From 6f7e419f1e9b580f95f3155fd6c22fc6cfc404a6 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 27 Sep 2023 10:45:19 +0200 Subject: [PATCH 01/86] [New RTA] Privesc via OverlayFS (#3003) * [New RTA] Privesc via OverlayFS * Update rta/overlayfs_privesc.py --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- rta/overlayfs_privesc.py | 53 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 rta/overlayfs_privesc.py diff --git a/rta/overlayfs_privesc.py b/rta/overlayfs_privesc.py new file mode 100644 index 000000000..5e318faf3 --- /dev/null +++ b/rta/overlayfs_privesc.py @@ -0,0 +1,53 @@ +# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +# or more contributor license agreements. Licensed under the Elastic License +# 2.0; you may not use this file except in compliance with the Elastic License +# 2.0. + +from . import common +from . import RtaMetadata +import subprocess + + +metadata = RtaMetadata( + uuid="a78663dc-9561-40a9-b4eb-f15e31c690cc", + platforms=["linux"], + endpoint=[{"rule_name": "Potential Privilege Escalation via OverlayFS", "rule_id": "ca9de348-a09d-4c67-af21-5645b70003d0"}], + siem=[{"rule_name": "Potential Privilege Escalation via OverlayFS", "rule_id": "b51dbc92-84e2-4af1-ba47-65183fcd0c57"}], + techniques=["T1068"], +) + +@common.requires_os(metadata.platforms) + +def main(): + common.log("Creating a fake unshare executable..") + masquerade = "/tmp/unshare" + source = common.get_path("bin", "linux.ditto_and_spawn") + common.copy_file(source, masquerade) + + # Execute command + commands = [ + masquerade, + '-rm', + 'cap_setuid' + ] + + common.log("Launching fake commands to set cap_setuid via unshare") + common.execute([*commands], timeout=2, kill=True) + common.log("Unshare simulation succesful") + + common.log("Faking uid change via same parent") + + sudo_commands = [ + "sudo", + "su" + ] + + subprocess.run(sudo_commands, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) + + common.log("Uid change simulation succesful") + + # cleanup + common.remove_file(masquerade) + +if __name__ == "__main__": + exit(main()) From f77bec85529e12b454f17cf4c039f5406a2d924e Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Wed, 27 Sep 2023 12:37:11 -0300 Subject: [PATCH 02/86] [New Rule] [BBR] File with Suspicious Extension Downloaded (#3139) * [New Rule] [BBR] File with Suspicious Extension Downloaded * Update defense_evasion_download_susp_extension.toml --- ...fense_evasion_download_susp_extension.toml | 80 +++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 rules_building_block/defense_evasion_download_susp_extension.toml diff --git a/rules_building_block/defense_evasion_download_susp_extension.toml b/rules_building_block/defense_evasion_download_susp_extension.toml new file mode 100644 index 000000000..743aed552 --- /dev/null +++ b/rules_building_block/defense_evasion_download_susp_extension.toml @@ -0,0 +1,80 @@ +[metadata] +creation_date = "2023/09/27" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/27" + +[rule] +author = ["Elastic"] +description = """ +Identifies unusual files downloaded from outside the local network that have the potential to be abused for code execution. +""" +references = [ + "https://x.com/Laughing_Mantis/status/1518766501385318406", + "https://wikileaks.org/ciav7p1/cms/page_13763375.html" +] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "File with Suspicious Extension Downloaded" +risk_score = 21 +rule_id = "8d366588-cbd6-43ba-95b4-0971c3f906e5" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +type = "eql" +building_block_type = "default" + +query = ''' +file where host.os.type == "windows" and event.type == "creation" and + file.extension : ( + "appinstaller", "application", "appx", "appxbundle", "cpl", "diagcab", "diagpkg", "diagcfg", "manifest", + "msix", "pif", "search-ms", "searchConnector-ms", "settingcontent-ms", "symlink", "theme", "themepack" + ) and file.Ext.windows.zone_identifier > 1 and + not + ( + file.extension : "msix" and file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\WinGet\\Microsoft.Winget.Source*" + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + + [[rule.threat.technique]] + name = "System Binary Proxy Execution" + id = "T1218" + reference = "https://attack.mitre.org/techniques/T1218/" + + [rule.threat.tactic] + name = "Defense Evasion" + id = "TA0005" + reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" +[[rule.threat.technique.subtechnique]] +id = "T1566.001" +name = "Spearphishing Attachment" +reference = "https://attack.mitre.org/techniques/T1566/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1566.002" +name = "Spearphishing Link" +reference = "https://attack.mitre.org/techniques/T1566/002/" + + + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" + From 747ee7d593dd638239dadbeb9842cf12a8c40772 Mon Sep 17 00:00:00 2001 From: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com> Date: Wed, 27 Sep 2023 11:53:38 -0700 Subject: [PATCH 03/86] [New Rule] Adding Lateral Movement Rules from Advanced Analytic LMD Package (#3119) * Adding Lateral Movement Detection rules * added tags; adjusted tests; updated manifests and schemas * added default value to build_integrations_schema * combined analytic and non-dataset packages for related integrations * adjusted machine learning definitions * adjusted machine learning definitions * removed splat for machine learning list due to 3.8 constraints --------- Co-authored-by: terrancedejesus Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- detection_rules/devtools.py | 13 ++-- .../etc/integration-manifests.json.gz | Bin 7676 -> 7827 bytes .../etc/integration-schemas.json.gz | Bin 2622294 -> 2622437 bytes detection_rules/integrations.py | 20 ++++-- detection_rules/rule.py | 10 ++- detection_rules/schemas/definitions.py | 6 +- ...vement_malicious_remote_file_creation.toml | 45 ++++++++++++++ ...ovement_ml_high_mean_rdp_process_args.toml | 45 ++++++++++++++ ...ent_ml_high_mean_rdp_session_duration.toml | 45 ++++++++++++++ ...ral_movement_ml_high_remote_file_size.toml | 46 ++++++++++++++ ...ml_high_variance_rdp_session_duration.toml | 45 ++++++++++++++ ...ovement_ml_rare_remote_file_directory.toml | 45 ++++++++++++++ ...ovement_ml_rare_remote_file_extension.toml | 44 ++++++++++++++ ...spike_in_connections_from_a_source_ip.toml | 45 ++++++++++++++ ...ke_in_connections_to_a_destination_ip.toml | 45 ++++++++++++++ ...al_movement_ml_spike_in_rdp_processes.toml | 44 ++++++++++++++ ...ent_ml_spike_in_remote_file_transfers.toml | 46 ++++++++++++++ ...nt_ml_unusual_time_for_an_rdp_session.toml | 45 ++++++++++++++ ..._file_creation_in_sensitive_directory.toml | 57 ++++++++++++++++++ tests/test_all_rules.py | 6 +- 20 files changed, 636 insertions(+), 16 deletions(-) create mode 100644 rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml create mode 100644 rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml diff --git a/detection_rules/devtools.py b/detection_rules/devtools.py index 5dfbf37af..f32d6af8c 100644 --- a/detection_rules/devtools.py +++ b/detection_rules/devtools.py @@ -1236,14 +1236,19 @@ def build_integration_manifests(overwrite: bool, integration: str): @integrations_group.command('build-schemas') @click.option('--overwrite', '-o', is_flag=True, help="Overwrite the entire integrations-schema.json.gz file") -def build_integration_schemas(overwrite: bool): +@click.option('--integration', '-i', type=str, + help="Adds a single integration schema to the integrations-schema.json.gz file") +def build_integration_schemas(overwrite: bool, integration: str): """Builds consolidated integrations schemas file.""" click.echo("Building integration schemas...") start_time = time.perf_counter() - build_integrations_schemas(overwrite) - end_time = time.perf_counter() - click.echo(f"Time taken to generate schemas: {(end_time - start_time)/60:.2f} minutes") + if integration: + build_integrations_schemas(overwrite=False, integration=integration) + else: + build_integrations_schemas(overwrite=overwrite) + end_time = time.perf_counter() + click.echo(f"Time taken to generate schemas: {(end_time - start_time)/60:.2f} minutes") @integrations_group.command('show-latest-compatible') diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 5303e11f2b397ba4045a1f4f18580e7e841fc010..897bd5e1acb4041631653990037606909e06e1bc 100644 GIT binary patch delta 7498 zcmZX3bySn_+r9|WJsN?5bfc8g9nvYSln9IxkQfY*uE9nlA_M7=lIXgSgKPk8jK1&=vzVb1#Loz-K#Nz#;YF6YO;jpQO zaq*iEYmFato@Q(RE?6~h5vR2P&?+m64pVhu$@2{N-UWFA9biCK(RN+-!C)a*eKx<& z6WJvvQHG_vV1TTn`)$wFIiu&Zc6w7N%}S7wbn)lQv4Cd@H5v>;Cz56^dS927&=^a195j- zyOg&6F)We&1CA2a?eV+)w`iB4D{CxuWVCPmv`v6T?K=t*tO78*$uNa{iaP&3^$lEy ze`0oY23;|{w0Kb=K4x@!hq&FaK|xpZY0O&Nj(CaQ>RjcAb(m#$T{J9^-=OB!8qdBhMveFB)P`9u2 zgv8pRvJQ9A506#lLr?g=UEV$#SE&?IPG(Cdcb4>lD0*cl@bczg+f&f)kNjkfOr(pg zD%9&K;Q``)q;nOEOkh}x?frJ?OnluRN@vO**~1lyCsL_S4AmuOv9(O5lTD`+T)0n+ z%=UY@yGDDe*v^4%8_6-JJeqnBJ-F#B=~8K@_6@z%X@nudgt5 zh^z(`dy|0%RW7?^T$720tE|REPH+Y6n@`2{=I14?rvS^NOC2xpdtEOrPnE+awv}O@ zmTuo+z%M#){YomR+&~<6+_NCi!}cEike+0P1$q_LTS9~y|VO{b9K;Z)QlWe>aztO9tGKGa& z+vMFRxm5Og6os-6`?QELlZKI+0+S(1-`>Z=r|Xpujy{v+8(|ZslCs1FV?0y(cw;pR zR97ml9jaPmcg~43yEL(486JlH3KDCxrqaM~t7#AfmA;9Dw(U_c$Q~9Ship@rEBqI; zl<#q!!f`K5Eq?(Uq2|QWl|TIdAxtepgOoYJnao?p>w}EqH9oU3v!1j;1}oORsLuT6 zEWGS*@r6SJ;na?Is@%>?j%b57){sZ)s3c9;SH%$m1F-^1<&ud}oDv2D4VX~|BQ8cU z=IF)CJMtaId*;Cx)PwV z60dVMAs|h@G}1_1pI6J_-u;}tMA-0AfwMZwjx-K(d@w3d;&FzDNf5w{1f6-+>xEKZ zmX}yg8zq(UP}dhK%28vy95DuYxrFxvVMf$_bl>#<$aCcqVR|8qXM^%AFVaQ5>j={{&{K;CQMBjrc^#DCW#D~ z7Fp!GF9ldM%DAF7U`o;?|EidM-}v72pVf*%yzvGhm>r$+sjOWVR@~9IXSWu`V!--X zn{J2JOST2Xqq_d+WV!EGYqKXy;CgpWp>CgsgD*7$#p-&=-V_j! zR=IkAl@VONt_+|}t^y|~LHJN;Q>qyLmr$tGvN9;|v1MsfjfOgrSHwAy>Wk7M6zT*K zP0C2=Xk27-^d^PM$$w3{R01LYF%?|%xrXv#-}}S-9OM;6qi0k^HK?=|?nxc9%hSsi z#ELnW@*ade3m6;el0#krcY?8JB`9GuOfzZk1xatkIyVFX!s(vqAoR&{=s0nZFJcO# z5pOccmG{`Qv?)ishC-4Nsn_7#-Rn*Aae~L60G$#7%Q#4hPYj(BOv~&T!g^1rFogS_ z6mJpH{U%xV2EUJKe={KghD;reKDmmlUOvaCl9*x}(R=mUE%F7-RSnWF(h0*PA*yt|`*RqxVl9@)_?z%!6d&=Sc8>(q4-(P!A9dqig`CyG zJ;KaL~f;U1bs(ruQ{YT;(5ca-afM#Sr6UjT>d%p4&%2bwrv80D)-TetGNw@{!ILBv(d&9ywxf>Cr0a)J5b{|vpc2(*!}$fB5c zJ6Y+-T`r4uOx@^9Uwy}$V&lb(8a-TH;U0-AQr#O5zI8z^jK!L~Op(3&>ahYXs;bHY z#}<}d&YXN@eAmRcv)wNLyev1CSyO7J)8&JzLtu$rhE0r{%s#+As9>2_lX57B=Xpua zrxy4pMX$G-5FI4!#GBCSdI%L-VEt#^8Mu=g1T1?f^)k)6!`APYWs@JD*tb`?Eh{si z1i>87S^An)!ui>EyTEloW!%oqYtsl6=W+6> z53LSg>%mWB9B53@QQ7?UKM>29cA5q?bcQ0+_Sm+dcoFIzZ4+|13P^g|UZcJm((RNP z%2^f=pEloaD*vYLhaQ}I-QM#PlXH!toLO}ae`2kYwh0W@=ah-5e?8qV^}kbQ@H?;N zalR}|5FvFg9^%DRMm|;2p5f$*Tie%ze`R|6AN@t|(>PB(jLyONUwpzD_a7e@R~*eW z#s{hYB3x)&JcNre-j9}Md^8PNu_79uyNSq0zWC}y&q`NBO=*DUD zM`-e+=%Ng&16=d2@O`-RuHqqi2)uW~d4z>}*eTO_;S3%r)0D63G6dld?M@$dAkjg= z&Gd&Y0jJ!1JZ4{Kir7c?GRokjdm*~bIBFv|R$tt2G3+=kU zP)kJ3{J+bt!46OE^P;N+T;9eH>jwr0rpJtN?O}m$55l^aKK{9BJf~Aw`|T0+N2ZC0 z@B>Tx`PzYDfa8rSocgDf7a4b4Njg-2{O`ITcibFQqn)vyhrv2jCUt3CI%^p-D&o6L22PR<=1U&A zl%r5n3~LeQBvJPLbu<#s6gwch;BKW;!jVv|NNXT>5LoihH%?btoME)> zkFDm$_keiXzM|KvJzO#mw)iQQg%`etKlk6Km!mdb+!zxZy!{72x|!9^sW^|sv-&LNvPxxIK~AoCdAO|se!+b3uVub zJlwe>*s5bFM3R8FD6!d<(Aumr?M;@7SVl8Ywx=51e%++|PD-p!M6GG@5Wsm107L#2 z#QbAtk#k^^>+93acy&k6e)a#t4M$1efi?~<%>pxRwDRI_zDRihyVJ1p6cti*QQ1kH zBFm0VG>TX|13$r}sEIR6H7oslK$|c{7Es|tOLX)})@C;TD3>CURya*k9swXPc~|t^ zV8kPh)^9*<%x3_yj@5^&n4j1!UM&$VZ8_JA2J*z%Icn{b*s>Uaa71_UodJO#=c29{ zuo438t0*QK@s2T6(rvc4b~NO-qUY;hKC2<1jCfIxl=yuK_08?|T~1*`S8ThK&<*42 zR8zn>y{q`SmbAYI-3|fv4uN>UqF1cY-vlj`mTGj{oJSD#mmtB&^)O<>Lb zcBy609L}4vKO<9;zoxEG%f1=?STEodGlQs+Ni><9;Qb;KYl56ukPoD)&{o)6 z6ZWO5(1l3FKf(wgc?CYkDVqnsaVuKsrzQyRt>j3>MVf{nHB|6qT|x6qWW5^l%nIUaT^6$m49UlmEFyT2I&$=&cMtCu0_QPF zr;G|gC-CDMmS2&i_P|E<8rDS-{sUTMA|82b@PiHVI`r1pmC_3x69xges2oh$R}A}< z>fIOSJgEubFbuThps1Fn-`ZqCVRG1l?cTR3k!RD-jSfqY*o6zWUhV?wG@B1iv>>gZ z>18IrMc32s*k~p{sXDAIQc_qB5Pl%(@y4qtJNYWhQh>O~^6h&GD?8P(<0ioz_Kse- z=n$;sC$F{V|u-*&&J(`4mHN6+Bf!u`A_DgaMj#OnR#y0CEJdI3Y zgH!e=QMSIEv=rdUZuNr-N2dI;f>dugYv`x%cqXuJP-^)1C$Z^tEm(4HIBQUBS%E4O zyy^=cuGY2pe_}PHEj`qF$L{9}Sfe+zxr~1XBQQ)lGUL=%;IwhsY;aMb5!UhL(o#5c zKKX7V^mK9o&6NGR1HIG-FIGH0nQfz|ixu%C5v!JHLQ>EKxQqs!?(p^GLF(6hxC9q$ z0^J}Dca;vHky0Y39>CUl`qKWcu-%S>eyzW$ig4HhUuE2D{0>tK`Y!xnu*(xCYjh(+ za9BdFD2&DC(pdG_u&Vw=6ve-bnJte5>EPB?27v0}Nu%QxS^7Du!TJQ@acKltACEIj z*_c`U(D7>OaKm^qPJ-S6qHhjPT_cVK&18FH>$}>tRn4v)AB>HHQ9`Q^KQxcG3EKu1 zZ9F=tE8zHT^#vUi+jQPK6`X(Kc6hyio(cHST0gLQe3l`agmUK}_M!;n=LzH&5?W(c z^4OSRE*n|Iuy?32<}%X2e=lpIPuOq9vQ+(%&DWLAXzewR26ad*4Vs! zc31GiAqCB`6V%9^72ugxf!N>t`H3n5zBCli_sibU4S2%1#BTaSgVIemOFL~~<|>Qd zhtuQo&FAvMnHF29rZiXEY1svW>Cagf{|H2e_K%mZyB-6hvdhmZvj7h-vX70YnSj0> zajsz>JGjDy5t)^2RgCxml;ir)s&sNF<+|HUlGxGoFamdmd9vDG^ zO!mWk9qrmDa1^EVox+}phEC{EWxXaQfvEhpFY!zhqiTTn^_wlQ+e#U`!i2;Nd`qY4 zlnn8IE9ddFPq>ErA|_nhCm!G9j)DE z@q}kLf7xyBs+I4KcBbt177Vxpi*$4;s#F)F_otKRdj}sYv-|E2258Ow*;kG1Sr~c( z=pC%Pz8+~I`I9f5z!eQ;&Smf0+J#q9DM5~NUJ~v&A9*II%T0zn=1GkD7?44ev-fQ;OV&61%wBX@z*kd=tt zB&ELU_aS+N2E~G!yN8NC?>JC@vF4gvsV&ZnNsi6eLE^`Bq-~~gJE|++R94ss&8Y+} zsF)Fw0j{&!eRePV)OdyJ8@+pu=DP{V6LsFdk|+-0;YNBAqR4Vr_n(IdB+V4)2rtGS zvTCi_r!vJHXXgg{omUtOZd2(ZAg-^7SQ4%U!A2F#7O~H6{A^sGTl|4K3BG7*L9$LH zpEfKEUVTLmUilM!V9-Wfu=0*EkAQZ40%zw=R#WeyY0KnxXD#kBX>u}ub=PgNawfh^l{ zqUAxmq4N{$B%F=Qb0NFQS}S$`qMf~`uEGX3&pluRWGbB5%e4;A`O6r78r_sU`Frd# zdw0G=UPWUkQ#ZDDn`0#ZFaDJZHLUT0=Gg$9f!8m;xxE#b*K3hqN?dSI z`iQ6u77QtiK3ZnR$3$Rng;;9f+fo)6HNuj5**zKtQp4FeLk*=X z*`tg6D2x0oHOO_3*maH?VZhI;8lP4@ITU32PLgp9DP;u+L~}C2e(iCoF~;&xW(!b? z7G|({&ao+!VZwAwSe3zcgbAhMcqnrPU=NZHAuiS`?gb3e4|JlgiBo zdJu{7+*@9YmW`Pd-|!cweYoci9{cZmV%plw&(M!HXpLNdL@ud}0mc%R9)2i{GC6C* zf?V>Mk7iABH&_Cc1~;d_b^fES{nf)CddcmmVKJb={Y_>#t?^*}mPAzkIzDYLEn`zt zKI9+qyhB;2RR;L+)7&8^GL{JbOkiNKV4}j=TqzMt5>(-A9*7qLCid#Yr^jp0Pii6s z+x{62kQh9z%L^=yGc~(otladkk2X14fut{D+rtAwu5zB*NEi;82nlqRzszN zKh<2J(F~*am#L!HpTjayqzi>!9rMEp)Jv3nX zd`50F)+(UeDIiQ;mqA;X67Iwh0`U?zgfE@&0I;a4Bmy4C5j*`&L7K9oGStVnKl^hG z{tZX|RaYbNnf&a(mreEu@(+C_JKW>$-u$DPPUv9rTkzrTTBb47EdWw>iHJlY!Cqi- z`dnegT;R(49}VNI3tL$U;~Z-M$2EX5c+wRN3m<>hav0Fty_ad_Cu6$;IUQ{n=UUjx z2IcBD=w>BAy|=f)W4;{UpD*?tV}lI zTFTnm=N;Y&P+nQIHwXhRfSng#78PfAp3&*LP4($lBvb;CJ{YrA`gSE=vw*h@n-z<< z#rBnQGuC#)1j(Scr;$rOU$i#|CQ4OqCdA};39Y=J)pbHrU76Yv=D&CPXP;#F`oXui zLHT@6-qZ`E11qJ>WgJYEY_6|m6XzX!;?cDL8!2}!fmdhh5 z)J|qTeh0Z~pb=^{5f!>8G&jituGqX5(*y#pj}io~*evEW87%%PH+(aenNPDh^6zL! z*Oz+gD-qzv-B=#AdrP%-SKl1O;YLDu+ENbrYbgYRh?IE|A1oA|rb|-|cHz%1-qkj| zf0p+5VQ~zrK0IAfn=~q`F@=&h(nzt7hkqNP%Mvs%eeS>+fc? zsz~_y&rZUH-VjEOg6lI$LA=y+h-oM3Qk8abT9Zsl9vjepv9uwkmwqM&bflfc;vRTg z^-pMhUyY<>_q)(XGbrO1YN2AH=QiGBXc7qP+qi>y1*^d(#0OtJTCc)wvIi-R#Cogy zU)CK$UYw(#cVA3=6~xe|{p`r=SQ zZAyV=H^*cy^g6OpwS&U|7lsXEk3P48m7mSJ%!q5RuK2~(7M%+FH%omd#gE@M3?3k+ z3Az0L>4m?4?-6cV&9~99q^}J!TOL;{yBJMh>QXCArj$|FFfq6VsvAFf42h$CRQ}^C dmu0ykaLXE(+vh>>2eEvtY zt)ZY&+dO;}CYh;_#{<+A>?zqt)O_${wpJ2XE^o97f;YF`xg2OXeT=P>ROpozkJj2~ zJZcRLFm5_Jcco=ric*{Z-M?FZ91No`Fcd!x+Iad+cy>1qyk{rwcbXx86l3>RzH{tv zt8l}P2mKIRXL?-0-jc}6HXrQCCjWqfd0(ba-;up!%VVY&4NE|f{3FA^Z&QJc$fJgZ zDjz}88l}I7$T{sDV*y@aHQkfTveTv6CFFUYja^gojsO|E=FTq*er)skI;#w))v({m4wW=FS!3~Auh zFnx4xurp|%^Xvt6g79@vhIz=r(U9-g>MfZ?PB)U={bGP>xnV6QU*Kc*(0oQ<;;dv!pgg`jywLabkQK@b`W#2vD}pHE0pc> z3|GR*f^<{s6J~Q$ zR+uz!I~IyxiCr;6?i$`MVCZXHi*!}}(tPxS6f>k#YTi`9MMrTb#DB&_sy zS4rNR^&e! z3<~`ZLaq>kd}0h1r`KVkkdQgM#gy{@FhRUc#qAGF!*_V(k@wi6TI4UywQHS^BIqc8 z;c|9^7w_7re^f^9nzQvkp+lxkXnPkEYH|$#r3A(HT1wSAFj46ev`#1o4fY+2t}2&O z63D$>3cnKVbKG9WpRgW$rI7;(C2TYYf1+OU;)|4rN)ZUTD|h;MK^yg>|C%Ost~7{p z1e7MfL`mLB+oFw9Q5V(6rW{eMa^;SK(Abm&>j)M54Ojr0Kbt?X(tQ1UB}gar$*U3- zAHH`(2&KfJL0Tj4F{3)Gg`s#aM3ZY@`)b5!4w}>Af1&?dL~+otEkxiwCKw$9Sq80< z{M|QNCkY^}&6i75??Egy`IBi}EJ_jYj33}bkmGsrb|w!-u3hbaA1IQ=_e|oT@%wQl z8X?7O{I6OCyiNycx5|{<&?3R;!2Si}P5-t=Q>PlC3A#E6r{p#V)o16^XS0$m5k~aI zDVLPI^9SHH9wRA-CI=7p0P%i|5~bd=KhZWq+y{O1o`Vg0s%yRL^u{`vW7t>?@ znjMdR5l$PQ-N3YhTReAFH3DUci08yeUX;(dL|kk0ysJhT*iLg3?-!QeC!^}U3KEr@ z#cM5|JA;?dz`8Egk_rD@s)wll`*-TJxhOi)Sjkf2Ni&MpM9I?n38O6b ztuTa1wo2+=z{YYq%V{LP$W?gKDnr+=|DM3de*89e2HEhM`ISbF69!^WLh+M5iaT+u zVgg+q3(H~Dt^KIa4Qeg8Q`xH9ckpY*$Pu5=%?(n@1BQT&#dMaF$dT-;)1@vCa(8`i zvcbK?JC(9akZ0~uB#Q-6xZI9DsV_M6Wt^6;aXrDz55ODvJZw=|hK&S(OSo!l8F64~ zb~nk^YXT{jd2M4$PRRq9^~MWN79gRVY~3~Bl(I10@^W-$MWf$F z4m%Zayglf@gyZ?nbEze+8ZrM;Ew6+w>p5e-;ol#x4kprDm&-Q=;dOGo%Y2_m0da{| z`+Zh=zCz<6urs8y0upw{xRme5<;U^c;9BKRI_k~$sTPt{(|+UZJ?o0Cy2+5FXWDMn z?rvLZZUCq^lT%dw<<||ZRkV5qIpn~PT_2sVzaPTm{+q|p?;?6G#C_?!JlW=hGj>kT zDGr+HI!0GL51QEi_Cvad{r0EsxCl34!w@SWRlS5HG7TFcRVYj91c9~Ql$DaT9=WE? zfr=ivowXhaQfgN%;YT#$TwN6Bsj5eTN>SAN4p^~r8X_hQzFYaD8O}l`fYm}8O##IB$ws9BruhBto zFNWy7Lv<}cOZ}h0cxvux=fbP=1xjbv%A~1w4n!=cv-qDL%AM_v?R!`GiiMgvR`Cm9-*+?yQ5*l>E6XuBTK|oI(5|dqag?((}@!$N=sjV<*92QnQOc<=Q4pOuSaw1GrNqd$ov8i{AmT(|i{yQb#I zXZ_v4)LW7P+uhTJ`va$SY}_9k7MV0?wfUIxvetS{HE2IDCj|(Hx{?&{^`fS$wD?$< zgH_DibqRL+6NpHv!+ZH;Q!h@9>H(JaMcM?SyVZn?X%D{Z+3FSXnnjlR>40YrUr|a0 z(YYZRyu5GrVw9cR-wIMpgmm*g_2OVUgSFO)zE2hG0+}jaeB|zHi;>(Bfj#m5_Ki<+ zXB;MY)DpuP{M>lxSHn8p#>z@Ag?Jv@DDwn)kNw7hdOToOf3df` za2wr?E+e@({SZ)bZ}Bb?qt6JJVP%I*C1jqLJ5IAy1d+GB-jLS(N-WxBxL+dW#GB)_ zk>oolhXkc%&vWDdX^9mgB4EZ0k(Aj=+S+&=66|6GdO$_Y3ZDf#jl#z%N0N=v856 z9lRe$BU;3fz=64R)zD)JFOWQ-dZQQ2q7_1dxwZpn>8&n+H4 z|I)3F271(YceL4dwN1{$5eM17N-zHpthPYv#+wnJKg&!lTu+2y13M{Tp@gdMVCaWv zoAg_QY%=aD;mZlRBviS$b-^*Y?}~f7sg+{AsB0!*8a|1Bnn=K$kUupgS^Y=<`!qe#=o86d2#1F?u^>EE&?als1rrJY{G zDb6&^ALY0re+ylwKaw(glykRx6YWz^S7pjUe!EGHv5E|pcr!jJ@#1DLW2VV8p-r^Y zt5|`mCa(Hj`+3o@!R0Ij`yKK}5*92HUli2o6_KSgPj_yQT62G5%jyIC9QRek3lAn% z-}zh<`-Kg363A9Bz^%NF{OfTy9y3zzcxIXBklySP_NsR;dnu-Dc9c(yb!-ys-0gE| zUH3d$I0%>eb&`3AuztwVbaK(?Eb2i{puz^u2H1P$bi)W!SLBGyOA)LE!H^hT!CL4r zle~lW@To}beff>=N+R# z!o3M*BJKVTuw7rBrU(&HBBZ>_h?L5LT#vXF{~|~2?lsVt9YV?>d5x!-VM>Q!o%s;Bt4 zs~1U%l{Pt956ON!@*t*{GpsIeR9Wp2h!!5>Y6Ar|{3;(mXWQ?;*J)g}qY(HlQrJ8& zR8NUvCK}NY2b?w%!PCqCdVR)Y6jbW_7wKvmt8e#-c~zV}pK6(-`XlC&H_EmPN(Xxk z#m5Rzi)lW|1K&?fZI&uU)&dco!j8V?uUqU+%qtI?4{a1HAFq3M=EK~3Ni8!d7nk%^ z9>|*(DbUF(Cn}LxDw52w+Et_`tC}^vxF@Upr()b4sLLv(7y54Zko?{+V0Sl^9$bG8r zA?ZE#Mydi9|GJZ@N-&+B({`$AmHGD8yr#~>lM`RKpe#S6BA4xuO<1fAGiBsHBq{Oq zNBR9(z;hmRQMYnvdj>ZituMm{L&aT#fQhdav`zP@gHqUC;BM_x3|g<#TX_=7JbTJmk=TvYH?eHH6~r{Aayd8O@^iG* zoSHYQB<$Q5iug9*cR2@kU~Fkp_WR2gCaAm%RJvtIw+z~&yjXTO`;QL%OlGD(y{kNz zH~FP@^a-rsxLw=yIWx63znSz$qdNZ)^x5W^*mmu#ZR=3R$M$jw+O&r5{E)IBC(YED zaZ9BMOJ85QqkEy;4TlD%GfYSKluNx14eG`h%$I9K(%HAmT$7i|8@;XfoEf7~6XNhW zAa41jLJlyPd!4v#G(yz+CaKZajrr?tfmudDKS#5uFuVMmRfE6+NMs_Jq37I4xR=H~ zDSQgWme={Au0{h{E_xzlbcxG3PQp9S|hXKq%mmO3c z6W`-sep-aq3nW}=&ycT-{$W~NPOl%xyPc6g)KcgzVW8Yh4#7?^I&N5v8a)U`hh1Si7#(wk{a|#|6?TKs$SWKI8wKOh z=ravkuEDi+xNo4#by7m2cMRac0RgA`VMLRwy)d!3!H@bA(HD;INBLn9Xiq#%Jb7!jyEhnpsrif<<1=P07mgS-FcPT4i+R_V~(Q{{qsY=li*eUkC-A}K%iu)q|t>kjqy`k1&YdxU}5iB+# zpQ^f4*1 z;UDX{;cAyF$}2<~!gE|rk<25WOxnUDZuIGo2CqmBOA0CTQYas3wjS?wt1oHt!_Q)> zg)fGzDerH{@nz?k=KHh;A=%fp|* zGB+3Plfu;Dm`c-&*+SVSlh}h{G31%I*0r6RA706r7~fmBifxP|7H8ft+Yr4U_V^3- zU7eNe=5^1f_Gx5w#6Jd$B%nVeHH7mH-)Z!_*GYU0@pE{ETbcRIYMdvB_QI>JrOKUY7VLg)-!ITMCJ#sI>GPDB?rDVt5;M^dhPJ1L^_|YI6>#j0LE3>-n6{ zi661j6V^EjluII^HYG1V$(<_-;F6@mqB(E1942?HvFNkOzMlIm%A!vh`j&8=vjPI) zC&}1!WzBt~^ottFO)}4!)xpW6PuZa@j?fmbfV?U6p)B+jwM75Sh6a%*fb-7pv&GVb2fY?5c}jxyGe`wZv=OuZQ80Wq;jhtA931GC$ZF8^ zdb>L6P|tkSRQkzI!T84A!*_k7&L4%|(^;gQzK%N+5IOub*D+)E*nc~8my~PNrrr6` z3du^BbMUjZNWH^m;MxhDQ#bk>N4*J^Y|rVBs?X=KhJP$lKL=3PjdXrVMyC>9{rNaztRt>wW*De@>oT&r|e+K;=ES zuN6!Cdau|ba*4{c;zNUM?dj)wa7gK({&T;0nJNaG97*iu<{TO3z!}gPL z`jC+X#i7+KU)G-eaNNG)3o_4dS-$`G?ONE$#x&N}TggDe=U```qvm6pQm6p zW43A+`#=}F;xS{*ru&=2Pc{qgy~p7b$AovY1sSp-b9)24O-vvD_}PHXkOn?LV9n+p z;_$>~Y6Z24vRQa^U(6`G#H}^L#qEXeuZcF*&lvG1^ zIcw+fM>10)ESU#QVg(rRifb;6322;pcTSl*vbIUAJI2T~0o6)*BP z!kllIW-AI4Oy9&_d&e7Zuj)aRSV4$qNs9U*cuhVx#yRrlMxPpJbn{O+zQy^E22bRgQp#+r-7rq;qaBgGVf?KVx}Ppo zbpV_3`%{m2+-tnA2(3D>o54J<4snvQjuFcZDbM*JZ*Fx1{|PcCtLJ8Y3H#JMxAUQc zKV97;OYgiWr;L94qOIo(zgtrqDm%&*a{baqkXak=H~DOIW51Z5)Sf0qT^GGKXMYCh zdR25MnGp!(QVIET{>Yd7(eXZ6BUhV*hEK)uzjvvSTfsk+eX4USg$FEcQF7b>MwjAk?|O7OYHezC3LCD@96mQTgZxE_C2+bRW?hV55 z24Q-Gu)IOo-XI)r5Uw`}&l~jG8-(u-BJc(gdV`3(LB!r55^vBOZ_rzB5NQPn9PEaC%6c5nQ~{oN+a3quQG-Ktr$NvD!L zYw8z6wnbD_IX4bg3KY6vC+sb0jB~UMgwq%`A9b|v2ds3v?&_7okl7|C|1pQxWiC-> zbk5T;cP1~99K|v@#i`Isg{mSK#Y~d{`omPwY3_T3Kmx^^?@O>4+{G8}?MRevnupH< z2^OxGe2-^Uh3lx2wA7q~!kuEL)Wv^N$;!6H)r;ti*2TB)ShH8v`IK<<K`~R>S3cGQL`8qEv5qW2q7~QcB3dH`o;{3 zF`Xq^^L{vKLDOc1;(mN=}CK0U&JMRr~`@#c(6!i3)#^$~7!(|m)eruZWYqGuWG4MgIxmRZJYh~vw%@Kd2gbi-(+1jxh zJ;8FNS_g{naI=}`EKC)GIqnapAH`?u=i4xSk&Qz6Ns#?fFgnoG%YB7UPilT92($0a zfWfEmn&XGX{$lKBo-llQJ^$kh|*4BF{fB6f9 z#6f-l&CTk*8+Fj(%*3wa@pUlTd)!lngBSK>1+ zA_pivET=iR#gD~fT)6t+C0jk(vwp^`sTTD^hiS>vcKv8!ptf91U$RJYKhZ1sKx}~l zOPlAd#YF4Zn;srKTRuQ+%*i&H>JLQVC9+l2!IOSKSjr$2=yo5X^8n7WH=klPRH5U4VXN+W*D~;a~DbJYv1Xf zPYk4=W0>yYUFh-w*<`AndOd-9`W%Ez_~FZApjgrpfF6BkKX{U`ytc9L_U4SKjC`9w zZL~VzPC>DhzBr*!(&|F;d{*#$1-Rwazi!Gn`=E@!xHEg4XW&Jpqz2uDI2YxJV0;u~ z=GlKWsmv60CC*g&3OhR>F01in=z3DHK;=BbJ^cIB`oW+5O`{A zb-MbM{drL)^Vu|(gp>7XRCl{7XtpxDvXu|2=u7!$T*%vYKIA#LpagFlJ)oeyKml6x z9R+R)YF~Bo?hC=v7AWs$FJaLT$?%3O7Qciqqn|n44!CVQZe-qt*$OWX-0{yTDc{6V z&&fqjrX>i7OlrC{P88TNVK0*n@JX!9lj#r|#HLUaXm~QyHI;t0j?G}5zF_s6$1yQ7 zS4r3scW}JC?Yl1&YNb1e!2tHhKAjVv7__-B`m`eW;vzERnX@c?_j}fAd57BOUNBn; z*HGBBju+gxhb+Qe(QNS@kGWG-NvV#tRaZ<&A-f`!`lp(3jC5$#MKu3({aBHE0n%eoDyWtP$ z2%a1x-YFC{$I3K(=l}u3N&{y5A_4}Ln4{W&$(Hj^6_UA`^Yyjq__16;bIDgJZWH|s za%U!3DzGL}>F+0KG9@OEbInCKpF|Xl;Y?*-sRm97h9uy>k2;Gwb(l$H!wDlJ3)SrH znk8vpMiJ|FppYY*LEA&7gQV1f@uBtJ#Kw_A+}FWaz}hII4-2cQ*|(yG#4Fk7hyFMx znTIWyUKPebPK{LupCxtl1qt!n>ZzP189CE=+KIjPHe})`hiBxw_|Yom-6?l4y^izx ziDwu|w>m4FHvAO>dCt1Zmxyn3MHFhZznlr+x29ALJygaci6C;8fZ)Lwos17p9|T*NxKhDX&&R@39tlx##*Fl z(P|SPI3Qb;c8d|Lq2zjL%UT(I;j5vMpU~V{x<~DqLiFk??q7I z5v%P~FV77|-Xi8oC*r=lvB#ICU~F&PX<7on^HX*@L=tJD+zR&tcW-Q)zQTW(Q|2lE z$!KU5qV@cz0t%dhWPoqu-AyZXXezdNv`ci@3k&J3TF{FI<AVG>|490vk`;r$$t|w@-_g+=JH?SHN z`BE@gi*52U@;0WC`n6$i6&h=>qX2<QqxxqVObx#5UKvfD2P}kEw^>Fp{!yoaR1xb`YmZKPnfqiep`3 z0h)!LV02UhzADF;B!3P4SlXr^CK8fr&Y-t!twd9kdBT1j;DC%O4xWSX2einUG%~h&txCX4a}Yrm%K4~J%D~3F zS?QSF5(V1%bGkjI_Ad13bKT`yr3~B;YUnd4Y8JP0n5cv`>^j%?OFk@#8Tc~Jv}9_& zCDf-4#Lj3_KS$HP!|c6>C2~G-=dcn87Y{F*v95_fc77k%nv&SNYL#6D6c>GDv}TU` zJcquq7s3^$} z<~JjAEr}0a-Qhll5nf0eD0QY3=Rbbt>%E~ggvZTEYRQDCFqWH!$oS^#;f>gLGjrXm zg#q6Mt$19>p%7BK{_^-&0GT4}2`0riWIQTd#KbUq6%l96`fMx)ZrqLlV+8-G5g1G= z!l&4Sp;X_{N!5vozB;9DYYw+4@}zo~bhN{f@O2z7!!7#=qX|5DlW6FW%5>g8+p3;i zPp5<#CZx#pF~@f|=W^ob4}l(H4aO$3!4>DeN?7g2;xFplg>Lhx4uA<=S!ojD8EJwU zz2#;bgB?55S7?A{`Ob@bi5?vInrcfP(-Key+Fn66@4XH6H-zj6|vH8c5quhkWg z^EId2CPKRMAM-qA4?H3{X0#LbDjm=A%}J2`5UZb7e`ZdkXEC~?tsNUh{giERdo0LS zQXwYs>h!#7IYhS3CRJ`cq9SR;6SF~GPY$k@?sgd3^f-36bljB(lg7J7Ncxgful){bf6~dfHV)}_PVQWD4slM9;3=&690GgoY9mQm8$5!mY4uRiK?BH>V6LqJ|nMxMY& z50~P&Jp0l4C`mse9MM9cwvX+_NX)J}!1IL$tYyKRY2R;Sh6ItM9_VN;se_a)Tz*cO zu|DNnY-tYFZDV0R#N@hG%rGCdi*$Q)-`uJ+AIHMB(h>1#Cq#S(>C>p45*6SjMo3bE ze-m)crV-su|J!|>W_a2s!1uNgz7^HV8uBe*LmEPZi#OqaV1+ayf_`Yjf`NNVfixP7b4w=Z7orJ$fWg z=*H40_sB)+JTw_l)LXj#ed5TN_mDV-rc3-v9AAk4N*vFb-J^fyjS$N6hyQX(=GDN2 z?CaMy&#Ffoyk-14$#QzNow?(xq?+X|jy|3Cr|(kgE8Nx0^)vUT<-bWRj$XVBrn`Xk zUeSwttMOb-@{HD?-iGsZ5tCDAODO{0nR0sOZqr^i%YEYVTbkSWB_6zWr2s>>6+_5- zh_)@lNTv&i-TUbtJ~zpVv{5wRz-WU{?&a+bU&z`X*Rd!quyp5;L-oTa#(vPCsqgTI zVFs&e-pg~n9TVe)+^ug&0DU8mJ^S>%z<_-_Bc~C8K-Ig`uwDn8-WHnTRQ81O-t2|6 zm8N+=nv1_vMSmz$o~q1GhD#a0GDSy?W)tn|--#mlSEksByeT52!^nsiC^OfU{Cdhk zKF}Epx$h$lTr=hKGUUFiJji`3nD6PiCd7OZ%mL4Fm+%bW-5j>D64ZtSw}EA!B~(a2 z5SGAi5zXPTu?R+|vT_%E?6{pFAC|xjP)QK6b}$RlS=)49=(}iG#0cY39Y7RPzXYZR z%*hJ}kKgnhI6Ox}=J;^%q}j8m7*}T*I)ATsDqfp^VDVNDSw!G93>`OWNp>#}l2N!f<`*hck&_;(B3H2i-~344gHHM*%%WB0s&E z9~VRejn#mhD}z2zQC*^b$3)m zK$9!X2&Da~f4vf3n`sPunLm#zX_V;?_a~I86A~I!u@}tUi#ak*>4B**ho6uU6~0)f ziIl|KA^%E<9)5^_P-SjPp zQ%<_~wi|_gCQ@9xrnsiSMAJlR&X`4MiS@H*a+b$q3X8Yxflr- z{uB0tU2vH$$Q}d|k=Qz-TF7o`1*6FssV{B3O1vEE+LG?HY4pg{28XbZDV4dscrlc& z9?1%g&vYgD$K?xkxJOVwJY7>cP_e4>Y#gzVE*=kw-;(s&G>6}(QpRu<(cYKy^E+|= z9RCds2!tmO>>*O!;McEwt&Hlp*?EGROMav2X%)~7hJu3f zhq(8E)3B!<$XL(Zvpur!-1%&$-@P4Motgk&4Ru>UID5fwfc57e)!KX+RyvdJ2Rw~4 zGN&N73O8-Iv*wg-MmC%4TMN@k>3f*rP}L$NbNA@K*)1~|tuPS{$@TWqR|B7)K6bpS z#O>SJFnK)%2|FK+s<)`-r7V7RZvO|DL}S}wg7AA}-p<&AljksV2nNFw_i1O}^wW`p zYvSDc9=?r9U~*t2n2zARM#W$@LUS}vYt&hRj?~;+W3_=5jM*nDNw)M8Xk^#)t{QAZ z-z>M+5Eu^1hS$SzW^v4 z)c43HVfgvDjng@D+^bn}xSO=|8V#mRb*weXJzS zQ0~+Zs4Xz$F_xF0;4~TbV`im1miU9kK9X1n!K#A-7oup%k=8y3Ey40NHP`1$<;!Q$)#NGDrcv^C*5M`M>~4X{p(-GI z{a{9b03UF?X*Lf-nUrMN13BvzE5Q8m^!W#hUAHC#eg)6(miR1iidwq~uIqr$Y%i|L z_tx?qMT9Mizn30Kq|=nTjWNQ2SvuvB-0|$0SYxNDGvOK>+{Wqh);gzq6)8Q%^`@r9 z$TSlwL_$pGT&i0jB)w)AU)@XP-47rxD2_{Q^#B=PaOof9ufc8oALOq$|6j;oM%2HO zKUcf|k^KD^?#CngPwodikiUYUe<6R=vNQi1`CI#nM#?>W&K~$eG^%!XO9b~h@h3ka zB4Tepw8vl(4dpi({DT!b8E9pBqi|KKl^kI!+)W|S?JpdR#l@&Q-sAu%DXlH33HNab z`&Xuh4p-KG8Fd^wzkr_hk|uHu`l6$b@~uQz{LjlVX!+pD$0AO!4q20=nGRTfL1X zp)kDRV7bFlmVdNqT!%oC6jQm<4x;vYKIC9v)gos=PP z8>Y`pWb7{P3@_MCauc-0F-)*v-BL&xY^E_V;ftUYT;8xEmxnN!_jKy4hZl&goXfJa zi33ncJ`%DSLxYklhUPd-O=!p9J;{RE7PDx_N5vj*FjzjewIcVkMn_}jSwXJ(p1Zx_L&k%o@lJ^ z7&a#Fyh+tXFzyz^Am`}yq(0X^Q$3i&WV*VHU0`eYutF~ed70J{mhoWt8TVj=it2gj z-wf=Lisd&MSD93RF`ypqKY62IMyP4X;wYFI$wD%||0dhR@h43VDf?L!oLa1xN*icyz;To_u0A2L9lLDmXX29lxUz-Ey#=KWN z(ujOJy3V+kRGBSQ1Y3{u3s>7m#{K*`^dxKKUnN9yRPl=`-6$BTehzx3aVphQ-J6T@q&r+HLl_ZvOI@maT=zqfC-I5sp zfy!T)rF1h9PRD$?5ON6j#9ey^SxRnsi)~2qFAVN~bsJ$e%&N)3r$svkq=K6j3(TkegO`P57F5d8)g;Q%C;OpjaoChoV}i(Qm&|1-vH10OQt!>q4Zwc1EKI*} zrtotr77Sap7qcMLIf*62JdH)hU9pFK-lmwDvKIekI=?6Ijm9)qzfkw15PA897CNo+ zPAxKHC+B(UusSOsXFP*EuwTeAJIoL*P-!6eVgf0)K+I9C-DD9A{G~%0i=++7CYn;-7tgt6D~(cqHY=NCf^yweGO8Xuf~IOeb2c{Y z$H(LNTt#3WpBz6_Q=~&B=i_ju6sZ<`R!UuFBhaV)YN1kdsz?PnY+r?@5A(g<7H&b< zoe1s*S?8GVKyh1Dq1MiNAx{{!dTVs3I&T-u{%(9+V+XQ*SAPFd#Uy@303nyO=RAY@ zg-5Zxcxx<$ff(Akhd(#*Cy&5{cU*GqYp->7)x`|yKKV0$9m#JUD3wF|c3dBPy-&q; z-3fF#Zv+^>R&x1=Xep_7Dj*-?9~TNq;R*&Nkl2I_v3^{C3=sWM-Uv*2cvC5YkVrU! z4i4Dikl5KS9IP)t#*vTJ>b??SvT*crVYF1ZbwHOIhIvVRAoT}^xN(u*c5)%hA&+x^ z&3>qOL_<_|QxjCuGI$6w}ozJgxYygrV_ax)CdRXR7bl zZxVagK4-66)!=PW?c_=I|L7)L}lP4_Q?FKCr)m5@36{v)>@aT zLkV^;uq|)BmP7vL3J+1|Yb^*oVAuU&!2OXbJaUG*FYuCMYmJW1Qv_M1|Imu~v;GII z=zoxkGFlqCt2amG5Rn!w-|PkJrX{h~_n)ajO>f)do9ck_MJIrA#|_f5zN_RUAx_1n zGBR#D4IKq#aurvn=ow+?bR(u7ll=*UbEf|Hq?t;W#L36?68(zjHc^{78UVn)CsZK{ zR_0W?Cg*e*-jawa`=TT$IsRq@`g~V4q!g`7uMy z7HML4$n}Ki^G}wEx#BcuaSbHd?-rv&8!pWGbToABx`@JBN2sn%Wzog5Iduhv~#bQj-Q|e3r%S3pq>!zlGl0Jb1MQ!A%Df0^@Zy|4?>P{dVlRRI|^}G^MLQ zACO?v4v61)4|2)p%$C1?E7}VjeExP$8iH7Jn2uJb6LID_R<0)BOF)F$C6o`_wA46& zsc)Iz*mBazrW1XqnFUYJGSBMIvA3C?XDWNYdP=))Y480Y>Zp-e!<;L0$G2jR1Kr`> zDI(K9c9H`%@$@KIi&?K#uLImfi&egfa(_hKmv54W2}eLFp87#Fo8nJ0r)2tFiuI?f zH7JUy30EqIp8ZJ_gZ7CyEjuy2c!rs27yMpaNKYdxSa{lZmGq1~* zomC6D0vj;JLP*v@)A&<@RIFfK-d z)K7C9M%$?5&cCsM2?<*U^TLT3U^G{oCMIPbr9l>!!TwMTkPn>?oWj)x@;Mibg}ObY z7BiXbGBf>9R{#q1WO5dCA-gMJ?5D;bAd8(~%!h0UEDWd|C|lKg46WK{wyvkdT?u~M z^mu#EuSDmnu5)J;7;xhBJ+Ju}n%);ps7A8Ux7@fCsPt?7u3@HsXu}eMwcF_JoYYLF zf2?7urPhR9vnrY}O;`=_-pX2Fv_cjJZ}tNiDBrtk9;(LF@}_d@jN|O!{|2ywpEsdc z0YlK4%Q*Fj(`%i{ZwPxB0oe4eHcL1uC-6)Tmd;O7Fsm#o`^!hM zb$$bY4k>W7`n;WZ8EoSc>~0eg?0zJ(ooFc;q=#cX@FKcDw_fNdDtI_3vJVrxECvZn zhQ@e%fnTX7QG^g@Hwuu+$V6DY+3P8LE$(Tg>ueXPd7C`l6FDhYkKuNtaGh?v)t@K2 zm6FNuQheNTu;*8uvrHp*XOgB8aUxkrEniD4A)iQgE^?-bL?wr@Sp2jGqa+lMeb<{@ zyxBI(O!9TG5L%>QvEIsV*wP^=Q@1|q9h%uoy;mKdacWJrfL=<{Lo+y^+gfOp%SPx{ zmqqQY#$lYzqH^~TD>2s%cu|*aoDR1=9JI?N#-Pg$MlaKY`GJ~E6L?GCz8Ojl=UwSM z&=M-+hWN5KHOOR~A^$&AM7>B!9xI~#Y&(=H{93Gov(@+WOJx8MRPS4uJrUL}m>IP% zm6~f4MFDd$CTF3$8eM(qfW0;9_b09R#V@{M@o0NdDL$}^1Dcjr5K>dwL2;UAC^Lk* zJmzD8D5;k2@i)OP1yuX-Pz5M-vt+`jNYH=aw(L;KYUi0WwDj#W|E*Fvk?h`*0!glu zl!%3|3&sXgb<4MJKj-H+pN@Y*)N!SAKGVg>CZk>yEJ)6b#xEKleBo8=hh)?h%6*>z zJ1!z#LVaCy;SWjP0E3?&BQ>;ix~)F{{yw?IV{BcrhP1z+eirsc~A;W?*nm{ z9KOxSZMP@eyzXcmI}g~A*7TGNeTrKh9$bgcurmyM)P*g~B;05`xN0@9Ut@~s>+~Md zn=;?h_;S2&&a_3GT~*#!nFu=#rIm2rD)XVFI2_GxAU?RT7fOq(%f)ebbdfekOj4Ni z8A3e(PK6Sz$|(VhKs{|bfZz{-1<;%7xz;%L3cs>?)|u!I{JeV?V||edktze*Jx$7l z91el8phBw_%fMt%P*#wa72t<^`naaN-oU=`xF{j9Ds~t8O~sr|n_mnLg8Z7LX*6?c z2bqqY^V!Sr*M`)P)U} zc6WUxr=*`?7<6V^fwxOu?(yzIN|E&9Lb>AGK>Z!)I)B=ZLa+k^>8!fV>c=J4KP|{O zV8!-|iHMY(e+j&-?OEu)p`n-!p~Z8ke_!*pcO zUFma(gM9K;>pxTEGhSKcy>nYaT~>HVf!v8S4V-DeO`|pb6yWMb*{=& z{qUfhkFcpy(C+{s`&VIyH~J>yDE-Y?ef)gSmUVEhWlv{^_6#I-QQUYh5Ehxe7LXqU z=Wb*vo)6Ga=+9*zgH=vwS$N#~Ad)>KDBS0N;HIpE$7%P@b(EhzgL++z({@}%(Mv^W zOvG*nLHjG16~0+@hgN+H&ovYqmHAp_9yrT-p@^(zOE|EQ$P)M4<@8D1ZpT8nIx8hb zqXp|5+_M+6M#iSLO@<38XjKdAO4Jt#4m6A?aSOZHc-Oh~o#mJ_=cfIu>!*&1e3nTp z9F0@a_cDIx9a~W{{s*DzhYCz6{8`` zL=n%gZ2=dWQTH>a_&{s$?JY)&IwH>$IDzOGB$>G&7~e3AI&Qd!->SP`5O>3^GI^qG z%w^Qza-jMbew=q%L$_ZwqQ3kgo|ako>ICaATwJGi(ub)EIBe1MLNgrCWtv9-SoC0j zO=Z<)4D-0}W|#I1MU-C~WYRzu;VcQAFw83)~&Jt%ytKVrGKjxmT_svA4HHZ-Qs5-|t@{5V|DR220tk<) z|D*g5Jm~-XR9`kOk^^&TnMfS21t%HI?=CQtgxS@SRt}Q(szS{_s9^03+*#!Ki}#Ym zyE^k61rUeD6Cj)`#q#|1&kCjpfuRW&AAI%Tz+2(gd*UJkWc$+l^4D&)! z24*X6Sd;z^Wkjd!q^*AKi=*q9d$lm1_6#J-L<$*up%a4#v10B|JTQ*DiJ!|4M5FEz zZotk=Y4hAiTAj>L300EF#AX<3b0or(rL+D@r5|^uf=js_bO3|jyFW1?+ZGe>v+8ds z-AsfFQKL1!UdDX#w7r}tIk#inHaY2UED+tMTMS89%W!Iwt))d`BhP&D*|&=y3TU+0 zic30Hlb%;DPyH-dPP4f{K+Z(3Sez3|*mrE9Pr|_IaGRn!vo{DxAnSZK{e_*P?8lS)t05qA-OUOKD@n!Y_$+n2w=zUJ97q){%)$ z%e>%AYp}{4D<_Iycyv-3(FB_ghP=xE%SR=7XPhJ}-r#5}%sCb*kdni;uY@hjJvQic z28c%8;&eQrKo_Z%;B0OJ`2;yYM{v=uih))%}GP?_c#Jo z2Gw(Z;=pf?466F%ohqIp)`BI$YcK8^)BdK>thrdDija7rN;8^Tb!UuOndCN#X-GOG z2Pr|z-$Jc*YEaFSSfk#DmY~7sE5iINE5Pg;Otkk^DQ?xIh|?II$0Ze}!KnTKTB{(| zhf!f5nrsgm72r#Mj>#_Pk{i&^-Z9evp=+bzp@aphgaw-BE-_Mjk0Wjf^zPBQ4?8Mx;Vf~~u4=CA&%im?-nvf;M}*D+=-7B2EU1hA z7v6c`c3utOZV@6l9Hf70_7D3Nyu#uuMXo5=LSuU5q%38%6W$!tyc{h zkJhWbOoIPny#gM*SO3v^Ws}zD+pDlkZ_G=hKlC}nbsJ08-d`C)U(?R?eZpWah!MKy zPHX{!SiY(f5Z}R(hE%o2s-u=rj`jcHOfE_flV z;2=C1l}kP0e&6=&eW_7xeAU8F*kSoOM%;nDo8UJ!&^&)zu^1}876|7|l*FW(Qz(Cp z1)@ep29+6>#1VVzWy+6!1fR~a4z4mxtO~NuN40)3Z4?=YtZMHI)KZ5I&DK&7DAnHO z1x2sF>$q0$C^YEj^b6oxhzQ=+k1~H^D`)6dhw&~a(7$dzq2v~@H|J23D8a2t*~38I&jGe>0gw3prx#1DpLw6u{Ckx z)keO(TT&EnbQrX;+EfO9o3YmOAIw;{wECWXzMUHQK&gsu+bL=Ydy6{uPE_+BPk8oT zYIIX?pRvOJR=EPF_Mg&mNXK2T?P>w>Jw3W=e8gJQpbY#<%%=&;ko?q#D%-c0=cLP- zk_xOGUY%jp%;CXqYX?lT_RzXT3y#IXM8)rwM%Pl}`slVj-H1;$ZwFFux?FY}6dR|CHc9J4X%%#F%rX1U$o?pBkGzfUkc)!ofH`N?0T zpfv7LCM?7L>>IMvTo0Pq20zK!By!}WXp);ca+oWwgkZSqcs zV5`Ct_tdGkLQ(CAiIhRFxs-9(P3u`Wrgj+3g!a8)Am?8gbCAo=+8mcug>K6M;J#dI90hCSa4xG1Bgq1d7osy@c-p~0{${TQBwVX zX@2?_?^BuQpWde(>;K|?0{&rs3b8Txe`J12W~^@V{1@{R${O5%F+crB?~{3J|3AG? zBoF2%?EZgierkOuaaBZK|A7SJmH`%gYE}yA%y>{>GJ+w5nPBXfaX$Uj?Kl3{GTRW| zOfV5r%U4|11@y_2bXTmo+%Z9jbtd?ecA-7bpBA8xG}}cueYt&?Y6VU&_`E2d)p#^j z#)V+f%A_^-aD*Tn3yfju^_dT<^OQa_Lv$3#W1&`6*#Uhwlbw1Jjij`r?>4?yI_gi4>so zL<*q}=kUF=p1zACHEz1Z1=9kyR8}m{8b3o#7crfrTsPdA+Z}((77I`l(T&dm?qi@u zjs5f;D4Q_ZFF@F4N>L?{2+Mc4o@lhf_2HTSl z?ka@ND@L-%ZNoV&*$2KbtJ|@#jmK}v-C3)lFLg~^Hw_8;BrjK;>~Jn%h#0eJiaXq-5ZhWCObU+dR=(Qlj` zGkc}8_69{PkYcLE47Hl-K4dKly42nnZBd-AnWQd}Y@DVE%``#jkTTYY_oU_~wTo5s zkUT-@`EseFTWn9LRnU4XGAs_p&Ud&(BXbAZCl6(h;DL8AF)Gn}LWS|NH@oy-8!0h_ zR{EC!Lj7LdXmR)@x*XkQ#OInQ6?Rv~!);B%h>{5-Bx-1keh`n()lcJbK8y@2YFM0-4l+*P2_!$vx7jzX<2idDUAoi;wKFQ)OAGzZ z`&~JZw6j~oGAbTXz>%)Xbd*iMn+tAxjbab*{Xnr4e2m)eaCVA#o}fVSJx50Q!1v^^ z0UG%=fsHg{hyHVm`;FL+euDcYdZVoE2)w(|+p}Q=Lpaa5>3b^15+g^iG7D; zpaies#(msGF;ZN8;@)npw}t3`7bIs=?EEM4l^@b97reX)&B;gXhpMSCRjZKc_ni#; zn*d%T^ix0EccHx0e>6@r1~m;x7+Uu}A~RO#G2 z{g52Z^jvnlx)$*S^)DQ=rzf2t%ov&H3c|O$MAAL`sM2#V7lNuhd@k;KY~4uFqY@~O zw&#aIdV39!wClsbF`c4#Io|b~dS${EaYu^I-cG;Jh7UpbgFdlVW5{{dJmevqN zu6fnQA^n#X?_<2e`c?3WG{k?%ajQeimb-g^IMDvU$zTU>cL~yix!@G(O>VC|dCL3F zO0HpF2{&H1yab-zkaNiQl2VvS1yRc4>%H{06=~HJ%+ytWTuJ7K>7>o; z5%)?L(Xi2IgOkMx4sf680R7De=gjaG#tqihVT@hZEFm>Is(#=r`kbcN^sXwPW5&2n zhGpL}#n>8Ms4K!P*kO=|+%_POj}ucc0n)FW;n|orPCTfY?wLI`&2XS#Z^_>|`MCsj zBenuH{jgFciLv49i)wt~FJ)|R!rqS%ys$}SC;fEL5GE8oiapu=DJm&ieImPW(_6U3 z)(K`noEknpR(%2(ddRez^~I^<(3D2u5{R>C31Zc=AAF6h)=t82yG@1!GabV z&!fEK_>0qj*#xzO_f4obH^Z{R)3R}u_+hf3wO=dMeN_0Ga)K~*x~jcfc?II$d`Z1o z`{}fu?I6kFJ3o^++8SCcdNghOD#BN->~cA?K=8b!SfKd=#eS7U zbP|X{IaY0VSm>QP&98x#9$t4YwVcZzK}arq*>5rV@vSYbmk$nDZ;cTKU6G8&_!bKX8O%#E+?dywQ0SS6>qCX^}VkX-1R$I zdi$~$%)6hJUK@Ms1_{7>I`qciqdunT@r;~69rs$*$FtbGM7b&Eg^KH6%KB z<^@Z!;4^22klo?W6jhUjv9Zrd4`rRo1n1610U?Wop4F_d@z2)qQ_EY)CY&LWkW`bn zD(!i~BfYHDv6CzNxkSwSvvaO%FS5D|OhJjdpAxa3F-2d&#A%|nDsAQVKuPcLJ~vr3 zN24dgouS#v6jgzlwlDY26=c_qwLE&(AsiHe1*VnIjt>fn;MR_BWAV2MKoXBo)C3D34lU-Mg}v)4lCuwKsdfTimSa_d_2| z$K2o8Y~`754AFQF!`NXLiHG@D;96LJ0gj0f-Z8Js+{T{E$rTh<(DmL)TCA9ciM=_U zn#PkDw^`S06VI}uqLaIidlLg)DQumN$o#_JJV7G;WK7m?YpX|x(T_A7KUeJt#-9(T zEM^|=$tV9lDTSbf>A@++h`Ibc-I|GKU%PkwnpIozM5QE1o2}ffhc~!mcTTc$jDUbS z8jROYrn!NpS8uGwDj;*gl+pM{jyH}kee_e`GJW$d%U* zsAET+=9=W4Tw|i3L(&iL9VB#~${;9m=I6xNBHkO&oNB(YZ@!ilFkTXd|h5j`0uod6VG3XrWbm7vt!xo{m0Q;wX#&koDDn@{a9RCyfe z^u5%Dt))!o4oOV>B46!*UHIj2(e^fE?tu1kDjr;WoJr!w|D~TyA275#TQ2MEY<2{Q zzKp21803B3wB1LRe7)qYS+7~o8U$f&^5uB$$4&3|vwu(~EzXxa(t=rwF9qPpn_o)L zY_<|wSLj?2WB0K7nlfe`SUQ@*xzSWmO9ZtGb9wRR$J(*XsDIeAVYx=$kuov@^?C#k z%d4iAxjRZ#tnX@hCe(0*YxzNuXHC%D*#^3_6FSzCTk~S4Wr#oTUQOwb+PuSB-|Jfy zUEpWFI)*d__CADfG5mW5y@AtLM`bJ{iZ%w5UNt*bGns);_;g^1II>hZ>9#V%F5+9* z#*1o-@Lq%#NX4Aidy(*+s!}YM@OR$k!zV_?;Ph`A=wsLiV*AoNhCyRe_>r!xr^b(Q zEclVKYeZJ>+m?0A(qP+uu#jM@sVpt9Ako9yhIvzE5^_Af?JetQ1J)MGUi>wn>7Y5H33&e}5uqom))Fewr!Z zcsmjlavEud@7rr1=W?e2;n@fCKW&nP`0ayRp=uyv2VgJQyOB%GgPK9evB zhJ_#-e}&@bG#cA%)p% z9@&X^BX}4!3=VRC2*##*?Az?n?C_8N4+FQ%va3?&eVqOdh+w?1k|Br3U@Y1p#z*|u z4qLm_@)m%@4b+y|#k`aSZv(<9)7UH)CrZs1i2E`4_46RiAWX>j6EFtk>oNERG>Y~I zKd4`?2~y@CC;l+?f1L044DPf~&q5*1M_@l_1!)W53q;}=?DyQm=~@sHcLvsmaGZci zu>;3vxjFBioHDss{57edL_gIJ5Xn<82He=}ui13Kb-+QSPaobY)zgPJZ)_GsOW5}0 zR}0Z&7tccX2k`u!_FwatvH(h)t_}V^8zx0|)ji_>t#d)2J~-apPaiC(*Ry$5l1|Y$ zdKA-z3GdxPd&jMv9X?I$T1wgT&LP+`kIhNhdk(lifalMbf3*Xyw&(ZWwYZJHdi`n^ zkmP%xyysJkyJenTm-24{m}ThYharFN2L6iv8F*nKYk&E>(?54T9u+3xS%T+(+kFSK zwWslL?)^Vz%{%w&EHq+$D3rI-8f{QH}e~EW12q#7E?sI(=k57|&>v zF^F?aWj%v?|r0I>Dd@3U@V(o96iScQ*UC&U5T-GQPzmSkzb+h|3k$ zG8bj0FH9K`wDCLi4Zf}Zz6mPzzpb z)k?ycWKUljH(jKi(GuuQ=P)z&Y(w;I^0Q2jSyUTmSB{%-STUt&{m$YK*<56`y_NL< zbTilR!jJFm-*Sux_r1%N)281Y_he}1wPmS)wNK-+LX4j+%|C}R_jw}ev`J6h&xg(? z{D-Ef{L0$-i{KqAMlBdl6qBrHz~fgL`Cpj0L(5|5nSXQ(Jz9o-(;`&09*0|KT}T!9+nhp_$z_N>2A} znmAq0q@K+c;SQYW`pZMJa-o!?||BI8Di zd75jsy?&HST{pn5XJ1~^ zujPxE{oCbj8GqgNztH*Hok!}M++^07n>@PE;jG-(e9^Ee*?=Q zAs`j|1DW{0`|Y9slDj`V%t{isD|?s>Ccdx)9@qP`|DE2SH?d3Fx4#C9)}N03ar5|( zaz8JCUP;^rf2_WxyS)(v+cvf<=kPez-Y<@p!x zoU`too~KbF|L&C4-Rw7ird^iQdE9BYQ|d@&k5bR|^fCh#?u>hzQ})lhT$j4`dVQ>* z=eJ8gr?2o`@EP3FJtu9I|6%P3Ae%Lw-!3JnPTP`kx`M8LQ4^>=n(wnPgVBIHOC>ZQJvY fM(Lp)2P?Be&22OHhlu}r{$HLUVP5+_;b0~JBo-y< delta 13802 zcmeIYWl&v9*De}-C3ukF8dwAf?(PJF6D+v91oxQ$3keo<;Uu_gVBv1T-6cS9cZWmv z-tT_*y>;(b=g;|bYS&XW<}APfiy69U45fUqH;=MWGM1cVC# z;Xy$75YP(6y%vxKS{8#7ixFS)0mK{=qWSig+>x104FDW256r7Ebat2?%- zt7wlz+}!HUrj8?5*tdf0N-&EH_O7I5eE%j?**6>tPaq_nBRJg0wdHs-MH@v_Y8+o$ zA#cXaKL*GzQ%3&yo|~U7hQAfhmJ)*QObh5azq;9IHatQICD*)dSwX=UF1!5HiOJ|| zaI~tef9v3z%wP#yV=uCfR8~>MnJawS0QvmcJx0UQ#uHkZ;A6MpI>iz%t;Gp4WL>+I zBE0n%V>V8v;T+);nNo$~c&%pd}yb8Mp3GOg|4TFU?13EzlOa9dKURcgRjgwVWZ%C;2pUd!_#eCaQKF8_gVX;CHH=$U#W;@q(YvSYrjEjKBvQI3>< zoCgWS^qc+RF1!5-_!P&3q^Jfr=SQ5puYCWNS zbirEVEuMrthG);59Yyj*G{ z+%fcGvlT?4?E^HEz-C`@{P^hyc3RcSn2u*{Xb#pOepNNKy+MS`#S=4=#S>(MB`2ii zMJJ>m?uw3jI*Exg8cy0~!D+>6(i|wpEV=J7`b`XWRVVC?S<)N2pQfSxjj#zV7IKz! z`=l!Z*dAL1PZ)+B@jO?Jt;5{U>gB+y<|cjf9N<*a=x$ui-Voc4Qkh|ta6IF?VroOKA2Pek@N{D7+%f5wW-tC@G!F>THn@Kz#a!@ zb)EkA1EtS%2PZ`@ZWRO)l7a^g)P1W<`J7@kzxfPJ>Ub!pZ^*>%loYm4aml`|s62y; z(gB2fGbX-)@5k5h#^L`9Y(t5FWoF>S%P?%J+HNR$$v(?rCa?K=65XWa8QWc2yGP~) zU1qHpT1+F%?)brE-aey zAq-$V;07&=ITY!+MRU zdI;0q`SHfj-aRvAGE+Q1*GbvR`JqmBEyX4Am3^-Oj0nP_5c&874*oZ3`HZJt)Nane|7a9HalYymdS&|8|9T5_9?|Ou*usSeX-}Z zw{5^Oe%%CE-JtNaF3PU8bt&LpUR%3hf2gNI@0%yqY*2l>5IUTWjS@(V!A)YvGw)Ed z9E?DXf!2M+jD=EdH^+2Zcc13Oaa|`)w=j;}49EX*czGq+7KiEHB($gidm1ABH1ata zjex9sEY_yjS5)a!FBgeo*ammyBFDF6xVa~Ox{Y0c>N`#a{D5?jFt#t%t;A)>Ax^WX zaFkF8&z{6Kwm2(!cK^rWcs6g?YFh5*O%7A%XC5?PhN2F;GAk7g`{LawNcx$wFZ z{8lD_W@~-D^LOwgHK?@yDr13V)Q_JyX~Ac>;Wk5d`+C9_)og1nc%_hoY^(Hl@{JxY zGJ+gF1ofh4;&(;KmIb?0EY%p3U*G5!8Oo&=QNCM<^?X9BozGb&e^!fM9!bJ4s6)TU zuygcX(1n9aS&6JQJ_;uNxtls6`bfP%>HDjBfYJml_gj5VQ@_#krD}ueQf;iL18tW6 z7fi0(#KlqfvVCtjxaGY!(cXIR5Ow+P6X9O1aE4uNat7EOE)EXlTBCh%oStRW_YyqI z2dz+ZZpyDhm_gPP_bN_nVIeDeEJxB3vJT~{ow)_m4aP+ap&^tK^hd}lvw|!zix}}c z06qSsVL)K-wa`s>kJsjBt5l7Pp6|z`vhU(b96O)vh4Z{yOL#KnPPjc5Oz^@;C-?(p z7vwjY)(u*4(Hy^>e8HKzbnZ@^tUa_VVp!aGj=tMKWUP5cb_^zznqUY;-q zf@PLA!+`eShutY0xj>tS#A*fHq3x1$6U~$%jl=Ym+Rj@LE0tD69m`08f+#Mehf{ zfR|^0()NS70GFql3FXyEPPk$GhPz3IavE&e>C~&0Y9J$X2F&n&b!$X+?LCT98&1W` zd7HI8&uW#1I8sA(S5JqdC%&}DA9uG*!-taedJuIYU$$tGM!$Kn6^Y0!)omm-z${HgaAdE66ijTUdF{7yy+yQ2EbATM&h)u>?$c=67xV z>nXgAS<$~ZH>t<^_;ejTzt!IKK2MgU=lxta5*t2b`e~Z5J8%@0ZM_Pvp0Gl5h*=0% zdQj_aUCBG2@`zy?GKVPnv9*Rf1{ z;H_ZJxsg&GhOz#(m*hEJS!=HJC-iw;46*Y~1dm_HVK0+k>VJoJmx0NEm#Tf8pYyj^ zqr^DYvp$TSz))w*Xl}Z@AG~f`OH4y|r0IOh^TH)<8Lf!?!jB3h zl=w@c8Y6|^cM-i{4#OfGiewHWrd1|@`{JIl95Or4ZI9{o>A2TKSAxoL29!-!ox83L zgUx>@8a7A6QSn(A^>3wi7ya z(^&9#;ddtY0g=?WaPMyFjZGoo9nNuZ@GYSiqJ_z^63(#3q;KA&b_Qh2F4($cqr+pr zlE}h}5|eoLn|$q)gs!)MIT1Eq1wzSM!8Ay|S%(=}&^N7Miq{JXi=1Osf;vKtJj5v7 z`+9@E8|@IQp$QxaDvEG4_Ue2``qi#+T%G)!@^w^vC0I~0U7y^E%uS;wrFDUm&D;Tq z>*w`WPi0IbDTp1=`cVh!Qm&3hNFI}@D&2%3)|=LzQga;Hoe`T-%wWNV4vLNtQ@S^{&!-`PM(e}Xk=INu~6A5GVq zFyLGXPDCiEw&Z@pQG0cIg2S6sf78$0c^h)Gnhj0-38us}c_8Lp`dxwe5d5w{pg(?s zRe*g%5f;=|M#M_2eleCEFLX1t_1luis)4F4?vqZd{+zsYSVI1Yfhk#cpa->87@HZ) zyp&?*6IYNxrdrC2lGmpTG)i%?FvqFOWhp6{^){xWyK5|*#{CHikt21SFzLwtv& zBr1aRn=Gn|be6UD@vPiqm5Kg^)@CB&tf~DaZe0%5YsbNHRgFf7WDP{3*ra=r0@)+F z9jhPcBwNiM{Ii^BUb6*~J|c~%p{(4Vg;XYztFd5`&`y|i-zNol5fNR}gc;Vdd?`!K z=~BN4Jtvj@aO0D9=C>4rqKZ>~wUE|Y{#a1RdHpUZ=2dil7Zl4!ATkQ~k3Zr3Q1lJB zySh*{7og?5ou57(trcPY@31GIq+8A<~`Z+?i^~gc>rnISl$<%lQ8M$C(J-@W=X30F0*YZ2@y%y5x&7&ZO{_F-DGFTtJ zcWm$*Uc=03-}sh%Egiq*M+4+CCJL3ZK75yy^c4I#@h9}-q2h&Lf4CTEcOh6D&L4_e z1SW;!hQ4~dJkNEstQY1N4Qnm`6U|RxnnhqZIJhY2`(kh=;eblRtvDKKCm?$ z+$a=l0PKR=b5ueSZ*-zoAjAy)G63d;YlfzlfnUM>@!jD>6BfF^zVu(9qAnr-0A(En zXTYJr#s|T&aPYz>P>Nx&6rOOi(7M2W$roP#dTW!xpZD~MPM1YcuVJt&F?sGRvm;^O1{@3*2`#PxYrMWe;r{v>&DHz?Hr|o5hCSHSNZ}zh z4W}Ks+l;;t=Yigvn`-Mna1DFU6?d%*WvvAh!gnJ>m1@CwP{UfV9DrO()6D?Vy*J?V zCacQ_OcI$ikKKBsw@!#o6t&-FO(E!^|A9MGkE->I@kH$P4eJFfj6MSC544U{NK{=S zd}ZSLLQTjBsaJ83pW{mHg-Ju3;CZhhAQjV!|tTL_^Wz2l_M?+6Pg z4KDryaG_b%Rls@4qh8!v@*7L!_0={GFs1&4txTLLP_}tlYv>#TsIkVU(iR^kJQGz@ zP>zP4@$4^rX2<)GLv{K3Z`k5DSG^oXh1hprB7GELwFTuBd~hM%1pkckprq@m+MKv-!l%9uh%!cRbyfJ#dP!7ujQ^Uq(2X!;oEFegHCRfXF&3p zdH_AN`lb@6gMfti58R+S*bKz@YhU!+XRTVJWhL97#iqZ%2=g*x98+>qXt7aWlZ-C4 z2{X$wY3fNB@NP-)Q`UZ9>Q(t&(^!on`^FUPqCakO?~ZoQEJ#PT}o-uq`aBl9?k@1t z?~H#5I!jhXFbc61dj~yN%P!PmZOJY1q-FrRI|jP@l+vXF2C@01H%Y!Z{U$*jpy$*! zt!?;>0YTVgQtp?jkRVc0?}l3MZv(hix@=FWlVJj4O-VI{z75avED(^e-Rb_qrha%( zv@v-weeibrn|IJ+6*1iiTb~Tf)Z5Ru>iqt*qzBBOj7`x?O5+^~c4B5|E5ZLewG4Ev z0Zfb7e0#V9!)*MWe3+qLO^?aPpX8v|@D-PS_Vx+%rs=Wd(4NQYt{g9U&y1YC!*ZV8 zq+t>XPwef9JKgfQzf%0wFjDA?^x&HcnPW*WCa9C|kf{^TxKphT#u@&(TAtay8IIlT zas}V`vmXTE1jtA6?1Ho^!Cmvb)}HsSK-dh$$?9rpr10!(wv}t_Zc@WiwDVqrzf1&w z8xtY08~rH-pxkowKhCfvdPMK zF73xff-Po;w;^1kug+Zq_;Aw1%v6|kSDtUqY-KdWa+i#LrYDL6w$L8x@D}nPo!hqh zW}f(ml(3U~@?JfB#ngeobQhK;v~8J0IoJbTMHrJQhj~OQWf*; z&6rK>)MD|_zHO4OoLuFxq{xOxYEt?B7X6rN^ZmW+e3TVb;k#$WxvJ-3##CXEm8eFJ zutkWiUZrkz9rGr94$F&I^v!V}F7)2|=(jg*zCTcMJAug7Z<7_xeY@Ed|Jg!VTyH3S zk<>(%_i-ub+sKujrm2C+=N}}|ZP1iVFbR-C#u2q51%%Q>QxySsN zjK)mf{mG8;;OhRfME06`sdcn{pfs8{Xs95DCPqB2qIO2~MJrFQx}$;9dF?sgUAzH| z5$YR2yIAa-iT0A1%AmYfyjmPbx~_8i<2T2an{_ODTVL+4D(0?F=q>jV#e})+@4t?& z%agzBZJ24-8z!1xYK1S|PDwU5Bd*efWzT|6ATxbS1@E^M)SE~ZA3hY^8B>`bYp+XW z9HEZRyh7HJOAcC3atR{i6`HcLm9t=iGj1!;(R{7 zO=O2$FVtMD#{&vz=Q)>_{Wrhj#b4Rm$ue_V{Ux_f^~v^+2NW^_hOF%;#HNRs&wliA zy=?;3rR^FIx^H=Iw=;WojaSkVo@-WA-HjdODIgS|yq3NzIN>E&w+Xk1Ub7(4W$N4> z?UKK8-_@yz3%O0RlFohga|{>`DZstH3LzPgZ(oNR-FMvOyJ**-vmg9EpjfRPk#(w3 z$J_6lo*Hjbn|MurZ|3d4?`qf+o^tTn+H+JW%ua0^0eZv{4>2^5bmOyxDmP3202;9k z4^8bVWxS>N&tHLX5T^a?0aB;5?xFxnK@BeW*ewm)&CpB>fFC# z^R z-o2{A9NJGZ0&$DG%CI|*QSDsED@zm3c@l*48otf%1*z^I=`0FHDIGjlLE$mkOcIU)9Z#+W(Y^}%eKCI0 z`Q$SkF2ZIi0-abAfhen=5n?CE(;czudO;Sy0N1wA8a)#%HPk%3c}3IJaf2*mL_&Pp z9fUrA|6WE7!$lFTX%a}`rt1(k+h5yRymgFV<@9vShQoMUuD&40C7*7(WnZ^RlGwS+u;0yI^GK`Wv zs7L8g|4vVy!jw04tYh+Yur45!erbVk=^41UnJ>a^%`ddX^rRDqz2KT0mGs3^jq z(}1SYa(P(i+iiFG#oJ~OXTf6(yP2xR47XC4ga77eW(`>V+0cw7V#&N5qtzL7sN&`#b9OJ>PXN>j7{pfYB_n{`sSYM(u{l8GuP z5|)#?lq_(wQE*N6z{R?qAA)N8}e z@GOZtn$B4DRYxA`l?z`#WoHkq?+j~CZ0PX|1@I(rj-8YhtkUcyVp5r9=P&BCR&5i) z_`Y(3Q?=*osSTNf3Ww*f+XXGb0Hb2XNTB6v7)P3OonEJdVy}gPVA8Rqae-*V_bW?S zQ+qxchsQy9xBJ+pWzd^?n>t10ovfKFs~6Y)ylR^9sh+Bt4Ze0#-JZQ%k?m{s@# zQ1Jt>Bs?Go{d@p!hpT}q9D)N-Zbz@o4{H^nGlyV1;9&^pQ}fFxh)WY&{Cvx`elLtU zr?_pTDB*k|wq>*hF`C+TQYGKPDc8X`jnd>oxt3#0o)^M>4W;&>k5_h83^8>q8tQcH zwO=ULi8zK8U}4peg5Iqd!~_KYHFA{Q0mKO7;)JP>WNr5zyS^d6N~C|9Bj}H@mfRQKKUW z3j&)ikfFG6k1r^>i7%kLaBq_Q#^1O9As0{$w+Hg^g~P^g`+;@D+je>Nte#YkaR2c9 z&(Qxqi-4Jc`5&#oUsL>}Ny&}6<0BTr|D)xPW&GXp|GgRwCAWuXF5KSsdG&v-CoC;k zN96Yp_}laUO}YToF4X^_|92ONm7?Rx|1gFRh3}s)>(43fx(n+8zZ&8a?v4d4H}QG& z58P6Uh)fjw_r9GAL7a0l6%xVql>7HU(u!T)_iv+tvc&Xz2XC?)iFrpyt+_<^S)!Ty z%*G@y&@1yJa4pXLI38?^Qj+CYmi9yv!58dc6|$0F0cZkI`-4PpWIAx3dbIMKKlv!@ zFKdkXxR2){B3Qe8{j~6o#(eftlDId;EXT@Q>cd=Wrf0Zzf#~X`TcY zhWzbJASgQi*ayA7eB1~BI{J0=zw`b%=BBiE{SJZYG_W*8(w@=Nc;x11#>K#FUu(dg z*3_lceW?~C_w8hc|L7L)FBWyFv!@KoSrMijd}Er z+w$@Nnq>|la0{l7maq46hyRM_yf+0e6T||X|YNZ8VD?3U&V~h3BH}+^z*oKE!)a67>$tIQqZVib@uy z<*4YJ2p~L_C`!c$Aix5QM1q%_Bwg%`Bkvk%NBm1}?=)Y`@HrpI*6+;Oh>Ry^CchO7 zB#mhBse*u!Y&&9X-aTK}cr_-X&1|VD5WxRJGCO zfyz=S^1``7>BX;BKQ$&0-S2-Q{h4~R-d00Sh;d*%+WY=*%;)0BYo^C;m)A6f``Rcn z4PzD(@QUvmEU=LVt&oy&)qMC!-x}s?dOAcPKA62>)Z}&BCt#fwqOS{o^)aXZ3_W>& zirXf`c`1~Q{6{GFyIMDuEXA|Y zSlGfp+NTC71~Sc9Xa;sX7g!Agzn|i0n_cSZdMR%$M}Vi>oPE)dpXm6 zX?y|*aUB?+JQ@I&e6gCTwHR(X&*A1A!ch(tcDuMI_mn4U20vix?+nnbcPw7}*Kc9& zrgukpJf;%8-GoQ-Kbrs=toWAy4q7;ywu&r1e>C+wfcGswE+Q1`;qf3?80!51w*B*> z1l-FZeM+mW0{koxGq8iD=3)1Pwu|M>Q!hP-cZp!qvf7(6FSL#2{@5LgXhKfit52xn1LW!vXO)a-Y(x>$;W8t$1E?g* zKa1WkX60>ptsA+HO6!h22JK*IRDfI!rgy)O}7@-@Yxh_#=sQ9rP6rDeSHtc7B3rB#r~E3jHC= z=8DOk=Az)2UR$?LJ;eV*0QuC5$YGE6v%o=OKKspvZzo-w zAuUMGP#7GY3zELt#vKln6`n2_MPuCK;rbHcj~lG15f9+{^Z`zg2cbgdxhnks0&u4b A0ssI2 diff --git a/detection_rules/integrations.py b/detection_rules/integrations.py index 16f6999a2..faa305175 100644 --- a/detection_rules/integrations.py +++ b/detection_rules/integrations.py @@ -47,12 +47,13 @@ class IntegrationManifestSchema(Schema): description = fields.Str(required=True) download = fields.Str(required=True) conditions = fields.Dict(required=True) - policy_templates = fields.List(fields.Dict, required=True) + policy_templates = fields.List(fields.Dict) owner = fields.Dict(required=False) @post_load def transform_policy_template(self, data, **kwargs): - data["policy_templates"] = [policy["name"] for policy in data["policy_templates"]] + if "policy_templates" in data: + data["policy_templates"] = [policy["name"] for policy in data["policy_templates"]] return data @@ -93,21 +94,30 @@ def build_integrations_manifest(overwrite: bool, rule_integrations: list = [], i print(f"final integrations manifests dumped: {MANIFEST_FILE_PATH}") -def build_integrations_schemas(overwrite: bool) -> None: +def build_integrations_schemas(overwrite: bool, integration: str = None) -> None: """Builds a new local copy of integration-schemas.json.gz from EPR integrations.""" - final_integration_schemas = {} saved_integration_schemas = {} # Check if the file already exists and handle accordingly if overwrite and SCHEMA_FILE_PATH.exists(): SCHEMA_FILE_PATH.unlink() + final_integration_schemas = {} elif SCHEMA_FILE_PATH.exists(): - saved_integration_schemas = load_integrations_schemas() + final_integration_schemas = load_integrations_schemas() + else: + final_integration_schemas = {} # Load the integration manifests integration_manifests = load_integrations_manifests() + # if a single integration is specified, only process that integration + if integration: + if integration in integration_manifests: + integration_manifests = {integration: integration_manifests[integration]} + else: + raise ValueError(f"Integration {integration} not found in manifest.") + # Loop through the packages and versions for package, versions in integration_manifests.items(): print(f"processing {package}") diff --git a/detection_rules/rule.py b/detection_rules/rule.py index 61cbf9a20..b7679b9ad 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -1024,8 +1024,10 @@ class TOMLRuleContents(BaseRuleContents, MarshmallowDataclassMixin): # if integration is not a policy template remove if package["version"]: - policy_templates = packages_manifest[ - package["package"]][package["version"].strip("^")]["policy_templates"] + version_data = packages_manifest.get(package["package"], + {}).get(package["version"].strip("^"), {}) + policy_templates = version_data.get("policy_templates", []) + if package["integration"] not in policy_templates: del package["integration"] @@ -1131,7 +1133,9 @@ class TOMLRuleContents(BaseRuleContents, MarshmallowDataclassMixin): rule_integrations = meta.get("integration", []) if rule_integrations: for integration in rule_integrations: - if integration in definitions.NON_DATASET_PACKAGES or isinstance(data, MachineLearningRuleData): + ineligible_integrations = definitions.NON_DATASET_PACKAGES + \ + [*map(str.lower, definitions.MACHINE_LEARNING_PACKAGES)] + if integration in ineligible_integrations or isinstance(data, MachineLearningRuleData): packaged_integrations.append({"package": integration, "integration": None}) for value in sorted(datasets): diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py index cb842b5e1..d43d36aa6 100644 --- a/detection_rules/schemas/definitions.py +++ b/detection_rules/schemas/definitions.py @@ -125,6 +125,7 @@ EXPECTED_RULE_TAGS = [ 'Use Case: Vulnerability' ] +MACHINE_LEARNING_PACKAGES = ['LMD', 'DGA', 'DED', 'ProblemChild', 'Beaconing'] NonEmptyStr = NewType('NonEmptyStr', str, validate=validate.Length(min=1)) TimeUnits = Literal['s', 'm', 'h'] @@ -159,5 +160,6 @@ UUIDString = NewType('UUIDString', str, validate=validate.Regexp(UUID_PATTERN)) BuildingBlockType = Literal['default'] # experimental machine learning features and releases -MachineLearningType = Literal['DGA', 'ProblemChild'] -MachineLearningTypeLower = Literal['dga', 'problemchild'] +MachineLearningType = getattr(Literal, '__getitem__')(tuple(MACHINE_LEARNING_PACKAGES)) # noqa: E999 +MachineLearningTypeLower = getattr(Literal, '__getitem__')( + tuple(map(str.lower, MACHINE_LEARNING_PACKAGES))) # noqa: E999 diff --git a/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml b/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml new file mode 100644 index 000000000..19ea2b676 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd","endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +author = ["Elastic"] +description = "Malicious remote file creation, which can be an indicator of lateral movement activity." +from = "now-10m" +index = ["logs-endpoint.events.*"] +interval = "5m" +language = "eql" +license = "Elastic License v2" +name = "Malicious Remote File Creation" +references = ["https://www.elastic.co/es/blog/remote-desktop-protocol-connections-elastic-security"] +risk_score = 99 +rule_id = "301571f3-b316-4969-8dd0-7917410030d3" +severity = "critical" +tags = ["Domain: Endpoint", "Use Case: Lateral Movement Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] +type = "eql" + +query = ''' +sequence by host.name +[file where event.action == "creation" and process.name : ("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")] +[file where event.category == "malware" or event.category == "intrusion_detection" +and process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")] +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml new file mode 100644 index 000000000..1258f9bba --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected unusually high number of process arguments in an RDP session. Executing +sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms, +redirection and piping, which in turn increases the number of arguments in a command. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_mean_rdp_process_args" +name = "High Mean of Process Arguments in an RDP Session" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "36c48a0c-c63a-4cbc-aee1-8cac87db31a9" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml new file mode 100644 index 000000000..6a3e1989b --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/12" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected unusually high mean of RDP session duration. Long RDP sessions can be used to evade +detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might +require uninterrupted access to a compromised machine. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_mean_rdp_session_duration" +name = "High Mean of RDP Session Duration" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "a74c60cb-70ee-4629-a127-608ead14ebf1" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml b/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml new file mode 100644 index 000000000..2861af3bd --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml @@ -0,0 +1,46 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected an unusually high file size shared by a remote host indicating potential lateral +movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate +valuable information. Instead of multiple small transfers that can raise alarms, attackers might choose to bundle data +into a single large file transfer. +""" +from = "now-90m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_file_size_remote_file_transfer" +name = "Unusual Remote File Size" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "0678bc9c-b71a-433b-87e6-2f664b6b3131" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml b/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml new file mode 100644 index 000000000..55a84e1d7 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to +evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that +might require uninterrupted access to a compromised machine. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_var_rdp_session_duration" +name = "High Variance in RDP Session Duration" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "a8d35ca0-ad8d-48a9-9f6c-553622dca61a" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml new file mode 100644 index 000000000..27da10305 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/12" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral +movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so +attackers might use less common directories to bypass monitoring. +""" +from = "now-90m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_rare_file_path_remote_transfer" +name = "Unusual Remote File Directory" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "be4c5aed-90f5-4221-8bd5-7ab3a4334751" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml new file mode 100644 index 000000000..6e6949a6c --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml @@ -0,0 +1,44 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +An anomaly detection job has detected a remote file transfer with a rare extension, which could indicate potential +lateral movement activity on the host. +""" +from = "now-90m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_rare_file_extension_remote_transfer" +name = "Unusual Remote File Extension" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "814d96c7-2068-42aa-ba8e-fe0ddd565e2e" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml new file mode 100644 index 000000000..94fbb3d40 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected a high count of destination IPs establishing an RDP connection with a single source +IP. Once an attacker has gained access to one system, they might attempt to access more in the network in search of +valuable assets, data, or further access points. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_rdp_distinct_count_destination_ip_for_source" +name = "Spike in Number of Connections Made from a Source IP" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "3e0561b5-3fac-4461-84cc-19163b9aaa61" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml new file mode 100644 index 000000000..e0cd42f3e --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected a high count of source IPs establishing an RDP connection with a single destination +IP. Attackers might use multiple compromised systems to attack a target to ensure redundancy in case a source IP gets +detected and blocked. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_rdp_distinct_count_source_ip_for_destination" +name = "Spike in Number of Connections Made to a Destination IP" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "18a5dd9a-e3fa-4996-99b1-ae533b8f27fc" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml new file mode 100644 index 000000000..540ee068b --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml @@ -0,0 +1,44 @@ +[metadata] +creation_date = "2023/09/12" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected unusually high number of processes started in a single RDP session. Executing a +large number of processes remotely on other machines can be an indicator of lateral movement activity. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_sum_rdp_number_of_processes" +name = "Spike in Number of Processes in an RDP Session" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml new file mode 100644 index 000000000..28b32edd9 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml @@ -0,0 +1,46 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected an abnormal volume of remote files shared on the host indicating potential lateral +movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate +valuable information. Attackers might perform multiple small transfers to match normal egress activity in the network, +to evade detection. +""" +from = "now-90m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_high_count_remote_file_transfer" +name = "Spike in Remote File Transfers" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "e9b0902b-c515-413b-b80b-a8dcebc81a66" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml b/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml new file mode 100644 index 000000000..db11bb949 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A machine learning job has detected an RDP session started at an usual time or weekday. An RDP session at an unusual +time could be followed by other suspicious activities, so catching this is a good first step in detecting a larger +attack. +""" +from = "now-12h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "lmd_unusual_time_weekday_rdp_session_start" +name = "Unusual Time or Day for an RDP Session" +references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] +risk_score = 21 +rule_id = "3f4e2dba-828a-452a-af35-fe29c5e78969" +severity = "low" +tags = [ + "Use Case: Lateral Movement Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Lateral Movement", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml b/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml new file mode 100644 index 000000000..ae7845747 --- /dev/null +++ b/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml @@ -0,0 +1,57 @@ +[metadata] +creation_date = "2023/09/13" +integration = ["lmd","endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +author = ["Elastic"] +description = """ +Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these +directories could indicate a malicious binary or script trying to compromise the system. +""" +from = "now-10m" +index = ["logs-endpoint.events.*"] +interval = "5m" +language = "eql" +license = "Elastic License v2" +name = "Remote File Creation on a Sensitive Directory" +references = ["https://www.elastic.co/es/blog/remote-desktop-protocol-connections-elastic-security"] +risk_score = 47 +rule_id = "2377946d-0f01-4957-8812-6878985f515d" +severity = "medium" +tags = ["Domain: Endpoint", "Use Case: Lateral Movement Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +file where (event.action == "creation" or event.action == "modification") and +process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server") and not +user.name:("SYSTEM", "root") and +(file.path : ("C*\\Users\\*\\AppData\\Roaming*", "C*\\Program*Files\\*", + "C*\\Windows\\*", "C*\\Windows\\System\\*", + "C*\\Windows\\System32\\*", "/etc/*", "/tmp*", + "/var/tmp*", "/home/*/.*", "/home/.*", "/usr/bin/*", + "/sbin/*", "/bin/*", "/usr/lib/*", "/usr/sbin/*", + "/usr/share/*", "/usr/local/*", "/var/lib/dpkg/*", + "/lib/systemd/*" + ) +) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index eaf7a86c7..458c0be1f 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -632,7 +632,8 @@ class TestRuleMetadata(BaseRuleTest): # checks if an index pattern exists if the package integration tag exists integration_string = "|".join(indices) if not re.search(rule_integration, integration_string): - if rule_integration == "windows" and re.search("winlog", integration_string): + if rule_integration == "windows" and re.search("winlog", integration_string) or \ + rule_integration in [*map(str.lower, definitions.MACHINE_LEARNING_PACKAGES)]: continue err_msg = f'{self.rule_str(rule)} {rule_integration} tag, index pattern missing.' failures.append(err_msg) @@ -658,7 +659,8 @@ class TestRuleMetadata(BaseRuleTest): ] if any([re.search("|".join(non_dataset_packages), i, re.IGNORECASE) for i in rule.contents.data.index]): - if not rule.contents.metadata.integration and rule.id not in ignore_ids: + if not rule.contents.metadata.integration and rule.id not in ignore_ids and \ + rule.contents.data.type not in definitions.MACHINE_LEARNING: err_msg = f'substrings {non_dataset_packages} found in '\ f'{self.rule_str(rule)} rule index patterns are {rule.contents.data.index},' \ f'but no integration tag found' From 8650b26002a5d31731f00ff3d8433e0857d574c2 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Wed, 27 Sep 2023 16:17:52 -0400 Subject: [PATCH 04/86] [Rule Tuning] Update `LMD` Rules Min-Stack to `8.5` (#3142) * updating min-stack to 8.5 * updated min stack comments --- .../lateral_movement_malicious_remote_file_creation.toml | 6 +++--- .../lmd/lateral_movement_ml_high_mean_rdp_process_args.toml | 6 +++--- .../lateral_movement_ml_high_mean_rdp_session_duration.toml | 6 +++--- .../lmd/lateral_movement_ml_high_remote_file_size.toml | 6 +++--- ...eral_movement_ml_high_variance_rdp_session_duration.toml | 6 +++--- .../lmd/lateral_movement_ml_rare_remote_file_directory.toml | 6 +++--- .../lmd/lateral_movement_ml_rare_remote_file_extension.toml | 6 +++--- ...l_movement_ml_spike_in_connections_from_a_source_ip.toml | 6 +++--- ...ovement_ml_spike_in_connections_to_a_destination_ip.toml | 6 +++--- .../lmd/lateral_movement_ml_spike_in_rdp_processes.toml | 6 +++--- .../lateral_movement_ml_spike_in_remote_file_transfers.toml | 6 +++--- ...lateral_movement_ml_unusual_time_for_an_rdp_session.toml | 6 +++--- ...ovement_remote_file_creation_in_sensitive_directory.toml | 6 +++--- 13 files changed, 39 insertions(+), 39 deletions(-) diff --git a/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml b/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml index 19ea2b676..4b1f99bef 100644 --- a/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml +++ b/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd","endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] author = ["Elastic"] diff --git a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml index 1258f9bba..233c5b43a 100644 --- a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml +++ b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml index 6a3e1989b..d7ebe48a3 100644 --- a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml +++ b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/12" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml b/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml index 2861af3bd..3323a6915 100644 --- a/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml +++ b/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml b/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml index 55a84e1d7..eff288b76 100644 --- a/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml +++ b/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml index 27da10305..218797237 100644 --- a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml +++ b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/12" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml index 6e6949a6c..437aaf652 100644 --- a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml +++ b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml index 94fbb3d40..5b38eff6a 100644 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml index e0cd42f3e..c32204374 100644 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml index 540ee068b..cb834fb68 100644 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/12" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml index 28b32edd9..ed4402ce0 100644 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml +++ b/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml b/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml index db11bb949..7d1867075 100644 --- a/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml +++ b/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] anomaly_threshold = 70 diff --git a/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml b/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml index ae7845747..11f92beec 100644 --- a/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml +++ b/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml @@ -2,9 +2,9 @@ creation_date = "2023/09/13" integration = ["lmd","endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/09/21" +min_stack_comments = "LMD first package ga available in 8.5.0" +min_stack_version = "8.5.0" +updated_date = "2023/09/27" [rule] author = ["Elastic"] From 4828ae07df818452ac826a1f917c16e4b763883a Mon Sep 17 00:00:00 2001 From: eric-forte-elastic <119343520+eric-forte-elastic@users.noreply.github.com> Date: Thu, 28 Sep 2023 14:09:05 -0400 Subject: [PATCH 05/86] [FR] Added asset tag to expected tags (#3115) * Added asset tag to expected tags * removed * * Add regex wildcard tag support * Updated tag format test location * Updated to use env variable * fixed typo --- CLI.md | 1 + tests/test_all_rules.py | 2 ++ 2 files changed, 3 insertions(+) diff --git a/CLI.md b/CLI.md index b36304e6a..37a253f1a 100644 --- a/CLI.md +++ b/CLI.md @@ -39,6 +39,7 @@ Using the environment variable `DR_BYPASS_NOTE_VALIDATION_AND_PARSE` will bypass Using the environment variable `DR_BYPASS_BBR_LOOKBACK_VALIDATION` will bypass the Detection Rules lookback and interval validation on the building block rules. +Using the environment variable `DR_BYPASS_TAGS_VALIDATION` will bypass the Detection Rules Unit Tests on the `tags` field in toml files. ## Importing rules into the repo diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index 458c0be1f..67aeb151a 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -240,6 +240,7 @@ class TestThreatMappings(BaseRuleTest): f'Flatten to a single entry per tactic') +@unittest.skipIf(os.environ.get('DR_BYPASS_TAGS_VALIDATION') is not None, "Skipping tag validation") class TestRuleTags(BaseRuleTest): """Test tags data for rules.""" @@ -313,6 +314,7 @@ class TestRuleTags(BaseRuleTest): self.fail(error_msg) def test_primary_tactic_as_tag(self): + """Test that the primary tactic is present as a tag.""" from detection_rules.attack import tactics invalid = [] From e4b66c23dc54797e05ca99718c41bcd4b7c07eac Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Thu, 28 Sep 2023 19:28:13 +0000 Subject: [PATCH 06/86] [Bug] Create Rule CLI Crashes on Required Arg (#3127) --- detection_rules/cli_utils.py | 8 ++++---- detection_rules/misc.py | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detection_rules/cli_utils.py b/detection_rules/cli_utils.py index bc26007d7..8ec2ce928 100644 --- a/detection_rules/cli_utils.py +++ b/detection_rules/cli_utils.py @@ -140,9 +140,9 @@ def rule_prompt(path=None, rule_type=None, required_only=True, save=True, verbos threat_map = [] while click.confirm('add mitre tactic?'): - tactic = schema_prompt('mitre tactic name', type='string', enum=tactics, required=True) + tactic = schema_prompt('mitre tactic name', type='string', enum=tactics, is_required=True) technique_ids = schema_prompt(f'technique or sub-technique IDs for {tactic}', type='array', - required=False, enum=list(matrix[tactic])) or [] + is_required=False, enum=list(matrix[tactic])) or [] try: threat_map.append(build_threat_map_entry(tactic, *technique_ids)) @@ -158,7 +158,7 @@ def rule_prompt(path=None, rule_type=None, required_only=True, save=True, verbos continue if name == 'threshold': - contents[name] = {n: schema_prompt(f'threshold {n}', required=n in options['required'], **opts.copy()) + contents[name] = {n: schema_prompt(f'threshold {n}', is_required=n in options['required'], **opts.copy()) for n, opts in options['properties'].items()} continue @@ -166,7 +166,7 @@ def rule_prompt(path=None, rule_type=None, required_only=True, save=True, verbos contents[name] = schema_prompt(name, value=kwargs.pop(name)) continue - result = schema_prompt(name, required=name in required_fields, **options.copy()) + result = schema_prompt(name, is_required=name in required_fields, **options.copy()) if result: if name not in required_fields and result == options.get('default', ''): diff --git a/detection_rules/misc.py b/detection_rules/misc.py index bb0de6938..e940f9203 100644 --- a/detection_rules/misc.py +++ b/detection_rules/misc.py @@ -115,7 +115,7 @@ def nest_from_dot(dots, value): return nested -def schema_prompt(name, value=None, required=False, **options): +def schema_prompt(name, value=None, is_required=False, **options): """Interactively prompt based on schema requirements.""" name = str(name) field_type = options.get('type') @@ -136,7 +136,7 @@ def schema_prompt(name, value=None, required=False, **options): if name == 'rule_id': default = str(uuid.uuid4()) - if len(enum) == 1 and required and field_type != "array": + if len(enum) == 1 and is_required and field_type != "array": return enum[0] def _check_type(_val): @@ -168,7 +168,7 @@ def schema_prompt(name, value=None, required=False, **options): prompt = '{name}{default}{required}{multi}'.format( name=name, default=' [{}] ("n/a" to leave blank) '.format(default) if default else '', - required=' (required) ' if required else '', + required=' (required) ' if is_required else '', multi=' (multi, comma separated) ' if field_type == 'array' else '').strip() + ': ' while True: @@ -177,7 +177,7 @@ def schema_prompt(name, value=None, required=False, **options): result = None if not result: - if required: + if is_required: value = None continue else: @@ -187,7 +187,7 @@ def schema_prompt(name, value=None, required=False, **options): result_list = result.split(',') if not (min_item < len(result_list) < max_items): - if required: + if is_required: value = None break else: @@ -195,19 +195,19 @@ def schema_prompt(name, value=None, required=False, **options): for value in result_list: if not _check_type(value): - if required: + if is_required: value = None break else: return [] - if required and value is None: + if is_required and value is None: continue else: return [_convert_type(r) for r in result_list] else: if _check_type(result): return _convert_type(result) - elif required: + elif is_required: value = None continue return From 16550b7144f065fa12200fd880c9cc90d9de2de4 Mon Sep 17 00:00:00 2001 From: eric-forte-elastic <119343520+eric-forte-elastic@users.noreply.github.com> Date: Thu, 28 Sep 2023 16:32:55 -0400 Subject: [PATCH 07/86] [Bug] Updated os.path calls to pathlib (#3110) * Updated os.path calls to pathlib * fixed typo * os.join replacement typo * additional join typo * updated os directory functions * exist_ok typo * cleanup * Updated for cleanliness --------- Co-authored-by: Mika Ayenson --- rta/adobe_hijack.py | 19 ++++++------- rta/bitsadmin_download.py | 10 +++---- rta/c2_dns_from_iso.py | 8 +++--- rta/certutil_file_obfuscation.py | 10 +++---- rta/clr_logs_creation.py | 7 ++--- rta/common.py | 39 +++++++++++++------------- rta/delete_bootconf.py | 8 ++---- rta/disable_windows_fw.py | 8 ++---- rta/evasion_loadlib_via_callback.py | 8 +++--- rta/evasion_ntdll_from_unusual_path.py | 11 +++++--- rta/evasion_oversized_dll_load.py | 14 +++++---- rta/evasion_unhook_ldrloaddll.py | 8 +++--- rta/exec_dll_file_compressed.py | 8 +++--- rta/exec_java_via_scripting.py | 9 +++--- rta/exec_persistence_from_iso.py | 8 +++--- rta/execution_iso_dll_rundll32.py | 8 +++--- rta/execution_iso_dll_sideload.py | 8 +++--- rta/file_create_exchange_um.py | 8 +++--- rta/file_create_ms_addins.py | 8 +++--- rta/file_create_mstsc_startup.py | 4 +-- rta/file_create_outlook_vba.py | 8 +++--- rta/file_create_powershell_profile.py | 8 +++--- rta/file_create_scripting_startup.py | 8 +++--- rta/file_create_vbs_startup.py | 8 +++--- rta/file_delete_vbk.py | 7 ++--- rta/file_ms_template_macros.py | 8 +++--- rta/file_script_startup_folder.py | 8 +++--- rta/file_susp_browser_extension.py | 8 +++--- rta/git_creds_access.py | 7 ++--- rta/hosts_file_modify.py | 8 ++---- rta/installutil_network.py | 12 ++++---- rta/iqy_file_writes.py | 22 +++++++-------- rta/mac_office_descendant.py | 8 ++---- rta/modify_bootconf.py | 8 ++---- rta/ms_office_drop_exe.py | 9 +++--- rta/msoffice_addins_file.py | 8 +++--- rta/persistent_scripts.py | 7 ++--- rta/powershell_args.py | 8 ++---- rta/powershell_from_script.py | 8 ++---- rta/process_name_masquerade.py | 8 ++---- rta/recycle_bin_process.py | 10 +++---- rta/registry_hive_export.py | 8 ++---- rta/schtask_escalation.py | 8 ++---- rta/secure_file_deletion.py | 7 ++--- rta/sevenzip_encrypted.py | 14 ++++----- rta/sticky_keys_write_execute.py | 12 ++++---- rta/suspicious_office_descendant_fp.py | 6 ++-- rta/suspicious_powershell_download.py | 8 ++---- rta/suspicious_wscript_parent.py | 8 ++---- rta/system_restore_process.py | 8 ++---- rta/uac_cdssync.py | 10 +++---- rta/uac_mmc_deserialization.py | 14 ++++----- rta/unusual_ms_tool_network.py | 7 ++--- rta/unusual_parent_child.py | 10 +++---- rta/user_dir_escalation.py | 11 ++++---- rta/winrar_encrypted.py | 16 +++++------ rta/winrar_startup_folder.py | 9 +++--- 57 files changed, 253 insertions(+), 300 deletions(-) diff --git a/rta/adobe_hijack.py b/rta/adobe_hijack.py index 3499f58f8..3d0f91607 100644 --- a/rta/adobe_hijack.py +++ b/rta/adobe_hijack.py @@ -9,10 +9,9 @@ # Description: Replaces PE file that will run on Adobe Reader start. import os +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="2df08481-31db-44a8-b01d-1c0df827bddb", @@ -25,20 +24,20 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): - rdr_cef_dir = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF" - rdrcef_exe = os.path.join(rdr_cef_dir, "RdrCEF.exe") + rdr_cef_dir = Path("C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF") + rdrcef_exe = rdr_cef_dir / "RdrCEF.exe" cmd_path = "C:\\Windows\\System32\\cmd.exe" - backup = os.path.abspath("xxxxxx") + backup = Path("xxxxxx").resolve() backedup = False # backup original if it exists - if os.path.isfile(rdrcef_exe): + if rdrcef_exe.is_file(): common.log("{} already exists, backing up file.".format(rdrcef_exe)) common.copy_file(rdrcef_exe, backup) backedup = True else: common.log("{} doesn't exist. Creating path.".format(rdrcef_exe)) - os.makedirs(rdr_cef_dir) + rdr_cef_dir.mkdir(parents=True) # overwrite original common.copy_file(cmd_path, rdrcef_exe) @@ -47,10 +46,10 @@ def main(): if backedup: common.log("Putting back backup copy.") common.copy_file(backup, rdrcef_exe) - os.remove(backup) + backup.unlink() else: common.remove_file(rdrcef_exe) - os.removedirs(rdr_cef_dir) + rdr_cef_dir.rmdir() if __name__ == "__main__": diff --git a/rta/bitsadmin_download.py b/rta/bitsadmin_download.py index 38e8bd7fb..648278dc4 100644 --- a/rta/bitsadmin_download.py +++ b/rta/bitsadmin_download.py @@ -9,12 +9,10 @@ # Description: Runs BitsAdmin to download file via command line. -import os import subprocess +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="aee48793-01ec-428f-9890-c5db9df07830", @@ -30,8 +28,8 @@ def main(): common.log("Running Windows BitsAdmin to Download") server, ip, port = common.serve_web() url = "http://" + ip + ":" + str(port) + "/bin/myapp.exe" - dest_path = os.path.abspath("myapp-test.exe") - fake_word = os.path.abspath("winword.exe") + dest_path = Path("myapp-test.exe").resolve() + fake_word = Path("winword.exe").resolve() common.log("Emulating parent process: {parent}".format(parent=fake_word)) common.copy_file("C:\\Windows\\System32\\cmd.exe", fake_word) diff --git a/rta/c2_dns_from_iso.py b/rta/c2_dns_from_iso.py index 38de43412..0545f6f40 100644 --- a/rta/c2_dns_from_iso.py +++ b/rta/c2_dns_from_iso.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="ba802fb2-f183-420e-947m-da5ce0235d123", @@ -27,7 +27,7 @@ PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") @common.requires_os(metadata.platforms) def main(): - if os.path.exists(ISO) and os.path.exists(PS_SCRIPT): + if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): print(f'[+] - ISO File {ISO} will be mounted and executed via powershell') # 3 unique domains to trigger 3 unique rules looking for dns events via a process running from a mounted ISO file diff --git a/rta/certutil_file_obfuscation.py b/rta/certutil_file_obfuscation.py index 706473488..d2063e34a 100644 --- a/rta/certutil_file_obfuscation.py +++ b/rta/certutil_file_obfuscation.py @@ -9,11 +9,9 @@ # signal.rule.name: Encoding or Decoding Files via CertUtil # Description: Uses certutil to create an encoded copy of cmd.exe. Then uses certutil to decode that copy. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="7b2c1b3e-2097-4e2f-bf5c-e157a91b8001", @@ -27,8 +25,8 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): common.log("Encoding target") - encoded_file = os.path.abspath("encoded.txt") - decoded_file = os.path.abspath("decoded.exe") + encoded_file = Path("encoded.txt").resolve() + decoded_file = Path("decoded.exe").resolve() common.execute( [ "c:\\Windows\\System32\\certutil.exe", diff --git a/rta/clr_logs_creation.py b/rta/clr_logs_creation.py index c216b25a4..a06288517 100644 --- a/rta/clr_logs_creation.py +++ b/rta/clr_logs_creation.py @@ -3,10 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="9bf3622b-dd76-4156-a89c-6845dca46b1f", @@ -32,7 +31,7 @@ def main(): fake_clr_logs = fake_clr_path + "\\msxsl.exe.log" common.copy_file(EXE_FILE, msxsl) - os.makedirs(fake_clr_path, exist_ok=True) + Path(fake_clr_path).mkdir(parents=True, exist_ok=True) common.log("Creating a fake clr log file") common.execute([msxsl, "-c", f"echo RTA > {fake_clr_logs}"], timeout=10) common.remove_files(msxsl, fake_clr_logs) diff --git a/rta/common.py b/rta/common.py index fc1458257..47858425a 100644 --- a/rta/common.py +++ b/rta/common.py @@ -127,7 +127,7 @@ else: CMD_PATH = "/bin/sh" POWERSHELL_PATH = None -BASE_DIR = os.path.dirname(os.path.abspath(__file__)) +BASE_DIR = Path(__file__).resolve().parent ALL_IP = "0.0.0.0" IP_REGEX = r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" CALLBACK_REGEX = r"https?://" + IP_REGEX + r":\d+" @@ -176,6 +176,7 @@ def requires_os(*os_list: str): @functools.wraps(f) def decorated(*args, **kwargs): if CURRENT_OS not in os_list: + # NOTE os.path.relpath supports Path objects and does not exist in pathlib filename = os.path.relpath(inspect.getsourcefile(f)) func_name = f.__name__ @@ -191,7 +192,7 @@ def requires_os(*os_list: str): def check_dependencies(*paths: str) -> bool: missing = [] for path in paths: - if not os.path.exists(path): + if not Path(path).exists(): log("Missing dependency %s" % path, "!") missing.append(path) return len(missing) == 0 @@ -200,7 +201,7 @@ def check_dependencies(*paths: str) -> bool: def dependencies(*paths: str): missing = [] for path in paths: - if not os.path.exists(path): + if not Path(path).exists(): missing.append(path) def decorator(f): @@ -209,6 +210,7 @@ def dependencies(*paths: str): if len(missing): log("Missing dependencies for %s:%s()" % (f.func_code.co_filename, f.func_code.co_name), "!") for dep in missing: + # NOTE os.path.relpath supports Path objects and does not exist in pathlib print(" - %s" % os.path.relpath(dep, BASE_DIR)) return MISSING_DEPENDENCIES return f(*args, **kwargs) @@ -237,8 +239,8 @@ def temporary_file(contents, file_name=None): def temporary_file_helper(contents, file_name=None): - if not (file_name and os.path.isabs(file_name)): - file_name = os.path.join(tempfile.gettempdir(), file_name or f"temp{hash(contents):d}") + if not (file_name and Path(file_name).is_absolute()): + file_name = Path(tempfile.gettempdir()) / file_name or f"temp{hash(contents):d}" with open(file_name, "wb" if isinstance(contents, bytes) else "w") as f: f.write(contents) @@ -373,14 +375,13 @@ def link_file(source, target): log("Linking %s -> %s" % (source, target)) execute(["ln", "-s", source, target]) - -def remove_file(path): - if os.path.exists(path): +def remove_file(path: str): + if Path(path).is_file(): log("Removing %s" % path, log_type="-") # Try three times to remove the file for _ in range(3): try: - os.remove(path) + Path(path).unlink() except OSError: time.sleep(0.25) else: @@ -388,12 +389,11 @@ def remove_file(path): def remove_directory(path): - if os.path.exists(path): - if os.path.isdir(path): - log(f"Removing directory {path:s}", log_type="-") - shutil.rmtree(path) - else: - remove_file(path) + if Path(path).is_dir(): + log(f"Removing directory {path:s}", log_type="-") + shutil.rmtree(path) + else: + remove_file(path) def is_64bit(): @@ -534,9 +534,9 @@ def get_ipv4_address(hostname): def find_writeable_directory(base_dir): for root, dirs, files in os.walk(base_dir): for d in dirs: - subdir = os.path.join(base_dir, d) + subdir = Path(base_dir) / d try: - test_file = os.path.join(subdir, "test_file") + test_file = Path(subdir) / "test_file" f = open(test_file, "w") f.close() os.remove(test_file) @@ -557,10 +557,11 @@ def run_system(arguments=None): return None if arguments is None: + # NOTE os.path.relpath supports Path objects and does not exist in pathlib arguments = [sys.executable, os.path.abspath(sys.argv[0])] + sys.argv[1:] log("Attempting to elevate to SYSTEM using PsExec") - if not os.path.exists(PS_EXEC): + if not Path(PS_EXEC).is_file(): log("PsExec not found", log_type="-") return MISSING_PSEXEC @@ -717,7 +718,7 @@ def enable_logon_auditing(host="localhost", verbose=True, sleep=2): def print_file(path): print(path) - if not os.path.exists(path): + if not Path(path).is_file(): print("--- NOT FOUND ----") else: print("-" * 16) diff --git a/rta/delete_bootconf.py b/rta/delete_bootconf.py index e3d86d4fe..31270f3c4 100644 --- a/rta/delete_bootconf.py +++ b/rta/delete_bootconf.py @@ -10,11 +10,9 @@ # Description: Uses bcdedit.exe to backup the current boot configuration, and then to delete the current boot # configuration, finally restoring the original. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="eaf71384-2e38-4970-b170-9645ccde1d2b", @@ -30,7 +28,7 @@ def main(): # Messing with the boot configuration is probably not a great idea so create a backup: common.log("Exporting the boot configuration....") bcdedit = "bcdedit.exe" - backup_file = os.path.abspath("boot.cfg") + backup_file = Path("boot.cfg").resolve() common.execute(["bcdedit.exe", "/export", backup_file]) # WARNING: this is a destructive command which might be super bad to run diff --git a/rta/disable_windows_fw.py b/rta/disable_windows_fw.py index ceb612b6d..35323c3af 100644 --- a/rta/disable_windows_fw.py +++ b/rta/disable_windows_fw.py @@ -9,11 +9,9 @@ # signal.rule.name: Disable Windows Firewall Rules via Netsh # Description: Uses netsh.exe to backup, disable and restore firewall rules. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="75e14e5a-1188-47ea-9b96-2cf6e9443fc2", @@ -29,7 +27,7 @@ def main(): common.log("NetSH Advanced Firewall Configuration", log_type="~") netsh = "netsh.exe" - rules_file = os.path.abspath("fw.rules") + rules_file = Path("fw.rules").resolve() # Check to be sure that fw.rules does not already exist from previously running this script common.remove_file(rules_file) diff --git a/rta/evasion_loadlib_via_callback.py b/rta/evasion_loadlib_via_callback.py index 9e0f98345..381461014 100644 --- a/rta/evasion_loadlib_via_callback.py +++ b/rta/evasion_loadlib_via_callback.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="ae4b2807-3a16-485e-bb69-5d36bbe9b7d1", @@ -22,7 +22,7 @@ BIN = common.get_path("bin", "LoadLib-Callback64.exe") @common.requires_os(metadata.platforms) def main(): - if os.path.exists(BIN) : + if Path(BIN).is_file(): print(f'[+] - File {BIN} will be executed') common.execute(BIN) # cleanup diff --git a/rta/evasion_ntdll_from_unusual_path.py b/rta/evasion_ntdll_from_unusual_path.py index f1c54dae3..e447052fb 100644 --- a/rta/evasion_ntdll_from_unusual_path.py +++ b/rta/evasion_ntdll_from_unusual_path.py @@ -4,9 +4,9 @@ # 2.0. -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="e6d5315f-4c70-4788-8564-e7c23786a4d0", @@ -20,10 +20,13 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): - import win32file, win32api, os, time + import time from os import path + + import win32api + import win32file win32file.CopyFile(path.expandvars("%systemroot%\\system32\\ntdll.dll"), path.expandvars("%localappdata%\\Temp\\notntdll.dll"), 0) - if os.path.exists(path.expandvars("%localappdata%\\Temp\\notntdll.dll")): + if Path(path.expandvars("%localappdata%\\Temp\\notntdll.dll")).is_file(): print(f"[+] - NTDLL copied") r = win32api.LoadLibrary(path.expandvars("%localappdata%\\Temp\\notntdll.dll")) if r > 0 : diff --git a/rta/evasion_oversized_dll_load.py b/rta/evasion_oversized_dll_load.py index a09192410..1622d8b23 100644 --- a/rta/evasion_oversized_dll_load.py +++ b/rta/evasion_oversized_dll_load.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="ec52377c-b2a8-4c44-8eb4-465376f2189a", @@ -30,16 +30,18 @@ WER = "c:\\windows\\system32\\werfault.exe" @common.requires_os(metadata.platforms) def main(): - import os, win32file + import os from os import path - if os.path.exists(DLL) : + + import win32file + if Path(DLL).is_file(): tempc = path.expandvars("%localappdata%\\Temp\\oversized.dll") rta_dll = path.expandvars("%localappdata%\\Temp\\faultrep.dll") rta_pe = path.expandvars("%localappdata%\\Temp\\wer.exe") # copy files to temp win32file.CopyFile(DLL,tempc, 0) win32file.CopyFile(WER, rta_pe, 0) - if os.path.exists(tempc): + if Path(tempc).is_file(): print(f"[+] - {DLL} copied to {tempc}") print(f"[+] - File {tempc} will be appended with null bytes to reach 90MB in size.") # append null bytes to makde the DLL oversized 90+MB in size @@ -49,7 +51,7 @@ def main(): # copied via cmd to trigger the rule - python is signed and won't trigger the file mod part of the rule common.execute(["cmd.exe", "/c", "copy", tempc, rta_dll]) - if os.path.exists(rta_dll) and os.path.exists(rta_pe): + if Path(rta_dll).is_file() and Path(rta_pe).is_file(): # should trigger rundll32 rules common.execute(["rundll32.exe", rta_dll, "DllMain"]) # should trigger dll sideload from current dir diff --git a/rta/evasion_unhook_ldrloaddll.py b/rta/evasion_unhook_ldrloaddll.py index decbaf052..971059e8d 100644 --- a/rta/evasion_unhook_ldrloaddll.py +++ b/rta/evasion_unhook_ldrloaddll.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="7fcf2f31-b510-45f8-9de4-7dc8f5ecb68b", @@ -24,7 +24,7 @@ BIN = common.get_path("bin", "rta_unhook_ldrload.exe") @common.requires_os(metadata.platforms) def main(): - if os.path.exists(BIN) : + if Path(BIN).is_file(): print(f'[+] - File {BIN} will be executed') common.execute(BIN) # cleanup diff --git a/rta/exec_dll_file_compressed.py b/rta/exec_dll_file_compressed.py index cc8da48fc..628a90bf4 100644 --- a/rta/exec_dll_file_compressed.py +++ b/rta/exec_dll_file_compressed.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="bbad34f5-3542-4484-9b23-5ef05af94c0f", @@ -22,7 +22,7 @@ RENAMER = common.get_path("bin", "rcedit-x64.exe") @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Public\\Temp\\7z\\" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = "C:\\Users\\Public\\Temp\\7z\\file.exe" user32 = "C:\\Windows\\System32\\user32.dll" dll = "C:\\Users\\Public\\Temp\\7z\\unsigned.dll" diff --git a/rta/exec_java_via_scripting.py b/rta/exec_java_via_scripting.py index a53899926..518abee61 100644 --- a/rta/exec_java_via_scripting.py +++ b/rta/exec_java_via_scripting.py @@ -3,9 +3,10 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="a3b26c9e-6910-43f7-93b2-84cc777e54f4", @@ -32,8 +33,8 @@ def main(): cscript = "C:\\Users\\Public\\cscript.exe" executable = path + "Javafake.exe" - if not os.path.exists(path): - os.makedirs(path) + if not Path(path).is_dir(): + Path(path).mkdir(parents=True) else: pass common.copy_file(EXE_FILE, cscript) diff --git a/rta/exec_persistence_from_iso.py b/rta/exec_persistence_from_iso.py index 39cbd9500..74dea60e4 100644 --- a/rta/exec_persistence_from_iso.py +++ b/rta/exec_persistence_from_iso.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="a4355bfc-aa15-43f6-a36d-523aa637127b", @@ -26,7 +26,7 @@ PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") @common.requires_os(metadata.platforms) def main(): - if os.path.exists(ISO) and os.path.exists(PS_SCRIPT): + if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): print(f'[+] - ISO File {ISO} will be mounted and executed via powershell') # commands to trigger two unique rules looking for persistence from a mounted ISO file diff --git a/rta/execution_iso_dll_rundll32.py b/rta/execution_iso_dll_rundll32.py index d9151e82d..66db61faa 100644 --- a/rta/execution_iso_dll_rundll32.py +++ b/rta/execution_iso_dll_rundll32.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="8bd17f51-3fc0-46a8-9e1a-662723314ad4", @@ -27,7 +27,7 @@ PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") @common.requires_os(metadata.platforms) def main(): - if os.path.exists(ISO) and os.path.exists(PS_SCRIPT): + if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): print(f'[+] - ISO File {ISO} will be mounted and executed via powershell') # import ExecFromISO function that takes two args -ISOFIle pointing to ISO file path and -procname pointing to the filename to execute diff --git a/rta/execution_iso_dll_sideload.py b/rta/execution_iso_dll_sideload.py index 228ddafc9..1aa167ac1 100644 --- a/rta/execution_iso_dll_sideload.py +++ b/rta/execution_iso_dll_sideload.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="ba802fb2-f183-420e-947b-da5ce0c74d123", @@ -25,7 +25,7 @@ PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") @common.requires_os(metadata.platforms) def main(): - if os.path.exists(ISO) and os.path.exists(PS_SCRIPT): + if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): print(f'[+] - ISO File {ISO} will be mounted and executed via powershell') # import ExecFromISO function that takes two args -ISOFIle pointing to ISO file path and -procname pointing to the filename to execute diff --git a/rta/file_create_exchange_um.py b/rta/file_create_exchange_um.py index 64ec87067..92a498449 100644 --- a/rta/file_create_exchange_um.py +++ b/rta/file_create_exchange_um.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="29eb99a6-14cc-4d37-81dd-c2e78cda8c74", @@ -26,7 +26,7 @@ def main(): path = "C:\\Users\\Public\\Microsoft\\Exchange Server Test\\FrontEnd\\HttpProxy\\owa\\auth\\" argpath = "C:\\Users\\Public\\Microsoft\\'Exchange Server Test'\\FrontEnd\\HttpProxy\\owa\\auth\\" common.copy_file(EXE_FILE, proc) - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = argpath + "\\shell.php" common.execute([proc, "/c", f"echo AAAAAAAA | Out-File {file}"], timeout=10, kill=True) diff --git a/rta/file_create_ms_addins.py b/rta/file_create_ms_addins.py index 44c37b531..0870275e1 100644 --- a/rta/file_create_ms_addins.py +++ b/rta/file_create_ms_addins.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="5432792c-d31a-42cc-a82f-0884ea230493", @@ -20,7 +20,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Public\\\\AppData\\Roaming\\Microsoft\\Word\\Startup" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = path + "\\file.xll" common.copy_file(EXE_FILE, file) diff --git a/rta/file_create_mstsc_startup.py b/rta/file_create_mstsc_startup.py index d9dd0d5e8..bebe6a7b7 100644 --- a/rta/file_create_mstsc_startup.py +++ b/rta/file_create_mstsc_startup.py @@ -5,7 +5,7 @@ from . import common from . import RtaMetadata -import os +from pathlib import Path metadata = RtaMetadata( uuid="55750f93-0545-4222-a1fe-8b25a1c736f0", @@ -23,7 +23,7 @@ def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" argpath = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\'Start Menu'\\Programs\\Startup" common.copy_file(EXE_FILE, mstsc) - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = argpath + "\\file.exe" common.execute([mstsc, "/c", f"echo AAAAAAAA | Out-File {file}"], timeout=10, kill=True) diff --git a/rta/file_create_outlook_vba.py b/rta/file_create_outlook_vba.py index 07effea29..4797cec9b 100644 --- a/rta/file_create_outlook_vba.py +++ b/rta/file_create_outlook_vba.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="3c40b5fd-afd0-4794-8af3-f7af249edf84", @@ -20,7 +20,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Outlook" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = path + "\\VbaProject.OTM" common.copy_file(EXE_FILE, file) diff --git a/rta/file_create_powershell_profile.py b/rta/file_create_powershell_profile.py index 0f4ee9a25..d82fccd06 100644 --- a/rta/file_create_powershell_profile.py +++ b/rta/file_create_powershell_profile.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="1bc32d6d-c5c9-43c6-bada-6d26469b5dac", @@ -20,7 +20,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Public\\Documents\\WindowsPowerShell" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = path + "\\profile.ps1" common.copy_file(EXE_FILE, file) diff --git a/rta/file_create_scripting_startup.py b/rta/file_create_scripting_startup.py index 05fb8b5c2..5f8caa28e 100644 --- a/rta/file_create_scripting_startup.py +++ b/rta/file_create_scripting_startup.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="e56f77bc-d9a7-4e02-97e2-b3056f3d4171", @@ -25,7 +25,7 @@ def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" argpath = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\'Start Menu'\\Programs\\Startup" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = argpath + "\\file.exe" common.execute([powershell, "/c", f"echo AAAAAAAA | Out-File {file}"], timeout=10, kill=True) diff --git a/rta/file_create_vbs_startup.py b/rta/file_create_vbs_startup.py index 4349550fd..d1586236a 100644 --- a/rta/file_create_vbs_startup.py +++ b/rta/file_create_vbs_startup.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="7cee9313-5e55-472b-9d61-a95b0c9725d6", @@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Programs\\Startup" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = path + "\\a.vbs" common.copy_file(EXE_FILE, file) diff --git a/rta/file_delete_vbk.py b/rta/file_delete_vbk.py index 905d4dfc1..686a9631c 100644 --- a/rta/file_delete_vbk.py +++ b/rta/file_delete_vbk.py @@ -3,10 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="a6c80b08-ca72-4c3e-93c7-ac3421e4235e", @@ -22,7 +21,7 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): - fakebkp = os.path.abspath("fake.vbk") + fakebkp = Path("fake.vbk").resolve() with open(fakebkp, 'w'): pass common.remove_file(fakebkp) diff --git a/rta/file_ms_template_macros.py b/rta/file_ms_template_macros.py index 6362b7c9f..a92c79720 100644 --- a/rta/file_ms_template_macros.py +++ b/rta/file_ms_template_macros.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="858475a2-78a6-40f8-8691-7ce0c631cc0c", @@ -22,7 +22,7 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Templates\\" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = path + "\\Normal.dotm" common.temporary_file_helper("testing", file_name=file) diff --git a/rta/file_script_startup_folder.py b/rta/file_script_startup_folder.py index 3ed6cc4e3..1d180bc79 100644 --- a/rta/file_script_startup_folder.py +++ b/rta/file_script_startup_folder.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="b8dcb997-e099-472e-8f2f-15a80c8dfe1a", @@ -32,7 +32,7 @@ def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\'Start Menu'\\Programs\\Startup\\" file = path + "\\a.js" common.copy_file(EXE_FILE, proc) - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) common.execute([proc, "/c", f"Copy-Item {EXE_FILE} {file}"], timeout=10) common.remove_files(proc, file) diff --git a/rta/file_susp_browser_extension.py b/rta/file_susp_browser_extension.py index 4eefa1d49..03aafdb19 100644 --- a/rta/file_susp_browser_extension.py +++ b/rta/file_susp_browser_extension.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="edb804d6-85df-4dca-a521-1b6dfee9f354", @@ -26,7 +26,7 @@ def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Mozilla\\Test\\Profiles\\AdefaultA" file = path + "\\extensions.json" common.copy_file(EXE_FILE, proc) - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) common.execute([proc, "/c", f"Copy-Item {EXE_FILE} {file}"], timeout=10) common.remove_files(proc, file) diff --git a/rta/git_creds_access.py b/rta/git_creds_access.py index 8ebd6fb53..ec5808078 100644 --- a/rta/git_creds_access.py +++ b/rta/git_creds_access.py @@ -3,10 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="e15ea2ec-c8a9-4203-8d01-d18d1c27fd58", @@ -25,7 +24,7 @@ def main(): gitpath = "C:\\Users\\Public\\.config\\git" try: - os.makedirs(gitpath) + Path(gitpath).mkdir(parents=True) except Exception: pass gitcreds = gitpath + "\\credentials" diff --git a/rta/hosts_file_modify.py b/rta/hosts_file_modify.py index 9505a0c42..d7122e4d7 100644 --- a/rta/hosts_file_modify.py +++ b/rta/hosts_file_modify.py @@ -11,12 +11,10 @@ import os import random import time - +from pathlib import Path from string import ascii_letters -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="f24491d0-720b-4150-a2a1-45b5b07238aa", @@ -35,7 +33,7 @@ def main(): } hosts_file = hosts_files[common.CURRENT_OS] - backup = os.path.abspath(hosts_file + "_backup") + backup = Path(hosts_file + "_backup").resolve() common.log("Backing up original 'hosts' file.") common.copy_file(hosts_file, backup) diff --git a/rta/installutil_network.py b/rta/installutil_network.py index b964a166c..ac0c41cdf 100644 --- a/rta/installutil_network.py +++ b/rta/installutil_network.py @@ -10,12 +10,10 @@ # Elastic detection: Unusual Network Activity from a Windows System Binary # Description: Uses mock .NET malware and InstallUtil to create network activity from InstallUtil. -import os import sys +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="6dfa88c9-9fb2-4fb0-8bea-0bc45222b498", @@ -56,9 +54,9 @@ def main(): install_util86 = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe" fallback = False - if os.path.exists(install_util64): + if Path(install_util64).is_file(): install_util = install_util64 - elif os.path.exists(install_util86): + elif Path(install_util86).is_file(): install_util = install_util86 else: install_util = None @@ -70,7 +68,7 @@ def main(): else: common.log("Unable to find InstallUtil, creating temp file") - install_util = os.path.abspath("InstallUtil.exe") + install_util = Path("InstallUtil.exe").resolve() common.copy_file(sys.executable, install_util) common.execute( [ diff --git a/rta/iqy_file_writes.py b/rta/iqy_file_writes.py index 9afd0bff8..e93b5f2b0 100644 --- a/rta/iqy_file_writes.py +++ b/rta/iqy_file_writes.py @@ -8,11 +8,9 @@ # ATT&CK: T1140, T1192, T1193 # Description: Generates four file writes related to file extensions (PUB, IQY) -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="71f67037-1df3-4d5f-b8cb-eaf295ad16ed", @@ -26,9 +24,9 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): common.log("Suspicious File Writes (IQY, PUB)") - adobe_path = os.path.abspath("AcroRd32.exe") - msoffice_path = os.path.abspath("winword.exe") - browser_path = os.path.abspath("iexplore.exe") + adobe_path = Path("AcroRd32.exe").resolve() + msoffice_path = Path("winword.exe").resolve() + browser_path = Path("iexplore.exe").resolve() common.copy_file(common.CMD_PATH, adobe_path) common.copy_file(common.CMD_PATH, msoffice_path) common.copy_file(common.CMD_PATH, browser_path) @@ -36,22 +34,22 @@ def main(): # write file as adobe, then run it common.log("Creating a 'suspicious' executable") - bad_path = os.path.abspath("bad.exe") + bad_path = Path("bad.exe").resolve() # PDF writing IQY file - fake_iqy = os.path.abspath("test.iqy") + fake_iqy = Path("test.iqy").resolve() common.execute([adobe_path, "/c", "echo", "test", ">", fake_iqy]) # PDF writing PUB file - fake_pub = os.path.abspath("test.pub") + fake_pub = Path("test.pub").resolve() common.execute([adobe_path, "/c", "echo", "test", ">", fake_pub]) # Winword writing IQY file - fake_doc_iqy = os.path.abspath("test_word.iqy") + fake_doc_iqy = Path("test_word.iqy").resolve() common.execute([msoffice_path, "/c", "echo", "test", ">", fake_doc_iqy]) # Browser writing IQY file - fake_browser_iqy = os.path.abspath("test_browser.iqy") + fake_browser_iqy = Path("test_browser.iqy").resolve() common.execute([browser_path, "/c", "echo", "test", ">", fake_browser_iqy]) # cleanup diff --git a/rta/mac_office_descendant.py b/rta/mac_office_descendant.py index 47dafc0dd..60f411632 100644 --- a/rta/mac_office_descendant.py +++ b/rta/mac_office_descendant.py @@ -7,11 +7,9 @@ # RTA: mac_office_descendant.py # Description: Creates a suspicious process spawned from "Microsoft Word" -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="bb523eb1-db67-4ae6-9369-af1a93322817", @@ -25,7 +23,7 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): common.log("Emulating Microsoft Word running enumeration commands") - office_path = os.path.abspath("Microsoft Word") + office_path = Path("Microsoft Word").resolve() common.copy_file("/bin/sh", office_path) common.execute([office_path], stdin="whoami") diff --git a/rta/modify_bootconf.py b/rta/modify_bootconf.py index c832fec4e..ead87d16d 100644 --- a/rta/modify_bootconf.py +++ b/rta/modify_bootconf.py @@ -3,11 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="672cd0e6-fa5a-468f-80c8-04f92bead469", @@ -27,7 +25,7 @@ def main(): # Messing with the boot configuration is not a great idea so create a backup: common.log("Exporting the boot configuration....") - backup_file = os.path.abspath("boot.cfg") + backup_file = Path("boot.cfg").resolve() common.execute([bcdedit, "/export", backup_file]) # WARNING: this sets up computer to boot into Safe Mode upon reboot diff --git a/rta/ms_office_drop_exe.py b/rta/ms_office_drop_exe.py index 7d0e1a438..13e4cb1e8 100644 --- a/rta/ms_office_drop_exe.py +++ b/rta/ms_office_drop_exe.py @@ -10,10 +10,9 @@ import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="ce85674f-fb6c-44d5-b880-4ce9062e1028", @@ -35,10 +34,10 @@ def main(): for office_app in ["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe"]: common.log("Emulating office application %s" % office_app) - office_path = os.path.abspath(office_app) + office_path = Path(office_app).resolve() common.copy_file(cmd_path, office_path) - bad_path = os.path.abspath("bad-{}-{}.exe".format(hash(office_app), os.getpid())) + bad_path = Path("bad-{}-{}.exe".format(hash(office_app), os.getpid())).resolve() common.execute([office_path, "/c", "copy", cmd_path, bad_path]) time.sleep(1) diff --git a/rta/msoffice_addins_file.py b/rta/msoffice_addins_file.py index 99a0239f6..30ceb12cc 100644 --- a/rta/msoffice_addins_file.py +++ b/rta/msoffice_addins_file.py @@ -3,9 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +from pathlib import Path + +from . import RtaMetadata, common metadata = RtaMetadata( uuid="97979b30-908d-4c57-a33a-f3b78e55a84a", @@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") @common.requires_os(metadata.platforms) def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Word\\Startup" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) file = path + "\\file.exe" common.copy_file(EXE_FILE, file) diff --git a/rta/persistent_scripts.py b/rta/persistent_scripts.py index ac7fc765a..da2e4a743 100644 --- a/rta/persistent_scripts.py +++ b/rta/persistent_scripts.py @@ -9,10 +9,9 @@ import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="2ab62c28-1abb-4ac5-a16d-2f4f75d01d02", @@ -38,7 +37,7 @@ def main(): # Remove any existing profiles user_profile = os.environ["USERPROFILE"] - log_file = os.path.join(user_profile, NAME + ".log") + log_file = Path(user_profile) / NAME / ".log" # Remove log file if exists common.remove_file(log_file) diff --git a/rta/powershell_args.py b/rta/powershell_args.py index c2f5ce327..b10c86fd2 100644 --- a/rta/powershell_args.py +++ b/rta/powershell_args.py @@ -9,11 +9,9 @@ # Description: Calls PowerShell with suspicious command line arguments. import base64 -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="5efc844c-0c11-4f84-a904-ada611315298", @@ -31,7 +29,7 @@ def encode(command): @common.requires_os(metadata.platforms) def main(): common.log("PowerShell Suspicious Commands") - temp_script = os.path.abspath("tmp.ps1") + temp_script = Path("tmp.ps1").resolve() # Create an empty script with open(temp_script, "w") as f: diff --git a/rta/powershell_from_script.py b/rta/powershell_from_script.py index 5693f97cb..b5410c938 100644 --- a/rta/powershell_from_script.py +++ b/rta/powershell_from_script.py @@ -9,12 +9,10 @@ # ATT&CK: T1064, T1192, T1193 # Description: Creates a javascript file that will launch powershell. -import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="161c5972-6bfe-47b5-92bd-e0399e025dec", @@ -28,7 +26,7 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): # Write script - script_file = os.path.abspath("launchpowershell.vbs") + script_file = Path("launchpowershell.vbs").resolve() script = """Set objShell = CreateObject("Wscript.shell") objShell.run("powershell echo 'Doing evil things...'; sleep 3") """ diff --git a/rta/process_name_masquerade.py b/rta/process_name_masquerade.py index dc4e8cdef..f608b491a 100644 --- a/rta/process_name_masquerade.py +++ b/rta/process_name_masquerade.py @@ -3,11 +3,9 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="98adf0ff-2d8e-4eea-8d68-42084204bb74", @@ -29,7 +27,7 @@ def main(): masquerades = ["svchost.exe", "lsass.exe"] for name in masquerades: - path = os.path.abspath(name) + path = Path(name).resolve() common.copy_file(CMD_PATH, path) common.execute(path, timeout=3, kill=True) common.remove_file(path) diff --git a/rta/recycle_bin_process.py b/rta/recycle_bin_process.py index 9c3837ff1..06f5e3e9e 100644 --- a/rta/recycle_bin_process.py +++ b/rta/recycle_bin_process.py @@ -8,12 +8,10 @@ # ATT&CK: T1158 # Description: Executes mock malware from the "C:\Recycler\" and "C:\$RECYCLE.BIN\" subdirectories. -import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="790cbe6f-ee44-4654-9998-039236dbe0d8", @@ -39,7 +37,7 @@ def main(): common.log("Execute files from the Recycle Bin") target_dir = None for recycle_path in RECYCLE_PATHS: - if os.path.exists(recycle_path): + if Path(recycle_path).exists(): target_dir = common.find_writeable_directory(recycle_path) if target_dir: break @@ -58,7 +56,7 @@ def main(): source_path = command[0] arguments = command[1:] - target_path = os.path.join(target_dir, "recycled_process.exe") + target_path = Path(target_dir) / "recycled_process.exe" common.copy_file(source_path, target_path) arguments.insert(0, target_path) common.execute(arguments) diff --git a/rta/registry_hive_export.py b/rta/registry_hive_export.py index 5ba09b263..8c56ca651 100644 --- a/rta/registry_hive_export.py +++ b/rta/registry_hive_export.py @@ -8,11 +8,9 @@ # ATT&CK: TBD # Description: Exports the SAM, SECURITY and SYSTEM hives - useful in credential harvesting and discovery attacks. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="dfdcc4f4-5aca-486a-8115-b15b653b9b4f", @@ -34,7 +32,7 @@ REG = "reg.exe" @common.requires_os(metadata.platforms) def main(): for hive in ["sam", "security", "system"]: - filename = os.path.abspath("%s.reg" % hive) + filename = Path("%s.reg" % hive).resolve() common.log("Exporting %s hive to %s" % (hive, filename)) common.execute([REG, "save", "hkey_local_machine\\%s" % hive, filename]) common.remove_file(filename) diff --git a/rta/schtask_escalation.py b/rta/schtask_escalation.py index 79f06cfef..91527f518 100644 --- a/rta/schtask_escalation.py +++ b/rta/schtask_escalation.py @@ -11,12 +11,10 @@ # signal.rule.name: Net command via SYSTEM account # ATT&CK: T1053 -import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="1a61241e-5b1b-44ec-8c9f-3ae4652550be", @@ -40,7 +38,7 @@ def main(): common.log("Scheduled Task Privilege Escalation") task_name = "test-task-rta" - file_path = os.path.abspath("task.log") + file_path = Path("task.log").resolve() command = "cmd.exe /c whoami.exe > " + file_path # Delete the task if it exists diff --git a/rta/secure_file_deletion.py b/rta/secure_file_deletion.py index 791f8386a..0d496dac2 100644 --- a/rta/secure_file_deletion.py +++ b/rta/secure_file_deletion.py @@ -6,10 +6,9 @@ import os import subprocess import tempfile +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="9cb42759-a161-4d93-b07d-3c8254dc8838", @@ -22,7 +21,7 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): - temp_path = os.path.join(tempfile.gettempdir(), os.urandom(16).encode("hex")) + temp_path = Path(tempfile.gettempdir()) / os.urandom(16).encode("hex") sdelete_path = common.get_path("bin", "sdelete.exe") try: diff --git a/rta/sevenzip_encrypted.py b/rta/sevenzip_encrypted.py index 1fa3ce940..22df1fdfc 100644 --- a/rta/sevenzip_encrypted.py +++ b/rta/sevenzip_encrypted.py @@ -9,12 +9,10 @@ # Description: Uses "bin\.exe" to perform encryption of archives and archive headers. import base64 -import os import sys +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="6cd35061-278b-45e7-a9cb-86b48bc47884", @@ -28,7 +26,7 @@ metadata = RtaMetadata( SEVENZIP = common.get_path("bin", "7za.exe") -def create_exfil(path=os.path.abspath("secret_stuff.txt")): +def create_exfil(path=Path("secret_stuff.txt").resolve()): common.log("Writing dummy exfil to %s" % path) with open(path, "wb") as f: f.write(base64.b64encode(b"This is really secret stuff\n" * 100)) @@ -39,16 +37,16 @@ def create_exfil(path=os.path.abspath("secret_stuff.txt")): @common.dependencies(SEVENZIP) def main(password="s0l33t"): # create 7z.exe with not-7zip name, and exfil - svnz2 = os.path.abspath("a.exe") + svnz2 = Path("a.exe").resolve() common.copy_file(SEVENZIP, svnz2) exfil = create_exfil() exts = ["7z", "zip", "gzip", "tar", "bz2", "bzip2", "xz"] - out_jpg = os.path.abspath("out.jpg") + out_jpg = Path("out.jpg").resolve() for ext in exts: # Write archive for each type - out_file = os.path.abspath("out." + ext) + out_file = Path("out." + ext).resolve() common.execute([svnz2, "a", out_file, "-p" + password, exfil], mute=True) common.remove_file(out_file) diff --git a/rta/sticky_keys_write_execute.py b/rta/sticky_keys_write_execute.py index d80540c1e..c775c76e7 100644 --- a/rta/sticky_keys_write_execute.py +++ b/rta/sticky_keys_write_execute.py @@ -11,12 +11,10 @@ # ATT&CK: T1015 # Description: Writes different binaries into various accessibility locations. -import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="398933ec-f8d4-4d81-93ed-e7d7adcb9d97", @@ -48,13 +46,13 @@ def main(): "displayswitch.exe", "atbroker.exe", ] - calc = os.path.abspath("\\windows\\system32\\calc.exe") - temp = os.path.abspath("temp.exe") + calc = Path("\\windows\\system32\\calc.exe").resolve() + temp = Path("temp.exe").resolve() # loop over bins for bin_name in bins: - bin_path = os.path.abspath("\\Windows\\system32\\" + bin_name) + bin_path = Path("\\Windows\\system32\\" + bin_name).resolve() # Back up bin common.copy_file(bin_path, temp) diff --git a/rta/suspicious_office_descendant_fp.py b/rta/suspicious_office_descendant_fp.py index 6c1d902fe..27610a9a8 100644 --- a/rta/suspicious_office_descendant_fp.py +++ b/rta/suspicious_office_descendant_fp.py @@ -8,7 +8,7 @@ # ATT&CK: T1064 # Description: Generates various children processes from emulated Office processes. -import os +from pathlib import Path import time from . import common @@ -33,13 +33,13 @@ def main(): "wscript.exe //b", ] cmd_path = "c:\\windows\\system32\\cmd.exe" - browser_path = os.path.abspath("firefox.exe") + browser_path = Path("firefox.exe").resolve() common.copy_file(cmd_path, browser_path) for office_app in ["winword.exe", "excel.exe"]: common.log("Emulating %s" % office_app) - office_path = os.path.abspath(office_app) + office_path = Path(office_app).resolve() common.copy_file(cmd_path, office_path) for command in suspicious_apps: diff --git a/rta/suspicious_powershell_download.py b/rta/suspicious_powershell_download.py index 61c26b059..83141c18e 100644 --- a/rta/suspicious_powershell_download.py +++ b/rta/suspicious_powershell_download.py @@ -3,12 +3,10 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="20b96aa7-609e-473f-ac35-5ac19d10f9a5", @@ -37,7 +35,7 @@ def main(): # Emulate Word user_app = "winword.exe" common.log("Emulating {}".format(user_app)) - user_app_path = os.path.abspath(user_app) + user_app_path = Path(user_app).resolve() common.copy_file(EXE_FILE, user_app_path) common.execute([user_app_path, "/c", cmd]) diff --git a/rta/suspicious_wscript_parent.py b/rta/suspicious_wscript_parent.py index 78004bdcd..a890fcf59 100644 --- a/rta/suspicious_wscript_parent.py +++ b/rta/suspicious_wscript_parent.py @@ -9,12 +9,10 @@ # ATT&CK: T1064, T1192, T1193 # Description: WScript run with suspicious parent processes -import os import time +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="a3cdd478-b817-4513-bb3d-897a5f92c836", @@ -41,7 +39,7 @@ def main(): for application in ["outlook.exe", "explorer.exe", "chrome.exe", "firefox.exe"]: common.log("Emulating %s" % application) - app_path = os.path.abspath(application) + app_path = Path(application).resolve() common.copy_file(cmd_path, app_path) common.execute([app_path, "/c", "wscript.exe", "script_path"], timeout=1, kill=True) diff --git a/rta/system_restore_process.py b/rta/system_restore_process.py index 9a23e2073..3580421e1 100644 --- a/rta/system_restore_process.py +++ b/rta/system_restore_process.py @@ -8,11 +8,9 @@ # ATT&CK: T1158 # Description: Copies mock malware into the System Volume Information directory and executes. -import os - -from . import common -from . import RtaMetadata +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="0fcf5aeb-cebd-466d-8a2e-ddb710ec845d", @@ -42,7 +40,7 @@ def main(): common.log("No writeable directories in System Restore. Exiting...", "-") return common.UNSUPPORTED_RTA - target_path = os.path.join(target_directory, "restore-process.exe") + target_path = Path(target_directory) / "restore-process.exe" common.copy_file(program_path, target_path) common.execute(target_path) diff --git a/rta/uac_cdssync.py b/rta/uac_cdssync.py index 5f3838524..52b6bc60f 100644 --- a/rta/uac_cdssync.py +++ b/rta/uac_cdssync.py @@ -3,10 +3,10 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata -import os +import shutil +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="7e9a94f4-46aa-45eb-b95b-53da7c01a033", @@ -33,14 +33,14 @@ def main(): path = "C:\\Users\\Public\\System32" user32 = "C:\\Windows\\System32\\user32.dll" dll = path + "\\npmproxy.dll" - os.makedirs(path, exist_ok=True) + Path(path).mkdir(parents=True, exist_ok=True) common.copy_file(user32, dll) common.copy_file(EXE_FILE, taskhostw) common.log("Spawning PowerShell from fake taskhostw") common.execute([taskhostw, "/c", powershell], timeout=10, kill=True) common.remove_files(dll, taskhostw) - os.removedirs(path) + shutil.rmtree(path) if __name__ == "__main__": diff --git a/rta/uac_mmc_deserialization.py b/rta/uac_mmc_deserialization.py index 219617c1d..afe029bc8 100644 --- a/rta/uac_mmc_deserialization.py +++ b/rta/uac_mmc_deserialization.py @@ -3,10 +3,10 @@ # 2.0; you may not use this file except in compliance with the Elastic License # 2.0. -from . import common -from . import RtaMetadata import os +from pathlib import Path +from . import RtaMetadata, common metadata = RtaMetadata( uuid="1d486055-38f8-4cf3-aec1-7f4f72d73fb2", @@ -27,17 +27,17 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") @common.requires_os(metadata.platforms) def main(): appdata = os.getenv("LOCALAPPDATA") - path = appdata + "\\Microsoft\\Event Viewer" - recentfiles = path + "\\RecentViews" + path = Path(appdata) / "\\Microsoft\\Event Viewer" + recentfiles = path / "\\RecentViews" - if os.path.exists(path): + if path.is_dir(): common.copy_file(EXE_FILE, recentfiles) common.remove_file(recentfiles) else: - os.mkdir(path) + path.mkdir() common.copy_file(EXE_FILE, recentfiles) common.remove_file(recentfiles) - os.rmdir(path) + path.rmdir() if __name__ == "__main__": diff --git a/rta/unusual_ms_tool_network.py b/rta/unusual_ms_tool_network.py index c94443c32..ceec52563 100644 --- a/rta/unusual_ms_tool_network.py +++ b/rta/unusual_ms_tool_network.py @@ -9,12 +9,11 @@ # Description: Creates network traffic from a process which is named to match common administration and developer tools # that do not typically make network traffic unless being used maliciously. -import os import shutil import sys +from pathlib import Path -from . import common -from . import RtaMetadata +from . import RtaMetadata, common if sys.version_info > (3,): urlliblib = "urllib.request" @@ -53,7 +52,7 @@ process_names = [ def http_from_process(name, ip, port): - path = os.path.join(common.BASE_DIR, name) + path = Path(common.BASE_DIR) / name common.log("Making HTTP GET from %s" % path) shutil.copy(sys.executable, path) common.execute( diff --git a/rta/unusual_parent_child.py b/rta/unusual_parent_child.py index 160a378c7..262066f5c 100644 --- a/rta/unusual_parent_child.py +++ b/rta/unusual_parent_child.py @@ -9,12 +9,10 @@ # ATT&CK: T1093 # Description: Runs several Windows core processes directly, instead of from the proper parent in Windows. -import os import sys +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="6cf12026-f99f-4e5c-8cd4-3dbc7bce3e67", @@ -27,7 +25,7 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): - common.log("Running Windows processes with an unexpected parent of %s" % os.path.basename(sys.executable)) + common.log("Running Windows processes with an unexpected parent of %s" % Path(sys.executable).name) process_names = [ # "C:\\Windows\\System32\\smss.exe", BSOD (avoid this) # "C:\\Windows\\System32\\csrss.exe", BSOD (avoid this) @@ -42,7 +40,7 @@ def main(): for process in process_names: # taskhostw.exe isn't on all versions of windows - if os.path.exists(process): + if Path(process).is_file(): common.execute([process], timeout=2, kill=True) else: common.log("Skipping %s" % process, "-") diff --git a/rta/user_dir_escalation.py b/rta/user_dir_escalation.py index 34882c0db..fe98895e6 100644 --- a/rta/user_dir_escalation.py +++ b/rta/user_dir_escalation.py @@ -9,10 +9,9 @@ # Description: Spawns mock malware written to a regular user directory and executes as System. import os +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="dc734786-66bd-4be6-bd06-eb41fa7b6745", @@ -35,10 +34,10 @@ def main(): source_path = common.get_path("bin", "myapp.exe") target_directory = "c:\\users\\fake_user_rta-%d" % os.getpid() - if not os.path.exists(target_directory): - os.makedirs(target_directory) + if not Path(target_directory).is_dir(): + Path(target_directory).mkdir(parents=True) - target_path = os.path.join(target_directory, "user_file.exe") + target_path = Path(target_directory) / "user_file.exe" common.copy_file(source_path, target_path) common.execute([target_path]) diff --git a/rta/winrar_encrypted.py b/rta/winrar_encrypted.py index 18669ded0..e36a5a2ad 100644 --- a/rta/winrar_encrypted.py +++ b/rta/winrar_encrypted.py @@ -9,12 +9,10 @@ # Description: Uses "bin\rar.exe" to perform encryption of archives and archive headers. import base64 -import os import sys +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="6d2d3c21-2d71-4395-8ab7-b1d0138d9225", @@ -29,7 +27,7 @@ MY_APP = common.get_path("bin", "myapp.exe") WINRAR = common.get_path("bin", "Rar.exe") -def create_exfil(path=os.path.abspath("secret_stuff.txt")): +def create_exfil(path=Path("secret_stuff.txt").resolve()): common.log("Writing dummy exfil to %s" % path) with open(path, "wb") as f: f.write(base64.b64encode(b"This is really secret stuff" * 100)) @@ -44,15 +42,15 @@ def main(password="s0l33t"): common.patch_file(WINRAR, b"win.rar GmbH", b"bad.bad GmbH", winrar_bin_modsig) # Renamed copies of executables - winrar_bin_modsig_a = os.path.abspath("a.exe") - winrar_bin_b = os.path.abspath("b.exe") + winrar_bin_modsig_a = Path("a.exe").resolve() + winrar_bin_b = Path("b.exe").resolve() common.copy_file(winrar_bin_modsig, winrar_bin_modsig_a) common.copy_file(WINRAR, winrar_bin_b) # Output options for various tests - rar_file = os.path.abspath("out.rar") - rar_file_jpg = os.path.abspath("out.jpg") + rar_file = Path("out.rar").resolve() + rar_file_jpg = Path("out.jpg").resolve() common.remove_files(rar_file, rar_file_jpg) # use case: rar with -hp to generate new rar file w/ .rar diff --git a/rta/winrar_startup_folder.py b/rta/winrar_startup_folder.py index 7fd825ae5..774ed1d11 100644 --- a/rta/winrar_startup_folder.py +++ b/rta/winrar_startup_folder.py @@ -9,10 +9,9 @@ # Description: Writes batch file into Windows Startup folder using process ancestry tied to exploit (CVE-2018-20250) import os +from pathlib import Path -from . import common -from . import RtaMetadata - +from . import RtaMetadata, common metadata = RtaMetadata( uuid="6d2d3c21-2d71-4395-8ab7-b1d0138d9225", @@ -26,8 +25,8 @@ metadata = RtaMetadata( @common.requires_os(metadata.platforms) def main(): common.log("WinRAR StartUp Folder Persistence") - win_rar_path = os.path.abspath("WinRAR.exe") - ace_loader_path = os.path.abspath("Ace32Loader.exe") + win_rar_path = Path("WinRAR.exe").resolve() + ace_loader_path = Path("Ace32Loader.exe").resolve() batch_file_path = "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mssconf.bat" startup_path = os.environ["USERPROFILE"] + batch_file_path common.copy_file("C:\\Windows\\System32\\cmd.exe", win_rar_path) From 8f122197bb18ef6a39b054c2c359a8b976ba910b Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Sat, 30 Sep 2023 12:57:18 +0200 Subject: [PATCH 08/86] [New BBR] Sus. Process Started via tmux or screen (#3071) * [New BBR] Sus. Process Started via tmux or screen * [New BBR] Unix Socket Connection * Revert "[New BBR] Unix Socket Connection" This reverts commit 92a0b09e8c505bceb1025124658bb4233d5d19d9. * Update rules_building_block/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --- ...s_utility_executed_via_tmux_or_screen.toml | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 rules_building_block/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml diff --git a/rules_building_block/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml b/rules_building_block/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml new file mode 100644 index 000000000..e86ebf774 --- /dev/null +++ b/rules_building_block/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml @@ -0,0 +1,49 @@ +[metadata] +creation_date = "2023/09/04" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/04" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +This rule monitors for the execution of suspicious commands via screen and tmux. When launching a command and detaching +directly, the commands will be executed in the background via its parent process. Attackers may leverage screen or tmux +to execute commands while attempting to evade detection. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potentially Suspicious Process Started via tmux or screen" +risk_score = 21 +rule_id = "e0cc3807-e108-483c-bf66-5a4fbe0d7e89" +severity = "low" +tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and +process.parent.name in ("screen", "tmux") and process.name : ( + "nmap", "nc", "ncat", "netcat", "socat", "nc.openbsd", "ngrok", "ping", "java", "python*", "php*", "perl", "ruby", + "lua*", "openssl", "telnet", "awk", "wget", "curl", "whoami", "id" + ) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" From bba8cd3b57e3bbd0f94e9e9d4a748cffcff3fc2e Mon Sep 17 00:00:00 2001 From: eric-forte-elastic <119343520+eric-forte-elastic@users.noreply.github.com> Date: Tue, 3 Oct 2023 10:47:58 -0400 Subject: [PATCH 09/86] Updated common.requires_os calls (#3109) --- rta/adobe_hijack.py | 2 +- rta/adobe_priv_helper_tool.py | 2 +- rta/app_bundler_execution.py | 2 +- rta/app_hijack.py | 2 +- rta/appcompat_shim.py | 2 +- rta/at_command.py | 2 +- rta/at_job.py | 2 +- rta/atom_init_coffee.py | 2 +- rta/auth_plugin.py | 2 +- rta/automator_workflows.py | 2 +- rta/background_process_from_tmp.py | 2 +- rta/bash_cmdline_history.py | 2 +- rta/bifrost_attack.py | 2 +- rta/binary_masquerade.py | 2 +- rta/bitsadmin_download.py | 2 +- rta/bitsadmin_execution.py | 2 +- rta/browser_cred_access.py | 2 +- rta/browser_debugging.py | 2 +- rta/brute_force_login.py | 2 +- rta/builtin_cmd_file_delete.py | 2 +- rta/c2_dns_from_iso.py | 2 +- rta/calendar_file_mod.py | 2 +- rta/certutil_file_obfuscation.py | 2 +- rta/certutil_webrequest.py | 2 +- rta/child_w3wp.py | 2 +- rta/clr_logs_creation.py | 2 +- rta/cmd_shell_via_word.py | 2 +- rta/cmstp_image_load.py | 2 +- rta/comsvcs_dump.py | 2 +- rta/crashdump_disabled.py | 2 +- rta/credaccess_reg_query_privesc_token_manip.py | 2 +- rta/credaccess_sam_from_vss.py | 2 +- rta/credential_access_dump_hashes_via_cmd.py | 2 +- rta/credential_access_known_utilities.py | 2 +- rta/credential_access_osascript_phishing.py | 2 +- rta/credman_discovery.py | 2 +- rta/cron_tab_file_create.py | 2 +- rta/cscript_suspicious_args.py | 2 +- rta/curl_data_exfil.py | 2 +- rta/curl_payload_download.py | 2 +- rta/curl_sus_payload.py | 2 +- rta/darkradiation.py | 2 +- rta/dcom_lateral_movement_with_mmc.py | 2 +- rta/ddns_lolbas.py | 2 +- rta/ddns_unsigned.py | 2 +- rta/defensive_evasion_reflective_loading.py | 2 +- rta/defensive_evasion_safari_modification.py | 2 +- rta/delete_bootconf.py | 2 +- rta/delete_catalogs.py | 2 +- rta/delete_quarantine_attrib.py | 2 +- rta/delete_usnjrnl.py | 2 +- rta/delete_volume_shadows.py | 2 +- rta/deprecated/_discovery_builtin_cmd.py | 2 +- rta/deprecated/_funzip_extract_content.py | 2 +- rta/deprecated/_linux_discovery_sensitive_files.py | 2 +- rta/deprecated/_persistence_code_extension.py | 2 +- rta/deprecated/_persistence_reopened_app.py | 2 +- rta/deprecated/_persistence_terminal_plist_mod.py | 2 +- rta/directory_service_plugin_file.py | 2 +- rta/disable_os_security_updates.py | 2 +- rta/disable_windows_fw.py | 2 +- rta/discovery_virtual_machine_grep.py | 2 +- rta/dmg_create_in_tmp.py | 2 +- rta/dock_plist.py | 2 +- rta/double_persist.py | 2 +- rta/dscl_hidden_account.py | 2 +- rta/dseditgroup_admin_add.py | 2 +- rta/dsenableroot_account.py | 2 +- rta/dylib_injection.py | 2 +- rta/dynwrapx_image_load.py | 2 +- rta/echo_tmp_file_create.py | 2 +- rta/edmond_child_process.py | 2 +- rta/eggshell_backdoor.py | 2 +- rta/eicar.py | 2 +- rta/elevated_osascript_execution.py | 2 +- rta/emond_child_process.py | 2 +- rta/emond_plist.py | 2 +- rta/empire_stager.py | 2 +- rta/enum_commands.py | 2 +- rta/enumeration_linpeas.py | 2 +- rta/env_variable_hijacking.py | 2 +- rta/evasion_addinproc_certoc_odbc_gfxdwn.py | 2 +- rta/evasion_loadlib_via_callback.py | 2 +- rta/evasion_ntdll_from_unusual_path.py | 2 +- rta/evasion_oversized_dll_load.py | 2 +- rta/evasion_patch_etw_amsi.py | 2 +- rta/evasion_unhook_ldrloaddll.py | 2 +- rta/exec_cmd_adfind.py | 2 +- rta/exec_cmd_appcmd_logging.py | 2 +- rta/exec_cmd_arp.py | 2 +- rta/exec_cmd_aspnet_regiis.py | 2 +- rta/exec_cmd_attrib_hidden.py | 2 +- rta/exec_cmd_auditpol.py | 2 +- rta/exec_cmd_clear_history.py | 2 +- rta/exec_cmd_compiled_html.py | 2 +- rta/exec_cmd_endpoint_security_masquerading.py | 2 +- rta/exec_cmd_fltmc_unload.py | 2 +- rta/exec_cmd_fsutil_fsinfo.py | 2 +- rta/exec_cmd_hidden_share.py | 2 +- rta/exec_cmd_mklink.py | 2 +- rta/exec_cmd_mpcmdrun_download.py | 2 +- rta/exec_cmd_msdt.py | 2 +- rta/exec_cmd_mssql_xp_cmdshell.py | 2 +- rta/exec_cmd_net_stop.py | 2 +- rta/exec_cmd_net_use.py | 2 +- rta/exec_cmd_netsh_advfirewall_network_discovery.py | 2 +- rta/exec_cmd_netsh_remotedesktop.py | 2 +- rta/exec_cmd_nltest.py | 2 +- rta/exec_cmd_non_executable_file.py | 2 +- rta/exec_cmd_ntdsdit.py | 2 +- rta/exec_cmd_posh_mailbox.py | 2 +- rta/exec_cmd_psexesvc.py | 2 +- rta/exec_cmd_pwd_appcmd.py | 2 +- rta/exec_cmd_rundll32.py | 2 +- rta/exec_cmd_rundll32_davsetcookie.py | 2 +- rta/exec_cmd_set_casmailbox.py | 2 +- rta/exec_cmd_set_mppreference.py | 2 +- rta/exec_cmd_short_name.py | 2 +- rta/exec_cmd_windows_firewall_disabled.py | 2 +- rta/exec_cmd_wmi_cmdexe.py | 2 +- rta/exec_cmd_wmi_subscription.py | 2 +- rta/exec_cmd_wmic_antivirus_enum.py | 2 +- rta/exec_cmd_workfolders.py | 2 +- rta/exec_cmd_xwizard.py | 2 +- rta/exec_conhost_indirect.py | 2 +- rta/exec_control_panel_cpl.py | 2 +- rta/exec_cscript_archive_args.py | 2 +- rta/exec_cscript_suspicious_powershell.py | 2 +- rta/exec_dll_file_compressed.py | 2 +- rta/exec_dnguard_program.py | 2 +- rta/exec_echo_named_pipe.py | 2 +- rta/exec_explorer_trampoline.py | 2 +- rta/exec_from_mount.py | 2 +- rta/exec_from_python.py | 2 +- rta/exec_from_terminal.py | 2 +- rta/exec_gfxdownloadwrapper.py | 2 +- rta/exec_ingress_tool_posh.py | 2 +- rta/exec_java_revshell_linux.py | 2 +- rta/exec_ms_dotnet_clickonce.py | 2 +- rta/exec_msdt_diagcab.py | 2 +- rta/exec_msiexec_dllregisterserver.py | 2 +- rta/exec_nohup.py | 2 +- rta/exec_persistence_from_iso.py | 2 +- rta/exec_privhelper_tool.py | 2 +- rta/exec_renamed_msbuild.py | 2 +- rta/exec_renamed_winword.py | 2 +- rta/exec_scripting_persistence_locations.py | 2 +- rta/exec_scripting_unusual_extension.py | 2 +- rta/exec_scripting_via_html_app.py | 2 +- rta/exec_sliver_posh.py | 2 +- rta/exec_sqlserver_suspicious_child.py | 2 +- rta/exec_susp_explorer.py | 2 +- rta/exec_susp_msiexec.py | 2 +- rta/exec_susp_parent_child.py | 2 +- rta/exec_svchost_child_schedule.py | 2 +- rta/exec_tclsh.py | 2 +- rta/exec_unusual_directory.py | 2 +- rta/exec_unusual_path_msmpeng.py | 2 +- rta/exec_vs_prebuildevent.py | 2 +- rta/exec_vsls_agent.py | 2 +- rta/exec_winword_susp_parent.py | 2 +- rta/execution_iso_dll_rundll32.py | 2 +- rta/execution_iso_dll_sideload.py | 2 +- rta/execution_node_child_process.py | 2 +- rta/execution_pubprn.py | 2 +- rta/extexport_sideload.py | 2 +- rta/file_ads_creation.py | 2 +- rta/file_create_dpapi_key.py | 2 +- rta/file_create_exchange_um.py | 2 +- rta/file_create_exec_pdf_reader.py | 2 +- rta/file_create_lsass_dump.py | 2 +- rta/file_create_mimilsa_log.py | 2 +- rta/file_create_ms_addins.py | 2 +- rta/file_create_mstsc_startup.py | 2 +- rta/file_create_outlook_vba.py | 2 +- rta/file_create_powershell_profile.py | 2 +- rta/file_create_scripting_startup.py | 2 +- rta/file_create_smss_exec.py | 2 +- rta/file_create_task_file.py | 2 +- rta/file_create_vbs_startup.py | 2 +- rta/file_creation_teamviewer.py | 2 +- rta/file_delete_spool_driver.py | 2 +- rta/file_delete_vbk.py | 2 +- rta/file_exe_ususual_extension.py | 2 +- rta/file_html_smuggling.py | 2 +- rta/file_mod_via_chmod.py | 2 +- rta/file_ms_template_macros.py | 2 +- rta/file_script_startup_folder.py | 2 +- rta/file_susp_browser_extension.py | 2 +- rta/finder_sync_plugin.py | 2 +- rta/findstr_pw_search.py | 2 +- rta/firewall_allowlist_modif_unsigned.py | 2 +- rta/fltmc_unload.py | 2 +- rta/git_creds_access.py | 2 +- rta/globalflags.py | 2 +- rta/grep_software_discovery.py | 2 +- rta/hidden_file_mount.py | 2 +- rta/hidden_plist.py | 2 +- rta/html_help_file_written_exec.py | 2 +- rta/image_load_dnguard.py | 2 +- rta/image_load_msbuild_vaultcli.py | 2 +- rta/image_load_phantomdll.py | 2 +- rta/image_load_rdp_client_dll.py | 2 +- rta/image_load_script_interpreter_wmiutils.py | 2 +- rta/image_load_taskhost.py | 2 +- rta/image_load_vaultcli.py | 2 +- rta/impersonate_trusted_installer.py | 2 +- rta/inhibit_system_recovery.py | 2 +- rta/inhibit_system_recovery_and_rename.py | 2 +- rta/inhibit_system_recovery_cmd.py | 2 +- rta/inhibit_system_recovery_lolbas_child.py | 2 +- rta/inhibit_system_recovery_office.py | 2 +- rta/inhibit_system_recovery_renamed.py | 2 +- rta/installutil_network.py | 2 +- rta/ip_discovery_unsigned.py | 2 +- rta/iqy_file_writes.py | 2 +- rta/javascript_payload.py | 2 +- rta/kcc_kerberos_dump.py | 2 +- rta/kerberos_netconn_file_creation.py | 2 +- rta/kernel_module_removal_execution.py | 2 +- rta/kernelext_agent_unload.py | 2 +- rta/kext_load.py | 2 +- rta/keychain_cred_access.py | 2 +- rta/keychain_dump.py | 2 +- rta/keychain_pwd_cmdline.py | 2 +- rta/lateral_command_psexec.py | 2 +- rta/lateral_commands.py | 2 +- rta/launchagent_plist.py | 2 +- rta/launchd_load_plist.py | 2 +- rta/launchdaemon_persistence.py | 2 +- rta/ldapsearch_group_enumeration.py | 2 +- rta/link_to_tmp.py | 2 +- rta/linux_compress_sensitive_files.py | 2 +- rta/login_hook.py | 2 +- rta/login_window_plist.py | 2 +- rta/lua_image_load.py | 2 +- rta/mac_office_descendant.py | 2 +- rta/macos_installer_curl.py | 2 +- rta/mimikatz_cmdline.py | 2 +- rta/mimipenguin_execution.py | 2 +- rta/modification_of_wdigest_security_provider.py | 2 +- rta/modify_sublime_app.py | 2 +- rta/mount_smbfs.py | 2 +- rta/ms_office_drop_exe.py | 2 +- rta/ms_office_task_creation.py | 2 +- rta/msbuild_network.py | 2 +- rta/msbuild_unusual_args.py | 2 +- rta/msequationeditor_file_written_exec.py | 2 +- rta/msequationeditor_net_conn.py | 2 +- rta/mshta_network.py | 2 +- rta/msiexec_http_installer.py | 2 +- rta/msiexec_remote_msi.py | 2 +- rta/msiexec_remote_msi_install.py | 2 +- rta/msoffice_addins_file.py | 2 +- rta/msoffice_dcom_accessvbom.py | 2 +- rta/msoffice_descendant_reg_mod_persistence.py | 2 +- rta/msoffice_dll_image_load.py | 2 +- rta/msoffice_file_dll_sideload.py | 2 +- rta/msoffice_file_drop_exec_wmi.py | 2 +- rta/msoffice_file_exec_script_interpreter.py | 2 +- rta/msoffice_potential_proc_inj.py | 2 +- rta/msoffice_reg_mod.py | 2 +- rta/msoffice_signed_binary_spawn.py | 2 +- rta/msoffice_startup_persistence.py | 2 +- rta/msoffice_untrusted_exec.py | 2 +- rta/msoffice_wmi_imageload.py | 2 +- rta/msxsl_image_load.py | 2 +- rta/msxsl_network.py | 2 +- rta/net_user_add.py | 2 +- rta/network_connection_desktopimgdownldr.py | 2 +- rta/network_connection_download_powershell.py | 2 +- rta/network_connection_download_script_interpreter.py | 2 +- rta/network_connection_external_ip_lookup_non_browser.py | 2 +- rta/network_connection_freesslcert.py | 2 +- rta/network_connection_iexplore_rundll32.py | 2 +- rta/network_connection_kerberos_port.py | 2 +- rta/network_connection_nslookup.py | 2 +- rta/network_connection_process_unusual_args.py | 2 +- rta/network_connection_rdp_tunneling.py | 2 +- rta/network_connection_unusual_rundll32.py | 2 +- rta/networksetup_vpn.py | 2 +- rta/obfuscated_cmd_commands.py | 2 +- rta/obfuscated_powershell.py | 2 +- rta/office_app_execution.py | 2 +- rta/office_application_startup.py | 2 +- rta/office_child_process.py | 2 +- rta/openssl_decode_payload.py | 2 +- rta/openssl_file_drop.py | 2 +- rta/opera_child_process.py | 2 +- rta/osascript_hidden_login_item.py | 2 +- rta/osascript_net_conn.py | 2 +- rta/osascript_sh_execution.py | 2 +- rta/osascript_suspicious_cmdline.py | 2 +- rta/outlook_suspicious_child.py | 2 +- rta/path_passed_to_system.py | 2 +- rta/payload_decode_bash_cmds.py | 2 +- rta/periodic_task_creation.py | 2 +- rta/persistence_chrome_extension.py | 2 +- rta/persistence_mail_plist.py | 2 +- rta/persistence_plist_masquerade.py | 2 +- rta/persistence_startup_item.py | 2 +- rta/persistence_startup_unusual_process.py | 2 +- rta/persistent_scripts.py | 2 +- rta/ping_delayed_exec.py | 2 +- rta/pkexec_shell.py | 2 +- rta/pkg_install_chmod.py | 2 +- rta/plist_creation.py | 2 +- rta/plistbuddy_file_modification.py | 2 +- rta/port_monitor.py | 2 +- rta/powershell_args.py | 2 +- rta/powershell_base64_gzip.py | 2 +- rta/powershell_delete_shadow_copy.py | 2 +- rta/powershell_from_script.py | 2 +- rta/powershell_unsigned_defender_exclusion.py | 2 +- rta/powershell_vault_access.py | 2 +- rta/privilege_escalation_remote_thread.py | 2 +- rta/privilege_escalation_tcc_bypass.py | 2 +- rta/process_double_extension.py | 2 +- rta/process_extension_anomalies.py | 2 +- rta/process_name_masquerade.py | 2 +- rta/ransomnote_delete_shadows.py | 2 +- rta/recycle_bin_process.py | 2 +- rta/reg_creation_servicedll.py | 2 +- rta/reg_mod_amsienable.py | 2 +- rta/reg_mod_appcertdlls.py | 2 +- rta/reg_mod_appinitdlls.py | 2 +- rta/reg_mod_autodialdll.py | 2 +- rta/reg_mod_base64_executable.py | 2 +- rta/reg_mod_builtindnsclientenabled.py | 2 +- rta/reg_mod_disable_uac.py | 2 +- rta/reg_mod_disableantispyware.py | 2 +- rta/reg_mod_driver_blocklist.py | 2 +- rta/reg_mod_enableat.py | 2 +- rta/reg_mod_enablescriptblocklogging.py | 2 +- rta/reg_mod_ifeo.py | 2 +- rta/reg_mod_lsa_ssp.py | 2 +- rta/reg_mod_netwire.py | 2 +- rta/reg_mod_networkprovider.py | 2 +- rta/reg_mod_nullsessionpipes.py | 2 +- rta/reg_mod_plugx.py | 2 +- rta/reg_mod_point_and_print_dll.py | 2 +- rta/reg_mod_port_forwarding.py | 2 +- rta/reg_mod_print_processors.py | 2 +- rta/reg_mod_remcos.py | 2 +- rta/reg_mod_run_key_unusual_proc.py | 2 +- rta/reg_mod_shadow_rdp.py | 2 +- rta/reg_mod_shim_sb.py | 2 +- rta/reg_mod_startup_shell_folder.py | 2 +- rta/reg_mod_suspicious_service.py | 2 +- rta/reg_mod_systemcertificates.py | 2 +- rta/reg_mod_time_provider.py | 2 +- rta/reg_mod_unusual_startup_folder.py | 2 +- rta/reg_mod_windir.py | 2 +- rta/reg_run_key_asterisk.py | 2 +- rta/reg_vss_service_disable.py | 2 +- rta/registry_hive_export.py | 2 +- rta/registry_persistence_create.py | 2 +- rta/registry_rdp_enable.py | 2 +- rta/regsvr32_scrobj.py | 2 +- rta/regsvr32_unusual_args.py | 2 +- rta/renamed_autoit.py | 2 +- rta/renamed_automaton_interpreter.py | 2 +- rta/reverse_shell.py | 2 +- rta/root_cert_install.py | 2 +- rta/root_crontab_file_modification.py | 2 +- rta/rubeus_alike_commandline.py | 2 +- rta/rundll32_inf_callback.py | 2 +- rta/rundll32_javascript_callback.py | 2 +- rta/rundll32_unusual_args.py | 2 +- rta/rundll32_unusual_dll_extension.py | 2 +- rta/schtask_escalation.py | 2 +- rta/schtasks_xml_masqueraded.py | 2 +- rta/scp_privacy_bypass.py | 2 +- rta/screensaver_child_process.py | 2 +- rta/screensaver_plist_mod.py | 2 +- rta/scrobj_com_hijack.py | 2 +- rta/secure_file_deletion.py | 2 +- rta/security_authtrampoline.py | 2 +- rta/sensitive_file_access.py | 2 +- rta/settingcontentms_files.py | 2 +- rta/sevenzip_encrypted.py | 2 +- rta/shellcode_load_ws2_32_unbacked.py | 2 +- rta/shellcode_winexec_calc.py | 2 +- rta/shlayer_payload.py | 2 +- rta/shortcut_file_suspicious_process.py | 2 +- rta/shove_sip_bypass.py | 2 +- rta/signed_proxy_file_written_exec.py | 2 +- rta/silentprocessexit_lsass.py | 2 +- rta/sip_provider.py | 2 +- rta/smb_connection.py | 2 +- rta/solarmaker_backdoor.py | 2 +- rta/spctl_gatekeeper_bypass.py | 2 +- rta/special_chars_zip_file.py | 2 +- rta/sqlite_db_evasion.py | 2 +- rta/ssh_bruteforce.py | 2 +- rta/sticky_keys_write_execute.py | 2 +- rta/sudo_exploit.py | 2 +- rta/susp_scheduled_task_creation.py | 2 +- rta/susp_script_file_name.py | 2 +- rta/suspicious_bits_job_notify.py | 2 +- rta/suspicious_child_acrobat.py | 2 +- rta/suspicious_child_childless_process.py | 2 +- rta/suspicious_child_compattelrunner.py | 2 +- rta/suspicious_child_dns.py | 2 +- rta/suspicious_child_exchange_um.py | 2 +- rta/suspicious_child_explorer.py | 2 +- rta/suspicious_child_services.py | 2 +- rta/suspicious_child_solarwinds_businesslayerhost.py | 2 +- rta/suspicious_child_solarwindsdiagnostics.py | 2 +- rta/suspicious_child_svchost_sch.py | 2 +- rta/suspicious_child_wmiprvse.py | 2 +- rta/suspicious_child_zoom.py | 2 +- rta/suspicious_dll_registration_regsvr32.py | 2 +- rta/suspicious_lineage_script.py | 2 +- rta/suspicious_msiexec_child.py | 2 +- rta/suspicious_office_child.py | 2 +- rta/suspicious_office_children.py | 2 +- rta/suspicious_office_descendant_fp.py | 2 +- rta/suspicious_parent_cmd.py | 2 +- rta/suspicious_parent_csc.py | 2 +- rta/suspicious_parent_msbuild_explorer.py | 2 +- rta/suspicious_parent_msbuild_office.py | 2 +- rta/suspicious_parent_msbuild_script.py | 2 +- rta/suspicious_parent_sc.py | 2 +- rta/suspicious_parent_smss.py | 2 +- rta/suspicious_powershell_download.py | 2 +- rta/suspicious_wmic_script.py | 2 +- rta/suspicious_wscript_parent.py | 2 +- rta/system_restore_process.py | 2 +- rta/systemkey_credential_access.py | 2 +- rta/systemsetup_ssh_enable.py | 2 +- rta/tar_dylib.py | 2 +- rta/tcc_bypass_mounted_apfs.py | 2 +- rta/tcc_modification.py | 2 +- rta/trust_provider.py | 2 +- rta/uac_cdssync.py | 2 +- rta/uac_clipup.py | 2 +- rta/uac_computerdefaults.py | 2 +- rta/uac_dccw.py | 2 +- rta/uac_diskcleanup.py | 2 +- rta/uac_dism_dll_side_loading.py | 2 +- rta/uac_eventviewer.py | 2 +- rta/uac_eventvwr.py | 2 +- rta/uac_fodhelper.py | 2 +- rta/uac_icmluautil.py | 2 +- rta/uac_mmc_deserialization.py | 2 +- rta/uac_mmc_hijack.py | 2 +- rta/uac_mmc_net_core_profiler.py | 2 +- rta/uac_sdclt.py | 2 +- rta/uac_sysprep.py | 2 +- rta/uac_windir_masq.py | 2 +- rta/uac_windows_activation.py | 2 +- rta/uac_winfw_mmc.py | 2 +- rta/uac_wow64log.py | 2 +- rta/uac_wsreset.py | 2 +- rta/uncommon_persistence.py | 2 +- rta/unshadow_execution.py | 2 +- rta/unsigned_startup_item_netconn.py | 2 +- rta/unusual_kerberos_client.py | 2 +- rta/unusual_ms_tool_network.py | 2 +- rta/unusual_parent_child.py | 2 +- rta/unusual_parent_chrome_extension.py | 2 +- rta/unusual_powershell_engine_image_load.py | 2 +- rta/unusual_rdp_client.py | 2 +- rta/unzip_to_tmp.py | 2 +- rta/user_action_script.py | 2 +- rta/user_dir_escalation.py | 2 +- rta/user_mode_smb_connection.py | 2 +- rta/vaultcmd_commands.py | 2 +- rta/webproxy_modification.py | 2 +- rta/webservice_lolbas.py | 2 +- rta/webservice_unsigned.py | 2 +- rta/werfault_masquerading.py | 2 +- rta/werfault_persistence.py | 2 +- rta/wevtutil_log_clear.py | 2 +- rta/windefend_svc_stop.py | 2 +- rta/windows_script_host_file_written_exec.py | 2 +- rta/winrar_encrypted.py | 2 +- rta/winrar_startup_folder.py | 2 +- rta/wizardupdate_infection.py | 2 +- rta/wmi_incoming_logon.py | 2 +- rta/wmic_xsl_exec.py | 2 +- rta/wuauclt_image_load.py | 2 +- rta/xcsset_infection.py | 2 +- 484 files changed, 484 insertions(+), 484 deletions(-) diff --git a/rta/adobe_hijack.py b/rta/adobe_hijack.py index 3d0f91607..e143d5022 100644 --- a/rta/adobe_hijack.py +++ b/rta/adobe_hijack.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rdr_cef_dir = Path("C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF") rdrcef_exe = rdr_cef_dir / "RdrCEF.exe" diff --git a/rta/adobe_priv_helper_tool.py b/rta/adobe_priv_helper_tool.py index 5de11a21a..4cf0b65e2 100644 --- a/rta/adobe_priv_helper_tool.py +++ b/rta/adobe_priv_helper_tool.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/com.adobe.ARMDC.SMJobBlessHelper" diff --git a/rta/app_bundler_execution.py b/rta/app_bundler_execution.py index 7f58655c6..ef583372a 100644 --- a/rta/app_bundler_execution.py +++ b/rta/app_bundler_execution.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/app_hijack.py b/rta/app_hijack.py index 5bb950a7e..880f0829a 100644 --- a/rta/app_hijack.py +++ b/rta/app_hijack.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): app_dir = Path("/Applications/test/Contents/") diff --git a/rta/appcompat_shim.py b/rta/appcompat_shim.py index 2173bef06..dd9e98071 100644 --- a/rta/appcompat_shim.py +++ b/rta/appcompat_shim.py @@ -28,7 +28,7 @@ metadata = RtaMetadata( SHIM_FILE = common.get_path("bin", "CVE-2013-3893.sdb") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(SHIM_FILE) def main(): common.log("Application Compatibility Shims") diff --git a/rta/at_command.py b/rta/at_command.py index ef94cea95..a2111918b 100644 --- a/rta/at_command.py +++ b/rta/at_command.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(target_host=None): target_host = target_host or common.get_ip() host_str = "\\\\%s" % target_host diff --git a/rta/at_job.py b/rta/at_job.py index 79a89c135..d4b2b5d1e 100644 --- a/rta/at_job.py +++ b/rta/at_job.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file creation on /private/var/at/jobs/test.") diff --git a/rta/atom_init_coffee.py b/rta/atom_init_coffee.py index 59809c164..193844a45 100644 --- a/rta/atom_init_coffee.py +++ b/rta/atom_init_coffee.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): atom_dir = Path.home().joinpath(".atom") diff --git a/rta/auth_plugin.py b/rta/auth_plugin.py index 8007b6735..79e5d0db4 100644 --- a/rta/auth_plugin.py +++ b/rta/auth_plugin.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file modification on test.plist to mimic authorization plugin modification") diff --git a/rta/automator_workflows.py b/rta/automator_workflows.py index d5f8d7405..917555dcc 100644 --- a/rta/automator_workflows.py +++ b/rta/automator_workflows.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/background_process_from_tmp.py b/rta/background_process_from_tmp.py index faaa317a3..86061a350 100644 --- a/rta/background_process_from_tmp.py +++ b/rta/background_process_from_tmp.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/sh" diff --git a/rta/bash_cmdline_history.py b/rta/bash_cmdline_history.py index 52a6450da..9c392dc13 100644 --- a/rta/bash_cmdline_history.py +++ b/rta/bash_cmdline_history.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/history" diff --git a/rta/bifrost_attack.py b/rta/bifrost_attack.py index 9d3affeee..ab72abf1d 100644 --- a/rta/bifrost_attack.py +++ b/rta/bifrost_attack.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bifrost" diff --git a/rta/binary_masquerade.py b/rta/binary_masquerade.py index cc596ad66..5366b3d84 100644 --- a/rta/binary_masquerade.py +++ b/rta/binary_masquerade.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if platform.processor() == "arm": diff --git a/rta/bitsadmin_download.py b/rta/bitsadmin_download.py index 648278dc4..d7a2c44cd 100644 --- a/rta/bitsadmin_download.py +++ b/rta/bitsadmin_download.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Running Windows BitsAdmin to Download") server, ip, port = common.serve_web() diff --git a/rta/bitsadmin_execution.py b/rta/bitsadmin_execution.py index 667cfcd97..6b8c4cecd 100644 --- a/rta/bitsadmin_execution.py +++ b/rta/bitsadmin_execution.py @@ -24,7 +24,7 @@ ROOT_DIR = Path(__file__).parent EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): fake_word = ROOT_DIR / "winword.exe" diff --git a/rta/browser_cred_access.py b/rta/browser_cred_access.py index 062f81885..9b788f5c6 100644 --- a/rta/browser_cred_access.py +++ b/rta/browser_cred_access.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/browser_debugging.py b/rta/browser_debugging.py index 07ac4434e..661599e4e 100644 --- a/rta/browser_debugging.py +++ b/rta/browser_debugging.py @@ -30,7 +30,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): param1 = "--remote-debugging-port=9222" param2 = "--user-data-dir=remote-profile" diff --git a/rta/brute_force_login.py b/rta/brute_force_login.py index 67a7e7082..4a9c12c04 100644 --- a/rta/brute_force_login.py +++ b/rta/brute_force_login.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(username="rta-tester", remote_host=None): if not remote_host: common.log("A remote host is required to detonate this RTA", "!") diff --git a/rta/builtin_cmd_file_delete.py b/rta/builtin_cmd_file_delete.py index 2e041469e..e4f1547f6 100644 --- a/rta/builtin_cmd_file_delete.py +++ b/rta/builtin_cmd_file_delete.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/xargs" diff --git a/rta/c2_dns_from_iso.py b/rta/c2_dns_from_iso.py index 0545f6f40..859374202 100644 --- a/rta/c2_dns_from_iso.py +++ b/rta/c2_dns_from_iso.py @@ -24,7 +24,7 @@ PROC = 'ping.exe' # ps script to mount, execute a file and unmount ISO device PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): diff --git a/rta/calendar_file_mod.py b/rta/calendar_file_mod.py index a83edb533..1d9fab45f 100644 --- a/rta/calendar_file_mod.py +++ b/rta/calendar_file_mod.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cal_dir = Path(f"{Path.home()}/Library/Calendars/") diff --git a/rta/certutil_file_obfuscation.py b/rta/certutil_file_obfuscation.py index d2063e34a..0ee9e984a 100644 --- a/rta/certutil_file_obfuscation.py +++ b/rta/certutil_file_obfuscation.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Encoding target") encoded_file = Path("encoded.txt").resolve() diff --git a/rta/certutil_webrequest.py b/rta/certutil_webrequest.py index 80712857e..014ac0c1f 100644 --- a/rta/certutil_webrequest.py +++ b/rta/certutil_webrequest.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( MY_DLL = common.get_path("bin", "mydll.dll") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_DLL) def main(): # http server will terminate on main thread exit diff --git a/rta/child_w3wp.py b/rta/child_w3wp.py index 8e948fefb..3a14b38df 100644 --- a/rta/child_w3wp.py +++ b/rta/child_w3wp.py @@ -31,7 +31,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): w3wp = "C:\\Users\\Public\\w3wp.exe" common.copy_file(EXE_FILE, w3wp) diff --git a/rta/clr_logs_creation.py b/rta/clr_logs_creation.py index a06288517..a3affe36d 100644 --- a/rta/clr_logs_creation.py +++ b/rta/clr_logs_creation.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msxsl = "C:\\Users\\Public\\msxsl.exe" fake_clr_path = "C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs" diff --git a/rta/cmd_shell_via_word.py b/rta/cmd_shell_via_word.py index 75a596dcc..daf68634e 100644 --- a/rta/cmd_shell_via_word.py +++ b/rta/cmd_shell_via_word.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "winword.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/cmstp_image_load.py b/rta/cmstp_image_load.py index 92209a3ca..509a7112e 100644 --- a/rta/cmstp_image_load.py +++ b/rta/cmstp_image_load.py @@ -24,7 +24,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cmstp = "C:\\Users\\Public\\cmstp.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/comsvcs_dump.py b/rta/comsvcs_dump.py index 42c29a04c..2d0ea6f53 100644 --- a/rta/comsvcs_dump.py +++ b/rta/comsvcs_dump.py @@ -34,7 +34,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Memory Dump via Comsvcs") pid = os.getpid() diff --git a/rta/crashdump_disabled.py b/rta/crashdump_disabled.py index 720562152..409d28db0 100644 --- a/rta/crashdump_disabled.py +++ b/rta/crashdump_disabled.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temporarily disabling CrashDump...") diff --git a/rta/credaccess_reg_query_privesc_token_manip.py b/rta/credaccess_reg_query_privesc_token_manip.py index db8b4ce7d..2764211b7 100644 --- a/rta/credaccess_reg_query_privesc_token_manip.py +++ b/rta/credaccess_reg_query_privesc_token_manip.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( techniques=["T1134", "T1003"], ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): import ctypes from ctypes import byref, windll, wintypes diff --git a/rta/credaccess_sam_from_vss.py b/rta/credaccess_sam_from_vss.py index 9697cab4b..e4f277656 100644 --- a/rta/credaccess_sam_from_vss.py +++ b/rta/credaccess_sam_from_vss.py @@ -32,7 +32,7 @@ def vss_create(): results = wmi.ExecMethod_("Create", createparams) return results.Properties_[1].value -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): import win32file vss_list = get_vss_list() diff --git a/rta/credential_access_dump_hashes_via_cmd.py b/rta/credential_access_dump_hashes_via_cmd.py index 307515a5c..47be1e5ac 100644 --- a/rta/credential_access_dump_hashes_via_cmd.py +++ b/rta/credential_access_dump_hashes_via_cmd.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing defaults commands to dump hashes.") diff --git a/rta/credential_access_known_utilities.py b/rta/credential_access_known_utilities.py index abbf8d59b..3b466ffcb 100644 --- a/rta/credential_access_known_utilities.py +++ b/rta/credential_access_known_utilities.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "ProcessDump.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/credential_access_osascript_phishing.py b/rta/credential_access_osascript_phishing.py index 64e223b5e..a4fac6674 100644 --- a/rta/credential_access_osascript_phishing.py +++ b/rta/credential_access_osascript_phishing.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/osascript" diff --git a/rta/credman_discovery.py b/rta/credman_discovery.py index 50eb18037..e49ba1ea8 100644 --- a/rta/credman_discovery.py +++ b/rta/credman_discovery.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): appdata = os.getenv("LOCALAPPDATA") credmanfile = f"{appdata}\\Microsoft\\Credentials\\a.txt" diff --git a/rta/cron_tab_file_create.py b/rta/cron_tab_file_create.py index 4bb81bf38..0c984e927 100644 --- a/rta/cron_tab_file_create.py +++ b/rta/cron_tab_file_create.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file creation on /private/var/at/tabs/test.") diff --git a/rta/cscript_suspicious_args.py b/rta/cscript_suspicious_args.py index 73f01c368..376d843a2 100644 --- a/rta/cscript_suspicious_args.py +++ b/rta/cscript_suspicious_args.py @@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/curl_data_exfil.py b/rta/curl_data_exfil.py index 0e3062f20..6f59d33ad 100644 --- a/rta/curl_data_exfil.py +++ b/rta/curl_data_exfil.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/curl_payload_download.py b/rta/curl_payload_download.py index b6c56d2d9..3b75a41b9 100644 --- a/rta/curl_payload_download.py +++ b/rta/curl_payload_download.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/testfile" diff --git a/rta/curl_sus_payload.py b/rta/curl_sus_payload.py index 76616f860..55e93672b 100644 --- a/rta/curl_sus_payload.py +++ b/rta/curl_sus_payload.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/curl" diff --git a/rta/darkradiation.py b/rta/darkradiation.py index 54cda4da7..3cd28ffdf 100644 --- a/rta/darkradiation.py +++ b/rta/darkradiation.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/xargs" diff --git a/rta/dcom_lateral_movement_with_mmc.py b/rta/dcom_lateral_movement_with_mmc.py index cb54ac95d..910659e60 100644 --- a/rta/dcom_lateral_movement_with_mmc.py +++ b/rta/dcom_lateral_movement_with_mmc.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(remote_host=None): remote_host = remote_host or common.get_ip() common.log("DCOM Lateral Movement with MMC") diff --git a/rta/ddns_lolbas.py b/rta/ddns_lolbas.py index af9a1cb43..ec37fcaa0 100644 --- a/rta/ddns_lolbas.py +++ b/rta/ddns_lolbas.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/ddns_unsigned.py b/rta/ddns_unsigned.py index bff4ad7ab..39cc9e387 100644 --- a/rta/ddns_unsigned.py +++ b/rta/ddns_unsigned.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/defensive_evasion_reflective_loading.py b/rta/defensive_evasion_reflective_loading.py index a907afbe3..f7a28aced 100644 --- a/rta/defensive_evasion_reflective_loading.py +++ b/rta/defensive_evasion_reflective_loading.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing deletion on /private/tmp/NSCreateObjectFileImageFromMemory-test file.") diff --git a/rta/defensive_evasion_safari_modification.py b/rta/defensive_evasion_safari_modification.py index 11af1258b..7ca1530e3 100644 --- a/rta/defensive_evasion_safari_modification.py +++ b/rta/defensive_evasion_safari_modification.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/defaults" diff --git a/rta/delete_bootconf.py b/rta/delete_bootconf.py index 31270f3c4..d4972b420 100644 --- a/rta/delete_bootconf.py +++ b/rta/delete_bootconf.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Messing with the boot configuration is probably not a great idea so create a backup: common.log("Exporting the boot configuration....") diff --git a/rta/delete_catalogs.py b/rta/delete_catalogs.py index 24aa819dd..266ceec9f 100644 --- a/rta/delete_catalogs.py +++ b/rta/delete_catalogs.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): warning = "Deleting the backup catalog may have unexpected consequences. Operational issues are unknown." common.log("WARNING: %s" % warning, log_type="!") diff --git a/rta/delete_quarantine_attrib.py b/rta/delete_quarantine_attrib.py index 5e352b337..407d40083 100644 --- a/rta/delete_quarantine_attrib.py +++ b/rta/delete_quarantine_attrib.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/delete_usnjrnl.py b/rta/delete_usnjrnl.py index 9f08963a1..7506bb695 100644 --- a/rta/delete_usnjrnl.py +++ b/rta/delete_usnjrnl.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): message = "Deleting the USN journal may have unintended consequences" common.log("WARNING: %s" % message, log_type="!") diff --git a/rta/delete_volume_shadows.py b/rta/delete_volume_shadows.py index fef2ae862..66d57b32e 100644 --- a/rta/delete_volume_shadows.py +++ b/rta/delete_volume_shadows.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Deleting volume shadow copies...") common.execute(["vssadmin.exe", "delete", "shadows", "/for=c:", "/oldest", "/quiet"]) diff --git a/rta/deprecated/_discovery_builtin_cmd.py b/rta/deprecated/_discovery_builtin_cmd.py index 86b859d2c..33eef0abb 100644 --- a/rta/deprecated/_discovery_builtin_cmd.py +++ b/rta/deprecated/_discovery_builtin_cmd.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/deprecated/_funzip_extract_content.py b/rta/deprecated/_funzip_extract_content.py index db576ce2c..ebfe8099d 100644 --- a/rta/deprecated/_funzip_extract_content.py +++ b/rta/deprecated/_funzip_extract_content.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/deprecated/_linux_discovery_sensitive_files.py b/rta/deprecated/_linux_discovery_sensitive_files.py index 6fa99840e..60ce89377 100644 --- a/rta/deprecated/_linux_discovery_sensitive_files.py +++ b/rta/deprecated/_linux_discovery_sensitive_files.py @@ -14,7 +14,7 @@ from . import RtaMetadata metadata = RtaMetadata(uuid="82358d3d-6f04-42d0-a182-db37cf98294e", platforms=["linux"], endpoint=[], siem=[], techniques=[]) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Reading sensitive files", log_type="~") diff --git a/rta/deprecated/_persistence_code_extension.py b/rta/deprecated/_persistence_code_extension.py index 53f860775..ca591cd57 100644 --- a/rta/deprecated/_persistence_code_extension.py +++ b/rta/deprecated/_persistence_code_extension.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/code" diff --git a/rta/deprecated/_persistence_reopened_app.py b/rta/deprecated/_persistence_reopened_app.py index 0c146873f..3bbe09893 100644 --- a/rta/deprecated/_persistence_reopened_app.py +++ b/rta/deprecated/_persistence_reopened_app.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/deprecated/_persistence_terminal_plist_mod.py b/rta/deprecated/_persistence_terminal_plist_mod.py index 3141d85b2..a5527f336 100644 --- a/rta/deprecated/_persistence_terminal_plist_mod.py +++ b/rta/deprecated/_persistence_terminal_plist_mod.py @@ -36,7 +36,7 @@ plist_content = """ """ -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing plutil commands to modify plist file.") diff --git a/rta/directory_service_plugin_file.py b/rta/directory_service_plugin_file.py index 5152f13c7..6c7fbff44 100644 --- a/rta/directory_service_plugin_file.py +++ b/rta/directory_service_plugin_file.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file modification on test.dsplug to mimic DirectoryService plugin modification") diff --git a/rta/disable_os_security_updates.py b/rta/disable_os_security_updates.py index d5f316d01..2932eeba4 100644 --- a/rta/disable_os_security_updates.py +++ b/rta/disable_os_security_updates.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/defaults" diff --git a/rta/disable_windows_fw.py b/rta/disable_windows_fw.py index 35323c3af..15bff40d8 100644 --- a/rta/disable_windows_fw.py +++ b/rta/disable_windows_fw.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("NetSH Advanced Firewall Configuration", log_type="~") netsh = "netsh.exe" diff --git a/rta/discovery_virtual_machine_grep.py b/rta/discovery_virtual_machine_grep.py index 86f7cce49..d32936031 100644 --- a/rta/discovery_virtual_machine_grep.py +++ b/rta/discovery_virtual_machine_grep.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing egrep commands to fingerprint virtual machine.") diff --git a/rta/dmg_create_in_tmp.py b/rta/dmg_create_in_tmp.py index 52c0552ac..345818ee0 100644 --- a/rta/dmg_create_in_tmp.py +++ b/rta/dmg_create_in_tmp.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): tmp_dir = Path("/tmp/TestDMGDir") diff --git a/rta/dock_plist.py b/rta/dock_plist.py index 7695da37e..f6a9b9563 100644 --- a/rta/dock_plist.py +++ b/rta/dock_plist.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file modification on com.apple.dock.plist to mimic dock plist modification") diff --git a/rta/double_persist.py b/rta/double_persist.py index 236898088..65165ee82 100644 --- a/rta/double_persist.py +++ b/rta/double_persist.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "DoublePersist.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "DoublePersist.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/dscl_hidden_account.py b/rta/dscl_hidden_account.py index 1c06e02be..3ee3fea3a 100644 --- a/rta/dscl_hidden_account.py +++ b/rta/dscl_hidden_account.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/dscl" diff --git a/rta/dseditgroup_admin_add.py b/rta/dseditgroup_admin_add.py index bd8278216..a0e579801 100644 --- a/rta/dseditgroup_admin_add.py +++ b/rta/dseditgroup_admin_add.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/dseditgroup" diff --git a/rta/dsenableroot_account.py b/rta/dsenableroot_account.py index 576142b33..271194686 100644 --- a/rta/dsenableroot_account.py +++ b/rta/dsenableroot_account.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/dsenableroot" diff --git a/rta/dylib_injection.py b/rta/dylib_injection.py index 5b6bab71c..b384f9a58 100644 --- a/rta/dylib_injection.py +++ b/rta/dylib_injection.py @@ -30,7 +30,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if platform.processor() == "arm": diff --git a/rta/dynwrapx_image_load.py b/rta/dynwrapx_image_load.py index 17c8aa373..ddde48ff0 100644 --- a/rta/dynwrapx_image_load.py +++ b/rta/dynwrapx_image_load.py @@ -29,7 +29,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/echo_tmp_file_create.py b/rta/echo_tmp_file_create.py index b1cf5902e..d6d80ec62 100644 --- a/rta/echo_tmp_file_create.py +++ b/rta/echo_tmp_file_create.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): file_path = "/tmp/test" diff --git a/rta/edmond_child_process.py b/rta/edmond_child_process.py index 0d8eec9ba..fe373c4e5 100644 --- a/rta/edmond_child_process.py +++ b/rta/edmond_child_process.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/emond" diff --git a/rta/eggshell_backdoor.py b/rta/eggshell_backdoor.py index 316713975..9576f85bc 100644 --- a/rta/eggshell_backdoor.py +++ b/rta/eggshell_backdoor.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/eggshell" diff --git a/rta/eicar.py b/rta/eicar.py index 6be6f738b..6e3cd0fda 100644 --- a/rta/eicar.py +++ b/rta/eicar.py @@ -15,7 +15,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/elevated_osascript_execution.py b/rta/elevated_osascript_execution.py index 2b5933e52..ccc998ef9 100644 --- a/rta/elevated_osascript_execution.py +++ b/rta/elevated_osascript_execution.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/emond_child_process.py b/rta/emond_child_process.py index e14a7b246..bfd89efb5 100644 --- a/rta/emond_child_process.py +++ b/rta/emond_child_process.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/emond_plist.py b/rta/emond_plist.py index 25c692c02..349bd34b8 100644 --- a/rta/emond_plist.py +++ b/rta/emond_plist.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file modification on test.plist to mimic emond file modification") diff --git a/rta/empire_stager.py b/rta/empire_stager.py index 81d4ff257..be0743519 100644 --- a/rta/empire_stager.py +++ b/rta/empire_stager.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/enum_commands.py b/rta/enum_commands.py index 31be7d360..809534cc8 100644 --- a/rta/enum_commands.py +++ b/rta/enum_commands.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(args=None): slow_commands = ["gpresult.exe /z", "systeminfo.exe"] diff --git a/rta/enumeration_linpeas.py b/rta/enumeration_linpeas.py index 059bee14d..684e2e1f5 100644 --- a/rta/enumeration_linpeas.py +++ b/rta/enumeration_linpeas.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/sed" diff --git a/rta/env_variable_hijacking.py b/rta/env_variable_hijacking.py index f2663cc22..f8ae76092 100644 --- a/rta/env_variable_hijacking.py +++ b/rta/env_variable_hijacking.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/launchctl" diff --git a/rta/evasion_addinproc_certoc_odbc_gfxdwn.py b/rta/evasion_addinproc_certoc_odbc_gfxdwn.py index 0432e3fe0..fc885368e 100644 --- a/rta/evasion_addinproc_certoc_odbc_gfxdwn.py +++ b/rta/evasion_addinproc_certoc_odbc_gfxdwn.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): addinproc = "C:\\Users\\Public\\AddInProcess.exe" certoc = "C:\\Users\\Public\\CertOc.exe" diff --git a/rta/evasion_loadlib_via_callback.py b/rta/evasion_loadlib_via_callback.py index 381461014..c4be1ac25 100644 --- a/rta/evasion_loadlib_via_callback.py +++ b/rta/evasion_loadlib_via_callback.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( # source code - https://gist.github.com/joe-desimone/0b2bb00eca4c522ba0bd5541a6f3528b BIN = common.get_path("bin", "LoadLib-Callback64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if Path(BIN).is_file(): diff --git a/rta/evasion_ntdll_from_unusual_path.py b/rta/evasion_ntdll_from_unusual_path.py index e447052fb..23a7de872 100644 --- a/rta/evasion_ntdll_from_unusual_path.py +++ b/rta/evasion_ntdll_from_unusual_path.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): import time from os import path diff --git a/rta/evasion_oversized_dll_load.py b/rta/evasion_oversized_dll_load.py index 1622d8b23..23bfaf7e4 100644 --- a/rta/evasion_oversized_dll_load.py +++ b/rta/evasion_oversized_dll_load.py @@ -28,7 +28,7 @@ DLL = common.get_path("bin", "faultrep.dll") WER = "c:\\windows\\system32\\werfault.exe" -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): import os from os import path diff --git a/rta/evasion_patch_etw_amsi.py b/rta/evasion_patch_etw_amsi.py index e7b96959b..3b64b4dc1 100644 --- a/rta/evasion_patch_etw_amsi.py +++ b/rta/evasion_patch_etw_amsi.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): import ctypes, platform from ctypes import windll, wintypes diff --git a/rta/evasion_unhook_ldrloaddll.py b/rta/evasion_unhook_ldrloaddll.py index 971059e8d..73e77bfac 100644 --- a/rta/evasion_unhook_ldrloaddll.py +++ b/rta/evasion_unhook_ldrloaddll.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( # source code -https://gist.github.com/Samirbous/cee44dbd0254c28d4f57709d5c723aee BIN = common.get_path("bin", "rta_unhook_ldrload.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if Path(BIN).is_file(): diff --git a/rta/exec_cmd_adfind.py b/rta/exec_cmd_adfind.py index 0a0e3e637..edf3a227e 100644 --- a/rta/exec_cmd_adfind.py +++ b/rta/exec_cmd_adfind.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): adfind = "C:\\Users\\Public\\adfind.exe" common.copy_file(EXE_FILE, adfind) diff --git a/rta/exec_cmd_appcmd_logging.py b/rta/exec_cmd_appcmd_logging.py index 65bf28334..c130416de 100644 --- a/rta/exec_cmd_appcmd_logging.py +++ b/rta/exec_cmd_appcmd_logging.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): appcmd = "C:\\Users\\Public\\appcmd.exe" common.copy_file(EXE_FILE, appcmd) diff --git a/rta/exec_cmd_arp.py b/rta/exec_cmd_arp.py index 0cbee9bd4..9c0cf5001 100644 --- a/rta/exec_cmd_arp.py +++ b/rta/exec_cmd_arp.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): arp = "C:\\Windows\\System32\\arp.exe" diff --git a/rta/exec_cmd_aspnet_regiis.py b/rta/exec_cmd_aspnet_regiis.py index 5e0ce2f3e..e527dd218 100644 --- a/rta/exec_cmd_aspnet_regiis.py +++ b/rta/exec_cmd_aspnet_regiis.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): aspnet_regiis = "C:\\Users\\Public\\aspnet_regiis.exe" common.copy_file(EXE_FILE, aspnet_regiis) diff --git a/rta/exec_cmd_attrib_hidden.py b/rta/exec_cmd_attrib_hidden.py index e2294f4f5..56461d09d 100644 --- a/rta/exec_cmd_attrib_hidden.py +++ b/rta/exec_cmd_attrib_hidden.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): attrib = "C:\\Users\\Public\\attrib.exe" common.copy_file(EXE_FILE, attrib) diff --git a/rta/exec_cmd_auditpol.py b/rta/exec_cmd_auditpol.py index 29f71425c..c7ec086df 100644 --- a/rta/exec_cmd_auditpol.py +++ b/rta/exec_cmd_auditpol.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): auditpol = "C:\\Users\\Public\\auditpol.exe" common.copy_file(EXE_FILE, auditpol) diff --git a/rta/exec_cmd_clear_history.py b/rta/exec_cmd_clear_history.py index 1ab2d5b81..3db358367 100644 --- a/rta/exec_cmd_clear_history.py +++ b/rta/exec_cmd_clear_history.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_compiled_html.py b/rta/exec_cmd_compiled_html.py index 192ca5ad7..2964589b4 100644 --- a/rta/exec_cmd_compiled_html.py +++ b/rta/exec_cmd_compiled_html.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): hh = "C:\\Users\\Public\\hh.exe" mshta = "C:\\Windows\\System32\\mshta.exe" diff --git a/rta/exec_cmd_endpoint_security_masquerading.py b/rta/exec_cmd_endpoint_security_masquerading.py index 49326746c..586006bf2 100644 --- a/rta/exec_cmd_endpoint_security_masquerading.py +++ b/rta/exec_cmd_endpoint_security_masquerading.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): esensor = "C:\\Users\\Public\\esensor.exe" common.copy_file(EXE_FILE, esensor) diff --git a/rta/exec_cmd_fltmc_unload.py b/rta/exec_cmd_fltmc_unload.py index 56069e36e..68bdae44e 100644 --- a/rta/exec_cmd_fltmc_unload.py +++ b/rta/exec_cmd_fltmc_unload.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): fltmc = "C:\\Users\\Public\\fltmc.exe" common.copy_file(EXE_FILE, fltmc) diff --git a/rta/exec_cmd_fsutil_fsinfo.py b/rta/exec_cmd_fsutil_fsinfo.py index b7ccd111a..d63934494 100644 --- a/rta/exec_cmd_fsutil_fsinfo.py +++ b/rta/exec_cmd_fsutil_fsinfo.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): fsutil = "C:\\Windows\\System32\\fsutil.exe" diff --git a/rta/exec_cmd_hidden_share.py b/rta/exec_cmd_hidden_share.py index a5a4ae60c..f3ac01b33 100644 --- a/rta/exec_cmd_hidden_share.py +++ b/rta/exec_cmd_hidden_share.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): xcopy = "C:\\Users\\Public\\xcopy.exe" common.copy_file(EXE_FILE, xcopy) diff --git a/rta/exec_cmd_mklink.py b/rta/exec_cmd_mklink.py index aa09a77b3..849db50b6 100644 --- a/rta/exec_cmd_mklink.py +++ b/rta/exec_cmd_mklink.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_mpcmdrun_download.py b/rta/exec_cmd_mpcmdrun_download.py index 688595156..377278e7d 100644 --- a/rta/exec_cmd_mpcmdrun_download.py +++ b/rta/exec_cmd_mpcmdrun_download.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): mpcmdrun = "C:\\Users\\Public\\MpCmdRun.exe" common.copy_file(EXE_FILE, mpcmdrun) diff --git a/rta/exec_cmd_msdt.py b/rta/exec_cmd_msdt.py index 96e92fd3e..c75f68bec 100644 --- a/rta/exec_cmd_msdt.py +++ b/rta/exec_cmd_msdt.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msdt = "C:\\Users\\Public\\rta.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_cmd_mssql_xp_cmdshell.py b/rta/exec_cmd_mssql_xp_cmdshell.py index ab503819a..a6fb54414 100644 --- a/rta/exec_cmd_mssql_xp_cmdshell.py +++ b/rta/exec_cmd_mssql_xp_cmdshell.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): sqlservr = "C:\\Users\\Public\\sqlservr.exe" cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/exec_cmd_net_stop.py b/rta/exec_cmd_net_stop.py index fbf042f4f..a2dd815c7 100644 --- a/rta/exec_cmd_net_stop.py +++ b/rta/exec_cmd_net_stop.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): net = "C:\\Users\\Public\\net.exe" common.copy_file(EXE_FILE, net) diff --git a/rta/exec_cmd_net_use.py b/rta/exec_cmd_net_use.py index 410e16218..de5412d08 100644 --- a/rta/exec_cmd_net_use.py +++ b/rta/exec_cmd_net_use.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): net = "C:\\Users\\Public\\net.exe" common.copy_file(EXE_FILE, net) diff --git a/rta/exec_cmd_netsh_advfirewall_network_discovery.py b/rta/exec_cmd_netsh_advfirewall_network_discovery.py index 428508a9d..1e9c310ae 100644 --- a/rta/exec_cmd_netsh_advfirewall_network_discovery.py +++ b/rta/exec_cmd_netsh_advfirewall_network_discovery.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): netsh = "C:\\Users\\Public\\netsh.exe" common.copy_file(EXE_FILE, netsh) diff --git a/rta/exec_cmd_netsh_remotedesktop.py b/rta/exec_cmd_netsh_remotedesktop.py index 4feed5efd..f71c86884 100644 --- a/rta/exec_cmd_netsh_remotedesktop.py +++ b/rta/exec_cmd_netsh_remotedesktop.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): netsh = "C:\\Users\\Public\\netsh.exe" common.copy_file(EXE_FILE, netsh) diff --git a/rta/exec_cmd_nltest.py b/rta/exec_cmd_nltest.py index 60ddf1be3..73b7b679e 100644 --- a/rta/exec_cmd_nltest.py +++ b/rta/exec_cmd_nltest.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_non_executable_file.py b/rta/exec_cmd_non_executable_file.py index ce8eecd0b..cc5ea269c 100644 --- a/rta/exec_cmd_non_executable_file.py +++ b/rta/exec_cmd_non_executable_file.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing bash on unexecutable file.") diff --git a/rta/exec_cmd_ntdsdit.py b/rta/exec_cmd_ntdsdit.py index 670d7e8df..989ef6740 100644 --- a/rta/exec_cmd_ntdsdit.py +++ b/rta/exec_cmd_ntdsdit.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_posh_mailbox.py b/rta/exec_cmd_posh_mailbox.py index 2e4432f2d..65d96fbbf 100644 --- a/rta/exec_cmd_posh_mailbox.py +++ b/rta/exec_cmd_posh_mailbox.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_psexesvc.py b/rta/exec_cmd_psexesvc.py index c04123aed..839047caa 100644 --- a/rta/exec_cmd_psexesvc.py +++ b/rta/exec_cmd_psexesvc.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): psexesvc = "C:\\Users\\Public\\rta.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_cmd_pwd_appcmd.py b/rta/exec_cmd_pwd_appcmd.py index 8c839baa1..0e5a62874 100644 --- a/rta/exec_cmd_pwd_appcmd.py +++ b/rta/exec_cmd_pwd_appcmd.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): appcmd = "C:\\Users\\Public\\appcmd.exe" common.copy_file(EXE_FILE, appcmd) diff --git a/rta/exec_cmd_rundll32.py b/rta/exec_cmd_rundll32.py index cab4f0809..da7734727 100644 --- a/rta/exec_cmd_rundll32.py +++ b/rta/exec_cmd_rundll32.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rundll32 = "C:\\Users\\Public\\rundll32.exe" cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/exec_cmd_rundll32_davsetcookie.py b/rta/exec_cmd_rundll32_davsetcookie.py index 2f4e7f777..f0dbe28af 100644 --- a/rta/exec_cmd_rundll32_davsetcookie.py +++ b/rta/exec_cmd_rundll32_davsetcookie.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rundll32 = "C:\\Users\\Public\\rundll32.exe" common.copy_file(EXE_FILE, rundll32) diff --git a/rta/exec_cmd_set_casmailbox.py b/rta/exec_cmd_set_casmailbox.py index 2bb6a021f..21282aa6b 100644 --- a/rta/exec_cmd_set_casmailbox.py +++ b/rta/exec_cmd_set_casmailbox.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" common.execute([powershell, "/c", "echo", "Set-CASMailbox ActiveSyncAllowedDeviceIDs"], timeout=5, kill=True) diff --git a/rta/exec_cmd_set_mppreference.py b/rta/exec_cmd_set_mppreference.py index 365384480..cb74c8dba 100644 --- a/rta/exec_cmd_set_mppreference.py +++ b/rta/exec_cmd_set_mppreference.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_short_name.py b/rta/exec_cmd_short_name.py index 4bc9e79d4..2c6fa9c3d 100644 --- a/rta/exec_cmd_short_name.py +++ b/rta/exec_cmd_short_name.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rta = "C:\\Users\\Public\\a.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_cmd_windows_firewall_disabled.py b/rta/exec_cmd_windows_firewall_disabled.py index f71f6da1f..5f0f3cbb9 100644 --- a/rta/exec_cmd_windows_firewall_disabled.py +++ b/rta/exec_cmd_windows_firewall_disabled.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_cmd_wmi_cmdexe.py b/rta/exec_cmd_wmi_cmdexe.py index 55769d179..87edfc170 100644 --- a/rta/exec_cmd_wmi_cmdexe.py +++ b/rta/exec_cmd_wmi_cmdexe.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wmiprvse = "C:\\Users\\Public\\wmiprvse.exe" cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/exec_cmd_wmi_subscription.py b/rta/exec_cmd_wmi_subscription.py index 01a737558..70532e72e 100644 --- a/rta/exec_cmd_wmi_subscription.py +++ b/rta/exec_cmd_wmi_subscription.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wmic = "C:\\Users\\Public\\wmic.exe" common.copy_file(EXE_FILE, wmic) diff --git a/rta/exec_cmd_wmic_antivirus_enum.py b/rta/exec_cmd_wmic_antivirus_enum.py index 7a8eda2ed..1ceacc3b2 100644 --- a/rta/exec_cmd_wmic_antivirus_enum.py +++ b/rta/exec_cmd_wmic_antivirus_enum.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wmic = "C:\\Windows\\System32\\wbem\\WMIC.exe" diff --git a/rta/exec_cmd_workfolders.py b/rta/exec_cmd_workfolders.py index e8f533917..1ac8cd2c0 100644 --- a/rta/exec_cmd_workfolders.py +++ b/rta/exec_cmd_workfolders.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): workfolders = "C:\\Users\\Public\\WorkFolders.exe" control = "C:\\Users\\Public\\control.exe" diff --git a/rta/exec_cmd_xwizard.py b/rta/exec_cmd_xwizard.py index c80fd53f8..6a769e432 100644 --- a/rta/exec_cmd_xwizard.py +++ b/rta/exec_cmd_xwizard.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): xwizard = "C:\\Users\\Public\\xwizard.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_conhost_indirect.py b/rta/exec_conhost_indirect.py index 22d1cfb70..b2dc7657c 100644 --- a/rta/exec_conhost_indirect.py +++ b/rta/exec_conhost_indirect.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): conhost = "C:\\Users\\Public\\conhost.exe" posh = "C:\\Users\\Public\\posh.exe" diff --git a/rta/exec_control_panel_cpl.py b/rta/exec_control_panel_cpl.py index c9bd41364..0b261aaa6 100644 --- a/rta/exec_control_panel_cpl.py +++ b/rta/exec_control_panel_cpl.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute command diff --git a/rta/exec_cscript_archive_args.py b/rta/exec_cscript_archive_args.py index 3c0e65783..fc412d9fc 100644 --- a/rta/exec_cscript_archive_args.py +++ b/rta/exec_cscript_archive_args.py @@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_cscript_suspicious_powershell.py b/rta/exec_cscript_suspicious_powershell.py index 09fff7242..a1225e131 100644 --- a/rta/exec_cscript_suspicious_powershell.py +++ b/rta/exec_cscript_suspicious_powershell.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" common.copy_file(EXE_FILE, cscript) diff --git a/rta/exec_dll_file_compressed.py b/rta/exec_dll_file_compressed.py index 628a90bf4..56d0fda03 100644 --- a/rta/exec_dll_file_compressed.py +++ b/rta/exec_dll_file_compressed.py @@ -19,7 +19,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Public\\Temp\\7z\\" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/exec_dnguard_program.py b/rta/exec_dnguard_program.py index 1dde467e4..04f691ee3 100644 --- a/rta/exec_dnguard_program.py +++ b/rta/exec_dnguard_program.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/exec_echo_named_pipe.py b/rta/exec_echo_named_pipe.py index 5a67df1bf..80a3a95f8 100644 --- a/rta/exec_echo_named_pipe.py +++ b/rta/exec_echo_named_pipe.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute command diff --git a/rta/exec_explorer_trampoline.py b/rta/exec_explorer_trampoline.py index 1916b3419..2d5c8a1af 100644 --- a/rta/exec_explorer_trampoline.py +++ b/rta/exec_explorer_trampoline.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): explorer = "C:\\Users\\Public\\explorer.exe" common.copy_file(EXE_FILE, explorer) diff --git a/rta/exec_from_mount.py b/rta/exec_from_mount.py index a145f9bac..168a95a7f 100644 --- a/rta/exec_from_mount.py +++ b/rta/exec_from_mount.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/Volumes/bash" diff --git a/rta/exec_from_python.py b/rta/exec_from_python.py index 62aef4e42..0c94ec7e4 100644 --- a/rta/exec_from_python.py +++ b/rta/exec_from_python.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # test_file = "/tmp/test.txt" diff --git a/rta/exec_from_terminal.py b/rta/exec_from_terminal.py index e5a5857d5..da185c70e 100644 --- a/rta/exec_from_terminal.py +++ b/rta/exec_from_terminal.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/terminal" diff --git a/rta/exec_gfxdownloadwrapper.py b/rta/exec_gfxdownloadwrapper.py index 7a1b488b1..2f5a8d1bd 100644 --- a/rta/exec_gfxdownloadwrapper.py +++ b/rta/exec_gfxdownloadwrapper.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): gfx = "C:\\Users\\Public\\GfxDownloadWrapper.exe" common.copy_file(EXE_FILE, gfx) diff --git a/rta/exec_ingress_tool_posh.py b/rta/exec_ingress_tool_posh.py index b802aae0d..59b786177 100644 --- a/rta/exec_ingress_tool_posh.py +++ b/rta/exec_ingress_tool_posh.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Users\\Public\\powershell.exe" common.copy_file(EXE_FILE, powershell) diff --git a/rta/exec_java_revshell_linux.py b/rta/exec_java_revshell_linux.py index 6afc5de9c..e56b8bfb4 100644 --- a/rta/exec_java_revshell_linux.py +++ b/rta/exec_java_revshell_linux.py @@ -14,7 +14,7 @@ metadata = RtaMetadata( techniques=["T1059", "T1071"], ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Creating a fake Java executable..") diff --git a/rta/exec_ms_dotnet_clickonce.py b/rta/exec_ms_dotnet_clickonce.py index 9cd761e0b..db0994975 100644 --- a/rta/exec_ms_dotnet_clickonce.py +++ b/rta/exec_ms_dotnet_clickonce.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rundll32 = "C:\\Users\\Public\\rundll32.exe" dfsvc = "C:\\Users\\Public\\dfsvc.exe" diff --git a/rta/exec_msdt_diagcab.py b/rta/exec_msdt_diagcab.py index 60ceb1fd8..a2373e32e 100644 --- a/rta/exec_msdt_diagcab.py +++ b/rta/exec_msdt_diagcab.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): firefox = "C:\\Users\\Public\\firefox.exe" msdt = "C:\\Users\\Public\\msdt.exe" diff --git a/rta/exec_msiexec_dllregisterserver.py b/rta/exec_msiexec_dllregisterserver.py index 7f84d5b18..7e2b7ca8f 100644 --- a/rta/exec_msiexec_dllregisterserver.py +++ b/rta/exec_msiexec_dllregisterserver.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msiexec = "C:\\Windows\\System32\\msiexec.exe" diff --git a/rta/exec_nohup.py b/rta/exec_nohup.py index 471c31633..a10b90d3e 100644 --- a/rta/exec_nohup.py +++ b/rta/exec_nohup.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): test_file = "/tmp/test.txt" diff --git a/rta/exec_persistence_from_iso.py b/rta/exec_persistence_from_iso.py index 74dea60e4..3871fcb42 100644 --- a/rta/exec_persistence_from_iso.py +++ b/rta/exec_persistence_from_iso.py @@ -23,7 +23,7 @@ PROC = 'cmd.exe' # ps script to mount, execute a file and unmount ISO device PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): diff --git a/rta/exec_privhelper_tool.py b/rta/exec_privhelper_tool.py index 9541ae934..234e7345c 100644 --- a/rta/exec_privhelper_tool.py +++ b/rta/exec_privhelper_tool.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): tools = Path("/Library/PrivilegedHelperTools") diff --git a/rta/exec_renamed_msbuild.py b/rta/exec_renamed_msbuild.py index e8d8c6c86..70d06817c 100644 --- a/rta/exec_renamed_msbuild.py +++ b/rta/exec_renamed_msbuild.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msbuild = "C:\\Users\\Public\\rta.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_renamed_winword.py b/rta/exec_renamed_winword.py index 814cfa366..030d53476 100644 --- a/rta/exec_renamed_winword.py +++ b/rta/exec_renamed_winword.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\rta.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_scripting_persistence_locations.py b/rta/exec_scripting_persistence_locations.py index e87bae2e5..627a5f381 100644 --- a/rta/exec_scripting_persistence_locations.py +++ b/rta/exec_scripting_persistence_locations.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_scripting_unusual_extension.py b/rta/exec_scripting_unusual_extension.py index 6b1750ae5..3f0c43710 100644 --- a/rta/exec_scripting_unusual_extension.py +++ b/rta/exec_scripting_unusual_extension.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing cscript against .exe") common.execute(["cmd.exe", "/c", "cscript.exe", "/e:Vbscript", "cmd.exe"], timeout=5, kill=True) diff --git a/rta/exec_scripting_via_html_app.py b/rta/exec_scripting_via_html_app.py index ff8d81026..c2597dae5 100644 --- a/rta/exec_scripting_via_html_app.py +++ b/rta/exec_scripting_via_html_app.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute Command # Had a hard time trying to escape the quotes that would be needed to execute a real command using diff --git a/rta/exec_sliver_posh.py b/rta/exec_sliver_posh.py index b8c2ab945..15fec41cf 100644 --- a/rta/exec_sliver_posh.py +++ b/rta/exec_sliver_posh.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/exec_sqlserver_suspicious_child.py b/rta/exec_sqlserver_suspicious_child.py index de4ca3487..3d40a0044 100644 --- a/rta/exec_sqlserver_suspicious_child.py +++ b/rta/exec_sqlserver_suspicious_child.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" sqlserver = "C:\\Users\\Public\\sqlserver.exe" diff --git a/rta/exec_susp_explorer.py b/rta/exec_susp_explorer.py index 8821e3830..2f49a2f02 100644 --- a/rta/exec_susp_explorer.py +++ b/rta/exec_susp_explorer.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): explorer = "C:\\Windows\\explorer.exe" common.execute([explorer, "easyminerRTA"], timeout=1, kill=True) diff --git a/rta/exec_susp_msiexec.py b/rta/exec_susp_msiexec.py index 8409a78fd..3ce98e2f8 100644 --- a/rta/exec_susp_msiexec.py +++ b/rta/exec_susp_msiexec.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" msiexec = "C:\\Users\\Public\\msiexec.exe" diff --git a/rta/exec_susp_parent_child.py b/rta/exec_susp_parent_child.py index b07f4ce44..811f625e8 100644 --- a/rta/exec_susp_parent_child.py +++ b/rta/exec_susp_parent_child.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" tiworker = "C:\\Users\\Public\\TiWorker.exe" diff --git a/rta/exec_svchost_child_schedule.py b/rta/exec_svchost_child_schedule.py index 3409cf1c4..ef057f06b 100644 --- a/rta/exec_svchost_child_schedule.py +++ b/rta/exec_svchost_child_schedule.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): svchost = "C:\\Users\\Public\\svchost.exe" common.copy_file(EXE_FILE, svchost) diff --git a/rta/exec_tclsh.py b/rta/exec_tclsh.py index 381b00ef1..0973f3482 100644 --- a/rta/exec_tclsh.py +++ b/rta/exec_tclsh.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/tclsh" diff --git a/rta/exec_unusual_directory.py b/rta/exec_unusual_directory.py index 56824da35..8ecbb312b 100644 --- a/rta/exec_unusual_directory.py +++ b/rta/exec_unusual_directory.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): exe_path = "c:\\windows\\system32\\cscript.exe" binary = "c:\\Users\\Public\\cscript.exe" diff --git a/rta/exec_unusual_path_msmpeng.py b/rta/exec_unusual_path_msmpeng.py index 6bdf1e4ca..efa141a04 100644 --- a/rta/exec_unusual_path_msmpeng.py +++ b/rta/exec_unusual_path_msmpeng.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msmpeng = "C:\\Users\\Public\\MsMpEng.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/exec_vs_prebuildevent.py b/rta/exec_vs_prebuildevent.py index 04b951b74..b54a019e1 100644 --- a/rta/exec_vs_prebuildevent.py +++ b/rta/exec_vs_prebuildevent.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msbuild = "C:\\Users\\Public\\msbuild.exe" cmd = "C:\\Users\\Public\\cmd.exe" diff --git a/rta/exec_vsls_agent.py b/rta/exec_vsls_agent.py index 79fa3d2af..91800054d 100644 --- a/rta/exec_vsls_agent.py +++ b/rta/exec_vsls_agent.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): vslsagent = "C:\\Users\\Public\\vsls-agent.exe" common.copy_file(EXE_FILE, vslsagent) diff --git a/rta/exec_winword_susp_parent.py b/rta/exec_winword_susp_parent.py index 8b8c5aca6..41d4d2a82 100644 --- a/rta/exec_winword_susp_parent.py +++ b/rta/exec_winword_susp_parent.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" winword = "C:\\Users\\Public\\winword.exe" diff --git a/rta/execution_iso_dll_rundll32.py b/rta/execution_iso_dll_rundll32.py index 66db61faa..23049f43a 100644 --- a/rta/execution_iso_dll_rundll32.py +++ b/rta/execution_iso_dll_rundll32.py @@ -24,7 +24,7 @@ PROC = 'Invite.lnk' # ps script to mount, execute a file and unmount ISO device PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): diff --git a/rta/execution_iso_dll_sideload.py b/rta/execution_iso_dll_sideload.py index 1aa167ac1..f60c1875a 100644 --- a/rta/execution_iso_dll_sideload.py +++ b/rta/execution_iso_dll_sideload.py @@ -22,7 +22,7 @@ PROC = 'WER_RTA.exe' # ps script to mount, execute a file and unmount ISO device PS_SCRIPT = common.get_path("bin", "ExecFromISOFile.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if Path(ISO).is_file() and Path(PS_SCRIPT).is_file(): diff --git a/rta/execution_node_child_process.py b/rta/execution_node_child_process.py index 142aaf2e1..c63afdb2e 100644 --- a/rta/execution_node_child_process.py +++ b/rta/execution_node_child_process.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/node" diff --git a/rta/execution_pubprn.py b/rta/execution_pubprn.py index fc6dbb748..c041391ec 100644 --- a/rta/execution_pubprn.py +++ b/rta/execution_pubprn.py @@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/extexport_sideload.py b/rta/extexport_sideload.py index 167794278..e75dc77e3 100644 --- a/rta/extexport_sideload.py +++ b/rta/extexport_sideload.py @@ -22,7 +22,7 @@ RENAMER = common.get_path("bin", "rcedit-x64.exe") EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dll = "C:\\Users\\Public\\sqlite3.dll" posh = "C:\\Users\\Public\\posh.exe" diff --git a/rta/file_ads_creation.py b/rta/file_ads_creation.py index a6e51fb17..54c65ab6b 100644 --- a/rta/file_ads_creation.py +++ b/rta/file_ads_creation.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" exe = "C:\\Users\\Public\\a.exe" diff --git a/rta/file_create_dpapi_key.py b/rta/file_create_dpapi_key.py index e0f6ed9be..96820d337 100644 --- a/rta/file_create_dpapi_key.py +++ b/rta/file_create_dpapi_key.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" fake_dpapi = "C:\\Users\\Public\\ntds_capi_test.pfx" diff --git a/rta/file_create_exchange_um.py b/rta/file_create_exchange_um.py index 92a498449..cb0c9f16a 100644 --- a/rta/file_create_exchange_um.py +++ b/rta/file_create_exchange_um.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\UMWorkerProcess.exe" path = "C:\\Users\\Public\\Microsoft\\Exchange Server Test\\FrontEnd\\HttpProxy\\owa\\auth\\" diff --git a/rta/file_create_exec_pdf_reader.py b/rta/file_create_exec_pdf_reader.py index 178f3e7fa..59773ef1c 100644 --- a/rta/file_create_exec_pdf_reader.py +++ b/rta/file_create_exec_pdf_reader.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rdrcef = "C:\\Users\\Public\\rdrcef.exe" arp = "C:\\Users\\Public\\arp.exe" diff --git a/rta/file_create_lsass_dump.py b/rta/file_create_lsass_dump.py index b086e9f16..a7d893760 100644 --- a/rta/file_create_lsass_dump.py +++ b/rta/file_create_lsass_dump.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" fake_dmp = "C:\\Users\\Public\\lsass_test.dmp" diff --git a/rta/file_create_mimilsa_log.py b/rta/file_create_mimilsa_log.py index 064779e7a..ec6201d66 100644 --- a/rta/file_create_mimilsa_log.py +++ b/rta/file_create_mimilsa_log.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): lsass = "C:\\Users\\Public\\lsass.exe" fake_log = "C:\\Users\\Public\\mimilsa.log" diff --git a/rta/file_create_ms_addins.py b/rta/file_create_ms_addins.py index 0870275e1..1d6bdf97e 100644 --- a/rta/file_create_ms_addins.py +++ b/rta/file_create_ms_addins.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Public\\\\AppData\\Roaming\\Microsoft\\Word\\Startup" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/file_create_mstsc_startup.py b/rta/file_create_mstsc_startup.py index bebe6a7b7..f7371f462 100644 --- a/rta/file_create_mstsc_startup.py +++ b/rta/file_create_mstsc_startup.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): mstsc = "C:\\Users\\Public\\mstsc.exe" path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" diff --git a/rta/file_create_outlook_vba.py b/rta/file_create_outlook_vba.py index 4797cec9b..851ca871b 100644 --- a/rta/file_create_outlook_vba.py +++ b/rta/file_create_outlook_vba.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Outlook" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/file_create_powershell_profile.py b/rta/file_create_powershell_profile.py index d82fccd06..670420700 100644 --- a/rta/file_create_powershell_profile.py +++ b/rta/file_create_powershell_profile.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Public\\Documents\\WindowsPowerShell" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/file_create_scripting_startup.py b/rta/file_create_scripting_startup.py index 5f8caa28e..488ce62e9 100644 --- a/rta/file_create_scripting_startup.py +++ b/rta/file_create_scripting_startup.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" diff --git a/rta/file_create_smss_exec.py b/rta/file_create_smss_exec.py index b94f5e3f1..ce835d50e 100644 --- a/rta/file_create_smss_exec.py +++ b/rta/file_create_smss_exec.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): smss = "C:\\Users\\Public\\smss.exe" fake_exe = "C:\\Users\\Public\\a.exe" diff --git a/rta/file_create_task_file.py b/rta/file_create_task_file.py index 13690103f..19a0f75eb 100644 --- a/rta/file_create_task_file.py +++ b/rta/file_create_task_file.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Windows\\Tasks\\a.job" common.copy_file(EXE_FILE, path) diff --git a/rta/file_create_vbs_startup.py b/rta/file_create_vbs_startup.py index d1586236a..ec562dae3 100644 --- a/rta/file_create_vbs_startup.py +++ b/rta/file_create_vbs_startup.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Programs\\Startup" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/file_creation_teamviewer.py b/rta/file_creation_teamviewer.py index 31cd3faf4..90e1bd1aa 100644 --- a/rta/file_creation_teamviewer.py +++ b/rta/file_creation_teamviewer.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): teamviewer = "C:\\Users\\Public\\teamviewer.exe" fake_exe = "C:\\Users\\Public\\a.exe" diff --git a/rta/file_delete_spool_driver.py b/rta/file_delete_spool_driver.py index bb942dc36..06f5c6ddf 100644 --- a/rta/file_delete_spool_driver.py +++ b/rta/file_delete_spool_driver.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): file = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\rta.dll" common.copy_file(EXE_FILE, file) diff --git a/rta/file_delete_vbk.py b/rta/file_delete_vbk.py index 686a9631c..0c6ecd5c6 100644 --- a/rta/file_delete_vbk.py +++ b/rta/file_delete_vbk.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): fakebkp = Path("fake.vbk").resolve() with open(fakebkp, 'w'): diff --git a/rta/file_exe_ususual_extension.py b/rta/file_exe_ususual_extension.py index 20502c336..57562728e 100644 --- a/rta/file_exe_ususual_extension.py +++ b/rta/file_exe_ususual_extension.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" unusualext = "C:\\Users\\Public\\powershell.exe.pdf" diff --git a/rta/file_html_smuggling.py b/rta/file_html_smuggling.py index 739c75059..5b30f824f 100644 --- a/rta/file_html_smuggling.py +++ b/rta/file_html_smuggling.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): userprofile = os.getenv("USERPROFILE") partial = f"{userprofile}\\Downloads\\a.partial" diff --git a/rta/file_mod_via_chmod.py b/rta/file_mod_via_chmod.py index 18340f9d5..bce455f75 100644 --- a/rta/file_mod_via_chmod.py +++ b/rta/file_mod_via_chmod.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing chmod on tmp files.") diff --git a/rta/file_ms_template_macros.py b/rta/file_ms_template_macros.py index a92c79720..617c82f76 100644 --- a/rta/file_ms_template_macros.py +++ b/rta/file_ms_template_macros.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Templates\\" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/file_script_startup_folder.py b/rta/file_script_startup_folder.py index 1d180bc79..61af030ba 100644 --- a/rta/file_script_startup_folder.py +++ b/rta/file_script_startup_folder.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\'Start Menu'\\Programs\\Startup\\" diff --git a/rta/file_susp_browser_extension.py b/rta/file_susp_browser_extension.py index 03aafdb19..8dfe1a462 100644 --- a/rta/file_susp_browser_extension.py +++ b/rta/file_susp_browser_extension.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" path = "C:\\Users\\Public\\AppData\\Roaming\\Mozilla\\Test\\Profiles\\AdefaultA" diff --git a/rta/finder_sync_plugin.py b/rta/finder_sync_plugin.py index f4888adb9..bf314bf5e 100644 --- a/rta/finder_sync_plugin.py +++ b/rta/finder_sync_plugin.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/pluginkit" diff --git a/rta/findstr_pw_search.py b/rta/findstr_pw_search.py index e65d53660..68bba4890 100644 --- a/rta/findstr_pw_search.py +++ b/rta/findstr_pw_search.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "c:\\rta" common.log("Searching for passwords on %s" % path) diff --git a/rta/firewall_allowlist_modif_unsigned.py b/rta/firewall_allowlist_modif_unsigned.py index 037eb7985..36928447d 100644 --- a/rta/firewall_allowlist_modif_unsigned.py +++ b/rta/firewall_allowlist_modif_unsigned.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/fltmc_unload.py b/rta/fltmc_unload.py index db51193d8..c7d9ce35c 100644 --- a/rta/fltmc_unload.py +++ b/rta/fltmc_unload.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute command diff --git a/rta/git_creds_access.py b/rta/git_creds_access.py index ec5808078..3777c7751 100644 --- a/rta/git_creds_access.py +++ b/rta/git_creds_access.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" gitpath = "C:\\Users\\Public\\.config\\git" diff --git a/rta/globalflags.py b/rta/globalflags.py index 437257a16..b058d2caa 100644 --- a/rta/globalflags.py +++ b/rta/globalflags.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Setting up persistence using Globalflags") ifeo_subkey = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\netstat.exe" diff --git a/rta/grep_software_discovery.py b/rta/grep_software_discovery.py index 472261667..fab17c015 100644 --- a/rta/grep_software_discovery.py +++ b/rta/grep_software_discovery.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/grep" diff --git a/rta/hidden_file_mount.py b/rta/hidden_file_mount.py index b6c77acc0..fc979e4ea 100644 --- a/rta/hidden_file_mount.py +++ b/rta/hidden_file_mount.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): mount_dir = "/tmp/.exploit" diff --git a/rta/hidden_plist.py b/rta/hidden_plist.py index 8df4bf8bf..4ef1e481c 100644 --- a/rta/hidden_plist.py +++ b/rta/hidden_plist.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): plist_path = f"/Library/LaunchAgents/.test.plist" diff --git a/rta/html_help_file_written_exec.py b/rta/html_help_file_written_exec.py index 3e14d94af..62929ba6d 100644 --- a/rta/html_help_file_written_exec.py +++ b/rta/html_help_file_written_exec.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() url = f"http://{ip}:{port}/bin/renamed_posh.exe" diff --git a/rta/image_load_dnguard.py b/rta/image_load_dnguard.py index 19e15a86a..60ebd86cf 100644 --- a/rta/image_load_dnguard.py +++ b/rta/image_load_dnguard.py @@ -23,7 +23,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/image_load_msbuild_vaultcli.py b/rta/image_load_msbuild_vaultcli.py index e81d5633c..6a507f8fa 100644 --- a/rta/image_load_msbuild_vaultcli.py +++ b/rta/image_load_msbuild_vaultcli.py @@ -22,7 +22,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msbuild = "C:\\Users\\Public\\msbuild.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/image_load_phantomdll.py b/rta/image_load_phantomdll.py index 68497d96c..d4dfe5d45 100644 --- a/rta/image_load_phantomdll.py +++ b/rta/image_load_phantomdll.py @@ -22,7 +22,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/image_load_rdp_client_dll.py b/rta/image_load_rdp_client_dll.py index 6a4b8e605..7e6b1c338 100644 --- a/rta/image_load_rdp_client_dll.py +++ b/rta/image_load_rdp_client_dll.py @@ -18,7 +18,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/image_load_script_interpreter_wmiutils.py b/rta/image_load_script_interpreter_wmiutils.py index a5f74d7c5..56f596902 100644 --- a/rta/image_load_script_interpreter_wmiutils.py +++ b/rta/image_load_script_interpreter_wmiutils.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/image_load_taskhost.py b/rta/image_load_taskhost.py index c35fdd3c4..6b25b78e6 100644 --- a/rta/image_load_taskhost.py +++ b/rta/image_load_taskhost.py @@ -22,7 +22,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): taskhost1 = "C:\\Users\\Public\\taskhost1.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/image_load_vaultcli.py b/rta/image_load_vaultcli.py index 4ccf98388..245e3ce5f 100644 --- a/rta/image_load_vaultcli.py +++ b/rta/image_load_vaultcli.py @@ -21,7 +21,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/impersonate_trusted_installer.py b/rta/impersonate_trusted_installer.py index 0d8170647..16986a890 100644 --- a/rta/impersonate_trusted_installer.py +++ b/rta/impersonate_trusted_installer.py @@ -48,7 +48,7 @@ def impersonate_trusted_installer(): print(f'[x] - Failed TrustedInstaller Impersonation') pass -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.impersonate_system() startsvc_trustedinstaller() diff --git a/rta/inhibit_system_recovery.py b/rta/inhibit_system_recovery.py index 4429fbd15..de51588ae 100644 --- a/rta/inhibit_system_recovery.py +++ b/rta/inhibit_system_recovery.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Deleting volume shadow copies...") diff --git a/rta/inhibit_system_recovery_and_rename.py b/rta/inhibit_system_recovery_and_rename.py index 079fe2e47..193abefc8 100644 --- a/rta/inhibit_system_recovery_and_rename.py +++ b/rta/inhibit_system_recovery_and_rename.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): vssadmin = "C:\\Windows\\System32\\vssadmin.exe" powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/inhibit_system_recovery_cmd.py b/rta/inhibit_system_recovery_cmd.py index afa0fbfa3..5e8313158 100644 --- a/rta/inhibit_system_recovery_cmd.py +++ b/rta/inhibit_system_recovery_cmd.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): vssadmin = "C:\\Windows\\System32\\vssadmin.exe" cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/inhibit_system_recovery_lolbas_child.py b/rta/inhibit_system_recovery_lolbas_child.py index db5cd173c..2160fa37a 100644 --- a/rta/inhibit_system_recovery_lolbas_child.py +++ b/rta/inhibit_system_recovery_lolbas_child.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): vssadmin = "C:\\Windows\\System32\\vssadmin.exe" cscript = "C:\\Users\\Public\\cscript.exe" diff --git a/rta/inhibit_system_recovery_office.py b/rta/inhibit_system_recovery_office.py index e46fbe2db..a0dd58e4d 100644 --- a/rta/inhibit_system_recovery_office.py +++ b/rta/inhibit_system_recovery_office.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "winword.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/inhibit_system_recovery_renamed.py b/rta/inhibit_system_recovery_renamed.py index 1d1b9aa60..e443c322a 100644 --- a/rta/inhibit_system_recovery_renamed.py +++ b/rta/inhibit_system_recovery_renamed.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): vssadmin = "C:\\Windows\\System32\\vssadmin.exe" ren_vssadmin = "C:\\Users\\Public\\renvssadmin.exe" diff --git a/rta/installutil_network.py b/rta/installutil_network.py index ac0c41cdf..725527788 100644 --- a/rta/installutil_network.py +++ b/rta/installutil_network.py @@ -36,7 +36,7 @@ metadata = RtaMetadata( MY_DOT_NET = common.get_path("bin", "mydotnet.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_DOT_NET) def main(): server, ip, port = common.serve_web() diff --git a/rta/ip_discovery_unsigned.py b/rta/ip_discovery_unsigned.py index 5f5047eb0..63bfde793 100644 --- a/rta/ip_discovery_unsigned.py +++ b/rta/ip_discovery_unsigned.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/iqy_file_writes.py b/rta/iqy_file_writes.py index e93b5f2b0..5427443d2 100644 --- a/rta/iqy_file_writes.py +++ b/rta/iqy_file_writes.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Suspicious File Writes (IQY, PUB)") adobe_path = Path("AcroRd32.exe").resolve() diff --git a/rta/javascript_payload.py b/rta/javascript_payload.py index 22f38832e..4bba705b2 100644 --- a/rta/javascript_payload.py +++ b/rta/javascript_payload.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Setup web server common.serve_web() diff --git a/rta/kcc_kerberos_dump.py b/rta/kcc_kerberos_dump.py index 835aea334..57e8fde3b 100644 --- a/rta/kcc_kerberos_dump.py +++ b/rta/kcc_kerberos_dump.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/kcc" diff --git a/rta/kerberos_netconn_file_creation.py b/rta/kerberos_netconn_file_creation.py index 01f5bd716..ea14a3335 100644 --- a/rta/kerberos_netconn_file_creation.py +++ b/rta/kerberos_netconn_file_creation.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/kernel_module_removal_execution.py b/rta/kernel_module_removal_execution.py index a0076f31d..d96c38bbc 100644 --- a/rta/kernel_module_removal_execution.py +++ b/rta/kernel_module_removal_execution.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/rmmod" diff --git a/rta/kernelext_agent_unload.py b/rta/kernelext_agent_unload.py index a0f80d027..519096b26 100644 --- a/rta/kernelext_agent_unload.py +++ b/rta/kernelext_agent_unload.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/kextunload" diff --git a/rta/kext_load.py b/rta/kext_load.py index 07dd1f3d9..d49ca9c05 100644 --- a/rta/kext_load.py +++ b/rta/kext_load.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/keychain_cred_access.py b/rta/keychain_cred_access.py index eabfde995..978be6c46 100644 --- a/rta/keychain_cred_access.py +++ b/rta/keychain_cred_access.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/keychain_dump.py b/rta/keychain_dump.py index 07639b4ab..922f59fc3 100644 --- a/rta/keychain_dump.py +++ b/rta/keychain_dump.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/keychain_pwd_cmdline.py b/rta/keychain_pwd_cmdline.py index 70e9457e1..59e33dbc2 100644 --- a/rta/keychain_pwd_cmdline.py +++ b/rta/keychain_pwd_cmdline.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/security" diff --git a/rta/lateral_command_psexec.py b/rta/lateral_command_psexec.py index 3a7e5cb60..4c95fccb4 100755 --- a/rta/lateral_command_psexec.py +++ b/rta/lateral_command_psexec.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(common.PS_EXEC) def main(remote_host=None): remote_host = remote_host or common.get_ip() diff --git a/rta/lateral_commands.py b/rta/lateral_commands.py index ce81874bd..649d4658c 100644 --- a/rta/lateral_commands.py +++ b/rta/lateral_commands.py @@ -31,7 +31,7 @@ metadata = RtaMetadata( MY_APP = common.get_path("bin", "myapp.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_APP) def main(remote_host=None): remote_host = remote_host or common.get_ip() diff --git a/rta/launchagent_plist.py b/rta/launchagent_plist.py index 99e3a62c4..8483efb79 100644 --- a/rta/launchagent_plist.py +++ b/rta/launchagent_plist.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/launchctl" diff --git a/rta/launchd_load_plist.py b/rta/launchd_load_plist.py index 268b70be2..294cb195b 100644 --- a/rta/launchd_load_plist.py +++ b/rta/launchd_load_plist.py @@ -39,7 +39,7 @@ plist = """ """ -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): plist_name = "com.test.plist" daemon_dir = Path("/", "Library", "LaunchDaemons").expanduser() diff --git a/rta/launchdaemon_persistence.py b/rta/launchdaemon_persistence.py index fde4f3c53..42dca5963 100644 --- a/rta/launchdaemon_persistence.py +++ b/rta/launchdaemon_persistence.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/launchctl" diff --git a/rta/ldapsearch_group_enumeration.py b/rta/ldapsearch_group_enumeration.py index 7b2da0f89..87d09d2d7 100644 --- a/rta/ldapsearch_group_enumeration.py +++ b/rta/ldapsearch_group_enumeration.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/ldapsearch" diff --git a/rta/link_to_tmp.py b/rta/link_to_tmp.py index eccc4df72..c6a3c208f 100644 --- a/rta/link_to_tmp.py +++ b/rta/link_to_tmp.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/ln" diff --git a/rta/linux_compress_sensitive_files.py b/rta/linux_compress_sensitive_files.py index aa730c39e..99802ebbb 100644 --- a/rta/linux_compress_sensitive_files.py +++ b/rta/linux_compress_sensitive_files.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Compressing sensitive files") files = ["totally-legit.tar", "official-business.zip", "expense-reports.gz"] diff --git a/rta/login_hook.py b/rta/login_hook.py index 3a1447533..deee6b744 100644 --- a/rta/login_hook.py +++ b/rta/login_hook.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/defaults" diff --git a/rta/login_window_plist.py b/rta/login_window_plist.py index b92846bb1..5cc8da5d6 100644 --- a/rta/login_window_plist.py +++ b/rta/login_window_plist.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing deletion on /tmp/com.apple.loginwindow.plist file.") diff --git a/rta/lua_image_load.py b/rta/lua_image_load.py index 39dfccfa6..fe36b145e 100644 --- a/rta/lua_image_load.py +++ b/rta/lua_image_load.py @@ -22,7 +22,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/mac_office_descendant.py b/rta/mac_office_descendant.py index 60f411632..2bfa69308 100644 --- a/rta/mac_office_descendant.py +++ b/rta/mac_office_descendant.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Emulating Microsoft Word running enumeration commands") office_path = Path("Microsoft Word").resolve() diff --git a/rta/macos_installer_curl.py b/rta/macos_installer_curl.py index 58d75b429..05cd75857 100644 --- a/rta/macos_installer_curl.py +++ b/rta/macos_installer_curl.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/mimikatz_cmdline.py b/rta/mimikatz_cmdline.py index a725f9939..e2a17047d 100644 --- a/rta/mimikatz_cmdline.py +++ b/rta/mimikatz_cmdline.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/mimipenguin_execution.py b/rta/mimipenguin_execution.py index d96859b90..792b70d4c 100644 --- a/rta/mimipenguin_execution.py +++ b/rta/mimipenguin_execution.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/ps" diff --git a/rta/modification_of_wdigest_security_provider.py b/rta/modification_of_wdigest_security_provider.py index be66302ef..e8c77739a 100644 --- a/rta/modification_of_wdigest_security_provider.py +++ b/rta/modification_of_wdigest_security_provider.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest" value = "UseLogonCredential" diff --git a/rta/modify_sublime_app.py b/rta/modify_sublime_app.py index 332d38811..05463781c 100644 --- a/rta/modify_sublime_app.py +++ b/rta/modify_sublime_app.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): sublime_dir = Path(f"{Path.home()}/Library/Application Support/Sublime Text 4/") diff --git a/rta/mount_smbfs.py b/rta/mount_smbfs.py index 93606713c..a584580c5 100644 --- a/rta/mount_smbfs.py +++ b/rta/mount_smbfs.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/mount_smbfs" diff --git a/rta/ms_office_drop_exe.py b/rta/ms_office_drop_exe.py index 13e4cb1e8..5d98e57a6 100644 --- a/rta/ms_office_drop_exe.py +++ b/rta/ms_office_drop_exe.py @@ -28,7 +28,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cmd_path = "c:\\windows\\system32\\cmd.exe" diff --git a/rta/ms_office_task_creation.py b/rta/ms_office_task_creation.py index 91863e921..57753c42c 100644 --- a/rta/ms_office_task_creation.py +++ b/rta/ms_office_task_creation.py @@ -28,7 +28,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" svchost = "C:\\Users\\Public\\svchost.exe" diff --git a/rta/msbuild_network.py b/rta/msbuild_network.py index 8e79375e8..30d123795 100644 --- a/rta/msbuild_network.py +++ b/rta/msbuild_network.py @@ -31,7 +31,7 @@ metadata = RtaMetadata( MS_BUILD = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe" -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MS_BUILD) def main(): common.log("MsBuild Beacon") diff --git a/rta/msbuild_unusual_args.py b/rta/msbuild_unusual_args.py index 4f277f6f8..177e24809 100644 --- a/rta/msbuild_unusual_args.py +++ b/rta/msbuild_unusual_args.py @@ -22,7 +22,7 @@ RENAMER = common.get_path("bin", "rcedit-x64.exe") EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msbuild = "C:\\Users\\Public\\posh.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/msequationeditor_file_written_exec.py b/rta/msequationeditor_file_written_exec.py index 5e6cc40d5..0ef3f8051 100644 --- a/rta/msequationeditor_file_written_exec.py +++ b/rta/msequationeditor_file_written_exec.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() url = f"http://{ip}:{port}/bin/renamed_posh.exe" diff --git a/rta/msequationeditor_net_conn.py b/rta/msequationeditor_net_conn.py index 6c70e01e6..9bd9fea82 100644 --- a/rta/msequationeditor_net_conn.py +++ b/rta/msequationeditor_net_conn.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "regsvr32.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): eqnedt32 = "C:\\Users\\Public\\eqnedt32.exe" diff --git a/rta/mshta_network.py b/rta/mshta_network.py index 3f3b4bcd6..b0618d820 100644 --- a/rta/mshta_network.py +++ b/rta/mshta_network.py @@ -30,7 +30,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(HTA_FILE) def main(): # http server will terminate on main thread exit diff --git a/rta/msiexec_http_installer.py b/rta/msiexec_http_installer.py index 989d6aba4..2e812750b 100644 --- a/rta/msiexec_http_installer.py +++ b/rta/msiexec_http_installer.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("MsiExec HTTP Download") server, ip, port = common.serve_web() diff --git a/rta/msiexec_remote_msi.py b/rta/msiexec_remote_msi.py index 732616f46..458cb7fce 100644 --- a/rta/msiexec_remote_msi.py +++ b/rta/msiexec_remote_msi.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute command diff --git a/rta/msiexec_remote_msi_install.py b/rta/msiexec_remote_msi_install.py index fa54d9ea8..a5fa6dd87 100644 --- a/rta/msiexec_remote_msi_install.py +++ b/rta/msiexec_remote_msi_install.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msiexec = "C:\\Users\\Public\\msiexec.exe" common.copy_file(EXE_FILE, msiexec) diff --git a/rta/msoffice_addins_file.py b/rta/msoffice_addins_file.py index 30ceb12cc..7ef4695ce 100644 --- a/rta/msoffice_addins_file.py +++ b/rta/msoffice_addins_file.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): path = "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Word\\Startup" Path(path).mkdir(parents=True, exist_ok=True) diff --git a/rta/msoffice_dcom_accessvbom.py b/rta/msoffice_dcom_accessvbom.py index 27d6e23fd..ad3e015ed 100644 --- a/rta/msoffice_dcom_accessvbom.py +++ b/rta/msoffice_dcom_accessvbom.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" common.copy_file(EXE_FILE, winword) diff --git a/rta/msoffice_descendant_reg_mod_persistence.py b/rta/msoffice_descendant_reg_mod_persistence.py index 0fb97782e..5b347ada0 100644 --- a/rta/msoffice_descendant_reg_mod_persistence.py +++ b/rta/msoffice_descendant_reg_mod_persistence.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" posh = "C:\\Users\\Public\\posh.exe" diff --git a/rta/msoffice_dll_image_load.py b/rta/msoffice_dll_image_load.py index 46b04259c..da7d288f9 100644 --- a/rta/msoffice_dll_image_load.py +++ b/rta/msoffice_dll_image_load.py @@ -24,7 +24,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/msoffice_file_dll_sideload.py b/rta/msoffice_file_dll_sideload.py index 80a8f6e4e..af5b27945 100644 --- a/rta/msoffice_file_dll_sideload.py +++ b/rta/msoffice_file_dll_sideload.py @@ -31,7 +31,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/msoffice_file_drop_exec_wmi.py b/rta/msoffice_file_drop_exec_wmi.py index 2684d95be..ce1743bc4 100644 --- a/rta/msoffice_file_drop_exec_wmi.py +++ b/rta/msoffice_file_drop_exec_wmi.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() url = f"http://{ip}:{port}/bin/renamed_posh.exe" diff --git a/rta/msoffice_file_exec_script_interpreter.py b/rta/msoffice_file_exec_script_interpreter.py index 3354785af..c5bedadad 100644 --- a/rta/msoffice_file_exec_script_interpreter.py +++ b/rta/msoffice_file_exec_script_interpreter.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "winword.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/msoffice_potential_proc_inj.py b/rta/msoffice_potential_proc_inj.py index 36af034fb..ec1a37907 100644 --- a/rta/msoffice_potential_proc_inj.py +++ b/rta/msoffice_potential_proc_inj.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/msoffice_reg_mod.py b/rta/msoffice_reg_mod.py index e51dca639..0aa2b3edc 100644 --- a/rta/msoffice_reg_mod.py +++ b/rta/msoffice_reg_mod.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" common.copy_file(EXE_FILE, winword) diff --git a/rta/msoffice_signed_binary_spawn.py b/rta/msoffice_signed_binary_spawn.py index c03311f46..7bf1ddade 100644 --- a/rta/msoffice_signed_binary_spawn.py +++ b/rta/msoffice_signed_binary_spawn.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" temposh = "C:\\Users\\Public\\posh.exe" diff --git a/rta/msoffice_startup_persistence.py b/rta/msoffice_startup_persistence.py index edd9fff49..62ff4d292 100644 --- a/rta/msoffice_startup_persistence.py +++ b/rta/msoffice_startup_persistence.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Users\\Public\\posh.exe" temp = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\temp_persist.exe" diff --git a/rta/msoffice_untrusted_exec.py b/rta/msoffice_untrusted_exec.py index fa9a77656..2c498351b 100644 --- a/rta/msoffice_untrusted_exec.py +++ b/rta/msoffice_untrusted_exec.py @@ -29,7 +29,7 @@ EXE_FILE = common.get_path("bin", "regsvr32.exe") EXE_FILE2 = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "winword.exe" common.copy_file(EXE_FILE2, binary) diff --git a/rta/msoffice_wmi_imageload.py b/rta/msoffice_wmi_imageload.py index cc8696b7f..26bfd0a02 100644 --- a/rta/msoffice_wmi_imageload.py +++ b/rta/msoffice_wmi_imageload.py @@ -19,7 +19,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): winword = "C:\\Users\\Public\\winword.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/msxsl_image_load.py b/rta/msxsl_image_load.py index a0fad0c36..9d1e007d4 100644 --- a/rta/msxsl_image_load.py +++ b/rta/msxsl_image_load.py @@ -23,7 +23,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msxsl = "C:\\Users\\Public\\msxsl.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/msxsl_network.py b/rta/msxsl_network.py index 04f044b63..129d20a35 100644 --- a/rta/msxsl_network.py +++ b/rta/msxsl_network.py @@ -26,7 +26,7 @@ XML_FILE = common.get_path("bin", "customers.xml") XSL_FILE = common.get_path("bin", "cscript.xsl") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MS_XSL, XML_FILE, XSL_FILE) def main(): common.log("MsXsl Beacon") diff --git a/rta/net_user_add.py b/rta/net_user_add.py index a3f5f89ca..f813740a9 100644 --- a/rta/net_user_add.py +++ b/rta/net_user_add.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Creating local and domain user accounts using net.exe") commands = [ diff --git a/rta/network_connection_desktopimgdownldr.py b/rta/network_connection_desktopimgdownldr.py index 29074b548..58a5e09ff 100644 --- a/rta/network_connection_desktopimgdownldr.py +++ b/rta/network_connection_desktopimgdownldr.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): desktopimgdownldr = "C:\\Users\\Public\\desktopimgdownldr.exe" common.copy_file(EXE_FILE, desktopimgdownldr) diff --git a/rta/network_connection_download_powershell.py b/rta/network_connection_download_powershell.py index 3fa4d47f0..c692318a4 100644 --- a/rta/network_connection_download_powershell.py +++ b/rta/network_connection_download_powershell.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" fake_exe = "C:\\Users\\Public\\a.exe" diff --git a/rta/network_connection_download_script_interpreter.py b/rta/network_connection_download_script_interpreter.py index ae7afbd54..2e2fb9bf5 100644 --- a/rta/network_connection_download_script_interpreter.py +++ b/rta/network_connection_download_script_interpreter.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wscript = "C:\\Users\\Public\\wscript.exe" fake_exe = "C:\\Users\\Public\\a.exe" diff --git a/rta/network_connection_external_ip_lookup_non_browser.py b/rta/network_connection_external_ip_lookup_non_browser.py index 2e2e4545c..ebb907798 100644 --- a/rta/network_connection_external_ip_lookup_non_browser.py +++ b/rta/network_connection_external_ip_lookup_non_browser.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/network_connection_freesslcert.py b/rta/network_connection_freesslcert.py index 2579959fe..2e28f4ce3 100644 --- a/rta/network_connection_freesslcert.py +++ b/rta/network_connection_freesslcert.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/network_connection_iexplore_rundll32.py b/rta/network_connection_iexplore_rundll32.py index 597478f60..26695b169 100644 --- a/rta/network_connection_iexplore_rundll32.py +++ b/rta/network_connection_iexplore_rundll32.py @@ -22,7 +22,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rundll32 = "C:\\Users\\Public\\rundll32.exe" iexplore = "C:\\Users\\Public\\iexplore.exe" diff --git a/rta/network_connection_kerberos_port.py b/rta/network_connection_kerberos_port.py index 9eb7867a0..0a60d994c 100644 --- a/rta/network_connection_kerberos_port.py +++ b/rta/network_connection_kerberos_port.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/network_connection_nslookup.py b/rta/network_connection_nslookup.py index d4544c93a..86e190365 100644 --- a/rta/network_connection_nslookup.py +++ b/rta/network_connection_nslookup.py @@ -15,7 +15,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): nslookup = "C:\\Windows\\System32\\nslookup.exe" diff --git a/rta/network_connection_process_unusual_args.py b/rta/network_connection_process_unusual_args.py index e983340a7..1a10e7eb7 100644 --- a/rta/network_connection_process_unusual_args.py +++ b/rta/network_connection_process_unusual_args.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "regsvr32.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Making connection using fake regsvr32.exe") diff --git a/rta/network_connection_rdp_tunneling.py b/rta/network_connection_rdp_tunneling.py index fe6ae5da2..f2dc65a9b 100644 --- a/rta/network_connection_rdp_tunneling.py +++ b/rta/network_connection_rdp_tunneling.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/network_connection_unusual_rundll32.py b/rta/network_connection_unusual_rundll32.py index 2d9466c6f..5665298b8 100644 --- a/rta/network_connection_unusual_rundll32.py +++ b/rta/network_connection_unusual_rundll32.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "regsvr32.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "rundll32.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/networksetup_vpn.py b/rta/networksetup_vpn.py index 9582fe084..b183eb07c 100644 --- a/rta/networksetup_vpn.py +++ b/rta/networksetup_vpn.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/networksetup" diff --git a/rta/obfuscated_cmd_commands.py b/rta/obfuscated_cmd_commands.py index 76881d011..1eb63b827 100644 --- a/rta/obfuscated_cmd_commands.py +++ b/rta/obfuscated_cmd_commands.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # All encoded versions of the following: `start calc && ping -n 2 127.0.0.1>nul && taskkill /im calc.exe` commands = """ diff --git a/rta/obfuscated_powershell.py b/rta/obfuscated_powershell.py index 3a7df1ffc..c2b558353 100644 --- a/rta/obfuscated_powershell.py +++ b/rta/obfuscated_powershell.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # All encoded versions of the following: # `iex("Write-Host 'This is my test command' -ForegroundColor Green; start c:\windows\system32\calc")` diff --git a/rta/office_app_execution.py b/rta/office_app_execution.py index 79a97656b..afabe7be7 100644 --- a/rta/office_app_execution.py +++ b/rta/office_app_execution.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/Microsoft PowerPoint" diff --git a/rta/office_application_startup.py b/rta/office_application_startup.py index 0c8c4c01c..8eaca8621 100644 --- a/rta/office_application_startup.py +++ b/rta/office_application_startup.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(dll_location="c:\\windows\\temp\\evil.dll"): # Write evil dll to office test path: subkey = "Software\\Microsoft\\Office Test\\Special\\Perf" diff --git a/rta/office_child_process.py b/rta/office_child_process.py index 03a79cf78..e81e66e72 100644 --- a/rta/office_child_process.py +++ b/rta/office_child_process.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/openssl_decode_payload.py b/rta/openssl_decode_payload.py index 6a522427d..7c08c5b9f 100644 --- a/rta/openssl_decode_payload.py +++ b/rta/openssl_decode_payload.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/openssl" diff --git a/rta/openssl_file_drop.py b/rta/openssl_file_drop.py index 9a6a898dd..5a9631653 100644 --- a/rta/openssl_file_drop.py +++ b/rta/openssl_file_drop.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/testbin" diff --git a/rta/opera_child_process.py b/rta/opera_child_process.py index 2b9c654a0..43d7768ce 100644 --- a/rta/opera_child_process.py +++ b/rta/opera_child_process.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/osascript_hidden_login_item.py b/rta/osascript_hidden_login_item.py index 70c8088a6..aaad0ecd6 100644 --- a/rta/osascript_hidden_login_item.py +++ b/rta/osascript_hidden_login_item.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/osascript_net_conn.py b/rta/osascript_net_conn.py index 7b5cccd43..85277e0ff 100644 --- a/rta/osascript_net_conn.py +++ b/rta/osascript_net_conn.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/osascript" diff --git a/rta/osascript_sh_execution.py b/rta/osascript_sh_execution.py index 3cd6cddc7..661043a14 100644 --- a/rta/osascript_sh_execution.py +++ b/rta/osascript_sh_execution.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/osascript" diff --git a/rta/osascript_suspicious_cmdline.py b/rta/osascript_suspicious_cmdline.py index 8c6945bb6..cfa85ea0d 100644 --- a/rta/osascript_suspicious_cmdline.py +++ b/rta/osascript_suspicious_cmdline.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/osascript" diff --git a/rta/outlook_suspicious_child.py b/rta/outlook_suspicious_child.py index b3170ee3a..719ea6467 100644 --- a/rta/outlook_suspicious_child.py +++ b/rta/outlook_suspicious_child.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): outlook = "C:\\Users\\Public\\outlook.exe" svchost = "C:\\Users\\Public\\svchost.exe" diff --git a/rta/path_passed_to_system.py b/rta/path_passed_to_system.py index 5a540e290..b23957773 100644 --- a/rta/path_passed_to_system.py +++ b/rta/path_passed_to_system.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/payload_decode_bash_cmds.py b/rta/payload_decode_bash_cmds.py index e810b0049..73ada0793 100644 --- a/rta/payload_decode_bash_cmds.py +++ b/rta/payload_decode_bash_cmds.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/periodic_task_creation.py b/rta/periodic_task_creation.py index 1e21b8f72..eae2b4553 100644 --- a/rta/periodic_task_creation.py +++ b/rta/periodic_task_creation.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file modification on periodic file test.conf to mimic periodic tasks creation") diff --git a/rta/persistence_chrome_extension.py b/rta/persistence_chrome_extension.py index d26088e1c..98da3fc7c 100644 --- a/rta/persistence_chrome_extension.py +++ b/rta/persistence_chrome_extension.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing chrome commands to load suspicious ext.") diff --git a/rta/persistence_mail_plist.py b/rta/persistence_mail_plist.py index c4632c0b8..5a4a83fa1 100644 --- a/rta/persistence_mail_plist.py +++ b/rta/persistence_mail_plist.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing file modification on SyncedRules.plist file.") diff --git a/rta/persistence_plist_masquerade.py b/rta/persistence_plist_masquerade.py index 6ef917de4..4a029a321 100644 --- a/rta/persistence_plist_masquerade.py +++ b/rta/persistence_plist_masquerade.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/persistence_startup_item.py b/rta/persistence_startup_item.py index 1c50e2c72..b497a36de 100644 --- a/rta/persistence_startup_item.py +++ b/rta/persistence_startup_item.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing creation on temp StartupParameters.plist file.") diff --git a/rta/persistence_startup_unusual_process.py b/rta/persistence_startup_unusual_process.py index 325ed3e49..0cc1f5b9b 100644 --- a/rta/persistence_startup_unusual_process.py +++ b/rta/persistence_startup_unusual_process.py @@ -34,7 +34,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" tempowershell = "C:\\Windows\\notp0sh.exe" diff --git a/rta/persistent_scripts.py b/rta/persistent_scripts.py index da2e4a743..6e696c6f4 100644 --- a/rta/persistent_scripts.py +++ b/rta/persistent_scripts.py @@ -26,7 +26,7 @@ VBS = common.get_path("bin", "persistent_script.vbs") NAME = "rta-vbs-persistence" -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(common.PS_EXEC, VBS) def main(): common.log("Persistent Scripts") diff --git a/rta/ping_delayed_exec.py b/rta/ping_delayed_exec.py index 273dd81fa..635873e0e 100644 --- a/rta/ping_delayed_exec.py +++ b/rta/ping_delayed_exec.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/pkexec_shell.py b/rta/pkexec_shell.py index de2bde6a7..c50f300d9 100644 --- a/rta/pkexec_shell.py +++ b/rta/pkexec_shell.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing command to simulate privilege escalation via PKEXEC exploitation") # The exploit reproduction is available for commercial usage via MIT License diff --git a/rta/pkg_install_chmod.py b/rta/pkg_install_chmod.py index 1bc9870cf..45be4e6b7 100644 --- a/rta/pkg_install_chmod.py +++ b/rta/pkg_install_chmod.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dest_file = "/tmp/test.py" diff --git a/rta/plist_creation.py b/rta/plist_creation.py index 8d57c16e5..3e7dd59ce 100644 --- a/rta/plist_creation.py +++ b/rta/plist_creation.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): launch_agents_dir = Path.home() / "Library" / "Launchagents" plistbuddy_bin = "/usr/libexec/PlistBuddy" diff --git a/rta/plistbuddy_file_modification.py b/rta/plistbuddy_file_modification.py index 1e09e76d6..c03a87dbc 100644 --- a/rta/plistbuddy_file_modification.py +++ b/rta/plistbuddy_file_modification.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/plistbuddy" diff --git a/rta/port_monitor.py b/rta/port_monitor.py index 16bdebbb3..e51147a74 100644 --- a/rta/port_monitor.py +++ b/rta/port_monitor.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Writing registry key and dummy dll") diff --git a/rta/powershell_args.py b/rta/powershell_args.py index b10c86fd2..deadc64ab 100644 --- a/rta/powershell_args.py +++ b/rta/powershell_args.py @@ -26,7 +26,7 @@ def encode(command): return base64.b64encode(command.encode("utf-16le")) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("PowerShell Suspicious Commands") temp_script = Path("tmp.ps1").resolve() diff --git a/rta/powershell_base64_gzip.py b/rta/powershell_base64_gzip.py index 380d4b8d1..b5efea1e2 100644 --- a/rta/powershell_base64_gzip.py +++ b/rta/powershell_base64_gzip.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("PowerShell with base64/gzip") diff --git a/rta/powershell_delete_shadow_copy.py b/rta/powershell_delete_shadow_copy.py index 6142d212c..4d2370273 100644 --- a/rta/powershell_delete_shadow_copy.py +++ b/rta/powershell_delete_shadow_copy.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/powershell_from_script.py b/rta/powershell_from_script.py index b5410c938..709a583ba 100644 --- a/rta/powershell_from_script.py +++ b/rta/powershell_from_script.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Write script script_file = Path("launchpowershell.vbs").resolve() diff --git a/rta/powershell_unsigned_defender_exclusion.py b/rta/powershell_unsigned_defender_exclusion.py index 53ba8527a..22d4dc078 100644 --- a/rta/powershell_unsigned_defender_exclusion.py +++ b/rta/powershell_unsigned_defender_exclusion.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/powershell_vault_access.py b/rta/powershell_vault_access.py index 937992cad..392818241 100644 --- a/rta/powershell_vault_access.py +++ b/rta/powershell_vault_access.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/privilege_escalation_remote_thread.py b/rta/privilege_escalation_remote_thread.py index c24592ea0..2753b4505 100644 --- a/rta/privilege_escalation_remote_thread.py +++ b/rta/privilege_escalation_remote_thread.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): if platform.processor() == "arm": diff --git a/rta/privilege_escalation_tcc_bypass.py b/rta/privilege_escalation_tcc_bypass.py index 323dea346..38818d41f 100644 --- a/rta/privilege_escalation_tcc_bypass.py +++ b/rta/privilege_escalation_tcc_bypass.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing deletion on /tmp/TCC.db file.") diff --git a/rta/process_double_extension.py b/rta/process_double_extension.py index 6f67aefea..c4acc2cee 100644 --- a/rta/process_double_extension.py +++ b/rta/process_double_extension.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( MY_APP = common.get_path("bin", "myapp_x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_APP) def main(): anomalies = ["test.txt.exe"] diff --git a/rta/process_extension_anomalies.py b/rta/process_extension_anomalies.py index 7864464a7..6bd209f19 100644 --- a/rta/process_extension_anomalies.py +++ b/rta/process_extension_anomalies.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( MY_APP = common.get_path("bin", "myapp.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_APP) def main(): anomalies = [ diff --git a/rta/process_name_masquerade.py b/rta/process_name_masquerade.py index f608b491a..9c2ca9bee 100644 --- a/rta/process_name_masquerade.py +++ b/rta/process_name_masquerade.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( CMD_PATH = "c:\\windows\\system32\\cmd.exe" -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerades = ["svchost.exe", "lsass.exe"] diff --git a/rta/ransomnote_delete_shadows.py b/rta/ransomnote_delete_shadows.py index 709eb6368..da75a47f8 100644 --- a/rta/ransomnote_delete_shadows.py +++ b/rta/ransomnote_delete_shadows.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): vssadmin = "C:\\Windows\\System32\\vssadmin.exe" powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/recycle_bin_process.py b/rta/recycle_bin_process.py index 06f5e3e9e..3097f482d 100644 --- a/rta/recycle_bin_process.py +++ b/rta/recycle_bin_process.py @@ -31,7 +31,7 @@ RECYCLE_PATHS = ["C:\\$Recycle.Bin", "C:\\Recycler"] TARGET_APP = common.get_path("bin", "myapp.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(TARGET_APP, common.CMD_PATH) def main(): common.log("Execute files from the Recycle Bin") diff --git a/rta/reg_creation_servicedll.py b/rta/reg_creation_servicedll.py index d0f0b41e7..f51b6ed9e 100644 --- a/rta/reg_creation_servicedll.py +++ b/rta/reg_creation_servicedll.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temporarily creating a Service DLL reg key...") diff --git a/rta/reg_mod_amsienable.py b/rta/reg_mod_amsienable.py index 74a77b3c1..05a21e133 100644 --- a/rta/reg_mod_amsienable.py +++ b/rta/reg_mod_amsienable.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software\\Microsoft\\Windows Script\\Settings" value = "AmsiEnable" diff --git a/rta/reg_mod_appcertdlls.py b/rta/reg_mod_appcertdlls.py index 9ca7cf12a..758ab5316 100644 --- a/rta/reg_mod_appcertdlls.py +++ b/rta/reg_mod_appcertdlls.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCertDLLs" value = "RTA" diff --git a/rta/reg_mod_appinitdlls.py b/rta/reg_mod_appinitdlls.py index 6a81ddc51..ef8208fc8 100644 --- a/rta/reg_mod_appinitdlls.py +++ b/rta/reg_mod_appinitdlls.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows" value = "AppInit_Dlls" diff --git a/rta/reg_mod_autodialdll.py b/rta/reg_mod_autodialdll.py index 9e8e8b3c2..19d2a8f6b 100644 --- a/rta/reg_mod_autodialdll.py +++ b/rta/reg_mod_autodialdll.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters" value = "AutodialDLL" diff --git a/rta/reg_mod_base64_executable.py b/rta/reg_mod_base64_executable.py index 3b3bd2abc..43bcafd15 100644 --- a/rta/reg_mod_base64_executable.py +++ b/rta/reg_mod_base64_executable.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Policies\\Test" value = "Base64" diff --git a/rta/reg_mod_builtindnsclientenabled.py b/rta/reg_mod_builtindnsclientenabled.py index ffc3bb434..701769a6e 100644 --- a/rta/reg_mod_builtindnsclientenabled.py +++ b/rta/reg_mod_builtindnsclientenabled.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Policies\\Microsoft\\Edge" value = "BuiltInDnsClientEnabled" diff --git a/rta/reg_mod_disable_uac.py b/rta/reg_mod_disable_uac.py index aa2753ea3..5b764d60c 100644 --- a/rta/reg_mod_disable_uac.py +++ b/rta/reg_mod_disable_uac.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" value = "EnableLUA" diff --git a/rta/reg_mod_disableantispyware.py b/rta/reg_mod_disableantispyware.py index f5461c92d..139bbd785 100644 --- a/rta/reg_mod_disableantispyware.py +++ b/rta/reg_mod_disableantispyware.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Policies\\Microsoft\\Windows Defender" value = "DisableAntiSpyware" diff --git a/rta/reg_mod_driver_blocklist.py b/rta/reg_mod_driver_blocklist.py index de04b2223..f48b4ebe9 100644 --- a/rta/reg_mod_driver_blocklist.py +++ b/rta/reg_mod_driver_blocklist.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\CurrentControlSet\\Control\\CI\\Config" value = "VulnerableDriverBlocklistEnable" diff --git a/rta/reg_mod_enableat.py b/rta/reg_mod_enableat.py index 1347a4ae7..da6cfff3c 100644 --- a/rta/reg_mod_enableat.py +++ b/rta/reg_mod_enableat.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration" value = "EnableAt" diff --git a/rta/reg_mod_enablescriptblocklogging.py b/rta/reg_mod_enablescriptblocklogging.py index 84e72c6b6..5ec7161db 100644 --- a/rta/reg_mod_enablescriptblocklogging.py +++ b/rta/reg_mod_enablescriptblocklogging.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" value = "EnableScriptBlockLogging" diff --git a/rta/reg_mod_ifeo.py b/rta/reg_mod_ifeo.py index 0c727830a..7c4b6f154 100644 --- a/rta/reg_mod_ifeo.py +++ b/rta/reg_mod_ifeo.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temp Registry mod: IFEO") diff --git a/rta/reg_mod_lsa_ssp.py b/rta/reg_mod_lsa_ssp.py index 69f683033..ba34c6ab1 100644 --- a/rta/reg_mod_lsa_ssp.py +++ b/rta/reg_mod_lsa_ssp.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\ControlSet001\\Control\\Lsa\\Security Packages" key2 = "SYSTEM\\ControlSet001\\Control\\Lsa" diff --git a/rta/reg_mod_netwire.py b/rta/reg_mod_netwire.py index ba99703b3..9ea64ee6b 100644 --- a/rta/reg_mod_netwire.py +++ b/rta/reg_mod_netwire.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temporarily creating a Netwire RAT-like reg key...") diff --git a/rta/reg_mod_networkprovider.py b/rta/reg_mod_networkprovider.py index 3ea63f348..be2d0c924 100644 --- a/rta/reg_mod_networkprovider.py +++ b/rta/reg_mod_networkprovider.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "System\\CurrentControlSet\\Services\\Test\\NetworkProvider" value = "ProviderPath" diff --git a/rta/reg_mod_nullsessionpipes.py b/rta/reg_mod_nullsessionpipes.py index d49ad47ff..6a39cd31d 100644 --- a/rta/reg_mod_nullsessionpipes.py +++ b/rta/reg_mod_nullsessionpipes.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Modifying NullSessionPipes reg key...") diff --git a/rta/reg_mod_plugx.py b/rta/reg_mod_plugx.py index 4ff4f27f7..20a72fea8 100644 --- a/rta/reg_mod_plugx.py +++ b/rta/reg_mod_plugx.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temporarily creating a PlugX-like reg key...") diff --git a/rta/reg_mod_point_and_print_dll.py b/rta/reg_mod_point_and_print_dll.py index 3e31630af..214590001 100644 --- a/rta/reg_mod_point_and_print_dll.py +++ b/rta/reg_mod_point_and_print_dll.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\RTA" diff --git a/rta/reg_mod_port_forwarding.py b/rta/reg_mod_port_forwarding.py index 7cfb6efd3..b1fb79d92 100644 --- a/rta/reg_mod_port_forwarding.py +++ b/rta/reg_mod_port_forwarding.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "System\\CurrentControlSet\\Services\\PortProxy\\v4tov4" value = "a" diff --git a/rta/reg_mod_print_processors.py b/rta/reg_mod_print_processors.py index b8191f1b0..e8f049bca 100644 --- a/rta/reg_mod_print_processors.py +++ b/rta/reg_mod_print_processors.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\ControlSet001\\Control\\Print\\Monitors" value = "RTA" diff --git a/rta/reg_mod_remcos.py b/rta/reg_mod_remcos.py index 686d0cfde..1469310ab 100644 --- a/rta/reg_mod_remcos.py +++ b/rta/reg_mod_remcos.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temporarily creating a Remcos RAT alike reg key...") diff --git a/rta/reg_mod_run_key_unusual_proc.py b/rta/reg_mod_run_key_unusual_proc.py index 5ab1736eb..3f4697c50 100644 --- a/rta/reg_mod_run_key_unusual_proc.py +++ b/rta/reg_mod_run_key_unusual_proc.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Windows\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/reg_mod_shadow_rdp.py b/rta/reg_mod_shadow_rdp.py index ecbb4baba..b6d678c1e 100644 --- a/rta/reg_mod_shadow_rdp.py +++ b/rta/reg_mod_shadow_rdp.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Modifying RDP Shadow reg key...") diff --git a/rta/reg_mod_shim_sb.py b/rta/reg_mod_shim_sb.py index 1f117f9d6..f3025cf40 100644 --- a/rta/reg_mod_shim_sb.py +++ b/rta/reg_mod_shim_sb.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom" value = "a.sdb" diff --git a/rta/reg_mod_startup_shell_folder.py b/rta/reg_mod_startup_shell_folder.py index 8f6b8abe5..0ef202897 100644 --- a/rta/reg_mod_startup_shell_folder.py +++ b/rta/reg_mod_startup_shell_folder.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" value = "Common Startup" diff --git a/rta/reg_mod_suspicious_service.py b/rta/reg_mod_suspicious_service.py index be4ba9de1..298c88662 100644 --- a/rta/reg_mod_suspicious_service.py +++ b/rta/reg_mod_suspicious_service.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\ControlSet001\\Services\\RTA" value = "ImagePath" diff --git a/rta/reg_mod_systemcertificates.py b/rta/reg_mod_systemcertificates.py index e348fabcd..03ebd4679 100644 --- a/rta/reg_mod_systemcertificates.py +++ b/rta/reg_mod_systemcertificates.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software\\Microsoft\\SystemCertificates\\Root\\Certificates\\Test" value = "Blob" diff --git a/rta/reg_mod_time_provider.py b/rta/reg_mod_time_provider.py index cfb11c0ea..29fddebdb 100644 --- a/rta/reg_mod_time_provider.py +++ b/rta/reg_mod_time_provider.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\ControlSet001\\Services\\W32Time\\TimeProviders" value = "Test" diff --git a/rta/reg_mod_unusual_startup_folder.py b/rta/reg_mod_unusual_startup_folder.py index 26accbb46..daef9d721 100644 --- a/rta/reg_mod_unusual_startup_folder.py +++ b/rta/reg_mod_unusual_startup_folder.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temp Registry mod: Common Startup Folder") diff --git a/rta/reg_mod_windir.py b/rta/reg_mod_windir.py index b5cb533a9..c5eceee68 100644 --- a/rta/reg_mod_windir.py +++ b/rta/reg_mod_windir.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "System\\Environment" value = "windir" diff --git a/rta/reg_run_key_asterisk.py b/rta/reg_run_key_asterisk.py index 4d3756836..c6a58b924 100644 --- a/rta/reg_run_key_asterisk.py +++ b/rta/reg_run_key_asterisk.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Writing registry key") diff --git a/rta/reg_vss_service_disable.py b/rta/reg_vss_service_disable.py index e87dd3c87..ee3f483c6 100644 --- a/rta/reg_vss_service_disable.py +++ b/rta/reg_vss_service_disable.py @@ -31,7 +31,7 @@ metadata = RtaMetadata( HIGHENTROPY = common.get_path("bin", "highentropy.txt") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SYSTEM\\CurrentControlSet\\Services\\VSS" value = "Start" diff --git a/rta/registry_hive_export.py b/rta/registry_hive_export.py index 8c56ca651..dfe074f96 100644 --- a/rta/registry_hive_export.py +++ b/rta/registry_hive_export.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( REG = "reg.exe" -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): for hive in ["sam", "security", "system"]: filename = Path("%s.reg" % hive).resolve() diff --git a/rta/registry_persistence_create.py b/rta/registry_persistence_create.py index c22a7fde6..7a545b423 100644 --- a/rta/registry_persistence_create.py +++ b/rta/registry_persistence_create.py @@ -38,7 +38,7 @@ def pause(): time.sleep(0.5) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(TARGET_APP) def main(): common.log("Suspicious Registry Persistence") diff --git a/rta/registry_rdp_enable.py b/rta/registry_rdp_enable.py index ec75a9260..66488ec7a 100644 --- a/rta/registry_rdp_enable.py +++ b/rta/registry_rdp_enable.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Enabling RDP Through Registry") diff --git a/rta/regsvr32_scrobj.py b/rta/regsvr32_scrobj.py index 9c00bdc6a..b9534e439 100644 --- a/rta/regsvr32_scrobj.py +++ b/rta/regsvr32_scrobj.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): regsvr32 = "C:\\Users\\Public\\regsvr32.exe" common.copy_file(EXE_FILE, regsvr32) diff --git a/rta/regsvr32_unusual_args.py b/rta/regsvr32_unusual_args.py index 369f55872..c622432c9 100644 --- a/rta/regsvr32_unusual_args.py +++ b/rta/regsvr32_unusual_args.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "regsvr32.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/renamed_autoit.py b/rta/renamed_autoit.py index 048861cdf..295df368a 100644 --- a/rta/renamed_autoit.py +++ b/rta/renamed_autoit.py @@ -19,7 +19,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): autoit = "C:\\Users\\Public\\rta.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/renamed_automaton_interpreter.py b/rta/renamed_automaton_interpreter.py index 8c2a4b9b9..2549779b0 100644 --- a/rta/renamed_automaton_interpreter.py +++ b/rta/renamed_automaton_interpreter.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): autohotkey = "C:\\Users\\Public\\notaut0hotkey.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/reverse_shell.py b/rta/reverse_shell.py index d02502663..6e6e06c61 100644 --- a/rta/reverse_shell.py +++ b/rta/reverse_shell.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing command to simulate reverse shell execution") diff --git a/rta/root_cert_install.py b/rta/root_cert_install.py index 659eb0d0c..02ff6a119 100644 --- a/rta/root_cert_install.py +++ b/rta/root_cert_install.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/security" diff --git a/rta/root_crontab_file_modification.py b/rta/root_crontab_file_modification.py index 39a086b4b..1bae7f7ea 100644 --- a/rta/root_crontab_file_modification.py +++ b/rta/root_crontab_file_modification.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing deletion on /private/var/at/tabs/root file.") diff --git a/rta/rubeus_alike_commandline.py b/rta/rubeus_alike_commandline.py index 375dfba61..77de4b327 100644 --- a/rta/rubeus_alike_commandline.py +++ b/rta/rubeus_alike_commandline.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/rundll32_inf_callback.py b/rta/rundll32_inf_callback.py index 1bc608dff..013485d7b 100644 --- a/rta/rundll32_inf_callback.py +++ b/rta/rundll32_inf_callback.py @@ -28,7 +28,7 @@ metadata = RtaMetadata( INF_FILE = common.get_path("bin", "script_launch.inf") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(INF_FILE) def main(): # http server will terminate on main thread exit diff --git a/rta/rundll32_javascript_callback.py b/rta/rundll32_javascript_callback.py index d2bb42aec..7a97a0ed1 100644 --- a/rta/rundll32_javascript_callback.py +++ b/rta/rundll32_javascript_callback.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("RunDLL32 with Javascript Callback") server, ip, port = common.serve_web() diff --git a/rta/rundll32_unusual_args.py b/rta/rundll32_unusual_args.py index 86d11f178..e393695a9 100644 --- a/rta/rundll32_unusual_args.py +++ b/rta/rundll32_unusual_args.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): source_dll = "C:\\Windows\\System32\\IEAdvpack.dll" dll = "C:\\Users\\Public\\IEAdvpack.dll" diff --git a/rta/rundll32_unusual_dll_extension.py b/rta/rundll32_unusual_dll_extension.py index 14af87ca2..c6ecc30a8 100644 --- a/rta/rundll32_unusual_dll_extension.py +++ b/rta/rundll32_unusual_dll_extension.py @@ -26,7 +26,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): rundll32 = "C:\\Users\\Public\\rundll32.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/schtask_escalation.py b/rta/schtask_escalation.py index 91527f518..69dc9bdd5 100644 --- a/rta/schtask_escalation.py +++ b/rta/schtask_escalation.py @@ -33,7 +33,7 @@ def schtasks(*args, **kwargs): return common.execute(["schtasks.exe"] + list(args), **kwargs) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Scheduled Task Privilege Escalation") diff --git a/rta/schtasks_xml_masqueraded.py b/rta/schtasks_xml_masqueraded.py index 644daccb7..2d278e2bc 100644 --- a/rta/schtasks_xml_masqueraded.py +++ b/rta/schtasks_xml_masqueraded.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute Command common.log("Executing command to simulate the task creation (This will not create a task)") diff --git a/rta/scp_privacy_bypass.py b/rta/scp_privacy_bypass.py index ee0b387bd..0d020c7cf 100644 --- a/rta/scp_privacy_bypass.py +++ b/rta/scp_privacy_bypass.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/scp" diff --git a/rta/screensaver_child_process.py b/rta/screensaver_child_process.py index cea3e9c39..a3fbb91e4 100644 --- a/rta/screensaver_child_process.py +++ b/rta/screensaver_child_process.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/ScreenSaverEngine" diff --git a/rta/screensaver_plist_mod.py b/rta/screensaver_plist_mod.py index e382f0480..132df6e5a 100644 --- a/rta/screensaver_plist_mod.py +++ b/rta/screensaver_plist_mod.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/killall" diff --git a/rta/scrobj_com_hijack.py b/rta/scrobj_com_hijack.py index e1cd13a1d..8bf11f9b6 100644 --- a/rta/scrobj_com_hijack.py +++ b/rta/scrobj_com_hijack.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Classes\\CLSID\\{00000000-0000-0000-0000-0000DEADBEEF}" subkey = "InprocServer32" diff --git a/rta/secure_file_deletion.py b/rta/secure_file_deletion.py index 0d496dac2..79bd6772b 100644 --- a/rta/secure_file_deletion.py +++ b/rta/secure_file_deletion.py @@ -19,7 +19,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): temp_path = Path(tempfile.gettempdir()) / os.urandom(16).encode("hex") sdelete_path = common.get_path("bin", "sdelete.exe") diff --git a/rta/security_authtrampoline.py b/rta/security_authtrampoline.py index 765a65677..7ffb57d67 100644 --- a/rta/security_authtrampoline.py +++ b/rta/security_authtrampoline.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/sensitive_file_access.py b/rta/sensitive_file_access.py index b55f34e2e..977d15878 100644 --- a/rta/sensitive_file_access.py +++ b/rta/sensitive_file_access.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( techniques=["T1555.004", "T1552.001", "T1003.003"], ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): diff --git a/rta/settingcontentms_files.py b/rta/settingcontentms_files.py index 6321154a2..da6beda8f 100644 --- a/rta/settingcontentms_files.py +++ b/rta/settingcontentms_files.py @@ -30,7 +30,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Write to AppData\Local\ common.execute(["cmd", "/c", "echo", "test", ">", "%APPDATA%\\test.SettingContent-ms"]) diff --git a/rta/sevenzip_encrypted.py b/rta/sevenzip_encrypted.py index 22df1fdfc..bb96230eb 100644 --- a/rta/sevenzip_encrypted.py +++ b/rta/sevenzip_encrypted.py @@ -33,7 +33,7 @@ def create_exfil(path=Path("secret_stuff.txt").resolve()): return path -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(SEVENZIP) def main(password="s0l33t"): # create 7z.exe with not-7zip name, and exfil diff --git a/rta/shellcode_load_ws2_32_unbacked.py b/rta/shellcode_load_ws2_32_unbacked.py index 3782982a3..f2132b9a9 100644 --- a/rta/shellcode_load_ws2_32_unbacked.py +++ b/rta/shellcode_load_ws2_32_unbacked.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Inject shellcode into WerFault.exe to trigger diff --git a/rta/shellcode_winexec_calc.py b/rta/shellcode_winexec_calc.py index db1376370..6b8bce868 100644 --- a/rta/shellcode_winexec_calc.py +++ b/rta/shellcode_winexec_calc.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( techniques=["T1134", "T1055"], ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): diff --git a/rta/shlayer_payload.py b/rta/shlayer_payload.py index 909e69a11..a540c870a 100644 --- a/rta/shlayer_payload.py +++ b/rta/shlayer_payload.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/curl" diff --git a/rta/shortcut_file_suspicious_process.py b/rta/shortcut_file_suspicious_process.py index 9915efc16..3856258fa 100644 --- a/rta/shortcut_file_suspicious_process.py +++ b/rta/shortcut_file_suspicious_process.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Writing dummy shortcut file") shortcut_path = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\evil.lnk" diff --git a/rta/shove_sip_bypass.py b/rta/shove_sip_bypass.py index 947e6f47b..fa42eb1dd 100644 --- a/rta/shove_sip_bypass.py +++ b/rta/shove_sip_bypass.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/sh" diff --git a/rta/signed_proxy_file_written_exec.py b/rta/signed_proxy_file_written_exec.py index 8bfe0e8b4..afd2d9396 100644 --- a/rta/signed_proxy_file_written_exec.py +++ b/rta/signed_proxy_file_written_exec.py @@ -33,7 +33,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() url = f"http://{ip}:{port}/bin/renamed_posh.exe" diff --git a/rta/silentprocessexit_lsass.py b/rta/silentprocessexit_lsass.py index 4e78e438d..8f149c508 100644 --- a/rta/silentprocessexit_lsass.py +++ b/rta/silentprocessexit_lsass.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Temporarily creating LSA SilentProcessExit reg key...") diff --git a/rta/sip_provider.py b/rta/sip_provider.py index 82d9d570b..6d65ce0bc 100644 --- a/rta/sip_provider.py +++ b/rta/sip_provider.py @@ -55,7 +55,7 @@ else: TARGET_APP = common.get_path("bin", "myapp.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(SIGCHECK, TRUST_PROVIDER_DLL, TARGET_APP) def main(): common.log("Registering SIP provider") diff --git a/rta/smb_connection.py b/rta/smb_connection.py index b37de0726..4931b04c4 100644 --- a/rta/smb_connection.py +++ b/rta/smb_connection.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( SMB_PORT = 445 -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(ip=None): ip = ip or common.get_ip() diff --git a/rta/solarmaker_backdoor.py b/rta/solarmaker_backdoor.py index d6bb86041..4de1427b8 100644 --- a/rta/solarmaker_backdoor.py +++ b/rta/solarmaker_backdoor.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): reg = "C:\\Windows\\System32\\reg.exe" diff --git a/rta/spctl_gatekeeper_bypass.py b/rta/spctl_gatekeeper_bypass.py index 6b2644c46..eba2ac78b 100644 --- a/rta/spctl_gatekeeper_bypass.py +++ b/rta/spctl_gatekeeper_bypass.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/spctl" diff --git a/rta/special_chars_zip_file.py b/rta/special_chars_zip_file.py index c9492fdcc..718de02fa 100644 --- a/rta/special_chars_zip_file.py +++ b/rta/special_chars_zip_file.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Creating suspicious zip file with special characters to mimic evasion of sanboxed office apps.") diff --git a/rta/sqlite_db_evasion.py b/rta/sqlite_db_evasion.py index edbe2db9f..5fb8f12e3 100644 --- a/rta/sqlite_db_evasion.py +++ b/rta/sqlite_db_evasion.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/sqlite3" diff --git a/rta/ssh_bruteforce.py b/rta/ssh_bruteforce.py index d9b23d16f..b5f717196 100644 --- a/rta/ssh_bruteforce.py +++ b/rta/ssh_bruteforce.py @@ -21,7 +21,7 @@ def test(masquerade, masquerade2): common.execute([masquerade2, "childprocess", masquerade], timeout=0.3, kill=True) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/sshd-keygen-wrapper" diff --git a/rta/sticky_keys_write_execute.py b/rta/sticky_keys_write_execute.py index c775c76e7..af2643c3c 100644 --- a/rta/sticky_keys_write_execute.py +++ b/rta/sticky_keys_write_execute.py @@ -34,7 +34,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Prep bins = [ diff --git a/rta/sudo_exploit.py b/rta/sudo_exploit.py index 3dcd7349e..134e5a96c 100644 --- a/rta/sudo_exploit.py +++ b/rta/sudo_exploit.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log( "Executing command to simulate attempted use of a heap-based buffer overflow vulnerability for the " diff --git a/rta/susp_scheduled_task_creation.py b/rta/susp_scheduled_task_creation.py index 9f7159b0f..4e1bb16d5 100644 --- a/rta/susp_scheduled_task_creation.py +++ b/rta/susp_scheduled_task_creation.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): regsvr32 = "C:\\Users\\Public\\regsvr32.exe" common.copy_file(EXE_FILE, regsvr32) diff --git a/rta/susp_script_file_name.py b/rta/susp_script_file_name.py index 1f3322797..31ef516b5 100644 --- a/rta/susp_script_file_name.py +++ b/rta/susp_script_file_name.py @@ -27,7 +27,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): mshta = "C:\\Users\\Public\\mshta.exe" rcedit = "C:\\Users\\Public\\rcedit.exe" diff --git a/rta/suspicious_bits_job_notify.py b/rta/suspicious_bits_job_notify.py index 878cc589f..43595c69d 100644 --- a/rta/suspicious_bits_job_notify.py +++ b/rta/suspicious_bits_job_notify.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): svchost = "C:\\Users\\Public\\svchost.exe" child = "C:\\Users\\Public\\child.exe" diff --git a/rta/suspicious_child_acrobat.py b/rta/suspicious_child_acrobat.py index 092ea967c..16712d38f 100644 --- a/rta/suspicious_child_acrobat.py +++ b/rta/suspicious_child_acrobat.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): acrobat = "C:\\Users\\Public\\Acrobat.exe" arp = "C:\\Windows\\System32\\arp.exe" diff --git a/rta/suspicious_child_childless_process.py b/rta/suspicious_child_childless_process.py index 6ddd29237..91186789e 100644 --- a/rta/suspicious_child_childless_process.py +++ b/rta/suspicious_child_childless_process.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): svchost = "C:\\Users\\Public\\svchost.exe" rta = "C:\\Users\\Public\\rta.exe" diff --git a/rta/suspicious_child_compattelrunner.py b/rta/suspicious_child_compattelrunner.py index d8b71333b..46905a55a 100644 --- a/rta/suspicious_child_compattelrunner.py +++ b/rta/suspicious_child_compattelrunner.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): compattelrunner = "C:\\Users\\Public\\compattelrunner.exe" child = "C:\\Users\\Public\\child.exe" diff --git a/rta/suspicious_child_dns.py b/rta/suspicious_child_dns.py index 952b65138..bc684c327 100644 --- a/rta/suspicious_child_dns.py +++ b/rta/suspicious_child_dns.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dns = "C:\\Users\\Public\\dns.exe" common.copy_file(EXE_FILE, dns) diff --git a/rta/suspicious_child_exchange_um.py b/rta/suspicious_child_exchange_um.py index fa9666ac5..d8cbf2c7f 100644 --- a/rta/suspicious_child_exchange_um.py +++ b/rta/suspicious_child_exchange_um.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): umservice = "C:\\Users\\Public\\umservice.exe" common.copy_file(EXE_FILE, umservice) diff --git a/rta/suspicious_child_explorer.py b/rta/suspicious_child_explorer.py index 12c1af6de..73f37bbb1 100644 --- a/rta/suspicious_child_explorer.py +++ b/rta/suspicious_child_explorer.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): explorer = "C:\\Users\\Public\\explorer.exe" common.copy_file(EXE_FILE, explorer) diff --git a/rta/suspicious_child_services.py b/rta/suspicious_child_services.py index 7c65c7579..d01404593 100644 --- a/rta/suspicious_child_services.py +++ b/rta/suspicious_child_services.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): services = "C:\\Users\\Public\\services.exe" pwsh = "C:\\Users\\Public\\pwsh.exe" diff --git a/rta/suspicious_child_solarwinds_businesslayerhost.py b/rta/suspicious_child_solarwinds_businesslayerhost.py index 2dbfda204..71fabbb8b 100644 --- a/rta/suspicious_child_solarwinds_businesslayerhost.py +++ b/rta/suspicious_child_solarwinds_businesslayerhost.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): buzz = "C:\\Users\\Public\\SolarWinds.BusinessLayerHost.exe" powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/suspicious_child_solarwindsdiagnostics.py b/rta/suspicious_child_solarwindsdiagnostics.py index dc1f0a74a..f0a0d347c 100644 --- a/rta/suspicious_child_solarwindsdiagnostics.py +++ b/rta/suspicious_child_solarwindsdiagnostics.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): solarwindsdiagnostics = "C:\\Users\\Public\\solarwindsdiagnostics.exe" powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/suspicious_child_svchost_sch.py b/rta/suspicious_child_svchost_sch.py index dc00f1041..3ca3958a5 100644 --- a/rta/suspicious_child_svchost_sch.py +++ b/rta/suspicious_child_svchost_sch.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): svchost = "C:\\Users\\Public\\svchost.exe" powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/suspicious_child_wmiprvse.py b/rta/suspicious_child_wmiprvse.py index 8002b59b1..bf48690eb 100644 --- a/rta/suspicious_child_wmiprvse.py +++ b/rta/suspicious_child_wmiprvse.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wmiprvse = "C:\\Users\\Public\\wmiprvse.exe" arp = "C:\\Windows\\System32\\arp.exe" diff --git a/rta/suspicious_child_zoom.py b/rta/suspicious_child_zoom.py index c3768ef4e..9e8f15d43 100644 --- a/rta/suspicious_child_zoom.py +++ b/rta/suspicious_child_zoom.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): zoom = "C:\\Users\\Public\\zoom.exe" pwsh = "C:\\Users\\Public\\pwsh.exe" diff --git a/rta/suspicious_dll_registration_regsvr32.py b/rta/suspicious_dll_registration_regsvr32.py index 0370a0516..98f986284 100644 --- a/rta/suspicious_dll_registration_regsvr32.py +++ b/rta/suspicious_dll_registration_regsvr32.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Suspicious DLL Registration by Regsvr32") diff --git a/rta/suspicious_lineage_script.py b/rta/suspicious_lineage_script.py index 951b77389..f498fe95d 100644 --- a/rta/suspicious_lineage_script.py +++ b/rta/suspicious_lineage_script.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cscript = "C:\\Users\\Public\\cscript.exe" explorer = "C:\\Users\\Public\\explorer.exe" diff --git a/rta/suspicious_msiexec_child.py b/rta/suspicious_msiexec_child.py index 88ebc5979..c63a13642 100644 --- a/rta/suspicious_msiexec_child.py +++ b/rta/suspicious_msiexec_child.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): msiexec = "C:\\Users\\Public\\msiexec.exe" regsvr32 = "C:\\Users\\Public\\regsvr32.exe" diff --git a/rta/suspicious_office_child.py b/rta/suspicious_office_child.py index 7d3053828..cc0537b07 100644 --- a/rta/suspicious_office_child.py +++ b/rta/suspicious_office_child.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): binary = "winword.exe" common.copy_file(EXE_FILE, binary) diff --git a/rta/suspicious_office_children.py b/rta/suspicious_office_children.py index f3fcb0627..0099d5eac 100644 --- a/rta/suspicious_office_children.py +++ b/rta/suspicious_office_children.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): cmd_path = "c:\\windows\\system32\\cmd.exe" diff --git a/rta/suspicious_office_descendant_fp.py b/rta/suspicious_office_descendant_fp.py index 27610a9a8..51ba3b763 100644 --- a/rta/suspicious_office_descendant_fp.py +++ b/rta/suspicious_office_descendant_fp.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("MS Office unusual child process emulation") suspicious_apps = [ diff --git a/rta/suspicious_parent_cmd.py b/rta/suspicious_parent_cmd.py index e67bf7450..7bb16f08d 100644 --- a/rta/suspicious_parent_cmd.py +++ b/rta/suspicious_parent_cmd.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): logonui = "C:\\Users\\Public\\logonui.exe" cmd = "C:\\Windows\\System32\\cmd.exe" diff --git a/rta/suspicious_parent_csc.py b/rta/suspicious_parent_csc.py index d9ce4a253..959cf0495 100644 --- a/rta/suspicious_parent_csc.py +++ b/rta/suspicious_parent_csc.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wscript = "C:\\Users\\Public\\wscript.exe" csc = "C:\\Users\\Public\\csc.exe" diff --git a/rta/suspicious_parent_msbuild_explorer.py b/rta/suspicious_parent_msbuild_explorer.py index cd1216794..8f1cb2e6f 100644 --- a/rta/suspicious_parent_msbuild_explorer.py +++ b/rta/suspicious_parent_msbuild_explorer.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): explorer = "C:\\Users\\Public\\explorer.exe" msbuild = "C:\\Users\\Public\\msbuild.exe" diff --git a/rta/suspicious_parent_msbuild_office.py b/rta/suspicious_parent_msbuild_office.py index 56f0c3587..aa45b68ec 100644 --- a/rta/suspicious_parent_msbuild_office.py +++ b/rta/suspicious_parent_msbuild_office.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): excel = "C:\\Users\\Public\\excel.exe" msbuild = "C:\\Users\\Public\\msbuild.exe" diff --git a/rta/suspicious_parent_msbuild_script.py b/rta/suspicious_parent_msbuild_script.py index 0475f779a..b3016dbb2 100644 --- a/rta/suspicious_parent_msbuild_script.py +++ b/rta/suspicious_parent_msbuild_script.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Users\\Public\\powershell.exe" msbuild = "C:\\Users\\Public\\msbuild.exe" diff --git a/rta/suspicious_parent_sc.py b/rta/suspicious_parent_sc.py index b082c913d..90b141818 100644 --- a/rta/suspicious_parent_sc.py +++ b/rta/suspicious_parent_sc.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" sc = "C:\\Users\\Public\\sc.exe" diff --git a/rta/suspicious_parent_smss.py b/rta/suspicious_parent_smss.py index 1246e78c1..1f0691cd7 100644 --- a/rta/suspicious_parent_smss.py +++ b/rta/suspicious_parent_smss.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): smss = "C:\\Users\\Public\\smss.exe" conhost = "C:\\Users\\Public\\conhost.exe" diff --git a/rta/suspicious_powershell_download.py b/rta/suspicious_powershell_download.py index 83141c18e..c45d2ff41 100644 --- a/rta/suspicious_powershell_download.py +++ b/rta/suspicious_powershell_download.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() url = "http://{}:{}/bad.ps1".format(ip, port) diff --git a/rta/suspicious_wmic_script.py b/rta/suspicious_wmic_script.py index c8c3c6298..df1add08c 100644 --- a/rta/suspicious_wmic_script.py +++ b/rta/suspicious_wmic_script.py @@ -37,7 +37,7 @@ version="1.0"> """ -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Executing suspicious WMIC script") diff --git a/rta/suspicious_wscript_parent.py b/rta/suspicious_wscript_parent.py index a890fcf59..9b8da04d9 100644 --- a/rta/suspicious_wscript_parent.py +++ b/rta/suspicious_wscript_parent.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): script_data = """ WScript.CreateObject("wscript.shell") diff --git a/rta/system_restore_process.py b/rta/system_restore_process.py index 3580421e1..88ccf3238 100644 --- a/rta/system_restore_process.py +++ b/rta/system_restore_process.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( SYSTEM_RESTORE = "c:\\System Volume Information" -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(common.PS_EXEC) def main(): status = common.run_system() diff --git a/rta/systemkey_credential_access.py b/rta/systemkey_credential_access.py index 3e611916f..130f335e1 100644 --- a/rta/systemkey_credential_access.py +++ b/rta/systemkey_credential_access.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/bash" diff --git a/rta/systemsetup_ssh_enable.py b/rta/systemsetup_ssh_enable.py index d973737f2..1b83056c2 100644 --- a/rta/systemsetup_ssh_enable.py +++ b/rta/systemsetup_ssh_enable.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/systemsetup" diff --git a/rta/tar_dylib.py b/rta/tar_dylib.py index afd862d20..3736cdedb 100644 --- a/rta/tar_dylib.py +++ b/rta/tar_dylib.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # Execute command" diff --git a/rta/tcc_bypass_mounted_apfs.py b/rta/tcc_bypass_mounted_apfs.py index 3e7104c86..6ecdf1300 100644 --- a/rta/tcc_bypass_mounted_apfs.py +++ b/rta/tcc_bypass_mounted_apfs.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/mount_apfs" diff --git a/rta/tcc_modification.py b/rta/tcc_modification.py index 733d4c316..92d35482f 100644 --- a/rta/tcc_modification.py +++ b/rta/tcc_modification.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/sqlite" diff --git a/rta/trust_provider.py b/rta/trust_provider.py index 8e7072d21..4d4d32b30 100644 --- a/rta/trust_provider.py +++ b/rta/trust_provider.py @@ -45,7 +45,7 @@ else: TARGET_APP = common.get_path("bin", "myapp.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(SIGCHECK, TRUST_PROVIDER_DLL, TARGET_APP) def main(): common.log("Trust Provider") diff --git a/rta/uac_cdssync.py b/rta/uac_cdssync.py index 52b6bc60f..f6c038c6c 100644 --- a/rta/uac_cdssync.py +++ b/rta/uac_cdssync.py @@ -26,7 +26,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" taskhostw = "C:\\Users\\Public\\taskhostw.exe" diff --git a/rta/uac_clipup.py b/rta/uac_clipup.py index da2bbabcb..716a063d3 100644 --- a/rta/uac_clipup.py +++ b/rta/uac_clipup.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dllhost = "C:\\Users\\Public\\dllhost.exe" clipup = "C:\\Users\\Public\\clipup.exe" diff --git a/rta/uac_computerdefaults.py b/rta/uac_computerdefaults.py index 0cb837c59..6f6a11c71 100644 --- a/rta/uac_computerdefaults.py +++ b/rta/uac_computerdefaults.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software\\Classes\\ms-settings\\shell\\open\\command" value = "test" diff --git a/rta/uac_dccw.py b/rta/uac_dccw.py index 947318123..a3f956442 100644 --- a/rta/uac_dccw.py +++ b/rta/uac_dccw.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dccw = "C:\\Users\\Public\\dccw.exe" dllhost = "C:\\Users\\Public\\dllhost.exe" diff --git a/rta/uac_diskcleanup.py b/rta/uac_diskcleanup.py index f111397c2..4e80a8078 100644 --- a/rta/uac_diskcleanup.py +++ b/rta/uac_diskcleanup.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" common.execute([powershell, "/autoclean", "/d"], timeout=2, kill=True) diff --git a/rta/uac_dism_dll_side_loading.py b/rta/uac_dism_dll_side_loading.py index 6beab774a..41b82d10f 100644 --- a/rta/uac_dism_dll_side_loading.py +++ b/rta/uac_dism_dll_side_loading.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dism = "C:\\Users\\Public\\Dism.exe" dllhost = "C:\\Users\\Public\\dllhost.exe" diff --git a/rta/uac_eventviewer.py b/rta/uac_eventviewer.py index 33e216b87..865cebb06 100644 --- a/rta/uac_eventviewer.py +++ b/rta/uac_eventviewer.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( # %SystemRoot%\system32\mmc.exe "%1" %* -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(target_file=common.get_path("bin", "myapp.exe")): winreg = common.get_winreg() common.log("Bypass UAC with %s" % target_file) diff --git a/rta/uac_eventvwr.py b/rta/uac_eventvwr.py index 6c5bfa9cc..30811d440 100644 --- a/rta/uac_eventvwr.py +++ b/rta/uac_eventvwr.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): eventvwr = "C:\\Users\\Public\\eventvwr.exe" powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/uac_fodhelper.py b/rta/uac_fodhelper.py index 86fe0f002..55734e793 100644 --- a/rta/uac_fodhelper.py +++ b/rta/uac_fodhelper.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software\\Classes\\ms-settings\\shell\\open\\command" value = "test" diff --git a/rta/uac_icmluautil.py b/rta/uac_icmluautil.py index 6605c6fc2..fefccdd13 100644 --- a/rta/uac_icmluautil.py +++ b/rta/uac_icmluautil.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): dllhost = "C:\\Users\\Public\\dllhost.exe" common.copy_file(EXE_FILE, dllhost) diff --git a/rta/uac_mmc_deserialization.py b/rta/uac_mmc_deserialization.py index afe029bc8..f2cc8f8c5 100644 --- a/rta/uac_mmc_deserialization.py +++ b/rta/uac_mmc_deserialization.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): appdata = os.getenv("LOCALAPPDATA") path = Path(appdata) / "\\Microsoft\\Event Viewer" diff --git a/rta/uac_mmc_hijack.py b/rta/uac_mmc_hijack.py index 7cbff6458..878615ca4 100644 --- a/rta/uac_mmc_hijack.py +++ b/rta/uac_mmc_hijack.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): mmc = "C:\\Users\\Public\\mmc.exe" msc = "C:\\Users\\Public\\a.msc" diff --git a/rta/uac_mmc_net_core_profiler.py b/rta/uac_mmc_net_core_profiler.py index 86f572004..d422b884e 100644 --- a/rta/uac_mmc_net_core_profiler.py +++ b/rta/uac_mmc_net_core_profiler.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Environment" value = "COR_PROFILER_PATH" diff --git a/rta/uac_sdclt.py b/rta/uac_sdclt.py index 309be5580..6aa2ed8d5 100644 --- a/rta/uac_sdclt.py +++ b/rta/uac_sdclt.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): sdclt = "C:\\Users\\Public\\sdclt.exe" common.copy_file(EXE_FILE, sdclt) diff --git a/rta/uac_sysprep.py b/rta/uac_sysprep.py index 38e637774..5fd9bbdb1 100644 --- a/rta/uac_sysprep.py +++ b/rta/uac_sysprep.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Bypass UAC with CRYPTBASE.dll") diff --git a/rta/uac_windir_masq.py b/rta/uac_windir_masq.py index 85925a21e..f4cf8e715 100644 --- a/rta/uac_windir_masq.py +++ b/rta/uac_windir_masq.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" common.copy_file(EXE_FILE, proc) diff --git a/rta/uac_windows_activation.py b/rta/uac_windows_activation.py index 2bb11917e..c65076d2c 100644 --- a/rta/uac_windows_activation.py +++ b/rta/uac_windows_activation.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software\\Classes\\Launcher.SystemSettings\\shell\\open\\command" value = "test" diff --git a/rta/uac_winfw_mmc.py b/rta/uac_winfw_mmc.py index dc4a90bb7..8e71dcabe 100644 --- a/rta/uac_winfw_mmc.py +++ b/rta/uac_winfw_mmc.py @@ -30,7 +30,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): mmc = "C:\\Users\\Public\\mmc.exe" dllhost = "C:\\Users\\Public\\dllhost.exe" diff --git a/rta/uac_wow64log.py b/rta/uac_wow64log.py index 9fa0ec345..14618f6f2 100644 --- a/rta/uac_wow64log.py +++ b/rta/uac_wow64log.py @@ -24,7 +24,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/uac_wsreset.py b/rta/uac_wsreset.py index 8f8e8d8e0..33324f6ca 100644 --- a/rta/uac_wsreset.py +++ b/rta/uac_wsreset.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "Software" value = "ms-windows-store" diff --git a/rta/uncommon_persistence.py b/rta/uncommon_persistence.py index 29b0daa5b..a1d3a97d0 100644 --- a/rta/uncommon_persistence.py +++ b/rta/uncommon_persistence.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell" value = "Common Startup" diff --git a/rta/unshadow_execution.py b/rta/unshadow_execution.py index 3b5c4f89e..c2f6d23af 100644 --- a/rta/unshadow_execution.py +++ b/rta/unshadow_execution.py @@ -27,7 +27,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/unshadow" diff --git a/rta/unsigned_startup_item_netconn.py b/rta/unsigned_startup_item_netconn.py index d180a7039..97463f24a 100644 --- a/rta/unsigned_startup_item_netconn.py +++ b/rta/unsigned_startup_item_netconn.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/unusual_kerberos_client.py b/rta/unusual_kerberos_client.py index a43e2633d..e355c2f83 100644 --- a/rta/unusual_kerberos_client.py +++ b/rta/unusual_kerberos_client.py @@ -27,7 +27,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/unusual_ms_tool_network.py b/rta/unusual_ms_tool_network.py index ceec52563..55428e5c2 100644 --- a/rta/unusual_ms_tool_network.py +++ b/rta/unusual_ms_tool_network.py @@ -65,7 +65,7 @@ def http_from_process(name, ip, port): common.remove_file(path) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() diff --git a/rta/unusual_parent_child.py b/rta/unusual_parent_child.py index 262066f5c..e451fcffe 100644 --- a/rta/unusual_parent_child.py +++ b/rta/unusual_parent_child.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Running Windows processes with an unexpected parent of %s" % Path(sys.executable).name) process_names = [ diff --git a/rta/unusual_parent_chrome_extension.py b/rta/unusual_parent_chrome_extension.py index a011dd6ab..d532292aa 100644 --- a/rta/unusual_parent_chrome_extension.py +++ b/rta/unusual_parent_chrome_extension.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): proc = "C:\\Users\\Public\\proc.exe" childproc = "C:\\Users\\Public\\childproc.exe" diff --git a/rta/unusual_powershell_engine_image_load.py b/rta/unusual_powershell_engine_image_load.py index b6ac4ac2a..cc5983718 100644 --- a/rta/unusual_powershell_engine_image_load.py +++ b/rta/unusual_powershell_engine_image_load.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" posh = "C:\\Windows\\System32\\posh.exe" diff --git a/rta/unusual_rdp_client.py b/rta/unusual_rdp_client.py index 42db9adc4..1e1b692c9 100644 --- a/rta/unusual_rdp_client.py +++ b/rta/unusual_rdp_client.py @@ -21,7 +21,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" posh = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\posh.exe" diff --git a/rta/unzip_to_tmp.py b/rta/unzip_to_tmp.py index 917b47ddc..ddda2e847 100644 --- a/rta/unzip_to_tmp.py +++ b/rta/unzip_to_tmp.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/Users/bash" diff --git a/rta/user_action_script.py b/rta/user_action_script.py index a4b8fab4c..8113d650d 100644 --- a/rta/user_action_script.py +++ b/rta/user_action_script.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): # create masquerades diff --git a/rta/user_dir_escalation.py b/rta/user_dir_escalation.py index fe98895e6..cafcab9cf 100644 --- a/rta/user_dir_escalation.py +++ b/rta/user_dir_escalation.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(common.PS_EXEC) def main(): # make sure path is absolute for psexec diff --git a/rta/user_mode_smb_connection.py b/rta/user_mode_smb_connection.py index 891ed451d..4690aeeff 100644 --- a/rta/user_mode_smb_connection.py +++ b/rta/user_mode_smb_connection.py @@ -21,7 +21,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" posh = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\posh.exe" diff --git a/rta/vaultcmd_commands.py b/rta/vaultcmd_commands.py index 69aad84bb..67cf397eb 100644 --- a/rta/vaultcmd_commands.py +++ b/rta/vaultcmd_commands.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Searching Credential Vaults via VaultCmd") diff --git a/rta/webproxy_modification.py b/rta/webproxy_modification.py index 145b7bf0a..934ee03e7 100644 --- a/rta/webproxy_modification.py +++ b/rta/webproxy_modification.py @@ -16,7 +16,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/networksetup" diff --git a/rta/webservice_lolbas.py b/rta/webservice_lolbas.py index 0bbba801e..4974f9fe8 100644 --- a/rta/webservice_lolbas.py +++ b/rta/webservice_lolbas.py @@ -25,7 +25,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" diff --git a/rta/webservice_unsigned.py b/rta/webservice_unsigned.py index d6a025c9e..4389660dd 100644 --- a/rta/webservice_unsigned.py +++ b/rta/webservice_unsigned.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): posh = "C:\\Users\\Public\\posh.exe" common.copy_file(EXE_FILE, posh) diff --git a/rta/werfault_masquerading.py b/rta/werfault_masquerading.py index c37f52f24..916dcc947 100644 --- a/rta/werfault_masquerading.py +++ b/rta/werfault_masquerading.py @@ -20,7 +20,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "regsvr32.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): werfault = "C:\\Users\\Public\\werfault.exe" diff --git a/rta/werfault_persistence.py b/rta/werfault_persistence.py index 06f729786..2559d51cf 100644 --- a/rta/werfault_persistence.py +++ b/rta/werfault_persistence.py @@ -26,7 +26,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_APP) def main(): reg_key = "'HKLM:\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\hangs'" diff --git a/rta/wevtutil_log_clear.py b/rta/wevtutil_log_clear.py index 820258ed2..fad12fcc0 100644 --- a/rta/wevtutil_log_clear.py +++ b/rta/wevtutil_log_clear.py @@ -24,7 +24,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("Clearing Windows Event Logs") common.log("WARNING - About to clear logs from Windows Event Viewer", log_type="!") diff --git a/rta/windefend_svc_stop.py b/rta/windefend_svc_stop.py index 0dafb8ce4..8fe208a79 100644 --- a/rta/windefend_svc_stop.py +++ b/rta/windefend_svc_stop.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" tempshell = "C:\\Users\\Public\\powershell.exe" diff --git a/rta/windows_script_host_file_written_exec.py b/rta/windows_script_host_file_written_exec.py index d3bd19fd8..d6577a66a 100644 --- a/rta/windows_script_host_file_written_exec.py +++ b/rta/windows_script_host_file_written_exec.py @@ -29,7 +29,7 @@ metadata = RtaMetadata( EXE_FILE = common.get_path("bin", "renamed_posh.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): server, ip, port = common.serve_web() url = f"http://{ip}:{port}/bin/renamed_posh.exe" diff --git a/rta/winrar_encrypted.py b/rta/winrar_encrypted.py index e36a5a2ad..1736d4261 100644 --- a/rta/winrar_encrypted.py +++ b/rta/winrar_encrypted.py @@ -34,7 +34,7 @@ def create_exfil(path=Path("secret_stuff.txt").resolve()): return path -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) @common.dependencies(MY_APP, WINRAR) def main(password="s0l33t"): # Copies of the rar.exe for various tests diff --git a/rta/winrar_startup_folder.py b/rta/winrar_startup_folder.py index 774ed1d11..ff5c7fc4c 100644 --- a/rta/winrar_startup_folder.py +++ b/rta/winrar_startup_folder.py @@ -22,7 +22,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): common.log("WinRAR StartUp Folder Persistence") win_rar_path = Path("WinRAR.exe").resolve() diff --git a/rta/wizardupdate_infection.py b/rta/wizardupdate_infection.py index 5f3476c07..4d7c00a48 100644 --- a/rta/wizardupdate_infection.py +++ b/rta/wizardupdate_infection.py @@ -18,7 +18,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/curl" diff --git a/rta/wmi_incoming_logon.py b/rta/wmi_incoming_logon.py index 5175a8d1c..417b23117 100644 --- a/rta/wmi_incoming_logon.py +++ b/rta/wmi_incoming_logon.py @@ -23,7 +23,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(remote_host=None): if not remote_host: common.log("A remote host is required to detonate this RTA", "!") diff --git a/rta/wmic_xsl_exec.py b/rta/wmic_xsl_exec.py index dc1235c80..bbefca2de 100644 --- a/rta/wmic_xsl_exec.py +++ b/rta/wmic_xsl_exec.py @@ -22,7 +22,7 @@ EXE_FILE = common.get_path("bin", "renamed_posh.exe") PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wmic = "C:\\Users\\Public\\wmic.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/wuauclt_image_load.py b/rta/wuauclt_image_load.py index 033421a87..4e83cf6e0 100644 --- a/rta/wuauclt_image_load.py +++ b/rta/wuauclt_image_load.py @@ -28,7 +28,7 @@ PS1_FILE = common.get_path("bin", "Invoke-ImageLoad.ps1") RENAMER = common.get_path("bin", "rcedit-x64.exe") -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): wuauclt = "C:\\Users\\Public\\wuauclt.exe" user32 = "C:\\Windows\\System32\\user32.dll" diff --git a/rta/xcsset_infection.py b/rta/xcsset_infection.py index eeeeba60a..9adf70e44 100644 --- a/rta/xcsset_infection.py +++ b/rta/xcsset_infection.py @@ -17,7 +17,7 @@ metadata = RtaMetadata( ) -@common.requires_os(metadata.platforms) +@common.requires_os(*metadata.platforms) def main(): masquerade = "/tmp/zip" From 8d2b730bc5d9cf048a5f4a65e031072bc16796c5 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Tue, 3 Oct 2023 13:36:06 -0400 Subject: [PATCH 10/86] adjusting minimum stack version for version control (#3154) --- .../windows/persistence_sysmon_wmi_event_subscription.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rules/windows/persistence_sysmon_wmi_event_subscription.toml b/rules/windows/persistence_sysmon_wmi_event_subscription.toml index 161a2ff8a..5605c425a 100644 --- a/rules/windows/persistence_sysmon_wmi_event_subscription.toml +++ b/rules/windows/persistence_sysmon_wmi_event_subscription.toml @@ -2,9 +2,9 @@ creation_date = "2023/02/02" integration = ["windows"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/08" +min_stack_comments = "Related integrations field type changes in 8.8.0" +min_stack_version = "8.8.0" +updated_date = "2023/10/03" [rule] author = ["Elastic"] From 0e2ae5b9efa3da21c8337461234d51f21b9c48be Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:34:22 -0400 Subject: [PATCH 11/86] Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 (#3155) * Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10 * Update detection_rules/etc/version.lock.json --------- Co-authored-by: terrancedejesus Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- detection_rules/etc/version.lock.json | 118 +++++++++++++++++++++++++- 1 file changed, 116 insertions(+), 2 deletions(-) diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index c18651999..294abbc35 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -169,6 +169,13 @@ "type": "eql", "version": 4 }, + "0678bc9c-b71a-433b-87e6-2f664b6b3131": { + "min_stack_version": "8.5", + "rule_name": "Unusual Remote File Size", + "sha256": "4474648fdc8f0b955f03bda5337ba2f2645db4f902f82c9b5f399502684d327d", + "type": "machine_learning", + "version": 1 + }, "06a7a03c-c735-47a6-a313-51c354aef6c3": { "min_stack_version": "8.3", "rule_name": "Enumerating Domain Trusts via DSQUERY.EXE", @@ -806,6 +813,13 @@ "type": "eql", "version": 100 }, + "18a5dd9a-e3fa-4996-99b1-ae533b8f27fc": { + "min_stack_version": "8.5", + "rule_name": "Spike in Number of Connections Made to a Destination IP", + "sha256": "eea67da7d863bb4da8802088e97d3e0f188941c8484338c6e17099c6f9c88450", + "type": "machine_learning", + "version": 1 + }, "193549e8-bb9e-466a-a7f9-7e783f5cb5a6": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via Recently Compiled Executable", @@ -820,6 +834,13 @@ "type": "machine_learning", "version": 106 }, + "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03": { + "min_stack_version": "8.5", + "rule_name": "Spike in Number of Processes in an RDP Session", + "sha256": "c2a98c086c35d0e6339615bc26c449c6e6e2a3cb850572c19b445f22fd02d3bc", + "type": "machine_learning", + "version": 1 + }, "1a289854-5b78-49fe-9440-8a8096b1ab50": { "min_stack_version": "8.8", "rule_name": "Suspicious Network Tool Launched Inside A Container", @@ -1120,6 +1141,13 @@ "type": "eql", "version": 105 }, + "2377946d-0f01-4957-8812-6878985f515d": { + "min_stack_version": "8.5", + "rule_name": "Remote File Creation on a Sensitive Directory", + "sha256": "6c62d2b1221abd06ad64acfcf05620adc52bc244fa55a8eccf63b284d974ab08", + "type": "eql", + "version": 1 + }, "25224a80-5a4a-4b8a-991e-6ab390465c4f": { "min_stack_version": "8.3", "rule_name": "Lateral Movement via Startup Folder", @@ -1447,6 +1475,13 @@ "type": "eql", "version": 106 }, + "301571f3-b316-4969-8dd0-7917410030d3": { + "min_stack_version": "8.5", + "rule_name": "Malicious Remote File Creation", + "sha256": "a77b63c0cec99d37a8e4a3609137a34580f0cca84198c663fb6adcb5efb462bf", + "type": "eql", + "version": 1 + }, "30562697-9859-4ae0-a8c5-dab45d664170": { "min_stack_version": "8.3", "rule_name": "GCP Firewall Rule Creation", @@ -1607,6 +1642,13 @@ "type": "eql", "version": 104 }, + "36c48a0c-c63a-4cbc-aee1-8cac87db31a9": { + "min_stack_version": "8.5", + "rule_name": "High Mean of Process Arguments in an RDP Session", + "sha256": "5e13a7be5f8a00aa914acf030478774a709c75e65e739272b194674bebf33f1d", + "type": "machine_learning", + "version": 1 + }, "3728c08d-9b70-456b-b6b8-007c7d246128": { "min_stack_version": "8.3", "rule_name": "Potential Suspicious File Edit", @@ -1780,6 +1822,13 @@ "type": "query", "version": 106 }, + "3e0561b5-3fac-4461-84cc-19163b9aaa61": { + "min_stack_version": "8.5", + "rule_name": "Spike in Number of Connections Made from a Source IP", + "sha256": "65fe46f9242a840f6c97a70fa3782f5c6b4b016bf458fecb8460e3ca8e3e17f3", + "type": "machine_learning", + "version": 1 + }, "3e0eeb75-16e8-4f2f-9826-62461ca128b7": { "min_stack_version": "8.3", "rule_name": "Suspicious Execution via Windows Subsystem for Linux", @@ -1852,6 +1901,13 @@ "type": "eql", "version": 2 }, + "3f4e2dba-828a-452a-af35-fe29c5e78969": { + "min_stack_version": "8.5", + "rule_name": "Unusual Time or Day for an RDP Session", + "sha256": "616e8eb4fc391b32d81e6e8219a3c053453306a6048116d1e837b55ec439363f", + "type": "machine_learning", + "version": 1 + }, "403ef0d3-8259-40c9-a5b6-d48354712e49": { "min_stack_version": "8.3", "rule_name": "Unusual Persistence via Services Registry", @@ -3614,6 +3670,13 @@ "type": "query", "version": 101 }, + "814d96c7-2068-42aa-ba8e-fe0ddd565e2e": { + "min_stack_version": "8.5", + "rule_name": "Unusual Remote File Extension", + "sha256": "6e54a46cf82894aa5484fcd4379b15fedf0c9cb10afb88344a3035f32f6a5727", + "type": "machine_learning", + "version": 1 + }, "818e23e6-2094-4f0e-8c01-22d30f3506c6": { "min_stack_version": "8.3", "rule_name": "PowerShell Script Block Logging Disabled", @@ -3911,6 +3974,13 @@ "type": "eql", "version": 7 }, + "8d366588-cbd6-43ba-95b4-0971c3f906e5": { + "min_stack_version": "8.3", + "rule_name": "File with Suspicious Extension Downloaded", + "sha256": "4aee04fcae9856c8db9a767d12e37c08a83d89f0665b4be03150aa01c6e03b4b", + "type": "eql", + "version": 1 + }, "8d3d0794-c776-476b-8674-ee2e685f6470": { "min_stack_version": "8.8", "rule_name": "Suspicious Interactive Shell Spawned From Inside A Container", @@ -4689,6 +4759,13 @@ "type": "eql", "version": 104 }, + "a74c60cb-70ee-4629-a127-608ead14ebf1": { + "min_stack_version": "8.5", + "rule_name": "High Mean of RDP Session Duration", + "sha256": "261e95ec78136218300b4b17a48e642b472f7a6cd692487fb36e3a707b6ce56a", + "type": "machine_learning", + "version": 1 + }, "a7ccae7b-9d2c-44b2-a061-98e5946971fa": { "min_stack_version": "8.3", "rule_name": "Suspicious Print Spooler SPL File Created", @@ -4717,6 +4794,13 @@ "type": "eql", "version": 1 }, + "a8d35ca0-ad8d-48a9-9f6c-553622dca61a": { + "min_stack_version": "8.5", + "rule_name": "High Variance in RDP Session Duration", + "sha256": "7b577644248850837c58cfb8850fdce3df772501393676bb090118f5ca4c3f22", + "type": "machine_learning", + "version": 1 + }, "a9198571-b135-4a76-b055-e3e5a476fd83": { "rule_name": "Hex Encoding/Decoding Activity", "sha256": "b6cfa5bf24a78049ee0f873fe01bcc14ef5116a6adf59b8721abeb11ceca01cf", @@ -5357,6 +5441,13 @@ "type": "eql", "version": 105 }, + "be4c5aed-90f5-4221-8bd5-7ab3a4334751": { + "min_stack_version": "8.5", + "rule_name": "Unusual Remote File Directory", + "sha256": "031fe3c29bbf87093165028e79236de7553cdf3f3f10ab76a86289f3e6dfa1f6", + "type": "machine_learning", + "version": 1 + }, "be8afaed-4bcd-4e0a-b5f9-5562003dde81": { "min_stack_version": "8.3", "rule_name": "Searching for Saved Credentials via VaultCmd", @@ -6374,6 +6465,13 @@ "type": "threshold", "version": 105 }, + "e0cc3807-e108-483c-bf66-5a4fbe0d7e89": { + "min_stack_version": "8.3", + "rule_name": "Potentially Suspicious Process Started via tmux or screen", + "sha256": "b30b5b205b4d258de4072197ae2f131b0716891f4297ffc36e6a2549b7ca66fc", + "type": "eql", + "version": 1 + }, "e0dacebe-4311-4d50-9387-b17e89c2e7fd": { "min_stack_version": "7.16", "rule_name": "Whitespace Padding in Process Command Line", @@ -6586,11 +6684,20 @@ "version": 105 }, "e72f87d0-a70e-4f8d-8443-a6407bc34643": { - "min_stack_version": "8.3", + "min_stack_version": "8.8", + "previous": { + "8.3": { + "max_allowable_version": 104, + "rule_name": "Suspicious WMI Event Subscription Created", + "sha256": "ab002c02bd96a6d77776ccb1b5fe96cb19d8ee3fa408b8c5853d7a4580f3fc18", + "type": "eql", + "version": 5 + } + }, "rule_name": "Suspicious WMI Event Subscription Created", "sha256": "bee333bfc8d77b96f009283d0b8dc93b5e2e38ef6b27b38b21daccf6fe50833a", "type": "eql", - "version": 4 + "version": 105 }, "e74d645b-fec6-431e-bf93-ca64a538e0de": { "min_stack_version": "8.3", @@ -6669,6 +6776,13 @@ "type": "eql", "version": 104 }, + "e9b0902b-c515-413b-b80b-a8dcebc81a66": { + "min_stack_version": "8.5", + "rule_name": "Spike in Remote File Transfers", + "sha256": "0f4119237d356fe2c032c074c5de136fb71aec5533ecac64a6152b49c3b3f92a", + "type": "machine_learning", + "version": 1 + }, "e9b4a3c7-24fc-49fd-a00f-9c938031eef1": { "rule_name": "Linux Restricted Shell Breakout via busybox Shell Evasion", "sha256": "f5726e1a8ce8508e84699dd4648108f26b624ea175aeb4a0cdace248925f0d8a", From b8ae2218f864aa696360e65cf8354e5951210961 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Tue, 3 Oct 2023 15:05:41 -0400 Subject: [PATCH 12/86] [Rule Tuning] Add `filebeat` Compatibility to Network Rules (#2925) * add beats compatability to NPC rules * added filebeat compatibility to 'Accepted Default Telnet Port Connection' * added filebeat compatibility to 'Cobalt Strike Command and Control Beacon' * added filebeat compatibility to 'Default Cobalt Strike Team Server Certificate' * added filebeat compatibility to 'Roshal Archive (RAR) or PowerShell File Downloaded from the Internet' * added filebeat compatibility to 'Possible FIN7 DGA Command and Control Behavior' * added filebeat compatibility to 'Halfbaked Command and Control Beacon' * added filebeat compatibility to 'IPSEC NAT Traversal Port Activity' * added filebeat compatibility to 'SMTP on Port 26/TCP' * added filebeat compatibility to 'RDP (Remote Desktop Protocol) from the Internet' * added filebeat compatibility to 'VNC (Virtual Network Computing) from the Internet' * added filebeat compatibility to 'VNC (Virtual Network Computing) to the Internet' * added filebeat compatibility to 'RPC (Remote Procedure Call) from the Internet' * added filebeat compatibility to 'RPC (Remote Procedure Call) to the Internet' * added filebeat compatibility to 'SMB (Windows File Sharing) Activity to the Internet' * removed extra space in query * added filebeat compatibility to 'Inbound Connection to an Unsecure Elasticsearch Node' * added filebeat compatibility to 'Abnormally Large DNS Response' * fixed missing ending parenthesis * added auditbeat to compatible rules * addressed feedback * removed filebeat and auditbeat due to incompatibility * Update rules/network/command_and_control_cobalt_strike_beacon.toml * Update rules/network/command_and_control_accepted_default_telnet_port_connection.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --- ...ccepted_default_telnet_port_connection.toml | 14 +++++++------- ...mmand_and_control_cobalt_strike_beacon.toml | 8 +++++--- ..._cobalt_strike_default_teamserver_cert.toml | 18 ++++++++++++------ ..._download_rar_powershell_from_internet.toml | 7 ++++--- .../command_and_control_fin7_c2_behavior.toml | 7 ++++--- .../command_and_control_halfbaked_beacon.toml | 11 ++++++----- ...nd_control_nat_traversal_port_activity.toml | 4 ++-- .../command_and_control_port_26_activity.toml | 5 +++-- ...ote_desktop_protocol_from_the_internet.toml | 5 +++-- ...al_network_computing_from_the_internet.toml | 5 +++-- ...tual_network_computing_to_the_internet.toml | 5 +++-- ...overy_potential_network_sweep_detected.toml | 10 +++++----- ...discovery_potential_port_scan_detected.toml | 12 ++++++------ ...overy_potential_syn_port_scan_detected.toml | 12 ++++++------ ...emote_procedure_call_from_the_internet.toml | 5 +++-- ..._remote_procedure_call_to_the_internet.toml | 6 ++++-- ..._file_sharing_activity_to_the_internet.toml | 6 ++++-- ...ial_access_unsecure_elasticsearch_node.toml | 6 ++++-- .../lateral_movement_dns_server_overflow.toml | 15 ++++++++++----- 19 files changed, 94 insertions(+), 67 deletions(-) diff --git a/rules/network/command_and_control_accepted_default_telnet_port_connection.toml b/rules/network/command_and_control_accepted_default_telnet_port_connection.toml index 9e8c417b9..276db49d0 100644 --- a/rules/network/command_and_control_accepted_default_telnet_port_connection.toml +++ b/rules/network/command_and_control_accepted_default_telnet_port_connection.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "Accepted Default Telnet Port Connection" @@ -33,7 +33,6 @@ rule_id = "34fde489-94b0-4500-a76f-b8a157cf9269" severity = "medium" tags = [ "Domain: Endpoint", - "Use Case: Threat Detection", "Tactic: Command and Control", "Tactic: Lateral Movement", @@ -45,10 +44,11 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and event.type: connection - and not event.action:( - flow_dropped or denied or deny or - flow_terminated or timeout or Reject or network_flow) +(event.dataset:network_traffic.flow or event.category:(network or network_traffic)) + and event.type:connection and not event.action:( + flow_dropped or denied or deny or + flow_terminated or timeout or Reject or network_flow) + and destination.port:23 ''' diff --git a/rules/network/command_and_control_cobalt_strike_beacon.toml b/rules/network/command_and_control_cobalt_strike_beacon.toml index 26a4188a7..65f957277 100644 --- a/rules/network/command_and_control_cobalt_strike_beacon.toml +++ b/rules/network/command_and_control_cobalt_strike_beacon.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "lucene" license = "Elastic License v2" name = "Cobalt Strike Command and Control Beacon" @@ -40,7 +40,9 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: (network_traffic.tls or network_traffic.http) AND destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/ +((event.category: (network or network_traffic) and type: (tls or http)) + or event.dataset: (network_traffic.tls or network_traffic.http) +) and destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/ ''' diff --git a/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml b/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml index 066bf738b..facaf30f0 100644 --- a/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml +++ b/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -16,7 +16,7 @@ SHA256 hashing algorithms (the default is SHA1). See the References section for configuration. """ from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "Default Cobalt Strike Team Server Certificate" @@ -34,14 +34,20 @@ references = [ risk_score = 99 rule_id = "e7075e8d-a966-458e-a183-85cd331af255" severity = "critical" -tags = ["Tactic: Command and Control", "Threat: Cobalt Strike", "Use Case: Threat Detection", "Domain: Endpoint"] +tags = [ + "Tactic: Command and Control", + "Threat: Cobalt Strike", + "Use Case: Threat Detection", + "Domain: Endpoint", +] timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.tls and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 or - tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C or - tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C) +(event.dataset: network_traffic.tls or event.category: (network or network_traffic)) + and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83 + or tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C + or tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C) ''' diff --git a/rules/network/command_and_control_download_rar_powershell_from_internet.toml b/rules/network/command_and_control_download_rar_powershell_from_internet.toml index 7c33cbc33..fbade0aa6 100644 --- a/rules/network/command_and_control_download_rar_powershell_from_internet.toml +++ b/rules/network/command_and_control_download_rar_powershell_from_internet.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -21,7 +21,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet" @@ -41,7 +41,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: (network_traffic.http or network_traffic.tls) and +(event.dataset: (network_traffic.http or network_traffic.tls) or + (event.category: (network or network_traffic) and network.protocol: http)) and (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and not destination.ip:( 10.0.0.0/8 or diff --git a/rules/network/command_and_control_fin7_c2_behavior.toml b/rules/network/command_and_control_fin7_c2_behavior.toml index 3d1a895ca..cda4259e3 100644 --- a/rules/network/command_and_control_fin7_c2_behavior.toml +++ b/rules/network/command_and_control_fin7_c2_behavior.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -19,7 +19,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "lucene" license = "Elastic License v2" name = "Possible FIN7 DGA Command and Control Behavior" @@ -37,7 +37,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: (network_traffic.tls or network_traffic.http) AND +(event.dataset: (network_traffic.tls or network_traffic.http) or + (event.category: (network or network_traffic) and type: (tls or http) and network.transport: tcp)) and destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us ''' diff --git a/rules/network/command_and_control_halfbaked_beacon.toml b/rules/network/command_and_control_halfbaked_beacon.toml index 9eaf40abd..fe46b4b90 100644 --- a/rules/network/command_and_control_halfbaked_beacon.toml +++ b/rules/network/command_and_control_halfbaked_beacon.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -19,7 +19,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "lucene" license = "Elastic License v2" name = "Halfbaked Command and Control Beacon" @@ -38,9 +38,10 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: (network_traffic.tls or network_traffic.http) AND - network.transport:tcp AND url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ AND - destination.port:(53 OR 80 OR 8080 OR 443) +(event.dataset: (network_traffic.tls or network_traffic.http) or + (event.category: (network or network_traffic) and network.protocol: http)) and + network.transport:tcp and url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ and + destination.port:(53 or 80 or 8080 or 443) ''' diff --git a/rules/network/command_and_control_nat_traversal_port_activity.toml b/rules/network/command_and_control_nat_traversal_port_activity.toml index bab6a4656..8c76d249a 100644 --- a/rules/network/command_and_control_nat_traversal_port_activity.toml +++ b/rules/network/command_and_control_nat_traversal_port_activity.toml @@ -23,7 +23,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "IPSEC NAT Traversal Port Activity" @@ -35,7 +35,7 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:udp and destination.port:4500 +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and network.transport:udp and destination.port:4500 ''' diff --git a/rules/network/command_and_control_port_26_activity.toml b/rules/network/command_and_control_port_26_activity.toml index 080ddea6a..dc7c52c3d 100644 --- a/rules/network/command_and_control_port_26_activity.toml +++ b/rules/network/command_and_control_port_26_activity.toml @@ -20,7 +20,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "SMTP on Port 26/TCP" @@ -36,7 +36,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26)) +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26)) ''' diff --git a/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml b/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml index 5d3f3fa03..1b1cc835d 100644 --- a/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml +++ b/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml @@ -25,7 +25,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "RDP (Remote Desktop Protocol) from the Internet" @@ -40,7 +40,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and not source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or diff --git a/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml b/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml index 5d980ddde..5c07d1604 100644 --- a/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml +++ b/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml @@ -23,7 +23,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "VNC (Virtual Network Computing) from the Internet" @@ -36,7 +36,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and not source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or diff --git a/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml b/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml index a90903ee3..450ea79d3 100644 --- a/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml +++ b/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml @@ -23,7 +23,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "VNC (Virtual Network Computing) to the Internet" @@ -36,7 +36,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or diff --git a/rules/network/discovery_potential_network_sweep_detected.toml b/rules/network/discovery_potential_network_sweep_detected.toml index a830369f0..0c8bd9280 100644 --- a/rules/network/discovery_potential_network_sweep_detected.toml +++ b/rules/network/discovery_potential_network_sweep_detected.toml @@ -9,14 +9,14 @@ updated_date = "2023/07/31" [rule] author = ["Elastic"] description = ''' -This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target -network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and -weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized -access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts +This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target +network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and +weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized +access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services. ''' from = "now-9m" -index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*", "logs-endpoint.events.network-*",] language = "kuery" license = "Elastic License v2" name = "Potential Network Sweep Detected" diff --git a/rules/network/discovery_potential_port_scan_detected.toml b/rules/network/discovery_potential_port_scan_detected.toml index 37ecaf6df..24c72c77c 100644 --- a/rules/network/discovery_potential_port_scan_detected.toml +++ b/rules/network/discovery_potential_port_scan_detected.toml @@ -9,15 +9,15 @@ updated_date = "2023/07/31" [rule] author = ["Elastic"] description = ''' -This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a -target system or network for open ports, allowing them to identify available services and potential vulnerabilities. -By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining -unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further -exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts +This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a +target system or network for open ports, allowing them to identify available services and potential vulnerabilities. +By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining +unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further +exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports. ''' from = "now-9m" -index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*"] +index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*", "filebeat-*", "auditbeat-*"] language = "kuery" license = "Elastic License v2" name = "Potential Network Scan Detected" diff --git a/rules/network/discovery_potential_syn_port_scan_detected.toml b/rules/network/discovery_potential_syn_port_scan_detected.toml index 9d18c04d2..f294ca144 100644 --- a/rules/network/discovery_potential_syn_port_scan_detected.toml +++ b/rules/network/discovery_potential_syn_port_scan_detected.toml @@ -9,15 +9,15 @@ updated_date = "2023/07/31" [rule] author = ["Elastic"] description = ''' -This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a -target network for open ports by sending SYN packets to multiple ports and observing the response. -Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, -allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its -security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic +This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a +target network for open ports by sending SYN packets to multiple ports and observing the response. +Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, +allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its +security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port. ''' from = "now-9m" -index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*"] +index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*", "auditbeat-*", "filebeat-*"] language = "kuery" license = "Elastic License v2" name = "Potential SYN-Based Network Scan Detected" diff --git a/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml b/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml index 03c15e746..3dcd1d643 100644 --- a/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml +++ b/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml @@ -15,7 +15,7 @@ directly exposed to the Internet, as it is frequently targeted and exploited by backdoor vector. """ from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "RPC (Remote Procedure Call) from the Internet" @@ -28,7 +28,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and not source.ip:( 10.0.0.0/8 or 127.0.0.0/8 or diff --git a/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml b/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml index 0fd6a76c3..ce2e6f9b0 100644 --- a/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml +++ b/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml @@ -6,6 +6,7 @@ min_stack_comments = "New fields added: required_fields, related_integrations, s min_stack_version = "8.3.0" updated_date = "2023/08/17" + [rule] author = ["Elastic"] description = """ @@ -15,7 +16,7 @@ directly exposed to the Internet, as it is frequently targeted and exploited by backdoor vector. """ from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "RPC (Remote Procedure Call) to the Internet" @@ -28,7 +29,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or diff --git a/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml b/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml index 8660b2b1c..782073582 100644 --- a/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml +++ b/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml @@ -6,6 +6,7 @@ min_stack_comments = "New fields added: required_fields, related_integrations, s min_stack_version = "8.3.0" updated_date = "2023/08/17" + [rule] author = ["Elastic"] description = """ @@ -15,7 +16,7 @@ systems. It should almost never be directly exposed to the Internet, as it is fr threat actors as an initial access or backdoor vector or for data exfiltration. """ from = "now-9m" -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "SMB (Windows File Sharing) Activity to the Internet" @@ -28,7 +29,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and +(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and + network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and source.ip:( 10.0.0.0/8 or 172.16.0.0/12 or diff --git a/rules/network/initial_access_unsecure_elasticsearch_node.toml b/rules/network/initial_access_unsecure_elasticsearch_node.toml index b1fa05a1f..7c166db1d 100644 --- a/rules/network/initial_access_unsecure_elasticsearch_node.toml +++ b/rules/network/initial_access_unsecure_elasticsearch_node.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -38,7 +38,9 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.http AND status:OK AND destination.port:9200 AND network.direction:inbound AND NOT http.response.headers.content-type:"image/x-icon" AND NOT _exists_:http.request.headers.authorization +(event.dataset: network_traffic.http or (event.category: network_traffic and network.protocol: http)) and + status:OK and destination.port:9200 and network.direction:inbound and NOT http.response.headers.content-type:"image/x-icon" and not + _exists_:http.request.headers.authorization ''' diff --git a/rules/network/lateral_movement_dns_server_overflow.toml b/rules/network/lateral_movement_dns_server_overflow.toml index 14809d8b8..ad311c66b 100644 --- a/rules/network/lateral_movement_dns_server_overflow.toml +++ b/rules/network/lateral_movement_dns_server_overflow.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/01" [rule] author = ["Elastic"] @@ -19,7 +19,7 @@ false_positives = [ authorized vulnerability scan or compromise assessment. """, ] -index = ["packetbeat-*", "logs-network_traffic.*"] +index = ["packetbeat-*", "filebeat-*", "logs-network_traffic.*"] language = "kuery" license = "Elastic License v2" name = "Abnormally Large DNS Response" @@ -59,17 +59,22 @@ references = [ "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/", "https://github.com/maxpl0it/CVE-2020-1350-DoS", - "https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability" + "https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability", ] risk_score = 47 rule_id = "11013227-0301-4a8c-b150-4db924484475" severity = "medium" -tags = ["Use Case: Threat Detection", "Tactic: Lateral Movement", "Resources: Investigation Guide", "Use Case: Vulnerability"] +tags = [ + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Use Case: Vulnerability", +] timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: network_traffic.dns and +(event.dataset: network_traffic.dns or (event.category: (network or network_traffic) and destination.port: 53)) and (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000 ''' From f4ad1f28e39d261812b463914830dd6317605f8a Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Thu, 5 Oct 2023 16:41:11 +0200 Subject: [PATCH 13/86] [New Rule] PE via CVE-2023-4911 (Looney Tunables) (#3158) * [New Rule] PE via CVE-2023-4911 (Looney Tunables) * Update rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml * Update rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml --- ...alation_looney_tunables_cve_2023_4911.toml | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml diff --git a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml new file mode 100644 index 000000000..5c7d5b0f4 --- /dev/null +++ b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml @@ -0,0 +1,66 @@ +[metadata] +creation_date = "2023/10/05" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "Linux environment variable capture feature via the Elastic Defend Integration was added in 8.6." +min_stack_version = "8.6.0" +updated_date = "2023/10/05" + +[rule] +author = ["Elastic"] +description = """ +This rule detects potential privilege escalation attempts through Looney Tunables (CVE-2023-4911). Looney Tunables is a +buffer overflow vulnerability in GNU C Library's dynamic loader's processing of the GLIBC_TUNABLES environment variable. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Privilege Escalation via CVE-2023-4911" +note = """## Setup +Elastic Defend integration does not collect environment variable logging by default. +In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings +of the Elastic Defend integration. +To set up environment variable capture for an Elastic Agent policy: +- Go to Security → Manage → Policies. +- Select an Elastic Agent policy. +- Click Show advanced settings. +- Scroll down or search for linux.advanced.capture_env_vars. +- Enter the names of env vars you want to capture, separated by commas. +- For this rule the linux.advanced.capture_env_vars variable should be set to "GLIBC_TUNABLES". +- Click Save. +After saving the integration change, the Elastic Agents running this policy will be updated and +the rule will function properly. +For more information on capturing environment variables refer - https://www.elastic.co/guide/en/security/current/environment-variable-capture.html +""" +references = ["https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so"] +risk_score = 73 +rule_id = "6d8685a1-94fa-4ef7-83de-59302e7c4ca8" +severity = "high" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ] +type = "eql" +query = ''' +sequence by host.id, process.parent.entity_id with maxspan=5s + [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "su" + and process.env_vars : "GLIBC_TUNABLES=glibc.malloc.mxfast*"] with runs=5 +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" From 57c05f0444bbed0f1c9291bf51ea19b082b59edd Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Thu, 5 Oct 2023 12:16:53 -0400 Subject: [PATCH 14/86] removing lmd rules and fixing version lock history (#3159) --- detection_rules/etc/version.lock.json | 93 +------------------ ...vement_malicious_remote_file_creation.toml | 45 --------- ...ovement_ml_high_mean_rdp_process_args.toml | 45 --------- ...ent_ml_high_mean_rdp_session_duration.toml | 45 --------- ...ral_movement_ml_high_remote_file_size.toml | 46 --------- ...ml_high_variance_rdp_session_duration.toml | 45 --------- ...ovement_ml_rare_remote_file_directory.toml | 45 --------- ...ovement_ml_rare_remote_file_extension.toml | 44 --------- ...spike_in_connections_from_a_source_ip.toml | 45 --------- ...ke_in_connections_to_a_destination_ip.toml | 45 --------- ...al_movement_ml_spike_in_rdp_processes.toml | 44 --------- ...ent_ml_spike_in_remote_file_transfers.toml | 46 --------- ...nt_ml_unusual_time_for_an_rdp_session.toml | 45 --------- ..._file_creation_in_sensitive_directory.toml | 57 ------------ 14 files changed, 1 insertion(+), 689 deletions(-) delete mode 100644 rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml delete mode 100644 rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml delete mode 100644 rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index 294abbc35..4c3f0d389 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -2,7 +2,7 @@ "000047bb-b27a-47ec-8b62-ef1a5d2c9e19": { "min_stack_version": "8.3", "rule_name": "Attempt to Modify an Okta Policy Rule", - "sha256": "ab816235d1086e87acda877a4f3bc72e72af952ecf7a40b59d2d45991812ef73", + "sha256": "ab816235d1086e87acda877a4f3bc72e72af952ecf7a40b59d2d45991812ef73", "type": "query", "version": 105 }, @@ -169,13 +169,6 @@ "type": "eql", "version": 4 }, - "0678bc9c-b71a-433b-87e6-2f664b6b3131": { - "min_stack_version": "8.5", - "rule_name": "Unusual Remote File Size", - "sha256": "4474648fdc8f0b955f03bda5337ba2f2645db4f902f82c9b5f399502684d327d", - "type": "machine_learning", - "version": 1 - }, "06a7a03c-c735-47a6-a313-51c354aef6c3": { "min_stack_version": "8.3", "rule_name": "Enumerating Domain Trusts via DSQUERY.EXE", @@ -813,13 +806,6 @@ "type": "eql", "version": 100 }, - "18a5dd9a-e3fa-4996-99b1-ae533b8f27fc": { - "min_stack_version": "8.5", - "rule_name": "Spike in Number of Connections Made to a Destination IP", - "sha256": "eea67da7d863bb4da8802088e97d3e0f188941c8484338c6e17099c6f9c88450", - "type": "machine_learning", - "version": 1 - }, "193549e8-bb9e-466a-a7f9-7e783f5cb5a6": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via Recently Compiled Executable", @@ -834,13 +820,6 @@ "type": "machine_learning", "version": 106 }, - "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03": { - "min_stack_version": "8.5", - "rule_name": "Spike in Number of Processes in an RDP Session", - "sha256": "c2a98c086c35d0e6339615bc26c449c6e6e2a3cb850572c19b445f22fd02d3bc", - "type": "machine_learning", - "version": 1 - }, "1a289854-5b78-49fe-9440-8a8096b1ab50": { "min_stack_version": "8.8", "rule_name": "Suspicious Network Tool Launched Inside A Container", @@ -1141,13 +1120,6 @@ "type": "eql", "version": 105 }, - "2377946d-0f01-4957-8812-6878985f515d": { - "min_stack_version": "8.5", - "rule_name": "Remote File Creation on a Sensitive Directory", - "sha256": "6c62d2b1221abd06ad64acfcf05620adc52bc244fa55a8eccf63b284d974ab08", - "type": "eql", - "version": 1 - }, "25224a80-5a4a-4b8a-991e-6ab390465c4f": { "min_stack_version": "8.3", "rule_name": "Lateral Movement via Startup Folder", @@ -1475,13 +1447,6 @@ "type": "eql", "version": 106 }, - "301571f3-b316-4969-8dd0-7917410030d3": { - "min_stack_version": "8.5", - "rule_name": "Malicious Remote File Creation", - "sha256": "a77b63c0cec99d37a8e4a3609137a34580f0cca84198c663fb6adcb5efb462bf", - "type": "eql", - "version": 1 - }, "30562697-9859-4ae0-a8c5-dab45d664170": { "min_stack_version": "8.3", "rule_name": "GCP Firewall Rule Creation", @@ -1642,13 +1607,6 @@ "type": "eql", "version": 104 }, - "36c48a0c-c63a-4cbc-aee1-8cac87db31a9": { - "min_stack_version": "8.5", - "rule_name": "High Mean of Process Arguments in an RDP Session", - "sha256": "5e13a7be5f8a00aa914acf030478774a709c75e65e739272b194674bebf33f1d", - "type": "machine_learning", - "version": 1 - }, "3728c08d-9b70-456b-b6b8-007c7d246128": { "min_stack_version": "8.3", "rule_name": "Potential Suspicious File Edit", @@ -1822,13 +1780,6 @@ "type": "query", "version": 106 }, - "3e0561b5-3fac-4461-84cc-19163b9aaa61": { - "min_stack_version": "8.5", - "rule_name": "Spike in Number of Connections Made from a Source IP", - "sha256": "65fe46f9242a840f6c97a70fa3782f5c6b4b016bf458fecb8460e3ca8e3e17f3", - "type": "machine_learning", - "version": 1 - }, "3e0eeb75-16e8-4f2f-9826-62461ca128b7": { "min_stack_version": "8.3", "rule_name": "Suspicious Execution via Windows Subsystem for Linux", @@ -1901,13 +1852,6 @@ "type": "eql", "version": 2 }, - "3f4e2dba-828a-452a-af35-fe29c5e78969": { - "min_stack_version": "8.5", - "rule_name": "Unusual Time or Day for an RDP Session", - "sha256": "616e8eb4fc391b32d81e6e8219a3c053453306a6048116d1e837b55ec439363f", - "type": "machine_learning", - "version": 1 - }, "403ef0d3-8259-40c9-a5b6-d48354712e49": { "min_stack_version": "8.3", "rule_name": "Unusual Persistence via Services Registry", @@ -3670,13 +3614,6 @@ "type": "query", "version": 101 }, - "814d96c7-2068-42aa-ba8e-fe0ddd565e2e": { - "min_stack_version": "8.5", - "rule_name": "Unusual Remote File Extension", - "sha256": "6e54a46cf82894aa5484fcd4379b15fedf0c9cb10afb88344a3035f32f6a5727", - "type": "machine_learning", - "version": 1 - }, "818e23e6-2094-4f0e-8c01-22d30f3506c6": { "min_stack_version": "8.3", "rule_name": "PowerShell Script Block Logging Disabled", @@ -4759,13 +4696,6 @@ "type": "eql", "version": 104 }, - "a74c60cb-70ee-4629-a127-608ead14ebf1": { - "min_stack_version": "8.5", - "rule_name": "High Mean of RDP Session Duration", - "sha256": "261e95ec78136218300b4b17a48e642b472f7a6cd692487fb36e3a707b6ce56a", - "type": "machine_learning", - "version": 1 - }, "a7ccae7b-9d2c-44b2-a061-98e5946971fa": { "min_stack_version": "8.3", "rule_name": "Suspicious Print Spooler SPL File Created", @@ -4794,13 +4724,6 @@ "type": "eql", "version": 1 }, - "a8d35ca0-ad8d-48a9-9f6c-553622dca61a": { - "min_stack_version": "8.5", - "rule_name": "High Variance in RDP Session Duration", - "sha256": "7b577644248850837c58cfb8850fdce3df772501393676bb090118f5ca4c3f22", - "type": "machine_learning", - "version": 1 - }, "a9198571-b135-4a76-b055-e3e5a476fd83": { "rule_name": "Hex Encoding/Decoding Activity", "sha256": "b6cfa5bf24a78049ee0f873fe01bcc14ef5116a6adf59b8721abeb11ceca01cf", @@ -5441,13 +5364,6 @@ "type": "eql", "version": 105 }, - "be4c5aed-90f5-4221-8bd5-7ab3a4334751": { - "min_stack_version": "8.5", - "rule_name": "Unusual Remote File Directory", - "sha256": "031fe3c29bbf87093165028e79236de7553cdf3f3f10ab76a86289f3e6dfa1f6", - "type": "machine_learning", - "version": 1 - }, "be8afaed-4bcd-4e0a-b5f9-5562003dde81": { "min_stack_version": "8.3", "rule_name": "Searching for Saved Credentials via VaultCmd", @@ -6776,13 +6692,6 @@ "type": "eql", "version": 104 }, - "e9b0902b-c515-413b-b80b-a8dcebc81a66": { - "min_stack_version": "8.5", - "rule_name": "Spike in Remote File Transfers", - "sha256": "0f4119237d356fe2c032c074c5de136fb71aec5533ecac64a6152b49c3b3f92a", - "type": "machine_learning", - "version": 1 - }, "e9b4a3c7-24fc-49fd-a00f-9c938031eef1": { "rule_name": "Linux Restricted Shell Breakout via busybox Shell Evasion", "sha256": "f5726e1a8ce8508e84699dd4648108f26b624ea175aeb4a0cdace248925f0d8a", diff --git a/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml b/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml deleted file mode 100644 index 4b1f99bef..000000000 --- a/rules/integrations/lmd/lateral_movement_malicious_remote_file_creation.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd","endpoint"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -author = ["Elastic"] -description = "Malicious remote file creation, which can be an indicator of lateral movement activity." -from = "now-10m" -index = ["logs-endpoint.events.*"] -interval = "5m" -language = "eql" -license = "Elastic License v2" -name = "Malicious Remote File Creation" -references = ["https://www.elastic.co/es/blog/remote-desktop-protocol-connections-elastic-security"] -risk_score = 99 -rule_id = "301571f3-b316-4969-8dd0-7917410030d3" -severity = "critical" -tags = ["Domain: Endpoint", "Use Case: Lateral Movement Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] -type = "eql" - -query = ''' -sequence by host.name -[file where event.action == "creation" and process.name : ("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")] -[file where event.category == "malware" or event.category == "intrusion_detection" -and process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")] -''' - - -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml deleted file mode 100644 index 233c5b43a..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected unusually high number of process arguments in an RDP session. Executing -sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms, -redirection and piping, which in turn increases the number of arguments in a command. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_mean_rdp_process_args" -name = "High Mean of Process Arguments in an RDP Session" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "36c48a0c-c63a-4cbc-aee1-8cac87db31a9" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml b/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml deleted file mode 100644 index d7ebe48a3..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/12" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected unusually high mean of RDP session duration. Long RDP sessions can be used to evade -detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might -require uninterrupted access to a compromised machine. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_mean_rdp_session_duration" -name = "High Mean of RDP Session Duration" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "a74c60cb-70ee-4629-a127-608ead14ebf1" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml b/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml deleted file mode 100644 index 3323a6915..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml +++ /dev/null @@ -1,46 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected an unusually high file size shared by a remote host indicating potential lateral -movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate -valuable information. Instead of multiple small transfers that can raise alarms, attackers might choose to bundle data -into a single large file transfer. -""" -from = "now-90m" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_file_size_remote_file_transfer" -name = "Unusual Remote File Size" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "0678bc9c-b71a-433b-87e6-2f664b6b3131" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml b/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml deleted file mode 100644 index eff288b76..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to -evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that -might require uninterrupted access to a compromised machine. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_var_rdp_session_duration" -name = "High Variance in RDP Session Duration" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "a8d35ca0-ad8d-48a9-9f6c-553622dca61a" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml deleted file mode 100644 index 218797237..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/12" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral -movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so -attackers might use less common directories to bypass monitoring. -""" -from = "now-90m" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_rare_file_path_remote_transfer" -name = "Unusual Remote File Directory" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "be4c5aed-90f5-4221-8bd5-7ab3a4334751" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml b/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml deleted file mode 100644 index 437aaf652..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml +++ /dev/null @@ -1,44 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -An anomaly detection job has detected a remote file transfer with a rare extension, which could indicate potential -lateral movement activity on the host. -""" -from = "now-90m" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_rare_file_extension_remote_transfer" -name = "Unusual Remote File Extension" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "814d96c7-2068-42aa-ba8e-fe0ddd565e2e" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml deleted file mode 100644 index 5b38eff6a..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected a high count of destination IPs establishing an RDP connection with a single source -IP. Once an attacker has gained access to one system, they might attempt to access more in the network in search of -valuable assets, data, or further access points. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_rdp_distinct_count_destination_ip_for_source" -name = "Spike in Number of Connections Made from a Source IP" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "3e0561b5-3fac-4461-84cc-19163b9aaa61" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml deleted file mode 100644 index c32204374..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected a high count of source IPs establishing an RDP connection with a single destination -IP. Attackers might use multiple compromised systems to attack a target to ensure redundancy in case a source IP gets -detected and blocked. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_rdp_distinct_count_source_ip_for_destination" -name = "Spike in Number of Connections Made to a Destination IP" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "18a5dd9a-e3fa-4996-99b1-ae533b8f27fc" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml deleted file mode 100644 index cb834fb68..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml +++ /dev/null @@ -1,44 +0,0 @@ -[metadata] -creation_date = "2023/09/12" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected unusually high number of processes started in a single RDP session. Executing a -large number of processes remotely on other machines can be an indicator of lateral movement activity. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_sum_rdp_number_of_processes" -name = "Spike in Number of Processes in an RDP Session" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml b/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml deleted file mode 100644 index ed4402ce0..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml +++ /dev/null @@ -1,46 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected an abnormal volume of remote files shared on the host indicating potential lateral -movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate -valuable information. Attackers might perform multiple small transfers to match normal egress activity in the network, -to evade detection. -""" -from = "now-90m" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_high_count_remote_file_transfer" -name = "Spike in Remote File Transfers" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "e9b0902b-c515-413b-b80b-a8dcebc81a66" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml b/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml deleted file mode 100644 index 7d1867075..000000000 --- a/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml +++ /dev/null @@ -1,45 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -anomaly_threshold = 70 -author = ["Elastic"] -description = """ -A machine learning job has detected an RDP session started at an usual time or weekday. An RDP session at an unusual -time could be followed by other suspicious activities, so catching this is a good first step in detecting a larger -attack. -""" -from = "now-12h" -interval = "15m" -license = "Elastic License v2" -machine_learning_job_id = "lmd_unusual_time_weekday_rdp_session_start" -name = "Unusual Time or Day for an RDP Session" -references = ["https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html"] -risk_score = 21 -rule_id = "3f4e2dba-828a-452a-af35-fe29c5e78969" -severity = "low" -tags = [ - "Use Case: Lateral Movement Detection", - "Rule Type: ML", - "Rule Type: Machine Learning", - "Tactic: Lateral Movement", -] -type = "machine_learning" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - diff --git a/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml b/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml deleted file mode 100644 index 11f92beec..000000000 --- a/rules/integrations/lmd/lateral_movement_remote_file_creation_in_sensitive_directory.toml +++ /dev/null @@ -1,57 +0,0 @@ -[metadata] -creation_date = "2023/09/13" -integration = ["lmd","endpoint"] -maturity = "production" -min_stack_comments = "LMD first package ga available in 8.5.0" -min_stack_version = "8.5.0" -updated_date = "2023/09/27" - -[rule] -author = ["Elastic"] -description = """ -Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these -directories could indicate a malicious binary or script trying to compromise the system. -""" -from = "now-10m" -index = ["logs-endpoint.events.*"] -interval = "5m" -language = "eql" -license = "Elastic License v2" -name = "Remote File Creation on a Sensitive Directory" -references = ["https://www.elastic.co/es/blog/remote-desktop-protocol-connections-elastic-security"] -risk_score = 47 -rule_id = "2377946d-0f01-4957-8812-6878985f515d" -severity = "medium" -tags = ["Domain: Endpoint", "Use Case: Lateral Movement Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] -timestamp_override = "event.ingested" -type = "eql" - -query = ''' -file where (event.action == "creation" or event.action == "modification") and -process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server") and not -user.name:("SYSTEM", "root") and -(file.path : ("C*\\Users\\*\\AppData\\Roaming*", "C*\\Program*Files\\*", - "C*\\Windows\\*", "C*\\Windows\\System\\*", - "C*\\Windows\\System32\\*", "/etc/*", "/tmp*", - "/var/tmp*", "/home/*/.*", "/home/.*", "/usr/bin/*", - "/sbin/*", "/bin/*", "/usr/lib/*", "/usr/sbin/*", - "/usr/share/*", "/usr/local/*", "/var/lib/dpkg/*", - "/lib/systemd/*" - ) -) -''' - - -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1210" -name = "Exploitation of Remote Services" -reference = "https://attack.mitre.org/techniques/T1210/" - - -[rule.threat.tactic] -id = "TA0008" -name = "Lateral Movement" -reference = "https://attack.mitre.org/tactics/TA0008/" - From c3cc01333a64132886c1fd59b892328988985c9e Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Fri, 6 Oct 2023 13:13:17 +0200 Subject: [PATCH 15/86] [Tuning] CVE-2023-4911 (#3160) --- ...rivilege_escalation_looney_tunables_cve_2023_4911.toml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml index 5c7d5b0f4..d92d5bb99 100644 --- a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml +++ b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Linux environment variable capture feature via the Elastic Defend Integration was added in 8.6." min_stack_version = "8.6.0" -updated_date = "2023/10/05" +updated_date = "2023/10/06" [rule] author = ["Elastic"] @@ -47,9 +47,9 @@ tags = [ ] type = "eql" query = ''' -sequence by host.id, process.parent.entity_id with maxspan=5s - [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "su" - and process.env_vars : "GLIBC_TUNABLES=glibc.malloc.mxfast*"] with runs=5 +sequence by host.id, process.parent.entity_id, process.executable with maxspan=5s + [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and + process.env_vars : "*GLIBC_TUNABLES=glibc.*=glibc.*=*"] with runs=5 ''' [[rule.threat]] From 959341284722715f6e725f18afb444a9330b2cdd Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Fri, 6 Oct 2023 15:44:04 -0400 Subject: [PATCH 16/86] [New Rule] GitHub Owner Role Granted to User (#3087) * [New Rule] GitHub Owner Role Granted to User new rule * Update persistence_organization_owner_role_granted.toml * updated integration schema * changed timestamp_override * Apply suggestions from code review Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --- ...tence_organization_owner_role_granted.toml | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 rules/integrations/github/persistence_organization_owner_role_granted.toml diff --git a/rules/integrations/github/persistence_organization_owner_role_granted.toml b/rules/integrations/github/persistence_organization_owner_role_granted.toml new file mode 100644 index 000000000..0d757fe43 --- /dev/null +++ b/rules/integrations/github/persistence_organization_owner_role_granted.toml @@ -0,0 +1,47 @@ +[metadata] +creation_date = "2023/09/11" +integration = ["github"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/11" + +[rule] +author = ["Elastic"] +description = """ +This rule detects when a member is granted the organization owner role of a GitHub organization. +This role provides admin level privileges. Any new owner role should be investigated to determine its validity. +Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. +""" +from = "now-9m" +index = ["logs-github.audit-*"] +language = "eql" +license = "Elastic License v2" +name = "GitHub Owner Role Granted To User" +risk_score = 47 +rule_id = "9b343b62-d173-4cfd-bd8b-e6379f964ca4" +severity = "medium" +tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Github"] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +iam where event.dataset == "github.audit" and event.action == "org.update_member" and github.permission == "admin" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" +[[rule.threat.technique.subtechnique]] +id = "T1098.003" +name = "Additional Cloud Roles" +reference = "https://attack.mitre.org/techniques/T1098/003/" + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + From ef8f5620e181a7b7e183438a75e01782e758a74c Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Fri, 6 Oct 2023 15:57:26 -0400 Subject: [PATCH 17/86] [New Rule] New GitHub Owner Added (#3090) * [New Rule] New GitHub Owner Added new rule * name change * Apply suggestions from code review Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --- .../etc/integration-manifests.json.gz | Bin 7827 -> 7684 bytes .../etc/integration-schemas.json.gz | Bin 2622437 -> 2622511 bytes .../persistence_github_org_owner_added.toml | 47 ++++++++++++++++++ 3 files changed, 47 insertions(+) create mode 100644 rules/integrations/github/persistence_github_org_owner_added.toml diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 897bd5e1acb4041631653990037606909e06e1bc..d7f09bdfc50b23605b29f8336a31105d265539e7 100644 GIT binary patch literal 7684 zcmZX3byQSw*EJ%DbPb@iFboY+1B}u+bR*qJ4Be@8cM2%oq0|r((gG4gN!Jk4DIf@Z zgU|D>^}Xx;=k62xoU_kecm38~_tM2YeY%``Z;5_y>*#Lv*4512*2$66!OYRt+RDw{ zjmyr>$r0_~N8oQstL1aA%N!LDM;UFd-7LQ!#FZG4>C zIxp{)nyxvU1w@}9q=c}|kzX%61N^hwFHc>FrT;{Xc5e({gKyrO9u7c-{sbQJtqZP9 z#OV(E2>D#+U|d$V%7edhMNoSVxgO)@l|KpRh2$>HohOis zw-OhtW&$nQ+;lM!F@pC)%Pg5#fjJ=`H*@)vy#hPVOXo~F2z3ybtVjDREUN2UW6o(u z{jNOtxKEy!d|s>WJU)vclmIyK{#j}vw$55^a(d3}!kD-ro(z}*4hYssq>7ObHaWo`iYGYew9k1e-3d(04FW%Q>p?AUn{4xnTxK#DwO1_XRVs*vN57%Vo za6+o9Sh;r^hO*vpcts*)@%nT%%hsj#jGHxx0!)QNt6c`iK?14G#3&|#nX*ljIsU8)V4<- z)#LTXWqi(~G5M(|6bNk5fC6)YILU_Pz-U#HoIb-!ASf63OQll>I@>y96foupswJpt z_GcEZ>0lOaZDzPKOmg0AH8Oj(dE$)M%Az|lVA3N)6yf6M@VcWXDWWGycK)fTgR|v? z994fvYA|@-rtqqPCqE86pXopUW?YuafkV^*W>Xjk2Iqna8W6HnHHe?Cv4K=Z4N29^ z!Omwbbe=U&n_bImEa}LUX4ErZTLBF!86$V)%L*$Y$z}1ukk*RA@4KtJ!SLOu1(4?M zylO~YHDp(f#?We9hek#VOP8`idjME&QShOv5@LO0eVPQZ0ohl^(^rI8*THw?3;yFW z{Kr+x9(O3v*z&JVNcg7?&HP|X z2z)fHEai@pYh9ailGpAiX|iL@g4Q=QobdIK2)%Ep4$*%QMErn0p>wUPh_d7Nzli7M zj#)1M4{i`!Cx^%tc89=e=OSqH127U?30Y`aeg%4;VpBo|8#V{4=pkw}-1k6@H5Xh4&-GO3=RA{xCtbk=b}TFehQ=c^Dc zrt-1~F+<_(QvXW>2C5@K^qjErXwuW+gZ77>vHV$dJctx@nNS#f| z>Vd5XEPttqS;PjNHY14HKO7M$cfP8ES8 zXrXLB7I9Ez!o9Q}N=Te?6?xS5`EoRifgROplVm|F^O{WKW1<34 zv1Inc+y~OX#mXGmVm02QHnb@O7~9XU9WCEqoN!K2ChG5S-?1$QCe0N1H1yxRKMW=O zcQ~4386&EEi;eXP;eX&AtRnb7=f8#wQ5P~u$V^B#@YFIq@6=F6N7ShBO8}H5`6Fkf z`Jn)1iGPL+U?kLrs5;69q|T39AkhFS(33{MBA+0#BCSbf+~_H#?HRJ903%`lNL=dt zg#SoMho4_!*5HYw_}J@dkFXK+`lJY;IzQ$=15!1(K^q-z|Bc&nJM<)C#mo+=Xs^prpHw?}3JufzE;u4eiLWzO-LagM9woTkn&V=uy;9Q^B} zI?ToeA4pQ?_!gaO22?AC1y0Y<30CH>wvzno5i7VW`d8MZH+~N1m)%V|9oQ94Wvldt z>}zEL)HN@~o59`C0;lF~G!(xivcrtw`NN!;UsN?Ozcqn7=A>7g!ya`so{YS>4rj-E z7|n$cG&FmU8eM2)=KL>tJo3W$zvgM2XIPia?Gx0@Es{M!4noWa9SHyW@Os!wohV3> z(;n4vw01#k=RG)ZtfJt=c;XEqY!-@JQ&h|QEdGVV4=U1x7jNkCIvUR&_J2nGAP0(C z&3P5I8UP`|QV5{l<*C#(%iAiT*vist?;l>vYaFYl!}0-vlqDxe^wdgsVj~kbOfw1DrW1 z9-Q$vE>Rv>&S_7^#M)6~zVFB-ao z8@HaB#6U=g&Zy6wd@TC?ld?v8UBGt}vAGV>zkHdLUF$EDDrat{@~>o~CKTX8Tx4`S zcA)7lF7UAVJrh=EtZVSWnDwXO4VP_tbQ`+&%DCSo(0b9R70?Ej(w^oypnZfKd&-4< z-dmv8$LRCA*^{RCqe?|yoioLH4cxW2tLATwL|%RQbG-8PQlU_90D4{QorN=(k%J|} z_c}l*I_10^u~qN&PT63=W!?_EV97*-;?CPQaC$@WrP0{sr?JJzI-@ArOV%O16RqRK zx!Om@&3r@iiugVLpw`PTiiv$mfuC8Rz@M6~bsnx460SIdzf*Gxn6?{O-G4LdGAH}C zr&IRb@Wo@BTx z4ArGdMrlU2?y>R=2((9!iZ7U5TkO5mYsd@Fs-kC#VLy^mo?%MYGxVWztefJE34E9a z9W+9Y|P@ z`fWrO$AM7HLwtrIT`x9-(yk87^B*KY;RBCL_@7{oYRoVmG8B&y#Vdd2SXadRs%=s) z4z#}K+}|pek>PWpPTKF4D|&Yxaw3&@<)ki275@70wXQ=FudEtM5o!@#i-@c$ASj0Y z6-q}^ij3mJJyfXc*}MB$#su@od~$b=(F8W%=a$Xpl*Qs9C^q+)mGmIqRg?61E+s=a zVJbdfWGR3C#gxa0Q#1At?xKdD*QLAgDq-KQdjF&=&2y7<7mePWT=!=Q z!@um|jM-W#-0G{${cJ;PMNY?~nNPACOP4pfv!8Sg&DN0HDc$x8(sm2A;cxF8DW~TS znF#4~Ic5a%E33N6?tG2kS~Gg-ll5b=;Vrb0{%bpoe8}@`DJ03yLj6$HLlIxg+3EXI z$>QgYbn*bq%l<{ou&<9-zPcQ}4DJ_RC0KdoN&z_J@;~ZdDn9?wS`1=u7Th>gC)XUK zE&R0e-AIkRmM+ErXRr%F`R~CLy?PC9`rP+QCOz6{r^AVu*ma?U+*0XF*ZLRqJsVFF zF^TIiHZopJ>b%t{<1!Aff@o2U-kFk!2R=tV-kyX{1`8A%yEFNT=7I;f`QR+HUu`-C zgp1Sp`*Doqmzvp!x?{LbgvxllCMLMKPG-vlE^A^~tyXq<42yC#U?ztH3!(<2t4-_A zk=xt(M6U}$aJo6X@78+-$$vz|E%J8J%ZfawmBTN>9q$X1vi6BB2yb;#p zM`>tT>Z|B>h2JRv&F>*-`f97_yXdGiZW&e{CZ=ef(9kyE>is%PuBItE8`at0hvUcc z;+i8C`Uq0PED~#+$VE{}nBGHE7|y|xNKQsusEjVGu zL38Yls7#pX$M|9HBTZ^ksqNQB(K<~pY&Z4X(oIM^&5Mlhv_5Qn-pO5vMJ(XI#k-Ra zwpkmK8zI`HTZvVL+up6PFOnEYtZl~cm|qlie>M?x;-yy!9xBi0S_sZat4yQolXz6Z z68TD~|AtV^i`8K}9K6NiWe_MS7Z{w7JC&5Xfh=|3C~dyNrr8tg(!Kxx01*habMYn( z3J-(#U^1wC-9&@NF|e~H5d1RyBU8j#&`|50ry~qfq!7u%XdLBEY(p>*kvAdu~DFmqfZf0tI)u8@N(;s1CxG2uughOC)zxxz7JnXKAE^d zlnxO>a)AHv&YeftkVlBD6QQ}89 z5+3Nuo|$RCL@OlNZEO$$T5&oP;{`Wml+^`!eTW(qOgG|qpcH8s*>}$?G#F82J55X1 z6Ny`)&G?{;Z)(uI_r67grM@3R+jmPv!{aR@_$EAH3*k!8##;Tvh-N5VN$}0@7On1u z&BrmtTaW9Hu`F*m3yT<{uI!%dvQCJLNP6YTrZO$G4u{5bRC~KsGgPg5JzkC;agywe z)oH_|a++dR_CA|twn^h(tIqV!F6*Q^2G8v};kHp7!)+e(b5aATBtT0prac?7f{Y#l z!Y0pD=4LJ&TPI?3=G>Ga&_HZv1h4Tjlk9bL{c=WTKu`E3Q%UyLy@&qFo=y1qM1irc zQZzWDZM>gV!Z=WdLSrh-E)`q^_>ejtp1Nw3yk!Udu+iri3NFGpiWbpTjBZs*sK#f_ zmLEcd16*)sPI*~TL7^i%ABWURrcL6~-_u)oA6nJI3Kbc<%(9=UW?v6kQn3XUD) zEyv~kqtDl5#Lk=GQuit!w@x>^^VT;h2_<+ID8a(|MqC%+N7pknCWcCmN@yH_5b|D;VZ9?m>^#GO4iZQ4IETwr}#6P<_IsB1_e zK^piO&Kper_i9Gg#>WR~cZCfO)KCoc-_*4oRBfNxrPe=28szrOoL-$o+bh|0jjd(v zte7lqFF-b9y5}^l62-W!C32n}iTyQKy3Npqs;*c9u+*=$E1nlEz`(Xo7?woenUwZy zE`?$fbSyt}JigiY{6Ol})-(%w3Sc%{tmkmgNA>7Rkme!iF=)L?VL_l{zhvpHV9UtGW$a%K%=4yvzmPX z^x=yhWZFTe)X`*m^>jMT0?AecSDA%@VKpjYQ&z7OkKMbsc+5#5W~8v$B9&PnE}Rrs z#25$ee^{_Ta@5V@eZGCRf6`;;Drh2VP3Y9~=e6Mv9O=tS4-%MQe2NvIL3-JCT28xZ zmr*EpivyxvbRp}Y{grZ~@nvoax8r-!Tc!~Iy|LRq%X+hmSh3;U>;TTKCugMZ$T*qj zkki*-6|Z~`Ym1I?49QoTHo<)SLF1! z>2JaK$cr6l$DKvg9rCPnV5YHH?PB!fCkEpzL}R@i zC^D(>@M!E1+(wwpl0z@*>z@qBUFt}d_V+)T>&2<>LG$Pxc%Dn&A2C$_^U5ZzG-RlL z>|Ci{>VabFGvmzmKd@haoTKT+G0!|GHj$)D| z6hh1ETRY38k zCChqnrx_xmEw<65$coe)Qm59!>?Rc|4j+G6IMsnI6@tDuF*wyF4LJWQ)UR>?kQ)HN z1$i=N^)hSp(L)w~3tH50EyJQyjhIRYAuazb=0LwOCTE@Qs25jDk#{8!1+l#x8ofz{slr@=r z`?pvA?5ut|kkrDbsp;Tns@=|jsu%BC#j{Y- zBT`E(#ge5=<;N&qfu_D)5=WUpPW;fWXW>QDnmBsLR{1u1ncsuCaZ}R6!Z@z#zS!u^ zKDgOgVdCWedQTO|35GCD$O)7#_G?{Xm3kZlHS1jx+YqMzQ}g# zDquuo>w;o8F)+i}0sYAg#5kHP$=rZ2wMWHII;OZW(KeBG0Ra!vy!B6lJJ*g zGStp8NK~TSY?S*slfeb$zKUTb$>1a*OgffcM=%avygPNLk`6rg*c>3cgd91!nBOh# z&s`#Pky5GMnOOCvc5S&z!9rkB$HPY}oiA=152;q}ljUAJg>3L6+JEkg9eV4!Eycnq z8TNV8s`cFL6-2thzx&89t(^B=d!kx8^)C>Zn-p3cBjHQZqkN-rMvuK_2&(seAD{Bg zrwbJ8z*<1ziJRqSL4Tgtul8^RwUE>oRU?6bS)DqjnpZylkMYM3$6c35G>x&JCVC}0 zz$s_L2d5MND9QRYlhj!T@8`9a1@C{+rr@I2mGGRS_j_-MIcE_X``CoZvgUEFP;1>X zo-2>TFXG*E?f(1gJ)dOmg0#S^%?q>-MYMU2r9Xa-Xw_-s)@f=U%9FO-?KHyyOHpR)S;$UP^#h2 zw-Sn=m=QrSNWA1rd+WTK#rtqw)WJX1{BUN%fd2Y5h1I^Fp|F`)-Hg4KMte0K^o8^x z^N=U*t$-hHM5M5@Ozf}a4sU~+{s^DeSIf;Y{44~_Gk9|*R^O;3{1Oh)I9fc1aDd#! z$ELGBDHd(pDvvQvlIl;AO8aWq`zFh)+A6CO?|jgoMabP%K8MH(A1yQwDgs<_iZ4LDR1-x zAw)FoFO};2{-=Awj6S@f=90s_{jIIhkzTLw*hK4cedO;?#UAZ%mlCZf($Z(zF=p^> zFAQw$1E#(>$-Dhftd=vEFC8A4#X1k2IhVdPn3Dl#myaH{q(-4l{InN|m+|HIRoG)s zwo@u9^%!d-`6r;LFdSk()^@T~njm&-`j-fJw~!60=L(Pc`kkA$?b_RVIzM}P$-bk^ z%!5CdCKuYzeBRG2f5p*$P#<|Q=ZmZ#yb4{u!XVC_qRIuXxt(*h5!4<-d?}10-gq0e zAGk$bwD>M;Cm*EvA{l8Ql)3drgASvh6Zo;2fYvD55707&BjK+8q27B|hL@Uxrq&du zn}68JB~F`TI|5Z0?osc8Fi@S)p`qyVF2v5g!8Y{_c!@n{6AKZL4^{M}_*P z;5zCf1vV*su~TRya@UTOBpuyh#fx`hN8b(@rEz>!@zLn9`{j;jbEvB{#o-L1xP^Vq z5r2uGDcur@^mHftH8ZX)-3mg1K$JV@cy+$L$Maa`%boQy9XZ{^U-QmQ;Wf(cKOZeo zwh|=O;I<058!;FWy4(NqwQLotm`0FEx00Yd1qLHbRE{i+tM$3vsscQId1BvSwQbBt z=~Wxl{d@*N#@~wL5MkF`(PIZKt$a$FS;>YyP-zni0j0^kh zhZpwmo;OCr%ilnQ#)G}$csnv>b!v_f+7K;Z#*V0VaQcPTUY5Rm}Z7f;^ zo#?YZ{RN-Y2Jh4cW2F99uA&pYjH?Pw|2Dr4#b2UhyXjUFzRh<OQp}-`_SWZ1#CR8XD?PTTUazlRZr0Lu98;bx0juR(F|G4ol4cgF#7b0ZKIoB-u0_;Pj39wU-+rb9BOrf dY7`#%UpiGNkIbV{{}k^DffUAVPJ9?>{|~`F9-N}Zofa+bQYa3^i)(NwUZA)IfI5tydTN#p0nS6=VX$ZWI_{zjxKwOZT0-o&dI~d#?8#b&e@3*Xy#;RZRPIa&SmfJ z?DXt+wxRp7d}jC~=BS>MPKnv4jpk49UuUWQE?hTg6CgDNkjhH)jS}@BNwSXiKL)tc zT7hZl_&U`Xh6A}BHR!#&&%{@3`6yN%0|DaJ&JTUJSCp=AI?44wBx?cMq9r*u6TWZa zYLzIs&xG`oKi?m-PE>d&D%A0DJX))QZ$vXUGx*i4Gl;p0<^qz7PZ;WsrZ?ffel!pI zju(a=4jrKB2ya5GIYH;oeviN#_{avmayef1z)dj>c!LBL{c-Aj+Eh6?4EJXhFkw3L zK0W6J9i^S|fJUqDKRY{Z+=!a|7!}O=kp$yY>+^p2yKIrJCaxoLqJ60Ix`UHOp$Qf! z2hhJy*Zcf6;;L!pyMI0Unf}QoXie+J@NK2Qg!aWF*r%y679o`kd-aG+w|{-aSz^nL#2Vq1J16lh!3ScJBP*&*^H3^7{6qxBhSW+VnyG zFN8BY*8)bNu)YYE@wtq@M=R)Uihst^z)8&nif*(@nD*ce%0;?Sn*B|_5I+vh+6NOf z%Z_Zhn7`Yv&D&#U*4O;uvDyJYP8m4e?u0;dCzmQM*C%9fo!o?q(_xL<7Sa|wv_C&% zE4vUnwgs>K8Ic{_r@8jp+XGH}=?fgTZ8a4B>su;b^>7ir64E zY#MW;L^AO-GOnek#@PIzi?d^-tDO0Qzj-r0;*?8E|FH`Tc@CB;)|GW$#=+F1{ z{JH~sMgo7ZqN3Y3u%fsU5krfn5>YOLP)v)ilB2lNRCZt`_`7H2-FD83%4>kp$<2E= ze|I%E6<4|A7W%bO&$eE#QNS-U4~;4!ki<|7OU#=9;PcKtjiA0nsU>uApo`^e1LQ{iez?b4cBU_7D0j^vD>Uv&z$|~r*TWlbuR(;|UKkZ;+|~&>=|ik*++-G6%rQwcaC{yuuMio_-bmdh0rtF zbVII@!(3T203>=J4(d1{pb$SUIStw+Fp&BWX39R{CV}-qh(f^@u|cyyV)d5p!nGBSm8G9b=@XnaK-9 zSb{S6oAellCVwHJZ0XcEN-2e=5?DK(5*1O=?C+zojtkaCd+NDdf6>M%Es2mYatlTf zA|*BzhUWYagH6Ti$t}!K%A@t7 z&|VQ{fg5vrG|pM-a*2khV}P}}?Aa6>xKrL$lp4)yCzP=gHxx-r5F@ONQJVR=m{0Q{ zCRBUzbm#vPVcAk1a&ClYi||`7#Zp2UU5Y~TXoPlxy(wERi_WuBT3Dwxk`mjGpO}ba zKK<05DjS%kxQdAF^A)HNkzhnp0WP8k^_}HiW`9ZoENiFV5^GW=DC2*V&U(7{$@Fir z5+GZwW)NaS+X5mJhov=V_`~IcVF^ENL$qnHRr?M7668hw;9byBD2UXD?_HlSnhCVR z>zj%Gs}=tSXJzhQ&&H#?+MyCf^+XQ>ph|_}V6}FVWPLe66<;n19|z(|ph_sG^&dhY zS4T%7dqAJ5N;Dp9i(eUIi>tv$3X!Vkg0#p&MI%w6t&!UVa%cZBsS$Ao{WBHbu{#E{ zBR}~=ysadq`6B1!_>_oLrJhJVwZrS1HprR*v+MywCT(=MLpFY8k}a4aGfoCkLfj?l zu_WXnUGD_JfY?5f_Ye)dY%(Sk=-a5GNQhZF{?kEK!ttJwphQT@oqz8B-8TLt#>=mO zZb8mf6sX`=if%!wRR#p1dm=;#!tz8)cCg5PO+{GgPpl<{noO=ow;hd=H)(f`_G)Jst3rtKwGO1Etqp@?tQlA5t<~s>Jo<3 zxp!R@*=a^keqFSYC3B9WNA@c#-kA$3Xk-@T{I=8Qe@)wffIebWgo*Mu=9dU|>|@nF zL6CP?&%ffS{M^Nl(`PiOd#MMd=XRt) zvQnKxHYs&Khai$!4eqzsm2dK@liM8iMv-F!$)%|v?2_HQEZbw@OG9=Zq?|>tn9(;~ zE1gr>s+mrX(hoID-L3C54+OKc4N-d zYjL*RajcHffD#jl#dh(BH<<>|bvmxHxx3!{L%FDE)Ufg6^);5Um}2>Z$-oB( z=+Z>A?z?31$8RocpyKN4O#kSj@|(G{ZQ?0%*&hi@ZxU z=`#2JWz^!$&j0;GZrj=%FpewRb)LL-9dmKsZl87&5dL#xP`V|nLb4WFRW|{Qqi&6s z=_tujhctTlF^MrnUsyha%DUD~g}qLbb}^V~xj;|-H&e`#cgYB*c`e}xE}y=VvMxk` z+O}2Vm-o zwi$@{yV*gJ{|=eXVZV{j^sYRP7uUXIgbfi4eJ!Ip$HW}7aj2g3jmqX<{cZp27*};f zossE3_=+j!pO2Y2hGZ7uYslj%GA|iHMfjcuOVzfH`1ICcO4eU&;zQHUX|0;Leedmd z-yKa?Qzz*3*f4o2o(|+Usbg3iOF)E}3_ocAwt$!{3bFWvdXmnjC6w^#H3T0Xw?5+7 zV~B_q1xtwbRK}1^k`|1S6hx3kXx8{T=HH@wvgF^!=0nizc=9oe)RB{C^Ft|Il4l7& z)TeVLJ-4`c-UWpR1h$eNxA|VM9I)ztn=57*J4i22!ad+sl1LM&eb4`xEN|w-IfMEB z1a(z^#PYDNO@uOrCFYvBWHZlsYMUnnMZ$ zPA!`%X0e9RXlLeKh=cyVwv-CtFgqPfu0a$6yqI#%$2vAd}B!mif5Mv?@k0J1>Rg&1`gid9H^t`XaKT6hp3hv7u(DV z+{+I>XRfHfEmQ?U0|QLO^l(ojnW60Qg85(o7&!d?ME7!vw(4_yuiJr!{)EDdcDeI1 zNg!9A*ACccToTxr7}85^!YhHL-bnwadn)rejXIfu#xG451k>6%>4a*Q;f(Fy5B(e~QDS=0I|mbAEE_nnDN9@FLJ>MCJ0?RkA=ey{A`vmm(=#+nyo?o}6=G7s zlE4C4_1D&-)sWTOEI}NLd>GPD4VERyj=zBHYDWvTYCri+m)*&)fYF!%Z^hC~;YC8- z;S+YPMA?Bd)0uVK47q2=!-^gIrA#BHF%k!{P(SJkvin4ZJ^HVpR=P6rPRd-jnf)%k zX2whOur!gPgT*BKu0Z3iksu)qw&M6!M@$p_s#LQ~IsWukTJgRbc;{VN6- z9^m(7A>x(-DbCNbnqaCK?G!ekL7bojy)7q+}_>XXX4Rv zM7Br{-qNW_(F079I|^K>i2AsY?O`DAVF>t6OZpmJ7E`e*!2OnSevtHN(EHIU zPC{ES5Slu%L^FxfXu8;1KhkiCCnI@BT&a+CKmMhG(>7`jQY#j(J3YmgCl;*>om!Ig zBdS!DI@sXxBC1pqiG6|4KuIZf${EvVzfmjO$!Df8pPcwm>1C3}00mg!Rl6aKWO3gM z?H4eecv4j1S%)D#K68{LeaHsEaFT2ue$NT|EGxYvols6tA(b^_E6899lfuA*hDw3m z&K4Tr@v;(UK%@^lt*pT1{EL)6=OV089RB_e}MK2 zg7OllTTBk4oA%2Fl6SF?>d;or2GVsg`ZH2!JQ{v`;Il3Kdic(_wX*B?x)hvAd=g+; zFMi|;BD*~5e32>IQ7~}DN?IXRqrF9!K=-%}*?C}FFyC~L1s)P7xSzz;ezOm#S8hGl zRcQy#u2Oj~J6<#)!>PPQ>X9;WalzTNNk>91W^Tn*#$${VR@dWsX*@I{$=r)*iP>6AOtU6sfx>Y^y zb$Bv;65(J1Vf(vjBTm+=c5e_*c=9jfnjL#3jkG=2IJzxDC7;0r`u9CcMoe4wN(4K` zz^XX6hQjCT^__!X>9k18j#ca!yd41>mtbk)>ShjtDovXB!!+jo$Ju8hmA3ZsqkR|r2n2+dPdWPgZ=z;zYuWU`= z%@lzlak+e88q*sc`BSaxhPM#}f3N3uT;fCn+t(=o^2cY**0*?RSFlEtGl!+9LdO;DHP`u%-Z8+pcXKanZ#18u#lvWKf~xHKw8lfW5Ry%=x%Fw@4& z=l8j;t&-u4djZWXnZB;6m5{^jpI?c>l2%4y*?(DTInka`t}y8RP$G0v%T!Grn!C;9 z@MLniG0Ukanrkx$DT^|9T$Eo!sQz4La*TZzBmLv%<*ZIYDeLgFTHn{j4ev|yMFwDC zPk?#U(;`V_Az7)BRbZLoO|p@oKu_qn07lkIxtg+PbDrnc0s}x`sIYZ>5B9tKtx;#I zo1;^aws`|^jT%9j1G;#fVzhvUe*?!Qz+6R z8nz*C_=2b26J>tH#*zDNS?Zd~Pt=$+FsQ%8U@oHL2<8?j^eUSrlhH!|Et}8UIprAY z1(|Z}oO=0$FFU7PSnC+CfL?gt;#NDy!5Y4$tJJ^K^aI7Nx+pqH%i5np1GJz|raqsl04 zJKwqM`B}x&2+v>e2@lrTek9h*4WnLJQFP^?Fe z0Huzi{MAMBH%2{+kV2g%dqu06O0?YyWAQ*rU4O`ArUo1 z$k%aRb-?1?fC3wLL$gQU$zm@Ce*Am)4}v8@tSnGhOc-A7`k`*=$ z%M_}p)2!S;@2g53u3aKEh~oz=nz%bIf9*&~XyG$?RW(Twhc=ao&P3^};^S8CMmUNN&c^_TEd5bvESu$skU*RZI zgiQZo$gFdsMNn`mYVSvEndyDjFple5^?D9R%bv6_)v;bF5`TT6dJdx}`EFdA7ORs3 zg%JyHD});hq{}6mj5WcbxYeuB@@uTOI3?zp{;?Io`2=KN_0c^=e&{W@O-w0-3Q9>SAj%37_n66PqU_^Ewg`s)1DVgB)I55Jnk zLacsb;~`sH@^9=19y%uuY|qz&z8grBL#^|^?}t9V`|f1Jxv1VIxe~u*CG#7}Q^X#G z(||YoyCi^V_S6Una?gWPd^oQW^c$IDNo1m8&RBRSaEW=yzsSyXxo?eqX>drq+){*d znRy75zZ9C=uibe&_g3D|w9~qUL%ez^4OF*&M%`Czk|^Xj(8Jp*^j*GJPZ=c|LyswT z3*|)^JJBGRo&Zye1N9>z-4_86)KJD_6dNe-1!>6If?QEKjI5Pgyg z@1EnZ713TVX%QBGG0KRI3PaurGEzb}CoCy$1}F40xHJx>gwitwYl&7dL>7A!7JC~h z;j5i6ygz9M)8?!zeO-5DloA^_OGMEk6z9a?%T5pZb-=7Z8O=(V#YxClluqxuKrdB} zkZA~6olbv(kRmaxgt?sHXNkwMgj26ruRfo8P<}JJ^&z)bIP!$U*Sr6=Y}Gl>OwP5{ z2l0Zep|ids8M6A;9j2?uodGhp4l9D4_l#HGaQPcEh+*|&;Lo$F?M8ASj_iUBn_=75 zT(Vc_+lv9zD=U{n_r9o(4uebhi!D-Z#~uD|)8QD4E~i~4-O zk{CVxN6M;gpN2@?leM&EWXmMqpxf-%rh-}{x}3u%stpdsV=#FwmnJE_nwIikM@X$k zM@tAbZ|y!G-iEg8)^gCjf=rcSkpsnE)YA1IdxcCsrzSwxRh=`{G6=_k-Xgb|pi~K( zKJE%*_Bdq(-|jwqYWJo7@Bbv0oNHRO%7XhHOf~v~CIMADja5=UL<>dQbCe!=GsPcs zLef8G4XHF614S^}FD5lUIEk^5wonsKkw6`SXOBcy3U+XmJG5pFYSO20#a3;7#S=|F z@^u8MsFA6v;qNIG>?zTUS@DU<71~g$PBKlq#}@6V?~c@r3>gW}No+?O`}W%UhA660 zsHzd}u@>yH(u*zI`U*tl@Z6TrMJnLf@rfxF7RMG951)rZ&uuwLmTj*bA%2a}qeaWB zLg+a|V$SPK>dJ;gGUGqO{l1gDt#J3qiyRA&jvf31v7uex$riftLUyVGKa8)G(}zvd z{I?}*@PzI3Gc)Y)np#yUA{ak(n35P-b z-TVc}b9pFpY1iC;G)~ej?PSJHGHw8@HvqE!(~kb&(8)J#$G-i&2N}lRV&-cXT(w5E%s7z8?ymoY7h{v~a{qE~1Wa8Ri6_n5v{|IYp@kW#D6-peCTKArh<~U0 zgY1n3IPf98cx}a4RA0@qX0@fg3x@Q4?X~GQjTd#-e{W`T6B`0k8Ul521nb2a^#ezJ zWadl@UhQ=luRM0_NCV(&tk{>%?9X?A6Jkyx_SweB9!-0f&7rjlq(_a=Z!PR=PFO3{ zO{vKn8##MyQ^5T4NDm+a8~}T7^OmLO_ui1HIn4}cRK``&LOl^?v{p_JF?wSf z55wJC*;b_8#wna(4_9r60`^D`MubX{ZN)_N*f5Pf-qd%eI8t@QEjD%gWSymZc_;1e z0t?t}J&2cZht|rd%NePv=p8?b$1hs<#lq`Ie&GHFv3=vlyI?FXA|F=?xc@DGbkL8^7y_EvA~D_;fX< zX^6b`67*$hu87!wAli9sXboU=!oj>~tN46w#0~t+TkeK^v{ZbNCQ3BigFe6fSl8(O zCiVPzNfez%Qkt|XZbW8tG9g>Iw)6lN@$&qDz$7;CXK?^?x<(Y16ypR)*#w=<$4Pr# z8uR0yy|`=j5kxg2NZAOT%{5T_R9bz+y+D&x^BL?0E6<&-ZEQ(yLiu%o3Yi` z5A!yyg5F-is?%aA}m)G0gS6Z5_44jp`v}qhZg3Mwv z`}|c8b$53O)vICO>RQoI1?sO(DwJQ3r>*oT6eSXhDJtn|KF})ayn6XLhV(_nkK0_D a)k?n|6I2$@XMs1Tk7;tCv~_-zXa57zdr>0* diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index 930510ffc4e1e59ea2339b548443d2ea0cffeb7c..ffc241b0326fd967b4b67c8d0eea9d4e2a82fb48 100644 GIT binary patch delta 14452 zcmeHtbx>T}_9jjzxVs0M0Kwgzgai*3++Biu6QFSk5NI5Ny9T%5?(PACyE_cz=H7ST z`%S%?e`fxey0xlye`m?r>qxErt$lheAPu@CFbx_&76Jg+W;_^v0)PR~U;qpl01F1d zfdTMf00J0*2nIarpMe3-!2l#M02vHG0RvFM05mWF9Spz#12Dk=EHD5Y48Q>caKQjP zFaRG6AOHgh!2lvKfEWxQ0Ru?E05ULu91NfU11P}&Dlp&$7(fjM&{P6|@v)#+GEpn9 ztD9-Zu2}>wcFy7|XDp3b1l->}3kGBZ($Iez^lvxoG?GKrzNO5stE)Sa z%A$%PlifE5?}{^t3G}X{q<{M=SkX5e0)sCol`Syb$GK&9Ger|gSYi-cQZ8f6#5V?# zS*D2S`IeKHC5pQh%bFB~;y?q^c6fQS(X4j_8$zab`+WrwSE%&zQwJJ@m+sN3hR&_6 zS0cSx^%`5DMTCN)9M)XHvj%W*uuHV6nWY<~BF@u#!)b~+R!W@%pvSUyDM@haE6QY$ zNX;?AD?FtH!E#^C+Q~y}-pnpa!YEX@r|QRzquB(7E~)*!K= zdFiL_*`Y=NYw=#iUX#B*sni=a*T^g;FQb%x6K+%`3pagb<}M3Me-s{0s3 z!jQHB>PgUMUs3G%=|?sirHbhG=dH-L763jaW#zp=*o?&!W5dN01l=Wj_~k`=_#PKI zJ8jMQ_&2Kd8peSsMaoj_hz86#A5i-Zb$68}Yz&xF8@isQApa$y6Y9)l%&9gBSNPR? ztl`|DsMbXDoHbUqb3dw<{VSWBbWE~ArxN;i3lno z51u9^$-XAluu5W(Jz zp_l)M@im-rn12a|p19vK6X?WUFLbKPdMI(pCewB%xA}S!#jyA}>s?BlYsLj_My)$? zbYr#k@q^*UXNx=%AwH5e3b5Go0BqEk#ERURH7;v&$IA6)5JqORIHc;J?Pz~^ajCJneRVCu+F~DRgMMr?jvS*v_ z(rUA~-$Fim$dbr%vU#FBZ~UOVET&snd7l4F*@geXlD+)Q`qIP}W9>}F)A9#(+gpDK zG82I|YlERn&tcRuHRwdU{No&H$5y6LR}$b`J?PbNd}Sgv;z~ZcN#(^SwQ9C^Zx)0% z88YcDURgKNsVS<@1Sact!duC4N8zB-63cU^*$OXvd!ZnHAucKH+Ce+l7!u<;izs~i z-1(f((ZuY?rpZB7K|8{U@THdT)zydU*%`yo3~nr*NcW7;Pf2F}O&%U7i`}=qtpjGU z>xQ7!4RSY&!mL^=$9%5kwY3Yjhk8nszIh_G2Bo(PA;YN{i2g*VT*TJg^R_k1fv{Al z$X!=V=!jL;bBw2T_bK-5*L7mF3*!jQ(0ty*%PWaiSd90EA%*!E(_pD*5tyXZ{L(I8 z&^JZXkfcuC9mR{PH@GSm*}o=2&q4WUHFkoO-gC&}`lSMdFuW*l#V>;nv6@AMA_arE z_r$j`#8}9(`n`u^Sv{&(Q*t(MvKc!rUy%}Ohp1r7O15Wqm8~S1@I4rxLk;^*rEZ_j z7Cjpe)V^r>8o177=g*2@C&-3iE}B;hdmLs&XkJ`BXnZ_@gbBf##7 zUoUbdc2}5amcKj2T!lKB_FAh@?_F{s#ruUXZcsEDc^suOXSKLx5yX4~nsj^gJ4fFH z9N8%qet6ys?wb<(Lj$p&|vPzV|3ak zDvG?9?t9J7CF8M){MKWKu+wXw5c_I{BlK#M!_V??ad05V0{Nre^elspyTDlFeqFI38E0EJ3>&L6=1G5jTXBDp~Rjv z4Dj#061?f^cHay(PgcF?{&q|v{XVAHt^;Z>jQjms9MqHx!S+}nKAyg2;75v1@DrHU z3RrMd8^4{z<49gQcOgntC0n&xpK)Y9bu%#J8K?SL@a*#@ZaPeAS<5;Pcc?A?GIOh* zUt3^e(y~Hp#w~w@ow^71wjIclCMv0DMIQDBSB z+0avSK4_f={1nREk{y>-QWbuCewDrX@uK?^uHXeek43mYax!a5`s3IF86I{3jmW>>XLz7{8-`c;P#M77= z^^;?hYOIe}%g*gTm0c z-+PvY4^xxcM#_w>HQXVTn7K@7RV?pnC%ld#(%34#`@v?rmR)W?BIs=?BV9?OAhDow z3ew&!Oj6OP4Uuf<(K92LpdVULTS`9Blr<1oqH^I5$eQ+u$sg+LNC|Y-AzdzYQ57s_ zxGuJqGOFs*?r>S^tC_>5Qq^6I4%;z~v4(O~HkEQ{JX6(r=lyd(bg#Jsqa2ZLvg(vae@; z96PB-nlYxn>FRoLzilZt3fYmO^(@N`ldxhiH&7r7nU%lR=OOBw0j;4#HAy8KU8p4l zuOp%&jZ~!Zc)7h>u_P|eRhA+#e@(u674JPa-+lVPN9Gmq(OR>UO5k%sn5vj)p*W0Y zp_-`eH%o38$w3v%mwTU%()EXLE%E8|IbNtp6KQ_)1{m@SRjH}OxdizMZwD3oN+21) z2jO-S;xUDy6AVQ#g%Z&y;6s0QNnZ|{o#(PabN_VQYp5kosW$`2BCX0<*MLAT069SV z*Y43D$8rjYNku=ExKqt+nxNWLc&ZAY2Tmi-;lu1iaafVo^%Ms1Zvqw3CJz{T(fX&R zsWEz0Qc1I&6rs%$!j5O_!Cx9>Dnf$HRGI*r{3S|klLA^sZrf8!OW}Nqd!s=ra+6-t zXxgW4G0LwtdrzhCN(U^e`cy99wZ5xkuTx5_T@ddrTI3yAOyg&k8!!DKq%A;dc(2UE^i0U>79jbng}6nIu}T3=!A5Q(#IAkqL9dNA zu=&sg78nUpC<4y@+MU$0z`<%_3ySII@lZ)- zh$qhfGN9g52k2C&ih@lX6R#}UtcI&Msy(G*Ke9d}G9sTrhYlGaDJMzbeh~xlsQ^-g ztkZvpTjIJXZ_M+v&E3klPW$9Mj zX73_B$$YjD5M2+T;~VLdk0`Inq1}7#Ga~NtjH+#;`x~O$42_oc!|V&iRmc8g<*J_D ziNfoWm;6z@@#pN7?_aPlDEhONEiA$5Lw+s+xnS-rAtXP5s?;2>6OWIkYYpkKt^_8+ zWtG0?e8p0Jd3u7ylTd%t&(v`nbhDZTiT?qlKr?(G;#qp?Ks@oEIuJoM(*`hNiBNZB#H==7q+U4&`Wgg0ETy0W9KJ$q) zfImYy39tB-6Wk9@I!mbj00t+vW^?BmOaAnO7B$~W#5jbo>q??4hQv_h_*PZ}nUjVb zu|Zu#-eS$bTl8!3O{}kSeu5aFKTs90QhP?%Su{Zmch~in5AoiAG-K;$c>B4Y9}QxG zhB--!QJH7e0$9C&pWqoiQ~7B|9jn|r8*xA$2bPC2vlPU-0poWA(Q4Y=+ksTw`XPg< z`h%kO)@qp!W|TdzV{zPNF25yoFR@FMCr}DOhQ@(=k1j7F4F3cc zm4rJ=Tl%TwMdTO8r6p059%OY z%^LipooHUO0ws9Ek0>Lq+@1wh#FHsAqY=|g7ta)iQrBP0sFAxd=HY zk^Xq&nR4c{6ojaRRd%(I(o*)=P`q=0YAEIvHJ=)apk@N$bs$Nd}MEH==uW_|uz5LJaxQ1=ORrIQ(GO;4{32 zmfg1THSt<1cFTtvl*14&SiL=#j-6S(5T8hBOW7aN3{|aG2!w`)j)Z(D0%j0QxX|*Pf6DdAy$=$1oS~y0Uz?r; zUJv(_KyZtJFK{7nqFU_{X5Dhlx5gDWyghpjW3Z`_+*NWKS|eh& z8D$~H6{R;P*~)j|y7~iW%(WJTr4~p4(}e($uLa^j^lE|cKnNw&UGxC0dtF`+(z-m5 zVLYSSv2$oW}diDOhckUvg*UTDhJ+9*?oUVXpSxPv(mHb2zzp`t9-mvlSFtpdO4)@vQ4nyL433pQkFB)Q(nIMORR94D_@Kvfo-}j;k|`ftN^+BA00_Hfq%&c*K46IqHkmK?<4So zuRyd$2!2&xmg`A?-_j2fuh%y`l)hBs7SYaQyn1(iAr(A;jBB|~1vt4)oB_z7X@lq> zRW}t_?fAq*zvKqV)^Z@)SL34JCUeySIWy4``Ah1Di%@rchB0}2+3%JrYZ6f zP+7@FTT2m*BTK+YsgJcJ{az$&7T-C#(FS z%0SPb(`HQX%$^tXS-EeUil?XX`@EvEiNKDKVy0d#djHi_i8h+qe{5JwNe4ol0>lTQ zID9eK7Bf*>(U@XBx1UPu#w*e5mnxw!^u2Hzl+iH=fmg%xTvJ$h3>VtpvZ)gm5M@9X zNEf)B`uaVjNKsTP+{!Z@E%`S1R)x=ZmgIoxlYtRRaY?Kl{!a7^O$G4(q?duLH2`Vg znr{zxs?i#siVqXSz3H*|_!1xV>b>OD$=W`F+%!G592)cJT@~ZSAD9rbc9_qznp6!V zV2C{2u&2L2?ynT3=|u>BmKuCr{^nT1oe^U1HDqMZJ#JsCiF$^6uAFPUZ;WLlDJn7Q$BUTKi!G01}OxYoeawu$Dcj!6S$RnnJ9SaHgy(%Q>?l^Wv+~V{(8*v z%hY1g(7siI*1LBV#}dLDuE_~y`&)ElO3nB8PVyLnhv`!Vh2|ov*+Qm4 zR@xO>Rdr08Fxkv_FX@_NK3-_Q_0(x=+Wc@J?|cH5uHPmtocnsSDfZ(#K~cS))I~xQ zX|DHD_ScasYc(TX!{8p`s8&c)29Ow(MCntC)hY|%quBL(0tXDc-_+)zMX(7mbFq*P~9)&1q*(Qn5--_OJqs19&G@8aV;_DjGaSee zli01kdFj+evxk^xR$mw^Bueu+QVq?k!!wzwe?`p`ycOZt$$Zx$OJHoZQ8?x^Ghu-CEH1fCdNdSYSme@fD`ac-%|dEEm@T&61j(u`F94CCdV4<;^{|7 zqcblN)TNWxrwvlrzuwr|RWBO@-3Yc7a4)d4v_zN_041Tum&Ebs!c23SeS12I;^qzE z>P@|z@p?GGyD4n#w8(ev2_NV%6Rcmh#ZT|sz_38dLH9(H@5>+z-+)A*v*e;YUfxXv z+Z=bK9Q4Nz6p)T{PIa5FK1GW^v$hl8%&GSm-`dwF+B|-sc*C#9(sn{*bcpu6r;qb( z6QC|-*I>|P%Wb=j$*ps|f`;H+t-SJX>>yVbw&>)Q)Ls4w5B|Dkm}%6SDX|t~$M$Ha z%$3WoW_e7|ZHl>6&dVQTpy8l=?CYx_;sKeqb%_3b`(2)+Mhyzv!P5td)!Gqh`x+IT z{l4j`@h0VoS7i6b9=`iddfj132f-F@qk^H<%G)R{+Q(WZYqvKLdq^pJQ*3t<+kOXIy>J926cDjJ877KJNta^ zUS&Zx&8Ii~F^jtj)pzWp8aZ}XW`-Q|#IWZzyqg~)sMfMJXV;73xB@*E^JqC5@3pEo zI-2h?h6E{k8SgtH#~5p(Y34hk{90)6J8Wa?^6iANZ_ryl)DU&N19kgzhSqJ3#)_Pi zSbg0dL5(*~y2V(1(fKAc8Xw3aE7{eP$}Fp&)Xses5Eh-qC~n8!4s|VnoF?S+*#N2o zDi|6Yb~724Rx|-$gvCc6t^?ra0#|vxAdQ=kZB<}_k^z()Y98LaqV8oRBcq57KsER}c^WJN7%2;z^#@z)gO>%G8H=qlX+WyQ4IDhy`GRvh*&(^V!9Aufg^VPyW5hosz zt!K^Tv%v0X#1yD8ofOFt!`Xzz#@*`$>QW6A9=#vax>%%Ah56D-$a>-&0UkO|&r`4nZFkBVcuJeem2t2WsrB0Syl z+qDuiTf?NMODYSWy`6kLJTR?KuJX3pyFYExEm3T#e?enfL}=l@(^<9#;W8rsD4wW< zz@yu%NJ@ilmVC&@*~;;E%4&g*Hrdzeh_;|-mKA2aIHC5=>&LYR=|p!|Crce`j}S9N zd~KuE?b($&u^B^Mg+;5T6OYxH1XMbUFM5hnF)4xL*lQ12z2xnwdDU>gE|uJVH|G_K~^;N65 zP~J2yV6w)1J(V6)K*8|*b(?@05X2x?KH_h-8p@vHP^aBtE7xnPE0Az3VURD<@a@X1 zx~VOXl->0ptjlF=(=6b1y=9#o!cOMQl{wzEFORZXY_gkDMuV5NWS3hnXGGgty^P?4 z4n*t#C;xB~2w6A>Qa}Vwfi#Fh8jW|Wt7s6p6JQ{`NkKKp2ai-IX^LD#A_~T@F@-`1b5YtnjKB&3L?ItrI@9}f^-t5-OMUAFF zbpX(4ffUh^YkWc8S!@Btk!zFqN&Y(g6I?)4ogc`?7Y-Z0?)%pfZCmHov$#>(LH{lC zPuG8)3!e#}>2F%l?@!C(^%;*z zT%c6sg=3qZ`>;P)6(%LhtSs#b#{)0efQqEWKmCyTBliahU%zR`dgj`~eGcUm*zs(hd>USngq3z&IGQ>hO+gr5iD^M3kb{=5SQY& z3WW}ZE{wyb(A8jo$YSxg=R>;1q7Y>D4#>#*Xz_iT;cwQ*^KcwAZzfy}sh#*21pO6^ zFCa4hXoFl|KJJ63ji!zMYu-P6Zc1v`?_e2E{Y!!*Y#7`OMs9wjUkuFlwfOC+PhCph zhj_V}Z`;XTl{tlr;QNtTY=9ywPj)L)+d_8L__}7VrZoAu#I#tPI$qTnb$@v?GNN8T~CVnS6#Q*$UZcg!JIZHZ08Rh7-Z;6OwEzxLOXiT<@S79 z248`8D8HIJ&#aVq^lIXWYb-pC*ifUFwpTX5ZFfXR!%+-o7UlTpO*JYkh>s%~p9fuQ zjqim($gx82965f@1O5EoP%9XkRI9>$JD*E`u=lmu1Ce^rK(~Hj*Luo$WBfMa)yJr9 zduiQ7nX$5vN-6uRdFPR^``fF76}v|mB$0k>uh-~z%Mi|vyD-C{$5@|KwM7Xv5+?!} zdZ`)_T4(k`FsGD~r342=S8*JR@0*)qVKiU5shbkhQo(wnm6y!R#!-(G{8--)cWy@f zZsDS%6Mz^ah8rQ67me1FB{qWI2`oe+BO%jgQ1`&6SG$X#nw|8oIGrSH5()BxYmcrwS8HsNN{7J$a zJS)LKc&qkk%lDY;sxQZcHJHrQ`2G0sB>W^?UK=tV2Le1#05sSv5RPgE25|}8t*O#( z>@t7q*&b{oOAC1w_4;HB1~Rn_#kX6e7J>7%F|1lHNUT~QZzOiDKqPjB&q$2Q;z-N| z!gvnl@_0X6e3Tghv`_y;`lIw_zO4eE5MfnwYwY{JHkpedtC=3VU0zcY>T4y>(2HJ( z!zsFJFvWl$G>1>bR`%p2d8?PF=4KlX_h9^*L5;_GAD?AbkghK5rFVAy8A{^*6qjYX z!IF182tIE93-HRM!%cek$u0zz2wr6qJgbwEuw4NRv9z8{nrnYoGln(d!JXufSDDRXB8 zv1=*}x#vl_pu~K@p#1o_QU-~=K#k-UU%~eSu>gMKzm)$DIvS*HSws&MBS-yoDe{T?%fjRO zUE^JT!<4xz$S^%P`9gFC#pq({y^~lvN)YFZ+0UjRDa^fv?#M~4if48KksdOfiHvnN zaWamX!WDR#S2hNf^Ol$o)`-3QwW&Oj$F|f!_8&nG&XdB@WGSz^3p&aWq23d|Cv=A@ zMTEj}hiY0CfO;y$g0aUB-?BWK*YCI>o>xFd&|O!t>#CnascETc(&uoj(T}3Mvah?I zZ5>?tozAOv>TPqsBMHb`Wp*Ua4sRQ8p4Zzx(l}TgaowH~Vm|(8UH*M|2-s_V zfUiGXHrK}!bXqp}HJrjJbTQr@IOBPpGmf^+os}Vx)gLymGv0!B4Q|U^$r3Mq4b5`{ zH%B832c4|e34C?p3DbS4_3jU7jWl6P(GLM7XU5p}`Zjkh3#W+ZLk3;^PfNK||0DSC zLn|iWt?pk=tNU)2m0c?CkHf;55T4*Y$#a;RMR{~#5h!?QY`9;~#Rm!!{s1I``$eT5 z5eX?R06kV%4dyuvEg+5D+Xw1T@PmXFa8Cw7eE?cN4e}sRwvX`8%&d?IJIn|`oN8YK zw842Wy<~wYu-Us5;TX9ma>3YJ-!#xE+sIS*YSLhOxqHrrN+!~WbL9;u-Ln&<1hcdv z2s;DmUUCR!D<%I6Ry!{DfT4%&jkg?;u| zv_geEWoJ+Xhxq=ybUb4Nd_3cK_yopw_ypQ+cnDoOe4KI`60dqL(y?yKtjKF*Ul*!6 z+5G-!)aiN8X#xKeTjO3w^q$a!;@j`wuj^>^UDxWk2m~lnyPcV)d+YGww6-d*Y!u(0 zZ8{o%fEbEpQOM}AQVU2Nh?Ldl9a_0*~ z?A0f-t64t;z^KuU=l7EW=b}`>8S6V>8OZD zH9Fk$m}6}=h)fAjrJeW>67kw>HhldPG-nUqNNqMOyNPX}By%||4!athivNJ&1^wOW zFYn*raaq;=+d2Nz{A7}RdTjs2XP9G{EF#yreECszxX_{`F}Tq9&gYM{dNP$^A`G7LjRBRq598+p7Pn*Y!LFieh}Mh KxwVj2g85&1%1-v4@zE>`c_ReM*{-8I)-a~Js~L#_HILxBhbL7=dE1U+|x@Vr6z-k?|BAOdd?p*M)g8$|34BJl>1dV^kjgWh<9$SOeKm~Vi& zc=(KB`2kHXToqTM^$q7Co3{Fz7U#YfTx5(`#Cy{0-uR9CyG@uEh8DuQRkLQ3P9=HP zG%tp1i>Rn_ZXB!>D0IP2I9t+~=ja)Tr!i_i>geAO*ywlN)hmS|vrWwYV-By%T%yeA zou^~&OyH0m#WK0XsW3`~sv;M~Op^hI!&K2}o_oYVLdBc!OR$(c#TV}F$dqoHhtC2D z7p|9lk7red>!^~n)SQFDonoid#eY)C%C^PTi|CBj#kcQRb5zy&lyLUs@`3{2cCz&R zBt&<@nWfC}pMa`Otc{<-qfwJ|z2Ijto2wUgE7djeMQsv%i&$Qkj(?gr@RAlFr3fTb zl1-^q4H$p%Gw$ecsz#RrEtPG2U_axF*W0T7Bf!6bCZ^+jJ_svi;Y39;#?s4xuZpkOf>tdk5m@wCxz9SV6LeR`3!C=97!D|Y=xW+2{2dX z_Br`w5z8#@C4JTO>&CQK*XUk=+HH&f4Vk$t72r@HaH;PKCZ_KC| z(^;Z5?}wWfG;LP+R>&^7pLoy^W8K>%@D)@wMmyq{%dhR`YYMI#7Lwo6S6DVX6?#@qRG>C_Y<1--hXnY!u2*g6xliF@UCCo+|6C1QE)nt1B5;14T< zR&qJlGk7Lv5b~0ue1AHYf@bTO)8A^&*7jmXz)0Ax@{S(#CXFkuZ%`_*w%$Ye%U>WO z3GxGIZ&vr+Xo3!BCUzZ6Svs;p`$RC)Kk7&B&1{K1W8E zdFYpXTc{a`7W=&f%iG6M&wWQ&gx|qU@t_MR1lyhaTxMu)_XQXXi-qTZQFD`CiO;x* z9H8{DoaW>aKNgR1;qF6_Z1rf*`WdsPTGS66rX^3;^`nK6#&R`%$s)=9M6cvMi3KJs zU7oiVGo4>=dU)_``2dMA7yD$YKM;YR$X-#0K=vMSDT7F$qQnD%rSp`#;{{`Wp0 zLuhi3Z5qHl#nniDIFzsPtOF-RTb5K$L(JbG!`WbVI?l#!z~sp_4= zr>|expBH5|pG{*;I9ZQIbGNI4W-qfVTY0aFv6O$tjk0a$^EL+$l;CZn2NbjyC_sz8 zqrfXc>#I)QeIZ!d0_FV-4i+7W9Dm4S@k{tJ#+k$IfZMj?M&@0Zt?=T&9sit?@=YAg zoLuB&T7rPcq^4WrM1dVM&NBG`pTx>Mxek#*Yzhsbh9?VsQ|V{x*bKJm3pT%bToWU6 zm4q#E2gl3XzWYLckBL7V%cPb;D?9uf<_IqTAQzh|wMcW7TMo- z>cs4EoRUTCQ2!URC(VWG%WrdW!SF4TUP&MxR5y|vz6<|_lq8`fzIecn$E%Z+?cQE`ll4% zF&^7ToM&uFIM0|;#(qFucF-d-O{y3$IPP4SGA6aTgwe$X=!o$iZY@;M&^W(yH~aw| z!JA|BaSBz%ew=BPGcvgQ0!g=B8#e0^;?K`eLBT=G?l+eAO3 z+?ffs3ap7#I`sr?ro;qFuDJ-;lZb*b+^Nhf)xasikOTtisI#b3hnYln+%R(TP|e=1 zS=#P7n zdDw#GRbdR|)L3=!S<*ybkdnNqp2}I0ku#mAo7ih_Lm`QBc=mReAX=roJLL|h*KuAy z@eDKRR%eCFhQDGU&skUb66sB@h(e9_moowUTr06JCiMuXMtni=bkuFtD9axngPp?G zJ$8W7*lj;BcEG~9KDa+G^pN>@haKCgfvyyP3-xIHxsVOKwEN(c<}p6L0Bg`^>_yrZ ztv2z21M)>_w-~`1N^Uq?w#w)WUk#1?gyzoDJsNi%J;cJIZ&ujb5lYYyrR3ClFTx6s zSZ$|zc^)vz772GcG0)wNJ%KC*Q+wl1(-HulpR&^-mPixjQMeztdu`kF72&&_GH>}$ zCPS+bt>-@#P~jCM1AH6rZdz$VQ*p$jUGkGMTy5a?d%BQN)#4nc&7O+mdAPNH$(uoF zThEclx+T6uHmd!^nDW_=*S=M${PaG14j1PwpH3kX_VG(xh!EzSl%o2`x14=prc7u6 z-Ao#DTvAe84Hv5zB{(r<>(EM^(={qR-p3#Y8B#Q3Fy^D#m%J!)Jwcbf_p*Z8z-mH0E5qI@bhcne0YdYB>z2MX&Q|1dgLlH}o{2I9X2bLL0b_4QM-Y^T z5e3wqV(RA?tl>j1OJLXOV~<9OZLW6#7p52A%&bq zKBdBXuW0D$k^(&DgiIeK?GST=c7U?0~_;Z zrDJwW6zJy9>Gzo1yD*~9b(d?EGVtE3Va%YaS=`EDp%K+^=v?0~`LHHt5Xd;wk*oQZ z(401qIHOPf98LQUvqud}?0n+RX(bRY9$qwKT@!!oOdZ#nlGwXym0blC7kyx|W{LYe ziUb)?krxWjS=DYIJBbz|#s8UPv1#b*2>OKYr%xy`eOO&%;G#$&92hmYase^!n@Jjo5cHbKR?j z0pA6!cs$6V5OTWy^7vN(g(B<;7R5Idd@4Mo#4rXG5ogW%Y-~mzyp8~4ME|G}7%VEH zr#OS5RNpYj)JcfHI;C!F4!0=srh1ojw8N9~bsR6lFZ&3i3p{z9Xy}m2eBM9Xs-9d= zuY?sQq{#ds$9Fg9a^mL?fgTbKrY5t&73aQ6SnbB*FX}vnZu4jkfC+tBX%f;IS%MjZ z^xeGfkCV-JzP?gFx95eJuVPwfO&2h}a*>=hGy8n6)fJEP zHK*SuM!xbN^E~AUJR&`2vJ>_y9nbR3NsxUXtDjbXW=^bUF}kCz9UDdSlznh}EXY<; zAtv$a^t@_0M7GW*Rc<_@B5A}Et3h2)4!)NDb{N|9ICi&m+?5xL*1JYX`jShq?p%56 z8uyHU(#f|r4*7OY?p$*YX-<&vDXjS%B1i4y$?1FO8)n4d0sGc>&q!s&1nl}CdvjoX zV8aU4?!(jzEwEPt%0sZ3;GKXea4}`q-eaJ8sl(D$546fy=sT?*W(jy9!3WyiSuodc zm!&K^1`vO<3YsKe7a=4MQ1g&g+WFbtGPRhNQPSEG*y`D@KI(HK;ZR&d__m(>Z2}(y ze2U}p><8zgB>jkRBnyGsKK2(QF}vyj?-yFImIX_ueZP$vGDMPQprg5@4pO#o`8j3A z`jl_6r8!i$jg{pPi~CwJ!+g{(((UzqbF0#P94q@uN5rR{5b+u0Pos89RDhQl5orm* zO~5s~Ms$1072GJ{c97PUX99iSPlxr_N7Y#og{9KBkjc*Y&N&QvgU|NCeKE8o``rFSW=sG7}{sBb~y^(walI6};P-?goMO?}Cbg!M|G zKCXT_?xiNpAF|hMQcI3wkFE`Wq8{UlmIPUC7$1>lBIC56hIB4~8HkQFYX5$ib z(F*AyxH3qST*XL2z6(d<-KgxfCjY=nRi8iKGFEz-3_@undw)qMr_qP=!xd_e9*GnB zu{6rPw<2{OnvAIGEnWXUab(JSNE}1cC4ME2FT{T(j^`}y(ZBLW2xa-hf4L;{YG6Y4 z)hnB4)uRpGGJc)pIlbD>JaJW0&GHsUpHBPJcPaH1?rP@xS$fm*UndqvFJ1=IU%+~= z=*7L!c&;XSMrTlO!*#ld#ig^Q6oKGOIX!c?X)l}QK5_Xi&29V=AHlj(fU(<(F@zeT zZHqXP>B4D8J>A3SCRvd-iVhqYZScv#-QMtptnG0hi_!s0cMdsJKYU{B2MwC~4u2SC zu&L(3o$KwG7%${*eM1Hq8hPzGrtbv??Aw{Rj0gp)-kpZ^I^g!U&=#k1B$W4NFQlzB z&HK?_{GBTLLz(hcWqvYT%J`KjI%+hVXjlJE6v4kT#ZHt>5g{EWCj3B|xvu0_Qx5Wh z&e$k@A86s5DW8|2^j+ma?pwipPtP?W=8IrX1kSsJXTZnJVH+z!ZAfq%SoT>$g#-j~ z3H%1h903QLaC9mwcfrSw#~Jc|3CswU1QBZovm&3hP4|Vqi-tvtFfP>rL?QJ{U>d;u zZQz)IL=g26W?+>0ddlnVr=`2I%@AXc_Yx55*-s+)<2)u%!=RqsU?xi5X^iw3# zcK3sR3^Z?XwwUTUn`barr+z2ht1SDnC zYMc=w8mi2X?oHK3O>!>NPmh3R>%Xx;I*5V3eJw%$nI$;3R%A%$FD&l|5)ATL;VkB~ zQeqAD*~it2Yxl*!_As)9R;f07TD7_`TwnVBOd^=1UYN{5cM>fFcMalEz(A46&tT@q z4bebnGkD9L!4Rma$~-73b15Bi=z_iUzSRSG<NMRFP;WJ9C=j1g3l2k9USRO_a-rFFTsqZYaUugKAsi$;u>qr zmiazI%KL0TqJay`pw_4~$~UrCfWY=KC8{P}3i0D0+4Fl0rZhZnnLtD&U;LhsJoN(+ zHC8=IUG}8T?U)Msx%-$IT`p_5knP&IhPMK>3*5C(W?ID@4|x$8Ggav4vt8(Jh8CnL zC*6D7jlwfa8mo8obdSq&YQ`pCp%G_SO7)n=< zbcNPux)S{3@`XD5BWNBr*HjKvZ0fulM;xPz$3x<`q`fxH;rFSOG2BIT_vQTjPFz37 ze?tQT;mrekLX|=Gy1*Zyd?6}p;8#%g5UFnPtCzl3Ms++Kyg|(+ztQxx3g`wyK|%RL z+M^zbILX&o6YsDh3Ta9J*;r3Y7x@8dyL=gmIaJnn23(-dVA@sLBP)tJ6=`d z_U&x=Z9N4k2Oq7fx2Wc&EJ1Z{|9h82W7}cE@OzYxov{Ze&tc{e4TdM~)6Tx>r=tYd z#JTl7d>fO%Z-J3udO~WAiotBe=4js5sIvkcskt}CY6B~nvrkl#Y#Aod$*&n)HQ0x~ zS-iEvJr3gj5xedc)9>g*XgDYvUJt{S#W|DOu#cW2nwf!9nu-_nwk~1Y;=j?>|HN8> z|DR~ns@Ug@VvkwES1_M%7T*43_`I4~YCSymp^_{^ zxl=!&w!o0rSYCpH%VgM(g^lu9;tv-4NMa#`s}2g>NTMZ|@8mST1vcPqHgbNj*e-O@ z-MlKI*G|mC-gm~SOJq7HdUxd_$y^vGR|_>JmvXtQoSjZhw&!Huadr>c-2%Ubs(|eE zgP8zA0>JU6**pw&Qj&EKrt42wPNtFFn#orzv$CW5fZobjl;S%zmUI-sDCAY zu6F+;`TH;2k5}}c+z)sle+5DRLjGuEXZ|Tfdm2PR?&A>m zuS^XcuB`ns@Ryl-YDQoKv>`-tm>dqJw00MUMmxoaO9z@|ljXz>XauHviAXdl65!#! z4~Fv>l|zX)S<~t1t#M)0WfC4X`gIB@M18_jDh;BOVv}c|FHe?C@$o4Fy4==Vy^STI zFumbndBRbbf3#^_?0|HlYQ<-zOUogK>0mB$4Ru0m0(*t7_~tpL2Zjek^|84~Cs4-V z=SKGTBh`XBq$|Up#gz?0`qRO9Pe&3UTj}68Bpwq#?~pJZezpfucfT4 z>UM(1Fg+!sky{X(8PK*{O`4r^DdX%BS$YwOlej?c2}lX4S1KLx51r}~T6c&}$`HB@ zGh`+*br*Mr7wjgv3EJWsCRng-DI^Rw(;ArYMNkSZZ&bn2{!7l^H#%W|-b z15imm60#XXgOV$T=D5sF=*Qqa$%5GyvuMXh#U6h!SU$G3BKNaKM`Pw$L9Y4b0n0L; zO%?n{^A#5b)zOGEEt|Yggf&4~C6oxyC~8NA>w>PhMDDhOL7p_$apFrHGbNI|(b(TH zZA{*Ilc|ef-Ytef&N1rAe6D?_da#Dcb#d`lvy@YnMjvczPhB<6u81Nl0Eb zSmEicAcSfHjPvrBirJHu@VANyp{W7mKxILMYrxt7bkUnm3Xqzc0lN!9Z4RItL#=qE z5&33xooOwpGFzw!wjTEvuC|Yi`}uPiNc#pSYsc}w(SET{d0mxbgORLauTq{`7J`=RJ@IFwUkf+%a3EM=&%1od}P)Mn=fU_Uxm=3h8d z_&F5|hOOF*SrF=+#1>+i#wO>f*uyz*Q_M_Ri~lm6-xK&+V;Z|(sQXcfy!=83omP3L z7MZb=^E`D}oehvPoP=BU*ry&bF7eJQ|f;ppYUWT|lLfFU&u14nWo^#_J{@Q~kha-+zhjPrcW zrdG-Ds>PqZ;^QV{zeKz&u!E`KnAdpP*@LU9LA6Rd0WLF;)OQa!dg(R>XB@D3sC*m$ zK0EN@tIy5F@q(jN!5I2=>3u+w0|a3PO!l1T{-C!Cu>ouX1yuxbYy{iFr{VAS{2^&U zE*rtjKvOkwh(V58g*t-Bq}Gn8Yf%>gH1ov?d9gdibhQd^D}gIfXndG%#7f?oD)stJ zV(;4L>~*Ue{4J`TJgNR4{bWDNTlH+SF~aF^=@6Ev44lLsnVoQF! z;SMH_<*nCp$lqMyA?kdk1wjDpy5A4DKT?H9&QSLSL2_)Z(b0K|Fst+*S`mNN|DYB9 z4^mM^OG9_{=BOMJ@}lMIyS!9ZV`pDMks)+n9@{sa58%Y@lSK1JR=vda9j^G8&7tG;9j&v+FKDWT@F9 zPwWo4o)CZj$vQDtoaQX9fh_yoVsvQ3g(aV!mcCsVNm%O$&9$j4x>z=+uAs1-m*`Kb z@QX7@pz=a$(!fm5vUq$UhiTw9(0iK)FSj6g>0lyYyw2ty%1)}^jy<<(_8GdSboJ*0 zQXIMg@f+_!Zuy+q@>g#}dx3+`-_FTGkZKOo(d%>~&OFD;)#Q5#iP5@*@?o2n8V9iS zE%O^&PCD6jqVF`b5ExkJ+59>8Hq-M=W$#x{>DDdny&ps!HBxJsbA|5sR;+QLJG?tZ zWctTWa-b%@9tB%5+qLR-fSYKs$~RG-4`}=HP0}#oh^WO=KZs{j{7L7OOutL9{dBbk zMKL$wN#!tbJc(kof0{xV#{x(h9cLoH)0^MXqA^6=+t+kgupQ`UC<|83pZ#R!b=k7B zY9Uu(1EyFA$+~A8cMD^nU+pg5Neh z-rVym(Yvba+!+N1oH%{YYyO2M>Y@qNNOp#n8;DvQegr85JLmkLbZQg~(mgk>hl zfb8=o=)cgvRP~L|Ddk`nyXgrEc_t#198+Q8v)ku?;Rb0F?CNP38@Gk}kq#it==(DC zjozhd*-QSRp1E)nzaMZkk&5BXk?Jjcews8q|w}}XLKa$x_w3H0e!!;gw5#66#FLV?YJRB6+hlNuXgN!Xh zYrMU{uhf$$LWH{;1;}J%A}-$S^_0C5_cYRVwu{ufO`h(FoRq7_bURYGPB-4_&lBBB z$z+5RA9oz=`BmpE)5zVKq^(4nNETAd*Ah#}CzhRyoGBtz$zduMKdr$m3B~8w^?obf zY@1~!`6^flJyNh(Z)G=Z=@68uTOaif-3(6eWyfdST9YlHmy+zz4BqFq78>=k5xUi7 zQ9G+~70 zgvPWXzU)l{G8t#g{|^;WFEY}{ifBLk4y6je7Te%#_5J)(82|*;`xa(TgtZH1M(soQ;Nh^Nwi?7(c+Fn$O5A5QAwxtz>+*Ec@oaPzI0--67 z`A{HArlouQO|VM=&3-&o0Sdz`ndm7p^dGn_JCw58c_s}lef!LRt5i-TySJo3lKUhj zV&Ut8v4K?G^6i_?`T5PK9+$X?} zi-?!dTo+yVLy|YZ;OEE4O`KJ|8;{gt27=W8KrMO>3-P~cAIs%7QbIx=lmgTHK)fY~ zZ!>b+?a4N;IvU5$19qe}Jtae*;#G$S*I_X348tCE;RrJeHyRJFS`F;im?HT)QA2uD z=35%!#{1?>Tf{k3<$aZjanev*iRP^`A4-bD(HsWigA041ba=YloOeeTX>%l`g-M?w zGy~vND8Z_n60iu=)20Im!4Oygqp6;IjdQQ?E1PGXiSEG9yLU0x7pV}bGO*p#q)f=+ z5EvUOv}&;oOb!KQ1%ayoKit#DHRbgN_Kn9yiAYp&x-f1k=4{&hVsH`V*DOt=SyDU5 zb?lta;KE-ST6Zxhw>vJ*XbV0uPiuks?$V{ra-3%e>F*%Da!O!QbpB#Al&w)0Hdxx- z_4O?!!vy1?Gy4jHUGj2|cNcPsq!%~p72gKh??Bi2({>c19T-Sw(`{BiF0uY;LCzH` zv6t>jC}3z+T$?emsDwFdFsl~bzLOYMd_*G3lS^@|%iU@jt<2D@0Bvov*?||PBZJ|} zkV6vWldoF;nIfO*$|~>8YSesC_gMaZjR&pUC~gb;cR9H_3jFNzdYqW^dZ?*$Ro?1{ zC;fbcO_hRv2LRc>3Ol^fHyKCmZ^rK9=Xxu4-JL!T=p?o<${()z^e};-9v`Ld;SM*%1U^hcJEwA`57{3*2TDN$5j-)RD{Mv z>~;{fzk=BinpJn`)VJ_mLvhepu2trNv#b}2C~CGu0}F|)alc(opTzBUEQG7GQc^Tp zu)o1SdogQdY--zNxR8QgwXm*4bCKXc%Y+)Yu#1C#oy*W!jx}>`+P}Jf>X^u9nZ)V= z3nCzLIJn;Jm~w#1yQXK(QVg?p0C2p*rG4G|2KgwrjskwG{*UrM@Sy)IHg#Mv8M00k z@&0-&;6XF#e&!M%Xbrx-#cWYW;++B~5FdjiGZzHo8-~%w4fhCIb@vP6Zg^BCPn3Zovb!sO=n5uxo7Huyyc6<5RLELQwNW6#Z}9Aio&;uBj4A|@-2viO z4qK4~o2l8n_2^!$7(ahxf1=EK#iyKUrtePUOm}{Ke=qlg^Hk2^{@Rog9BkLhllR4~ z>A@A%#qw_fuyma}lP>rmatDkGhla12`|at~nVR*-HgszttYaFCd)2TiG2>-2GP6sD z6RQNys-c-aQJMy^1!-08zOZ-mnEVrN@am!=3MjQV12z|&HZu2J^lHT`P2{4PgC>1E zX3}Bm$PP@ua5}j<9vk?{Kp;A)$QH!5!07kxPYlSm#RUAU`Ws3& z6X8NM=#8(Iv7S6_FDFjU?HIRBPWl@Q#JA}dLlV|9T-xMoX^}W6GoO6+?c#?58ZEZs zl8)7+=atJ-KMR)AZY~hMWoA$;&Iu*zJGRg#W#n?WO;MfM8w4a!bUvH@!cNim5++F` z^Erm5u#h6UujZw6Qf|g`414}1Vjuh2pvsh@u!I{+>0-meFG+NmkD+wn1k7&h$VI1R zUht(gSmlnD6UQ$+I;o6kgG~oRUgrPhqmsNcPLdUGaI_WX8jBQ2$zk7D!ja_}8+1AY zM5AtTJ0_ZO(Q^Wsf^s65ymI3{UEAtXRKQf`a8Ht)h3RB9&}O`?-YehDNkjGbI097$ z)pLE~BxsHds`})eDxMRbFoGh5y?W8W;BiJ&KQd_>1`DAkaS26 za)Oq>g<9*>pqeL%M!gRmVS~?C#Q9k^fW?uPeg!W{g@THq;Q^Im6aoPU z?8QZUOaeQbgTu8WZ)TZn+wRvvrt?RjOXH=&tHXE6sfg%&KU4k$z)T<#;!2cDlnW3^ zt5u4;crag``g7YH;T@^$A{g7(H$4xDVybRb?$OGZ)E`Xjdy298<|Z3s41ILD;)=~( z3hR&<@$zuJ={Ols&Ut&LcaOny*infGZ;7jRRdZ#32F|(m)_qbqB6JQw$HwbmLtXU0 z@XiCbf7Af(79oPeLHeg=|FB;nC@j8IXSdE8xL<^&hQQHfepny$ZVw#vf_*hdyVxZez>Z`zu2jYTB89BbN$Xv0}bE|k0*;O75b(vNO(3XuOeHfHK_8RP$pD#3^Xjhp=)z`~{ z#X|mRK!V(rs6KI#zv(UZ{Z!~_{5Y|{P1v1KGTIznn8$uFUrYQzwZymFo3@iu0X+#C zv6qFT44=)Nw0@4Al=@_5LJ*lvoTk&eV%0YuoMM+lCm-JQ0j2{nqoR*KF>d;X{LwdA zSh00Qls_mv9_v?H!pNdd8qUI!p`20p{BvFJ=vk>yw!3C9YCRA#EWQ`gV3|~n3tk8- zI0#Qh<5?9oOm|g$DgxegWJI5y9K~QRYu<2QIlF{fkl$w3Ka3WlA9>wkA%z z+Q_$eON!#P4x=`9o65j%GuC?kgBk0VPT#Z7w^M@vC{@vIJ4FlOXi>-6iE931gKzJp zMnCoD85`_xl`C*+|0zAEblmmYt`-pA)1#}#N1`x zRAA%u>I|!92@iH#J7Au*ht@4xa4ZfcE~Zu*T}z4Uqu=&)BRSQ)9Z0?DatT&5$}m0M z)G`KRe9fFDFKSRpnww>;i;mV`4g4~2%+91UH!7Ez<#v0!TTMDnonUyXyPI|LlfOto zY22ew3>bPjTd!YdYO65>4Txz`f0A{hSl(;+cGc+PI$SZIvbP2wWjD^HSoQII*!R1; zihXOy9+NAV6jYP=$F$?Q;-2qa=n-tMy}Kn(ZU?kmK4t7x){elq|E_TTQR-slfBvWM z=~t<1UTMlm%PZ7OA>XAVipS2g@0x}4R6kPzAOMW{Hj0Z4*YEXP>$vf76Yub~-*!3# zTNR$Tr%t^QifTtnqzrn+t&GcITF=TkwZmj4wC@EQSC`c)nmsDaScVeI(nwVfzBgii zyLq6W-kTpmlrX)A@f>9R@=ShzglV*bOO?BU6%V#EfTZ-7_etgp|6krG;4kwNCDs3z z=BI!0K9za?>3!O<{x9Aq;2-9v5F3O4N9Lzwrs^ioe=$FyuEGBo^V5IyKAE@n|I_HoLpr`C58S4D5@-;+YzGQfgQ%}ODi84n6fMlggZ6O02F=hIKqe&c^Fvkm!} z2_{Bv`HIK3fH8TJ?utE^J0=LR&IEtbF0|+U(*pE?cDo3-FSqYft-$F8pBKfm8jq&R zxDaeQnY88}&Je_7fiY~oKJ!6!-qL4gNR9$|tTd`BJD~4ovQtl@k(GAz-NyGyryck- zippS2kZBQdPfb{kl$asK(O`7o#D56%n%&y zPAK1R1&JfcSB8Wo6T?p-0EVP275KN3e56MM>~fYM>1{816MI@j3V``Iaw$U=IY$nxYmkpgs{ zNFmhW9KLtf(|2*C#zUXDU|PVQ%7*P(<7cSpBBqm+>xMUTyW>yUVgYI*zVSK0dknN_ zaGt&cWfLWPe1Urm>a)HCXn8^`+ir<9J^uv2%q&zi*JM#^n0c}qpOaPS1RwYr-e0*J z2x;I&IC||%939BjA)1i3Pp7k_5A@F7F+#zo<{`CR&Y~GG@Z@R|u!`k&hul)VIA>%$ z5yft`(jwC05DzZc!`kJDTsphv+=gyKL(U}AKCa{P)X}hAi$42somfzFQ_npZLB5A3 z_+YPk_8i%*X$~8YM$=ZKV-20c3TdAP@RXw8qWyXqLmtUr!(jhEOwt<`<1acrQ-I_=|t}|*hbtN zY{#mL_Ja!`$cgZO;hMm)Fj;ZI{)2m+(b$-r2Z84=0FQqFjS~m5@LrJQEB%@;`i-+= zW-oQtUZaWyQcSg&p;c4ehpa_Gm)aYnFN)JQlh!4YkJC1xn ze4C*3e7V%oEw(4rDrmhG1r`@`=R16&k+}oilZUcL@W4Bm7?tQfp~86Cn_Y&ljg*)| zEB#9Vk$$gkv^c^NeU9!j(sNDJ3cD-g;kG7WB*}ykQZ;lYKZwWY>ZkE|asjL5o?X3p zbkE2#OX}iRz+p}RrLwL`*>3b@s5+g^iG7B1^L{z)) z6QtKgAMN$jJ&%kGW;M(1D!z$lxJ3jf;9>t>da@5B1+S$Kn_n1U4DGX==0E|LF#iE= z7Av#G&4QNfo6;jc5QiH~Aq53WWh`t#i$9j~V`;I#z51<@9RlmZ^tvXNbtWE&L=6@r2hJw#3aO4O`oKI0a=+0Y6Tm8idV~2Fm;)D-Uv7H0RO#G2 zeV-i7{9Jatx)$jK?Jpd2q$iyq&KQ~J3L><-MAAR|pwe?N7lNidd@k;KY~4uFqY@~O zzUPNYc6$www(G;dGoPY*Io|b~dS${E@kENw-cG;JMhHRtgg zW8@n@`sa?w6=MICQD_K@(pg$t*2@MYNq?7z|ELpx)PC-dTB)f8kNK$Ml5*Y*w6umG zanGwZ4(Y>HP{(+M^{WsNYl#1l<57o}EqC_-aiaf$lfjOU-6hBm=7Lk?*SWp&Z&Ro{ zE4hb#CEPx` zY$=~l(;YUp2YGIe$YY1|8-q{F%0nd<)o`YXJr>`oKJCpq`YvY%vve$*7kKye#uuA? z!Yd0*yJ5~6Sb0ZSQ3WuPdK>o5o#?24Sbo`^iU-##IzxZTmD5rFC6%ft^=dOGM|Alq zX6i75ESGwre^ya=WQ2L-<>$*>R{=9n2Lf(kxy38bEo$j)E3&F7n5nD$xRT8G(@C4x zBkq+hqG6-a1}BRXoZvpw0fw9R&Y9sWOdD*g!`RQ0MPo$Bb#6 z9NWHSim5faP*;RUu)`n^rENf-05_&!0;FF#!@DtUoOn<(-7|Y?n&Cjf(UQM&@^cC5 zMr;LY`eCI?5>vz17u5v9U&`2Dhf$9ZzOYHbU z&!fEK_>0qj*#xzO_f2RvH^Z{R)3WiD_+hf3wO=XKeNgzCa)LN@x~jcfc?IIxgrnK4 z{dC&Sevstwou648a(sq&Lo}0Hr{6lA&=mH%ib%+Q7l2K2r(lUn2+YJRWqLc#&MY%# z#t;9g%u0DvDNvxkTPwysKt8dqq>*F2CcdNghP<=RN->~cA?K=8b!SfKd==G6#eS7k zbP|X{JyvaZSm>QP&98x#9$t4YwVcZzK};@$>$jNv@Wz(Ta6k*>@RIJ^lJJmkZL%*0f&AhQC##O6}_efBjCD z!M^MT%kF2TSH|ADK>`S#4!to1Xpd=nJQEjC$Fo*8O>8~UI(nkZ((U4Kvv>%54T;X3 zdBIvN_{^CxWOw*8Mb%_sZ0vKgLs_RX!MU?hK*%DYXEiHq{IfN})bduc30FuYB-JFY zN_(E@NG~gO?BvRRE)nbg?40}Bi@fdvOHiWjr$p>$EYX)Rahm9@N?W--P|`aepPMY2 zqcafW&CqUTimJd&+n0Oi3UcViS{^;?5DtpK2GdDs#|MQ(@My=kvHDvc+2esl)%;c* z06(acBHAx*Pl!981VEubBZnE{fR*xMr1Q{z-VO>tJvjgwpVmcD%D$bEpTrfA3`zu2 zhmTEy{Lc|x+E|%4LXq*RZ!5xc@wXDOT?*JNr2K%sAH9sdfTRd#(_d_2{ z$J}4rY~`754AFWH!`R^ziHG@D;8|FI0gj0g-?6OA+{T{E$rTh<(D&X+TCA9ciM>9Z zn#PwHw^`S06VI}uqL;gmdmRH^DQumN#PY)5JV7G;WK7m?YpX|x$&W0YAXn`O#-9(j zEM^}5$tV9lDTSbf>A@+ch`Ibc-I|GKU%PkwnpIozMWrOjnyuWehc|d)cTTc$jDUbS zTFh5Yrn!NpSFf$cDj;*gl+gr7jyH~QK6)=*#>?^xLq<#+l?EJeRyOy_KX8;=L z`rve7Ybn!tLJ||d$X7ey6n;5ew7m_PJD|IqiU-#oXOg<{f9WUJ2Mq1bmdkoOn;ik- zFC*$L26>rd#i}U4)v|!QVO943Z=9khl zo2`V_6*?EhI6SPrri@t!mX4-yZ8R0s5<~66Twc8Xv34vo>L2!OSg!HoNEtbydOf0t zA;wfvySvnFVsYy(}o2_0+6t$DH2GNhk(FQ@cJZQfz8@Aa*U zF7UHl9YdM|dmq9#nEpM3-oWY0qcYYJMH_=jubLgJnasc^d^#}1oLQ<|^jn!>7x69Z z<3%+^_%A{Wq+(9%y-4{^RVkKB_&aa&5fYn}dTS%~1Roe?bltvU%YEC$9gmv3`pR$_9?j#09%c@YB8Aya+aw`O2$vm?Q=bT0=N40PoMs9* z-i`!?oJN`v`1abzx!fs0c=y5lPn#qme*557s2Yga0oV)nZsZc{pk@#p%o0oI#V z-|hwwgFfEtKTeEtmXIzH?ZKD^#XOkwew zM{)YN5j>0*1`oME1mjRW_HA}(cKApChXc3Fva3?&eVqOdh+(|2lOc!4U~IY}rbqnO z4qLl4@)m%@4b+y|#k`co#|Fex=CN69F4USY5cgy7tLH&jL0FLQCtys-*JJPtXjJX@ zeo((&6Q;~RPW)l&{}}K04DPf~&q5*1M_@l_1!)W53q;}=?DyQm=~@sHcLvsmaGrq4 za016?dARPLoHDyu{57edL_gK{5Xn<8Cj8j!ui13KcfdoWPaobY)zgPJZ)_GsN7VM@ zR}1lD7tccX2k`!$_FwatvH(h)t_}Vk4T~bX>K^I;)>zP|4~}>D(+3Oc^=w|1q*FAm z9>sKF0<~Lc@3^(I!>5T|ODX%0bBMMqV{=mWo&)X=;QjOEU+sXa?fJcTEnefVUcZ_J zB>AY5_k3#cw#>8ZQvOWJQT&g z_0*>tZ^_)Rj(D$Q!~Z*U+Z>=~d9KxOS4oNb*bFpfRO7uf%PvnD@e#SENgtUH#y8qz ziX*be?uO`o!T*sijMOLu-0Fx+WZ-AKoddc6b zUK8K>$@>i6j1t%<&QFSAf6~;$J`ufC?CJb;M_3uzlKjY?rcTuLE! z-4f;xdflFMQ+6&io$gnndx}<_;ny6BR-vK#VVRH;b|9&OAgSqTQr%i&Lr-EuVPZu% zL1BVmQnV`7pgQ581}aZAjGN~8^>=prH_me$Z8E;aq}Vjr7D&q#)-o4mrY}sH5VZ+9 z^bNkP{=Vfo7naoedIdZDEjlJmky}- zx+la+1mXJ?9=!@rV6qsXtnIxka21HN7MJYLo2Jy-cR?wR(+RzU6{8Wm$EF64wpYhM&ozc{@$ z{NU!%E!-dBXIOg7?|-e%VuFGg!4;@q3r4^m}F018aG{} zozW5MP3N#M^=w1*ZSu2Bk6Be4XIGA!aM`e==={#&57}L0wY`<~01PwN@WKz&_HQ`H zgZtj)%4sv~j(ajTf3#(-f4NWVvO+?TEzLiNIrn)Y>9k2t-Oq>KCj5t{sQk*>`HSEk zD<&-%E>x4OXTakZ7v*8KrgXyWlnziNe3JZsrd@A;&2<~!-QAbo{W6ml`1La*gLmpaXUZN-(KUB{)A%JY``h~Jwo`~kR0b}Bbh7jXA) z%I>mVKWz10PRf1w=hzY5bJKn+T)J8I)LrkJNqvRowey<{PGsCjF;8>Nw%3nxY1|xj zP|Y=TzTfen2(4*ybCeJ6mlWa-J2%(bt!G<*S6(vLf|q%aKSweUji9_`m9>o?Yaj`vI7(4+C|NtVEJ!!Cokg*UfN&{0!g zD?T@NP!S`?@P_dKm^k`Y-)D3#_;}?j3xClzF+n;s40BI5Xe9w4AA(ppEdHKa&}~3WfWlv5J>pq@_=djFQ8}GxR?y$ z4C1E$`L8Z%!o{S)u|UBgf+>*`#As+@fQWz?P2~#|e(VnrIPkR%CVT)?!%Ur^AvSfc z20IJLu~R!WWb6M-KCEW-j(0|6!^yv%j5asR^Do>vXWctJPoqTs-6^ZP*>C<#yDX{mxYKT@ z)RD{{rJn2QWdXbKbe;C0H1sNWvoxlIqQ1StN)@&4TO&*_hJzL!SRt zF1c5*cVRuuiQrs{-5F5*z}inAn=6rwSC(qbV8Ns2h13fvROx!4-@lt*sr>)x2Q%0~ zbaqcYx`ROO*?zH7`u^^nVb|{e`|zV#xW@YHcm96)YyS(v>%M<2UhY2Cam%UdCI9=s zcJ8#8ulG90+NJ;h{nr^MXGe0EPOiAI!t}qy>ub5Y<90t^HM=b+ul`cyy>C^sCzi$5 zZr=K4U9EB{_f6(G(?fntpFGRx&&&FsA+H&$&SmTs&A*vsR<<~!%Wd29k4EXC9S1A3 YLd|V6_lJo8dj4OYAz@zoKH*>{0KORAjsO4v diff --git a/rules/integrations/github/persistence_github_org_owner_added.toml b/rules/integrations/github/persistence_github_org_owner_added.toml new file mode 100644 index 000000000..3fd492d96 --- /dev/null +++ b/rules/integrations/github/persistence_github_org_owner_added.toml @@ -0,0 +1,47 @@ +[metadata] +creation_date = "2023/09/11" +integration = ["github"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/11" + +[rule] +author = ["Elastic"] +description = """ +Detects when a new member is added to a GitHub organization as an owner. +This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. +Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. +""" +from = "now-9m" +index = ["logs-github.audit-*"] +language = "eql" +license = "Elastic License v2" +name = "New GitHub Owner Added" +risk_score = 47 +rule_id = "24401eca-ad0b-4ff9-9431-487a8e183af9" +severity = "medium" +tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Github"] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +iam where event.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1136" +name = "Create Account" +reference = "https://attack.mitre.org/techniques/T1136/" +[[rule.threat.technique.subtechnique]] +id = "T1136.003" +name = "Cloud Account" +reference = "https://attack.mitre.org/techniques/T1136/003/" + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + From a46797b987febb8f4db8748fcee33f6eb63df1d1 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Fri, 6 Oct 2023 23:14:39 +0200 Subject: [PATCH 18/86] [New Rule] Pot. Rev. Shell via Background Process (#3114) --- ...xecution_shell_via_background_process.toml | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 rules/linux/execution_shell_via_background_process.toml diff --git a/rules/linux/execution_shell_via_background_process.toml b/rules/linux/execution_shell_via_background_process.toml new file mode 100644 index 000000000..e997bf007 --- /dev/null +++ b/rules/linux/execution_shell_via_background_process.toml @@ -0,0 +1,66 @@ +[metadata] +creation_date = "2023/09/20" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/20" + +[rule] +author = ["Elastic"] +description = """ +Monitors for the execution of background processes with process arguments capable of opening a socket in the /dev/tcp +channel. This may indicate the creation of a backdoor reverse connection, and should be investigated further. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Reverse Shell via Background Process" +risk_score = 47 +rule_id = "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39" +severity = "medium" +timestamp_override = "event.ingested" +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and +process.name in ("setsid", "nohup") and process.args : "*/dev/tcp/*0>&1*" and +process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +name = "Execution" +id = "TA0002" +reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.004" +name = "Unix Shell" +reference = "https://attack.mitre.org/techniques/T1059/004/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +name = "Command and Control" +id = "TA0011" +reference = "https://attack.mitre.org/tactics/TA0011/" + +[[rule.threat.technique]] +name = "Application Layer Protocol" +id = "T1071" +reference = "https://attack.mitre.org/techniques/T1071/" From 4cdf52129a5ae2a147f04bde24d7c77f2795a592 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 11 Oct 2023 09:43:26 +0200 Subject: [PATCH 19/86] [Tuning] Windows Discovery Rule Tuning for UEBA (#3097) * [Tuning] Win DR Tuning for UEBA * Need to get used to Windows formatting * Added additional content * Updated min stack * Added additional tuning * Fixed unit testing for KQL optimization * Update rules_building_block/discovery_internet_capabilities.toml * Additional tuning * Kuery optimization * Additional tuning * Additional tuning * Additional tuning * Additional tuning * Unit testing optimization fix * optimization * tuning * Optimization * Update rules/windows/discovery_privileged_localgroup_membership.toml * Added feedback * Update rules/windows/discovery_privileged_localgroup_membership.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update rules/windows/discovery_remote_system_discovery_commands_windows.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update rules/windows/discovery_system_service_discovery.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * added host.id as additional new_terms field * Reworked a lot. * kibana.alert.rule.rule_id to non-ecs-schema.json * Fixed index by adding a dot * fixed typo * Added host.os.type:windows for signals * Added additional tag * Added Higher-Order Rule tag * Stripped down signal rules down to two * revert * Update rules/windows/discovery_admin_recon.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules_building_block/discovery_generic_registry_query.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules_building_block/discovery_system_time_discovery.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/windows/discovery_privileged_localgroup_membership.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update discovery_generic_registry_query.toml * Readded exclusions * Added trailing wildcards for KQL * Update discovery_privileged_localgroup_membership.toml * Update rules_building_block/discovery_signal_unusual_user_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Formatting fix --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- detection_rules/etc/non-ecs-schema.json | 3 +- rules/windows/discovery_admin_recon.toml | 22 ++-- ..._enumerating_domain_trusts_via_nltest.toml | 20 ++- ...very_privileged_localgroup_membership.toml | 117 +++++++++--------- ...unusual_discovery_signal_proc_cmdline.toml | 53 ++++++++ ...sual_discovery_signal_proc_executable.toml | 48 +++++++ ...iscovery_files_dir_systeminfo_via_cmd.toml | 26 ++-- .../discovery_generic_account_groups.toml | 26 ++-- .../discovery_generic_process_discovery.toml | 19 +-- .../discovery_generic_registry_query.toml | 52 ++++---- .../discovery_internet_capabilities.toml | 41 ++++-- .../discovery_net_view.toml | 18 ++- ..._post_exploitation_external_ip_lookup.toml | 19 ++- ...ote_system_discovery_commands_windows.toml | 18 ++- .../discovery_security_software_wmic.toml | 24 ++-- .../discovery_signal_unusual_user_host.toml | 56 +++++++++ .../discovery_system_service_discovery.toml | 19 ++- .../discovery_system_time_discovery.toml | 24 +++- .../discovery_win_network_connections.toml | 20 +-- ..._windows_system_information_discovery.toml | 17 ++- 20 files changed, 468 insertions(+), 174 deletions(-) create mode 100644 rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml create mode 100644 rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml rename {rules/windows => rules_building_block}/discovery_files_dir_systeminfo_via_cmd.toml (90%) rename {rules/windows => rules_building_block}/discovery_net_view.toml (92%) rename {rules/windows => rules_building_block}/discovery_post_exploitation_external_ip_lookup.toml (95%) rename {rules/windows => rules_building_block}/discovery_remote_system_discovery_commands_windows.toml (92%) rename {rules/windows => rules_building_block}/discovery_security_software_wmic.toml (88%) create mode 100644 rules_building_block/discovery_signal_unusual_user_host.toml rename {rules/windows => rules_building_block}/discovery_system_service_discovery.toml (75%) rename {rules/windows => rules_building_block}/discovery_system_time_discovery.toml (67%) diff --git a/detection_rules/etc/non-ecs-schema.json b/detection_rules/etc/non-ecs-schema.json index ba80df95a..408ca42a9 100644 --- a/detection_rules/etc/non-ecs-schema.json +++ b/detection_rules/etc/non-ecs-schema.json @@ -114,7 +114,8 @@ }, ".alerts-security.*": { "signal.rule.name": "keyword", - "kibana.alert.rule.threat.tactic.id": "keyword" + "kibana.alert.rule.threat.tactic.id": "keyword", + "kibana.alert.rule.rule_id": "keyword" }, "logs-google_workspace*": { "gsuite.admin": "keyword", diff --git a/rules/windows/discovery_admin_recon.toml b/rules/windows/discovery_admin_recon.toml index 309acb7d0..640e7c090 100644 --- a/rules/windows/discovery_admin_recon.toml +++ b/rules/windows/discovery_admin_recon.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/14" [rule] author = ["Elastic"] @@ -56,7 +56,14 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "871ea072-1b71-4def-b016-6278b505138d" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -74,42 +81,43 @@ process where host.os.type == "windows" and event.type == "start" and ((process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and process.args : ("group", "useraccount")) -) +) and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1069" name = "Permission Groups Discovery" reference = "https://attack.mitre.org/techniques/T1069/" + [[rule.threat.technique.subtechnique]] id = "T1069.001" name = "Local Groups" reference = "https://attack.mitre.org/techniques/T1069/001/" + [[rule.threat.technique.subtechnique]] id = "T1069.002" name = "Domain Groups" reference = "https://attack.mitre.org/techniques/T1069/002/" - [[rule.threat.technique]] id = "T1087" name = "Account Discovery" reference = "https://attack.mitre.org/techniques/T1087/" + [[rule.threat.technique.subtechnique]] id = "T1087.001" name = "Local Account" reference = "https://attack.mitre.org/techniques/T1087/001/" + [[rule.threat.technique.subtechnique]] id = "T1087.002" name = "Domain Account" reference = "https://attack.mitre.org/techniques/T1087/002/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml b/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml index 7b337ff65..b730a1526 100644 --- a/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml +++ b/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/27" +updated_date = "2023/09/14" [rule] author = ["Elastic"] @@ -62,7 +62,14 @@ references = [ risk_score = 21 rule_id = "84da2554-e12a-11ec-b896-f661ea17fbcd" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -71,16 +78,20 @@ process where host.os.type == "windows" and event.type == "start" and process.name : "nltest.exe" and process.args : ( "/DCLIST:*", "/DCNAME:*", "/DSGET*", "/LSAQUERYFTI:*", "/PARENTDOMAIN", - "/DOMAIN_TRUSTS", "/BDC_QUERY:*") + "/DOMAIN_TRUSTS", "/BDC_QUERY:*" + ) and +not process.parent.name : "PDQInventoryScanner.exe" and +not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1482" name = "Domain Trust Discovery" reference = "https://attack.mitre.org/techniques/T1482/" + [[rule.threat.technique]] id = "T1018" name = "Remote System Discovery" @@ -90,4 +101,3 @@ reference = "https://attack.mitre.org/techniques/T1018/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/windows/discovery_privileged_localgroup_membership.toml b/rules/windows/discovery_privileged_localgroup_membership.toml index 17764a8ba..744c5f3f9 100644 --- a/rules/windows/discovery_privileged_localgroup_membership.toml +++ b/rules/windows/discovery_privileged_localgroup_membership.toml @@ -2,9 +2,9 @@ creation_date = "2020/10/15" integration = ["system", "windows"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/10/10" [transform] [[transform.osquery]] @@ -31,7 +31,6 @@ services.path FROM services JOIN authenticode ON services.path = authenticode.pa authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted' """ - [rule] author = ["Elastic"] description = """ @@ -40,7 +39,7 @@ Administrators or Remote Desktop users. """ from = "now-9m" index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Enumeration of Privileged Local Groups Membership" note = """## Triage and analysis @@ -112,75 +111,81 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "291a0de9-937a-4189-94c0-3e847c8b13e4" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -iam where event.action == "user-member-enumerated" and - - /* excluding machine account */ - not winlog.event_data.SubjectUserName: ("*$", "LOCAL SERVICE", "NETWORK SERVICE") and - - /* noisy and usual legit processes excluded */ - not winlog.event_data.CallerProcessName: - ("-", - "?:\\Windows\\System32\\VSSVC.exe", - "?:\\Windows\\System32\\SearchIndexer.exe", - "?:\\Windows\\System32\\CompatTelRunner.exe", - "?:\\Windows\\System32\\oobe\\msoobe.exe", - "?:\\Windows\\System32\\net1.exe", - "?:\\Windows\\System32\\svchost.exe", - "?:\\Windows\\System32\\Netplwiz.exe", - "?:\\Windows\\System32\\msiexec.exe", - "?:\\Windows\\SysWOW64\\msiexec.exe", - "?:\\Windows\\System32\\CloudExperienceHostBroker.exe", - "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", - "?:\\Windows\\System32\\SrTasks.exe", - "?:\\Windows\\System32\\lsass.exe", - "?:\\Windows\\System32\\diskshadow.exe", - "?:\\Windows\\System32\\dfsrs.exe", - "?:\\Program Files\\*.exe", - "?:\\Program Files (x86)\\*.exe", - "?:\\WindowsAzure\\*\\WaAppAgent.exe", - "?:\\Windows\\System32\\vssadmin.exe", - "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe", - "?:\\Windows\\System32\\dllhost.exe", - "?:\\Windows\\System32\\mmc.exe", - "?:\\Windows\\System32\\SettingSyncHost.exe", - "?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe", - "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe", - "?:\\Windows\\Temp\\rubrik_vmware???\\snaptool.exe", - "?:\\Windows\\System32\\inetsrv\\w3wp.exe", - "?:\\$WINDOWS.~BT\\Sources\\*.exe", - "?:\\Windows\\System32\\wsmprovhost.exe", - "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\x3jobt3?.exe", - "?:\\Windows\\System32\\mstsc.exe", - "?:\\Windows\\System32\\esentutl.exe", - "?:\\Windows\\System32\\RecoveryDrive.exe", - "?:\\Windows\\System32\\SystemPropertiesComputerName.exe") and - - /* privileged local groups */ - (group.name:("*admin*","RemoteDesktopUsers") or - winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555")) +host.os.type:windows and event.category:iam and event.action:user-member-enumerated and + ( + group.name:(*Admin* or "RemoteDesktopUsers") or + winlog.event_data.TargetSid:("S-1-5-32-544" or "S-1-5-32-555") + ) and + not (winlog.event_data.SubjectUserName: (*$ or "LOCAL SERVICE" or "NETWORK SERVICE") or + winlog.event_data.CallerProcessName:("-" or + *\:\\\\Windows\\\\System32\\\\VSSVC.exe or + *\:\\\\Windows\\\\System32\\\\SearchIndexer.exe or + *\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe or + *\:\\\\Windows\\\\System32\\\\oobe\\\\msoobe.exe or + *\:\\\\Windows\\\\System32\\\\net1.exe or + *\:\\\\Windows\\\\System32\\\\svchost.exe or + *\:\\\\Windows\\\\System32\\\\Netplwiz.exe or + *\:\\\\Windows\\\\System32\\\\msiexec.exe or + *\:\\\\Windows\\\\System32\\\\CloudExperienceHostBroker.exe or + *\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe or + *\:\\\\Windows\\\\System32\\\\SrTasks.exe or + *\:\\\\Windows\\\\System32\\\\diskshadow.exe or + *\:\\\\Windows\\\\System32\\\\dfsrs.exe or + *\:\\\\Windows\\\\System32\\\\vssadmin.exe or + *\:\\\\Windows\\\\System32\\\\dllhost.exe or + *\:\\\\Windows\\\\System32\\\\mmc.exe or + *\:\\\\Windows\\\\System32\\\\SettingSyncHost.exe or + *\:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe or + *\:\\\\Windows\\\\System32\\\\wsmprovhost.exe or + *\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\x3jobt3?.exe or + *\:\\\\Windows\\\\System32\\\\mstsc.exe or + *\:\\\\Windows\\\\System32\\\\esentutl.exe or + *\:\\\\Windows\\\\System32\\\\RecoveryDrive.exe or + *\:\\\\Windows\\\\System32\\\\SystemPropertiesComputerName.exe or + *\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe or + *\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe or + *\:\\\\Windows\\\\Temp\\\\rubrik_vmware???\\\\snaptool.exe or + *\:\\\\Windows\\\\VeeamVssSupport\\\\VeeamGuestHelper.exe or + ?\:\\\\WindowsAzure\\\\*WaAppAgent.exe or + ?\:\\\\Program?Files?\(x86\)\\\\*.exe or + ?\:\\\\Program?Files\\\\*.exe or + ?\:\\\\$WINDOWS.~BT\\\\Sources\\\\*.exe + ) + ) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1069" name = "Permission Groups Discovery" reference = "https://attack.mitre.org/techniques/T1069/" + [[rule.threat.technique.subtechnique]] id = "T1069.001" name = "Local Groups" reference = "https://attack.mitre.org/techniques/T1069/001/" - - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "winlog.event_data.SubjectUserName", "winlog.event_data.CallerProcessName"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml b/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml new file mode 100644 index 000000000..f6108af2a --- /dev/null +++ b/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml @@ -0,0 +1,53 @@ +[metadata] +creation_date = "2023/09/22" +maturity = "production" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/22" + +[rule] +author = ["Elastic"] +description = """ +This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique +host.id, user.id and process.command_line entries. +""" +from = "now-9m" +index = [".alerts-security.*"] +language = "kuery" +license = "Elastic License v2" +name = "Unusual Discovery Signal Alert with Unusual Process Command Line" +risk_score = 21 +rule_id = "29ef5686-9b93-433e-91b5-683911094698" +severity = "low" +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: Higher-Order Rule" + ] +timestamp_override = "event.ingested" +type = "new_terms" +query = ''' +host.os.type:windows and event.kind:signal and kibana.alert.rule.rule_id:( + "d68e95ad-1c82-4074-a12a-125fe10ac8ba" or "7b8bfc26-81d2-435e-965c-d722ee397ef1" or + "0635c542-1b96-4335-9b47-126582d2c19a" or "6ea55c81-e2ba-42f2-a134-bccf857ba922" or + "e0881d20-54ac-457f-8733-fe0bc5d44c55" or "06568a02-af29-4f20-929c-f3af281e41aa" or + "c4e9ed3e-55a2-4309-a012-bc3c78dad10a" or "51176ed2-2d90-49f2-9f3d-17196428b169" +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id", "process.command_line"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml b/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml new file mode 100644 index 000000000..f42418688 --- /dev/null +++ b/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml @@ -0,0 +1,48 @@ +[metadata] +creation_date = "2023/09/22" +maturity = "production" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/22" + +[rule] +author = ["Elastic"] +description = """ +This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique +host.id, user.id and process.executable entries. +""" +from = "now-9m" +index = [".alerts-security.*"] +language = "kuery" +license = "Elastic License v2" +name = "Unusual Discovery Signal Alert with Unusual Process Executable" +risk_score = 21 +rule_id = "72ed9140-fe9d-4a34-a026-75b50e484b17" +severity = "low" +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: Higher-Order Rule" + ] +timestamp_override = "event.ingested" +type = "new_terms" +query = ''' +host.os.type:windows and event.kind:signal and kibana.alert.rule.rule_id:"1d72d014-e2ab-4707-b056-9b96abe7b511" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id", "process.executable"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/discovery_files_dir_systeminfo_via_cmd.toml b/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml similarity index 90% rename from rules/windows/discovery_files_dir_systeminfo_via_cmd.toml rename to rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml index 680fcfcf0..25178ed9f 100644 --- a/rules/windows/discovery_files_dir_systeminfo_via_cmd.toml +++ b/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml @@ -4,12 +4,15 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/10" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ -Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows Command Shell. +Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows +Command Shell. """ from = "now-9m" index = ["winlogbeat-*", "logs-windows.*", "logs-endpoint.events.*"] @@ -50,7 +53,15 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "d68e95ad-1c82-4074-a12a-125fe10ac8ba" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "eql" @@ -60,9 +71,9 @@ process where host.os.type == "windows" and event.type == "start" and not process.parent.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\PROGRA~1\\*") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1082" name = "System Information Discovery" @@ -73,26 +84,25 @@ id = "T1083" name = "File and Directory Discovery" reference = "https://attack.mitre.org/techniques/T1083/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" + [[rule.threat.technique.subtechnique]] id = "T1059.003" name = "Windows Command Shell" reference = "https://attack.mitre.org/techniques/T1059/003/" - - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" - diff --git a/rules_building_block/discovery_generic_account_groups.toml b/rules_building_block/discovery_generic_account_groups.toml index 640a15c10..06080aad7 100644 --- a/rules_building_block/discovery_generic_account_groups.toml +++ b/rules_building_block/discovery_generic_account_groups.toml @@ -4,16 +4,17 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/29" +updated_date = "2023/09/14" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ This rule identifies the execution of commands that enumerates account or group information. Adversaries may use built-in applications to get a listing of local system or domain accounts and groups. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" @@ -21,9 +22,14 @@ name = "Windows Account or Group Discovery" risk_score = 21 rule_id = "089db1af-740d-4d84-9a5b-babd6de143b0" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -building_block_type = "default" type = "eql" query = ''' @@ -52,20 +58,23 @@ process where host.os.type == "windows" and event.type == "start" and process.args : "set" ) ) -) and not user.id : "S-1-5-18" +) and not process.parent.args: "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\Content\\DetectionScripts\\*.ps1" +and not process.parent.name : "LTSVC.exe" and not user.id : "S-1-5-18" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1069" name = "Permission Groups Discovery" reference = "https://attack.mitre.org/techniques/T1069/" + [[rule.threat.technique.subtechnique]] id = "T1069.001" name = "Local Groups" reference = "https://attack.mitre.org/techniques/T1069/001/" + [[rule.threat.technique.subtechnique]] id = "T1069.002" name = "Domain Groups" @@ -80,16 +89,17 @@ reference = "https://attack.mitre.org/techniques/T1201/" id = "T1087" name = "Account Discovery" reference = "https://attack.mitre.org/techniques/T1087/" + [[rule.threat.technique.subtechnique]] id = "T1087.001" name = "Local Account" reference = "https://attack.mitre.org/techniques/T1087/001/" + [[rule.threat.technique.subtechnique]] id = "T1087.002" name = "Domain Account" reference = "https://attack.mitre.org/techniques/T1087/002/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" diff --git a/rules_building_block/discovery_generic_process_discovery.toml b/rules_building_block/discovery_generic_process_discovery.toml index fc1b1cb28..69bef326d 100644 --- a/rules_building_block/discovery_generic_process_discovery.toml +++ b/rules_building_block/discovery_generic_process_discovery.toml @@ -4,16 +4,17 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/16" +updated_date = "2023/09/14" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ This rule identifies the execution of commands that can be used to enumerate running processes. Adversaries may enumerate processes to identify installed applications and security solutions. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" @@ -21,9 +22,14 @@ name = "Process Discovery Using Built-in Tools" risk_score = 21 rule_id = "4982ac3e-d0ee-4818-b95d-d9522d689259" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -building_block_type = "default" type = "eql" query = ''' @@ -37,15 +43,14 @@ process where host.os.type == "windows" and event.type == "start" and ) and not user.id : "S-1-5-18" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1057" name = "Process Discovery" reference = "https://attack.mitre.org/techniques/T1057/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" diff --git a/rules_building_block/discovery_generic_registry_query.toml b/rules_building_block/discovery_generic_registry_query.toml index 8eb94c19d..75a979960 100644 --- a/rules_building_block/discovery_generic_registry_query.toml +++ b/rules_building_block/discovery_generic_registry_query.toml @@ -2,55 +2,61 @@ creation_date = "2023/07/13" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/07/13" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ This rule identifies the execution of commands that can be used to query the Windows Registry. Adversaries may query the registry to gain situational awareness about the host, like installed security software, programs and settings. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["logs-endpoint.events.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Query Registry using Built-in Tools" risk_score = 21 rule_id = "ded09d02-0137-4ccc-8005-c45e617e8d4c" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -building_block_type = "default" -type = "eql" +type = "new_terms" query = ''' -process where host.os.type == "windows" and event.type == "start" and -( - ( - process.name == "reg.exe" and process.args : "query" and - not process.parent.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") - ) or - ( - process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and - (process.args: ("*Get-ChildItem*", "*Get-Item*", "*Get-ItemProperty*") and - process.args : ("*HKLM*", "*HKCU*", "*HKEY_LOCAL_MACHINE*", "*HKEY_CURRENT_USER*", "*Registry::*")) - ) -) and not user.id : "S-1-5-18" +host.os.type:windows and event.category:process and event.type:start and ( + (process.name.caseless:"reg.exe" and process.args:"query") or + (process.name.caseless:("powershell.exe" or "powershell_ise.exe" or "pwsh.exe") and + process.command_line.caseless:((*Get-ChildItem* or *Get-Item* or *Get-ItemProperty*) and + (*HKCU* or *HKEY_CURRENT_USER* or *HKEY_LOCAL_MACHINE* or *HKLM* or *Registry\:\:*)))) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1012" name = "Query Registry" reference = "https://attack.mitre.org/techniques/T1012/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules_building_block/discovery_internet_capabilities.toml b/rules_building_block/discovery_internet_capabilities.toml index 9bc90cdf6..6fcf1b7ca 100644 --- a/rules_building_block/discovery_internet_capabilities.toml +++ b/rules_building_block/discovery_internet_capabilities.toml @@ -2,50 +2,65 @@ creation_date = "2023/07/12" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/07/12" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/20" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ Identifies the use of built-in tools attackers can use to check for Internet connectivity on compromised systems. These results may be used to determine communication capabilities with C2 servers, or to identify routes, redirectors, and proxy servers. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["logs-endpoint.events.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Discovery of Internet Capabilities via Built-in Tools" risk_score = 21 rule_id = "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "eql" -building_block_type = "default" +type = "new_terms" query = ''' -process where host.os.type == "windows" and event.type == "start" and - process.name : ("ping.exe", "tracert.exe", "pathping.exe") and - not process.args : ("127.0.0.1", "::1", "0.0.0.0", "192.168.*") +host.os.type:windows and event.category:process and event.type:start and +process.name.caseless:("ping.exe" or "tracert.exe" or "pathping.exe") and +not process.args:("127.0.0.1" or "0.0.0.0" or "localhost" or "1.1.1.1" or "1.2.3.4" or "::1") ''' [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1016" name = "System Network Configuration Discovery" reference = "https://attack.mitre.org/techniques/T1016/" + [[rule.threat.technique.subtechnique]] id = "T1016.001" name = "Internet Connection Discovery" reference = "https://attack.mitre.org/techniques/T1016/001/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id", "process.command_line"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/discovery_net_view.toml b/rules_building_block/discovery_net_view.toml similarity index 92% rename from rules/windows/discovery_net_view.toml rename to rules_building_block/discovery_net_view.toml index f79ecd709..a4342f266 100644 --- a/rules/windows/discovery_net_view.toml +++ b/rules_building_block/discovery_net_view.toml @@ -4,10 +4,12 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = "Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool." from = "now-9m" index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*"] @@ -49,7 +51,15 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "7b8bfc26-81d2-435e-965c-d722ee397ef1" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "eql" @@ -70,9 +80,9 @@ process where host.os.type == "windows" and event.type == "start" and */ ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1018" name = "Remote System Discovery" @@ -83,9 +93,7 @@ id = "T1135" name = "Network Share Discovery" reference = "https://attack.mitre.org/techniques/T1135/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/windows/discovery_post_exploitation_external_ip_lookup.toml b/rules_building_block/discovery_post_exploitation_external_ip_lookup.toml similarity index 95% rename from rules/windows/discovery_post_exploitation_external_ip_lookup.toml rename to rules_building_block/discovery_post_exploitation_external_ip_lookup.toml index d3d963d15..40219c503 100644 --- a/rules/windows/discovery_post_exploitation_external_ip_lookup.toml +++ b/rules_building_block/discovery_post_exploitation_external_ip_lookup.toml @@ -4,10 +4,12 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this @@ -62,7 +64,14 @@ references = [ risk_score = 21 rule_id = "1d72d014-e2ab-4707-b056-9b96abe7b511" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "eql" @@ -109,27 +118,25 @@ network where host.os.type == "windows" and network.protocol == "dns" and ) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1016" name = "System Network Configuration Discovery" reference = "https://attack.mitre.org/techniques/T1016/" + [[rule.threat.technique.subtechnique]] id = "T1016.001" name = "Internet Connection Discovery" reference = "https://attack.mitre.org/techniques/T1016/001/" - [[rule.threat.technique]] id = "T1614" name = "System Location Discovery" reference = "https://attack.mitre.org/techniques/T1614/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/windows/discovery_remote_system_discovery_commands_windows.toml b/rules_building_block/discovery_remote_system_discovery_commands_windows.toml similarity index 92% rename from rules/windows/discovery_remote_system_discovery_commands_windows.toml rename to rules_building_block/discovery_remote_system_discovery_commands_windows.toml index 90c6d2c99..0b70e684c 100644 --- a/rules/windows/discovery_remote_system_discovery_commands_windows.toml +++ b/rules_building_block/discovery_remote_system_discovery_commands_windows.toml @@ -4,10 +4,12 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = "Discovery of remote system information using built-in commands, which may be used to move laterally." from = "now-9m" index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*"] @@ -49,7 +51,15 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "0635c542-1b96-4335-9b47-126582d2c19a" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "eql" @@ -66,9 +76,9 @@ process where host.os.type == "windows" and event.type == "start" and process.args : "group" and process.args : "/domain" and not process.args : "/add"))) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1016" name = "System Network Configuration Discovery" @@ -79,9 +89,7 @@ id = "T1018" name = "Remote System Discovery" reference = "https://attack.mitre.org/techniques/T1018/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/windows/discovery_security_software_wmic.toml b/rules_building_block/discovery_security_software_wmic.toml similarity index 88% rename from rules/windows/discovery_security_software_wmic.toml rename to rules_building_block/discovery_security_software_wmic.toml index 8e3377602..12707e0d3 100644 --- a/rules/windows/discovery_security_software_wmic.toml +++ b/rules_building_block/discovery_security_software_wmic.toml @@ -4,7 +4,8 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] @@ -52,32 +53,39 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "6ea55c81-e2ba-42f2-a134-bccf857ba922" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" +building_block_type = "default" type = "eql" query = ''' process where host.os.type == "windows" and event.type == "start" and - (process.name:"wmic.exe" or process.pe.original_file_name:"wmic.exe") and - process.args:"/namespace:\\\\root\\SecurityCenter2" and process.args:"Get" +(process.name : "wmic.exe" or process.pe.original_file_name : "wmic.exe") and +process.args : "/namespace:\\\\root\\SecurityCenter2" and process.args : "Get" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1518" name = "Software Discovery" reference = "https://attack.mitre.org/techniques/T1518/" + [[rule.threat.technique.subtechnique]] id = "T1518.001" name = "Security Software Discovery" reference = "https://attack.mitre.org/techniques/T1518/001/" - - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules_building_block/discovery_signal_unusual_user_host.toml b/rules_building_block/discovery_signal_unusual_user_host.toml new file mode 100644 index 000000000..5c46f3400 --- /dev/null +++ b/rules_building_block/discovery_signal_unusual_user_host.toml @@ -0,0 +1,56 @@ +[metadata] +creation_date = "2023/10/10" +maturity = "production" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/10/10" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +building_block_type = "default" +description = """ +This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique +host.id and user.id entries. +""" +from = "now-9m" +index = [".alerts-security.*"] +language = "kuery" +license = "Elastic License v2" +name = "Unusual Discovery Activity by User" +risk_score = 21 +rule_id = "cf575427-0839-4c69-a9e6-99fde02606f3" +severity = "low" +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: Higher-Order Rule" + ] +timestamp_override = "event.ingested" +type = "new_terms" +query = ''' +host.os.type:windows and event.kind:signal and kibana.alert.rule.rule_id:( + "d68e95ad-1c82-4074-a12a-125fe10ac8ba" or "7b8bfc26-81d2-435e-965c-d722ee397ef1" or + "0635c542-1b96-4335-9b47-126582d2c19a" or "6ea55c81-e2ba-42f2-a134-bccf857ba922" or + "e0881d20-54ac-457f-8733-fe0bc5d44c55" or "06568a02-af29-4f20-929c-f3af281e41aa" or + "c4e9ed3e-55a2-4309-a012-bc3c78dad10a" or "51176ed2-2d90-49f2-9f3d-17196428b169" or + "1d72d014-e2ab-4707-b056-9b96abe7b511" +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/discovery_system_service_discovery.toml b/rules_building_block/discovery_system_service_discovery.toml similarity index 75% rename from rules/windows/discovery_system_service_discovery.toml rename to rules_building_block/discovery_system_service_discovery.toml index 1e9af9b78..97efd2762 100644 --- a/rules/windows/discovery_system_service_discovery.toml +++ b/rules_building_block/discovery_system_service_discovery.toml @@ -4,10 +4,12 @@ integration = ["windows", "endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/12" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ Detects the usage of commonly used system service discovery techniques, which attackers may use during the reconnaissance phase after compromising a system in order to gain a better understanding of the environment and/or escalate privileges. @@ -20,14 +22,22 @@ name = "System Service Discovery through built-in Windows Utilities" risk_score = 21 rule_id = "e0881d20-54ac-457f-8733-fe0bc5d44c55" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "eql" query = ''' process where host.os.type == "windows" and event.type == "start" and ( - ((process.name: "net.exe" or process.pe.original_file_name == "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and process.args : ("start", "use") and process.args_count == 2) or + ((process.name: "net.exe" or process.pe.original_file_name == "net.exe" or (process.name : "net1.exe" and + not process.parent.name : "net.exe")) and process.args : ("start", "use") and process.args_count == 2) or ((process.name: "sc.exe" or process.pe.original_file_name == "sc.exe") and process.args: ("query", "q*")) or ((process.name: "tasklist.exe" or process.pe.original_file_name == "tasklist.exe") and process.args: "/svc") or (process.name : "psservice.exe" or process.pe.original_file_name == "psservice.exe") @@ -36,6 +46,7 @@ process where host.os.type == "windows" and event.type == "start" and [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1007" name = "System Service Discovery" @@ -44,4 +55,4 @@ reference = "https://attack.mitre.org/techniques/T1007/" [rule.threat.tactic] id = "TA0007" name = "Discovery" -reference = "https://attack.mitre.org/tactics/TA0007/" \ No newline at end of file +reference = "https://attack.mitre.org/tactics/TA0007/" diff --git a/rules/windows/discovery_system_time_discovery.toml b/rules_building_block/discovery_system_time_discovery.toml similarity index 67% rename from rules/windows/discovery_system_time_discovery.toml rename to rules_building_block/discovery_system_time_discovery.toml index a340cb45f..6ec486303 100644 --- a/rules/windows/discovery_system_time_discovery.toml +++ b/rules_building_block/discovery_system_time_discovery.toml @@ -1,15 +1,18 @@ [metadata] -creation_date = "2023/01/17" +creation_date = "2023/01/24" integration = ["windows", "endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ -Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system. +Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance +phase after compromising a system. """ from = "now-9m" index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] @@ -19,21 +22,30 @@ name = "System Time Discovery" risk_score = 21 rule_id = "06568a02-af29-4f20-929c-f3af281e41aa" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "eql" query = ''' process where host.os.type == "windows" and event.type == "start" and ( - ((process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and process.args : "time") or + ((process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and + process.args : "time") or (process.name: "w32tm.exe" and process.args: "/tz") or (process.name: "tzutil.exe" and process.args: "/g") -) and not user.id : "S-1-5-18" +) and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") ''' [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1124" name = "System Time Discovery" diff --git a/rules_building_block/discovery_win_network_connections.toml b/rules_building_block/discovery_win_network_connections.toml index 071b80bc8..16ce86012 100644 --- a/rules_building_block/discovery_win_network_connections.toml +++ b/rules_building_block/discovery_win_network_connections.toml @@ -4,16 +4,17 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/14" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ This rule identifies the execution of commands that can be used to enumerate network connections. Adversaries may attempt to get a listing of network connections to or from a compromised system to identify targets within an environment. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" @@ -21,9 +22,14 @@ name = "Windows System Network Connections Discovery" risk_score = 21 rule_id = "c4e9ed3e-55a2-4309-a012-bc3c78dad10a" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -building_block_type = "default" type = "eql" query = ''' @@ -43,19 +49,19 @@ process where event.type == "start" and ) and not user.id : "S-1-5-18" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1049" name = "System Network Connections Discovery" reference = "https://attack.mitre.org/techniques/T1049/" + [[rule.threat.technique]] id = "T1082" name = "System Information Discovery" reference = "https://attack.mitre.org/techniques/T1082/" - [rule.threat.tactic] id = "TA0007" name = "Discovery" diff --git a/rules_building_block/discovery_windows_system_information_discovery.toml b/rules_building_block/discovery_windows_system_information_discovery.toml index d5c4eb011..61bfa2d8c 100644 --- a/rules_building_block/discovery_windows_system_information_discovery.toml +++ b/rules_building_block/discovery_windows_system_information_discovery.toml @@ -4,16 +4,17 @@ integration = ["windows", "endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/26" +updated_date = "2023/09/21" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ Detects the execution of commands used to discover information about the system, which attackers may use after compromising a system to gain situational awareness. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] language = "eql" license = "Elastic License v2" @@ -21,10 +22,15 @@ name = "Windows System Information Discovery" risk_score = 21 rule_id = "51176ed2-2d90-49f2-9f3d-17196428b169" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame"] timestamp_override = "event.ingested" type = "eql" -building_block_type = "default" query = ''' process where host.os.type == "windows" and event.type == "start" and @@ -48,6 +54,7 @@ process.parent.executable : ( [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1082" name = "System Information Discovery" From c2822e175c80c1b457e04734dc4b61e35c5cd451 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:15:29 +0200 Subject: [PATCH 20/86] [Tuning] Windows Execution Rule Tuning for UEBA (#3107) * Update defense_evasion_execution_msbuild_started_by_script.toml * Mostly updated Execution tags, also new_terms conv * removed index * Removed index * WMIPrvSE tuning * Additional tuning * Tuning & changes * Additional tuning * Applied unit test optimization * Addressed feedback * Update rules/windows/execution_command_shell_started_by_svchost.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * caseless unit testing fix * fixed caseless executable unit test * unit testing fix * Update rules/windows/execution_suspicious_powershell_imgload.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update execution_ms_office_written_file.toml * Update rules/windows/defense_evasion_execution_msbuild_started_by_script.toml * Update rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml * Added user ids to new terms * Update rules/windows/execution_suspicious_powershell_imgload.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update rules_building_block/execution_unsigned_service_executable.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update execution_unsigned_service_executable.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --- ...ecution_control_panel_suspicious_args.toml | 11 +++- ...ense_evasion_execution_lolbas_wuauclt.toml | 11 +++- ...ecution_msbuild_started_by_office_app.toml | 3 +- ...n_execution_msbuild_started_by_script.toml | 43 ++++++++----- ...ion_msbuild_started_by_system_process.toml | 11 +++- ...ion_execution_msbuild_started_renamed.toml | 3 +- ...cution_msbuild_started_unusal_process.toml | 38 +++++++---- ...execution_suspicious_explorer_winword.toml | 9 ++- ...sion_execution_windefend_unusual_path.toml | 9 ++- ...tion_command_shell_started_by_svchost.toml | 54 +++++++--------- .../execution_enumeration_via_wmiprvse.toml | 24 +++++-- .../execution_ms_office_written_file.toml | 22 ++++--- ...ecution_suspicious_powershell_imgload.toml | 63 ++++++++----------- .../execution_suspicious_psexesvc.toml | 19 +++--- ...execution_unsigned_service_executable.toml | 47 ++++++++------ 15 files changed, 221 insertions(+), 146 deletions(-) diff --git a/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml b/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml index 3beaffd08..4e8aadde9 100644 --- a/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml +++ b/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/18" [rule] author = ["Elastic"] @@ -25,7 +25,14 @@ references = ["https://www.joesandbox.com/analysis/476188/1/html"] risk_score = 73 rule_id = "416697ae-e468-4093-a93d-59661fa619ec" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" diff --git a/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml b/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml index d2d7937ff..b5acccf53 100644 --- a/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml +++ b/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/18" [rule] author = ["Elastic"] @@ -25,7 +25,14 @@ references = ["https://dtm.uk/wuauclt/"] risk_score = 47 rule_id = "edf8ee23-5ea7-4123-ba19-56b41e424ae3" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db" timeline_title = "Comprehensive Process Timeline" timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml index 68ece95a1..369ec7f7e 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/18" [rule] author = ["Elastic"] @@ -86,6 +86,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml index 7de464722..a07905101 100755 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml @@ -2,9 +2,9 @@ creation_date = "2020/03/25" integration = ["endpoint", "windows"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/19" [rule] author = ["Elastic"] @@ -14,41 +14,43 @@ behavior is unusual and is sometimes used by malicious payloads. """ false_positives = ["The Build Engine is commonly used by Windows developers but use by non-engineers is unusual."] from = "now-9m" -index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] -language = "eql" +index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] +language = "kuery" license = "Elastic License v2" name = "Microsoft Build Engine Started by a Script Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -process where host.os.type == "windows" and event.type == "start" and - (process.name : "MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe") and - process.parent.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "cscript.exe", "wscript.exe", "mshta.exe") +host.os.type:windows and event.category:process and event.type:start and ( + process.name.caseless:"msbuild.exe" or process.pe.original_file_name:"MSBuild.exe") and + process.parent.name:("cmd.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "cscript.exe" or + "wscript.exe" or "mshta.exe") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1127" name = "Trusted Developer Utilities Proxy Execution" reference = "https://attack.mitre.org/techniques/T1127/" + [[rule.threat.technique.subtechnique]] id = "T1127.001" name = "MSBuild" reference = "https://attack.mitre.org/techniques/T1127/001/" - - [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" @@ -61,3 +63,10 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.name", "process.command_line"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml index 0c6c03912..93dff83ab 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/18" [rule] author = ["Elastic"] @@ -25,7 +25,14 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" diff --git a/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml b/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml index 3e512129e..16df4b7d7 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/18" [transform] [[transform.osquery]] @@ -106,6 +106,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend" diff --git a/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml b/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml index 86fcdc731..ddaafe8f9 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml @@ -2,9 +2,9 @@ creation_date = "2020/03/25" integration = ["endpoint", "windows"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/19" [rule] author = ["Elastic"] @@ -19,8 +19,8 @@ false_positives = [ """, ] from = "now-9m" -index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] -language = "eql" +index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] +language = "kuery" license = "Elastic License v2" name = "Microsoft Build Engine Started an Unusual Process" note = """## Setup @@ -31,32 +31,44 @@ references = ["https://blog.talosintelligence.com/2020/02/building-bypass-with-m risk_score = 21 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] + timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -process where host.os.type == "windows" and event.type == "start" and - process.parent.name : "MSBuild.exe" and - process.name : ("csc.exe", "iexplore.exe", "powershell.exe") +host.os.type:windows and event.category:process and event.type:start and process.parent.name:"MSBuild.exe" and +process.name.caseless:("csc.exe" or "iexplore.exe" or "powershell.exe") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1027" name = "Obfuscated Files or Information" reference = "https://attack.mitre.org/techniques/T1027/" + [[rule.threat.technique.subtechnique]] id = "T1027.004" name = "Compile After Delivery" reference = "https://attack.mitre.org/techniques/T1027/004/" - - [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.name", "process.parent.command_line"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml index 414fc58c5..4b52077cc 100644 --- a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml +++ b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml @@ -25,7 +25,14 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 73 rule_id = "1160dcdb-0a0a-4a79-91d8-9b84616edebd" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" diff --git a/rules/windows/defense_evasion_execution_windefend_unusual_path.toml b/rules/windows/defense_evasion_execution_windefend_unusual_path.toml index dce462621..cbf4864f4 100644 --- a/rules/windows/defense_evasion_execution_windefend_unusual_path.toml +++ b/rules/windows/defense_evasion_execution_windefend_unusual_path.toml @@ -29,7 +29,14 @@ references = [ risk_score = 73 rule_id = "053a0387-f3b5-4ba5-8245-8002cca2bd08" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" diff --git a/rules/windows/execution_command_shell_started_by_svchost.toml b/rules/windows/execution_command_shell_started_by_svchost.toml index de9784d6e..707b1a6aa 100644 --- a/rules/windows/execution_command_shell_started_by_svchost.toml +++ b/rules/windows/execution_command_shell_started_by_svchost.toml @@ -2,9 +2,9 @@ creation_date = "2020/02/18" integration = ["endpoint", "windows"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/19" [transform] [[transform.osquery]] @@ -31,13 +31,12 @@ services.path FROM services JOIN authenticode ON services.path = authenticode.pa authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted' """ - [rule] author = ["Elastic"] description = "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe" from = "now-9m" -index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] -language = "eql" +index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] +language = "kuery" license = "Elastic License v2" name = "Svchost spawning Cmd" note = """## Triage and analysis @@ -100,47 +99,40 @@ references = [ risk_score = 21 rule_id = "fd7a6052-58fa-4397-93c3-4795249ccfa2" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db" timeline_title = "Comprehensive Process Timeline" timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -process where host.os.type == "windows" and event.type == "start" and - - process.parent.name : "svchost.exe" and process.name : "cmd.exe" and - - not process.args : - ("??:\\Program Files\\Npcap\\CheckStatus.bat?", - "?:\\Program Files\\Npcap\\CheckStatus.bat", - "\\system32\\cleanmgr.exe", - "?:\\Windows\\system32\\silcollector.cmd", - "\\system32\\AppHostRegistrationVerifier.exe", - "\\system32\\ServerManagerLauncher.exe", - "dir", - "?:\\Program Files\\*", - "?:\\Program Files (x86)\\*", - "?:\\Windows\\LSDeployment\\Lspush.exe", - "(x86)\\FMAuditOnsite\\watchdog.bat", - "?:\\ProgramData\\chocolatey\\bin\\choco-upgrade-all.bat", - "Files\\Npcap\\CheckStatus.bat") and - - /* very noisy pattern - bat or cmd script executed via scheduled tasks */ - not (process.parent.args : "netsvcs" and process.args : ("?:\\*.bat", "?:\\*.cmd")) +host.os.type:windows and event.category:process and event.type:start and process.parent.name:"svchost.exe" and +process.name.caseless:"cmd.exe" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.command_line", "user.id"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/execution_enumeration_via_wmiprvse.toml b/rules/windows/execution_enumeration_via_wmiprvse.toml index ef6f9c1b7..007c5850f 100644 --- a/rules/windows/execution_enumeration_via_wmiprvse.toml +++ b/rules/windows/execution_enumeration_via_wmiprvse.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/19" [rule] author = ["Elastic"] @@ -24,7 +24,13 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "770e0c4d-b998-41e5-a62e-c7901fd7f470" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -55,24 +61,30 @@ process where host.os.type == "windows" and event.type == "start" and "tracert.exe", "whoami.exe" ) and - process.parent.name:"wmiprvse.exe" + process.parent.name:"wmiprvse.exe" and + not ( + process.name : "sc.exe" and process.args : "RemoteRegistry" and process.args : "start=" and + process.args : ("demand", "disabled") + ) and + not process.args : "tenable_mw_scan" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1047" name = "Windows Management Instrumentation" reference = "https://attack.mitre.org/techniques/T1047/" - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" + [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1018" name = "Remote System Discovery" @@ -92,6 +104,7 @@ reference = "https://attack.mitre.org/techniques/T1518/" id = "T1016" name = "System Network Configuration Discovery" reference = "https://attack.mitre.org/techniques/T1016/" + [[rule.threat.technique.subtechnique]] id = "T1016.001" name = "Internet Connection Discovery" @@ -106,4 +119,3 @@ reference = "https://attack.mitre.org/techniques/T1057/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/windows/execution_ms_office_written_file.toml b/rules/windows/execution_ms_office_written_file.toml index 581098701..48aa8a50a 100644 --- a/rules/windows/execution_ms_office_written_file.toml +++ b/rules/windows/execution_ms_office_written_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/19" [rule] author = ["Elastic"] @@ -68,7 +68,14 @@ This rule searches for executable files written by MS Office applications execut risk_score = 73 rule_id = "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] type = "eql" query = ''' @@ -83,10 +90,11 @@ sequence with maxspan=2h process.name : "MSPUB.EXE" or process.name : "MSACCESS.EXE") ] by host.id, file.path - [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable + [process where host.os.type == "windows" and event.type == "start" and + not (process.name : "NewOutlookInstaller.exe" and process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) + ] by host.id, process.executable ''' - [[rule.threat]] framework = "MITRE ATT&CK" @@ -94,12 +102,15 @@ framework = "MITRE ATT&CK" id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" + [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1566" name = "Phishing" reference = "https://attack.mitre.org/techniques/T1566/" + [[rule.threat.technique.subtechnique]] id = "T1566.001" name = "Spearphishing Attachment" @@ -110,10 +121,7 @@ id = "T1566.002" name = "Spearphishing Link" reference = "https://attack.mitre.org/techniques/T1566/002/" - - [rule.threat.tactic] id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" - diff --git a/rules/windows/execution_suspicious_powershell_imgload.toml b/rules/windows/execution_suspicious_powershell_imgload.toml index 31d26f7e6..d838855cc 100644 --- a/rules/windows/execution_suspicious_powershell_imgload.toml +++ b/rules/windows/execution_suspicious_powershell_imgload.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/17" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/29" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/20" [rule] author = ["Elastic"] @@ -14,7 +14,7 @@ with powershell.exe, some attackers do this to operate more stealthily. """ from = "now-9m" index = ["logs-endpoint.events.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Suspicious PowerShell Engine ImageLoad" note = """## Triage and analysis @@ -63,56 +63,47 @@ Attackers can use PowerShell without having to execute `PowerShell.exe` directly risk_score = 47 rule_id = "852c1f19-68e8-43a6-9dce-340771fe1be3" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -library where host.os.type == "windows" and - dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll") and - not - ( - /* MS Signed Binaries */ - ( - process.code_signature.subject_name : ( - "Microsoft Windows", - "Microsoft Dynamic Code Publisher", - "Microsoft Corporation" - ) and process.code_signature.trusted == true and not process.name : ("rundll32.exe", "regsvr32.exe") - ) or - - /* Signed Executables from the Program Files folder */ - ( - process.executable : ( - "?:\\Program Files (x86)\\*.exe", - "?:\\Program Files\\*.exe" - ) and process.code_signature.trusted == true - ) or - - /* Lenovo */ - ( - process.executable : ( - "?:\\Windows\\Lenovo\\*.exe" - ) and (process.code_signature.subject_name : "Lenovo" and process.code_signature.trusted == true) - ) - ) +host.os.type:windows and event.category:library and + dll.name:("System.Management.Automation.dll" or "System.Management.Automation.ni.dll") and + not (process.code_signature.subject_name:("Microsoft Corporation" or "Microsoft Dynamic Code Publisher" or "Microsoft Windows") and process.code_signature.trusted:true and not process.name.caseless:("regsvr32.exe" or "rundll32.exe")) and + not (process.executable.caseless:(?\:\\\\Program?Files?\(x86\)\\\\*.exe or ?\:\\\\Program?Files\\\\*.exe) and process.code_signature.trusted:true) and + not (process.executable.caseless:?\:\\\\Windows\\\\Lenovo\\\\*.exe and process.code_signature.subject_name:"Lenovo" and + process.code_signature.trusted:true) and not process.executable.caseless : "C:\\Windows\\System32\\powershell.exe" ''' [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" + [[rule.threat.technique.subtechnique]] id = "T1059.001" name = "PowerShell" reference = "https://attack.mitre.org/techniques/T1059/001/" - - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "user.id"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/windows/execution_suspicious_psexesvc.toml b/rules/windows/execution_suspicious_psexesvc.toml index 9d558f377..6af5bd359 100644 --- a/rules/windows/execution_suspicious_psexesvc.toml +++ b/rules/windows/execution_suspicious_psexesvc.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/19" [rule] author = ["Elastic"] @@ -19,7 +19,7 @@ license = "Elastic License v2" name = "Suspicious Process Execution via Renamed PsExec Executable" note = """## Triage and analysis -### Investigating PsExec Network Connection +### Investigating Suspicious Process Execution via Renamed PsExec Executable PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections. @@ -55,7 +55,14 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -64,22 +71,20 @@ process where host.os.type == "windows" and event.type == "start" and process.pe.original_file_name : "psexesvc.exe" and not process.name : "PSEXESVC.exe" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1569" name = "System Services" reference = "https://attack.mitre.org/techniques/T1569/" + [[rule.threat.technique.subtechnique]] id = "T1569.002" name = "Service Execution" reference = "https://attack.mitre.org/techniques/T1569/002/" - - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" - diff --git a/rules_building_block/execution_unsigned_service_executable.toml b/rules_building_block/execution_unsigned_service_executable.toml index 6c29b7ca4..e82422e85 100644 --- a/rules_building_block/execution_unsigned_service_executable.toml +++ b/rules_building_block/execution_unsigned_service_executable.toml @@ -2,55 +2,64 @@ creation_date = "2023/07/14" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/07/14" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/19" +bypass_bbr_timing = true [rule] author = ["Elastic"] +building_block_type = "default" description = """ This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges. """ -from = "now-119m" -interval = "60m" +from = "now-9m" index = ["logs-endpoint.events.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Execution of an Unsigned Service" risk_score = 21 rule_id = "56fdfcf1-ca7c-4fd9-951d-e215ee26e404" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -building_block_type = "default" -type = "eql" +type = "new_terms" query = ''' -process where host.os.type == "windows" and event.type == "start" and -( - ( - process.parent.executable : "C:\\Windows\\System32\\services.exe" and - (process.code_signature.exists == false or process.code_signature.trusted == false) - ) -) +host.os.type:windows and event.category:process and event.type:start and +process.parent.executable:"C:\\Windows\\System32\\services.exe" and +(process.code_signature.exists:false or process.code_signature.trusted:false) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1569" name = "System Services" reference = "https://attack.mitre.org/techniques/T1569/" + [[rule.threat.technique.subtechnique]] id = "T1569.002" name = "Service Execution" reference = "https://attack.mitre.org/techniques/T1569/002/" - - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "user.id"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" From 89cfdcd4402532bc6d424d3e7ad2345a6014409b Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 11 Oct 2023 16:42:25 +0200 Subject: [PATCH 21/86] [New Rule] Potential curl CVE-2023-38545 Exploitation (#3168) * [New Rule] Potential curl CVE-2023-38545 Exploitation * Added setup guide * Update execution_curl_CVE_2023_38545.toml * File name change * File name change * Update dates * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --- ...ion_curl_cve_2023_38545_heap_overflow.toml | 76 +++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml diff --git a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml new file mode 100644 index 000000000..c050cef54 --- /dev/null +++ b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml @@ -0,0 +1,76 @@ +[metadata] +creation_date = "2023/10/11" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "Linux environment variable capture feature via the Elastic Defend Integration was added in 8.6." +min_stack_version = "8.6.0" +updated_date = "2023/10/11" + +[rule] +author = ["Elastic"] +description = """ +Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerable command line arguments in conjunction +with an unusual command line length. A flaw in curl version <= 8.3 makes curl vulnerable to a heap based buffer overflow +during the SOCKS5 proxy handshake. Upgrade to curl version >= 8.4 to patch this vulnerability. This exploit can be executed +with and without the use of environment variables. For increased visibility, enable the collection of http_proxy, +HTTPS_PROXY and ALL_PROXY environment variables based on the instructions provided in the setup guide of this rule. +""" + +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential curl CVE-2023-38545 Exploitation" +setup = """ +Elastic Defend integration does not collect environment variable logging by default. +In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration. +To set up environment variable capture for an Elastic Agent policy: +- Go to Security → Manage → Policies. +- Select an Elastic Agent policy. +- Click Show advanced settings. +- Scroll down or search for linux.advanced.capture_env_vars. +- Enter the names of env vars you want to capture, separated by commas. +- For this rule the linux.advanced.capture_env_vars variable should be set to "http_proxy,HTTPS_PROXY,ALL_PROXY". +- Click Save. +After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly. +For more information on capturing environment variables refer to https://www.elastic.co/guide/en/security/current/environment-variable-capture.html +""" +references = [ + "https://curl.se/docs/CVE-2023-38545.html", + "https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/", + "https://twitter.com/_JohnHammond/status/1711986412554531015" +] +risk_score = 47 +rule_id = "f41296b4-9975-44d6-9486-514c6f635b2d" +severity = "medium" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Use Case: Vulnerability", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and process.name == "curl" +and ( + process.args : ("--socks5-hostname", "--proxy", "--preproxy", "socks5*") or + process.env_vars: ("http_proxy=socks5h://*", "HTTPS_PROXY=socks5h://*", "ALL_PROXY=socks5h://*") +) and length(process.command_line) > 255 +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1203" +name = "Exploitation for Client Execution" +reference = "https://attack.mitre.org/techniques/T1203/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + From 9f61ce4923786c3dd7db9e63e512cb8a685f84f7 Mon Sep 17 00:00:00 2001 From: eric-forte-elastic <119343520+eric-forte-elastic@users.noreply.github.com> Date: Wed, 11 Oct 2023 11:43:42 -0400 Subject: [PATCH 22/86] [FR] Only supporting known compatible rule file types (#3167) * Only supporting known compatible file types * Add --ignore-invalid-files flag * Added support to ignore invalid rule files * Update detection_rules/utils.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update detection_rules/utils.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update detection_rules/utils.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update detection_rules/utils.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update detection_rules/main.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * reverting main * add punctuation --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- detection_rules/main.py | 2 +- detection_rules/utils.py | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/detection_rules/main.py b/detection_rules/main.py index 84e197ba6..c95ef2c99 100644 --- a/detection_rules/main.py +++ b/detection_rules/main.py @@ -93,7 +93,7 @@ def generate_rules_index(ctx: click.Context, query, overwrite, save_files=True): @click.argument('input-file', type=click.Path(dir_okay=False, exists=True), nargs=-1, required=False) @click.option('--directory', '-d', type=click.Path(file_okay=False, exists=True), help='Load files from a directory') def import_rules(input_file, directory): - """Import rules from json, toml, or Kibana exported rule file(s).""" + """Import rules from json, toml, yaml, or Kibana exported rule file(s).""" rule_files = glob.glob(os.path.join(directory, '**', '*.*'), recursive=True) if directory else [] rule_files = sorted(set(rule_files + list(input_file))) diff --git a/detection_rules/utils.py b/detection_rules/utils.py index b7ef0bf44..265742c52 100644 --- a/detection_rules/utils.py +++ b/detection_rules/utils.py @@ -326,8 +326,10 @@ def load_rule_contents(rule_file: Path, single_only=False) -> list: return contents or [{}] elif extension == '.toml': rule = pytoml.loads(raw_text) + elif extension.lower() in ('yaml', 'yml'): + rule = load_dump(str(rule_file)) else: - rule = load_dump(rule_file) + return [] if isinstance(rule, dict): return [rule] From 7f8a9849c447b50dca0b5dfa45782db887f36c8c Mon Sep 17 00:00:00 2001 From: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> Date: Wed, 11 Oct 2023 11:34:34 -0700 Subject: [PATCH 23/86] [New Rule] File Compressed or Archived into Common Format (#3173) * [New Rule] File Compressed or Archived into Common Format * new build-threat-map-entry-command --------- Co-authored-by: brokensound77 Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- detection_rules/main.py | 18 ++- detection_rules/schemas/definitions.py | 1 + ...ction_common_compressed_archived_file.toml | 139 ++++++++++++++++++ 3 files changed, 157 insertions(+), 1 deletion(-) create mode 100644 rules_building_block/collection_common_compressed_archived_file.toml diff --git a/detection_rules/main.py b/detection_rules/main.py index c95ef2c99..40f46270d 100644 --- a/detection_rules/main.py +++ b/detection_rules/main.py @@ -11,14 +11,17 @@ import os import re import time from datetime import datetime + +import pytoml from marshmallow_dataclass import class_schema from pathlib import Path from semver import Version -from typing import Dict, List, Optional +from typing import Dict, Iterable, List, Optional from uuid import uuid4 import click +from .attack import build_threat_map_entry from .cli_utils import rule_prompt, multi_collection from .mappings import build_coverage_map, get_triggered_rules, print_converage_summary from .misc import add_client, client_error, nested_set, parse_config, load_current_package_version @@ -385,6 +388,19 @@ def search_rules(query, columns, language, count, verbose=True, rules: Dict[str, return filtered +@root.command('build-threat-map-entry') +@click.argument('tactic') +@click.argument('technique-ids', nargs=-1) +def build_threat_map(tactic: str, technique_ids: Iterable[str]): + """Build a threat map entry.""" + entry = build_threat_map_entry(tactic, *technique_ids) + rendered = pytoml.dumps({'rule': {'threat': [entry]}}) + # strip out [rule] + cleaned = '\n'.join(rendered.splitlines()[2:]) + print(cleaned) + return entry + + @root.command("test") @click.pass_context def test_rules(ctx): diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py index d43d36aa6..264b4b960 100644 --- a/detection_rules/schemas/definitions.py +++ b/detection_rules/schemas/definitions.py @@ -90,6 +90,7 @@ EXPECTED_RULE_TAGS = [ 'OS: Linux', 'OS: macOS', 'OS: Windows', + 'Rule Type: BBR', 'Resources: Investigation Guide', 'Rule Type: Higher-Order Rule', 'Rule Type: Machine Learning', diff --git a/rules_building_block/collection_common_compressed_archived_file.toml b/rules_building_block/collection_common_compressed_archived_file.toml new file mode 100644 index 000000000..c3482ff67 --- /dev/null +++ b/rules_building_block/collection_common_compressed_archived_file.toml @@ -0,0 +1,139 @@ +[metadata] +bypass_bbr_timing = true +creation_date = "2023/10/11" +integration = "endpoint" +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/11" + +[rule] +author = ["Elastic"] +building_block_type = "default" +description = """ +Detects files being compressed or archived into common formats. This is a common technique used to obfuscate files to +evade detection or to staging data for exfiltration. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +max_signals = 1000 +name = "File Compressed or Archived into Common Format" +references = ["https://en.wikipedia.org/wiki/List_of_file_signatures"] +risk_score = 21 +rule_id = "79124edf-30a8-4d48-95c4-11522cad94b1" +severity = "low" +tags = [ + "Data Source: Elastic Defend", + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "OS: Windows", + "Tactic: Collection", + "Rule Type: BBR", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +file where event.type in ("creation", "change") and + file.Ext.header_bytes : ( + /* compression formats */ + "1F9D*", /* tar zip, tar.z (Lempel-Ziv-Welch algorithm) */ + "1FA0*", /* tar zip, tar.z (LZH algorithm) */ + "425A68*", /* Bzip2 */ + "524E4301*", /* Rob Northen Compression */ + "524E4302*", /* Rob Northen Compression */ + "4C5A4950*", /* LZIP */ + "504B0*", /* ZIP */ + "526172211A07*", /* RAR compressed */ + "44434D0150413330*", /* Windows Update Binary Delta Compression file */ + "50413330*", /* Windows Update Binary Delta Compression file */ + "377ABCAF271C*", /* 7-Zip */ + "1F8B*", /* GZIP */ + "FD377A585A00*", /* XZ, tar.xz */ + "7801*", /* zlib: No Compression (no preset dictionary) */ + "785E*", /* zlib: Best speed (no preset dictionary) */ + "789C*", /* zlib: Default Compression (no preset dictionary) */ + "78DA*", /* zlib: Best Compression (no preset dictionary) */ + "7820*", /* zlib: No Compression (with preset dictionary) */ + "787D*", /* zlib: Best speed (with preset dictionary) */ + "78BB*", /* zlib: Default Compression (with preset dictionary) */ + "78F9*", /* zlib: Best Compression (with preset dictionary) */ + "62767832*", /* LZFSE */ + "28B52FFD*", /* Zstandard, zst */ + "5253564B44415441*", /* QuickZip rs compressed archive */ + "2A2A4143452A2A*", /* ACE */ + + /* archive formats */ + "2D686C302D*", /* lzh */ + "2D686C352D*", /* lzh */ + "303730373037*", /* cpio */ + "78617221*", /* xar */ + "4F4152*", /* oar */ + "49536328*" /* cab archive */ + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0009" +name = "Collection" +reference = "https://attack.mitre.org/tactics/TA0009/" + + [[rule.threat.technique]] + id = "T1560" + name = "Archive Collected Data" + reference = "https://attack.mitre.org/techniques/T1560/" + + [[rule.threat.technique.subtechnique]] + id = "T1560.001" + name = "Archive via Utility" + reference = "https://attack.mitre.org/techniques/T1560/001/" + + [[rule.threat.technique]] + id = "T1074" + name = "Data Staged" + reference = "https://attack.mitre.org/techniques/T1074/" + + [[rule.threat.technique.subtechnique]] + id = "T1074.001" + name = "Local Data Staging" + reference = "https://attack.mitre.org/techniques/T1074/001/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + + [[rule.threat.technique]] + id = "T1132" + name = "Data Encoding" + reference = "https://attack.mitre.org/techniques/T1132/" + + [[rule.threat.technique.subtechnique]] + id = "T1132.001" + name = "Standard Encoding" + reference = "https://attack.mitre.org/techniques/T1132/001/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + + [[rule.threat.technique]] + id = "T1027" + name = "Obfuscated Files or Information" + reference = "https://attack.mitre.org/techniques/T1027/" From 3f2a709370391390c8f53fcc8302fedfc89ca091 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Wed, 11 Oct 2023 17:57:32 -0300 Subject: [PATCH 24/86] [Rule Tuning] PowerShell Rules Tuning (#3169) --- .../collection_mailbox_export_winlog.toml | 9 ++++-- .../collection_posh_clipboard_capture.toml | 22 ++++++++----- rules/windows/collection_posh_mailbox.toml | 4 +-- ...credential_access_posh_request_ticket.toml | 6 ++-- .../defense_evasion_posh_compressed.toml | 9 +++--- .../execution_posh_hacktool_functions.toml | 9 +++--- rules/windows/execution_posh_psreflect.toml | 6 ++-- ...e_escalation_posh_token_impersonation.toml | 12 ++++--- .../collection_posh_compression.toml | 10 ++++-- ..._evasion_powershell_clear_logs_script.toml | 5 ++- .../discovery_posh_generic.toml | 31 ++++++++++++------- .../lateral_movement_posh_winrm_activity.toml | 10 +++++- 12 files changed, 86 insertions(+), 47 deletions(-) diff --git a/rules/windows/collection_mailbox_export_winlog.toml b/rules/windows/collection_mailbox_export_winlog.toml index 2cf82c64e..7c12a1ffc 100644 --- a/rules/windows/collection_mailbox_export_winlog.toml +++ b/rules/windows/collection_mailbox_export_winlog.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/05" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -70,8 +70,11 @@ type = "query" query = ''' event.category:process and host.os.type:windows and powershell.file.script_block_text : "New-MailboxExportRequest" and - not (file.path : (*Microsoft* and *Exchange* and *RemotePowerShell* or *AppData* and *Local*) and - file.name:(*.psd1 or *.psm1)) + not ( + file.path : ( + ?\:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Exchange\\\\RemotePowerShell\\\\* + ) and file.name:(*.psd1 or *.psm1) + ) ''' diff --git a/rules/windows/collection_posh_clipboard_capture.toml b/rules/windows/collection_posh_clipboard_capture.toml index f7e9a2d0e..8c2019cbd 100644 --- a/rules/windows/collection_posh_clipboard_capture.toml +++ b/rules/windows/collection_posh_clipboard_capture.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/05" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -94,14 +94,20 @@ event.category:process and host.os.type:windows and powershell.file.script_block_text : ( "]::GetText" or ".Paste()" - )) or powershell.file.script_block_text : "Get-Clipboard" - and not powershell.file.script_block_text : ( + )) or powershell.file.script_block_text : "Get-Clipboard" and + not powershell.file.script_block_text : ( "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators" - ) - and not user.id : "S-1-5-18" - and not file.path : (*WindowsPowerShell*Modules*.psd1 or *WindowsPowerShell*Modules*.psm1) - and not ( - file.path : *WindowsPowerShell*Modules*.ps1 and + ) and + not user.id : "S-1-5-18" and + not file.path : ( + ?\:\\\\program?files\\\\powershell\\\\?\\\\Modules\\\\*.psd1 or + ?\:\\\\Windows\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\*.psd1 or + ?\:\\\\WINDOWS\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\*.psd1 or + ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or + ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psm1 + ) and + not ( + file.path : ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\*Modules*.ps1 and file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1") ) ''' diff --git a/rules/windows/collection_posh_mailbox.toml b/rules/windows/collection_posh_mailbox.toml index cc89a83a2..edc8573fd 100644 --- a/rules/windows/collection_posh_mailbox.toml +++ b/rules/windows/collection_posh_mailbox.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/28" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -97,7 +97,7 @@ event.category:process and host.os.type:windows and "Microsoft.Exchange.WebServices.Data.Folder" or "Microsoft.Exchange.WebServices.Data.FileAttachment" ) - ) + ) and not user.id : "S-1-5-18" ''' diff --git a/rules/windows/credential_access_posh_request_ticket.toml b/rules/windows/credential_access_posh_request_ticket.toml index 6e562f4ff..60304a4f6 100644 --- a/rules/windows/credential_access_posh_request_ticket.toml +++ b/rules/windows/credential_access_posh_request_ticket.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/05" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -84,8 +84,8 @@ query = ''' event.category:process and host.os.type:windows and powershell.file.script_block_text : ( KerberosRequestorSecurityToken - ) and not user.id : "S-1-5-18" - and not powershell.file.script_block_text : ( + ) and not user.id : ("S-1-5-18" or "S-1-5-20") and + not powershell.file.script_block_text : ( "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators" ) ''' diff --git a/rules/windows/defense_evasion_posh_compressed.toml b/rules/windows/defense_evasion_posh_compressed.toml index 89c00a98a..97ac8536d 100644 --- a/rules/windows/defense_evasion_posh_compressed.toml +++ b/rules/windows/defense_evasion_posh_compressed.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/05" +updated_date = "2023/10/11" [transform] [[transform.osquery]] @@ -138,10 +138,9 @@ event.category:process and host.os.type:windows and "IO.Compression.GzipStream" ) and FromBase64String - ) and not - (user.id:("S-1-5-18" or "S-1-5-19") and - file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads") - and not user.id : "S-1-5-18" + ) and + not file.path: ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\Downloads\\\\* and + not user.id : "S-1-5-18" ''' diff --git a/rules/windows/execution_posh_hacktool_functions.toml b/rules/windows/execution_posh_hacktool_functions.toml index c80403035..9f8ece14a 100644 --- a/rules/windows/execution_posh_hacktool_functions.toml +++ b/rules/windows/execution_posh_hacktool_functions.toml @@ -2,7 +2,7 @@ creation_date = "2023/01/17" integration = ["windows"] maturity = "production" -updated_date = "2023/07/17" +updated_date = "2023/10/11" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -224,10 +224,11 @@ event.category:process and host.os.type:windows and "Invoke-FileTransferOverWMI" or "Invoke-WMImplant" or "Invoke-WMIObfuscatedPSCommand" or "Invoke-WMIDuplicateClass" or "Invoke-WMIUpload" or "Invoke-WMIRemoteExtract" or "Invoke-winPEAS" - ) - and not powershell.file.script_block_text : ( + ) and + not powershell.file.script_block_text : ( "sentinelbreakpoints" and "Set-PSBreakpoint" - ) + ) and + not user.id : ("S-1-5-18" or "S-1-5-19") ''' diff --git a/rules/windows/execution_posh_psreflect.toml b/rules/windows/execution_posh_psreflect.toml index 947263e11..096063ec4 100644 --- a/rules/windows/execution_posh_psreflect.toml +++ b/rules/windows/execution_posh_psreflect.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/11" [transform] [[transform.osquery]] @@ -152,7 +152,9 @@ event.category:process and host.os.type:windows and "Reflection.Emit.OpCodes" or "Reflection.Emit.CustomAttributeBuilder" or "Runtime.InteropServices.DllImportAttribute" - ) and not user.id : "S-1-5-18" + ) and + not user.id : "S-1-5-18" and + not file.path : ?\:\\\\ProgramData\\\\MaaS360\\\\Cloud?Extender\\\\AR\\\\Scripts\\\\ASModuleCommon.ps1* ''' diff --git a/rules/windows/privilege_escalation_posh_token_impersonation.toml b/rules/windows/privilege_escalation_posh_token_impersonation.toml index e86397efb..9212e2a50 100644 --- a/rules/windows/privilege_escalation_posh_token_impersonation.toml +++ b/rules/windows/privilege_escalation_posh_token_impersonation.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/05" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -73,10 +73,12 @@ event.category:process and host.os.type:windows and "CreatePRocessAsUserW" or "CreateProcessAsUserA") ) - ) and not - (user.id:("S-1-5-18" or "S-1-5-19") and - file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads") - and not powershell.file.script_block_text : ( + ) and + not ( + user.id:("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and + file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads" + ) and + not powershell.file.script_block_text : ( "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators" ) ''' diff --git a/rules_building_block/collection_posh_compression.toml b/rules_building_block/collection_posh_compression.toml index 1982b9c30..1d1b3d612 100644 --- a/rules_building_block/collection_posh_compression.toml +++ b/rules_building_block/collection_posh_compression.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/18" +updated_date = "2023/10/11" [rule] @@ -63,7 +63,13 @@ event.category:process and host.os.type:windows and "ZipArchiveMode" ) or powershell.file.script_block_text : "Compress-Archive" -) and not file.path : *ProgramData*Microsoft*Windows*Defender*Advanced*Threat*Protection*DataCollection* +) and + not file.path : ( + ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\Downloads\\\\* or + ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\DataCollection\\\\* or + ?\:\\\\Program?Files\\\\Microsoft?Dependency?Agent\\\\plugins\\\\* or + ?\:\\\\Program?Files\\\\Azure\\\\StorageSyncAgent\\\\AFSDiag.ps1 + ) ''' diff --git a/rules_building_block/defense_evasion_powershell_clear_logs_script.toml b/rules_building_block/defense_evasion_powershell_clear_logs_script.toml index a14ffedf1..1360e9a62 100644 --- a/rules_building_block/defense_evasion_powershell_clear_logs_script.toml +++ b/rules_building_block/defense_evasion_powershell_clear_logs_script.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/06" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -55,6 +55,9 @@ event.category:process and host.os.type:windows and "Remove-EventLog" or ("Eventing.Reader.EventLogSession" and ".ClearLog") or ("Diagnostics.EventLog" and ".Clear") + ) and + not file.path : ( + ?\:\\\\*\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\Microsoft.PowerShell.Management\\\\*.psd1 ) ''' diff --git a/rules_building_block/discovery_posh_generic.toml b/rules_building_block/discovery_posh_generic.toml index 26cda1b53..29a7a9cdd 100644 --- a/rules_building_block/discovery_posh_generic.toml +++ b/rules_building_block/discovery_posh_generic.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/16" +updated_date = "2023/10/11" [rule] @@ -132,16 +132,25 @@ event.category:process and host.os.type:windows and "CSFalcon" or "TmPfw" or "kvoop" ) ) - ) and not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20") - and not file.path : ( - *WindowsPowerShell*Modules*.psd1 or - *WindowsPowerShell*Modules*.psm1 or - "C:\\Program Files\\Microsoft Azure AD Sync\\Extensions\\AADConnector.psm1" - ) - and not (file.path : ( - *Windows*TEMP*SDIAG* or - *WINDOWS*TEMP*SDIAG* or - *windows*TEMP*SDIAG*) and file.name : "CL_Utility.ps1") + ) and + not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and + not file.path : ( + ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or + ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psm1 or + ?\:\\\\Program?Files\\\\Microsoft?Azure?AD?Sync\\\\Extensions\\\\AADConnector.psm1* or + *ServiceNow?MID?Server*agent\\\\scripts\\\\PowerShell\\\\*.psm1 or + ?\:\\\\*\\\\IMECache\\\\HealthScripts\\\\*\\\\detect.ps1 + ) and + not ( + file.path : ( + ?\:\\\\*\\\\TEMP\\\\SDIAG* or + ?\:\\\\TEMP\\\\SDIAG* or + ?\:\\\\Temp\\\\SDIAG* or + ?\:\\\\temp\\\\SDIAG* or + ?\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\SDIAG* or + ?\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\*\\\\SDIAG* + ) and file.name : "CL_Utility.ps1" + ) ''' diff --git a/rules_building_block/lateral_movement_posh_winrm_activity.toml b/rules_building_block/lateral_movement_posh_winrm_activity.toml index 3aff00994..8c7359e9f 100644 --- a/rules_building_block/lateral_movement_posh_winrm_activity.toml +++ b/rules_building_block/lateral_movement_posh_winrm_activity.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/12" +updated_date = "2023/10/11" [rule] author = ["Elastic"] @@ -53,6 +53,14 @@ query = ''' event.category:process and host.os.type:windows and powershell.file.script_block_text : ( ("Invoke-WmiMethod" or "Invoke-Command" or "Enter-PSSession") and "ComputerName" + ) and + not user.id : "S-1-5-18" and + not file.directory : ( + "C:\\Program Files\\LogicMonitor\\Agent\\tmp" or + ?\:\\\\Program?Files\\\\Microsoft\\\\Exchange?Server\\\\*\\\\bin or + ?\:\\\\Logicmonitor\\\\tmp* or + ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\dbatools\\\\* or + ?\:\\\\ExchangeServer\\\\bin* ) ''' From 3e212e2b745ea22699a4f235ef7efe5b1b606034 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Thu, 12 Oct 2023 10:51:12 -0400 Subject: [PATCH 25/86] [FR] Add ML Jobs to Schemas and Unit Test for Validation (#3161) * adding machine learning job id validation * Update rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml * Update tests/test_all_rules.py * adding integration manifests and schemas from main * rebuilt manifests and schemas with lmd * fixed unit test linting * adding manifests and schemas for other analytic packages * updated manifests and schemas; adjusted unit test for verbosity * sorted imports --- .../etc/integration-manifests.json.gz | Bin 7684 -> 8113 bytes .../etc/integration-schemas.json.gz | Bin 2622511 -> 2623052 bytes detection_rules/integrations.py | 14 ++++- tests/test_all_rules.py | 55 ++++++++++++++++-- 4 files changed, 61 insertions(+), 8 deletions(-) diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index d7f09bdfc50b23605b29f8336a31105d265539e7..9529c165b233ca1de3d9492479cb886faa5b66e1 100644 GIT binary patch literal 8113 zcmZX2WmFql)GWoNKyiu{DDF_KXt6?YcS>=GBEjVrcS)c)g+M7#f(EzZF2Nx$c@>9^oiNQ}gZk*;>Sbf+Vd3TA=F072;p$*(uc*YMZ+1u+5 zc}0tYhMHD%jD~*mVP1i3BY!(cAWiw3z@zV`G^^Xg@Sn|uM(P#(I7QD8a%;j^yLSGS z_%LhIs5rs+ts8S`$;cR@v8j*5cQ>o?T7tQlg@XLWa3=o0H}e@74m63xn+%DzeRr9U z0rfMLoo%Q5(OkZuJkMB&D_JI$o0Ax)fnqdc0w`SBd0G|bouYq!S}*`OV$rHZLxjVH=Aqi z^OYZ&;$BT{B@dmJA&e=z$yAmx}Bj-cix2_gPP zm`7e1<#1stmD6!!_wc?`@C1x{Q1mCqz5aY^;MI1>jY(DX-Mw84%XaSPks`%8l{z!DDA0+ zhYy(6tzXg4FOI}41F<&`*1e1qbc56<*~UEXB=Gf5y;a}dogPS&etp3`^;7%MbKJv; zwiPHM`0#h?Pr8Y2FEvJ1nl0Oe2u5@2{cGF-@n;x3l|OIq>?F1w0vKvYo5D5kOGzMi z)|#3xM<9L~)#IK~lrBA*fkF{`8fwq@DSJNt;8&fd6k&=SG_cC>A@6Bq;OCO!r-^o# zvlI=qY<#g9+4HHXrwZPO6r9_IBZKT@fY}OI4&@F-><2@P~k;;t5XLnIcgVJ^$pBDKS6l$Q$qU}xeLS&B*9sd zDBNV^zRF$UXPOg``LX09EWZ1KnRUUKRz_D*mey=0MIJ~x4cDVp(8n^Mfaxi|nCT?L zbeTzUnbB(5TjL0;-(!P_HBRP3#aIBeB%{`5GyDh<@b$FJ8zU1Sx)!YBaha)(-uw75v3_r!3CNX`vtO2|An~^0lSf6RSZE1>`q;mHor6vFdlTwo zv@oEneD1;Ar#!Bj3`k>}qWWEAQqw*WmDEYe$v-MZQ~UkFmn01(jOD-$mITOa#}UlB=gNaXt#@yVe|P^Ho(OLQIJi0o=z4O{Q_Z=MPS zIq;^@D@XW|(d#L20KVXIvnuJOD8Kk7D?(CKro;@;ws56TSrcFj_UF(F} zdPNYrhfjkT$U>W`lrIGv>9!$8=w?`=|7ViT#zkr%`O=BvP+hXp5*H3tL)20Z?M(Sn zzBHUCcS=#0Dp_(Fqh8couCo@AhN7;8S5KKr+6yJ6^fT?c!qvq!S~@aiWxCT@xc9n9 zYZ{YsL@>v{`+Sp?Ci^$@{}n{vx~yBDJZh=9PWEzTvAP6W92D9zWkIE;5M8>WP~AIi zKjf;OoXED{F9N3d6F7^+=$~#+2Yeby{7p7V45=yXYxO%;CuKjCOi2#dv}DfzdQ1WftNG>kCLa3Mbrl;ETEU zz*4u@Z_{R-Epcgwx+#x$)zu&63q+MDX{HDgxhRz@MY5Iw=od$0SfU|-XiRukG)oMG z{okTE8j|?}A0k9F$`orWBN#m^FBr#`g%77UCV@Lc>4mD;_ zH`4T0ewFWvy1njnl=(K2VeJH(;6^tnLVe$M0*!DJuI`w7AHo~x^gBEMHWHVhtByF) zxO*KJE!^pK4%2NU=kq6j><%>x=rb~>Ho6_D1v+hJt6kt5P_CI!uhKx=8oQpNw}^wf z$uOUy7s)WOoSK2E7bW<~ZSbSxg?Bc1x8p$ED8tZ@kt{Lo7S9Qu z)?vJjYzbUPuA_?7&M}ahEm2T+2Jh24lNr2t`vp($g<}~K{VoI>d0T3zH2Uz#(;3h( zp&!xSPOsI`*`VK!19CIG$3Z@p8hlTL+F&Rk=-ZNQi}sPlh03eFI(^?R`%C$}9`j+Q8xcqapOvn$H&|h` zdf6p6q*F!Sr0vXh^T>QryoExTQkEh>U?{lO2c)BPBs<7%?4h15YY^fAq%WPyHN9kN zYbCVKw6GhT+|_?hn8Ru3_RXJsznI!}X4Zc4rB5~kXGQX|uo`W6U|+KMk|CQ9m`thu z`yj4%4c(Bl2KX}CW>zlq(50qGfHR7%_Fh$=z`;fzmkBXtEq;Mpwrs6MeJx}pqpHui zkjKIa7*w9_lT@qkrkD2=F`DiRQqxZc>9N&Hs_7FAm&-oQfeAQ4My>>nz=pQmPgA%p zYlK0E4mHC3Mp%Paf(rywuS{A7As91r))?$YrhdmxH9XZL8$$sh;BQ}yE}qf=%H&oY zw^`+iI>eZ*03O6iJCgNW*OEX z5zZ*#EUvLFY zC3a#S6sZaaQB13KA5Gsm2Ax^YmQUjiV9`&_eIonkub8z=D3`_AezHwN`xov3zNTl^ zGT~g$Zh!-@nM|^>xH*O&1Tzt}k{Rg9=21)Qk;}O>^G@LfCP%ZQoM)roo?Jd*OR3!r<<7c3l6>pSr-l zKd1Ye*m+tc`$^82)^(S+tctvd2fuT7%u6e^+3?^SLy2_4Gi=39oc?UhL7YKhYt{hH zTDKPl(pbUmm-M{bVb512MAgZ#>+y|Q~<+Zwc zL8vhh)Td8I|0yhH3`T|NI1CJ8g^O%LWu$*6mL`={i4^`Q%Eq3|2AQfhCCybPQcMp; z`fr`Yc{bbCv zTb-oOyPJ}EBj4LEvI%xG{_7KJVwt4r+h*0ABUyT}pFWd)5e?4wa4Z>aUi=3C^>rfU>)IwO@E7aNA9mUscAj9_{#%WcnUMbhFmsUc z!HRsoMZw{x&q~wF?GPM6nb2Y{K{X<^H^6XP;sPTv+1i1L@WcswU>3B{p~%lKZVr#O z0EbvmQE`d};!u$|Vah0|p=eL{GHZf}s#G1EWonq*gNLWxkB8@>M5kHKAh^foOdAk3 z&>aChzz2auZQu8=&|fjk7{4n_%%80mi4H2MB%f$hymEY&5I~PCqc^>Q5{Qd=9?}4+ z53E=7k%LP3ih~2LVb+Q26%}Z2dWHGkI~aZ-Gx3`_&FQrE)aVCe#iis;BAIdorc7mk4p3jWC%pZLo4SF5Ty%_YRy%cj=A z^#zyjgJ$c%AK*R2(*qi~ZX17Xu74xvzDeP-TYi74`tdFes+Mi)^vH(}Glz@87FKBt zO~Ss|b8{dz?V0hRsEdX6WcW}Vm?Auj6vjhfr3i0^b!T89xj!kaM&KS}q5?kD!hjD& zK{_#rxM5HW1W@--Bzu{oUg^uVILh%oQ-CeWvx|zDcR9?cG1!TU^y9>zWzqXzYi>uQ zM6CIug1j@*cBIN=IPLA>L0&Y_q5_3$xH~L1lw7f8)1C}kp;zMMGy&Q(CYhyEKme<6 z^wk9Mp3&g{6w^Q{F-^pxSAX?S0`Vt7lsg(`l(6TCSZg_(g0$)V$Rh7GimALf-9J9J zC}#}zx#KGLHdndvqK5MB{!B5yY%%xPC*MiR`sBY)Wkxg)hbMADeLbO!_do)3A8YXHPmSy*k-M`+8 zyaoz28B(e*%-*^-55?!)c&dp3f(aDeQ{@RuQ`$DlubH=2tJZ^J7K(dAa%Zm>vl-fI zO6KsvkWpq{n7eXvx;Z?86j(s@4WC_sg&D@c?3-THWTegFcS=`)&)(T$IX()4@Jv}b z$qli9JYWn8IiYpUszak7#<3P-GwR>A0KXoGpt`qm#XP#}JCjPE=2`ltirYP2+A)zd z({I+Q?uDx6Id0XPC~Wbod$W4Uc-Pz@+$df;xEx2SRhiS#b!lnR-<~62yM5vp>IPdKq4D_`((QFb#vfK1Uj~OJe4PfpGQZI?KGXSboGXVH9Juc}Z%ikx-q;sT z{+FgA^Wna?e15j{1L@e;ve3WoQaGS#-^X=3tAmbqW&bOdFsA6*N{<|w`cX%)Eq%>l z+%-_lbY;0Iv+|FE>AJd46UBSyV_0if?iW~5F6VTM3cruA_@Tbov46+7Yx-OFD3buL z3b!Nxn$hwQgv+41A5_zSb}Mkihi>3{Sl!$%dBm5he|S*sSk*7Bc+Quw;TG?nYzu91 zi``lly=b)aGp2K#VsB7{<5|kK5Es&;?>16Uj@jm z0+2gnk^8rjJNGUr++<6KyPq6re81WJ-n(N#CAm#_+`TK9qoFKc+be)SOU>#)ip8Dc zV|=MK1HHu_i+UTUPFC8cZ8B4V>Bl+JzYs^AKOQ{DuzIHxB4zB7A-$;)yUk)g)YSQR z+PnwO7Sd|C!n(i%8*?6@$a-gQhpYA}lI6u>rYuQ(K|x6_x6oKkWS4jSyr@dHyz_Rf z+F5Vp^jI2|l|61jF1uhaMOMtj7-`lZMOMTUB6-3Sj#6ZWJz+ORR@@T~Q)ERwVLw@x ze1m(#MC?eP#iW$v;9Lk7JS6bpV!pYabZDh%N~h-soP|-`$C`y-052t1yoP|}%A_S_ zy~_J)0G+>P_Wu56IkJ{Mp_^!}FO1Xq&Pd}yk!`Ryh-?xvgveQ!9 zNi^(9zl1wtmMwMXI2EWN_oeA zXi^kvsLafWL=cTb635Dp)Jsw&%vz73$($d;GLvN{Gv8}UJ(FW=wt!duBrBe7iF3&%&>;xDIn5Xuuz`!c`W`k-eO< z%5X-VM|FrFLI*>!zy1}C|1y}uw)$|g9Od)AJzqx@7Zl7LD0t9(qE+qh%ro}qoD1Pm zv-nEO%*(^4P%a;BGpIV{)Uzq&bd&r@loDfICplMg3z52iRZ;bQfinbmdw6wdj{1?- z?&}RruX&B#-|2y~^YfWto!9>Ji&rY|g);K$1rxG)mg>;#j^{q_2pCnB^V1r=sCm)D zrO7ASO{qCJmunhBdEMKPaYy zQ-mzU5nJ+c@%N*dSWjH9AtCg|9}k9RE%@Qy^tM$;9l-BoVRc2AlM2V2orsOaG?VWO2`OoXCZ$TOJez8PQoAOptOc&ZX@n&sX|d+W5s5lkWkWK$ z4ly}D4mE&}*@6W8>4_3>;|P{ygswSh0CEUCYy_Cd33AXpm>Hr0`FR`4vc%w@3v>p= zu^H&H|{`Gya* z_l=uoqrf+dj?q=ay7jiBQ1(k~#59G|(p+ctFh1+nmE%GHMXI@0wE(p@$=h*J5pVn@ zfH#!+M4E1 zqU@H~NlY8({wRI=ROC^?*aw@xUpsP&dl`)vqRib0lL33r_PmDz5vt54b@bvwGp@Nj z2GnYu%eZE}TNR-#SUVm~PF+X_9yKF5qRSutU4h|4=%q{G_x=qNFW`zh>AAI`q*27* zYG25x(3Nep{;T;5#!pQ*dy4&9*tVn3rxmX|)@M9Jq=ao{sGYvQ(Avusg8m9BvdD*8~ zaeOz;f4g|jg1>;)zhd^nlu=T{$)7GWZz3y?eiCdv1(x?$cJhx^8lTR}0~FagsEtD= zz;d}sO&;?P8Jym`IM7`jM#)kkNkGweSn>Dh3svZDCX>JHeqkg%olw#21yf4iWL6&I z6p8UvVV$8WbooupQKoT=9ccOgPlwIcd;_-G5$#K=?E8;1&IWv$z06Z6zvhDOOYSEM zf-7LKBj&0jrP@_x6Xe_=#Vo52j*`T3VrH&=D+R2uV%Fx>A)d1ZRiO9yH&yiHwh#O6 zT$6=x9b@wpT{%WcXuwt){nG-kX@#bZ0=5zwzDfl@LQh?iZ;y|%Mw%(dURiboemXlH zDU%avYnchuy5F;x5|;wUYwRRwB%c`hBkYI{YcKokz^6EEr#OsKr6N**uI(K&Us}s` z-~~@BLG?+qKVqBs(DSl>oEgD-*{3MxB`9Url7h%l+i+RGcPzDw^WOw zBmc43_2&rB&$4rak+6%mu^oZxR*&lpG*FhB`D4?S)jbr$kQAQH{C_fo9xi@g|1@kH zGHfdg-=|K}0_AzGB+ty*EBU(_T!$PtPK0~<;)dNLVt@K&dqyD=9qr~&mR*`@c?u5T z5iLM3ha=@i6S;>%Up|1F5=}L2G%T&#DnLLS(Krf7x3Unj`DH(i5Y6=B$u8~xYAZTHO zz#X}$nVwwgt*vk~vB_ya!PF{m( zeJ}UHXt9Y-#s8(_hGXd~W=ann z+dbnAzihWA;2)WA_}BKwG^Tz{YzMvlr99)uGV+W=r=b5~sW7 zcVujbn#N}O8nGDN;Y@1{9nEA%w{6GhJlm5209mK+{Lx0D;dx|%^I_C=|^j> zzi^5WVoC?=_%PU7W?R64MuO1=>Bt$g^igdCB{h7>7yG-6l(uW01bX#)(&P#I-B=|- zY_=NKaMgSi5dB8PMQC%Z%J*guKaLyp`+ltAmuA3x*mKqbv&-$w^Y{M$ZW@l zpg(?ybWf&iKedSHoZs@C10EY&!*;J0^Q8s0r0xP9j_uJ^}Xx;=k62xoU_kecm38~_tM2YeY%``Z;5_y>*#Lv*4512*2$66!OYRt+RDw{ zjmyr>$r0_~N8oQstL1aA%N!LDM;UFd-7LQ!#FZG4>C zIxp{)nyxvU1w@}9q=c}|kzX%61N^hwFHc>FrT;{Xc5e({gKyrO9u7c-{sbQJtqZP9 z#OV(E2>D#+U|d$V%7edhMNoSVxgO)@l|KpRh2$>HohOis zw-OhtW&$nQ+;lM!F@pC)%Pg5#fjJ=`H*@)vy#hPVOXo~F2z3ybtVjDREUN2UW6o(u z{jNOtxKEy!d|s>WJU)vclmIyK{#j}vw$55^a(d3}!kD-ro(z}*4hYssq>7ObHaWo`iYGYew9k1e-3d(04FW%Q>p?AUn{4xnTxK#DwO1_XRVs*vN57%Vo za6+o9Sh;r^hO*vpcts*)@%nT%%hsj#jGHxx0!)QNt6c`iK?14G#3&|#nX*ljIsU8)V4<- z)#LTXWqi(~G5M(|6bNk5fC6)YILU_Pz-U#HoIb-!ASf63OQll>I@>y96foupswJpt z_GcEZ>0lOaZDzPKOmg0AH8Oj(dE$)M%Az|lVA3N)6yf6M@VcWXDWWGycK)fTgR|v? z994fvYA|@-rtqqPCqE86pXopUW?YuafkV^*W>Xjk2Iqna8W6HnHHe?Cv4K=Z4N29^ z!Omwbbe=U&n_bImEa}LUX4ErZTLBF!86$V)%L*$Y$z}1ukk*RA@4KtJ!SLOu1(4?M zylO~YHDp(f#?We9hek#VOP8`idjME&QShOv5@LO0eVPQZ0ohl^(^rI8*THw?3;yFW z{Kr+x9(O3v*z&JVNcg7?&HP|X z2z)fHEai@pYh9ailGpAiX|iL@g4Q=QobdIK2)%Ep4$*%QMErn0p>wUPh_d7Nzli7M zj#)1M4{i`!Cx^%tc89=e=OSqH127U?30Y`aeg%4;VpBo|8#V{4=pkw}-1k6@H5Xh4&-GO3=RA{xCtbk=b}TFehQ=c^Dc zrt-1~F+<_(QvXW>2C5@K^qjErXwuW+gZ77>vHV$dJctx@nNS#f| z>Vd5XEPttqS;PjNHY14HKO7M$cfP8ES8 zXrXLB7I9Ez!o9Q}N=Te?6?xS5`EoRifgROplVm|F^O{WKW1<34 zv1Inc+y~OX#mXGmVm02QHnb@O7~9XU9WCEqoN!K2ChG5S-?1$QCe0N1H1yxRKMW=O zcQ~4386&EEi;eXP;eX&AtRnb7=f8#wQ5P~u$V^B#@YFIq@6=F6N7ShBO8}H5`6Fkf z`Jn)1iGPL+U?kLrs5;69q|T39AkhFS(33{MBA+0#BCSbf+~_H#?HRJ903%`lNL=dt zg#SoMho4_!*5HYw_}J@dkFXK+`lJY;IzQ$=15!1(K^q-z|Bc&nJM<)C#mo+=Xs^prpHw?}3JufzE;u4eiLWzO-LagM9woTkn&V=uy;9Q^B} zI?ToeA4pQ?_!gaO22?AC1y0Y<30CH>wvzno5i7VW`d8MZH+~N1m)%V|9oQ94Wvldt z>}zEL)HN@~o59`C0;lF~G!(xivcrtw`NN!;UsN?Ozcqn7=A>7g!ya`so{YS>4rj-E z7|n$cG&FmU8eM2)=KL>tJo3W$zvgM2XIPia?Gx0@Es{M!4noWa9SHyW@Os!wohV3> z(;n4vw01#k=RG)ZtfJt=c;XEqY!-@JQ&h|QEdGVV4=U1x7jNkCIvUR&_J2nGAP0(C z&3P5I8UP`|QV5{l<*C#(%iAiT*vist?;l>vYaFYl!}0-vlqDxe^wdgsVj~kbOfw1DrW1 z9-Q$vE>Rv>&S_7^#M)6~zVFB-ao z8@HaB#6U=g&Zy6wd@TC?ld?v8UBGt}vAGV>zkHdLUF$EDDrat{@~>o~CKTX8Tx4`S zcA)7lF7UAVJrh=EtZVSWnDwXO4VP_tbQ`+&%DCSo(0b9R70?Ej(w^oypnZfKd&-4< z-dmv8$LRCA*^{RCqe?|yoioLH4cxW2tLATwL|%RQbG-8PQlU_90D4{QorN=(k%J|} z_c}l*I_10^u~qN&PT63=W!?_EV97*-;?CPQaC$@WrP0{sr?JJzI-@ArOV%O16RqRK zx!Om@&3r@iiugVLpw`PTiiv$mfuC8Rz@M6~bsnx460SIdzf*Gxn6?{O-G4LdGAH}C zr&IRb@Wo@BTx z4ArGdMrlU2?y>R=2((9!iZ7U5TkO5mYsd@Fs-kC#VLy^mo?%MYGxVWztefJE34E9a z9W+9Y|P@ z`fWrO$AM7HLwtrIT`x9-(yk87^B*KY;RBCL_@7{oYRoVmG8B&y#Vdd2SXadRs%=s) z4z#}K+}|pek>PWpPTKF4D|&Yxaw3&@<)ki275@70wXQ=FudEtM5o!@#i-@c$ASj0Y z6-q}^ij3mJJyfXc*}MB$#su@od~$b=(F8W%=a$Xpl*Qs9C^q+)mGmIqRg?61E+s=a zVJbdfWGR3C#gxa0Q#1At?xKdD*QLAgDq-KQdjF&=&2y7<7mePWT=!=Q z!@um|jM-W#-0G{${cJ;PMNY?~nNPACOP4pfv!8Sg&DN0HDc$x8(sm2A;cxF8DW~TS znF#4~Ic5a%E33N6?tG2kS~Gg-ll5b=;Vrb0{%bpoe8}@`DJ03yLj6$HLlIxg+3EXI z$>QgYbn*bq%l<{ou&<9-zPcQ}4DJ_RC0KdoN&z_J@;~ZdDn9?wS`1=u7Th>gC)XUK zE&R0e-AIkRmM+ErXRr%F`R~CLy?PC9`rP+QCOz6{r^AVu*ma?U+*0XF*ZLRqJsVFF zF^TIiHZopJ>b%t{<1!Aff@o2U-kFk!2R=tV-kyX{1`8A%yEFNT=7I;f`QR+HUu`-C zgp1Sp`*Doqmzvp!x?{LbgvxllCMLMKPG-vlE^A^~tyXq<42yC#U?ztH3!(<2t4-_A zk=xt(M6U}$aJo6X@78+-$$vz|E%J8J%ZfawmBTN>9q$X1vi6BB2yb;#p zM`>tT>Z|B>h2JRv&F>*-`f97_yXdGiZW&e{CZ=ef(9kyE>is%PuBItE8`at0hvUcc z;+i8C`Uq0PED~#+$VE{}nBGHE7|y|xNKQsusEjVGu zL38Yls7#pX$M|9HBTZ^ksqNQB(K<~pY&Z4X(oIM^&5Mlhv_5Qn-pO5vMJ(XI#k-Ra zwpkmK8zI`HTZvVL+up6PFOnEYtZl~cm|qlie>M?x;-yy!9xBi0S_sZat4yQolXz6Z z68TD~|AtV^i`8K}9K6NiWe_MS7Z{w7JC&5Xfh=|3C~dyNrr8tg(!Kxx01*habMYn( z3J-(#U^1wC-9&@NF|e~H5d1RyBU8j#&`|50ry~qfq!7u%XdLBEY(p>*kvAdu~DFmqfZf0tI)u8@N(;s1CxG2uughOC)zxxz7JnXKAE^d zlnxO>a)AHv&YeftkVlBD6QQ}89 z5+3Nuo|$RCL@OlNZEO$$T5&oP;{`Wml+^`!eTW(qOgG|qpcH8s*>}$?G#F82J55X1 z6Ny`)&G?{;Z)(uI_r67grM@3R+jmPv!{aR@_$EAH3*k!8##;Tvh-N5VN$}0@7On1u z&BrmtTaW9Hu`F*m3yT<{uI!%dvQCJLNP6YTrZO$G4u{5bRC~KsGgPg5JzkC;agywe z)oH_|a++dR_CA|twn^h(tIqV!F6*Q^2G8v};kHp7!)+e(b5aATBtT0prac?7f{Y#l z!Y0pD=4LJ&TPI?3=G>Ga&_HZv1h4Tjlk9bL{c=WTKu`E3Q%UyLy@&qFo=y1qM1irc zQZzWDZM>gV!Z=WdLSrh-E)`q^_>ejtp1Nw3yk!Udu+iri3NFGpiWbpTjBZs*sK#f_ zmLEcd16*)sPI*~TL7^i%ABWURrcL6~-_u)oA6nJI3Kbc<%(9=UW?v6kQn3XUD) zEyv~kqtDl5#Lk=GQuit!w@x>^^VT;h2_<+ID8a(|MqC%+N7pknCWcCmN@yH_5b|D;VZ9?m>^#GO4iZQ4IETwr}#6P<_IsB1_e zK^piO&Kper_i9Gg#>WR~cZCfO)KCoc-_*4oRBfNxrPe=28szrOoL-$o+bh|0jjd(v zte7lqFF-b9y5}^l62-W!C32n}iTyQKy3Npqs;*c9u+*=$E1nlEz`(Xo7?woenUwZy zE`?$fbSyt}JigiY{6Ol})-(%w3Sc%{tmkmgNA>7Rkme!iF=)L?VL_l{zhvpHV9UtGW$a%K%=4yvzmPX z^x=yhWZFTe)X`*m^>jMT0?AecSDA%@VKpjYQ&z7OkKMbsc+5#5W~8v$B9&PnE}Rrs z#25$ee^{_Ta@5V@eZGCRf6`;;Drh2VP3Y9~=e6Mv9O=tS4-%MQe2NvIL3-JCT28xZ zmr*EpivyxvbRp}Y{grZ~@nvoax8r-!Tc!~Iy|LRq%X+hmSh3;U>;TTKCugMZ$T*qj zkki*-6|Z~`Ym1I?49QoTHo<)SLF1! z>2JaK$cr6l$DKvg9rCPnV5YHH?PB!fCkEpzL}R@i zC^D(>@M!E1+(wwpl0z@*>z@qBUFt}d_V+)T>&2<>LG$Pxc%Dn&A2C$_^U5ZzG-RlL z>|Ci{>VabFGvmzmKd@haoTKT+G0!|GHj$)D| z6hh1ETRY38k zCChqnrx_xmEw<65$coe)Qm59!>?Rc|4j+G6IMsnI6@tDuF*wyF4LJWQ)UR>?kQ)HN z1$i=N^)hSp(L)w~3tH50EyJQyjhIRYAuazb=0LwOCTE@Qs25jDk#{8!1+l#x8ofz{slr@=r z`?pvA?5ut|kkrDbsp;Tns@=|jsu%BC#j{Y- zBT`E(#ge5=<;N&qfu_D)5=WUpPW;fWXW>QDnmBsLR{1u1ncsuCaZ}R6!Z@z#zS!u^ zKDgOgVdCWedQTO|35GCD$O)7#_G?{Xm3kZlHS1jx+YqMzQ}g# zDquuo>w;o8F)+i}0sYAg#5kHP$=rZ2wMWHII;OZW(KeBG0Ra!vy!B6lJJ*g zGStp8NK~TSY?S*slfeb$zKUTb$>1a*OgffcM=%avygPNLk`6rg*c>3cgd91!nBOh# z&s`#Pky5GMnOOCvc5S&z!9rkB$HPY}oiA=152;q}ljUAJg>3L6+JEkg9eV4!Eycnq z8TNV8s`cFL6-2thzx&89t(^B=d!kx8^)C>Zn-p3cBjHQZqkN-rMvuK_2&(seAD{Bg zrwbJ8z*<1ziJRqSL4Tgtul8^RwUE>oRU?6bS)DqjnpZylkMYM3$6c35G>x&JCVC}0 zz$s_L2d5MND9QRYlhj!T@8`9a1@C{+rr@I2mGGRS_j_-MIcE_X``CoZvgUEFP;1>X zo-2>TFXG*E?f(1gJ)dOmg0#S^%?q>-MYMU2r9Xa-Xw_-s)@f=U%9FO-?KHyyOHpR)S;$UP^#h2 zw-Sn=m=QrSNWA1rd+WTK#rtqw)WJX1{BUN%fd2Y5h1I^Fp|F`)-Hg4KMte0K^o8^x z^N=U*t$-hHM5M5@Ozf}a4sU~+{s^DeSIf;Y{44~_Gk9|*R^O;3{1Oh)I9fc1aDd#! z$ELGBDHd(pDvvQvlIl;AO8aWq`zFh)+A6CO?|jgoMabP%K8MH(A1yQwDgs<_iZ4LDR1-x zAw)FoFO};2{-=Awj6S@f=90s_{jIIhkzTLw*hK4cedO;?#UAZ%mlCZf($Z(zF=p^> zFAQw$1E#(>$-Dhftd=vEFC8A4#X1k2IhVdPn3Dl#myaH{q(-4l{InN|m+|HIRoG)s zwo@u9^%!d-`6r;LFdSk()^@T~njm&-`j-fJw~!60=L(Pc`kkA$?b_RVIzM}P$-bk^ z%!5CdCKuYzeBRG2f5p*$P#<|Q=ZmZ#yb4{u!XVC_qRIuXxt(*h5!4<-d?}10-gq0e zAGk$bwD>M;Cm*EvA{l8Ql)3drgASvh6Zo;2fYvD55707&BjK+8q27B|hL@Uxrq&du zn}68JB~F`TI|5Z0?osc8Fi@S)p`qyVF2v5g!8Y{_c!@n{6AKZL4^{M}_*P z;5zCf1vV*su~TRya@UTOBpuyh#fx`hN8b(@rEz>!@zLn9`{j;jbEvB{#o-L1xP^Vq z5r2uGDcur@^mHftH8ZX)-3mg1K$JV@cy+$L$Maa`%boQy9XZ{^U-QmQ;Wf(cKOZeo zwh|=O;I<058!;FWy4(NqwQLotm`0FEx00Yd1qLHbRE{i+tM$3vsscQId1BvSwQbBt z=~Wxl{d@*N#@~wL5MkF`(PIZKt$a$FS;>YyP-zni0j0^kh zhZpwmo;OCr%ilnQ#)G}$csnv>b!v_f+7K;Z#*V0VaQcPTUY5Rm}Z7f;^ zo#?YZ{RN-Y2Jh4cW2F99uA&pYjH?Pw|2Dr4#b2UhyXjUFzRh<OQp}-`_SWZ1#CR8XD?PTTUazlRZr0Lu98;bx0juR(F|G4ol4cgF#7b0ZKIoB-u0_;Pj39wU-+rb9BOrf dY7`#%UpiGNkIbV{{}k^DffUAVPJ9?>{|~`FKvyw@C5mQV0=KZ zJ|H+B&|@DEyblP$2lT`Tbf5p!2ZZPYLh=D2`+!hx*@ z0b%=qaC|_xJ|H|F5WWwHzz0O=10wPP5&M8hd_bf=ATl2ixetiK2Sn)uqVfSf_W@B? zfxvMw0E3k6oN~=3z@dXo8MFL{BhRu4Z%u^U4Iyc`@Jw!@lCG%`i_x{S z5-AFH%`SQ^gM@xf$LzcKRw0r|6KOdKANtXkfB_dK;ihEc=7+N(pkw6;4u9!S&ki(t z5A8#^AX4S)uPa^W%|Dl~Ig~~%`;3&QNHQ{$sjHPRosqDy52;H=r%xD+n6Kss_lkAs z!^%z3TXlO6Ls))3@zLz$kT6Ym_*9(306y!Kn35y)7?D!rwEB`lKQpV-ejxh}ZjYW; z6u8N+c--IJn=X!{kjntkb%6bu?Z)HCFw^U8{J!egmG;}%aKO7`Pv+>1y6V8K@R%?zi9wH~@^h_~3OCPhW0M$|LTP)2jUR6V>!^;6C4N z*(21Y(-Mx1m>^3DhE-A$Bq(sNE#sO9L7w$|p8PVD41VYFU$~Z4F*3;9DROyQy;g$! z{lna>^)yAa2(5Z zmwd{PgbK$P?l`qcyN_mU%TjATm=;R)_9{cdKJxJ)C${^6`6 z%2~1AsXD1i+-Rc_p;TJ#WfxX1RUQ z|039Qh02~=z`5iSwII7ZiM(N^4*#5s>1muqaizQ|-(C0PX2iq<~YfIUZM9KD@3N>7Hy@ zCT)2eHN|?PZc}xc&aptJRM~0+$Z5EZqtXEIuEqX&BOGDQOfo$}4R@#T}Upg=f0wP3s zmR$4JwaeCR%f6JT!CXv48~g%9)Abe&!#kI*gCmNptu(P z8Sn#h8Qdy;jd~+|NwrdmnJ0?e;TFXLC#cr@VYF2wOupdn<@fX=K>Sc^m3nZ&GJ^qox!Z zahf6d?jP7s*C(Ez4xi}kB21v2R#;}|m20(4zf$(1a47R-b}09iagf`Fi8arf{K_%0 zq1w)8yL)1tS6NcnHFh>W;x8=l@v)l7A_*-?nD)C)Ewwzsk!)+faOOnc{rF3kAaS?3 z&pJ>`0pVt=7ACFQ={&1SkxROllq2(OhiRBh~ui#z5oj!QD4@Ad_*l|in z_SjWx+}>ku)xuoUJ-8;$XsTs+CnRD`CM>*!`c1l;KcZVFLc+#3rdA#AHjp0%Dy1c0 z>nr*+?5K~Y*Wge#x38?Do&Wk$cMq8_#sPRrL}zC0UKQ1*oYMcIwjUOI?fG>s_Bhtq zYSra)PZ``pa+He;2=p*jHIMep;0^;=4zb|GSz)U`u{%B3mHu#!)bmI^3tJdT(~Eio zPvnsYcA52Qrt{_wBmd2fEL+CY$goqOqB89LvIhPPdAb=UV}n$xiO{eWp0z@P=TDxA z?R0*sJ8~(dKx!;h=1ohkpz2%3Dm6+r%5^J*3c?=c&;>&uoC?HD(|_oZ9S_MicVj?mALQbQ(hO%VL75&1?{M)rOyja0R2_B5+75E? zW;py5WFF73vB&8w)mE?{k79H_D*R=B`km9>lN3)n&gi6|GZ=ld5Bcl?FSe`G&vlK~ zDrb8&*jA)aCE#dPKkj#4?k8^866{=%w6t;4cdQr4yQ^q1oC!Bx9fABh8jd0iMw}d8 zzo_6nd(nBN*}0I7R|k8XY_85(U=NpDAox0crwF>O3rpo>WPYbLkKR==u4l@KkhQ~f zmes7J9|lY4=7Kf-bzzN6Ka4M2bWp5Z{73Xc#x~K*_mjhKD#?yQsvm~cHtsMxFyqmlD@jBRUm4#%>bKJa<;F<38XWw)?o_)?R zXlr4$RWy_^K?}yk_F6Y;Qd8U9?(5H4x6zTEx=8vw^NKs1EI~32J_KDD(mh!SMK?KUc>|(fMO9{aV zd>U&%&=K7h2zx~M?VJ<#8eq#s+xezD(Ul>ECdb24hP>Ye_#<3OJ&a^M^qV^w0%WQ$ zPnfDA5yi&Lqox*LX6{1V7Qplr^`9&>D>SO>88>0GnQ&=eKsSufH6`4&+L||24`iH< z)1Z*FuV8YZJ2dWEcs^ZZK$+|`-jj&f;IImxVL2z z;V*)Sc~tOTyH&C|PCMH;m(G~YhA%!v<2VN>eQ=*=MH(BDvst;R8B5=enSU5v9uR}5 zfCXMvEYN|_*Qs{*I!}t@iuaa}wmN3GxE#-I&t8)<$h#IN)2MU(j0nctpuTN2A}tuV zm<=5b`_Avo)#r*S>NoHFA#kBg{7S%dmZ4xREc~fH)ufk}jn)QI1(%|h&ZS-wvm^kN z%K73G9V7~qoZF8oaOB?|UB({QHVCdG?-xgKdtDXi4=x97>-T(@$ub{&H~E$+v^<(< zI*~fx{VnwQ^vk|1(zF1lf+ZTb9$%2M`F{A`a65S(J%@HK(T`?s?{^7HD7oWt#Gl^9 zzxEss8%W^Kt^7FlB$~zQtkek;9;{mdd@Xpju^u-g@^aE5j{{Lv=j^B^U$H(i+Nx^| zh&P3H$6d#8M;Kp!ws#B^i20DieHIIr+T=@~e=GB^_bDaxVCq&0JbXUUY~JBMjxF1( zDe4G<61|v`aw)?S!wEoYIbyu0GAA#KB5f;%B{5*{mKxoT_G$yF3prc@V?p>T!NhO} zM#m7%O0XhavA`_k+XxsRaly!gc3pa&l(7mjTL~sZ2VX69UliA7gZJ7t6|?wkA&6Dr z4`^s`pH)DHJs-4&L|QouoG1^*)_q zf#a`C_CO{}$~;gALQle7+N)_MTcrxYTDekN|z&C?pWb&g?Vbt23j z-_XT0}#-aM3~f?y=S z>bHd%aI49iqw4Gzr-;Q-D)pJ8wpP0(9-u?gKNzQJP0;@=>c}gbuj4^G{iB4t z)9&JJgk8*v+^Y&ur@`?xTQun!-jE+TDjWSY;EBsKHvdESkuF|4VUhweOAXUPggSTL z&p9J9cNO~Z?t~73{+J%71iW^G4?Ug4psy6BdnXg=0YD^C@~bS-dKy!7M)+lGcrMO- ztUi+`zqGTYq@L3+?aXZ*%s701C54u2TUiF)gxCzO+=|N9;*6u$t_G7qM*ti!os$=% zhbWJzV0_0nGiPU$oj|SjQLN7VyX=E}_J2*W?_W!~68ekWuup4wJ)(g12a!>H@_)4A zibVE`Z!_IAcmTBcAfh>e>&T(Zq+)5?pHAmmWVf4z4q&^SOk7H0iLW6v*17pEBKyD|&-Y|0z)q1cXj1wfO9!vtG1Zk`X z6JyXos;??A+wq79f8mO*X1g8?0|T3q3)yP`rxT=v_!w%6Y{uSv*O8BG!1m00ot{kA;_~}8sOwybR^jD)S@sY%iSLFptl

nQx^XH0=J({di;z4B8Iad zqpUd^lXoD_o(+#>A&WC1EiI)%fLn?llAN}EXe-6z9-WzJpV9Bvr?kgvD#TpD2TP8ux)v%~k^N-jZAE7#Nl6FYe_&}!DXbqwv2m!HhCMpKmt4AF*F z8y~!WyZyz)#J6x0L9f?x)pPCPuWA)K+w|SKaQ^f?T z;E>|6_t1diVzCijhuRE=p+U|QT(oaS6lmSan!x1G!Yv=kucuu>ix|9Tlzdh^#%gWpqVsM1q}(?<8-l`N<}#Dn9k02G#T{}n zd?NU~-+VA`OyY&OrWYSeQ{mY29NhSZ68d@i&(C@3w{*nOBwVyy#ihe|qKV!vbiZKX zdWjC~bkAbfe@4!-`dZA0YgRKM`cquVS$rxwpK;Rjt{sk{+@wCSX6f6L5yb^|!omIP z5UM(OfqFCkpUCQUdAsUtRpCYAd6Q*v>6Ub=;qlR9?}k(#bWmTTT;Gw1 znke^TblV5>=64g2HQfV|dd9Hfxq3QMm3rW|AUJm8mkKI28sPO0o?l$##^~V7L$C>TsRHWEe^~~IB z#m)uSm#6M1SLtR=LJI@9FZS|XOD+BOGtfNYYW97J7tAhQQeiz3d_^`IbfP^YXsPYQ z5FzmyU?RXe5cGehgKoJ0AL$?`X+MZe&VQ6az;7K?w3uaKv8jAf^A9}nj zSe5fAsMW`dw8!7Za)r_DtnA%F_8yIj>aCYwMI)z;eRl{rYnnKrk~A}WuUz#O6!%6% zm-i?3xkEEkklrbFHvc4k+sTvH2C*%NgW}(9q`?{n8JCPDVccO2bozte_6g!xYXRuH zb)x3n_c4;F3cc%wPc$B{(x~-#4$N%KDxIi(UMN?;#E5sUxeQ?mH~0V4v5q=}Dn+z4 zs0-)Y3v-Yllv{bR@abLB3`}lj9VX~zy79v6T>_`O4DGQYnyY}BHSh$fG2hNIInH8S zcOk}!iI$wRrwGfQiD{mg zaeWrDk!}O@X}fyw?L`TMp%P30lw}99PdHU)Z*Qg&eofkcnJCC3BCdfmH>cm^gIMhn z3CXvjwlHFDI2zisY*ryLcz)>Jfjndt)xu9h#W+WQL9yvl9>%?zwUdVi-Nct0ir1gk z>zO>0hGx7%sT`~!IxQI7(2lKOPZy8Lu(7YhDv%)LTw5)(>rtdWa?K|OlCnQZ3xV@L zY;J&U**H-Wv;r?M&vPa%mO1(xUHPsILO1^5C0{B2@{$ix>gRmOIc=LCyyPpUKVGu0 zC-%ZtriRE3$@9BY5$_gA-2n9=@!oU}nIy6{QayXLASUB;q`M#8eOHK@m~HMt=4(KZ zF-tkY_egGEu?H(TZ&^8UTLfY6YiEV3`oZT1b@yB5O@K8rys?lsq7khOzfA>I16i) zR3Mn4F`*EgnsFYfaNy&!Kq_Lv7{E!uFjz1JmE1odgF^Di0g0bRf&WYl)h z>RiX7vqe2%1n!;YZKm*xIRCdAniyqo+F>z}gz3>A$j+296al5{lAY$^x9OUZ>Wf^Q z)AO;m47wyZ-A4|(%4F3iS?)Qx@~_}@NhcUs(2Lz|a)`V$+KJbc7yuVR(2|k<;ELp9 zajNo?lb~mV$@sX!XA-Yp03QAUv`(CCF6y8F?jS@C8DgTI{}9aiaY79&30rJ&xG-ffazvuunf$3VDSkPk$Bl zu{K7P!fGltmmm3EljG5J1b_!mAeDuI+g9(1NU$5AfpUOu>; z7{dt=p2x5eePHdk1iK{yk1$|_AERTu5q@;o1dmQkYA?&)Y53UcZj3!7f&aG0X!QLQ znESfnYA=Iu7zd%D;!eU;ckBpcw4@o%L%I8@Nc2q0Z@;$@VQp-%y2bFu>}A5c8*0MW zoJ=y8>*jYHAgR zR0vO$aDM9#!+xkXTJK61i(D8AVCA*(Na0VA9cLXek z9vSg;8Y8Kem*?PhZ|i_Vz`Dr(hIY}6a-RU&sa%r^vX%$`F_dn!wD!ca!_HtEHQ+W_ z!K~EvZxpKPO%S*d6-;VRJ>VcrLye|8!4nqVaj#CWpkGBKn-q}w|_@gA|Zf2h9 zB8Q^)KfmvXnHE){0Tre;tkdMt^2c!(5gI*n4 z4y~;1KFCEgm;->;l7|}QX;f(Jlmc^h=hN%cot$IwizGYoF;4dlCBtHPWt^Uacg-61-)>t9&Hg+#1^g^=DE;k4A6C#Pf|Wk8lz!2vLAkT+dm5#Y{VYIQvf zIEt(M6ADDA^l91Oz55bBUCGlrQ-e!21bVH#6LIr97I;zl&sg9f3bK61fSi`kIdn+G zZq%6bIs9_An7+G#CaM2gSX-~%iqr;l@K$P?KINsBCfcV%{V4)hlOtBt#I1@4i7T8Yagn|)eEKb-%q)_B!8n|Qn?C&v@4%| z`T?g`dQ&kd`#6F4tnT(J1ZgM89L_ebkJ4~!tf~iA&Wv6^Q(})v6OjKKHrW(|^1x## z{2vUg)Wit8r2W{#gFZs1$wq-uU@tC)yLtQv*Qi@ycQ42Igl!BVX40(wPs1@RZZ)gk ziYM-JOV^19fk%_+*gmh*eZ=o>#meGZK1;bj)=36f3DdS(cF@*F9RbJBcwTzH0l=&9w?C5PRnLPl$!WB)SG&l z<}q2JmA^a1RE;{BDyC7WBbihPkjpPb&6ZHA<*}Daoz~%$g%Q2p^P!b$amcZdCJqt9 ziV`g~_`VmhatO-SZ;XC{Wr1k$tkasH-fX*%p8C)N$@iun9^;}JzRhh}H>Y`oV5_9k zGt^eneG^&2ZHJ)KW1j%)Vud~UVw2t5{Kw*8-If`$jbHyPy_V~qYyoHmz+~T)TJ>QB znN6@2*4cIn+c3udq@;L$AC6p+Q!rm-p4{*7rlyQ`hNB&LwM(z|R)>3NuJ&$mr2+_U z^efJtjOY-}jy{k{&$o}JL-;waV5PqnTYKS*zdh#vd*=OX3J%8;(Di<)JpI|{2h+n8 z46XQ4n&A}&a6%X>;{=N&sCD#@V??`^Fr6mClwhzeQpsS^;Qzu+#i5MtF5LaXeFGP; zU9Rx%KC)OOeUcWr6ux9?B-5~Z^W3_yu;p~(1FD`oi|d&_PA(1OvS?9ib}UKB1mjch zdVe&N?jh)P$die8Qe})+VLy?q%p1zkb4GxylmfsA_)@PWhVbo0i2a>XY7e(B#;2u3 znOc_*JSV4+l-paH_>scqkkdc0#m~zx)M5K_j=m~bAgmnA7X;mgU;E*`n)J>AGyNS` ztYLeID=wV;-^3Mxe+CvKEu${1FY?_*EI^&e1jUtB#9rGBvOBiaHPZ;wmxT#s*>7f2 zwys7!tKB3b#$t_5mM3|@_ih^N^&8jhFW=cWxz|Q;_S|#CG+15^gkvvgOU~@619}$h z8#H)Mt<&snvBmoD_(eO73eejJ6-fxA)+6l_^>6-3d^(BaZ3z2cF z{=;d_L5|M|ugPZf8w}fKlAsY(HDqG{ih*Y1l(W-LyyB1>w|I;6p~6;m zOC?C8u}3G)DNr%F0Vr#Jy-}CgS$|E_)nKa}IG~hwS+2gjAa=fn;iBfWMkz4`L}MJQ zcQ`NgO`jIlJ&_&Ra4ol4C>%veEk+!$ni72Oz-%+sz*>FBXz9PIVyaYx>ow|tclBY3 zu3Xd;h40?~`}U4wUvaopl(d`Dh-!xFBA*x1#|_;m=O)^&1JoJ(T#&9_$g?_CJmuW8 zRv|X^(GM0u_Hyov`xPGDPh`IjkMeh#hhO~odES+>hl6i(=0G4$QFAErJ_6q^^7{ng4JfLoy`#~+Wfm%{M`QX+uE$wrk>iZF$Gk#WgDvf z5dDl4?#6*L4Val7ClYf#P@%+R<;P9xivG*g6fs_9Xax;FiSbHF}&D^CjmUhj)lNq|*(Rjz1xokw;Q6suC{#z-sM zIZE!|PZn_PVdP?iu%efGYh6pSnoD%F?2DXo8!iO1G#t<-_lDh1$gRIkE|g}tN@=0V zf3+GL-gM(EWMN|I&_@;5Il^>@R>YRd=QR`+R|=5*D=c~+ABB65Apoh%0JFp8@cTgy zGr-T`_qTpL+lCNkg2{l12Kxbf3p9u{<6vh?S-StO6Q6qS8J4zet@RH|eC9!^Yo8%L z#k{#n;^z{5zz^$~bLvpky2DJY2EE8LuklI^#XeGU%x6Sus z?${a#P)EtV@*DC z{#`VAeY&m*g*7rQidIJ-P6smg=na)_>lOw$`!Witl1pQkFMe(L{BDr&T-~n$+bt*g9M8#%m<*4J3nFB@Y7w>`Tei@L4WA~fe{J{__K>d1 z7{da7m~09wAl_UHhpuPq97`|*E4SnIFXw&ZoQ8~`{fG0$S={Oci01~oW~NK|+c9VW zYqNk;1JierL8lIOUK3K0nir=Lea-}ZtxToquaheKa+fl`Ll^y-ezMfeP&H=|UtxI% zz?civWPdPT$=c4C8A^vs!SBt7aVflsnI`?4MDB?fDRE3Eg|COhyAE^>dP37qj9=A7p1I?t z-S7U4QS~!YF;B5@(!r^46>04aqQA*4?vK1c?$R+Gc&vrpKaxdgB^)ZHa59h?$V5?{StM zUC@lf*J|Do?L1B>QV?Z(qQ``bff5{MvMV=XCDf3@8}arh$}*?-61s=b1KE8p^adUV z`>{N_jKDpKKF5+_HvhpATFd{~9Q`l+80tjWs=7Lt!X1E*YEERmU*O}w*no4M-3hOu zw-k*dZxX8y}x_xUYan$ecfYYdNSP)LVrw-0z!C z)O|a+d}DzAPJ|eNg&(slw-2EE6Xbp%+BXC{Q>n}MJ{|nS&)o`ZJiO(UjT?>g>|71x z%Kca;#oo7{k|)lC)aFb?T0W!B6*;o0#`5USTw}~E?;`W`sKxGISfU)l#@e}hPh-s) z5?}vrSnm&34}wUBgl+MG<-9g}+~IzwgnB96{zR(JCN}VDwHB~7YfB@I@wb!B|4&i{K#(j^?ps7+UK4DV&J-d!iL;mdQ`PHxRkjn z$@1apWmg@$MKag-&MYS z>%#kO;y1J)5P<@)7fc0YzZ)zB;|Eb&2NU1N!)1EF#LxU}O&a)L3k0{6{RR}a2I#qu zgu?_tJbS?z_%qHl+-IJ-pL1_Lg&k&IJRe`1o&;YG_gF!A`@pmqer(@2v~D}SOtZ45 zAvdDeK9JPS`!KjP0ALLmD=u|js?3V!{3s6IMQ^djX7F5-`}i%N1Mcu+{={2A>{bYw z*sOI76VIMA@vYh&WL7OcLXd6U@{*Y`%_cy91jT3VxkcP%vb>(^n-LrX*_)H`@hlq{ zq>)Yhd=kc~_Aw>#UUAM|w_3Lez6_4XdI%^=vo)at4iJG{2kuBUb2xMN$pK}#)ZL*I z_pLW-%~{O|8hDX$@#@~DH7|tv+@3-7F72R*S%i4kV z`hP6eZ9Fj8b(x&^%H2HXovF1{+(M91@>#DjOZ!qETf4J>KX-@A*?vf0RWKPOu=Og~ zJ?{W}CgUqY%Dw4h{hZK=&UiWl?Ry047xOP}6UlvRiA#1fM5w3g3=p9vAHW?uKdxcM zJHfHG5VcB>MTGMHZ*)yEEC4H=*=aC78M;8K$I_ z|1-IHuQsQjLK-r_tpC-U|J9rS)tmp-oB!3D|J9ph|J9rS)tmpn)|WXL#}wbe$R3M$efkNlC#*I=^U|$*{aK$*g(5b~M&)TFZ^F zYvV9nMIzcOF;X?4#%zUtQ7$KI>T=UyITQq3xu&=Sf>9dRL6kWf)?lgHpyyA$q?iJi z=^Yf-KGB?!f3C9T42%m$vA}Z}%X;ax`+8PzB7>M^fa?Ngm8w%bI1&%c{9dH1Cx!XF zZelyvMMFqr7K5-YPy3@wO5{}1H{HyibRTs*3WPZsgux=03QolnVE(N8n3w0X>W$@d zB!$50382b%1T$kJ#rWi!KySqzj+8kR<#M$R!4fFSeBoCQM$j@FB*a=FWj#M~u<~f! z<0w+QiN2IZ-QurACv+ftnsoVs@D*FXcBQ9Ar1PUQ6rhOcG|xVV{UlGpI*zSpbjIp9pwGGULZ$fhkv_|7U8X6fu4hq^;-%`} z)Y&e>s9)chn8xdJ2EX+qN!X@H;0qvf*fVgVM9TJaBLR{>>%=|QI;Aft$Y4vbiec46 z_z2X$E*eJNOURFoTiG8Jt{yrauBsad?DvZMe#F{M;<(kdqbVEaQ}5qU5nIE{|IE*7 zJ|YOa756x;J8y(J8Dd^g5*6uM@B!_~)Y(qs6z;l%zI={ZGse3*Df9MX{uF69wjeg% zHpdhBR6>r|14U%lconcSo(xD^VHr8#RBRarO(kRib1skxHl1N>oGf$9d&R$olEiKEV#W$XJ0(y-mCzV2(8XOB?FNe`x zw<@HYk;E7Deeav{WHq5|8G5`130=!a3)Crh6Ww*60tG5Jf~S_@@aV>0TooAaMA~E9 z*3m8JS?Vjw7ClSAFDJ;-A=%IY=G&Py zQ;KJ2nN&W;kAZXyf06l`+d+%PGUybQ%W(9N2Eu!Dw0bAm#ZwCo$L)clfNZ?pSj*KQdSz%>wKjC$XFn=cAFzs|4I~BWx7D0J^UH~OX z62nY6JxNm5wg$l#a# z2R8nkex}5znr^LV%BZZQ1ZsZ^@3vpTD=KqdgE5ySF!g5YXp;bXUArS8n*)S}47#{l z+g~DmoqtsJq_ZoV*JUv(>nKtz26m}K?d3gtLL;`^qdB_x2Io=A)LobA^f}j) z#C_m3;}rel^sXNzrSiuP8Yhg0jksx?gZf?vC~2JDi|8&wn;|2Z5lE1`Lohx_&LeP%DPvJ*E!jxq9-x4tTD?nhJF zqOS|#wnc6YvkQeS3`F+y{`)NTQ}ENr_tOd^gzOAV{6xlzvi%b}+`|DrLp{O+PC3Ts zWUPdmQ2r)23gdI6sf)e`e{y~gl=Ci*x~adK z&j3^4LIm#bB)r$*=R-k=^yz)SAMUY{ATo&g%|CA9-ozZ3S2CnL+I;FgF0^ZHyN;KK zcIS*Mw;^rcx1Mm@GPgls@fA$~vSC{`D;r}{50B|@TLU(FA^{pjbvGi{s-|yTE_zK^?z+YT@RciQJEe2%6 z*}ky!VIC!#Lw;7qL@4V9F0aywQdHGtfV!Jln4g~KkF;q?B`%bE z@7iLHAnXTd5Z4Q^h^}<~`VH%3UK_-A^zs@OK6B1o8xbwezQfJMO7Qpw(yb2YcCO z$XhFV7gF_;W))ZN*izmdf~9U?L1vKG552u>>2k;9rZYR|2x7Ah<=1yH zW*dgNbe+Yu@HNPBEVK#lhuW2GyS}`RnJ@c(iyAY(nxO(@ZW$B~8WnYIlziPNt}`kr zH!3MGD$4XT+ZX{;EA>@Obsa0UqZNCSDxdO|4r=sho}(U)lkb8$kvbFFocHFjZt2xv z)ug;){mN$I3_ku+Ddfr9BGNDoPbm@CR8Dcg>?kopub{7P4QDZ;yv!x=-_C5wgz;XQ zJqQ=zLAh*A>S*U=V^TgzFL3kAG?L|e_mS}N>IvY}aHCSo^fklGQCj0vq+bP}b`PMW zEBl9ZA>)_&;4c2uyu##_W7(N8gVrTO{YVP*T0{MTmWj!GFcd<dgv2&MZttP#Qha4&WeW3bX9Uj*@iWO zHe8Xo9`5|{;VIg-AC9Rg;&rotg^8t+t+J$SWEXBSMtOkz17PXXso<2sX=YYBVnUF2qDY`w7xc=&-RUY#O_D7 z5SThP&obWTy7!B!IBrXY99?GN6YtQ@@t{HuI4-VBLctJtdR+Aw!H>(*7Emw9fyDsl05>Th7E&qZ_9<-1Ic$Br4A7 zFW7Y#?t+vJ>Qb=+fOPxp*8Md5@aMa)CcnXPHoau_jCZqlDa;|FNa(z{vY~kZLAZ&# zzHVG^dbxW}NzM7gun13&$a5W!XqMjsN2vB60%w>rOj{7+Uf>XR+zXrtkADfA&gx$R zr|!4FiTWjQfL{vdeV zJ*}WeW+C912~ioD9SXvc{Z^=0DlR*bGggKb6PWd6L+po@Z~NzHyNytcjJ=HXxmZ}^ zdbOp}Ef2uGjr!FYO03GK9w~7co|zh};rT({5Qrs>J?TO3s|B;&YseTrJ!K$Y9YMQE zFh#JEarH|oB;&a>)~G6#MSK7CLZD?T@^Q!=y!1vK53&7IQK}$vjyO z@NQHka((nBi%}q}?8zh7N2O1`Jz0eNl;uXhrbl~+rq+9Iwg_~@bE-@IYkJ*$njQ)X zzqtRB4tfyJ`CjZv5JFJr(=9G?VsPfFw|!#xZK$-^kh=jFDkOUdMr^e4|pRj)>&^d-{tx_b?Vrs`_JzTzD$-{KN+j?i?v}|-h z!P}@o+VG$uDe1tGCH-o4U4}$vK+|;WRkWNiM6qCy|~ZL0K?)wG!6ghLHtAq(+~jnO^Ln$og^0BU=HrWojik65=`N(N3^YJT&F zHJUi0eyfo3zUzZ>el&?2rOj9TXF+O%Nt_~X)nS4A#)zrFmZfW3_SGIr!e%X}wjm7l zIT-$j{!){G-RlE3&HA)q_gcCg`;xL_wf9D)!Qjj9rsz4$flQhyGcDotsUL^F+_=2I zimuYUb9hTNBe9{C&fz&oXpdr#^2%znG40rQknnGErMBJ3|7HVa>Q4^g{o?>|hd&B! zpd@kHFaA67ODF#4;$K%jyyxE6`yZ<)_AD0oUy1>_r1PQSk8Qx|pDzB=aR0s=fA#R; zf9}8QkT`7&v-W^m(1=&6xl=@(xb3S*u$*cz0$dq z4kNv#I@n@(cd)bZKCEMM`}*fyn87o3d-XbkSjLkalR(j2 zVKX&*euD1@OJMZlqGNZ$g~`IEk=cyKmB_Y7)f29z@*j*~c7w^gqrAzn*~AeSxYcrI zt6h;1tPt~|d&ejr-Rt(8{wSkAa zf6z_wVbxM%iB_;VrOPM$bpN^!w*LO_XSXRlKENp5mLHzpMyWOrI?L{%G}{GiZ&(T_ z0@kcnlUhyX@>A@N1~`x==NUeh5JB|as=64=AkU_o=RDA~i~n}5jE|Hk@ZYh(e@20S zf7=58%fSLaSR%jQ7dq67_8Ilm^DuUH4jNiLyjSwMc7v;(dFCvWR^?cFRH%)$4yKw~6P`Ijs>s7p{Wxf-^~Yq P{`~&~=USiy%3o6g>cuum delta 16137 zcmeI2bx@qk)~|6U!2`jagdw;O1PvNUa1ZXm3GRap5-dPqkl-#sgImzS-8DdPcZUl} z_CBZ1mHO(tf8ASqR#nfhyWd{jGjC15&sx*Hp{el2L8j`z=Z(tAb_V3 z06qjj009s}07MV~F$6#Y0gyrfWDo#31V8}+P(lDy5CAmYIu0+c)|&JW5JM=`ufH#$;tQ3W`?O;*dg&c3 zYwBLxdL=TLRjqIoT0|%)%HhrwJgSF${OA&`W@hOIEsyiGUUQmYjg{2k0_d}?oJ$a0 z`-!j^CO+pHdMP}i1jTh<&f3buYFf|!nh5HWi?!TgT{@%7@^Om&oZ&U5fnZ_;HXeEw zLaz*cQ~DC#LrIXF4{B*F!kIID(SWyawl0=+@jb44NJ~@SD}K)!^YfTybr|YS@_<*o z{p*aFRok!hv(VDwJk;iVO~LCvhoxPo+?BqN`KJ@dnW!Xl`J<@J%Vvyd%k)p@HZoyO zH{{RnPE0gubXU0(+nm1{ruee$NEa)MppFT5Qx6-gQ)qZh5{c(y>8pD#_)oK1o zPQs^vfhufFa8~`xrUc5)_a_7RlAnAX|1z)Q!gBWE6V(Q!nL{-cyF4o^5E+|6wuE1d zD=EopST0+4+}vt{uMz4r>0zkq2c7E5NgQuYg;}^bERAgwud!Wl*%Xy91$-Tf1r{p? z@reZ}!4yP9#11j;NLY213;fcI>7Z4EeL*GRL)dqsJdOXqC#N+a9-|+gbqllvGr9`Vlkck4%i_k5Kd$?2#Ae z?UB1&%>@`h-lE11*a-tft=Dfq~HPYKw8nZEEO{s@HN=Es}*gljCvAeKjmQvPk{#f+##G2@hppQevbZ-J*8rzQy4zlQ@_iT*#?{IQe z*6M!Slm9rgcT`AlEz2L55Y)G)>Q!0%(*Co0n&-f{ma9U_n$+j5qJq{5Zs|8=3dccUv$M-l#IIQnA#i!9(Hcm2?bO6!5d1)EIUsobW^aSWrP$Lu%Bt*#ko zbQv}7=+O;T)`xdSYo9Fg$b|UFTB#tSj|1^AUyv&DWLCSZ%p9uJnT-l&`%|C^opRhv zPAzNZ`zlJXq)xF}ZE^>*g@GlJcASwlzYHRUH_&nRGN2jBDblwbwfagr36$1>dRdS) zO;!0rOrngCw+}<8*BIMj4kkFEJ*yXH2{zq7kMvDki18T(kq0=}+^m>`(91u*TE)+H z4Q2p71z(|OvVoj6AbyB~U30qVEK%OHMnWgyMZFvmC3Kc87{ zuY))V%ZoL9to+!R*+lO2RO`z|c9$yor3ANFD#uPf5D9=yDeMggkMJPAe|)N1`2D!a zHG7W~BndvFDXjv>%V^xKCv>PBH?>41`Rq7&Mzw-#7lf*Tdlc+5cT5$i!-oLVg=Ad; z8q2Ot`g5!GqFxL6=mAR-%kieMvb@o~veKANVU=0_6BQT!J4?>86YFzRTbz{>8Bfa} z&s*OFK+#!p-@W6&(YNEz^2hbO+hEZiTH)K-^Inds_7}C&yYy$6XyYM$asXdcD${xsbsW9Mk|3Oc1Fx&#Z0r zVh|z?COYhb1sk=}dWQM9_BPp`^RiZyZf+E%37*e;aB(To3YYoTD5NkSXA&a$DB=nE zbAD-;&)DlCsc4eN?v7$#tJXl}^PFjk@H23}+6^6GC1oyIeE$@H5RMo1wb*&^K5o-1 zp-91Co*l7G98orktX}WISay%9<>Z|8t8C`>b0%_Poe)(#S&6nxSn1LiQ@%TsQ@BCD ziImOb>93DQgLKZC(}Gq(b^+`tc7hxz<|27Dh=*au#O6g+{U(Q#2UG6_gDsfEN7@ z!`8t!Xm}lv060r!gr1XDm)+QF@MNJa|X_Mq@c zNC583u|WS|H#yCy>n?DT2Uw!vT9;XdumCK^ZWZlULW7rdSPvw{q-{%;+H>+J>kSL% zLV~Hp=nqg7rv+H6-bahxV8kBP_wnyA30}cE-Pb>wC#juvemf+SR*osMYlqtj<56CT zgPU+6+8hZYBrwnl`asnIc@UG@fpd;v_0j8b0d%1-cg#L z1&=-udLzOPr)Gvcz~yMB^<9M1Eg&D(!*y`15@ko6Y%HkN zXr7`#;>+e2z_6nUORaq~TKlC-h5^1(aLc6dh5V`MWurqX(}Lnp&Q&7MYOaAt9EnHh zLW9Y9&s;IwWL>|ByDz*@guZ>lVI&SBbbO>92mQ1GOanhj6sPC?SUdDNY{1xOk_Z+s zjK;oN0bfT{rar(Th$q>v@us#&*|Ri!@Hx3{q|C@l{S8X7nah}V`Qo-t!s{p!&5fd) z9~`zT*=6=ag5H)g(iOA{;&ZCUI@^U`R5fctBKQy5HNE-huq~4qYdA-h_mU0` zCu-Vny?^e8?liSyeBgg0kbP<(UyEs|yXh`|N>|dHBk6-NtBomgx{m1jGxS;FGu>}% zcD!q6THJx60??inc^iFQi215D_hL2~bAjmBPtTOVJ?$U!HrOIXI9D@2j2u;=O_@Bu zg2C?GubYdEL$)O8JWF%K#H|?34HZa2rsXdUcu9Juz$+M0jgm>mXX*(bS5Yz1hRRcU zz1-d|S&|mzsz{QVzouNii1(hE?L5BYqwos+V6D|bBk(C9OifgzPz*t5IYBvmhHRcb~&q>#>J+>M0 zpo2zVpN#cyN@La z3`_bfDtlDVkhQ<#tx}7xoRRL#TjcFoOcH2sk!@NF9y_be`8o1APpCM7 zh)?%tI5}S~U=*N-zGWktVv9~$ze;NN&yt?Aa?HX&z6uXHc_1ZtE^eM{q(VSTuz`mJ6}GF>@3qznF&`Mig`lAdMd2*Z zwxwKb8^+Yi%qUz&UZY}}y4ozQe=C;qUyXB#e58GsT z3ohgc*uZk?X7yW6itb!amaXlUI7!i^uqSs`>-^F@$Hi`H3y$gK^-u*TF~*bTf9})h zss(f?R7N2tj)+whuU8?}8P^=sa2{BnkQh@=VZ(>?k(H4p@H~rYM?sH4oCgKUn;q4` z$Gj{@l$WvxVqccJ9-+o?+gzq9uJ)0iTBrXIv&45%S)1kOn8|IgWg3%s#n7vBt2!p_ zTz0tQav7ntL%$~Y^ip!3@hbom_+hc{7#V`1yUdEqtRwzH?oKprL^<|M(&^7j@*g9^SoWCH>Z&3-X(3#S67D*7r-*&y` zL%j_c&e-@F-gc_*Pm5ZhX-<}GTzxcrBcCXk>oaz80k7d;_W%` z)ZcyJ>9b`4DQ9#EU($MBvLUvZc>{2-35>~r_v?Zu76ZXtpOrl z4H5fl1e>QsagA!l?rkSu&g%aiZ8fb}ffKxuhg49Pu1|u?<0({Fu}Ephj9|A3{_e!Y zm(N4>Ygj*(BxQG~o`sx}Nq@NVOg`~l2u4-HExnjaZZ5r#x8Axx#9On9S`YEo;sJo1 z(#87+yf3P*9(1N1XaL^@73=_#;D^couqNhmj7f$4%NFpVHXT4ww6~`C&DEC4DcOg9 z(1s3RFgy=b5(bpe5US1oa0F{Qe>=T#`7H3xp$Tk@INhS>d7nRBGqGhihHsUTwtt}w_t3zhJup6w3=7kaXu`074X5Qh4U z1973B#(_vs;0jO*-(vrrUA^z%3RZUOT3X_zWbB6Tb8rsyU>t}C9}7)f0s6s5Ln&5) zqVRsu{s|x%JP7Ku3M6}yV`o+;#P=$+x%9U+!Bv&40^#A|BcWtdzzm`>7dqZkpIqPE z+h8%rDf;K5E0g2E%fYT z69*lv7Asp1XgQ3keCsKf&&HJcKBO$y%guaqxY`@?{uo^)0&20eQSfXfljMH^SKtS_ zVygV_(Up=D-^7BtW*_h4jwDv6KGtl8_~C)bgDHBX((;%<36laY-}tXi*lv{xKo9H6 zLni^v7xUfWtPFet)h=*CxURyd$KbLKQyCT`gd)i&KMFCWGDD6f5t7!!gYi6Uo;_K0 z=x{7kUIAu9x#;cP^rLK(l6~w)&=7O(8#uWdEK4*-dT7PRk417i&3Xf~3F!4r?EAmy zC`ug?A4hH&Co%Ij49U|?z8Zex=Jqr1C*7umYGkvS4_IAtylC*L z5uGQZlV^>3-B-aDx!RWBD2RCt{2K*@f+{zQrfi+oY@T&70fx1&noWOn%NVbv=RqD& zFuV`XQFF+5^d1G>#?x_Z?9^A2(qq=F3-|h6nR7~+g*p$4NMj9-RPqH`2;4!#p057$ zpXGJ7P!;dEc8PU!J{Ya|VmUU>6d+y*&4uqoygM_%Mre+O1cN z{-^j+O|u=<%uLkDi+v@&O;D=a=0))750hOjE349OQ9pUqBSCjk(y%@XElUS-fvc3O zK|~CJ5XuTt5SF}p@9GY7{MInyk5v`xmc&xo5SladTRWsRDJ3#>}v)?xvjNvxgHp=spCALJCK zpCY}?2;T30A21MUhIL#fQ#*TGA(h#&6}M7g8BL`6Vfa2>j!gV3T~3|$D_y>GON(v) zD_i~x=E$JcSwLJwo9Gj0e-==cmf33da|Epaxn_LlUY?Uf0)ik$Qm%AbN=oO@ET^T{ zi&eSVly_B7>1-e+HbKB_=S5LF(_Rw5QJ4M_oeST*Vpw2YaT7%=>*g|7sv`eJi6qUORttAZAL`G!sb6;b~3cA z_a5^kN>nQBiTZ$rRA6Jx|K6@Czfx`sEzoTOV5slQ%(VZOxd z)ycGLiygOKX!gAMnTFpnZUrIX!dj_HDl|S?jFqWK53Ne( zN98qNf*OA3e4c_os0%4#+bvzW^;)sS(WJfneKy9>+JB@<>4iGklCeZd->a7(vVdK( zYZlw#+E{}?FAE5bto3VYYU~sbss@BF%hV|&K_Px|Owsz>Y(YJlQDJ=8-r}Rv8wKLH zceK3xj?xhh3Zs-dk6RWW+gdBXh#kSCW-0DKkBjTrofZII4cPr4)J?q~Db{!zU?|C! zA6dqd-Bv!_P`-mQRj1ee5f`;20<6RY!^_3XAH4M}t6E!n3zDfk{A4%PnbH5PAQ{_P zY!>H(WE&aIgSfINX+nV)L&C-p7K6iqZ#%;mcJLS!A0te}slUmvAO?Z2Lk2RFisbCh z<<729L8(mWPNsKNqixwMIQ@+cl&%t!@R||ZO&D`At{B}pNmhP+msQB`xMME0p=tR* zTtJG7aMQvl3`#sJX1)qCkdUYiFtif2|obncGYI3hlh(^Sr! zK-9tbWjDr9$pWB1{1mje04Q>gKUjr8a(E>ub0LrnhaOsaRgT+6NJ{d{uF$Hq3hyBZ zfg%s8`xTf@tQ!^>Wk?Z3AGDeBS{eFPQA9i3$}=4+>G~s-qzFj&-dN%?c(fmmFy7gah>t<~p#Wn%C={0AuVdbMm?^sZ>wpdTI z8r6&<5J)`S@Fu_CC&0g^>PHBElI(w7CUqzdZAt@@({vGr5uzN#atP2W26fExTDaXh zfkUS#kCvBII61bkgdiVKQghl`Yh>1t9^Ms7-VWr1*M%yz19`A6+opd1UOW(bynCbR>E5QMD% zA?bfe`X7@1f1RYG{~_srNcta={)eRhA?bfe`u}^9p81EQ|H(=Jlau}@C;jJi!v9rH z8vHva?ZM7x)bHk!ki1PBPeB28xo*CFo}KT6fVn;NojlCYopZK(r=lR6)<=pzW`0|t z>V|VzGso`2%!q526!EnB<@&n_nw6~e>D8}spdgR=JUXt1TkWc~_NJSR0YR#6=G*qj z5$5V>+S&Ff|7KdkcH7w6d^=&hD{OG{yK0j5x19mpp|u;sv9C_atkO1zFyl?WT;nW1 z>yQeKCIqs{O2E2OSY-{qwDDX7hDB#Fi`ntF!CeZVrwaLgGK6b~`v{MRxSoVaCz3$; zip|#msU6_vf>d!iCyk$vXH{TP48zGxG z8acJ;73qgRrvpao)qJmce@r3cbU8B0*=|i3f+@f~CeH2ogm-hgXIBFME!GA9EkANA z`=iE94OKNsGwuaO(|Ytn2j_QbWYZuO29EZ*q+rXGtuzb!#HaD799=7>;7EvjRIL@YQHtt@}Fc+$62pIfXRz)L~G7R}yrc`z5fM=>%v_T;OQ!_QSLbXd$YqGy_`?*Ea&p29TJ`8^-_Q4Jy=CD>afm}cJzE% z5G6-wOCb{5UtP-^>T9Lwu1aK0mrqu)`JgzW$D4Unuxyh}_KLStezQh=YGaW6ctLgU zled$fhsP7^ql>(awoadQ`UR>Djn7yt^C-ouA4OvoP%tvKy{d%t)q*d@ zC`TFLR%s2;(I)#+1JxG%$gybBi=&11m3#RlL~LcP#qH6B2B{fi zZMj8@mJ_elh&Wt2n;&+vQV}_k(TvyizA4c&AIVhCq)pl+2+M zh^1F3U$9-A{#9;RrE{goKc_ZQL%c%T(xlVv6K#Jkrli3VSpb$@o8im++!+IK(HqXq zwCJB5#$~?z;J0|j(1PIClhILl={P|Wl*AtvF8QilVYfQb>#x)Vor!o#1=i=qT_>uh zCi6g5vD&;W@W|Y0fXvwp3HQ(koA12{Z+GP$|LAIT_gi(EH>-CLz0X;yjc@2IW5)HaqsJbI zrD$Qa%#VS4XhJ7Uomiity`L{PYD%6e`dp=x(%#s3J$zxhUn6%)`f6@L!V-$2ji}v| zVR3!9T*M-tbSuF9a%-n~XoCgL9{W>I1|}0*nk*JY}zYPY~hw_VID`SbE96qWlWqE#AAZe zc+$rzILQSY+Z7J9+jZN_m1>2bN^!Heq2D3A;nE!!zat%R$8lSJ%Y8nN?Iya8kp}Xg zCltUzsqr2p5wU?b9RP_?LJ2|%erqyRoG@Wdgg+fj4j2v?A~t{qs^fr%tAC3t2DApS z?;uIzy{A7eCFI1IDWQu8K+-2D%gD=+e_i}AhrkI?l1NCi;bwUmOWvmSEWnLq(<-+r zZN6hYxDy!~c?86V?whXU1vv~GQ3U;0on)Q(!A57~ZA2R| zPPqRPr=|r}(5qwMNBkhSE6LodMfbnE4UffsB0$rQfn-ScTbd3u^6=g*_7M;T8hQxi zMnuc~H8A+s%8vf~DozQ>%6JskiHM(78 z2Ik!#PTQH@SURiL5~vCU8qblVI)X;$}~v*;|w2atpu5;NuQtylY8AlJ-PnOIOA)$VP=l6CI4wBZ1068fFJ z*I5lDyu-s5+^=?7qgZ-OM#RrB%JahU-k-eI!M+zlQwk zK1Nc2J-C40odb!9{T`yV4+Z8FTA=~PFu<45lEk2N_Hk(sB zQ?+sDXQ?R%H`qbiYL#kgmm~~>;N2aBsuX1nIk9k0q%+t87o7dS%{S|ma_Wf>Kp;G zC#giPHnYMv2=fr|picN{t3wL2q-m?M%M7C;+wp4zys`g?;Sd+y}o!_62 zK-^#4<+Ty>VGzLc2tbR+2IZfbQX-?eD!T^Gzk> zhy=HaM|0Qjwdu?~O-znlFRrKy^|VlC=ts}RJ^gx9|Nb5)%#joER6Jjjz0uE8ce4#g zx-)srsLt!WOUO1YNM9TF!aKX}1S4^G0%VyEHeB$IM~<8QjQ2g-^9rSJXLiJ8BS7Tr zpr~-9p`#zno7Bvnz8+oh>PrV*iwneLMx@MpHB9<+D_%g_HRM=hd%LF?3PxG*qa${} zbiho1ACyk@@wQ)lXzD65Eju8A*nHDQLgxOTXuHP3kXzp5GwLUIIMg5RAJoC3&oCo- zz+y{;{%n9>T5Rc0<9~{WEi#hlKU@E5xeW_$yXZv5TMA;KZ1g@yz*~|J5~ad~@cgHE z*i8Sk6-;$o^mIvR8UI7|Ja&*MC8p2$D<7WEbNBdA?Ok@olDRF&IN3k`Ok@hf_-sPi zNi-cJnEToEr}tpVCp&YUk>lFskL&^?J!H5OnQLw0WE?Yv%Ly_sYz!-AEuY+3qjvMx zr0_-_+CB$z{s?w(9v7CTNPgW}&|ZoPr%bF&?9KpJf(qvj*SIVI_pqG`#va~%%kpSi zy#W=vwvM&^*-p7^LX#;sp$Zp3LMZkH5D9z(D{@`-cPM#Z^8U-GaNOY!A}?iM!yawy zo%Q5AoiY!%&YYB@QPk}>tukK=ZyR2hx>6*b{VJMf`mPR! z8238ZtrPfa#S$iaQtI6Auo`H?7NYM0i%(4O> z6Tlli7{62Ry>{wd-gUFAfT_CQ7jq}~2ieFTBUI1JV++56Lx#sgdblSsALxi;Qt6O? z@!VsC7%Mt5X6#sDb%e(VbbwS!Z(q2-#1Aq$z%2zHl5IoUU(Kv;)VA<3Kj;W!_UMq2 zeysx@p6>oDg{MPhreyRfLBd1&d$!-AnNJ@3`oHW284S+$6&{$H7J9{rFa!{z+0_KE zaqmqoSUeF}?_P*-jNEy3#@t=k*w-Q3z+1~SZaBHvIb%a36Y0ynB*jht=m;&rEcGjt zlaYKUDTKO(n*SL)fvcGRhAR?oMO;t93_5-~_11-jy3t4V)+akgAEWBH=n4wwb~$6Q z3KjBHoWT)XV!N}_@yzwe@yy?m6PVkO6X@>wlRh0eP9+uXrA98=p39T@BkzuX5MJv*8kUE9F3zwF~nl!Qt+RCir@GU`05&(>W5( zsw3IuERx4_fpulFXT*F>D-I|*#KYJA ztC?+(YmjTbKJ6%=pX8;@Ut+H~|LFG7OPlI@Cx5*C`lUZy^DyjpobX%!i4*>Ga6H5b o|8n%l;}yeZJ=pUa{=eh#`TyGE)_T2==jEN~PV=>eyb{9y0C8(ixBvhE diff --git a/detection_rules/integrations.py b/detection_rules/integrations.py index faa305175..2c264d051 100644 --- a/detection_rules/integrations.py +++ b/detection_rules/integrations.py @@ -23,6 +23,7 @@ from . import ecs from .beats import flatten_ecs_schema from .misc import load_current_package_version from .utils import cached, get_etc_path, read_gzip, unzip +from .schemas import definitions MANIFEST_FILE_PATH = Path(get_etc_path('integration-manifests.json.gz')) SCHEMA_FILE_PATH = Path(get_etc_path('integration-schemas.json.gz')) @@ -137,12 +138,12 @@ def build_integrations_schemas(overwrite: bool, integration: str = None) -> None # Open the zip file with unzip(response.content) as zip_ref: for file in zip_ref.namelist(): + file_data_bytes = zip_ref.read(file) # Check if the file is a match if glob.fnmatch.fnmatch(file, '*/fields/*.yml'): integration_name = Path(file).parent.parent.name final_integration_schemas[package][version].setdefault(integration_name, {}) - file_data = zip_ref.read(file) - schema_fields = yaml.safe_load(file_data) + schema_fields = yaml.safe_load(file_data_bytes) # Parse the schema and add to the integration_manifests data = flatten_ecs_schema(schema_fields) @@ -150,7 +151,14 @@ def build_integrations_schemas(overwrite: bool, integration: str = None) -> None final_integration_schemas[package][version][integration_name].update(flat_data) - del file_data + # add machine learning jobs to the schema + if integration in list(map(str.lower, definitions.MACHINE_LEARNING_PACKAGES)): + if glob.fnmatch.fnmatch(file, '*/ml_module/*ml.json'): + ml_module = json.loads(file_data_bytes) + job_ids = [job['id'] for job in ml_module['attributes']['jobs']] + final_integration_schemas[package][version]['jobs'] = job_ids + + del file_data_bytes # Write the final integration schemas to disk with gzip.open(SCHEMA_FILE_PATH, "w") as schema_file: diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index 67aeb151a..ec0a2c79e 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -10,24 +10,27 @@ import unittest import uuid import warnings from collections import defaultdict -from marshmallow import ValidationError from pathlib import Path import eql.ast +from marshmallow import ValidationError from semver import Version import kql from detection_rules import attack from detection_rules.beats import parse_beats_from_index -from detection_rules.integrations import load_integrations_schemas +from detection_rules.integrations import (find_latest_compatible_version, + load_integrations_manifests, + load_integrations_schemas) from detection_rules.misc import load_current_package_version from detection_rules.packaging import current_stack_version -from detection_rules.rule import (QueryRuleData, TOMLRuleContents, - load_integrations_manifests, QueryValidator) +from detection_rules.rule import (QueryRuleData, QueryValidator, + TOMLRuleContents) from detection_rules.rule_loader import FILE_PATTERN from detection_rules.rule_validators import EQLValidator, KQLValidator from detection_rules.schemas import definitions, get_stack_schemas -from detection_rules.utils import INTEGRATION_RULE_DIR, get_path, load_etc_dump, PatchedTemplate +from detection_rules.utils import (INTEGRATION_RULE_DIR, PatchedTemplate, + get_path, load_etc_dump) from detection_rules.version_lock import default_version_lock from rta import get_available_tests @@ -894,6 +897,48 @@ class TestIntegrationRules(BaseRuleTest): self.fail(f'The following ({len(failures)}) rules have a `min_stack_version` defined but missing comments:' f'\n{err_msg}') + def test_ml_integration_jobs_exist(self): + """Test that machine learning jobs exist in the integration.""" + failures = [] + + ml_integration_names = list(map(str.lower, definitions.MACHINE_LEARNING_PACKAGES)) + integration_schemas = load_integrations_schemas() + integration_manifests = load_integrations_manifests() + + for rule in self.all_rules: + if rule.contents.data.type == "machine_learning": + ml_integration_name = next((i for i in rule.contents.metadata.integration + if i in ml_integration_names), None) + if ml_integration_name: + if "machine_learning_job_id" not in dir(rule.contents.data): + failures.append(f'{self.rule_str(rule)} missing `machine_learning_job_id`') + else: + rule_job_id = rule.contents.data.machine_learning_job_id + ml_schema = integration_schemas.get(ml_integration_name) + min_version = Version.parse( + rule.contents.metadata.min_stack_version or load_current_package_version(), + optional_minor_and_patch=True + ) + latest_compat_ver = find_latest_compatible_version( + package=ml_integration_name, + integration="", + rule_stack_version=min_version, + packages_manifest=integration_manifests + ) + compat_integration_schema = ml_schema[latest_compat_ver[0]] + if rule_job_id not in compat_integration_schema['jobs']: + failures.append( + f'{self.rule_str(rule)} machine_learning_job_id `{rule_job_id}` not found ' + f'in version `{latest_compat_ver[0]}` of `{ml_integration_name}` integration. ' + f'existing jobs: {compat_integration_schema["jobs"]}' + ) + + if failures: + err_msg = '\n'.join(failures) + self.fail( + f'The following ({len(failures)}) rules are missing a valid `machine_learning_job_id`:\n{err_msg}' + ) + class TestRuleTiming(BaseRuleTest): """Test rule timing and timestamps.""" From 1e514afa5781164a0f9988ec9c9337b2626fbb2d Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Thu, 12 Oct 2023 15:02:19 -0400 Subject: [PATCH 26/86] [New Rule] Migrate `Lateral Movement Detection` Rules (#3175) * adding LMD rules * added setup note; updated references * adds 2.0.0 lmd manifest and schema * adjusted min-stack for non-ML rules --- .../etc/integration-manifests.json.gz | Bin 8113 -> 8129 bytes .../etc/integration-schemas.json.gz | Bin 2623052 -> 2623170 bytes ...vement_malicious_remote_file_creation.toml | 45 ++++++++++++++ ..._file_creation_in_sensitive_directory.toml | 57 ++++++++++++++++++ ...ovement_ml_high_mean_rdp_process_args.toml | 52 ++++++++++++++++ ...ent_ml_high_mean_rdp_session_duration.toml | 52 ++++++++++++++++ ...ral_movement_ml_high_remote_file_size.toml | 53 ++++++++++++++++ ...ml_high_variance_rdp_session_duration.toml | 52 ++++++++++++++++ ...ovement_ml_rare_remote_file_directory.toml | 52 ++++++++++++++++ ...ovement_ml_rare_remote_file_extension.toml | 51 ++++++++++++++++ ...spike_in_connections_from_a_source_ip.toml | 52 ++++++++++++++++ ...ke_in_connections_to_a_destination_ip.toml | 52 ++++++++++++++++ ...al_movement_ml_spike_in_rdp_processes.toml | 51 ++++++++++++++++ ...ent_ml_spike_in_remote_file_transfers.toml | 53 ++++++++++++++++ ...nt_ml_unusual_time_for_an_rdp_session.toml | 52 ++++++++++++++++ 15 files changed, 674 insertions(+) create mode 100644 rules/cross-platform/lateral_movement_malicious_remote_file_creation.toml create mode 100644 rules/cross-platform/lateral_movement_remote_file_creation_in_sensitive_directory.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml create mode 100644 rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 9529c165b233ca1de3d9492479cb886faa5b66e1..c7ef05516e322fafcac2623447c8fe7457bd9204 100644 GIT binary patch delta 468 zcmV;_0W1EoKfyl-ABzYG-V!LW2l^d<%6C{Z$Tw{@<;}484y&(QY>_PQcjCyuRXAVH z%Du1K+1Yfk42$=x1dx5N{NL`-uf5!V{>fPQqc8p>Fw)2v2WcTeh9vf<#w>aYX8AfL z_t}1rjc9H>gwr4&-ZxJkg4pm!Y50_ZzI(GfPV1^kiSv+>tfbsakdmh)RSYbD{WY9t z-ykvm@%@KYr)UXKvKLD4+yLdN3*~Wu#rF!v^+Qq*eusShCL{PQ`@nQH-E%lE=agL! z{mr+yJ8c!J%+FwdWewC|h0dQ&qO2MCI5XaU|HJ!tUn|Cg&Kds*{=E$2 zATfO7!wQ43&F8M`-nGbR({H#zf8?fx?C<%%tvc?t$_nTXpc7l@1gvY0Zaw6)c-bP3 z?x(?Q^cYU}8x`w!+}WhjZ8_Vo*!ktP)0vvIe#(-VPmJi{!AKtiU^( zl&0C{$tI;>{uIX1Ja1^RhSV;T-9mjTm_jF*;-qE@z04FRHB;zjraUQ3sR_)#{`wC- K+$BFPM+5*iJ@+60 delta 452 zcmV;#0XzP|Ke0atABzYGjnpQw2l^d<>QJ&>gg^geEd0?Ie-apJWQ>Ef;F-O9>`#qZ z^c2kUB|q-7w-_7I+;|A5K|WG$o;(Dx;g8brDf`Z^4vL#i2g|V7hjj$`H*GcJ&aim- z>J5u6lI8u*uH;a{`EpjmuOyp&V*YPyOxf-@Es#1yO6-u5=Oa~&(fl=>XWuS=G5+!W zhgJXL=>fXD0Lyx|+%6c`kElEdE?<7g2!6{brK{PB!+AL+>U!jAzQx^X9a*!?cj3?; zXMfNC?GD&%7SpaxwPPo5gOA|gBX5_F z0J>=AXRxyNRj@+mPbX2wfRBkjDH0GUWRdy7{2jgg~8b7bJun6 zT4c28_S&F7GUh(}d;afe0|Mw8q1$dz2w2w~-Fn1g@v=o6-A{wr=rNq`H!9ZexU)&4 zyGpiSvGdFBalKVqKV?bGCr0$}V5Ek=q|2ZaX#g$DwK2Lpu%1ce6$g$D+O2M2`*2!#g; zg$D|S2MdJ<421^`g$E9W2M>h@5QPU3g$ELa2NQ({6om&Bg$EXe2N#707=;HJg$Eji z2OEV49EArRg$Evm2Oot8AcY4Zg$E*q2P1_CB!vehg$E{u2Pd@$C`|=_Y(MyU8CTE` zzHUFzBX?m+zp%AbxMpehC=~0qxxlQ&^oJ(7RKy=_3Z``-!cm!uOL+#!Ek0ay8bu+4}-@?WCytLO0i9*H>Z* zSI{~2t-pjtvZ?F;``HP9DdLl|((V4?>1~v1(>c$wdnnBo8{2c1K_vq2bpL6Mv?xEt z?l_GDX>y+7<8Ki}->rr?1~bUBDg2xVnl|#^u9b1`0tNm%7WmI7@NZk-e>qs-2TSDl z`$C6$(L75}O%G#d{kEaiE>R_)Yd64JZ*BHN3{=xR2AY-UgQ$maYUuiTXg&*WXx66N z6s6zb$?tJwhn7@=4+oy`*?C9WOSqO77rQ54(qjq>a#Q#`0X@AH#vl7%x12m`c_fS2 z=VQ0|BvHNocbj+~ozoiObKwg4NB`gt@2!SEyuTX$`Q3c*=gh@5QPU3g$ELa2NQ({6om&Bg$EXe2N#707=;HJg$Eji z2OEV49EArRg$Evm2Oot8AcY4Zg$E*q2P1_CB!vehg$E{u2Pd@$C`|=_{_khEDLg*F zDBYGHp58{OHV-<>?x8f>1#E9v3Mc~BtX7j+P37`a?2ZOFkS6CDK9&$c^xdku7|bBg zrkm$H(6o#HcCCz$lqm4uvA};ufq&Zq|I5JwKUgBa-xoU6i}o4y)blWQb`Ba^J-k=) zxpsrAoq6Ul)j+k&%0RPu@_Z2WPz_x_56x%64b9qAm@ErDC7D_I$?w-DokN54#d-2VSKFrb<4@4mPfLPeLi-}LK4;Mf47O}(K)RV kJ{PW#fAkOj@ZM_p!~3h@pWn>~fByXc1Ls Date: Thu, 12 Oct 2023 20:10:20 -0400 Subject: [PATCH 27/86] [New Rule] New GitHub App Installed (#3055) * new rule * Update rules/integrations/github/execution_new_github_app_installed.toml * Update rules/integrations/github/execution_new_github_app_installed.toml edits from review Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * change query from event.module to event.dataset --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- .../execution_new_github_app_installed.toml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 rules/integrations/github/execution_new_github_app_installed.toml diff --git a/rules/integrations/github/execution_new_github_app_installed.toml b/rules/integrations/github/execution_new_github_app_installed.toml new file mode 100644 index 000000000..2d07e6bb6 --- /dev/null +++ b/rules/integrations/github/execution_new_github_app_installed.toml @@ -0,0 +1,46 @@ +[metadata] +creation_date = "2023/08/29" +integration = ["github"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/03" + +[rule] +author = ["Elastic"] +description = """ +This rule detects when a new GitHub App has been installed in your organization account. +GitHub Apps extend GitHub's functionality both within and outside of GitHub. +When an app is installed it is granted permissions to read or modify your repository and organization data. +Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. +Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks. +""" +from = "now-9m" +index = ["logs-github.audit-*"] +language = "eql" +license = "Elastic License v2" +name = "New GitHub App Installed" +risk_score = 47 +rule_id = "1ca62f14-4787-4913-b7af-df11745a49da" +severity = "medium" +tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Github"] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +configuration where event.dataset == "github.audit" and event.action == "integration_installation.create" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1072" +name = "Software Deployment Tools" +reference = "https://attack.mitre.org/techniques/T1072/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + From 15718ea09e18f6c4625dbe0371db7f92b26aed9c Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Fri, 13 Oct 2023 13:39:03 +0530 Subject: [PATCH 28/86] Improve exsisting setup configurations for Linux (#3141) --- ...d_and_control_tunneling_via_earthworm.toml | 40 +++++++++++++- ...ntial_successful_linux_ftp_bruteforce.toml | 47 +++++++++++----- ...ntial_successful_linux_rdp_bruteforce.toml | 47 +++++++++++----- .../credential_access_ssh_backdoor_log.toml | 40 +++++++++++++- ...defense_evasion_chattr_immutable_file.toml | 40 +++++++++++++- .../defense_evasion_hidden_file_dir_tmp.toml | 40 +++++++++++++- .../defense_evasion_hidden_shared_object.toml | 40 +++++++++++++- ...reload_env_variable_process_injection.toml | 53 ++++++++++++++----- .../defense_evasion_log_files_deleted.toml | 40 +++++++++++++- ...very_pspy_process_monitoring_detected.toml | 35 ++++++------ .../execution_shell_evasion_linux_binary.toml | 37 ++++++++++++- ...ersistence_kde_autostart_modification.toml | 40 +++++++++++++- 12 files changed, 427 insertions(+), 72 deletions(-) diff --git a/rules/linux/command_and_control_tunneling_via_earthworm.toml b/rules/linux/command_and_control_tunneling_via_earthworm.toml index a13802a47..27a4f4f8e 100644 --- a/rules/linux/command_and_control_tunneling_via_earthworm.toml +++ b/rules/linux/command_and_control_tunneling_via_earthworm.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -20,7 +20,43 @@ license = "Elastic License v2" name = "Potential Protocol Tunneling via EarthWorm" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ references = [ "http://rootkiter.com/EarthWorm/", diff --git a/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml index efa147837..60dccf0ca 100644 --- a/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/06" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -22,19 +22,38 @@ language = "eql" license = "Elastic License v2" name = "Potential Successful Linux FTP Brute Force Attack Detected" note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. -``` -Kibana --> -Management --> -Integrations --> -Auditd Manager --> -Add Auditd Manager -``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. -``` -For this detection rule no additional audit rules are required to be added to the integration. -``` -Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. + +This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +### Auditd Manager Integration Setup +The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. +Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. + +#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Auditd Manager and select the integration to see more details about it. +- Click Add Auditd Manager. +- Configure the integration name and optionally add a description. +- Review optional and advanced settings accordingly. +- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click Save and Continue. +- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). + +#### Rule Specific Setup Note +Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. +However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +- For this detection rule no additional audit rules are required to be added to the integration. + """ risk_score = 47 rule_id = "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d" diff --git a/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml index 47419a0c1..9e21f2815 100644 --- a/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/06" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -22,19 +22,38 @@ language = "eql" license = "Elastic License v2" name = "Potential Successful Linux RDP Brute Force Attack Detected" note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. -``` -Kibana --> -Management --> -Integrations --> -Auditd Manager --> -Add Auditd Manager -``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. -``` -For this detection rule no additional audit rules are required to be added to the integration. -``` -Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. + +This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +### Auditd Manager Integration Setup +The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. +Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. + +#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Auditd Manager and select the integration to see more details about it. +- Click Add Auditd Manager. +- Configure the integration name and optionally add a description. +- Review optional and advanced settings accordingly. +- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click Save and Continue. +- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). + +#### Rule Specific Setup Note +Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. +However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +- For this detection rule no additional audit rules are required to be added to the integration. + """ risk_score = 47 rule_id = "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0" diff --git a/rules/linux/credential_access_ssh_backdoor_log.toml b/rules/linux/credential_access_ssh_backdoor_log.toml index c7d1cf2eb..1bbb00593 100644 --- a/rules/linux/credential_access_ssh_backdoor_log.toml +++ b/rules/linux/credential_access_ssh_backdoor_log.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -21,7 +21,43 @@ license = "Elastic License v2" name = "Potential OpenSSH Backdoor Logging Activity" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ references = [ "https://github.com/eset/malware-ioc/tree/master/sshdoor", diff --git a/rules/linux/defense_evasion_chattr_immutable_file.toml b/rules/linux/defense_evasion_chattr_immutable_file.toml index bd1ba550a..f8e439d7f 100644 --- a/rules/linux/defense_evasion_chattr_immutable_file.toml +++ b/rules/linux/defense_evasion_chattr_immutable_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -22,7 +22,43 @@ max_signals = 33 name = "File made Immutable by Chattr" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ risk_score = 47 rule_id = "968ccab9-da51-4a87-9ce2-d3c9782fd759" diff --git a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml index 954a9ebcf..2299892f5 100644 --- a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml +++ b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -27,7 +27,43 @@ max_signals = 33 name = "Creation of Hidden Files and Directories via CommandLine" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ risk_score = 47 rule_id = "b9666521-4742-49ce-9ddc-b8e84c35acae" diff --git a/rules/linux/defense_evasion_hidden_shared_object.toml b/rules/linux/defense_evasion_hidden_shared_object.toml index 28e1f61a5..4a650968b 100644 --- a/rules/linux/defense_evasion_hidden_shared_object.toml +++ b/rules/linux/defense_evasion_hidden_shared_object.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -21,7 +21,43 @@ max_signals = 33 name = "Creation of Hidden Shared Object File" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ risk_score = 47 rule_id = "766d3f91-3f12-448c-b65f-20123e9e9e8c" diff --git a/rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml b/rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml index 3771c896f..70a2ac9c5 100644 --- a/rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml +++ b/rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "The linux.advanced.capture_env_vars option for Elastic Defend has been introduced in 8.6.0" min_stack_version = "8.6.0" -updated_date = "2023/08/25" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -21,18 +21,45 @@ license = "Elastic License v2" name = "Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable" note = """ This rule was deprecated due to the large amount of false positives and the lack of true positives generated by the rule. ## Setup -By default, the `Elastic Defend` integration does not collect environment variable logging. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the `Elastic Defend` integration. -``` -Kibana --> -Fleet --> -Agent policies --> -Agent policy for which the option should be enabled --> -Name of the Elastic Defend integration --> -Show advanced settings --> -linux.advanced.capture_env_vars -``` -`linux.advanced.capture_env_vars` should be set to `LD_PRELOAD,LD_LIBRARY_PATH`. -After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly. + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +Elastic Defend integration does not collect environment variable logging by default. +In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration. + #### To set up environment variable capture for an Elastic Agent policy: +- Go to Security → Manage → Policies. +- Select an Elastic Agent policy. +- Click Show advanced settings. +- Scroll down or search for linux.advanced.capture_env_vars. +- Enter the names of env vars you want to capture, separated by commas. +- For this rule the linux.advanced.capture_env_vars variable should be set to "LD_PRELOAD,LD_LIBRARY_PATH". +- Click Save. +After saving the integration change, the Elastic Agents running this policy will be updated and +the rule will function properly. +For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). + """ references = ["https://www.getambassador.io/resources/code-injection-on-linux-and-macos"] risk_score = 21 diff --git a/rules/linux/defense_evasion_log_files_deleted.toml b/rules/linux/defense_evasion_log_files_deleted.toml index 11b7082b3..2dc632a5e 100644 --- a/rules/linux/defense_evasion_log_files_deleted.toml +++ b/rules/linux/defense_evasion_log_files_deleted.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -19,7 +19,43 @@ license = "Elastic License v2" name = "System Log File Deletion" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ references = [ "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html", diff --git a/rules/linux/discovery_pspy_process_monitoring_detected.toml b/rules/linux/discovery_pspy_process_monitoring_detected.toml index e39b6edeb..81fe33eb3 100644 --- a/rules/linux/discovery_pspy_process_monitoring_detected.toml +++ b/rules/linux/discovery_pspy_process_monitoring_detected.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/20" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -20,24 +20,29 @@ language = "eql" license = "Elastic License v2" name = "Potential Pspy Process Monitoring Detected" note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. -``` -Kibana --> -Management --> -Integrations --> -Auditd Manager --> -Add Auditd Manager -``` +This rule requires data coming in from Auditd Manager integration. -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +### Auditd Manager Integration Setup +The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. +Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. -For this detection rule to trigger, the following additional audit rules are required to be added to the integration: -``` --w /proc/ -p r -k audit_proc -``` +#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Auditd Manager and select the integration to see more details about it. +- Click Add Auditd Manager. +- Configure the integration name and optionally add a description. +- Review optional and advanced settings accordingly. +- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click Save and Continue. +- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). + +#### Rule Specific Setup Note +Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. +However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +- For this detection rule the following additional audit rules are required to be added to the integration: + -- "-w /proc/ -p r -k audit_proc" -Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. """ references = ["https://github.com/DominicBreuker/pspy"] risk_score = 21 diff --git a/rules/linux/execution_shell_evasion_linux_binary.toml b/rules/linux/execution_shell_evasion_linux_binary.toml index d88e2665e..09e519242 100644 --- a/rules/linux/execution_shell_evasion_linux_binary.toml +++ b/rules/linux/execution_shell_evasion_linux_binary.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/05" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -65,7 +65,40 @@ Initiate the incident response process based on the outcome of the triage. ## Setup -The session view analysis for the command alerted is avalible in versions 8.2 and above. +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above. +#### To confirm that Session View data is enabled: +- Go to Manage → Policies, and edit one or more of your Elastic Defend integration policies. +- Select the Policy settings tab, then scroll down to the Linux event collection section near the bottom. +- Check the box for Process events, and turn on the Include session data toggle. +- If you want to include file and network alerts in Session View, check the boxes for Network and File events. +- If you want to enable terminal output capture, turn on the Capture terminal output toggle. +For more information about the additional fields collected when this setting is enabled and +the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). + """ references = [ "https://gtfobins.github.io/gtfobins/apt/", diff --git a/rules/linux/persistence_kde_autostart_modification.toml b/rules/linux/persistence_kde_autostart_modification.toml index 980170104..41c72b639 100644 --- a/rules/linux/persistence_kde_autostart_modification.toml +++ b/rules/linux/persistence_kde_autostart_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/12" [rule] author = ["Elastic"] @@ -19,7 +19,43 @@ license = "Elastic License v2" name = "Persistence via KDE AutoStart Script or Desktop File Modification" note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +#### Custom Ingest Pipeline +For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + """ references = [ "https://userbase.kde.org/System_Settings/Autostart", From b4f8fc3290862d0d564cedff8d278b56bb5593fd Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Fri, 13 Oct 2023 13:37:21 -0400 Subject: [PATCH 29/86] [FR] 8.11 Release Preparation and Update Main Branch to 8.12 (#3182) * prepping for 8.12 branch * added ananlytic manifests and schemas * fix linting issues * updated analytic package manifests and schemas --- .github/workflows/lock-versions.yml | 2 +- .../etc/api_schemas/8.11/8.11.base.json | 453 ++++++++++++++ .../etc/api_schemas/8.11/8.11.eql.json | 475 +++++++++++++++ .../8.11/8.11.machine_learning.json | 465 +++++++++++++++ .../etc/api_schemas/8.11/8.11.new_terms.json | 516 ++++++++++++++++ .../etc/api_schemas/8.11/8.11.query.json | 465 +++++++++++++++ .../api_schemas/8.11/8.11.threat_match.json | 556 ++++++++++++++++++ .../etc/api_schemas/8.11/8.11.threshold.json | 514 ++++++++++++++++ .../etc/attack-technique-redirects.json | 2 +- .../etc/beats_schemas/main.json.gz | Bin 510685 -> 511034 bytes .../etc/beats_schemas/v8.10.3.json.gz | Bin 0 -> 510685 bytes .../etc/ecs_schemas/1.10.0/ecs_flat.json.gz | Bin 50553 -> 50553 bytes .../etc/ecs_schemas/1.10.0/ecs_nested.json.gz | Bin 61829 -> 61829 bytes .../etc/ecs_schemas/1.11.0/ecs_flat.json.gz | Bin 73727 -> 73727 bytes .../etc/ecs_schemas/1.11.0/ecs_nested.json.gz | Bin 88011 -> 88011 bytes .../etc/ecs_schemas/1.12.0/ecs_flat.json.gz | Bin 76788 -> 76788 bytes .../etc/ecs_schemas/1.12.0/ecs_nested.json.gz | Bin 90989 -> 90989 bytes .../etc/ecs_schemas/1.12.1/ecs_flat.json.gz | Bin 79509 -> 79509 bytes .../etc/ecs_schemas/1.12.1/ecs_nested.json.gz | Bin 93708 -> 93708 bytes .../etc/ecs_schemas/1.12.2/ecs_flat.json.gz | Bin 79509 -> 79509 bytes .../etc/ecs_schemas/1.12.2/ecs_nested.json.gz | Bin 93708 -> 93708 bytes .../etc/ecs_schemas/1.6.0/ecs_flat.json.gz | Bin 43881 -> 43881 bytes .../etc/ecs_schemas/1.6.0/ecs_nested.json.gz | Bin 53764 -> 53764 bytes .../etc/ecs_schemas/1.7.0/ecs_flat.json.gz | Bin 45153 -> 45153 bytes .../etc/ecs_schemas/1.7.0/ecs_nested.json.gz | Bin 55196 -> 55196 bytes .../etc/ecs_schemas/1.8.0/ecs_flat.json.gz | Bin 46571 -> 46571 bytes .../etc/ecs_schemas/1.8.0/ecs_nested.json.gz | Bin 57038 -> 57038 bytes .../etc/ecs_schemas/1.9.0/ecs_flat.json.gz | Bin 49570 -> 49570 bytes .../etc/ecs_schemas/1.9.0/ecs_nested.json.gz | Bin 60254 -> 60254 bytes .../etc/ecs_schemas/8.0.0/ecs_flat.json.gz | Bin 78214 -> 78214 bytes .../etc/ecs_schemas/8.0.0/ecs_nested.json.gz | Bin 96973 -> 96973 bytes .../etc/ecs_schemas/8.0.1/ecs_flat.json.gz | Bin 78214 -> 78214 bytes .../etc/ecs_schemas/8.0.1/ecs_nested.json.gz | Bin 96973 -> 96973 bytes .../etc/ecs_schemas/8.1.0/ecs_flat.json.gz | Bin 81089 -> 81089 bytes .../etc/ecs_schemas/8.1.0/ecs_nested.json.gz | Bin 100228 -> 100228 bytes .../ecs_flat.json.gz | Bin 107355 -> 107355 bytes .../etc/ecs_schemas/8.10.0/ecs_nested.json.gz | Bin 0 -> 127127 bytes .../etc/ecs_schemas/8.2.0/ecs_flat.json.gz | Bin 91216 -> 91216 bytes .../etc/ecs_schemas/8.2.0/ecs_nested.json.gz | Bin 109590 -> 109590 bytes .../etc/ecs_schemas/8.2.1/ecs_flat.json.gz | Bin 91189 -> 91189 bytes .../etc/ecs_schemas/8.2.1/ecs_nested.json.gz | Bin 109572 -> 109572 bytes .../etc/ecs_schemas/8.3.0/ecs_flat.json.gz | Bin 91945 -> 91945 bytes .../etc/ecs_schemas/8.3.0/ecs_nested.json.gz | Bin 110526 -> 110526 bytes .../etc/ecs_schemas/8.3.1/ecs_flat.json.gz | Bin 93557 -> 93557 bytes .../etc/ecs_schemas/8.3.1/ecs_nested.json.gz | Bin 110592 -> 110592 bytes .../ecs_schemas/8.4.0-rc1/ecs_flat.json.gz | Bin 93926 -> 93926 bytes .../ecs_schemas/8.4.0-rc1/ecs_nested.json.gz | Bin 110612 -> 110612 bytes .../etc/ecs_schemas/8.4.0/ecs_flat.json.gz | Bin 93926 -> 93926 bytes .../etc/ecs_schemas/8.4.0/ecs_nested.json.gz | Bin 110612 -> 110612 bytes .../ecs_schemas/8.5.0-rc1/ecs_flat.json.gz | Bin 96630 -> 96630 bytes .../ecs_schemas/8.5.0-rc1/ecs_nested.json.gz | Bin 114326 -> 114326 bytes .../etc/ecs_schemas/8.5.0/ecs_flat.json.gz | Bin 95575 -> 95575 bytes .../etc/ecs_schemas/8.5.0/ecs_nested.json.gz | Bin 112764 -> 112764 bytes .../etc/ecs_schemas/8.5.1/ecs_flat.json.gz | Bin 95571 -> 95571 bytes .../etc/ecs_schemas/8.5.1/ecs_nested.json.gz | Bin 112760 -> 112760 bytes .../etc/ecs_schemas/8.5.2/ecs_flat.json.gz | Bin 95569 -> 95569 bytes .../etc/ecs_schemas/8.5.2/ecs_nested.json.gz | Bin 112758 -> 112758 bytes .../ecs_schemas/8.6.0-rc1/ecs_flat.json.gz | Bin 96145 -> 96145 bytes .../ecs_schemas/8.6.0-rc1/ecs_nested.json.gz | Bin 113584 -> 113584 bytes .../etc/ecs_schemas/8.6.0/ecs_flat.json.gz | Bin 96145 -> 96145 bytes .../etc/ecs_schemas/8.6.0/ecs_nested.json.gz | Bin 113584 -> 113584 bytes .../etc/ecs_schemas/8.6.1/ecs_flat.json.gz | Bin 96307 -> 96307 bytes .../etc/ecs_schemas/8.6.1/ecs_nested.json.gz | Bin 113757 -> 113757 bytes .../ecs_schemas/8.7.0-rc1/ecs_flat.json.gz | Bin 106124 -> 106124 bytes .../ecs_schemas/8.7.0-rc1/ecs_nested.json.gz | Bin 125615 -> 125615 bytes .../etc/ecs_schemas/8.7.0/ecs_flat.json.gz | Bin 106124 -> 106124 bytes .../etc/ecs_schemas/8.7.0/ecs_nested.json.gz | Bin 125615 -> 125615 bytes .../etc/ecs_schemas/8.8.0/ecs_flat.json.gz | Bin 106501 -> 106501 bytes .../etc/ecs_schemas/8.8.0/ecs_nested.json.gz | Bin 125947 -> 125947 bytes .../etc/ecs_schemas/8.9.0/ecs_flat.json.gz | Bin 106758 -> 106758 bytes .../etc/ecs_schemas/8.9.0/ecs_nested.json.gz | Bin 126202 -> 126202 bytes .../master_8.12.0-dev/ecs_flat.json.gz | Bin 0 -> 107861 bytes .../etc/integration-manifests.json.gz | Bin 8129 -> 8965 bytes .../etc/integration-schemas.json.gz | Bin 2623170 -> 3101487 bytes detection_rules/etc/packages.yml | 6 +- detection_rules/etc/stack-schema-map.yaml | 13 +- detection_rules/schemas/__init__.py | 6 + 77 files changed, 3464 insertions(+), 9 deletions(-) create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.base.json create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.eql.json create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.machine_learning.json create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.new_terms.json create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.query.json create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.threat_match.json create mode 100644 detection_rules/etc/api_schemas/8.11/8.11.threshold.json create mode 100644 detection_rules/etc/beats_schemas/v8.10.3.json.gz rename detection_rules/etc/ecs_schemas/{master_8.11.0-dev => 8.10.0}/ecs_flat.json.gz (99%) create mode 100644 detection_rules/etc/ecs_schemas/8.10.0/ecs_nested.json.gz create mode 100644 detection_rules/etc/ecs_schemas/master_8.12.0-dev/ecs_flat.json.gz diff --git a/.github/workflows/lock-versions.yml b/.github/workflows/lock-versions.yml index 484fe5c20..9e6ab8905 100644 --- a/.github/workflows/lock-versions.yml +++ b/.github/workflows/lock-versions.yml @@ -6,7 +6,7 @@ on: description: 'List of branches to lock versions (ordered, comma separated)' required: true # 7.17 was intentionally skipped because it was added late and was bug fix only - default: '8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10' + default: '8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11' jobs: pr: diff --git a/detection_rules/etc/api_schemas/8.11/8.11.base.json b/detection_rules/etc/api_schemas/8.11/8.11.base.json new file mode 100644 index 000000000..cd6f208af --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.base.json @@ -0,0 +1,453 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "license": { + "type": "string" + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "throttle": { + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "query", + "saved_query", + "machine_learning", + "eql", + "threshold", + "threat_match", + "new_terms" + ], + "enumNames": [], + "type": "string" + } + }, + "required": [ + "author", + "description", + "name", + "risk_score", + "rule_id", + "severity", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/api_schemas/8.11/8.11.eql.json b/detection_rules/etc/api_schemas/8.11/8.11.eql.json new file mode 100644 index 000000000..a1e618f98 --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.eql.json @@ -0,0 +1,475 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "event_category_override": { + "min_compat": "8.0", + "type": "string" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "index": { + "items": { + "type": "string" + }, + "type": "array" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "language": { + "enum": [ + "eql" + ], + "type": "string" + }, + "license": { + "type": "string" + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "query": { + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "throttle": { + "type": "string" + }, + "tiebreaker_field": { + "min_compat": "8.0", + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_field": { + "min_compat": "8.0", + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "eql" + ], + "type": "string" + } + }, + "required": [ + "author", + "description", + "language", + "name", + "query", + "risk_score", + "rule_id", + "severity", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/api_schemas/8.11/8.11.machine_learning.json b/detection_rules/etc/api_schemas/8.11/8.11.machine_learning.json new file mode 100644 index 000000000..ca88b1912 --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.machine_learning.json @@ -0,0 +1,465 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "anomaly_threshold": { + "format": "integer", + "type": "number" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "license": { + "type": "string" + }, + "machine_learning_job_id": { + "anyOf": [ + { + "type": "string" + }, + { + "items": { + "type": "string" + }, + "type": "array" + } + ] + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "throttle": { + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "machine_learning" + ], + "type": "string" + } + }, + "required": [ + "anomaly_threshold", + "author", + "description", + "machine_learning_job_id", + "name", + "risk_score", + "rule_id", + "severity", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/api_schemas/8.11/8.11.new_terms.json b/detection_rules/etc/api_schemas/8.11/8.11.new_terms.json new file mode 100644 index 000000000..de43ba609 --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.new_terms.json @@ -0,0 +1,516 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "index": { + "items": { + "type": "string" + }, + "type": "array" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "language": { + "enum": [ + "kuery", + "lucene" + ], + "enumNames": [], + "type": "string" + }, + "license": { + "type": "string" + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "new_terms": { + "additionalProperties": false, + "properties": { + "field": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "history_window_start": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "value": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "field", + "value" + ], + "type": "object" + }, + "type": "array" + }, + "value": { + "description": "NewTermsFields", + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "maxItems": 3, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "field", + "history_window_start", + "value" + ], + "type": "object" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "query": { + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "throttle": { + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "new_terms" + ], + "type": "string" + } + }, + "required": [ + "author", + "description", + "language", + "name", + "new_terms", + "query", + "risk_score", + "rule_id", + "severity", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/api_schemas/8.11/8.11.query.json b/detection_rules/etc/api_schemas/8.11/8.11.query.json new file mode 100644 index 000000000..20d6284ce --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.query.json @@ -0,0 +1,465 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "index": { + "items": { + "type": "string" + }, + "type": "array" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "language": { + "enum": [ + "kuery", + "lucene" + ], + "enumNames": [], + "type": "string" + }, + "license": { + "type": "string" + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "query": { + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "throttle": { + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "query" + ], + "type": "string" + } + }, + "required": [ + "author", + "description", + "language", + "name", + "query", + "risk_score", + "rule_id", + "severity", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/api_schemas/8.11/8.11.threat_match.json b/detection_rules/etc/api_schemas/8.11/8.11.threat_match.json new file mode 100644 index 000000000..dcc339473 --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.threat_match.json @@ -0,0 +1,556 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "concurrent_searches": { + "description": "PositiveInteger", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "index": { + "items": { + "type": "string" + }, + "type": "array" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "items_per_search": { + "description": "PositiveInteger", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "language": { + "enum": [ + "kuery", + "lucene" + ], + "enumNames": [], + "type": "string" + }, + "license": { + "type": "string" + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "query": { + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "threat_filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "threat_index": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat_indicator_path": { + "type": "string" + }, + "threat_language": { + "enum": [ + "kuery", + "lucene" + ], + "enumNames": [], + "type": "string" + }, + "threat_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "entries": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "enum": [ + "mapping" + ], + "type": "string" + }, + "value": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "field", + "type", + "value" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "entries" + ], + "type": "object" + }, + "type": "array" + }, + "threat_query": { + "type": "string" + }, + "throttle": { + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "threat_match" + ], + "type": "string" + } + }, + "required": [ + "author", + "description", + "language", + "name", + "query", + "risk_score", + "rule_id", + "severity", + "threat_index", + "threat_mapping", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/api_schemas/8.11/8.11.threshold.json b/detection_rules/etc/api_schemas/8.11/8.11.threshold.json new file mode 100644 index 000000000..0c5a10ad7 --- /dev/null +++ b/detection_rules/etc/api_schemas/8.11/8.11.threshold.json @@ -0,0 +1,514 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "additionalProperties": false, + "properties": { + "actions": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "alert_suppression": { + "additionalProperties": false, + "properties": { + "duration": { + "additionalProperties": false, + "properties": { + "unit": { + "enum": [ + "s", + "m", + "h" + ], + "enumNames": [], + "type": "string" + }, + "value": { + "format": "integer", + "type": "number" + } + }, + "required": [ + "unit", + "value" + ], + "type": "object" + }, + "group_by": { + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "group_by" + ], + "type": "object" + }, + "author": { + "items": { + "type": "string" + }, + "type": "array" + }, + "building_block_type": { + "enum": [ + "default" + ], + "type": "string" + }, + "description": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "exceptions_list": { + "items": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "array" + }, + "false_positives": { + "items": { + "type": "string" + }, + "type": "array" + }, + "filters": { + "items": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "type": "array" + }, + "from": { + "type": "string" + }, + "index": { + "items": { + "type": "string" + }, + "type": "array" + }, + "interval": { + "description": "Interval", + "pattern": "^\\d+[mshd]$", + "type": "string" + }, + "language": { + "enum": [ + "kuery", + "lucene" + ], + "enumNames": [], + "type": "string" + }, + "license": { + "type": "string" + }, + "max_signals": { + "description": "MaxSignals", + "format": "integer", + "minimum": 1, + "type": "number" + }, + "meta": { + "additionalProperties": { + "type": [ + "string", + "number", + "object", + "array", + "boolean" + ] + }, + "type": "object" + }, + "name": { + "description": "RuleName", + "pattern": "^[a-zA-Z0-9].+?[a-zA-Z0-9()]$", + "type": "string" + }, + "note": { + "description": "MarkdownField", + "type": "string" + }, + "query": { + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "type": "array" + }, + "related_integrations": { + "items": { + "additionalProperties": false, + "properties": { + "integration": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "package": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "version": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "package", + "version" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "required_fields": { + "items": { + "additionalProperties": false, + "properties": { + "ecs": { + "type": "boolean" + }, + "name": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "type": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + } + }, + "required": [ + "ecs", + "name", + "type" + ], + "type": "object" + }, + "min_compat": "8.3", + "type": "array" + }, + "risk_score": { + "description": "MaxSignals", + "format": "integer", + "maximum": 100, + "minimum": 1, + "type": "number" + }, + "risk_score_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "rule_id": { + "description": "UUIDString", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", + "type": "string" + }, + "rule_name_override": { + "type": "string" + }, + "setup": { + "min_compat": "8.3", + "type": "string" + }, + "severity": { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "enumNames": [], + "type": "string" + }, + "severity_mapping": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "operator": { + "enum": [ + "equals" + ], + "type": "string" + }, + "severity": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "type": "array" + }, + "tags": { + "items": { + "type": "string" + }, + "type": "array" + }, + "threat": { + "items": { + "additionalProperties": false, + "properties": { + "framework": { + "enum": [ + "MITRE ATT&CK" + ], + "type": "string" + }, + "tactic": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TacticURL", + "pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "technique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "TechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$", + "type": "string" + }, + "subtechnique": { + "items": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "reference": { + "description": "SubTechniqueURL", + "pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$", + "type": "string" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "id", + "name", + "reference" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "framework", + "tactic" + ], + "type": "object" + }, + "type": "array" + }, + "threshold": { + "additionalProperties": false, + "properties": { + "cardinality": { + "items": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "value": { + "description": "ThresholdValue", + "format": "integer", + "minimum": 1, + "type": "number" + } + }, + "required": [ + "field", + "value" + ], + "type": "object" + }, + "type": "array" + }, + "field": { + "description": "CardinalityFields", + "items": { + "description": "NonEmptyStr", + "minLength": 1, + "type": "string" + }, + "maxItems": 3, + "type": "array" + }, + "value": { + "description": "ThresholdValue", + "format": "integer", + "minimum": 1, + "type": "number" + } + }, + "required": [ + "field", + "value" + ], + "type": "object" + }, + "throttle": { + "type": "string" + }, + "timeline_id": { + "description": "TimelineTemplateId", + "enum": [ + "db366523-f1c6-4c1f-8731-6ce5ed9e5717", + "91832785-286d-4ebe-b884-1a208d111a70", + "76e52245-7519-4251-91ab-262fb1a1728c", + "495ad7a7-316e-4544-8a0f-9c098daee76e", + "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "e70679c2-6cde-4510-9764-4823df18f7db", + "300afc76-072d-4261-864d-4149714bf3f1", + "3e47ef71-ebfc-4520-975c-cb27fc090799", + "3e827bab-838a-469f-bd1e-5e19a2bff2fd", + "4434b91a-94ca-4a89-83cb-a37cdc0532b7" + ], + "enumNames": [], + "type": "string" + }, + "timeline_title": { + "description": "TimelineTemplateTitle", + "enum": [ + "Generic Endpoint Timeline", + "Generic Network Timeline", + "Generic Process Timeline", + "Generic Threat Match Timeline", + "Comprehensive File Timeline", + "Comprehensive Process Timeline", + "Comprehensive Network Timeline", + "Comprehensive Registry Timeline", + "Alerts Involving a Single User Timeline", + "Alerts Involving a Single Host Timeline" + ], + "enumNames": [], + "type": "string" + }, + "timestamp_override": { + "type": "string" + }, + "to": { + "type": "string" + }, + "type": { + "enum": [ + "threshold" + ], + "type": "string" + } + }, + "required": [ + "author", + "description", + "language", + "name", + "query", + "risk_score", + "rule_id", + "severity", + "threshold", + "type" + ], + "type": "object" +} \ No newline at end of file diff --git a/detection_rules/etc/attack-technique-redirects.json b/detection_rules/etc/attack-technique-redirects.json index cb0fad5a7..83204faf4 100644 --- a/detection_rules/etc/attack-technique-redirects.json +++ b/detection_rules/etc/attack-technique-redirects.json @@ -132,5 +132,5 @@ "T1536": "T1578.004", "T1547.011": "T1647" }, - "saved_date": "Mon Aug 14 13:11:43 2023" + "saved_date": "Fri Oct 13 12:24:23 2023" } \ No newline at end of file diff --git a/detection_rules/etc/beats_schemas/main.json.gz b/detection_rules/etc/beats_schemas/main.json.gz index 0f45ebeb7a057b5ba250ef2e0e9fd7d97cb38403..cf73eb2fd45ad7b752a9a61fe8cccda8a60c32a2 100644 GIT binary patch delta 146852 zcmV(nK=Qxcl^?p89|#|d2mp0kC}n{Ng$MzK2m*x&1BD0#wFm{%UVr0Q7yT9=3IMat=+&Hn&BITa@g5cceAO0GJts7y!nDxaHvJ0q*?Fef5D@sFGK8qU6;!xGKpKbfDq7=bx7grwJ<;4;Tz}m@sYe^W`n}IjIJ9%R z64dAu^Xv~eF}KflpPKqv;tH~&6~o)mDr7VD87jjykcUqz@5!!*btfZJ(AdlW^RUBd zbF%xr&#l8a_o^55OD5$c>DIZz{dvfZKWr@c(x&77zQ2fzlV|XR@okj2#p6?F;pVuY zT4aojI8c={)_=!53x3&YJwJ~zRo)`W3{$<5o|d7UMAU{3n&5=BzR5}fbW)+i9Hf^^y^L=8@03BRowIJ!v^zg zuY>uFwuzj|DK78t0~hq3ix*>T-)pL*n82~x@5cg81Amz24Z#(+?nQO$;tmAy@H~kk zM&oCtT1Vb|I_$V%t*>C=ZCw4H~7Zn!Qe-+H{oCly9oMwO>YoCo_DR{q-! zi(FiU27grfVuKS?dyNBk!AMoc#hoI>PR@%ga5s5vl-_TCO-=1?~>+fi7@2`7F}Rv$CA|4Di6XEI=GuKQA)yj2iG;y^qEJ`7utiEqOUQl2`L9I!G%vD3nY zfeIegm(TxxbS!{F9H0dmRsrD$l%0`BxRe z@HW^mzUuH4R00|WcJ60wD9m=Wn0^jp5P!M4@-zxRxeH4k7E`@Bt5Bq3l7#rjIpAl# zmjoQ@uIBgpO9+M)uHG95_vLe01kP6UzU;0~cdj(tKE>@%K#e18(h zBtGt+021kn%fUt9t>c6pmu=msOK7l9As1ridIb-~WHf9Y1XT(#t!NqZH%6ZETOt^7 z;3Sis`%&{cqXY&6b$R4TJ#=BD-5RAgaA0KRg|Q4m7{qC=|*gkc0_HiQa*hc0x1i$rCs4sVYjWKv`)DlZ$K@t~h zo1hlo-R^NhUW!0atLX@0f1mrks3p80*N}I-M>Wnw;Ne-$(i!8K_k~F6d4H?pX!1miIa)%Rw0dHY*S56?0mB7=;HQZ; z5IigV0*RIU7T*#4V0SoDtaf5G^s($*BieR-SDV6?Ewie&y{2>9PSd%yOp(s*$%UGy zc2#%2y}HGPn*2ElN7_*qwT-_TJn?kaK8_2u?a;1d_?0I_oIMGeNm)SP_#>uwF)=}k zTIeDJ&K`y<*YCaHJoYO@9o-Gs#YcxT%)Pr^Ra@$P%L6a?!Q#py zyGMn?N1Omc)S5^9G}+J2!P319NG!N11B#N>T)YWQ%z~h6Og8Eu^a~y(wd+X&ta^^h zRl-=_mO2NSLVthg#E+ACifDs=TQa%jb#3u8_T%*3UBsluR+td3@8|G8$S|1_jJPcK zg+MrLvUgr!j|&k8cgj-$UPlF!ZWd(`XeS4u(s@R~Ru;>#)LDBr;&q<7dpmb1v)13^ zczzl6?&S`bl=+i5K?U24pb<0YItZ#HIgtDTfONQ<4}Ul>%0AoBo~gVNjl(MN1UvFq zP76tx`d&bat#tT&b>UyRS#h#c?bCf;@dEN}nqA16+r^+7bEIQPGpjTlATf-YUtH!5rtgEt6s0gN2S#rZO7ydA55`1kqMegU8tI{i~ z_uL*OOX!(r+-^%nffM*Dya}E|OvrkhGiDbt!G9;eIdswt-&qfxpzvB^BB#2W`BJ7X zKou8YPJx^{5RjT&%0Tf*WLIb)t-n{7xKXQ?AoH6 z)dLTKv^bPcCEbHsmJzG)OX)^r6Y!Ib%P6N46Dtif$+v~wfRT*Nz*JT^xUXM@@eLz{ zJb(9uR}H-L#!^m$FCQvnz%2AXJm@kLoJ@X_Rb)oeXKH>8G&TIky>y zcym3y`60+Q7<>mb&_2^1P5I}Y#F@vFQvGch6-s<{7Wk!y(Jp8&3^dhuiDf6`XV*an zPMlm^sq_mS)O^AAV>V$&kF+24e=GYj6KLH13zIfw9+;C!E(bvCftfUOwt68a|ImKau|>sIFRwMDY#AsbDf39Gkl^4_XX0 zQ=7-RJ3ZYr4P(u1zRf4!tZcu;+$ZDWMQy9_57VuW$ewx1j;Rzt>d8kV`p_bL0GHB# zJ7GVP_RJ(i=_#BPl2?{-Br;4U#DD+p5>|t;{zVi}m zb81%Btk|QCwPJM*OY3CDWyNgpnzOIBOr30+vorQ9$T$kHKag0_s8YYV; zldi;B6v0Ua-5WIRWf?gyF+3gIBrv0|0PE0XuF;|3)x7(`{hkgHWWpsqC8NKW`fCM{ zf1u>fO9xBg22Zx4yak_PhUIE{g;AI9!!j5@SB45RIdif-k(R(-&AUItWPs=IMf5R%H zN-cMW^zwCYnLL9r5yFzHAwd?TFR3_ikgA;r+_4=hU)V7A8}LQG~hbdq5xtm`_N$hgLDDc}Yx!pBBzi z=paaokl*4#I_EX*E)r^jUPdR~f3@d7zH|<_ztxXr1oFcojL^{wA2DCvr%4VaA38@E zK&sm;Zej?uRRy-3aSDurxz$_Kxx;O+kGKDG;r{=cy9mAtR<5^o-q*#&C6ngjaKtKfB*^1rvdqwqSD-`!U(IwQUY&o6lLsbZUzhf(wkYrP3mf2=-_r%E~f1+s!^$&reBqgI?#VHL?a6b2Hj4UDXH~1G6`A z+XMnh{^EMT_O@eXGX+vSi1W}Jy~!1|%eL>$$g{3ni|lL8@7(a#(qe(YHP%rNR!;fs zI^Si76bq)ZW~UP|)m<4XI@|Bp{iVzOOaYQ?c%pF+G^hejX{}yhe>Z~cE&{!kQO=T=7zI9CX=A=(n&AMZZJ4I}TOnaM?(TaZQ?1Cr2ZeN*5znm{ z9{~MPR-O5jP z9q&b^&&!-0r!Xn=&rRF7bF-ME&eZdCb?}@gln;?>{|jr zxsjV~Y^Mq8+A0ukn%Z^?MmOt<7IBAKeee*msk~rYe7$iqD|f2JHXWH5wgReP@}zae z`Py!#y4p1U3b zi&=VGK?8YgfBpIy&ljuo_DOtStnFAXYr!irP#;F)#wbld^&-i4sC^r`v1RoDfQQo+yPMQ{1hRp+xZSadjr}HITI#MxA&gUY92eUn->HGr zyV;=yOk`tQJDoEHuSn*WRyJ(n_Q@R8U&{uf-F725f5iLN69Ba{>)IRleqI!jeQj9z zD6r)uObXnkd$##@>pqS0d9;Y;Cp$NAylV@myEgE6*9M;K+Q8FY8+f*B17Ggiz*oCA z@bwN26iFJniy+#$iO^Ou*_06q2kb)Fv4!*|w{Ia_ZPFd21GrY*XqD_xJ+!_I^57S* zu)T_Me|nO&ojNAe?jRLH?H#1Te4Cf4Erc$sFC2>P<;o%{K#~dWQ~L%$EZeC86ou?t zDC6)xcH<-uJll1=eFlTrg_GPqOVWa}7w4AG)al%dY;6Eg+tyBll`~9SV_iMBub!53 zTZ@aw%EGJ5NdGTcJ)eWGthXKeGNm>Ew&Gs{e}7?3!R;Ia!R@P4WX%r!)3dpK6QJHd z+d;i&Eri9_<3szD1}xwiYqhf^vaD^rd$DTZWq~c-Xwry$%i2M)CbNd6GC(ch6=>fA zp`MhX?I7Tt-CFKp)vaeQTv~@cQf+H?or4AsuatB90|yE`Tl+K%c4&Yty?p~B;goH4 zf2PA5B~I>XAdGidgH7U>5!(Pswqpz7%J%RiX@2Jx@?_m>n z?)FqZfb?M%MB_iUjJ?6IA6r%gfj?Q2Z0y5^pth|f#_I3zz{%r|tcRZ7*o8Z#xn+Db ztI3o$o0^deaprcW|Dupy1*~))!h9ct|z{74Oo5<-no3MfkFwL)o@(OU*L3 zRiJZHpluDvdEnVq1C(7`sU;77v7BBd*x9nGt+bSfE8Bydr&cOfo_W@rOCs}pyW5=A zRHD0WP%#60I8D2_*IO^Pau>;E+6uc^S-VuwtHN?+sHUZ@Oaf@yqNrI7w)7YFt^{Qk z*)laS!p!~f*0yeF-7EZUmqc|1A_0H5XLSXD0s)1W=ywH`0rR(hcm=Em0YA4Ze+9<@ z0{@YSYVaOTx9!9`b3;+(MQ98iV*5^ z2u+am7?%pNOt&s`Y9}<=_enO5$&x?pp<`i%SSpj%GIT0tvjwXr_ilT8NiPGiqVLeF zBU69+fmLh(6T`=3LK8iID?B(yFx-dEd6=&Ch#L=o*|R0=oNX9?!Y2;2$NJ_3u!8ex zEn!Q2+S33pBNkI6(P-Tx^{CN z3MRbSLr_;Wxw(e{c@1P&Z>mtc_VpAvII3k`UDAEv8df;6?`m-7fFNs~IvVzWnCInA z`_Rhvg@wh?WM=F$9iJlB`jra7z>yZ~Ay>aeO^XLS;!Ol5e;2%a!G3apuI?Jus+ez?4H zu7D3ZZ}b;&#tOMCfAVSRcz2hy({XCeF&KaKZt`+7HI@>8j7uT|$S6{LpX__%Jy65jz>#@OVgBPk)rawknf#?BEfxaoF2$FF-rY4O%> z90ySoG8aeBzfOmkz>#8qdUf`iv(rcQ2j06~FiP(DdQP&9&IHD}fRK}z?*e3-eJ^t7 z;5La$Hhm8ANf{ceaPqJb?-z(BOdvOpcSlbbSBKnGTLWB3tf9ExQDgKWWT#JK|;~ zT5CoHfRhJp2TOhT^34@f_AlN0O&I$UZhlsa6WG%$yXIK4D~Thdb#*<&HlLhpf5LEs zl)le@mwVAoIR{~~JRx83-r5M5?4tQ}0S|)oXkstvPvzn*=-=4hH)~16ClOp^B9sEn zounOZ$R+#G$xBEAl{^2I7a6;f|FVc&?*=lM1^&N1;=diruVDT6+CMGXEqVv&E$p@e zgHBZjbDiahqfaBMW1};A8bX3W3~a&?*H&zQFzjAqrSu1J`hCuSpNs%I^;;B%ZQ zz^s~k!LsoQ9vxl!6@2UXU$Dbx+fCHE%g;%PAjGb3@mx9w=P$o~i1*X%1MaP!Q}PXe z+8y08DsWr;Tv7M4BL~5gkRS+Am0AwjIV(EHSH|6>_1~=3jCZo7X><}g5!m( zL1`8pA`6cJI(dsHPeamwB&Av$U1(T3t>EpAyNf&SaUyxE62q_3%Z*Z35{4J=kVA=M z+yt8{zx250U3*_td{%imne=#t?H0R#bx9=)^HFN^%4?4w=cuWD-^hT(yC-}YXrjFz zjuL}G`*iCY*#kEqP-BiRwI2vK;|3z(4$k=&T#fJJn>e|P51m)Z-Jx?C_+hy@biNN) z>qFecY~r>@@K3cF5do&ObA0sp&)CG1qi25>&3t*}eD&w5t*?(xj{jUWNJ9^Q?%hoq z1$>d{lOFZJW}QE*7-hg)gH}2i$L=n#(#ad(~kH{FAx=apbcS4qh zRd5F!-0JM(fge8n?@_2y&kd9Kmb-$(vj>$z=c1i>&vtANw>hI z>$U8H9xCE8it3HLF2*k+CYp5%?#Qi3*p9nM%0l6UcP;=QctLnuU2e@WH;48X>ZHZH zP+wdh1kL`HMcN=a$s|(@1pF7zxneoN?;yG(0_(c*k?n5==y}OFP!_vg5rt^)Oc^x! z{_Vy1b0mO8Mox5dp83i6IK6I|HzrQ^_blwF~92AGn)f@Kd;_~VY{+Dcs1#khsm)(d3^aB6Dm(z&_ ze1HEwJP<${)#uI;Q3+l7>UoORJe8j?C#QTM;`HAik12>+zlhZ&%}v~BxiAh&n7S2UXL z``Vq~+Lo1ok9&ZL4$|qZYLAk9$_3GQ2!B&o3QWAPfCH}j9u4TNLMp9<)%&Dgz^!c!x8XE1HW2Y)^ktS8g5 z5Vhg?6K#n-(=wL-6ckvhs(>FJocWtDhUY1G)B5lL*e|pVf46jt1!V$%f6l#+0I7?W z4B0f@#iAhr1%lw1E`kU^tZBI13jfTPJTBzJgGZN192QCT=tY>{JbD|re#3tT`lF}` z1;f}Z)#o(55 z51}q$QMFO`84D0=r;Ff!Z+SI~Cu=vtv0^yJ?^w_OHVW>4_jWgB5Vjr&f4Jp5{Ua>r zI8|}#xC!Kaqe3R2#@J|y3&^F(_!nUIDM2fgo&n)aAVMpEQanhq)AR3wZfMz}RltU8 z8n6L9?jcq~^*?OsacqQ!+4M%ivgn`NH(byeJ-JOF3gKLuy4xs!as8f9jV2jaRLA^= z?Fbo>Ii=#xi@t}5QPCZ|v;^ww3QIYQWkl=-BZU`wUeX$IIY|Nt?IZl$yJ;Qmn61Un zt05T_9l-s`rQfs~MPCmJyu7@0eBar!|2W@&|9rD~PRYDBVHAaV;4vnfGo=i$LxMD6 z-5vZplWk7&!a4bW`pe^o%`w@8-d92QV*8C-^O0fpy#X&x7h{W<7bI%u!2NnVdk-U_ zvD-M0HwiWOAa5PD^;r9T&&nJN5C9}fVA zy5!+Q&KG%!V7OnvgnhAOvQe4UGR|XvZ>a8=wPiySs9SE_s&cbZTeMmTg4h~mftzDq zXcAlw+tfm)-|G~PS6*S?$yCIYH2SaWokm_(2+`0BxCoEPdz%g*SUxZ+Q%VY|L3b5TL1iyGjwRfd_e)4lWX) z)LZS+%>j;Z$&^o_)K00Z1D~qYW#CtZOezWHMl{u8R(p#u!z<=xBaxfP2;1a@ikc$2|mA;y`b_zaQ=km#oGQZVAk976;*Bo2V@##3U zl<7}@l#MUUerY)!`G&>TY!Nb@kS(-8dtEV!oza3j!Ve0z_wqVc-ORZxqar+t7*|Kd zAGAvjE+v6P7XYmfEq(X^dI!(ZbLU_sZr`fm*>Mua3pq*T_se~(z_<3IAIjUji?(KW zmjTrth9p7Wsf{qG%~Q89$a~mX9_*X5*Sm;+f1+Vk1e5}3ml()9-cb_l8`EwAVPDIm z%A2F};laZ7**3^? zX!pYddH^p8yBDz$BoqUkAUDbre0qo-Olk)evY;rl*a0kT^?~>J{^a!WliH*1TcmJ* zlBjuFXS*8TwS%X|i``y;frOX3u_I$ye z5a=>yTMGN+Z5=AGBswZOl#-yl`(cpHSt?UL#H+DrPMx*21Yp<%C#;dB}koj}x3xK00!y^1O zqkd*=MZc)wiBr=%fz=JXeJXJ2$H&i){pZh)pS#QFCyVFLPMVZV_ckgl?R@fo+8#&g z(}eJK9XMXpk1=4~JMGbt(?1MR*V5x8fO0wk-Q8Hj$gSxyfm|n0SH;B}cA%o}Ck2*M zPx|QhHL7d_CwHdqC5|h%2yo~XZHw*URLF95N-aU<>dk!Kcyevj+C$0louZ=18G*5h z3}?%3bjiu^=cuoppyz7CB-FWoHtaYQ;EkZ;a(GM3EO6th;e2AqxQn9hqmpDCS_M3IBIDh7;xeawmq}9@7wZGO-_G}r)SiAUbtDYS05DY!PqWSJA<#> zEmKvWRBA^l6%=9JRd=>1mdpHU@6NA)?)NXQw8_Q01+I*-koU)k^`2vYW=5LML+6D5 z=B`#*u%fKXr~Ef`j3j_{I$MuLVUNHl-zgfIj(ZOqs_G_p4lp&tv959yHDgFmx_1&e zAd!)jmz^VrO~5_7T`yi-A38q;3x|@=Yq@~Ar#Q7R=7H`F=HRM}6d^a%>SmKr;{L-Ko;E3)09rQFs$T zx=s?Vy7$3%m~_t6#Ik0plE*l!h-Tn2K-iH6tF7B>NS_UM-q_rKnUZ^u=()UT9vOpR zH#pl*DPQ~&a>=PydQb{Uv5Ei79 zzra+3nEtEEG{{qbeu-p?tUS@%%%g}Y5`$t~y2QWpTK^bKFeZ$?SVXs62)n{S&PkO- zkazykmNF8EPzJ>=_GP%LjfsBjNdd_XiTr(4QD%Z=cq1&FQL@U1^Qv9Y9(eohxpVU5 zIlpRwaZO`VuKFgJDE5$#;w0s6WK!#$;fSGg}5w8 zQf1?R0wkt($+&NY=))p#3+3C~4>RcJ5fjG2#ji-RbNrA$g3*P36wJZ2m6TBH!BgBi zVVsr)pAs)h*tNtM6IZqB ztl8cy#u5f-C`oKeUz>6a^_>j?bBM=(Afxo+qE1Wh`C?>pUEUO!qhZ^ZVEl)+sMQU4 z$<9@3Tqf;pe?_kLAP>d0SM4s{xeEWS-R)x)T1g*Bz0Ti~1v#I}ST4DAvwcw8APOs+Zb}ZtB*2wDipVbC~|z=90%& zEs4NX9HtdmHaD$#CDVT60$Zwou?Ai4?r^%eh<)(i1eB(w^6ZzG{>IMGo0vbu9zxu&QW$?0#=e-bEj+|<`TA73eltMqTI$C2 zcY`^S*U5lM#ixF%?JBPe{(dP!W`htzcRoBQLvR^D2WKX=!}HgN2Rc2}@Cft?d@%&X zGQQa>Y6dS&QJdcG$8&anQD59%gSVN=mHGGwlwLlRep!rU4o#xrVuZX0#hkQ`1I}Y0 zW7+wH4NV+-jfDX_N<#?O}`!!%%ARu0tmjo>YGZ z7tZGpKl$@)=sn|)18nZKA+i$~+4GCQ%XnLwd^{fj#fI$#{H~1PH$+=q?xh}j4 z;#EO`IN>HxXhy$};6BVTn|;ikDD=L>r9R)}#?K7m79jo$PCR8w&OCl{7t52mjF`&F z*6zat47($e;H}+TBg;a+BT=Z6wVOuHIx`u4_j);!#h zkAQluO~I$m#wt~R5A|&=md#D)Y=sMe&};2@Ep{5dZNd&iAPJc=7(f1N_y246f0n!d zqYgHrkxq^-dKtN!yRWsXh`7}_TqQpW-EMln$BRpUU6$<)_H- zZ@QPwwYjL{)|cFeWHNSwAr~YAf;67t4%_MMptnqa8f4&ssH_%s&Iii=I*}UC z5;+!jc+p6eB*j13Vb^9|cZK~|%Rbu#Ca<%XnX02jA(V#dbG3>Ssdb;mfZMw1M- z$N3;-s@DI15+3^IEpxL-*s?RdqFsTLs@o0W*rIPKDQiMg17k-nT&(h0-OmEv;<}YC zjn$N!jjIFKwlEu|P=np@Z&nQF?CMgg#T*e=QJC1DQ5fIg_>ENvK{B z!Ls5+Npe%B#>PhzYs{xGuT)kKz>yXwe-*NGZEg8~kOnwms(_8kO)WgW1>;eLjb`=< z40>5Hq&9K_`?tJWNbDbF`R(@4^)_ac4lg@3g|cNE8Cj>LzU+E8?kbqKIHL3ixcb3; zz{6(|vIDRZ&y?28?}(W2ob3S0YsIW z(zz;sN){T!#p10kZBWAIA@ooW8?84s--JC@cy-~L=5*1Hs4~Qp>->!j?CN^=&#|4< z(0Z6<@Gfa!K|1{rZk3XI%<{UR9Hb-sV+?EfUb#X2Pmh;dcR}5J)R|;WDQ`Qka$@FLs}sFeSl*Tc(y3lf z+}6rv3w3k5EBl))xr3;>4U?&%DbS9J%=LmHBku?DVXMhzZ^iaTV%vjqRTlJ#h$*4|(898|L1Z)synq9*U zG2bdH55a4o1HT)IL&UFFUOpdva?~gUg@^~1ei{<)DQe5=P* zrMk-NLTwT!MG|vZJ_VJRXeS4-5I-;^9I3LPh^cTesz$iM=teeCCMOm{(iDXK zgCG>tt!-w~5$nxtBfbjrfgmHkYECYrHc4@FJRs!8Cu+@h}un}1$qA-_1 zfB-)QS_e?T$wmBS9-Ry?kS`s_9d@MdOz z8hS7hEt*X+5)nZ#ypy3djGdE|fQpCrxKwZ#L2(E017tjh_$(N%iV()_e0LeVodDpA z{~@mSAAaMpl5|wKw-7rlPSuMG9|5Q&Vl3R>euyh*SdJY7YZ+6vH%9)47)<4V&%uZ- z+k;gG)KzE!dc_?8*m$6DxQvKk8Qv3~*@xJ{|8VoVM0h61DXH)f<3=M9-Xbx7fT7B0 z1#~Gc7th&;PvOcZoUP0@!3*UUswPS|WI}$JxaP$r7VtyNNA|A?pPO?xb=Gt4oTY)p zspqHX7&yJB;1i4;4s|f+gqn?iogCZ51{3Tf9JXNrI_2PNssx?Z0NJ{q2!ZIGWg_*I zK-Px^lR_ccNtZyP1r`F{S(jL%1ttOkK9_)^1r&cIq-LC_n< zUGJYBe?4PY;CvA2!e8W$7i0xN=5yRMJcGK>Q5Bg(A6SC- z)a8Eovlc8 z1v)4?u+ZwVf%(rBo(w&s`jK2lVBcU9WJj+-E_M=-C zi67=(a*J`?`Y}o=F?H628*%TNzXgBZ=>+ft56*tNc3z&JI`F~)V41Ctu1mL!3i6(- z)}z+YTVbC7cMPZA?4d)Dlo*>rX*<|wGn4>mN3IWmZ-fQgckm#45I+9une*Sy{a4TC z&z`V9+-$@CUq`o8Ym7{^Dlt64Q%5{UMQ#~$=}b_i^@pWrBYf6aLpMPd2T@-Oqv5NDr3D>-p|;gs*|%Xh z3FF4ZQFK+W3q&~QzuzWN3As)*Z1hL$^c?VfRS0b=6M<0B8wR}1 z>OnfetPbeaAFD4C@KIhzEe+s6Kcn|&l?enl9!NBm@>g9-7}XZT+0y!?%{q?NR9*gf zbzT8ixAet+)4ID&z1b+238n=L9DM>WBkVH6a0CEe)1LvrC6}I+yM+(s%X~v2jh8T{ z1sZ>j(Mod(CMzDv<*lz?ew73rM2pET?N{II<)s$G#8W+CT9-r4V`9 znP!tRjs< zZohrF)0tcG6N84 zFVY`r1JgwJAK&JUE4)CJIoZ4Xbo^dVKQr(eX331>T*WJb(K1 z`N@;nldq52fBqLF3p>{AmXs>iEDoQK`Ru>)>a2g^(RIQ)4RW2dW6doHVFY6aW!gLf zp6wW+dsgr*O;%E^`_ajh6a4S9nIvY$?tz)Raaq@J+jz<5K}%fWxSdR7pobaWIhLFG z$iv8w>5e@mj|CUmC|OD?%_o8-KIr-q#u+}^PTg{8`k#QSxG z)njHW!w6e>6|^pzZnN3(Z!`Kf9GYoD!ApM^GVx%t*);+P@L2KC=fXTs`@%t`_=qKL z13DNH<`;(2ueiSq82u@@UjwOvJf3VY;FOYxL~>|X3c$$0f!XK>58<{@y!Vl`Jh;Vt zD3A&?f9{Zqd??bMqW?_DYJm4Fs#h9Gh(S=~ZD@`9toGjSCKLLOI}W*FO!MWJ0GWTa zbmSP@yXVhqyuy@3e33hRuQ&$^9S{2nnPz)oPRbzm=^e4q=0@2tn%*`*7Bn^iRp7$B zPVR^)5*d7}BZWOHRrV&(HR->Sw#5u!%J~ZY6QS@*_8I-er3juBos;81y;ejBg&XtY zN17>DWwb4PPbn(-oq{Y2jfV?2c3XeIfAa#L3;X%7$~2pf+ijs5oe`)S#yMO?b7A=F z3WCL_NhMYQVT|Y1&v}vY8<>e)K{OXIyW$zkkw0hxF;yY_Wu>(x6I}}B3q0n8Iqiw3 z^#`&;BuecOLczmWhU5c+_UxFR@zGELzs%h~A7Gs4bNatIjo|qKM_`@bg^_>nxtag` ze-wvQ@C%H@or!?sIom7G|L5uH-~Wz{{^K9)?=K!cd??;FGy)!(B$;|!vopXhX-FkM<2CVVtNEo-b%#uv>@C|xMY$-m7Pg88vy7oXoLP$ zPcQ<$ZGS?p{RLz%6AXc#}=>w&OuBJdYI3km2kFkZ-eP)>?8G@nl%H!8o~We~+p4R6y|7rTIxm$x4`0a}-QuDXa#8 zE`fx$(#0G~gI7?JF;;;LiDAwYB(k=`LU`A*Mo5a0x|uBZF2OFeeh+`~;TNH4;h#S{ zNh+S-+v%up2l=GgWwMZTxCliAVUAMrRa5`vJUFN_`XZ5v!MCMn`S{tF9~0Etz4R_0 zpgZ$tSI#RK`VhE0K_XB3jGo~#=W|OBf;sjLj|t72w8{ZWyB2mEyAK#kKw&`kCt{i^ z{qU?@m5ec+K4XXW^!R_|*`afC`uy?J=T9Hc9zRCgZ*}GPwY%y6%KrN;lAQ*OvuqI- z8L%3#c+=c)xe2x^TOe8o5V+wViYI$3R5~D8{FaaZb#(~tLcw3SsESI8?}t!^=^u!G z%T62O&H=m|R59Q;)HG)(bzHGNP>t4hK*gy;Bi9~^I%5#1g)x7?^(Md_!+r!Ur08n5 z7bT@HrOaGcy4gSGSYR$3(W=CN2L4nEr`NlgIae*YY6I`|&{=tudD0J8Vc|xsGdFIY zNB-cVBp-8U*u|`pms_8)`KwiBh6d*7Y?wyQ^rOZOk*$j7F0e%RHmu%mBb)AI(U;VO z#5d|_TQw)1&NhF6AC{YrK6yntu&pddv3NRoH7GBQj2C0~4Zh!INcB2MXxLO+=}@;& zDxt8Q?~()n%g?c;M&G>P(S7$8L3Y)#mTxh!lhJ@%8mF{SI(jvH(7~&<(@=SNA~}`M zo1b_$L3SjMT#Mt|f>r(N#}DxfEQ&8yz(k`6?G1Fq>05uxdF?s7@5v-pSq?(K!TR{8 z5s$p;a*~&fZk~W!cu_Km*J&VQMFgy5~DVq(nFf4`B*9&xj$;D zlm?+%p1OZttws5>MU%9~j0>lFo7LJINIyz@Zp?HOR3cg$RX&by+0#zJ6o;U-aXgvh zkFC1zt3A}e_w{l^`@f>LU-0D$?_P9Wp3ADC*#xbM4afZmikV0(Wsq4{RvO<+r|_Xd zpJE?e7{QyRQUt56$*jsRAf`{l?Mca80Ol98ZvcPb<*}(!AwzDWRdpbPWE5>XNyc~2 zR#_XDspeAOK&9zwmOI9G>uH@b{%gTYV6HfxUNtd!@7#~#LFim3(5+CXaL%GTcT3ih zB5^)ct>+&eG$o|!Ynv)k8@f>BEq5XC5K;v%N`70wHbLLXmIGmSS z&kz!ZzmM!4(cJSK5a7BAsl%g}jr6Azj1!K&?<8f>k`)N@X7=Y5!&c2=xcHtS1dl0p zOuZ%D=rO_GXmrrn82jHAjp>?lQ?w6oryYL*O^(_R2r)9vhG=POpB$vQSWN<^T&=F* z?X+Il=s=ts^=}xd8Rj<*q__bU5EpWA9WMzDko>_nVT>6QFn{-|Ov>Exu}Ksg6eLFY zHRsG(+;U>iNJ}%jUA-EdU6qk8)jb+=07^i$za~rt{+!-JTRoSkF&G$#FF=*&vTnfw zw9Ep3#eHoQK~QxxEtF9b&~b7}44KS9;c@6%2pkmiWKQ_EE9>>^D3n|df7<%5~JFSKEl<|t{0&&BC zg^TFN=n1}YA*+2uN5@}B$}^%vkz}LVBh@}`z9crFvYOj~Y<>AC-d`sHGFMS_OGL&P zxKQr|!es*&m9gn`PG345-Fi)_E%KHtE~5cAX04b^|092G{7R~_7hQ9|4qm(FkP;l`ZbORx`c zqM%!-1M*|eO3Yb_QG&uZNNQ)>Nav0X3(U=~mRq1M2V1Wg+oH_34g{n%8KwAt6^e{x zm!Tg81Fb?4qgLOiGNY#F zG@>DOjCIpX%|qci79B%+lz`+u)HW1rCA|fmul^X@0|*bPKU@f=S(&^Ys>NmG zDQ0rrgmGEadCCdCfwKJtzT`_L(c=65$?@@+{oUQ?Q{HQR!k+H8+mo(;eow}CY?n9X z8gfG{5;yaO1ZHrlKy((!(~U%;IsY=(GkW%jBLo55AwY42;I=!x=VBsPYXlu@TyrsR zFOAIZ@E_PQq!U|f3eKnb@qEFA+*g>8u|7mVJmIMtO&U6`YdH!0j~QPS9L zNeY)5`(V_}PcHI*N=Mnb8h2C*qIJfu2;OVsHRxO(=)s(X^{k6+iY%&616r&sGvuQ} z%2<1zOzweo9;9p2r}LjZR(PBmdH(Y1`(Xy>MI{(TAkOP%Si_V_E;Q1NM&7{K#-N$3 zdd;x5+KuUM?32KIG6h=nWNPhKC)+UB7q78~yjknP1$u)4zLA#QyfzHU0;uSGTt?DM zHx&^c&G$RXgqP>D1^Iv5fK=?hC)decju;LbH{P=Kr^u}^uCUTtn(pY^gGb;|vzGVV za~m}24aI?*b+iVb#Ux*wZ5EfrhQ264=uis(PlB!9x_rL_jD+nLy>d)vg=&c@m&FrRGe zF4C5!V@I|4A!!`Pj7z2LiZinnUHCH6m({5oG9Q>m;B+@KX0vw~uBt|Rmkg%W#&%V` ziVHQNb1>A&7)7CJtr{_!K7&(@;iCsM=j`+@1TDnKkgu1_ZwqHi6K)gSX6oq zv6tMCT5~8mPfBkM35&Qdk->A(&z`6=(pD>~89e(-surbp6BOoeS?Y13x-jC12oyU=p#0Rb+~FJw7*fI)l>8TPQZh`#iRoHEq<(vLIqb2C?zbaP zL3NzbTYP^R6kap+IDDG%Pa~aYu~pP050I#b2E%~fMh>Ilty{Uk$~|RF05xGx0$Z$| z`v0Y5m*^~WHzRu2z0V~Dn7M%ak8(!*&~aCAgbNKA3aBMAbJ({B|MQ`VH#$+udK&GL zu3RI8-UPukosMTonvXIsDy~~au*qApkaQeyC_aDhQ2JFyPL)kvVgz&ZgyGPXyL}5$ z18aEP_cK^R?jWnF*yj6c?fWx~A28om-&cL(T65czaDuQRfi{g@Y)fM{6n2GYLP{K+={d=(TnV!M8)Ad!IS zk($$7QFV2Bui*^Bv4lYlx)6=kR7($ zFu1EvlHN5hY1Mo0B3Y1Nu`UMtWS9UfVby)t{EzI}V(tOe215&qFbaPqFkOHzQuKc% z#bbW16q`e_9ke8InV>#X?~1<7>6^JnQ9W3xTUTlc2Glz>_cmxZIDqO02NtX#A%Ik( zWrSi>;GF>-lN;evK{{Wo=G4Skpby}f>#*TO%6^{1&&JzfT?3zLnX0i-YML>_qd0hO z)~K)r%&i%oFGO8g+t#w869WKQ5Y&IxaoCiOMaf+(I!Xk6(8lj;)|-)vE}aE2%XOu4 zxVy2U(Ph(2HQb4{ZBMtc@Po#9SKUOb*jq--T7KuIbWL|{PiazTB}Y$HwG*hL>bB|W zWaL!gt0qrgQz6Dt9JY&24RQ*dgFNsawua2jEbUW|1X5bAT7NO!U7bJOF6Mvy%N#f` zvEP1CG_Cc6Fk#f{-*8&(BF9=kFtI8wK})S90Jg*kARg8`28aACME34asX*Y4vp}*RvLc;wqZP@oZoQy51hhbsF*cE$#l>I#mn*x;H=lY+*H?`IPn^kLEj?-&jdbJb_TLJ356yt!M=a6t2{5*C^feW$dkG1NUlJhe-xd=9d#i+#x7SG0WNFFM|wu4 z5)iP3f$O%W)5iYXucc`2yp(I>$%>W+@pro>DIr-+HNf9YXUAy5gZmH!NnJ{n%cvz8 zxow9*{Mc~c#4bneQv&-RbQ{diomF@Xm=G!Cb|~^L zX@Z+xjFSOW?W=hW4k7zwSTLcK$;$a*9W7fLoRCI8%$Q&vZP8snXabO=ZYM<_JALGO zmIOpu6rH8FX_b#*8hMrkDHJ7X0S)5j6|oRWsq1E8R+NTjFkO1nn22y|bK!m0VTB3AW1HBY2AnT$?^XHEq(PIE9 zoa~x>6vQibXFbY-Wx!_K3m&;?_=vtU1$>hf!JPdvzdf0qK6&*2Jn}KJYkNe}+R+_5 z(??;Ymd=cWTs=+AGFFKyBW~)J979CcaI2FF->vM!o!Wo1+=5iVs&RmEOZy1t1*{rJ z9@k5{L1cba*KFf)CeN=I%Fa{2Bib3`7zi^tG-4X{cJaslalt+{8xc2Jn!7JC8I7Dk z8UqILtr=Z4DBN-iqHq%y!=`U6X7*lueJzZ?qt0Dr2`5+0oIB7NV*8FU6*u}2kuiok zl(F`d<)(idJST~1%(Q`bkaW>(qrCZk;ogt4r~^?GPR-C`f#EO=7)+VBUuxDkt3d(q zbR(2oUIAq9Y$*U*>nuflG?qVOcA)}?ih1*vH(My$!MPot@v)CTRZo6KcaiKdb}xM^|}jxbu)i9E^|*@Mp13ushxolY2^k- zRh2f$Mf4KF-T)Wa&AjzQ`H1v3g)3ZJ;z9Z}3IIEnrk#EhSjw1FSZI&m|Ni48yx2t9nZBa(SLMSav5yz+Le(%dXD$ZK+4 z^+PYn4ReWf>L>DzyUt=k^EP(@Z!mI9faLc#&kNZpropPMUHS7^(uK`OG%#Y@%Rc$u zAA9|&<|YiUt@o|P-p=}*<8&zjH;CEpgR_6fC1;45G~88hBEMP7OxvLG4J#R=g00*e zvvyNfa%{sJQ=*~q`8dj}0NdF_@NY?EXw&`w*g0AKYY{)oMcl&L7y{0g*==}>DeM2W zlAqs7=6rbuq;)Pp&0zHm8TWVRLfB4>jnlxkc_nbpT6tztx#E^)c(rPqXP9HnDx!bJ zFt5*UD0puB2UA~lMz~zYA@o@EWyYl*C>W?(MZd<>C_1DxX&OuW&P*Z~u9is@B&LMj zx|z}Queb3d$TN%*RhT;~q9e_cRpxH^gFN`q&l({)P;XGACsNEdD9}^ue@%*3H3COSO(s4X+DhY58X)#>9n##dO0*~BlH%)^McbySIv#*2uLS1iD_ z@-y(}p@znH@vJ=RqbZeMWTG z9*(-{KI5q!J|o)Q+tt98+r?hgGAqw)0?;JKx$Pmj01*fiaG_*@uio6is-=_}WXT-L zsig(yfb|Dw>Ob%AueZ6g2%>-F?%|Zrray)*ayHibVGkiQyeA@qG2P#C>NHD*eqP{Mg-0z*&(?-t%E!;T!UU%EZqlgfTS#l0`!aF-bQb(4Pv8t zodFioNHsLD8TourGHO#Xpz?g(VEtyQMErGRgboCf)my^ftgMMugcN^=u9Le@DNf_>e31tT7 zTsAp^48~~j?B=N(8(33~Q?|+0<0L+kJs6AuahC=deYMet{aVu@evguQzy4K~8B)AR zt!kZ-zkXETsy@U_5lDa6fEa%{i4I1wA%m^FymvQg6p-_E-K7{m4XRkw)6lf?(G5(j zT1w2J{IQkOon2+g{nm8SL~&zxj_;WAkTLF~>VOmwCz|5=P%tX+p#bvMo6sF5>zHksU0K6mFY2g0GBhm8489oJ}u^OTr^I$s>(RQf0R+w!*0Hp8Gr!@e&G#`xV-K1Gy>dQCXM497H*tu#B z`UZZiO{XCS4?lmAJ(<~>VHX2p-xNtL1zp$IuX@_c^Jq4nzTq}Uc&YLeJ=~_TLnm*s zyEW66G%yY~^XG&6rajkN|M973U>-4f+7u<^%Vje-+4Y#phUdB-HqaMmSJ#zn>eYtO z8V{C+siEHi_wOr z!tTRkBKv&TA<8z!li3?ZPOCc4f3qSiiBqm)&4BUBJH~8}wU#1sl(sCgy+( z>$p)#7LKuWJUOe8RNB_Sd=s{-G#~X_Z89mVQ;eFDZ~hvE3&3WYcZD3-;0l0c#C*e= zM;)~~`dWWzusr|Z!TYO2=f#_!ULQKI-@N+f(78Ojc>V4WusraugWJ%3IGfEL?u2kc z0@hs+uGR&iaPzI4Kg6yCwwY3Z1M=7Vr6MDwIzPE1;Esbzt$a9hzEx;Aq$ds1`a(kU zm(_&&b+=9+w**x=M6(_`4wBuzwThlopmM>aVrGBxE>l~Q7$jaO>Kq*ZS+KT4=j6|l zn$tg1UpSeM|4c&DqbSS^FnTm`|9GSGI)Z=Ssj93Bj0_y(GRz=~FJ^lo_5wx_;XdLV zljS~7oFsnOVa^DR1*mI|VvNXg2j9MZ^ZMP(*Dr_$IUV1eo&O+yl@kMa@9~x@R=cWm zW;lOb@_dZ9vap95m{{WxHUVmuDa{7&EoEVagT_yTf-#6`+}~dv{RKDzOdkCI(O=$Q zIYs8idDs$ukI85V_Q!NNg%SrA`J#x___W&Dp%?i)O76(70$$_MjEpNAC*sU5^)g{h zrHsH-I1w|uu(!%&1816%r{OdP#H0_MAY^}o%5ZdXaOZHbCdXmm7_;CAqNd%#!&KwQ zpE&>E>(-jeX94Hdo5nu@|{v;Hr7VJ7H7LwuX0uF}JxB z!~hi7@X>%0?AI>yW1qJ{xhW$TGd5I1ox+mvy0LIot6=cc7BT}Pb7NTiS2Nf?{;Ge@ zJ8^`ebCZ)_jy!!Q$EQymskt_D8qaEv;TGC@&vd`#9XoyyLlTxn;Gquyaf>nwi!BVn z3o@Mg53%F?3HR!|^DEk>VXjtkosEllq)y?bM|@ZqcMc37D56f2?o4jrI;qtss04@R+@sbDgL;y4V;13KSOy(=XQIqG9Ba?3Hg~YE*+tB4h#sdM4q-1>BP16XE z?=p-EAep;DiLqOAMIjBzNi-9OgyPABjfcjfQR@vy-I|FxHnIswBq-c}c#vSX1los2 zv=0vkWtAc8R-a!49T9&qKxA|$_xA`iSL>JkY?fH5rODIwCQo;0@^O2Uk9TPDNqdt| zc4+cxdy`LhXp)XIG|F~3JN!lBB^)xLzRj^{KW~G5IPe%Q`rn2B3Gg+c%I@$y+`MTz z8a0(*&#N?kyd@1I$>5dUXbJ?CQ(eWqHj`>dNH%bI)soPC9glx{dTTC)StllD_Ks`c z_7U%anSq-Nj<_5=@j9~Nnezstc)0rV{`C(I{O9N|P8r|C$sPWB@%lpi3ZM$18->5J z`w%`|zd8Tm<=eOLiC?dHVByoNCvSe>wFv7oWs)ZW>>;?K^91b2PMN}Va=gqUAY1@$ zK%r*dy?Or*o1q_SCr3|IrRUX?^Ea=Z+IL0rWt@aHwK>Eqle+*yz3R7C$pu0J0sFU^ z%LTCme|KkQdua0Rn^X_TLj5BP%N>(}A z9Q$Xqt(J7Ta6C74J@8N!07kZnp>&8%-u!r?l`DQ0cUwD|oK61LH_7`wbL)%^ ze||X(tj9$>^UMs2z|9TS^2tyDo5(NH&1r@3o!oPW;{wYZ+}w|i9mc9{Lm+z*ZpcJI zzdN8(2^2)aFl;sPP%ni?^w4<+e-t{=~^C?6O8Qe;DY~gk1$O zNGjH2-l1GgA4>UYtjc6m0(>j{J#w7MlzcxFd%=3?L? zJvd4L&u(1(w{&i>u)M9?-NbuI;tL(cw^|<$G!6C}TVH57e8y~ze^btj#nIGz``Y2T zOxy5bv`w-HaCNob@qg*;y_?yq8z$D@4LkQHeX`x0-Qd}?yw7*atTn8SwRX0Qia5vg zz6@%w*hZ^;GZP;+vWH zH5q0{uNltEsdt}Eeba$<=x-yLF!Z_ytWiNaOAb}Mj7kgrXE0ZvBZ3aq%^EzguoaRP z>kgt|zY}~ve_vvP3YB)MMt~Rj9K7CgBa)W8Oc>F11vxFnbVrG<@eYlQ8;=D8S*duk zS>&$bvGGvdl8On|jrIoVymbAl-u8cc*8lAV{kIqNU+@LJp(UV@a+Ym(SyFB6U6lSt z%^i>X-yVqnn?Df0-}zbi`GN{b0plj(QY*4xNbcZcKkNl zP*L8QvK4^tZXX}Nt*d#mZ)Z(U85CwJ?5$;@i5du}ldiUy<e@gutVWd=w&rK;W&%q$j1L&;nxl6{~|z}iw#u33{6HsN9& zmCoc9P4c+zZrEJ$4qUeB+{_#plz&;xg38p*@AJe?Y9}F{wm}~>^Rxh{v5({j~dS-%qAY_XU2LS(o^=q&nBjV&%`oM-}mj*jU%BdJd zaiwVR9El~UbODMM<*wjDfni#Q)u~3aF>OkXe=s``hmFcP5sSsv00ASIBOV7h9Pgn1#P4R z9r6IKQb){L&ox$?N%zSan3P6fe;KZj4|3N};$kcgjrX`^Y-2;@7*BT#i;Pm7=S?PI z>rBmNYrj^|=%$64`Qt)s=R+vvP;CKm@*fEm>8$KkXVi|Lxj8XYqDqoaAYQ9@}PQyOvS4fnv?qw~8L9*b-*O4o53jf;RIR%3I5rZQpl<)o160AAOx zld8Zf-$_D4Dbz3wBOW#^f2>~>OXKFE%MovHBW~%kN)o9#p`2ks0VZQFwit(>$E2Xf z3!wlZ5#pcw#)Q9OrB@c(6-rgGEQAhJvJvF~^FPNSml#piPCoLmK4Ln)k6fI@--sU| zPdF)QLZ>cEthAa!%I^ARE{Lc$UAYl$WujgX1tlX5S`JeV5MN;Ne@BYCH~E_&I3e9& z5)z(K@=%olkY#LDwNP<~%r=9pSMlDD6L==!A*wytysq22 zPP8nFEr@iVp)}>Pf5H}7H>e-ak0c#TSuZp577M6N@_5Mj=Eli;9aNr%R( zRgx9mHR=71Br07`^qrY#N4UB^;QpRfkSJda?=X)N9Fp2|f5gb*U#LujdglF`YOWW< z;nQxrje?x2CbDpMIr0!0&P+{{EO6_(Q?R69z*Ej9FS%3n;e*|g#76v0dS0hGO22V~aUd;4l%r*RJYxUHDDzU$mBM52(92kSH|;-Z^@ z{W$e$$^qvDDNXvNB(M&g3FJC2qiZ-TP(~_mOc#z2eOVTiL_Q>G~wAv10dZgPiqP;!k74d6%02JQ$gTn$=n3mUF6~JjMgF zz#&+6f9)@;>uYiD?n<*bDk`k(EiWD>#o)go-3>*TD5SG71ao*q>wO)-IR`pOAZS{Z z1LP|yC*ki(zectuh=XfwHo=$sv4)`w>m5guM;oC>khZmbfMV&yLi}<8AF=FNbYINC zM~Kbe=JB2A<^$B72XKvbK~P$C%iK9JI2<$LYhq@<7R}b%9(?}!Ei}z{#>B~29T74R?WeaG0 z^pSLV+U+osXwHbVpm2`H;?zVdK&_51ymPH(9$izyKTTh6^zOPJ!u<{3=-HG4?c*Z- zf1+%<%u(5C-gJw$=cRAs9Vt$qJn-R~@c5iiZxs15E^uE97zc_o4(bPe`D$)Hk^TiS`|lrKtiQhIEuU3ER$3qG8T$h>4XUqBV3YTOJI2{4CMS%*(l;MD1aC4q z>!?Jt)@<}Jz{vzDf2X)8s@l|4i}Wc(G0>5cds}{6D0bV+vKAbgh-TW?s=i$KxovTc zvd>|+Yvg=p8(*XBGm`-tWuKim&}jP{B!gemGs*BQpCI&DBf~Ib`%3aUM&rh}e_w;w z=~pigAQuQlFM~=?rW7$`aP$rG)s49Bi0gh%uC%Oc0xQDctDe-%UGq}xbLwAeb!i2o~CcYPy%gZqS5sK)znc?6_#bON=zU4?thQKSA<)b|T}1idHCWr9mOG@DXeD0*FZG)Ujih3i z1x+D}*PVbEsi*~$IO{5=Jdeu!p-ng0Dd07?@Ts+JmY^f9$}O+QoYJ0se-F<) zhcAZdTgM+AlYq;@f3+a|0Rqvl;x&6WyZC@~!fU*JHJr7@u3hK#wzbL|s#V5hTW$@$ z17>5f7J?*4cb_)8cy$Y9u9bPB6Or5dt`;GL`?`Ut6Fxo2a*OFhf-nHf3B-tjo#u~_ zjZ7b+*=_c8JYCR7=I%pxe}z?@i|yo2=Vl=9d3?skjU~O;4gY!zmv8o4F=Wf7~QnE0wA~gKX;( zL+^&+eVir6oY8ydk~mT>m|_Y+!Z=cr-}YGLKEKA7GTUwLTLl^P#|bul-HIKYFg0&v zTt zuykTRov~x)lpIYINvy|W%lK@ThB~WsM_`X-x1b^0oh}y1e+L?8)&ia~{i?7#M%&#x zdp5j$pfN{;8uolr+9*x$qHB^+7 z(ke`vK$$dxV3>^B3J0~E8s&}K4Ytpbb{sD4oPNmi`;a}{99Lk*G_=Z;FI6b?3eQ{-l!||!L#&Ideacqa9e~1#JdZZ}rfRE1r>rehoS#Es*;u92~MkS{J>@*gpbDTU#;tY$nXyG#G5X$7|XmBIk;$w7+j20qjIo(z5Mr@wM1`#)$?vNyIZCe{e z+;F;Q41R^EsiKRD!u9X^HF@NuY64)I7u zu@y}s58e*tb(v`u1k)UvD>#<|;)@Ew?c;$_8PUxf;iyjl?L^1ppY! zo3Zx%to53bto^vQKf%bO+K;+WZvn2?brt)n{DoDBxUuArRzRK!|BK%L1KlJR*PkJ2 ze_-5^>I#yqh;I0}-+6{Oh}>amQAgoo;=(u;I}h%J2bduY65Kt2vk)U)c&FEf_eh$h zhd)Po2160_#4C&*+C+f_4(6E>LyM?e}Unnx5t5Dq2}d{VLo(fih=CQWRy2ivh{AG zXiJ0UDNM3^j&COGW(hgS67j3{n0g(6K@!FA@ekd|{1@`u?j?ckw1|M0# zaVFfCL$5%I5fcExEk&leX50k104_ezn-)ABWL%z%{G0%T znZ@|TQB~5FM+rA^nF+vKMWFl`K8QJuS0BymT{x+9gPfIBGwp0WRPT^Pve>Yg;ZIQT zLa=s`VTKIMnabr1@F12+R#^+Ee-a_UW1JV9P<&(l`26F(rDohH>mm20t-ccpb6)vp>Bn@sCtolEOo8r9kLAmvI^P-BYTdo$sIf6SF2wMk}J z)#?T^V9}<=SZ(e@k6qre8vXKtegmA_HQq&i3D{ydb&h7`qKIM~v|q>| z8W*}*J2S5~(y=nL%;9{dDKI-BbWwHAjeOKKwuzajwOPXqS7M{BBjte73m)1oCQOtw z4*bU$)L>hOTX1AwW9Emje`tOEUSy}|ko^U`)zq=vxay2z;ae92>BRA8NN(A1%2cqa z_ko#64&*3^hsZlQyA-pU-B#QB66^!AZZecLrc+`I6$Nlev90u89&!wM#pRU_Ong-; z=N=Ps>a%bF%Ff{nNR}L6h^bVBVoFZlO&(ykJ4E5o;A5K9Gu#~aej2+S%IUpGZxD4D1GKx$-~X>jUR6LISbHe1b5v^M7kaFUD;Eo+%w?(p=7^!=r_JncZqjrhGg2}wb z5D|tM>~UD8n1sDQdx7_y@txdcJg87Qj?0uwr3Txy*)fkBp|Ku%y!oL|!!hxNT3d_C*D zcjOAFG}689TfI~c1hl7Trqcz?o{z~IL#D-23R`0SC{UJWJ!BNe7uWD1c%;eGp`#T|$lPGO+$U$YBgo z>4P0+$Jq&EA-K^v3R-^mfgq9c*GZG3VB=^78?vDGzzUh&r`|QXDPwlEJu1PI^eh~k zQ(?lheevnfMJrhS>f7A{~nF5E?vOh6)F0e_j=eVTKjEMkrC;T*Y6s5tkW|R&-gB5e7qZ z;2puEztIt2`KjR80cVp>*nob2LrP?`3snPTbbHZay#SG#lZg)fEU*>=J(xEEa#W-b z04X1*EcIm`MG~WftG#&_Y^78-2L7}&HPduViQWu__$I*{MkOgmBTT7!d`2p_ea_tnO$NLHS?WV{3jB#Qdzw9TIAEvO=vY}>s&-)8*CT(l z0j>RO=j#Hez**f?>8*6b$|L2@f3=0GSVdVInz|FaET})^HRc|>mpa@kMjF{Qjdr8E zrf%IeG0`VMe+=&dK?1wyB3Lft^6g(|svr&7=tp6k!2JO$S5iJ+`)mQYK+w}cCZD6Z zQ5ThTfeDfz-;nFi8cG6OyP(G!nGQsJZ*X~U?v?A%p;9OoY9HA^0-$x-fA)IU{OPzq z{(ik$h)evUrw)4uSOH9h$R8MHJok&oO*;f1YCmIY1}^btMyw(EVh>BZxDZ&GZ}HKpn~CBr|<<%8XrZ zgc48}rghEyqM;d>5Q1tyBOON)t0@x>CDGIQIC`t)1vE}y9js%rsQUPLn?^+(7!{Xr ztQ`-njRf`KaOuGf0>)VKMfu5L%6FnIj6?PfrX>0{B<8_pDuo*`e~Dr`DuXN(pUSVE zn^9GAlZaxyz~6mGk!nGOQ8CGm4A(7k24#%^%=GsPnYF2Qv3{K=0X*iYJ4O4hF{w_w z2^aQMRYYCjC+K1;F@KsF0ZbYdy2XGsg-~~2nrssf=pGURS=g$MMz=()V%<|9i^6lT z#e!S7FL{fMCckS`e+*!s%~? z#m>+f`qg1uw2)EB#u51T`vL@mmMLDD>!73UOD5J#qmtEKb*#s19-(ErJzOE@h(F>u zG-yLa+0o_k>1iG6RCuB{hN%ZAXO4Gx(fu3ebiPsU)l;$Fe*p+vv_ITL=prXrPd?t! zn2RdEi|-<7SOeQ7xXrdKQ&nyzCLQuUmFV=jrFb9th7nX{1~D8Iu!o)*Y39MoM|qbo zHnjKK88O_5K;Ow#QWfB8NC92oKb765QSNW!(0r>@jcrk?Bh=&&gMY_z4QRf)O#8w+ zlm0GWa89Bxf5`uJ6Fk7g{`l-4a7hrqA9!zzHI_sC=a0|G^&mC9=Q5?^59a zD;+zbfEO|h9$aaFdd-ekdmx19H^VCneje;|A83Vnzko(xbb60YRw}l6oaGSSlSFq> zQgBIVIYgb%j#RMfgN33YzOxeeMgRF!cO7gSGrYndA6Qg8sO4B+p8 z3RxPge{R$4K8eCLCTQm&@6il}(YCzVZ{4t{5uL5O>F7iWWvu6UCzEzF8(a%D_S+40 z7dj(ix}KRnI-2w6K+u(0HjVB1SVV#;WDgQriait&L2@5FfU~OioHi`n24nT!QuMA> z4c~#tS2BCDe2gIGQ&}#Xx}P{=g;Io}=Q3)De~H)A`wOYHx;>z>cEEvHrx6Mp7G+*x zDT~6&c91zeaGKLi4nbnD_b>ATjT|Yhh{@q6{aAyP^O$UejSiZrYnYnZHbP;=~kcDOqc$|VF5$x6yB5sKx zP2`2A)vpQ2tqYN(1M;gk=kLxByjK_XA8*dzU;eq%<83q*LOUgG|0PFGEU9PO3Xae3 zDc5Gz5{MYk3ZvM&Qikc*PF1)$5(MNjf0E<#_rxFLl{Uz;5IUF=oj`R4PU3x{cxcS7 zxLb+Q`2Fz-?;$pLA|jRV!wKWS;57gCK2sXvh9Kp6M(KjlVz>RKr zraPEjS4hGcUm}aeZV!7 zmOQ)PI{V%mdo#JwGn*(0pbn{Te^w85Ah=4( zc$-9@gcjik+j!!fuU7s}OU??qZx_L6N|P#`ykO;O>)WQsF}n6W`;B(I`FTR8B(MAx z+`}jICC6V3To^qk=vL^WyxLapXcZ-|?H{t1$)cyU#KNuE$sne`F*A8IQj~$ z%L}K8hd%r2vkMk}#E8>ve^u5FSdB-zs9fM@cjGJr&#H0|I(@eXZ!jViX%+t$WfeH* z7vLE0Pt&HFuyEM^?Q-j6A{izR$GR&_^n0|;V9?cf8{}miB#Z2JR|rv_PXHmLM6rlI zZNblOa`(QHgjU_b-ygzli(UF}Vl&64C4_CYEUG2mfYT`10m2sCf4B2=3Is?IDRjka zu|=T_%9QQ0iPt$M{KCpeKKs?|9*_dcq1|cmQLe?1{a!^($;P`I@&Ce*JS=VwCED{= zl3ClAeCdK!mZmdXaJTlwuZ~uF7^Qq_RIJ(r3_m+pm!bVSvb+-E*jp2v@*@vTs)>4K z!e0h##LdL+2UtZNf9+uKgriE3i@83~{5G2JQC$K2HpM-#p~i$@*Gpu`zjd}(hI0s> zmKrb^f_y)tjB((m0=fLN935f;4|Q(rXH7IfJ%$dXYYg)5V2Wh+Y5*PUE` zkzJP)rU|+|f7Mj=lW0;i?}m!gyDSlu203NAmHOx%J48c|`x|g%hhJ|5NoJv)*ea0P*=pX)NL=jZ-m$;XNSlM|S-fWTjok97;^S&twKP8a zS68Fz0(l!ifXx>2VbCFlQ;|XG6l|QOhm_wB6H?Z^e^rpXF}jusRggV{sp5tJ{qe=~ z=l{d|9fAKSVRgchsk6%9Hfj`=fi&>J3O&tu=XB!&R4s3#JSrYTne^VJZM|2h{SR5i zwPWt0#^{vNzs9sIIeYp7$=>&Z)uK3j-X0pOfHy9C~(_zK=9dE+Y8RmTIybejJMC7sgLY=Z+Hj(N_8M z70Zt{$KSV%LCV0hc< zyS^B(X>V>HS@rxbUIM0w3I@b&&UHD{{zQDi) z7N0k9T7P{a+f+=C{d$Sk6=wRtp6rGg^XjA!&Wf=-)XD=_Tj=!7iwHE81)vsBSTNL$ zWq$@4qqN9Ax>5f8m`_^CBoKN*(HDt5pRGg{p$f?|cyQ4yC~ao{pzH9`mv)9y-SQ!N^Y$+d6S# z^@DB?y84sLvnt*T$U(EtFb6M~saK`q-hX~4psum1B!(i{X8l&MtdI5jf}%e#e&>Ds zQmoCF@b$$*tLRr7<%Ot>JH(u-H`x&Q&C2{27`NyA65UPBQWW%+;$%Z7@|Xw8cQ zRbv^`F5Sbi^fA2l4ug-7WL4>sHb!H!f~uq$K}1ut8zI$;7AH9{?ip3W)k~y> z*@|F}hJMw>8|K`&2pSp95_IJjc7H{iW)CrJld8aB>`&gLA1r#cG`S9^eBxj`t_QUR z5=BT|%i>^uqcvA53YG@i#A#KU`W0I5V4Fe|>2&}axA<8oB`$9h{W!m2tmei2o5w}_ zq7Uzj`4D%^t&o_?PT4dqp_fxDF=xJ6ym%aX)c7Zm^hi_mVi%g`SvMD7Kz}Rmx(`M| z7t6DZf@E4+xLdLz5^}cLh8(NRI3+QfV$`f(YVdI3p(_oCo&e~!gq4!vC4dWscBNI+ zt9};v)+9?G?-h|!{diP@d#WH=SRMyXnrMd>)iafoG^nn)HXKYHcf~2=v24*O4{>LW zPHhQJp#lPLje-j)!JI;x5r0o6iY@CEMT?}a?eoaJtBzkGM=BO4t>&g{WTfUF8b12V9H&cok!6dfHs!FI5WKdALVmSo$!VqKjK*-9X z$`I->Q6Fh@D*||T`R~vj((HN#WuDc$%6X1cN`s=NS#fd3Gphh_XbFj<<4^F*e`2c-Bf7dvKDdvZi9tKoWo`!TQN9saS|^4m zqx@RC1C4|;nB96F=YON}=J_s<^X8)}90cQxkhvwX=)j|Lij2QIq?1u?0}P|r2c?gI zKRW}?6<}i&8p%^(UwcuW;{!FisStv8C0l`k+U<&c;>s zK-wNmZ)MU^Y=YEvHjGVIG~vXhMB&dt;GYEfeN2goUtOLEjelnqKq0hIJT&_mk~^e}zvka-l^47RJrgrj7UpvZBu zY3ly*8P}Nj@!2kw8+0_=*kr4%OW?hP5@3bi4q#KDkuuVTwRV67ZY?sK#-X?wv&k5W zP(V6!WJ<=T=YNt%EnU{55W8FqOx88;a_d}ez-iBE;^D$1@GoX})$@x2c77!ISxXnCE`_z*{c_(oai zK*DSj@V1Zfyxu_e7p#Qyk-q)-qonj>hp(;cUf}eU9)E0kSe-D=@!|VHPM(^kD~<4i zd<_H5^^k5J=HlIlF2qFXU7TkraE1_yc?_V7ey*as9ae#lizYGO3w=$x}q|Uob z@84UQz3=(0zQX(ufT-d{bzos!Y?I)jKDNqiD}{*kT{ZkFe~Eab z;VHlp=H}t8MccM4i?y*2H?}yuF)cDZ5Ir{@;-A=uzmv;G{p=kLZiCZn7FWX|y18B> z?0XruD~E%=)19R?@Yj|<2QYT0JG9Nstv56H9DmY*W>Gqev;L$H^(L@*n6*tjizqLm z0#7pUG7|qUda@}^aZm>p;Bm5zsm?2&W87x%;^?h~u@f@O@A7WEGesR64rrRP(~6rQ zukD&TNmXIrb-HTBv)Fp)ov>WOS^l4?20w<6-jCJRDr)^j9-BZxIVb6t}nm?h<@ zxPQ4JAsRQCZCAqLzGcX+ODgFlt!N{dYw_LCGBh|`MvPM1o2?;_K#)Fo9pxUWZZZI} zrXHeY=Ad4K1JtAPCWep)aX~%uEGs+7g`UG)cpdH}A=zmnW%`QR6LdwF6mY3km8;93 zxFy@PV1A6&;8x1}B9H2uaqB>UnupY}xPOVaAQJ+Nql4iyB%H7!Y5*Koc1Jk<^aS;r z42wX4GYH}7s=Ng;0b+piN`fAN=@){bBm@DgD(XlS2}!$C$lMgcvct3#J89$F0Eo); zwLnWXSpAzn7uAxq0&#)C(e)>9v~fh)Ro+?_YA>)JxEP6t8c@%wJsTD8;QeVfD*ER)AfqPVv&I9tw%p zC^oGvJWL8dgi7Dmz*`Fj!K&tQW`B`oQ?N8&5qQF+#N@hZ<` z5D6^6O?EHHSy$qU1d@bF5d<*v2?}At#RVa&a>!j;++>y51R$d$E+Es=VOQ5!ArNM{ za>?0TFLE!vTohI8K(!?Tea-VKmFu0Q5wEqk7eIl=>zGfW27UV-#Q#(YdVg$bKT7e% z0gB|(l?xe@Rcp9d)$5I_Q-g^c4#M&rX$*_bNrEhahKk#_)dGQ%!=JaQ3bYTs1dIEP z*m14QnlL=-VKunNV4=7e;GMj5WE~3%@p?>^Qc+BbBQmQB$s7=U+&IRYTt&I2x`)!H zJqKrHpE`N|`8|w{g-Q-;2G$c@P*tY1pOqQ~PD?wB_vS&V)kG#Ag{eM4yv|TlgH_g>* zxIi_|3T?<;rX9Of=Fb$`Mu9$w1MQ$tHf7P~080Kd850a5e@I0?8>!6UnNzP1>m{@*dv6xv(w9^&*)rJ+PrlSOcn>}K(0PgC z4Q5{b;(jNVY}tyj%<|(?yEC^+b(W{zq@Lz}ZXOlnKL(eYEPqmSZ4==L--^a=oQr~z z-;o|eUf%91FiqO#OerP1=MzSiif~~ z@(^4k(=vHDM1OYJdvo!AUr<_<4R5H;_8P)OZUia&2M+8?R}aGHi(7s~&X2psSgyukkew$Gz|4kg_P$HA%ZKLp%i~z#T z;J#)Obi4`@pJ4f}o8ql`w*O+(7x&J@4{ab7SE94w2!C5xQZ7Nyvs*d|b(=~>kmH`Y zgr(Tc$z@Y3IB@BUeCGo6FU*}$^ijlzZOCfS zIWk1(Pk$fZ7ONk?e?zL|P{+SfwmEoxg)9Vl@5B~6e`w$=lXtzD6n7`tVOqqGlNt5N)%ZI-d+G*MeuZ9zfS z-g$30gFUDTNeF&oct{9Vj_zPf=b%JX>1~?br)J0l{W`oSr6XiPyQEQV_MG*=OYPfu zH23kj$7PV~YEz`ik8i3!XZJK@1c0`QIDd^xbOT&?=UGw2@Hmf-DCB%7gBA}|K;Z#Q z3S2p&v<{HeB5!4nM#?#i>j5HcD;9@gj(%~$CRX{MbtK!nuNx8A*v=OE8%#NJdhP{; zhSf!OvJ?M3J-_=JhAIC1RyAr7@!}6J7ta?j7cZdc%jeHueE0n1)$hMMdiDC`yMNz* z^VPTCeb>kjj)_hdaYOjV+W`W>5wC^y<;xaGXlJz-E`&-VSpBI7o+Dbjku!n_R*oVg^+Zk3jy&B?!hd-(Fji^CT$ z{`K&yZx`wPg1;@qZdi2821qrh=zp~9>uANA+4e9I1SK+DZ!fxfbE2h+#gPDfve1B! z9HtgYf@PE#b?Bf6bpM|(P%8c?6sK&l4D!V~O9HXIvs`TPXD}f@K5P7>g}*^Z8LTK{ zECD7so60aF!CT<@975`&Rkl?De)Zk-rYyJLefj0KS_%!QsIIT$PlT!!+J8Shu~C_X zJ`CK?>;pGnLr^#SvoGZs$fZe5E3p8rzsEM)R@!m3wm!y*+v2YkdTAU$+0IV&wa7MA zZa!UXgK*EZxKtVTwuc5Z(zstfhrj}QEuge6`#l)Bx9#{kLAb@%9xaP3fkb1vXL$4} zT2*u<>!wpQuto5`UIcU&kbjC{f2nRLN}U*mLJm45wA@7T~GxX)rUat$IHMy@!$`8T1FnB!)f z;zk@Zz98v3UW+efUPZbhcS#MqX8Z1Pi!lhB3>@D_r*Y&nNK2tz=YQjXPDD$1{}GG^ zLpCx1tB6R#1%*xs`Ww4Drt1NN!6z@I^(+Ku~h zQo*fK$j7%gKO0W_RDb0+Tx@QBcCbqgfg|R&g@>#?1PW3o5F>PDziPrW7n#u4Ff3H@iaJ9PdN^6O7f=wKQn zuCaKAqv)(LquiK;7!6+&x54Bg(|&Lrv%V`PqsHywiut$_=YPhA!Zr(oXYiBH`@t#G zioP40du&9nyem-O8&)j!MpB1lMX_^?%cu7$?l` z8#NM;`v!ub?%=~`-#T~45vL@FoTBOKLB$G3X%TI}whXivJr_h})}+o*AIQ^Yu=;#&^6^sDBQ2FV^fDIgn*R`aQ}=wt5x2 zO$eLd6FSfMH4ul9OM>KL+O3+vX$L({r$Bf15)sf+dVN5*n0m_8^9ipYM7AdNJBrd_ zs*R7o`x+!y&KXKGGPa1&c866w({n;%Tt3LvW=X0vA_L&Eet=V=Y?VM9XWq`}C}H^$ zmLoa!xPN6<*OC08{COci&xWrv$phgkBIjw|QtnW%ct}^sa;qQ*y{Iai{HJ815)-YM zI+|YuWcR|8QKg|KTS-LiQn7bXug)d4r1m5%h(bvuWnwe&Nq|*|JRJwTA|z1|ww*0Z69^!c^nRuLpUQy=6<3y2xj@!Er`F}nrF>84(FEBq*%E9OGW;eE%5yYg; zO9xs@(Xc~{o%_%>yq1KjGNR%tHEURNY&09w9Toio#6R(W4wMZavh98+W=60_81dhO zF!WbRR)xMy^xA5IU+7n?6hwamrEBr9Njep;w+xFOq!7NWzYJ$@sMYOg6QEVa?$Yqk zt$&j4BDDqCdU4Udj&~wK=$b;(t~#<@2b=gXSgyhsFTZL$hhx7*4B+5>f*Grm zgiX9=TfF+IzLp8akU+^qYof9?0Nq<~E_&@VQYLkS{CUesvxC^iBT@1kA9%=pa zXw7Ft6Knmufl(8E*s^iEKW@kpm7SWUooK1#36@UFA9j;#f-`ThNYFDK=An{M&)Tww zDEyvU3XwzR8aP(#n>vccMnij1H*nu=q84}0Bwi8fI+=0%g1WHxbL~gaak&Q2E`OKn zCUCA+*he>|G@VL00q>xhz)q(+%hy3FYrFOm58fD4NpE227y-bZPJbD!TX|gJr{B5f zS03`Zu2XCCi&&G2Fxn>B1Llvu$46guU&M61=xWFLzZYgXR@uwiStY%T5^*UMyEKeG zwTcFa->ltElqZ-R5i0GH`pElxwtqBpm#ZPg%Cpxb!N$?+-vs0iJ`f14^>WRlLYw*? za$Ecsuj6#ou_EHB9`mZ!r0lR(Y_=Rzj2j%*JT5|T`pD-xCNDwW{ho#9h&@#UU4&VE5I^&)#`>N^ctOYWyC7H(Mg?p4wZ(hIv`w*LX!*C zvw)DgU7!7BmL*Y;b~41fOSW@pYFdYv?(a`tJpV&O=oJg>XDeX^o|QNcp!$X}#3}hJR29b1;~Oc$2kmy?b$#5^aMKw8v47a++X)^WBigX` z#fP|Susq9Vzq2eyq7j23mmDM4qDcGr#AFpwf+c1;h*F=Pm?Xg_a3KX-a+??Hk5f5P z(~Ucve$>aQ;L)^yT_xS*YhR}#P)8(!_x5BZR#f#lFFkxvsoOa}>wcfAWOXjpf_wOM zYPK8Gi|S!D53n@b1b^XNXBPq+Jho2z%{yn%c@`b$eH#B%>9!D+1(wnR*Gh|$3iSv3 zlSaP=+CX;U!b`!uRpA1?z#cAc)$ET~-??jOpgPh9ZCeeTo%Qs2!fSn|#XxE}#Zi%^ zEpv+K;WTqsqKyMKC{>+9*z|$7gcq{KVzJ*rfs23mnbZqhr+?O2p}0Vkuq&FjA=!5I zuu6kz?Git^tPjqP1juvWC<=iAHnJo{2Qu#C#uUMN7Mx()vo;h4X}}i3IZ&?NUSzJQ(^-5b@&q%daP;*tmpsCH(}#rn7aNws7eWx{1&a%694q_tldy_qF)F7PN$>}0APS+b50r2{pKTTfy!GE<0TfeQ7 zY#Ai=Y&5?L9jolz78Hur^YaV$T?B5mM0-?D?k)kmoPQ1gLC`2({$iuh{|A;j5}Xb0 zMZ>FOE1r&}>n$cF7re&lMg%Y@n%k06l0*Lw=HDvCHftB$gH5Zro$hNrH#nv4<$2IB z^V1KFHXT;ihM0&_5OblnQJXaQVO&s)9%A|dAT^!+JLn|gs>$LG!tHF{>XVP{efT^L zusI+TGJk%z1FZ=lV3LOPxq=u4jp5YcTB0wb$+0?<%D>Th&FuOQEa>`O?RWr4{^cKM z@6P z8oBhm1ZW|Z=^&)J6f+}y=l$X3^XK}GB!~576n~U1o198#jqgh?u|>VKavw3JMxuv9 z+_;v7`ZTqdL>s;Dt)n!`RWW7#fp6Hm1AO(Pa=}M{#zF+5{(W5eXptwOk5Skr2Y=}f zZXwrlRK@tB4z~&}Bty>^^@Hr719gp#dN+)(RNH7c?okbtqrK|;4lBp~FTzrLR<_N) z34aZJ&Wf8oS<6P~RF4WSI5+_&Q5-?0T z^r|#2J(=6A89p8^uJd3G^!hHz&rtaTsQRo*bUamE$e>TJ!Y1FBaRWAekLV{5Z%RRE zJ5*wBkS z_2EIg03OPoBj2b3<_Zl??1)Mt37r(-Z$xD2gYMU)^;UTV$)2fU&{*{&Z1wi9a(~@< z-edZ;nRDbI>Erl5>&Y^Ex!2@-j?7jU8vGUXC^? zq3ClG{0WpmZ+AkB41rp7&cZPKtAF38INpn!1CEOeB;_sW{Ob;|3$4l<)))&`kXufS ze@%HMVTzekn$t(!7h#0bbXFP)Jcl#(uYwy^ZChy(5T(-zsM5x86+IT?-eo%tJ%|8<9Bg+{xL>~qkIurJ(v#^5BZwH~M8<05jm-E$ zO^&FRrZ$Ei0^?$f&tkty`G4L=K=f$~_p%;@{Bcf%avE_}4!mVmw&vekJ{1(gEr* zB}jX*+62tGT7ARYX}u8WXh3&t1myRx>PcMO;v*d1=U^d6*MIS?I2xhiFTEXd9y|z8 ziPsgBJSW%E<40NR>?N?LoHI+5^RjAWZZ+ z?YU2-LD#2<-0d~ZP*J1QR1B?qq|$I*G*v2r-VWpp<-u;ANz!FxoLeC>8Qr344H0j_ zT%+3i;zrz+4u9{(bmoWu2?P2sx=egH6btr6|AMP{-usO&f!W40bK>B}9vT;hP3Dw^ zg-6(Pcm?L-)g!aGdA3?r+n88F)y&zQH!yXpL+RrovOpAJ@{pNmqvRwr5l1d<0cIu= zV5Q&h&O{cjR2n;;Nu6)E4@#h^fwy(6Dp$#WQWSG#jxG>V%clz1yU%dR* z&fG$Mdw-2B16(P)zSwx+FO0fvUhp$cbLM}yc(L(w&em##r}LY`Ows9*sBdhD`sRs= zdhw0TOg%MKTxYy62~jr4C!t~!d>Wn?Hb6fOG4K*NzEsfcY1aw~8>Q(9$qD0ef}qXQ zkra>76F(g>|N4#eIE6IogJf<0^_wRn>kkfO{eR&J$@;_M4-SO=!T-Y(lIB9#laYmq z?1MbS((M!kGDurdhN9(@k+%-2b<{dnut@Wh(GUh}Dq`dnVX#ynGs}ly%Qlk`Y=!d6s(A3A4o=(1C4Yq`j(?`E zI22mKFjQz_S4xq}Nn6_YE=l6mHK@A-p}8bYyG(R184bW@k?tNaRu!qc-iXiNTf3x) zrf;&qWIVC*p%X^{94twmw1L6zPQa)Zwg>e(%_2W$#ceCX;4%0nPQpA&DPxY2)sMgV z&V-u4iM~GYW7L0W)+)7JYZaMjyMN>)GWCc?D~oZLDhEZEG)QRcZAb10&}_lq8~|hK zpOEUQ4bV&Ap)r+Mb0Iy+;MHXeHZnew^PhR&&C>d0ezF`tZJRNBm(x-u18A<$o&6qh$s+ zeb&G%4wW*6*gLIV+>eo1?w%2 z5%Nuw5D6fB5X595&VNL-#6AKk{E-BkWf*7^QIO(L{8ZTDT0u38=+ib49GusNiGL6u z`b)^*wuw?GR0&DKh@zwa0AQzQmsdw;$FKdX|9k!#ez<&n@wd}s{Og<3v%kDP@sEy= z-@QM(LShuaGFaE31YzHCm7G@(&p!OKBU2CLk`g;^WI!*!zJKYQz2YlB3}PYv*saSN z4#iwWzCeB}PW)hnFQ|G>ORfdX)7kO7|CKsLEm+XPu=Y`O{3sKUu^FxK1b6C{${T@~ z@aVK(y&{8Mr4^J@4x4O+PkIE`f8zu2@p}nK?Q%`VSZfaxjfJ++Z?>dRy z@zrLi6wL{_re6}%}aVXxq2~DQ(Q|7gylzy_2f^pnkD`{jvuM%++oM|`>Sd#|B5T*^~ z47_I(oPSQrHMZk$df-hPSqvr(!dmqX^V!lAr8eroC@W` z&I4*fn>HYT@mB_6X*vR954i4=G|J&HkM2P21DU$Q*Im;#dHUe$W=mGD0&Nh zd}x?h;9?U-U|%sU4MRqEu@B_Mi!g)hzS6D>(~d*8r`c7^Mv6GrHhP>Ky7R_p_uDzN zlp37l)4sgv{D2BDdC@BX9rq(lWC3w7s*aPo^E+gPCfD_vOYd)@lr(Rz9*GxhW2fpa zt$(7fG`|kne3a2(jx~|Mo@hm&;|ZcXd9`qIVuw|cMt{DY8}Xvj>J2vpi39EqN1Nd1 zEUkaKEb}PX6kb@d)X*0hA9m^XZY=Ai!o;usZ-@$q)I3+3hWUAo!AKf1GKOYyR0?7vo(~GcAWB5 zPxWyZ!+jpMGe-WZXg)aB3qF~UAiQ?=48tJyyaxLNKs{!l?*Zm4#9~nS+_b`T(JrLQ z?U-soNNqAXcTVVK;Nj5AsRv$>!QE7JPaz(Ab?e=Lmv|*4i-3%`R((dw8zB|fH-Fm- zGk;-ZTXUetjCa>j3Lw9pp^2ZZ(+{b($1-nxH@to7Y05$f5to^s#e!UTt_9w*P_rX` z;V8_yD`%iCzz7DQO$+!{4fB`*x-1wv6Mas!PuX2fb!Y5YuF9C~Jsk1gZJa)$U;9pD zgh6@7rk%>ylu&Mfh9gixL_RQZ7&Ci!20b6w4UTW3)$R8POL`bjBnagfiA0_?h&~7WLJ$FY z9l{T?Al7*jAzJ$(Dk)#0*3n%Ko|C(fCJv90$81M-(ZwW4X!L0naT%n?QJP_IUWqfk zER*OpWScD>k7`YKz=Vt_=YInA1ncb;pmhXAV;CusZC13EG`q8rGubmmVX}U6h!t;(iK2> z13JST)78nPzs!6QDUUf}KhQDrR5SLZduPJfc2naZX%#F~tDhU6G{++bqA63ja(!yx zE*82WIc+ga&XG6oID0k6o`HU77aAP#*3g~n?B6`V4Q~#^x`6Y9Hucx9F5S%O@?J^V z;jcYNr$+otA;w_M)qnJ7X$FDAe_Mh^a+f6)6nNKjCI{YGT;|!~GAJ;WC%H}@=ymJW zb+++JCx7m+!mz5YbJO1tHEa}&W1Em0zcFfJ?_bNXao@O(8$?2B#6mU~o3lQe1Yq$s z2ubUn|99J6sW2wroeZ20cRGxDfYZq219d57uX9-HWh9?FWPcK42U4*P)SD<>mp6{o zHpThrm+$l$tK&nxz0-H+m-||+0a-f_XB|E^1p75z9r%_lWC*kO!h2uH+^(A3CIFY0 zCu$dDY4Xr9&?|L?so!oU@kyXE_Vuk&;q9fhi;Y;Jm*0H*7vn77ug$!}OSa>%b+h~g zwycr=2`w9mcYj{xTc`;ExcAoEm-`1^J+W6 zng%8?i>aVYfxzm)GQ&%M7pJWRAAv%&2iyWgc<3vq$Y^{QL?8)>I2T%8oNCtBWt9un zg8g*$`FjN)UIhur%^d{_N94jH)A0y-ZB1E6`s?J4jDKcLv<7zqwy)7o6gJ8N= z&qwhf5%d(CW<2$Idq|`KRm%;Sl)6qj2vZs&*Igsz5DQyJ3kb!SMHO7Vd`eaD_@$kX zOLME&DUJmIWVNb{^y?lN4(lY2FR1)uSCNlhF`=T7)qKXL6xGyh*C1h z%hsEqM&Xh~;RG5BabzT50M`lBO8h7(Bi1j)8@i^l(x!!OVvNTKfrT=Mg@{}I&rzOr z5YBl0-3Ndab`AqL5G)DXAP&7SyH8;t?M0zOkbgE!c~gO)5`2r7(@>e<$*p^IAmUGK z7+R0Sl$JsfxrNj?d9;dzQif%1K*Xm}3CSu1ab=WWgJ)WcspC{e0>K&G`DVdT7IC^@ zL=&c5lBg+?C{REru%>pDut|wZhGx{AMwc0d)c>F7lxmdCHm8&nXI>s1NJOo1heKlQ z#(xYijodgBi0^0F>6vxR_@(ldbQ-}s992oq99038WpQob{bik zLKe2$adM$vL7XiBx5MPVstMNSbTaL&C`E&&ou^iR=Y8_I#hZfj@#KVTg2|p z;Zvqw8-UZ?Uqq1VzJRL*`inH^fZNhGDDVX_D{q<~r7I6O!>~tQ#5uH@-`Kj;pY4b< zVqj~Zd~{}|eNMtU@_@}kU-z_5qEO|;aMvsFnwI6Nx=OFqRX;=P_PznNV;$wa7=KSs zr0F}}fPq6sj?*pN3NdzE*oUg0rXjdBMfGxoQAz$_n#BgnRj05g!#=!qW6b0dxdg&( z^Y{)t;!e&kDXy6(p{1?$A!h&!$fM+x$x}mqdVcpcT(u!m!xIdctzxt*p=o;(HE|;q zQM~OZp;{*Ksx|zvrKWC^1}(?Qn15cwP7)NHo~ti=FdzFuzEx=`1+o1M5M|aAfE;5E z`+&T~UVMAFg!;Z|5wBCU`rsbwLye#o;7IAR@j40c_O_fx?7zIcN>lnchot@dSi+oqto)FgdSY zI+>i4dBXYxoToH7znKusm+HmiWxg+sJh1fDk#WfbKj}$OQ5$2`rQ5TguM%rMbn)d0lK-Lcl*#tFKH#VRItl3S_SY#hV)c9 zrj&^24F%*`Goj2jP7?3}awn-K<|Yb~^5&uDRh@xR`NBB0f#o6qe}B&8)VO$8_D;g@9ld#VglKA&fYxsJku?c1 zJdO9>9KYY!-KdYYDnbUcuY0e$m`tZzdL9W##SG*^{JyyYy7u+h%WxLm&%Xxzq>*P> zKVsrspUdup9+(q6Q+cnq9_p z9e;|#Lv;cKt$SL1M{DVR{`b(?zu?aPE_8r9MlL4Sk%9~E_6WFFS(Sw87iH5aSXcYr zU%ZhPRyBd>Wq$>0OlK*mg9)%DSVM(8`u$%9#_&E*{5RmU zgQl7d0YLSQQhEA}8X%zG zY?u9CLM!gjgr96Jzeajni#p4KcAI=VZ6{6QZZOE0La*TR)DBqHt4B1AJ_LLoRZlTv zJ((l(Hkl7Kq*XG$d~2~aC}99y{wYNUMVc{@LeIF#s^(U?s36upNGkF&m`I_+MR&x8 zvcr{Ddw<%YEu}fI3#f63Mi930%x3|!L#xb7lPpH=H_PVraOx$KA1t5tf_X+r=e}G* z6<5KGO*`a%TYUFk7QYt&rdTCLF1+*6K zbE;tN#I-UkZh~8>P;!zYelAICTS1*hP2RiUAb%rkgS5~;mcgM*+3H!?L7j^wFW*b;ADrF*B*ScOF~+gSQ4Kj|0phFr%yUhOv{V#py^nHsYm%8t){+P+|(i%S1-C~|l#28!U; z`hS?@=o3VfLK8%j)gp(MZ!$%{>7niT4@(_X`a{X`aC7)XF|4OjU@57>UkK^+T<7f= zEiBxi7jkDDoYV9`kP;MCKAP0l@NxT7R9-}@EDsBRN_r6vBUawTIl@9u^Ca z686{#)-a2LH75_jJ6fYh1+OAWMWhDsuR=FU};2Xwm3WkpMF+^t88oUB(hk9ZV?>)I6MlME-N4 z;MG#=cTFJ&Q_Qt*IKBQvS~*NmcX@>T8q9Xh9WuHvFasOOB-ZCJLJu(D5}j8}HGggi z^)G#HjB%c(t861A-4x-_=9tGECU0pf>bUE0CI3wwFe|scBdiMPv{utt=OA+8LE~2Q^c7NKMx?dDBc(p>1i(qf08>JcnRSs@%)FmPDAa{>9D=F!2ay;`=zEn2{Bx zo;{|P-?^1J^O{iTK+7yS$uTlBa(@rJoFCxWX6Blrk8K=pE-WJ>s?Hd6vxZJTl#iZo z5S-s=rh``w=a(3XUhrm@;na!_zfiF&4!RdZJ`u1PRC)Bvj8diwe~b~9l!sYXKX`Ih ztTR~eGP>6Nqm*z}Aflbd(asC5CpJ}C(WHNlgB;KlnZk=GE0$hRsi>B!hkwj4k8D@y z&!r&t5{OZH05F)46zqmBzaYjdo{5%M-2D4zF?v;a;J#&-pnfV+>cBeF-dy&nLkM8 z99QPn#797k_073^D0Fjv6@T5tX$Xo!QBIuxTC6?60=Ubl&P^{SFn^Gf&(j$f6x@nW z2|6b)yi@!N*&Ul=1Es+ieL}!$K)bQN#gXDBe7moEI=E?fJeVv8$`HEbSN-DK~JXFRa!f#;*R+gt*VmZW8|Barhj?TXYwEytf2jq zOT`vd!Wy;$-FB-!P4C!ece)iIu3KN%!55 zbA=i%POLaxrs*OfU(jmyzZbwy?b*=G>XRo#EkhmISH~OHs}WJj8N(%mm7>>5h`920 ziURQ>T6b_Xp{%K)8mWyZaY;P43Nr{jz|5ZT(wX030d}TxWq-cv$tF9FV~6R4#BqA= z@jhC$W4M!8+m}$Ba!+h#45)#BByqsJN6AdVdNhno=*N&NTRmQzNy&T0Q|Hnh9ocHA z^o8v!uf+km%j~Zn^b>I61GpuPz(-+_H>Z;>!Aa6P-*LhDh%LsVLaj#!<*wbaqUP|v zEsmYFV3hmdVSg6&t_Ihm;-MTquB(?*<;B&lhdGg9rOuA7Jcc0zOA=7}H;Mp_>Gz_Yc4+VP+%`&&^w<&%hV1*d^W#36E^(4}d;ODXHaWq5 zizdEG56;lLs=UhPnjj7)AEd@=j*zOIrl@wUtCc?VBY)^2&pg4o^AYvk#h<4y1jLPy z*LBaGoQqJlnoEPxiBx!tPa}vgB?S$##b-Xc2GssR^x-b!XYzDDAiNuhYIB!QlXqi5gwJ&wUteo;p)qaP-H2FNhLU%o)_H(HU>%ftpdoC zR{(+cSExj1WTNP(87f=)T1zX0?Av-FOA?<6fPZ^O7iasp3RFrkG>z=xQYDUEh-tLV z)p)G$U_Gg)EKviN-A%N~@`pO;W|ahWPR^58y{Wx5lCX<2Q2|VAepplxWd|=Da`NL) zFe$uXxy~c8gvQD+I3IfW8caV9?P*Ga^%@_SxNs+OS>ssrzBkjKHvD=PF<&tU^i(c;mN z-&2}{!^SwT*3|?WBP{NNEo}-4@8pVTjS(2{{CFu>8w-xiTJVhTEI>#KjN`t-rPnA0 z4NBW$NwzNRm{Z?G(97p2FP__7IDeB)0bACjngou#*+MMNjvR)p?9jdVxaBT`6daml zt6LTJsT77@q^ipl=47GW2s}Qja`CIqp_pD0nQ5H;sJH}5)9KZP;v|t(MU1sp(Tf%2 zs^n4@2Ow)ROiL-wfNu`z1Xj6St*Ksg$}&r$i8YZ+4Vsk+;8AGqW^zXcXn%?uuz!l* z!N~}IBku^<$u5k5Cp=gSlZoeidv~xJCMbzD6L0U%z;?d$yxjq>xJqoqCCx_U)P-*s z)N2>X6Go6TP6;3zq|{{>q$ekDwCpuDD8pnId_u@XIaFn=wjp@((Wy=2uq0qJ0|8F6 zOkJiZJhHNbRv;NG+cfxr^?-C?sf`*C$ZnQ4^^Ua~ z7?Wo|vY5l5yuAw=!G1l&Jh;9V8ckc{(cQ6d^eaJY22RH6xRae>CZsvxaq(`5=l--smm@%TP5~znr(2SDlkPVB@}CgJk~nwP=svsP-UB&6N7X=1v`nt zD{>fJW5!&#j0EYrf@#|m$JM?%uXZEV?I7!_DE&D{}k82E$GR92Y(_P#F>_)+KCvx+X~2m}PS^t^@}pKce=tCZ&~O4o5J?ifg^Y5&%2-x%Oht_BDq zNbVI5O=Esu+wtXs%A$XM^%P+R1Co63P%EUxGEU%Ww%_94J*5G{^H~V`n!(Ru?=(J3X{URyZS!~og1`3X@3sMQon72|&Gy}cTqAvcxLnj&eWc2d zGY9!UKInQ;^C-+f?ve_Q65%?^bA7mUrWvE1HZDNoOC$~>k^z4dRzniJK|bT^q!O&j z3j5F^_GuTRtAr;Hyv$7*48K?HHi(8Le|!iGbKyX={xaL7QjZ)q=^?QM(yjgKAP+9X znB_#hFGzA4fw*9PZX<|Oml0@ogkW_`&iktyab1p7yzNTpnx%|rz6R$&dVHXw%lHP= zD{d7~pMd%dbb)_Bfzfm0k}<5htjemH>$8vO#uJr0d06>8+%@o>b3)cc-iu=@yH`a; zc{t|xULyH3b=$$UJ1B?HgZfo$gsvis$P5kT8snlUN&H~l_x30f!ysVcv0Cpl09S3* zgOsvb%gWr~LY3t-&TST_ch%EeVLrQ8o) zYs7T$J0^DVRTrP*&E0NXwj<_@8&rWTN#r1kG}sn5SxLJz=ukG%b1H_QsdCaVB?iZF zHJw1)k)#}a$PSsy3U-#af)Wj;dn5ej-^8Vl%GH9JJ`x=l7+?)4U~NdDaBN>RpYX_9 z2m3ZWQk8$N5^KkL5l4d@R?Vv|?!#%0C~%O~2pn_=c!|(15{iDYDKkv3l43C$-g4b? z8B+C>na{`DmY{(%+*Ah}+sy=fg*>$(a}C~l$+_dNZRa}A*i?94p5d9!0Viq@i6R6>n zkKfd?KBkBMaIL2HntmUQ7CyG$a@I)so(&bmY zbl`s@v<~txiP&3R%xBB{lE6?D#ni%Le|mjo5Clvkc`8o3i0dO{?QljKWSqaBkBn_K znT(UyZ(d)$o{f_Bvw{mTe|~**V#O?d=x>aNF{cH2cX_oFayaQHAg{q+inTbt^4{Uh zdk|Lv8*r|rX+P3A#Xie3pjZWIDr{Ml>cF94Q13JL>E4!&v4{&pmH%>sk?1Fn zrYT%e>_Z(64hcf4aj?M%Yd|Mg^fZ&=mX$&o3sy4i1U+S>ZB&9)3CskkS!fZ|Q6ru< zdwk*EGVxr*7SBShUL4SJU?B?z2$d*yTjZ}leQMT!rJy6q8)7r-#Nt7n?j?%xKJ$MZ zo_b!GS1`&~C6G?8-YMv96oq{XdcSd?S6rYEKu=7>3FW zsn{Ar8}adW87XPw^iF>rW8A9X9T&rBlmy#?UORh6iEwcj)FYF1Is^HokeS0Q7=LIG zsIN)IwR0SXx-C^^7ezarCsbO%dBT5C>C3ZA_dGH(@MQbuykMdU=g5Slwv#hywMPXkNYNV1glCuHr>&UFW_2(G z@$UL912|W+GA-qSBBYTlmj^Fbznd;H;!+k-O#79FXvgg)_$({&fgK-NPb7c*U8zQP z)hOeD0`RdU6yvl|F6~(eF>2aAG*c3b?Fn|EZI;9Rw(x|6uNfj2ZvTSpVtOzS{-i-oeIG7_-s7^JoU#|StGg+fQ3rxfq5 z9VxAYi~ezdV^MF$*2>m^PgWoi1lprK#t(%{*Vp8{{5q8f9N#S&t8Jk;31-9*X_t+a684? z4Vz6A#$vq5gBc$$*^vS5yo2c=@UD}1eN*-!6O{UpopG5&yC5_Ni)F~59Ea5T^#yAY zF#`dTPwWtK>s=5k`^|syL6)+}_`wseG<;roM<4k>X<|A!_oSc)C!8~PNQUhgI%Fo@?YAS!BF^X-v&fk~qZwRGI z>^Dc^JbQe*4^ky}tab4RZv$Kf2c)-5M7x^|vg%}&k!F%;Q28ET$)=A%krZA?8JJ$j zs5#3nu*ohQH<1!#zsD!UZjqYAjI5EnnruiwCykj>%FQ7(5z=H?S!A0CmEl>0V_k;@ z&fjK&1UUT26#;(@LgI3S=_4DtZpDGUQ)=5rDHt^(6>nhT_Q(fEHY4@;I!&vU7S8q-) z|NQy{dp-wSlZvzlhZ*v2Lt>hj@hc?hvUE4;8p?#8gcatF$J)jPp$zTg)(TlGJMAc< zj&oLGa_3}VOM5;>P7dyi>mUayYsJulSFhuB&CpDjI9=i2&&r^<^5RUzZztb@-4HU)JOKH22ZCAJLE;$$6N zoH-(dZifyzL=`G6!@za0iIayZh-)B+HIS)faDji49qG`Z4BiNvTcTrEi(c(^U3)t& zX_LV|_@0}>7Kd;3hMeUNsld5g66FrXSw|S&zx+cigMa+)?CR+B?Dd8J_Vv}#$x7=|R28ft%HJH@NtHJc(Oq+2^1bXr!@Tegf zxBUiy)-$nxjd;H4M)G!N{nnf`;M>pmmEy5VGqewmU}EO~CZhQ!l*k#M(GSg({2hO) zQddd|nJmXrh99j~)uxhH=^$+88IP~EJokLGj_Mv~TIF4Pfa<~0GQsF8zTyUuRLvT?C9{{-GQ$C?o z(L!dt7wGVjr(n+kL@-PRbaf@6kpO?WLM|k7I^LVYkvKCW1fj7@wt0k!EX0Rz7hfNE zJFhH!brLB0R>N!>v+gw~h|@Nk%oX^H?l&IiZyWA2*l?}XYCG<@k+r4IllL6$XSi3+ zzx#}AJ&%6m$x-~`+p#lQ^>1797u%9WwSj2*88&5WyY#JZDN-6y_J*%oa0p)Y~2$TIv*=d$RTAI4=r2=6YXHb_bVfdmDU`J-Q7J zt%ZI_K2%9y4yk=vnVh_kn?jSwh;gKBMfamrvjd0G4$@9AbYy4NTH8NMU3r zDl?}gHFH2gv63LoMnF@;NyLvp=3j@Gl~egIez%CzrI2{xZ>#sKT)nI+`FcvA|McX$AD{jB?4N*|+X=NZkIIg= zm#>d6USHMiqZGXG0cwAlSJ8oIdTDUvhUub#<7jwieD(Y}Psg=5$8LOx)Awc7Bxvxh zYQX+S;>WZ~5{O#S;*CQDiH^lm~}3$kcPT1e|CA!l(SU3(b=W65#Z}OhXlf)1_*y}ssE{!ZtaHXnwVG( z4Yx-V7VQ{IU^Mv(oX`b|*5j`D>31C$6bW|99i?eOCFFMMl$=j`aH7l_QP`eM{O&TP zjR42f6XTL*?5?SB+c6Cd$jS)7G*UXXCDIvLW0DW zVInVmv#tjIyEhL-8g>8@zq*0p75xR4Szi+;4`t|y-n4TsB?A2wuHyx#Awla!cOD{t z)#X;+f1#8hIkUkKnA$U8#|$Sm1p-bA42I8yQffP;AE(;kwBDM``p@>HQ8iq(~I05Z-H!Rg|tB4 z+!-S~uUjJJ*8a|Dw|NE$N8k=-hq>-B!=TB5$__DQ_HoDg`qL^R4XA@(Bl*!;A{bzy z+ALG-CDDIfl=R}^Ry$$hd{@JWsF6LMbBZm(B*bhJmahm}z_(_OuPx%Lqc1!9)X`TR zeX@jDFIy)y%zU1-n%fe?{d{RHpOco=w$gKCBbz#qB)a=`cTO_=7?e$>X(nn;-?a*+ z+LIJ#*cYhsxu#M#Ri;Wsijk8(1$n52#F;~zVo-nhs#tMCt5R%;aqajO_dLdT=arc~ zV#PmCt0=U}FxT8Qr1vj_Po~vPTy}y_{>sQPI-tR%ap|4s@OaG?skZnJ)+Iq|P+F~p zw})|qua6+L9>sydvwa?{O6s$3I!g-BK7O$yICK+H6gJtZx=>ep%ic6p{RW&uRl6n$j|dEtX2fD zPI)d19!Spu@w=Rg){hn^rjY3hK1J1e0(!4qH^9L zDzJTHRSlkU(Ci4NYVgf7W);E3P=D+WAFM0?{Q@J-qjg-A`NO;;mQedfEWiH}Bj$g@ zZQcPh(7y5V=cgO4EHdh|)SqLts&Fa8G!zj7k19jCDkVNc8)bUTZJa?%t0jZj4BQT(PXx8HsFWs-@b34Z$1_Z9sA z?7fSY+%}RR`YSxT_Z~~Vr7TI7y4ya}y(>$yt!=%oO6uOZV;`ECWM#68NwWE0<1Hc7c z=Oa23+sMaMgACIQlihdj=(Hf*P|h5o4uXR4N7aqW!SihP?vu)n-{u}1pt;4JDC2S8 zkG$;qTtq62+u8mjjCUafWTbz0B?`1SZ(ShBSnpCSOyG494pLVS5y7qKUMd0lLop?7 zBXzzVhU-z?6}xFL-a51OIPa3xv{+pjt?TH)W(y=8Py9Du2lZbNj?$0kyca;l;xhN5 zvB%WU9=U6vZpQtW z&+r(B3u9qhuajfm$oKzD%Uc~bM_?Z_G`xcWw-CWlR*cJ%_*Mt5AhJ(@+`;Esk^VDr zrwW2*!N-JmT5q@BJB_d6A;e(!=2rZ9J*6L9q$<#OH!1ikLal$p16yWn7b- z$F*-DjGLEBb3&u<>Ue)>`;Lf8+!=?YLsMM%c6>Y3J2;~0DH;o>L z^Lgugqwpt)S50)`$)+eWsQ)t?i44H5UC+lO12Eu$Y!F?T^DIOI2nI};E@3v7uD6LD zv!b5E^J4kC?j}P}QEk&WPV(7k1`u4NAGuM@{$_6dw)f6}27> zbc4#XL?dxO#|M8j`5of!!c>REQIa~I-#QFVhxZJY^U&K|&jB5Lr$fM9G1Q@O)C$=F zD*_hg;ZXprqv+@mxoSDCXQvLw)uy#O(nXc_Q#mKN*`#lJ>rXNcThsFR(5Of04ugLKcQ)3HG|kV8%|UTS*0D2p z)}8{PI&}|-tiFv6&@%@>&zvZ7f%N#9ha&1SMog$}8>ka$1j#m3XGqU1{M5Cy z-J%fiT+V;PL^@M^m!(_$t4vEKs&jTz=$qR#v<)OBid_LKT^!dRUivQ+R~*SD(7x$A znbfpC50nRJP4+0AMuU;>o}l|qCdj-tyDx01n*n;+ZnLyLc!MAGGwBmaGpV&q!S4DP zHR5LSN-_m^l;uu$lwT^PgLO}<9PZ5R>9U84wkdzxrswVp>qI+k8x^d>rrBbZ%-RdE z)MxQ_971;6jB!heJbZzRZuJ_QeF)oWtFw#RG0Jbe084!qZWk4<<7TNXwmx{G>)-H7sTO*8 zh=PCA*mRL6$QV;wy8-Uoy1?aW*E3}2>*Bm|f+!lAY{uoJB}%{& zO$^JY%yqa5g&+eQl!;~GNt?lqe%`Kq+(Xz>OhAg*s+@C~@1AO{H zYHm6|4^`1LkP6HbytbngqI?F9+{R#2+~roTOKK7AcFo3t-=uaX#^4Qkb+OtFtlWRv zy5X(F4w{+4aY1a-fQCRdeJmI#&$%B4rH|=AALVwnIT9+h1$FcQKTeb&)CDAorlv!B z0Mm3(56jbCM%m=!8-P?=S>f4+t+aB0XB+gWoyojBs6jXZP+zEU8k&tjwV8?8wDQEk zDD7WJ9RStgk|T8T(SdC&_~(*G2M&K?$)f`YvE5sFr(03B@JQ7A3RtK`+AP0%%bL;8|*dH zgCGm07fH=#^N0ZE#wLYrd#jsI!$)ZjMuBPfh-9O*Fy14fWj-0pDq!Uf@v49PVs0W# zZDNOJB28^#x-F6=#jt0T7LJ@YDS$-E6{`d?kR)I@>>4wV3P5f=Dl*hqUb`B7gpU5K za?Dt7OEL(FC|$=eCVRZ zD6L4HG*IV`XZNV_f)3e0FtvY2eJCo(SB8eGuY>a_s}nheI*e9iP+u+IHcsJ0qV4Go zVw_lGx;YJl8z+03d95J=<7zO2A_-R1C@E(+e=MIIC;nBnp+(c|pzeqrV#GTY+J4aFaeRZ05x&Qi-b$6-ek zirg*{br$ORTY9Ys&!z0=vdirA;KIaiB4i?5aQ42Q+B#DK zd#3r+$IHzYa4yozENyN%+${7CH*+$4IhiHz-r@+(jQ>rB>gi*ujYcyI*+CdqT(q#A zHE~#`7LyI`65oHIuDU%!3nIDJ3gVh_8!{MPCcS)g(pc-hGu6-m`=q;#MyhEYX(roE zKy>rB)83~i{GjzauXLioQG96k*OdFG=FFJz=hPfmelHsu&q~b_n;bDs&2!7--G)o0 zaZyd~k7mi{0NmiIs8diToeszIM2?EKiSl(!)VPvs>C}IEhflT~IecprrP@ATS4T9} zZGRf8KBi!*of;`HCerNUuX{Wpk)jmzDvhFZ^66|}FkDTVCw0KXW`Z==JT0-0h@fxp zgy>tG;$T-Ck3|ku3mF3-^xExtUK2+=aS0g*G@3W!I8ae@FBwM$YHkvvC_GIYP2lXf zl{WrW!}fn_DC@*wYEk&7;_PNdrAmyV24894c&f(w4x~gy>1F~nCfnIQ6*;A0*Z1^< zJMlWH*4Ja;`gdOsj~%rhF|0&a-_?q?-@CMg0b~5UxMDoGSD(HOTVfI@?F$ZjRMT*B z%b1A_c=WDPGIAW!>k6B>|z7b2JEzNq9|BfIr2J zc5yT@yOSV4VVUq;AykDoUxa8-eoUg+abNWVruxS4KA!<*D>{p z!fl*?gIL&^1BE!+CdrqN6$5f-4;Fh{4u;7%Ubk>mt@7^Vi9*#1*$r%A%`&-I*`r5F zDKdYAKQ2WEb3Px!(W#c%3)XS6mYLG_C&2Pk!2Qu`QF0lAG}ynHqIku0j(~NEm`n`L ztKt~Ec=h4?jk$iGAbr{$RJ2&v9TY|`+(Ef-UKpqK#VVC3C3x0peJ(7>d|UF`#2g0i zjt&5W{n?$8qWi{u>ykj8g^sSE?x;SK_t<|7OyGCsa?2bno`;8-=yyn>tU0W?>;%!e z@b53dsFR`eZuQgC$v2D+{mgNw(M%fRH5BPy-CVqcW_$Cu2WFK^TQ-W z{A#k*DR9pQ!*_vgm<1hU@CBa18XVDztU(a1tbt;gPmFd2HMaA~34TGiNhJX*SG#{d zz_p{qO1Vrz#`axbMd#<~4%3f>?wem=CIw*`YJ@QZH;y`Gce@c%?cj_GL6wdt5MKml>##bcuhO-9Okh zLs6pYcmuz>27GWpc@k9<(BP8~L}jWOh#Ka3TI~ZI?JAM}XY za(!H{-|2Cs`TDp%zIyxo!-rQd^%yJgy=HgQkny+^T2zj;VjVzEsLnbSwAWZ&RnX(U z3fI1t)=BbpV7QwqH}eq*L-K#OfL}KN6n#CROu{vAMwo0R|9P)&nR0XuaQN2Jrsu zCFrDh8s)p*WW%-#UNeUGal>_$!Fm01I?{Mr(ig{L+63V5p6_lz;2nPlhapcff~`W{ zDs+5Vd|sB>jSX}JjeH@Gsm|?G=QF9!tyJ555(ZrJFR)ROR(4c|s|ETYpEHPL4fkg6 z571R8O`QS)6#4{EB9!4SK^U%E1>c{8*Qf76F11nFzJrhb5@==3xbEzh@6mYMA*jEy7CiRi=yE#BS?3 z_+MntHC2+Vb}R~j_5-m){Vy<0xTve@TpdLFMD@sj?K4&6X;ZAJX$>KAF%Dz#ctYVe z5n)Y!`(C+x^sgo5&h4K1JyA0Su-EWhj)$JmzkK6B|{BkS#f?Ck8*d|Y+i%zsGqMdtgM_=fR{o{I)cGr>_BrFkgBoUZ4y z@4;VeI84iDpAK<+64b0=((E>>9Uk%^v5R?B*FGq5 z(#U{(S!Askfzu1Q^Yln7hyiVYL{c;S_^`6dQ?G9-cS4_LfQlPa?%BVs{-`=1P zdZbV-+IxS?yj|7Shu|tn_XoxE7r%t`MFuXYEn!@PK)xB^16+V!Oblsg)faHfP%0eqN5$Fj0Yk5P4_ktFmX zgtvBfxZk+V33{F+J;D)K@zG5Hb{;Lr$Y~QWk=TD`j4cwTy}(q(#Z|5>dEUyhpB$*xM8=`LrlUVMD@sqZFI zD}K$imloV^`J+?9ote9wmWZRz_(fiWif@0jJWJ@<8&xqM0D;{mLUprwI|HcTTY}~4 z_G}BwIgmQh2cMAVvy5sJd?@NVMZFtFSa+Jv7u`&JaRPtfOnebUc^rI!O}|*6_yB3} ziUiRlDSs-b84H;BW+yK8~O#A^@>G5D7nVK%;1qB5py3MDt6#qCLsY2VJn7^bu+5c8du^! zASo)J;te~7k_>8OlBz%@dxn5$hr?Gr1P}PTm=&*-)S~aiD0U5d^O6hafoT(b!jz@6Q2H@K(%haGqcU zeYa7iXCxB!QNZV^(@#Z~kEjk1nmG^0M1a}khUqx zG%Fmd41A=NBmr9_yfjJm$sC8H24F)e0aQwZVvCv^kD7%+zCYVIgk>wKy4(ixeG-+O z^#(KKh?mm7NCNyCx;yi~SD^{d>;vF}+bmo-1I7ReR%xJ7V*=n7V+~@sN*2{7_ym^4 zV{{X2+p6YwY0}0D`tN_X?aZlF(zF$&d0`5462&*%6P!+Dg(u3;#}xIE^R1MyW;6`Q z26C5!uqDGWl?pz8MHgUiErD^HH?%WG}*KT@BQ z>txq<8PTO=Ftxj13dXF%EbK=}4oqB?5#IQ?t;1uRk7-6wwDN!8>>K3;xhoEcw|V&T z#Lo`7aYiQR4qt$0&5;-YGTuC7!+Xe7UB-yYEPzZ$y6b?cW4n%5FqaOy0{M_Wy2$8q z{{Sva8%|=_&8#hfFo|qi?$AA-RzE$QU$)~}x(z$QcIB>t!kWE)BYxz0(~Nr0<1fGb zqfYPPdFT4nYukV9A}z*>kRX1pGQ|6HFFn2>;sER6J6N@P6#@h-z)P{PSP*TQw3A?c z(dP{7eyr{HNr_mjvr|Sp%|kZ+Y!4|POq@}rliC?Al6_0Az0rcLQTc{(%LV$9a~`qJ zm3W=nVpn=B)IA_NzftXW?Xe|&2_A7F>rn*@hr`qXCr$-vwEhgkc9cRFZk>C@DDG;? znRWsG7q&{6DC6$N!`*7TxO{vnlu^lUfd}(q87v(>;{FIvE6xI$9Bd)8FrAK=GZ{f3 zth$5?I)r~}lYXaIAw`O1RsEXEPi;Cy8Opz4Jwg61Bx$kAXH0K#&DmT+@<=c}*ka8B1-R->Y-M%`US zrRSu{fO80{R~?p!4=-~5gph6FfgCvKDouCjr1UWzAK^loD9I1?@+KuAWXfV`zgWqQj2YdD-A$Up@ zp;~v;8ofcmJxs+qrrC`Ejy2)SqH2QskApu2uRjF$+5hJ`GJ~fNPJ$=+^Y4ELzyJQh z164T#pswV67%(JU#I<{4 zT=LY$QLquvyBeKa6yT?NwuL@EIC}n6c0+LghkI>Y{%{ZCMt`{1?ASjasPVf+Q#fyT zG$I|+hI^j({`B~v%-VgLkJo<*ziyzLkB~%=P!~R#gN-`66p;5QP;%QB5dH0=-5s_> z*IMr9Up*dOGX#=Z7Y**Qs=B4T5K#F(bGV}a)KTJD_(XKGRX>pjYPya{%~r01(t#HK zCn%%WxyOk4<}u>lekd^0{LEMo03vA^T3|jJ2A%{I4OUS;0tlXDO22=&op3~Tne4D? zJNM>9K8f(Q%1!vJ&&TI)?UoHd;v3xDtB{x~h5K#mqRaTFsn=oEOX7%vPr$`9!p?-%Kh$xqawdRB0L~_XE!QIa6v@XF2oLPT_sfog`*8N~M-J}R{2++- zAf6iG)WJ46G!Gq)UoQUqtHrDtv-kdXt9-R7p zj~m&Co1Qx*X$}d*hrVgz$S^gUi$2;`7}4gCT7He-K=NOrAV$DFfS5_9TgUVs3{ck3#1^0+(q?i zoSa8()<{lPz&GovG|1TQSHQkzJRT3nV>Ej0*&X9>pEUC>FT-OH$qeFxUFn?{8gJzr z=(7QcVQ=#aOrx!yR-qZI*JR(g<-5p}|h8IzP2dqJ<$lAnh{g4=4#8fI7 zGs|$h4+(#SZ|!!FnP}i1f@D93@Ux@D1cm?;t(=ZUGg+dEb5xjY)Isxj=dIYgFS=WG zcCpaUyWVpxOhaO-1lK5@*lrSH(Q=7p3$ELp-ma1OiWSTAc0O>_9NmQN=zMj#w_|gi z9m#Af=g`)~w;GdPsu_MFkjk_LaNfXmjE?Fl29qwR z>X7bw(T5_4DZAYy2KVb^r{Zi&2%gxu7OYk5bf-)mX^%{z*0LoWGYG0O>T(*XKaD1<|PSp3GK7Ek<`8=*apwCfAs z2A@Ll$rCK4immYogQwCoZ;Q4L!rdXt_lbIQqs9UkTUOD|6Dt!AWl=#Y@Tqy~T7Qy7W7Cr*3n*Yy#{h2`7i_CT5&Lipc7K2I{=>gd&71$4hGqR~7U;)Mf)9TczUrrVYk+7y!vG%7+Fj2WYrY1b-ke>-&Pd~W zRaHebh3A=$Nyh?|#9)YG&`o*@&3Kl~gu4@@j)Thv8pGkvMH-J%X+*RLDffu~ML6$} z)as=-$;0lOCt%pVOtOho@;k{JQmJ0Z8ix2eq|a`Z-I9Dy86Klf`C+kl5Kzcji1`U4{b$G51fd0|>E;sg0cCU%S7U9D2zBYYvZu9i|>(f)nMtfSd`6&V2 z)a*aXU74esbya?eef1g8=-Yp0dHORV&?)tqa^LQUHhtah+t_d0F3zMh>|3d~S62Xja!*a@<+`{| zmaAE*t?bEz?mR8ft!6F)c(d{YvD4t9o|qd22R5DISFB`};`@!K4|5nIZ@F+43`DHA z8l2SGtHJ5PnVv|uHg|s!M#-seE$!4DXT@61`lC4+z;~bVPaTixb78EO8cjj8-h>i4 zvu1R->cfo&*~S_&tG_;%8Epn57mqhjo}T_+r|cF`GIo4O&qWWfm~40`w^MBfashvL zw)P#y_1E44dcoRTAUmx+gE6)EgCqr9hWU%VP`oa!ApR7P_5g(sLiwpxxA2Xte*5Xg z6p&`;4(0R9DJX612jxxLB-5b6jD2>7_xi=#$r;)mJ?03~K3*=ZB^Zjo90aho<(hI1edCGCVIJt#c?@m?w-g@L<$71@Ew-?wetECrLOWfk&VW z%u$0H4_*`*p?MNmw>vhf`n=6%&l3kRXQHS}Qf<0BielN)&%Py)>}Sp+vs_ zs~SzZTq12bRG&3eeXxU%GhTJ*o<$_GOzjgc1-3zpGv+nX~cx?(X~kmi3Q;i0OaQMuj4iodb{by=GzJ z3A4PB$sG-tPyjd#XV}ile~gd7dge+yYKhX|J6FK& z(a4GGhYi=nGIaZ8%`KiRE>05~O00ephPN@t2NMle&GVK05OjKxb3lfy?Xru!AIeO~ z2f!SC?EN0f{9dLtw5qS61RG~W87q6udY&&Dt-Jgk`r8G!VmW!{sLi4+;44<)N0_rT}*ylcXW zpnP!qKG&O&6D%L>Gar~uL<~Us&@%6F*F=g8(U+1HN$|ow>v7pcfdtU!D06&nbq}xc zF$nNzU7He~$%-frqsxE&=JC-MH%l#(%AQz@7loQ(T*0(m zAy!v#9tDDj!9=@Vv!N7Xxiu<^n)?W_^E&)T%PtX2cI>J-^lcc34T9LTKJLQ3rwYSU za+Xhvcn%5h+eQK7=`MreV4<)%#B+&Iz_?jWKzesw=JH98UqYYT4P{ZY3g64QS*s!o zshNM@D7bbs0%3AlfCP?yl6i!Waz(m`XWGciu+dg_(E$5Qex}tK&61{3G1n~Ya|%In zBJdUiUbLS-dafGA-ypo1lw(~PC%V~gfoF%ZD6-AA%`P_B)$zUJ@0cKH9v;!#$$SGn z{0v$%hQCjmyBIy7@f!R-X>NV&<^?tJfTO+b`!$ z0=?kf!5k1GuPK`^#mTv+TuurLrzJZMh^mO3rLoS-l(;>C|nb3;iNMsy8b z1mw2@r@5RH*=0cKHjCa{dj^N;q5$1xuYHMK9`VB{%iPR)&im4s@QwSB>ryI!N33K5G;L>;cnT{kVN?u++$YkE}#Gk&*=s!f(0%WHgBqht{yeE zf^urM!|BABqo(WT#vE{CmmYIht&x8q_(fIJ^+U0Bs-(=)9eN5;mg;eC#_0$WEt}}w zHpdBStsei=UF0YkZ2>wx`6J)tF=UHB@wkJ|7j&HMws#)2m@`pvO0IWF*|~s;);Z3P z+hMKu;+>*?qT$eoPxzvG9FeP2K@O_FBn46ghDDgjzPGNyUs~6)F|~$BjER4u&OD%E zrs`*lz0++YuOPw|R@#k54NF^=Q3~esSB2g&AdqsK0=oiK_dmOJ%wdFw<4;iz9zEi61~s5i0uE4UY)wYE@0IlQ~XeI?+2jWU!L@pBP*vv1=4EM?!VW)U|*-Wk5c|8?AGG=nt))3R;Tn7dx6U3sp!w>HD(;CgB%%}>dzEx3iMpUi*L zlEW0s;ZawLFiNZAR7X?;`V6%KC(<$a!yWRdv?`{}o~GG-FN})KQkr%v2CXGpqn{%f zx3%xe>VZyER6!pUp%iqq221EFfB7a4Pp-?fy20Y_`qW|?Ex{~k)y(~W#-hspdHA)p z8U{8xOZf!HKAI8@T3a1fOmIuYz3HsfuF6W1SE*z16kBN%gfyk3Xq69>l~()8U@@LG zQGH?Mnh1R>1@B( z$*u)OJuC~hfo|O7PJdW`^M?ar;|Ta|lOA!0LWq7-i?}-|1S*c^5H$g@bHF`Spq}0# zx=aEZ4-s*^{Pp<+Hs$xTm6)HAte^N~Ym zZxC*&)Xke^B2W0#^7)YGkepk4J6+rR%T^AWm%QwBT=HX5ia}c>mJJ8VFb`Ztsi(yT z3?N>K5G>$uET-)&!T*&{V)p~hy;6ft=7_$QQT|s~YUWCRsb5sIddQ8VWTWGSrp2M* zvGZxg7a&?{{0K-Ek-MY zk3@_v_rA@&#*Oq0^R?Mp`%KY9xYevg_ukg1zEbqYUH@%q{ zZq1}}h~6)`=+hWZrp`1e4A$@hw)NBVn{Y~ck0ku2JKVk10+G!3ZnT2mOi>=DsLd^1 zRi{(8dwvEo0e|n`pwpkf{x{bA&p+H#v4`wu9}3vFWP~y*OLh))`cbz5w0lrDzqhvub=Yos7it;Eyu&m(`HISV6b(<5;bF8*8q;xf%)-AH+ci$1 zWA=mXbord8Oh*ZhS-^1GjMOH^{@<)S<)#@~fE&9Bkbmv8WEa&h`;(P!?i`;s(a+GZ-dwQd9ktLgqEwI{62}w01lAB^%21P z`n^ziC4lm{DkJ)1biERGOFZak;qr$ojz2H*IaAP4vC1?EA`CO(mc(2QLOAcvXUJ;B zsDv~Qgj0PUq&&CY*{^&y_j=*{XI)%t5N(UL34fAkci?YDIg@VMtZx4P0*(d)SN{%U zP?Ako^1nEPwz5JUO`G~8yj*-jE0$)r(gAfbTXYUT>%tX&L6&!B$;2~J;>y`)$HBmu zT*D5L)#h8a0*CGw!I3I^6i>gt=4R`POG^6OxJ@gYdu{Y7fAaI2f<1j?!InKPt?AYAH?dAVHAEI(%0-R4`3BNV6Ek-Y0V-Wk@ah>I4IFbqbi z`mXA$C3Q8JJT=L2Mm6Uz+<8OoLVsFs9zV#vu*F=Z9OX{t5po{&2u?;qL||$%Fe@c_OV%1uFg%UYyRZ#FfS6r8ZMPE`TaFz&4v0W`jSPSoGiwwKi^X(7JaNfz zu4LyX6Q*iOdD%+uj0QG&yClSr`+r}Wlo!56#hn9o}#D8_ruWlODT z(*=~^j6A*wgH;Orq~e#35fS7AK?O7jCNAlCPO<1v6^!s&5sGptpFh8T$wL$py|WrQ z74m(6UdH4%qJPD^(bN={@*W+5Wiq0H z`UV3n!7=@hKtRQFJdyBLi&u@avuzV*-D!B)S zVgq!>dKibag;f2R5(r!pK~*S%x&R%QU2TRJDc;T_-h+bgy3%)8@y9Gw_nIis&*5 z_EEKEf+Of(7{$44)9)2uQXMo53A`+Jyxd~HzO;JWT~nID{v|+A6Z-m~N`Y;>AjuSI zv&eCBnB4C?YansaZ8|aS0U4IJd2lfb=ft5bLVsxT2+&o#D~?AfoQWD?8SqM+-dJ}6 zj0b9P|2UY&>w-160#FPxB~C|4HXB#H^CFM7f(%zfhP`Mfgzmug8E{47<_YjB zR@|#*#WV0x1iWYt+$>Lvszary4?z|t)-y;jsfyum~jHtGt>}9%|uO#!GBtG zmFdFA2W-aMc(SgFiHqgzh9Lrs6S&x*U2%QGWX(lfT;)1+TS{;1lTZd@#;7+>oPqzQ z*r>r7fGs`eFbyG!ng}RcCmW|UfG;s>eIDocoeWN`q z;DawmF;V3vA@IpAjFYlC_~M8s&Nleq35&!`0q>PV#fEGfW0j_BI|os{J0xK3cR|#( zHS;}Zp^)ao5`85PI5Lau;AZ+`t(7R?iCi}jn(%@?#xlc9;v%zBO7nyhytq)iZaQ`U~Yc# znQcjV8(pWz_9)T7&~pHKa_qzy*<`LcWcJk9nbzX5)Z=t4%AGX8)&Uc{=jZ9pm7&xD zqlppHbS3F!Z@2Uur@^WzAb&4NdQ2qNz$&Yg2T(modw!Wz@FKEc{@6W-jfE|Dylg5V zuqAYTZ=IssaZ=~g+|Tbcy#sen;%c`o@O;0ol08_t2ck7@DelTcM!qR1?WZbbdr#yO<&#$O-~om^z>F}dbWtBXF8gO8;(HR3~0i{?z0)uPA2kv zpSL-R5zt>b#oK6i0e^7VNrFnhlt{PBLkzQ!<`WKu9-CH1z$TZ;IWooNdxnLHrn;$$ z8`cyrTV7MFf>@BSY=X!mB;1=r8g*QsApT2;4?#2N8uVXEp14Abz`CVw2^#^o`z)0cQOeFvmR z;=AK^GF&%H2X`x&#S03$$v33nzHn>89`%E{Pp=jNFmv%Cx&*uGZkHsnGFJSxuFudA`opv^CG7<^o?V>2JV;^I%?d4HNg*aG#Qj~x{|whjf8P`l=o zr!7Bi^SUje4ke?ENvo#V6VIYiI&v5T-N3N`^r zxp?w9&WKS$binx)VPy222V`|JtqPkw)e3&E`W>yt;1x@!fPev*8a zKxJU&-+8`#^mq*#7?>qAJXwc^C-Z4|y3SfWU9uKW*IA3FOV;A)I&1NC*;;(L4h>%} zq2cK|G(25G!?Sg0c(#Cs$Ls8i$4mCblXZCV$$t`_eDc*gG<-FmhG*-@sAo%L)U$PD z)Uzcr>e)In>e&(*^=us(^=yfZdbW;?dZv?6YLc|J4nfbUeX0zI_hh(M2m{qW`#{El zS<3frGc;w;c)P3Dgu!c+oWb+XFhmK3)q9j>TkSa=L3xO31$V1t`kF9!nd(Ehm_9mx z`hPx*ptHenXZIqXo+4@zYQh4hLo$YL{93mmzlD~oAkciu?nc3Vt;+)0kywkmPPbX| zK#zM~yufIt)hQiPsoJ*8q%1LZ^>lP`2lpZ4=L3ZzGXZNxB{-z1m=0VpT6WoOJ8pLk z#Tn}CS>xAoceCm9vXtV$wRrrUdL*FqJbzIOW3$GlJM^aF?JebG$}%)2t+V-4uQ${Y z=%U(_JzU)2DUFHy3@`v8?=v$pOf%f{5;$otNxc6wS?YE{?4dDZhV&Q%OEDRgr=G_3 zuO_62sQLNlpQWTSm&FalJKoGnC(~z->C?u1^%YYW)toRLmRZ?g`u?tIUF^@;%)EaU zRmUWLATrt1!x&etiHMK#tOD!p*=P-VC+`(Rn0nzpFLMbmrzqui0WlpIIbXaydoV;T zGUH(9nTQ!nrRQMRybnmHafo&^(SKCQvADEj;mur;=vEC@3v`hQeQ$IcK!Uw5cnzHJgO>ml7!lb@Bl+pvJ)|niz_X1)-o*4Ie!h*PD{X# zI%bdZXg{g>d0YS~+lx4Yf^!D{5NzA?bKLV48$bo&`Z>LAfb0|R3)B?)vw;i;h@YTB z6qUlN{N`09j-!Rp@V*K*yET&cvYKlSehtTO#r|k%tdIvR1tD}vc=5oPm@sAULi*v5 zzAU9hngYHaI$YWa1rsu%>3=nY%c6E{U8V;eVp8f>8fqRSRmDz|VuvC#7LUGS4gh1& z)gRE2V_1DPp$~bkEZ;^@T>#$ol4B`+CFqTdD!_Jw!hhccS#+ba3)UyVMsw#+L&H^4 zaeoc;%wS*Pt)I}>8vMMe|LMkbGTA-?z|^hD2o0gxlHu`T#c2$gNPl2j!405-+fkfW z7`UPcdhtDE-$N|WxfTI%de0$(_46bIb6Nr0L^0C_I&37Lg((WuvMac;KT@_YSv`K^jls z?xW`}*WrsRc6WvS|y-yLfd|l%;w~bxX#-T7Shw&r9p7{N~p1|~!>;dxp?HC{*vk1aix{V`=7PlV|uC1zZ^hHGh1Xa=U0*Xwa9}*(TEhBN@n*6$PFigLcIytvNdBYc7>Pz5haOMhRnb% zW|?ylPbAAGm|_QO^@^|R5GL5K=^L9aC=3BPpJO$-@P9U{(Tg-Vd-0aF1GiH3@}o)j zIY8PQm73ilF81Lu*+(JdrSa&J*4{HFF+z}(g-F`nMdB1)64nqu`=21gcUr~fBpx<* zH`Zas$+q2xQ4NJBAOj%RgJ#@^m;|rUyPGjce8b>(YM%%?M6X%lqbt`?=!l_iA#cMg zN_(?wUw^>>UT=VREd>nx2RKk`oySMLT!%L}n?i^dW+Egjii@_itMuHazxZU9B@bpP z6lX9@E)%ElTEGvtEUNa%l2J|q>Fck*hYbGszfZpY`b7uo^|8#p{`#z8ynCd7zkU9H z!tY-_fBEWTc=r1LdllUO{g)StW=Y6GfF%D0u$ib*Bcxb`SxP75q10GEK4cm1$^7`98?E z#%IRxyv|$9eOQO?{7F5-4Yux+I?NBjmA!53N{h9lU0&4`$VI^k z``XX0;))w4jnJvh4B)gV(XMI1xjnk3XOY|_I<;U(Yi0W`WsbFTXS@5}b$yDOK z@Udp%aS{==4|#i!u=+tJUUr?XTU0p8qK>kf=d@Ste%*H|L;YG9c^LQn9AbOVrS3y$dbA<4Y9aTDstO=d2M9aroBl z(FGH0HhXU20?oLhe-n4w3FeKs%(;bG{zg!N2(*)Ipuv5nRXmduZNR3TZFwuh{LS9T zytdAYTbV=bt^1UAE<&p``*?;4RK6>$`+CnVqREjgTL^9ARd9ILbchU#E6xWBZJu-w z{qjIeSqHz%QZVJw+2NP4ke?ErIiy4Cfzp=3aUy@;t@(@Bf9?5sdW}bR#x5!{VAX|O zXqHk5h$K5-|C$9*y{<{XM!Z;I8nc;(C-$lfE;&LSH?`KY^Ytl>yLcvU;pS?k4lI3w zFshB=8lb@f@bP`;>Hw~f2YfS($pMcmIFp$0yZZWLLe@VNB1)`xM`MDjyjxI{>F-ID zOnj_K~F zru>w0dG`3zS~6AM?=Jq3k>!DgoGsHWuhO_VRLaB1@VafJrkjN|2r4i3YmkDrsNt%B zyj31$*h<{Rg4DcV{C&>pICgGjr^3@Ico4+Nd79I^4JV}0%Y^jk+~qeK^6!^fmy>HEBI?v zQTF&@ba$hMVL=SAWiZbi26O8)6GKN?y3g^c?B4S?ufKa2zI*@f)xEA2FAWA`6Zr>D zcV&AjJpaO7!M&9RpD_|T6leYLQZ5hs!rw6B<+dvizAQeKv zP`|{K7~+S;E95bu6H4g)%*|`Wqtn`B%l4nv z3M_y0>Ip+|ZzpUbnBRpku>8sb5EN*)1Ok(6m@UE=#_(Mn1%jLH{4HN09?jRZRi1Dk zj_-;B?s6}(q9r#Cc3Z4&HmaL7pEdeF4b^ec@?NV)-u`-VATjV=B1DrlaFCrhWsl1SuAXmOg(xY!YLC zIo~J+)@Z!T~Qd(0vUY^l{#Q}1+nIJh@?ixpuUWi9bQ8ZBa zI}5Lk5f=Ecfp#98)?tCpgyi-6VCXbDjVLTifBsSiCgsC1j|_8>%pMx0IdL2tr9GK5 zIAA2o{?flf_d%+_D1Uv+U$uWo?f_3=EsH)+Cb0Zp-|~ABsWKuaDtQu|N5?d~*=UI; zOq(sRZjo=Q=ty2|?(}mXoSw@e1H~^yIwrsHoBGkDBS*9IiD=kku>{;j;8X>XbnuuE z)J#?;cQ!Ua8K${UkyG8!#K!47jc9a?q+fb$Mcd5Tr%H9yZd{U^&tOg>78Du?xxN)(8 z+7kB6<0pMr!%)cScw>L9aVxZ64w$g5_r(#IY)>Xf~g$Eb{eD?C@(UmR;z!_4@s0Yhnrx_^x=zI zERPgsGEG$1Ii$|B)@eu&)^zNP=kZV|a4<2F!@6y}LpAI)$b9QWgOGBoPXx-)y4~^! zRZL`KBc^M<0y(NzkJsvSo!46gic;y|feLyJ|gQbJlJwYX1HC$9LTYrS9*% zTI4rTm2bKxAy0pM(*s;Z-tfF!NEoKUC1YG|pr|a@5G;t12OWbW;Uqq(&0MVVw2Q<- z69){U70KigE!|UFu%D%1(qazQCwgV zMxKF+jO+l1a+CaHrKtlBKox%y*ra&wnrQZ+#V{A^WaH zPvx=|8AN}liEE6<)u(s9Tl?o#cIqcA z%=oD067nv1SENjIu}dpY`J|@;jmc}$fQHoxWMtoUh(I2ASh{isxTdYZ6F)IHQfd;4 zzmnWquHay*qOx;rdGR4QYogsn4B6}}^ljn2@pXT2?7sw-1nBkMUtU>j-5lF2LTw3N zD5z8psJ7j62^w!j*)^fHxLG}vlyB4(A2I-RIO~-Ks3gL$dTT7qDb;&VcK|~Ukl5BIGs6U7qFDBdq=|)FP8{*Yilm{n(48*+@TV8d^XcNx zL%vI>+m%O|!hbROY?os4L@gH4C3;RoZH9lv;H%<-DesUf59KribP^n+zk_2%9tX!X zA9-^sL;<)E!FecyZwI&gSuAy1lkC51&8GzC%>SAP#c|95VND+oVM zrSDd_MSh#l`D#KQIeUC}o~kZ&J`{>B0&qzDI`}{# zd+*QYvRIkMA>G;i9EPO~Mf?F=RNUb{&&x>ibYb?h=;P95jF3!tuEh~!?|grrIu}ys zg<9RRFdOqXtbAegS2dc8BBv7KXUy6}W-c`)3cAoTCOvf8Yti z`?z6H=6a`AQDF$8u?C~ezT60k{KI^PBOS#0tT$FOwV{82ka>ML1@c~YqW+fF#6R53 zwkWd)Xd!X+m3aN;8x3pRKVLA-57a?G9>m+>eLeLC##TtVMaGs%yQS&8O}3TDx8V<$ zgb&I!Bl~h-48bwYFT?XY6<@&X=G9{?1`q#G- zcTpk`8ztVX{?37?7#(id{W-(7B9s!=b2;+lYUWyq`m9pCP20fz2xAC_B(iJ4{(w8) zm9C;p@|lD^hZ`ol3v65YnkVXc?4oSfQoT%EI-YI1cUHRMX~nyHDbOQsQQ1OV^rgY+ z^Ei~blX-}{rjio8(jjS5(@HSWn#xaV3ti6tb?2lzUMUF@*c^V%votbr;Z&$ovuF49 z=P&*;5FYSa2XoR@28GFSnh<(}y{nfqr3N;CJKPQ3!Tv9`30$Uc%`MW+(%tTiMRPQ; znB2h}-R;z1D$9WVTvFr{pQ@8yk_fG3pgD*XdEMk_Z)TG>GA2>(WP}5eI607R7l>=- zaEbBaF{#Mk)ll&H=vWl&zcG&Mewqiz`awTF`Cwz0Bp7K8@ir%P5U@)DBN?CM& z1J`FNrxMlN2GvPTVqAkRxXvjt$fB#}kpBg0p*p9=%iApLGvP`tT#4qn^Vg>NL%Tg| zx2|?~%HIknT+Itel8ZT1na77g^oNWo`mxTVvOW|;rs#fzvo9<5-VbTM*hik+G;Y$n zjHJ=CJp12}H=gw_xf9ugsA>d{^Az=e7*7IRX4;Wb{3}C1*@KfB{KvIq62Oq^lgzUU z%vw2iR}4kRS=avcS4<{JS}>36<~~6o$zR$Y2cCCef8>9nW_w&305?TxChTCsu#n|J^;W4E92tWGTL!0^T9jOb`mZ8wOW@knLkz z)Ju{!ACTD*e?Qt>Y@$uTuHjInfY(x78NQKq{A z%{Bs|cSyZwFsqTut3y#INM6Q&Bmv$@XdaNTw?&+u->|**QZ!hy*N#OT!hRFjRvOEg zNFm>3Zugk(DLO+rDa5)IYp2zlPXE_p&6&yVF+eJrTj@JWDSUq_#ePA^RQlL9etbNWtF}QUa0s92W_>ly0G7CZ*cyj=4-G;bB3NrOojdc!soxh@mY%jg|~K)b|{7tJGe@l1Cw?6Ltw(2!DObf zCsU3`u?~wWwBOYt|J$yJlRwW|YS%ehdzFVfV|>}3X%Dd@i%%O7>ecq@q=~R_Z5~>F#!IxHGJ^MAd9F?Mvl# zn_Ff(IS5QpTyDTk>hR_PcJ`z;8aP?;02w(6Hs=9+Pz&M z>?hixoy%QX_gTM%|0%lN4Y{_)P{pX@arvF2zu)0ur0LCF_85R%_X^Fu)uQf|-Td~v zzBkwSwCkB)noRWQN_SNu1h%KysyDDK9fRzW#hsKq+?se&oz?xC&UgYKH^-)zN!CRD zmdA9{5n9=Qq)7$dgfCQ%mdYt}jfb2x;i@&5^QcT`gn%lC(xZ4UoroScPNYB%HyPcS@armCYbbuZq? z8Syn)G$-))o#s!Ka5FeYu{`R!Om^uxJLo2c&j&4knuS2lv2A=$FNGK-SB9E+Vj*iS zNSdLgQ(Mz+B^nnd%%J6g$|hB?Z6O41Kv!4sD~sxSkkkQ7HwuSdC}sx`;^^iC>Bh7X zqFt4g6nDk87&)l$^bF+i%i4(msG_CpkqpjIzVhr~MD4GYZ3g+(@T3pLaqPQ5LK%T9 zJ7S4{c=n%P|0)?1pZqxP;C!S})r2C89CKyRt++qalI!v^s_+w#fXPGvM{Qd2CA9>E$L@|L8580Uy$U{K`u3BRPU}Vxr04&?JOxr$^0f|vo@GL!l zMC9fdnJkUC`!1@sD7uO)V^Xewl10a3RNXjGh?4TV7eN_8=0s8DhopLzo+ng6=v<^v zvqO9-Krm7Ju2u$?TZ9=&eWXRR;toeK8wt1=9^gGUXG+Hqy+|YL?7fy;H)2*{NLTE3 z$YImX?R&-~&moaw@Ml_Gs^%cLS zg~~x?8;TTEGWheXi1gRGHxSM>VuTw0h1J?1kfE1Y^O>9b|UPXK|VhW2o#BIi>lMd z>%?&lrl~^E9wc#PB^L47@6YUiI7A|XMxVj@1Y@g$OxeiFh zh_*~CbJ*t{NDnfYpvAq*u5)>9M*(g9po2d_hrwYCSS{Eh=zB)D2y?uDBKTd9tEfDr zO)~3>EL~Rx7?=C0Xbc_~i*Kj`vH6ZFwHnV&cjN2_K^AfJuw3KHMUbomeMP1P@;e#s zdCBTvyjF6Wy?EddVPN)^Bs#)I4VD(^7tY6vwLF!% zr1m*E)lQwdDSmg7m>+naays|)pu&83uW+f6big{X>V=qo^&;%`OAh3i?nzB&Uz@5; zWIEGWHUtXe0smQ`in27SwYUaqQk#eWXcO<)t-2}760RUng<2VZxA^7>5-iCYXz-JF zU>TBtX_++;rO)9E=vm5iMl57M1l#@Yn@hW5#4v>Tp$Sxe7#iUNuaLaBihhQYRp>WkVdeI3=`k~8=#3$CrtHC==+ zx=xSm5=iDIsjA0+uo7EvAC%WG-X`o8a2>w=<_nQbyvW&U*wA%_eA4VH8PC$sAemlb zWJ&2HHRad6w$T~v+}y*sA%fpl+oojVyn?#sLx}K`S*>J!E$ZZG_|lEcY0RYE24ynd zqEm{mOQuG)o;r}-SM#{BtN*CZWN)_aGE){srjE?(S|SI34#U6rt-niaW<=H2-dMQU z7$lS|5VjydD@H6+%DOw-|8PS~kIGf@giu~zW7N_+z zGG4dC!+tdl%l&W@bU{knX?W~*wehFV4%3}Zv1oRf+C?)!^jv<6{&t9}IJELjk8|Ez zr0|PVMTq#>e_ngobwQc7m6_$g`p&L9%|5g3B#`ibR4>yq>0TNyk}6NKhg&kI@5-Qt z9Dn0Gf_lh^X;yJO)@+CVRwO&jp38J#m% ze@SkC26#nEO$F~oaufQ`nHboGCldDoc57WFSVnXRU**gGs?7G-E>Xf!scndm)S6fI zE&>Y#_r>^eAcP3lO1!JChsXszvBTC~7guC1TbjdiJBNE=k9r7Hiwd%$xM<6fHV5Cp zc7-23Z;U4SzdVSY?VvEphhEqBk-SDy0vNaE(?3K!*y9h=oT_qRDjZL z#2;v9am4t3sC|aj>_BMjzVYyB!7C~R5ifpHfeg1c~}=4-gf9 zPr)KLpr2|LFE#PFtw5XxT2kduP>L`VG@OvnQRkD5Ue=Jf1nkRoETsWCu{)x2uQ(?S+Ff#9P zpcD<|xVih+97YC?@jR{SrYkB;o+Y_a=_%le;@w&^9QO?i!r;ZA%}GdDVoWDmE(jF z16*sGCc`iaA>4<1jC^Zr$W)IW(%@H%W^r8Eybyc)eAp({LStxHIN1s7bDV_eQ~F@`c9;!29D;nAmq z(p`jKo;!(x5ufv)-7ODPzq`wS#D6MMd7T4m>@F~}r4EuDUMff4))i%;N@GXiSX`tc zmPXVFAatBNa6j`eJ8I4U5(Uas$p~#+cl4XSP67-o%JxOY*6*ltK5G_s&BCtPBpQ=< zw5~ez8V196BmR^s=TJCu&n=WHZDi@DU%ejRIFdlTbsp;>shAhHN0!IuE=LyTyM>P6*Glvx< zTzD-V8~Na_YJluy&_g9%UX;H6G{`|hGMBI4kjW&UgT>+1Ms;iSeb+VJHR;!R3x{A2 z>4+QPCyNamx>{eNEOu^xlXXnQe#c3kf>(C3i@5ECZNHXDM$Fo{ODdFRKjcC1yRLL= z!}AD9ouc3fhap*hABwC3JJj}?plUN%RRIHP7@2{9r&$LDPLZf8(+HAK^)jl`qGgDGqF5<#-oxGq%3auh+{}sCw9c?f#U=)<>x|KqI<+;w#bH8qP2Z&RU>kS^F zOBe*Zt#NOs2@{Z{R(Y_9^ZO#65#5~kuVIR=m}F52n_!_I#Q0%w3jggnF{n4xAq8DJ zj^$SiOlh!7%0@l_RJWh5iDh`ye~I$d<&+RISWe-P@3J;d)Xk4RKWO7P2M@DoTU1S- zxI%C@cW>W+z&_gWO~{)*5Rx7x5Z^W=-+vceRS?Xl|hqX%NB4hLHkb(5T)qj>uXAVGQ`V%cDtKu zKt9ofe6j%KmwJ$2E&%yd5Ax{(kk9lWpDma2w+4?OJ-2t>t`sy}29qdbG7FEhP4FI5 z&G7r>=XZYz;Qu}Rm!Y@@C=luUzwlm&3Ty0QMl4==_bHdzxCR^ue)v?rmA-lUm;JZ~ zB0#<1KDZKAHB+Zh33yjPwde-3@IkO9v`BZy@&OX@d&^jVPpy=p{64sUcJ}7MU^u`3 zc=jO}v`KTeM^Y&V+QXM$xdt2=`sgVhcf;vp7h71YheiI7H6Sd?IR6mbrl^<4K(VTFFS6!<-b?3F2475nMV&x|KVp}Jy9O==*Oour zQyJUiU- z)9vy2kJXOzuO2`9gS2Dnuv#|2Xa|g>{LjS*crJfAcnY`~OZJ$Wv3-VVoAK zT@z_?w=hl4a+PQkk`>22hci_CdVe`+-w{=EEG`ql=U|i$!SEI_WgO@7Kfs^_Wu_8# zBh8|1lGPg#%SyRs+w=4E8V|TE8m1#t_k>vfpMUN*N1E32$|b4tL1Cz?WZUlq_=9`R zNMbm|G;#{lrS&|POQD+8^8C^qzkvbM+MHGT_3JaiT%)nBAcCIvFe!^44}U*Kjp+Yp z?_HSWwvlwvzrxUs6P7kwY{@g89Xob6jx5Qu+R>v&Esgi?T9;xM+10dIWGx^4n27oB z7x@4Pf*=X7*lKxJ=P_0nfy~4^k;wegA)r1s>qE5 zUJozCWpo(GLBD$BwR!P|;(rCSJc#TBW15@G2nuSs4VPBC zU%A_fmHjd>sLzkPe*)2c&P3dK;5>|WHW1Z* z6*Xmq6(X$Q$Pkga$`^cS*vsF16Oj#z`l|@4xm>W zN7{h8z2sh}CCn_!;${aJ9&J5-y;h|nEak7d)SLn4j5DFqqMbtE$q~`XU|_gfA@S&|4h<675Aq@ z)zCi)y?=j((^jZ;hX6r9zQ3~BxumGTbJ=^uIwmJ?PG=jlFYBePkx;9ghRhC+N*|Zm z5vOMuoe0ZT4>GcEK~^sP4QM%&dgukJGpJM7Ynkov)I5+!fB=b?1|25LEoW*hPAfxW zX)b4`FHS2beQ7RdGrzkLx5ay#jcISOTG{oM>byZ4RDpjPgLdy7*~gOYn&jBQjt%B9 zZ!0#-aNzr@t~2>vw(VMr?Z$Da>M~SW#<{Gex7@lK@fl9^KEqo*)%&b&@nr8ay5-Z| zVD^5VS9=JndUa*Ovd7-mNiSH9@cMe-{}vAX!_Qt%VaGYv6{=| z@4x;1x8EV^K9kaoZI{*;ri&VKwnseJXg~h$(c|A+X=m4Ibz8)@mz%=|ZZvPJ{RVCW z7o`y|10O>A;G^Xuy`BI)g8apYBIe@Z05*siNC~fYhLM?UXZCi|o%LzeWapPX#0Fn~ zmJ(YCDw~*~IS~!Eh#C0Fq8N&H0BsaLLb8BOjv_2GJH0)5S|jiSC^3lyVU;idm5{Ll z_auy8tlJIw=2jAJH5{2=X%&(OQ{s`iswb3KX=0opwOS2NRoeZtC*p(vyLubiR9j~$ zwl*>Fa@vQrnHHh;OEzqb40@4xG@8qQ`ygXcxF76g#pWiszY`NSlX=5bH{hm!0q`~u z@~ge`Kg7^0_F_w%dj`v6J<&tEUE3jeEbo6MsdmXGy}++CM>e+JgBzcZ_5;@?IBz~EWqC}=Q6M#c&(C>& z6HBk-ThF;9h7+T-@egVcz@&7n4zu6=xjlo_&u}WLpf{8Ckb?>fbY-Ij)&pf)Y=$c- z74f0UDI7Jz(nZTev5@7KDG!9Eh`Qu)+zLKLBcnCp4z@2LSGMRugk6Er=P?Idtzchf z;J#7dDQ|c!0>!XTG1MtKFM20`S=W_wB^jZ)$FIcy5TejR*?>yeQ8`d1HVugV?>Ip; zRctXPYFQ{>M=>-ht|x0+T$VS|t^Z&-b!zL$C=}H6D!y4kK1pdk*#N!i%mC&W-cAN4SYUbEj~Y%+G3~MF#-6T3#kE zQ@TycsG7t&Q|3ghi+EpuUzANm#8;dW&T^}HLFIfU{sP9?6v=OZ6AdnnP?nk8DobC< zmWx9LzuocqRjQ>cA1%n;p$U)b_|yBhFYN-sMLor#j1D;@ zwd8dTB%;{fd;^)Lo?>3^E=%ABPRe9V5~>)Mg(aW2mmG2MKdrcbgl#m=Rf-OuY#t`nja{8M@pazQ87pZ-{P%orG#M7Uq24*i#9dGhAF}c+y&jLsd;dBT{>JEW;@D;hf_^c*VVCZEq z?OH!#0aTqaz{4C14ecoYTAuZZi65Npi1-4dJioLz4Y3hYWARbm9ysZh1y`NezUmPJ zxvj4Pb?K6s^h#=vMPOIe#v;-%FYi4;9SBnh(P^^+ zcy_GG0y}D!$!&Ef0}#Cae^-w|G;G0(2Hu~* z=|Jq+nlT$t{izasM;{)QP+Z&T5ZakFL|Y9`)~eMQM3s|Z?oT<87^dGi`M}09N2q4$qi-LrwB(PF8MS7WDlI&IydQ+2QIDB zsU-uDe#i)g@<987n{r@IjI&rIeF2Q z6sNrS_oX0|98s3%E67kGVeHGw$o+z~>`*eH{Cr3gl!Fw2yARrdHE02fe?XEcP)Eul zzk$_%Nm%~9FuQ>o=AOFJcC<-f)c&qSPifPgzH1SRtr3a~?rx+)@qUH{;!l{7Yu6T% zF6MbpQ71Drv5|dKkm2+~#Kfp2O@A4HDXAp#Ed3@fin0mLa2D;;3bLh^`xXrVgS<0x zMud_IKPS#&{GeRN{>vNX3Xw5n|&xJDb!u^ zut%_8X@OUnv_g073if+`Sb%@>dWe&Fk5`!DyzCoAhtmp1lFNrsUS@>cEOi{B#lR#L zHkK9(3LNLfpx^4{0!UX0KM_=|#f+6Ng$G-%b3mgl)8j1N#A2(H0_iUSRob*wATKad8SDu8}+zMaE=K~rGZ z&hliPwNHuMp|?R2CGJwmaM;$FKt*~b?hIY@-m-ZlsH`JSl|F0_nb1|*`b=m&Dum~- zl*-P?8_Pvwz{}rsCcq!(uV8q|`C{*26d?XN?_kK$`409JqfiN;LhfSM&rapjh=zND zwy+Z*Zp^jo#ODo2F$6BXxWprW@VC24^Bn%mdj)Pas1m@nvcP}#DuPfs1h7`{KbxdR z`$9TEc?Ti)ZGGW-`M|ey#M{Ou2TlA5tR|v+1ra;PqxskH5uwmQYDIUz1BK^@bMm(G zY=N`i-+?l2IqByM_}V-F=^EehyW!QKBU)*lNbCdYnc zN07yRSiaWba?bN?gYCh&kA#g$2Hn%Z9Q*$Tbe&c_p@;O3D@jGN_ z;eApSf>hv&`J8ZK{7|}o5Ht7zmRZOILqX>NnbBTsh>F`OU1{L+X#f_~dWnqiuX>Fh z)jMmfLwmjMF0CNl?@%*2si({nqAnZqfq{>gh{=)WE<8)r#J)J5in?src6ps7s1yCT!O7=K4c;{Ra_s%}&ZPbRb^L z9N>u1ws$E$%0l8USj^?|?%Fht;iVPwOIKcB2*oO5t8UbPnJMaP&xY!6ko3KO0vN@nV#)^k2?tc@b1}`M z_%asjx!C>yZTweGqeUmc811JD#N(aGW4j4AJ4lWuOGJHg{pwHU(LYh2)PqT({}fke zVu~}}vO0oE{jX1z$>vpDeLB5L)BSX_{ymNNl&bB$OrWCVqRcAcg($-5ReDW&T^0_t z0cBgKFx4i1BE@Bl{PALvesJ25`1fdhV>$}lr{K4qQ}9iZzRC*m``ftb_XnBJBs^${ zndunbC@Kp`DN;lb9B0lObGA&-F?zSGw&DbU$hvS7*L7SZRUC4+P=`N7TI}n6RBuXH z4T2y|rk9fH)C6*FFeS)ap~XEyt2Fs%py<)&zs7lgYqS;Ah7HHLG4x#2#Pz4zUqD4l zE@`Isj>s(*Y){70mBczBYVR~+U&f04z2}Oh7=ahXdD-hY#wG;k7^APA3WYS!ikSN4 zR3Y#;akWk9MBIx$#CHi%{4dX+X?h^voPH4U{ZQ?)AC8ZYe-#~hO#kMd_~D-)egF7a z6cN9FV%-{@wnSGJnb_*zmZCrZe%pNxbSM>7n1X>5*u>R_Lh)>U|NXa*9^L!!cU`aj z6rX=uO{@Lk`$yk@Yc!7-EYdyy3{_n<&za9ZRwZOp6{l}4E+JL$Cs3IJm{Sl*hEZ_} zWTC^Dz0cJo+8ucnNE)biJ(y2uz(g`5;yQDGvvqRqIJtxkrG;!(W^GJ5hNqLvv=%CEc%07@{>X4TK*I|cJlio6UU7p zB%e3;9dWXTkcf6B_$|tu5px~6;S&n{MPoL}oQjOepicm`AjdCMs>tv zK;ZP8~C1V5LKZ&=Mzq+WTR?@rx3;OtpEgq3#UDqD#QZNMcu3thj3t zj?!opQrSqB^~jyj7MmQ_gbz2a6D{ZZUuF4capx5b+1slI|3NKrw=re-bNIJXEOe+B zCRxoM4okQaF7^VpRB;JQ&?hiH#G9wAxvYB!&LFOA>zl$OvrJxYgYz7oU(A_*Bffyd;M^vi4M1`?k*2Cbib3Am6g2N z=;CA1!_>FC*Th6`V}dZ8>EMcgi81@Vn;Uqg)%{}}-I(H_>tmH197=g^VB#uS!C0Hw zs#t)8LR16DY5}-YtnS;lXPS4i<{>gvf_9Z?QgjTh0`-*uth+!CsV~YN*pYjX^nX+n zvC5wTh;D@7$c*NSI%#$K>I{vzu z4x4Tr)0RX(>`fdU_nk=}ME|{seqLdN>JfDCqV3y)o{bx4rnVf_n>=t?0e%_kLQjDo zpvd(y$YWWjOW&rgn{uZQS`!EGf8Ij)A1lo;TngKi&pE|)equ2~&9mS>NzRYZOg+q! z2g{}!6P73i%AMZ>wLm$9_N|y=R^chpUj+1{i&2SMHj^r^zurAE;;OD+W0P0;)S2LBDZNgw5Xpd+hiUXP9jUOe)4Y9?C+>7hEIbYCINX=Uf33rv{S|hj z`A&FAc7`ko?vs}Fzz~p(3a+43V3U|2##ReQ|M7$qe-Ypmkp}<8P2Pf|AzNj$;vrm( zWs!zbYu$fw`qt#06;Lp;2ys@HU_tScqfs^?GnPIY_SqDJ=W4&CJq>kRbVnbVGgJHM z2b(#1W((+*b6);rw_D{7e{;gLYH+R4nm+}gH9lMt|eD{Y(k4?V{;;_uI0_%=?R_Om$#$lO(6gkEXIGNo0zr9~& zXT*6Hvqz9JSRlhte@#gW@uPJniE$b9!XB0kceNW2sNdG3ga@T2D3*1|E|TX}3ONC~ z!_`WAqWlCGhR_Jf4;E@s%*-g8eueptk>xdKQG9Za@@z-Tc#@61TIkZWE<8EXo}orL zju&@totQWXm?pN2hPLzBVVk4i)KoF{hf6wSO-a!XPmr zi&SYsh4nJBX_M2#01;-2WcQk1&k{DuPLkKok9zH+#-PqRt0M=YwmKhXZA-Q{Nme3t z_APQ;zvtwIfAu5eKVr?Xo$@_5(vaiuLKmkprHxE@m8ml8M(L0?Bc0Az=!ij?*033{ zy2O+f+*2Rrb54O8Y8-wYIW}YyajLfB`|lo&Xws_0_utPb#cIo+F!Vscbke4C7GYzs z{GN}va@DGFTy>lg>+S0xuQtdk&7=De7iE&(!b%3Re|NZym1lwGI5-?wwI^Svn|7cH z56elIk!eG1uSfmIV(qntBXLIy?aqf`!Gh2Z%C&|7bp!%|NZ;^ z1ESPlT+H4kEg4?0Bys&~1}Y<(-_#urPF5u8b^oP?e^??T7-vj5eO_bb5MYFo5L42_ z;Q-W^f1ZCH;Ksp^(NwI*I2R3iUqMCqq4EEG0g>@!v}2-(^@SixT?S4CHK(c z~I>;PEz zDswa}+t}=o@QyVrfVQ)lY%QDKI9s1B&w%<_chfV7Pj7p+m6>F9Q*)fJ|^aB+=(S1}}5*@*Sc5s{cGgyD4qc!4_0v-%=Ubh1N$ zx0%O<@jz3uqxQ2|+eY2}1;H{KZLc|_eycF~${9vDOBXuX-3VF4`gX8#;v*P4ol{g1wpAnY%2?VAju0b<>tXi18 z17vEw8jJy7hw>+#-S~6EL~`!TUd7j8Anp$VCHlgU<6d)LgD3Q_wG`yYU6QGn-SMb- z+_Ts#MYeo=8=BbShKDUaIL~<#e-c->c_s6u5(cE}#CknQ{;T1;ckfYYGDw_Yd#Q59 z?X_nb9!a(EVd!4u+9jOmjNm#oq>)LlXz8J)RW=8{@1nSMJ=R_+FD*yf!{<6%muSy# zZXNSne+LW5?fx4=aj%_rqCrlHx0FEkpuHa__>TAGT$dn zh0yip9a8y&FW@W%JT-}<4wv8{*)onz$VKqc-MMRDNjGq}fqmL#6w;Clt$*c^hgFw1 zB6QS&x)rORP7_iddQ^>5e|A5v>Y0VFolG;^Lt8IK%AAL>l}NGiK09V+JuIzObV-pm zjxS`Uz#K{4cY8CS>RT68Q9ze;T1#~qU}E01|e#T(RWjf|6 z4)Z;TUOltZf-hdAe;_o=PRb10a_IynDbzK9eHRtSNMnh}#8RJpJM8S}(%9ER@Iq4E zfZ4~+D1k_sws6;zibT6T*=c^t3ip89awo117;~#508Y~1$U3e}V5w0Mt_+Bnp5!Wg z)`hs#-Xv))G~P1zd>(`4oUvvYlQb>K3umV^z^|8yogRJje-^PE8?4F4`YAo|KIPONJi8=8zgfOxZ7)^8d zlm>vd4D2}Qe_4VT2)ieOl`^=TQWBP{PM{hks(VsQ4Eazn*YqsinCsl9X}gd4TizIh zPrTE^uxpGg&mQ&ohOdwMm6?#&ZOoMgZG6DHoMcGyNM5M%A7`C*aips^N34$!k_I0r z=C${hrcD=E=rv~!nk*g9?lEwT`p9&#nf!d8JC%($f3AbhBGm`E2)l#c$tic1S>I&f zz7*(eOZXM)2vaYisdQ77ma|C~3|sdB8Zs&LJ)JWwjdAf>*R+fnGrqTyELpL}IIgn} zUO+0a?L}iBAx;A3-ZW>7%Bi8@Vt595C)R(E3!s8{g8J#99HDI_f5&Z-HJ0-Lf2SCw1L!IszcB_1$Iqc3yG!-$*^&;*0mbQc*17d-!>{N%U;0l$ zvBGDXflan*1}`p&$|YgZr_m{JoblMd?J0Kw>s`=%T2?6&F5;rJK1=pZvNn})Q&x^g z3AIB^L*NG0OkVP5$16hDFERL=i7j^{rZ@b}f65QJQ&2zyy#ym*k*H@r`EuQRh8KFc z@8jssyB*All%(ewU}@oNvbuP7Q|mtbGAcGe-?RnRO_K*<@Z#L44rTDO;9ddRV~uIZ zC06=JAo>yi{D?0B5&h8RVZdr+Ln`I;ID6^ zfHZk-NjOP%p=`MLZ%H&W8N8cV^j^~qY6g?MHeafYGjU=|B6{GHX(a_8yeMIh*(jOK zwRH*An^`n@xpleDd-NfhMDBbwkXR%Pf9=W3MY6t)c7#38AA1L_bp*KxcEBmb9XfXq zu@wKS&Z0SU$m!`y)3JB0S!9hXt548LfY5hqD`bqxXPT7jkNXuh$Qc8&yN2zdndfnv zn@(%+fqr-F)Q;vZ{uOa)M=0axY4VGl_@^d#30aciW_43H>F!HaMeJhgI=~mA5zpBL zWtHIWb*J~YuA5Y%1J0L|;08T^=T%%cRl8|gp;P>=EDU1s%aW%~rKMNoO+yP6Zs8O_ zut((6;_Gwh-9CrDR4RoNb#R>acxzQwJ_Rx@-&*nYwJoyiAl;Xni;9a) z=k@5knT{yKM-e3D6&x@eU5UHO5pN7Q&rOhZhgYAm=QNf>zHJz9Gy{o$U`L!3VaZF* z;1NQ->1Yo*GhO8+nDppeEH?KH{1;7rJLAYlvCMZuc;)P ze?KjJmDjuC7DjLNmu}0$vyW6%Ww8r`_PW02#2HHE{>6+-L+F z6g3h08(D@hGXaRX1^5K&_qZ;;X-Hs5vjGveUEYGx7J4+QEzYw7gRDIo^s^!tCkaK~ zd9W09d{$P+OonD8>Atz}V2I@xaWsM1YY(nm!{uRG5jjLVLeo-zdYMto#z0VcPw2d; zsN|x@`L-YsiyP!R&rFqH#LbO|JLQv}0ne``RNAz>*^$6RV{^!)S~}+C)7G`y{i^195icn(OANr<*+w+Sk#Wf~M%1sM#=wPJ8DIIMt(#}b3-&4IY1U$La7d%7Y z-C>&+p!riAjP(4GXGDgF2*MUA+72nzAhsF{s7w(}FMR<;8mlx#kYKE0pIJEM$_?(_ z$;|Vllc(J~2~Lk`qO%GTB@ua88{#*M%P1C$x?)bwD?LVk2&FK~2TDz{(U+eUWnbGJ zHs$^%YDz7&0Tdj(nQ<}%92QPN*(I~G$f(hhOq=w2>^2nFkUH9#c!d?5Q{sp+{p4E~ zl0MNW?{Mdo!5vi!P*oJ&A(Qzy%yn5EQwVigMpZ5#wZ6>R>=_^es1B$#z}uiZpHX9E zFJ^KOEH!?A?7R|N6DA&vh3>e?aOb$nnhX1|xIV4xi)SOIg@RO>8fz?QnBcwFjUmaO zxEr~v&$~|U^OoHmEx~{rq3KJC06;Q19cU_C#iMgUMYFjw`76f_=^~HDCDE^uX8_Ur zA`_=8R_|dI?d0cJS#rUE|ncm|J4>tR$P|( zB|Q0SO`SsCIC-I>@p)WqofPjg-=P4?dPs$htWVsWzJhGDe5SjcUM@{vJQd%+c;-UC zb%4T`qZ+aCV)|*1v_Ow%J-9Ed?DdNm!r!dJFP@ISIbYxP96!Ihu=(`q|7HiKuZ}(* zjy~ysCe1GKYK(C)h4kM72?)UVT&Pp%7C87-;vurT*OBtvql*S?8717y#pQ3)Fl67y zM;}*pO?!Jy*|9&X?7g(H^ULCT!F~b2!n>?#e#1la?#myV=6dEl5}E^SA%`uppT2lU zx}SanK6F2QvF>x)JAkhv-Q;m`Xb3|`$vcdH!P~*_+&A=K3fX9fC*&8uYDVPz0@u!n zq@QmE_2v@@GwTdmiFs}ZvNWHSymG7~?$?^PNin;d()BWb z)_e`@TWf|pMfZK3$_q?(O85FgEQwbGtJxPA@ORi`y|t*nXxth&+wUr719}F%NY^wl zSFRxcB+R6VGV-!f@?>|gPewDuoh+2SKnMy)a@OFh^7>|F6j-F`iv#-)6{WQ#YVB(< z)z@IEufbGbgQ>m-Q+*Al`Wj62HJIvuw;D`kvF(yV$ZFwDv2nNXioz#Q?JXodSG&^; zW+`S!KX8j4;cSO59WwMdqU?-jC%`oSRiS;^086oB@oooK*^!g<-q3EV)jDuYrsS{> z%!~*g(Lxify@qN=q5~HuEUx+Nch@&xDnez(@{72C6rWNL z!o0^Ir#`JgbfF`uG5GZbq{O_2nPFIN=tpOV=0@DB_vo<>E;K?FmlFq!Zv&@cQRa?d zTl7%AZf>suN za5j_{B?P7oi7Uh9m3~ImLa4TX2z_N=rEuqh%>^N2cD0{DrK=xu{gqCIlc8X|gHEva zKb?o|pJCzN$?Vq9F^K7YTg#n*)0PHx8Jx$}2wz#rN7wDH2A&XS&uhnPIq4*y8i?k%D0Lj4*O5Xc`n7aGV6V*c1QHU`*QLlb?JzIvR*c=2_OR} zYI~s>q``fq#9YN$gZ~h_z%DD|&QVNl1W?00@vUT3rEwx}(*p>Xk5$KD~RLrE-l+XCG9*L`(=hICIc=wW0pTC&+#IaKLhY!$KduJ^8oFWJQyGo2cu zGCJ}GRF*B=Wc(J60UdP)7C7B7G|z`?IdjpegZk~lW1x;Za%c;`KGVw2Wg{kHGiQG{ ze`kNAYfdz?yxFY;=Bge49bxCS@Mml7eTK?5z8g2#-e`DoH+qTs>Z7#0#_X*y1M`+VmE8QjgR=4hd zn;X|k7Zz=z`&?G=5Yk{GQC~dRo$90moly4zL3vgh>&?QL`1rxoq)V!(g<7Yh`WT4Y z4ZQE2x4DHPeoPY^Q6s9*e+PrXQE0kuV~b8jaiifC8}}PWK;IGl#ZG=B?OQ{{e`Wl6 z9xr%N*D!rNdC~@~if(;Gi@mMT@}x*?2t>V`y}|ucrybsMn^9Dkjrl&V;yh3Dtllkd znNCAn>xL_+XRFbM9a+c5YA z?KJ-(_}zQ39HsZol{A%iIVA4?e{v6$re6e&U+$se1pgFs@t1r5Qj|sdZv&259d-3* zRVeKJMdQXgozKAO)|}qOUg)=L+vp(7*Hu~+ zU8y*Pv-9dbxWy{0dUY^{)+24o(B(LHI}ycVWd#NAHZX5+4m}8`Rh225f8;19`Obq6 zXA|tSa!&re|6GX&Ki<)Lh2%P20RV2gZI3%eINi^9cBQu{(M3Y*`EU zS+cBw9EkT`vk7=H=J>m4f5c?4>N_+jXF4oT_Zkg1Mp~9Cty0$>(Bbiks`IZg?vx!( zpXX}@d9RQ^Ef3f7+mNv3p0MQM+Uyj5MDBV-J|`>hR)?OMcy!h~%Og66woDYwA1GCI z;vp~Ha~_-~=#$0vpfw$lqTHK~SX11JkqI(F(Sk*^3gGA$cTn#kfAL4%q(yUC=Iw6n zL%Sm%5dF?V1&O1eX{+>+x9ic6TfnVY%6}U@+?c7?W2tKHJ^;3>I8gn8zo7eR|j={xJjR z3n|oq6#ed%r|WI!e+wp8fyMDD;;H7bLZGcU>%+zC;0aoPgB>7i_OE;Jd$jY2CATjr zA!E4Sf})xD8(md*3WxpYel-Zb3SOKH!3UzOm)b6ywW9$wRwXYZE#tzgI4o%s{3QjY+ER+K;-b}PJ1^TYx7fE#?Jr1eHRo6&M=we6By$m0 z2_7vqL}!@be=dD^oU)$)bSgDOPxwQevUPd+%|X;U3O<71A3^euAo|Cp*^s5A^vX#g zqQEiUi+f2!K{D3=j++fgO;7$i+o_w{>HBc#z-cZ}r7xH52Z66=V$xEk z-P${nZY6Y2=BC$Ly|En#G#UUk)($9(a7~^X)gcWDwD0dOtl2`b1c!;IwEnxtMPnS;~-B{sinL!OLa6|vP(^q_Xb?x ze|^v+z0|F^M)dt5eEc3f9PPg*BmW0TMs9mi?`7NL2OiW-95Up2BuQM7`TYF~`Obgx z%}qWE9Cv8GbW2a`B-iQa<=NCf43uQ&jSaW9PnT{QVNXL9V-Dss9R7QNll{Z-@$qF` z9an8}oM&f%BQF2@ur4>B?tz#>X$Jt6e;gu@96Vdi#0X9~j|7ijq0oEtSCEO@&{op8%5NfPev(V3 zkP(@E)1|6bq^YbE-7Ww>2Qcrr0w*xpCPPUR`jy+ZC_BFfkncFB7X%PFf88|HLvhgW zK*Nzg+ZKj>!~sh{cG1;ETBSiQW)NhZNh|dqj#o8U;kU>Gy`a}R3+E?VCzr4rXAErNiOGSHJ}d;`3H z78l7?mWTmv8=>j`e~sQp=Q2~>kK=o0Q1~SDc&G$tn=E?-Iw(yYf1Y5hgh>I-+e?vlYj=GU66A4K!yIA9L zS>~c=b6=Gn-M>&RqA+4)e<4;cbTQ|-|vT-iujoPc--+QruqFqGXL z4lEx+B!t9>M2BRBZ)(M)MMo%5=3(mDMo8x&ir4c-uQ_A#r+VkN0NFgU!Ww)@h7q#u zfw#o$663P?e~j3z%-M_o7L)4Y%z)^PPxV#2Px=Z6X)L|Pu!SlS6%LVz<7H51mt>W= z;^sGw+^D!WH+U^kfhpa)=QKm82hY)*{3EFC+frq zCm)||DekfJznBJ*IL;0FU>sM`*dAxq^MthcS^6>6+Abm_&to=5U9?+ywvb;Bryrq4 zht5Eo8XY#%?aMMB+;)c3)g1uim2@1TCul~|5Px*M=Wka~+b7PurXIBRkaWAtCT$+{~K5Ohqae9E?=?L^gONn)-^dAXhi0F z!+jm2H-#5%&qdoIn0s+?UNCTr-do&NCYU+ye+;un8Y%3+X^*>LXjQY?+@N1r`a)} z_jrun<7M=|9i#W{GJ3xoqxZXI^nO1^@Au2-eK$t$yJhtLFh=hW%jo^{7`=a9M(>Yf z^!~Vv-uGklzF#<>M;FNBN7EacSeP?gQ5Wt2k@OIm*Gt~US5i%s5o!8{0=obZ>2@O> zVy>oKuv3Y|b$=C)%~WDou4cU1Yj~P@-V5K?Qxt6W?GY;hM;Q8(l@2eq$|et1L}~oP zOqZ7=_Xa?J4|ghka{)_LtkeYTqTb39=tLCF zD9YktmgLhCiW#(P^Cm9RvaRz~Rt7vIt-Uf#QSe;^$dM{w=q! zClvY4j+CrCXwhWlogF2eHBPDf@xbUbf-OIXZ+yhH0++LXHg4=_?)=qFHx+ zRE#!g`GUCXBVv4v4qhi;=+R(XFD^$y&s3l#u5dRMRPjDv!%XmV+~9LSj9{fDda9q@ z1c1|jmIrU2oV;{QwI=$7y!a6^QPh(zZ$VjQTgc3llHY9@yeVL26kIE-!MU-@*ozv_ z1g~HwTCQ-e0R|`dGENUjFq)!?wR}l>_V&puk}ts!DKnTP-i27+ZIXc*X|Hj^fL0A4 z2Dyzg`n7CxS2x+IHl3V28gJ5m|7gt?0k1KCHtV(L@l<;ruiKu-qij}dPrUgAzmK3FkgLOk~(1oU!g08$M{D$i`(iuHLNA&_)LcLy)Np{=$f zWAYb+qn4{E)I z*2Huk!Kav?#=R2s+jOC_p4+Xe5(2=nP16o+8a=1BY}cJM){i*_N}!jBEZVwV$$FR0b%YDQf3j zYI-!L@BhQ$SbY6oyf=H?(idF56&QD%pX+f6{j2m`sc~9&dC_%Szf+gZ>6%XW!{L;h zyVnhCI9+# zw`q4=h|&GoXEPmk!@d<)KHsY2yZb@AwXYaFFC33Ssj5cid^WGvk<)}XVf08A9wkFU z*R!=Rk2~|(p*&#Bt$Xhj=BfvpD*O_$0%0|3f9Na5gPYEn@mo#QILq5=ZhbRU;oOQA zw{>xb&Ss~bGty6go30K+;qWpnNEi+d4P5IP^zq|wA3rwUK|3ys9ztKq>aOsoQ^uE` zEaP^kUa_I!X~wpsB$mdd)vPye7l@~ARRQ+ZUR@6*99P$u;45Sz_c(${c0@4#yb9V9AZ9?D zCkV|6k>8LFl<=%dL{H#ywZzyez;i4I2DI%CoQ4$7kX!01I!WHatxEZWxM|YezUdml z9Y#50Ge9M(8SaR%KPO~z4?yoaQxoZzd)u`6Sy^p;KArM`T{xA17yCfnS)XSnx;!m0xl2ip2seT(onGl$GiY@_NS!@N1c9w1+JvP8M zTp)59q}io;K^`rlm&N`Ouy+f8B8j0a;9800ZxM2r*$<#eF$djRrJFPZj0x^i9&qYe z1f9Tx21L(rJGfzA!EUGkSGY9e$VKmm+qCf(ukMR~$L6%8KjIc%wIeTrQs`iP&KNwC zdqE*Z7HI>g!`d`a)p7^Sl$dQz z0L=h@>DTyh0P;78g^l%?k%Y6>8aCCt)Yv7v92whT((TILoTF{2DG^mm9FQ_JMIv`o zAITl1J76SCT-JzzkzFFgTIjtixSwactN}wN;eI-_5a1YbFZXO8P2q0t;F*lUxI#?a zNU-bX1;8H`&L z&!$GrJQnKH6jQw^^PG^=an`;9n$Lces!KSZnS(2gJR_QlcPH|M+T9hJf9-X7Kba$_~WVtCj?+tC;_P9fqmv`1bEsBVWHEB=uU5U1`hEE-Fl9H zz=|j&#NBTudHJMdp%W88b`kguf*xQYi^=~9!Lan`2UErO5B4#RXW)Xo`7y)FV8ZM; z6>b16k6K$Gn2cccNG=zYym$jthGSL)b;9xodI*veK z(A=smFu5!Re9SeIOD$}uB&S_Mu-qU$%185QC)n+q&1Q;riwMZgj@GmcUS`3A&=4&V7ghnK-l59$@n z#4UB3R;(mUfLsb8oq0`Yf>XGEi(-&wSxnT=iX^>umJv&*^AGA#dfk|hgO(>xx>|e7 z%(p;isf(H(c6Vpt?#%ra43iDdyc}nRt;h#+4&W$R{7_~dOhr%ncg{qo^j>dqgd#9r zM3C}o=H*Fl7alu|OgX>84s+Vwx)5)_O3z_k_8tyezPq5~B5e{<(fde$x6Y4nwl^`D zCY8>jL6IE=4WwU-F^Lx76o993{loFG*q!Q-FRo%g-W`jbxsCH-$E`fZvIy$ zB~n0DQAt^v9chrlV1hU`!-ckLmqFbvPID?R+zjk*FZYSqyVCsJW7AlPalGAD>DDh) zU?tXPZI&lfD2lhp8%})hNRZWd%Llm#@WJm+3`67mJZzJ*yJ~QM0!K@+xq~*JXGQY) zxr$491n;fr3{~#$qRT-9h%1WHs_JV{pOJsLy&J|m13~2TaTfP5@mG`HL65^r#~tnI zWVN{izIC*V>pSUfTw5cz*Uu^e>0fuiUhL_SRC$v-;%~Vwe;)38Bg@-o;#!sGMyj^Y z!&qEX@>*XIXN$5_C!H??#4;G_IPnG;Z!r1TrrREw;`YKa1Gx}vG*GF+I6lwC&);R6tC>-<1^ojRIP&!V4 z(M0qv^ss!d+~nEVQ~dPY2BGI>HOk9O+d20k9TE~ooAetVGoYB zRZ%aS+1*naJ!6^Ef0ciA?(uQ@q~;D7$e&l>P^C>nE*1AH4v|(0UaCCqka$mrno7P*Mjo#mNr^xf$r=#K2s&$fxShCJk@ha(|Q6f zWPL=ZZpwQt!~okh2qx5ymqOouj?ydnc=I8t`9&?bpM_}{e_TBXwv|v3QgCFBi{P=% z^&$e-jBr;k9?VIxVra%jEHilIJ4{56*I$dpmvVFWB+z6v4x<>1^m8ekO$HDSL}A^rq8a!WPeNfQvoG$Ba17&7RH8<&|3 z88YUIRz#S7Yw=|6Nt+hjz53)m&$Er)i78TFXV17Qp3s;_-ii{Hhz$CM##24E$gG8n zh6wvpx_ir9#T4-(`$J8khx=TNKnjmZwh$PuE-%HNe~WhfoLEULMbO3L0trXd#qJ6R z4VFxJWF(!0tCP|=IOIvaW9c6uZC_l~G7gE41^KdBAEBR&AX(Na&DB^OPTw@(Vvb7+ z{Roj9sGJT=?(VGE{h@4Q}>{Lr5@g`ZJCj&=>iPUjUHt ziHc2|f6Z^TB#0U0a-|`!YwX_9j^BD|bo3bFA-|rG(iTz5^bawfK8rV7+gXSB zXK2SrRX^TP=j4_I}dw| zf5u6ZiM!6kMB2{?g3WUiL+ZS5sFm{H6TRZ< zs7IB3c2m&{Sp&B;nq6qj7~dnsuDG8tLG>-vk=#+&P&!!52*mU|Eo77}c*k)FxlMmw zWQAcvaGcDpSYtrlXOD5JaFB$ysE%armn!Xo(?QdYlLTK>gv4ZoFt^(-Gy|QkfBWOI8We}T4R2m)Z_xM0HZ)@(CiD=&#p(jRK4POA#sr58;h-Pq(cSazWonYyH&#r(zLB2{_T%PhfM zhxF*-JLQq7sUI0b-*4Eh5C6E+i;->&q zgYOey&on~957eiP(zwS~QDBksLg>UL8VXa&_KO0O^Cwr&=^r;@z-g$n`L zIo>k96dD$&vO`gZPjaL`ERbP}i%m4UX>|^Nfgl}JAWBHo7VRL~)7&{9!+g2oI0_78 zXmVZ?2kAhAhg~}SHK#lIf6k>C+Mj;sP0!8`Swb5Yw>;=Bakxs;1cgZIN3XA-`xq1q z7sI%qFtem(RFFp?5qcGoC(jD8L>;x!fJMz@!`G+zDMC8g48_i9#dM{jpW)-W*q{}} zOmYT@OmDk-06BjD!LmC|y^m=PB>HuUdqEr@gqC9Fz_iDf@gCr~f2r9eQ8e_|k7eSt zwd?jOam(dCaGq6SucyamvE}6AbZj1ITL{|{I?+rBY*9V5qM^IX08hIt0=x!!2>^9{ z`GZ27opaclP-&X0G%d8=0HqvdnvlYL;KT%~bMKnt&i1yA4bb+~4zAXsdAx`d)(472 zdHm=;8>lMB8#vuif4MAmM>EtGLRz7X3RL-3C@x^<=@XuBe^f#?&bbAN8;9GHe3s_% zjoK{YF*m4vmF;42Ps58nW)9fj&=gZ|F7r@H!_A3Ag?8%wf5j<6im9zLm3t-^fP@+M!Wk(=;Vm$r*LfAT49LtoxP^;=+zu zG}Yz?`67*zC#ozRvx}Tay;6%;58^Ypq}rbv1Ei(&y^OuIXU7&(_{2$4;iKlcx8w^4 zR{?)pL}3GiZbi0V(Je{4=~(v=%hfK6<-yem>-(a8#udhYE#=DfJ-P1cD>Uq~La)>c>awHnc8WDwBB)^&A^;z2cXoEN4R#zRXKNsy;@( z>x14PjmLl@zjJWFAvuq6eIaPxCTZUmSYLmnnAoGneJ*$^D2qE6xwmuf4{@-oN3oA+ z+(;6JUw>qgn2ge>jOeC+iANAEYbEzo%1J;+&my4MGrxRB2g<^+&boCJA7kwmD0 z<++_PdzbXhrz1Vy7g&b-QjqT^FY94IFFYZ*Ik0H79q-k7++a`<$D(a?5L>557W6d! zlW!K#Nsxln^5CMzMV)GIiu^_!QE{PvUu4(EFSDY(o`3w{%&72m>gTp-zGLp;+5bG3 zZ4L)Ge{C9(472!#RXhbaGyal{u+$1hP;ZFi#OS;-Ivm*}EskCF3qG}Q7&`&4%Y_7P zfq8ir=R!~T)aB7YHz+Y}pp(UxgfAGSoQV^unrIDqVX2!T?Q)bcd?8VZEf8oCdTiM% z`jD^=MvhNpFdFzoc0`*?yW@Cs*h?vKV+hW7e|Q!`ANIbWvAR+zG-d+MeL6x0S82&J zxCtPI*$joCFg`t+QpK3dW z^Q{LYFg5LrDTi?;w8apO-jSq5Riiix5`Wy)bm3I;lw*wj@(JWDz)S}?O&ekq@u5fU0|W)6~k-eUn5wQhWE2 z=0I}<*XbCk!tABEmp(n_LLS{m!PQal7R&z34j@%p@5TQoHB=Nzjsg|q24_jrePPd8 z{6&=!LxMRQLXtU*H+T$_86za_6R4+Zf1`ygW?WY#S?c2SflL_m7o?p$gq9+_p3 zG5$huL3Ka88lp7Said63Vl$z!ClnJSBdpPiIwEFU4`mdyM%-v|5nv{Y?xNqF-Tkvj zm(<{rh_#6Os&BWCwq8=K9b;+x<30ml-7kFQQ~0e<;h*Q@aNPvfN?tjaeCu4&e??9) zhbp&XS8m1Lx)qy|&6s(WSLrLS(r>*=|2z|df!nGFQr6cA{&j-?mL|B=7rsvMuT%UV zbc)+^&wZWbUnluL&?JW&9s&w~o#S8U_&?|zA9K?;b1i;`$CWN(M8^6zReUaJ9I3~a zqb?D+%(iXX>8J8uc|Mys3550=w;&M*Gy#7feh=;rzx(z`Os9QH*e7Dgp%>}~kWawN zWOE_3w@uSlDZUnWufrNZ5Az3Xxh%H>w0 z>3e7D-{9vduE%59fk#EL${@tM%!DQ=CY>6ZP8RMNyChuCUl8V&pxF&M);nk{J$gaX?>m|5CYxBdSl3 z7F%&+GrZ>h!En$LL3bPB&)}@`F56;si-qsR#%HD1RB=(q(zRLbC>icy2qryG z__gltCVPc0&>DFQ&E8;zu8Dr8*kyo4Rd+77Rz`k4;T=0#*F8>F`qBXvODunH5}I7x zIuME;)_=roru&f1VZEpGu~DDtJHr89`e*91*lpjjE{09Kxu85D=qR3EW*Y;~7)#8r zh*ym3O9T1%YIUc`Su;+0q@LZ1ij0gIU6d`lA-CR}u8fk5>GmILi{@dbHv zZGh_bE?+PZjIDodUIOKoEO;sWh_HGzr z4pIkGEKrH@MjYuv+a(0!^g^USx9whvP#2Xx!LMFDIk|l7t^YldX|g!e6xsC0opsfn z1yGx4Rv{`THKkU~SU&x17K>gUhWoqv!5}MKhXPH}bbG1)fznR+awvrO^MTRfKPt~^ z3NeZSSf(!Xw&AG9BZPn1w?sm6vp%AB@G*uAV?wLn)gLL3C59dX_6~Hf43DH2!IAh# zY`0IsIp(PY9?NFR2ExM)Zx5IxWe^LA6ug+u!SAZUK_ii|H3_-OPXuaCxce4>HCJh# z1dSC?P(k{e%xz$9=UI`#G#*Bh_fv96T+vAO@S?4tyHr1v39x_kG##L3(nA|Yy$AoH ziuaI@XkXw&Smz1@z-x0rX1H29nZzg9XcFI8O1jkLYj^QB5-?8fgg4DyXj!LXB zi%D^rp-d{Ceba|7;~MgD*`=1686i>klj3M5S~5!=BsiyHEYY(Ib&%Sp39!&AiWd)X z4)?Ac_K7eYT1kJxF=4UXe272H3!3fa2Jbit*lWdM8EbKVXsCr)8Hj49Dp}Dl0Z`W) zObMxu>7o?-w^;E2Yye@+mp7^c$LVe0=!5ll-d1QqPO^Aglyz3yCvcP%5p}s4+T{gw zECpmQ7C3_CI5SE+I=;x9W?nM_kYH~jp9S|~0Lg|rPq%-K8Af?!vC}55Osu!R03#?= z_*LKe{3f@vYZalfLC`Rn_+`Jc8pLtP)aU5B6}*><0`kz$`5yj(po-Ihs#00PZZV&k zn&l_2OoLmc`?%s0pAAv{1s9y|#5@(^Fno-f>a3f{KGjbi6HO-Fiz&N}IFrwzGK-_4 z6(Zdz70rK?_$RzPVd74xk|uOECUD111C@-eMwEwG$h2uD#8cozGchh_1QrVu{{@EZa=$k!{(BjgtCtL#!#i-79E4Zxi0 zv|HKt+%-9P95fF5|7@+z2%gcbJnLlx=vTXPifMY^1L^LR& zJG_571wveXo{+kJclTe;rkg>CFa^tt4Vv;s%@BNFWI}xiUOXEB5@mSZCEFWdz+`k>R}08k$YiQkeM0q+0=hPFIA~j1Ms9j1|uo zdhJB3^HlSoa(ZyXcZzzS!+r&qf4Y}zTNi(LA#-vNPU8+b(0N{7b?I`*q&z^LA+nJm z3yDNMEp@m-DnD&gv@YQpTDkF{0gVPi4h-zKPnhY|PYlzs74gapyd>@2ql!kbl$;ru z?@ww|A9`*nW{IXUa# z#qpaXV=JwXw1@2@w!mJiv>LSMQ$pIh49em`82o#-y&&pY18w@fsE^yAK+ z-zfPgZx(3PfjIV?TyvI#CL^X+?_C;Nw1Y{K!*f@9E$&YM&I1R0(XRp>)!SwO+zpx1 z7IPscM^F3M^c-1|vITFG;nQ{`y3NfnKenaFccz#+?J5II%qG4u<^q45E@~>E(haE= z>TniL_%^r(_cNJ)y?ziH2>R1^OjPUg>^zNNxHe#!yE&`_dHwL?p#BWS>K<$@lzEU- z$5d=CGcvrrTEhpTp_ZfDcufTs}RedD4zK-|xnr4a> z1}1ZPl_<35r!{dJpXX)V^n1@tOK3Al!h|CTUss6Qrmf(T)$T9@6{+iSBbNMG+oUq3 zw*E{$Sl48!*J8_R?NP^Eqr0-mniAhu&}>hSd*~6@zu+Tj%A627IlnRNq)7t(zYZm^ zbi%WxK#ukNc)Wjv&B2s_HwuK>y=OR3w0n2V{+F^fv>5?u&Yg2ZErlxpeBq<<{>#(X z59a#rrP)RP)IB;>QuOIkqt)om(rHTTH{6TCvK_x8@3@=d1Yf>1Cf7u`jD2rp(o zh>Kg5HvfOO+3fE>{`Q~4N8fSpYUThJ%w>*QdJ=z%VePePk=fKVUi`UKAi&uRi7G*^JE`G%XQ@yEi zqdkOe<6K;kqV-ZSee6+m?;(lgL!+ZQ3iP`_Aw_=&N9X-MzmXJJOowEU07KBI47-)G z@8cu>L%3(cmm3TeZkvbY`9raW;mq8}U`bE&>~Ew_rT~?c0St?Y#9x+WYBOzFww_L& zjz5MVmzbmz^GjemsSmp{m{u&?UZ4%;e~R)OhL4tsgDL%Y6$XDL&koE(g3oV{x=a^w zu*HAu3{|j=_bR6-GM2euJD&BhmAPXppRiMNlChtdWQ8q|NxCT~X&3KB4zbu8Y~pN| zZkq`ad(TZvc?vm)&Lt>?=fv`9BDRL#5y(kDF2Mf9(CS^YArz2jotS?m7^5=qYfZ(l zv0=M6Cm#$T5B7B=C2}0AzIUSFh-eiu(5rvfMfk2f0Ll=*4YaHA8!dO+h~u$(;*fqh zx+bW=2I_$fUTErZvBe;V{XQ)$$P2}J zX)jLcPgb5+)ODL8ri;?d5WBJLjc+czvaoaU*A-6!m@yXy^3!xFC{N|^hj=Euom?C( zm`5_P*$z{*2T6B#w5r5hLSvBl@4f;!do|MfIDsmi7l>a=CC&bxx8myUk{+&_UX z@>D35RhheQyO4;z;K&pI*K{{rBMX-II6kPu0u1#DY-BRIsr3wPotA3?@ymoTw2}V2jp4a2Pr8zph*?0@g#X) z02WKID{Hk$E1#$%_70&aM-_f2_KwbD2%VEa4DhUi&cOxKQrGKuGR?Agd0Q>NqbAkq z96BRR=4jJ+yonf=#3MMv@t8R>!}a(K(vC@6sGch5<`@G#s-SmQQp$gFN?WU|o!x~s zK2u3-X*u`f;!rCU%PPH2H?5_OXXg=8Sn8o?m+U;w&<(Dqj0-i`RGgqd1ck-wUrhov zVh05D^~VvGp7ZEQCHFo(*oyy`mTmnY$kSpguEabEktAiy8{p=(spC4ABqVJPtWC%( zM_w{q4wmi~&SA$f-12{Nc*3v9ljc$Qh&-i~8#wMBtOk$?pu35~+a6xd$?f-sa&XDJ z5~iDjxAHA||6u@JUN$;V964l&6TGp2L1Ck#_;TxU3^A<9=rB0-l1&Uj*g4i?mld}p zL{`kc3tjp=g;=k)q9~-Q&YI!jg%y7ntUZGFUUlsWlF5N< z?^KbnuRT|V&TZYPpeOt4fFn);q$?Lj!dJYtmD6?N9j=@;gqT}7z{Ax!jjtkPAXdl! zPp7X~(WOB=4-V#gFG=KndI?e#g9MC7d*`uIs@7IjJsm-AWw=rKwTIDoB_xW5R z*xnOd|3&XCZKk{}R}N$QsL|72?&PbT1T*14ZX^0X=J$V1={GsMq=Y^VHWDptg|Euw z`z6MKZdsd)bQiO8)>hnU95ML1OsDej>d2})Ij59{Vu^v)6~d1dCRKHtKEMiYiG(DK zuy`OYnvC#{51SPlWa~5?;^D|2XT7H2c>ex7aVWDZAKW-)6IEAoJ_tna*=HMR;_08q zF;))0|IUA@fqK9q4@x&69ipH7MbZPrgt?$6b7Te!I0VC{*Za{y!!H!J$>Hx?E`eC2 zy1sTji)i*!c;AcTH!=zE4ZWgGCBik8V;T(UZPEd)!OyO`#XFS4q~R3C%Z@Zo&DK3@ zC<>KKD`JhHfl@*O8~s8nE?C2mgu`Ezh1_xWC`#Dm{?pWCx4mwri@inwA2jXQBz21U z3W_bGm{11;+6#@vi<2Nul8W8{dk;LR(8-ssB?l*edaggtsn<#tmY+^(1{?)4*p*G< zP=j7j#c7J6m6ZOh0>DW2{bJA@(55nreP1$MsTumxV$%Wu$?8S(4Ez@8WQ6EQaWFc` zZK%6z34FuDe0EjEd-yM48T6Pnn>~EHtr=IR;Liy&4uaKqZgC4 zV2qG{jQARTPTlFj$D{vW_mLfr7*j1~HJsLeA?Q4Cnt_vQas-QxV$UV6AiScB&8;nP z*8!)*8;bEXf&*0rNamuM`AI7VMiEgy9{dz3q*cR~#XvgsT=pYLXf9&JOsZg8`|gnL z4wJ1%HH6UZsIA=|VusbNHGAR4Sz(9Ywvhjk;+7!J##cwBkf*+F8PP3BpPWZ%x7m_^ z9hVD-Td_6Li|f2k#=y!r<&c4SR+n`k4rjv3!@%s1AD1Wz=ubXMmcA}mKE^5AT>2bo zS8Y+yg~djhzs}scsjB;uwE!wPFG$Db-t6|Y*gY_!%=&c0T~c$5>4)j*u*ya^)UTYx zrW}uvWh|Ylk0np|(9b~_-}tn+hqoVp$>e_CvcW9^-TQ8FzAc+8bt8Ivw_uJr%r7{T z{kxjf5#Lqgyzf4H{_^>|=gO`%m1x;BV`azV#p~1OZ{Iob@Jwu~>FJ^!Pu+No-HB#- zygzyN#Idi&@{WF(PGdRk?N|(f+G_Uo8)Ty=pLOZcDIx1>YfUhf0lZIB!j%>dvwev* za3u6wbP)xre*u?XC{oe~ZZp#NV8(%m6Fk8njv75H z@V&JEte{j2o$CR;sv3=ngJL6*2Sklr6~U`EZ?cDPAwVp6i@DDLf)9E~106zXNq#dp zy{g2e)^YHk7~bb8qtK@W;E%Fjl@I9;2I(J7(Zp5PpY~n%oo7{-ohb)Ve>=~v;Xo;C zn{mG?lH2ImUaprR%gElr9}F+TB}$AE4VJjM=V0awdJo2a%5%W?8BMe#3mnozqhjQM zTPD7UBL`7tOnp-RejCi8VF-Cdr@^cY(HcD=SdjwDQxt=^8cS~0F*VnV73utQtVS|i z>J#xo9HF^u$nBbDanwl2fB1!|A72y&WO-p_#PqmbqU|CF>ZmlCV5fqoD|(6L*#C!43&hEUR2*^}P$=Aul_IORWj9)*i1~wXfIZjSEiy1KM&*6e0CC;nIVdoxGMoF}iPWDfbhl+Yb^7jf|6rm+C7AZ+~%q(`~-JrA4W1 z6LpIgTYkEM;qH<$3`6VOm9Sc284VRqT=gUKG`SJ{plOg&rKd(o6^h(Y2HFu41-PzV z3Pv`K&Y&Go)JJ1_4ekagP?xfMM0`S-Qdsk9iG{(>;EB&Q3QTJ#dmj99@S#>_G9XKR zu*o4_oz^$(?kcJIk$DH8wZmUz9Kr6&^)Lo6xLkwRni>Y>3_Y;1M^yxc5<;{!~TnB z<|8P+k!4e$Q+u(;;oVz&`XivDLfJuVe5FF*5#kL20&s}pegzgW$z@O1r5e6WY zC5HH;wC{0dNb-@qXqr8avqB+#{p8)L1R>QtTUUs!cq+#a$6oW&mGO%_*WBErw0NbC zlwkn(2=XyrP=AHmBEPc2oYkXzdZl%S@b)K;9T(**C1U{HP8D#U!EnM|jS2XK@=~a1 zRwiZuNCp-t2;$v5F!?5o>DD(xnbUR|&n(GPcdk%6@?zYj+sKMdxs#V<&%D*D?hgFV zx26-S{Phs2a13Wh+#$$0E8Ne@P7a}(Z_9#N(zT<+UroAx7a`dLd*?G909Cpxg{&Dqa&`gg)Pjy7 z#`X`gd5fA+mMlBq%}N#`>#9x z*ByVQ9e)dT`=LULo31wqhy+21o2U9fc45JUkUpQiJn0X#XkLCaQd_HD0; z^;i=b6s5;>-|8%DA#|EVoX~9EK@X-cplEX-%YV53;-5}@bQ$5PTicFeuipE5Fnv9k z<`1TMGX+Cj*X<6H2XrdE&?aHc8(J!22+PvW?FJK(Lcoyw811A^Bch&iJF}fnJ%rWA zB!iq)P)iK>{_TrX&odFjbm8&@$J*a?Vr`X~j&o3C!GHkD7IpWY7>X>TISsUuz4OiES`WMy1^hGuV z^hmm@jI#sIu8bORQdSt!0}g~O=4siX4GGje*-@o>akM}j>|#uMEK}IC>#D}qIE2uZ zV_Ey^Hira7O_wwVLV+#O!J&DPpS4P0E`I_Njod*}v=zXlN>vQE#%@~6Lm9++k1E3< z)=A-$sJrKJ0X_qG@ZdA$~B9`CF;a`$pov+;ESo|PCTK>B7c5w zXmbhvu(#yfTHT0Au_kVrB&2YNZ{L9t7hKFJ zsmlG{g%KBA%!nCy`$9R-kZA^7{(lhq+MK((fCWXRBH{b3Wno_NawKJl`^Dn^GmG7!ZJAzYDBuL}Hn^ID%=eGJ zf22FeM51~liKf>WSPfO62*+9DpMTe??BnJF1U{C+nf^BaeUA^(vNFzWy?;rIPVP4y z0X~xF4`hw01%(=qle9=Mf`vW}@?D5hSN|06vi!!_ z3e$Y=ddLu!0E!wn9jNR_q!pJ~BL>Wf>763d8xYPV5}&1cZ90F$Z`M@XlDbS^|GEfQBJf)>ws_DsigCDd#b6lWPpm= zbMMlc-+6h-J?6kv-d6uXoh;#lj2hYd&H zs!dVsy9GkUsY#?M;rt02#3JAq1ncK*7(X5lr9F~{fr#23!A=JVKYx31rKxdN{kJ|o za;8YnSGpUt=jYiqUXk;-Zw!}X)mFKA8lVg6oP2c1-9_g%Rcr5C`0)3;>bJkk{{suP ziZ^+>=+viHC0#Q+H2{#U|MeIA&oB4H-Kef%`HNrRpW+wReoh-OX^Nj8;l2CO50Ah5 z_VMwXw@+W5Jp1u+h=0mNQtm{vez`Yvw*7BLPTI%Z724@ftuhY&9qo5_FSia>?jm^o zr3hZ%)bxvk*ne1M(L zCiOrXdYI~_y!vl0q~4|w(pv||!3ikpXb2C3CjtEqS4BwfeDdP8jIKeQg*5k!Fqk?3 z7bwOP08r~ymNBkG_6N$ZO%L)E8AMKPaOumy8vz*0yD8V~!h}dnO#ERru7e1K8iQ9z zjzA@F9$gXkRW))|27B(!{J;_+V1s#>;QjNreI zw_eoc{*=0cpp|y9K@yf+P7O3yS~~|=f3yBH5oE1BGk-BrPP<@~_zYeSpq1M8P

0 z3b4s>BYP(wb>Ov>r=U!lLun!5g+hy88g4!C?h@|%kbV=5Ik~v0yKul>&+wPXJ$mm) zZI6W6{Eg-TFqgj)vOoeTd=tPj=qehI=Um81oM-YFIiqmoZP_&abWacnh~K8oP(q^h zP@$i;Rewzh5Xd6JzGqX3LwGT6xF&;gpWUc4gRtVe!%fScqRfnH*0)d~^yvJ9_o0a5=oi`+cm8d+CAh(#u1mkHUi0nk z?lZ1hF4{4NV(&ksaVe~z&OYQS=P*6seg7WcA2Ss%7!xrcn1~WPv30yURRMM!W(Raq z$4-M+9Hl@0+WQ)h!AH1L_Q)^IdY|@G*BMt+e+wSXKPrb}ry+crf*1wv$ofLw-eV2h z{)sMc`Y|WEZ<5z;)YS&$RBuspOmAW1(x?rX=ITZJdZ>K|L6p$p0vijyHn64r8F8X2&+{5|C?j^PLSVn*(ETl3G~L@HYEwRiZ#;pyAMuiu^kCeZ2G4~K70kG&oFhhfKK z8`xrIx33tJ5^e$z&;4TnVCH*XpvH?~e`skbs5-$M8Mgb}Fd!TFNPTnoE#hb=i0_%i z;I*#+pz3(c-unbc>+-Lc@87)Hga5rcdAH|@f4n_CI}v}J!T&-JT$~)e|Ka4Kb`Bxx zevfoN8PJKoTtpUWI#u_uzQ9dzl&YZ<4T2KV4;p-vTsxBu=3Bq`INkA2dv5T}e>iRx zn4dj2{KjfA$t`B6=9_xaKE!OjT>JC&YJ2!gFTZ+eTtZ3~jmuM20J#b%<5_KUKY9M` z`Tm>pcXmPC{IW&xHcM+?NLi<^M;)V!#)e^<#*WzS!`~iP`Gl#HkK@w+~kP#{}+ORVS}ziE2)6>sGvAy z2+Ps>l`8N8@MamdMzA{seD}vHVN{kuu$?&ywka1e}5%uvj0n% zL1`HX+azR0-K4?FGfUm#<9_17<(#G}Sr))<_hgY$fJe;01*^ZVC}A1n>^{^=MQ}K? zcM(KbO#NoPnqVpDWfac@hZ}E4P`Vc4f8@=*oE5dkx8KNs{X#8* z8)mi>O@!f%_Y-RQz}Hx$3AgKARn806D^Ke=-idSY1hRld5+!~P#fN<6e}fZIt{>wO z(#uJ^Q9&B&1lH7`8E#m=-2&3Qp}(H+wtaMdkW;aMl&?Kj&G* zu|3jIc)r`x21&-vX90k|nN~y<_wbGue1p*bfAHfp3}KtO;g@_se2CKp zx&+g*Fc$^_LO2BiooTBB{GN8hjlcT%ru9st5<9RlLGx_r4`ZiFYkT-uXGE~u#a4I4 zCDUQ%KmL}d$)BH9p~*ZQwqZ`owXmr@ZMSippB}4okB;@TiWUr>q#}5$xGG#5@_Z`U zt?QoBAdZ5(5ElqMG#Gn3r!(+_Tu|xfJ(uk~2Qz=oQrXI#1M%-T=0^dyepeZryxB@M zx3hZ00*kY7jz@(w*=-fh*MYn2(HDt{SSibN=IwlQa<%83zrVbqdF1W13$;5q-K9`O zSfBZz8z%D1P(8L=0aD%%7pGW5K^n;!6mLcJl#L~3EEOrPP+^laixyE*Hxl~g=uHn~k_k4*<*e;e?IUym zT!5sRF#4i7RYeHJxot<6-#rI77$JDfy_X=Iu63##htpXswY)4n13W~_rk5{12PZR6 z(qyLnWUVIpgRqa%I{D4aB{(_#`G3`nCU!yQ1yp7GIo{COE(yJU@uKp(fARTeuS}PT zJ_j!sZo|5Td%jsZEiue+4R;hZf8HK=86K#Y&prns3e@;(W~iQxvr2} zd|=ithJp-g-IkBe33Z&0HR^hVn~bp<5_bgZpqGj4dp4e{Uf2Vl`2GQG)PeUQi9SlN zF9&?Ii)VtGcUutR1@nX>`yV!fJi^Nb@fH_M zsCKRy6%(6O=qnZ4Lpu_*sS|N2gq9A zK-t(i?}Tiu(#u+hq2b&3ws|F#J&qQY1OV#DOr}J%_;)z8(~d_57m4%c7N|N#-hZG6 zA0kJG!HRCv6pF0%#;QYYOt=Wq99f!L9k+HMuU&H6Wrpa zvHO}Xk<<*#qg9tNK?fcoj0iym<}6Dy7H%%)8yw8NxlpG3avb;eKYX%Z`-W-FqL*+% z2PFqNpgrMg%q$;$QOlDze+?I~C1CH?qARuwul`0yh|R116v zC$e&W!?jt72#3nLXatEU*a6cFt3H`1LXP)XRg(CI0w_Wb*@%@#iSHT$?Itr{hg=Ds z%j+=sS;bWM{}2WsMYMwn2?GKlJwjsww!$7c;^R1CM|@99@Tzftf+IRv)m)}MNWD+p zp8Qc*wON`(zmRPZeF8Q?8v}MI(-oQM6M6-WLygAG;G#0#_gsc5_bSXuDL5HWJ12JSoS-z6XECpMDY2$ah zy^Zpb|H#f%h21+kPCd8NaG(KTo0nT>9_oc#@j{xN=XqGP7&W<%Px`O))#m81p-P9= zwtSON;eO5eBtW-vNXlRKAEKGw`XOhc{BG;ML_FHPM3aVp)73>Er)4&6oUxzGyD04R z)w+1Jk-^2`s7+_$t6PFi@0W6F8XS>|pU!pXBnjkU*)KL`Js3qhI#<-c{nA!$kotWkBtyQ$nPs0x~z#14e2cZDO zdQCZWm?VUMlL`1d5`ZSk0gq@0CB}?j+#Br^4r$<=1G+8hGljGBc- znI)A*#$$N@T!rr@^1CrS=OGl?aAwJ$jp0ZYRoq#B%J0VTEZ4JO1WW#G49A%;1x9e> z&m1{Q4pV^t08Kh8F;f8UOXCPI$I!VgEL89SJ`PEuK66!nVqZ-WJ&jIHvMyd7oSdukc|3pXq^LE0?Vgf2PBOfZ}r!2*voM=!dh>jtM zP!$A!ePYk~O6FE1IZntn8*|7;wWA%3&4&NFJ+-Cou+Ov9_GF>HN%79ad`H7*U{b0t zen+;yvf~|VlcGoXNdgndy9s~c{c-!Dpe;%vO72s>p_73LNUI7L?z%fhMg`3d-)`h7*|bw{4wr?>O6L z8=O~BV$Zjc`LY4u;G;d?P^`19FcpMsE#vcaEn^P>hj0eyc(d?6sx*{#*3j7x+3K2q zJb5t_B&`n-#&l!P0owjL1{}LdyZeH|A1Cy^{n=`mJ)RsL*;^lSE%?tOVQ_`cBJgM1 zlEQFT+e*QojgkU`H^$U=5ES z1o(RV7&LghHXqq{w%)8gOUA1kHc6I$LZ(SrK4JB%)>2kg2z4dFs1Rznw$AHy3j^<5 z5mi;EEF!3@j}}3>2wO`ZRpL(mFu`b?C$E8|$wddsY*;dW@z<0s!_$hjgtFl4uO*&1 zz!vEu3s%FTsaIR%>w0Dfv{>} z-tI`$!(F(bNWw*m@K`jTDPB9bffp5jSj$z*PU&i_OFh&}#wFwIoeFmXps2J|AWAe4 zmc5p?6wPbNLh~Sk8#M^Q4XTjn7VvHB#I*29B!hc?u3u*+xP?%K$3a5wJ&2GrN!jKb zVI$iJfGpNj&a_$?i1+1x<(S4Wuq^0hGX5sHZE2JyGfpa+xiOSqjbtjpy_|URM~*C0 zu^-v?DZV?tOPQ5*kLv84Iuy6Lsy3Bo2537{J&Vql=y($=#7xb^dAihed0YtA(F+}( ztvWV@A35V_3wD;I2-M4Uc_Ig?0@ z7?awM5-xKESHYa@$an{EmnLHk_57_IpxG&?K#bIV5L<{l6ACJdbLE^HzJu)VSkX_S zXQ_gy(X*p_RlK#eZiO_bC+}Afc%Wl{suh*55>{FFy|E* z`{3CFE4e!2&7WiTj~*~YVZ1>cWGm9F3n>0IcVUmfkPbp%0R{ORROM5!zsBItXA^tW z%nyK{KQ~A>3BrcpXw-dkB%_L(2(*joL>z1#mXIKZJp~IO4x%d6t*5I6lj?29erD)n zEUFmXFEF5gz}S0IjP&#A%?Z5e2L)V~6%+A=ZQwwY8_~$^x!L!k&J3?0JDY|9)DF#n znl&nX9{YN5cqAA5k*Sze6RTZv`z~Rc*!8_s;SE>1c^KYx_c1(m?qej`BPbGe6%%s8 zy2XT?L}xL9WS^Ko)KN^lTHEMZeDRG$i8mtUh|QKk_2VuHW>jw;nc3O&f(S`61E zqHY?-dKH>6f0ZX$96<1L2Ut1$?qGYJb<*VmS8e1+SYlJrds-+x1ZbD&sD`68v2L$3 zVicCOf-4ZrX1O`Q{$xWq3hN5=q3_hC%4+hHt9+ z-N6l#F~S;;G-iwJ$ofAoCoj=NI+(oNtw1}~e?ZDQThU6`_7M930}{pnFIm~UlwHe$ z5w04c(Ri3iDX1nuA7+VqkEQ{f!YDqTYiPp@f+Wcc&{rX5SCh-QakOK=^Y$LX+TS^@ zqlr=bySp5&m;q?p05}0!j!7_u`loR?TVR+cH+hG8Xcn%Emsl95pb;(no zlN)zn*A#z(o-`zP?@}|}L&%k5dAFjHyH>7l2R9Ce{ulF;(00(35i#VV*qJ(4a7Evt zo2eXqRhU55A&@yJ^`nb0>4Z&>RTpbze?&@z+5mJD#3?C6&+U23Fj%8rl6S#SYNVVN zWoC03#3?QgwSdj+8qAW_W=PY|LVz!il)lc!B9_tt^vPCKTJ#730hdk9S~3H9Z-i*% zyXundC-a2sl>fd=g=w*kvkp;mKJ3tEpH4f!8#9~+q}vXkVg*N`$e!bjg$H0Ke?6~? zjXd8p-nY;KP^CC05uS;jBW%Q!Sjx(LwvL5b?i@}0`ck=tS>KmBC-%)~)2z9JSAU!c zn|E^X`peJ$_$M<@0vU`;l7LUU3U%W{i>lek-zdba15|+K*N{89X&VVHs$D(#5Av0! z?o#;;_zEXCfLL3pJq?8Ho2=s|e_-j-)3Z14Z#2;Cfi9+DVyJDzHgUnnt;5peMaT}G z_8awZacJ^bY(ov>Lc!lzZFFzxJmjTiu@>teirE5&4zOb&^QKTOwK3^)pWx8!te9wl zjH3kjGLG61XDBD;;Z*Xz5C_T@L6Dq_9A@v=qJjg;^~K&tl+Ul{PS|{2^LVaf4dk5zfxPwmO>XEkQyqErDWR zxIl&rx)W+1RtGaoT_V+5wE?|#`D3kj#kMb6<9FNtJ*+fH*RBgI$x>B{b>fZTlw%qx z11UG>WZOpIXwk^p45^o2e;b+|e6+FDpr*A>!A%Om7MfSv#=4I%*gTa4?gFd(sMZ&? zpyG~&HYR)< z;|p#C@iJni@ujK~Sc$s14^HS~Tf6)Mb`n*y9lC=n2l^R!5b%my{bqzSX2Amd(X zs!jac*h#DUr$u_PcwA&wr0gUH>K$_a)HZ7ok+AD%Soa%_G9HI*gO&wOxSJ683aPlW zawSqoisY%p8{VIpw(J^@Ao>V7WN{x^gN{e?ynEA-c--!r_Ri3DURJ zf6c|oaKfK7ONV#wJ?nJ3+y|sZDu^!nc!kCLkXK$#!6uxSF}4GEbg^y^+py5Tfg;^K z9JdSP5hajKxX8k~{nIxxm+D4Wb)aIW!bw}1QPc2q+fDUYRz>e;2UZK?=b6h-FLT}| z4?*jNb|oN8e{p2rwu%J#J&z9J@R8k3qE@?Ynyw%Bg=`$3Oo{~0{#=Kp>dLQ=TSu-( zeF1SlO*j^g##9KJzke5qI>H(>j(C zZE+!Yh-JN&rAVU|^Ce?jfJC|=gTGwRgEDv#Pt0^XH6X1 z2yD1-g*Fpg7lqO4j82caQu!2W?wV#Nvn1Qcsdwu;X_VY~JLUQX#M(kal;>sT#V*h^9>*c_wOX9j+-NbPDA@Unue^qR_xqAgrl~U|rvj{4rV6Y)TlR>GWHnvXT z;T@hbZX5-`?n70yHcsI97SG}F;BB$ik#?ItgQUT+dT7(<$dtZVE-*QWvkb2SEgMb4 ziS}qPw#o>BSwzA>UIqu2da31WfMtIi_xWuZ#WTNN%f$Zc6$hKyf7#Q!X|8u{f0|Fs zdat$}8f4R@e;XC~$VQcM5efbE5fGe%bu@BZrc=LVQf$;ie6!BOC3}j0oviDlXxm#^ znT#I)V!HNiVFHa$yYlk}KV1GY;-fe#{V4?2jQEx!_OQy=g9zsudA`T9Bi4G$kZoc?AXe?ZpcgrRb|iXbuh&|_accHzQFJQOpga1v@E!(lPO z$L?Y1Oq?U(I;qq1Q78<}zR@xtOfWXs@x}iO(=wl=Ytdn0=DT>-xjoN0ZyS;zj693) zzJ4M8(Z`pf>F#dVZedh)_T--$#h=3p#|comPlPIf@ETzNa&^YGLpj=qf7aE>>m204 z$Xi3ubRfAQK1G-pZJhYcNqRSe-z-d`QQX2T8?~y1p7g?x>xdnkP`}*dBVNfT_>MEA zLI@!*qCG%D*3(=CAN6RLHeU3V>p`Qs#EjGQu3U5TRASF6h@iwg>cYT`c7YcGA`MCi zxvqZ35Z;6RNlVG%i9Y1T0@x@y>hF*HpW$aC!S86FtK+?D@!=D{bke!iG$V8cLLq}=+Pl+lE)K6w zL{DUE!PVeM_G0K`QK6a7UytC6b4r|?A^I5k;);A!Y`vXeji)b2IlRRZ*WmFH8XAA# zi1L;Lo=+<~_nEd2j2ssL#=yaDq+L~1z&-#>N&!XaWHX|#c*pFEy&AD3gWHz|R|g*? za}{OO$5edpkLVDCZGIQ6*W2g=5T~mj%%WG80r3i_G>_AVmq}L#BL!Mw&+QPGaaRXG z1!_N=zG|1YR|g;go|o5G2OfWnVKT%BfJwUZqs(Xq$-Mt94W<9{`hNrU|6>l1wTlF0 z#!N+s-bYXnv5ao6{(635W`m7EJbD`@3n4gLDA*Fs8jh)iGd2|xvhqDIrVrqkyZ}$Q z_-z_wvnUB-@Dt+$VKJBurtj=-W7q>P>;c;A8?ZC@V^PHY(;DWU+f;wWA=}n`MPhvk ze>icu+wtYiv;MwgN*;#NLN$bJ^u&`;WTKzVQ1JVO-`e}bJ31dS)H$Mgys)C$oDTWm zT%f^qDq)El7A%}>oke-LVMZ<#(#l`Icu{5Me)aN?FJI^dEkk})rCn#~$H%tZT}`NZ z7Vm0HNxa^P;^1BC8DD>cX}y(bV-kFa`L?C}*1KaM`M3UZTV8f85m=K*<^+$%MDJ=u z3v^s(lK807BEM#}L#nZ}t_&FY>VP+XX?NFtryjZX~fN&b2D z2>;`)gFFX~Fa9n6^k%ovx#E}Et(WI9+`|2tOJ23>n⁢m(TJL zw2YUe4?DZ^p%8X0O!v^QZqCsGU{{~_`?p-G(L?a8uu^GUtQX#Z5rruynDM1Xxt z5S3_$z)2$PtgOsKV7aq?k2O1)CLtt|2A1Nt)opf&GZCXOZ7TN$^bfI0=>5qbdMoBy z6vRDClYJ&eZj66n-ef_xvX)J>Akb7%X$MZYsQCW zXjC4h3d!jVs(fD-;)fL`LsN{$&gIqN*{+qZg}*pGHavemWWLy2+(1hrA(+JY_bzIN z>na(ToBYPe`mdJ-2GUUNS2@sII5iz<1D1F%#8Djz)yaW*LH+rQD!VRKoHG~{jBG_$ z-b0M{3Do^G26YM5)egKi!ViS>DPWFIQ>_hfsf?0A6gk}4L1Y(mLU8t(!D8Z_&OM4? z74Lih#}j`|-1)!oC*+*yO5mqm3QvvGoDlYeZ34ANAH8&nA*6=WSP``YiwSHcZp#a_ zWb(ZROi7uD=|3dKE2UZ;N%ju`6aGdxdQ z8Oz!VhX~?@FhiYnRL{j{V`m@9OwQin`pJESTaZQrxI0CZ6JkU_mm6qXGb&kKE!c3f zNJ)QJMw9g-t_{I&u+QoOY_{q0c-JZJa7ET=wma5W*~<)LhjoTg1B3z6Qe2mTtYQf1h8y+PEz`Z8GAD_tg^ITJ z3zbcvHb%2nw0(})X>O46RzY@0Ku76(9!Gyk_#Z}vVfxiJL7~Zj`jjA`#p)5q%-Mf5 zww%}osjQ(`?cLI-L1v>)cQP~kwKosqJY+u+^)jFKo|z{$;I+qPz{M|L9lZL&&OL*l zvWLdW`@&yx)?ePZjh0vF#?c)oO8sYl6|C0~d2PO9;Z%_F>k6+DqRn?ex5on#{9%{t zTn7_>cAX55$#fy~)j&#jme<#Y*$BW$2&bf*R6sJ3rPM=hi_Bghzj=iN*t zkBQde3G~Yi?4CEXTLSmF+2C6L9eYb56ie8DcT$vG4zhNx#5qif*wWh2CX&1fnDnVT z{ck-lAdaTJ`0LfXgRfW^qJ;N75b!Zer(I!CR%k&SsikFFjm6?JBY}02-VXDj0zSL7 zaESH_RULU?!w^wQQ4Dm6+u$1m%AWVykeV4TZSRCxmS&SqazFLmDzvn=NLROcktU&k zYlE#C=JY|Wjy1HhL!zPHa_xcuqqP5}ns3uGo5}d=w%&DMA*^=bl{WXpztrRh$Cdvt zxB}`)cyxgN7gm9B>|5Fa|C}AL&Z1-*t%HAMO@NtQ|H4Wj&n>LO`zU-EdS{VG+wR7u zz2al%(9rM_Iqt>JY+-F{mPczb!Smb=;<T5Wl0 zSPwNe3-9xRIc{dxwDD`EytFZEaeNO9*!FmLG_)ojWUp*tB&R{SSQdV{9+Dg}VEkXg zEOk>}Nf9MwS`PM%7=J%srh_xSafBUQMz#`I9XxHtY_5<2IeTIh23#FAwnZU-CdSIR zq8O`bTz3!7b@mzK*g*u&Rzu%#&uMD3^ls=8jy#{Y;g0xAF_~)bajW#rZEYe z=Bd*}&~^}iUFJ)FdxnYYv=M_3X|OzPev63<_MAU2lW7n9QO#B8TTIycoXD4h6RQt^ zsiymHW4mn3<8rkIY^pfO79rGsapL66_S75B>{sO`7eRIlNiQ5hO7>;jFnnE3@4gN4 z<>lkx+TevT*-?^ghm3M{SDHV~}qVjHD zKYmi*pVap!_5DeG|K8MpHnjoV%9pCLk3aEuy4dx!YlxdoONJC zcSwOc=E-7*jL(~e8Y%;`oQ%tfs9;Qz7QS_sgcPjzm@Kkh#~U1UWN1W(+^Q}v4~wRW z193?W6H7oLHq|RV4K|RzY{ZIo9jSjUv8?fS`X#^^S;k0-&zlU(_7vgeN%~${L~-;>N2!L|ZIW*hS+z(- zGm0n)b06|x{D%N)(g)dH|7T)O`PHZG@3#7T)+HbnO(8;FYe+vcS--Ng9N|w*9N=xa z@7ltvruUnBg$K8Mr8wG6xlaR>dV!w^cSt$B-?UV6)`{;vMue~q!Kz;biU-891u$zr0U|SWR zc@9HrBgRUTBF&^3lL;{phIRr$%abfzgdf)^77>|L>?Y{Y@G+|jDE@yhcEp3fPjR^Z z4wU~s3-AAb9v0KTLumZp&nG>5UzEgJB}$}%t>%YjpU z6KVeMd2w_{V0++eVc$y$xjlPi96@0g14^i^%=qv*;+(qJ{@_8CD(E9j`J8xf5OFks z$|0}4>t|dG`TE&pg9K4zLt8PpnS|M-Fb?xI9Y?T##Y&WVfft%2-W8lq234vLyrGsE5 z6;Jkmt~uPu`H-u%FWp1F(}ZnUrlQwLaaVO7wCoT3QX)2p8MPIRI}&Ig=xMEoNvlwJ z#3Bq}87$%uXEGH!#*!HLowZ5;sz>kvt&Uz$yMYV>iS651wjhwjY{Kn))Pm~O9TAqE z&paI$uU8Iudz2WJTirs08n+^v-r4(4hMIeS7iO3ZYujL+E8A{zix>vSEjAmfHl`2z zs;rW%zmVH>Kmw(Kw%Yt5acZ2mIr`%CV$))LZ@U9tajr4h?$mw=#BL23y|XC4v)ZGg z6u#N|r${3;)_EX znX6h`Qn*C()FE!-9o`2~TooY@OXWineYEQLA{=Q5^sU(6sHOEr*$*C?d+98cPVEbIw04Ht3mq*^H35_>idN-{Jq&{M&B4o; z|K|OH$lpj>t#pDI=9bVm!CgqVsO+amiWEvqq1K}Ppq&@6nl$Ik_Vxkod?F@N^CT(O z#ba9Hv_~2B)+r~|LbMVPyl~lnpvbzr2;p}=la3cCc~W>^iXJR;bab&hM6IHAIgux^ z8yW~Ps}H_X{qQtrxZly)>UVhF`EAc0zpKN+{{VCSe~794uVtbRwH6)cxks|1B85mh z9Hi6tKf-MNpXN$~J@NOXi=RfG%@y(!^^=QMezKt&t(u=kqV4PFUscY34VCnhjq>kT zQ*XP;Hi~*ro(A%^J4iHx?REL+2K-u=62In6z;EGpe`3e?uj_06JvefIFCNnWsXoJ> z>Jb7io*I}(QMwgp4Up2jHSkZN{<3uW-!&Z?H+H^sGj>1{_8OsJpu|`{F^H$@0p-uy+(G|~_GIaLD|x5YKE`obOxsGS2kPV7 zs6dR^+SgTCOnzt0zm1BqF7JvL^Vp+wDhyd7==61(#%e)*{_;;>T3F}Sv2U`^9fnB@ zr`^U@U6E^CuT+m*Zdq_orn0D2@4|(KI9VjZ2EP|n7f{^=ju}xxYH?UgDO%PeT^R@U z@YI_Zv+(`}JUy2xXa^+%r4N@;Xa^z%eGpx`6PI{s2QYv3z?_~gRTl+diQGmBbpjOY zhMBtO@mkmupRL5{;7xmTB`vrd`Tx>4{c|sJm?LuD#e8dYD!faUt>Wl}b8LklcLA`DRSzpc3YC=M+bD50J zJpJ`lj(3)#u3(KnX-sT~b#xZyviGD}1=*>Sp*pn7R|H|c{sBsJHjd>TeEWDU(@~zGy7(I;Xy$y?pkmC$_?g*|$%@f5f z_pVxgg_^Y?xCB{SyuYMlGR6we#Nv%&VHK`X2@tZ13TM-GYwp6t#f8j-Ew7gpuncHy$YWGRQ5 zwDD8{;)J&l&ZCd;%m2los#EaK$$49HyliI{b@%+gwYFmd`OLQ~F$c}2-+R%@ttThtn*w}2lz z6V4Q2qZOLSV`9K=A(q$Y=E1&}cea;nGM(mSK+3!^s0vg5LssQiC$2*yd4 zuGekd#Scbs6QVBCer^UNM-V>*kGb~}c97#Bdx)r_=hv6V!qS)mdJ*r{UVCMt$+Qcur23i?Lt$sa6B z@?ITv5hnyUre(t~%sunKC-ml06uo#5~!? zCdjn3O>kWy`UC(7x~Id0?CF3)-IzbCXpu?0Q${#3H??(8EHwa^iMiPYaTMg;7S0nO z2=xfPrrbtT=5;;gQ4_h3Ru{1Va#%;wTy)S}bW-cQDdD75d6UPa3@?9Lx$^lvoje#g zi!kdPHHcS&tB{qLMEg+OoorK~s1S=t=eNiH6jWqzZq61A?wN<8rvg^v`prSKNFe7m zxJ~atnpZDB|4MgYtY&68dE3#4U;}g7QW{G4ob4eueP|sk&UA`t8swool>)B`+fv3c&%>77>l`%CXH#zGPdTS}_S{u?&)qp5yaTvt)86PtjaW~^-u*Xt<)(^U>Fu%r_#;fG;Y%PA`xVQhXFdyf>h zlWE%zWLBxj)TX_WGa8swOqh5z}N^@{VkHn zetj&rmv%YB+fTG;o!i?^h9E~~Zzs3TYDX@Pn00-4buE$WHqMCF>hfUQY(q0qFUq+7 z7O=c!kn3(mg@vxWnvcX{6EpB=iB&dsik2%1MLDRI+7N40tdQe*g%q! z>?-U4KG7>=_WFNl_nhp_i|^i%zhJCm?=lqsUwp~F@n(~3kp+jkQ6hx!CM%4H0>d)* z9AbPj(GQ!1_&fz%BFHpGvmnmMtWBgcx9JP~zW-EQIrm1c#5ds6kiUruNgJ&yL4*1n z#u2-g&b~Es1|~6GLVy})%f=P#V_p{`2d6<|>cV=|UYLJaPY_5i^5O_qIJ>|HI9JxG&*$nWT4NlboB`Qf)zU|SYeUZ}>_2b!8b z%$Ly`bV7fCNHWlTri2}qhc$w!2GSE(C_Q#F{qz_&2N=H;xZ4&tu02>0>ec{+O7*cYgYWt0yu2kV z=y^_2gdC0B)eNM(Nki~t=g^dUG2k2+C|RjVB7=WkG@M&y=g_-8e{Q{Og?&`@iI>B@ zehKGAgo~zdapWq-T6qEF>^r3AQpu!{fe^>Mt{+l$I9FsLy7B1EB`%?hs|o%sOe(nX z#`++f6eecyJczRDGhS6#dNTv*#XvlAs1I94(ma({@UrjJW%NS`uv`(7KrDQ#LfmZ={5-&wp+K+ zrjgQ)t{qg{4xCn`K{cSGL?RM&_5ygnoI9aLeh6F3wJ-XKkM0sylLH+habTRgL?b_p z@#Wej{lt5^#HhznSmLXnqnbn2!QHirrkU(7)V|B~LFj-*83!3yExi7p>xoLBAyt3z z3~^FPOR?dCJs4uGm7oR9elAWyq+-k51zucf_)d9gX8Ta`JcvcH0xbSQtZ)WCa(=Ft~cjeCkIgzkW@xsw%+Q^!I=bUmiv zGc3?X66SbX=5lfX{6_7_P@h$V*Vx{artBGH*oniOrSR1?j}oQ`GcnjX&e_^{!&uj6 zF3mI)P|UD(-sYk!_H3k z2nXI0?qBr_Uv4h9wkJA^Ju+H(=_+Owf~cM1K!mK>!`GkpCrP;D$-g?7eG*ZdF~1)MYh&}26~;QFnM#ep;w zn?n5fX|_DYYe;)vxN;jrAR+ zmPk{x!?h;2T}CGMp!mqP)`DIbbSKZ*NER(77 zodM7fXE#bEMi;vQSRK%#=v`wBvi1w!Q8(GDiTX&YQN$xVVE<2=c7ThULEVnaS=tQz z*lX+7`dxR246aSyjxc}SBiz+hPc%F`6kxF1HBN5ckE^cE(Zd)$eaBeDy}av-FY{n0K_7V=V!VoLv|cDq{o z)9qvDrNWMkPq4@Z6*MR00Co#gkQW|$?&Q`*5==&lRe9-Xuc&`#BZ4?GP!wHKm>9^e ziWXae%0yHi13}ZS8Fb@3HhqP?8%B%{U3%{ryP#xtAdrVkE{WiH?WbYlZwxbqQH!;OvG>}w92cGsDCLQz3dh&tHOB96oRFdooe z)hMvoRl5I!m1KWf2OAXNiCq_}zB4F@2UY}9jDTn%ARbr~xQnPOJLvfE+=>`123W~$ zgy7j=kkSO>Lv!0i*H9)6%aF2~Cdbrd%(W!+nJw$m{9z*n-w3dSjrUiOc4OTyo$B26 zru5YJ+t&C(d{>=6QrQBhUq#&tM!$~26^z^meQ38d7gv9^d)9|)VE+^^JMEyKc7uPR z-9StZr~Lqpc|IpTg-w6AsZnprwml7hw_W4DF6dU3`P~!S?{^Lc{GGD}-*RAt{SfkN z74nI75IeBoX0-e&X3?@)(+N_`cJuBkZ9nN8t2* z6-rlkW!ZlwO*>F*c3cnL!z4`}R}f&K3_|n);N2Tx_}~rhJ^(NzMf|vr6L;tB#fM$d zr+HD!HC?Ue0L!%$Lhia`hmhpN&kux14ucPw4*R!&d7wjcvFt)jB_#{vA`19K97H(> z^@81J(<@ejATUV1zhRC{# zc-FSH1S<2SzVV3@&0-N|c&1sSxe=6c(H`n09{c$CiRD-Ye-mqo1o5t)y@P*VKcgQY zb7p@HX;~_xhHXiLFpD2Cvj(EWpt4ILbKfzF9w4_{TZRn%@$Fk<9b@?KjA}AhD1dZ1 z8%O|=&W_FfDA|B(T54vG8(;D1W}1VY@-V_#kmQ7I;VsKWhzxf3G|0>?EDE>O%rgVO z3IO#~Lt5o^ki&u!`b9EXJ8T|1trj@&ch1JH%+u z2pv9He;ub&9fmG?RZ3VByG&A9>SjjkN;Hzk2en` zb&E0nGy$w9z;8L$9r5HN!iHNnuAdtD--FCl-ncC`C4aI_Y|2X_RYTR)vf2SdmJw;1 zMH2>*pf!wGMK0wqx0d1y_E^x>Il+Ix%jsvpFFUfp`~fTa@TMd2JPyOPbpzzvu1pHV zO10!s*n`AYEPjD9N|xP3?>aJ=frp@jymwkW&jGCA(JPZUx&zPx%0nv%4+5MJLFV0- z7(9yGHl~yTT6t8IY#ocYp$0IyEGA|R!N9dk9)i0Nu1EI~+_F>l_W%-tb+3Qm0j_2S z$N7$YC5$4`D1OT1M@aRA5;=QCvb%7$EqV4J*Oeh0!VDa_VDk|GL*B5xfwQZ)NQKmK-t1}g8DHeYogy~*eoJ4DM`BDF#ts|L61!1wDvq$o(iE`S#%TC(i ze0jGuNnchkckIMj5N)OK7tk55l^0Z5D0EgbOD8$N(MzOhUUPk9;f>O%$|W?10&MDp z4TLBefn!7Vh=cj^$7G5ZZ-Au|5%G&dajXxrOek&4B%g`3ABcBNpv8Y=>eH9DOsf^o zR~J}x)!Y*BH+o@|a|Q`$y@W{uQI3nemDd;p2|cE>o(A9xjzl?_r<*9fU>WCxSY280 zz*RP3UgoWm;uG>(Yy@ztxtT!=)y4o~lkiqZoWfpxz7M_(e#>Ym|2Sq$m@8Y<%$P1* zGCW+uly#5+ULR7WsIh+>&Kh}`fmqv6a{AdqVp|dQ+z#_k(|=N|4T^DKp~af^Yat3R z`TeNmZLqMcTnEWJQ_joV{XwGTt-Hv0+gAjuwIqzlyll`QRH4LUlPvM7iqs-_z1cw6 z<1*G@MhkOijd_@jCi{p0+(e1(5bpByo1<^v0ubITtN{L44oH9d0TZtUfGzwOPJQ^u zsf+dQEfWY5h~he4k@%7Bcb&U=7UEr{6O;QenZZpbz@=Ij-Zl&NHoyXFQ>V{PR0!JL z;7R~Q;)J_Zi`QogVqaodmg`V1Wd-xq(~)#v6m7Kv zk1WGtL)E27j--Ff*UV$<`0(v*lZeG#q*k+~$F5hvI|J`&gKl5OBZs5OR%&ZQI3rQZ zs|}u%r(1Cjsy)CatSnH#T{WpabSrr<4^|N&U6@3Xj#Z(9w^)Vr^c=trGscdM6cnZS z@9Fvd=Wq@d|NEtSsZnI>;7_k6FDI`i2k`2vmoE=qzdV2b`m5K6U!NSm{_2a*zI^@q zpuR&-;i9qTW{uW80s;U}gX^nT4U+Jl)hxddx=JYXU%TNMvbAeDi#XhLCTiXG^Q#Mp zPY}CMtFFyt*T|BT=`FZp#4Gm^prC=r274|}(>rw$uJy?uzubRyaIk-H@W=hnzMLcv z6MiO?^=g08(i`9@a@mi=`8=HRwe5PJj;ym3?TMZ6>h1Ba+@rZAK%asL0Za~SfX2aX z7}qM?5LzgF{_h89?OqH0kxp)dY_dpWVM|TYY%#fh1|4$!toD;u`2#+jg+-XHqC{4# z0Ga^FDr+5xxdm{VNQD@_3!e~$y8O@Dngwmue08&x5wUJ__Km4f(VF1WE- z)ucCC?Hvy);TVoe$!mO>97#f$#ciU3wOnGXkb6%cx<$QbwVy`NYAxpj_q2XTkJj(_ zaN~b=Ip*RQPkEyT05K2(Db0YWx<}*F@Nf}ioFGX;n|yBdKJsjQRMj~*Oy0f%Q9usj zc0;;p6I(=XLca6ER*JRKwYK-|z?16K**E)LJ(Ehez2s42ufm|NjtmNbl7locVv>$g zYpNgwbuf<7Ol;q4L_R7~36KG04g_(kZY+O3dLhiG7t#9u^B2W*4N>2GebIsf@7bif z8ew@u!{pj!hZJ(ky&&w5wK(!aMB8*N`>wkIMo~um)TU>_Z{@={N?%j{Jzvsc?;2JS&WnBKMWk`K2x?V;{o*PI`} z;rvvud1}8UQPI=UTM~T!8*WKZP4!pbl3cq??F_9S4(|+Zqc6H-$b*FAWp{ymiSK&( z;QcZA$G1`^mPp;yQ`gJ_%IuJ5qtt({0L}YL`4u7{$6`k#4{#%FU1APnt6uO)z7K^N+*#sBhBMUf@>*!SUp`iyLW^Gf?^GxP zgDm{y6w?7UuFeOhvS_ndXm*)tHJ2JYMJpVk?r!!weSAL|PK4aS-H#fhNLSOq&fzZ< z**scQDg%T<4M5&w_~+}dUVeY|@)-!lK7f$lpl~KOTQD8(*`B_oX5r6e2;}hF6e#upzgw%Rtitfu?l^taEMsZ6_(%|tu&oQ z*`#2HA|7iLr>&JoiQDAv))^jT4GwUujGA*6cg41sBOsDE@Ehvh`kfQrR=D*bm@oT9 zx*x-B1D009Hi%BmBFeVwvXP1+9yE{C5ZhmGvclQILgM31Z2|pFoGT`9v*G=J=exiB zhD+y2Rn}dG!McXhQ(F<@A%`2NTD*2SyTM0m%C?YQA94qA;ZSKs^)!hJ2z9q593@d< z8Sg8*80swal24(a}PIohK&pE&+9vB=ZYWwD>;m1(_=s2xeHX&Oq? z@wrSuIEMq{@C=t>?6+n9sL~@8)rwSYc*VQcD$B1JT-7$uDcW#1TGhiaprd-( zzIV^V;I6qUMi1{=kh95ufnukDlT#xL!g+M}uqSo{YNltSYE_SGqk5^~u@;>MZbj<2JjW>qky_Y$mD__Uu-}6_ zcq`{Mj!BWxcsNm+o!HWdlXrN2DvqZ!ge)2C-VbY8B}sO4lt58`?tKY8o2%9xo36zf_FmI{1mon0S0WJs`+n41y=!F-efU)IGOQ3ART^~cG7OYwgXUjOOfPX~tTA~vHG7k=95FEw87Q#4A3ZZ)G`>AsFEf4uzW zRB92<=G=l7LCzDNo@z7j=qpQT2z3@)2FWZAXKf%-`bogj76?C1!*$DbF%hhuI*?S7 zK4ei5^3kS^IzIQSqmMOxu?=-og~u*LWe#)H+NDOcYbTX|AJgnks34Qb1O7a5BeL$0 zh>6*XbSZDl=(|1d0MdZ-0`VQDII!ZtmV^)0h@p4oL0F>R%U0IvGiN=`4A|d}&}dQ4 zlC`pOn#;DFykK64|MEY`T_TJcxD{O@_7H+jd+!ea;$NJ6|Ka5F>atb1Sr`|A?*sI84(wi4$zT+^+Y zE<{{m;Cl+GAgxNS#>W>eE<=}P#rk(=3J%6SZw=A)d%%AWoeX=3TeI8F(kZcDm|xKh zjJ{SsoBe%8;-zxfH(rWdu!0zD zD(y=rw;O~Xq6|P~n_}YqQIJDNGg#vjNO_Q>>WhMs?Nzatd z=naSEas?=t+BIA&+2Z4PQ@UL*3k%vZ4~cc(>9J|xXQAyjbxx47OzFIp6g~89_bLrc zxo$&$kQ#4cAm12=@gUZ7G^HYY$RY3JKyTYkDWQ2aecVSi!&j}SzMs!|o3bIC%D2a1 zRG?MX#=zNJYmi3IPpjxXCfiS~04r9ZZD_{d=WAiqgc}}%;Ix&CgOKv>yvS#Fcn%VW z_i$Pw1B@K09gQS&3`NOv+%jHke>Vyl=f2haf*eK z2P!z*=0%!qB_u@=8*J;bd=qgo#sdKXSU(4c!s|xRcc+LTMW^E z+rn}HI)f|WTL>WBY!P7J!qr8Tc<+|K7|I;cEkvKKmcKY0==;dg9Ji&1GrW%+&R$z; z*w%OT8oieB{;pG&I$|WRQF>q`FURG7#`qsV#n|~7HUYC#^T8-p8OmzAuI}k#iTjNP{_6>O+fr$g97l+4nHeAFS#xILE{D)l=k$)J9Jpjug- zo!%i8j5Pj{$ZT|e(nRS#KWQ&D@4T03R`}En+Nn|(vJ&s8YHvd#! zSlfnI$d7j;VIeA6oBk$r`W!?n8Mo^at`we;B&ql^yxp zfIi+ZEh90Jz1G^~R9KJ`3$%iNGKqdJF|n>n7{ae5&QJgq#Z)32FYf2L_ss`@icMxU zAVcV>CLqr8$Is6G^Ud_&a6K+r?`n|4kKr`GpKgL-Ig9dj96Yu`W45s4jy}Pt+9N2A zJuL`KM*~;|dcLb17@Y z(TE2ie~fZ4xr`7xa|y&A#8^S)YrT8*!i7P$DDj1+=tr-wuYWu}JAVJ;<@GhWdp>(5 z{<@!{SrdK?z5P2+Z<4paHq$YQ|6vgO({{pHd09UW$-XQVQi1KT)|5<_f_{air8N!h55fZeeql69zVC zITKj8h>$PJ|4XM zla4xPd!KSuLw)6}bZ#hCaom1>I>)FDrC+tC)`Vl!VId}W3)RZK>O zGW}PYeutl{82Bk|95M<4EX*?7kHZ3D5QL!-i9H48IYXIQ?B_R1#v8NpF0rJAL>w!D zx)>OSYpnyiP1o9M&c>^fN`ED(D#VIySWzy(8K+P>6b^jpIyX&Ndg6;GR_pD12u7H7 zqi10jpKZmur%9Zvk= zg;lK;=}Vh5{cJ9q`r#U)rYQkfrsGyj;Hto25L6%d@Ysj1oWcYk@qa6sK8pRZc!2to zVUmX{Fd0z)b?E#GhzLK1NCMZ?rS(!6TbZz4en~LE*4R7cmAHbDq;s;j&OG%w{_sgNf?dNXyds`$%T8RG;S zd_$U8%N4JWvH5C}vOR0jCgxpqVsl|G@RO zleVmy$A!i4PUhUB^B(Pqtt(Y#wS*ubc5Ngl4i)jB3 zE^;I>YE{z?*jTVk?AYSRqu7d(%n}&)oiKt3Zfz!r%_+U5kF9PgAm-~zdDFNe`C5;C#e^_%5|Ce;bc&utQMMMCMEgP*r zGYpK*YEmEQ;t1W%O_l|Oxl@Ti@AQ~l)W3X;W_m?FocQY$t_#FU3@FSV*8~o!jt(vN zNm>c;I#dA7Ns-FZ4&?SN!j(|v0YGnycd^d$oa=7YrUgjjwluUhsbEExDB_lkONl+f zPO$9Be?!@6kbME(TH46SAF0(*mum;F@G3OH>e$WV_IqN(%)t>$`!%+#d6TdFsC}N; zFu@xu%`e#En{7*(|8Mp0f7HFU8e{Ng{$rHu_P>e7KeiA(-6Bt?C$;6>K5RcJWlQF; z>K!+WN$b_YHlNUy1O=>^*CTXWF%Upf7qhR$f8Db$&4p6R9&f{78&R`7bmma9pIhgp zkHdTI_o~u7o>5)p0-G~UdSG?JoO?W%b}d011-E#FMO3`|C`*$S;y)!?iDg}}fNdcx z3voDtVoU3y%)*%+rm=octyA2Y>s5Tdy}CNz^WHsPe*bpQy9j3yRhGW^@NU1{ zm(q?0BY$Sf+i`(E!q#Whqrkemr#XDyWVDXFS%AFX!@CG zrE0nw2ksZxN2w?pN5VB(_VZyPz9Q0#?%38MiQCi5248ySJRu^4mn#NGh)xPyniC_L zx=jl{+YC+%gUKe-qRz6P&xmPZw5WYr7;L(y#eZpSD)W%Y0$aL5LputQZupRfiqQax z&!Rz z>e2}pXN>uU3j6;I()W~VN%K%!2)+Ysfh({}Sl7VzL)EGZn-=OG8 zntw3j4?8%x>wD@@WnmEeR9??4ia3{Y`}OjB-LAYVIWXX{0ZEE6h~v?o*X3_KN_D8PE&*I+H<2qI-fY3mz*(eaPq)6Es*n&pneb)=?7FqAV}k#J`V&j@z`p zVx;0rzg|pE_Jw<4Q#o`sN{s=vBPLr@qh&VHjufFvV-mL5k;B5r7<*r(eXDza1A4C! zfj^Q9UpjU2X{qjO$7u$60)wrAw?x;Yh8x)=gHdOLbXMK1(zG0!?mp^@nyPyP%NS#3 zN2|Nqj%=y*V8d8OizQ)+%tBr&u_xj^V7gj^ErsivTr;x}F8OkKS0r~HKnE!p z^fiawm^Rdv&}v{uLSFSYgnVn4F(zjZ^$PPE=*ofpIezdk)(_PK(lq@T$;%8T+)pFgMzGTRfe#SIx1U-{^_~yC(3KrI_i6F%i&BK18hQ zO%aAK?%h?ti(NcVVZy;mj-xwa4U1Xs@!$eQucH3#f%*Z z0!&zd{v8rmRm%>4d8Ms3$Bj}pPhYUu)Pda*h8YG#?MlW9lv63-2s_^W9>m)7c7pXf z#==hG*Eo2DOD$pevueB*MuS*;imoCnR1cgX#9|jM3?vd%_YBf5W(TLxaB~uHkgZws~i1q3^O(!G@C< z8vV)3L)c=;qFCgNjO6i z6aa3QK_dfygx@NP1C09sm?nB}zk&g-vS~hl`FU-f%J=MYYC!FTAJ?&1fpWv4J;7Z5 zKo%FgZMskp#auiA%soXqa63lvHYY7_Nl z?8@!s!Y_^Hk^uR*1WCO%`s%4GhoCId{aF|b!;c74s7{$6u7i=VP`&HQM)Sy{K@Ov% zMQl|k&xT31Z`RT7Wv6-l*l`TuDdh^>>*7ojQ87$5u4FtUj9U_#hj;lQcm;bi?!+q! zITOx*xJ<6fG8A1VMn)JKf|5Be_z^O3FUO{AV{Q?S;2vKIORpscV40_BWHmq?mOUL)+Ca>M&UrMb5(V$LoNjGz<{6#YOZ;RHo6SunW9 zR+?i{0ALz}+oN^$NArF9eI(IvwJsi;H1TJb^01_(&_Sh~?Rho(^#y*93EVAtdDc@z zU9YgM7%F2Be1f-d+z_XP`zS5*_)#u&X_-eDj4gIHjQivZOw)2u-`MuSVKpb|+5%#K zbUNmwd~QqoJ^mHMaO)DuKV{~;2U{hz4O}3su=9y`Lt`7zCe@GP>S%4 zleJT07AC^1ZT5|%D<9iKwD2^ia7glh(6oga@IhyD(4sWiUqi@hj?LLQz&IlPmsh)8 zo2N@qv~1W~%+xF@9{0SLFr)uunuYw>E+11nGEUPBkLP%wq0EuSsHm6r9ZH;YNC8H> z!@;OX+YchCYiEe;#R8H9Fk&H&q&SL*(=iauyDZNmIDLS%f~DOfb3cV&9h$1B>HdiZQSq>grXC24NB!QEfAxm+E5LcY z3Vxi5tw3nqEZ9!1X(r~~fBxb#OV>fqHE5FhnuAfgS(M0=`txCr(y8WDt}ZSssjE}k zta33~2X08qA`9v2N0GY?rvU1IqMVX}cmCn>Te*xH7GGPN`nIZu{6iu)8!Vk%7A{Ab zCTL!mcBBRlJ3QiGk>gr;WZ)Qz*TC40dZ>kX(OO+`><3-==7m^uD_CS6gwLq7q8u-c zt8S2rO+|&M552$0OQS^@WP#X<(O#G7GU_$MKS|9Abjoy;`^%($y$s)fTemHNyl2+( zsNayqECTQ2qJ*;qJ3tAUNY1l*GPHe9!d1;8)cokugI0H$-lj7ZXGopD6Yw7p$rP<3 z_H@7c;>&km!$Ft6-<{Mm72&u3><7(K8P4p2IeYZ|TfS|i1GP5%lvpekirvlLPyH7l z-LmKl&rZ8EzmRKnPtLr5atblw6ffuH(A_~UXEc?$gH+*9EBn*R{wG`6$HG2|;#}Lw zB>*Ld`#3Ew2oJ(@-dHQKMI1CBN^-8r&N7l#;)Y85(_UjZw zHRrO`VCUIfN52REkCcb1aY24Q6+-v%NSXU!^X0a zGf=e{S1uOD_a9DwF8=!BjAFfU)LJ+|fB{{a|i!2K7Lv6rjvaGR+52U+>D5w6c zH%F6f&?;DUq{G$x+z*y|j!zhBGH7>tYK>vfC{LzX9UCpUtExvZ3qPMOMThx(@u%-P zE}Bi|qY)Vxx%)H*c$(Vebh?bhP$By5Hq6<&Q=J0+!OS*)?2Z;Lq-DBTI4K*0zCOr# zAWV;7KBvV_UN;35qLkepc_x6@o;NQOyj{RFzF@J)!UZfQpjh9K*@tHs_uxfg_8sPquz6v=QX4QYKzAHtfH^G^NW-7!;6#AD^C1#EpG_L z_HcS!*J%9IcY%9u%+$)l{$xdbvLZfN5nHq(#M1IRED5`{Dc7Wmpw<{bl zG~<}!IBQ3()5D4h<}a8qP58<1gOOaYi`3ygIo+ zm!Y#sOIL{-IqI&o;2*rd$LK{ux`d6T5G}wv`Ib|w#CcPlA<+SNXp->Zh0r%CAc_De z+XiRb=EeZg)6shJtfjWzc!IEg>$)$^?BfN0d7x+P`_%Fo==j6k_Q_Z9$ye~nS1{gJ zpubzCra71gGUGyGv!J0=;*hmiSyR&Y~;9pq|}_w8VU(%xW~76PbPxu4%3z zRHO`d13*opXLCoX3BjUv+^JUfuWgEmqAnY6$6%E&T&5)T8@`F2o2f7UuyXe;}kcVGMYZN+G7IV4Gkj1CAv|{Ek?VQ(R_c5~#wYs!uD= zzUp*C$;3v+$e7kp&n|;|R1Q^e@~oDBQ#cx0)utaGggq0Q!TMg5%R>O60#BECw(B3` z+c=%x&C|>doRv4!n(cw6b{47p!e|BCYH1kM@Pboiw$lOuD5UokTh0>*j$ip5g9V`D z2IdMIsD{;mg+{nXU83%l#Un5D#cTtPyk%~DZ{$MX$?|E;pE9AvX1KNUVpTYQxU}t5 z4WyA|;;;jY6q^JgH^R8XRSI})DviBmnZN}-f0Mg(rGEVE>qhzG6PYtMB8bm%5e%C; zygv;YITAdj-%--Y)oyvMig4|XldZp|Ai&hGDq?oFoUZRb-$uCX@wZ3k_n+6IV;%Bp zuWIPSdtlB9NmEt$28tf4k^$F$37ysV$d9IKlHmCr@mv)Cx~gt>ov73$Js>t$Rf+n9LcUB2VB0I;Omv&2 z!3>uop9eVtv&WZRp9dyNwam*DyK5m-XRz*tR<#!q943#tpe@UjecWOVY3{e{WG9-4 z(^f!jB0BVFw~{%5^IM56pDv*w{8Bcg6Wsdp9dj-9(~u9G{=MC zTF_OU|JHQS+<`%t#yhN3{O20LM;bX{>RCM`)2RY!Jr8%8uJdZ{s)IRBjHTGc7E8k+ zxVFE5k(TZ<$Yu|q-D*gkRQg61dD=MvjV1oIcb#Af-K!wJ+w;O=YR)%Ft=}phIOwa~ z5h-J>`L`ifhQe&JaI%#hz;oESs&cOiWESaYAW$txPVhh`kN5yu zxrwMz(kQ>;?SSaVrl0=MPmURH`hsBTglg{G8_n9MAH&~U_LZOcN=maR9QM5+Fa$iS*g&fFXb@O0#-Y`l9Mix z*h3~wG@*I(@>VP~6LLm=?$9UQ!mMObLW=aRtuDDUN{Ku!-^_b@Fa@_nONm6VjD5LO ztZQI)tP^dOV4`Gy%6kFipwoD;VJocXnRKbq?X85iQ z&H)Wv=^Z9Z7lG9b$ay=y55?Eo%r>|R)r|(8{7|O(RS^T%2?dG=O0YU;Ax_{51q162 zC0u@6pDRjt*Cc3zpy`;$wu+%Xf5brp(5w;y*cJ1oVMSekC+PVCJi{1WO0o`X?%hWL zZD~XVQEI60y_pz{FF5bux^TSc8;uAM))#k{N{Z`*#Ne;QTgn+{8nZPqlicSoEEeTq zZ3lpXRmp)YC0ttz+P7jj36G$C#$)oe%n3MWRq4t70ZgB$7|iTOax(pE;~dtq?EsgN39 zUnTsgcK&)U#(>3+5_P;qSjD4M%xXXo6CL*<(kDWC*_*xF6}|1!kHae!X3|$*ex<)I#IakW*irV2v|aOc z^iEVo=$~DkOGk*U_DG8L#)6rN0j-Q&3t^8k3(@leKU|!A|Ka5FsxlM3b}JD}VC6gq z)X7_aug`#$_^NOqaG~s|bKvft+~D~IA!ZIbs-{k9T42c#WgH{i_oJDI6`!*Xz?fB&A z?djP`Wd^3#iSlgWWyrGTm*9idOlms33+z09p|pUnb|Qs#&v6d9#;saQSLwf)4 zGyy*B>!cK0N?e<7;DwA-^=f!>adLL@1_@RD6vA;e&JMNbIHlk|B z8&6X3Yf7^tK&J)*f` z1Op@y1xGn|bQ4)BcD~@xTMiKDg`P+^TtLN! zCWw@$D!H6TGd$PUAed#CYUez_r%;nL*mfUd9i&<(gN6(c^j6slaSDTdb>_F-Vh-KmhZy94MWagZz~X||X^ z*+00Nsr^LJVk)gfmUvYGx`HN0lhZyY?3tA~3C_@&xmF=&L;&6Z;NRCTULX$QG%x4# z=p(W+U9zj-7onG?>7=|ffjUTkWramN^P%NF)LI^Pt*e3#VpWJ8MqzYU+VDo`{)yOv zp&t7UscZ9AiXJ-TSRBgQL(Gjr@r0R$>L7d6?&Ou$&KWRL;rSEWCaf#IAB8SQX!ri8 z*vLM?Dbeu|jn0%jSOAK73;KK-moOn3QGyNUT~%qIyRp6-#%axUl`1EH3FXh|9RQ$p zSir!Xiu@w{e_L&$>8M_QQtr zy~3)robc*{r=9Q>o0bXRc=%KkzGC$InedfNzv6_~nEuKWUgO+7;jbD8KF!Zpl`1g% z9;SWA)2rmMG@Oi zCZNy$-74sft2=mfe@^AKaH9ujFnv+0&{f^m$T6x_SmMFxmKg2ME)h>)ycwy=9MG5b zi}_+A5v_)>o%P}^;9`PFb$N0$G3m`xTTAZbV*$m-s>mu1u15tiV~G9r;qebA7ndfp z@MGa;7+cVTj+{HcLVsQ?(9 z_m3(EB!}$Pfb&SPHeJ3gmjb8t}elrhn{XiS9j@5~&AR3>WYxXVliK5_;)+ikEh& z2O|uX4xY~!MtXEXnneqjrKtxhe|swqK=juo)U>5PslW~WeFUzRFr$CK8G+x9gWIDb zi8~jB%?`5$RQ=@$(-2p8A=l6tn)iDv#stm>2 zN*{#^l2-;f7Q_n0F30h-G~L?1T}6~;UE5|^iQpB^P9BEdjqF6zth>?Ff2N|m+cl3} zhfZGn8R_Px!cnVnr>%>q_-ThkNZ5DGOgC3=l?H)siIy4~a_-U_PtA+lwsmH>MtWOD zcBr*MGm2lWbsI8F*MSgU9^^;|s2B`Yu}0I~cmOoDf8Nc?ooa#U)>F#e!aJMtK znSRb?x!V&1WMA;-_6av)e&Ua=<8puWKiAxP7wYsoGxUKvn#_9bx0}xOFz$jd^ty zrLup@WY)43)T$Vu^QO@DepT%dD_X#g3I1`euC0QyR}tdAbefW4f47$>ZufGL1M=5b z@0J^&?8y-=ki!q#>zAK%ip5MeCntC_c8{re*S>kcilHHe-7K^dLoP^*`RFPLTnP}s zqtr?)1D%iX*fJOTNtyNJL{~Mj+d89B3%h^A*s28F4Q?V#$?}D3TPnc)VixjWP++hK zdW{BrV=KI(Bq}1Ye_fDbR-v`FnwZ34BKBJ%GE+cMyo9g8L3f+xQ2|~BUbkJ7U%u(I zFKXw|;6W=^DOK?`de3ujGJ&`x&>Gjz;;i(haQxt32X+SWrr(Lj)wMy=jik&21Ksvq z9Ncfg+lHaL&j)&g2>1>im^*(w_@(>{Q2cB90+qr92NgMz<(i78`kfJ-(KzRNw)*c1tJw`$^cyp zW#JJUHmdr*~5 zApnJ@JO3ld(#bJ$M1E6PQLTr+Q# zz+JsPniTJ#n1All*yq;T-71YA@71_)ZUak zbng^={Y0~3=`iWH;R>k43|qLrVxQD;kECjzP>n06hpMYKm6B=FSjh)j)2^yw;5C2% zu}P`bE>$WeZBx>MWZ0*~q-WvvlbEM~)XDn>uNm0eg@0NAen_1sLIx_&cXB>pS;*AH z(&YwbAWDc;yaaOt`KNQW=L^#beTI%4GhE)8^!}Q?AkaWyVo9Cz3`2^*C`tUx(0nFI zQaTNzOqkDMjU0Gax^=Q6Mxk?QDk)>iWFsxM1+YEuK*bEnHWpciOJ=oj9po>K z6zbL9%Mb%AB0`itR)x=-+(^X%P*@52!fei$1PI++3zeZyDey71o%D{OPz_nu(54{m zuqX(_fBsV&xhf9sV}CIM+*wPOs`M zwJ??lHxWa=#>kAgk1-?$_AoprMr1@6x@nMLf?INoUhm+gE!c`b(FATZmz8|EON@k> z_J4b0_FPf4W$E5`*qN8T@5C`7uE+4#Du#S~-w72p5nUrZgYSwo*c7YGRu;(N&3R4` zld~|zwdyPjEw%VGRrLD@EIUEC5qyAV;a5Lv=(De;EiMP42P{CXM7^^8mr8y}3{p~b zhm}LO+OLLbcwe1{au6=D1FR_ls>m&Fu759SM?H*d0!wHmA<*Nxz~qUMg!T?kSD+Go zKtzcW_>2*G#wy#(9vCfw%qJpqA@%=4H5!zoCghp-F-UinNJApqmPZhFuAx-gmVt}$ z^zw9k_IC*-vO}zM;{vF%+Uj?8*)w^T*okVe(UGl5vGUWdNEwBc9);t-Hq@y5;(xc~ zNtCGj$xmnfCvcLJ+6mB8muiraWIY#$W3xh{lKoqtv3y!3kZTH~#Mjm9hpg)k9m_o( zolj0LuXr~(c2wghr_n8(0gxgCIxZTwvn}8!NEO=Bhso*L>2Y@-V!FL@y#Jl+jRlgsigzBD$U7TZhOed+HNe5GY^(l=I>?-x)xnoFqAG%D}TR>pXP8I z5xYsXI2Wp%{rb-yBi+rBeoBVxLDg-)%yhsoPN4-C=f}Ov@p11#K`KyDdE*%oNcvPR zb@Z-5Y?@>`N7+!{0@+$5!A+J|!e6KKdm|NCpa=qz5QQcVOUnoZ`nxo~E9aO6Q{OIj zL>VyKz(w(BWciRr=y4ccuYY87g-3f0F|+w~ES4KFTg@zP*rwPG^A-5WLd4)QN`ZZ& zDsi!#YxfIjDS4C}8aGs>%^w;=KIH^as2RRSNP`{{Ym4a+)l~GEjJ@FS!ip8wh~=p1 z0du-{7qDKX4~9vuu_L9ZkIlUOOp+2ro=8F%>GNo_d?H0vTuHafJYIStZ53EWQ#7=M z!6P+-3eh^aK}!d4B~^&=LK=k{TJlpv*vYfg%gc*P`1s-I>gWvq7$2RFj-UPPtQju; zc;$5QZIsgzw&k)@1=B?&!|R38d@rO+{3M##B@lWlmngFb9Dh?kRulEMC+l(m8!Sre z>gpnLb+HM(utoeNv1yahlZE>VQlL{U1f_0(EH=Fx?vkxAW9^7D3Nd|^l|g;zCwD^S zUKxR?mQLpvA7bRXe>5Z+OtO8A>AJskI?z-2Nz(gtIij;1Uh=2r`l+r$ia}^itUY{M z1PO!@SSbiiUVq=^@jy1<(<#vx!n`cc6_BH!eTkuhT!AeFdho?JB{EQi{GSzKJ_w?c zPz5s-2-&!yZG?_6g?PycynK_u@6Oa1jgWRvVIiZ5Z?1%nL1nezq);Di0j|*!0Pzf` zlu*51@3G6aZX`3ax)5ErLGB1vGf{xgbrVv8Y_4tiNq={fVAZKOfP~WRyQ#)`d_!;X z-*C5YsFA@#cD?Li!_GHJ`$+(kaJ>{TY5Ph8lX^uWn1p>KgGscCC~Oe*krER)hY;eU#s)mx!juMpM<+V(N ze{rb~mib2Z0_($r7!0X?OBTbPJ%q`yXZ38RX!NO1 zr>OZb9a6K{4heZM-Z2B9HSrz;q&fq$}p4`D*=-?o7bO~QVhD2Lt1j3#Mc zel&^OENRm9;YyRH&6p-lAKsKS(YDe=wDi%3s!U2@6ZA<|A!(uSd^x&Fk~2Q}Q2eQm z)^E<2uHAN3!;fI?@MJ`!lt)3bt`JhcI@9@G#19?-R# zcEcnP;RjE}Xk1Uw3E&gR$RXEFCx09GPNonaDLebxM>CMsp9elCvqjm!y=x#|gN)ZX zsZwBEXW{)*OAP29&~29(r5bTZ9xGWuJ`l4{Mn)E^?JAEK+oyPEze1Nywg(tGCucqE zJZ4W)_zvW6Zjjos3w(jj++f}7NxR;lcLC4aw{gMMMkhuNMQJIKFsO9^n}w74+?={7 zzloQhwg(`8CpS;w5}FpN=nkH2!5Ov1CZ)=_cSzTbKtBj+yp7VLHhg%u#tu&XUd6vKrjvo(Lw*Y~ z)~O7C0BATALb!JkB?}dv#--*_&gi+7Kmh`tHwsKuJ3axtI=)MsL>I@Caf7#XHZL}{ zSUoF&^5A8VhVZTnNdP21VWoef z6Vlg^&hm7g-xFe-pl!1dQgm(q6NVT||05HBch1}zI#Mw=V9t!|few1C1HbgY$eH2H z5Nw@uN7$-bf|@0xYBA_dq6h(viod>kb$fd|h=UYtILlWW=dXAL)cQcCABWbz26wCN zI+ps-<4I9~&NZ0n@Xx8lMRjLINg4uw zfVpZv3GP9QXGSc_c*Z7p=dKb?WRRI6nW@T9n?}oQ8~b&Ru+p=#$R=s}k^=o{Iwg#9 zB*f@FN0Xz(3vWPPfyWNxz#&s3fuez5>8tPj!PaFdP*fn+x@JxDn(HAi;mOI^UqmByyD82KSKY0S;Jyz?;+Q zG9K!3hH|^KRizZ)<~!6w`1}Bn+G>Ue@v}H2rckHGnWtF6OK5j+wV{}p0(Vi)N?Vur zeX5JsH2iZFO~MQ4Lh_%{CyLU9nC&E5Y=yFk9E5wZ5sYdoOHDhq`TF5B-n*uFNIBiU zy!0y^rNp*f$dGiYKlMgi8NrNySu4aOsbnCwaAMUK(iOtvL=?(EVp*e-M4Wdgj_m)o zsz#}aY+Z;0sw-2Z9@lUKDrKX4RwTU|h3DTusq9q4+(hd+YcP=DNb5Phvbyx`w4qN7 z5*?(exb)9C+B>lHB9#oPVT|$su(YKoQHG2OGV~!MH`2G(dmekLON`!sKi#P=Z~8&$ zoGYL0I$s@R0Dv}X!98j(>;J~59N&-HPC46NzryHOR$r9JlFVT|k<{G7%mx9{-lD;5OP7oxo0Yt8*u9Hg{HJtcR;!5l`i*= z#-rZzkC=`z6B}3-_$;=1fZ1fyNNn#HcH5w)sgylpv-9IH){q&0OQICg4mrs1PP3EXRKr|$%_C{1i(Nu{O|TY#ps%tFd$ZZ) zn@k*n2KF{9Q7T$c>!@E8OUd-BoGLJsLf#|*9ovG>aIj286L3z8me=;37kgPUV`pLy z-ipg_!~wJokr}dohsq$veW)%lSYD--6jDgJF{zqpWDt}PJJw7vCkCV51Dq&Mp0ozb zyoAu|SJ;L~NYIhUNR3R0kLpH+esm|eImYxm3D<_~OXkluW|RF)6+e4P7rP zQa2~sjP?D0yC7p5weg4*@aD8_kS`<1j}HC|?VWoxYsfhxNb4t^xSHkl?H#tFJpe%3 z+NaWb2RI;NZlgPK%s}32+Ice!n1UKJbbYzccDVZp#uHeZSQ;g`I78GM?lspf->;j5zGgu+(t&lKa0LnS zB-Z|Kn2$jThA6ytN7jJULL=aWEd2y>kQ)fNc*598hvr)p?s77%&zNPMC4>0 zl@hRjz@J=F%MFqMjT-l6^GLBFwj+M6eiKAbSrSGf-=KxxdnAG7a8S$ zEINZM+}%|m8!IHlaV)+$>hQSMCC6v(s?BQoJS7K_b~#) zi&NjJ=)__AgaChNcc|voD$lmt#HX5n`(!x{_B^`fb#-6^UD%cO1jC4&cu|xV(-8%s zTSuHu=<{q1V)a8#@%G&c)H&McI*VN-p~uKXX{X+*1j^kd`QZx=7^kHe2M#jK;A78| zV4MrRCfgOhx}mJ+SUA2B<6TBzPH`yh%GEwB&1K!Dlgq|VT?lt`he7QEx3gA%6dY$s zJim7s|4$2NCFLhf(%V()G71U@Vz`3>*QO_UiFgk;!YdAZYA;WbD^9D*Wu3c1=HKpe ze8ki3%IP$eRZ!tQcDcpM8m^NroyFWsIx3}5KI-PS37{&ts%cpG!!DgWNg*sPuKv3u zax3d3cHC~ou9LLQHg2s_l)?#rzMHx+G1YKY>9{z&t@x0K@-C{;)x@C>SNKNjF-EE| zT0_1~$FeTBKq~64HXG%gN6DwbkDn;C*S&^w3llW4d(5Nr+Uw#@OCRN^b+MRq>3{ZX zl%6KhP2emjuOJD+I^K$FFiY?5&F4heb(F4$#g{DqwQy9U=*`=$*uGmzu>-eahi=7Q zyA^xmR_v`?u^+mkY?kn)(C4-*aZLPMYTjX9P_zp@vimSaXx6)(}(@vZR9$0yn zAlDgy+oFJki%QV^&VB^92=4^eDX@`6RsR8OC(e5_!#iMR$^v^5ko@%Nd9Dh88M@DbXk7WoVZ8su*n$8I?xTCRF)U;4&G3y}Fsp5m}Hjl4&;P4GcMH=0* zPc1iwXC1o)*?od?N3#ASryvyd=F;!5s~6)MC%M_x<)_Kj^kj5-dVDpyI2V6Sj^3Z0 zo`B1U{cUvq9`JbTK3#meqHl!yYJYw|Qhy(v&3|ep1v7o-Pr3<~=LbBt^?1;(U5?7!~s5BmqN4~K^bd++vt=6TSpunTGxq3J8YVfwoc4j>B81iuCzp8>Ofe1t7YA)u4k4S-P^f~Tdio!$)YXz?j*iytgXxae?2*TJZ|u7p>|B!6ab z)X3UGEJb(PeGrkTX9}Zg@MgNrrf&xns37AJ7`~_FLT|bewg6tqg_lrQG-(5NORoXj zYN2J_*=&;KuYRN}F4z|F%6C8V=6jMw+5F^3)O;zjh?<}Lh>F^cbD*DY{AhCiyD7o{ z7=-bMfdt+1rppf+sj~B19WFh1_odL>hwGs6Xm0SVbxJ`MS{`L(eAAvscRLC`eG%mp2k!1Qhb3JNk{vjzTMW z;4>W~Io9)G$_Dl8z&&rlINn5%wp`qo?DmEY#5Y{UBRj(7E=7mqnpO@M!MnY;hhhKl zb#UE3j9wq~-wofr?nmPPKYt8^`Tq6wbwfvTrs|W#S>nZ%6_> z6im({T$|6jk-yWqk8*RS(+I1p9K`FC3!z*??@T|KC2%Ii94q<=Q*YU)V8w>~Dd zQJmgnzc#lrT0!nO?lmobu-?}Yw zU(5u(zZ7N=zYK}T)Zh|>v1!uE_fi-vXDlHqguQ8Zl#s4>AUZPO9^+CmlG`#>nK1D6Q5#EH4{dgD8(DQG2u9#>eCep zoWbZ~aIDh|4Zy{hzI2SDVSoHwFNAB>so7tmP7ZTYq9~*%E`L6MI9-CHYzAK&`O0ri z#^<9SFOSZz%rWaHDaU+322!0t`6gIG_>7Z?ZJazF`xM6h@HsSetSDVdXmhu8&9(K_ zE046eu{^6RiZLIr2gAYe?b|m8gW=xZ+h>o-^-Rv(n0O~@>|@PVm8m$&c1xl*En59A zD>;^Ky_*N0%zq7;*%U)Ww=L~9a0StSI5()Xhe~2T{!SR-uyS&7?Q8IquB`Q5xF24J zLI3T+n_>U(-Ts??@J=YP;X85dT!hz$2aBMTwFhZUkye|!8i?D&{lCOkfP0M2Av4vp zGi6exl0u6T0vreO521Pe545TH3|yKWfrk> zq(-|}Q-8zH7aAL#jgf!stHnf`L=%?;Q8p6=>LDWmH|@?G(ol$0bX-D(SVCGGm%XXv z^qiGm$~xlT;X#iH@vBIC*5OBj-kTv9q=-W`E$Jvh^w8{W4PK7|SA!!Qc;s7dDIL zg5t3Ud3)rG2YtQjLI6YBETgVAy>0C)z)Gx=bhMdKAjquNbx8KOXb%>#ud`to^8=lE zV-2pe-PRfd5ZBD+Ka5xpV|VQ|lHK*RWi(au=m0z0fhi^BPlpJzwu~Xb?u#|f-R~*B zCS}-YdHc5ItdyP~l%*2A<`j;Slz}JbliqI-b63u#h%F7mwD9C4eS?nW<&}JiU_Qv- zh#p|Vy7o{Xl?7ZuEgYImZ55=h-ME=Dh9|#|d2mo87+hlL&6FN47UjBX?#XMYk&xMK!X!`bIJ^s&lPk2u2<`6;>n#E4`HLroMvhXj3bfyl3) z(X@Dz$#>^)lqqX~asWUNe2Jb;*JSo7V;>N@!P{G$R&w9OBa@ zeQx6+JI^#50s0riLuI%I^6+WpJ=yiJ?qp;N8hiPF9(Fiw zPIkZdxpf%lUiG4W$)ubl-8xseKM%R_hm8ea+H~CC_ZM+-@(i9ZzKs&Mczo(C+#DBF zi;R&G2dZ+$`hS>b!7n?l=jSno{F5qQWDlQ66mHW3fS^@Uxhs8+nt-5jLfK6jiaHw? zS3hc3y^9ZgtkyO!f(>Wi%OtyV0Y#vK1kY&#@ZFL!u}7kge%)zfqjq+?ihG`Y*kGRR zbugdNHjz^~#pV5d;DX+B@nVeadrg%T6F64;{aC&Tl=r(M_I{9wHyr9F+CV$3v=<8z*sUETmkU)z|zm?td;$R3f&2{Rjpo0K&{ zlZqb^?b&62%h};{4vtw9S?QcUefp4tw)0TX4c7(bTaUN+q{2wcsPZ(4^I#vt%743I zk&BDafPX4qY;a;~uW{fm7^%v*xKpIq$$60l?k2B|()(>!?^6zQlGSYJJK@p^ix1`L z@yXXY@ux>Aatlcj+k&s$EgRS=n-eBfY&=YTI3&00VoK9;LWEtCE6qv{OUKGg0c0L zcz%J5xZxzIlI1mqk55rbu;@dETl&20Q2ds=x?6fdp zAOsBoP5U?kiq7Ci0l~0jyf=>2%~nAni)q85-@vP7?(bv_|Ky|MUdKbD$}?|L{#8XV zybU&tuR1&hm4HTpo%>lE3bP$8rk}$YM1QWXJdMIn?!uCX#Z+(3Dio=hBq9EB4)|H` zB>{)JtNFeD5`tj`?E1etKfB_B3pdd+MMyxfe6DsTVoWfEPbCKMaIQYZqpXTl>IL16 zs8`IG?)c2P!o{S@Wm`Au5*qAN$c31>Uco~#84X(pL6t&GD_X|kmIy{1 zILTz^e$>3qD1pI1T^@N-4_z2(w?^p=92i-7VJw3X2639}xHmkTF9;uGd5gI!lz1NE zB4G>Q@b9~9hTPsvUs&RT~(b6aIQyDxD1f+5Y$&MiG5w<5e1D1 zOGk24$n9Fk~wol!heVm9pwvl-a!Ee13>dReUV+@`fwZzg`ki^B> zCaA@Cw|ktBmm(0mS|L<_syiZ60VA*iI=tEuLkB4{0jH3*0D z)*%RYOb})=-(|_}xdk%Cs(%sKy>2mUg0~0$-0DojF9sD&&nHg$av4yRD2_D?mTdBv z{D2DtxhrEoWZElSSA2cofL@CO`mQ!u?XZfbC%dBxEhQqE5$|E)Lna>+?dY)ucj|o_ z(vi_U6yWFG2&z=ILxe{VM{`!x_=HgY$F7)s;$-5xRY+qP+f4o#dich*d2}(tDRU4eJnfIh_+qd)uymz%dDzxuj$;j({yevQ>1fya-rs_ zUDcg$uWoUnCVx)Ck#>|tZR4*7PduHqkK;mZJG3hqe&q=fXHSA=QWg+6{)p*aOiYlX z7P`oQb4TnD37Ys>4}T?MHTOtj4w^6^zmaFHVtdm~j8tm!5OZS3(xnd3E5YVRaEFzM zM&-zu)WWiN^t&y*Csa9KHK==4+)Og(&9%rin~PTm z;Y5z~YqO?+-%q-nC~GtADi^qRa*ONwd6=h39)8->7nd8hhkw1HcP7E^0VcrMeUtVb=u|D<$)LcU~y%U z-J`Ry{}M zDq$>dOPzyEp?^Pg;>XE6MYKV`Et%Z%y0-Wk`*Hg2E@Dz+D@+L2_jC9UGEAlfBQDE* zArKCm?41|b<3hy2o$?fb*HOWwn?+d!+Q~tvbe>VLmBn%_b=IDZc%7&2-p(D$to8Re zo?k}2d%43UW&R{iP{B4MXvEC94uUF44kUj7ARX@J1Aoqovd=cOXDY8mUD;+*xUHDgSR-Eiq`*fdIynsBLW*4&Nb}^{N9I0Hqv$22EfTtdy-^h;0 z4~`O8LCVN%x?ZWyC7{Qo0e@1pH*#YC z6DJo}>bzHBw!rN4i#*4wN-Exc*+w8~eScnJ7NE78ujQVGdwuKVC8$ThTZEIGbd)_8 zHEZ#!K&WhXmS-L&$Ps_{^Mb&0Lwp4;V-Ir5z)u(qt#nO(u-tHv3Af@-lb7h>H)p1d z8v>fHK(SGIDR)uMOc^Vbo%{@|x7Tf$m6|sp{xIRKUZ0$Ej*?BN*>wX0$3vao{(nR! z6?U8OTmc8Q90ueD4rDxR3a*nu9rPGnz|T9D?w{3(a&@aJJw}rqW=0DM$L21~gBC;0 z)aG&SPER*Y!&q~hZ}Z7FE88zI_sO_;QQIo~!*uH-vS*&MV=4uZdh*eTKC}oQz@_xx zPS}s6Ju?YWdI~3n71*wMIOXC z#{OQEBhpN+B?RcLTfa4Rc7=wi)q;HBmT+JtlHxNe^ z_QRF9q7w{~$3KEkxKnLFTwFha*?aR2-i!e;9!@R??1thq=iueN3vbEKoqsFRsi+y` zIW;S5R_xKnTCuu@rFAmnvSK!P&DqymrcO4^*%|v4WSj|HNVSpvsG6(_%3_B?#F~{@ zgHa27TEm7A!He#Q2;2YIz&XnS&(8EvhV(#6=kd=E)2lY(85EJPN%PLj#Zi^a5P#zN zKWq2*CY|r&>9dU_$phHBLVtt>Fe8De-YQj0NLb6lHZh%meYl)E0+HMy@c_7l>s-2? zKtj=EjxY;vC4BL+!14fJFRuLJ`(Gp+LU{9 zb`*{*S_+KSc*)$@6}5h=h?HK7#MdoW{KFhRSc!P+-D2_DOcUH&oTtbWMz4@blF|e> zYg(6VgY&$NZx`odCrnTLGJk&co?^#@36KCM1Fuw-1$qcw1mvnkL2$Y%o|aRhe}`2@ zm0Io$>E-L*GI<7LB7`NyK|kLmla_T9sy(H7>oQw%$!o(y3M;EJ--I*$6w}^2F`hgr z+i&KJ()YJ^+7YX5@7=~K!~2z8g#EKH^fqX=`=_kchQFrScg53OQQ^OBedKP{Z4 z&_R$EA-~0gbk1wqT_n^5y^Kz}e{0WweCZr;f2$wM2;_%F7@?yVK4QMSPm>%cM*IQtXyyFyswLkOD4_5`xCHj|nil6D^=F z?VMjZ%g9~js4*fp*a{R!NI~6n@hZG@jx~0^@#yyjr$mHqfUzLdF<^?sy0afIe*%^F z9eG*&=}+wMXK!Er=}+YTf53Ku8`gKh?PedW=cgpQL9cVw8d(F3xf$)2u4;sgf!Uk5 zZ32NLe{nrvd)u+HnF1*u#ChnA-sFnfW!v{=aGkGo$dGQ{?g@srT|GcJkhuZ8dL$Nv{o;$e;rkSTe7*ya?p9M zmE;MqBO4bz7lGc&C}+t_i~^snv@u^X&2RwIHcZp~t&lJrclW)Isa9m*gF?E@i04)e zkAG-l+MevZv2DkcUziXP1$D(w&czGW2NQ!YW6UcLFMW+SVF7UxPH!PZuMqB&2kJ%{ zbLFk>AOb$-lX{7$e?7luTGV$z+}dwE9Oh@;?=_P|zDe#|`^|@?6#IS)b~wHEZsjMt zj`t$d=Vi{0Q<#+b=caAkxmnCn=WLD4uP?8hH)JoUUj8-HPrOOz$sP>2*Z=VfFnTiW zz~#S8{|2C15Vq_t;?9fWwNcY4SkZYFENz4**NZGYP@ra#f7;eeliao{!nIgc_ALRR z+{n!~w$lW4Z50SNO>MgcqnmX_i?~CrK6r@OR9>(xzTUW*l{?j9n~qEjTLD!tdD6P# zd~G+=Ua++Au9LNwD~yD*t;<%}wrc9yVO>%Dp4|$eMSVEMT1RCJX59pEk=u12&s`6J z#Voz8pn*KLe}4Up=ZjT(`y{?E)^;qHwcr&Qs1KuYW0WSKdXeNi)V__}*s^*6!J&aA zJFM#4`mM1Rmh=2BEWEXC^(eW^-A!se0@*-Z-0s-K#(onpEp^wU5XLDxj*D%P@6U8c!wl)B$ZEL5&${8lEv96xmS5M2i zt;NM-W#QFjr2m(!p3lKo*4vJKnNk}7Tk)@ff4{J%;C7CI;P%xivSx?=>Dk=A2~h8! z?V#SX7Q*7|@u7W60~YX%wc1${S=P4Ry;wEyvcQ&ZG-*V>W$mC?lUc)38K4&M3bb#5 zP*2Lxb`bE+ZY}q)>ejOtF0I2JskSw{&Ow8RSIW8lfdd7et$msWJ2b$S-o62maLTqi zf79WO5-0aG5XL*K!6xy`h;4u*+p&dkWqWv%G{19;@p$%16N<-#MeQtDg?W*=aj|0q znRWeir{QP2jXy_xk8GEtOnxD>6>OWR61Q8_CZDUF2-xxRzgs6E8wKL}S~jtD*&edq z2)^!iI==cXp~+iS4k0U=oog#&;EOU_e^|M;5=fbK)zYq4%X?n9(OT6-=$)md_ppgO zcY7)yK>Dx>qVXSF#@=Aqk1Z>Lz@IEhHuhmdP}^1#WA%4<;N)>f)wa*_tvYO>Qgd8t0sbMvjPP_@NKK#+1IvYloUty z{yjm3j*lp3x3-(7b4!*9^+#qSP;l`g>kBOlJS3Zfig#(ja^O(iB79lTp={f?rDmDi zD$qG8(6$ETJn-zQ0m`ne)RG6kSWd4J>}*-pR$9u#mF+>!Q!5oK&phi*OObiL-EGcl zD$(6GsF;C0oTgpe>#Y}Cxr^j7ZG~N|tX(STRbja@RMXN{CIK{UQPivkTlx!oSAsH& zY?&GuVdj2#Yg;$8?iK!Qmqc|1A_2d*XLSXD0s)4X=ywH`0rj_jcm=Em0bjQ(e+9<@ z0)L;E^ne8{0o|7&fd%@1KIi_fkN6+>10k~XD9AJmV}VsBbCK;c=@W6PMIQ|VDnh8w zAv8hKV_Yi8GTpk&sh!Yd-zV8LCQJUXhmM66VyR44%h0Kq%@(Yh+`H}VCA|#5ioQdy zj!gaO2Uf8GObj2B2~G6;t?=L+!Ehfs=V7|mBW^tWWzUwdbGBiB2%k969_yPEzzWW% zwS+D8X-@;ZkSo9v9S?9Ct9AXYwl@FHb@*%0wg~KJgO%uXslE8&r4us-R)jRW>DtY8 zD46hO4?$hkS);iVV;*e z?L#Zu7j})$gj2nLrfT!0vVfOa2D}N);tdi4_&DKSQC~m~uJNJ2hYwB-v)t2rFBcf5 z!x(mr+eWl4nn&~7@myb8o93`m@B(O+sKcsuoz+Q@GL_*WBY48(D6nR-wZFJN`{DA+ zxdJ}uywP9887t(n{K==KDAe5&Q2fIA9(L}!6>=o>p96bIujV@0zyt=z6+3T_PxlR zgWDu3+4Mcch#hp-mQdJ!Sc3&*f1gwN9ai)e@Bcl2>z_X-%yhq|TQI4!1z(mCI9hl? z3U1>}FitXerSGz++}R#Z^8_k@K!XPwFgZ>F)A9W`XF53kh-|qZwd@i|{-iO}?TDL| zXssC)08SpX9W3?T%Qsg{*}rt}H(~5cxcONvPGC>3?3!cEt|X3-*46b8+kA4a{RzVj zQu;oBU+zUWfAOpG0txiBJkO zcanCvA(!k!CodrhRPOv+US#Y_{>vhAy&K427Wn`6i2rsdzk>DOYyY%lx9A<9x3Jp^ z3_4XA%ypJ0jy{d3j*ZUfX$T1hF|Y|oTwAe!!LWOcmC_%?>GwJReKG>b<(&K$J$Ca{ zFgEg{mo$NYN;_4fk}+vseX(yM`thx$*35F(u+l&HKZh853F0OjBP+nRX%b;x!RI(r zfLS&7f@R|qJUY7cEBMy&Kfw;4Z8uTtEL2354g8_PRTca zXm@nWsK9OUb4A_HjvNF}LV_SfRcblZXI_5mFunrr*R-?Pvj2>gDe!aVTomY>3XT`D z2Bleah%7t?=;SS)JPk?zk(6q2bfIDCw1T%c?k?`Q$BE>vN({eBFE>hENf=(dLk=a5 zaT9E+{LZCa5cVc z6!1l&PkPh?n|1!MVw3@I4O&GlYOR_KeZIxDZqo315=A_F6l;-{JR)Oc>M}W$-3eJ1 zR>2)`aI3SA2Y&eQzoTphuAa@{Ec33}oD?E`71~B!=`_msEsahy4uG$T^3Yg^2yf~9 z#p`SC=cT>E??l0iIDa91s?4r`S;g=>1qBe7_IkuZ0|8i3Nk_610T=$5t}oBdC*1;< zuGg{)dZ>uYD5^K|x){HRm}u55xFfeBVLR?3DGP-Y-njsL;057rb-6Xi+#K3lsFN1& zLVa<45H$N&7HNazB$G@r5b$3-=ZfV7zk}$G2(0VIN4CEipywsyKw0cvMiipGGiA`^ z`?nY4&yfHY89C9-dFD^sroG?lxBgCR{Nt#*zilEXTal6LaHhn>Q+i4P|9Ja~Xedt_Ye}8*==)4P}I4BOCt2gY^#pTr*{FiKq1#ki1m)(d3^a6jum(z&_ ze1Cr*9ta?f>T~CasD!S3^*lxEp65snggrIKHPGQ$RZ~Dj=wZ21*y-qu!yt|6ti~7$ zDc3i7gwegzL79an^8i!Rxk~^!4M`oWsQcgenj<$0gn!cO!wgVf+P3{MklVZ4D;iDr zeeKR~ZOcl)$34JA2kG=ywMR)l<$`EDgny|k1twltzyVi%57;^hMQ3>UBUOo>y9E&& z+16zTvUa*-=l$!8|2*VqK}kVH*#<{g2n=bga|$fMPX2M%2mpc1+^k|iHf7>gfw}NY zCkxYA!;B+qaMsQ>sf2Cl7@VC`kyJ~-2EwuBPX%<>X6#-{;i-|lGnlsGgFhb%)+cFM zh}!V{iMGU^X&K9Z3JNS$RlpAq&iqXn!}AopX?=JA>=)XGKeu#?1!V$%Kj+>@fYilG zhHRSdV$qO*0zq(07eNFd)-+shg@5Kt9vAZA!K2G04vQpv^dih}9=#1*zu`Xv{ZZ6} zf?;eH>!GAFZGnhUyg|rUte}914(CXuL-^Z_in&|5UKoMzQF}MKL)-N>kCGMcVsJ~j zhftTWsM@Iej0K3b(?#%qx4fFgleHV+STP*qcdX}s8wK~jd%K%52wM+?KiqPj{t=dQ zoT@l=+ywHzQ6UphV{Ej<1?19X{0lJql%N$#&w%hI5TO-7DIO%*>G^j-H?(ZgDqzDk z4cLGl_YkY0`X9FRI5tAVYWuS-EEYAxPDKlMw5&ys$+h` zc7%+`oKkV;Mc+fjsOSz}S_1WTg{7RuG9q?^k-`f-FKLaqoFoB+_7Q&W-L#H&%+})P z)sPH|4&eUe(r;RgqOS)9US3{0zVB?=KhF2xKi_PgQ!=kj7)4Id}Nq?Z@^2_#n>X|1&P`@aKGNp-or>} z>^9EhO+w8*$XiEkJ=T67`Q1infpgG2tMXXZjw@}kAoeFbq}F815G^VP7nnY*c2ojPuyv8>%~IZQ0NS>XsX~s@$y97OfV7Aht$X;O3YY zngo}_HnouH_d12+l~>qzG8Hl9&1ACyy|a#H^?Zcq_`C5cfA8k&D&=CMHTZ09GlF@n z&jB?Ih!3=XTVW6(NVtu@cAk<5053O*j{{8*^3<1ZXPXu2O_+;6dJ{gNp@C0!QAxPXY|0+=D8 z{sFi%BBaLw@ZY+(9E`<0xP-7Bq@q7grLU%~or2HSxqNb?%x|^OBV9fIHOJO-d^!#- zW%?6;W#bF8Us_H_zG1O7TZBv}WD70OURO+FXSCps@PmTwy}XW9H*+q_s0fcD#??{r z2knxBOGzNn1wiXVOCLUf-obP9+&Nf@+qY_XcASLqLQWF-{c;~G@U6Y*hw?V>qOIB8 zWk9uuAxV&TY9kD4^VBU2@*Z}U2m9vi^)BLnpJ-SW0i^)iB?j`2ca#MC#7b&?nP__3B^Ds$c^#@pB`cdliERrEGWt>b^r@oec(O5KRJE;r1q%$7AYKm zWqV>o9GxNDW7`SOf?ohJVx}XY<8PFpQb8$vV4RVv0rCs*L74eWhu`8oN#&hUcA$Yz z0NkPTHbAty>|q;`(C~d>4i-!q=f_S3RU0$!NI4~TmMH;v)*u(sez$dVDf2*^JzsDq z1iFmbmcl-HTZalPiH?d6Imd|-Vd{c^U%2$cOA6~cLPWwbT#Hs0>!0HCxJ{7q1Hh95-W~7 z#2R45^`pU6ld>xi9JRC$3^;KI+n!n5_ig#8Ca1r~(=+NlFWjuys}BnHU~HGEoxxY` zmZ_>wDz&4O3W~7qsyka0%Vqwwcjs3?_xl%D+T`Nh0$0XZ$opf&de1R`Gb2ssp>x82 zb62Y@SW(vHQ~nz|MiRg}ovp{But#8&?-Y$p$GwLQRdtg)2bh}SSXViUnlYp&-8+dK zkjO~N%g&L*Cg7gkt`{$^51pTag+s~bwOqj5Q=D2D^Fa3ob8yu~ijW&>b+bt*asT1r zJ{9s$zAb{yp-gsp$n9x=U>j!uLgC4#)5-jwwgJQUL@BKTRV}JOndo`?o{d71!?4*D7*Ogd+3Vp%g)$zz;VL^E(1AnZtk)z=265Hi9sM+&Ou2 z@|a76OnechIW$1)^8qsCymFWxBP&&jO}Onc*PG_Q&OPIQ95Z!W!ZJfMHyM2O#>J<3 zJW{4Fvq&_*0LSzgAH1{5c222x@7&A}d_89lmY$bA7TQg?%3R(XPc$m4C;oO0p>8uw za~GzKEsAu;?HIuf3RY!AH%w1=^TAHCV3QQVJWSQ*Ig4?dW(BiGaf^s)7LCG> z4bEZK-bPw~iNsno|JhaAhV4mGO z05S-dxhyoc4|?3`oL{xTxTY~FSA7%A@zD*JsV3tXy#p%WMB_-5)@D#UB z7^h{yr^JgAb}cbR1r{$P`RPWRm%l&2l!~N7EXoyp%$PD8+_9fdG~o_qy9Z2by=5b0 zY;934*^M*L!N29X^Yr-m7&>3YNfyj;edMO;pJx2C z{4uAWKBB(i#`7iKbg_qu%gHev6Q-%o#f&c9C=Yb5%9q`M1XwoeufK)7@WYt)2fNmj zNR0pV_{mo=KWr(eXffWCGpp z{&V4_KOeIHMLGNr)U2QBr2_w)|174wTc@IC>xygjYm4w%_h43X$P4EPvV8M-hDV=s zdLBU6)p&)e2u0a2uL|Om^wluca2?fY_8aan-85fZ^-_D$P2HN0mY%tP4%468T=Lke zB@vj4!?Xg+=B72TWZG|BU`sWB)}YJX9ZnY)u@C;6fYP*-e1^PH(Z2^@rBz22a!{2H zS2a&6)b&Z4`lSpr^=>qb<4Pb?6%S7Zr$~pLVRpvdn2CEi25H{1B0hhkVDrv4mv;j` zK~AW+Jdza*xdZI&iz|8-#KQbV4VsQu5&8Zh8bEC{Sa`k~^Sptc>zNyWuL63%Phl@m zG%q;Tzym18O%&W!p8XQjpRqIaCgu;ZhYoLz8H@7$NULF(<9#fb$s0 zSav>PLsN$kX5uhm%mt5r=daQ1*1>JbcOCFIx7sIk8s))bdl+NGFqB%n>(B{>C)J<9 zh4VSYPyRd`dJlLZHzf|M#_WvO_S-OHLqgXGnw~0AJ?jDwU=YNA4Za3Pa_$yJt_!b% zcvVm!PPhpan$hngxDRv8W*>7W3cW9Jsn0jL@iT+C1&IHG6Hl3vGmoF##qwk>Bc^h) zwfpb@!|sSAcx(68$gH4iuB zBcNVuQ}C&?u}al{Lw#F|WpmRxTj2sA^jbS!i=BpVo3O(WNJ6Fz#*hEn{r}qipXKiV zsDq7Yq?4nIUPkWb?rW_oB5pMfSILh;x0~MY@#4~7mu0)e4G;h&@aqr4<_p`~I=Hmd zn>JeLyxeSD9TK!<8I?kfh2-C?mh$ZCQYsuAYg7?M*&m~SFup;rMPuPikW8&=Btvi9 z`^1i1&{>@*Np8y2*sNos=Y9&swbCa6p;u^?tB@TWYn@V>HiQxgiX2yBdE@{_`U&lK z_6bZSSurG#a{~Lfyjn=?A7%ON_RsY;W|Iy!^O~sMvW<-Feo_;0y&HEG%v+xL`$Gr) z;6C7ii3o;&08!{@;KEyk)gx{LuqWIlRe(2udQK0Z^_>HaT8LL1>#*(CX(4?PA_fFP zGb%Nu+e(xy)Rw4tYfBrHU3hRZ)Wb&Wjm6LZYx$}A4H+IS0A zba2sm#T`b|${AXKE1IKb8^ycnHhkcpLhqt98hD z2a`5`XU-eI9$N!y2l7thyA(|kf{!_RlS3KsF24)D@SR^uz$ND(fPDf6G}?pF4*hKa zK80zaJpO*>oJ;U#4D>@PnbP2u8gB|3tz5QHH@Ca8zsZt2h*#PKY}LISUrCC8%=LmH^V->h2@q_Th*%YVi(>FoaGwTQ z7{KC-cDXXM;N4LG$*l}Dh~3+8#j^sSd6>sl=uCD{7!_<4s38LZ-x2Jbuxk{cors_= zX~ckaFTK?4nMx(*6*z$Jg`CKSoEPFG2*3)EFW7+vx7$F#iC7Zkdy&Qb01EVA?`^k# zX8WYn1g&l&yfP{`v=t+F3s_6}I$Xk&1fVdvu=jF8#miXR8e8?E;mN2@f*Cn@^aLOa z8nnU}Q ze5=O^pt{QILTwT!MG|wsGX?LIXeS;Uf>yg0Ic<1jH`Oj|as0lnO=q2&*)Hd7)SLO2 znxF+Le;6_YN@_=F4>%qOKMro?7`Ab=IKqSUX5g7UBpj)-pzv0AFkV487zkt@dTSPC za$+$gO+i342tq+#(|66JBi5VQMtl|K1qG*2vZkCTVB*k0Sq2OZEPmjgT?urrzzP}` z!A9WqM`13*s{q&sv=l;I0$Sw71}6J;a#vU4e`W7uTzWh=CYA$_mf&e6X1;QT;M`z0cXwjnC6eAH4gc&;-TEo~mNeKdWc#lg3cM%kK5ZJv$ISL|QV7Myw z61Vf+Wnh&CC=LHZT35l>^o?raW4V zfBX;e>!b*tgO`VF4^|oQETIMH6?Xujj)B7AG9rRycuz=CA7Tgp;g)8Jol9UoQsE)S zjYcB8MPhE+rpjmqbSdHy&)J7h;Up#8Sj;xT3*{E7CQ3JCLgtOQ<{u*#@I%Z;_OA(_ zn{zjH)^qOmqQP&e=cnfwIK8Lf6O0`We|0eDgqn?=T!zF36YN8s1?l;t{-|*j*p3Rr zLF>B4Q#oION&1|pPll8ci?^9T-17kNDq^eUmBz_(R3TCgK7tFgG<$V!HHr#!D!Doc zEg{eyu3-^LbodaH^H*4e?A!t_MK#MJ@_gpJ1S1UL4j>egL~#{{RNXkA&o?B>-Vsu>ZS72Y%@-kwah>kxgf2^gnloV9is&%f1wkv zuC4cO<5E%gt+HotL)YO%LLu&cp=@Qjg_TOIq&l$QdP|Sn0szXKKOL~WS7oFnLK(0n z|E!jCm~XPH3gB8meSGlc?5o)^6lnk_twkOA@Pt=Qt znwgWZGH4IWCFEG&9TW|`{D}hc4tfRg9bUF2(D5CvBPNEVl)cGJV54NTAdX+0UtT#c zy>;@IqsyQ&H*3Y1G4>9XjXG}?MeuC^sa0yH=d*CJ3cbyM_#jJ&wSys6ftyjd*fng^ zjoEx*aDO1QbW}xHbYU4$2?t{>8VPOy3RgHm(YuTR!>HKv5v7-rC?Nb6pa!Bm-=N`fspfvPuwz$Xb}baDXLO` zi69lS=+5g5qr(wwXgu`^Lg&UE=ErK%+wQA8z<+Es6blA^AATc>3royIi6I}?MiBHj zBKVp8=$1v|hq;&BVuY-Ij8aPZn>B$P+`Hy)fp!a(^ zEu(_G=c@InHS|{4C%_%UsW*G*5ZE7j{Zm2&_Sr1{8rqTT1F!~R!S)?I$R31`zk25U zw|{g0)wB7tC+rVywqgI*aRb#FBU4yPbVTsf5zkSPTgF^E6I5yaVd>cjpEcIdO_0Sw z)B@HVR$CJTZC%RvQBPq`^+$Bd15e>KZ5{BWdt7EwBB}xMoZf+)1Ga7HPya1`)2F$r zHfzKn3=JQ^i(z9xD5!Kvt^)e-~K~QbCN>UD>x`I0@s%#PLa0uM5PE=D*)2Q3+WjG}P%w z?Bk={cTe=)0`=xpZ}c4SOh5=4DN`&^I1z>t&FY~;!K@CI)E@;cQkzl6JT1Z6Kz~1@ z_h*%30XH5K?1k*#eUPeyG^~>C|6v@*0$tn z2YzFKDgiGe>@ve}1c0>Cp8>!nm!6fog%9P+d_%!vve@8@H0yc>_hzpUtQ5+Ei0w7S zCkoup$N-)*F&5w`IZUT`B$v0odVl#<5_AwPCcCs>eY2NKTWOYG+AdkVDft%rK74Ec z#P5_sWV~jYP0BbHJFMV}dxWmdjEU8fvp^X=+-1&r++6rr*#R4zD^!Ar%!$Dpo!XqwqYKe!cP+gDA9&hIy*f+`TFSi8QTKy zPEVdcefs?5$?VD3$Lyc~1!^Ie|U7Auug+qC+%2s3qlyd zm_eB~k1b|9M(CauFh-M=RO^0p^5g{neKwQC%-B6Jb2l#Q8g3ge**s{8D;&3zi462G z!#l@vGe3Fy<uM%GTh>AaGMM*NkB2khe$%$^CE3d+^Mbm9IJN|7(--bgoO(=Nje?pEEOyda{3$6fA3Vklj^Mo24 zu7{6UM#Q6o5uqtzqL>x;mjR7W3y0smO;Sp(OgxgscX5&!T#zkp$N5u*lnR@bp>jz1>YF^c{B`a>JPB z%P#?pe`x8*F}8QlpVxSWDT(+Zclcg$4iq{b_7gJA_QGs`nCe{3*h+JwY#2>%8z2iB zn}8~CVO}S9#1x4PzSWV!o|P(lQuxQgb&@YfXti%*kEtN;SU&a0m(Sv`EgJoa+|U@D%m9QlJL5K|RGwpChNGSQ__ zzQAKnnA4tkT7MurM55FlArw4}Wk^0?6VHz686OQ5@XOr&^8v9|256 zTa|2~p5MUVMQnT|0GSM1X00VF3{Nw38;q07_V<`tPqG4UU7DYCl&pj~ zHAlfjmcnWf=n_cKAYII%1Y-rIZ(@rzMI^3M+kgp_PHK|(8gM%ugFA}L3d|P^!kDq;+ z2SKgfOYialx-&Cz<-CHS4}r^5&+&A+=ov1v>9+JBm}B4Yn9#gQtL%!jYhkys`+%_o z6b58}BBrU*56{X~$r#h=Gj?cCe~(X|9Xcnc&mTX1{`B$e@nf|8R#%Q+yPN*6?7!b4 z*=fKy%NAjg0jmLvH_Z)~n_#Q51)_BTfgAp!c(S*GPy>?1Z~6FNSBKy(6#RvYs;H#+ zeh6il{(-on?6e`G7XW8L6$5@lO>>4)qrMkZqqQASaq6J6wTGh47zAoze+(qJ32?`- zA3+N#y4vkUN$E=|GuM@F_Ln&pmD)PUZ9FC*Dnv9mylt;`p{;RsZ_&L;M1Z;)@k9(I`TD108Ytf7Wtdd(Q5AGD%gI zgV1lVKK^OMBd@xgq5i$EmmAvu6}A0>FIRZ?qU-W3K@H6&XjN=D?nh9}M9Ln6oTakT z_+C1N4;A_p`{2R|-Yk_OSanTiRek|!dD1uT7PapM+~pLTe<~F+JmGr*qR5UdzWtue&V;^tnn|kA~q|2E)4c*S!OcyJhFEjCjnMOJU=1 zUTQrn5ZQ+FmviOHMFOIQqVmltoLv705`~pRoyBHH+cmdxj7^ zrr0s{mUN@X1bd^=L1Sa=e_J%BYsyX0KER!J1T;Bne?K6^$TS#kmh1F37B%V zx`wyYdSRmjac&T%yKcU?9E#Ri4Yb1q;wJ z3l#UYe^CTM)zP$2u0BjeFNxt(6k*C{5xt;NL!fE+!s9ndlUeOGY?5ZO`|jK&oiquQ zyq(Cw*QX9@^gBtWL>Szy@P3A}YbAJrSI>fRF-S({e6bE!>!Uk1o!QY}VL<=A2{uW# z{dmL{?2GONm!5}ro4IJL)eoZ8`V2kjXK0uif9ji)s2l)5K)=7-p8YE@)m}Z@Kt^(f zti3QB9c@=@zKuN<77wI?rYD38 z#b*55h=y;10IoAP0%5G1UTPi+&#~wj(xU_<_o23-SS#r*=zR6Z*d9Q5Nd4hLFwM&3 z?NBW)BTq3$<|d5GqRvxJ@C}shFYqN_GKm)7_fL+G$L#O!KA-Yl>l5~Lzulg6^?!RZ zzGJ(*Dc6u2Vv)F+FC;L7OGRXjFVk5|VqTzFPZ!!Fjt~TJhXBP9g4^!&o{NcGtr2vr zam~fNy)-hr!+&7MkWOr^DL9|z$MXdfa$jLW#`+Ke@r0*pG->FZj&9Ep=ZAYNDII0!YTQvNh}IdqB6zQj*PwHGpa*jj*0V0QDYB?O4QR2l z%#e=?DP!$NUgKYB#34u}=c;$rNbOlc}{|oovHgU%bW|@@B0E7w8QJ_(sBR&^8Ro0;uSG zTt?DMHx&^c&G$P>+XWx`MHlNb85m)?l&?Q_PI6ihT_1@I$DEIV_K|DHETj97;YEOppSAh zhk`b1i5Ou$iJf|9dwN(v(B+~f5B&lLJ3=et*MbmyFW=PWztf$pb1J?kYPuS1%E7&GWs=Yz zzA>QjW-&rT>}iqoK*QEh3G8VMRXtP6;2{cQA|Mo^Od%xPuLl?9#hiaJg1=K^?i$36 zdEb4NtSV(!w$yWRfscPzFsGM_C|QkAtS`gdv+s*Zg5HSEuCL$O_m$^`y=`J_XJhRX zm`}EK7imk=v7=i2kTi~C#-&nr#hKZPE_@m3%j(n(nGZ}OaJm~Av)MZgS5>3EO9sjH1xAR*e`Z# zEGoT**h_9mtvM8(C#AQBghkw!$l$r?XHV1_X{#0044(ZZRg2QQ2@3PKEcG~1-I@J~ zdZ(Zlv^F*dv-mpv6&pi01d1IbP=0Dz?r;tT3@PCYO8yHtDH*2W#B?nnQolXB9QN2m z_uG-DpgPXzExvyY3a^=Z96rtXr;*OH*eYt02T0UIgJD2#BZtxO)~#G%<(@JofSRx; zfi2cf{r^(3OLUgGn-RV1-sh46%v`|zM>!*Y=(sC5!i5G51=JFmIqchm|M}3w8=WX+ zJ&krrSFRC4Z-QW&PRFw(%}1FR71ymI*yJr)NIDKU6rX>0DE%rUr^==-F@m{y!fg514PO@2kFXt-0+V!m|=^xbgYDcd&OM&kz#+&3c2lO18HAt{$v|}z6uH(v0cAY zkVwGv$jxUCHOCp$nL&$lkS#~7;tN={oa<3a|8;TBrFpX=3tsz1k|i`d5~!;HN;Y3b z$PU|W7~It-N$;AMwCcTgkt|5CSQmqRGE4xLu&-|-m(GHi z<+@Ti+}&8w=(1_18t%l}wx`=z_(5a5t8SuI>@6c^Ex&V9x~99fr!=XvlB1`p+6mNA zb=&lGGIFZ$Rg)*LsSx8R4%T(|P{_i4&lFamunlBmVt*m#b0j-@2sy#nWwuDl z!XXsWFRFAh67ta`yE;)=K}Z^l=jSAl^Y;<9je`5YD>-l#?5}#$4QU1IkIG#q(F%3M zTAqxq-oc0zbrni2Ie;`Hhemi@D~*2v+c2I{&TqK<2TtKIRLmNoWIAY_Oia(a94BB_ zjpGuo-CMx^XA{gP4nV*uajpcI6#}`9;$?XTaMo*HZmMfeoOlh&pzo1^X96E9I|JFA1jc^~Zt_L| z7`BR^j5fs}ojlsshE6_XZFKThC!`ZYj%}#KmrNw28BjffKsvM>4k$_R(w= zt&CV{7mwc9m|VcUzAfM}x76@j!A+XDCL>xzYVby+X23$UVCUZ-ic0IAS-- zwZ1r66-ZnbOW;5ZYpG@SU|)aORh}1Yl$zTGGX=8ux*HSchUdpxcWJODZ_`6+`l#r~Z8sKlHvtu;j!F>pVq%Nh( zWz>?4+_u9Yer&jJVwa=#DS`cuy68doJx_SL)whmd_TESONrWaa#@j+QMAPDrC4W=t@Tw&<=OGyzCbx09le zoj!6sO9G-Siq6v8w93aYjXX<&6pE6xfCh2%idcxG)OE8kD@sE%m@dg;A{!>na{CH4 zu36&5jejk{-6Ms9yLt)SVOLc%6-#KfX(1F64zAVSjwEm69xfnJIhkaba{`SVAQ z=rMp4PIgT`3gQ*JvmRx^GGH_A1&`b`d_>=w0=`L#V9tJ--=54)pFH}19{CvAwLKzf z?dXo3>7%exOJ~MGuAZi58LLE<5jS;9jv=CJxYbF8?^gEVPVIkLZb2$w)i}VorG13+ z0#=P9kLxAfATqzIYqs$?ljqk9W#_5i5$%j|41}2+8ZnJ}yZB@OxL}`}jffj9&E1!n zj7Cl%jRAxB){L$i6mB^MQMd_9sv3yYQKTc3>BdfkP;x|u&4m$@e{qo}s-)Xu<& zv~q)^s!E&WB6OJn zB8nC8W^$d zWuJWSkG=j>a}$Qw*8A3CZ)bhZak`X%8^mn)!P$S~k~2h28t$q$k>9LkrftyphLwy_ z!B*~#S-UAKIkw@ADbdjQd>rLffbDD|__ri7wCVnT?3}FrwTPePB5q-A3;}1$>^8i` zl=c5w$kbG|$S(mEHQX0UpOjQhKDA#5kc#%W;Nyb?HPtvoZSTyaY?yjr!*Gt9AO z6;Xd6gQ>4NBU~=y5PB^7GUHMY6bw|YqF-Zb6dh8UG>xTwXC{#gSIZ;{ z5>vu%-OT9u*W36Jk%*3^u|7!*Ekfgdjo7~o)?C|m~kj0}%s zl=I!d=~Fbp1mxFs={O!Zl?1qlv=}a4P32%Cfk*DOo2EgByUvK9+1J5+p|Y;KFp7BF z^t28d`5Aa_JAa`ScG2T{SRaX5%kz~tH-BgOHsg6tA)xE(J-zP>JHU76Eip7pUc-MJ zO{lRCa^cxcInEIv2(4y87AC$CItlroH+Pt9IFzO+z1i{nziTrOcD1kV%#NYq^B|Ly zJ|nto4@cc}pYhZVpAqfu?P}o4?P4!#nU!ZY0ceur-1d-MfCz*MxKOgdS8r}$)l$j~ zvSbeB)Y5`;!1{wT^`H0m*W27#1W|u-_i)N*(;q_@IU8&Ju!oQt-jk3F$N4k;5wku0 zFaGDa%ncs*M8igeQ7$YQv01p@jR>4cvO{uvS_gSxxCXtjSh^3~07+R81?U&Uy^Y>n z8^lKQIs+`Ek!omQGxGVMWYnf&K;`+m!TQZqiTLZt2ptF{tG9%|Sy>aS2q}LK$5W5I z8iAHZtER+UfqNu)^#OVQLjh0@5ippsh6_Sd9_ULk3%UdGBu0C?MzSx=S&B8dR~Ur=e-( zqZ^o5wUn4c`C}`mJG;t~`>pAuiQ>lY9N#hJA!FP})d49WPBg{!p)>2OGP1QE$i)m9yr>IRB*#41?%($JN|02IibQ@(zC`b{rX3$|Ue` z!{jQr35SQC=KQtCIe`1%i_2gGC`^~%eBmHy0C-2T)4=_WN22A8Gkgj{V>LuM=D~I% z$XnOe<&>bdIgibQp{)7PgHBf%qwP?0tuWhs07&1VPip{lX+9X!yGgUa)R%9%i89BZ zuyfTM^bP!2n@&Rv9)5o!dor^%!!8EIzA2Jg3c9YZU-h(?=h19DeZy^z@KWU`dbmwv zhfdyNcWb6CXOR)5SC zwAJsLgx!b7ME3cvLzHcdC$l$-oK|(71%t4uh5@%r5%V0qx54sJvD;cPa0 zxD&z&30QYQxLOy4!p*mG{t&wo*k(!r4#;2cmx_##>ip!6fIAKkA3ZUse<9*WEgS+!9pf5Y2k%I7oK;)+%~VfyxDwikW}OyG(6KVvu;DsB>`qXTjPI zos&OHYEJ)5ec@z2{xbj?gRr>e3lFfwqA%P@l|zL@QW*b5jz zg!_ndOqTmRagz99hdCoO7ND*Se;1N*RHva3W@QVQ-bm2F^4iPs3>ph)EwhLCAjwmEq{(;LhPUz*X~zcfzKgZ4K`R zV{UUNhyf_D;iCa1*sopY$3Aa^a#KbwW^Aa2I)x?Sbz|YGR>9z>Eo25p=Eku2uV%1) z{8fLQcj5>`=O!n=9C`Xqj!&OBQgdzQG@jKS!!5M+p6PzeJ9hjah9oSDz(XGZ;ud8V z7F!sC7i2i~A7aP(6YkY_=U22%!(6T8IvW@9NS(qeybg?l26eunZrfGaGwn5-#(bg$~Y{U33 z9wU@Z31mEEWF4|aT|%4%rtIdutlgYYBIA6tE4Ud>2V}sg(w?lYt0V2y?B>1|>V?M^j2$;a(YKHj0p zC+$r>*`dj&?M*)2p-DQ<&?wvC?C=+fmvG30`ZmX+{k#qK;lN|K=zkafC&1T)D!aq; zaPy|=Xw+1KJ+IRE@s>18-gGW}TRr z**mU%+ef?yW(IC9IO1~f#Ouh4XU-dp;^FGc``14>@Xyg-oHD+NlRNzN;`N326+jh2 zHwu4c_aS_`esliA%eQag6Te>Zz{00jPu~2%YZ2CG$|O$$*h6qd=Ly)4oic^#o-0D z%?yasY_D!Kg1!*GDtYH*q;x02>>=c*B*U;!&>E*E=#JVpHX|r_eHdlzmQj({^TVwI z`hDax`o{em(;Pe7#m{|>8z;0hJR)zCq#*1#!WRB4S#vv)Dp&k0?zVO^Ih*{gZ<6nWaes@5n5-5m-Vc2Toq4wyH66V13mC56q6rDs7L4&sgT0W$RyKTIJW3hQv%t(sY zIznHJ!F~|Sp|6{dHSY~Np9e=LR)o<^qd7J@fa!_=1WHgI$FbT@53 z!wSZaWdPBlS?^n#tV6C0*gjl*gQ`caw)SAN0X;TCk%6L@Y%HjAm2q35?Fx0P!19(Z zN2QEpW%CqrG>4GJ12FsPoPs;EWF5`+v5sjcKXT)lN;0^TBxU9W^^HTn&PS%t1=V)@}QnY}*TaeRa@!_+-*a#ZGt>xe1KnGkDu_Xnu^!V7<(>Udiu<7~lR*L7bGJqO z_A|HseEZoOe!l%oZ9Wy_7-_5TWkS2XLFn0`M!Z9ewn#0_w;ck%Ueoe}l@; z?!0u+`KeBgwv+yU_TGd$ZX8Jv{wsWbvtLQQQkLyHrn~m_+m$6(x2A1bEy-Q8Gv!A! zlT?Z=CYi-UvZ|;5`-eCHg5U)(DV1xd<|x}qAR+(+0)aprK+34yGOt=$czbI8I^RUL zS@`Hr_P?Fxzw*<(;Zv7|&P?X+e;ragW5l7QAGZ~>?M+Zb-X7cH54`&zF7Yoi6=W3d z8_F{Duy!6-h`_u3fg`0_cG_kv(~#e(4iL9lLHW>HW)u829y{IV)MPz@aD!I2WD3vh z2+mv#T%-p_3EEszA(IFU19X>aWeK}V$DnI1roi8ZXo~NFO<%{; zdvWiP4N$M@%og4;%cy>Oe|URkUPTAwE(%ffobzjc;MHxZ1GfCOc&zgTsn7@LD%|zaJ0#E`HbhkJ zw?#E8yPPPl69XQ}{R{7qG#>!N^+t}OXT>cX%e!^nC%t?9rP=NDf82;_YUa(^j-6Kk z140^GfZ#`e3N#j06UW1P`GwTW&!ZHAL!p?@4(hmpT^WUp}JXv z2Nt$M(qi2~6zq3`fA8l@Oi-cHPSptTBApf|Jx6jIKz?Ji5I zjlGM~->A9casS%`@qhCN;`cj03x7XTFqy-n@;nd0dIQ>Qe`BG>YIBZ+8#mgGh8)+e zhr*8EMjI;1J5#m-(B19hCPn;FXfUod zv~EBH=a^2J!IekULd`=oW8MjbBjRiurFtMexn;*i3+sU=*rQ4yIW=YK1g~FC%9&!- zDw)7Hta3`oe<@@{0to1;&|6ZfaHuk0qFTW$h%14rz!j82YHiDU5VHIa)&Y(6 znrxu&whAoiG)*bEsFC#JvvmXo1yfRDW_D`dxDw8;%F$D>qN2-lnGc{D#|r$ zvce`@tfSJIyrM}S*WC@9E8c<2Hl3T91B3D}t65N)y7_&c*h%e#M%Lq~=Up&xNxIxk zPXP(Ne>uQoG9^&=tBj^4$c}{|D5L~U9w_sZLjDEwu$k=%I=Kp?2EwAu;3+O59>l+A z4a}S&K880R!7UrEN)wZ90N(25c3)zFO##c2Xf~!zsqqhH2jZ|%In8ec`Ps=UBPsrXS|mI0 z;+$3mM%2bWC8k6wJxY9cHTvpI^n_HyKsMg@SW3 zewmQ%Koe-^>LO)ut;qqODBS3!axsTI6YU6B*9Y9+vkDUBi{TySQG!EKe|wG?S^Nu?X;9C+ ze^br%VmN%-ZMRX7Q`JNk?k-0jBEy-fX_5tQU3UtW6byLE+2kdcilIx3x)MF|cd8Ts z#zu@b5J!O62`!s8e4QeANk4$HH|v1RdV6nQ?dvqoK_9mj6W4d0+l5FJGLjrk5K%zi zPK2W};+L7PE`^25e-LEJIIK_%tf@=h9!6*{tps5iHX@Hy!Vi2w+%6M-an;m-l}2%? zxkW3!ki8+uTlfircR?O!;)F+MS3Kzdu1h{Q<{lASO|6V7;!#p6Ij^<75-Zf=oMV9t@4Zxi zDKVXA6v=n{o=Hilphk7&KG132eE z2MGjCt8##RCFLaiUFp}z)&y~It<5I*azEBEbYZ>YNb+bS^a#?nwhvG&omhxpF5n}U zJ&W#(8TbgX`P)3c6Wx4(y7K_8u`UQot8SS)CkBUuf5t-ocT(2M*f(MZt=Y}8WRFlf zVRc||tN1!zS(fgptqow$RjyPpSK?^gdX(Q!cl}WJ1nKJGy=xk2#Ch>PjX!<)CQhqQ zF81MiR{#krour(O8_CXa%U%@r8G;walYyO8BSg>y6%B_d~e9;Tt`h zQlNcYf23cOO_w<;JI$MJ(e}LbZM-AJ>5~UOToWFj6Y7m3U&aOQYXRdxamGRYpf6v| z%_p*%N=jQ3RN!`|mtH4wI%`Wi@tpESX--OyEw!tzM|;7ClM$Jh?B)xoVpNTrfg%CN zMHZx5k{U4o>fj8omM#qtRl06BCW1G4zQz3Ie{r-c5dh_3G7S`)JKvNLyvgK*5m@@> zBZuHkCTAU$Xx5sI9tJp>Am#5A7e!T@nre|gg(wC(QgUz0Zwtk4ds)_kLle~@Wu&ursslznD0K%?xl69*b?pMzxZYkDRbp5+sS9&2P6W^7+cUdL$M zfB5!m@H+kKB*ELh769rLB6^X*Bx=)&&idRbxmN!+WN!z!4xQTViaH9 z?%~U6M&OI1w+C(e>Vf83Ie2err5?fr;O?g0P8tMxcX1Bpka}rqTAGixrrQbin`U$7 zn?2#|q^xUB>PO(l3q3(OWSD4~I3OLHe_pj>NSt&ViHR0lXBqK-1?#SF#BXqa677IH zd1q-CO+o5|xZ-LGYyEd~LJ0q3%?G_NDW2693oHbh*{6#rAG`)@`_poV)Do@aYv84R z6QPk*?6ROKMDe;45F-_}U=n9t#gyk!nLo7YCOZYZ<`zD+w#^cB#8tWF^_WxIf3vTI zmT0|x-tF+kFn#Ozqhk_qS@^FOgg-za`c=GU?`9VtkWP4wx37k?w%E1nyxz7}c|*0z zm~6|f!FRxHEY?Dh!#MOkkl3 z;;K01^S3Lo1luj3-6RB!$LwJoC<7)TL4IpRb95r%reh(}qWccpfh1jUe*=@7WNW2T z)n|}xU1I3nFuaem#F#UB?_3f`$^}zQAxIcUO7hzttK8?;_)=!O&3&sNgZ?7K z&~hYbsctkHvP2h`Zf<V-@P9<55-T(N0~FH;JX8XMEw{eIkP3E zz|mo&QR~411JP-ZLOwju@EkB5Eh(6Qds54toGKM@0fSyD7vqTCD#ek=F;^f|!F^9T zhbl;*)CrbO%%?MU%$$;=i6V*hSZo=e&C*b3mF@`avFsK!WV_SFeI@P zcE@PDduPvvmv5YQOM(vYuPB@rqIF!kr7JQRe6FO+twn}l>NQCs1lmQ$m=al66xIns{9rJd6cS$?0ANRF$Kc0=Z`BmNle z>=eUWcEoFVa6?*dfA?~;rOl4nLJQ~p4*k(!H>qbI(htMzFpHq;D*-SpfGmd&en1I$?n!6{iG==m4!C&5lq{kMlT1VPq39p zu#45jqgq;CJ{s`x8DRa%zbVVD4?ui^;?t<)6o8$^!gP+42T7b^(H8C8&MprISK6aQ z&7bU@$M+Hae*#lK3H?B2RrIfBOcX+y{2UE#gj;-!ZjsSK1TCk#s@;gqlh`2QhSMFA z#I0>>gNPeW_v|4A(yPwe+0L3nh7q_1<#oW0HtVqy<^us4qhDdWcS;lor6 z9~G*}*inJgI+&jD{Lkly-=Dv=J2belg+$-pZ2jx)#?f4*h^gf^Mn>5n%raNw7_^ZX zWx4yo}aZ|QVnANM=Y5C@SvEG_CNTufXTr();9o$vrNgh7J42XGc*qzmu# z+VCDpv-I%iD9>Ohf}VJV(LFf7!(yfMs&PE9e8eVL5% zCQ7#6Z4_;3&^(1ncF*z6WZf(w2U#M1)gDu?129O!_$7DHnu?i=1HlhP2Cu;0-qrCr z_|4!W3pmb%`*P?NC^2FJAh@N-G}nxqAQ!;J2YS~f(Z~I(G1GAeO?w~PF}-nU_c?A@1uxO07t~BUu*?u z`HY_vU@)^7pE#;Yy7DODCN47pc&iAMAHxSRr}65edA$oKm2Qx;vTCNCt%vFzl1LUC z7Bl<_3SJ1-E;7uJfjLvToB8)ZG@zO=QO zwxed19^gfvqE$sHHXzIkL}~PC6-BUHKXN0#5L*pG9-&EAmFASgXWuSP1J0STswH&r z4(ktEqcIIahy!1U1DC9P=i;uk&ZGKO!(x+ZeXMh7y-TAyyB?%mX$opg(R*(ue>{-6 z5~McC42ztj5`F}w2BccuKn5(@)EKMHedw{vJ65A#KG1J~bGyd7s4oFq45!Y~tXvdP zjDz+I8ARhkH*06+)kZp2W|lde&ol*QCxkAl&bg6~y2ds!6SX#LnBhunv~{E$PjxG7=s#Y>u?K>>}$;Ye-IX}uiuO8^c=FkfVY}DmK#@{Q7nAxVj!J3{tU@2 z8%~)DHuXL*6Ul)b1@RDhCuf&pR~@DJ92$H~lX`}mf8(CSO^$jk zXb}hXS>C;FJ<)$W3Lk-4W#a3m=nEzDbRS5KOfwBm-D)CkUBPCn8H(2C+(2%&YnIHY z+p{2#v*z5~V zmJD7OwW@WhZFZIlS`HOZ_XRY71v$BRp?vnDXeaumo3?1}ShI^(du zw}Y=|o%fDh0hLDke?_76R9)??lp~W=I+ttiXz7oo`w7ZaKjJT|+ie!7Wy|WqX*t@* zU)^QVS&Y#pZK%pbv?BoukVE2rBWnj^l|?czhX?OZ*b*2Vd#%x_Uwg@{&FNh7NKat} zP8J6vxq9`H;H8s%nTp{4?nw(*^}lf2_x(`4waGpxU#TBLH>y zh9X2A7Fr8eS7rkx`#!ezY9C@ebseKLR0`O(L?}vn@d`YIjP>8ZCMew=vARpBaa{)1 zp9eXNAu4^a!|XUaVJrkU8b?9P?>-PDQvNz=aujSFtzbhI)E-zNv-{M$MmJ^5uC_-d zc#@ulV{=?6*HSC?D}poJ_9W9Q93{`fh*Mfa8p!YHy+< z(#)XrK7vOd#MqS`hc^Tc8+BPaa<=lxV|V<41t-t$(Rd@x3ANcq{&IK^Y0)&3?TE=m z_IqrL%TpOzTXnI`U{xnf2s^2&tjAhq(@8N(_^Or4%qs(l#qxJL%t} z(bc6ZTBYp22j(oRJgr45-tvZd75Xh?zbQDcqY|CV9Z_<(DHzF((H*7iHw7oT96F=q zZc{LlL#Q)G?&gS5Vpu_1fCTe$L>%sNoy1V#e*n#^LNUy+V%G>Is++6$i#Fmi1Ja5v zD>A}hXb!w1c=R_q;wwKD96R7_@(CNz?{7$nY<8h)fQ)W0TC5i!QgbrVp`QiTLZAop zCP0pg^Z_8{Ujw#Wbp%C9Bc*Ce9#b|^nRgcd| zf8~~>jy(+1**xlo+-x`cJgiRqK`*mQETU$<6N~>uVpb}Pw_b~U8oCLs25p^-=qxM2 zH6&1OSQbam89V_DEo|R3q zmia)rR4kyif9-r-;1oEkn<~APZdiGwf84pYP!+2vYeQ3aVwVN=hrGtzWA{>rTg6Bt zyQa}@bl23ayCx?3Br54-AshWDj1#y&VC726$7`Q002c^) zI>_X6G&ky^k}fbo6670l{aHgvfNK}@SR>Pci0=(9@6Ek(9XeDB#X{{P8%O}Oe=gfz z@0vdy_s8F_R||28U-Z;r?*J=+sSw#Dh-=&Wz*Gw)b!*3YX6Ho|FTvd!Z>@$aT827~ zPc2Eba2WMM^sv3&w6Sq0wmmlcS=5o?9lCdDoWI9<7+lkc3cX_HnO`(C0~10}?PsLpNMbc*!l5L3Iv+=GwY-4F>8pcvOcqriA8*sB zhy$bI5{|Xwp|z2qJ{&GRxIw@eOTH*SIZXLZw1siVzQL44--g6I*i5Bxe*-2_Oh;vq zh2m5B)pIkdN^TNStQYvZ?O5$D%m&!-+o_!V9+wfD{~!mw0+6MnrT$Bx~q=$n9U=!Ot*(C z~pUg97%@Gb7DB zSotXL^2LVsemf(E8xiO`xk{=6Tn#Cp3;d_D`!ve^Z5*0!m8!8VN_B*q9AfbASgrxh zSC?sDcxTezybeeMITFz*-8=!;J8(aB21HjlF$ z!h4eFE=me62`vW+VVTtyT;NO|%GVfORA7{y1md3Aw-8YBe~uJX{JVpFA!napUTJje z+mq3P&lk^8^LVj%u9fRn3n@cTo9f=$%a#PFlg{EQnrkVvX>@mY#}QcP63EuQ<0sdxokqPU3>H+(?>^h{u~IpGRvm1Js*omFoo^wW{Ge5cx`GPnM4n#C$5tWmESPN32kaF!WqTe+@D5dU}5$wN|$WRMrkS5bHET zVZ)-#D=cMESlJFTrw2}Ry2&9(&2-mQmAr+xxEi1Hm^>-&t=9sVYRZ2%oe_E|GrXlI zkVe=4KH5H*SA>ygpd4RdHa`tN0ySF6w;uU;(>Wm*LJ;?6+rW<&sV{P9XXL)nLtcUN zv}b20f7k%W9<=T|grV!FXWzg3s0Hqfprh&Fa39Mz*fTSCj-D=J4;8Y|tO1WxP$Yug zT0+DvF{FvS@U;3h0l9S{a&$m`_2&HD`GNQ9qW-TC@kTNmd?<(QE+Ps9-2DCPpZHYylCn2zQIupnYlC6 zfA5{QzNs~i4Dm6_9ch&$jhywZ)Mo>?d+uxxJ%DT>;#68tm~i2vreiak2BhU0!NjRA ztJJuW+@`485v`_^qiWUkLTV^~oizh?U+$svadaekMCRfy#Ok{*rzS+0RUB6cIbW`=VJNb%<{AAYs0P95tg`%itAlEA~)*wvWx~N zi#n+1jtdM~R17rsYrKvHSKkCLruW90Q4~hSfA!7k zp$-IBNf~dG=#$VQ{9qeTob%Pn-)YHNLHF$<7)@zXrIQz|Ty1^Z^f*S>zGuJDjyFF~ z=#=D@zk+-CgudkXi-8NH=LFpfU6fbb>K(13=uTH1W`9UwwAL!jBknf4Z&8+5xNaNEek0{OoR=W#Cy=4nn8z_TUXhq#~{2 z|Dvn{=llX32(Wfo=*-h@=SCY`GJNWxUxNWgZ|4nS>*tCSOt(HZ##2auLB|AXae}emVo=$-P zDI$fgcrCUlltG!YT{iJL$An*48OdkAn%x6ZKsmHKEk4S%7_#51h$-24cO(8^7?Ov@ z&7nkl-bylS`;sqRu*%YOW()4tzWCMAN)MxyPmPLIn}FeG=jt-FUq_Z#A{={bf>VCv zp-DASuT1#MfQ`7B*!=*jf2gA!44!aQ334&l2b$kT^F697fZwLL2R7805bS!14EeXt z_R4S$!P8O$21AhVXOuAx+*BZ!f0m;|OyHr;js2{N2B^o-fpm>Q{vAw_%w7$^!-5t7 zTh@61$OAR^bT%Axh`@}ZhX2E;!M<6Y-hzY%HYopG%r@LxA&{fQe}2HcUULt*gA4=X zjKdaUHp%V}l?#&jI5Ic^X)Gw5b@*fCG%(M(`e9iX z!@|DRNHgd&J9BpuV&I%{=$O)eg}Eg$4Obc_@Q<4y5AWd+L7$ggT;8qtJ6u0f48Tas(unpYUbTgae9{}g3=(TOt(@Wy<>-H=y87oj_mO3jX){L zFN6w!X@0e_P_9oEZ?W)>lxIDrG7?(_QafACdl`v~-P}9&7aD1EP(6#+tiF+3K2>~N zZL5~XXaDMIR9zr%0|>C$LOu*S#BeGyD4l|hv-FVi`(Z-Lf10-nayLfTGNB5xXE0UV z5THN4c>ersmfBmTZzF+)a&BNnpyPuI3`Wb45zpR$_S*cOK0>$Q6qE!6%I?TsL3#Sp) zF@mra8(Jv5;4x^KU}1m*@N*Kpk3-My()W?($wdS|+EPuH!;eGJ{KEK2>D*BwKiVpP zzGC^&hCEd^PbTQ8Y_Csg@cbpLi;ryIds>s)=U}h;e_RYf|4*1kY$Fst0t;!T5e#oT zeb*NQHto&rO6JegBFp&#kE067*>6fZ0txyHoZeWu<8Z7n#Fj%$=@P4sQrX(&1C`t{ zhS6dGYCx609t7tTI2UrvBJCKJ2=CQf${bKsD_C?aFWOPc+$Dao0~_ZVvO?#Yfuswc z%+ePan84!mCVx(=Ph^{l>9Jog(YnG+AJ~)K5My4Q6vA0CmWNt-;A#twct=q9YzIf$IyySy}bbo{lG(gHlB+GCk$WAZ0VI9v9 z2XoU%YcwB`&3UXTip5qjDbi>kpTGGgZa1Qu6Sf0YuWD(l&f^vd3yZ9V^;|JEZK>i$ z6V2BQMA2MLq$*$sEtINzLSbWZye~79ST1Pa-lPQtXD>7Q!;UUJGxsbcQEr{jh@b$} z;t30ex_`0EAY+sk*+*9@A-Z=XjdA#ecdSU(u~ zDPmhEPON^=?Lk+6a(Pz8djUCU)*0sD1vB-kRDayt?*!B}R+Yq1B-^at3YPV;USCl3 z2gdKbk6((l`4Yaq_-IyNKz5pPU7>7r2BPRw`Sr)?8R`HwUR|;H7^I7Bjl_VCt$l2| z%LNCsiBpa(_GQ(ID4D6n?aPGpF^4@9K-%>QY8|GTcN&!F;Jb~C=1?1-{iy8IDqc~A z_+|+ZDXf_+VZ_89JXqHFqsJ##8P_k>RlHgpfmxdi7sjQ2-a&T0;4P+aADa{ zQ5mgyaiD4}W7?&AIF>$!*WO|95wg5N3YM%YUDC#AY*tW}G$V*;YIY-}dePz}2gW_4 zO1OH7v@lx{%+b)Vx_HB!8y7(%qgjHk+<(HZXw&Q=hHX+6IE?+toAiT4ua+j);gnAt zY{&JWwm_l?scTsr%x|>jN=3oaK$|$NN>jf=>m6)Uh$6iXK;sra3#G*6ZK5CNH;mQ1 zxPSAwXkYZQQ`sq-rX}=pY9;2(H;WgKLysE&1d<+UieBtO(>&|u;(rTh zEpd3QmP-1N^nmVBn!*qz)2JB(4u;#a*_ts71xG?spGCVWjvNG z8s#DGtkJ10!6{Tg;H^<`AtjhoNPjcp$waYby`pH5)U|ycxp&p^E96MU;-tLi-d)m- zX9GT_VI;OiA`~=n_kr@dSZiImf@;h6adr;n8R=$9F(a77Hd$2(Re}r(N>?n0pk5ea z%pM3?SyUN99VY4{ZEi&X?=Jrxxub|AcdRIBmaY|`W)HI8(Kg4O6-G7UTqyEuP zFcxtm|Jd9BmQ%L_=Lapun*RzxIP63&iWB@?3*APxNm@^~`xN)Vwh_rFmzbx~N-}Fe zW*5&+uw8e6+Nn-hb`_ID$aZEG01ho7adi9%e)&&q^cLa0atm&wt~5RNg$_<#FD8RE2|JoDnj&Bo-ZbR8EoccZYN`s%?N_ z^!lLm5%6bcz_|i!j6x%MD(q`7%5!|6MmH5g(5_@FFi^W)5fqewwqtfC!xt)Cwm~B& z&r53+txRfaTISBldAis|(G4ZR*6Mv!ctO6*VLPsmr zhl2b=^*yG?yGEZlyDF=+zb(ZMJ0fXfMW3mr(9Z35o*F`m~O$o_(ra6ZzvAAgjTe(dnIb=?b`o`2GVEf1>`#yLKGKgh{b z({!Z~UXZV0pt&B>&BI*0`_P4$D7}mGECtRGLNSj4bkWaMbhpDQ@Nv;3=6j(J3bA=W zRFTwqcj^6mE3@|<{4-lZ?k?XXQ=^<(^jS#{i*2-m($umcdt;{{awHyr>Q=jEij&Jk-ZlnQf&Ik-n>j zU*#_mZ!|mwSi;;qytQcCmSwRv_Tk1Bhc~80rU#|GqawJ>%y=Jy`&Xw1amFE8(M}2hs%gjYJ0Oaa5!nZ6cisRpZm^XH;kl2#xtFnBz$6ItId5b`bq0RT?7oNZMT>B$NKlyon^7!7(Y z7JrkkytX7e9MN~V>&3kj zoY&o$%>}Ol`wHr@<|VyW(;ZQ1QS$vu&YOA(x{u=ZjhOk1D;=e{^(L%-8ORE-OVue} zI@LoV(Hh03wS|XC;fGM^+ZuRl!5~=GJb%tCvTO>L<|_hE_%wz+-<4UXGuSzfRF;85 zMI&D2nG7O<1-QxX1v%?VT#-PMFe!onWIbi@T@S~~3N z8Y=|CELSc$o9jjHrI(AMiXEu7M4+#EUZrxqvozwh_VxlO(0Cp5Db%2Ezk~RnDt|$b zE$v4szBoXUT)J{0W3p-u7pr=`QFUrCal=7ao+FK6(K$(wCD2fD`?gvjP;&V5HdTT4 zp_gEBzY#mGm01&pM?I_t_ZTb`7X!SLmyWDsK_Om`sZuJ6NpVDGRUw%JqK_NLc$2Fr z*HrgV+O+53tSl6)%C+XaBBqRTv47YF@@!+hVXd2-OPq!T3J%*AU6;vHc5o$#Do6Ir z$C7*;@~kZ3z}Z7WVsX5HeG-=To-AXq9pwXonBE5__R~#Jq2DD&tzH}c5wtP%(UayV zjwIZe`<H-Du6=a06l zrtzk^S`8Pd##x~axy!U;m&*K^Lfa_NCvl)16w0P7+8jX1e`dq7N7k_YK6Em>k0Zhs z^D7F(&WHlB2cT(tZovttYjVMOK@4r!vyqezW45ss1cR3@b}e~fqZhsZRy(5MowI!C z)sOe2_tw5udE^BGbTolU-G5#8!JC~Vfn*|CwYEt+w&~Rd*R;kYN)SJ}P+|SLUg8aweQh$?0YOZY}9N}Bh z*o|{hQ1Uy{W5~ey*fTu4*2#_ zi-6uQSKHYRVUv^@nMg2zPqZ~?Pvb=2+ zo{|wjxEb8nOoEPALE;lE-*r>GHP7~6jQZlj=ChL<>B`gDNSz zjjZCckDnizj!p1)v6qMt@5g6v;h#S~qaWZMc?(Vo>V26tG>QpI9`KzR?6Qzn!jID(utEhs#g%S&Mc3UV z$6oDAn+IvZ&eAv4Izj~d2U-Z{44cBuQR&QxFo6g)HIPnv9q90(lZ)_B7g+aU!-TsZ zQgj3hB??xLaFjAgu`d#zzbD`d{%a2Ke}EdB<_$Z!snj?;(_Us3I6#&1TH04a%A z51kJeaW=wn%cMIYR>RUxzYRBHvh8^Hvf6BdI-W*pf%VuqrlljrfJ5Q!8eGQD5FM!s z>_bUwsedS`vqHd)9Z_JSbSwDK(h+!(MA6oI0J60!k`iOLEOC_fL2EUNpR>&}wwxwv z>#8j%$l5#a4QH?iH6aPXPYe$U!OGDcZ0Q`7h$_8Jv-{Kxd7xj1_oQ@$ENGWBs?DCW z9(bvJ8;|BbKKHl`a$RkTH2LvO_2=xKhKvBvHh&SPafxn#3-3HDiWnZ}(Gi854`tBe zfeI)*fJuQXN0in9l3L`g?9oU$hjBeXgl)y*FwD^}F4)8>|Fe!{d-ruC0vp@eLVtrP zM^4YZfY7kI$WC_Rzo+MSU&AoPpWmuREh1k0;pO7_;^pE6G=2H}`HSzKpS=40cSo;Y zpMQM!`)|Jb_Pg&I`N1*K$s%qD-*`JfAUNW+u)ciR0txM`_QHiwNd&7u^}usPYd3Nx zaeU|u)OzgaR~MlC36|(^eT6O0QzJ87WJ@qwh$eS2ICtGed4V&RWZA9KGPF7Q*KZGB zzIbu?;>Eune)a7ly<=4%M*W`Fjj90R#Dsc9t^p!N6IX4^_TuGZGaIB{G2wL&kA11Q_s zslFE3rpnEyi)|3@nHHBS!`}ALfJPek%jXbSK(7Uq)@8p3Blor)UndB+*xI9IktL95 zO!o|rK1HjFu4LVGiUzg_-q(wO&VK?@G3<{OLr9?a;{%z)GHAZqf;H-6 z(=Kbq?|amWwR*c)gLjv*myrm$btjW9c<^hSZmZI-zv&$tIt2GwY(}m@M8n7xr#Js5 zG!k>%Y*XBbW5yRGUB_$jrOc~HSL80KVb^TmU2ZW3VUvO5`{*=|dmIB z@?qg>41h4RosnXKGJBlw$vI#*oQ|205GMyDj$-WyTx{YsLKxe7R)MyYVQ|1c^%nRu zC{(*~KTayRRSNm|_U329X@8%p{DzCo&Cd>YsUdL0+_vzLwTHkV+uB0IvA%8k+u8Ub zf%V=svm#E!L|l^uz(ia_`(ED-=G~xwBXCUiCRp7FRqCm?#NRj~{4JsXtagXae?or! z2?`xdW5hKU&u|o-HD;6>lMtifYvMMTJY?Dru4C4B#bngDJzOy#SAXK%*ihJJVekxo z@_9cvWm?g9V{?y<=#_T`>U+bArQS&DkgO zs|dz0sahjL3BC@JqM-#dO`Rk7k1YF36m8K3+pN&Xcg^dp$`6yMEHSbojfFM<*Ac#G zTIA{a__Mg0Ba)A%&wmM_)N_{A1UVqsq@@jPb2O?SA{xh2(*_ctBjuR<+4}0d6&K7; z@do3B*?pr%0&?F#5Y!!f`0QKf?l|I<J<;^3R!Ly9|p@+_~PYPjpuOew}=58 zyiYJ=b&{}&*KCVdKh@VVp%@YGzX5{q7Pd(ZuiFxS)#I2v$PW}l{~@HY5Bu$a!qjN4HgM{ro%i` z66#r7_7H{NQ%fOo$Xo-*YJF2jvDj#6FX{&FyG_*M?wQ0ZLR}{_ZeLIr_I|GY2s$p; z0Ds!$a@_>Z)e8IQrj({rDJS3^G!xkARA>1*NM&u;UgE(UV=Czl3>_l?*wg7RgLNy9 zEBy33_x#F3Ue|SMZGI7JQV~YmBzwU8(f9c1i|&hgQTn7a~8$2RTunE;@ zGfxHjHtjeVIFQ-as@!bUS#12?ar)aq1r@mmFlx^O>YWvWmiE~C(y6#~Tno^9uYYLO z=9A#)^Ym8^TK{3@t=o*TEwMwBU(qXWCT;~-Ca+rEu!LTtv#yL-g*Q5>Q_rE&a8(C{ z%TZ`@p?Ve&Qn%}~zs#~E3erx7cz4Nm4oyw#@Y4PL$&2TIXb8Pxf&FYHtiZDp=K*v- z@M4G?>u|*`$~-DpHwGTrZ&bqeynl6TT&G${=7Ja1CTrbRONfCiqhc-wt04}G#J{L! zN~dqy32HdCeP9j-(-3d7u;b-j{OY7oX#md!!1t#oZFrTv_Gf@QJ#Ry^QWG>d&=(cm zwu=G&Jb^USb~?NkAk*5!$&+t$UeLDH0o)&}m(O4Pq2Qq14!o|9dm3&!1AibE+k890 zqhmxH*1q@5gAt{zrtFs)tUCztiX*^vNw?i)oRFu+EZgy=xVecYHLSkHnJY@8avkpgPNu!7sti{n>c7_p2 zZFUdZfqof&Ht}e}kbf(TN?NB`9{IsCy8|L#Jb(H1q!b&Mu&$(^K-hG)j?)${{XsVo z`a#)Gz(&k@?CT>_TpE3%01Pn)h0Z}tBz|wQr;QqfQ#(0bgvRN5BO?G_fAgowYd`p} zHeu_xb&@TEq@IoDSD|B-o!f#!v3h=f;l7K&t(Ity%E{d&fPa_M0U!t(#mir86#D*@( z)V(|p8fJd_q0y$p>e>(!Q3_%%)HZ6920x4oYSBYXKLDhrvwsJjBwRIF+(EdV&0Br) zvAqwUrvWwxWPd`&?{=Uy0R&9akUm!sqo6UII$TTiWi&ZfXHxk$I8$a6$tAX^msaj0 zrqoFEaEKe%vQVF<_L69$_q}zLM!71ctUvG#dv}1ZepD{_2+&xFK-9mFD<3WLB=j)~ z+vMOc-N7y7T8^q1U)14N!G&b#`J#T19dw|s(NXV)@s(;D4aYsIfpWB0ecxf_xc^01 zYR}5H*?%{oVYaF^l1CQa5tXFJNzJ?;;Q>ljM%T0^HMC})FTN~-cXFJo{nCY6I#S}~ z%3A`4DTiK_#-%57n>EA7!^L$TtbtzNCHWaDe*jgVRf&$LstXzP=~dX|`!a68rtcB` z1maC82yKT-%q_C{$x0|R#Gcr=7}EiNttHTRzkh%6?Tcq04jPLCEtYx4Z-_zzrxT*g zw(*MEO5$pIaE}%R4itV5IRHRz+%JP|{N>-XB)g4+FaI}b&6v%j_#>?L|F?omI@Rlr=K!HFGFNhG0@BK(brEPc@ZnzY_3k09AIH4GZ7euS;w z{(n`jJJ0(Jcf?l+sm}KXRzq;#fr#&$Xd%h_jxd6u;g7#NfZ_b{m0J6O33@Berc~zG zZaAAjYC^oKH^dq=x7~S6y1e;JiBfIX{cU9e$KcJ;2zd^Aq*-z<@_Sx~=2KpV38=B- z4AslgCM6VoPJ%yy66ozth>;;si_TdXhJSzc`xM7}adW_Nae<_~1)YE00d}EPdBYlG z!3uKAiSe%~uOv({b4qjisQV&}P@2w4LxJaT#{N}s!>Vm7Edru+IssMM7_OqnV%)o| z=QbA-dxf6;lvqpP)5bZ3Uv*trgjCcgURzolLY{SWIvHmW)qe#*j*?oNg7z<9)_?ya zLj6o6I*o7_fld%)fU9${dKvIa1q~H*fxqVsR1%h1EUkACmXuF8S8tjgB>d&`G| zo|9gY7N^$<7P_{l?MkaoJFld$jkeYl#wS-+v5p)(ggnCV-HQg)$9`D`%nZY*osN5T zt+hSv>H0gvX@3QPWSuD=(+GDt?SDJ2e><*!JFb5_u75kOe><+ZWPb#lzP86T zIp0KiR&3+jXf|W{SI?h6Hx1wlNy}DkW0pRW-Dj~&>$D6QruAk6mTA?DP1Ci*-3&^Q z5hXAfb{xYFqvAfct;InRl@V2{2{@^cB?Rp}?uUgU5R!|_NE2=K@wrXFw@ab z{N7m$tPv-NQ0=mFGS5&UwmCS)ghZ@S%*Puo1TDsRe70y!*PKkzJ;0qf0zf+P!+jpl zB|6@)>?a@ zI1z-2UZ*|xsWj;N6p_2VrWq<~l$wg6b&pgUu8XEhCD7Y}oS{6}%`-{5jEr+DL?)wK zRIMT6EtqRmdtcm$yMNN*y_nAY@IPTd|3#OH4~JsGzUW_Y70-LW@g*?ZcxFx<+}K0o z!m!Dlvas+7dk(L_T)cW@7B|mUt7;n)OQ@PTyYmL7ZgnVqJVX|VB1|4K6K#~7WG3Rs zr7ghBL;|ez``wwy!j(#6$1|z(?e;+lG_|~F9SXHuhW0ZEmw&EnFSNpzo#4z6c71{M zye4Q*Id{|-h~v}ha(dn-fV`*el)8lxb!Ss#k`czK$s;u%*Gw`}&hkUcTfA_R{U!;q zp3xF5Y>XrefrWV;6L=m(m7aI;#>&V`^ol|mNT^Bgoq3inidyETKi5v z`~8cT-`bg5sDE#-v1NcOW!D!Q5B!Bux6KQF#%a#{?-nmMe$Lrijqr4SbC@YQT@v+; z4N>1bF;OqRv6-o-ri$x~7bYRf2KgjZY=Te2^TGz`ry&Mj0>_sMnmz4WAz`C5Js~+^ zJWdd_c{-BfF?!;sBj#VfkshazMtzX1?Z1BWWMuupfq$$&JRw$B}ordw|pfM zB&0;>Uw=3F+P84}%o2ObscM%w)WDk3!>6}cHdDYAk;gxQ2D=*YxiLI2KVDRA{_tBEuTU0?J3VZ4xp?Uru z0s}>-U@LJE9uv6v%&dk!zz(WS>ozII2vOjC!+$IA;tZ3G6Fin*g9y~wrz+-nj{ZoX z+-6H#8Q#2G$VEE3G~8#Vs!?WqO@I$Ms&Gt~t-_}^PPVif!EKymWLZOA3_CI0+S}?b zWQiN7i$NB|Rt_F&;cuZvNwjh@^1eb+dtoD;I|63(*MHoB=-^59nM=52@ zF|zvcH{Y316FAY=2Y!tD56xPomTRpd6Mt=&oJ6J`(P(8c?o#ET=#mBrZN2Tt{Q#OR z_?rV@Ed3KwJ+%RP2|P5W5^FA`CmFoDjKPLxouq&04iU9mIoNhyK)&1-%ceJ1Nv9#N z2iRGv(v&GLP@NI{1vj?q0CJLI3aIBU{N0c98^&r**f)=h_C+7w7w(8Z49L6wRe!r& zWqGvB;HJ+Sn8l$|208G)kp8WA5c(oc5=(U?XjI;7=^}w%OwaOQqDpfY(KdN#9doic zpZI144JvSTRzQUPX}>*Bgp&Iv%WkW!Im9q6`~<()mG-5rJFvxhb8CeetpLBt)@zk7 zs%9hn(F(wy@?Zs7ZIcJ@I!@!_rhhFs*Q$xHnpnX;1^sCSPigH51jWhcZ&twGL7B-S z$;!@}lJLO_%nt#|f85Xgt8q`Q{A(;v>9itvuDQQ{7HUI}_;b}}j`2rGe5D`FRA!`p zqA(WDMd!mUPE5gO8{~0;Bm7UkxpIQoIuj0FPOIzd_!Am=lA!4!j~7@-PJfaonC*m= z*F%Exzk{mG{`gE!?-bk@lk5}518J0C8J62Pjf$AP6v}l_M)#EYET@9n=$RMmA20<3 z{N-+&nwAYJBdwV=Hk|v5aMvl@q%-)lqaQB6e0}_q)~(2@d=)7RX0&?wovgw}i*1Yn zORZqN#W6y@X%Zp~dW?U4b9(ld z*C+nb@$tL&XIDs!0$2v?8k8XHJFb%R>fzake|BW*fm~8z$Bhi=<$u>VowHYb<%dBm z#2>qLS;L{2tH>9~Z^elptndX@&uPiEfO$GQp7*~}r>F%BS{T+oijE&;0x~wE6`tTu zy;6B2@DjcqD+XM+g}0wFVo>dWz3BCNmDjdpDuU6n@IQHk8s&Hc~K-yK5zl4CqxNZh|unrvYoy zU>L%*p`3yDY=45&Nx8;$98M3sX(OwFy$4uFn;w}pGRF7ma>fNSpiLT>f-!B;a5luD z7>HA$eAszFO=!~w1Tg-}AS_KsVC(_ceUe5w9Ols-sC^()SNOVX+J^ivC?or#o}oQ> zu^Pj`N7CvRWllK_P?gyV1yUT@P^J!aOdufeify!l)PMM)N0ZVp2R*oCOYA|0Sp&IB zNDD=8p^py@6AN5y!U*gurln!X=q~nwym%32aNSqhbz$0Z==L12y{F_lqatiPEPEwD$?lBw{s(2R9d~^h9Ggk z-Qj2x{G6rrPnTsL1)IVPE0!AiBICm@-QJC5y;PX^)&C7q;gFi=O4BeuuQ3=&Lq^8X zOwI~c$RsMcKoQ1{M)w|-&M?EOAQEI50m)RuQhy9H@UR|>LFv0xh^y!n`qWW)=Xth< zQqqo7p6aPS?qayl!*<5VUlq*<$9lmh6B2~i&Yocy#Gcn+e*mb*4D>y~oP}5nDxaHH zcrMz7RJk2fEeNSiCg;uxy$n1YdO7vLD>As7itZ`IW3O(#8}JgZgk%wr@z$!(NO>cq z;(z*PTVduejBINT^qBGPI!XcL*E2NnvvvBR_VRUZiC=n8sJT78NJFHHV0#6eZD1v-hEtEvdfd@I%P!DKB3DQge z%2f{r%z~&(u3u0~7{qSp=dXIm_Q$Qv=6{z*e<#OUpy)7(?jlWD2qEG!)3aER3(vK{ zTNY||#4j9$S$E|O)CCy90JLcVzp7y#GeDOGLuaDTiS{YGtEujc9m`c2lf8!{-n)&{ zNAzpoX^b!^@7T06xu51vIXIQ*ru>>rwX53OsDA^y9vsrWZ=OGw-po)O-dQG^#RIBae@-c4bX4|Du~Dj1`cCp@6Mp-s|dsQ5*!TZbIUrHPLL|e=UqVx14@Y*W>GBb|cC z-buOw2yZ}Vm}9y+x%8KrFCyhJC+r70W}a%so^DLeeN2kF#^pDDx`tbe(h{w&QPaQJUa&`9pGq=EwPdd}p)JB!OaJ6r|@rt&1$ z$pgJ^y}HgeUg_k|9ab1t)pc(A8={7df^lpUa^p8fP3-+^88+@4*KvbLD2-Ui=3;Z! zN0R_7z6K#_-Shu$yDJsOk=mv>KmGEZK4W!!sJD0e?)-9Jt2H2N=i#iw$A)0PrmF+rvV{y`_Fj1J3z^$h zliLK~^72IOf-FrQItF^Bt}yl6%_KevRK~u(RVuu_w05x(EA;Z4Z~tPP<@>dncX-Km z9JX$jpTL$i@;{+vBY*MEt9%PJAprN@di!$!z^kX$dj~O}IP5>4i0?)DVxKIR$KvSX z-&Qa7n^e=l1ZFW6lqnEcJy>RV>F?sSmEa>#i1vV6fCvwL?}7*<0TJgy%ZpRZ z`ns%gp<1w?u0DUS;KQpR0lB%OK;ej7SY$dLA+N0|>qvi{ynm6=tcf-O_-A*XsEw9wdUEg42wrK5q|+G@xp^0h3bKNe5v{L*%+^gdAdF>u3R?7_+E?tCvry z3Ld|-^Kofz^*Y6|0D!Dkm63kk1H)mR#4*N8s5HS#oyQEG+g6-zbV`Acn&TjlT8bI9 zPjtL^l3|d!c7Ks*(?T$O6+z@^OpO9`$k(Z%nMrFxAk(q91Lc)ySj6y)xC28;lO(88 zR2Wf826@?f6VxbNk|>-&Vkm=+*dWh+MG_Ny%nWs(6sZ^>hHWyKDT&NaGqRAvNpdH zsqda$jjA1{x4y!eSJFpeJb!YD9T`B^8jPfYtLMIbz0Mwc>WO`( z%zca4-8p>9)N2E9n){0gQr#DDwLpK71|4u)+6D!_AZF!F^P_a-0cRNY$cs3KR`VNM zm-@3EaYhVm?URqrthCQbSVtbPS?KGY)=3nqoEYwU1zyv#Tvb=;mAdL@Xx-j7pmwaI zynh$t>4`Lb#~Uzk$jEWJg@e=BY( zOs9K@rkwxs#8hmc*sdV$zu+Xp2uJzXDBK?=)OF!%nN;3@T0!Tkluv!QxGkQ5(0{IT zY8ocz)k`Onb23j@pMdj}Cg(R3g85Rtc)ZN_rI81gzB)24d4QY@LU6_f7*VBLI38Y* z50DLxxl$DJXdOctCC$9qOyckgOekqsXUN>i^A{bEU;g{QgP-PB3?w2KWa*=f{xzc{ z0gz+S&1c$t0dN<3zM7k!uXdy7>wmfF`Fb~czL}ezZ+4#_u1kuwQ<0{kNmPsDyD1V| za*o;I6z_9TGktE9BSw9LYi0@bHbI}eKc296L9%GNb0a`E_w#Na8tEmi#Fh$nSw^b> zp2(1%D#w%(5xt>+JZmPD*~Uo%UO?_7)x_LHK~mm4)V!)QFe+adr#7%$1b^VqnVcFI z@5gqfQ<11rqH>B>whKU$VoyLQkQNY|7w1kpP)Uw<&{NuVydGzuZ|E+trF1M z?LM+5A%>^%-kan1`??$T(N;ysVD@$IRTq=#bW6`80jZdQT!`N{S3uXk9(x(iqWk&R zfS)w-4C_Zsoa=Mheb57Qf@eyyw7Dj94EJMDkKk#wer@U|T>#7zG|Ea4S#Cj2Sa0;Hah^QzELVq zpHTw@^qcLn|4V4a9h&fyt>xE9Z);I!SQ~~N!$$v8B^#LT%Otit9tc_rqPFh z&!g%oW~?W3WZow8p@y_d#+Pp`wgx2(pvym{$e>6wCQ|4bH(Ax(Di;;R+6PHRUIr5> zbhzk_*id%3(tm1CJG7-V2X+B94$%n0R-XARV0LJgd1;cx$o*#7ydF-yWb%XM(_S#o z2Bij#K?trKDvAXZbsU~Wphs2-dxT{+xwGQ=S_f{ zENeas(PvH-tev=4hQ&>AD-}vkQpC?CX>BX0)2PXN7k?aNWNnZZ`o}UjbSYas3p=QD zvE=1jx1Q|DP^;=qyt7W&zdvRs75C0#>woap0OfIjIfNYf^7OpZ?7xE=XhD_Eazl7` zo{^~=L?@892`y-Y*em?$Q8ozV5h%UAi_5G1W<(4* zkHtU{+<#ghlN^15Xi{i`XtG-5(DF^D=r=vI9sgmegGzrWSsrca^U=xLrL zUJYDmMoGdR8^Ic8QLyIZA$Uh?^r(OqGTZ+uYJa$gNmUWMQDkV8w&-Ni4LUJ$R||$I zsn~=dv48STOOSY3E+~5oMHgg=a7RTBpZ3L>L=i0-T`Ce_hJ~K?cCX7=qN#%^#etfK zGmyxCP87UaYW=P$gru7y9NHZ7n8V~PO+_7d9j@fRsRL%^ws(Y8A)VH08tWWH zPMoL!OcLOR#Oa`B>JF*tnkH|Wi7K=$O?h-lg`4LPtVxx7dDoH%6V|`jnE@sq;Y@rV zCloWX!ql_J)bcyGGG|^B3LR*fB_}yXW`9QRftT|G9NWxXQ}nTo4);s^9_RY8_jg^%HjMHBhd@q>@u8M(cu>=cEv&WV#p@~HiIgUewk6qRN;>?!jkeZ z%jySD&Wd#g>s?0Ix_^`st_no7(>U6B!S%$ZDl3}w&vB3gnj%wp5oN{F3n~@WQh)W3 z8Rn7g3jMhh#9jh1N)G@A6SAV~T%$MJVz6)mr^d^{FFVFkCVGZ%&FGHPro|pZ!l-*S zf3e06t)f$idKq11mvAZYFNEaZX@VrL>T$0omgb1z9@iI4G)C?ek=~nGWuE(yNh2mn z?>_Sf$(-ZL+?x0Zh_SvocMpYb&VR3>n>Y%PJ+!c3}&%`5~wG9!+(PacZm)K1}Nys^twuGCso`rpQ2S&QhbbjvwzYwPx?$A zm{8C)^y9YL6Dm5Cp|Tx)Lm$W|;g=Vm>fV zbedRNphn3WjQdfN2XEJ*&?pX*NHoehj18*9p!U(A_e8XNgUvo4%8L@*CsFU|p;@&! zp~T4#-?KLFdVyByia9b%EPr$d<3ftVP(65JF-#`8NmrFmsioA#bVi_JfN9BD0bX0`p$C}R6J9#=J1oG?RDZ6_S3TKe$8qd1 zosc+A&pqBpt9A@`5^MVsic{{1&5Qvx@Q)-8nD;1|DOit&kqP}6a%HQ>YcnZ%&v@!w zx}zgo4VAvIedV<{Aa|Ml)q{QlPJ95jq!IWi4D#l5(j_=adgnVXI3KaaSX8L>=%C!S zJ66;j-nYfEvlfhUAAdZ|qTbcudQ?1=!^d^?a;m(zy7e$8GOX0u(Ur$AgkVVmO8-WZ zz1T&MGcLlsrF3-aYNnmp&6FJg;xzqUw9^jlou1o9>5(2=g29k||8{=dN7E%v(r&MR zGR-C@*l*FqSLwkSdRLWK*<2IE!Q_L~Sj`bqwbK;Uu64E2hkt$qJ>;1uICnmxzPtGI z^o4-95%Rk3xs!7d%2sn}FglS6Z}Dja@uj4oLDsnTHRD|TdX&ic#JK`Hu&^s;-PVmS z(jbA^qGWc$FyUXCiXWE&5W8ZRS&}YbVUF3PI`(_>@Sx@=qV*hDcM^L{%Upubnx?UB z-Jolyo!v_5J%3UBF-0>8zy?)2ia?#R2~#!T0?%8?j7+l;McuLQb2fapw7v8@~Strw?-0naV9E&Y0VFd3Zm@b zg+oq$9113d7mS==E$SbnziO4nKUI+@@DLNJ768_c=o+Xk<(K@hQZyd=w5*-{f)9fj zKul?Yr+?+!6z4l$^FfrJzAL;vun>OPD2H3@>qYkhH0ZOBZ*kj^pV~*8v>!&>@^7m|6=y~P(^CZjU%|9hRC5G?=fZziJ>rGr+mg>~qLVXS) zUV-L-7=1jI{&gNj(B0<_Zgn8K=z!GXSUPiCr+=#*A;9N8j@V^LH{Kj5;|k<+=1N8d z6*7WQx&@^mA`igxtSHxcB$m)v83yM=4_|}n$Dut}C{5ZjofAFK{h3OZ$avxg)}EA(MP>6-k2>%()+D z+ke7-V;S!tfd_sv;y*NBnrMT$g9U|WetP$%14Wm9`h2~85L0#Fy$$j>IC({dp6WSl zpeb5B8uEKeb8y%g=heEJKx2f(eXylXLE)WT5v?%-VrJzA+TP(@eg&lM1n+SUO9OcDxyMGI3(kWoenpBg(kvCh2#o3X=kd+;}7azCW zWsrhHlWcXX!akM4(2G=cnZlebv>SoPM^!F<)j1T?OCmFkvmX_gKxsO?x=@@XvZ{!& z)+&0jf?Snc%HjZIZH8$n#ToF;A)UY~x2rYPi%wZ)Ni?x0a;ZVHG66ga&D~7y$bSG$ zaRc^G@jEyf!EfXp0Xx}+5%7cuYhg0+oNwK4(v1a1!-5J=gkEWP_Bt?1J><GSsfSaP{q=+dkp@I8X(=wydaWLiE-bZC0|MF2 z(x%?ARs&=5>_--J7?ihnK_l3&hnNS~*FvLdYdpF;7LI-;XwAUMSRHq=Gt7iEC!AcW zpYgx~QKgyP0xa^U6yniA`aI|MgB3T^b%ukz;>GzDjaKrL`&KdCmQ>_V`+urju;7sN2yfC>(?HstoNVd8n^{L*?;dqWP>=h3Uo+TSaq6kQ zU;mV3%OLSic&C_7_?-YqK)1ifXDRJ;@3n0nZ$R+Z{`}oGK(4ckTd&!^dys3S&kvW2 z8mo^~`ElkT|HlViFKQlz8OU8y!BHYyM|rLfm(Da}wA01~NPLOJVMKp2fWm4>f;Y%# zT%A;cHCbUFTEsr>Vsw@8mO#3- zUmfJZWf-%ZsP_d)P9qQ(%+GBEaq2Px&5jVPZpnFnbtA6Jk&3rn30f2M9bxONBS5PDF*ijB}!WD%L6pZO$Xp=*tp4t~ePF23sGbG*6Rjmvh#oNXgiXWgAdsub6LU8@>Woy!E|qg-~5}n^ijE5P}4`E;{pS$AqA`rDHM+F zi{=v^S?gfmhDU#@@>OE(STEveki)8ZwZ(ln%@G9-vKoPd?f@?l+C@UqFE(X{=~YrJ zM#EdKTP{PYo-*_Kc-s;*aE6=eU}L+PV6Tv;He{~BTQ4~m=yGoC+Q$1|ZWe;zli#x2 zUdf|P5aU%y^PEF-hs<? z_w$jlttOLk^7_r|tJkwp(tcKOA?DAok4~(Zr4Rj$@i6AJAnz`(c0vv({RHGS_)D=C z$5-AvoOuu8DqsW7wKVNVI;YrYc?J}#AWdcMZ)<N7-0?QATA|i`e2>sMU)DS`I8^!2qEW#cqrI^`}qG`mYppM0rDOW}R3(sMEbf zG2VY?p2Jhm3-by_`Kkoc$<;dry^W%$x(ThMD~&nOWt?t*$`vQB3pzZ5ca zm<8hx4FdHwsknBI!%(-S%Iuj$x(jULDm+}t0s0ocEP^z09vhWgn{P#Qc$l`M8$ds=@@B{W8{P1pJR zvi%LAREhoONStSnZ}&l}HB>lig>*#$P)h2thtg6#MBgxD=olbDe;a#xcL3FxFTQ%boxgeF3oEGvs_6QMFZ zi*T&#u)z7-OppMFAGv=bpg~Anjxc>>BiF4suy;yr+b9L2Mx^2mOxzy%;K*jA9$&|4 zE%w5A6Qu=}1SyJa72`pIhWC1&7tI=91a4p)?wqC)5ZW`?-8P+ty#$=e%=NePvpEi5 zE!~{h{$eeoWZ`|!FDCH{&=d#WbFsW320;|w$-5uU@P_k3`|*GMIrVz=r*rP2e|>#< zb@b}Z>E)kapJ31DU~5v5_TVr>-fc)s^D=&gBwd#7CS60B(37yj-0@i3xFD3FecW0h zYh|Y$MbvT5N=)vY3~Xu7$H>XSeQ_P+AZ4u>TJY+1ysjCV=@O?a{QFrM6t_MsV(|>< z+GJsskmp>D<^X?_lg3#HzrT21&=AIUN)6znM_|RiNfPu!013+|Ru7>pp~Cnz<2<+(~bH_8{{-Ww$a1mODtn!E+QezYoNT%2|AnZTx?PQoXf9J<7o z0a~1_ql+^~gwXBKA&00!rDYhn4mNS}Fa>c9}t`g z-L7kI$0cnt*azQpQ`qA0t=^Ec+#wY>cT1w&p*ZUZ!~2(ih-L7P-<@3@ou0kE@ZY|^ zIyyPJI`ZFNoce$J`k!Ay+b^lD%{DeO!)n{s+dGeirkiK`jpgO2)k%BB+?_Z%E|8AZ zM%Ti3gH?Z?L4s8QjB+(hH$hf|~*)m1dS+j4;`G zBN7683r+Yo%EbZSlc2RDH#fC+PRu=yT-+!H+9ZGexmLT4Ox{`EkzuZ%M1bc^Cm<5a zB&AyHm>UBJHnqB<7!!cbzl3a~-U*5av41u;L*$k_uEGEj^Q{JxI(api9-L`2PKiKI zUIZRBB;&T<0ML3S_OB7oH{D3y?yTRMlLmbI8NX6IR%wRz!4XW%{NF@0--Hr5<1_l9 znUa6MLsjZZDIt^PSjzCD)vDT5@+uvK%{=4rwU+0ekJeG$<4mi(YY$L8SXw3+eZ^PY zAhe};AU?+WN#v}RpoPX*=Qc6?e66FDk=rPQFGK&$SZw0ccg>t*X^>_dS!W0?>fi$a zSA5DRlqy=tjQ0W^KJpaoIe-X;serDoBs6~#AXmtRL{7(hQ#cZ5W`rO#cF8u6Fp-7$ z@a^L318?V*g|AKmMc-@?Z8R7}ZIkG%-)W%(sCn$){)2D>(!B@GtO_(*eX>oWx=V#=W($ znH8lMmzNEGUs!Sv_YqfBG>F3dqMO-bMvi*hgF{Q5VslTnz8vR8VaHtW3(D@`GHq{z zPqIh1!J#!#w&l~`YEb8#n%-l^Z5Tc4-RV9s@GwhAd)8-^UG?$_TmitcE{K0a%%_1# zItD3>>_lbew4`PZC@5AEq}d2)YB-7b5y<@O@Un6$|HbbXak>-|FZ^xwewC}2Rb}7u zeK4Pll zcIHvp(f0E7@x|+_x_y*_7e0SLE%Pcm@Jufaj@&R^G;kaZ?~JdWKj-PV7U$TF4{`dw zteON3zEus_|496pR!IU;D_VS(F~rOFuP%=-PS3AS-<>rEDlT$CYeKGGpB?EFV&g7? zV_`oLXOE~O>P#i#;1aXW#TC*}_vOzn&zW+TYBxH&lr{odAGp#j-BKlQfGYHyOPeRH6=u^DTJ(N+d}^?$Nkfc)eTC^n0;kj@Jdu9du_ zI8I2A*fLDyrEk{Nz<>AVp-96HK;l<7FubC_z%uJ=;^d(WJ<*$X?xjSazruCA;4~y? zz39$ECG_UgP9_B+RU1IkXstlYA^)(WRQfr@E`?4mRY;Agx+v6>e z4XuzC$eTN3Wao8Dq}C9cCCbIZ)Xlrp!L>IA4ESMWg|B@M|PL zI!gotEL59iioJg%x{H!tJltw0Oq}m(7!ftH$8%1xMVN$`ZNl;uK@0fS%<;8FTy^wi zN1rtslvf5U9j%;L82a-g0zwXXSh985n$u!MG z&FQ;V!Bl&a;tcx&RX*2L>ZZz6sYo$$(x)H~wU9V-Xj6X-3SSi~PH0t%4Kc1Azv7<9 z`0l(ivq!A>=V=v%RvG4+yN2}sW$?+gx{1q9@X22pIYtLGm^3cE^Bf+pxgymT|G~N> zNDWG>wea>ZZt(RHq}HQ2FnG4lgH=g=_DyF=0ounecBH(ewBDQ&A`m)A`QUBE75^rH z5HzgANo9WkC}>g3CQr)0pa_H2G$#YOh+Lh(e4{2L_T}xuXe*TB4LlUJujKVdrwjRc zo`uzl0M;qbWx)gKSs;FwQ_)&-?C-)&#Lj(+e?|Eh;H$OfPY}EHe}We^ZM%cenycou z;v@Jw*PL)LQ=DlQHMvWVI1tt_gV3)|D``N~!bN|2fV)|QxReR(Z4(@PaM<(!4Ft$4 zz?+r{PkwTQ$U?Gb{kv~~AKI(xCh#E*XC<_PyUiRjzlLUrZ1wxjc7)#4BFeDP8kvu8 zrbSfFJ46MxZ>*}pQx2LP!Bh>tdB&_FxESh>-Qk0E<-cEG#Cf!ii!y(hcf=BE--zY+ zUt)j6e7Ma!UkK!=f2}Kwju0^nS*X;QBY2Lg1-@p2tA75l;!rjFTYGOaWuiN z-+lA^+i&TKy!m>roCN3=*?dGtLMCN6cqM;&TD@5J{ar1?Hb|)sGr5+4*#}7q${R`I zg8aUM?M51e_)4ASi@yGH_Jbr2ini~Ij@}6$dWtMmw+=Mg!vU4Si>4rGb{;@;ox^jj zJBGU70Pr0ahOpSJOnr4+Wsq}nQTyY#q3Zx(gHHK~PQ=#oG3`KxX@<$}J9TuOAnboo zP8?wu1Owp*(~Zi)^KA0&)5?xN<{oUIdBmNlNV@-@y?4=)+eQ*Ze}#WX_ugZvx0I!4cUxz=cV$VowXN4xN!>el>_an? ztW0(>Nj4w#=sEuPi--V75CricS+aY^J7?RfBoGk*0)apv9z5~id>zz(K{!f3p7UM+ z6^qNeLI#(V6>|7L6p@9XFmw zyta$uVK@sFpGO~^qRs2X7k<}g`B6B4>pMqz(Hz+g9Ktm{G0};u^j~>2=2KmU?xOf; zK(DCvXrLQZo+TQI`#FC;pvmtLcNeBQB#x5Q@%+|da5}tau$+h9=6Vk3;5!`x?uwxf zg`-x;4p!wAhsagSaXmYAI3^EH837Y|=OXKZKMJ|GaRcH`Wqe-U%-w`T z2AY=E9R0D9^~kqe}UPdyY-moZ{OZQDSdNFzwLp*ll) zYT>7@rR^4lfaia59wyS6;=3%};$LN2GEtqgn?m2*rlD;hDN*bSSn1-p{_xU&nYiLe zE`jz<-^rw=^?9H?Kx?u`=`GZL#&i z6J=kB+KzwN-Y8mFL!%Rj4ziQShe3-~U^?itm{Qqi29yp~&^~jZ_Asn2_3*fXkX!$T zS4y?e!$W@*q{gO;JVC~o+S(0p-_`{#Ps{ECR>|P5nK)`{IYc;IkLks0OHv+^V^T#~ zXuc$=?Tq#XxKx#p>u>rMeB8)Uouh2Xhp3t&_YmcAmcT^I4NdnBY*-iPjT1!C&}1_% zCoNF|mS|#FcHY!uMfbZfPp+qiaZHZ%52=~a*hPOyN3yKg*&y=#=v`YoSknQbf}J`# z2Ex0pZP1id&zcz*O=l`%lRJpg$m7-Ax_fr#Oc|!^2yJbLH)?JH{g0MSrZZ%@wd4LI zVjSSp4^nf}`FW^{rh!yop5V0|oeLgL+t=?lQ_IAKw6^(#i_YHf*Jp13cTHN9|1JW4jjb7M+XjN@uP#Bn47^p zmNK^gHTc!>{2$Emj5W|&xT@WOT{Cx$NVU$v0yk{bkA@kA_9|%zL;m2wTG-cfEM*oo z=iFegnH~gLFuh1>Hk(HTFgG?SY};Gid>TGVb1(`_yGJA&rG@bx2`%%ZE}>cRagCjTdyt27-U7J?cYILB29HTs;fUqpVKk6zVWqkwJa6eA_sM z6N$E`H;8d!jp^nz3~rq4Y38+t2#l-242mRJQKO`s;ry|Da-8^A)rJ;LvxB-Lc8C%0 zRA?LKtx~;stUWK1Do?U?=2WK~ESj<120AGJ4$7#rrKyUvydHx zVZ}uY+gTHbWoj|m;7fnv8`M>|M`%GL*IGebQ*J{B!^@}=6gY|x?f#l_|J0lr6aJi<D089k*2AZ)+2_M=<2&#(e`_nmM~z9pBGn*2lwjJw_!_60;PSy zVUKDWPHq`9kpYk1RZ2#VLwa2S)&bv}N|i0shP6WMB7A=ppxO{#ceo@VlyZ&+p)m=s zDGKnXxX~_-CT4dMf>o-2f^@aBsU4a$#66g%##e!x`U7~TgI#<}rd41f}ll|!lU zJ@GoGK2f-h^KTFfJ9D5AN82R%^08t-?(D&0Z_B|j8OQ4uj;dAOojg&fS|PiEEv#84 z7b|=4Kq-GkhVaLw$Y9RrLpVCsGJC-~PS!G0+WrJsehRohS}jU0Ly!jhH&Ya^n9dQf zE)kQ7!Fg32gBPzpe7`Z*?-Qg?yMu}r>$-!&$b~y7_st9Aw7yuS5~T#sI<3!z1(|P4 zUYnT1;N8&yV6Z>CQ&M!_xNlt&$g|MV71SNoXYzj@n}G@Z&RlMpgT?dkFcbX_Nt88* zHJ6O+#wxs_DIr%77bLmBW@@t(YpbyQnuwS?mr@E7^4l zDtLaFgos~FwmJpw*m_XoIklvpX3Nyyl~>#OMeJl$dXk5WB%P_&$5B0qOG+VK5sM+Lj`VK>dLd}*zv?w zBW&0~#)W0c<8Znfy}%hK`zngr88k6r;`@J$3F|bPKm)*eVc>?zDBkbWO>TDcE- zcpLn0sJ{44pTCFVst(xy&}F~e*FnVe_%!DT*}<#wc(WO!1^3_ubF=? zQM3C8yJjd#R2^^NSJ!|K4k%BeY62R3@`0#KH3Lz@JWs2AfTKNz&~VOLA_7>-9T5t~6gC*T+|HpMUu9>ZKlI1-{qpZW=NkcS4KGu~w`D$O+Y1r-Jqx ztE&on+*je+*U~yko&|=xsd6(PkuZNGe+&3^13=N&6Uro9180QER`Q>B>Xs=-*8u15 z^>Cx(jh_A8R?za!DR;;FpWp!dr-yfb?#whYz3W}-29u_}*%_uyd-a%{xPBOny+A!Y zUt<98&t8H~ilrFOnyWllrcpo=hR~ekwFQ+4orzL%HJf=+m{_gqi1_XcJac~&& z6eHLwfB1T%_m{NHU9z|6=`KhWw=_PAM!ba zNY-#~_Wl4}h0@e1AV8r{03|{h?h=IIx>fM~Ie2~g9#no(4P}}IYIvIO9xJ39=N;t{ zffUT?TjmHJe-oGhDc!-HVB&u(Ou=AL@REs8+kIGqN^c%ku=acQ@T7*B57Q#76klb! zxJ~S~o`e5I_FPjX$!f=<0BAoDJJkOI(}atarnwr)SA{XN@ z7LO+sZW9sK%~vmw`_+h+$KX0xfYqXZ4$6-@i~tlKF!Bf*UkKgL|ujsjGurw1KrBRxP zGR*0EK1<$CN!O@MPcMHTY#yF+3VQJh2WGs={SThc(U1kFN`TJ00l0tjkaDYVMH^TV zvre%o(bVLkb^XU?L!aH+fq}*+L7HXBp79?1#fHPQeD>)O$0tF}8YazdquSvi4-&hW zM|JIk5+{ue$d^UdiV--ykULM0v@(uJy2o)p9KF%q5zid&f?9tyC!ge- zWc2L~`k+S&)uMmBx6IpBZG8x?l5~GiJb&>^NMB^I(+_RvupNv* z>V~aekX*CD!vyC=bNAu>o1{Jo9^B81dx|R{G^<@-N_i5B3A*5S(1i`9=oK*kswu2s0~sC$zXSN4_abj*5I4vFBjrU9d%UG<7Sbvqxo zd>xC62lSaGS>@Zy7>JKZo$wp%ff|)?v@p*&+%7((LX_b_%A^caoFUvLW7 z#nwjt&mLmnMK@PGg3i#P8-zx?+7=XWnZ z{(JcR!|U+*%aNzk2s6eEo9NyiRsi(oAP4J

lF2F7-8LMI$w1&@zn|Zfiv+{5an_36*m29 zf#L(C!7CC(lcfBqoMtRw;+vfS#V$p4;C$s*f0`cw*{d z9pde3A!&bn@JAj{Hq_Giom5fBBm%}UYc5Kd0Pyk~u7dHHv5sq6NWB<*V7!yC`E4Q5 zc3c)|-fRp}{AyU)kW7R6Fl^`-WY#Md{h;I;12cn1hD6MLbg0;YcbS9)JcO+nLe|Zw zN^4w+|A3^Ze2O>h7)mmzkx8loh0uR>uf%1>wzuh-n0q*$UPg?>pMU;Y;@7-xvstV< zxE`C7S-h_MC_(^~MMr&#u zTteEWDATNPtTOPCQj!F0k?_(a)hBZtjv9asr36qZ4T>#lZaiuh2KoMM;}Djur0Q}T z$oEN9cGerrkRx77`yvVOYv}IG|6YYAJhKmg3vRP;;S3l9Bv_?^MvV!8TZ}b`;VM~F zo8S{z7LU6Y+sHWWmlT!x$mNC3%AK#k!5TRifU^6 zSo@LsoLncnw#$evC4;Hm{ZcSy9cE!aLULf@s*Lc)$88-R+k8wjf}($w2WQ_XFUVbS zK)lVvmnVL9$c-~HId}L1JZp}`0Fd$KJ{#VBrs^_ARAvEWI?`PSOdZ>Gyn?xO*cHf! z^wC8|m-`2BS=w+C!)|7634}>x+j58Q`Lz1!;ry~4&(dw!3AQVD4HVYw^&9ac&zok{ zdmcW1{70SM!}HGdsn>tD*+p866(K?VTxE#&=U#ezLBs*p!*{T1^(q7iSb&#eVX+|E zGHEBl`l`5Y`Vu_iLe`@S77+Eg^jv>3>F{ar$YSFIu+O*W zW1>UvdPj<Ipw1##Y-iU@-*F|AXng`7AQq|y2_4BJr(UAT4b z6{Gl4Q_i#t@V~HC!bBPOWjx%iwu{S$r$QN(>=t-1FP6d5;Un&k@U-GAkjcRoG7Hn` zh&huH1j4FIxS)SSs5a?$iWO3%SXR}qsr=NYQeZ5xRqC zBss16KIbW<@%s%eZ-5$=8-W`K3JK~;B;tlznLtec?Mr`N|IR8g6XgU*nOa@8nn%~) z@eI&p&IlDYvqY{TGPm5-zgpSc-H(=s93dpD6n;zgDyHUMzyS)T(9yHFkvDix*3p|o z=mg*vGscQ(3?d&$fNEG9>zS?1T0Mz}r(=Z)BqOCA0d@H{&AehpcG2$Oi~<{b08jH7 z;}D(PNAiCeH!fcqau>6+QgkhPP#$$FUB~F!X8}7CpD?m|G3p}jbR3X-rloJAG@E!E zhm5x4Y%^AR-%6AQlrr5)??iDN7pbbDfGbgcTq8Q&8uM@j&8;pcM{>UUst)ILy=65j zs%q5TRaAPeDs{QFHAV2ZyP}9<{q>aRa=q28ucCj_T1r%yO@E!r4>vtmNu1ZKxqp29 z@af|z_m8pn2jQM&Hs+m!x32kyslDW1Bw2_1jKgT>;CAOKdHL?ll5n^mg2{l}H5&VK z_qJPVBsqN4D;f<3!xgX2@Pddo8yqRVf_FArs~w@g*_2Vvpems=@S8^lH-d>3=4ksX zmg0ZBcB!~HO5Bb;z*a?%0_+~t6#FVV@<5YXc|w~;DnPL7(uVqOey6!NAt{<$(=>5) zN8L$Kw?~*y@q?baUT%qYE;QGU5s@0Ia>+qblMC=5G;33HQ5f9QxMBzwfEY)rlr$&RJ)*JjjYdF}m z9|^%zq6pQxqt@sR3hrSl)-la)1aPbgUlvsp+SC zKluIk_wK36831)9=OZ7H$BySydJ9`#Ps+reACuv}>Gg;vcl{WZ$8idYEXk>j1HynI z;Uccx8{?9vHjaXgfZo;U+@b(K)w3=1@xjsar?MM@yFc7%3f`q#8$sBCd(WQXAM}d;tzJTa& zAMNh2CA!vfKmYpS=$avr%(`fBk5$zz<%NLC_nE^L{ilu+&%!67o2~kZJW$hhL~6Ej z9h45V@IOHrz0N&G%r}n__x3}9ndWE4f&dUn!_Wfr(J=5NplGm)@)1DrBvXI-#qES6 zs>@`DRol5YC-O;zw^eS!XMH|Ce`~jF021He=3a%wR4LqVTNho%KTW+3t6maE6np|M zo*{RUta}av0eqeV=@E7&tp1^nbCojzJOXew32eC*;ipJGra*XLAHH996x@Zghd**~ zx8{36v#QV8Q$`7DR(772owCK`v8aS|r zpEk*H6vaHf$)S1ZaQt%d=U**mU5U99H8WgA=C_b02twn7xB{-A*X?0;d3RPl#PQ~w zLG<9%?|a6Gw)r(OmS=w!(-uha_KOzE{bRCCGm)3Q&Ggbihhv z;5oL0Rk%nE@vQPlix^!C=|mbe*JRYl?dUqBW*#9a{H2drk;Cnnkz(n&@ie&m7D&FQ zU?twekol0G9LKGrlrkdkX4rt%7a<%BtL!>Bo#b8T%V#|y13stN1)h^EUxzd}H~`>s z>gH22YcGC`j`QZom#}{sGeoiz=4l`s8scz4b(hxOoISadSk!FxEV_h8h#7+RVn1z07{yj0zn0v6@qC;wvX6Zla`4#e6O1DPI zMKqL}VbO#IcSUjb;hj!JMc+dD=3ZA+ee#~ZFX9ntLh9}iqc^;W`a56^N=4QtZtI7{ z=pv?4$(UJ&+kJmXAbe}LgUmz&_YfreIfS1bB_=Qgm}up6ESkv@O`M~`WTOt6$2)Ju z-hI*Cs+DEoTRDfeCcf2}^is|66M}2LWSv@ZhqW;7&An}|m z40-1fU{{B9*NZ+BK}^~0CNa2MCp#5qTSD-}#PUNJ61A2s;g~^Cl~I@5 zkben53X=#nYtK1Ymbr9|jQNB;qn;SJ2xY)9acAi+7a43rkQh`s+ zQ`aJ#J!80d`Wc&^ELlJSn>q$~%eY`$9g5h8Td;roi}xS?eS%*2G-veRzk2?10wjEz z1M{z;m9Q3MRonnFIa_Tg-2wI1o;*6VRW` zTh%9QfZ!Sd9Z2TF?s1U?3t7P6jJN4?TaX$ zvx~)*X>y*4xhlOgsFBcV3tPQ`S;@b2BAg`$XhO4 z1p^W5tp+D`_G)l?aHc2Ht<8U3gi&&;TT46jg|lKUXZ_Kf4B)%Z_@|D?^tmurOO2)= zT5m#$oLMtET=n5bgKT4r1Q!ah-R}f;C5&@Ggj+bL16e2Q%^#;;p1|cpcsHP><63oE z6&gCWbqs|y=V&t?^x%!MPFCTU;Md}nRQR_fz|*NyoxGxGjC~M|qJV!!jgLc=s6!x} z-(SD)ULsD6sWo^9cMFSzPhj8)ORu67J>nTU_B+%=L2l>%(;UKvVwN&xO-pBz&P(Sr>v zP0`$<%Y%B*%8SlUr2lfOpV1VRXJKZ?F}Y9sU!y7oPcGKxlnP%)4O9KMtyHI-ke&o_ z!ZvaYXp206ye#9~QGI94)kn}_x&1^A#eZn)cY>?YXCk;?d(6f5r&HSDK~q6ql6pT2+f{LQEDUwr@S#b18H>U&j7HJsqB4-MN? z&8i5tZJNb$-}ES1LZ-Qlp=YNL7C5Jeex!b!?-L%48g^P<3?2*eCfUQwkiH&WHy4t3 z(h|YL3$fDz*?oUAB?1`t!h$H+*{@-&oTrmdG|G6YMgtIkp9ivNo3d3lGyUc|J5Cdx zT&GQ_<}2%#QM=I$n^E3d9$OMwbH&Yw@I2n6pwc>a$)X$BcbK^aJg^*|c0cDS(;RsJ zzGJXYFJU*9TtH4dD`~2|nU?f*4_{P>2fR#Y0tftnEhc~JaVSoD@Bc3B3TcefiV0dK zfdF>f;smUSLW=|v6S6lnn+axzQrgR)@ky{@aK zbqod@K51eh!Hj3Vj|uo79!+GWkQYULY)tm-R#mP0;>b(?4l&V>ekb(mZ<@6IedI-c zzKW3(+%gTi6kp)vgV99bIaWVAm)>m#BNq=hkDi?VU#ILAP%?JBPtQg7ub6DOFSi(O z266#^Uu^9=jO(wx1@wZow?KAUdj?}_@drr?xD4|bd!cw;T0#6NAngGPAB6H#t8U>N zSN-w zo2e8{C_)NB6GwVN@x1sS(&TLhy_v}P(O#25Tbm)tB8(kNqH1?o$oYWx*|)WD2BHFg zzL3z;Bl`jZOF_K4urdoFkA>hrDg6u+!duRmjUg(ZiRkU%j?=)@@ng+vNce69p}I`M zFicKaq>y}j8RBUmrmKpJf~FvHQO=mE7-DSN(ovZK8O?di*K!huO_X-eOUv+EVHuC~ zYu0s}HsD{mkPa&>lO$yOA-u$Q!Zo&kmI;*I+yXAa3yH8mvYtd3bYCqb!UoE0(p!Mo zj%z4@shdS@9-SYWHZ)>yGaj1S!{R)o7|HOwfV9q`WMQ5#&cK6F+Z4RRhPrQt-JK-i zhy)&iGB8ICYCL#RWQ68PVBPN6sOs}Jn>|k)#GHwuE=jfN<|&FD=cOBOHz`qn?DW#W zI)@VZ{;z)Us9`i|0eRiXEbl+V>wvtjw&AO74S+K?H*C2rCM*C;EjL|DhqZG7+s%dx zU{38mE4J)TgU%YL=QvTW?PW&>Zyj~=k1#Ksune2KOp@nlx(V|gPlwQTL>(sQF#!m% zN!gxtnzpGf1~f(6u&s$+ZL{Qmg4EwE9Hx-sQM&{y0&qf0sJ89-IY?!ZS0=PQ>N3P~ z&rR3UAE~1qV1!a%-qOsN6rp8*4I6UjsFw>e;r`}{P1nr@9ezuEv1xjllxsBg;EuqX zvGqZkp_06ia4T3}pd}>yq=AIp^ASow9Q>|&on+3&@4LJ2`&-sO1|p_^OB)r6Om+@D z()XH$i6_kRMkaSOU_t@lFq~mKEB}$CnZtA>dVM%;mb8~x&0W}YUYmuGGn*Nis_nXJ zxHcc7&YRBRpui_({$307gf8U0Kc3T(LF+je*F*tO%^XeLMJL@Y$D_FAN!Z--3{0m^ zbMZav#f2+{X(7MD%fiin?G>0w>BUGg?WiS6 zgYR4cyGJ7@t{*mB6U)%;mo>L|vbZ=+XehDzO&H$B93MBv%^IGO6r|wRlme z8O9Y%+ZAGU1?N#9co z+*JUoB^!O$8x!q6}HLLKw zoSU^OvXGj8`Hg~WMmjy`R=qH&+_$XJTi+HAuybK#{Wfu*w&*W!XozX058WnTR z!ak=EBqsuIG2lh}`J?BmVf+okn@Ks=m2sk*?G|`;D2pQ7Y}@Q&gIyipEB=lNg6827 zy`9WA(8JH5HDmbur1=t~2Q*%T-zUwjkDWYZzrg5!MIITC@sFJAZe<2~!{TjE0srbX z2j2F}d6Pgdcwb-+2$9zmOx1`RJSO%i95OB}_8?do2qqr1rvgizmS9d$m=*EjN2j@= zqzfauhAsl~TY=MD&WY?Ypmdu>@2x$9!*o%A?y}du#4eBcVU%TV<~-+pX-xRWeaLkw zl|{aP3N^2Ru|k{{cp6WD_9#6!0E|%&(_kt0hyl1M+cXn-!RwcED?VU%&1CvaBEn#| zn^A!X{LMMRbxo;60T}#)lD**H|8oeIzQ}O5>}W`$da*g92GX6X(+g(yq)I5*>T z1c{bS^lqEu1hrO=|LHDrl#I3jou2%WZ}J$j#h-ZGLFWrP&UV{7k6O%`s5m9pyQJ(~ zz(ngD=f~}^)_d_zQ9sde=))&`Q9X{x)u|u{)nAeVDFVYHOl03%*WfR$YuT7uLnOw3 zL{VoRP%%^Wv&G)&wvks5;R-A5Mx%zMEz2kc^ZBbn?-&qBxlMsx0jhCoSqbGiayb$vFRus>3J4`7)avr`% z6LuMh?``H6WrllYjj&U^y=+RXw^ziG)~iskUAD@7Qk)p4pLssVk5T7eVk82sT5c~n{z(`HZ8?7kO9#bzl@yA^}h z60OnC5scf~cV+cJrzxtS4~kF|i3Y8$4l5?OCF0(6R%%yeCCRJQv3QEDvqH@Ziu7m(HrnYve?%2R<%JB zWtMcd-|J-8f}$Rl1=~P3ZgQtTf2{e#fv|A|{I*GtxI-aCzo|vs9TWl;M{|gpfY>?U zo+?mJ?+{%k0gZ==L%IT@l^$olE!E6XW4xxX8cYW$g#G_k^)5Ad65(yL#wQ zU*F63G<=WoJJdYo<}8CrZ@@|3k#b1me|TtX7)StZ zn#*a1S@Y0WbJklgTJBeu*D!J3?`ocJ=F_ud%SEc0DBt<k7I5QORYx8@)p4_@xOQ zOv1;su0sb4#oX{o|M9I%xIIqQk{o%O1bw{sM7x*?oykpZ46?Lc?i{JLCal$|zm9oH z_1Ii;c#eBold)=~m^CG?e|AwE63&kMxu)bC_jJrCs!@zCH5@;s%0t2VwO{}K zh4dDqmBB|MMwffv=3e7QdWQMhY^{B!Xd>KdR-$`vYgAt;`u5CH9+7`WQx7NAX4t9{ zIC~sc$>KthW?rvBe;sws=lCen-^Nvr5=^l;n|Q?(ac{DSjk(=w>7S~Zu6-oa7jw5f zs|r>gJM^dV95B#cH6l+v%<1%ms%1A0<-JtG@4KCA~)ye$yT9-fDqJ=KE!|g5OM0 z9;T?xEnQWow?2OcGXa0+-=NcR!&+AKE>ro8Q~pggR`uybHAqWZq$#oP0%PJ&J}W%J4ASCXMMhI%eVD zi|rbx&@ubLcDj7dQ>LQ?$1GqtZANMnWB+f~opRHREWnN31jv7OTC$7krk2YI`TJr_ z``r!_OBU>s5l%cwOzXdwQI^IOS>wJZK6IN5L+X-CRKf3zc?yg4?HH{tJ{ zfvbOqF(}EVEBRlXL0eg&j;2k05?(Gop%qKBTj_whm@PVopLO91zaYyyvt;6#C~@WN zv*Tc3Os-*v$ZGQ~TY=Xx{7Ql4E8AX$N%?lotX69_TBlXqex~cembIQP4h%e}e4oe5 zv$5o&#s7bARip44bLCe)a21rxD*#%T$XI!AfxD<-{0_zKB$l6s<5ru_36xW9IVVWw zl5I{PEQQycV7S#ya{}d5_skj6LJ%(X$GlvwXO~8a|#u19s>`2~q9q$ZlRm4RL zNf-vBRDDoZkg?za{CwX9IxR+s6e^*umHM<`2C-=0gt(Z1iM0*7;IAXz&(lA1eu4UV#*4*t zK|FEEaIR$MCKIM=NqN~yzZeZ{@^(pxA@_g3G$}I*%&kqrtQv1?6EUyI+S*hsuXAR6 zxS2lg`KuG7@wiR%1Y8lAR7vv)lM_Zc!$+}!bFDe3#RwQQC5EIMu7H*hBad)7MFVI{ z$l`hYms2DFEt{j;VTYdG7SEahwGKhcCQU$zvTV_`&+k933T$w`anTaQ!wFk(cA{Ii zRpO93+dn&QnP5Im%*!c!$+MtroBNlNCRwCrVF^OoHL|KE%H=P{Vq=?&$XEs*I!~+AY2=Mjc z175b&nl@cP3C_sli!fNFz)vcE=@=0~J`hwugJ9y4j^`AM4pqSjuN9#vm-6}Z>z6!4 zA<;Xlky9bx2k2!?ej{3cycDEdW>?$V4?;5&h<>= zS!5c*^Pr^|gKe8;F$nB~VX~lJ15X*#+iF<9>8eRTnw_JkZSop_DNLxtNk12t`B@tAGBB%?{aoN>oc#-1mJmNhl_^vB`hZXM(Byj}6 z-TMzg$IO#Utc%Nksk>(`iAU8ew5zKo4Fjy!%mT$kP0EQ#1}6b21v1b%#U{II^DzT2 z39E=MqhKFZTP8Sy{)JJT%QpR9@g>zk!;rwsV#muZ_UlWl$K5rh8SGyI1T~?r52_T{ z#tV{6kv5AQCx^-X&a(y*7u}{4(;kpvd7B3pqi{|f$|8h+CXWDJwY%bYgujb#^EdU#p2^Yxa|Hoj%7Zp=qh8QaMBJ$ zV|KJ(B$e%?{u{Ll;L!`?B!+Rc?ALHcWhIMOi$TfJ-vK*n&yhBmJ4~7{hP(4EpVbo02 zq!_G!MOT?Fe0;!Wyp1R8s+hP~&TbeYz&L@64cZmgH%!)C#Kl#vL${^$wmu1EFlLN; z^TZkWZ;Fi?oB`O1f$F9YYhR(2N6U z+txSQvjRT&augF)ZW02Y?7}!Hn}aWoc;ak>51z0{%oOlmIaF-OwlP*|y0&u=)w@Fi z)_xa6U0XBXa~29|K1}{N?rg~po%_GB=5MUIkTn?_-3E7-?KVs6!*6`~8(+@jOU^)l z7N-1Bx!T#TLY*$@nC~QK(*g_r{ijbKMCo2(G2U2xf8@>_HSCePOE$9cHjXH;>Yyl- zoDAmX7oXXdl(*4!dTfsp4GcX8peM&pjFC;|nnPw!jh$&N9!ot=$D-Ux18f~Iv3q`= z?pzs49Wa_0Ax&43UiNlN&v6>8nga5Ff~3bpVhyaaI(Y!qgS6+DNd+$=3+9jAbJ$qe za>vW25&~O7*Z0;bx*aEVKF$67PSZPZ=OnIn+XBz``zqOkm3tsszbs4Qet?KQ#UcwU@onHFMlGB zh`=>-?dy_>&V;P!b+E093wDU0{fF^4wxOJjRM*H;O3M6I!@CL7D%ftvtcFqW@cLRN zAWppIiS?d;R87+KXc0}1ZiS}Di)ea$D>OY>MAMU7q3P)&nx5)t8g4iOZ8M+=6T8o5 zL_3+t^L^gtC`LekkC1S04r$bJeS-KeAwC4npli^7DS6@wEs|$b;%5pC z7^isNxK)8}lX`7#=dWhc+s<6x{w^!FY#!pI%!(VZ$=|<9<38!Xu$XXvgd3N~&`w|C z(exdV9*OUc+sSaG(u&zE(^{0KbfKxOvO44t=aUpC zdAfk26IDrO@NO7iMRk$;E)&uN*}BgQF;B@ZYU_l5WU%kYErvScb>c3j#)S`Qzq&=v zwr;`bQ}$;DUL!Z`?wI7uC#xqb%7Zq)$YJnt!H&&*_=<}^h39F124M@-dp>ql?ASUK zOhWCNQ=Yc`w9V_bggTUrGA6B>Vpn9f`UXpVLh*e*5rg&N-pC|O(9j%UEawnC)5k8t zrYP71B<14C=Qtxq3DE)PSA>-@ApLvJ)Z({q0>BwW4LjJjZ8JR2MZeW30T$?&0K#m* zAky6syZzcX3VEY{P%Q>BmbAFb$DA`QK?hb0rlq%8!|$^vus`|z6)ps`?yrv?Jm{_! zVERe&Spt=TnSbYb{NUjlG%zqrXn3>^4Ugv2@MN8}c(P8TE9DjC#6`jC#66Mm=3eMm^QZC^bo1TZf?M)IL=P#CtMaD};gS zpM4(;*o{H-4?#kl#YfRS;-CWp|_CuGVFN>`1Id zU8mbDxu?fHFJ53Y)9RECsZ?!SW>S_IyLvjhxP!Zp@$;TSk(q!sqY@m_R7?jh7%jW( zwjH;-hT;r$_N?)1xx3l)d09$v;95NXPCXJ(dY-6%g|S&<(;a$K@%EN-GG!SWlh)b% zsn;9o2y{{H$sR6l@RY{HeFhkSkoTDx8KxO-dI_8~mn7bQnk;p@AokFhF++Ncfu)!X z%2Q9{`d1UuL)85I^UqRJnakn^;vH{hrIYEi$Mk7qzW$o2i)v1o4$G`;Fnxd5G%$nD zd7EW_gZD?78dGW%x!ovHk84Vl4hYYMQYY0V6R9i2QN0j}ZIIG{CWye(3eimGE0-xHZ^>S2s4*F?lec~*h-_H48Uy_5F}B22w-mzTMOms6B-yMUMujGQlC zp4}Uw7MXFd^Gw8yrP6b-Yu*K<(>O%CnP{qi zF$aJ#=;{yX$T6(Gn$U+lSC(%hs4f8SddaaAz7q7tMHOJXLE*n|f-JgG*#+wpV57P7 zr=j60skpxedS6Yw z!R;tcD-2vw1iknkvhN`l=v<2cIKAf(!TNa;f;p{#ZK9ZI106P!&%zW1YS|Us*dHj` zAM^>kKH=C%;=f1P-45!^V+PSAYT61;L1493Q_8$+8}hc01IVAlh-Y=mFVjfj(1qmz zIe~kqzBgt*f?yR3Rhv83!PU-xRmN79ol9;S^P7>LDZ0;5nfd7`K=7nEKu1dPKJ5JB zwx2gv%;-`vwMeI z$smm^+X^Ls2zgcZ5>Qhp6h(b&XG<^UUFrF;$1jG7c%92qfzQF`A(% zFi)=8dTG8-CqtMrI{_VnDeVh{aWO~p=d-3P9?K@1muPjL80CRY}uMI7Q4br|A>-A zD??`B7PHK`h$oU|6HKv#wR*)@bqEve*Yu4|7ZiqooX@eETzDIQ)#ybUoV|F<+JRfC zdil|$`y3$cjY`e#5EuLKnCznv^3r&8No(&JlNcdL%0eXV?jmuDE(vRhpZ!me;XAEj za}p1myBq5;<7C_J!>ESB6OaLr>p?T_Lrj9#=-tg2B)(zrJGD;)9irE)@X?iPD0IY7 zw~)8t6{Wq|wXa}*0IxT|yOsh5{sSDSwa(+CUarF%oJ}D_3o{Xt6~#qc+EsdP(_eft z%aRAP6pAw#CYOm*crDQXua9N+?Ackvc=t&E ze*66Ygx|k<{_@qw@a*;f_bRyi`^OiGW=Y6GhnG;521$P(*`Crn8S7CqrP;-+J#0UE{D-gAhi!mA z?@62W4BoodG+~XUIwq1sO>cz7EV#%6uUKmt_emY*hv3TIHuiEb0sxN{^6UNjC59^UuET!> zRIXX};jm%4CbQC_N8;wpB)t!OjLw_j4Ul6_U~M6&c*2s+i)hJ>+1oVnH_*61Y@K7N1t+5;DB z?zl7l$d1W-WAZOxo8awVU%cRbr}Ir6FL%2z-ty;mOaSSg-RliMcd$Z2Mc(%jsJ=l~ z?D1(RWN;&p#}ex6?Ak)5%N ziVRqFAs3pZR01N&&ey+Y0aUMR60i|3R+z?Yrs0Xb>Viv-P{&QJ_3V6oO5-k`iCeh2 zTB!p|pCF8CW4H!rumF5~-?=(~>*E363}bS@;|k6sCj73x{+N*U4~2*l>)p|qpepYc z)MWa566N@{$vil4XvBZ%`l`mNn~JZDM`6w01QnH_$IAJF#H7I}x^zXVyXNk4Lp^!N z@tI?~`>82ErCgpp{#7LVGV-Hi~Sm; zpe<^+Dj;u_M;W#fUt&ROUNHVH=X4x9x3W{==@dK&;^aKd>D>(z(&%MEdUWpc8x8qi zmmir1uK{zH&zS~Bf8VDG{t|;I+il%$p$B+LZ=)>Acie^UJO$?)zGQGe0ab0K(f+f@ z6Fye(*QlcG;r-~#jT(jpF~F9=Jarh%tZM?p^rq{kvCpx>me2 z7>rHiA2{8W?Wyqm3wH(gRvLW9Na#?U^}|n1D(amMzVREye~&yMHr;h%2KEB(cV)80 zI9A}CFUBDIi)1}|i@LYav2EUF5neZ!j03hKBbKA(fAPJg3}u^U8SH4wa2`E5IPKg9 zvRDAA5DJF+C8op>KP+A$kCE-7YRkCu3k}S{H{iP$A1346O<9hyTb?qZgx=5Gyhc1a ztv$AE|7oqje?qUGFa-B@!X|?GT?hlquPgvTfp$wEFv*75B79*C-^EcNxY^F%@)hFI zd`(;B3HRant|;Ix_aZA=a?@b9#p-6Gx>@sCqyN)T9TzQ679)KKkL>;po@1ib?`)&u zn_=3QgEtr}WWrlxFrE)t)WAJRxNiv2vcm0afae>6e=Bx^)pMh!lf>nr>bQIY&(7FD9Uq!O>jAN#j%^_`u`Z&Sm%7obv*~2HzG%Q!-)N zII@s5f8S_8CMf3}l(lDF-~$LtF!~r|&q!N?F?QL>RjjBF4wJW2FORVaJkrl|5Xw*; zF@MA>lm^)pE`H~79oViYli=ZK5W`&b-LEw?f2i3xlb|2z<_BHI3rZkA~`^7Lmv0m*ayU zmwEh>w7SqExQ?=}tF1_O__)GoMv-9=F8x;#72598A<%Cd-qzzGwnJ9J>wYr}UC8@} zXpY*T4c*%rs!HlU431}KJfM5|uzJhz=;oRH*nN02yh)F#;2N8bj?b9-4a5?pSRh*Z zfAFwLjQ!<&qZE)c-~uc5Ih3SLk8T97%d1 z9x+AHK;iE!yf#Ky;KK&md2m{X1v(Rw*YAU&)95s!uqgfcOBtAy563(*%tbPLXq4u} zacq?KWX|A#ktq91{|em)sREs03&3%fT>V_sZPUmSvqhlof(qk*yX3joUs-t$}lH7zwf9UzQ z4LdB^`B2Y6E6&(uh&dDw7e8g(=;#IUht8;z#Y3Kr(|@$G*E1gAT%z`-+1E>mdF9LI36XIi%*R;X7tE5IM{s z>jA`#iw)G4uxB1V>bn|-LQcmUe`}3fq5XOo3A#t8wKe9K9I&&>9AkP4T52gj{L638 z5Ec{x<1z;_FNxgLY^EUhQzU#kHky=&n?rnFZ(yY0IN-yGJypAiv2ohmbTsj@dx8$8 z*@?W2j8VS(W||KEFcu1kUV1JFcczoTgC5U0Lc|bE!A{!eqUGo*lQN4P+R;TN{-WsX&c&$`V&wA^nogm*;>j|5)c4JZV@6SKJ z>n-DU=SsrYW-zy#v~(tIDX$!lC4@jd`&!v6v45}Gj!FS94H*kyDJ*HhMv$I zoOG5J9>&L$)1J2(Q(B}tD)sJ=z?-pwMh+odd-g8V3WH-in-omve>54qIX8j%%@r!J zB%4sadx3xJ zs~`>8cP)AzQEV?3@tz4P7Lcb{(sWXH?Tr-8(fQUb)qu7yYSfILfUrI0Lr z+;F#3KVf0UM>Us_cfq?NWul8+T6xMRJr!t7UXunitWF>!`>sO-^1#E=l{3IKZ3UkA ziNTRllTiGXY=23qptXn0ieTKuPi_%5r)-+yTG#!{2X!+ z)QsmP-IEUxNTj(w_Y5LbcyiI?8p^o`4o* zeigaqrs1*Me>bNMN5&~xi4FR3`Mmt8tN>c;9^)c-+PWb_$lM@8!@e*-h*_J*5pN(< zRFIU1EaK6 zdci!OF8(~^yM(%3d6X&q7n9F+DJDW}rfC~|vhcftfaJ!$yQnxk9{=3$EN^s8nuX#`m=WHfxa%Na48A)I*qkTP4XL6Ei-cGomv62$s=E;6td}?Bj?vN*Dblh$MdsUn-}T ze6?jJvX* zJ2%4>gdeBUcPrc?zs=`-H6f3jJ-$0nRhK#+3Pl$II3#}Z@GG1qR!L#LD!t%K=uIo^ z;A3pBbR%Pxa*iE{ngS(y^l zRsHK*iMuEfh>a3&R)6QfQ;ZHb?Eai#TM$x0xay4@;M158%-llEfeuOauLlW7w zV1K|J?@CuuCizUlp2H23-37L-e9aT}Ja$pGYpGr)E*;M{-8(B?@wDRIy%gvXw^3{% zF8b2o^m!c0+{rw|T~kR3Ug?lDsc9vcXieoOwS_L{|GIP19j}xG32Y9(=2;pUxNs`e zsoAsp`tuim83+$}t%Et~Ducr0I86w>!G5Wi_@xFme=oQjx`X{+Y7@9j-*d+-@T0^|e2^|FNQUE#L zw ze-&i=*cSDYq|FCpcEsO}HW!;{6L7iEeYnRbUM6UgQh#|jm{5uZ>0`|$rK@)h!3XV> zzsR#gnKudk(Xs&t@-y)?nG8}0=x#&W^*2o!=NuU*lRR4v8abAow^>>rXd+`Q-J3M% z7*LeyZa}k*KF z(q;9uzpV~t=F~3rc~6GBH1fcuwTq_r0aCuIK0 zthFlaXomV<$5Ky3@Hx-Yiv+2ye^1DM2Yt{htqM}`H-(fyq&~+*LN29SsF+Eqwz?xQ zI4ejG@8ZlMv2~Z9r^u5*2e?@bkyWs`V#7$wj1p(n zrdh2Ib37jP*E+q9G3T5fo@mQWSH6_Z6#vRWyslY`ZTt%(+fI@NJy+U0f8E@P_r9Sh zVwy0=Of|33KXT3$2%~k@x%Ql)=Mht(KY;N0FK~R;VnE@o9i$zKp~McZ(&oTqU49>! z@MbWXY3#|A<58@`q6+O_YLWkKSH#JmXDzks9Id^|!<{j{Y|k_cs8rv!mB5i%$K#_1 zm{rGiD=gf(qc0(~bCb9=f9vg9r>M9+EjT`xS#c%%EgDkMs#`1d6U%gWyEfbz)>@)! zwwd;&^196}vz;6SCaCdtjl;b+MlH5Bw(KWm>AU-4TMIWOyRst<=GSChSv-ohOcDze z>{;aBs!FXg_^)3Pq)Dm4y<`2mIZcM^^;{z5mp%13A-~9RH;bp2e;;tFq-OAf&ff_r zJ3{T=E)ez;?aDo0D@l)1)3PMUDl8q9fArZYl76=J%J11|s%D~r3F zu?H>zk8x+~lf%1jg!#jRy2z63CWu?yAiU-C7jK3NW7IZ>e=<(aLM*i#@`WcD9yC+c zQJA_HZ{&>lnkWsOb>C*REOpXAz%LEA zuCd%VgiGL9>qAjN!h4u?*5EwK>I4v_4b1?J0vGcnkXK`&azc=-(}IPbj@-@(iaz7| z?+S3U2lb0eaH0iqL!i1;wA4qQGd597V8laq<^%Fj(15Gfm;e}=G!g*Ib}iGkk7Ph% zlodQne-9D4`9&s6BksP7sx6AHBFmVRE1+c2@fcM%4iuuK{O(0iMvysCRQVyPo~7pr zRS-HC>C@~GUkVUR)V`~gf#nuqMp7SX(X6<`QOrgHE`|qq&&`?AF+?xY$U1wkCD)CZ zRT$D0yB%`abaVTjG0AgCq!|2}R+p+di&;Y6e*r+99Pc%c>n7aqD7T$shS)x#6y`XF zg%N3^zI&l^P}zne1(gi`JS!soweAgsbB!3GhJRtTHV9yUv+h?)%vqa25bzA(*_Msaezm2YcO>`flYd5-|GdTgG=T}5~bUAf0cSe8-`7+2s zf3|a*0FVGe+@4$=Ql|5ff(&A)*m65AhN4lvL|2*2vw>(J1a}!e*i--K`ugmq#=7oT z_v|tUrJvJ2`fD1YXk*Y%41{d(kPO)$!Jp`#X`Cg&|KR`5*(}?s5`diu`(}{O4+8>4 zBHN@leD?b@e>)D*$09w6VXs>G-dn z?$eN9T!n7z8PJzsS^;oqY;@t$?!crnRzNg;OgeJ7+CR0fO<`u5)NCn&H zcwepqQZb?})5;w7c?Z&i3?^uC@3QM$UfWSXTR-UFPtaj-7z0)dwg~#3(JjIpf3FCB z7vw4`4{4Lkx*|*0RRPB3ekvM+$Hn3ssz7YMqe`vDbJN{8`$3RJ96c=8xN;FB>p)+T zX@UGshI?MJIvB5&oMtZ`I7Ap2K8po)!_>VU6j@_!8qAcMG0#&G$e{qX%o*==J ztbqnUc?Xsu37D2y15x@M&VZh!OlQPG_Cv7U@4mUTD@F`cNU~zDg5;k<_~e`3uC3Wl zV^>2cXf=cipF;l0SLcjU$ZB0Bb&<97T&F0Y*dUY|IAIuUo2b61z0%iF{Vh3zzp~)k z`drgR_@e9d$S#3oZj!2ce+(P+@#>n<~8QDo}Kysjm3f8a3ui{JXYv}Q(B zZS9SPi;Y1-$pT>u0<>bpGNr7$v;7Y@wDhP9MrKrLy8Ki_8+ZdV(B`s^^>=@g4*hpAmO14Pf|x9D$&sER`? z-}E@=y+sPYI8}s*pZ({xhg}zxX?o zpPJD*bM=?xe`bJJq|{XKUL-f6|D1_|U3emKA7HoERf1(ihwxRt?61mfkL?mA9F^LJ z2uZDZRqrCOKyY7-9|uB+aIM6<>UxM=&=Wgs-F0zA=CY+ZEVpyG7xt)!K((kKD~gM@ z9BFg#4QyBV(euXG13#u3t1o^E>67J!x6W3%1Pp34e=-99nWbBsM(?t)M>|}XHH2;< zgGB`>-A4R@b{0pB?}yrFSj`TE#_k&rpBB8LLJ;xdr-(BKr}K{y_Kg{@5CEsGgS($U zoCGi5|LxsL@b3MaZ%%@@&tJd$bP^O5{p;>!8r|D$HupyMaOm#pZ%B&nRg&%xyh4zu z&vp+{fAJJ7as&FQR`F63kJ}2wX`m%l4h5wMLqWp{`5bjV+3000x(QRt)uG6`-1sN> z?v6RB$+1S;g%3fsfAeOJ@zuw&$gzeCL?hpQ@FyYgPlAVk>Zp12C&Go3`S?$y)t?IE z{k@TSj{~J>D96p+zveJ9aE#|^RX1JnNk&jWe+vh5Os+L`5fu47hu0teO11D2=!{K5 zx=Sc(;O@5{-@p6x>fKACwVSqYp1=5u__dorh&Rn|sAJE4lQUQoq7eUf+yla~!NFI; zCqVHVVZL^7oNAj{WqtUr3F;JL89EEl=MVS)43YyT5B_`q&!0a~jarP^RSh|;OGwd7 zf36%Sj2Pfr(=-`|Q3&Ba++*ZhTSKOL^pFO>S~QE}%I1aG+vmeJX-=(NP6t7R`Gjz| z~FSYvmAku7zQDb5zcU1#qCxad;>GGoV^`}7&5|X)m{f0~?`5Y_`uQsY%qwl+}>8?q? z&RaMHdq_vz06$r5*wEGb5@oS-f19jhBKA8@@)W$XlU>AZCv5w*Ofq8D#$8gOH2WbB zg5PzeTN|E7Na_>?M>q`0@_S!o71*J+*929Y!Kw-vP{YU!1U$_;C~%5IRhf2h26{Zw z@AlX=J!Tk{M0B^^7`|GI5VBbG4MS|WCK196Y^I>IRym^=${ado#l1+^f8E5!DvYLb zH3tO2aNvm79Z(UYY(I|VqUK)DUBaBv3G^WhJpxyW&Xt>F>#jgaG)$9Cv0VzL`w#hy$%uZJLt%)1pxv-KEkd-pzoq~C_7}? z{0@GjTB#Dh($~wVN{f~ue~MzIzCcP}5qxwN-QbuQy$!Ehbqq zz_^2_BDgR1R#`qnW!BbsTb5N3Tr0GSu>Du;QgpPzyns;l$Y42zL%z$}I8ir0`uw1c;~YH9 zqHR$%ec}qi-Q2x>e*^ny!#5#sdQV7tlt6sjkbM7La8*Gt2mi6iC9%n$?}NKnMgA3} z$D!;Rywa(J8&KY30v4RjAj2ZmyF=M|#bNUU~Nkm!7!>90_=+r%(xaS3tGs z2D9)%uqL!fcgOM`67hS>SbtBgl%f1SxO;Z?=H6g9zyEmlAsDntbGAoPDF@p9V0gq} zzdu+g_=9NmLT&|2jL&sUK-`S`3}!8O^56*`cf;vp7h71Y`$c}AH6Sd?IR6mbrSjo# zKYbXE_7BRJW4ZUDQ2wQKBs62op5+o*#IYT1ibdpJUACQ-AYozA(smohwDOE4^dpnARoFC8ig1?d)W zXPn~LejZfkfCYGVdI}{nH}JWk(osi54L@wsI*h6+x{<_LHEys>G{WB0Hu!?vM=8QK31~k+TU6~1I2Ag{|MjB>O!oiWcY`&<)+3yquy2m#DU5&y ze}^APFkfI!G_QPrH!(_)733Kt15!T4#jb^50SH(^?hNUq7wfda#UZZfDy8v>ZmW!r zq@TO9@|N?uD*I+mM%HwDJpN;~ z4c`90lLzwD)O8rAg=*JCn%pf+le1hU+Jt1qanIol6~A784%&A_l^l!9MDRHnr9&{h zMNApTx%>|>C_$O2gxyH9Xq#m9M#QpGuG#kdJiW#PE{lfg$kaU{mjCCU`^}N2^}KRP zs(erw>MGgxI|2USUNe#y4l#|K!gOgpkL6ORX0<%OG{W{(k5MCX2&j+L{xI_ShSa|m)djm?3L?PRcbO(vZY6~J*TVz5jE)02=vR-r zHm~1Pyns{(kvqYt=H?=VhEnarko_xE(v(g|%Q8gdZsvjsTh2zsvtL}MRnv;{8LDp* zeG5lMeM7h}n|`RaL&-1th-FQ=9c%(L@7zJ>!~D#DjXpoK$I9|qfI@s=wq{~R&A32c z*t|Ag^IBHvB_wyz%`5-rGp_;P_XLTN9brHx+yc3DcFLz>Pzl@9X7G!wa64=Aig}KepzFkMWoNp4bZf-4qcH~6WQGN=WV2njK$WAH&@YkQze z1XUu29>gj`v_043P?w@6F_H94q??+*$gKraR4K&M=fv~TIZR_8VeX$Q6cs5 z89+l$Gug%0I(f?^*ioFznv;MNX%I^}OyY1GcnMHJ<|;=E3%axIF`Jw5R)))(+vAJ- zH_i_04%}l)d%fRWu`r{V;L6Tt-ZY9we~ON*GGef7HJfbSzkM;u<-nD!k+&^>WkLPG zmE19~ujG!y=zzEY@r=olHlS`Vxz}k4GmEmg*#U+}TaRC_RjCL|`KvB9XMj25OsMoY zKEe$PMY7PL%rI@x6eB3$&t!Nq8C^MYIvHJg2*cSF6dG*ML5vDWe&^IWQD|8UJGJfE z^Ow)xJ)hG*lQd7o{pnCO^iM*6@1NmxF4Ve1+3Z|WRN%SnJz^b`lQ*ZcjoFv=($+|* zRZc@@hexH4%j}5LGmK7zWvd4n*|#7om;MH{oJl?O0@WGRsq3}Oc6e$Y$Rj|2#7lz? zljW8(H5R9pp|LcVGt(ERm6N_Sm$RAQ-H6-bz0Jn7w^*(0dP{ZQpbe^jz>Gn=_m1pi z$#zY0>|ncCE#B<2Y1x8LBMfT-MTCZe5M|3@3V@ z;jNzPeO9-4viBL?^673cdq2;sJ%m-gx-wzeV{hxE7pz8jeLe7h3kUw;XRj-x_j7#O zTR7s`JIupnvKEb4&1Ld;-~R5~B5!q{N$JM6OX~~MMGZOIBOYwDAAk4g@$am(v+K0F zE#l{wU&ID(G@n=d4crDUN+VtdK7{naN6SZgJpp(i>qwwD3L248|=tv1&ilIqyJz3M@vb>RQ{RhjbQ(I3)p`fN$@y!bI zNlNR<1_*|mc#Xc3l-84t9qsuPSwTdD;DM6jW^i*HH{yIcYnyZz7ugn#-OB_edf|}X zI&zY3Ssi~UousmkO!DYDP$)%a9jOl4^jIRlT~4aU;#xppKnSv$72-mPsMeS08B_-s zf=78?iHj5|`6GI_@k)g;!LGACkP#QT5xqHH1}zT%W{mRrpWD(5Tl7ckDI zNPYvHXmDwSvdrXGS^7%0TpTL+?Ur`{vlX|s?57*HXjTkGUp^JAQY~HiXhH4{O?Xtt zpWeTHX%`4C>M0IobjTs8C9i8B5ykn^vAkm#=y8F z!u=|J02tmA49U6$g%0F3+ce@d+A!Ua$98|RFV>F7@1#rYc$2S*$*ned7C>qUr$aze zcL>CTugLYqXEm7uLob7A*ZL6)pz4eP9_CnRXh-qa@~lrx{NQXy#1|Ol`K7&Sh>egM zi;wd5z)7zxxa!3ARgW0RZG9D}OP9=~S5kW{0=ud<7LkT|k>~rzU1yP_a|(X!b2onx z=7bKa1URtjK$t>^PMa0Lvtvyb*io}gZmT;Pi0}^kb11=Wbm)+aPmdx3cok#`827gs zE4P*WT|EZTumvv~cz*(?1F>go#%w_Kr%Lc0eRxztac!qVXlK?CZ8bPqt5#zWRZfDr zKjlDTn118r0~^Z$Hc`y9a&?hyE&_k{@TkYpmH9_mFZ6qLv&++adNTxbVDI@PHdh_-A`@W_2l#gyyi3-Jp#=dZ%Ee{=*P_Z|ihKX2swTQMq^G{XRI0IWYnJftrt3 z7m8Yk2x2^II3WDDw>)umzRPE?PGyxTtoPXTJhp%K?Sy#i zPHE4PJ#cdC+@x0?xU@>AmJC4pAuEW`o|T1Co=oFXF{x03y00;4Qanqt9~;`I>d+JKt(I$OS`@0f7rA>GGu0<%eMkp@0 zyO9dT`xzF9KVe3$U0X=HnCCr3oy^e0M)plXhSLiX6Qh{+9^qaUS$|g9& zS+q|p$d+2}TQmR+^3KQ^5lSljoH&b-kJgGW)^J5}6`$3Z0v!F^&&+=taS%hYPvtHv zJu+>YF}vez_Mx1lPIR41zu&+3f;9U*zfsa0shJBAx`2wUSW!D**A&~rxlDO zmk*)5%m}$z>NrG;fk`TCEG-rkIL?bfztzhHkggJbBB)x687p5354K$AfJR%U$630G z#a1T;(q96qv}vnCl(By~!5cF1eCTT5^5oU9=Vm9aEW6UA?OxA3#!ktw>fnub4|tEb zbPbd{xLYK%L?#Qyz@)f_%!QD$s!pw`ss{q>019~Vu#nG<$B-cF&odkl{tAbT%aF*j zE6r9(&Z}#b49mMG-e{A7lU;M=Oiimuua42@T+QPF)&@dc^^(EnW!=p!>Jlxd zwiU0qQeJi;Rd*IeVJ-Cr@>1O5;uJt!AvI)H&}@o>bMZx;;$kUWW>s12hSBFzDk4%J z+%Yn_JBOV4b`F0BO@U!M%ae81J|%L8-UdmOxJxC&VOwVc73r0@Gj!2=%jS`wvW_@a z`mjA@LRV?)GokgU5T3(QDmx=@EEkOdFMrdS0Dqjng5f3Si@k$UfcWRUgCR%fJJ?f< zLM4C-xr<#tJC#o(8tw_&!cKs=G1smWpEn@I5V-W>5|4kt-|i~SbNDas6}Z))N&wf& z0{_{o2twr$z*@ooY?2!73+Vvm9faJs^@Z!@1K-jSZyTE&H1Q{}nuzWdMC=@o=3m1{ zghB_Y72N?36rLZ>$=k}a1KB_DUCu1mJ`f1zq@OR~YxCs1&xx(;2b^KMLB$z54Bipb>t?JY+m{t*kis$$bFfJZ3w$M)4P}9lYaGDy zN^CouxJm-p;XBUacgWDf`=lxaslXNUIpM_kp>%&CX7B?nvycgfg3bXlqrKP=6}MBm z(!l4_04%8W5*guN^%^~@ch*>k_Ill2T0y$sp=NSYPnjn~T{h$c0bNJ@9c+|EnkHlt zvp%jXb1*S{n$IE={uL43Jf@gzD#Y>#88FT3*@bcl452T)%g53h5=AsqzX*)~~Q zG~Itx`f;Ky6YRM0fYPB?*xpH*kOd3V4omBa(A+43s{wn(k=TW5cwfB{-_iDIur10k z+dJP?lu`4i|9JM=T#IyeJG)}isFU+h-{aY0(l8NXhDpy!`~Pw;Cy3FsreiZv{9o_a zjA-u19lc(r(O=8F{FKFOVYX3X=G}Fur!Rj|0|OsaD|)}~M0tj!;$J(UE-9j!uvyES z>kr}e??lu!J1NW1fp{@&Rt?` z1?|O+SBcDb*J~IBWS0tZbLq@w0|n#TNoMYzmfVIr_~_9e)kM~2rl_wy8>+uS()WJ~ zU=*8*DI4e~98jUp#WauN%UG=E;`|3_QCUDrks^ZNICI{Zvt@#g(Ys}JE=~Z5tP3}BUB^XI z#UXbKb@)@H#lGH0^`?Z?APCZAdMT++O(5q6Q-Zt|THGVFN|S#EiXLtLYn*?#Mq5E` z*l?U1L(fG`Tz{(l1yrQul4g4Eh}>eq_GBzwNvsp1_D&=AWvtlWd9GNB5qME-%U;JZ zHX%627=86rD5QB-#MCdR3W2|gtMimj#J%W4e3uZ#|Ks^HO%LRo(+@(vAF5sU!}0O) zuc9N5>EGNFKm6g*_m7W75%GU3)~(TLOLS$CiLL%^Df;v8x83JJhf-06DHu3`OP&N1gzxz9G191sos?)Q3#l+db-UbUf(AQ|DEy<<;e(I4cJ zpA0hB@~6S$Th7;;FX6m5JAYyiDTSq}_qP{QIl_oLPjg;BcU~`3Bso2`8ur zl-SE5foF-w+qld_q`6-QDvzn@r4E=5MVg0{6cwtvqj!SK4kQdDzmR<;w#Q96$Q@DA zONzxk9*T!lTV|0c3y(w$QUHEz-lomwLbX^rbeuY;sr=KHRuYw4CdImE~W=omVhqZ?78s z2eriA#+2dD;onNJ(4k(KWHoy@Ea6JH*bCTF#U(63pTPJKZ=SN|vhE!?gSfJ-Zwimh zGI@C(Y;$;iF=u~{_!8omNPcmns3Nx@R+%;&MDKx<&Z38;O_&uF*X*AcM<~$er57(z zV=1#Lg;zIxxpHJCYb@ocx{{r5W|>MSov3dt_Z_f%{X{CO4vxUyv zbhur0cX_Cx`<=Y3tmMr`7axlrroP?1CMJ3t6NKSR2UmYgjM?wq+`ucX?jPgm#uNu# zAFJfxP|9-y6IaO!#@ftQ#R4Q0q8dO}3&5RXb>F@{)4Y>450Rk~w5vpuqGMl1Hg24m z+HzEH^1x*U_+_XIJq3P%BG=0xk7b=MeVev!%AG!FO&q|JJHQKOMSpr59quHzSP!`T zmCVPq9c|)#L$SBuM2Sx2*>;;&DY$J&EYQC7g1eW&)CL}ZK8Nr>R+?eB6t*d!bBgQy z#A1Y+XTg1voFAc?dYB~-mQ6J#EKv%SJHH2NfpQ4#TQS9~!c(HZ2-x5^!V=7ee4?l9`x-QQs-uW7uK{;Fp! zoV)>fZ1kRe2jA-|m_}*BZ24k2$rftd+yP%)$}8}7>|VOO@#Wf|qih#HjhI8Xcpf^?^_hQN z$H+~8%JC(}b0DmI2u^665qC~xHM)3Pm3ji7O%C^BvN29Uq zDJ#oudi!pRpR~A*b!_tmjwp-R~bgHvKAy!!pMTtUKyiq5oSM zhh+v*w$uO>7wrZRfMYHb=p!sbcIA`S9^>YIt$rqCZ~r1BFq%Y?lr%jC2W+PB(I$x_1Z^`L7jD0 zM-D=5bw146mTYg5tVHVUTjaQY&&dma>qp3c#F}F}<$G?VA;;l`E>2}i8=3GbQ)SkT z(jjd|I-Rl55rZNq3T+t)!}ZID%(NB1Ev$|Svol?-Hm?{FC_ z&jQVHa5%7PPrgn!?LZSAmXk0e(}vn!kNS_r+G`C*;*J*Doe#r;1)&|3YYhSF2n6ul z77r2JXM8N|Bvdf}`}h3^M5({Hn7vI}GQ40(;`-MNR7NzvsXH8;tVq)9{!0!2utY{M z&X{ugyvE8Qzz8KFrlg0%0jMv3J^wtwje{SfsaTJ3E*kW{f{O4%$ww1BS^RLXdEry!7%g!qaoWKEx=Dy=}Z*ts=j7R!^^>!ok<#>ht z$bfqkzj{S$&2CGx17O{&%+auHW3xlTJJzfK+RkROwQPFhY<;#o1L|kpP0t`cz3tgn zW|GxSRnBgKRO~J9YqJ|>9ybs|>0EG*uubw&Yq~}I0@IUYS-@7EDB4dMA>Z8{x52)R z_ae@>k>wWlol~jD|f?Ps&Ljk@~_f@L<^UUNo&MS70@CScMH@S;AQ z!E?s?UW0CwM6-{$St+5@2p_DIAtU&(jDn;kei(k|%s!QzGEIjeIwT^LnL<#Qzj!>; zvX3JzjgHE5&2Zk7YX%WOcVh1mS3L`C_wYqvwpW~F0877{1m>H-EPudzXu;P=Gvq@~ zixzV;QeGnTJ(eSX$NeD&0;NKkokSaXDdQ1;7@@j(z$MGd+#mU1eaSqBp zBP{b12uw*_gJ$|zwJ>`J$kci@7z4fzYtJ-1l4{|@(7njDOE}RP!F6g#Ba>dy(nCwDYz}a&%vy>{A(2010_65(72qZ!fnNc--N3##Ef z<1sVF1HK-A$^oGY5^H=tF`)vHEj78-jM95+jGO`pRR8;!UD{RbE~iK-piR$bnR&`}5KR;+$HO-Om@Q8i9~+5NbxXBNJ8GRp zJmw`8Z&0f_#=7@Lkk=kR`u4j=rWa`^^1zc6_Rl&GHvl`e#kiCRl8%;D)?@_H<|!Tj z`EV0|hnuRo_rb|kRS|Sn*>q4Z%q8FDUI9%Nu&#GvOF1W=w%y>YrpfJg-QaY{P}czVT~r(+jU^%z zOMUX~u(P8}V_yrw3rTeYW*+yidQowzz+%&m?9I7xpa z>$oz3rA9%xG9Y4llB@7p7vfTTlccrKc+1@Lc?_0w#+qSF(zGNmoSo7Dzg{MGdi2eI zTf}l~uqGetr}V&+_kra)y4km(5v!7v?OC4MksWV1SEV!*(rW(V_>|w7_3}r$I zAAVfNgI#Ak5gVkKf{-;(7UAqd>WN33N>Ion?Zzo}KU*+4jtGrV;=r$(G%>CS@YC4f zxEqxw=ETns!pKHoG|k~t8UWfdu;ZYAX9->)?4Af#%HVQJNm#Brfohbf?nyB*d7;LC zoORm8k*?kxu|7gb8hoIb*WO#2HeFz$*PJ<)S-r`%a)eUpLvQlPUf;a8|5OudAr(oI!b&L&wfY~2TF$fVHsbk49e#>H!0 z(=uYr_})sgWW^fexXwCw0ja>wFBx5 zx*Kaiy@C(!X|w4aq40M|-xoE1K5mn&v786^JH;p+Kvx0zjWJL-eh&TEU8---mUK`K zC{C}l&aGb?enr>$(tiqy6+Y7pY_e4|cyUQoE(wc1jZT5%jK}_MPq_A_>f+f=t^4rHsMr8~(-v4aO&)~7 zi>*-|%HU_gy#lny8q<(Vtn`mS^dtWH5nlo#`k~9ifYr{*<^oO`%vceWjO7AFj|kC) z%0qU`JUHvvfKP?k5pF_%hwi24^vV8pafLgSl4xc!csH@=y`~$~3?_MPzEl}!;>4Cj z^uQ<6N(w%BQNkXxQ8Jrr>k_IrvuN`2+~qp&(T8Lbx%1UPVv#U^v?nhY$@(_h5%xTP z>>ae$5#%D+0jCgm=-ffXQv9zvi{{KBr>84T$KJJOku|QYK0zk|Lf@^ekTE8oX;Q8~ z?pM?xXAH>h8n%aKZsRsLoz~z3{qESQ9nD?*E8^0QP{z;GZWee z-IuD0*u~U!fGpGiY?oKz20ee|NmBNWSI8J-KwJIy00-2U?t@!%d7TI-> z?#s=^$V~Vg@2_3|;_B4%dUW1QN0i~C2$J#&4j7KE#9ifxHwK*NCdj(OtIybT8p|Qy zHjFo#fkc0>BTkC2s@gRqqq7?x8>p4M=Gka*o8rRU0-wJ45e~^=IzO} z>Ie>{S}=r8sU~KQhd-BBptIh{;|XIl5m{d_g$;jEKE(0?Bu-Mw224K>+6-4^jCmO# z)i6Q%aOrdO@#hNmLbec0Aij4d;;}*To>OoBrv4efQZ{JZ^38_JsQ;( z+pNGKYmWx~tjNVlLXmeKEJYokmDMqmp&3cKZ!SC-V);cJOj%Ta5)&riiAOzJMZ) zRhlA5Fjle8EF5y>2KVk{=6TY|)9#%Fr^htWSp|ubh&-$f@tehE6pKY&F(>Dh9wUE* zQkdlfr6$?v%g>6kuk8+-a(@#wrIy+N3J%`PI2i&C3#Xv$l37_~)M!bjO?o|c8;Wa4 z9qmlK!V1nQaYUJZ@+}KVpJG~ z3=jcS2ht~)ix6|L_q`*GdhrrXBT%k(f4m(_F-^FdcJ>7^KF!8 z#i!Y&vg7H$+G5Fy%QC-&Cx5M}Q^*@9FH|%>kBhC7;(g{j6hK)Isj!jtiJQ|`kd2nl zbeGf1rRj^O;`${%g z=T{dtpFaKH?7;NZ(Z|ElC*6Of*(F|$F)pT%{#zgc0r+l(I)!e5gI^^cBD;GXDbGE+ zXuy_H!o6Hv{x%Im_I-TxaaGr}x7U;%`?Jd4OB*}CEUp*q7XU20%bMmlJT&jV{Gn;C zXU-#`IlvZj*dqJsi+7~^={Mj*_tO{aKBv6{_&U-}9v6p(Fm#l>!x(?O9sIVwp$AjQ zMmszqzxY)%BIg&lc19%qd@HCopFo&dXV6N_b32fw`K;uXV;yn7*1S~;ino5LT%^q1 zj+%963efGSCU>AT9A+W-f&y{Byx?0{i^_?-Hp5If>K6P<#D^W2QMAI+;S>BK!NAfF ziJGq@lvY*ee|?m$m$855Yhd46Gu$b<@9R`vV6s!X*B4?*yc$@|zQBOL!zSykMg2wN z*1*|*S1}vVGw4OSrh&O~1^FjoCQX!)myMDqyMui)nj!9Fq3i`hP&ksa249ueH!GvS zB28Z$*ng-fttC-wUxTT>22*_vrurI8^);C4YcSQjucnBvriibmh_9xIucnBvriibmh_9xIuedH> zab3RRy8Pqfy2#!UYGQ)3p|mI=Fl|U&87{B%GpZIswMBpEEBh*iI~Qy&2pO}h{R}Ey z{gCUgbSj(-1>+rbg0=tYJZ%3A3-?ZDw}y^EO!wPb?gX5+G^op98&@NIWhEb7x4V{e z?E|zqzQg0j)?K>Qt{|nmHS1?R-k3SveSzry6KE*kDuOudKON_}6x+(I_odn$(F5(tcW{DF|`pu4fn*il2Mh$iM&k@ zAY780QOnZ=K{OiFq&5sparjNA3gK@6IW-33LP#}eI(7ca|l|6{!QRBpFN!SkxZz>pKn0IvSY-yfF-=>{GFCATH%1{eW~Ty*N7e!K7(sN;?t z+QP5TwDNP=h>6(D+2757+281z6U{7db}NCoYR7*^*m*7d#aeqGV$XpKlzB6~ju>{TS zhV8@u8sjt+YJu5PvyL~jTd#5lQl#z+9c1%hcEg#vM{A6Rn}NfBSUJ+RZ8c7ti!1$o zg16lf+Vs^*cgeoht^42R#2n)U@$leP1kK~(WxkIG`wQte&Yz} zJEFhX$#0~6Ylygij6cug1uyCvrjI92+JIHjt&eE2w-s8R6p0OisCTnBxPR)j!&`1M zit4g4-^W#)=V_kRyTvWjX=rPGaho)Hi`pa<0Q9gV^Oh*%y;UhhT70z^^lFOWR~yZe zoeP*q2;K<>!Tt0+41Pg7&A$tN_Z}=q>3wr0P32tGjO^!r?)*!HItRZK|5vTC7!*&oR5M9oQG$H zpLVJj`t8~_K0EO79Okh8GUj;E8QjrlVgK8L&0MH7+pciE60UYgq)limCvf|Ll%ZZN zA+vt8=gMAxZF-i~pO$e=M9pP9-?Yt}Eim?DShh`6ZX@99#qQ+Avt=#ZXUVb#a$M7U z?TY2an8TT(ksH{m&w6my=_n`N;~psBv@BJYnyx*d5~0Pvb5}4_^p2*_YoJ09S3ruE zcR=}VNZ6uwEqMntJB8omx*n0QbIMuJp=T!E@bu1q@(6aIEfYoa$DLH2c*w)yoI{+6 zp<}tqX-!Aq9rvaqbPu;;WP*%Pv_QM8g5UVX9n^csqfj?#(Oi~!yIcFv?#Ks3zq{~5 z9v&$95CwVYYKr(Pk%6ucm#XhfL&r>Yo%G|>$jK+(KvE@4VNwQNM=bX3Ic>@ckc>8Y zTz6J~5+1AG?vCXmEH`@=3`YGQWAci|XS-XU!Gg;Q^Z4YiPY;{KKW6ZjErlA8qTjvJ z9=+{cYvd}h_>n|B)jU=Rv=wK4xOg2rL1S951E9jbp$~qKb{?U*_9Z1`4A)ywG!uWL ztLjeCh5yp82C*!`i<4n2ca-%qg=Mp5382P*O7=oo*p2h8bmKf>C;Tux#Cy|Va@!YG zvq#u3BeAhO8eym^tz+hJ#?JfVmWq6RO4oi)mVOm=y68PwuWorzc6QL{xfr~qKUVO| z@MN&6L&g{rKaUK~+=r37XBerQ$bg-Wfo7^T3>92uL5sF+p5FwbyVG2MR-S4Z7hc7G z|3jPbztt5>*82ZxODV>Ri&mrUyllt34Bs-f|3GT1`5F>AGR%X8`y#FqJX&gSb~mvy z`e-9%KcC_h(tc0)LwsCyd1=8xt)t*02>uZy{|KUgT$)@~N=lDL6mbU}ZLSsAq_WN0CIP1E4o1d*c|+A&aE*XK_z3heA@j(7yS!Ph~wumjvG|$8t&iMmGfbU!j4lukT8K%3caD z`Yy=fP#!PAeZ;__v+R`V4wNFxXpL%Me;JWeX+t%UBm zvGiJNJW}kd@-l-|*J55M%|+*b5*iNDvb4JbjK)e1`a&Mbji4u%9$Ynfqhvd?5m<;d zqb^*`h2JZ9nL{p|GE>QnvGj$wNM~qQvsknF%K_%z1CMWgzWwHw41xx(y-Wy+P)m^F zA8Zf3Yr1b~A*ODF{Dmbt|C;0cbEeJunoRs_GI8hlb>0U(vi01GYee6FAHv7)!NYI) zYi{R%fZWcu7xiB9GJfDe-NYf`m`BdJC5fcpuaG|aC*M@hqc~iLrk}R-v`%uJj$WRe z`olm;cHY=nj}6BbdlLaR$QWc#YGlqc+>!oD9^r ztnYa?LFqEiO?-U(X$DLUy2?op8ktasPNvc3_QF@YVI7$ZcEyE%-7i*{3XUdDZYEl1 z1~;+B$4T9>k=V>UE86Qt+gMs)idXRmxxL)$62ao;2C65R4euQ(<+8t(5$i>p8CG@O z&ZsbJ7j~V|*jbch<9mxLGPS$B#6rBki2f^@Di%BX3Uf*kn{9pF?shTx*B9GJ)x&v~ z)s5(jBR~m-2kjVtfFbKHN@13^&`1FQGf1j(zZV1&fLkqtjtN9`Wo>25XDIHp@;gF8 zI{=JX#Yu44#h=okD$56$7T;(^BGe5~CQ$TafzUeamD$-QeiEbCqoC7v; zT!9mqY?Gm+3H{1#Ta=w&17>oZ(+dKKoNgNGp*ZMwpy9}WpPd(meZ(O&TXxaaMOvjn zE@luU@klH69}fRBSmC$GBN)8bIt&EaAbuaDjK&t3vCml{jx5I$h2kahvi#KUYYwfx zh_TPkQVHDH&F6-J8~_8{3`WPnjJV3oc}XjA9wLsn39sWSE7#Ioh?2LrTby*6B6ewY z4iVA#QVy1XI~u_&m@){;j9pE6qtTCG_`nrP=sl!WgTH!YcqN=wdLW7>^hA%X*HsIp>37iq;!uJc>>-R5u<{NaP#i_?uoy$v`)Og~%M_nL zv|K@O-1JAy+B>wF(5t3xg2#Z>y1Z9ts1E5C8m4uB`^A_*z8ym%dG?GH1#>^#mo}pZ z9g2a|Y!2;ksPW}_1cd#?A@un?EzX;Z!(>592S_rQy9-BW>9|PuCJ^I3B9P}oaiAw1 z@-=yJ{AOX_F!8}V)wpPVtCY$Emb8eeNXkG@p79Ov{#jfkS6LzkxNU@{`!{+Ym2b^d z>OmNPJfq^ZxS&bT=gp?AP>U)E@&fPMh*6Q3HIBmLN00uG(b%)LzL|mMWj(-4clcDV z^R!v-<{j-%Uuidwd7prbn4ne8Nh@z_bNumBRAV_er2h=xUPT4W9RbxxNg7ybqcqoF5F#NYMkG2UD||E6B`rEa zfie$M&o)9j4^h0HH+sz(lRwovzXizVkrme9OEQd*Z4bO9W|tV3#b?BBWzJsw&oM`T zDb5Ut-uP5s#rveMaFE8*TMXw=C8EM15^=l?>g(#*rHp_vQw#B`Pqbd-t4X z2$eiI6}|Ui&~(u&$g@kEG|v6|bey+G{~~Me4yFo{V~}pQ*(M|OY;`t=!4q*ozk&=9 z-FXczOt6@1ZBP)lx~bap^PEG+C0$N`bUFLfMB+r97~$mOlPzO7cK#RBAQH#9K_86c zDjM74ta_f17C%crrdr!Ygyeb5#;A+-T%IlD*TdNysL`P_ZlOkp&2;;+%m=rf;dFHe zz<4DcN9YNfQ8dIK9q;+u71Z{L^X_S-z0OL9cR9x4-9S+FO7hrM6n(xYgP6-}m z;9uJWVAZqrv8Nc4rf)7=aZA~hyInRjz(a<0TkZ4KZFrxt!zSKQ;eOyVmDt;JaQho- zCqPy0!}}^_kH`PUmHuJvC5_8hY&AVkE5CJ3js_Z$`QC6}$LLMrMcZ@Hc7V`cT$~pS z+@kjuca;fdjyuEbkwywTaN6U4E*P5Dc8~MEPpfR3Z~#8$LG2V;4;Hle0*r8cU4h)u zU<(5-Q58qx2aC}StArc8dn^$BEQanc3!S~Vj6s^avZzP-jkK+Itq>es*R0)Z&;7Qc z9%fg#Z%A76uiN4-LL+nx**lNV+9bJwnzYq`rh{{vhEu4&Wu>ygPmz6p^@Of2&s^?0 zu<*pix-C8-0^7I$-=lvzdGe>{(dmo-dfp$rM^3Y2K=1Jwy~oSweLF_)+hz3rd5qpa zFQfOnF?zpSM(?{ZdfzRh_xmw=zh6f04`cNHu#Dax$LRfW8NKhv=zYI%K94St$B(8r zG_f#ewl3TOBIzMAua~?>jjyDdC?nGJ4Fz@qAkytdI>cN}sWqqaGVA^-9-FDeuw2b} zv)Ax6^Sl?nuOq&1_U#cX0Y@16la&rHw#p_CRzzw1!^DA?a`*;7fA@DPeRBazRjkwm z?BmN@@z0Muo53FBXLXskjhv&}%TAYD_JMcf35*J}O2Vw0uF_^${^XMhCBxFZ5`z ztrwRgp=T=45?8pJ3aWUYuVE(mId1SdAV#p#5m$#s-vU5s&j~13NcvHa4D7aQugL7k*u@^O<30}cWv|Qm_0}M{^Wt<+6U^GP& zYx$D&?Cq0RBwvCdQf4qoybH0s+av=s(q7|+0j(N9400P~^lRDXu5PkZZ8|x5G~T5B z{?VE(0$yWmf7WZyJKD_}e1$;d$exA&{;k~q)e zdK&maJ+i0qK7z-pC@UiMxGTxaW`Azp~nh*Bo}cqD;kW9 zcf=7Ze3w-g`VHuj`?iZDwmK6+{Cc@_fK2F~pyxzLFNIc8hkdXoOD~sg<4B52PS8r& z!`r>1n6$m(L~l_&j}B{F3Xhu-M*SuWPc-!s5;v5EGfA!dM6>j5Vq!Y(vwfOpMSo%! zn1W+^e-+z$=J9vCxmJ{Q2=-`%cxC-NP8f=@9&je8~Nx9LJN18DkNnFt5_=uEzp_9+Hg+*_;)24PrsGqBWlvQA{<^V?07Y!U~vw` zm40swxwTNbzesoDP|hO0K6|+y%Cop4U(9D~0f+LUaYlnye>;quI}-rxYnVp6?3{t86`qcsvP<9H;P23e z!LMzRW4GtOQs2+=wCMIS=fk)fZ(;oJe|;6aaPbfA3FbOeOoI*`nZb)^v+djW&mno( z?z3doJF3;x&_U>0Z)p>E=9v{bX`~W9IEajRT_!=3{_ge-xW? z2mZmNr%1Eez#-kq&itlr&dXV1#x;MG+D}<7Dg%_y6tyjvnjVem`~Pq_7GM7t@68^! z^aYo11;!ocTRkqJf0dpqHBRd;FS>5)cj~e^UDN4)IGl2G_qt&Xr>mGVQs5VK6SJY2 zTJ;bgUF=W=&?>;lWz90WF1i@re*jTkbUZZRyl|@Y!2~ezHtmiJF}gqdY^K9**tg=! z=Ua7rcRy&i_7#KYh2t?ORn^Fx&*s%Sa+>faj2_9tqhv_vdbalEac4d|ln0Etb?=?R zT=hUxggJd&DfTd#L~F5 zn)Sx*0`au1D!{(ltLveJzq5*5E-Sl}g3E#l@e|=g=JW&X5rHJpW9&kMh#0+Tj1fe-0@*A>&5}s9w=m}h| zmKa+Fc#h@3fVSO%(~#mBa!XxBC&@dwRVjZEH%+?RH(evR!zgEL2B<_e!yOU!=Y&k| z0q9+4Y9jq|?>udOxfcNFKn!_n?_+O52y^{_1wtX({ZWu)msx_{f4Y-{|I5A2E{TW+ z^|EM__>*RaBvpY$s^11tCIlv)qDw$m7F)rhouwN{j}7n*7l@n&X?AH|kVlK?WwCz* z?A^kjNMa}pxK?8MTZG(Y_5)~A%t5zS=_btpV}iSs2b_8qK_~E_0nszu4sO_2up27C z6)w#X#V{=;4A8`w>+L0GQDRi(tXAGXny`YdHi?jjbFHI-45_(RZ z={St0J2-+}o;ocQcEn;y04B0Y3lCwsfyl&0P|F=Ozafwj#rzwd!=`l!D*0|kJ%*5C zgbYQM{CC;o90mxyA^u-cirFIWS=p}LVQreIYPkbuO3bz2_sr&e68il!&S&4oDfAB9XhPkK~Th9WW9mE^EZV$S#p# zE%e?M+|RRJ)_@_Ca6cVd2yl$JmwUF4rf@fR@Jz;FTp=cIB-nNH0^kn|=MxE`A7bKP z5Ey+$s4UQfe;^YlwQ-gPyU|hY_Ry&Xkuo`3O{4zy504)I!PKak$3lIYVyZV~o)dC9 z&e~T%^VyG5bqVJ)b8v-`XGBx+?nItYySqa3ue~m>yewmvks!}k)5T@`xgQ~1T|*5T ze_XZTgaFJ6B>*)%u+LnL08cw1EOa^%-RbSlz#$%?e_OW*tcXHF-2G;fmrqI-Ixzuc z7lGd(=m8e8nEam*3`>uGFjaj2U?1an1}?~(A2X~BCd`gg;RetW*(`;g?b0k%Iec36 zx{s?q(&8^x3lgm=T$6PbH)WU{J z9_e+ue`$wzFiG5Vz{Jg7j@J&NR{(e!=3sd>*BYVaLyd*4Az0m5@)KgPvVc;+7Ba%l zvwf6X1Mk&BlS;~sxCX;x_#>Q#m8a$>vSFu zpR?p_H8qJzQReOhHi!a4E-y1kV6+wc#Xbhxew)XzQwW_(^#k7!yTvEeDsUnaUB7|M zs1TpoTwrmTa-1kC0+y(mag;*HHy|!__|6wPybN}FP_JMnZmH*K#Y(~i$fXd{nb(9S ze>jD^C~O=S*};@AVc(C<5a}1Szj(UY_K3;jzQWl=Ca> zFsI$E3-R`=bPMaU_i)hi-31*NX_JtOf8IyBb$*1iy@|mzsdN?%itH$8ApKg5Nwff` z06dNBAC8a3?o@|-aTWXV?pW;1ZJZwqDN@0DlOFSKeM~p&Q_Na;{QvMh8~+Mj6Fa}f z@MjgY39Yi78?bSTW*{9rviLHp&Xt&hpkV-O`_Tiv1;(f@QAgbE#N5v$OrxUMf4j@o z-~@x>{%X=Y=y7=IxT8IttTuPRw~lskeJ8z*Yis28 z`dK9){p$|ci#1o3_ekGjdOE z%!8+5&Y6RDShyBe3D{Nm8Hg+{U`=SP2H8KJnfNO2-K>nuy+o9+vNwn>-tPil3g_ zAoSd(c?Awt+O!pC$CNME=5rjCSb-Vsp^5e3awalK5^ru&VJ)FRpK4kTXe`%J(o1CC*VTXM|A3@yw^euuw8>-LhX1d^zG*; zy^@bNACj71)Pnn2f0%~B)q~)?5-LIpj?8fpJhr)BMBthc?&`&ZIVn~Q&De-#29JD) ziRkhAYq9uJZtk80nykiQ6oZkxN^3}b$MfTgcVrA}s4vPqVefU-cB|xEt6srSGJs)# zM*$gkMUIo;MJvVzD&xdv=K$F3U?tz^P3~>sqU)0!b2h?6f5Rcu;~a?MvaM12#_&@E ztiqrs>{lwppCCs7Pe8E0ZmH%wX#%2{CIkr=Lk1mj<1&*WL&jXuiU`whEuPFhY14wc zSD(DwJloivm?HIc_Kd6I35|K=tte56$e?d%Jk?{1%v!i;h_FAUySL0$Oc5`#KhzX@ zxX;B1r0|$z3xVP4@_$n7xoF4FiIv1s1YJBXkZ?p@?5=RoV9A6>M$$>RIw_5VL!Q(- zmi`ga_Qh2# zK7*l9=V`hh1&`95Yj0-y+nNYtePI^+k(r_F~7o>YX!Z zWtpdOVffC_h<`=k@>Ff(O*#vsvTRpmRa$IrY8RoKv{Xve@uqJykW&*IJ2cGe;O860WA7yK;1I}zh!lvBsh zP0{~woxO-y?jRu24ckiwBc+dyZk@4SDS8e7)L_@#&VR!mqjAz?;;u6>k@ho!VDsF> zkoxjjyWQf*n<7{zaD7v3gfiP!o0Mw?XXzFkleC@%LZY*!uX;=q!m1sFOr&$g46foE z)G?}f^GTb;RM2fg$_sAK#3kF66=PJFO-30KhiS$6ip6BfSyb~@5;GIjo<;@Eu`o1G zIfrD;fq$_OLDW`|+S*K_6wiA=PV|Z{C}bB$t(5_TJ4 z_#P>C#r=c{s&Ao=18tBqk$-x!rc58Gq<>-JgdC_EFEUV@SOE@dM4yD!L!> zL$-F$9SX4IoM9>l9W-hmoR~7U*bbM# z_HkdO54Ylqbny|kob&XEGx5lS5y5q|dpqvUWD5}g6{8GEYQ%rC9UNZ$9t2Fb_WWY6 z-hV^f9cVj-AOJ>=3nm zH$fg(=dd?z#JyKb-EOJ^t)SXO>Geh2*3F{#RFYS}a3KIY$6LmiLc;=8b|}j5Nsjb~ z1u{%=v596ktu5Tt_&L*rmf?bAP&% z?_7$Z{pok!^z8hQCA492%Y*I`hpRMAP>7^{^!f_Ak3qq3F^mfeGfP@V1$hJ#p;r-k z@~jX`)KMD^Skz25e0`dqBBYbeQ0$CWOjj!U89uIy4O&6WBxiug^tP)9kmL6sEW6Xx z`p>H8M=rsK&-z=b$AO)%A!9|UWI@R73 z`HeQB;zIwv$gYoHW<`5F|M4t9J}fld}`q^b^>0P3klo;^YSdtg`V)K%cFsAP-5CZ zCyOl!Uoc8J6DLwN(Hio?Qa3}|Yi9G}QwH1LV+h&GpY z$MNQ{mr~-!5S;IS@GOKr?0rFFb)`~h%mkeKbc779(voLz6F>^H84A1Ig4gbP2CpPa z2fl8LRjg(fRpZ+LoH)J)piQ!TMtNJYT6l74&zK{iy<1l zBT0*@MsXA*{K&rIfi~mn*s3?>i1uDi3&XT74!k)AEiz*|A1amfoBy$*V@E9gD zMo8QzP*2r=MhjWYxUNdF)WzuonK0-v>H_fHxztiTGRq)i{Dt6x>V9}NL}{wyMv z#?to3eFna|U--(W@LQk4KhMYEx(Te6ymBu2*14pAi=1K(Rc^(u+={(*D>fsWG4m>~ z(pO%k-+Gn)c_st{w^a|MtgjRN>jeKTO>n6%e4XN7r}#hU6u0M|`#QctZ zgAngB6PloybZTfiS-5BHl5jnLLD1hBkf9UiX_d^@Cx2n^BR{Q6pYygR08>HbA=AWQ zgCn|>Dfq=a`;_Jw;d_?y|Bkq)^_?Y!s5fO>X}W4PiepOrZ>vAZCsoZ^ZLr|t$^qCA zs%8@^f?$=13t1&JVnxcz5lZx3B|7-(f}(i=3bem_qJ1Hj0T60OVuvq~9H2yQhH?`W zJw)o%^#DDT8p~=Oq1EJ_){YT7Zx)0eL)_Xc1 z8}*sKGaTThf2KZ*-S!>pV%Wr+3(6CMj^gQMwlVOGvBdm}c*VHBL=driX3e6E1?*uO zJ=NUtb?@!|I_`-)&K{0}g}hbpd?JqY8xn!t=^UA3MGx+;dmjCaM~e7~CR5#)zDC#S zMSlz=UWs)g^m*VOu!srHw={8K!bN8m2vk2{InYiQUywKVxl*aRGsx9kjUZt9jBy0K zS~4SOM#=$GlR^W}A7@JYw>ww4&Ov8%U*-`Mj}|v@o457FxQ8-+_9p7$_Uua&FcHT| z!dGvK07yMfQGA^_Gv?p?u3&PD1L)iphkx9-sY)cm-VH;{LF!Y~yo_|>Z?Czp@C^}i=FO%`XGBAfoWv#z?c0BRG>Dn!Mkrqrq#%cq~s zV$sXPaDP`n7-WU(P@pNAZZGveP}&J!4uueZJ}^4`N99>fAx1F(%hYAwHXQYMgnuym zmPkl$)<@J1KE{w?OlbAH`XlAB#Lz>)-hu9w;gR$rI1(R;?e{_+2$PXe2VWCLve(i9pQ>ci#fA<|@sTps@l9DoB5mxed&1n-v*M z<6$IuKP8966^&#MFWL&aOZ7vU0DntQ(*bHGJ+xued+_h7cn|rA_61IawN)4ZUYi3l z!`0HsBtF4LllaCW_il_MIBuGC3Q^(th3rafupR5sLRdJE-#>CDIj~Xz!5CRnNix&@kQn| z^O_NW1bY+tEVvf~NH)}Yx_@oVFv=^7oi=f0V!izZ7(t=JulmmCH@Tf%s|bw^f`-Y& zFZ-3%AdW+(K1bKB;Js87kcWQG_wWw{Rh$k~mC6!!i}}pdEI)Z=8r&+~#}%LWY>4VF zxZrdr=BW^e;bYWPXWc~hseba9Xfo+uOxg2@Gx;1Uvp6bRA<~Uf(SJ;df5OWXChmkP zX+mdX0(aarP|4V8M0tpXOq*sxe6`CdYxRNhYhr5~alF-f6U@)I)eL>JKCmTK3f6qW zv)JD}EQ^OUh4?Xm-w@zIzFuJ-A-8B>WtXB_1XK@h0OnMu-O9e_uF1jUpmEs$XH!Xx zVbp#YsvdTIw4Z3e3x9(PQMh(>{Xe-A2p6Rn>p-{&olN}mo}fU_us<9hBW@ESW`bml z!Ig4BO^J;7POi-)s!_s$h9(n~?1-@W@wtS+xNgKPq=g-kenzUFXdJ{_Tc3hH`aSs zl=Hw+M$qjQ8P5Bxq1i+&g^6!Wx)t!}bVW$b_yBXxSn+J3*G{xLPc;uJrw2EDr>OTi z>{oF4r+c}!b$@{uGA9S&H141SZS(S~OP50? zd2`T!84`5UN7_uwlrmj1(iX~tK2AysV;%v$Lq&oWs~K=C(iuEOg{A8UA(?ihwUK90 zTKD<^w+g%Q)>;=FE5wF$ehyFzVeqH45DgJ(`4Kp%h?Q3~yicea#3uz8jS!7xS*`hoX&&3i<^s;|Bm?7ua$2*O z%zw-BQ@gLplF`}S)2jdkt(ETrVb6(UohLEimWc+Ce%#sf8zmp*%>u1D5XXL#YtC}e zWW?0!y-P!jb}&hDcyt&Jd#QD?!neVnFl#_OvUChBQuPIQp7~>=te@M zX@)R^{wAu3Mp)EqBb{!~$T(b85U|V^|D=S2&La=Jb-b_FG*hfFFqzA%M4>%Dt%=iko0oCZ z?>#duq0Jx(6OJH!T_I|lwt`DmyTc4rq^`$}Sn_9WlggCZ`ZM`pU6Z9=i!H0QM;&vG z?#d!-N_<;EvpqfTp+{W*f{&yrb3*9k{Kl}8CJFTaI+VcD3D1@SIo9*z@qZFF2U7yx zC=hD*p5Z{z?%gr_U&_|dW(1@;cg_v96s`d9g^$MjFHc`TnCrWjW*7NW_vlbb(Wgs| zR--pdrzx%9a4!bScKnXK<8F!*eEHItTod7vQ($ZW&F7W5w;Ia}hsRq?TV%z7Z!zlq z<%i#W|GV$aClzEccrbB#5PyNH-_CG}Y?x{-slivGOaQ1bB#gtG8Ss)kS3@-M+98Wfymnv_e(ivMU8ITk>FX2q=I}>Dcrp7yT->U(`G3F7W`Fc-0qTQAX77;#W*C)teeO+C$iRoQo?`v|cKvk3EX+ zJtUEQXmnIZfqwTVq<`q(=)B+OH5vQ(U*?g__+toiiAg#!zXZ0E`mig5 zX~nYh3$(%fPf>ou@X<1HFs1*l!r-su*@1aT@cHdgm+2x7&VMmGLlvCIdzDiZ8OvO- z9nX5$%G|M)PuQtB$=FX!vceX~B;Aygw2Sv5hgfV4HgPsfx6Oozz2~N-JcXP?TM0_x zIk9}2h^^sw1ai`k3$TANw0hTU2nFO>C+1%X#;6SZT2nD>Y}oG2$p-_-gMA%Ii5$nO z@0}<(B3gwE^ndDg5xy%AfHK5y1MO=3M$6qc;&`l{IHX^Wt_dozfqEbVIS?Du9IQ_y~JcV&E7?}7n*upoMVu~exDW=c=hD%{|i>) z*Kb}&^3RUYAa!Tc*0b&$aWYq9RFLWAvY2*1=DXa|H5$lKS)h{flSc z)H2H$^oK3@lhxaUwv!Rq3x~fAI#bI0JHgW~)-vT{sywYKU6cl<5Qx3E-*=KL@App1ga1s$SM57KB2kf`z>&w*sDq;8TTKt`G>E5cr)7nke=?(Qoux zN?Fz+6bI6-!;?JwVnL?diOrapc^uVb(bargF$#iZra{|@3q#AvPl~u0!4{+{k)sEb zG=JRo-_?G48l60OfBKx_((3*`AkXqXNJ+^7O{!RpC&~K)uvmg!S*uN2`9vMDcL+r} zs_;9pcXS>@=$r&%fM*qS4lbCMx?aDNX_mdq+iLk8HK|VL&>3MeN1MjuO~kMy9>E!o z$IOu#uE%GPc1+qr^;AJO#~A2Q1--kHQh%0H+FD)h>@KYFnMz_y%efyHhgzvvR_S%R zX)SF$+eS!XsfV6jvTdB98(dEr7izGnI6;933X9dhngnXZ4hZP$k0UHS=h2f&?tOZ& z75^_S+xkI}r^UIr67wWPl9VlPfScE*j_X{KkhD3lHX*MZdC71&Sh`y{haJao%YVz^ z3BMvwnn&Ry@|03;;JACR8bBt1?j{azdw4k~x8EDe!6olXm~IZ<%FogJ4+G%xveAL! z$RR_V;Ee?g3L728m**bG5W|{`4uexK*~Acpont+AS#e83WX0^e(525)i1oUQqZ8lM zQq_p-n;n_Z$j|y*6opjPSu;Gmuz%u$wMX#YtFApkGC6SVohlOcwdbnPxve`D^kiQh zaKtHqbmhWG_=>l-a=K2u!GTyVy0oemT}betbCcs| z&9=dh3>je)-NgdHgan}RMXK85OrAKMU?I^cz^R8oa%mn z=F$me0V}uXcO>PU|2SW0&FwcPp+xZ#+SD|%Lg=PPrUPS8#0;p%iNn_g-9Jy%TVhF? z1`t3_#~EOm1Nx*ldlaMZAAaa{C~bF{U&FZl+dTaMxuqS@Ku?7zr;AuEo*a;?qYV%Iu~~u zM-09$)2TeXIU_Sr_7c>3pYjFrRhzkhRTpdPTugVGI1 zhv+ANk@NsDVJ_&&9GSra4#BYL^?r2F@C$`)a`^j}OCT1huCHCsBAWda-uL48jZ6Z3 zL$7F4iEvHjm^^;f6gMUSemS;~d+~00J#LBH*3p@O`;L&hdV5u4JHfUUwl@w3A z*z14hB%<^KYn(wy>7yl#dLy)Zp)bmG3F^V5t)=fm{{Witv42qs6WklQqL<7{?lBH- z2yCzP)pvWwY%RXlW(w8vmT&S57HR^{3NnTXJWV7BkRD5nuX4F*x*!Vm0^lUJg2oL5 zLN_%5&>=givgnRr_9wtO|7mKn+g>-*#a<(T51Mvtk~+nF1;sg|m{11;+6#@vi<2Nu zl8W8{dk;LR(3kio2Pl8K)gR~7Yb6WIPp32kjsh9%$|iBBK`*G{G{w+LN`F=XU?lr~ zF=!5GQ<=rSFBz`X41H;_X#s#_^`dzOehYLmLUg1!7@g!c)ZMiNzTsg$yQ<nc zdd!;59=_eyjH^@d=Y$ytL34RNI`@M6Kk=|j2bL~eOuey*28w^xA@oMbH?$**4v7t$Ih#9vt871~r?3+euAdf-4EL;EruGWw4a!cgH}DtP zqHTRhS(8uAVEoCM`jDoIJ(%`_>RBr5{PQ0KI7qP3i^*CrMo2$Ke2qS*?)2c}(f_ae z$PP!0sTQ*uPV0XVbRIa(z)3YZf<;HM=Mq;CUeU$o))u(yfK%cP#dsRQfvN%|bJ5KF zq!k0Bh$tTqeu@;*s$t7wAf0+H`;jCx7cpWcRj{pncSv`K$=0J9Lg;qX)@~0m!|K+W zy>R2Ku)}X#$p1)jOAu${tD{oLQ{T3X=oX|;&LgzjY{`F)%Z01gqU}cpI{mQK~jk|%uV=OB!4 zd|KSY+mC-_azAg`;1+@IeYZH@md%yA5xu=zFvlF`7o5rdT}|qU@2YX$cb`3f`TX5; zW!IWYwCtI&vg7gM_387s@0@seCN|adbkUBdZal{BM6*2JpFDfw*jHnDM?Xxbv7GjH zEQUaBHT(JvveA>zy7cIjkae}SCYZ_q-lr+yN{bHJzQh_h68bH=hyvCB0GFvL2f%;W zwgsMRNBksvE};*}c2o!KS9zA6XQc1Ji~|oRc!EJ3HF{Rydujh!L8%rx*8_T0H5wBK z#YQ3zh#I*nf>&+cWDnm$fLQPrbDseOAM}t0I)u`a{AO@^Rf$WjuHyDhE-2+h*5rpp>=ExL*~?ZFFoe*UOM)Wbfb) zh8N)yB}Rz`OWfRZF!Key2V+0wIpF(@CR&mO4(Xv$F>=5y6JNxUgD5kmJ}G~{4d&1= zggm0tU{;1`jh+y!NP*=kia}hBB{%Dsn(M`ibpAP3BN;CBiFhH7(A+iTc1^Q5Y9wTT z{KC|aFNy-Pys$E2dfYD2c98>hRGQ2&k>!^1ks8$u8!on#3(cKbE?jJ83o;Dii--Lk zB~!$7$Eb-Fy~J|t|3jw*;$%W94!MnTBQ(s+qYnMLyPP!mK8{**Q6^`c@+N}vQPS@A zQQSoJMcZI(CMIOG7c0suQ_+Q=hw~Oa>?^NBkn%`rGP1FB zE}P}d5XDQ}l>oBEubEI~0jC`C;S*10Tx$Wpx#^=EZ_nELM)z^K(Tob>re2bpKPqMk zL?i)BJz`?Q8!Y6f?p%04bAc;(9q?^6PU1b56&KVC>qQ9wBs|x-{~` zlsylAIrva3GZ~PjKG@_CuTJY5c6XK3{78S&;cVJLUGCD}IZwtrj8l)LgA=*==_5gD zoY{~st&oc0YEa?+PRb%3?{sU*N4M3fO`sW% zA)0ZwkT0-^n|d{f+CP5#?YF}`f$XW@VSg5kyXz1A2{nUPNN66^6AEiC`6_9S?(~1& z<$-xEN;|pOuwnnjGxHG?-^j8l(5b!HvChhwjK z>B{&;o@;LIQChrGN6IjOdj$CyFQ{KaZINGDVb1DNKE2X9LwNfW$Bv8gm69=lZl?;k z&tN#=uEqp>LU}1vG%FJ`03-to6a?{Z9+-R+#&qkOq0DK!jAxeQsXJFF9eFYC(rskL zrrgO(vS;3ERd)ye=jWGzF9#QYpO*`JN7Y@ucNFE-dPh+7^6Ym_wWE7(eR11n=cn00 z_fk3wcJG+EAge9y!?;lxO1sy|-?H^?G z7B!(BeWrU}0Z99s+dhhGO^z~qxKbYpt z6bx})w>wB4(5du7n}juQXsL)HEK57L8%#tB0YmO%w39lGhbUsMm%7ugWdBk8I# z&JH-cGHSp{Sz$;II1sj&r)7sWBvAKcN0sWu(E@R>i!tf3OkvNis~TJ55JFduW$mlm z91;{YUD6l`1-3+g2Z!cGe%301xd=!!atBG#RsfSKRWaNeyJ;;CWf1E_^b!p+7HLaDvzI$ zz>iogdc}JURoxQ!L5vUt5D;I7Ao!0c*DMm3s1xrc6Ra|SgD<9oL`S&%)|M01dWJ*2>UZcG){6*!5d(H$Y?si#DmT@p3~*eJ_gI7 z6JpO;-9tL+a+UlXXN0rWeKlQrkcy{|nJxq%VyQdlBqJzUFXlvk`won_;9^EeRqppL zjJV)pM$Eu}+ZW1thD0x3Eyum3-gMXBPm1NFBbQoS?msN%k(-!0VjaB!POjOzJK)nBi%tJ z64e_?G`+^aYN!H5IL;dX{JU0VA2$~u@Uaxm^tbtc?|XcRmX&d4>rGm8a=+;a@R2-! zAZtu5DAahIq(y=e3>t{9=xxrZrSl|}asEj8QK+0^cj|tW??RNi`loo8P*FdX)ZJ2P5BZt)vCoy% zTbCq%y-s)gJg#apn45mSm3Awp)(%&!m-W1fa-uC-2YlO3C7rL^Q%$8M160(WdzaSy z&dW>gF$bn1M@jyUTbxd%7R|@bgTz-DgEFz*;-8Q{S9LC?*rntU$67BuY&iN>ZHi*w zEf6YBO(IPR=TFce76HE?SU+#W`0;os?U6Kp3`ErS2zEL^_}PmqO^vhazxDBvGevs7 z(%qolZnJB=BIj}67%s=Et#b1;Ko`_G`RI_li_UGT*50@9;qQ0VZ-1Bn2Nr4-Z}N1} zsZXs+x@LB203cic>o549U+#&!QC-9G7r($i#V@S=oHk(66hA-0d-tOs9)I`k*u4E}|7&AJ_CXNnOW@yfsu~?8C@}O8btBIbs!Z2JD z<^zC}>s_ZdhMCSIo3Btf#dtR9F4)C?0K+{@qQJj9=K;`Mj`dItHoxl9&4dL^>VY)$ zFx5?Y_1|1by-gvcw+@bj6HwIA5FQ3k0{R`Uijds-d%4 zpw_D_V_b>s50qb<9^@%9h@9Hs(wBiZ0x*_$Q?A*C36YqX_`_;k2N4K02CtBR9Dzt= zI;UyqA=)(chlDb!s5d;5dP^@f=sT6z`+0(Wu&c0<#QybVb;Y^WJ=lybLW`X8^8~(DI>)$9pxaYT0@*f`1-wy{OCm zDRl)wEA3)~BrLg{8fdPxb`G$A{$~AYBFI{MW@4h8cEKp|8N3`oE4A&R?!v7UV3XrU z_D(+Pz-uW_L76m%(n7)ug%-aw+H!XXT<2-m3UoW6Plw4AVbVn@q0P;yrQeWs3NrL;T17(6b&qq#BF`c^}*Uz_6s}i~64F zVs?uA7jZ?|nCo)eJOCXD{=sE3%q?+|0>)OM=}B=;sYGS&5un1G%|A+q;`ZN`Ff8z zY^Nu>eCfxS=&4EGdr?;hkXOD%%`m;f!KG1~QO#9B_k5^R7eSQJA(0AH?7~#6Qhe=H z5vz2nA$1`uM=pNRP_@aWZ-l|rq==9gpzr6VX$=rDthCFDRzaNSEnWrwfA-#lJ8mOM z7yT$fL>33Ph)!_nK**WRA|!?5GA4Qw&9 z+gFT92{!?V=l(GOF!KX1P~*igw6qjdonVd(+ka{pkPUpKzB&9BakLY}_e^5&+E)Nj zbv$P8eS)KP`G42T_ix@D!2e#IygTs3Ki;06orpiq;D4b9E>4c$|8R0qJBJW;zel>C z4Cq8(E+UIGovM3SU*IM88 zW3`y%7Bf`yO}%IzVzyar{KaOyJN%{RUp+T2Atj5(<$tLvfLsNX@vOGFpFIEe{P4~B zJG&rme%T^;o29icq^#4|qmI!KKw2Lz%P^f0Rm?G|`p+OT(D z@oF#aHe_9Nk1x7M-2j8Uy9ihRRYwc2Xl4fz$`5t~VY7!&2&PfK0O|VTQLwDTrT1-G z#}z0GI)B9E^~_AW@o=sBr&4e$C|tQ=8%q{TZgNEW{|mvuutC?Ml~llbR8X8Ugym@c zN)>nkc(V*!BiJ1RzWZa9u@M!RtU}*B@TS641>55xER?(x?{s0RPo1+d!#S)>%;5q~pq!RoIoN?67?y9>2a5gg9!T?7#p zQ@`1)Cs+!46~%MG;l|q&lVmJ@uiNUWuZQt2>HWMWqf=rjAGk)V!NqfaEdEP;l?{O5ZT6G&K$ z19gLsv_>5txaazWF#(!2mVR8XY}Z!ntQDM~=f;MW-_BGGO-a@5H!@(qP>bM(ne9ar zVR+;HgjzoEH5O^Y?RsC8^Mdut(|Un-;(r`Gfh=H=M2Vk6@gbl2-{3@)>&JM6^m5W} zRFH-`fi*Q~h8x!JH)i3yc{~Q3TlR|7XUwr`s&`2Hme64^k3oVLVzuX~7v6;lm#ry5 zJ7H#otZmO}8IZksA7Q^>ha!IE&GVc6?NXJDbc}zK2~$d&*&$$CuUV74^}2LuSAU~0 zwLSsj2nt*QFWgYF5DVfS&`jB^0s5DKc2N{>4X1Xgo4q~oqH_H^IO~e{pYkl?*dA#p zJl$_;gQVj#*MYk^*+*lb9%OKfOe>;_dw53+zCmbz_;D77u+7}?OFkez#OV@Uf@xWp z3j+ZmoC1N)wABHAPrKp9UwwSjdVi)-i5=LOpm{d*hp|(owLN^SGa}gSVynC2lIbw> zAAif!~1MMfE#Xh62B$rS=2O59N zQrXJA7vkS>%#Q+Y{k}3bd9#&jZg2g71s3Pw0*?x5vfnD4uLF14qc0K@u~Js)+}r!+ z5wAf;5sdDBgQsZY1=}$w?-jFnvImLP{AzD~A+!Ta+LAdW&wB$t=XDrJLzSY%)#f z4^0PQe;e?IU=Q3MM<1@f^*>ymT!5sRF#4heRYeHJxouCEDL)4|7(RH&z2_jDu63## zhtqj1wY)4n13W~_W|w(C2PZR+(qyLnXssstgRqa%I{D4aB{(_#`G41pCU!yQ1yp7G zIo{IQE(yJQ_N?-|fARTeFHM)zKL;-t?83T*d%k%(D>2M)19ucPf8GIj8Sbf<89)ai z3f1^=i6V^K+$`~zL_h~T0n3+xKnEj#K9@BsE36M|E({IAM7ks5TFP%I@R$QE`xXM^ zH!T+MT7ZHJz1L@#qF2+~a#JC-_`s}P3I|N@xvFeQ3u|KB>E`5z8vt;E}jW$-fcmM7t9lm?0?t@@(3>%#9Lf{ps6g< zyI@w9YhhoM$!rCFL+wZKTES0M@vdrKRUfoHm0v=AE1}L}^@CQ#4dXJ!Pu!2Hi!cNp z(LLZPml!?p?ja6-7DnjYyoap;qT0D;R7}Js-pNO}j6l!*I(Sf+y39YPArUhH&v-$s zbQ5-p(f$04lGt1O8&2+QEkz1{kr;zi_&j~!fhYT*GO60viS*ib2!O=wj{L0>Jyo+o zi}TgRG@Z3tH1IgyVYBW79UyCc17%|uyc4pqN-t|2hK6tB+vb%}_Apvh5&)M-2M0>+=UYabq>~dqRb}>e4WW?oqhepT?f(H$#m@I;;KnRocTH+P_T$^<%L}on5 zX7owvgQsuH-cdD&@wC~#QA(!#bX4ak+Opy?Z(tsOqS@ak-U4PA8VlZD!qt8|x|E{7 zpu!tNa%r=HtsIM4vF&C9Jb5B0*Wcp=Ts z^E@nCjGElXC;eCYYIAhhP^Cj_SH4N8aKGVv5};c-B;_xM_t9K${g5+Jez$X9A|CCY zqe;Vm>FT17(=wYi&e)IUT@-fudQ&{u$l&5|)TT4>)h)rM_e(i74UR~~PZz$V;;JU9 z^F>uQQ0tePSpf$x&|f{re4!)prNL?0q)Dm(9W86$}Ol^a& zPRw%m)+$=(r{M<~U=56#gHQlsy`~&GOcKI>$pm~J2|yF&fJd~4663`+gZbt))CBEf zrcPO6Xr%@w+0&f!>#&D#HD()fh#x*mq7-0D&8pFugIFMf1;!Qd3)hx zIRTZLkq;H~Q&!?nPBf?!M8^!eA$9;@X?-cDAw6dm zLpTR?ym@#RRT@e=Yv}BUY;{e4p1ha~lGcX^W4f{D0BwIA1CHIK-F-pfj}!Xd{%keO z9#4*r?5z*E7X0UtFt|cz5%{xRNnyCFZKdGPMoEFeo8xB!em;64G?_ci17bdU8Z^1P z&H@r(n@P}=!F3Lh4BJcru!hGE0(?Dw3>v&$n~&@}TW{8$CF9i%nbv?5aQ4gzE91lNk*mdrP&r*fh zSFHqw3fy()MVyww=!_13tyoZoL3uP!v`RrG;1fbbr&Em}ZQyoWBIrPd8tuRtK&LoW zP^LdGgSa~QEufP`kD`CuU0UF-TAT&bX;iF#-q~jG;)^f;XeP}lCZqKI1%CbRd)vx{ z1CM_Y<_+NctyJVXI%EM!=IHYH^t6IF5nD+#Dm=2auqi(cFU$wcvjIG1}dLo9jv zM%jx_w$gYWN^>V z_3O+8w-BoEI7rC72N9AcDcgJ_Y-Ae&kj0wHnN}+U@xHu&9Mc#EmIb{`#@{5jEsfG- z#z{qUH-_@7kxV7HmlIF^$dP3#_9NRq#dpVdDYLTfQJtMrhvGI@)uz(S0BuLAXVLi* z9dBZVn5mgKkC&P*j|;&jdZxp(RmX<#BWE1#z|NAioUJT^r2AxGVPeQC#MBd^k7dji zbx&SqcVhm3<}zzs=yFI$GjApUKW19TiR;VhlI-+hAS^c-dIIU1aLY^hlo;8Yq#mps zx*l%i_loy@`gn{GauQK`Rsm(SVoGv^xD@D;X;_6xZ^~&LU6OzJR7xXcw?1#_|^;~l_Vnv6Bn^S5$;|<~GeaL^QN`eHi2((F#@>@+q@Pc3PT);HDB!ZJn20ZI0|%Pi zh(>PD&Au0PW_ShJ*)$BGc4!9FtWn|f*w=%@Be~d*OvR*{SnZPAcL~$PuJ5G^Z@ALU z!|=AdkKw6vA0x>gL6NAdn2;0JEhgk7I*SP;`@{sIj$-2FLbse0Tkk3;5p|ig#K&=e z))JeZ4k4=cJ<_rz$@gDC1Xj89{+5<-W^XIbFu^w_{D%90H^ivV zc1?;N?xSb>aNB#hy0%povF)Clo>nHI8M6()*w>usK6}V=bqGz^T6TkebyyaE4Q9B< z4AHk=7oZm4tu1blkVd(|Kw%@bU}M5;H{;~wy{7HSn#O52F(Bn9H|{4l?szvYD>E$S z5SKY1F;UGG@Li?%NtpSYXl`Z-tCwwA{sut;4G4eI&fb|s$#}|{1WyS~3{V09UqGP0 z#W-9)`ENMOAh`d#e2K2ee_TJ2z)z~be-u6ppvO$S@8Nf87eSgHLs!7n7xWc`FG2%k z&8S*Is5zo-@I-*LEskOdv|5x;;iaeBL^?FBpG_8}8GzHq;T;4bNaSv6B$O~IH!Zii zLAER@!wYJXNFvTQ3_@2od{fo$4sMW)5!QI5F_^QZ|@c^3?&M#@=HW;T~WoZ{k83)sxA!7N#AhBW;w1o-km>FaDPVksR! zpKL{?MUM~=aM{$XB{PusMukuX9!w!A+>9q5^F~ey< zy6x~8R&W%G>?zJzcmQ_Nf77bi$kT1(eG4rBRf=;G;hE?u!bZ%9rL4?n>sYAe&e6oL zFO@0G`o7dTv2RA(X3f2L`NxT{c_%MkefilR|77M#AcJv967XqPp>BL=Q8gR+8-kdiLi1jRu-M z(8V-N47H8eCNB86by#}52-(Baexn{P4ox15ZKz>fDEK?8jqWX-hrF~bHe&rlFz-V~~(HYR=U6C9eI6%#Fyag+dG#!(yM4CTZ;oJ!so;y~FV2$FM=!|eT9RB%AK zzS#SS^7-}K^Y`Zmf8N&@)&IOb|8V(jE1KI-iBM)}S0Gf*Eb?Y(Q+RlSor?B=KSV1k zZcxiR!rA%PR!394B}mAnB~a`O7szlycS6m>>R^VcOQc$>HlVjIf2j4Y*!D$h{BHZd zhm{8D+I3+iS*l90PP{Rka!ey-Am#R)Y}*JNEgD&yA@%ZWe?zl_k2aPX)U?(qxJe<{ zLi1|dSoaYIo2Qb%U0`(|)cT?pRNS%9W(5&ofp9e8G(%UPi1nzEo8LD^WN1!3lkAYnNZZPNHhILw9iH zKtBTy0$y>e-;8j^ELeg+n)V_*(AfD}$c^E|vp)$=6T=}sF%H15gc~Hfm{gJTd03-a zRm*6r*zVKYlPLH3KxKP5^G?PYp}I&-4X=Lh9LgTOe|V&HkYz8rfqoxRN7>T0F9Clc zRiPzmsXA@%E3{F?3A>{iEh(c~wTXWlJ84z_v`8-&kBiKTl%2#ty+h8Q+GZ^x5_TO8 z>wd#g#^bPU(6Yb@cM}3%Ar*ICt~V63jiAqm%T&B(lvGWFxxD-)Y@y=>eN8G@`4!*CD?;W+66sCmqaHV1_Ckl}i2BoWNLoV!eTI zf1F9XsI7&g`UGuV#2x+Qw2q}jJ6y;eVp*?cDblFLe971rAdxNzx#BELIL-vX*C*|( z(oUndb%UwXYrXHL)>}B5UCyzpLJ*@`+*qE!V@+u>6)dNK>(B#f=_;o38sf`AF7T3^ z;nr*vc@Jyu0Wx756Kr_bJdS~#jYUtnU8 z3t+|TFb*EzT8S!K5u{ri(K)?1a12Nn1E#-b3)|ZNs=V>=WlS2Yc_=aDygd#byMD3` zz-N8^1mRzfb$ z$)(!rRcm8xyTn-#>orc`O?XL>E*9V!wG_hSxQH^L!ayLO2-$10Hm{jymVr}lfJEvBBe^lbA*ALJb=@e+_b*vUF>?J7`Y>rXtGXpkzwGJVG}k*ef6XUmy;s`~4YJwFpGHMKvQcGRL_&Xk1O(?`6O9~~+01X5 z6kGKW->ma+$)4h0C!6{x+V)mfCZor{m~DJpm_XyxuKc{g4_Cj8_$bawe+GdyBfh1G zJ*=`d96gBY#^pX@WSoK?*(8zoCQn-N?{YV2zJ5-B!^1}pr@z?;e~>jfVW?cLB1lX= z^w?LAUAS-(55id&dvqgJ)h zlV1376S0F6>X(~*#4Gs(-*JXi2qEM}vEvqlsGv<^fB_q75Sjp zdV9eJPhXIDIEy8&!Q&$|H2%O5h^#qF0sy@d~Fj zkJI~?lvoEN1y*9u?Gcx}SO-7_@-UmdY?lF92Oxi+JSFI8xl_%s7PP|#7shwOcx*w0 zcggPjkVHQNV#J(bGQi@>kEERhhY8J^$nLXL^4@%aC7HY1di$@u4kuR}-q9#k<~760din zICz(O#@Aq4ZzbB81m9u4Z7IL??ifh^t-susmt9K))+CZS!J{$JyBg5~9oLy8KB~0H zuUYL-t5-tvcb7dy6#v<}ia;`cjz?*jc?M8BRH-R1maGday#q;-e_lVp|9G1q&q06V zi+{^Mz4;V6SNt-cdU+nhE!>~E5b5B=)q93235^?AR4%cUAU1kVa9mBz(-;SCsZ2z6_!uf9SA*rxhELEN)6Ib>qw z#u(;J7Gx`H*+e_uU(@ZrEnf}>aAjQc5BwbWZ#DcvH_C*Vn{q!HUk$cVL02ggp^tV} zYW1s^FJHE)0(D}nc~0R6<)k(A1V~j=6kl4xj=-1RJG;89H}JA%d}xM70rmhR27@7ki5vXh|dllNkTrMa^(sB?EJl-xyi{ z^|HV~8mj#&2YLsmrekfu67QKfszaeVIWW(tKYvkW*QJVc27`i;t?0^oi19vwx}V0N zE}^>Gf!9X(fsj50%<*ZewE=%Fl~FQ?B8NLWi0ooc2+lq?SWLXrg+~#r;(hP`c%q4W z{}=v*oD*FM{IpNusd1VU!k(~Ap!Vp4m(DPR)NmRrqIO_0fvv=Cd4ZNpzSn>$DHE~W z0FEmMz?$sgNVAHTs}S)5H{{RfK0)#7?;8dLa2fE@Y4={%xNE4Oce#Hw@umivd5CDS z?Mt;nOO83|+kT-+1^7%~p}0rM>omd&lZ%tr`&(dwoh~Hv zaDL!rDrP^*5wllKEEaI@t=K`r?7(}IV&z`(*RhO;+#esh-?G>lo~NyhWo?B+1o2Xs zq0Tz0=i;-mvyWsZXYYS-{p3EvEl8sQ+?^uI2{9s|%Pq968I`QA7Hl|Kq@*jO$$Amj zhTu2YXLSL#+jM!n>lF96B5O3?AM2~^WrnfCI>V@eMcO(m$1*=Vy1JC$*%IceyY)?B z4r-Z_4a`j|w?6ET06?2Gwka7YuFF7HF@$u(je6^r>0VEnlf-A#LPcBqnaU3k( z+CE3@G&e|j>ma)&prdrLh@&L@52L~`{c4+_&}2Y;N)XUu^@wBU{6897PHclz)=;eW zZfVpY^HHZenVJ2{TLf_)vY&{0nNNF9%o7{%I^Z(k;+L;py!@B{T?ZWl9c(t2A6^G4 ze{P)&56NsP^wxdwursvM&;Rt*7j3?V`PB3!Xv{|;nO+J4-w**g$b*iBil^h{hQ@5* zLc?fR&m5?~*msekahLN!^yf}YiE_4r!x1*nGrH3Pa#Y(lrK1*7n-OFTzw>TplE*}A z@dWzi26oSz`INwYZnn7Af5+ZZ2*ncif1MO1mxHXGD{&4}BDSsDRIYEgYh~ zLRCi|*f2ztQWOJS;x_okfU@VkHl${TOWQkPmZjOGliW{zw+bz-Ezt9$2o}XxH7?v{!uW zocu8vQGEH3>L}~iS{*_-F$PuSf48Luw~pJaG;t>!?e*@XN}J7t(PQ=VMyo9^4eO!C zX5n2vFvrd8nl^sTl$SPUEspPj0oxt#j)vC6gY1*=pz;?m113mLBfjlRET%TLbbinGbIMcS9DEk*@Br*)%4B(>!&W z2-*(fZ_0e-@6IrBoi<|dAq|$N&2KSr!JhLMWiso5KdQM3eTxZOpA-3NaANfVFx7Pb zG`7ped|j?LfK3$#*)oJWe@>j7*`9jCnfXY|#w3Q~u_7u(6k$AhDqK&GGU12U)Rs z=;d$4@LbUK#@yyz3;wUeX}PR7r@8q6tE&Aq777lCVv+$$Ebhw0au2$`^kV`amnBxiFaNCTm)zWx(3`VC_ z3+PpgcHp$K>J#X_4uVGA3Y+9ziwnc{2qdnHv4i`<`kgE4UU^sOol+5r9V+kU_2Vb? z{Yia)Qs1A{_wP-8e{7DZl!({oPi7&!z;Vq8UWUYYpjVChJ#rmLvSBi37YV_g!0f z)$DG2udv~>e=G()l2bnkU0lMZn9Xj@2m3OZucHL`HnHa&`ZO?2o2Dp{Vb`|2VVWq- zSF#qPyxAr=UpaJRGB9?Vpv+wyo)+!MABJ;o>R`<+KF&cR%hc~VXd9%8a4oCIb_5{S z{HsBh_!bsIr84a`Ek|mDM5BVVjW}$spAD5LpB(76e=FncGHi|1C=z5mFV{jx;){eS zseUn|x>3+JFbRoFF815FoQI-cH$EA^(+3~KdgXm_0P4e6{)#XDf!%C00o$thEOHo9 z8!^_J6lo^Sm`sR)Ftig0TApO#GW@tfv53f|VmCpDhL2fQK=J>3wkIC^eTKvJccA?D zd3g8tf3TSS9YW*(9!Jx^=Si^H-}`_5{%rrrKM>NS(HzD;w`jl@Ysg?%q29cvo;bA)HUlEETqc*wib` zugdr&V8bk=BGeI7*-ca?)pM{yUo>idvwTnL74IjTS>cRZjSa&|Gqa+qdZedcVI9>io2@wpk;sHmlCl-%&47U+>tEuOj?D)BNkx* z%U~IYIFqT+F_y%@@2phI2d%GR*igS(0Zm0HrAa-lO=$%LTt<@eCrSQ$p zCwHqL2G1Qfo$6On9p$;V690+eAFCjn--CIGHSRKDuv*RcDEoQ09pWsWF3IC}e^Z_= ziV@uepZ!{0)h(ha&2AS|l-#AUkW?HPX-@N=eHUd#$zbF6E6B-&Usr;q5MLb9$XwOh zlENjLrw(xw@8~Xw;;IONSSlZq=%ZD?7vV@lpl`+gMlG#3%6{5!*r`{R$Gf73YhL5pom zuyq{uH{w5Rn&ARZbMzUAmjPe1@)lGY6AI|WvCz@tR1-kCqG(;N*~1`6-@JJK{C|0W zAo4eoRx6z#hPfs5O>i61Eh_sdk|KrDQmD0PKWOI#tR~Glv%7sjJD-S&)I3Rwb@7mv zIPFnJy>-e-wG^!c1TS1Re<-rYb?1lzH z%<30kseX8zGu-d!Z1p=l@BFrBkKfhd;D3O*{y)T2{?{^5hgyq{^V}m@QISHV9S+jz z`yXMp{!eqI!Jhbg(#4M>&-M!Wk^0F+D?i#$jaJQ%Bhl{l^RFuBf0j!6(MI|AtEqS0 zWE(|&AWs8%+Z`mD!S=d*bOU~^ONn3eCg8VlyFaqy``7g~{~jE zWF0&J>>UOrXX#xu0q2)CXa^$-7ne=gg?8-l-7S}6Xa_8RUc7AVxGJ2q)`{CCG*F|U zdx|g_*Dm?-PMbypwq4uSQ4AIhRgzR;9IM%>2~aZB)1Eh=MKZ9h12e0 ztFFj3u2-r@F1IYWCsSF}s(0Z+L!2xUVT0cZs!OQu0>_LfA+_jcErB0;l(voM{Il1-%ztx)+zj zX$LTW4#1qAtyC8UV2MnlggOC=b;C?O@OUj8h|kvIbZ{&Fg2Mt0tEr)BiP%o2lqv_9 z_l4RL!L}Pb(qA?E0u`THP4edH8PKN86j$Hv1O!-~a%5-xTZf;=IL+IFF@0zTpeOJTMw19ip& z(+pP#{GeX9fvm6QXf+`r*11eZXP*9gD#trZQCG0WpEM@6!#X+(bJ=^+tb**+$AxIkMy(Q_gHT|uVG_B!1vM+8TAVlw(@Tj?6VO3`JGKZAl;2_lAU_vsIeKD+nu}ZxpRm>``B0ADdu50p z@b}@*&_zY6MucCr91*9}w&8hf%-7u?7>S2nVlC=JeB4^eU4l%>dXo3Srk0dmKRwx< zNi-rm-(Q?)yDqHCyY0edi^)lY#AzVZs;g|o5Z~Zg~e$)bgrq*lbNZ^WH z*f~r~Gj#YD{kFN57A>D+xWGa?vks&Vn4fjrI)}yT`EKgk(`_MaSi>_bEel5*sd?2p z3x%ef5A%wW(X2L5@3yElN^b!_b|#!D!bU4Jk;l?rcvRVg<2i_dm`P0z%?co6801us zx21PR(-%f>gX}({ zik@Fzz803o4A6^suLe6nSaE4qR42ubuo1oEI@_YFF%3<}QI9ELogL`28lodKO6<0b zt|k=_S~O8He3N>5-cisu+D!gnS(5kaxQj?Jv#0Xmbr+R#?ndQ*ZB&Har2H5z`EBW) z9>44Cq1n1au9hjILoL~Z@kz{+U2K9(OWOoD6{1f7fS?CDOvr%_DAbMlvyPUT#5-k# z6LVAB1jR}NaG98!T@Xh>-fiJL0)kMF&>PBaG-ck@Qyw*u`)G9$3m}JeB+X?9&1EOG zmQICmBDkqoi!nZbgxc$5Ito34P(eD-&jGtTP|v`zHd`|GW*&-$1gvFs$9}X-ASE@J zrgtFA%jcherTZ7wbFB}V~b@xl(LMRj@r7cKU-13FyOVtjvp>HWo+=YnBN#dF!8b}CLR z`onw^&Z0#$)6a67D(G}#6OYpjg{{GEJx1KPN^u32bigEdFYIbLWo09by$M6(k-}~g zVf%5$%FP@V*lD2|HF>laL!Qaw^8W&gs!ckvd6aMB;Gwc;igY6vu#EpTVo86C9Isy= zYVEmQO7HG}^B`L1_O5dk$j{i@$*r^6k&7dwTpyfVOJKQ;ub{Q~JD483&`i{eGVHzu z%Wf6qy4O!ZmFu41W3kx83_M<85sbZ}v+zL3oKH5D8Z}VQdcjPY^irBjh#s3#yvg^8k*(6)wzoBlF03N)_3L~PxsL2C| z5S&c(!!{8(kAY?gGL6wJ2m>;26RFH?`U1c2KeSf9w~;IH4Y(ZSZ(>5yMyo2spgxCj z#IB{IY0aF0NlbSHpvKv05OrMy#upU$wCe{-KvVXidf)&ml>H*Hxc2%?G zG&+EPb}+|Q<%U0M&RiAh{T)UTl za9%_-XNu-Vu41fJxUHOhNAz4OnG_NP;+WUl9>2N7C3JB$!M}w`1sBp- zzJqhN#0*{pQC5A%s|qV)W+1&7hzE|uVarIGr}Bne_MN&bz7GL4Ya;mSEVB^qRMDv&$ux6<0fbhVN zTc_vSuF>)9is;_G^b|yYPjlr+h}X%;5Z#mnNy^z&b#H-qK1u9sK$C8hkYT%jbsKFO zDedUmLAC9`X+;`T13F41U_fUtfcML}6Kdp#ps!r}qM!KaE@3q}&><40#kor~^1~2Z zu3gekyr)Zyav6ms{P{VmIaD3oUF&F;$^Js^yGrkc4p^3Pkb%|0>;I{qM+6#D)wU2P zm9!KaF4%)1mO=?yz~&d?6htb2w#;47zmHyXsh*DaGw=Q$cG=B*f-B1Ck0mlx_qc5x)_ZU+M-2q*5Co3F(r;de$=z2`S zXIP+(B+T)&%;n?&bd1`Op+2h!PO-fyP1!R@fD?x~OW~`06(vj&W@4~&oU^s@hOw^C zT$*VppqOEsyv;>d$PZivf@b7h{V}Bw$Sf@iur~KlkSIT>B^Zj{g5@ah{)`;HA`+a#^$L zFFd$5FDOZt+5|5Ont1SmBE)RvOWuPOZCKb;oZP$@&ppka=ympgy?AbK5Y(A`Y0u=# z(M&#jZqG%$YtM$}-6iz@Msk!k&G7ZhKryg%9oiW;UGqa|6mZf2ev;kvfa|w176;N$ zYzpzir`hrtv*ith8Z>5$!^D7Cg`ui~On%@szKm zcLq2-oO~#i7+vfJV0A!`qIZoU!rCu*N8MzrCh8-pMiGzf0L?#X+5s+Z26a0wXK6F= zv!E9GPpK*H^Ov}a93A7((vq2fWdy(IJtR0uDUvZM-O8dHCAJR%XcJ@%Xn>r z>#IhrVSKA06lO;l2_D;EaXoa8k~Dc(Lx6=c2+;?BfOl^Mv4c0bhk%ce6!F6$PTak>7a#UT zpXNm^*L1yE0BY7s2)XZ)9YT^5KR*y6ISf8zIvh>`l0Zk!V%de5N=g>SMHKLfIEZo% z>IJ*crdO;4L23>n=)OT^`LCid3$odYcLtSAt}PE*w(eslNn?#!qUF0T-*={k`kP6A zpWizR-?xAiN|inh2d0IkFx% zHjwxpogJI|QL+WswA9QVH@@Q2?KB5FVSq?~I zU11f9Fau^B{U#(GmJ!2m!z#0uBS5LNM;y%_TEkJIbYR9!W3DnZJmFZ5A6~+wdndt& zvTzdzSPu_L{nO7vNFSrof^J}cXcNa{pLv$EJs-O8c03|Fk~Zd558+RN$N#E<$J>XJ zy2TiOngG@l;I|y>j(GABVZ*H(*H4Z7??GlNZ`>9-l0VrcbmS$Gs)62WS?vJv%7`@0 zng)YF%^HNOBA0TQTT5*Od#L8>oM7PP^fTa>9a&)hfE9gs(~)={hvCM5x&iWSS0)8Q znOgEF>@i#`7QaB1Bg<~0cO4nb!9&nN-a9Rx<^b04;FU=n-2!L<<)IaX2LVoqAoHdr z29M&ljVWaSCLR?fTgT#UDA7wUi-}p{FL3RW``|W&>(N8Rp6rzUJ%EH@St@vdtC_)Z zz9U}=qewJrlQQ`cQaz%7M9yB3>^7Y5N}dDAb!7;LFat*}*n9-QkT+~^;Or`{l2A*g zTam?z2($4V088-fF7#=52gX1KzMV3;P11XFR`IWP=@4*=$O)NQ@f%PKq=RFO;7aWOlFi$s8dciWz39-7e z;GTO7uoHg<=1F?3YpxgF+zpQit$SXlWf&`+tj#ngpr2AdxZk~sDSLwv$E==Zd(+O~?)^)MXdb$m;z}nR5vlA79 zb~m^Z0FgN1Zq;JtluKE`eD!oB-4{hW zEs!Itq}Wh(sbM4O@-_3=GCO>G+azLf7paw0>9Om774Xi$d)lDeSJ}wnXtI;i*AUJ~ z)beVBC*|o@JA-Nuun8**6mVBfY7gB?9xQ@&L`WAVQKVy4=-@3D2|Yaru)~b8VdWWPU%Yz$`s=S=9esWB`qfuoeD>w5 zS1;;+JM;`L8f$LWXwxGg0Pr-pzI@pr3GZ3W@(ZD>gfjoN8=fIsyOy(v!%b(R)@?t( zx`6luu?w~8+DvwhtQeV2!5t%Bxr+b=4Lmm3b8(v9s*7-~PyYDj;ma2<4qv?ZSxSuB07S9P39b=H`scZvbf2nSzDL~`zaR9XGudl||$2w-C3i#A3_UxvR4}Z)B zH?}Kk^hT?_<3S}H!%-=DjW3fUNeHvJO;oU!ONUnsbv45BhK9+t%Z@1IlzTzg9~*JxhlsY>M)qBI1B{x9_^peuI7M3}9z9Kg+7?r_ z*J}rE60w=)P({60YVAdLE(T?oT>dN;hj0Hrhzg$^2u3fd$Gc$%uA6Rd>gjHndD8W8@(aK9b-7T}1z06+jh8egA{a|+6%1b`n-L!|g zdtGyW{D$*Wy(FpqmP9p4M{h~+`ER%-L9x?ceM@rfGPN_bemJ}{xQ)K(k|7Tgj+fm9 z@+H3O<%9Rfl?E}o{dtw0yOV0KLhVcskTm^w63*t;5~KGp>>~OO&DIr-d<26 z(Bs}WdqlZ^?Kn)+G{yjbn;9*iKstb0rKe{)b@)CMW^iYT9~sV2zsqZ(?SA=KbqXzd z@xL>n2n@3DlT%Cw)VMkyn98EfVxie(rqx_(>=dnVgu1)g@AUEgWH=FW2X{Yej3Qmn z0y~GlP-Kf}S*Z*V3N-+EkKv!MzIy)E^Cut_`v5|IgTk5EY{7JYye9|xmYRh>mm!eD zZ&RogL~*ewo#qsI_O~=nZ=>MZe^6;<^ta`I27k)`o@g z6g19$lcC!SWbBb7O^v7iPRcm0#qmmcTeej(X!Up6#!2p{Bmj<->aiW@^<$yH<0uKd zV@!#x6>ow`_+vN=z2N($3o-kLY`m$L-hl@qf4+x$X`t@HxmF5K&an!8sBnl_(G`~9 z8?7~+McJfahaw(p6sN6~M~U0ycIpfdvH=G;Rz}S^i@Rdm%MlPs9QX}&Z~e{*Z!6q- z5X_guB0Y@ZwgF44VH-rJW)WrEb=gQo5f7S2YKZNxH(BBAU?K7GrnZ3oCe9TTxY_Xj zfAig6e#516tSalS!eCQF>8Y&<@sPs}R4rb+oZaA~HDz1Kt`E6`xNxYnqI#M{1%$fW z5{{Cnu#ESWT?};=dda6y&~bD>JCS$lY$wXjJ?=!kz1!QG4#O! z+DF@TkPgHj69Rs!kUi)&mM2N`(omR?t$R?vs~qjonok^mnONlM>9W{Q^UAc|MbwTY z)-(;J>G)J8Ae_U2ad?KyF!pJgKdAHwMYSST8(#6QwTiT)X{#Kiyjox#F*xvwf8aJu zhWN1A=rAvD!*JsTXe4o9bUS5u&&T&1?6B`D;xPXafW?*xy>Gh+j;jMc*87s+ z3hejb4&KRmjbl<|G#*Y=W+%2Z;^ZBjpNiw@93e{vyZ6IJR!Nc_9VJlIe|tumETjdD zv`5Mg5YH^*Ea8qT53NUBH~Hw(q1&TwTZ{`cNkXlqMeD?ayQM#_@~4s(oF5*g-(l`U zTV5XKH?(I%*%XD5yasN+cmD60d<>Up6Lj0HiLGBV^)WEIi3bBU}blQ7&^cVl);x8P5Z?z6x%W$$f2Cd_-oH6KWF%fHhkfIv z$OS8i!KTu_baJ~v_#w&wRJJK5-X8@ybTorCK7y2Y`7ciTSz&I7`Q6@Zdcl{`FIHx9 zaG&%{>5SfRST0w9a;aUzwURA9jyI*-^|G*_E%T6A_np2r4g4&$-KNe7QkE&5x00fV zzU^M6fhpH*e+W|JEezxv<1ik?dX8pPWDhyyeH`d*yD23!ucnXtsAl-871j5P1#eR} zgj4zUIE)Ik%Gww>n`;fy==o_Cy~kwxsTE+wDzpvF_`7@~jGA!EV-TFSa&Zt+-koRp z{1(qa;_x2MN@ReMBekQEWR9UId5&AgEA8*bp^2mMe{`>+)j{g+5*h8{D5c5VeVEc- z>OM}fQ1U&bC}M+ceJ$TaT#WHRKmgXy!J+WF5j38=1m@8}MnQJVL`1zk z-4VsJU=z%u;$h;7b^Im^!>ySv1Q7?GAIQ$xjwcvPt~?o)bC7EbdS{()Z%JcaIaSl! zA@mkQfAn^+9DvT?O86E62)A1V*tc+X5hdQc)h~uJM|2C(XY1834hQ-^ax}+n>ER6T zBZsrsmKwJ8UA;!HWxT)Zl%zrk+ODfR zI@_$pfgW;zcd)|h6z$fU>A^vGM*ApswO*wbf2&q`jUxQVWf9AR-#co{mMX!d_Fkn@ zT+(jYB%kL09Qx)+WduEn(h;Nn4cPSKw9gVgb=@{A&NP9?FvdAKQumE+G7X$-n{`z< znl+BEE9c`<*b3{~9Y7Td0*`!FE?Z;w?Mek3D%I%_b{{44^gbVT2s3WaWrj-q4oWhp ze;=sUR%fSoNChK}ejjDJCOp9d{JgeOR;0Bo%4s*`&+Wc>%aR@UJU(#{L&wW zZg^!!{x+bGH%!Y&Ok}UMHaQg*(uLrW_!H@RuT(i2}i zv0886LomX;8+`+Ve--AIx6+jP(oM`MH|AKwh=IfxGu=NKNTJe($H6XMCq=dsqZkNT z%yn~hsqb*&4==20tw>+mr0HjK+0>6V5H(E+z%m`TVggqM27{pbz=y{^eB~4-0Eu78 z>_P00#XZ!Y43j)ugUNvUuS4foKt%X4L=w2BE^SuA*vf?UfAUL$0k+28DIez!Q54$E zvCyIEy_i9@nwm1l8W9opK5W2LsCxIa$rqD9?Hh6^LbeG)m{VQlEueWR-%5o%0n(eR zb5+G(#>yBc*x)0gl=~GChaQmv$w9UoP21$9cTqBix^qou9k8l4WD4rJijbmYBEw-- zt|`gL*C@Hpe<*Vx5j%+|*3clryIYK6B}G~m;3dJ+hzfSWUPwZUxtdn>os^0b=a;-$ z?pmYej|`iv+AR^=C9t{NY#P;|2%2{^{!~a^38Wekjp^IJy?E@9@KCrwjxm)VJqg@on|Xqr%KJ@2z^Y|Oyf<7^tbdn zgxQmq_KgQ82fO9&YN70ymn4n{F9IAumsO4jDFNq~e~t$*f3@Zw{x9i<@mSSriiiLh zTQ*vMZWtJy)ucYq#Syxjn=A_mbEgu4-sx*{QUCHWn(Gz$aN=)LxGoSYF`zJeToX8? zIy$u6Cut?X>reqSCq*htJCNJA2-iZD2LQb--o-l03$D9Wn-(CA+tSe5q=FS$qKI2E zE+zH^JHfIie~)CRLG}fBYiT1Rf23ANU9KIx!mH2(t7A8d+wX}DGY3a3?bq0{=1sox zqxN}X!vt@vG{0brZ?-LE{=e0~|55kaYK*~~`HxYq+y5pS|JXtFbc;Nlp466i`>_3_ zlr5RVs(0KhCaqTo+k8S-5)`mvUXRdi#XtZ_UCh1~e|OKmG#5%Kdzgm7E}~`u@i`90 zdFafcWIwmgOCN{#+V54Rc|4=K$^|xOn)JZxggN(kF6~-^I0~kCghf=myC_SOHR3-d zT8U*{v4CwMEDLcsf?`XXqRhg%9j38!dz`F?N5mlDH z`0#GuqpCiFJC`hw2P1!O%G`S7p47_EbYeQv+29cB$?S|{kS*H}vq#fBjZ3IPrCo2c zx|dw55;Xlxv{E%)jRW@!?4wi^jU(ZjEc^K|5nmDMMR#m#k;LukWrHt0ah?zn!pjwd zBSa^K9nFc6Ox>mhpKS)Gg~4Q-X;Ej{&u7H6Fj~|;Eetl@)8c=$HkEluWPvSRp`jgx zNH=^)L&a!-#AnemN`$G%GU|ow;L4xW;KHnLR=p;E7d+8JKvl^+vXIIQ4><5WK+4P^ zTVL43vIgqSUk(NN`#@N{bNCCwG(O1K1|_QaW6mK#cxvP{-BkcBL+g`*J;b9mJIO%0 z8)}RnZEjHXBu#%9@rNB8-1R+msIoAKeJZbK7DZf0x&33_Dl^huG*nlKOI!j|Z z4akGOzL=ocZju&NbOUyJf)#lpENoh?)%@vcgyPv++fjemQcsIb2HMYS*1|FU)X~zx z?H#x6sK~>3F|oMNMi_R$$X!&BkXWCX|CJy??6U>VWSD(BSzfe>e-{TGw`qOFNX3_ay_lTr3-`jNa_DN58Ut!aOtz** z%WR?@DMFRTBy6!GhlP(Z_P$E{R`&+g3Z>-PexO9P$JPTLW*2u15_w zvPlM`&IakMx?81bIW*mU)D<;V_Xd_R#>|dZceQ^V*;4DlhOvs4E5;J!fa&I$g}hW^ zPsDq`biDyv3fDEcX67MW^5ycbNbWp<4pK1aYYw|HZK!LZ)xeI368cWdHI-jZ+EB=_ z=Q)_ur(jO>aJ>Hxo}9>{otI>=sDB@m#XtG7>1Cj^+GDR}9!SfwwBfOh=4~fNt_3VpVU7Fnn?EuKHc<;&}=a4pwp;-3n`1%yNH^ z2iMQTAe*iJ14R2Xfb;Q?vY&%5W{mG?zKfloEDfXt7aj~hz;qhXf%W27gC%C@UO@~a z7$*gUE7XPz6fH#4Ko`S`1t$zN%zXc9l|_r<@Z$W~{Hl7hvY41_W5C3lwH>1nr<{&V zpFGFvY)JB4xy+=hr>i2G_+?(=5UGCy7)58V6^S$>>vWTa>OhwT_Y_-4l%j+t0ZeYL zF}@1p&7zFyB$1`1m?`-xO@V?LYn1Y?EB8qhV8R0Q?~u5vT6V}QZM8XWl(KpHg2ko| z?2a(ZFd%AIGFG6RN&!dM@$Ppo)}FT)Y&J0#b`rnF!2?`s3B#XN<5U<8V(ot^x{9n& zJ#dB)i(RxZkVsJ7Gf2Cb9h^eL&0(yh-?TkVq)=**Hbul()~3dV__y_B5XMJdW}M?v zLH>6*ng(pA>PonV(;?gDou!4o%Tfg!PGV^ECod0SizUlqb%19hY249olK$yAXeB6P zNgfY#4{l&(Yx=@y(+~99SrnIK|?gL<&=)J=V2Dr+m z`TY6kwRI}rv&*RgwG)2a#9{@?4TtswbNK^VT=2H(LO~RB@dPlpXTpC3ZTeNkZ--1=vPci- zVJr+kB21w=WrDa4M#6tW^{y)$%_ENnIgE}Lu~nTs8z$MISx387d?hTsmKcDAe*W-YsHu4bT9(aVjT1)_N9fPa5klSuX&g#)$DRn@T$ zxe&Yq1A-!`x#l5~pB%y_>8LEUxj9cmI(-YJ4;5dNQPz9x z!VpI1yc$}0?N>R-(Qet4GL%X@T{mUH;2K+LUXua<(-_D{&#T$5FYr4|;BLvwvz{XAdWCJpP#J^Z6P&_vL!1)sqO{E82f5It zWgcNLw%FM)?vpPtP0K-jW7`Ku)tsbj3y9I_n3M9kE$#RCR}jOkOCVTQ}3{6TyDZ)2S)=rICmA<0A2 z7G}T)o$W!3(&TUhA*(qyXYU2Z5$V6Y-0#{vU4o)z!!}~3W>N8Q;5~;K{U_5b&gImxNw^F_4 zkQA$WMrzK^UXiwkeUC`_A(SL9#1b>Z%jECQ1R)5nB`Mftc^<>*1FRJ+?H-x?Dg5ft zR7FkqPc(>%hg~%FKwv!T_on=-H>6(y&f`_^<4k{S1w!j)!ES0zGcoV(^Jkw~x(<4- zL6g+i9E{S{}h z7UF+JYjwr3A9UfH7h=t=VUc+dKBLl#a=bLIx zsMietBsC|{DbrEzFO&N9GJJ2{wgmE?S<9n-Ll*N0ypPKg&JyeZC1fHw&+5t0_B{z# zHOo-*qe~B3-DNsW=PJ&SI)5+VKOmART1S8E>3;dem+!uYgD!o)KdEOb!f*ZA51OSi zoY@6)_W1j^eA`F|YHj!_u~;e;yPLhA`Y%AbWziR&opxz{A=m1GoO$I8V!|n2&dZ^@ zgIvyNDsu;^!knjf&eD3j6@(W_sE7dX`StB!0OZ&>$Z&D1^T*y{~oo90${T}>3QXZ4|O6Ix^P6SZZTw`tAEzo=dDbJr05Iqv?l&^A~B}t@&a} zdwsl$>zNZmAD3%{gQ~-m(e6h6#4LZEmorpi?ej&@aL5&I2y_0Ok^%zgK9Z{(=;bvw z8_`6c-?a8WZ-OO4bx5F#fbV@N42kk}R%sc}LDgbhxmXzAe>l1L>$8);oE(3+I-v+b z1Xq;g*q$%4D7*``0h`OR#wtFL?i!+;`m^2~O|n6&VBL`pSMzh}JpT6t3Xf~OTMr2^*?$Q|GX=;Sh3L0w zn6q`KItBWJnQhq}EnG;;bg^(!HU@otkn=#89>HQki=Dh~3Mxb?y94q}0IvgYQ6_l1 zfN6Zea+!roSWG~%z9F*@&sKlPAX^HhJClp=`pKIQXUA8k@6WEEP@>?`H{V>Gd~L^mSdM@l)Rg?zu5jD+_=7lNIsFiuhzj z?9hr3OUv)DB<$9vT$3t>f(4ZJ!KY>VX_zA%KIz zj~C>Dp0n>$%V(hD4|m%qU%@9|!6#qAcwd43Zk3wmU>?Yf3yIBwhEkO$bY>ZGyQBIF=akdtyP(aG8}!pbC?!KCL|as?!Z66B`*LV_HK!y9(}5IaI;P^IA^f zXlPZNe!LgYA0fY)XTjANRe~hPbI=fw@nH@MQZ>Tlf15NELQu&3^8n)Ha zFsR`Lr^<8zBgw>J2No$d2|{j!afhoE@Yqxud&@F` z3wr)0cj-#~_}SNu^2bLqXKX|epW`AJHg$M^8Zv)!BzQ`{qok3m-SS!$;o2J~TYpVK zfT>?q#O!=E+uVJ=i*VW3-yWaeeO`->b;zr|s-X`bfH@~5O;zC=D0-+$23#j}RzDy= znyN{H=Xb<&QTXesy4`i6QkV3A*j!a93UmU&b;6DTBhb1M(_vL=1v03PjVDf)8xWm# zN@h(w6~=v{&fvjJY!Z3Iu&LKc7K-C|5O<4jFc7ZDsL54xZ&%aeWFVhw5Tx9emtnuya@Ky4yA^k~14O9ItytwkcPPjm0x(XkS1 zj{p>k`*go;{;Y%9mnWeIA%7iz*OfHKgW+1xRh|DfbkN*`L6^omtW^Bx2Ea!eIbrHq zJtWhq0%<)Dca?7PYVN9oIZlj~*u|DB!y&k_zkrdJ?kdRU_n_TsNS##rMizP6I{}R) z{&jGjUS!Mk3V8h0P1LTHA7F zadqGY>|9m3R|PVQbTkmC79=NlAd^RY0Il3c)F^3`U-9-p^w+1C$M1hQx!6Zz0US5i zNnKmX*Qqib2wg<85`SPmG(|TJJ*m;#F@;dm`~13v?rLg#*p~02IYdh9il2P4D`B+6 zd~vEQoepiT^4zRcXw{c;7-<2k9bU;vmq_d(lO~$bym>hl3(bU_k)J#CNw+X-S(K0> zy=$vW?u=3*kIOgno*vA=EzwdU5iDb0E*0wugxTP2t%nSb(L06FM19&FeO>v=9+ zYIHlTuNVX`&}dD(AMkywjS&oQDfQ16O*7$~pAWI3?)`Ip_3@70cw9j}>3_TwW-dbb<*AtDCEleYJ<|3p z!!(3-o!8+1vD2@%2^0k80?l#kTZC0SPQ|PS1ToQZ z9}-B3&ws_p~p6HHsZ&zew9PUq|mmRfPW8)wy(p*lLfY*laDBnHbQ@$h8pm zD6~$@d>lF0U#x(QCI7u>@Amb3mQE^?&*dSc$I+2Lcz$o;nBaAIJ@!Ul3yE zprdN)lzK{)DwFIY)3(9GgNYrYtWY06^?54IwlQz&GE;dx2turGYT1wyO-YSI1C9aw zaCY=v1;&tQ@iA!iu*+Gr=BRJ8QPf_a9KSt1JE_dT^g2|rYN(%TE`ODd@VVMm19|Fu-TvA;(&tZZdClRU`^NhT;9 z01Deh7Sjk1NLeV1GKq#L3{H+HMY+}P$+Btoe5-g&D@}a$>2^Yz7A2KJ%8i1x8-KyH z3<)DId#G9zKTN!f?&iq@?Lbq6ppgrx*w6%#@>C_4^JtFe+8PA23{&l#2ly0fk_Nl( zW2}Qz>txW70iqlr^kWUjnS!_5q@1n78CS5P(n>oJ6r)`6G8BrzcwfADX#x|2b%K!~ zG8w&9wnCi3U|*g4ZMT?1claR&`F~N!%jS>*ba+AUg;#H1?|YjV>S!b(#afA_5XO_H ze*xb8w-=}ru7!F_C(|ICEYmnhmXkDFPN3``T+P&eqG&OdRw7HhssLRd*bB%v4%%%T=hL$;&XoPI<$SNODlI3x`rvUVe8r|^!Z#j1)`YJZ{eC8V zCDX4s;Wehe@`TqocTf1M#(_`s^Hrq^%)W=|BBshrtORfogbUcYBY!>06)rikAmhaQ zFMxvP8$*aDtjs8ECx64Uk4Sb;r%6%7_LB+dvwyb=dgJO29^Ic)c`e-N!5K_n)GBmU zw>5H%Y894vFuEm1yR%Eg6Butssxk-kdHrI(m`FscA#7*8cni3gU{YP498XMo^VHUo zJNZ~Z@v$nhii7J>!A2Nje|_}&hm(s-lUew&@H31p=t0L#v!}WD;q|$<2_E7!m{XCA zy(l5mb-&Ssa=z)fzWb?u=`nD$PU;0MM2A&}YB2hCm;a~-6&xe6);Icgh#LXd_O1c- zwp4KPex&PbLdqiex{a4GsRtbo4=M*FhwRmW^GLBaUA`-qT&V{l58SM>faiz4X9?Z= zMr_mbmyM|hJqKp%o#@oliHc(|s29Ab&?1D9;72UrZ3@F!=~)~gbF z>1KwP(5eR`47CoP&lg5|bU~U$OPBwu2P%JgD-J;P*Co`nr9Y{_4gGx#u9YyOf4~`m z-;RUnagoJL<>JG!n6j~a?-ELN^PlAm@&f1|P|XegqMY}#Sc$38K9cSL7XR~m!n^92 zh-g)YVr``lLIueygB%NDg<_ZEcv_lnZQrgVO0%wQv#dn$3TH15L+?g*qG{IMXlj2` zQQq&G$F4&sFaC^lb5r4{)wtKzMO6H>Ln0*XJ7%VvtG7ynK(|Co4GlSW>5a$c#ckU; zGh8FREh9VB+MpT5uhzOP8K#>+h%XOvqytn8hN@Vj>25p#n%Y0_>=U5=yAw`zpp$fW z(-Pe63~r{Mb6M{8!~oeB{JDL?jaYxlkdDw*l9(H*pKW|UiI6Q8h z&30p6T}7$vpE8-ZYz4I{2I#ygw7p+dJH(0>uw#OMoU3cApzL*oxG$Ziq}YG$<%!$9 zT;zcK_0_xM1}J-SL<{8b!}j{+=bU0Om(9ru-i+O2D&Dnk9q?lD`t*s^|ahQnxmWa$05EL)rYjDs_(>yA`tHA5F zYx2uCo%TiT92(qf#VVyLzDDnP?oB2Tmjqhl`bnIX-VBZ({OiEZAl~#l@wmD+NV<`f zd0?R1o{EF}6ufO1y8CpXH;91WfQRhAWvxodZ^0Unc}tX|C!ao7SHzzx0qu6WDSLK|-fz3;{yujsKTJh(B<(su~AIi)7%g>n91!2ORe>&Sh!_#4bKp{Y5x%hQh&&F%4P5#c1n?|uj#-wfBrTqlPlev`XXN&vPX?6$yyTbe zTaaOsW9Eo_rfNm?ZvIv*FGI}9flDx0Xi3U}tOOxz%zlo3YIuK7Wc-u76zn%RnTKt( zgdt(kbI^`*24I8YTZPn4KbKKh44mii9hXSlU$9NIg9SU|`g|Nre>d2baPN0$F8gb~cxSd%d&*^cKwS&{?pmlv)F9e)y?WCsfbfy}OYb-jA^ zs^0N4TmhAsVGH+H?2|g~kyOnSs&VD?P<7R&QZh{%EBPR6+ErByyao^;HYv5*rAnow zZAw~@4EvOr^envDi+Ku2oxX4Int{Dts0HAM)OjLgpz?et=L437Oie6ZZeRwYgjmH( zFgK8YI#+wXFn^uUXXwZ=!{wbx@2}Yl0u2Nvmee`VFr)~KlElvp&1aG%rPDCVg!vrS z$bomITPHhW6grotk}{@DHqv5SK+BlNtT|6Dq#DnXguPwy-Lu#91?3vKj6&!@T6#Nz z6C5@;l~nu4A_3{Y*#A~swx17PsAVh>wL%3{%#dtjk$+{lWL66|LH^Q6poBUc%vE*X>2jRnsI2uNE(-=r1+r7fik9e}t?WidcyRNpC zEAE0*D}P@I0$GLJ7ZPWIbPDl@Tq8UFo`3!zR<6O(;Xfyr7kVkt=~ca@7RD0cCSu6f z7?~0GF^0sz9){<{h>Yk$Hw_X@a7&KS>m9tb1zYhan!t_bvXU=%iIFhVes9d4D~h%( z-TMwZ^RoAyI3~pP82(ztkdN;>p`s?DYlLU;U4M}Vn_`vO$^tpOInN1Vau%kzR-I*` zr52y2ihloqWhV$Xf)CIv{OV^7efHI~#pNLMfCZ?Ps8_cCQppdAK}w45uyW{D`_(WF z@2k^L4#FjNfHfsR6}iRD^(F17hjC3{39TdqdRiBlJTa2c-r?yARH6@vC{Y5RF(S`c zWq*6w1EVF7`9x$crT$;2MuT$Hggo;;2I;O6X-H(-@(9AtHIz!*GH^MbUY(84|1P0K zc8GOuTmV&8Tm7ysdnV5kJ5dcbIR({$QDWj0mqj3B;h8p!y{FdxRiF%m)bl%^C zlbqB}fS$TkgN!8Wxi}n~6%v)~-vW*0(|;;~TvHe&zOG(BWL<)s?e4`OwP{FPP+RL)9sZb=k+A9Ol&?_r@Ua_t_!$M zEgisBX-?j9*F#R`=5dDw#_lqL75=Kgz@3j2E788G=pvie>A2HJB-#gwSF27pw|^r2 z70coQH+8#kP(_qzfHt&XNEdqv^1t{n>D?ZEf7p9+q(4wnFB|e=O8oO^MD`NRb)1Sd zXrYV+roQxVk9sGUAIF!UE>2A_^I&OZ{%)qAYtfYjL+RqQ^1JwH4!04pn^cQ)p~~5> z|Lif+-5lwsWVjww-S*2&2MpsBT7PhPanidQpY$FTqyiO{H=YrJq)+8iNADZNrb(uA zlnwPQkgY`$+-7+t{B=sdH&THGiXb2fQE1|@w2VNYzf0r$a*kOr_3dIulmW91TojK+ zmXB$K9*5!eN;X$`wATF~%;JV^irp|@fsZUi3@)P-*f**Y7k|sScE6C8 zl1Is*aYI$w{Gl=AQ%(?tn&E4NH0U9*wwMl4O+}x{*b5FXtXOf4SdN+=FsFNW0qa%z zV3_0@J5q}J*v#9{Bq>4Ui6n%PK94rbJt?ZZ#&=Lku)Cej>>)-}0 z9l(`TA;t@76l!S6PYq!w&wtLYt}d_Owx<8%09e0(uFdG@ojX1Ms{mD9zyQBF(P zmdj2ROc#+1uNO-5y^t>PUNo^QAha)*r@1J*MqmT_#s*o`YQk`WZS9K&dw8}iVVV5C zAFGLa+mm%UfDIO6=tj* zaYiAgud*_z5B=m$sN5?f5Y^J@{Nh85T=!3gB!fw|uQ6Tsmre(I3O`ADpRPu9mcvW_ z)LcK+RY)-it%sJJRZmfd^#oiLYSB3xdL+ZvoA4JkSnl-Ko7q7 zrbGsckpHtn%m+bK5`U^-h5{iQH?)n=F{ThNIf0jN68PPj8lw@??kOx}H1W-q&y!X>n_M0!D=Q7@VRb6N|4R94exa~309qo z14t;{zME>C$G7wr{|$Hhh8h_>X4lIOHtc+pw4Vep3D-*jlYh3aG%%@GB!WrUM>3d1 ztBAq|Q6DKWfpZAao+`&}5&bssIdc`MnnM?f`JKF_Q|NOX7$R(++<6-Z{%27Jd4e_o z2L$h{rE@zQ@TaN#k76*S`Yl-ud-fP6!=BZ%nWE{(Xo_Mjt0|(s z%%;fN?4~ICFr1=hvz(&l!*oc^Vml<{!FVSOfY!u&43PFH_LH=~B?rp>J%$Off7=E& zGzt50q8xT3Gn%A*`Oze9v!qGahbv8*He;GJeRxySM1R{#6VcK~AF47bg-y^WS%sv9 zzVqeiCP~ita&v%1Zt==tm{Ma|v;ikg?&emd?MuR7}D8Eyuik3B#syGsewqbi_)B7XK3PnvK6 zQAdcNTVzj}zk5K}YT6BxK!hJX6{B%IK_`GuAR~udH=X=#;5(T@e5CB`Yah)(R(~G& zoXi$w1NW|hcnvaM=cG!3ag&7)`<58cJ)qkzF-kS!jyzVffP7}3jEpQ++f^Pfw)=Qz zzebm=w+9$Hr{_KFJZ4W)_zvW6Zjjos3w(jj++f}7NxR;lcL~qicX7ehMyEy&MQJIK zFsO9^n}w74+?={7zm1pvw+A49y_=_S2~CSsbPrFq;EdX0lTu~eJEZGa&j!Tmt$W2N zBe#p5DPz|p`vG`CWP33i*XNT*86L|UXc36H)pAG*o0eVnS?5~3fBov6oX>J%(!!x#$uATc4i2AS&m2hYA-@F~>r@7R05lv5A>6x&l7$LS<5Ke|XY|}kpa22S8wIAS9iISR9p5ER zqRW%XxWQXGn-`l}tR5dw^EL((CwT>~Rj4Yfh!Ka^>s?Ay74C8hT|p0yqGkm>dGIPo zLwMJPBmfehu+l%#3F&J{XL&l$9|$o{(6(6!DY~}*2}6vf|B;D*J7;bU9jTZbFlWZ~ zKnFe6fnWMx5Cz#JTqcZ#xpj-J9m|EB7@8n$xKy-+B8~b+t{yjgq5C^ zMK(#(mlWtv(;yOTPC!y*%RJbu9(vEuPEKAxbeZ^nfQNR`Qw>^t*wihm=G!Ta zA{Qh}z%5#>3kjnA!08g;UJ{C{`W7&VWckX{$PZIZ=!r8VCgp{=sK)7*H9{duMvT2G zq42O?sZ3>MA>EF+sa94rnoqG}G3A=hFC^qyrV`Kvp~5m|=RpUs1PT7L)%gZhCXwUh zE_i@M4{*SL0^XcXm+@GaGnCtwI;P0RY;l1^1}Etp6LIa(q8(JLPP9{R*RBS$$C=OEQP? zL{f7PGapFiK*%jWRzsUL&oUj4G9GQ#0fox5El31SQY0~f)Gda+ z59^|H@j`yN?^wER(h&qB3QSA16!e{88eqGB1KS?%;xx&Yz2zU+>T1%59;)8_` z_C;L8A*AaJZ4u|$vc?e60Lt>;AI}@Im6Ks3yJ0|0Y>XRX`;!VXL&yaU=boupZosL3 z5Sr3j-2vsISGwFg9*=s@KVmw@Ol)9T;Ir830cMj)BeA_-*lmNFrc(BZ&CZX*SVLxi zEQwOY2Zzrx_2Z1|Oz+nT1&Gclji3eCN@^8j<-mJ~IOHJ1JIzjlQw?+3HIJm3E_Mm+ zHNjc{g1*W!?9FDEZ!&QR8ra*cM5$;&t)qTXEG5&ga;m^k3VD+NbZiSg!@)8YO~5%V zT3*|CUhHMbjGc)+cqcBu5eLvVL}ti;9x8(v_o2GLV0o2RQb-}?#-wVZkwH*G>{v6w zoEVIH4{)M5dD0pz^AbX}AwfqXBQ-K1KB^lP`q91M<`~oOBwQP^FPT5vm`(OG zRs8HFT>xXTOl=d|TPE2}kcj<6i5W{tAMuJK|6R!ZTRC(d@&?>O3~WzL8lQ=Oi17#5 z>%~fDi^QvuK^Th!xk`hEIDv|yH5UGvbz);ow!1`^np_G=7aY9X$}!5@O?h>{K=w8= zAjpMd<10nah!1R4sbxk+(!4}n1Q_4wDV>dFa zafYZj-c257c+D-Hixu}6F%L7OKy4sx7;)H}VX5KlCI59Wqa1BTCfa#_DNd1j0Pmw( z+!|ETXC@^&;0hAtNv!?fFdvoF3~Ejl>`FT>Xv<=>g1wUyOdyniR7mNS7y;&+mhXYa z5R@py!$SeLhOXuDFg}s0$_K zV_PhiS@7B=RSgF`t(8+0h0=R0K2 zV|-nLd$>clA&a#r{b@UQT8~p>7j&0}i-|)q5b936ri-3e9?x5UDmab|iZWw-4E~wr zo>d^DRd_v3P>*~M;y09zl z35F3l@uDa#rXvbMw~jcS&==Vn#OjBf;_bT?s0*~ubr!o!LXVM&(oVfq36#4_^1~M# zFiuM`4jg2d!N;B_!8jLsO|~n1bwgRtv2c7V#=DHboZ?X0m8*SNn#;OPCzp+#x)AQ> z4ujeSZfC83C^*iNc>drp{+|}kO3F`|q_?ZoRTLBs#Bc`%u1!zy67e2xgx4JS)Lxz< zSDaRr%Q|<3%)i~`_=u<5mD6b`tDwSr;&O|XHC!iMI*YlNbW}>AeALZt6F^mPRnxHW zhg~{%l0sNoT>W=RET_xn}juJMi5V~kW`w1#|}j%8hLfmGC8Z8pj~kCIP=A3srOuX_#W7A9z7_n1fLwb#X+ zmOjc+>tZqK(*Nw&C_PJ}+rU{+UPBUub-WeVV3yw9o6m``>nL3hi!WLJYvHIy(VMqh zu>-eCVux=6T z#g^o0jN|Wxe*A}U8^BBjUqNt7t7%$R+NYP(!Ur`0w3i9P2QzhX?kn)(C4-*aZ>_eaTjZ-s@Ew$T5?6a$ zZl%c{rkywsJh1XCL9R0Zw?zR77nPv-o&5;z5Z(!_Q(z;Ds{RAmPMr5ku5Oh zpMqy`*MmdnGRq%Imq^419DnS?BcnIx$1((wwi^*YP3MFc+|gJoYFa3?n01ioRPn)f zo5wdhaQKF!B8~3Yr^?!cV_E-+QxJ-JbLn^3)r)bBlick3>eJ+UdOEr~ zJGmZRUWmUY$M4V2PQhiw{x-UJ4|qIvpDsUL(>FqWwLiZfslSiUXMZ&law-S%2m27U z%+dAV$7j>i%P$w_XP?i`^(5f$pT>2+ejHtwCWJ_woYl>MyjHmm-j<+SeDxnZO^(u* zdYqG!;eljh5=!@{Z{rW7g;EjCcVOo<56kD1(di4@El*qovN;8jXx~W51EYoIZ42JU zfMcB8k{}fnX=@Q=6@RKosGP$<(bo+40RKUokG-zwCm7RAdKyWMF{4YkR`mHqU~jQ7 zF6Q8xYj#Zc3goZoQ}MC~h5(QPcrYwcHqD8T3(^BQ28I2BIYzdc0%Ou2_Fwl8hW*3W zN5iATSMLsf=pVd#J$ySH9t>aghllTmhd&%0zIoRlzIrvZ*MEATr~e7t`NFtIVWzm& zMXU6|HlhzZdM^Lv~|SMp>>^jvcsksY3szil`d>Ok&TTWxgAA>OdFp!{I-gNmvBUN^OtHY%S4}V|Mwa)~V25L+BHKlLq7Ipo> zk6`6qZPBfK_a@I*?RwhgP1=t#-JhG-uX6eIBQCFc7FGGPCoxoW+ozzU3j2|-QD3Y^ zYDzq!i3Z_Z`sPR0IBzYYHQ5No4apRXJJG4yN#J^Nlc9R&%h`tnAi zi-1C2bVt8Y*->aE4}7L$B*%I_Oxd7*9k}N$7{{9k(w2++lHK00f%t~2cw|So+NJ1l zT+_UGah7;7WkpsK z6?a;3gH)=l?&z?-4+Rr+1H{ZAWKcKFhi@TOJxR=N`c-|~TOjAu@F|29$;W->Z5n74 zN-V;z+yLOJr4;|Vy2hfO{O#*k=Krr>>0R*f;Op1!O+9*zMvtOHA8Lc4_xPP9_g~a?<6ylQh%Kz+x48(V@<9xn~Z=v-OMj$V%k8*!?J||-0XVG2G63#< zOqp-EgFwknRic9B2#&1s5OiD=(fTHNxUka7*Yw@@!KH+|%FBrsiFFhphlx)yr(uNoQ74BvDNz*C6Mq+< zKb$VXQ8t6GjeO;|Cgbz*k5|VR*XEe@laymVAOoq+pnMxFA$-P3#5PVIk9`VbfBYO8 zI#!e}CA7I)y5`#Y>Xk=Y+*qDf7R8v4*Ms3;`1b9a!@=;?tGCadlIxkAxiRrh)Y!+G zttwM-lS`cv z4-fwmTLJDdI)}_u&(4%dl}ZXNN(gWq$UlVU^_Rc=j4XopEPq=TgC9%l z@GEOQ`1&>At_(KCuyL#sTcd~qp^{90r|~&SZeR;HCbOgkiwMXlfk|BG&4FhQwx7FX zFt1hobfL*iJ>`azWYpN8ttsf5cfWiJsu4f%5*N8||E3J|VWTecImlyMzWJUxvi}{Z z_N6PfnA9jJD3@8p&XF4JUVlvuKVN8UbT&r*v9A^rX%bCb5=7Zd6sU)c1l+Vcb4WuW zQqge<6=Df#ZCv)YlGAfmdXYz~vkHBj^)krv5*YX=;6<3`Lj7K25}eRTK&XaG(@+-P$oLE8sX%Tv5uS@*~QMT=%UQBwwLCjq_mm;<_2-Cuo zlk^QbmX}xZC4%`Ne68pa>)*vb=7Je% Q5dY_Y0e>sz<2ctg01{NRQvd(} diff --git a/detection_rules/etc/beats_schemas/v8.10.3.json.gz b/detection_rules/etc/beats_schemas/v8.10.3.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..5ae373a27f0a6fb7dd1622c0b6e7b35025590ae7 GIT binary patch literal 510685 zcmaHyQ;aT5@aD(1ZQHhO+qTcl8QW)U+kVHkZQHi@`|r(OY<80;^{aH!=}NjUs;jyQ zqoIH(b*aojey@C^UA80=_v(nyFfFZvi^*gP$#1VE=DcItNjG_vab`!>fC~aI9N^}G zVnCz-oF}`CtW_|MY&2C_jTSSnSgNrT)tVX_Jv5L0H{j}MX|Tx2uRZrar#mdNB+61B zo4XM#O1&eI|2`NK#2(0|II`&Y*Bwyao*jQ(8Btj14!UBR(EQq7S!5@P6iUiA{=iJY z)&_GyV?^E^EWsuYp{|n9ce`Z4{&{fqz8zb9lT7Fd6!sF<#<(w}0X8aqFQMx8I#03P z-@og2Cpst0E2gUA`Z%ILSP1S_>>}iJ){YvR+;eqCl@%@@wyz&Y1umZ`M7a~ivAZ*T zMdRb>4?JXyrjr%>xAQrgFp4u`GizLZ74D1xYk=0jGMSniLN2Gdpem1X*NW-&hr&EY zm()R4xmftXT)ZpDSH}Vzjw_Yz3-uQMOEvyHg5u%+TNkm^3G^|lF^g?H2#TVCt`T02 zS{{&F{lG`-WD#JG8X{;w@MqOos84gZw}Wc19S08OF^+DU~V zhH82utdtGdzOp#x8{h37_!Q)qF#tW#+QENt-ozD4N$DU>CdxczZfL(ZQga}&4+C7h z?Iqt7ua!U%EjjRJ)ee@!!4c;Bld!j0hic6ui?*SAJj%-LP(a8rt!{V3+Wm4E885A^ zSe^}x-4hOp03ePAL8bepA95`1GsUzY#7Yo)K&y>dJ@zC7C-G&>7^4gThBzR;2982- zc(!J|f@aDs_UyVDm%KJ8AGf0Hbwe-?g4(>+5Z5@~)@V~Cm6wqCMD{3@KX&c(iJQWO zUO~S&P`9-2gfn0505}mjLBf7}I-H;FH0YuqeYwyED%Y27K)UBT5+-~Xdy*Du^Ug^1 z6PU=rByCDm`eq3NSJHOk_rlc%(z|kYf**HL(c}5pHw+B!Y;&yTy0%^Nr>srNW&KPq z*noT=Fv^G&b2wLE-OD~N3i`c|3f_s#7DoBq!jugOki<>#kXH}D6ARbVh4iROtLa0x zv4AEEVCa76Kc802!+A7(zfu^W2TJTDt%J~Wod~ycOuCAsD|U3^k~tGC@7xG+hE0Rd zs>B)F%v7T;C})eYDx7JMu0>>SL9}M#W%Di^Q?0D9%;ew99}h2lszGItuMWhMzC(+v zB7JnT6vZiLN({g?xnbAQuv2}JKMU+fe98awe{e8CG7>F`3rt4rJ*K)1ri0onIySJQ zho;Y8qKOkQB9{q(jG0+geQeN7k>Y0t$vfhDTq+9MR*cN_ufGVTjbq;WC zzU|1?SP~5UO51@CU9zR5xl;KTR6iBfPRj{3SS=$wScRdpFE-6sen*w!TwZ!vPH()K zo7)_pDfZY-OJ5QHmyvwD5m8IOVIqoN0hlb1k7@$Gy5mZ2n2qNj2M2LdOw5~pLa2yL z*gW(pmWFts1wGa-`ojhl1DJx3Y#*(pf=2gwt9$2hJaCG zRSK1um}R(~>*J&P2pU+Qvrk~MHdfM}8|q!QzoJNpBZ%;xVP9E1a8*TI3nHQvN_PSxsIE#6i%GcCTePG_b-x*+%v3 zT(8p+EqY-gnFzSdS#~yPUE4Nk>v9zE@=KzMAtSe??4}N(DRq^VRU8Kaoha9W;hxV% znEN?FJqYIqqrT>4$ztfQo%TSe`y-{3a-{bJZpvcTcswrg%G6PWI9+5%kT&FzTbDXt zmTCJ!x=P`~R?sJl+d{R@K#Bt={9;=1s1Y<8_%LGaX(S$Uzl&yR(Lq#B8=sU?H-^AszB!Gw0f4IbAjnyt}vt{%SyqBBYuR4P1DILT*L4tlglH1>Z5q&i65RNBEr~Trs z*yElXyyrN_Sh3a#vTgt$HqTg-b-o-zEtgj#bEx+O`QS#7R#qUwJD*gv@@mt$k-7!P z)$k9BJe5$TF9R|;d7cy2 zuWb)bQfK_boZ|RHlys2xI)Z`lxa69jadM-4;}=@! zCeWi$W(nnvA?|tzrnooNqZ5Ao4lB-WFDA_&qm2Y+P}7~FF+L+7`dpk|N2${F11Vq) zV_aP}1&Pj2R+Vmdb0+TiGJyL`tcdP=pq#d&ItOW59hltZR~6*}FWI$JzP>7`Wd00G zmYYpDv?L3cJox%*laQqOTRr{=Gu+vUrL`LV9<4as zUolyJc4 zF2TL=d3s;l-o)c}I0Xd-S8IfeYae|tP|i+owhzrZLdteh(}hjz0*~S;rCyaro0{VF z{kr+Ms6{~byc5B(9?jBhCTQ#IB#t55KKP2}|AHV)ee;visI(u#3^CNr`9thFR!#J#tDBm zS?5)r3kUV5%IwoUGD5Xaml%TOv$Yg;Q3qa68M}$J&B3kkvgRi(P_-UGwtV!si2}0n zBj(6}&|1LP3-v7Vi{Di`n3-ARY4+tk*lv1=DD}l&_7YH+OexD%Da$Fd-E}P+m#QZX zESQA=_~hCVcq++OfLErwhC?Q1!L|H_M2w)AEpl+k6z-J+jF3$w*~1no7hC^=v*4h@ zL6p>J1jDV8R`VNxhECxX9j2s-+8Tw1tcwOLx!05YaX*QIQ0nbO`19?is1(6Q*zt2o z99pKdkA~MFG4FEe3Yw$485en?8)Q`*_ex$3I@CZ#2(l6>M*b<;`ow1oO3Gb~(Hiu{ zqdTr(BZf=B0-4}-#TO({yP*wqN5^0v2NsM*R>+LlO7v#L(;}XnBCW>9`@p}^Q^1mti zSF8$^_yAp_R&Y2iA4-x(7T~p;=h9hB*p{1YR`G{Ij*#Z>F#RL1^1Z~S6Se>fsgav{ zFY;R7uk7`M4P&@dJgMxmKB5(+y=ibY7&QhT*C+Mp^xl~1?YD<*NiLYsvqOO%gvTg+ zx5M*tT)qLe2&7AZ@VFyd&G30g(zuZ@yTyOW&eZ^F zRhYQWmN*5qt8yRbASWD2ze`lp${Nt+44T18xBHvAmJvRey3^KdRjgCvM=l33mw4=; z&ORWVvrRn&v?Pyvnc?(TIV-bz(`{s)DYK8Dv8&tgXwRcZQCVuK;QlDF%n{BleZ^1k zeA1d-)fVs>Wesb`d(vkky-djE0A_*U!Lapz4tT6bZI@hC#okm*rQP^VYC@t3@@fW< zIn9{WR*F-OMGP6{M{ZgpU3bibu!O@-ky9$rfP=d;K$|0$JAo3L%Px7HA3z|OM8Beb zh2m**gBhgJMQ5}GLC*{O$K-bU=dGdh3_ZBM80tQigILv<*J><6g(hxo zX6s&n3%*9&E!ZIhjfq#*G;>QZV4Mr^L&BS{KC<2urPMUWL=w_-D#87 zV4(>6DG$_}dT$XPh@bUV8o4bm@5ZVG`+Tc6IL&7(JYi9v$|FA!(E4N_hnE{fK^ONF zJVNJlE@^Lw76HFaeZ874BRjND3VT`Y^&RYsS$}9~Oh+R?ejCB`%m^4AlVapYSo375 z_S)w$SE?41zJD{|a9p6y;92@>7pogVjMvPf7hm4^)Cqcc3l23}@GQWo_|i$tz|Cnh zqc=}MuC#fdV7?NQ=*A_48BWB0o<0^g1l!wW07HDA;3st7xRH@)wy&P|H079@7Uu#O zJVu$UA3(JanV3mfNsC{ORAscFsz<+dHdW2UzzAa6M_5~1nWMgH(Q+#C?Px=?=fZ18 zGWFRofUp9UY_}VtC=?`QopqfKX)Y9*fOSEHb0rYFaZOhiH9yM|AGJjI44X~}ua)?F z;FY10HD*3+-!K)*nku0TILTM7|;fYPX2`Gant{X|fAnc;xrJ zyz|+qDj%cjL$92NJ+<3P@JOq_*^3@n#AFX&>A#0%Jhh^*Zj2Q-Q-JJgQFjgB-jbq5 z5{%E9C^OR;Fw=Ctb7<*v+cOB?xBnA6t>)dUA^eTx(LmpcP+@p!sK@tJJe(CyH_hYp zS3o~J+x}}U(Ylf)$N_)8i(xw=EZn7r7`25^;|)A)lk@@U%$o)-lv387kLF3P0p^&$fBpB5u_IER$Y^mn z_0+_#NPcDVnb3W|ki@LK>p9%Msif1fi?>QRaI1i}3+$?deuFMX3#q8%Nz=$imLVWH znc@+2=n`GiYe25kDMCihsz}+G%4rPZj^t^z?=|eJK4z%6!`Lc43?rY@rIDMmIPW)V zP%Uc8O;YE$mdw~w8%>_9_glVI$9ROYn`ga(*KZya%E!Ys zTtDzftdEjnmfN*eml9-hiqvJMtO`wCn4@_=U>a);@&$OdHZe3NCXS!I$WWByLeH(Y z7uoq$X&Y;^3S*G9B}rVI4xbAn17B#oleXn~hmcPM;S!;<+bCf3V`OatXr|UX(q8u#gkeq+sPVRFlNXQwmM*5?Mg<9h=ahqFm&)5mj&5p>WLcE)wx8nFTab z+)bjY(`Ti_P?;t|c4U#f!z1f2c711f_klf-u0JC7%etK~OhTzo{cp|#-bi6@Wn&(w z06W9S@n~$ET0kFHqb!fy%x+wIOM?d}GhE2-Aa2pWXYK(Q$-PbjO07Pm88 zyCfz_&OdtJA=szXr+fxO0ygZle;?l86Q?{sb7VMXYoo>J#FvMxy#~&Jp8MnmoXE?% zOVgQDM)$&LKMvtDa=Sk3c6Ln2 zIIo~PPHv045H~h_L#svds|TWnM&kE#gK6!ak(l>J+<x6 z%bk8nO+5aRkCWP>rzN_-4fW}?9Yq*7-nf{0=OF9J$I80Jw3(UpYvt$``1*xYH>{Nm{RBa`?2-}kfmgQt1b`-Ar)Nk#)c z%>9S=#l^Z|16}S>w%Z8hhYI~lGKX+7i&&N1tKvg|21%m1dn*!K;oCw+s%jYX_ zYK7W}mr19D+9=|v;16-l?|+h&z056q6g+zVPu2r(q9(rsWG}6F1xxxs-&3t)gq6d+ zxi<60q`yNG;Pu37v)5rBm|6?vF!y9|Y4L`9y4g7pj0(Me$O6!Wy-=y~fmMRO_bpI@ zSuoB@JHBz42FP}?V{!r|&8Zp8eJJKu)I1KIFHlSPaK4vcuS}p@fuUA>IY&9kg>ilk zKD`*aaKqdyK|Z0<%_@OChl*GRc{xikBfY*n>#CCH)wdYe^jRl|`ZkHhQpKwkiS!aB0f4ft(2%=G@Us3_k{u`D@rI5XbhkHcP zwz<<=>v!&upYcD2PXnKPn3+8Sh#nc=3-W0#GdwG#@P3*Q#T$)KpcLSx$G_dbH_wC+ z#e#5BzZ($6o^`)W1mDJdIFwO>aFYI5aX(CW-@n#ejVWpHRd1Ti2rb`}d7~SyR2G*O z=M~+{o)#zL!v*$y{%f{B=-2E{2t9JT^8QA@avqsKYyOtF@?|bHXH*|d3)1AjY53>K zrG(~xA@MY&2G5r0)gQS~j%=6n-5(Ed#X3kXfL>bKLKj0dm5;=kyQ|9?6Ed8h9d~no z-=EJ9-k#RAPeIDD{l4*dp=*cE2g1Vuj4*IFl(Tso`(a^vTeAfJ+gS<4FyP;ebw%YL z^ar^|=S)w{Z#dH;zxuxUx_9_;shN0b_jL09a09?vxyA=N#|a@76~ez7&#J(<4G^IW zoo&*Aw;UL^XvI-x4~l5joZPx<8ok6IX^a2^S95T&OL)2ffg#!h5I2}P|1s&>5gP+` zhkAdW?JSyGTQ8f+nlvm(a}))$F1jOac2%E1&I^Ck1dCL(@db7tsdH{c1+#E=#CRP_ z2+xtv_97`(Ak=kq^B+-)zWfZcs};Hw5rwCG(#>eUektPx`MDn44pLrl`I2;D)!OMw zo!gLdWFU(``3syvWGGOPM~SK z{UuommlgT%8D!L%-IFv+{)|IE@wd%3w0PcMj1{j5kZ1?}2%Fe>`UR;3zrWO-3Z|PZ zb?}O94YoI3x%n)AymMV))X>Vd$mtkHi7huZZU^eIFAf41S7i`*X-efaDH2)A(xgth z04bY5o^*pp<+Qz`(R%FfXtu3|X3?AQH5=X!jsda0z5WBEV7jG8Y;Kfzek_-x&Bez^ z)sSAO!9~#CB6ujXg5>0F6Pn*Sy4LkH@;zMHQB$YJx$G z$Piq2{UaH(E1+|Ciu* zW!iu75!t=|cP_EhNvbz+Xcbn8 zcI$TjPQc?J{&Aa3v@&SIXpPKgu@KQfL|uBO+IVsO$ohL_ZK!0==~m84{SiG%6U!M{ zl7&h_aH^cgvd*)6O*C#4Nbafg-o->A!Qfsjyq@i>YnROSe0lg*`b;?c~ zW9XehZ`TvcpCG}fQ$cO-!!(8Nu8inxhp|ZB7RVBGAG-69^&kZ28XG-cMS}q5$ws(D zF>%!N>@6IRAEX-6guA#>h5bTVlf9tehI7OAF}C~INWqV!7BDlV#MX*vn>0&XJjs@IFmXZq z5WM@r_=++o_WHWw&~zzB<5OFOcZ_KBCEA1>p>1H8KUiIHVP)lbtO zO8tkz@Id9$gQAJZ-WiT`WrX5S7TkXjUk>sg;u7F4lQAw+kR3(_c`GX<4L!?0#q1P~ zzyNlNTge=o3#k(1rE@e*BKb?Qpzly{I6ubU_Gu^qWcwLCc3pJ>d5#suDI+X2w0t*z zVn7C9@0G|Q+B$Tz??Bjbk3&9b(%7b2W|K}I(zT%fV81PrUwLyDYHDPrlIU}F zl8Ar%6EtV1Iiaxx`{S)whD*no2hJ*jWblf>J)><1c_8W)OtS@)IDgCP*G|lFzbxn% zZdlHe(<@$)#D2qR+S$ruO-S8&*Vc+G6XLZDrl*;dt} zZw)i<#tADh>m1r{p7WVzBCO^3$G3-}6hfDm=BfiQ@O(0DefIyS7R`pGr<0I^d?X%(~}8x?YLrjo@kN za-DAf23$aD*1pcAwz#QBSW^2)@oBaDqbgq5_crMif6~>x`$&|d(8ddS1HV1uK6DJa zzLQUsJ=SHTtYjB0lk+{Y^BP0DnIC&8%BI9N_u+MwqKHPiG-bMZd=-R-=ODFvjZ|Y`W)n0@##?{Gdg7|hIrXom6eps}565@T>T>g~| z!s2)fsho#Fwh@c&IuZds!7&%+xx1d(xx_Lml?h+)!k`vmKEXtuJeE+`d)*|VfBrJZ zFn?EhL?B}N&}L2XQaW$vbI>@Hz3zt<3{UhJ(<_6(^!q2o>5JUhr3edPcbA=)`s?8M z^>ze>(e!;ARbj+jMC{-RiX@Kj&wUxRSQWPzZ%8HJGb{qqFz$KE^20KIZsUMe;-1SzKtL)(Im);yI(JRw71R30k(U+$_zmO;Q zdAnY};i>zA{ynR&@hE`WzX9Lw756YcJNWiMF+Hf7cPmtpI$FZuDS9ulG%zmXN`lLp zw!f$5soE8d9RuPugDYoHpcsG46In`2OKCJ}n93caiEuu*7VD(nv0|v&5{whokJCw z()&7etU3BCdN??B){e#U-L%wPM!P{Qy^R2g32=j{cK_#PIu$GPL`BkrhT?2@fGH6evqD}=)HhYA9&5QLq*B`B?!?B$AH>dN%ur@N_&te z?vUy(DvwUH=7eE}YV1C&BHHNEpe%LyyBoDE=j5^PZEtJb@ZN6Fs+K%S*2(=;_)Rpy z8ITG`hIzZA_q9A|Kvx@+BX#9~$5K65z_gd%oZok0w&r4-dm^{i%!Ltt3!efSNh7OW zT9iHBshn1e*Hl&^Jgs=vGV+}AB)6`2xDRa8;q?lC?4qlYz&*wFxUrz54TM@wjv zY(IDEd0**ieNn>JYN7Z@5ueZ!2y`o3i4#ukXVke=89P+5QRTeb?_e6ft zxHK$?I;)*ZnSC@Gb*>t~&5`NSoW1zU1Na+HojeA}N?j5!5FXGi;T#U-Tb#k-R6UKX z5hH+u3Y#;CQ)8a)NnT@ZXK`rIIqx(xP=Bo`_FxLqpRReI7Cq+L`-cp z2UPXfMxz1Tq8@r1&Q>S+IhY%n)@j<VwRdc4gFdd{SD;b45^5Bt0X}FLH&V^}{rhe;Q*{$=ASK z7M?dDWryw0A?J5N|K^N9=vlTCo~|l>Ba8FSc!K7vgB*vpdEgYTj9??xZ#jn~7*ml) zV~@Kd7YUDQDu44c`!)Z;S!cxHpa3Cnf&aDCC?jU}Sa_MUHz%i6UG%aZGEb-#Qp`*{ z6W*5B6>QFnKpHr8Z1{qQeH5~`;uYhjSb6XW4llR zJawWH;Ia@-a)ER2ak~ziPTjokKy95ag%3D%;t@kD1Jg z8~a=enP!03^ZwC`_#-m_(D;bAhU<)w@ZTIUZ)mZF*|6P`zu{Q-Fzxl7>o96&sHK0e zu-@|iG67eD7?xQ(>_xt}v0v??qsOQNW3MC>V(P)set**xtTxLq&UYp|_+wm%c;GeZ zJ|9zahqdlmz^1xgw0lV=Rg+E}xL${7D_}JrdGFF!4R($Ic@MYdmy_B*0W;@4E>txx zeni=?fmY^+kqT0tD5i`{?FOfVZGklxm&5Z?YUlEG!qOGakQt8 zri~Q(#*n_5Cn2O!X3li_d(}#ymzG524)8KiRL8kxt+_Pe_T0I!+@1){CSSMVowT;Q zChpMpPZ`lMp-w<6Ee|@rUiybag$RIF>VsN3yRX?_@@_1!Gb1DKzMCqcxf;wAQ@i9@ zFd}O+vztashMUwIZQo$xgI``)mk1)J@EJ50g4d^hgQMY?``8WzB}>}Q=)(;|uZ3t} zr)mbC(E^f7(e78CiiQcw?Ec$eBbG3rk}-yzA8*Fm1SFgPm_;Q0C0u)YKhifNMe(HC zT6Rk1fn4q2{(m+>;z+G#pf8fwy|mZ z&)`G_7K#gX!J)l@9kF$5ASX}vts80}3hI!`IFSesIJx`ZyLqTM;uBtGTZXtPkI-1s zn6QZE_H*_E9|+Yx(4`EQs}l%5)(K1_hEZp|oN*`YR7#HSoc8|e`NlOz{6a+=J`eZ= zp9e&Q`yCq6?HM(ehtEo2;n9*1Rf=BK=9G6Qni)e7E$zSRHfWf?lCn1|HZMJ_B1c4Q zZknb!nku}^mJ((GVUEG0*4HD3WJ0TbYEFtLW6>Z-ZW|!DkNhCXRzfho?KGB~mEAaA z@TVIytV&jXx(MJ|733ATgBA4G%Bo^lT}Up6b-`xmmhDnC5!KrS!8zE|(Yaf^8-G!^ z26i@wYJ?99)22*qqIk56^9)l`lZND0`b-Z8EO@g4#K#A#FftK}CIim<=kC@{T6*1T$6a1+qZQ&q<$(4G zIl?WVJmu^(Fx=)4JhdTq3NoJP;emF}6PTC8W>p%T_HG z9JYKAlU@w05RS$>xZsz%yEVi$*(s(0QG*OaHgTg0pus59kSQjp#Td6iBSy4sswKlL z*O%o?Sah+2!6z8CFrcE;Ixje6tDDAqdfWIAI|I7~=0v@4uC(?tEt2BdYvIlPaWyqT zYgya-_%5L4e-`R*vLj6XZkgFaQxMgXV;u>gn??%@PeAe_A`i*$C5!I;HK0FFAO zu*t;bZAckr^N4tg!w2csU3hTfA?00UJ5_*8nvW}A`*`1ipQZ#l|xEQ0H(NAbwN z`QBh9dEjocC}$~_jZ4r>N41;2yF3z(3xO*O4j}JF!Y_Tr>EAJ_auw}~1?{48IO>~a zTHS~vBnpvHFp4zbv@jY4>Q&p(YSXxQ8R8CUhRlaz`#g~_>87VQF7|dd7POX=jbo%r zC-Uk>*Y&sDn3AS4FoYgsFkim5gsv{mwn2280-+M}7;N3IZnw%`!jT%K>$5qv)kR@t zI@_vud-L3@X8RLFw2iiGJ93iFd6B&Wca0f%5F2y9+%^$x(rz=p>i6&TaY3Z2=DYa5 z#U00iUg?mPsuZ>~?9kf~3JHF;dN3YnYEY5rYH&B~;CYz)Ybn?D4LQK~O;_keRd~`? z2?3t|eFk6&u&-?qRSFL$=i}ZN`bUjP@zrb&k=3 z@1xTS9aXiRQ+R8M%(&-0^yT8x)8L?0w%ZUemtey|U}$%X#I*q0^la?eSKYmaPvrx3 zoj#mWG&O1VR5rS{`Oba>CegC>=VfyP3hgoWJ~V7r1sndK!1>?4KcTLqL28neGaq~v zH3lkKD-%Uck-6{tIw6|fk}pNU%0w(v7V^Wmz?n3ZZHPcoQ<$s!wI=a{BN!T&@-giZ zE^^-GMXq%4m0%IIEKec2BWSJ0)x{8CM5X|HB~*~|?3EY%GZz>I5t_q6ARBZw+WrvcY`fHUcpz8Y%`G6gaT*$CK2LQP z+KrolIqRTcH}Z^2l@b<%5|T{FK{1oVC(adtWBtj7lbWr$M&SJCgm24+1YT5lYLRjg4_g?jaIJREWZ05%4D zvkF}Oa~(PqVLF&-gp}A|3jQtV@o>Qx@47TTm2LFy0aR&WvT*>30#-U)1Hd^60&o{h zL?oNM?agik5Qrm=NMSSwqf;2npNoXDi*v;krw%YTz6u{KXYLqxK9essNxrG<@)H9f z#=U#u!T-eyv7I`>9S$W<)KIBqq6IS*=}d5D`P5N?U&-NCkrYO#b zaYc5$f$%2pTxJlV222OY4tU=Q2+dYX$G#%Z)3y;!(L(QFmsSr6 zWqjAq1{^Eh-#ws2&1^FqyusPa>O44LKT3iuJU)H3^h@Rv$=-NwQma7a4*he8zZXyd z#XLp4{+IK|3eq(JUjbJz*E3aUWrhtYSiTugZ3Ri;#C(~-me3+sw9G4c@eFu(af-Ms zuGl$g3sY>o;R6>3=){hAF%-M^Pw{&H_{oJGrv=cJx<8pV^d+BUSRa0b4=X7qDgE=^ zrwb*gBYH+TX3f#Uy}U|))W6vdpKeNRh{$A}#efbV>=xvD9A*IGcuzoDn%d656b2xb zAdLfB4(XjHQS)ltJQkAA^XKHb$E0gIXI9LuHafuqCKmhkTq+rt?6AK3P zb;4KbF6}8;A+<%C*t#{q^hvykdlHwRw>afld8IOS3s)5U-yg`h2h6w!$?*3f@b~}O z7IhrTs7&7G;qQ*Ud#y$AY zV&fjfz~8gu9&qFSH!uFb71IAN%wn17!w>Dej9%IMe+?KLmBnN6*#0;0rTTJ`C*X{| zriz(w$sqKf>}a@rZx*IuA@eC2Lhg@*uNo zWOx4umWtKWLJ&vXgdsHz{KmG#itCMUssOs5WZ!lHe&2rm>M})zccLr$KNA%1WtL5o z?u#!XI+UWy)L&{7LeXFy!8~jn`etu4(JUXP&p?|o)a>cH11UIL=y6%;th)K!+M!og z@mJZ~?qEX`fpcL+WQomZhU5o^&b2Ztvwd{tgBP%EGnBYv>|fY5 z;SUGEi+f`hQ)u#RkQ=kKDQts10F1*Ai`lBE30anLlQORPP=6h)#N$518;0|jCrzhb zla6(Ht3S>o^mjh^WDlG!e>2bF^4$4x{PCkns0NO77YyEg)@l32dQpccI}|JF<7`wFIU2 z99hFvq5W*TV)Gomir+9#r{^c(nQGy%_l?q3;;IStk?mTXh!%bJleIUw#z$o>Q7X7KZvevgO8t~ybYCtmnn_YhkmM+Q3_mfZwN-aN4-2-k z?z;De6W+S8OYJ%Z@Pin}bk1DY79T`ZTW34lw}v_kE*uSir2ELaUKGv5S5{m87QH!e zUx?>xfrBu21rq&R`h42*nE3t~cHfj^xEQ1Ykee(c2)S&o$%E^dJ6|FFkzAVRA zo3;IL1Z?0yyoVzfV$owx;An%;CzJ>^eUBRg0yrD9fU^yw_y)6?<1Mi7&b<@ z+1WM1Pp?G99qVyWT;dz00kds=+$(A8mS;M$o&h2DQKZ$J!52f>74twewr5wQ00&nL z?q|6#0Qa`-9i6nCOp89k!gYE0)w4X6@m@0k|sD;SJ-z-mG}`R4;K= z|2UYW1=frUcLYmPJq`H{LB7Yj8|A<3Yvvc$*M_`nevde5SGZhj=sM*gTAHjl@_p*z z9`a!&?>(haumZ};P9jrP=TQ!Y1fMk@w|MD+*L3O|gN+#)9mba*J zBsLl>vK<#(Jwm0MG9)@v*+^!f-biR0bmCB@o-izwDb~mQ5nYbV{@g#Hk!2N<=o1xfDh~V3 zx^MLH!sEE!rEBxT8)=5h(JGx9D-Kob3L((HxNfp3n=TeIwukCcTCNE}v&5lDE;vqH zFm)7xM#V%an*w$|yRFN4E27<|E1rW3dP`g>i>&t

ypz{kE4U@3|F}&k4|E zP62RZ?!FADcB^6&2%!2nYtObCB9a4OwK|rog%?XvGlxQWmVkvLAJ;@>%7wS}XzGO( zwMXT(i!eCS=Moo3tW=hj=-S~pe)dR00J9mj-RWf1z%;HkBbot#qbLov1{z^=9iDI6g4x_ z??7bMq;J~rJs_D-0$tg6DR51*^3(z(@rlc69QP;Z;=lsTm_T?-*jA(B?0syV{U@o( zg&R;}$cW+fWYNrUxn5AoULWz|gj`veVhYzCVZPXq_}NN%8tHj8jr28yMVi@rv4;Da zX=4tI{$QZEsf7ZUv#qesI?UapfLhhb^wnzd$kjUh6~Jpk8Mrpyy9soKx5jq@P}hJ? zhq>LOX6WoHyoLa;P!8Y+e%lwhPJU*cWf0bidx2A~eE?w_VOy-&TuSt@9~^vu_K`de zyN^YJI0j&4K2s=cE5IzbY!4ps3H1rk>w|qgE`**A+z7wptmQnggFqZx=D(SVfA7G8 zKG_lsXMaFdu3)ev7@L3|cY)yTqwC$aKhr!JYs;=do=ohjLJFziRoj>@7 zS?i_8W=4C$o!aIv?4xao8@UkaPZi)S6|l52cqsGfSv?elbj@$@`gqLl zs-2lw{{Z&9V#WlT%7Be6-m3fYNT>DmT>;~KKG*a~-Y*4Q}Zi z8V9s#K86S0Je|A_beq836m8aU+afk)yxxwby2dh@K|TL+g5N;V~z%e(jfeJi^6`R~O* ztQ(X2_C7Z)1-Kc)WfE*7z?D^H`JX~Y#Yp}u4^51mx+zn2tJ9X8DnwM8b0y+%R4YyD zev;)Z!8y(&g3UV+uqO2_u~F5L_`28|6CDZ^1+yqs&lN##K+Y%6&yItnC4>>^02*pY zi5fOhTeQ%%sQ_E$E>^5SWd<${NM)J2Lk`U^(W$X2{KZ<4#pb8*VFWlP+hkS9Jy!`Z zUE{FSPPYD3aafCgP{XWg%RVprro#CcZ%+t2Fw4dsYAn;t_USsklw|k2Qe+VuX+yWl zi&vjUaN}px^dp414vTp3%b*ECPn*ej-Nbjeh!mdWfN4FE#atMxi0To9Vd^74M4XEk z?v%joB2v`phAY~~rV&Fh|E6U<1Iw%5MlPL5S~UquG71Ow-l9etbSe?A(HhaoGAFie zPNICAk;{}Racd(QZeww0hu_^isCU-7OeTa}Q0TXeTvL{A1Bq!9`iknu5 zgd^XTKYOCsT>hRQ5I8 zJ!z^?({%+(p}3ZA{FqUn*bOE_Nmu1)AKne$2^g@Ypr?RV&0KI_?YG;12kDxaRmRE3j@m%?oJj& zn=qZ!ohka7i48D+64^U&uZZ*@-K?r>D8RrU0N-K`6WNqcT)Ms4H3qdS45cZP{T=4^ z%O+Y)S{ihem*|@|$0ju{^(xFYsty{|khW->FvljoCR#aq)$(?<~ zc-4|C8b#mL;-A`)FO3M-=I967!EzQ_lOrz_q}Y_2TGS%%fK$#CYi$#qWUo{*P1yeh zFF?@064P?TvlzKriX1FNZkC}@C^;0H$ANj~Bq9PUu{yST>u#FsOrw;_$*zw$U)#ax}YTXVf+eYeY8)e%>oou0O8z|TIX>Idl+dA1cPPT26Ytv-gGTAmv2iqmv zX34cx*7g1@j3ebzm*KTyLe#piK##YCLkvt|lg})lY1R~zYu*nZ+v!z&ldO?GEKCy4 zR$F&#E#FG(WSw=e%5tr-JS!~E`f6`=#g>_XTi$ z0Jn6(cdBCQchZsz}W6-rgDFl}|OQCud} z>IYH2!QcMz%RlJ)-?O`#}8)B9Z!y$~CS|wwnb0 z`8NQrK)t6ga01|3is0{MkVt_Y!gW3MsUAzyJD{M?S{{rEsDSqNfgXa{MTKONjC3KA?&yS z0|H8`Bxz5PhA}cfea;No-^n1G62zlJ{aeQhfrfx0n5e_v-ZdQZ#Dvt!gV??nZX6=S zTwYUrK)tG%XA-J^8y0a+O+CdaW;uawt#QumyBfr9!miuU1*po~A~}>rB|5ZiW~A1) zS)@Iw=4FGaZRHtY+o(FiM1x$ zTMd02=2l|xP-%FYk%2`{r`hgGSNI(-bOk-NlDk$_6dO#PfH!ejZauWVhH#Om-px7= z*R;TRhrwm;fpU%6)XlmZ_oPP`Q(SKQm#aoSN!B}t^)o3jH9fJPV_Ps&uw(cpr}2x$CH}`|{u6E{@hckKA3OT5v7^~dFTCfE&HU%x zOd0ede_C?$lyceH?-}`PhrBSRxJ5GpeBEYFfHy+UUFm!{x3_Ux-8P!(iT6WRdO?yH z={_ig7iD3EwmOhrKu{LmLWBXVCcV}Hm5|>3B)+26%}8u4vaIae zc`&D;+bnPab(GmYO9&|3Rwp=E&4u*2fwP*1}Gv5F_K!Jpify<8ZJq$*M7%H zlCaMDSNQ8UQDn!909N+jVNJ=)hK(PA(iec*4(p+}h3X0ul92(M@h&MfogVIo|Mn`a z^t5%IqDoVwSWq=rMF49t(A>*%Yj2!1BMXWZ@f~x9)b&FK(;oWZ(b#a`i%nJn4JhNe zGDfzCZIXk+$dMoRaRS(wseQDMoUZFJx+?ls_%>0sF}=+~++0z@%3PU2_mCxagHoub z$CONuX%nwhE#u}wY8gNXC=bfDxljk!bCAS=oJEx@DZyaU>G)6buJB-qYYG|MOmGyP zaO(7x2BkXGa1enr3m0svYM>5(=wb~9iH%!G+qdP84lqnAPTRHXOdrZyaIzBF$*>V` z78FWRZ2eefl<#e_n_)9vM@iNcWgY3D{h7NDtF|Y81b43mbAc!fb;ky@zdMb5X6Z*- z^}1=x!vGQI69VxrE>MK)cK_>40ujTHaA}17xL>>3t-1%8_{x|vVTY|6!RCS|7#kMJ z6MGCUs3wuRpj*nZK{m#UJx02e)o#=-NX6K2#d0ag`?SYsMYR*L3(C=@B}H?OagHvk zLh6Dp8yh28Hue}}R!t&xK?ir{X6$};UA&0Uu@C^xm2Cm`&aep&JMSP-1dOGN$wkuzMKEg?rkL)i&;FLiA}i$M{H( z$RI9^0Y?{0Muk$j#v@pTIFVkkK<%AWcfgBdx;X#7G5nB5x(OnsP3vf%BQm2Y13*{^ zY75lm-Jt0W?IkDP1GlC8Zl-L43h9xT~gyf2n*eAF3D<|Z!JtsRwcmlb3fY+nT*FPBJmB_dl3!^^)8N zu7Ku`qxvY&L^0_4!T6YVuil=_4Tqw-1?gQnuaCwwwK^R?oPLo?hoYEq$eG4?Yl_>_ z&NoMv_m<-jMF#!Se(E|k6sRwn*Dp`K^9tsC3HJv|Us~{Zodh5bhu*hnB`<^Ist4gFn-#-pb$-6OBcBl<72js%toGC&UwFd;Q0Uk}N8KIc(H9s^*Y zSh~6;J7}-1VG=3a@vvOA8_JN3ibto;_nt*i4@On5+gVI|QaYg_*HH|zLpbEQH3w`V z@Z?j}d{hUhYo{fl>JYf08HS|S9fOgYTMOHbidP?$qu^wypm1)+Uf1XEE^3`9kTMJ7 zM!ur&H}X7>U!u#O`uc!F9WFtT$6Ph(-1|0zn-3Vu_~w9^g#uk`{;>D~9H2B%&&0Je zwIk)#ABRN_Ef=Nf7P`xFp^PP}Z+zfzoTbUO`OqVTAoB6M{Td{(q=RE#Zb+?m2z2*0 zbDtBuYV`=D4(TWsoNJMw5tq!MygC}n^3or{UXPH7y%kENr>SJoZ}6V`=9}O~9_zDs zj9q^74IcPo1U)u}!CA4e#|72$+FiKsg|3;V4oT3g3{fdoC5o@j$q>HBIc4nN zuT$@Q)>l4u0@q*~CRK#Y>4x0ZMZ8+UW!UBtq^GFO1BSad=QVkX6sOUa3){*3=_4#z z!^#%hwkZZ=EEOIH=SkB;=ev&YsAG{N%5^9Psk>1#45&^Pc?W-Aj;^Bg!y<RilNyFZ zh0)gdrD=DO%6PRd<#^jzeI2>#%v5ZbLYog|4o7kc;ydiaOOQz5;(6N&N1A)2(}+T} zR^BU|CCYXqxMnSqBbQAF4a!tRIh$+|C&FvptIbOc{4#dqF4Ubm9>)3p?O@RNy5@UI zb+X5;Nu0)01&P}x8$7SILK#(qtoIDg(FI3sQUC1)9L(O@cPnQCP7&O z7mJ99=>o%bRQZo+@`X|=WwmGmBh#-+5A)ij6#Erj2Wcoy>?v)3p?eUpv~#uUNgiAu zv(v5S`@bXY%1Tq(J-WNNw5>1T*3dd{66&AXQOz%F503XLULje*A)RHCwJZyb$-QG7 z9*ry;5w?>a)A5xvs5Q(KTJ0bNs^^L8`SHU`Ws{|HolOXz>W5xq!yvASV$0x)UUw-$ zo+Jewr$`v;d%S+e?X81rR0TzfWCQYE(HCL5`-FoUB3$${TlA&P0*1t!L&w@? zgcxs8VU``dZJVcWVO5ZH)}GcHCej^ScTJ!83X_A!2u7h8GHE|O$H#;q7ReDu z2DTQrpmT)r24n|d3R#5SG^)Z)MYwBkDWy`RGoi1{GFOV@Rzk3BbMykqQ5a>iDF zEN4W$gaha5qQe{8sGj%j?%z!cC+s~%+5p<``Ttk)H__f;Gy(|Jrw4O|NidjpH8s2|P@ zp7|IUmJ`tA{1{!-`|GmIDc?ev_aDP?Q-OS_pHLZ5T4%h4+sFvn&D4~pt(0zj<75_~ z0!1*{B5bLPMkuCM z)i6aYNPKcV7;c%M0ING-kNDzU|7tQj+ia4OL?;=HIa}SAE3+&HU&3j%#ktG=o4L78 zQShq}ukjPKd%xfQIwWQVfLs`9z03+_Vflp2@T4~XDI65^@o9X_lkGVZX=P9{ZUrE; zhxBv3XmXfXX)gc$L|65F!0XKAGHBhdA%-lbUMtVPr#*!FfpW7qRzp(wsBQrF@>PWw zTF-p%dVH!wZsZ+kMa|=4xK_hLIHB$<<-21|BkJ(0e6nyPp3J~AD`%^4vM z2r)&YsU;94eO2NS2Qfvfpcx#pMsY?V zf%P)eU5U>JTAF>-jdnx3y=tRB_f;bGtB*~5(*rNCkZue0;zmR&TDHSY8)wCRxS4K( zB02*7{#HcCh7}!kqJ2+JP9D@r0klaOPQkS(;26-{`_vnlqDyKFEEC=Px0F5Ib5aPC1fmey_8^7k8RkX;o=j`!<$dr|6C#WHD`$wwr& zX$S&Q8Lxto8@~&(M`wD+amYKn@OSKRM-2zPnxTewo-!R)7r%VsNrxPdv_?Uir7;KZ@)8Z)zT#k523o6``i@Hx+T|16%Ft84^p8%;s! zCH$_q8&3xjPcClV0eMLS@0hl-O1rNvOo+?4?rOi<=N=~Yhs&T78q^s1Mg-W1aq%Ra}?X{ua*L0n~gl@X)oM!r_&qDGpj^5_%3#`!t zYAeZNi^0m0VW>z zvMmsAfj3NvR8^7s0o>XnPWhcf>1YJB@$WHKpn%~i^<#%(Rp^%d@cMRt_>AlL9DQ8l z3J<-4As-m4A04R<7gwBi*_%B_(?~9&Nxr6AFz=Jw<6!gKaU30=(wm`r$HgsZgi&*S z4%3ujk`!iVwg1yh=g7N^SAU_d@sFoRLw9uhGVceCF|Yi_{p#>I`V!x=!GAK8lce`H z*rFx>^78EiV@PVk+{7v?W585$9SU?~*}!mCr?<12r-Iy{|e6NJ`fP$edhfsUuvs|qshX$_!4p|?P4 zVI@nr5hoy?j59@+0kw(4N0x1D3ugWUs}1+91bGc=9meFwtIJPOhfSD}t}~~dNPu%7 zflZbFvb1@b==!mDRJwEE94}wKe)oYMIKLi|`-l17<~lbOQ?z)i7sIUak@w@DkGvm# ze0BceobHA{U%bP=`<~fsH6rlZuRW^4L8>3wel=VIhrKy6H+hX4{bo0*VhupagUwUT zxK>oE2Y8%_Yms>Ovm#z$PM-(H!Z377>7n+W%~v437U6UPM(d7SX?NPa*M_;t?jxAL zefQ1Y(eo4}-8w(XVNMf1UU5CkvRb6Z{&L`9Db&o7E#h($$SW=A){HDm;F#gz`|$Fe zM^zQS@lOBa^1pvLdi)&!bA0~t&qt5{g}s#45FXh z!v7Q~2Iq2p1pMgg$g7IgR}=k#PEiC~r?3{ayx#z2UW14U|9eKF_v<(3wxKM)bVUs^zJH%G<`6$Hi2@T=&Z3O{Jm&ra57m2F1}0lZ~?Co`S7 zG*7K|tu0xIa**%I4B(DZkT*J%nP_)CXQr%kk&Vq^lCXZm{FH7rrc~7y9M>3ep-34N z2GoRfC_TW`gTtpuXs*&eNBH%By;3qA!2cNT57oBu>J44fhmA4S&<#jQ$9^U;Isw=M=!CoBdn6bN#q%mM6^DO$)3F%@z?0LQz&7?fW@OF;ya2n$soZqG# z7rxibd#7dxWxa*ws?)K7aKs!^9imv~Nw6KE3v&p4-Gs?NDb~|ij+32(_IV+_hc_;~ zRb`;5v>Ig}8F-6UN@mud`4`jhCTUIwE1jXUF{0jajI5Dmu*s*k8~BTLwu0~=*U$&` zn6u7WH+u+PO;W83vAQqnhrzaTHZ#t>bLH-0Jw+Z%b)`!dYI$|IEEIp#2(6se`96y< z)lbA>Qa^|rb$1Qx6VlJNeVctA!R4~iKPJ%_Dy-xVnYSw1M3Bv!XU_9{UK`h$p>~m`=Bc%|^#fx=XZZjJ8BAz! zpTP27*ykY}%ywW-@6GjMK8ZMtz-~`J+St^r7{%|u7495)nx~#yW_Osdi*A2oAs{0$=g`w~aoKA<b@p29HyVcad${$jmOn82lr zhJLbMq4YW~GBOEvv9vz0R{H}8xhhz-hp+q5o(_`4aNv4^^qakbKS;z!;4NJw_0L>U z|Dw0t&F@@IeB?MgIgJ#R$7xEp&;cw(9R|pG4A}L=ADV3<`r|ld7>oY7EHq!XZAD{k z{W^-b4fQ+RMu)L-Io>|IL_~Uuh{1`4Nege314GuvR&e4frM>D@n7aS*!^;Pq4%9;? zEoAlWpQ>_~ACy)W3X*uItz4uSyXcaKw?f^e68}-Xe;vWcupo`=M@$Sm432=yWhbzF zQJQTq-=r$WYs$R$B1d#1Up4YoBP++%OO;9l21rjw`kruA`T$1XPvgCte$qPkwSF}& zMK_|Mj zzQGWe3c?RoE42NTeS#*e)WmO^IN;ZL?~$ipq?28!R=yI*SiRsm5F>c$cXkxqG+(OU zvs*Ez9XG3bDUC0lZC*kvZuHAe?X6`E+GQ=LijjkZuL?;rj=R?GaZibbjtY~wm-N*Z z>$gRABm0WeLj8C!;}efr6qOtk@=E-jC*v*kV>Q|U%B!}?lQ`(BurX$G(O+y?)&VVOK5r+@{?(sW0M3w9A0O6mc*f|5fGGEA)-|Zz`S-uLCK_AoD(nMhE34+ zK5`|Rt~v#~>CwlI;tD9qYu9}5K`W}7n_QJC2wEj7bRFX?9Rt$YFLu6I9Z5<&J`!3!*B2nsPy^xcQ^hwr|-q-SxI5#Zr6C^my;OA+ZLCEZ?k z&#ZN~?asVB5#iUJol4q((6ha=(%fC>ENUKI_+uS3dDciI;2d_XI4RVvieJ4Nza6nu z<$ckeH8A!%evFl@6P*WQ9k13X;;H)=b98rCHWebGtX6QKS8K{{-`2W-Yv({oI9~G; z<|eP;jENb-#<|6X;Mm|U1s%Va=Y2*2$9$`j_+h$7HIO5f4+rS`<@q-XVA~`Qe+VP~ z{tbM1CyL{0aG6Yxb(C@Rh_zKBuTCCCxt8=peu%4*6#7Wj@A*uOqy z=1NOy_Ki1nT{ga6P`U(2{6{G;&+;k>>Qt1N0wK^AY2+F)ru3kaI%ymC$*7;&*4WfB zC~>oLv}f32FTc|~Ex1xx00kSCqy^BOlWxi48VZOHWZ|%!kjmRYaFl#XsUzp?^iFQ) zmLr7qDtUqTL|8?E(*x4x{bYj&y)t>QS;EzP1Cq(q8_Jtt>HK)I?#$B-$KTZI_gt#SM$7T$S_c;A?j>-S%S+3e|M`k|GuahMmNsmf<^0@NAIvjt@U>x*z2$4QOj z#2j+WmUdIb^x_DG)YPSxIMd#*o)n z0_`K6qP!cq;taM|1w|cnF0iReCqoYO)OzSekS6zhol03H_o%Z2%84p2`}D5^&dF+t z*{3L_MBqtO;xMNZN|1r~gD8KB%M{gly#tyLmF9irfXHiTq^rt;>!ccVwz-mi>E8?ia5f?7GPOHy5b5_fD`v1}LUGKGiP6ThNrhd*ov&G+im9p~p z==nNGK6kh6C+eSjx}Tq<$US2WMW3@{im>!4*ZAk|8fL44F+OLfYvWP+oSnw$e5aE) z7_C`Q)N<=-q3!hPAgSbfvJ&U zveUSWQ+`3~rX8>Q@~1! z3Hw<)-~O|&PdrCCles=S3v>1_xG>je`!7xZENKO~r4>goFiMv61uDaODU8wm^U8a5 z*YmoQl_`jO`F|O9xNeM9bckyU^Bv>b)9`hG&})!#vV7~kBlKn8bgp_V*@tnDI__PuZ(U_jmqMf+YL%HY;ob(O zd);;Brts`{74LBSz+}$ubTVHMnbb>ph|617;<$Llv3;u=7Ht!_s&)8JV*ytaIE)V= zFt_eSC!Q%F@$jWeY5hg1)=B6ePP^{={BXZ1HkszFqP99B$Ctb+`}hFa*Y*aqHuO$! zU=~;@tbSBOk%}7(TvUrnA2E7`!WJbQPVfFB47{wo(`U~f&;vJ#zIlVSK(F$N_g!{_ zD~YkV9@exea4oNd$h&hU{GXNAejyWf=DM%V$upIRRW0;NsQ_9gzK)BsqU2RwBNUt# z5C&q@5XiJoGf>Zd^igQ%43MoF=5@1?*RUAXg0-CXpxe(rEB)eOZdS4g56ZuqdQtDG z5Vm)zX-lU>K+6514TZ&?7Sk_b4jQ2^^CbT4AuLiC_dI|S*sfP>7RiWzngf2(v}9^0 z?`wYVdqOZA8^z0aFVEj;!9|;BK@n0}nJF;&i?lN-#)MP&Tw;KJ^tem$sG25?dZF${ z(ko6tcRcfMXyrBn-)kg^La1H{A&y4L^lmWDozMjM(lNj{NIJEC{SM_bs$gI60?2~| zCh2+q1mr@KCTFP#*J%dFW!pFEF5?2m^UMp^0jB;?3xLOA>mk9BX(@#j(LP39w#F(r%`QNxT#$xrxqe(shYeCXuzpz_JSN zHK(D`%j`T6<@gS??yx|YoE~2~tV4Go?l?BgOAvX>og?gScYlv1!n3xxNlu)WYnMkY zQLw$k1$k}Kd^s(LNTa)?cf|c0jLAp>OH&Ko)ScG7Mk5~G z`cyH=wH3K9T;R4M*zb4<^AwnPT~n9VTqMR-S2ygq9#AqufeK|OeBmKOkp@MaDJf`E zC1reEqPwR3Y_xg%rgEK7S)qjNgGRztovN|G-G)V*vzxR@hTm7sO;>ZB`hAu541r6 zp2sK#?G>*py+3$BFUS$#(>l&A?~K5Z3Q+p@iNO^mA5!Jn8bc3g+lQT8CT`JsK8O1x+hO|?_Tq!E_A zXWZ?sMXGhw37o$GUeFXREV_jdyye(_WLVet4k|mR1(w9yI|UX;uP( zto4hZA^X|;vGh&`WH#KE0VUbWH$I^QvmosHPvn!N)Gu|3szD9;J31=wRGK}NcLrpN zuA`Ga9xPI%GwJsg$SptgHXp0KAHKVGB`h5e8AY<4^^@|l+?JkBMl)pZy1^Z8L~6>Z z)z6rM5~Q0&Rf^8Z3D-fo(%G*@Su8bxRaChPx#D$Q?&S`qNiu8S9~ahn*Xz4i2VCML z>#}H#8xxa8oOqW))QJdBR4&ww3G>0=#kx-oro^96B`#F$+j$NPPiG^pf7N4A66VP; z8N8DYFIN}QyPzl^?*)B&msh+gpLZB41a$itRMAZ)in8{z73~@-ssI2u=~m_SjBB8v5Ruc(WKPHqP? zSY`P4kTL1&vJA?@^30%R9eqfb5cZFLJ}g~=H4(kb=1l2aRh>)AZ$u5pQN2{*t7wj+ z#Kp$x3c{meA$r|ltVtzHLk#*KI_WVQr$n1FY$v_Y$Y67qcXMl9_v42O`anYsU`s)bxzP~}Aw~$~_j<6dvlEDfb$_j_~_1ieTf`O>WJrh-fe%`c} z)9}mBjWOUPj()y3WhQuh@RQum%&7F4UR;A(8vWy)b=}lwxU4HMm=XMVd3f`KC^q!? zj!FR%oppNjyxw%%74BC5i=6o3>R)ptp456I6hMS($_T3qS#-WIb( zX4k#QC4sgo7TuL?WG%ugS#6N1t^>KQX<8KlG$jUtI!LY#lznL+d+%3qpf%bPS%e5x z|2vYU%HA837r08pLK**Rz@YP?9^U?>Oe%1j{Gg8FefD7YRh)xi#f3&we;b@*pmL!n5rG8a7=3f1Q=Z>T|=Tij0hjdrMka8h98yo z3=(1;DV&uxudLDpL#;^{RQ&HI0|;RKi$thrCcq}Jn$gLWXmfhdHE+unQlygJ{%&); zq)bq3j9YQ}@Z#O2PE?_EfnLNsf*#gtr~ACXJU*s8Xpbmlyz&q5-oPAHq=$Friq7bf zJpG9=;a)?4w7F4+tM}svU9E#ou1?sE%}>1huWtkNC4b|+Q#zGGLp-NvWi84(w6Qj< zZeVFWm~pvfHuyoaFDlS$ zXGYlF&IZj{?!Q-8(1ZF(58MF`?uWyxHpUIwloSFnaB+-UUY1f2^O6$qWgtrT&ElKf zzYEvr*pO--0Q-tBERY$QjOwFO#Q_I4va!RQPRKq2Q>+cETBv*TK5~h``#uOwCX|lM zu?~s|%bDDT5fW{mMxH1p52SmNe76Mqg$QKk6wTIDN4z8H3`F;2k=??sKJ0T${B$_c z13UXT$WNju2zm3#fLT{}Kp(G$8E74tCpSTCE01thI>xNYl^g9L<6x^B1CzzmgYLw6 zlHf^IRoJ9lR*Bb?5tXzg}=TPD}h)>)@sXD?_7uJH%G-0TY3p`?$= zQX@1>r9-NBjQBB#Q(2ds3l?w`TkS@a%lhiL6XQhC6q(C2RqV0pKTGzNkIyl1GSDVK z{Vd;j9&|_m3KoDIpA=wtC5CqrC-&~+0fawDa@VcJ(uBb)Tahf|vZ6=n9+nkNv^%cD zz}p|VG)=D#oel%rp4if@!oaD|Jiee>yqo^yl@k_z4LJsrVs3yfBEjCdOK!J zfGXjn2&=ZTpd6tKp+dFPBezy=9@ZFDdbKm^DBs{3Wl0|G zj&E)+Xo?>5MlW1ZvN!JRK%fD1H&$o>MgiTVBlf>vW>yt|0?^GyR)OZ;O>B6@2I>X% zl9id2`8>w3z^cOA;T0MmWA`YkjPtYmCZJ%%_ZazwS3YfSbLV1|;=)Ex!h(wXnJcm> zd9C?A-g`fSU4xtE9aNoqXGykOe0A<6d3X*w1^g$*{{&f(-it&mzIryeOu*4~G=ZkJ zb9v(-9lRimk)*-BMsb7#XC%a{3Jae~Sf6CmCh& z)mQNM#mB3!zLMb&unK~tzY2ESIYiITdHIE+&b!{o9$?Iu$zkbTix31D-^I;I1Zw0< z5Te+-pQ@X6AjOdrI-I=7J7yQR?d`<9ZhDLOCH;Mn?3f-40jJ^tA#u5D-g z4VE1kzc?T|3+hJgoa;B;7)(mO%!pSWZ~6vz!W!Zvaql6ds1OyChvr6|DdVjlAc8UG zPNPJ+Ex!jV>hEzj+HUr6njgE}ThK(l&+kUt6%T7E{B|qYoZ)!0%_CmJv*`4q7Ogd51=Mj1b`zUcwUJY=e>&PPM!*CKAK8Koy`*vJ3hf-bjb>iV(q}@hTS6!)SoxDdKf zUI!HO^~x%*P?L%83VsEsmRVImst~`1I!o@dAj?G@a_4dP8b88DlI&jRMJ3sb1@oG^ z@WYhr1HjT;KMfTwiMWPcT=0t*wa@jqgzzrjx=f7!YKjXVV`anpsW(&I3eZ>ldmJs< zJ=pn_2+l7qGixl`m)GX}D$u-tZDHO+4N3La>8X943K;N=z0zf#GE1{pFBOf$GUoQ1 zTpDS_EFD)H>DFKx1F{A>0{Jya)RQ{legxjLv-KV*&K|vF#ZG&arP<a4FClMzfsUXQL=3tvgbqWh0FD+|G*4)jL7h)e&)A8&( zRdgaI7^Ta2ortOovdXf8l3l*A`ux)F`vu{9lr~#g#)ZhGz^$SsZfBI1F;`X{usr>N9AY5N&754$GA@)Lu%&^nx#di`-o>e$ORy1B{D+usqT`pOntrDb+U9{%4$~@NbB|N`Akqgbi6(l*%)OzsAFe3E#Gf+HxBRprEX~!#puEKer^-8G ze|qtSm+n*uW_~o31fz{pG7T`#oOk_|CRxlxR6sBW_9-W0Kbb~Sn#+W1y!_)y*ro<< zXa=g9ylsIcxmyDDQ*NU?XEqe%PjR;9uS>)~V`V5T>ot2}VVW&_NpHp421AB7u~}SE z(ow{Of#9P@yx6q#6lA{#*m7cXTWXk{Eyw`EeXO%2Qs$Ks6iWs^gh+cwj( z6kG#ZNCTSdKo)VxD~2e$T&+dKzcGimlkCha%GH)cvgU4NQLs!bQHJbAQHBxkG>4L% z>~0P!X3U4vtpL^$qyx{%akkB z&$xD8cLE#lwBJYy2VjuXsBD2pC8%d_UsNs)~b>?ZA z-DbyBd0A(+WDP%I?6P-R#)zzQ8I+OAQXI0&g!3TkDGW1-t3hyj6b~Kdsn?0%>48aG zeDKw_Nb~!6fFXG3vt!UJ9DMhIOm=CI5P(}5uj4y!8>m3+7ImV|=2%$hMZ{*)AY0eL zTF-{$e-w2=@c0Nev`4~qSR939S~u`vFpc}SVq2=1i#W`{rsl!@&g_gJ%;t~_;jFGb7%Q0laseJNmm z?e3C?AtWX92X&W#Dg^xae@>!Oj^aDyE|R-~ki?C7nG;)_AZ|7BgA5q(NCCs#@;+R@ ze((sikU`rk#P84AP6db_7H0=pA$7S~QvES9M+BMTQfl~?H81T5fEg7CorA}s8!(ZF z5JBQ3I}n}gSdn{xp#pndj&2K;V#3cg70k)~K)LyYbwt1VGcu$Ri}fKckYx% z+r`OW{i`ucZjXc>2_(S_br7+Tqo)H4r4dwVZ6W`%CTB)0B4UJGT%;mLt-nW5LWt%+ zsuBzDBD-(?A_iWl1Yv)pg(jt4n22UcAbf0)6=5~m^Yg%H5w@Z+WJyCI9C%%bbN!75 zQxN>-Lctuf&4PPacmLd2!s5B|N0K}=mY-rd^BE3H_iIU_SW$eJv6@UxfDr-q0GN=Z zczgfh)75u~i(bakfFhSd1nO5A7oY&#qXM7~T*an$?tOaq9fCu@dU@_$zkhS}@85Z! z;m_CKdT0C1Jy>;;bufgk8}C9=(CM|ahJC*e4F6;2r@6Xu36^)I z8G#L19fHMuf`gfbQ`wyA=6bch&kNLS# zCj7vc@jBe{MO9kVu;LE*iW_U3ve$-H{z+k}a`#nxtZosROp8I}Ytwl~?c)lq8rbbf zE)Mm5)*|jL8J@2YsaP7G-iQ8mC|Dj&G=jsYA~9s><4`kJ25G82WBLJI*CJ~INH^$7 zMKm!`k0O>zGBDDN6J0@VO=j`IEfP{xgWWbu*d_CVi?xTPk*}0nmK!Q2Wg#nKh8!#0 zb|nCfpT^m`+RWgZA$}n`C_rgzU1wn9(1imUI6vg&J}4txgBQdIN6uqd(RXx>yM)s_ zj!o`f`edwjPKSD41!>o(DYI=o0t;y_Mr2R|-92oR3ip(P^f4)r8L7G!#c2qajr!sIO;Nci+9u*ZFE?c#<&qSG_R@bD+K{>vZc1 zyM?{EsNtooQgJc;UR7Aw{RLUwumFyC3Qnl9-xUUT*GZkp>k5wGBO`PxnW6jrQRSTX zhuZZtugM76X+w?UHZm*jwTqjO+@HvPP2x@QB zMUL)7PW&i&M|`W|yKKK|5Dw7!s>$L1Cw|p3-UPcOuSq>XE2PY~iFw_<%)=QPzRK`g zzod`99BntYZ@1rQ0!D+VlC^SCcW9&9tEwG~aE#GND)pchf_{UUs^0K0JD<&{tU z@P%z~uXX=k9_`=DIf9Q{TL2?xMN8XT#zoxs;i*GWew@3}qD0?`V^toV%V{|&b4}-~ zqtp4y{c=-YkEy%j@Q#?uv^{fAUmo5Y&U-2sC99w1i^J=3rhZQB;88(iMSkdd%3mGc zKTl&Qk8bkv)stD1FAq=mliEA44v*!Oe*S7C4ABY{ZhbprCV}BL@wRcb$s_ez|Eus_ zU%oNy-BXh&Ow_RFv2EM7ZJT>++qP}nwzbE$ZQGv7ev>b$p!n=USr)g^IWj#|TQP;(Kh<%mV6gb3 zYzbTVK@=6BBfw=tV^oPYfj>+e%4-a@{qg@c9d}BAW_wO{0`i_QT30({G}%^rC#*T< z>l*JQJnzCrT)Xo+QzUy6(KfUrx1eTVLax(5in6eIbig$py$b%@_Wc79F|+)6y%42o>kLT|`k}6tPgVU)wzF zR5s%_v0Rc!^%nGOR&63kDuB4arW|#|p>=`vbFtP9|IA*wW+J}!2L4Io*c^K<%UzMPJsZo5>8CnIx330Ewos10! zw~u-AQB{iY2ZD26Ur~G}5IlQyU?x*lc3oO0oK23v!*{wcp~b9#7C4fUT=9FV@#L(C z7m5-&yC6fxG4i}<`-|FRs?)1a<_k`lcVA4c?TuM~}_v zZ!$nx$Q5*|U8cq}4fPC_9octFtD@6ySroySI(RZm#Ti&JVO-I@_f4nD>8T+VQZv3g zFy18%-Y~|%jap8Q1+h+4;si~HxDOv5Jns;{&x;mtE`(!N>t4xgBMR6Jeb42E0}>G5 zib+8uiXZQ0q<`ZSGlc_d!alGVzoz2%xqG_&*TruIa)LYGTDZmGKZqW76sbCy$0Hoy zY?mb?v-e0W5ns|sZBpLxFDUsw-A~8T)y2eU1j4(&_~0f zi$~=zwjj>3BX z9M4}hVe*#(RNcgjOZtfzgn^l}X`JNq44Mm0E}K@fdIv}%Vuwe|vSbpfVrHGT(=ApM zEm2N<9}R>JOa-1{h})`}4!ROarRMo++NP>UMJfZLfg91yoK;u5uQh9oCu{yLYhN>) zlzML@I}qF&t;%Oo=72d8Ow=#wG zgr5u80!qv92(as3{^;1)ef4Y}y}DZ??VTc<9_UM4Kl9gi!+>a{jLp-s1uzuoC(<*M zxU>XO3rUS(6Lf{vDqWA9Dj)7S^ImRK<^ZqO4<~#t1u=_*XtKGm)c%TuZ&>0sdh0E* z=pc7?%Ce4BQ3KUZAekU{41?>0-xmzFEc5_!c9lf^5IfGXPCX>7#7PB&eL65*Wj@4U zNUIe8*mf@2b<6V2pzHuNhI46@d=}OMQeHywAc5=#;)U$Uq<>y+M)`Gj-PZ>&5t7qTb+QPd^2oR$Cll;YW&3|7H2a31xFrRt*vO zN%9vzCZAl?=2@8lRuuqm56IBmj;rfsa4-HLxCW^1mpR;o_Y$J7cSMk5RM^sxACsU8 znVQvyD|5eh;GQDgA=VgCd02?xO$a#FO&}+jfuwcEaJ^Yv%ux6s^4oBZ{w~Dd25|k#tO5`Jh4__ ze+>r3E#+D7f7eF8+m=4xR{1?U*V`$lk?tVN?OZV!Tz7#2Ogqs2x86Y^`jJT^tBR(k z=6l~Udk$pI{B8}LXms3x!}sfF0Aw`pZ|Y}NKb_#VTP8DaZ2NlUN~kj6{?YtKLEDe- z^FCPgw_E=<+jt?Et?&FKa{77dHbiy9^#O=Y4>!JN26x&cIvUAJ`15`(!slTHoh|n;C9A;VF|XV{lSgNP`93N2xqU9@9>hq_K>c ziXK`{;YUTuGOcFh-jL8QkYd@54NJ~bU2wC{=$mNj0Po$#LgtqIYw*H$8^Ag za1*TvOzV+9_EJv}+bL18(@+fxo1sPI%@i<}Ad+;S}Y;A1Lz7iHXm z$arR-OM1n=o$RXj(odX05`tOpkg(EcGJRb`H8gd@T-X5D0udrL15FgC=q+tbD_t%r zTm60sLzqyQ^jR*EqzSL-K@rVh0U&sajlW};-;T&O zL0t;5vM#f>+iZNF18N@hY`hZ>L>fyEfgeA9`vcZ{TJbY~bd|syN2y{No_PWiJOfAS zv7n?ecuRX%S+29%W%_p0=@2T8bQbjujg^fU~`=?GQ`kL(YjTaze+4phOyJ z^PxD)pAdj84gh|T>N$Iw>=1Vrr@)@99YDRSA+r3pxjE|~NN_S!MNPpUA z6Wbj(fG!y0qEk7bQ|Fdv+$i5TdlE%eNBY&CdYQhA%x)R^mD`I=?5=W*k4aPH;7Hz| zvt=h@>-O}9G|E0!{S$uLnm=ye42gIi zH>Wh>C_EUr$7;mlUfE}uAPs~brGz7-4DsCyh3h1CF9GXKKi9;IQ%R#Es+w}+tpp^k zD+my5)e$(ZxMNy2C4mZM#1NcZ&~MZl$ty6=3aUO5s^-}>h?F&3dB6b}ZzOe=pCO|FsO^;?&E z7P#XCNJ+Eq{2EvW?}kW69;sBOaMThAI46@X@D zGC}v}`zD55xZhN53AX>dFP~KVl604ViSp4zP{XR7iIWoDtFx zRcLQ>CP6H6gjmKmf0U8zCFx3&A9ds&`QGjZBM1>1j_c`eQ4EWAnD--0NL%3XtMVtI z$iPYZ;_;yJOP_mA-IZ^u|9KS3jWJfI`RnR^eQj~n%7`>yT2ZY~22tI;GWPU>aVod` zcd3}M^gy2@xWDK=oNNsl4`82!LDJ`SwqEqUF3CHwcJ)H|I#vMK=gAnG4QVGE}1+o=)w~fQ`Jr-=IC3f5r>*6De=J1k(F;kcm zL6l62c%Qq{D4u^j??MZSaN!FuG%c+~j$$$p)Q@l* zR?OBJTbJd5|FYq=H|>1BK}{nR;-JTA#cWv$12yQjc31S-{14#S{u zumf7MBwb6sO^(|5Dyr_P^LXXPR+~+{ASF<{{5XF(tM+>N6?C@Ea^Akmw%G#ZAJEN0 zyUZ#)R))BAI8<9Cl^X#>u$)^R*wd}VU_-5lsi5l+^2ym(O)o4z&VoG@v>f-4ii&YL zAFD7e6AyaK%0iH8b)MR#uRXAyW$Y*ATceoi$|_e^v2)4(v52_qd(Rs7iA3=6imZkqwpI%$C)*MS-*~!x*rY{fmKP!qbZFJ@*;_ zDEsY0p%if@-aVVxz{nnbpAQuWTjxyfzDt{7)JcWpP0M{JY+CPDImNfH8^iIm?!uL_ zRRfoTGC!^aiPTOC_TP(sT>96Ixs!VTrt|T#$m*}VE z7@KU7u>F>4O67|vtLn8p8PuLC+mn*leKk=L0Y;b0{GhRl-;r{czdzY>sgWIQCrnG$F4-1eKHfmX0v6j!$8yUJV!3n2F6g!U) zzMt`=xJfRjkxi;g&;ORLZe06V+q5(!H$a@0!@UXgcIF4r<3{3N8lN9}dsz<1qY7B` zzC7p5!PqbRm2pc3`dZ}MV&%+<1}-PmI3@*+b*06?o5MqUa=@QFjsDqJ#ykM@b>7`_ ziP9-KBrKBH^OMjAvyg_%!$-KqJ=n}3BZ_*>sR9r^QYV}2jEu<%3Qx4+34@E!@B|cN z+-U;HkJ4}T5$Ce{<)b5c`WEg!;=0#rUQLIbmFikK&M?P1#oRltQE zW=RGqm+8g!)<=|jlKLV0fw(+!PNFt;$pM2n{&024L}$3LBV!Gtvx+0+gJL0<+dGSV zUS^%`2nADv$_pV2FZ-{~fX(3O)jfT?EznmQEpa+)&p*WVkqbj;jeGSTJBZJBdurWQ z<|Q)q+?}<_5TY}Aqv|{y5D=r9{H&6QhzAp)ld)1fAI|@YuOsks?pBI5EBPweU>t&) z!8tD;RFNMkhJ)puFk8p-i zt{9Uo7=YTQ1bsq5RsuDtpaAjG0B8?!I;8UdXgv!N1KZ@BJ)t{HOyNl`$w{hP9IsS} zoXx6A9K>%Sx)|TZx{#E-D07urslZ^_MRW*~W5NJTlOeE6x`K8V5xY4r$LcF8D@hgN1Io=?~L-y#Y6_6NBv# zO=P8$T{fb2IZ0X6{f#eHCGYEuF5)V-Mt?vbQH={&*`_M}3lMZ#NbkixfEJSD5ik7% z-N#FP@(@G8g@jU>C19P&DtjdZ3t~G5GR_*%nAT}b?}y60q0)t55?+$oM;st&jsY*) z_SZ#><@pVnRM;&u)uA4Cu?LEp@9e>Gs%ikelmIpjcIAB{zJyAogGaUgpljyU{`F~t zv_#TJh@XRJIqYaI*u7HXl*lb#E3;I>X*dw(fJ^GTp zr=$?Ceb{4EOmBeA1_c4Z8BAN43O||xpQ2=HSNCt+f+rYkLj=l9m6+NJWN16rAqKtqHiiLe2NAX6tGuMgEw$M;U{+3>nBzJ#ByN|DrQnT zk89<$)zG~K#P^hFfU_^$18isc8~aE2%w%Xuusg>Fs6-O>F^4BU-+qq6AMs`G8h{p zbA_-diIgmH9-gBD7-2?13UsT3U`c`^e7Xi=(hT0uABK$NllLc&0^U}FPl69#zb_g% zp{a1an)3s1VMf43KJ6WM>cU?Q8oxuCx4vN(*c+)MP=SpeY@jpOz^5CNXpSlPRK;~=5GpP67%6paL(O7fl)MTb+JT|nzT&=t5 z>CH6T@T;N|&7kh8UYwfC;L4AElungg%yb;e7hlmd*NtR!B_p3a&nOcv^ zeH(+3mZafM#!Vi0Qi<*vUuOF0VOfQ*r@v>MukBAotGCNj9uJ^GlkX@)`S(r==9WbA zDrX-o*f0L1b|+Sy3r6=NQY1x%m9)gm{s`S7&M6JV{k7ltL~V-8*d}!RXDHT&HG!a= z6aDH1U-xr7JDANHIC)kFNzzEg?A}$vk?Vs34Yihc;+hcGl|C;9x{-%x+Jigbswsv0 zUWc%bL1zqCXPw6J)bCjO*!hy}9shk{w%WTzr}1So%j)(IzM;*Llwky8LEsA9%8apb z9^;xKcq0Z1hLxLkc#y)=K7PGQcZ?3*PP&zlXw+nT@W^?JKiPWw z9-8ni5<4gTmRL6relFAXo9WNPNz)YWBAoyv2WFVdszy9|!K6m0;1UyvREk_na98xsaCzGXiOI?i=rFGAQB_iFF4$bOLR1$dI z{B_$;V{D;Ut_w)X`@D?;#%-NDE&7z9Nn)2&k%S2Qi$EX-LY@LL-o{CO zPxsqz2v=C!Og9CWiyYE*+xz8?w4;5_GnBhLj9+A9K~H+5hPR9LJtjc$)p?N2jhW+^ zHmRVN|F`;0z)aB4@UP1MkNw-B49WhH=ni97yNwm>V`v`^6#pfFBplJa3J4Zje}3~k1%vcr-lolQqc?-Q zZSy2tJux_Vk5T|1o90Xm4JYM&hDnSl?rJm;1MVP8j$LT;;hX)Y6O4;EIA2v}Jf_dK z)cO6aoP!Pbrd|Ej-?w4Fc})d&%Tw*X^AUZe2NSXG2lqwxcH|WV@(3?@LeY@&bRHJ= z3mHtiZvez-MmH?d1)FzX4Mo4Wrg_(zzQd2OnSdjaqjN>HRjX{u7wdEE~Lg ztX$DD^cMf?HGE)%KOgK8y(%t)P_vK8ZSWyLVz- z(dyA>ouyBfvKjVUjSPcZg`$54I}_i%{vDQaAA=}X;84m;muw?J*{j|s;Dmrtj72r| zKnV?Y{LFqGbgsLmZp)$Mjs>ChRP)~H(b$U>KvC))^%OnQLD8B#BS&-TlyI95TkWjn z2FFo8N+H;`_bj_n`damU`4t3JuBocl?@<8NDw{R&#-P@t$3CRhR1^dBXsiecux-x! zK>_N=e2bG}s#m?w<6kCf@f$T_FyV1)!2TuDuID!Pr|PN`^fAnNBifQcfAVD?>))<2 z>6P}&CYSsSbo$v_S-YES_EKy>cQ@4T&^MuUH`VTDTT#EFY(V{5%JV0pSTsf|Tu>p^ znb%h+DZ%XtG*%S65x=k!pIhta;O;bF7hG%=c?|Huh<<3R+r<;&)f=}8fJ;_{sD~EN z{uH#MyYz?5g*(ZpJE`{KiYU2Z>o_zd+I3m_Q}a#U#k4|H@ixqdra2M z?D4EH$4O;u+dW#4AT~X3-;ihnTf~TGokJX}6D-VKf_x>u%gw2I6>xYtBc*oTD59B0 zTLq$Z?=E?I$A*J-PyZ~8rls<)I91PwENdU`59N>Gc$WZ`G-U+e=rezPcYGm(1F^b(mHS# zHAi%%sn3mJ#z$kF#EnLktyKsFZM3uy`Z(_cD{L)oMd zm|PXI)~TLw)(x6#nm~G*4M*egk!E{kPk<-zX-KlnQ=8tvmVDcbB9i?id-NWc!5Uc9 zl7Su5(s8KnAbu`J(RVwS2{Akt6_8-qWG7nqdz^G%*0GEmk`)34GSoA^B#cqQC!B-ZQg2DLh|2L8365}p5PLAWK{bEJL#kDnCW{k zB$E`*NU} z71L+oOl-Agq?YVq%?V-6X@fV03+pn9tRGv_68*$*cIOzInJU({k|eUa5l01@7)CG| z(?>EzyO(h$Um3eODKHxGWs}k0x}cj@+au1;sogo6c&N->MshMYk}RsP0GK-}E@|Lv ziA(!Z2r18WMT}KZC!O2mjnAfk^C4!r3xM1oVEAJP{Dtj%FBRj3z@+#BNOxHkscGC7!tE5A7n{$4agzGF|M46oo*x3Up-brNx8h1A@Kn#iJqA@VIh}YBm%vFhhLWZ<*jDXfAr3HA zE^vm!gSPD-!4nLDM7|zyracRgQw}TU((ocLP2#jbBatv7DDc7^6`Q z?-1dg4}<5d^E^B-*o4kBjJLV7L3srNTjGP`JG;At^fuvcSN^iuiSmh*erS zooZtB$hyrS3b#oo_j92aqv_~H@+3h3saqZt9)iP*t3eTyFJ%S&p2o__Y>0?Rd~`sB z%4zw{8;B&t@~fDl;f}uU^N7xPCqxSIiA~Ewc|9P)A`P@}6jTjSHJ+OXE*4df8bc_J z1-1Y8QYib&Q)iWm0tzp-gLF?xb|{(pe39-R~(sFLqWmvLOYWRMAh{ ze6FT7Ffap@(RZ0Gan*GG-?zH1q*bb4xYFc4cJWV?>7BCNnYl{m%(BPpVK3l6=lfGb zVe;jaPS1UhQ%jq^VffnXWoW0cFPHhwZ`+8oe~(mI`2IW&Xz1>`qbCN+)#b2WefsFX z;dAp(FULsNcT-P8SdU#G(A*&7OwnXdz==kdUUc`agB?VTYa@o!JNa=RtVR2MLPD^U z+if8BBZ?%B!b-}vEOrIS?+6DJpZ1E_IB}Ac-z=z&E$g})%|zw~inVrTCV>xG`s2x8 z^uvA>Vq+3lkeIKbD883dG;jusk4n5i145@HFK&CSViPbv7A_+bOHO|_zhF+JAl)}4 zr~P4yu1RD~4l{AD)7T+J|0pc$)5u(@c`@u1!;kHgkMzw1WH#kL-ay9y9P84gJG9a5 zw;(K1NN4bxnvG%F2k(tu-A|>jTqq1hb^EKnrE!?t!&dzu4<((_RkvZ}5;bQ02Zl&5 zYlhhpU)_B9udTSFL-}nJnuFc=op*@D@WR~_-&37%|AT!YA`TyF1fei~SY`v0gz`1! zBK%n=nkKS9r=UDlVMKr@N`p#bK!R!Z8I+|JQxv>yLVO|CRjcLzT?V>#H7`w!cga@c zmI5Osv?e0+k;Z;2HK6$y%goBMDcCB^J@mXFpp@1n7ch1h9nRd}cS8DCLCk%uZUQk5 zN4&wv-Xg0l((D}vYsc3Ga-$X}uBAsRi7r0b44X?t4GAYkq9CNR8-pyB_A->>ILUx1 ziRBiC+UMmN;FITKuK>L;->eMVa|vrulayc=tmI5g*a{*+AKtFc&l{WG8FlKxq~QL( zix|#y;AdIQGA;Er+N)_%SbCF`$f)zz%7K9!`mu{pQ2TCWd!dx?T88#6xeFOxb$bwe z%mS@(nC;s*s?%=%rP?wNS+OxWY)hQBf9*w`&Q|czkI0J^l3gTyoyYuQ*;2llTa+;XF!XFLUcxT6&^IRVCNWLJFw);>Q-LX%$E zsmmJ^yqUQ>)zH-sQlGD5^R5P;u5U491}u@3>XfKXVeDmH)oYDlqv#c_A)2E5bAdnL zV%@}Bn;~BAnMsRbpXyDs*W!?F7buXv2lH}5abv53A;a>8)Tci>AfEl<7TAa&J>h}3 z==)KiYazh&b>0_Y^wvRMHJ`5!=D)f#h~8TpKp33Ve>QfQ=ni_}<#8h)4!2^^NI&Fo zsvgd??dBk*5NMpJi*9$({oYToZ?CSiqOhk7`t2iK za>8MqPkiXL=_XE|Y^an@SoGM9jWQCL)Ve;Ylyx*Q$i40)+!4by}4l=8Rh(A%AIygz7{EOdxy5aD{RyQbs)5sDdnE@i)7kioS$lU_onY zZFu8X#*X%`h96&nm@Fukzdmi3R55wv@%DtaXv|j(7c3Hvx=e00m6j z(*Z5@b(la#X5~(zZNj7o-^erUl@5Ykl1=8mUM1mk@QJesgCw1M%g|k7LPoveZbwXT z|69awY>{Dt8M8*)BTGLFF#+Y6!Xk)wVr8U@12K*>Ub%d_Ktn-tZ0rHhHFw5r_6U89 z=E(QbSJ>{V5dQkeN9Etc!dWnG4yFwa>vCvpP54`V+=D`CMN>>kJDYt$@nhR0vIvu1 ziXw1k?esNY`q*nNMihr=3Y3o%Kg#r4Or3(ar$^&)MoJcAJ6ysMl>gFKFK7Pzj!hSQ zpBJYQ3b{~LsjSmmmHX0CFh{g$^PXw8W|`;ECcYS>g7)x9lA^6(j93zG+ua!Iu?P!B zo$H6e$u%Ap86x6@Xo&rBc8FU^WHM!aBTz;XV#4q zC36R++J%7fnI}?RvUE$PS)9_v6B{K;kni0%SlNwMozrYLk4dG>=0k8HKVxL)!y*}a zxMLYt1+^T*_&uN8JbrVB?^N)z?B1D$9euGY*u>6nD$cs^reB1Z%s_90BovLKjT;K3 zf?M9uwoP1rw*Gkb~jhq#+0m-it{mm{j6Z*f-@R%$#uFvfo-7%BVsDjYw7mzevkTVQ@xINE`XxW z;8E5RU)W*}Y_Td8jhygKS_ckG`2Msgh2w1584Yy=@51Wu8#{O8E6D4I1^F<%3)I8S z?gfG9Q{0%BaKqIC4g1J>nw=jx%oF~)8 z1%*)-^5bBl+t1N9qnr$DnmE(E={H7D4VN$;sSjc(ZWe*2ekSl^Ofl#`wQNQ;`_M9x zYXZjBh4U~K6Kg!9E*WyTC31>4RPAu~%nU5Dsqk%o(AGN_c)PEJwgGm+^+gW&`QBfVxh`gps z=($&)&ytMtqY$ttA!L`H1f+&dEIiXx?QlD<;w;#L`YnCa3kl-yn0^rYMKn54KtowC1 zHX-<1DH3bj02vGkn&h29SW$(mji@BF1F+8OoMOq&mxl#jcBy$QcaGB@N*jAshL`>C zM&DRb>48g`JwZ@b!KU=_h^$w*c3NHO1QX zT|@Q^NC~o!3^*9^6cSUSH1-8^;uwyK+ccoN$LnV*O-z%!ih!YcjpPAzkTdTetar-G zoe5q*vJIq(S|l{4^Xc)tfMXOS9RB%wIp{$uoBc%Z_QH-%?8%fTpF9&X%C>^&0DII4 zvL1YtayRSZsWEuVRUCl}v0_(PQ(OoF4es-K?;VcrRlW8LeOY!H7>KsoD3Hb_^Hwdx zFh?8#4UGvh%uegy&^EEKxrR?W3?}mz3mWA^;FOCUygz(JC*$}5Y2DI;b%ng>UCcgr z7@AgVVatYsAdg#t>v?{yf@jyi>Vv*%l|*B;e~i-2{VUUUC8i%^gHCRKx&1yjxz(}c zJLDWB#P_P+v{ot==ubzVK(AtDglq3Q$D=zCbmMu!A@$K9)a~-yw)JSb=zO4vk`@Y4 zLgZG~4A;g)^0|e~nkWGI?@XfFm-tyV!3x%k@283VdC~rM-Qf|v_2c+42Q53po7dWF z77CO5gmcJ=*kTS#m}(f0&LtNLG=Q_NMOa8Iz;P>}#Sle$p%MHbAO&FXo2W_rAs4^)>g(H#hs5Lrn|Iz2(T$ z>`XGx&h_|p)SYgDd+Usf(9n$@e90n)CAYL}91r=(8gd~WZ z6@-7@845Qu<=|-x6#c3Fa{%Zsb%d(^nrd{E1=3Ao(MZKh6*^w*>y&>vZzza2ny=)L zNK1YICL5bS=u~dD2Vbhi5|n{YmJxl|ZtprQ(5>C-&iH@zbRNVe6E;?B3XY@y)6;=X z{O>*8I4>!%*1w+4kof=T>DbBsr>CQ?`+xRyP^SN@r=x56KYBX0aMPFn)zewrX>lKz z|F53z$L(KFXZiU*Jzb>o&Hwat`4<0YPsbA#<`c9X>;VY|@PF&+IE??NrxQ}dBj;TH zKYKdomVZ5+dOtE&>Rg7eTZES84wx$&z(xR)zm{l;VkNVsok_LZB~?ezFOeH73X?9| zC5pWH7Rh63%a^C+E^!XOEt-h1b!Dp1h8`5r4AvI1y95R(Zq@y`Y%BDL1S{Jrdzam2 z^8>Kfao@%p$#4XY>L~ch^KTGvla~!Y%Xd#P%u%c=j=_iz5b-lei~%c3>REt{Po2ev zJP~?renr^t;@x1zJXq}wip5pMCsoy#RLS+u+y{^P4E`J1gg69n@!kABULqLAt)j2Q zW4`C}LU-{>w^z_5XUgMc+Pxhe2h{JL9YUO?x1?V?v8wwMozkc^pMmsWlZ9mms@BV_ zyyzl4JFrCnDa5s4q+RN9kCMM|=Aj~4h06%06-*}%X5LxVqc;?MQXQX*mzw-1khDpr z6goIN{3C!HysLJlZ@uh|3ZtNM!#|hqe~-c2JA@%J!!ur%N>IZu_Dyn2oh?3t`S@Uc z+*VwEXW&n>!Y$6bSkbJ-kKHGV44uF^-q&`BI0_==#A^9s;384OjkN?&9TmQ%La^yAu)5PUu}7%$a^^hy!4i#z0m#;{|;2Ph4ZtCzz-wklAv> zGHg%!6oJepIJuw^>PSQCO%J~IE9^vUIb^wiBAG9;uwq<>>d%}cNv4_m4lCZBWEPG> z;o%OfTow-pO%wCj|4zSkAep@nDrjOTMSbWW3VEMa`7N5*Ab;q$uJ9^x!!xjuvi^-; zzZl+6|^%=!t99^bO4f+%PxDJ8D^k! zfyJ=L52YW>Bts}I*r^D#;p)D5FmcF=<-E*>S7B9pYS9>3aVW6|cPfCEK^5nFUmVNp zpY2s_B^mlPW}zK3D{u+}jiUekHrJuA$+Ix6rQlIj#LH6F#Xkx(DW7>Tq8V?-!;?jk zj!cix>=d;h-ef-W9P9E6=d*z24+Hz2oURY}L5oetCfQb$j)HO#VatluF>m9#JaoJf zv1L|}wngm=@?xpb<}9^Bh;ER+2%5_!@uaHrSm^NVpNUANQqFA<8U}GlLy@FyDY(g1 zlUPUHU3>26+|psUNf4wIe3_T%r(o6IsJM>Kv02GKSkXCKtlSLMD!R*}&TBbG%ZN+0 zMN+;MKm^0J+l4jLK?*tCij?uQ2`!(RciZ&B^5ZDfPkAJG55?@5l=HCyS2FdWi{vB< zsZr;yUGd%z>siHqR<<*Wm8GhFeHFc+Or(`;JH(y+2I5p-af{LrVs@dEkStuv{IOmu z>@!8w!-}pdFK2$}cM;u!Im2pIXIEw*>o$x9TRpfOGATTx+|_^o2M}eiQyh>w&e-$s zCJrd7SO3RT#lhAYi<|H2W+ZiL0Y%&Lz$x3GH|w0jyZ7zkM0yX=8u_}x3nBSmXQBie z7e(8jUP^7b}9`3Ch1QikJF0Tsd+JEr^t&hs`X~-t)k~)Q$-} zH#d_Pv=J_o&5d+bR10LBCf6u%H_>Juy$!~QOo$oa=@kVpDryWY%kqEcYiAqkryk5vn z3Xpd=SVd5i3aT9+4ZwDPs~sx8m)5f&q2G0;sY9B@gcRPy;xzlwxsl5Lu!Ig=Mzw}OHtSs&^bn0`FTw$ z$K$wpm7m07dHkQaTMkFL8S)k4uuQz;(iTa{@HhYUY;q^IUev%0?MYeaaS);=f10*3%f zP-c8Cr_=^$4&1+yL5HCe$Q{@6tAvCE&KZ zm$ftLwbB?Mpuib_D~aPE#AD!+%GMUz?{2Kq9|P zF(#Ri;SofzH|Sw1S!r^k-BnuQ9LUL^R!HIG9H?!xb#}I>3L(v)o`{bcOEs%&rU+ zZsWTi>IGs(>BsC2OnfSj8d7X6B z3=Jz*=X63uI%}cz(2S+5m=uT?s?s8BhiR}^4uV6oh)x zlUhrYb@LOG%ut59hyZ$UmCn1gy|iDPwS1$UOJe}WiV9E6Sc*O>RrYHQ2@$x4T#~wI zl(-E^R0Q`h{~YfgXrY*3!!w+${OA{gw^Mte!dvA_If4j!vY$s%+>#xB#=L$ciB(~oBfEj)TUFJ z8jmY@P;hMb4u_3zE9WxW#gsQH%{}uAVuh@de9;C-B3MQJTrfFSj#Td4H;Ufui)2EH z1Qun<54*;G33?vTmbR6)r%T&Fx^{EyelfRLX1O$z@7+@!tn2d(DASQ{E7@D1*-Rmk ztt$;b4-jXdu>Fib)nU_g)J`QnIK@~6wo=$iCyWP!1mhr2C_jEso|{OmhNnGhtM$DFv-vgCC8Up;HXIck)SHEl%N>85&JnL5k1UX{&(;T zTg#jGQepkldI{x;m8Heb@UdS+*NU)70JnVUG8$2uVb#+N>v?MpHDnJ&?5Ba-KZ92M z8A)@YHvSJC(nJ=~7c@I?l5*ns!-WGa;vKxjgEz-b4uYv+Wt?{8_SvnDn5UX>%MsNOL6E=v#(oItOH@ zA)Dc8r-RC+xVuw&JKm`sMjN0MfaHhuH(1aQM9!F#3bYv@W|;?~*GRn8E|pL1%$XFs z`rsch$0FwPk>U=$)N`q_D3uxJJ8&JeDJLzelp!_hnzREU9Z|;{UJeg?texL0dMk>~ zvrV!2Ec~6YP>0{Bb;p64)iRFi7AO&CBX|-Bzz4{d1Hzj)DvHvCg|1OZl#awKcm?Jp zflKP79^etxLOao1IxT7ZIv!?JI~QeKqTdD?#VBW@Y3b^2qI7rDW;?6N0+t^%y~gS0 zo2qLd5>OL?>lrN>3kK-34zGR{gTJVG9k2iM7u@sOQAbxRkTrR6ZC!fzk4*J4($H7k zzrKTtiEHpeQ5|_-_d!-*IPi-88lcW&YwK`glyWdAA~z5m{+>czPwrmv#=q^s@2~Bb zeT1u&>uDm{r0wN;P2}ML&jI>DKJ*Kuk+>BlLet~L)+XCKlc2_mnSBAVqmjCHh;hq1d0Mkgwz@$@|vA-;K<;@>`lN8bPen9>7zPUdy zt22E8stLwFsrTD*hn>B1()TGWd8}fu14q9zankfyAqD~*cC~Xx2*h|p3ZZztD!Vkn z6}x9gko;%L{b$PkXUhF&%Kc}`{b$OV{%6YlXUhF&%Kc}`{b$PkXUhF&%Kc}`{b$Pk zXUhF&%Kc}`{b$PkXUhF&%Kc}`{eL#)B!9WZuYExK1}~$1#ZQY+LTFVZ zW7g@zv>dUTYhLhoP#^`pC?~dUhL?|cxYhkT0!^) z*xbA)-GKK(FY;ds_t!*_Qo-<@xP8X)# z;xa|iQP4I%N=}eEfz)l#X>FDz`P-E_57GDc(LH<95Ifkn@dlbku53m+H2~t5f)C>= z>+b1EEYQ{4zoQ_wzM6kQA-|Rn3MLE|5lI5C@A}QLULTuaH0Ak>*l9&s`RnqC0s|JF zexnEwW9{FS+(mS6pys;T_>7CJa6SBNzB7nffqf zJ>E*k?!H(#&#M$SL1!5DA4vMax_?pUDyD|pOBOY=onTQp-!{`zt^?M@5b{_RJ$3S# zBTh_&)DR8%RsuT$UoN#G?=^?ggbWc8_kY=B+1rao)#T znthJb7t+}b_ueyOdu*&In!8V6=7r#q(l#)W*!C7qJ^y1O38a?XsL1p=C zoSIA*ab%#1C}Qkk9i6?HW;v+vlMPy4F{%V)OZisS155lX0~1`2zkC+{LN@PJqnnLy zYPxLrhX;|IyHU{edlPnzdhj?LqY&LgTZ8H#R~i{FLwT<&$k8z8ls;mqUCM z!>vuvy+@he=q3a_5Tg=hrxG=TwBIx)EKB{IR&F%~rZ@I$Ta$|A2>GkYE0eb|ZbRB5 z2J^!U9_}<_7Q?Pw92IzLo?Z<%V=no4*CD0AErt=cg8(V5t_o)h>Thm-D-ahn$D9tn zN4WKXO%jEK?B$3^8U4SWFUooh-%SBB zN>2A42~sE^_1NX&8EDi{F9`OE4GZ>5Tz|0;_Imq5tN!Rl@2yEBFR01B9j6Vy9rawk6Y9Fg5I}n6YX945t=Sz-UTc5Cq9pi+?;7zle>|j(|CM+x_#BVRG(HM0(&c=-lyhoy@owAQKa7=q(daF8=y>C5~j=f6Ry7l z@)NYXMQ_*!d9V>AQUgzGYatnk2ClkXQ>d$hRAEpjzBTX4-K2NH=`I@_c(pxpp^?FP zUh|5E#6F&eD}u`hl;ZrG%DsY>wbZFet&xWt`3FwwLskwsnOX@^VrexkJh0hHmKL-S zsVx9$@~Yfrm%loep=$?uun)2b+NwHe9Z!$kTMZgkJSwVRl_1O(n~iztj#~el^{Ps7 zwW$?Md2NwYQ%|NOH6piTmWX-UwXZOGf-BR0X4&eZP^b!+6mE?b6+dF&Dq4&`n0cG{ zy+3}P6%6~lE7neX0q@u`7`BK}_fR6vre zq-huN%J#ESZGyZ|oiO>a-S3-PZ{4=k`KNA1gxB5^O(e~GWU@7UjoK)CZH<+qOI$Kr}I;CyV=<03V=GeH1FertgT^*hjRe13`v^ z@c}7V)ogFvg-)=_a>(&;vx1(F`ykrCw0VaW{1{V4*9zTVn{Oa z#d!bofwGC8{w*)6Sq}Aop1b8q-S+vKkh`gMwrkKEwA3eZI}O8Swc@ua&)fa-^R_rU z`N$5Vp};oAcCpZefSb6uF4HgwfqA+B#kNT^%_jA;ipYX}z3F{kDBR z)W3>rFxRR21N- zU;@6o!Bo%Ia3myBqM1BLT3_u7=l{IcL3OF_iK=muFjXA{-xf}%Zt*-u4--+ia_QC5 z#V0Pushw_B{u-yo=Wu}5eq$uQ_h8NlRv+*hsr93)5}M~`O)Vr|{0tXuJJkekJlUKr zT?`Ei%zm*?$GAr>r{25M7?lXRqh`9(thx!$x7^z)+;BDUR(oI4lbC|b=r-RyeaM0I zb8+}@G+8T%l_rK`;;nJ|jF*$IJyMCkFA$V5j7bY zS)gZWQL{eKs96zAt=K$)Nz!+eS->6YOkV+ETuOffg3>avAf{Kxc57#Fue3@lVGztxLmmQcT75bH0H*;wLvOsaX zBadl!F9lHjT{i?-!Mo<6|DfXy`?-MTc~JfMM?0GrzQ-g7DTI{H(zgP556~1 zSY#S6o14(RPl2ZkX~1%D*&iBQn5Qdi9Kjq#qO1#>9%1h!phc#6sqgvb%!6SBn;{=w8!hM90IT2a7sJqDZ^W)?^;3YD&d<8D})6I*0C zb_7VSdq-B6h|Jx`Ks(-ftAD@eP3)uXx7oDNx$hK~8p|rg#oasBW|PI2JIdeCmFyIB z=u8mX7Ep6*hSExFI}f(avGN@ilO(FUNJ*)8OA?pU)WBJqUjeh_r%!;3aJ+FexbYh@RFD^*jvB>(mIOu4dry-26EvZiRMQu$6X>m$K~! z|5i?EGM}l>BNG}H>iz2X4xxlII_e4UYCMP~jK<%31WU>IXdA=MqJ!KGQL4=cFW40^ zX&AZ0!{WlY`ho!Tc#xKGvz&TezsboB5v@?g!u~ZOJgd#zwmlB|k&V7L-fVbA7gdOF z8F`RA0(Sc}D=E?eY*MyS2IuM?nhB7r9lOVXJ zGG!wq0`V9?w;*1}OXZ*gbL_~Q5bf_IFCwVTdw5(H9pZY`5q#hThkXvl z=d>bWln!(?eFU#vtITlVIODus==gWWr71IprJORk7Nx183EwU%xD&w&5~)7zk|x(t`4(_=UJPO=H`r9J9t zQNrEelkfT@N_$4sR|X-ml2BDS&81UR#fB=t1!?(A!U=L?9tf|X=+@qAXNTRz!D=WP zP4B>qooI4j!Z1U`iva(MZQrtyhR)Z+5!SoSM?~2y_>|S`U){L|R8W$cSRSC=}nS zkXWJQ0?Lj7*p~vfZa3d-zf-4>xazpRiFEe>licL&-=^Win3d<+3jbH>NnwbcTWg= z1(yh5;B_cp3=I7xNmYd9FAmb0q(BVrL7G+s<1sehde->RV2aQ3Mf+Z<4U9h|e~2!g zFoD#$(RzL}1cDCe2*ZA#>2L$Te&@0JQRA<^k6uDG0Olsni3g>+281%@Cx>8Sm9~-C zHx&)O?m1hdQ%|Yq;AMm3`3t%7Jwb5^5R2r6@E@HVSV#5LLfrPhL=cLTG=$i06$%hx zrt2-QHG=__#SIw0HwOtg zicVKSKZd4=@E~;nCH-^2yb!7p+B9(L<|n(QDCtSyE-DfSAb)4+F! z)G=Zi@v`H_0#o0g!xuHOAh9-Fv<@$gqe-vBFO<< z>URUuptkV!x=jfVZBf$|(ZYdzp;)lHq0(_I2_4+MA@~aT+HJ4hb*s^Z^zz!Kg-2us`Q*quxj0#k28vIO%5@ zQ%R%W9w|gX!EZOCUj{utcHA+(ejdB-yn!&GaNLRbSQ6X&F@zA(X1RnUq!A&+bpL)m zSouVaSTSXtfFTZRm!SfsB8=kYI^4qy`!gie{Lm3yp(I=MDMr~4>(Q+_)C#om|Hd93 zm$Y?xvb(=AraKfesXvdXfcqdjZNiSMM`ojReSJ{RCJyCgYr)i5c6wmml1*kHX`0T7 zKhV$IqQZ`r@bsm5dO-&f1L6ug~$wn+pjbEocRu!jFWf?Ebv>QMw5jZFMWC0UrnFRyIlYyRSl=W_o`a z3v=3#R%&++Y_Mm-Sis@sfzuPEoUK+3!?wbuHCnW z66@S-FCrPib#8B5Pn&_RuC;;By$HrVe0=RxPQ_MW79bpAVJ%F313>)9?deg&9xl8U zh%v_5u*!i2mmU3bx_cI$5M_Y^bzA;FUO+TuJ?<=sl#P^H|dkZU_>>jPyD zDbdj6+Kh#8P-JEtwUXrG2ZpAVxTaR45>=n-Mk-YGy6TG$P>K88PqCf()TQkKI!hMP zglk8kiFZ3L<%Ld{3uF3uUzDJED28i@bJ=-QA(ks(7>OB=QZod|VWC4j<-uie;Bd73 z7PI7Ma)pE~TUQPtNYSLltYc*5l1PXPbIHd@_236XA+Z1Z4zbhs$ymlqjA@7&=i$zo@(! zT;5XTVcpu$?h!WIPHz&fqQ@|Xj7+Xx84?~4{Xl~z#c&)}3r%NyvZ&z4kRmT6n9Qc( zY>H)lDnA7tPZQ8Fqb61feD@PZIOjb65B+dD3TGyeXdi716mE(7Lw$=8NU((}S>W(pA`dQ8BFXRcp}t_j zDzJ2XEHTN&;{uigiGi%lVmzv|kTiN45~u2UR@qS`IK=aaAn&D0+afB)#KMHA1A*x0 z?F8Zy%h;lRwip$L-Ll6t!>Ov=Y7DJrDP?mWl;8Q^o0vn0d0AdBl+2BcEEZvy%I6Kv z#8cjA|L^6}axzI(JPVzSM^Z}>Fs-K%?$yUxIDee)Q?;GPT-TqR0nBjz z!wRZ{pNuC_@?i+KG(roU*4J-q#6joDwWXqx^_jtst$d0_>A)+J=6(xL zSK8uA`X8Y0b92$C)t5o#EHMzUm~|fMeuc5l_F*K%VdX!JDdc|=q zWjXOx0l4B&!`@CiWAeB}xxbZ|8`osd_JW9`xu2H752NUgTA;I-+w4^yF>oR09)94o z6W6yg$upMlv8SoKegA;Owu&hdcGil1&oZuLhq-?#g zPoY>5gaAk{e~r%V?O#A$YGW168-TQP58iE)cQc-h^bPxk73mj)nkL55D}9VwW%w78 z1n645U6j+QRN|9VNE#ads*HIi51MrH>@LYQE}VqhD zlpFL&<9nO2!APG0tD*{Jvl20guCf6YTFy2 z&4W)~*3A<|46jpDXxMo)`?OOsq@C1UadnSzlm#{rZn_%&iGF0+cqKj^eitn;y`2u) zgLkJJ)qYp>9Ux{2U)U7lhmpL4bD5Ao!XT!E7(nlUVKfC7c6QhZ?1y=%2t>MCjt)Od zrOvQzG1T%+ZKzI50%tVBNhydBz>ugXlZ00-&gOFs@kd!ny^)BgRLoZ@na-_*w?o0% zK-_>5m&^2aj#?v`ltAY`iJYmf;W=sl1nTvkqgIR~vO8SZ#Y-h{3^{z1WmI%UycS}6 zPAh{(DJ)w7RX(lhgsy0|cviDySsx z7%{C~=#m8#W(d~n&T5F3T+Te86)u~@at*5-jD7iQGF^H_8XRXmx~{Uz+L*GyTJHM9 zZ@k8(naAjpFld?X&4FmJ4bKpo{Sh7U3VkswHkckypw9Q4i~olKeU?#%BxKGoIM;bX z$SHtWBaMM%YMpi9%T))%b|8Ob)ispSI6GqUr~%;* zXgSKin2Tb5~Vh%bav=n6u35+uhkY92pLfl*MmDaYT zi_Gk-B#T%UT!o^PkP|Emeb0ezWcx>!WS3}g3c&+fXMGK1h2}`9LEcBO1J|NOoWk_1 zOR>>t0eEJRw0sIF6XeJSmgOMOWyT#Px1MUU(A0K?{*Iw**KkBpeqs0_SosO7Q>Mx2<50>?yKEGU!GnSu=| z-5paP(UpPw`hig~gd43`qMSTPGNG&@o3m$X(qP3r$SK|*QS0K@2Zml^i(d&Inm;?8 zSn1NBGYT%7Ak0k4QM$XX36m7y^pyf{rH1{7u5#-ja509mLNJ470kjh`uQ_9edR#UK zBMCsMtw|hAsrv*lt{$t=A~4RxyW*V_&{;BAPs%GW1dAe!<}CQFfCiGtlR0Gvgj7`S zuGXZxs(+%QTxoaGNnWXf?!SG$b26{g2?32_-Wg0q)x1=Z`?FuA)J%{HqccKqNL>z9 z0h9J`4T{TQRK9Dl&%o)kI~nQknlh5C?%2G~unU7lH`oh8$@W+Z%B<*KAgNB)b>c@U z{}jylz^o|}(i9MHbab%@X)HJ;gN?!}Zhx%2JYB(Nb$WqU_<)8Tdy3Vs+d5KgB=Ny# znH3NWee?ui`s^y7R6^q8WhUiQI)|=hHquAN1O;l%=;*F_CKuP5X4bAUaX>5?)DZev z&9A1T@PW^%M!8}JS%=Yf!ZTEf=E|5=PJR2g?%&vk$yZql%7NDV;-ULX0|#Tn4~3T zB?N){gcTiyC1-cNTNW#-%O#Jo@zW-~GtTe}-D6@RaL7One5Kr56T{%_;OiR|h@X18 zG6y!`KUJrK;>N@>Y{e#>&SO}1NuKvnVR@dCUyJK^PSr@GP4O)%lgRQ%-p3f|7wPGz zsv9L?!}fM|ds&k{oA!)0v0*plu|N?+NfWx$m|0DB(zs)C9q!n|2UD(>~?{d{4x z+2%^v*OR{gvfj$ao(qFQGV#t1_L1GJS+xLLoLZ<0^EnQBDT&4y1^sV+juG;lEE?>qkP|1)TNoG$P$iU@w%>QTInb$BmNT z%P!=!gZel+vOj3$q5dwX0v!@(r|77GL1~bp0@BT>M*#Bb7t4*J1MXOo03zk$K%d^7 zH$Ajs)MVuAL zx~c89ZDbRn_4jnqT_g8GH1Db2Obwtf3Y2bhas!Nix%x6|RZA84$QxymQ|QTJTFwEO z6im{Y*m<~eZo)Pw1L8Uv>t7&gu^&oMzPfOLqppn7_%l<@7 zx(Mf%3OLr|{@;u5=noquzLnc~p=kz)4MG|{ruIvswdH%l*a<;l`7}c*NRSx<*@6Re z&XMu%eCcruav-+uhtwP35+Sk7=Jb?f9Ry1A*oh#C{^+vIG912CFnKC&S&t1eYDly& zyTd7<30k0XDol{mH6=!)fEP?Vb2%hsEUyq(7~~;UnTz5|t4PfCvIoJ%{&`-d-PMF* zD^~q8M3IDGYK`k%DRqs-n3ERsnK8kYjhz8&KkYY@hw$`VH76IB(a7($H zOKv%;4yFIM{3pN1zA+Rw&j-K1Rw-lP?Lptd?$Ja2a6rVbk@tyFU+lr0|1ZD)V=Lx2 z-Mrua9yL9kP|Y%RccXYU6NWcR>BxGqZH9N-!ub+QKS4VF$y&}LZ9P_P?IxXJz~KSk zVg=H;@`8^wJOL(l$(0Chs868m6pt>Tk`$t#k-tN#0$1g{est6Nr6XqQ7pw}REMi;< z#&I~=**jeEw$-Qi&#hNO@-Lr7f3+hDBgh4lv>+RaUJ{hKx;nymy6y?CEA1j4#;7%2 zRVffX6^Jr|8ITDd>gnJBuoF3Hx3`asQ+&BHLSCH7+~XW_iKMX5^!%S8oxGPjWbdE! zIoX{Sk* zDvXQpbVVFOOLKlqtMS8a%97T;Agd_`NcfFcX3wW&Fk4p+9-&(l&yAdBd5=7(IBae( z69`g#Ez4efmHfiG&`rpm{>9XDwcOIsGwxE80OkOQ%b$q7!WAFgwPrey1uImg>$0!$aXI&H zC+0@#n=gK{NvZEB<%N=nrE?|SdTr^tBQG|pW;yN3XiG96`z@r)WlgnGWk{P(RbhDT zzEQmiijC5TI(#5n&HR_+UGiA~B(VFqiK&FIggipmAmG$#aFFX4_9TvonhVd;F zQF0;~3k(PyaLT%_a@N?hS?E_p7^`uq8r;;2wS~1sUWaYa9d?6e%{<;t!NH=>WuhOqh&H8ly;Pu9^@@+A307`?H}1 z*ChPqfzn_sxrT8WpESy>ln#rw?A4Riu*v7@W^mzD{|xG&v{d0*<9s1bLJKr%5I5-( zAzg_+G%8&FTV5PoF&T>kG|KS=fs2n~Nz{T+`8z0q6#=YHu{!lF;2wWbUNM9ES_>&G zt~P4hKGJ23OtF|Xq2OXUJj}REIC+e^lDRz%N=0I(NH~wj8e~=b5P_O-;x5y#e z99S_uab7|{@I2QDs2!y8lNoGdao0#JbVO1P4XYXr*e$fAA>{k^v8h|h*jvivOxIDdULVRUi{v6Ex?pUJa|QduP)l!7m4=(R;&LKw z?n6Q|n&@j}{Vvk#uu$AgbwGwS306sW_0qr;fU&l}Wo!^p0o*vwK(u7vfy`6U15F*iFsx}K?&|q`dR(M($^J2? z%IrJ?1jEqJL*s zvhAY?X+{If;s8whr0kcVH+oFtyh116-1SCT%qWPBq{}!g08U z^!)}B1l0ST{{LKNvqI{NBe2Oi{zYRXgCR>Fr`sQr{U$hP9(I$qq#SB9q-((j2o=fV z_+t1>X3EY{RxMGtxb~n_1m#%Z+Va+lq?%dV*WM$Qbp2vh&>a?5TOoTwHzGhM$>90m z1|_15tEm7QxkSoXC4x?|{*S9K8qsNut0VK?=bc^;pC3rGzh)n(FyK;`CSX{kQQI84 zN3P-?d)8Q25AhDr3t3ZiuZ!CFCw1H$303+B`xaGKH-2%q`${^px1^x> z+@Ztk_<@q!ULrb5O@25B5;%5-`@IWw*!mev{NH3?cEdMhBxs+@f>wY3z{RUb`&h!H zZ?3*)RMuj^%8lbFTK*o)1wXw1)g0$1WyLh<$UfvG%Gx@4lewd}~PWcH>XYe>O zC|8l#Iodztm@X)+Gv%Y@VH^_#idW~WqubSm4{a3vVXJ;p35KkgQdOY&#;?}hPZB{gOd&)hAE=EMfaX_UMtfq>4d!ZoDts7q)o1p$< zjsT3BWAV=5-OHlj?>LB5#{VMCF$YbZt8I$pFFOwX$G~Z zu$?vq1xYDrLo&X*(?NUCBszq|)q;uQi!tP>!@UI4#S|2LRhkyXAQMJ~R^QnHK$X22 zLVphLpuSuS%cjy-v6BW44zjxv_fBKq*7_g`Obf-;49=%m?t9AfYMPR}NS4@%hBz3p zn0JIKm6+-QAqi~`akk|!Mnz;D?^Y=Rua!nSx3_+KeW>4@1t$_d3}vQ^H}oi7`EWyv@HeLo-&8#zEdEq zub=adrGy6Is5VvuFlu-V9}>iT>jF3|ALjM24%X6cNHxO4gDZ_7zpvL*L>ht3O*QFx zHL1m)jYCTeIXEr!oVf;2dV0IzV$kNMh(CSq#Y6MzysfN7x51BJ`}aS-+EilvZ`HU* z|E|Ux4E!E$^A!t%7S{J9V~{N<6n`M-HB#~t>GZ~X3A`kYIO36n#TqGkL0&V&4UWy^w|gsSmxdYj2!3Fe6<$n$0bYv+zJ| zB8?;4&M<3IJY>)CY>DtYfo7K2yYk$yxIJ@`S&C6%7$L$YQt3Z-Lnz{sie8eG;-whv zzgeyHb=1RaF^;#*BfR1|UK^_?oOeTy=@2gH2((6EXmUHg92M0Z0WIytzy*2QhnEh! z13=_(U~=kKReXUTG_!S?^Us-2VNQ#O-^dggN_*P2s$$-Im@_ew8{z5$^ z1R-ca3 z6HU!9Qx}cdBMMH-x<3(fzF(xFCESH3I9}6X6T;V@jp``zJ1jo6h&%Oa#n_&We$!&b z#|L8K@)E^6Ph-f)xM6-A?gx zL5beKt5Y{z(fj*~Xf?qjkrBn!qw@L{NCWnNj=ag-uLzH zb#?B0YlK$D+9!9mK6oY3_^x>^VE@3~(Eq?)K9-#x61wrpT8@CYT4Ib!at};2VZ(9i z>dLznS$-dPu1OS@mwSIKxAxVHjQqcYTr$S;JLru)=@?Q;H@VhY`Q?M}zT<8RX3}mxaxa9=|wV9(NsH%p|0nY*_2EB}<#~Fymx4JUe8m+8n#Ng3<|*8*{PTIAG710d-7}!J z@C}~Fa7;peKcetsaA70aec57|-Po6X;;XLmCBmIWVa$hxkZOOoI&h|B?{VrQYaqTLZ~iHtr2V=OZTF93{G98P zIxFG5R}sC{PS%5wJrb8wO>PTi`aw~@Nn%4e3rAllzk_9FYMMAc|I6Nss%$>~%ibqH zEEpw}e3Jh!d%y0Fefm~M9i8bNqS!SErunW@2WK+cnfMSzq5 zr^{1yntJLrU{1V4jRt3wy0$q#bpeY2R<3K9AkGmDAL7hX|F9tpFYYYW0=sDX(A?W98f55 z5=?8KBtrAz8`M_tpV)hE5P}pEYSOPG5`jZ7&}8y}1=DGT1s{@qK@+D&=*lyAMePjK zy6t~BQp}a6=1^zpN-LERK>;^)fT=LcfHRGgc5y%7aX+8rf^&HaI|z<{ZRp+EAYUZPItQ}Hgi-38koi`s zk&%(5LlI~@5Fp;RtBRanjnsjEnX(n0xA6)=8c9CUDP+>c1|I3MvO?dg17CqzC=}X> zZ03RDm*L@=@&`>M$6-#|WvzmRNcMJXRk~m~?H+G}Z+#X31+rC6#SggrQnyGU->vSn zNIc{)U=piL_#+!4m0KZ1@XT9%fU}LHa9w3Ep*Q#5^$BGh}6W_VWhCM8s&R~Ox6TuwszZzZ!@7l)wlnv`V>Qm)ZUzm|?}JC8?R z7Hpgys6s$B14aaHA-GpIaj_A7GoNo2hrO%Te{8RkI*qX6jvA!APE$#%Tw=%Pe{And z6jr|8(WQ|1Z!=Nizcs?nS2egh&)xsn-ni{LEF7T9|JYurpbTa~9uiers6@kF(pw?v z@9Q!o!3oSR3e6}HlUgHh>ud~cI^t@|Q<}J|1g@YG;cR?m88#}cK5~JyFwJ#ytddVV z98lSm^lnO!LAupEro!HKw;+Y9htEZ|1yxt(nOt~wA|jwD$ogOyBJ-Mhw7(qcroLQ~ zYhnek(-k(f53k?dvZ}8fUG$Z$4PoEmt@{3N9buZ$@Gr`+6t(Ku_Tr772l;?9jx3%0 zwj&==tjnoQ$#t%O#8%=(jno9nEbvE#yK>; z3IG$3{AvIr7n`Ykgi}Ni*=9w+L4Jj`C2Y2&1DE}39dd%lHyw`4l$&vKUKX@UB`*v3 zh_7e9=8xL<39DIMN)_{>JSGSz@A(n|VMugSzM9B3ufts)hNF=cjICEJWc467W}2yn z)@KNO><=Ju5gK6kZlEM@DleVm-5amC7d5*6IRfhHb9$hMGGu<}vDnCh#0jJ&fMnVp zR|x?wA{p>t^sBZ}MoEU*0n_ikq}bqr15eLz`4jr0`Wizv^`MuHtGK-y`k-ridc6!( z-%hi{dO_1$nxQ~RdTRwyc7GV?t@*LP`e>#>>lwaB-9#E4Q--13#tb7QlE~(s7@#G+ zt&NSxJ5LcVkq*1nwy`)Knj&seS`=^TsMv*25w|Psv8dD)4ECW{DSx`?Glm^Cy-Ia6 zFDO?Rn7Kk4e4n2P$z4KL7qZRdA#18u3s2ap!p!RFIDAlN9DBzSC$IaULLd;2zBFI`LbPn%B>A z3cA#RK5m_w9HDfL&XL9|fa4M676B0FcbX;bWtkRMw` zTg3{yZX@M-OP;m2ai`{kcPLB}b?`~O@ub`@)oTmgo1*c^+oB(Cflgc#?5J^Q9a53J zAbv%r=0%pV0XB$w95o)R$0XXXga3qIrNc^LdsR&;p_C_M&}tCt*3R&irRau9Z8zz! zfy2sO+#F~zo)ez;yg(4+2TuCJyI zMZK-6$ytlmAsP=N$E|HqQ4WKOMq51egJ++`=NQ&5BYh418gy8Wzbo0n^RHIaQwCYX~L~@Xm{~IQr5)%d6U}ZaJS7$Gx0ICoAxyZD!VwW2C!YS(E zyNESHLwo3EbWy}=U8oOmhpHp5&J;1%j5U{L45Ydxu!B=D%74)BGv=780Jl1T8*}C8 zL@7x``zbf7x-e6@vFXedrfp4Z#g(R3EoM4u(||W&FW;c+AN$$a1NCJ`nvjIn-sfnm zKS9*1UNfgeCEEeE5M2nyTE%%tgnFzZA-vZ%2uUZ$#Q1`9mnnE9BssT!4gM{Ob_!%> zh1u?kwE0K0^s<8@I-`Q{AgZ0#XnSV2ICXP{bSq2%r>M*{3K)_iFM_p$Mq^-PtyqPo zh8GdJD1edV6r?<7xo6TODQUBWoJgk(LPa;qm&hOIVawnXYryMs!u1j@MH}<8nyAcH z<^`Q&Q_py2FE!MR4~e`hz}SDchsY05L;iR!Ag`{#Tph{c2dW8s$bm+vI)qd!F`LzD zT-EZT;3U^$^CpkHshJ=0#5tBz!3@okmX;f5fHbN|HN>UOvT~w!W4;k|=UXBZg2L`8 zJN>Zl^o`ebgR-)t?Q$My3%r5(J~>P3D(8FZsGU6_UA0My4k55m&r13_nLA9H5N&FW zem)`2Lt+IPe`$he=TbM7`o<{5DzJaRO?bw<&qpT#c|rYR2k*9q)K+w}J9N~<$7#kO z>)l+2;*~gdeY3Ew#LqE0EFzN$B&N~x!V{4Iph8#RC_^!HC!P02Zajjp6MO};xIehH zCmG(`P*Y7-)KF0F1QPQ{hjQ1E_OE~|uer>S@^~`Kw31V~Q|~QVEjj!aZpAwzWi`Mm z@VP7Yrz>WTR3{u)$lNFW-6<38;4JZ7`Pg!s<;WF-32R#X`G=B$%0RUg?3&tiwaN3=;8Q;&{ipRdAlf8hN|OUUyM;_NgsU zFE2ii$##R;-|;)sd8`C70gzm{Pl+D-8bUV=r)osf;ilR{Z9@d!I))1OHim0*Z7YyZ zm=kd^=};l(4yyTt4QfS(#opLVy3o^BRLam;6)oCfVRxkaRS$>Pqs6YzHC+|q`o&IM zLF+%?xA<48{zRrp1Fy7ok)lW_me=4v-?wT=I2&iV$cT{0EgFHc8__CSfdN7AGAhXn z98!HCPqDiC^>C`xndq>#SB3EsUix?}24r^e#5WD?{gnBPlQf~#7Of4EY_kd~`}ow= z?PhcHAMQJQ@V7oPXD=FIpzUDu>23C`uCpD;maek3NjEgTBmGW$2&fvWXNbDn2j)Xj z1oO)Ltwnqw;*RkVT9;4OuIUh?w7p>!ID0B z_Z42zNjh79X@%=D&KhuRXD(h^-8PhP;8}KuJ4#R&*|4fRE4T`uT=aN;&v>eBy2Hjs zly9#+{a?njZSMtzMHArx_H}JU9pN{poa~xJ7idkuXDNB14UH1@s{i(FdgCoCxKtBn z6a~qA0~AClyhIST!IyhCy<8e1#2mcG8iB$OhI5p3#0n%I7$VUy$jsheTNNnI-WL#&MzNjCRLHGIFHSMB-5vrB zy#;rl?Q((>9IlJla2=dK?-_ZW*j0s#8S&Dji+ z_7Y*47B02iM9l^gqD${F>dFJOmK^Ik3@sIk{f*^5!^+zA$6?>*X_Q{YAfs!KfZU%r z<*I>wa~-Ud?NNgwZN8Dic_mdmjwAO2KtXt_?xuKY{{lThxo24WOiO=39TBx>xVqgF zCh(?;e7i`BSp$ChM-x*O(Sswr4G{_M*56E6%pMkZ_F6l&(QDuIy8bNm5sPYM(0$M= z;DNuL9%r?lH)-ZIhB%f22=3(2RzVaq!~3kZ0x__h27j($4`BLOYxhd6!RzH{U$~#hOvovlE$&A@AmW`yX0bjs$wu1{!G4qROV5)g0!Ij5J1RY5nSrYfUPjjX0k(E zHE-zk!}M(Tb98Kr!YjWiE~eh;Qdq{nSi8;L^LPo_YeQ?4@ zH@_w?H3skWc$+?baBaR}gxVqHT${wh9Fi4oj}Gt9FJ>Fl!*(CIz3ty9LG}aRd$-YO zd@+KzW(+OB_u%P$jbAuyg^?VOF2h`h0rAs5lC7QBfS_Jv&^c?Z@}8Yy(y46%>uvrU zOCUgz5fuyvDSYbDGjhZQqU6=qI!sL9pK|poqnBy zp7pk%gu-CYLvD)rF#WV?=$sOo6$u0Nr{LG5^JV!lIkf`!9!_q64@z5|Fee+Rx_qyF z5V?Ch*m-$Z+&Ol0VZk>VrR|q{)T^ZqHq4YwZEpk9jE1kYV@xY_cWDo^h zsDRH1>{pSFK-b~5f-L(2;%8MR&?C$RK9My+t$wKMJdI!az>FxXH6V9(5s;FLkhPhz zOb%gXGyi3>?!gE*X_JJ0-zrvbTu*hYxw2Ce_peS`sDWx*CWsefTf*4Ro#MU$=+VaL z!aNOTobQ4-Bzb&_CZ4RT1E_@dTO-sbUDjx;Y3kDadsPVrmReek-yiESBrl-7i+D0L zYg;@O8HEBlWd_?9vx+T4;?Y@cB8-|E2{1nTHnVW)OD(C(Kv`W>Hadj5;Idyz!88f( zVK_L(n?&npX>l#OqXD)rU5}Ix#VZrC4k4vwNHkoK!2C6TBhHf2rr>xS;STgJNcj?UX?c%i`}{n zl)wwTx@3=@30xXO#sBhv@(ByOA(${bfrSR{INIas@odY38gWpftTKxa3)2v@<9JST zKdL>lWBM^wHU~>cFcS5Y>OhDgH7$F>5QwMZr48UDZInf1H|ckZl;e&2kwSbfiS-c! zSLF?gRI??SM7}kC?JG$Yg1Ez}gMqO$FbJLHH5(Mm9Fpy(AazyPF1y&j%o--o=XM0+ z%Q7M=e7s926lyPZ7=(eJGAv?&jzN%6cCq~(D5@P63nBZ(Aj0^<8ABDdjk|egB10zMM}C5jI&_LrU8rO)VgHnz~2KiF(;@DkcTf8Au+Ol_Y4s(3yU$FVP%~NE!g^m3;a?~eQR!p1lDNB16 z_?i}xLum&5$!5kwY%?tP*UFiaMP_J}hbBEaIXtS=a6xU^)2?RZg^$f~Par0ZK8 zeHqc~On5N28|TAw!}WJ#A2g=r5P|f4L+dBlRA#ktLrZ@e)@by8w@!6sEwq(bAU_br z2%6)KpkLP~vh%`2BBPR-3Y5^-zg0xEKzKcx}jE8Fs+@>BnBG#q9>e*#Js42nN>GgQ8MxmU}Lo(0_9!X-+R`EniScG?S431;Q|UPH53G=F&I z*L^l_ZbNE6DhItozHm|z`gQlQGkT)KC2b9`rmAgEa;Q%a*R_ZH`X6+jC6CHGyPSbJ zZ&X-7+Ra)KIj>3KrggYdVZ@_L&U?DHeMarGJBMf;PQE=x8nM5hNs%1lw_8Aihha0u z;HBkD7jy?HZwiF|x~3~{*dahyb+@3aG-7VISc)qM)9c#LOn{m!i^fns?c&%kw8k3K zK;v)-s|ira$RX?vGVl8n8x>%r zwZeS|?`QQ+W8%L}{{6#mNpG`$+%Myd=fSg~1Gu@_LqR%qp*7)4OcAt8lwhWJMs$GH3 zEEF6Ms4LAGLuJU=rb+hTFPI zpt9^0T&g4WmWLQuu(iSK{;h3XuD=;-_AT~oi{co}Snt2^yIif_QbW(fZ0YFIAzCS# z6bZd4V83ZmnRY&vFsO%$+OOO=7PZwbk$_B!wPx^Hs zK=7Jh;%R;)lKyBPk&a@1>1UcxL%=EZS$N+8hnn=maqTgGqnAK?!Vb?kY`VMCD+NV| z)1kYbT;E?~20cU{Ji6l~oUExPt?1>JVC>Zns@AQMk^i7Z-i@)1hdS@xry95Jq6 z*(AphU+S*}I0@BPRm-JrQ4>54dByq=Xz2V=I&-@Fpjv{F7dc3vc!0ro7(X##J20PX zdOnw)3^O2Ja9(bX2ETiANMAcTVT}&$7UrLijWImzz4nz36Ph`7QciiDYwkl_x#=m* z>(2b#op=n_3>}8fncX#GZz3z@HdtRCk6yPMwp9&MbiSqyW9z3f-?63NxqLH2t1a$Kjp10Ua$*hk zSuy&>#%A@(#TIq=eG0CuZp7y#7h5CV5;t!k;R}QNhy8R>!Y+(K1-Kf(!d?JLAO2*Y z;|kEF?T?h>R+>XS8F<$eH9@bAfD7BF^h1SBt*9-?{hc_Sq$FmVd~C}Y<$oidHE@%_ zL?sy;$&=k{+<1a3-aVtJY>-0M#0A_UJzOo%D>!UJ&nfVZ+l*(7S!jzUS#>#NdrFrB zJgS8>2b0~H(KEoXF?PzGGgO8@CjJ6{t;|-b%3`>9v3(6UG+k$GXjgAq5?qRp2@P|~ zB*aFW0c(BRGrOpdwj^D$&yRSuCgP1m?L^k1Ya@Qar8|+eWqrK`$)l%9%ThA+C6ypP zt0{pvf!_d~aN&q%=1K!fB!A1K7EQfyHr_aG140d-fvQo)4NFSbI~uEB^M&hU8|3(l zwMaq^0zbfru|Fo52;pRBM%QMniKq($NK+AI}&DbT*gi?%@{z7WDv! zV4^x_<(;|Alk0{r0G0d;4N(-mlUFVuHCi~hbC^Cng3PiD1NOvz*L)W9Jw$PsNS;fl z(~V;rfs}-L^0##e{v<%cP!AaaJJGaarbr7(dVKsI_=PWXF7Fo83B#q`y}gXHZ6U(q zUI1o3)U=C8(h8zJY=py#5GL4I>dY>2tMo zTALLY`hQu>XJ5XPPWCLzj;A6l(pGMT{7@IvXuib5fVp@rZ1pOt5XP}6yF~Hbe>MI(x&s-eNU=a`ce?%59g4hwrO7kH1 zXk;oHrcERx%BJN^i&GMWXu4CHHkx>AI-=H*@00_2pp!F-FQOm6H$V+ZBL%%uZYmuU+oA}RP_MC3fzptWK2u_6(H5%S1S`!M{ydaaS z(=aHBZ<`q);|gD0@6uK;mfbMWD)OBffA_&Q4hcfqDJ^p~W%m4J`WxBf(Et5*^E46P5re1N#h zbsWqbfeOY+wjLlSvf~5$`WcBDJ^9%S$C!rT79!yAd0r9AEJ6P2w(hGi%}Qnx`Tg{D zuu(WG*GGqFkw5dwjJiefh3<0_&n#rH4bef_x+!O)OIF(15RdRS9w@tUx40+ut^6SWutYzVc` zc_AUIqB2Mon(2o&ckM?&(ZqM6#UgIadjvL4nnq+Qixz19Z2cMCVA?$}N)*ng)-P!kVpn;e= zec9D2{!48sNEcA8zkfhmOk1ztZFmoEHpTw^_LG4G37JugiCZ-TdfiZvjLb)hv+a9| z;K5P1W)qi|;T-lx@H4KPo{jGH-eLCV{d&Dq zg8S6Z%6CK<4MzWa^x*kmQJ-fsA$=VM^sqWWS50?AOXgLdokb{DTt>k^=y?6|+*sR$ zxcX757bHpmO)XG(G}xfAtACl`GBGe169{$pkyq)*4%+i*U>m>=Z6vrSO&pr6;f=b! zDX(n-exL8 z?0kIMujC&A3qt#t+IV;o$;ora@A0I-BKI^AsHH1*jdErnKD3$kgl>YLn;PO?D|H4R zeu-uApwjCOA3`WXpd!HduTIqHFr7Yw3*S;6QAbKkL zXvg=tU`!{h+iUun?cR})RvMmRW5+G?-YC*z{?p!dGE;UvQcT6bjw~a6tk8$=z)kkC zL`_2$M3WY*Kq_OX4$=}uaHi5^zXV`5uC=k$LQak?%9|)o`elwpbu2T zec7X8E76zJ!Nw~5O{^=)ABK3F<^zU)j0bP~hRC6-S>vJ~yG9`t(8Dt1gQWMnlDgmK-|!xd-d2Pp9We zAlp!Zy#lWgT61tC+Z}g>*=#maVXsbGzkT6o2!qbw;UP056kUcMVgi{VB9lKAD)BNG z&qV&s1<&&)!ZM=uXv87#{JRjXj*5k!$*i}KtcYy~K7_}*a7r#Z&26aSsnl*T2p_zS zoAuj0Na5VG0`_ixldc^vpD2!Ed?nm3EG9S<@pmITF&uJ4eT;wJp%=u49NcS>mf9k2 zj($Xk+gWi0YrzFm<5nfI&+Y{`!!<4&b+^3}^00`dum4BliBDbvVnwy9jq72GTzJsC z;>v8{pP6yD7w@wRkKE-^{@*T8sF8Pd17{?t}&O{0rfz#V6;Nb7u6UpZQmUtZE~%kCkh|ID1l~8LNl}4v5OEXgb6x zIyBiQQbsp+c5VOKG1E%0OYLvJi)tc0%R)e$zW9NKw0K$fv+DAd)=Ny)bq<_3L5^KQ z?SYFaWCHuUxb$-V??h>XF-(@vs~|kD-o~B7RIkK;**j=JI!VY=7T~0k>3g7E$*S*$ zI6E%Z&qzYgjrtR<+~Dope8Z5I`qU?n=J)sc@tz~c>HGJtBNf5Z{phokY}IXnu0lAY zz+QIX%xCd%jhW_(p^hX!&x8r04Dxj_(hhA|0E+hyo2Ynlt(vQ36wB2?-IKju!kV&Q z;;-ka|Mc#CsOjYI07?e26 zHNYvJ9+>X5dUjvGe>(L=6{q&;4i(YRjHwc!qY~~On)=3Y{UTAqw7wuyqWIs=4oe2r z=T;Lqdy)GM0hN^Y|s}sF;Qn)R0{1%i^_WKjDK;A}yJ-0O4ia zC<@gPT3@|S7HEDVRWHT+)IMfb^F845lKs_7&3^5cR$6RPuwA{sV6q3se4Of2EZ`$0=1X!7YG_sQhTIqTetaTLXSy7F%$fM@ih=AOOEQHnqpV+~f;7u-a^Ow{+e?GQK z$?n=-YMg*bXan2-$?0HCbx7D{GFtmH&jZx7Kg0yIbk7YYb0r&+;9T>Ol*5WpZ@>oW zHyL##sK8V;GSN?Au{P!YQM%v7)6}PF07+|Iw^u4Ea7)YSklRzkWeE@5FB;wghqzCh zCJjN9eU&)Uo0E~W@c$FiDHrPgzagDe*#Cxfl4e~5=KeQ6B2dLh3x|xe^z&2FH^QaFamVxujhq*kfAj&8Zn6V*;iFM>~{=bsWB`y4$LfW|dvRgvmB*WQ%;BaO0L6#seQH8>J zkeL=VHu4`ML9Yc{hCYO~-(EpcT{)1PKqI+=2gTa^WlcAX2GN-*{Qu%}c%9RGcv8V_lca`xRi=o6;{>NVDMac{cxl6| z1v$of0}g})Jh-7DkX_!OG>+a45m#r|v(7fPesrwc)^dxn1b9J9pCj{?HL3@D)Zc=*0<5R~Y9h zIeJia*^LSj>pDNj)UAVDid8BU*@9-}gAtVL;givZUDt5N=4V{cFaE2}-sz~z7^DK` zOql#j$);nI>IHnZ?H-p){RV|2I&GWd!eB-`!KOe`F5;dOnZ~mKDrEMhF4)yUTBNZu zl+~DbZ{qW<4v_c9FrJDlOp;R1*u|y=b*HMKn(k#<8C}fDcl1DJ8qr}Mw^LZqU7)R1 z+k6=?OT|sTNs^6xf3@F~tfNVbDe4X8)Jr~a$m7qoM;&^(J=ES5(W=aRTSb;pn!o};r1^!`~6i~qJ3C&4~1>Uz^ey!P6*?N^X(#qZQ- zkCasz&6Hk{t42W`n{zR-tX8kZd1gSyqoRLm&XxfqKRHYr%4QOYbN&yWd!xVjA3N8T z6_C`4kAoh!V`}<0a6Iq#Kvy5G-f+z*q_aUv;9sBC zI}fz#{3uHvW~5p^O4++SNTkgVzO#%PUd^0ZqIyDyC4j?Ck!?&IIYW$7{A3`aS!vqGA{bO$BHrxq|;xvl1Vs0C2XH|!f3^m{2pccr@sF0=+@+oU@TiQ`<{OC%zz z4;SM3A5jS5pdaF(vr%|{KOT~8^z)5O3KHlWG|j+*`>A4c z_3+xA}W&o5>Rm&{jvHU~MdI4v$tVnp2i zHHJveGU8>23`^Xb^274c7kq!ii9bOgQ+&O{miL;5L*T{XYX-2+CDN+R^Z?Dl*7S77 zSegEuhscDGV?Iv9Fs0lmVRqx_E^>cU-lA15858jC112#t>EsjdjIfg4 z)<$MCeOIU_;Tmp%UvngFssIUY;0Qn@0a$qiMH*T{xE|iz%72KQH9p_0YE7}F84_*o1XOJ?=S<$Y67%ARgUuwm%ivzMRr~{gyqd+2I+2(ZJn6}py7J_I>$pTg9zE#c zW~FbXtJ7j|$~3pX-_&EYt-iA}(?0)Qy7%CGB4znkx@Z4ay6=JyxD>g{4(e7SN#w86(01wL7i5fGh1_1_-E*9H#zSHIy!z$5luUHq+*DO~%x}!Jo9! ze;C}pWtFf~FOO6mLP~EUIqzHb>O$AL`0o#`s&8H@CTRGB!v8jKY6<_#zyb7LNNT*6 z4$U*Q#SJrp+4KNbC)H_m=){w6jlt+Ut$qIpoGs>&{XOdYe-XHU?>V9>+`Pih1jVQJ z@l454IbcmP9;_&a6Wz1tipAw|pl#@!o7yCTrN=be4Sek2k+RZO)x?^0#RQutwaMYB zjEsO~W0yT9&c&b4#&0@Pw~F~ZG5(hfnHgKtkw;dXuOa3!KCUm+UWb;5=v2oEo>>q} zNkB=aHNY2G@cs&$ZG=aKi{4gSn_Mhi#8Wsez>_)!XrVt=RDl(k`S<9yKXci7PYcg+ zm4kAqv~Xv?J;N1L`Tp_c`MU&=`mKHeDszJPmClt|wr1pks_J_yCOFEw_Bf}K^IiQB za_%v^A~drz8*Cy4r1n$qAlq7WT8f|`Po_b~fFjv^y_ zvg+mS1Q{HFKuWeQP%7{{!9nU*q91?Y7vE#F8g150M(GXl6`b0OSLXI`&2wby?f)MF zw~jZ^IZh-XS*0GCYkjRp-^_}fWQ9?W?_5cXhy#Wzs?Mc zZzDRIg@#r}#&dUkZXe--0ov(l(Ck`cnrCSpF8L~Ia?6H9-02rX#+9JkhqHnRY8&w6 z2?NY43r({ZdJ>-azsP-Zt&3C+fE4)x`R~~( zjNbQ{u};wSI)e?EW!LOf^V~cLzi=v1w3Q3G?iczTP4=mAoO0=KuCnBt5AVDs6{U!d z3SRVseo)({L}6CcvHi3iHCuhH6t!K=qzN*^dUwXkc1$s3J>aVSx(Oz@cl!!T=0dVv z*!a=#tTo3PW2$&b14mq~q7f3#M95FX-ODODL`RKIY{UVXB#cwU9vKFLL`q*-<%VdF zW|h^(ec8aT(@jCFXE~il;>#F&^k3s%VS4I=j{aZce%4in$bN&)0adO=9lZ^N4BUM1 za=o>+beJJ$_$7dN_y@eT{eeTz_j~(oQyo*YV1|6zqpkXu<>mgD?Z3u-p{G|^dIGUv zG?nSsW#2Ou)*Ziuf8kX5guMn{F&ZX^7m9`2ro7#6`9|G`UtTAla4$HUY&QkxtK3mZ zTl*WTlrmqc^VGY7#NT7GJzj=lqx&0{{FWf`b*0dDw!D}tvoy~D@GUH9oJ;a(QamnD zVuRBBPPL)ek%OJ|B1#r_&^T~qT+lMPR@{&KYs{W||9z?$$NsSXIY9&e5Bdnf0h-&Q zYnoO26D0ork~ezs+-kr$g3f9aRm7>_IrSdhAfS)X~B$%unZv#=D|j;3QqdT4dkAeq7Ehw%Q` zuzYHvq+TgD7 zf;l6_FB7Sr&*$Aoz!=&YWvv}aMJ+ONV)#NLHF8RqQwYp-x>h2pg1$dOcgb+btYPbL zk4^B(!%+zJE&b8IVQb%*Uc7$`g`-?>)9y>Eeox!&y@3ZaO81yTZ!& z=l53YL(mm?+)2OryL4M-_N>uB@7qdyghu&TGFTy|@;niVnvS7^8_D1*eK+P>a zy)!DsJVINE0;37GMf%LrFbCye+XWgtD-a>?#&k#b2g{i;E+jJ+-M{9KW&JfUAIhsdN`~FW_1W>RF4eESGB9PKGYh!?M=svOPRD z)NutUI);xIeKU=&OBu^pY=wIzUa;qP@5oLcN@<~FO~|tN`7IX?K%2a`l6v(EfT)B$+Eyf;3fv{NK>gbC-t7I8!1SA}d&OFV#n-v;tZY_K5YP&2 zWUbE&k3JjKA<^wsXvkNsrymo8cvG}uZt|(A-{Zur0oYM|lB+~7sC|85(z1CmI#D6% z@OPfAVYbTOI(}E*efn-4d?K)koD9gyTQ65D0G?Z=&Mj}Wu)bQB6&DpmbpMd2h~t{4 z!%xHIu(dLP=z!n>d9pQHN~Zby1@+i$d%>@y=lfWc>ak9m4!~Fe-`-u2Jv(>g>KPc` zwDh)80+#Fb2TyX6Y3JJ9OCV7YP!dkTnjYkUufoC*%EAR8)w**kW}$l;aO2MzREk7p z%v0q?TvSlGGE&3Sj<-%(O62Ef{|XR(CFq>cIPO3)fay|a8@a+Mw`Qw3YHD2D@rlJR9|lrKnfu647Amo!3CxouV4vdQbz%C1do?PawGMz z*sR;@R$endoe-YnWW7j@?VDj)ck&%wOtvJZCd34Br5bN4$j&J3JPEyW`nj0g;11ta zh+ScGZVyXW*-fq_xNNUBmjMs{RL-S+Q7=0pxHze#rD1y&7G~YHF6*OPBhO^^NWlRu zE5ifBW=!CWT|lpgWdIR_R-1^^*o4-(Twdg1*tF3{UUlLbdd|#!} zI*&k6^RA&?nuj`oSWsxUE7_v?*6m&?70e{;RWNWV27{@0Bfn>ul)VBCNGCt$HUXVz zIYIxtYm~vGZqB~UV40~NNvYX`{lmbE=^Z)FgK0nzNjECc9V>`flsCX+ss|suSnOpb z7>7?DTn<4IL8tIyj40}K*(^FwOXv3@MZs$*1vNmAxU$#V{3J%?5yGQP?n+13 zLSoX~m|jEcNN*YPMi@gw>g5N9+a)^Wu7!uqTHAi>EVico){Pyd?^A*N5hiN3Zv83g z(?DsyL`svf4*l;$DXMaOAmZ=~c`X=Ad$TH|g#I7$|gULI50i7ri^IhLzSgN~*M$8&hqawHeeNO8Ig&C+ zD)$`AeDLY|a|UlLk)%w)if%A9<$;7Bf3#E=q-|19BKTZKV4QmzUiN5iC<=axL99)YR4)LO2li@?Zhpq2ZP19#fm^ ze)21FzrWg=i~HYK0Ca2oC_H3|V2mY1Cd85nAh6`fYS#9|KTTwo5_BXcp?W!E;?X(* z5e1=0GXWUn7_;6@^*zrTQ(%GbHs+jl#81)e~v?kPFKCl@!l$=x#q4(`)Dr^9Bjr=4tL**LvV`%gcwjC0`>2a#CO%GOI?9P6wx zwJRX8Ls~zT8{<~2P)y&n?)NxHJ3}ewH#36*;LR_U#jI>Jxrb+dzTbV|wU15~`@@t= zDV^^-)_(yT{t<+BTZ-_rxR)yxZm(M?a|4I!YzdD==jg0_9m10&V{ux_aOs)umS^b6RJ^;!(9|sK zKN<@-lfx{VuxXyhB8F~{n8VfX#l0=^#fW1&lG>azLaY{ofL=o*u!1~GZp3zL=yGt$ zLaU)mYk!A-r{GUqdg2}4YNp|Bw9XJ-WjFy`00Uf!H_FVy$u0G(#xC)B3!O(0O@my^ zB>{#z4bX1srDPpLgPf#Y6R6(*j7h;%7y2;vpPBE`&%SLT8Bv(n+WihQ0rN8Ud+G`vt zu%<+6Be7X(PTQt{*c|XEE?ihctixZ!P78oaYngKg@gwjMyawN>XKs4<2H3q6Vx7$R z!qI;zI&6~XY#Xm0UzaNWu{mL@C@;mV=8&IlbBCfU@rZR&0(m27Q;zbL5qfW-PGnbc zhi6#%+xjr@JouhfHq7vPa;ZQF_XSXA)u}l{@oEwZvbK@Z%(tS}eTcQpvc^ib> zWo&Wk5Fo~V@m1)7KVi!vgW9w6VF%b!{5B$L|V*X z>8Tp3f)`Yg_=TFD8?O^o_X%|+J?R!%CZ@!?)_ks zZoi6z^ta?>K6xA$g-FeX3dgchd?+#=FumV!jf%X%Gc}R20sCbzza@nIwv>uUaG~oE zDm#4X3Srf8&e(K_%6(tFD(OeM-!0c)g^5t$w|sc}L)veH?a-s2qESMyOHZcQuDr3; zEBA$s(wzu&ewSj-kUx|C&Bd=Pe`(vBT_8>M{mquvI8wvNc%_Zijod0zKF40m z;jd5+;ETp@<%rXQ?e&+Osqu)Aq+va33Qr!8MG@R1mb~Kh|HF(l(m0Wq4^wTu@(MItzOH7 zMp!oTQa8j!aiQ?=SfMo8izH)Y705x5sfihVk$vbh%ev|+Q=M==hY79QZy2rCv`S!p zE9M%4obBazZn&p;9j;?g_u3~RcxqPS||xlHk+ZZ^rJ81 zUoiiGP+@Kpv8A<3_!#~js&#w+==&nF-=ok4@;Cu=Z^ww-qiI~hk%-B9|)Tq@?6 z2BMaGa8!SSy);&1M-Rb0)&wNx_Ru)4xEQ(|of3+qbCce(3|>4ekt{smKTLe_Nzv)9 zI;50@B7lpu2lb>vPTcdZiwYD-&~Lo0<}fBhq=HBbw^V3##@1v2mkO>o0`q%aI=_ka zuO)rxT>4miq^<+yz4QW#iLzC(fvkfg3RUEy6eQ!#HBhCj2XY!%X0)-4&*&{KO|Ew4 zbz%K3vXR+MSWaI-ec$xaz?`{$9JW<>)4&&6fjU%@E|Yp&%<_4(FZZBSv7D|$qw;T> z4KlD+Zlw&4dH@N`y~ExoZ`o95IZALS)A$a|d}Q2Pb!w+O2jJsCin))eu{kocrf%77eN`fk4^E#A)a1Z~V?ld2F($27km zRG+3dWGf>~U`TH_d9lz+gS|`S^eoPFhI@kC*o~fK0_{`otB8Pq{nIRyaqzdFOz8u6BWMxE6C1t8&Kqoh&6==`e^4lAR!P=(8d`jT%27gS%ZQ zl#1}O*UQpo?CMN11Rt}IXegNM<(2%G6rtCE0o?d}ZC9I3>sVtHDOb)73r3a!VvREq z^%EbIrZUO2T#F>NyU&GrjDf(LS*WTneR}0=pP)rW{KjK%$)E?0uW30l1=>ZsLp`1F zXhAljPOwks)r>2@)fZPz{IP|pPkO`UOu}2xRXKqin+e> zSQ}eQljtN?La$x|nVLN3*n%=!jQExyhcGF#v@7L)#E6jkTSv{FXCcVomf#uA%3pA$ zgS;7ftu0*8LHX|7R&b;FG3_G;^<~W!R+oi!5U~Nal6M5g27=cmua(il+h4Xvqmkdp zT#i&}x%Ef2&hPdb<$oCWP}rg#Ibd+fw_|u==Jh+=-pFf9Na=;b>%Ii1t5m@Mttew? ztYT)E4&gg85WZUTRpBQD)|^4D9)RM4RG-+w>fqsSLb=cHcG@B;7YUqh$UlhVFXn_I zN7vjC?jX2Z+?#tdec1g;nAp|ev`|hW{GC|{+=e@?s+4EkQgGzLx`fkLAdP&19>uX> z6|82y&Nrq`pomXiT5(Nj$$$o+iwt)@v{<%Vl@oJ*JDa`t@NTSdqZ!zD%7jJbp_S#g z)2T6=tod0txMDRg^IJbG9P`g$y}N-$zVV^>CdLaT`+LCTsEs8{V?r~WkGKll)<}Ysv&7nT);M;9B z2Q+(18GSy!oc|32?mIB@%G7FAgxNQg3=1;+>sU{0tt{91V3CnkcZk7gkV(LK)dlbZ z31r}Qr8A^)WjrUslZZQz#6eJiU+uo4xq%&ULh;Uzmj(9v7MY0!U)lS9QJNeGL`zDr zWp{vXPnB`%5nfVf;RKtHa_=)<*H`;5H20Rm#Z_glpZk~F2_6@3O%b2VRV;D2EdI|E zA-cGE3qq@%;SyUXw7s{g?m=mE;1r+anwZ6%0j7wbm2+(cL1Hql%Ohc8NSkpQVvD~L z4Buu#vGGc%eMzfW%<7hW`g?2Z#Av1nVgZJ7gvME2MYZsxT99P$uJ3&Dd=|88fV=DW zis#BK`=s!R=msf5k<#fsBSAZ1{`KEI|DL5ZEF#0NjiUASKPp2vRlkAH=~P_qVcAwJ zG!dszV6{sn&(WnG3kyKtXfPh5m%nPCjUvF%dVn&3%6Ed^EoD1sA)njoq=7!56=8^T zS|+pSj~ymiXcK=%7K`r>?%6OCTJMF>6M-F^X6RmqtLI(_Dg~u@foz$6zdnEE&BN+& zLyhSvU2f(j{!R&-W^}@jU$}E#oFnfOZHTQrEJgJl3OZ6qlOURfrtcv1xc(tt<+=Uu7Dh0Rga5(=YR1IWHcSok)jpWLelB9?bgk@_q#Wn? zYiD=Xkpm4G)aiY!AF&SZd0=bE@f`|**^23u^4|pXefp37WqwBvcS-_r=gKH085Ym` zE2k;qwQ>bzVraF!&rT{=uB0DtY~OEsmW;5${J9aw@+Z}n?~maG4X5aBVjtKX4Xb(U zZQ{CS68H6Csg=fw*gQ#*U}FS38l)A#EwfYIpssxc*UxqIPOW>O=q$IxLPTC_V2K7)Ne$82y_s%^3@Q@2BF0aEbzOXQ&qHn zlhd46OorW2e_TY!@OjhqVoc?|@>xsew|&PJ8w6`TrV{V#JdD}5*%*_ib`E8kS=#l&ZIrUUManWPPxGf%{I}KZiOapR04@Su#zefh zB3(h_{mI_;851o>LRH6@mlfC`K(r_=P+>%Q><7E`YM1KBztKNYACLYNl5caY>JJB; zMELE;0x{Z=Uhi2dsFx(NY)g;Aoh0&eNaMU^whON33Q9kZb)P@Njqy#*aM3Y{-O0cs zhg{>G-s=xzfEWK!OmG95pRAwgJ@SisP>(1{y?%KCd4eQ{72CHW_y#vX<%0*`a!Ml!R2YUba^0 zK~83_CskCKLQ|nb0su)IIEsUptFJFOWMFz~btXY>#Tc@$pQh?C&DXwgcg5{L0q*Hgaj`_vAf;uvyOP73s@S2AFpHYt^` zNUVqWHNB*ZVIG-B^=|nyc$&3$0X`u`c^9%+Rc%`fNnJ4Vk?X65$2h1sBA`+w&V?FmYA<8jC1hLNQI9{>eG`o1tSMO7`##b$>&WR~Iv2N_t5ULa(+Vc`j$3+IEd`*I-Bho|_pL?P5uaF}b&n_dE zNTvSeM{+g(D9(VeEZpR9EARW@BJ#v*#Fjo2xYlQd7sz6GBLnH*ex=i6nubqZx%+@Z zbm8XXS&Ut}{Ypimltn3Fz^8NT^ZU!c*;h9f6M;!X56;mU4qEsW=-0G|YJ#S2e3;EJ zv$3$Uvb2>t?ky_@q zILqs6*kxYc$Y9>m_q$qJ zxtXOHzH1~{N0&CQQF$!yi#y*f*gdh!rotw#MPN;vCNHXHNOesOpi=}=$`ExRPC74^ z4HwWkfAmhEtF+n&Z_iGwtXTFOBUaP#mU?@3`r_pl(#{-Z0-^-?Q`(;d)>*-L`J0v{W_?NeCF3A7yd6 zMGo-cr8i7V`>AF7RxYnAM2}hNZrG{GcffOom)ET~=Gl4gCZP@`c%W6Qm!CdfSUHBy zyOks5fji+7ecrJN-(B#^wQfb0Xx$KFl0vn+s{BCl8^Nk|m1lfba_82MP)*Z#Vt~Q} zixR!Aw3-ID^6qWzD1A8C@)v0?Y;#w?37vT+@gT`jkhSJ5+oIxXTLSvDG3s>TlkXNT zcp&6nq{ArqqTCfHenj#>9L-|_G)*lxjI%9{@J1SnTirC3q#!A8*|@^QH*@f%c-~2H zxDe`s9u0Pp8E%Nnno&F+m)>GQBLAkYSDuBj)4Wa>I+#()Si3ujZIkg7`Di0D+tdJM zPi?3_Y0Xfrc%M!2<2o@&d;-#rx-f+jU~;>+Qu(oUy-|TKZCt9!L)PNp#3@-76eY_V zaTPgD)~u+j)kXd+waIB5qm`yv+?5KhJp((uf#GdgQLEi6^pT{kS))*hE~9g4eBCjl zq`CTwzhM+VwVlXEZS8XJ&fM=V(`x#k zR-z@BF%U4-0nJk=ymwSTS6>(n?dRsXfQ~!R@|^1h3o~qD;m>3)$jWc=Uo)- zYD*mH)Tya0&TwyA+ZyV+!a=I2z4p2-x;f#5GI&>|hu@+6;{xp)C=(jvyhx+7^en2) zN3v?&ZNfYtrw654kOHDc5#zjkQ5G~=U`Bk#`-;s{+w99lS3}L#1%XD9P+k)a_d%D_ z_wmj7>F@vW)Ve&sy0*?^&u1E0pLTeAF7j7)u9ct)cGcQtB8E^V8j+~8?REn1U{lwO zp?)~XUQ=1@TU^piG$;y!W;@Px%pO4ptGpJu<~w#(+~3U=v$eB(XIoU-y1UYNYo%z1 zcbXRIBfL55blUYwm6r`Q8|V}C>SxX}pa7eO%HPmCeUr7XnaqD2e70Tn&-k*No?oqd zN3G@+Hjcmj1yez<&9rKp-FV5=e=fn84{ovpm0KCGn!ZTrlu`b`IL&u9d4peL7{^EY z&S0CvJv5*DXvD93Ka>i(PE53VyE!PrS+mfY*R>U>Qksy2*H&~@>kZ@i?poi)bCWuk zaTFkXwX@zU{=lT}@|I5o>#}X%rN<^5gyd92QlwhV!j1a6%9zxdLm`jwrZaj?Z@Qe) zhI+S-D%aYcOsRFUr)+~JvB-@0{M2utC7L2nN|BpUck=x^ED_sQGTN z4s566hT=830RrTtw~1rsIZ3Cwh5MV*OdIz%<$E!T26vI24r)qc`yJG3AC}%|`1}mc z(e>GlbVsWO+S42DTr_H3OGIqXI^&@38yQY=#i2J`6((l0! zWz6j14@ubFAE!}%TR5Ri^w4&MwBz@Cy;muwZ6Tht_|)_74t|9Ui#?-+4Eu~X+UG*E zZL>zWTN&KxksE}8vv+$pmPOx`nTYdfS5g8j@Bfk#8hQI|_gleMExy!wyXKF8xVT|l z9Ig&dt)JV$a_M_0riPmqC31{pvfVnL+l;V;${1iw+YBwQ85f(;S}BoP)b6`hn|~Fg znAu80irHHr&KEiz07en*1AaYx!NF6NARLO{(t%QmPZJ2^N1RrMA3c`7d$F`+WsfEe zfrOj(QBX)s0#~RPIX_a6C84uHM24L=iyOl$t!0S-+RBO`ljrz%d5WzNb#J=6vOPDB zBw1~?mhyG0C00Ve+7W1>cW&{WR2CxiO%g{{B>(;kAj?Zc@fKu9$qBUgYv{8BEJ*9` zJ4|_}`A!arJ>`elvPIj1qqe;wZAaE+fi`ugZo8EjoSx8WY2t40410p@$iQR zl>fHw|CiUYMvP8X10|&m^62`@*E5|s&4DC z8qrX2gs@DUj9=@CQ_A~8hh#0$K3h)}@27V%*n)1W@>l(q@?w|K4KgVw!oy%5#i?&o z{4_j%{`9Ap$CAygzN*OE0Ybd*^~nX}X&_%S9{#Db$5mL)NLE5p*sbZo7|&e23t z`2=j=a<#hm(V`Z&c#80R8G)IINM)~Z^GPjvHa_coYuD~;Jm`CdldRT_L`xxZjp?t~ z*59t)m8KF78g)Wlvb8=Sj;t6cr(pZr&AU$=kG+6p^!#ZtpQCq~P*4bYdVrmnI_oaW z58`GPQ~D0luuiMvIjN=Z&IDKrY)7?svLVVydC1`|+hn8}Wom_-Mu>O^&5fa z=QYA5@IK0Z%v}7awKq}oJ#*vC^m`_Q2i+hxL~OyqQh1B7yz3QpORYSp~)rAre&m7lR4z_?=psQ$#`J3Y@<@c@|5=0%7vW`ht zfV4)-rYTLimjPdaoS71z6O5^o0%LZPiniNlV$habcwrppN%eD;R1V~jRw)-Mq6ZVF*rTnXJtL# z@%l0ZJHWl`3dEU@()okAk+3_1aKbxgKua0^0Ea#VnslJyZ&yJO+xS2lD}Ihx`9M-I z9^(N`i#r&9caBH7^pB9c0OdgTG81X#iU>%BBy?POVfyT`&KK zp@-Ac1r3!Hgyx>QFHDsez~#ir#=55cc`TGaFcyl^6R6N4U(@HyC_j0L2nKHucjDQp zo@IuO2#RlxDx5(ZcIyAyJBQTwA47Jp!WZkq2V#XAlZn(&d>*1CFl5$rF(73q>TFzI zf6=abhj0})XnD{5r6Aw4I9)rbC#=YfBUVyZyNdUiePA#zM;*)q z+9u^x4sm(E^&OAVaysa~7hFhDfir0Pzl;W)2QZ8c!6{Q-RktqfKx7Zk8T|S|iPoWO z4<}vMZGO1kK_)@J85T!lIUe$?^sxbUzP6W$Z6MN%BA&d2eZUH`V3|M_JgM}ugdxu0 za9T%Cp^CJyPG7uu#Gp!Oo0qj}wjOtSugplps03!v2*b+0->^8WOiDmy95gxWG?zFc zw>)KB!b4N;WQO(5YNK?&@9N#>Fb7%9EqN!HSwT)Y#DB_|K0Qf@T9iGamM#mmePcTC( zGCk3Tw*bCSl9yBXCy==UbLlJsLP<_D0&(Q~2C zg1uK?5`WKkh9oI?cZgJV#E-xSVwNY?+jxyLNxqoSS#&Rsp<{lckD2PfS6cf(25d}q zFXYLSiJ3A2LoHYY5InI6O+@)ZQ$oRM0cIdT34zgAa0CKljgJE1{A&)S!X;aNRtp5+ zNZ7#ZnSA)(Mz(O(~yhUNmp4>myHiSH9Uit3X}yx_Z0WJSU>4QraYr4MtB*iclVOl>@~Dj|~re5o2(8cgq% zTe0xPFN0w3Q3QLy6Oaw!m?Xyi6}AfvnvA80nIFS(+0>P~oF4cEA}ptloAU(VaoAY6 z;YhUNf^w0nU5+%$dg(Socyp=$KnF+ zHKVQt5k(aGdGiV=cNk8lOq#MibvC>lh&ncPQvs{q(L;T?>uXF|$2u)>sVs;iP65<4 zsKs+OBTh((qir-De&mh0-?8rBpihzmVAl|t7D0_O!LNGE(ix?w5*xD~XXiCobjwrK zal0y>`@TuJjqmh39ujStXix7BvNcus^;c}xg`aZ~i2e;}vs^UKDqPfg~ig?V(tYJ8my9kiE zBNQ6zs(^cLN<=ZQ0X5XzlX>{I(V504Eef_hpET*S87HUVv8MhECNC2Cft`quzCn7$ z>#EGh;2>G!16oI=&2bdfRifH4 z5|Q$_PVyR^kivi06{~PV3Zt{WWU#NU#k45pfp*s?PSGk(Q zQPcRVgD0NP+P7|@wmYP&Z4l6r7|poIF>w3|$X$pZAz3YQkwNEpv(D*Q=Sv7hrY#i z`MgS{cYmiZDweQ^-9yK3`}Em8qZSYKQ*|gUcN-r^vHKZSrRD>%3-5AZmshEc7AX#E z!MbDl*&-d-+2~NGz1+GY@Iq$BWnmHSQR(o3`R5!<#n98qPw!yqy#z=ucv}J##&cT- zavb!GQ)&x~pkG!pvyz6jJmOJdD12@lc?#Xo$>705d5UO*#&j9h``Y4Twus@IyHpVP zgg>O`W%v&fOhmatT$a0BW*FNh@8W|I7b5c4iYb7uqa3)KX_5Qd$srJHyoYv?SVpcrb$gru7*p?F;c$tAl!4z_WyVC%h>3OM`xVZeGxr6SJT=Y0#-dG8 zOhOD2;uwFgMB_k#X&SFHB}| zGog4E%-=$0uiJ8p9Ostfom#)=M&v9RV0K4xVKIU4f?NL;#)K?3S%AsdFm3Izm84{6 zJ+}PZZHS2+>TVWGnK&s_n4>x+fu3SOYDQ5i9H}95ZpNA^fciG6xkft6G4EzI!CxudexwvH!ArweDn88888XFzyGjHO>i>!Nmh{=S)Qr+HSpAkhodzu zGL6GdyCHLzmWBLgc=dyyE-Cm9`@s85Gn$Imz1W#&gZBDO5avpJb?SSCOVKW*FZA;o zIQ?+Dm>dKA6rDH)yHcmU3b93Em)Bs1v8Y|$6=Uf}7QTC%6-y+l3nyEYdm8Wc4Q7E~ zuz!Vgk}Dl$&t=J4{3>>|tag&6E|w~Pdzrw`4#)~zL~iIiX_<>&X`20Dh2kKUZpAxQ zUb2PnPE3Is0;5)<*r>ErxG1M>39E!O9`p>Wx7R923(cF59t?P^*C*$k5l=Y|eoMh1 z@KA@>Ke0*$ZWECT^GN2mDRYR+RHKi!8P~y}4)!Qq(9b(6-9M`n<>*>fHb%1^X2J`J z$7UU5euJWBX!W>or{|kyOIfqZHre2twaR&IaRS7K{5FHFkIVsZ3dgi$K!DI`a19~9 zXkb2&O6ku|;2}%Tz#*2N!f{^G$|4HU)tY2Mrhn@gN&xAfhCYXx0GYrnNt0cy&FP?X zuJRU{A7vE#yGihpl1{Ohs^s;}lgsNH0aU@VK+R(wiw>)`6K!51j!!TL0*gmT-xOIe zw+DzfkVh5w!?nDkV+xX|KhY;#Nz+b?>%};GA3mYYI4nFmxiU>EX4AEfE*M7s6=q~a znTo3+np4xVrum3E){4|^X<7$UE-Pw-_kw(V1aWd(ot?r{3% zEZ~a;Dz(t3HP~Vz#HT$GVfPyw1Z6q;$XC##GNcFY00Z;G@S=@0gA(#JOWs*AeO#sy z<3~-2Uhorp4AW;*mr5D{>nd|$N<{TWu42HBH7x8lrW2A6M^H!Xq;N<)LMq`{SB@)@ zP&A%n;iTRg2>%#LNYs5wej?p@Ak9JY%>eeRR5YEf6J>(Zk+?Hp-NR{o2dny|PBHP- zaI6P5_IV4Rgm)0q=E)YZE=JfNueT9s4Txt~fLH}bxX2BC*0Qv2}z85dI*}U3~4&q#Hczin2V&3kpiN;L1-z zVUE)XxcZ{&o-UK9c0LT9^@)mXbjQC-*n~L*-I0}zLU;ZgPleJ=ZSo)S)Q)=TYG0E_ z2+#h_^`&(wFR{vVCFqGUA)MBB*4`28q1u$AIXg;67A*zFygO&!+7-2atH_jI)7aZI z<{HHpMl9ZnKzs zrFq+>wiKM#QiK#%T4k{bC;BPoy?4@j@=D%*X-^B!+n7m5P}gvdWkgOD7($cTAym&6%<`N(=q0i?Rl;x@uSTa{tUfKpHt%u26Krw%KB4BP*? zbpL-ZTm;|wbI09SpX==647jyifvX5qvRLXcoQa6+>VAyHpOPm_x{>?3vvw}nk%R}w2p#kHTm(_3S##dcnbK( z$A6s22{&1gO@4f|WlX@?9cTe{Zs+{knuX3hBZ-ly!A7Du!iCe|;+4CJO(lBYc>H`S zdLlzNP+1V@7%+Kk+}M|^uPE|A1{9Vk=-9)7dSzE7p#_Jke;t`dP`pC zsy4C)7<1d%EnSrefqf%r?YzkqvCFjWWyiCwYm3ZF z+G{6R8EPyDxW+i@!N@5euJb-SB%gxFnw}0sRQnQCa<(7W{biT?nF1ua<%uRd(69(P zr8Rni^%VV0yDe0f2c72{yF37P*wkkAKugwLRE*gKY=GFHVSzg1Qzb=km4cgGs@c5#^OfOW&4F zSVEix!)pl1D@6F@p}0{*LU^k?h@g-8pk5+s%kM#o`q_^f+l>x~`5Cu+1Dwd8;=9In zv%_49dAm6rPPe()@|9V`qww@uk->2a;v#!!(#G0JBY`?+s$_nDb!~lMeL-dU*Hk~z zGO^;9#eED8^$p2kRo>KZ4QiO#**eJGg=z6HUT4lSF&;r#L6on0Rz@~l?{iF@0l21;aOS~{^oz{_LXP|HSDte)E>{u)*g_S=o<5bqgJ0G3XTOD~-} zJI_P&(zx=WZ%Rpk3+&T8Y`%WYCt+rX)6hQYUBT17HJtXX;91`ap7*WbMc)cu_O0Oe zeJl7w-wJ-}Q9&Ljp)>Wv-c|JJ z2ATh>o10!m8JlEHrw*9f9$X=o?!gsio2*DoA#|aRCTb7W1A_StN1UImKx zFMEjhP(zUa)IGFMslWi9u~s^bL&MU>yO)akZt9!%n^YR1XIR?L7p&GW6b85kx&qB> zVAPW$FdYQi*^T)gC~iD^!OS@9kxLts>kK7$v{KsU2Mz^zSo`r==HB45>Vu@M9PL|c8@5B zTieMJ+mK{p`HtBL6kNQ}_(Ds4m%7bC#eHfp95@y?2w&E7D4VuzC|PEv0(8a#w5b9) z^IfxIh_Y+SwPgOUhSRGAI~x`?<(9HwZhDZj#7M--QrCD>q^@Unn?p$@y4wU5(>I6H zG>dy(xsj2(NLHq;FpHHnO9eg84OfOs8tTeQ08LXAHKV~6-qhTcph!bgqJ~Ns+Y45v zWdq|@@o(c^=Wgfx=w!UNt#_n$K-KZ zM17Mrd_mu3>pb-lS?AnIJrSk2on6Kq2T@O8m@%#f!Re7dv>S((;=xk`lkPF#i)9kV z8-EK!aM!SX;420g_l`(*7Dx!dE%oRAowam?BX)&4QAA^GEYu=mv!N5s3ui7@gY!RT zMMCiS2sX6FgzK<563(=);p2$1qvr2sBz9?`M(h`MkrtsD-laX0R@8Ws(1`V_%2%KgPHRMl1 zr-%p+c3vz6_Pv5lQG=q`N8U>Oojr0o z+zL9cIW;ljuW0}o#W(nIplb9_)sdkoqCNSUBQ*szW zk~4o$cL}H>gNMJgN~P@icbL0~PX!@~YwI#5wm3oD%ES-sFkle_hOy;!xPJNK9@0WO zRj&}gKdL(AAbOY|?aT@(%Z(E1kDfW16Ny|(Wxi#Zm$m`Gj0(7egU6y8FyKpwAaQ~f zkj}X;l6!!l0%x6Pw}ML1;pfT<#?1XdvH4s3h@RRbW=Nwf*1K|vDEp(_Gt)7^edWal zthq?NT4p<<+=aDsSL;wRa1tguT_u&2X_$Z-dO9b9Pwt^%s#I+>^Q-PwB$TIq0P;^7;r%Ub<+9O-=9Z}4C! z`LxGNe>qFZ>I2@1jxM5OLsq|Lx z$!jQ(^xkIFwjrkk*|+jNL1cP zO8Q*FjdR5PLcl^n-=ylLgaa8mPnTKfp;N{aYcLQBmV#%94B%ELC?h%E1% z3w=`KUwVqx75Ad6Mi2Yn2T485z|dzuG?g#V1JKN}ochZ+huea^Pz+)A42SDQneEu@ zuVY$1$@h3@7mb=c{V|5cx&$Q@xwiKO5`hLqYNwgd^B}D^i9Gc^%4(l};E+&6s>a=32~}0Mre7l2e)( zs7EB03L+5Fv>RPOZFSD#gGaNGjp)*`Tw(lEkK31oX%205N70qLWsKsE@~?IB!C)6N0$x|3bt z+qT|jBr6?}Eho(bw+Nk7W=6wQk-)wlUEIBT7tiC_Ow%Nx^RM_~jLd=3Ql@n40=tF1 zIV<3!C>MS)^+qmPznPe6|#Rq z*r~AKJp{ z@{&PjCx9u2+T%2(yQNl5U)+@v;t?}+aT03T3A@0@2-M!2~`|19s z_qiHWHXJ)egrD+g2d+iQ*MWt_A(6?sZi_%I7-iZ<1VPIq=lh9!G6A`8OUuh|ZTFshg#qJZ)HPiOUJw4rhHU{r0Z%U(nrYF1inP z${fb?a_;FvJw^!M_6?Xj=sb*b4J`FmKuYy!gq9tbl%l0Kw<2hht_lw$uy+;KN0kN* zU;BMLxj#ByP-N&298yNsELaApFQYSs4dWhk=^$#Zi&S7xZJFxOgBrt98t0gGZRck} z-yEoCk+o<4t1hvM)G{d9ihXgs+E9goPFx^TK>Hq|S;1OJ zh39n|uL7?OA{E~`sLvM6g9w2mqOGwN+I2RQHQU|Hy9YX4Rx2W;^UaPPiYDoq-9_wE(zMg6yJ=)MOu9N$B7VlN)eq`H`D$k}WqeuHl}n%4x|T zV|a&k<+zI=+79vP$s*UM>2pLrNU(Nz#PE{jNY`v)z4M&J`a(bWHuU0%y_Iuo;jGXj zlDr%_ZLmer+GvZ*{3Zo*2(=AJ7DNy-X88a)PsX!HJOYkFuD5QN>5YfzL$!Dx1!zK> zF31@g!D=C~PPB+Ud|D_7)(AP3bSncV!S22GWY4@QnH5H8AldoRA}+VSD| zqsER4R}i5=l4tya2C@x2Fq{ualT=-5we)$c{0R2PyX`N8IPyy$vvp}A@;{@iaJpwUSE+sxbuDZEi z1i&f5{zB%PJ&X2r)i9NJSw3I(;q(5OB~J982LrVz<_5i?_9F27@d?$YM`DVSBVTx1 zJ(O5IyD@^Qt_^UdHFV3zL}tkb`Fp?F`3isA;KrisHumCepQoDk7JJnJ?2va?vO&C{== z8a2N9Q{W`x+rY1wcqgneKx=<$^G8NOM@E1Qb^X7e6uAnbC$ufhuum|?ggagdA2>9g z)tW^>*3<&_c+Y{r>RD_-jbnuyp-vjSw}(TNC@*@wX%^Hm%t4yfWH<-r2Ji}~3%lV?IHT=LZMXZxW#)(EFOjTx_=eS72uCt^R zH63zdLt(>$s2IoGtcDHuBT-zwyRlp^FE*7)1y~$}IX|MiGB?Af#Y(!Y`Zs;Ij})2m zX_5L4+hLxFzt4rg>l5*ZFc1<+5B*frFy>TbFc;ZtftCnIaZ&SAqaKC!PE>$fKWKD39`gw6D6Pkg$N zE5H&R4{#W*b=_85n}6#j_|0!x1bEzHC3d>hUjF66ihzLS0ncu-a55bVCb%6TsH>XX z%%y<5Eo4`Bs8GA+^^`a`s%BkX(lKxiD;(KRH8^ubkTp&njr%{yvZB{MG}3)h(_|(b z%9^Upmr4RI(iCYEsl~Ut;N!~y_ljx(Il3W3{~kIxG|cjz*7s6@!~JLtyC!ra+7``1 zd)1xlm)a&9R|+kFMu|F%O4mtU2~wsKJR$_ofsaCMCanGC&DmeBuB~gNgVqP#A`YZb z@bV}3+mBD{xVayv#uNkSt9zRj%b~H9a9kxaKp90!Mt*_jTAk`?gd*1aUGd-zRPEBF~cy^Pf0o zsrK}=I?u~=sVH=XJ}uT6DGP}(+XAUu;8;IL`MtPPta`~7~?o~=K3xRi{AQh zo+lImBpN*Sfs*6II2~{Qbf$yjcgU9eP0KDp-5)e&x*2h^Vy!i$0>a6ov_oJ0eDUEL zg#9b$ZW%;g2{%8f#R-gLW!D^Q`gXAcx2~>-+~$K*?RyM2Ncg=y8$~u16a;vAM!pcO zHFaRHi{}0U9%R?UfxV>f%f(yve`$K(EXq#Y3*%BILdi+p$$zbdBgOa9g25r}~C+on^75Pa}zAoilp2 zgapGF*jOO0&0#QbufbQkL7bo4;`v}5V3%|DTXf;(sbFl%i@xj=`lmGas#7v1&8si+ z+OU3NYpEsE%xPKZpY%U?;bZVp;0g!vSGZ5(kP-{x-)LHN_$hkO(O(RgJJ~El-pfwm z1v$O(38}_|zh_RE`B=Rtq)VRb#!u$%t~blrD?*+Ut(V8_H0`Im3T9!v241c4HBA_w z#cB+-Eul4MT~RmwPFsJ^AwKZ>LaP&zW#WjGIcTb@d}g8B0%t@3DT*)<|IS$^JQ?xC zpSY9d1k>lehMWBy%}+k1ySmv1d@5V|p=~JIXC(tuSY!gxMCriK%T+pk8@~S(+&yI$Q@Bf_r_p_}AIt>VSKSmog~pN^gK@{ zVnCBSJ5C(<({4Yf(mz5@mD&d)YPAmF+`?PTTIM9d7NF8Zb)MLNW!CS9hD#E;gr-kX zbAWlvD4hhA4RY?DHraG(9$U(Fcj%(5Uov|cK$+J_TnD)Gi1n@C1+OryEkEXrc`RwC zR*)b-;WoiceH}lWn)snLUsORya4#tAE_R6) z5`0|yihs^wAf$Y*(zrD~lf^IrHe8mTE%xa###z~pQjz%01?nV9YjhjJOIlf5`Qw$B zw#>>|UnYzXtG|)CZa-e!e6r52FJ<9J>YA42)(&DvxPGvzg!}39fU7mEAkxyGO&I0&iJNTJKCd?bqJ7o@2Bljf-Z_y;fp z5v=0rKeauPh7&5B?c$$+OV0!eg z8fwjDlv*oFx!%OseEsd6eLH>mt(G?MTgTJduX z8@zF0r-vV_j@J9IcUv!mc`7ASAtu+#+tb*ivrazNbp{DvPAHmD-`^BBaIgs`ueMXU zjLAksR@orwUTKjAYE8HeB_4nG%1WA~Rhc!2SxS8+iUJHusO;re6oapQ6h!g{m;nEW zCgKT(d3*MBV`~JN%)e?~(-=sc6V(DXba;)uH&?j~O*}65^qU4shFsqcMM{I7qbqN? zPnQrCVW^stl%{rfNN81h_T%Ssii^U`RZMOE!say3Sk<7-b4dBV=IINg=09P> zuqC20C=%OR`_8RZA}C}^&uZ=ChZv=h*;Q%t9w-yAbkbYwNeJAXz<V4RTCF^7I-We-C`o8u-0?Nl4{%8TJ0bu)GD`Xdv%j_SOH4=;)hOxb6#r- zjW99t8@bGGTaplx;j-LG>8n`~1=*rDN@S3CbVPH1NeWuMANFhZiDv!KY*=dIrf?M0 z$v=O&5*>vzUTvmhG#EJ+bqE(+c%raNfj*Fbtd=$~{oS_M&rUkUh&W}=C``i3M5-M; zPhzqgx3~D(rmt=M+T?KMaZEZrZcTKcxj{PML|0_X-3EM)s{1*U(D~MAoOx>|{H^aK zm_s2J#0M37V$Oo!THK+$rx#cY7QjWn4Z@f*8P&&(e!;g>wPykaY_}4UD&A8kQm^SW_GGWwd!KB6Qo*%j4Ok6z!#0YPQpi_X)hND! z=nL6bq^VOQZcvcQ?IB(Vwg9ip&*wEkyoFV?_I0_JBke}p=}x$(ikuza^(wX&yxnQJ zL9sq^eIL0ur5#xH;UeDU$W z>`!km-rH|3KApcU>ma)+)PmoW;^~+F_xB&Dw}1cP75uq$a;O9N5&k)i<1B|iPbN?Q ziM|vEj{iI0iD1Vy7^NF$Y3AoOm_jPwT9HWdZCS^x@glr%TQI84I>< z4Ci|vZIbWXRCa@F#-QN!I_cqw&Z;_j`2?FvXYEW+MJ_@lmHEh?p1l3<)4%@d_NRZWpU?BT^Cs72*{W1KuZ=zP-N7udy=6U4 zy`>(p*4wj$0f0)1WoggGyN_s5Ex>s9hR`l5aS!cvv5QvmCczB1M*elX9NBaSxvGse z4sPtyM*g%55CuZgfyML8V(%2TNKu__^}Td$QVEN?!PPl4OmGw7F${&H`oRh>s1m%9 zbIQNXrNfPNc7A?wbE7l<@L4A!^-*F1&q5H%>lzz=XVbgZHnSwlQ{P#Zn6OgG8aYuc zSST@OqDHFvm|6Cu$nEN#QcRO@L^CpP2me{S33aFy>Mf#Nr@2JMCEBHIdQ{9TYe?xL?s~J{(j>2ty6~=3T^T zzY^R1^7V;`>gUuoRe&IYq~AGiPIo*_Y0A9}SQ)_pvG_dGbByEnVy?gQV%1LT05M!! z(|7v6X!=&Y=Fe!uO?#J>T)h$g5pTJjF@1fQ5fJHxhPd z5KeekW^om{{{aqth@kF33xhA&m$V#F8D*uh;^zoi0VD-OZXeLJxP$R`=XjJERYy4h zCg%vQpzCY-cnzl)>&|eN@1Vk(6o>BI0q zm;I-vewKuQtVqQkX08fgrXHX$ET*Do7H&g+uWb6T?9@sX)b;Xz7W{^XyaydtxhtVp39tGiU=N zWqU)peg83J_bPm`K71fnxDnH*7AyY{C4nK67l;AvNH=?V{YAU#5n(5EpcEx-6Xbgq zr)wwmL@=}JuZ6#5pqnhCUw7KrxSoDj@gB1e4CdvigLy#Pq@2njF7LO#gL2R1>n^(Q z1s76O;8g5iM+43S7{-R+l*n_{txG!)*+UTn_n<`U(6xt?uIn~GTyJ0-n`!Wt2L*IgB5=uB6dWn8Rz5~A~7VGFKhSn6;>5CVS$eoH( zoXc7@TaP=vS7xMPRKopdgkfdhZ&;j`T1r4=nmOD-S#yaaX9`_a#wD^>%bm>5MpQ%p(XBpF;>Wxk*9?V?}-+x{Qe z>tpNLGx*DmQ{-$IpPpMdw*D>5{~bRJFe#ooHr?053l1h17?z_)`^{j9NMJ$ZoOT^t zH;j&iU`+zKk@&qDzEHIGZA|nyg*h4OuBRY-U=p!M)Dr|sMy4m)@D{-A-Sczp4ZG+0 zXvel~+qP}nwr$(CxntY5?HxPWNjlGYPMtp8)m1Z7H8nLq+082WB}lsz@ia*8lXiJV1xDbbGOl515;P3pA+ zSxa(0@=-!8{V(lv`GElU0e^9Xcm z`>LCrt^IXKsQeore3&9?6i#J!D7Zod@u7bWARweg?v}h#j`A+>Ml_L%6rZc-_X@L< z6y6DD!}3oyn4b4XdMs)d<#DM1O9iDDr;7-IIniGKAEZZ5XSg9dZB~b(o2UhaF8+z> zMH`2lzucRu{a}J6MIZ(Ot0)4pDk1uCg<0S)IRfZ;@C;T=BnYCHP}u0(Zsk-1@F4DK zVJ1s#U}+J8pvfHZfn`F`>S{ooFCH*c@z4MV!Y~uy*9(5kI?=MKN(T&|Ct_$*Ul>HI zh4B03QX>bzmrRA#!16#0OLf3wSSJukwTC4F{?%}fDqHkxb2+%DFGKin@_D>xNV z`(y2%yK#F%1j+o4wa+kO+>7{^^q7ESSp;?z9g`=x2}Z!pxD=Dc9Gdz?6Gab)dum>* z5O7+#)=CnxtFXoh93lmqhIQQ2x1IV8YrE_+B&jeoQ5$vQg3JUR=7? z$HPWasID?_SHbdPjN4=5TzV%F6=*X{Ci4!>w27aH7t;)aYV5AV9j6PhK&7i@=yU78 zGY0%#!K!{$KT!$RS#*?WA5|^dH5dX%pN8<1!`*T#+bsnYP+bU&)_3TOQ+fJDjiCKs z&V%t6il~{6zm6M?s_Y;C&ZxU1)C1-_P{Af3`o54Gme<%hsHVYwbvH6mp&QAWX4$OT z8}E#)L=$q$4NJo;*37jLZV|&QH#Di-Oq44huPakD%fF}i$Q5LCmY9Anw?hvaA1gFV zu3^s2FtmJ#MHpxtps{>_?NDpMiOZBurecVsdM13A1;X-Tdn zFt~;@M{Uj(MD!kIAO*GR%wMtq)i*O=36X*>!ZB zQMHX(4wgP`2)GFH(uMSpWR5fAMb8T3D7M!s&)gR979JS?hJlwN zG15-z&@SRyC%N7AheIK}Sq&reuPVT9O(zRrRV4*Q)Pieyp+%Iy>7#x&LwMzo%$T3X zy03Kb%)l^w*So$zhDl);L;szjWFid|m9EChD~n02XLri;cMi^i`{{q!L>e-Jf%)3q zy+|^{BBz($VeXEX71B)^TzC;ca}r{a1K_3YG$);qbxY>OdJKo@y5zm=hREySg-~XW z|7E7TvcCNmE;N7&_C1In>Q?}wTEh;bB~-xXk^LMZyOtRpiFb(+Si(Y5dARx@*5@&) zNJeT;rdlxSE+s8JiUXZ8e{{z^+}#Y8&`t|7%XLM*Iz#FRuJ`%<(0@J#ycD~mY$mC% zVv&}r(|{S;&1v?cqCASw)5_doNXbV?U;=BI@tDdQ^xB^XQl6a)G2Ep86@QiAswJCn zxaEiv+2T1HGp1oUSw|6$Alyss3ap5?XRU(tO566NXCOUhnDi^106{o>(`ce6t!R34 zb~`kE46tddi7RJ{63kEWosF!B93^&%|J#InpurR}zenbx-7M8;XWA08NB1#a3T{aS zEERbuz4=z(eqIRwzqp4m!smZ*4|j%A2xKx+MM_cP3meBE$wtDLu!VtrpHJFw+XA9L z?PT4Sb2C^e-k3daUM0}!AUnH$YbB)Y7=MYY#-gcbmwtX|vm6?n&-{uP=NW>@=v>0} zZo|<1+%rNY&WBwC+cC?WSMItVp5ey&y=q7PVb^}BgeTxlQ$hF0GT%CZ%ni@ed8g!j zfc!@?=b3T{H6q71!AyCn_Byh`nFwmPdpeTDV4QQkaBI=M&aS$e|1KPn5Q40ILE%|D zwR*Ttk?@zs6|s~KwaV8sy~_>IXTiVBN4f=!0=PG1sA{GupLzkic!}1XY)YE-ekYPr zeyEbPIW=S#Q5C{#SBRk)Kea~XfyDVvGK=Yv@R20WtVui7vlazT zwU22S`6kGp-IDf5NOBB;wIj30(pK4k$^%UTGDo>laa66yHoAnd^YmdsP~+lzD1N4U zaPW5cag^6#Rvsdw$i#Afj-hXsW(NnJ3^O}na^_61P;s)g0Dnei$yVlnky*K$=rly@}GD4tcWCESH! z;LE)`hTn>xyAx=Ll6^qL_N*y&diog`F?Qx)Bz5B8EuYE(HPl^E;aOC|OEq}qS4de= zmT>5Q2@rRdn{-U4Y$0SžRUWqTl?t8?wEqV3RU>m?`EasEZ*BaMT2aTltAK{+_ z8Ah;BtuA&vozq8?1a4<_emSegKWzbCdnd+X?OJP1er;q{iEu$W8IL_0PM3o}kzaPZ z3;)_efh}^}3A*3d#VM*F%U)7}<_RC>`QfmZ#>Xo(Dj`-5Afn#$n;SgMKUpczP#myB ztu=Haj$)nV*J_M0!`7Vp=X&-H zez(7!!7}MWb2u97X9?h&iF)dF+Tkp?Vm z%&u@6a4TgvGMkE=jpr5hr#hWZYIGDXTO*~r}j7W6XUI)U5wH~8}trTUz?Hrz^ z$WwFy?GsBNZ5wNJ7-43d(sDJj<1mP^1>zB7%+N}%8a%NimYi2Q%3K$7Lko#AQ> z<(mQ{!r5s8i*E(USp;>1z$$1YGj)iye`$$=Z8x9l(N+`f+dY+lC-|j<5^#7XAUqt< zMlk)oPk2fP5_icNwh0bsp&U#FEXgNNPtnbi#Zmo2Z~1mQ|N7Q#1Mhh_jqPmUU0ol> zuy;~uz?MPIEtTz{FX?L#!)72j zd}Us4tYp37eN$J{iod#7&>mPRbV(krnuHfugYOy_Q0DLF{dY7X+dk>n`q8ME)(A-U zb^xmUsq0J~2NR=2v@i@S;xGbjHYi%%mQ1Dhc(*OLFE0vDLID=xcEgJCKLq3-0`d<5 z`Gi^h{}7OW2*^JK@fv;>E$T+@{wN3|gTYX8>jMiI2KcXTIWWR&=5Ocqz6dn4f6PL1ibfX~D<1e8xT1?ffAg3L-n8s-Z1&;V`<8%ZFlwks0 z7I70m)uj6oeqB=WotmLQ={%o^flYcC4{b7RB`G37FPzOxnbuSY0e`R#kPT;pI%Row zG+4>j&9F9KzI1}U=9Pfs(#3z@+PTSya|>tPJ>t2h zX#DBX(&c!;#Ugmv@`>Bu`A#MDbzP^6X;c{e@h=`P)@MS@I*bi3>t}^jmM`!zpbBxt zB;B&JFB%$kb}RkcnT#yn*+Pc_|FyJx3SMWMGU~%~x}UJvv9b3Ocz<>b4+1h9oBB1>Tj*Dcrd(2i(e?e-G>keg<}o z(`9Rr20lL}W#vNuKB>qxwc-)5)-|CcIplxu>wan6uv30pJ|Gd(FtJ|crKf!ZlbJp> zelIP}Cc?*~RIClY{%1+qkkZre9OK^0WYKjGrU3H7^NkOhC)?HwZ(=~yNp2gBVFisa z{3-MKv_bx>PkoGQ*M+_y#@TnTxXoO}9ce`N>yI+q`UJJJ)(9m6pjFvdosjXLj~Sz} zYn4|+pI82B`yvxrPkLT`3H>qn;?Ib2+PYqIHJ*)eK`=>#$3XmDrWpVd!EcL@MoRq( zX*`mNv(+3{*4naNl`b~GtF*Kt*b_jTBuC1ywyxcG*a@Dry3YUXCo47h;lQxN>7!!> zD!s=k|7Sk=ke=8$6pZ=xe@^Qp7bOo<$I2lm@8Zo$;$Z3@n!AO|dH1WLGA@Z#Nmb*2 zO@dVJNtC3W$sBUsQUwiK;P4EujSX=6+#Mt|yMo9URI4;SwJmy?h+>M8_jK=zRxgL#VmaGRJr91PK8cQ>rQa>PeD3j5QsmX zLkQs}^H4So=Njr4BpKT~q$qUmZi@5+wS4l`ua2%Xncbq5)F6FQAxM1xdsfFNg_m`G zx&I4HC^+=^Y~Ghiot=Q%JX?xeVdfgxuJ{|}&Wi4DVVd2egF)wna7;6BMdqCumA>DktnkJIVkvDydEA3* zBqm%FO{f&y4pAi>q8>rXK!mtYSUUc~1U$@&C;}i+Eat$Fu-N3cNz#;rj2zH-k`1xH zDO%{?c8#?}*KUpURSBrVgK(}0PIOa}Ob_LH5uk!x%*9*`qX$(e$RRPXzoDhph=((A zB1I(aha4uBc$Smz1M5!H1nF#1>|LcH08t9}zdtow4Rk=D)PxT{NFF{6t28qlVAe0q z3u-+uE3N$ii7R|BMx=YSC2ltaYCM#(l3{9nWWcgPcMM^a)i+fUENvF$bE^bRC4FST z1=}Y0ZH)Os9>}u?F$U@&jd=J4xfuc~GorYwBg}xECZkg!C1F~PhW?$&X*+|or?f6K2)0eQl*o;45-CvN$R_E^+#sSpR?Qs!0#?e-m#nyL!;^kFN=jIc`M7?VfA!QlvPlcx7HE07$6ygh}0T zTyfE+gEH$wL>(71hN|C%6`UeF$2m21I%3?1gciZPoPuXr3U(A7Um&;xLB!3t8kfx+ zo&lwaYJkfz^CwPo{mv!|*fR*gKJW1@&QEfObL zE%tw0*7eu__hp@q;`u96v>c48VYOsn%6aIbvIn4eox4uNQ$MgL5!_kXhJN!PWfkt9 z*hHxTn#O+zl*5fLxIC=)b3D^P&RuutJh$qETtM(Vn8`e1WX1P;FC$g%dP3$k^jw8> zRmU-9es*lbN zE;#FO^F^Z1b3&1V41S(+A?WpS zZYcThJU!0np+~fz9TKU74s0ymDfz}cnKOjJhxzHCGAy8_m|Z24%H)Xj?xw@8Gr{Sf zp2!RKRRcMb7Cn!^;AC+}TXp01E$9OCLlx#fA+xEf*-uFHnwQ(GbFBY*W2!omNwlMFP1%L;(Iug>&KewUPGRosl@ zWV^al=RyRo{c#Ut?c5Yaet5K`!uTcMG}-TdmGPU{>>24_b2-qN)_|@2L}*j}F=zan zz%x|Nfn2YJD$uJgh4HfetX{PVe~G=%&oCX!z@&b;#>lC$d+F)AfHF~T?3#19h$W$| z<7OMW!UScG>^AiHreSP{4<*5fBybxO_2r z&oBjYio_NWl8QE=oiP;{!l-xc$orMX4!U%HWuZ*u6BXYoE zKg{=UK9AiUY_`O$Hx>J@!_>@pO)3l3=b0Lx{t|Ys$4JGx^3f3wGI;a+4lGj4zI=b% zXW`dQJyTVb9hpKzfUq8?ALS29StTD=?fs=#k^ztpXMW7=qkTytQk} zaRr}taB{qSFAA(eu9J_#5GPaCym8K32R~X?eX+WQtiEU$=pDq#{I#GxFQJ-BSzw60 z3|c%4gP7eNmp5;QjRKgX4YL+gN0;3+$pz;#&c`lQqC~+s?=PNP~kKQ(O#d8msNpa(?wyhX!1t;4B} z_ajvK9-x{cKdJ#;_(`|Ia3J7`+8S+9LWM$M3jwSG7;!dU%6+E!6pJ`HbgJR0aStHc z50;2{gExjdA%{EOJKh_&&zF=tqrPxm6z#%GoD+DSN0Y>@zA|Uy=Zie&JTTYCLO+=T z7r4hm;b3(X#!m)?7KkRuV*_Yt#XdMH8>5Mot*bjMI!Fh!jakE+?_4rl3?Wx}sas)j zq|vAnnJ!d99s&h;Wj?;WTB*Ov18!(rIt*Ougq(*&$uH?k#Pt{_yglK0#$p$!gY7I! zZ?7|kORo9YTbH|?RU?VsIRoXix~pBO%|sE$#>Vh-8D$O~LYCw^yM|?O zXoa(Q%4j%TH+?F-;_EK>Q40$8@P-%9M2QLouGL|%T8F0rh{Vz#zKD^D(NlExa|@(= z*-5rsFdRhxz+dpA$w1I`L$|UALo*n-{I5a8Zl5jcS@iBEREZwxXvxXfeJOdOH3OYP zeV1_6ldXm;1ef&cn@Cn2DJCg<_qynAUvpPwj);}@Fz~!D2KmVfNyA!HiAqUg4HelN zh1xm`zT0nG_VFZN^oKPf!?Te$;hoCu^ksWop=;FMr@KihtR2gpe`k%4M~bYQpCYf= zeyG%hwxPfWdCK-|0ioHbIXA4>w}Bx)SjJy}#rFKV z)}mq=lcR2OU9utAJCSJgl{VVdIWNaH#TU>cu&`kwiL}{y2z1-?I+hF{W6FH>&J)s? zV3<*ZWuVi!4cwle-mxmX@>G(C-FEwXXZdt|UveP*{B`z1u5{{mr~5s7NY-gYa#m{+ zX!_E%F6$pVM8Tn>?G8?efl~esKO|h?*qAh77Pp0)oN3wJXKoB%d6{{vWUUbTO1^toSN7J^GZkK{ z;_K&$J^SaE?W9;&tXaaj3Bf*lhy+1iW{bmZqk7SdL(CLjZQ6{O30*n&H_W13m(;c~ zDDd_4?hcWt+zPw>ecHJXfD6mch<9?fsK}frdQe2oz$^DBvl`!g4m{fI+x%7B7R{$DE z-N)LKHxR0ks1^YrMpJiQL+3{E$IW4<_oPuffB!6#GG4WVktK1xNA4Ix%}W9rQx=po zEQ++Ndh_W>4PZz!6`aAfUHf#=5q`JM#8+Spm~K+oFICcJ+|7Yb}V81 zdn*ySJOP&N<HJJ*flOj3B)EQv2{m5Z$>_`}pEWZt095{yKmJ za7z%`krd7o3)UJpQV}A;?g^qx5Ok+_L++cV#m2+lYCaXpFcx}@^*|TD4$ro$B`DKs zTrUO4a|u!otq>IpdL)ZXgv^CJljf(>shvo~CPueOy@AM6V~O|+6Yz!*!rmCt$rj(X zU$*&0;W30J{n;h8sI5ekD$U|_`3$!L?px93f?=5{w}`FHg?W<5ycdw#nHd%__P{Ed6A@L>Uh zb{|o_q>f0hS?^5Cgycioa!8UOf=sUw=}|F-DP_zjpFD5Gc%jynak$! z+Rw~+F4t^YZx)8Z?M|ls?kfO-v&u6y1OZg{ocAzIN-0}%ni z!XFn^1ZVrX@?3nscl_-B%!1e)4k3CeZ7rB#rkfo{9N(~6R>aGP_41i`%hSjprZF5+ zUeiaSfMRR*Ta`hr2$cT*p3gc7z9-P$CxbW^_Yc9dD0rqp+4J-Zq)hHI`%tBM*PN>U zUKOEMgP<0QI7X*M|7D8DY!M(E&b_ z6>D;(iO3|B`OqaYl&XO^1R2c6HKN;LSKlZSYJKDf0ov(Fc&ZlZr%U6(e#qvl=3*kF9p#3phA*0qVPxzgClQJx+MS2jNBwf(_Br7fIlLgn7x*rhm^mEF!*NwTP_ z3S{o6u%wQs1w!RZE|4IiT^cHi&IbOn)k4sz_BV^?Vym?_PM4If-2ggfRXer|t|{AR z|7OwMJ62te@yY}6`&D@;c7I*PRXW#Lgu6w3P%T==m6kDJj1x^4^^AJh)&;{4SC}Wp zpwylPTsH2Y;FH+V5`mkB{u}|%yIrd2h@2BWu#8vBUz?%dEpN)2A`^d_qjQT;z+$|DtN68qXlDAGq1mR4!Q zW7$nFWv6^W|3X{I zEu&v2_+foSzfA@+eLO)qqmwy-ABKmBw0(V+VOhhC)fzGld88~tM+HCZ#9hi9C}wTT z<{|bRC>!&~j2Q^e;MFqqQ^4$2#^k>0oX2NL1OlEN@e#q#-`VYBwx8dU>FGf6ph{BQx;g9JnBM~XvpiQ0}DCa{GhORBW1A#n^YyA=!rPpN^|mr z=VU3Z4V*s)%PkpLoCuSCIW0lp5X4I#Cz~MJ3xLS4nU2hDNXiljJ~hPjrf1;e6SrrC z&x;v#f|yG6yh;+qO}yh=jcLGZD_U0gX_xcm#tnpJTI-z775{~ZDEj$x%JyQ4L69wa zb4kM2Ng`+I;w+x3os-LsYUK4RE}Xy1d~B)~8&m}<|EeilhO4U=m4QN;z$;tW8GM>3 zWn(mimlGZxa3?}Ye%1hy1e<>)**4hE92&jRRrWy%!#}gBrx*T?A}!Q7lR)D#7E#yG z^2JT38Bn#B)=*D{f6nF{YJVFMEx~`afdp)lV|$3Lzxirk3O<&yi6i!1Tl4Lh$e5&8 zm+ehMjzk%DV{uhdLev-b=K&xsmhAF*eSNzJ8xolfR?HtOhWCF>i9iPNCxQfcA6Q;~ z%;n0f^W(QaW2?*KQp4NP`T7Jqh5Gw&^)j<=;0016tAg`r(7^JjomfyRYWGtO>ir&V z>KR6d7jj6%YVM7hnKC?O0Vtwh*?mTj;e^JF{;uqCPr2pmPrRQsy-5#TA6-hspiG!q zI`{VbDgdl`v^PB%WJ{jb{LCY^ov`U0fKxgzBf7@IUX{4My%crhSMGVQva~1HPH4y$;pcBgVDVT8sX{dn;NL7P7!A);jByLlG|aWQggp| zy|xp>&ib;$^S5VuoqMK-rIUBrsxPl#@Late*ZL_cZ>f~qD9J)Zb~+;?`k?Nxs0~vK zjBAx?CV{P0hM~$~_9NQNlf)^M5Swo}7u@TrGM*q_=Mb^bf>1AM&p_XFun0Jw$XKC@ zqOjPdHOD2?8HdM})GSpFtZ{Dfd##0v=^X1U3+nwoN=vA8A?aq8DS{i_4YS~y_Qz<# zb9jP^1~~FaWonReY@<;|hD0)rdutb<)|pkg+cb zQXv@H4l6S(Nf#MyGR2MmV}@k_u0e^$E2N?4=0i#b(35|U#MBnFR9C(3A>2_^8f-B@ ztU7lH0V;a(y%E@-wCP?L1U=4eNqBovLW7)?#}3E7Q72OEBMc;X3X%95`+O$ zvh$Iy_fG|hVWvibIJjIt z-iEtLl4;asqn1GbTeX{BR?a+DrOe zdU>2e$9a-^5p9i_hJ)dv;>spME<#Wb$;4ap=l2k#^Kn=oog?IK1?7kZr4}_DA~8kE z)D<{KyhqzS>4oNc`GiWd z849-1qb`9d3ui0X0w=>E%ZaYd*5V{KY~FQVmQgLQq%4^%!eJTbM!}8zoeR9dUDDX` z*0V@HN;IVnQD8oj{O#v}Uo${=z0t9XoX+?1+TPCmp_k9itL`jy75daq(1hw%xVP4BMg|o6S=_4@#L_uuaKThS>Z2<9fPx zv87VuNJckjH=P+~*)hP433E{-o^1D#oorrS8AHko?){(Xr1hjaIl7l5PA)sy*^+5? zKU-qxdD!H|4cB+&z|i%f^$71QkoV?iwf)XoPb1Nw-7?|@QE2B!7f=C+Kn+I8^N)`M zxZdw>r{}NjH$*3O`fNj`U`ME+w>ii(r~?k0tPXOgWb29cGPEoX!B=PNfvuqaLH1RA zMK?sn$~@Dv^@nkCO;M*+WSd5neFKoY+JX1-iTr&d2GYcjB(&g=A@{v-%Ek$Mw8HM_ z8D!UJueq|IHE^9`&?L>t3qT%o2I^*ql%}1vH%4qN;3sa^>-F!a__fUC!C=7(GD#$) z=JJ~Sj0E`EM0sJSBx5W(SidXb%)XmAdJ16E;-1VLi;NkzNY^a9LFtpBMr9!Llu)%y zSKq+xOgo=Pwo;4%+JQOp*x#;@Y4qxCz(*DMxh$?s2KRxE>%1dl`>42F_FK-qgG`a6 zE|MozqT3uf0pevWe=ZMMf~lmP4+M39G(o~me_0to=T1_uhY4f|SMEN{<<^9N7|RSS&bu}`iVzzZ9GEp`?8l9~!j!Pu)v zHAcmaBz|s55W$(H5BM{Q4f(oCa~T*$4iI^yG%50qJi?xCJhU2Y$=sn+5Vn?`OGz{Q zXH;1^qtJ82fTicVf*>}qGbvFi@ms2ues2~-B15rj#I$(;szMS{o(?pSa7v_L|2h{3_( zt?MXu;<{E5JIkRcn2=rL=?!>HaU4+Ah|>F~s!TTfQK)e_kD@7Chix^ZVG1dlMx7|# zKYOvOHss9Jg@!fDH$YOwKu}5SQh026LA@H-6J@%3sFJHi;t`pHCW>BBbMP2Jp;j=) zBLVy5ZVdTA1PPqhW7-k9TsQ~mB?|J_DGjEUlrnbj%R5b};QV+f7M8dq0n89*WMfL$ELpM4O}FFhC`pSbTXxkc*M8(r zj7uVDn)!J`wn&CN$!c3SHz-^n6HYUbv;At>3HP@z@t^svQuQ4a>yNut@7cR5J!xhm z$mbGC!*YM8%O?JWjtAnC6)_OYY7NQ1ZyqdDgRCGD5YK3kyOfP*Jq3(X9%)w(+vprO za*R(0eqQtnQI59sm>0SrxqRKkmebPG+m0ttbxeXm%TAa?<(L~FYMQh4AgGK|apb#E zUwc%4TdVZE^Z^7E`}UhI@PsVn!I(NzS;+`)sWf0Yg`Q6fQ`az3d{9tEFf66|UhQ0w zZvY$46<34wfHS_h)wKZ)#j6sS8DC$SzLC#z*+>k?i zNpczjGXB2$CZxIN49{(8ArJ5g;2^c!OSuooD>ZFCMxajy?Ze%5!jJD#)S5d`-xpmX zgURh&B#=x-^J%gwDL2YYViiny`ds|z=~t(k>|Qrx@|A|v+@^?1d<%ER#?)^bqz2r_ zFop7*Y4z#ehnhlc$cR+aLH%2cf3I@d#L?YqYQzV?sTruI|y zVB`H{Y$Evs#2P(7h6-cm;|8=R;-)FJ*1>UAkq^}lL~U{K^Tuel{jk(}xY-KsjqDNe z&jYI-8js(o>ec0Bps(jvZpyOdSq~0`urm|Cs3cW;PmW&|aD6J1Y`)Z!3kp(dtzJ!Y zhSeT~6nl1pn!!deUN0$f_zqJc_*y=UJ$xWI#~Za`9R>Kh*qtzB zV@XByRf~X@H%&-P(kp6LE$hfjla5#6l&|d*#A8wR*X<9~&3N=)6{{ZwLbe1h2V&m_ zOy-jd?sS}8Kgk5K&%PD5JQ=d&E4996omGl>lH=B;;9JgJIcRXj4F@9agISvTyVm>R zeUmT}WCErSHv+ob!-eP>kP<{MERZ4UH4s@GIqnVY!Y(*ED#Moc>aUN{GAu69^T6Aka9Y`~!9f*-<$^Uc10U zE#=A2b_JclP(F(pXTAed5>2*fNN}>a4cP9dw8=Or`RBUsP91bGlC8gmDP;6XY266w zOs?Um3!XkaQ>=N}R(ysX0+qR)mm1DW(*pddYGY^}tv!I!uJhcw13?&`%nr$qMj`H5 zcQ(=FITMc}k11j*S`Ig(sk74d&gW2x)GlbyeaAE0ZG{Io=J{i0B&gm25z-dj(P zm41JHe8#QVN8!SE|FWfGK2yGtuVKnypSB=&nd&G!8MVtcujPYeknB*fF?|PA=gNU3^3sK%1UMiZ?VL4Va%tptxy7YzjyLU1P6HVbUTeU&} z{gi1+#g0$4d*1t5dR(aKy$_ym3EK>GtF4k)L1gnJqjf~wHTX)?AW@=Gk>norJKXDn zo>~$UN{d$a)R?GE^8^Q5{}COoj*$}{UzRdm(HnN5_CXfkQgg7nBdHqkp@R%}s(ipL zV}ff#?I39{N135^Yf4gxVX;>RUtz(t-!ehBwuqr>B1%iyx=WKqqzS0kL1EN%>~XM! z8n`Q&)X7->sji`%nf+?jvs16ztHdUkvY}Nmk38gP=D|ssbvfD8GP$7AzGT4c&TU;- zf9T~&o38*e+g@{9!t$H7?B?lPY_S!O#jhI1PV3Agk~eADuR~?HW%SzPhR1Uzq5|(# z%lrD!j$#4H^>9L|iSs!Uf9k4gN^ahz0-M{kOiPRTk%ANE5MfwfG$(i0)Fh~38Cy;Z z|I*?O(h)%TwakfV-<~uf7_VIULz&Nqu=?anvGOG9QEs%9+&2K!N1wtx-d%92I=H??I71Ho$6SqXiQob^D$B;o64>g^S7tvZjrR~ zqIGzqcjXSGf)|xILfRSSZG1eurRHIh)*p%s#f$cK&FkK}#8o-$lyBPyq*7oigKa(r zyKlVg^v}&ZrA1yTO@UgAVZf88FnT39d5je$2E?LxiklRjP6PT7im~T=KTOv)Q|UqF zT&YYi%$^yY-lg$=sg1nZ<~y*SkVaf@IH+G4`G_jk=-n)Qq7iAm9^1|#Sr@)IWcf4H zu1t56$SLrChj#ICmEIIyufm1)b)$>Ip}Yn%`V&jFA5c9yG`*~~o{xN@xW5U1&II@T zG+$CfmGe;&RS4BJQl(lgblqa?l$=L&hF?&hKi^$f;yeWZmBXW;y~zs>^PFAg!rFXM zWvR^Qt62BLgKB&Cx9|qn#Yj`y?)VL?z}+QY7!FUDJ2xuU!%f+=E~1}jMLzKaLW+vJp3y*Qnq*tsg!S1jr*J=D z!>69Z(rgZ!-5wn!Sox?LVfWW8`M2JyA$iV8D~l0N;BEg>l?93CF#NQfC5UXVmw~73U9v@t2Dkdg@;{uyl1t2$juJO&#_NTlSLI$i0hVRHd0!Yp#m?3ev1B8R#lzB`I^uRzBWaHs}nZUf~-OTtA z?(uKkR}ciRVjvg2?0S~{B3b4F2$GB?xO^&HNruu$s`8$T z?#}0(-HU z)8(AFsNc=WjRlm^As$vz=~=ho$}MYfTsGjgq z8V^wB!6*F4Pq0@hv!u3fJ?;(CdV;4aGQYlBXtAsnQ#Ld=$3Xh4}8s~bquNNz;?){P|d%#do=(+_Vbj?Rkg;ReO%ZSEMCL!&RVWJ=*(_D zY@OMYsRb0Rt4qhOnH|;{gf4G`!>M&1GGe>BWy2wot;Fe#!OAL?+q?=Gr8t>@hpL+Kn~6GcdzntdxZ7qOv4T zyu0QR5ay)4aHQcmVtN^@Scr!u(vpmAhKv}@>5ozMe&dfW2#3aby&o8gk?iBL`))6u z#!hK^!wZ(7%4=S;x?n$DtFicKGQh`hmqi@#+yIW=q~?zrZ?_*of4z4TWAc=FN{Uyr3~HLGdO7ij0r2@D^ay_k9cUN(A~+I0Q>(*hhj? zdBsjJ0;akt=eSu)mOk3!^54jXfPP!ngS|Su{{-~)>5SBq9eG*_x@HdEE>KtpLHSKT&cbIVawP8JsAS2C*qWSQz340 z+zZJJMS<}Cw>-Xm9r_*b0)={-W@Y2HI)o3ItAl^)PMFc+B~^*5*=KfITmBx0gn_Wo z;ULVIw{N|Y^w!6n%GbOIozHC{`fv3tPQnKdM*@d9GWpdwgO*!55Tw7Hbz|St{lMvBmN@je-HCyGaz(jd=oFn zq9yYzhFQuh=J{q;o<^6}2y7=1S4~0i>`K}A^eya@xFj=O8O}?5p$fW_ zbu+^9ugO<}&w>f96CbjzQ55v~3c|(HURG1689EPyYQrL17q#h=tc6zH_)6QJj#}3i zls+m4P+lhS+8E?s2AVDRY7Y4%>mgI#)+%3I@#(>#ck)NSXbt%gaSP$WB|~dnY7X>a zHrgSmcrETT+st9|GJx2$Q~2*MLFtwWCf4OgB5!1ULoZubd8aa6OwPg}?4E3oZ3MZO zQJ^i>6bDA;3S=;op-9kKcbI9u~R8(fn zO~N$FLxzl;z)Q{;mZWWPSN9(;O3%@)p6|)a>K;;u8e+%WJXbd;-}`^#zptHJv6q$r z07cgVuEJM<@eF`DR-D+??TMA}1O=;$LXvrmQ$?jy&d1Z1zwQzQp!U71CCFQl_K_}( zanZ^~u-1{~JakwSh)`3!v}%-c50$iecrVsRT9rwz z+Hs0h((p@C?T`oZzJ$m&7K;t_X{jW(Q94LUDT6)^OvWT9N>}C!|JJl~cs+8$f)e8s z+qs^x+Do>Gflo%P|w@1p3SxgWv!Xh;Uudh76_p<4TqVDEUpkO(&hOT(iJ@& zz?yu5wvoK%`gN3sisHDW5>fMX$uMP)=+`+YBM739?-+htt$u~-?$sh~%@p=VR$2Fw zDm2k};pwj=^J;JJ*np&5R=|tj-iID@1c2n~01na=eYcX(H^j1kviAXl`NSPp?V_3? zg49|FGr~LsB+g;A-z=6W&84BczWO?-X-#n&VS}1^8cMY^RP|_YLL5%vwtXqd3LrND z_MPxRB{5hux|#|92V?ixBw7@tiMnjtwr$(CZQHhO+qP}nr*O))tLF6FJAH3-&qU0p z{R4Ky%C&dqlP@Q$Crb8ICGFHI>GgW{9Dzr0HpK-+Okoym> zre(2q@AR*XnjO!S+Gm|w-J_Z3u}-FRO_UC#xRK0RL2L3#=JAa=j2lZJO)L^d_BoWS zn~>smdlcn)t5ndx$S{6~dqC-t?YQaDOJ>D1|lScoYc0RpcsR;cA=}O$st1`Dn9BD}ofXLW1%jmDSo0 zbV#B?o?_&?t?2snxy-os&#e&(ej1^Opk9f{j}LURBz^BQo`R4ive~1yF_CSqfwDm5 z1vDAH$y&+WSED$6ztG4(_0?tEx1(c^@pI{I9UWknbaZabl|$7t({Ztufx4l42dq^1 zzJ4gXW)I!o=ZXx6;4xo9>GG-DI?gdlIvTgK8A{IVc~u+#;ywKkz)#5+tnU_dfX^p5 zp^v@~yHDjZ-sT0%0)8RB;?cbq6~mnFcbnsw0nOcuKy9SB(WT9CJ+URRh#iBA1sy}6 z%gINmUzO9fV*2h^ZmD^ZlDh)Of*K+LlgY2<`t-(KI#r*Hd|58xZ1 zdm4J7U%ELp=G#fSODi6`SermGoUL)w^wuE)1Mg*bazqM}`aSrXdW&mq)Phma8)1Ae zW%ZQ1JA7|x=Dn7+M(oe=dK~6kG!PtMxi14zQ{dO%GjNmY1x#o4$f6zj^~FP2?wc@A(}MD?#=D!GSCP^T+l*V*Q?msh5TXr<{TEuktb*oF1C>3TIv7 z`|$J9d&L!K>S@2>N2GgY_Kd+m@B6m*$k`+oxZDp@FMNTWAjgnyNiceBdt;&UK(!s& z8qUGwBe59>RGW;F-84($P8rDhkQELCU_sBswA+s5P@4|ukhHR0yM>D}yUAZ%wk_ij zi1K@=wl}v^(;A1WRmN5t7;Qk+0G>&^GdoY_>u6Tut~#6EJq0qHcG?<-cFT+VhB}oW zJp0gzq92FIR^(X9Ojq(dqElD=?mYPcqZtco5(4A4S7tZ$Y?ohOpLBaq8gz;`&#;SN zRy&zk5Vm<_&Z1|&2O~4*z{$d(Nx15loetK52Df9vnQz*5&lH@JcIi!h1*C|_ZwVys zA2I-1*DFPcBb2zKi;QVS5T#!?5Kt6RwM$nRIW%6=K3#g5$wz!e>Q(Et zNQ$w*Z>9&L^uKYwQYB51PUmtVScyx7Zg_>LP{cP$bRu*u?17*>9#8R1DkdSiQ|1Fi znHEDNP>hr-j2!4*jYgvIx#Pat-xH5HBzrSf}EKXlK#^+GkH@se!i6H=xo+meel5@-s zhU2erc;E#Y@)*IoN-Bsj04CX#fciJB<&mU<*Rz8+-zQdt#yDt^8!1ciI1~Mt2*Tv{ z>9TTae$=Or)F;k%LQ&m;(2CkYQZ;lPvqp7dwE`ff_Y-c5G^CDDN1r^h7|c7e2O-FO zwbJ*lS2)>>6|R9Ai@pT~(R?}>xnEjZ6&?HZEf~+m*8;oqr?~S zG$>UBxyRsaPjMYS9mQ}@E}ewSZwsOAOv-4%KQvhR7`Kt1xA(A=t28+iAC^|o;;1Et zcar(IqpyeoO;!XH#MofZiTXLIl2jx@s#E+JKW-=uwX*<&!s0Wo(E=`z38}aux#yb8l#jsJx^&01|jmJlQK`E(2sW32pvwkM zB~{Db!1&_rIjw$e!bWU(R-^t3giJH6Ujg_wRWaV8pjGg|2o-Fql;VToJ6~lrAnJ&8 z2h|0RXC}%V>zbfQ9#PxtCX7ty7rxDjbZJz&e?`9hV9^B>Necg$gr$oX7TT?1qCeD= z#ss>UqA#}rK-?CcibVsf9YycN9^DX!jj@9^84QdGMAZzA_AfngeFP+&oAMRQi!W?; z5vb@Qr4T#ngdk@h(w4yRs+)HX@YcVP&_C}n1?C;SS*3h;ncU8tJ5XHp{Va@!N3kJ1 zB{DW3?n}>R-2xCPk-WS&jg@9yZY{TZjTvwSD-82}MhyJx@{_{|NmUQvu;~F*Bwug% z!BUjqhj7;DmCAw=hq11i$l5sscCrWHs0{lF0AZcSwjF+t`-oFQUaJ)d{rq)c$An%P z5%OxGEZ1g|&*Kv~=c8R|N}BeYE2YqSfAK;v!v|%~!X5bkkFbx_!%o`#(;{sARoKTcQMz zdK6$0p{<`*3<_a_sIF;i`fZ|^iO~>MLv(V)nFK5QRSQB8X8o6F(dImTXnsXeJpv(y ze!!rWQ`{CsSfF{&jlydnsI8~xfty7)qGBnbr;l*2jL|7=vCfb`1}8oZpF?IFJG z@~3At_*7mej=*DY%d2xbV}ebeza|Ma7QNMt*;z>e#XvNG4}_>hw!`D|>;D9FoMkFN zp=6=}A@nmP1_3yT01D`LbY<;1pFTdrL%@BXJUgFW40liW|L*$)`uBbBadO+l7pzuR z1@qCgh2=>zt*o5Ys@wm*{(7vnV*ndb$T=0iv@d3AUiE+(pp1QN;}t803kKioucFr@ z{g7)Y{cK+0Dl>d$XfX+sE@g7%-p=#06r|$K$@sj5HECA=CXdK=UaP+uQhmFO_y!+w zP2&3HR?G!F(_Q4(dK%Kyr_FUz37Wsmfz5pnT5sT6^Ut!zKri$-DfhXv9gNYV)1!GgC^y5 zL$%sYQ3^Vy#|ah94|ShZWsp*MUaD9>0BAoi97+;v6w!A5Wvog8kPq)l$XK4#&2D-@dD;?y1%~i%$Du zQfjR$NiVZ}I(YkJur0@AFn%Gf^9w`_;F)(KbCZN?4~-Hs9J*rUXOAeo?4;5Q-{zZb zMnqZLfz)?4jwOEC!$|c{ibLt#F5*qn2AP$L*4xKg^%OflLTbh0xYp3YIrC+tx#6YE zvqz}Zpv;>aZ{tQ`iI*e^T5cy&onTlmtkgIcO>B(G1piw%S_L_`{m)P|zBI6|Q6IM*hec89O+;l74nwu;g9;pp5$*lm z#*|@J(T|{mLfE2O#ysQr>mUGnI!?mvp&8(PmqRs_c#q-sgxl$;?%)l*ShFjgA7gUL zQbFE{zG|CAwY^5zkg&v96ofSK+5qj$ql~pwt_hTxSj8>W$yS#OzG6+?KQOP`Ju9Qf zWu&c_7Vd}WnOPYVR!Su3!`t2SdEnb5xpo;w3K{JGjP0xf$CB5y)j;Q{!IAX{q!;Ck zi~jEd5f@wTo`7nKI`AVn2%Fj(K2)*GYQZ3xIE?Bu53^e_wQzlZ=9U~E{^2U4o1AA< zZfcohN!%<_tAz7q^UZfJZe7=OVr0aGJ=o}@nI$04s1H3yw2lMW8b+*7wee6tQ=PTRTSw%1k5k> z9%1j|v%XP(5dyr@H^uekzpq|9vbG&ADR>BIMX1>XoqcnodN{vuZyICw9mDri)UMCi z_s6ZAkOGzoo_$M1ml|8Ov+AWL$T((?dZb3|^hH36+^lD8r#jZ#D|7f@`PtLh ze1y{IOGTXf374u5j)=w&sWWH0527VVvD8)s!37AaPyekRtpMGvrstyavL6e3huh1i z{ucMoC1+4PwJrd$xv6R!J94GP_T5uy1)p8lW|4^gbm!EKu5@=!N@v>RZ142D*~fKR zEnZvszY(K`+7{kN3H^LN?BsYATd6gUX7%#dW0|8Coc-PyGnM<{%Ji?<^T$V)vWGq4 zyk1Wx?}z8}V?QPH)7kUR7R=N6*bu_4KqswjxqPVwhHMV*MEhic{Bm z6p^inz_`9S0t!I}X)#J)fBmn6*M9f8y?$K1|VRi<_(>*)}Sk7=k@j4SZEh79W~1 z5hwqLpoRntcpODhHOw2Kmh{EUp*TnQ4;KXN!srzPC2LLI0&v=}Qnos$HEeGEFk|b2 zyzx2S&we~4?PjkG1&U`8OQRyRR#X;dq(e=lC=0tJo1@W#`dkU*w{Ju;(}9>3^=4+; z<#(|~yGP@U$sCO|DS+CgJE`S4`3CLB+W4O_7U2z146M<_HMs*MFlhGx9@LTMF*`CD zJq5b$aSYC#A!G2k>>GCvvBeU(NuSjU?s8^?^Oi7Q-<~js&`3F*3Tc68fW;aE+L%G- zOwvyVie!mrZ@jJM*1H1b{Rm6;k*G1(HntR9?$;Y&V7kc*nDZ|WqYeBGPa2rvE zN3g*za)tmMka}UQX02x~HH|eRAV^pYnF&348bykvY_lp`$`P`O&4`7rr98MxO=Ho2MWn>gRNa~%`rp7b& z4s^VK*kZaV@rXtLzOeX4Qi4IQ!Np_fB~dM_(&fAcrgQ0^<6p4BBx#6JpU$mq8;g*L za#l4B!kJnZ)5}Hi0Xu=LkeNVpL1I?>1mu}NY#KjB#xtP5 z{q@vmvF7a(nm$i8p5>gD89Yl8O`?3${Qiu}unT`RI(irHFkvMVNiC6U(UHwP)>?31 zyz=Uqa;_$kZ+skrAZ}I7;bT0eLg^%*EX0eKG4vBDG?W_0H=CnfAe?%Q)9W|pzB~V0 zycc+>fM6@gWd4=JR|3t$pbI0BucoWjn)RqLinx=1>qN!Uo3pVPSiGvERX(lt+ry>c1>R{)KMxo@MH?s2)ArQ+d9m&sMALh9c zMnF0EBXpoGinhzHVn%t}aQma?fmq}ZGRGZds&3_JoadLh zT6r&9BakFvC#(p0ueX8}0B3Yum98NvP9qT3_N`wcst3NfyoN^FK+iBP0^6g+celJ! z)5Zf7wgj+oU{kWSC>k%+!r1PPFpnW$wYuySI`9q=A#dnW(Ir>C|wU2r*mrx3hEGd`jlM zXEvn#i-G?64?5T0bLo#TH$-HqIFYpmhO-ruX2g{*nJ;TcmuNl=uxrSIfUreT3Am1w ziRN-wjW~DVF;FI!M^(Oee&$E%VV>xxQIji0(j`;@e2kLCvikK+l<+HKaCsIWMXU zp?UzREYE;t&6=>@TfC_MQ4-JH*{%Kq?2OlK1nvG&vYpTDXi;IjHK@B zU#Wbg2d;^_AC*eC?@LPuhl{l5kEFRkYmI{mKfA$9;vkxC7nYk}g(;&IK9kM93Tr21 zxno(|8TDLH9W%@aGNx$vFoL^-5bx3(K+bML@n2pa2dj)@Z?FDzXda%p!3OIswxx|C zCa2dIo&FZK&JLwBKoispgI2rdE~Jv0xw{BNA9yDeEoQ^(db_z_uU?n53Gm!_*?5iy zA=>GFuN_C9e>-E2JZ4WY2K2wRHLuFXl!k7p5&@@Zl$;){S=KL9ULTVno20;}P&Lkq z!=M(ZH5RCo^KL&NUNi!PYyngO%DMk71d4P}zv0~0Nd|~R&XbtU(YPK@ncY3{q-y+$ z9H%}m-&)qZfkA?uI^+`0^;D8vDJh9E{rlAts z9$w`sgfdvzcZ5;FAs;+{JD)$5b?}L{>f~pyl3utYpUu1x->DI~3{wO=_^Y^G*#6`6 z?g%;c)9T(1eN+&Vt>5whV)oF)4rDzBwg>)NZCAw!G4TNP zF7&#_9xzFlH7@PJARJE?m*iK2V9)%6``Wje7VLpCSV|L;l-#Lo8P1LRZ?HQN6fH1m zF5e_?F!js6dg9T(F(?z_=Sk`JrN<{~&A$wj@qd z{RsyGGK{k!QcP!iV0@q#%$^nZ@WNgFmv0k5Wuh}m`|04M(!gdax(^3=to$i{stQAy zxQZSwEW*#rdR5zO347zLfB!d6c@DLfgC__!OGHHx;a4obsN8RKf%6;PZhzDf{TV!L z!T8uqt5_MIki~z5pKtFg_+^%teE)EHG<$tcK5r*WBgfz6a1c$~qvwwK7dDeMtmfJk z31vVb!QNn!Q>D_6ML1a;@?qz2urRl}!zPHW?9u(@{A+hLJ==U1F=(L8@OTTfs-1oI3>{97S$?)FNiKSb|B=B5B7*>j5FZfoL=IA>*0&ATayjyp+zB@q z3L7A9#H`Twcl~bw@~1V1=-xCxjo)v)|3yMPt^E3GHyY%ZDx{9Em}i{bIUDG8C7xSr zL0K(KWvqs-W(`XKMPzuye|$Q4D`)3R3tuhpttYlyDyi|l;95L}VJ$hx34_Iu?kUp- zRbC@raK>7G44p9ek-32?Au(Z%7P;7oWGVFtritYK>l_|=(tfuzmoBXs39mxvRybmE zgutn$>~jErp-gF?@~%~1Cd{;`8lB~=8MDo$&%0i=JuPyfB*O#zPTO`{4 zHHP`HvT@vYpI!vc_RTau08>sCl%5bplirGwvK^QZrlORg;QAMY_sL7PLY5J-yKYa* zxpGK7MN&54SvgRATe$ld9=O8Y1LoUi&(&6vB*~6R|uoWfH;H|Fse%#+)Ll!v6U31U+f0LSv9N#8hGKl z66DZ4M&|&|#Zs-6AspeG8K*)R%6=Us}rFFLXz~z9aJJ0Zx$x(a}@=3*`no_BjiN!}MvE85(%C>q5IHON6 zuOl%R&#@_vp)i>9p=bfFn}vZVu=SfKi{?P*15?bj3{=NEAC;Aq(4G*J?aKeXDVZ$vT_zmm{_s6Rqag;Q zOPTK$t#=B6Cv-Uf+`mH)i4Z28 z!%cE=zGqn;?S1ZBs{Tw|_&lkk(C9ojx+=kEolI3Vv%LxV*W$?%KhRA8%-v0LfmAjg z?Dp&tA2&v_It6B9#i4oO%p{%dZr|aJwB7`680Ui&{F%55k}>>`5o}|olrG^X4kO$s zftPnf=6U@zd_xe%^A?$?=Fl*Bq(Tlb?7>gwuVUwL#jzCDNU`+?Th>&wk|(y}H3;|T&Qh@3v-QFqE@?4ougu<`mI zui0~(-nQFwtI4cU2GbcLD8raO6Xgp0t#xlb{g_puy7{xqea1EDf8*OUGpINvuIW_d z?g=%GUquLuS|&?I44|&=>kepMqfIr`$*|c_BTvNz(kQ%#vY%e7^0jp#HwoT5tbS;) z=mg=5!}#FP_8Na{U$nC|#=pF8!To!$qVByJb;A5lA(8#}N{|+U4@{ioRsG2lX^=6h zsJ2m@JsV}UqT>ncPm4gAa{qE1f6KVsRRPqNWWWzurb6^ zY@)x>8U?OwV~zN8hwDg^)XTIS;{{Rm1GA?>UNvD_sILKOu^FFs<k(1*c-i<)kJ!pHAetZ{>v&qE33 zBe@rpF7C5vlN6=wVekkObcW9mq|s)_1P{?c=*or4wMUTqr+)B9929p{PrRH?Dh3+Z z6n(COd*pA@dss1Fo2J>`^JF&*_V)7CMpplnPi%9NMs&D2x9rlR&I;;9a#iB}Ys55j z9=T?v^66JCmUl7C*OqI#n>ww_E!Lm5!EWtD)u1hGp;s4GGKc?y3&2SN?{ykIpzRa%M-zMzrU19L4q0(H}S3H?U z+5DwjW?10OmNjv_XD(+y&za^)bPZArHmbawFoC$dKn*b6BmUDHAG`{&x8t%wl+b)< z$}W~(BN#h3GHIV~+$MmyekjN=(k3sI*y#mZ55=u{Je>}uP_TEs+VlrINEa3DG34+j zea=K%p@T=?&!?Wa9mU#a2}v(YrF(L+1>usCLJjy^8lA-750{QJ^-*Jy7_t85jJwyf;V!S{RsB``d zU#zfSn37!{?DlDXy$i=@-CMZgi>=x(wrpdX`)Si?kl{hCph^!dHDD08!K3)Bku8$j z|I-3@bAyWRRtdE(I!xN~E^LcsmHXJ3T763&iawYb@CzYC9?(h`%P7@@rZC&PyJcC` z;=F1&gIt*}XNa%97lXxi>3RxF2=D4k?I)o<*)FOde)n<(`}v7_=EuAC%J1UL)B08& zTetnjzGo#;uK^2ROT-Y+&B>$3IoB#26POX&?d#xCNnD0I1!Z+^I4HkH2{DDwunEic zElrFVwc(X9JTSX)-{EOtyp96D7zG z2vf+ecN>oM`*Ht%e^q%X19Xxw4vGG(ciZMr+#g9VtsY_zUBU=cb2AOFy_&#nHF!{E zcvda7Nz0qMW}i5Ecg|YhLHluSKXtXk?)R(!WWyr)vz>sHMKT0W-ccV3DR#-Xo~|za zTXLeXU;3K_A?=GES7wLqWjDpTFTZRy^+E9O-4&X#zk9!>e`O)p_9BlT)xW#v!P$hr@{ zC()gAiSIM9LeZpOb=m{#^?mX}$MHSlM7D3V-A}%dH9n}LISk`LkxC2XE%>~ZSI9B9 zK@Su;bcwrLE607>uE;SS@BOo0dA4tKc88gRrgQnIK{pDR*RkJV(cwC?B#X1}x$4kE+OkZ%Ak~AnnV|;(r$%wpB0Zz;O9-^aLc_DY}6vxvQGxk$oL|ZzYbq)7((F!k6kp zMBdkCKciGjp-vRv8{+N&-l1;_dyHe(5gG3pP(`p4*A#>-pesUCuldybYToW_UAu!e zWgx5h8LgR%hr^4}?riK5B@taNw8 (}hks0i96e#aM=&f4Sl|HDa_yy7Z}pR>yfP z+>c(KkLzfiE*=v3aT+dZWTj`q@h`2(*wi*a2^uNE^1|?x`&;$8$#-=4IJdjHP}!sf zGsno3kM|DBeyJr8U9Q`8VV)glhx`X#nfYt^#c%lsHnV z=2I^>2m}_H%+-`HWt~)3Zkcrww`5We%EQTuOc~^sl*n{!86{j4S&6O2BLS6l>7w23 z-951o9=8k0P@4te+#}ZOaf~&>r@}~Ws(~2(SX?DaoBijEBIJq&os`l}wYi(96$x#t zb2O5lzL7fub58ncPctW1+wxI0yI{3tPb+kwRczf)#wZ1spDB|tm9T1<320ohekwNu zrub}_2s{K9n+E;`K&e8v_Ba##U;ymz4oa2>x3KFrDnK!uZ7mZKRGzrwV@w{&C5^(k<7C(h#QQv!DzAYK}th{K{jd(a!KBq1}%MX(d zqcSkDfBG6sV0yjCI7g`c!aT8Lbek$hezeD3RS*2pw$gNvs-CKqY&0ET^O8lwep4T| za;q;Fimz_?h#52z+ume~h-?dNocryV3c7pzME!wSCfk1U(~hsf{US@7a>aO7kt#<( z;ifavDsnYSC_KAHj!xPgysx56|9)^UyGGuZHmEYW{V)nKF){tkL0yD-xIK&+jx~l& zlDA2{HY6gjrGA8*4N9*Go~Fg!UuOkg4@Hn7x&5AsOCgHs!8xBosDvJhT+$~2PKA}` zyo0NrZo!}Ae#KW^ZcM~RO)b%igqZjO@p-Qg_Et&!uPAvv1fZj<{R@+~&nX~HaYU;> z+9GCeyQUEtS&RfRpNd4Fnf~&D?-zVe(ZpR!3PZsA!LITDHjD(<7G<4Vd0i{#XqH&{ zKfp~jE=Zp)xT(Vst?CLFG4J?2Nxl*748v4iV?|V4%T0dy3h={+%Ym1cv9CCO19kiWS>4P8D>KQCr|QX_A*g;1z04)Ldx3{YFD(5(0xYWKdh9QjFKaHcxiMeh1hs} zk_)E0(bwwNB$Oz0Pq4Js@zmvSP|}D24)w$lO>Lvxvtw&j-CSPg?Wkk}OvuMFBXcs% zi}Vx{pfRnqBvUX`4iEC=N0o4}v*S~5OzX{2ni^5P!C*0q^}6SdVZhjr1}4hP%TZp5 zjAEfAfXQ_KD@wRru%&Dnot8qoz+oX^#3t)aj(k}*IoSM?+$_jp^^&?(V zvLj3@qDBg!RE1bpZ?M;RQ)p}giyMmd^zuu<(f23i_S!THHm=)y1nh%FRK9K6lzxru zz>`enY&OG7>c>&wdi&)uQ@;1<@F<;&h;JEofo*$k3fZ^=;|X zD?-qNB8XjxoE2@mCXA8&@N=l$hz!KMr_$e3sR+#^vgi77J6@LNhUe@)kjG*+Okdm8 z&WtVaJhW`SJ=BoK?389ow70jQKm0O{)Y*1?mmU0~LZauzPsKC^yTqXKf%VnpgzCB6`g)d`rJ}ih*g11G339{wqmdBu z%8g$K$x(GZdVH1#A)_ZnQoNN!=Hr( zH7e6x11wEr;#ZKnC*IC4HjA=pCjG`7Sa5~l&?ke0G-n86lH7S zyFnv14cjfWv=LNT$HdTkKqIz-+Fd4JI7C@>srxO=eZ2y;Eh1|Iv{`oRx*$tzHX6#7 z!z+MNt`JmNYUwhdl$rpP8I8Np#X&8Z(2u6m^8mLBGIn-!o@RSmvflZNrTp|6QL8Dt zJ^w(PP??&9)5$;34z7IUZYzo9CcF@qq!gA5S6k~~m2pagYEkJ|y)C`q=6I{=`Hs$c zJLQ~}7Z!h}|LNE3>0%ZhR=9>^j219g%}_p;eii_A8vw+oTiPNuP@JxtKu$JF3+L2X z@5D7& zAVMW@e=}5?;1gDQUl@X|De`Ph{4#Nf=Gj-$?i{K-J7Ij0eY1jusZ|2hdO8rD))-9U z^EALOvtvHsQmT^hjWjawVj#y1$1?bGe; z1~kGn3w3YL^D{e@R$rBhi*l!Y6D1s5p=C*hwNkQ-@YY2kS?!Qu~`*VG}4H?7%?* zeVntSei)ettNzINFhsD3uzJR#`izLy$||qxZM*eU411-(YO>($nk2K`6FL7yfv1)z zKgr-JX!w#FU!EU6Z<)N&l%DZi;MFE)sJ$blf5BT)bJ1|ilHfSY{(f8)ZpEmP|GOk) zQUb8pXX8UhcEm&|(oQ5>TpVnguw@c{x@07<1*uR;6kX$3YV{Z4?<nZWmWjj67Q9fq^8uqHv@pvyMbB2k{TnTC_v3@+|7%u}v zn8()n5fe*Yra#+#EU$&Lc3`U&r`~t&+(hcPIm{iHev}YiuznT$UU|<5_;dsc9n$<@ zKYWnN>r&Js`zgthub(VOwy;#;Pb?A+|%IeBT?@ zX;;mIsp(nb2Sw=iPVl!H1+r|CZKl8^W{tvFEnaTSJndZXfA-wPT^bTB69?!WSh(jL z3yS>PF{SG{AtW@jg8Tfmx%3eQ%06w+@dz!#y1B!Jw{gIPw+R;GpG69t6Zoec`r>MU zLXuIS;k8I}sorvAnJo5&51jiTZ`a<*luo4z#Sa4dm3~~KNqXE7EIaVIcKV64o+m{@ zxKnOwmk>~Rhje%Z=gRV|&!2w0&Bb?fH>CO56SSEf?}&`zB_ImJ8cMn?z{o4%ZQ52O zrhV(b(ZBvUe?z6>egT5@$q`lENBalw1LH2#7hp?&r$+#Fa@^cK|DMgBv&(b>vmD~I z5#&<^YS~vXEfW$(*Ftbbu8SBeE@@!ggcO*7Bb42d*?iy5#Ue>T35WeM zB8>N?8+kN3`Fe*#9Ro9}?n@Xe3D)r5SqS)%Bls{_AJA;Tw1r|7wT0OlH+`iha0qMX zXTkGACiN+yJCiP3U<5y5otmkcz+X&m{0Og7AFB+eR7Zf!uTZib)`eLKThM>ow zMtGVWX;qJ%=|>|N;?Ko~3}=oc@i78B%<6hX;onu$>=Mse1e=~x*{lUwMi`|}+7M3* z>NJ2~J5*XEc`neCuQQZ)hP5P79cDf2f71ct4J*=Jb0opAFBdU@?00=8v&Yh^zLc@cIxbcF03BsDkDVL3%UQ?j)f9k%&ci(t#?t@X@ zB0EKybM*K-`3@+`q@~f{_9yvV~NQ3SDbHvj*x z?uUu>ec4rgt)g(`J=MnE0BY;6anrug27=I*zGIWe0YB@6hjm9>X-hlBYUHH-}X)WSAU3(E%(riyUT;sP%sTXYtCn<>{0TQBIbd=Nz3&?SK%RSzj_ALU1n9^`o(X-03KXX>Wt*d8?Q_#d`2M$ z5f&sG=vX0n9~Er?e1%QHRxv1eFWJ%SfZIWm12;k9#8(kh;*0T8NB%OhJTGye1u}<> z+==Fea7OFFN&? znHw2;a$`z18R4G=%zx5jsxUU5y|tBx0Q_q#8WR0jil);NiH1U0(|}Mh@R!`uTq$N! zh0X(paX&cwiy zL66^^0jDT2?mdEP133?XQ_>*m=f+;+#k}%(U*~O`Bk;({2HSPr5bWq3Sg6t@FTWac z;K;$n<$$2W$xy5%UUB_{R$1A__KJ}E_0-Mx@ojKIHaB-sPPd^&JNdu)eBiZ_P;4E| zJ)>GE(mr?=R#2EXc!Y2cv8&7osYoLr=l?GBJ)4tUmPxDhaabBk0=#2cS*D(({=MIN zfor(o$r*#}7x`Rhc=E$I-~aCOtD~zf3^&PILG~QSAUk7%5tj)M4d%Y%TKq#9F(Cy) z!+h3w*B)j3R#}@fnqA;{lB*03$5eJFRkNYx>rUlsktI#jF zU?z~#-BO!Ar)wFvCVsKN?(iCRz9!{;erKMC-&^R+o@z*DkOLyL6VmW@v>e`W0PN!8aq4V$9 zcwntRKij@+=~zhOCqIxNHdVCySq&!F%WciSR-EdM0QMR`{Mv|At z+hph3H(BMM)mISp#FQmmaBGwUWkAv2u?$j}e*f4)S-d&k~MkjD5s}$1Da;$aro*gpU2H?eOutT1S~zaQyy2m z^@FWP&Ev^e9`$~SSMuO_ftKnA9sTK3SxOJ&o*0a;i^-vsND*X?$KOzZ-ZBotb z*L7v?()82|GeJ3x32Q8%*yNb~oI=KXgnALjCG}iKF4@p^T5;C33*`=G5+&O1_G*$y z6dV6zVlcBUdRlgSQ>E6RG%gGlIP!}yEK(ylV%kYPJ?OI8?PoX^8ZlaU0#$HXL4&5j z&l#d0_qsrdRt+$xTQH7TZ+bE7b|YbC`+3A7uox%+#EOJQV zml&y%@U%8E#?W$NaN(C|N@9pT7;Bbp_b0uuNjXi7GvsN#D8h($j{Cw$^xlFXW{e&s zPA8r5{F3SQ!P2u#y*aM0L>l5#oF6|Yjz{G3OxCrGMNRc+$%$Gqn6nBRwJ+*~|!}`ztODIyV7_%q)K zGvTL(5Lp6mhqdp4PeN?skur2ag5rC8Zxj+0pFE>?ZYLviF6`E%GrceoW)^djh9npX zRh81Brd9^tO#dtAx78cJ7hd%$D)ee7DHy|X0SS&r1hV}3e^kFKq9E`PIBB*(fkVt{ zWTbV7;KQ{cy9Eig6JshW-0kH**&jV{gwknVWVJAlo$iFi_bzS$CSn&KU9yx>K1*s=;g9?5)9hU)?! zm8fs?J`)1!&kC0KOoG@HUN1Kxzx4{_&D|bWv#8m6&xC5MbbA-|NmHy%s6TZyF4HQl znhK*g*6njKF|aoR{h@$#6LjYLM%9-)0V5>rQQ-u%&WIlgj|d?` z3XJZh*65(su%Ovclzdi?417N)GpJn$lc<+Li>qFha7uGw%&NhmoYz0#uO8X9Cm@l3 zr)Dod7b?V~>UoC?96TnRyZ2KfL*=vX^My(!+IVR^^1#S0a)XY z3YlsKWJ46&b99(u@#wY0SwD@YG?L`xA5W>LL`K2(e=2w@2nrnBt-W{(zT^E@>yM7fZ770?%tf%#!b|Q>io#05)rFxiBJ`f znD1#wV@Tq_pEzM#%>l*w_L(C6c$G2Qafn*Cmm!G6>Lp*q`1r^fCg-UIQlb19dp;Nr zQeY4$!dMD0Ox?(X+|lS12A<$cFsa*5yG9nHrwP>%cQ+_$3Af{6S)%(0>pzsgo4oS> zm##zCWQOa(d-GMeEq_d+Vu(%Pb2BVJSxgq)u0~Q$7H_1?*(%!ERr1~S*m*!8{be|| z9lpAV*GGJ#bUc(3bcu<}xCB;{3`RAAY-1h3;WfOOw>G?yqfBb$IavsV1h(1kEe7d&>>fB2lklx=Frq>3dFFV5(<{0&2-$szBlkk3@)Y>J`RWJ{(n8M*KLR- z-;S~5ySzX@2SYkeiFsO{FO>&Uy=z%!fEn}CL-XpQ+amG9Vw<~Wa#(x)XW)0^UyDU3 z1-4vI9}+Qxg*J;8bSc^-|KIC=WQdleDT~;Bg5*5gt}#ms)Rvp9BXwJih*#>Z0MzR= z6iA?IeN*mQ|NA`-+y=pWIVTVdmcHD^ZL-?9 za$eWfb)z@ETdkW|(%$Gxtw#-zcO?_{l;5=WKBFWiq(w10wBCA%ImZqJ`oP^;_ett` zI+SN}3O?iTmc-fJOmJ#5DW`4i72n$sIK8@@q?beW_L3nT`5QxV`~B(J#cLq+pg3Ds zP;9<{lN3%lrf_9ai;FMVaH=c@vBJ$8u$jCMyuEGD-GI6GrME2~!keSR%0`W+n#A5q z#=zd=M+Y_T9Y?lsaY|6&0TM}&r^Whk--JOF#|SgS@1Yk5Zcok)1jl^9I zwJ2Z`fJ9WcwP;T1)#M7kf9B&?C{Z?-!I7Nsq7btbK7=-8F$ z*7TRMFzV&VfHUC2KmC4lU^am5Wrc0h8AqPZdTGyCneupQaM`ObHu zbNPa-TB{UMkvh5T(^Oap>VCF~pHjr}Fj_F_@p$xP0h*^*t6aCUGEU%on5#XBS~Eck zd+E0ZjxkrfFvM9kgs&^+K)iXA`!DK1wj+seztn(y&?I-S)PR1tl6!l8zZroCxhIP1 zObQiA0BegMs}2=o^M%wW3VKwzClAcf<`CfMwOoo|84Eqe|6qvSN98@y5msn3YE%3x za0ONdrx_CqaU_pIjw*nx#TM6pQho4E z?LCMlQ}2^e*jBDXm1c9k_(WI@4WQ|G#k9y)(9e8%9KXXwtyMiV6yiE}VSxUl%#uPg zJpL}KIir*XupaJ%+!xO6-z6Eg`*}>!U?TK0Zaq!vcmA~jf6grj_Q1Pd^1K8_w~MY> z)j(v>Y;vPxLGdYNHzG|EMW)w`@}`o;oI38C&!>u)<1fHXE^sZHo0CQT!sqyW8D#0Q zUSKh0vVy?;?@^)s6F3BdtI{hy3?4-9>)^^9|eNM8AJpZN5nMzl;uJ86%_SHv^>z zDYs_LX$)yaVf2np{M1Sdyh8Lp8OO7^*M_WO{=QevT4&v%WO7qEfUC&A6VUYYs|mLn zg0NP`GrlbTQ=@v!ZQF0AZVm2kIu(h7gD}0NJN`G0M@^im57Xoty6DSJ9iHUdNWA`_ z1X|y+nh5ktl#R`K8~$TqK~tw)ks|GFZWbYtMP_1jfXgxagA(HRWR2_pX5eOPx3mB?=5kId?pnd`b`qc_VokdZbl6qqQYQcTP@XO zVtbym4LtyVKyy{?FwqH#P9N{}6u#zFTAio;)lM&rS?9s!_+{su_A-tK@P6S(3I zA9N}pjp<^2#k^vDJ%B{jx-AHh0%DW4*zm_b3cvBG7a)$d+jEAwRst31pt$^{9+}ECa9!`sy{=Fbr=SP{w7{~Qx&HA zOZZPSj`JSubd1g)+BSKhB-Li5H^(FDeyk^DL?q^K?Bp42E zU$9H69X5>UaN6=O)T8dY{J9l5SWUGU`qfXvV1ni&3;CQI>MrzW;lEsfr9>j(-au`q z1f?JPAZ05>X{K8nSXN8wA4GEq+$#$7w1-3Kc9fZ#HSPPd2aW!MF(@J=o^Slb(`F_r zwmkhiMJ1vd*@>?y0to`d01v%cK3V@>^J6)|Z?5O@z+JtS zBNc<4U#JI~EL;WQKd7htPI(p-p}KkNe^5{3`?TmU)N^25{N8JOJ$YtldD?lsI2ank zif|uGPzS#$ew<+qj4wy@{Mb4|k#RO2*X%(;Pt8~6o$N(I*K^u($P`Fq`klLnAQ$9| z`%|DwafH`7uqo_G2`0X|n!;W;1ir6A?5!697=lI@Np0KzQ~~=E`|I?G{yIJ4-2XW} z{fBxgV#>D3az2lf@HzyJjh|DsVA>`y2y*L1 zXFIb}_^;E$OlNxiH+;%Ai|~CZi(U}JxQ-`LQiv0GDNTJE@VWwrMQ_UZe2HQM{)onE zvt!t|J}iN5?y9`BP+|aNk&ccX{__Zjqquk~yRGG|y_!L|`D5CB<{i~ArPvDrLmUrW zM@(?AAB!7TjVHAS$OW%>sFT?MDZm%01Btsa@UfkWknRre)G z5&*bV#WCpxxQqjgg{__}c0Km={J{1X>~VKH*6Q-`dRw{4l)XJ^*0`q&UBs) znM$5@G>?wQNOHfs`gy07?O-VgfgR$vSj@!SN*h{c1SptY@i}G2a7HIW`$_6{V}9W6 zOJ3iZnx_BL5L4F2xJZ>XzVLSZnFUzo#KCa)2+3?z^DUd6>bYTiJD_xb7Wx7@;vCEI z$s(Wa*H=>N(R3VC*V*ne&Hg8ggVVD0g>z<>*W!PzfY?sRB>2_bB_6R&Zlp;Swj_;k zq@?nPbN7p|8IxlOS)%!Y_X`dfYZtBc-@RL)>4RW#>7;qh0aDvszIoRa`Hf;N z1S8ioio$!EP8L^TYkpzPlJx{cqb0#8(x_bw=Q-r4Jtc%jD+YNtQgZYMFxP7M7)U@! z;v~fZj}0|E`iDGa%mMMK4D&0*LQ3|1LvdTgI4akKrjcV5zclkXNG)QHnNcsTd?nx(?1TtGj~t{h4?+JEN+Al9 zz6G}(rV#%_dT>#@SLH$|^mBG4bjmI^m2~tpJu|%BCvI3yR^!*>S^QB+BM527oBckg@jF$=vk3 zPk~1{fCZI`X})3n0AL8Voszfd31F^(lSKIF#1Xsvo6*RQz!grYsm(4XV=EV#Aa{*_ zb=3=pW||?r0u%#aoW!wL`k2W7N{9+$(ty?olw1Sts-!qc2QT3LH)4sU2RQGp9CE?Sk{v3$SLQx3lA@+uq;F^+b;~EJn#YJD9{uRg%~s|t9MW=pK##m^TrvUW z@gvP?l$SO&$~TprFH`KL3g0jrB+tFs;Z*@sR>Qx%@8WD9m;N~X7(};aC#FVc5%kNt zH4^UR9bWYI?H*xR!#S*NaZL0TLr8Ijvp1b8g#EgKS15SfQw9taj@PGEMOz-09!I1txP!OD2Urcv zivKfu?r*n#jUG?3s^PRAHcuK;jFVnK9Ac(|_+O*vs0L;yC!{V>l-BM0yf1SsC8Xtp ze=AEhWW`~W&4(T+_!K1E+?i9Gz%P%*zFEIc99X@Qos#OpAq*Ya8+Trff_`>(1q0*{ z*zp-z-c3ye@8|c+bOLM5ObvbTpDprbV&7V-p!k+XIU4+^tku)UQ! zKu6N75c?{>BAY*ji@Z~_4JQc-jrYgPAlCEBd&VHo)x+>DL6CIBwP-4N z%pcqfKgY5Palo!wmb|5ZyoCr{ot^|gKlI%jYCNebf;)y)3;q$s3Q^CV2AE6oie|CI zbmKHxH)#b#4~>SXQpk=-SlKlcs%`Z}Nzv4+po^_X2pSNb(>h^WfEPOOX8Vx*o|X!y zE$K^1Jxa4iDgB(5FoaW0*9Q1sOz@4zvMtOW^2JDbn(`ZMfHSityC*E(C3Hj#rL9fs zcUa8t-!(uP978199v<{Sa?5Zc`W~P=fG54G*=EPGP3-{|l#I%y{AVCwWBo*T_S!M1i;%3|$rcR-Jb% zjZYC5P}0g&UW|LX#@aV~k3tCFHCj7y?UgLzY>iSsC7k@@&3WoJray zfuERS5C7pHmvAlmZ4{wz10|>W6tWF zZ@Rf~`b$adK{?=)^9sJ~_6LyTb3!0`6>H*ePZe0lmM~vM|A(MSRu2?x%yMIjn{w|u z?17Unc_W>BTT)bVlBPRqzy**#l_&PqQTd<~f3q4G0>n zVm`fAuRMc%I_g)$071;bQ*7maP9*{uQaPHO*uedA+}KZ{#&RMQ3@nuf8cNkR^GNbyn(TMA_5ob= z7fl3J`bSp+pr^n8&{0BS3&~n&rt0hJMS{b2qVU*Rbe2O$_*#_xy}XNq^qXo}^~V^& zU=`41dcBqjA(Q8RG+Ci4HB3!V5{P^L8px>bgF;E>ESNFLlmb=Q!jFni7h-{dp1q`# z^>Yhe^3RTtR<%{@We~0;MYs?u057I!n0C}UzMEB^FJG5ocg(9d7FLQhv{9Le9*HBX z=G|1YSxyNVF9xiH>DNk~)l^^AUoapPbooMkXq-VxySGmW!P(Hyp77BX^I18$$DQXB zBjSc}6dX{KOB&NMiYa?^vuhX0K?3FwFvG)Vidz7tKt66O(@rkPk~8*+Y%r%*c^ZJi zrlcN}(5#FubEMB8RAXiDxW0;~25v3D9jhQ*@p)%dvI0ar7;zFn?rKElY5V1QN~VPq zttUeebKUo}^rPl# z6ZoxTOcvYeZzSMEk`xd~MX0lVZ5WXRN$SxpIJer}K1deOjoL`nr(CY%`b&w8t=&X> zXP(^-+7fFm2Aa)LD7HxkJL-fNAs@>brpifokvR>#q`nyAqA0<4f=hH=$l`7pPT-Sm zPkoLWPu6C1)+Z1~2D-ts@TEX$_mRzgpjvz@)LuyVavP@PJ*jzYC`$k`S2-W1VqIE6 z)i3c3BnGUHwO2Hc1@Za&{P=UmwkFH6FksqafdHmZ?*5+k+7%1e)%=A`M?(=Rx8~ba z-lpU?65ysh3ZRTcj{ZiRZs}FgVLk>TU&Q?eA@!J-2js+nqGUAxQ5Ca`@{8L6?t-vg z0V@4Z=Q*_5DF09A5fNOOfR|=Qn!}}ky0-OXkLsjL)2p+x_H{?C&<2CWN=J|3)LM=A44z+EjAm13zcg< z6Oe<9S)X-_V@mgQ;QYRAClUAoixJI~j&~LeJwL(F_v7!QH&Mw<2I%${T4a3I=8Sms zTw6bzDx3rIaR<;^@J*0i_GYm?_{2*hfy=0NhkrjzKIm^G;L70*p7UMg`3L+x(GR8~_3uXM}IeUO_7w_xo!TWCS;s z`URD+0|eSO9F)ed#UfmmipLl|Zl!07%Q2r_`Sszgv-rO$9%%}>67H{H{5|BLhV z(wtnjoDNJV4y-D{dNGqc%AVmY=>VF;1&08M#U#Oqq-ujrP^1}Z6tV-!U zNFOj|D>Ro<|8uuvruz7*>Xei4(=XV$YI`sp@F~N1PlmV6alwCuu5q{x(Nzs^U=arR zJ8D{JqxP2JZ~&z$XF(ApkM_P0+3eliVCPGmbAky18Q4CyOTKYgd{@VQ%@YqRIc3!T-l}Sd*m9j| z+3p$HE4hFDGV*yik2+0TB=h8m8a(-d`Hq&jlA@7X-5y=x%%H(%n3JVs!X3xYt3f(Y(aO#UN%@pYHQBOEK-!MeKIwxs^uW1*e#{dw^Dova5z`ARsmKHEm@KtL3Sp7r=s1ZKo3HBc6Q`P z|8!64<3mY>MdMe{iEQXj^s8KP;+ZMD|9dQe^WGgIZk-4WLOLuw(f?w9j$EUYZlakK zR&87xFJEhe^UWc=+)c~%*S@A7^Yp6hdgcS1vn-}6R zvvh&qegmyKue7Ull_Lr~jhH$dysOMZ^i&~93b!^8!4wUiwFfB8^SpIdcu_nB`;wv1 zG~bELQ9kUzb*PMP2#obhn)n0gt0jm%oqvIR|?;MABo=(9ln>f1KT9TUs{`zY~L$nMO3u6>CBeQh#u9 zP(RWU6z{F@n;v}63ZH?rOI}1QwWL}?*|xiXEg(tVG`L@DhrgV`4#liCHAbiahTmk8 zxUUl}$sjdoy-#i@{1c-&nF;ND0YaO>Eqp)fN!*NETn27f&k3tw9FiwzXa2D$87)=S zeg7N&)}BQ6UZ8$$ZSfxyF>pr5>BaA^`SrgH`j+J$Wi~i@k__u!0&f&d*{>?cZGYbS z$COzOnT8w?X(?=FZ@*y;MkgH~Q421FlpSYB>Hq z0Rz%1+ueK1h%ek8@|X$h^C%d;!yV&cItinQzFhYcXEb_;gHxl;IuzafAQe-o4v4Y@g&_<3y-ks^mf1d(p8XU?pJ=gF6#f#B);D#K zUVQq4l#PbToFO^*n?!uC{W3#BTY~A}6VOo4afbFEpg?%$An?c-x}I=h6nr|}zS7@A zJ-US+6tq5^9m!red)w1qu%o1UC_%JEYm)T2T{NR)s^!iyqmr_llr{@M>~COL6|%nE zaWFZoh%tu=Mz6BM(&sbWijB9#N%5SBEPZwQvWVc7a+;!(b;?uM$i%c zxh~*!%wut|m+PVof}7nq{cV5=O)TuZwyh~{6g8h&6xDHmraHlY;GOL7kG`C^by)fc zlWyB}S37!A;lO$;u`zMzJT($gV=}|wW=1xEVZizB&>U3lOH~;Ew3uhSD7j*~Ceie~ zFbb1o<~b&(PfCn>6JWy_mX!ZMF917;jLPBP1j6I=!y?kgC>;AY8*2&8{C0Lv)ho_d zSz%fT3qMjH1HuQ6WZbB3n~`<Pu?D~S zeY^U0E5JWrFjAtpE@1?vyUbNRvBlA6Zsq`VQRq%y)lr`5G!WrC z5A^rIID85|991M`|p-#2^DJ!q8A_~s<8BvXyI?iM4WsRs){16#B>z@ z#`TT6=4!lgsl|rn@w!WT+cKB%@j5K3Wp`r*$NLkBc6*Sho~3#z(7z9 zI_HgTp(uz_g38~c-y=L$6=}h*3@6U86_HE0AT0&#J7HiPN=ad-o)%j2mc;JM!6(Zd z9#^BqeeqV*sk}xGYftQ>vy)FoXk0MDX>$Uf8A876E2lHGO3sv=s!9Ewtuv*TF7SG4 z+GHe@J#1wd+|<_T3OlKdLsO^P$Gbrfhk*}-TsG~FaS|qAo2Q&n67gADYKJ z=fiTX62ANAO*hIPeG%Lfz?^S6iCl^RuHKjhS6Af#HFBR(Jh)d}f>a$X(=b`sSXXM` zYbngQK+Y*7JjVBOqxF?xWc5km7(aMs_L7bBY%iG@xaSxb9;p+!JeSAfZpEm`Nu_P+kz%Mey%%MrkvALUI2cuhJE}BZBhK~QzA+&#^N*y1gmupo6B+NFV-hQ z1>9YWCCFEjcP#G}p-pbb`pnBpQyH~aZ2CCFedTegl36{!^F%0-aKJMEd?lhpZY+S# z{xW@t+&XHE>bPx}=@xa_E~aoChpVxM+Jy;?d#j!o{Dzd*vHOep&)7PZ7Qu)kK znYMr1_=(XgdlSj|w}r+`(ZD>e$!jngA4rgMf_1&ClK>;gUf*0p7C~r9dd4^y2qze! zdq8zC-hMCZdS()F_KPJ(Dn)L;P28V=i|a&S+JY0ABa81J$Xt$>3Jbn@!Xc@UEGX&k zxhExP9g%tDS+MN?nmNi1kZ~Vs74MvIXo11saz=k>5XV(xc;)FDmzh8MRLF0NH1GJ6 zRtCXUF2l&>28{o>cQcrkImu6dAgEArzF{xx)@+cmI_A#8B6go&QOyPZqiDEdMutLw zb$0(ktWerzj$;qV8Kpxa-fO`86?4op?6a61gOplxb6lflw0Fp67R&4D)1T-dx5YYH zI>Z98!_&)_4(7A6b<>mUk5w**9@)p{iQ;(BRckOsg}qZzZm~JNz*ia#_ zPW5__!U_(id}nYfPY&Kos2*G`c4UzO6nCI$W6zDPn@XZP-E zmJqX!mD>>{M&)t&);IBnmOOsot%vQ=XQz^Ux70lMxY{}&W|Kd&9H$tNSp}I&@{Fe< z(48xp%Ph?`NEK-;EdpHQJ-q#L@x>7yn}FE6$jzvNZb{X&~`8rs1WC;FKKHA8u- zKtk@DS1Re!x44wmMqv%xfpRE~YTBEfycLWJyx{CV9B&QR1n7lR{A(XTkmblZ{_aUMg6Txc%si>z~c~ zFac)8^cF!2$uT!;V=?_I<>U}M{cQst4_bFxouLieEn{>L56&|%iw%z!e&a^nwWmyV zm5BnUa=LJ_)9$}e27GUU6fd(Jpvs9-LWkCIL_xFyMeqbl3)lF2B&!S@XJuWl zck^xpUsc{zhKIPx@>0<{MuVN56AFIBIUF-&zKe_Mo-%Z^DyFL-auDJEZOodCWdqi1 zAy+>FZ9fxGJJT6Zs11RtuZ1wp95_)|rYWA6{fR{KK|O-@!C+-VB2@QGX_nBw z_U~>a*%6T2{l@)A2YtyEE~dRbKM=z^an~mHFKYH~9$-^+eWtEq?I1c!-5_jQ9AmR{ z=06$TvM$y~LG>n2`fSeHg}^{2b%v}F!Ib7uXGH5;aK|&uWB2t52z+kwR|aV|x?6y6 z+RLcxYtF7aPnQ)8`Foj{bcIiR@e{0YY8=ByNvvJl;o$8sn3vKt%#%kq+5sprMl>+ zPqzq4*n76#uqSIA_~jraO++%ZDE#|e;3>ZvyT-)gg!8uNS3+8B>SR}~amJN`=$0a@ z;nH~5VA20$k04!xPgDbUmJqTpk|wrSb%y89bDZEFcFNrYOnxq_Kfh+{z%e<~zJs|d z^v&IMajBYltZ?~3z3cG4wWX4C$&npYf?DKzfmBrV&uo5pdIB+w!?eQ4`{jAvZRXv7 z{oc0JJKp-Zn32rR_WK@`-reD#KTNlz1@IIjkh@cO-c4Q|6FLnjyxpy}UO$_QxA~E; zFWuZklTk9rTG`*St{h7Zh|jGq#nw6n{9+vfPA7TIB|?JrA{@m&M8xY6uCA;zkg$8r zy)B7z$sq??3Q7}L8GzSZdv0sBsu8!Es`H|Jy@FY|e{DGkySXae%|%TWtH-oOuuz^i z%ixO77{X*L_%(LJIj8kMGADUkWz|=#vMML6L(8;fhsbqkIQmck(mSr;l@5(n#1g0i zwG2)EgXI}v;v63|Bslr7w%Ych1(do{t1be<$54}7#`!X%e2n!!1%HoZL9ZYr1{pt3b#hzW0>^XnZ3g0QO+kve4gfgO$Pllv(;u4du z*-8m`5Mr%Gj$}@IpSTRnYs0Ja3x$+EIDXSR!{m=CElRS<`Q($KCN{uw^U{LcQ6|EQ znkwq^Qp0@HQtPW6N)-+8S5NtQzp$>l5APyF5vy&jl9mj*D(ZDiEC8;0g`Gf$Ti^W(#;%VyzxDDcF(ew}_(a1mWE z^(>;<4p2dMV%!zc?6l3)3!n4FQiRH~evH;ex)x;O?wrKgx-J{iuKrB}7uFnrRhJhq z#a^PdbL^f6u?){VUt;8HfHg)UJ(e#M?wUYja~GF6iHi}r01t=29v)!Ty>2xq6h4B z>=QqjRLjENk}bOQcDX~K`rM_Krk^kEgs1t@`Z%8Pva)1{4)u=Pk%*;oO0KI)^7eq& zW?P5i8{T|~GMx17IKy*rzqge*{IB3)-rfX@*}vYLiMEKVznf?;x~w?Evk}B;+|R&+ zVc|b(qR9A6H@!Lii7YB^7FO!32en*-_2I1nA#OhoxMKF%P*AH3*<6i2YO$^jS!wP; z9Lw8uwJ4JYjeOO@roNFQImp`(E~l1kc@Yq#-@Gj9PPuGIXLQNJ0uBkm0YRmYcR5F> zv#Q!uKS$h=g=}eX^QvqNR9j*7;#=s}=mJ08SAI_eI5xmwwv3%!QdP}~#ne`9nSqvT z)8{hmbfptnYME9UJA}{?&5eJny0TL#x^!X`s3INs<`M+Cp&PQyH8K8CWBR>8AzMKo@o8ioJbW^1wgIl z+pLTiG22q{>*zFVMS%GzRtbqc_0rYdj(Tyvviq5^lIS zO(mF`FtVx-#+`FrYa105T5h|&=My1sZkTv|z&jU*VjNz=W8=OLd0tqZR>K6#Gd2ffk&8{iSVX#t)Xv{FuCqPZ$g6T2V{ScrJ@Vrb zETtnHiM`TM)yzxif!;w>Lr|FN&DVW0_*{T3eW%t~VC^vpL29vyrdLgPmVcX7~|W)tx2(%Bbd zd1Ja5@Yz(EmRXGfIRlgS>6v}WS!|v;RfV(j0@mwC? z+eZO*T=21$jy)AwVJU-n5trLBFlAIrLb=;GDWw^>HF@kXy%P2aVQyN~*(BM~_oF-nTFo)d zy=mM+~F$OL?6Tf{;RI#(mm-* z*r&)=XX;b7w&>Zl!BML3($L}-idnMc-l?12$CQsUD_V-{O8|Q9*U=#%*?GqNq)YPT z*zfAI$1a5Fkxn$#yCpx@`Jbaxo#iOQUot(7as4&T_!zS;>j-@SM06uy48mg81dHGb z`=1%=&(ZrU~Rb88~o{7dIkZRa8qXTXV*;23d$l?C%HmUIb zcI@sOL|nM~t2?`aO2LG{>7M#QtTf=HA}P#eVi-tKM;(E@ z!dP$mDS2cyH+Nulbz{Iw9HdS;H%Bs*whnh_5^BhQ{xOxa(5AsQ(W1*4o?MGH1^4Mr zM4VL$2T~Vl$Sm(el49qwlit#Y(#I1O5FF=87Ex9R3E1S$?Clv`iThw;K^QqmE*MsS z((eg#QUA2vETSJ6QDRELA{3$*ZLSBx!wqLmYO57tI6&OcNY7WD-SryV{2k7G_B4uJ z3)2hBdtyR$2IZ3R_Na!t%i^I3E)9C|-yQu1KE~Vu{O6 zFu=Tvdc48ltVrhcWvS@9{^2%lf@0maPD~!e$wi7U*%)PVrB(C^j;2Lqx;SBaikY z8xwtVgf%_VMCF^^kT0{55u(1jxHl#mN6NZoA)kBG+cX|?eN>y8*w*~8G5I?dXP~hqlOm>9DxGPqW;M@;VmS>l(XM4660{S- zlq>}7Lr2G%vudAYt=bXvxl^yF~ z?5htlUm=&*P6}OJxG_pjSHu;9bC~gTL6}JkwXDBzonb5QFLQ7b(=`3X@EGdcDpu)9 znB(E+1x;Q0vS6FQ9cuERz?3B=9U(%zI#9To^}Od5@tiHS?60ANgHkjSe%i67k$h%V zP}=gwGcL?e6amb4LDwnK^Z=Z>Y;aJ}MLz-W0v{~mUARu&8Qj;8i3h`eS6Q0@9)P-P zx14S+D#8fjl#Y*yauu@ZwsU%6 zgRInF%$ObaX)WF@7T->&5xTkm-?U1(v1_W^%b;(CiE*G)9WR{$`a{y3D8pZ?e(!@Q ze=8XifKqUtU=8LePHaai#tc3w;Nd`I^XWk_OIvyaRL!4o3F_KK)xWEueYppu*Y_J_ zVEcC88=XboBqTyB2)h!H^^(sL30}uWbs>~eHodd$Z3w+d%4HijtgV2*ye)9sz= z&NmQaB`d+qC*suzBC163N`10VZ%N=?Ft+_oCpUX>NvUwZ7vD`sL#bXB?mDae`&P& z3qi%V?j+O2F#qXs;KtIFwa;6mU8sG)W5u|#AExV2Uz&+3V7S3m=L?mmoklC1J}yt7 zRQ7G$|>UgZmEQ&sDMV_}YTe;Dre( zXp^q%l4N^6$a#ytDB+cAG=Tb0_)EXo+xAWoTXN0i*Y+#uL@H~B@#ZWIY+4iSChmIT zKTKr{j|5w!jdzsmT8-Sg`5>jGd~S^KQHQtj+m;r9art=4RHenG)*ny8>R1LsRGiR> z$ZbTnNf!`wG=18DPMYAS zz%2+YJesi>E&-;{e|u&{)QQY!_25jMy%XXalvUipBP;>P8a)L7oEIIUG` zr4EmLkeabne_&4(egVsxobhy&S8onb5kQAZ@~DF1vf8*h8ms*?#C63eTg_Bu5M>^yi4Tm8HCVlwmD-q;oW07)X zMyj-idtjvzq5MTBI3fXAH;+wvNT{&FJ+GK#+Z!z{{cG7zkrUPzUTfd-Es>m07UzOMZd~%y(vETD6?Kz*k87& z<#zK5>&hNS#4i*VYoO0fLsFRbMV+s=d2wG~WcV7J=DR@fKZsu0_@xy(T6>CoI*@Bi zITVZ49=ymf(beiJElx060~n&uhQQNU@J3aNq6cp=fn=gtf|OgR&eA6RWtC;a?q@{1 z3^Q>ozyHTG2g32n{8Mp)98JJvc*M;MP#mDbJ^La zurHYfGD|8QD0fL%{9Vm)^brc&Lf^`lP6c-Lw6p&_Y*?OPoaH`jH--X}Cw6{Dd|;1^ zXs>ferz|4@pH}>+CvKG0CEDpAGw>k`ONe-f9c%2I+h{QGE1Ao710i~ul>%f%{y|QA z^u8c$9Rfk}1YiS{@c>wwLENjxYTIb00K_8ogpX%aU&2jbaaBZ0>-{9n)~4XCmi4gL zC52T3JlX{{FsZxY@#=P!J?Lu$wgW{BvfaS}N3IR$KPAkSBIMQ=Q6OR9^<%>-*gGi3 zmh2R)jm#U9{2LvJJ&{Ef<(rA9VYhL$SyaQA*Z7J_E8gDUWd#ICRZ&b*Z`fz9HnJbY@l7lPg%1#FmkyuHq4Y|pNNJADyI;42U? zLNDi#iIj2>;={|@clXz5;%jJ>hJPT3$)p|AzQLplx(KL$te{b_=-cV-8zb;M_CC@R-{S(K*9dm% z>kn6H-UyS= za1Ww*wDdZk;H1NtnN$Y@dU=`(ZfEC|6ysB5rH~QI2vl>Fw??er1>eJwsuryC-|w*E z;^0rHaGXqiX4=d{7HA0^RvTWGu}|g9>+diUX-9v2U`d*2SuK?JE#A{|I^^mZ`vA1g zqNKbKP@`Nt5qvDm2H_`J^Y-8xRC^83h#Yf;5w4x}gON-DDyd+-L0 z?7ZDoTq{JtWO7b#ckco`xr@-3d%8^NM7=V{;Ynzs<7n$ zNv?QU-q5$KqIRz6%j9{nj+|%5vXCfpWP3+5+vu5n7<8sX)7}5TwoxrQD z#Y-%IGC4Pxr072l{(AxF+>3{?rSO-Vozr20`4qAon3|62u3$1^i-M#o=Mvk3g$8~Y$sr%>{X&go%`!cQ z9lm|$X0KcoKJa3GqN@-rk8Q`WJJNwq%G4khNUcUep_)S}xxzccv5cqHf{%2j8T?Xi z=>OQer{K=McG34qIvulP+qP}nHaj*uwr$(yFSczP9or}Gde=ItT6NCewQFDftLDYL zo)>e}oMSwnZ)7HE{PD)JZ52*sM|PF%7W+On?<7BaIKf$vgCt@J$meSCjO5&5mT1|dW=cZ~|>mhO2$ zN8VUTx5Tog{y~?Rx@{vvCX|RT5YK0+p9_w~Eq)ojvS59+7TpHqt<_)ab8=7j%L`AM zK*LJn9dyx0H8G5Ne)i*KHMrm|h?hAlcDKn+F!jWB4R&R=&bwv}n92<`tNcD_W_twH z(Y?p--MokI`PLWc;ApQ!buOC;oOUV}a%<&4t-uG$G3=-S?68Z@Fi-+F`JA=VG;4;? zNk*HjC0LLOMddS72da zt0dxZ%iV8yW~L5Wr(DFX{UFiPOVHt8tJ&V?KFINwh6Uvo-Z*eQ08$z97v+}8`AJ3! zw_LwH#%2qv$8~OHq}xG6|nz+vQrL z%LhJm+3;-1kl2TtN^=Usj3VJndM&u7r~n*%qs4-8pJAeUT0NzFSTeH=bI8;Ez8NNTFj3xH5_CDc9yAh7ER8 zNVk>c<>}5%lC2l^_ZeQWqefbWLKcn&mUZ&XIg8q6Ztmx2iq8)eb0r-1t5+6HQV}~& zx9@YDYbIninj&U%xn4D$@UIjKx*0&hk#vMwBeTI`iSTYHzCz?gnI|fgcyE9*4ct0I z!O=a@@8-{EK=`BK#x%>EbRu{NRSo+q;JOrxHg6C} z1pcz7B>CD*^3KOCh_bM;>vscnlOmL{|_6q8PO01s*P8UT2V@qQW1D3N9)qKU+zVd{TLX>QeHS)1}M9 zD&PguF{SRy-l zbxBgCg3mnl z3LHGjw(Ih6=b$&%dcrF~rlLQhaMVYx0yaR-&T7vt&?TxK@+_%ejL&qiaofCf-+t|2 zFKMJfs*r=X%Z6xyufZT8h6i{n0P`W+gjcmX)1K=FSB){3rQ0*Mj)uY`WM0-$TDFNy zEuIHt2`@!`n{1Lkc9mFi#+S9#&8LjvlemcOa82%FuW=$^k0NTA_8@oW=LQ?0mmUq~ z8kVR5o96L$WJ$%6T0gH)+kRs_Cfcci7vKNJ3>Awh&Px=T$2?5*Yr5!&jthS_xfTft z-#93bG>WERoJ0rBS5M;HU|7N{BtL$zXemXtsonQ8MaL&;6x=yogG?h1g=%f)$}XgvJf=uMsJtg3o8HRpg-63K zY%H6A->w9+r;9od@xbIRKj{1MIr;rEx2^uX?-zTzeIR?~gN;$^k^KSLJ@Na$G zUmQGyeczuv92_2BhJABPZ?z1UG$P%w3~$B~dQVFGg7n2WcPtJwjG$#Y?+Qi~DMGhAkC&7|fqFN&Ha<-xyOZW?gEvia*U_Q zh`@_>uE?1$T{^ZG9Mc1X^~FH5hB6{Vf_P`1A4H()X0X*)5f2D)ND7rZVex>*nmof^ zRjBz;lScOKclGk`=Z>1TF()@e7#lk@S`lR@X7!_+ouPVeSjp~_bb9Yvo9m290`Q6X`ba)5lVDErNyx#GE)WuJ+Pa-r0L;B}iHIgpUgKp#`O|qk z1Dz^%`E}$jmb&F%!vqulfQUnD$kiHbHekiR{3Krs1>eT&NzL&H5*!1?VY74%*4iEW43POmhOBBs=+hVv(<5N-7L$@cQ)!QH({;{Nc?% ztjg&8lXZ()V1LYOIIUD(ANNi$b2v7w5q^#3$tVoqxFfk@EaV5>GdEkPKG)*pFA{!n z7uL1ZY;$Jn!iw{X+cF#mQqN5r2svU{qup2N?CY?KSl3Ve{ce|AqYc(&i)JXSxs+lk z3NW_|!3^~i_ME+rbDN4y^F+_%l>5x$m|zK5#9zoIKy31^tvW2CSsS_?uv2VD(q^Kg zorsIQ<50n+8(dcX^~g^bY7hU#SHupVv88+{z*=9gUeb(HKIYBU>5mlV=MS=Ppx_rk z2gd?)pM^aG+?A$O)yV*_bV`b9q&I~rn-E{o%=djW=!)PhvrP9&{2oYw4pINl zZJ*K{_7(+-3du(wx2mOt3^E5ozLyHt4&GYxIg-{$V^)BWCl@OCIj%aEqsAwNY9Si> zPp(4eSEn3~IhMD;?#BYNwg0`BCf{_UZ>o4Ml3-a`qGo2awCwkStRKv92+7#kayuLl zBk{vI72HEwWL3w{;80d;$ujW#lgD}CY#FEe3V})YEM*|8d&v6@L^$L7;atqx{m4&S zlP68BRFcK)dCp{eZeVw9p&b!UAk?yZhj)}1->@-^&Mbn2nVplz7dmj zXJw5Mhro_S5@psWsQ#X)yTI{DTNnu?PW4fP5Ja>bn@FB9Xg~=r-HbY3UYFc$e_o> z0awbv-Y421#zZFZk z@+$d=Ap{y1%&wE@I%ey3BjdblO1EPWQwEJ)~_~;2qEyLLsl9uIQ#B%W@POC`RhpvB>b~pSo!7ztO`S)cupX3 z#e8N*C?E8&@vlK;@gW5+_N4$ zaCT-~Ud?E%lL~+4(e%_g{0Pjl)E;_q5IJ(UZY07-y$Q1^!Az^B|Bg?a)9ZccG6ca} z$QGpD;;Cf6fw%GmkUHEw?mOd%igXqAlw!`RIL9*HCa*Kc3RrFmwwEvHReDo-E^8)- zqa3%_xt+{Cv8e}P2rw7e>Z@8)r6O4+0i@vqbb>pEr1UTVkd!_8s5;>-OgO5zn;wnL*I@ zp>=d)5W8h>Y$RpNzKR`Hd3V4*R5Ozf(L(IJ&Rn!{3=tN_bN^+>C;26%mfmGjB-%8# zS>h5}kd;*AU~tcG;_&2qaia+=7TlqC6`|OXTN|nqq^KW>QM~h4DSCh&dNN~ldAuRy z(JdT~Sa^_!jJX^y99zXQpKoik0Uu`*ZhpPP-$|kKwzeN7WpBb`myOnevzglNvZpV{ zm8*p*vmF{2wQG)Zq4C6$;Hz`+mC56g(L;V+6e*nBqNapXtT*JPcg*Tch|mje5+Ba# z=Z|5TZV3!;D|wx(0m8XyVs*F~kQwZ~DiXh(73vKC!pD!B|+J8tYW2b@bIG!5@Le zm$^GWyfZAGRP^oCS!r~F_E|O`a^h-}ANw-Ro3{9MWXS4NtQs9=7CJY7FvVT8kL}3t zAY1A}n-B0Bq6||>aWwoSe#V1nMu{WR`jOfIusK`<&B%p>UL+8rtEn#yBQBfGl)bhY z$nhZ@z5TFzDWV5NX&xyBL%p)w2rN_=%~Mg0DrZ5GJwcDj9q16(OJl|U3=P!^aNS>1 z5g+ITlDjI8aRaXeXN2g|Uobk`B%R^}FqLd~KZ9jiq=DVmjuceqm3I)XH?1**{Uum< zfW4C^!Wc&w!mST6NDs7xJxnSnI%`)GTDCi|JK*#p$#l-7%>z94EGRzUr3sjYj_m4^ z|H%i-;}O(MnPvEH&K;LNrbv3UqMW?6ZE*2r>dlY)aU#gg@C#B~f&g~tsw*qy$|0`8 z13oLuEy7-^i&Lwkq6%X^>PnHOW{Bj#*AwDy`<^SfYJ9}3CGW=2%ny?Ms6l-fSE1K1 zSD=^NfN!X4vw$9tM~5SypVy*8;JIr~bjze?TXSm4&>=U_IZ5a$=f2|*#z0)G~ zUV76j%ooFiQ6K__G2!te6i?IU?=O**k(5#!4efkP(1KGNKyR%j}5hY&r_%>NQjFo_F{z_fD=uj(gGXNv_uPrEX%rA09c8?!tD z8DA4~TOH^bFNZdi!*r!7L#n3er29qvHfEauWKoTGte9S{l;^EwYtn_SqU-xoL=+1A zp2{SqQEyL7oP!ywur9q^$vtc7AgyQs#o zAaH>b#wp3>pf9+N)EDIP5Dk#zCwSd-Sb)x*i*s+)74$eB15O%IM^X7JNU>`GVLMdv zefsdtehl>FPx?bCt9p*%u9+At?yN({$Ku$Az*&JVEBs|a%wT||<|@}Ob|20HIUU?X z)^bAr_BgDaMt88gJTO@*lL=SiFZ+ip+pHE}gDmW9D*H2GiN;8O`gTA6A^YD_EDGAo zc2@knv=a_)s(-q4JwAutf$lZoz&@YvFVAYsrZUJWuBJ}7KS8JE+L6rem)vk>&~p-; zzySt6fsZ}(sQ{}^dc+{rE6BK4MDPZs?4JsK5IkjiDMvY(^K|GMf)uiP*H+6X9VRqY zd=D=7Y`;`2h%~<8CGg77OMT*6oM`7msA@pq-W=j zskdXh`*@aUA;ZAsU!>>08g4cB-tK|pa7MI8r$7wFH8ZVo_s{fe02KeIx4T+%xVjB z#B?$&#YA#4I-)!@+&~Y_3sy|G24#t|+SPlchhAlP9(Jf?WZnruyuaMtbrExTWQda^ ztz|JYQ&WyYql=j$eX;uvQ-it3bv8@cB((A|Y`~`k4b>hx zQ1FseWfI4Uvi%O{euMwTk-;G}$t1cA?jU!6a4>IB@i#Vnmw*uXNS*N5LT5>I9yb1& zGDcXxNJ+-(ELup2m_!N1!C?NPwDf5$#HcTU$PXt-iO(VAt!rU7HRE(h@>c8-^ALl2 z56L2CQ-nw8TLafbN5xlXtz(S7o9{F7bS00c*u-6o)OH^No3P|^!g*ccXtHK+@R3e) zr*4bH{r4xo&Hi~^@M~t)SWb$Atkg0a3au407wvua zHq5rqWIh^hTX^&J zD4R9l_0@|cNu-gRCY`(s+{Od(nXj-4d z1hr3n6P!y|*+e4NOs3cJiMyQo3iiqk8@WF=OV|U zFA$3JJiy_aFoxb%O@shN(IU#C8R-=FkyMAPMu@vi^zV*pWe7}jo`R{;-OLzhr@;4 zbs#HXc?uRI59B-(P`bsD@Fc?33SWL`qWUs^ zUV_vxRt8?3q5&QDNFn!RVg<*LCjd2Y8@|W3S5=(AeNqYDQqlh>MPhx8CDV<&=B56V zdD8D$AYF%L0Kw6fVM0R0G*1QOxI!Wd-lkzTntOIlTW8xx$)F#*o$|~294U*FLt)9x zpzEXC&cLP{r<-}QgZQVh4CPR+Ks1<#TVJg<)X#Xg?swhA2aDCR6iV}x{V)1^yP@<* z-=`v%)TQiTIs+G4zj28MfTPUuoiwGdK5e47B3M-rB1zDvQxY;=m&kGN)&2sNF2EYd z_ykyAW*6qQr)NXq?S=jb|5D}I(EC}q(k=!0&kxO#mrnvI5X(rUTbniI`^DDw&sn!K z9znQ2nx1}Py=h)Gb6&@Xe)rcY5`z_XmL`>|&J)K|saP#cmlV8)kA9_D|*V-_+r2^$>^hC^Poh#%Jpy5-3=~-`VkBE{XS{U}PE^`u@kk(~Ph# zC*9X|NXajBbnj8u@jxV=Qbe}5p-X7VAO{JosV%JeEAz^?( z7T{vR#9xGaM0wA?8vjqE!Ai%Kl!F+&2~ z1QxI@nLx7WwJoHliBmVUUrw~qfK=956&m_4XlcUeP*K7i454DO)jPx< z_#R0SzX>1lu1Ts^(a@`K0Xxd;InRG_CHvo#txqIjW?Q(03qZL3+Ysjwg!iRIqx<(3W2+Xk6d?O@zR?%)$MTax=re zK&4hX)*U3JWg~wv4YaaBXdf(zYV|*VpQ{=QlGcN3mwG>U{y^;f@vt-iK&016CpWE^}$*veC zY?&@>(yRMJO3H1yG8mPltMBMy4fq1~E)x?iAK(Om$$;qm7xM^q4-V(wd#4|&9Wweo12Iw|1*^cVA1;jwf$O}`AW!s!yI`==2vhC`3>V@lW7E2h8TqwTJwxd(;t;L(t*)EO%xXu6 z)*8lX^xKj9A`v)(N77$=*-C+Cn$mxiBZ9fvw36N3>r`+>b>Ek+Jo(J!D~)+fULYyayMvPS{!$?%YI)OdM%_TMN)tv;T5%o{j1UXah!;VJz#$WPpx zBn{?R)dH`LKb8s?Fk#}(I%pyRvgEtIC((umQ{^?9`3VsEW)0#3*j~zb{$`gW9nK-Jo&uR(gUL;0V!bSESe$nR(g<~GOdRoU( zuChZ}($SGnfGW~Gc944D)YDxu%a$&Be3;jtaCW2}O}$~AA|k4^rjCVW4%t?wgBdWL zy8NnvokI~(#uVE~oF<~wHtX5> z0KYs|{>;W9QeHc8dT~ut)_`Bi8lOfz?dg>*X}?&U1u!^#Ng5z-DI8w=h52xcfon34 zPM_$X7J!QXcGCkvF0oQu4J0KMNUV#qjtBh^RFk;!hzF`5Qaj}Q8Q*d|6<0zJn{{u` zD2He?hlgo>*o?_fq^SES6zNfY|POS$E_tKDoVMYKu8$n%G!8H_*FPj_}`o&Q+H!G62H3~nH-W=?yR5;E9XmYC@RpdW$roN z;fw@XJ%I;k!G^@Vc>nLvi4tJafr^PP1Pod-0gPzykFtOQC3czL=eS#tQa>`kkruNy z5#S=zwxPLt|Ab&U+q@Lln!>C&H)T-_-mj9qLYgFmEGT!&^LTkKLW2yUFp)d-U*<`q zhR)gnSdwuqh?2$bHNXdnBCFGhG?Zv#WyEnZ1fT zdUEe@7Xohs^Uy9TN-hGP4oF9*y~Mwg36GWos9{+zvC!pbOSXgB?Qt?EzNm+&VP``~ z8E4Y_9bGl`R{tG-^7EKJas*17)Cb!mR1iV&-};HNnERqdz8rl`Ax8`9jr_>;-OwpffmxNai3#ue`)o-Zero)``IC`}4{8(^rHbJqE}m{?8k5PYm55RJbCIM$ z%;Xb(kMq$-F_K-+|8M<7BC>jk7@F~8y-5Ct_}8xl6i?#-r~ivTxpNhbt`(O5d&S!? zCdn}<+KR$9T~lpKEdO&H1UAOKlCx?__R&3vop%-!f?Aj0PCnH9LKeX`x0*6L#OguV z@eKNv>@|?<0l07yR#6-9gg0x7odUe64Y?9Eh&GiVHO2Y=k3rd0JFq9UBVaLoEvT*s zL9_yxIxE!q{lZeV%#*WPFeEgdjSH>TaiWrssJ8fVg{>$gM zfv!wC`Rt1L+5c-5l&-Pw$nbSH!}V{e)^N=>xZQdWPE&<{87L|79cdpWH|n3y*f?Z7 zWgv+LFJrg(Iv}xie})(efi|gT0SV-Fcc66m?*Z(t8l2h`Y;H>^VT6>DP?D}Yqtk{K z(MD6;eM^(Gb7LP~XLQMIhB}zA0|GacYfuM@2AlD=li|vcmm8WVJ zX!Ff=*?6(S7?*9!xqE72U*vM_>I{)iP@F_tTBEk#bBgH}h7+j^xQ}ht&kx-><718Q2#>zal{n5dW$7SkaIQ~BPKo*UoM9B}9 z3G<PPxMF z#Tb*w_kPCk(b6{VMkYH~U z=9h)K$#jFn_dZU&zR2>9QRUI%mC6^|4Gz9UNQUx%2$X*alz#}6e+ZO+2$X*alz#}6 ze+ZO+2$X*alz#}6e+ZQSSpwzjYxHgHs5OdsvfDoc-fB#sMKrN$^JZ%5XGs3=#w@g0 z;z3l0J^l<(dxxkwkSOqGA<<*Eo~bIzACMViB86NIPb@6lIzJB)6;;(PZaIoRN=T^w z$YABT+^%fxEuSw^EwhRw6N$bZy^kU63BMtwrL!dx7idpM-Cik+vVFsL0A*dRC%A@6 z0}z}mlx%7KItrNUvO?Bq`LF05Pty}o1|iqCf^m*3_@;9V-2~wJ`E<r+xo{HZ61jXWc8d3@lhO>$bn+Q1xh;YzpPS;R+oM0mLpUF>(rCYE&~A`W^9bd_aj1JNjShtFimDb*67#B->ETy zfv0E&hC&wqF3p)uevG>XHh5esYPPi^hTrTzn6)25v0sFvu@i3*w@;p{%L>kdel&`* zaK3+yDA4T7)FNq!oB?kMhFeovyFM{Oo0&f|inRC$1azZYvt@7Dv?u_lfN6v`u`0Bf z7htL_MvJfynF9nS>M`-)3!U|cwE6%Vts#63>^|+j&2JkplI=<*;@3zq%@90gCLhdJXAFvXCZXOU{A7_+pB;Nt_-5*);4JUgGy_2 z&j|LI4pwe&^77uc3>wLM91gWXz_x?7?3i}W-60_7uITNsxC+)yz&X++t!h^x@ zf6w1+N{L(eq~{&t6Bn4{Om4QDCsaYP5tX{aE{O>R1jp=C#BJdDi!1-y_d_x?PBNsL z(G~TC!Wv>hpA&5qL@WEFWTnBC3r-XK@LT(^Qj1D2yzHA(DRZ5EwGA0)uEZrpmgG@j zt7}DRLRrOtJf(&dVP?~)gHyb*qMHNt@eP#VFce+WYha_f^eQlKc@aRaCyp!n#h=04 zxz>0`RJr7Ul;6!jhv0(PE^1#`rQ-&h6~x4k3$>?Vzyz0omN@>%-~m^1y%4>h{|5C$ zp1welR&(lX>ndu0xl~)zvdo~^I~$FZ4#F9YFbUNa#Neijwkj*^{Hx4|j^DFc71s$0 z8}heQRc&-bQrRlr@s@XPzjG6(P@Bow%xP#!VwWtj48~5c_vmxb+Kc>W5gnr zen$sqBt}MVfuFb&rnActOQ{cR&V6KT|K`I_4!`9JAVr`0r{!UEqJo_djI9WLsExam zD=J$^Dr#ph%_*#Is)QHdut}2pPpuq3)c8dfWE;_M7t7H|U(sT>M4k6$RG)mxr&pgCzUfAs7ebF^ZfcEbtimvuq3y4V{Svsd-W^%*EC>lTQ(ij{9_F zgbnX-4{vVl&rn~F4_5F__+ykSUIlBz@|c|gX)00?2?)fEC%2r;;%s`57oj(L$yQHA^29U2(1 zvPtumUv8!xIy!ZgGofnPwU71^r^ez#WFnFxU(Wc}E4+&*5@Rw5;S%wV+CHCxqFueK zzw&SbiRThpYpEkiQ0!3&J#!@VoU4D&lJ)ar5irjoq?exhC5A`zHPfDNaWb!Nm#p5C zR(u)+2S=e8E~Z!d5L2_66Ay*{&k7Hj(qho%h=SN?vjMV^g`LqxakF z6M%JN#eI*sb4=7V&>Oo}(XH!20a2@1x;n|`*O;e2kb)84o<5pHKyvU9t0SaV=F-1C zzq8XwbABPm30`dwK=fAk!z>!2-uld3`%7@la*oq@wX4*^0jd4ASo3ZX6*xu2uRd&I z4?sKcJhQ85;mI#+GcxNNgYER)8Qqj7q`r!jf*)P!VDh7En1y^Z-TtYMuuILy3AHKL4?K*$W3r zz5pT*%Kibjz{l06(`IJtCu>t@Iyuvc?^sl{Ps!GeHYTHi7gZ2|UIW(VCogA?cZan<^!Pr+3u>u6#cW zjBC0}5=@+I=%-)!Efx$4##Y`a_o|g&~M@P zZ%gluSnc7bb)A&_Q`V6*Jdq7+d6S7UKf8P9#f+A3o0l(a%12A@g=(P!EL-=<0p!Gi zNehTov5S3R^VTP>X&P6`T1=`Oz(q@?a6EAjRlLnN5fmO1$^kD3nBQ;ggsKsvYr{MH=WXnlXJu0Uz&j zch-{J>?Cwfp6uJ$c53yfQ)3Q6X6NII~OqQ++rsj*gs z&rg)%#_!t;YE7`|oSb_7$_J-UpR!cdTU-`N#3jtOo2pU@<<;70m|Hr4?!3I_xBD3c zypyetWVCU7ShhwunG-7wP%0QIF_j|^1!wA^@P%geG6Nqk3#R1G%%gu~0y3ua@XcJ}a}{4x6cZ<9-U>QBve}pxu!QK4oEAMtJ~oxQ*ms{od7Fu+YHMgEk)lr}Roy7ZRba=j+rb zUwYSO;foQ?b6w>)?b<~0*EQB_ujkw8GVEF8c+9RN>s5T6)r1yv*UrvCtvBc+_7-qCHrh3UT&0k zxsWSpCijGurD&mVdxOdibYpdZxWIW2QhM@CnvbiWmIeoq78cNzAC#jOc)o%QlclYQ zwadBWMxSq7H71k>-MaG_8MAG;wN?GQhvmM)BQ6_s{t@G%6u~L&PmB_l1xRjUb^oQR zn^A9TG~zf9o9b%UZPv5{@a8eT_4m+san15KvZKYXp0HIwIxov6ppb5)O3OY_;t|C3 z3{p4vL0K9U#`w(BdA=)DJJo*(_fxJP&I}yA)q!YkL+Qzx@TF*K0Z{zlULM6qk18nu z@x%Cn0TDO+1x<&Hk61&#i@V`tF4(f>IBwpe%Lnmm&p-K^4L87RVLYWigiA39d^3hr z`VMj%RQpI{bGqw0S+>e~Hj9x8Dj$AL()g@Pkxmt5%daQSs-eLmmP~7e=eo3_%rhUo z=c(bs*PZT6FK3>%pme%-{mB4#z2*4e5qaTR0M#VDqx?5#7^E6(XD9?=L4a|xOo|F& zu|I-Z0>Wnx5|$Uz+qLDqdK$i)&3<;S753dq>d?k6ieAXf>7`t&}V!t2OweF2*ms_%lm1Q$rjI?SyZXw@EkHFraTfRQnCPTik|vq z9af6qBn?YG#K@#}K%zFVx_PL`?{Pvh*#r?>YZb%fdEEyvj9u&`!LPUNIxvP*BoRRT za<9G1xxiCSVLwgp$v8rSt?g`iYm1Y=sI@Y$CZm z#q=1_tJwceE-bd72^EDdKTR-$EN z#>CV0NkKj0U%2QoST`M_?)1MK@PX7S`-dSv>-u)byyt@Z4D$!?DIx{bPR6+rV{rQj zMNY?#r3okS8P6mb&vKIg$a&D<#Lappz5vc438+PdC%=PbOW_f$vwb4uR0|K!Wov1P z`VQh|_d8|J5)#XAw74pFl8yj*Gono@R6AF%!wZX}W(LJe(y;OwVxh{;qxjPchN-M_ zKe>c~RHwjQ1XQCDBHiBXYfy1AKM9WwzFvnsfrJKTI5rEg^}}kb1rk!6D=z6<8vj~l zBm^Z(a$5F5USOtt?@0Neq);w@9m&*f zgkCm4&{z_BO;v)Ti(*!1zWC76VY^uXst96?kKiqL)=s6MoX)N}Nw2r8T`ozX5vJMw z$+Fs0`G=+4qO64CnSb)KnV@g}Io19r4Npv8j{F_;u3WbuiB`js z;kEB0f?E`{)#5!DC^1wY-gW_7sj#ngOzKt*>E&5j3P%a0s7V+%sC=D0jaFw|BG$WU z9vKn&ayFuTa_91B#Us{}BCByoN4I>B5iAmuC{{JL!@W{1gP1av{fj~4Lf$2&0R>vX z$UEizujSFk9zE;W94MZ>n6K*gHqPm9-plLpRLObdEsGn+tm$voS%gn7n}hLYo%soJ zHT`FTVqZ>#ainMY8}Ak1uAOUEd@)i@Ja!$Hu|<*LObPjEDkP-Qd~~5f)v8UFZr#d` z0QEC7wj>D2snNV3HiJNArMM=V^^D(!%C;PG3~GC=aAg(ltSBKO1^H!9i3}F}#?#^p zI@?hqPUzwrpT?Tr_EF()tE#i>XQrxdSGG>Vpvd#O;7G!tWyQup(EJ1i<)96b5G~f2j9O~~sCj4Im@TmU8 zTVG)1%)s<)_!8t03v@5!@;1qy5cZyBS2<+)jdUnQJwf0)da%Q{KZZyW*=y_p`#5cH zs07TJ>=6`*@A-=BgGo$cl=Ygw?g2z@xaLE|_r1qaaw(vp>ng`q);L15+J+oYVnd72 z^ilVDpwBqrP1juu8(co@32tDp4fWZ=w(ISU2+arjI>Htk32d(XpY1VkuY(O*ZhSCt zb-lKgu3GBtb9?GX9-k-PF)`JR7w9jVVj)Ozrd6wJ^3QY0^`t4iS&tEOgeTp3y-@_6 zm0-%t@*T=PtgpY^E336$*-XS1uu78D^ET|!3FA#q*+epj3jwPu=*86>fv@<**__@v z&?Y67Q4W}oRfs$geeg2W6u7V)VqF?$&sSagbHhcBv7Nal-_^1Zgyt9@-h&DRa~y!h zqjHEt`qooJStdCer5DPiy+JNvQqmXY9ARPbICO$!vMIv}-vZT00!~fit_GEFsmr}W zoRS!)#aE&dRg>q`}Xy|YAhv%l!(zoKS&Qvrbac;*?K+_CWiGfcgFgLV!}Zlb9%@&Aa&WdM}HfOI_I1Yu#}d~@=Yz>ziq4#*jRR1%m+NNT~5M}%tv85 z1f*GU$UN*zoJ~lT06qnXO{lutLklPitd}gg$$U|`G}Ss{MM8_tx{1Oh%+cXR zbayCW6WIBY{Zr%fv}7vS)qn8V^o7HxcVaV*TnABz_nSnWb=4b}!70#2qf|au-|=kl z0$lQIC3H`~LrOeyz%mfzShDn&dvb5&H`j9#C4R~x$%K35&&yB1>IL~3v1LD?ENhf; zH1_`7@5BPSH5L2WtfInEkc4BJ$4hLJ0f@c%lQ-1lt{pO8kx*<_xjM>qn(ag*rG%4U z|Ipr`eE*{*^l{|`!+Ks57+Aop_x~X79D+oN8Z`ULHecDcZQHhO`;~3mwr$(CZF8#s z-gIRy@es%SUaSCD$^mZtUx0ab) z;LvYl#0n-PcqDhkO={RO7E_s%&MM7Owxq-lOUGcSPvrj~drWdc?NCkx$91Ke6zQUMAzW#}tVY$)b|y@0 z{P7;!@mx8VDJsWLTd1o?J&I&m7Fm3vs+x|Rpl;~nr0(YFb*{Iarim>v`33uL#duq! zRqTc|YLeQ(+Z^>V`)LMKRpt~49xIR#^lw~Q%*Gt<`LX$D&J%HrZqRRh?0lQ(ZR7;H zRakA+seAe~b&?g}AHx5&VVRvlaouNPj2w-&qfX2wC!E6*v=GT$J1E<#$3Y1otzedu4 zz*Cs@?>w8TLG!ho8<5`XQ0A$3nCIzMd=XM$t@9M(!Xo(Tu04it0zTUiz(A9&UwJH2 zJ;8E&U9hk3n4?-6b%)~%@kHF86Xj;xZ9&9_d5ASqA8`=Lu$O}>%hHL$jqyg_i*tcQ zKnKrRmVB}2>|5C7h`O{b?0MRJ2e6&hY;tF}V>zv4+#xuHqer@#30k^gKWmZH6}CjG zx}ZwBvWEkZgI~}tlJ`Qdp<-Oi92cxiq%`9kw(K7LP9IMJf;;F(n(wz-ref8_YS)G} z#LBeJhOk(zbIPB*dSyDM^!17bL<(dLxM==1{E#aMC|Bna9~1tY zKfS|;Qzwni&6qO2h>TJ~;$?SqCIPmC4&wGXU=FJ()p>Lsy5K6Ts$)rv;_zK7wfSfE zs>A^?y%t7}$CW@KMLuC@gJ8`3tUyhvy_t+P#A(%qM-#T5ifh`9(|@@!j`PmCS}T?2 zFuKeNwe2BiO#yRjUHY3)^ZkrS(>f#h`}lplgCRr>sf~cdKKZELSMLZI6^bn*HJa@xQ(nQ4vX+4LBVw-jGD)lOPWzzr zG*k-$?Mz6C6zB7#u9mMto8d5U=^xUAS_@s&L_(*(6>`)`z^1xG597ohYKBT@cBYH+ z-F>i+f5*eWK^$)P9$%HMl`*v5f^cj3G(=8e;a+<$7zGCIqo}hfMwPVuki-? z)|&bWc;sYICZ;PUk|Ek$AvZt$fj^dzjyKYsu>G7jimKXL|5#E~HrA^9CkV){E6x8Y z2W{`6=J7T0zXj3ckhHWNp%=B*_9f7j?E9RDTS>Gr?+kg~h_oUg+Jxg6%{`GTnF#8pllTG1WYIl-mr z`PK;H?WF)0az(jpb_~tVso#eZ&T6TO!|qL`Ef|>JU=@JZ^Fm@JMJP?CyFxJ=!ZFd7 zOe{*w(_mvLKfzQ0AQeIDJ8nfJvMM5l5{?y$;t<8IGH69)~M+N z)>7Itc&68JHel{^>0--=^ycWoxmxX|Cb`$5*?$Zjl2L_whmkE@l9Cj7MN}`r)3hj0`5B&SjpSU4YlVOIag{-fs7E)B|PbnTmIJIkfE!7Jk!XbN$I#YWc z6vI7i)jc|XKY3>$arYW12xX>)drAyZu(clrUyc#lBWq_G>;Vd4do@j$h9U`83ze6? z%^cURzINFs_cj_q#QOlUB^ab4!v)K5K<0|qIT$`b1bsnOEnr%GS58@v)=7u$!iK{D zQk$Hh8mgN&dKBhDIbcLeTBe*w3NU$tTjW?Cy&@LNQJcM`+`xE>r+hG`%^lIkgkDC2 zsGMqSaz~i5)my|Ln=-`~e=*0^=!p&mnQ}b19;woQp;oO$j<_^##>b3RR!T$HnmN@y zlaTS|6$n84gwMcwXa3qAn49m$X}6LGDY6FDL;%!w5)ZYn#mqUR^RmfdKL!pUJvkZ! zYm1ONGF7`9Whh>(P5!Eil&>pgD4!dPkl%E9{tOcddcT(Q3V5w4BTeE$tlocgb-|wz zhbwr?8(#h{ej^sKl?@O>ARlzGceMIr+~I`|V-6*-iR%y=_{rJ1DC3;!M_S<8WVV3e zZyv^JNu^_hE$lsjN)sf?eC6;x!4xPh=CLLWux&f`FOXpL!ts|n#_naS5yT79Ss(iS zO#pi4)mg!iXhK>8G&FC&pRp4SEde*QE*ipvp7Z_r5w*2jn@ZDiZGiP~->3rO4lvFf z#J;y7Ws|AE=cJ8HT@alcUFp_sL74o{f!D=u6%c5*VVN@m$<(5?ij?qSeFVo3X_6=+ zgXHLmC?V0-wOB87KUjdb_!DKla#eWH6S-BF!o(U%uyVf%YcyJe!fVM z=pg%_j8*K>dNB-W14m&wv30#lW)IbaK>HOj~Aw*6-6 z#tdi+bF#6`zB%nv6Y;4Zk2%e{J zXgckRG-+>ha)>n6nepO&?#Em&ss!_?|0$JSD#{G`FwlyN7b8~By^SQ)I>T(vLMt)5 zZvaXK!KTak_a44$R;&>;LoCgs&uE?))(nKxe&cO_krqce2EWegJ&V+%{6 zgY$R{Lixxi$IxuusFy?V-d30Z?xGxH^YpXVLf$C0y3-|?eBE(bORwGKj!CQ2 z(DNw*xehj7=}3`H5K$_vAnFYKOMI=swOLLWr(_UNL9wsXJ^x6Dgf+Tm6edZ=9TS=DACg=J(?AGWv`$juDgr(3tz#qfUOSdMZl3B?m$(Me zD2HNN@uND3RfU#!Y14>^^wpQKrCdu>PpqI8|2<5jw1#T6dhoS~d~m{Tb68@{wJj{A z$yB(Ku?f$uAaY7Aq2)%DPAzpDl*e`>pTElS=9CoxOl@Qqm3=C6@wgIlC=jZpc?iQX zgVCBQwVFe|4W8P;1#fc~hs3&ta&ALOqnz@Imq5NLB@2#&pz-E2l&=SZNgg65tZVef zDoSTc^}#df9hch3^aK}Lz`}(M$RC#sdt9L&7z0v!7Vw!kLxLgd`%MIH9D4IepudH( zgiD%heQ+EM7if>50DIg~BULm+Ks(BPXRixuAneesTp6V^EGVd|&{ZqM!V3zujGDYx zT;n7pE*^iFt2jGsRMG0xWoj=hZ5Neqo1j4(uEo%=d;z0Nrf)*-)dGfd1eD4x2%$m^ zB>CuIxPcd#Dqx1t6+2})HaN(?p0;ryNXFqB>&$=CT<=LVCr(xYhGzJRHK@lZz zf8Z^hG|y2hXInqT6V0hO(S^^@LV&TVluKvz%61rF!|fX2%WCOcMM+?=$l;Nvurx+< zNcocxu`b)!EiOM$S%ksD^F;+tAP;k|bz!V?_bfiBrva?(1RHL=g=QJGbXbMJZsJ4m ziBKNEoKyTLh(2F^WAYWE_cae`6gvE42di!vNSoRCH!=3XQ0R8!0E63(v|D{1b`i|* z1Bz8ccXC*=AmO>GWZ>!r(j6KK-wlnTp%tczlpd%tb=Cp?FjByCfW-(i=E{Y@^Y4dZ zhfX_Jj&bki1A1yt*#IRO49qN{Opbl=wY_yY3-!D+G87_2JmJ&CEx(tpOgg~Y={nZ_ zv#2gpwQMHbr@6fBkO^@ZA(CqBupl=#OXb55X(sXS;Sv~7YTBx|uohF3DT#{a3uHx;2GFbLGjBxMk+>JgL^2tDRKM})fJ z>Z?7}W@^(?dMziDj{isNWZ$TnoYK?f9lG!@EKl66mLNH>%8hW_#VBPAyP-+406 zL19`0=YIqV0>J002q(FJHuC^;;k2fTUC+I}KDhk_d$>5Cs<*qkKWlEfWN%L@Y`YS^ zj$v(_!=32@W2*8_>H%#n9+x9je?EM+wyZ6ElpuQd~nsCN0wzBoeuzQwu|(En~j{o zS+5D9C#f>WQH8_v{;N+0dLJ>Rg)mC%7=vwZ6+Get+&?v!;lgJJ9Jg;TsGw;0XtS5# zDu;L0RwK8eB?D33(TKv(g{HHiJLKiB(cJz{0vEdUhdO&Pz_L+zg+WAKe74a%|DIo- z;RqfllW>U^m}*gB+UdsH)ccnf^7q$3=~RGf8d%SEUQEj?kj~( zh$ath1O#(sD^mCVFb3&m6FvD4QBJ9YtFmXM4Z@mK1pi@1#Y5!!2=TUsUJGFx+v3Yu zXe+DJomZIH(E0vZ*G;?N-tnFgA)6NkqF^vPER3OXEYUE72~KPWsyY&1JHM<%e%L<` zrn*G2y?B$XQw$4BrU*EjxY&G*Vr#}enzSRWN^YtsucFQRO*wjED0KuzBelKeia%zb zL^3N!CZG$@cTjWu01}#p908oL>{z${4}vO}0R;WbZZeT}MqI%t-jX((#F^XnR*o<8 zv32Y0Fz4!jiL5h<$D5zPsR~^pOLKwmxvhl5JS7C*SCK~}m9`*KEDzS*cRjerX>T2O zY#0+#q6byv5(z5fbLl3{#84p4FUF3pUTo`~n>EyviJ-riY$yA$%(#rJY_ttpYFSTE zIunyQXo@!~5TQC;W0jeqcI`@b11Z|I_3d1-m(nUJ_Q1P;(`3kuPA$CcnGfG`9oc)# zfAKi0%Ir5qOop;t?2+Q%kk)F%JI%X0--Tx~6}qy273OjBs>ZI0feHkCN~zyx6EdPz ze5&1l+~pNsWd_hoEZ6Y3#S)K%+M2>Zz=ykzX)4QtI~iK1=B+G6xk_DK2pwf&xQyi1 z5a@>FJXJ=60c7KLvN46cZqShgH3&~DK(=5K>1DkicI$>63bZj6f*JV+lw(HYWDiIA z$#L(ZqHoeU%5~WIER_ldeqyke7`A~qBl=tp z&aPZAQS8iPi_|QUoFiDu?Uk?80u3XVF$bwC?(XJTCdG0V}`|zC5>C6~VGrZpY~Fv7+bA^cyE*%SIgg z!VeW9rpIB!7f~T^2D~zEEUDGk3c$A(qI8ObWNS)p0`izOP}><+o^EftFG?N%=aKF4 zQu*T|W;JoHFOav049y1pK?GONx8beM;ijlyz3=g!|| zggIME zbWf!43ppl?!ofA2rwBO!cn7ux9Veb*L7AqLRX)};=M2snLqxqiKS|OS>5`5hJ|7Fk zx>j^;{WK!sE*60O-#S(}NLFAZ6|UV3*ni~$6=cHS+7nw45qzQn$*AP zeU|#QGL@0si@r^nAq2un#Y96#=G53pTiQiz>-N8SveQU!AGmg<=8&z_5&V9w-Gqfa zvt<{jpydV3k#tuD^!`%~p?LCFbx$v4iIRZ~H|#)HyHN|NP!jR1^Lytjsuh2p2$PA@mTA3qsYgi%xc9>pZdp}fY|w7wl`0lhMdRt%tK0L;2bN#yKgC+^4PDg7nX2B@$OiFG_sn4yJ)9TU zHmpl0%2ZzeGOrpm(zl_&ErzZJ*Hz(Dju`LeTLlCn-&bhcGTc~o#lbS$CvBBLk%X+24SVJU5=po>R4o%1!b4?$A_k0UWX>w7+*cdb#!_p(8@kp_$EDs{$@lr* z^s_H~bx++^PTq0X`Nash!=NVm)f5m+@#|mG9+gklQN0 zOy-5@d_exEP?qM3e;<`)k2FuqsM$}W*GJ~Hzv{63Li$JNaZ96L<+<^M9(xo#2iQ?$tC)&bFk}AREtB7;jJIC$gC}-MnuX2$E2;Wq^GZ~ zXD5g^2vmkt?q{RfrM(WcGr*ya0#Mf>Ss#y1B#Fs(NQLH^kNA$}kMCuigTPV99}5`| zt{RyK+x*bTUE?Nt)(&x8*s>=TVQ1vqnSJ}vh)e$PMl#`VbuJ$alZz1(& zckAGUq7(Lc%%>me_Du>jG(|uH6Gk>*yPi@eURLbZd@(m| zgfW)v9wKD2d!=+-C~HkD&_vBHu5R>`+Z@ZjLeD_kJg#d@+A=I40NXnSx@W6koO{>! zAKW0|iZ8+r$j(L}?^wQe9A+}4x57l_wJZn{<0rGuU0Rj#*GjT0V}T_+d=rfUMDKHw z#o>MUK^xfK4;;TX%)gMUe)et)P%`s9g>3&VK*DfLaSl3@FwSI)v`0soJaQo-LObd) zMzuBv_w}}c+OEOcKXugjx-J8tI8^VW3bMIlpl7`2)_erskq>lX2oDWzr|*LXx2QmKeL~#zJyiZ0fzB z%2p87#nL(ZhMZuaX}(a)KL<-BSRS9`xqIs=@L*nm52au_DGWh`5l6i{o0?4M;Zc@D z2SApOYynaRady#D@?Ju;Zg<_Qh&QX6pJk2T{*#4UPdZD?2YTu|fmo*4XN1^oa656E z(OQOF9q(x6deZsf>p!`I+d_5L&w>289-aF3X%fI_g6&hPpbgO&E8Vqc45~eQPvB`) zu#9|?833iaZe6a{aSf*|+HdV=*4Hh8jTpUYEsrHnLg#a$b1M;fcy$GuT^3vtmwF-` zW^!JsvkWL1d4b+JPsG)E=XKS)_GR@-cU_m$N}^Vw+I}$;7!(TMRfLf0>BqZTR^@#@ zySs^IJW!m6G?wi%4IPph*(vwS(m`?$LI40Iz9!pvVx}&;KpT7!=;TzBYdP0 zpR3lw!N;nL@4qdF_2PQ48Y~&0*t#^RJmdO|H}RZhTCAg2!e%8sk#g)MU<+FA0D9$Bd0EgJ)THc>oh?`5SJ9+!toGqH z1im#X9xqZl=}g2X~pSQEE56prk zR>REFl^)BW!L+GayFq4mCu4+4I#Cn=_motgZ0aPuYbtH+k^E{y`emMlZ7-xt6ye&J z=GCGBJE&64e$Bpx7{kYh&)OdDd1>c7;3|gV+m*jY zJyoejgZ7mHq)AVW%BAnGaH7tfd5-C%4oscx^Z?>x*zUsl_g+8#9ehf9S|BlW#g$^4 zNajPcYqLhDXLb%6vcAMVa`xzp#cx6$a3bfw!Oad8;^DoU`C*ljUvTqh7`LK96MMDV zbHVlbXYTQeWD3`^?;sVYW6J6cu4m7{=Q7!~ufQ|`)8ux?pf#qaa1@A+g>ggpzp%}D zQuxUcn|78DUXy~1IxbNf43snA^bzrnla{yoIi>99fjSWDUTP2$P>Rn5_PAP38KynK z&~xiSe^NFlQ7S6x7hglzYEdIC=4J|?e|a2u3bRYEfyKm5#XH)&Dk^h1)2hWG1hd9?Qnl=)(ml_+MT*)NYk5~1 zd1RaJz=j2Iw(0mF<&bE;&nT#MJNwxxapS4TbhFp^tAkrQ(6&qH13m@XP)i&#e})ZX zV?5pzp6x`-Z}q4O#@;;oSpiaVVO|v3b+vt)qdg+2qyWi;^_(@lYLHEvP0_V<6!G{nJ5n-z_PEK23Tu%R;FbESL}I=%P5)5c@;A)W(UI{exfw91i0xe5suX^#iuz3uPli=A zWdGsi7q>!xj4cvEEE(1ml%MaH!TW;_@2HHCwWy?$SrIYnnq;Pi)Au);vkoHtv$Boy-GjmK4i_Qu4xKW5_jICuv>WR0! z(whLtL~={A;Q>5C*FKd_HL=O(^xB>q>&rA}=*S&Z7ngAkHb-gXap8K<~9!pR>JB6$+Yleo%y* zO6kR&ViO~I-(f7~Q=j5pLVWd$Hdpy^(y>S0v`D)u)$aA{_{PGdwPC8|BzXy>w8_)B zB~98k&cS9``k#h+_`W{__*CzGqMiQSdl0cQfC-PSzWzr70VJm8ST^&}%@f)yrIL-A z+peMLO2GPMBzPp5f3@tw$6-x`KG5lp+OoKq{p+U3I|q@2oj?QQ`2QF${!ffkom5H# zBj6ZWCAmdOH>m!9a-8tUzZ@rE?dt!HZo z9yP`>IqY2k3$tHZqSdGdTa1*;6WD@a)uHORRe*twyO7r(#didYtUvp>I)MN(5*ss2DfHMEXnc$>XUO=^Es)JQUGp<~4wP0auN8tmg-Z#T@3B(0X!l2|@8jMSRUy~;Gk9S18-N~cf${(l{dL~^skFX4nnrRN-R$*=E z_w+3wB*;yD=19eJIPYP$q>gkd`E|Kl3u!R1#XKSEI`sxVNQIAVd7C#8*Ps0U_4~fO zAvK`l0*_dMBraD-TZ?wRqiC9vg7%L)Iw0S;!(Az>Ai*~!IG=f03obq6&DVB&qZ6%6X*0+6kl-+c6McsOo5U^xKVn1{({4XO zG5UluZMSFvr2llnPn1ViWd-nkT5^TJhN*b~n9y%GxH;bIHG7M4SgzorA)2Q-KcD+a zVik&iCP!f+@e`tMOIH@di1VQeHHXznh15lzk8hO@fO>Jj=F$uGDx>Pf4NF z)QJI+H^{}l{V}ab>t)@S{Pa%AIb588x^Kw#u>T8tD8wQ3qPpjVA&U-VL`+;LF|IH- zs9XET4$3r{((k?bv=4E{ouwtrf^8 zFdRzzfAXBle>;feya?xMXAw}^O!F;fXEK&OFnHcP4WZRSPj7lSjY!<~yhvN({w{eJ zBdz2Xi~O)@F5Ea8hP2|ls&;_g*luRv?i)ysxxxU195F4$kd`shW<9@y#U)mKo)biu z$JT3)>Y!_??x1vC$YpP-J^E>{Z6G$2U0w!g&4D)4>7D%YoT#EPugFF)e=5bSEstY! zVdE=+jA^CDWWFg}8mnFKBj6>Md_@rxX6bOkJA0KeNbLQ{fQ49QZ8V1ZFmMQwRJ>*n zk5Z%KX{9)!L9Erw1rs9-K`6T~yx>}7YqH3!hQ;3d_R6-iGNFRp%IDTQKtZEI&VRQI zDGIxEv)50gtY8D1R|;sXj=Rd5*6Hzw5*Qlvldamn%$yXpRpsMF24D6)Raq`M9k`BmE*XdKt@*;NTok)%fyopowsa z3eUE*yQ0pXpfGjO$kXE*Dk|jmQuEq!V?ExW#C(rPXwrNAD~?#*CMFah4RjFx z=z^9ztx$DOeX(oh2x^xb|EaGvf0qa-Vp{r8#@8GM6<_ZRAJgMvUmt-WR%-VFm{2`Z5k1Y zjM*&18El&$AeE;CH+IaKEJ)Y)?z|?PWe7Y`^IJuYwo_&>Ts};1d6u(_?6!H7`d>U} z{;{Nl>m7ADiN z?XC93q@pqVfMnJVi6%yHvHG3Nc>-sMBFW0!GRd+oHb7P`KHG4PbL|?ldotnG0p1e0 zv*H%MG7cdRv=BvJ$!!nBsrAHUY|@-3P|Ae-VNpR8693hC5ROsUmQS+OQp^m!9m6aM zUskd$7aRxC9~7ukEJaAVPQ(FDl%9DA8@^XC^XvC3H{<@@q$;uG{7N$NtpGw^*+$N3 z#N8_}!xbiD?0S{~Gf#sH8x+t=7Sd~8r;oDCKoTpU#F?znMdL-IyJj&5jdwECq-yH% zDSYhateNBhDySI7Z5}Ud?AZSo&v|7T4ldu|`>SEpP7|yQ(?UR^Cvlox?^_o&;C6D? zJZaTB=R=JEG`xxy=tc`)=T?R;T49K=ib(R=Jpf7$Z%IpzU^Pmgo!h6N$z$<=m?g4A z+RV4r-X}Q;+6YZK8Bi?7_B^Jo<}KT#Hw0AjOR!gKqJAPthE1bxI&NAb4~kM&r|l2widb6rw0}HY zYX4f+RgrfZ>A>bU_i@5R7WqM`Im%S8giotrg2dmb1A`p&dks9loh1QNR*?uj-O3jZ zUk7gzCc_BDdvX@v=Fcye%a$*xc;0^~a?L-e;!%Y-hm(wx%SB_Sr?q{M+RvEjv?cqu z*sP8RW@|xig-8Tq+;@4oZgo~0adP{mn|k}>`rF<6{{(en3+71wFQD@)UCVPmti(t6 zJUev}rYv+C>~)Gg%G>7yNynYHoGhZIC%9*ZSIg(C3DVb389wxyV%7Qto}1Tr2rZn$ zR+Es^k6u?Kq^QL<5U=-@#72fdj#}3rerS73ZL1Q59H&GfumH{dVtvTklhdJQW0}B5 z+!r?#d%=Lem-(_1Oht|d>qJpStSykz(*9ViR0gFK*^1Zpbt3P!0X5c$7ExL>S04dd z0y7dY!|mzBMKgm67djjBvL5Jibeq3MITy}3*^yc@TEfd@YdAmITm&c;RzH3EB`9+5 z)o#O4%2^VOhx{V;?}1IxDk3w zAk1Kxoh^Q0DLi&U$VwE&Qc8=BANX)8XB47&%O|Xjyl>b-pUXnX!sqJMwjas;$)!uJ z_FHXozimt4)L&RuP2PQGt_T@gN{9_{qa-hjmMCwzLJa3qr66@A;LU3ZFGj)F-Y@`7urZr|xJSc{cGP-z+2^B!p+ z6in{W69f&5*{sGL50-O-lW1S^p;?BWkv~I^IO*Pg^!?#*^w0+Z1h!#``K?g-IA$sRQIv!bCpC%ag zQif@B2DQWiHFgt^_3xxDd1MQ7sE~e!4k3Mbn}Qq4P&zX;`dWTTP8$o5nqrmPn%~Ek zU#L@G0K_<%w2wiCL>0d^eXLnRjNK1N-vH(fZLEgBvgHl<>QBrPp1LVgIMlN~-hpm^ zyeG2wQT&k%Hdzx=qW~2*KV_n8{dgOEyWBP~^25_O1EqXIn60A^NNKWkxt|ig4~#N} z%>v$(5tc*G!8Ho3K{(M`*Z93c9hziu2FJ@lpe0c6ycQ=63QcHhu(sBH#7WXjQ)}QY zjfb|#u>oQU_oo$`6L9qzjx253&D4M8#w}#1-W)Ittmj-IH$D6@nr3 z7IIhST?L7L8<{mPoJ=R#ph}ApH9&CuoFRoFK1hX~f@!?0rvs`4;{<$fDOXCGvx1;b+I0=~fn|H1L;i4_y&R7LH9uq9j{AdJrF=EsoMf z>=varrmSd%Z$fTWW*WSToToUpPyi#r`ToUC^^gNECMx%7{Fn!Iz~iu8IJ#eD^2Qn< zp^StNf|~vR=&B6GqpX+njjsw*>QqcRZU@fQk0U-#hyUgFl45(IOM)Ztu8lX#Pnq1r zl=#>SCy@FiueX|z#q6Kgl7=3awX-|#Bz&HIpzU-j(PDTg$RpBPXCqGd^DyatT_aRT zk0cM!hrU{p8UAIY6CW={tX1$3L#ls)(VF+S)Z)GwB>B(=Vo|m&>OOK!F7_vEf!SA^ z;QKG7puT$58Whxm)taOS<%%MmksB^cl%xblcq$#d*JCK!XFe6KcKc3)5|YoZ>J)G< zIxy})nY&QT9#yTtB6k7Vlozy3GZ={c zPL+4Fk~B%xD6o=Z-=Jd{$_L9n;^wU=&0pat&ilPES75|6ai9!)bkj6kii$TrDmN%1 zr53J{0Jdy{qRdSKX7Zn*y~un0RNka@hI>QeCRC#mnprh~`Y?VCdj6$D6YAfe{>*Ka zdd3DaRn7R{!yIKW)vhx_s7Dh<5b0dNl4!2)U@uLj$CXJ)d1;4IRA~*ZG^ccHtLLIP zbsqa6LTpLtK|dyT$Tu z!ztrj^U2o0zG-AjPC{Xb7P3`uM?xr`A}4L?4aX}>=gW*>a_C*wI>-!!mfOI?#Z1Yc z*Npq!;h&g-)B2b2*to+(U>gQ4g>RjD3rV409WqGQv^NLfxtK1|A0fdGcw)z@X^4P# zRR%9!mp4E;;5+!UO6S>8Q8f_i)`-MblxtaZ1@CyrDM;PCfHBtz_c*AcwdkufU)kC( zD?hg&!?xT?5k7>2Mpw;0MLlXojTZ?i)H;wt#hOU+v0!k6Z!k3=jNohb%5&{-kQtu0 z37|;Ek((MV85nL3rJIvyYLr_K8E=|`MHirn5_!Jymrt7)snzoA-xA0c)LiJo=V@Uf z*fc8S^7<5djIogSOz;)-4ees2Fn*QZWa;dUvAnYW6vS++&P_|JFVt4yu*kwOfzv3X z{98R3>wE)C&zhM)>$|}wJ0GFBrmdY;<#1ldGg2WNd?zr9NQ6AwLZgD?gCcgMQ>+_c z0=ZIFFRdfNQ%*pPSpnaDrkK$8hH~0Lo&ocRx77MOZ^EquPZo zAoyXLJH|3r_WrHRgK!jjy@VjpjuRbrU&nofvjU*fHSj&W)*L8!9%`95MnOzRCgM*c zqga0n(R8XcS zeEf5G@Vp51c``K;BSgIr)FP;QlCMcS!rJXV)&pA7Qmk3F5*^fDU31NXJ&G1jHFI53 zn4hKl#}sKL4eaY47+hx2VZ5~NCA}gQ_tpGRAo|ttl(dNhfsH8Uk7j{yfG;Wwg*uK` zI=?RPZ7et)sU|cC-o_?t6s+MJk{bv=<-16Xy6x_v`Xdb8DF@O2EdnJd(NT*qC4}c~ z6^o+Jyng@CYlYC9&upAu3=iAMGT8RFUKc%GWPS4va5m9!rM!1JHf*nBt7m+yn4m(U2E!E-=ik|6NK8iHwlfL1{e zKHS!H>6^um*Jn@Q5FdA!bL}oq?>F5Y&z#*E)g2Ggk16cUbL0y>a9mBn8Do&`#nURZ zn(vn%50*#z=+HbivZ!{$0`7)YP*gqS;rEy=kpz|i(1RWe-%gP?*IV&7Psdu>xl8Z! zQ|KrOQ#X#C%$|naB%Em}uh&3~hpKPcHG5L8p(tjVRZByK zZ*d;^qwDf#wJn1BG}M4mR@IZgO)-+4OT9Lt4)&!t2?+MKr~7Y+ap6lt3!Xd9A^lSW zVIp>~N<_iXj#wDO<9Onc#*as9+o9COTz%Vwy!n*{j6 z%u*XB{@M%^ZEBus7;h47#%*~95~%eACZo0e)~W!rui}~26I0N|fA`Vy0{|17hn+xO zu^iZTK~6#{SHXk>EpIc?_eR~IDc_SfTP4}L4pxt^i|`Gb95EIf7{u0Dq?4>K5Y)u3 z(B=6d4n0@H5nmF6AM40t|CY5Q(X0$NJ@h_#B4Q*q>geCS<|t=WSMEpfnt|RTGdZ>Kbz(pH%5&i!uw>wK(NH{SjhYPSyxJ!rdLXUW zO>kTAa({}*W-s#KcHFNgET|s8E(R|W@++nLT1d%?*7#TL1#q8Vc$*bWFSAn5?-5Hj z5$0ft1O*@IIi;r*(8J9d`npX| z65J>7j7ofnikBPm*?5xyf=eJxc67qw~ zUT)k8;X+U$#@(wa7H1uFb**Ev2MwcJe7a0)c8eBpHN3EK#X_+=k0)8TOmdEDt#nYn zUI#vcUd0-!u5xhjuMu|AO|q30>gCoHbwu`M#w90%U)=Q^8Nz3O4mD5o@FKT=KX&wJ z^GP@tB{H=cfqyoF?9~UMTdlXN*7QhO_Um?Nad&&{i?gG}*VGXhm(>*@GBXLr+7{u& zekHgBPMDd^wLv(noA9K(^+hv!LOkulvAgrdvD>Lu_j-w1H#>*7usU$yEm@dxHM! zb4>z0ABAjd-6gmhIC*VwWB7<9;?Z(Tey^k3!%!q(CxmKF1lsBGiGv@)Uzp`={zW(9 z#^=ZL=5Xrb!E#c+&o11V_z;xip&E$>t;lhmg_+zjzUrc_1nmk7-;0A;|GIBiKhsjK z%oBoqN|vz^E6@nJs-R61&AMKB&jk3Xy6@f0Z1&cki#Yy65I#)8fXhxGvQohcWPQR+ zR)3%sRB%01<&*%$&Vt$!>@jz!wmYgK)7kP!l0FIOiR7JFZ7s%a+#mP=Sn!e_a=spTy#?G!}7U!D9aZ4iiI~+AepFM3D7JdST)1N zCvZu_M&Ob47^I&@V1+EYu?easufYyv6l z_<_0W`f8eNdJE(E>6t@>;+IbpP~;my$XD-cp#z<{AlL{il_6NV0Wq6d9uJWDN0?__ zhO%tm%)tC{u-O6U)LN}#Dwg63=27X`?cgDH?I-P}Qt4ujY z)5Vy4sYojen5hp5MAOLz6VcI$MpA6yMpWYg?XPF)j|DrNa5#mu zc=*JE1_wn)hlG9Ofe3`~?B9=19H%lXxDNUl!N9g&(h|YB%BxezsuI>{=9@ygz`3SS zBE{Q==hyN?nGn`H4)B}Z*ril>>3EK%qlJ+W)SB`&8#!-v+v?uI8#$YC))k>IX;tcRz1&s zLX5?Fy6Hs0plmJNP{?JRvIaICqIOZtIf%YI*6nRO;IoN(-g);`1QFL46ba)UG`cn= zr|!Oq?y=uzeL~dZZGC2?o(OK=ubCDNjP%Z9X>gr7a4;$}`jNTCmax%{|7?cDjFNZq zd~o5wboX|;eXjn&3aNu+*eZRXO9Z&mHCUM2BLeo!ALY^``|@lfdUj#VtBYgP7sc zdOsmjo`r&p&NlswxGOjFKQ=ZAlV3tj(#vDp(%`Z&F;`&6_?4Z3uO4`^0ISqgQ=8da z*%7WMfX;Zkh9W-k+p<>CoTnZaM#&j@|J<6CG8WKI1gx1d!jgn&ZsAA7{}tkaftj_b z9p!TmUh_|$n3A)61xz4di6zf4V-hZBV41O3CNeZFQ%>YO+zjcT^fyBnwNWt{SP)92 z;N4cYNm+>qR|G%}nb6AoKkVIebEe^<=lh^z+vwOfJGO1xcE`4zbkgw?+qP{R9or|p zX7--7_sp3yyXw@bI#uf>Jbyjcec#{f^PAPsxT&_NNnq4_H}h(kN=mEl`Y z?3})?oVw?)4~!G`M8-%7t|=gz6g0kMJ^@TN(7qUBniB_!Vhf_M^2RATC@e3UY-oj& zy}q(!ZW=G}k55wJGNSzvUB9mi;#Wyi=oC1|=H|O&3Dx zctFe1M#Q{ez7*WY;oc)F&@*ie(&-LRcKiPJOao0av2|3X^?Vh@vcjGWzQcIqBGZsWEDQzzZISO($Fw6 zL?4X*16=_E;H);kKxks)FBY(^HT`=!18VEz^zg09uByW-DR9$kjTk;({_KVxzlnh0 zamAj0av2$P-|9(3RclFIlA{tE>(?X^DS4Nula1?rHH|}@if4hYzc2x=6pa`JiE&mrYv1aPWKQ@&TK(A181?aNnH%jJC>?Y|_`}|Pu%0J6^d?JT5 zJ$^x_0kJomrnvP1=wb0o`Ng?`tQc6I9^P}NVajoXjOZwAZRLi=%Yw$`?D1r$uN~&5 zNH>Yq2i0$8<9QYQ4|H>&5RZb;*AciMPfnyMXm`lO=QvJ;4rh<=mE6Lhuqhvk*^e&k zIea!=Ro(-6L$ z10Kn}XV_cc<)%Ab$!Y#H7vW{h?*vwreFLTKl+Ao;qUV_<(F&&!u&RI_;dxIx*;<5N&9Tf`%lIZNl?Bqffo8+Nu3yYu<=p zDcd>3$ma1+Z~vpJKQT`iGrhRB)kouWr1*+72j_Udt~cSxzJUDA*(2CHPYdVNuP*TL z8W~@D31vuOHWqEy=B4W(hdr|uB{si#UYLS3oqOTj9w1mN$E)!jD(UWnVhki^pPx37 z@GSt=)ZuRE=%s1yg;MjgZ%2%pL*y}R6Qmdo+d0E6>`dA;hd0_84`<@ogMd z!3HkS-wAHB7H{{|P4Dxf9F%Hbdw@2?{)UBt?Os6d5o%8<#EUf|Y9!)R>bH?He@Fc) zDGU~_#&Orqr!3SO92AgY7NmNfhG0^_lbtga_^Db{_S|PLT6^;vSs>s^XROai-W_K& zkc_6DCIBr&o49ixx$b*y;jW|B8!sLqtolDx!_0@2%wj>VU1 zIM%+z*z2Y7&{bjVkoTn;x~D;h^(W)lg+(UVhoM?2|5XhIj=xkxzAx2qk%7WxSzidL zSpbg5eC8va{tBlKVYQ|M!HG_kf;U@ZJ-o=0${YIM>$pMAWdGIU=cF@xoFLN8i1{S+ zvQ$9@#!?QsH=R{^|EJEJGjd@xsI~<+K}9RMt(8x)xu#4O-*Pbil=x+l%#|C0pF*?` z%e0pPVsbGI!fssy_5{8X@q%sHgTKcuIZB8WVv2>_W}GVq`2N;$)f@k);}#SCt&Usm z=_{&r{b(MIhCur`$r4}2BhR=3O)8UfIga@e9LmW*5q2l%_BV`6F+-$ucls$fhs-s1 zNoP+@eWY#$y3H%Uqi{w@JNhPaUJ*87s}rvEM6bvx^!?1FP4+qHPzFgsCPh!qhG!Ig z*HmDhC)bmbWTTL9uRa9WKQyU!tCf|nCH6evhr-mv!u`b>+1N|B>a$rUK|F!Pit}fG z`wIaFW1HGsaZy|99axJCbqoWrPPa5~&scR%M7X}Ev`>}oDn>kv()4oQr^WJ)^-&u& z2F?Vpiypa#-YLzZm1b`7>Jz9@-qjn!4^bSH_h0G`GZj}t31A0f%xh*==Et6!RM{YB z7}xZ46t6$`7>C6=yeYk!iB;UESHiePWs&`R6h|he`fpL3 zC>6^;M{%`V|2>Lp&H9Ssp2WcaEsDbqn*7gEoMh_$pL-v%avp^YRDlG!DYQd@jo%q` z53tNIf!e)2D#hm?i{GK~OU^(2JNWK(JA-_Y?6SYEBTKx{OFUmb<;UglvT-jGBO@F_ zwk#aa`0mlb_v9Oe4>JB?yerS~LBFRW%>4$1Ei3#g}p zrCFqvO0o2N@3yW$Xlz5W^)u;?Vwsgo!H#6YzZi`P-T9EoQT{c=Z?!=1=cE- zB^VdB*$zWsw;{F798+5yVmzCK5@?zH?tc&Bu%B2YqM$f2;SFjmcy`hLK*{+zBc~M% zy`#`zV6$*a?b#=qR_k1}is~4qUw8I>TPA{(Vg+U_l-UhX8i!>dULAr|QI{wqhQzeK zSVEp#N)#JGCpw1%#oX~RqUl2gugjD$b!GvVi7%wF3prtd=__Mk)$jI2?S?H(Q%Lr6 z{_S0Ev$eK6y32~`yugBQ!9I5@TyA*Eag*N187JB}YNX3kW`qDVvN^{ZPo!gyoZ9z~ zAP&3B=PQVdgWvqW3E~3X!UH&WZh!obAnrmhPfiq6KJPn0a5lHyW`>|l(Xts!jUPBL zV}&Rv{)VSow0331un&6LP<9cFeiit6;an|z>2q%suKNoiV`b}$$k@GK1`?HW3AaH= zDC`~!g>X^*FPr3~-Av>SR-4f>vPT=70{IC23zS*}Y&bR6vKJ6Dt!K2XvR7p+kuRUb zt?IBCt@4?EE^VD=p80(x}Q*Ke6NMp|8S~CI_uen*MGCbw562XNZqDU6+H`Ikg z1sc!giWV@I!fJAD&^jt?O@kjlM8$-EFrK?G2<*@MS}khE`O5N>pR7WDaeq>$q@Bn5 zMhEGrv2CxjmQw2`Uyn>57q{f5w0vRrv(OY3YMHAsp7+!@>9Vjv$w&JXo45F=k9=xe zWM`9TW&o%^p*SuLYi*Ego<=8QL|MPdwm~({03@=uOKnZH7V|&VfKZGqc3wkG z0BOEs+(;nbNx``*odwY$mtU+2@Pts4nAvZ)(#(j&Vz{%>Z@G#%=PIzy2v_6U$G7Ir4<|<3d0G0XwZb81jdr6pWJA4EIZ?9Qp+TBSu%PPp*JF#K;N zp=4i1R){z5Ryp&Vn;yf--Yln|_H=CwU$GG6nixNUBPV2i%qELhnb45*k&c`3`>!fVa^nY1Dx3ZDydNVH=%tCTunfC2r)CU1fV@$pM2@d=)yRp%4v3AftMg zAd({I#ctB8Wtc2mzz%_;OliQW-h_6-FJN5xM32(Sa4#NnnsR;QzIIW-Fi7w3ZlUAf z=(8^O*_eK}PC4&l&(9wdm|4B}*#1FeXT_*H>3PL@JcQV<7KLl+No>d}dbuWXIV_yh z{Ul7NP1e)tS3py2gjs>vtL+o|%5RkP{RUiTk~?S(B6}zKhS6X`wzANiRzz7Sp`aIJ z2-)v5$YP4HA=yg;_fLPUz$n!wc17S-0Ca|l`W5fD;`>QhqC$!2?URu;ct3X25)I>M z{#i6Mzx+QF4M$P`Pej98i~o&isLB5&8kXk%6%E-w{+nn>^_?x|{|(Ww&jk7Y}MFVXOS z77ab^{v{gzOEmnKX!tMD@L!_gzeL0TUyFvHu^mm9w(Em8L0!;IpJ|Tw@hYWd1+9ta z>Abe7bJqpBJSJ+hQ?ia6s8ABtN+f+4YonaE8@aC_aX=ChB;uSoo8v1oZNebUK>m@h zFKzL(N?$!4PLNxpjnJ9GwVhQNjIX`V9hJujoRN8Z{lT!CfvURRlbZz(pIA9@`a^k; zuQ!#E*!3SS?jrG8CVZ{(9f&9$*GXpoVXh-x^kJF-R~M{LjxbN;z9RdL8}S`_N*ZEGH^FrDABN!N^QUqPM2 z@^GYDVUwa>;2Hm+iR9H2B%50pJW)a@fnNHv zKjcEXO%A68KZtHd)3){14nz&Ntd>#XC?ZsmT1$VxQ@v1`gF>mT;a_7;gD=&;Ou_}^ z>^v|@`D`;k4jr_`#!pPQ-^6L}KfmYGfFR(qBRK)(s2_52c@` zwHb7#hJc?(Q=q04{PgZ1lN5SvK(wiWrr5wOS;jAVxUWlNMX7S1qN1}355#P_E%&#m z>yD%UD(avv{ah-8XfA*wptD?bH?XM&f^q>|9H!?GqZ4-L#4iiHhQTalh8=*Eutxqe z-Z~EO=Bn1^A1tYbY5+?y<+f^v3+!)&C>RF$b1DuJDj`tK2KtgjPh-Te(mI*Mx8_4Q zt!1by_}u5bXSvZ;Ea%D76d)2;g4jgpi^ntid8h$Y=d|TrK5+sLw#Ti#oSZxV6NB3-r1l1H#hiiPpRj2J$Wl5namxT0+ zfp@4pG*|vo5{nQS+MJo~U|uielF72V;vU3zLkAxcRVKAz0uS!I!WI51iOVuYB>G6e zu0YaZQtduZ?oQWmyZL4TXcSD8-w1!25P<>fM}qjZ+ncaH?g6FR>oP&WnxW z9pE$E@~A*?+E*c>+d}Fm@AF`FsKcTE#D95X)tu=yLhn&^9w@ zu{(;$_13lW9^}+mPEc-@NOQq{!3krOH=FF}6#O?uDg+^s8SG=LL&IuJ{X+?=mX!>R zuxiuzjXSEU9!HwTw;^v#iVc;87;`M193OnrnHJzFjIZ$(f00DjoC9g=1Q1)87{QvL zmAWij#G}e1$MzVT*ZN`6yXtzKt3sP{2jdQQ(SzIqVv&m?^Vp3E(7M@tjAls}zWh4} ze@(b7R~kC_cOO-n3p~o4Dx}ghG`ST!oKO_W941W=5s8dA=NHE(vLp88AMq4#;?+&Jnk1|mo*P(|t68osvMEP- zb@d*tm`hno6NDD<3{k;=BV-ppy>P(8}yjn6!^oBN1q{JjJ?H(`H;|yvc z_LKN?vf|J|7iFEq7{g)}i!2M`I$_hMAxwl zS0Yii?@?sFo1B%H{I*Whh)E&skZQBS70JRu;3h(o!O3Yy^>Cc4Kqq~H*9KT$HsPiu zI+jm8dtM%S^S-+#s>bFO8$O0(YFfMwCv~p+u#pufu@|CcuZ(TH-iSNHli1V$#!`8+ zKb8CNe0=u6mTGy7GpouS&+%?}{aPKayY+n3gwMM*BQ^+g)#t0QDV8E-7$=()MLi>l zt70_^zHEIPM1uR7n;?$OI6bpO6oCA#&NylI@$p$r&wD4U-OI~0n3D!mwuY+D8?N8m zJZKE;n$ae+mcl8iysV)ZW8!aC$7XQxQUkQANybi=|(*E!e|<|_9*!sQIn|fQC`!`UIR5yu>^t!@k6CCb<5WBB3 zN%f35$DQ?<(*?ih8Zjh})Y2lIYZM_6U>7O|OD{3$JaIJH)-9Dya7^Hh11>Q>Ga6j? zaPbc%vBkPt=&zDECXx!w8L&xa48sJ41@QLEDZW`T$^ka}&MxK#xEWNMmiKL!LuScC zfU*pZ*=~?mCl?*WAMHw*5=tzOGTPmJF5iu@b~{29W429_|3(hr^F^ptc0?#~Ur4iigr_El65+9)tBOY|jkGX{)^JRO_ zOEklR#iNtB4APqu*=+lt82)IjKOHSIsWie9tLEP_Q8V{!sQwKq5q|T7rcXU1{WwbT z^lnhAqj63gWprP&Nez|IFzzrg<(I0h*ZVrW zCO>lD%zDvNJIwOKUe$BVUa_8Zy&>$YB01xHcgqWve8GhSvXe{1k7$*zq%LQ{c(Y0< zE=k`v?`k4m`aMx?>Y$W14vHhkZ4L9Imkn7!1xp*+v5I8~D z5hp@3>@hzC$eA9UuFE*t+4!rdtN)Cwr*TH)wXiYp_le;olXkE0-kx_?!NCV!P(oPV zNLMv&xTjXZ#|yK)A&0#Z1Hz)xY$jnA67MmyKX9mBOSHARR^7v zHQX5&`xmEvir*D10E`&pta9cGYz(e|ijI<&VL@Hz~Z3T*n9^F8)A;f`LC8%75H_H+P2 zJk^TK@=6fOIV^m}0D6HKK`S!v*Riv@%Pl=lwPA?t*dj4p^}M75Jw7@-_D2bJysC0e z@GG@XHhOj?Bg&n2Dq}yY$fT?{bUDU_YcKb&igWWWU|Ir|Bm8Vv+WY;HQJ7BTm7JZ*|U*Z&HM=RAmD%6>Q{ z=>v^kkI$RLGl3=$`Ur#2Tb(jc9s0?E(_#YYqF%ib1>?p)zqxP-4h^|*r#^kn4Tqr9 zRc)XrhZKwQ3K zMkRPX^OCQKnnCYr3k<8IT|$2ei5M+Tj;X?=G+R!i%X#+a(9qnFIMsevcBxwg*CJaZ z*Zh4?v)K&ndl?u1*c;Xm#WdfEMC}_CV31|9Gr6cO!L>m+auG!Pk=H{Er;JP9bMSOg zWk$yF;b+;xkF!7;_9o#})P}@vHM7bU;DY~wH)Li-!n0V;{hUe zQ;XxzY9xV6SaG%`WOF;x@<3dKQ}DK~gD=9KjQh>lL$ovQw+j-(ipXCfG2+gA_a8!{ z>YbhSWu}Wr|8Gb-mG4ObIO;L9C43iPrq zwvjXD>P-4G{6o%;TQ@kIA@kP2}Bu=!HYZUQwv?`16lPVo9L>q}K3k4=EO&ANR;L{|}~ z1L?Z40vdGn&bftN5vq2pNs+TZY2P^!+@vn=&*y)oI6aQr_PNv4yn5mZ1H#&qf`Y1B z{P$7R7GBEpd#)lbP9?_xEMBwtcc!)=r0`~Dsc-8I#~Ldi;~&nE`nkFcDztX%bWciK z4=SpSuOh?F^08m`#;9p)#D+3TCk5)afrE-g_COOh-U3URz3ku(4 z-adIZ@)u0pa-pR=G3fhsU6h7xBO01Q5-Jd?16?~FzoW>16y|EKj{X9m8E3XxpH$Y? z)7}k3fc7U`bk;-oy!NhA<9TgSh|Qfbk1hL378NSf$q{vM{rYK?Vkk9xjkD#(AE|EK z*3a$Drro%J{(QlzDTqg%iB75V+ef$hNi=r`e(OLV1C-c9`uQ0%&Z-%Dyh`48TDp%Jul#A? z(0KOao#`Duo$g|KOQ3?uY{qK9#hK5sOJ!~0&(raq(>0hZ}qjS03Q% zChq-3tQ3W5mdWH>N9$vo6ur$gvsA~;2nvp|&f2^;BfkLBA=XDAEWOp{S-NO(Gz6=| z`{$P>FuOv0qz4-UAIA$QfWxc<5mkl&%??J7DaI@Bw`F zdl2@H{1(@-h)(|3kHE^vth2264zkXBy z)Mvfqox^)^S=CZjXQny1Sng%bOGL5}SPhnQFzUxu~hs zojuBoit?f+%11|H->s5?O-cKVT85KzCgEWypr3v;-(EV<>!O$|bn_5OH$ zAY8?RRp9%U5~|S`oV=c5F?85hOvjHmZ`Fj&ByGIY7H-w!3bmw}zN`yqn2WMB;?jYJ zx?f2ned94t3BOF$SP~IH2-!fL1rL}NBR%p2r1zg5N8HSo3*Qd%ZSK_1zt7Kd@`yb; zHFaV4J^Ps@!hmheaBDB`_jlf>H0jc_v#EJjY%DVvyy(b>Cj))xdMeOW&%w3STY%5= z&iHo2eeiak*pCHn+U_}Mi^ezd@fbH%5d`8zsr3e&yy?zLSmm3t&DKmY_xd0O*9;@P zULmOvhsP_R_;E(msq4G_o-R9_7}M?CbX)pta|`A0)y;Xt1=4#Lx)ev0Z>PfD#P3Kf zT6|q?9^uiWNaJWI3QetNJP7bgx1PN`@E6-&p^`u!N+X!BgH)c84xZpqB07as?5SvZ z>->#HFyJM_XwDVp7**(|37 zQuwJ9psQwEVX9*tQA@nv+v2qIY!%@ggOns?tw`h1mzIF~LL!7?g@7fJ907rhes^+5YkZ z5JB{IcnN+C=J0t|d^@?Ds_N9t>3p6`^?d-nlRA$j1>9kF}1KIB<*U-_DR7_Q5m$e8ihBB6^;APD9OO6$oDL(!7Q^eb0_ z1RUR-gsUR;D>J+Pt^_neX*#rAuEs`l!7n0iGLcBlK>-Zjo>3X zU^6>X_;vWye|FOlwf~Z2)@ozLot3x3d6iX3@%{`On@A?GCoo-DA&9&L(_Z$!@0#Do zkhN4v12?p4ktfRoaB8Z;G@I0s=-Sja3NxVRULkYXh3Z;fpApYn(QDM_3^sS!wiYtR z6iF)8Uu^a7=+B40`#Q;~EJY9P5X_aQQ1<2U75D7Q7abNE!F{jSFp9J>Gt1X!~7 z4N4I>zv@q%&-o}`wAx}N?-%Ps541eBe}i@?&0W&V-?()zyQ@lA*6UTqP>gk9(BAuZ z>22XYaoP1(E7juUpkJ3%n;2l#;at0#?X z)bA&HP}lbt9&kAq0WgmG)_aSNb3;m}on_8V%?&?G*&oAuGwqW-90@HdPNtEdk}I`r zNVEq6eMA^8#V?_pAj=4Fd|VtTTv9gAIa8_N1dWJ^W7GbeKGqq#rSN$?%F5d+Hn@_WzK`YX(3tvd_V9aa7jW#^V&PtE^Ru${#Sgtx z?g8Dbea~F)z;BMW5X;58!LLE>GRI~TIW#cTln5+_{-liBRpM^pUOlT@&(^mu6Ka*G z`_=90C~IOw-c_3y=um~@a^*v1 zC6NunIJ3Gb-@Tna+CwZ!m?5Zs%ck$P2`J_Gi{+k-$ZP>+JXAAKSv44U5cwAQV@L=S zG7Uta80Y#RdmwLwZ?Cjtkq&ktSSRZ*5Z`><1&ng zoY}QQ+WQL+z}*@g@rgojLfFOsJYwn`O+Ygx=lT8K=yV3_^jnX5-2tz=mEK~Ds5qcW zuzq42fxUYI;Opk$T$cAol?f3H{XXnf>GeD1o#rYfu_6TJ|KZ; z%kQ%TOFZRx@dYcrx1S-G@K^#MM~QjYSBM}s#WnPYxB+~|zs3M%YzVl{tB<2FEq1>c zc+awD=Ioi_um*2Iw9h_pFY3x@OnHegRwdcp!gOE}X6l)^0}6EaqcYIh zN?KPrTXLf%LluqFaF8X7P0F+!D*Nl>k)tau2J(Rv?Mm@Y8ikLfDzebioBAzntiFD( zy7(6-q-mo>81FL<;5!tGmvj!d_~s}E{$h=$SXWfy+Rp~uifrN!>H+5j4tqQ;(^(5# zmPj0|s(w{KDjfo3`^!UKntZpWoBWWcP_RO>lXy^{#1h#CJ&DR-M5FAED)t_`r;X<* zkm4t7B<4!~8%S*cK=nKGAf|VRFd5hG*XOjcUqmGd<=v_-J^_P87;0I>G56V6E*&8? z*VTN)=jxlRHKK#)Tl=*Dzl5sII~_vxwXyG|7I~x;1e9A0VA8cg z8x-dJVxmbkG;b)j*zd4B?rT+|SDKz4`+F%xdi|qxy2axBzB&O$1L!s4;Yb?WSDy}* zc;Ab0QVm`9$r}rUeoOzybd$m^T9sb9{iWz1NhQue#`UkijMlV1JO0o&g=G51P&pE4 zw|q~)so2-M*tA;j(yTZ(G#^&Fs-Fy%p0Qc^TESCfDEJ9~Hpf7ql*IJJVazH6z)Wy% zTbU0B-=o?h9-Dpine1Y?(#h*($_le~Z$4s>kr;$c{mwJ%Fq~01SYLCEfRCW0_k>E2 zS?JHSQe6onLXRX+furRl8)CfOxXxQoZUKtT7Mp*>*@a_@+o_Da{Q|4b;mmEyCNV&$ zL52c!zI6#ecr;7o!RRV`hSh|EpaeT{WKE7>V2bH-Rdv3ca++D^+v(n0K6$gNp;4(xj-l11QB02Bo&gLmz|819*(oLN%^pQy~lUT zNc5ga=|rK+u9ja24(IQPTegcJD%-6K4)5sA@7K-f8&FYs`=}5?#YJ5EL@UkVtkUb# z`-`uI^Fz8ByEs4xxl_gb10MX3_6rJUq&uv^%4IqhfsN*y@L` zgr8-gVf^86S1KxL3)hU^nQj+}Y^bKhv_*0T@X%r8a=));gw$`U(?*Y^X{39$mBYkn zJ|y6u3LX_>1y?%8FJ# zDlAsbpMq^g7pRR3xOwlb&yCuAD`!vx-X^gvH8RHI3QI%;JDE^uCU&hfu<*jF9eQ!G!~-fCM8nwhutJ0ttw# zAYfh*xK|4@f*=WZZ$4DTYV&!im5GvNh zrSf&{0=AN|lJ?CpqrzdI2l+;KsL9=j5v7sA<=q6vYS$5F3e7oCg- z3<+}3!v6xh!&NBzwei}}JeYeTe3-9oWJ!oRJ;9lYt37t{w4*F%Xl71iL9q}+fj zsS94A8B_q%xbu;8-3cb7tb)q`Fz z2f=XPEoRWKjudFQ5QO6fu3zlYBiNxTF1#yvg?v!4!>0WZZ&%+{naNiv4Ph?lLs|BT zneCLpfgM(}$yBUEqzkwzZ}WS|lWzF$A{Q1OB>{Dv27YCE6RpIfO23t#33Mdc9V*qhn;f&)CCQru6VS|@7jHQ7lu~BUs zP2$P6xZo~Hsk5jc78uO@>8N_^76I~r`r2H+JtpaM>5I_Oa-V!+G3 zv#%9LGMddrY`GNL+rtq_CC8D4_?dhiClI&i8)guITwZo1!H~h`l}e9$E!4lO>jXCK zqU`5fM*(Ayg$wdwqcxeCte!28Bb{aFi2Qx>1vWkxILDE##%f zQF0{^5(LrzceHR8_a;m|Y$Yx`?F z%kC;w`mDdjspt*qpJp#7dcSr;uE=U&9aLY1qKX)w=QXkP2kg%Lz>JntgZkJomA+}E zX*bl&Ik8xr!ElD!c{)B4Qg1@6_`P(Wo}jKWSXgKPtflBOxdSkdx#f*fHvLo~)CkjN zFNan=3|@u3A$XGv8$2mw;gQ-w7=ZU&g^u8vq*YU6Ubt)_mQ3Ne(ULU$L*Y(>ai!x< z-Pw~Bch3f4is8SVxHXx@Ld<_QjugBVkHWdILBmg)CrUg^3O;<86qlg}w#*ZuH%Od? zSqYSHvk4h}$2QcS+2DdVgwS#?T;O>nArRe?iUi9i3Ry5v?wI^1XTCP-R}Xz5MvV;N zG$Drtc$ty#j%^(dOF|E{v`KK^>x&NN7RYzpmg2wQGme_$7x-Mt20q@mUCjT738g*j zjpS@Ns(gxN7u(%pKUNIq#i;BL;?n-bEaj6sZ^yI0fH`r#|6{raV;Vs$vYD=&Br66& ziK{nRz$`{gEk;DXf`VJCjT> z|6j)DHs&#b$svK#!DyE(9;HY>olK$E?ep>^&f1kjD9n7Ys5`lzu@>#B+8C&#%>`c! zdbK)QIF6#+M?J1+K?D1RvNu2a$h%7Mg<@ZQhx3of=a}yc?+pz}Q+Md}$Z2 zC8zXN+i9vGkPKX)mEU(E@OmK}DQ}xnuZXRt2*0bw_ev;Sk21vsmFs0Oe74E`0;~QI z>9@ZfCYv2zn{*3jt0L2J(rFwP$x^zwWE+r@1RDr>qO8=@*42^v1-%G{jdZ*0tO>}* zy+wBL?nPrz=Mg+C8tzNx7U=ZnDr+XFoJY%+PvChEXWWtP06y6RhpOBh!nwl|Gxrze4%)c1j>|gON6{0Q0wm!#gVL-c z%mLU&|N7769!Cee^<@%M{QkI*`Ob4Roe~>H&3tX*W$r-UYU9;EObZYfxCc?9ToI4^nizUN^w4XuuW(11C@5|ga*CG*6e^Ta(6KDz?FreEFk zQ)N`pNjZ_6zzRQ_$MbZn`ONI6J(+XOfI_^k_mc161+{x@8ZI6nJq)d}fmDFq;zA<= zb|6!OO~y4lYuCJnIluupw21?$i9f^ZD0&kkTG=gE$Cw=HD0uPuNJ?JvK+YJ9D|;}pwYt227MDhL|hNx!dl|*CMC8&TG`Dfi=QeTjvTZyPX-dL5;KCnkCk(f zFHB_j(k70YTcMpzsr?`}hpfClg0ptLu%s2ST6Icl5& zAP_$YM|3)AQ>b8bY(zYe&`C)Px$O^%xyOskiE|o%WxF znh1_a<_&NNy$wBz%RW#{uPsF!Sv*iP50$i%&ZJhCvZq1<|FI@w~-&3jXwF z1zeU)#`L;<@M?(v&g9$YPYA||tzGCW3`5j?KLbb|De4%y>`QVW8wr9}od5A5Tome{ zj79%b0-_Oxj0xCD@VJzpKdi`?^rTJb{u<4LpyR7XzFypOyl$07VbaXnL#Fzz2AN=N z5|G(cA=NnI@j+HSc3Xo|ME)?ItLJmL&S(N++%2KPvt}Pe_bt@Y0XeHQqWB=`*q}k7 zP=Wh*#LfLzm^YfRE1z|VTwsC{d@63T>6%VkxZe;@8Qh?vVcXl{5#e#!@u$N**}BUC z!vxX#yq?(HhF}9cddAm;-O+M|1}3p|mZDcXmRBDUw2WLiICPP-#A8HSI0t=1@rh6w zJ?|HBz}^1}h4jQyuWr=uifahXgo zv|HA1joOQyE*ImQ(iisRF*~pPYCE3<#$nssH8*b+w=I-(bOITXV-qvVJ0gcBT1FcB zYI$z%;iF=y1R{;;Zx@|66qwhbqCfM-iYILraet#?EP9|6&96rnQ?U)$P9W@VKEvN( zm#xCQEIV)-y?kx1W40cOFhXJXqne?oN9t}P79*3ty|5a;RMP^uL zghd6mM!^1NqV|*yPO=gqoQPz;{4H>n>vy+k*+-+XRN_I;c8hERd3TJp&Yj}77iAMp zwe|wF-MVBpbn_xCDE-x73(t1?0@$IpA-+LHE2b+6h2U`tH|oM6{!63PoImY7ji3h@ z7{Vq3IwOfr&#JLK1^Z)Zr=!1%s}4|95y^M%&;=u);~70lY?Eq~H#2~VFpc;ulEV0I zAg1#_$aW_k_WCS-F7D|DlH4rq=Q*vvRVNwp+X9EqUE()-8na(17{9cS?{EZ5r1P`d z>}`%2hI5%&8Gl@Tj6M%P1gzfLrTyHMIVBTg*w+0V;_g2li2_aiWa>cp(L`vyLzmDK zIl5+k`~^Q}h8IR(?LWtxe1mS3R$NQ5NLXVdZAJ$S`jY}BVR)1S`=to^{vd)o360&@(9$fbR{O>*(JSjfmBEMz$~4wsh~y8;ro8Jv2I4P4~@CT=w zysobmEHamHg+;c->sbF`2R1J?iWS5xw#UU-BO+K3INgdl_J>|sZj{xLzl!K@sIOJP zaMNoo_|SAkj9!bzL?lqB2Wp%w*RpGeXrdr`U3@wqHW-um0gcPdW8LY{SFCU$8aeF4 z*&0Yc_;6)u4N*1ZdUdc2--*4}lUalJW?>ECi@(;hM9f8zz;c65guNkRPMvN&8WsfF zj41jLw|V%$8w8Ny66ET(T8LB~2|LWYH;IeXd+U9m8eJi^YI7!>kBNh>xrZ!e*g7<^ zgvoz2OpQpjH7dj>33L2rCq!27|oi%BE{?11GB=Q`Yg3Oai7- zH%qIvRB0*J+6HKObx~F*nwd)5XoIK8E+?h3VqhTDZRU)L;R9fq(}qcXW*6#NbO%4J z`UZeRUqoGRNrJT9%3`(>jheD`dZm-^@MRY42*vN+J=-bu(S$(1ii%#;K-Oq%-0YZF zeoC({{PLd_^j9=dt=O#8sX*63b^ITA8BQgzR%O5Z=S4>ZmL}Z}dyDLc;fjhCml$jw zPfDFv&`@X|?^hNSVlF>9yDfhz4wE%p=O^9Z#7AeuLE_FHGN@5VwjT-6f4*z4;OCG` zTy_|8Vj3wsRNTV z*lEv28`_UlFe_BF0yZ@?MG+pMjxOj90>uebC0Kf_#{Lq}H6|iyPl==>gM2oST5FPq z(?5d(l@9SViI=h;XW&VJ6l}Q4*MxWEgk-(_Y^>V7ScE$?a zR!e8Ngf3YC*5DyzD%V!g!ArcVvl;Q)Qi)eJ(W#9a`fc^;r>@nO^r}P~jtqlTb;7Lc z1i|#aHBMZfYiTh_P7=SqrRNETemT$;=Le-$BTO~#-Im|5>2!^K@=SWkYdK5ZrT;I+ z?y)Xf72CFrif!Ar@y51o+cr9TpFTZKcc0OtKd&FK#(d^IuNyHL zb@&M5ble2qc)gC6b$mm`Z%W;-nU&zUuf;N$qPrw{MJ!tznu7<_xCR=H0AD-+y-Sy*COjV!gUAa||c6FsT<%zQXt8r^lQB@_# zOrxlLL%J0<&4n=Z7)`ygg;}6|z|B;%wHYtfm-Qd#UBv1b9a4ILK3r5vGwv(h1k5?? zH(k{5aj5eT2Ay;h^Vj%-B3s*Z7)?@T$S{KS!?$jH%AE{J{bwT&l2)`*O}CE^DgW0X zm9ZM4_f(#zF-IgCqjw%C0grJv;tvj~=4>C*2CFr&!ywrGR@~?m3^Z`7u>mPwW)wMS zo#jFp6W`E~5H%6PFZbK>2bD8RyU*bc8E8EG-r%dc9WJZrMCz(vFC6uk^5?G1DD8K0 z#80pxBdO*eyu2#`OlQdGGUOo0WhzP(;(Z~z@8y+XDo8au<+=7}#sIr5Lv)z~%8sTA z1EZ3);+t?<0(z(7&7WuxwjW`!ddGunw7l#7e*R`ICh5cy>)0=1i113N?+oRd+c)(KpV5nT}-Y*gHf@(qa#Pxy>{V9{ABA@&~(T2vR@nqb#r zofz*2gHBi31_;hDZ|Inm{b0~|09+gRtYz(VtlL{LAv^^#Hh=C>j|OW3u(5$`yk|9K zW^JxH*J+w!aEit0hH1DX)6YcQ;MjvPe32gv`ru~Y=ZUHaHx#l`d!WQWb|C87LFPXg zv~mzWhh7gM@DB!^VfT5~OPm<=U{U^qL05;}A@Rx#a90SGyNLe>gU;NDFs3ak->NT{ zUI*3_gZ~)qHJpXRx+4{d<=FjQJCzhW$SWZ4*DzI~DO{9#24FR zj1^O^bX`Q5eG+f_;ZlK~l`(&X9@RfsC|`zJV6shV2jn{K5y?2UQPGu+F#xl}$w>Z( zgZ3-4bTq=dbQ4xhB3d^r=`{UpxJ@eVM8OdyfYy-^9_Yj2#i2Kvnc6=YUp- zu7nT82Ps4APtOugE#gK=3Er%uftaM&99ipcf0oS!-eb<;Nq)?%{Hq^J`za~U{726i zjy~v$-9DNKMnlwt;0tXZ)`Ey{OV=f+^&nIG9}gO6phl*U0LV%nC>FE2vY6e`X3HmF zXQoDXGIJc!mj3H2>K^;+^+@{o;9n_ zIlIMF)YOF6KDMts);a$JRumT;O60e~w_DQXsHl$iP2Tswg_aTr&@vX+QemnVl6ZLnj zSE=9^wK=It^r7Tkn6-YkjWMcgEm-fZSY5I5rKSgibTP!??GSV3$sQ&X{`y6F29TMl zhRm=(3O&}n@)XGop2_p@dmE2h(aUw#IT)*~aL&KW z!;^H-D92Mh1gUXnbhr#O|Fh`Bc26sh3@#!P^x_4$y&P%ROC?M9 z#|QRy-$fZJAt+@tMODI*z?N}R?-sSj+B5zshq2=645+Lu2Xa9LXIEMx8O(Q4r8kJL z_oa55hS7F3J|W|+-#mDjX^k$ooRhz3q>5s;HcB>&j0lOH$Wi-DU&*LUQSCe_)hriX zC86VHI&*Mg7o`v-tc4NHQF6gC0B^e!-oXS9x?VuvH=?(sK|~>;OxnE`_TokJ8Y-ga9#n=0Q)9Xw$*NM?Mo zBdGdKUCsFHv48b7q5pmOwOR|7w39uIy~hK6I{0Z&w(C;V-uViA^0juWrc{=9~8?q!9hJX$E z7Q8yJ8fuUQcGq-Nd83`O&5_@Gt%xE?48irLAtL9mmmI0^_Qm&o7D1nx;A%Tv%@6|K zPpM*@TH}|B7-a__;48LP#4wJIS8jTG$WJ2<{5woG@f!|rs0kvjEh$#v+bJ-PHzzV* znWd%JETIYpkvPWKLgMh{{5;D4!$P&*+s4-q8k)T_X(<&|yX&R-3K+;_>`Ey?_td!=e{P29&Yo$!Jv zR?NO|jj{v8U>9M;75tXQJ{39vbH(@_E3u!JC)sYpY5FEIUotEH)uLRpgc<3yG1%L^ zwwsJ?4BH&m#c_T;sTxK1KI`Z7A%)=!F;EIT( z56BL+1Fp$L!-;E2&4ke}5MlzFIzBQDxp_-( zi0wZ~(L-rPnl88O!)KP{};^y)ubeD8At@?Gt9n-Ds z9`rN7wx1x3Qv+bPwDns|L?Mwl1>S{1^ViQxsP_SwSxdQ{{d|+fn_*M1J-7G%IUPg;2M|mUe@+x!BY$ysP ze8*_<_*yVo>S~vzxKBJ4){E&p++?wUx-e6Rdnq$P20gM`jU>%K=lq`9uS1t9>JV{;nWNGpF(&Z25mTr6cugtrU~cDeW<77_6wLl zH5e{V1eEf4p~hI!%&1xNQdwJWryWUu`LK4K+TtPxjy9gv%m0ORC9#+l*Dbr?m@7Y;cOW>pVf|>ho#8YXSuWlY|bj zoq74upt(}lni@Hw{c?;svEWv7A~Xyl%6FBOXr|;8L56%Z#c!V&YM$FEyJ(4bT)*W# zkn?@OrZmHiO`A5p=**5GjVDx`iXNr&VW5Tjs^6dE1Po%>xQCcFyXV?=Lw~hFgrO}sDCVI zlK)!J57iN=y<-lhPpin}3H~ZAO@Q9hUY>B zjLB3D)s9*wvop$b>1(o_&Utml!Yq-7)+*zE!*vuk{2S^v%_$jU#h_LQW0|3+)if7B z7<2;R4+ibnf=|hOXp#jT^T|Meuzk$5^%(Ra%mo!zBu>Ok6A8|mMkC^qBbgI6{~rr_ z23ZIcIxj39&yF(AxY$`;fje*XUyjkdM&(%uFc)|J>-3qg> z?n7`s7t?3Sb)G(KDi%H&YWhi0&CNk(k6jM;v3?sHvyIo=;Yf0=;|fFMUmCcd)I9Kx zsH=wb%AD4d(oB#RXmYBX@4Q-7M%UWV8~5^VP5wD?&opn>z*Owo_%(ed7M2?F-C40E zJ$s&B-#Rgg^I}BCdt&UekjrC6r^SzmlD3Q# znONmD#p)g*d>kr)5+yWLt^}%6kxu5}NwqLyV>~ zI|hj40QV^!BRf)GEusgnEo!|oKf@cLPloc}*|%#~evLj_kC+o$JIy@7l7ArfriWzpt4FJc?Hiw)`=iH6VOANAm8!{wT6H@f$MKX~p+^4-F)LlY{P65DqgpwI+S?CmWB|ylj%v{eH*g zbxD~Z{X{+I4Oi8pn)>*4QEV?8V3Ed9Nm3dkm4J}+F%)#*o`XUh3GMhAL!G1mJ6U}g zvM2awpV--wGRNiAa--2k3+OJQD8>P9H0)tpZR5QOFS)NPbk8-BV**#o-jVy32eWXs z&FjS|2@?Q)6ttkEqFi*FMM)68*QopdGe$YZoqTuOL)v8z18C(VzOy4-$ zG{xoF?Au{SUhDZiuo&c`N9jwyi8r{$B5TAr@CU$M}e*z686C^@Vt6>Ui-O z7*M(X(QE1QFY@QxhP3;OfY#w}Kx9pA zJ}+*SsgpkMJINhM8)|O@L{`(R6;M%E-R^t*Qx)bR$QDe*jqHE&qp=k}>?cG#Ar_@w z5Ab>kG_uH-h4ksa3IVXUOA;7PI-Zj0yk2ebt)*;x@WPw$w)Ao}USa#3z?~%p@jS?6m#LH%* zbC9o;o*5pH+D%Cray$f<2YKVS4T3Ghh1QIF(&&KrIb$IEqt!l zA~nu|xluMNnhZs~*;uGt5dsja`}J0qb`lxV$`Fq;^0{vL?nwQM;rLFovAaW6CDB9Y zJk0_GDe0wSsMYVv(hTj&(hBY=c*O0oMY)@^(1+V97nzLf82Bz4I_wD_R^S3`cF1XG zOVPIhe;~%$gL~v7fE;kiwYco}Q^vOoe4Q z2S9mbq_K#)$4)wnTA&LqcXnT9{z*rLL{T-Q+x+HOwQMVNRDkISr5!_`nSUS8_=}l~ zy7@8w`plnHqtoSaNK+Tev}far+5{aTv!S&4RCEdwpe~do_{V%6c1&Eg9yARPL+F&2 zd8)v~MxBH?5y_8yKjTG-v9 zH!e0H74%u5y<1L`4MAhN$&t4sws?YLC8>dmMB z{Cb1CY>Dd;I!XPEf_V6SzkIhT+_*E`2uVa*)Z;KVT}&);q}Be5WEHg zK?K&SdPJfnI1{G89lE^6PY|J1tA>Fy9Hwr!G|ojs#JLz-M(36k|%{ncV5 zD*Y=lr$HDaR)|@Z2lt5DLiNe0!ovCFO=@^erse1FBMQ?gcLfuzofv1tBxs_RSvWkwuZ~*C?vFHTmcO^b$tlq)i9Kf{SHyurOIMhZ7x+@x#+iN3^=4{3; zKwTM>7LUs{p-6N8@nOaKx2mKlsVfURyRIR^C!0R_@R?`b(MRIUHU)35Go;TEGqF|t z*Ql6z^W+w6EY6P4XdR)0OVG2KRRbmZWK0wGdo;TP>J^R&Rj(}N>RrHci%1h>>nzCR zr9oHvG{>Ewx9Er2n`tIDzM`HSKS@`Mooq$owBi~_$!M12&AlCH3J%<>(il@XMY;R3 z2#JgepDPJ6lR?1L=-@COtPCqjW#}06S6Kqh2~(JA=?MEW9fA~#Ql`Ux^x%2Ed^8J% z26@=72ZQoFs(m;juX;>R=|oB~{?6Ez!vZKb#(EzJp5nNF&vQ*HFD z=&T!W!Jh>rPvq-$% zgfqDnf^W0Inn{un8Z598fNaqq=iune4tv+y9-nfK8OldUc8M6tQZ~BoMOSgELt0dw zXo`yrFa+p7AzziJ^VxFGU}rjS$n<4)=PsS(K$zqdGLL8u-UtA`u#c67 zQi<84IQ&)`baXpDnDbxrnGx>RXEAS^Sxo;zYGg>wwl=hspYbx22l7fO7f{%Gz&;r$ z9jUHl*v&o_b%Gv|dN5vjd6o=1ql#CK?3xtxaCuErH6{k>PD@{~CUs{7Rd>{ zipu-I0MMaTpxA>hL(0FI-cW1Y5L97^X@hU+z*sE<F~Q^m1YrbT?@k`#-Q%;q_QF(si$Ftli~Fo-KFU6*HwRJ_eXWyxJEKHxirRcrzv72 zilOEpV-u2G&s+b!$@FlVZ@fqp^7lVs4w8(@G*^1%wg1x_-cBAO=#4xU=8P3Yap z``>0T57f!B{Y;x@dz9o%IT-49i1gXYncB^!varK>XeDEQ-WtDg2JZTSaS3p%rxnw( zn8)X7c~i2sg6sxNYrirAlKC}7OHU07;ET(#oDXZJUSDnLF5k&jbQ zB)S$B>Z^b!qbqMpUDdcu9NzmKR2@*T#vgMMl-Atem1pr`9lj~ znLOoUVF}YGGtXIkgJewBMdRXPL}Cz&@S{h{p=w2qXc zV8n=67i^Jz`q`6*Lm(^mF@~La!JObdr1a-9sn>H?}QX~yYlP6=!;?7$=&MjOibTV^T1t=j3iWxgjQYg5_ zAFB4l0Rj*qFD?qMB~V;aqI~OFXBd&*0Glv64*yae#bDymUlW1%n9xBfYv#l*LVYs) z4*s>RC_uy4^Mx}0td-%WE9B#pnjA~Afhh?|7DrDgs7xq>AmU$7^V+0zC%b(y1*cwN zoD4d#WsJ5kNWT_MkcXjT<&pk8Q+`p|32OKAA4u2 z#gL+OHL&!BXCyq~ms+T3B^>!TmTpV~Rc zYz!^7(%9&GO^vpEwIgV@q^XH+fa-uK)uKXfi4%Rha?v8asY`8%F}OTnYmUxpv>-u@ zuBSI~P`QbKgr=sf%s+!=K8Zz3Nuf!$u2TB*>;4gbY(S&v82o~1;>$~t`|iA^JA3py zhO-aZ3eeu)Y?oi}=;Dz0ySR#=aEH#k*TUMuIDA*Cn<_J;_nMc436`xyS4u))(_e#xGPH_y z{Z^x>2mT+QA|A*SKI>hYX@_EI51@YKOeIGEO$SRIeE8O?#7JD3hF-j6$tITRE-}?8 z9BE9jGM+MtkjZcjryA```M&UmEBo%Jc}y({WJE^0l^Okxxx%J7O~auH_U|YwdHepf zf-eVCJ9UAY(OeEY;M=gJpmMtfdykx(*@e&>#@uhheSIuTq`hLz+-amOENzS^ibn$$ zY1ft#o6ZrhBNzLem=;q$wdNcp6KpJBN<+1ZmRPcU%Tt?>tS?A^i%zKr3Q)w1-A{@N z_vXF!d+4G$CdbrjQh<~d;`l?!**(=*>h>y<7~6hI8@QM1qXijr4Z)#;XZIkyhWGO# zwq@6W%TIjQdDF!qtDk)}b;^XrWC#k+ov}X^6j&ED6)6&cT=JTXos#QQ0BhYm1Y?J7 z$5IcMkDvMi$s^AXuHQ8_hSg=xU`TrR^L}MQuzJ8$2qiu~e_5Fef~Tl?@m$x+z}^LS z1-HN5XqXN4&D|J97DiZ^xf^LeVjsw=$%0XW{2OMR+na+hpwFWU%EFNn7i?_g*~ZRl zsTYSUZ(tM3~ zOgBk9fOzkWL@vf@)LyX6G2uAj-=%tj6W?q?C8gzEsuPYDK0u_0C4z2T;F%hbIR3`< zRDN3GKWZ_*ZJL9L{9H4h;=T9GaIh7KF_|O)N!AVgMb%9lfRu(yn;x@RsNpj8C>_S1 zpHv50mb!H30b8OuC@XmUa_lD|=k+Jy*-xys=x@SdnMiXcwtmK%s$W)+5TVZDoQ*cP zr9TKwK-@3E91pKj^C6B&{Z4s0HxW;t-CgN4?oSs$u2jZUcNr>c;c2bIJ*?&q&PAZY3j%t@f zmr)Zs%4u_RFf7~g@EJ^{UX`UEf&qMcl$+Aar6QgI_!_nn34Dg8Uo*IR?0m{7HSv1- z;PT*olH@q(&YF3uqrebCN<}(ic(czdAD6nL?ox?xfkovR$04<)Bzf<~wSk?>o106*$5Zk7R5byt_Y{C_XB65RO)d$|eFFG)yDF|&NeMiVp={jG^e26jg}xCs z#W_M+d!4M-AYhNiw>AR8HKsJ;&q>F3CQYgwQB{K!SZ00)8mS#rVn3$~fMtPla>^<7 zKzu|g(5`Ok`Plab0~$)G;t3ZLl2SP zmdBu9rwz7JNYQ}*-JGpS1GX2;R@#FDP%`&g_O(H2FGq2&;R)tCYUPZl;Zq^cK+@+P zn)Iv-#48wmWfi+jrCU_RXLw>&i9Y9_egzIz`h1@%hy1%P35@C2mTGtxrrK4QH%4J zlU>YeQO(N7pliW$>xt?uKY&?_)d>t9Ht4ip8fok7fs!omx6sRpA|NOkahJvHF@|R# z$xg6fqA&i{VkqEopa39`xUB_(9tqNB?%gg)1r9A7(;mCcDui@`3$=w$4IO(`U5f}n zmX`&~EJ&rSfG)-RPBO&aC;6gx9$c=8LzD(FDg-fx^+@n1|B7(IWc9~0cNUqAV3B-4Ldd+;)_((kn24mJy+I zz$n~#@N_fF3?f%lH(E%;zNc87+%mIMAywI^Zn9!xWBT0r+1r&5r&o^gpAS|V&obW=>X9_ zuSJKjpCEDgJX{YhOyg|@l~PiQi1VQCtsqc@if?tN4GhZwNUmM0yi_b~=Jn@JU@4m( zLwOFU;55EH?$mB0bBjLUvnZ0ZJT`;uijA>+NXi?Ec008@{M>vFRTlf5-jrqyF|eo| zR$cD58;zu!;ii%mYnq^tr?{X>SL#$c2vb2*^>UyCx=)LmsWig%6SIoUlX(KQ_*YdS zggy=cEWag)(t@)wCIiY6Ln<--Srg<)uoUM)fj;?Zv!9B1l-30Xj8JROJ&$&I|Shx}vS8l+~{?bia~D98Y_#w&;Zz8J}AQfcpI z4*%tNxh=fV-}#Gc)hbkh%J4nv9vqY)8Mii4U8FmlW|!$`&LjK9$R7~_X`J_|{h3=m zRGbN8?51(Z@mLeYib;%+lvio-GDQa)U76aZXGtm=KcS)&2hwwqOO|TS z1cq_mgrJ>m4J;i`_PCwO)4!cwLpCp29GzrC`GfED9Q6a|Cay=2FbwgEdm1(F!Ekf@Y zR5M^tu5|f_aO|(%!I`Yd7(LVM+u2{MoRo@2y}DA<6zK(CdJ?%X;gKA9E~b+8c}$VE12;1zIBu&DzJ2uu&fp*u%uoJHMCDY_FM}n!Nl6d;96#jYwFH`BBekW9M z2o$Ej9O)*IK9$$2k^Q_)Um1X@;)x!zsbOdo{j`z*gEx?!p^%DQR6yCNV}s{l@uy5` zl1?hAT?PEMXBg>=b}xiYYVzHvFXKcgJ}|$k@|>r%H<8wQLoanPQNK%~6X75ySp{PprT6apkb;)6tC0Qua;?usxCw;m|q zph%z9JT0D}X^+HaL}J4#boGz_wVQm~)1Cuy{fxMySrn?vYjgZU>+?{o{xuOrqxYWZ zo!oLtXp?_1%ykY>6E+ld%yT@D7<9abH!Hjq|5}?UlYrG9g)ks=OMpgWy%z2iEa2f> zhz8jhj>Fbp3Zno%rA{mD2S-!GEcj=qEbhI$U*)e^L9islx`6AKJ;}X8@YILzu)>zb z09deqF(OWp^w36L_o8~e@`b!Epl9I400RSIL=ElfQxp5$87hxhTLn5Pu{~IoH3Swyhy*+DFjk$D^*y53`)XNEtA$!Loez7EW-eacw!KA@f(WS zR=)v~=8N6!kFLS5P%bY?cxxFG3(RBo!pG{z*oau_Zj5BP(WKE0P*Txuel8@xp~xCI zWU(s4zpv290w7g4cK$v;h)f>m0cPyk@Aw)i!U%414=me{R~et9;o#jLWS4(Qo`~)|QdUs$>{X z1s(R4w)p);v%KDz@2SV=z@Y*vdl)x87Z%TRhIMN>hSv-WAJ6F+p7ZR#vJ8?Ag9^b( zeAq8^Noa6krGFLv@{=kT;4?o=G&Q$B=}ISt?@p0>jWOOge1u6FD<&;2;s>kw-s0 z$9zcuJAe3F?RZQs;m~wVLQMNy9*YAM-&YHb{e<_GF)xnZH7%V@?=X`t8I|=j9;)y8 zC32od$G*nt|2HfXn%MY1VHqL7G@j~KMKE6__ahTHeCJ0_@b4+Lgxlw?MuhpbW#uC< zlXxS^Hs@+HpQ*xI$RnW}FDfsJ!jI_b6#Lsdc%en_2#L)a-9-xBxvn-iRbv(O#Dyeg ztp3RX`hu?G`BdSr(lN~SesYwc_C_G}WYhOVR$$Tn!1|2;MVOJ>YNnEnUwvj8z3QZi zwO4-#Vv+e*y}K(~9_7A??YRGMNPEz8gO4GNT|8?7b&YIMLDt^ghrGjg&pc$MYk5P0 z+0PNs^38~0m)*m{2ljWf&BTvCW}yF`Bs}oDQR#fdwPe0JgOC4X>t^KGT~Q^6(t+nt z8G9cT*UQ?L!EE8!Uj_@ln1Qb@fM=sn%_kEh3C{p6Z2tCV_%F4z7+JfWpQsn6R2#hW5P-U?j3!L%ywe# z+q!$pP}VWNW_8XL3jMw0ZV{8ddn%2;QzA@L39T2y>)2Y~phoYHKJlb=upt=ZjlNDmC&f`poqLASha+*E03{jNJ3=Fy+EHz%m`8ImJaY6;7|qqp6yUW zx)i%e1~r6xDJ4C?vxqS<&Ty5~Ki*`rYNFD*y^scEQH(dH)2`e9iLb zb3AT8z*BVyMkN!l(;C+#RB)VH_%66xBWKdLtoF>4&6est8k-`m08$|9f^EnT+y{9J z(hu~X2k8?C#Q_mV+=t`P6vYEKlQ-@uYCaRyO^PLUWTWDkg-Q0_og?Q9Xv)V4y@QvvERpIT|Jro5c6DSwu56KW;q)q{xd?={i*(}%oO zhG;$_J`^d}lQWF0RAHe6X!~C^nZxY=XfnG7a>5zPu-v;>eV6jWoi`9dEg;6RkiYAQ zGc|0SITS3O<}A*HR{?^Jm(SYPFq+M9f2_qxeQCy%mzYG)))FFUbyrz`dwX7DVB*{z zli->c(pY5pINuE1tG~Oem0u!UmP4p05KYB_O%~EH*nb2Co-5=h3ndG8Y7o&{?wK+t zL22N{4dAlsi?AGxXiPqtq+`8SjVex%MmNKh5&Nn%zDj}s6{%Tqaj44}+E-!qBl#IG?H0b@zffdsAGP-BHpw40lj ztZyD*W^HLL%LxIL+q}D#`~`;m&GEm7WW4t5j$bpWwi*J2jH6_!7RY$jpVjP}QAz=x zGi9=#P0q%9K|E>->Vck0;9f`;@VobAujv=2PW2Bu5QThhx)36VQ$>Hx3@`$PzoWe3 z!9In=M}3j9iFz%jka93k_h{^z6Tk%#luME*#|f&FdLc>s|fcVd+v$wELjAAM^r`4W^K*Azb+h8LGPc z>uP=5Rr|*uVVtSQ0hlmbtO8nkzDW@(2@mEvMy3BaGGIp`D9t*{fwtS2gzJ>l1(_=S zLFzI0Dil3}XnJ}O6=2^s%w#{KjSeI2^aIQJ32a-So!7&C?O_8S$i08YYl>u7-#f|r99W-tq}{~IS`d}chO z?{|czzBe#VDILVjs>B#FUcS*4wuZa3_{CP5(av(kU+ zllP@$`^otihkV_!J|04}P5e_5a*Teb#XY8pX@Sy5ecYM}`^Y5y-b>%m<^spBDPiZ= z1JEYM#zAbE2G1+;;gL>tWG9~4_Lt7wRWKtb{sX_xffat#o@+S3CSvWr;5Z<8r}l$c5H)CdIO$%P|(Y}sk{KjUhSDYo~c z>=i2T*LRm&Ov$LwcpN9x9K}gMAdyqPmZ2|#AvbllM$w0Nu7ucWXymvH*G| zEDO<5-D#r=H|G)Q-b*00Uaec;#Gjut5LbUMP-i83eyuWUt~?U=H&nyE$FtlQduXrE z{{N>Xv)3!Ed&fS7ey+3uf14Sc#7Z4)W>}@JJwC^kX0Oit%j+k`fLfYh?dSs0ogc|8 z2vx>7kMER#UaD4so)Hnw+EFJ~fHBk3!Jw`!D9!Z){bAM zW{rZKf>5{NC@UpGap5jL)ju@_tS7~nVv{ApR^b_|dYUet3J++ziE4|CG*q_CK&X$4 z&+6Aa^lAt>fEa}m6y8H{SF@1H)CY1*}Kx6Nb|kGTEM|N@P%pL zIBJDib6fCHTp=^kCNYgNDg=ExE-L;Xa*rLo9L*P!j(}M9Y0Zf?p1v=)b+Ozgy=-A% z16JJK`k&{eaa9*jMC@Tb=K|yU7l%1|dkj%G1?8kQV{A^$#O!E&6hMKhkVO(iz2>t3 z5AG?FJ~;W3BGXsK1ARTUt-wT7p{wj0#!RQ6Bj2EF6nD(}nhbrmR>lGeoVv*%XPM0v znoXLLm}Z5VPZtP|ps-yOzpY+_qp6}KKDTrfQd*_310FHoLmvmERK{TGODDo%eH&M_ zLFNsWD!p8+$kB@=iwYlK1x%~dir(b^FGEJDWz%tI>@V?YG&5G~m)=QsaiwrYKf_9P z>8VPWDeKY5eTWVJlw@f?o6&B$fT)!|MvV%Ic!GGHIbV|~psUb(^VN!D1f@IY_NkU@ zt=Dxxc#Lj>@+JE0g2L-~J0Xar?Ns=SSiSX@Li18H9BOy5yQ|HKZjn?)ygHDWk<4gj zZE6eBfOjF|&a5|@Dt3^rHDST%>!RVEDx+fL!7sG6ph*olxsDI#G< zMwy4UL+8^xPeBdSgHWZk@v}05U%y90|v3m zQBIjs(_Mo^dN)8$J$IBpd$*4>?pB3A5qS(Tf+1gk-oZeJ zr%*E5md{m|(r=+rePbxqtOC}G(++0LAHeL%4Cv3|2)_Q-3i|emCG@`@7`tzoIxcQ) z1v96kV;5Hp!c0rCjxzSs4%*r!rNY<#hqh{R*Zw|Mpf`Ys^%_K%^PSV_dTX;jau@iG zZZ-Aq7pHi!A-DZsQx6k3s8`W4SZh9;9$`mV-OQ_VPiMGb@)r*> z45>pm4Rz*i44FyReBs;?w|l{#{lv@Fp$9brpGiomm>3?k!YVqn&6 z{IM!$d>P!|E-@fsaso{P_lpKj7#_;9yLsN0C<1c+0XS}C@ zkgVQ_pyHXSfoIKWboM}me--y*P>pv^IaUed0dv>i&cI@vR7X0{nM;=Rm=c>$C@L|7 z^fbcH{~rLIKw`i2a62Rw$J_fp#8N9f@KIj6%t&)9g~z|>qS_wqzQM5r;TIP~MnT<* zn{#od`e0JWzJ_t{r6&YNoATF}!CT*;pG!m$D zrb_1Pt6S@a^#zsXUsL@=%fyZkpuoNV+a+T3q}qkcejDEgplT2{@D>T@MQLr+WC|#1 zr~b@@d2-y)&;tc)#))aoB+g8$5?qT>WzP@*$_brxX}U~U*HnOTlEk!IRJs{gG>ALY z>Z6BKO5P+0A^eO~V0@rc6$+JNXB<|+{El?sG)7ps*0$v{5hFUgiV)dO(;;&%? z;jq()4)LDx0$}abxc1U{wDUYPuZ=q&`lgfwxWFOZ!{Hm&eG+DNI1TOBgB$pEXbW$K zHt=?61K$m8;QOHsyc^oUpN2N@PeU8{^MD5OI0>Dp9}aFJFy%~^MM%s6JO~3@NIqxg zEd=vrGJre4XVnSk@qp@q@newrzqz^TQPv@W zbG|ZMotuGzH7RVt9LkwA(UkGE>3dJUYr@4sT11` zO?3cR+f+|Ol~YPwV_ZEmubvdPsm8^HvS@Yb>Hk$$&usLSbvJ!2Q)&aKEB@X0rp6;! z*%SzFUY#Rr2K3KnbMq!pyni=9yoVNo{LlSE`;-O@;2CSR(>OG&ZG3vEs_&-0>9|Ry z5qgHT{d~b{4MSmoTc9V=(jE!L*4gal1in_PH7~fPs(y zdJzXO3&Qm^Y+~cU88SWyp6+(qzxs;N;wG{~Xv`D8$uB{AGW?Z!}>(%g` zmu|F1bqRWBX6QZK#htr7l@B6)7zNRIZw+H_DD20S6k*^`8pliXupz8%%85b!0R~PH zcVs;E`?L8q95kb1Y647s9G?cFxyWQ0ad_~~+v0>1B= zR$rUfHYAiBNA~_bLxuK_D2G?u$r9U;WMciE*$5O|ywLbTOMRDy%|XROS}>eARyPP= z)^jME_H8IxW~Ksk#sajd0y*LaqwsgrslO0k(;#yt$8p1?3;Tn&QL zBY$W&4lTulrv@fHV8Z9iB#bwH14D4zw0+zg*s70 zhd5ZMMZ|7HCz=<|T!R{4NkEmekAP|viPKj~^d>EFOX(cd&cnMbpl@lk;eCrCcU?NT7qg^H=vyLv~ zdG_j--6daGX96BgWFVpN@jG9j+tRS$g!=i%Admd4hEWuK9x(xjatav@md2g=PU zyJr&90F>%x*=GXtNxdceAtX8T2Mw2iDl+)-e|Jiy?D>zFyNGWEA&G1Ia!71(g1D85 zAJ}2QA_fd&%jA%1^U4a!0EFhAOw6;jqaNT@%0=44JJaw(PhmStYr z763D<;EoO+i)z4tA0dLo306Ql=e|hp0fGwLbza>HDn*B%D;qdu?gxs^Z=56g)jnW` zG|FPVEtiOLKFTvQJp{O~eAs|B7pYgvY)6#4uy*fi14>3t!bG>Lq>?fX6Hr4>=S1+A zC+L`()_dmO4%c;=DYDsj(s|aOv|SqaNvI`(BzPeO5eswlD6mixL6y!H=3kb{nGuVK zGD1#H!YoFvzm}kc5Y2xPH73?cv?>3h47|_?!v1;_nUr>-Bbo(HW@Cp&9#*|IKYLb- zuobl>3(6G2j-^7J%QATISZDTG8vb%H@VsRJF^j(o#P}0`1_GAxP zbx`9;Be+FfbV*}4l>{xDNL1cRN`^ebt!u>NLcl^n<>c_LY73Md_|VFY;iTsEwDu9w zl@#%@gqE5!jLm{M)Q4lZ5n0|j7y6{ezYG+uEAB;Cjqdlq50ZMAfuYZSXewWz2cVf{ zIrW!u4zC4!p%}vK8BW)WGTX7)U&pk5lBWY&n3*p4%+%L7G(H=H;!l!+EO(u?$L1!U zo@vqXY$-Y)ko!1CsRnL4CKreH-b)g9NrLBFL@H*%)4HjfLqYNwg(KMhDpH0F`5elO zl};E+&6xZ^=32~}0Mrdel2e)(Xh$TL3L+5Fv=?1KZS~ILgIB~QuZCgQEHJJaC#G0? zSR3<|n$|US6=PaxaY&mHjxJBrsGBX;ciUjuc==|}A%Xl8o zW|}4moqt7%Lu3w=mNI2n=Qu1J%}D`;qFngJ)JK(L+qmPznPe6>@w+*r~AD-h!-c6a%v5V@8Spsy?TJLhx4Nhpq7p%$4|Ls8 zMt-&Bho_p$y)bDEn@&p_u5v~r*+e={ifzRA!oO?itQzhB%B*_3|970#)L%HOATEeK zKq(}Rmw|5Xp2qG0IzErkte?{4Ph0!-hxc3WGytI?%Y(U4Q7dVqDpS?UDB+kv?-gQ} z)_H#*tt~6A5clffZr|ph`*MHM$6QS+8;_kL!cTd$1J|PD>%hX|l*r^^Z=lgl16k!?Cyg?e_cgJeG3jB~RZzn=|=l`*uI8yYqJYTJ{;|CoN!zPGB~! zZl_Ho(9|Z@($5#MCyLc)g=K9naX^LNT^tG}1{(SrgP;JxG#(`M{rlwmZ@;yUF3(PG zF@^=*Ddt6xEnqO$HFr5LI;3t>BxMfcdAasfP>&J9uR{ao_Bs#aS_4bn2uP`ZIzZ2k zOG?qwn_CgINmqrJ5!ky5>!V78hM)Z*p4@ki7Ze%#1BaB6H4Byj>dWX(VaIp|UAl;x z>mpScRa>Sy^q|JDl*Tz`T|4<%Ff<41No4If|Ef!@qVs=(1GKj`x@^ks?;f%uNrmZc6xp? zu3}$YuP#(!q#GBA6wtnhXjZTnQsH@<#;d?9gGfa=2ld&4c@QCRM6@-wLVM0;vSquU zd3Vo%%VtG{biUa#ViEI|&_^-{Ec|Zc4ZP%#%m7dmd<>Opig!BZSY|eXmH!1F@?@V9wM{ftbAZUw-V5@Z)`q$c~=NRODyJoXjNu*DmE$ggs2SohkVUR9)BA{gkYMldis2*4k*?Xq zy7ZjH`apm1Yv{!hdn@PG!dan5BzZY<+F*;Kwb2%r`E3g15Lz3NEQlav%<=(po{VRY zcm^DWT<_g3(;JU5hHCTf1ZYB+A;=XvfYm}`ooEqz$o~pD4^`44iinD5$0c=Sy*r0E z>VBhyA~;(1`8DuT@fvPp;=2fQfnSc>yjfN63c;sWhBfObl?kIu5=pAy7wY_qh+coU{q%__SFXq{K@O@vGP(It z3z{k&e>iY#fpAgYIeJm1@4(07k6H&VTtS2eN#5~unn)9PU_2j?HmSPQYU%4(`4Q}n zciHBeUM}olM^YNO=g)#jsF~=FQt0&3NhXbW^4iT~_ zDRLD=PiR}1VV_`(2@kvyK5%Nhsx^y%Y^ek6@s10D&9m5o8pjGZLR~cYZjXm3Q9kr~ z*DR=Gn3GUKk@o%WvTZQEh2_@hvja{h0jX}AMoCU08HNU^cbLY&Ji}^1&-tRQH!NV7 zBG$fp|W8`RE%S8R>O{mktnX;-&n5K7l+EE0jv(f zoFCC!nVVtLVk3Qa{gZy$4-}d5utnrgOVIU-u9{Q=KVa%z@XfCq5 zRQfzPRijUe0Tm(C6A+rn=>e7U(^S_ki_wm#vfstoG#0D;;Q$>=EyPS&td^;BF_R-$ zHFoiCfdc=)OzZ_T-b_xfE z@rixSSl?U#C}@wX37hH5p7``2SAZot9^g1y>$jjsKJ>d zf~;}sXgvQxmKB4}p^@&3x+XK>Sk_c+y;Kr#o~B5fNG;wNf{!0ZJS(aN)?NxuOUuv6d+$ppG8YSv5s$C~_B}kb{@Q4t62YeK2 zGhy#9?oa-Db!*)s9kgzAi#U)%!OOpX+HpLrrzImqm3HJSFwuvC3ed_}P?1sZw>p9qCZOO0zzJ}g11NtU33p}3-8NMT z;5gw+CWw{7kQp!nE%8vOXbJ)X)m7Y&R`_* z?VBT^0!A?iT?CYIq$kWs%0%WPh{GWoKJJ^b#A^i0=$pK>=SbMG+)CmA$T^_}H{H%{ z`g$Og7I)!9ksmf8b7}VC>v)I>0x9<6<;k@mr?2V;-t`cSlC{{+QI64x#5k7_awX=w z1lfk~d1f80;;?|_dqEL9>04Ae=l(J5=iD^P5``_OG1BWe|BK-29{#CvYGuyXIIkbcj8;b#*`FF&~|3 zKVi5*!r$%LL1a@wL4cQMIZOuLH7KPU#QAqy{65+M*yWu47F~FG zDj1vcp)bdT{weLF>XnR1^XiMdF07w8T58QSb2?V~KlFcCbsj{I@CD9i98y9-{5P5u z9sU(P=jdMylRMcgLq5aIrP3##AZk4L_sj`1AKPV}+m??Y+Mu4CAY9To4E?Pom$6rb z3`0i)rRnlbszy@V&?~A#!~*lo$>5u7Yyep}a`nk3ztUOW<>^A7DqGr~2BIPiRoFZl zZ~K1XfmMrSAmpJ8g$u0gS&;M8uf^19!<1#;w_|(O=@eEUolLBmn5az-LtToNsBa&f4^Phd|AOHSRpiKH6{_7tT>kjC(xao zt$B|GiH!qScax^e^kf;#Q%9_X*t!Z4%G=nevzri*BsM_q8bYZskpUPJELfE(J3$Ym zy`7K?f_%wj^8{Zlf9%&@9y#YJq-Dmu@KPAz*|wF)CLkS$wrR8Wj-f)^hRrJ5({J}a)hR)F3ij}zJ4S==GO(6W-k7VPlyg6x zGz;~cGDSN9pA=+qi4?h@5(BbVBJs{oMB|&&eBe`x@0s^jx4I-|XA~^}Er? z_bh!&sU3$8Y6QtwyBSo$yli1eHMa4f%nfzZk+(Um(hF8e4{Llvm4Z-+^GzM;t^EvK(+xk>rX$<2#ZVfv+JpE~&Z`_y8JNyM{D1t^D%O@qG~yItC=7V|j3$YIo+D0? z#Q}o%eonJgq?BHheIS(^cgM%UI$|QD4kRSiBa@J0QV+^6D9XMN#E+D(BnWS6nPD}N zr%Fh%-?j*QXZfL%pgIoL!SzLGAsP)hTLY~iK2eqGhUsB_Q1WbU9Ty&yueyer=`POY zer(yMI^VW$M|Ah;9GxNZV70#=rL5hzPqF)=*Ydo_Q+yPCWqE6d7%suAJm9^~^|6R@ zUoM?0R&iN`d60yDgKpxT;s8*_U4?eS+2cMagz;$)5xJ%2dqz-pjPPBS z$h)b+9R-5#>qBWfAE$~PYp^^c&fj!ux*#XB&$Ud0ZT-)00y248r@ctw`HGj&BLP}4 zy4P8CUTAE;Zhs|oK}aL2UsS_iRKs6X!(UXxUsS_iRKs6X!#h>OEgHOCehcy2ci)@2 zEr1-Gx49cYqbnz!C{UxQ%S8~FtIbLEvxL{G1D&Y}#Q=ho#zx*9mhy(NP>BnDy z-6@ObK6)yND^@oBK);Gs%XfCeg(q>e4BRx%;#m&IeTgfec}37N^mK|?0J{?++l6XM zW`l2LGla8)##Y+oFIa0 z|L!c8e&-q(y?st`l3h!8Eq572pR;{ShXuE8gjO<1x^!G!_Ol>MLT7WmOL5XttxG4r z7pZ@OSuFiCiL^wy3_DHa{1ILB=l&Jksxv2dCf}%41dzQ}<5a;R*x59buWl>FWiO&x zTt!}Xsc_r5VAlhF8ZVI~u*xS+mzhG7c{; zIW0iIUA`yB;SO!%ws$JjXmu z++7ws?=(Fsd0zrI?7K2Py)AfL_urRu1U2z|?>3DS421HtZgo;%#ZMYm?$#0g1TP!h zv%SkqPgf@r)Zy4%ERjkD`TasTFYhiLxn%S1(s0C+$9%or?h@6wCsf9)TL-Db#k-Ww z&SLj6nC@NO3utfu)^e$C zaoVZmg{zBA+Y5S~iaij=*{MNTvd&bLPV0HyxnO(IZYzZ)k$1We_K)Do3Bqao_;b;{ z>-NuE5*AFnYBEa^@1TE_SU#{QutTiX{~Q#coQ~fz)S|=z76EE9p-q4 zu@hdW3&WW8_hl&i&cgQyHimpNKIAZF_Pe^sF4z%f|G?Jg{J=H%VnUI!u;dX1szx%DR+?37*u| z)>}(1^|o5xFL@*)3z^T-g%N zOdDZqZEZaCleP0+wv0+xefJDZu?=gZ+E!Z|*gh)I<{l$Bg+{~HRYAUkvI8vKXP#TzwS?S{=x}Oo{dTqCO_f67n@oCw}_}3Wz*NvBc z$2;LWS+(YRRV9~m){iwvNg+~iwZ<3xVBNnzJw3m_Kem24xww3PcYbW$|MlYb_WbPF zI=Q^O`FISh!}Z^ft@)w^{@i!E zT@-GC)k!SQzC6%>$OE01`Voz*t8b3B_f4J3EOheRk9=?NbtYRa#;akHHO?|+ax$9L z4bF!u-ze?Xnf+hC`gs21uh8nRU;Wz+{G;nJ`c%&;S0&Xlx~pwVr|+BI$@p~G^QXmJ zrVH#wjkyZKopmce3!*uun+>YRX2*MJE5-Y4`;7V062hvM23qfG=F}O~{!g>?7p@a| z`ql1tW~Fcb`@4%R?GyCtTf0zBcvm++RGM>6;T??7J97`wo4(~8ek;Fpuk_0@EK^@GHLCy5$nBwQ;?&m z0+O+nwuVKyK25*ByR0jd(q3bOhdhDnEiR*tm(gOAO8umlWWF=)r;Ucw5x7BIWRy2> zg<6eS4XUXx9gt!IUeO*R!L}8^At`B4TLzrR@n_8X-JmqA9dmmsVT332z)rc5KK)Wf z>*B1ny?%5CWMG+_uo}9*Re#tyLJ93qdExoP)<(9XAJy2&xAz-I^D#P>&2;aXQ340` zT7vrZI|vG|uKjS56OcCT9Ox<%Tc5dAa~6p5KT%LKbG zvrX$=H2WxPY2lZ+Njgw&IcQt9xX10jBGR1-3T|wW1gP_Mx<;2iomQQU%T?-(S3lOW zeJ-^YlQdohl=l0pf z-TCRm%^gVWmuDxpAl9G5XDSSm{mtpc$t8;VSfs36mjt!(*m6954rpyka5s|OonQ%# z7{jUpo7_oP#VhH;fyV}&aL)>!-oc8%3Z7glt9N&Q0?YIFtCQ=8^V4JN=bM|KFVByy zv-da0*5BX%c=6Zszt`b<%KnU2Xy*ioKs5&c0K0jAb$@K#p4{JmytzXS&HerP9q;YM zN0`C+)yW0y?+u=kH^ipsE;?#!89gDTO zynv;#@6Ye=snN6Z4;QEB_WQF2C03^2muj}(0!}Z~@g6m#6|MF_!FpSBoy6uUOVWP8 zng=Dho|sZKBVRZIS0ym#>!$v0iBh&G)$={XYnFnv$jPxLmOq(K;3yP%2ygqb2$^~N z?)zhFojs&QJ%qWezTfJiU-zL;z!oB`8)@`12YV1QA6{F0c6&VqFoQUXm&h70@6fH< z$-T&ZP&)@v!!3Rv1=WDxX`=BuV&tcKCws=EwM2<1YGdo7^-~+!2LP9KSLw1xIqV>M zJYx9Qt$Z75Cpk-c8LT;Bb<1R{B*C51@h*HyY7q#)A9zU~DZgeEH>@I=O8f#LLD<=19|c+kwQvsaFAf4k)VS{_Oez(=o7kV`Af^Hi7gds z3+IoYeeI&YIwW%VCuM3y1)OR%u!-*4bZMdK66)HJPB{8 zsKpM2{hS54W?Oi1-Di-8v)gO1DpMLhSP1>hK3|%|mtPLG|ID^pu+4-DV9z{V^cuIRa@_J0V7)l-x&_|aOjZ&c;Yv}G=` zY}XF1RXjj!cfE)+IedYIMYpe^?!(gErNQfB3B_HRZHRV-Z*`tJLC85urF1;Xs_UaAYXB;dYZ}ElP2kyuhFA}hD__%uabPz@WT+^Z*8mA z!P0diy**RwjKxt&Qnz~6i65OkfCz071bEQWB8ueGAie95zLwbL;^vmA;#zwzdRjtd zYdi+YEhrkGh6paZ@7q(wlMvrkxv%KcqJgyVCREkztjgqE6`kCO<9e+50yM~SN&%8g zh?UBdz=M+yyf$Ln3POtLhZwa8N5s$9z8|6IivJSC2*S|h+T30yz zetFpElCn3;@oi2C+@gFrik$7J@OLd9~lM%SF9Gkd6@~V{+;H`BLG6dlP=^?7Q+fhYSUSpO! zZsX+r*~Np6CZU__dn-p$HL-rG=6NjZz5e!Fix2_n*}c5^`R2NH%67CHcVioES2Xp& z$hrkzsM2IvUMbuR^xMG+U*yVsOLpMwM8sg}Y?S)%|NADOYehQN2S~y1KrSPzJGIYa%&Y>En z2V6-y00M;?`bdR1_)!$YKcLdDUuBV#WQ#a&a9RCmcFhG9Zjrj6c9p@pav_pJaG84UG>v-bnm0!QI8PFW#j|7QOQ(NRpK*0iQUD-dM{%O zG5V?~pPhgF|7BzU5X7}EMM95uJ+IT&Y&i_`Ts?0(-~gibi{}a&M9#)yVM-iov7~jj z(E-}#IcZ}Qt-glMNc9G7OPpvukg!n`+*F*6fnas(gt2uJ!b>9%yWlmrJ-L2)bN`~3 zLkg}l4o=X+Jx(cd8r#WTSwhk}`aux7YW5>R`HRcevKYJ;9TTUjI+GMvm?#{aGj}2B zTf24!3uk`b7bqwuhwjJ|Ttf1a13g7*R4uk~mtvHQ6ATEi#MW{4LH{V72&Fgpp0;=U zeYa^@ft0fu-ahZU zrW@vdC)q7$21@6I;~Gbu56+oVXYA9Xw*3T0NS(fVj?~`=9457yfhS6B>OjXz>7u(+ zyuh0&m9J7O)zk*U;p+!Hv*+kWOshK|+gk^LT7kt&@*?%6;@Pn{$iKdxP;8fuZfAaW zO5%`{j(Qfx>z4~BTT}_(VKcvfnHNduwy-1thh64ZJ;v(0+YveLYW|&Du%* zuSp8|dg@2PJo>u9!S2Yd@@YGg!uGY2$rMVpQcYwbJz+a>#v9N>+kF|&rR}Hcg7_)Y zHVFyOm+D3g8Vq4&8OFC73oveNq1jSL*`i+BDr4XlB8new4GFV5$cFe46Y2JelxSf< zTV%prJ$7H zEAZLg+R}$0%?pgGWRqDCfnW=Vs}_U9g={F)D^^5B%lox>^X=HjUBxZ#hY_yQ?14Ik7U<24stPU3wJc3TkU*IpV&Aa+;#w zd^n>1OR{>_41(QlEGO19$XR=aW@(BRg>eMs$s)xQbOaRKV*|@Ah_tD*bXs*tv(TAm z1Evo|lU)+%pYVK^Xbyz`6K&e@Om=1;srSlk`WzuQvn+N4*0*D3acUpi5{C3GND@@U z?&AaTpc(50NfGJHY0r_Im2zCg*X!JP^}CW`@t7W8xb#F4XxRFJ#YHSVSFlH60HM6l zvtZ>*mDptX%A|e*MAz-^yTLKwX`opRq=`pfKxqYoW6=sN#trnezqH=HT3|J{)3|qt zD^Z7Xu$yU{J186kTneg7m$0LB@f6<)vc8c%u(8glEAIDRU-_8sF36Upd00Hx%*S5b zzCyHqIgU&o6o<`5B5momLG*z@z;0fGm?2I(JG%H}#bTrV(JcsuFJ97cu6Q_GJMQzk z>*i!w1w3j=8Z43XuWkI%>lb+1;JyW9E(-+!U1lAr-bl^Pz%A#~0AiO{mL`A-uvP#zmjQJLfx!6{wlY)?oN8eX~8+jy>_?EG|6-7`=SqotIozz`y*a|-bF>wv@ zjdcVkcBL_!FQfrY5?kahG@EbhILW(>d^%t@7;%d$8syo|VF)h{t;i7z$=|-fHICw3 z_Fb8#;Xx=|)U-^ji;4lN4wv;BFaLMP)_30@Ti>F{Y%P5!5-X`POqwsHvwKyj^3+FR zjzoKH(AX0R*XRc*7J$cseWdnLtM9H|@nPCGm( zG|@R+rzIB{YuWYnw8+xfqQRDXP{%)lYCTcxRCl#n=XEuXqR{?l7+JW%(-e3XdC>8A zGE4aB&~%n4fuh&1-f-47>Rzh$O0rf}9<+i|$=B2YHX!AzHcgNYiztE%cqFV=_xG0{ zZm&`7zqq~k-MWm=rF)@0wyK!mpY*>?t+LSd(xv+u_H6BJ>ef~&&{Nr@y88Tr5Yc2I z#CaxZj3%PmM9B%L&t8611nNbQ2yJrd;D)ZBw`FQjfU=0%N)={h>6F7(!eRune?_Ha863}Xb1C?(k*iv>L~vWa zXNyKMQ)*gY-%QxyJh`B#e z{7LOj@U85wxYIM#k1|;L*bJa-wr=wTg=SYyI)OI?_!XPtS)l80C-ncm(!VB*$M)xM zzkRKPnUw?U;#MjPn*f^K%DNpO&B{UT_8?VDNiWjdYCa5XHd~MEM_Nwg?5B_WRY-gu zrPBw{#ECU1@Tan1q0>>Vsif}7w38L9^8P9Ivik6pPj=7fJ~T-5Xua;(wllaKxGq=q z0LPWBw=K(b9xpseG0@!|Z6=~f=P)1i5r%y#we!MNxV{eP9^8X{y{|$~w~w_w{&d%> z%4Ru@gVOS3OVhnzHt#hj-kr@;$-c+!zVgKF(0HHI_D~Ot01{Sjwqu$EBu5m;6JkU< z`y;d`K&YM$AnbEkh~Gk^#{=D5_Ci`Jee?`3khmS>UC*uD|Lu|_Xc|+$6xn(Ud!LDF z)Vm)FtsG&K+9g~`o)*6LfRsa!Pl#N>k)9A4OwoC@Kp;TX4sP97f114Iw|!@RkFpPJ z7{dU!=JXK9UG3tZB>T|tc14f^AYDgQd2($`eOAR_Y$Z}LWTR^vdCZ!bfHImC6v8BF z2o6v9AiQX}$)=JjCQiQ4w{n7)u%!_VL_Z9ito2I&f>Bph$`yrm1kQNQUd^oKck%E#fv5rJMV>zQ^ zIs9o5Q4FNOLVD4%cv!G8FwU{Ebvx$4%8%Ie&qLWiNYctObp5Yi{RKp6Xvh0k5p9VI zU7-LGG($Mq0r8keaiz>s2kyl%%4KeU%m4SfISKk}SMJmbP(}hKh<%n(@*=YwA;^o^ zQFc^t@*k`$bzccJ^sC&BlUMH2gY$ufCyOlyq8<+*&eV2K6A{{8#l|quO+&q>FlX@2 zb#^fM5rZaRK4>TiwR~DZy$9*&TFa=lJ?IrzSgz~#jHcTYbnS==MNXA)m>6M+RrP`b zX4Vl$yuX-O_dd|7FpI54o+sH4uU@U!>xuH3#OeH%7rWUjG0s%YIY{>A$44gBoqZbLjMvSi45rH2%$h(ZF;Q=?V5J*%jwp{;32Dz!=IH!dXGzA*33%5jTgX@yP^fe4TAIn|G7o5G*M61K0JOI4xmtE`DPGYtK(`~e4t zq700WaQEOR;leM54Sz3u_cLjx@hj2$B009!P6+I|4=-~{f1sNv`X*yb4uklm#OX*s zO}#VfKSPWjpc;NEu=MaPXYcE!gArdVUv=}Om1@4s`hd0Eru>r@anVHxIj?~C_7MED zvb`Uq3pT#nG;(;#kp>cYfu$31itX^7R^RoBr1IOOk*&{xB8V)5IV-#?*;5tEWC*S7 zg3qM-rC*y8sY|9otn-`(BZ9U~kN<`aCtw1RjpZ%?i-PMhZkis3IirdQ@K zmh;1XXe2f6wp8NrRa;Yjs-3>aCMbzbr0n zP+OEPQkPP-u4zrGR?cy_mQ3^{l_|d4%d~u>%5%3x}UA$RR$0MM+USlzU5ZwRPp^A}EBE zb5+wvu%Fp04q4A$SZvt{H;Ts0y7T$O@~MfGVNB{;y*=x&J-ncNEvXa9YLTxCGKNTR z(9wVLRU7f$(c@MoR9*HfaojJ?UJDpIw%ke|p-kkq1pb&*nzW=TkCORf-Z1(-V=*ZY zT*4T{@(QZ#AGley+iLf_bDfs&&HqEow;Hs5Mh9LdtA5Hpt(eug)pSoK$ zr2eU=`}9XjgYACGjtQyJc0-46)>C%v%RGor+37;cWKY>?5bf`D>kB#P_WUtBE0Oz$ zFa&Kpu~M|O?fbs>j9w%h&M2JlmK9L_>z?D(`wB}t*qNq>cq8^&W5rM7$VHOk7zdOaNTm@8!Q-E^dIXQd_&zFMLd}u$Dw{;dg5`Ye=leNNno7pp3HxbYz2;vu~7cNT*#s++)_kb*87VnfBg=9YJLi1Cx82<3gi*` z)hhO)E}TIhcIy8&Xg{CF9I_`BzE~eV5-Z#$1xUQd=PU`Rn3N;&Zpu{D)wsC*pgr{t z<<;59C{8Bd3J9A7v{#&Ph4*C{`Kdp5+T6IEVNdZ6vky$>-9abwjE+gUlw&;JzxWQy zJr`$vbl(fEq^Q8D+J7DmI8R_48-gQWT|FzCL+s%x2O>Tz(K>YP@ucgz&5!U56bw0r zqEc9n=e#OIY=FI=?Ik+VyPQb|^9%vSf>V@n$Yroh!i`u|`dFa{qu=<^w}?MmSZ}`n z{sl!wWxmMVv=p*nY3p&PPs)t6%t}Pi9$;G8A2%&_Gn5igg(8WuA?-DeoGA=dnU|il z6T|j>XPMPz>He|1_mtBdWj7o0PJr(6632z;)2oCL?&XN!2wplHnAjUw6JRPb%!Y;^ zkf;8mT@)-}+y4beeQdpb3;&`FY+`((hhyu1g!w;XL4;@2=BE34Akx5-a`b4w8HJ(e zE~7Y?*=8B51HDcqx`0Rusdc~hfu9aTbeA0Kt*2;wU=ndeB42KdUN;CJLPr2U5WWfT z5qk%7umjM&&@W^DoM*}#Q9pKxZv0e|c;ak8O7-9&_}!Pe)5vGC{xK`TkV=w5p;URr zk08b>ukytDC0_gF%Ns-jsRP#Xv+pPRoT>dMrM1sw!p2nhT;4p1^TgRn3l;$cPb?99 zFp67MLcwhTW*|Tbfia#47B_Y)Q44A)Xf8BUC&hR%S*#XWj=!N-i|q|khClhNWD2A` zv&vF;RQgo~zu);wpsSV)Ul-{<@#H>hMPWKnWBMHCPzIYNVesTGELo6`WpgGHR^kNl zB1!g7P{3z>mT>%IsNd_B5Kae_TDPYsw}NpIDq0YP7)6>Klb@xYi3yX;6Z8~pfJjcW zOYkVFB9(Z-ZzIVS6ObL>S!-H3ge9~PaF7}lQ5euhC1f&WHZ?<`a}FgFb+tI&;t55t zXS@K}D2_=offXDVnlu?peRmPXa9uWarS2?9VLabkZW-K%jL?b#rLhG{&H*bTY>c&( zG;}6Ap4?9@k&AokD!7mX!WD>nLkC7EFO_8&!cb<3Lz+?J7#IXXXx<_r3K3eNYylnq zJqK1OqLjB3?ur4kO>4_o8n0HTtEzKPn3-OM!OW+DS4nYolc*@zX<%^y@0!ujf~bs1 zZ`%Ro4RZvXV*AqB@Np#S*fz|23`*QNLVdgIdrU!%y|%bi7Q_)}E$a|#O%Ujj+xGJ9ezDd1} z?+m*hz650@T8Ck^ZcGL|@sLPUU0F~wJrE)cAy5<);gMnPmNbZ&3nG-+mpPhi)ZpnV z_HF4zP>T>mLedXP4wpOSv1FXXFkVLrf>2E~R}yR!vxebN?jk_u4lxoY)>V<^#1*QI zFv3C2J(;I(8{KLAr9;K8_mdWVHp7Xn#9UK<28##$14BMX1gs6xD?V3ZfAE6d%M1EY zo2+(OWz(a*QMrcl#A?Jx-1q?aV;(zsY~h>wm;?e?QyUZhJZwN`3i=bK1Cm#BlGo^j z6#o0}Se41XFuLnYPVCmVnug#u(&-W@g2Zj&1B7M;V1NtXYw;bS4`!Dmp=z&B>V^($W>$RO-sPUhpP^5vpsA>Gw-W%V9 zaqO_0TcoQd?CXIT&A7-haQqd>UBD)ktQNV*pmRrLNq8rP{j7%)LCpgWF+)ihL1YAq zSfzW@Rg7F}^bm6<$E8ah;oCbZTD4%&xSYu4*CIs?^Sj-(NTqBXc$JrzloULn7t^;) zurKyFPN?O2eb8BS4XY=`G_vdw5oGo3AdFw4p@(r(qi^Q}BehrPwdE1l!`|N>Hi~Gi@I+T{Djjy9P{VPto7;L?tWBGfwj8JN$IR`>LSoctVwgMfh zz0RUhYtjBbF77k_-T@#!NJly36R|It^^1n!gS#2QSUhCrzGeX zx=LEcfH4BBc3hR)7)aiRJ4c>EH+0g+(L6=8NfU_pb#3zrF?{syE)-Nk;ScF~nTqr! zAnZznz6N=h7x?j zuD@`62~d6H_eOB{4AQCoORW1! zC$C(7MTK3RefyB)MBi;SlM#_Q2(jKoaSgKB4RU;}{iERNaHG6p%sPHrQr@}RRnD>Ejo#$*=o{+h1xDe{Jv2SLYE8FW& zL|!H4nnoN2T`ZDD{|SdPV#L82X&F(So$>k#VR)xV=<)*G-Q@?BKCekdvNBQwbn^)F zg`w29dAj-GF%Q|@K9~X0tjW#M;ew3#d~8plIK+oIH~v;EkHGbrk4qVdTFSHeI%<^x zN2Ri>o~R3s!LU>jH4qjOBxTcghe5*e14B4}yM+J5d4>WH^a=br-1~-oB+nGJdO<+d z?G_-X^wnE5^S>5SpCZsM7`_jFeVH-CBt&2GaD==##wa9UyZ4SwBxKH&O`29EKoB|o zVvP7q#bhXPO9&7PDP*;7c$jN#rx@qdFz+l?fmOk$c&j)T74TM+q4btJefxP~g7G+M zLknm!FJPS0wZ;1ed;K(5z971(tb zYCg5^TZa+$vRMYB3# ztHjk)7*A29)JeGTxfp^jCv~cX3c6e?#VkwDB{ns+0?z~mJq`DGN^E0UqbaQ~D!3LK z_qYqkG-uprfTWLssIF}xoKBd8?@>Uj@ELYRtlI>xkTI;0(mZk9_vIV)mhX2bH~Ku)e+ zW@sbW<7cd|hI|!{5V{%do9$@Q3dmtVPEUZ9788NM8B2R;JbyC-zC_8>uI^wQ4KHw* zh9}ghha`0rg^0RUB51~UjZryZu^$!`jUxfFSXNirkY&00&<`4g`%Z;g^DO{}vwMj)1PJR4`?pxzzJy z1uVr!ZsIl+d)h<1&MwcG%(c4{s6IPdo`(1-%-eU6%On#jyD&>xsfp|(@P!7o(&}7u zY^jdg64+{>_jUlsx{6uZ9rXhTaeKTa^H+XlwZKs3tmdC&`uriF6s@yGES7W#MP~w{ zD_f(Wd>V1LPmu2VWRWzmldyYHYzr{bBdgS|Cc}56k}i%1V!~)(e28l2KeRnESHkIh zo1rQT0BhZH}nKaMdP8S?O}g^|}h;IK}o7JVI3a8tSps2?{K^M*GD(zw;7d z3PQyf%C`vT%McduadzM}c^~qqn67n&SxsZ`qZx+0K^EWOKR&8u>8}<%E5O`dyM5&Q z$idAX3j`~}fHR|-$N?+cZ>{&Z!Gh0wNG>@pAyA5ehmvE# zb`Sz1z!)P5z)p3gXL*vY6+~TuS8#`$!e;&?+q-J&i3b9D3X1JOa(>7VPC4Sei?ANE z%tE*rI$=AXLL%*sSj9ZxTl~x~4zdErO@I?8RCk)_2?||O$=FOs6!@<-tmBIWSJlHN zQ-Y{%+lkGu19Rx@dwgUzgIGZ~V+yrrmy6>;+5EnxH zh6yK9jBrN6?3LEm9puXbu4Hg0*W_3lEvRS@znQKkYRfOx1j_ExhBB+_A#iMdj0X28 zg9dk-O2~cM8DGef1?qHVIsvtQ*~|^n#XTOk^NiuQbjC$u?Gt&sU8k#b6+osvlG1fG zr|LvP=ZmH)H1PiOLU*O;2s|}PRm%=$DSACK&`+3Q5eeByQQscsy;K*JO5hTY&C*ts z>{X>;6g4dq2MF?a+LNZ2&c}n4uCIk$wA?nvq}cq{4mWHSv5yqZ*$9Icmhe%iA_%7C zmtPkXMV`Vrp4M=_DJU|cgEoldew2b`a2Fc9lJ*jdmqa^cYjmuqr96MOw)nvAg)kz~ z4+E@_;}a3_$(s?9nZ`rNzeFGjmz?2K2w)r4P+79!W;IVME*Firu==k&sh1zCeIobs zSzI@x?z*NZ=Dm|bLk|W;_e`#HF>N#sRdd|jg1dQBaYPp}zrS|4j$&P6v-B))Dh<=W znSsv%Exm!@%FTI=@zS+wkL$V`J%QSOX(v$GuoXpw8nRs+ZNV!%V0plw`+I)5qu?x> zF|yq*a|~pA7x4{&oK4Q|7SjUeQ<=U0FXTxWWqITOt2~JuD;|7>1fjf`J~qnOZZVBr znP8Zazhmcl{0h=GH6OAGV}XZeb=OK&ef7Y1k%V1;@_L3t_6(en8yAf{9qBHYLxuDEjiV`3r0;E<|rT z0Ta}P+E#WH^D=l+AU*K}bzEvssH}!iHprnB#5lFc>rp|wqKJ@t)vxsnWAHQjqZ?fAX!NzAW!IWN&2YyKE^X1~w)N9^z2 zh)h{Pk^7$+*;LYDXeb_q2D6-u6`6ynR?41MG?iBoy55@}QakYM(rodNaBy_4PY5@NH+~v$b4;eW{B< zm~0hUEanR8=xxR|g2mEHnZ~A4MxbUIAK#Jbws`9yQhjHvfI2- z4+C+>Twqoi1>e(1jACZrg-14Qc{fzfSbb+)e?bo+XZ1zadyOD8Gq*N)$6tmTyphW( zO|lVY3heNQ2QNG3W4?XmkLpvXPdwnWCK20uP(5w>kC_l0Hzlb3C}+`kN$%ra=qyUc9Zo zHeqdd=H`I5UsICpuRjUiW^a2A?3<-Izz^%!p#;tnKPq`9^JQ<396)K-NF!tjwG@!4 zP9|r~*1Qt9Z==)`t1?^Z0PFA~!{c9Zy(}voU9xDEwERz9qo-+6UG?8{s|+P^Z{lys&YmO3~UY;rB!{{ z|H+QZQpL-gY?`u~tgYaWf0w?$h0DT~~M`oDWijk9b*OcnKTumli_+`z>(jW`@BU*eJ`v zT);EfN466mR*>gS59B0HG4Nqo2F{r(F*`HNY)yTlf+g66m;39(jMU+L_+mjx8cYGM zntw7E)tf+<)?$uXX8wV$w(um4=V!fMlF5KYoo?gE%*vA<;%AOjNJn!z3<@!59TE4; zm=4n)OSiE;Iz@3l!Wsahs_socu?*mh{n&Sx1+2ZN0vdvMm|ZX)!9B zRE$V1wR0ql$c49Q6~~flew(a3y@xZqRCDWcA|`rEw2{dsM6og@`nx2<>q-NP8W=RT@WP2tQ5rqwYcLx zs8_0RpV5%EznL8L(?MM%wRm0CSq866l!Zle5d7&+tDG`^f{R?v60&0C^cB;M0m46! zP|QP1glxPw;lB>%lz2R>4CjEze0pRCUH8}+ft#h*z>NKvY9t_War(kmGVO3-#QQRrSbVYNUUQ$@(L;2! zOW|JwbWENYe&W!sb>W^OpvvF@;VMp2$;5ku^<6U50hmM5?NsI292O_q>gk}!7Et)t zOqdxi&X}`J>TOqaZv$M&cjiREkRfrqZ$R6rp`heTv;1HlM`oIYdMpYaR_KYcEi2qOg&L3Bk5B@j;H>q|E{T zRW{G=5avN%T0WP6g0pw-=M{W+Sw4Ht?WoSWUY3SKqu3B05(#S%HzW_!Yyk)qNM7Ds zMj6x2rjVPwN$FtuD(sVd$m#MIwCnJM;~D(s?I0=%{c%5km8nc-{f4$gy{RE2bvDz4 z4Wp2UYGgk9;DFH>^)a+{!!FbCa|vjRm1CgpKZ-0B;0nXu=2xoY8+QbSzUG<9orn^o zE2i3L9v4~x(iK77obNPLfWbZ?5J}|fffhJlL>=J~RQ75gFVqw$xjuE)`v{%*6|8*^ zapvou0hx;x(JpN|M3NsBb2H8f`+SZE!KynXy0uKX3%5dAywtH3m>iMFI{%QSBwM8W zV|j9s2lny^jxIItFu%CA*G|eLO!p+sG<_FeFSN@G(L$2+LsN!p{CdOMU^Cl!Qj#2Aq)!PV@GXbrjoIs9 zP?PtwNJSb6erc|m&T@Tyz}E2T2xabndptOP03GI)^FS$-DBb&fOMHP~`oJ&&?)M_C zJx5mtm*FAczMiLl*J*rQzi;_9Zue*1b~VK>hrx=uX1LASjkU$7AL#$D|o+J{)r^cvHQUF#gOL1z1!JqZ&eE06`x?9`#@=_TQM-8p|`C; zmJ=kOox!>J+L(Wen~)E~8ljZf>6n73p0`9Nxq*W+CC-*26^)cx_Hg*?+&Jrb0!9Ae zebzx7EBmp2A(5E>K}d6=83cK%ggn3^pN zIcr^6OI&GEuQ+((`ZrTcey(toECX9URRsx{2-5NIbhlN{rCCE3(@-P>G`yIQ`G+ z2~5UgrwXRk&I1aTBS+v&tA;Be`L+y+*$YDg+(Zp32m$e>-Dg0SRc>hbT|{&qtT2B~ z101F~7>73oH`42tnrkbnFcyV~<1m$~)1M~+SX|G~)!xnyHoTOeqPS)%Ke zf!6U-1!LW$1m4dm<6(tdz#&!_nw!MCZcNZ$mzFkh#-zlJCnX>IXobjAGUgdnN$Tsw zPviJ?MjqYS7Fi_EKB=W}h@A49lPL$eMh*7O<)A1~jtA&V`6_X!tMDEk6D5s|;-P#I;Ln*^K-c5xIW zYeVw`478(lKu@X&tKIO7D0VIJ;Yd;$&(QEEQ<~! zq(HoT=U>J$Jyg;1^DOJ!gh(2#IcqK0r!ZrUlPx$XSrhl5fBz9STeb&RFkRmK>OHJ3 z{T|Q+br8G)lp?g~f^l|wVR40@yY~n-{YobD+t{e%@7nb&1B8Ip#G49<)RM$j&8Sop zgB*qNtV3vOp7{W_u+ek~X;%k#`(Oj#PWwpWJF!$+cfUeG^qnZeZAT;314lzE6Cpe8 zqy=ixPqx5D1fh+~z9ql8{LKNv($f32Y_AIEc!9^=PS4zTa|S;;kV5C5TC0^@%YF^j zUEU29jU{2*wNT8poobbEzclK}Ocb;}Ue8>6bALM^YsK}n8Ggi^Wm$am5&JZK*+%mz z@g<8L%IMkgr-5Uc%>v$#ummOI$95mvwe9AeHY9V?d%QodXOFXQwtZ-B=d^9EHqLVJ zTL20>12s9gaN7_Cl(IFX`u2qLDpvDR(^xr008@S59Q@|B=jK*1KtLf%?+FTScgc7C zK5AT?JzO257-`Pr80iD80fRbfJ0?Bm30<;?D4j57CtJz_J);qPaj_WMRy{CQu{18k zey3lHfS#^8N|C8MTao#)om5@XeLJce_^MbepI7krM?Fqm`D1hV9L3Sqn)NUWdSY%+ z+#}3q3!+Op=oJIy8%)au;H;q~EHjLk8{@Nq1)K`VFJTYr>pE4(Mqj-Xd31 z%fv}Uz#%CLTOt-akU@Ldd1Uuq$TgDTs0(jQjWkD^VhVRo$_S<%i8OHlv_ke%Ds%Mq znopq7uVW-5>!TQ09*9+K_i16!cKofgkY{23Vlui1$hOKeI=Y91!QsGfueysXmdN#c zFPCGtEj}hWpne>9x)eYWZ?_8+`#}B(C;>Bd}~O-=kmG?mpQFEl+|fC+(XN%x!%wjvJ!LG(ubejiXP-j`&d!h*y|8 z48CNn^EBB?$tlSS_K=dEkTj(aqtN|qbB0CFdcVC@`WH5$^TNYt9}xB8q%c_Nykhzbuk zT?O&wHs_Gy3pOcA|9s+r{mVibfu>{1Yb8(wWfH5491^C2_?{8 zg;RBrCoY|Lr_t>`VrmA$N&*+lNwga5474F_XM4`v!!4?rMLjOT@Z627GI@~>M^Rfy zM}@D1@##3NIhFI*!2l!Z;HZb0`6wnIa6UZ0B`*7YC?Xb#huFMDk<32e!#DqC$>kC? zX}!^jIDNOSNw(D|M+0!~#Dy_lKQs}cX%V+%p|UhNCX1n@7cmapx>Fvuj+Z~Fm767Y zAg~t(S1Gw-*L z(x}1VljF->u6S6)4=P9Wjq{3%d>hOPW_~SiLuZWQ zYz#7{u=?{MnNUUGDYQ8N^8sQcG7r9lo2lN>9CK{dl6_mBwoqc%}#*?A%YHU*Zt&=AL|3CooyTEyY&d&IH3 zheL%7R^J8TCX@kZwJouT0C86nr zVT(*oR0d9e<#^EL&dmC+viV&=7q{YlQLn%dI30t3gt+o7q~`7{xzAotqfD@Ij@VY` z{kSi)UYUa-TK>vv^2 zC~EALFzgHtqH&C}_~9FTV>N~|T#U2c5^DzJXk)46Wl5s{Ba7&Uh~@nVg7+uKfuy&q1F!D_Ir2zQ~TdELA6m(r&3p2b|z$m01lVEoA1-xX|-?2xM!B6s7O)CCcd9QmFa(E5E^F1&_(;f?cpV~)} z!~SMqdobb%yImYeRE9{wGot)xVqOC=B{C*_K^(aGJBQt9Qe9#VvE8E*Uh#q0V>Kjj zff-2J_H$R;#Z};f=5}cE$j^Gn4Cy9xy-{Hq1c?TGdih#VP9IhFyV@}Q{V~)G$z*UFgU)Lbq!qs7+|gdjGq&>0|J#vy!tP-Y5DgNaXE0 zix4W8wL4A3!lIB%@-sHLXoqYrr?2FYVSOKtI^;+IBv`yrfpG^zomf3zp85WJFXPFt zVw1G|{WvVl;y=ymVr zw*^?;8P>e^UW-tOoNB0Jj!8oaJ#mClH?yZ}FvuXrng&7bv;osytsvz#!A$Sw!OJ{Y zAKmFy+u6XRa{pQ~ybmYYle`7KYMrr6rn=sdi^12>ypmOE#$v<5Pr*+RdYTA->UG*qPh^%b)aTL>KWP-x!`nr3X|MImTX+ z#`_=pW#q+=)Tzzr^gN%qC`M%!A-Am_3lHl*CBYe^)WQ4|uGWc&8}0nsrl9AseTq%) zesGnrvUF*MajzhkPjR!1JM*81>!ax`_9Q#jRi=bf(^JVoi)%id9W0CN@%6jU415zl zn9fPWec#S(1jQAkVM}O=Sb>hVt=gUzouBAYH|Rs;EFJ9ozV05is~n`HPALE-PRY{> z=0N}u5$!BPYXzR;sZc{pR*VtJ^^xM+!>Zgyz&OQ=YFhU^#^?ZG2ZU96BWKM|I3Xw+ zy1;FVjXM)I_WADc+^IPO%v3X)B3ErwHKF4J9LxW3gt=(FF$55E2K^*?a&+0|Rlyn1 z$>O-AkfmDz{2b_IH|IV4z!hO#L*~!qQX6b2G7xEBQaCSBO{+qx)AwsBOVSDaaj{v* z7GJe&#G(h=jv8tXMX@;p(2iLMvALa>N~K;Ca_BySSEFYv z;b2F1n9g3`={f&G$@aHuIn?G+FergEUQZv1_U*;?gI`E6d~22QAr1fX0@r3Iyjm1B z9h8}e0VW1|7MnHG+?aoEQ|g+qp;Ds*91Dnd7fX8iVUrcUtLF4WBrmx{pS%my! zYcgxL%}%vp`0})UG&r8+056>Kq>dHR;D^e4W6#PM z+;5xgo!~(-6KnO`k^c7F|NO9t1CH@|!mcDk=vTtxhM?N8DoccKnNvYVqQ^FK%5D#y zgPxa));XN>(FhYD9(WIf&4D0;Tq&v!epjk23uC{xESwHqLwSd}9~u4J-R8!5ij0)# zjxpk1=zD@3XNNWMw_gIODXHu$pYz0lXOJ;QL-&$zRFgv*(~7pdxm+KK+PNY^AQy4p5p@KA4akV1Gktsq z(L?-A2ngROCvGmKoyb=-R?1ey(^&QhMp&4{j>Vp13$5Q&V7;(zgIl$E=oOI^0q^Ul?aN*fkAg5V@Pdc%U~;7IOka#5N_GWTRgo5Z`6f z65;dTr1x%HNWvw#sXBX4M`{f8fStX-9t;VFe3O)?jS9T`(BNNphkk0Zg;7zjh z{|@<^b-PyXRoJ9mPz@0z)652D%ydXF+Iy`^en3sFR)Yk=jHnjC`p|?Y4a^LiY7I?f z2)u1Dt10|nh`&D>2`NoEDl}MWMkY$o<9zy3FG_51UDxrC@2QZ_Cf1)v@LW-~jad$s z+gs3a5andma0?OHBXu>IK>nN;u1Iw;3|vS?ooWWE0r_VY@J zLkU}WXufwrDa%u4T=pht<|s?}=^*U4S$ksV!oc#Ygr;W4soC5sA@+{z>!V+ zqZrj(FdrUR*jFt=x($|xKmO?LP2qr3(sz7r+P+`7K9@np9~J+3mhr!dFz*7`h;LTI zC?v72X%EIbKf5X5Vd+v zxIZF=9G)5P5%ODEu`z_3Tp)^eqIyTGFRFc>6H1ii06^3WLFZWcQIu~*2CkWDj~GAO zBr*pbIJk22ip@oJXNUve^D|)?vOr6*JL+zgsoB{RoA+~9oMl%%kry1R2J$AYdLDtn z$$gQw8pa(wFbD8-ftbr*{|)=alKHx_AjxldAHNo_>~;X30`e9Sh=CNwZu>8Rw`(l} z>4N2b;a}`6j;bXl=KNcGaB3qZa}+sKOSnVFno`V3?2}+5U@f9RO;`qm1JK>qUiB49NwLmbie6~=Rx33+7D+o85s@0~ zduxryR!QuKiq612WeVpT6j*bT_gv1;VW)ay`FyY{fk_A1snfGjM()D&L)bkss>lZ7)FOfhGZ&qdaQ3>Q?0MT>?0HOyecK6b!@15cgn~rQzCdBBK@= z9bt}(D&X;Kt5FXBZ1LtyanSI#bpY35hRIjvIgM(5^tT&jhNlsxD=ah@KmEB@B9~ZM zYKkb+P+R(22=v?ttrOPmQrLHH^@8FZ8dcvaSuG%U7b9rUPnb2#Jg0$+Add}T?zjN^+H_pfhe zhy70S6@<_xmnGcA!T-@=MI@hvPL>KMRHDfcH-+8}s7{8ctEQxmpC6F5jL>~VZ>fI0qoJWa zuBJlFJe@|^5r^2cNU`=3oIq5$UxoAn!{E7DZKVAU-Ho_;cEBiKhMt^x0hE3Fzp@X8hA1&xutTQ^QoY6 zs9IrW6yDA2iXu7lyEocl*@$)XkI=Gws@6@07^J=RD`^Y`7p^R7jg)Lwx*t}T=}1uiHeRpacVY6yQv`;`0qyg%cRIrqt+8^_t{u|`02wiDPCPF>~fYBbNLm=iG~ zu&hZUiFr6^>2y1?)>Mq{qDFh=hb4^9z^I^saDmCDjChGp_@+q_)8o;(W`rP^FS zMU^gJ=WezD1OEmfQ6c&${84Zne!d<`pacT)MMwZNn@(faFn0|qCcJY?*&9JI zoEEuhx-Ad`0h0cV3^)C5-Ikx@B%**Su3lHPdkJk@OL7JW#(S&3p3 ziUS2)4R68|5qz`HfnO&a#*tb19F`DrDHkZw|F9U;gA2)H^(T2DnuiJD1Zowd%`m>e zHh-7?Tk|LN1#H&E)dS>etUF4#N&vr-=2R*bC*_r4@Gq>+QYWw>6Lu6y;YpsuKv33br_OSQ$hXxNT<@@|{nHYg6_{{t>y&3pR61Z((!Bb@@vx zvTGX%u55SP`d>=*zNE9KDiw#EqSmiA(Z;%)XTID?iTv?zoBE8`Gx`$!PwFMPrkO2Q z0PxGZogG3Ec^h2zyU8cJe<`>DxLX38?r%&mRThxn<tK23mKlEs-TiJm|8=s9ZzaS1azOc#+$h%Q^D;bV*RNnL%Q`VzbLi>XQ zMG8qiD4Ycz+iv|ylSaoqk82)$?H;_al{;f|V45)XtEV~WE=(fHU)l#iL+hffV1N^GH9U&ikGH>!?~ z_prC}U}9K9({J^~q*4>`J<<<0sG}VmI}NG-c$l-vRN&*&nywCL`a>Of%B!4^>U)X5 zrA{#bAh$u4OWw%9;{K+juplpN!8b{o7%sSE&~Vrmwt%sZbqWt}eOuv#$UU-YV~S-ycf<{1_EufYQRDem{;#uBRxF0<#|M zl7+%(4Zwo0KGd9&m&c;CRd*hLwntHv*icA;3qCD@%8{NDOf5cY((Jc_1CQNH`A3}59 zxS)oh@6?13J*1UMBBR}$(n{5RHj6<^Q8REy6QU?A4)XM-^g*x~UJ*(5PAT0>*n(e4 zF*t(XBeV9{LRdqqGD7eT5I&phR)Xj0N-XsznbN?QB^jhhR*C7EVOHn)6IEQ2LPSM? z0qmZ3v>{K3m{N{&9}EA-7^$^V5GymFvh+$rU-CRb;7etrd@2JL^jJEZ=J*5YepUn% z>d}#MM!8^ zWPU-E16*<61}HU*!D8ilc2Od9iB&>eX7uLGzfq`Bh)voU)=O%?thQGR zj%wC8xR7eVyITa9AEtP??O{PkaNNT%9J?J{>$M#iIt*(j4R=*u0n)8&X@O-*1fZwfk+p>WGwGD*sN1DuG>5 zH=O=cHWg+T@lv9cmwF!`e`1J{>F-P|%pc*Eq32Od%5Oh+0xm$XCPpOHK; zMR}ui##*rcb48x!yb(F#z%tO^reYuZC5@chK3?cvfk9ZldNjigaK@E&Jc7SA9^Ig} z+4Z@=6_!h(OzE1&ndp$I5xr*W&O$ZVBY!0mvAZ`2_6E^DmvwA(#tN-B&L3B$Z(A`# zcKZKdfrL!1SU(B$Yu!v2h^W=;kRrueNQ$wc@PoV9T9C#Fb$gZh_9w?w&O1cVWD_Vm z8>pBWP7h>%D$Ue!=-!4rYWC+@fFVob{2*96X#fJc7@}H!l^_mQN ztnXhl#3pbGm#s-Y==8j-vLjyzNz?EAo8LX^K=_|W3aVp*F3}qzKGa|m+nUMbwF3|b zt8jb{{XRla7^lfi`>&HI@cfXc3*FzOqLSN$@KZel=NOd5glytPTmt8WG)tP&aGSNe z1vkJ{xj#RbJ547baZfM=68VPznNDct7BCDd$0g5SR+UItesxs_(ih<4liO?J_obY8 z!WfNec!vmoRh|rv#SoI2Ef+^2v5A@iMrb9$T zVq@!?)k;h6+W*A_2GKD(%_RQ$M{l?nB8BkGo{p)skr88#<}oo0CW@%m&CCBXg=Rpl zrHrPEGLX9%%)xHdoF2H>#E3FQw>h=h-}7N)0$F9YfiL+mx8a+4JcY_ZGrB7sZ76#G zXT`RW6;KdljaOet=KlHSYc$FZ5uF!)-Jd8;2;f2;&om$4N&#>Vz1DP*+l8;^3$4FE zuZP2hZnwMV^`mWu{Pnb|E+^^Q5?l?p3GTgq4a<{mdS0nWkJs;C@6WO1sv!=du!90t z%cz){Y3nmhA4T*p6BrGK3kEylx31Hr^@eXCd2H6yB;SAJV|fnKB4y^zwVU1Dl%H}l zE7SE8deNlzlR(zG^Gxl{km|#=*VFHdn+(?*JH$Nah3+!D(#(*WraptIJeSek6ztUd zkLJhdu&AQb0WQ_e03(1_^EznQCpbtmSb05Pf>9+WP2EaM zHkPj$H*gR-eH2zwHfHf}fc%b7K=JLL{~&=<3fm<`@fS^Z8@i}XASu?kR0|K5D5w^z{YHWg&c%nZ$QCvekKQj3h@Ct0@$5vQfmdV>5@siAIL5GAU{L*Zu;xB8 zh5n=yRSik7olg!rKP14LsX-;xC(&f<4BN7tH4GjXF0TkX7^_J_mtm?@%}W#GU9!-) zpum_KQW%cuSS_(>0)WL1mt@kA*~cpUDdeo^zo7Parf;MG9Gu0zNBXfQ4ZIzEHXJcF zd$hjD?i|w%uFVZ&{2`!E?Q3r2FED{_3%7$2?Ds8$nA?Pt+UTy~R*Os7g{^M~>dM+asBFZfM|<$ndKE zV+eI3@TjzMwgT!3?d7C45SJ)4I^67~s=t4aKQ<8wTK`wsUikRB7NY%c?1hXLnmy<) zqwwk!%=S$j9lNJr`Jd6dOy~FZxHWA@Jvt(zp7m4XHRa}YE4a<3_Rj2(&kJ`+@5O+C8hT~Nr-n$Am1DH;LhE}=E=CpJYaBrgE92t7Ju zuTF0~F68I#L<48vIbpxMnzrrT|6Yp`GhnG8(zZl(3Sz7BtJ;VJ8wIXd4bfEHe+y`V zn|2XyUB-C1XA~WleVF~7{g=Pwet`n%doUmC9X7Tq7&1&apXBsG3)HPY)Eom5C@0YW z!u<0Fb2Y$APw#j6J{t!10(Y|;#r^SO7`b=2fz~&ssk-=lVu04_8`o2Ia2Ihl+05%8uZP2jUG$R7UQ(X-_Bi~TsstH+ng`*v{W$Y0s?_;9E5e11BsHh^#~z*=ipHc3*y zMK;4lqh^usw}OZIy>hH4b9VO;Ke7=K0Po|KlMm9*gKPZsBKR!byW6 z*FZzu5;)Uk6*37rp4=lVJAqR+X?b%V<{FFO%gthNv$JQAZKY80f~0g2M`phMI8Lc0 z>ckFX^PswK0P?SPRG3p?7U?whYZoTM#+_G&0>y7IRbwrD1L`U|*f=qmC^L&i z&r|a0Qnwh=`x_w1aVVNa-N{aC#0y)rciK&{779r-8$hdUU$r&|U%w5F8h;nN3C94v zzzRitgCj(JPO}|&sem9Cl#SW&0f>K{Ph@r<4R6C?%USOLQ#6f>^l`a+hdW0wJ?3(4 zb@URWf?**diUrgegCG;NI>fAm2CdYzZTInp z7q_-@8FOLyMj*~*MqNyA!Ksgmr?yuyUbX_ppQV4YUa=Z6Cl+V2nk;_7pVL4zvx#9~ z!D?!4c%!#iZ~9JM4^M&EGbnb~DRoy&5Fuj*IU1N=QH+Y&M$eNJYK0TH6LB){e^VCX ztQxh>pZW(|K)8k8X1D+B-d(+UzRH^pxllyB;-@fs^8>Dc;iJ)k7fe*ub!oluE;$1K zKK_9VDOE@2=7>-B#0!q1n71Y4DoW<+er{aX<@2x$UcA?$QyTB!H?552e)5tGa>eqx zE}N%Ip0Ba3qYxM-m;~n)^y;|&_rhfU#c>sP!Zz|SW3UO|d%_*7_h?v%`HKZ|MHGO| z*vtTlUdSb-Z(bp$H<(i1A1-!gZK{G~B3;p|^l&zw)z(5)bX7eJdxqz}n5B4(_iksE zi*mAKz`BqF&F1AP+PIRH(sAC0w5(vgr{~y}Ufi1K54cC)hlWn^u z+qP}jOtx)Jwr%^(nrz$kX1m?*zxP+zUtt~VSkJxg=Q^*mt@y{Ef%b6$6mtBCAJ}W3 zUre-76yZ6KEp`3;19+&H?ti>@X57_v7(q))NDbqzIDcyLWzwHGR5_4lBtmX??h{L^ zVgfc$rDp>$Ahg0W`Fi?pBYHp*2rjUOTM8KMGCsY)3j9T&zjTaYj zJ_RL_f#ssItQkaV>1oGp6Z_qb3sf}tjz_{qMncZfq#TuXyGA6D<4=Bct>ZvB^70>1 zLClyG&KelMers11O;>#VzIu%KrNUoxJG1YWX7PIEgn#ua`;|`!EmbsPWb1(iNApWN z{9KR0=TdjRP$4#eLfA5om{n;Wj2iu@{X%aEfIn;ImulX~p|uEw%KE$OXVkE%3w*X8 z#cH5Sa^l+-!?W2BjeAltmxIZ;Pgsa2|A?D$XHiUmFD)+@CDR7wlt)tac{FY=fBFil zDQgax;zK}`pKsjKoujr#u)$l6 zqvv!IjYt0u27bmR(Lh~@{Jo0GD6#0T*H@{2v5xeQ;+0qxwY>o_1V0~!dlkQcIy%ZB zeYlPG)f=T;S$@b<+xrQ`hU(3CBilq(tZd$=z9zT+8%plS6hu}ED|6OaP$M#v3y=uh zv6(5H$%L`-^YD3G{$7Kjj|m+EK1dJ?6oI$Xge`=GtyXRV`r+h|qZ(i0$-w&hBzs-- zUxLYE(sA!Nlg<2#n+>MHRdb{duw<{6d7#cT825=v({7DWxMX=d2)*E(Z}?^W-&)1P z*hYF67(; zzV=;dm)VvNp4+SKB7@oY8P&xBe7f=ug2$k}y-cq1(97pG6S}vGFiE#~@=2_UTR`q_ z2#%_yT|t`Sb~7e9HAwBFlw84>oh!DvLWJOp(rXGnw~qG^))m+}zvbrnd}J{-?q{%{ zD2G89Br!v3KO2P_?dM^YwzoF9Y3U+9hTZYz!x+x&)FX+;Chj@EU#GI*;`Ko3Tux(j zg1h)FWS!a$PHH!|WWhpH#w{U!oV`UoX&9dOJlHNPp{Uy5HLB|u~ffH$K`b4ciWe_nf1wm2#) zP>~ASR7I&E+Id#Fb)6(1%L}E+0+gq6)&347zuVod+}XwV(ZPSd%lf%$`$TQ|^}JO= zY!v8-+6An`;&VUPg#%@aWBFoCV;{`#c~MZ{oeWiC+FFA9dI69<4TOU)P8xpv+EAPa zS^F41Z64NGnP&yHufaFen}9R1VNH@+%4_Ng!bE5x_iIVFZue;x|M5$^J!L! zZ?7V5E*jq_8tL%~W9Yx^izVhOBgN2@yZCD>&}XmRA(}zyWh=#DPxd;`XUU<{M@1MM zFv7TwR{$q$*{FvM`j=?ub?lv~Pj-^S@9MZqr4ime@djTMbY6Jt?2?Oxa!B9pV0<=` zvS{JB1whd2%IH`gyg7~CbEf%Jd)RdZBIxJ<<7a(nCeg%~!`ZvY&=$p@fS~?hpFkEW zS|Opn-_!Z|huh$4U+*qZHFc1DF8rH?cLP@f-?h(SrM01f@Og0Qc~)7*Y?~EQN5xVLUr;a#pyJ<{VNRWQ zQFD1hD6S>)0j%JcU#4}SIL)r8@F^w{ag+R#WS{~yEoZUB07~={Z5u|NNzal(OyE1bO6?bVoDh<)>V?CO0_u!c zmQQr8eZ^j>l!N!jVwK{B>_3=mnBVg+YGGM7;>PplW==8Bg@XNpFQ!n~W0>n=FRWRl zCFki)8je%T{94sDrgK3477dY8YVH-K6C*O~Hf8-fYm5voZ^Aq9adnYuto_cP*-P8X zSGt5L3!&w$irozHj4>56oT~OXJ=WyzNK`hV+b=5NU(3Vc>Xx$QcACmkYtlWX!Nk@p3;n^MlIX0+RNK}lVky_vI~&oq=r1YNCg}KwKe_0rWg(=UCr;%{Jmwc5 z%zUYwGA!%KW(<^k2ZK)}#4U()+?d3z(Lxe+2_j3u(|yR0&IdDwY+T9)OF_E^V-JR(YaA#E7o>X@zlwgVff~vz#ahgL)8OmV!wEPci@D{_+U=g?L?5-RIbg zC+PUhp+1$5g{E$bbV~~`N~($9Ypq|Wmk<5C@%6+<7>j*LJUSB zW;I3SDdKahbUUnLH!_*ywv`E=Xho7Psy_5-Tbeicsx9d1QN&7iu+#fXXoc5)iaqaI zsW+h;vFn>(y(LE1(~=G_`vkY3Uv{-sF{o+c!e- zT-KBiFAkb#nSe?C;_)8Qe;3&!Is7nt5*ojH?KBJkP7Nj5@7JO)->L7_@kljCrG!}o zR}VFKqd(yFS+7sSx1fp7C9kt;^F!d=jzhIHJcbvqJZ}0Tf_pI>97hB;*t}AT0cZ_W zT(G>uVwaD+!DdSq=;q|{%9}GV)>w9Il5eEsUyw^;jutzjZ(ro4Po*`l3X6hhv8|_6 z+VXqad>HZ}A=jhJ``rU9)Q0{I0XCsnLoNFnRHOB@NuAv%T~m5b>jZluJcwE&=o*jh zfD#Oc#P3@GLNReXgCDG86?ZiNj6#|+_?-439qhl;4|{y!Q20P!N$1y(YG!PpMtj03 z?{O^rj@PLzyOqi}5m^X$!qfJMRTk6yX{hx~B^lAK=5dvTX|w5Uxn(p9?#c$>R1=P; zZ-b~K-@yOG3gV-;G-dyka^>w0H{4?exE)M!Pd==I>U{QtZ3c_E?kig^`EO95Nd@$u z4h(Jc>*@MAGa9rK@-|(}+r@B_HKy!TX{K@h_}QLGwPBolN>DD<$Jb+0o5rx3q70})m^I(I>fNt0d{QS$M*M~OnfNK3(DQh&i3mr z&e6lbmxDm}m;2)|p!+=z&fDbS2w6Gt58|A6$+b=!ebHMyLpLwYs2cdxAj zwrN*yU(|&Mq-^u7RYE~bo0YU`a<*umS42~yq(zuTuk)Xv3ml-O>4#iPDxXiR9fkrr zjt&_%(@~xSM5ENCBl`;K=rX1q!_-x$y($*4se0e>0>!Y1JoQ&@xb9C@XqbcwSNXR1b4 zwzT7e(g%G+dsQ3@Fhzq@v8s+jh51py^LQK^y2`bE%5Yk^?MHSVJdWdMfsHfG^?QwJ zZR5fl{G%y#>aI4%C*mMhA-UDEdk_&A8Ff8xFUkQ3sijbd?x$HDoM?32#KnAF>#Wb} z!b3;i@;v!E+~kljlD)5Bd!>Vr?4_S`gbdGNXx`hcRY9nJey=i2s-IC)zJ*+K@qs!@YnZ~cT(?`mura6YxOe2_l@oyg2 zXoP}5D%X$oiIdi%4$7%FI@uk|9H;OYW)&u$9qO-)w$!H_Ql!(|ZQdS{ucppwWd04< zKTXr{y84ShQ@xNX&9$!F_4sUjWtU(*3-XsxQQfW80U!5YT$6T3Gn?ozlXRVJLxTxs zk|$->AqqT-867*zL*{t_f)Do&Gaq?4X7d82+T&CnUqLzpdH(a2OTAFq3H+XD5vgg< z)PFS8kt~T+QRiZQdAG1$J-C1eUT*aCe2%xH?(qG1%7h`9ziBC9cpT~ajI!B!{^aQb zA$SQDTOQb1u7q+!;&WAqd|UTY-pI*81NP1f?RhoM5_@iR@;H~)T5Xo&7p%rg$`CnU z&Ns*C=Bn@Vw}gqu0G?XfMN;t#{w;BzM%&Uvn6E*zcoS{jXJ`jsy;7CQmB2gooc>m! zcQv065(*S-cblGC zJF{MF9jWfW02&9eG6B=llIn{17*G*L_p0+H++0Tdho2Hl#UFm#XOc|fu?Hcmek%nnjV-G}+A@6@!-mEn_@S`wyAim{)G z``-=HK3G;>mP3C*xXd3ddnPPUces+oc7T8o-l&jNRoFG*SRk5^v|CQ83u(jo+V8US6x~+)NZZbV-Rl4j`RR;uDlR6dstlVgDQcxr1Wrgqn_|B z?QspPv?e%6Mk;E~h|T50YdR0&4f2WMDDR5jb41k+hUeNEgiFdHjyM`01RE+>zm5(B z9Yf6; z>PZ4$jEbY01gg#C`1Ieg+#L~`xd-L!OQ75MdUqpFU~=~MYrio*^Xh`H>dWWoc8!BvU-S`PN!| z!AxkW(nk(M&j+wkRrJ8X?L_eLXeki1)hgus zbpQEeKglu4fur~^IF1vfVty@W;&#QB`9NSyuQ%z-oY4hSGQ((8)!+`n=u>I-k(rOW zaV__R)iN>6xrNCoPW1*o)w{(W_kdDS${v)7j^E&{=Vc1NOZ>p6F1cFbuduevO2OQM z&aS6+<>8MM4~Z;ljgvaGbsIO++;R4q&5|1F@`?2YviR@&XJ+(tYkhCUZHE}K=`*e` zOumYXP%TOG&{vN03K7jNi%hkDyuc>0&@iC*(JtCTnHKi0f$F589LOe8qfV|3^bAU9 z;1eum>)?A)Q||CCV1u12V{-esj$ew9jSYDnhFD9Y31*7au3J~iT_SV8G*WWIu$BM! z!IdHQBK~F5@@>;{{djEmgi(4A;&kNB)O`=ASFngO6*@Qe2#P=B>D!2wOLV4F?AcrK z)dyt@2?w3JQez$Md>5(VsuidRSw9?`!PO`vKK_gTWpi<40X{l@Yk|?+LUJyAAS01Z zAx$Vf@TxkcY`ttv6g(xYCc#5)XGRuYgrwUV;7mckP*xxAF4cUp*j3^M45WYJ%#La7 zhU&PKqen&}VUhhfcZ@;EH5wqS-z7cV6GOM+2@SLyWsYEJ0YMV>aeB52T|k!Y&*0i- zGg;dC)t%R?zmzVNH)Ms)OFvh7FCii^vul@A{xitFK48AZ**eEv<>@@{+3uQ-uyyun_}CNvIsu{$=8-L$^ncq_3STbVEMFF%fgNNtt=KL~3T+#E>wJhtd# z=Z;iP0$zn{ybnqSVN$DkbBk|LLFP;uTNziaXecpbLh|W$q3hQ)3QD|}TGU~?GKixN z3I7;i%udG*abY2;{*f1qioc5lwS428u#){HogwA|+0kTGqm?nBIi zHsN~M6#GB+|0qyJH9l_& zt|#v>?bc+R6(}DDw}?Kkr6zl1Gv*RqP4rvp{)sFqC6iijPh4uGqqU&1NNzk?m}PMY zUQ#C|cUeG2_VmfrOE{YFTcEw`{~KQx$O1ecp>Mg;iqD^|7HNAZenM;I;6-oL8vdJ5 zfG1gfvWnbgUe<0K>tmc1&@h0I%D_a`hfw`s)&TiXrmUR26#rewO<%|Uet=CWY<#;o zx{@bXgoB!`6UMP*4YDx=w*p;6H#u9FF{OoSYa!-<-&hf=WpHp*f`#vIn&q_)>)}t_ zKF21OXElz`Y7TWN$O(awJf}@hK8W8@EIAnS4{}2@IvnGhsgbsv7(j6nlr=IJ!xz-S z3MVm0J8`%-PgFZqBUnUFz;>VNtb4{ohvD})L!ViKay6)i{!0tPoaIBHZWBc?JmUd} zo3+>KlA*8m08>@!={n?Hryw|BfiZ@&wC+T+9^)!EcM?i|Co8z9mo)+{%7^2j^{_-^ z-a9k@sc!c)zC2AIrY@J>`%@sV=_d}8oYfS-lo5jw%cthixZ(_RZQHqCyVM0-^$l?9 zb@MfQ{|9n1*K%M#ji6)F`O|>mc=R2E-VT!4Eh1yc;vYY6qY2{EZY!DtSk-_Kop?d$ zs)|q>8q%h-81!{~OpW&+76H>jB}czP2}NmG`Dwex2B8xO5%fT?DiJv-S`hn?lYK8% z4ir}lG`Z(qcvj+mg8iA1y!Hq><2><+WbD76mKK$J$C7&xBoI=P1hY-gg{N-E?n%Jt zZ0?7E?Iwh6Hi2-D!Iwe>AV~+pDK!C{mOu+oHO_J?Fn-Q8bgXuSo#2rorjgi}>AcRx zGXc;c4F))6JmqUNV&m@^63;05dvtVbedofH`86r<_AdH#kwwL0Zmj>ok(D-CxvMhI zFS90St2rcu{`K)3ZN!I85xZyf0H`>9`%_w|E9ArYHL@GlxIH;yOk32>A=QP}AKH$& zI@MnA;Zcz-z?2e)6;@e}>ulXuI$q@d37gx|6Qxq?{?cF4a}Wk5N4~&5m4`5BO(1Lg zwjL+MS9UY>dHq*)S3X5#0P-uG9%Oz5*`;+@F{9DJFCNM=g)@p*r(yhqtaKqU%g4eX0H`)O9^5;by3Eq}^V z(?+Mx6L@osR1xhQ9SH+jf|c@m5h}(?lnkLdkS%IM&-x^tH^}H}()@egEvcA1k(t2$z9DA*N5c zK{aBpm03kv`SRz4(o!-?i-mzE8 zW{*C%!l~9_Qz-K%y|C~A>=E7ksqRp2YtqDYr!pMyY#6?x)Y+9xbjty-48u5g&;_ah zDbI~uqt2PU(|Xo>4Jp`>Z}9kxp#bmoPHqxd;NX0l9fTXJDt6q_-XLu0 zpO}1*r{d}3z}Wknzr6a{LK-gn0lwy*7!px4{u8*-D!>1rc=@g={#3STg+14v!djOSi`v{mVxj)Ewe3YnZOhU{uF|1+cwS z=tRS@k64#4X{;xN4fNwe+xm2iz#beX84E-qPD{FGjBc%&n*yEeito5Oayy~)*oCm& z$_cNh;rGz5aDE8ngvOZOQ)Cw4^AjxPuc`8o+Y>mkT8PQWW9|1`MXD)e<#k6X z<6vJm+tpheOKj*7(*J_r5`3=u0c(#9iC<58A98MQs(RjTdEztFzG!v&%CH=wN++UZ zRhdrvht+9_TkL48Gm6|`G!n5JfLIAf|KWrd!K#Rvd}Ofcwf9o>vB9|b=I^wEuTQ14dm*(>qjP<3SU9y_rSsu|HCOysMs z3mu1?nWA~XxQD8OQq8I)k!@xOrDt@unlS_z_wC=07*N?wY-FJsq0v4y2J05lUrQhh zS23>;g2y8;K>GrLr9V1iVP|ZQ%#2Xqkl_o>r_a&qqvubAeNY}U>fkAHC{C*`o;VTY zx4XPtddX2y>c|uy{zEE>{z_;PhfIh2;hL~JKu zY8PTdrG4f?6cJ58TODeQZ{onk9avxsQKamW@6TL{#GPc=?4BlhR8g02hb(9eee;!* zo1i8@fYHunP1o?mTSI#l zJG{)`kKh%)&Z6hvN(P^J1a%J=(@dDpeC_1^On4FI$!Wd~vmW8UHu;qx-{CiYBmZaH z3Dr6Uyh27QI(s32HNdVQ^IB&DM(Y9%x-;z>T_KyU)NM(HlI}e=Yqb8-9FUZrDiQ+G zq4F!PcZyF;izcf);AY%CSOrM!|H^I?BJK&KzB(H2LQD+P^(?CK#Cgz@V0y+Pjz=$D zRQb0nMBIHh^-_Fq{0IYnx)#L>N)gkm3ZG#Y)+R)WJ<+SF&)HSGE&30^IhgcGRy9V# z`-ix~fSqqeHb^7Y^J$cbZQyZX?g7Ow(sh>VHpm>Dk6lx_<+hIH`;Eo(zBk~_Ceq+3 z;vC3Z@7shY>!JaYvW0%^8t|&1&GJCw*hujeowyj5e%?)}2VW^ik7L*8$<$6{rJ#>YDlM(FPPqb#(p%Q8tmvBelDnmBT zkHVbYql@N<+qp=JA|&yy#q~s|sqoS)sGeiP8TYdNx7?Lt(AIxE{E?KQ@8UYoc#yH1 z?hUnVv5+qIVFM8RU5PaBjr>YE7ixzimU0>6a1kTsxaHSGQdjPm4*2rZ9FsYX=7p}- z_mdUaYd3Uy-L`+wKZe|aCQR1`M8!=?f`T(z_6W>=v-#e6Neu#Ch=dIf@Hock)L9tG zRdk6f_WUe*TJ>`I;NhPh6L_Lj6!H1Su9D3j%x75~E^z1+k&b?D*!s#8RP6o5ZN9D^ zF4X}vD;Sny6DG3`0N0L5nZcWg6d30E7WRG&SMjY&y@AuOSthE z9Fh)?TYiHa`)%+i2iCo|?=KTv?S^S@cGQ5U$QEl2y-IVGB4XS3!Lzt^)b5QdAxPKx)UXDQ0 zYss^kZ6wkZLtXypyBl~eiSd9mQ#NhrQseTARM*c?{COAn<5^j;c-{8K>OUHOmW51k0biN}@p`QoZ z?C!UMW-97=-0~ZA6X@5=nUrKBpm;OQw zn+G!~C)NmM5NOuRO_yEiM&r(RCFIUCOB_iGwwHdlZR+>ezyrbBw#wl6ejSwGZYC{v z&#sy$Zd^JvHQH8=ofTfLaW6}i!ws@kwxqCHu1dfFq&kndZ8*2-o3w1GZ;A_2C6$el zW+yvl-b>X_qB@~|w}baw$NLum+;+iAU0h_2aO$tj@yv&^`rVp4Eb_3=0-tr?1gBVf zn3)QNkK!K*p&CmKfu$d@n@tvxjmqnP4P|xty1d&T+}BtuiLRuitlR;n!9Q1cWwSoX z_gF7x67lIF3R7L&wL`#0b zL6}<&)vzEi<>A%CwMOjLzaE{-G!oBK(jav()l=$p;cUbHVsN@42l--cpdt!A{rRw1 z>}17I&+SN#6V99;w1l|ypGRRUDG`DvLl7eh)MV9wMSvTv*{2dqy4C|{g@E=WB+4LM zwQI3Xw~JvpI2Pl$EqLq{J%B>1eaHN5i`>dFrw7s0ga4PA=RxYrU8O=6kGbwQXem{6 z{KxmfV>Dko3*6#cTgye^sd=GlUa8tyIcH9a5m*4Gc$jmvTRm4`N+N0V< z+UP=UDbwCO*LcfoIxeS6y49fb?iaM{FCet^c;R{;Q@6oC?Wy3QTPl3o7!u{l6);F< zBK~|D-li!bHF7v)AMGZ|-5^De;J{dDWsTG%Ju+R0p6J*Pn`yr;dwJ)s#W=I**8$#0 z>X|44W=7ja)m_G1P6g_Kg-5NQQZ2=G)bVIZ5RLUVjl}~LS$h{>8^K>a^TdJw%kpI@ z{BdyrS<_Xnp=1d;Zcn|cvI@`(sU3i0a+*G|8PYh$Y_V4S>V6|HX8pLB z2p9p++Wd<#v*bEenhTsZ0gv^i?`?I!xT9=0Td3b;NxPy|y1uPrlZw!b^ z(cZAH_Zzm{Rvez$&7#KjRU;CnfzQw`QXO1Z832wQNG&>j%-WM*cK83EigX6Y!RX6t znxd);DCuchUo-QtyVkWxmFSJ#=sanLz0V(WtTFwk6fsR=Luc7$&gyT4S#s)3Yl=4# zww_~Lfy;d@r4%xecC0QP=jRx0JVrSPeE=#F-RN7=;LMA z54lH%vn?X2M9fWrG#T@2c36i;5Zq)!A_m2(}sH>ar5AlRluQhIWOX!9B}bl zW3#q+be(?3{&jOw-QXWij%cYyao|2$ak1y`rQxM<)EI6`mtQ?zUWZ*4enKC&cJ00i zE=MJ(oc6U}kC4osj=gJC}~OV6LK_L!$TVs~qnt7z9M97vcbhyU(OjKE=2WLd2K z(W%W9fG?BK;6a1rb*+pq&sp_1D1-Hn|FUX4aYn^NJHXdIWEK`xc1P6lZhmxB;#~Aj zeIN_{K12j_(J-Ag8qyyJLWnwQXaL_09$8IvRdr34NB`<-IQ z!rcFkXDH}SQyMZGHKD8Lq1*s1_NG!-kAMd)n*T%@7IrYXGLQfcCOB$_HzaCc(sss- z$QVe>T&!r3107wgwg}dmZPvKxpVHdA@~vY!7JJC5=ww6YhUhjg6hCNPPL#qE;A8i_ zHOhq0O+P37al%K%wYi=8dTEt4PRt5v*bO>OKVfOZ!!E?(!;uD2{fnI(PMh6;7-Dpc zF|>qX%2J@(JMl+GcL+B8QOUT|CQmOru%Ap#p_n4H?p#fQwPEVllQXdT2-Q1r-;CsP zKKi?rAcR=P&=zkrlm@aCTcQhgqT>(D{$890T=H6C?V3iAH4yzu{VrK3w79|409d~p zxKp*FXDM}Vm%IhU8QA*!AJvK%s_9b1&iP$1R4Kq@G3`7G)GhN{SVekVRgiMwTbwbn z4!JHewR}dskx5#-!JkqM9?9kqjhM8%EG|c{^$Sq`#l^ljG+C$)F>P%LnA6f4XAU>J ztwa?2;X;EHv4%EoH`dKVCkWJImN4GRHU4Cr6U12x{ zdkP;aZ#d}CJJ>qKcdQsG7+3l?lgUrALzq0D)9f#8X$VDMf0ECFGlsNt zBt4R%i={m$mY!*2$G6wsRdy1?uxcw-5y5+1X$%^V zo}x!&ML@3??DP|Ti^9+YI?;UdllPCy>Sx|R7cFXLLA@a7LFe-vBq~}mTGK|+rMgly z-?P`s!@OHr@o%N%#Ig+Q^?;zZH!UMQT2hw8<0-00$m29sn9jONIxSkdW;Z3S5Ev#S zhJmHWiApP1xw|Ane}IXD&}+kFKHVQ3OD&pmkm?ox6z+JnlkrI6u^LqyrCrAU(?4W9 za8c6D*kZ=3$R#;cDtU28=7yvdivBW(npr;$vKn^I{F#9?)wXB`uh0JFS2@*2^e zR?Xh6em=1NKUu<%$eYzUD~Y?d;T#yGcm33!Gv=icGy#q)^mhl^K7ahbDM%QQw!__D zT`o&Gh=Vmslw+omF(LY*zu6xX%ueYit(m?GX;=bBBX$uLI`ZBTwMJvdW4=taW-U0c^f{-_`HL$Q2`ZdDG^bLju zvb)uKfB$k(+RYVz@5gr&6tb3a2;^Ae6l`rbsR&8# zEp^C7(98d94Sfy(gTzzrWoqq0ShnkS|Di2edx^gHMCnq>D~be{7*rKsvO!k zFyQzO7^G51+cvwP&_Vqv>c0s_F^Fb&wdL3K{Ot|Di$|bxqz2FPJv4%Z?L|cY;j?Sa z4p2GXU$;ZXdp(R&IlkQlM)mjsy#xKaU)Q)+Yg`Q%nSpsoQPug!b9nS@uZwpYUvCCE z&h*2`%xF->N?yO6&CPA5L8JRMzq&^(XN+bH-%}@tDwDsEQ&fG~dEU@uw@Oo{6f2!W zOYgoD*>KvYpA&;`c4hoF4}@06z&}0xP$sLTV3)Y(%R;BuKuKOOfSc0OZ#g&<50Aqv zW{B)n9vRLjo#|TvcK(bC++#xz%uwW&ghhVM4GGRPG0tR!NHmc}50B=@g_ud*-SW)x zkyuXlO%nmo-J=tcbz;sge~*p$g#}Ik?(+dXn&j)2*+L6*DfpruH*7gSTmz@r35ye)Mxl!6e zmz+&*p6)+nLK&~}bfe$M^!dEM2eQpQEEw*!Wc;u#wU^hTE^q(>pZsHMR*?N^ADY$% zhTwVUW?V?iRv@hq68X?ZkHOzHu!o)uBS6V<3o-uh!UpGl%sI_{%`Ohe!(3A^waXUk zxW!4(OsiQqT@!AFG9TSMHLz0re?$4*3gUwR;(E_XlA9Dzv%0K1c7YZYa3&5jUf#S=GIsh&2>+ol^MW*vKvAqN< zif>E8+^7Z(JuL#di56948u3VElOANA!#uj^>6-BAyCp4XHdhhuxMu>8qQ8IfV@Qs=VL5KIoAjI2MvpPG^n-^yE<`^UOi zSY8#JxsehCf+;&y?*9~pz0N8^>g zCuus?wHAfEtAABe8#}3msbd9I(>|?CN{iKZRD8j23-YeBGnnO<8-zXMi6+AxZP3Mu zuv#-Z>k4ojVXxTb=9=+udV5yyC%E`-6NJnt1F1vT=5-h0-DQ2f%zxfwo9Mzzh2%}+ zcHmQ)bh}JqBC(~|d=xSN=EP^!T?`lZMCEc+d>8kw-tP>JwPwW2W3JfR{gQ~aCaCF> zOG+ss$U{#k1&;b&=9GSdBN&i9SLM#{O!KTGgte~QvVs;0q0cIJmfmd8aITPwTnvYC`vF^RVX0i)z8!uoZ@Ng*F{Sc&v((uB*b$f;t%sE| ziV-dBIV|eFekea+`bpLITVc8gJe~ejrBa!x(p-zb7Edde0$qs`+XN_ z>R;xvg+|&y;4a$uFJ;=3iB9!4-FVs4^@XAdhmNYF9AC?0=-pNk)T2uTg5h?^WKTxo z;!n%K6u#W70yS2*ff)(|bOLe3E9Nr*aMxz<;vG&{7UHZK(O!)$M1-cn6m2L zDM?8RDXM~Ysk`D-(Vk1OjNW4;CTfWZNhh|a60@#WrTcYn%)<(zze6y2E;#y!YcC+K zHubkR0OoOISL6|a>Y>^4ai!7z{ltv+q6uw%6x+k!l4lEt38ncV7RsBBOP;dN!& zD&TJ;Yu7ivtF8In3hiuSy>rBS&0}w~dvZRgs{Z{~T!_`Au^*DCUGTU=IJ2jt^%K^h z)Cg&)>P1{|q;!DcXuYZrnb$>lzlTE*wgQfmXFiLUKWN|%oF7*DDmazZNZklQth<(n{aPNl(cwi@5+w+(R64lZd#Wpkg0cB6$U}kh z!s01Nb$7D-Uj3vybO)|LTQNIcal*5qw>%-#*weuDd>DOt_@#*C`mop9lsiQ-#>C*F zHty;o(zi{nq1o8~sS;L>Tk~X!bvR?RPDm#pe4WW;DwLYX>H{vN>k z&fyuP&sS8^464FTJp9zt zQ{UGC5!y*kL9>c(B-igR*o)>C#%Bqr2JT*bteSjb%z3-W%?~7o*4&_v&#_c1zc9w z03Lz@QJ2|uxyJlhEBQ4Tv8^X0yAJO8bRqH@wE7(BLD51O<>UyD*m2%V9+{YeIbsV2Gz<*U5l+WOSX=^%f;R835y#H1 zE!70rI!-JnBVji);(?MO>DQ{)=||gKDwe~28YDj7FprWi{^gsR>3hQ0fOt_)yrYz` z`aF`tkkPHfx#KA|zSjdROOjwn9AQ*8zIbJ$ob@fU&2?nGM>i{WuS7K;CZU00xOz)j z^^utuiv)U24X*a9i$DWNdoclJRf(YPS&-jJm;o+LU#4cSWfj&L$TduHO;MTX4MQ+OZl^b|u>grN^gP_Cqv{{k?M$e@BZ*rIDsm_3pRmIa;Ty-B{L(w!=Bj1BIK`ma*Ak$PMJ;ZYO+w^tlRiE z2R+D@4{;Ti-Fbf@N=5%UCX>Ll6*f^k3$*+8CCo_H=YAKH%X0$ncW!N*y{h^y8dH&G-R{K=3Abz)3AXg5<~5_$^GR zJN*1zFQfP*F`0fTzEP!SGhXg*e`|R$Q`_C+?gugasdMFuPc8((Az*U|BYQt)3$X-$ zVT|+#&`w~U8OP8}$h1kcf3-P8)>58AlsC?D8)92s30A1bij;b7*g+77NB*HmyjAjL zbL!Jr!F@v%DI*rF9N(E(J-`-bn#)}wib8exu7%E}`|pcAj_(T+d!m15divg?bg}j1 z>i`7dM01xE3|D&^=xHc@<`K8e43QFj|qx>G2BK53x31qn)Xd7OTg{n zxX{I4WQxmnHY~F=w7#6-wL$?acW$#%-&9sz)d1!DBKEX;kuII~YE<|u_45kNqtKP( z8shgi70LfiMH>7^MS^`(k>dZOBJGU68N0x47??Z?{~k>JD&Z=ZY)G>zk8;-{=s#ne zFiv&^L&#Zti(2u+{Ub%TrIW!B4_vw*3QgEooa%O`7G!Mk_J{~HG&zUVVzVu;tevg> zjl55;I8vPA38`tk1s(jwERu3!F$e0e&r!qNba|%8f!eFtl#&-SmBv+Z{);FZv<59Y zvjXWZ%}dp)r^!N-*dAU?n#`uY)3NlS7F9}R;jsD!S&C~4rSc{+8?EV=S_dL<5(s%1 zzJuC}wyZ23SD9xCFLe=fOBqV4@z0Kz$1N;T&Z4NVrFHgC1}|T>v8vu*O!tzCHktQ>wPzr(^TNg>lAMbt2*ZaAUpZ)foKhD4{_JeDoLBJ=H}WFp**= zNBF{d*k`}ATy+g+WJOtBkzH+wm;57_G6`0W-9H$m_V!E9HQ^t`1fA+|uM#ycO1Tc} zh1CuDJAu}0bNie(kG9LQ`VhfISt_81zxuisTuH|k4OnqAOR0aaA1Io*idaU7w%%uP zNhrX27nIT{}1zy0ZGMVDfU43b9)*d7^ ziTT|jBoqc9xNTaD0jeJ#tYn=L^J^FjVR3-}8KMwW} zqYa}pskN%ucXz>*aQfV518urCf%7`BGzJ zPs=!lhgHkHF^nikP%v607@wHch{1svF^gGJVWTf_9#VbUqh}N) zZXsJn2JSHV&MBlvY}z&BoLD_ToWpM5uQaD2&JUr z9!XFdDwU^(53As&nVzMarxxjCak$%rS{|k>%wbLeVV}5j7tlwbHl%isOsxE)YT&d6 zNc>Q(Vw9eWk{8fLS+*8~KM0|r!?rsP#3?~P$(8Chi$nnyYpuHDjW>@gU-&%ESOI-v z2Uy8h)%JBtP0qz6dGJqlKqW=_?(zc#v408kiT1pfK7aGAgV6)?{>_u-&v3*NXBE+4 z-?hw6#7|7I4U_4&Fc$8}K-M?`U0!#KL`UEc{-ORTZ9Nu#OjsBCX*nys#frypwexe>{0O z49L$FJJ!o02-jC#@SGfS+!((B6)fs4d@;6=Piot{=^M@;{Up*3M_Q^s`|~)^TS#tloh1c*$oVY^@WM zm*uLV5cV)w2^;_22ZZSfBI=j(0;jG1C??$$`KaJ?Ihi&-4 zo^prLKL*791#vy(!+I|gHG>R;_*x-?wiqAWpNn0TznprZOCsI{q3uNcH#N!)LpKdl z#F>x_QMUc_(cUmT`~=exe&hP=*VmcuNFQUGp{T$yeDo!Bnz!Zf)*f@?F%*RPf2F*q zI8RklTnI}856sbF=m&_fyw6*Al^4$$c-3s4M-Q#AbXGz~u9FRnhp@FTO3%R z`e_3;qUI35-=RVmGEHVF z{p;kf=4IFuULxujSnuoA#;+oR)~qJW7hp1WGKh*vcI2+eAxIrCIU|i!)S52q0`{A+l{@j=PWmFFlUD*eOnRF;jwAiyYD3OZ#_n z{;=Pb8zGfd4ynzuzZe0`q6`YmpuFd;{Mw>BxEKpug*Hu(IZ8Ubu$xh?RR#rR%({Fk z{9`I_FvBU7R?^U1KuB$ADaOTAns91f_+o(G+9rNK4 z&U5|*iN}_>e9C;t(8WZd_+kpcymgLU6Sw3SIg7`jJ5h!zlfBNKN0w&C%LJ1w!Fvip zU`2L&i=xF1uoO$c<$gtdoxs9`&osGb_kc3BV%&h{iM_-;*E6+Rrn8T#nC}(DK?n5~ zTu$g9S0Av1Nk`c_w;+LmYEl20UdYK%Z-YQe>OkAg1R!o1Nj-5=eyZ!=tF0?oV2r(& zVYOfim}BOINmDZzdel7}Qk_$9r%truS_$#wr%(i_W(oA-8J zBB5KseH->88$zD#TUJ!{ z-n6AOIiTl-hpUiX73|Tqb*FP&Is1uI?RyNidWt2A0Buc2M@C6$>Hi1y;xpMmcQI5r zDr}kmZ>*P2|KD2BcI`o)&RJvSz@@u%WhEWbgQCjU@9cwrDs+KKYW!BtJJr=Ku^z3F z_JGh`9pM;&%<0kVGs)<2bCX?b|9C?Ij}nxCpt2m2OYMnhP{Q8Mr-G&JvQ8k zoYIQLp(x6@TD4?U)6J#s5L#`nuVqEgDX+*UnlKLRJb(VP!b6rjrzz*7XdSn<+I*a< zU|+h>wAjcm>|mz%8i*zDUlZka-{2mt>bVJ55`^U6)gh?qU?K~wZnljf)q|DDbp7f5 zR;aRp@X?cy?;{b#3e!(6XHuuoOFz377ny%XSYmy8!4Cf+Uq)7~oBvzk3+e+vX}owu ztc9hf0b?TFG-N^}*F~)~H;~<3s5yZ9e8c7aQ8I&*+T=<%_m?QQaox%j`{_D_4_I~o zboULLYP+EzWEd+;+3<&s5R^hWAkC+>G@FZmr zjl;lS{}a9z@ASyIA&|vFf|}_x66fdS zoCFU*uV8gzQ1uU0UVM4G)q+@pwJY6cQcFc&;==kQgI?R5&#A+c$IBGe2jv?MR+m$6KW@g`uKvhgQx?WCRN%*$&aGAa`qHgCzjAbX>7_lu^&Uw} zV2QW$w(E!>UErYgzXM;V>Ai~6=m(x?#p9O>{)pJ{k(n4NrPQh1pFX~@S&pvRXp^eX zy!ATSmCVS(gzFvqPKAw^&A@b$=FjwajJOx}Cn9@1ggq^m|AD?6tSfgEg3J3{7iGw3 z-eP|bL#2OXhyNGwJ*6Nmq#XaZCk-2^Gfb4JE(^HWqDI9$uOaKk#&+zK%6&Lbd6IBuuPeY7ambzh2gt@meC9SaRc#a%_-FY zp+s3_y}pIOQhs#}y)8fA+Dk?H2um&KJBo6JTu~)kUC9IU=1FTv@KQ;@UMcsojbd$F zXDC{EXPnb<_2wY3MIA}*R)t@<2 z#qj}JD)}7Y=u@>Xya(qChRvo%CNV{snZS#FziK->(?P~Y!tK@r4lF8!v->AZi_$iu z^Ps?We*gZE-uCi$_&wyrTpGZIO^b1&#Z<6DHr~)x{)sW=o%)B47&pVJupdrrYW4p| z_(FY<%rX2)snO67@nP70&)xTn>h?8Ir@*&j{!HyTmE*<0?s;2tc#W+xnMJ4&-)k&2 zG)f!9Fqdh@pXjlYJUx7k95ExsC#_%In1U-~r4!A1D7Mb)7nZ-ip&gJK2N@D=MOm4l zt*K^_1Kj|s3U#CAtX}!s;uglvJI8o;3bB?UC?e$&=n3qgXve3SM#Wh~?Dn2e>V6I@ z9)VTJ?s3DnpJAs7=4j8N%l7SgoT<6#{+j$*#xjqWK}$tnmn`Lsj!N}91eK+Zv4D9+f%skmjHq|x zZ8;l%bO@{?AX}b@+X@Ua1Amagdi*Cbwr1^K`RJ2E-OWr;U=kW=SI9lQS;I4{O@aG2 zz^5!8u(mo?&#!+Jzud(fmB_i$K<|YiOU~0(ol~F8iGLqb5_0A@g%J#LXr4n^8`o0c zR(3B?c&B8J>^=beA6z^g@al|^Y*D@`>!U-mx!@Iy;)`qcc7Hjqg_QKCIrkDU)<@(2 zYvwE7qUz_Q%Bgarc-oENDn1&Z-UgHSD}*)?L3-w%X&aI$#585 zW{K4HaC4@~wMCsi>Ud2W;Mr6|K^SQA^L{?x#+;&x(}n~)m^v$90d8><_9SOBKIV@j zgC8N{S9e*HhKCcr-mL^vw89N*8I$zgKSU=?xoxgWtDRyYC>G(MDR}f4&Yw`JY1`m+ z6VJ>sqXS;gjhDvAb3gI)om8U^YNkrjenJ|tn=Op%>rkRS3}M}X!c zih6Wm#h;Ux32`7{M?UQWxLzM6$bvYvLC{jP+_}tIRQpVMA;aDv%W%_mA||U{v{AF= z_6LM3%?YIFXwFIwW2eTD#-v|AUD&NMOJ@X^J{0f{QfV*G39g({E%bCDUjzy-aGVIm zQ8>1}z3`H7kMh;XaZ$_T`yj|6|Dejdag6T_@nN4;3ibOw>>&|J+$v{C#y_lCCP>Dw zFqb+NEvb|ShjkCd=I4a;^Ct@q(G!`L$LGY;ydna6_Bh_2Cyk==PZ8DvPzRJw2)e1K zV^_f`W5Ldr3N9#7_rNHf=Y5$&1{Qn)3i`4eva#Z(%rIfbzR8r!-trsZB_=nsP2Tw` zM_BySWrYHn3?zF85lwE@Ri+L{#Ht2mJ%$A4B}_Px zCOZy+c2G{6qW*2vNY0Fttn@h;Co~}zaIyGM)Yt1XQ+g*J$M}9l&F+o~9&Pt~_yC?R zx~segy5+J$X!eYmw~+jajEx~Q{c*92s`~;V2q3A8ofMKE<=g(-;N+$Xn+1P(NLcvi zc1EY3v&4q>3-?8Hi@5gumiwIOX&wG9rrmM?IXPbS0|8fIYQR`}4~9f39BL_wC7;#n zMBZ%!SnQ!Tae6fW03k-=@*hyv*~b)TjSlJ?*zAkTdx+II5A-f&KVC((=_G0n$~!f~ zC{WmyNHF@Ve&#IepvZ$)+YJS2Cn0cNit^Y$51W!_ce2rTRx!@ox*L9X5y<-Wxz&$j zZJt|^eT9b;fv!h)MK(7wtNfY52Oba#i2yp}LW8rSgPR$vb|iPhP2x z%^90H$7I$on9OlKg)LcE6k>6>T%~8x>=w)>qx#^5sto z{~o*8)MUO~(v|9b)2ztWPj5N`fnPuEY~zc{TH~-kO}yFw$iVl*T@&JTnrdUwWB_@e zAMXj~bGvy{NAmam`VgA5B1!ecU3K9gU;=wSO!PN52J z(NJ-y8NG;_Wo=rhlJuMU?7`aKx5#P2zW=o(>wbYBJgs_n&3d zlbbQ+Q10^=g-RT9>9NWS1Uh@Qhp>w`5NguM=6)zeLhmo>%{Rsk&#X-}sjNf?Lu?@Gnq@0{(S<{kYGVO)s&RsDgjt%6{~`N9f^pMGiA36X>R{=|H4(6 zN`0Cg5Zxj;9w_ZoMg!I{O2+OI|$9KD^-NTYXbdx?kY? zGz-=JN4>A&7x&tkg8pze`t!k-=88A0W`x}BQWBOK*V7vOgWDCvP!)16IAjr?aAM`> z>a|#kNICP}k9%d5+oSU)=n6;S8w7j2aI$G|-K1xGL5q0(7)i)E04M2~mKbT++cJQpUB>oc-4#rcy z&u?p*+Mww#HDIYPazcuqWj^LQ1weq@1{IFk!~OI7TT&uIeDFnIq$#4<5KvHDfw_*jv_wjW z+W%lG@zGOez+n0CSiMDFao=JKChZ71Q45t82e16+u^m`Sfr06Mt|+5)Q35ZhD)mqL zaFJ{Rd*QgQbUX)4@ALZ+>+{D1H3WQTCOm1Otc+qA?dJY1m)~Zy={4rpgLE|@h{EF` zPjAT_1&HJ26Q}PM(Z2-Gdl%+IAp6`iYfUT!*ET952iybWvO8_Zxt^{?QEyQw^naR? zLyBe;8eZyUw_UzbMaRp9mip?#>}y0D@CAwf%e3!j;r$*Xwp0pWW(HQ0S*z=fpC|Hr zFKd)fW5R+OPhnRZe<9h=31dV#KKj>LM?a<9S+ru#0U{*YTq~g}H!qJL=oecc#+`zW z+BHYAQ66>Ih%cs-Pt z8iVj!k~t0KrwDsjl%a{9d|7j0e$gX-g|wl5*(SP8_$Itz3rC`*p^KCpgAhk%G4+kp z0a?B+qSBo5sJ)Sq;_QTAE2HMWQ>qF8<|1Oa{;%W={k%Kd!2iD3qY&RIALg>GpuBo?oT z1}Rw&+`@)g4s`I2$@{z=k$kZE*~9b(ny~&01+J!iQCXrOve44*y}oqIYMIylJTQGi z18@R07kEFXEa$>$(sgyS5usDV+V#|3MQX6eK8i-7x33Va zjUxR{tJr^-sx)5N+b;`0w;~6vwM!8{f`kk&nZJp2YCVh=i6~VYkVD0ri1V>w@q&BU z8j(ivwfmF=_9iEkPCG@=q!TGRo2VEWPYz|;6=$m1HGkjq>H`I4U`Ud9KM3ZI8s})2 zv;XC2NR+B$h>T5zf?!8!jhfaj+Mv3(^`whP7#i5VNMo}9!>6CZb|1|d(oRFbzO2`@ zxcmTP6@d=dj|sGycix)fg+|ZECOh_p5I^}Tutky! z1&a55BCj|u;2NjtRviJUL;`pJ@mbwH#zYDJu zLr(Sd>|;^q6EldH@Q54|Q%q@#!fn=W=bZsk2ncY z_b<0uIFVze1%~}qAt8Z@lNx>Kj-|wj0GPD5lhp6@F4NTp?+WLq=-yx)R$E^nx zp$!69tl^&I2VBhq%B9nsDt0;d^!%Xl7wYk}JJ;;?@Va}k$&$UDQPJTd+gO6D4 z)T?88)J!iZ676ySKKJ>VNT?oSCk)=tWj2qAnx3@0QuCF^xY&8YfaQe2jQpu@b8Wik z>yICwF*eEZANyFG|6`ssee2lG;b9^`wUv|R`UAUUQuR$FW7&13@~TVy;n?dH@Wn}v zP9`OMI-T+Zj zFA%3+%1KwVoZViRM#b&K^t6gNQtWXlhQEpJWy%E-f=(ZU6`zh-;sTu083ZJ;(-FDO zdYqWsE+s~=WU|-PMQIF4xyHGizDcCa^XU2yzIqm2YYd|}KG$qP_$VviaFk?|Lu``{ zgnIGcwBwDHh5zDU#xgZbLVAnY6>=gK$G(9X9Sc(=O+HCth*j$X_041uuf-W1u*`+J zN1ax|%gBzH8rKv*MgyMI6?7y(Vi)zv9w*Ii^Da3G!DO~=t3bZy%#kaO*<0l(_+oAB z-&a9Q3+#xO;oQ#z%iQrT<*T~(U%p4Fpn5h`cNdvPciM)ghRokCAPbcr=I72_rr%2CJieiYXzPNrl-5YS3)O89T%Go(eG5;^`te(?BYKbJ44gvfdk&Mg!+}@c@gnS4w6l#Ib>auYW%5yx1UmFFb zTY+i#OkG(V9;xt;ymeJS1jvE11G=)J(BHkSVu|)S`uOJVvUIgj*; zbikM~n;96wZimPSf-;0hH=!0_qsf-)xBa|f`>Gt~VAzs?;0nw+aT`K0xbU6O8Yj<{ zS^29VU}n)JuFs!Q`Kf`Vm!H)S%$wmT;vOGRyX^=TZ$_i3RR@pghA?HK8YeEi^|;|} z;_MJ+Khpn7Ax(WzzP7(^%F3_7W&y;3VELCx?zb{f0Ue)QenXmC9`@gt5V==TC~joBm+kMix}lq=0%fKl&~rS4bYlWLe)f%zWf@W zBVB{qQlMRan8CL~J{s1J>lO65?ZPqmj^^OFL*i=!AR@H#sZQRtK-Bxl7gz})IC(jC zW;!4KoCd*C)p%aGp9p1nfVbQn^*wiG_P@0*g3dZ9Cz^REWZ$;K%Ho9AI~+uzfxbUu zS3K@&K1WETnRDvkWKOFb(6Jdkopw+?--LFjHIrGNO?-J6JSLBem@Q2|dj7O$mS*u_ zxyH`HNP4qBC-$uO_+$^u;cgzDRgg81>RjhslQp?$U*S#gUVU1Ez|29R9IQL9D*_Ez z?pL}shkHG#b*a2oQT3$G?!GXu#?&BXm0AlK({MU zKk!%PGTc~P+j}z?St*bh!5tVeJU{0BAqun!0h`2e!X2&yi)%-W{l}Z0YkV9h-*|gm zO}=he(LV*TuNC$rUo0@N;u%WzB6bYk#_zKm%UB<-i<8?G`HZ3*`5VR`W!m~*i%OM| zQV4D%2HJXSq#B!YH$?C;e^+QG@I}u#l181osS5dEH zI910j7$&rd@9N25L$A3gjCQO_bIhDQdr$}~Hu_ddtJqxO-#$;H3apNWld;xducoec z+n_jS&D?+d4tR5wy0ndb52R6SemWp=iV4@t99?Qp7h)>p8fhLU;!t&q6EN&2Waj+1rNLm)_)^rX}g3S*JAkC;Tx zaqlUQOE5j}_AwZ9SdO2g+TQ4|-lHWuQx@eWhN6xI0M(QN&U1e?>SeQt4cYq-!7@3y z@8`AVZIKgDaL<%EXbufvZfv(1Y*2-#5MulY?Y&ZYMGgZ%96~f;;3fW?Q5sKcM^UrWL}L>G`ii zh34ZE&9KZBx`Sa4_qRhOV}aFXx!ffveqkbl<%D<%vH%)QqIeg5>H7#V3(n>(-i?dh z5S3K;PvPH2O_8m0bAc?8go``I>8eETw{%bfcXKH|Fa7Z%DtoC|p(VVu&CgJOJ;@Pp ze$?=Uz;Oc}S9>}m2HZq`4Azwg_iKf1 zMHeT4AQ-q(%wh?W4it__Jh16-h<507a<;h)_1Y^YvszU*gl*`JYB1X09?X-LiYW^f+V^%gQ_r?Gw zkI|i+^XCOU0)1fg4Be4p%yShT{RvXPQg}}jY-~KT_3m_RFu7Jrl^!W46)WXw3eXpR z%Z^45+F=#>FStFVs{TG;v_Vt#&eHPmP8+QEiB$qX4A z$<*j0zx*uSwsJ$!ptGEMmr^Egx+{gkg4d?Z+nSMEcA*0vKT zOK&C7YEU(w(2?z{&0EjP-mdr-Y?e|!MCpvPf{K5<93}>%uLWN$j|KVo`~7*}=Egb` z>o8y%{6Q33H81{X2CoIjWuvtVhpvhP>{jJQ`|!W^lv*87Mt(#Q$&^p1siw`Pt4_nf z()nn6P}29(T%blMw8yd1kB)VJSkl~BXnxXOGuB*JZlvpRzb-2aq+aKKti03&r8fdI z2Nktsh)JLR%YScU_sr-qP51mLvvAhA#>O4bODA<==J3ThzAPAKo*%|ir@$2$fwWNL z?CZ$J#7WY}=yD-Kov*D{!$>xW)CD&8^Vu|U(MNxgz z2^`8^&aYfUA)zRqQ(Dk(P`P+2bZ)IfbQ3L?JfrI)X_<%Hf@7)ZcUVSQJ7)qN>ca-G zgKt1ZE@L~K0fVlq$e#lC7w8$oQP-!GOzu;iY1>O!0l-at1$E78d4=V&_iRGAvXcnY7+Jx`5zIaj;~Z3Be6UCS?wCNdl6*9n8MD*rm+Q;d6ADU*nbJE{gp(l(sTbC=P zBpm&}-#r%->J^tp02LBz%YfGrf6o~wf#f#=2jPZZ@clV$*ag%6G*36xj(=2}*AILr z=297GsWl&M5l@n&5l}4@=$lHNuR-YJ(x6H2jWQk)suc@q<~8?GQoudIeD}k5?vx#Qe;sT7Av9{VDqE1#907h{Tm(3ZEv`@Uljb7vQon1X z*F(JXU|E(Wry;#mc1aBEJihJv{4srH4H%v=?|Yf*<`&Jm`^>RU6TPal*sc|W2bq)j z`VPJ3{f;Nx^Wvd4X;d1behH}bIe%d&rzL(KsdQXI&-aX!3^3&nP8R4miAhuQF%2L3 zGVU|4>>LCHK>R+-6kpAhC*C7EGsrPt5d)I5p0O$SD8#*zmj6Vmy6pWoD|s6jJcK3F z-7#22O$S7U1@Ocl)>VZ)Pd@&qs3q}Ys~rM&S4Ua{HYhSiCVd|=Dnq)RCDn(g>07*G zh8;S8)T}&NP*n%YUkvmRvXj`=KYaQ1kklj6FwWev+J^-1x!$b$0P3{$DJWdRTP!)Xr1Zv}OMBFoD{OpNVm#VV!7!4D(}DUs z&}r9_d)TuuVT_y=qe(^MsUul)Y!W7`@}Be?*E2O_SCh!iMWAE@>kfe*I{=>|1OyPeNN3E$l^!U_53xe8{%^SE$dwR@k0JjigEmF@hV zU=!MNAIbl*2VebI)h43NvzH!b_QJ$Kfeh8n0)XTweMHg>jOxI(`7Z4jm#RSt-vik~^3iM|j?Z59HE&Z^m&&Z=U~ZbH18pr)sUQ6} zy_~-+brX}-HF8;u!G!3QcLM@VHtNVud{@F0b|cqVDjxNLR6wpqxVuX!nD}Fg4hlZ_ z{1aUD8_?P1-$O2zW3B_(^RCl>*|Q(wXFJ)Q){X0J%ZzKT8HRgfBN~wv2pPo$n@y?k zrw{AOQuJOM)}D3U9=*=&n4Z)i>nU&vSWrLh69_OEv~RC_;j}-gmMnY=gf&Hs_r5DO zcZgX32RSLKG+W-_FIOFIRvlVFB|-@YEO#0}`*-}Ihnul!vcC!Vgrr*_((XL@OlHnL zP4pp!GX^HKLAo9#Ms}(f>3ht$MUHq#Roivawi`$Rh29sD0eMuxT6HZI08a7DHsbd$juOnQo8;OD zGXyE^@H!e0t8&jyY9P2Z1kf;-bnuP5Oj_zz0`L=Vj~YtKoBg-7MjN3$_v zBBA(C>}7y@e^SzTbMIQR7i7sfYrN=OWK}}Dd9}JCfQCMMVhfa9E3g2DVYdrMrh|ii zI0@pPHw_2b!~*Nm_M$N%ETwQNg)PUwjjxbZpD$T; zjIA6k>lYW^^b1POqQG4H=lw?nCuN(vu2ld)w%QZllre_xdMzACl+M;mPu-WBrj1vh zv@2;e8o~L^O{CRUMPU{+3dGf34t0l89r*#WHDCLJGT+!iM6ih>RtGiF*RE|Vyf4sA zTLoH45DMypY2vey4=}(ZGyld#RYKK4Cv^(#yD|1ncoKgFUz!v&i(a5|LUt4CMuwSw zqD~a9KJA*_-anPYjl?!;NkkcMvM31}YLEWFtsrac*AKv^&I^?TGPy9&slDJPEc>HCyhkk?FYeny7kc;k``8sD092re3 z>LTiXj&dAcdLcY20F8`G6WiLyJ(vLV{tm`mdhPc2zotOG*FE!D!~#7iySzct?4rI) zepU9!z!Mu|<5*$1$nG4lsww%J2i@pfFbawd$>D5#ZqZM_TWuCPq zp19_Og*`RepybM+7j&~tHdi@9^V$X-Oz|R$;B`^nmZ9!B^%AbQ;?*u*>~N2;R#U>X zz`Y~xF_8s`jHhW*27+I^n8p(nND=9nu991FIPvJbZ$@vZ=Gf(QvxhZ2OLE*XasQA= zJJ1CB8L4MCscL_)QBO^SCwX%mA>zFsx$%0U0<{r zfhdn&usb4#?VnyGl4TaMA!7+Gr2Ch(=wFO2yimtFkN1<8?CwY|2k3sv4P}1L(Z7tY zOkn(2Gm<)KM#CkKP%h6gaR%0Ucb*J%q5`Um*-Y>#N%6?+bllBulBdjjp-$Q1CS;G_ ze~+tB7y3>;^lKWrGnC@pBTuGGp^x8I2J)eBrJs(@i8Go#BqmTbc~8q^9^Ju$G7wJM zUV<9(_Rdj)-&)zu^wbDJ=Wt3$zEqaL&2%QGjw1STC~>Obr{-~x_$BM}m*3ut|=RI9J=5m21NznP^9?pW_A4R}89@ zY|ik6I}>;i%$ReyjA#rUV(1z^mp*JmHHa9S;2ts_glJ@=Dy)er0-+g}Q;{kUr5AfD zf}YY*WgbF_tx0LsqxFQt(u__EpX-(Fx6si;z<%YOqOr$x#xe;L?4rPEm8rk?nM2rL zDR-_Mve=XU@i2zkwAIe-po7sa*GycfjzsOj@q$;8t&xdMAJabV3oUVH!eJ%IE^qXA z0uJaG!rA#ImZ7vwFFhP3ql6K$c%6sE&bZ5`X#Ja>FZ4%qcBTV_kj@2#sjB>*QGH#{ z*q+dC!xFep1BS&QV@J~ZNWRdMv3h4QIozFrww_1%9jV!jz!#u^ zX%|!QEnno7pVo+%D?!N$~c z7%QC^&O^B+fh#fj^U5R+?yllyw${!jWiC`1^dk3h-D#^bm(mH#{woRv%#?^9B#c-n zTj?=i>ztTlCYqZX`Ga^HfSLUlhS<#j&i0>>Hd!teK<9%Krjx^Szdfz{m+7d*GU7k` z94u58=`yAUG-_G{^PK5+ZThUPHLELPa%36DmnaWQFp^9=+Y31rq*QXhFwcy(AG^I4 zRu4U2)?yZcaPdEw2d~3QK5c(5k1IeI9*aA@WG3j#&?5Gkr?lSCoafBk@Dn zagRB;DYrFU)&bhNoy+SJwS#GrO>MEzW$I{EPpDV=pUShdC$k+V9^X*^c%LB3J!S?O zd5yqi?I31Neyn3#f?!cNk7bNT)Tzfun*H~>gK*f)VL3GJLNjhu(<#&yg62Wg=e9OkE@^Ej;(As?cgk=Mdgm#^_89j2KHJ@AaD{V|prIBx|UI3u$w zWuz!}ryPH%cqmUzIowR164I#B<;hArs$Y|F*DU6~5Px$UBCM?!-RHtwC-FMnGvr|8 zSfTtj<9aO`VA-_v_}Id>GTp>GC^?g)i$5G_uf8F*#R&ctI32wnHze*?hfVikFo4?R zU4ELV{jkbLqkJ9|L02jK8@{R9$+{4DkCx&M88k-)AW=`>H91VyLQ4CofDPuNH@ zM8LNLDn3C9wIpn|{hUUVbl9X!5LBe3M$@0x7IC!Bb;Io%WZC0<(spxm*+@igb+ZK) zboV`8eLPtI`#EF~BoC5*?tw1=L!KkIhpRrE8?MQS*rb6X6^E5q3-LySTUbqL<`OH8 zbZ_jqsO0hXkmQj6S>-(~l!$jMARevl80PjAI|$U{x#uYZSXex@&)d(xQQk}Ht00Fm zIb3LL9|D`RfBo~X|aC`bq5gi>Je@f)dol(g(yWY_R2D*~66GuDue$F{2 ze>~FLd57L!)H5bq$Mr~Im{o;Vbd0X@iCDU{6)P&qQc~NZ`$Xe}Y}Uedp%ZvM&jCp| zV@;*xFM>x2zCte__KzMSvI!(F z{_4EiY@Pkb?9S9aHE;Eo6t8O& zRQ$1Evh@33o_CtKd=APg_taw5%&3Ozlx<=4AJ2;l&<^9riy%MoPjQ6uY@Q$f3^x-6 zOl{Un|H~${Zrj;&O%dEq2%KXWG!fZtU3B}3t|h%uaK)zTocp=&drDr4)#OmUqv%CX z@yeLrdGETg(u%x{K-Tw)CU_4e&+ArdeHiy|`y7t&)PT10v1=66vIKv6NMV7snK}yPJhLk9?W+Up zB%l#Jk?kk=j7*)(n%fWX<@v@2v4D()HS^W#lgqapR1e%F&R%=5B`WwYU`{)Q&MJiL zBs2|=T&-c|YO=Jxp2jcFtAzSU29TpRJX?28t*xvA>Wd$2R%dQkLvIY_VjeFD36tGpej5N3-Tl}k#FK|&n@-3NS2iLt3 zf3pD{sX*j`Htf152JwNyT=;x}Nb2iovRZR@jp{7SjEImjY_$IQ&_D(bC=+oGek=p~ z7AaiJTRiU?tC{Lxn(!VrXMz;=5-bhuV<~$fL9u0qT)*i8?Z6b>+LQaK2tj&sCHA@q zL3ZLw?&<_1y)MWB{c!s7qmdD0JlN8Q^(r%}oe)5R+v39%#%@A;K=s*Y!NkJdsv7Mv z;>vN?^1^`pOiftE5E9fFT7|#`t^@x2<$3t1;aQ`|8W39KH8|l{N8{Afa`AicVLX5+ z6JUt=@}t>;xS;Te5&C^R8*ZDO!+&A+h%;7x`;9Jtci!ooc3rc}V7^6GSImm+MT0EM zLqT45#4c7ew78xTEwnseJ>mQPB06d|D=)_7k^ojiJq|wBTmDf}e!I^@MutuP$6?5IMruCXA5dZ8BY`4kiFCkmMbzV9 zNa9r!WC86ta2GxJo-vN2%E{gY_7tn}#DQ0PX^<-O0qxFw3z| zg10g)3*SR*NHW{yw!Ug}mzo-Welrh_)<^4<0^^kt$Ieaa*$?Yc%jMJpH`LT!Aswv_ zEhYB?h42;lm_JEIm#{%!tM!C1pArYIR(QWToK_?ZqLtXu)ghbZ1SfaDB0L8LOctD2|63{rsy1VwoH0 zP3;8{%^Fm5gWGo%qaeB}tJeTw3%X~7nE^_BRv_siMzfV0e6kv9&3vZzYRjw){1Sc5 zBaK(n;E7Gr%H&H(9pPyRuZvI069Pv@jDl21+*)+(T^-Mq;-z$rvD6g;bRycoF5=dRDWu+ND>=QWRw*|~G1m%q z)ZfE-2*GGY*&OkcZDOwqgi8ahDJfaFwsC8euV*OA*G=Pm}?f1Z@jd&nX}P>bZBNeu{aBH@ZLAv zY^ke7^=-9vK6#Oa*9D<%9{>SGXUTC-D$aBP?2{loU@)leZ$@YTddCohJ=HLAno9lm z!PK-qIA_jftxcMP@IteGQAIv{>XLDrIn*6$KziRCArtpa$iwbbk=xb$H;|Llv*~ZY z>j)Nx|3~|jKs83*jtAjdk)R-eHHFSSxXDx^k#iVloR|VNbt9pE6G22WhsOC@>>Hj) zHUc-VKdcqQ9w&9Qu(3MZt)1eU#Dj|zv9p)ZZy@Kq$S};ojcdRbRsL@vXL;0rft)1c z^0#`gU4Nxc+UFs+027D-KnCol-V4Oex(o7*}_YJW} zh<$yu4^92uHM$Cmx#XAVGDc7 zvu;;qVTgD(_=f}{`b4b><7^usg1O?CcXlyOtP4Q}*ViNwzXrsqV=V>d*ug0UJ0vzS zjjyx~M3G>3@8>#Ea_s~@wL|&=>;>7>vz$mh#PsKSo}{SC+{jhvr3st zgr!(wM{V02eeJ+jdg1or-PS72CFL zqhi~(ZQHi(OwQ@<>FzlU6^=M*{ zJj9J;E=~ZcUE&`a#O_X6BZtNRv*P4PXK6GQF(Q;vV2V}%F@Hfv@;{TDr9Vkd!Zp-x za$q_H{uLdcqJ+6ADWQ5_NOY=(yP7krS9V5?z)DjXb-4lrV;R)FKhLuxC?L~A2=wcY zOick!&vZeg)KiJv@h`cxA4W_&+4vfPi}7KmnX~$}HWBr#9QKf0CSw`pXud3p4XoK+11@nGEL>U zrcR9KIp7JEImde_EG%zlACErYvUF>t`2p~Q+SW?f*q5oRX_&t9C+FKP*syCbP?6tl z9Bzd-ynTsl*ON=XUlW>3NtqG}GpFWXpY}QdD;>EQZ(kr6O{%_BaZ>HquWxjzKOKAA z0xs9aalP>=runXw7kD)0`_#0z+0Yq5GqpJ-SDrPESMaG~ip+;dOt(^}AS`dp;hC@C zz>KLf#w5Z~GRyAYj3);=Q(OJR-b>%3*?wPoUHjV3yUjPz!yS!tS*I*0VRur!9I&8> zxnE2CBsoJs2DR3pYS*A`Ce&vY0J<%`S-!s3`UfD5x4I=$jytFIIqKx^vk&$wH`g!77ng>N{`;*CyvGR+g-YgKZ{l6(EhRRM0tO^5*QluaA# zBpJL%B}A1RoPU+;h69~6Knc_RE)~OMe6TBFQmLa~NM`u-ud-mU0J3E@6&Eqn_l=gI zMit5_z$9z)Upvbj1aA%%)rReFQrFdDl(DRRs$o8&YNW9^rzCaDO&W&5RIxly`kB}p z$v0|B>tPmr4LZpI$gO0~^otfmhb!6nz$n&Cero}vBPYVajL{S3ong7ck+GSY+~`~| zBIYdQ=blniYcv}()ePwo2#-KKP2_WdKPTwtE+p`pKp8>HZ39lU@M?4r>b!EIyJ_NKASL2p+p*3PACt#-X0ovt)-_HKlv!{N+EQ}>7poSK8H#Vs%#zE z%_mp%W_VOFQgi))uIm^9TG=9J%bjyqq_%f)GMCCQu?4}$$kqIr*xSNWwtje$>x`bV zn2Wz?5Q}1}GC`|ej7X22$WHl8TS*`LtLk}jqF6RtCtr0jQbLvAJ}O87(%bn5U?(pl>TfyUa@vHV?erj5z2ceRWp~|XQnuLCWbSllHd_^^T(IaTP?Jfcm z)*F9c4wK;~uX+{&3PEb0Ut*irc-!kf%Hi&5au9Z?CWmv75q%QxV_E=PL?YFYR z5xq8=fh>L+gTRZkY0rlIu^x^ELMb*N#bG|AxiKE5Ftp88c%F0<X-Z5xG6kSdG?Pk5gJW!<1P$pEH+G;tyvLY>3RM*R)RWZzlK`B9*pAjdajs&o| zZ01~%UxX1#-=cH5H6h_CL84QdeyLy#uL>wSziVCNnc4EI2#cAtbJM6W=sk7Ox~2!J%=K8@(;&c z9J=^jhj_kib`-gb7z?pN?UW%IqF*+Uyf26g1QSVF_muV%(QT5zvNDM8##txL3-Aox zz#Ze>tMD(t++vUuE{B{d3h{{1yR;16#3sg7=^u4Gs_%VB@gA6+497jFOl6?1=ZF%! zv5z(M!UFwYcGW^Eh ze_H*?q2ssqRTtt&e~O$u1XdbOdW($1wGTvWIM;R4ES(rDz0m~=_Stm)VyUU7F$yOS zX(aU`Ty8dj^S9hgB zZa&P-3`H(*>~A8a9$%jMpVh5Wcu)fyTZfjx9a>?JU( z*%2E0`O2U5C2AMBZ6J}|m7T7fDa-AdD7;6%ZrZz#sf8Zkx7`H0E)-~3hfbTt=~%pX z9b$?1-hKZHa6wxD%_L82y~Zie#Gw)hZhlQCaFzR?P*_Bute9XJ5Mpan;;*o&c8k2roUy*sNpCYpPpE@ub%< zL7F-(6&b}>bu&8JkX8h62yDfClAE0Ci^QpzScrtPwVy+lhD7MjMx zpo3_j^Ym~W>NQljB85lqKIz6M@66>_5qkD=CT>Hg#wOs>(ZU{5AE%GZv&k6`t&{9Y zul1%Dw*QW8KT3V((n5q4hH$Y^M`EI4P6|K8itGHYGM^>u=R^Iqpo)-2ehT<^&&*uo zud;?jN zxT_FyXB!n)D>3~B`jk;@#Y8A}OqP@-WP2be(QR0(o%%Koz{?EoGEx(L2=}fd!Czkz z(w`cq%K4j?mDNY)`i{%iZ^)aLeyIzm($25-BxFF~aUk}#(Qrs)DAJZ}f|7EaKfCgL z+Q6%e*i;KuUOX&tGK+QEnR67ju#z~d?N}M?gd-Zo(L;~;5OMGtAu3IDWocEA!)?+m zL*-*YRdXnA$f-XwFgq{y1C0uufb6Y>5nsTbww5V}z>W9^K*Q^^n9kCxB9SDN0xt8} z=jcnM=q6A$0F_8iYDrb~Z9oMTV>h9Qp3wFv8ccdu)i!irPgg^&{5&U~^fm*2sFdno zA9m|@%~9*?w{vL*06vdb!d?Fn<9t^p07j87a2&0k`7^GyIVC9)N_k1Hs+$)BMafsL z%by+D)?H4sq6-Ao3SbD7VGJBTOtf2tv$Ebq3TR2zff&xNo`fI&+a<{;tmlJlf;K6e zTGruKjS5}}@Nx&t+_=d?#|zJ+;7NB4P%R*CsM)3|kf$b`|0FLbGM`&dL}Ap>8_cI|xq8|bw&gvhAM*y;gu_|GN|$SvuQ<-ix-}09>mDy4;Gl zTmWd`cGZV>Ph^+!qmTdFqEp|*gT-2oI4-GYT*!&(?k&jX5I=piViU8fdJ23~$he&V zDqnuD0X8|iOl1Gc&Ril9dIREYLbzQd&`46E3IhYLfPbr~DP$Q{zFz~a)9 z?<`!}FtqE8G`#3jyf-zv&E{9*rCU8E)-AceWE=zukwftU-16Mdy# zK-VCsr73W#rxi>m6@BlnwLB|k3EKQKMa7Op1t$vfkQmgA)pEtxRq8%Bz zT^vDo0NBfy*BPjwXtlb*7S0kdY~P7LTDLoGg(t{CZCTPjRk@unE@2laF$T5>LA7r9 zfVMw~v^%L3%w#ex&i4o@Q{bb(&_^)-vyz!0M;Khq0fy{|j)2(9;De)DHO;Z|%xD$v8QabaB!6?EBs zwasCT30*(ibNT}CuKUYSFy)+?!UfB>F*bv!QcIjnYF^E?0nPyJol1{pz_y)qa!^{M z1=3Z=J+&8zRX&N4GEIC{A!T8sqkj5^rZB_BWnb|P!D+?IhB2`ZbF#*;le1}RsV-|f zXzuoxo`pa+MuS)7P(#To#>T8@({ghCpG#q_`O3Gv@UQZ29btEIClf>n!?O|211y%n z?buXnk68_e1}sqhO@S)c<)l4MG;8@jbi4!xCG(_sVG%rQ)2ov@W7agl2XzG>Ku8YR z45y3brIQTp77NhB)i9MYddc(mA@}V02<^+ZuGY$$NTAL6g7v=?8x)?gDwz7?$3VoR zzhC)%bpA-Yj2UV);q_XCqs+6+4YgM_9NHJ17ot58E;qR0Zw8p_ttr~cR1Q3f(o%8r zbA;IkS=5X%RN7-DXIwlzy-ikB%J}hx7WTfC*eyi}&cHI%6pK{4ZiPiAF556A8=Ew% zXDoyX(}D^(;CR4#0WFi4J?o5`Y4Hq=n5zOA}n zqmkHMekXrg?Y7@ySR}0lXPoY#2)an=1H2`yEzIJv$hBl9N0rvtd<30bF*N7EczIJV z#(UD&)e3vcbt@Gh+|G?&6S(~45aGC&dD_doS>TDt)qpH@qP2~-brjKw0@`^lA!VY>tn>aA!RV?==rn|fIc0u6tNK(%s08HGJo}x)gsD^wT4gil zyDQv2BLB)opXio3SgaB=aj#sQ+ndUXTUM0cmlw}d5oHOV^o|R`!3~lB2SrAx9e&#b zc?3s|V1oIOw%c_z;%E~#h$RuT$#_Z{W|-E!OFUxt`JiBb@HGDGMz(Mn&UgjJ<%sCD ze5-2V5jf8A+HlSJ1m*HvN>s!)Zo1{*ES+F7sNM(zuOW*5udo5Ke5$r$9(mGkr&IVH zH-BaOQ(`)Jrg$s9&J$G!kEkNun8Dl0zS9)_F*)5L2$c@Gp{|;ZHhkwU(X*>BhJby= z`p>$Hi>E9Iizcu}r#+KO)Dg+uAO{yWLDCgj8|x?4d_^56#Iy&uKb0`^ioZ)0=EivD zbsifM(+l_;BB{=W5QHY(_`+VtC6{259U7i*!by7q<)d&21&}h_qZV4 zFW?5=pDJpB?T4iwZ^|N6)tk{M_y?F-%D&|+cl_Ddl-q(QSTn`J``E-LD^v%0vHleh z!wCtsf=6N3@L)Z!h~|kMTCu}^5O{h6PB-CYMi1hJsV=>o1cl*UQ>qu zIJ!I{sXkKC-IPb*XmtX+m8Qb*OO6@*D-eyDV?O=hJrWqs50bq$ui>{6xTBFQs#maS z+}#^_e?nEE4ZC_33|AUQqwA$a^vb-DqL?Nd5bxIPDQXy~Y_|&!39+}Xp)V4Pd6IG1 zx+Y~mC4EQpU$tPCQn{rnr<`NbgjX45w3E6t&`_F5ETyokc2PG}&jHE3bJov`=7`F4 zfmS?~#5^8qGCP<`^NaolpFQfyBa9%5&syp5@>VKb5fLI)cP|%0^aw12*&MJ;iS1s> z*|=&JM)jp{sMQ?NTp94tr!-L6uydt=p(YEYWt+3UmoEag0b(JueS!ANr`B7zw(S#D zBx^dQqg$2m#f$aKQ*(?PBFA?aSKlp-?^oXCk{-cj$vf*OrH)zh;re9}*pGtmL+e7G z)C~I}6PeFkD<*fX!xO{y16E`qJoh>pC)8rNY#Nhd#@1)yN&%3zNHoK>y9NvT?}U{VKUL<^#H6xwonZCX3!U48q=fLiVIct$GZq%4=;$8-#71V(tq@v$4{ z2k8zU-S_B|8g1vsITL7H<-)&3^m7*0QmzWCL<|&KxUNcb{~n>yWo8>aC?&{|RFsu# z2hV~b0+#+B0fg>3)+){Iz+M1hf31KAot^Q0n6FyD#kGZKsz8o|e^-mL0CCRIhYLwr^~rF4i%HM_A$QO*UWA*=4x_jGpxuq6H~d=Ati`;|=`INb1J!=7pM z6R_>By~>frUdt-?s|f$Ot}$n?B8oZK2xR2vr_v1dT#0Ds$*it2Q2j_KM+`Y++ntkY z8%QasU*I`P1bXH*37duKqa-D!YK0k3wanQcd+y{cpP zCgDUaM;K6O1vc!!6YyoFOc230$ENbAjV6iRzVb8a?k4Jl?)*`FnW{DZz9fJ3s<<$X z*xM|Um7@@=(Wl6*Eh7;M)}JT>D0#0`uXhDh*f^Z*2eqPij4`~vOw2GLty0AvlTCPO zB<-Oz$}P4A;!J9@qw8VVw07hl$j`7L zxNnkej%joRlZeEhHcl7phnqV5IX$hjmy9doxYby{nEOdi<@`P6D~dLi3ozNF<7hj5 zW^~|tCdhS~yv0jPbhLoiz#y?VOK44+Zf^qlOF7}4&;DjtY!vD2er(wI=H2Cn4{M44qf8VZ+h} zc9SYc;GAH5O`0TWd9#v4In4?zVeH-ecLL=uTD|z8lgl{d9%riIjrcO!A*4MUZ^>=n zo?Qq_8CUpIi^OqQX1-&R`MhGSL}SdK#dY!0kN_kOl0_&gf*o4TYveZOPwtp=XYqpF zui)wKlenyAej;2#9=R>wslI+4#3n(K&?-vaL|Ls7vAT z4TwkeVWS3OH04rS8?#tcu2_eo4%pw6`3&OlR{ir)m>9dJBrnlDJFi}TKIvI;KKAp> zA;DRieAx@|SYtIa=+^t_m~ZPjf$;BXpkH<#9ut%|HKJpTzB>>q#!q}`xPc!A0>KIn z4s?I%S&KQw>cPy2@OcE+xc>ijI0iTLe#^`r_|l#Snj?qs$Z&tb?qMWyMmhmg0&^cD zrib8|QLB-&A!#9BMKzcbxS5v?w5&!X3F>g1WkNBkk5`rjxfiTE zRq%?gDT2nyH(3|AfQdkI9V$BwsskEiJH(Ffvr{O1Rd~NjGaG|OrEaad{=AmkU3$VV z*mv20D)alp0f24l9Z;YMvC@PcA@@T`ju3~!%B(KQSAnj{VtVUuA3Tz|TXg)w?^&=V zja}-iimGI17=b+3Ou>^4>P0_>jFEAuXEtG1}U3vgn=ho zpo~Ef4ah{4ktuWbH>2qtU(|aw8)bjhhK28Y_IRjJ>rI53(<`bEfS0d+lbM*}>X zK&R?q@Td@LhI?bhLCsj;{}T{#6X~*@arag|D<{K+GPwbliam>QuchX_7~!~$D5#+o z%bKcn%pSB$0xL;X11$ifrX+R1#-5lEbQb=(UJ}0XZ3fMtZIAlzhDbmfbF4c{!v`v0 z9|9W4>!A$hR|OqtFHv??z=5RSXQgSBtaV+Z$u5L}gIE3Qk}ba3I_3B55E)yO{gW1E z8u0zwcdy@S2ObaeV`l-%LAc6=V1M%eP(&x?)x$|YiYVq>CR2*v3;w%UFN8_2;)5ZY z<^}&hAW@rp3lIgFjPn$1<+P&FhhJChdg?IY1sy!X-=SAWT%+UaS(`J_j!cioxl|_k z;IiKc#N}g{3%f-h&HVST%x?sE%CGTHH*rF{ziD##+PwPG_!gI4iB~J{P0s}d=Mq6E#(vbFc2*#{S+?HeDPHyAl!r)S4U(&!rDuL()o?5g zyq`(NUmvFCszdR|85VL0FmyAIF&!7XMi9A$;|34)rSz$7Is9+p$l4FJ0+|m&6i`CN za8EkcxOF1P1S6Ml!mkldPLN=p=aC?)Q(@5`iQ*22Ujyqg(Z3*k+T4`j1*TJj9>%Dr z&Few?R5y{R6RDJy@|)5t4K>3bO4@}h5-@@4SsWW`-VbfQcm`Z}22~t`s|`Bh=@^e6 z5(PC-ms?EZLlNgjyqW~o`1itxb~j{hEH>Mh4K1B@;!d7aLk@(vFTA~!cf2#{Xi5!q z3<(&yVXt7gsJ6F48Ty?iai>05+rEW~BvJDb{Sw5TD2P!NT!B1g>J-}NMi`6~Y%r>B zG|@B!$29)`&5q{y32Oe7%sZ-U6meBxI-&DJUA|Tgq$-g|pHB6HiWU_@hzM;m=$i_$ z7=kVv4kx|0!bM}@K5i)0l0MD^WjR~KZ_W52b}bJv!syMkr@D$r>-*;N?Fwpa<(Vfo z6#2q^^8_GWM@L6D*?-q;;kjjN$ms}z^l*=H{7QNy5RVBzJwNxae-TdmS@uuxC! z{;4;|+PxzE@9bz-*IcaOXr}eXp7?5IX#&YoUk7^fv}(E*kZjg0T+((@Y%lp4*8FzW zx(^WW)U(I-W+dCb(?Sf022gA{mQ&dP+t%-pT#GF+QJPjtls^cqv_Zq#F+yw6p>@fj z_>rc0-*V+?1_L2}88KWdbO1@n< z5WU#ftwYky3USau%#=fE*z6#+P14ET_W6}BLwCj4v6A)kb1=o*sBlw*)|opj4fB2kcBzzoCH zCEvnoxr8HS6xaSfH;$4u-2J2pq6@Gz^#$m+(O=*hq~!b|{~rFDZ)Hon(DI_+{ckKO zXP+GS)c8ML(pI=|qLBIja7iK^Xprfa+i?>b-7)ul0I7nH7s_ydSHy8&XvQr5Gb`Sl zf$nR{)N}w+kiX$M<5pXuh?=k$Lk75T@SJ3dLryQdPt!FotE^cNX!bKvS(^k$m%RK1 zD_MWfU#KJFHW1?NmIbd9#AhAKk6JzInuhvpdGihV_bl0+^fJ_ZUkQlnzzL@MDybUqF#E*#}b8`CkYGQ(eXVBLLB8b7)8 zNO9c1nBzl-sTKOT-1&kK=ffU6E4b>uOS9|tvJ@4R`!n{E^8Izn|0`3HFv^|V2eX28 z00Bsh;Qy3^B$;LFlnee@wVJ!~3$gTECT>2%-o9{Yx)qW{vf}jzDm4`~6#;r;Z`@xq zkQz23_gn}dcn*A)CKNbMyPw@mScHY)oLj0WrqWLc$fiOen^J%kK!q#B#bI$^+W+rV zDe|1&n_MzxK?zI|%6vk_jo$U-SFB<2pz`RK49y(^)CsYsH%qnug&!$QybW|aKM`hR zkD3Y_SM@g7EcemkuW9Z}<$&i7`CrAm={k}IJ=8ZopZeLUJDv}je}s(_-=rq1`Qf76 z+0+;Dk*q>uA<7rgJX>(LKYHd_K)3a<4>*`^FAvZ8_a@5aH9rjyjFVo@65m@zXK4-T z4ua3xb8JKpOq#i1$52F_wlwvcMlL1-{>aHUb5Rx5MWL*QDG0%9p;}-~KV}lyE5*b% zo07Hm$v-Lltr)D<7lf{3igQ;hd%28|GKPcrFKmgjpTBG~{5h?|5!Q!|3DlZxx#weM zjgn58cFat5s7$XybhCePzMPN#H$jvr*W!7A0|lb25sqhnPtJ|pa5JxX0#pVmRK}YS z5k3{HkNS>9w<%OrK0huFeM?TZi&BeEGG}VMdSqQ>@e${Gue`}|`QZ*qO$a>5@Xt*WS245V z6@cQsCm1FeiT?tZl;Rf`=f+xz2Cz>m!_Rj`@MjryI6uWP#m7L!63&O&-0`n&rr0LD z)>@%zuz9oD$yDKCuH(C1tP5mFMiHh<)z#-M1+Xnf&#;o0W+TT@>w7&0yLkLLR+&wT zZ%~Xf5dVlpWqti&QTGdP{3GFjSR~_b1<{V+r4bN}kjsM`3gPim$8VRM5OW9NE+6>N zgQ;uxN#A9jU(Fv8ISa$&>lLM;jT47_?+@^zk5G7SeCxC)WB0haRNxQZ)1e;-%19Jd zvPG#Jxl)rHW~I;Z>s>dTQ=ceFa1YWR@~FcgOGJRdFd9|zlScCOzsRNWft5}hvhV>{ zWO0)e!=LpfJr!At?4*bI*wPO@V>~Q3;s;OyTU-|OKYO_!Z;QhCEPA=#fd*7;1Mes1 zOr)tVm+%;)x6VZR4R0??nCuXPTNLG=MWj9ALZ(oIiu2P0ds1g~af2roIZ--rT(Wtk z8p8Vc0$hvkZ05R0sye_JSe2R`&a45eSxcsM_M3-N$;Q_l>9DlYE5tA;C&L{SGBzMH z7{l(Gmb$*~AWGO_dl|m+f+uOiqDZ_hq*(+e6FCYZ4F>*Fhk`Vqe6fPGTES`7-f2bH ztK;A%V34WVEke_T3f6zI;ZWl1!~?i5yv8S*D9%C!Zs^9nlQn$Z9J$?LL6%Y&=@EokGRFWh{WqMQl*{D01t zo?1B8`dnTF39IRccR15lh&_+D_gWd-l*>O%xLor2o7Py99*X~~Tk0fR5^Neja?;V9b@byfnrLTvNHH$* zPv#cyjUHQxZ%W6JLAs6d`r7-qb!e5`p4v1a>kR#lsA!Y7Z$F?2h1M$9RQ=p~|Ab~P zPnimUB~yU*P1|kr9_2`#ICh=8wa*-aST%z7+`P^E_BD4;HR?7nK)K#=Vt^h z+s0Vo8-2Rs+0t!MQ6S|pqrsgQm!UN4@WAy0t{$)xCm-KlRSPe!`s=VqA6ngb70P@J zopH9ok{#~416vhvfQUjfld2jx=EWS$Kp1U1pKzfrj}ogIS%u)bqzVE3sMFuVgxW)S zS}nE#+_qC-`h_o>-b9}%c4!?)3tLv+_wmmIZk?*=>xo795Ge8aAY%cS^)bNgaB*g%x1%p<=NH5MFOk||v=_dNN6i+|(iHbj^w7xi03%1uDDGtV|iJ7p8s z8{2C$WVFFWL0LUt1yqA|C|=)c=Lt4jG}ZpTN4`mC;n%CwJ!U#d+m7SC+@Lj3dG#D^ zgY`WJj|kFKwM@?ztpPM&FKVrQQ-54BJ|%rlE%&N;QkB890=vsew2HAzJ%9im6T8<$ z_;fZbxTC-DJ~~1q?IK`uMK8yNK_>^R@{Pj4%Zi{cXDwJXS8xr*r5C{2Z|#*I!o@NA zo?)`f2#zq$>TFmWQmv08FhibNhkIKSFvDa~qo}>i-E{A9%vRp!Bvm|b7yw_1{fnDG z&gXs6#3Y``W^!3L1eE(7ZddebFDsCWv!-@G5i!Z_h=dou9*5Ja zlOD|wXe{3#Tf}qylyg-9=41=!-LXrsr6c;$Ay%wyxq1k4>0BOB0F5B`yu{XD2dEsv zZDF_niujdd)Onc1)umI4=8|ZYA-I8U=-2t0H#DRI`bPd5_L1Sm!>l}{Xa#4}DS2Td zn{#03B4SZ952;U|crvMWNY(f?$AdRd+0rwH#R0?d*GVGxTc9DlC^h9tC!#*kx%=l{2Lc*@gV4=vPQS1a=8MA( z69!(>$b`I2v#%fFv=f)7?BGP>nz_I?na85ZlxWr4NO%Q93>rh{gA~V((|j2V z-7AI+ttsV64bJFZmkFk`VHNiVGiAWuBUa*qBx8`M>%kZs1oXf_KeS)S?X5+|qkMN@ zo#e+acF*#*X`kxdpryK_Hk|7m3RbL-5F&rQ>|B&x~*D}$-*r9_yZa%q?NtM&xdi6(P-uRmI zoy|50d48ZNYDkGDC9>p{jWTQ+4DzU?ic@90$NZq(d}V=`cR6%;j&q0Or>Ekl3=yW| zcs(=+vgi@{?`5Fo&t?AE7R)tX1btI^0FkosspG}m5~D^ zd;>u~1{N%n({IW`rs)!~Hl;alZTNbTy`lMn21@UF#{i(KS34j|+nS9ZBQwpO%H>6r z(|lnBwNEi-yj0K|AJob1s%&F^(%=Li_;K&I-?<}pJ2=CGFbAL@3wz|GF_t}oj?j>v zSHo$^MACHiLsP{U`q#W0^7;1RXtHU8zS6?QmZ5wrAL)(WkvHvFrpNE~OfRkatuJXLy^-b_ zZsqlpuj+lydJ~>@U}TiGVfAz)P`>zLKrtIQuG$t7DE%uS;2HwraGU0h+urw+XAwVJ z=B#y?`gL)qm5}*3bh7z9YEv;iApHNDKu_r%bg;oBdAmGazNSvNQI=Kyl@xkYb;4C_ z#;T9Bq4?mkSC+w`xd_3M>b!%b5Z>nWc{`HbEloeRZ*Tc*a_{BhaCS9M z)~EwYa`A|va~+)&kwFr&?u6?Ty@n1L^(lSy^)Uu`Qk|*zC6~_SDOrQ-(2Q>_zj#I4 zj&jxl8>$H-^;<;zKj4V`vmKw5pH3NyJQ!%!Y6St)eg3Y0bqJ~afAzdgkHKby>)F?l@ z<<;0MfuRUwbhWVae@}#;X3O*OY70)*T%czH{t8bU4DWoKZ-$GnsZ@_=!$TpaAV|n^ z3O}wyyUERSn^5r4iB(jVV6zObt_2NT?BnAMpZ&c9Q-*Ku;i<)jF-i-+wg?*E^)c#3 zR%&7UWKq%84=YkqmqX_;aV)JdSR7+>D_1Q|92ANZnO3e-TLMP2!T}NRNxCuxp);1@ z33Ta^OATfV#DN!)@jbrPPCsmAXqM*#x?F3QewITn={?bOePKOQVCYZ@o?dX#>Tt-H z1E7SOMh-9(fPy>w{h1|dOn6Ie2t-n9(#mj-20g-+8a9z|{F+J7DJ%Dt+cuM0au_hf zE^i_T6*rh9T{Or0xwu<_U)C^gWS-8wE$pV8Xm&bC#-5bcaK<5!a)?7xyn8hWJxRQ~ zK=qDJD`8EdJ5gN*PX-_71T!C+yZU9wwc+{oR6r))gjN%iS)I6UF6HmNu^;2{q2m@vw z)&9uhfh|21wVZYgxpM4g3j?G4#TL6jKI$T@5a^k>gKjM=#>v7k^J&EVnQJ-_psFG- z;XYkoC88VkchKNbLv2&jK0=EUehl(pR#yw>M_dHAeXS_%)5xH)eXUQE^ei-#*~U3e zlghf7Wh(Ylu_`k5ncYI<+`LIJfRY=dUd7&IY34Vn#aQ`Qh6ju@VU7WuTVI_eD3}gv z3*BsMbgqn5YE~WH`mbguwpZpl1_6-kIp4A7Cc>G4>V&pol88=ajQ!CV?#mPk_sjc0 zx^z!OWwe6Xa|SD6#35f5_OkQfG8^LaRH%)e_l9ub$RR2tlS^r`_l$}ima&V=RZ{o$ z(t45mw4B=bonpbydKzo}X*%BI*5kz8;dno*!G2Dd3xb!H-s+XG>zrljE`v_M+Cc`2 zw>Q>6x`$n=*Fy-8>y*f0UXQ`2)5qyzx~}&wWEwO5o*cIR^oVcU#ESiz{qjY!?~|*J z540sbl6=SuHMWhJcW3(2ySPi9x=qoh_Yr6O)hoxQ_vzY{V8O6~Wg&e!o2xT=?L4n4 zh+k9roK;q1aq3x-_o5;AW=Uh{6j=lCxY7^ctCO{^#XnEo+NKxGLeU3fvZSIANi{Q6 z4IrS?&*dBU_!&fLeakI_**>3-32jAFXSuc3YNEId_FfzW+IxfWMhED&o*!26L#M%I zTnks9SBUBcBxywy0Se(@64^;Lfu3y3N*Jwf4-H0bD~mU0DE9A{5ecNzy;a&LjYRKL<) zWj{?47r()1{(h?!J_3IW=R?0JdgN&c(J?-9`dgh!-`GS^ewB8&L3fpZ%i$XLGi2a zqJF-iiKQ@v4bPtn^Odui<8NmLpcX$5!;zXOw;PyXTQvlD z&3#-_td2E6k4p6CZt2rfQAwcahh5Z0Jgi!)-x(Y(WYm>gR^ksa)78t}ZFO~o^jh>6 zftXCS4~tfN@%K)AKgl1S#=1-_brhO92&QEX6qiBU+eQ{)&X{eo%JgPcqira<;xwV* zJTR@42MH!i%5`{ka&b(=rD_B+C5J?va#H0l?=w4jR#hl6c9Q|<&BUbL(!js@!>r)fcACr237+hD>AQh{s6)ZYgQ*!(20KzRHt}* zi|_6kSKLRWcaquUENK9XYe-V1C98YOs}iGEQEo9GL{OD2!WpFbb5K%PUmH9c&Y|;2 z0*jpRkBXIZRJa;mCkx-ep=+Kp$0NACn>se_aDdNg;;&8^{WCv_bM#^89RwAN>7S z3NFp4UDxKD)V-z|C63Os#+n>GQvC&9N-x8GEJl20=Ub-+ z_Ey{Cr)CMBN^Mf@qPB7oxop2oDE+qLdF=ml0VU&EO7HkKafRFd}_pp!Y{EuhSn5dAxy-cGAKpZI2Cw=cgS~* z*09qJsh+_wk%qOI=z;Mv+~FnEeXiUc->r?KG6WPd>%anS$lc9Pen3c-;&8A=!HH}& ztU^Y0SmF+Ici?(BSOuv~fl9)E2-3vGo$%7LDTbHu&odDM-kL3yu2*_oc-yc*)_Fb5{B?Zn_cT;9guB!cK19r4!%Y%1(>D4 z3NyaIBY=o0?(3dEz{a13_)8!sN8$am-vHA_M zdJUsmgZH;9E!@GA4;MiU_(As#;Hyb{-IKj4baqzoXBxWy{)CH#0c;MJS7wIbI!`B*a9=TcuTr_6;W3Yg{XuHDQpF(8;JRwP9!v2Jzh8zH3Fk)AquI$J&J;}EYL%}NVd_Q`Wxn?OP=up0 zrYFHr)ux|xRfPFn$4(;pI8lA5AdwVy(|sP5_!^d{oPsGfs!xCb4-HYMuL|DDzLz0H z8rSjk?wws&6y8Q4koxHkQL7TM<6oy6=R8EHsJwxpTWm}QtC}$-R$ojTvke;OXVQ9T zJ;Wk#0I?9pDJ(BafG2?*FUDFlrp>?2r7yykDJ0P=g|W?3@Z8%7M&dbd!}7PNOyEcP z1x_3_eBtp(5V98qfB9`QF9+801~xbb=z20FM|OP#-?MmjiOA4p@x(cY3&bxGytx$P z@|>%XcP#IkL>tCQJHU0%It+)qqOIR2EeVMP;W|plJQ@?llECYCUe+K;5!`zyj#&Ha zWq%{K`^EWlp&B#vZjISS#>9^vTxP&Ncu8{}B{6F8!RU8fG5ALr;T4?I`(mv>^T%qP zR@dyzOy!ca-m0<0kW4fPyOA%7JbOe4% z!d?Y3u1f_(J~e5WEyoyqN}^l5uRk@>DA`YR@P?dqdOpvW4MH!ND-iU_#67lYtS0aU z-AGj2U!RvMl>}Jch3Ybi)4Gm6!heg9;ItbrH~TEUpmhtvyJ!La^`*^+ ztvt(Yh@aD<)EPqD-U@{XcMuN?oUf)eesLdrn-=9lYjbgV_bnRma%2rdN9A8_eWHCk zC(5QQ%=iBV7v}E!`AgG2OF}``wBi5;wuxY+zCdMIEQRzNe_DA@k>0O6O)>?UUjAQ( z9j=+O8!T~c!T-?OSE6PIF3wAka?c&q z?t>plza-a*50P=g>pF=i=PN_PymsnhBhm{p(o3c>>G$5IlM7UevcP z?LZU{&(b)CF@901b?m##Y1eI^AAau$FsWqQiO+?R`L0!MbJx115y>qC@ZSJ#gVsyp=$GrWEu$XWUkR!v}Wml-mmv5r@6@2 z?C3ku+KI{!)r+s6|E*yD^eiK8p+*E-@U`~<6MF$`0zyS0L)31lwD;!?QE)(P{~tK& zW9OT1;9q(^mY{I#{NHi;|KN+zS#xg9SP!h3{7EHx^xrHZ&@;&-EoCShr$!;9R}y4t zREMcI$lr$;Oc<|VO_sXrDKQX)L>v(pu7+z2g`VVrw*Wo>Q7Q`f8-;m}SVM4(0_1zJ zNVr|N;P{s*8xb9s#{DTZ@yvU`8jWxf{0SQ=Ec3``c)a#QlJEJ>kSv9w4$E2|ffvLo zpEy6K_qdYBIAItptSPMJZ5U?FIaB|il-GVC6Sn5MFXhRjqL?0`8Nw#7SOpL=@m-Xc z6&x4PFB(QDI4vLyM5rNf{w>ZRPyJfeA^E#_&%* zD|R^VomG+hi}J5JC+mvQt**u15|QG#bH8XqVLsDh`X$Ukbm$gY9DVW-mLe*b@;MU= zQxFZjNK*V09Po?YOE~@|%;$czJntdMN}KVWI^^h=J`WF!_tLGcjYrDSRq1 z;5~EKF~y^*U#Zm#z8gueI04=9dy(L|3t_E6{NoPEyhT@OtzjxXhTDlZv9q zDi!Aws$gI60u+k`CW(3f2HS-uP0rHL-zF&>mxs1dcOB(0p6?ug>*bzb@&e#-cyMsT zk!dM`6%js0OpVaSO?z_U&TUu6&Xc{7n_98#8R-fnyW!Lq#EM@WP4Z5m{2g1$tERNP84LnK& z{zX&dkuOdfSX#loW;L`Z@l#AOF8jZLc8B3&BA846(z)<(A@0~W%xe&N%h3@wKX>~Z z7ueqD6Dwmunv`3cq?W*YIN*YSbUtG_!X!B4e#gH5gfU48fI~xW1Vug11mBvmN~fH! z&l}UhY&|WoE$H#+s#9gSUE2`%rtKa=Z{G2c7&y%95D(Z-$$=*>66vZ_FE(5c1RCsM zFBN5Y6n>a^d6cpgw5#GWdRn5p#>+C5I9lhv?Ysn9;ZAd6vJXlLmx=ON;BG7b0=MdY zqM>iKRC6&R?45))Oo#Hf5ej!82!qV`rh3FQ6H&+Yq-^mCsr;LMG3DX}@!cw=F-mNjHQ?YD+FdtX z;y|3Hx|#?Gz*QLZ#E#GdyTg%Dv*%V*H)ZFILEC=c&91a%%h1%8YUbJ!&0K4lB6IDB zi!EQ+HJyEX4T}pc`EwDDG*cF}&A-}v;`yxoZkB30pk1l-D_@E@2NE>Xs>HG%@m9i>H_~J60ie1hj=VKL*aM zMKpd-)K2KpqUOcjjxCbXjUx>%Q)&ubac|g#Ue!-lfJ4zZh71K_&NNzJh=<4rlN?441%H$52=Aw-h-5Tzz>mx z_nIr9S%^VDIsVp5Hh2#Wu~>QmRx!M{5wDBPJJ`7+nYHbY^WzAagMRmlfJ>aDO#Cit zHztBcoH*AZFB{OvPrOY?KsqAK2ZI+C&2j@^q8p zzq^b{T$iO+F3U4L%{uywE+GOMUpsg@$_TBa*Y%kaSXGTn%dJHX%Tb+i_$r#?e2*iQ z*?$!X79!RS#u`^eDK~@oLzL7*o`vv-Vh26#1VtX^mgAk;zUK}oSt8|gN@4`n zuSorf%m)g;o)++RbQ}JFIU(DJ0;`x{m5keCC(FstdhCRy-;)!$)ZHvTW#;A3VTtCH z3`U9xsRd=JaHa;vFXItT8?FEv+es@l(%T*KZr0Xy9zW#P3k}tSPYPI)p;0HK4rU*y)bO3zH54SL4I}}<`~2&#FaMh)tD_Z zyXHk+P*b4^#t;<11v4oC=gZlPz2Mt2j{A?MadQ z*h>8!6eSlmkH`yLC4L-wh(ZujGPFjT<6wp1AeUjqgC;LY;j=SS;D#WmDHI!>mx>VO zd@5tbcNagy`t5ZWKf9R zBPwY4?BeoT09CLq(2AJHrpsFG1kDS?@rgFTVDShwH$@R`+y(Lt zpBNMF)EkgKZjj>Yy}Lo5aa;v-as^;FzJB5yz2tH!KRB1HQ*k%Mb6Qr`ygZ>PeY8E1hI(#A}G)lF8QVr@2TE<#{>IEHWvF{U-@2od7d znTW9C&IZ9*j;{C$dZJQ#;0~~GKP<1>NH-`UU$f?2RI8_`<)sM)F|P@LF9lJ$Z5H2U z?jc;CeM3?_01F~{rH9N&BC7XF6$=im=fid}osfNaf;-|MML^;aatY6Q^orCfnys$laUkgoi&?GGkMLEWwK*m}T2Ayp zV(&ZnB)o%=H=lHvb#;LKao$CswP2p60I?d5a8+8ytQ8x(y@!m$Sl#HDEWTazOPt0r zo>bJmQPW;mvGbDB(=kk&MBCKJ)tGS;83fL72DT;oq#*zDZd zQqsp@sSz3`>yVtsh!4FeDPW}Vzi}Z70oCvID3|K$IEZn=Q?6bZK^iydr}13*7z;tJ zJz)YAY5CIgAVLCAuz=1nr2xY#F}#yFv2%n65dJ}uyLdZX%P@Gh6%}PvR+NW>>!IG12MczTfh>&@7#nlRd~zsi`&N-9y;f<^ zv{;D;Es{9Ry|=VK>KFYK8=yL`{N zW6}i3fRmwL>B<5-LRTS&YH<==Qx(suCDFrbqe`oGhKlm_?m(WQoCs-2aVXAr4bpNG zh3Y_M-iFMULh{;)l)`4cN7!j6%~Q;K@A>4#Q?mWeT~$HwV5c2HYy0RnXpH_VJIa}5 zvph45*%v3JYJ0h&U~RrSL&e7NMXgg47i)?Jg4Tf<2>)?%K0o zUphx3-s;yXM)_eC#T4j8PRy4dv$ViBpEyq`fwXC}xJ@w8Ru|X`;1rYvbJy&x$sO*( zL-_vBWcdGE5hD0H+<5+j^S&)Eu0fhhs@=g%7cax=xO|e_^ZFuke40;V7nm5pO>>NeO-N|2%ohbE> zL8gHJg!msX@#2RfDo+0Tq~lD$)m`WVHl>}jOJ^N>n}Re(;sy^A#St!?o)E9n&s=IT z`^MwnS7IbGbpwqBQ4<5EOs$Fi`sO!Od2cw%;;(;&zfZ4T{`IdM{s6nci`u*3Zg&XQ z^IMwVQq;L_jcftN+!}|a>lz_2FnbfXO(KxuFP@KV@4-|y(;&seq=NI3t&ffE_xvXU8yW*#Y-k7K3i#Hfo7T!0H%GI zric4N(r`RX`w&a5$-qaY3Yn4aR!Wb5GR3sL*m;9(2g)xlh|Gez6es86T#vz|R;}ez;C(-g2LW&9zF?pzNREbdD+5sXMW4>sVh)($}Xi-0fNiW@Gf0~~)-D{9U zeoR01(k=E&DfV9Qm{rA_1(UUh0T=B>9J^xLG2hmH0aA!5^b1zUW( z^Kz?js?|egSQxejssMS?x}m$ZTWLRBTSV8X*6R&r!r8WkFKpX1^X#y$IDgOX3z0>A ze~Gn$#+1yu3-KbiBcHgQPrzc9(N@?&kyv{_6L+=A?!HYvmRmcP3qAN{j_QLkZj9Ci zHZRj+M(exSODvm*m>e2fvctN)ZQL64uy%|4sPwnC&ExdG@OGK?3{(e6c{j6*o&6>N zEp_fuh>{GBOoGZz%RGIcGjY}Ccww=Su_mL0_Nb|VJF2i6OK zt#j+vJMW`gma%^NC$YW zdhsTm(LA!g42tj%zqGxI3UiwjFPb>{l9tqlNM+uCWU zaZZJ6teY41&9ln2wYd23E_z)I?nKPwT(}p0U+BPh-p0*1MOQhJGH}j+;yxabVdxEVpdd zuv7-P2f707dtlU)Dzcpf`q{1J9%yd8dePcC?U7qsv+Dvic=S@b_6H6Xc=+~N9?s|h zKD~Vhvfz|$bI{=@6;2-MAWCL@gIyX_F>HV|pV>pSu{}I#R@{4~Ii9`Ng%&Yk(K-(| zQBmezQqJrkw{D-!ntncS{srNCyQy zcJbiB9sy!joY$y+s!uqv8eXe%)ARh6%-LR%T6%(`i1N7eG4mtnM4Z3%j3 zZ5cg0C7ipzln)|(SS8T}-&p3}P}+|zE5gK|JWY4@X+zlBRuY5uGaQ^E@5p-U*{xl= zQ&w2!M?*_c+H6|J9_E?bxxeBl2`v#75RAe4mgCq@OC>2zIpG?ee|8*J^ps|CbeXL#6BHGv<q(|Pt>BNV zDsd#wuCrsxG_R7m#TtIa*k$J|4-r}C%*z9jrP!@5;~xf5Phglat_H#BQ9QJt#*P-j z(*l#8G2xfHEKVQ74u;^+v_p_97MS-yCOa!61mKp3oA9Hv^F$zajXF^!huBzXMMSc( zmuxC;BfkdMe=Mqu;PDY`=pGBM!{*4i(s~0QN3=a?{cc8LmmX@we&GG|s%d2%R@r1rvD+Z*5hK%sG0UZi;7@94`69 zIT!F~q5=t}k6(oX-Ij(0J2WhRi^?P{S{Oyi?Sch3v|Y$(ur%%>^m2cD5+zX+gWE7^ zU?M}{GIMAle-?XHLU6E~YA3MoHEfC&6h)^9-BKV2YJ3XXK)}^@DINma;F?z7xk1n~ z++NL6ANb5Ya5>x>I|KFri%0c)MYZvjUASCg|cR3`sI6>UX!VerU;E(`@ zx#exRe)-@Nl!f%_Q6YYRQV+^Q^sq1)tO_aH9VFEsBXbHb5w(<5y=7UKwgWi>n3HU zb~w_iQe>BQHhI>+H@?!cS3;`@B*6=5h*(&oM}viu2&%NVu>P_v&Wu<@R1xyzG%iw< z`dbA`2+{m!(c;88O&-)=RDl;dLD=8mL>8qzX(F0MUg07^s|YJ&%g>(GB5cLRl0~Y7 zu;=Iy=W>pXNo?&jqWh>MJ$|9#8-f7p|zLckJA}`2oS9zj<-& zT)aJh`5!+x@8Qqyzjco8w-2Dzan(T|KDL0KOLNrJ=&k49|F8e+N#Dnq5JNG@joNdg zGjp=@8h}w4>u-9DW*r6r#($xIyju8Q;FH>)&E7Eu2Om>QW~fCvS*P>$>Dvah(*DfE z{Wp}!xBAaCY07PX!VgR7r!(#w9M>Rs_;aB;1ID|kf3*$^V|j7uoN@^|xpy{j?(e;Z z{ZaerP{TL_&AXHpfg8Nq2aS7zf!PYDQY(=nOLbmc?!4l*S-HY1ZVx?o#Ifn0`vioW z$%nRwad-jOal@jf(&(+>lebVH>AB0OZA&f*io0|aQgIf}n_oqK0>xXG`X+nWs)rU& z8o?#nq7{$fQWCUmqELA+E17c%_pT9-3jqrSmy^SL(^{b7z?)Wn7%pnwE^D74U&#?4 zOIWG7!q__6KzrDR52DID*FryO$uBci>soqgnnw4>-$z+H&A>8dKep8`Faprdvz&*! zw1nG&qfjhi_AI9xB!%m_9Is>BJ}dJXJ*;gPd~F+R99!>=S@|c~Op&`S+GBSoL9^1L z7r0V&KA`mR615sQ?O0qK`g<=~+-p)izd@v8Ry>_|ZFeYW9*al>!?z+;$dK2etXS#A zv9yfI2js5BstLf|U?e4#iGhAZVW}tqC9QFz3#cvQDn58be2QwAcg!N|mT6{-wTG>- zUa4(c+fXs)g;o(WWLUAK%K$WP944D`djQi6)fb|R0))2ObOt&OIUG>Id6nk(ULN2c zJf(_oWITo){gK?bE4aPGuvxp8ri|Sl(x9G}UaZ?RIosADun^@K;h+TaJ?x?q&y;}l zX_i2?NY$O8Tuax^9`)MDFYtTUZgU_n9kDGhFC)K-y2XIZ%4av|+u(Vc}>_D|jg>MO;jKR3$cE-a%HWDuDfif*UGt55=N(*QCLu zRS8${$O>I^W$5;JM7zbuLv$Tk*QBS|sVa@LY-Cp0qKk)+%%52On%JADm#1EIdFV7YA)Bpr7>?hJ!QDmj27~VOq>+^h_6L_*W6ik!U42d8HfK*oYgAadUsJ;k$8Yw zNS^MZrn`HU`UfEVGC{X~PLn_Dr5nzt+a?-;(omGqMwqCzvQf3G>dva*m<9D3F{?q` z97tax9gn1yW{p12fwa?7n2 zCHfk!RX+MH&2mx>^*O&8{hZ${zukn@!}L@Pp9s@R+Xo)$i{Z1e_(*wET8%S*KD;jv zG)}_-jxw5A#SfSMQm@2Xs(Jn%J8J#I4jC;_hgV+dN zqy~#x%k+RAv=}OFoO9M2JHLqL)<8W?oRR&nhs0`D4;c!@PgoNRwWzJ2nURnjB%z4b zCe1fq68+hUG=bkg!Jmc7BH4T5f&xH)c7) zF2c|#j#N8^moQkk1B#&_o;8wLFnNJpwx43;a0|~JIBvSX;2A}eIwkYfqwbu}Ak3CE z?2F?yg)1y{;v!K3It&oa3ciIjcwXk|T@9z9$ob0XA-My#;k5BaL3T)C0JsTWhFUW%Ivr~)vzS0a1LlO4Y0k_D zTkkMq7kmE;y>)_b{bfLmFa{mpbC%ykK@f+BKg~O$voIsN6aZIRl3ns3E!oFT7JInD z6b76-VdCcxStm@4d-z0NY-su#~%)yTOdM|M@KK-F&+4F@=@==MJR}{AjvcSk|xpx9#}30q))3>R;}hb)^P;m z`7T4D>1ttT2a?jrgK!-s!puZxlv1a6UUt&SCpShoU5;{@+MN3-OEvA#cajF1Y3#L~ zMwn0**Sfv31QCNYAG8E@a@*_YcF_89XpZK##OGbXwx55^_Z&a{Vxkpe*q1tqp$5*? zSAimR50jXyj|kLQ`6=<|<9e9)+Xy5j*k34ob7axjP%TS&tM=t?j-2=JMdl^{b8n&+ z<=kL2)F=YazdxhinwglQ<$*7}&Ilz|&oD+%J+uX`w4PywSja4UK>0rG55B^`UGdtU z0R(9UhtG&UhSH!8CU-4uPD0>kSq_LH`*TrC?2O91ii*VWQw{;Zn1oQf|o8na! z1Hb!w<;95p5jf`*%g$u+!=m~2J3+yMDW5NTkl@FX6uWHL9AbXksdpvR=uzOZp(BfF*M(B$M&)ww^CDcXV zB+ZICra1{C6j|S|UiS^gSXu7PK0DxKGSKRVEJ|_`**rABCc!)f;Tcv7D3{wlYWRX> ziCC{ltP71MSgOpr&T*B;rmLhiwViV2LSxH@Xc))Ztd@l5u_$hD?ksP%7n{na18fe; zT$s>ZS=wRKVkahF{rBc>KTu}M%{C7`_QO0A|2`A(uFu3jgoBV+dK~5r3u8%577LLb zGwJi-bc;S226TkbKtO1sqz7Co%=4yoS&Vi;ll_=v(^)L_!vP3OE5uq`te&a!Yc^Z3 z?(*Qax0mc0z%P13Q60Jd(=X7l15At$(*;fR!dG~7Mqs#4oUTT*Dei_NE1A zjtH{WrK55GM@3Q1+J{!QFCtBD!lk^ajrG!5z{@;G-b7~c&JaR;xZqyVJs?NdU8W?yvv_ZvZZU(;a~Nc_G}Dk+W@U z62Ni7lR_{jtM+rs=5EU}E3p2FXIILP+tauBR67qu0U6*1YG(P+zx#ae6O9MU4!|Bv zB))xjB=mw+4#E@#Wf|=WE0Qvk`3=_ob1+Ko#rIrf8=Xpwa|t1* zFyAG}Hass2=jbktD_FiKl(9qM+6oFgh+43K@VCqF&-kLR1^xFxU$_%ansH5cXi|p{ zzOG^nwD7|W!^S}{PIGV5++}e!+aAvAgerhUgU2yYahw#F-zVQ z+kA1Z{Rz_zGJfu^52Bk24g#_~BVPz=eFIqRqWN?Q4|3@7!co$nD#Tlke`kB&Y}Ft> ziQu9Np_F9qWbJUrA=$@HQDG6N!uj{2%;8G@pR3sOZ?S?|82tM)@!PR_iq?O>|Ir$5 z(R)O1f!hiVI`unL>#Rtf<}#8xW?a#8A|x2*z@`FmZ3B~mdkx-dI>h;RSNy)%0665F z;}(6md1@FNb4DKCl9-rcQMPU^e7~dngIU2_TnPMo_A?b#WKW^XwX>s7}TA# zzQ!ABMJFAL#L3K=8}0%nFpAVEPCn3991B#TN3|<#Zx=}w$IZY@8g>7Y%UA;PUo`3uN8)fNM#h1vx z@FD4Bfz_3NzM6c(bT}1}zg0B57QebG27ZE;(F%ghsr)6UHa9z$kCc8fb<|ZJ%kEbg z)Ib#ez9wN{cies_!}#n{r(-m20-}Wjtl}in$m|hakF*#y?w^i`tA`m z_2R%FE+%DX7UIZn!t|v3(#T|pRfC`t6=`RWHu~(oHqtAF;Iu#q!*OJ(qwF^ ztvANz3Af_tqUq1~k7>_x^}IE*6`%$4?-8j`2q0rp;Gbb=CjttY*^Sd-L9njRH}po} zhi;zvgO9go(=E2cj|MjaiWI|LJ`|u}3_S&X z$cGJEm4mBXR^(b3czPd3`QS2t{O;?&^*%FHEVo_~#Hd-Kri3{#LFIGa)PKS`dG=$T z8Y!2u5qIaU5z{R}vr{Z=vwM3x?Ww9N6Lr`@)zoLikHT~~YD|zPe^`Z8Z%F+W=OdNZ z4u7Ai!iseZKcbVM&Q(K_j!p~La__RChDK%YgE00UWbFVp8SX-_fX*nP5RF%irv?&j zb0y2dg~p|)FOdMk=nu}&lDrv)pd@_|&5^q*E~5jV_c?S$1oJ^Mv7kYss?0LRU> zBRqyXFK&_Dcv&%Z&2Cz?6^N={Qo)3?bpg@j!SIyO;Uscf#Isa9f#-W!CoUA=G1+@MilCqr36q0ZF6mX3XX-pFoTb=WP zaXXflLF?2Rmdz7@UDAlzFyHsnQP%XS7OJUz!iFj&@s?OiqT($sJ9D~2}I*LSNkS>JTZ z3XS&^!9mX5!Ty@)o{GH;^B`UIIv@i&KYQt3U7k(iK38dl7dHIDx4XKaq|sIRg@g&r zxme2x6a6(E0!ZWQ;@-WF;uyh?(CXh>O*p{^R}WQ%nKgD}Tlf_(ebrMMbhzt=LywrH=Md@)!)}l~hj|>H{5G&J5wh?@ za`E=nyQ??yx+aHVA`~7%?@>8rB3{a&>5%6>>_8J!>v3u5q59xDAyjhn2fu$Cna41>_bu@fXdBo%}G!q}6i zt334rAKw$idiUOhwdRfd7nr7(2lpP=F7D}2)TuYz#Ns-uw}$wTz5Y|ny&-s0&z9pK z+nqMd%UxIDw5XTYQ9(t`^e;r>W$RG2&XX>67E{;rNU&QcT02=9NB+YzSuC@7hF8Zaqzw51KOQq{d&9KJ~$B;G5H5Y0cl5V@9rO4 z-|1t0d-@B7(uR$ri(KJD(jJ^9&F$Tmy z>H=#n!S{=+Z`SI62_v5PMdUyZ@>#0YQy5#(nIzoSJTYQ5Iav$Ie_9AQsuJPO63V=Q zz3L+xHwGZVuUg$B5mbUGw5x z1mII9Ta*N01|y~dw*nDOrUr<5s<5X--FcykrF^@96jl{wx??~Wg8>_#)I{H0)K zl6b0|BaW<>tu%K-uQiH3_}G3Z4!<3)rx^#}y@q}?WQ$|y&H*P}pRuTI*b*jZ2Esxw zl`?6K8l*yPZ!@bN`h8@K=XEM_Wj!K!niThN2d*Mcm+#C>f(A-7`Fdn*`k*08 zlOT(FDi>GIL_cVPQFCbuvaI?&Lh|Y9RNvGM#dQPo7TH}ekDd|BYXYUllHcxJ>NjU5 zG_OLxqJUMznTW9T1Ckaw4{TSj?@%`xL~H$YqGexd0kArfco9I>aG#`jnMDM zY@PBYljSa3kp^nrbIjujiZOAD+PXa}J{sC!N>pyhUgG#h6iz1oo3_9h#H_6{mTq66 z4Xr1Tq44hA&K*Ctvb}V8Hv8ywWK>0`DH@JNNyt#mLrR91=aU1DsMPqMv>d=l2m;@e zwyL`*jlCYWFWZZzayXTdYJ zPCPBb&5jKo6w}nB^!wW?xvf#aAMg<`)eg1zIJ(7r@tlg3)I~F-(ml9>Oy3ps_q!vr zU}Q&Wd**O^>J@f^yXs^@_#c5!cg!U1Z(B`QHEsmVj=1hnQDM+W1;pOwKpz#-@gB2u zvukOq8tOMU>Q}f&#Vt)`eMnsB>9~%8oP0l?*1DYEaLqO$BI#pbWY~%G@?>*@7U>;@ z7oy*YjW=q;en?Wbs-tNyDup1XR{PkY>~FRYQooeg%CGZP=?0fP?dxP4&uD$i_-(7^&2_B|LhP-VTd;n(cNzu2>Dx$iA*(7&k_Z+Bw zQE1z~{vgNl74*v1(si^}ag}g1YDby!jqy>C{iPTwUCxgkTzL4R<%fhrL+RKE-Y(}< z7pkf|bs8FO(6y2kMzbPYjx_t$^)tLe${+-YaN@j8#i4Emob<=FnMR2yxt7Buxu79K z6m-sw6DF`YwW{CCw!_3AjItd&%!6Pw+9m-L(p{EEMOe$Jeb*cb+6MF+smn|~ z(!NGf0tesmfbP-Uj-!af5``QQWUVn7QEmfH#(Id?P}QAebI2iL)ukYe;nvQ1<-{BH zr$k(2E#kw+cyUEy5ipX|%oH(91eb?+qr{&_5d6 z4Xvnwlfq@Gg?#v<`;VGHi^;4-b6V9Jv~XzqoRA-K^%Q1u!lAgOs2V=5Aj#(*d)u*4 z0HPzUKP3BZ9WJ5cnn-;h;Ji8i&IzJTSd@*sf{Jb>WoNeq-%Xb#u75s#ZqRqJ^`0Ab z{^Gmu&ANvMUrk2Nk`kD7x6~h{XP2mllP^$lg*2=lG8Cn3J#h(x57`WZ{EVC`%~ zyDJYKXZq@9T9_#nRBk#d1drT7?AvqSnTFV*%|dy=gXvfc&hm^p_%>@PoNZ2QI|O6g|;Y;(Vv zNXkK%r`NwaJIXJ@n3>HcmQ`z0nM^zX16TYpe(DUY^=Hx4&-51SjIlzu9x*JC&u-zU+{1@W9we=TZKmXs z2|tD)D0XAK!aw$Bj_rchsD^jr->a|+1^W?WsExP6H-zRB*bFG>K7^%~$q5rdHJ&B| ze`3H|C+(IT@~-TBdZKpArqehPRB`l<>gNcyNDOrz$2<=?jI^dH1uVtLq##y1!u!L> zWCC%Ygf=#Wad}{qM*;kAQz8J$1R9Fr4XEm}W&BxzesGlEcOf#TsE`%}kD(CTHaqCT z#V*|5M1+1Zq8tklRB$Q>l;hDTJuM|sTF(VKWt4?66+mG#c9bX)qP7LD8z1;tEp61H zWxera9ozQUHoqqHFD2ywU#{|fSwsRcY)G)_)1GmIP)^44j~{g{kNlHLteZp~Te~K5 z+fFwLm`gk^dAABA)QN%5oii)yHm36~W~>U0}@WPGbelxD7qz5W>yuJ=9{1 z7#*E+5iv2O_>cjl2sm(_$LOn$irC>TB4mdBq{+>U+7fTz6u6wjaN6d3_dxD7f zN$PhbUEzYzTzN$p-M`_!kV$}VQ~3^q-F`^$9*z<}t^#opA3Oi3ic(u(?yf&UlizSv zIf1D@>Z#)vM|rt%bB9*rK1D}QKC6)BJ1uv!pf*HnWi!`%%3rT zsHt<64Gy!=LtZ!h{XpwHO7d{aJU&y?RhH^xZ6hXkKA{0ewJ)i`L*@4b{b#8`U33JeE8GexqR zK&OD;n;`@ZiJ#*=9g(HCNgd9=N=fVI%m1SSFQNFNwsA9=9I^LX6T+%F+E%}m2WFd* zl%QZ=17?BbEh3i&$t5k>{(vhEOx0810cgQ?X$*FWF`b?XO1+Bu>OS3$3? zu}|(5$w*|1CZRwk?A8evl0|uxuOe;gcvdFNp?T+-%tY39A5ZHgIcG!;$`1||c5yWg zChTqG-zGJNQEhb}aLXj{{?w27UR0Z$+P8_*{$O78U&)=*_CD+cH}46k>oa2&u@OZe$o$aV00Y{ zkhdOeL^FsRIj)|LL~`lmEPSy(oP*Rsz~~f9Xqa9{)}2exn?RcOiJsI+f0E#oNEB7- z-mm~2?*b}uOrq>br-0I~5toN3wY}=2-cbcxsvU(wzfJ0@jyw;%heCiPQtweAN7^xQ z;H!IWJ*txP1V9X?2$Cn3DW*XDF8-|_W!vfZ|0}K+MG4DdLPJ;6x_))4GvF#r!uu(G z=ki6Hz5cUTaPkh*kTnZMiu|AIvVAt}?8JAcE?J9Q+t2sQ`C0o;5AXLL74B@pSs4o& z5lCxwsq8tjRr9*S3Hx>bGgPYU8u-KCH(&u0vUl~m+K(=uK6;vH$mlcc-lyHG~^Oqt1tRy*bk{-jL2Ul%esvOPO z@YYkf=ZS}{!%@b!xO8y z&d-+X8;VGZvs#&d)trBtxM|{l$B53Kx8HQ$L(kam{V$S(%^TV*5qs$zX#Sv|HxYVG zzkTuP&|)wC*UpKiNm?XEpSFUbR2-tgSvSO#(e1vy7Y6)j6l<`pKyo6MNJa~lt|d-S zFAam}-5wH%=-Y2#gC~<2Y<;^?eOtlwIkdXZ2$)Rzq7vgn03TB!IELBrqC&a=d)EYC zHG@nP_)^->YSm5YQXe{DbY>1qOftO<6SW=~hfa=P->U?7UsX|DJ_XK36e;aVD9K(Nl@Eju&BYN#O%Kk{ z!k6`mNlZt9x#8}+V+eHh`iDe4rVh23a*0bBh+>QaV5E0VsI5!%4B~`qDM7n@?=cR{ z(|BEt#isUgmE)~QHsmmiMYYBMwqVG=YEkOBn0QM3!S#5}>Q#i&K} z%!)5?swmUd9r=N~ZW{I{U@)rGCzi>yvL6)Slc!lGaus0W`2D1e#ucO6rgeUQFPfjw z_(oJhSxNYi3gOM`H`CO?a}C6Gzpvb^1e7YJw7+B1qDmdW35HVQOI!uNmgh&sAK0iJNz-eoNhkEmtj&xjZ*I%JwJ9{96R3}JKwgQ z+2TzTq*o+BdG~zx_oPAY3|zfjy%R31YUdn*!nX7B2eAi^MV&JJm$39to^&$#sJRKn zo%b=?0Yz05O;$}7jDS*MB}VpO!L%%mV*^BbxWN3V(2Xw-MTu1_;?%z#p(2}2B}F=N zjwt(231y!}A5|`L4ayyc5bhzHr)kN8iV@u)0zrs(pB=@hS-EzE;43s9iLLWB>}^DR zAe&h(B}ekeq8Jo}tBSE&9laHt3(yx;(Yb*E!%@6AeS3Q1oUYQlP;X4a7Z+2zxV-z8 zgMzzt#abN_R-IP24G)xpehs34ZZKip!GJ~qx{ua0F9)qKOwwwz6#`cyJ{Jb@y(AtM z$D$I}gChlHDyRqxQc3k(B3GV&hjQ=TO4M!q4fLgPzo}w+& ze}WKG8Z|-t?ae^>xHR9`kyho(TBN-^C%9Ra427fzD&qM|krpn)-f8#J{Yu;r7;3R-$c*C#uh<~vTSl=`oaV& zyhhvfo|04;g$T}HZEozpE73?Z?Z%*j%q2zIHU^P|_YELKZ-oG*+R&uWN?${n&oO}K zoS?<9Gb()%tBigdKQ6@BhxvYXa6f$(8bpK0s=89AW6^e26mf&^qcIVNNKOF;OQL`F zcu5R>Bq*z*{}?N=Xwt4qutKL;BtYA`C4#Y$5joAks1p&_q}P*Gg47LUBO!iKH6T$E z9?upDqHTH42>k);4YD{}2PFtPDBV}dF#5l2IoV!T=&oArdz0se5F_Ac&X1(G{#OUP z8`?}p4c4hS-+%iQGrek>-M+v7b`?zq{5VfTt$$Iv$Pp#Uo$Cy%f4=q}knLQ7T#@dg zKZzCnua1GPaJ?eV=g~dK6rh(hH$0`6z|PV5*iQ~bXgg{la#UXw4I`PB(5d`w=-(E7 zl&FT7deM$3YLCEmDxaZj>R`gHN8Xe^x<$CPBStq9V({%~S^G8$h&wJnc1x3>@P0zf zp$7@^<0S|wjHJe$H$)fTnNO7sAA>~bsfz(WMnQRm!=d2y*|T?yb{)d)=!lLSDmIM9 z@q5FOI&w4TUJxBVlJ|MP;N{xFwB3Km})HYrC*@ zHGN&m%&O6JZbXK2ifX6lz{OnFc89Ce^NaV_(pbP@s{_4CvygtdZPP?nbm|TFrTR+& z#rsYGF}>n=f!YAqKM~NSV^&4fG;S&c9(~G*3{PJsL6+h))sgKlvK(a-26e_kStJaP zd`uC$<>G78bGXK^ef_N$qXRaqXTGkpvQZ~cy8!oR!(Y}BFv%=n0vLC#Tx}>>tSLUA z<&x_L+g7nr&0tmPLt5`^8>cdq!H(2i{2#tLrC~iiC1l$VU#Zo@z!kU*FmX)7XAs`@ zaF>-2RJUgbj8Q~2Y28X{dWlVxK5@JE;2)G_Y+l_iDkwC;i!p@fft5EbKqh?GBELS` zz=7)GQqp^Seb$1%jxgZh;1;o~^NGH$voyVpWaU<}D>dA(Qt_xaf2pd-dx~dw4k7kw zXy4#{+m{{hT%h9SIlJhi+M+nWB;2GW?_802Q9GOPTmE!*rVcUbFZ)Z<8l9bMiE666 z4*oVR+Ai4cJx+~W*=Q=YU&4n~>g9nGvoL-Xd&#DPNjySn6?lPWN%v_0BDhHK+Djqh*WC%(-L^?==V5VMrkQge1$7a$ z(LvFhQ(2$vej7%cZ8@obe$~Vg4EvbegNR?NaztAjLxjw3p>LPoXE3$i8nN2*{Yn2k zLGy*b=!APm($ptXbY;3h!eyZG0MyC5P0$({%ZdueuuI=02EG|~jQt7}Am=|$zWe%b zbXC>Z4+){$o~j%<8G9H`HHFoK53RZM219uGGkDWif!XFSHl>aaD-2 z2_ERt9@;Yc^B3u%y9N$2Imt?sAmITkwd@p-zC5q1-w8>=NS^#nm)fS2G7{l_ZisHv ziHyi`4d%ICjWACP>hjQJeP|YXEeTCiTt${{J2O-b*CEfr%!DExUZCz-K*JOIVh37l z;~K#eB4D5TwGNl;5PeGYNH*=67yV{pS9+;x_Q|s91il7mkuqkT!JH-&B6TbhOrtmk zj#DwTAez{UYDYn;B#-v2qLG|hQ^L@9AVnm+Q6l)}2$kQP;}K_I?3^6jsB?WW(WvtY zD~#}yJ@DKkL;W?(S8PTQ`XNqI8Ul|l-u`-V^YYladim4E_07wx-oWLNTdUuY+^8LS zb{+olg9P_i#@}8MX(Vo^DMX-k*q;cX_x|dlG5`L`7F8bEPVgL<1K+>TKrUuf$T4M3GIdF%A5Sq59DiwQGQrLZ+N za@jo{Tyl1^O<(xV)M0Bqy*QtET+kb0AoR6~30$y=#Kw@pCJ@7vyQilc_-P_Nbn&>} zW-Kgj44|z}VV_n|%LLxird-(+*voGG?DUQKo0ns8&w+h;&rj!`$Qx)o@jQwuQPbda zi)hS>R_sv_cv7v_kU$eo8+T`$dzaRTWqHa!kw8G2Wq&p)cHkOpe2KvfGVO0<_mrC!{1Pi798aI~tq zJ%J=9-|UptW%@Y4qGa8X!Rkex5z6HI+AXckz9(e4vdbenZDv#o>9V8{Y_x~8KjOy; zky)qhEKNU*?gl!{J01Q$QeLUY_C6h$ei&UJZW#Rk&z~atLKo&g@-VCo=d&jKrm-sp zyK%*fZXjCD$Nv{2e6h?3UyP2h-{2+g`f+JMyYCNZ^a95IifW%sk_ZlaKH+%EbIJHO z{Rsu@=II<0Vh_NgE)gLxtEha7x_ZS8B2n~OFoSsSq_MaF+&{Y~Rx%J&F2y{JoV@I8g_C|9A7n8Mu84m+qe16=B2BRh) z68SpfhWR4WSd|$D{&*k8aj(yNn%b^y!Lf~cc!ZtnH&Y>YPT3{b#ND9Ee&nH&-l&Ed zR9q+oX(TX+H3t@#mE2Wv8D+5+2~3Eb+Er)m#M)z=`8kZ!eyh(Go=o=35}KaE9zl?i zM7f6EoL;ud#brN{k8WDO)k<_Sp~l%bSEO1~W%|B-j_uucw!d;ke9`P;ZQIS=1;K!U`(mW8PRwOTwRKNB*V9HV9 zidXiAYm+QGBC004!;7kK-x#1ldOMOh^b@CDT zljHqM;T+vPr{%eO;XeU^bQdKN;R6CMcqTLE9Li$Ggy<9J8kEheS7*-i=imJs8m{Qy zfBX7*kH?P&Zv}?b$iKPs@`w;!RuQ2!5T4~vVJQkgK7)V0g_}gygSa0}8lYGM6yfUiq8%(6x{>M1tuoZp zI~PTjx%Bh60gx_%kvk&wZx8Q#cz5>8^|V_;!3*ll7@N;S3RV!=67o-Fa;lb;K`$d*eeJI+jk**IzalfwCz^GGrtOTW^)yy_ z9)ffV@`IMLDz~<@!unpu5KO%F>Y(>dTpzvX_U-R}v6gt!2+u0E2j^JVKYw0Oyz?m6 zGYVQj4vpkfSNSc&Y9A4>Z_kw>ts`VdnBIb`!VU06GK5$J#rLH>@u9Frk{(tSOTewA*f;^--aZLw>l zU>-fk!~J3=ko_4ItFDo03oVs_ip=Qp(VpF?mBp@+ZX?2&m{lTMXfagxWJ>4ts}^zF zw2$Fk^!iFV3+xHpWZ_5Q_1!Z8c-NKh8qFZukm`E$=Jf2zJ|aV)S-(qTabu8PJR$S9aS8Ti=a3=tVRF$Su z^`Hb>W#s0fLN9+F)*?Kzt{uEjh}n`a(G}q(ACl0^W6V+?gv$_JPEP#Ba%>8ZsR84L zwY%zJQGGaZB(MTm?j((-3O&CEJlPn#sekS8f-GXSfXY&h;YO=CA|&-15TFAmue~<7 zI-@zFgtsN2Wh8dXofk)er`7Kxpud4{V;B`~LGW0>EW*;f%fbYYw$`AhGGaS_r1xT~ zyO^d^yvBRPixJsJD=Ck~>+15O!*DX_vZBT|Dr>`;By=eX>k*dwln_&h)6_fGxhPu| zvw-C5H537a^J}Jus-) z-1V;L`;WuK6kJAakJvwl!NIvkJ{akx)-wL_60pJjS2(;C_~)`uPs$7jYcFumgC=Bi9q8 zWm11~pFd!Vyds38e`$H8KOOe7$SaMZ98_Kz%mM!N^2)$aKBc_UA5Qn_<(1xXd|r8F z?~p#Hywac4_u1u@8OQju9^B7zR6pP0{34Fy7j^&-dE}HRWRl*+@*NHRV7pQRpI}< z`LTl%hws`z)YagE9O+opVa&qAQ_8@0UNKn?yFbXeX|5g2JMB^p@|5tbMropH8B1GG zk{|*~mbtfvectwYb6=JtVYp_Fe~qK$c99|VWfOF9qr?!*h5dRKT(en{`-EdB!V^Y5 z<`_L|zfK5y}!1oyk?b>v(9)0gHI+P}f4foYb$1y=w2^TW=&-TwjRT?IBZ3eMgf zcH$iZ2bg)}_lI(J>o(yC<{WLp!CjO;PeYv*bm;=Di^BdI zuv>LT*1E=~EP?EwunYDQXhR*DP!K6O>)hKAmfU_~c@tdUgjkhuLF_IO=cv@H9$sFY zI;#qmEhnewD`?h^ZW5hM2!fVG+%}ZUm?MAF$lbcf*exFv?OVz|6026$h%eKmKh?mE z2Uf8SFF6_|{7`_>ba35{s7wr$;&<1cACXx@nw$p`5XEbgwRP^jfIBVU-@AOxB(gD! z(av9Dd{2L;;@AD^J%5_vZ&y+Q%r7d)TOs<<&}P=7lAWpaT9SBDpQO@YIeIKwiiaFT@$ z39(}0^kGM$H!cKal}3IQd&PoAjMlqV6{E~%cI+HvwtMUxv7Gb9$c8~~JgppC3g2J9PZ=lT46>0Y?l|#Pf zB0CJ46D4p3C4O`NiiK7~m3d%6xQ-B(t~FH9*Rb-dz+iXe(3m;Yh;H0}SlJLW_EITlkvX+l9wKvcOSy&S zQJ(D!GABRR_tSURl5cjIeb0X0fjX)O+5Dpv4|4)WNFMAMjL`fPXJI1wgC2;HF)Sa1 zKymg*J4~S~ve3sdJaPPbPc9G=(9S#{9Y*Q<`$d2GD#%uAgd!)osJUR26h@uz0iqj* zQB_pDHOjCiMBuzP0eHH|3e?QPa;T|1nA9_r-`Jb>x2Li>DVBt-k3EAJUxbXr@!+Ic zm|&XBQ5aDv$-MB6ouJ@ab^enX3N6y*QZ=~qS5XHWx?9Jl*PzqN(OE3gn>$fNLR`lj#N^P1Oz|6hzK1RE0M*xO` zfAs(rx)Yh#3g_->b2qN8(5VFu-1-?P%ug}VoyyifMeBbP`0hjUT7W&Y;+rukvdSm} zKP2-OE@GKFuR22C#%&jb@7)DtBN#9tkP+d}G`$VO3>IdJB>`4y9c^k$f>(hIK~KU2 zuPiiFuD!Sjv1@6^?|HOK(F=+Ls_E0X_n0dFGfjV?x1BfC!`{uMlcUl zS3&TDKhaXy?2Ue!Y!?)U^gr3+2;!Z`Wo4`T=m{JEZ_koVzMkU76zDRWspUl>BMP1dpgGvb0#9Wdw_?m{vJ$Kq~A zG_L|wfs`h#z!n*6(UWN^VoOg10&7A$1gu2%9q@kh>q2hI`fT@|>K4lq{wE4DP62y#l1d1&F1J+^Z2ns4dqJK4N#=L7Y;GN{X z`dDXvA#KD&%nNy#k{~IOGq`r@s-SUk#;taNSJ$`0@JboqU z4EBu0`pmmUWWI}Y0lJ(=z$B=S&Q=tjZ^^C1UeesKe{BAYQTnyjLK=9a4QZRMmsk>< zV>;Bg`Lflvjn<5MdRK;-X%zwF&53XJ)Ud${4<`4f_`u>4q6NPv5E0lfa&gExDk|hW z3!w#S3vA|0qCI5WF@L+EbIoIN?Md3OJOr63xh+b8OK5cFyOF4wUC7S`0R;u z=Ao$TJU_Zf?m)PI`VNHnC&$iH&8%W4JM{gaV_8L?D}XkQnL}@_dj4J#?|nB+30ZhL(rd|HPsgQLDnWB-!@Ub|xk|FxdjK+6Kq1NlKVn6(v;} z4p8c=(J`1l$#Rn9cqq{nC^nH}ysnfXx;~~^haWve7x@8hrS}QJ{J~eKf+%(Vs3_E- zeM6}OhMgA1pzj@aHL@{H(cWuLp@JH>_?1%veZBEwOSz1WH*v zSVxbPrLAc03=b@woCa%{Jra=s7zPWCMN;GN<)pwekiDOopDj%lB&&XM z_|%1`(@6~r&Ct~#34@K>V1a7K4l+Tpc}-Yg>!QU?khhtRBK&M@USV#|6$IG~SPj() z#mfeyr7{w+=ApBPq9G^H6D2rCR;eGTZZV`i=~pj~UJ8W!CnMy!57#tTL)U`!Ei-Wb z1TB*~y^()K zlqr54CE-u#KNuOUiVZOOBK3Hao&}pk&TN5hq&PK|kg51|9%8*_UVf6-Bz(#~LIE|L zVTrAq?(c`}ok`hLF&6oBtQZ5fVYMJ`kgsr`|=-$M*(&U>| z6D3_Yb$Mx)VghYhxh6Zu&?1Sow#VM7TG?JybHy@LEqcjaIB4bA$tZTg@wcIW%Z~IQ z^{btX%^4h)p#V6bpQsM|Z8$YO3zbOOa2f`jnj$tHoSrF9(Darjl_AZgre&nPkf{)q zdbA)=q|vlpM3;e)Zl9K3tWXs?QzG=J;VlboJ4grIvzp`6xLrX6S@RP?dG`QQ%UN(erNu zuj=m&Okx>LT@vlpha@diExlJm54^Ig`;C96ncBLX+mNm<=@@J3+U|y1GYPy&`P&DHmga4H^ZCbc~W@v_hGzm7E5@ z;ID>UR$E2g=dq6n{>Kdc!He-L=SEa~(a20UY%iGXrEw8XCLIOy36r2)=Zyt*=n)O$ zYIqpb(qIgTt01TOCi3&NNY{jP5>&nbmE8ztKvoTvnONwFKzFqq;i*{+Eff`%HIZbS z_Lsg@Q41$(3QYWF&|g~RAS+trTZ|1y(Z%XhVZ0vtRwh&%e1%Gs7I^Oo4%4~~>H**@ zm?Qs36=l1Q_Eqx$?8cz(l}Jw)*#T-($f#BYJ&EIF;5(TbDN3`#3x%}3uhS|~fHwO~ z>}tr=k&(1JecWofIPz^L5jymVsGpaZjOxsKF2y#zC*yOAQ;G$z3l_7O_5A2Y=AsFw z@mU;t_}A!i-$sc&dlONWn+THwMSOW3#|eYzy@8d`cTZ-s`?m zq|CI(ZVJ|%X&Ui`SGBozDf;H7+}GaHV=%Vxo;J<%vj-sf`($xNDECCPC*G zqitrb{m&?C)a;r~|Ia3F%>;C`g$NHrqz#6`G$T7^kAQ4ErkTIMkgHN32~1-$0h}WsOhN$O^g=`rqdQ3n0#&W z;8MXpYpU3Vi(QxlevsNEmcG}dJw~@TigMC?`SY}9Je{!F*S$#mxPsppxGD}LP!-wq z2@rwPom0lKB;YL$EmjGD5>H`>u|uye_o@$S4XgsTLpWk(6@E`Hsf6xfq*pY#%#3l# z4hKf{d&>gQLUG#c!Eh?j9+%IBaT2{?hmmKE;v~9hLR1bxG}R<)lqS*s?e(<;Ym&p6 z3Dl&=P$Xdq+w_);c&$C397{Pzx`{eQwFxI(5tdn}a0&NuqWVzz1?gRw6D%COR^}KG z-+w-)*0n@`1x77sr6+tZqfir)K)m~AN;}9jgiRqdO&=O zn>J>1InK|d_0W2VMJS}_wj}WoJ~3DEP^cNjKs}>5^aW%KU(uz=obwc%;x;0S{oAno zEh-a~^u-qt2!RxY!j(u8tlA{fDCpY~(yIekvd3k^5F1j z>$JLNXKvE+z4$+9`R-<|pVfxPIeluHAf~tszWF&Q-+A$;CM(^FpJTe8eoK+vbSIRX zPf3_SQ2&4S-i14EBS{neD_GsL*HkZABB_UM?R4+blx%Y>N*qzL=T1wfi~>+qXrcfZ z50d4c{_i&nHk?Ytp(Iz7M5%KCxp?IMpV72J_Av@1B8v+6!RE7}Mw}J|H2uR~FUPWvC>=qk* zt|ywCi>uow^=QLazxVkGhjva^f*O5dp8WwQ=Jwg{Q&T@nTtQZ}Vt5-`g>0riLuI%I z^6+WpJ=yiJ?qp;N8hiPF9(FiwPIkZdxpf%lUiG4W$)ubl-8xseKM%R_hm8ea+H~CC z_ZM+-@(i9ZzKs&Mczo(C+#DBFi;R&G2dZ+$`j}_IFFUR0=P`!-lPX_i51&XBZqovQ zpjA@2D}9cdfS_?g*-aUWIvW>PKWbOKiw}IP);2GK4QJoWB)f9~MWBKN&uIei-I6k~ zN1~2?-DzW^c6Pgpd!BvRV4m%DFrU#jkyAOv<^6r&g5GoSVvOy3O_dZAI9B`pSiorj z)4U&ONXw}5G>P+IAH&LjyJ3-wi_m~7UuG8?eIq|1QDRK)*5!-^V+$|f}DVq}}ROIa9!b=Tg>fhQ$ z!C_+ipMmN_=ka6qCojp+4-2P~dN_3c->CTCP>?mIk4^XW@WXQRNhNwrK{Y&=YTI3&00VoK9;L zWEtCE6qv{OUKGg0c0LcxV~SC1k19$BgZNQeOL+4A`3Mz7!{K6~vG@5D$S5!&YSC z+c1Narw%0ttc+0Xv@l^H1PuXA`#1uM&frG@!LVe!H;&ZJRzV?)X~Uu4z^i5M?_>=B zFoaJf z2JmpMKEJl34Q^$o>O zn=c3-WO<9ZDwKF0;v!)S;PCIeY=+__+b~_^S3>aGG+$e$vUs&RT~(b6aIQyDxD1f+ z5Y$&MiG5w<5e1D1OGk24$n9Fk~wol!heVm9pwvl-a!Ee13>dReU zV+@`fwZzg`ki^B>CaA@Cw|ktBmm(0$099gy zNA3l&n}rEUL6~*nsDS4hH)R4i_YbUM-!^W{Y9SI+g!Vxp;ZmnW3%lEjFLFpBsHEGg zspgy_XdQ($2#504AqaO&5N0ypWy$Wj1v15|5!k(MF>8Xi2majZOv5h*6;014PWo~g zP?RW+H4Bz(@|gU93k10OXq zIR1#~T}(`nq87TyfOALe5DA+2Sq~**HTOtj4w^6^zmaFHVtdm~j8tm!5OZS3(xnd3 zE5YVRaEFzMM&-zu)WWiN^t&y*Csa9KHK==4+)Og( z&9%rin~PTm;Y5z~YqO?+-%q-nC~GtADi^qRa*ONwd6=h39)8->7nd8hhrOZW*F1gm z9itY9=u{m_cqn~6o9|$eZX(E5m77B$mnxIab=O+qr%}MP5>cl%_DxA>}Tg->0SmT7TlBpMagO|-h?J*LC`fO8+8!+1&@;2 z^&|mSJxAp#VJvS;or6rFKXl^9$vj20LBB1T-154%_!;|g`tB}bQe!Jj2-o*>_zyBn zrUWA{%Y7jb4x8+q7ue%M#KE2N6oA)J!K9l-Sp?e2L8x?|QLvT8ax8V$o{e~&r|#a) z9m=fr_c)$kM!kEv!zE?@Bu-GlHX~@n%()JNDoG9`e*hpI?&br|i?Yu)v}Y=>MB}gu zJi(6qmD55JroI=DVk;d!UtRcDZdRP^RQq(FSG<5cn`RfX=5{ft#vG|!ytA=?(}1TQ zpx?-j$PbPZSV7Nm;35(y@lh6}0ZMN=Hil?xA52}KwdE=xG2On8Lb6jzqa5HEa#4g> zkMjb%SfD=|6Gr2sRRVu*GA4dq7H%;u&vX^*=p(#@5UX_Q!09MLu#R3=XNqH0X_wZ# z5;ZKTIw$v4Fvoc=c`DQUmCsoSpEpKpR06gtZ3g}qDuQWMmfY~ng+EN11Ya9Yk^8yj zs`QHLJ-0{65_;wtx7$)t-~_%3Z-VC#6SCgsjM+s@@X2ouoixLD)sMiX z!w4bIJ>gXY@4T^;)8Na8$`~*U{SObi%mgQspJWx8k@T6GUjt1I|8Z|!ze$B1;u@d3 zR0`f)Pj7w*vJD2`0S&azv`16^c_(q^@uXCL8%Bi^U!4Vh>0z`B+6x0s^<84w3HjM| zkbx5?7gy@MS7Elm?DUH~$Er#y-hJ6dAZdMGViusao3G`bhI@VMZtsM&P`1II(1-u^@; z6?U8OTmc8Q90ueD4rDxR3a*nu9rPGnz|T9D?w{3(a&@aJJw}rqW=0DM$L21~gBC;0 z)aG&SPER*Y!&q~hZ}Z7FE88zI_sO_;QQIo~!*uH-vS*&MV=4uZdh*eTKC}oQz@_xx zPS}s6Ju?YWdI~3nh7u z{%%vaq=Zv!2upGO=;G>{167bNQ1h6Fs?%ESc%K)5;}fnJgM}lcZ;Cuz%_oRA5JwgE z!qf*t$Z51u!FlsNO17Oh{PE!ZtCTfPJ`}I|7m1A@KmXgzH?ooX|NjifpiKV1Pery+KYKdfQ1 zQ)5#}ADyX2kWA7cDUK07x?!92ebw56c%X58NdH1Pj(UgcN{#C1z6s#_Jrw0c3wb$(@%Dmck95Y(;qy79|FyI|U>S z<`jHKG`1JM11VQuH)aRYrp7zjYG0s7 z2+jWW)rE5*F0smUCEO8Xf;+8swmuT;q1u#tb9NMtELsYT)p*I=*cG*YtB90di^SJ0 zR{X;pK3Iu(>)m4U+DsGNTb!rJ6GpF)Ns`h8H)~p#Y=iT>jc*s{V<${c{4#%j^`2tK zgb9!UCj+lkl?8eTT?FK+ML}@7DxQ{8qK8#Rm0Io$>E-L*GI<7LB7`NyK|kLmla_T9 zsy(H7>oQw%$!o(y3M;EJ--I*$6w}^2F`hgr+i&KJ()YJ^+7YX5@7=~K!~2z8g# zEKH^fqX=`=_kchQFrScg53OQQ^OBedKP{Z4&_R$EA-~0gbk1wqT_n^5y^Kz}YtMgt z=^Su>s~^h<J*WUk7*2_e`&WLvzWRj+}!qzMcK)&SbAk;Bnip09JA1{9bmG>QaS^Viw?C)o9U;gP&{Rfg9F$!R=-r ztmmgByFssW)f!m?jJX-@mab}qjDgvkxNQP~B!6)|V0+uKvY7%Y9>jU*jo##n+GX4K zX5?Adtwr`V=XY*+YiY4S;2P_w2P>z1cAf9CLy84cS+moLnCh+!6`k$(>;BT^ex?9P zHayX|2O3lXr?gftupL!@Te7*ya?p9MmE;MqBO4bz7lGc&C}+t_i~^snv@u^X&2RwI zHcZp~t&lJrclW)Isa9m*gF?E@i04)ekAG-l+MevZv2DkcUziXP1$D(w&czGW2NQ!Y zW6UcLFMW+SVF7UxPH!PZuMqB&2kJ%{bLFk>AOb$-lX{7$J-=pJ)OSJL+HX7@=4ajS zHIqcXN$y+w&4;BF`+f^{IKB36mvXFRz?8 zWG|>*{x#E2yh-QD9t^nG|M3bidNS?6<-bh-2B2CHw(KtA&Wqx;QPU|{(RmguZGe^vlQT(3W z3ZX@PIK^5=WejHB1aOhtbsx`N4}rxjy{({uJhp!QjOUA0dix~4FV=P}m$l#(8K@7V zabuJwpn8$yJJi07+}N^u0KuVwB|EI@+xo4s7MAn;E-bvYZS^R*%iT?CJp$Q4T-@&1 z#KwLTFfDc0qY%a^JC2KOk?+(%>fP+n0w%Jtt)0%9f>$JSODh{TaraS%3(QdmD z9O8ZJ34q#}b?uFNKQD^NzBa6U6xebSCI#-&J==V{b)QE0JX%Ealbstl-nE6(T^o43 zYXeVqZQ$vy4LsYmfiHJ$;HzC5_S~;niiN|Cg+u&%syL+m3yiQX2qU@vniuu%_U4 zj)CCz)hV)OhyLl=+`b7=@1O0U-m@0M;_LCDeM$os@Qk(ESrS>+w%)y1HSn^)mToj@ zM80M1pjeYx!%`Wb7VrwRZ-G!x%FuQY@Xl^6_ps{LvllL{!yc)&HM`D1gNIkjx&46y z1)i;angu&Fz?R;=0g-UZwmQ?{jS?sKG!Vu+tidMn%ZP1&B-^otaAkXVk~F__i}85& zN)w95ghlNvScQ3!xpA>$1DSRGbf@8GyNy3be2;9GqfCAwv=wZds1mnZ)Fz*+oe0?R z^1oXrAsYqa`dT)zb=e-W-Uz<#b~?WLEuqODx>qVXSF#@=Aqk1Z>Lz@IEhHuhmdP}^1#WA%4< z;N)>f)mwHje`P%j(kfP2z&I16Z@)GZ*=k9ot0=}@AxG%0oYZxyFijGT+IQ_!K(6I%rpcg`}3)b?oLj{5tp6tDWjoGD52+f^4$_ z1wZg@tKZqzwq%qPNA~_bL4}TwC}+2}o2PS2mI?JoW+PB=@gnOBEekv(n}UjWX~A;f zP~9SYSrIh)zTIukYAVs)HmI0^J)EXp-0Q6uTe*wmGHr!jtgKxs=v864GE~#jRwe;7 zZBf*$23z_Idsl)oi)@)17-8mqcxziXwC)xDY)y6Hjn0oQgO}!E%qlN!Ir43o71kI2 zZ5r<$Bi0g3dsec)ye(r#@a!r&rbx0f-ZfdnkKnuPoM!zuop&!ZHZ*=4-_AnI`p zGs4wCI6d@-_L9g^Ja}qg(mM?J>75!KNQ3g9Z#40;QP)3;CnSEn|d(0B=B$zg?9Zj(x9SQ`Dd+8cFD;0y&WM zNoWHOSKI7yAJ7KZIQz~!06l~4rKkFUZ}UB;!>yq6+EWt)KHiRyhZuY!e6p zBeAE)Jr>zamkxisCl=EHlrnqSCkFFTJte~sl9c%a$wi=woc;J$qg2X%a1XhQ=u{w* zxVA3)#1==0TaoyI90nW|z#z7~4%aU}e1f!)ZbcQ~_s11cE}(}6ac5RYQExAy{@|ID zyD`tDB=aqcytFL~?S96T1xfFWH%2#FKkGS;~YcybS>sIaq6vs*!>=(4||+L?}M7P|Qy zI<)ez8g2O*m@ULs)TS(yDTG}|g*X>u)G`IJ-=+{S+jKK`%l6%uQWMS}aeE~4Lv8!< zEN62IgXQ#liBPQ2zf0Rqx+GxX0X6_8L@C~0zj^oaIpCsa0Vz;uQt+Ahl?5pi0Jb0i z@C%n`(>rwDT|NhJ=*Opr&c*8&FaPto^Pc_n*%RmBZoOq%9c3N#*kW_&xg-Nk4NILo z`#=BVVcTLD_)v6mqx#tJ%*-~f1{ejt{$r2PPKSYm@n5KmR|)?UEUEq3Y^BNHJ54p2 zp%Uptp3YZiuQh0;;mE|{8*0p2{Z|s}a@()$hpF__9qt>TtCKtYI#Hg1(YvU9w)P8S zd2!{OQ3^V-cUJ7&-?^IoQTb_KWSle2yATSE>r);#NNOsK-U>c>4FwXv&k40{$|(VH7mq^1&%z6R zRm2iV-a6Hq46s!fES^Zg71*LBkD*i&IBh&pc`GZ~XCS*24@e zefA?;{Q^7y?Ov9%V3QQ=wjeJQOPD>&;rektcjx4Aa~whceA$ z5{aPuR>TY$;yM%=E8Qp(mND@GpKBp&0^@Fsk^F$=A0CaEpf9@K_>rM7i#UB!qOT6xT%Va2vz0-%{kLA)x~doaylej&Uln9x?4 z&X|sa4-TN+`W~Ng7wq;90zG#x4jG!=r$Id_+(@-)Qnamu zU?K8hgq#xa?O_uZaHcq^XyS(3o{mzUT_=0NdMrjYd#$O3B4N>(T?xL-`2ssbuc|3FsC zEP(Aqu^TF@lVXv(%ZQkyEZ7y?Geg&u8M;mnuQxe8*smk$VXy6;pO<9I7; zNDtyCDW=?72O(pOcRY8YOf}>b?tKy`8{Ol9%G{2OIW@dwK-dY{6tmWoEUz-)QS#d} zfr#&zm>6P-pidjR?kFR^&c%mMHI{4sq_Nv@TGDXI5l!?aVmK&zBfjSTUAvB|;SQjT zYP9>m;iwkD+Pw{v62$}1Lb7BN>d)Pa#M?v1FJpMt&v5YPt^EeO_gn8YWJ*I`gez{M zR?83CApYuMo4e&c_33bEJ%a84Ub=nG`Q(z3j=*e&Q;dCmg8bl_O+akdzbU^^xKVFJ;t7j?h`RK)ApVz zJ?%allT%8Y(u&UPqJAYs=Ro65_oC6ye+?*~*Q>UmKn#?DtPFDF!p5u4ZFerh6L&yUn*@mKVsfC;+qy z!;_|+@7ZoG)*ie!rWwF4GSbkGR5^uLj97LD_hp_4`~%rLqEXHF1%**0ysiBSum=v6tB@-c*WIG3)s4&!Es$BrU$eVX3K z=!3-84vrXHk`(Eh&zx7jn>s(@U+6aUlbF1f3uo=#f=48JIa1nS2cxy&EiMn*49F2{ zZ9=xdgODN12h;OJJbO$dpeW>e?{k^ncnTV-#e2&^6HG`DGqi_S3xRc_MeKq6%lSO3 zl9h3cTs%LN+>z|=6ym7+jUtNRWZCEMm@JjtvD26a9>83{m%}!1R@J+L%jwm_nsbne zgwc{kqAB>HI=(W-+u>EPa=k6PWH}~86{L=B&3WrqPYe7m+PfZ4ac-658Eo7z0#9x7 z(?_OUxgxg&IjH`~=;ntlXr^@dVb8Gz+(o&UdR}HM;nT@St%P$|5N<&dXZ$4&qzODQ zoexNxRxPbs`aD*C1pVHgL)WyWvAgLl*zSjwxlqCQeBQ+dn! z#by^d@89y&jsG$jsD&{%;0@J_!1Hg9ur)mrlh@qyh1Z}^VD)rk1XZL>aHX}76+j}h zbPMu*(C&N%f1mSW0|fX<$qwJB{=t<7bTF}NadRR9Kgn{eGhlyn&=MO|jnATDafa#= zF#O%xi`T%sZgx|ATSkoE{YU9Wfd1h-FVL5r)N*Z}e%b4z#!tb5NfOCT7*s;M8`T7$ zyI?V=LRLXXR)7q3`+ty@g$km_tt}+5&mhKx2(Oe67#huL?L|PeWB_~Ib0DC3Qd_{{ zSm8#flg7T!r$dyG7rov!De4gB#EnpBeSiC^jhNBOa%=S29tV>$t**^DYv2Gq)CmM|*Rhf03<1&lJ&XQ8qcF5_RRko}MhH=QvYT5B_ zEQ;!ne=OJQ^G#*b090qnToB`3S=eFILL*~V{iD9y_Y|4(Zk+`#y~8}>e?I5_u8;U1 z_yZxb^eD(Q3uA#*CUcSPGwBm?szo0S11dtO&mlBH(qmjI$THo!%&DEwWZx&*G$u>_ zu!oL?6=JDOR?E<-n9UZfn%ukX?Ipboz>2;@uZ~Rp=?7M^0Za@ZlL<}q{H^fd9KmoO zI_F`!)+25_{AJIUuyeLy2%k969_yPEzzWW%wS+D8X-@;ZkSo9v9S?9Ct9AXYwl@FH zb@*%0wg~KJgO%uXslE8&r4us-R)jRW>DtY8D46hO4?$hkS);iVV;*e?L#Zu7j})$gj2nyYV)PCfR|YYya~V?j)k%;tmEj>Hc*5i;ux7Hgzqmg8;quD40zT-x(O<+FE9A2L$)}~`-Cfd7$Eh{P zVEom)$;-{uSV}N1i3}j4Nb!-Mqq$b6x}BFy5LId@S3sf<1r?xGu)rddo^O?cTS!1b z8-NnvGzpMDPlUVDbGB_w0zfDGl5^%{RezVXx$B}xbI5<<+NJWN`nVRKYUeRgKsdND zHM7{Z?>^7{MD#$~0k#KYfp6cW1PfTjAebm9(`ZkSk(8LsPfQ(-;Nj!C8B2TzU>ReR zmyV=_9Lt?F2^l*_wBV-O`5eFQ38lqbyKx*uO~_mvJ^wl#Vgg5s{pr=&YtBv|)gO58 zcEKpQz_X-%yhq|TQI4!1z(mCI9hl?3U1>}FitXerSGz++}R#Z^8_k@K!XPwFgZ>F z)A9W`XF53kh-|qZwd@i|{-iO}?TDL|XssC)08SpX9W3?T%Qsg{*}rt}H(~5cxcONv zPGC>3?3!cEt|X3-*46b8+kA4a{RzVjQu;n$?nO7{9E8d8gnYq!Ya?K?i{{e>JP6XG ziM^yhm5aBae`9;!tR)ejL~xObPzp46l6JTum+V6)FCht3?)+O`Wb8`*%OY~U8^~Z5 z`2Y5Z|8^+9g7x2P|FmSc=pCT9u-gg@I#n6Wb(SZNK8>i3jn3$42nhx;un9+8Td~2g zdySRSAH?bRIsbh!0?6f@{1!cS^HeZ4@}ieCfqzOnRilzIXoC3o z?$@-l*s}kOl_~IZ=3Er$oC=N?vIeDDbcifG2I%B1o;(dn|B;kxade?!>9m5kH|{R( zxW|d)tx62PN-sA`T}c>Tyh9Epj&T!gs{GR9o_FniQSn*jZCa5cV< zZ{p-GK6G9scZbep;D_br(D^=Gtq*Y%vx(at!C%#8LaB4cFgGC7pp30W3a!5wgLtFw;>e)#aeqihDQp3UGa^RC&P6e4{U+D2XJ zG|KlajZQNTfUk-2&{&5EZ|VHS>uc`krM<%MM8S(Ve<6LU%&u9*@H+(s5SR9P#6klB zSW!twvJ(Lp{+O;W&(0^^0++7WvI}~sh|4IdH}bj|zlfM<)-AXrw<2LX?jk7*g%jSn z0DRyD;ca!fHOJf>+FPiT7VkoRaeWXp`&SlegXAQWOfeAfUp(iE&8d6 zzZszCCF4L@>_!x#y)$LdbL$*Yy9J=yT5HBCtHz` z>u{#T#8Y}o0snsJ@Y`3t$-jU1?&=W#dwu9!Uw?mldg#0hqBtlHovSzO)5Yc08T|JQ z3P^oVpRuY-fkAIft;1s{YZ*CE4CeyP_sJd8YU3?O+ynN3pL4h}h@~V8O8fkOoO5i> za{)8lNjMyLxP-KPtjdWVgyZG`svYMd!gA1tT{&wL1UQCik>4ESc?-xpe#n>`J3x%P z2~CyT<=Ed;OCps@;(Q&ZhfET6W5NRfpFPk}V4TY+xswrntH4epM zBr{Oq#73j|9%x^|O(gY89a!DQs&&>J;G5EDt!ih{e%M8am3#=ht0;X;A3#z#ZX1#`YBNe6cVb!>0ql;>S@|wVUQye+ zM9~*E1kph8YJc?b#!U(8*;}}$6ns*nEmeWexdzMJ!nbuA;=~Vl^t6kA!99EHh7nj2 zyXIl641XQov(3q-_9zch4#cu%Jjf5ca3ftcI;VZK%#7RMCyo`+qC&Nt@UFgXL~T;b z@jZ=?46kyYB*QtzYx>#Kr;nd@^?JpV2o2s69K|NDbLWVtgsyz`JVooC=SU5NJvGNQ(BW8BQ$R%MVYyP+ z>FA8ZAdTs)#uy4I*Ee~D(Y@0_nT00v08`VsO8_|yNgb@H```GQBR30#f70v23{YO$ zw*4`X+q>H<8cp|o?aps)%SynGW2$M@c^Af@nO1sVfC0URb~ZSA7rIItfK* zc=#h#iJrR!5gXaoWe2i$x?|`4>x=(9V!EWu9xan}d{fy~^j zVn8-!;#PsV@JlBP(^2o@p7&e+mjLRaL+b56=8e7{l`vylH)S0PGjqhCjho^5MaE z0Il}nfta%X35KvoiK#hrF2s(|4>r%#!+r_8vZ#C%sy%ZjBoWykUzXYwI9C;dC*$Xh z;q*;kRn<-#P@0>DAMA?>jI|<=>AP@mSXbOe$Db>jFBoSMr@`uY;(e$oLMB3M3mL{2 z&{-5Yq{oRDJOLG^rRpJ|Wjcb+OP2}vBrfFQG}H0r&n$3KsGo&+tuC`P$)%8?_Si!H zIez{&N?ZUjyn?6RlUG22@tXZkM)mj)IjSe4M)iiKn6_lfwO z!`mS|5}4f3w*~BC33^fDTNE3lA5x;7}?N2QIm`96C5d)-G*EC|22x_u^Pv``ItYRrHVK;qkXyKm?4eSp%596i(u)(DmON}eGgZ?-Z{R0JPX?dyYVu+H(=X)d zA7dd;|LGU<@gHL$t?suxyyvw1E*FrnR!;r^);&Iwf7&%X{ll!`=|AlnKK{e3;Xf}g zee#D{!zcf=YxwjJvxZOqY1i=CA7%}ojeCHNw=Lm3ceq>#9~*Md4dH~3us~%jf)K!C z0sRPspJ~K>zZDl0Se7IMFOVbW!-L}w56~ZiJJdtO^@j&1{72!N-ZI7)f*fNXz{wq* zk&LlE&Tj#0D@SAk>|Ma0Nf!_9fRSY33f(!_iE=}ESl(>FRs78~FE2?9D!*+y>$edDf=SAN` z#Hi>FURnb6b%mvz#WEsxgOS1uJuhjExSS*bg!U1B?%lMGcFfk|=hcu5iVooZMZfO&CRC9(at&=1eIA?2sT$Sa%2i&SaaDyl_sw z{_^-?b4)g&_f^on*nZ>Id}Nq?Z@^2_#n>X|1&P`@aKGNp-or>}>^9EhO+w8*$XiEk zJ=T67`Q1infpgG2tMXXZjw@}kAoeFbq)mK(RK+^p0VtrmhHwnkat=9m|n1ee1$wUFueI)&qv zSJ-zl6*1+_WU~RivyNuCLl{6Izi#h9@bkP0~>Qz4+Ll`->y=GYv4iNrGtwEDD_smbaQ|sTr%ZTD791S z>cFQebs6|oA(Kjixe-mZnAM&mTA=k1`z2i##<+lpW#bF8Us_H_zG1O7 zTZBv}WD70OURO+FXSCps@PmTwy}XW9H*+q_s0fcD#??{r2knxBOGzNn1wiXVOCLUf z-obP9+&Nf@+qY_XcASLqLQWF-{c;~G@U6Y*hw?V>qOIB8Wk9uuAxV&TY9kD4^VBU2 z@*Z}U2m9vi^)BL{Xjl~ir2yI`2J((~lmz?6w3|TK*Yaq&P}@*L@*(eJgos$PV`T2# zO957B$^=0-OwhFCvIQ&@6ijXj1KWV|=IDHQuyB304e}h?{qTSuz)QmJMQj8K#Xu*> zjq(Ja9%2WR+ChaZD9S8$01I1v;61)SIeq-3_Ne<7DI8^cVniIBA>3oz3D1IG05M{w zBcS7Nl%P^UDSTj@k*Wdm3-Cdh`Amo3;yp>_ol$n6flmP3q4PFCw7cwK852no&P9wxVCu@WiRzF8eqlsqrp{^vMUfAwX_cmIB^Ht zo>|-XZTYAsr@zM2GwMAr+^pEE4+{2RY?rB>!B_5jgJ6jaXW&X5x z=T|`Y`xjT*+6Pz}!=uS{U;{_Xcxt)kTVs8)|j4Nhopu;o&|N@=v}kg3X~!c6rF{X_qmgSq)H;lJO5})83{xvgJKu^GF;WhL_hYVfaHcm z{=TXxGr=;v5f;uUS>?ld)h=icy#4mvIeBvOm`j9Ad=aKOG(hX~0W##ga+n??D^-b2 zxa~66o94gHJ>wiRbz8zRLo+uSeD%h~r+GY5rZ2NdG`|4H^cWw!v&wc(sdw+(%ny7$ zXAYL0mpvBRO}NTj-WyLeDyt{{b`GI#Gfd?IO~7*(rj0F%bjIx%!3+vkWkfejPj~ad zPO@N=6u~@9)#f>iahqlZvqo`?h-ns$!jBEkVb42z zGe|VPF`#I!q`}lEZAp)5x;(VTb6}p`I{-2Wm$@u7whwyT>6~A+z__L{DOY_H%<KbfF&wb1-csCDeNG6t_+or)9yX#ETMkEipy~7B3|E=|-EEzdyi~iljp< z$`yRfm@*sOv7b&f;SOcH2TW_dWg}#4ZBZ`SjWf@|zva2}^!WG~I$y;}7R+(v?AK#K zk7$CQBqZ;_qgyw7#D0C`rsXfE0^RQZbK#{wAF}^NIs6aQte@$n0{@)}8}2aOG+$ix zQhU)&-I|Y)Nt*hl3^Vm^G>qd)AX60&PX(t)hn-<|#@(2S zdpQPa-m)S-f1_aY&Ni2K13p1csJJ|m6%4rp?CpyydKSdO{6!6#j#m-+{vjGbZ8TVT zz8dqqfu8G`8?OR-zfWN=P&6+%*1!WO#!VF5Ri6D4)1R?3^d{yHv4;@%s}#ncg|RPY zYzq%DT)sY4uHOt0yOz3f{oP=Wo zLz8H@7$NULF(<9#fb$s0Sav>PLsN$kX5uhm%mt5r=daQ1*1>JbcOCFIx7sIk8s))b zdl+NGFqB%n>(B{>C)J<9h4VSYPyRd`dJlLZHzf|M#_WvO_S-OHLqgXGnw~0AJ?jDw zU=YL&z6M8f?iNO_3$KEBRZt*KxCs=R(eER;4|B|BA9E)Py)SX8&o{a8GlRGVi2s5U zPnnW4kDuJd@?#l^pk8ZJ@Ts%0O4UPsTZ?6L(>Yt=0wDBSJ6?;OhHsm&!w^V9 zrVPf9|Jwck+Wnv9?*FKRjcBBkql;cf?&j`mttujJH4azFk3zSb-tY0^(qETlyTlC; z044D255ndP+uJ(0wA7n6TIjsoY+M}@v}GBULXCyw->jDM?CMe~92{#@5k=V_qcFZf zuSH|wOpr{iY9vE%-223iT+msaC`oS0)Yz>p+M?e@?0HfEC!HuIXO-m;C1?0!-c zalIRN70g?n`1?Z#{op>}fr$u)08!{@;KEyk)gx{LuqWIlRe(2udQK0Z^_>HaT8LL1 z>#*(CX(4?PA_fFPGb%Nu+e(xy)Rw4tYfBrHU3hRZ)Wb&Wjm6LZ1O%Z~RIeL>r8SpN@3%>B3UrN9w=OBQ6 z0tPhNgV7HCZ2&%nX`wv+e&(D@@MaA3Ln@il;FTMcto2Bwbr*=pN1aL5)Sb5TDko;1 zwYn#3h2?EIAf4*v#BHrywoo^>yRyH@k~@f3+5~LXy&PXjip=$bA@kbVf(a08mxx#u zev4x8Q*fUKSs1|Li*~s(v*6uP0LiTkG>F~XaK*C%pm~_bRp?B1P#6_#6{sNt0pAhq zoUm&Ypq+@IE@{MobuYct?3qd><`p=A?}ePmhMX7TBnZF?kT2MQ1-IKkz=>EA}Qe5=O^pt{QILTwT!MG|wsGX?LIXeS_D)|=Tzd==&e1*cH5rkp2W;?O}^1`G`>e&C*633RW(3K|x{M&R{FVJ^d~ z0N4k#6hd4ATI9tBCi``AS6AX??_*qgJU1qm1CN&AX(eX9a)sdAibo7kpWP+_-puSz zL#AlaqS+K95fOwLI~iKT*f~iF0(N+hO9gik6n7BVy+k<*B41#*D)th$^W9}&l?Esc z|3h5uKm5j{(CDaeKMZzQoT?WWJ^}B4Q#oION&1|p zPll8ci?^9T-17kNDq^eUmBz_(R3TCgK7tFgG<$V!HHr#!D!DocEg{eyu3-^LbodaH z^H*4e?A!t_MK#MJ@_gpJ1S1UL4j>egbvU zFHFl4@|6b>8@qk2hGl11XmPB#m|-bMD+pJ^0(8n@tyBp*twCLNKM?}aJIh4sDFHnF z1(QM{jYMth_pqbtrSj8kGftJY%s>{oAg#uPelKwT^g;jTGSIk#Q+NaCMidaoM(!WW zr_nd(KU_Zr)_T9K9hc|Bp%bsJt@m!@Qc?G8vc~rH+U*wJ#WCekdb3`gUgSyaB z6`4aHSc3P|dWZn`av0P&lR2wJ)`=OTt;BuU=w6VuYuV3keaDUhFZ2 z9sRCv82U~4(Wz4YAo55bxDSL^!lwC^r|lGt5(1a{Wmtib^N3H}GK^>u1^OwfQh$jc z6|(5g>kOmA5o~BY^$9}f#vSIzYSP>8t31GLG!zR4ejk1#iVI83M2R6E*G3TZHzN3% z{pglO;)l7H++u{RevDE|`I|L?9NfF+Z-I9@L16cTv!AY=m*=Mryl?;vVe6yo(k-Kc zyyvR*s5SIf*eAdp!>KoW=n&W+di_&E1oqi1{ujSU`VZrttJjfn|kH326{I_%e z)wB7tC+rVywqgI*aRb#FBU4yPbVTsf5zkSPTgF^E6I5yaVd>cjpEcIdO_0Sw)B@HV zR$CJTZC%RvQBPq`^+$Bd15e>KZ5{BWdt7EwBB}xMoZf+)1Ga7HPya1`)2F$rHfzKn z3=JQ^i(z9xD5!Kvt^)e-YmdL1LeZ&m~1&1&OPL5$U1*|%Xh3FF4Z@kv#$3&f7*zuzWN30WjG)agg;^c?U^KnNNsQ!G$85rz`Y>Y+oytPYjb9|bK^n^DF*Ey3DAKcn|&m16-n z9!NBm@>g9-7%vpV+0y!?%{q?NR9*gfbzVUNxAet+)4ID&z1b*NT*lV6`#yYY|HSW)cWUuRejNP14zU5 zQM*-wE*QLge@I+^;YM)YvN{cVN-tZW8MR}w=cEe2y3!v!tmwDhI2?A3oz&W94C4s$ zq& znlYC1yv&anXDE(Non0r|z@h z$>Xmc)LcL3qT-zOY&sI*n3M-znE^a6^0QoGHq^$Hua4Z4#nY!xeeIx$+Jv@Y9-P8Y z69p*IhE+N{JwEyR==d4i0`E>wol$twFWEe3i7OnplZg!UFvB~?ax*`9`sLG;)32VuX68-RH}c}kCkxof-c#DhkB$RY z{;BJqeC0p!pPqiL?QGu2m`#1BGEzLBIZ5jvAu)*^WD|HuM%GTh>AaG zMM*NkB2khe$%$^CE3d+^Mbm9IJN|7(--bgoO(=NjLXHzm z;|UlGt^iO9eJ;%Ngc=;KhmTlB#G``|p($aam=*Vz0i!?KN_6-i$dJee15PQ4NYRCM zr2vc^9P)~O@DRud#d{w~%Y$3YGyzE#^XCq!$cG}KB>K;UtOj_`qI#u~1lH}a$lGx6 z^jYn_-AyL+9d{gZ!Bup*ch8^Kc!ep6_#$`sUU3c-Iv(~DGR^kFY=4;Q zT+P@@bE9k+O>Y|@3mTh%DsW+5CwIgYi44Bgk;0ypDtl9tn)F{u+hPVVnRkV&h#+Gn z`;30#QUp(m&dKqho)(~-B#ht28aL*}k2F)R%4l2oo>EluI|Z{78V?t4?6$zF<^?_% z_VZztX*M0V+d?%uBTzN;Xt;{z!tmD>1dC6TN~{0^#LlaqDOo*y!94bJ0bnYgu^jn> zCJ<8}TQbq5P`-2v{4R`q&&~Yj|D!mhf?r@H?o0$6&)Hsi{y$Go|NeJu^dJ9VfBxd( z!-wK+LnGi>9|256Ta|2~p5MUVMQl(5Xargp27O3%vF607bzR+OLGxX358O~k+nG9QIttBfAPcw8IjFZdu_n2Bw zvI1{inxAx(tb{o=N5Mpv!fFuc5=hV>UCf~bV+EyeVim}c80I|n9BV5qgm-No6ePt+ z-AtBymtYrKzlZqni=dzI*Popv70>VObkw(leA4VPSx7qEoad0QBwsbDTF!%mDx)tF zsTh1)dX|r$eVGSAt=&uS@&URtGjZj-f}szA%Tv$sbh_vnF0<*j^dOjH-|(2wyh*F< zinMECx3T+xu>=$bWPc*2snQS6%2ml2)9EvIXitw%o*g;mz!X#vIU}b0D&9+qIj~mf=~mJ#c%oeUss3V zE)@KQi>j!k_u32@nIU5??ST6Bx+xcE^bT^PE%t*fE;p=xTU6~;x5TJT zr}U5}YNm_IM(&SVDy2cFmZz>)Yf=7e(Il-gWRTa}tk&K@`cc|*W2T#+64BDA@^O62 zo^}eRI0UVYtOxX?fB&?iRK01>EHnn<^DDi{avX zh7dfa*fI5%bfd=vd!x}oV`J=pTQsI?%1zNez@2skG&yQNAjHTt8=|GDeR7cIVl@ev za<#gKx6^uIqXThn)W2b*W|-eNkURubKwQYdb-W}rK=KFQgmJhjHz+fQt1>Bb$Hyj7 zY*3IG;n$oqXK~AkJtHm6>~{5PaCTL$uT=MF$eAz|_;Y#>ZS`ED#$aF|z5rF8%en;% z&@u}Y_q9<3LDkW;P_8~qL@$ZqQxsv!W)Z!hQbV9=_`>5iNt0RaHEfb*vit7bC7m=0 zl)RnD!Pln_YVrYHl5kgUtvK1y$Lo+ zw*7d-7VL}e1(%+OcbmCrtkn;q)%pxQ=x1n{8S0yps2tp${VOolUOn4DMskI$#PiBD zq%A>q_K}pe?+s{b#CGi^iy}Du;C>?7u&t?xBLxkfy9i=CpNPnOES0qr&q-2A zg1p9Eu;Ar~x7N=t*7;da`zkQtDQg_0Gi852S*oCxi>dX8hZThHruZ zt}{0RVXT{8Y90#DvFI4mqXZ=Pp|+t|E9ouheD%lJ9zb|V{oz6|&C2BMP%SPaPccX4 zCXCCX&QnhC4V3LK@Fia|i5B1YPmYhr?CVGP}cn zV8@V7Y^^CcpXSH&1ru^#VM50G5CQRor)o55=$wvj&k^T`dtQ|=YWP*MT0tt}+O>&4 z8a418WDOx)W&$~EGR~DOGM7b++P(n!$pdw)Ie{QJ&G|Q@#@?iGvqec`wNUgKYB#34 zu}=c;$rNbOlc}{|oovHgU%bW|@@B0E7w8QJ_(sBR&^8Ro0;uSGTt?DMHx&^c&G$P> z<2?(~#9JH9xU59(J)JG$*BM2~8C{Ip@J-t8nT56mq~#d5gw(~bS_fQ#51@6XTf&Na z?ojMoWFlcSuGVQ;C}xY{Q*Ov+ z42O*yZ`t}&?tIYxi#>H z;=s*1T7yqxTC7bqYeFU%ZWqs>k8(4If;MZ39l&Dp+=FsK-(R(NRHoDSb@95ruP~mz zueUER&#taszUb}o)Tm1oU|U%_G}j^Cwuyzz9(wB8f?nJy>Mlc&>y}rpz&rgLPP9nk@P^r)=&xTX$)08Q_A2W3S%N5 z6rxNaB;2nD7v;sAe=&l;Q)BKL#Ep61eU+>#WmmS;b8&%>S1_lSiYQr)P^>S*+_UeC zNrK*p&aSWD+4q&_g}rTJY-eNb6PQo7br)$%)3Kvk{E#$`W5%UYcEy?5iY|N^>C5WW z4Ve#2BXGJK8ME0t3|Cd7y-NnuYGb>qUd4r)&^Z|DWQ?NFv{sE6O`pN4tFN2I5c!?F z@uL>>$#>9@A9s+h`;D=p#E>Z#EGoT**h_9mtvM8(C#AQBghkw!$l$r?XHV1_X{#00 z44(ZZRg2QQ2@3PKEcG~1-I@J~dZ(Zlv^F*dv-mpv6&pi01d1IbP=0Dz?r;tT3@PCY zO8yHtDH*2W#B?nnQolXB9QN2m_uG-DpgPXzExrs2ubFxrKF#>2k!*Y z=(sC5!i5G51=JFmIqchm|M}3w8=WX+J&krrSFRC4Z-QW&PRFw(%}1FR71ymI*yJr) zNIDKU6rXn}{VF4;%BC(cg1LFZaA?ZizJ;iPH9YS787v`pkkwRd^L@4U{Tap&m~X4^ ztG;oqx$Q|fL0FMMo5n7-r7;(k*^Q?Pu_9?KG2hq8P>;J61;}jhF=#3>@XFa`t8o4| z9~sqg>D~)gf(Ho#zFWMoHtzkLip|Z9Y&>5 z=A6xM7Q1&X=eMWRaoqt2pX9{BHKLxlv3sl{MBC#${RBoT*lw~qX~5wz>|kf=>?yH2 zhi~1D-5iZ2%wmR!Z^ArjtkP$oYyM;#f4&L|8?jx#Q;7mZ-B{7+vT3Fo?!?-*r`uTgL1VnDZlYD}EhA&Yx}5w?wj`@kzX za24#YdeaSQ1?!K>T_@2Bb;MepjIQ3nh!k}dN-a5nG$V&bcw8%u0oyR1QO<9;{0C0q zFjUMMp=3H}olH#6yBsHAR*mBluH9R}{$~@+Ck{ZsDRHh4TSVT#dgpfoK_9F`L(Bw% zB!;xIEs*(Y`jaekw~dfMni{jN-ZHKWY!L)r^A!TQjpAi_25{DEUT&&uPMmlR%AoI& zfoB3AD?0<(oCL-SZt_L|7`BR^j5fs}ojlsshE6_XZFKThC!`ZYj%}#KmrNw28Bjff zKsvM>4k$_R(w=t&CV{7mwc9m|VcUzAfM}x76@j!A+XDCL>xzYVby+X23$U zVCUZ-ic0IAS--wZ1r66-ZnbOW;5ZYpG@SU|-l(o)>JCn%f2B$y{|LS0K+n ziq7GVx{w}Ym#d5bm$l?0JtI>I2-w2Fbz9SEV}I_~QZ#p7%C+%iMN5PDyIqr%kgTQ} z;BTh0V>IExeF%c2E~Uz4)RK(cw!6>&x+smiXH`aSHm#u9nnJ=Ram2);Yy+vkdmuv71T9gz ztbtyN7LavOr1|qlkLWRg6i#+cJ__O$yR#l;!7^Yo?gfwBG<-zgnF78^ieS!unctqw zPM9sv3@Y3fjHq_P5M`9l9FKcG{b=SS1rI zaU$CJWJ@f2+}{!pbg{z{543Ew#I^hcEi8wx=|HLdWrORG=dW9zjM#eJg}=I)KO2|1 zCoZF?w(iud5 z%qc9i$M1jt@e*Ee4A1@FZa2c8cFmfbLvtfud!aKPf?pdoG~5!LZ-gE`+Y!mUouWQ! z3|@IVR%vdQ800m%uKJ-D6w_eU)~@_{ zEa}4LBN`a7?PZ^Q?~lFyRC5!C*Vg;iVsB@C&T+bwfE&bY_rclYk~2h28t$q$k>9Lk zrftyphLwy_!B*~#S-UAKIkw@ADbdjQd>rLffbDD|__ri7wCVnT?3}FrwTPePB5q-A z3;}1$>^8i`l=c5w$kbG|$S(mEHQX0UpOjQhKDA#5kc#%W;Nyb?HPtvoZSTyaY? zyjr!*Gt9AO6;WfD*Jn2rJh%OWsjoUCTrT4fdMx@f<5CY43{o+xQXW8AgdJ%$*g{k!Hy%b2t1!9(?F$jgTCuHz?8*DP|iK z=&AL;CPl0Ajb!a5T;-ysXTRAn+g8!d7GSznm`u6ZxY^d!jKmleK5l^@FAW&rV4Wyj z2KbB&k7Jbc-N5NnG{FSq*LCSQ9ypZ*xQDbDE?!OLU?YJ??zNkyL5I7}h@jcm!F{2! zuDdXbc-!=}4jTCxcy2p?p%r$~<9b*hiCN3@l{YtkXZbecc}^jq>*_td?+ZJ?cjqlJ zG)rE?98IXP4|3tzO*zgHAPB8yK^7*y5jqL^pEq}yY&evrD81S7{J(264|cV$?aYp$ z;qxGqls+T6YY#`=bf59m4xbV2?(J&e%I#t=YMGU1HUVgo zVAWE}464cvO{uvS_gSxxCXtjSh^3~07+R81?U&U zy^Y>n8^lKQIs+`Ek!omQGxGVMWYnf&K;`+m!TQZqiTLZt2ptF{tG9%|Sy>aS2q_N7 zQ;)nFftE(Aro>!xV zFx&+b$_&oAY;pt{jM3uR%~Llvu%;TPY?H0WNqi)GFc<^kE)6jHYNHSPwWdS-9wqaB z{i`Z7qjABCuTX}i!Zqg_q=j*ylF@73Uv8bn^ zY2~9Em{_%xm_zwvE2lfV%98u7>7`DIiWX#r2_JRNzCsl9Wiq z?`F0&D$QAAdsFjR7d;0XyLeG=$PksY=EXSwr3?&%=yk`{+%N{_oICOkC3YMcSIQ*t zaKq#(w+V-bp62|u$2oxe;ET&(11LVIp)E3 zBFJ0U*5#C-wmFZ@gQ2YX(1T7_7^Ce_bFDDjd;mz_p-*c7bZI^q)4NHtz|@y-x`{H! zpRjY)9P|zRSes5m3?6Cf6NrL z)$f{w-G|3S_W7VBvp0&IR&|~QgRr_EwNsX`eq(GKK?TaO^>25FTm*0#Qo!q&g%&NeW$9jDljr|jLR^CD888Oh1d%iL4^B= zb4-@|JaLlvVTU;*G!~$)If^kN%N>0C_RZ^eFJHeP8sv0*b9VlN_*G5};JwFNs#xu+ z&Y9tG$@4MZ%EBIMU}B9&*aWCqrZgM8x0Hny4jMlV3dSI&aesex^cUa=FnRF*qrber za*E82^ROlS9+S}!?2qYk3MCFK@Se;1 zN*RHva3W@QVQ-bm2F^4iPs3>ph)EwhLC6M`;ppPv&f#KBj>Et)X2B6eO}mAMsm75% zasI*C6Y_EZLQArOcoc%N)%vd^MRE!n`<(x5u9UH3FLJ}cRr82iiz7x74)!b^|%urTf%7(iA=a7INN-@kh|&{dK>K>m|8*j9^f&1Gv_){b9AvW02C-L4yI{*F1A77X3^Fuf^5V1FCHV5O$lT? zWMmz(MO{Li1*Yugy{z4wP~>t}f*Qi4&e(gs1^P~Z#v_!J`fpy8aJ&b81nBFnn}taU zKo`~e*4v(m&WSEK_O!iPkao?36q{^D?H~&T)2CMkmx-0@3J%Wb78tq#*fzxG-8*-S zV{UMBIA6tE4Ud>2V}sg(wBFkMQ_`1krKE(!HyC`6xr}>PZ6JGS8V8+NK z_|7I4{3o8Iz6!LiIGaQIpmT7S#9tJQ+j0~Vzb!g545m9~#j1fncf<3R& z`08-gGW}TRr**mU%+ef?yW(IC9 zIO1~f#Ouh4XU-dp;^FGc``14>@Xyg-oHD+NlRNzN;`N326+jh2Hwu4c_aS_`esliA z%eQag6Te>Zz{00jPu~2%YZ2CG$|O$$*h6qd=Ly)4oic^#4aGt%rzH+oOVa(1* z=vQLGk)yLmtoP*r1z(C%=V~d~#AwfCn#8tQN1HY0$?+3p)%x@?y$KfUD2b0)0qUhT z&M%z<;P{WOFW+71qy4fr+AmE1o(hl~K{n6Ka`i@Drw6H-;{$ z9OV_P=DfXOC^Fiqg^A5^(V(f1rz>|h5<@f2>APEpQ6s-lnYQ2)jz_w}*r2N`Y?~~Ri z9d8JK&>B%a{m6(|!eKqAO3|2r63NSq)bY z`^Gg}Y`L%j-6Mq+4bH*&)%!=^{6sSTLlek9YHauE;ndv)Sv4urwALH)#?Pop8c;dV zNwyk?6h?;840bT*UgSG72DI#>?#^((on$@Til?o-r~r1om6=`wVcqO{aK&m|{u?@~<=!f{dEic0vv3w%1fx>-ldv z)1Y}oUQpC#wB}F>WzAY`4S=k*W)!;EV;U8wUzCt%oXuk|@an%OQF0Tyrf2kZ5z7409DQfP>$@!_-%`3HA-Qw>y1z;4Wq=R?bo=)uOm$r8vO zaLy|^-$5-$&3IU4r9&?Q6v+>GHKrQ^2G2@l#-lc{=Z7=XzC*uH%;LD{cl zLniqO?$9lc4v28rs@1Q+s_tqcQ|Bgo6Zz)tCRlg?aaTz~j(ce0S&+>$o4sVctu~Zfr z5=v3M&Rzy;nghJh?JR|<`ClCH9=kI(PohdJ+7b6IW# zjLBklAX}rOC0cAN`CuX@TqOe=T{%?f2KUnd=a6LvSqGKu)8Kz77m)oLE<`?z!Ie}s zPK^kd!>~}$8mA`cj@mXhBPe)%7-j61QIXg4!>t1PedIIx#{C=996Q^^ z&wY&>C$uy?B5#wVAnZ887XB<*b32hLSNtsQwstZ(oBXYBlJ|S&))^c8au`^Ti+JXl z85Dt=8>;1#p#V0KU!t1ynv z4A?$ge1ob-uD14IvjIIeLXm-@muxJkbCq#hqU{QGtHAP>E=Q$|WM%Udax{mK#se_> z>70T)vt%93_OXs>CqHuInMyLak|bs31@(1=V z)@}QnY}*TaB}#xqV{9ptX=?4);IlKf;h6qO?QH+D9{kIC@GtAZB-R7&E4rI<+a`S9 zb8reX)Cg?@-CLY0h(VIE9@7rxo&8XX`=Kn8K>^!yw?+K+Gq?VH``H_QzWq#XJ{98_ zX{+yLLc6^|=-Hu0yhDt(NG->{9`wE8Zjk4G<|n0t%Fph+bkO;!PK~yc{(tt~ggb5= zNf7=ke15ZENxf2*?K-Br_VwG9C0DnmZCNeJU9&UgM>CUDiY+FY#Y3{Hr~mthH~@m+ z1u!XGT4odcHXb|O=hS39fpCLXw`2;>>*Il@!G2@w3oVDwn5}Wjd9gT}dT(DlJeO%3K8&_W_5iM~);s<$ zoxOK6dv(La`nzH0-lR{qo3k4{dzSb4PMNiawXxRDmQfMsnBJE`?G@W-wQpwP!$!7o z&>EszA(IFU19X>aWeK}V$DnI1roi8ZXo~NFO<%{;dvWiP4N$M@%og4;%cy>Oczb1D zMF-?A3Q_c&^J{7W>-gMN91W z=e}3q)orN*w*0nutn&n^&L{#p#MKvqCoG7jn10Ko!3-6FL9{|Jk zMvkIq#Vs7myLH|ty?gzo+3ob)h-zx)&DoBfR{#S-8e4$iM}G=57FH9-!+QCJ)XUGK z6oNycn9mOCxPj!crK&k2Bs-O=(Lj07gHUxEFMw1Qb%vvh6NQs*Syi(%-1L<8lAn1Mz?J2jcfTKMQ|9 zQ!tssqw+it!FmJQY-6FuYIBZ+8#mgGh8)+ehr*8EMjI;1J5#m-(B19hCPn;FXfUodv~EBH=a^2J!IekULd`=oW8MjbBjRiu zrFtMexn;*i3+sU=*rQ4yIW=YK1g~FC%9&!-Dw)7Hta3`oDP%+f2_SaK+&Qcc5pe9#er## zq(rF?m^`9C##c2Xf~!z zsqqhH2jZ|%In8ec`Ps=UBPsrXS|mI0;+$3mM%2 zbWC8k6wJxY9cHTvpI^n_HyKsMg@SW3CJF$%2iGwD7#1C!DSEW;J@ zLGJoVT#Ut`@gBE~ZET1ff1HRRlg+sMI<~RX z9^Patp~@gwtYExtRCtloAoJFlxig`&y#ZY>x4K4A3e_%hx`GMO8&<1UaT(*?3ELM7 z?(cYp-v>G77nq8b`@0%6i|H6eUq@_0$(TN^(Al+Uv^ZZfya7*MO9{aW^9cqVFQF1U zW^!P|hh$VNV=k02DxXW`i!w;fcPr0n_$h{xxc;5pcw6Y);TrCXBwE6jB|)>-u$46wmQ%Koe-^>LO)ut;qqODBS z3!Y@=86ighDAnhbHn4Tt3zQ8%r|*MXlf=q@)aC-zH*r2iQ6KxD>7wp;>F8BWCV5=0(w)#s>$4oco0LrZK=3VUKPr{-V zuTe?TjhHi>$aQEKBFq_Y5*(B)>Ckw!O0uH6CcWR0M5XJAzB3c;2v^q!+~2bb66K5G z9p+JjLsEN=7+L%am1$7Vynj>8^lfir7 zueH4rE7angV}T3ry;OfGF`cHpHcn>&l?vWsS89vrdn3fCnR!P_sH~+;UF!lgD^q7B~dUuKi_oeJ#%2U1=6aMTM2U<;BCK82mS+yP@b3 zg>*KCU=ELHy{`i}=RgMu1Wl`QfP5w8B>Y|J*T~icad558Cirqc)-ZHoz2ivoXe0Cp z(zdn_P%NETh+i(?BbGgj?u!}t2(kIwJiZg%e1N+10Isnv2uiDNnL8&2hl9pK{&!N= z%Gftz2Cdo6vSg1?I$?ESaI5$_URjpzsjUrQ&sDBeFjwMe+6)$xUQuC>ggYfAX1 z>FbT&UH3z{zu_A_n^K^CT%=!=O_w<;JI$MJ(e}LbZM-AJ>5~UOToWFj6Y7m3U&aOQ zYXRdxamGRYpf6v|%_p*%N=jQ3RN!`|mtH4wI%`Wi@tpESX--OyEw!tzM|;7ClM$Jh z?B)xoVpNTrfg%CNMHZx5k{U4o>fj8omM#qtRl06BCW1G4zQz3IakMKD0Oesa4HTO@ z-;@x%$>f9)So-E8hu}>nXC0Mj)|!nT1~{1@6VXijTGf{eKesKeQT93Pc8#3RY~yQ`eP%L1qwKR22O4dkgJke)dL|j3FDahY77Hu{n%Sp|C?C8AYx~o3 zhtv|SD&zDJ&(`WxUr=7y5V1M z;quKM^aK!HNJp(S>~-&8skzilnT@B*#y)OGBXpvNqhKO#RaQO}NBV<$5AF_y=yvRe zj+3HHV4(`)syOBIw=1v&+by8oBm|Ae>|q=z112FserrW@bRyxVVGkWh_5=Y7fQ%oU97)MI-+a9aj=hygBX1mROt005^ zIKif`Td{)^rsj=|YuyW!+&*1nG2vaX7bJXjhWL=K1|W*BBWH%-f{_=gdth#H0IfUI zXgVi!qASpHBxtE_G#au*7ng2se7OAUo9-ZiRuB_39pAklHxI>6$w!$pr{KE-fkgcn zBRR7rroho*qfzU@0t3-$k3v2?(C{2E9W5!CfO}HQot!EaaRGx~Di`C3-73YA$T3$S zRKa~uIfp7ppwtPLPRyq>cFdfTqlqGk^;m2fpUu)xXO->I@PcE@PDduPvvmv5YQOM(vYuPB@rqIF!kr7JQRe6FO+twn}l>NQCs1lmQ$m=al66xIns{9rJd6cS$?0ANRF$Kc0=Z` zBmNle>=eUWcEoFVa6?*d_j0qP&5qeZ3+Md~{n21Isb?S355w#*i=gW(0Wd-~y*l|W znMQ2%xMmjRBzSNcaYOU;<#U5GZJ-&$6~li-ew)TCMJZ-`Gl9n}_zSYXxKB0o0yWib z*I3Kllh<`{`};~ za<2MbLO%>YtWCaqfbu?a^N>wO?;W5pcHhp{ar(*b)*=0*DJhkOHt-Ql+n+`+2cl1~ zl}NCQ)y1P)T3$XH@bMX7{mH*6%dHPUe1hWBsN@uYoyNj+j*|yToMF)x?cB~T4+dA- zqeRW0?48H=5&Z&FKMDOnWmWXAW=s@9nfx3LZiHKWjBb(9LIf?RyQ5n%raNw7_^ZX zWx4yo}aZ|Q&tNEmo_K}PLz^g&z`;CIVw}Hpt8eC+gz%g^(%$u!Rq=3uFO{|1M4IW% z6(k|T5Ey5I`=kW@!n+7!v`2p2ZWeI+THVA+C@_5V_Bb#s)V#bg%!f`*F_3+kjPfQ* zw%%7N=oKh2VgewzrN}hbjGG`Az{Ll8(}Jgitn1CW?HV#e(DXU)>)G~|OzX*y zsvqU~P^uOG$jB%K2IgE;yn+c3A<+!VwtZd}VoqMeYhXYjo$sTFQ28)ZG@zO=QOwxed1 z9^gfvqE$sHHXzIkL}~PC6-BUHKXN0#5L*pG9-&EAmFASgXWuSP1J0STswH&r4(ktE zqcIIahy!1U1DC9P=i;uk&ZGKO!(x+ZeXMh7y-TAyyB?%mX$opg(R*(uJdn8(q&CS6 zi=3kpegvfkq*~oT1}xgt7^}^F=&{Q?R-<1&&~JcqyT-eyF9BN&r_Rx=Toh4^gZ2v< zMB_p?YiH)wMmknzmN}fyGzDfSgf6Pixsi{$#x^k%wKi**;Yw_@b)+0ndci~6#e|7+ z#)1DBgBon>a0`y?Ys~x*7Ok(}i|q6qvcG`0nmU#nSDjHTeCuK$ojCps$t@dBnF==b zJ}?u>fgA<#5P2tOmtt14+iF{1f_*^NO@^|@bV_WYq5uvlww2z?LyjS@xV+MViLXlK z++#vceHIQt**Sax$&v#MF_nr?Ov%Z+$ph?mhbSBxd`y#ihMVJ_#7&NREoc!3^;zD% zZavX|JPIFyS!LqursxYL^K>6bjZ8BQPTguEZe77Ahu7I7%q!IxDol;>5#eCgDfsK6nW`_gZvE%EuNLCXgbx+iuFb;gwE-_dznb#O1 z!Z3q94$BnNaJ&~W+-6wK6sqTUKc+vXp7%SR{qH=`nlzGGO+sx@x`;q?(Dho4n-&+y zl&p9j&GA}a)WU0CYk|VlELsD)B@(9q6i=JXAsP)l-X6PL?0-iJyyCzj-o%i;Qfx}@ zM`#)}fQGmg)0`?viTyX|+0OS09UD5bgak-j`|!1riMtm3whe^Px~@{$I7tTQAG#bi z`Y^08E-+=2IVL5sV@%Jqx|KQ&Jh4FVGxt+j#k)@sgxAgJa1l1x>cVL`+Q(nrWzkuT(I#!E z%0#py0Sb^q;(jA*2V<2*GBAe+?@!ng7#w@8(Wzg1$*j%kT=GayVFgYW2P3(9^^xGE zlYE(tL?8W?dmnu~;NW?aXKDO1=^)bv1yHQVr1=$N@}SzYm?Hpn_=X}x9Tr*(S65~O zCHp?M_G%wuJarwTG*k-MwnQjOdhrT8gpBpyz$Pf&9t^79IaqO7StYCA+!6`yGA!<%&xXaC3upag=2FnOn6pA zWR_AIp2QMnaON>=?6*HSC?D}poJ_9W9Q93{`fh*Mfa8p!YHy+<(#)XrK7vOd#MqS` zhc^Tc8+BPaa<=lxV|V<41t-t$(Rd@x3ANcq{&IK^Y0)&3?TE=m_IqrL%TpOzTLcYCX<7NB=MiheL z3s-8vGeQXngg(576l2aPP~ia0t3ol%uwvH;C90dN_=`5;G6T|zE-Ny^U}z4!BY5;TI^ruo z6&yR@Z1M>k(C=?ZiEMVEYJiMxFIub@AX0NO(V?FO)<>Qp4zRaUY zVsvn|H}8V2l*-1ypLV8ZnvN;ao1qZjBzVK9B*kciDOHcpNadEKjy(+1**xlo+-x`c zJgiRqK`*mQETU$<6N~>uVpb}Pw_b~U8oCLs25p^-=qxM2H6&1OSQbam89V_DEo|R3qmia)rR4kyif9-r-;1oEk zn<~APZdiGw+_|<;6{{#~LsNHRmj(5QyvE#P_fm&j#YiK&rqOP6*VL`MCMNnM=#Sw& zAV^^MTm;KyT)zG5OckUd8~rGZ6SzNM+8-afx5_)M4)c zD}bpG*(8W-+xoy%3nX=G$9ZPwMHDZ=-5PJLhAUczI*v~*Nwjbn^+NQpz23C3aVWMu zHv3uBk>MS>cW9iy$9foC(})ZQIM?H;j~R>o%G5||#_Fcreo7c7PW>QMXyFRCh@#v6 zIfk#!bBrJd2t}Z-WP%a8pGYpgtTfJ-9)@ z7)!n=KRHbKPPBz_$iBgpMBj$QJlIU7a04b$Oh;vqh2m5B)pIkdN^TNStQYvZ?;qU`$9lw-KKpso)1p7}Ds5*1Ss?x$Zy)Fh2ao#TzStQ$L%%v~ixx5}**F5< zeqVrK&@#mu@oX$7Oy?QFvI{;ye_J^AYUE~Do$;Ueyb5Z4Y@m(YhYhb$sx7n6u zs>;p8q(i=^5}iJ`6z?P7FoLSgAclhi_RupU%{*B7DDU#chW36tBZeCh=sUSessdaM zDWD7dr?UGr%KdE|ns1e=u`Nn;@b6fz0nJyJXo9f=$%a#PFlg{EQnrkVvX>@ zmY#}QcP63EuQ<0sdxokqPU3>h)mHKMb1HyxcQp^WuB?_|<$W`k>?#(uk@?m}loOxH8hM@Mu190ORn!4l<_)PIJ1+AxO=1*Hx9g zg}AsHpYxbJDekS;0+(vae>a^GdMPu!r6-U^*Z)4+KA2a8k!PSBUtl&r4L<@kTFJK_ z`FPVgAs0dr_h#F`j~1yfa%gAdzR*Knf%CLyXD8SI#~!rqJA|R@r)S^4`=|x(jG&|G z;BX(yH`p^XcaEMeVhZ1PR&H4MwKX-b(jiy3qr=;z_-TC@kTNmd?<( zQE+Ps9-2DCPpZHYylCn2zQIupnYlC6@13{4sWpxa@iEFBX_X|6ob|2LX9Kr;?raY| zfNUY+R9aA&aN(n-V>6ouq~#jH#HlZ<)VPt{rl{NGW=jacX=OhfxWo^@L6cw+t)`Qs zYSr{YYAAo5H3N2E?xFK>bR>C1=Iou9SOV${*mMW8>k3IY<4a_**bSm~VLv-CjX2=! zdd#&<-cnbQt?W{nJ{-kXo+Z(=fh%>`Cv|zsG6=l@D!$mKE$smSRa$oFejVpx`QXg* zv+HZat=18ixQmMGT{h-dW1}BR;sOOFg3|UkRH1=z}js;iW1TUud#+p$R1$!kF zLBAPEXWx5cZzeZ-W)md=)FJiF>Y)w}+v**yqU5#x zL)J1`^puuZxD`7Y#PoMOJ_a!T-JuRgU!iq*;WY8kXJ37G!NQLiak{O_+5xNaNEek0 z{OoR=W#Cy=4nn8z_TUXhq#~{2|Dvn{=llX32(Wfo=*-h@=SCY`GJNWxUxNWgZ|4nS>*tCSO zt(HZ##2auLB|AXag8O!!PJsX^B89GaEw(6>L7B2$Ht{;ggkM-0$!EWs-2+lUIkY=1 zKFYNivfrzSDcN{;BmQ3)l8433p+tM$N-}Hvk}qAb%F=XZ3+~pw_|?%$52KV%jfz#9 zfZ=E7>N2!nN0wJ29D8emQ-0*3Ni|WgO!&)yjkuZE{Q#?|qa6&Ma8wC$G1mv0-$wI2 zsw;rsrnm<-)R++LdWj7Ax6by;a1O!KQUeAK764n;c>u@*HTQHj9CV1ljG~7B!>GZ&S)Ja3ga$S!|6I&A z+*=`#qr`r|yk2t;xq}P?vF<0LAR%xs(unpYUbTgae9{}g3=(TOt(@W zy<>-H=y87oj_mO3jX){LFN6w!X@0e_P_9oEZ?W)>lxIDrG7?(_QafACdl`v~-P}9& z7aD1EP(6#+tiF+3K2>~NZL5~XXaDMIR9zr%0|>C$LOu*S#BeGyD4l|hv-FVi`(Z-L znzssaH%8Yop$f8RFjd?Tpg+EN{``M<%o1V7qRO_sxt zL(%-g_(|#9Q6fLuDu2FW`O$_vRW?s1=&5Y4PigS{C9I2&Y~OoYliKHCuligJLH|#f zMrccU~T>qeC)aRse$}bc75vK*~iV z%WxyePA|D(9nTO4bJIv`G#`=8d8{dl#a1yX(r6!_zxgI^H=>#owgXkKYH6#^;}!`E zi>!wATro9msp3Wx&DRV>(OgZWDqsgKl&X6|VPkQ;FEf-_E@g&P*rgGoex6Zp){Dl)A5wY zV_sIpL&sP@82Kq;TPIGee$eefSATMOR>gY(IcU}y=HLZ0^{Q0d+wTO_HCC0xP$b)| z-wKxXv0h(L^asZ8ypLaswfPdhzW8WXUqE)6a$TWpbOxg6Q~CAB=^5$(HeOw^_!y*% zZH>f$j;(!cy2}Lzvx!rVE%s&AiYS?>#qG<4^f8A$6F}Pa32GgtnRgnL=-|7JjOI`q zpZ%!p(<)w3h4^q99>+|+ZDXf_+VZ_89JXqHFqsJ##8P_k>RlHgpfmxdi7sjQ2-a&T z0;4P+aADa{Q5mgyaiD4}W7?&AIF>$!*WO|95wg5N3YM%YUDC#AY*tW}G$V*;YIY-} zdePz}2gW_4O1OH7v@lx{%+b)Vx_HB!8y7(%qgjHk+`_JC)9fLJZBi9DjQz=*^n*pO zmL}KXlusON$MvALK%xk#Ygru3Z?xu0MZwZQn>ejXQ@=v%9c)vGBE1ek;}$;)rNrfJ zq95lsjMcojfAhF#U-aR9F(2ZNxfK#q*(sZ*CG>J?CFaaGix-bWj~f33k{)S_UhG2C zJnQD-3uxtC_rXZ$VtJNPkW5PpcS|-zLe4hZkYkk@rzA#GjGFaJ4IVB$bfw|Y69Ckp@Wxb+kk<_()9=Uhb@hjv=#p0yA z=iXh?jb{TsreP$uMIsb5arc4px>##nxq@oT_i=U(0Sy@yWLLDaRBW-R)0PimU9lArBU9X_bvwBxK&v8m=P}DSwu0OcLa0atm&*OYl-aOysao&7Xg@a(65i++V79Dt0PLc6}xN|b9|siHx)wAu4F4PP`h0b6qJCrV|FIP7b;w~ zK_e&6QvDdf1xVY2>8(sUicOHZ&W5q+iYA=6lqmc;2>g>EzmF*~@vF-dq4BH&D4jw_ zE7gaB{6qCUrpLQRpE$cJtF*r@#SS|nX<|nv78f!nfRerkdT9HB9;R;{GLJ%=!FJV{ zaFi?(6gf^dP2E2};~En`KHH^ogN|k!n{2gp3A~q30<6&60c;91QbyXa)()`1twmbe#7S_LV4enA`#yLKGKgh{b z({!Z~UXZV0pt&B>&BI*0`_P4$D7}mGECtRGLNSj4bkWaMbhpDQ@Nv;3=6j(J3bA=W zRFTwqcj^6mE3@|<{4-lZ?k?XXQ=^<(^jS#{i*2-m($uVD!B?370T5NZs17WQi)|7-)W=qtZKV*AzN>~` zt+H>O3V2cqZ3L;Mr_@ON_AsGq%~!EJDQ&Eje} zL^s!Kgnci=cI9x;ce=B*2L9Ue=K#j;bceRNx%FlSpF=v(EJ|l_)}QpD-UJp8v$lz6 z5#>cx;7R6PM&kcPPd23~4(gx+JWjST)p^BpjN9y89KE$Lc0y+PUEYm%rl@1X0ZmhO zT5%KPwOvyusVZz9(Xs!qre50zCi16IJ&~Rz$qmWI>3{dX8jp1hK|vu4_^R zv!px~H#a0i<0iB1N?6>t4B2%_CB38-Z3J^Iz8hMG28YXtQEGd$HRKTp(g&}j+#}UZ z20+%-L$u5s)N62ndQ{%T5b_`{s7Iba5! znZ6cisRpZm^XH;kl2#xtFnBz$6ItId5b`bq0RT?7oNZMT>B$NKlyon^7!7(Y7L%{M zwj?_o(RaD)#l0_w&?eew_nErEDzLe@nE8t<9i_PSCaiuL$O^Da)hS*&)k7iC z8pWoyg@;MuhfwL;8hC5LAXwEr&MdNQ3YO+80#EofhCSbvS*J7DIgV78fkQq=aaK$0*if&gYdK_N`IxFBRz4!KK0AzH;1!P(}?CKgT1i~y= zE;*a)Mee1Si=v7hsJ29)uX$dja=o)O;q1X1EP-`$9R*gDA!c?P};QT z;H)eZtje|KydtKIaH>CgPkG89(@us<24Hu}! zS)mQN%d}&c%KVu^+bGZ{aiAR(%BC#Z96-r`X2Y^a*0B9PbTYe-Bf=K*D+FvvVF{y@Xa}@6AG7`jW~eTPAzq$(OnY@1Z9jIxkVY!OW{) z-0#GaEn6{`S$=$Kcji{9&hpfo)YIJ0&7*?+$KXN5R}T30QHy}yFIU^y4q=m& z8JSC?a}EY$s!f7t=QJeyk-5#pF~)J&-ihmu(ky-0fN4V=2&lDy+Rje#5I9gCf{SEY zCJ%?m4tsAd-tP-ai?ZPjwb@=nn8=MFW&gl|UFqsU_g2zPqZ~?Pvb=2+o{|wjxEb8nOoEPA zLE;lE-*r>GHP7~6jQZl9*D2y)yrmz?>Fh&kK@ z;MD8!9~hK9ql6)_t|Xpy3G6_{@SPd#vXE}6ls=01unk!aI!A^G{psV| zV)X;~Z%CCK>i9RxHV3b-kcA-co!G*U(;cuv1wO@8*o>h& z{wl?SpzwUrN5<6nsaH@USqqi=d@Y%?8Zyn`C*($<{O6?EQ!FnhF&}wwxwv>#8j%$l5#a4QH?iH6aPX zPYe$U!OGDcZ0Q`7h$_8Jv-{Kxd7xj1_oQ@$ENGWBs?DCW9(bvJ8;|BbKKHl`a$RkT zH2LvO_2=xKhKvBvHW8sAt7#`=*5rv!&Wzgb*3Mf2)Nr5Xzl-2=~TI8+l z(MUOmaXmnUZN=g+%+W6{*u*OTvyNnY_jMxz8{64Je}gGUPS3r7(6GA5PIltIr{{NH z!!X64->OC}B3}IA<>L9`<>Cc2efj+Pi|?MFy!!ojN3UL=eE0irzWVmN?;82RG118) zZV2CaJ3t^f;qUGnZu9t`9rS?i z|MLY(#UF*@lr5G)zF22TAhvgwi!J^PCgjIwji0peH|QvX6=jSizyxPg8D=DS3p}4g zNPV=*wkp7{zMI~Z<@UQTzuZzG-P_;t)hbJ~FlhB8O`<=4%M*W`Fjj z90R#Dsc9t^p!N6IX4^_TuGZGaIB{G2wL&kA11Q_sslFE3rpnEyi)|3@nHHBS!`}AL zfJPek%jXbSK(7Uq)@8p3Blor)UndB+*xI9IktL95O!o|rK1HjFu4LVGiUzg_-q(wO z&H_>~?2i>gPoD`>?*hIzq_&ac1DV4zXujHlHR@y2E^Ef`d(?`xdb?PIcbBr4kqEhU zCzCFC@N1lItJ1H(=^Yz71ov5NMy^3b!^jnwFy0iD(J$KZ4O<$VLWW_0e{3oJhnS&|HGP zzppcvLUSV@ZQ+zR7%zy*rX>#(eR}$B0IOgdtm5)v;c5(kFteSJVuCVzobSmwU^kqO znUD}C2PBSS?Fd|K;x$4T+j~}lwv%CSz&`aB_%kR}yKz5GD!5e&`S|wcXTxcqs{DqF z&CSmacBvt7#N4*0~7SC`Loi%2Z8U+bArQS&D zkgOs|dz0sahjL3BC@JqM-#dO`Rk7k1YF3 z6m8K3+pN&Xcg^dp$`6yMEHSbojfFM<*Ac#GTIA{a__Mg0Ba)A%&k3Q_bC%TvIUv}i zr44LzG^!sW8pl)91`?nn<(T~0`s%zD7tBxb2IGX;eWOMKa^FA@)E#{I>|5vVIO3G# zkW(~WJ*ZgWC@rE5*p`9zqUVCB%$n30>H|62_#?52HiCl0`x%R1m>HMk=fbxyNTAg? z$k6RDZ@%71*Z7Wi3e~~x#hP6s2eK?kzeoAVR9{WB^>&4{%D9trCdi%-b0qB`jaUawMl7x6JA~l0TF`FXZRh@O376 zAY4V{Jk49m9qJVi=?YnH73827Rb`X^luT4&q7_p|^NWD&UU)L9G}L4(iKtyF_73XR zxullVo`eNaD2b#@Y$iSlunLi<tGWf2Fq3W;^kM3=Wy(|hyfhDPcUP3lCX)_Y>QVv)z>ni7!oKs3z%#P{Jazr z{flGGcvQx9P z6D^fI!P05@!)|g-aOMpb33{f(JX8|uSzGoHh2K+4A#%uE1IKE8Q%AAbXlO6$2JX8} z)Z*@$#4AEwCo^teP#5-ouKfr)F4q9s<#OEw&eaP0=%$pWQz<9l9W)cz=~QR=I!I-0 z*Iwem8)GWz4GbM40NB&%FN1X}k1PE2JNNv`LtfW)YHfZIYf=$L+a!Cy{L%OL=!@=) zn64LH?KuDU!Ys!sds#cHq<2vwE`?&3hS8^1(E#zAwcCmE1d}5|rCm}Vd4JEAX6|w| zq*!_Onk3jbdi|S#+`$I|p|xJFc~odq-$QPT-{N(gjyhIEJk?`f)tZzY){4!RV~TNu z!gQTn7a~8$2RTunE;@GfxHjHtjeVIFQ-as@!bUS#12?ar)aq1r@mmFlx^O z>YWvWmiE~C(y6#~Tno^9uV~fgli=v{^j8jA|6%5>+l;X-u|tzz(JO8yZUtB-uUg%( zgkGbwu8dfPH#(_P&!N(ARR@I2QD}0ZdKM5;x9hXN%(5g3(oTkWcgc1RO-<|Y(*6C( zi|2o62)$x~{cI(yz_SwP0dzm`Vu%~-aK$dlJStZ=1|HdORKoVWb!%LwT1e)C7u6AW8_*CX&;}MtRhOV z#7qZK>eCaGB-jKlq+m;K^J4vRDo1L%afj27`ZyIln)a`&q?>&0>r@2lh(z$-o~*=* zsy^qXhYu=sJLhNJ?^Bhm&ZSy#51&rWc4K-`J*?&dmS&qEoa^jDV1vijX}@{r3_8!E z1HDh+dd)9`+APv|;I0xz#g7bSRXw3Sn00A7Fdr^#zS_^&o$>$i21ErX<dxXphRt-6epR z(*Ym|8pX?BY!v$cz*0wov%$S+cy(;W)3J2D#iZnd*ErpX00u>KTT)7L=>Ng|Tcy}$ z?Sgx-X%)BAeXZvPr_{YX4;p5E`k~RL!|K`)6Hy9cF4Q(^lLkMG3u@6rOg{jmrn7$s zog`c}S=>Rmoy}W)^0B=SpQiyf2V_FV?{=Uy0R&9akUm!sqo6UII$TTiWi&ZfXHxk$ zIWs_6s ztnq!xCAO%SR_-IF)JXJjh#S|kP@ksul4zs%y>*mExhkftKkyBEcYv>cR4(`k&{&8- z)W44_A1(4E^f3zCxVJv?evQW}Yv;EP{7( zoU8rPg<3jN;^fL(0){DvUX{kBCv%%M!^gwLbsnsNUf(7887hAORi9Ofj;E>%8T9E@ z*yQ^%ZosDR5&Z<>O(_U%hf2&XviZqMC^W>L*ti(e0e`I}(09Lo@$HLe9}XIe11*+$ z#&3v11E&+B%(n50+DhVTdT@^x1r8K`4>;;si_TdXhJW?@6vumUbHH(Nfuy_zoqyc{ zcA-^y!y0433UbSd@vkYbBup`LN^|{#9_ps%EOe8vua2J725M+R>bFq3E@Ja;@6?1{V=M7X6mRT&VcMz7AG$LQatOBFx z5Ppf6;(Kk8LhA`(wo2$>VqnObrkT+Dkj^V9iw;4#2N7V9gY7N~_v`oI(OH;NdNN&M z1QDa0$XJcMkr`j8$r07k)W*<5U|ekRS?pIS-}?xNK5gM%)`O5g&WTV?Bd*GUx2($6 z{CmrXgPxOKkrt=d2^PAxr|n9sPCKupu#L9X6vii4R<*!JFb5_u75kOxnu;K zzP86TIp0KiR&3+jXf|W{SI?h6Hx1wlNy}DkW0pRW-Dj~&>$D6QruAk6mTA?DP1Ci* z-3&^Q5hXAfb{xYFqvAfct;InRl@V2{2{@^cB?Rp}?uUgU5R!|_5@EqG z)6q}--dPK*5hsUG?Xq(+&rl(@IXK3IM66NF#~UpKEyj3!wrEY)oJ`R@z@0b(Ksxcm zeICyxLOMV_rUYp(R-1r1SF3M$JFOQ29S!J?jez|ARXvG|TYQAW`y4Ff=sLa?MHt zd!RTGgo$3KJ@=_J==v0qyS=6vDr%IPilKFnR2r^}rb;Ey+ku>+JlM@MNxF=Tb1Ot9 zqgzz1A>u8VYgBt*+=#o<;k}s7{O~_vK>tOTi4TWj!M^BUa23yczwsq7+jwS99NgGL zLQ2{g65XdMc*TZZ;C2$!yFFSNpzo#4z6c71{M zye4Q*Id{|-h~v}ha(dn-fV`*el)8lxb!Ss#k`czK$s;u%*Gw`}&hkUcTfA_R{U!;q zp3xF5Y>XrefrWV;6L=m(m7aI;#>&V`^ol|mNT^Bgoq3inidyETKi5v z`~8cT-`bg5sBf>aWq>PX*B2WP{Do1s%?p0UY0mub7B4n_&e>Xx@N|B2m?=7467`J@ zQQtf&9;c8-eUPl}zkc&%Wc|T`tUo*rMGRzQxS5V(jTH*4-7qw; zaX0|fKGIr({5vO>>;Wo1`%Vrc43-LHX890o*=7=gtqgrB0V*Oj9~HS7KPj?;Kjl5q#G+qI(35J%S6{Ak{Nm-m zE}o13ePP~02*>`Ez8IcZD#-X%%Ax(0Q3AT*bxX_txaC8Gh@EYjTr#;PK9*BkNqdux{z z(ezCgn2aY@K6K&;fP*E;lQuB;-3b`g!uFtEr&;93thjAO7(52w#7US(DP_ztvik8i z-FBtvj&Ad2?%p8La@n$<}L?FRErE{Lu=) zpYmV@S#6UC?>bK7;-)P)*Q$xHnpnX;1^sCSPigH51jWhcZ&twGL7B-S$;!@}lJLO_ z%nt#|f85Xgt8q`Q{A(;v>9itvuDQQ{7HUI}_;b}}j`2rGe5D`FRA!`pqA(WDMd!mU zPE5gO8{~0;Bm7UkxpIQoIuj0FPOIzd_!Am=lA!4!j~7@-PLd~>?Sz!qLxS?ZgR0E_ z_)Jgl6x=VWVX_R0YmfJXuikQ6=%5_ji_muf8r-It(nHTFHFa-qsbe*he6RKayax3X$_LtWu{?YOAyZ2{T zNQ?ql2J0G>AnZG?lJn}}*@u62Wa@!jQewxA4Cv+8H=VOreC3BhEW{tXby>rqn5)Pa z$Zy4oAFS{NRnKY3wSaj#JD&HyQm3c|3tAY~K8lVXWdbrbqZOXuPQ6ljBk&Tw9V-T0 zxP@Q*XIJK2p;AA1X!Q5CL7X!lL6|4E#*`9RbG#AA+{A%*`IWb}s1}g4)HY90=jOd$8Tq3tAV`-SVx;4nKd%T_vv!R1v8*c8kmAHZP9Qx#Gx37Q=xp=c|c8Q(*^`E z{>mUMO-Eqt0oQ$!MmZej(H*FLAX8WPx@+2o{4gjZ`=XwqJ$SJi!@x(<>K0{AISo*i z*$M?x9NAE&4s=W)An=N9w1U+5p+}R_Fb6%jWJ~NphFJr-N=OSuZ=sJ54HFAoY{Cfa zE2gDk$mlNifxLJTW^mnC+I3;tap?9myNcOJ5y#p_kCQ`p-WctEJBOB1gL8b^mp7ds zPyr?{dIg~4euRlEAPz>=aZ-1Fhpf=#x?XeX{Y{jT=IzxZ@q%saRNbXj)RpGfA)Ajf z8qBdK64(>12y{F_lqatiPEPEwD$?lBw{s(2R9d~^h9Ggk-Qj2x{G6rrPnTsL1)IVP zE0!AiBICm@-QJC5y;PX^)&C7q;gFi=O4BeuuQ3=&Lq^8XOwI~c$RsMcKoQ1{M)w|- z&M?EOAQEI50m)RuQVcWjupWy+>AO^jtLPN^)KPfndA5d9(vDM}>Zv~NVz|%4cE-qG z70n07dch|X5`@>zo?#fop4VW10I0_d^gY0wg;)$KpPN>AF4~1uxgAq22&qjb=gtYe z3_KiqIrYFRGPs+H?kU7$uWr2?@Di_tWD$_@)~e4)c_XCa`es{U<}ZwFYYz07@$NcG z0p!;+H1V@_`l0snb#94YdXPKsC|9^VoE!#PLl#p6BH(?|4c-)W36DDT*`Gr6DUPB}Q0 z=%)OdOtq`p+o*p7yB-|Uy>FgBm)^`!9Nt+uMh85q?BT>G^#RIBae@-c4bX4|Du~Dj z1`cCp@6Mp-l6x=iPNpC2*dXh91Q4l%Q}}%kSfXN zT|o*1N{Ja}Q9)@7w%g=^w#{J}ZBR{s!4)vN?y)Ux&jDqKxdd^x;nY^mzggjgEs=6J+FG-V1`u1^iz#X>hEr!9ubIr8QmXRqei zGtdw1LW3jT8oG0x{hJ54;mu)K7jT}?rvCcXrJFfj-YY3P{Iv(^)QF!c#2Bo(n*J=! zAaM9^OVCK}vZR6n?|RPUz&ne}JUd(l1*Y;O*U1CDZoRtBHeTuE&mC46R@HTG`WvE# zje>D(6LRA>MosMfYZ*4~8`p7zNGOe1$mU{m)<=^7EWQRIY2EYxZo4ZL#^k$`f%D-` zhcORu8ku~cE~V^s4okg^k=mv>KmGEZK4W!!sJD0e?)-9J zt2H2N=i#iw$A)0PrmF+rvV{y`_Fj1J3z^$hliLK~^72IOf-FrQItF^Bt}yl6%_Kev zRK~u(RVuu_w05x(EA;Z4Z~tPP<@>dncX-Km9JX$jpTL$i@;{+vBk|6wd_4A~??w4ypDdTh;^^YvRxkFORMWr&W-%3%DG*paSY~+X@8YzT z;3H6o_JCV}2oHVb6d8^0f(Rr55$8h7i&M?|x~y`cTCkt4K7X&^!>b?xxw)f2;fP#V zWI7%pudONTNPnHYkRp8#jyZ@tX7qge%%AZVV%S= z#!IL)!AqUT44&IooNjbVfsmTxAdp&$8MRMzym*pfkhyk|XwyP4d=)|DXiSX)bja7K zp_xf*LLk$zxC7;tXjsJXi?{wrI8zF0`dJUJ3X^b|K!fgt`?IE zd@|eY&dR+zOs|$49W_e|Q4|EJNuy%*%1$FIQ^>-0J5DatD~PiN;C7hYS2e-foKB{_ z6{Tp>Nxy za)})oK-U_Kq=BpFzJ0yU9((GEeWuKPi`d;ce9F{o18|!AiwIKP7jU&ee~|_qa9i32 z1->9=z>w06snvU z?s^4Y)3RJuSLv0y>St)(-Z!9jtfRaamZlofLxBVnk%Oqa4hCjB{)NRtB@e=BY(Os9K@rkwxs#8hmc*sdV$zu+Xp2uJzXDBK?=)OF!% znN;3@T0!Tkluv!QxGkQ5(5`c88Ybt}ODB_aGEZ2afb*0l=Qk6A`BJ@jyv+Bdkq4H( zIx;SKfSe3MaK;4~QKefr9$t_SkPVKxQWWxN9YYx<&Ai!6;_wPgC}~({$lS^E7afpa z{`7$JPHKQZ}kYmx!XWD!La2I;Mnwy@lcBAL(x#{_OH+sIAo1SlW zpC7JEinUXbrlLtyi{rZ~5?gYP+2IuLb5JvVZj>WNeS>Re3G_BWpSwSvuy;YSXu5MF zKsWdEZXX)yC9TAk3U*mWs{o$Jke({XloAoWp@2MVCY0I6NdjI#?j+U3+(bcA-aOR2 zsxvSuUl^x0uv`S-&zYPW7w^j6so6tjN`Mf-IQ!<(?Oh$~U)4j8)ELD1D4lPD))1SM z2$QV)*tn2i6JDh|PvrY_hN;9?bdGX6&~l9*)EWG-N&5)Iqq(fZYH02{q?s6N87Hml zVa|naA-^lbVHqiA2Go+qV5f!g)d`jwdVq}a0;bTpgzF{Z$VoyLQkQNY|7w1kpP)Uw z<&{NuVydGzuZ|E+trF1M?LM+5A%>^%-kan1`??$T(N;ysVD@$IRTq=#bW6`80jZdQ zT!`N{S3uXk9(x(iqWk&RfS)w-4C_Zsoa=Mheb57Qf@eyyw7Dj94EJMDkKk#wer@U| zT>#7zSWCfcnDp5JB!v?NoB_HQnSmLuH#Qpc&JW*pmk5H?`SRE&;K4e`xo5V--Qlv$H>LR zI#O`K-5vq=Dyxz({i19-1?y_x`-?Zy!m1_^y{ur3=`00xFafp%Yp9S%zyHg?7~bcJ z{|0<^{MQ(SC+2pSVQF_nLI7lul8*xvTYrrPnVv1xuj>n-yHnP48`_byuje4G=W4Vg zY2VC3+VkhL()9fK95lV0m!_9<(Dc>3G<`J(O<&JT)7Sp)ciaxWseLkG1k369-M0;D z;0Hrvnl?KCsJ>AuPoGf(1oWHjvj0nH#T}aPlda{~NN;OVXIap0lW(W(q)FTj1{qW6 z6Bij#K?trKDvAXZbsU~Wphs2 z-dxT{+xwGQ=S_f{ENeas(PvH-tev=4hQ&>AD-}vkQpC?CX>BX0)2PXN7aU|{ZIBlF z$1*r{DO)`YJE(K9vrgE*KV~Ks_s(PMfAH1-<#B*HgdF+u^t{vT zzk?cRL6y#OLwI+dk*OO*Cy=)ZEog(-EBxtEHVEVqD80Rl%d7onL<~9PDpOke<)cVZVsO) zhV@hmEG1R=3n87J>%1MKg@qgRLhg)%bDACqQi7t&N0ZtbK5l=C%8O`~a#st6DXG|mAhCb)PD_w@SuQAh3q==XiEu|n4xjeLnM4sS8eJ+9V1|XB_I9t! zSfZ(eDaC=Bhcl4Ke@+y^x%LgG*Plo$hY9K~kC0!3*{-=mM)w6~U?Z8t z`W!~+0R~*6^NOj)EusFU&y6w8({z<>gru7y9NHZ7n8V~PO+_7d9j@fRsRL%^ws(Y8 zA)VH08tWWHPMoL!OcLOR#Oa`B>JF*tnkH|Wi7K=$O?h-lg`4LPtVxx7dDoH%6V|`j znE@sq;Y@rVCloWX!ql_J)bcyGGG|^B3LR*fB_}yXW=8ITm-7Q0+ss^3^s$ZO&4p!T zMAaFCZr0H0hw{<$4TAF<&2;d};rtRK(F@+}GMrk`;TI})#XIYBGiggC-T}Icsf0Pog3PiNiINEu^^~9zsE1LAragYO=B2#z~WyR79 zDizgI^^h6nk?jioxfH}+0x?Pt00tAXqU&6vH``*cZ~~{s%fT-@#!@DFhHuU2j?<>a z9z(*Ydo_Qt#tyBbQ;2#QU1gVWDey0ZKHTqMJAkK~X5miPK+;wI^5rcNx{W>BR)* z4|4K(I^%+ZTk$DD=j4TVieDkSV^eIPH29)V2v`khH`cc}Qrv`Z_jOMPH|?&6nGq+* zad#`Iv}Zb{q)vj(G7M(1ffA@Ee8Yc(2zQAN1qLYS$@IEPYbRCQF`uGURZ@J6e6!Lt zPx?$Am{8C)^y9YL6Dm5Cp|Tx)Lm$W|;g= zVm>fVbedRNphn3WjQdfN2XEJ*&?pX*NHoehj18*9p!U(A_e8XNgUvo4%8L@*CsFU| zp;@&!p~T4#-?KLFdVyByia9b%EOZCsLW;vsJ$Pa{Ib*nF zuu}9|2@zM`PEjCUMC%TYCX_WbR3o+VBrb{PR$&IA2bkFtUOMwTEWplGuFO|G*<{CY z>@b~>I8M(!-bbr;40jT1`x1&%?upHe0X6WCBo3JOD48i(kA{&6{TOm(tH*0IDS6L$ z>Rh^`BU=rXzOa4ewKyPmnf=v+egaN>0Jo$O_$UnW=5*2}I7xcvJ1#gMvBg+asP*We z+_gJa)EwTo#j&#%jB+15%%a}a;CfU%l*7k$^>V7bxVrT)Co-(m+0m89Foa-90!sfz zlD*hPk25a9yrpz>>T0H)+0B$40OBIT8G2WhSJ_+>#KGi))L6|CQnk|*)vk55(uaNoJ>;1uICnmxzPtGI z^o4-95%Rk3xs!7d%2sn}FglS6Z}Dja@uj4oLDsnTHRD|TdX&ic#JK`Hu&^s;-PVmS z(jbA^qGWc$FyUXCiXWE&5W8ZRS&}YbVUF3PI`(_>@Sx@=qV*hDcM^L{%Upubnx?UB z-Jolyo!v_5JyHBIMKcM&230$XK%KG)Q#IfM&s)iiOtTS1-Lda;IsDbCjgz%259e|B z6L6l;&UJBe=~Q)t9;JH9{7|8sLn@ThD8i#sy0)?@GhBUn5sECuFsTGb)AORcz{Vg6 zzf}Nv@(LjE{tA`oj7$_AHA7`fUu$WFkbPS(WJ%&P0dVi=;%pyRfl3L6rjb2ds>HDi zF^#sl8jtlItS9x9C2GL3yNNbg{!jKAEdu(mBv3+ktgsF6R8#e){f{Js4eA}{IF6q9{RMbo&16igBUS?GD?`tu~qn4sLZIy6Aw^;#fL!Tc@iXA;9N8j@V^LH{Kj5;|k<+=1N8d6*7WQ zx&@^mA`igxtSHxcB$m)v83yM=4_|}n$Dut}C{5ZjofAFK{h3OZ$avxg)}EA(MP>6-k2>%()+D+roZh z8Sfy02Yxc*KQv#OXoIN#wnDOx-l z@_R~iaM&2<)w-HMV}!+hu%%5w;hkI&tuX@QogXjdYGc8XSqq-=odpOqPEPw_iA z8NqMl9RWMpg%R+C2Ww$6@tkk(4pzeiC9!7W?cEvJ&X=CIJKz;piH*3V*@&FF@a=+n z?IL-?2y(_L0c3-ey6l4V_--J7?ihnK_l3&hnNS~*FvLdYdpF;7LI-;XwAUMSRHq=Gt7iEC!AcWpYgx~QKgyP z0xa^U6yniA`aI|MgB3T^b%ukz;>GzDjaKrL`&KdCmQ>_V`>^XL1CG{Rc4-ko87-$> zN?mqAN+QV#DRtQeX{*E@PO}YeR0XC;rG#RwkjGkw9g2{R9;$3}b7GM0r(h>hctsAQ zYs{DnmysY{S1@gR;<(yZ=hbecx*cSlbPgV7J5slqi8{&7yOHC31WpzvcJw&Pm(KZV z%9!2e$65GvQq&YcyHPY%GCkIc%_6OuD)Npy%vE<*6ltcDY_+PkFz18bs(kEwPxAB`T5rf%i$ez_8id)+U zF1f#GNec-__drM??Q+(MYs(b39C(2ef9FQN`zx5hkY`}{NaEYb`{CmB>h%RY%U--b zI(dC@Fbjczz?PoZaO2bM;(3+woJHw6PQ@JqDK+iin(Z3{T*}n|K?KRY!l7x*&ucrr zTu@omubv{TU_g=&9%_ZOSjGuF&GuXTyQefjcs>h3Uo+TSaq6kQU;mV3%OLSic&C_7 z_?^aQDeZLcwQU}6K=9Z8{M|M{uCt3XE}HJtUSuy0u>&6d*WesTj}KII8Q*|<#jOJB6HuRlE)Xa% zdTv}YhEE1!qE2EKDn$ePG|aZF|Rs;DRr$Nb&^MnJj0OC*1$ zZacVk2jviYP``?e&{bp+nW3RvV_Xy^i65-{-X29_7z8XlR_lER;Hs^9kWyA_S(zJL zsIr{Kxy|CVJdD#r)Hw2p%GzHG2CT%NpjtGI;x)T`QAk9&xay^p`=M)%m=1of(- z;&Z&Y+l|Y1#GG-1Dv%|K97K@@+u|lGX_p2a$|ibF#Sk=AP8z1f;5e?P6KFePstRV%g4Jj0k?Th9U9$D*P--bu3@>OE( zSTEveki)8ZwZ(ln%@G9-vKoPd?f@?l+C@UqFE(X{=~YrJM#EdKTP{PYo-*_Kc-s;* zaE6=eU}L+PV6Tv;He{~BTQ4~m=yGoC+Q$1|ZWe;zli#x2Udf|P5aU%y^PEF-hs<M1 zL0_}_!Hr098fh4Gr6bS$aVs9T1FykJhl%DiyM!DnT~rXKi*rOyB6>2n_=rIH*|pE0 zhFPb@3vPVG(s?cpVsIMo$m%wq1IL(ag|)oY`9u+l8J_55MY{ZomkxY{)Va;QYd4=N~WElr;N0XO0X({nIJU_ErL2~#M5SvFWg%uo{QMxS*X>E z16mF&WWfNT62)$d{Pm|#&HAqtbVPYWY-XKUJgC#XL^0lHp2Jhm3-by_`Kkoc$<;dr zy^W%$x(ThMD~&nOWt?t*$`vQB3pzZ5cam<8hx4FdHwsknBI!%(-S%Iu7GYM23~E1sw}P}S~kpPm_7Y^2^TK6v{pGsKx*j&FW+8DeBg%y znc?E7nHNkn;T)Ne)OKUYycMqJ7wifO;n5be0#1fOLkKCt5>>xqQFE7i!Z8f6?%06vz4Vw@Jrr9BHF zMors?W=dkQJ;4sN&60R!vQ;-_*dYqvRprx@*C@#=;d}u>8e+NeZ3%2|aVpNPIP?xF z5d2dB$I3yYuj=9b+vU46O5L@}awtDfz7`t@{0N<<ii`J` zCvzpHD^kal!^KZCX%;^{sb=w4%OotpcAICP;tgiSsuPh?)V0{J=^+_)LUsQ0>j$x( zjULDm+}t0s0ocEP^z09vhWgn{P#Qc$l{k@Y!%}{f`<2co)^s;Uj%Mo z9PXT^5)j%m*xfdrg}nrv$;|b)^Rqb)UoG97*#2TIqh#TI&o3tN3eXe>-gB|MAqGJd z-pRWk&hUowLi_RkIrVz=r*rP2e|>#E)kapJ31DU~5v5_TVr>-fc)s^D=&g zBwd#7CS60B(37yj-0@i3xFD3FecW0hYh|Y$MbvT5N=)vY3~Xu7$H>XSeQ_P+AZ4u> zTJY+1ysjCV=@O?a{QFrM6t_MsV(|><+GJsskmp>D<^YqE##sozzj$8I5XN>&4dA0k zV8y;k67)j=3Ckaw`v=H@Ujlq>mqu{6J@Wb(j3DGEC^dcMxk@`X$`|6^8zlt<;QIlZ zyal~}v?^p=oOSS-z^0&1!Y7*?y2O?NTAZw-i!(=r(CyG6hp0lOWf-^)HgWPW1#u1J zum&=f3@%WzBOMx)!5d+7OLXjN(W~9AYj4LTZ8F#g-*Z#g;_$8Bkh9z&6*zZGqTHc4 z>j=a9mw$+5@Q>e}T^*gCy}t0@zP>s-Il4OX-(Q^ifBX8MUqah2sjba6HZ#L&+t%AV zkAs_HFM$! z|EKrGmtTng)<4H)kgUBJHnqB<7!!cbzl3a~-U*5av41u;L*$k_ zuEGEj^Q{JxI(api9-L`2PKiKIUIZRBB;&T<0ML3S_OB7oH{D3y?yTRMlLmbI8NX6I zR%wRz!4XW%{NF@0--Hr5<1_l9nUcRlRq9G9A(Q1;%J8Grs@hcYDjkH)Jmc}Tmgk<2 z)=}N#Osl+W4^TZ=S|%8M#aG-Qw550;KF0b<WYM4!9*1hHgaoT2+xdMOD{l??` zZNq&A8?KdFZO0uqvbOYj@}8sp4EM_Ucb}21=h2TmIf`F=J9Z|k{%uSCVq3DPHV{oe z!=`L)m%jCFg@pF2v5+n=&g?YVw^U5YQjfg|?q&HUGMd#vC5S@RtbwnT{{C9rMa(o6 z0R<#en4jO6=H|~nR~J`pey5L$8unPeHk@sn1L9Ke2TYk!jJpgXvtYN;J#8PSdmaV1 zoQ-#Ys(wsc(SMjH+qrrBSACnucVH@oT+&$SCMw;iq5eMihg2F4G0Whq>){)2D>(!B z@GtO_(*eX>oWx=V#=W($nH8lMmzNEGUs!Sv_YqfBG>F3dqMO-bMvi*hgF{Q5VslTn zz8vR8VaHtW3(D@`GHq{zPqIh1!J#!#w&l~`YEb8#n%-l^Z5Tc4-RV9s@GwhAd)8-^ zUG?$_TmitcE{H?Sr-4a21}Ti}L}li*q-G8%C{_}r*$8NAIEnZX$o%W@vT`c_#qSnz zx)c&G{B8Aqm8+LkW#96BFrSQ+>f_`=@pF|=bDp4pYClF#h=2LV(SN+Zc_v5o4pZyb1b337S=26+v_VV@d#p|oOeUyS1K0qz=Dmw5?FAa{|FkLio91ZV` zubw~W>9`i>*o_Zy`o6511P#7b4cPxk{Fqir0#Peke3mi9%lEG?k1tNouTI~cH3lj! zazSfCu3n!V=@Vk(E`noWKM`k-s3Yo3CF0-`v(Cj8(opy1&o0lIa+Yd0I=hrM0(@QP zkU$vJ00A!bKef`W-4I<96RV-&_GrSQ9b*ZMCSQRQx?$Nkfc)eT zC^n0;kj@Jdu9du_I8I2A*fLDyrEk{Nz<>AVp-96HK;l<7FubC_z%uJ=;^d(WJ<*$X z?xjSazruCA;4~y?z39$E5sZF-U0<1LU4t&kSTn>%A<=XFb@+}ht6?KaOK;RxKp>@e3IW*9U%P}w1-%s%co zUw>LfqycsCYa~B9O9TTfRGVdry(GGel3qOAY9~yb?`jwkHL}NZPO(LpgqUr@@)bb~ z_}0wvwMATY^kqk%I{K=kPnHntW$UDdna`6}b6aA#pD(TDbJDWfR(g(XWK#!{M0daL z&Pj$JgR;pq%|y-VyH>$edy?V|`vO%y*Hr4J%2cUHF>=zUAP=>WICE%I3<_TrD^6%t ziVZQY9lzq9$N28NGP6gl_~&UAg;p8nn!ASd{$=pVw7QAQPVmWJ897D=G?+9lz4II% zuel=C7XQJzBuEWPtF`df zNcrGx#TEZ1fDkmS!%1ZTC}>g3CQr)0pa_H2G$#YOh+Lh(e4{2L_T}xuXe*TB4LlUJ zujKVdrwjRco`uzl0M;qbWx)gKSs;FwQ_)&-?C-)&#Lj(+e?|Eh;H$OfPY}EHe}We^ zZM%cenycou;v@Jw*PL)LQ=DlQHMvWVI1tt_gV3)|D``N~!bN(3yIF*|lnLx@6C8YS z*z^Dm1js7Do0bVresYA!Lb7N5yKjIW+NZY{(zyuy@$u)r<21G*?1`C!Zf8+YPI`jB5sC;sir507gdaj%V=oZ<0L`OmNV@-@y?4=)+eQ*Ze}zZ)-eak^l%;2PTW7j=Wl6TRt=Cma-8*;e zLo<`COm;CzHXrrqIsW&HhyX|s1o0qQvU|omXWObI5D@?Zfj}T0Jn`Rr9n^n8I7&aB z^IiZIi_6@L#vW5Yd-%T0ICla(*{^SI4YL67mPQ>l4l}BkpIF%JewO5WHfrnWaRKqa z=MaLs8TVg4!($vSjD>BzPL6pa-~Tf$Z*|xlfql%-@CyvMg$RbSVqBKQw>oeIk$nQ> z4nEh4^q+}4RS+}_J|?`=dc);_T?R@`Cx+O`ixhp9?hlt}<4KhbicPpDJ{LSu#LSUK z{-04VP2$3xq9L{#F=I3yjK;=&&X9zdJo!ZLHw4&1D0W6ePz z_g}tg^f;W)Ti+XnKS8`|q6<$pMUg@MpV>%c0Cw$qJ{}o>0S{z@=)#<5AsRq1V8V0> zv$1r&P3)Kz^&FlT%inc38G?#xo5pdH&qgzV;3ECVjcO)G=Q>v`4YoE1ujrzJgleV6>|7L6p@9XFmw zyta$uVK@sFpGO~^qRs2X7k<}g`B6B4>pMqz(Hz+g9Ktm{G0};u^j~>2=2KmU?xOf; zK(DCvXrLQZo+TQI`#C!|EHOs@L6t2V9OkuIvVpUOGG%_e=*TYr*q*qWBd`$j!VcNiSFv$1BRX?|X84vI6f zj-9!)_7n)!nOi5Rc#eiC5NZww-O{ybYyu&^n=ZJ0af&G@n)(%*l@*Roa}4NZyTLrs z6IAg0O_$Xq=!#E6j7HkVnS`(K%Gb>>#7KMQ4avmnqnc}-F-Qr(mS~5|cvztQS+@_&zASqGo3Rvmlxc>0cf0?-ANG^f) zP2b6+ruBKCJV0x*N9i;gjC}V5-FGrU=C#>GZL#&i6J=kB z+KzwN-Y8mFL!%Rj4ziQShe3-~U^?itm{Qqi29yp~&^~jZ_Asn2_3*fXkX!$TS4y?e z!$TCL#-@urLB^Qc+6{2u)&(w4%kBbJ$>6S;IBIG+L^xcJ>BVbHQXZ0HQbk#4z9gyb zjP?b%RF#nHZ~7H{+{jU#qio2BsG1`85an@}z(mUpP4^CLSQqDw6GYL_WHT-&El~oN zXku7)-qd47_q#ApuBV1^Opf#qshQE(MM+1ptk~Hg^8DysTRT|O0iuGPIywfzyRL1} zlvK}}85d1wDq@p6h|PHU^vGF1K=BQj2J}Yc>x2Cbcs$25-o#i`8ym<<`~> zZzXon%nXhTVv`0m1ghy{!9aP={V*tfOb7ZXx2w&OP^m4bqX+nLq6DEXAW1Ye9nu4s zrh|G|p6)WrCLiAbq|(X?&o*qOl>R!U=%-LWR@NYy_&!Ow6X0Ck{qw z|3c~js1BDLp_7jeY-7PcmpnRf5KA5%IEW>W4jjb7M+XjN@uP#Bn47^pmNK^gHTc!> z{2$Emj5W|&xT@WOT{Cx$NVU$v0yk{bkA@kA_9|%zL;m2wTG-cfEM*oo=iFegnH~gL zFuh1>Hk(HTFgG?SY};Gid>TGVb1(`_yGJA&rG@bx2`%%>Q~+}0QIVm>^4ittBXsmvNGro4L2S|3Od7S7S#*=23rU>$pHN5`X|=R+4QMrlRr zq=7njJiAAY7j(!5f~h^~Ls3D#GBjL03(ljgPUIBoFj|p8eYJesIE535wx>6Uabk_> z<}?g$oa|}lwT1|ctHBJ4Bv?_Sq@3aWv3zoz_*d127EQB*x+8Xo5${xJ8|JN2y?CrW zFOn)xvUTQEryMMrvL#2qvI$?;0pz-^pk`Q7!(8(XF7P1?vu)Vs{16cq!XIboo;UekVHzIR{as~0vp{Pf^7n+ET<8W zbHpTk?eXZIqbpjcxJ4(SYxiVLwggRM(P+%@GA&6b60D3Hjx(f;+c*(wNc`Z?*x_(6 zMy4B^PXJ#f$mtAI`2Nx!G6Co4fg0uJa)Yh2_*fY(iK3;CN zfOC;vW@&TF;bx(CxS5mT%gHSHij%=q7AsGdHi+GsShkR60!#YGF-Srdn4YBAa1 zOX3^URkufIK_u5&L0nUALk7dkq?eCQ8f)EmrW!h6pLDm;NHwh^&1Aa?h;IIN+WYi` zAGChwl};2miVyAnnsWctoEa1ToSNgx?`1>dS*clKlOv|7d2X4!+i(Ja{< zfEzp&bqdO))8TlY$WhTYQNE6e8dq{Hom%hk$(AFBZ;hf<+sEtbh^D&jPh-``6il^K zBL&7pnqB;Lk0&Hjl!9KRQFKl|o$U*Tt4Z^u4tUs1kmj1FCH4^!^zEGxeT!2Z?26;D z$f0T>V*rF+yFJfq;)o|MA>)8X^F|y8Dr)W}*2AZ)+2_M=<2&#(e`_nmM~z9pBGn*2lwjJw_!_60;PSyVUKDWPHq`9kpYk1RZ2#V zLwa2S)&bv}N|i0shP6WMB77B~+7MoMxFjHya*hU}F$u3J3h<}6(JqcAW_J?gCoB`5 zD}<`>=8F&w%8yADJMOD~z*OHD-Uk%Mx$$2NfD(|EL#gmR@j9kHQMirsZx9PRbD$7M z+a&q&v0^~(?7?Dh%fT=i$Lki3s#V^dJW;4xA-jPstXU=(D|_%jDMg0x$EC<%&gVlo zI@L0J!8%UXGE>_A1Xz9wxIbDgN-jf?2KzTt6t9@h5wI>1lZnB3RUCsCuReUgG1u=C zq))qpiWcj-gTly#J1FblU&>Z<9zjmm%#OMe zJl$dXk5WB%P_&$5B0qOG+VK5sM+Lj`VK>dLd}*zv?wBW&0~#)W0c<8Znfy}%hK`zngr z88k6r;`@vV>p+_(tb;#i!a5AD6V_pyKVfX1pm;Q$+1A}z?l;hS#=eY(YL5#h>@ovY z)2ll!Xt4PVG;OEqxL|?S9!NgyDat9^i@J%-S5&RQY@Sj>WubPM|VgC0>^u8-^WJ3X#6Umw@US8tzx z`0(nb9%BW**X(W@G9GtAi^{Q9tOLji)mf*4_8P0J3VPgE;o8^II!T@dhP$b9Gar#K zB!3I|bpt@r*AvPlTmxr>$yV~8cj}fYN7n%7@AYt_IRdhz1bP2O?&m2oVb1%jJ-fTJYQn~@6TR>PKu{dzUxgkY`fq!V|X7o zTvr*K*Dt3dji)7jaXh9?0RHaz?gj+jac~&&6eHLwfB1T%_m{NHU9z|6=`KhWw=_PAM!baNY-#~_Wl4}h0@e1AV8r{03|{h?h=II zx>fM~Ie2~g9#no(4P}}IYIvIO9xJ39=N;t{ffUT?TjmHJe-oGhDc!-HVB#xG!C+DF zl8I2;eOQ7@Zyr{#_Ivj5q=uOf(;}=CUuC+uP3*Rwga1YLTvH{$Cwg!8ot;VfZ@B0D`n|139b(8K)H(Qpe^IEy91<= z3Hg_SPcw*NQ;q^HaXx4Dn_}O;Om&b9R-2k}XA<(9%EjK}73^(V@8;t=vfduZ&dxr~ z$5q$O{D(weWWJAyZy2xWxoEI76C9;cnujvX>3Tj(-cCu^s7y~UA8a0;ateC!3I}Gq z%KZ;y zKODW$-4V|m?}A!2C!ge-Wc2L~`k+S&)uO$(%-dCMeF(0SbbnAhfALF5 zUu3Y;4}AzQPD)|N>?LH`xOsxG9gINghOJ(ZT(iN$1m{I__u>7Uq&^8A+|P@9iYp*A zt6g78K)Itq31>I~k3m4j7#prtxa_EVlN49> zmFjfNdR7jJ;IyUzqo7^&iavEaAGdrRi;D;JnI&1}+shb;k4T;H8|;A^m2k8$&p6zB zuV3NyFgX}P;^X%)b{6y)jmckd3fINfM*ie&_ea&l>*asQ-OP$M##sL9W|n_3yFP?b z977%*K=6P6=ZiP*KfnC;{pWWtKmL38{KM<;`OB9dU!9#j`{B+HcYeNe(%U&>O@|k6 zUcY+xDSZ8M)Vxl1Rnkm%IeYcuBr?s8fpjy~fTc?~MQ z&GIavV{cT&d;kP?n+Vm-=Isoif^P|ytJ||JEayP#L?3)Yp3gF>P4J

lF2F7-8LM zI$w1&@zn|Zfiv+{5an_36*m29f#L(C!7CC(lcfBqoMtRw;+vfS#V$p4;C$s*f0`cw*udu6hOE=M1A-?x?riwY}uOcQo49jA=}Yc ziih4R9)|RzyCCmi_Lo}|V2Ved0Uk*PJJWb7K=d!8*Z|i^uo8LL3srZ210jCb;eLcQ z;C=jM5$A*8$tAss!`#f*od9B-o}VX>LJJbzHdjeP0uro;0l1vYsJLV=c9?Z59x2t? zaE7PtrEpk~F$siwz?2%ph#X?#q_fj~#p#q?W4#g5Ew47>Sh&_Ly9%1%!FL~cw0Z`B zqwoifeW`2XxN>~A?k=h#+8yHUY9VQVeDFseP&U-k_?=Wy$0P#AF>5YLm;mtd8?J)! zn6Zv)T1dSZd|$h7i88e7X6^)8Ur(fM}|bq zeRQbUfp?jN1U!VT7(&*~s7h;GiT{A4sC=;TisF6vk0)^0Zuf%1>wzuh-n0q*$ zUPg?>pMU;Y;@7-xvstV zE`C7S-h_MC_(}doYib-^LfWP%)2wi;GVqa7k_2p#@X{pJCvzN*8h{O@1W+jriY;nx zJZcsO`TlI<5SFc^>T(;%_eoTC)*H-_BVJ1TA_?$o=X6> zSfznRjR}BTj5UbiDp^#U;1gIDkI_xAZL6B!rAZqr=)c>xGpANb(^iz`g(=WU6yI=9 za5|9{o+v{fQ`AS!w^G8I(J&wz$d??1Eg6ofR1h*;zdYL;Tpqq#d2(!DjvHlHn&!Fh zqG}7b$z73UYz>NPYWrCGk@}omC%d-Gh%P0AsonijFlHTQVLw80VB)Hb@W#h&9Uj|! zOf!O_l?P|vC@;ueaX`Gy!EZmc9naEj*a@~P zcMTNQ?DZS*BhQ;=)O#L2e*8zB-ox|G^{Lmk*+p866(K?VTxE#&=U#ezLBs*p!*{T1 z^(q7iSb&#eVX+|EGHEBl`l`5Y`Vu_iLe`@S77+Eg^jtFO z@M-YKV&em_&$s7eqC@X`M~bJPryNdF_k=(4jG~A8s#EF(ao(JY2!k&%ty8ImoH!Mv z(fTtC+ffQ#xOMIoqxe!&&a?~gzpz!pL>c#GJlw6ei_3?nLK&6p7I-i(mci2DBkqsz zwBjs~$-x#f3)AU{Ig=3t!m3NSphKuO>3511QlwZ`)vu}i)TUFEq5KQh6Xfqgk`}9+ zrnN0K^|&sfn<5J|e6BIlejx=gq4V%Jd_fixFr^XeLdv=aI7-R~_&WxGEZPjTyhFY0GO#kgmUjNQ2F%#tk zNSRt)wwg!R-|-C4WX=c`HnT*oAu_kz)xTQV+})3sha4d!s}z1q_9~|4UcdngrqI!| zxREz_Pu9_!L+AwH7Bj|*X$&GCNPucs8|#^^&00N)ho@tO2_z$>9RYRuHqE?ZMt0He z;EVzrdjL=K8RHP0+(+^mH!fcqau>6+QgkhPP#$$FUB~F!X8}7CpD?m|G3p}jbR3X- zrloJAG@E!Ehm5x4Y%^AR-%6AQlrr5)??iDN7pbbDfGbgcTq8Q&8uM@j&8;pcM{>UU zst)ILy=65js%q5TRaAPeDs{QFHAV2ZyP}9<{q>aRa=q28ucFdgN>rFlf1Sz?H$7KL zoY$+le|-J$>EkK)kFoa$;htqS=ADDLuK9+kz2sjcS%>?K!)WK=cIPU2`R>e;aJV0W z$$;B68vAqiwp(f>IegSB8Vv@+6|c_lf`~R794WqncQ#t99ihM3lu^#0Dxov*n@0vW zf{7L8X!|Rc;=FdLxHwAOjy=FuMUMjP9@G^3DmwB&lUjK~n?@=?u`fh%wxi=vx znp@K}adk)CNl>>(m{0M8p1NLciFPhD*Nzd98me;1NKPN!rpbSu&e$bnyhhX5@X|sW z`KoK862d0Wi3rb0R?%4aUP9zPwY{+z_Ews3S$Bvo$tU&Y`(T^m70|G#g-Gg;vcl{WZ$8idYEXk>j z1HynI;Uccx8{?9vHjaXgfZo;U+@b(K)w3=1@xjsar?MM@yFc7%PP}6lp zYPND6ln%7;KS3G2&OJuVH;)nb_CtZ0=4Zx&01!#T&;s+(Fz_UxXt0X%5kT-HQ~Jg2 zgd?iUWQSGTxi=^BNrbmmZo+4MK0beIw`>3s-{9t6g~U`T+;3YKUB*96y$-8h5=Rt# z0xq5*caf}n4g&#vo&)I-b|$R;p^kHvGXXpTa5f2SxfbE4NIs@OcwisCUv?DSg|ml0 za&WiidqK1Z@ze;X4z}Uj3aBMAK`9CD{y+Czo&iMB-o*R4O3DwQOVGI)Ikf1~a~e3X zho3gdaTLWoy~&|@=y3dU@#kMHW?hN76E!njMdr7VCI~{~gSY~&px5nTc6oPJJ;d?m zoI&*9)bD%T$UfZk+$l+ONFYA+O%q3ksnJ~Y(YC^fHisl%V!l_&kR`}03Q&Ggbihhv z;5oL0Rk%nE@vQPlix^!C=|mbe*JRYl?dUqBW*#9a{H2drk;Cnnkz(n&@ie&m7D&FQ zU?twekol0G9LKGrlrkdkX4rt%7a<%BtL!>Bo#b8T%V#|y13stN1)h^EUxzd}H~`>s z>gH22YcGC`j`QZom#`T#M6wg+X&^3VO_8stRQ0P_NawAHf_afZ?5MB^L`|WPUmyi3 z`L#v z(0D7~K%Wgj412Sm6Vtr}Cad{xo^M#)7q zl$v4Dgavm+arWVzPDMrELi*-jS5$rSp1v>Q5oto|?hvClyomZcU=2z|)+TQ2hs5Y2 zrc%k6S%%wvNFaP`w}Z??1NRUl`#FT49VI3(1ej>$bS#?55>1?=!epZkn#VhD#om3< z-Kw*Tg?`@ko@-$m5>q9(M)AaUlMsuRODtP(-R|^ujl@^1Sf01@furW=CTvINtINF| zo9paIW?MOjwkE#SnDkQ3@DqVlrY(T;2CidtR8KLe>}2LWSv@ZhqW;7&An}|m40-1f zU{{B9*NZ+BK}^~0CNa2MCp#5qTSD-}#PUNJ61A2s;g~^Cl~I@5kben5 z3X=#nYtK1-Z1D2obGfltj-*CL!f zW4L(w8JnIgSwI1sItF;lxL{iyir9x+u=|VmAO3xUUidU;^xwaF{&E5&e3}FD!~3&O z6CmN!9FQ+xy?OQN)dW!bI0x)^ucioPUuF&c^W?}se{x_Yv2Q}oARes6lhcDIT0Ku7 zA(%%G9t7|I(tFtrN5Q_%nU+Tn9tJPi2BjeU3CIuUL4FiG-|dpp2>Q_+(2p6>Zwt64 zd`O_gDwAv3%@mHu^T>bv;7RbVXuxxxoC+qvKbZsm30ur>qBsyvt`pFo%v;qbY=S=L zQOh{B!Z_PW@DJyKe;j;URNFL;lYAQX<9V=Y-Z6RUH0+s^{uEN{vF(c}p0kU^m1%OG z&O`DwByKuq>a<~5zn%s9;iKR~g|GT4-WniU&oF?8vv${0#+t9er#ENUurt!QUR705 zP2qW}W74qzB{3MH7<7}KLNlHvGvV$8spH_XfyQvSbCJfQR2mU2Ldreje-X|*B(-|! zP4ck&<_Q?KFOzH{mHbZfhE%E-vW6jk4(YR7Ww#{XQ-;T=Q+}APoyJM0ZiBfF5<n*B$) zD|2+SuF5a5uRa4BecLQge?|m4r9M;c+x^g{uiJea`)%9BnUscoE0q=aY>#RwxFmqX zw?po#%UGY1N3x~jFT5(~(X$HnceQT6gclR6c{)h0L=vBrTNMHQ>Qw!-ODMz@`OT6t zQa!NOA4IIl$W1gY!|sy|I4x}ig1yu;(~)=%g{;3YeaIf&OZ>zFL5;ZZ-0yX*2i^x) zZJ`DLUkr#);O8@cv%wGJYA4l|#hsrabW<>1AHmDBiT3IWz)$X}3B6nw*U54S*7@X#YVSb@pm- zdT^#E(yh&1gi&&;TT46jg|lKUXZ_Kf4B)%Z_@|D?^tmurOO2)=T5m#$oLMtET=n5b zgKT4r1Q!ah-R}f;C5&@Ggj+bL16e2Q%^#;;p1|cpcsHP><63oE6&gCWbqs|y=V&t? z^x%!MPFCTU;Md}nRQR_fz|*NyoxGxGjC~M|qJTz?k3*EGLm-^rU%&5OB2J8{HFyVi z3yXwLVBiT$uc8z^;u$*jJJdr&2SY+&rUJV9l90;@6QpXx5?o!hm0FboZ0=qeN_a{D?qi=EQwq_84J=L3+@i~adeF*?&Q7HN za;u-w6qRRTX2&tPPy1h^Dg{q2*5;H7Uq%g6{kN@Dr=5_V1aZPPatvsTJb=6`cwAv!s>ffOEsL}tq%>`RL!agwr!fla^LhQSwg0{ zjGa$)X$BcbK^aJg^*|c0cDS(;RsJzGJXYFJU*9TtH4dD`~2| znU?f*4_{P>2fR#Y0tftnEhg%5C{B9s|1RtbX^hi~30fwB0CqC2CQ?R|6#Y1PuuR_( z@SPOjWkD0{9!!arbskIUMGfB+X#pK_GE47+vS94JuB)bX3kYG0~5HC-mxXnza3W0JGe^bvIf6aYzXe4}8xcH-aT)4qJHspGxT6jRA z^V$6|x*DY8?@KH1kj9#S-N4rX6r1XNR2h=?l__1R^mBNO$`T@3M4R6^3Q2HK0-I7S z>O$wi-_krTu4=~}jonsE>;Hji@0fDINYyl^Qqlf(`{StO>!02mWtCo{PgP%j$B!E7 zAM*YoRN?s*)F4?_*g%)W<}L6T`F)mR>1PjCeUMwD^kchjAew`P}Pj1m9JWsK&S^wdkbi4I4?1X88ZLXrWb7? zM959%yl8pB;Tu=|_S1_gAkEGl%IB9;P}fj91 z^0|^#17&);Qp zM4AAyut&!-o0;PNOdEC7A+sMC#?YYw(T4D$LA!PH()VNO!-;UP#k_E$A$4<8!E_7z zpTo6;-u({%o2e8{C_)NB6GwVN@x1sS(&TLhy_v}P(O#25Tbm)tB8(kNqH1?o$oYWx z+3BfNCJuu7htYFGe6#rYl?-As>x}&G&Nc%Hp6d<0q`@0PnC9Uz&9aor)A8*&ppnw~ zZXjy;G9lX!@4Ol27>cqqs!39g@D=5JbiA)KHoS4oMb~%M;~Oflkmp!*b*PQrJ;j&D z&ACv2^knhmrW?9mv;W;)YzEy7^KcC+*k-q@Hc1XI;+|-<-JQ^NZ}4*w4geTt9{Yt| z)fdNU@882+Xv@-Ff`y4jujraN5Z*36fK?9}%{X~ek1>{2Dh_`=Ex1WGQZv(rYWQQj z2~^j}00?)AZ4avH5H)Z_(lR|5OtYBAE>glaD7x*~xbUDq?bWr>ty5SE`Ka3GH zIW;Xp&=)@MJ2KDeWgm3$;7o+-M;9#UG&xgXK8emKumxBWe-F`>RqM6LU7hBqY8~B%r z{$mDB>?7zQo)=6-W*}<*x8(@n2qt?uuEJ84L$5$W5F)(6IS5+9K#EqH;3Y`c*)WCZ zGh~O4g&aK`|bV)m|u0;mn0I!|-9p(8BsE zX8ap!`zXC_n)d9ORuTG4b#thSrpc1!$PJKew{gWgN~3Lb_&hWXthyZXqNJ!N`SB9P zpSwUY%r6p#wNd7iV25Gc%#xs^>#1bA=gHN=@1`)pA*LA<)KG7BM(h2TFa{R|VrTh5q`Au6AV=P2mEhNGQ%52hGfY^>} zD1fP(MQt9PADT8aVsA4Zn%cwSJfs-O@VtPu&Y@&so-oe9gHhWQyu*gNZ-(8SB;kkz z9)U72M-6H`cu{18=1E}P?%1g6^ER73PaMRYiJ~q^wdv+5iXG>r8*eu$QS9{6z&eK# z`Tnnd@Tg%lX#siN$Sm(a!|Q;&uD0Q;Z4H1kHaBd!Eha1gOD#8DONX^{0o%=n3t&#| zJ}b8DPJ_-GsOLCQuI*(<25%j8@{cetoUja=yG)YjXu1jW9Z!eQbwnK|=P>~Yu}RsU zb(*%RE(SD3+pw*PUTw4Fg4EwE9Hx-sQM&{y0&qf0sJ89-IY?!ZS0=PQ>N3P~&rR3U zAE~1qV1!a%-qOsN6rp8*4I6UjsFw>e;r`}{P1nr@9ezuEv1xjllxsBg;EuqXvGqZk zp_06ia4T3}pd}>yq=AIp^ASow9Q>|&on+3&@4LJ2`&-sO1|p_Q8x@L7b`Ct!_nL)? zC(QCjCU-PoLIL0~oMAgF|B8Fw3k@TUD$J8n}v`wn;Ds^?Ye5XHXozT zo6g~&z$az?UJLVtF66yGp3{**>p2(KL;+CE98KLtC*3W_qqyZs*xd3AOs7tB@jdIs zg)4<=A-}@Q!p-d!m`UlyNKuS>Vx~R27&UEQ2i)EklVWnS%gxT~nJew6B}#+uTmidB zBPXsOHe3_S(CwEsw|KI+I8A6MvHDFI-o_jsOf*h>k6)jj+>(L3nq|71F!Ye(;z_TB09 zOlw7D+?$KuPyI#Xtv@Q7aQ5(Q470++nu(ABNFQ3}Jt>(;kspmrWE%0DX=!$LCh}@ERY3 z0FMTCFjY$*Frmd#W%zC1?4x zi06<1zikvSp6)Uj4i*ZVLp+xV1&o{31f+M@WiFre_$BnY-B1=atMI*?o3$#kked08 zf@?=35GI!eNZ{xvnMe32SEP%0rj5J|8*OD54Y1GTXIh=nENL1QbIrm&rw}A30&g+k zMf>@q=c-}+4Z@pAIo6eNqMPj&cy=g@BHL`+>|%pm9p5YdjtPS1;Ss%^%s0@(&!9D9 z`1_>!5~Bw+UW4B!&8?4}JY>JX=tUkGkMWP3>uzNRdc)#vPXYhxH3#1I%XyPPFL+;I z4hWIg6in5K8$2fVC>$~_EcPH+7zidFw5I|~ot9uuP?#0*;zy^sp`;5Vx`r+S@>_w^ zT+WH?GN5#uMenUWgTr)DfbIZeK%Bp_*S^FqkN9DfWp3s?=Y45R_{M$6bt#oaz6v$3 zfw4lI7I+#@fc7XoHvo)L57S^N_lNi`C z!F5fkL;)E5gOa`A-~V$6mcGbvx9n(0qI?SOF)MZ#PymJJbb}PZ0+$M#H`PK{j~ZJ+ zIW^nibYjd=({*!W4!E&PkGZSXND%y@D(d>a*g92GX6X(+g(yq)I5*>T1c{bS^lqEu z1hrO=|LHDrl#I3jou2%WZ}J$j#h-ZGLFWrP&UV{7k6O%`s5m9pyQJ(~z(ngD=f~}^ z)_d_zQ9sde=))&`Q9X{x)u|u{)nAeVDFVYHOl03%*WfR$YuT7uLnOvTQD+`dF;n%k z#op<*kyjAm3M=hKqlTp|%P0l&`Kvq%GFVCbSf5B0Cp!Fa z+y>`KgEa~jGL+o?a05dKAwQ!H2dF~DcgQ?J&pZJY7G~TzoQWYy2cBEFFHG27cZMNc zOrxt9qP@ng4bfVLb6_fLMqOtgOdqjQQYAN_xfp#W>WGKbKFm|be}>YZzF>7 z4cGw#mJK(8RXwk zajGM#0eyyAffMN%{NWCHR9Y3&W>3@Xz86NtW+_d(6@%6it8A5Dn{ zt*s6#Cb%Wy-gH)KS7jy1tJJZ0imkK>LYh)iw91FcN~?Wkuo%ypsJ^grO@zLb)@Hki z>CTzkno_Cw5YUH?c5rENtHy4Kqw3Kc@IbC9+m~$KsRo3 zr$4Ou!-24I1pKy1kGMl2M8By;+#M7G6-RT3nt<3j;GQZ_Pwx<2CIO9yi9@;qqLm(J zzAe?_dc0*w;1lEFVz|h^;AQOxwfBUvEFgoAdNpHYP zBw)O%+Jk*#1&JgXH?)p%?3&ml7LjsD<9KLm7)StZn#*a1S@Y0WbJklgTJBeu*D!J3 z?`ocJ=F_ud%SEc0DBt<k7I5QORYx8@)p4_@xOQOv1;su0sb4#oX{o|M9I%xIIqQ zk{o%O1bw{sM7x*?oykpZ46?Lc?i{JLCal$|zm9oH_1Ii;c#eBold)=~m^CG?c2OJ> z&W`)JrsN#=bj&EKv9-9SW!1@}$xtz$q~xY2CF+@6v-!xOvo{F0RO;rZYa)GsPpJ>J00sZnHHUKc&h;!TGgc|Ne#a7NeEHM<3@Uh`Pyu) zeWqw4+-g>$dv9x0Un%f}3YU!V@f>NEdQkjAEHuhNFUc|Fm%ZajzMgbT?$#Kp6`dJ|ih z;71?Daiw^28s{JT)04o6BRFvPfD9Shp{SdHQxn`}DqhA^-6VMZq5H9@un}Opr^gJR z=it`Zt~o@f4NKKm=TGVx_Mezk4%~fGWoU~gm1FjqR2jEsQaMELmt6E|3@1}(niK|W zcmdn`>G@4KCA~)ye$yT9-fDqJ=KE!|g5OM09;T?xEnQWoQz|;cU+3;`P3z}ix^;O* znT)<&bd8z$^x{MYULY+y-}}mFN+GRL&MX`_Iee=igd|EXZ5&i!2VW6~Ti0*K^xq`d zuUvvDX{3z4T&5(~zX``*OgR4P#GbRUX(Ls9aMv#P@IX?gWs;?NvW9;7ku3`wINQ2S zmF{YY03s}bz{0)6xO1c}NbQteYT*}w!kBeHSWr$s>H0@o$@9dh_EH~knv zwzd1i5F?+)I=#d*t6(!F5Oj=gq{!ka-?a_vu7on+^30q8T-72rwM zgHBlDO2Kop&0hj$l*h#M(H@=lX)XkKp`_4h8vJnQ-=NcR!&+AKE>ro8Q~pggR`uybHAqWZq$#oP0%P zJ&J}W%J4ASCXMMhI%eVDi|rbx&@ubLcDj7dQ>LQ?$1GqtZANMnWB+f~opRHREWnN3 z1ju$;vWx1bmdgqG`(jM{-3}5<7VMG{PCQ9W>%W&#mc|rWXJ)T!S9TD z3XAmZ7_BZo9RQ2kIR+_#*y%46gs8^Q^dL!5)<*$2l;GZh{6jbeVBL)9Z}j&k1880} zU<56hv`SQdL1!9ys$2qtkJ$zo-a})cLK+9csXh-R}sF0M6*wnf_nNwhog zx1yX$H*Hooe}4f-gMq7mhcPJ0rYrehoIzVzp^m0aeG*wax|l6Gho5!f z3cn!BJF{fsnJ97P?6c!wU`(!IhsbL4En9)tG5kt_g-Q8#&8${yHd?1u+~8a|#u19s z>`2~q9q$ZlRm4RLNf-vBRDDyW_Gn^KOF9bqZ&8hu~2?aEtqrEuM6ebw)gS2o)weTDhBuFxg0!E%<&Lq z=ixc~*eohnXDF~}@t>S1duZ-uEmEjAn;J_BPFPx}ssL&j_tuL58s9!A>hEdWPE^m+ zKXZP8`gz8S#dJYDamjG5WalOmrfNxf*-F0{4Q%puNr)l$zceW`3e2rd!mJu^YZEcA z$lBUeEU$BBe7KoD?)j?|qw%;+^8{QGm{dvg2$K^=Im1V>fpe`nsKp2vG$n?l8?Jzs z5F?LpIYk3#OUUAR{FhTC04E-4@T90JRQ5%O*`giLz|bw9oH9t_o~$zH!kK z#KQ?&aCV}%RpO93+dn&QnP5Im%*!c!$+MtroBO<8gf5QM z*<}?xEYqCw$!f}UFg~MW&}IVAt%eVOV6gfce8KCWU?b~7i;#JAAWf<8+=}7zL(e=! zqJ!#DA?6dl9D~!I382|8Q%9sIw#UobM0LOxuE1h5SjT zakO7Uhcbe+MO^n3&q>bqBx71Oe$swjHW-x;>^GRmuKp}&*mi+(gGJp?{Xr-^`0Vr) zrZR(HpFMu?;1O0L;Hy1FQ(}_2C0vw$z$7T|f!W z$m5GJSf#*EDt_r05kWo>R6v7Z;*yT%6pId3!3eJvp(vN~`Sa_SJVYVUJFAgXA>Rk+ zWlVk}TD%)gP0`Sa33Ur#C{n3ut#N@jR;uhvQmUg6Whpt!tddV(WsII34XgA$B#7vw z3NFzIkl40!%B7B>@#k!r!z?sT!{Fymi*DZ(R(gzb#$cia{Lb}E<5^@H!tD zNLxtNk12t`B@tAGBB%?{aoN>oc#-1mJmNhl_^vB`hZXM(Byj}6-TMzg$IO#Utc%O3 zyJs$mN7XE}tE(mr1FY7}0>wm4%85t@Cjlu1GSE52CcA3$F#|6NtB5Y6U>{XmCOCrr zg;AW#HvL}lCDlR0kig4g$IC7D>r1Q0-8H2d>|X)|HKDH$subA93zAHcHj5l5hspiU zvj!3u-KG=M9*|*qn+F%8a84Y`B7`Q70A01a;&_C@nWzz#0k6dAjddr$c%TONkArEv zE{GRI+N6wmH7P56#-1|C4KsBB7G>@|MpLG60%qm$+l)EYQ3xz2~?&K0c$O9(34eJs?2oDZEy3x2OPX^KD z^l~wbf%K`tGXXY^*pPB9bo%7(h9r?0;9N=)7I;VK4qTrBS0rwp0Iy=jy=qoG10O}e zi{`-1^0cTr#9DGTcgEo>^u^-iK)CGwIF4mLtLQ3Yqj1s=L}PZeUnG_7r2ZSV3gFQT z<0OW0wCvY#MrA9gP{!7qlP~~DpM2p7pBX(!UFkZ_6JS3frpJ4lK1-{9C0t_AQ5^PH zX(s9#jP@|tfBv&~N`b38gV0v+`<>IMOi$TfJ-vK*n&yhBmJ4~7{hP(4EpVbo02q!_G4SD7w+e86VBjVJ4> zn7CNZZWtoKIDv}|+7;I~Ox9e)#Z|6Dx25#9J_%(oW{i6C#2NT+ij5ka0oc-WKF-^W z37VUH=Yjzmd%|a8yh_ zp-3>|5m38rq%*2Ft+i@gH&ujJs4MAc**G0T6Q|IO18CdUH`=oTKKODJ6IE^!0-x-{ zI4PThFOGQPY=aM;ut>}l@LoAoY{<4TR%yDna}d?LLju-*7erlKGv9L-3TZw}{y6Sz z$qt?Szp>_Tthtai85`XOcb4roOY6gLeEAz+&f`nYKo+L_QMuaLu0owI>6q^%XVU@; z{{5#Flbj6Z<`Ab$V=%5)BMJ z2cRd%PK=RF=9)uhPmP^vEgnlfPRF9$Nds&hFtK}np6*;3N*yqo7$Hqpl3w<9OV4o{ zteOJyf~3bpVhyaaI(Y!qgS6+DNd+$=3+9jAbJ$qea>vW25&~O7*Z0;bx*aEVKF$67 zPSZPZ=OnIn+XBz``zqOkm3tsszbs4Qet?KQ#UcwU@omMeynAigskXwu&s&!%KTNsy9v`O*lx$HhEeeF`dTI+PQ2!c^`3uJP15ve5lxS7g{H@g zXnK4rG(A~F)011F>FFYxp6X~CZa4yMGoT3*yU%7sJDJGyect9MMnHe%6mO&51;Ak^ z2`c?kBHbZU4gSW~=gc}=kjVnM>P2_lb> zaBmK2)Ny@+_%9(o1kIpp(0?g;;tDO2XH(*53Jn;ic;2{Gfo_v}ZEokUX42cvT;BdJ zE4FMN;-t)q8?edWze?ji>A$d;aD*F|$Iwn+;?eXSkRFNej@!v_-7Fp4tzZ@}DCj2N zkb=9ytqFV7_vSvmS_r_*#fRt;?5ew6lElhb@z=UOZ?jq0IGYcVZd_8Dk6v;^(cN+c z?2+vpFQn|Cx}PPNNhT@YzMQF!xn$aL&4f^$HvR3Y+g6?Y>92pIyEj4zIfPmB{`upZ z8VXSqS7Q>G(u&zE(^{0KbfKxOvO44t=aUpCdAfk26IDrO@NO7iMRk$;E)&uN*}BgQ zF;B@ZYU_l5WU%kYErvScb>c3j#)S`Qzq&=vwr;`bQ}$;DUL!Z`?wI7uC#xqb%7Zq) z$YJnt!H&&*_=<}^h39DoVGGoIK6X^>*g6zULhYJUp0@n7&Fi*=I+TnuCas!cS7f#N z21|WH@qIoKgZ1Iw$RteA&>Uba=MX*9$1cLADA)uf<>JZbI3q?0(E;aIgq1NM{d>;T z;} zRt%=4w^_sQvnQ}W`TZ3x1hek1j~+bet`%VVN%C0&m4TUm=Xw0#;TkkBFiU87v zCHvyhIz0Jk2~R%ydL0_Ro=?Nmb!61jB{J&iIx_0%5*hV$9U1j>iHv%>j*NP`L`FSb zM@Bu>$tX2RT3d&p=hQw`2E=YsfeyGHATr)oa4wHA>Fld1n}+ zgu?1Q%CfEYoQ|M8M74suRWf}|7`#mNAzVx!oj-jaM$p+{xU+kaPfrmw2{mB>(;*o{ zH-4?#kl#YfRS;-CWp|_CuGVFN>`1IdU8mbDxu?fHFJ53Y)9RECsZ?!SW>S_IyLvjh zxP!Zp@$;TSk(q!sqY@m_R7?jh7%jW(wjH;-hT;r$_N?)1xx3l)d09$v;95NXPCXJ( zdY-6-u~}o&9ePvo_Lg!oWf>Zi*4g~2*Bj~xbW!ce9xiV1l*Yt;1{i>l_n8?PrWtN} z37j;SB;J3TEOome_RyFyLwbyXrI-xLQ%~diR}<1h)cpMO&r(vE%i;#&9dBl(lj*a^ z^l4+h{+g+aYEGCA%dBiLeSg<9FoVx|n`MLdN0}N^Y81KMC{d4VN|X)=&xKMa)g=?D zE5uQ~5Q%M&(tsw2z|-TJxjfo*c#(Q$-o1*dV-nvJnQZD|j4Rhf#7B8nf%W!mvOS8xrCQflybX(m=27bFJ7MA8=@AOaj^4D#EhlVbFgdP1*FqBM7x=2s^nN) z+OhCvu1IvN2CD@+&0Vlr)8b4m9dEj9?Si(15~8(!K=d(Q1Q~*|vy`$YVItnx31`Tr zdYrh|j(v!NUMBZ!E_a}iL4j>dAr&VOfLyV^*r|~zSplgpArHHLeq;#z6mK3?6*@^m zZA5s0Au8F4n8(GH7CCDf7U!G>YNsXOM;)_Ad9JRA1F|59t(1$!%mTx1dE&%U($*~l^67Z66a{M872Mb#DB2(N3A;Yw*hu2PN7>yD>da#X(Ijfx3Qj>_wN_KgylWfs zwvYqJpTme}b;>W(Na4_hkpUq|W^C%3zq} zd3S~$(cscxz_Y@wfwOyuTgf1eCvf-CbC>Jz#TC1|!hUkZDB7=aGjc@9o6lXmx+%(1 zJ*B!O<6o`fqUWV`RdQ4`;Yx$I#EddF2T^ZZ>^+X^Ls2zgcZ5>Qhp6h(b&XG<^UUFr zF;$1jG7c%92qfzQF`A(%Fi)=8}DrLuTL>v&^}OCz53oOtFKtdc{|D2ovnr^o>my6o!DD&#{_Z zcpKH|MH-yFc+1*>Td8{a(WLtvAnlDx&F&Bv`|z0TqY(1acyvi??-`RAAxO$XB<=1Z zaf&VpYlxryPmtj|tzvT$51YFi>oDVF+wQ}thQbq&0g&rKGwwr7g4gKX%@`!UVemV( zPXryJ*R1f-m1`(;#89`8x8W6~z1g*|U;wW-z`K?L2L1yasI|`Hqh7AV8=OrcL<=(! zk`={8TiR86Zqr|UGRu+&vlNOm7$%pAQ+O@lhg%j^dt}KdCxP_r+4qpaAOH8!vu7_l zP_K_=_UzeN!+7^d|9<=Y|AgPadj9g&$MEd+|Mx1m`}@Ziie^d3LgSI{aGj&OQgC&E z%Ui^Uz?6aFY&2|p6uT6Uvl@xs1fQTf2Bb*2sLAb^ozYmPOBiv$ zS*CYOj_Tls&0U+vX|&G^Oexy#bpx!!-IiULLqarnl-wh|4`e^DqN6YzU#3MygW+Mp ze-yg~{DMv&LGIukA0lch+;6g>a%x>EyTJBWbD z3jUignWk9!$}}{kd>`an<1=G;Ugs_5KCDA`{-mDa23z+@9p;DN%HB5iaxek_j}`Lk z{rV+_D)O$w1XQkB_TjK$x+n-xj1wypdR##lJ$l_6)1j{pUNhDQv+B5dF-PL&%p|=J ze2mVU;NyoEfgD1qM0kdM?PphU#SN22=+tHga9WgT*R){WAy$*8qWi_TA>>6hNVy)G zYqd2|Jz)jzC-uFLiw0?e?s~8p{`xpL6l6_U~M6&c*2s+i)hJ>+1oVnH_*61Y@ zK7RVz0~c%VxHJC9j>&st@-JYU;O$>uyx@JO^GzKuce^m&^5=F;0O_9H>kU75utGvb z-uDrxzCl*(@o6Y#Lsi|6vhW;o9C!JPHhI0-w!4d@+58S#^7;t_>=HHfS?@xN@Awi0 zxRx&X-8pN7Lma+!dvw9Xn$4bDxIiprEOi_j{~KAvF$mG27czTUHoXmTXW7DC&26&#*5 z9U{Zxit~X&nMYZ9;#FIJewY^LFfz3PHXj!?%zW$hy^$&%J66@X3 zn4l`}7Sv?=dlKdNwaGj82ErCgpp{#7LVGV-H zi~Sm;pe<^+Dj;u_M;W#fUt&ROUNHVH=X4x9x3W{==@dK&;^aKd>D?33=w(8BbnfyS z4f$VW0dI2va~9lNVtI=x?#Cv^TXl9Y*MjK7TNyj4d}`KXt&S%{t|;I+il%$ zp$B+LZ=)>Acie^UJO$?)zGQGe0ab0K(f+f@6Fye(*QlcG;r-~#jT(jpF~F9=Jarh% ztZM?p^rq{kvCpx>me27>rHiA2{8W?Wyqm3wH(gRvLW9Na#?U z^}|n1D(amMzVREyk31kY-F0FH_5$vAWwOOMR^Xg3#vuEPWIcL|y0_4=ZQf=PUN@JF z1GXb0mZRl=@x7%CWt(Oh>}bny9z8iY?c4^kSOBRI3WoY6ro<3GEM6gxk?o>t%eeCk z4a~te;JX(eCga>qS&p$=o-(0?-p|~;Mm##LJ+^HBX|2FQubwaj_jbZ2g85wt1Iw>0 z06~FvOCT`GhS?%~VGQ5JQ6RY4&foGC;?aCfTjdG&;rOm7;4b$fD_U~XV7JBUW}~`U z^I4<+(@-53El(CBeF%^2{tcdEqSfzgqvD%k+Lwbj7%ODLTVpVu4_VZ}JxI832+^{_ z?Q4MN8-go#g4J`QrsSplb&X5elc0&NPl71^JG)Xt!jThn0>ec7od@2qx>F~s9q+z^ z)G7h@HQ2_@K}ltMS+GMg#4oN;KXA!J9t>DPV2Fn?YmwvQoSJT42suYgRjjBF4wJW2FORVaJkrl|5Xw*;F@MA>lm^)pE`H~79oViYli=ZK5W`&b-LEw? zf2i3xlb|2z<_BHI3rZkw*5e_zLsr7;elrVQ$oqz9j@qCN-P;+eO6oogj%Q~)pnLhSddu+W=9&E1 zeRwmxNsp=E8k>%e&zSlR#1f=fAX@tHut|*l<$R+QkTc){EA}~*q)n00acsRG!ix`| zNoh^xczH$(76-`PW`g8sxoaFrdLbS$MbSXv?<~AFMp)p(2HJUWT89NX6Oz~OgQ3&t zG@`I5{rO87n3NC4JTlBhGJ9y0=EQMql=fuK;DC`R`%C`{-3O@xqx|(Pf7K$n13ZPb zEc!f|!18~6%kN2~%7~b#PM4~9L>%rqG6B45^xuRQx!zg!DB*DGg+B@v9STlFwK36oa%-qHcsbhM5ALQ z{nBGA+Gfr^RjQ+Q`-+1E z>mdF9LI36XIi%*R;X7tE5IM{s>jA`#iw)G4uxB1V>bn|-LQcmUYmHl>{dyP)x<{wA zHRhKbu(Qe>V|of&YAHYb%WuyR78C*FG6ym*iQLp|rXcrIBz!tHnv{o|LwsIuV5HzU z;KPVLRlA6>aoXH;H1V=~f)1wHiM))AQNH_TnhyRj77B=7dM*ferjx*f9?v;K#1Ks7 zD7Moey+C=9F|}H4en_IMIot$WrVn4#VtJ%6lWC&5&LMT4wN68Nu%=^QJdcM$frE*W z9M)~)9jalcLFQX08ibTveIihX*6o%@sA3`;8!=t;706M&dc0Pr>%86?sq}cQR8P-( z>!qC_-&N}go3nOfQS%4sadx3xJs~`>8cP)Ay^WEBapKk?Z$IH*Bfy9tf z0>s6xg-7*(JWFe(kSu-NaJN%GVPVEcHJ6Zg!Mh@5qKjQxdCDg}6=+OelLj=bP9P)u zu0sU!z{Ap&Gr%=%1)lhc!I4svQ2dqT)^Y_0Qx%n+W6O&V!C4dSE@H@LU!iXc?~Sj6 zWB(*m;I5o$~DLP4c+K(+0jOVD^L%B~5m#m(xWqcjh!&$E^ zKqV1|)q}ghvkv?mauC#v=Ox{f4-iPCxjy#{B2;*C(c~J+xd#s+a+MZk_yGgb0Lywt zr$mK7Gc-p!lL&)49 zLc_i=KZseI#}RKJQ&f^fqDlVAv z4yp1`PBTC!!7=(fI9B9wa7^=&H>W}rfC~|vhcftfaJ!$yQnxk9{=3$EN^s8nuX#`m z=WHfxa%Na4!-@IiJ&)o~G>uBq)L!@TYu0*G2 zdPr5T!?+5rA$OkS{J|U0-1-p+NG^-4J^HIz?{uS(HRH=C;0;s@{zibG7siW&|0cDqVhvXg>hPdVxxPjKYXZJjaCGfN7&a|YIHWxElJI>)PtfVLATUoU! z-sTgeC1<^LK@vI+`Sjw$>F1Xp#Hp$fC6bVL#0jwtMZ-41w~Xr;0Q?KwyT0NH!uz;k zQ0984R#9OHqOk^}%pPw9MgCzv!;ubRebyVRncC1lK*+p4oC0|-J5hg2YvLbnW?Pim z1GJF1`bxZh^Nofz?w&80=6mWOAP?g0@V=gU17jDyF5WOR&#nyXIt%H`E`xH3a{by_nG)1h{p(wayC@Ne zjS_EGf9Jqcj1D*K{+wZ35lRW`xg2?NHFGUQeO4*nrfuMUgfRp|64|w2f508@N>@=P z`Aou|!wr+&1-7kx%@g%Jc2Tx#sa_^79nUu1J1brBwBp^p6zCDRY#}cC(%|%Y9Ln6u zJj7j7NeN!*kTj`jC75VU3tXPYyPd|u z#?MYFwwAE@tETz2^1C=s^%tivxEs2I{azSoaWKG@hL2}W8&yv+$61ng1(Io{-(QWo97^_j}4L^ZcT zbyAZU*Psiob4m=d=&Cv7e}P)4&Z+V8Hp}`55w6=eI^7WI;(%?D(5#NUlJ z7n^7kaJkTZxW^}6CTNmUe|a~UP>KcVW6dR{t9K2-2kn%<$g@M4HwpgHvH=J3Gx0Q; z3{nW_ZbRDjH%%Gm92qE+JX;PLIhLKbSy~@xB4aGwn>6ScP?YIzK(mcN=p9n;8O&;= z^6F6336hsFNq~0}ng=B8Z4syEH*BxH6b+W_wPO*7u-^o>mBunAQph)%+dZaxiq23@ z3b8K5+G+Ks)Bm+tbEfje6j_mEj9&p)*N3i@E;}jO2Hj3>l4c;Hr-_D>Rx%MUQv_~R z-~y#k`H)Y?97-+cu#R~3Pnwo~t#Gk{qup_7Rc{f_b*T@0cCOOvL;a-r*5C(>p0w7;zmX6Do`^?6q6$yqAd z6+M&`%GJ(`$foStPKu5){}Vz-4}klZUZk}b2q$Fz%B;02>}ZDiU&m5UMDRJ!(u)MC ztxw2)2Yt{htqM}`H-(fyq&~+*LN29SsF+Eqwz?xQI4ejG@8ZlMv2~Z9r^u5*2e?@b zkyWs`V#7$wj1p(nrdh2Ib37jP*E+q9G3T5fo@mQW zSH6_Z6#vRWyslY`ZTt%(+fI@NJy+U0-Q0=yzM&{$nlQ&qHLuY>a?TY9qjlD~_MD;T z5mTW*fbjV*aD3KcK;f+&q#cT(#15{~=D=iKejk|dW-ys)?8%hlQLMwF3hiHNk^gO1 z#L1s$Ew$?$t-Z>_oiV;_&om3DRNuChz>!(UCHpNJQqihgEAV8dUJOPlKW7EqdYodP3W4h@Gt!&by0&l_>Do0D@ zl)1)3PMUDl8q9fArZYl76=J%J11|s%D~r3Fu?H>zk8x+~lf%1jg!#jRy2z63CWu?y zAiU-C7jK3NW7IZ>e=<(aLM*i#@`WcD9yC+cQJA_HZ{&>lnkw;Ra(UG+rtMnO^NmRg}wm+`yscS zxH{+PE8Qp>jfytkZ&po{rqk35q`B`tJ&Gvj_EyN^qhDaYLZGRJ7Dbo-;O4Okl)A zcIE@}P|$#@)|dbonKTjr%XTf(wvS{$Vw4p;OAisb`9&s6BksP7sx6AHBFmVRE1+c2 z@fcM%4iuuK{O(0iMvysCRQVyPo~7prRS-HC>C@~GUkVUR)V`~gf#nuqMp7SX(X6<` zQOrgHE`|qq&&`?AF+?xY$U1wkCD)CZRT$D0yB%`abaVTjG0AgCq!|2}R+p+di&;Y6 z0YIG`?=_F>Cfx5Rx1D2#*gl~Y<~W9h5ox2od!cer*@hwol??toDQS44YsIdw93Mt}+VGRQ%;bDIE=07BfJTpd!T^O1rKVyM`1J1&NzQNBc1 znas0+Xdnc489vxk|L6Mp?54)L?pOEhG6$uf(?0rZ8lh-o&`%76Z19i_*&o55=$~nv zCBgsT|IXPg+o=+Ooe2A8kk1bT0!1R*qU!YVI&oZsX{r#k2T5F6iA8+&`!hQZ(Z?b} zkYW#JIZBBvAfAv_k9^%~u+`>{K zIliaf(u5|o<|b1~0Ol30?nnjO=XhVP15z=fEz`;z_IU@=gA68UaqqJ0TwdEzKwCfP z;7`zDa2Nwt3$_UQp3yDB9Ips|7vw4`4{4Lkx*|*0RRPB3ekvM+$Hn3ssz7YMqe`vD zbJN{8`$3RJ96c=8xN;FB>p)+TX@UGshI?MJIvB5&oMtZ`I7Ap2K8po*IBdO84whm6K zU_7{uuksGVu7*&9LB8EH;mTyam>hoFO=_Q$Q|;8Lo8osTiTQ!&DW`K!4=T)u_X?L9 zNe8SGt6qrdS1-a|zvMuU>7LYd_O+?nM5Z&1WkaAa9`K(9swhjNT8nF-CbfC^k2dj+ z-Kv|SEa3_QRj8G5i*KGF!IG?j20wWRmLUn4mRSQ)`W()Ho~2A@#6tE%u-)&zxwI=r z3{yz5Vy}YapF;TLo8GRi*-m3uLnvr9gbJTR{>fM8j8e#IT_tsqwe(!4D4^INlo~i; z7;KxUzNo#@*HQf~IfK8l;M)3J(?$5A>-5Mjfn;uys(K77u?2TQdHw2b!fpZA;oEP% z63N7ioSlXZU028_&90L1Ed30U=_N*%lulApe%)&uox#q{J&YS7_-(aqN+!-LsB1oi z2tS$CO4iq+PL75z-N>BAOxkTwCgUwSrTDsJYGmuF1KE8wj~l!CkLpbJX6r69Wl?16 z$h@v4a^Nuhi{JXYv}Q(BZS9SPi;Y1-$pT>u0<>bpGNr7$v;7Y@wDhP9MrKrLy8Ki_ z8+;bxeMt$Mr`s>q+7WpP?hBja^DJnUD~u-p$fK^LU7orcG5R~vu&>@eNw6pLnu zsa-S!M9<~7=x>LpibE^k^f>3eMGC(-RfLG2{pYoZT^E#TTbWt@tMBZ()9f?bP67!} z^)fA!?xpb}sq!Sdza?|}t_*6(@i)FBsE0gw*zA+a!6Z%iGVRKM2GNI zzU;5cY>({{B^;I7h6qWmc~$Qsut0EMj2{O=h;XgMyXty~T+kCcY~6KnMdq@lIV`tx zxEJ=Qhd{NcAS;TCwj615@C|HN_|fym*aJVN8mljU3h9&Og}2UDxdaSqG%^DJnWbBs zM(?t)M>|}XHH2;-A4R@b{0pB?}yrFSj`TE#_k&rpBB8LLJ;xdr-(BKr}K{y z_Kg{@5CEsGgS($UoCGi5|LxsL@b3MaZ%%@@&tJd$bP^O5{p;>!8r|D$HupyMaOm#p zZ%B&nRg&%xyh4zu&vp+{@f0j_1Nx~}@lq3y+X}>Kpe0of1*Hf>LBk389Cbd~=w&Us z2~*0|p~$-2_$T=8jyb8xu}0g44?(qm^Jb3m)yJ~Pv4#soBj0`SCn4}pf`@Tt2XjoWHFXgb`8|i% zAO1?U@Db>YO+va$C~DyDw;$iX`}FGFOQN-#wr`%l_>1_pn?Q&+&2Ok<&wZ0KSQDZU z|90F1!m+`@SHdSi@f%^jc5s|(n^|Rj_^t`+6k-`V3()5e_x}u%111mtd;ia$KTwTY zjM-HUIjl=a(M+x!CyW^2TGKQchEWLNKHOvETU$e>di0P6zgjelNFu729B{x?#F3eLINzf;G!Jk za)ygBl=%=>QdA9(J{^?qBK-2)NfeCuod4`@d7%2;T_*lhk;>~FSYvmAku7zQnl?;lgX_*vJQWRRd%vgB~jB@}l(hr$G)9lDT~ShD;{;94rp6HmX~r z@4K$)u1UYnTQ~%JNJrcNKUr+p(AD}9WwCRctYaefJ5KTxyt0#B#BC>R`?X9mV%El8 zQlT{aArFGzb){Pyo<~UP6a_~(49W6)Ut|^7p|;lqRhz-83K&qs$P5HL%{nM>ibPeJ zc5nuIJksy>*fl+77?nhHx7`@NT8j{}So94;Y`7*7!VGMtptDvvqZi5?I%dVaNY~xO z#wv`aay178!EoS+*Bww1qijEpCcP}5qxwN-QbuQy$! zEhbqqz_^2_BDgR1R#`qnW!BbsTb5N3Tr0GSu>Du;QgpPzynsU^#_DzRTJ;Q8z#O{Gg5F z96ZdTZBaFS;tIjt+`WAR`)I>AA#Zw5NP3h&eA|$G|6OoZK`;mZvB)K{$)E3oyH`d2 z6{N?Z>>9k%se~I)-eUq5oXsG^BGkJ>*>Ij_4Uo*k&BWMei(GMo>n73d3MXubOy#(@ z=XZYz z;Q!tKbI|6HNfLj3{qD8+6%(>XS^7^V3gFY(`xk$C_3|#bNUU~NkJfj9}3Db$cFztk$yr8Y{_W=U)>HX(V2!^^ny#GYLmA-lM;{Cfo`7T{e zm^5afjwe*9kD@=JU;qDp0JiE4o#)`1_rsmwF1Qj_HB+Zh33yjPwde-3@IkO9v`BZy z@*WcLd&^jVPpy=p{64sQcJ}7pU^u`3c=jO}v`KTeM^Y&V+Wla7#9+TaSSa{|X!SyF z1x$?3bxc6qjQb2`EqL0=jLSgiX+exEfUEXp|l5ZtBm;cq{E7>@Q2%4q-K zI@+^OXTyF&ZGK2N9@*@CU*f~?2Jt+-{|7wgPvAwXGa-*|sIg;?=U!*V%Y6zL_u>Lr z3{oH0hlx$AD4#s}i5p5%{vqS$q)bq3#`tLi&0Obd93=yAYdv6S;_Z;lt{!;ETd@rGi_@3Aoc8@Z^nh z)u5G=q<#gazh#P_H}0@i+@tFYQ<5@IMY`dkbC(u-V3p`V&R&BM!$ zrwU;T5bDn-Xj41kLgPeSDpV1BR1_v{MwY3(BK|Wb-6HYTj^8Ekvg;fEeNVBfaxb#x zfZj{zQU+g4e?^@@gg;;~xX@%bn*sOEx`$#p0d8m|B&#{fXa(RXYsP<*Yv;e*b+f<5jBD+M#maBiACKE z)Yl2x$adbtaK!Uh+&sAllcpw1-Eo1gfg#P3KDjM1)-nTSeEJCrnM4SwwcTQ?nm_o?r({I9><{jbgl+P zTkTYZBce7k@Fuxd0&u9O&5{aHH-0(X;O%8u0=GUN{U6nA^x|b_kO=?pb&-etFLFM7 zO@cR=Uw&Rm8PEV7X`3AP9W7oEnDF->A28CKa>apiJSPGEE9PT%8Zf={EhAX?P&gAkp$j5VIz-V5N$^BU!)IWiHJpFO2rUJAd8nd# z1fOXo;26|WU}dM6V_U0GF+5p1K7NYqfxLxZ>cBonARDGg5C~guji@|;BN8MgjX6Ui z;&hTpc;)Qrg2xe)5c*HH`}cbY3(1npBqO1}ZBgwPUnruZsA!IUN8$AAp`FgT zx|cFMTuU%4pnARoFC8ig1?d)WXPn~LejZfkfCYGVdI}{nH}JWk(osi54L@wsI*h6+ zx{<_LHEys>G{WB0Hu!?vM=8QK31~k+TU6~1I2Ag{|MjB> zO!oiWcY`&<)+3yquy2m#DU5&ye}^APFkfI!G_QO&F-nmY$JheA+G2urSXYwtBj7MpS!d2mh-wQ`({o?)^vM3{$sV{{OgBL{~+y{I_#EC zs>!CX?mv$EN?~0hYF6sj*WbJi-u}On2lCX^br`3GYS%=X+$~I#vs@+Ggk;5W&*2Oe zzg`a7cSMyOi_1jtIT)owFuX-f8OOQ&4=^Y}nW==`NV900Wc5bGvQnWN!;euTatNr8)c!E?`G(ZL71ag1U!;t+eRMM1AN6Ruq;Ptbsl4N5y(uu6N$_(cVcC~jEnOYWO&;W*u&C=xy{h! zW^8uL&wf+--9=SiVHgN_GzW>$&@VU-qn!;zwO>U|8DWJ8D|oUrf(O!TxEGMO0uV2( z8MV4n5tZ@n`o0)bLKAd$nn5_>5l9b&Z(azF-ReUVKyVc{Pr0r z4-{G1@pSua+nV2jbr-vP;RKQY54Z()%kQeEoIp0CwkU>xi&QL<=q~=Fcj#{akEqGq z;R&X>lXtrzY$b@OGH^`Nc1&5st?S;Z;LWVj;kyhoZUo;WJC;&!>#p}vkvdv^pPZhA zub;ouTj+Dfo2Mbga@oh7K1Q6v((jxnNK(ubDle^c(3|UoOGUDj&nmRUpxRp^Kl`=9 zLO#7tH*GWANfZNBU@;2@vDU{I-5$m`W<{jWWve2Q-Fm2EjBPig{WOyJ@f+A8Puukwaj*S zY97cVK!C(cgASABmNPXLr5&2 zs=$mvyZ4UlW65?+a_nHo2J@J=6`N%^@O@R+nfxx>cCE#B<2Y1x8LBMfT-MTCZe5M| z3@3V@;jNzPeO9-4viBL?^673cdq2;sJ%m-gx-wzeV{hxE7pz8jeLe7h3kUw;XRj-x z_j7#OTR7s`JIupnvKEb4&1Ld;-~R5~Z*`wZ>BhE8>kHFG4LRE*9&EH9fA{F|@2s@5 z>$JKp;^%Rmr#H7neV^rJb6dnWSrd!pd0XU>P;xl+?;lxv2E%{dh`YEoLe=1vn`7fg zEd3E-rQ@t1pTG>=z_oaBd{;*FgBMVI+M8L4KH(85i!67^MGEXRDMx<=-TkShAEX}7 zxCY2NcuG9w3Gbv|pI7@0+y*X6BVGnRg!I8j%SU=W0eS@aiw{N2#lrz?5HXMvUhNDc zGuh7U?W8;F)2hj~@RA62cyRlJ^usO2220&3-jJUcejcV@5&Bq_qVC>QkUL6fXqTHv zREn5h1WZDArxlQ}EwXFELvG^T{zyw!e?-|z|=tvXGU@t2+H^Kd#n6R158>YGeH~kBM zw}Fsf?VbN2hF-B3TjJa^SRNy{h_C3X@T>)3gYciA4#fpVy*9Xq4Gvnx%{Y?yQ1p9- z`KbcE#U}2F9@_2N4#8u2|0_wgOE&2Rew{h8vGpF@_>^Dv1vf;f5!=; zsbY&UQOiR4I*Or5aXnen;>8I%}JB7Z=$Ujor%xC3@kI-a2xUZdn~DousmkO!DYD zP$)%a9jOl4^jIRlT~4aU;#xppKnSv$72-mPsMeS08B_-sf=78?iHj5|`6GI_@k)g;!LGACkP#QXZ9Y$77Q;*@ZfTg?k9=PU6SFwUk(egm9naA}0H%;Z*C`bxH3 z94h$jmUjTN6}PqQryI6tRt!a7J{7D|EnWF&LGBJscvQ!q-oJfm7YHuuDGp_H$RVjE zuWKL?#re%QkZI~E=H>3P1a9D@OvWUkieXt;@_Bp75eNU%ic8o=<6Ncap*_PI{;DFb z9C4ik#Q4-164+qDw%u(DX%VC~5Ay9@4zS0lMg%k>J|L)aB;1n~)1SvHtYOx?{$`xFo{;Dt!PL-V+STx&?&}~l8}=7bKa1URtjK$t>^PMa0Lvtvyb z*io}gZmT;Pi0}^kb11=Wbm)+aPmdx3cok#`827gsE4P*WT|EZTumvv~cz*(?1F>go z#%w_Kr%Lc0eRxztac!qVXlK?CZ8bPqt5#zWRZfDrKjlDTn118r0~^Z$Hc`y9a&?hy zE&}%OsK?Qj`A1nV^m}!)%hP*$GX!&B@A)J*lwqGD9ErI2XM1sGbt#X8=CG07pp8Cy zr(mW2!w`IL>vTkB#o!Q8xp(6IJ~)dxF#-I6nvYi(idu&VVmxa)vGjiD9G|}W>KkFI z6}iRfdWaymJaKit%V)1nWtAzc_t^A2w)X9WcuN~e|#K>8so zh|r#ug;JhO<5DrHP=dOzF=$deOR^su>s6PWMGi+14qt3CkL09U@Z{u0S5lnv;@_8o zP;x|Bp06N7g@my$D;b z!t4fWn0x9<+tDU{QTw|RJ*7=|`mRMNwniu}xVw=G#rqi+h(BRQu3cM5x|ruZMV-vh z#76c_L59-{5fh`9H2q}&rlgX{v-F#|D9R={!&$UXE6A2w?prhf4D!y%84*e<{G2$8 zk&o7jFV=8HaTTA{m;xOA+|SG#aS%hYPvtHvJu+>YF}vez_Mx1lPIR41zu&+ z3f;9U*zfsa0shJBAx`2wUSW!D**A&~rxlDOmk*)5%m}$z>NrG;fk`TCEG-rkIL?bf zztzhHkggJbBB)x687p5354K$AfJR%U$630G#a1T;(q96qv}vnCl(9L%8#3{H=xX2c z3V89bkk5_BkRa>NGaL~93Wto#kjSzt%~nayt80`D%eyDuXp@1HU327++WRPh zbX$z4GpDz=qK3m-oWDs(WFscAK(1GKu*ueefPb|F=F7DZt#^#<}%+~VRCKwKd; zWLD5@ii30UMV;beDO_e%S?q?<=Ta&nQXkwgGPyg4ocVSR2Tg%tJIj-G);=Y2hu#KB zl(ocMCs1TmRQYt$mZ!8y$0WW{k znE-#Bzk=Z<=Zn3AQGod8yn`V}=R4R_j6x-V3b~72KRcCABO2}r+QLqNxG~qR6Q4IA z#Spmk;u4R*-|i~SbNDas6}Z))N&wf&0{_{o2twr$z*@ooY?2!73+Vvm9faJs^@Z!@ z1K-jSZyTE&H1Q{}nuzWdMC=@o=3m1{ghB_Y72N?36rLZ>$=k}a1Sg&MenH5D4a^pD*BR^W?nG ziLL7goMF2`#Thyb-VxL5W~?LRXCkyHpjQQV|EE}gERdKS`;i?%7WZNKT8GQo=Gg|@ zmlbD_!ZHwZut^IGd?l9+Wr2`u9KiERY&)B{N&?v7JI>;F$k4+3q$&idz!md3;l%i% zbRlN&11z(U35J5s0Wzb#*bo)BQ@YZ?=hFZzsPz&V;a~L{J*s!sScmp{-CbHiy5FH@ za#By3Cq!K~W3nUDnw(+*4PiO}3A zf~x_0#gW*BYItA05#Q1FX|OHIFxxxdRg_Wlr~i2N+FXltc00Rb(x{X3P~YR(V$v`X zVunf2N&EkDFDHo6w5DS-QT$);*NkZH#~r<1rqN%^y!@2KYhkugV&>g-sHZPc0|Osa zD|)}~M0tj!;$J(UE-9j!uvyES>kr}e??lu!J1NW1fp{@&Rt?`1?|O+SBcDb*J~IBWS0tZbLq@w0|n#TNoMYzmfVIr z_~_9e)kM~2rl_wy8>+uS()S8r6q|}E8|Wt-P@&JoG>_uTSghyb{0C^`zj7KaIswLL zKUE+e?@S)&n{cy(0Ud7d? z)2lSyPdDq&X}qUYZSQ3Q6(tvCRtYae5l*ktYtrkoaHtI^+d74*HW4W4Yd-beMOgw-Gj(qwumsZLEG=LS=PycJs9 zBeY7Be+G&kZT@SVw?agVrwW0;iL3LJPQ<an(f5y!MG^5U)~(TLOLS$CiLL%^Df;v8 zx83JJhf-06DHu3`O9~E@sG1lZ)Zr(G3Qme&o-7E5Don9_j-tw(5j4H zwV{n58R4D1V^3nyALNps3^Ld9r_iyJ-xrxUZUiCuyt(g)lQo1yv@^kPQRa-8>&OkC zP~a~bvq|PuWK0Hq0;mN!exXuDhS#Z?8xt;Bd0*nGw!)Q(*MPiC;@YI$fxrCwtN)x? zgsTXO*+UOQPN9_#XTO1hg4f;kthp~L<~{@er(>R&E`V2SUPpgh=G+35kgCx zXzz#l#xF|XGS%j}hPpEpi!K2tBZ*yEvEr^pI7*{YNM$2g)+2X9TWoSz6F%IyPPCls zf0gB5#GO|#WN)t;{0Ftf-NuyR&*9%nvCyGjm}E73I4t2xxY!HWQpF`KL7%|*5O1Ec z=CbY`ID@#dt#1mC%rbd-9&B@Xelcf`_!8omNPcmns3Nx@R+%;&MDKx<&Z38;O_&uF z*X*AcM<~$er57(zV=1#Lg;zIxxpHJCYb@ocx{{r5W|>MSov3dt_Z_f%{X{CO4vxUyvbhur0cX_Cx`<=Y3tmMr`7axlrroP?1CMJ3t6NKSR2Ukpt+3(%l zz$>lpALHo86bD@&tK{HN%5wt~SIG*-+RRqP0wffo8bDSHz@1`s-@ZN5ypuH#k)aZ_ zt3;EcV`vqquLNM-1#(DzQTD)&+=Hb5qne;SFrKBWO-l|(Bb~?RMryc-fAW*Q+-@Pd z5rQK#nk(w0)#et;s^%OH_<`3uZ-s zdK(??B)3=(xcrsO$Fv=7;(SA~x8OvHPUYEln^q~fZAdK8zV(8;0PGe-@xGgqml;eUh9Xp_zJ^B@dQO zH6|=k3Y0s)2Wo+G2<=-j#jL_pqQ3~}M;D_KwQMF;UVpuNWW-fnzs4rvK8{ahtQODV zTH1Fg7N|49%~E=uULleJEf3S^XF5`0VW)ZfCQsbymRNWi)^WHmja!F1`z!25^PTXL z> z*1G@V^sUJ~E1+Ox5#p>Y!Ghu?N26>)W-NU)?6WBb&((fOdm8Gt=#D-zXQuYi4>oi3 z%oflq=e+#MZnw%E=7ee4?l9`x-QQs-uW7uK{;Fp!oV)>fZ1kRe2jA-|m_}*BZ24k2$rftd z+yP%)$}8}7>|VOO@#Wf|qih#HjhI8Xcpf^?^_hQN$H+~}@g>G{Agp`{PH3DFefQ*~ z=)X9A6I{iRHS)TvWO@cU8=02%Yjw!uqBqp|EME6Z(q`)-S$w789R%!j^fv=Ytn zVoPon*;!ny=U4IF?;kxj{VIsVGRF$6JL*}X|63V{Wd>5@7&qW#a_|54ewCdO=UL1i zLCRo(3_~>~Da4P~nIy(#&M8qL`UcHvJ0o9V5$Y&Z79_9Oc=LmhmJTd$rJ|X=F6!@os8*Xhj@oeK$|*J6Bqd9f&=ir6#+IQZVFYxsMW| z@ZQY!ty#f+)@n7|Cd;$GF^DBXb@=eL*Iq6`mgI~1%eu?CYyVy|5lxe$UAZ z>qp3c#F}F}<$G?VA;;l`E>2}i8=3GbQ)SkT(jjd|I-Rl55rZNq3T+t)!}ZID%(NB1Ev$|Svol?-I>a2YGl0?l!7IIwC@zD_soKocI8lQ1LGhT2|_ z`j5rhYYj)@juzUT55s~5p&gWK4FT#11n}Gz4-wpFd@SrFR51Vh_x%S%slT|Gy-iv& zykJS<`qvCpMl`>vI~<&>NYd;6OAY_9L`E>qm~#5O#>yeU2qht=q=&-+s4qSLJiv{E zAET*Qk8v&<^uB_M@I&MO`2r&2$!Nz!5$g*kU%(g9tnz+l( zD+!#y0f*+k<8*Iw+>4Ay`t^1r^W}Jj{m6iO6u){!Yt3#;vjbq=tIW}`Y-6)S!aLTi z0NT!GvbAh_<7|DlJOk=y-A&IRKE3VPR%VjbO;yfrfmG}*?`yLgW*#>XLg`#^j<8Mg zQER$I`vTLGV_CpfohaH*86n@@9k;>0jrStXw~^%*_MKCy$K%C5^nxw=31V&cwc2gZ zeQgFj=|LpBI7y}RF6|Iu@VabL@`gC8%BvcH*EVs1uhPM;&6{kWLxddsGcJUBT=ysn zVltMhD@=Le;u`&~Vo0#E5$l^HA~976!|Mj{0(F*W^+lTKWQPE6Gmi`7fu>|f?Ps&L zjk@~_f@L<^UUNo8dXD}kVA2inqCTC$bH@5!gKm^WvyZr0DWTH{AFPuhBlxh4f}|yW z7=Gu>K9!s@O@|>mBqEfVLQt5$cs$dxk0ULOj>>b*aNd+_1`$AaV($@GJqv92@I_#@ zSDa)3OTU{0=9|DQf53Za!PiJLx27IQOFULy28mLtdgAqE1aLYbXJ8+j?{OZdS) z;YR9CxE1nhg9pd)C1=IS!zytO%0443^AiY6NnC?w`dGCvdk4tWdNmjWz7FM2I=k`b zhKc0dnZ1gy!$9000!s9SA;-Puz6MX|Uu!AIk-H>QFT3MW^SEcRSBh-;_%<}L#SITz zd~lxgCM2$I^GfDRB@9T{iS>Gr{8z(w@7|-*WRN()_EP1H+iTA>Jd$eR!_d9RwM#hB z8NqdGNF$S8(b7Xpt85N@-$n7<^;mnQytEu?51;F7U7|g|xpmBQ{T(bIxBG7h#l3dg zi3T|(>Js5x2csF$_elHhjti>cJmWDl#sj_{$^oGY5^H=tF`)vHEj78-jM95+jGO`p zRR8;!UD{RbE~iK-piR$bnR&`}5KR;+$HO-Om@Q8iB4 z{kW=U7QS{e&1?^Cy%;HT9>!K8#m4*Wn3?skv|7<6McO#NkeQC3XJRKztEeeIr9}kA zkk@5g9gAzxu{iuHv3(zROv0=@<|P$xP^&q{y7xwq*B(Fm_Pa->7ilN*z>^gA&pHn` z06VqCxReNzj+Rx{WCYRXDINd$a1)1{s=4>U$yHSmbXM7PP%q3S-{oEbO%<@NcVbI9 zC!JlBcp8ef->CF1>OqySj9=+1*7Tq)^uY_FYsQBaI~@6H9&a?Xa_>OJiRP!3#-s17;sPqXZ&l+QMB=DiZDXWT*Kl zE8GKa%bmD7V9c$K060m1BkQ;_fu%-4xH2GOdXlT~Sr_6`dy}NK(0I$-^LY%GbH*(rW(V_>|w7_3}r$IAAVfNgI#Ak5gVkKf{-;(7UAqd>WN33N>Ion?Zzo}KU*+4 zjtGrV;=r$(G%>CS@YC4fxEqxw=ETns!pKHoG|k~t8UWfdu;ZX-30@%Vo(NXT;Brby zSgtyOYLuw%Nii|xL&03rvvgywbDyT|KIU(EV+=m=P7lMbF|s^+)Z-hzKI&IyLSDBq zR~EGK0q=5>A;}|op~iolb=t*|uHGE6K0-(ue4v=u-dmbBU0|WtoH=N+bUeGqz%lA0 z)5T`;^L_4AHr}`nI*U{vRa(v_Sukwf z2WZHo(D!uCur$WSYhBYaV$As7O0s0d8soUmI(Px8z|Jok`v`FoF!#pUrWYB7p^AL- zv@(MN@=erf+ItxPJF&VOYe2n%5AJER=^df)cSzqCH9l^Wtg)O2_&dcY9Y9wB`HeA9 zIDQWO*j=h`&z5vh4k%8qv(Bww8-7LC`O<$1iWNT73~aJhGk9@HR4xgNK8;R+k$R({Bxf&v=oB^UvVL_PD#m+Rg$ywJmaA4hlI?O;x%B;96!rG>A_>f+f=t^4rH zsMr8~(-v4aO&)~7i>*-|%HU_gy#lny8q<(Vtn`mS^dtWH5nlo#`k~9ifYr{*<^oO` z%vceWjO7AFj|kC)%0qU`JUHvvfKP?k5pF_D-$nsx^4yYelI%j+aPi-gXl62aH?iowrW@1@ zCV6eXR2gUD#Fj+#z$ep63O;yI!XC3xGMj7b5~??|X!7#h_^5O?U@LBvx0uR4q7%ps?zD^17VwPukuuB<*mCjmm= zt*wwTCZB0iu0QTq)F5XJ$nF}phh}c$HaDHt-~;{c*r^@OUHmKJ(vDEZ&(q`=Iq^?T z@Dj2l!_DfZZqnVCs*2df)OCO_M4z(@$|}L#>rU@)T{o#j2W;zk;9S1$d-%RVr3!M7 zR^;ulRtf+n%03kCmV%L&?-gFWeO|gpUl{#f7Lm;GS|NmBNWSI8J-KwJIy0 z0-2U?t@!%d7TI->?#s=^$V~Vg@2_3|;_B4%dUW1QN0i~C2$J#&4j7KE#9ifxHwK*N zCdj(OtIybT8p|QyHjFo#fkdz)PKvPPC1>ymq26?~hn$(N@)FGZC9AeR{y=XHo_`LL zY@J6UB{jbM^4lA32J_NQ>@Lcw?6B8VlFh%L7QV{sU2zMexB5%B<>A>!Dyp*Bg+Y5= zUvuINrE-7f?a8$22o9xMFoaI2CT5O@KbKdav);(#31c)7Szj=P4N*SC@&P1HQpyHQ zKM&drS7nTO86ed#LHTg&t^o~11UDMN21QMT{zjG|%uE1co&$UW^?O_w-!vpJq}hOo z+b(axXbU|W)fU^Vz#wan2K}ta#YsYucOEQ79iNreF_WPgNxE+?JQ!m6MI23F_S%Ch z*Km25Rzwcbj?lD}US<@tF%VSV6FM&{D!J%!zAXsE;s&|SGgIXkadYG0PWhx~!1HSf zl{PJJb|f&-*c>vcmX3M3bx@Mc@J6oU#KcBnOB+JJg;^c#VsLi1B9xf+hrTJ{_WUAB zagB+Ra??T_Iv6Q&N=KWEbn^*gCbWQ!fn1^CqNUV6v1Rqnok=2UmEpfeh+w$JAwC@F zsIrDl2GAL_$PM=QRBsFcPcHQZ&k%TbI8O`E{3#Abdj7~WBEv%jVT%-Phm>j%Ta5)& zriiAOzJMZ)RhlA5Fjle8EF5y>2KVk{=6TY|)9#%Fr^htWSp|ubh&-$f@tehE6pKY& zF(>Dh9wUTOnB@bdCfVrA&x*3I?GBrAe-kyOmf8Rc4&KZ-83GOqr=aYTSy^P%Xi26` zdOdarPwtd1#!x-6qA z7m!+C=4|#15CK#N)EeMz(4EhyF|rpkIS7^-KXzV;tqBtk#zJ@8WVmx&WzB_sSX`gh z^~JLh(?UV2OpP@bG)(Z`>&B4ePuz{%)!VL<`@Cg$M@ul^MrityA^?y~P6wI_SMlgv zP|<9zO#aGoL%PVLaY^)R(`^@*F) zSCEaC&vcj5%cbdyr{en;&s^xY4p8`VR3kQCOh4_B7U=P;2ls`Qy?*gR_?vb3#nbUO z=j*$k!x+3B{I#aro zMdQ}M*?w0s8_+Z8MY^VexpD>hCt)T{l#!Q>k|(=^eKMLM?qs3t1wv3blCuV1mDe{b zqrf6fUmVzfs3@%^QEOj=slEnNeGR7i8cg*ynCfdV)z@IEufbHm)nF=%ZI={6Rts;6 zjk|?c6h47!Zz1Wq+MQ-FOEE+Gfm`$lXFGi9kfFyBWoI-y0jBw{3hm1VSc)BscRRSs zj+~_ThIU)6)`4R(C5L@rW<>Ca7Mft~HB>Va9k?)Iam{DHyT18S5lZXLMG8q~*3L_! z=zezGkrnQdU&N*OlzI^6Jq9`TX$_(a9Z8MBuP-1a<~7U=!*WAEIy*Es;$FQ+k9BaN z5vsVHIADAmI1P(3cLdv_hw^oEdzA>jucnBvriibmh_9xIucnBvriibmh_9xIuedH> zab3RRy8Pqfy2#!UYGQ)3p|mI=Fl|U&87{B%GpZIswMFPF`znPy7i=yF8MCYX3@Tmy zkn68>Dx3@j;~jK@wg2fnZ2t@k_fBTFhK@l@_uE?T1e~@ssLNm*S0j97B_Cb4yOwk9 z1GG85!{f%*UAon-Af>xC>t{XQm^s~jf$07dXei$*f;j9y9p||e+sdr>rP>|Q1Mkbp zkJP0j%6i$fCV&i_sO^PjkOuda5_1)24gN#y0=uk;J4Z3K5kL+1#J7@BmBxv@O%EVk zlABS>(*!{@8q}mV3`}wOO{WUsZvZ(p2IE3VG6s;oP^I`d%yDsZ_XPKq98VEy1bXag z71tLp%X0r?y!ljaw@1PAs=~mK6U+dv{>k4TfR||3%|LUv&&B*m1T95AE{d{w+ZIR- zG_p5uUi~G@b1^R1n`w9uAP#7MfHY)nJph5g!O+Qw9Ni>^)^)Om7TltaZZskFhrXFe zOdo&crk~6U{q@O}(vS+>9S83G6K?c9x|K>WZV43V>_c|y{(j%1vh1{kBJR;g)OdGu zrM?nnyQQ0{D^J-eBV4^*9X$c=7ac46xVZo-VR(#(z;VN=64y9ys9!?^zCik3)n3&V=4l=Go?^|MaE4I={ViNgpYJCfrrJG%7p@x;})( zd~SX^vLbgy2G<364oUhsrL#Kf{qAxMK1W-6JxEV;iBXG!XW3kwhz5#$Jm`sP; zl{SffgZoeti`}*WH~w{B-Jc=dQw(|-*^8EJHdYQ*x))nT?7Zu}>)}gwF~&@%hNz5= zyaAPE3pW|Rg=0WRoq+{THw?}5;abjIbn2jfyYLvO zatBhR?h74c^I&$vnYu@7jE0+m!&o`ewrw>|n~N*`eS){$5!&?CN_WY=)vf#A=Ek+s zg+-g_K9?0dgfy5))E5tSr#k6CC)B+_P@a{>db2PlK7Q~t>5?jHq1NfBJ_h1;1Mhp= zHn&j3k7;5fYD5+K?_e-E3QgB-Y|*JGZZy1N<9_1^=sTjn*vW6CeQSugj6cug1uyCv zrjI92+JIHjt&eE2w-s8R6p0OisCTnBxPR)j!&`1Mit4g4-^W#)=V_kRyTvWjX=rPG zaho)Hi`pa<0Q9gV^Oh*%y;UhhT70z^^lFOWR~yZeoeP*q2;K<>!Tt0+41Pg7&A$tN z_Z}=q>3wr0P32t?ZXla<6lJ7wi1p1r`FkAel9hi8SKcB&Wp?bn|B)jU=Rv=wK4xOg2r zL1S951E9jbp$~qKb{?U*_9Z1`4A)ywG!uWLtLjeCh5yp82C*!`i<4n2ca-%qg=Mp5 z382PG_Ci_Mjq|N^<2+#}{4hMkd(&WY+ZR={N7yeTv9UZFVW=vtW9D$i&imq)ihO-a z*M3fxeie1P=sj7lZh264cF^d#7`&xFR`AR4WU#73#uyVnj||S-hmpHy7^$1cfSrzk zW~wy|6E-BV|9I;uO+;PxwQ8Ty=SA!9lH~;3EkB z5hVWzqJLbPTvkd-k46-62OQ(QnCW1@DQ!6mXAi#qJo{~~71*S*&Dtgbrs@tx#^n#X zEWLoVOhudvRZ`7y7Nkd$L-P#fa`HC8;-%Nj;o0lc!GxC|y{=;e$}di=G~H!=S;k55 zW1It8O{E5+Pc|22qBAbDpdZXgRiCx^qM%^vzC;=Q>LH7y^Jj5SFo!}?yU@P*v`=L{ zMwbNNEXQ(5{YEzg_+O!ctgr7%%3caD`Yy=fP#!PAeZ;__v+R`V4wNFxXpL%Me;JWe zX+t%UBmvGiJNJW}kd@-l-|*J55M%|+)D8V=I3w7UX~ z#!3$QLLSMDpeL3dTs3*4WIMAFSco;FE?mro-z#{TLoS>$Q^}06^o6)cXJ}WmShM-d z0p{KVk8gdx{pOYof(EX=ObCfkOOWCpY!AI_x^HPArf!4$g(W)wn&bR)rp@}AO#Evy zap(AT-UmIh_1ubUMBg96$M3o)u&bcLtq~EWQ zKKdu$RL`S0T!*Hgw)C`4a-EJ|o}Bu_KuLDq*l=t6bm^uM_B2#6=3qX<;lBs4!#^A! zA794Ran%;bd3FY{%<{hv>vHqy9*8NFcEF?fftVg)k7ejnwm1VeO~SYA~PS3 zS?+`e8DvIuk)RM}ZWnZ>Fx+v0hR;o|CuxB&MLMmKQ56)m0@{e4rTh$&HPoGd`Rgkj z(j%D2J8=fW<#>(Ls-rgB-JA^6x2*4ZHbLn!&P{xL{AmVE4Z6xn4;qk=V>UE86Qt+gMs)idXRmxxL)$62ao; z2C65R4euQ(<+8t(5$i>p8CG@O&ZsbJ7j~V|*jbch<9mxLGPS$B#6rBki2f^@Di%BX z3Uf*kn{9pF?shTx*B9GJ)x&v~)s5(jBR~m-2kjVuA?q$mVV1VgNC5ydNUCzb7X%W3 zTP=f*2}E>dZDq`7DDJfKJ3>M`0E}71NpRW4pVFWz%N^tKTtQ-EGoO20oH(p-p=x3^oIbeSS{X>|?}(fCphmOC23E0{6}%8Xr2d85&fVEDilO6WbLRfE5J zWO(X~2Rij-yQ;D#T}?QowxV?Xp6f)(>UtoGCiFy)t=ClxrRjIk0pd`C8|)#B6|nLS z9Z(!a@30s{*ZXN<;>#4DK(t&zaNP7q&DuM(nb51IZGy*u)w;Y_Xs8b978<5?`^A_* zz8ym%dG?GH1#>^#mo}pZ9g2a|Y!2;ksPW}_1cd#?A@un?EzX;Z!(>592S_rQy9-BW z>9|PuCJ^I3B9P}oaiAw1@-=yJ{AOX_F!8}V)wpPVtCY$Emb8eeNXkG@p79Ov{#jfk zS6LzkxNU@{`!{+Ym2b^d>OmMhqvEx=ph?f?&8DqTiz*260`J?1QIVH5j>6+dkN%I* z*t532nSthIJ-|zM_*Ad+v{~=w9qmtFX*Z8~pMZ;)pjFOED{pIa{P9y%V>vgZ{|w(= zMFq?q0o6xI8dzzgG~XAQm@5;++QLJ^6Kw6~A}-D;7!qOQl{)K80g%KnB3$c1B9ZL<0_h2u8yG#V1YL7PI%0|lK1jIYgF20U{q3rH(VEGUt zAtXj5IwUK6Gu0(6IzoXm4^z)JLOKsoyq-6D%^8zF)jPih$mWq1*5FGrjF4>)yd`Fr z7?;Io#BOEIUi{B7M=8z>h~D^AU&Z^RuW*pY(pwDYP$i5b-`*fVQNB<&g?+&I4l4Fo=x7j8m z^lWuDhrttZLBE0w5Z!qVE=;hPYi&>vwz{d>^YffT$0c1(bUFLfMB+r97~$mOlPzO7 zcK#RBAQH#9K_86cDjM74ta_f17C%crrdr!Ygyeb5#;A+-T%IlD*TdNysL`P_ZlOkp z&2;;+%m=rf;dFHez<4DcN9YNfQ8dIK9q;+u71Z{L^X_S-z0OL9cR9x4-9S+FO z7hrM6n(xX^2_9wOU)uy=)wA`nrx=o^Z!TMLOWBmWT{bhoLxy!*?eo@cc%QMuCf-ru ze&92e*xPe(`x|N}KvnI-`zmFR$N$Ea{$cGUjmuYTH9b!&zjaNH1{#t1-f&;X=uP28 z+jG%&fY4rCoEHq-qW2bel?i5!JHzaeMhZJ{+T$)5n$~uY^S)23Y@2WZKITE~6j~1! zwD7NBNDkt#_>u z99-9|-D}VNwxJ$oSGaFTTJx{l;x0lXbPU-$kI&j9xq+Ir)qtjhbDM@!sJ~^UvcXT0 zef5N{F3()#kws%Ap+aC|KFp3I(hP^=h5kl|9ajZyhl#6V?gim7`?~K=zTjz z@7rbc{&|evKQE*AyD@sdTSo7@F?!!EqxbtUdcR*r?+;`2{;-VRAIIqZaT&eu$LM{( za6XSNkjIavH#D&@XSOcf0V3%kGOw4sjjyDdC?nGJ4Fz@qAkytdI>cN}sWqqaGVA^- z9-FDeuw2b}v)Ax6^Sl?nuOq&1_U#cX0Y@16la&rHw#p_CRzzw1!^DAT_l}zY8ZPwI z5+eHJ`V*VKQ5HJ;z+w(ca}Wm&m9+O&1n5jOGjtRw%H+t(9{d}l{W zRvxryvhvQ3l1}o4t3t~D`@59=z-cer@Z}sGLL$R7SAHQ!hUoMaj|m$#s-vU5s&j~13NcvHa4D7aQugL7k*u@^O<30}cWv|Qm_ z0}M{^Wt<+6U^GP&Yx$D&?Cq0RBwqkbK(oJsAyQ^ANxTcOyxSxLGtyq;h5@Y_Kn!vl zW%O&==B{qCQ*Amqc{JXn{r=IKEdpL+Y}RYfJK zD_}e1$;d$exA&{;k~q)edK&maJ+i0qK7z-pC@UiMxGTxaW`aTIukFPClONQz5N&`Q|D+r6Whw7ud)Z&5vu4r^NqkDC%k{U!@fH1!e^H&87+Q+=~#<%cTKGH5{otvvDid+d4uZ>4@$QUVKAaZAZrBF9u2V z(mdY7o==CKrv&g@I7w?_p5X2)ZgOSQfVYo-#}oT8G83FTiSe}UY9G{k3$2OiJc3U# zKaG1O=(p)YWj(iBRV4&~W1FEBRRGH{=3KOGaAyPO!Q#|Z795&}k7h&6KklS@Q zcLb%OQFNlgs^o=KD_zK57>CPTGgFUdisgx3k{A^pG9tRs5G#1c#Hpu)PH3eDI7KpV zHEQB@jduVN18DkNnFt5_=uEzp_9+Hg+*_;)24PrsGqBWlvQ zA{<^V?07Y!U~vw`m40swxwTNbzesoDP|hO0K6|+y%Cop4U(9D~0f+LUaYlnyJB*t<69DXMm`1zooPnnm zo{pZfOW)n#@6d+9uWgZIx97i7-_P>2==L(_!?+r6Vf^oZeHFZL@el0@<~mbMgAN^; z!HZ|J?c4XyA$i#Dvt-pfs@2rcLFig!W>R=Iud^ z1EUJ&V}M^2n{o&K!K9~1v)RBQ-O0}Urfts4Sz^XDf0Wu!SuQFAl+P5kEti@ejp_UU za5xrU{}=Dg9=G%bmv05e9p_s;E}?&wo+~v@>n<<4ZtHjIvN>JT>3%qza&z~(VGXCN zm@`t~7jzS|p_y9s5FcIaPzBH`z{q9IGP*9h7~TL;U35G&;Jk3E^uYu$@iy&_3o*Js z`)sDeZrHct%I8~ke0M)+xAql-=Y``jC{@+SoX_UfI&zxuCX61*!lPtJ=z6yH<#A^| zJCp~ExpnWI!d&%0Q-xn5Rv@fK?GJs$cyQAhGk&Xy8fST1&8=^SDx6!<;gJd z&DfTd#L~F5n)Sx*0`au1D!{(ltLveJzq5*5E-Sl}g3E#l@eOgF7Q3!9Pi0`Z(a6Jmd3~2KNp*bP)8?u2C zo>htH30$t07+VE+j^)6Bw%vi#km4C~OI<}L$ve1JDSr?*O}g7RT_d=|C}(U2s6;ix z9TE2DgiP)M=v`-OBK>mjJZ*lt7Xau$40&tsV{bwTbNzq?LLu7yQIKSpS%TfVlY{@u zz0EF(hz9ktXp{JpW`-nHfkmp{22myiCZ3{8Kvx!9!J?g|8%U20@C_G;oCaxjX= zi|A#se+2B^!kZM9yOal&k%{X$=`{8-oc#Bu}#ba|?(jRdPuiB9pK`C^wK4%P`$-SVEB8#*E<1bAo zwGw(xo#{A?raL%-U7k8E6n4a7NdP9YNed5Qx`D{VMo`NgG`}H`5yku)p2Mbf2`c$+ zMm>g*VuTDumHc2_sr&e68il!&S&4oDfAB9XhPkK~Th9WW9mE^EZV z$S#p#E%e?M+|RRJ)_@_Ca6cVd2yl$JmwUF4rf@fR@Jz;FTp=cIB-nNH0^kn|=MxE` zA7bKP5Ey+$s4UQfAQLCGah3+V(NXR8(5VHHGC5mKqyF{}j~@TQ)To)qLVcQIsyAhx z6LLDv+E+mH*^g3n3Fk9&aD|a)L{stZM4nK)yF&A?y)Li3EMu3EAkSCR#bx`sA0b>_ zLk${#T(#hY0L%&{05v?Y&s>cFPdgzjbUG2;>Fv(IAs(Syw+O6=LPFgAW|EgrN)|dX z0c00}-yrA#7P6T9pAZa7kA5&!eE(n{<9G%x$eSNCtPCd1j#J?V&=T1!g`VxwEL1ss zTJ^e*t3J~xBtOxnxpolRwM#_#>Q#m8a$>vSFu zpR?p_H8qJzQReOhHi!a4E-y1kV6+wc#Xbhxew)XzQwW_(^#k7!yTvEeDsUnaUB7|M zs1TpoTwrmTa-1kC0+y(mag;*HHy|!__|6wPybN}FP_JMnZmH*K#Y(~i$fXd{nb(9S zIEA|?25FYXME$Ht(rafKv2;5BpdO{yjrlledGe&IwYSWC3v`ycsOe#McNXr>++V>k z+3?KEaaP!hd@$z#j*`U>W#++D^rV01Oms@`^%h4c0^>ylDX(T;p5%7nvBSue^DFEy zr`@d!@%F293+uA?aM1GI1sxY@laPwuN4j->gtNVg!8ECK77dE*C}<%4T8v4w0H**v zjq4wdkHzj(hkS7r`|<8r?96SP9}6i`!FrP(^KN}iH|tZ(T6p~b@I4#<3SARBzs2xp z6|@PhvYi{Saf)Uj9Xzu5GOEs%n1i5U0Bifv1HA>ts4h`Q-0j5N&m>HvqS(93)!+n! z;O(n4&*8sKFS`$$+xgTbSW#2p@L%{}{}ys_ar3`2DUkxIib~4T>_~$Y1{1`o87{O{ zyA0}Xahg+k;bvfed$~`<-j(KCk4B3arHXtj+Rd3Ptf2dBchC9SO1; zZ}}h>0Y3QMiD77*pNDO7c2^Bf;Akl}chKf-RwSRFtGJX$@ZO5fQ04wEx*SA+xS}Yn zs=fyG8Tpszcf)vRAc%ZE&f*>>{%X=Y=y7=IxT8IttTuPRw~lskeJ8z*Yis28`dK9) z{p$|ci#RPC3h=9m$d$F zWVlG#XrJd8{M|UA^yYD5(9PpYN5pwAZ_vw#sHRa!+o|gQsH7 znS*v%xE59k*j4x$h%7E(O=ztK*-=P5&6t3c^lXX^=4~t6hMmdK3$y1DI^x!d6`fu3 z$C^f-q9j%5nK)dpOZICJzQoeOvmgJXO{<&m4gMJxB|J!AGgC~5xv%h@1KU4LD^rva ze{e>>?Bx0=j)fvkKH3_mog9T@9+^Jz-Uv#^2{4+7-i02P@0FW88+(eMp4%Yw+^j|! z98)il2~m4{h|xz9=kcygvTep$8TR04TNU-PncY2=(KD7gUHMn%9v`PqYVLr6{CNcq zRob)_XUCK;*XDB^l~{op?V*YF;c_N2NfL3L2_Q3B1MxZ<(6J#s>i6Jpikkv?Ehryv zX`_`E=+1uQGgaap*jseSQ$3e7tta3@)<<;ero7ie46t2;U_$M9DfI2sqU)0!b2h?6!y(h-9Ejqwtx@{M@KXby}) ztKtcbdE~7qQHjW)Z)iN#V~fmMxM+y5Kc&03%vDSgFS0+>6nePN#R#PEm}Coq;p*~I z?73*i&xw`9QUqN*E|73UUF@!K&|t}gM@G^~xH>6~gF~LwJC^K7*l9=V`hh1&`95Yj0-y z+nNYtePI^+k(r_F~7o>YX!ZWtpdOVffC_h(+M?RBhu; zIt!z+Y*%DeT5N7=7onT9R7%wGrf)RmJ}=KF(9L9sWYm<=nNX;AX+(N;T-`VwJ%)J5 zuP3CmMU*oALyV`-;?34})*=2G9BIH8{4Bsb5#wW&Q^(Lv(f@Fry@*)uARy8W+e-!` zrH_toov~gidJX{8VAtHv!ycn?(q!VUGcl3&GlF3A+{BRj@>#px;>epKSSN6OQ*4AX z+g6*DYX)cO795kbo&`dpv!$WmZqLLe z+m#h#RF_Rg84`zS#rcZGWXV}n^Hvfw6V#qY1L$-F$9SX4IoM9>l9W-hmoR~7U z*bbM#_HkdO54Ylqbny|kob&XEGx5lS z5y5q|dpqvUWD5}g6{8GEYQ%rC9UNZ$9t2Fb_WWY6-b36SXgh`=07i}rCLC|gHUqZu zlK3S3p~ik@HqJm(4Xt<~6ANflyDT75&_IrU#E!8uc!}k-s=!@((G=2+O2L9+{f@kumiBhTZz`k2}2>>Bd05dBkEVii5?$)z+`w zV#GCL12K%y6^P>iemnR+0S0|=&qTv=P`8=5XyrFS9#`kEH*LhdS4-V)ssgQ`+C=H~ zMcmfSqW4siSHEx}06WK9#+O3F0#$Y>%J4~!^oIp9OmVS^W;d_W2ax0UA1u4m)ccs$K%!rlxEI9nL1-yv4orJ&8Sep( zo0?q`MMHo6SSC(eyKb)%w_NT6+pH3MJv}yyEhiVJWAi}ULfDqjiDp7zi|U~j4c%P^ zc-mzV;5Eog0I2KB9~9zj%VBFmrD?9xw9tA3lya15LJISN6BDS;y=#s;+uJraK-*J0 zxLS+m@gh!GA1D&#@uT}}psE~i;B-UfveX^TP+O1}tVD@(nl^t*8;bIiVQ>T4(Erf% z0<^>A55VEIkVJK%gq>txW~}#NI2tOZN1D?bnZD`<5z-2M5ZSMe@ciyGNwq&U21rZkdl`Fa&yFpo@QIV8 z!bi=mKA(&`0sR=tOg=6r@Edax*-6q`b0zu`ZtS30%HatRW6wN~`C~``d|m?AI(eZb zj*+%(sy5_)r|3>jESoXJ>kzzF6Z&w;8NzU3D#mm1radn1H zD7Gf>w}mZ`lBu`6yO@H54ZDj&bG3P`XYcBxzRK7JXYkS&5;BM3 zi^9=#b_XTZ(;X_L#L5l!q^#=<%+ToiLD)8Eey)SE>cg@aIgxA$@!V4ksNz&xdc`kESM==~?(ETEGh1*zr1MU9I()!r2OjW(j< zLjS(Vu8&`4MSDH}_`#V`;px=RZP9$k+{3f~Hb!4Ej>JOGt02khPr8FuaH5q&>^m55 zGj2@Qwyj54FBD{po?KWyt06c=pV*>IlZh!oZXbiE$n!KJ8D{Yft9S}^H84A1Ig4gbP2CpPa2fl8LRjg(f zRpZ+LoH)J)piQ!TMtNJYT6l74&zK{iy<1lBT0*@MsXA* z{}FS{~H|BV4v_wuHxm8bhAiFBm)?jy~C<_NCSF;a!uOK~rKdd!79x{rdZqu?!; z{h1v=swTC=rQU7@ZGu8Qam!tAY=T6;DYLYcr`?6s^dnHpu}cEV^1h1Mn+hp z6?H_+wjRnTW{tSf;v&FI6x~I?JG=X5kuIshB@t^8_f_9+A8oy)SUbkj_Q!n&zPexd z%BS#KpTa-S$KkpOtd+cSF8S8Eq>G$l4pnZ&uH1^fbt^U_n=$h$uhLgurQdp${&^+@ z1GiNVq^z$K{Obh&ElqH#FMOTiU#Iv#=oGi-p8Gn*1x@qf@c zKIW!x=34v=k1Jioh>Z1bs(34C9I3~aqb?D+%(iXX>8J8uc|Mys3550=b`JLv2asM5 zd&W^P0sT%Hc>^8~3S1ly{zmzOLnKSFfnZZ{n-%#3S}^NpsOidsurXtnz*h zW?62z#VYyJA#GM!u9mjdCy`^hm%?VQu^CVLafWK4X`=-DfS|K9Dju_;_HZtEf9c*c zjYZsh*0iD#9}L2Im=K7Zu~-I%PF<}_hG6l2NSKrzbv1E_-XWO31~SWm@-V^00(FU9 z>$>fHR65^;B|CMs3I?|%pG4*&e^k(f^V zl(0|4jzcfh4IrO@m&xWrXm6XQtx|j~?p}vAfF9-#*m7BJ0~}LGDOt1R4)*rREAp^P z&tvkuyZ`FP2S=L!%cSp}segl?r??)EWd|M=#VUgk?=lmbpqO-OXgXQAXY7)2J%2&a z-x-jh6Xt1^%+@Di@FPF1OP}+$CIC}GrQo5UOSqDuQ5@hznUIG-5@{$`MNRT_rmB z>Vl$q0SdIgd!l_ImH`lIM`DLBkQ|^yZiaFb6g@=h)a1RDjKcp8+-vHF*ETuVkgH0q zG7KyHOXU)ds6IhjoQoTq368+|yZNIJhJ%&}y4whU24|Ib**QkHSoltCd{%l*6&H0Z zU7OX8lHnePVAAu1U+eB}vRCK=t&z9T>^#PTMg$;GV$q3B`#N6cor57`{ndpaK*^_jji9N?vYrap_^_8seD*u|q)`)!gxQ@9q9N?uk6k9*%;AyjAdgB98PM z5`o?69GPQ95ALsf9{r3*iuj2pQ{9)oM%U>@3?yEObt3e6;2yAu3C_1PabdzmXBG%l zKVUh~P8VO0H}|f-k7OA{~=$4SChZ;Aj&Jx)=4ojEh+-~6s%a*G4#+!cr1 zxT#7c!rl!-%t7j4iUle$-iRYzXuE`9oL-0&=(gQU5$dASC-~K?CnuMWz4gB*GEEj| znj)M2xU;UhvjA!n%_>C2q^8uW8Ox`i&0^8Z!*G9BKNw_%>rkL6nr<)kKTz5UUk-&3 ze?Ble{726-ZmWdc!V(fmPkl$)<@J1KE{w?OlbAH`XlAB#Lz>)-hu9w z;gR$rI1(R;?e{_+2$PXe2VWCLve(i9pQ> zci#fA<|@sTps@l9DoB5mxed&1n-v*M<6$IuKP8966^&#MFWL&aOZ7vU083BP0cs{a zv|-eH@b9X45BZ4p1x|#uRTuzXn*%b#)zZl%KEXzl_{JjlZj2*1Zklxr2TA^pT^A6f z9)@*PVue{uipvaTQt|AYK6Dw^kdMnQwbaZAiMpQ@M>ElqS?VCcITd4xo?WPe)ILps zg;r6#cz|=bcjd58gyGOi5{?Or<>o{DVP4Q|FE@C{Nx)t!4$D}J^Fu=|#L7TaJ5|Yw zehGlO-e5{dbxaqf*uTY!2VesTYrecu6*x|B14kdMzinHg1v$y$^P;S?+CG7!tca+~ z&Co6{pkpZ@d$GU~EXSEq+R^bv<}~w~5r71H6ZtH-7XwH()OosX%rMF;i=8%cWn#Vk z1sFl0!ms+y=Qp{XU8@L<4T6Tr#4r1m)gX>Tranj4t>C>>6p)90&iC*S1XY|4RF%pS zc8mGU)GR-FWg6Tn-NzN5_-u&kFSy`zC+4XThv8$?RA=2p_NjjIm}oNTUQF5Zh%@;d zDzi8$S|QSnQqfF_f5OWXChmkPX+mdX0(aarP|4V8M0tpXOq*sxe6`CdYxRNhYhr5~ zalF-f6U@)I)eL>JKCmTK3f6qWv)JD}EQ^OUh4?Xm-w@zIzFuJ-A-8B>WtXB_1XK@h z0OnMu-O9e_uF1jUpmEs$XH!XxVbp#YsvdTIw4Z3e3xf+$xOR2@Ke-bK7o`{LK)48< zO#Jhnpg_;CKO7$;ZWAJAf@F-rm2yE%iH!J8uFWK>QNn?SCKHtGh_LzbxrD&DZp1C5 zg&mQ9B_dgg-yc81_5<2bhefxGv*MRu)Nj~lbC6=E!Rddz3|N}^6Q?T6hED-FCImx7 zgA%&Kt5YDv)#nMR>vwnmAZ`2II_eCbuhv3Dt0U%L^*Ig2>=hxzB zDAgXs^zbj`Ry+3KdhaL@kAhZ%n!s@aJ?zNX_^FbIw@t zY@ydqv^q~U4=SezH+-k4_c`oWaQUZuxwdtI7cwUY;WX}`18wv2s!NwcCglP043Uil zSx6-6X{o~vQu%3{qIC(+(8`Sm4QMnFa$sP;eZowyeqxx8t%z4<;3aAA9#u4grR2=O ze1B4#`pCPK%X3+}+lwo_IF}(APg)=2e^7bGzd=(LviG`+aVMZ^M70*RMr_DpS5R0z z-E)NMrC?u{d3eu`Mis$>d2`T!84`5UN7_uwlrmj1(iX~tK2AysV;%v$Lq&oWs~K=C z(iuEOg{A8UA(?ihwUK90TKD<^w+g%Q)>;=FE5wF$ehyFzVeqH45DgJ(`4Kp%h?Q3~ zyiceaZ;EtK?O2Xu>T-Eylydv6q_D6t1z`tW=Fe-FZmAGrM|=`1s9DFjb&M_`G#p8 z+sNhu&hI1x9F7$&%68-P5Z81g(|t0%6aIW1S~4;FgI7kbd0R^BW}} z<;?=EIuOTxlWWd$&}78a>b*-ti*_(ca(M1auf_cdzd#QD?!neVnFl#_OvUCh zBQuPIQp7~>=te@MX@)R^{wAu3Mp)EqBb{!~$T(Vb6J2G72iJXk7>y7HTl{vR!KktDToVZv2>WJ>G~TVReGaSH~gmchB|& z1S5QI?Id%XKj zrCy6ItF=cRbB*rGB5O)~TS2ouJ?^1LT>pZPq$zVk=;Zvyu#+YU^#3}Pz|slNmI67} z^W*UnHV0Dz-Y5`i_nzTE(eB+b`(Mh|&}IarId{$twG^%Z@P&`Y`!7#lKbY&gmu46F zQ}^glNztcEjaH*KOQ$KV-*7Jm%Xa*ZyyI?)6MXs7m|PR#l2c%80L|x>xwjh23x~&B zOj~5dfp0PD{pE+>egC`f%_kLPFnBO=dJuuC-_CG}Y?x{-slivGOaQ1bB#gtG8Ss)kS3@-M+98Wfymnv_e(ivMU8ITk>FX2q=I}>Dcrp7yT->U(`M=F( zfB*5fe+VCm|NHodfBxr3zkhISPTd>%8t6ZDZ$P29CI`~|Kv4U~qVql`A5of*@~N-x zz0={v7NL8~Gx*x0jp5!mCI@p4+|0jt-Hg3>)fZw>M%3@(S4=R~n;JLTL)dwoiz`yJ zUMi-KJ&NuO`u-rZrYZ%VVeGHcLG|&D<>SPK~Ng2Sfm`MC(S*AAAmSyYdD}!mpvhxeH!Te8Ae#7w5GI21a|E|K|ujJW*c}Vd2?NOKMA`Z?mJ3|$m$9t7i z6dB80upQ5O*vj0ol~35IImy^hOtQij$RypAleCNXB8OOP4K{H$OSjF0h`r~gr96e4 zLt6<-;W@ENuYzPJ9StsUS3C5@l{902nY;4%>&B+G?$b)?y zNr@cCs_&gBI3ikw4D{-C5xy%AfHK5y1MO=3M$6qc;&`l{IHX^Wt_dozfqEbVIS?Du9IQ_y~JcV&E7?}7n*upoMVu~exDW=8ZpXme){RC8+M2(f(QJYw9%5Jz{yjnq-leBBomwMFhzTiwCMi2 z%W6_`I5l+`JcU~*l1Qsc%q27iiT~~^Fa+zio#CP)NnB&}pI_F&PmXg0@_>^1^Zxyd zXW!H^%NX>BE%=kyWbmB7P&siTK)+S#uVsJn2CX;)a(rg1Qq)~I88&K&TG*871PiJ(!gOjRkN}*0$7VEq#SbFIg!2J{GB2R@x^$xn*77{L~#Dv_fH zlQi7+-_?G48l60OfBKx_((3*`AkXqXNJ+^7O{!RpC&~K)uvmg!S*uN2`9vMDcL+r} zs_;9pcXS>@=$r&%fM*qS4lbCMx?aDNX_mdq+iLk8HK|VL&>3MeN1MjuO~kMy9>E!o z$IOu#uE%GPc1+qr^;AJO#~A2Q1--kHQkGNNT3zkzF0ApHN@7dPxgQsYTB%r8>21V(UVHs*qMv^lUgA+H>H$#6MXx?4Dh9mjCX%i#&X zB2St};Un^tQf}b5d$1ZnCV=iH4sUySIVZQ@8_K~Y?@E|%4&KVo(fbbr;PSH3f#S#^ zL!97^1q=!s9mSXD9>);Fnv4#EQ!m-X5QLp$J$6}fOG0GD?7PsV&r^u?x{IR|-_%mo zi0hjjnb643`dk!+RMlBCJiM^tg0)BR-m9)XK{7dT?VTzT_O<7#(7CNU74&3Z9dN`c zfOO@;Ncf7kwsN{oyu+2Vh7fZr2Y9$Tr}0&U48-dA|LOD@M6Wz#k!23qRyjsAoZd`9+KjVIXnl^H4KUCAv4iI%%;6;?~FnIGEoa%mn=F$me z0V}uXcO>PU|2SW0&FwcPp+xZ#+SD|%Lg=PPrUPS8#0;p%iNn_g-9Jy%TVhF?1`t3_ z#~EOm1Nx*ldlaMZAAaa{JtsuCTEwF(5JyhqJ^#SRhfLh#5m9`YjctAVs_3t7k3&*48AVY zsXV+ovg%IGDW#!UVxV<}@MDEZRo$i!u!376AqgWa9*B!3BfR6oW`zdXI!%XoIP%9? zuPHd5zyD4g%IwMqH%{3^)s>tN0+D<6*+!ap`sZORCx4Oj z05M@M=*b+J!2%A!u<7-FbkOh%g>7>9`<6=}7OAeUUC$z#{S@B!;`ohB0(?WSXj6%B zP34#dLwcKZKx^=`t8VcQx8TumSzxId?>1;$l$8`uyV&c0<|Lx@ z18bZ?Na>>`jCv!qd!aANbP4Lgq^+gzLjM4o@v%_}6WklQqL<7{?lBH-2yCzP)pvWw zY%RXlW(w8vmT&S57HR^{3NnTXJWV7BkRD5nuX4F*x*!Vm0^lUJg2oL5LN_%5&>=gi zvgnRr_9wtO|7mKn+g>-*#a<(T51Mvtk~+nF1;sg|m{11;+6#@vi<2Nul8W8{dk;LR z(8>AJg6_78#CT5-+h2E=-}?__MyWg#S9FBN0M}6?iXDnB5JaDyRl3z5=hSN@3(HTZ zGy{$T8SKg?ai~ErsNyum&`L^wRsmon`+hNK4ro)E#l9~YuG9>DX|ZVmfMoTec?Nz9 zbTUG8q&OIzm|1eyeOh zr>C$J60V;XjSTm!U8eR5=MBnEt~c-(*`jTINLiCl&0ze=nfj2XianV2g6df+>-_T{ z1UN{r(TmAiFh)o}MtqGvr|$INR2Ku)}X#$p1)jOAu${tD{oLQ{T3X=oX|; z&LgzjY{`zxg~P4b8tKJ#-X~*VWt?)zz&xwVIuM65VdY_9_Q#J)lmzrAA0WJ^Eao%^IJ%9Q9-E(Evno6|nnX$6t@#6LA^SAGucz7l@)%0}Hj;C%s z#_mM3Jl>x?d*awvV|hnEOsBD&_I50WKy5Yq`VF$tlh3;J=#-FkwY4Ug$^hP{Dd9?s z*}lXYI1>6Tx`+bR{{S>BylYF6Veq2qZmMVy4xYYw6`j0z{U=bK;osnq@#6H|i>Jyf zqqZcD&C(^81lKN5Eyt7wTCG}3p2*e>QJ+;OROg{#%lixGNY`8a@fhj2Bct2o->=?9 zCvTshJbC+E`{n7&H>b~!y1o`ay?uWA{M|%f*Q;%{{lQR{E+NUQ7w@!Qv$|z2#-%5Z zc!&nTyb@;+fI{1njA6iS^019ddeIa@A=vR-oj!JOFGc7c1m_1kA5ISH0mNOt{~*}5 z1)gh1{3LrWp%2M+R0r%=d6u4Mr0>Cu0}m&7f9074!(8c|wCP2UYHzT|EoVGJcEU<|7v0GOEs z42?0k+6>)m*5IU^?F2o&i555dwb&Jq?f}{+*a25t2pg1Hi=UV$mzX4Ch9{J}mBHI) z*KnYewavI+70GRMY%kZ#kY!}=;17lu;SwcAi3UsD+;cGV1-%DjKjk^#`-~=9k_8Uw zp;0k%z%3JB#F2w2Gp0T%f4>dp&@hBNqSIhjhG>nR5UfanzJDB#fo(P zIaVVXF7=6cA&$`8HRN_pvp8xbWcvb?Y|VtU*z(RPsobyS+nF_Gn#@{tz-Clnc$BSuR{`W(zV5;){p<9VJu5bjPTP6}`lA?Egcj1>$5vDh|1gaw9a%%%cwd zy1Se-_&$zWb5SN|obo1u@=?<6_EFqK^+nrYY$hgTv==MND^t;hpNH}3lcO@#+N)UX zzJRr6Z5*^nLhj~Oa>?^NBkn%_}vaxh7o8`<9#Y^0k0J6oenNVc`ryTL&6HjJbYXQHx>7yKP z&)WJ%_i?$=j0)nWUXq(XDrN~pBmqo4Vq(G@Eaa!|TzEipfh%|&@NG3t;ysoX7t{;u zMF{{TJlDDYv}`+T5TECKVE!23%-S)!Z*M906Q$b^5(bE73=89OiXB3DI?)4H^&`Sgo*(h6*RH`jL5>+z5WqG)Sq^Q=_B`MQ$hq?Ffki zT-PoIBb!EN&<-f-qcOb(cLNltOW8dlKA}u0ta-J>!r*7{#OE3XrZtp34}LlLP%AST zkflD@l=1=mDK!5(&22{L0#_B-Z@XkJB(A0rGpc>`ROA;X`I=RFRhasN{G{? zMW*e!rVx-pLVNLBWIslGyRiXf=W0;l{!Ypw9q)8&%15`=sZF36k0F|Iw~#Neh?{yf zh}u7X`|Y>GJb~<~-(i0ijJxX({RuULS4e0c)DsG8F8L~Hj_&l{<$-xEN;|pOuwnnj zGxHG?-^j8l(5b!HvChhwjK>B{&;o@;LIQChrG zN6IjOdj$CyFQ`IokzZM1&gxM5E_j*Ie@k}-g8rwX{wU^wBf#sqvqc_~yh zD-$ySBm)Z+1o3Vjn0yn)bnBa;%xSxfXO`rtJ69+jc`@$NZDhr!+{sI_XWnX6cL)CG z=cW^?{Phs2a13Wh+#$$0E8Ne@P7a}(pO*`JN7Y@ucNFE-dPh+7^6Ym_wWE7(eR11n z=cn00_fk3wcJG+EAge9y!?;lxO1sy|- z?H^?G7B!4v}?W_OPvUx4oSk=+PyVjb-&7xs0nt{h{fb9SGDd>bLUY zgabP%1DzNRxL8Th-`UA5Du;fm{LrMgDJyot(pf_g1$ca#&W8r@CX%cZlvv~(Sn7)9b&4DcA`ip-$@zG_3r*3UKioJU8>%sK(V46Re z=FJogab34NNFLCs^g^42HE(FCh#@RXJGUE5L<#{z?qjr*I*o{W%I(Z{KJ^e*ACnAn zRzWQ>;QO~PPCd^=4AX_n6C7)Q(}}fJW;)J6kp&xuR(h3(-+wg&?D)p zGR_V-yE1CPNm*e?4>%CEn5SijHY8B@WJi_i#nA$Bu!}M2u}opluB#eb;}Akuj%Dqu z+Z+-UHC@se2nDu82Z!cGe%301xd=!!atBG#RsfSKRWaNeyJ;;CWf1E_^b!p+7HLaDvzI$ zz>iogdc}JURoxQ!L5vUt5D;I7Ao!0c*DMm3s1xrc6Ra|WFQ%G1@q{Le_`RXcCHTYM zl5cBuBPPX~xMh-@UyotT!})atjfj8<`!hr|PI6Ge8(@COXga{egU&Xd)8)@T2Fsxn zV$WFJLpthmmHZrMgtOIsHC=j;il>j6E(9QAsXON+BPdxf=0tw`4ve_qVn#_-?)NT? zxZq+&%)r|h%6W!NGvM-v(AVbN)degln)VDWEA24PZM@OGpCzm-l3@H4Md z6(`eS0b0CW4igFAZ!HV+ikBlPL)g zF$bn1M@jyUTbxd%7R|@bgTz-DgEFz*;-8Q{S9LC?*rntU$67BuY&iN>ZHi*wEf6YB zO(IPR=TFce76HE?SU+#W`0;os?U6JLMAY^Ob~-@#*^4VpjkD^%_3@E2MS8x{-JsoW zvunH}=W*W{F2|~^a`QAm7t}fV=#aaM&TXpJ-na1K?|0R2f0zFU7HSo5@^sOuPpwM2 zW_D@-AY1?IFZiEd?uolmUBmJhzra7mFRcBXHek{eKR?2I_oE*kfA{U<<2P@gzC3yM zvWxDQg%rI>{!E4pnAo&X}=SkR0-$SUIbSp0~mMgo0HD^ZEMr`W z><^S*n;zsTGKieo;L?|YHv%x0cT=v}g$a?EnE1nLTn7;dH3qMc9Dzt=I;UyqA=)(c zhlDb!s5d;5dP^@f=sT6z`+0 z(Wu&c0<#QybVb;Y^WJ=lybLW`X8^8~(DI>)$9pxaYT0@*f`1-wy{OCmDRl)wEA3)~ zBrLg{8fdPxb`G%qX8ma*$Xa`5VxpXO!6@+=yc|F)we6wq!mSiwljBDAPCn|uYbj4b znKXyeLc$A$7QZyydf?q9-1i~!UAeIrUiPl4fe%e+wB|spH2>YH* zB@W@mxZ#=%%6)dD&J4ne?+!ODdy?ZkcoknSpl`gmO{LRBqcBsJj2t)&-k&FUyy;W# zO(Bm|jMC1DaO+HLu|auATkqoTP*v#Y2;|Yvf#ndhPW0R+;EA}(rCRssGf~UvkSZt_ z*&z(mKbuUh*Wx{K>t%}gp+o$~{?M}?Jfs?o1$iIa{=l%L=ZpHD>0)+@`xkLV*_i8c z+dKdr3I4%lGR!S;kpjk6q3KC+PN_s??h-)+A<7WjrVPX~&9*mPnrNXs0T@4;#5wVW zIM^W34&u2;HR>`Y@XHGT6HG#Hw1TR3+<9L2eQ{Iy!u76MCv;;)9n_DizUFY{YC_wJw?9 z`ps$ZvK&BQ@D>%7HDVq4DnD-#3qf2@h3t@*$HX}7sX~z$dm;VCk;!{ViuO)RB|gdq z&caAbI_}Ac_B+ZRc)Edwd(!7@gF+!J?Wl(G$gjCBe0%R_3bmi_K8nd-)T|eXAnM*M zM44ICtUp77(5ENwgZE9AXMdw(@&5mLU~z7UHv2YeyJC^M-u;@hmWy_5A=&$1%e)m@ z&}biWmUEaMP(HfE@=K=TTgF7JXC|V=PPC5K=vIIohtUC})Unf`h^O?=ehhxZYw%M% zDJSHYYJEg!s_%^JZ3_X-KT3zBpGpsY%{@QCA0$ zSH4BfFulUTrBRzv%~e77e5g|wL6p$r=B4p(i|l_|2;77`zoJUj4^4Mk96t&6I*fsW znqAtkQ$ViK)ps&TkPUCv<}C9wZ!vcvkqT7o!c?qMeC-jdbgChBAuC5Ne$i01$)#_E z!PKOPkQbou=cZ{55HYN@%ZgS(oaZfG1^$2b-h?}DBS{ziD>ypuUXeXyY4Or-z3DrL zrYM_ZiK0o$?w(6O5LJb$LK6j)v5=yt`@g@8B@>CnmWe9bo^IX6O%;HM$SpE5GU5xW zU7HfbJ-w#cTY(0<*V7mPx|vwyg_x1M-PZimH<60gd*vPdaCG|i=05J0dFHqyfFtoH3RGnas4BLNd7?2Hoq`o=) z7ICxyK|sF06U6sSV({8m08n*2X77E1qjmY$%lB{I9KioxoxD5n#6RAio}Gw4&ftHc z2QE&I-~VuOQ9Fkab-zctpA6_kUoIkxG@Yt@SYO~KI7-#fi3ULl=?4wINv@sA7W1uN ze4Ot1r#(0LW*oN)%+H=1eq*(mKKw z2Lz%P^f0Rm?G|`p+OT(D@oF#aHe_9Nk1x7M-2j8Uy9ihRRYwc2Xl4fz$`5t~VY7!& z2&PfK0O|VTQLwDTrT1-G#}z0GI>hAl%uKuSaIN~MQgACMT)ANzOBPFRazy(73&Fs! zLD!*`RKR*vP@FP^^33`<_^bfVK&t ztKMxGZupLpx-d@f8C#J`vlkB>RIA}3F9LaUFJ}jhspz>VfLID~02Up)cXfOY^B*la zEU&RIn_j|ENOSh*Ie=Ph?_O3+OZZqLHAER-;cO zx-5Z)!u;oZ5)(*Rj01IpkF-V|AGqiGgfRh{HI{x{uWZ*=>#P-=py$ShmEX=(4NXba z?Kd)Dzfg&JM6^m5W}RFH-`fi*Q~h8x!JH)i3yc{~Q3TlR|7XUwr`s&`2Hme64^k3oVL zVzuX~7v6;lm#ry5J7H#otZmO}8IZksA7Q^>ha!IE&GVc6?NXJDbc}zK2~$d&*&$$C zuUV74^}2LuSEDesJ^|tg3S0p%+)%O*3*sKoOxdgf`j>!qQ50_tr*^5Ey*==va{W6v z>x%cE@+{)m9%(2%-EV1wq~kN!fx9``M`NHKWN?d2E24^fct;DqL1=&YaTbQK&D`)y zJ|I5C=@MOnX<3*H0|6nN0)fu7)d7A_yWz%PeSFh;rcsF<*qESsHuQ(FQ>C>%e5^Af z*zIDgyW*1RF!LXO%hTk~PpZ&lo({V(r{!AM)}FT8IL=RBt830&e}jGB$a$m1=Hp z{eT4)=ivg63Td+6Dx9waciE#a5)-jfR_WZ^`{v~8z&n3`c}4Tc+iMqUe{i}>p@^_P z^FcREVSgL&hF}leA4eaqzV$y`o?L*W znK1gI1yw}|#kp-yhIBd$4-9HuE&e?*oksmKLL!4lzoM5+Xm)1_l}bS}E_xE~b{Xyi zjA2y-Q;stuO~Dx+!kvToK6uEz=OCP}b*dYO(|IhlyevHfJVeW8WgJLX2159&V}N9) z8RwwJ3W&8zf`;M*0j0&`8}M^OhOY(y#*xU6(qyLnXssstgRqa%I{D4aB{(_#`G41p zCU!yQ1yp7GIo{IQE(yJQ_N?-|fARTeFHOID#c))n^}7yNI+4X7Iyz|%TVL8Y9kE?T zdQe^V9{+LeJ?Au`N-pUr#?xI?JnX`{g?qkvIx8{Ea07P~HGkd#cp2`g(q47-E$?I{ zxWPA*)H2NA%m^_U&Cn$jLHejmjRf&Unys%6`%EGxa|`?zS|`kl;9&%Izimo+OZtPg803=P6Wx+CIR%5Ny}m;)^P z76RlqEf(-vfPxFX*JqcaSJT^aQz5nZz^q*i1sT-3Egzo~>Np>3)b$8A8Dljh?g-RD zFB94KY&=)JZ~#8>!xyko2i}Jy`Y64=9PrUDo(XE+Z9#|^%oC36f7l4}2rn1JTU?;2 zEYiDRR+ejFUzEvg1%5;ANAOy~PgU`*YFTeCGR05akE)9> z1Rl{n;3=0FJ@D=!4t^F!=-j-AtpTFixn@*M#3tU!N4ShY&;2@hP?);RKc^uPGXc+d zL9BEWc8byc{EU*=Tl*VM?rbeZ3XvFtRQNo7;DIOmpfai2*NODnb_jsP?2i1c5di7y1^1+L&+=qB*iOJzVJlzUmN) z;MH|bV66Rti zh)Nq0?knKP$KR>yBkemj`8Qi9I^0hi)9fjrJ>iLUrkS><+G1y|fFGe1i{^E1=#Hx8 zl0-u3y>Nw2#Dq;9723y|!cZZDM5bMBw6+PL{qTB?O%Og=_bubLLW4-58?uhKYvKdz zr7F$RTu`0#d4KxJyv&QJBC>6g&~!M-2M0>+=UYabq>~dqR zb}>e4WW?oqhepT?f(H$#m@I;;KnRocTH+P_T$^<%L}on5X7owvgQsuH-cdD&@wC~# zQA(!#bX4ak+Opy?Z(tsx+21GL0%jN*3*KJB)qXp=l%l_&!&A|L7&4+PU&&>jf-S(b z@w@%rM)}BpWM`_v?j0Scp4(|S&;YQ_%dImH^}?-qAEhZkLFzz zcKUi#JlM$K;&9ZaGx60e!KU|1IW-NANX1VVzNF%+CaUvARW?xTmzr4t2QScHJ;!{Z zBk`rj6a!K_VIl^NgKkX_nE~o33T)I8as^}DOmR$YgRf4^a`)CMTIZ+X2N_@ujGBW` z0AjtS96C%A!pQ`D9tl7b<$y=DhZ5t(HG}!)HPi&{Vx~@6VrZoXCfU=R^Xv$r4By^w z?}?S==%d0VBTM2?t7IwJAwt=xfh#x*mq7-0D&8pFugIFMf1;!Qd3)hxIRTZLkq;H~Q&!?nPBf?!M8^_m@ z$_4Henb30oU7bo%K4BVG@rPU7y0;%;^lPcCgk*|s!yqa)s!Q6u&bDHIPmb*HW6?$g z;j?YME!5H~gP}}X1w*K^QBY^C=FLMZ6L@tL58XhMRwxB!_i)1rO!?ckPPuoSZLnO43+sJ&`f^YEAo^L4D*-n@WLbjIidAgCYhk!#k2Xwr7co$U~N;_-l?1yZ1O`g1% z3zF7{2xGdj=KyVg9RrTtq}_c%;g1vg-u`Sg%pOmUj_j=uxfcBAkubPIXA$_bT}ffM zt8Jy=&qhgs!JFe}0)9SvA~cyh%>!aSdKxsjyUqdQ0kDS04+4BW zeheDCU7L^WJ6mtoo+abe4VxrOA=4x*AF=vXYbmQLgu0SoR0uU(Tj%wbv?5aQ4gzE91lNk*mdrP&r*fhSFHqw3fy()MVyww=!_1nSWt#Rc{ES7 zNSdHP1#i%z!Eg(M3BOyde@C=gaH%-cPQdbkf4 z6iK*D5gv=?GsSD?Ht?e24{Nz<*(qI(b*YDX$+%>ky;I>%02Gy$3Pgzp!m`)WmZC*1 zS!fYNaH9qxxIq;X-2%RCotPFriezxl&-Lrf1h){X@Hj}wy$2DJCMnx|BWz?F0g%O- z%9&Ox1M$AR9Mc#EmIb{`#@{5jEsfG-#z{qUH-_@7kxV7HmlIF^$dP3#_9NRq#dpVd zDYLTfQJtMrhvGI@)uz(S0BuLAXVLi*9dBZVn5mgKkC&P*j|;&jdZxp(RmX<#BWE1# zz|NAioUJT^r2AxGVPeQC#MBd^k7djibx&SqcVhnLGHYDua!5xrZzcdgW?ILI>&xkq z?DSzEEH@c?0_mD?%S-r_7}=Yo9;_U?9&Y6KiuZl`c#IHo5>a|q0cEseN^*p_6zGy^ zScOS%%4r7rnUPBbEhB>dm*ay!ZSjp89Z~h#! zfAoMM3gZppAX}4WT|)7%g$sKGhI9}D3n<9npemn&{WS)EF`w9@W_|$t{DncfNf0&! zN2BhWV;NQ4M4(;HCgNc0u!ICL>?v3PaS&ChZarNsm{e~&_A^5tV^PK6ZixW}#@>@+ zq@Pc3PT);HDB!ZJn20ZI0|%Pih(>PD&Au0PW_ShJ*)$BGc4!9FtWn|f*w=%@Be~d* zOvR*{SnZPAcL~$PuJ5G^Z@ALU!|=AdkKw6vA0x>gL6NAdn2;0JEhgk7I*SP;`@{sI zj$-2FLbse0Tkk3;5p|ig#K&>g5}Te5A*%L0(y}GV`qS>4lK9ejJ9Oj%`|4yJ zYpqn<$GarVqoAHCL~U)!d*+Z&s^ZQWjJZt1HKjtr6MRy9bm;P}WRvAbSw<@nvtT_| zLS+e?Vxjs}_`3WW6^k;3$d?oR-FH-}7EQO+iFJFO5u>oI6) zmT+coE6y;%Hzxds`+zsZsLysyiXQHxXZvv5d$_u`RTi=Bo|~RlCZQR#4ZqmeoajD# z$Z~ZEP1ss?gMM{b77b>&#|+W8Ul*Vj;H@ogkdQ{X!9ZanwP0hyY&YZNO$<;1#W-9)`ENMOAh`d#e2K2ee_TJ2z)z~b6g~`~$4tEM;df~lL7E;z zSHRU5^c93JLIY&Ys9Hg&IihXwM1Zs{j$#S4T9i-WrKj6OIy9}HO%|mYfYZj|9Rwms zb3u=-`BF;7pLRU9@Q`PSdZjg)-)_9~bTVzkx|9L)njwaHJ z$@BdRv{MbFtg{uZg>4V94=^BM4Dgbby-V4(EEwUc5gLt$nUsQR0`y^)sP||Zz$uL4 zqOj#CU|RA~|=`Rc+m4l-jFiTbDfbIk|NQc1`g|=t)Cz_bxTlJ%n62mUk;E zxohR>_Hg51=zlRk32g^m84*J+ik+!*1y}SPx|zz+SA_{=9RityQa`!~lTO(5Saq>h zMx;cj4L~c^3?&M#@=HW;T~WoZ{k83)sxA!7N#AhBW;w1o-km z>FaDPVksR!pKL{?MUM~=aM{$XB{PusMukuX9!w!A+ z>9q5^F~ey?zJzcmQ_N)2i6W({1B@3oQUuigOa-ndm9PM$Cw%tjuTY zSg7UB(ZsJWl_|{nzSKFfZ${f@&AoW}$BD3cCof)o`Pm=;WaddAgKUGg_w1K3efx-az{69Bf&+rt0(_KzS7iPD!&0=;p7GoYbUj*fslQZb=(9jU3z-< z=KYNZnmy3PG)xS&jo2nG__%dgdb|kP!_$7F9xe_|9*b?LVO%KqJFAWEEuDwFv@AAa z{X;QZz|aA93}oIEs--q2eeM$+nw=FBEs=4Q0AI#Y8{!P*#5|lz-WTFP*&+y%bCJXB z{aRFTK)Jry`-t-S_1p9J=Lg=`7uEl~J^yg|Z7Z7FP>E1xXjdRq&Mfj~Xj6E2f}M)? zfImblDsE8AJHpxd*H%YUy(LJDqN+C0VLUu}-`(oN`PfWgzADoNU_&94#7In<4e`YeTbxk2aPX)U?(q zxJe<{Li1|dSoaYIo2Qb%U0`(|)cT?pRNS%9W(5&ofBMM!HpnZMyxfyR8;~iQ8)L&34Ls9mtVk6qH4B7 zcW~uEKLZZ}UU946jBv&*Sb{&A_98sc*!fz>jp4+zKM76~!y!H~4#2O38zj1zRFU&} zSfg20%V?|E?$g_oDEIk5WqUdEPR1Fbx=2k8uYT_w${xLVq;!yFFS>z#A5lly(zY)F ze<4+&C26TTZSO0zQN;&xgxYyk?YCO@q0^l0KNGP#0o4I zufMLG%CperY>2LMy>K{UYJ&7F^4!!|7RZ=gtb565(gJfZ}$371(|w}1LZ=2G40st#1_R5)oXGin-s zZo8?zmQ~UF*@4x<_<82?)61N<$wSb3pD-)Y@y=>eN8G@`4!*CD?;W+66sCmqaHV1_Ckl}i2BoWNLoV!eTI zoJqT=t%ald1Z`c!9sT6Aj-^C9T*w__S+8X&(x}CJ$=DVkkuC_i;w(%!&IG{MC+(}! zPNTPVgQ?SNz3-;hTR56s&atXO5Tjb$Sf0OQO=&R|ET@3$&;x1dDyH%p;>$rU@RFS2 z)@&4c4{PoMu7E6w3wKpKo9uW?5OW9T64jZKe(ArZQ@pp-ymhC~-g{a&sybg_Vvq}9 z#p^H*9^hJuDq9hxTN}|iy*O|TNEZX9zh(>D+W)G&@$h9#8moCIG32~G4jsFGvJSv! zefQ!rFY`er+5bHHg;7xc*kuDbC8MPF`jytDTd{pA7*ALJb=@e+_b*vUF>?J7`Y>rXtGXpk4ehF5`>jb`CQdo&nZWrV;iBViz~f)|#0spV^cWq%m=`LvAUxnHkkV*mA; zgU#%}?CIS!*E=@NCuY4@+YSw~*~*_rMLx1oWn4r;e|-c5=U@|!9GBV5Zt(7HN#or63Wc^e3t4kS0krwH?+jT65)NpDB+n}id&dvqgJ)hlV1376S0F6 z>X(~*#4Gs(-*JXi2qEM}v$yzj^jTg`E97epWm@#gRDErXtN2bl zoj74`cQW4q%vP2-^5(DdQP(5vu3eyR*Dq_<(JV`AH#XHhHhkj4Cw}RqbE|1a=n8~F z2FJ8_r{7#0U7d)Y$Totj!IA96(8r=ebDzH+!58P0I5|V~G4jO~`JmW(d%*@zUyyi< zC9c8aBQ!Mrz!Bvw2RxrvcJ4E69~e0<0E~fy-AKEtsDOO{n3MvF(8*>*U-6FF7kf2g zNe0st%Okf*#wlAeda)xa%t9`QMSEt9BZQM;{Zyie$^Fn9=#SNqgI4vi;MP0J0jOMa_tJt*KQk+g7CE1KcQ za8_c^?GcC-ncL>g!yjCVfI?yw?%5C;g(>((aCaUm^RvOnNyi0@l~W5K2g9z>yjDJF z$3nv_GjeO4D!Yn%x5@_ja`N&po4ssyq5Q&k>&wL4wXGS_`(5mQYB>s7M95(_ltbbt zC0%WwJSFI8xl_%s7PP|#7shwOcx*w0cggPjkVHQNV#J(bGQaGgq6qJ{+vC);FE9&VYD3x%}uSI?eRnYmv*|Ksy#dO^#O zUsY+>S^DvzEq7NFs-DHW-cb^-ccM6WmwLw6U|Me_+L#32VZLoCzxD1INdB$A+?JPJ zO9a*=k~zVnG10pk(E=UUnIt}{w8*bn?NF;%Li2Z*Jw+7%*}95AGJcLnX_$EiP&-tq zDKD0+3oE??Ns@nFKfwQZn;_3YKMpL%&7!!6vOx#U%wZlWTRb)5vF zH_!yANxm#~`6LfP%Xmq8zqchELEN)6Ib>qw#u(;J7Gx`H*+e_uU(@ZrEnf}>aAjQc5BwbWZ#Dcv zH_C*Vn{q!HUk$cVL02ggp^tV}YW1s^FJHE)0(D}nc~0R6<)k(A1V~j=6kl4xj=-1R zJG;89H}JA%d}xM7@oB2H0WOtMGKeCFJ3EN%VonIo zJ~voQywin85v<~U@BetBiF^MS{)C(pT?zcOPvNO?niImFuuY)$=!2KeFoe`_8Y`l9 zU@?KM#BF(jmQ23afGH^xvD^TTD+j=u?BPhWik7Po@d7vG&*wft@#^mz1_W>!@X~4b zUe>s4sGxVbH1Vbent6z5vF%H>LQ9T0>DzvxN(J~#U!k~1$?G)25kvj_`snTZvy%hw z`0a_sn4!)(s^{Xfv9ph4CTH(({p3EvEl8sQ+?^uI2{9s|%Pq96 z8I`QA7Hl|Kq@*jO$$AmjhTu2YXLSL#+jM!n>lF96B5O3?AM2~^WrnfCI>V@eMcO(m z$1*=Vy1JC$*%IceyY)?B4r-Z_4a`j|w?6ET06?2Gwka7YuFF7HF@$u(je6^r>0VEn zlf=|QMO*us$|g`7qggB3K1b{{H%NKwAiE`?qja%|qa^$fqrx!#YMY?YWI%mN5YS@v zh-2pbKN?$3Y=czRP^|WDY1AO|QKvhZnf=OJ1aTg+pNM*yPkT?y6C3b4;4xA_Uvk!8-nfmHSLnvk9VbftXMY`RHV}DjzGLB3kn-yauM(oocR;tt z0}}jU(6ykty!Qmh@ANnr=p8<&aV+s}oeU4jY$^2Ceekd|w9?Q2^wk$_zJ~eK^d)G_ zM3NY~Vt}Xjji1sK3~Ek)d&y^Fj3IPE3h%wt~YEHqbM= z(*kl-+c%}77E+rLWDLLaZf26lL~HQ``sD_8&zt#_zQ4V#&kKm7Sug&2_3q#+7KSL{eGdeD%+py{7?c%S5Jzfh znO0-5xXegkous$Ne5ioWek~lLy+Tz-9@sEMlu{G}UE((Q#(=Wty*8v~hD+N!VV0%Y zq?6oFeYXlNtu4~^G%wO5bZxLz!<;^-)v<t9$2 zo}XxH7?v{!uWocu8vQGEH3>L}~iS{*_-F$PuSx1|QRj@zs>aVH$@ z_3ooeo6UpKWA*b!t1T}L>!HSG;axs3$Ia}THh#^Nmo{cCj_-j1+a2$YhStP`?3Epi zlRrEbbADWarI%fX%zONI?!mdvK4Tm^h``xu=o{`iO^ucw?%tC+^nP0d@-UeX zZvJ;e7Lt*!?y%W3CV|sDb(#p;4&raheC6-XFmatWV(=jimZ!~cF>%43^A}|@>w!P2 zxe9%Y30t2N`D$=t^#L%|bpJHA%f@_Nt~Y>96$jZeggQ=~oY|gw!bJz0Ikz`JZSX2MI?pX zMzr^M;g?%=<7rangS^km^_w)Ch4bODc@MP>E&Aq777lCVv+$$Ebhw0au2$`^kV`am znBxiFaNCTm)zWx(3`VC_3+PpgcHp$K>J#X_4uVGA3Y+9ziwnc{2qdnHv4i`<`kgE4 zUU^sOol+5r9V+kU_2Vb?{Yia)Qs1A{_wP-8bJ-z#m8@INJJ!n^jNGmuX03xcWDtc6 z`$lXf%mUEJSqDaRhZLw|o-B6A_`F%Dp)xSb$+(<|3dSU9;ag`(NWprK$s+4@yum?7 zhDLPAt?J_PuxOe%5SP?2u>=%iQ@zsDU<2vPMyzPpk^0vX%NlQ|UjmGgWegUI|Ah0c z_3$^n<<0RYg5v^m>|<2S7}wVZlKsRY1iR-9@1nx;w9IBnLmrHOA3#m|AiM4VOw1|2`n3JsR)5c?1f-%FM96Cm>1QVE zS9X>o{Hcipyes!zTX@y%ZhNn=;j=6TJ(5#D30+*mrkKrc%?JB3n6IM*_%^ZU9r`pd zO`E1Dkzv=iykVLs%~!G(qrBNBIA1w*V=^#yo1n~H9G({K$RCDtZt7soEk4dcBFoh8 zIcOWCif}Ef$aVxE*8HnMmiQJHLZve8H7!SKgG8f(w2e4yuAdE+D4!hYwkzZ8GHi|1 zC=z5mFV{jx;){eSseUn|x>3+JFbRoFF815FoQI-cH$EA^(+3~KdgXm_0P4e6{)#XD zf!%C00o$thEOHo98!^_J6lo^Sm`sR)Ftig0TApO#GW@tfv53f|VmCpDhL2fQK=J>3 zwkIC^eTKvJccA?Dd3g8tu$cWFLgW7)N7KLONwC@9`+xraZ2!qW5YnX49L7GkXuub1 z%fNUn2Tt`(r1^i~#nCN+?SZd_eJ>^C_8gFL1cg})D51780#L)mMhrIHxpKvYY>nD>f5=4;=ZN=bb5@wUaILtS69KjYVQR)R=Xp(qWa5^EJ zPs}V8wu9KzE6lIT_#|M%ETkgT5mebtR3_DPutHxnYJRhPPwEx#C!1N}j9ZNj!$5q! zQIIAk4O}B_PVm7e&D$a9WV;^ad8KoNgz-&85%`Es%U4azYpvUqGnDA z%xWzi1T(34vUknlM$U&^t$pbp@|`AZ!zvZMPKvv#^Ppva;Fl7yLCmO~VBC>Fhd@tj zJxp4K!Xp-80Lx$*hd7g|&@q<8!0)V80#H4M4`_Atg4zva5J+s_# zukMJj^nB*&xOlyCz}ut5sNCunBGkAQ(d^dVe=^kE+c3jySlb5kT-kM#Tf{Ip?y%WV zwK2UvRArT9{e|470}?0=wA1DfiBsde%h4C77n>I2d%GR*igS(0Zm0HrAa-lO=$%LT zt<@eCrSQ$pCwHqL2G1Qfo$6On9p$;V690+eAFCjn--CIGHSRKDuv*RcDEoQ09pWsW zF3IC}Q=Tr05#0oz{aRhsEutySZWmOP+@-OQR2&#-PV=697iC4sVB_~I$jO9XSAwMw zUmViNT-Dl=!X=ug4sjFj=q`xjstAEtDj$;QqgB5b;YdTEZ^iybEv+}oe(=!TOXs0< znoqp1$xYM)EpZt_uFIM4psom#>11W=js)*0p!wKfZX;u7Uivb6={qQZt7c$q#&s`v*MFIKb(Ur)c}*kD${y z^g)YlOR#ku^*7=_Y?|Q$PjmDch?fChv+@>H8WRfW#IexP;#3nrxuR%YuGzyNNZ-78 z{``M=e<1QVl2$97Acnam^i6OZ(k&|cDUu?E(o(3kXg_G@1*|5`IkUTcKs%p^iPStv zigodjmN@NEM!j{)NwpNM1OzW!HYl?0E<*U7&!po8N}d$nm!b#D935Tk4pFOUQ%>Yb z?1lzH%<30kseX8zGu-d!Z1p=l@BFrBkKfhd;D3O*{y)T2{?{^5hgyq{^V}m@QISHV z9S+jz`yXMp{!eqI!Jhbg(#4M>&-M!Wk^0F+D?i#$jaJQ%Bhl{l^RFuBmP-23M)~)v zsdwFE8%2E}PXl?|9VD8;_PTs@1AeVbiC^<3;J0wQKeFTd*Y!339vr#97Z2(GRG;Bb z^#}nMPYukYDBX#(21se%8u+JBe_a)@#)YlGC?R33#31_=u$Sh+i)|_l0O_YVTv1SY zTQQns9XtT+9R?+5>0LDEDzdL^M!ooFs0-^=pWu~{t#UY%?g zmrdA(cI@!oE%{NR0oDwuaRMh4`Y*{{7UjnFnPVOrf5|@Fh({*@;Acb@r?-=4ONmPd5X~pS8Jz{uk}Z(#=lt zPOE*4)1Eh=MKZ9h12e0tFFj3u2-r@F1IYWCsSF}s(0Z+L!2xUVT0cZs!OQu0>_Lf zA+C3+Ir(*l>m&(#OWB-t1)9lYXN#My%$}&7k-=w z_QDWO#PESwjl#e#)rz5QXa<9h!zk)TPu`dpz*WGtEfYiWMNs@Dm-lfr{SLsKo~=|D z1z?Fxql7vEigm+GJ@9xf9Ei`>;&gB;{({2-4Xdf4X^GfQrj#lNnD>R+62Z0`Jkn+% z7puu+E+6}4vdF@4Oto|Ine6(gYFgbG*LnDE-ACJ-);9YV_2hH3Fv1d&qxis=j#f~8 zFELnKdcx=SfztIv3hVuX5-xTZf;=IL+IFF@0zTpeOJTMw19ip&(+pP#{GeX9fvm6Q zXf+`r*11eZXP*9gD#trZQCG0WpEM@6!#X+(bJ=^+tb**+$AxIkM zy(Q_gHT|uVG_B!1lK7;xVV_Rd49oM&E5Em$7TDXi|>ow zF>dKwu^lM)P`9JMDodWNCodjH9@YL4B0W+Uz1T*k-He+{RG3wqm98aZ&Ze!7*d6TC z4UuXb=s1(h_ArMkn6tTdXr_J0!?`ut5mp)5nw0||w?1yVG6(g%z?PUcpL*;oeg#B#H8+-?y!M`eTp{zc7U-pvPPpKoK_ zb`07m!?uO%5q4XZ>k6gik~xmw@NDIeH957xKE)cbw5Z9qI*(xVFs64J7WW~?8S>l_ zT#K3~id*howfqV-YeR4evbK1CNylW26`qU58^yvZ+@KO5WEB<8s7;icov#J%k@o2? zdPK~BF(R{)(1WPtuGWOQOS;2_lAU_vsIeKD+nu}ZxpRm>``B0ADdu50p@b}@*&_zY6MucCr91*9} zw&8hf%-7u?7>S2nVlC=JeB4^eU4l%>dXo3Srk0dmKRwxlY#AzVZs;g|o5Z~Zg~e$)b{)@$ZS;EG+?IZR74bodwjwz-xTEuUk! zz(PB-4x|p4pLN_ihsEmoZtB|8Z6Rz}!!s)_3r8ENdDS`#g{GVj^NNzutTs^Zwx~5q zZvj7cCY&k4Mk_Rt$I@PSRM~^$If#LnNlgyT3Ls+`3pAg_b$KB9`AUthi!mc|Uwi+HaFJ3v@* zX;xGx#g4EMz2iFDqN_0tO~+A>DPWx)=(8H4BQ#3vwv4VO6%bl9Q89dzdV1bb&^Ovl z{$N>>_v*NdNHMdg^5JzCm2&PzB}V~b@xl(L zMRj@r7cKU-13FyOVtjw;{l%E)f?-R=bJ?GEDo!l=!+aCYqD3^*&vKh8=yYNekJAi= zt-)?RM%=hcaRruiz$ADt>}ok>Wh0Ee2}9$N!fp~_`*Fs~%^VfjX`vZ4d9)Top2_3# z{{o7tO**l8lyBnTp|WU-bR!qAjQ=%aNq>tRuU{W(?YUh_@9y&;TIcqza}~(X*xSji zv)Yl1Bcxm(oLoy_xs9)&wfH-j9=p&?)Qd9gz6Hx}738|tPeGOIp5SA#*u)GxUSSc8 zy`tp?K~WBBl`zB_6{{r!F1TbNHh0eM2DV?MB>O70pAXy$IK4jFJqK^|Ub=VWFBpp0 zy9~wu7hkgLy4fUK;J=}6lmH&Q$qFN)z^KUshY*}h^usn0IFEs52r`Y)EC>TKZxgA^ zZTbSg??1FwzPFJp@eQ~fHy09Kp7beyd1hRj;ID!?<9_j(k)pk|0!Y@&b zDqd~c;$^kR5<=Y?fKaJE7G`Wb|D2aovVxxG6y(Rj!d=Zk%G)#qPj(JXxf27h!tW~(JoP9_1Tq>Cq5(MIy z*Y$m>4(Ez21Roy1xx^)OaW%oeg-Hb$(pbKObGF0`UIbBAea5Q_D`RFLy%>lGj>KWh zNSdeehFtcYx+}g90X1tP`06aP5bjjbt~Hneh_(h~)M|YT1*#Hs>z#w0!a*6{yv#6( z(p!r8n0N%cjj{H4WK8CQsg(DJmj^l-NZ|{!rCfJw(ARt{Q+Gz7gv2n4(JGK=FrP=z zNe95`uxgjCCYFE+CM5ph<*;U`>VWXTk6Wkb+pf{^>x$^!z4R1Be@}DeNQl?T$PnF> z1WC%-RCRBGcs@z&Y(SH4laOJ%bsKFODedUmLAC9`X+;`T13F41U_fUtfcML}6Kdp# zps!r}qM!KaE@3q}&><40#kor~^1~2Zu3gekyr)Zyav6ms{P{VmIaD3oUF&F;$^Js^ zyGrkc4p^3Pkb%|0>;I{qM+6#D)wU2Pm9!KaF4%)1mO=?yz~&d?6htbv%w5pGm4@$> zmv#oQ0@QvO=n7w)q@}V4{Yp}Jd%}{N3zL&A-kN;-EyDj?3VCd0KT7bTAI|o4Y{y-R z9TwoUs+26DJ?cAHE$L0#thHv5O-__0(Ye~{0M;LfQd)(#E_2K@e+d`ePywj{#}3V- zFRU8(7*hz{0bO$^D;%eeg@ovOOu=VZpp7KV@wCk4cuydTVweg0ruFqVWX(*tWVVk_oMOVlVTm^z=Hsd&WH4*R+pSpBz97^Z*3j67F913tw(8x3(ubi#^b_mK*9hB%zl=)$OS| zZ?Nvf(M-Is&mrXlM&PB?m2z3L>MuOFHZLeimf8d_3YvKEfg;3gV79RGi$r z7tcM-p6GS5$!^D7Cg`ui~On%@szKLaN} z5s&Nu%|B_{0WNL^bvrI+X*2NSpsic$cikN_xHfq=!gP;tS64mK@a$25!G6~`xp_aX zx;jS>V;D77V}Z+eB#_H^ZG-EpMyz3ct05F-M;Hj}1YT|GO~|ckQ=HH^+N_MoE*#5& zh*S1QyF^*YOEn7l{FmD8YS~HCht5ldJsF>1k*X$fGONuS?43*WbZ6iSso4F{%$rR0+IZdOaHpl)5M1ae$6mkhs8!W^yx zJP+{yFcR<1Gz^h-74fWXYY9~5NqyrJCz|Cl%xW(`D#LE)7`=DuSTJs@JYwhS5iFx%HjwxpogJI|QL+WswA9QVH@@Q2?KB5F9B07>b=2Z{j zPl3n(s)5JbhmyL*7=M}o))U~j9P5sF@)2RftsB=*jr{LHW-4#o7CMqY*(G%3C6TIu z-fCIx0P)I*G|id@gFww1gsUQ#a+q67Z3KI$=IWea;N|o);Fld)VE%v=eR$K6cpiu0 z#<~IWZC54*LYZ3fDC{v@D;B>%l_Se;qIVq`%)vv@LEbwpp5_47@Zgn69NhwF0p+0; zga-jmh#>Q(B?gb;wv8!e045$4C0obhZ79)8E{lm-;xBORlKbE`gzM2m#GdSw{XKw$ zU|A}7fUB9oalRv838P3fYLhbg5mG&(M9yB3>^7Y5N}dDAb!7;LFat*}*n9-QkT+~^ z;Or`{l2A*gTam?z2($4V088-fF7#=52LNk8l)uJ62ELs#xlPi0b5`-McIgmsipU9> zS>*%3b$UQ0Bmzqe{bPCS#$i&TZ>17tYLl@#Q<0Wp;X#=0wZ%!aMwcJ;@7YWTUy2HX zN@f%PfQuk3qOW4A3k#GV!eCI1cC&jxQdcvtDf9Z3Rf_68!5&)4n;cnGp<>aN-lg3Sya}1mophe!e{$?xt5?-FzR{)mPG?YtO z!F=^}B;6N9J1vkStEAXab*W(^>GC!6*fKkOd)p*paTlqTROzwn74Xi$d)lDeSJ}wn zXtI;i*AUJ~)beVBC*|o@JA-Nuun8**6mVBfY7gB?9xQ@&L`WAVQKVy4=-@3D2|Yar zu)~b8VdWWPU%Yz$`s=S=9esWB z`qfuoeD>w5S1;;2^b9TZ|7@1DN9V1@3ivR@;JT};Kahl$$i*T(^{`lqL%NH*W zU%dF^;b&h?lKTli6Uur$Y3U8{6uIoj;bIZa_}X@JNJrLriuS}_c=h)6zTBg^B|x8o z2mwqEOLWG;G>mHnXb3G7KL58DXzgAL{gFYv9P5kX||kPKYe;hRIgN!KP%akHM`G0| zJ=fo{VG+-LXt8Wf3VSlM^r71w;?{NUM>94QG*2g+#qYC)cEB5TB zkPm;%1vj=UYV<~{z2iY89K%s5d5tfVBS{FexJ^{BmP?Eka_t{+ zp4RW^(fS=9Zrm=%T>RoOZ`1%F20|dE84y+XXnYzTu2GB=BuQwK&#m4^o{f*HGUSHI z%ea;8v4nyg#O;Q3(28?i z4~Y**{jI#@!`-nGHtSs{D|omYR*NXXK6=s0OFi8!vzNWhUhak&xCi}UcH7EJKHS~3 zhq`-RbAJ4W^HaSfsr{BjHAzQrN$~k^xFtcc(_ei{a_us;Gqipn2n@3DlT%Cw)VMkyn98EfVxie(rqx_(>=dnVgu1)g@AUEgWH=FW2X{Yej3Qmn z0y~GlP-Kf}S*Z*V3N-+EkKv!MzIy)E^Cut_`v5|IgTk5EY{7KACkOhLnuR}?A&|pw zQ>YX~aj__!<`jAMw=_;~qu|+pP-$iKx8;8Zf6D)!LB<^99G?Yi!RpV8AkN97f?)U* zG|qmLq1y{&?2#l*ji>%j$~dmY@k)7HwpB4`^>^CFN$#g40FIREu^s63W1+y~C<(k{ zOo^-&Z-PnqV>rFw`=tvp`-g12saWt55+cf}sx1X1#kd-av}QrU>n;nhvI^z=;A&a2 ziUzX2hk9wC?!viN3Qx|l3Vo<>h*;4Tmf#z$HJwG-q+o|49%~e*t(8ZK+vIlY3=gsa z2RK$n%{hy^V%y6R5J?>P4Rvq*&IxZT+NLTD;< z&OPo#y}jGp)3oguyRs>Eu-q@Cg5;Z{G^;QDZ-hz?Vt(sfz4P1ZfwQK5mtp+#aoI;l z3b+cdTLHXCsCF$&zZRm2Y5Ve>G4#O!+DF@TkPgHj69Rs!kUi)&mM2N`(omR?t$R?v zs~qjonok^mnONlM>9W{Q^UAc|MbwTY)-(;J>G)J8Ae_U2ad?KyF!pJgKdAHwMYSST z8(#6QwTiT)X{#Kiyjox#F*xvw;5JN#_^{dNFfVVzaN`ANBynJLJ7sv!$M+oUuE1>#kHS6{bHvrIaXzK^POsH;J zy0FD-cZ}g(J63Dif+>WPy6|L$R`oCp=%`+{@7?n-xNWYA(ZjnDK|*3H`uN~IqsV<>VFbynDxo~=iQR&l>Dj1S)#KWz zUTS!(MW=yVkvcBVamqoY7WQ7{_FxL^_uvlR$$5=qQe-q9PE=+mwlw189i5+w9}4iL{Q<1FEhD-W$lTsQgX)1lj=Zd;5CGf6_N zrA6z+gS(|auJWgn7Mvd*rQc!hLt9=R<~OuwL)jFCk-P?Ozj*Fh-M-+RP&Ge=ZCZc< z+ox*&TT#JP0GBsej2=#A{15qm;L&})jJ8x~#SEe%U%dR|JkX2AY-ghq>UmaLVP(_FUYuZDTgL_WIwPDC)oN%i9lu)1uYxSN zjk3tM-_K9fox(DK+S>SKD{+3qHQk!&Lc|pYzNe51(yHWYe0of7+n`4!FKNP8)i{3Qk+Nn~V&ARz;s6kzNG7H1IO2M@XT zOPHlzA>O|^JY*zZDu;dJrN{*#Yn`;fy==o_Cy~kwxsTE+wDzpvF_`7@~ zjGA!EV-TFSa&Zt+-koRp{1(qa;_x2MN@ReMBekQEWR9UId5&AgEA8*bp^2mMbg!b- zLF(=j8SUaIrODiVn9^SAK2EVv@<0V=+q_7#orI()VuNjcE#E|3jPXD~0M^gJq42s9 zG@iQz=Fve$L3YbTM7=%T5yi7$6U?IGVd9E){3Z*-t(h(a5eJ?h$j;f0Cm2hvJQ3(Rnyxc^cF+(cCZ|P&frS;76J&jTLjp*aCH$S-n-Q=hB8NV3(;rm z)h`YQ`aW_r$8G814DTa{v)7gyw)I`TMz3YOzw4Bxju^>nlpYw#%W?UiG5!ZoF?N22 zO~5SGd@xE?hO*kOt2;W|ti^#Ia)5WR!s-<5)|%{D0a18r53AJd5t3c$7K=A zgWo%9%a$s^r1oB=Qe4t**(9Il{~Y?}NM!^)iqa9I{tejljjDJCOp9d{JgeOR;0Bo%4s*`&+Wc z>%aR@UJU(#{L&wWZg^!!{x+bGH%!Y&Ok}UMHaQg*uW?4yKKeu6aqQ9U`i-~_p@kfBxe1baxl4! z5IS=S#2&<0L*;9|d-cMFLAEUMg{J7oudc6uJUx5;{>RJfYjXE|_EP+HH$$@~{1|$N zx1Qc4?{H(LeL7DID(}~dg4#1Jj)kI#l2Wt?=D>MS=Gvb$F)rv*1pd5)?pA-Ns2tUd zp&AA)Q^r1}5^%i~A*G}g$|<69ALo95t5R|Gfjcy1(MuihPDt3kJ`u48Sl27G* z|M}_b#(aG7{7*XSob7$eRSor(v(mYtSjBPo`RN>^Hk5wVjxRZ2KK_!X5MUf;JB!VH z`Qj@xjHzNWDwOHJ()2t0T*bi8XycGk2w-8B*W_!H@RuT(i2}i zv0886LomX;8+`+V73P+=(v87zkO+ zb#ry8?{MM|FRW^1T7<)Q>h0HBAY?G99;K0#^kFgP{7rhsQpAbZ)LqGTe&VO6dv z$;j6zxy~qaAQ3x>C)Us)!n<3HVkJdd7T_hp(})Uo!Cpv0in*Fr^_`T86X%z_S?*e+ z<&O-TtlBLR+a<8M+-w@vpa|>GX)m(j2Rl*+FYCNbt^QOy>?7^xka%XXxhqlGa8ltCADYs2QX<{thp>4x!G)oO}}02o^~T7PaB7@gIm zKG4Mxx|^FU3kY+k5`o_7YjRQl@-dq075Q-DZ&J7}5GygDFne4RIHWo{wA?3YCBW-Y z0W>E?DoZ<%+qVeULX`&qy)E9wI?D^LyH%SOAdTD7(AuPe6`@}u^7V#5S)tTex1 zi*L3qW&Xd_zyDG9+G>o!oB5AXuG{}68vocq^mL0nou1T|cl)sYq?9e0!>V`OEGDg2 z2itr?R}vJkVqTBXZN)$UNnOmo7I)9SG#5%Kdzgm7E}~|6=**#HKex_HABXqa?^UIF zJfphG1vY1z^uX$bIrn%j?OK933Z{63MO3`IC`*$y;y)!?iDg}}fNdcx3voDtVoRH% z%)+@Hrm=octyA1v=v92ay}CL-@ZLRKe*gBsy9nnIRhGW^@NVCusy>1{l<`Rfd#Y&z zznCW=c{dH)W|X0x0EEs?AVTdfzXE6CYsGMG%G`S7p47_EbYeQv+29cB$?S|{kS*H} zvq#fBjZ3IPrCo2cx|dw55;Xlxv{E%)jRW@!?4wi^jU(ZjEc^K|5nmDMMR#m#k;Luk zWrHt0ah?zn!pjwdBSa^K9nFc6Ox>mhpKS)Gg~4Q-X;Ej{&u7H6Fj~|;Eetl@)8e!? zm3c^Hfh}F3p&f-tH+)D##b|)UXVEfBgsI3f>V@p!%AeHW!mMvry(WGaJkdiyRmnWE zkje}XIPg6{%FH2KU)aR52I|dU4h8x9Kv=wU_zS``KFHVxC93#i&LKf~YUDKCRRAqR z>yv^##G^Gk$w0arYK$LkZcy|jO&IZq9UR>CJ$0zEFo=CBuV)rTTu8b7dilL>SKgHz z81UGDBt<$)V>%7UgTB6)pxADb7FBcuc6x#pc_J)qTCUan>1l-G*;?CCf7nt_i%kaF z&uiAgG5yrh(!uQ=x9zCN!+0^VxX?xzcEHG8RFIHZpP2uZAVKW21yzZ z5{kxw(>I*hME8LnBUv~^DTyD<3pOB(L~Y^S@%|lzK*Fc5tGXVQmkd030e1?VB5Nff zYpkP=?1Z;RXC9{G!{o>+7{0Hbznr}IS^OI=d%;g5Et9}oi$xb576BA9pcnLYCWDYf z_XJrMJXDDKkkKn9Xs~>mdnRA3qa>(BSzfe>e-{TGw`qOFNX3_ay_lTr3-`jNa_DN5 z8Ut!aOtz**%WR?@DMFRTBy6!GhlP(Z_P$E{R`&+g3Z>-PexO9P$JP zTLW*2u15_wvPlM`&IakMx?81bIW*mU)D<;V_Xd_R#>|dZceNeaQtQEnv5J-}#uDU! z>E@Y*yi{UO#CyPWy#ZSa*EP9j<{@12bI#`cBI= zm0wQUP{^?7IhfO@U{3UKy#EfKoXDb`mt?T0e;<>@LI3{A{*1&{>N7!X`b_B3RXT6& zn#z39gB1A#w5#{NIk`IU&fj0ce?MH2Es>|9yY|WE5r@Cp$H3CtyF7V&axC8daQ^z} z>g2$CE&dJvTYcS(^cOrkO#`UqGDCz2t|(rCAnTJS3m0(xRis@_`*87=4C!(sZE4&n z^BBV6_nz$=g=(XP`b(p1rs^kW+)Csh-^s0hr*hujS1b#R`L_#N_-$Ynh??BaO}6Ao5#9Nh|Q zSj=*d2iMQTAe*iJ14R2Xfb;Q?vY&%5W{mG?zKfloEDfXt7aj~hz;qhXf%W27gC%C@ zUO@~a7$*gUE7XPz6fH#4Ko`S`1t$zN%zXc9l|_r<@Z$W~{Hl7hvY41_W5C3lwH>1n zr<{&VpFGFvY)JB4xy+=hr>i2G_+?(=5UB$gMQ5)Si8LeYbd!bZK$ivg6kA7>qJ$;^ zOm40*z6#^bqKxSzk)@@WDfuc*fr1%pl=7}C_em6B!UFW~khrQ^cE~GjwK;B-vU&P~ z#ikDIjxfwHAZk}KR-l|p0Y}*J?sqTNp0^ilHZc}<62Hd516*ne!=F{-R2U6n?J2s7 ztWZ60h7gNgv@noJP~9^~yOFzy3jn&`d53I@2! zruqE&=e2bz-?Pi90kso;+{9u9$_-1=vPci- zVJr+kB21w=WrDa4M#4h%t}7eOBaa3-jE)wuRh>K=CfT7`N4uAu=JjL8F@&d-YjCfN zGf70nFxj}0@sKcXNoXG4<%i%E?9I3nuPEe9IO8(8D$7uGnHU*iXb4K?yx>R3#JwDw zvW>Y#ID!X!B`m#`7=VR-{_tL?sd*?gi#TS{%Z;1`qIl?le_4}A_8Nr)wa!)5u@1Qq zyaNM*BB;6MA(EdQ!Y1jcEVQ{fPeVF=3#AVgU&VPPN$arbd+fpx zM(4a5T6yhPImpp&*_1MrN<3XRWx?PYTWMaC0szw(+#ao~KUy5p?<0wZ>rL^{q=`Sf zl!qlPg$^p^Y|pFNuP^XBOyF+G%d?&$>UxE3#ZVc8;1is}aYLLE?xM8J;|ICWrDYyr zFt*s)Fz%BtFip!rePi1PN7bC9YYT|c>6nx9xh?JY_*W3atxF{Tl$rA$Y?ahDaDlMG z&L`e69kj)QzY8+xidGMmqGO3-Q}sQ#GXuPj=2hOvv*PEr&E)cHUbL1MT~ZI5^HaWH zOZnaDyAwRK!M@UN>VTQ}3{6TyDZ)2S)=rICmA<0A27G}T) zo$W!3(&TUhA*(qyXYU2Z5$V6Y-0#{vU4o)z!!}~3W>N8Q;5~;K{U_5b#eM;+#VYFxnjsMn&3w5J_D-Lu_{uT`H-AThJ1>QoZJo6svkh zYR=AHk+z3@k4X6;lq4_25;McgeJatQ9Qn9+~?o{OZtDMNRil zG>D3aT{QJTU_9#gru?fnq+bEf<5lqEOl$>0>t?}jYE3gS@9y(wpIN#Ndagl})Ylx0 z(#@hop46WYdz4N!r*d_1SxH@;(&m+m$vSXDS{7MIS3io}G@Jpbi*iZ^-uZ{iZ{;#- zSbS}5>f5Rs@(+pJY_N24S-2c!nxJ`M+L0PK?C^+#WsYm%fq`QvUISx0>Y*0mMQe4% zu^)8dn-^lutznUQ5I&>QigLU(uDU@gHWd}3KJ@+~FO8OEkOg8ZMtfbR%c$23|0Fdh z&?(bV?k|)2^)h^K-L?eso>|MIenS@X2)vKW63!Cr03~E1InV0J(DpqES2fE}^P@`- zTHR$jP3J1kkUD=a;6EUeDOyMD>3;dem+!uYgD!o)KdEOb!f*ZA51OSioY@6)_W1j^ zeA`F|YHj!_u~;e;yPLhA`Y%AbWziR&opxz{A=m1GoO$I8V!|n2&dZ^@gIvyNDsu;^ z!k9{fL29;(I#`T0}`-Nz$k?t{&DAmc;w zO(1b0>jj7DiEYn1GS4$>z7ir$D`C>_XeY}e6nG-@E zmurNBs>74f?neH^ES;A#RATM(MbL1_6>bP~{+*Hn0_Z-Hs~qU%H8va3M4#WZ_CIfe zB|>#bpo@U-eJKoy@^w~e8P7r0VqCdc7~g+5x%lg|lfRrCf4DlK2tfo_l;qf+FS01S z3$+28%d*BQK9KGjqMZ7(-W*M`L91Zhkq%e$bKhI)IX+>i$)MfosWpZ@qdb{nb!@fZ zuBslvEc|@75*_CA#h$7mL5rQdZVD?`H{V>Gd~L^mSdM@l)Rg?zu5jD+~LR74gZ6_+&-w(25XC%kQux?AE4S zlPZRS1(f!|r)BzSnSNTP+b`36<6Bt#a=#rq7@%}cM+0S)$`S=Bm#c=9fV|w)0n}>X zPSSlfOV=TK5QCbFD@eTe=V0VrwmO>>?X7Q(TLLr`!W3qcP|Z|*jw4)rAG&yjStqU#eyVXQ5>@XM>5Z-^oR zFDo3E#2MlA^6KOQU53skEnOvU<*2*Tf`9P-9-|it=@K@ULbL$yY+Iadn;Qc}Pe+@{la|_g;|aq0t?RxtvyT_#fu6JPQ_E+d;}3V+ zCttxQU%@9|!FXSR{%)0;=3pMkj0=g)f`(F+Cv;`p@|c%e;&Z(?i>?HNdUhYu67z{N ztI=#uWcoq4p}B@okuuy305yr8%^jsC1dG~nr&`&+wkaZtx@^21gLS@inVQ5xhvpif z@4B-|RV=eUFw4bN{W26J0?JcrK9kdq9%4N#mlPwb5AUQN#um(djo1zjMFi7q91ajz zUV_Jh+G{jmVrDHynRQW*?i;!gBe+GT0=d%3hq!jRKdyfT2A3;XjPkjychONXa?(hQ7#Vw zgbF-c;n}W#jHhuryIrK29XKm*s5RRIP3(DK-g0ZiI1%s}%6qR2qBBGJy+v{w81z@ zL=d0jA{aJxcz+r)awK?4zoVp)tKITi72(<&CtH6_L4c`WRmALkHQU^MzKd|#*WVtW z-+f+-j&;bZy{e%PAAmV0Bu!P}8z_3HN(NjfbXGqgKbopZg6DU{b5Z!~s=D2EqEeUi zfY@ABDGGD~!F9rp0VB}564PN-Y6UW=j*TZymKzYAc1mVE6~=v{&fvjJY!Z3Iu&LKc z7K-C|5O<Ql(5_bx~NKi88S%LBm`=+-|9L^!0RSV zjE&686uWC7RA;d1g;uo}5gaBDx}Yt~lYQJ`4QcMT>trvQh|^X;Z6Z4KXupw50@ZG< zMIx?GbMM{Ju@Y;K02GS*biZx>tb^IujZLl+J}qje&xt3q*e2cw^8Q~Z(AxKJ-ke;( znt^{D9e>xAG{=MCTF_OU|2A~c+=D@v#yhN3{O1P1M;bX{>RCM`)2RY!Jr8%4Zt`mG zs)IRBjFs5MmMg;{xUs*0k(TZ%$maK;-D*gkRQg61dD=SxjV1ndaGhWY-K!wJJ@CR} zX3jTBt=}phIOwa~5h-J>`O^?9Lt!>qI9X00M0S>n!4|@$iv=W!^MHXTVg@+B2XL%7 z5L55=KvrEi;2XS_apVMGBcaK6JB&lx=td&c%7x7fwp!bAW^r}k1?*f^xmN`;i*z&) zs1_tAcp#HUd;qQ7M${;2lwa}oK=jwAm&fmaIJwwIV*wmD*GXMl$=9he90*-Rvl3uF zG(|TJJ*m;#F@;dm`~13v?rLg#*p~02IYdh9il2P4D`B+6d~vEQoepiT^4zRcXw{c; z7-<2k9bU;vmq_d(lO~$bym>hl3(bU_k)J#CNw+X-S(K0>y=$vW?u=3*kIOgno*vA= zEzwdU5iDb0E*0wugxTP2t%netu$Ip{PVY}g9xc`jXQbUUrD7z8iSXidBy@O`Z0 zBO16$Q@ZJ#hYLUhS9*uZ(nVl319IMu??UmlHnR<`LUp5oCqI;FepST4bwYvSffB3^ zT8I<4LczegLkXAP*5``S-8Bi?AZR+~v8`gL&mVEn05q$F0CvTEX;@L$33|Q&&oD-p zlB~m;dv{SlTN)8Tlo~30Zzcxg3(h;ZE*vlVMk4}*^~If~lHxicG59O-mU70K#%xW@ zB=`9Xi$!@<+W}x;RdOIp3D?$w_EZcf;SsdYcuYSDl5!DX3K03})O<+wiV|uei&GKR zHs}1IbWz~jq>AVs2E#!V`hh?}PD)4-@;Pk5GGqYF1k{wG7xLRagFdZrV#MoU*Aq6lq3)5G55z2OWkkLg z1_zu9sqyty!jEd_ucu-RSnMcK$6JI|JWj=|1_UwDaUT*$iOp~p6HHsZ& zzew9PUq|mmRfPW8)wy(p*lLfY*laDBnHbQ@$h8pmD6~$@d>lF0U#x(QCI7 zu>@Amb3mQE_4*80iLVL=0vF1jItT6_$PJ!f5Mt(_qiX7udP zP#-__c`D7eF>mTJQ+YfHLac6T*^m-VNsU7Tjsg5|cJy5Z#*k?7F=+L$%UQJMsBg1T z)Lx$)zdb!Wsm#FiI#Hf2ybM{@{1SYynoCWGcY&QJlos&SPNdN8IZmSn*s*s|d;kk^ zNbet>CcuY%os?oriEHx>ypWNqUJXw!PR>q#JU#n{$|5w*Am}q!cJO=)%n==8wy+v+;=Dg5)PEGov+52qeDCdrDB1^^27yNn40Rp|y6GC_4^JtFe+8PA23{&l#2ly0fk_Nl(W2}Qz>txW70iqlr^kWUjnS!_5q@1n7 z8CS5P(n>oJ6r)`6G8BrzcwfADX#x|2b%K!~G8w&9wnCi3U|*g4ZMT?1claR&`BBKr z=8yt(ctP)lS8reMdz%>QXe1%UT8X6)#*?Oh0p9($7pN1ig?dXT(;%BH(>O?$lQdgS zpzI%9&D4IPXfc&mB1^og09`?oqseKX6ZXtnoCN3S%-pCDGa>+Q0PydtXU`A^ah8{h zMf4F_nJ(FN@Qct(vvgA4nm`?-vce*s`_OV9YAp}D)>T0Vu`0w4qcFNFZFnPe|3qxT zP>=nF)U|mlMGqZvERJODA?8M*c*4v=b&x%1ck)VW=L{IB@cfBw6V?^qk3yFtw0nP4 zY-FF{l<0VfMrTSMEC9uvf#>zw(6FICoF@tHyy(^Yc}u3e3KT z=_01eOsoWO5rhlaxg$Nw6)rikAmhaQFMxvP8$*aDtjs8ECx64Uk4Sb;r%6%7_LB+d zvwyb=dgJO29^Ic)c`e-N!5K_n)GBmUw>5H%Y894vFuEm1yR%Eg6Butssxk-kdHrI( zm`FscA#7*8cni3gU{YP498XMo^VHUoJNZ~Z@v$nhii7J>!5CtHef0W=lZ#7}S@^N= zGmI_hLB~zAr@8mx^|`kR9^y2ZQ<03lC?V5zztMzpzUjEW`>B5EF>tg_>IE%ChgFAa zF#2|Js)n*jmd9!uW;FBKW$E zM1a#v(qg4h`C5g0hS+Ju0yhM>{HcLVsQ?(9_YW!uB!}$Pfb&SPHeJ3e1mPYC(5gh0 zg#RqFc+$Y;)2geCLgwSqtBzs=;VJk&mn+LXuU_k&iB^His1kcMs(M4JRG5a9PK{>k zo#@ol<9A(kf0|XP+(0Ff^boRSOO4IX54J7Pe zU@BH?XC1E5Oy0%%dB?Qo?S_ft3X+ml_0%KSW7e{u9U0w(nZcD3ub)ssyz3`;xTb#` zVu|hp@euCa_!0amAD|bIlWO=eCZth}c2f+kDnbQuLC<{GtVJk~$n|bLxKu>$k~Kfb zz4vEt|JoibIDwDcf_%9-k}HLjs@TJ7yW{t2l?!XWRMBhVlpr&km+&WN)YhvKdg*3{ z8AVvA6OI#5PslW~W zeGIOZFr$CK8G+x9gXwXR#Z2Ym!?BpMv3&0mN_F#}_p(@tsnI@? z?f@45^LxU(>X?XVRfb}1r4K>{$t!~#3u1+0m*aR^nr?01t|Lmbu5GidMDPk{FAqcS zMs}iU*4=1oQ&HaUn#Zm~ColetbaPYTsMWaF)^o+ro2$1IWt@%y)7d<)Y_mK#jn=7Eg7bpK!`67a-;)P42G&$qv>uu0GirA@9Yzx z{<{-Sb)b`UcheHw?F??FpL1F6_QU|$7yP+>!i`wTkdDw*l9(H*p zKW|UiI6Q8h&30p6T}7$vpE8-ZYz4I{2I#ygw7p+dJH(0>uw#OMoU3cApzL*oxG$Zi zq}c7{iQBzg$Yq1%Qv0&MeQ6K+-t=ur7FHg?|JS`CJ>hdTI2djoR!`TjvxH%z|J7v^gHpm zx;999xB@ClMgT^#7!RoD)}yBwyJS8Ub7$|*&-dX#m_y>I_}2^k7Xr0m{ciZ}<^F+m zJHT8ZQjw+%(6vC`p^m0YVYfO{W2|1y5OLT78o&*`{jPY+(?T0>2fgpc9k1xIDCC0- zT~HAV_06ZzM>S#OzODx8-#>dUh(B<(su~AIi)7%g>n91!2ORe>&Sh!_#4bKp{Y5x%hQh&&F%4P5#c1n?|uj#-wfBrTqlPlev`XXN&vPX?6$ zyyTbeTaaOsW9Eo_rfNm?ZvIv*FGI}9flDx0Xi3U}tOOxz%zlo3YIsj%{FA&C>^C@> zhi$ZkAz{&T(2jBjV1wdYh15qf2j33_SolABy2W%G+B<<* zKfzWE9fE%U|Lt9QZyQIJ|0;wL%-C3yF(uiK=RaAJ1MbQaBg*y;#tGSCH_4tfyP0lM z#{m1?x86}lS6@{Uon!|K1cA)1dUd^e^{U?SGh6|cm|+X|SL~BI?vYf@6RL6L^iXxx zrcyFZ8Y}rAYuZ&+47>&qAT}wr+NDaRq-{!CkPQ2jnDi{X*^7A!NS(fK@S1_WU8n`% zhtzo@WT5hVC+7o}g-lH>U2b3oqJ&t*OE5Q(e>zutzA&B8XXwZ=!{wbx@2}Yl0u2Nv zmee`VFr)~KlElvp&1aG%rPDCVg!vrS$bomITPHhW6grotk}{@DHqv5SK+BlNtT|6D zq#DnXguPwy-Lu#91?3vKj6&!@T6#Nz6C5@;l~nu4A_3{Y*#A~swx17PsAVh>wL%3{ z%#dtjk!84KRtq;l{?bUHUhTaMF|Z;cMClV%_@c>;R2%?>m7p)o=6p$j(9N|_8Tyn0 zA5+^&?-&ZzkYx>R3epaXf-o#N}*p{8~=2;lqhI z8b)=~7)T=9y~59rc(T#$s3{Sh$65%Fd$k!N|5%)2M#K0bg=fsGN=t4IQ5=?MQj?wEKytD;d z@h6(VjpnkFFL#NNFw=f-%$_TXwk+NI4mnKQCZcPEXYgH- z2Ag7)*~$VrygAPaVsaLyxK^EIp`{j|riy<5fMq8LH-Zn)Ed1(c4Sn|2w8iBh^neAZ zm8e&?|5C{hi9t$=?yz#`R{Pa34ezVdP!7T+c7Qb{Koz;g&GjYisE2V)UR({$QDWj0m zqj3B;h8p!y{FdxRiF%m)bl%^ClbqB}fS$TkgN!8Wxi}n~6%v)~-vW*0(<*^nQy3+_ zu3kT6U3chM?&;`aa&~piyUDSm8b3LW?%)i76dBNQ(YT#$0Y5>i(3U<-&d$$Hy895* z?Uf_v^(3)OY(7}0ykOt13%E`#9l%v-PTq3YLr&)Aafb!Q?lOWE{;I&hosSeN(Y~qZ zBAeFfxYI`@+6ReOt4=q!BK;N1;sG~xyKqoNlxTo9v|vaVdkONt_%P|+9({k8E749#q}-%S;Ch;}lwOd2!Oa8lUtY6{G?c zl{cOdfuv96Qb+F_#HLB6bCeDBEs(8665M8aCH!?tzc*5W1&Sab2~lX`u(XUopubDw z`*Mz1F!k+XN0b4x4O|qDMwX9hgdT_C^-4BZc(m6LGn?PUV!08s)y(3CZHnD6UxAM- zL<}yY6xcVa5*N$4cE6C8l1Is*aYI$w{Gl=AQ%(?tn&E4NH0U9*wwMl4O+}x{*b5FX ztXOf4SdN+=FsFNW0qa%zV3_0@J5q}J*v#9{Bq>4Ui6n%PK94rbJt?ZZ#&=Lku)Cej>>)-}09l(`TA;t@76l!S6PYq!w&(5x{F0bI@hvVzxbNFL?d@(wC z_Or8QxcK9h)5W(@PD|L9%T5(c7m*CF7fSQJkS_6FG_flnv@e#YxhT6vU<3Nb23gc< z!f=9Z?TZF`c(yEInf$&VtBHEslXW?O4Hl(!b#)QBy4ZwX*dpFbY}#bBw{TxU3UsQ4 zpwtbJ#in<|U9uHstQ~PiA*QdgGN=#z$^N2$Oe2mCHg{`m*u$v za`dw=F;tK%u!TSmzWAm@28xjXvqH=VK~xf|V1@!A8#lC#&@rYEFFApiZxZ<3nHr-J z((WlNWHj;3mCy;OtQMRU>Z2{dHCh57p5c@ds@Lm1cG=dAWM)fQ3h=pZ zLQ0U$wGHoeHwjjqiUUX}-M*V@oX5BH7XJ-*`-U1BJZ9I+4mRw3leC`%FbUU70h6|` zG%%@GB!WrUM>3d1tBAq|Q6DKWfpZAao+`&}5&bssIdc`MnnM?f`JKF_Q|NOX7$R(+ z+<6-Z{%27Jd4e_o2L$h{rE@zQ@TaN#7y}Smqnq3#<>1VlbroEm;hE_82C^p4GFN zqUpzIiefFRDWbm2rpVgtrYQO_oT6s4oTBE#bV$u&J0#@6cqa^i*2H@ZkoG9{leE7j z2g?3Eh6%BM+Xgl?3Hx!P9Cjl!nxuXC(IjrOq)FF@D@~d)3!&iLd*@uxakzd2vJcH31AKZ3QxlM#_p9tFv|LP-7UOy^r} zV(ijmb};s=e*Y?(kC?N%&86u1>?}pi-T{i5m)d?h?isH->f#x02A+>SKq}wy*KvsVq_?*lZWdrxFfp`rvUgxArfpL?C5BruF&^@5rE-^|q;*LC4vVeSMpNxzw zR@+q`FSh%5XTL^D{bt7nZyO5vAiyn~Ov4%}rpaBal zC?mIvo+)G3B>Mq)L1cR|8`tNPM;RW=8)y-Txz%z=3Y(T)_F3mzynp@bot)2dV$#FM z+g`>1Q3a1^Xc$^TQ{YztzAg}vn3oOgaZ&8Vv9#ez-=>jbhnYg#TQS)NCZ;0~CjpT( zICuU38vQBOh%DEQ4tW0SQj@DxY-4S@G>!x#$uATc4i2AS&m2hYA-@F~>r@5+G#m;c+`EX9g$hsOQu8Qh^xR6I00GY%1*WPUp8#GR-z83> z%ah5t!CN|;7n@qF9v@KiHU<+Xc?GUjs4A<75r^07T}o3G?s5uUK@X0iW(7TY@G3|{ zc-Ms_01}_D(m&A&>1#-5c{Wk%>EJZVer&m>V!>#`Qo4 zJ=TF=`d{SCaApX$&bcFORV_iyl2Nr7^d?b+fJVjNzW@I2?rsnVDcEq9-)o$|;(MUh z2QvLQwEi`?Uv1ZkjZ4cW+o{nF-kV;zOjc2nWP0Bh5_D3nIL};%H_SOtiUM@5!AysL zP9-j?J1a`k5CF_o`$_NsT0ApiQN}Yi!8>=Aa3X`u6v<3ghT1e*X4}}WbA*+il|?p5 z)0Y(JPtz%3lp`TVA2^yEC0=+7@(Mh57zYlS8VM8){7PSa=MT0nOM#*SvDP(fn%^V| z-{#K*^$i67pX>xT^iDuhWXn9*tR8yL&rVKWKy;b-fQNR`Qw>^t*wihm=G!TaA{Qh} zz%5#>3kjnA!08g;UJ{C{`W7&VWckX{$PZIZ=!r8VCgp{=sK)7*H9{duMvT2Gq42O? zsZ3>MA>EF+sa94rnoqG}G3A=hFC^qyrV`Kvp~5m|=RpUs1OYY?$?ggMv(@p~n*U6~^FxP}{0DI49hBI(sAJpTqtWv3eECR#68gMkD` zTF>c~)unHz4Siye=paqSrGL)R-hrhTsbo+MW0VJgr7i7688Rlw(1(oNNZ(rTdFrVy zF?#=Wr@Fl92c>hae75U+b&vr7+NcHhsJ*QJ8=rD~KWaPWYEie9gi{|ZPo#W%Cjv<1Wi&TF@e-AhP~sDc{GpW+bX^xd_)iH zqI2;=e!1^hx^2=C1S1MeOSBa9onabay93)E?&37bmcV;HCJ1;A5?V`>CE|mH5B5b| z#37{X3~dqT*|NqE(E!Tw-yhE#vXzrzBfDWhO>B%CV*8T{GDFA(4d1#!PHrS>UtS>H%hxNh7hnU)XJfnx<0rh|SKA!&pOREQwOY z2Zzrx_2Z1|Oz+nT1&Gclji3eCN@^8j<-mJ~IOHJ1JIzjlQw?+3HIJm3E_Mm+HNjc{ zg1*W!?9FDEZ!&QR8ra*cM5$;&t)qTXEG5&ga;m^k3VD+NbZiSg!@)8YO~5%VT3*|C zUhHMbjGc)+cqcBu5eLvVL}thyDuWpJp}N3ed6iaDNFn9Mq-vs(K~O^MSTn(#7>s%k zaH2SQ(i$xD5<;tAVH+YLK}RAZH8LSSsv8yh(Y@g27}M`0TpO}4nLpc@P4+WY{Ol!N z0AsOCZ4=sCCfQApi2X!~8B0kY@ron=UC8`fIdmTK2HZjnY)?%ZpNWX^2iWVyN@k11 ztC2w%iv+n!gN8VPilQ|Z{+V@RV@$TYM3)ShQ zMSB2%w6#yA^$u`A#N0;r;+TQF*R=Cy7%&AjX6X9zknM2y5sW9WHnB8HaB+sHH{MMi zXL!vmor@Ls7%>ksq(E&TZ5VObn_;Qp>?QwoFryr8MJC#LDNd1j0Pmw(+!|ETXC@^& z;0hAtNv!?fFdvoF3~Ejl>`FT>Xv<=>g1wUyOdyniR7mNS7y;&+mhXYa5R@py!$SZWyqoL^UQb4C4v4BKXiVvYLpehmbSRzYJ7mved|iTjxI?!g zi?t~IX*+jXk5gk8beDyTi9<0E>Q20-i=I~=&s!=ujtq)2V|)z$ndP2UAfr`xm0ZXO zx3NOW+_R|bw7^fFgYLCC1BV;L>gz5Fvdn1*VoB(2v2od1XZPDYaN1aa1GvlGrq?Lz zIB6fmMcGwue1MD0q&+`^Ec;^~q(Y52#w;ohrQuS8W3 z%2{*{S-88aKsHuLh~rp%bKK!^txJyELI`BB|B4yjc?SIE-UX+vjdIgI6{{5g*tnD1i* zh8L&4Q_+dT^a%m}*zQox>s6j@w~0?R_sMb^>_v3P>*~M;y09zl35F3l@uDa#rXvbM zw~jcS&==Vn#OjBf;_bT?s0*~ubr!o!LXVM&(oVfq36#4_^1~M#FiuM`4jg2d!N;B_ z!8jLsO|~n1bwgRtv2c7V#=DHboZ?X0m8*SNn#;OPCzp+#x)AQ>4ujeSZfC71IL?xI z{@^hFpBBza%1@Z2x2x1u6ci4`a0dmhO;7L=@g8o3*BtoNUY;UXoK}^~I(LQ4zuo2d zh^O0?(`hKHpu&6Na*LHUTqj*Ri@BF{R7#5`=ZU71v;v-rbweiLmP^T@Q;dS^jI`s7BG7w_C9Tw_=BG#g5#Hy>=`1 z#;w>}w_-nZd%Kk0?YmuAw4v5WT;97jks@vTFypS8M)F$YLB*EjX^i9Vg?{{pa2vo( z1z$mMORH&GR@$e9a}}g1;G}^qQbqzHXcAaA8AT-sOX#XGL-Q;Y^p4^5!FHY`TNX1D zj7xf7nlIP3NsRjPw29@8Llm0n=m4f8(;iRgTym5-2$+=I3XKYS9@w9ANXDs*^Oerk z3exuoTvFi%3dqOFgNhGQf|&+<0HE=MU)~)3 z((Wtp;w6Kg+;6S6rCa2yO7I<&dJ1`JMd; z?hxJytW#hki>m$u*iM}HW`=jb%#;Q8Bp~_e{(K1t1H!h}(bn!=2gR?%PE-o`NDz+a zG>0q`O8&#*Ruq`K$#lTw9Sp99n(bjG1t%{nerk+P@jDvo*%OyPQl}b)tSmfT?w-5| z8`7_)8V!gnay?R{dROA24e-9KhgExmzivAF(T?z2Jy#5w)O&8PCgzW)EDrX3QI!`> zGxl^xku5OhpMqy`*MmdnGRq%Ikq1@T_*~H20nhNB{l?%1c68^g1XU4raB zLAhgD|A|u&ih6VDci7d7agCGQ?E31{#&_6lrS_WEHANsGP$<(bo+4 z0RKUokG-zwCm7RAdKyWMF{4YkR`mHqU~jQ7F6Q8xYj#Zc3goZoQ}MC~h5(QPcrYwc zHqD8T3(^BQ28I2BIYzdc0%Ou2_Fwl8hW*3WN5iATSMLsf=pVd#J$ySH9t>aghllTm zhd&%0zIoRlzIrvZ*Lt9*{|Vdq!nj9arnuHctMtJ)mp=P%sxX~yRv|C6b;Qx3b)9&! z!=@Q&>%_d3E^IyJN=pQ$4un-4`d4N#ZT`h_) z1auO+0WeBK@U%3x)0@FPEk1>9@qgmGJ7A#0-uaSzCyu=w7=IA`}%66%U3ZNP5nHDFsUw5&UuO|tyek95Ta z+ag~1?nmByPqHYRpZtiLFGUtn^OGM@QM+*t^wW(WP0oKeCHNnMF#a%*pj+N_`9UL9 zc7ChFr3VjR(zVY7l?G}{`8B0)=@xbU!H;0&UTx8>eD@~LSM7S*=1tm*spT= z^&>8?dKOjrvnMfBbK9q&qze0yuTfvDMruktqKO9KT>9om);Mo1qBYqF+(_Q9lakE1 zZ9;r8fD-wHmSI$-Gx|JQ2J=!Vo2*DM-ehyOBPKW5o%j<%Yxk1^Ri4!PNu(i|jrybB zf>o4apRXJJG4yN#J^Nlc9R&%h`tnAii-1C2bVt8Y*->aE4}7L$B*%I_Oxd7*9k}N$ z7{{9k(w2++lHK00f%t~2cw|So+NJ1lT+_wmUuB`MOG6PcUp0SRI04*=&-&I1ru}w#LOUMP&dtoZy{AZ zNz88gRejrAAm`NZDTEct$9?8)8fX+sEW)nb0N|>n6#u%q#-g75?dw(}`@9Ehsr{JSjlJ?5~?1K!%cdz4ozKU<7tB8*EQYJUb0bI#%-4?koW`f>d3NwgbhQwoPaEZa# zG->5~DGZh~mJpS~Eti0K8K#OA)}!`Ds)6=q2foWBkvo-54Fj){7@0HWCabVX82050 zUrT?aTFdRYcI`5i<^edY#xelzeN35exPw5+PF13U3I)z!bU8TDX@&;i;!9sTM$xc8 zey$h7HS5&uFHt9lIVn*T(i0b-Kb$VXQ8t6GjeO;|Cgbz*k5|VR*XEe@laymVAOoq+ zpnMxFA$-P3#5PVIk9`VbfBYO8I#!e}CA7I)y5`#Y>Xk=Y+*qDf7R8v4*Ms3;`1b9a z!@=;?tGCadlIxkAxiRrh)Y!+GttwM-lm%seu zm;TQ`|A*O(EQ0qeTNZ;KOY86}Yd!e-HQ=rcHpQ@UtP)$JhytOKOn;~GIZ19{3pXaS zqy>uz$S8qHTDBgwvy9xR(g>~tFsDyob@uu@)8*MC*Vbx z=0g2mV-lRuNI6}bbVNfPIvKry!k+F`P z8`;Iq+OC*^hsxHcfcMKtnPV)AGzNn|5MJ0UnhT1@9^~zjFCO&ustW-OX|s&F+Vr-y zuK+8tO48A0Mu8x+TGt`j9~P?k#cno~GRQU;!0 zOnSdT%w0K`BDORL)54RJ^bI)JzoR2FarwQy)MwN;S1cH?5I fOEo6xlng}c-^D)Wf*ENL|L1=Je=FwWIM+4+nuosY literal 0 HcmV?d00001 diff --git a/detection_rules/etc/ecs_schemas/1.10.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.10.0/ecs_flat.json.gz index 0487c2d84abfd8762b6d0799cf7c5920b2f510ba..346b5408c938e85a08bf8a1a9cafe705318c4f12 100644 GIT binary patch delta 19 acmey_#r(62nM1ytgW+7XM(Re6!lM98!v|~t delta 19 bcmey_#r(62nM1ytgJI9&+bJ743XcK+QdkI7 diff --git a/detection_rules/etc/ecs_schemas/1.10.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.10.0/ecs_nested.json.gz index 302ffb97a3e8c7f3026705e4fa8119b5727d5ebc..91eb0d5f571525468a768dff164a2540fb6734d4 100644 GIT binary patch delta 19 acmZpD%-s5znM1ytgW-I%M(Re6+K&K8tOsuZ delta 19 bcmZpD%-s5znM1ytgJJLD+bJ74YCi%1PC*D) diff --git a/detection_rules/etc/ecs_schemas/1.11.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.11.0/ecs_flat.json.gz index 30e6a9f0a5f742f5eab3a03f96aaad1cd4c8ab37..79464ba88a821d41a205356980a023775a711411 100644 GIT binary patch delta 22 ecmeyrpXL9477qDt4u&()8mWyOTR9lN%L4#wKL}6& delta 22 ecmeyrpXL9477qDt4u+kJZ>KbJY~^75E)M{6feAMN diff --git a/detection_rules/etc/ecs_schemas/1.11.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.11.0/ecs_nested.json.gz index 0a6163994afdacb8959c6f40e3406bef1b530747..461be18979278e08fcf0d5570317d79618666421 100644 GIT binary patch delta 22 ecmX@Tp7r#4Ru1`Y4u&()8mWyOTR9jHhXVj$a0ku+ delta 22 ecmX@Tp7r#4Ru1`Y4u)NeZ>KbJY~^4)91Z|zy$H4d diff --git a/detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.12.0/ecs_flat.json.gz index ad0fefa6ee29f8f3f751b4a0e32b4a8de7910b2f..317f0d6f53dd01fc65156ad8445fb6b57cd1e129 100644 GIT binary patch delta 22 ecmexzo#o4Q77qDt4u%ua8mWyOTR9ltXafLj?g(c9 delta 22 ecmexzo#o4Q77qDt4u)-uZ>KbJY~^5lqYVIcI|)w! diff --git a/detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.12.0/ecs_nested.json.gz index 0cc0eecb293fa53e90eef0fea3750febe659bfb7..74936ae3622f8072bea177a2b65d1ea1c04b54de 100644 GIT binary patch delta 22 dcmaERjP>m?Ru1`Y4u+G_8mWyOTR9k0lL2Uw2kQU; delta 22 ecmaERjP>m?Ru1`Y4u&0zZ>KbJY~^4~O$GpP>Il>T diff --git a/detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.12.1/ecs_flat.json.gz index 2db1db74729090a4401a5c8d4e2f9108e267c563..b228ca7e7a6ae99f40a3b7087bb9d92a7d01037c 100644 GIT binary patch delta 22 dcmbRGmSyT&77qDt4u)gV8mWyOTR9ke%>ZCX2Y&zn delta 22 ecmbRGmSyT&77qDt4u;K(Z>KbJY~^6=H3I->iU?)^ diff --git a/detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.12.1/ecs_nested.json.gz index b36e8545d52f187bf9e04714cc0308eeb2f009f0..e6d7025b0e1576772fd54706a35ea4bb1941ddc5 100644 GIT binary patch delta 22 dcmeCV!`gF)l|#OpgW*`TMrtF+Rt`p%JOEpZ2K)d3 delta 22 dcmeCV!`gF)l|#OpgJH|!+bNA4TR9k6@&IGl2jl<% diff --git a/detection_rules/etc/ecs_schemas/1.12.2/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.12.2/ecs_flat.json.gz index 39862b984e474f4c38c76ac834f11275a285cb55..c8c8822041e342b331ccdf4f8cf8da567510ff71 100644 GIT binary patch delta 22 dcmbRGmSyT&77qDt4u-?g8mWyOTR9ke%>ZC02Ydhk delta 22 ecmbRGmSyT&77qDt4u%bjZ>KbJY~^6=H3I->X$WHg diff --git a/detection_rules/etc/ecs_schemas/1.12.2/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.12.2/ecs_nested.json.gz index 752519ca7e8f5734631a64367c4508223f947271..904bac3de6911e74e90938970fc8ed60f8fffd5c 100644 GIT binary patch delta 22 dcmeCV!`gF)l|#OpgW*WDMrtF+Rt`p%JOEpD2KoR1 delta 22 dcmeCV!`gF)l|#OpgJI+1+bNA4TR9k6@&IGE2jKt! diff --git a/detection_rules/etc/ecs_schemas/1.6.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.6.0/ecs_flat.json.gz index 77dc0c72804fedc2c2f71130d74d5d966b526194..a1e3888a5e586fd79cc4878024a2e6debfb48e26 100644 GIT binary patch delta 19 bcmaEPjp^kzCJy;-4u-4I8mSvO5?2ENR6Ym4 delta 19 bcmaEPjp^kzCJy;-4u&I(Z>MbJNL&p7S=$Jx diff --git a/detection_rules/etc/ecs_schemas/1.6.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.6.0/ecs_nested.json.gz index 80de6568c961daa338a48c5f16f07f3821fde3dc..57a9eee26b311d96d1b3203c6e4e2cf563da0f3b 100644 GIT binary patch delta 19 acmZo!!rZcinM1ytgW+1VM(Re6KNkT(fCp6o delta 19 bcmZo!!rZcinM1ytgW>4n+bJ74{#*nAM;!=0 diff --git a/detection_rules/etc/ecs_schemas/1.7.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.7.0/ecs_flat.json.gz index 2516b5df235da3392bb34b5231fecba77fd4a0ef..9716dd6098c1457bacc6a472350e2366521a17cc 100644 GIT binary patch delta 19 bcmaF(fa&1_CJy;-4u&hy8mSvOA~yg4R9y$Z delta 19 bcmaF(fa&1_CJy;-4u(UEZ>MbJh}-}GS@H;{ diff --git a/detection_rules/etc/ecs_schemas/1.7.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.7.0/ecs_nested.json.gz index 5d894abdcd8e4332e9023577e8da0423e085bb42..a8bd99a8b19ef276daf42fd596214a46d5cc3a2d 100644 GIT binary patch delta 19 bcmbQUo_WrCW)Aso4u&hy8mSvOrd$UAMOgvZ>MbJm~tHeO7;jK diff --git a/detection_rules/etc/ecs_schemas/1.8.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.8.0/ecs_flat.json.gz index 12dbd7760a73fe3d689f6c134bd4f9a0528f2260..2f52a8b5f4b606389d56695eca96db6c49719fb5 100644 GIT binary patch delta 19 bcmaF;n(6gxCJy;-4u(t78mSvO9&ZHzST6{6 delta 19 bcmaF;n(6gxCJy;-4u%7ZZ>MbJc)S$=UBn4q diff --git a/detection_rules/etc/ecs_schemas/1.8.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.8.0/ecs_nested.json.gz index b2662fa9d1db421f8600a42fed5f9f8d4de268b5..424d14a53875d742c878a159b49651d06904f2d1 100644 GIT binary patch delta 19 bcmX@Nm-*aYW)Aso4u(t78mSvOj@<(QPFM%- delta 19 bcmX@Nm-*aYW)Aso4u*q^Z>MbJICc*JQ}qbf diff --git a/detection_rules/etc/ecs_schemas/1.9.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/1.9.0/ecs_flat.json.gz index 66e34040f31f683855d9b9345d02d8d30c8adbe2..de56d71c606f9f8b1704cf0b4b75f513f011b42e 100644 GIT binary patch delta 19 acmZ3~%)F?XnM1ytgW*E7M(Re6SqA|?RR-4p delta 19 bcmZ3~%)F?XnM1ytgJIv|+bJ74W*r0oMd}B? diff --git a/detection_rules/etc/ecs_schemas/1.9.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/1.9.0/ecs_nested.json.gz index a6fef6b8bdec9aa86347af48f553b30f7cfa8351..46b250d125c4b493b64914042375f0380c1a38f9 100644 GIT binary patch delta 19 bcmcb2jrra+W)Aso4u*@-8mSvO!d?RaQsxKT delta 19 bcmcb2jrra+W)Aso4u<`UZ>MbJ2zw0xSbGS> diff --git a/detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.0.0/ecs_flat.json.gz index f70e740c09e7a14e4d51dc7b541579df2544707c..9790a3a8670caec372261b5f0c042ce4c08f770d 100644 GIT binary patch delta 22 dcmZpB%+mIlg+soZgW*85MrtF+Ru0BGLjYU$2QvTw delta 22 dcmZpB%+mIlg+soZgJJFB+bNA4TR9l(3;|>~2pRwY diff --git a/detection_rules/etc/ecs_schemas/8.0.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.0.0/ecs_nested.json.gz index 464894a2e7175abfc5526792413f48e8ed6b02ac..b752df620e2989dfcf0b4d97d84a110e04696255 100644 GIT binary patch delta 22 ecmX^6mG$gbRu1`Y4u*r#8mWyOTR9kyRsjHO8VGm* delta 22 ecmX^6mG$gbRu1`Y4u*A$Z>KbJY~^4)S_J@eTnS$Q diff --git a/detection_rules/etc/ecs_schemas/8.0.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.0.1/ecs_flat.json.gz index 2ac587c9f85d5fd2cd6d92ab9c9becd88a44abf9..509e2927832082532fe87477fd984c2e00be06e9 100644 GIT binary patch delta 22 dcmZpB%+mIlg+soZgJEB^MrtF+Ru0BGLjYUg2QdHu delta 22 dcmZpB%+mIlg+soZgJIR;+bNA4TR9l(3;|>p2p0eV diff --git a/detection_rules/etc/ecs_schemas/8.0.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.0.1/ecs_nested.json.gz index 1365703cfa90d830f72d84bb960d51763ec109b3..029310d696b26339fe09f7500791e4b50ac9067b 100644 GIT binary patch delta 22 ecmX^6mG$gbRu1`Y4u*Zv8mWyOTR9kyRsjHN`3Q9Y delta 22 ecmX^6mG$gbRu1`Y4u;i>Z>KbJY~^4)S_J@eI|*C> diff --git a/detection_rules/etc/ecs_schemas/8.1.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.1.0/ecs_flat.json.gz index 77606d062bb2a9d11b294ca6e8f688c7e12c5dee..c5d867b85ebd5bd46aed8bc8dc524b3949907ba8 100644 GIT binary patch delta 22 ecmX^3ljYz~77qDt4u)OP8mWyOTR9ka+5iA)0tgiV delta 22 ecmX^3ljYz~77qDt4u<86Z>KbJY~^6wX#)UpLVAvh4k=n?ym4mUS9RN=~2HF4s delta 22 dcmZqaXKU$aU|6yEc1k11Ru0CRb^up@2f+XU diff --git a/detection_rules/etc/ecs_schemas/master_8.11.0-dev/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.10.0/ecs_flat.json.gz similarity index 99% rename from detection_rules/etc/ecs_schemas/master_8.11.0-dev/ecs_flat.json.gz rename to detection_rules/etc/ecs_schemas/8.10.0/ecs_flat.json.gz index 2dd7f75dfec6c1458f504f7ecb6215e5faf3420f..2fbb60ab2cd865e2c31136b80f87ee39666519c8 100644 GIT binary patch delta 22 dcmcb8jP3R@HV*l24u;BTjnqbttsIQOivePR2d4l4 delta 22 ecmcb8jP3R@HV*l24u+G9Z>KbJY~^4KUJL+l1PJi} diff --git a/detection_rules/etc/ecs_schemas/8.10.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.10.0/ecs_nested.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..9a25e7cc10daded5a28e7c1ad33fcfe7abe0af12 GIT binary patch literal 127127 zcmV)aK&rnViwFRETPS4$|LnaBd)r2mDEe3MdH1`q=aLllwCr>C-c@8};&1)XSjuEK zQH}@_O$uWW-~gaxPHz7Dtyec1ZxEC`$=P$xtYZ`XsIIE6uCA`fug~0t3e#t=onN1M zDw)OpD)plf{{8IwPC4|^nfog65@!~Lsq2SM3LiW-bscvatyB7E63x>GH&zZb_tVY5 z@#l^k!hh2{H-(Ntpk`?@a6FarU!vHFriqI0RpO|7=#@B8=(x^Zl%(`Ebw9(WrE-&X ztd{u(qnq&Ji@RI}(83RA!P-;Kx5`bEk#n}7rb~C@xIq#*@jAqQGFJ>OF3zubS))Jc zg(Y`x5I9ritfJLAa8uB)5uNkly@7tONBI| zc0+16H0@xh0x2)Pq$>0P25Jd7n@91|#jnm>z~UKi!s|OfVZ1m#Vplq*ks&|OwPGA1 zw99;vMC*8_hzP4Vy7xUbaKgw*R%+(Y{h7nPQp6(65v#wi{aAT~1I2VjpqDC*{n-@g z>LBHCl9!{C(b#$JF1?eZ7Xv5or}UYB{`tf`I8>+e)A`|eemoxUPu;_#BXy*XkGxaw z)ogltFq`g=U(N{n)HxU*jECcc;rQ4&IDEZ7hW|PL_Za@4^TYM|FGLXFg*>W@B!Nc$ zB8*~n3wz-n+wG4Jj^Nh-h>sL|HiM7YOb=5YAVh2g{y*^Z&%eMA$z2quTagWiNjEE+ z;IrC1M6vhmw}FOPt?q!`VmG+;y?Q1xt%lI5f`#;F2gnJV99SggjR7R&o$(wteG~%U zfANzvd7+uf_Z(hguyJO0Zn%J5>(1gRLDDCw8>2j!f*_eNxV|@Wya*bFQCj4QQ}+l- zJFlTmZl&$CQG#EaKE)v#sMCs(7P>T1qml+cg#O>xY8wKGn0)Pg2mC@JlG{H-YhWml zc({K6kQzLDHF)lX-6H3=;j?9REy$EvYS2mlDkJoKoutvy!LK(eldI=-P%JtkS43wyq8?zLENkgSjLcl*B?)=$Zc?uTE2wt?rN#=31ERuU3MKzSx zh})9Zx?4T9Yf;}!X8BS>X8Kwt^ELcjrmsHGu@fi@5AFsuffWBVL~uh7lmoq2nC{b! zr3|bSIJca)A<#adDGd6vHoVtl0vN_LAq54vq?t2vT(NX#cYdf!^poB-MAT^6l8Cxn zJrT=@ZKj@_y?8G7)#Yhk>l7TfYZ5&e7nDiqO@n@IsLHADaLs?@L)gAQFJ=9hG znL@#(TiM!$K7QrAMkdu#B%v*H7f0*GodfcEjUy+UBvs1<6td6C`44yg*&R5al;^Xe z4>}<5b7D74)*z}t`F#hgN`Vm^hTXX$9h#7~fGJjhoCAvtd{==VRU=hVnnQPAUpqflPGjVNFbul^vvA<5EFj_|IM3&?{Kf8Lt=Y`yM zgcCq(4&h%QqThlp9fvA)F5@VTpq2Cd?d1yxCL>LlmjrlUgG$269ctV$w2Syy2OKSd zFG1vk#E3sT(F(K=SQp)lrV1`Gb8HIwH;e}dh3kR92TcGEi+g=F!%@6w$@e&rH!y8N zS0)5}378rZumP0 z#~_-~RZQk9pYcmu<6Z5QPijRJch%A>J+1oRvS8_i=y_=QG_h^?%nyb z3iOmg*-jZ>u7lLSHB9yMukAC8QWzk2dda^vsz9{O?rx(n*xb^m-+r+gR{~s5vugBI ziup=0mK0=ILj7a4PEf-mx~VTK5*xgH5=7F^B@kwTFJcRH%^>?_1dU+csxCld*vAC4 z-Ou{Dp)*@I?0)=9Qx`G=!CzbKqV#g5hI(iGH#I+NW5KTgDi zlc-eNZ4#6%+Tz7`1=KJ_RgFO#(TWS(<4C-M79u^cEgum2@{YqHXk;IgK83U3-&22y zSN!FwN)}}w%L3>P$iO{pfcCV|GN*~<1a^jXNfV2t^nl$RyL9B@T_@{1KyZP$Xo!fF z9DGQM!W3wg1Dya5SG2us#KK9edlSC3kfbeLcP^?+8a6ug9ma z$H%V^k4C4*hd-4B_`l}}Q>zo_o0Wv6HtWH^(|E1yJ=2A_Hsd2{iSGk1d_w;XQ(;hiz zfO?vPcMHsmqyY-bfneKXCSElAtl|k>F(;o-lZnGiC{pd$n`fY~2Pl&Oq8s?>2Cojo zsTXz_z7FeXSjyIAWK*fZ<2doJ;;s7rFQrOoMks5P5~M- z;Bk$_!&?`<1>jWz7{=`I+`KS6OcUrHnu9|-8qfW-xTYYtttF?X(5vdTXg&TWhY(S$!6ea_!C0it> zKCcLVfW15qq6a)>5#1sJuFo%JJhr)Hpq1dkAF#Ov4PC53x$wC8)qi~eVF=VUm|n{i9xd9Oqp<-xPnfs_0Gw749Io2f0vtpwK>=L?XX`^Y zf&&B@3wT1?8w7x`uprh2_2+p`<5lLB)OrnOofm;YeK;u$ZbQw??40L@#?y11tP6S) z^aPOpwhkG|^g=6duH3I`m<*G6a%Y1f!!S*Tv}ZLNgI>U6?CG(Mrbq`cOLtTj5(RQR z^=EYGfVh$e0riD#W&_c&ftvb302tZ2Y(Tj*qr=T3 zNE~go!GmQH#hU>((k5!S#-Z{T;`6fbAgiaSV_3I5Ld+c6;tpE@6Ru)lFBNQx>bt&C zdLCe)QVes8p>9zY$i#@O+zA6nTTznCPKRS`v4(pOKtaqV`Y*01fiXzebOIEPfaJHA z1AJ>{GZrenXy^F?4UwQD$N8@eDaNoL$*X+qK4=&;Gfwmp<=Vv010fnxGwZ*%W-W}R z@nqz$COGwE#9&O&xnTu+ULJCo`gkCdId)V!ND9d9_gZQ7Zg^^8#Op05eQHhh#*WZn z$J2EG-@%+$TJH{4J*^*#?MkJYW#W+yei_uA?0y-+p4$A^1lXfm0UIXz8pgmbr0!@Z z%*Z+2q^e2K^7k^qzQy19ZN}I$28k@}~4-xl4XUKVWy zXdTnD#BD&6G^lt9##5J%4g2L;Advkgb|t>Wq7xHHe|9{hPI&a70deE}9nW$gzh{q0 z3Z@&fhNnBx!#iP;#auSFr(%4ZF~~4COl=XN**#BNvoc#{#UuVm{yBncVco{eaI@tV zChOSnAl!uCHs)WbXf*TF&25VigLXq~SL@Y*&spi}wDfYUmLQNik?J<<=+f87= zlzA&k4)!)=MQFc-f8EX^uN7mu@sJuci~Ed;~LidU~dZDxP(gp_Rcw5f@GMv-O$>XVM_z_Lu>uATCux^ zExEb%lc*aHQ}ZD-ujAr#ZsNSX`k2w!LhgABqZZ)lgVXX5eVMglDIF2oiCGz$by8Gj zuiEYBZs>Y$7ew}E%zXFV5ZG0ok|ti`pJXAERfSj?e*rJUSj7kB?vNpE|!a;n;?w-l%Ui>W9UKH5vP!if&htAErf& zc3{IA_WJ?!z@f1}X5ZKZs8==67D+bZz_&&0hU>tM@f;OHIlgkDZ3>M$`ZiBCs7z}4 zF&krM3NMagkDCV(s9$_fqlgB2%hPtRM8F7~)!in+S3MK_Fw=)P+LJy+srBqf)?A+* zh?aEi103kp6!~Nd+9O=jyjc?$^tf2HdTDmzi*6L^vhP-~PMEC20l+QmWd9|7W$ndH zl4#~024^0%Lu8Sb!_zC)Jfyl3p#z*4@^4hrBUXB)e_an50)-KeH)dFzb^+@N|O(*&% zYSD0@5C3xBv_XpSY>&l?5&B`WYAM~Y*+GyBCTrxWOkH)F|7ESFYSsaTJrDCj@10QB z^(aSs@js%l4QHlVwW)x76#hZJm-Czi85j@Nw`U*DtaerS6-|EcEMCxU%H8{Rt->g| zJ@aERvee++25;L3N2_Z;j9=?Twc*=eHDKAV^6mk-sZH>C3(WJkm-j~~TH(JZFKUhE zezRwaziPHp)J>mTsBb@5j+XAMVUhT?yvp}y=QZ93LH! zul0JdARm+0&IKB|qgko|NA$FVzSXD0sh>J%b$h{qbaG)AU!jM{`FXussTjS^o=~bfq%0;sV5#@jVd^Y@UJbd-buLr+9 zA6ox-@$2#6w|~v;fO-P9?1<29*%i>BdS_hYD=t4#0++(1@`Q&k_@49O?Ap9)JI~c< zF%mayJf4jeReNSr1fJ16t>;{PE2fABpnVXzKruJKm=jcd=OB|F@U4;TnCPsi;`-Ms zS!lbWshhRFQsEN)m18|@Rc}Zfa>ZSnkW5V)(Tpwr7>L$u$xQM|ia`yX(62jpB7kmO zXMpFI^QMOi-J(KC=Px}TD-LRKW6f2s2xo2TF|Z|Qwb*H9%Nmxv6h16SnaTxsVTAHk zpp5})AgEg=s&#NU#jwKG2brvG^V`gwzqo@F&&k?r^mDfXI_LRtrg<9BWIg3i;<+RI z!Z&zp7@6vSjdT)Q_ZpFI|)r={%Ck0)F~_2gI-`JYY{pRsa2Zgm7wNXJXi^PBL@Qp zT?aI;)OV|9q{GGMIq?7FJKth5s~MTQ*2qIRBQQJiQjXsT)=F~`1-S(PGe!^9TQ9#q z^MtZ-ck}Gw;bEkJ!AHxDbQQ*xT?(Ioi5+poml4nf-+0W@x=3d;Qw*$q06!ie@%QsW zU{C-`LMYe+NIQL7y|D-F{V>9V-VZ3O1MYfJDV`o-uG?EV4(qX}a{Zh4Qnt3pMqb-K zF%dBBf*zW(LtV3+SMxclNN|II4#I{4*>eR_>&1X=Z^rOuQJMwkKs#fSD8vnrUlZTN zozjs|n$L>SM>b#{`-7YSB>n4ze}?03#{m6Y$D}0|=*O#7!!)yO6Q=-`P`)h&=>COX zzOaB7ZOps|4X)jTWKG8HIu^FyJK2*sirH5e`*9fXQjvdGG%qS9z(?=ioLy4LGq3E8 z8N%k>I#SpR=tqSH+*ewLaK_sA-uCr(A&3Hqf;M_^qw2RJhd$<<8*7ng#_5wEM)&QB zx*Ay9@PmhQn-Q3BgbkbC)V@iwgPzlL-2*Hbic&IL20*{mxxkDRirJ+WqZxQl;o_H{ zVmIf$9HcwYumz88^rVQ0j$(+~_7O(Z@oPw<+-km#OyZD|ZbGRN58bI$ou{cxp^iD5 zbm}gKN@sT=*TcOPU>I-pUC`Y-#Z^rrrjBUdVL{!{-9^eV!aF!w@sJ&``SqUB8yPo) zw+&fv;kj!=6Sb-3Njj^s3BOLqu|kVzDb1WKhdO5di^7eG=|e|Zkc5)zYC=F^?lugH zpno7l6LWEb|IV3dFk_lE2R@!>H%`i^)JQMAs2-HkUHi)YN5Wed^0o_|ZBoQB(8Uw} zYPdf<9v_f1zK(@Zj)x|JCuy%hQwL{&+lYB+FywgxiW7 z4Qp*fau-okBV?`+3UMK#sO0QYU4?3Qq`K%)TfVSwp+4=dIqj%4bwOAgz2Ycn438j! zaicQD&M?>(r=)F3t+e+Tz2D~|u*(6$pZ%#Dy0?^6i9>{AMP{pTaf>5X1q+v9?`byG zee1%9yOCgP40O(DlVzg`DbA3Bwtu!#(&W4|p5@6(E675Vt)~afhyzr{jJm?!rCc|- zzS$jIsBZJwbsjN63niH;%&eUy@>3UGC@SW*9OJ6SH8jf)Tq3263j!!_4$IFHo5 zn>|?xJ%9V9F-e+^f$=?67iK+R_eCr6HXrtVZn&T-@H<+2RdL?}2p^&*3XYnS?K+&t zuF1$?MV#x5G`XCXx!_e8VdT!p?XLDXg*HQJQ+=Rb8(^dvC408xx_r;X=*v+AHz$8S z2d0JA*VC*<;$0+r>C!8RfIkkaMUvjH8()BJ+BRy4d;LjYyHV>Q?%ynF2kXZ zC4k#ao{*euEhrJx^AorzRr}g2wDkJ3p{MSjHPdg0D@<{SZD`oyl1C7-ZNv{SK&sv? zk4R@V9oD$!omp+z?atQ$*JLo~B=WIhmk!!1lJF9Z01|Io#Pd2C;w#N?e^!U)(jt1| zx@w$ygg@S5>*=GD&Nhlk-KbhlzSZf5-@eg$1U+HaWUTdv`v-?dc(r&ncBeB>&Brxp zw_)pP@5qnP;1}3o4IPl!ESn4(YlM>l!VaJ;fzgDh9ppf1j1I_ZgtH!9x>a39XU3Ma zs>|&BoP_|z3Y1<(cRfl|`**8O)h_8NwW^LZ`WiZy ztiO}$CB*zEXX=rre zBD=IC-0|?qZS5y_x?N&dMa%A(+MkHCa??dqGuyyX3%XEVoF6#%iSy1~PCXZHl;@Z5 ze;4@E*=prngaEdYhJSspf0xojwk&nwXC=+??*iIDRs;YJoVg1(_7r{#Xu2Xt@vqJ7 zl*4z=7=XeMyGv7>TrF(VMd|pxYa36kX6&L!bkiVy@2bPs&>42q3fk3y-=iMzlnTJ^ zM||7a{yR9-pXxM!`t!QmLH&PD=>8}4*EpJYJA6}Eok}~s0&&y-_OC!?jQzo1feH(1 zmIehT`0w!wRE42G;46?`M)y}BP3_<9D^Tr{{+ql4$@)9J0tqqyNv}W^kp6*Rfr_i? zBs8Dw6{r%LKlm$I{(!GQ*)m$pJ{ehlch;Zc8vcNhL?d{xouhQ6`O%>&j!h zx$r=4hZ2E5YXH7UEbQv|b-g+%J_%yo4<*(P%~R`i5#isZ7->QxXT^D%uz=(D(F5>l zY~dxryqfI*FV~p$jxzyZ!hkH^(3G9Eaida4k|7(5R4yEn+ghuj0(-M`?FI(_jLT?> z|K`9`_^mU@Q6d_0-h{W%(%5{uq3n%bJp@69iaV);Hn=sw{T1aNzf{2b|pK2XE zyJYev1-Yenmd>!vyOAq~Pz_i&;ketd#6N~s5;Dx|7ySKG)}PJYcm2X-mFq7utG#|? z7n4LzidX+u6)FC8xgZ~{T|QBto+-XA)gNcQyD&jhAUmmLq5~Hr)CJOt0QJaIx0veQ z#X$3_NOh3GiI&19txYbI4Z$!4fgW$TFpL>5DTSx!rW?WS4;Fdr1`A+<^ln+HaYL7( z=`!Rl!>mh9N@W;?G7so>=BUJ>I8$XDVM70MzRR3OZk7TU4u!hZ+z&{7k@^58`zqIJ zo^tN31QmU15j)d$s#9fVx;!r<1Fxt%CwK0_@kv>CZoyyAEMyhK)IZpM-yOBJSFZdr z)EB^b(t-HWu%Z%d6a@-MhpCC&73EC8XYNi3v7MiR}_ z2ebx(RP&(4BXXMj{TIv*uVt z`@#5Ne>lefUGE>f-XFg{9RJix02{hyWZNz4(fy-dL`V2FwmtY*iE0$zs?)}imKEYC zjbgb|*#}6~p)kASk_&&u6NK$cS+~0O+SCXd1uHIC_JPQnmBo~D2-@D19a*UFgKn0v zMa~slphM>pBQg`@Tk4z^Mw&^RwQG=r+aj@}_DN@T2l8^eu8KP+Gp3ipyl#B2Vy^Sy zF3{Y}=cc)O;;Rb!*i~v4Zg=&e3w6wb8fjx%ZF?u!2?Le1t4(51eiEkAT+}H5#on8$z=oH>;>FredsZ z?VMl!AW0nQ(HItG_M@jwHeB%pY0uG|yfm z&rd#&V&!@xthJdmQvn+fvGI@_*XX|y%Cij9)Yf^vaMugEe?+3{A~1L zIeK~G!k?$7ho`R&W-njvPmk4snyHiNe1Cdy@=Fu1XfslzO+{=2&BULZFp&+=xZtc=*-4Epn#Hx`ViStM=*HZ)uV)Hy|Nv&$$|;lCUHZJm^@%)e9WGmh+C`*J(yMHA$0lE%tq*D~!c zm@`|ViPR6t{f~}*{I@(XlTrQ-6`WCxK(uDig9#%fvuv_0Z>OS z(CAl)k!)|n_Ga2cVx3iew3-?#^m0lb_mQbmUho6AJIM`q4w5%|z?oo^0!rcj{HwJ* zit_wznEMI;4maV#uXJx-fgJp8f{)M`pa7hcSZ?v;W=D@{rcU0S8v|%)A?BB~So}b+ zc(bl^%@=aKf@aVsBj-IxEUZxN`axocMM&-Hd9)5aV;jI))XD3;Ju0`(DHKMtXm1)s zi#-=p-lqI~4m2L7(GXxBnoJ8Y>yT$1GEIg|lb^A-vx<`R7oZ~Cl`ptQqTCqG7#6N= zTL#9~qg5WkpSrWpybC=H0OAKox5x&{;rJiB@OPmnBWdKkSqu4D%;MIeT1GbNIPic< zjx+Ib5cNef9GsDOBxAp%P*c1JSE6ef!kHedJ>^VpZYBd~vWI{C3IF(i@sFEl_~-w` zKmH&5AF zvGzT+r@}pD53^^6*%R;JJ;CU32Fpyu5n@#eikB#4xZg zm`4PZCZyO3?s|Bdtm$8HTCF13HxoytGv<>VlMxV<#^%8%shbYSCzgKqA_{!D!v|Yg zCfe4V2YR-$gx$?EIt~2U%`;PaRd=8kBY=bs2>ErQZF@AfamwYf2%eT zJ^rhPZ7e%vhW6;#cX18)B#T-ThyP3r6g=S_%xJNu%^|OELdW@&^Iiu5X(~>J6aMlc za!`llQ!&KbtR*fBx}Hs{k}^`odaZW%tX;E~{J3mrpXVquQ#VX+ZN;$iz-ik^S;Go* zHJ6d216zsl7n_cp5Bjg>IThU@VGS2rm~54W7(mAmY?wF@xd3hg*tvhOpgQ$lyJZ zE)$9$3?pq!PsA|dr}*d%M=PE*xa_P$!*0o)B-Q(5VsLEl5>isW!cJM4bG~t(N1ho+oL7{2`Dre>V#ya-Hcf}Y!NKn3fypR;%W$F<=Nr?H*gbP zBp|+#({G;feINcka(+|}dy?>CK^*}GfF@~-$S^&UO$bw_)JZF?A#j^BUmN!nJNy`C zYb32+ZnJk)YeA!~=xHWb-L=ZT!sISi_DV`|%#V02$=$c!V6!U&O~s9iLLlALBsD0w zOlF_6s{lJa6%}};?JRM=FsJ&$H?lq0DW4U)x#ll(ncJ5{F`KTa9}FDsXl2)<-?cQs zrE6Gn69YGfi8~X|mx`6}riI%T@W17HMhD{G)*RP-klxf!sjLUZtSRnhkZc3TIQ$Y-M>iZlr@qGA+AZ zxMeTa(K^BC?`wk>I&KqGktrlB@G0Eid3!m)^Eq0&9FXo}R>v>UklEPzuV`JMV}eeb zycOIB4TF|^6TMi8bYyR=5RYpa1(4>gwM#1<+#`R*mFh|Q(Fdl3(yJoMO6;)2C zs4}xc>1RE_^RufDFC?KS2nyrZo;V799`rIJrn0WjTsYkJkM~brH4?|Hyj5*6&AKJd zC={CB8atJy@dD^}CeYd!wgUa^K6P(yAMFgIRY{;EgVeis=g(TOTLy8veb7?GzHPSM zirQBK-;4a!7;W2^wXae(P3zvFzRjM=Oo|a(Rtx7@fzZ~zIX!BktC^BLh{*0;dRZ#E zVs&^$+8*S_9m2x94S&+A#%|5WkZl>Z0g}C%3yqdA377NNa9TCjVK>3QgVw`t>DIuc zVYwmeSh^Fr1rT;wPG)0+Y6IF{h9J#;a;m~uQ@R;yy-tO2f4Ey#MD)(1Xe9p}&7x)F zR?e`rr3YTtvDq%tjOk9>WucvE z<@&XCL-rcB?&j7{qAfU_`V65@9gm-L6X)&K$Bg(EuFt!$aRIVEC@v4tmz68lvkiW` zvohnh*7J+us1gn5Zs>Y$XT0`i+kE%k@VS*N)@gXU;L)@#~7k8X-T9vzR4$H%YsPo3XdQEmfMi&(o+KcqG+%vjr0 zbW1O8l?d+2q&3X>LxS-nV&Jg8u`Num4>Uiv(Ge!_+ah+ub>O0x3Vzr)GfMf2#ym6( zYlB3=9l@8kLUhMeaU!Ynf(Vp7zEKW17}7VcB4~mkFal?Fw@G~b3#U>VI5VvoU;zDx zC`DT=HV8H*Lmb{mmvlh|9O%^)*=7p5Dk{*kR;G9g*UV0A(v3`=cP08Rz>HlF4{ly} zZd}q=){EREiDo__+(cIx=qON|o(EQ|I9kQnPE6bphHfq~g+Fs}udiSHdh1<@=<*d6~ zX$Rb;NjZ>2y!E=l@Gs}B+ouTG_DHQ5p&w$a*0Tk2yGmU_Y>n_0AgUCDzpT|%&AMW= zr(RI#y%Q$4(hAU0URTqlh(go0Cdd)pOsQ^(=+oJmm8@rXC_dhveK@n)RiRsM5PN6w zf-ZIL-nVNNM#=4&AFHI53^t5g(!lQ8j{w(tWu4IPuiB9AS0z6InX4ZpD(pwk-(KDy zp=^f#p1f#&NAOpTDwW@ovZN7^90vT-6D1bGXj?rtsR)WWJ8znn6B>t6DzA8C@ZzKB z(|702%kj|xzZ(x< z{qpO>h}JzN^MZ`i0f=!!eH;+Wc1sikphyPF9*DaA!b06-?NH^THr zQCj&YMW+Tedv8E*r*P2;$+~lQG+#=O#@7XQk7#|K(akCl&0qRH(Ht}(&6>4d(aze` zqoxm#&1mbuolTrsBYNsF(S>!&caS!gX@aG3{ir*_Q5M6}yS-0k9h#r2?)=3a`Z;Fp z^KL8DcYw}IKAeS~20mF&`4jBmobNij7G-1c`wU(?Z;CHR=x3I|&$*w<34^EPy`TO=Um6!q5L1Z{U~SN~OP}%-N{5O8hY9m_7=0zlso+5coX7L}-J8Uy!#BVtqxEN4 zS+T@q$2YVx>HC+5DUH+oy0$ZObUEHl>o%6o8dkHi`R?FGH0GLyH&pF}pHQTsK+h2u z>dQ>6(yUk-HRrkxc@`IBjvVJL)r@grYPV`eI=dwK82+Dp7mqGu>LVN78u1ptFa57pZ-zi0C#vvGIxjDkCW=|{_rbQNZnoeQ7P#Z(;EWCZjxHi^4w zU8MS%DF)WwfFBQ#1NQTRVNd`nmnTp=CR@F+2g!plLUqHZ_;^s={iu|F4q*^EuaC0janWt`r!bD-dii25c}i)63qCXKBa zrkR7A*ab+1GH)?Jx4VHut9a3gx6y~cqaV(iO!ajfZNL0_aEZW_6&w{qVFErHyO&A= z(2J@Ju+_UaXO}3p&v=b*%n&v!H&Vu4O3(TM^`xjYSmBJd&)@Ax=u964Un5+S~6T0wB?_|g(lws?pN5pTEOi7?uJgHJ0lx?j65H@u# zFrBIL!*&E`fIgYeWqzLBye)I!?m*WTjCP_iMQUs#xTr%P@kJfKn*7SG>+47{4tnV( z#wwAqCDE#L5!Mi_DKVjyN?pe(F?`~4&d#5Ey4+-E?DwyY?(Ks09agmk_B+c(#(xJN zHXgSta=)IZK_gpdKzG6&CK>F6HELMPv7`l1_C&YnVyTYMv#z^n4DLWay|NyJ(_Q*TDohpCnJ&?7&G$co!6<*mJW_Sv7hp?m9kOFu+I)y=b5 zk(Di6+~SBg&wgnqw}GvX7L|9!!HLgxpdr0ol5LV;dm)83tESg}C;9n{ z-Y69SSpJE%gB#lBM=z0FhA)=$Wd^Wn9$9p6sic{UgTj)2+1g=SzBEzTr9V5q~Fn`I!D77Q3s(xG- zL8@-#i`Bc%^JO&k1NB1BCZoO$6@IKQH@2=)F*F}=_?`95 zR3T@^a$KzImgLGg8V?lA-vnH=0d#-S3=(FXMbi{GVdUI|AEC|1s{xy)CGrnvMFzpg zCcROmu9*d#LAr;>2w*;z>W{N%iFjXQ93Ufl?SJ;uJxuaNDBV9f7>|!%4YR=jTAtv= z$N`AXLNAVduN|uI;7X57X%dNdLq?j!vfYx%cX2g>Im^_E8N2IlF!{bJy!$ z^x3LQ8aM2$T(jyuCajtd?L{w8f`-nD>yn0(<}RZ7{qWDP4#wZr;<*TLPh3|F(~R#v>uN=O z{Z-IHdCfJDd@0sI>| z3`mPBX!Ax074^(aiTMZX!bOG2)tZ%)*ShRnz1kluQ#CaV6PCRmMu)KLpb;0b>Z=SJsm{mz9 z^-O1r%!)DMEd|F)BsrRKO3@i?U*Cj(a^5hk!@v(e%Oo4;`D6qLnY_Rhxl77GyB4kR zM;}DsLxMf87`l(FYD1SKs_OAW=zkf~lYMEe*8I7tH}H?Dp+Fvdyeg`GrD}BLdhb=c zJ>bABtN0>!8|Lb}SMC4qh22Zu4W3UI;GvFD3X#W3A$N#%lsMoxU+oeH(5LV3kfoxU5t zWTosoRqJf1U*A?#vmVkWyKB~DXKZi1qN|H+^gqz&WzN}^=^hersp}U2#o?dOa0e0q$t~lRf6H1l%jtpT+$`@_DJ?hBk z7z5wI=4`QEaCX+sDvcJgyMo)QqvANCoUszEYmY`5*)hl(A6Tt2!Xu}$yeg95-R5V&!(%p1Km$EUJ;5rqvT&ymmrX6S=9{?b180BQe!6#_tuO{%?-SG%~70 zqZzoTA(MM{L#Or!%R<*}(CW@6YLMKy`;BX-1{E^y`?LMF)$6W()NJY6bNzYf+7N)o zp%xT~{iuut_|O3j(!C!dq;r2%I2SLpt|IMh?biWF($at7c?ylL};9y}7u!Y(<9Y-Uk_`b6;c> zU~EK28q|0%YgAB!ihJ9;tMA*;pu6_D0R`K*1(#5ehpr9*P3D9S&h7H(p>L(Euj8xH z(p@E0bqVQ-Afkta&qW>PGkT^4hX?p{Q;E@@CWP&3wCg1`VGXOm)nSdkRXA&5NDr+Z z8&pkZr&W7>bE6-sZrFA2@ZjdA6+wFL9^9t8)+4EX1-0l>BPyGNjxFoBmfu!tm}^#% zQuXo&$8O@JZoE*bi3CCDin#o8a#W400#H5cTNH-qwpmwsCAssm8W4=PM>pIw;8wS& zDu#8|r2a#E>Ta2yrqx9KAXj zk4O72kM@u2D3XJ?A4!Ts^rFe7_@^{ycx0Ft(XGG4P=edqP%y^xA{uhTx=^q)j$sn~ z{uwjegp0MiP!9JaPfFLhyx^lqeZjmbXmG8S=~0ZJ=oUVIX+L>kSgzN|M8=TLUX6rWqF z1q|J?8ny@+7txcXf@QyenH$V>X-C3LvRO_e>C1J5vl_XW3_=-aS@J12VZ_eQ7;o^4 z@wHvRH0vq3*h;P3y);_G|CSN_fA>X^jrYe>&znt;W=b6$j8Dh&mnXB+Q}5M${_5oD z=+%B5V;7jDA8VHf>BZdJu~}#KPr9&v)obrNpDo1P0tjw{q?nYFPlrsy0827zMRfA4 zGdh#rsO$~8Mkp=;AX7CcrPU?33QKmcHk}a66<~+DOI0`=#&?E}v@m;%q9k>exIh*L z>(R2L9peRPbD7&Zmg;I6tQUoLS#3EPT+NE_-M9~ppj!i-{tDvQ)iuALoM`qE9))m) z0ecbe(NNGpNu4*XnQ*36#eU-ar1%Par@&^GLCG_>3HBH533igbiL8fw;8UP9gD2CM|= z*`i?S7HyhUC7JKPk ztlV^nUVnJ|-a8oYAMK6z_plx@Cea!$u|Q|6Y>gFu9^IwOl2812c5*sCoE@oG2M7E3 z7jNbszdAW|UGMP3^X7G|X_2c>08Q5W5wxH_nol>ae;bv*i823BIy`&nz`oy5q6L!Q zLa-wDct`u*>CAg|Ivx()A9J#t5Y?bpB^2&R1Ms-qdNWgx^#aoN?JLnljgjw zw%k=!uG5p-!q?l><=!gtw)*jtD95{^{Sox#f1nP8UMATjN>EDww zy%VJ^&;r%y!V4tUjoBty^9W}Qk~^5{uP)Etez+c8{O3g-IV<4qcg$1|w415;@yzur z)uO*hgErL#PP;qhVrFI&&P{woRcd0^7@$qU@!f2hrIa-4#xQTld1m(lwQy&fJxZdHz`s;Fezlh>(2ps>;mXAr_q_*9 z^AIPW{p@eIs2A_~K>9D0D)P(2`F#KM)%4_W=ABH{;mc$9<$Qi{y#Ml*dwA*{9=$v{ z-hcJ7)-IkAq0jTCdPEgxTROL~AG>8Y@t?G4kOR`>F`n*j*5k3OOr#|L>!XQ%z7jmx;;n!an_MAPSE{1cs9mMfO?TCZWt>(dj&@Orss?#FHP>EJoo-_wYEf$p znrk!~psS`jU6E=s!d6Y%)5)wjM!#3mI-2hSZ@QiKcccwr|H~ z9-bV3Vs*0a`@cNWqae4uoK~*vcC9i9e(W1nXQ8m`U8!!MuXIh?N>beWak}1u>!p2H zrkCc-B#tq}1rP2f$x;xw2^@bmmrgnm$p*YnJ+Io49%Xy%wD3IDYSW;w=V3lEVkykz zndM&l%rHPP7h({!mNTb_ zPD~Zn=r!vid)Rt@dGW$os?@~`LB*sMQ8IY|nj;vyq;WBkGIr2lQcQ*TR5@YtxoY0M zt4UO&Rp`oOhF1Q_Hy^H?zpoWdPVOyX@_^O$ZbJOR_fxG2E1wMdrgA2w05(9$zjg>0 zKovd828$;~l$U0q(v1%2^dEv0*d(DzB|Lz+ zoWu&)O70ab`{R2R%O!=f`R{U5xj4TXIiJ)Fbf!c<7T?Qri_N6V3~c_WCk>qk>;>b< zu)0hOPQRf zYEEaEeU^KEGIL|V)yVlt#gTYD(9YN6%I>fzZiXyY0zMr#QBRiEiA>VAnMzNLk?I?; zy&(SBOwY}#Zqt+K#Ny$-4mjHHjk`rpy~A$NL$uIg`-Rl)6n>4lg*7c|H3)7qFf-@T%Y5gpWe`)^vfCj z{ha=M^O1C@5>avs>seiAxx^onCcMSB9*2JEeETPZRBoqSSbA(yh8(oMO3lvogrW zm#%lD0zCbYTOOq2EvX*zR{S+7;RbyTS~#hD`FTmpHlgpF!pRiK4q-TQRVAyTNfezp z&$&|e;Q^(DMyxse2PZGEVnLMTT4s8Ou}tBEcH#hZF1nag{et~5sW}T8`{w4&n>Q~; z&bJ_YoFpL2DD9`eucK7iL&_MiIo)Y8pz;DfhVro4Ct-6$fN9O=N_loqs&qk4Qkebu zCWWK%Cg%1xHzDm*B^j#v=<|7s?Z{x=H2MnKcH*gWiTgGN%X&1I#lG_wcbFczR7-te z1sKfpRm+R@I4f(hlezEa**uE!70{)?y8YAdzv^}R5OL+}q^|UJw}RK5S+Y#<9r?3z zz?Ka7eORLtJ7<;T+t@f)bH0LovqJNJ&L%FzBHxq(f8H7bysLDXm%rQAk?ZPR!ftooa zTWMsYvKteWYO=TS0(9W$ie`z{RJmQjHiZMw4U)+D97YczlGEY=mJ|bICbRcfZk*=V z$4(heNd}hYn`bSML0I(tK|~(ypgL)n;kcXJqo14kx5N%RvT@aT&D`9?I6$-ks8Ndn zR&)a;2G{eVBcC_eXENSyH_(Xfs8N?bJ7eoW1DgArV@hLmv&YoJU57bsG`{s$b$HWF zhW@J7_F}(50^7d5#0#OqmuY8W+vO+n&Y*vs=r>H+ls@dF8Jr8af7S_X^{JY<>%_Q$ z-s5|Ax-q6Few$0so`*vS7$fK63kCwF89ey*7IQ5;4H&*UldX4BK*YpZx}Oyds^9S_ zS2KD?W3MG{KYK`4lerUpS8n2S9hG|@of?2_qOapc5rD3+M_DfiEwo4e?K-)O1OjoR!Lx*c7|iwOMik#f-2VabA`XZ6$K8143h zGQ4%0ut{ol5LU*eLZ@l<2Eu7n^AD-S3K$i!6U(gKFX80G_?(_#BinsrKtI?yjAs~m z3wt$8Oz%0vQuM`Wn>CwIyH$wOMQ&1=4_~Z!m7ug~AB$+k@96**bWNhjC>dgtVRn6i z;To7^g`W#Fw(`7P@BX1ZEzp`}y@}g3m+9w9?%UxI*iQC$VT0|;X0b20<@F_xUJZp~ z>l}ab{zV_Is{M=9tkS>eJdanW9K-Gt7eX zqszv~nOHMSI8r!Pe_#7}ZR2|g9SG=OLWOWhT%zj{@jYw{%9&2YA@1XPljcGMCykH( zEyJO_LyEr)0zi511Gp`w!1Gz*B@1fmXXPIc6h-u=Y7y(&u-@MgG%>=mCtEQ)mVjD( z#vhGGX4L<91wCK9zG9HZ)8QKh!XJFn@xA z!j+DJ@BDE6#rAWAA3oDxzN1Ar&oAD6XFEO?_E9izP5uaN+A=@Bmr9DcG>O7yFn@LC z$J3KxMe@fIL{F6YF{61`*sIQVgcg18Z{dgPQk#f9Y%$~(6$$G%SaAk+fs&%VbqIUs zrz!fhg6MF=O1xQ+^utJwg zGo7W?y&f-(VAi4qwI5jLEtSit!;Lf=QlpA9jjuyk+ZzuabE`2S00_o6NhS!Kw|E4( zsjd$QS0OB6FkSm_H;ZB&eCLs85Z=7V$^$pJIb4G1B~hrhN>%iPh$;k2%(Ux|ELvKz7Xc_*6+9^H8>DtjQzq z>!ovSg!9RBIX+Fo#>zFdghf{3|DTbnu@(5QlBe-2Bx96?Hf3TIqWtmFFc#OgYYxVz zOtgrwveV0&hJ(`}XaNYAjYj zwu@J2ai9jq@4be)(^DX*^Jv*o7Vn}i)cOCwAaZxJ{QIE4$@LEt)7ph}n zrY2J74ZdsfKDXwTVVe-ML+DIlgnG2J0@s2T6t|mIgf$JCkz+Ni<(;g}Rt%IMdh0Oo z%28SwsRh=`BSmK7kh_l3j2kxyw3}z+FZ(yo=nyoKI~tax5pe}Tc4D>iSoJ9E0CEf4 zMG3&@x1lbO-g32ZnoglKtN+&y^)&f?C zuN~}ig%MhJ>DJacnV{R=+)B&nAn+e$BlguGI>`JE_M^VZg{@ouA2_`*ucBbtk=2@P z6&H_|c(_QDr^!0pA+>Nv8%>LW<|)z&+tWTmPT|K)9BhHs%?9&3Nf}%Z_tWMJ{+daF z%WLdlqxrq218!c-)8_*IrzQNwg*Ro2M4~-Py3XKzZ@RW&s!jM-24<%;Z+e7= zr{aD=Wjj;t<3}mew)j=u$`pIN#A$-zIvQL#RHoqE4lq!KT?KqcQvATT+w$y1; zrAr%n3jjSz8dz(vEx5J{@NU@bBo15B?$(0SK^T6;M7r(hYZHYFy#6(Co_ycoHb*0T z?b{rK-Ef=B*409atYPbI4i_iu*UQEWck>NSAZ@=_bHkzeDbl1UFi zTIrGLt$>mj`H7POS%b48Kt0h`F-&JO@>VOT!)ywFG`-E3?`2HtPdSfOl!?s`diIEY z!r`p$^-N}9s|KojJWwz%!~?+!bk1}1fZz}rNgBu5&)vl8$!8)?jQ`4_eN12$B~R!4 zof7R+9qFSJk<%J*a7s^JF_)zCex&JSG@cPrY@+<(E4h>X)|#2TPXJODK?QW6f$}#YOOYhR`(**zhV`x6Jyps(JzRB);^Hw?IF38Df`;7{xcoj(KG7 zfVh-#cSUlc8 z=z&G-Rf$FT&<~3;Vm~ZO=l)pCfxR^r6Hlqt)>!0T6?cnY0a91&B}L1B!& zRUld5x==8~#3QMqxd9t;JK$2P@zmm+SiO$gC-7=w);xxPu&Uk`0CN1$z6ez4&vr_p zjObfj3wEiuQ8!jS1sc}6E%Iw$MXHfs^Da`nonSM{$AYiC#T@iUhX=1ZqE%0~9Rl0m zMXKPfc@81KrnA|o={1g!1&tb>;I55DMA{$$zdb)k%Z9)56$ivvjEHlt6BY0Ods9Z< zGJHLgl;lTff7EDQN<9;HLFV?jY(V7}nA{nWyW(*RH1Yw{au`ahy5sL{sRrU*^k66C zr#!Qf)O&&RX+yc*ug&S_I_5ms`bf*IpeMQuLu_$um2GVGxb{@w->Z0Yi4&n;r{sg;NbQC z!Ry1L(dquHlUE1(Kh@BpVufwEukO+q1zB9Ly-FFbka;!BH^X51F~12m;NLW`04eeQ9b5yItcLGa{A%BI7F)uzcvf~Cds3r z1@}ROK5f-?gc$GCqPm{Y5263}b*>@~CI$_4enN&rOAO8<%BAZlF{qcNE5v-Gxw1N# zOnZf~Ye`B^6P#!9E?Sise|B)B0W1nW`a_ zS$jVs+1=~+L>-QDXlWsmY@6pYpn`|gnPAz z73D14>zYWIy{yC0Yc=2U^sPR4F~%`UFkjnyEJVu<_{fzi8*}_a*KcFdV;j_+8l0?-$t_5+7n4%4XR(9y?@ z?3GpE=L-86oq}{&`+S!QTw!51exhlwBXb-TsY7s$FmYIi!>F{}zFD-(!?Y(N7tAyx zrA7Afsn$*{Zr4DoOOR(8%Y#BaFxNmznZG&3B9|kFvxoc@$?st4CrOQZQ-S*e=zYDk zii0#574n*o-tRI*3!d4fqyfRwpvvE18v6>1z$}-TtU#tuBT%@iP-XG*WuUNVR-&ZR z2FL%oAe`E8n?bV$QYlgMt?{||`PYV_M|gS6dog{<-G@QK&hBn8v-&N4B3BzjwhX@3 z>M-QW)8k6mMToVEuaeGOXTs=ezt~yUY$;_f8W&KHy)U=;pPKBxgu5?8Y0*%EPTN4O zlpS;s;Bllg8F;ZfPuXt^or!X#mm9UHtChQ)f+l=_FgmWmwpm3#T-)8dB_yHM(TXri zmtfe=JCA(72JEN<7g{dY+VDg~)V7@Y%#`F7=iTB#D0^A_-64h&OqrjId7-otNh{eu6b^lRUUMxPr{WA zHdN3OE>S-uitCt=n>)9VoO7!cXn_xRxR$v}F*o+YRDp<53z@kICk>8Ob}_>wbt;%= zbrf-(IBv;#jee}F7D8X^%7k3tM=sS_@bR){%5i=+*Y-*4+slA-fu~Ze(ASzf8X=(L zC0c79jmz(JZ7nW-`^#z>mincO6supqZcxVq^=E!={H7IJZQ3YYb;y>^bh9|Pn#?}m z;v;Lr0;$oE8`YHJ!xj#;;Ijkk9}qaO1<6wF;KX$(u%YOyKW0UuJ5RRy@@H&AoR=n4fp_0ZyLFh|1ev=+-q9 z{AyKYc35Ng!<-JT{P}DIMX}fnKkihVTlr&B4_R?c;)zsqOv-U(72_c7Yfh3pM5fB+ zvS3)qDK}a;Bn;9RZY%bo2j}S-efAR*-o-_QN>zxo$2vxML@?AHpBU!gMf=UW$Q-y- zUxr-*m>^`!K&_EdQqeCoMArL)$wyNJ*+_a2*Ab_G++r~~&EqPayC_Kq@ZV57w{sD6 zE;C1Z1X;#hW1dALpGTS*A!#9XmPN#1jO7=mMiCjjK6K3RI{ zorvvNXByY-XvNA=NE^(`6|R>mrXcDiTp8CfrH7HsFqIgznvpi1x}Q~;N2E>k43|p< z6K*Kn4+qc#c^O7&R!`9jSgMv(ZX8;SoGYco)t{`|$lViOq%Y}ISmxRb%l0^go} z?-p5Pois22HUtfHC=DyjI1AoUxY;y5iw3b(v|8(+9I6J1eLxqLm=>l8Fo8V1Z4%fX z*5jq#X?U4g>14Ff$M>=^nW)B6>aO9(FxA&joAI=6Dgr2FJGTi4D&!M{6DpvXsXL0% znML~a1F4}whzeD^bv|!e<~NBg|1b?;1{xM)R* zdX06u@E+iCtu)VLR2t?SaMHyGKjAWevMSER2n-ZGC{NFpS$~ltTwySbEY#x^AWD(G z_Of&3p`mxQ^wX4GK&UuJZW3VL*EiuL1AFLP*YYVN0JBO;ETH@xO_5aEl@h6(#ks-Y zOFyBGErWZJ;&)7g=I!T6U{lC6F~0`^#!BpdGDQQg&hRn@P_5fx< zX!^)go>96$A=X(z5rD6r|Nkz8}hg0Z@~z#tjmwIEbcN zsT`sAA!+rvW*%A=N>?z@MCnCqr~go62^FS$Ki!NPNpC1*Q!YoS z+~}<|Q&gkUU#z(tXSNhdER2SJa!u4-b!$}SjU)ja23G_8=c!2X*4LTz+L0r1Hgfg3xbg- z%F==>kK#bU7=9XIikMNyz1F_3O2o)PR!Ix-nQ&1z%#aWKAEnBaG^YBkbaN^MkaOMf z1lHl2Z3WHLJqlG3vLB*UT$D`da+_tvF)8pt1<^_+Ct1SFn}&=BORW2iri`_7NJziG za<2aJZs5G%(0?wt?9| zPjl96o&qNu`Apx~eN(T!3}PVY=WgP2;9O(TC(frj3C##db) z#Yn9M!1&;9V2bQLZH`C5f+yB4P|?~mZpbj)z3&l$Nh6{0$Pkr@E?c6uV7w%o_|dWo zt)Frt26Iqg7Gq0YHYJ~?Xf4y8k78NF->J^D*7hhJg9xMYj?Yx9TCTHC_<`*Af!M29 z_|gHx1vs2KjRdJg7i1DsQ#gx>QHOjh$I*o7@{1fnl+s`2jwRMI@~u6UW^Tf~=8Vh_ zT8+h({G`-p4k`kn`GjW=<$9?i?-o)wS6^Dh4;c&n5J8Q&oICvz_;WSe%mS6w6@MQk zX}*GYHC6PZG+uH_ve38x&AC&tNs#Ia)eE=k(Z94*5t@vW+Yg72K=j zf8Y&Nj@zYj`Ccpbu}qZSJYxfS&fEf`6s9XM~+ zk*#vWSVo0uMx?$^wQo3n!?7@2x-t z;5)mvW|z{EC^InLnsK+fjFPvvzJ>-7XRIMPE!BLp&HvmB0%s2dJ^bNqLii51dze4U zo};!xuPzs?XDz8tMqhHA|4?d$zyk|<+9!z=%2FqCl1AgGwyslBMq1vDC`=%}vdcKy zpt{^EZKMn2m56>X^|UjVvD8ZDo~^L7ERHA4ck$-a-o@o*i3#Oafd%GS&R>b91&p}? zQ3a!9-!4Ic<536Bc^o}>m>Kl58rWxkX}1}6H+*iY@mNM7f!oL_!Gi9bZ3{`nmFWFp z1lo^&;LSmXvAJP84Nhin*WrRpq17xju)?=1UP8@jJ}_TFhR^5zOtj=AVG|9;DxwcR z+i8(!YrCHH%#2=1UddQyJDuU{N6Nb}$56~;4aS&^+fYXkW}8K8 z@(`P6b7Db|L1w2LXsGd?uuu_3#S~v^_)gW;OlMi=43ZlyaT=EDqgw!PrM$UB;u|@o zcEdLmG{bq8;MwZ5FnZrS8$CDZy&L<{n)O7!yO0$rRWZml#meISItbw^EQKWG_UwZ0 z7qWJp|DK@UW-{_^r395UWcn{bYYz1?dIeh@wdW2u81wY2UyrL4>!JoNmrqi^Fex^O zt<4jtfjUoP)ndPQ?}d}J3B%a;XnC+hP}~7SDDz~a%@eU&_yqDc{8h5<=uxyDN_Go0 zKX$wIcD_OVk_!ysIcp7eVqnhQ0bDUsqotwBYPWD>Ppp#k=3zwwW+H)Di0=*TT1}>a zZMP_FHPMcvSjSBPWHmDyrxzmT$f2sLY$~_sTT=FEeSOwMzA)B5IC-zWm%pJ!7axHF za^7KNWvAlz*VmUYRP@BWI>^*k`?rj>>&;ham~)n;liS7HM)HjVa4ZxGxMhT> z=2cJC9qbtR-gc6E$i4+bBTvvO(<@{n998R}R+8%_*&WfI$jTPmtFBdut_uU_FMtcQ zQxO-T2^c2`>0Xyzr}7|JS3_+x*-nqi4cEH<2Q}4(Fy7rY%Vx6_*~pW-X$0F3C3V(& z4+P(rO(t>pRtcj24$$!S?GXOzlS-H)44dma?ZJn{|`Q~*!ht; zLU>txs1nfT;75Lxl>-3>$V}osP&%I7p%u00J(WcQByyFR`U_{e#>deF%`tO(EFa~f z<<~MmqZ%-+7)}awXxT+((xjZ(BqGsh|Jrj%!DMG=n9c9;hRW1rYMNF8( zQ2c}ZIc*R!a-*H|$`Hid4cGc!LL<>t{Yc$?0T_@sfAT(aF(i4J&jDNU6>t(-xG{ zj_WoG^UFg6k)=VI&Xe2-le{k*IvVX2(#PCupIf-CCm0m%(!q)Qcfnp`G5&jlB6H=h zQ~;Nq(r(9+c_8=2LwWM=CO&+^%nh44_hXjdL+3Cze!&&V@v;Csoqqyk0$#TgKV7?G zH)ID0IIbKsPh#vzN#HN;QuI0X=W`X4^D8HJ;eXCl(F0Kz<>9vtP^aCE(I^QQ@?-)y z(r=&ID|(Q3bS6|&7xuwoJc~TWV=@&PS%5%Z!>q2~@YP9(fSypIsX*(`Xk%Ni_%cIX z?2XGf!>BQaD~~0*>Uu0bgF&8B1y8_I@`3%6;rMuXaCkjFeLX&=)@0^@Mk5Jb$~SUy)8KcR^u|)Hl)47ML(ZZS-Aj^o ziI>tC^O6(?cQU*C!){{-7sRMAz=;@$xd{bkcg3A z6b3Hf9{wCg54qeT+2&32!cI#vno(*d2!Z{|qLBH8=IT+|zxv^7o!(jn)v`r2ZhCu+ za*Eh>njh6o-h*8Ct%0S<3d6~zTEKoT_O}a`t1~)k6xUN%ZtT?uF%hS92p44+Z#&e4 z^zYe|2wKowd~lX0&A%w5jL*r-iyk-qzN~A@tT%$HB;N=Q-RY?%Wm0MBra6 zMFS_XidS%3N?%Zd0rx@F6i!P>fed80h4Yo(Z#k^YIM5YE(*D8W(ecU4(^uoFzny)1 z{-%Z=JJjH5ufOx8tFISze#16s3YdQThG*rlq(Z=qor=mmnjeqHb>8St8Asg+Vgp9d zEw52mH!Uj65?asV9b|L_xKmOBNA1aql_JG!k&V(?0Vma4G}^N6ZC%<6J6CJepb?V; zJEl=|9MS{Gj8hymf2pv>E%|$J6bNcz9Ob7~u*7}Hr;rOJa0$f>2i2kBB}vvxdb$Gz z)x}^va&*BP@aO@feVdXE+3}KlLt6fyZr2@|Y43C%wCe|ng4qK?$sDS1{ zJzi5jZLC#AQD$G*9vf`5AA^1azry(Q%$kPKzoywJzA2i6*wi6zdFM#bV{v5STzrCl zz-Wy@r9+6kiVyH8<41MNS;ThcHw{Tsikz&Vl@-^RnhJ4x4M`NN<)Ig!EC^R#G+Qq- zBNr-e+S3qvB6<=FKkURsi1`nH>V__l!V3hRLi6k>7i)u`+1Q*bPo`|6l(s(^;9IJd zb>R-d{sYCiz!600rB>@0v%E=KU}90^n%r|MKhW$Me_**i`!PDPf-qjEJF76WBfau(D6$tucF6T>ZaB&9pgGACIvvEJ zJbO7N50h-?SbN=-w?5{P%>akMVSQ`V>fv&uSX6@Vh&{~&xow6s)jp(7R2cj0em$ud zqcgZA8>SRg+aczX3}GO`4jS<@m2pJ145Mg2;^8<3P#)r#+R+k5Ut-|r^S2+*VOz*b z<>?Q#Ke$gV=xS(4Zf^EI<;)gGNQq;U5Kep)rj_O)BikCxlzU6kLzQRBuBk>m@e_m1 zCl*FW`74e7z224Ha4Z`tKsjNvT_Dfy2^mC|Mj#qvEk_tioO~9XZ1Or;j}@A}Qi;%H zmN01{azNjAgI7tl!!W`kwTs_E> z2|qy7Cl@^k;WQ|OC0aI9qrSV|@GhEJC?WV@Li2c(B_YC3^)3+<^l1p9qgc>BOC1NA zHYSTm4RyLwWgz)o^kDhq7$#7epT@CMMtFjfkpq;${V4C9=(qnxc{=1l?=p1P&>LA2 zq6%YYI=S(ANUGQc74*o(jP!HV$o)8-*e1GpTZFMO8;CpOL-de&lfo_d~-aor>w<75*&z6 zr34IzU&yJM6PEOS!mNO9VQ3KN*4XkJTdY!0HSjfWFdkSYn)|61nXxh=Q?s^7l+ut$ z=O(h(3-@z$}9DP`r* zm?g7^SXcW=3$F2cx1(v)N) zCqF|k)_!s)Ok^vdxeQX0l0=ew%o}pi@LF`C8xWs}5<7K5roMvM^a3=c!O-kk_<-&q zxP^^DEmpWT(yg)|)7p~wGGkDwAR+_dTN^%WqN-?!!)KG z)Q(BGv0;P8hBbdMnnKN^i9CU6>-Rbc*eOy5d_GlkPO%0@9AD2(*R+C0`6*STUuf zm|85$Rne!FqRh`eym2xQ)Yo!EX1@xsuW@|19#6`45(!tAp7H9D`Aa)aJ$#f-ybfn^Mn%*yiQX=?@g zhO(E6F$rSy242xAti$%skhBwVLGknF6&htu;bc%u<}H znc$j4;bWA^^DS9CCDe+O!sj8K6s9r{W;x;ua1D17Eg7ERT7qI`+gnMtI?NiH?P3!NgvHQ6WiKJjvgK5Kh$$b$+d z;GzOxE|=N;AiM1p5I|`|#Cw`=PkwAK1Rn|T5)m3W_0zGN$ZnuQOzTjBe4XcJ4VD$k z>@x$q=15)xnc$3Cl3j?h_u0bTm`0tlvQLf!%nPVgpwquas7_?c3yhoayLC)_kS!be z-wKT&$6!ihh{%J)5s}xlFCOn_X^?KgRV=za7=9{H8@&WL=qTH}+QM z7y{b3d~-9Q@{|nG5uuw8Ilx5WnKS#6Z}xT##VB+A)jGKL$Fy_08`Cr~t2mY0vPN!z z0Lv0h2N-$faZX1zNw243mDXupiz&IDbLy;t^WMh-jWFL(mNL{j^6*Sj%)KbG7Wb{; zEF053oZam1_54*uvt||nB`0Ze%9ZaGH$wUVTXAEnI@+dPmbjUZeMRzZ9EB)kRb!NM z0cj^Y#^k%m=jZ;BE|n8Iv-Kn|Fl8ts9L0beBlC9??o=f3@97)Je z8etI*7F8VRpHqU2<*H~U)!>-3AkHw&>^+$V5oJYA{8UX!Y#1eMA-b?8{{ zY6i_H-K(0O?%Z(g>c=r{{3{pXCKlFBs<>D?d;jq1ofG)sXPq@8b1LJ3gq?M7 zDJqJOAaKCtpMR`g&Y5L*HIJigv;Y6u`_|^hZ6(pa!t&j!%w#25^4n8&J~%U;jBDrN z6Hk(JPn>I06eaPDL@FdT9_Lj4`$cyHAV>lrNJ*Y#cWcjPY!i=0cLQkjv+l{&LnVbT zoc8|yme$q1YoWhMMwh0l7;YK|2iljC; zj!f?73h*{zqTI}~rJiajf*jLD;^$go+yRs>6zO9_jY?Upa^j`U%j)r5(oCel`)&vu zZ!{b#KEF^^d;v}wA!rsN)IsCsDaR7=o1f164D3#s0sw!ELDvWF#0!c#--`=yd5K!8 z=!}B7l5EV%1a|@#_MKF3Z&4VxLZkO=*k@RKZY6R?re@22lPxr2B>x2d7vnIk%99lJ zTW$iH0ghA=0EQ=HR*SUlp^J(CiF=}d@uBQwI^kj9()Of;+ExQ?OHR|C42?07PF-jb zY6B^y;@Mtv;nSkCMTWB>%o2T*f$1MoC|Ib(TNtW8at9gFtjs8-+gTSn`LpoEDIVl< zBvGCrge;sS+ZU}wn3ag0hW#e)xNJcF_Un}p3X}pUlK5EEhEFEEUJJXw*qK!~y9{0y zic}hkH;e>(90HC}<8=?|Iw|41#5Bf7-%CdV@#p)J%YWf6L>UtJ&^2MF6!%DHws6bt zL4LC5vereZrF{AFodT7fJW!#DnRmI4zdTK|@0cT@V>juH(G3MPNa?9vL)ObW;W4ITu?_&=5qPUNyI5i24{X`M18e`RV z3BDnc0*=++*$rz(xolxjm|7HNC8*f}QJmp&N62zye3r5xzkv8>@uFgax(}*%egG6v zG|&0@Blb>F9R_rU0obc4T1?DAGf>$U5ZV1WiBTDK^@`7RyLY*U4;nS&cTRPux$CB)P())zkr>G4gZxmWlb^`y5nv*enCDwJTELX1m929%choKNXvg~eykd-PUG%k;JscLGJOvIms z>t-=9=0hnpJLv?b;e;bp zzQH`IlBLz;Bu{({nWmLcs#{oXTw>E+Pe)fcu&2^wr3r$|4}YZWs6) z*pD+vD+VkXtx?Zfm=5u26U>u@9Egjw@Ho>gW8K?5!WsOGIpU$_V#R$`q(FZqSSL;>aP*k?IJw)w5QH}Ps^fO z_YUe{X9*Di(D_K>$wCb|Bquy^BOqSKN;lAQMZJ=%?!Ez;wa<+y)MwEx6UMEr( z$g5oVQ`l3=<${5_6t-C_k)aTj48FoQ5)xI1kez}*HL2u=ETpTXcLqg_q0z^e*ZV)d zx)w>6(KQz)5mg_=WJOx$@gs%*P4=;f6a`(1Vj38NZ&?84DWxITaYO3*P zopX^7J6kU?C|CKcK|&RP55&)yEx^- z*6hW?$)bFh2)}Nyp}%L+egAu&j0^ouc*|$+zkmJna~`%P6A@-fCG~b`!oo?5QZJIw z3c*ThQBj3!Wg(P}Z&S>?@(l4GKB(EfedJ%dIVL(fFvP?A2k^d(CVku}6pxiP+%yU_ zLan%)iw0g$$-1~+Kz)=~?iVGGxao?ym8p(z_jWBm317L*{PqBEgIbm|Ywa|iz`Y@;eEh@d?l&ZrdYRUx;ZlOnUedEL`w`?ntCFl?Za_;VR-niKtZ#Cdkqes{PZoT4zvK)K+(3>f>ieA9#>d)!!BU1E>)?eV_LE->9m_|Ck`JujW~tGs}Nt? z**AS-! z;pi%Wabqy*1#_7Imq$VrqAG4orRaS|+f+q~H)aR;r%Cb)Mi2P-#ag-^hXC?UNo?~txTIw!hSb?i2MWKCc`!X4s-8K-(q{g7~cNn-qBBQxG3uIUz)Eqm8 z_V679jxnsJElaYH@Lq}ut3;#R?lJoHDI*@cWr0#X+GJGs1UzpF2liT}7xL?%hbLr} z1Q&`-Dc~Z?FJYo?u$>b4O1L1UsiO!ip@St=?UR&PDHz-6=A>5da@G35+Yw^RdiWD&1=nygZ|LO=Sexwwn1G&v>mreauU5(oiJLMsa@< zt{8`DMhlAznr9S>gRndi?sACffRfQc_@o~B%SVk*J`TKpd~iBqQth}uJsuDHM+c*` z{@Ll2{p1HnXQxB|@N8;IL%}K2!M%s~Z1U_WBiiJr|A#D&{K7k^CG*4DmfI%O* zW_INl93M#PX>_3?p{(1?>p@XcQ}#CV{TrTp6_YD58gZY|vO6P9g3EyQFm7SLntU0d zMZaiKhyA-GS%4dEDG?Vv)Sw%eM(BCT;jSNX6*!uU0VyrbY}OStLH9BBmy{py#8>+G zHpEoXLQiG+9sKwB*}~tj1zBaITH2WD`Q+I5kNW<}*>V3UIG*)O%`oFWEe+aoz8j|Qdm+7>84{G#r_bY}MpPSjg)X0~{ zFZ_q>#R4Z|B4QunbNdG`)EWmb#MCdAkA3m8o~TZV`E}Hc9I{2VK%+P@fSn% z0FTo(PpM$G5mjQM4#*N+?dWO-*N7pWw0*!MIqxh?&ztsnQ}ZS$wjS>y<3xKROHEG% zJ{46`1wJJ|YH_K7x1$@db|5>RyDY2`^U` z%`f0SMlH#EgIeG2{c0d~34t9>)baq0S}Y??jCW6j`jSa_hZ%w~v;HIk&xAXF0h+IT zzBIB2^y|xhed^aQ`swc~s56GIP|>ca9m$3gW(BN8UaI{8=bWlPmJ??p4VE~0;R_p4 zsuwZ-3^=a{Q-u~OrQ@UA=|%i3Eu#Rhmhour9~__P>D`3MZcLyXre3g+ry97U!x1Zq z?v>%$s}^%}BtskKp*qg4EW=xy)hbGnuLxxY(G`tIq)@LCC{Nd+6M2f+jr!xF$;Jq8 zy(Fz3Mzaj~iBZz@aMGZi_b|VolxJ_#=2Q!Yh@#whvlkIt;0dvw`T=Dd!qQwtRRqTE z;E45c9u`IhRe5)@f-U^*ha0qOR%y)+`~l1q4!*2{0j3UeBE5pMZhNvkz{bqsiu5*H z5u9Sy&RdbU*4*><)ICrTF6D*CsbIyr!W)n-WJ*~la?&4&Y`l~r)ts_@CDetMH zv4cOF@Lb2>I+Ba=y|*Ex(Obug9eFA;{Z+aM9h@>QNJvcjpNHUvS!JoqAAb1o!`+YX zKmPFJ&Bx1EcRzgi@X?K@BnG?ilkB`PFLfbUE50I~{+&^^rQ8N;o3KqOjl<^tJ4QzRT+ z^r0vKPC&80OsVd@WKWV=;3zFJM`AHYl)md_O%F!>A^h*-=-|a@_~LN*PdBouAU38| zkS#YR($8YSj%(FFva5@M8!2?(q`bN2z=Wcf+#^M~7~#cDztk9>YiF+{kDJM86(_!QM*JH6{)%%A4a&&2{^^MfoL$0MJ(S=6w#`cinsw^ zW{Ocnvyo){vqqTU1w6TTPB~X~2@$HMZQ|=uQ%uuEn|oYN&JJ1H-f z{uYcoEZB~3SoR$)+l+E()aQ*fSXWSILwwmK76l;rY+uR=?5$QrL$f|L z)5w&Mxsp$ofndVz+bGW&D_q8t$dAn^R$%Ie;PL?7&}(0m6{o>!eP{HR5g28SOx`k3 z=~{#(+E^9L?F%y+B^ce1sCMs$LhCy0804bi9m*9}H1d{xY+1+USqi2kwMcUSX!r%ASFNNFZ8Wktx71S$NSQ&|gt^@xH3s^yjv4^X zKDe@-$qw#>q*fpoIlQ69SR7Wkd6wLcMf7Jub%y?~AbpO34G6(wf^nAhhJO&sG7a!!IDa{Q6A9j7yn1xR zGn(A8zUZV;CC{NkYwYnBa<7$2{0NUMwkC15xFEg)aVdj2<>PNbn)+bf2(`(AYq`+P zi~j7V-AKhcTFCViJEeU%=D?)>1hi9^u@(AN2JA+|tzp4RP)M>5$(fqyC)?@jbx;Ue zx|RxN@o4q|7V<}=r02pRcm3 z`X*AUZM#wKXQf(ZfeFJB>#Hy-*kLjA&}T2hfj^G!Z2t6ua@4%fnp@oKe=1zn#Y^Wx zac%mJYyj|JOQ$}>AzplU_1uDR4UFAn0sTN7w^QduT7?1*V!$M;%!Lxvuug+F_}RnH z+9#(K)pFGCNR~r%LvJJeE?9&&tP2vcoz|T1dvwq!5b&`ZaVQ4ujzTd)Hw-pH?}9R~y2Z})~@Mz?!- z%gb770;;ST#}$w^V&M8%-LUPjCKqN-GPa1w3CkH=aXO7d;}I_y;cXPJzjz;R957B` zZH8$%M#tA}w{^K-y;1qgacomx@5fyTEo!bZnLH@z>1pvB?PN+ff=$F_13 z>_Xgfy~Cba5z2~ z9);&;!{Pb)Sr|;ujt)*kGnZ|y;oE_Fud7PWMW5F~nb%%{=c>IksqVU32An`{(Au?E z+3iGMw>kE=pu+o_`ny)Ntc$kYRC-UN&)XVpH&yZdsq}jr5>J+aQ=n2TsK6V@r*X#ysk0kcA&( zFvjd9vVeFp2t7uhNi{8AXiDg%2dm5Gs*TXmW24)unm5Y8kE@+h_c8PJU4bly%7U-=4t(@N)xmZG=AzrZt z0km^L-v)`eYGZ5(c@lIt+^y!18C37QOQutr!U2tYdY4Soj>J`I-U2OG`SEhdT8| zCkJNdT|@~>CrVU6>tY474YsAdpj%lB#JeBe0_(0Pw*bub;4VS56=ZMu+^#LihUOVO z?wk0TH`?Htjw3wvGo8S0dZrhPYoJ=uaHD5BtezuC;02T}4o`Ew9!K2@wYDi)G>}N% zY{png!_n!|)r`}93)mLYaQ$*P97Gq6Q;XQ3<#-Yc_EJ6PY1K#pZ6$47DtCzbSS=4+?YK5!o+)ayEpqC(rQ9T z?Clt)BFrOEoxnJ%$CDpJl-y&6>>-QZ1I=-Gksup~ z!jgo5LyX}m=7E+O=Agj@j0ErdkFRffbi$yG-(MuNWX((3coz$-ki*y&eFbmw6f!J5 zyLff;Tx7060nBF%OOt2R1OO^>heA3Bcz7)s2L9vK#m9?*_fH1<;HpT~#9C3I8phM& z+!Ia(=;{r*fO$#@s=BmD{0ZbZ7H>H8MvB86T`U-cm}B5^1v-nxqf9Zt81RL6|MJD{ z?TX2Ux3_t6dkbKq!cOwv3n;I2Czi2zQ20)+?H-*G#nb@*Jhp5rp=m)8aRS!Mhwpf zZ$J%xZ9`Bk4`l{v7 z-4@P!y2(sJ!YZ;OsIb{r&&1S`efiizV~l)rF=|AB=-W*&A8mkwGI)(RfOOSOSl}tG z>v&)vTrk1=cf$qm+#MSwARF;zpZK_fn( zjTRs5g9|=*|8Dr;ox9_s1Y`p~vPl@O8t_4FH2AoAb$NN+j1Sqr3qEA$uK1_`X~##t zusqHY8`wgVNA~T_n?_8CzFnT*i#AX18Wzgn8F3KB$;A9Zqp$U~U%}stlCR=z$P3KN zpLs!-YO2)Zlf$z^J<{ZaU0jPrU$eZ?9&RJzmVPi#ToYtq<87tL@F0Iu|HJ<#$@ps} z$#E#Qt)WF(B!i+k0cabuqx)etb{3^bmIBiA))L$oY zMx9{W&$M7zxQj=Lfn;ATeTKtQzFq>2IxTmcLPKJsF^Ptx<6kt5Mt!9_Nu*Jy;I2|> z(1P6Mwyv>;rEBvq9Bs%rjP0FAG9@r>+g?mzof1zNRoEmAZ6X1=i9b7wE-VAFtN20( zfoCHjr;CL1XNoekt>P=h8Ez=3ytBzXh3L50HmZ3)#lr{w)=^%57KeEF16(W$_aPAt0R9T(- z#s8JUX)N$QeL&4NF7npLj8kk!l}7gH4jluP;vqcw+$8ThS#8MAy!#R#-#gOnD~E%) zZK92EU?nEK)0@c0Tm6qzYw&frrctVDJPw0kIyyfdpB(t-2dC%3VK6%Pr=#K7@aX(B z46ICApuNjYTJ-*^nvQ50+N*^?3sX$SyQ_DXlxt1Ycv1_i62VnxFklYu(aQdc_aNgk zcnAnH-owMgfSru~AW3KYeg^gJF#ckH8BQV};VAt)_%hFzi(jrT-d{lIauh_2SMbZP zJzfJy6x|qjST2(|YYs1uI3(bKktiJ>Yt}<(mkE?lT!jHt5G*Z`Zw%AF`49F~ZFmunFB*7YR)dMWU1B2}&5g3N3Zr}u)55ZFJLhueO@hW{8^CbZkCY0uR zU*1~Ewi})t4Gs9~?mDn+^c-jft{G9*f`Ci+f`GE3AA~3*6Rh26Vk@UQd&^FB_KaZY z>#28%mr4cpi%q;Ib-Pm3>6$hB3%ugBMP-2lX}{ZAkBZIbH znsC37Ed|^yu#BNgTn+%d{@XC@AZNYGfnW5yz%aXsgZUlAgWTb#KYmpj3&1QSY=>Jr zZ9}&bd#kXi!XA|PDixs1{d5-QGJZ!}Vb4@vuL{;vR@YmFwbEry>$2e(gmOQAw4qlt z(K!cVq|(CUO=^DqJxI~@Ihs&eSzgPlFKg*42!9s^X_6(=+xr~f-uY6j(SJ$T88Rv zxz@7R{{Onw{-xY%>umD0KD8D8ZpUZtJ0Nr7{vEr~mI2y@4{ZgTyKtZ_EyB^aq=e%q zcAd4s`*r+gD@5A9Z>4U@E@mSgnZBC4Y||pXp08|$emi!QB|J2G$rA1UqAs$PHSWYe zwnDXCImfc42z!TxREkN&-EJf?Q%ayU^TPV*WF^VjJQA3Vzs|h|e4N;?_{$C{h2Z-LI{S z`bxgnTNAH0BenwDBD5!BV^kKc`!-vw)L3qy(Z9LAxO)F_aQTl*BSkfkceF2R2ii=X zyhW}4Dr^#Gc#9@UhTVNsUk`Z$Gjbs_ftLznIusyS8|lynLJkdGm2ZN@Is-Wdvmju? zOChe1E;L<(QORGFoXHtU*160v7el@}MMkko%WU2_`hp%ii*V)#kNY4@gM+?LRQ_i2eI1Dt@{HNqIkF#Q&ldnokd>)6v=a_~bB{oQ%W6(_{a1 zIz2cZou2!LXOqLD)05-T`KeiVUQnR}4;G!bAn~*%bR!3*$%IkV%7VO! zzJ4U{Ky=UK={*)v{K=$mQ77EKH>xuFW=^RUFwNMuF5h^0T7zB;@h(VLjJkNnV=kf; z!!7ufHFp?jWgtTL7?I}i5H~oDs99SQd9SsJyy0yDj@_6X`$tTUox&NuPN9HnROF?9 zc2mimO@86-X};H;(|oU+(tK}a5k{nbIUb%5d|m(``b?@U^IH&__m$?Py0ukwS<^#M z>BDu6&u%W>KOcA)w}3iF?=$$ou_s*+rm!TiFMIwvpC`CdP)n#^kdemgyr?L^U!dOA zwWv52WxCV`($GG5ytT>8wyS-SPpEyL+MC`*0z7I(ij8M4-yC${iz zZ=bzLQwmF=Eeq`TlQP+I1SVY(#VYcy4cx8r?U-s}ol& z681!4J)C$!Ha71*(L@~ZZ=YAS;=saiSN;@*56$FJr|eD?b(HPwMEyFQP@beSKaPI) zt${Bp+DjeGs8^dYh(2_`$k?`Prc4#8?$oJ{v>gg{L`Q29GI-W;l((j&zvyE>H-h>L z4_d=Qer!+J%K6!jxMG1@qp>pJ_DS6VQBEY!a@O%KN$=3y#V#2qf@3d6_P*?8d9XlR zcw&jRQb_*T^KS6DdR;wDUozyeCw?6H%`~mAU?YlZhuhMF!4(sB%Ed{3haQY}Qn6-z zYNmO|LuLRhqzE32@Vr&oD9XGz@j!cp?vQcD-o#K8@iRlgq*ftfcrfe_Py3^jkHfK?+f!ZzDemW_j1?%*4=u8o6t=Bo?H>I#I1e7hH zNx(l9AQn-RsvSeDPo(;(QZ8mk^y>IvSm;q!*tzOJHw1KiNi0eBo5=;naZ+* zrt&xcB$<$%1)x)_uwWDHlO(t!hkG_CMhcZkeR6z!c8u{uUaDsKrb zdZScz%~qpbm6ir09DLHou>T;yUckx7A$9s zY-}!Wm$%}Wn)VA5eg(rn#?fzUFrGs*kDB3wpg0Be&jRmt!X=%Ip)7dpQFLCE@nXEl zKC8LUhGb(0?6c}YMmB3vI5t5`!2({Pp!Q#{R$&_WSqPypsUI-Gt)}}wK7Re(cjqrp zUtNCpdU$>|JbyJhc=__ec4?Ne*41yPGDb&E=#2K}BNY;W%{^cXAw`dFz{}|(9-~juu82ry*mi(W$hli*Aw};1vRmP#Rnti)`rNd!IhS87I zk!@NM!GT%G@Z@ec;vL!>jxuQz5pz}uld-)XP6jhZTz?^TF>#pN=%fL^Bc1dkZQU}Y zM}sSo9IQYEf!dpa+E{_AKy8Zlo!f!j@!Zx9Bv8JoA*g!l3#%~fd6OmR=HuTA4Oh>5 z`?niE_FjXHC(43Eu@v<{XFWi>&?Y-=YsMh^fZMkQIUv`KJKXF+f+x0N5Gs+>fkqoz zgmlAvJ(G}t#@!|)P``;$$Z$uM_L2i7wqOA=4YflPQ2U#ywY5h_qYceHD%35=vYG9s zVZ$_iSZzB#1*|PkR(FExkhAFzzBtCGkS373fb%g+$jgFx zxb!8n)hgS+0dCKF-a1?Ri^U^((a!OY16p2bSRSQN9<&m=@DYO-d4!_yP?Z%RSR+g; zby;MXdUk#J+*^jZ4>7p9StW0l=hbNf>oX(ssxqo=raD_z=F~K>&R!4g#!NSl_;@PR z3j*0=1{;lqRyQ`3hja$TAACbio)EGj#2mBQ3{;j<_fZ9S@mDLvZ=-nqMI{gW!zcXV zHPw-LcKP;ojb7UVyr`~G2EAT&Lks*nKkz=>VA&1t0}sdrj^-sWo>4uH67&^^eH@Ms z_A#i}FnFI%y(p(U^)=t>;uxfp56{3bp*y5}F?=5;5>WQ)2-v0fNCD>}+Fw?<0AU`P zB@GvtZ443s#F!N+7x{_UEV7x(Up)N)nI9%RhARx_s1?l^_8C(A%mZkyuJMYbWCbac zMxgA5sCpp6O8yP&83gQUVSKK$27PE?dY8Wx?~+=OIwKf6`W7{*q&#Kw9T*7Hx7eU+ zUvrE>88DrYfPgS4Be3n<1%|2|hyc;5ALz?-e0)gyl*pd8y{vM9{z0PmH<=bw?=SQ? zDudPmQMCaq*b;3Ken*s9c}Aklp;CoxTtf{5Z|+^7Da3EUQdf4W4d7Ogq71VcS*TCD zi?XDF!?0bSwKMV9ORk!`y7^ELNqq>I*r)Xc}t>{ zF8v^cWb`ofby3-0iZs@n}iWP&Ny<}~NCp9sho7ec2?qxsAk|6Sh z0i9?rpty~HLZ=nA3Jos=B1PV%4^BK;0>u9mCl4{mTRv1i%W(qM`kz5nTTl?- zLo^BD`2{kYu(E)dOg~m=c78NG8tSN}Vx#?`Rq1V}n}Rbdanf)Gs)(lBjhfjmw;!;D z~eVsvmeAjfuUal{x7FFu*>V*C3#9EX7oBOULxO7BKYG~Q~E zu<7?CHljd&*Sj%c1-0KXW7o8_U3>DmgCz-zb~lW~UOb827lH*3c^JC4*&@Vm7`eIAEdvSgj|x^1Ep{>9pjh*Z@T&}lGXGEbxzli_=xf49FmWtl+yjUdLn(900L%91G)2*6n{6vj(G_TIj_ zxQ09aBEVSlS8@!R(vShG1a-$6PqMSy>(pU&#zPyS)hDJP{Av?ZaM!%3>}plap2U>J z26GbbuNZznuVq43=iC!bsV6o7(~KK|JxldSbuAdd!hzZl$gqi=D@sInAmG=56v5}ZFtIr9#VJcI_q0ijr*7q}+f9tTx zJez2bF9zdxLkURmdWN)-HUNc*;)jqNXMv~hvHiWcj4<^kI|vK)dgfsk*cd%Fe}0XBl-a#-X7G*l2D76m-%nRkgwqrNmV@u39Q{L4S| ziaHmBvxOg!7KxH85m*_ph71#Y)`mrwlesvT^sw*usYtg+xmEC>k3OC*w%P>c4S*4eAcd!eP~!C@7isRyt8$U zB@k?DWao`-jqq8!M)sj$jl65OHS*5ZHI_gyuQ8j1;mW*5`m9;w&8y4HYwH?i*Dh<6 zoh@sufM8rBJ7?#{72-#Yp6u<-8{6tcw=NkF7g&;c(U$~3 znfbBi9i@nmqc4;-RdDq!_^{2Y9IJbmD%ZW?aB0Lk z(5`93x(g4!cxbF53l7>kC@_7&B@+;mq8Q5l29Wyx^5qTo8hk5cFeUwcvRW?++slMW z*bzt-=plom7)-~+pdw2F%BO5Os}&SjLXQ?SpcE~Zp`Wc&D){mM;xUuN;(_-DhN2XV zQ4Gb20V(MOD#!I?s$Fn7V(Ws0ib?Q^GEjh%5t{Bm*a0~^jYB42c`>9!tI0aB(o!9I z-Ogo=`qg6f6;u~B8%Xg`s!3l}W`8+5xjQ+kZ}l25?KRic?&fXZ46*iz0~p6ik_-Kk z#;dH^pG=2f7*wyAB6m0V?yc9+ggAuQXdia{K3l;4C!q6UpGnsfs6@yb-$m>#!DaW* zln-i8CeX+5nKEc zOoMF0#oOdvoSpfj=`fu1kNxnte>4iizCS$~v!BinM#14| zbar~6=P5z2Za0Y1+u{z;nMPJl3s&m^yGv%~eaTw%sfEUH%-)G`th~JbkzQ(a>R`?q zz7QF8%tMjcy9`>xwxZ`!l+%kXqs0t?lSk~Fyn%=wa6a@wOADAB4$J!H7Z@q-d-+3x z<00Gh)KKx_WCaL(_CEAyQkN&Xv6GDLriYNBbBGX)26`$NxN4$ksb!s}w6Z%|*&Z#e zWLvJFRS%$`DGbMmHeDosUJ!N?WuHLXHW^TX0~2|nT_4)@Wg!HejWNlKXmW->Z0kLn z`RiHu929nN5CtF}z@`1@J@aR?G@Rj8hGbb#=I^@nZqHK6yd`+(XJvcNcVH!wv8a{n>(_2IcCioN!+0&<^Qh zX`tbA!MoAUMc8&SbCF?+{Z`0KLaYV%r_Ck<{Dw!q!Z_ZC7k< z6cV?2w{X)gAZ_&3E^zhK4%;RmcjC3}hFCX`ZVlkgocIL3-6ptp;^6Is(00z>3jEC; z;0k7U;RbGoWk|c^%Zw9_CK? zYwdk50c>Qw|Mf%f;D=sD@0ML%oH$}bM|HV?25)uACjUcR*0p%qzTdhNiCui!CAT

bqv4ZpHzJXJBY7xt`;t;c4gkfoL}hoV!(U!^?`FX4fAyxm#hN9 zB4yB6sX(>FtlHJA*w8M`ib%biFrv`rB}^Kq2}9dO<_XwHv!08ZmuqYamd%j+h851@ z;7`t8>eKZCq>smBoib_VbCf3WlEUaOg%X`-Xih18FISM?kHLi=$zedXlewdcWJlj) zv3NUTS7yYn3|#3&t4h^3&B9hz**aP^Iy9PR6N`xoyE3GEFfIhX8CLS{;-xY;l~iZE z!E4u2t_PG$et7-TI~^V!0P|$)*$n+DUwD^b3rm7L%)MvGH4&47&-&viM^)@|XfAa= z+>G;(c)!RTy1#mJb{0;;AYz#CChX|RGjA4s7H)&w5J&rjCIYc4W^4;NKTs^r!&#UP zyc<$vgSr$OQb+`MC#1Q3Z~nNNhc%J;m)pJJu+RQ?e2M=(>>nK7?!l|7`sbtDyly8! zd@9anOv}M@h~TL#PaWkPW*hViw`Yq-6IvgBTSJnq2%ZLoPTPC-`tPsaKS!qopZ>zV zFAK9Eda!%s_RW*}hLa-GGu_P(JZm!yS37y@^z3*8vNY6ix={p8y6%)_pm#x+wp&HhukBvhh&o9&nEK0T@o1z+lJ$8DjRW0{ zN8h|>;)$Dv6L!z{yh%8YeD?I6reQeFCOz+gY}>UG;?z)&-2%F9+R37`+q*W&N^(=@ zxZiGi0VaZX>Mq1v&fw@FXKy3kW*wrlRw9Fz>KP8@{ct6ozfXL&d-V zqOyxZe#6fBhY`CS>?n?#1{rXpP18=9>b7Z2II~er#CF>#C)+qsPqgJnG}zt}aLgaC z<9uzob^P=pGT%BX1YK&KDc!e&@HWe|p`U*9 zRp@o!D}pM8pDuR~mr)P{?|Ko!yMGaaY7%X8AP6$JV@$~rQ)MHX^77?P4;Be#z67$a zf*NTuiFAh6r5_}`G(EvoRAc*PZvjqtxZy>sbsXUzIO&kn=!+ju(j=Oo#z)JYf=FE= zi+I;gT=_HlGAg7~1SF#H3lA6C^Kh9x&?bM8+{td)BtyLoEwGte`JrNCSkc7csBpYZ zN5jGBXfQIK4a$t&^N4TnWaxB#t|ErX>@JFv?Z$(!ar<%BhjDf9H7e8xdo+qsu9A-# z;YuMZ%a#9t!4`bM&*E&#PCD;LMdi!>e+@^C2s_$GHr!`Rq!{nPyjpbc_~h{HP)lM3 zHyuy^(g2opZ_%W*W=q*01S|zl=)hkDbdt&NH2vOy*8QS&pIU2*zIxEo3)r(aqg39& zP2>twbVqf0Om9j|kHEu^GWHBjv2p#A_`F^kcoW{nTrv_)jIy3$nBq$u}sDYdEZNODkr%6N_!dF|t=@ zwo#TP*W8T8M)E_&mMCz!45($Niy#?ecq5MjVsAc3*rTNEDqLK!K?YHlGL_Cp%$?_5 zv4t%b(JTZ->$RHV%l$SeEw*FcfXWa%xCM5LE&El#m*;Q|aCYc&1w0iyoE;7a!$xj! zy8^0>cX0ea4c#q=fb03MlD^B?zq5sQyZ{bexy0@4*Y?=;xnE=+YdrU@N*sd*=Og{o+hwR z2E+HzDY^)76luZK;wlY3W%|3oQ2|nObTlbH3JaTxCF^0kUV+=BkqZ2?CM!vQxz(m3RE|rJSWOC){c+YMM^zoEy_89 zp)|k+%_W!exsvZ!lSihUxQ0_ylei|&wJC^Si!_9?z|xzKAFn+hLYARuttXYp>vSO$ z$dHncwaju@3;J%Q3!x86L#VG*%SH_I55%`|GI_K(d9bE^-n0)*jUFC1puc7mC5MMH z03J?KeRG`Fwx$6tXop;a(Kt?i8~RZ!yVwc(x(7fFVqk1YQ0|0F(OB=90qjm3U_s;F z8zuuJ9y?kWlf7nyDl>MnrkMuZ%(P|#(eB7$!H<~rAzDlVU)(w+;N3XhG#(=Jr zr}L=r)l zYfPB8cr2&alWC;I8wh<^>vwSvZPL8m{Yz@t|APhc+t(n#frbOCLv^uqtW3ljz-yK#01KC8qLd2@Lq(nGmtu zw_{kHe**-o!`O-rHLl2l*=)s5sL)MPr?#C$b?VwqRncXw1$HwsT_koLgqw-%nh`gZ*$qIt3+*O)>7;fsnIrpmk=r>qn+WbDC^y;(8;b7s zwKQxD7qNgNdIPzDPqw*Wps>*vBm+L0A{x+NI>-iPfq*|nS_=d)w`ygeMlsz0x_(dE{PzHB zX6HSeP49<28jQ5K*_~fr83$HRXQP4~l%{2MH^AJavyL^AmekO)FM18FjQlZ`jgbx1 zYH^rV2#du9Y$+a(Od?ke`myMyD!w1)VGL2-Y!%X&CF%?Ex-ruz4IkKJwdXMyb5KMq zzzKNlFF^5}J{JyucsPEMhoc;2&VX2u5?@3&v8FMP%<{Y|-W~jU@gRiv^+Fk-fSdpl zqhw*6fmsT)CfSMs4y$-hXSfQ1h|?-9T$5wHs;ids4j4oE+N)nS=~I*XUbvFLV+#sH zD$uQ(UF$ib1nQv(4X^ZsIwaCd0WKocAM}J77wvSD?ik1#2R`1fb^%n^ z-fdsXzUEz7!H?-sFW}Lu_Xslnjedk(f}DQl3iNy&`@t9bA_cIEY87!3oNfvAl9 z?S0Q1uOW3l_tNn03BqsDLIAm<@dH#FAv9I5I~WD)sI1r!x>JKS=tF}(HmDyOuiz`Qc)rT~O^PSS!iaH3L%`z&RgB76w8y%5GBk?G)u5R4RJkoCU+*>HhjJbYXj7$ZS@G9d(Z$)ZY#D+lszVQ^*5QE+5`6$ zE^Xe>o)({=JmC$w#37T=X>RUMUJ)PRjR9uOY&;; zidC|>8fj)_6gX~DBd5?;LyiX}Lk>0MGAqbkZ2vB}b0VbtA!>`VOqB$!I?I!#HjF+=XM+$@MMOasLKPk?*uq}l{%Y`@_(@M2xz@JCksaN# z2~m41Rmk#4=MH;dg(mt?J36|tot{$gsS?zM#|pPki*uT9F$}FIVsHy+UeH2eDMc-E zphIYF5lzRWu7h3gYg(8C^fk>$6=aiyUB$aW&aUo|4H2%doGM~(WkvbGUqQ*K((OSh zx6rL2$khPhdQ%whzI5Z&4mY`p2LJLu`+H4<-{4)K8^+EKh{(1KVA^}@I56c2S6M(b zbKn5p6s@{wPj9!&_TXr=B3yxG1AHr^G+ABvf;PZ5iOnV?^RIf`^6Q(S(#QPXswl!! zdMhF$NdrqLIWzG-M?UW^pq*m<+-8XcH*z+S@90$gWJrU!)*qOGy?N&x}8$FPRA=u#8pD)_&RF9J{r z<86{C%nPbv;9f(0G#<;pp*uh~n8vD>f&oUOe7&}Y@HEtIZrW$Vd>U<6xNs`a9 zoj6eN$mx?!(UpRg9fTDJPWN1JzWGk74b_Ns%K}}`d26a^1?`rE(;s<61f{xxETQ-| zxVjdw$nY3tufwAQa~EnhynLOIG&U*x|722Bl9~AUToWV=zpug-Low_@ZXi~|WJ(*5 z`-D!S=`_Ry%%ynR&Ggm;g~_Om##=b9`UztRNp7^ZUWwiZuu$vHt4Sk#*NgK)Vw`4q>K1n`OI@V3kG*s8t%MAe(7C%F3s`XjvEZTHc9a zF%;V}XWqBPdG?=D8^q5A{Jf)JfQSvM)XmTy>gIV*RsVjI z)w^=Rc9y_)WX4)2XR*0TX17f*=W~$XB=0qg%}>sI9e56%UknUau~j?~uPL)ugo#U| z@j*++jn2c`P;K52&0J_Y1oLzqfa-E`hdPr6R+O##Lc>xOGh_>@6UVN1tj2(TIyK>~ zD)BK^&d83-!0i)Ht^6oOPoAavoX9HkfMtpoRa4#-@~-p2R3=RiY zGFPzVO452a3sGBPu97+dYG$y-RjF(7O;o6A_E7w&<_Vsv8;G3-dBPq=(j?EVQ(a{C zkp=UcIXu<}aS-D8!aBJ?avf#i8w1mq93Wdba+Li>-qO%@j}dsIS5q9qHd4Gi!24Vz zI>ZVw`ecVS;uoU`(OhKKhG5SRGzi)Vc;TF9@S*?Vxm3bdy(bXZ!7RCpmat{-=8P+K z?1}CAv!qY$`q)kvj0ztFZ+@S63$~gy)MBE383l_HR0L`GMYvPQ@XBSd zG6}{asG6rWS$rv@4NAIodu|xfnAR-v?%FA4LjvyX=n>6 zRnVKLq_#B^<>z^bcXD~DhBef|6r>m@$s+V)g&Iy`O&giUc=7xdg%q+4F+@MIP4KwH zEx{NFn$?OI9E~Pt!Q}jGIvkDHG%eijDPv!jF4(7-L5%L^Tag^mJ3qjb8K9*Au#?+=L&R=DAlS7u(27izd#8hd@HEoFcF4A=!0_bK z!X~uLNDpQ?hGYw^i5E`-)gcpu#Yj6KQbX|(#CfS6k@S9Lha<1UtOOlW8C@Pb36YOD zDrq%@MsNHG3XMM3RA8`29D?WneR*{dPhz0Gx;(o^Nom-48VdEI8c?ZOzDk%Fs|;&M zGicmhqUEN?UuG%>XaK0o?$8ag;hCm_-N5EXt4jru27?QyouDq>dD4B}hOteI1l2Jt zX#s5DnI#c9!)pGRK@8PhMx!@jNwn`{dpC56KA0S%5pQLPIwb8dkJJv0b+DT_&FNm0 zsND9I=(?3Rz3fZ_ZS$UMv%fz_Da1&*axib+hJkq(Vg%{+<}V)nM+(HsctG%diRJE_ zNuh$?$#catQae`PXn`jB&{NMs5#Hc`vd!E|(f zJU%(_&ks(|gTr8S?oUU3nD1VZg;tNG;U%C@Q)fgDEW{%RGx zy^C>0j&BB6mIP7J1?n0|cMHYTDJE57CUhsCs0FSztDk>AV;px80IvpOfD$cCF+>B- z65)5sy(Q|&WaJ{Bkz39F1XIagXFYVIVE+VRnv+oG>0P1OB3*fU7?iJX_p-d~QpyMGN7dQY!-J_}UUNb_EmwA8`4C5sE zM45r}2MA_LMZy7EoRaa3aZ0&j$0B(MQ%uGK63lPwFn!eIjq#&p?cmk%MaR4`&rlZYRu^;nAe`ok22rU)d@*9(WPaaz;=t$Q09BSntJ!dku>2wWdfdH zy#?|w5q}2{p*VS9#Jn%Tc+Z`SBgT8{YTA{n)F_#v1- z-sxS11s!BNQ|@kY6^oP^48aP1;Sj*T@pFJ3!4KhLA&z3nG$QemUp}1`IgxFVWYPB- zPlIH{)I`;kRS;#mW#a0+9<98aJopAsb^9jp|(S zN_>+=O8KG5ICjcTS4JYdewOUKfy0+a$nY~5OTmyA;xb|D$0Bzk%UMsCJfs|~!!Cza z5>d9u&r$f$W85Wc)Ki-8+dZE9=XMVc>)XAM|7M3wEQ57fg=xe@moV)LX$izCp5*8T z*qJO5Pi`6JZy}MG@|&oGC)f2w{9cMtFE!**>Oq=hIG3Eg31+4`E@FWFi16Ak|O9Sw}Mg4&bLsu`HgTMVannQEy49uEbw* zki--IdUbP+LdH+m@8#Vu3q94ty%9U6($z}dsUlmH(npYOPviiTKy1GaV{p@0#n0;) zucUfO>-t7*pBJOl*L<`zZsn%Kgdz5Uozo0E(aLt7$aei`rAuv@phO9E#4)8HrXf%z2{1Q+U7$89J$eR_ANzM)mu5jKH0u{C zw`#Jvi}x4awYY-cQ!JHq$$NNsz-b0aI@^bGb~B8c%=X2l%?GakVen<1FBi`T-VMK` zQN$HyCDA(LyOQB-7IU!xpFi)z{58AC>7|N4iRwsL@`IjfYhD&fw}uMQPfVm%k=W6+ zUmn4dBhLh;ZRGy5ru)3`W6`*D@?!2&HqsLK z_@}oQ?}>wdWApcaqd(+6xf(NiatqtQyI8=JW+H|ZDaBx#K}3!`_%qKvhOnwIl(Vm) zgoyKIJfc_J2*@;;5gm^7vmx8zzj^!bTTbighVu?fw4uKV=LSS$ z-mX~$>UK6GRS-;4-0i|>!NrzHs`IMo{vNBs{2WaqBgS`{J+<>1Z1`OH!KW~{Dp*7l zlZu6ZZ>416eKcy8;)_PnB0pMGEeA&?>L?2_%4$lRCe@1Lx~<9;A>vr^FWTsm0ORiY zaC7CoOD13=0y*hHtrn~5-`@I<>^c$SRSRK(I0s1)CvkRZXirr-qa{C~cG~8fpAr_{pacDJd;1)Cq-DsKqn>zX*;}^06Yr?E;DUY&}`^ zygXq4iB_La`cbfCKZbcQc)nf2u_=snE3Lb2(O|W&nR10h49LJFcu*=qB#6l6O79iK z-ZzugP{%}4RA0QrVc&7dn)ciPh;u|Fg8#Dfy63H;B~og;bb^V@gxXbM=dB{7iD(XD z?b8Ufe{oUPNr?S=;_H6{!PVqLAS}|=lHPU6eXl~VN>OiB%rn;YF7>Y$#jdT~oMnDO z$S5V4FBRX`FJQ|PI@IB|TkebG4rHt6g+-)K!TW+db#DSeah*HCg;J=Z>`uT9#*Cdf zih3ZluPJLpCA%Tdc_=)GsAN=6j7%w%DeZmZSbd=oS(k&k)q zr;`U%0>MD&DhH$T8dXIc7S^#>YFI&Wn|0h`p;OE5)#G5CiCM;ar(XT?Oq(d5NSSRHdgd>OO_dBGiSG$616XY!ivoIfDSS&p6 zh6)||m;prPC0^*+x0gB+&OTW1Xq{;a9$~0_9zyv1?_tSQQo0j01x2iPU(w7gvq@j8 zP}sU^HJA)qMq>>Va~Y-zk^BE`%Q7|LX4_?&w8BiOBu(2wPUaQpWo|QRzha>$>mqh9 zuQw6ETpG#@xJgnsW9v6ry_*vW>;2H0ZXxEvtCm?Hkhs*kA0esa=LECqMn$ z(+uuk*?3Z2705s?_{VleqcMq6OqdlOD$>qsfw3y^V2by`{ftSNSOB0bi1p~ozT)05 zJ@#A>KfQYQ&z|?@ho1K~oWbv)`K-|T8gdE-choz~8)+_9-GSVd5p1#-N5>^CRP?Y? zZx$wl0KEJf_YZ5?4=i~bUxG8auI$dcguSmqaw^gzsSHGWU1F)P+qPg+mUcxM`eu}| zHAV2sF_suE<4rU-CR}|;`c&hL3Y9QcCr1Y1(uci;<9P+a?=KoqTL!iRerp4CM6wvC zUWC{I({3CpF>SNjirP}5aSfvk;JJ5!*++d>yq1 zq0c&)IQk_u@vd$@=&EJ!y=-LK3QS!vTOXn;<7yV;j8;d+C6t;@R}O)0|G)HOf8x8L zvon*HyKja@_j4A?UYLBrOX!mgHHl@CcoyaB2|1>NPZs=AMdH7`TQH^HvY-2>hl7*R z(b?e;oSIn&_~X&>;COg^K05RMuwz<<#8MZ|66fNCOUtUHemP9;(9ye&S0|P&@Z1jenwW1Etg} zFFPS)8K7ngy6}&=PY>x%0Ro(Wwf^VTHJ>boSr!ZLGvq~mV6QYra14gv2OE`Zz#l85 zK0g{B4Xs30@zcS{q};n3xfR5^(KHQb4A1TtKDD>q_dj3@%XQ!X`%C*~slwDAmzoi} z;ZwI5SDZQ>tsI|*6P8b}yX*hH4##2OgvgFpeWmwC2z0;bp~!Nh3IQ-D8|u@0!)K{P zP|uW}w6CBye9=yaWiI*eU!*g9gZca4t;0CU?k>Pn+m3w|z_vayO4n|9|0tH#jCEVN zEs1eUv8^|v0v1PfNn@l(Pm7{aRn)juin79F#fFHOvLQo>sxlc9g$ZtF)TQL(;+25U>5x_<_=PNt6CRJ>u~1huV`Pa1N`5@z$lj0_&g9Ka5OPS zagZ$4P|kKHMv?4-TNi7B8Na+f*U{n0<1QIP@@U z@up~qlh;JY>r&e`PF{(Gm*19tU|lMF*Q8*)cxjoBC;3Wv$~>O44AoUod+Ky}bbvL9 z*RvU>*L~q#LY}iE$itk;BH;2FWj*h#KaO%t*7F>iOOqn!?uW$tWxZNa_{Xo_oUz{| z3?hanZ^E{Do66ej{v7YZOiXg&(FST=m%-K+!j_WaBnl8a{+uKd&&vXeJ| zT+PFpR`r+Lz2UIW{&#$d|2^y<98zYH>YtBp_kK0=1V?(yCnoP@;*}L-bx)Ce|L>QJ z{_A1?{MUaU{PC=>{PO(Y$Gt!PqjVbDN!_@U8t)yGy@=edwU1#nOCvTwmf^W2DHs$Y z)(ZhwWH6x?^Kh{eNlQd3lW1DRz)RO>>68p}EHQ)!SV1b>rCJZN#i?RsE;&3d&Y3_x~RbJ1tafc}^ZoW6O$WEhbZOCt=c#;jK>?OB&w30o^ z`n;7!%((IBoA*p80n%{7Xx#HA;Wz?4!!!-UaRwPaDG_I_#1%C(IEMpT(LvZ2l5~lJ;)*R3WYZ=}%61Oa z6m9vj4o3fkiL&eQI?mUY+saSbCo5%DC_3ySwflCE-)5;zq%eh?t7I^Qo&U&FS>5wt z?zxavfAA*N6)=%M@f1_rI8FQshDowV1w`xN6&;0HQJ9-;z{h0$4OTm0C}d-y@t-FF zgd|-&v@!NXUORewsPZ4TSU?XoAa3AYFG2`qU$EE7Izy)bp4CJYafz~wJ!5dn%a=Dj zSS0utB#@yR9x6O9Rh7Ni%Ydk<%eBW=vHr5xQ(CR#2>-xIh#W^>{CJWk(WIVJuSU#n zTxtxecj3^VF^*LspCV)tm0x(c*q(<=WxUE3Dmj(i%n3&J@kP3EuBD{2%Dm>9&b58z zcmt1ygVE7oWIZ!BtJZ8Q)7gRHh?9?p+p5#a2T>5ct^JFS!X^FL>qorO?1EdWoYQD297nUHADr=ii;ClbmabUiC>U-ZR z^_%jI$eb0`gd@i2%{@cx-d@ESY|m<1-ZRs^+X}6 zb8RV$iG4wpdGsb?b4rs`aXBz2Qn3=|X(8aEPI*p^j;~zRMRkfQDwIcLoWWs7T))}(ATOaz6Dk-Ee+VlkA0L`mn% zP=dBokxiMCm+_D~WX4_@F(ep)Ck2z_)+=#VDw#l(_5*(v-Pw+2rEQ5 zrUES@Z%*K+>7yq&&zC98m7DGJ2r3fKI$jHBPy=v*b@*7(47GR8e9l-hYCCm!a*0}Og`^D(UDY8P z(#URtqjkD)MiI2t@X`-&1q8tHg2(w8(jISomJQIxN3gJ0E0CRW>3RkVe45X}kE(&C z3-fJu#A!yczl1EXHewHh!d4*gG~umiso$sg4Gi2xVmO}{PG+~E{|T#{EWqWka&vrI zkHbF6Fn08oAn0hpmi_I!y4_+Lv8)>W8xdV1LCQX8ox1hfIvvCZ9xCHnN0KKc_y zC~k^|87~dNlkUpttL{PHFo;JlQ1?Firsu)02lVR!|Mif5J^bcZJN0xc>_$YxNR1w6 z?J?m_HV3&(lFLmn6V15<=_CIY5_vP8JIiX75n2dqc9>gWbJYTycF#tSD%sQttPO{y zjZM&tXCP#(q00>{T^P;#U+mg|BsACn!KPIHrE1S zthe{f&)9<+EMgMI_ZUs9-T=@LJPOw_7}lOU^T2A)o!V{vHn)IUou8+6Aq#&TF5H=d zn%fUUZ1WY*K?&m~TT~9x>hx<|y8BjjdTL3!IJ~v&XNa20o(q;K#x ztBv9IINR2lxbjoTE@QL;Y4J^+jFurZW27DvDJKG4>e2C(EY3xKCSnGFN`?vF8?U29 z-UkUcNk1*XgF#M*HJW#pi|$ zQ5nkeV%jFc+p$kOzOgdQ)P0Zgs)~*z*#<3Ki7?%CV>%(!fX5H&JAuEM$*4#*%04Ok zC{C7agJ8R4J()s=zVz|A?jcJ(?6}^Ar;GAt+RC!r?P01qyli?>*R0d`r%WLG%u9|M zl;IV{d}S`3a=!Y|uFD>38)0e*;}oPkG#!&`me%G1S-$=F5m3fW464Doa%zwbKMTbi z5I_KKU?`-@BA%5&?a-}2;J4S=k^cU+*;A0J91v)rWM$mEf$a*=euHX~#QF1FR-cjRNMSI3w= z&dn!9S?{Bs6cx%fl%y!_V03|}ZCPB?n%!7ANy@NjPLj-Yesnj`RyM0O;^iv^y6i5# zWk*3Qme`fA9?CL;dzyP}3jrYw zaUfqc{A0IKA3F@~utaqHZy?8?JCGyW?W^|bf;8;08BZFLvCBw|ErnYcW&Nxo;b+nT z)gLctiwkC?ivSao@qT_@^|aM_Qljf&y&L%Rsa?>&&)j^?2E6kj-=W&6_$zh=jOEGd zPM~}0FS78D?RagLo+a|@jr518KTV)oGK01`!>K9Fsh!Um+G|jOB1VOj#=j<&%pVeOSw_7zLA5vd*P^y~@K$!0D&K zJc1f;>r{Jb@OJ%DJ573CYUZiUs(bXy*~#5Wy%?+(l8%mzl_4zkdrk1_&NBfasQV{2 zKT&}!Y-n>5<#&vhCGZx70jfSp1-A)+ZeyinHfCTH#U`WNyLod#R*IPFF2c1~bgj_l z@ML;4Jq^#!CzF%WczAwxHXa>>;cz${pP!wdoSdDUo{omW#7Mm|Zn}}LHinsg-<1$# zNa(1eVK5JaPuY5DBcE)e$&JE48EJx=GzM2Rjr8fiPtL}N2j>%?q4h94JQ|*#2d9%W ze{vj*&x7-$p%KF>R9!sclUe)u&O=W2CM_qk<3AP&wwPQu zOZ_E=FfIIewnpd3gm1456KC$Ttr5X}x*tOFtq3$ z?=B0HmGyMz4g1tkmq>AfI}F z40zW>WtA~(<-)hIJO@gI69+1UI)egcXMUK6u^zHP6Dny?7lefk#se2f1S%%%O;*Cg zB4RJv%*uTg8{xE~Q?(rJ`{4c*2=FU19d32|GLO}%4(#C@hk74sOSWKj}P*r+( z7#dOV1Zq7Ee9p={ps>QQ;ZS899R_Rq z@!9p|b8i{uKDgb~luHhJrAC#~%j+LY>KQNh(^;5HR~6WgH5HRizx2eaC1<#``-;8u z$q~bVH1XAt>^{a)PUOjuqO5Ac{^lZ`%#?hko$x>h7DI^z%lf+s!PK@ zG_l+e60V9Wv>k>|28V<5li_eMIz1X4>rh>Sw4>KfWeCf)k|vPl+V1JWfSM(D(GqgX z-_04`3<#VheQMOlMjBnS2Ok9DzE28881>80S<<_{BmpPcB% z+Yh{pnEy;e^PI{e26@Ulhv|w*gt<44Vn2<-3_Z#`e+qt@X-Kq^o@WUPQ{ep4r-F}p z>c^S9|1vfUCIk=GX$m?RdieABq&a$lE|V0?3rV#)0!9W}o)g_)fEhcVFO?hyivX?0 z0yEj;a-8tKP)*5KIPah`X z6l&fV&Fgr)nM3F(rg?!DayOtuH|WB0CC-YiL+pM#Dl1TyUWr9cIY(sI2Q#C7ljYRk zmYOAf_S3e=XI(4=_=%m2J{&C|819rBD(G9GNM%4vuC#5f(Lf?lJgim*tvXUfw$SW= z5ThpYbRAM1VE)F(;s$K~uz2lYA|iJFvHzc-mk?bQnJ0$Fdu%*iX8}4(!|q1^22@Hx zsSD*}X=oD#Rk)joqqeoV|Abs?p{~=gfI5tV0^=lEgnlfDz=&j#PQ=$Hu|#`?a5)3p z_4@#zDs`~G{P_isx1pcL)Cd@e%Lfk+4+BX27(U_)YJa>)X8ZX(4gDM<*Ftzb?jH&W4ALTqOI7_EDN_0gl!!6my&EnHJ0p=ovn{cDs)NIsQJ1cjV5Qo?mP&V~@ZnpnTdDGCM9M8tYf~xn$wkc0Bvdl6FG6F{c1AnVkknkZ zBBgM$Z=kQexxTo1|8a2nk4qh$H1KxKI;9)PL9MtQo$V^LT>kuH)4k7bl6mM)c>QdQ z8K!KeJVY3-Th=BE0}2iXk${G-N&_M;9M+RzLM?H*llClKgZkg#^-BUc#7_9ijc%0~ z*}QSYeNMueA3W}3m}bU)3-jUmejYNZ5qz)jR{knXv;7AqOt61HMa55dAT91=T(nkj zJUyIFM`!2blfz(gG7b+^x$}OdhQ>dO%9JvPmV|Dr&=9qL4Ypq31M6Lpe-S7 zd}Xe20E}g-fOQ;bx{rV7>b6CqT>x;sCwd57Om1D#uA`aG7RkUh-kK{ zoXE$qVrQ_4JfRz8L*Y+_Stl6CDJ?RA#GlE7?$Q%v#Fv0REkbRwuGKy&V_2+KCb$}Q z^bY7}JA=*=rj1^5~I7%FaZbt45RU642Yjt?7eAN6rkeJ){ z%fM-WZYuMe2HK{$@4RV0M`^xxO~d0#X(X(LI~V_YHT9jg{x2vXjGd|ctsxGn*C~NydrzP z+JXNGJ2l5WZo&Dg@cp{<-k?})@c!bkZV>k9iN#e?Gr{vnre_M0G!4wHK>s~4-&af!zn*X*A(??8jn0oBpCKLkWb?_+!H%@=S&cO__;zF#^5?tEk z`n(5>HW7~~Mrh<0Wz%`@P&FVsEQvQL+ZhkZ1K6{5wu*u%S!bAZ{c}_+b$(shU%Z0^a4GYXjUrQwz581e2|I{d;2m9^j<-l5Jh z-;qU}T*_AH@(Wh~g8D#ku2QJw{!Q1RE1e1ejJ4Z}CL3eE^{TWE0{WG}PmHQ}`s|7Z z{PRxwe2cJam0-T6?aKZqn($t<^ZeCnAr4V?GOwpTx^Sbi$1l9@sZ8JiWfQsvqH-qA zixq6@Z$I2%;`A!fgJd~?nZm)BRWQKPk*++TV6Nkfzcj$cT;huNmYb8^dilD|=HwkZ zq*@5VG^b$p(4$exOd_szCY8?MBnr~URSse0t2vW6!!(6*V^Ww?M`L$FG{F*TDL5Ii z1DlWUy$!+czm8?vBH@2j?;`5aDC0ty>pI4G{(4;D@tGgdQ zeE8_hToQ?07)y5En5nwZtSy7BQKM@%-Wk}8x|wu$H}tur7ssT2beVUHvT#^H`y!v! z?i+IA>^T!w#~KCYJ~t8))U1nG8zYO41FSvXr+;ICPTC zUZvW>@L<#*!v8*w4ql9gFAj(Qbf%vQrJYu4%Z;h^vskm^a_i|F4C{d_D{QrGc@NE5 z3Yok~g{WShx(hLw`%%oc?oV)glAW~ZW@;~9&S0fPnGYQBkSmJEJ+}yA@f$VEAU@O* z@c%`_AwIA})&}onLTqs>b(HoM%-A`jXt((x-WKOA<$e@zT5t!ocYSeT8hN(h9M#dv zD}~Y(0b9=?a~e;v1rD5KIffSudS29pGT&YDYC~MPFnf@)Xtkrq+(rm%CjFAVpeA>V zC~lCjuw5V9)k*z&y}-~g5**x5083nBYvL{gTcE0M<8IVSDv>>Nug{k8%_eurQdYsu3-)s#uQZ0nFhFSBn3M zAY(&gmL3 znvkWmGg&B|u+<7`L;QvUzC#uO1({n)2N26W_`eAO{t^iR%nY-$%m7ZCp)I>P9r+Cj z1a#YBhnWQQfNhvkpw&sUt#kw0l{iF@X%YT}2?$)^-gzbhCyH%11m3ppCeKkD&Av+B z0@uYnNdf~WV(u`xK^Ym=EC*#m{sq$=7}mOJ-UBBR?jk3GvK|Uh8u;VLng&ZDA@%69 z9+s?FKb4bV!QFYGI4*ogiaLzenfg$R_~N^(=XT6%AnhhN=m+Y!!8)(ANrK=|222>s z97#fLH5qFu2n|1LAFxe0mjidlwj81xo*S3oh)#GBJ7N=?YE5&#M`w@%2Or)AnPS}T zxD+FFLuKOv98n3^$m1%B?0&2YLX{3i9xd8*V$|{!t%D7;qin>m4ePO9s~j2%>}z>C zQzy#-eY-dOGP>PE!9XlX!j?H9y8_roEL|U~8`>R~<;dPi#?}$JqC128P^ZgiybJ_i zyoIu6-iI4E)Dv)LXY^T%~a*I zxZS6$+Obk`bISjJ_TGfKaok!1{VOcjt=H{bN#5Odr*75r^pbIe)f|TTKe3zNAi0v!@4i3)wPz%JO33};>ENazW86=BNo*9$H z#D`^ov)E1XYTy>*j;15G7zREVUHRL#QtVS<(^HpzKmIKhk?lh`&P*{g1@jvtf0*iH ztj3C{9Na=^5weAj;U?V(vzj^s%e8X#C^~h6TN#|r^7ga#oCoqRt(UGomo`KI!F0<3 zTu?zv{;Eb7f#Ok(bmMLf0ZsOBGklSWlNGs8rEydM8CCYbDnz4hT&#yXG7+KhPQuBA zd$HrEf{@#8MkeVx=0rwdS@sXgvVtSJQ}B3jVdCgHwAGL&9Xa z<8kE0_Qr-p3zPLM)L-Iii7K`tDGYEapkP{KOPU=f;@U}|)$-l|)>b*Z7K{5mLa{Bz za@(c-k`kbrSuDye;0d4>?%NZ*%a5IG&<%Vp4zMGu4b3d&>ZTQyP0~o< zA2#={s$7}-@>4Ej0@rxEpa8w)PCyn}^=`_n#%~^YEeC`8xZI!;lLXNxv{YD!=qkfY zZ0+|q_xjsAr<(_FH}~G|><$k0cB&yJM2GdMPC>(4VGZM}PWuWHKe=l_Zs9^^u$Er} z|F<*;DJ7px&Y_MP@4xwiJf3?aPF@#idh|3v9H!C8>k*t@j5*$d#T4&&dqrsV!oHxX zg!wz1(<3|XXXqHe{Br!hhfw@8=vuz!`X~4??qM*1tL~?%r<6#V-YFy*LXiq*^Dv+s za{`gcsCx&y5xpHj29tm-h1zL}GZd?gS=KO$Ii@Z8aQaC?XXYpVC1x>wJ$~;XN-p8= z-g=no9_Ju!T*g8dAXl;DyyXtXU19L9>a_J$ZI^;K9ePx@PZu*A0d+rYH# z-NUWzHwSO}+xv&`*WvEwE*NQhTZeo5Zw~hRTbrAkEd?dXYmesF1|0VWO;e>ZQU+>BQO|Q!~YUIkW!W&#WfxS;Ya?dUh=NfXja% zu+e}OZ{W|{Ob_@2EBCo_-!~zz9)Fcrek#C@N;|KQzuxSk9>Tx(*9X>eD37?-OlpCi z$}Q#?UN!n0pZ&QNiyLncD!5y5nSjd+mEw#hsR;a23=QIfBSzu;N;xHBgY@3QfB4C3 zZ*b|v^tj}Bz30FVHO7C=dd_t^^rl|Ya}xL$Mi}FN;hEE&_V8{G_EqmJ_ze5tTSq&% z(h+ouohJ^>b>@c{i{waaK`(IcVQ8iM~HVLOxxr6>Z=P*(&)#cUOltT((vPJ}S2`Qm8^(8-*(26r}}?R)CE;2msAk%lWAW z+A%3?yohsQ0m@oRqSbkpWwB(Rjy8@b>B;dig_+T^tr@A;DRWW>a8b|6(erfyy$6VM zk(`&R5eK@QPQhrEMsW5GvjBX0sm{YR%`8$(wCu$U5+lceXpPRXz{b9E2{|%?uQ&cE z+Y&JRB?_lgI*D=z`m=~}GN#PMG5!~HTQuT&2GU|sb{wBZ)j)2+M@|q1I@45Lb|s@j z)5H|9Wr?TrVmzzd(OcSdJuZi4s zwDfKxpOMsyiHw23?nG)hzOfx zHAf5jTEFt;%XZ&?I!}W}6eFFqRtsR&^TuLy3%`9ff)gW)^)hm2$_oXW=uh2} zYtPy&>9AOKF-Y#)cV|+99BW&x%X1f>mFwUZ;fgQbkr(eswJtp;Cy5|#-hPVAjgv#! zAjPRD4`|u>{KobnlF?UDaz>(lic*2GQ8rsm;JPO0X&m<;mD0kq0fezAVC84|ZdeAM$g(HqxkU03uQu*C-`Vqt`Nd1kb2mPhTbr%$v0mSe``VUR zvY)}05*Jj)*V*ZhKP8LVByK)yb3z+y~OpW0eAt2Y+$0k&|4R;%Ov2Bst4#t*&Z*2A~TZ$n35 zIgq&yZCv8@b2y^d?16*fYZs*q!wZm-nJrq8*Cm~hvdT$ENN(Nv@~x>SbF^q(Po}uB z^|Rm@S1@-ha4wLGapp_L3v}3%Dt% z?P)yvmdh`42wv6l)arshc5h_DR~y@isy*0QpfKp?dKl2jY-Jhg(pmCxpfsi@c^+UY z+8zj)t&jRdkSFZv9tku$I%xg_9tw&BU+t-&(AzUQ7PRuDKfDY5srk<1bS@(nrZU~T z%}S_Mm&xc4U-C_$1AQB)PL@E|xWvBzp9F~E5Fb5VEZ{xgi)$fl3A z`&_%vwaxnleRCL(Hk;3U)*44X#v{3L9FBa7y;9ISQiP|5!2VaUXcdpJGe1!6%Lx1I zVR^(-o+1F|Y)GJ#oG?C4N4((Ei%%1G=1+Y$Qb~2%vIBcTI=aHM;TcNvWb|yG9JmsdAc_a@2Qiwa*|w3w<=#T5SJB z9jufQOQywLT4|6d;O?qPwJTIpQyt|pAfJkiEoA*H#T@FC{ZTmB=5CaztW+iE;4B40 z=rF;y9Y0}^gP9j$z~CI;di4`f)-X%L;4We5N;rFf!v7`|b|^+ePC8luV8wzTKwp{G z_>Vj|ohkt|grS7D?w#61v!=%W1hf>@9YYG;S;*-lvw~J`b<;}8{B~L?Ypq5rHTJa7 z%C=|QM}4Y&`sdm9C)o!)!`|2F^%}GwLgw^N3mHJ$4B`}h(*sg5F_WI@F2A}!k zo9&@T&)u)(uf_0J&NWRL9UDz1dg7H@uhgQOJ~do}8VY6nC=3W{`vzaTz+2NH;xfXK za^Spk=Siy4mR%LkJSn5RO2IBk@)O zN-(78FDDE;=%}@GNr~-ipzSASng=K}JN@Nb1D^L35SD`o&VG-~Wl09_c4*8u6Y736| zWC>`UD9{;-H9-WQLEeeHUOY$bys6d;Nq^&{(o5DOh*$BWek;xeFf_p~^R?*j7k0VK ztfvdRT%x5JcDW?}7uaQMO?gtV%em3pLW}0K;{{r@K_`|8En3;|bA%Q(2Nqf@=1a=@ z?>c3@LVKQga(bRBt20r4QascFscPUWIW1Lm_Pj6+b41$2rsfpk9-~st1ARsTCzu!=+x?wLp-m0dvCmnQEm$Gav{1*&?7YuUJdsg41sDMK7I^= z+?ZQo2;`LDAu$9RNLYQ$+3x^D0JC8Rv+-V?LSUIbmMM$=r}ul5P*Z)%Qyp|WVvCw~ zT*AI`EXob9kqz;cyVb}CDrDI6emvT;;e@Q-ffcf9M_%MdXv2){y?q;YU@;>@;DaSg zL=)YZA}V)hOKzMtjM+KZwP6evGcpD~STaU5(Ty>pa(Bk$#%aTty{&B<#$YicW8i}& zV?-0(7$YioXH0IK&5Vi1o;Po13>Pyn=H&f{4_~bqqnhZ#7*)9|V+!MJWK1%J7Mj>X zg$zc=r;{ITSR$);V2G^RksbLF)-l5}Yv(0V=Ot0+ktgabGdE}Txi@~ebm%N-(vTty z71Q9FVkCn(oMA!eVVdB7y*~c3t}wDV22f9?R|6tHsym;1ZlsRH<={KMr|3DiSN`a# z81zT#dy7C0^s^WM3?&i~c|5r4^^|F=muc95kkpA24OcOKI2hg~UVI*3`@o^`3WVCH z4*IeKgNOqL4nfMWEc|-{8$(Q;O$luzhBX2f4#M{#2!rDYTRvo~X^;9;mzd%+B{=3B`}t5=U^RX4&)pHQhc7VPSo zE&4GtTT?My!$U?3p?LFGu+WF(ba7t8N+HMZ2$$a^MU269p@M=XT!KK3+KVk4XgjfG z_3FiTKeW~mjA_8-!G>h`v+hs{ouuk<4xeefV)(LEErS%g%`vrS-5Ds z!ql5m!Uh?=5}=glS1gbV;TUri$LWlQ5=;EU&tFb44uV@nGfLs^aD%sKb+dIQ=PR9R z7*LU|c%}ofwa~nFv6u{ykQdO1PMC#A;PGdaMll6M+)&g~&xu0@F5)`}0)oTv4{R0> zCFFm0#wii6wLhkXB=!hTO6H)bgPOoO!gFcujF8f5(tG74x3L2)1l$OEg?)w?)5R(; zWxEoM#eT$kruwOf?Zl!obU^LYdBu~fe?8w#wAsj^qF((T)q2=<+l@Yi6`JR|RH}{i zYU=oGg!?GYB1Nm1NCiN%$ivw;5-Wt5t-}-}Kj7r@FI*I6KCUFkvK~4G#8QG)Z}hc^ zn0ez)Q^Hhrr?>81?EK4%LR*b!aTchk)d`;IztOz4q9oL{^VYJh++LMjW8mJoJjDGS4ndBihMQcd>&F@wDX1i8_-pT zwmBZF%}E%4v?IJiZ__KH@>Lun-sdaXQvDhtNbC}OoYij7lm&U!fB zLAU4Ra;7p%J8xj)`2l}VbnS#os?j<1^l1V|a3_n3@{V(k81A9w= zZpI0S0`?OFmyw6UbByxjT1+>P(AvqeMx{aj|h;wUs5^!84R2%zP112>MjMg5B-Kau6 z)j&t?bd*kA;WYy8#CNk{DC!cLD2HZxlmwff_XN^-;{p|!5BqmKy8PqyRg%o(w;LOm z&`ml-K+X+s>c)vb+DO0{2-8^z|LYdRD)07CfvQ>cNDvQ3Qc zm@6=F5DkO3%Gi<3(>^|&r16N-GjPS3xYL*#2J;{dw2!%_Efhc}p-HxS*{-70Z{;$E zR8U$brq1ESG_^AF+E{p%8|+gw+2lJO@f}R1yBSR^P&*ZOpczo(-L3J#Xnc4u+1wm% zZ|-`B2b-IRhX>whaz(Yj&i#(NsKU_3vj80~KT%}fU!S(t?Fh+ZP#l$3CoPif7#-&=3YCV%>jYSt| z(T**H2aC)^QzI)~b#>w_r&MF+U4i`-X?H>cq>j+uu8@jt_`CoTLaB|eJgz08*_u=1 zm|xw+n5}*u^B8P-E9>>Co*k2A9lFY}=5~IBIo+lk7JJn$wX{s;mx;60>Q+{Q62P(z zgtm*#qFaAeL-)7qcUggMIJ>azY!TJkOcqgv)k!6Uifd0j9Q-1u)))2y)JbW|)2x?Z zp`~R`tA*ImBvn5CTgXuq{9QUs1RbWw$~@;UelQMiW9RD!EFhVr`%-pBqsi9c-f(~0 zJ=}hCINBL)9lDdP&4bO|!#CcjNn10{ciC;T+7IkQX|h}%?v0AoJxj4dNPuoHO(4Q> zkTkwd%f)_=@6zfFdb%&tYE(48MXL$>6bu4zxRt!-NK;}OUS87E z%hBCDLEC>0Cp*WBB8;3?R;S(?Y$^U2)6_9ZJWAt4w(orM@Q|1W^Kedai(?tKQLZBP zU%g$7Mooj!l?O&l35EH?w{Ks*o&WOr^xH2dryt&*fBW*~w5`S|UUtzoRe51e>ms_2 zTF1fI=S^qD3f<${l~{8k(mT+gbg>0tAQa^HlaB~vu=+Uf!U&GML~~mK>g2SC{3}*p zSdbPRXfLzGb7!447pz#lv*6cdY%kOf%wpa@ID1KLDx4&jblz1y{QTqp{_WtWgQH(t zYKCN5N3@Zw_ENSHYhHKM5H!gXU|I(qQB})Y@}6*0@nRZLZo*biQ1OZ`S%S zgVWsj9J8LS^ni-@sd!obA5+3AqB4|7Ekb(uxsW{clOM>0D+~8CFAE4Gn|W9HmZ9uV z?ChY{z0*#AN@%=}az{6-kjBXcFC+|2E_Odr99(xlr@e@qle`6)-gGi>qtTU*qQa@s ztcOsgpQ~cNs>b2z#pLq&;nTm&V)m1|r{tolKzf(p9t-nHB~i z5{8i~=kVQ&EX9Bo`dq=VAs{+R?ERKfE+Ia;S;6^Fev*I%{~;LrZeSw-ZJgcMpKqWW z^Xtj8Uw=^W0 zlOb)%WKpM2b;_Ln@I4`*jWHi+)B~|9WQTIPVN3E77g4kZ&M{wc$(s>BA){rO!e)i% zUJjeU%<7y+t#alCnhG|d_!hL#y)GGl^q9F00kph3V(@@HE=EL$F^Ta9${tV z8=PI>z*A3=#B4E?k-?iCtLaiAX{=da-&x?Ip+0!Lq6eiUTi_QreI%OwB+H+d&YgPS zo`*5#RWH^rFEN;n(dtGpf<)Z#t$n#pK6@3zI`d^*wjZeH8{O<;G_ohREpo>9Emqn{ zxPx{-f~KWu0-!z5L^nEXx@=-%+PJBa(lAmr_|vkZzrpR(8E9wm-9nxv@lSd6IGzqR zsZ!AJ%V4f=I{L-nIPQ;Bf;^-MM@P%d3IUqtO+I<0C=(6&7 z%yZ1rXw0UG$T@Jo8|}mayw zYQ;Pbc9pX36{K2;eg3sy>9S7D9SNM~u;zMn;Y2FLgD$;*lL3!vJ?gylOk{3V5pPRV zn?E=&+!|WPT;EDmT+347iO~6PZj(AehuCU^p#9KX;Z<(kD4I5{3gC)rN1p~ZS*qp0 z-608@X=ipb;V=(zMFUBO!lK!+tWS~}b`eRX&La;VfOeH41g$KP3`px$Eg67{r>Z#L zpxyOSx35#v(n#V{MYw6{?zwa*Ovu(6>*s5bozD0C!g^P{PSA}frmL;FoH!oG#3eGE zh!933ImM9*#*Ok%^nWO=7#S9Kc=1HaoPUi5=jt=|h>($~=0yIHtAj+j@3J@gFuJ|F zJoL-e?XJNFHxCmNws8ik_Sjy4H$qhcj^K$ZHF;QGeKUOI#S&*DOrg^HW@s*_oFchW z->mG*nUYvSvjTzW;=fHKoLa_KC?P8Y`?CX$xQR$?Z588H#}}w?Y$t2R)Zv#Zm5hp~ zM$4ra9qmO0kvFzv`Nz-Iaq&7MUxzl_H#>7v$`_;Rzs)ELKtJXVur(2>B1HU0OrG{T z=BQKoZnKaEWR=@8SE!iBcN=xAbx@yhREWU{XrfZsZh!wVT~93g`Z?A1b~|-=+`2m5 zTuoo^>f4nfeuzA3|c2xD0o1m{BrSkYa00#5TvPl9wP%3hJjGvb>3EFz3b(Tyv{qhBzG$EkWT zJ1<#@o$g>dQu2rV{jm=4g*@7*4u5!yh36k-14Iyuv^g@v00sCEWR*p?xL4s5DR2?L zqb{^%2lKiA531#gWdQpRs=a?F_B{6d52-!A_z$TS#+wa_yK2QFk{jY&q*8OVDiVf6 zW+xIk<)j-(7{=VDd^{j7g0?4*N<^ZXGWTlgY-Q)m!oj=lTEk|yYF-^LoH`P=h-DW1Lge zNkd}O45A={7NnOsPaV&o=Pz%(ZBtsR$N1 z+~;rgYdE$rg2NRM7tS>)23=rquNdkS)zGL7i)PRq!zP+~aE@lxwk3a5^-DQcx?1b( zQq^q1YNt0J6K*(Oc~>AYR9(>??<$*QbYbZAdL2{>rsjl^rV#&MAXbr~$Fp)}dt=*b z&}!bZoT)Q(l1=|_bKtbvRg_b|0eqb)o>~Jh74&|+0d6vMPD@{1Y#d5~yov zj*H?tTEoc?bp_=?8r&Us#+QJ_$)VGBoLIp|yR>Vk` zCK_0~)O;Kq8kR7zJ@i!kB>p_+hVY(^v&WBsik9QXwnMrrGsG+>;De1hu7Sz)fEOCK zufT`K5&*%w_oVDIhD)~my2A#rpaeIysFi;3XF<%OzE5fG_1{*530yKO2>rKv(^4RB zL$WR0aWyDL623V!++HNpGY`_uOj0`t{`#Fn(_*yJ?(5An-yZQ=kb6{T7wm-~u6N%R4Af;?GTdRFf(}^0-YkM<8OMAVq zI`QSVQfMu$Vm$0R9klvp}BV`!p(d8&O3b+>gXmP20S8Oo%XOOE^wgBqaCu>QWm zy(Jn?3T7zC>o3{8&7H3I5A1b>j9~dM*>#dLG?qe4QN7yW)6U z^*_GcZbwhz*b~+-l*Dn!K3!PoE#UpS>ux;jB6D1sn{dE>`{WZ)S2D`91khRr|FbrW zt5e7u1y$8ZBI_+U$i@ivHA;$y>|gn7uSZ0Yb`c)1ObY{*seZ9Jo^WlQ;+6xDqM`Ct zZDlp4><#K7nN|Ec+C*QSCx_6oR4(`crL*xYUlV#OBx9ROlOn7XOJ&3ai~GsY6t|qx~HT9d4~Xyp&j$$5MO90x`AC(zAFZ; zDo?mi1ZSgF>P0eNXz*5pxBXY-Qcu=dKzP)0OCA*l@($j3Wh?3g@9cnDCT4QBNqnu4 z7~O)?Syipz3jg|hUe!>5;{z~S31`h|TTdJgapx3X03=1A(RIcCJ8A0k!*pIm?&30s zd%WaI@D0onGUQh>RU*;h0;(kwm}RH zv23_;64&qe020Eph1UnuQBE%nV|X}jMPXrI;JfQ#9t;COt4ODX6at^b;mMLG2#Lye z1-zf`==_|#;uk(6mlb{V%^^A=+Ys1kM5c0Jy!ImQd!^9h@&?gRI!|%eF{8kY>1|U)(w8>~d^I$7S^;cD{!7io zXMR?aU6C~NuVUg{+u6dkY+u@5Y5b)T6Jt+D%{(P(iqVq3K;S?aYS`cD%kv8N@hYgd zGg)fi>1z#qZe3`jdmy&uWWT0ersW?~0qH<>?_Q^9#o?^3)pSB~uX}Cb!onkKt0ovw z3FS!tYj;x10{N>$Y+^-xwg}U9v`hoJ=K*!&=M%AjMWD&DDs+; zjLV>(-Zr3Q*Eg6^X!pertJQM5oj72><@2ybu_sg(HVE6=-X4f2xbNcTa zMD?(pAEowql(Dw9v%Rvlwzc_lP-vA`#V@qtba-aU`pMHKX}VCb*TT8Zzq*NeQ9a&pdob% z93n?|C0<9PGAqjYG)-$qE&y)K>-wXrtwyzT1N1^gt`{4_p9{zLc>@mZfn9divXqXk zIcd|I(3#wBW@jAUAoGlRIrzEBVSx;Yl<;og%lG@1v&xH#1m~R%%b-`+%&|nzbqHD- z334QfqIe}Eaxg^uvwB8R{H2uX!`VGh_QyQRI8wIS6Y354!EM@gG&aHGSXLCbI=ixFpSM`8&Ro9CDog`7<1SQd;Dx=hB zNC?N9Y%b;$XJ*z!7$N%kq!U|{Rh&Q?G_U_<#CAdFG;K!L(&cg-k&U9=zYvI#g0D#x z3rYrEwjx;=<9WzWv4FgkP5)LQd-!4Mo= ziGRq0yDB`E5^7(Gd)u#m3%jnr=OVNLK5{u`6B$PzU8NK3@l1k8z}xBjdUm+ua;c6@ zg~vnGV}1XC57T>XTXkWy#DvIA)bv5|R%lm61Jsk41`h6Jm##}5>7Jpl_Kz=D*U-M< zt*d%{hf1cqH{FB9UCjb`J)GS18>nS!qP{Q5!InaL4Tlw$mb$Auie3Zij60wX^w#tD zaLWovzli&J6$6VbEsSLx!2ud(ryeQ>&8eRg?$t(FP(LW>B?yV$Z%KTfC)~&dlJq(h z$fU(%?7xSjpR6`z`$77?6*$?lw6&#c^Qs=r-!HnFnY`{Q%lE2N% zdTf37`nszAW@9k-da<|qnCj2`e*Px>bZP5s-`Lq++u+*V@N=r$*;(J*Y)S|wDb|1) zRw;_EFrtUe&?V_grddB_mM9d=mb3S!iZ;UnB6UG>0MEhi(|!c@($%8sK6LH8%<*P_ zNk36asDq`ZHOA>=CzwIY1XpqQ-zsF7J!$nh1<{;l*Flro_#=7XZpaN0yW5J*#m^2#F6jdgwe!SoV}rY ze+#y#0WA)$T|P-_{No7)^855WExXf6#(>m&=|GTNi43Dt-$IWl|fx7`ug-4S8+86gwImAU@oTZUOSB4yL= zaNU)=9{@Xa-001xzp7>=pQ@D;PoEkyKJ15NmM}A8GpwA7gRxQcK?5OZF+QEqeW~_O z35d(Z+phIW^`?lq`u~=2+@_htA-l424V@3H#R^V7wAaks9sugO@tR6_V{d>Wt#W3T!pOIE_M|jO-SFT|c2-RZbeB*pm z!CpCVilOQY+H%=0G6YP~*3D{~(`o@&YZSR?kUOthICxMj(M5_pQ6tJIp?FWDS~%%~ z@104S6uK;PvooA6zbStE+J39pLvQjDtQ=CU?5%Lf*4S*Zc+?cuth3{r!;yC&%FL5^ zJqL6K8j`PDEo(4^A@Yq!<_y-kr5shFx4?U_gw=QW9`;-+L=70UBU*LD#oalq#jbo= zHZk1LZ{s~00^qId=Xu6n+_*{2s)a#VMpe!X*@dtM`OXD-l(hK5tkYqU`sZJ>4?tq> z2rOhb);FxToEPOO^&0ipSxuN;#NgF8ba-dg!%981=1xj?1a2smz1i-nFG%dJ@kZ>& zv-Nr+5C=SwWB;aQK7rRXlg?me?0fb%aV-F2Uk|Nz4J_F24Zx)|WOOE1`t8Tc(Fn=C z=hY0dID{BveAZ`$Vdvs|n#!)3YU4i-eO`=Kwb~WE%m!sr$67N(gmz$HS~Zvi-XUxp z_@0UD<_5=(aY)V|8@Wt_#FCtpIm<&GVM5Bg96-U(Uk~Z${u3+;>G&pU8SBR!alHi1o-Wr9_1| zC9fjAqB4V2dnGNM!yGtdkP)CW_KCoyI~{qTeFK+6oqYoqqW`H4>8q)82d$PiDNpgR z5l~wfIW#do21Rr97`lgiC;dd9fq&|0W&SGHs=qYrLU0m0z`k@xBK^se;t?gIY}sm^ zxu(Sout=7PZk!wjbwbg#$<&4!?5YMz`8-C4pp}k+Gm4ZnH+`kLPvMe-`UQ%9%+g|N zx+IXGZ?&bY6V2+eD?2lbWZVMM_AD=(mqV3ZM-zKj021fd zIW+egI|c8H&}9{WWEKo-2@C0Q<2gNn2H64w^lYD_sw`#j1zB|r zx_euM??U4us(32b)R5vUQTi7;$^@5!h=>i7Srgj{o)912j1~!g5JosF$wodMh#cHW zBhmeEUr0{e zCI4`$6<+IL*sGI@=yRqn*o)`I{q89wArQ&G9)kdJ5uK`m4D<}4+|`cWWRD3s^P{7i zXQc;YQ-KG*kxW*{ug?e$Y(JQBWMguL9|ICi3-bFS?N^EH79kPL{O{S<#`N%SrnI?g zf8RP0Z`^O*+_~C(8ZN(+m;E^JuN`vHTibeY+(jR2a(p~Q-RI-wLk;qgt-(hQk3O+X z6i(TNslb^?yn{NToXsoKs#B^}IWEmXsIEIl@MMGNGdBLH{~PE7ij8|&NYy6j6J!HK z9prLmKxB$`k_?(JKN5%|gfR@#pN;V+JDKnN?=qxY9yrnPIK~57|8?L`plxKQwH z$7=F_NP}{fV$D@~i_4L6O0yLnV^a3`<0oIbS(5aXifT4qDUr%|E2NVZ$@B)HjQm%q z)pr59)II!T58bq6GnsW|~QD=AeSpr@;{NJN+ROV+K_4sqrz7CXVY7Uk9VS_e zc&p2fsRTPte|W`sR^WWz?q*!JcuURAyBK)g4xHMr)~ErOFFVuTD%d6ys$tPm+ddWT z%FpSjK_K1QIKNzFddG%;WCz*@A$rrzu8f{Z+~7ADjW|%soW8^8aOgeFVW;(#JzjwW zyMzcJ(+nAfq#Xbmg@r?<8^{Mebey*zf_h+blcNvd(We)CpLfCiyb0yQ!gNKo^4)D$ z;!sY5x@qNFAqZ#TP zllGD60Z&uI*jFCwB<>@kZ#h>tzT@YaRF&XMR}VX z!c#Z)H4Xv}VCkHIP04pa#m6Vns>d!8WW_a(iik;Cuf5-v7Zax$I&;cGJND6evq4AO z655RbJ43ajnEhCEX9jI$D(;qLE#4A73&aK4)SWyq+vC9b@>8P>ECi7MRZ;Uwfi8r3 z&wZ)(wtchUB~Bcnb28Lg23UH0?GO>xw?XW<`5IpJ<=z zG4L#ojc^_0-o|Fh=o=K};a$vspG9LEznSyZ*?H<8jLkc_8F>6sCrnI2Z$XENB?T*g zx4c(_Nf2hjnN@8DgiY6emNDD6W1%IE+%n8~5;t1)sA3t0a}jYLB@))rLZv*exP{6- zg(?V$)|6Nb1KNdOk@|%Sb)ZWCLy3D34;aRvADtyKml-$YQ@wBQ#Y=mS2fo3fTxi?W zF?;UpNPKL)ye&=`aqfPPvTYB_VL9Q}t_qFjaN*4)yz&RrHNO`Xnu1&@!~q{RQVW;a zYRm$n9q=Pw-%$3O(oV?H$RLiLFs;f2LSRBn&8@IUC=%})k5-}X%<{2B7oZ<(R_wh_ z0ApvC=XBPr%-fm9+3edP_?g=YR{mz`zcoY2^R4C;fgl*#rg?3vdLLBQdPPZ^OjS4M zVuOM>bOreez5KikAWAo24`X9zVk-;EbA{6D*a2R4H{uv}=~GYu!mHmxIP=+m3*md4 zx4(t(vHeYv8xbHXY*R?0O;Q>o$P-q1fc;<~{9*I4VKFJdD&1RPUc8v55x>L!Gi68; zAQ;mwmz%}q3|7`>@<(aMz{XhzGs4oANvMwYB^7qkkBzgEs%EUMMT|vB_Kn<7{5Q^5 z&Mg1VEFb*GMK8aTEi;dK8%&TVq%Y;sQF8QWko5rie>t&V5Hwp1mQEcAE*}~?jT!|1 zI4iUfM@t}R>`|w?VD(4G8g+pG8E=YB>z1z!FM|>zMqaI|R@LgzV14Ps@4sr!E;Pf) zsd}v}1-(_|^g2~UvRkrVmzG}J6||0y2E}u`h1sXbdDG*$+ZS03>Fq}NbQ|(lsw46c z-(>Jc%*KOyg#Hoi1{E<=U|UnxCf4tQu&L+Dy8^WJF`*=LaiY}$eqPh z<22BY*lmZ#==|~32RexRqG@76uzlSHEr731l3BB9xoI2%P5F|#fF86pue`LZZLKI2 z`jR#T4NJo?1S6`vya1Drrybn1CJ|+1Q+`n zq5EN-g1a>ZZND5GK~sW0v2#xkkHW!&RY8brH`^AH&>|^$F{drxw{nY_@4}N$kwEY{ zM)f!x40m6FPw!J^RbSClcM!htPf)KrPU=V}7Yc-J;L^ zOBN)Z1F%}uKxpW6ebq=%AUf_pCn^u;ECyY#bcxqy%b*(cy?E(M(ruIpw4E|(*8r}AQ>2gaExTM!`SDqNTuz%aSF^k z9zPpVR)?LX9pROpKVx}`Xrz*CJj1CcBCg}9;PucZ&QxUxG42%^wz=$9&*uq^^+lNBW}?$Y=x8;a=DbEk81csPppc~F{jKuSEB;)=UV7BKQK@1H)ie}=o~bqBm7 zEvMlhjgnlMWbw|_ziGE6kek^ttyi=PQ8~^yQ z?_mM}1_9VVGk?QnF?_Znu3jJ5+<}2~2R`l4=Y~qmP8M5PyIs;CUeQ7-q-5K;?nWL_ z(HlWs_7MojU&rZrkIBYyNlgO?8S1YOsV{dtR-V>Y?4igW%O!0Q%CLJbuIw91pPO}0 zQl2Y{EB^0*ktVS$R3u*#4UMQ#lgAR>M539&$GN>GZeP+sL&D`u`9!4m@4MxQ*n?;V zYE6U?#exgU?L_cr327@q4hIm@{=FCJ8#|!G$-Ryz|Gg$cMtAHGJkb3?SONzQXjR$C z{Ib~Jm>-BlAZa4!1xV_hrq4ucQMK(!6>xt?h9wKS>tOVemF;4FUGzy>w(QoEs`XK- zhO@Ggv%oL2CAOvb=uwyG%;+}BJ$9Fxi@@y`VxU8Jl=;%nDP(MJn72SlZF2_hrb1bv zyBc!ck1{RKD^hf8D}6=N!MhS>jUxCR#_v!%9+QPYDznpjR7_pf2}7WDoh^H!Xg}G0 z4vu$EZ9*6i1WFjOFB-82V!Sy6ykZB*!Td1Sn$yvUl(#>M=4zj1a~NI;U+&4rfiU0u z;6~2Gej$P^`25C74^J!b7jSqz2;)5k2lpQJ3=l#A>ws^?BF+%5&cRfSV5SqH5g8?0 zx(xT;54fThjR(NC2A}sU>jDo?O(R^ddl}yc#E1u7-?wK*;i*zMom}&1qPbtX+~2v{ z93fe|y){|%oA_s&!clnqkG(8ZL3eGs81c^naA(-Lv7$=3j8jaYaZVGtFIgTGEyGgu z%9WzSf0AyPcihHFGj_mE^H*1N*PE1EEwa%qZ8>GJpHtaj7p@1cL>FtEvSQ)#f%a_T zJdPjCkPon;VQUP-ZAlRZxuk>XEKrv(9|t@wvh8f0=~>=kGrYVA!~#S7@;ol#FBr@p zL7dT^BD8^9!oG%;ozqMGHXgiJ5b1yX?fmp_xQ4oU+nC(S{0F#-0W_PKpWOs#cgFxP z(I9#pixfPHcujn>+{bG%%pUi+!vV_PIiCu+@3dmwA`~FllzC1lk{P_Ht?>*ASZo&2 z7v4C(UE{X`!dP5!95RgWqV+u$DB{=!V_{DMH}CrQB!Swe2R;75h-JS&@5!C;_?FC;%}-tJ_#|5#*0s)Di^ zi_M@vqfL@Tqp4itPLphd+A63g-f2DBhl2yy%j>0b@E>S%L}geas7Aml2$e)!0LoQQ zQlgU3;iy#@BKNz9FXR8bSt*>k*_(06_es|^_933RE!MM@bKd((0Rnz2=9)u99a8ms zKUz3rd=jwvXIi3U{W22mtr=3HYoD&|;3UBHK;$RPV)6jG;rWwFzq9?|9MJ1K(km%6 zrK}F^fd7_b?{tdVCqrINND?5 zG>Q^N`r=Nbx44A=^LbWknWD2+T!q%|qVn|5*))YErap!B)`-^Z)+?QnUvR^x0qV5f zkv(6HCg0jZiRhc7Gp>(J;?jYDF3`f&O4?eX#wmz%;jgqV!Q*VUD0@Uu3y z$I)h==q|)FW@g&<3&5f;TyM&X@i?Ult+|48>yI;SX1z0QZuy_|Ieew4YQ2 zv&i$ENwOsoDZX;grKk%0VwcqnE`meDFh?&9quaP`upLiDC~GDFn@2HQq+`0v$Q`hX z4%c|iwIX!?Eys`*Z3ml&5l2lmm6eQ)m)ff{@$9i4iy(H~@iLKxaOqC3zAW!YBM;j@ zE3n9J!KILsu^AuiguT!(Hv4l(zIUQUFik%>pya2ph4|yTi?Inrzt7pyNfA( z?Fg3`yIRCzZ5Odb^a}LM#PBh_T-WY63V$5nC+XuVNrH9+`%m|Ckm2Um&P8~iCLhxF z8N#n~+GbBV8xU$p0#fx6P5~e~K%GF)ApK-18{7;cZc5$9bO=sgsSyiC&S&U7mBGT| zcQpdi6Xnd`pd^n5k9o7VpRx!*bQjLzn6(&=;JEDjZ?E<+AJ}=)iOia0w{3B4;n~19 zf~vbC@82?|=3I&$k_&HqJhC-deEq2!h)?knNx{|uSws}y_l<|>;L1~Z$x?B9_$*39 zJIrC*9gk#AD0Wum6my6J?N9erf)gT@URSE4?n_1+R4S+=zE~w8vZuC5iV`T?Hi5?w z6me_eVJ2!vGHp+EHJb0rW+%tavn8XDa_4GL2~im)5PB6RdA7ytta1#moHTmD_I%?O zq^L(fXwxA0dw*b%ZE&V%;YF%nDAc*oO1bWk&)*lta=oG<4p%$J{wz162ZEl-?BAZa zG~Aw`1|o1X)}WwfW4#StEddKnReQ|xKuEObZbZIDw1irFu&UQb%!cR-z@D)u(v0Qn z%%HC6fEUNBRJ)i4)VDG;xKGfps!LyH^q-$LT%k)NEEVO7Ewh!hpljGHAGaU23{n`sk0;vhBt6E$oq=iU_aZj-*(c+YB38IW6wob+0Ny3bpR=)XMSpd7KMTLd2T(-!#BnAu3kZ#ce5iZPKAQIgj z0|})BQdHOCHe)RW3N>#Q1(i@FO)uOD=1{uyn{@lEkFU7jL9=>@6RER$V3@3|F!r=`&u^5dBYC697u;B`VSd4?+M+sO1#-0jSv9T zHp#gwZimwPxf?CNi2U;qWb~9-o@!LFTIB+cW7HSyp7bhQ$HSloVz(H;=cG#AW&rRt@geJ?f_i#`Vhglpu_hhl%J&qxW4|H zx^E9Mt!(OhES}Up~z+N^?iI1RsXdrz8|AVPpUCpQmB zbJSeEETyXVBdK1Ok5l3oCVYDdW>yYfnlFX5vD6!=J*awDcGe;l2k^&UMA& zkvrIH_=kBLnkXi>5LuddS6M2{*?Qn`7A@K96sR@ECw{-tFf=B$Z6PNpZyJ{cj3Jtv zu|4*CzrUV2VVI({d&4PdP1mY)?;)Ha*QiR60I`Z3@g^;8Kr(UlN!-cO>+vC~^y7IJ z(XO+DiL~3?$Bcr`9F$USu@d$s^u`ZMTZ$9fq-Bw9U1@9SGR&eY{+G1JJa6B1hv>hX zF+&CNHZhpaB;0EHK7UHV7hChvpGE`qNhR^ysEvlD$Jl&d`QF6-xCWppfc>;8)IfCP zxz2-ae}|<)JY%X{fo&@8F4ANkdU+ofPa63B+p5`(cly%+Io^rn&^IQP?h1_>A**!P z^r?;qQP<;J<+9=ge@(qc-%nH={n)HIQ$07i%Gfhw*}DAEVNND_M>zbjlLL9%=)gKL zIyL>6-V}c$w^BNW$Le){nm)#D1pE}I}qYMk3b~r!G zTPe0Mj+py7GN4EcnAxqVhMPgWa;uNHy67w0mg@-$FGg7%Mno^rH3q%y+;Hjmz|$gy zJ!|#B7MwAvp)#O(?a-RTQFhf1fQvhH4m|6tPv8=zAY=ytP!Vrpj{+aUM6ESH$s4#5 zrdZtG5M4UEie#oRf2O>)i(0m1kG6PJ_(0wGKC9=0YW*S{hmn&7Z)S`*$v$71Y3}^6 zHrL<_N5^aY!d=IAsHEYWb3tIYVB$ce9=`re=H}nx0er&u@8;wx>Xf2$_ANQbE%Bh> z?$mFi%w>96S;@?bLMtG*_6Zjy6#L-=V88LU=C4g#8GHHy(no2Uf7@&upC{sjQ-W1S zw=~Z)P5vNx>lFWje~8Q*E)bOeMS8|~+Fvp;zW(r#p%aQ@s)ctU(I#wKg~tsQk{%+<uQ`JF!f+M?g(poq|qSt^n#FA28EXER}Z+Cjdu+ zN0I81zqHZ+Qx4RI=5dUQP?$vK8)bknOPiq5ekFOHpJ@nK5hKrC33&o()bQFH5@J9) z>NW|-TS%@_YjA&Vd4{h9$v?H>*(*161(>k41{!KHi$d&V$8Nsfspio%16qhw!)@s` zH;Ix{`J#kjtiD|+b+cN!q=C0CH}7V}r43!N!f_*4$b3_0KBG!Z4*9HTNb>t7CTY)t zK)~Z{+WD$oN@yp8{k9>m%3_!-&F|$*tV2YYtxJC@lXBEHvDm_aP;(Aw+&QGaOA-IR zg;w@@5((zHw0Tpa%tl9C>^|XwjR40#UPmvJf#ZW~_A!4_DI)tPc1@bt1Yw41=tN*D zRu6&wHLVDfYU#q6P7sT5azqLRzB|!JnXVu+9m#BgOsX*Cb#)>2%S`&2hXyAGQ8!l~ z%G1W5P^s3vnf1}G*M`KG`c-R6M+Y+!ZG^zNft9c z;6r7dhTTfIIsnO!!~A@oK3wr!xjME!Bi1ZE1>Xd0CI#zkTx%UBZar#*U9HU1;;y2O zN_U3@=5>UlfYoI+x?BULWtoSqRXJ{XXe*h=>Wi~}#(;VwbVo(&J1UZOkVu~%#d_Rh zCBHb}-f`QsDXeC~8fQ2zPiDkZjqUUb>YnNztOh>e zci~wcRT!7(mS?A1o-N|>(sh?b7Zi!nEHems{|dBw7r*(l*RZ1^9;6>xKOs?Uqb+J1 zC%XmlqVQ^e5;Z&Zr-#z{dThZvp;z{i*mWeT%b(co_QM#f!tB8_hMwna{suMDKsx(v zNhb>R}r_s{_0w*0B<4+3GFEfF$*WeY?Xm^)wX8_i* zm1{Ed=xVn4A>n6+x~=(k=dGCUXvszE)34l}C7HN=_jRYaSwVK$4DtGdl3_tA4vqSp zh#HyBx0!PGM^QAI%eHiMOZp+MjcS~);UB0VvYc{5Q#C+e*W1pB9fgk=m@z)SckiNP z<~ud@du*{e((IDWXnaL_h=T`W{`-Bdo{K@Nap!JJ_LyABf{a%iSt&GaHd9iwI!I9X z$%}(p_RhAZ|2WmCvyVd-59hr?9zw;ssXN$<2_xy5-IRq$d})>57Unu5d^wW9Ze)+T zNej#tLhr5)xKE~zui12Qh9UL>-wN%r;ZG0Y#KKcKYDFjnW;jpbzk>Czmh0QN>LS$_ zHfGEFx;gAvJy-{inqFx!y`p$w5o4b*G6|<5>I9 z?Y_ktOk=>%|0Wey`S%KH+uUbK->sZ!3CEnXN%DHp$}j}Y7qvo7T__4JsWA~Pn4@$prVuDNtYdC>Nhw{JrrBQbnVhbBbvq9y4Q#HWx^a!Pi z;Xm2E-M_lsUy;CPc<=7i;d>va$twvALjS|Dn_meKnL%xo4+fg`%60Q*WGP)!*v88u zuIEBpYzjuNpxS2ZcG7HC_JZ6EvvUNqe7JxoY!YgVb|iIvLschOC)Rp-FO8-!DHfZ7 zN}Z@vBa>;g%8tdH@^o~@1%JBBNG)t6BXelvi_hUyA`I-`2q&^Xy4j#FU~qi+yNV;c z0xrp(MN`8ke78TtFWy)zej|iVv3ZweQk*_F7D-S^cEEsnQG3-M=SL@Iy7F8%)62GY zcHnpvulla!6;Q*djVOEpNKRF49nwQ?Ym_+pe5gHqqSz@qk4+u`{I-R+t@n|CY8fa3 zOh)f`k=C>;qglt8cRs!2WN@jw@%=Qq;DWe ze#tZ-m4Q_m$r*#^E%jR7&A3~)!p_d9NNOqu*mhW2mgt&Xuz(f`k5?uIM9y{o>GMov zQsQ$d#4B~siTmrDnaKFs^S5(l%RL$4FKC`zrI7+kp+933h4D-hX$=975fZ`$$Hl)k%w}j-x0H* zK?jX^8mS{}i9&4Zt4iW1j9u%#Usv+DsHPz}>P?3zg?-RSnc|fwjCvM{i0zo`R2sN5 zHT%+f{1_CX!KihLY80jwB7dKZw#~yY^{_c2GrBcgLuGZGE0gLrF$BV*mh9B9!z%`3 zfjRYaB5t;;eBr~Re=91^?blEbSQVVs3N(S={Q|)?P6_`A9&;*)o3*=xteRmM=)kZn zn{~=iox0Kx5U*ABA+?_w?VgE_J8>jRfySyS-F#*D^eZaW`m)*GdcNLUe$EVH|GN4T zdW9~8`}LRpFDYiTVZCOI_3YN=AgpF^Cu;P%x1hmab`-C359ffSHk4 za~Hpz0Uxa`C#^Zl8bg(Yt^!B3j4wfe1EEk!v+!G~g+#HjHOAKT#0eDjY(&jhK6cy5 zUj)>=6YxfoaT`?a`OGFVgu?q(?hYA~Eh-XXZp5Zze;2-b@s(k{)8nWdz7MYy|HhQa zZuN=CWQsAS_~uG*&p}V`7>0MjZcqx%p1n`#a9e9hqh$udzC+%Bie<7K;g`+Q5QUW- z_lI+TBWh{T%P6|Q^dRCG9(A6!o2KC-SE3sat&>eEV|MEBJ=kqSy9p1|{aO@Q@_PCI zVbcAj7N@&(e0P@XoL;=?H|BZ?p9gXhY~{b7gb#B+FW)mfw=eKB0%7V%o2VnBphDJT z!46rV?7wrk6%Or`spZs1yBrb|wr62qEP=g{r*X9kmoI%UJn`gc-%fgg63IZ)%NLh9 zzKDmw*)1jg3r7hDbA?bi7B4y^)m!xZne#BwdZ5ebx8QL#W9PbapY3}1iTl0&1OC-M zO<6Dhcfs#$xNId02Rk*VW5ctNcXfNTm1q0<>e?DxjWZjQT3VTR-iVfoY{?eybqm_| z*LKE0S>cacTfq6nArxKvCyE_f-EIS6EXhw&hnnWF#)>2Kv`CP(f7&c~EQBKPqI=$bc91rzoEwnWpDmJF z&z2^}bhj%pj>r2ExtDpiG1M2sD)mfV@1m*93KKBdQgzo29bdO6#M0#>&q1scqjkQG zlV{%3mA z%9{dOfNpT9k4Wtd;5g;l zbd=k!i`S0hj!nnTugUAx)Qjg4jyzM#&ULH$E1P|AumAZvbKJLhpZ?)+!@G@^N;5HG zCEGz^iZ;t!F$^<$$UMfq*jhLL(GrwsAqfv1`CNP^52DJ@+hIDaSRBOd6{-)tOr*ae z)5q74w6qn+h5%9j(05qDYXDOsOm9`;jUL8zINrC9TUp-O7l?)(viL%>_wD4g79|L) zY2pZ-`EB3zQbrqt8$+wm-k1EXFrr|Wt_YB+-(wh&sD9D67DqBKwuAoIve?!Y zX3Q>>g5^}Kk;+h1sE|)EpRCw9IaDFhkaZCSN~qAhm}QOD5=ugi)wfV2RPRt>1eFwA zfs2p-V0poqMnWOdC8b|P?qlu}wX+&4+*?PkMX@#^BwFC2p(?FFNYh6mgyprZD+d}C zPyZ0X6&w3fz6mf;E!^p7+nvcIl_>F5pMv`gl_+^YJVrtq@o7FE0CLa+E=um}RT7dg zvw>yLAmnw3iS@_bWaH;&kWs%^~+8bUYv?vr0^?$ZJ-rfx= ze_|58$UmtFUuGo$*U6uObpMB`a|#Y6XxDXYtk||~+gY(~+qP}nwr$(Ctrh3w-#E3a z`l@U0rlzO*`Cb4XSKiulhAQl&F@e%9^%;1XJZiExYXYmSqeH>Sy0pGRX}H)VSoG=8 zFP@h$bNoo-@-J2mi5^u2-Rl>4EgmD(JD z3`|6pT7)k|>&55c5)msFI_a1kTZPe_q8Y>i=`^isLD%LMJf+YdpO%#Ot7WwijTtyz1UW(>N2)?TUFk8a1T)%B(yx>H9cG0x$2LtGW*>LkfZ=OWN_Pru$d zVH32YCl@uu(Coq`4XAkv6^?VF1DAwl>eBJ%%Ig?M5-=NRAx{tTMR}> zHyW7Fs0s)t&Pq*1qp4mwx(r`*)CtE{H7mH@uT3y)vfC6R_P*Ncezwle`)X!DSK1xY zGG=PJ166f(zbE>$);?FMH`um`Yi*e@cDqIRisc+MlvFL~Tk+tb zx{x1UZnJ7aq%!G2lp;`2d$ZN|#AH^?r?fOxta=leW4D6d3dfVK$k#(X3EbD^Kaa;z zB1dt)m|_kTIO;$j^ZnV@lUje=w4EO)l%$t2#u@UOj4fz`Lx$6BwRk_3RY7Y$tsy0e zzp{*sA+K;&jfVnUw-B42bO8k|_c^>#)ptcv8p3AH?JPpzf-M_mhN)$c8bX<^JOmB` z3|Ku0Jh5%4*{W!EG_B)Vvrb6;YIGNgU*<_SrD0*3#0*|(gQIl?)cT%i%}S>Ebq}%| zt7|bijPK5~82YpPy~~i7tDCSC%}1eIjr!*~Z5DU6*lm(Dq^83pne55B8b$h^JIqpu zKP8#<`@ru~S&d3p;Munn6%by8jZVY*-I{&NkY5chb(kg}wQ`&$Pkuelxc^-oI!q}i z1B+cIOXFr8CQGGHlPrgmEQX<$BMBWmrIsUv_V$_MPY%+5CdeQx9jn1B zbgPp&m!Id_OcDER+DuR@-C9g8ohD1|pGh?s!)-J*7{LMDiIyWk+kY=J>g{QJr4MWp z-NqYT_t(uCXmZEBw5ElxnCHKRY%PK%{v_1v1Cb7~`Q9U+%aDEf>F6NeJ|Y*OfA_iO zzOkIbb99N)h9~;*nU<6|@q_>t)E&(AgTR{}#e`+i%g_onbad}3pbKsdS{8BiCNOkk zvGawr_BDue%hRA1tT_ZVB5yNC4M)XIV;m53O}$Lg330#aXxlF-9Q1JU|-_SO9-<7 zOG5Lpr?zDAt2FpaK~Q6IrAc-D53EX=1Luzw$}U|V%jgGh>9W7Rsr4b1Voy~3Lbt#M(Nf5N#4u2S@Thu2`+dXa^U1HO3n&nWvhrM1G~B(8nT_#`{C4x&mP)q!F|!v zk;XAN5Vyx5c~Py9_@b{#yCc?ZGM`BKReAcn@8y=;70jzt@X<{syDuUDnzk{dMnYhz zQ(!!R-Ex=u^eGR)CUSK<-_ip>->#J6YBL2y9Gyj0b|eU+rIjSo1QN9gL?|m%PgGhl z@C})asLfC8#H}3~<$<7(fJ{e}q}^;GYfAY|3CmjV5hRyEvU5Y4CXkO~(_S)Mj@FqU zG}_+$H-RjycCJ7dK!agu@|U|{==}#~#rM4-gr(8dAyz90^6eU02ninZxJr#I2tg|= zXg`bE-b$$^p-idoMT(I#M&OuM+-2lXLE- z_c$NL^g8%3rA^S&m?jr2H+`{~fUd?3q2RSzDtlwEn^YbJeQ@gprZ7bW%?ccOs%ouv zRh(-KTpKIPTbml-L9aDG$hJXZe_$eiFoUMcwX?awSA`f<&^jMm8L{3@3AOfCjbZ3R zrxwi_MZ4YigSPpVjP@m|=W$=r`Aw&hepO6){q$B!-}S2~E&Y4DQn9X%yXLUVP*eMftLfvWMXgSrO)>Uke-o%14C-Skz)P66jaWmM)dxih4~r_A|B zDf|Mo{L8FzsrRIs%|z`wu>Ad_e<8Vl@DCH+Kb7)3g*Np$k=kz=gNDE@KNrE>HhKH)V9i!vgbty5rj=%CXMmk5_7xr z;K2CYt!y@GQ@NVhO%^lUbR-%EvND%60dxg2URZTkTa6&tk%M3#Jb%Zx01b8uNSEOYVQ z4LF4LII-4E3ioS-^h*DW9H;e+(c4|Dt}E(_!8+=jGpa;yO6W;$XTI2*7WFB2LJyQR zK4T);N6B;M1#rm8eVL~cvgzh_{#>MaMyW+KvS zd(eTcR~65rEdD=r{3OO{WCL&$@$x)7WF*1yqkrX=tJ$ssuNBm#daT<8i`58R;BA!S^vlb|Uo7C>s1#z*ghYKzVmJDeD@Y>sw&IYTyRZvh~#A?7bzCZZuurivN=oZnBZ{c5JRmd5_>$7S-3qfHZMx}DB#aoGj0SXr%Z2dv3WS%~&UI9R?%1Y1#1j<~YdGCSj`-d+B~B9m1c%vjkz?tDG*&T_fFuCpm2 zp<`NcZ^gc1GrtCXKRrMAYCkscE`N3|zfOA{nDR9IV3`Q*65rJU zL8q7wk!`_;txvJJP>=$d82RwBfpQPiZA6=%^9|Yb|lZ*Ozms zmLJlflpoUuCNJH&&L#A#JFOmYClAhY-=!U3X=&JNsI(k3Q)?YtoOXV7OhT#;=*2vy z)}SG8qQES0R<(FGGA>)4G4@FEE?*i2^ZLLxUnN@^GbmUWA{syTN}y1R%88I>IHa8b zBeUuZ{EC8a4QoCpsiGRkC!{d!ScW3}DIG^5e+%A)zCo}kO5&l5&%^EbmZRFj`vSMs z?>&yJU|Xjeo45YHRpKGk@x0_UV`MuppiIZ!+le79{yi1Q2+qo@hK^e?!G7MyY6(V5_iJ=gOwe+)GxvSIp-R{n)TUhLAVmFK{VU`#1 zEf~2UzrUAV5&Zavr1(fG5gf$wRYE0>#eX@Xh`$**VQK^VDTK*xGPmTqVSIo;Ie>1`F4q2gmsd^!vpaKncW5a&p z&%ZUSs{|bRAm*bUO4+&khh7F5S3siLEo_dNs|K?smj4f@Bvk(or`#wlc)sjnOSjYG zp>}u74>2&R8swlqtVHHvPw?b}Ae8q+5Q{3kbmJUohxF3LNPAc<^EEKjG4U|fEeQ1T zW?pA_UGy)S`VDLpD3X$7%>>05ojva#;WWIZ|7Mq;|6!LK|A$>B?EVkCl%?waUv`-V zrQb@9@uo*t3}rNw5JcUN@Ma?)BMC$x-?l%3%^p?if#u>ll4})Mt7`HH1hQVgX_9Oh zq6wm6pNP8E)m!zme04uT?_0^uoCSn4nk$)vks;ZL8^3V3mMB@$VO?By{@_ys1&g!ZxrS*bl zs&ts96f~L?D}-gd60=weNezW_6#_t#cU{+GP=8PvkA#aNdlyrLodjI{$$#b(}KcUhxDxKn2>Sh!GMNz)>IWf zy8ThT*9)F8RsQS?ZzM47hE_)~7t$Av5F*I*- zM0Hb9R(Q6SNKR%NV?C3Hs3Kbof}fV3@?0gbBD*$`0T1eJe?^a)lWAbq{+Biz_0#@ z=kzg`_gjQ}0H44b!PlKth)5SEJ~7R0D-a|xT`Z9AY%tAT(1sC>2cea7ATzW*Hq}iD z`j`c@-Y?X?5UzYDVP#qN;@ zaRj3Oyc9x6JjETtr4k#tY7Y4j1_iju^uEM@@!38vnAn2hh+1>9E!e)iM`xlgv>p#b zV%$K(pS^1iQecjN2MRHAivFAmwf(Kk8B`br3NJxM01qoTsbR~;B(LyoKSFE0;+iUw z4sA(-lX(juS`yf~{W=06sA;`C);$liAyJTz%2qt_SWK-+KjT<|t#R|j-*8NC8TCqp=?2EURM!7$0#PB?e4Z}Sy-$L8}W`pc>1o=AiA9%70Z zR0haoc0MbPr-w^yL7Ibu=Udm*v#xkuZ>DyuI^cfsy%-f`4u{O1=;bdanO+!VQ-(nd zV|1ABQR6Jfw#ef?RARX7(IKkZStGq{rt!S9 zLT6V?(;`=Q4Ws~HC@Bd&1;!#cc&u%Zgpi_oEhq<`uX7LlnJ*-Kg#0IYyv4DX0jZOBd zPm;fI!QR^ep|k9pjFdXjzZcXU?mY=~sroM@uGJj2(Y%^@mcOP|qSwt?p6--b{aH-` zE}hIRxwCWD_*$vU=>AJIpvhsb#RoA36Bny)CgyGG@^K6C??S@pCgsU>MHQPOr($#u zI>S%gvUC4>bldA{50a8bjd$3F-Ps0OLEMFu_X3BOTHyvTgt~G0q{XN&ja$cg*ioYk zI^6?$J$AbhV5&~F-s&>JANpMz+&9c_sC7`lb=r5f1Mr82w5s*4s8M5tH! zspuRffT@btz0>xzUlda<5VR9hBL?uGrd;r^>%;6d?)6KK_f%&Gh zX!{QGhqkidJ*=y@VC()}-@e>bsIqHeI)a*dbmd7>0j)d)`ibE3Y{FC7?l93$87iQ zX#XR`JWu~!*67_nKO!h`VMC;l753LgbJp?MbQ)^A+vCOcbNqPTsw*qY*Twhqay)sC zsH9xq8ktcs0bOZ^W={K8`)&K}QTAKAaKRxk*`DouIsbhCQ?Ea%7=r75YrWw`z^c*%X{dH`4YC}^qY<%{^WG<7>n9J^ zY1DZKfbajrGNY+djBmuaGpk=0U%9PZ>E>AMmy-gn(2BJyS%SgS&;~mFi`I$P434Hf zh1N`H%hmFrcQ+#=9CG3eMRC^ibo8w34gYcNX#R4se7v4H*-goVeSf_qsr}7ne({ap zsxuM>pOueS*qZAmp`j?C8LaWwyB#2@#lRsIGH@CmFYhf_?oSm`Z?1TFzzro5K4VlK zQ6-XQYm@n$>xSls#1M&N2QCWv$@%Mq0i2XGIIfF!Z(9$OlYb$&`|3iNP2@f^4Aa^6XSUc7h)suD zXD*L+Y4H5!HTSpEh~LWL&LAGwjBCdu(uCZbW^ANf4(rpLO*yWsTopv!!o5`+oLy%lf@$9Y}Dk=Ut& zZ2rPExdF5i^_QtHy}~p0E+gQ*6!h}f?pssap}jfK zdLByX6E|?ge$>}67TRfqnE0%U;5pe~C>6-#K|Oa?1mXPcv$5V%KTP#OhC*zagXXE4lu$hy0z+~AzO0mt$T)LpRp{2Fz3ur<@O0^vltd@syC%mG;b&VvTke!7Nf`qLA%YV+HClE_jWH|v zJDnu*YdaFHMp)v(WPYTN`Px_VRD#m=PUl5Q4E7BuSE=y zqe2Gp+1IY8vkao464`G-%h;7@vl}^!E=##)h4P=O6(a5WoO!8;PY1A4`izHxfnB522dv2ESb2u+ujW{516I8DT{j3A>0L}T*-@|w1-bwKat zKO;i@$~lnvy@(^FrZRd6K0EHG)WH_fz0|5iM=?ULm`G;)&fLOGWGO!w)*Jt{=l_GQ zrP&@ZG3n{gY+Pzkzfj9bMcdAN0wOiZN3lN&>H?kbVgP-t8m^Jskw+HZD(0ek5+AM! z6EYk;!;osJqs{4l*eVX)k*3W&@?nWq)9yl$+K4D!<3>hn21VTr>7v2b8-K$=t?(>c-BM zF&q05I#`&ae>;wmzW$_4Y`|J|j#+SgM4FM!Jl9?k!mAO0o;0N}IG8siZS72QQo(3a z9gn~uuurV&7yhUEHd77{_gH)*s{o1%bk9dHH2Dt^FyZN)GZbIDOi{m>pr!YT+cdw~ zYFD_r$dvRC>%v@Tp*n56CYuicG`DFJjILgN?$GgI`4u#pWJ zw$|nZH3-76+Mc3xtQ%E<_twV|5ZY4;sO-mC4p`PHmg@=s1Y(DuI5B`-Lr3~dYdF~q z?bNtUa1Lh370JRNj5#z@g8HU0frC0z;Oq0q=(47YG|4BLIx}=IP$^pv*W+Of7iv<-Rxfa<-!0iAwLchg25SE zYQRTlY)ig?VKu5W1&WFnSl*H_W=XQhcCcZpX=gI=G;?b*$CU}d+URDRxUh$+tjoE1 z6$>uU`fQ6=tZ9}(iZlunGRu_+0X2q<_azk`#PWsj#1!*3BxBv0Y*%rK;R>efy(K&Q z!3_z2E6mJg^7e>u>xZh3W;XW_DNb6D{=Ww09oS4N+tuQe(%~%VEjJ$Wg6uF?$*Fx6 z!pEzd9QO{BURXh!wKJj6nj#7zSIFdM=a@S$J8yK`>WfspWjB;4Z8{GHGE ziEQTVs`6~|@~9>CFd3_dV`cpE_RsnPgTQdr%3+0}dyLEYCxw~+$-@8Pam$+PKTM0V zX5NIX=NRHQVsw_J;v$;F z5g~Iy@waklF<>k1<;BM}+j3bm*;z;*U?BR~WLc))&+ygA$jF{_VS4aWnz6iT(Myb% z0V``pXRuF+q;T%Y%>8~ktO@eihFy>wgPH|A z$jIdAxE9QY>kXQ&Ri>c%l9RvoWsfF|Wo2PpJDj;9-0(3}SeONCNilniWEeazr+yMz z)TWgbw`@o~DgUta8cH>$U54;~D~Tcy`TT_h!w@}~XUfrSkU=IH zFMpVu1)H`%QV~3=tbG$FM>g?ytR$di05?%IN|CAfx1dRGNs96{(Ox(}_rwdN*9!3y*j4h4b5s;YIPB?=&YsYsNM-IVX}IU|b+8Fl^^Iwu6gxQA9BESL-r zVVZY_8CO)O4V|FZX^u=(w1(1NP;QGijukCL||{&pVgbl#d}YjAN0k zwgQ4wk+?e!61@By21>)ONOd0=)!Wj&t5b{UiRp7z7*I`#A_28MGF&A7{Iej`K+|x&P{YmTL@YN5xg{(&!i)WsMIzci$+Du%D^wqhnK6FV8jOC1K|@!65sd3fukG4HDg9u`z>Cmi4OhvDXCb`sG$Fwn*$i{ z9VK4kJlARI%wz7%UtJ}C#g`6kB)7<52DvZ7I)V7=@w|LSzp{MJx(nLiv2_fk3Hsp# zWLvg*@Y>BV(Io5)b6|LtS`#9sVE${?B^3bRoEU6-3r)p^0(p}G6PC;H47wpjExz`B zR6!E1vYcS0`i_I8=}h}s*_y1nb(=<0f_1CSYhmc|r>daIhI^D@DO@$^Gz2yzhDs~i zBbeU;3tVit>meABBm+|Ts^O`y%hkAjk$i>^xi_W)vm@Tf$QX4drQ$*lJ94#(_d_i`1wMsw8lWCcf$EF5P8YMmLu;XhF2 za5}a?+Reyg-`?DC`eSuulj~f?TeHtYw^-O7&jO)s#=mX7c{Hli`10ZP;tihn`dw|L zJ_%0X(SRAx^xJa5owOIU3fSUv}oS}YbncG7>1OE-y8aVa$P)dk?#)w6xdgi}}^N6-mEUFd8 zJpx749!C*NEn+C>$PxT<)q!U!Db$GGVTFnIkuDnCQM^0d^fiBc7O}B0%`#7}trrrIoiZ(~UuE>V3Rf9#hVeraN`Tb0ZGzDG zq|~*G;S}@Ixh;FEw}zE|&N*1UZy$~gNo4I?w7!d#CYm`mB*?rbM~DjW{H}_bf=31` zHQ$HJ20gjKCO$9_U6&t|yyjYAo9;(4IU#hUJ5F&vzgTO;ZUv-EQ`k|O>+u23M(fFETu38p%)legs_==ENb5!(*&!Ortawnru z^M@B>t*RdM?w!-D$ADr0wNtHT8;tb0nC|WPyw+#;-Db+5N3UNY$sKp7$2Zm|q5GUs zss#giHRs3#Uc!NTfei_qva~8OHc{GihJS@?tbNXnzTuor$_6_J%5E`hNp1U zg{?tuc(FAvD|hqKU8rE`PIIzH-nC+*XX!0iMn}@4t)H}YW4s4B|9*g1#+s&gZ{1Sz z!K-N5QnYmw?p#Pw2%UH2<*OpdU`&&8!IKqz7Qln>Yp_3Gk(YBxf)2bIK-2N{*Wf zIswBgR3aGT0S(B~wlP?3Cb?rL0$QC=+Y}8A71ckPqi+2>l-X0-ui(q=+x~ag#5mjU z63?dA`|%w}8+6_3?PfeOPgh}$qg^_I_j9NhX-{FdZ`I?Mb3OXpe{iuSAHcRPe9z$E zME~@7Z(}{c#cuZOSkZB>Vm-vbL++cDM8Hb2Rc!R)D=a}>LU6>G44_X^rY}^Zw5!CC z!0|~pZB|j-UDsOSf6Y?d6u$nY2e8k%j0Oe(=GL8n({gGf@2x^#gkW=S37|bRp7ft= z;g&+LZ0a`fDf$GxQM7;S@;1gS_WQ;W>$Q>j0F``DxMHCvY#TruKva{{TQt&cfPBbS zRv>OX^ZR3=K63bm9ahNCI;S*&{q`GFT=s)cIqE~8=}wQa@`7*WG>O#q83$$BAae+* zoiSo#Vf7a|k=@>{xG4RXhpVKKt+LAL`?iG<%p$)%y-PcDe^)%bB5olC;!~Y{TnX1Q=d=)ci{Z>N!xX40`DT@$&_s_h<5Aa zb*x>NNk;?o->Hf%TA~SE0k~)y0(4fR_-PYe zWl}s`mU%AOV@R6XNoC)M(BkJUrgK*jOAVp&TYzC{D<}#&3{0vHp9)9 zLjse%q}$%lNR!Lf=D5cW+Hf8M z>kEod=3HgGt@{B#mzp8Y8vk-yAr>RU80SZcb|~s)DQ`Eo>(guAfw$}E>xcVkY;~57 z;CtNmEHP)^L3XFtD~dsoK#odLVX?BcgCZ?4dG0#e8pEB|h@pjzL7?2LYER_#^Yul9 z*9X!YYK5Q|Z9$~bPsW>9aj%D-)r6|vfs>}J7#0Y6~&{Usq&7_$k3He*Cu zjBu?B6hnM|Cm{hg-veb>)omnTYW~F~h&Y_38FV}Xhao9=n~#o)RU?(=6sVgG?@@6A z65)e8Vz957IhpWQC8U6ObuOlx&3teG2qK!bIRDNaFbKN@HUJA}Z!Z3t zQ#^~_p-(<$RcL@X?JW-IECs?=#gFa!rStkmptIF?9S8fL=xAW!uCz6Qu_qaRrq+U; zwHXx%updwV@e*10Nb3?UkwM;$`yU~N%SA0TiNXr5j@Fu z6heCCD-SMhupN~1TUDT?0m0!Ut;{&f(j(;2O{iB4XuhDrFl6391%F^G_h+9D`ki+Q z4i@ePHNgqFTaSf0^nzj+&&}5rThaNXBu;Vv*`lKWzpuI=LR`-z#?*j{v3d(y3^<%D zwy?M#dN26(OWcHa8P zOZ6k|`N`}c@}2xywYhIIX7)NZ+;n*EP`d7_n&UBMnCMc1bPR0nG3cRBdhs1$Nw`pc zzJ4Mk>Mk51@Sv&ORQ|ACZAOgC1y1E7r@`b#5X5Gut$b26zCI-2e9kHxErEoY=TW`a zQ#S6*0mT_%lrwGrEs+1@wa4{nPUfqf1h)%MgCw0Womk;&tqx8$c2-We$2Je=6>j#+ zI~kebA*h7PPKlVCBQp%_lp0yeBh(R*9bj%#{BmiYO8aY4g5H2WRyv&ke~z;6GX)Hw z`)!o5YF_85dlM{RDf*qnPRG${;;WC$h*pUGsy(gOuKZpb4I%#k;SYf9NYdx#bM_J14)FL8UjqUg)`!f(4gRb+Qa$doyHIvHNm#6bm}` zbiIE0BoKTIOF_2~(4j_R6T;nR;b=5K&x#5?=3JII$C7B5|R~2iF9n02j#g-MOMxomnTkE8i!g>?5*;URfsLW-MbP+Bjm{hqq^z$?v7NwIuWTC|%Y>2!kwL3Wxy~Z5f_+_! zq{o&~EV076s=|eIcCHarPW4adaAdGRn}6RVko-rY8P?#n2F$<+uh4{Kz%cA23ly#M zyuxyPpib>Jj`j;&%tztjzCh{bwZ&)&=tt+0YAC-z{`o=1m;wAT{)ItH5A`Eh{An=2Xu%XmcuT1)p@%zKv$+TB){1H4UBrg(-=qn5K2|xY6bj&NWC(Q1 zutkB9%((>j**_W;@f!-rv}S?yE{9PJK?fV;BTb9Q5NQ-8S-**hdAApo;)Iz#LBbnB z;_81n^?4f}BjL+M#x3~@XA&$s!&M@PrMaR41gMhLoX{&`8rFlFl~_!&+w!>_rD)m-TbcYJ{snp2;K6Wybnoxy zZ3f_N!+x@3JBx15%iqqu;d#@HS5qwqYmG_6qhvWm$5EB8Z_9tdBQ}T!m~FN4iFj1NY_n$Km7|xsdKd#*Pc&K-SQOQJ55- z0+;9tGL6orBB*;UXp3Xsms+O-vC}+5mH>z@O>R1H?~@YOdf{2`B`_hY?JO=b_!;$V z3sXrm2pILXk85r)OR^eKu{}OrpUp3@ozhh1>`Z-pXN(0g_q!1mJx`wW#l9xh5N{KQ zcl8~gvX-Uazx*B0y)#P9f=w%CA3kjOEtH-JW^#}Kd3hm;x)J2>vd1w4?D0$bzWyZg z#OPk^DQZ2v4M_hR1-hT$b_NAta6X!qjt$#6SkvM^=CG6t>(D$cErQt6&NK84UQ!IyjHy5P0>{G6AkR|1U^$ofv71D8fCX#%<;z1(qjTFv*&V@QHd z8|lzo9c0@|4wO5tD{n^XEU$i@C+It+8)nQs8x=@Hw(h}3Uy~iX8(Zu^30t4Ny~D1v z_r104+59|6-i`^*&|Ozk%F#ZbVUbvwaekH1Xi-wHS6xk}P<$YcF-6_fal{_@CJLrt zp99YD<_fE3-C8zKEL2!NRx-9(r!om@928{73mAs1Iav+{ru;nQTI2w#NYr-{-X4+sp;+h;Oll} zVCm#pMUB2vW1G9=AN#pdi>L<(j>P0fTU7w=_MoidZRZKGA)FrKW=q};y zD#7m|pHj;Tgh}dMji*Zs@rr`ld^51dsjG=)zOuf{mTei}L$cBoKxH(pT5w!ZV+QmK zdZ~Up^6eS{BT}OB`GGDYmY53Ygy)6g8@Te~y#t8s*;6BUtUu#@CMkkTCpN5cA|rrr zmA-PUDJD`++crOIned&XMzD6=R|&Ra-R?hYJQ**sUpMidU3~vu@`?GrX!n_}NaiPY z55v+q_Cosm^?t7kxG<*Rinn)WyjUK;Z|xTE$@}+8Hq0HnSmV2dHRG{ZzRQIP2bSZ? zoOuiH-Fn)-9oX(`N6(k`BD#HEwwj5Hee*Hs-Mh)dj`;$Se;)M!!SDQ&MRxs~o1x)L_c~lG>2dM8pFHGda&GtxO@dXK-O+~i*f1z;u zK~*wi4-SX}&SELG(iaMG?Py}CO}EYKj`A85D)P-> zA;BSx)lhvnKh7_f-#+e3e~Pdb?jo!ah+bNAb*)Fqw(sfqdONTa`ChZX-ODX=MVd3z zEmHV-{-XGLj%XJb{(woRn-J8on8=Et;FF~c3cUJbq!7T1(M+LnK=MH`<=N0@tVk*Y zSI4WD>;d0?4rEIKjFlb>tLE{K&h|Ia`dH?NXMa5&zJ5`>y$7g!Tg0As3T*7*6hEy| zee$)^hY>%OQS?AS11-De?&{bF7HEIEEYl?R=XbavkX<6BjbGU$FxJ!Oe%yE7_ z50)x!$c(q-MFI8JRhmsK3sL|aeaC}TphVFhO^PW zMV{qMfh3MILy#pdcX#R}w)f?7e+-r=N|eZ798IGwal%$ziJXV)5ohpNxqw5?>V=MQ zsqPf~IuP$Gow-sFI(%AGll!i8t-{RXP>rjzOuP(cBb7pqrWsUD@KZ$okL&Yl4k$OtXX1KMD*$?N_Axf2e>$z z)gUSiY7xn`m&LL9mE(O#MfAn2vy7Dinj=7~o)5?9ZrnZ=uYOF99~nuZ{@oA3G0v5q zQN0;(r8gW}SKZw_(E9}3&5|Z{6@b_p1h6bK9EmH5P^W>0z5SEk?h%c+0P&S#ROsGK zqDaqe8UGdAx^(~n*s@kICQhJfMERa`b!@J2nmAt0w@r)cWNV)Hl|f+-H7d~5Fh~Ae zOC;}Tm`5B{Ezp#A;Kn2pq;Kix<=Uzg>(*Q1Bg_L0s{B}1oiOA$I2T*H=aBr(>%VNX zxIqGLmfw7+`!XZT$I)tJiZaYialJw`c@4s-xtn-=4dy)qH#Q7iU_G$VJXBXX%k|i_ zlwv$TMIoOjf0NdhCvx9`xh3}x(Hk5uRszdRcuC0#{(>3w5OVK8YsEIm^296yVBi}j zMLkX`ePnnZ_A(%`IZShIHFDZ`!?XaR-KQP#p{hj70q!~3py`B8{aAOP1NBda@ovl7 zh@9!vI8WUj;AZ5Ot@h5pvt!l%s9uqX{&=U|DQauP zjSaeivsoKHR&C%P7bhN?iig{{LV(*G%!Vd0MkT45O#)~#R`jZ{G)@JMwIZ?dW>p2y z2ngO?crda|HYyTS9W5f8OpY_@zWW(J`YhlWbJ&DmFDBeZ0TU|E%2S^r`=+5j9BQWe zPAkZF#^v10oT0^x`xtgIZ62v0R}qn->lv21uosuFOr_4EP|qCUhLahDlyP+b>ne30=oUgzpKAL#_ep_P*9`(x> zi=V=@n!&Tzqf*#&NO~PHG`*8a#Kdz7L6vCuCV zLPnh+%EVzB77!VB4{rzltG5zZ2ZBMULcc0#V8r-$M{E zc-%-2|CkZYEC2-9n?T*y+CDa<-%+dl;XLLn&@2CRZ~|yc z%eYBz6+9nmYRWMT^lLQ**AMlB+M@_!fq&49H1l)9v|Ah*?PyOXbIPY36hC=rhk{=Q z-5T>8gun8r-sdNd(rvUMD-BmL3-q^zoU7Vl9UIeapX)Xq?A^p1}+8j^WqgoKQ=s? z&7Hwp67^rN7F$wil#5SBbmSmem=Htx)hS+ITGgsIH|gxgxVVdn0k(7n3Rgv)1NFe+ z=-5ei9o$k^jnd$*>eZe!>xAnhUITDSCL5%1Fh`Mr@DNB07Q(lpt0RoH%_H>_vL1t? z8Z;C3Kcf+MeegMt9rjVm4DgCL^tSLrZx!}6zji+^z#F4`9VZ4BO(`Z9V zhn_yj=y7m8U{o165naBLPZBNOdkOZv5URj#CVir*H%q#tPj#4A^Y-4}r-`=BjYT~Bl;$leG?H;o)QP!uVAS@d6sn*5sL<|c?Llv-l2D2 zIEw_gYUlO&bn-S@Pt7?kYar4}O00{vDwHa?7WuAB-QgP~=aH|DQE?D%sF;X9j?m<_ z0-VhCo!acBf+d+Gr*Q{)3F|Ami!v87AhL$!JtPg$jzTz>d^q5Qw6q)idlfrjX%&Fp z;Mr>T9K+b+^*(dk;GXtgL_xjfot!w(nuw+5cBHca7-a=q&vjWiosB#SDL9eJ@%^=p z9j40bc_X5B4`EK=Eirou(``NRwLt{1k@x&h zpbakTLpF8N-rvFdsZHy7;1eyTA!nOI?3t3p2_iN-L~Qf#P*^sNEBL}2;zb_i`-#hV z-I`!K=oWWTnWwzzT)ItW0CIg$609Pnx2S2^X>rHDavbBwnkdqt*xgeuge!>b z7DjI+;75Rio=#u_vf^zjr>;UmagWH{P<!&QHBGq+-oqB_=t%efxLE_Lk-r zllt@|dJgpqn!I{Ee+FOmgu{oXt0W{!39vtKFd5m{Qp9#hV=*?ciVJi5rHN00fZWsz znT_=rs>6ZLud>*TG*6-=oW+fVd;-rTug(m1QX~eaP?v%*XRS*Jc%&ZbrJPe(V84h> z!;MpzP~cObyzib&!kb$#$E--HW>`zpRc1>lriCXM$25g|e0;(^o1ADOC8mB|3ue^G z>LlGKOzAv#YI<4!kFk3SvSr=21zfgm+qON6vs|-m+x9Hmwr$(CZQHI}YwdGS?1=kv z-!dW}M@B}D-rLvyKIx`Xvbf~VfGS{%P#vJ}Db2|wvvCxqETtu;RONC{qq;XsrbJAc z2SW^oWm{mkaY+hZ-L*RKt3jCpM(TQqaS&s5u()*eG)AO$N0UVme8Tlr;Pfc3C+1b# zEc2~;^QcOi{dQ^BpgV~CNmM)wRz=Rzt)fNLF2$ble#N5#XF_ah*z^8f@Ch^>%Ot zTV4NDB!(J~nX5}3XYk?9+1s5HcHqO}iK~IlWGO7V6U*1-ek2qa*-y?54ptTNa+@5v zG&IX*IuG&7E5frn7oH2eXYryo>GU?mRI}OOIpd#JrnCa>XX?4sYLPGx=1c`iTcfH> z1%(}z8qf0;RjR4@bQ^V#PZXSGL-~gxtJG5IwdtNtvgn+e(|tKa!%j z-F+qrsg#|yz`9ihA;WluG@L@dluyYoqks{j3@;s^fre%3(Qmxm%m_3qslEgTYt#7B z`b$N7K3d|rqlMWWjSxbj0h|WWbNx2n5xJ!mr`LNpMP>Ev;v7tvw?z|h;(!!+sXVkHflDGcMbkHEJS#qZf5Rrl_jS%C(#nbTrX~)|V&yK5<1Vqqv zH7(TH%4lmlIHYy=vSNd6NJOY7uws~?ke-($4!zUt%kJNqrriY!x3kpT$PSU0?(`aP z0B^DW6%x|<&eDm-EA4CC-erfGrUhNqS%5xrGHV{CfUaj~3#kncac{M3!5;)%H&=N2 zalwey>HTv(ktwh&d5BmtU6SyFRHHxX(Jeo)%~@1S+gh#^u-z^CKJ z>nAgyj-bCzNwiFtM@lL4wVFEkoAGU+g(dw&)R#GKf)Sl zZDQnXXK1Y<0}{tvq?cRaYF%M08ud+5A*9v9jKT7K0T4bYP+Tb^0hgk{^gUinD zz>Y?$a=OMOP2;fY>wc-<#ZAE{G}Fvk$d0moNaZsJxMiPpd9m{jdt0aEpfW`+mcQ{n za1-l?Thg;3)GF_pQ$3}*Kk2AOqTkY1wo_MRjqnsm^9wS#yr;YrMx}I;O4)eAUm1^< zd^b!%91rM%L7nFNJ+9)*I)DReSM=Z>=Dvr(6IOUvFfif6lE>-w@uE%K(cW`C-x>`v zDc`!wfae%QKZmUWPNs5}i#t*58mi98T`*ws6t3ori@o3xw~qTP`pKz*T+K|v%|9#Z zN`zEq6SOT1+T8S#Dg`yJkh6Ydov9E&*&9~2GU|1<=kZhi-FEx3G5E^6n)mYU{j!Sv z9;~ysVm&>|Q3-{mG+RJ})9;2m%`^n`t|1}N$@~Oz>`z(PLk4BTe$D))q8T(RWW)Zwlmav6T0Wx6+jxxn zz1JG;_GKeTBSP3?J(HR3Zy9l7`}2lDdetgfVra6E#xp#az3LeOykj8xUfgM?NZ9^@ zBK@JzAqO)a4T1tIgzc0rVOfbr2x~-X8KL?lz|q%hRg_EGEjlmUL>7>lO!8vDX)UG1 zyzmJxA)E%L$PHI#WzK1V)h3GaEPV!yOQ1PD5njjR;=L}8>QD~IU4O0qq7|5s8F>1h z7zbh9DmzVHCn@@t-(!V;h_^sN3eP*)Yc&>Z6 zIUM2J?wS6g73zl^l;tT_^)2`KjNQDN6(>D0VU?(4DJktf$adRjj)nnRN{W&lb!^ZZ zY1yw-+{P`u4sO!1PX)7{I#tAc%Uut_qVwrII+dZuS#{R()frL+bx67`%uPnwf>IR{ zQ8sy|auht=r z^ff0Frz;zsW=UWd9^7r?c^#A`g9ricn;9_A%Z5cnet{YR2L7&BLqr2elVy-g>A~Pb zZjACv-EdHVZJA}6eCL%8Ko=URCWn~%iQR4>-icUpL|<^V=dakV<4pVgxSYw<%iY~~ z)`xhh%m@-oKa||LDh*r-kUbM(qRVO@QB;#fjeRo|0FYFp8ResE&~(;&XvnD^YJ)6# zJzPvSqYJikzf6Z{G^*T&@Uja4Qdg+fHMDYGdaK`5jvaC~jae=j5AgJZmkH9Bdq65s z9_*ez2xAV{rnp7}Ob><&?jOB)tLF1NurOzIqy#SHI`%&=csqL^fkw~d(;0IK1$6|I zC|UWxj|LN?0>Q205M6kURI5Nri=@zfOLca+XKikahUGS|c5>9ihsuRo-9^1`6oD%* z)ogxuE^69(lD7$elx93>XLoN`t7Hv^kxS)l#fc05byDG0idG)al*+&RGPH{}= z3-NQJ!uv+eqx!%52&RhqHJ=`e3{&T)E;ym!F3pBB>Vzi8ey;d zK^aB>|GC~wK79t!zM|GSr9e+C{77w8&q%?+zy#T7Y2l6k7^=0gHq(Fh`@sw4&BG?Yz0>83W~J&0A)oAagVdLH3ehYU=4k&hEe58G z%YaX|HX)MNtbON0NN1cLX!Ke%EL6gtDSeiNbc=0Ogc=Kg`YNGD)Tk7HJ09}DzbiBi z)fVU*$#^HbfvrXM>0LY-3pD59R&QUsm=$v6}I3uRBML8He%uIx2B4M`@>+gJ8a|*cN)(O%CGJKHvV^$`}T-`%xg4y3;ttlDw zUEM|HW^0=atH?9uv+Q*n7b3n1P)q5zuKF7f3CnQC<$J!b#x`t*4Xf54BEqm{xPyg0 zH%`7VwSUay^ZaUG`egG7?didxwU99bq?-3T2*dBXh0&o$5Ph*35RWg7#hQ980PO! zoov_mo7FxVLdWN!C)sq%W!=UBbo082Ny%k>$}hVzA+h?QP9n^339HpqDZrjN*|Zqj zlhOq_83VdnS!fYYq+%n)UBN2|B`!lS!UGe+B4=v!Xagubh|x`AXbrR`Rml~ouCH(c zC21ul1e3?8W$m}mN9ju~K4)9>z(WxriwpEq5@ z$z_ZVm=0N}?+9s(YH&MHPn!#SYy`;;VO7GnEm=Y#mOp$#dscCQ1w7!_4qVLZT-B;h z=HaTh@24ec9yS~}aoImTTCIwHGb%tS7BQkZBwihi_1nY8r(;;OL-g}r^kaX`thT5I zrg(WaULyLn__1dz*|U~)X5L%Y-yi#2=@x9VhzgyyN~4=hd4Rx*cKANrB6BBt5r^7+{9=bQ_{;s{S5c6y+)n3T20Iu^F-))H%4?tu>6WM^jU&>m zd(X{QsxS-p8num}tw{K;{l3N$xokeqwzrS3yZPhr@%s64Ieb1%th8K&(oo2-v85xE zJV9>70(71#^LNBVu+gfagclV06=f+-77&z`JmTw7$PNyFyD`qtJtvfKY-2F>#MJf5 z^$(WBYU|2PEPn=-gCQ4HHV5Pd`s|b)Gvs>YIX`R&j?Wn-Iel3omL4NR9?HzmkE85v z+%9gMZ+&Ar&A=ct`MI^o386+&YZJB_*^JZ*4kNV$V7pKuo!WV!aKr%O6gY3Y8t^>1io^p64>+SIpZSdbqjtX(xw zqKdAta8#Z!28*Y-Z-Gr%RaCTEMv+G|OYUcU}uw6>wP9ETiBatQTlw5eBO+J5Pg zHr=t)nT4ItI6SQ00Dsc%2BXz*)nlF^Zddui9=n59w;V}CGq}d9FRzqXs3Q@#e*Xm~ z%!ojZ5_e}~>kZ$IfYHDDYsM|=FB2oB#p>XuM4g&!PS;i|+=hk5aBl-F*AJrRrksI> z_dBvqDdJZ{WM`hPQSsG8CFR*eCs~w+{OWJe$JFv}F*HAP*xhg{Dhi4x7?qw{L+XOg z3$@?Foai-iG@Z1#vxss|r#5Wf8~WN_5?rlOgxDV1CLZiRTRdW+hcj8DRAcPd&BC`L ztO`OrnNPoks*(j3C5XngiX@@%II1!fw^TaiQE<(oFj|^aaBotZ$g2~vRTIAq6gee< zpgAM@37WIl+U&={od63;Xio%u`;VkqJk4 zk`u7AMl;?)**(0CoS1x;0$}e{t}U>1*xG7lp>0^!2BO9_Y4Sfn##p6C3UaVp?jDW% zbd5rg1uCmfXYtY5gR|9TaDc_m$yjmdu&nXznw!#Ri4kT{nN~nmwu8mwZYqtD%E}>+ z*dj?;vxB`{l5x6{G+G#4*G^ zQ%EAUpXEFWocjiZmv&5!nt03Hdf6=CoW1(6&7J+?o?keYE1}Gt%VVmjqv%s?;1w!P z^epl_k@Hr?cUH75*@l`Lc5ohDX6ce0RJ zwbY}6?=-cS08s9Ajzp&m^M;G&;=`k=n_T~~u2`fGQShnTY5&BzGM^sh9ljCC7NWzF+BIv9?4=HysUE^lX&|2viJ&( zi%Z$UpaE41iRr9vQ1!SZQZWgkt6#vQUSHD0{*pqJPmu}gzJ^%MxExNPR}`BGg9(Y( z0WW4h95z-jS|uzlP#Sq*^rnAo!j0B3fTKQdGt^JrKCwrQnQU_L)LG9;+N7_oK>RXnr5rjts3-$ffjTPvseIWW< z9`9&At0eOj``CLqX6scpl~!HEOaG9Xc&Rh9PvMt3U4{0W7Wv(YqLlx%1VUj(x0d z+;kspf$I?0x)}@2OKZwXsL60T!tP$4bdVdp{P(Q1ZGRKQi`lEWwro#gS!PD|Yom@j zRk4n6z%U(v)n9zQ@QGQ0?C$!e*}`QP2(%wq+t?DzaX4yLf_A}>Q*`}g#JE5i(XGdA zSw&og1-jp_Ugn%i_Bi%x(u1E4x;7`4Y=BxC018TE;^B91)K--siv+wg0r5Rjjh_%U z=uA=7fK{Bvu^9`A4e!hhk<@wmdmxXdw&*>lS8?b8XChm^f-q!5K`hptRntPq504v* zb!||V6T&tq#3_&$X6^6?M!jGe&`Fg=wf*S)k}Q`fC0s;tV@V}^z?~AJCZ#(T63)$t zg`?S+1jT}d)Vk4M!H#Hd5jvB(wzg7HXnJ2_5{hm#YShx+1iLksQZEFyFQ1_(Q~>nU zU=UXM3*4PXNx$qGzvB20kIM*C#@6~HEvzZ;WJ0**xc`e{{z&X${su>B=eHCywDeI) zIgHA9Uv&Tq-g>ogdgbNvuhz}nlZKo`9q@r(k|9vgC|+b8xc!v{AMtWk&N~z_JxGy3O)r9WX?-mR)bkwqgmBP$H;dC#Rl zI?FG$&fJw+cuEDLxbg`@wTPgc5*Z1Ew2=qcHYF&asbc;y>OAMCR>EI%{D}nSsE-5q zM%Ed|3znuMSZT#>7h+13ews+2>T`=?5z?=8-dUpQFi0^y zSN-`<5W0}6a3Fat1SuTTZu%kr*T*5i6u`N1%2N<)GeDI8kB`%x13no%z^vqPQ<3Hq zT()X>g=W>-1q-1>Yj%zaT3bw?mQ(q=aKeHM4EWO@+(ZFH9fZz4p5zXwL!{St zSCN5^&sn+;o{)EDxoz z1w>JP%vFZf3qGOXH4woqqv`qc@H`w17wonprab~JCMujIp(1ctN`eWjS@%}=X^;$z zW9oQ+J{%n<7Gb$Q1qV|nYleu09puQ(Ah+^=f!xY}133XQ;M1JTlDYKJwOs8~ zEMS>6OjyO6u}4^NtaiK#_7@sQ0YY?1n2~6^8vprT7S;XN()*9%`+0O_U&Bu8=Bvc( zzi#@AJz%%hWQth+U_w}VLwoIkwE1%7Ae905WLu_b-*t>;)U9RoW;`HmX_05p*yatn zK|l;=jt3!%g{%b>+SX(eD)m_yuX${P9&y;^lniz4CuWi`gmo4sS z3gb6AkJ*fdT!wT@bl(3V}a&ATR})5$nc| zi2l8kudSmK`1=>7&|Qy2U_?$T#2+IEL}T?z>ORAxcMC1VIY}r)?ToBUFBXJc0#hO( z`BkOBRuzjd+xmrDf?R;wFe16ZA0PMDw?825DI$gY{aes>^=S!R13`>A(u$w9Y6JnQ zJARTYe8n~yWV5xX3y+e!F(XW`fu93sA)(&XPku^HW!W~iWZK9}v;wG(aw!~HAhGVH zr~Tf=`>94Lvoc*eD;qwg=Y^2Dit_h395jViPFMq7LPIf(U%zOhFgEXket^7qzQ zHYi;a@qO$4qjA0Zmp7j`d};bI;3_NKso(>@I!sw2FpM+Kgpr_)!KT0ogCV7_9=N29 zUz|RzUQtS!Hl4t$KTJY zkMhr;mVB<0`Itq9C00+3Jr}Bz0jtSuZDh7ZSpjVW?4Nwi^(Ij~dD;uOLqk?XV^y!WI~^hERaKpDvrvj%~W_EP-}3SmNJwFyqPDQE0-v|ZA!=EYefYrOF6U}V;1g@{;rwN!F*ST z3iNrbZ3qFo-L{v&>g~5e8x@uFde0O*Htk-&e1Hq;l=tE_ZefCXgRsG*aqmx#Lf~e{x!ihVF280lKz3va>)tG17+zE zM6Fnn8KK_AYU+V1z71B-Tf8jpd#*Cta}t*;SuY1(WCz+SBx7vp|-niZq(Gfw?&GVUfps^kKhX%ev zF$`}iVCDIGmb`{tODvq1OgN;*SKO$2`x5rKt&^9hNSec<{zCWeE%Rf;uScJ7=HL?F z8GLJo|Loc0M(?OKKmXJ3dMfQ1_!{vpKBCYN zthLzW1|MyOxj0vR;L($1T?*#nijjb~5R4Bc@3@LqJYXH>op&fc=$_{A20O=X&5|Px z#GGbiz!Cn=OVCZF?lUrm2YWq+#S&k^Ai3*^wVSm-s%ViqS{VYpSv2Q#Z~x`v)9Cmj z+vG7)pf_F5ROik#E)w3>b>#q@ZpLyQ3^%uivz~;BArK`2*_)hLRE|PC=$T>OHn&uVazWZ*fW=!ya z*A5p~mQ8%u`p;5+4vbdtdpDm2ZVr3!;QHPh-JeUYnULuMb4G^s276#=KCQ`fY%83} zkg3Otq{UJU2enu-|BZjf)=<(uPnW=qXy|h9+B>7#u$x7Z?DE#?>(&HJC^1RakF&-h z_SoRzN9zgT{U~u9i@qpvhxfV?v#+FPoWC2)nVXR{B#t%={azyxLX;=HH39VFEByfl zvL;HNh-}ai=xQ+xa5jYc@le6oeV}$Hus~Fgh7k;vlV0c|7Cplw2~@_{KVT75TuKHo zbd-(f9I-!?cKF6!-8>uQ&aEmB)r^DiQ{|0VJq@?Mm{!7~Y#|hPFbpA*B54=ttv#b@y}ZXZ6Ds?2M$*GC197s0mLYT)%*Qw>sEv^4b=6 z>#u0rA|3b4&Dk%_cG$%~l$~$m2%YVDq{||+4L5JQ4$iL(A-7wE7D~GWc*jLiE0fhK z>RV+M!^&RrHckX#O_Cu*D^Y!s_#k($5dwUS6A|kea|0lh{>%5_IAidg42FQZ4Xj`c zYwCa)tbO)gq+YmA(Oh)G>d@Au$g2IgfRF16URaQ&LI9fzI)O^TZfDs#5!>A-9Im@? zyiZfK8E{!~pmF%X^R^s=cFpPO5JrGkY_E`MSB~w!YBy4l2ROe+Zd*PJ4l}yCcWgkA zTzc(~T5oCeO68 zpP~7?NH?zxEApK{zk|S069Us_+f!GhY4xB_H)JY(RjTR$Xm+K^rscGEVv|XV_omUs z-jL~=W-|%q61Ea1(kQ{~s}TR%0RJHe;~JZxJg+IXCp2~~2K#(GI6Mwdy5A+eZa&Tx z|H(^0+R=JzB&oTKbGm)s<-Rou*{T@l6{*^=$}^x+3#MbvF%e;_3-wKSid^3DO@-gI zo?eD~YC^q%PQ3pE;{3!8*;3Bsi{_+#RGF=d3MsT(^lp;NU9J_Dl!Am>n-25~Ch;f8 zjpkZm6H;x8T7~Wt(&Wo>Juez%v07jQB0KLkjj$mX>j7O(1$_+Vz?`K#c8E+T zXh{4gHG=&PCMrl)5hPXRJ^$KSGx4XbLc|d!&7m1mIsg5Q=G@j%vEr)PlmY!9oZ~}AT{AL)1f5ySRGm==SxWqlNzVkD};u1HWbM!m0Rb!#mMrm`yi7;iAzZGs_W%Inzj#g}!8!26c zMOk#5DKgS!Lf{_6?_IvPKKNYjx#l>-)&Js{2M9QK{+`Rx!J>a~ISqk1@l*5)-yB!=#yl7NqCMR`vN+gJ+4`ze;mJoa$8P%!_pd$M)(g+Re?w zqG(h}(3#gEs#7(Y9i@+y=YD7Jd?7AJ+hEPj%aouvcFgeN03Ga@<+%4~bajvYpqw6c9-IAegSX-4aNWdl@@?XQ%1D^Y`ZnG=`%_kZ(Ycnx^wcd=Klr z{=>GnUy23CVve7ThVJja&aY;=*H@A* zop{FBU3#Ys=xrAi4B>Ey-&!O5w%4ALUzbkq{hcIFPdp?w;1fGKnW7KP%>liF@0YqP zBkNc)%(F|H+GPcnrUvGcK}kiWsL1bmdTQZ0l=(UMtTG}W(d+&D6)521#9}=JmHJtQj^|f*wOcx;*mi zOay95$s!X@8PR>Q=tW}*x}{4Da;RD03^@@n>Y6I2-ZD%-2yCz zSxqK*UKEWJZv&>JnWHE;!mxay|5@6L|ih1~AUt>iLa&hO~V=TYceNGFZE zksH6WC_ulxH5Ct5hpKy4a(V#8!P846>D~Edk4>=p23Q37ezdwUso*9CY}+; zFt*6$-@smYx5TuIH2;~=&fI*nF~ZJkWF1xNx9zz--y z=j*$a8c5C~2IWL@QbbU+qL~H%A`3Yg#-$@>$S9_|Y6gn|iXzj1?ug+Nzs@?Cn@H_@q%VTIV;Sbic1lfyo@ToNFS zHzY9^LISpy7%!IqdV)e9?(Y$8vFlj6)5yhk-6LdS0Sb7$EC5~pH%1d6@&2nC4XM|< zjtB7*O)F;R7?6tM^A(*QZxxSR!E@zGW>TNMEOlpdh(LaL;RTYgv zrew!)v1zR0jYBVP=W%iy=U|cy5C=_C`-vDB{|N4Is7~H10fkELq$pP zmYvub77XC7>awI>O%AKr!_XTVZ64K4-Wa5+`vgVFf-V-K)+I%f2W7@@Ee98i%VITE zg}@3GdlIk_2Mu8d34XU)V9>VzVQ?#a%_S6ROUVe-MQdjd+ySzY0~rlktXk3ywyhSY znhm^GjWiMpI+Vf!3?PcZx0H1=i}Up;@kPjyER3^Hitto4f*wdmg+53 zx?m4c&q6j|d2TYA3ABz4aIA>v)wvLk!2i^b{oVH^x0xQwKC#igJowymyt$tC_HytJ z-I>cJw`KSsA?RmJ;~R%u-3DyZ#BC3!>Z3!YW2I|1nEx1HHxBUCfg z!4Om~Q1EnD;#L=Del;cS&NONTn4U#xHlnAHmP;y$##AKJjWc94K{QS0-oIvCSytDH6 z3D>zjxINes+cO*}mPouxKslxw#4LHZ)c?bB(`wuL)sVqHlwrNb3h z@2;-BT8<&)-u>2DUTt&K2*64H^cpf)o*pJ^{H40ws-wfMnYD@GuDvosflNs%N#Rvp zjMDyVDb7q?y%GO-HGtp8{TzS|pRRy-1?UDuYw!YLkr@sD7764$SrF|>B$Jov@8eql zR(po@dF4V}u97%?Ee#IrA&oyshr$d_D8UQ=061w; z-1z?hI5Rtt(^~F$getIFO(?kHYY~=AAr!LG;GMqh9Q^wWYC03X*YNCSZ_jCO3;D=+ z8EzO^c@8NCVKOa%UI4Igybe4E85R4RbtiX1I(24lAOT+Evry(jLaP>Ip(ML27BzbU zK1yYQhM|LHW=%4$|MqWl&DZTmXj-cFokJ~!N-_jOU7sEa1XZhwFt zJFq@3F_(j)reG%%@^I5JsH#h$D3Ho`db(#!lbpcBF(&d^e*7D%Vlt!*XKtBa(oltL z1MYQK?}SGEQQ z1d=-stWF@P-&y;#4gK^ju0(wNA3DD)+8!t2s+B@~IyUwMoc6F_o8ZCYI7u%)^Dgo7rnZ2v|%ZTb)e~a(<6AnMUR}R8E^BK`hw4@tgITySltL%%R)t}XDZ@h?qNlX z4J@=##{Q<6P#y+3D9DX8E;o}>uSuy*1GW`hT%$-ioH1~;1{ZnvIPdaN zLS%-I-}?wjQ}L&OoUiL)>(3kUxpPpUi&5)8Uy2xpIqtGmjWem`v9szYZ{;Uq7mzE@ z5Ymm@TSBF}#L>U+jgLLfO|M6Oqw?7{pKwL-pa}+-UQ87lEV2!8Bg7=;Ub?$RKzD7= zx>eP1^@WSiIqhNj{SGg{7bQ9*Q~7Omc^ey&BTT9@-XL+yMqSnN6b1j{D-%|fehLZd ziVBHFHq8}(!{bQsum?~8>$=r@3>kbsGaIZe=Wa@zamk3ze&0=htpS8T>}2Y3!iaUu zV>rc#9#fiwJ69Xcy-`n3)OFZVq+EU4D`1Lf#l;d>n9`G<*EEBx!mj z$J}CDX#1@86qT4}Y=3b>vr_9@#9_VZ5_&=+!sm#?u^eG$>LH;$A=DG;+IlnGmXQ#~ z)6aVNvtT0fYO&;vBVuS(`?n#o;BLW$TFFOjQ=P9{KZ`EAhJlj9tqBetnFy^!;*H2V zA3V#eEk-aqI|kzFSFTKotvPKom0i|-Oy5u>cX)TmC~-0c5(HoVvuw+FU@U(&kH$x0 zlb=c!4>iZo(gVV<_5M`JdQTVgD&jo zjN7~=!-Rv$nXr=Jf~3KGxvI`e#$KD&QCP1M0Yz=d<#;D4Vr6lwBe=aCQIdbWTL7@2 z^$~vSK{rAD3+P6S*?mGo++^%Y37(6iH)3s6mwDE^ z?p>_Zs<+)6m~E61NA9WD3^#!RZk4!ZFG}Krfcj5@^5+p^Ej)(7YHhv3XUg zm!Fzd(w&TPT;POu1Bpf7G?jm@B-;m8uJ?w9jS%Rg=gBJPh47XvbRr%`oh9*W1B_EI zyF~(8#|ip)2zmMAo&>l0$ z!Df*lJL?dAubh2f_HEHmu&T4j5MJ~dmzhzx?D_X5$|{hy0$unpn?M9|r{p37HK{!o zr;lSy0$^#!Vm#S;1M4Q$(K-V=1SV4_mFEg7?1+^SDLh0)69?{O%b~|GPf{2w`3JLE zjge?ChQHd*x;BScqRAi=76bQYQjNJ_QOAb7wV|83sc#w3{bXhilUt6mMJ$omFV ze`93XHYA)rUKPZHLE z;*sJDc%+SmjQKXQdDI}L;b9GXs=}2XTaGuez z3xKf%eJpY71RSFjlv$}a0(~X*=1Dn$44uF5p1QdrglFxD6X48kCj3!l7@_6wWgbwJ zHUQ>Cm-s$Vl)*}Rj!$xU`||IO6}-w(CG``G@*M6bFnjfE{s>kf=n$zhPRc8oN4UCz zt2{}K8&R%K_7ItRFUxciAz5aSgtkhZ?u@V~cdUWWj202r2P>=2&LSyy{v03)6*NXt z)}T#%+@bu1L@a}0OdOl2pB^kyEh8|lTxovJ~aH81CGk~uQrFl$*QQpOoEKQz%%hxd{-#-bo_ z4!8)*&3DTr&AmW+J?WQtLqaxo`6O%)o#-#tUh$FNcL2tENwp$uVZ{mM1!>IGl|Jmh zBt?eYdBD_kG7BWrRpehDoJkAdiNXChy(?rTv%z!E@ESbclQ(4k1v$FMO?a1?FG%d{s0)Pq>W#4`B6aCqhWP&F~*7HB}P!Zmv^XNbY z=6~j)*k+MSO2b??m{u%OXD~Tl|A@6;oc)CZBiwNvQfsiIEVX!#9&c1=lTC`%1O~Ap zpLzv`hG1XIPAE&Ao-xfJ@~x&YCKvMVCnM2}nz5|gT0E0P^qnCbF3Gl%+DyTpv!=E= zR*?4fzbL=UMcS({f7-!la|sbI`E-(x`Ez9!m)TWlICTZ^ZV^HaJ4e?ZZ>~-gXf~mf z-GYPH+V*8i%E`62eny+dl|^JodB%6zk(O>OxI`+{)A7%oFkc&SOZtpa9wFyWjAJFu zk{Ikmj{-s>r<=uQY^DqtGB#fOOpb+UID>NZr8C6EIINU?5VJ_m*9cduRmr>o`5oB91$vu4#k_DogWp(cf9u2_U}KfEqNIfvadoaTvaoL;`w z{*iQt)c~g2M1kG`=x*VmJeoa5g&MyBZbZ*=o$Vi}ruX(=P_6A>sD{=44^&%J`xmNV z{eMF>lly<6+IcmkavduR6)UOm{G3uqkznY;H5lU{%VnqWZ$?DMy10cgw9;v*)jFxE zw;6fiMhR(@QcObW#1ecWmPmvnY>V;L zXXHPHVA5&slwlHz*#;9erFiRVIW=jz_pyCg{!7gSpK657>16(YF&iz;W|`DWi0)bX z{+5AUzMa)VVkAwZrt+1RR)XaP7!}|#@R+hIs*3_CyEnjqj%{F+P0>{~2ka4pJYAre zBlho~dD;th*l%4pet7-8Ra3{Z8ip)az2ekcNuIGR>Cwb$jdl7hr`#%*c3LbkU|Xor z`{(aZla+dK$8056=>&9>nP8&{LN@O+axLFpqb>0{Q3#Toe@%Iab6sfjifI&}L@!lN zADMF}{X+7dF`Nd|f#1M$ldC&sR&S2|c4}bv7Qu~tLvQ}NAWU-LRX**O9l#0dvYU(d z>*)lhj`r7f{CA3FyB2$Vx)O`(UZwBrrF7P3J#P?-PrQjNWs8e!O;BdDKtaW@*KcxuzgPijP~xCyQZW-^85f8{qi)a;rF*euL=iU3766nMs2Ha zsD;VR-2WVAqFrWd<4TPQoK+?jY8#+dv}YD&&=e|I48Klmapfdxq;ih|{93bbi-?a9b9<^yWy*A=yJY2sKtJd^6PVpR_NDrfM*{RZ`=2o$jrYE)FaNF$V-ezB# z4fpSkJ4{*0B@O?p9_61^WL{P}dBHah>m`80+W->!@2+b)7=U z3DWMDvX($Y&*3j;7x6Aux31Sz47;+DdJSSn{d~EV@m`EOjU597*5)DmY4*;b7$P|@ z&0Ib$C<+DhtXAH1^jI!d<*2H@V%DBbV5Yh(WeG5uS2L#bxK;W@Tz$Ok4HcW7Vww8{ zt`^*M6&0b85{sb~vo9KMm9t+P!pM0bx!)O=sA|kBrKe|)jbi zSr0t8ne^^+X#Jc5-3_+e*%U~M6oJy3=g>Do%xWpGo9T;oPKreaQ9(15&`dOP9cV|0 zn6_0K6a6zzt)a2hr&<2h<7o87^Fp;sh!X8}VxkK0GBL!JW>OF+8{Qk+)>ow5tb~*V zN{QH_iE)!WO;q&}8U8Cs4}z+rQN1gA*1zM<{@Reg2-E#W3uYI)iN`PkD_q2B3Y4tO zA!}cZ;(;CRl&Xa}kIOBW_^-`!R^H)}I-xh64LHg##}%&_Rn#{1D6a2Dp)6PPc)aeC z=?URZ8D5bC?ffYbsqI1d4ojloS4VWCy2%1!I84G0 zfr^ML_T7DIJ#c>D*iFqy^{m-Drx{V@1Ek@v$9ID03rAeZHuSnHuz)BDY8COA(Z{jP ze&xZP_seyr>9;i_r|GKPKl{t$RmoK!y437YQ=7Ieb5m5RAl6uWO6}_b zBXz)HhGeGP)Qcc!Qb(i8Bn<4Is$^7(5DR)G*ake;u8``0$AS>_;zA$xh^_ouCOc%B zOwGzK!T1{(tHprOb3!Av(6K!aH+A7ALFD2kpA`{#QVR!q0(@s00}5eLta1C9GSOVqq(P*7~cmKU7>V#&W+X77Nsk zl{M_apJ~!7G=-cA0SXtkmiKSHD6%m%KxUTrSANl{Cgdusz5r$G<}nYxEGO&4We|pn z2`lzx4HLyukbYRiMXDRfOyH7X&w9;1-b|WHF|i36ji>v_$HPUu?mZjtnWh2Cn3h{{ z&Jp5~a^O>~unDbOioBLvu%UCV<2bHpOnuSSdBA6U!18DO?8)N!e87BveZOjOb#V31 zQgxG;lZ(5wj*3u$+90kp0bVqk?4zwHVWXv!t10kMIwDm1sq=a=Eour(JYYUw(8gBc zE8__s{{8)({Bu5kt7IEH>q*vwoZRI91PmrX-z2PxJmZsN`mTDLu1y9^zcdSsY>)jHzJlmJi z+WcE_cb4X1Ew)}hQ;@ul(croF@2{&Y0*NUuHUA07?*{hoKUKXv=V%HGSGYpyj$ zpj>6mv%W(|)wrOkrmDa|Pl=uEA?BjAZ@;_oL)LC9Y|vi23;$hqyT|xnr`zrRR;8r+ zprEP>6}_ohE{iymSr#fFK(ksY#r@Q6a6K5%-qAtVL?t!xKb19_Q;HVwXUYKP+m6eD zOHz%{l4XY<#^9#$$bKG{BBaN@KW8hJjlWzb?EWUE6`;_ikXjDM?M)r!YsQ=w%BZ#IX*j6ZLwA;Zo}Ir@54_mDt-A z8EVv0vl=#Ygv!m~jgVJHOdFAFOBRu=3|t4jKd&=lviWnD9k5b{YZ#kV%j%v!!sW_o z+<=eb`g?Eq@QLmLVer);+ z95ad(ez+2MJz29~{dDpU-1URQA$8NGMakd03h#F46~$v|1PXHX9eU>S++hV8*~wB< z_*Y)C5~KOyGm_<4t(l7~XF1E!_{W#s$J0H$E4mgE14 zW&J8=<2%gvm1CxMrmviKzDbU+I&J?^vU`>DTAtUdTt`ndqt`Ab|F`AxDwjuP7O!%> zKhgYMHTe8NGk2A9UYfJ3T)U5ut!qbnzneT=IX-r0=*mg`U%9y|CHSLd<;pW#Gapyp zX#SOntHgMI@Elxuc57ze%A3zq$h%d8l^-VKRw=KwV`2}SWot(Rzu){?C5)Lx#eU$N zTJ`1hV`tMUk%LZj>=83)?P~3JoI9(8HQfl=x67ARhk+j_Q&tUbHDX_nnjK4{=|5~< ztP&X*MXjDfF09)8{GeH|a{SlGf0a|>LuJ0IZrFF0^9q=$^qH49$4lTkQg<-y5#gsr za0_=b@C0v*UeIvY>m{i*T^6orCBC;N`{cO99d6?hk*dDrBRHM=E|Y!;vj&6p8$=5d5~I1$1J>f~%*-5I5(REkk5XV?iFXnk4N zqnEqtz%sGBb&bO^u@=||8s8F@ zsZ`cY8PGR|WvXv(yI`4^m3>oKCT?m^9hNCCQY&M6DzHqNrc?#XB-_%rgJt>#)?@|C zRFJN{Sv?6@CVj)IfMv>=);EM@`WA!LL%=dAWZ#J4Jq=i<`o>oc%f#%i6qf125>iNN z=feUpWx2J|bR7Vu2IaCtfB)qUk{#N^BDKMmXeC>)rNPl~IPAI8{n5c_==b~GgK5w2 zO^2g{>0p1@n^h@^x7S=noPsvok_GcS^tAKh1;>xsap!_;$X4qD<_*J+c^tT<0!KBq zQWI{eVJ?-&{G}FE-@1^rQhDJ*r@;>Zw^ZauLnn3MmKx--N+CNSc9=HGA$BgbA!ABs zpu(N)W@aEeP@N)?+H+8&vyL8c3RBy^fKy6r;(r5hip*+#;1t<%z8Bz>9i0B?z$r@h zD-Ve(mHc49DHZMeu7Oh&eAPc9s!+iX2%J(+L_auiib4pxj)p3%<8gpfs@nQp1E(k$ zt8*+=p@=5~oU)6hA0IenhXi&U9^Ikarv{u-liB}uz$ps3)INf$FoAD;0<{)5KP+&H z%za(|-ID}PQ8V)00;lBJspZ0ZdcY|qYn(h;`7G^PATEM3OJ=iyN?5$Qq|t?2{=XOqZV+A zEcJf@r&LPt2Lw*ZFk2ruC1W)I0!}G0o*y4LCBtrg;FOH{JQ3iOU99{_z$t28YsbVM z9yq0{f!{T7ii$C_sMwDUoKjOxKRj@XN)9^FvBw2Ysch}{4VJ| z<&TT_QHHiE1!17jzMV$|Hkw z5x(MPu`l0>&}&_27t4H1++A=MCP6&h!wgN=^sqOhCh;4iNYaFq7~$YH!MAoq(TewD ze=<21&ySxEM@ODFKCJ3`3L_mgxx9D1oLvWhwWpjUw((@cZ!3~ArxyL?kfccR4FO0% z($NmkC?zv*jC{P&0vb(yq!3>oWiOfp-d4sLCGpMUjCXf7d=RD-vQJXX*S1}WoCl-H z@!n+r@aSl?e=ru$#J=Yr?;Vc^{=h#t+J9C(ToszDFMY$wANznMdG%jCr%Q)_K1EdlSjIEc z;s52+TXlMoa@U<_$8ocN9L6H!e=KOiVvB}x1x{EE?0&x5$5uC56 z0wW6}8s_32&^^Hen{oo;v%YY=iz`QTi~~HJXZOAAid)EqYX%xr3^+ggc>63H%MZO-B*TEN{(D6Tz54aa**-h{ z{Kon8=ET`M+TYt@81x4D^}D*dr<`LW#KR(`eJ;7Z1fD6_yZ)J?M#paZIPYA)e=8KP z6}$K?%WYW4S$P9<91H7Y8D&_d!*f#gGZ?N)E)qLZ?ys@R*D>?OnDQ*Tgu{-?(c$8L2 zC=uw%3iX^X8CPy!Y)${jVc^aeTRUaOT(I=3aASeG9T>9Ezn&-G)Nq6)BQ!DaBo@E-KS#LB##cpE%k&E%)A zFqt-VV6bcn5(=jYIadIt5{cDwdnJ`gDTjk=8GFX`sw($uE}LH*9PIBVKHB1c`~9W- zo&Wt4(ArEwi3B5|Xj5Nihc^0RO#R&yIu%qi`ENy)xk$b1OWgdI^oiUa85c+h8g?3z zV;M?!70{(Xa`omuqq!2vb#%|Zn>6luG)4t+oC|hhIL!Rwhep!q!V%R2KV@Y)3IpH< z*zPQ6qY){~<4pSib`cq;5tD#UMIHx135=atG?l&r?1EnsKeJ#%f=JR44s!v|BfD!_UL{V$BtjW8XKRrA@%k2-O>@}wGLJ-*Z-X|gO<=a@$B zU5F$h5mv*!*>{8Nm!C?$G_&m1$LSL8u61va-3<`ciEQNL`o*W$#)V^Uxxy6sIVbrK z&bk^*@SrX0*%C^7Cls)#EqwkzYG8?9S3YhF^?Wkc0ER7P-IZCZHWNvSafJ z-U?tPdK!TuuU{QH_@h~ar*BdaN`Jb~iadXjsm$xiRgzV?p7b};lUT3QZ?N=n!91Ku zJ2NvP!U+44Jdf4GHVsPZl6@0259Xgyt$NxdyeyeKn(``QhVA(x&F3djxy6<2>$NPV$|#J|`o{G?8G zHq;~)$8b!?^8jlaz{&0fi9eGmHU*^-m%iNm$wIQ6OoDIxjYC+urPRG zwC{Klqo!vhK@L=x`;@G6LsGKB;@Uht8J=sAm^G+*v829}+fSOAtd`${+{7rNAm6ln zOUJ&HM8CD<@EbT3`~|Dn*LaUe>Eq3fs93x)Fu)wHjumTQFJcgylbd_xN@#^WKxC zj+O+?2qHqdeR3($(^i^$9Lo#9o1Qzfz$!|$B9rU5lMYxA3-0`0c9q**$~O1}yeW@6 zh1r4&iPn|K*tBemW$X<JKP&T1@)k&aX00c3T+&flcT(m!wmUQFXCrS` zh~M#=%`i+er#7((<>&(3_0Ug(9tVJar;&&8cDe2i2J&w9-QdlUpRDX*eVh(x(z`c! z3mPD@zFfr1y~4$!Iwdi33QLR;s{C&Yx@~74iAc1bY~H2Uu`g0rrfZETHZlu+Dt&XY zCk02<59Eh&;9XPcsm4K#?RWyjRmN}fn)H8$ds42JFQV2oF&i8z%6~ z!`d*RkMB;vef{bqBH$Ivjn~-_ z`ms>mwuU8a{0`C>9ZVckh_+k_0k!f@Ul8SvZ6yh}GRwYV`q>uzWdn7&F;jgzVy_0+ zRurLRsePbVKohp?HyjgxNpc069>a@UfW}mU^3@E8m^!DRK&L+QOg&O_09Qk7o0Ho( z$NJYWE55li(y;}Ttu!UEY%7qcaTl>f9Unz571r}O(uq$tJMm;h#0rEmhqf7rWEtU> z)len4A{mZ#4|{FCy8tBP!E1%_&T(Zmv1FE*USma;7`KvljPn|Sr*i|3X@k%;l;hRJ zN;CWB0Jq``D|obGiW=2&rc%AGQIDgL?HL#1%N4*01uF9~A7U7Dct59S7ev^L5QHMu zq6JBKMbHJ~D-fZK^J}t$<(Sk5KDFKdIoF=aaI(z zkUpzL*3#(Zch>!3|FFL|?C$~g_70ARdq>ZY`g_lg;a|rGgMv^1co-sg5EIi*3cTmCUJ;Hs=TjdnSS4vuLUX@)@u#T;EEyvJ^)OldEV{ z>nl@h>QOc*Yo%En&CC@y3Pj^p4JA`Kx*uC%I!JQH1-Ue4v$k4_^d=aIP+W@fJP5fU zY3!4iIGkSMh^E4%2IxE9@2I{jy|%4TVPzE5lB7kO{T|Kg2M_7ppv9ay9NQ3`HT*77 zURlP|_hsZuYW8O2gjw64QJ(T?cr} zxE_yup;q$fd+~Y{zzdmkeqnmn-8SCf*-^S z(qaOxZTLNix!2jEYq#Sb*?N0Oo9$67wT&2KRwmeYYtJK`X@aXm5f zmXyRP3t~3Y0bBR;*8Kd!WP>=^((z^@Ny;yO^6vQBK!luVjgolMIe`xc)Ef)VZO>U9 z@l`9y5cwm`ka&?PrzzIYHq+R=-fqIiG>qM8fKU|el|KVv)=ZIjHH9dROp$ozLX_q; zQtQWHis#P#W|2r+h<}L-Ta5$y)aB1-1J33a=81(V z2Vjf=8#v4W{|(1vgCLe&~iV+kA>WCymt8BE*l>7is1on5mFIP{j|-4%dNi4Fu&pgo_>s?ky6Koy+;9oJ7sntuDNz-D!1w;=;~7yh}SS%pk#>&dW)BTT2SPbYtJ3;U~x(Lx?OLhH7_48}W!i4t)OBFuWaVsrDP z)J9I2R3?mltPO2DU!k>mI&30mi)l9JOdZCF%uojnqPs9Zo7Lz#Tp~@W24X#IBR>`R z(iS|BSbVI6o?tIS)*n4)@ikIE-{u`wYj4&|EGTY;j6uF{nYqpBW^ z0xUE*c1WSs{JpeiGmkmK{m&(+xvxH+x%Cl{PICw96h-8CT4) zt`Y`jj@23x7Sa^T>CJfxFU2$~3}nt$$Su^aVts=)(A?+y9^s7Q=uRuz$f@n`WqlD? z$DM=TmXHdrs=BIJjRXgw3aBdSy)4N>OXF#^^1-EKgAA8D_Hnpo#hqIAxuuPdK#o~b z`GSwvQRo|0Is+^nonFNeEYlt2;MVEO5)$}o#Ec)kaGyX6CVEX z?;YpW0{Z{rkNz2?yUzxP?$8|`I@|yJ$LDu%d))T#zIPMtII^<*?r;w#co&U8fb9+s zPlpH39i|U-KX8XlRMOYES?7Ieg2yST(@2>%&Pd#emD}_4aj0tP*w1e`^nJ@)@m=(rxb@ozAz^u#&67N2 znKUa}uZ7cgg5Q9y>|2mrwzD8Qx6EMT(!=7eMnoUD2kxLh9PagDCO;0m7INosbl7)! z=grW# zEvTy6N`dde5K+=|mZN2uE*nlV5#I%ECz%dMmvVAi_sx)CmBqFbM7C%l2DLIqZLq&X z4kTS3bonGwe+ujSgIh%9RZwMZR5GQO43?X~Y9{l!AA5KYM@KlOiqDEl!*;xnmVb%S z&Ja}8gbH2A;y+l?Le`8#CkMM+xmZR|mi5)jrpPP3MYP~xIM?|&^F`uQ^8IB(l|C>) z4&V-PCJc}UliTMhPfyN!xX48uEzmm0V(MZ%4pM_4nG268s$jY#nAi^ut5|*`p`cnV z!+?H}WF)TRFCrYrQ7|T#a|6FBQgx|_A-i_s(_gLw`KwaH zT8wuz7aMT;a0tz?)(q)NS5MNdWx9aMc*JmvbeT`r=yA=*sJi$s*)jrCi z+QJK%JKkz6TipfdWEiPB0&iy`taAZ=ef#RYS^-wCR`nj`CHuYee6Z&Ze|J(b-A;D6 z+}T2SH&~8GBwUDy$`DU6w2_|z@t-uZNRkNTR!Rllv2&;j2veX0MN*J!7rmnih;j^0 zmlLpM5r#f_f3Z9r*GhJAJtmm3M0PyJfdHJDTpIvRWzmQTODY5|rmD^^)~!Uae(wii z|98g^J+VlZ3=;@Xj_NQ$;}j|(1Ih!B+@`X?3WtGb#hnvBOd`Aza;L8IAK$;}Illye zq-zo1>^N8(H@L+TQ`rSG1y#jj0?5$T9fWwVQb#fF>~JHwpqzM#vz?WTk-rvKyVGe& z9oOX4FG;ErsCQ@eM=_*EDgwCD(7*@CvRoa=SBr;LPjRnYgdZf!xjLIFK6G_{Wi7(Q zRTlfufUZtv2oJlunN%cMgkDw z!B1sBIwGhhun0eyBZ>&3v)An4LE13@T2bOr069pJV;is@h}oU*hYt5^-ym#==K(hk+{Ys=qg z-|N@OHADIJBl$K1Nim}jpi7?Cjx5|v-RXlIqS_UJB2cqTtqT?vAc^UT~q&3B58F%)Ei6 zb3rdi@V;%j>)j^F?oNp|CtuIc+bB|jxeHw?gVdi$C++LEBu^2!Ews@an+c=+WTpy< z3#pamzA4z>sObS(%xf_d&%5>Ad633F5sw7u?nL}f8+7&)e7&SPkCz%y$)$&nZT<0o zPonu8fc&b>gArJ$SDt=bLx zimR74)2ELouIsiiRSDUfbL7`fvz|Y{1aCd_zHZ?WOV0Jf<(wP>Hk_+BZa(I;(0DRm z_@z#ebmqvaJUMNldMBAAKpO@sa@2=Q0C@`Qi?4gYwV(d^l9*haF#g1fwB(EHaD@RMq`9vyMJ zUD|AEZd$*yr8^DikYM#?<9;kr0Wmrp44=EW5!#Td0PTuYt$#y?x@OSZ5sGUkTNNOP z;&!ac_I=sjj9R^476qvy+uToMOa!(q(o}diuzGxpjp7YS_YIo#v{-AFcJi%c3QHr8 z`cBUY<_q{cA5DKjN@HO2X-t3O5b^~+!LY+W0o)7U-ds|aJnfABIP#Xb#FEl;=pMFl zTt>fkzS5gExHt>jA}2{rA{i4res~+iQHTpN2fmsZtJvv*IP6rPq>a@?2>ca|`3xjP zNdD+KtMCT}uLrS@<0gL&gH&*9!6}tKwk%`7@d~_?`g1s6?Aa!3|3Dn`S&rYvEEI?c z%GHvY0LeWLv}A6~7m9DZ%}9z?!t2*EmcV1F;vT|)u5 z%-^~F{wvr=nO2Pc%mA}<-TF*w+NUDC!3%vnQ7^XMMtA)7_8ky%Imf?|f)|up@M4RI zjy^8u7Ng-unVe)^OUgHgbVTPfQRIL&#y*U}kGAgV3UKUCC^4G!eB_M^+yMMZU%>9e zmv3WM=0zx`e82MM?9=&Y_d`7GIcK5gI@|OE9$3zo^FF^K3xTNsFOvW@&Z!84Kct1g z50&OYlE^o1unKhi(%DMa*@^EFyQ2|F(h!Z11sD-vg!p0(#)lV23EQNgfXv1u#GODyF z_=sR6<&Sf!v!@;rnjt%y6fW#rKgdp!V<}(|CTIO>c0wn`Z0+QO30P_q)6!&lg!toc3 zji9yV@N?vkpK#z0_UNHSkcX5~qJk^@;Nse^T!)6iEG&Mac;@x#C(u~&&>t5DN7+yv8QXpe)(N96b0zW;kG!m9ALv zM_0^9=-`=4yWf~y16%gBmVItn6@PC*^w9O{a`YRl&C&Xhl@CVT`K$Lku0u95?u^8_ z74bbDiv@x$)9WbatkOkNl4pCgOy$Plr`?40vyUpF9`fMp_vdOx9O5pRjXjW}iL?s~ z3Hbb^>{I~lUHW47}nI$ zzib@HnlRmP&`zo)UJ^liSpl&|$lEXn zM-M9Z%Ron3BN7We>RA4@-bhmWbq9_=dHLnM=X`jnI3Mf+_~)0GXn4wI$cjDZUc;T~I#_F?H0J-9)u{10eY1A;yF@inBK7S~L>fVyM6Jd!omJ1%w=vS4IwXBWNO&hQi`8uGXjf|Ls-oK3EOY(iy+%xM$ zqz*vJe%7Hu`Np<#*ZqyF&O z=fVDq;o*z@Do5 zFD$S;3N-QLryMXRTdDHtCHYU;O+%R)==5D2?hRW>l0ms1IkI6I`2WGyZ9_Ky+ae0H zTxZRc%i30ncPc++>;yX%y(}eWYJ+$jdHIWUdeTuK-?PKR{i8O@=}-nhns3@rwq(=C zsHfb97OlvH$A^(d2~XZiA8J=~*@C$bRBFkbmy(6>(D~|&Kyj;tWgR?k!?l{x7O$#( z^KP&P){MCXr~t|=2W-{ija&6)tJ)0V+)M?Ml0ug4QL|!8H%@d~C4dX>o~mAOG%<2E zGs5CpP`Ga3!DrpA&TjBjUPDCW!JVOPM8Q9cg&))7Tkl$60FZjTs7biP!#6+we0*~B z`t;{FgX8CeAmZG?o)^sT0N{}XSYOukDRvxem;rs7a%ES!6+6O#eDAjj=Ghc!eGl0Jye=T zGiVL}*&WTI5&U=P4i9#d*xU7JfL&Y+{hvFHetNsVf7E}wf4E=CJot}Sdxy{ZwK|9i za~+w$Jd#xux($k(8G!x!Rz7;!c6BFxl6k1rbR}ft8*YE>PJv)zmf7?nCvP?2-T-t* z+?z-0;)ORa(gN|#9`_vStGnDSJ?>>t)#Dwyj!5ImEx_wcSYw-INu9o zYR3DT-gnb559NMWb6NS{6*|{(z}Lw90?#*NcLUz`x}nx{x347WSMjWy@V=&NU5C{U z)$94mTSnZBqkJU-*!#p4`u}XFcs=Cn(d5r|i_5slHbYZ3tG6_@1YaD`L?&QK((D^i zTLNLNEM!&&Tm!7uafcMwR|q$xwOFM;QGGdM2!@*Ji9)itH$BNnu}eyYmtC3kC@SO` zDSxvY$`8Sczvc%LO~V@7wM~)5rWFP(Myxe=ua?y*MZ($SQsIOirHpOm;7W|r6&NX4 YjP#^tCwVhNu;>5&9~J@`|3-2R03e0livR!s literal 0 HcmV?d00001 diff --git a/detection_rules/etc/ecs_schemas/8.2.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.2.0/ecs_flat.json.gz index b8673c33290571072261fa499e08256f18c3b3a3..100380ac65c2345b939876d7a5bfe43bfd0baf26 100644 GIT binary patch delta 22 dcmca`g7v})Ru1`Y4u-AK8mWyOTR9j#QUGHn2ZaCt delta 22 ecmca`g7v})Ru1`Y4u-{xZ>KbJY~^6|NC5zAa|mq! diff --git a/detection_rules/etc/ecs_schemas/8.2.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.2.0/ecs_nested.json.gz index 4bd967f3359aabae51287b8f4da9df3d29193ce4..41c2d1c53c8548352b2f005ddabd6c52e58af5cb 100644 GIT binary patch delta 22 ecmbPsgKgRkHV*l24u);f8mWyOTR9l{)&KxpPzOQ) delta 22 ecmbPsgKgRkHV*l24u++RZ>KbJY~^6&TLS=Os0b?n diff --git a/detection_rules/etc/ecs_schemas/8.2.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.2.1/ecs_flat.json.gz index 6351dfef7e37f0516f4617314b5936ea16a1f742..7cd5dca999a726159c698f8d4d32fdf61c3ffe1a 100644 GIT binary patch delta 22 dcmdmbf_3W&Ru1`Y4u*}<8mWyOTR9kYQvhCZ2QUBt delta 22 ecmdmbf_3W&Ru1`Y4u<)QZ>KbJY~^6oO#uLAz6clq diff --git a/detection_rules/etc/ecs_schemas/8.2.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.2.1/ecs_nested.json.gz index 3f60465eb8bad95803f56345aa463857ff401cb0..4ddd95092da70fdc1c7b8816e7ef8e619cf52965 100644 GIT binary patch delta 22 dcmZpKbJY~^57Oa}mEh6n%v diff --git a/detection_rules/etc/ecs_schemas/8.3.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.3.0/ecs_nested.json.gz index 24c462c847dd320599a3d599ed897971536ff94d..2025f4b08716425c587689f4e85d4eb1e25c93b5 100644 GIT binary patch delta 22 ecmdmYpKafLHV*l24u^S delta 22 ecmdmYpKafLHV*l24u-jlZ>KbJY~^6wwjKa&90@D{ diff --git a/detection_rules/etc/ecs_schemas/8.3.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.3.1/ecs_flat.json.gz index adf088e214ae340743cc3cf3b7ba1de222f19eac..03fe439c2f231c3163ed1c5da93e480732eca6d0 100644 GIT binary patch delta 22 dcmex*i}mX*Ru1`Y4u;jy8mWyOTR9kWa{+6%2p0eV delta 22 ecmex*i}mX*Ru1`Y4u%KbJY~^6g%>@8+_z3<0 diff --git a/detection_rules/etc/ecs_schemas/8.3.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.3.1/ecs_nested.json.gz index 83f31313ea203906519ea3a90983c3a151b16bcc..532b8636b9e9ebb637c88165a0e210df42acf9d3 100644 GIT binary patch delta 22 dcmZp8z}E19jYGbhgJDgyMrtF+Ru0A=>j7J92nhfH delta 22 ecmZp8z}E19jYGbhgJI_4+bNA4TR9kitOo#NtqAY{ diff --git a/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_flat.json.gz index fcac8d2ad3b2ccd17449a4979c7028d34d40d9df..013414f071e5de4c01f10447c78afa111b42bd77 100644 GIT binary patch delta 22 ecmaEMm-X3QRu1`Y4u%!c8mWyOTR9l-KbJY~^6Qmj?iHy$MtR diff --git a/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.4.0-rc1/ecs_nested.json.gz index c4ec36b77080b0c2ea8b7aae0a84789a4f783f6a..9424296407a813784eb20636d610b6de9a968f17 100644 GIT binary patch delta 22 ecmbR8fNjbHHV*l24u%!c8mWyOTR9kcHUI!zoCiVx delta 22 ecmbR8fNjbHHV*l24u+|VZ>KbJY~^6&*#H1!-UulG diff --git a/detection_rules/etc/ecs_schemas/8.4.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.4.0/ecs_flat.json.gz index 9658463b6db079c3588b378ff32be21d713de194..3e2f019490052fa93d52317c15dd0704bc208ef1 100644 GIT binary patch delta 22 ecmaEMm-X3QRu1`Y4u+-C8mWyOTR9l-KbJY~^6Qmj?iHkqJ-$ diff --git a/detection_rules/etc/ecs_schemas/8.4.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.4.0/ecs_nested.json.gz index a3d46f7c96984b6a31049fdcecf4c3e75fd44340..f5e472947852ffe896a3dd31ad98f3670e840657 100644 GIT binary patch delta 22 ecmbR8fNjbHHV*l24u)mX8mWyOTR9kcHUI!zh6g|Z delta 22 ecmbR8fNjbHHV*l24u*+~Z>KbJY~^6&*#H1!vIr#r diff --git a/detection_rules/etc/ecs_schemas/8.5.0-rc1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.5.0-rc1/ecs_flat.json.gz index aab8fdc22596d8e4599ba966e16f7010c73469ad..29f44446ecd119472d7ed161bd8d921e7944331b 100644 GIT binary patch delta 22 dcmezNiS^qjRu1`Y4u%EM8mWyOTR9l>DgkdC2ulC} delta 22 ecmezNiS^qjRu1`Y4u+1!w^JH9wsJ7$RRREaCkZV8 diff --git a/detection_rules/etc/ecs_schemas/8.5.0-rc1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.5.0-rc1/ecs_nested.json.gz index 20574a46d4f49f72086ae703f4b83bf50ceb2eb9..90b77e5585df9844b252ab5b22345105d89cf06c 100644 GIT binary patch delta 22 ecmbRCmu=c#HV*l24u*x%8mWyOTR9l}_5lE59ta5l delta 22 ecmbRCmu=c#HV*l24u-D9w^JH9wsJ7`?E?U6Gzjbf diff --git a/detection_rules/etc/ecs_schemas/8.5.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.5.0/ecs_flat.json.gz index 006e7a11f007762be1e13ea23b5ca914e49b418e..1e99907c785785701b55d94c516cc13bc978f584 100644 GIT binary patch delta 22 dcmccqiuL*{Ru1`Y4u;v$8mWyOTR9m0O95zf2h{)o delta 22 ecmccqiuL*{Ru1`Y4u+P+w^JH9wsJ7~mjVEAiU_y> diff --git a/detection_rules/etc/ecs_schemas/8.5.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.5.0/ecs_nested.json.gz index 59f4d27e93941b87fcbc71126dd0f971719b5b1b..4f731534de439719d559ad8bd9e3d7afdba5b620 100644 GIT binary patch delta 22 ecmezKf$h%+HV*l24u(0=8mWyOTR9j@b^riy2ndz{ delta 22 ecmezKf$h%+HV*l24u-bHw^JH9wsJ6*>;M3GDG7Q2 diff --git a/detection_rules/etc/ecs_schemas/8.5.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.5.1/ecs_flat.json.gz index a87851d731b2218b38013889bd78dbda289c9155..7a571cbb89923af1ed58a4fc5fc69be9be691fc0 100644 GIT binary patch delta 22 dcmccoiuLj;M3FMhR&E diff --git a/detection_rules/etc/ecs_schemas/8.5.2/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.5.2/ecs_flat.json.gz index 9f37d16799db9e91b2e617f0f8c462743bae2df8..1476dcef6e78ec48bdccc1970bd19c55c3ab9c92 100644 GIT binary patch delta 22 dcmcckiuK|vRu1`Y4u+}G8mWyOTR9j#O95vv2fY9Q delta 22 ecmcckiuK|vRu1`Y4u+b=w^JH9wsJ6fmI458FbJLi diff --git a/detection_rules/etc/ecs_schemas/8.5.2/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.5.2/ecs_nested.json.gz index d413c0f58e5577d7c1f7068fbbbbf45cd309a928..7152b813d44e9c83c5465045cc1a91307193bb13 100644 GIT binary patch delta 22 ecmezNf$iG|HV*l24u)yb8mWyOTR9l>b^riw#0Y)> delta 22 ecmezNf$iG|HV*l24u;yrw^JH9wsJ7$?EnCF#0g&j diff --git a/detection_rules/etc/ecs_schemas/8.6.0-rc1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.6.0-rc1/ecs_flat.json.gz index 061619d2a1d4b0ba92975de7f11bd95c8bbfa827..b93906ab8b1e9ee6d45099431c85c638795df042 100644 GIT binary patch delta 22 dcmbREo^|4TRu1`Y4u(n58mWyOTR9jz%K=^#2ZjIu delta 22 ecmbREo^|4TRu1`Y4u*=ww^JH9wsJ6bmIDB02?%BY diff --git a/detection_rules/etc/ecs_schemas/8.6.0-rc1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.6.0-rc1/ecs_nested.json.gz index 099ff17d0299b187c2a9df8c312c9f8253c9b6bb..b45ea6c5c983bcd322d31f6b566d09b71cd5219b 100644 GIT binary patch delta 22 ecmdn+oo&N+HV*l24u;9m8mWyOTR9k4>;?d2^$0ou delta 22 ecmdn+oo&N+HV*l24u;Cbw^JH9wsJ78*bM+|>IoVE diff --git a/detection_rules/etc/ecs_schemas/8.6.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.6.0/ecs_flat.json.gz index 0b08f4f8f0c649173861282a1ba11aafdc2fa02b..89ef74ad3d2f651136cc054ff2d1acde7b937361 100644 GIT binary patch delta 22 dcmbREo^|4TRu1`Y4u<|{jnqbttsIP<;?d2)Ce~K delta 22 ecmdn+oo&N+HV*l24u;ajw^JH9wsJ78*bM+|z6llp diff --git a/detection_rules/etc/ecs_schemas/8.6.1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.6.1/ecs_flat.json.gz index fd6726a1035c2acf7f49a448e17a2a3c5b8ca867..6a2810cf7bd0e3e2797f1549104f5b4e29e0cbe2 100644 GIT binary patch delta 22 dcmdn|fpzl-Ru1`Y4u+m+jnqbttsIQn6#!ze2WbER delta 22 ecmdn|fpzl-Ru1`Y4u*oow^JH9wsJ6PR{#KNj|fKq diff --git a/detection_rules/etc/ecs_schemas/8.6.1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.6.1/ecs_nested.json.gz index aebfc87d96686f8eef00ca20e585aec69a62ce23..ff8aee6e2f2dc10ef64d22dd96d2fd113e22c65d 100644 GIT binary patch delta 22 dcmccngYE7QHV*l24u;-njnqbttsIP@djM-{2tEJ+ delta 22 ecmccngYE7QHV*l24u+z|w^JH9wsJ6r?g0RER0$mb diff --git a/detection_rules/etc/ecs_schemas/8.7.0-rc1/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.7.0-rc1/ecs_flat.json.gz index c44ab279a95654cf391bd4174c93539ee8a93ad7..def85c09e459e70ec344d88f613903917a3b6c15 100644 GIT binary patch delta 22 dcmeC#%ht1(jYGbhgP}88BejuZD+goCJOEXQ2QvTw delta 22 dcmeC#%ht1(jYGbhgCS?}?UY82tsIOk^8j632oL}O diff --git a/detection_rules/etc/ecs_schemas/8.7.0-rc1/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.7.0-rc1/ecs_nested.json.gz index 8f064df90324ebcbf98c60cf7fcdd6056c4b434a..34c5c2ff5f9bb8b8168928950f71b960b7b1ce7b 100644 GIT binary patch delta 22 ecmZ2~m3{qHb`JS&4u-C1jnqbttsIQYUjYDLjR+e6 delta 22 ecmZ2~m3{qHb`JS&4u-tNw^JH9wsJ5oe+2+%YzX-P diff --git a/detection_rules/etc/ecs_schemas/8.7.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.7.0/ecs_flat.json.gz index 9d3927e7ddf82daca1e619b70ecac125c6277906..9253435532c06338cbf6a51900b21a85617fd8fa 100644 GIT binary patch delta 22 dcmeC#%ht1(jYGbhgP}EABejuZD+goCJOEW(2QL5s delta 22 dcmeC#%ht1(jYGbhgCS$_?UY82tsIOk^8j5i2n+xK diff --git a/detection_rules/etc/ecs_schemas/8.7.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.7.0/ecs_nested.json.gz index 9e1a90a63aa1e117a572447476f684ee7b7950a0..33fe9e89a6a7dfeae3f42e5076adcedb472893c0 100644 GIT binary patch delta 22 ecmZ2~m3{qHb`JS&4u-a9jnqbttsIQYUjYDLVF(uh delta 22 ecmZ2~m3{qHb`JS&4u-77w^JH9wsJ5oe+2+%KnV2! diff --git a/detection_rules/etc/ecs_schemas/8.8.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.8.0/ecs_flat.json.gz index 7761018caf2f3ed2cbc12c596d0760274fbef416..ed96653d58ddb15f4ca02af775ed70d866dc724b 100644 GIT binary patch delta 22 dcmZoYz}9+zjYGbhgP}fJBejuZD+lA>`2ba82b%x@ delta 22 ecmZoYz}9+zjYGbhgCS+{?UY82tsIPh=K}y;O$d4b diff --git a/detection_rules/etc/ecs_schemas/8.8.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.8.0/ecs_nested.json.gz index f1f4db85fc7aa48cf0cdff588a3ed1233043e94b..5bd5e3393975d19410c530074958aa5dfd8d1989 100644 GIT binary patch delta 22 ecmex;o&EQ9b`JS&4u*zkjnqbttsIP>UjqPaG6?zr delta 22 ecmex;o&EQ9b`JS&4u-VFw^JH9wsJ6jehmP0CkfgB diff --git a/detection_rules/etc/ecs_schemas/8.9.0/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/8.9.0/ecs_flat.json.gz index 225574773ffcd63ebaa0a86f2f98a68f103c33ca..fef9906f026bab8cd0dbd562d9fe8a6f5ecd8b9d 100644 GIT binary patch delta 22 dcmZoW#MX9*jYGbhgP|r`BejuZD+lAh1prmN2cQ4| delta 22 ecmZoW#MX9*jYGbhgCSw@?UY82tsIR1761TUn+SdY diff --git a/detection_rules/etc/ecs_schemas/8.9.0/ecs_nested.json.gz b/detection_rules/etc/ecs_schemas/8.9.0/ecs_nested.json.gz index cad7c9f5d6843805b34998c4c07ddc8d5d6157f0..b5a53458648214bad7a794ca34ae7412f800bed8 100644 GIT binary patch delta 22 ecmex$ll|9Cb`JS&4u;xjjnqbttsIP>-T(k>H3<0t delta 22 ecmex$ll|9Cb`JS&4u-_Vw^JH9wsJ6jdIJD-6baV= diff --git a/detection_rules/etc/ecs_schemas/master_8.12.0-dev/ecs_flat.json.gz b/detection_rules/etc/ecs_schemas/master_8.12.0-dev/ecs_flat.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..3c652f315c68341642cd427360da92a1b9c0a1ae GIT binary patch literal 107861 zcmV)QK(xOfiwFSOTPS4$|LnbqcH>5pDEccnx^tdO^GJ%KmXdVeJ!j-nxvg_+>ym8G zxaBK?M3TZ32(Yn8#qQJp{$j~YB$fm~P^z}?%#7QvB65k0h>VPkjOFip|CahIk)-Zw zy?5dKea~}~2jSg^?n=Pl_wtVeXU`MKJoeYAABFhs%1y-qHgKLEMChas!V!-mOr0q9 zmwpIez0qBG``{-I{DYr8-9vm$V|NZMoJAb1^1cHn-K_n&8w49C7VB6f@S`6t%TqkL ziL(@;h;bHYwxLf+l*Mxab6ziuru?h(06oG;!4^1rWiTaz_~-_iAV4($>u8+?<^&5r zPEzVw0wor6;XmdL*Zx`reu%Jq7JtqB7#He`0RA1t4h+tHlM$j-d<7^1Lic2Rcsd-P z3@1moAho{Wd% z32=%tIl4F;!#~ddJBI&re!6}0TZLI_Ndk@hC2)kecW2QfwmTe8j+>aNIzWY?H2ZWW zo5@38#O5iAJ%f$J`a!H<0wJW!?udkWB@BnohgIsdsD}Y1PYq8%oAtsF_Ly+ zp-y3??X(dRzb1XkLo`sQ6(cQlX`)6g4Sov!zoK~UPJp+Jx(nwA;Fs@VuO!_5DawGM zX2QY!1AtiY>{;;K3A<&^Z^LKH>RON~XR)A@{#Hfkn=DD;;KZ*ySxFA!-29cq+uRKi zXG=JwLX?Q`S8nc5Yx(&>1nWfxT(O{CDzWOMPm%M39|)3Ieh7>o&T%Ki!ilpmL}3{5 z5s~184-p)axGP-eAzQ)7v2ZR1K;${8_31mDvn5fEF+s599g7f(K*tEm2|gv}3~x zVjV)}fsdbE&x1oSsly1j7^)Ukl-xusrB8BON4AyB@lrL|1C;EH7IJa9v1Q(VUL_^%SR`ju?#T0M@dGqgo0{mUMX1!6-iK z{{?cFklRlaFnTwLF-CkSU=zn*)Z$yIo{Yk5H4||Y-IJkgV^swBJKlsMjXdJKERDiw z1r&FZO_GWglfCk@8sOFC&4+y?GYkq!nm&OOM}WN1i<5%r8tw!!{8rk1hbM=p=Qcv< z^|m2BZ&ty%(wXmxj}k%ncZoh_9ils8OhN@wxGYgAikEKa|BX&ttBR2m%xrGcIX)U~ z==dv3u|Gx85{~(I@80a$(OCs-J0@RcLF!9PB7*+#sI>1LZ$GznV%UM1M~_`8E9l-$fB<*j6^M8t4Fl=s8gv4wnk zBEHVitx)}Bzc;EDc3HF)pf;vwiQ9lC*`P+tLfaG{8>Ut#A&~n`D%NZ#LIVLvf0vbA z?1V=T=*}R7{+huef&891=70_)xEDUa?pB>hsU=LZn9IlZL<}lhjtp(KQbrh>-Sd|EK=59B%_GQ@00R7NvUsfx2GuV=wdq0V~@h~+XLUS7zzu_j%_07ke#s+fVv@mK3 zo<2CO4$+rcYnIXxp`DnOk!h2na`w92{>BYm&+UT9-i%r7z8eC&%2U$BEq8wdak^O* zY41Q&@zcy>vkc&d{!&KY-<>IdnOZa)=)*t1 zY1$xVc(%u4%?SN4S+|sK*z6!kB_=KMR8C!Yn*TWyGcoUg!k&kDsrOE(>w1)u2D7nA%V`*fu z;N1jo+lLXOYd?(NsztTo+g~?e*{^db0=cP7@I?#EtLsmX$0%Cizo+|Fqq*Pg4CAkx ztrWKD3k!uoj5V&@dBY;{Yju_HFW*?^;itVYO0}Z|=mLCTeE#8$^Ll(d!Pn3vTP{Tc zN7#k)7LDA|JQaW=dgt{)NjV$N{M13K+dey~$P2r4PkM@+zhvvRi1Fd?H|GIZ(i3wZ zkm7hi|1`nZLcH9k+9D;v9r7OA4D!t%nk587Zu+H$fPIekdPfS z2DKS}wr)hZ&~`;rHEVsP!X^4^$9UMP-;g-un!7e3nVK}B8C(1@5Utjdo8*%;hM_y5 zUv=(80M*!LfM2`#(AxA+p<2`^>HMX~W5vXR8)GiJBAmCeV_-|rtk`L0OAAYWl6+W_ zGPMit!U)x?KpO*CAh0bH)jBwwVpw78gG}DG`EBOGUp~Nz=j81b`nenEU9eI((>w)e zlFj%N?7<&$S0=u}8^g#~3B2Upm7hxP_VD<;+bjH3dm6ZemAVFTypZR$BzeBts1|O|9va4iVxl7>_FtHRXhk{&?Hv)t&7J!tQT5gzn@fV&gaZ9l5` zsv^v`y;b0_9($_Lzj-g^Yl}?ewe6EMTHg~0?SdYf4ykFgoEM7)sz`8yfDV!kC1kGz zNUi+=+upR{&7d?3&VdRwAyJ4MptvT!i93}ep)#N0|B7tDJoX1U0Z97Wgny3XZpQ%q zY-7?23-sgFx?!4Gwuw`KN+{o!19blyIJAKMHfGL1gKPI7$;h~EV`1~X(*r$zo<=dd z++sg=$zBQa?}`>>#RT~1-PPqM6wH^rvMW7=$-6dEm<#Afg$CT$T83~&>w9ne`nwQB z07O9>J-AW*TaiN_3(k#JB>VLqiUmYvw{UubTc~2f+Un-WK#kP<03IAg8qUKP4&eI{<~nN!DvKd4tzY%Z=4jZ z)JQM2s2-G3UHi)YXTn<-^0o_|ZNe`Z=<*4FGdvug3@3-f3E*yWe1152efD}dIX#EJ zp~wfI9*-Nz@|^LOTalw-t!+r|B5Eu`<_4jVE<~{tM9chAU59FS zB)aHPTfVSwp+4=dIqj%4bwOAgz2Ycn438j!aic25F5}qU;FPp2sg?2`qxbvB$R$xG z-(T+bzW6gYbnjgcF8^rxx!a2cnXSU*J&t&{_gf=rHCTPjrmAlN_j@j`XsFd|8&(6-y&uc=;N;v8n-B%c(*-p}i%Z~K4OGJ~R7MWOuLv43}+f81OoO}zb z5Y+P%P(bT_m<3wU{Q1xmk9*DZ+d(xf53vmmTU?z8LcVkQ0S2Df-JOVZM$@6i<>}IB z!|qJJ3S=ciB)&-uFd+s#mD66q=TLu6>2zcqV;Rp`GDPe5@NjNJb7c`daa}i#9pTTn zSUY`GpnRj4RE_H8VD z2ewNmqm}UdY-Pb=0jPc`EDvGFU?<@12xMKVlZL}h|H~^nRgArezEi8@5(InCtPPbG z)GT;POz>YrH>$(X3#mxG$=*SMQp@PBM=5ImZq+I4l3r4)>PVw+p>xUgcT&A1G5<*# zSPi5vqlk5+&TeX2c{QDc=8Gw9wa~nj?zSy{dun!aP2ChciQsRn=hcDuLh4>eq(6@` zxQ?U$6!T8XplsTv49aGv+GQT#h2#2@ZaZ);|CYtV_@$DObfX|>CXunCegrBGu=}aK zE-tAvNjk|HMU+x^Wk>aKn~N z843<+JaQye*fEczkKCtZ;J8SLfwP>iNp+wgCl|B^;Z_2XpnWSTG-&SwlvjQ)z9+c@9ZW*Ya)B98~eW<9b`^A^UZcSh8`u#8S|(Yk4spHr(;> zeJb;l2h}byGr8t>Oy#GMkS{A;G!?TA9I>Pe<=ZzC=P_~KxvQDy!j1CHC-~o6{ONMN zcHV{nww8uJzgNHCaKMZyOI`R`$maNG3EDue2ml;73m0zeDf|}DbY+g>Uz^#ffbX8Z z)ukbJm!>AUTG*zG((!xOHeOoI*hP`(ra}DPRflh(Gwh}nw5tQZM?K&r6@cB3__nkC zcW|h`)M@_m=XJM(`oB-;{wMUeIGT4md{bDRNISg(ant|uuRv9d{lQ;>N(*Y11|=r= zuki|0hoL{Nn-w!UV&;L{R6)Ol~>bAXujAh zP%Sin@K+$Yrf#o562ag26{rrxKlCe*Tu>K-jKuiw-7ZsI(I4y;sI-7ia_0AL%Bfq^ zAMh0@Uq*}BCnwAA&iYec!yoV!NG_qxQY4A+J1`g(0sg=46-X|xn{i1}<-cuA{cTKj z`2J(P0&(Olpl!a+Mp@!6>lsEh8$z=oH>*i6Ct^%)?!5W*6I&UWyRkZ>T8%DhEK5^? z(81OiY?x4#uAe$F*G8q}cw=O)!;y0{cPaJJ!o`q#MCo{3qmkFFrVa6hmQ@2E&wJ1F z?(xKhgm$Gh51g4upM(ejbX?D20rfZ>pmh;MZd$@W?4U0rEN%3aJ*;4FNAx+HKgLzgtmDnqHxdh?n>Pp&}dkd#Z_MODX`-IL4#6^jL zZb86#D4U2;URrCOhHCp}%WHXwv@}c+tKhdJ87xBh6#J>@jD2do1NyN)Ed3i&z+7J^ z5|lb@M+3D!jK1$m2Fs;KBfcpdUAIzty#*C7S+lnSL$k>BS0HvM*T4u+)UtGJOUV|7 z*tW(72zXYpx1f)TB-IIpsjn`a!vJETd9MEroWrS~xfixce4{sIA#j5w96;&AiiDah zZy(B929%QE!kOwu7t~-naxQf@&fTXAW&-~6nhBf)k6XxcnQ!0R@We7fo~VXPClBuA z2FQEQY27Mt4?JQTZDCPz1)G8UD?j68MRc(5PmWKQCS_($gGBBz!_bsh^C00?q>7qe%OREz7o<2MD88dyNc8Py{M&-Bw zYpZ#*)VRNjyizOMK}&9zTGmoyik&T~#)?xsbC#x>UDfegCW{V_#FFy(b_k0JMH z)KG1@DJ3V5vQ#N=s`4=62!ZOd#^SQQMw|J#yB zcG-$PF{my6Bis!Xp}sMFip%Uuph~Z8FLQFyy{QyuA?BWGri*G+W1ZwL&dLqlCFjNk ztv4UOq?meGAwF)vrZH0=>to)#!ELPr$jx#m5%UZS+}-0(0LN$@`;UGgmZIg3raBH~ z$Dz@&?%CC&g7nTZRRix6tSY=3;h)*|S0Mp@8gjFtYE~~+_)dk%rd8rRH{75t7Wu@*2g@%k851;O zI9Qtp{e&pxB3Cd`DKKFg!``a0&O1{yxqd~T9oYBNfiqo$x`GJF=x=~&kxJQ>!I^RIlhcKLw9>i5n@%WyFHyg zQgxsfBY=d`P|07X>Uv6J(`xa~z@x$KU|K_nDJ=hcv57#3p=&F*(QQodu&_6F5n!5*07^xek_oi$! z*Fv_2HJlx78!2yCV{zdeXR17b z-_3$_gT zP<(CPCsU1MbC=*y-(sf#CcSK~3f)@wNr7cruM4_mLl&uLyh|TNA+#VKZpUcnz zdc{aq+Rf+@V~SwOtynBKi}6)3*f7Y#GoRYAg7Go|@r|5*x5p}Lf^|855svt}MqdG1 zY!V>@K$A2^Wau8rCWI+d>ZB}-A#j_s$kHsXI8Wegjign}ZLUAinmnj0dfLe)@YR*; z&8liTOXe~rAi+>pbbR3|dg6Lwin=3{%H>cW*% zBS^8IJXK+=8L7C+D?o&x2tBN7l1P`T4mNJ(&b2hkWbay6sTtFqwhLCMo}($Iizviu z+t}Fp27tjJb+Ye0Tnj+s3L4Q>1Z8`y75eromt9;yC)`C?4ICJStIBslpz1MHb?D1` z=qVZo0*f6}f%&{7G~L@&@9&aYOn`U=Z%)QN^SZs>Y$XT0`i+hX_K@VS*Nru%`#Pri&t z-L{Iucc2&fDVo{Q$N{LLzm&20ce0*@ckt)o>!Z=>;qlqg7%NIZ2mJB)WOOnuz+rsjYP)KE169sK7q(r-ZkPow zz8K+$jWee>ky(^ssPr3UkWdwDrLgnmqX)W1P_cIMgbN~2_V`9Q;F`Ligfc8MG{F!U zfwO+tBv=ZbBepjKXRb7Z1g88DrD#-=wc^PW8;$F5A6?M}6>y+dQ)ZhP=&Gnd&s&+| z+ZD4au}L>Fb>5Y0STW4l_3+^4wsYeXePzAKO_FHt6T-EpqlWG-{8`#Lu@dV##&*&M zsBP_dGa%b0Fpn-$>pBPlO#rQbz5XO83q3ZzJ-RX0iuKUILU#oz@VJf?{jo%Itim*I zqqd2q?S*cscR#utxa~|_4%OL8JK!!&%7KjDvFirIKfh_+K4r+ZM{3Oo{SaHXo-L5u zRq9H_T7<6zqE0dRb0%hD-W8)g^@39GoiMqTR)CgrTOx=u3UymczyZ2^P_hH5Pv>Wr zs?2n;aza>K{QWA>b#4=v*FB7 z$pdVk+-8)KK}L{0Mb2NcHM+;TiTKTV0RHvF+y_K)FmB>3{YO>DoDFRfR-On?($L95 zbSfbAC>2W#_`Tt19JIz!Lw@y2#M+HrIk)RPY}OB=qB@PoL-^<9E&cmwI5}!0y~OR7 zJ4E)Xu*BL$dkm51|NP~0_``U3{@dRt|9CYt{<8n~lfgg!rI@mynUr1j5d5dZK7#+$ z@1#ymZ+Sp1n7gg5}m$yIwph*-a&MPrmj@b1t6!iLwUR0<&UA_NxA9$~* z_LAZiL>LX`2AB~873~Gcu_yFTAS-PQYC8Pfyiw&U+Z9{YtlPsLE{)qaY*ZX{&7E6u zOzrB_(l|B!W+XasW2HF(0GYtv2-B6ISkxCqrvf#9Z$P(=aM=mTs&jWVf08{KUl-Oc zK1jDd&!}cKh~_VSpJ*mcNHb=&E82M*J8Jp>*^IUh+}XsL7SUtJL>Jbn-a*<}rU{nD z^`q_xM_CL@@Af{GcW8d9dhnMI=&+TyFOZ4*4$xi1hqKUAz$e*^Ka~rylRt$q7QfHn zwezn0a)b^u3H)66srV{}o_pwMAz-u>-NxaJp8E-2JxNly>;Mw@U)cJw&Srr>2k;gP z|0{oc^^m6Pi-QCH#9#2qcYoyE#v3}oBfcYl^;g;#4a8L916ZI4xL?#MPj2m~7;wlA zUx(4@i<}Cc1pEzGdi(Aw(dzIWu*oR<0xK)$rR(^HRwaG^oD!9BnqSv;W{xh$yKdda z(s{#rR@UDgDrl?BH4Sg5%9}VLuYU9^4ft__9B^0^41*F- zGDMd>uat+S(Hnb^JP0FHH++g!1J&J+D(PDg=EnV2V6#4HHq8Fb`zv2yWMZ(>wn?M) zJ;BlOK!El`YTtYwh{Xbfb^vzofPzQBhOZtp&#qk4b#lQP3!`sLYcQ5pxfQR zp;hd6;%%xl-i@uPR=Sm=&6i&fE)f_$y3xhjk)vFU8RcNGvMK{?_3rBO6N>FiUgMP> z!er$}%9u;(N0bIqbgP%X9TGazM*vtsC-QL1`qwarJ{J5=n{lZJ>w!w$w&^p^x~Yj^9jv71s4_q!>-vQH<3hV@smd=LND5tSL!Qo&!|}Trhmn z=bW8C4^)o2&e-ptP}$oB>pQG!3+#86i;VvcK5RU0SLA*>PlHCb&VlZPJ52b~32W5Q z%CV#cP$ndLz>i}=A$fkt#xMEAf)O>OE?^906mC|OYLAG07yiUyVIVc91exz~BnL{Be$I-|ojp1f^ zI6N6n4u=!K;^g@JaPs=>^>A`}4u3;Wj^X6!$*ig+=;t#nBC17@^x+<6=&vgUs*Dv`mCxY@HDSh(aaCTzMk(c{0MD6-VE3pB!g{mRye=}+IQ76 z7ofyL>u(Mm8Jv=fg98sK7p;NB2pCzq4!mfdVdxD3d64;E{1pDp(;gh2PR8St^I<+1 zK+6;Cj~syLGW6mI)9bfE^#f?p_yF!uF^3>voM6EWJg}BQG~;(!#`;e`!55uw7XZc- zju@xQXw|5MeY%OV*u=BEnf&SM(`P#7$t!goM=9q8asu}W6RIZIoq#qFC5^sBN8s2^ z;by6Dz1H29lT&l zYi912{j_q!46~zUu`L{zc2=QT{T`F7T8yZoEYD`=iq7D!l8m26>kwC-w^t2~;t(%fYkI>e!+d-OSa_pWMLxx^Zq!oAJKGEwVU3 z%d2d!Wz}Lk2uA3SdyhV9F6FD>T(I{#&u%UL1NKfI>TW~sHq5(OC;|f^qVddLif1p6Hg)kznYlRVBx##!Vf4tjP$nC?~j}%LZ+&tWJ}Z{rW0Sj4&{{tWPV}| zUYQ{{A#jxoI^eOV*{o)mj(PhF@DvoeAG=dw3(gT=F{N`yevyr9;?FrN8QrGcHMS*N zY))}fKG;#SQqU>RL>JoRlUpyJd6S*7z4eM}6SP%VLCLD%3Sm*Dt2mb(?CP~4v)i_% zUsL3fGEx}IwQ-YG zE5hMXij0BAzy)91mz-;BvreOB?5^Sd;D|Vm;v^4QGDib>?|T?&hF0bnZ!L0s=bgZu zd0D7(hIz`FrrJft`WoY6?(Hm`KZyC4YDu5BpFe;6eE-vj+s{AU+`hfK|NQaeZ6}7( z2<*d5y7SJA)Q4W%FjdB>tgZT34Qp{1t6hvg7c>?MGULO!oIAnCD<;Se=S>u^qu8xa zkk$hD_7=!;_nqm~Vc8u?k_va#UGigVyV%FC&msG19N2^M?nSp(E%9Y$yWS%I?Vo@A z_g~N6pI!dkh42bJJ>6jP-p?ZAJ0o}-20*!_9cNvFa-2pd$V9(B<@icT(<&9=N5UIUNI|K@qN@b^#e(D%u zX@J8`iB0q47cW(yqRM2tF1Z*$8#-edq4`PELrXWX(##EcyWIu!w)oycUne!CBS&!C zuD2uhh@kqA#aqRrh}i?#U80jP>jE=CNW7u$Oe3ROH0ptSnwGd{H*~5;@jQOd1kH9fQG?{cJ#1V% zHK>tsKVBZTtzLEQqh`ylJ=b4^t_=Zb9BM&#QG03SM_L3Zzl2-&$mDhe>RA>-)m zxD6TDq!tiwI(Ya6{w#*GS=~xmU&r_AmAg*V6SsNOrY8a_6r6l1>o8w1*gH6y zjJzPI#b{3x!gfXD)RLO8wsuo1$I!Pb)_y?0W?DTqsGH2pEpu^q_lplV_^0IV?uOht zk0y6_tq4+c_o*)~yV{Y|z5*+{#E6ohqpJZbh&IfLVWC+~Ub#;{Ic5`w3o~nXScI;O z%de-$^|&el)icR=X^3u{bzM}FJ1?sN!FYRg!%YKjRg1dnJeX&Jk}gq`%8nhV@)908 z8(}N>k<1yR-ey7r=6u4DQXZlg zO+K+fv?a|I!@P{{{T2FC-dp|Q8PCgT$PI1&@R#h!E%Ey&4D%0{8CJ&Re&pNcI-lP1 zQ6#=%@Ho}NN!`$MV^5t(s{P2h4CSABXc?-i48RK?>%y#K*duIdph5+Y=+LmhqI(O&2RtmH#6Cu9XeyDw69BOOcS`~?;ue$(EMOPD5`k<+8# zQauN0l)*o%2>##QFSGICc;}Y z=~%C%X|P@t+GVxXj5wARKe}-r8bP-PI{ggdn4G^+6@GD|nM-&U!j%T>MZ9N2K?5aK z@|b4A=~gxSiIcS9D}=J|D`!9#;SgWNJWJ{Dp@%9=Px9bmrRzioB1`7_ zmDE?QsKE0`zQAuvCjS&8qg8 zld2N68xAQ~j-fcgFTa1?>78)nkQ*VNNfifk=wJdnvEks3Sr9D`(uY{M=@7mC@b-N$ z86O@Wj1Ld6x*TQ_8LqHOSu9MA6@DH)q^pXT@_2rFHa?mki}T6k5dYxK-IMdvBiHqg zPCaj7V@-oxeL@=Y-p`-~_0fE~Y5m)%{7sDchtlEMO9%G-hN4YLeoKN?YDpg-dS`R* z{A@8E&n9EwqOt}_h;qCu+MhvR{wFHSTM@CWc=gerzm4+zOhnyPpZ+~5(>qbx04)%WF1$cu z)tGIPmPa^kklevkfAi_``orz$?Z3aZk+TNwe#cDxK)acWpU+&s7A^XVY|y5-5BN#IoaMpAeQcYb3hT~3H(i@U!R^Fp1-!*#d9L`dEOMy zsN!r(=Qj3Zx9leVlPwzLfNb&{Pj`3OcTsHCXbKqlR!wp2Q)i7EvTh5o@+gkupXAtjbakRuq3M(Q&^2>?*i&o?iBEo0VX z$?QbP5sOv4F-2xJ8#3NFfo>@94S#B^YxJ*E>#=Swtl4qLXt;}#d?WE-inkI@Omc-( zVxo>(qjr@_HQiMsmgBS{akPs{R5!@Wsk!EoY`Tqxs70;OXtroHKvzX|x*}Q9;?+&s z)5)wnM!#258`vF0$w<|AyH9x5R@|u$L+a3uL|s4*+qYx02v19u=ti7YMtT2C>Y&qj}&aZ9F{WM)lFT^i567QYP`R=!Xy;j3wYuZAhjz^*AO-WC>gqIH|x;5SQ$tHIzI@o#|gQ%;!jD$#BLP_y!-~%e+A4 zR+`EJm9e}VKXgks)q@^gxFk)3HYUL)4P{8FMBgJBBJmU_LJ{R^fm4yrzyWw9iv^uw z=2`Cf$=r8_AE& z^xUkib!Aa>Vr|A=2ORD9#@(W(-eI?>AzJ9L{X%Rzh3&leu%@L|gWxtpZqtytcH#sA z>vz(@D-FohsU~0T=PS-q`}tC4rWIe;pxVI9ydy|Oy1c|Mw^W7t^A-J@ez~MSzoCC$ zeIy;KLX^V7dM58K4Y8g6RzZM`1eSn(K)f}Z3Xab;63vt!pbv0jI(fTT$CwRi#k(_4 zHNkbkM7*gavjyInM{A#-XylO$XH!x(rJqg?4-e~*{-U`{|0#>M5iMHVE3pIRqP4B+ zx>`xZ?+sDNDNy*z2U`Gv;>+w8Kcs4R1h%~V!9kHE?o!=;IdLIoBowJafK&)ll^ut> zlg7x)q?fY>>hAsdr?;Q~qgK+XRrh=(UE3?XS17$Bewt{f6{W^|lWNuN;uOnkH!Fh( zk}ta6kxKCNLvD4Dj<+N`Y5ABnrz&?@~mH|#43r^R5n%%)jve>R1j#*9J6cj)cS#*xr(X@ zaHle=CNKPV9o7Ha>Zmrd!;WnHPpzn0SXhI7Cg<&T1C6vDHR{rrmuwwqKy!a{Ol6F2 z_82SNHq0rb@x8yc;Y~Fe`fIE0#e9PVw!Qv@7eayFMb6Z;%TMJygZgo*-Z15+^kFB> z;atG|lO?d#XJYPViFPo1#K4nuqfJlzHkY714~LLojGVV$F~lg%;Zc=LMGhDSsF1C9 zT0+FsS-D>X4XWPpC<`q5U1F~lZa;HKR+G6CeHU(m7klXR=qDMGP3r4-Q3RlC>`}%G z2^*&J9}a74CzYtzS{|v`wxcPjfw1NG7R6#PzQJ8|zi+fus77t}3e}FT<7EVX_(<8U zZCEm(=viET6E;b$4#Em2BWGfj0MZ*sPNVuxNF`Rls9=$_%$ofYPJ4>a z=?ONXFDyNPxA6xvJL()``e3hyiSE5%Sf*+*7c~8}ZPt83$xFDg@Z2j*D(Ax&D_$ii zZE}6DqBXy#16a^Ci6X6JNSh3^>pnVyWBLYuE>PGi@;3L-t^^DT{?}EW7HG{f-o(w4 zcJy;C_w8^9Y$yA>uz`&W#XK1`q;P@H4XInu=Rsv{Aw@@{7sWF=IgFgCF~gLj_G0nZ z%*TrkYwjdM(IbP3QjmZF^fRXbBT@chS`N{Rt8wWo1juF|Jwk><`En;cOb`IdK^?&T zDg`ddi=Y@#Q$HgYa3CnUE)~mI1}nPWeem(a>yE7tW!=eU!6H=?y;bE<-cO z@yNy3IH{h8vNpMCXe}bQ0&MH!SFvsD+4!#O8WNimbp=LBN;D$ith=y`UyfhO`_!Pj zh)qYg9T<6i=o%ti`m+~R>&<*k+fiHwzvm-lQ^73L zH(Y9Bcnc#=c?#vOgovr=pfJY4I&f=B#oSJHcjX-=KiMvSZuv z(d4`%TGe#hAx-7BwquPugDB#ZG~m@`UCp<#4v@d=gAQ<~Yv={Ocwb zw5#um5fl*UmguP%umqON0jHkCKN}BMIxxn-w;#gR2|XKXO@MmU4mbKYpx3gl7S=|M zwOt-#t8FE+LZgTWhPtdZER2OlvD zzWV5)gBhC8#SNb(_$lfkT2~l9&92L;gLL|A38p$Nv)Dy};ZVmIlmtC)~U<)wOJURb2Y&kw0wQn6`p{;iKLQ^~bf2IqwUUj}!xyAzO z;a=@wn3{om6=(sN>~i!P&9^*#>knSc?Gz>GZT=pk+qnTBxzcraf&WrLVQe07vou1D zip8Bi)(w4%9{gsgJE2rAgkf{j>S3veIaT;aH!=ljam*J zb==6kvJU)0w1CzrNQX7gcNx|bmUiQ3n)Wu*$5EL&1lI^1t2!J;mF4zz&8ZI4?%gCY z(~OiB*~h0^JGHo71Fb%RJX2U6l!A<04Jo-3kvEzuTjkCv8wsT@T=_|2QEzH+Ujn^v zey8#v4Mv5c=A-tz9HIr!Tu{CN!LmV}zrif_1$vgRR#>t|PM=1gaMhv8Eb0^pjKoQV zbl>Itq*%ti4YxToTOgHuS)^GQvG@0ep+|UmEY@=WTDT8`gq=U!qr28Uefr05CfRcM zT3ya5nM{u>VHY9RD!wW@v(1Fj)qb(Ftl3h^ylq^79eZEz@joKAKFwrGfJQ#Q~w z7d>aUA2c#FN<=XEe^osc$8nvjKwY!>uCj2-VomjA~SJ4mGX7>iUQeGXc z2(t(i3|2hHaTJeiZmIOu=8yUoKXOcH$?t~;tzsjeYkOa>c7M|@@Yqpc(c1|D9WPeu zG-_Oar>jhP@!MZus<7CXE;-x2e$~Ln1NL*EFn-etjW%r*t`oc!IjgxQgJHonQqYqgSe2OTK%3IaiLcwq5zP!U4 zYqvPrZd|)H6u%GMCQ~SX)ZWy}ETXJJ^yV!kuGG~F$>KtzH6~Dk)|63Bs`qowcQ@q* zSgB|kq0hYYmRHWn^`^@>%GRhSO$W|&%>^TI-(sjX{zMOt(r7j1)Dk);10x>2p7Rua zvVaJu*sosTP?H+20o{nmAs1q)a)yc9?WMZg!Cc#l{}#G0@!7-o?g3M2mNYN`HiUz2 zC>z$?AeLm$Kw@ZomhWQgXifP#<+(ehQQ^p&N{4bz5AVnr*o4x18+LOU4uN?<+%;tu z05*p{zL$^5MAescH-jI;RB1jY=R=^L}S6XFV66ARrF2T)F zbA@Ye#`f8;jBIVSkO-Aaoj-{A7tFD+#Hms}9Bx8@QPV|b!ouT&$Dh`6(*=6bqq^a7 zB!lPWsavSSfU6%p`3Z-u$W?JkBw(QENqB0u-0*-D;fR?qGEk3GtVN9UHJ4oocZS~4 z%1={%eWco^g-L*UFYdx=4))Nwwel$=0Lwecgh=w|XeP5fk--wF3@S3Ocdap*kw+&gCn`*T&3(EF2 zr6F?Wy}l}oR)u|=I4y~+p8hh`Q5x;fipjWnA(RC+wnC}#>SUL>>IfrYD;dzprS~ORKaJ*C!%_FX`FQzh;C%k{ zX5joHW=Vu;so?K#Z*CmqrZNTd@m*BpLoOKle$q&?-_O@;`@? zl?A`-;$9#hMpRAk52#7(nVPq|_K{n<^FfT6Bmy_hr7OS{1OjWr@x!wWu#{>M4#5Wo zKuuRdH{gRi$@8(7Zp z&uC6b9_TM4=jTEQFtA0i`I~0X%BlgVAd0@wObfJscsKw^K)1h)uX6XuGo*0(4;7YB zVS4mam7vE$dQBmdas@&aMsKAVglR(2b47!VWWx+ zB8>*66}TDZX$ElM6_gg2E+QXx})!a7{Nt)Q8}{F+M0euz@}I<7+Xk<9?$kW9%Ff((iAan?JuBIPW*~pSN5wolA(quTi*+uD)j>=lqn2>IQnO z-EkTcwM}#?4JMGxsl_x(wkN5QfOLs1&`{0XVJmqtK0ej#p@?@-qz^C2j-DWAC+;Uj z4-f)h!Lia1R#(Nk0>IBA&mE#64rRv0( zg$gufMPxDHQV9tiIKk5v66A=lJ%I}Nr#UT~r^Ly0FQU_)S7~mRfaWqME z`HMV)s0y7Z980Wa6kB6PqIs@@kn6Q3^OKpp`&S{pus=Hp%@;g-aEe;;ZXtC|qAT%( zNP`auYQ*UY=$F7>i1}t7h&<~5eUzld`1*RPWH>cPn?y6>aU<9SE@laAgFL4gUo4#m zz!Gef1oM=}4(BnBVVAB0Hx%Dt5eKYxjHVc0JdKD zl$Q?#6lI~x&(X>ON~Mcyyp5BTQ_3VFcofP1#2ctQZZTmu-D{y z?SsSUJW*RPN~>VSfomCrow}r0=b`0|h{6h9U0=T6uamHNX@HGMM$beQ&%pW}Ny-|~ zRwq8pq7NFanCHa=T~0v74x}&;T;;CtPWACi>JFT%EHYJY7)z@#&4^U@srC&=%QP`u zxik6hs#U%Mlg1gjerO3IS^WCy=HU9%je?t2v&cejGGGCwjw$?>3$v}zTmt~?5rHMD z2@Ey8zPW}`3|G|~IM`rtm$CfG4I<|bFQYejX^`jX@PZz0wQ z{K_X|D?NvkLRslV{&|!aUs~7m^o@5?VFK}$U&he})#YAkB3(jWi|F@QG$|Ga%NS}U zbI(>-T9wC>%=h-{^TFFspDIi!Zxznl&|^7&BQ-5x%ngVt7$yJq2^2UUb>O^-qbCn@ za(5cun$Pi|Az@+|g(TcsPDw1N&iS_Zz|$mZe`taBiywFkkYQ|Y*iM6! zv$yMTL9Wm$78)3lgX){{5};4>f&L0I9P_(LEjdZpM1x^6=swDJTI5-IF{I2(d7d@p zW~%IZI(d^P(D}iu7|U3Dauqk=(aDL&4TfSKYcR&-+(ucHnAzr0Ci7nDIkAlPAh**E z%>22j5W84CfhwXRFgf z>wSxS^unN+)5N{Z{Zv<~gkf zJ857p+yPu^q()0aoz-sX#-6lF(wm17gp!K{Vj;dauvZ_M0=C_vu+^k?9L36IUwF0| zXCO=PF2uwfIae|@XK6mp$)>K)ipX!Z^$$+on;+$$(4vcvKmk%rA}c=?f4sf@1Vcq% ze4(z|vPlP-+G_unW9@qLl{75)@T9Vlj?TM^xvAyb6gj^T#&wvZGQ~9b=I8G4Ky)M5_6+tkr zhRSBLogPydu66xSVx|mXyt^&SmYFBfMxH#(BG`T?sq@|knBaMnOB}vcuCdb8z`4G@ z0nKOWhhL2zl0V6!exW#ox@mLaOt#d_PSzewIE`C_Hjy$wNIl7`C@x(k8k?%?_5gs) zesi^6Gy18w&T)!sqDsGq1t$N*#Dj0Ri~l!1v3?+TKjsL@%hHERrs(8HS$QDf0J%xr z2TI5D2ehJ=y{Gb;8i~Bh%>1P@%kXhDL37N)9Lqhh4;_G0&GlR(>+d4cOUE3Y(Wxi9T z%-`k=R9bbxCnRT~7MBK_e>m@gdjD`0&^R}W2kFC5`Um+7&S#58ZnSgWXoBdwVW#dS zGy)y#($9ILpCI7U?yi8tGtia;xR9}q5XfKy6=Q=gpBerkLOU|+5S-9-#Y!RyLJV0e z7^>AXpG?nRJgzI=Eyt(FXBJlIpLDt1_q`q0Z4~C0hXx|c230yw3nNU6zHI1dbWqA% zK$t`SA-JtmsSlS9PTaps_8N=v@02fj?XLya>8b2?4>$(oe#)oD^xt%7;*^;iHgn;} zJha@bbWD)d(r(BO5Ll)~&y#3-QZ>^q?@IO8xhQ)es%q!_ zwgKui6>MaU(##z#OR32^*K#8%r@|c7)P;Sp7|&83<1v{^8CilrzJ?iHzvHWuBm#Ou zNlgV>e?c2tw&u$Wbul+C<81CGyqpr2=&I|n_zVU`N|ihTD{-%fr^E5daB_4zKD!v7 zP~7Xu>tAgGIA>eCq|MtjIO1-_!?i42AMr|H;+33}pjoz`YS5h0O16>}a>D{axPAwf z%p&(|^17z-x6<((wW|ER_mvneN9w8wp9a$5pPjUf$@Bq@MiRP|Z{*3%wRLmpy%MbB zA$Z7HSfpXKB56lnU-+7%lVRg%ctI&lMXv9Y0`>bm4~uo!b={US8$Vf zaMvUgfq&tb1)RhprfP`$6x-@PNi~HtV!5(ziYMTFrT1HUqR1WSDyi}(N5?0pug}iM zb$`12p3Cjl&_lu9r^2plNz|$7^rEY`i#oqy8#KjbUSIL79F|lHm@%`UxW|i=@z~~# z{*vLEjUYB)1l{r)b#>jM#w?-qEZ#v{N5BG^kGbV}4!_0HYmtr8N&zR;Th)%J=-$Sq zy|i2bYshGVelz~eqX3(*f zlz2BuvK2kufr1K4Agjkf>(WwRRV7#+;wX%y-8tB>hq5e?<|h|LJ@)@AFCza%5op@3 z-JXmN$A>oU)+Dr@8;wTI`fWePXb`hl7`ST~gjq&e8^UrOR=KE3mkK-sFg#)w=vbo^ zIBY3mtpe%?^*Ezcu410ir3uAf%$z9w7}Oj14Tibq)-;6vf@Y)mrf30TQ-!z{og+by z#gU0~@d^3~qcsM#4k7YYe1Jz8KdKwfBBnFHZb+I^$MmBS5nL8x*pD4}+jv&fxvd&^mFeEcl5{n|&6rNl8 zf#yK_1Iyd9AEOg12;(dzZ^d$}Sm;V8I{bt@wY1kzvY(?^hjZ~kD3?hVDK4%gV>q@tHb$LY|ItHTn z0S!1lPy-et1dIm@<=hRpdGr42`+ZeoS%NG*a;1O0v_uz2rWVRq7o(n%3dfhZT{){T zvm?EVZzysvj2v@IbHiz22Q5gR(CHu@%JY|F@-WGFjwwChJ4$RD`k5?$=Yh7@fl{Su>?XHF{|HGD?9GrG7;d90@yU#LraP z5!En^qWy@6;}}5s5XaPxRxtVs13zC~e|!VmLatOk{h{^;_o*da4K>O2&EBVUt8c2 zKt8)CWDr?tfvAnO9APNq#nDDoMHq7AS4HA3ypr=J|yrGY#k1~AwPcS43X zdl?l)Ui`2hDCi?2W%NC{184^U6wSo4Ifs+WFW?QhL2)|Tp=E*8l`xW zPbT~TO`lx!AcWJP6qab%Ott#%dc%ikZlHwVlhp%9#at)&$?g(CL7$o+DvAZ|v(#~* zXv0tGcItGc%0Q-(P=kp=PaUYtPvcaOPOp-nWaI#4a6iiTPW0RVO8yAsIj(jYx@)M7 zEOYTm#?Eze?emb-u?ttK&M6NgM68??;-la+$*}ac#OAAIEJS#)5vYeA08dC8CVwS( zZ{K_}-S%EZu!jcxNa^8&Xn6nR`l$|WE%hc}ERtWSz)5w+&HcKH@BFXSU&$*l%DuP( zv7g)Wjp22w1m*jJ0ygl`mq`_ChHt2t(ovtn5co>}N;OM)8vWP(f)~C%9@taXU?CYC zh)<;i42NIHQ?no}>HCyf0o}sTAkM9^<#(o7rJ!oyYu;cyu$*Y&r%GhTLW@kr+CT)~ ze7a?ECqrnY%)1M3Xuy{e3`MEHe?|AdEH;R`dX+qWsCt6_b6C-xDnse~3|YDe711!Q-CbFz!yE z!9;UEPlvH~W6B>u?TRZej?wkps=Wu%OUA(PYyL?q%LjoG zP1`uJ@XEL*E)FnMy~|NSPjp<#*Q;VsohX*J1>g`<*ojMm=edU>6}g@2625u1qJmG1 zJhv1j*~rPy(96tE9wZZ)3h2sIQe;XJncQR1kc)=bqG~LF_(YVLsS|Sb6~v|&peYT8 zX3xSWbPvHTtPN_hz_pQXmH#MT_GGNr0Iw|CrRqThYmS4UlLRe7bhfJpDpvhhtoEZ) zp-!Keo!u~In(Z@{*ETX0)El!D6K-j2Ro$9%C}FD-ac>Oy1#JbGCkx6+0tj%Smm9Sm#%iDZYZCN`2qNn zo=54<3Yy8(T&aGkHytYSC#MU~#4 z(J&3SZ0(qY8yhxgtXcCXttnU@P2>}pvVLblz)q2Jz*jS|;1p|c#PRh!MOO{evklY4 z!@XP{^6K3k^jjo5o{2F?N>6;Pc;4V?L|ET%Z0sYZdsC?p{L~^1MAAw5isfPUDB%c4T!!ef99vwPf zlK!vB=x{U{O_Fu`zYZry6U(kLnUQd2tjxNj%ue<_)ym8*8;Mh`b$ukbF6z3Li?7TV z!xvVNVan8ESgy)GtrTT``QggRJy0*?5t;ugfxW=-;d(r++DT-%y6lNh(r$`&i&QZ_ zXVgj!QWrEeIdXk0ai_KC1Mj?k>GoY+znsIqeq3dNnWY+C)JnNQ@3mrLQ?kG^hDm1S zdGeIC0)0c-OGTRmF?s{9=oHprdS}SA6LCrL^A|N5WkKO&P;}-qx=xa_peOI|Mg*QR zd{CSLTT|4V&%jKeI4$B_u0qQ&HHY*op{SWSTE{+R@plsULjLAW?C4o_j)^WVgms51rU?yG$`gXc5b#|`k^6ZsZwOPI{T#BCtl&u zXKfD-c~HS5xTpZ=%VmB)$ZtC(1W?)#={?Q2CqFh9f{z4vi3l~E>gm``#yI zz`?sZcsLiCB{3i~QQ|IJkIIJCh2S@t#U@LA+RY%#hs}eW&v9C$K zjiV5Sj6z`YTtM2%9i#JI6!UZcLYK;^nb~?;6qs@-EgYo*d1|6yYJkLx;&4ywh`J%Y zMwKLR7@*ucuTSN zoH8T?l}bBxs95iM2F)qmtB{lG+;Hvc$1!dED=)%LEUcQ;aj|mt{^|2OC-B2BDr-jW zU{IGTScfP{c2>P*Jv)2^fdj7i{A2WTE)Bb@ejH_+ebtj|Kt>8zU5T;q0KN+ zM|7Fy@X?`Nq(P;i^KOhA?{GXee15T@ZGcW0 z0xb(Z*`R6j6l00x$Gux4PDvN|Fc6D7smNH*5U1osLT z%{!^uzQJI;6&jsa;~`*ezmdoZKQ%Y(H{GH}jg+6z|6(TMvOdXCzr`kK8IVX-0bnE< zlS-uRfLu)6FVYkJtBV!SVo!#F>$fK()V3UGTX33obZCr?bml_yP#a7s6)yMMYwqQp z8+5oPgf&FpB>41?DHIy0BwJVtk4Xm^)vU-Uh10n%bn+MFiIZQ*^+>8bgTO4DtlQ_U zRG5{Dp2q#A&bVa6{`T2gDFsFW6is||{85uBuh;zDU+v7Yn_Yr83qvav>JFp9o(aS; zS-hs0u9FkKYfMvo^i(?%sGp|=m;c;dh%+R}p)1NxA?}f7wsOlJV1BZFUF)LIQr~># zPI1s11x;vbrUA(=)Hb6vD>M{Oyyk)|_GKBl4fMiFD#mNu9?99PagUTwJ+otjfNNsY z#tlNrW9+*_<(8=rQIipct>Ip>zK=cNi{n1p;?y)W%@RemYK>KUN$@R^6ew2z1}Cf? z<+_E%VA^0PD?kkbBA4NMM=19@HA_*E4>0~&-KaoOchU4N1wbA}voGb3+B=f@u}R;yfW`Y@(yHyoc_jK|Q_#!V)o`&0uny0>Za6wri?TMQ4nuv(`$8~r{d z&8_G`V`ltLx#X#I-82k}^jMK625Ry_e#+Cyd%AjrC_8hOU!inr`r4N`HeYssxtq$2 z{Zv9Cf0mO8Uvr=PfPHvmURZ31zMrO-O(nsQnTN*t4>%L>AYMolaKR@?T9w&0hVE!t zqMY&Y$)RN7$S-K@ah5aOhY{h_uM{BaP=1+%o zwV6Le5jzm)Y2j(6J7C?rJ;oXSnR3Kq&Bc=Ys!I84<7>I!UXZP^5ChNR(aj+dm>C(f zQPP8A?$E8HW)qoO6K%1SheRt-4^%s+RnpkEi}Kv7l{(WwEsNH=cW{ShmQVozy+x8t z7HY{M>B+E7KiCwWEX%TCTJoN@P`8v|xs*jY$?!*?^Kew_MCt;0r2~I~d&)RmC{UNf zHY+7E41)55ukww=MAZVbQ^>0(m)t-+GZ1-tXEelE8r{D6bnw&FCzWKGTyt>}RrNtl zmZxQ&Z8-eTJD?&`9CWFQX;27$!vZ)@DG!;2J}XR8bB~=_;fF#x=R6;FlC3Bx*Z6GY zm^3G|rVp*A)JA;-X`-lLPWVBjNH4hMfBND2-_1;$_;WeCIOoEy*^9Z8Me!_Ae%<(n z{sFZ6;h$tOF7h{#Enj{3(+|Jw%dj<_h%kvtskaLg=1y9idXbe@3|2CWiW*$23!&_M zno{PKSA>7@WM=nviGTUz@apIQh{yX6;(g_NL)s`DkCn8XGzK)vtoSkq4c?%lEI(e* ze3X{X7bB0j?TES4sgCdVURr-rzH+T=f;Y_E#cn-WN zg_~2vB+^NyCA$XN&pYt4OukVIZ=`3SX-z8<4$|lMJ zQh6GhL5-CWHA-9esskY0wxyfGyuCh4OmkdJbS2^UcV|K-(ZURqnz zb$L3Tf?W1yN-He7VdpTHmul3~u`OAbbb6U>r-YB5MoA%cE2P`@Ol%@9uZw{YDjB;H zsH*SC`IGWm&nsV<>1)(vIu^S!E8U!%jPqScVbPoQWZU19D~L0KaOx_6$;V)_3#K{& zu8f4pRaM%UM$!9(x2cH|X9fcNix)kG`=;h$VwFOX3<#CeH|7gdulst`iqc_xlln$A zu0cN+=ffCw9LbHGAVud5-c0eGyGq%FCT} zVRj!FRecX^i=y|j=hw;j*=+}vOj`^}zvI9y8X3>sTOp$Yq4wA@dJlhrz%jsTyk$ui zR^AISVWnu4yFH-akTc@JDT|aE@FwHBC+K;TJFr(Oy|7;gUpz6ZB)U)}MgbR9eu)xw z-9Zojesiw+tgv-8z;}!R8!1#B_d+sG%%w$Ps`a zYZ4fjoaaNGu~fU)Ms#@kVa8$alicK#(C$iW}fT#cyZ-p@Yf3Y;_$+KN-hGL3>29mMv)FD7iK2@ z3pMq{YBN-St|w}z^zn7n^gHA<+5(M@B$RX36OsO6@o|^Yr1mKd%(kLRP1FNfs%ta4 z+QGGANTwDa$#}#22Bw!yhq9@C6XaV@cG1y{1C>iYC24s0;g4XW6B=c-y3{75Sk>S%XrGY5!DGC`(ij+EoVY*^Cn3md@622o#SsR(Nu z?#zaEPGV7LXv;wMnspD3kUCp&~LzRHMH@~Sp)o?<_(q~Q1q`m}IMep2SvcYD8Ch+RNn zj}25Dp!I5PrAg!V!KkTwN?S_lzC9nGOYhwPujA>%%E}(tZ>akXx!*AFS1+2d_z_(? zRJ**O9So&xom3#XP>=wxy{1u1Pn@XSJp8DX&=(j{+dL>J201T}ox>I}=LqA3&UsKD zFCz!9l7{8Mot&K3)4L6m{g|L`m}(U@8UK7wdxFaw?iJzLD_5B6NQP~ghl|U0Wf|Gp zev39L5BYR7sIFw$W-DKrKxv$bPUOjFw;HwbCOad1>m}7*yK9z#e*#L{^yC_}%N}-h z*|_DjZBDa_fvOZtp?7&02|mwe3wO>bP^ex|o~j+V9lb+t>GYD8&sYFKWEAS<8n^Jj ze!QW_mNKnD;E!-7G5Wfmk0_r>C(;`@>$fM11MJKkU6H=cR>YV3tn*fst!vKt=6oVp zr7D)ykU5KfR^koJVX)v*EKAC!k7seTjNSDErqW{n9c^+qM+3p{dolqlzGtUueCM6O z++JB|JZ>#i`ms_MWpXjbMGXlQ%LjqJVP%$j`}y<7&-Xulxc&Uo&F$N(`_CUg-ge_D zjln+rq&x4-OMM8o6<={}rF*L-qmH|{kIlewBdb!GDYK}oHXqa_3h4}2&YLJ+M{#{k z_*T%jf8r>2-pVsc=_Y90AzeF8}fCa~uLR4(vph^73}4L_g>AOMA=yw}1Ze z-+w)Oe|GtEC)z6n^}PJ&y`M$ccgFBmJfNb#J9B~VP*b^>{D!eoMWGnCW>3~xP?YBB z?5M&VY2Vdai<86Q82`CFoLn4^FOJ5)b|ae!Vr#6oZn-m&eo+hVxYqhhc6l*)B8l#s zR5q^>m{@5~K9d^;~imQ%G@u zH!aXvlROjMBl;H7d8=#f$U~=(-fp0!#bB3NOL1;3skcS=HX1xBEnS&{8+W}jaaxu?fZ7W!Ezkx$+H%AB{e+aqhBZIF)m-HsCa+R0*@ zTe=)h((6(o0u@DU;!7n^kp8yRT~biScdjYB%yflQOr`S;dS7CGrYQk6<(5=b>OV=w zC|^UeE^(PRF1aO#QT{v%P9--84HmMf8;N;3JmMwyUR1wt&==d6x?%sPgnS*?KKv^tob%s*vxA^y{GdJom;z8*|My z2WnPjNsKMxm zM6-K86gIA-8G}+ayeGY)5sk9tkXlx8`SvTmy6cpB>nKTlt}iOHWa3EQC0e_|Xinu` zPCa}s5H!pDAmx-JtF>>`($b|w7w#9n)dHrTbe&37MAJf|!a6&t)@JLToDECyjHOVX z#0G5+0To{toC<{n?Q8*#XdhTL>WO>5p+=w)2(s6Rzc0LplVMZUNnmoEzSUc)-l zD)EadK^*wAm@>d{4+1828UZwv{STv4@f2QrNS$2rR6Mx4SrcJ&(t0mhylQe&z{QSy322`ltVjQ^&hesr=@UX%Vf?G1fb8I#ZwlY4W(OnELfA0EnN^_g1C@YnUjQXL7M7d{Rp+of-4D{?TdbN<9?)qjt%7c8Kg8- zqQ@uoZ$LY98P7t$(t!PF_-t5cBq(P7#*8s-^waI?iU`n4CfdQ3fmvOeU4(`G5jhhx zTAMKJ^}+Qh89E(oFvSh9wps21W+2k>6objx{yFzdRyUnX!?o#qegnV@TfA^F z0siIp*ZU0!uYs|jE>J&E&+XKEk&Q}$1aS_URnmnL+^|Z6AL+A0pKGt2ji}b6_D8ZF zq91x&;qQV)yu)@uBDJf1&UYOaGzJ86>{cAALHnanjnEH+t?frJg_9d>BYC+;gYdoE8-G2#+oMxn7kE-oCG9va zfwU6?SI6py?G9_|!puLFs;YvdAsem zt}a+_HU3JRTkOAbr&&#>ji}wh;#(SFCo$2_?kgeKLO5)tl65`Do<$P8gu2!BDC=r& z+{V^uvHAQFjfd=uDpyf51j^N_0>7W$VgnqYY~=Hf552RwcYd}Qk7twdu{b{)kI&D~ z#C&mfJb5kbT(-M~?*+_zeNB2@?0H)l^R_qOb+z8vOm}@>20DSoO5`xcdJmZe6s*^n{Ixlu#mQl$@LZKHpk zHt>eIxR#=zdBdIL?oCa_g(d|v6y(-jOSjSd!Jl*@-jG_>_-H)%!vs@piy-i%1#|H$}PL#v<%UX=&c#=vG+oD!CP4T?KamqGv(&Gt2GDf|}60#LImf zKg&itT+?ZUZ+%T?u-mTb`QlormN(q#nvScN2vT@Kqf3XYxm-_2+X}aCGP2Y_qIt6& zV+9LGuS2(Hoc>#&X(27guY{w6>LPL4pt_X6XjNX!xp&0l?#hb|_-6b)z@GH(*=ODt zEo@1Rhk0ZBiw8G#bW?sYqx5rr;^g2qp|=cLPYl-#^DHkUTP?AX2r2xl^)XX7sv=!| zDntaJ{O<6sZVuZkB~0GEAM0x1>!G$I4xwp&N7pSZ2?cb6fe}YSc68y=pS>t8#Lepj zFyypJ35(EIH7_io227k+syaaG#-rum_6HmyOQT~fI#vY9PfVG9!E;{S?JfU?X*Dq< z_HK_m-|bamFxIT9)X>yibg!iDM*o%+2c7WONJJp_m*yN=*urLkx85!KJhSbT3D33&W0_&*GrOYl6Jh_{M*h5$1 zMw-*`DjzZpMRn2;hZMt;&x0)!%0WX37#ZFVw?EtrSi;a7zZ*o$D3f(IoXdd9b^yDQ zui#A@V}_+ymsdCYDsv4fU@kB$Po8iS1SroPis>Bi;uQb}{^jcO_HyL>3b2o^^HfdH zimPV;Pb;~noC?U*8*>56loDJDCWu@tZ?5lfwcnI(<8VB-#IG%Tr%hY7<*@GvrX4X< zEYyk``r3vZGy7g0Vj8kz=n4AZM)mEAomx1pm?6)mm3LxA4mKEKgPQaTS0|44jH<3$ z58ZF!|37>0+TAvetPB4YuDpA#B(qIflJD7TKDd+gwAaaP+DZ59Y4@=yl9D-*NHs5Z zJagv1zo^26APImVDcNx*>+Ca~L;zSf00p4xDb~}@XW|}KiH;!CX6Bx_sS`8%*h29b z`P1p7RRFwiKgWDBKm=9tT4exm)ooH>kk(B(kRNO$!TR@;1?${j8Wkd2<*|3X-zpDi zqm&2v!A2gee?NJ!&i&<4A+l8-2a{>5JfMwI9^?lbd9eQdksYn5dHheLv-#dj~bC?dE`sO;T)xbEfhGiZ_a;el?3nG=lH$sa`bLU zp-P@s22q>@`V$)cwaNP#{Cio4lAjG()obx*R!pxBm3nZvcf6+-n)qO!&|=3Wrdxp(uq55HfGnxw9Jko-Oahr$|jmjPjKEr~QhXc@P>T=5v z8bTVaAR0oCj}%6u$>~;rG@2UR7L*2M$lh=3n`>CvHXm`eA+azrckbv@0rh^^w-(V@Wlp-?X@%OKW?qdyP9|I89CJn!p;Sa@*`K6#@5}-_;bYk%Jb$tYhj?O{8tf zM=Hu}@{f$PJwOJMoy=|1kZRo7Z~PCGPGg|={u638v5|LPW~_2M>N+xKcc=`gk`LjC z<0g%+6V-;i%(<%A@s*|C9ylGuZW0ZWfl-m-m^o>SZioMTHTK0a>n~rD|nyZCC3tdje+q1W?Db^aV z@gx^kr3#mW!N53JL@W7M+y{x3!9jpOyXBjgoY+>t#^i4)ZT|S78u&NJr(* zqc7L_YWdsQ>AO=%U5@;S*b4sg`wpuC#EWi>94wbfE$bRi9&t#C2ScK8e5Bb9QoBl^ zeBwIvp@LwAMK&>X>z9yc&#*JOzy1yUEl5D1+`*T3oFMTFkkt-I84eg^9`VF56m^Rw zm|_T4>JWmr@DeZUml$8-Lt#SkJnxBJOPY4$!~L;Fe*HrSR;`f(oygS-%2*I^WnU0b zRP=)sg(Se*jXJZksJsw8@_*_w45+LhQ_hiw)1pu|_D0A22-i!c}YJIV@sy7GE; zvhK6G-a2fQF0w5%xP_gS>^%TXO?rWtM`;+|;bC-lwoDeg`85>3cHxc~&gHw)@nnB@JlRDY4Z@kr zs&2~;EcxdVJWez&zx~7G@t(gQo=m3`_(R}(2PcPno)_#L2Eklwosz!#h1YJ-DeC12 zS)K!Whicbs^U;TCZ?yDFP5$>7qrELd%G!-+3t`#P=eHG;-R3~|cbYqU%wJO|wwC?} zh{GP@J`ae+ZHU0qqyDPHuZ>JSQ0(=_-0NY=mS|gsW*|1AW!~B~y~Ta)B`y174lvqZqwq^4&Q4 zf)P8*aN+rPyWmXa8Tnh7k56{mYp}?@pM&m zs|BV>Ks0JJLDs~u8n7mtc;~w)#$!(e-?6{FCz|&Vtm7PkIrNGuY3-w_viGnhqNhAe zifT=vA)4BF{tS1ix0X92F{V$Pk-6Vm)=b?e)2Ga+&KdP|8JRB&59@vsWmH7nZ-l=`r{#%JfJ@1Bnw%v-=aN9P7&;K-5A4^v;tbj7G^unt9R%8i!j7(vh`JYBC zz-;6vYSn8b*fUOBHBP7FCXk~pJkz3yb~A~xtRVJ8Yv+`7Ptn0U57QemLtdU5RH)#t=WC>Lpv@?; zpOh@sS`gRw&Qhhctx28O!nwG3_VPJCQfD=NeLA;MhWO49MTkK*r358!R#Jwl;Y3+Q zBn!A*;FWH=sq{*2#BAhMkD2uH&!5hBocDj`GwLk%$zMPH8E(~iHW4wz9p~k{KW}K( zDa0~J=j!q7&K?cD50a~uRV)*7L?Jz_Y(X^E&pzISFYs@k*Kftagki7zB?@ob)gynh zzf$B;HZv2|d|HV-Nf%xm{nIlhzQ|&)bkK`lZbm42-+v<`)2>}Jb*lPnr#{kVG}KcZ zomEKaDdH&atVwU_Vm~{DdP@gd10$chE4H?Nc2h2AaAP`_2Hd==dkD%(Tcdy$lByXbVRy-c~rtA9tK{Jg$DIucj}F@W>HAj=XlAHaQriQRQ$O zIxyHu!mPPC$uBX2(X1-c%%#l~=XgK{z(R@;!3f7&*^Hvhi4zBIuP_`k&d8Y#t0pd_hP31!o5X~DpyK?Cbzwv7BsGD$8)rkq(9 zw1-Q2xMdH;3w$H*ZV|>1)uKNn)8bDZgWI{y5Z6U2`#6qSpu0iJkfcsl!w!hUq)6 zwk8>C6^CEeNgT$xwU$K(MdfeylQ2TE7Qmfa%>>(M4-)^92HcZDF;l3b>cfMBy(23v z%cNq&nlzrRisdnSYI#FqQ9nx6c{V=U)pe|Nd{W7^a$pYUrE{uD=l6!3Ts%^cbc4+P~ZpgtBj zKPJr6$%x4OyB(UH7iFv%FPhK#+9N}fv3>Hh96?6kta;(s1YZi4a0-QM|6;ukQ{T%% zNQFr~pEz!fyZ?iOAAk7a(bE!oi@kkG z1pqt`AYg1=8PUP$$w-x=;l)&@P7EM#3%`amD{2*jMiH@(9#Q5=5d(e_WGBAy$UnbK z@7823Vn7Qc=R6D@1(?7hffR7^AIPtpk^fFcll|Q+^>=+7U>BId{~0Zk|L@J--jVxe z?_jTPIJB&$Yxb{HGVEzE>XCYyO-ChI7z=%PvVS*X9lAdpW#UbQf3v2TjLh{g7%hl$ zy`{K|iNoBaCk6RE^`stY<1a&MG1w}};uWY=Q1@q`F0Vj!qK1ln>+eAJa_;&L#6>>z zA*jCU^H*V*^SYOy^N)WnZ@6}xH-A3&V&_MAi^86AwZam0IX%;ERxIn1_23;?&r`331U6c@)y@QI)x5p@|K=0O^L> z;uBE!ovHI{k4i@apL=AgJE&#Y+fB=e_wabrU0EI9X}GGsiia9K55x5L^*_}x1U{=n zKWnQ$_5V^r4?+ia9Ivf*dwMn0i0LQ$<{&+HeFHZtnJ&_#SdW5a+oI%B9 z0h3OL(a7T7@XbpqRIFYnS>6ie42{}woXg~3D&-3JaRb2l`0!GJ;oKyqT|hp6zqAE! z7D8&LSSzqulH`0c&BENHcggtL83Go0=D@$=-6=oTKvF;A2+@ZOg@9pD^(=f7#l;r~ zes_u@3Y^^g9I`|JU_hV0t6j2*`MZRH-OrHDyWAzmk^msDNaM>W7&-3}_R`1xh1~|1 zot>3;he_+?KQZ~jEG(0P$l}N1#L0>dDMD-_p%9$&WEGabJ1IHfN3fCJM$09jG6l{G z4*g_(io@I5_mh}`kRu7ak^^QxixKNqbA0Sg=3{b_Kk&i>cYhLwt~WoNkw2YGC;r}K za(pyZ+Z5MVzxgKhHdJNkts|qQ`Rig-WZptQFG&lRwooL&g{cqEO8`cWPfYZg9)lwo zBjS3S-FcH$16sqhqL=?s?qD5~j50F@OP-Kj^c;?kWb({C*pfh!<8gI!eSuFBo|E4u zI3AkKj{GK3zCQp39&tbbP?RlPyj!*dv*|V@;v6GIlaX4>rL0;p#^shxol?#&DQ8b8 zYn2SUnpo8Ya-G6(L}~M7;^n1cgDCqvN<%Lg(M(#MdZC>Q?Oc&@t9X;kle~Pk5OsN; zExck8K6juyS%`c-1SW^|Qr4q4JDeE`oD3~HpYnZ11f?&JIO_Zr1Ml2Zi|y9kq!ALV!2i+NNvY2`vI zo#XtHUqd!9X^1;OrutGXsp`kOyNi{+cE?@v$!evK3gu=o5ndt)__*{nrMgO4@use? zF5LC;HgRc*8+=VE>tA8yFz@{|QwsInsX?4oB74ZRF+fkj@^O&CF4AqcL?K;^bDU`0 zkRl=U+BwB|3eQHMeT}p+KtF-%nQD5h_wPasb&Fz<7>;+!C2zwi2wfiv9*{z%KPNjQi5+W0g z6bESHltej{2LtyUfJ)#mb;141xd8X&g8bP%+8Z5C_K)|7-%tM0%i$mQ4@L*$gOkaz z^KZR$Wh%5XlpFPvpMfJTNz&zVoj`@4iY!}APh)bQGDxjtSYoweKAyul+JRtjbYu}_ znf$gOr^jOHVOl!*0l;D)CI+wyiP!d0_M#-9wkV~rdT`DP(~MU1Bu6OXgHe~X3~!^f z%;306A2dr?Ao`ZPi_?4=$wU!Rfh(f5CuWxk4Yi zy%qOqa5d#EvjptqbDZ49a24f2RoEOqKwAI(>;wB4g)LZ8fP`D(dJ`q%d5cG&z)c+e zV@^5t-1pa3do24ZhY3^4b zt>~W!r#i2!7dvpNat-qz>qVFCRFY+$`R-}Dz;lte`$G}NNp^Wkj=Y&(;xcg^#VvR3 zC+m-#C9|aAe~dOM8Z;&R6Z=WNuOJKYSeQW~6M_Y&J+Ac+_eLH&}Se|+g2jrXTuJXx_=Ac*Y?=QX^AC4L^}&NH-{hFQ}@TQd-D6grvHBCN`HC&uY;X` z|JRd--BfjJoCU@;+T!x5T$=$Ro}+f*sw`F=X&ojL^b32>=7%PHefXn*Xs!s32IZZ$ z^X$jJzIyi@L!LbPFD$RDd=>;WwGpmCB6}nZ%9J9yH{Y`KAQ-N(@;3F^a|h@a_t3ub z$03<8>E}_n07bSu46(*8ZESoT(me|yL^q^XvBwiOBu=w*?)ePqpYNnSABB`$wH`e+ zow_{^Q3iF)8J>x1pI>|a=P6b1xdH@@1=#Mz5}~){NCnXvB7+aGms>DeXjWLoZ#YilSfFxiUyQNj92$ zt7v(r)kl)Ktc47M7~z7B?UcZQ`vbllDA;eByZy>CDGRD&=>%R5RlZbnK^&cO1H;5isht1 z0~|DIx?QH)O&XodOj_fC>?X~LHWu3BZP^kHZ*K`XMHaIn&I`k?ED@yRc~zzYcz$i(Z33|0$!s(G?rwioJ5dyOfuQfEDmh+9Ih_jz!(1Tk%<%cmZC= zk^?vZSKt;K;eFE?Z9*p5T~a*7I#4uV7vJF6MJ1Ftgfduo?-PC@hyR?P?%C}DlE&h6 zS$Oz5SwpdpFc>)>mLZ(`mmyqD;@ccJf`o2f+6o~w=qF#lJl_E(;h8Ui8sBh@6wqqA zb(30oe!?)2DNQBp&u>qb5QK*lp0_IE2>*ep4lRxT;>AIlL;>FTD6MlFApSO1`76dU zN~)6_B&y*T4l=sqAe%dIoBTysC)s6_4DW3ygYDMJ78R4h@+KBbh2?HK8ILCWqltEH zkiOVIVQq6OL$B>~9T7=pmr&BT2aonwKpilIKLI=LWQP%ht4nxUw85v~+xO?9C{y0az0ag(ff?x%JS-!gdC+X zE@P8>t+W6)R(sp`%`2_gBIS8uJzz}bf?;SL*Ld8pmQKcU$(ikBF``#*vys>mJhzLn zRs8@B5cxKn0d3i9BS>bL-pI0m$e9n2ai#p^GQFGM6w^xIwYj9&~_FUM+>nnqtBspl}|^jFo=rP)yO%UJ2$HxMPi{yhToy(!9{{2 zIq8w#(@JUVmY6d2USN3v(g<{HtzcM@l5w#u)(|$S)dKrjQH?t!;t8_y;qlsolXe(8 z4Dmv$7rHk+P_kbRZmv8in&}yCC8zmpnCI(J8vap)2vQK-8Q$1QQb2J9@8 zMJCWN{AEP?(i3Wi_3bjejwC)v=CP93G%z-zNj|f3!=p)AWW$fa!-@l9JM^=Z_tGo6 z`kVVRW901B6>N;;UtThTAR~kPYvWpax)<&r93Hvh@yX1cOoKhwBY$`Ir-z4={mIe( zcsw@G;oe{})d38F?6Qc@Ug3UN6yP+wf0gT4YHC+^u%ByFOdDi z)69`aV}o&r`Z`>$nUfoY0N6!Ghoca_iLC&aH=aj}0!)dmLUpr=R^B4qT}1O1+Yy=> zXg=~ddJD2rp_NIc;XEXZVA^U?qM<5ljs8^5K-t3U66G}lW@HnPYxnJ%B`kk`fPm#; z^zyaf$ROElO;)JT&Qqstd%5bgYd2rLNm?&|MLA4oZ@tcd&P9>G*6y#%618{O^}@9A z*i{q`bJ-Om4)xhJMA|#;I(@0UcK$I-^Y7!gGjfJF?iDHr&4hujyP21kiDBawFhLLS z3)shoI|h;&ZNM{Nqe-p-{g)oTLDeB(N0H7BK|?8hH!RgayrPy*O0EBlcw+~keWVr3cscfgPn{f zO4)2LEUGGlwm{RRHw%}_Ri6E#Kqev!M*{K4ce`{YS$k0m$NZOce)39pUJ$?u$*Wvo zlYhr^V>WWm%aB8!^cZ7itdn2>6=`ycC?6C&1kzFSB&D&8j0HJ~`YK5L&tZB+Po1BS zvnz+P&;S9tc;czAGS{I3e^-N9ZC;iqsdo5~Yp3fMrZ0YzT7HB0?#^OCtY}A|_KVMKD6ZE9ST_ zk`S*5uLKA5aSY$G*!Kd`2DDF8mG7YQ4m7|U#C4Ighc6@tuNv1xxKA_jY2qS~)#6z= zT98%dE(0?8PtO6@m_D$gkefqRxVIuFNBB>K|5Gko-m-DQNLnVT(vWP!EgFl3 zHpW821k>uwXeh~Ip}rHMlSOG|u6v z<0y~#o3$7j-#nR<=Q%!I{ZvU=NxB$?ka!sRSqPZ!2>(r-32#06f&WRZ8^LQ=<%o`U zx#_gMQ7iN!m99I>NR6fg`l0RU(v9uZnu4EdA;P$ttRDE{E+7-u~%Z zjJL+Blk)CC0UYp^#?R$+lV(#G@2axnH5NB9iAMkMZoDULiXVW8ry9m=4k*a32B4dJ zMeOTPCuI}h%`7Z{HN{J6d>-gF%brB6j+Iv65-kJdEsfH4iNqKhAngqIV4aZJuWH${ z?HkS!h!!ckA`Bo>av7;Nu!^wE@lE8h?jnmR3qt_o$()1z={~4vZ*sUlQi{8z${hS8 zni;N8t2`L|cRJdL?5n1QiMDciE4AQ)@FwyRI8oZA>C#fup&%~<=qVH`ne-7kyDS?! zZIz473lJUYR7pzxPZG(kIgTGd-TrsVeXP)jE^jVccpSv5~K&{h7C#ja*z5YFm zi6qo#m`;o+IOMqWiquwvwHbu?wMS2EWIlW*HHK=Hx`9F4b>0YED2d$wU-*&5*U`jj zz?{Of!Py5+iwL%q<~kfY5D7;y;l=5MdSgKu&LAMRsL#a4rzDDd>{sEMh#2M|yYH5Q zE-Mp|g}4OKd>$g4U*$WL+-ouomuy{P1{2~*7deRLa&#eS$^A%rZH9Fl=#@97Ffz!M zq)~l>{Sl>XvbGL*jRr%rgKqp-k;C96dX+8Iu}_kb(Kd?Ur&v`>j^Du>w?yYXJesf_ zhx`Nf28cggmsy|2t>f9NedDYbg!Wg07(%asE^OPVV4X%#`2Ma%3!<6gfxNof^Oj9V zuj8H=mP3&#bL{-7T+jYn+y=3AfgLXCRaF|!A>v%5%46^wy`J{iEU(pqI+-*=kq-=- zmW9!GJC(<1UDK5^ZQVhkq*?3qVvW=*IQ&RViJgzg^8IS4|2diN?VCl*$>~3f$}!9f zSugHv=9Dl_3(u3c?cjNeOVU=)vvMKNt})idY#C+OF!jpwm3${$Zhegp(#b=wW#>^E z-jWS(hsf>x`Hp=3`!s8IWsdD4f$4Zf4VeE(?~fal!X+}^oA6s?pbcu(`?+*S4Y$g0 z<(RDLJudnH;+||x`fAOYc&&YWQ0j5ede|7M%Ne5G3U!NMo)%c9HMqn(lNM7HtzCY@Qg<^% z3tDxAZ10Hei$UlO=dJGX5mU}Wd?_O2y3%7T!aU2ziLCY=c$s1)I;3-j*y}tfZZhY= z@PdwWilXQoj`l`IHP@tMtI}pSgHk(5u9k=g2+V}Jx^@kr7Lr!=0T&--)VaAlfyio* zC*)AXVUGFhR3D#xVvzi>_>JZu7ET;vtSzF0F{6?#|4H%oPsAY>WBOvt8nbh;s20GN zZDGQ&nyv694`g~1g}1Okqqhw0;2%WwMrn3n8VQF)gGG_QOINL$R&RqB*XxY z7IU%^oP+>RUaY(rE2*N2vtqS^3Ne+X2X__><0Lv3iYG=L(ZaP@y@-8eHDeQ#L2}7H zTqDNxS7nT;Byl~8dD+JN^2;S-CvjtR=}w8MDqWqbY=#5O%FUYg^DBmPh)Gwuj|IJl zDc;n=9SlEyvPF~QuM(ZcY}E@O`DB?n&*<*D8(@OW2eK-|YD)g&hiOjdHZ0X-{9CfK zGsOMpJMz;Rd;g+lD-rcHlgQ!~6l)bmo5?OE@pM21?XyrM%Sht54QHhcKu}j0Nq?mn zVTa`o0~GBnNj}qjr~DS)G}0@Ut3#QS;y7nvEe*UxYzG_pqX^SG1)7i-tr{k)vWtGJ zTx|ryt%PJPG`vBqc1A2wPO3IinH#S;Mw!O*;?ohP4&cr^^F17gJ`GANW3QfV8Ld7H3(ReFDwH1Z)_bP-qS5veBr;W&^$F7QSr@TAFRiy zcw~wsOV=Yd4M8N1$Uh`Aht2Ujs6}@RdVdpoY3!`vQV4EuSqjX8Y+c0+lV3pa%V=?( z@5=nSF#8*6i7&3-|9AFo|EK?c`X(+*sob`h5W(J(b(%;=U3-eJC!(F95Y^cSUg3vE zBTK~#jiwJ1uyn4=_80qsL;%1 z&6+aBYJDI07W|GrsXXJ`x|7xBC|!z+ycxidKczDl8u}q6yTpIjsZV`VpLPX0Gm}j)RcaxQ?)F_ zep_^H1icAp$uv!!h@3FY>cs|%T2=A@{3MPE{XxL|EQaw6OC|r@&5|6WS>wvei*UAN zq!rllFKs3doQhihN&RrNE7fOd1e88W)uaeUi>plK|oq% z8i3$hO-6Rt950R=M2dWE)MOS%rcT6JV=hxX@7Tw&SyUVW*{B@64LxMnGTQCzf$9}QP6(|w(GR28WjmA<_it~!JF=bd@#^qC;LbsAR1jxZ zc=LLdW!Ia&m4uIIr;p5O*9z@YSG&u|Zr6|^70slnvXSDElC69SmvYCM6@c5H<&Y6s z9^?NHrK6IAAU@$NQJK$*V7=qyKKY+$eRJqW{)+rD%>B{x%_@$3LaVn5-(8U?<-Udr z0m35&VPGx{B!Kfcv9j37l_c1!cC~8I8H7gFkPH^{j(OH}&W%7h`&32nzhu4Man{ia zHMLni!H4vU+7?>qMg`KQGz+)(ejM6I?#fy@u@C3IejARfXuvM_6r$!$-17dfF6inY z&UHf1$tCszJ}inlmptkfA*3cMASvYR)$`Up%E-j_H>@@VoW1HUece{2m%nD;I+IO1 z)K9EN-c5cz?qKitws*A&n~!EAZi91Gm-BX=EFEEw%-K@1VQb0v?|kXW{f3;d5%@qh z^2c`CR}<<=k%KvZq7@Gf1{xKGLgn}iFAXsfzUqkW&@KCnJ^$`FufOm=y?Xoi9p|T? zcbqrj0{#w1|2o7n#Mb+lw0D@d>YQ`kL*2CzOuiQr$7{+c?_t#5B1}d;gt@fNAJWqG z4fzW%A#Pn+6FiA?qJpJfNL3=bAEqmP?WP6!WEDKDLVdf)2v1Q=TtF>yU{!9sxi<0W zHgPG|7X|DfrcPh-cuWiS=8=~*0lzzK5p9*&9`bDr&{N2KoF=xQg{18)R7l$NY{4;> zc;kjd3BlLSDQ4k#w!-aeyo~|+30KdUg^UX_Mei=7EU~p`?BJ3PI*Wcun>c6Z?^Pg} zPhPefZH=Zrl5Gyr*KifgSc}!taH&Xjt1F{GHUD3Fu@`uD;_Pjt)$YT@Xur+^{DUqS zvLZgwuqnDXNxX>iBA}6(5R?FaX~0}M7x0z@NS5x=-so_$f4nz_s6NsG{&D|cbTB?R znH)R+HcMKj#DI@x2=um+rGYChRnp}WBORM^wK7SKDSjeNT%Lv{{YGJmIcGbLN1-JI z0N*0@;$rF1d_9^u0#Px<&4WCXm-5B7^gI)#G>;03(uZlrim)$}Bz5>x4`M(>nFyN6 z7#T}veSMeV%?m9Dy5snKo6l%SrsA5%EAnK85l=)0oSV9}%#timVmI*3ws3D=e%(6k zbYwRN*MwK{IjfCdS}S^j*dZ9hI%AL8 z^zIZWzz>kte?R-cJ{H4Q5FM8+KeyzRMih?Gz-(coum$+XnyOFs$NOWWl4beycxA2j z?x$`^uy#64!v&GE{f1B5oA&#kv4vr~cmMj*JXz{Ab(f`Lgnsf=F=H!JtEH96Q?tUd z&#U(OzZT&v^sNNhbE~iQ9wb2fjUK>;Tdxp6a-yL+%@uwYmk9EjQr5@9aL}@yO3KXh z-#twicn0%!e<;E@$u3VJRM9MbnZT}(!cy0Ma{tKLYL~hRc1lRx06O&(M}lI4uG|=@ z#nS;isV*8j#3Un4MrrVr0h2JKv;y5@B7cJ0+H0bCu$2lk(P`rKy5@eOc5{{AivQIsG zo@bC4Q%QdpgyM(5)s3AZhTK#N`vdUVBj>#E0q7B`7hywIiz-}usmFaM=lX7a9X4)N zf4g`x9=qiK4qoH`?zz)Fnp$7~=lzQ(zw2#+3BBVHll9Ws${N7AQdHmn{q5BKaqOP_ z{;%o3pSjXsp8xA$=imQTSq;sqZk*OohJuvM(!u2^ z{MCYjaxQ-)p+xaBjo>zeZ>%te9ZW%7v;)@B!i%GS@=M>dIk9@Vk`2NmgdthIcBFg+ zM#nOo=T5j<=gma(OU&Uu|BK#4wwhLE5`L@3lWa66C%NUFQSC|QvQ`Q=Xl~ndD|0O!xc^OGo^)dRg*ed#B zxoj0Yv{89?kUof4FL)qf7dzFuZvuvo1$rn0W<1{^48BeN;oXF06);LVD4?Y#Z+-M( zm3TRQ{d7D?o^6W$41rs%s%EV$lucU-dhp^c^==&sR9#o`{%C(Rb|;gmy9i^rYc{I6 zq@u@6D?4vS3l@yF$-Z?{Ba+u1p_E3!kr5@6(9Ej88719gTj(&M&^QN8sBT9yy9uR} zU7HrygiY{G+cYWKS!k2DWy?A|`X|JdEoMcW7lz%+OUX}0&B|2tm_>5;%?Q5>t8J># zT*!y zC(8;}K>PK}^BrIk;tLYe2@X6Qn5AxBgfwIKqEmDnyH;zj$$w zCQ;A?m1-!npOtE}N^LCkSH$*_)F(MvRLd_MWOm0vR*9_=Munx4ojE}SFUF*u?VioGG$l$dRv zHBmex;SW}e#QELIi*r*XQ~8ySQY$;^<<>@Ni-_9yEW?JyRV4e`IuY3JKTR1}K;$zl$r z7P`xgePw{y*a!ym>O``&EN$07F3(QoS-J^v*b=80#q4kxXl<1q=3cBJ_@zy5WlQxu z#oyo^iDJ^0Ybzqzd7lwYdkK*}wVmU0F$-OKq%w=QLP5`mBGKPGtGhANDrNaytyR#K z#tMH$`q}a3b9yPm;v;CCk7w`{i1(l_l$il&b?F1dZO)5z^U^L{dQeTktb;mny=u5u zhcGxq8)dasOKHfU8@-r6_O~jF_i?2@>J^2bkIIG_gCJ($ZsPOxSNNxd;>ioV;+j0& zap130`qwG@>mL2<-qYXB+Ea1ZPl=k5S_3<}OTu1l7Jivfmz`tAn==p6L;EY%%0q&V zq=EA7?5vq-?jX%|2WgrEh#ZQT-c+zM>x@opNetG;{ZzF& zY6-nqoVCnrhzyxZhIiLV;QE1on^_8dz}c)ZhTY+8Q)}YdgYvBU%T}elX(#OkEZ!ET z4sj_1PA=`ybCoRDMYbklqHQga+jC|`w9H-baFg`&5*`Z0=dc#Qj`J#9FO$0!mbX18 z`!tk>IS zbYZK6`Ot}JB~XnV-^=F&c4nq`_p}zqXK5bA$%;%6Y?lI^)?=q zr8Cn;*iwsLiVoE|+hr4@k1a}3rVK|QtOlPdBv}3UMzdJz-n0#MtrF7j%94z9VO8?U zSH#fi1+s-Wsrv9+3Y1bG_KjhKP?Z1**?Pp(qddflyedJnc5bDe0tJIMbL3|Asr}{n z@ba(;I;qgfj98PBAljGyr zWEzI!@pyJ}d~$ere0X#;8T)}&dsW%=Q(t2Yz5afv2uPDRtk+PlpBWNlpCSwojLROKrN zsBR+1>*Q9Z!MXLa(n=TrX#q%0h*q`ZESAa4Th_Hi|5YpAD&c+e0c&HJ%2I5CJqt~Q zfrS=AmCJ`9C|IpdN!h4Plyp!VfrTyZoed>i6ahK@RphWFhp0F++9GeF0KKEXIK;&! zPGxzgDAU0=I!&~+V(;ie<~+Ai_j!_uYR?H-TR*krIe$D3_NYT{a*Boo(bFTXZ%jlZk7&aauJ$o3f3r-dYq-6BhOaShph87`Mzy1PhrC!@)9 zbh4|J6aRdlAXC=WBquv2O!7;^Iq4t!M$;)9sQ{Q(@aYBKE{TSY6z;(HW(P|^LwQg- zEJ7xFH(s=a&0JMa3`@2r;0M6O)e5;nUauP*seij!UTZmS6Lv<2)yf%v*H2OS84J(7fFXO=?!_!$0S0q{w2 zf&csuuMtg3I%#cmtG8cV3B0Ar1}zT5`eQKvkkmp>X28WzD}wFiF*F1rHCDsb5v8ksH%ER4P5kaaiBMMe=u(9E)AS>#}I@GtbqEBq4r zMULyBOu6EWpia7R9?+c1^Jg+$H@lxW4pH zlko`t-{eq*T2K*5-@BYeX7wJZm*2=nW0we#+NL)OWv%i_!+1dy!4GEA!1NuRFD#WT zeX24sz~BM&`PW<|CpXWyjAFhuJnYTys-n^b%$q|>U>vZ;RFwaQez zA+UCkGJOf}`5s>C1rY#>TzX5$`pd6ZCQUkq{+b{S<=dMepvKiO-dZE2`+9eyE-$~xE%>(I2A zACiQeP$>YWw}!UpxR%i094wbIeQZMu^G<4ssEI`cfKOfXrQi@AsI2n-HL98_rT4&cr3WZ#J1Q`|tP zB^eaT4TsL3-k)QbRbA}#CZGPyoGrE^Uv>pzWns=Yy1TM-`g0{=5Aj~;W?qN-i2O8x zHN|+E#$7o0KRcf#MH$cL?6Y=BP<&L zVV;Y3kBYTY?*>*`L_Naw8Jbg{y{@(Ccsg;%@P8jC(-)KRi@ovRt@S5UY1Wn8a>`*lF6b9*VUzPvG2yvrgJPRU4vz?M18_OBB#Yzp|UIJwG`UXN>xM z@EC|zQ6BDP(0Lid1rKV(&CMt#As(=yRtxUQRIuf))YIFSBxAOWvfc1SysOMR`u*tM zbg&NE-uA?WU;=;%O8kb(DTM|%fLSj*c=@0KIYcn&9o`GW3FabJI%S@{=ha2If-&=z zCU3Q+!`vW&wX1$bPEf(+GKyO~ENtguyQZptES5`$wE5OLR`#|t)p+pqgZy7!%`$Cv|fLjEqMfmE%Z}_7e zodirHqG+$Hb+p7BB#K?lYXQ!^&(x13^1{<2l9r^|$gHahx2>wFx9(}{7+hI$1CULj z`CtIFhF_pcLDr@d-b@u8M*Vl%f{2Tys?yS!)LBO~Eu+Y!@y!*?%XYdKN-Jq~qM8d3 zs3#DzbgY z0ok6(jy_Al6=Xd|&S}j4Ob0LDMA2iKlg?qfP9sPZ11B;fVt~9c$D2bMP8w3XVsDqJ zlVB_co&{)GRx&B$OgLE?`3l1J`$d|ow2=O>5z`zI5lz1Iw;-=f|eq~Frf)!eL> zd_i1hJsnKT3vEG6Kqjx(QX>&&E#R!baC#!GwajPy0= z?H96ud$0n+tJwW0QD$Z%imVOTPnjDNM4M(I7<0Wg->Wi3il&PB7UCNOTvPGOA0Cb3 z0Y&B22tBQng`52U03oO8MwmH#c-*CD^CI)bb@7~dwlqWl%I!!$R)%g>yv#tGPUW`! zRQT(4$l^X_VQ9E)GGe;_0)DPTj~p^b-pq(aDXWn7a7hnCl;tngEJD~jPo=b4j8d`|C zgbgz3=2-p2Zo!tNc_$g+BeE5D2K%AvE~9lb;CAr_3PL#V&+SA{i5n(zF-FgGb3fKB z#cy-<%!IGGeP%OIdu!V!;{o^0wGjrbAiZy$84=yqjZPk2hfQxIi^Mj(wGR7Uhda(L z7o3_~rpI_=$!cLzE^4=rjN4ynjT`5~YiIxiG)hqIPl97VI60n=$Fu2pKRh`ek55jH zLw|m}KRpVK<~ICVaSL~f1MU$mFA+Q3AojX7w7oLa-52(Kps=F4{i?9nJ>ga^2{)pK z4cr?(u74LMHd^ZfUzPs`=ely z?K5(mSwdzC#F{`OFvRo^L@CR;v-6TI`ty2xM z#r>?i!r)3trZbKWV-R$h>j9Aw3M$Hv{yB}`XK$JYha+w9~LCEWkppasmX{ecz>qH@I&4prv z7-(lH*#Vb{jWISPNMI)#x(NUQFd1>tzy*)p>7Q|Be~&{um@ae_ z^axY65?$psrPmIv7^nZFF!9p9S2I%V93CcIgTqrJ#>VB5DHtfw;VzGk{#HR=ler3s zgpfxNh3$rl?cK7y{wanwbwpG8riZ{K22U{XnGLP$I1unAe>$XIo?df81Hxs4u;SD3!F*_nv6L;{KIaEj`8W!*{dDr z{4QIOPk&(2`3w2SYzKk?Jn=q_Un-EL<()v1K@_QEwN7HpF-H)YlDn5=H_Fq(M;Hr_ zq0y7xMME+es|;Dzgo-t!Ek-`pLRdw4w16z84`;8OG=w4|9w19Xs(V&}wDGvKe4%7A z>rzzxj^hD5QC4CUlJ7(S5J9AqWO)PJ!k_y42M58){N!Zs=pZl{D7TS*v%S*4Pt77* z7#a*Oyj-$?<`yVeZ0s&s`1XGuE^Jd++X0DHF6WGhCmRBhZSc~LDBDo~cX(NAOW6$8 zthHeb!=kNHpXYcKyIiD6v9@?OsaOf??9$FQ1xT^w$Z`&{(7w1nen`QVny3EEkLjd-nX!506iVg=v9pjs?ulgLoofwv43WxZ2x z6h=yB*7lfM8s_&i>wo&0Rb@TfIKW!Zjtw7h>0bcYXvFGON9!)rgZu?LyR1xiq(WXj z`@o<4%Gyt~w))wJn|-iD^54VfBWpc0DK@%E9ne$hh!uhBsISPGe8Wb>tuF`~>FR19 z!EOevXhst^1o}@I84wm6MuqbW=9I7vGJHY)5amz>+sW>TGqMVv?>J1PFggljRamqVxlz#*+t#Iss-b z2Jk2H*}4FCaxFd6i9l3&p z@E#{Q%VULt+;vG1uiX>JZJFthAO9C7;g7GJvGWYseGZ=9Z5mOe_QcR*iam%}o{tD; zGtd7FRtHusizLe1ly?aSKH(FJ84#|Dr-KmVABHB*t z^4f#4ay_m^XvgojBj0aF^tSXZU6L^7*4?MbS~)p{4^of&*`MxDyNH_&Zwx!GUx%!R z3b#hR-J2;RxONfHd+A~0e7~ptz7ln{v~O@>s`0uWJfF6_Y$@n{%&Qo_ObwJc9m6tY zls$!QAZXN*H;XEeX+HdF)ySwR`m~LUo8eR9Mm;BfVF@+UEV~ndo5Tlap#G0tXfEWun)-+6rZCf`sxKG zR1IdGHanwl`b_DY!E;)njP7&0*JS=`X7A&iu6^d`_X*i5(Z@CeyBNW?Jd{V{i=-hL zx$|QY^m?!tqbkYY>a&r=Wv8oCNi`dOK&n&pC|{9~iLSB0DATVx4!FYB+30Tb z4;cGfBYV4XztxX@J2AiTsCnsSmwaopRX+4{z08%i#D@P&d@1%orL4}5wR-7r@(Y;! z)QV+|leI$;ddpj}9|4PiTFwrPbH#tcwMoO9^Jjb#yxIXjZ$+resvg`8gD4==Dx=VT zv;iX#@EVDS$D7kt(0LW+UbJL*1tlGSx^kA$=aBqE6kIXX;8|GmR%>1%oAmuCWB{Pz z@Q6(qo+SW=pbpEr!ne{Zm5Q&b=}F8{WiP0+Fb?MtCMduD>l++|0wbpd6q1XHZH4f* zjOEkvr_{X`H5Q=&Te1SL)d~L~t|Pq0&%*pRgj(gdiNmlQ&|N2EEa3S$@i8`g7(u-JCF{HL{*k0zbmKyAm-cpPZ}onGzd00-ww%xO ztQDjY#3OlGmiQ6IUJ2+OuELLs!2YKh8x@YQt0)%Z^9cL0usmQXF985^HA7HJnlK&| zK3(v!;?vw)Ma#%bMN*x#?2x^n@UP))cmdixA74DduUWFHl!&_Q| zNKkNp)5P8y)09j{Tp8e<3Xd(M_SuLzlsWq!cEPsx(p+Sv3O&ac1#yHu~*7#_CJ(3nJWe~ z1fhht-ksP)%b|j3POKEn9YPAdRYKE8RyC`f^s`DX{BBmsdu_)mCGm8y%C2YIuliK` z_|LQ5PqGhqhP|)T>o<6A?G%jkJqk%L!$%f=M6BX7A@MSZQsT!Zsr|Wu^>oXg>dl|E zb40s399=yf|2kQPyF?UzXgBMdENnjquJO%bD}j=QVY{-G*v-qs4V3w#FWa*a%iTYz zK8wM>(p=MmqGN;0ge6{abgdQLxHzx@HI%f8(j-Qx?Hj0e0k5Vrz-1&y%8~QZTjzyH zTlSnR_SS@Z0j)20XEPn|o?v7|D1hU@MnFYBoPPZ2&xjzgOvn)ka3o%EKnV&d`sw`j z&wnmvMVuFAP*EoCzNs2zcO9N+6ED;(=2i=_!|!-7$c}BJbleXx$L4`IzC`&Y)NeLx zEy`VNq(R^zzhe>T+OmRCB|L}B<0pN*SHU9gp6F6?qsSdSNWxxq_2 z>~cf>-(i=nE#*nBP;@|D#jZHP-XU zlhdnQS)GZhlj5NcNIJr|a$3@S?AyXLtT1U4n_4l1dyGm|6Z#DWpePt@d&N-bVt9~= zj*iC?R#Ktg64S6E$nThj-!Topa!f<5jX!=&!wPGi7QlzYG;GqmeTU@HVH#GbUw3da zHi#k6py8{<5U5aUjUiBx+kImQ7)btB-LwuE0y@=f*kOCD7y?ZuEW)aqGX2_OtMqI= zssJku8{KXGenYKHWN$p)%J8vA9du<%S+-XGcMO5=7y{oh1ioVkbi@!au08)D7y>mJ z*kTCOmfw5E5HJz_tsVxtU+4ieG)jt07Z1-72!o?CCa#G!o05YWr;>&FnN(A)__pkf3M zi6PL!!uDg%{sS-sARA`13Jy#L0c~7p(^UQ2R|l9-qd(<|5A-`?vz~TRf^StsR3Wcb z4B53eX_W&uQtWv@ola~d!Mpbm1@GEZ7F7yugfTrhv=Ik1QwoIqU?~zdL_eXh&i%zw zq0>e%d&m1Wf`MjA!H^#;1;d8uCm7bbzhEkK+6d-gGPMy5G*b$O{9q{vqA=W(vWazk2=pgOy;!5PbwAI`@s!s&Q({*#SJ zc=sLx;az)*qe`Jk7?xQ(-xGDdC+d9Vi8`Ci&DnnLO_XdLI*SacND(F-i}*9fNXBb& zh9yc*iX8s*?Ckw>fssXH0Oe$QK@i@fdh2!QrQ%5348Ei96g$rCb>v^ygZ|KbZvn^w z|Ctd$NJ&{l9wkn{o>Jb-I!#&-l6py^rF4E}47rdTV@|WISRpAH$3J}c{v*Ue&{4sS61Y2bz+3RTsdvWbE1qg7pd$6+ zDIb8X1@5&6&3J$We}D#b!ZJhxjz4~pW*880gHcO6PL@#MBKqclKyVQL0mH(f1n-}n zpg`uO@dI2)vJmm4cn*p-EPHV z;X7CSQJ(ftR!c=A6yEsr3AX($ZHb{^Tt~i zh^gu=Z@s(B`Dd6WwieOhETHMu#~!vKu~uuMzir-pU|fy8ke_gwq9YP!=;0dHcyj3R zkSXUGo}t-Y4tQyh{^WfQ0mJ%bkwQceULukId79^UPw}p%Sg#WdjCS7B`wjA`5^XaG z#OB1DKimC2!#G6ahAkn3U7f(hUijYEW=wen){yK_7Q)Jfo^6w zQ3ctLhzZY9FTLY^h#wKNKhxn$6j$8Y=A?6&uE{Q*1D>~s+c>PLjyH$9(=-I9C0a5J z#gxUx!B+0lOP@UT;!FgzX6!=J_rcr(eg{NzYw0AQah0T75J3+zsgW>TdpLHZ2=x?% z`rgtnmL9t`BGSq3RXl4-Uj{s0#zGg_6&Ak z%9I(}h(c=v_EqY}gwd{H@HoYBqfMcrv10y(=tsh346A-XT>wP*{YxT&k5Zo)u4Ar= zg9B(7bgRr9K0NN@vw4yEn4SSE&fHsOI52S!idg!wGPH#O$Skz!R&Lu@mGY}xDG&{( zO=e6NPL!ukPF@!ePrJcBMwgA(@yPDTRJvQ?#3E)V;tnJSD%hU{$9`~fJRgr|)A4?I zay%ZNoE(S#{CIzQ6t>vdaPMg=uG2tw$=X-y;3)NUj%+<6om;T+Mzuz+Ji@Uum<-9_l`QWxmrUEFcT%^JRh7%ppRU?0MrP9-S1C0dxL%(#!AQkdR6>%~8HZV}T&e}D)-##+7`i~Sacl)V z8Zr}AgKTxxm6@}gQmvVHHSufG?wAE|8^OI@AQjulc>oeZV~oBsHZsxf%?Ucz*LN9Y zt6yf623y(kelGU26Eg3EPZ`$Iu2NXBZG2&|H|@qqn-qSNIa{ml%(*tmurAb`L_#Qg_LRfHuPSDJWv@V)m9{)hvj%G;ZE{)- z5<{C->G9t}kF4Q;f43w^?f``98aC+53U-P})3~hpSPsy|NTrgaqhUX#x<2KGx~uci(`Bdh7M9danTj5fZgcT)dw%J9hFzop+#sZn+#S*XXZ?Ap=yTU zPXHxihVxM?h4od#X<_}|5>cvcVylqh(LaE~3~Y@i3x6>uOEboY&akj;GS6?}T9zCI zf+VG|gd&PF4T+Mx7+>8_0k6~f)BAIboorOKO;#iLQaJju_D6)YFLxacLy}`pSG+R7 zVAHV`f4^x=w%EMrF^yS2h0_>_V^*Zb)(lf%1%dz^I!e`YxGS+t77HxBoZhW-@cq~1 zWaorw3X#*o>y$?$TS^o_nmQzjr$v_Y@trpz91@Foovbl#G2mev%`R;JmB)o>)FSq; zL*m3VP?%r;{PX*tFF(Ee`17apkFQ@{{`~&^$F3G9WZB2sMCZYl)<<B0!iL8$5PZ3GBoWc6`gCMh}cBF|kFD6`WY@~_@~up%ua&|PPF z=&gEfF3?fGv%s&L*j{iPGK=Z{L9>^{rb3hC^4`13>%ac=x4$31JwE-Vqh)ZR^+X#f zdv9bLv6gjD3jvorCqnCCBcf~5N?svuDm+XBiaZ_*Dh5scCs?ExA+c@|Mn_K!P1OA9 z#2v%`eVj~ROvW$v#((dsRGC<_0_B#2Rro7s-I8l9u)c;Z*#E*l6P$HaEX8?}G9+qw zLso6F{H zss{4pW__ zwNwLiaA^m{h5+a&S@=hRxr9)3QzQ8|QJxbI{&gHgUTmWPiOzoFuMW^p_-6JjCGM|_ zOOXcME^pFYm)-pG!zYokYclgQvPCRyge*wwCt|sKKLHy#vXyTd;&Ok9j-4Z(7hxyj&1oDG7xsDfl7u&uY#)oc`#shEF{Rq;&F6me z?dvn7tJQVcG3*lVRdZzfS@&u(w~>0UTaz}Nc&}v0KHW^Ih5Jvzx8dSp^6=|w+)9qN ziG9ncag!n+G9TZTwTDZ}uWNYwDfv~I*yQC`wflIJ^EI4rB}2ci*DdDfOKe@!N;%#v zy1WU~jH<;(ue75}I=Z~0Vy@C(B54$ZWAHN z2s=?n9b~Zas%~dmw;OIcv;y<{^G^Dpqz==A7^CM+KtB$<>7>I2J=2Khj-Jh2?WMM* z;0N5w*G3q$01dsHXSDQMb~-tk-FMfGtTEegAiHm{-7kInf^SLpZI3vUlyYI4N4hak zE{(?S5t++;$vXUEwcD-gHu1R>L~RSCtMwjrBX_4mE>6EPu&!3F9ssdx&@JjPv?i@M zx?ik*?Z{nLtUeHY*XC|nH)akt2wsx*HxA<^wt%f+c*$HE5xi7V*&2*jV=>T!cqw;D z1%j7?{*iwjO*^XA#XgG2pzFxZ{wP>7#f+S{mXJ0Dxw~mJD`bjW;dQj64g%NVBlL_D z>c?M~NjB=X)ZQDknu*l=#aHXKNA^|+5yqnH%IDHfig+$EO)F?V*sz<>#n?m8*2EzF zL~h{2(nYt1uv3XwlhW6q$_!$srRH9d>{>JrDiol(VQr8G z?YfD3!0l>dj19?GFwxbKyZUm@N8f-)JNX26>we;CCTF^DM#CG2>9vU;#S`Qt!iv_0oS<9U@A8_G; zBi#3e2PND7!lPufMW0@Ha+9_ZZb#k|u#0~CNjkFF9mrTz@&B?_%g8oRk= zH~o7TZR&`o^feVx^rFluS+Em+o!p-CR}8a}_pwgQTB;}~|I^_aTr_X0g#T2@=z)Es zQ#6PCfnEqRW%qt&FW6AiZzI;&D)2kjA_xI2jFdL+AeT+tm&u_!K5(adAIHZp#s@F< z_D9DDd#%_n?7QZqy*L<_6W_u{Yu00&NBNx{I1_EF#$);vM}HI*v^mgc9fT=V1~$;h zhio1C6j_2Hb3%ZqlO;v!hdT((iKXh9UNETk7Th17dp|fuAybWJukjDNCCJUEPiL=o zob$VEMLx|zk^e&eG24MC4^KoK;Fk(yX?Z8Wq7YIpS*?>8As-MYs^sn^*$?xy@DYE; za~8{F<}FF@q9GX!od*~LLd6vND`zyPPWUW*l z<(Cl6Wu@_mLJ(=T5cr(}idEs4cW4F?uMd!i0B21XJ%}{R*?L$3nwlXN4W8g|EQ+`j zC(=i_k>eQ7vv9N+2|*wZNl7~e#6ttfWZHv$NS2ZK9DRqV`s7gmfOQ%;?{4}`yqm!@Pa%Dq z8HiaKtKh)G2B4`6O%(uwuMQlM-(ixJ_*}m&fc3PK62I*$@&9BhEf#oen_YVoTj5|^ zMeyQJr;`ri;iL4sV4e&RP?gXQ5`u~{_A+AiXPQzXKXj858>ye9Sm*w-s*u}3T6@R) z9i#=VmC_R$BSe>TwHYg>4mH=9}}MI>?ES(&zbV z+2!e~A)_jx77~geEu137TgXUm-IS6H#v|O548lo>tC!OpSFCI&264#8mP_J3it~i{ z4RRI0SB&Q&B(IjiW2Iw=fIplDfd6#P7!>@qhft&``Sm99%j-#qY)O;l5+Szf2jnue zSsq{_X8?a9pRJ!5cNDB;85dRE{GqGyU=7|AIgL<11(EJVSP$!!5^c8qxX$ ziJ`|7dl0ca9}&)Gp8pyAVK87>Bv~FI8n#L>aDUv8F#@>CCZeFA=Bfh{R?9rBS*rPN zv)Z=5Z{B+XSYlDpvbvoiOKBbC4S|-*m2}K8P z%e?`ZHb~tDglSXu+XXSLGu1g8zpjl312S#l*G!KMMJ7=;g1*(iP#^RZFei2 zd&CyEfqK-`&OPEDwfSh9@yoh8W%q!8R3&U%2uK!g*oIuMVSd-wiGyU~>;aIF20CFI z0l!g+q>o?rNbr!_*nJ>Gq)j?$8#Id!8D-Q8HjaxV?+{zd6s$69lPg#g&(`3P6f1-t zAW65I>eB~njCY;$_YKUWA@_cvd3r9|U2@lJd|F1R)^wr?Rb@uf9YaP%)V-p}GzD+u z#oCwb4PjCfcpHd`irQ{CCPsQ60LjEoBi-RlYJB!_M;;t_!@$G+LvL)ty%?~7b;Nn7 zYtW4Jpfb4%B7z7WgsP8s)tB3=isfH**6IU8L)cBgLDH~PHNDBOS1xP+A9)4D_^<`V zuHO#r`Tl%zaxgobdMDGP6MxU2oOtue_;|d3auoWOCR{3@&kkPp{yJ`jEL|jxPxL{G z0A{t&A%YshEtX3frm#r875)y!l0_?GI%)mh&LZKlhu73C)e%`3l;qgWDKiE6cX7qm zVb{9l>#(hCIaEBZ)bh@~bP?tvI!9TyyuD_5oz(j*Sx#X&Dm9(0IJDCMtchNHXD58# zxG8rm83GF+Yr^JD`B1Y1GwLRS2p~+l!qUbrOu4!`-bN7FpUiXTWs;I50+&h)1xdv9 zDYjkq?xmKY0~dE{mZ0rdrjco2Cv&d!v)X@pv>j+MgU)sI0~wx=t!UuE;@eC- zJWOy~O@-SGaZ)kg?Y>f_#IGQxt&OpV3uvop_uit}s6;x1vQf=G`Z%^4-&+Y{tLb$6 z5p0Ahe!XU;Na-%l{=$-Pz|5b+cCHKL%ibONm#^Q!dlPzTOdEkAGC%D0_Ldw8(lETk zBlqrXnJjkm>ooLo7oOzdZen*jp6u_AC%a^D|1;stUBT6J8p>`p`RCDfzFO8Dx3PbC zJl^y7!;|TB0)Gg6@8INc&+~%4!yuSj*si3xelc(xbkzpBXPwV3y`wE_miy=ez+6KZolgOe zB!be&=mUjMZtO^~DN~TBT!xpHuam?Ect3jmt9h;zcfSMPRn9-0p1u1xdi}T87W!6j z({HO&4>auBek*S)>(JiGVr|>}E3yyMa^q-C2uO(L2l@HLOwp|&ZA3%}xL$PVy4U3| ziwwLg;5I{qL+(V;TV((aEK(vGIYyMIsmO^tK#x-~WRy#ulhMN`-;JX$#0nO>%W&cO zce@DJnvuVS`S@fv4~dsQFP6*8wYLt_Z1S5Av@(v?~plp_g$MXo(F#Oe^596$aD;yW;fK zLB6kudv{iXnahy>@Rt%6Pevc37;^v=-);~K3p`_`i@q3&X)H-G8pvU*y6v>Rame<^ zfYP3ZWXujlOrZS(R5GcO`R$c6k@&N8dL>0{tguO)ibq!61j#QlvUJ*;GBmffWJVKy zp>~6E?oQkTcRF#WL_pL1lgaex_{g0eo{+zt?2q@|>E6NQhw>QE0^5bE*NfXa$B&&FZid}g_tNge6V zklpV#ttR{%+^!Xj+AeSk9c^y=*3tFIwsDMN4o1GW_GZyC%A+tFh4Xo6Tk?YTcjf+W z*;}WH1W+j>08&K52SR%Dy zAPHx$y5B{YB=ouNuk;?`+Q{^`T}`u(T5gO?ZkoN2eOWx3OA~>099tUvfc>yG!eBXe z2?5BXd}$>{Y^Q$*!QZ9YpZND3S}2*~?#PdGa(T{?^U{kQZHYWX>v=B4zQ2n$_M#!_z_+v=r)`=Ye?Y5Jd-$wGD&L)-EVbo1aDhI@S)NfbRrW( z4u1lo)YuwGZWD_DtyH0i^;lI^MJZaB3k!A;;&(JJdYZym?aHN;nI~X=H%zjf7?lN2 zL+>I*_b{_)9{S)Ohcz?kVa53oNQ=`AK`N>RLZ44 zF@=3plvjJ2u~8v9b``~9d|v0Qgp`2C`6Wa*u4Wi=2(B*%X3`@rM$*o`71?P$;@iM> z53!r&(F(@#ESZU+HPwKomp6)y4SF~0aVCbOzrX z7D9eHV%Es2+Lxy$nVbJ%nTX{3WN%>SL!s69qL_{+CpnBwHjf=@pk%8dA6a|wFrE|B zOv=J{^pj*+%4yxU)e548z_K|t5VlXJI9ZLzKOo)^@S6P(B~IpwMHc`6?7azh+eWq^ z{8w=N=6tc=kQB9A@|>I*S&|c-mX}y^(l22~0zr_(GYPP#l_bmx8*^B_I5lddOZveDu`*s zgUJSEhz3l@8|uRHfmE}sy9kEfPhHoyxCTK%^6t)l4W84PDiNDDGsk3;wbx>>vF+k3 zwOTx8dqo>d#TT(rJiK+{o3cyXHuD_2)w_=U%3T;YsYh1&ZeqV6S&JgQVF(tlxUn6@ z;So!|`YyJ%Ll17Sgt4iO@jB=Zxl%mjxK4T*M6opm(bS_0jrZUasYi>PF4Y=|Pwpo# zg1ePipze;mu+FTZu?ui_--;tBUD#z`W9(yKY#w(Z!K|cvy8Q0XR6w7 zI!A5uLWir*znML&*PM_K) zZ))!eQy+h(RHGEBpCLEuH<}dHARFozO@sRHmjBcw@#$BU@$}z5)oERh({DJrY42H0 zKX2C38p8FMr?kferR@`thVHEwB+qf>aqO&WUoqps|SgIl(YceZrB~iFF_57_U zTC(&C!xj4z!w=Zsw#Os|jcDK=Wiphuc3AH@rvYV97y*{%4vvAKe(3U8jlDK1`CQ4(!D2cfkn8~<@^yAGO-8^OV7swU; z&`F}dq3qDj(?Wmte9+%+BIq_5p!-ez{AhDNH%|8ab!K^f#Oa+|Nf z!kOpi5_-KlWe#sXWX=B_RXRF^Jzm9*2AX>Hj)n=oD|uS*%cD~DAUU21}c+u6qEK5rMT04iA<;3=^%Sdt%~WV!F!$)s2rA z^=z?*D>`^Bd6+akNivx2sD-K+y4!7)U!*x#HYa(8KkvNN%(1IaF%)Xz`|BF1Fw3B< zPupjVSO9Z1%7r%5hGW*iLP9)piHm|Hbbv)M+Ye=6YHC$n_C}qglYT zn0UBwee^bij~_mqpAOLF4D;U!BhF9oOV~1$4Nv&z(M&9@(CS_QMMo?;cm+Of320|4 z(47Q6bE_l|ENig}rj!&iDPV>ILU(+0=GE zBIhAzt0;+LkK|V!VlckHfMb-~GAyE5LGG5sBm@n2YK~*8Pr+cu2lMd zDw%TIH+e|qf7`>ZdhjDmv*yQrqSY4YZG`tPQogqZd|!2O-$roU_OU&_mosRO^RK_y zK?y8|8~ZET$&YpGn(fu^o3jB{AKz|l#|jT8zdRyIrEwfd4tt+FtfX?;->w;|MbJq( zfqFMcJ=TyE9T-hKmo=FE>in21Kzm$X&1Ha?@c(D_c&=P}|NhTa(|t?c&}cBdwxert z?KNit>^ZbC@>O1#1z8&;E^hpiwNzD=6($L{*l?aloj-4>9f*x z{O66e@;0~5kGAa8q9R`HxFJcZEo zA0S?$t$*sqcUTWJz6&g#T8xBx7-NCPZC=)RWVxe7X2DF!cLP+?qeW@*w7?UBRvGGW z%008*zOS1}MOd?$sE0K1^O+|8Ii6(pjHg{gEJmq58qM=?TN7)%XvVb6NPd$CAziG# zz3^PfCO)A`#&EQt2&LzhK|=;pmwaPx)z6c5_$b*3&j_v)idvqI$^h&JioT4Ppa>a5wCi7dC|l~V{~_zIzeiZ+PnO~~-QVnmHVZxUg|ee4a6Iz+lCk-MkXM>;gC8P3 zDn5PJo-fB2e*bBySj>95!ZhydDdkpY5w^3$Vb=iF1DM-uZ{^u=+_)Iyjaf_OF@#A; zoh7~~CrHuD@#G23I(f2*qb>MpWW5q~1!hd;G_W?5-ISG{6$+gT&rd#CA2F5tN-A4) zLA`s;c~C>c23)D{)$LwIPAsJoqfILtU16C>JepMGPz(qyZvqN;t-17S})y zh;wp$l|-xoARbWe>>h3y&i@)6$G{7&GxV1ulybSExdqD-o9V-)%*G0yWiwXx1|%*ckibv zJU%+NC*TgOD0@BgLXdQWu+8g&_Z_Bv^=kD1b}ndv=yqc_LVe|7QL6|0B8sn$nyx-HS?yIwZJs$b{kU#%W<-qdC;h$@d zIVLzu*ZCMpM&bYz(+8d$zq@|Fe`1Rk;GI@nJ^Q+A+)032v~U za!Ba=zfTc_KaPjLU;p_(|KDUX`=8JLhd!fV5vy~Sh%bvkBhH{vVk|$`k~7kd<(y$# zD{sxRJ@9%qv81v@R~9@e+_5<+Eu0-iNwENAuMClarYDBTjQMa3VGC3-7aj#!4S2z8 zLU&J3W195*w1vQ(PHIwFDAT)2B2X7rDn|3s>Mj|Mf|7fM&n43>DD25Qj_cU4!`+e_ zp%x{LvO>gOT%DMVH7Jjrpzq4tk$xVq;AEETLv>D4pLZkc#D>@9Dhg0tLBXhDxhnnY*}@7$@iu@`W%Bq0uf32io5#=iX4mq7LZXX+GSsi-r?si)yKU$5+IAk=nA5MZ zhUN`c$(on{p2A*};<EWRh-Ai*7F;u35u%{2;KwVE|hMV zdDzP%bPO2@~#nRsAUDwust6%MqMQ{BpZ~)tL_%wLSqkf z;Y6NgV_B9qG7n&vE2xySba!XJ3}fjOmH0}Vm1C>PqRNp`Z^r)G?ADLcP~FHf{drB% z4`_S-HjK@6*5&W!f=&8*b<>fE8iIm{f2yy^mdO z__Js>#AZX*tVqVU{J5~FfsFGc<-ru5-UoY@>pKCaa^}&?zj^))g$*%2YSBV^eq#wK z{=~m@<6lw6I{QR|<9m1U3swu_zZ)J>U&poa3D)YpK1L55bJ%?aQ_Y017`rF(0r);~xPru+#g{7t}tf==K4_E_$-@tB? z*+`#Kl=|e!_TjY_PzF&Q_*pld6j>->}T! zl~%-p2~tEyDO7}Zyp-?kl*#ivQCf~DyK>&7hP$biM%s*lL@;ia+n6?{Kd`vQ^(8*!@Jg@%zw~N>1 zC|fo&*XOadEX%O3)O4v^VfAtxqfv+G@(o;=WDcmy}~jLXH<~}4~e%lb2ORUc|O8` z8^0Xae9bLU&3lz&x(4V`s&@EIEn0_^9pJ=t2$L|N;l;`1;c!2hoVwFw zv0$$?Jrx8*Ey*CdmD8aOPAZAQT2)a+j#J^0#dLK1q|dW|J(}bcE%7A#l_RQpm3q|B zr9Hx&+ftI(o1dhy$p-0uH(ll2B+ZxiG~lt_bBV*;##f(KCZMmDzOd z5JV0<%=l=iI$gS}4QdY~4<41omRti0Q~VHO(w``SKkme%m~x9t%OFbSPmw*)2;|NK zYU#l&$ToC#%88$iG!#>CVxdJtAu!pneeoau`$vnzVTpU<++u$tglLP;+cZ zzthozobsx%BBnE78qu{e&vaP3mW`5?JF=5_sW+(O=OO>BzpQXyEo|TWi}o7rvQ6YB zv%tS!3j(tNXamyU@N5k%CvGOQ&+4)bFs*hk7dZ&YYSU6QXECS8wAx0m*;Rfe*qHFhnN#3a zi@=ww!1)O8OUgz_n!QajU3rdm`sR|A_W1eg>fNQaWnEodQaR_q309FFySb&B=+Uwx z)ZjSRx)jZN^9Ny9Yxy{4_&YykmIbX9B65Na36`jk0!+tno=o9z1C$NY~d?Mve`+$y7287W&cJy|Kjb*->zYsU*k5v zhV8A#)p0O}^=*89+JbmxHkKV?edG-h-qAmPstDX@uI5yyhO#d2|2vwR@^9JTV zb>ni*;NPncBi?ENw1i!IKVX4cOhlxL3i3Y3mv_6v3JB*)Pd`;F$hEuI@A$2H{mNU# zAQP9MKLx}D`DyPu)Tb>=k)9+KS1Nt%da1H-v`~a3&eRS6S$_U*fZotd=|gUe!1WMt|omhkL7`zc6-Y~@>yN!IjIa1r>EZM+8X7lR7HzRLzgHzv(*fMSg0Lunw zfpibViH6ox^13PN4|2#ge5j_qtK0wy@xB|QVoU%(s-t=|VxE>&bdQF-O{ohY_tvym z@GP>G0@Lth4*XyZ6z6f#jO>M9ivgYy)^<}D4Ac-aM}WW!i%dNq)~ z-Y2D}ZOs!52BXpm6cwb5$!rb2V&8z@;-$ba$&R^nYYx) z*v9okxLDSj=jS{KM*PQ-6RgWNW{R7(E*7$5wP#-`e(RWj;RYiI3pmsqV$g1g?aEHC z6I2lCPOaA%H09c>GSp-j&>lmXz73OGxIyN`$gaH(Sphl*0V`ai1797+MB^bf*6fYD zV7Ov_gxDhMdn9}R5NT2S=C~56*@YTlwlIJpdc`;dVmll+;Yx|)202$`;{q;Wu}kZi z9Odk0Xfy9re>@uHv^4^#6YG%w@g6V}8!zkHk0SV8Vd4Ws7PV}jG- z5T?wk0i_{A8!;la6L`?VjbX3T8&ZU}68o{}V9q7qOLCz}`v5zUW$a`h0M#^aq;08u?!9KRUm_ksahE+ySRp!0;+KtD{Hg7 zk1#y|w@nQ!M_l6Q=lv##QH#v;2arYx<9pzhx29(w;6Ol==aVT&kMKyFIaOTn`SNh( z_@Wtwn(Vs`zzLHzxBytova|mkePz;%E)|4a)5NDxj0nrLg~2AI$am)9DkFa>$r862 zeDs4mpZxT(hFVM$K zPKRGE$!{Hp3wll2TQ3vW52EX1FLa|SysOJ=iFCEA8OE;!P<8m$dm(ZxYn>3`+!QMK ztOn-k`McXaJX+z;gJ-2m^PDGQA)0$rlk%u!dY#uH|FX873Lx=o5z5!cCnfVRYquY8 zQ#R8Ku?yqs+x@F}d&1K?X zgeI!3s3EiDMDE58Z9cbcE$=tWqT~8_JcNJu&*;Cq!=2qS3UiFMWP0AKKzTKx;2+1s zSL5N)pa0zX*VCc$!?S$SOLfkyE($27^t<`p;cf5k?fW2J0$DQ;TXDu zHp~DVf}{+;F5P<^wtCr8G^;gCAwaCDe(&K>n?RqiS-~eYsl+I@_-b(~mft!Bq}sU= zu0`WA_4>v}GisF?LbT9`;OvWmDPpGtH_BWU(LJ(FMK-{8ODn}rH7AyE;XBTHxidry za1%x-3i@>nP_lwDFj*v#i{Y`g=9aW=wdG~$EtatLthBvAKkGK2xL3HbW^$p)lzqzA z4o~A=X&7#Ez$e@!ZwQ$@!OL;-B=f7Rk%uSyL(dk>7KBGd2sdSf&p6uNHgi3o(%_V& zfVuQW$$aj8V&9&kH`t48jJmEY;ml*)|?^Ph-JV!2rOnpwz(`^j-PaT@&Nrv>G+?98z@vaEB; z1Y^V0wr)ncT)a8Y4eg5W?2VG@#7LQi;f*vSFgx;6hTjJYq^Q7$KQ#bgs?t0C*30hC zEQFm?kR?%@cFVS_%QjEhHoI)wwr$(CZL`ZZx@;T$*EbU}5p(g!MC^;aIC+<6XYLix zyPg8&E!o_y?d=$C{oDEXT(_g>KWJKJy`sDXddR$TUWxAt1$yD)kv~r4OzI{!wtuMcSidQ zF+Mn~M1olxJm@WzYHSQTY7}<}k-yk?c`NU*b@?k_FOA6}036QA&MLIRbe&obm|D?$ z9Vn*@0t5KAIyQsKM~#j^iL2!|hH6cQg(oq#Ul|9Xa8vn)s28qR`=>63L2@! zORU0H@-Sql!+&sPiV&HzPUI@9pBDaM$I1(1I%rgn`Jy$=f8HUaG|=}g9VeNBv(jp) zGoGv%R7>c)XjLL3OB0=`vV)z~luA(=dBbS+1j+g0O#DsLI^+1NzQ29}7007H2Zbad z$qDj&+qzroVB8ZXweO6Fp?-3j$t1-AKblQOp`w>A{|HGDr7l={bM97xyPv{l)Z$e+ z+xEm0R5Wy)l8TN8oTxD|mb9dfKF8yjiyC1>u&Swp2*UNN6UecCF98?XNY(_~VQHMa z8BU@^dOw!7+Uacq+&`NZEDEG8Y5W{wNY3x0(N=BC+0cFdB>p^kf>vCX&tL4RRt@MJicOWiqL9^@I0dJne$z#>rd7D`77uLEfjCPfMFy*FE~j z-E;4tzFeFo3n0W+>k|g<|iZHJJ+$P{nX6(jAA$H ztbj6!%95muT~C8OBOVDmGFq^Jfkv(U6N2>@e_oDZGCN{61V@*XI5+S#LRW?M;}hV(r*G;F0uSqmj3Z7A%x6tp z?SubfDnrTM=QaCe5$h&@&OJtC#yal*V!$3QheL(Je!8SFqm|uMs zPdhia@dxjwqVY_Rye5nh={{G*^+cell=i6AP+<^trOjk_+-@e~r)FMEL}%>!f?xp&^O0MpS?Rxn6Tc%E zREj8^yd~#ytJaovJJ}d;QZA;fRRM0cLmPr?j)5_>JA_%p`?kSA%ws+y(Fcl}Qg!;G zDr&rkUMWTe zBD;%_a|}!bb8fgssL^-d)x8z*k*_d()kfd)sBu^E{PpmQ{nd4`*vPg=WbAS*Z4OH3 z#a`-Cw*9hSqz9cs0uq#*HSNaa4Tvj9WFl7g-bb{WTLNs9t^QayqU!Vv(5N*nIBNIh zHRG<;yDf@!KN?Wys;q(2cT6%tr%psrxDND1pCk{tr;N=B317_Tx{I|qfyI}No44;} zOU!0k%xvV2%xBx9dJ;Q@Rdk55hGXmHC~A9sO%}JCr!es@{5ib6a<=SW2rKK&g6FfM z(A^{d>K&j!HyL*SQ@vhbG&WN6Tti#>WZ68IO$@~%p8}=FZcLtMN{`e;E3mtJB6l_H zkEr`wf+UKFF|iIa2Xn}ja-h-zQ|0@YD|r~6Y5Bf z{@#VEvbyq@3`!G378H;@fF$aB8oxgbkeQ?8Kp{$X39K&a|pcf{~aW1v7`O?fceyO$# z_<9m%>O?{9w?QsS-Cd(}j9%yx5ycXd4>@?gvN>Jxx4(Q4$v}Sh=_PFPZ8@s7(mdp% zj)__VKcr(^9e2kUfT1dD(oGF73F@&$7H+I7qe%ifAk$G?bUOz(C|PZ9zh&fsR%jq# zocu`am+vBwS9RbX3D@{$HEfFbJ(C^9x?wTb8C%XIJvXE_A4FFJek!{9s4pRdDJ)am-1HEMr#K_QX~Ye1aKZ|( zr2KH7js{5&H5D6h+>Opqg#5>DV0!4!N__J312=#X3BYJlIc{xgJfOU3?zZP{d+L=g z3tL6koz_&W;h6mAw&C6B=>M$3jD~tl{IU#1@S>Tia@(^T)6pAKF;IX}z;-VgzzDy+ zeA@Kg*7TE|8Gylgl#qqZDbRB6GV}ChxeiF;=L3-F`Q~IK6kT^^%uh{~8@@4RV83$LnNsgc>$5X#lHGc^zUt=2vHoLc%+EI^#d|$(&uM`C{^khW=DJ7iA3PAQ=;|6hlR2DIZ9*jGRFF5H@X`> zDcK|O0;f5^R>1Yp6U9`nKjy|@pEpK3Mf4i<7`odyd^Y3LsscYo9s7W~Q(Snbbg6f^ zcTqQSTsYf^$%tPabi~8ZTw1&sx?>j9}Sne#v9SVp5fh-s-*^-*>$N3z4TqQFfTHe z=}fcz&klHei30s0Nl&nI;;T;9+t@Kul-3i>pS=+NA(Gg#p1R zQioMmTG?rPCfok|Z+k#cfVFl%8Lg|uo#x*3oaJPF2=LULCW0!RE9zR}%c?FK%YlI< zU+}Ssw)bGB`bnCd(l45E-U@@IEl(MHP29m`4c2@X5pxn#lW|&Z(YMRaZC}HW=PBDj z38T>|*PGD((i5tQLlf#SG>1kFWD88f3U>#PG78HeAofRLe4l^K`%;8~)nuvG*)!TvXzG@wSw=&xQ46E8E0> zdTtmg0s^tgUGiCmOoM`wjT#Smj+8EJAM{Y%&bi6vbZtPyS(*rr4Qj@F@kP5@u(o6kuXk1gqysk#hI5t1dpcwRyQW z59UG6N-dvQ&pDPo%C@8yTED~PGlqj4Y`9YU57&uO>Jj86PYvaa1*xk>fNJ>bVBP5D zsLzghaUUY&&|=tvsjb0Yz%6eFpmsGpC4&?B$2)Rldp3krwwa+FlHvcHWf6J3{zG^Vg8oA5OXO2t=}izKB6wwRAoK@Y z(pZjLb0u^&2xraOX#M$^UZ9g;Ik-dm-sUg*ca7lY`iF9gX(RE>qYmVV9qm$3^J+En*Rx9;VJv^=taUbXx&Llm?u0E3y&>?2ZS{_xV(GnNA1wx}(;Qs`*+!h~(fhsv_VAkqAx( zA354>l;XmZU(k#wvC6039&`!Z1&{9hw4ACLK)@L0~lO$2No5juYhZ=A9@$*Ox0WC$4~$*5tOrca&hP&{9qF~_nqw6?BMJcHAv z&5Et4xXY*6_3IYob+f`=8Zs#-K>i7o-ukArHGlkDAnju!zpXNipN;ibko=Y#(^p8M zj$V$0Do4(r?7uk44XUyoCH2Bay?Kdkwk7Is%+&IZOp_s)8QINKPF3Hs1EoqH>gYgw z6OJk{qbx><)Vd57k^XKphU6GTDWC|0*c{GhF^o}?bz0Nqm1&99=&|Gee-Ag8M~Rk` z5+h_%t28NTO1=b?@%Q#*@Id|113A7ICNE~G3e?x+^4HhbV)Tr!=03Asj-y9iXneq^ zQTfJvgD4!@p-jlyq-7IS5R-iVde?+^ZB1eQgl&|iAN$|@#MUxrF}&tCAHb1{J1}k( z;cL1I(Hg<5X;(FHVc3@yGXKtdk_R!$$E!9e9O^qt$(9Hn=bR;Et7bji_{4$H4h{q1 z&4ha!%jmN;XCY*E$y01#O4bKB1x(|`3w{aZTmNW9GdoaV9;O#D#v!7|@F(B}%KX;% z^ZvH4vkLUl8!dpqrvC^7(k)YK{-Wih724QAP15HS<2Q zqG1u^d3BFJIKaRy%D&n=CB;2g4-x0`SUesOI)>E3${DThK4``f!#wAm3y3JScBizs zo6D9W!*+#1vrIP*TgMow6cOOvjYD&|9CjEaGR-JY1 zqV8nIw|&o9q%B54OmE+&4PEVj+naf{gSKz3b8qZ;_`Z6#JK2Nr7cdOko4NUYnE%^* z+aIv^;=xx-JQ`3EOGzjKS>YmO=d_eU$dJ|!k=bj6!8j|@472n)WJ@U0)LhmIm)|BU zixpBr4PKtF;@J!ms&Ax49K$M)Q(9;>=KR$@hP8hAW~d(9X80Wtmt3*GkvnjZXF?36 z^IPjJ$_iI8D=fd>Rk)=>@jL(oTGL2CIxa>>a}$oQg(tN>D$|9^5d;G-lKhOLc|yQ< zDpN9xZN0ESXBcyQVwS9T;K?L@ZtqI>puv@wGb7ZTrdf}>Xfrz(JT&-XFRcx~uH_i65{ z4B<1)tSS81Ds1PwZBm4ZD{bc%h36n)x`^TVXY$+any5Y7ix%#O#HW?n9Yg59@jX&X zGXBxd-34&)dDTWlf;zf6|F$=gs7^5dlwE-`R=_G>$V;Jy={#o|wMZDt}hjB!fp>j+v0 zyHp=36KBG&8n+f=Zc_z7@yXP$rKM}pn#XZ-W_LC6#2yiklA%jq zr}F*NQ`{~>1C`=@IF^JiF72*F!W0qwcfvDp+MrpTbTk(e;Ph22OsJ_OduV>oP=geN;8 z&gmy%wsTv_N?r0M_psKGwW?EQQ7Pl5*m}5#U_d#`x)RB zSwiG!Uo1tF@YICU$uE*jze&)Um&&$P)lN3zl(C)l*@I(fgX~(+C?ZF!e-jdNHl4rg zk6uZb4F9`o4=7hu&b=?=`6|!BcfY;39Sq0ApeD&d(EtI^ z3)ENluMrn(vTp^^PLoabOQfZpbeUV+ToPd2s^h`KO}}IsWafCUKN)k}o*c8B$53cA z6zXy$AeKxlqk++2zCulhJwt3Jf=W(GkMn7-=9GEilH0mfmPym7RF%qdEjF-r2PP`5 z%tt4_va`&%H|ds7ge`8e--;+EKe&iTq@CviSYwkTO_c=<5N_f~(F~jw8RKql7mVr* zOJS4Hj~V~`tCk-h11N)EIU=9Vz^pW#_e zChoz*O;6%FJK5V4wuln&e0}ML1ZMz)ZcD-$o$A?bS)RY<;c8KwD@j}2(iKFLl*7y1OvWuukfd6kJrv%Ir{(xv< zr)SGOW`38zYQKscV(EEE+mR(E6eCWs(Wgi?7+)*nYmij3TOOnKrtuL}*&%Jmzyp5` z`^Fk^?Db~(c_!-WE^7PkhSxr*^V@Q=ijI5nn>`>VG@Nk`_lRf&cKhl~V&BNZ7G7p! zTID`+t^k!Zn+%ru6TJk%6j!P%r3KR!cM0WgYiF=eh}`cluz&J3US_Ew0^iYo0P#dfQ0&hJI)bq%=II5 z>bFxsq`=fm<=- zzM@TP8Rv9@eLnLRqd}1fA858+?GTBh%ZCi=FkkO39Mzc+f_Am;wqP@lMQX1w1)Hzrw^D{Lh3_yv{%u1@!nW_@((0po8{%kEk)d-x zu7-Y@S=<`4YF93jmIFVrgsT8p*ZVaG2Tj^#Wll=+yfD}~m^iq-CAQK*J2vQKUau9> zc--WC1Zo>1>Ev;I*4YBLa*aW_%G99=AjDdiO#Uuaw)L+>U=g#{1z7(|#1`K>J8(%> z9aj;xF43g>3>mh28xHF_Wlv{qk8=O!G0m2?dK%YulgS?YP&dJ*P)Ap~%uT-yill>= zUb+{q?W2-r8LHq^Yp;3>w?1!>CWi*h_$!8HD6&ML*gUGb(zRr8^vuxfTEv~phd~Yn z@q(VC=QB5Vo`jl9b}~}I^r(vnJ#>5}P&KWnQ!yOQ_6VeV4wI}n4VmAS;3`mMqMR!6eJO9prNBo}KZer7=@mJ>4tO*n&D;J0EM3@}=q zBV$vzC0y}u5ltE75H^Nr6H@20sTfg%dL?+Aff|%FO+lhfW}v!piRh6gb89XFf88}=_Izxs$53J?K4i&6 z?uHOt5hslHL-!yIX@e`&4GNqBeMJoCt0d1~4^Q-0*hdxmAR@)2ju2<2T=K-?@AOmq zErZ>m4KN}1OaNy{w%>wP2S_b7*utN!&XS&g3M;_AiNj4x6@s15HUR9n>qX8qdfOSgIg>RWWy7y|8#&jhGISV;%&S30i%YX|R+@%fYQh4~nr<5i-*9~f` z6I3^nnDqH+Yu?C&^wU?T|Ek8nv6co`J%LgTcX1^-QqZ1S{$3HUu3@y$IQ$06GU($v!?@u|9pj1 zyP2&4L5^>tntE+E37fe(a}dOpaUbx$oZA0Pd2l)ByzTGIIIYHebm5@l_b1*Gt_01L z24T1c<=TMD!h@Trf+!_fkhphZL3y?!@Pu3J1w?EFwd_e}!e}-~{ApVRRY&BDJKKAx zmr=7CR5Ousm*9(Z=QMC?O&~EZ#(2c(*A}t#)Xh7=FfEy3?4ltkAY=jXL$pu3=j)!6 zPASFKZzwsDq*YM=t_ArzfGT*{V+hKec9~2%eyOq#2=!BM;6)B*C(e^H{W%(76 z(#!_~LxRP{ni;U=pcTip3zL|PCmPy&x^|?z3V-kKD3Iq2mQ3f#Q5>Utt1x9VO-o=fO4e~P;p=HT%2jzo(ompzexd2(ptX*C2_z?n0Kmg z5cXY8St?&g4`*UQFNh(29^ozO-nFB?9SxP}NcJo5_U~lLUu9snD>yX z;JT>c->6IKVaMMpPz{_woe>S^mE4JCU07NW8jy{&`Jd zXSv&bpOSPHP`u{p$i(_>s#Piz_XaH`-V*B}*0Y@BLx3y|(gZ@ynKysiPC>PfjUehW zhWvqMn>Q0gr(q*hxihfxaeTgfdw;%eNx~^g+i}8S}vtls%@7S&ncxqg=7v>SX+b7tIP5>?cy5oTVaDj99hJl zjPT0Fs0C>5BacQ6Etp+D&fcy8%cNKZITy*!e2S_{#Za>b9b%DlQYM~Q#&>9#V%xU0 zuK=A)5;8+`N7!!2&aa+(OoMpq>IbEZGx?LU*~&yE+qg0EGdhgXh;vNcG}=aZU=~sc z1WO5ob4_ui7OtRJtkMqBqf7EfBps5XCeT}S@_|4UzeTb07#Q%C~U_3I4G+i!;MYc2_n$ed}nv( zEYuWNAjDT2b8J2%Fb6(8Kjp%%GdBe>m;ZME)6t+K&hlqKc8-=itB?~? z5Rzq#M#%=BD5KNLQbkAmdkcQRP#@K2yE3M>)_?1AV_MSwqtz}h(7pkD);=G$#?tC)h9_$! z;qBveky*Fyn}griDSF2bzk5TCmhfm6Sl)y_aW|H>(rKhnFwH#oS*O)~38k7%_=Y-{4x{*$NPG$3g&5K@AmdF~Zf4eLBY zLZ^N9wOIWEF>h|7@XLZMyB(kog-3E>SoOhg`}U#m;d9v$h|7HNwzZP^FX-frcjH zuq~oqJ7Yba%iNip+UY|eXq_D9+Iuk)s@f_dAd&A|z_mc3EQnnNcTy5QobjE9i7E8zpn}wj4HOH3RlvLersDqQEN6^9eA8-o`j0OD4Y9(F(vS7T0^7d z{<8S_vl@M-2N;t!EFc@{&gp8S&o?m@q28r_lugv|Zsn_70G=O1?{sKOcu zcfizXG`GJn6ePWH=9_5bq9?LTVz4WgnW)EWK6j!wZmbh@8dzPNq<@r)>DUE0DborD zGRB`xTD4;N%wHP0p)!N6S<`FFvBQu>+w=1S?mQd5y=^^qVi$1Dq1PxKMA7A6u_}Hy z`@gP=P+%46%Ya39>kiHTWk_3|-p+GUYKni=HQh?#z3SCoOU2Ul8n2^= z7Tc<*VM%*OiK;oSdBkVZaGJgnlc@p8+We|-PtLe1M#;Wr^&9gLwJ3H zf}aC7Dsr;t*l~H@D$2>R`TR50@DhjMYU9=F#h5icovuq%s)4_Uf3)^(vdX6$Tnb(N zK>H7CQEey#j(v$Ys^-mGveGH}Bbu|a56Vvr&*Q$aAqYp4+&mnp?whFcXut`o#v&K(^nyl3NJ5nUP44FSiKIs!H58lVTBZ1o`tQs z0eAPe>(|fe<Gt=n8fb}_95pD%`)Ws8KLfb7l6v`W23hzLX!O32vrr&c^4(#v6 zgY<+Mh#TX|%#>-31rNj(O;W^Yyc25azYU?Fldzcw!QjuIsgvq(!ZU`Mfi}nVZAGiA zz1au4dtV|xoz$)eU9Z~|zGFyUCt}9LwHkhU)zs%D-ut(J&3LpSr6S|CYO7-BeeOmYkOTm)32z?j;lH^hTRzhvlat8J@m1~9TcAj>ecc5D@q_&(K$DZZBQ(|#;{BZ8i@Z)QD;RhnmSmN7FvuDrJ8!9 zLUeo#LfFAcVB^$*}>ki$qUi) zpOk3e=jk3ZcQxn_!lVq8lJ=$h4?9aIpU3Oth50&-OX_W>Cj8(7v+&5+rxGUXlHG7n;^p`%eMp<~NgUJA zlj!m*Z`_I(gE0^*XIaurBnS>CHKwt6GsL+$OFEl7)HZo$P5*EmFrO1pvFf#;ui=X> zoe!E9nD-qYCt9q=ml8g@DW&|wuuHhq7s9{R^o7~fGj@c4Mm3qhFBX&7o15%`mgFqo zXlH@UF6%H%nVNi`F{CfBI>R010Q@G zA@Is0WJ`mYGP$`tBx*I3V-N)N+>7e;g|I$Hgg*1Cut||t4`QPq_j`}@6iq`&}^n&vHz9L`c5epHxj`nkTJRF>Gkgz~q4NJY>WlFMx zyPgL>UQe~c;NnzaxtTF>{(jRS$_)Rw`>V0z8{q|W6tBnoQcJSD{FJ_^iC2>6Bperf zoeVb^a^>Z>e%!E0%?c<=QBt;nsPAUQMA?f!mAL&(oQ}vPs2~```CF+s<3B>)i}~`0 z@Yzx#i0uH?%f!G+WFYMMGqFp=^AI~Ab4OhqyWS6hx!=%DF47R|i3_T3VhrT^^x9iQ z7=#`EC?1``&^oHlZ(fzJxfWuD%))Nxs4f{*;DZOsXZCuWT6B$@Dblq)SGQPpekp+H zld!imKL!C8$Ovv7>sJnDX?#(mAl7^U3|>lI&-gtkEcy`|{@V!X77{6+_#=Ft;MX7!8mLA7$bZx~|od^IKDbugqunTx%+t(`dvQ(U+u-7lVn z&DoN7Bm{Sp{|2Ui7=*~;ep7+d%T^X{RDzp|obT}nzuFJkJiE1e?ZH5cv&Y5{rRRbm zhPL{0jD0mjdz-HzK8(+^gebpJbkOWg39ES8$}b7>!e(1xY(WS8hVuyxLU?|0%X2fs zM@P6HQX{vTBmsQ=O!${tWNv*sMGD`;qvhHe7;|PJ+=3C?(A`LbhM_8H@>quAI!oTiXVu!Sh&+2 z@C0K!rnnM)PcBk{$&*5sac))IPXsM*JGY~k76y8lad!cK_RNKhi1UbK;-3hC@8g5M zVYffN$NdoqbC{;aUwVEP;Bt3Ra-~%__j)BNm!CcdX^xMRFz`7r6S7l%xD5JiM{ei; zhM!&wDcqso!bf|AEq5mM9$V_T&8SyVqfOgFVbqatj%npF@s+p!rUShdWYKM14%r;@ z;(hUA1+kjYTZE?_(#G(^V=Y&sU$LtfOaNljM@5XJ`c#8bo@URHV zwV|J_G{Jzm?XQ%t$9GwaZ4uxAi5QSfXiL-rtb{69BdZA)nOpO7E)qIVlZV(At&Gd) z8wOPMa}P!=-L#ZeerTjbVylVBY|b8~)#F;U9yN-}6@OCBwGmp|!hU9@u1*+SpY<+z z31Y?$R$48feevEh;S>nXskK4rTcHpe8B{L*fY|AK=(Z1x1HVmQCP4Irt#w_px)PHP z3H{3MA7ielay^})Z}r9D9Q!AKg96$W$@Bz4R!{JTQXLVCSj z03OKN0xt=A7CH~K7D0-~21g>kZZoJ>$=xJpy_@^f*~PenyMDbbF?Xdas1lvf3Z}@w zZKW#~(06M{`xP;Wbxb=za1Zuc#wrN=0`|@4-OJ6jw!^)Jhj^Rj8r`?GNpKbS64#1Y zLl={)@8#U1WPY=-V zDE=RhbkZVoj(%o;xP=E~D#>y%<5AX6JC~VteW%$DQ~Cr?L=bCAIuI_D`F%DUd?8k@ zBcP0zz^C-FYC7MBKrSB5KTU;-L)IwZw&%O0_Q{S3=h5ycvY?i*| z7bAm%)ODjjp_NThoHiO^pU=-=Apu}#4Wrhd+<&DnukRqKA^jOWD!1>!l%5f`L>i@( zMh5B6ccxKNQP15@J8Mw6yR{$Ap=VY@WT3T^FVr^pISd!HxOFu3`sq))4k;$IFS~iS z_^qX_EXWiLpm_>(DTH`%;lEgTsJi!OX+pG*^m@r9IzpckO!J ztc1CpXlGrG|5YE-C$O zHRPO~pD}k^YQ*ByDhlw7ccE2-&6Q67ZLT~l{7*C62m%WLPyc)=7!Wn&P4s00(}nHB z{Pp7*0>tA`+O4{VhjfYERetsE`-H8j3HQ$B&hn0R3RtS&3=$$_>zfop1ne`2AgIOiye*5vfU7bA8P;U`xeLa3(Uc!GLy*~YEdbwx#_i%sy^)`Y2({*&2 zETc3nS^0NZX2FidHi_56l7AC55gYRL3~F4Fh~x$Lw>HgZ3lq}lPTxGS(nD>ghe&o z2EwfeK9_012FbQQm zs_cNO+qw%0mbahreZciV+x{~L`>`GOhP$d z;pj}}KY!9uq%o{XAt+9ezN1Q@)L)yOu)Nha6ORK*+>VIPwEkeV&heAvd}7e|%;IOP z81+)(0R$zJiPG%kPj~ASiJm)MQF=eh#giY?3xWd(7cHnChN6QVImLcJWFxZZ*tS1m zcwd*~fn^Z<3HMaRWSfk!Y(^NESW*C*xqMH`_(-MlDKuMp8G)FX#rfB|{3^rjE^gmH z1_+`*Z}DhKRo~x#{v5sK$Q>8RSi0)5a&**99Cy2tZ2B7{s_;@jvX=y>(%>K=6DDQkhsh>a zN1FQ2e))tJ`XAp*RLmByVdosad2l8gQvhl$k)s`Qrd$`Dya1#0d7QSfI z*l%f7t1{^nOwZ{JOS9p|ZIPuf_(U4zd_O;bQEisqE;76-8C3jyW2Y8oT)6kURPdv8 z0q1rWg}4Ab8hJe&l@vO@m^>Ws4Vj^haK1sC!?N_5Gd#bI8++T>aoSJ+ic18W_%z+rDc}g$44sZRrG94SubehxOp=rNx~ila7xhN_f7KV# zrZov!d>Ru{5aM#@{SJK=#B^kn(Woo2@5+AC>}(C${&d#%Y{NSh?_urmFI}ALF~QJ9 zDapVXXsP${wfisoOK365Vq0irh zFa+wct*+LW+t-gRqu7L;Lg>-ci8Ujel#u6*=>;fHW@hzyu%&!%aGhdR@|4k68X%rD zk#j=w=>GGTO9x#_9PU%I+3((I)kgj%@Fi+JhOj19kt$Q57r)bvObnO?l`< zq}236o)lK}X6$$_moyUCLkC~JTc0R15LKvhhe7wXslSwsy@oWpMX08*k3NM`VUJDN zx6Pd>KC_$1*Qf^xqB69WNt$5v(Tk&NB=h^j4djN`xJUX^&Y@+j&o(Egx6O9n1U(dMN=WMe+vBSL%qMm8UOjf&+$f=x!%_n%1#1g3%U&N8&?Ug>xfbAMm>3U=#62$f+}s zH8(oBmyRp(>wh8~r0iUEz_KJ_IV;srI$_;abK?5DO#{s6y!z~ZJ;uKpjA68*HK z{iS`gf$6IyvoWC?je2t%Q`&WT)H$naUNN$vFFGhZBG6oZ+h<4kZO8I}G^vuGj=Z zAIZboH+HRYx~UCHLUE0|&5jFt)U%9hM(9YmFNDyAkktlWT0}W_)*YS+*v~_dAaVYd z(L6_#SdBI28PHmx-DikhMO4u*__zLir!TA&6oTIEH5iF;T$bOZrE9%{+wrnU_airq zc42I*?d5hOCL)mpFW@}su2&#OPt#Z9G_VjdOl7A4$eld3pu z1M}`d9;>SSq^@*5f2x>V+lW^Ya*qCekHvkyT%P;`dS>4H6%N5NI*{cN+nWDRE`7J&+l(oVxH>nw zEMxNCD(!}NT^k_`Fp}|d59GuR($~~Y?~C-(2yI`TID7RHCe;DCPGT5n`yrxJx~|K# zFZ{6G+)xxg%I>enM882YTO=T^_AoDhwdF^jo2*D7lJ~#w$Nz|YN^=H@RO|F;N}Fu5%sR!jLWW`%rIEb~ zsV9rf-V&6u{Q3myVcSH~R9*1!xH3bw!(1$SEtLkaL`*EE!4~fUpH+yhG|i1sX}Dza ze~0|3q#_7O8|5!ykITFvs(B z4AcyCS$2<{3Xed`-XK(bcn!pMV`|30XNi2+TgX2-kC1b6n3w_HO&b;@h3U?0#n{)o ziqGR-Mw5VDw{2U~wr!i!wr$%srfu6_+qP|+ z)3!Og|35i7H#_^fE-IBu3hQ~F^|Ffnob#5Bp18EFgPRZbN2LI8Bu50oRq4<9)|koN zUdIC*#BNsX-QrZ=c&huA-=X62_q**mh4k5oKgl|X@e0-QA|AyC{nP`rZOj=WgzOY$ zKKC}*5gIpeyyv=s8l-VIcBq%%e#Po*H1;E?c+S!y+Yy}DL?#G|wZFwi2T!xnbwyPH z2g6y$TPY5LpT!NQ7O;mg@rM5ez`CC_03*zm&0*I#%C*ibN-Jhe@y^TP&78uoZ@ zfMCTsK9D4c{Dz=H6;i_GKovh-y=oN+w4HJbwZnXvRvgwB)aLd71-cYj=!e|rXVzmo zS3f|h_Nz7OvTC-nbOb*00@1nQwX08K8%T{?f)v!oe^&^}fdIiKAZ+);z zSR<8fV-+Hb8v}B&e=Z>(Q4gK=T&5ZyCI}F6p#@X5JY$y9XHvpI`|=-#ny_O5pp|a! z#eYRRtp?FJ_W1e*pZYr6;?DI=ap&u=)oCEcw_(2+C0nTtmqGo)hz${^ zxVNLi0MQT4sj!t{ZK&qF6WoR&hyoF{1MHAQw8n?5mYP}MGv6p z>vtqm14H-y9xS%G-FFZB&;83DFT>B@QQJkk@DX_++F3Pvww9E0uA#lUF#OPaOF70v z046R^e^9RmE3K!dEq?4+#6PK<49_D!$VJvNgT6U6-EuL!&W@3fhY# zvmt@e#4er6EN@nus7JCjE%d@T5fB{+BtE|Q@KrJ%B?FsRU~e?85Efz=4%MivuGx?j z(rRZu(V+PFO!GbxkkJrY?smNnJvMOe|?D-IlW_6|*;fSJU- zyt(1O8KR?xnw$74o?1*+U1EZ3FQIU0egL07BsQA79zkXO{U;d42jwqg=tEJ=l>+ZO zS}t{H2#|Mp&M8gmVsdJsZ@BI*rVOZ+SRY0m#Gr6j6*ddJqF&HT@XZ&ABi)M3(MZY5 zAKu}|S&4fd!gewcG@chrRqDSof;OF+8@yTDK!bVWLYgA<8mCJ%p8MFwtT zAK7+8$2t~FK`D}1#7%?^hl#-z?8f(ZrV4U^R|YXRV3+t#&Vl?RPZS{lzViQ2W@=5B zrG@eHsPt;H=;aa!gmh_gyBl&g?Ur-HIMMlPUsgL&W%)H&6T;7qz{8 zG8nb}wJp3+n-}N)BV9IgszNvki!LJ=kN?s_DFa=+Q##AJnl9Y%u?}`7wJkNG;{q{W zhj(Y!0!sQJo7z8QGh_$bp>sLi-y*63pHKJCcE49PN=Nrw8{&l{enicYx5I~{`;V(k z0HgTAN^oY^ZvZE3xnoH?o}t!HhOHO$;$T#IvsJIab}cGfu$~cdu7#D@`(EVoCpsSc z57-p53wX5CS(%Qd^{7M?aSCJOp6e(g)8v?1HJ8GuytI?XAiXq_p>H2#@$Li_^RB~9 zgMSJrJ^Z%2-l-bm)^cY>tyFjx+_7Wd%|sRmo^KT>d@cN8j12&UusPk=p<4Adf5K{@ZJ!gjv?d61Z zDVq+{Cf{rDkkwKuA1Mam@uya?+`PByVZL%AfBK5M8c_Pe&kl%SDZ#KE*&^p|FNsk= zy1!Iq4FgX$+V%WpJV7!NWIu>aRWbIp`ZHn#-kz%|eYIzRI*gmW&b z;6QkL5Euz@mTE!b>ruSS__HVs0tFWRpthMAp<`%t92>G~2L4*C4-Fw4J& zFE@JK?{GPly?wR4?&00B8z!ok_jsp;I-2AqfePa&qDMolmsRm3xv|al+6^zZwA?J-yV2h9PTfHGWOa^7T56Ht zsYBRBdgEbdJ;Y1FCc>i28asWt&McxO^A@v?Yb8_>>MlLLlx(wNCG2$fVV!zKC!=PE zllYjN&m*7{^|&RbWZ5#d722Obz1W9fzMAp^*Mc|E@=g;LJ1$ozN+W^%tzrmHE-HV<1Vc|YLaz-B7*nZ?oU+i8%Mv+T zv~Hix?YO#!FY1nZUh@hx<;9(tg3%cbGbUBqWjmqt2)`-^%*so|l&2L4vfU+@VwbqT z7v*P2VNS^cs0@Avuv4U@6WA|2zZGxBF@iW43yEq&M~3gwJtQQAsbKY=2>hrNrng+0uC=BE5vmIeXu|$;@~(K$yR1&NWYoEJKFKORS)irl}V( zCW~?I+8NIw@5&Nl%6r6A)Vryi`&|0m2T>ZSrm#7!6$u8S+o&q*=r>hXnNb!a|1KQc zIvggkvI4e44!hdl#VMe; z89a_!*+dG6{LK<{B2Kw@Kuy1&i)T8w9le&4NLb_o07^ec$A|WfO28M08SR{{1X$3b zS8UUq2j^icREzHzxLE%v-cdFbzX7;UdO5vZ<>Y#he<*kaSrW>?p|gJTM8~Qg%%JPW zO6k5yh%ZlVOo}q_K&5ro&NH=LZ?15CLfFc)>G3ubV8nF(Rppg+&jBF&N8?77b+w~eXj%`W6dKC zm_x)Y%Kk`a9h;6?-29I%fedVMKcC&MrldW3yVMi$^e<(_ef4aWK3mo*-YS+;1>R)r zZL1W{RsX9pk^$a(R8$g$Y`m_HP3QDN6|u-uvTh}l1tFsmG@l)gtuDpwNgG|Z*^pZ1 zDz%`d&_cltIg{ES=}xTzS$UklRk5j&A)bOVNd zUF&`EI}{fh*~(oehb{Lyb$+Ick%EM-de}^fVsd6IYQ;m6g`65Jpc;22qBPVrU#}4K z@zU(5#xx;d|G*4xR>H| zB?H5~3kis!Oj;p14i%l`Xs1i2$dIa3ffke$vEX|WeoeX{kB_g?Ad6P7Qg3}MJpN}H zUs?<|P-8+By%NHR<$#kEh6|w~Rw9+8FNJ-{l+4FEW5})!T`~-r@FW%|BSe|(!z9Vt zazIUfQFLLK&N|(KgYG?WhkY4C%i4@Zm=ZQ^$E%3R@pNAS+%kcXuJ49BXqhx*w-f|t zNgz8XaL$bs-c;2@rLd>*-Pb)&>0J98qXQVXNXp&h3r_eAv2EA~39uzEjdM-8#ZPm+ zHFBN*h)haP@qCKh+@hzU!5u<9WeiU@0Rw}Gry1uFaID2t4(os67Zk1pC!2=975xo_ z&;1C#~zs2WJBAgh6geYXm; zbTcwtP1>)?%UUc!?XAD(8POT({N;IJid3bum%xccX35mDt|m+v$mU_#%PV`x=r~Q8 zNiU%^g*4!H)RXwz%ur#OYtg`g0UFb^NuesQBrkJ#hpEhV^kQMIRLmPA*+Jpxu6F zCgFBKxz;+3U(nl`k6WdFMYi&?kQQ%GY{2FSsG^kZ&T0%NtEdwvGAKTwyNo6pf%BUS zmH*nn*f$ny02T4_(to~RP`p){7P0KSR{yOHI!92;zFeJIH!44$)s{x57CbGxit}&hgk$AhunXYBK(1&kZ%t zqDGCMVQ(WExa)&C(SA~Pkqpj`%pf~Xd#fmG^3z7U5QlfucIcbxe#*w6?c2P#YF!+EO%8&e zTTJweXtoY(#vmQi6WNg#5er3A4e62+Q+~Cvq z(PRyn9y)V!yOZ+v@#E&j#J^-KmN9$^OI_YVnuY>P5*UY&;s|NMb1i*I7BpKilOVRO z+l_x(>>|BZgpXvC@^#xwOE?^eGTy6Y!Q6e;RuI!{#*%FSO;;?&o^Ug9U>|ptrELy_ znyaMEem~lVJbPDdCYrN$Uj}(_Dlqd<@60mnMyX5veG(U7o%p(8nCp(Gq^>*ip3W>i zo9<8tT{xBnQa0J9iTe`(!W0r(m?Xh_Fm*?j{b?<{q$>9cq?aKULIkb2jseuzUUwt5 zk-E~+(d|)HXDP7-{}H!mY;NBF23|9Rv00HBlY=L7)Zr?fMBLOkOYkaG_6%cO0YQQ# z{%KJdT#FY!41f&V##c_M<=_$8u1pq(dsvTN%okJrdocs*!V*Jb5g3!4h>za8+1g&)QfLo@blbCL%J**0gAv zZrM$~q%4bxQc@|iOky@t)7BHU?~g$)4X8vy=zzpcH|CTkGGw6Huq)g>9!24{`zy4h zKDgR@4mLT9t&W|y{qwAcy9IH{pxGFeAt%uw8@ zD0oiCYK~ZLM~94M$uWih8W!)8&lVRLIG-Q$m#1$>i)CtCiOz3jCX?K)sqsORm8Lk=!NV`# z!XT(vlo5ST*i-}@-n`RPJ4stB$!17oVGV5U(>5vXJJBP<99Ox_4Q%UJ8OsX)>e6_I zxS*?vfA4T_wN+EHeW_N3=UYi_zPdl3iCaW3m;gIcD^T2!g1@yLhtoty__QkP0=Z+a zKkFD-SvpjyYMED!vW%dSa>qC*)|MCM%3LkXW1AHsLx^GhS+^QnI$_YP_3By|I{JK} z&=B**jnxVtIRn#je-Xf$KGc@qS8skeX^6Y|eq-^(Es-0fW_XJsJmWcEwSpVzcFCiK zXI@%~D4srT6bC3Ut5+vn@@c0~UR8R$O7m9T!i@Y(jfP*e_R5=hk%=L&c5mER78281 zLKd^c#Zip^8XCuBUih8hAzeb5sVR-L5Mj>JU2;V5pbTB8rYZlacs+tOCB{DLaP*>4 z@MgMv#T~IHJ{=ZV705ei%uy%>ew0W#mr%oQWHRA=_rNOU{96#D6ESXsB!EnZ3n}8D zuzzU%;17`!$My6-kL?0N%r)-4W6^?WkAA|c(wUXh5L;k_l@sIEZ(2#2FK)CMcaFa!J;^I}~uxu-U%0 z*EJ>>fv`tGeMtLoW+42XV!;~GqnZO)YHin8tU@J+8-7v?yCI}MW9jgQ54?1A?BM+> z$;^7n(>tJKmi$Db_+^iNZQQ+=bB0K>uuHv74%ynH zWobV?HlmuJv1sNV-U2ZTJzhT|aG+WP0X!t=&(*WLWyje!o`P=ognh3>B~~2#GZG(% zzmUnd5J;r&2Kn01^~oQM5nF(4Y;97};6tqt;UOU}ji5mq4uQ92EBAKk(8j zPTZ0e8#v=s83W^;{13)Xb6pM2#HH-MdTf*EzV#6uQ24I1UBd$3eaT}Xjuqf33PWU0c4L9N#+-;%(+`F7)1VH!0MfHVMBinN0~TEXD+vG`b|$ znBSYE=Ez?S4`N#07*@$`$<*HyM?~_Y&T@O|3dDa|Q34goz2G`lsE9-!9J>XXusscp z{c6VANs_55=o`B>GN5FtD&!o$UA*hlG3#RL#9Pe|UAlkFjDkn`iwPTRx=s}p%Ug$n zZ#^gHQ`OK7ADocHfWYnj_;}C+734POXxdmZd5)U0&VbURz9PDj1|ZBrP}V zkY+jqY9m7B*@w*>LCTfT2|WDozN2?m4+Z<2{-R;eCabqO6hw02jn#TAgdJP`jnIC1 zdEwiI*PXJFZwVCrK7HTS^HAOu<95pP-nCm4yN!!FM2zq7{F|g}EQnb6Z^cld8rPui z#DE^w3+DnuIGjit7>-B53pN?;g0MLX3I+XEW|leXk~zaJZkp7tT`BcKTMO+d(rvg~ z%45s1blwC!@hU*BPnlqb51&(PI9)4M5mCRK=heH;XI(F%TLN_qk+36}Cf4P*Z)b1s z=IU~|@2FnW#j5xe7Ss-$tA9aU2ZO;wzcs!r6IpP}x^>_>!wRCAzGM@*Lup2E#{kDy zL0zMHEH8hu^o*;6{hg>KNJf{%4lj2BfrQ2Wy7k$THsrBO0h)_?`Q+B()3Vk z_y~1Q6n2z3a=if&04m3;W}&O75CQViuLT+*PirQtVvIg^he1e^m|O0OD@+Jn&~S7r zt|lG_>8qK%g-apw;Tcz-2O#6tg@818>x< zUBue%{QJ=`>#`sw3G1?RKPrPOa4H+HO5ZbIf^xS39MDIW1^Qa!phU`2j~0g^r)_#h z5(biS26=z7w;5++j7iXo0g zJc~}}2JkQ1%m?R?Pf}y53?cketj}o>Zw%JQh_>7~Gw(m4+k6nkWukkfNPJl>xYk={ zO}oatmYlOv2)#ez@+|mK?m%p5=KAemUIxlpt(IQY#FGtnQtKAPKWlv~U4L6cT*jNc zuIgd-5A2XFIzC-|?)EF(pIcdcNfd6)ur}1$m*`FE#|;)2SoEgrsbyigm=~2jJXtxr z9z!u;%bL`P7ntAX52Ug)2Gt59KsaA44 zV+w&yUO=gK^B3B|dEdSDG1{Bn9v@_{B3lgcd06xT1z}#O=GuT$yx!<9d}B8?P8UWggNPSy@L>-_)742-0~M=ecaB*T zWLMr9F=ATbY$F@MM~7(jfZ4BNgQ}T|BO9xr zy(5oaCLUHps$6FEhYVSUNYOZ~oRHbD3(kYtGDl~Ki+f)8(%y8UZ5)i70yN@ zT_V4=6M^Ow3epQ=4a`K}T5O)G8VWG3?Q(4`E0dR%=}C%nE9&Env6vI;d-1+)T ztGN2^Mdo^pD4#RJks?O*A@*8%-5 zB$AEJBl57-#Zd4&4K2U`5~r~SDpI8ZDr&B)sx7wn{wm6yj9>ZWIUizkkP!T;QOOe* zK1UK%U;0I~Y?%9AJ$Z;&>y4n-CKA`}3|SUDY7%%f+{cP5=eVWng;PM=w@oe}w1`)` z05=)KC6pZ{j~lls%{_A#F8wWTaj=6}ipr5o4yQV!-R2jc!jL)V|FSl}xkI|ZS^|Tm zy)&ZNY*El!{foNU*0xY7?bnNQqPaM`u^PE* zLK}AGc>L!ueXTo@Ink_8P1lZD@K*FyEW_Oz${b~~LDRIh;FWAemG`Vg0aha{U|Z|M zacU&u#l8oDkPM;Lo4zS*Xkc%Nr~_ur0t@JW(hd(jx~w9Vl$2go^oen_V;0z0hhi6@ zEuqN-tfLESuASXC7#%t;JJQd?-T^qL@{sOk3OOHjVOc02)+V5mr>ia1OKGr0Ov4qu zVjxH0o2AcPE%`!wA@ZXbRe`e!AxA@OviuH05RY@e~3Y$H!k+OxSto_wKY9i`SPxBEK^RJ>c> z(y!R+A7O>lwSLu$b&XX?S5&WPuQ@MERTE~5T0*CO*q5i1)Z(WS$ zCJ`X@GJm26B~gFs>aqcYdrwty{ZKOhEHR#NoKPKEO6zJx4m@b6TmdBf{Xws3A$ z#=)P20^Z+!4iqV~RuugQEM*J3)6wzeT3m*f#kQTBNqK%UL&3if7=#N!rf`fwUrlywfV=sO=TK@8 zH1hdTfrx$e2ekBQFnfEKt7KB~6|^TU!DtDjo(FdZl(8Q0DgaS^znUQNp=Dy*#rc3d+)?TA;OgB$SR zj29V&R=Mt&By`1IU$9KCg<$Ty-_z;xZYZR90OgWP8E2Flk%7WM_qRL!+Z(B$Mj}(f zKEqSC^sF-)rpN=7g6#zZjmkG zi!v_oX=&6{+8gN|WYW?sOOY|Y^Nco8`Bc{ZyjGbJuLKl@`O=w_4IC8Ddk_Ptzq|km zR_JhA6>8fH8-s;b?HU)$eqozAab|sM z%IFZ?UGGfJf84U&1@t-!oDqQK1TsXG(wjgFlJOzLRyXoiF`%pM9li<_;4QVWlT8_u zv*x)A3%F?N6s;#6$}2J`&=8N0nxP_`Y@7c?s7R^Gd?=Jj zRnr;gFzeg0uG2fL&mEA6(y!+4wg^epY?on`RQ+wpnaDHDP9&n-e6!a$wt}2tz-nVv zG006BVC*u^ZwG02JE!I_YCi=S$}7V=ChAe-mhn&|9_Z56xEaXJe}Kf(BDoJviut7n z4f@4ejPcrXL2Mhv5p~4JJkd?!KwN7Hj40dyLLU#N0)}s5P*|3|7 zD63ObQEGdjKGEiMG3V(MkA|k&k}M;W7L#0jUi`7^VMwN^UCAj&_1E2&(9Jvm zZ!LbibT53)Ln+x4z_pI#mG27Ol7`oS$!iUs+OX=IDh!2SRZ{yiKqiR_VV7g1nMSSYc?nNe9F`QoHVxdU2l}8QgseYF~#8Q_{P)-ou)^hX6mdV#{IkAM{;<6HXVnK6Qa#{#25*R(no{jUk@H3Q_bNCn zdRrQze&oQHzB$_l}jJK@2y#|2z1yGg~-k-M2{&VCEH9o6P*>ur-L_|w|aCj zT`^A!alh9p`V+na$aLo4SME4)N+QjCrH@NcMm=ze9nimhjLP+AT0UkclW0|dWQu5G-lb`{~TFFkP;C;7sx>1z1{#sqVsFJ zC-vUcGb3&;bi>Vz5PD5!wVosVtLjcTc%@R?+-C%ZZ8G|LmclEi@^?{tG&hA@j!!Z2Z}EKe99QyDwEbTKGyWh)v(1@B1r`aw)C6Jl`!OUtkY$C?flK zq%=0EioBI^#Q@>9DqHH^=A^+Fch=GV%&u40(=b_w;Df0fZlel4LqQ~EO!ex~ad>@k zHLQ1O0hmh7xfnv+NlVOWqVJVH7@SkvPv)B*c=H4SU2O4(6-)qHyaspVQ^h%6-- z;2$qDQ*MMkL%EII*&iroc;agwsA3l^P{0vF-h@`FoX$A+#ycAiXCFE0-0uAxxnBut z{l3l)VERkM0KGo^JRd*=vAex|AGG|RyOWi(zbMpizaG}9!jR5YNgwPyzkbrk9De7g zYt*!e=TnmI5z4cY;+D+pH1u<0^hgSCZ(mgC)+w{~wbGiQ5^66LbIF@p-EJUyhF#Z1 zwrKUPW?aImH7Xl}wZwI{Imw>X`YUj=;R+PheTvCGQ>-wSNP`btZhiVO z{0R!3K{J?80hnGNztsftPC5LVvco=Vra<^#^?=x5E|=G5{y~u&6HQ03IXopGg-d7y zp*}4_x;b@j5!upD(EHije9cN*10t!I(?`|}hpU>F;%QcEG}sN=T9X(|+FCdFERniw za#_Rs1MYz%(=2;DMiYl_#%9W@YaHh5w(`fakfOM>k!-^6Loam5)@v!_V}{<&6vYX6 z%W);@TGM1=)tXe9#)S%7TKNuXab!rsD~B(v{?q;kt&}9{CB(2N7iRYUmhwhf z@$Y^I31jE@qMj5jC%Us!veZ!Hd|d9W=f2jBBEc~)tHP%ag<2Y*WLTJwv6gtWp2hY! z-?0laW<}xJx4m`nC zep~ef4xil6h5}kfGpAHF^!#~W$M09e;fJ&TM7WAyV%1GKJ9__py1Du+2z(!(w5pFD z34F@^`%oO+nK*Bp(#o?IoW<(f&3%AMKiyi8q554HQ*fVI!HHWB6PpGr+Gs+@IbiT! zp!h0Tp6-QhQ3|07-^6O>8syf+46*73w3?cVY9@Dw(%NT3|8Ga=f$L+l>=3c+=)&4; zKBL<71_BV|{HJA9Z~v<&D3GwAtm9Tp14+yG-|_Y`cn|32(KHxvlQ$&gYP=EK?SQA3 zbe1v4T6|d*qOf*ZuivMSR43uvGm8&RLZ&P1{&1cbYMzF=TWL`2ingBp^;WbVym+mh z)OCh`v|dgZR?NW?**_%TBt>sl?2mnmCJ%=+X=Xd`BK6)3H_UNdYG0G#Ao1|4WIj?J zhwzxcv#DDmI|v$c53$Nk#O<>Vr_wocMex~KH%#bI9cfgGJf6-wL6$)%E1h==prpjq z18Dg%Srt;KYU%(!79HJ^8JRaWoMpQ&9+7PWcyPBN4_t3|R;#c{`HsaWTuS{*Wr44! zZEsMvTXk%!0Cj7kPqUh-Az7&mNgV3r&@a@!xD|954kglY0O8s$I)~~ z6@toTVQ+XNX5}3A+|D^&@br(jNEy%DDv@W1B!f^s%u9esAh~dhf%0RS-Fvk=bH=Jh0~csBO(PW9w)VANFL=KYvZTYFwP1!CSW!Wtx>}$&5F(1Q~}S7-MD} zRtN?Cl>f9yVMKexbgL7CR4S6XuR67Fl76b-*i37p+({0Yj7Sol1q_LpW};w}pqI+v z+2^|uT$>&F;PXETz=uA!H3Aab>!I)2sq8tP)D1ac2JH z#y79FqSI{9Xv_jr7G2(;Njsl2a(V(O2@vbH$={2d+@BxVBTY~tkbmFXwZht6Rn*~T zGr$&s*MHa%qtJFZ{8={rLolC(UEg^yKk(EDihs)XYx;o{tld44;p1R(Ajc$69qL-8FzHkn8bMd>?f$boi&dD?x2f$vR zXw^I_K^%mi(v@nNaGWyKZsFoD0Y@83+uPO1dIx7Gw>y7c9_L_i z&c3x&unu8x*S;K>Uzq&?J#d!sgp&rwxH9lGHmO%UtL>Q}YRXfo%SvZMpWZyLm$+Kw zPjkJoU!f8E{1%)~j0%meAvwZJvxa4cuzq@X{5DnT;<@Jzorv%I;^4$Gxq-JNbfxbD zMp7WcXOFZtFVWm2K$3e-WFW$)`(dmnixoaWFqcMi$vozMm9~2=ZfwH{d>ujZxPDZv zd?&f1nb(hnN1NZ!P|4xZ3Ts9}lvW|(QS4KE7TVi|D41V>2ze_BL^i$5l1e#+Q=7Lq zzQfV}8Hbu8oT;VQoFFrXr_2uaV`jOP))=TKHr>2h%_#{C9;{{Ufy&Xl zq5b(8l^pq$u)UKjPcvJ+eK}^s>#8~on%WS+9Dz45Bf^aF`4{8AekLGhcRtZdOu0Mr z#;xF`L6imd98o(?F44eZkwZt2v(L6XgFcF4tW8ODIKK(YWIUOsnb<59aEu4k`K;~j zoU0+{!||&;|9=Tza=rfqWh54f(^XayX<|9n=p}F|#+?j+OlyP}Bn`&<-2J`u?DF$^ zMK^0i!O@BHIhjdI*;qXr2=8u-6*Zskmw>G47|4A0DjOq&^STnE^<7etwOM+SgB4=y zOjw15t%J(U9f~f&=Cik50;w5AW(dh|XVLk}D4)q6Eg($ZgA*j!_d`d$LMiDpgE>mt z`HUeO3n1}_fuV|A=)~b|Re4t$-8HqX8$EX{cskQ08ykIbyjd>rq&XxVWLB>53WJQO zP2yfn`bzDl0Wx-L5FQ#8c3dgT@wI%xmLK^5+LY@P`6+mMWTIMP4R=E-Emtt<-33B^ zRDXL-7YH;Q%(CkQHnh_BHEdc1YDp5~q+vr=p-fq~gNY)`jmc_pyUZ`czWy5rT5;`; zrY0|zh}pHOMBQ4MVN|!N{0)8>Q2!S3ZZQ>4TvjA|5|~^CNS5{rHei{0?a7&xH-d zf$L*D0@G~AE36MF9P*O2Qc?Tv;`;t&g0je~HD>&a;ol5W#n3dFmw1FW@a-ly!xXqB ziF3Gn%IeLRL>~JX6}30P0jmLjsa)d^4hOzua2VB#p9|)%BN%=<>z3%5zSa0=N&K`d zxuoq&R|4s8n%pXB3+5(XZ8JL4r>z;Qi1?elHTUnE7o+#j<7)weU@5w)jr`X)fWxKS ztLTw;E{*cnlNa`Mc~d_lYRZ*MT3SebxXP)bK1HE8c&31V?2fx*R&E%Fzdo=-b{;&{ zWhB^)GY|rSgB;})b_Q@a*>?7}ICST19Wiq>tO(i#C?90k8~ypJyQ=+=HVVHlWX|O+ zS9fVoGsT#S*@Sx*LN-jK~|ag&6FZcn6jSO8*X~Vjbu;!mFlC=FUtJms#;FFQEwR) zjLlT+Jx%z7P47nUR9iTgWw@Juq`dO~fP{r1}?ZGvK)aCW=M;~Hl zewgisuz<;Bx*R>WBkOV00`3ytm$BNNH*DTALe;B<3byikI9Z(vl6=KDf%x2T$of-g zzo9syZP|<}u;8tGR9+F@kxPd7ihxIX{$&$GPlhwjG6MQH94sYxFI5!Gqp_DQ^oe`) zq<`!%A?m+ZW|Wezs-SCHglNo4NtL>?N-oDJS~+A^h@6x(OqK02Ai5(j)HGE%az+LP zjW8-!XU`MVJ3aa1hKLKoBUe%*yqAy8eGSo8)A9!Zu&nBufK<1uBTPjm_@=1Q*Ltei>OUI z>#a6OkLxluBwyGTcd(UQRGOOl;qY)yeOs`2Dw?*L)x#6+VU3%+ftw~T6?gYYNT1gN zG}p-9<6{n}N?yxPs!~?+WbF_WPVwS^&nr>yR~M-<&MpSW0u5S!Sr^w4Ja>M9${79# zR_b2NPEKz!Bd60BB=s1i?5N#+L1(9t(n`c;jZIC%kBhEUmT_X4HhwmS*P%dlN)uJOT}}Rg zP8!AgdG7g7Zsy)hrdk0MDHEdsFPiH4%ySJ${vy#vov{E{i678NLbcqIEZ;`N(NVk| zFM~SSz2B!Z9CYb+jy~Nq#@B;IrI`^p+OVpv8C0&r9>(%a$>VY~j9D|5WsfSqXpyKZ zn%xeZotQRd_+P}hhGNnnNp+L8)KY^rW~-q!kSV(4(^E6%FD%Kn%Ar=pX&{JyhxEs! zdwd~hZ+nqRvm=fE;Tj+NA~q?%l0vUX%zoKSRvGn8^l`&0f4O3DQuCx_w2i3-5`}nT zTqHFo2qJj?F}0OmME$%^@$)hfhR)=>L8r`Olp z#mT|z`MJyAWlew^4^Cb#)|KL}i2TpmGr`O8^ z)Uy6o@FD&(xmOB`K2E$o{F#FLW^1knH&&&wDY|re-LC^dxJKW##Q}>rGPpmFc z1ZX#~(uss(VkZ-~cJ~PVvAGKq5_2u}mh_}!4pVPfW-s|PD+;qpSfgBE6i%m_=M}ZU zA)-auRAa-5L*6(ml#PzBEU}GOAi40NlJf9;GX86O$$8^9W$K<*7{O}HIRdx3Y`ls= zS@nYo6NKS~vb5tptKv7Oxr0KvnsLtSO`8;!rxu}pQKK&7RF=v1)fvr9JxPk#Ruge+ zEH6O}249&?s3i!d;A@A0nA*{*uF}`6{(wTT=MAbRF}S$OhjH+`3Qy~@!xQuo8k34u zHJVEGD=xsePM)Q$guE&^@ztZU-H=m>(x7I{7FUB-T-SUx4`2$`%~Gh@94XJ%^N$9> zomN|dE3)VxUZFKrQ69-dbd+f(ASw-TmEXqh_bKm6TU&$ zBm(3tx?B5YMk0@t$Et@gtG4ejwxprMrkR$KTEd6n!`pjMobP?HMe4B(UXw-6_GzVV z5iPS)GJ|y2+hbruxwJAnHz}cAG0?Upb(q~MKm^@s2|pw)#1FHz8RDR-POIqPElI&T zM~SNhef+n0eIKQC<0!m60 zpHC>RdtP&Mf5aZ$4tfj&hMEv~)zg}im}6`!+#3N^OU=zw7iJ>pqDtuymr(W6Ba`3q z{=DP!+MzVZrBs^Hj~ISZLt@V?n_chha(J6DBJ!JHGUs7dgawuBi}eu@b4G@6s_Db6 zmk3yw@VPbTfkTBOwS|=B*!nx2z)yZxrv-DJktQuE3OpXST)I(+Sre;Z--4PyQZ@nRX(P}&3o}$onA+o9;3gq zVk(>t>eVS>s&6CrJ^BXW1KrTfa1(&oQDS<&5uF(e#TV7~n&Eh(&vq8OhJOfO58 zxr|_xn3c=$V=ceYuWqF$k214jZ_zBU;#TtMX~%qY{4<}6^&8jgwBqj0Q>W1FxfUoY z>+k9qRsp%7NF$MQU{2uD%JEqi=I~$Nf_!9;V@YPAzra`2t|FgZQu0tM$Fmc>%bvj! zl{-gl?vI+ksXAT`Cbi=VOK{4+kj;`7K33S8DY5DsI2!@vFM5rh6y_cyNpndYB8?ki zr5!zQfDTQXi}~!@pkj`@v{v-_Tf(!3vWluUsO-tYRa}c0j50Sy-QffCOcE4aXQIB? z6wrM28~WN=IXQps&Tk)2pRbGIW%<=n^R(6A{r#u$&7_|}vd*gPXg{7e^Au|zL+iaJ zrPn~jb;TodM%_663wpp2r2y08l z6ShAJs7h|B>wS9D@rMMx(EiK=s)2|tpWirS7uzu!w4;Dcr`ZVd*0P;gr>;^l)$EzJ zt?QU6S3->Gv1x!a<{pE;OAP`q#TlEv~Xya2^tOS zfQy(QLDaF^k)gP25}ecj1h64b-o%8`{wqqCi(oztV8 z!OkK1?{s*0INaYq8J->u_J)Jq)4}QBcxYSyj6>p}EU9C$G28IQTJU!E5 z%Rw9CB2}N=V6}gEaK694f85{OJv$#99QO~;hUde<{_yPh?Jij%_fLoWduM~wgTsTp zw`T`r7~45H7z|I2kA|nm=Y1WsV-js|c&wq8rne?7X&4{HBxDd`?xO9w=zyWZY-a5&u`@9j-UuRRzZ9_kT@phug|DRfn;4O6+7Cp^T(`JEpRwm0Lk>4Z3~!-&Mc=2LIRV_xpdZ zQ<6T`ma0NcZ(1*xW%#B%3pL1Ed975!X_*qNhpsg^I_TS|L=#p^Sz~=lF~ZZz7{D}^ zarJ%ROe3^pRZQU++%yxipNFLg>9HR!*or0ff*@hnA`q>YB7#B2796+JNX7`GtO3*q zS=20O44EFq13wt~*mHiRnWS^LAa|}GxMP^3GEk7Y2jW=z6x8O1&`Vmwt6nT^`Hg7? zbhXr44V#6As?FgiA+Ma6Qjx+!7LlwBTnBx)&>1n={Mlp&td!*%rp>Bl@jxHpa^*Cd ztRPJ@P0nMpT9G(up~0+?mg|+Zu22%P6Cf`qDx@yvq*1G^e3zH6@eZ;g>a}vtk4=Ap z=v}1n!&SKJ$(sH8FDLK8UB7d{r9}R4I8gsXXfGd%j6L)O=||^Qcwu z(h_%Qi|8e%>`)7#7Jx@>9gmQvqk-1vo1jC@SR>SqS`kkpDTfA2FFYMbvjpnkcbawk zq*8F`GyCtAd_yf4J;)xl34Bki9$ju;W~z+>_qtyHrU0^^I(njsGMbqDcT15`Esxsd7}a`zqG>TS z_>0%jy+;xiY98GaY~8`)=VR0-!Bb?4g)VI0fh#)2C=V4O*&yf`io6BQ6U4XsMS+Q zF`>=R3r#Lj;9n!HL_vw0N+?lJ*fUEd0nF6;%qyJZ6>uGyI~ewe@YCGCgF6{`g1192 zXt>K|Kx&PH(iN@5n=HvbIj(SrxA1#cJG+|@NNiZD617LV#5lmUUX{S*B4x3^jiSIK z3o0U;9Hl;8F2W_S(3?l8Pfz{dy9pUMClfD8W~%@lUnyCNB|bc*&Rf!$7osl%zOTa2 z3)B-#fv{R>7s^)4{PFnVDjCx^3YCO}ei-}GXc7fgN`XRMQAoEp@Cwe@!=I2CvYBx{ zdDM_-Y=EP2TpWKmc4BW%Mo+Ra+~UqCIK|?-p^IorZUVj*xYm(uqqTtWp~C}vUD{sd zgWk8>bP@dE2Fp+|)AjKbI674m%0=cu4FFrr0WYZvUVVGeQ}@%nNbUM-sSVS9TP6Iu z?iqW@YEj)a`D4RwNhAw)oM9EA8MDTmSsdXVPK5A*It80ocSebnS}{uHEIZ*EsITgJ z^m3ODEEBt1w{}=2Mu9H&PMP3M!ZInuV;xFRG_+P&CiaTD&Q&EmeVsolEK_UK_@1y# zm9k!!0exp!CVg{jf@NY>_FZ9_xT!sLSf-*#TN%?+fn_o@r8-z9*_OT^EYo+erdF^_ zCF!;|t0w`=WNuhBuuKKh`i`(n-(#@a1T2$6_G>Y`rvb~PZ+!KzOw8^oVVN#lLJCQA zZWe$k&uuGB>i{sVQ7#So`=`5;G-wZtXoD@$N^QZGc8+#;cL(lxfA3&#*BcJ|2jhV^ z81L>KjCb~T2h%zwaeD1l#9J_iTWZ04gPs~MUU2-FhC3HzL$+9!FmD)k%;UfXS^Oq>9zjYyLrS`&w3BenHTPpKopc5Uqr8V+cr;rAS9j1+Hh@DGg$e79* zsB~w0Ju^@{P@Qrk+H=raXB{)(6sETS0H;*g#J>Y@ip;7$aEfd>&jmQ8fzy``oT6mE z_K>Jj$r}SssiEE(nX(mx`qP{9iXPSF$53kOb72%+g{sKPoP2RNmU)@KczqF_wt zSg1k~PX;)piKUkhoYEkHhQp%`x_xTEDVogw+X1I2i+>w zsg>Xh1Ww5@s}G!#Gn)SZr&Jiv%Lh)$v8xZ9k~5zt0-Vys%1Z)HQS+)D6Wcs+N*#gE z8aPG8m|axtWdo;Z%IU=er>Nv$5*>S7;FMZwpEq!diZ#;+*>?p_X=LC<0jD%^YY_W- zY~U1K(qA%gib@7nQL85coTA6i%LPu6`PTzZk(IbX;FKD|o*!@udv}#c`Qx(uK2W!d zvvgx|JeS|=A-^U3VmyN2TuHy zVp*WyN+3hvqEV)_LDuA@b+T>?d7)~iM*8hpQz{^KCtlB2V_?9uu0O5zRQj2#gBb*E zZxkNWPtH7!R?Ea$tb){s(?modklsA-zj_qP#huW_2j0vXd*Ez!(rE6%%|hze6o>6y zaHPjh?2%WKffKId1k^bvn)kyLPm>~e1;81Q@yDN(PipUuXGg=?&fdYncxQL&?z=k^ z?`U{5?R$N1_h4tgtamOaJ6+4wt99HU)fydgIaX_umoV2SuZiAa23bIMC`&`w&BqY%SrCwBn}i&(t!|mbpz-k8%!@Iquj-(yM57? z7fynRMOttEaf4xuo8NAnt&6j(bLaE*tjieWuuRcjnbr#A znI%q_^k`>~S>>7(+eMAnnw5Z$sz78@lIg8=k*k81Kz*U91&h+%CAHR zo{OKSQA%`wRc?*g5nkgV%R7j5`6&b6>3~UxQ3?}H`~XeE#ZO`>`TDF;{+cCO*hEt@ zjSy;}@)%|kpa;;qa&wS?@uG!E!O^Q_I0ujxs7N{wek1LFh*AaygV*MSL~yDGnzA{O zQ$<$%+;Nw>ac}+yu~Fm_MdHF{A(XGx3#;53y_)}#(LgJYUcD|FCZSDfjXCXF7-X(~ zwN0K^ScIk_)EV$BcIS(VqYYrc;<*AxicrUP0<5bzcnXeo^dD~Ip)!q@sN5_1h#qK5 zb4z0Wrk+yLG94CzmaEqQIyG=qFUeI9R7w$^DT0qP2cE#-OuAZ3I?n>81UJOF`ypDz zuyV@={s+m1lQd%E>J5MU4T3Bpv;P=ih&1ztitO5M8TP$b_I&6n1L1^8~&8ueyFOC6#hZ4ECLC zh3rKqx7X15ukq2pev_?$QBc#jao1h}nnEKVhhjz3l!g&In64y~VC9n;2P`QmYlkMRV|`6w&ZFVI2q&68oag zn=ne(Vsy|}#bc#C%F3~|N!~^~yOb%ZTOpfUOs(}U-6X*wtipQ5bH&)t9`T`)%|z<4 zTW-hZM4?o@X6&w^sA|XtORi=M6hS#iVx@`Z4)MDFxOzbseIw7@aN6l3^9=XYfV>O9#||C{k8^$^gVcAF5aI z_>2vN^zqoE3wip4p~Y6Kt1wn&>!d&9I*G39WGA8AF4-Q=*gjKiBEksj;&>kOy8{xH zSVcT@@jYMtk#4S8hhFCO&>v*Lclup$b5Ivu2N zx%9-)maN9~5iyj~CQE9Ac@f|+)rfSqNWQB!dIicKy~_Q>XLY(!V_KY&X*yo`02@ta z_KBZ(0Yfo!5vi5=B(qbY$!a$9ztLxi&P*n9`iMS(7~gARH}L~*Rw4iekE3t?f}YSP z?;jJbkfkte;M}ibM+5sfFqps{djVJ@SG0@pzI9{C2GUcEa_q|P;odaJK&B$O5y zb+`7^Dz>viWji(KF>Q>Y&SaCxt*1V}19r-uDqv#pLCx5O3pKHAe?td@H_H7TeTj0V zr&K{kluhtaRIb5&$uZaD=@D|S6rw0laVVTWN4Fo_X3}N(0~t3VQ0r%%7QG$JmjZ{7 z15PK6aFR*EThb-=Z3NC2D83?6hzo-NGrOJxZbTOq;=8IhVziXO$DyzoNf zP91g<_(n2BFt<-ON^~SnGmm4D0f<=Ks|T$7sFpW!S$50;ONNEs;(=9V-JOkX*!6?VcUBsh z2+iv5Ae)z6I9_)I${34e$<=lbvj4iq_cu(5q+A!v)z63?SusoyHwQL$)cP1rTOJwW z0aplI%wNOkJ_KD!3Z}D6hX+z{-jD~PoO8W2f0o`i%SwRuscAiv=@O^Ps+lsAvEH1C zKPzpsqwupGJPw5V*R?hbQPQeou3)?3xx$;n9%=1|<#sH@ zBv-HT7SvFr6hH#lJhyH*C#&(AKAb?Dm=>$u(0+(k@A!byg7GD#!LWOIzbGzMwQS~Y6H!~urC1mgvQ-XV3UluWHL6rh#{p4d>YR~PPU=yc zsTOKRpqXHsJdw(GwD*-8o;_FUu|blJI>m!9x&smxwi%YN;-id9Ies2zbi!9^4o^x! z7${18jz*y*&Eqs8ml)C&v9li!q^~Wumqf_mL)4PE^&ysugDaYnZo!eJ#I?pdD)Wi~ zPqqfyrj9^ctYFNBm3s5d2yT=YAXzs`3JX5t2?sbQQ?vO}txO+4h9vmKYhx#X~8yxNJ9~|y?2mOA(UNc(b(u9N9Sd2+k8mVEnQO;UpPQ_?*33O2R5m9&$&85>; z3TeANPitwVIUI3GnyjeWFQ!_qqjW^psIxc<)X390rO{F~sl(_|VkiZ$Na!)~v(XrX z&x({>U;VKgy4UV>;fFLaSL~rHFPvXPi>d@&3hFJL@Vu_kt&@@#j73nXl7`jnQ`}Z> z{M_Xlcg(^o)Ffz8@JWii#K!aYWn?VXdowb{wDxBdU->*d8X48iK8;LRkL=Y@5xIW9 zhT<*H+q01|q~+Vl)cb_J8x=gg1ph{nwVFLfQB|AwaVUs;DPE2uYno%=T09-fcRveX zM@D(Aw^DRS^aydVu*z}6eTjcoUlcab(BdZQa!rhRf zIw6=9&J%FDn;(Ry7_X#|8$7_(Lz}`qc75V+j z_Yj!2Q6!U!giK1KNG9rpOllsn^kW#s;bFgbu%l%Zf&*RkiwbL1|As}w)jta&H*HY< zH85so0bQ)}{mp>p_6{?EJp>$!;lKto(}(Y5nk-q1k+EEJW{oUH)Uq}ki7ml%vltuI z50It)L}xOfC9NicXbkH`0cp5OAvc+{VaTqyVF5%e1F0e-SGTd}rp^UnEC~F$2e7K2 z;Et^4eOVi4DvGo0V4mRKVENm%PALB+V zki=B_gyTsnZeBuIDaTih6FH}$%?Fu^WWAJFQ;sj4QEn}fr}A5$MF5JCT^omDVtQHO zD4Fq>dsL5c**xexl>k;o@bfvL$7t3WY91%#B@?vX$d}ae^F5Wvn5f?yGlf01Epm?b zmvI>H+MPp@sRy}4>U$BE?9!4t6E#-0i(y-`S!@ z_5YlcPhTAR+4*?s42IVOin{jRoxl%&d+i)AN&R2F@n8LPd%wTe8}tTy&emUlx_bYv zL(Bffn|zI4J1pJV_Fza}@ID&*fww)_I~(jCI#fTT`fhJfrzM%s_3oq#FL)df@>h~u3O2pS>a#3IP^4B&dO;hot6|d(WGPU zeZ>&H+uQB+yMw{7OWp*T5F6B;(P7c=vdZhxg$Aq58qioNM3s0c73RT{g-OOy(Z~MQ zAn(n1dGqZ*=0-)YdsWG=S)1Gg)~r!cQbVh}EF17Aq=_i$IIHn0Ojk8CnH%5xO*5HH zhfM+wsrq_UV8U#(LRg6gWnd{~2!*D1Vhyp>bm$3kQ*TcA`-7H|Wy zasmH&vGC#vIK^-Z_q`-b!$-Q~L$vx+4EqchVW1Hjn8Bq31~ALA0}<^K^C|EkyJ_I1WO;_z$Ple2bcgUJIIWZ+P-WuNwU@G(PA>z6LqzmrR>+Wn|IhQ*2we`vQF1isuI&(6s*WhJzgc( zRU;}b(j`TzhSRrX;DJYZcS?4`=;p)S!n^4>H(!$R4dxuUf$WBF-N{#P`imc@D>t|) zT4||7$zF@J+X+^#UM*QQi%nvkdNY@-nyzWawHo2Ff?ZZnk&`x;WQY}KncTL#z5mpsyrzngjVN{#H@ZxDQOn1#VHttA0b&NpGf88i4gYr^zriI zZ({7hnn{gRGjiK_Ej6yao?<~q26>lM-Yn9FPR>MH(a(R8C5UQeS*sS1j%0>t^I?jK zX1y>kZ!AsoUEZ9+5j#w8dWrI7IfYM7yPrS4&pjxP3FRUUDrqq;6k4bmbjwm{(nXXs z+IIEc5Cs1IvU^I_DclU)%&Ot%sbnO6!gB=DxF!^z#y*)&V95ySo27C36Z9)G1P9@Z;pPT``4&fZjNgfne>vLw;z9+FV>hZ{&Wd`-D(>L5_GON;9D5=>*v z#*t!=fkkH|I!du5>n$Iy&M#RH`Eq)GQ#lBgn6UI=Dw@%?{SvPYa$iJb>(|s1uuxTB zcn=R1qv0k-d5Ky((dHYd7HSn!P2y~pWwju|CO=%sBL}4S%KZS#NlXqd#*v%Rh|Wi& z(NAtn_L0d~Y7oP=!${Wf3E5RG230y~rw}b|5Fwb4C}e{@T}{$!_4yB`4OU2f1mqKa zcyU^IF&#ec2rrn@IlA+wY*Coi;77UWd+52w@S)PMC1NdoMY#rQ5_MMaq$$h>%{npm7SSCXfUS{qRz{KD zJe~MY@_B%eU1sEzMs(c zDrF9j6`}_Bt!hC4YvJ)jS~JV@7VCLug=$#Vqo9gC`Hwa$ma%$3ymdTs#ZOAA4 zkjz(PbI_xoA)Ds*@AuyL)(e)~v*;QQU%J6I#H|8vI`^RI?HohbJR}DxZPLX*e#V9h zOlM_&d(AR*(#^+Wm0-k-@P-F16=y;@7pk+L6`Hk0ILWFv-j+OJg{glhPe)~+%u}1Y z7p!58`SNO;EL=9`!(vVu3@Uf5Y7lA{I3-YUNGtyxzi3V-J-_ zWW7qaXYTLVL4zO2(`&N2jUTQhqLS+gTq^gb|2Uy;uV1A1_#OouIs3MZ5*XV~emRpl z`mJah7a>GrKVFiqJ%hX2!`@)n+sA-;?9oeNdG47L^z)~aUa!|+R0UzL?~F|4YuX)^ zDbQONJ*c-4P0RJjN*=?rI+iOJuAk%i__oACea=C2S?pL`ESr*9qYcUnc2c=8ykqd85#7# ziPvljSy3gLh?hjGc;Z!071Hgv4xcwDAP7;GKgS1&P_*dKQw3j=64Xkc%>C}z58+qz zN0aY=h7Ugqo$U_>O)ASVY;$Kvu3xRd&%9VWJwkW8*6Gr;Xm!t~&tZw4K#F>0e=KML zBs%C14tvlMnuN*;wH2yVzs84BPkOUJfp_wi?W3Ee%E~jZK!s>?-hjfg7pt>vf6>UV zh!wLL)1SabD7@`oI zt-?c$@R2P0_#t_Wq$WfhG5BNN!p<~dEkzLJhK*m6cuBH=Yb$gsy9^@O(Nnc8yfg;D zyDc|O-N{$NJzx&N@CK^;Mv8RESm@vRfj9ROI@+;2!6{*F0`$M`IR0WuK4-1TH>I%+ zC_azzBQ(K~CXj~L^e001($n8A@tr*OjP5j=tboPBqGzwS*JN=*f6aC!7p-w7<+??t zk_x~i6+K>f=f_b945{ywsSGP$X+suvCcmV~)ZCERS2U$_APR!nN5?U-4+oCc_^}7= zCf~Yn-%Xd$%= zZa0(lj1-NEm!+ejbGf*#y7K}u&~(koUX`M&kND#82bV2!^TY{%=hlZ`$o@#Iiou`h z0}9=pM^%me)D6E9BS>II9ld%N-P1ef?};K;3-}Bg93h0}=oKm*d|b{QTr?evagy2^ z9^B$IB|0QJn)=omH=kXxB(h Qt-^o(e@&+N8b0F-0MprDiU0rr literal 0 HcmV?d00001 diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index c7ef05516e322fafcac2623447c8fe7457bd9204..2a5fa5b631bf38ba27d85ca2b12f02ad67c64c88 100644 GIT binary patch literal 8965 zcmY*;WmuF^*EOM_q^Q(LN{WOa4MT|1%>Xi#NH@|ADh)%2)X)qtbR#7qEzOVu;xKeb z3^3$7_&o3Rz2Bc%=iYnmz1G=3&Rq9>7^Cmq(|3AiiFae`E`anYv<(wewK(I z?3%1}eSydHOzRJ|%nIE-!u6*$uMdbvFWg1Gj&EF_W@2U}eUBJNI+wqpHe5khf;Ym^ zlUuM%)|=Wku0a1s8U@@My+H$i4g}N=FQU(yB-O3QkDsQa4%7gs0squ?%#pL_+7+8gVbC+_{PX2EXxg++j%bmdqX}<-f`O6LE;|?FmmhPYYE&qR6!Pl|@6e-3 zWNVs+!B5!0*|i(PGHD_j5gKG{ze}XMi)wT zp=YD<3ZKk|i6~>`#qhnC!>%%Q-*a2&#*99U1>p`exrKw;+5U8A=$vBbopTc(lR&Gcct{D4R%5`ap=>)TF% zh)>u+i2N5@x&m37P+24m=_`F2!Pt+a$04%Fje-I`5`Y3DJ-)%1sBdQ8EO8HWx5ppN z4MAFqFOMVBfIHFO`K`WvBk>&|Arp`zu;PqKH+yIGn*X`NJ<@JY3qFo3dW+t1ACdPQ z=d@u*UynQqgl-mq_?;@UmVR$iyUvnJ)5jy1?Xa0KRk)f+t*qVRMv1soG9`=`g zD&*m2N}RunRnJFj(!G8lsnZoSGbnR0^kRGKO@q^qMSo11N1O2e#P7AwZZuhL-Lfdv zXA_QDumSJgQG)ShDZQYfKgYbZeFiMqBd^x!h3yFQf%iXL?Y{v9PDU$%9@qaN9{EEc zv->W1dNZ}1W`p*smI41RS#I~UL*DSby?$doY95mq_ z!QVIll6yA&xPo+#HGks};p0Wo$q-Hsnv+7;W5VABgutBX#fj29E=#5tU-O~&vsxof zl7hNWwo%_?DJ*pEkWuID^X{qMUCO&h_gGf=&8iDUQLBw8Ct&ljnEd4UAPgH0or$JH zu5BoLC75$Q1Y#4tjN@tQ3Fc!I_?X8ZKj;6Q4mEG1l3U>g#PZX>OvGjczbi6AUeI0H zu(UHeik^?l`%2Hd92Y=RG$=$l2c;(Y|6i*3^lIbxnFn?Ec${#DdlWYD=pJn2;o`*j zO?q=8^55y>=u_*@Nn zIedP`SKD?r*>k?jzyP6AO4pY)JL-R$edBp^R(6o)U7O`})vm~)G31YL`?ds-!OB8OHO->1$5;WmN@aRU;E>sY^VvW3^UHdYM6|>ni1#ceIcZ)x=RI z4;gzNS>??Nrdr9SUdyBUU|J4SS-s?HrO{X)8YquAsSM`NVZ%tOS&2a8gaNLE%rjzl zoq1NL)q4mTTs3+2JOvDXt5OLXR9eW52t2V%N2yYYCLsidQXDEW3Feg>+cOCT=Ozd6 ztZQ=z8k5UQlek^j;SK!ewf*Vkv8L5*(OC`rc8wVcB*X{vMhmfZQ0_?SJGEP9^I!N4R#o-v%_}WP*BxjJ>MZA#PmbI1!rU5T z#^(geZ=KGMG^TK8so$1+rt%n!%n8U_4^{u`>iF{ux9jZ&uwqBKF(aSftET>cm9=a` zV&sDxlAOI*Sy|d_!k#bO>yn%WN4Ydfs4O0H_eK)?+l@kHYp_h%_l+!~X^W394S4E| z2BtShpqG2o}^?~j$tr&QqCI|L8n!^-q^C5R{$y&et(|<9H3~)`IB6&5XSbz>0h86RU5`q{q|q zktq>JivCAoi=@X-`(X=a^dAp5Jw+Zz%1bTog+0Zd84HV=tY77Fi5JIHmTX^UcL@bp z`i(?Z?UK~dKU~}6dar-^I()Cvz#IP^adu6LRA^xdQ&3Jb;h}EU zeveVdaX{CxT*fc9$uoAS=zbqkbSNus+ZlCvd}c}ZbW!TBJkazgYx_i^g701(ONa?` zJ&fY1R)TcQgHtLr{ypgcrP}cCt?1GbZ;xgD#;*r(uKg#!=v}x)a%J^m5gbsDq+gHp z`lcMTKR_YV@QzB+cOj?gHhOY8 z7zZ})Y0mmyI<)6iqcL;m_+~0XDC7(9>CYmNufIUAsfc&C1QI=~b`oYIP%GD)C%fjn zce$cVjVrPG&O2Vtvw!6QGrq)Xmyo}U?Hu8fqfS3!%W+hT+Ii#Bxjt)c#17rOgNSK9 zBG-cQzrqZDnHHg%(?C>XO2N*Xhvc}KxGnaxi$eIWX+aT-Wc|iNdzJL@t(R#pewj5J zUNfHur1z4pL9%cga z<4*?mMLMmcT?>-!E|T^1_lwH6q+AGr~X6lp_bGs~Rot5jkd2Kx4Z=Q}*J ziv0jew6I;=g9cbhlh#E@Nx++Sh&a=0dd@9{saXrT(Xf)5&UL09xfvxuP;~L+Xvj`N zJdo?6V2701uV5#x+PNO+E_YJgX{%6J>!Nvr zt921fn#fcEtIxNKzhmi4-q19|bbpYS!H&90_F=NIz?kUwN4u(6e z9c9{Hw*1=TGJK63e#i#OT#>wK&L+&LP^fOb^T!l^>K3@zW?GQ)&huTHgF#1jQ^6uf z6WIcF1^gG~0#Kr!UPh&%&6&QQ54_PtZj&ch|GlDzY&_qgzF4kaUKqT<41P}QIA->e zs^6*iJK1 z-VQIdC#Q&VN3u-QOI=_+=aY)f2Nel1jYH751ml?uvTZO+YvpcjosFM^qdm;V*pt$j z6vv)NM1>m12FLhh3dn;yyAtwpXFH_MvvpH89QO_Y$5S*9??OB;e;8+QbE3GrbbhUk zRC3arU*ia0$)d_-LfBK(d1I#nVfqLqclwlW6+(a5+jSsJf9^=I(X{CzenpEE!1Fc_ zZwr5$^M%YOv+JOdetOw67~QnM?A)~6wyiPkCE>uj7$}m6X7;1c*dhJ4DhVi-D)Dta-L|a#p7KTCvvOyRj*V;Z&GkBIJ z1MKjl9SSy@bS4f}n>$#1WBUWhJWZ4tRvYO)e3%K5ZZ=N_(emETje`#cfTdNI8 za=RjL9^lEG;ArA|17s==)}n0%46i+F3{VGjJ1-vZ;PkcV+iN;8RjG$WgcZQO3~qFE zuOZ=3c#o8b`H0f>@(|n#e;AIm+5JAXwJQwac%g-_H5DHTAj&6DWqbTOMe}#rtVwh6 z1N??sdy+maTxzZjAlK@vP@qDOo^#hWU-0z@P=6@V-CR6g(3s!t(l2(ydL=mHT{`2XX;e@YxGehtl0tArcvm$ycRx4&K4^43 z$OY0K4&?PkfbXL4h?7Q}dQ_aJb2qF|Qdia1ox+(#7n>?OZB-`wm$km_*!SUe30uk7 zq*hTwKBgLAL=H99U)DrBHf3u2vB;<^?@T3GLg@ftO;ObHvUACIZ{`mTax)>bw`~9L zyPr;um8`_gA&4s1V8?1)w=38zg~X5#G7{BWJ=i-k+jA{g4Hwj$oK@>~PYD|r^qj0V zE;18>EDHXroNy6>WD9<^6V@Cp@vPk_8-J0}qfTWkM5|XfJCF}2=tgjR*8UYA{65Kj zVu4FdXbjS*oe{Q08jp)FV3x{^FOVD(Q(#Xs$n}L;u8YKy@@IVByRdf7 zFMSF(qG61H7^%zMb8*@}%EXEmirslP@2Rbc339OU{Q1$F#GS6l3XKoF&(mu;++H&T z_*(S;fY?#=alj7v48DCB;yV1gd5>*KW@eg#;4+D0uO?QW_&T29U%Q1Dh1PR`YVlRQ(!q^Si6U$A?R@9Ka@T&fT|oD{*s#8>$7hsi6&Sf1oa(*Bx{uN@R) zNsG+7RkoNPwC#A`DFnCXUv7IO_Acjd)?Z?r_&cB@ohi~LY?HPEtv)&l?Z(_k-bbt4 zIj{rb({Z2QB&%6woLSEs+8gHk;wM{4tBm%PKHL+UrS427^rloRnDf5+amY8WhHlEN zLP#fZ#!+qh8wF&dbf?|TD}D3$A3q)&1Cx_($l;S#?2gey0c;HHfx@xhi;F7Iv+>Nr zQ?uY$2(!>_k|e-JUd~=jP=zrAF$N|ZE+QZPhXv%rlef<>^5GdQ^5l~9V0)7B6q55y zje$u?H^U(xX1jY4W*Uhx?7&|^{<#MUJ>ka(wkRda z91T;SbFfbbr_{cUzYJrJ9@PDSIlv$6quoP2rVst72emi|Jw6BpEUWvYB+|kYc&&40 z`exr3$}pBThQ}mKn6ApTM{bF^GAWQnUEX&+znC6b;!=HHdBjyo5x@_yHT(g1b_I#D zcJ3%nfKor}#@w|l{Fwl)^j_DWdxO5q>$F~1c(#So$|BQ-8!j;=a4FJ1Mv~NyIMmdA z5(GCiGOUhxh8oI(%a|$%44(H7o6mI?SA=e9hi=)G(1#I$^0t&T_49l|Y`Pqx9@J$T zlx6B|8@yA&T%dNQUzQ~@lx2;ji=k0i9+R9`9-vGU5;kv8lF9{w=Xp|nzkNb4Z?x#^uLVfp&r?ulu$ZTFC^xEXxJI?3mdPcIV?7)==X!~M;Y2-iZ2Hu(p4Iw%p3Vw~4QJl_c!K6B0f8Z8K>x^^>e*pE% zFY&(o)z0j4s_se{xR?7YAaMDL`D`y|mF)7DYzyIK2cg_wplBCxb)A9iqn~%8#9z1Y zJU6}z*`FQyj2OJVs@R&&dDaygi{IfSf0$Z1u*a7L4UNUB2yIXLPId^%WxSb7d;+5Y z8Am)Q)^};#xkI_eS|-A@f~1&_Is7EiHADL~65Mh4*GEk<^OyzO-msh++V2k% z#kv*`-J0ZnJ89f{dttMODj079ll$@pqjqqzoPV)(j{}kPQs*j22+4n;kJdQQs^gvuJQOh0u=|z4=F{}0-KG8o zc+|L5M01u^X^gd1xpsuRR$eQ19!zUt>Z(>us?B|50% z%?yI$XPVDWMsIiFw(URx3sJpEhN0n_A>}*m+!0MDmb+j>H8ABY?AzJ}b;L-syS7|} zC$-Sh!)}|!F*p8TWs(a1bMCOBGXC;u8X$Fd(Zgl{; zqLjiCnV0yZg!MgZ4JgruPd=8FH-%L^i}y`paGBSm{>{a5swq8vyfSrlCRkEIrGt?y zm%gTP0!mpCK@d7m;IXBAa5Q5j#wHvx9#+ylF-G3Da&EG-1Cl5Em<w)EF=D)%6|GNLGBrNZ;(jZ=o28=Phi#MXHn*i&(GcDN-EPzNh%!wwXyl9- zolM(hKmEayd#I@4Pk^G(_9?WM{e0N3=~D=Mjei(n*T6f4_)4%wfeoxHd_KHaDmigf zAnRjMa*Mb=uNxBSwv=7}NFK)e-T^UeV#Zx01whYPX^ff8G#Ruipzqw#Atv6SOV_%X zi2;lB4lEMkMvK8e}koKk+!lg*yzgUaKPi);OgGGtTX#%um zAkcGN8spMejUd!+MtBh(S84sJ2&h!DEMsso!|t0lZVCvj^B)6!rD4xg@)DK*A-4P< zs<5TR-sa&vg~qbW5~JL0n}ihLFl%;ufXB%3SnX zjFlioY-I_#K9}4-)a5Eem_RB|{zCx50RITk+tygZKg3FnXwzUF50O2Yunb?mJq#pt zqvb39q}e1mbSSFiBU&Cw{k!L?klF|_{p1uZ?ew_j4I0Vw-Gh8t*0OY(xRIqovHq#g zQ-Ee90ar#;BO5?FGVI?XBk$pGi4E6$s!gi0AUwa+#xTDHl;857oB~@0>|Y22%E$Z* zfo0ghx&K0;p!`s5=!6M?AakKQ9t^(iil}s<(iNn1R1qw@N-NhIC*T0PfCO_Ns#STE z*(~HUr`Y&b=)CcJ46)0kw{O@4jYA^{K>4 zO1@z`%A?^W)2sT!FV2%x0r*_Y^%}Vyy9cDD{*#p-&l~$h52l)c9R}E3!EJ81 z;84xl5AN*ee}rWzEpII_EaP!4yYDq&`AzYIBH4JA9lK}p4PF&!_cr~2h4m+zm||r6 z)`HY>KbPnjKpnDRPN#hzrcZO*mzHb!nCSDZRNA13v7&sy0y0wpm1$z8xqNcArh_T| z5A80fW0R5q?HK3GoZ{>oDjTqH0I}mU-QK$zB;i$Oy*gjEM>Pg_{Vg15U?&O>R z)M1;WiuLhC8&mA&@?VqgWU;pkPWcYyQd@ zb>285l6$DuCwE(lwJXk$|8F3>N$>?J(&?tZ{b=q&I}NP`9jrHzvc+DbMMtdO_U)X| znYSv1hiVtZw}U0YZuSavI}@y2RZbaJ&J8>DZP?a=+j3i~wX2_a(nZS1Dw$!21Pk5Z zBJCoG*^xLnP4FcKeu@Zt^CZ=}5jVk6ThdR5=`NlqBrdl;a?S|bJM_#SPHM_;) z#@*R9in(ILuG0Tox%LR*`1KyT+VNsfHfM`=?r=+KOex{s$bjm0#dSHA| zR!;HlcMncY#jD7j&|1>ql_8u|a*I=gabcm774_xQYTqHWG$FhdF1p-zVvgoohxKWQ z%|=yr`WDRHoM7HgpR4H=)r?s5to1FwEBgcEQ#x^ZSc6u=ejnFMq!;CB$>G!Cc&@G( zRe)N(%liEr?V}lezRHiV@yL0x{gh5ReNB1kjI5zJdALF$gzw-6Xv+$MCAYYx3^Y!ISgXY1kS10O@kIRjGd4WKE zP9R-EQ;X=Z~Nz;Rs-Nef}&uA8*JzVZUV zTo}hmOwUBCHR`MN=3-sq;{UehIB}ROsya1lK|@tc_gh@IfoUB}Zm4NL-hlS?ljfx( z_3>M2kS{|3dloCV`D_VdW6cO|YG)$|T%2^D!)%@=QP`t6-5 z)0~vWH;%^5d$dH(oQ;3MiJ8zR?yi2GY0dQG+g2Bn+5m<=LXtBXUMy{9+u$c^ktZDE z!)pKjxXIMB_UnX!>1 z0>d-bi~|mLZK?iUYHiW}Ahz3mt4Sw=S)MMFTQ64>CXxCZLe7^aft~2yWy1QX_h_ z)nn=UZ02;IAq}=*2*~d2y8*M?8r8>*grh%5EXV-H18f#N^A=yDf;6b({9Fn||LWO! z9Bll4A+EU{oBO$Y+N_F*+sm?vJ%Vt^5mWm{yfdS>3CTBbjKSC=A9x)|-Ka0*oUEq7 z8dM722J*&_I%Q$d4M{A9F;17y_Ul^aK-Kluy3akF5$xGS7^f5>})0FBC0ejTvNXV1iH3&+jq@XQzYgGD%F>&Bvo^JCF&i?>r CUGp3O literal 8129 zcmZX2WmFVw)Gd+%0@9t*4N{U)(%mJ}4blxtcg%n^!hn z-n+iFzCW|ie)c|RpXd28Yt7KcKYzYTz-oj1=-}#QW9MPv<>2PZE?=bkY@s1Qp}EejO#J*k<*d2-EHq2PoU!?G2@+ zMnXYOFFry+y?MVNPrOm^JD5LR`5XVE-=-9c+r#MfW@0ntDo(tDXDEp^UYuPg-)cg* zHBofDK*IKoxs*gyEdIpI2ZFnswFE7JJoF*~z7i-S-`|^sOf(0oB!W%)B-??ztjEAc zSao;D317_D9<3BIx3$OH6SId^=$Uv-JYHVJpUqRr$4?)2SsX-e;d6G3ZVw|u@8xDb zo}a$Kv5hbPiheWy@F;w>?nN=da+8x-0`wwGX+nnJZrbd{jOhK{hOAXa>S35qvj80e}^O;^CRGtJcOYHzwq)& zilQCPO(k=?ZtNc3bqgE=k@t(QbKM)yW`<~ghu)af#5{gEnRvvBV>}GOBkgyUJ99VW zAL0wfJi2c&7Z1YPuudQD$`!M){d0d|Frl=J$+!q)L=zld&vSmce>0BsAbUe&HZ&R<3!zH^=Z}#k2`T3{SzP6H+LudQbb>0a?SkEKJc9MaH4Ma z78ZE;J9C|3qT5f2mYr_PIwg$Ons)yRYe?)F8h7=N+dDh)-wuKFbwn)@n)l^|pgU_# zP4Y32e`f8ZXEd2hpJtF?rV_ zap4nHIq7o8N(}VFiOLK&j9Mwb-Z5zf0e*6B>of7)FiQL0f|Yyb8V+{@eO@bjeeB;7 z8+N~t7>4!}cmIxy;AlF)g0m$@TTSV;03;p=Cc+t2mz*|FsFTF0k_4vT9Xo`-0!l9N z(i9UxpzkRAOA|3&AkcwdGXr5lOZHYL4py?1E|A(AhPUtjldOXKd8`UEw^ z+f^=afBs`WXI&<3Yki{G&st5O99qL0TGw@;_TuDe#N}9$l?@fG%4ae`Q;4x=FoZN_rm)aMAd4FOy?(-QSRlS~d4LIcQ^PnCq}5|@{`u&Wv(m$PeU$(8e_ zV?Mc4i+fawQz{trqTg_ywh1>C_bk#rWh!bfmX*`NI(3C=OX{?Aq$?_PXS1>HbrIHd zM&-y5_J8|)laV6+m-+t+{BJ$h?N1)HG%P23*@`$_TrGA|ZRv{Oa#N5lO>vm+owh$> zRZk8?+t$m#S-wP$Vo|!M+tYYIjU@OclPrqR>4O~zh#$B!*cnT zi!lAW7^tzFSNYk~GbCz@z#zT5K`X&LDeSxo~?mInNkS%YP=Oxb6Q;)Az(B zKhmE)`K8F6osoEWkh<4WkB3gc+OtYtIkM=&8skU;IFd~bt#%$%Zt62W+1A>s&; zMI)+4B}#An8j7kV@Kn5lmPM<-APloll+%%e@~S>ZG>$XI+OAu_Re_!c=l353*T?)u zC7HndX~MCF3Kh}c=zT+4i=_XX$HUBP@C&+0lr{FdU3%93%Aj!CQ z9SbGG=~XV{Z4}3gCx6@yB{SeNBBws46QKn;ZRV(*;~0?rG@)Fh0=YH!JVkF41osl7 zKSeJQqhmaY*lSc9|F`5=vo|0!oppQ4D2Pbr*iMTVxKHaa z+(xwpts~Y^MQCSe2+bBhxHpsMX`Sgz9_+osr}x6N42^jk`W$gvO0X2_=<(B;w_)NS zyt9)|tE;<7zY`PSW_XW@cq}#Ot}vy+NMP`{W!pCGLyL12+TD~!WIw8K%LikfJ8@i^ zu$yK-t&r^|IB9FW5-ibsXpNMT3{T5BC_^tIME|6J@!2-KD>UG7!mtmjli4xFnoLf9 zdd$YVu_caUC;i}@{U`lM_T(0Nd$E4hz3_Zn!$QAdfQlv!9#Zum>5fVw{Mx zcEM>ekQbKUf%uhS{j zm!f~4T>UHPzON>HnP|rN(}1VtKiQhB(AvH1 zQkpU-qHfZ6=6boMzbM>-L5!)(kpLhVSnmtaQ9P6xW;6Cs&yg_*_3)-EpUE@5VC-ne zv(B=x8=n57{{km}6m@kc9Vp5{RKoj_xk0!BbXTdt=mT$Xi0 zfCGm*AwDCF;Y)!<+!ft(h8z#4ip?7-VlM$TRRLI z{W~YA9kZm;H3v4t4*x^%m|@E&pZD;83p;SJCY0|u)zKh)s`8;gru4;!ya`7EeDmnn za|bQ$WA(||ysII%*Y`~WP13tvvY0Mpr!{A$4K^cW(on>O`HV~x51i@%nVePo=YmG^ z>Lgt2oy;7p!U=|eDy@bn4F()2;OU`_vF||Cz-+M_a;x+FGDn`lJ15yGA zD?VVsWR(t7%4ign#y_K-oiL2>lJI=wI9M5sIF1LYT@DPrWZ;#L<;_|5tN zI2vMyo%7-Toi*%3%iYK6ptBD@SB=u{bXJs6h?glnn%J&5 zTGHjsyF2)NrPmLCT)8fbB^0>(H1}R5Eu%%YVXw8h`?5*YyM7zSI>c!SOzWRL8!WRE z^&m}?-;ZWoYxrRL)-m|hdaiO7dkBMWX8t4br@x}s(qWtyr+Xm@Q#Q_Q26*P~YQr0dE6IlRm`a*aPv_7b?_2Dz8q)YQwF z5^H5hwS^Dk>W)Dw;<%1ud64sX6>%ZQ@s2%9<(sAe+~13(X>fzPletO#*Vhd}1J@^e zn$PpK2=|hm(XAUUZdnv~;1B+1?&ud*YI6}GH-_RFc&E=5x-kcHG>0*Vg{)ZuIqKbB z8c1P;bY9T${0@JyDlWpN3B)d2Y_?wI*95v07x3O0jPW3+frm_ZA;mv1h@wb{u0JUw zjkA4x)}ZxE1Y;cL@$ z`FAtYujTp&g*Sn2#(#aoOe~W%{W`2#b0x~p_cCBP=P|$n56806)}LEjj_ZR;nqh3% z8|X;(h0&8kPa*H5>Ufed+i-zOHgPeDpNl+6_GS$@0|@UawzuqkDte;F2p1d zP*9km0y$JAO_?$XXeijzkY`WfQ>LKov8!Ehk7Hu z_i+FK5!-izt8|z2FypsHNdR)g)8R3YU)05(DWFWz43Jw>bQKftx6h;yugd zLe#J#j>7PeYq)iidQ}z5>wY2LcMgW{iB0@rC%N6$o*IKdjQG_2sg(Q=MJ$5FgL+4Q z{Lr21(@m*0Y^a3-MDu4_ozK16kq+EfI)!3E!vfd2lT%+g|7z8=rn`hXd)d?*xW44{ zd(dnjy7s;Yd3u0@)@>86%=K?%-8V^H{#4$dsD8Lh2dm|nIz95DLd>C}ki|7BLzD0? z_FU}nO?xIBF!EB7Juwa#6QTgkCW3I|S}8zVA-$Ox2p&KLspG##o2r72w9(^$kq}Na zd@cys0`9GQAe^(p-l+KHN(|}fo-xpt@Y#7)?Au%>_Q!>nzE}dg*a^8ZI+Yc01)?#m6PlU zGr$8vFP|IM(5gBz4q%vQGd82#vQ_f$a|mvDBU{3)yS_86_;G=GV5X$ggWQghu$6AJ zUUfH2HQ#Z&(L{cmPu+*bOWLRI2JS{m?%;A1rB-83L(`+BNq2Lyw|f4fKczV;dm(3e z=Xt!3(|GX3ACBJ6hE2G-DWvOi`N8>7ZFK32p21WU%ft~+&LZr?!1Nx-_OvRl0Ih+r zD!u@-3kXgqK$Gfhz&C!s+Dsl2miToRKx=-ZXMCztYMdvF9TK$XxnN8qrQSRcLGqWX zD(m6Czj9%&{5{dc*NU*e?vj{*S-;11JFES!PUV10=5WTC`f86{>BezKpe?uaUREPn+l(=kl2B~=utq|q-(|-_h^$q&MLQL zB^0BT5fG}P5)rO*0E+#O5uz*al<`%cT zB67}h#_F`52y!+ETYC{&JLCi24>LzSktLe^>pwS(4YVd_^v&2VX3ZUYXS)je%r86aVnwLBpqf{cm3LdL8;)%( zoTSEYQSVg&uT)>@tmxkQPB}QBr|6Pbv*^5Fnuk?B>htC2pNMg*K4z~T=7k!iyc#7E zXAF{nb`t0QW%-*NsR;MueT~wa&C>oI3kr$fct^c|1adW$6gOI@$= zxg0{}tDC#OzgdZ@r%UX`-zXYnQ94;X;85xtB>k#Z$t(6kQz0n#1k*C8Oq_>;7JTZZ z>HnU;6IbPCq3xvbwB0@^jEt6jGJXKj)`GB*e^sdzm*^WLGk=(P6Y2Nnv0Y|XQahQ7 zEh)MqKFup3tvR-W+`d!AQ#jBjiT2I>g}|G>+A=$0gN#U;gB3-0&Rw%&h*j!awgZ#m zFhgY~1_T1A9Fo~rcO=P)6w&KFMy7MW3rSB`n7~Tw$~{x!>bAWv0|=$_8HX;`0HGT2 zXh#CshL?_yG7Uq88w-oQnrLjgluQkwg-Z}X#U0XqV>_|QRT<_fcqqsD7avtXHHi~t zWIst{BCEaDg0q%L%*IY_hYLHd2|Ks8Ke!(zM3uosg|`lIz-_`AvBFXo$d$R6vC4Et zUO;w87(oSspMU);lJI3Xm38gmcqQ8RU1x!g2o@lOD@b6!^;oMmz?pmE`iv9qQMW{^ zW#;AKTO?b6vKd^Pdg9rVda_A!C_;v|u9K1{u?Dd`9MCVn&!qTP6JHgESMuEf}?&Ss)yQBHfJN!m9m3-7jFY8|Racc64 z^pa_lpc29Ud`?AY!jb;tO8_$xPC=APDkv7bQS=TMX)+{1My$pp%ymCUdx~u==&?IF zIgLq#o@j|JeF~a6Nf;n9+@m`qQkH`hcLdFjq}XE}WO{6~K0Oi{&3RpSENZ89Uh>$P z5N?&X)9(q1Cpwxx(i*HKZ(x`k^k4)^O-O;rRv@iEYado?pmNVhMQBz? zbH1o?QB&-#S@M#F>;ba3gkuI~L%S|~lc1~#oh0~h?0ub}au><+;%RVt- zptmsUo&G*Cyrl&5l4~(1Vc)&dWi)@!(8=K-_#wNW;jZ1%TvDTMGVsz|RNk_d7(-=m z;|B$%IU7DJvuPIZ7eXSUDorw#I5}3;Ld8x^A{h%T`IAUX2BH$pu|q<2;_9XpR2>2m zK1@m_UM34d;KwJ5%Y`XWmKpZbNkb_Y*TaUNkpwpv#e<1HMyViwLs^CZ_+ydAfFLdt zRsEzHK$pLvl)K^1BrV<#6zSho4)cp+agQ5JN4+4LlqXPCYKAaQd0AqGRez;&VJ%Tq zZB(4fw2bSsj7J5tmnb?TXgh*h#G@W?mMEGwDvHbX5XLGbGp;>CM}uG9on%CQrD~b? z4~$1S`@KEcncPK2yYXT`AQRPU^WL6_G4{mW8}IrO=TB*?ThN`#;YmB*bgx{~`}+Il zO|xOK_2TqF@hRA(KwU(hOozG(5C+w`p@`l3zv{IhlLaGZT^1k$}Q<Win}?6BC5F=5ZTP zs&%hmne}g1g|%Vqc(ge6AQ*7mjPQ`AV05br%@@y07uWyYYepWWORnS>)`k*Bk$-Fb zK;wd!wlVs&3+D_UTW)q02DP5sj=z{yxawMmd4@^~*-BGH7o|raerdk{?yGDGv~6!S zodlbOpR(3?mvai+zb#ei7RTW07D~>l$yxFt@%#Q2MQSY|g~vl;s9-!?=d<&QZ>z%O zpY(v=CG!@1h13C6bLXZE5*khcG+Fsm+4*$SK;s#pT!6AuK%C;_Y<9j5So#0cA#-)#ygTgh_as#I0wx*e0>8{%{Q6_5v@;z5mVDt8h0d59Yp-0VA5uScn;rH;kAO1O>(eNZkyLqG)msV=-!hL9D zo41$4p>nf{Y*R0o>E^l_#|*7i(2F>=3KIcp3})C~PCLeC=$peXts)gLC^2KJ&@#Bt ziEzdHZBta0Z1G;0D~?%);ylU&Yt(0LB5#@l{X^tdsJYuMymajwSOVHG4*7X?$sucFj+-8A zQycl1abx9(|J-iuR5F>>yCvUCGDreBMGdHWLg+m==`4@}!# z<1Di(6iwXf%F`}Wj1L)Gt~{~39xQRYj>&-S{!H)YdlR#lvs>z5@LsE>dkdk{UF%!3 zL&#DKw`PV|xlc7tS~D4|yIH}n{mgwm!L9L{ zYuxYECeEpxN4^_FU3wzs6C)kf@Wn;1niug`-%(S7tN*SYPE~g-hdvA&UKjB^F!D|h zkzqK{OGhzYmJVf(Bq!Rtibu@Q(XI+>(1a}z)IeeMjb7gOJ>P>MZE z0aO+*tE2!*8TDRp-V5g1tc7GoxRBMx3yBW8 zXMT0fb@#(daK%%E=XaVJ-u-w}vzQCHIZN(Q4}H(#+F58D?0r4N$EAWgD1b5u6@%8l zEr=0=wtt9)XI9?-h@4d(S#MU6@DWDA7F#lkJo?NFIyU*i250s|G*;+d$Gc6$A4Gttu_qV&$u;9hyE&w+&{YM0*f9tj9~5H z77&{3pjJ91xk~)1_giF0IxOvWJ||PZq9oq)U0y7Py1ao`FWhW3%w%OlLPh|Y8VNh= z-HNm*o2Bji!FM`o4{7~rC5zj`%-=pd5Dh@Z-Rx_lX1ReYGQsSbGAx-J#kN=-V?->1 bIy<%{;%utrm}6ZJw|J7vOj2A5s7U_@zS8!C diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index c27741d5e64b2644c899f75ba2eef515ed341ac8..ece874e00e87870d760b827cfb1182ff3abc691d 100644 GIT binary patch delta 2253644 zcmc$_1yoks`o=4wfPkQMBO#!Kba#hzH%NDPEa~p5`^`1iTnm=(eBS3bTY^%-inAKQAaMhrpl-H0S-S^NVNb-DP{*-p_oMed&c4~EG+T86I z84FrCHevGmxWITVxbd2KZ*zMS~>M0dI9UOXyCSyofG z3F;}zm40|JU{oeLvaD;75Y%@R5aCCmXONa7y5Ab_x#o^t$M zkV@CCOMjYDxLPNb+Ju3yDveyTTKEhEKBg5o*iC4k&&mA`#n;?=eqNKr&ns}R-1Ut?fR~(|sD$M&DuHs>QJO>mpST=|lbR>(j&2%(RSk7J{R%13k zwkT55Am4H{k7qJ%P~o&^(#ixZw8FRgq-s%mP>7}a15+M%N}FUNA z$Xws)`2wLep^w`(@wV+rC)=L$wa�*87dFN=IyepZd1}K1;8b-2LbZjjGsncb<0B z8+HI}YnVJj_g#ZfirEQfY&9f@0YNwKrJF@%y=yCIAP0}@p%x|(0`jkjhQJds@)GX9 ziUel$yBo2^kxb}t-{;Jah#bln65%Bmn;liuz1K~WpUcC|h1MpYFl;AZpR1sdE(;hP zE4*SvV1ckBHpM!Vz@RBg%`&V4-sBr@=avH*Qf*h}v8GmL8^*=pX@e&hFELn;r?-GQ z%ujAIIK%H1)@R={s5oGMWmECb8F#&?J)Kir(@l`x%yl4gN#AND!(t-4qR0gfJF}lp zw|-0r&QP&=F_#Ae=W_OlirW5piLF$pd*0NlD0-3ESaBpfV4EBkYFAZo@>X|yWWo!m z;}jPCxY6L2RB8r**@Pw!-rrW&4Ox~xsfDpbU8U$!4XuA=$F=7^`}E%g1O)fE>tJkA zcPJ)ROX>x_>|Mz`QtQis`b(hwOezsm{zqY%%8dK6W6W%#v*&$-yu^9LT-Gc@~4|V`8 zk&0349|FK1U22vB#XtXt?tk=t7;wd#=8pIuhy8QEUoLFSsI?;p`NwpC|1`nHz!WB} z(SLgnf4dmDUZCUu;ocw41AaW7Ny`r698s`8=JlVa#WH|a`R2cQUZrb+_s^34@@oM8 z;TLl_vliHIa5fYADuIjM!x&=fCc1kaa04}9%h0uHx^zSPfBWWN2j0C-;P}s{-~!}R z&L-?7xCtpu2-Qn2QjrLw^f@LHGpSWvCiSEA&}<&l5S7mjG5?7Eo4{^HdKKXQf9(9@ zB7g}lX65s-->>;^M*lf0k7@R|hSv*ezt3wIH+tGO2(jXAtQqBkM$;GPX1nznI)n{( zG)OAA4_IxCz7{W5UUhH|Dh-Fr`g@P`W_-eb$ki%K!tn*Oh8^6)?271Ipdmse&iJG22aT-E7TorB4%Hl5;n2n~p4l>H~c z>Kfrkw@?G9iSHQI&6^gT)4U*F!vex+O8VyQi~gXWqF~>m%TVWN>!+o8d81%FVS%#M zPg{sUaeVgor}(E^;V}HraCwC3KUu=3Gda}A(^0}_^jLaT^0I=SH7X^H{$Q9zPqRqr zRTc>@P;A}r1XZGU>aFLdUySBL^NSFK4A=SIGJ{OhYNeq-}E43@s81A-I z*Lv?%1LI>PD2Z2`ZjYY+Xi(8`x*3xHDfIhy|F+Q%_84hW7a0ut3CW98&X145pn>08 z|DiEy^>I0+>&Hp|q3id7f9Z3EoqB=#ms|L4n!q1-^;_uINP81FQp(S%{xahKCGv39 zXTRL(Kc5c#b+Qjbe^>zX2Lv7-&p)5^Pvkn|%JYMoYM<}|0_auE$ z#0mNd`d>AGpWiWR)ZiD%AoePIGQL>m^aaO*duYU>FJBC{BfNy;Wqh&3=?VTa7?-xi z?F9rk8kFWMPf+6nlCR_|emAuC(l(OML1u$NxY!14DGm^Bf%xpHfn4bO3DoRhIIxQf%m((!~r2W8IONE3)JLC52QxZq3qF!loWXCNdu+#Vjw5O zo%!vb4p5NzSOTa^3ivH<4^3b5SO2*I{Lu+Z)pO;^AGiAZJ^$y%$|gS6Jum3-{O7KJ z?E^5@6()$I{ON3E27-rYi;wIpqv50LiT}c%ljLz4)Xq>KcD!A?s1ua>i|R@0OQ_uG zS9P+eCstM1?p*V>lLjc&9;SR7!6|Ir+rcRVg!aVq8u8z-n?ED1!AP=@s7o}ZI&)pR zA3a@z=|PQr_agxOEy8tq#~Hc*>|gZ%hwko2w^Sqx0N1a>{$saaF3bVFcKz&O4#1yg zHS^LP1_Bk90!@XoM#KEeqWhPp9zO#IEQ{_jzXtx+<1c{=pAC1(Thzag^rwEnFBb!> zDK3adeINbv1pai|kFyqWlVR@c{yfir==S@aB!7A8M4|z4%p!VW+J0;*u;1hfjLk*& z&H1<9!kgDDntxexZ++?m1BZ%5!Km^N0jEXtUf%hqxm(5GD00-_sgd{Q39p_lCEtVp z_I|}h9s=%vdc*$yg8ljq0-(3jo5oclfQb$RBhS9}V)CGKg75N0bg2b-YA6?;2lpKq z$?CdN#Ch}pf+@6>;6S{>iIah`p3dm7fg1Hd=6)B>>dN`-%658zb3s8$0$M8nH+9_W z1MVzyMpjWtUuAPI0_)UH59N$e4^>l+x+;@Kvh-j93B;zzN0Z+Vp+EKsr;=SEG z-oQeT&tw=J+mjJhC*Opf)mG__dZ&Q$l;8~!nT(Jm>k5wpZ&erPJ8}PW>GyXK1sxle zSK3yC1{>WFS<1Er-J?MMWxwbmW)Bg!g!0pfGpr4~J_7N@+Wd2|E&e722_t+W8&g7a zGBgo}GNW0FE)js2f`RxtURR>GjJUi+a;{7!#cvi1^Xk?J-@Cmy%ohK8~^0bs|c%_jcVRBvGWK>M*X&Pc8-+k3+~AF&3!Ch z3qvNilU{_V<0)H^EVSaM^Q|yPBP}C^{I$k|N*Ieq6`AS&cpI4|50RtOmP1 zCh~kTpK!|kOe?YD$`G+DvQQb1gmmLsB#L<{pfKy>HWRqcT}vvg@cdw}Xt*KILsxaf zlxK&U1qRsx{kr5+=J!&K?u4xogyGIi7>epo2_028P3=g(T3=WPn0ybt``>sfZq+j4?gS2B$%nH|MjOF9ZtRw z?*kRq_jo~0CFQ$|Z^_f^hs6P3`dz;28S`A+_f2{tvlckF=q$#|9bTT>ZCVnhcga{V z7$4O#Mhz8UZ$SC~O9!u2M3AKPuv@Dq0#yH4lAPgJJ6ZV;PptOPOH}&oibc#84!^!n z-Goo@2E;0rz>lkwkf|!IN;c4EKQ}N2od}!+U??^A({bKYlr1OwjQ90jb_Ku>r{GTH zjlD*_TL`3ANX*K;Dq7iZuN7<$x}t1C9oZPQka8jYO6bU3|C|nJYJamaA62!n6Qx*m zpq580cY(rhxAc6!FJ;W#xdbIkBkGJR{f38W8c?@cTz6`zb(EA*_Zbnu*xYBMknlOW zBXpU0;f#`%OVX^kabd&?KWNxQ!%V*dX_?&8^;K*|!R0F4?~bmSB35GFY3lG=B)q)j zNhj~p(e`Q<1&CXg!Qz$9Q<)T zHXxfcCBXn5JPRFZ-0T?kHk}C9W2$if$$El;{z!9^_q}u^jku8Iz#F-_E+=K04>x3{ zJapKkwQLK?bSn@=`N44;1qcvjGTVIfR{GjZh&{KDx5yIqQa7eg^cZhTUB{QR%IUvS z!;JycVS!6mu<>+o&aMSLp=+miy+wwK&w*`?IP#gq!|N{US-yNBwsXY0ccM|n{3yF{ zXQ-mnM-p{5yL#+?%@PEhJ(p7yqfc&TTk}UY&G0fzfHAwl@!YOay!o6oaVmnR``a?| z^3D93$QbH30kG#th0CK-LPXB}*j<1sfO(|IGkH(iLn?{#)kYyOA~|;9I7ULw5uiR3 zk!&M7*s3a8UdG!<3hj?ea2+lfeMi^Yi?Ql;L>&%!8|BcgKIl-xB+YO2xVO`#a;sa{ z=2%%3R^NIn@qQ^JTwN9t-X`TX{b>;Fg;x036oaJUvlKbkJPv{{n|kVAC|u?7o!m@3 z`SC`^*NkU<`_(#g5sbGP-SpTeHi;n8tPNTmCc`sz7{GDHc!Vu*$xz$~L*Gb}X zvv6;oc*yAe+!{q-3)$0lLogUszoTRq)#&^Nq_||*w+x@-iBz%<1L4w!-y;FVJk~?6 zaUEMcK&$1FWscAO*NYF?71 z^x*pFRW`LBxz0c&l;F6%5Do(vv89&hn&2F^iJw+%zu;HCwe45CqLv@Yr%Y(Q!3@E* zOwrUqW0$ikG{#?|r7*aCbiBu5G;r&Lc$Q%A8Qx`iwj8g!(lS+4@n!IfrS28E3@MRf z(dA&|12L-iljwR&L&;xuX@v@02ZZ&bW;Rp+AAj`S1tPM8 zu=mTtD@^bjt_}mAKf@rJrwn{vFS*UnQ#ej8Z~D*~j74VDly@-v{wDAs(#i%$NqkxF z;IJQEB{|EjJUbE2wcQAFz4OSW-Cl`>BY7C(>G7D}TV1+6(4RbuL5$u=NJ~-!BWjX|PUEan^=vpK%hH#-Zjajl0P?!c;}-Of1^x_I zi*g}*2Z`dSugS}4elEUV*)0*5R)0-aB@i4oisXQ1D4}hs~*}Q zBtZe8jKgsLPDxbVPu#8g7XEkP#(43g=&067`uI>ccBv zw^tDEX#ax-lN?vz&K5ln7y$kh7Kt)Pt-Vlf%pT4XSj72gtIsBAe69tHCXq{g3bwln z^=ieR`KYhKiq7k0h!FBnhQfWa2i_;W@wBA(WYkmVW8&1LmQbimRZCTPD$b?mhf$q= zOf7sib+BfRh7m8xwG>fa=L*q6Y$-`_Ff+5=vb!0-VPMmybEnD1l>|72hSdp&z6!dD zf2aW~?x`~=@FT8)AMtE6V4A}Z;E=SVp?AQf=nN!IamAnkl#(UZ8}&(cEvV>YD?)u` zLMp~5^VjuXUa5z?%Jm|giXWn=8c%-)%3s1w>xxEWD98+qrWQpT1Uqql`{pC;H%JUG zTZ_Ze;MEf5raR(?xPS}gGB68_3OBJzBbWrkc?gDEe@v_G0p@8hETp*rtdGqEOsQc_ ztEroNtB;7BB0Vx$qI^(RHao_Ee6VezgUfQ&?s{@Foy~*xAi4QKl?up={UML{v%!=h ztZo}c^DIGRZpw&M!VHe5RB81rGiGpwm=( zx|NKye&cr1EEd&uYH9u~(Yaaz^E%DTk)8otabrW}@spi#Y6+NIp3r=^4pUtR-I7M! zzHL=Oe2=@5{l!=E91yjR@j1vvXgzFSoqK~Ae`L|#SQ*c&V)wR86Sq(WZuqWC@B+wjruI+*xs&9<^ zvG8$;?4v5^$!j^VTy-N6D@l_`%5L68O7$n)$4uE#@slcJ?7Mzn5}l&EDLQaH9@e#? zq8V;qo^Q(J)0HHx7V=&ZT=9`_l6n_(rUR&o7K1$7beq4dW&zZJaHqd4X2oGt#I_l8 z3rzQR=trHup=9@U!%*oJ_ZbJCOLZ~gOWU>3BEMEYoN6tP-w#}0zU3T{j%9sgI{i7Z z;4S!CV+?k4Ghr=bnKpUlYJH#R{qQ#m03n~}lRY+Td#{}NN@F29l`BehT6}OR;&VV3 z3Y&b?W{m0>D>!^FNV|MY@yxm=k%1+gN@d}tZr2n|tkO>F`UrZYsp@r{`0~3^s8CDS zDi}I2j&n+1+W06Ew;K-X`{D)!9XwSZuTNY-4H9bnd-Tl*6UVLVco=v(<#m^Z6cE#? zs2ddPTk2za&H5$;QrLEJTNiW=NTom$afuwK*;_ixcHSf($*VAU)uS|G)=mHWN2GV) z1vT)LG-IAg)^Bm{7}>NkX$oDa!CCBk2vA0oXVc`8Kzb~hNU)ED<7^N?H`-G*~d2y<lxp`?R7Q+d7-ynP!`uhs zzEw*^2o4D6RTKAp86bQ5*{PjD5$=^7hu-Uo@NKIio^~o>sK6G`^2W*^fGg1wfQzP6 zm%Y#@a^<)0sby|H`!b9oFJZpk=}ry1`fLZ%q0s%g#c($ZAtW2#$)<9HTk1)cX4a?wWC)sl%==g>&Y(f*?*9ehZT?+r>jm6u&!4jCje^oH3&Ux2R&=X>dLzO zVKKYH;aCD=A*DA?u8y~^2ty(GQaLRfdytyB}xr zG|OoTML-ARXz%{7C5jmIA|41h37Ocoppd(_=upWs40z)i&K1g?9i+m+#6vvGnD zj}PR=NhL1;OY|-*Zk9Yb~=TyPiI6RI5N_Cn`}q;9tKTT-|DTT%!9 zZC3BX_@32`oJ$KHvbu>*P=r7Kxrkjzal)p|w#2u zsY<=*D3USe;5#>!l7iyzNh?ENTV-fOAv2WEu^1=!Tu7l+$tCA|(&8U2(ou~3WH^S_ zfgBs!Q`aK*u&9_)V^cPK5*G}U{W1K5noz0^C3s4iEx1~g&5Qz~xH)dtGrt+N+kCIQ z0J6K)%I+C+CeW%JI2nn(964I`O4o8y3GCNW66A%BQ8L;=MyQ0kEf#>80F}x_^_`TB zhIvuItzPeo7=C$$Tvj*i4)3^An&q}p>EnlKLOeFWm-*3-KTL6hP;{L8!{9o8p=zV1 zEU!o7TP3SZq4`sZp5duywOf*#U2NESdPG;FSuT@>^e?B-D84VK6o`aBuZ`zP z5D8a(ZLg5N&<2l6Krr!we<2Mrt_FL|*gHmP(~pix(r8Eb5k1bLE9IKyLlvp1>kC(# zD=hvQtt3#6f8pHd2=0By?7aqV&k!WWK;9(}|>!8wooy4RB63iam ziVn(G9L ziVrvkXA;*u`cz{8ZdH~C8+oo~dvh1Qy4)2GRE~!4Q#0HOWY^z-;Iy!1n**eG$`e87 zRl02#inHE^%pGF1v3S-M5)-nWeO8RZbqwMCa(YuEOP2FHf*s~A0O`{zCx zMBA^q_7^KBfl&iFX_{@y>kUd2`Ad-s_BiC{q*0h}mUYs2gd1jXg_s>;`!(;XyV>>VP+3@54Q@Xhtu+EpUtCGm!$h^U0KuEaga#_K_E~nLaAqCPobj7Y)|JA$OACQ9>uQ zo(;ZX{v3?Wq%iI*yOa@kfxh%+W9w!bQb1XS>q{IiOb=x!aS85fB{Y2-AMt)D)`{m( z2K;)IRjfJHtCY}@qLGeB9~dLlC5AdB*5JJPI< z#3Sc#)q{aIg?R8%#jRh;)Zk9pBoX^xBwhEp{Az6~sT4olj9 z#KCLb|| zrmjXWr$^Iir>{!qdZ{!xGm}RlDk$#RB#xOIZ_4oz0{v868U z(q53~=q~8OGxD7Ap7Aa?Y%lAO$04qYq7!?IG52nct;sZ9x==dEs#cx-V%aAPL^&q=8b8%(lHG=>46YILDa`KY!OI2-%UnDG<-0ta>zt~? zMqS8*20^`vWJS4jnQg`^NXsu}P4N)2TcttiVHRBCT2b66-x?i1%@b=rH#$v&R%cRyq9lO3=2!;1xN8u znsLZgV1&x((soS>`4AOh`=T1&DuClVc#t6jE6{`z#%fNNRnYeje0zf&ZnCc zL8}Pk$CeOKVSDNg$i94jmZ#qzMdUES^F~0Acr{NTjo{omCpm6YI^j&SdYTv32}PjC zv`Pufh#PXrtQ(@uU|)Lj9OIA#&foSeoW|E; zMuq80)U2=ZkkP!ImQkR}k&t0%5fo)gdF zR~+$}gCZY`_oX+aX6TS&pWQHoGocW&jat<7b4BD(2@F)>L38oJ(O$NdDMwc`Od}p& zN`^*Nc#P^BNx#^5r#^@8k&YZNLBG@#)^Bjiq!Rp+qOH40iFo z_9;O6w-gOZ+VBM#)mutGQZ$a^b#+d)o+{cyhQ{mR5SDC`bEH7+1<2VkY<^eW`fO<+ z>J?E*T%Qe6X^?Ha-LnX(?rYMfFy3=7TBNT-=S0uvOuW>)`0+5=prC1nD7RGz&Z-0#7gT1!QeT=*qQYIP zQY4FPlR#*;dVMH4ng;AsugM5B@z4uo9vwq9IBU;BC%%>e3#1s&KN8PrB!z-w45m>u`v7b-bcfS-0AvXc;m>E4yHG z)5wULTO*0vacKHvJ21T839$5wmV`tK`?lFykub-ekC#V_gAi?`@VASSBY3=>V5W zXJ(JDg+?65LN{I*U{V8vwm=%u;sy>x7=Jm!>(G0F_4_FKbh1y|C84xAVW>U5U32TG zcaE-;th@xDjO7@b$J#kDPnKufRc`aIc2EmVc=J{$q_LZcLh!4OpNvCqie~Z`#pWDS z3UeH#iLjq|LaH9(YP16%k0n5W(tvjh~MXSabYipp-* z_msV|YX0xVA)+ufL=koM7K&m?)Ol&zW-MtSoQxn=65bhues z<7Uw_ru^E;sU@LpNHx;)qyVG%AQ-*+ujEn(OfWY`NYWeI#E)-NcW?lQr89X1uK zrxxxa`e`=`y7J2e6|(*AzGZ_0i8jvY)|x|7;(b-8ufV}$Q+FZbJ0-XiED zQEHIyFIpio6W2Lg^*QmFT zb47$7AJKKwm5?qUoFc(2{Vct9(7R~5rX$AE!U7Aa;Z4_XdxwAxVv=E!VPdbB(f~WH zPE86+k(L6l0V9-4?U^n2K9%%B7>FepJ?7OWB{?osQqQqzvtc%7Gr@so8vF7=^f}Y? zk$mBdKxNQA9m~fJKIZzfzA}VNrOsiFP?+e`G1?rd5EG=JKp01ie55kL{V{@5_GciN z0ABWD+N);XcN(Z93ka7f#AvN~j3}ijKbf~c97;ZuuO|}pYQ$m*NkXcR^jQV0?xOU# z>F4}1Q%s}fXM3%*cosAHK&6CDSbIvtpUd+N64u5c0i_P_Vf+M_q>O?Zxzkb7?oaiX zlmx>IpP85$k;iv^&?s7U5h6$X#4X1FC>?Nxu#M9mG@MadWbA&LuFXL@7$BkEPW;rZ zB)BuB@~JYPp}=3iM4r#6h_<^PN0^D31y7z08oM@|=d_PEWx4{sevIhDWI3ahZTZ-; z0wOaMAVU92%!7U?*VaT+x_@RdOMRGN8rO~x&j0K++~<8UtRY_kkf@fncog9Zw14?p zq!XaxJ)U))fiVoe@JdThXDuQwD^F5tzmtf8!-w5>a}IlvzV>{2lq$s!jfr`Nt#oe7 zm71<69%qMNKX;tBLNcP3D*9-NUEWIHN~kRV3B1Tj!o|`D?NyAHO_meTj*5)<{sSo( zwo)Qu!=O3X&mG{i@L4Jpgkf9@04fus?_>y9TQbp>ncS0xQ+)$iXR-`OabrLmkbFwp7saTXfo={B z;-+^*DjW8bvy~(WY6Ls3zJwTBIB}LG6>pk$BbF(^4#v~nEx{5sf=mvrvSn;)sbtaN z-ejf#uab*M-WKDd-_a^lAn{8hblnhM&dA}ppV#Th4R#JPZyw*v7$`iQHoP4DI)eLT zk6;ZDoU{giKu$0)p)|n3j9-0x{^YF5jdN>a`m2fz=Ii&=FB$t#-G-b83^Ix6y!l?b}r7?HPC90=xdmRGmjZQHzsx<4ZHJom4vzS$J;L5T;P+NJsxs=?#O<$ z%yY8QS!rm~?Nz>tlWmaKw0+@ZK_O+4!5#?gk35bUVHSIvpTGhFH`MFe-&h@S_f3(~ zV6HSGQ3rR8CQ*v=b;~=S9TcpyWYpSogdQUiiTfweQxfO*a60Vkbnd?sq6j8a6d}K) zuo?lZ>v~h#wqCqZgA_k3vzfCuGvW_SX*bEq(%RwmK<5^Ku~D_@WA(}S+~_ykYXfSpQiv z82k-71Nm!Z7-D{7k5LRG9AY(or3m^4npCMI8{meyV*WDB&WoLfby{6uO?j2`IGb>R z`%UFopEGZJhk8y^L8sz8VPFiu@spS3;h_3cSZ86bkQ{1q!f}$6@ zMg;6Y?NBrt+;?nH@mb;ORpPdUMIgfCj1nf}`^0qcoyjl{oql;__ISUPm&ukz13}57sUOCs%JMM;L*oJ z<)-D$x5Nns1BzktI$>pEmstVSzQU0WEID3$IIp)UbzEv^&E!@RzhWG{I%UQp+g_7c z06%35&TbOOAcD@QcLa9TSJ?;#J1}n1I}-O`#n7<5AU6-w!abel257FRL_GZ5iOkHi zzgChI(^$cNm(e;BCDL!~vcGm%k;U)F&c~HMt-N)4oRt-x9#;l~e^7WnwbVzgM||zlZ*hkvLpw3WECh!J$shhkEy0 zbqi8;x@3=8ITY$bSvnMN#d2$?M*7fu$Y$6Yn)!K^gNXDBtG@!o4 z+2{krhym}19a%Gdmw(qv}q~kOzl4YJpdpw3^ z#agjab%-J6f|2c`!2oO9-8h}s!j-`pz$;XMY&+jTA`@qZ1OpxQgjVj2cG!Hrz?KWb zc!?Zt-gn~fWu?)BgRVs9ZSj=oQ&~}oY_s?)R~M(%P20$PtOzQru@N&X2v)0M|BOw5>$X;?s_9etRjA z^^3b`W6neflT<)@ce*7jzWR%3bGkqU$DSY-(yj>B$Au)u)R!U4sruQ=kBDylJu+2$ zQEFieMb8E3(jl9;ItF@rh-pM+Gd|6Sh?=^>xx5&z{{`2yw61dcP(OC7Z5T<%HW@S| zRp_UmL1d*xw$|!Wv_7;Rt}XuzCwi0Nu(ciN>Z0=;w%g<)G8LdpSjt3k{2(eeicydL zF$l5-_kFDj$i8lRXKDVT6xYL-O>}gj0E%6GKUtla!KNDqh6fwo=7wwR@Jd{++5Oit z_s_!j-DhUU{35S;oFDaWAi&XS+zYSA2UPC9$v|2&%G>}fOK&PJ^hc8nx$i*GF}myT zGCJ)POP}pr0Tr=MYE#%Qo%BIQO9=8TB+yz{BfH{ZdKsU93f_o?JL&uwPT=ci$Inxn zzg_0ZB|C$pbB+QF7Ej-_CR6-4$gDQmHFx$hvg`32vQdFBE+k@`Nb)zH?9?umKmd4z zZU&;-1SEa#8haz9u`e-}Tnpy}l9abA$BuF{vpJw<1$x3tzCn~VK?~CUEOkG^gxYZd zcN;CP%&g6!7mn4&H;;YyIPEfVL|D|g$S~!sO=EzqR~vOD%1|H zNwFh2{M(ne=_n`2JmXr!>WzSf0s=EJQ%mw`eV4z}{K_WZ-lbqK+yiU5r56P%e2ZJg zXXUN5Ed*GF`D320xunPqC5~H2DQeD7ndCg1A{UDrtGWVd>OGLAej}=FDiNENzA7U8 zLsDxuf0xw0?foLL5mnzMHKHddUE9V!*H!&6qHIzP*b^{m8@_goOHj)$H@_o9DePip zv0slPXXtdAQBgw*KQEl2`le@rnTP(GMgD`g+z9vFmscQ>{Sv$>%(LOU$ga}s6!x}a zYa!$SiEJ^~$w*F+$nLe?Lp2N(V&a(bQsPN;5|qH`?>Xg!CWvcMQ1dGbEo$YS&)`=h z0p1bVCE#CfUusIf2|}re3%iv=1$P(;7Gs&^9)BHY3U4xZ%AoJAr&@4jU0kTiOUf`m z?$Xyks9C~AF{Hdf2<;u>v_7-$nj$VfvT8(10R=0A2^&l=ae2C?P6k15Bbl{Kpxre= zw=aA-Q>m8;!Y0V87Bm0uRe!tw-K&=5;{yV<5;j z()8wZ0Zg;1mj^$9x+78fj2BTP4tAUU4z_Z3yeoIvFw0i zx6kXFHP0D#?rhP9iRo=U?p|JXX3R_$3gAGtD@_V(_E0zjdR#AgeJg=c$+Fv zddCLIBRE*V!xE>UUACW}qAj-?O4nl2YQi&q@j-EgGz4*`2ZIa0$!;AVSx*a< z1~L1ip&8`BSe=W^%!OJxxV_q^a-%^qQpr3UtXuF}4MlZPkGH3j{KH)}soAB%cmXGB zY*PCXCEk@+5?;lszS}`Ls=Z|-LSuPUfuxjpQ8r$MS1ymI${HQ3fKe!FY*aC@*X<4A zoV^+l>^i#;4_iJ;iGFPPsBXNHhml29yy-TIs9v({vp@QlO?8~T)(ykgc~*m#&aIsSQn0H*iMVgC`Ys$%NPoCVwM?vf08SDU7~D) z@68rKpu>Pk8%*~PJ3FqB+0t(<1VCw9efiPNUK?1DJrX1z3o<0-H+d|wU8Sln9etBJ zj=Yy_2hXW(<>c7o41he0*Qc(=md93`9=`K)V5SjH#iH29alT<0<#UJ$6???e83o_I zn0iJVit=L8#bIi_!QHc>^P!I+tQS5g;cfQArQqi;!V7HTfv2`$$(w?GS2=`eWSKrb z+5gCx_4BPp&l)!Z`iV=JhllSi8t;xl`kgM{!KLH*4RdX-h#H`Pwq>8Q0-qN=0hC=K z|3zbeSKW}~!^$?~4;q^XB(`srM`y|@U?tgkFJG+TW|F9rvc&|fWw(FLVHxwh!6Vb6 zxp{D^e_GZ|Lymi;6hzjULs5IY^4~>vsCN^C!KNwc4L3cg5DrLo@e?ae@deSILG&%G zV{!r`$Fha2mxhqZ5~a3`-m#Ufmb8T+`+9nM=>mFUFY;O1b`9*LlBi=53-VM+NcV>{ zLhta4BvQYSbhulmpH$hugUTKh_V;r5kl(UvRQQCN zp;1h4=|+f5Da^t4ppQn`H2A!#wt<9jU%6WA>qDKKM%cEf4Yn}LtImT9q`?UwoC$zu z4mQys4Q?_R90j}K=qcn1(%^|VC2!n78a(FP?7LC4hzH)R(wp%-G!?{~ZMz}yQ+t*E z1coF&3KEWgN^j59(c2Ufe(M-&D`w&C2uBO{)0E`_=Pw76*nWQ z7`6ubddk^(-_{XvJn&}Ijz4&_9)5vnC&kSivr9**a?PAMDw?n7^`T^z+69i@%{~Mf`XV=-E)h@lL^>ZwC_{-zpb$6r;j; zZ(7MS=macrO(24Q4T<0Gbh??=nLjy*?usUmX%0P+k{KF)XoctXv-7$ny%Viy2*fCr z`9+jMBS|&Ab+oPK)H|51W{m*3J(R+r4F%c-s>as_FoxIHPu`1S_Y#H&zz4vKphqAco*ZsHF;NF(^!RNOb`49h1ZpEnTflGX9$$AiaQKti z5sDBfVsw8MjGlKYqovPtGLR!?S$J{Xt;tafzDMk%x*Yn!OLe(K1k2VBl+Z!B{K{bm z!EO>1y2i8xTKCK*Zy)?@xe)F@* zssD|i4g9YS?f=rx2L9KE_J8ST1OID7`~T`^)9Zitvw{D$q5W4so8I8x`q{w$+R*+l z{cPY5Lt8um@&6;}>=)(?`2Pbs`-M3Jen4kiL9O9KOx-Wf3ci=kaRlC34hksQ`rh5t z$Z_O@yluyDkhhIZe5aNeATyiuZvVQ%eZ3+$q6hkTz?4U{%haN$plS@nh+Bu8O9>j_ zTX}qE#HFUcGvY+o-x+aUGE=pd#0v5UMm*`2vyf$Jt1&>ijgT;JSl^D>jVDby+&g>1 zoaA*(T&mBvKJ|rW(72XqerEkBJ+#4WE?9^oU`C>!WU3Z{rXn6?3l8D|8b><_B3%6r zjaRU-$WbS5za+W@LF1N3tyxbnK+t%WRkMWF`|o=PF_vd}+(9^65u_AaH&VxU91Xxm zIl}qLqalH|`N1a$8&stB2kwAyw5|lTMAx_$|XkobzI2uBu5_3^n`*$1-*Y6h`4S3+uo-F^)qx}^}6YKwhqhT=oGmaKF#6Lns zI(YRWcQgLx0Y@{~{)wYuVk_?Hq-A_~z|r`fWBdKcjUzY*4JmBhoxWbVO$aY+JnWnU zKwIam1KvK)Gg^PxHRck&n%u64TOkp_HJC@FAs*|IqzLXdL1|V7$6dhgF0B6yv}dlf zOKVgN&8y#!xG%TrbFcvjO(T>4j;3kSfY7vbcmZWu?gun&OZ*3#_ExryFWV>#gr>D* z!mp2&#;TJM{6y0L5Syj~@mDs@zC7q7>ThHkhSvj`#$z^6US3Clu`!Ai2Kh#2Swr!i zPYV%=u_ddQC`Od@_g!aS5B|-rGmQ5#mJS}u6-9gwNpV^^_wHBkKnH+asaCmyK3Qwn zx$`9Y6M4?=J|ZQZ4OxUB1v?o#qw4Cu8V1;pon^wZCbD_{-*=YHMCUo~=1Jusw&f#M zxJV|UkC{~Ew_9SZiFH83A8bSK5Fg)>l+FGW;RK3~``uqBbM`V7lXjeWc8Gm$SK(?> zK#7~jA3**seb+xI@y(4=ky%YUzwhb$yArQ%^<^(D#XJca;=q~fFl9SpBpGj!!-v89 z-!S9Acldn0GqSg0$i~22LIlfQ9OH)i!%(4#DUJP}I#7Vhv z#$0{tX6y5dIzO>WF}i^@ZgM@`c*o0sPr8CJpSRAt+$v_gyGqe~LV0pQnksJ3atla}$AEpruISyd@=X5FZ#Cx7ByZNE zo+v@k9K11NSd>+)4x&4Ja;_O4TC+RWtdvvNwJffd(C|D)t0O|3BPfo8TwINWxvH~$ zk~PbV_mg>UWrrG`WWdn9V}&_6VfVOaRdpqbs5TX){87^<6j-VMhrPFqsyc7`zC~07 zq`NlVNJ&UaBi$+8DT0LL2Bf<;-JJr`El5e1NQfex(k1x(H!yR~I5X!p^IYfL=Y6j= zi?x1h+;8UHKKAjA&p}#5aQ`^H3uKA^LdP|}cGyvI6Rf3-@WK=`!9jM!=sv}v730X% zIDsnAzbeXPS4&*bM#&*eNr@-|`G(DmX1JJS$^n#xSqlu74Gluth7aks#qdNvEtCYP zd4dEh$_>@83YM&&jh3yTZHDup!-<}u!+mn1MmFondPp->@X%ADWnRzxeT68au;u8v zLgNq?WnB_eQIq2J_1fp4mMG)7hD z(>r=!V7B0t7;&Py)3<{O2}L%#NDSmK4mjz(2j7Dmmf!ctXz#vxBi|)V1eSMbyoeqz zOaFCf{8CMS^eXIQp(QjleyOI$8Q@c*3H1k0p%L{tXaMm5U3Nr7x{w|E=!{Ghfes|#-$UUZTmY;I2dY$!&|cvRqhs}LeMSI zykahLrYiGi#I( z&RWs+tH|2r1V3e(%#3XiwY-X~*+@+NPGl_yt@X+dR~}c*DZIAB3ku(t(t&-s1sk~q zr*Xy;6lP5tG#R=Swv39u-e@Up^c=JnSar zwmgAt9P%(*{Zc{)HuB45{G|t|p@YZ~P}MK|X6G)KacKFApy8_gWxa7-{-Ufv1u9=x z^Y=ei{-P88vHYd9cwPQ-3jR&`3+R4<|G3iq_m{tb?icvKS^fgLU*P{{`3vZNfs>H% z|BsZvWHf(U{sOvR;Qwa%3+R4SCZ)_e#6Sq&h%6D3lP*{OO`?F2105G z+N-kmIne4Cg87PTwBJ_s8z!Tyh)|HPmHn^aQk;CcH`K&=l0zw;~^&t9%qibOh#XTX*;pb4C-i#n!R8)|V%uq!0jC7&s)I?I1< z*;K8`U$wsv=XLg&3!P(DU_uQhuoK$*0?cqdSg$4c_yKLGZZyE3$ z1zs{sqYm^~A55Wy`|b+L)9pIejksvM@KlKc%=gHOE@#-A<3YvTngNN8i|wg#>4l2> zVQ`!&*^}px4~e?b;%L*(H!VXCaw~Y$q{p0bbBIrV1G1?!o^-C9{~SL0KvgW)&kxN; zV&7u5)(_jT%F}nsje;tE5lqJd%^sK)++F~O+6U$9|@+mdPKZ0R7S%|DHXLF!a#uV$E$T2c$9-fDC#lBmwD;Z zCcfF>b^MAtvtje4pW~*^f{I3Vu~PG@1!g8XhGK7Qq>XJymQVvkJBnH72#k)96M zV=p?Ggn=`lN;)8?SDP(99iDm-Cb~y7`Xs74y}CuNb!@C$nyl{l)$u3$$QD=gThCOW ze>5spDg|^?Ih%ckPoEU7RTW8Q$fB0X4jqa*m?+nLD8+tf8^eP~&)Zr?|0=ETEUVj2 z96G+C%lK*&wUl92J;cPJVh^c2jqorU%<~Bt<&?;@s!%ul$_xi4d3stGqpkle@X?hS z4oq@rrmgeoRi=%g;X2b6_$1E$AgJSrt-&awM7TVQDF7;B^;!(y z4R?mYX6oa+pP;rmo@XXjkSdL4hM8}sL%P|l;elMfX-4X7pbPd*^}Bkcp6)g`Cub*E z{2pS@PiCQZ$^JlQv2=1Kn?>f$7~gz$uji@%B8?M3X7Q|P-*IRJ$SigrZObdG5-E%> z$t)P(g_w|<_Ich*fr&+{&W{*7WgV=nea@;Ji5;GnyjS(lk4wFXuqUP!_pT-AKBXfW zo}_}ArqD~eWflGE$QoU-Wf!uPIYpx%73itgtXWC*T$Y}_sIJhR7563AQE{Yp$fFx` z&7X4g6UDN;35E)&EcJLK`dPSl#gzH+8md>yK9WFp^>O_{@K4J+!mpQgN-F5GZu!%) zKGiITXnzT15&H`4>Q+DR>U{^mu3mg!cOs7FL?{=OI__r5Ho6VP1R6!yDp4#gB;nC) zH*IWul8Oo@$}QJ`Ozx{r-~ae{H%Ze^XDRnRcy&MHQ6Lt*;u3Nyt1123&PNUij_-o| zx})^zW&OKHb~>Jvpi16}IUr&AS&XL*Mf9tIioEtkf~oST&syQkJj1DN%GJbsEB#$5mWrB>xb?OZv7f8K9LvJNL5noy?z^Zv@*JD22+QpX2>}t$Un2_1p zLjtpYG3L=_{&37I8BfwSUX6LX{Od8F&~`oMji6)xms9?E!Y`&g_*dM!TRc*{mt!7p z@%P6(r7?kES8>d?u+iJAF>f+-J?1-JP|QGlkprP)zUSm>%ria$#(do&v{+UYb>rvI zIwqUE_5)~xYb}}re8eztn(muu-vUpqtEVMqn~p$C7!_nnzGRPd;Vo^0Z>** zJB^hrufFVOI7jJsZ51YUS1q$7Xv-|^;nYnWXv^$X4&~LVF8!-j9WD4I_7|(V<*!zC zFf_s5B>Ib8UFu)EIz2bAs|y0VI^E^2o^Rn@2(0Ske|A;J16Fm!&8t;?o{8qdd!A|1 zH?9HE`np|K53K6o-_*+%QLlG(*>P2epLX?>!uO1{zGQ-pWP;ObV+jgVCJjQss=jVi zymq4{ztv-8E1c{tQNl=fj94xkE3m55hBh5vuj*niChu;05_~@YIz6r5&TXackF@?u zpNONl-OphX{0f<1qG<>C1dWIz^DKiSlSlJl({=h3siFRIVOQ8%`_;n!pM|y1f&c2l z{vY1g!GDR?@}Gybfd3M$3~qcFz_##x?NXcZufy+=%L>R6{c+M~41)Jg-HN7s!-%;r zoN~VmCPs9zm|qaUoxLM&Ngd>Y)wtczOQ)xeTLAZ%PhhQ0As1xEw+@8d2j7Zk>8reZ z2}QaX-S}zHV}XMvyfPia#~)>+`not$uW3Lhz3+{~CU`xkCtbMn>H&t~LWDfSy^I#w z<(zsK9CJ5LlTyoO7X$5q@vd6a&O*^Z6qhvvbjNRgMDBXOqVX- zhR`wZX^s9$=FP_%iO1)?x{1LSSw0d}H@#0R`V;%OO2&$p3J-hq?k&w!iaD}e+;BVd zhWMG|hax-`$V)8t+N5CbTInWGI5FCo%4~6Y3C+i;`v07dqyI%d4h#**#X|#fWj_Vv zEYJAw4_yZ2@Y?{mOJ(`b`MCE$KCYtLP2)-C0%C&8WocacD&a2JDH9nVZDRs0jaRUmbg{W9pt3y0@|7%K_YIKcm!~dedC8mqintF6{Frc$ zI??b&x=gsgWBCdOBJOcUml5|8T_ECq!#RW%`6}Y>OZ?l2J9ypPOeB<3`Lppj zV;~;K`1&dy7u1q|j2P6Shoia0`1(2?w{G!!@i^fd;H!Kbx5|_8g6n*o1CWo)#tgc( z69nYr6img;lQt26cw9+zc_Hk#%$sKt4Ud8_os1;OmGGeh|D$Uz+u{6mJdWVAK6xYT zQ=g-D8=GH_dFYhCoc%|goW<>8_LBiy{!;;4X5-+RZR>T;jkT+gTwT%chUEUnj2!qH z`tol>a(`n+4*cJMzWgF12mWtBUw)C11OHp-%XLWZZ_LPnFQG60LrCubPe!ht?Oew% zJY_Jz) z+{>F(Plt3HBKSwhJ;wF}iUTQ#l;}hs;D5W;0V+C6qu2o*Kn#wRJ7U;229HP+Ow|Yo z0nf|XM)a!UoPnBpp9Be}pFFOR{#{>EOwe85BXwo0OrwA(Co)ODQrvojm7uw#(ib(0 z85vxDOUE>9T|YM9qRdhc>i~F6I?#ZFpVjB`UI9db;H_tF&h|h9PSQn7_-P4M&Gcmh zj%^$qks<7NF<`tRULM%y`o1=gyPD(8&++;9$^etqs1abY3eH?HSvUB-W~pDD-EvHu zJln!3&?S|*X0i$}>y~IlLz%4O0FxCj1YojGbOTIQPaEB@Bg`^c3Q#6%G{9sv;>Bxn zCvQ#*(SEY8W&=iz^BItcD>prdo*FoM=;G_jKT>hoS3lLD#2G-32H>n~>^n#ETG{hr z?$&d8x4H8il9g45UN{n1a5x4lnN*eVyBaUKG(v<}lbP^jW86rUuGIe3E46>G7XK}m zx!avyS0)~w$lXYe*iy5prO*_4oPV@>~} zD5>*YJyG-}t5vpQ^odEg*!?l0dj?Bfgp{8MB!-GBH&&mSCp#7!J$#QRk!C{~Jet~u zIZ5oOMD_bpKyRer1Z{$Y=Cu@1SSY3gzSIK7d!bsuVbL$8fKIEQrGPd^2z>P~qyRhX ze=@K!RI*1SP>?v3k+P_cS>!+ z*OEW$qoQW-OUYm5E>!aGMZJ{#4=e%6pCr8e-Qu6o0+eX}lokN~(YL?<b8Ha z1cBSFzP-ux@A&rrDJ|eWvhI~_f8jl;`_=Od@#5?B4FkhRRvTdd(DRS8ogOw8 zgU!Uxi1{~4kG@wrG4@-35oox0q>*osHu$``a(^#T@TKGKfH;;5)T_XC1~bl4$YW?j7TPW$AVk?T4aUO%)cyS~rKd zqtw-c@7+~oq(1PP?&0$Bv5BD`?9eUkWZM9UGeo$uZpbBZ=KjP(Nwz7Q`ty@Qt`t@vfp;Rr03`6(W(JAgvl;>kybU7v4~`Fj z1fKSGq%lC8c`iPnin`=l-i*2)F#USYWn>193!n@1vM)S-*HUFgJj~JDWpz6h&U|y^ z!Cp|T0nzdW><0s#xsYHw+vy-P3bzcP3D+5HfB$L0o}^j3B!s~P^njWZFq4ux@#|hX z#8b)69`2Xj0=jK(OI15(UyZt7xBxdNPc|0zeIX>oAbic(mz(SpnOqw8#yFjc6>q*Q zB`@NEcdP9JS+6(~6x7K&9NykY=I1xojz`pR%X) zChxvj3-=?fdm&ox31>LmQIToS*^{Oqn%#j_&w)PL_>E%T)_Tsx3QB;u(cC>k0Ar8_ z+X2d54QHhoBW`+(u>&5_c$5+{XcOH4!FUK_121QVqA;6I2T%x5vBK9PiuxLb;AuAE_Uwh^kzTcO{!e^LZMbXDA;(`~@_k4517X|?qbIa?EO}sLe zJS#YTAw{6)Q&1b$OL~3|VCb%9v=P4KO1=G@cci!4BE6i`2-wF_fqgtoWOQ;_mDgLK zhWjS`tOc!rJw51i<`W{K@TW|88QK1Lb^y+C_7F-~?NEjlhV%1Sz&&LM!X@PSlGQX?C2!+>6>w#-`sh>f(q~L?n$=|&`?cs`RoU2Ry{J7ltR|`p1&~%n%xqxI zX4k{?=Q>>yIbNN?XYyN}Pi=d$t7FxeAnE2H+MCT35F~C8D~vltfE$DhBL{&|1W9TX ziM7z70&Q;hvS85k{(Qg(t#9-IFs;Xgtkn?$1D$2q>&`dLLmlMHtEDp6SVKm_?N{No zT_mF!S2M(2_8U&m)B|FunlXvkVv&fT^M)3oum{R8XPvvE1K^=W06Y{|;)|W< zTX(hM#{MzW#~0oUOu#eWJT~79T_(578{$jQ5-#}3FrZknVLgy@Tp|E;4#w#pwElFd5i+$2*+*F1mQOnhF(>B zi}Ky)$$OI0R!=R6?`E+<00LOa4slzOX`^bA%*$nOf{}7nOCz2@XT=WpmviB%I+h1> z4D=IhRa!4~ka=I|p0CouM?RxLu2hn^0TPf=X_n6J~Cy`_y#3s3Hd0^Z^XnLYPmo$ z+Eyl?T@8AiQi?9f$rCSZi;>axYmU+%rC>xHzP9K%PMP&L;1&x*P7u(xDA+7CoM*?3 z*b$n@CcwwbxaMNS; zgP?tp1S!?sDf>Itah$~rwVSU{S7~F_-n{!dd&d{u>`)B}q(TBcccFvB2LQle^6HM& z_CGL1S&O)>F@8}3Ae{^od$&dqR?>x3AR^<&Kw@fj1fzaGhDsYWVxtG0BL{b=#1bQ5 zT|cxB?jb6YKo zycPcG6qrhq(5WQR!kknA&^Sf-3+lSj_5ycc%VJSH3jrD@9W_AX908-to1BUjW==^2 z-r2vc^crK7dw&7ffl_X*?jN!g{Gu{5M$hprK z+V$zxKwOigRl)8+CPYaSZYGksZp%f>fMD$HPnZXHSB9}hE4ZZP@FGQ8)DLI@W;Pa| zxzCqO+GZ(Ta7l+-q6>Iruu*$+#3b>#0yGhoE!EtUe6QGmaucTm%HvdtkNT*!#zXI* zYJ$`Zu_ua)+kf_W+iM@RC$T*|B%;4xq;rDfJlGqYAqI{^%j0Q6yd(ZO)#XLLeJ{Y{ z)PV9hAM;1U7TYx#EL!LC3*%#E3ku?6D%a(x)aYb~k`7ND`pDwY$f8x+6BD5*99@wK-d&e_qLZVrD|1vG zZrGn^0uaQMnKQl7u)ZxRwB;`yjT}F=TL4L}X2g61Nv$@W1v%yG`{O(2>pR)AZy>W3 z^3L)waQO?_(NH+Gemk|2>d4q9uqbT;?%Gu@T85YO;vvL)J-hY!;k%nADg9s4nHSTA zA%dbH9*CtV2noD|(D9YS=D}TDRAv&rh^C;#CV=!YaN0`bHJ#x=QC`}Gi<+$^y9Qem z{roQc9F1IRV2f6$`6Phr+EOS!OKKv`HjESJ!FyuVxL%a@LUrNB<;5u&#%5ftOIp`6 z+Zc`4bM|L@D$lu%lP!|>eANM>X2ENKsA&ukHEAY!PAfJ|0HkKaNAh=2Tvu3f2}$3P zfjj90T8(+jL3UlZMG#7GECkU5M8#G4_*e+wT8H4QYR)Jw#}4_$zEDUg(D{Awt*wtd^{wq8A3-2IIz!VRHXXM=*mTq(q{JXRqyKT$ zabrGwmDR05>C=Js6xDGwu!9efK3RnF&+BC z0PfbdQ<02li>ZRVqY5L0&>zGB4pzTo7=5k~0(5^OhJosjgpAT#8d}T3o&NV3^mhAO zs?XAjn>cn71{ZL-G^eK&SP!hp*n6k=CXuY9@S?Lq6T3q*B2dnn6T_hh4ur2m1m|l& z_lMc;z<5h{<*}H@z_^u#t_3Oe#6X~?p&IO~-5cv4W8TG4@UEPaNx^{w+>udT69c|S z%YI#LboEG@8K>M-$F=8OIc^%+*=@=8xE%%}}FDdx# zqF!J_1|Ne+(EKWz;gc;eQ3YUNppO@4oCJsk91+G2EE*C+k`#04kKS4|lQHvYo{ziU zU5}9s3>i{8@2@bBX&|b5(?n?Yq4{+5i{v*AE)`jCiGfk&{lsH&+a5(n>W|gLUyl2n z0X%f>F5{MP9YMoe%IGOoohIeyd{e@tsXchOn7Op{tGwpoau&^qN3t!tkLwVzd_|EY zt>V!ubFyDAk3gNi0Y_YfTqw)Rq2^)44c78|O#>=r(WDQ*KU6Kg%QNjdnJ~aE?mCsM ziy3Vrda5KLk=THw7qbwuB6AnET8r{7xINVp4cvku#bel zCoCO=L=%J!zU@NdF^t!u{_$1Cr|Nd0p)6$`c&2tI0^*YsyB6CRgj?1oMsw?#T^vmh z4_R@(2l1bYRwUdVpE1q{8ncmaT~Y-!4T+S^mZS3P?*TV0wOxcDsUz9Y5dvLzKDKtq z`XkjxEOgtdu&dyS!VWuq;AA>bCn0gs*wk3nN06&<2c~6d~Y4*U0WtZX9}^ilLVi3{|_;hzSfz`68)lK;HPpSK;352y%4C| z6ee#-);uO9f!1w`m}7Bl*HmH-ydn#~IxEt_xVK?$cHFxA+K;Q7;%@m1csi<+D!Dpd zlJLlf`tlr$y!w)bw|5ibawz-leEAde)1FzGxbyIRX}406yvwy?EVv85e0zbwxr7a{ z_3Z8^XM#wz>J2o3GSzAVkm128;$H;rLuM}bKGR}*>$JLF78@_8BzKxnQ&ev*+Zx18A7zfW(KlXhZ27m_pYmx(G6b z;t7L#Hp}A)B|Atv5Gd#6$&jy~*1;^18IQ|RB-sMYBgvLcxKoj9olWgZXQR)35a|mc zwFW(akQjroZZ^t6BG^G3V$pQZ!VPBUHjqe(DtV`RCds~N>z;R1lEF>ftwE|m0xl}3 zUqYk|LbF7&&U2^J$`VIuzbJo6X6gX09!Ws29^G#zgWTf);iBQJBbJBN%AA!@_q#_Z zxv3XJ*f~JV;P>-!++{u-#T~)DZkzMR%`j5{Z+S$bgsz?03toBR&XdKxTQeJny&n`| zjWii&C>Kgo)bixF0S;7!qp(hFm3eU_kGjA4{Ft@ecS$I3*;I$11x3y;B+s-3DPd4n zR`)K^`rwBl-ppWFd@Pmq1X9m@4OaSF55_88o+i=su$gqEUrIUCVb`ymM zU25@Af-(-^Ei(*zikB-t%`<=(I}gfnXo$OSfEOZjD9!>!If@MeC`Wb~tgP(fu1-!} z|I+T^h9_W#_yi- zV6Z5zJO9-2jpx;&k8g^g6B<#p9VMb+Ki%g4D4^6GAT`O&=*2CgH2-KVSye`>pru;; z^ltczvd?H5&!gD#>KSUWV9LF-vgk(iP1MO z@6gCCDiWgx|*!|3!nji@e0D=nlTC zFqHWV$9*7i8euC3WDfHSn$>-l$f*|PwKS%(fj0!50 zy-;j)hXsT(ZOa3-ZPH>TZc24A-2={dLF}833kXMc>BeVka^dtlri;p4@KjuKO2d}( z#BV93KBT;u_6ULHUIsD<_-2i@D2q=wup!bGPn-`F`wz@eeDxmcG859Tk|_OZZHX5* z#?15Cp#{@!*6l;f2$e))a2C)q!t8xyid=aH;j-uB>qhb8kHWC%$TXS+>Q=Q8j4R|x6CFq4qvx0%krtBC$IaY4+;m)kEx-; zoSkDEE7Ex>4V_&D!5rUZtQBUB_>m zqcGMJ$RO+&-4sm1`*2jhQZB<37T^E2C3Dat(u(S)l@p%c8N0Jlc`9|pggP9SWdlVa zBLLxj4Ea$JV^Q`aOy~o7r0PbHY2>hlm;n%8#22d52HDs{kV;Ju7MM~&bRD&1--nSe zM*^}>pbk~vn!Eyuya~Uhb}rPo1%GuqjahioUH7^$0i~$>lztep_)sdzXPB%TYlwxG z-<_EBo84aYm~Won8BjmSR%Oek@i2m;x!zsIDDG9#nj%hTW0J7ra4kGy0f>F*`0@@i zl?sbS!1Xyco!i6gdo&up1-+j{n}RC%nH916A13;R`FJriUDbS7Or+*O zPgXgV9bmuTy|9f_ndMIE64bXa@^3YUJZ1-p1GeEm8_7Q#$^VTTi5xaH0ur`m0+8Du zPre0AsOy}-k-%q8=|V{RLl7S7pf?xjS903M!%I2MpwKG=R``+KJ$GzKzx>Z~nsS=J z0X*~xuDX)^P2?69{U@bMJ+BU`Y9u{ZLFt-EgGuD<~8JMwGi0*(`sNB zt-we0dA$*>gHXGGB*7|Kx>(RWdh>hHaG-kDVa0fX1vJc!9-!$pyt^@7)&wp|C{gZ4AzBiqrY+wI;H0b}NpGMod^%#IYFT{Z(=rMiOo1S| zf@r|hRhgusJLEh98r|e9Q-g!qRQmBUTu&yca&7=73F-GslVs>$Cdn>c0JJ|&C#`aa z=~|W2^HB7-eW^+nqe4}wKGa{TQVNT9SE|%J+;3H>@8AwA46RF9Do6hJWU2pAm7@P( z@xM`}!2eE`ns286l`3VcYhgQgtxEMx{6|zNz2BFm(EYDvsb-Qj#I5q?PYq140dG8L zHvHdsh^tL*r&}C0wR5}Wm-?@{!1Z+uRzC%;ea=9gZJ-n3d~$j?2?$k%1jpiE!z&@D zMj$01IwETfDD&~kUapwy7bZ4$SK}9lWjnF)wolinQ?a;SUEU?p3uWrOgsEX$5>n!C za?W13jVH_E<>4>8k;YY`$lz}+hgsrbE8ri7HCr_#47v7|9(A(m~R;ay;c0|BPWc#{qBI#pI6gbjB1{kOB?zUIHPxxaAX`px4bZ*e)_TD@Q529WQ%S~Z@bV0yG? z7kWm)P;TFnyrTx)Gt9|v&% zUqIb|O1?h8{SUf!|8wzixtaILy8!pUKCPaQR*QqRD_Wr3pJ{70OG6L`WJb2u%xVRXv)$B1MFk z_G7cxw)kLa)oIZY>I7{HIzv|3X_E2VL`NPwUstZ73ipG&uGr&ByTasK(aCuQE9^Vr z^HDh)vW?b{I$=`w0C)-#o6d~C9j9Zk6jfD8qe}rKN&^@gl#oUZU}y+KzG?tNV+sPV z2@DPPQxz{L9@JHPe=-+Gyl-hVp`MEsI|URcWKEK!77# z*-}5|v~cN!!=z169t|=*jx1Kh7kdqm#cuN!S+gi2niU|6kp)SV?j{=BvC_=kxG&;j z5pWolpXm^w3iV8ger1{<3nF{S8SXx57Cq*12d-5^wlzUCoQm}LikOcoU}JoF(X-CK zNn4=%U0NB62oZ_Fgu7|DkG^WcBjwlUe#p10pr0ix^Im}hydf%vAWE1Rh^rxpOs0>c z%{Kx=7h4&@K}VoD^1Y-I8qWRqZ)n%h-sI5dQkKW3(vk;yl&>j)V&&*vO7C@vD!D@gE2B-GBQHlWlb1tmzRa(5lbS@RRY{n=)Mi-Gn2fua~OMx%2 zu9oUx4cDR;)__})xc!l8!vmXi>pJ{}Mti;#IYMK5Jd!VK*GRgCnA!XZw2s((#_D9Txc@KQ``=Gx968SwMu`pT3^Zlfe?n9iiGSdb8Ny(_6Z8>y}-A=KYUmC z^wI}suMqyk3Nhrn@*gn3AE_DJr=^EK8MbzLh6^syTPziIK7SZY=XC3-|3qX*y{3^s zgdJA_%8cv)DTP}WuQSz!9eb{RxCBn zMe$B-SDY1!?Ui@cN$^cw8!q7t z&sB0#dF-mandgEJeAUHga?dBCm-xGB`59CpT3r@_U_BXIZ$=V~ttRV~vTqK?;f!hF_A(gw+;SW=lTt zYq(m^KS=9gv3p%zmGyXiTErrz%Jmh&WE?A%I01VkfiNlYp*uS<^rAA>rwq>1@srO6 zdJAjsW?F_KL%t;!eHd#V6Ot`X0q~Wjck~uvCYop=_a$Bo9f-yu6QG_Ek{mM2fMZBA zE>=XLR`$T@s*xMi%7!$`0kK_TYd24>X)y{IGI(Uxs86o_cM)rxh;7nojXEf;h#&$f zxwJdP4zfj5rDM9&Bf{k8t#laP*IG^p9}#k8t#lmHmIQmHqDr6)n`__{ZV+$Km+L;rPel_$PDq zPv+{sm$~|GYMc4T3K{rPB5Prcx%UaTmBsUmA#9ja5+^=0tKNb}Yxgg$_>7j-)nYcJ zpr>!it?Y})Nk&TIgd_pIOs{@?xNh|@3eC+0m+`$S*1olzC}7yXVn4S3x+*@9H<(%9 zR^Gl{z-v!1i8=K1K08asw2F_oH$Mim zcKJ(m-s~EHu)OOB`Z0YLKtF~U+K*ue`Y~yJNpOv-JTfo4e6MYPcwa>l58=gdkOkEC zUxnKKL4Rob2eLwKfABAT|7ael@1JP@JH9^+mu?K;`}_Rb_b(Us#mVb9qWzcc?}zmB z_BQ#G?f>o4_7}oD0%hhu!2PxD4+hFJ5@D_htRt8zuAy5{5IhG z_ne)pTK=x@|3n5MRq$cq1H!6n+aFi;+V-D`ZC!1#P%kDExw8EQ<(QCju5JGzDl!|e z6Q1)geSe=n_Wk|*2rI69e<7`F-#^&r%J)|!$`Qeg)>>qLw_qe+3!}NQKQ_7f$1wn` zw96Pk?TgbGgWt;m2)%>m0G_!Mm!Dtd0G437uQJS^&mR-WWA8o=Iox|dtBPx)G=N>* z!!BUKXvgT;aqRWJ*Irhr$oaXWVE%kz7Z^$ST5cppIcOOUIN_5%*(>K^n0NA^^8?y;X%hCG~I)n(%q7LEl!=l)qB=B5ZO z@bK0vdcvtJZWF0)3G?xfec{nl_o$9Nlov$FS^ucATK~bIu1l2x+2PX-v6~^u#zeIP zOSbayg;S&tA@aT;LdX+e5ZccVJXpMQ_$x;ZTPvRDgBzw1^udYrML-#bweP1g3=`g8 zE5m#u`dt0Fx{aqf-s!Ro^U)U5;kRX&z=l6xhLL;mQyGRCtlFCJ@Z>N$rIKM$8XDFmzo*h7nYuAxW( zG9Ue8TGQ9N*JN)JZs2)U3Dus1SzQs@#9V>dO z-xoWxpnaeaHnG*JV%i2hO53%uqLg&#Q8T5y?}~lfSdEeha;5`fXR8h{X6E=n{5Ak| zdFMqlIOy{@lYHY&(O^=FF5L)!BRRnrG!BM(6 zl6Rg#r`Jw7Ojkoc0TM1A^Dcwl!jIif)xi)8uEM+gXofg<#oWBc~0xJKeMs*%#z{&~E3}Q}C6& zqk#~UBLIC~>{VbE5T`)9onP92w0FY86%wTe@jpx)%PsZ8>J+8qwtabX?ezEv(W16w z?24mQL7g6ZsM90*hfa@3!cR^Q=qIbE=hEtt;r_wuX$ZWudKLpg5AcOqQYgBbq(4bi zje+hN06k5SuL5M8(4HoQH3(|{FsPzsUYS4Xc{u(f*XEBIMr2JxNaHWeAA~o5Z2kxf zBWqllKcuDC=8ve*wfPgK_$%|r(Zyop-94Y23;5717>h=#$gkG6 zgJNqEPVZ^xM_}F2(3d}eXdcw;5C$*tIjYsMla0=a8yT#rQ=#d)sk^Lac~1t zC?8EI6xG5(xz>FS-5+IOn;OC zB3|1eVrF>;^fE*gyrcmg(L@8fleHREUf(i1_E3 zf(C{SyF-ZdFp>O=*^8tn_@C}Uhf8;?Xn!meB!jnf4U%~e`HLW#uVGM-%qJqh;il6>XjQnDx>fUAe+7FOm z4xp&!*GOkMs!s0o3VF1nU^?|8HhqmOc(9SfgE;jbp4^}Z0c%=Hax*ITL|SErb4a9! z?6V$qL#D?@n7g_th^7=0)poC%IyKp-gS}3vwuL42h8&C>sJ&2*CbMMt28$j!ej9Sk zcO0N2{gxBZ$L;hq8c$+_R@`7?9=?cdO{IpJVoCDpZs{qFxTVvl!pcwGd_;wYj==47 z*On*Nbf@r2f6B2Vx6x=kL9yIme(^Ys6?qPFZG z>=jwW^!&S!IP327QWK>!MMSQ0N7*s_27J$0IQ64kt!j$Tg70xOxCsO{o_kILlsE-H zpP(EZbFvFL?)ALrofB(2HOPiPh)u}t^$yIE6+z^!0E&m*kG;3q$r)xox;J{|Mxa4n zIcVKF2O*IHAPk`GOoWcXuaSIF z{cn;8Rz=Vx!r!rGf&bi|^|!5A;6Jx#{cUR&nBq_ES%2G_1-^<`|4)0?-?nCf|J{)*d9r$O@`hQ{1I&TRMM?gYWqj&cpkyF0utV5VJ$(*h)(C+CMNr5Gy z7)b#J-f#{HI(hU3;agoWVX!Btktk?4Zr?z-f!XaJ;1-aM8-ap$`61i|@Bz8wf^f$w zm+atK+*nIYE@APz2idK*5rX_q;Ex+$NBfOMjjvJ4)+B z;^0%}-Z!F$i~FK^)R-_Y>(TkP41X?o_(5MwK+EZSpN6d0S+#9}{W9N#PdjhDe~Hn& z>+FVqrun9}o_4F)?px?kV-M`BZkQ!pEX!da)~%uo=X`Vb)&hJtMt0G9PLZo{^6i41 z2>fjar7tiZLQ_21O+3}Fof>ZMMWCb5?wCZP+hoUDj|&*ubbqsMCf(=c<1-|_4`$b; z2lWiSU%MN4s(GJM7xOZcjZ8f0uL)u=AWmPQJGo)^Dx=uuW}b^mw~U`_T<&>8rB#v9 z+XZPdT=ZCn(!=6AqNN9!#-%}Y(qO)76Ui^TM98u4HV;)w>#TIgU9veObIT-l9WuUP zd8-d^6&AEt+)L|LL$&F$&EOKVrg-8GSMrt+2bohYHQ4s?Oyb=8}7-I==;r zM3~rclxdc?Xz^gV5xp`oX$sDowm-)-)XMUka>zB6PUI&l9SvP9azzgk7lOapfg01| zCx9LSGxA6Dh@0g<(j!(rK~QF8 z*x2PwCF9J2ldeFN5IDeI-Oenw3EW>VYTBGI zuk-p(RNBn9>p{^Trbij^vQaPnsRRZzEl}>T?BF9_EnncWRKJhxH(l*ZRz24Kvh+eIV z&XkS!=B)deNuMkfbz;*CUDNaS_vc?MT+#F3t;yV+A)nv_%|qs_P%bf zg)4lXh{iQO@7TWTzL*8f{c$fh5tbemol0rhJH7r6pu1mA5hpdVixlx4G`*i=Dlp|= zQA>0WFIhh*;EKB^1`lxe=oKkCQ5seG5&wmhC?dT=N~qjk%2!jEfDz zMvZ+xgS}6X3N`SplsrpM82~$iaSq8Q2Vh6b@Jb^w5rg2@0PQG_{*rcN_yC|CeNZ$> z3KNCWj?il!Uebc-YCxuTUCFSxk8%by?{RE6TYfh8Le5z7L)8oVltm0RjI7zNE zsf=T?UDs1{>NB7CAgXBnwvYqXiy&&?=#IkW>zh2ME#0HxLq zgL#((uf-8qsa2)(Xb{^VvY{YSh)yV=)qF4i!=nz|gAfg8y%4_|6&jA?0v zEVRS9ReF87q$aEWaFm?upph->4zo`_QwBm|=L% zMUdEqE3t4362gAyEh0wx{ovIzu_z;YxM|B`(dQMo`8K=!*|+X!i>o@JA3qD{n;P3| zJT>e>vG%uEE=GT&8`NF=e3>I5vLn@wqLVT86pYuVYuCEN4QdMMCh$@ zZWHmesnkU++Nq9c?ei=e>tn=W_o6XrS z0y6|WTlgnkl=6AzlHbHrM%TjW58fX>CjN}J&CW|^DI2wfDLEW+2Ym6(jcXI(mgNSW z`pf;dP_-67Jec4Old^n{e!Kdek)Mw3p;pQMi5IT|{DQM>hym~$0tN{dUo1+QLP9hO z47_|(6a@kjz|RFjxQECK!Xo@4H!yF|+>j?BCfg7sNrbQ8O5Km7k=?<}Lb zO4zlpf*?o;NOy~LcXtX>QqtYsY!K=0Mx`48=@RJ{q*LieIs|<8A9Ti{ zd^u~@V(Dg$ANRiR>$-l|%_W;V<1>QNbPQ6Jx;mfF$qr|$a1GWt9zzf=5UJ}IW-kMd+b676v*#MU=#I~ibTO?xe-ZshUK#PHlUMxU@0PgYxss8qwBB<$Sd~#0NBHkB>@_)NcwFf^h;7Ziv=B@7Fh4;< zV6idTnG4BCi!c1m)qR)!!_`$}T)AC3D);F#$`^l!qHdf?xr{s|t}Y7prAK%fquPzJ zzM!iMBk{K|cN^EAVD3y~h^c$dak;=3TVDofXfownE{{sHj%V^dytCy|o2({jT*U46 z^gye|`TSC-M=P&kXha~5N-ZZ2(tzj$-jAI`YQ?IA+>hPCfQ{Z)|3PyyOi@jiP%)MqckWwDM4`f<|-74$Ml@ee~tygz_=2+X9g(G>x&Rxz_4 z7*ZjUPDQVcE_@oT!pgt!Tk`ER=lONcy$tC(l zff9)*2)}Vg^Edl zq*BUADhly^Du0)yR`O9C?FcQrzsNe*SUSm)3j>09OUx|XAl?h)za!p&jPxyL-d>sC z8E+ouKQrFg4t>8f-u8`egX7+5ul2b)#gB?_6ovA7(3^VG(5`=pWV>hTyQ1ijdjo%G zkj>ZrRz&5UxZ=k$X$v+Z8cPko7Vf)WaZ`$@0$>^V392MIgQG)S%)5KWsF=u1!Sb#U z{QHDQPTb)9TcC^#elOWV2yzIr3g%fUn((cg3p3CvkJ9{yO|O55t8*bjOkXj`>~K9A zpzH*=1?S}k{`hfELWo!NdYt&v56lroXe>B}ecAV2z6KXlV9Vh%#U{_^a3 z5q%ri0^4?VI?D;%lRe!sy97Eq0(vy95RHun)Ty_q^p6iJLl(bPwdf?!st}Ohl0$+!-I$^1HZl#opmw)4tHk#hs>ozE0?vELRJaPwKG^dTXuk-yfvW zEpp&rt^?NljA1~!?v?1pXfwqOel~tPqMU`*0^u+_MGZmf*SNvOPZQ&)9iy_g#&L_* zFIQv+$haBR**W;PDe!NDbK}pMqT8%F+TT4csB*KYkdRKQl`(aSu#kO~!&LtR`hJg>_3*wHr3l_on!& zP{@jDrh;XAKFv^roSMQIwIwpI$iC8;^^sjMCat})lI{jj#;S;uuxpd2X;ocn*Khc( zV2rd4UalCskSec*9eXrWY>U;rII)%}6IVxJ_tRYHVs;_ccR>7sf7{ zI_L?T$m8d`7vTrJXFnC=(9qkA(rxtGA2Z}A?FbH1zrdArLu@+tbR6~84R_k4H+wO( z%7V)ps{xDwJCs-^pFhqtVv2Ips-|$R#wCuh;}N>!d%ebrFSp zhe%ngE(Hz|ki4gY&2^AMh-})hjz>42+U`Q%Sr+I$9(_fix-i(2Z-*M_n4Xg{-o_s+ z9beA9S9OUcJ~*(+arS+yQNw<^X1EHt1Xcvl-5Z~47Yj$EVdt7f_k}VIQiWicrl9W# zMV40nHa)vp>3K*7|VSm&=$_?bi0KeU2cDIKk>L(bSs;)MYC; zqGQMHaL!rBi{<>XF9{j-MZK3>plJFzlN)mT+hvJecI(z-yut{DI8zN^k^8+f<59*sJUn#>|QpYXx{Gv;bD%T#~=Q z8u;9;BO(1DOWNyp{KXxb+PjI9L=&~}!-1FayOHDG{A6d$4~5i@x+qH~&v7T?mHB&d zU+z7HGI_19vfv}UWF#K~c17~AM+jr6;PPhbUaJ`eHMoe_JS`7VblHrpbrV8Si#GIL zNkln-Ei?OSHjb7+rR}nXYMrn;;v~y~@>BnOKAmuPbYriNl8zg2DmX~?EqL2~!qP72 z_OWmxBxk52WeekcD`vhtLc>uClc|?4IZdS|+|}dbS$pEnM`bQUEtxlWE-a`hK{=x* z2_k1iV!pkh+`+R|`#ATiV>tKtvFk)B@+r3S2_?DXbSSzvRgJGDo zfj8W=%MVMM*vTo+21cJ{^Y<~5&~F63q*tv$CmO_Rf9Vkj(5qj_$iw^qnb zLT&eJHo%U*jCz+N=sFwVI=Lg~D975f2K^~rtGsbY#>~_Vw z1aHg?&B%qAsaeRfFj=kT7d^%ht&11MX+Z6e@4;j}9=&hdti|xm5{r_-r)Ns15Nw`x zC~P!)H*zN_{yvcV@`bu9xu4Np=C4te8vAu-bv?j31pr&EyVD zK5e1+D@qk%4aJW1n(C(kgcR~_IN7c*_~$YG7(aO_NPN~?Wi*6=+e^l@%Vb!Tq$M|<>JU5X`$G0%DB8T zagAAAEwX?`Gmvy~>VV`jegN2)cI&0U3 zn~K-L0`NE-nsn)~$kpJ~<|-I0(6R&Ol^PHYAkEImJwt_n8m&Ba^MtwEE~IgDa!4@;9v^$Ze3ohG%ukTP&ckip%8 z0d66nN|Hp8{SZkcP=m;P0HP?e>xU9>WYN$m-XhWOk-YJ1;z#)7Rvy5a9ncavc~89m zaG)0e++rV@eYx<(6=#Q(3`n{$< zm&NGincrElwoz=jVnn$&b0Ls&CVYMlz0rbQ?XmMJ$EtTtwYuF`ExZ|Zirw{PIp>F^ zB0IWsER`s$O#vtGty`0~%YAtOx%6iCCGSYZ2b_1c*>j2V7?p0(_2>n%#j``FqJ@*oFLVEB(n9J1xSUDXWo|TUoffks=brUd z)o=4#9F18mCyW+7_=eN$(I8>#Ra!;OgI|?NtwBTo8p+dc+4X`Wdt|32l=_8+s9RXm zc}bmB3q!`-jHE2XS?a71V(!}DR4X)8m__m@bA^UkyT(L&wO$1PJS*l~^=@T~S-gtX z>v4|z`%;RB))pZ)(p<`h#TN7mN?Z{}DN6RJNQ@hU&wG4g2ZC-hsb1n6wl6 z|`52c#5yQuu+YWfjJl48;|q+JIM#b5z4*M?38u|?GB zF|*|Ms3rJ>PajKbtsEcIY<~~L28A4C0v%H%qGeu7IxBeaSfcE!L-UIVJzvPUT})t> zEV7)8A261Fd0i!r>O5sIxni?EDXZNLwuwjA5=xI0*1o_70&FL+)QX>0_B!mamq$o) z@=u4Q3TV2k2$-@`pTaRV8pv2X;;Q<+#mBhg6SptshFvzFs4JG-uNp=>_R@r#98tA_YN)V1chitj1raMBZb?5_tz_RkHNWMx15`sM z@`~69ebVFSzH8aW9_yS>>XtBdApe$zcM{@@v_hh=3F|W?SHx4{XntYhSmg+hh2-Mq zC`+}YiUvU}dRA{3E+cXR4iPJu%F}MM5B3Kf2D+7?M~kE429xEP7hFFS*@7m6f?{NU zjN#P%sHK4JSb;!t6}-gs>aOaz3a;vaQ#NMsZNuiKZ9Cr}o;`FJbEz{m*7?bm|G1t&kEmJdJyMJVGf~{g_ zU@#uAD_?(>m3mfAWP9KBc0EyP+yePyw-QmC5ww@R@_nGR!`~}Yeoin>c%WQKb>?am z7_xFoXMd?mi*Ybg(X_J7wC2DKru$Vzd+L^+#BGw7EC!z-`Z5mAm7hOKiz^eyBSVbL zHsr+{h9S26xSpyq@>K52hP$F&^sZ)@@_7Xi$~j|8r<3EVi|8Z)UVG}3#Bm69)$OUN z>pe8S9-zA5572Hbq2VNv_RL_C5zrE9>J0D14y-%oBaRX7e5@AKP9LIOM6us2__Nv% z_1Tv`&Qwn4JH`Y3U9P^FpKKg(xR3FFlXz|hry4@OKTJ;0WPcc}{xDPBV?fneO7V^o z?>;>W=@eAxpb%BNmmuv2dPBb@`L6?){oIQtBCmdrTegF7OE;u_tQ8+`Cle@1gMkDD ztfy~aj&5%+-6LKMH(O0Q>pzO6@RHi_-f8!rUw0ses+gMUUJ#}5Z*n6oCxQLdD>^}| z-w%(u@rn|*ca&C@GBs(I9FEImL9fULpl#KQ^B)*Xu-t_?Bw#)wP+O^!<0U6C7fdEx zx)2&5-FaGl96L$Qvm78Q>B!l$pQ&&}y4i7(*!cc{s8P$+NTD+>wR4C+k`|+X`(0jq z`k(?>Zw98X@EA;wAM!I zQC^(tQxg>iC_=S*^3uYb!lEEluoHyXvHnvtypoo|kl#23!G{XQ#k2P2&OS`zRr;6V z{i}Nu962#X5;pl2V$UP<6!V%1FiK*`)Fj_Frd66aV?cRQ?g~HFiJU60Q+*FRdx90S z=-S`ehPmx;wrWf3H_sY1xdbdRsZj>;bVfNioxOA{vy-b{>#I~>qScDctVXNZkOV8s zVOSZ^EX}5O*a|KErpq}V)$XWm=Wkd#eu`N0Iqt*{%Fgf% zBL7;CCe5;-K!d)mMAMR`UH0ys`6O}tn~MD7NA8F3$Ga01)GCKsl_mk{0<@X7<4uN# zD8==dJY?XhK(7^M6kc&_4YbZWNafV%$F$k5awTJujl8fKtovtgdq=(A@sdxfdIzYj zjeiRWiAwK{8=7Z`l<~k;PS>HrEdn8^oCnqx6ep_EeM1UL?Oj|^)X=S0k zD(-e&jW9o2^^yiXE`D*tEcvWhJgiw z$Zo&CMJr?w8-^CDj$((9kfUZ)QQ_~p~j=nbBFOr1TCBHwjn*h zedh9f>nrkS|GE@;9-b$yo-f-Lb}44nt@fk<^I-=$xY%&p>0BDb4#|+!Xu8ZtX%`!W z)n~CCp$yFo%}2eV!?qiM0)~x|BQqeO{YrqBV=;d4^3#YV_T@&E3q$Xos?axz2zfT~ z#MC3~`EHSnJ@D=#(hFE<4%nCi-EC*ti@EhUh4Q$T*Rz__ z6ctin`)#0X_riN3=6&b;Ba&w8o~vZC~?PxZDI{yG3A9 z4eX9O`Q^4cIT(g4ug5cZPV;!BJ~cbh=|FEOCTSGY_EgoX*1=M+-pQg!^cb*u+M?yWm8v~K4R!nNB=DppKl&%$&#Gv_>{X&Q!xy~ zHAH>sMV$N4l;ry=%mx-~$ZM9TbM{F?Erft1!7gLyP)%D^WwKFA&Esb29o&_qvU-21 z9@DjP&1x?6_+y|g6#aHQEb?0!ktBcIxlbz#IS(3~XAdQtJCNVt$(8#C7zqrBnK{Ft z9N-|Cxs%!E%EntFp`{gEv3ioX)|#;v=5i+IsoLLVMp}H!SgxLJmasl!Z9o`f=T!yZ za{AO97kLkxsX$!0?!>tbwi0+T9RXTJ;PqV>@uGG{**{W;#h% z_e(7*fJY{1UwXeGXkVrBv`1l6zFm1Hj=s}iP*BpUeC|WfyC^;AI!xYt3nE<2-04GL z)`yMmjQFnkyi6!Ijzx1XN2C!-bJJler4~d(1IIVo_kA!eperY~RqYYb0CPdy{p!two&s?`+y1fnuBxJQwK<~D z1RMb<{0dZLJQ8+a^$P>mFSV|C{Esep<{A*cUN6^%W0kt~e@t15# zsxSYm+gIlektL>wz zwTQ~nA7D%`J=Hl|)EgMHd^T+()hsr|FLi*g3WPCnO8~=XMZ+H_!OLW`-gEjnkjrG_ z`MDwnv=RrtsoGtxZCV>+=}h%6b1&XL%BK@o^I|FRGMGIjsK9g~$f~9uq}iy6KHxZq zEpN}LO~V*1pGY<_nE9xvrc4v;KpVp1LLT}imfmcu5Ocw+Ugzx;gPhKtxXKn4u-A4? z#eEd?O71ezV#>kYt=yM_?}s<~Oln@ew- zPc>9d;7?zFBha_wDLqR(&6t(n<|)bkT2H~0k_u>2Y?4K-azqc%y?RThGO&)3R;v=y zkR4)o=yXSw7Y?PC9$ezu0r6Auh7?MDQjjlUeq1&?oi+_of*z7+*6jxG6B6^)s~iXX&t-azmi zd(At}i8<}ftem?Sw#8R7))21L7;FulO3P9Nk3+lr&VN61;N1lvK_%*EzK;4ou0vB| z54~adQqkT#fI-NDgBPDY$uH0S*k_79+~yB~=O-kR8_?S|Py<~$h}sfpW}Bbd1HL;5 zYzUoH9DYJ}D6dCScIKv{Dfq_l|QI0QO>5IOA5cLB%%2TpO3sGxGjb{iDR@NaS3(B=b=`-xFURx|{*Zk74? zt+pe5zh#wI57*v$z%nB)L33p_T)Ye>oT@2gS7Qa%v8p|LhILZkxzMdM1rK+ZUfHHR zG3~o|aQ{G~x$hBvE&*V8+gOGDAmH!_Zp4?_>THHzb~b*f)G7qF0uLa6XT5*V(Eeq& z+N-@Z88V!C#@@C6_UQK8_~)weB9{fAmLEQeGknm#zbI=oM&rGIYx#B$R4nWxWO;(u zJl4MZ1{*|{^J(6fx4zvzhT4LiKz>W8!~fpvKl{M`(N=B>`9>T;j)jHm#xn&H&Sp=9 zLWyt4M8X38-Uzn=?Boc9ZA7Gu$xN-NH*d11@-wTkQe=C=D<;-$oSG;M)iv)*pd- zR`#^;FGPBU-YT=K@@j)Cu6fk+!X|XN?{^jl2GBoQ4UV4Szb?eL^(#qq3I8TUbi}OU~u=~_WD4M<~zJwFing> z*soP_dG(|C<;dIhriBqiU$*YvMFzR{7?5ihsh*f#VkqQ9xYA-hoRCPQeaDEVAWnjXU!T*f}$z>T$YVQF$Bf#j<_6-dOg7_)01*1 z|L>4D*xTI-huNxVbwS(j9P*7+z#(70103=h{Qun{AAn5x`!`cQ;{(AgIJZAc z`5G0)|MwyP{Le#vM(53t{}%htL;jsmF}4NBkdM@GGvou{l<%YSbILcpp7Q5@new}e z;@o__5-QG;TPCoNjOjTArB>U}lM1iGEA;xQ!;`-}j~FQ`ygF6td8KT#OjEPTBx_h0 z)Pz26i!BX<4;aN+48;Q{PHnv7w^XIHJ!xCroS-flvtC|HM*qI&&;A zSkOf6mOW3u6iWiG_cNafGmR9I#CqK6n7K|#yBB%=#c&cPs#HGFV5u%UcY7-C)wF80 z(l4_dnwMy#!8?BA*Xsy=-R}!)Ns%GbinwcPZ>xB3uHNcAOM5Xu9*J`Dwj}d=Q_@Oq z-#}MH*m>UQXJZt-Yym-li}Ls6rsyx4mC2)@@MOt~L6vsecA`e(Z$#SH@U|ZeQf+>S zv@b$_h_oC_PsRhnRDacI83%sTXeAE$gfo8CXyt#?Xn{YAw8G;PE$cTL?OWrY8g0W* zjTXt^7mc<^_runsOLE0_^9PNGq4d0~k_n*24Las__Zcb#-yRTVp?ssACsw@!NbDOw zdRe{^^+dDch`pS)&?}z(-eNZHM}bbD$N(mw>*O^CznZLzl~o{35u2M>tJImd5~{K- zJC4803scGu76Wr1=+quR8y)S4XWplW7~OUTpwa!q=Pp3{;d9qX*px2xA#>%+8MjDn z>(V7=8aB(Wpnp;BQ=lLZT9TIU4A%aZSctfPFGxnr(Eb>0B@5uw-8BVG=SQj=s?0~s zRsBWv2h49%ErKzrjKK&VjPUdKbY14zVL`#^<|uea&|jDy9z^%_4Qj>|HFX|!dMH~; zdF|jVWNlJK}xx}|8m z)GqW`qrM~lb`tVEyz$(ZzIrr{11qrsTvfbI|HX-kvfUqHJdl}Z#<3M6{cvd`Mmk{9 zh8@O{iDJw`LIh{bvJfhkIuv;Q>)(F^KJ<>dMLG{1$|KcLs?CEG%*003Bb1=vM}Ygg zR15jjeP9k-ob-HV_?Gc4Fv%}iLSt1@G-e;!$$$*~P8e5$#JyliSJ;kT64)kmna=G`h6GzA7FzA^W4@YsM&^cYiYbGcB?g#?Qm zqJ=76V4rqP(Yk7}Y8lGLg4Hc>`O|4v$`DYVu7PduL3$YWApI4uQ4*(?z1ZF^60NVmTH|&le0tk=B!0B<4&Pc+XCmI9IUhxn z3A+;a^>;O>kAgCxn@bW{;tbEK=%p+QiLYfO8u`~7x?r6Q=0Km4%H61pkyW-XOz{#ye#gHf0m`$|G(Pib&oWRV z^zu!>L`);Qg!lR3s97mf@3cecdhv$??Uq~%h_v#tQGlH<&6s_v#cJbgmVbNrg2hngj! zSN=W*3!8anpEjS~XMIZnYgVk~{C*0mD2*7bhZbQt1nZ$6e4~P#oAfFa>IlkK1yvj4 z?V|(m+$3EsVEuRw=K9_w?DE=Za}h>foc0!LqchT4K<(Bky(%?Q9TIqLlHcaaIq-nF z_JUOJidFY;eYOME!F@WAOn|IKK@9a`v@JAf`U#=6&Lgl*dJ8Y%J${bqp0(@%H=tR_ zf1&~2n>pou6TpmKD zZIuX*&dR}uZ1DBPeD~+eu_GFLBQ2?S%@2yR*AKIxQ6*oXZ^?0Y0l>5W%X_JPoqXBZE-1uS&FxR$l@d*g0c z3GIF5K|Dc04QWnsFs}uP$YRM)oaFLc9hR@kS+FQ+)1~V|GaU8{fteLW9Oe%fA1=n| znWZ}O#ns*?jRO4_#Gamajy{KK@SQwStTsF>oL*?5>C}eXPT>)n#M8AKGxnfF3+iz0 zW8(UMBGX>a`g8H0srun#4?O`xY>~1HmzX5h`>%NfTz{YS2d7{2BymYhJ5&BwM*BZ( z19*FT4KPO zu=Vlq6;#)QNMgwPutF;A?(1uEY@%vl5{*#~IlW#!8@a|6S-ljQ0s2%H>k3W%!j!s@ zcb|ikiUr`#zHyM)+3ch+zW#aL5=~(deED_em9sZU&uU90%?3vjVi*d9_QoxXXKqN2 zMeQ=W`>YDO)oRhwld#5)$rDM~^FiQXUh58`DjWtiycaqUOK|v!1ps@YQi8 zq~d`0wioH*8@Y0lq=W$+SL|491YI!ZbGwT2!`J6!cO0JR%Y>`45~68miG6RvnMFMA zT~vo}Ha9Bm?jB8$(|aynjmll`abEWfJ-<`4u(EZS9NMjZ`t1{6kwca$0DQq&gD<#l z@CB#R=|kKq<&1Xq7`&gGY$2KoZm?Flk}EeXM2lVAe*(2A?fOC`y)196u07`SSIbKoIRQ8)u&x zk}sf&$jgRmblkKG9 zSV^bxRAW)vmuAR2aqAn6R&{ZfN}o7@@gi)tdfu?e**_`H{waSfqf#(RsIK(n3`|xX z%?L@WaB7a#I*mqBY#ELuw0=fG_fhg_USKl4`bu41>xjO2088vHky7lmqw>hJG36tI z{D=lyR>>wh83d6BrZ1kWIzChW;_rF4f}_oEcFcl$a-E<7hm;PlG@U2mGLj}4fZ)B0 zqQM95m0Dlc-{NacW_Z<+%gnPy5az~C@g~}e+7zyp4XMs6kJDO+jihkr!%@7d(8&Ap z@KVh^@m6M3n2Q^2a5YpZrahfGXF;u{2T|gfru#})RmYPl2jtVymnUJCC{~iW1x0b& zR%(V5@=`q?5CZ1YDzg# z`{})*NLLd3E)j2{I>@VvM_KLz9m-$^YhHFDz6{qT80Kq><^rRHph zGO}_;9=d|Y(wqozW1LvaPBv~Ar-RGr)LUwjt?1TLhh~hsZfc>*P-12; zppx`}_`(YuV>58Mvi@ZlygOk$36M^?Ss{>K4$U&J=PS_{tT0 zQhWQLIZ`;7@)!#em7YYR9gd?BK`=67C^|92OM ze`9YT1NVymT^#;*arocG;s43v0MPQ8uyD{wR{*b_lboAllQm+qa8O7$-x!E;tuE;aNlzJ ztp4=7QnD~vUVpXs#BDvO`-36)SGQ;6oza2=R!wUnBA;E%W@+?-1e3LF@&J|3Fr(GC z*z6V#(>={$!-v^1+Lw!LuZ9y*Rxnqpy^<8T&VPBL4F$!_D4t_$fxj&g&bPDLy8=b{w$pFtHF~PvPQ;REXD;2*e-+(=35N15e7se?kMw^hBUN`U(1+vf`&b>NYV@^Cq{v;Mv19V>zV75(^`>6?l(cGXp5#LafTvARU1vU%5 z9BF*e)|(N+D6wk+`=XRtJ2h<=?kg@fvST!QcZ0)NSMTdSoqI7wWcS|kqWGT#qrY~? z(YI?T0Nqa#*7K9mHLJJU*I)p%yR2MElLP7jS6$r15Lcsk;b)3g4b zIAj^QWdLHIi2HO^y{whSmntqK1ZX932YJ7R3D02l<)U!Hz zZs0hWzuFDI0yUf_3)Gr$-a_!uM`ac$WpnEw0aB%c+p7Ywg6{>)-zSI$Pc8BvBn4WP zRd?&E*kfJPo2`{aF=&|RgCv1Eo<}HY^>yqGjSr4&w#awm=yQA5qn@9!x1$sbksJ)t zCFt-}mUm9Pe4lmuvm~$7;{(bcSZp<2(&;xc_Z6kaoWBWu^E6Zk zL8E7djcC;H4F)#B0*j-x@nla{=%@q<7Mikb$#{{N=!nM<)3_*p4uJ-D)*BDlHyJY} zg&7^?B?TuEo=ahcU@wra9?=U4w8OfB)&h9;E$YN}V!Ev=BaLpklh31AwqIP1mTI>G z42FPf9FP8K>U`lg{F8v~wH}P4Pqez{RlladBW_aQy3GHQ0>=uoXoIA{@m+3G;9v+G zs^w=0eE2#9-tbEZJW7rF2{7>H1)=)w38nUMim+lEa>WtY6%)(xJ z7d6!=*w*0Rx=SF*U>;+b()zNY0FX8A{#v5mzhM?m5j&>Yg0RD3@wr$ff6CD91b4DK zEA`d3*Z@%puk`D8$pE^7pMWltd`(?gq0j`<{h@X#SJKAN32UPL+|5=P8gr3%_|cc6 z50Q=z7l>9hui`9^kwq;@DBNB#4!w%WaJ-C7E zXng(}uG>d6$o`Sj;JRfG0lFX%t_u_9X=y+M;W~TW1Qzt74Ku*E z7aIAR z82A#?>tHTb?stfYB3IoDcLVO&Vh6jb8Ls4(NUF>)p6fRiu#xk-BH9k&%^Q|{FKE|G zcN-gT&{9vgy5G>XSs(Dj1+)B)#3(StK?IO z`@ZiO_@&hoRR?|`b`1X^Vh4@#UbzMQkJuL-sj>BqGo{ViY-kocM+D+(S()!Vif|Z~ zS(`kmKTZJ4LZlepaG)@btpq8OX&Z4EM;6L$N$>~cH;?}1R{<<{LZPwFD0G$-n7l3* zY~^Fix)m^9B*=$>jl92=2SNS>0~`!+;0&$)UIk!lZ&;b`%M;*A^csIk05$1=9LirQ zPta3K+FTXHRy6mdk<29oH$|GT|nyxltOTKD* zh-?rdYR^quU|7aF)b;DuLsYRz!H}yUAV{_l)4c9wE#m5ChPwyM3 z(*dcd@Mg<#50laR-iwb}b#E4|KQ_;R278JmW_J!t?hPgbH7Uf2lW>{CHq1{$@3N&1^DB$fO;Qi{zWTd2GdB~uA9K8X}4wPMT zA&81>?)>h~4-QR_wUu4h`La3~vzOD1CIxbtk+OFP@om{v5?VfyJVyVli*bH*^+hjh z)z0vc9f1r@TUFZAd)8tsMn`wRzxT6NnA$FCQk&sq+e zh0|Zbtq`IdmZD@n*<}-WJv}4#=(Z4CI8*HBQVOHK8LxA1C|_by2Hn;7&^rvWA%MBv z-0dax%i8%*;vQ{-ID{ZoDVh6FdgvIY`TN1T+Z=izFgBt34ra6C-nxJUtPqzRQt9%ww2{boE2_mVVjl^miF;Tc2&A{3Ih7`n)UWTJoU4-}FH(a={uGSN2=$s;Af z{ekI!YJUL01>*mWx1gXI6{{s8>Zg!uoyKLFqY@lWm#0JuQ>llubz zE)f6Z{s4dr#6P(|0N?`gPwo!@xIp}q`vU+j5dY-<0Dud`Ke;~u-~#ba?hgRCK>U;Y z0{|`%|K$DvfD6Pwxjz8l0`X7o57d9PTKwDlLm$C=>@y_!{?)Xsk7oGrt~>_<0^e$V z$e23iU=Z@<^)J1TJzqxJidPc%U#z%Eq4ASD3OHM}?mD=|`>1W78tjpv31c>)fH&iP zU$O_V!@`{DA?(L}3({ijlDso~6aM{FU|*m>hhZ20ZDQrX3$Ox@#+OM68;kcfI0S&sizy6vt zy;lT?Nz>-uaHe<`WqsS(1Nexud;0CJ`eHzhwW|Cuv= zSb=(*<$Ax-T;()0mBTBwU(+9LXIq-ivSG<`y- zi^gw0Au?t~p7u2GnluFm5|^FUOIF8gGz`xtv!p5B$=07arjqux z9bTx->U|_d*?it<$(PMY+DG4KeF-pSI;6VA-c41T?IRo>r<6w?s9CoE&f=&c)?7zR z&}VlM_pzy)G`1gw!qT(DnJLP|qmw4n_rF7z{^CJEy#Q7%;nIhT1SIEG;{_k~MzANT zRowa=QGn!_8W4M8@?+k4I^X$s5Cuq%Y4FY4S61kj*=m0JX~dus zC|7ADDzLd|Af8}(n#Tb^y?Ol^w^uo5@3>A6m};^;tKR?(YV8loKK2EO9BX|#l11J(72-&iC>p6KHy1|3&fI;YH3 zeXw-I!(u9OVEA4EW<^51@ZdI9jUe#4+?-Hjr^g6vM zs=7MKleOnU+&z}~VS807Z`gLX-gL#MWq7*7?dB$4AU=y5EIjJoNCy-LW6=9xv$#|2 zhU{)(opz8Jc|W&23>CfNh&Q2)V^^ ziY0E9Pv$7yP^?dFj)+dGAQ zH61Mi-3l}f4m(aunYDWu5Kl~ae$(o3Gfq_Fq&yPF7S6_M!K#Yww-hMo6{2P0X*1o3 zA1IHL#4d~yVW22T)+|*E3(h+O?-PV@$?#S=NeG`I35nKfsfvafYANqVop<4?#w=}q zXcK^rqF8fO4p2t7nowm35!Rfr?5~PW+i59eTmU}oZFJjDB6nw;d4_58JaB3@+KkJLF3SAvcfa`grr7i@Pk z*kBXLet{o)t+=uw@IyG|B#I<+7YIMNL*R!15Ps0Ph9BTuLH1!F`imCGK8)hYK7z0h zGqw}&ui1w~u%IReQcwegr3z}g$3q%wGT?na7`*-oKVKof2oMCOoB|2OzSa!jH9clhDY?1TRJ#Ly4+q2`)>;2bKv3p8#zUKi8^{R{lS z@b~Zo8qp2>p!PTL!!qtik*DBZSgWV7Iq36t7^O}7KaCzYhvJb$($_F}A z2>bw(z>LZOfghrOfgei#1%4PXZt3|W{9tqgKfvpN@B{w-y(9?y!1i!uiBH$s?05Fz z7{Wd%g6u>1HT%%@gM9#&LHL2d0s=oQfbc_kPu~-*U*L!Re}Ny~@yufU20xHT{tiDV zf$&2%2tRb+zz>=tT_F2V8^{3{P=o!GeHi+ceQ<`b55P72K#`#@g8+da{A02rFCZ0WOoNN__Qlta^kXvrqKi1qmL+4577@}!{62}-n|UAq zb@Cv$&m!aD$DcISij>S1c-oegxXysDT9k;wlb7zQ9O#qVGSM%x$*#S zpeChcd9;8RxA~A22h6$LT!0cDab=8SDaV7lT}F!k!`@p5)!AiRzX_1w8r&tgySqDt zK#<_>5L}<&8r*`r26rd86Wley-5u^Gd9C|&_c`Bp&;9GZHLD&LyQp1773?+USY!TH z&uL*O&tc1ts$24s~IbB-8WF0oZrbM80|O-=SGnhy+x5; zaUzd1>C6Ig01H&TC0q4OO{Xh_1BH#1_7yL-yh@`PvntH80)T>w__vUaLHpCX6vXOI z^v)8X>lN+>jfq{umTJi4+&q$=g%xISH%1y341=P+INuo2q4j?5l~NU@b%>P@rL|}n zB)svz@0EpfXAKiV@L&48)Xk^y$}XOn8~1{4S3rgX-L3#W?+Ih!mXNz#7-1W+tqeL= zR)Yeb5hRTKJU-s1CZN`$Z<}s?)uMGjVCJoU-K90*wz=Y&Fp&EAp?ZyQ|EYZdKLr93 z_@k%!GgY6-;(NH(+JY}`uo1%{>Dt5~zXVtr^*1iYdx$W(u#RE4d#G&!Ox5o+qEClO zr*}r~Q~BD-Jg3TnzAQ>{|)uF#Jot`wo#Gz!LRr< z?soN#1uLIWHSiGCIVkz?-=PAKe6U}#f{r5klp=XRsG2;vl`!t3P`H^RKaSr}HRAsU zRfAXvLe=d3fvWjZ*~`^P4R}C6LH=wLK=eNu;;+Bc|DM_g5dH7#>z^-z=zj?iNgpAi z|JUh%z#sU(|Bn8bT|9CnM~3q0Fu~CNe*seSTN?p1(SB7*M5EZg?Pm(qyFMmkHb?*K z^aG+oYOSCPlS5R^q1^v`u=yXRAD-QEqF#&-p`1%0DzVk@IOtJC&WbVX{hEFNej9)I z=bqrdGztIdh5NJDk;%(^{>s_+kiVuMKEe%&`(M0-9Nil&>HYSa*5KC>EYYX~p>-dT zXuWFh>{yn2Qh*%L{)9f=+WRtdVKuSI7!K@bmW+QLpC`-g&bby0Q#7=8j&EpZZL6+A_5O;Z2u7c+=>4mAc|E zaAE)01G2k+HR1J-c%o&PJiyD=cr)0vc5~+r;oD?bozOcOZqaw_+xUypCgSzQS&U0l zR1+I1yr{DkN>$eMtM{nUtg+U30j zc~N@h`$Yc4?W=!5KWOY(en^Qf< zE3Y#nQ}7>Wv-e~;kp*2)oL->Lq!ZC>ElAW@`cKBNuBilgO#^PC( zig8|NRvp0B|g6#Wwjf__uv(k zQT?pamZB1knb3T8r#G);_>5~6Iw)@{FBqPSk>DJksiRs$YSC}JpZf6DZvIMup}78H zFw*i%go#Fr>2=dQ%ynOqgT07Cfj7^r)3@ zpotIJl!}{8DFg0Q>myWkAJ7*ZKIc|UiYy23a(p^mpTDrgHg2@Y%x2R#dxw~z{%LVF zO3k6DL~ExU|1bloO5A_a&lLNeyOmqIvGOun^VlKA2dPN16Ts>yT(L4=hGd;L9t-a- z^2aegAWZT}+Crnq6g{-)T%8{&-N2069incdTzu9qSw04{aShjQSt%KPeFzE zB*?txL9E7ba^&QtZj(EB;#NZJ&GLZlyPtjI)_lORGmlj=b1JCZ!Z zp-93IF#CRnRQ5$t!`#XTF);sO(4}Wla3v+hY$eJ2Qck^-L`g<1QvD3d7|;jG$=8D9 zlh-t=^}K^G?5g%^`Kl!O0UQE_&#gczrPb#jH**?92<7VxWmpany&_J1bS-y}zE8%IE6>^Qg(o zx`%|)LfJlfE#dbpJx-r@Tg}Q7@>0)Pt>feJ=E3Ms8mQh(kphJfOtyIMnyfKHT`uCN zB(}e>2&@s-`_a(uu117F)dwySV<3~SBC%(EEBy(&WV-nYy8Okt+z5N(Tmny^%RUkN z(4e27OPeUvv35e*!I3ERjo8X631bwraH>!Rw=mILd~SSW!kxKWUl|0vA_G$NRvOQ8 zkc4_E2w|iARJ}TW!iS&;6Ev_KGHg0 z&2>{6fK&1dJAz!fzsRxt&wM1u-tDemd?X+E|BztHbNXw7Y3tu6m@@RMb#VtF1kF!N zer}*(MZoBr0aJClrv#H=9BQK9P#fgJKP8wH%GTcfs|1sp!S4yCC}U89DW3i*!2}uk zGr`pRlwgAI`I%q}CdqcJI6#9G`b&ZddEsY*3Em6^M6S&t(M5U{<{Q|>cf9ZFhSY=bAkzYiZJQ0|C~mlR{PgF@T9e1Re%J1cs~e~G zX%IJD_K6!F0^)`*fVknOPu%cqyaav*KD2h-MjRD3z3(Z(Wc8F_@_kMW7sk~7 zdxD7rLYSOHOLx=x#qSBG`ri^vGoS<$+ph$Z-p>RR@H4^$wKnq(339hP@J!&Td5~io z`z^ub_IK;>J2?FB*5TidR{z~P{M|bI-8%f;I{e)_{M|bI-8%f;I{Y#G@OSI*=kUY- z-&zMC1o7|K(%-SAf7>+tIF?OmQ*7x0xL7Kdw89xcf1qF1=QpTgS>FDskn{(N*ozm<;+aK-ft)Lc;E2}kc{Xw^eKSNQKz?ZSXU=}<~`#E4vSNT z=Uks~df(QZ7%)l-5uLyuhB@0=7t5vu4!r5Pb=UBvHpw4g*~>~E?C*rS;SS$`^zN3+ zc-(#~r<%dI8H~D%p~5O(wG#++`6y=|QnoCq9X>^YJ6DNcBs~!2V83_)Cco1{ut$AwMVNzb z`1Mhi_b%((Yvo+;vALWk9{`p0Hc*^oGA6%O#Ba_r)7aip#c^`Qcam+Z3nYvGMZ^o7r z;)eu>FNM4DoF`Nd1)-$6jRp8R2Uiu4)}&HrbheI{T4A}uJiL&xC_}$S{L&`Y?=T}1%iYB4Ic72*-(G$SVrmAw`rCwZr2w}qtr)X z>R!E-=0C=__ePdm9=+@j)C9&u(O-E~2p@jX44nXnDU^dm`I=pDLaqXB93c<>nw{t- z;enet_(E_Y{jcu?{Cq1!@8oA0gMC@<;uR1L(kFIvmuv5~ugknbA0vT*_TjN)2KAQb z1zUmrMn|M5e1VhlW8}C=xS3LoMWH4VKMyj@hnMUEwRM+*s)9l17}2@j6Ph+$Dm1tDM4Ni)zE$++(%61$D~w@#`#S#I~4(_|;qOCJMKD|`re z=LsY6K%DU$nDtJExfIH}aioAh{Ff|V-PKd~s<(n*#@WwzS|zNAz@^P_KOhrfjBfUd zib!&Z3{jkEn_hTYP-1y_9y#2=ku-4QfH6A3_05*Ir;N+VkY$pP`J1XamDoi8I>V?1 zongE(HeHRDT)LwSL+=0lJ-g@Fs9Wu0?jgYY?0bp+JA?ae`n*=mwBCR&A}|@{ghGa= zVQjkQjvOcLuQ^W0pcoVZ&VfD&foBhvS#n1A&j;zJx@_clmbECc_hW(5*tU`+bf%qN zumAGRKm7zzs4v4wB@_u_!EqxkKDq3`+c2O4l?!{zBt6S3?B)N$LMtIGw{<E#t_%dJkgn3?qwGA8M>1;CwHVf`SldF5spA^0Mjb8M)! z)^*%0@$G2?|1rg-e9DO1gUu%bIknGLj-7+cpp z@2%YA@0uLgt_YHVDWeaa^gw7P;JjRy=mO4x{oz(~aPYp33x8==I|BNkCxF3ZWin1k zT*xbIct>?PM!rcZgeb$)f#frv-zxmfU6eM7i*C z&l0vmC0%_+=Dqhkn)_CFK_wWgv(!L)@H{;X`pu+LEU*dO6}M)Wy7RX@94veA1D8AJ zDe4C2P8+BCWD-V`%(AT;avr0;NRPV_y|NLRX0%bu+tXs!9Ap)*jY<5%zSTsZQ`i$a z&S!bf4L0qJ#6j*W*-Trkv|YZ*=bW0Ftb~r@wxay(xk-zgXkoYAb#_WPcK{C{m{>C&V6T4gxK%4go~IAVw25cuy=nL+Q0Ml>hXSuKBf~RAC*xqU&gK=K zy62;aUizM0&~qDk@|V5LS(p^J*?P~sPlLUxkC-c4!dB=r|( z*Uc1bBLwC}Gu;isP-);55b`^F9q23I+42 z4U4`+n7b$yoKKBgFV&Q)>pcsoSa}4^G;eud-@NAu!?V=B&Of=qzq!H4EX8@(^>0kkvXOzsXdMiYYG4G zFh9?33x~UQr5eB?@#1?nq@3$YcF#MPG2ty=Ks)7OpI;7$om;80oP6m$^G34M-!@D- zFatYG1zs5M_siuc(9}c z#^R92q=wFD*fO517#2<9WwR8z*D6{)*w6^@Y_l5`^ znlM4*^!oMcR<=TqZZrc4*ig6`Gn<7ncTyqsxrZlBaC|r60bIU{_#2N%X*c}H)mdjG zr8)*qAU5a#*$g%yNAaOXK0^=M(E(mdg!4e|8_6sPzM(TVrPiW!?iX{IZ)i{9oWA1a z4GDw)zp~gorE*rU2J6~vsgeEA4LrIRPb9v`=7~5F=m)1n{Ixi>&EbiyW1Lq;G2oB5 z7q|eQMf|^5*s;uxppy2-;u8W-6o=hKOvU40aR254dLB2)EZ&qg-NLaMLs%{c-8f#iZzdn|C-%S#0luLGJi{+ zFEKva>lo;uq#hqa2)@4kvB>Fp!GFO5x1M>vAs>go$*)~U-(S2`ztBQ?d|E>S`mkgx zzgk|4=NB85Zwh}u)btz|zW$!h=+;vQ4-s;&bP(e5yD%opk(u;mvO;=RCD#=D`m540 zy{iHO^#?_Ucde@ZK4$xJlZhtsWAd=xl;08V=(Zg`#wMbQUiN8f72(0OY;PWFH9tsz@rN%n3o;ee7~ZftnaL8f_=--d$7m5q z>RwT>Ja?3S`Xnse8KFb$C)%<*KjSOc9(sx3PS5J5Z>j0=nb0i3ireWX<+A^qf$a8` z3ld-+u&+X7bL(;Y6~L1c=@GBHnmxfQ0hT?3%{wp5vjd67s)%%0F!#Ay|u|{z{g;t8)D6?(`aMVApB2-5$Nze)C zzR=WGGkcnc#6imwAA2>F$C;~XMbL(^c;Y7#(c-n5#&@$hsVdZ%I)zkRS7=OFiZ!G( z&FTf;6et=KM!l!nGJKb(8L!m`rw2IDbefv02s_3K?lQuTF7rAJ?IV>Yx|P^=+$-yy zXU&w@VD7<}Oupg2CiM*|o=qdlPR5VXj^u$lPjK3@9`!*_QoFIlnRxxxQ4W?Prf_72 z-ma~;64_ciD|5eXKs5Cb@?erDl#VE&v&puzm#n+E>NECLG}p!EJn?%$VND=cmtfsM zg-q<*vI`485{o0uy?ow>c9>6`@3K`}%L-jGmBmHsta*4FMIZO;*GsGO+9lUY4hNzD z*6Y$C9F+=jzBy0$f!P*tHf5nrJk#5s>glF+O5HG zesg)Rv;5o!oU)n%_Q85*mB0@mD_}y4nW9_AyUWU-73aY&$Q8M-E*$Z0D;(+iJ~L_` z;1;fZ!f=+S?&+|WKi^7&yc^F^HT!*H!~4yd51nBoT(Kvoq{TF z!xwsEVx})h!U>l+;so|h#)7DDQETu~5Aao|&o+Gh#=F3-Nzx2&!rhRr_mk+|bkw9o zs--Vl^(z&H7d?9GHy#ICX91{5vSATmka_fxCRMHE4&qIOLq7AwVPHPHsmenvf`@28 zORnJZQv;*r&q{$fr4;S}{*>)pfiAGfkThVx~@w*?ey4%% z7`Nd&dIB#YD*l$uhd%O1@QY^@-|EZ{07-dH(@;eC=QxL^-9@VK9n7g*w({UcdnyZB z_Q6=d05mjauFHxNXG z&EUsqh)dh8{2up~DxPt4XC*{Ur6>yi5C|p<9lU*L*tE^892gW15_pA2(GRd#s&Bsk zOk(kg(-BLx6Pbx+JW5qw>I2e!TcNorO=;V_N6)9S>T9wk8~(-nHlWAcsTV7z~Bkxh@W42#c!Pg^U#x9{TcmufFNs& zV2QoNXz5v)|AHq5vkiY)Sb*&XhJp9(F%cZLb9GL7Mv+=Wo}SIe}gJ zZR+Ll($-t2<&ouPSC2e&wfmIoyI5#YCRKX8v|dS^g{bq9E8FH(cD{N@mD5f2D1Z|Z zMAJ7bk%3XQugVM49I$wipT@>qdQ&-YdTj!8kO+@^r3J&4DA!Lv4BwH3yt{=2ZooyGOkRI4?AEvw#bmm=!HNv^o|zu3F2GKB{Y z({$isJb*C9X9uR;&s>bK!41T$hhtxtcnhT--VdPLiIi$${O96+ue#HzHpaWYL(<27ODf!MhqCL6*RrpfNj2-y+2Adq_itkqA!xgr>gEtQYZ??$fNon@3zjc3M z@5HN#B0J8v-1Z#$3|?G8Xt@kk@C+XJo9MEQz027r6a~p!)*n0XTx#a+MO9jFStcVg zg#91d4Y#zr7GKh9e%A^vW*r$Ty;-dOP~yo;T~CI{yNL5$+Td`uLzAc{pfk8T2NkG` z0gHdL@+Nr1lTvgWU1EMZGgr1fQ!l9e#85EsJQ*Y(W}f6jC`dl|_K|frzu>PvCa<6Q zv4{bZ56w^N;al|E1@mhUn@jZ!Kv(%xL^uTV>{H&V#@TYJ#?me?n%o;VckMX$_nWP3 z)~bE@*KJplB@fkW|Rlbd)_uFf1T?YnPjQZN$c z#Z{P3j;2#jZ=Nvm+jtl=xk=7QVdOEqAMW2(m8a>QVBV-PwNGH!8UZI10fcBi`SOny zPI!_rTbitcK34?wFDNKW_r(uBw%UFnoEyz1A>*hr<*l0KEi2g`f`%pMeQ_erH*iL9 zsX!q(^dN~CE=80RX7%J~&ZRdZCQtolXj*n&PlUVho&RQN27g3wczgbjh9>Y=M>Cr2 zhfniwjwaIECr5L`z2da}gKW@~qd9zn^cP37>Q#3+dGdb{1C`%@iUGOs@qaA_5Okyk zMJ9mb1A1F9EgIP;H86hiOAK&9gm;{4lGMbQgg;7^+(;KC#6I$ppGYo>@-b@5oVMll zLke_lTV=KPDQ$;UL7>V5-u+7Z*&^VXR5+QqLuzW(Zg%eBLpb||N`zj60%LU=mnb^i!4IXI50 zxEmNE&CVB-@hFxL1^Oy0p@Z1>7?RVvI+CA+T@kY{uUyC6Ojs2Yn*jn1rwDcu;CCO> zdm6_2o2QbgA9r2~*8TffNy4UCQrV0@+*Ks6#PCl2^PcrvNhU?!} zm%K8$SpsJ`;Bpk5N_+Tl6LK8nuA0BisI2?6{fEjnGO^9(RfV(Z9}LZ$6+}}LX(G^S z4nHg~Axmlj7dfx5xhg!bhL^{~r-4*(&_A!Pbuw1>XWggA>WHTiX8ir4n`@MN$zcNf z{_5Z&Y`w{0QY#`N`@*U}_kzvknpGY5#Ja=sil2R*5yJE!p6cSmq!wX7$f^y=Ji7zQ z{JWwS4^yY~RafRMf(+n}s+3)W2A_P$UdM>&{MGx6Hv8p$MuNOg!wQi1Nr&;f_xbM0`$Tt{FOGTgK1*(tw|eoOtWV&t z-Y2nP{5#rz<9%j&{73I|nCV}6pW*-B`?NYgO`g~i1OD_r(-w~Kt{Hy!KA$62f1|%d z{2zOt#31jpQwyXLvhmy-mYVr6!u7@H(fzsbcdqCQ!=4P!ci%>Z#S!s%?a%(Q003RQ z<~P$q)`-o#XBXe*2^6j6sW3C$15b$hAE`vI34A9`@2?2Y9DR}zAC@04cg}Xs-d&eg z(YkU93*A6(lV_(b`=5WmdgBwbJ{?FMHVV^pqYMe*lLLuQyz`(5>M`4-oeYlM5b z#BnWdJmL%vYcMP=tI*M?eevn1N6eYESRi$nR3mNUkN-2ayIuC{mmXlSbay??uBC)MoRTub`p!b5&ZOA)ddV*`9+A=2bC z($JRH7xN#86U#^souOHRnS>*=Jxq`lCud_Pkj;l%$azCSJzIoU(q;z{FVjOvIiu5C z4jk@c=g=J@gf+)7u?GV#+Yq8)9LLKco;=o9#qazV;(Vln+R9Y>WL^PkEEy zvXodEdW%JsnX8x_whHWCDcJilu!*HiebN!N?KH8P^mj|kAsvXeo6QFIQb$LtU1eOT zaM>eg)?~5{tRXg}e6*_93||f9y`&*N^4o%Kl{Yp{=I+jf$}|%64l~wolpdd;o)Zkh zM}l>{OGxnc#FrJHQ~}bUkeTICOV=lP^7J_)uws#VM87rUVhxW9t5oV~*XD|bIt-P; zclmu!2}FiH#93l*vUXlRYSC`Ef2R1TymzeRX0sPP8;DMoA$xeu6B^x1m5zeB zq|~pftqQ0k#P51^Er_bHCQJoNlEyG$WcLQV$!UMVkaB>iRKnYt87PVzLX0j-bCan* zI)ZKKPioBtzsHg+znQrkklh!PKyL>PHdV!xQyF@es3bQ8pIe!dy~MX%^mV%4TG^Z3 zo6Xbf60%K6*#B+LPUE=`>0)WpMX#By;73-qj3fXJ9$^rby4zlY1bXN0oyegrl{s8!Ipw-VS`3bVXbcuM4*!SmkT? z=v3)`o-EDz%zI3+x+eorvs@^7& zDLBV%keX$mW++O8SBON_K;8{JEPt*9obM$Nxj};EyIm0<0az;tjru%C^YmDA*n=+% zg+Res_i0GkxQ4NYU&3x;{XxJT42^F0M)j;v$1|g--M6#&#%t-G$1fvTCVmT3w;)y$ zIhro$_4Dm0A>>axsSVN;*c2V)2=EFWmd(--JM`_vVP~hku}hRka4~{k9Frr)$JQ7C z9-*=VsQc<+xiz!8)CA~0>G}I69sJim#hQ)}@jZ0KR2dYXN?g<7^ti!tRIy1Hx>85h z*TQUZlY9oC;*nw9RaZK+P6adllT2a65tt_kcn9kgAar>aa6|{|+LBsUoiD>k3q%eM zG!7@KybHVrKcJzi5Dk0d$V!9vQgImJqFDZVZ+gPz?D9KxFkAGs)Qr(kET5eB0#F~w zjBHFiERqaO)JOhF{8M(6)WX$^54-4`jNpfanGvwSII^>C+T7$mlKK(T`zTG-K=bi> zB3S-*Hx%p7F7Nv2tzcqo3YTUv$do3S*P@{1!!s)FX^QaCW4}7MPN{GgEvA(e0M_^` zcWu{Rr{J5A!-(j!h*3#$Sh)&5tbmz1I24Hs#&+kkX$I9LyMa4Ocb2NHXwN+jmCdC3 zP8C=OmgTezNqs{up8~JfVneAUSe%!OQo2^G&g-NL3-(vgN3T}M+vGo{J>y@+^aOKw zVcIQAZ^CE3%CL_vHGGq4hu>a}WEDcpa;0ibZJ4k+ALxbW|3?9Qfq1EI<+6DqXcvSt zALrnTJm}lR)Muo)EDa4v0xkJSCz2#8ZM&(szA*h(C%RugIKR*&yyDn9SFa^`+nh1H zV8!`;8K;n-GPHaFHs(6zj?&CnRjHcv6r5EoOc6++EBfqcs#a04MGe+)&CFwFl+0hh z8%lj+AO|cTlAGLjOd!5Kx+@$!EACelM0w{-eWbEd+@|4G`=RM|2`sBFCfAf}sax>Y z{s00QDgDi*B=uZ#iY6W^X@1CS*6$H4n<6}6VkRNUH&8^RKlo&#kAs9>hn^IoTZd}g z$bF#G_>MdQQE`Twanc)f?CS;88wT1?dj_R0CaD0S&U{Nds|A!jFeM1@@#?s299DMP zCOM@x%47XtKFzQu8|bosX^RYlZ`s^O-o~wD(sWFkpZH*+_;soMkHQ~cl43?PwMP@b z=bjaw3^+!yRLQcar6L;pNR7h&^^W#+EI&{XD`or41`=|R_h;P;4)H1z1K|_UQ;}5N ziffo9HwcJA4G`d1Gjj|P<5+w>bPqiFI$pZJ6|xNh$qHLTlKaYV_i@On1>ABZH%^NS z5+3R~6sHBeziHH@-!2g9KGROs@kbGKQQ>R^#rPTZB@AM}*gc#eof?Cd+dF&QV=O;V zNzh6Fv_OxiTJl-I&LY6x68bbI+Ax(uj_J0M&PDr5y@0)rY6_7qiA5fN>`g*-Sm%+( zF|_hT_*zPYRC3uW;^vfX(JMcHV}@`!XUHRj6}&d?k511HR|uE9MmhbVD;Jyf2@A|; zRKftmMX6)j;v`>jm0g@QJu{=SDF^0apzdw9tT#)7?H_e4oNzqL_2PE)qf{kf;#RZF zl!3ieMoJYt(E5&8(tMgAm}@iAK>)c$N4;Z*`VcAk+#A{dx8e&%j&s~LSlZhW?|0jZ zl2oc7=`Kur2$_{sOh@SWC49XmeWN8y{`LS+e_1FNTmZ zae|#PUXE*WM0MZ1O@q72N=O3R^wJsr2z!OK&731@TA;rpQ*bji?xUgqa`vG}Q*Sx} zxMd{~6ip}QJ7=nk1xB$hI_th$LW}#N@uG2a)1C2}h}&m)aQvWpthKmmEmV7CqaTU~ z;{6(QLI!~{=qTZ2Pxl$ofkd|8w#R#q8w@^&W#oq@VVhGo0&s<-c6CGX{B;&fMq zzD_%R=;ZgEb7MY?Bb#;s+XV28rVKIXT$;kvKQr{d<;1eK`I^EhkBdZ?M^NNeC}@7` zy<~Tr)o@cHhS{~nwpS?h7W_sfyR7bCNY8_Vz}+%Qyz-4bx3P|d=1oS5^=cPB+%b~x zt(Z7=;(n8~-$xIq-Zi~*-YsPITU8scdBp>}!K~XrOIp#`tMPy!b@oxU>^sl{ zq4=SU2uT?dM@zxEOt-EIl1_b^rGwM8*Gy$^cd9C|yacNzqt2%36{Fs&N5`%IB|Jz4 zUP@oKkk6;n#TSopd33J94TAqF5hrnVd$ol8qm8S$wP_lQ71sdZ4LLUd)i}k z*xfEA_Wi}dgrQp<${1O9Cx9q>$elfqvpiS@zUSsupbQb108 zd66!6*E8hxeG~O$4#IE3wi8h0ZE-Yl8ywaKA5PTQ|KxF5`ZmRs%MpANxFSWLJR(<+wbk~BUnD8oEp*z zwk4|M+M{otHEh1T;8A6~W8U+?w!3#PeW|TG5eXjrr}~q@5##?-+3jq~b+55yHi<@! zjhjFTsDy4uh@nhemj*8NS@^9-f90eMx$y{8oRA0g{3jy2yyG?LDi*TmX}M)~6duhR zosKJstvlkY{8MJlkOw5c%RfEp@6U#FaGwco=c{WH6^gxEiO_l5o@F0MMnWUVGD`G3 zJ&4roQASFk)!5rKnExEUQgC8pf;Rvt($i6!KDPb@_Mi1%cFUQXEVAN#xsjOtaH82Z zx*9jF$qm6k5uf%S1I5r}aj(A6mfh+_-AEC)5AN2L*OHx!`Ooi2Ha;=`FX9E(1<%-#*Q>-KJ zoXwA>R*H!pXB1`15~ABP-@Q16)kGtEZ8eE_cCbkar)`cy4Zw(L|H_+(|7eHwtlv zBDpba$<_dw&d-6&M6a*2kMkqnz6ru<6|h<)CO2Ba6G8p3YRv^U!asDk;|N9Tj78T+ zN3-J+ino-D)ydfb(_&XF3fPUBa^94Ze-5PxcYXS z_55%M{O5Jyo=*z!EAg%1hjGddRI@TMS@UPQ!0SWe6wDRumwB@aJd6Mg0X*$ZHoS}xG+?0BAFcM!h|Ko0*j0ZqX~ z+i}>$5p@okM!%@amaXIf8(QD_OelE1sd*_ZqboK&odDfG3Q;cr*wnHZr&RRggo8k}EsI32iIUU6nuXF!l7~Jg8?#6*4@M}0`>otDi*U6BF`)Pm+?uEMp_HxjnQJwM zuP*&}dT8`%F2M{v$${WGtf{w_eRl$%BK0Q-atF+Ep8^OpH^CpR9^k?gu{PxoxV{JT zeICEOg$C3g8P36>d0MHMJ&Hc4M0BDp!8D=$5`eh$LAye-nEqkaOS`GWuD2CFl6@f$ z9%I3d*2eE3MWJ_yC5Jd(4{;)gXCcoK=kW_+-D14pW7k+EI`3dKDL*{!5eVM4z`Wq@GolV@QI-ND)6#~ z4ep1%|44ZVKO&W?&hG`W&;wQX>41!&uG02yjR&X0>Bq3YHNFU>D6bHLhL3Kdfy3$z z0SQ4(S^u9UUf%ETLTs3!#za;r_VtF_A*kBk`xW;+znjdLMzmavrviR{xg@OZ-U@ix zppa!BS>mt>-JQyrFE`)|LW`CJpZg4u4Mhi3p&AvFFy5)S3!$B7Ig@9jkXu}J)H^Kf zh-9o{4Q9Psdfo*7y8z?}bkea8(`~nKI>eON!LEt@uB}%4#$9@sY&CN7#=kBh5$lV? zq6{@1nkf)X2ycY@N8KSAx!1^j^<+sOqX{H)rH^LCN_k^KZrQPX7%MS0cOH;A>|%hY z;7gw{Rd&5l4T7R||~TvmE+gE?k8~3X@kiiEY}`Kw>vZ0oGiw;?D5ByTi z7(Sk?@LX>veWgAUWmflxp5GyETbym9Zp&tO`9&!i$Lt@r<9!eSRefo+L@Qfz3Ng$* z_yrhXs5*7Vt7g)TDfqy&wBpTem&!r-UXEYo@~zL*#f#?63vq{Y%})%$qn0zue)%uY ziY0Vy0oa;#5f)wPrDGHmR6~Da$=h!Wi^$Wu(Oh~%vzOTcjBX?P3jOA%?i|_T-2fxo zMi@+yMt9co3rO2WRg80z$Uc7>{sJy!tZg6xqa%oS)I1Lp?-kbZC9z<%$ji0cAS(8`*`iu(XGZBE&5bQp4D9AXU3$< zuWu-lt`3AGl7MR~E<>f|6S2d&g>Z_I+CBnBnfJ>J)!Xv)!_A1&^!o2Q9D|<|_s@@3 zao7r^2dw2I>v_?t(G1xx_5RqXOlUoSuv@@j#bBP=%%r=KJ`?A}_$vFhwGnH91u=ec zFAQE2`Tk_$er`>^y@P|%N@_jN?H#4Qhps8-`;tpEI}AW=vMq~#Ij*gF_dN%>$1mg0 z3OQbC{rT_Gj~Lx!w0z6>6I(|VyI&pr=6LBhi&?~km-GTSu6+YTe}doE>q zSH?59EE_l1TJSCH`6Q62mUm!>h#&L(;R+JiLOoTDKOK+R-_(AaETmRp;b2huf;kQl zeR`dLs*T(nJqt5H?ql}`{rnawD?csqBxpV8|1;;$$R~fOzzyMDR~t}K@_iZm1&;_S zj{;1t)GKnE&X7DPWO5x(TghfmB7M% zt`&VGQ@$v{Z@_^E%E=+T6oo58dV8sSQ&{u!xJUuLED7ym^Hk8E?@IAk4dI9KtOOlK zazD{hm<@~uDjA7|LV~Tu5hcvRUi+Xh`3s3zu!&)8xg?jH0y!pq@_jZAc05<{sw68?oE8kf%1^}9MM#@I0CyN z$TTx&xCyxIjTNED$?0tupC(A;P-PnDY(7vq%3o z)*tn)>~kgX&$J|D3APoK&xhhx3% z(dp28y&^xZ#KVzq+2u?rUnc}mvW!L|Lz8cY71?v&owd$sPB?wRj%6a7n?~sy6xf z5PmXTty}frMgN`L18Oz%mx8&dYcFh)o_v0p_(_?@DjGGlGqmT6cUbtW%)@C54&7)T zOnHZwuc{t&fgMN`XHR9L8saglQQ@Z6IiG`B8iKPPQuZ=-I-G;piWF-!Vv$VS z(1Mb59?+xu(^@B_ayXvV`G9ZW|E!1fjZ~^g@g0a=2{hn4g)Q7Wj{ry_O>Zwa3ro!2 zZMZaj3;_RaS=;XgRTqwIgR>~hXJh>Rs>_AV|FAa&ewil_A=uRyx8`LBOW#iWIlma6 zg>LMh6|NTxe=5>1RB0e%^vV0&X$Qr88-m>N2DnI2b)uG`|E&OenL|OVPos$N_8DT^ z#G1RquR?k46jI`#izjg2qwPY*%O;W|no@R(Ve~ zMka_2408NYS44wX7AfBMCIUHXNU~>IWadmA$Z z&tsjShF!lxb^KNYT~N}E_Dt4}=OCn{ecx-ETDaSSPDh?k%?bIUCoxLK^r z&|Gf8YtHmE+AG{vY1<~i68vHPF$PJ1oSDm~;cZm}7U$T9C42O+BkYLC7r#rt6;|9n zbHa7q(R4d`={BYg>oF%{ErW02UNy5w5a@cL)I4Zz2bfuU@wGoZkZK+#waW^i*0*&Qf}VOR^dZSvM61j?QkG_-IDXxqK-we z7()s2#mJ`^2}F{2)b5baYeMJIPI=kGssYZgeV$Yex-tV2C!B}!cf$G2?@p~uKV*>G ztmqnP`U4p$J-hii&{>1A(Z??_7LraOz*axplsDvISJlvO@z(Me79E=TDu!Bhlu(JV zrdx|5gxqSB(UNCEYn+6|3uI9+qe{*NY#fBuAtwEK?2PaG<{!?TRW+IM@98)K=erv6 z34&zU46Y?7gL)-;ngC3>y&x^_uB`-Ts5Jg}8TiJM0&m#DkqrITxP8^2D*40`y7+69 z?D%#AWYS8ncGVI(+3@IooO4V$@aU`|Zl6;8O9;l(vG!@b*r*~SXXdNFrv|nfqzwoUA`+r5<*>l| z9$P$Kc^|Xi_X-hO(tF;nTS8$4J|i{yaoPmqk&Sq;#}f4F@t8h3afO(C_3BmQgt0bh zRlZ1Se=fRu_Hv-Zl1={kGD?T#tc}V38`$U80K(_JEQ=*X&}pZ0Qr&panT+a_{^(MWW&Zp^Mv z-pu_bvd{+QE&2`Yfa-DQi8i>KZ})__PXpT=U&6qGjad2YGkQ!W9}Fty2zl5zQbpt! zu5L$Dve3xrB}?$G29_^a`{*=%kXstrcM}sox)P~}DZ~Lf=1M+eBUn<(z#Jyg^ZZzn z(ncjMm8X;TSMx)jY-Vb27leaXgJZcfB@9K0p>;KDt-*EQ(qidgOU8&q z2Bvn9@riia$-Wvzr{~YxLS=ur@h2|Ez#{gTq`HX5G5vo?I}5L%_HAveba$81U4k@7 zH_{*}sf090FXAaa>28pe?)(-QXYYOXKKFe0jyVSW0gSzU8{{@gBV z?2->MqrVVs#FZFoe;8dS!wz0RYa(m*Wa-OT(3(_0rZ$&RR_CwJI90jQbd|8M$ca?5 zsBiO|n?tuOF4Eyu8QnH+@0{|=kT={0S8kg(9EqeZm9+yk%R6W*z?tDLT3hQ;uXc%} zv$aJA>yJ}=bm-lwefi+-)ZV#XX;{qK3!d8d%~=35ABX>O<4&iF2oQinS!%7K`H;M= zoe_NGld)n|J*(EEZKwj#kGAz1Zn~z=$952)QlZtlH?)4uEV}pW&>pCMDB6*l%sz=o z0aO|p8@8b+9j zraWCm=6V0sI9Fu7j;%hARj=+*+AfJ%`7Fc<+Ar8z{K5L(sv`2+kBb`l1*mPKbXF2C z85R`wwIk3}x8v5{Ta31%QOnjOdCQ zTdPM>uc_GcOtc*y108!4#`#1M%a?XnJJmp>PL)!$vxYppwMH6Vv?$kQgE7qFBVsZ$ z$5W)rBgXp$4X~B0BmHD*&RJDYNwvhPg4MO!_yvy7P;Bq- z7{)b+wICjeqdaEB6vRb25kq^-xSMIoIa_BSNgGyk(dDkxIQ-PO+aJz2!CdNTDMf^5 z9K$>Gaa^X|f_Y#05T?dQUrk;&(0zr&0hSz;Tc)$2w-B9S!B6@}jHlLz_uiqSLH3f* zH8J9d-$WKTgLw%%+bXl;$bRvc)D9}7CEm9jv+D|aD z)XQyCiT{G#p7`qOG%&T-upYhQ4H&DX5@fW$1+Cz=-3oz*BEl<<^iAO9BJWE;$yUGJ z-kM3)Wr2+HLH}y`<;HO)2wTmLw|N}QLwAWEX&Y;(eGZR5r%H%(LniOM-L;qZZg=fE z)Q{kiz1RgjvLEKVi61F6*?OKVB9ptM(R{4$Rw|)g@yfnYxaaKIoWExCQVO1bYZP`d<}}g z{eNLr!j@+r3q*RW)}eY=wFon3guXo2wd)&N!ft-8;0;Z(`8osfu`2;fQOmyurntqH zsbW1+uZ{ErI`^Waquq~8tM(jh34AQFD zZlX^)0N;+*;Dc4hBx}*+o=T-tI1LJxpOBTO*v9028ZJMQEB-0lu1OIvXjMzthR}O= zVi$J}y!al3@#hnJ&A*-4Ie(tm(+~Ge3BVJ(gNDr~WAMa&*?EXrwXYodmlOLxUD$0Z z!3#U^`^4T9dUs;Sd;DLW*u{_k=EN?VcXwiML;P`KFHw5P(`M}oKJ;_nFzYm3?W=z% zv$gByc_6-!7(94p$6DY+eA+&%vHw3XugKhf6AlY^Mq&~o@t3hS6H*;Np^0(Z>S zxo$GlsGsn8mXQ$MIdoQ}_7jsN-t>&3fU?O`?YDR5_O{z|yPn_4s7r2Xg0ChEib55( z6~nwnWBF5M6r6>JjGlMrc5Qm2hdBuI;JN+ztkhn9_uaXD6UE@?xxH%mft=#g-?w(_ z7~rqxcA5$B+)j}E^W2_{??}CoAU=AZ;o8##DYvjz*s2Rz4EN`pQj4iiW<)r>E+(Pb zfs>(B`D`@)jG|)6WUEbtVQ@6TbS$SDiPsJznR2a`J#dL9s<&a~s}>$YPa5xQZkLuBI_Y=UabUo+jAAjVSG6bcv}cd6y!IvW?gi|f zj{vzF%Gd6b*fzo+y(ZG!bE*L8D8)H_dW%T2barQqGZgLYd@A(}%vlmMF zZH2ShJIO*H(^K)V>+U)Qs2MroV6TpkJsd%as?2a7M^rm{IjW=H#%->n^9jCTqOTl@`d?N+i5c_vlA}+qE`=0TN^fi_^P(H=uszRu#qOHO<+ON zV`RaZHg5hF2eJCT4Fnm-Zq|sp{Nw9IjrC{cIXF`6=C4iVA8-rj(8?2#kwcc-Ec94F|#pG>P>o5}TsF61wGaS1V$G#@sdI%xW#8v5nv7O#0_)w@4exz)@t^ zzvxBqfeB}_LnH(|0R~o7s3ncN$_+M2cswYxeu%f+TR5p~)uhkEdG?_kWZL`3FK94h zYidx#r)OldI%gRy4;jx~M4b5XT<=uYX!<0b1kD_oJEGmSLUu>A&s>2!q-}G~@H|h( zcD6H}SF>kMBZcThw6`tzs5(378vRP4Pt*!yWXA%UqqoI~qsBm3O{9T${fps0A?@cQ zFDCOJe)tp7231zfP<6~-K7+0u{rU5>-rW>t;15LGewx8{{neeydWmoBvyiN}qhztU z>QY&bDfXqBCaVL-5xB?8ZYa@KrgzxF-SjCs^KnLLV>#0=njLYEA1=xJA7C~=T5JVW zxxU$_o9WO*;q^^+stO3Oc}Yb8{-#)UlkbPa>U{xwf~JWFW5u{~50BF(sweCBD^zI)h&iDp8dW4bdho*AV-o#{m3AWB|A84(3P5?s(Vrr@>y^^$Cox z_*daKju2(Ho-#Q+#FR$iP<=IdR!0%wj4oHysn-Qfs8Fu$2aiPB+r$RT{X|NrDa@-R zEik3C_ibPd?H;rWw7QsHz&p~bQ-LyhLeyI{i6zK!96_evZ2LYy-jENU!p~*KZ#nQP_*-mM> z#MEBnAx~+d#J*@co@oI|p%fwX%|_nc{%tB-2L{PE%s6{;nKXo4J@UXI^O6vn_nws{ zCd<+T%X8nQ8J?(g^y-?zEe2C|G9lSCS!uE-2B|&X?LF9mw}4$aeL(mi zarC(6L829lg*bc9JJZI#kACuUA{dLFB;qJvsnG<#%Ip(u*;pR}4c>G8I;B-_eU;%e z06sg7?spHo{RSL@Rr2YDh!1n4-c^@ocVcr%O^g)T;fiqaj92onlPeYz zbb2mXp@-J!%ZlO&0h}1tlp?&SdrwIMzI}rT_c!zu@M^MNz80OE ze4|W)#VhU@vP-zYrSJEE2NOo}lf=O>o2kZAxLbcU7<-JFv)6Yq;LP@!$*TdXtMSUb zJ`US}d~Dh*Z-Mfd_AXvRB?!sjI6iS!o9&tp&C{m4UD8!R^~JyZ)%)(vESHcQQp3UV zI$vG;+VmzFA`^~8S9$p?9!+D5zS=FGRqbMKsYHX|LHs?gs64zU`k+p$x+Pe2zZ_5X zLg($fvZ4=mlUPC07lBQv_3^(z5Ml@@8U=rBGvKD{pBAi%l zZ!7kNLs`HW&!8HIdMNtrF>`-Wrm6Hd7}H?FFV`=0R3CpIEHN}1P=mBPctI6odRXtyxub z^_+T&`>8;3S?bKx#E2lEP*NkI_!wEzR<3pFm3KvFPAICU@OBFuUNW_a6jNcvUVD{M z7Dbln6Jo*MP?={QbkB}(pW&WHYx=@gE=I3S)S0yTuP)^iC&k(1-I}W&KTU?jH1ao^ z&$GY!Yqv;ZJG8(PUXIVZ%o2yOJf<5ms;rh}@WaO1V%P#0z#q5so#lHzn^KsVn)Pr) z1fQ~-A=7{{dzV8lIw?{WsWnE=oRH#~QmaM|Cd@sxp2q1GaL9O|N|XpYI#QB|pE?9S zbB20%3X9QESx}h$$S|Gxy@%T)2ri-sJBf$in&3{Lwh^Xrs+iRC8%^6-ROy1ZDU(gg ztS^BsF;HgsH1H>xVYwc!CiseFUk~B8cY>JfikWL3L#3FSOku!khMCu(6s;~z#aTRb zQ`*t`SyRvX#|VV3U#aKrs-ydTnY9aXfAtZ8T?!{>EcZ$sd;rN_gR(5u(n@N=DB{}} zVGa0riCo~_98`?F=oPgNVooa@frF!ET_tz7Nfp)ss*l!&V8*6n^A#3a3l!h_vi?IEqMnlDnKPnBc zdvhETkXWwT|2%%ChDzO;N!T~U;Zk|P&mLv)a?OXI5-#I*NmnE zVYAR^_IB*voz>t==7a>KBXZ)~ZJXp+8lTE?JZlXiK-T~GnzCVqUs^hfs$$yZaSEz| z_MWGY*;chdaG>_A@u}eWrCOHSjrDnM*_nxECz1y;@jc#qj`!wDV0KkxZz`Qk>ND!- zhh<+G`pS+HE*>tmFlvmJDL`KD_+^i}jQPGk)kuFWd5K@dz_e2UNOFv_U;@T2nj@d0 zG~ZRdIU8p;Aed;13fs=m8st8qoS9RkeWDeYJsOnb<+&;*MZOl6i(Nkiso7qJ*yL*gGomn0=$L{urdVt~^%4?emD(yC zZ1c*Yf&DY~SFd%y0xlMSvfA7TY#Q#2ueOT6>C?GDZ~T+W7nxyL}CJ!+MW9slS zl-?O4YfG*ive5*$XU@2#C%m{BwNLu}gq;m9aSRN$vx`0>^Pg*5p;iXjD+r*+ns@F; ze8LC|3vpse7{{n{2pnM9L*)kwg!uZx-=>=rKk9>TdjngF3K+WuGY0|YS>IeoQDXUZ z_r^+@1734$b#B_^Z8|o#k_>K+)Y1}_NDmILu;Y!FCTtD6Hmy?Vd|1&|PcYE+QWj93 zjXKwRtTmGS+(i#-v(*}lr*Re<_}*(GD`)I#bD{RtKDzVi^dlCEokUj1@Ef-aO2{S4 z^Dv*MlRB5j-M|zoE9!lzp3YS#ERfSoPne)nT`%b}vNws!HSbY5 zlWaiStX+@?T@2r;l7+968Q2eIuL-xWc1W)7=R3tpMW#~?%;OWL>RRh7^(;%}9fssrd z>XD-I96`7>#Eef*UkATO9qtOlL54me`Xj$qzvb8ZAiwVV1HT4-0BjB;5MUeC{|jIn zg8=)(4}cBT4Fc@ae*)P5#;@&u^J~+8@$1hqf6K44768}(Bf$PY@@wE9l#%}ku)Rzw zJ(VAv6xc2#97=wG$7!_tEFh!6`|rYtUo+<7lV3@(Ve87CjI`%NU6FnJW-(a4fN$Ni zY9K#(XJ%9pmtr+DfmnC`>i+KV`$t$qz5^(mkhwZ>eUW_+#_IFb2j&}PiuGk4oRT}D zyNe#m8Pm}xBlbx?AKnoTPIWi!qKcwA7crc~9uCaUxwaK>K+Y%}OBhGiI#9c!zU6TslCc_z0eG@VT^Or0bZW_lFuv?(}%}Vv#R-l5kS0 zvdpr}pX&9V_)jK$z6**CXTEO~7HNXWc<~AU%>(gT$G~HU2fkR#bm>f88iIV>4gtfa zcM16xC!i}V$=O8eNAtrKre*VIgBg0bHckx(C63$`LhDP)0YR((sg*z(?**O@ z#go9ph#D{|_6#qHmDk8nTp$n%2aJkY<-KqZD{l7oZUduYb;>>|@UCD~Ora2ritU3@ zvAykZKnQK?HY=7+0A|H{eq_boZh~1cnWMX`SOL;qR?L4C%!=^}(dXVp#b(q4VS^*H zChoFgQN~{ReC|K9V&DFl6|-Dev325);w%A!VvJN9uDPv>XoQ*L(|sNGv-yad+iYoP}4p{|A58= zCx(X4btVWp?QwM%Aw*MTwc--dv7;XfmNT#6vW$}<;8;cZ$QYe24{^DrnIN$Qhn>^%SaJT zJ~Wss;hyWEsL;qxK))W=$EQ26l0hP8F+C>y(pkNu3U8a+M8~x7ZM)?z8upW6ckE(h z(t9-09F;kj4oHc1$5a+}Yx0rv=uHe@0bkJ*VBlTjK zCg@>f_3tkCpA0su4w}%B5eS+e&|oZ!#Jzj0I`GRq2sQl>MrBxOkCWIeZdRz)N_77_ zlKr>QUOb99`KuVC;1!*ZGP>XT8+lveJ~05XB-t!B8=8ncDYux4wngd2EDC;(J22ca|_(@}m32 zqW7OH;V;{NwS-}je_Fycb+wZ~JE#dKMkRcj05xF&Rz9c#-VuX;*M$Gp5}tnjM@xA3 zhb7$J^IuuQVRb(&Vc?IN@G~^CTTNJt1>#N;4&B1+l(Qxz@pE>*H$lU{j>Wb}CPO&) zxjxnReOU8T=wlyH6_y!%NGVB-S4|1_O)bp9apjhTW`yL&^Ys9%6u|EgJ zE{wNWk2^a381h(wpP@e1ynThd61^me0QaciFL??@*K*qW42kotayR|N7@HP8>p$j- zH}k|Gzu7>NkkVy{>paDSahO^=U8nHaVB)d(s7dVC!1^W{qo2}4TC?D|E#EDkhO98`5mo+YW7r4c&&Dw8{H-yZQ4bo!GrVX_ z7M%Vb6|t95KT=CJJ3z0uP_TU)0(L<$PoMxO5C`e%yge1Hf-96Oyk0t#`V0rI*nHl| zau5m7oJeyeL%S-^gQsfQbhmV{H}=_BTQa?ot^eF$P}lwCi7NwZ9l86&c+{^70|C7H zd{dR~e6i^o*R8nXcUv#IB~BC>O@Ks~gF{OiECNPZ<;}KX!6sWW3Y+szALP0F-V6pB z)i3TO5{l-(N+gwxmL@jusI9*0gA&P|L!yF|CSw(O>yV%wwxa$I4oS!_hXnYGM6!|a z2Z^NNFA~YjLz2IhNdDd-`D**09g+-Q&>;ctB$5X&{#GJ6r|&Cf()>4x#5?FO63PF< zAt@~S;gA5oB@&x~Ol;Q7|5hRi_@hMfw+;!wbfQIXo{?>6_n#aR0AecWP9iy8`-4OR z50#D~#=Y>2uKOb;T)XUWvZ)eNWa9Yb@JCZSUqzp^Ct?yjrYoI1@Lq991m*O!+mG6; z+Pa7o=1NGz*x2agd4z}Q_MD;T@$dI3Y>{FHut&%iTVW){_d z(GVc9d}HK=zlzjCVe2q(SG>@oQ>yP5oGI$c6sJef7t{%Bb_5%WN~{<0qEu3T_&XaVmv_dB)pEF;^?J})Vd+B`%hpSnr=bMQKwYTRzk*QIGvr8z$*g z5z|mE#PdHU@&+Tmv?hB4e%AWakzLPD3KZMVn+I*Gw07veF_wI4D$^9C^>7)hwvszf zm-0b)!97EgNlp9%m(S^kvx&90?B^Zd7T08yv_pF_LyD` za1Er+RHax^&!AV+={HUui75!MuV8dzxRJ8HMlfv~Rlcbv;qedjc2yRMcAt`bJ z${0!;l{sbtk=JrFwpFyys-{X3^N&*JJrtQ$-tl;l>F|oW@Z4{K-^UunG0Oi)OjILc zS|0o#Z0to`$`Cyv!b{dmw>>h z2y2N%;!HKILB_%tiSsf+wKI?O_9TNb62}q_i@%S>qOyqe39%@+8J$4%{EPO1tIsXK zPGT)dBWd#t;-aDFRAp}HRM!(~*1vkXqw}d*9;#m2E;xIvD;?G;S|r@@jbsX}gZ;A^ zib15v1&nXd*$Wl36pcqX3#ystPRmlj4(1qi*F#kvIT14xYh2<-Q7Yco8ZWaf=tUvL zx`wtgzPsx%OP4l{5)0gP8$_#qkUtPp;{&ArLY z_;2*Kw-aTQIBjB5uGjS1eMn)K7G|mS+o5I;kveML&`VO-ywRPogpa}RG{*y2nt~%_ z;a*i3D$18;C_Erof||veM(x^z;)LYR|NaJwdqICX#59Ira8>T+c*?ix^=y5$m~mNAkkF-%3^!envdm3)|bdTGeT|w_M(ixi}l@||pc+8_M7*|rrK%7Gd=TsaK*_T6N->@B+3KI0%B zLxG-E98w#`!D`ar*VJd{#g@+#Ex(~_GAPTz0j4bPJ~(k^LWkqByM!1nPrsq_sUDgC z5N&09vhcHi;daUPHaLYF{*aBwQ3rn51+|oEQgdwv^*K3D3so@$ew{a{%a7FawIqXf zz`Yyb_Sfk{2gmKUCyA_i<6bWyOdsbR*WDv9(W6^0`w;f-VZ~V_oDFGjJ6`VEuWXli zc~>V!$<*f{xrMayF}lT&x5vKRwwvFA!!5Jjdsy3TnB+5=4qm=U(vuyD>OmRCRX5HXs-JHHGdc$ubT2on?>y-+klXPRk@NWtJ9Rskh!<0xK zLHbSmnXvLJ_($sKyk2@|-7P0AH)77~8AlSE^gu0XgC&W1m#GpF&7uup8Yp!c3PkJg z(B$J~Ur}%R4Y0v3264&liW2!0v>M+C`Ym59&eP(ilUhDf17p?9ZVTIZ4P*w|an0W| zWiY8}l1cimU@;q@a>+jL)Jg3%jr^`kA%brux=0z*;FG?e@9h?5@*zC_9vWqcrM9kuaHoXcLx>9@Xd7Xp2t%?qgI_@ewHpGAl+^_O05oL zF&0Mwa#s3TH!nj2>?@lOe~dfv&_%K8LNPgVMBO^!)z_yurjd+_g=!bYTd`!DWiqcs z=jJ0zeuna%gsBoVATXx{o-5SiDh6OY+1j0TwzQ8LvZDL;2>u7ZuEO@;SRf^A6=mk` zVAiV$%0MKyzdzlz$JDJ!1Jv6)MeKH(x?SnX^dgRaw#dYa)@YQ3hkcCvd)#3k^J`|k z5Wtr=!4|=&W$^s*=8 zlz{Kt?3EsV7K>miuTsp~wPQc(G-T=}cifv67mLfb&XfoZoitnSC)DOBNb<+wAZ&d)CF9=h78OPR%)I)a*sQMq0I|QV{{><%ABG_i)kDB)wgY80KPa}8_g^Wt zr8Y>h@fGGjw*8{mx%gtS^LG@RY%So?A1L-_~{FQ>{f7|Q$^Vgvt7u`vw( zCyIRoQfzgQVt-ltj}W^8=MG|jANT{r#)Oxk3bt!b22`U2WzmD za1XQ67d%wCp7f81BZ}|dqK~x01}NkcI<4!;L+amV9kmN^3)JDs;f+M1k!O^}} zb<8#NY2Jm^-+~N%`ttFheoYWPyMufxOsgl60Hwd;Dw0RG!||Sj+7s%yS!S)zCOG+K zaSH$;-xfQaL+2}v){|7ciiKL(@}kpFM}$3W2cjo6$f7eL!VmL@IWRxhb;fMwstz|y zfBil+cYKkcHY&3%KNd-``Ke5fr1$|+C@e9W>PKra-EgwL9;KgoQq zm$*D4Jv1@-e10SLNBMiB559Jpm#WGW#8pZ4*!28a=l*6Mqj42PZ>rW&; zH|n`Z#J_sayf6IogCRJhZSFy0jhWi}P*>=92y>gkg@*6M1sBvn?I=l3;|ca*z^j9O7+rHD0^f|5hg}m* z^+z{naC7GPgdBjk7>{c$&U$=OLMrOGPWnV z%KzOUf$IbflImfjbB7-S$=U2rfuvjFUjm6qBPfu3SpFM<M?g2Wy=$5HZw!+EN+1dUCxHY2J(6DriHYXl8zfRp|89_wll(GB{$3!lO+6dp z{+|RAp=CVa)*xB=qd}rX3>qW>p?@?;q+S1mLGoV+BpJ07s{kmF$bOdT&;7GN0{ov1 zlK+K3ax(f`AOZepkgVG7^=r9$2P|ohsSTsDD&lrF*1z{i2$AF_M?IMLzIgD%BFR&I zQNDcT-2%_Zs}>HFRIgOxM}GND%(6Cf!P@QDxMxK^Kdt&(x1K*x zVW2;g&s_Iok~%8qm8{pu~*ea1cSboIdBbz?bz5_m4;AYADzY$1)|Fc2ze-lW6|Fc2z z-wPxmi~U3f!;8^458Y8Mn!$Rs8{Rq~+(HPHv{6#LhVEtEmusoqVsll&UIH7^aB9GY zG~RbTMKme@R*+^>0v4pnFa_v7srXkxny=+Q6r}N9{iPr+f!`*j<;^|4?if{oQN912 z!FSyNtCHkE3)~^raM!*Ij2l$bo&0XiI4v@G!m^m>(R!~|_qa_}TBtDyjcS{q-azuP zh*TxG=WXXe=YL0V?*AUTu~CDshnY52lnbwbw5A#6wRDYb-W~9&IjVMv;wyC*qGYh3A$B#OatQb%DVF!t@tN+LA)M&G=L2uqctQ@jD;cRBALx_L2NQpe<2 zxG9O7SNm16JD#JzkL)Eo)Ji!;*28Yj3q>>D3;jNv(0~4DXqE2T8Jn_L)(^pnCe)q? zCFWGvx$d5NhOmQV+~-5Hyl!PYnoxsdpbgV1%kc?b=g?2&AT+(IY_-yS zLa0##3=1_*CAZYwT%`$o{P6TBU3WaTgsoT~)j{7JlRNHf(Bl{&13(d3)`Z@xnLSoy z3#$lB6Hv$Et&QKF>*m8j(4?Woo4M(qtvTv?N1%{)ll{!N{$RHbnNo1xFP0@iMhEJ3 zK%Hi>#ek8^4#a5#$t<}7dK>Mh*J&L(PnoT@fO6_^*F1Cnmg@YFjAe5O&G3DiOSG*f6)S)XSm@QJT zHAs%KH(I+J`dJd|t^A?BiP@lgU?2n_3Ln{d`HLK}WWP{m64!N>fc7}eHd2uMg4LoT z4tVsujYSH;iY#4tANGWxmc!7e1s1aP6wc#b;*3;KBBMk0-hB#Z!MyQ3Gf%vYS~BLe zMB&<@L<+CWH^FID>twfOb?nX)nyOpj#by2{ZLF@{PAjGhyCm1xmkh4<<8Jo1+P8m+ z;#}C~vGBPTu2qEpXx1O=kvBat*T^(R`-OA9|VaR2WSVZ2=OW%ce8TB{JAA zF(7qm;3U#2u95gzTcHa#RChe-rfKu>T$G?nH;YcB~$b6~PSrtRVy zU&EUA-XYp|pT!NbxPbWhn#HZNULrsKgDFn-qKLf{wC{@rz0p@_(7P=sG1 zO{W#1E8PE&V9 zfmgbR@y_vfQL%zO-Dfrop8%;vb}$#GUfXiWs0;=FfMZ{SsQ&StM0j;w87AFt{uR`)%)kPW(C8b zMmyhsk2dzr&IixD?!J=sC_XV({U+;Lr#6mkTkmIe+XCv0AjUf=k83_=v^36$bFQ1w*PiHT% zb5kmgcQ1>;6b9t^&$IhrK$*YXDCpEpeJ5YWB$(0Rtfp*P6|iJA#vD4c9)VUPLeOK; zA^Oc(Os0j5)CwsDe5*p5BdROkKqUfsP);B;kK%h#{$ez6FrA^2A>^G_BUjc$2r~c# zz62|!^{Q`+O?V|F#3aNL#z`ITH9?@*w(J_lz3SKV@U8QM5_dxFYw^-)^(1p&$D_)6 zL;svXs@igk1E$B`@HiOv<+t~})~}8Yqm)XstO*HLVQRap^~x}8tZ?mS$9HV(){H}Z zXnWt`H%eyt4al{kE+!;<;ms?MCVT{ZFuSmM7RLo>W|-Wut&x#(vHC8d*J{Ifkf?nI z9E6nfEred8sBSh*Pbe?@BWrN6gBrLp57qcVLf1@T&cWIV)i9hB&l+8M(5XgA_Bs8@!5TYj=p*-kmN$q+ILUi$P&F`;tXsN}2jB83G zP9RLqaHoSZ6{hLJYYP_iCY}4*{$*QS|n} zPE)fPj~$!2tuqk?>r5bKTvNwdJrQt3bgaO)3)OVI;hsq8$H8Dbp5;u3cZdys++|@y z`Z03&#D%+iwBO!?Rd!dT{AX9!EpX9bn@LBy3a~W0QvidB;eaD)+WyF-Ai$Y0^eZ;k z2^#IZylD(&1c49jI#%%O1U%a>nhsYlSJ9?ZyDvX~=FaVKYJNC39ZuTQTR0F@YcdiT zy_rv}14`fz?f*5z8C6s5LJD*a2rr+H69q|JjxV@y5v$xf;74Ud@fvUpz@G>@SYb60?75rzwXk}za{8T7(jw998Rfz4KInsh_;zw19@*d|0hAWhgZ&WBz)J>OZ?P6 zurRB7*{ndPd3j#DQf-)-R*_R;vF5#3!XP<{(8H)UxU&a$<2eMMpvv2B;`4Y0*h&y1 zp(31EGw?3KcRT$iDGR174@>NE3+_^utv6!Tf2uVB3ypcc1*ojO>;(&rVF;3j*+(D4 z`GFh!nVUY(?+t#g{m?x}$&nD;;CCoH_#p)pYo!dqZj-`wygri}^Fdyx zXHwEe7*2I?(r@96cHX@#=hQQ4;_08Ij2;TZ>PGh|d;4S5Py%)zqBq47c6gsLM%lcd zhOlCya;4wN@a|jDZZ6IKe&ol(XRAI{9~~BiiwU6Uwc~7x^rbpz|FlbwYoU z)8M)^I{bKa8lf(K_^8t>C|+G!CNTb zzJ-jSavY;qm*-JcZy^ZG^9-AxMJL}loW)0hO3IogERhHVI4vji_}7Zq2D8yoK{MUW zT1oB3r=&m%jhp~~VyclWf#`d{JrLh*mvh3eP$eUpobXA->dK7fZL1xH7UJAk`KJ$H zt6in*Ht3`zyy%xgQM52ggxNgYq4|JoAv?S_GTPK6O_pJLzUCDo|DZXEB~i;?2fu^c z72Ueio#scc3HuJyzG${rCF73Cd9c4knL40esrM@Sht3ZPxk%8{7+5RH?YUwMG*C#@$ZrCQn!N}dtXY%w1Qe9 z_?PPDI!VuBxuCvM>+8pMv{nxd1`J$#Fo>Rj3;PW=I{9s?vR@_>x8zd)ywwm$2UC?e zd(AtEdUis5BHPIXYR^j8z*ObSR$GN@qG|f7=eo_k;Y?E*)jHpWGso1fzN^H7y(Si0 zX}kmWgL>g8>)-F+Dk%(LuL%QQYwqk;kNcw&iiri%>A9&q0*af+wqiVpVyhr z&P$rOPM)@6raWunYxbFjXc$K9V?`O3&wtpq#e|RZJN@Y!h2vP$8-fIVs0inhFbx}A zZZ;*qxs;ZQvG%?Uo-KPJ`%MKNV?7J@xaj4~08=t39!)L8Uteb0*#efj&X3$sX$k<9 zmv)6-!?{3PP$YDJic4jGS+0fl`Jub%CCLUvghN98mQuP}9s_zy2vZLQH^7z=Rr=-_)6nW^6i93BI~G9!$S$G4ESIOYF-M8v%9*Bit|zGOBPP@ z6=(8Hm>3mv>W|hxB@v+v#0k5J_eZo=rbBVY)Y$_ju7m|D&NW4WSey<+No${^>cdol6sOh!?6v< zhs|D6e=+635Y0mWPP2em$d@F=w-4CS#yFRC3^mN*?-Uma@^ZAT$KXY5h*UI7I&oWg ze>k_3SxtZH>38hcEGc_7`oADCe3&#$+kKcsJqGT3gpNi~==y8@8pqL-bx1w0nCOEQjl05YNw>a`#a9(&tShC>XY|lyx-I;XZ3f9Cmw86a zl;wU(l7>DgJdH!ZQ(xuR1bw{bo3=0}$Eiqy)A$v7qFw=s`YkcxDd;7%UB0-}Jx|oD z@w6gJvIP`Dh25kJCyeR|57-!G(NQsMHC~(C61&Mj^OPLI)0utVsK6fLk zL$%M1MtCW_Y%fPD$D51%{iv0ghN6h%^8|qeiO`N9@1q(I=#|VMqSIdFVB<6X9_U_a zct9(nYTZ7t?byv>-oGHROWDq!cVq)KujPY0@!0(p5geZO&kkBO;#LHaK=6r=^LlNDzDcdM@x4dXxA(Y3b6{Y zF1BJfLBJ9_#&j=G4T-oQBd~4p(Q|frSrHQ-l429?N%wPd)fs#-Rp`31V3d#nUzrH$ zNkUudAuQoS?oH~kF+FArF<82M`-Y1n*g*&x*{hG>LOTR`rl(jwqgnxibN!HcG5}X7 z;lP#|f>+8LqwKxVguXc81y#mHTR&-Eie7nh?A*OX4x6m|8O)P%{+~u<*S4BW`C@qD z0|^HN>9U|RH2UR31uRIXO_PEFbb?PK7*}08A9coUp88dQcj|PEjSxt=LWgRKp3)^?%{vw%y6Ll zP+dO%PAX=F-|oThX*O7c+?E{njCcP?(ZAAI=0aV)7PQSwF(VvXK9 zzHkEkdgR0%m8Z4`42T+OUdk0g9O0?nRNf;oF`_#wdv|BoDC^jeGPL7m{kCgBfnC9M zxy)WIf>h1S@>wei;Uu2@htcm}rIQpufn8`>@MA#$HsfY(BPg(o;=W>WrtnL2nz{AY z6(dD;S-$pCIm^-mRaSz_P$1s7SrLtSkw%{B^ui-Lxr@QcoE!1 z>LZ)1sZTL2M$GL9Bv{cn4FED4?Auq{&QDqNe%dv0*&TbJU1Lj<@&Gx**MzlNAv;{B zX}mp_CA!vV3~(TBV))!sn44SboIr)R-^&2dG*4gR*LB9L<~vq{Pn=|cPn;;i{GL^X zz?#?enC1GFR#84P#s00KMD@{23Rt)GE6=8ib3S}c^{n&xJ#I2CxxLEi1MGwctILQZ znOhX2d14b5Lqh5IImk^sR|?-NFQ6Ce(2C!ipT&=H0S9nV&H_IPItDnWx9%%vojS)! z*MHlfkU^fccM(NOBlYnjuSekOq>W@Iwf9bMabcCz{)*BaBn#*urK@IDn>%dMcf-5ZRzDR|FK;cjJ;45-M)(nyfPA zCt+jpMUXM_$Fq*AK^RfkwFg_TZMcY@7tu;+22NjnC z3Xf-nsE0K;cuTB<_y#V^F+8U(&mXk*OHp3hotrBe@Y+NC+o^v!up3>1 zdr)7d1&O?1iuss!X2Wj_5Et}M z>kCx!%kZrmR&2+DUoS(ts5-y5k>2E0&jOz1v|5>^iWOEMBkSPPs0@jd*mYeDp0~` zNj$>ceYECqTYyMVTU@wSS0-TmX$RkXD43`vhfxISqooQ`$c1>3C6zv`%YFcfhd2uu z54A&PSPA*Ok-(0o*;h@)_ijRby#cUsuV@Tv0rQ~*O9n}6Mb)5LQ~Ca(3C?D!yD@9q z`xTraDoQe<1N|z09QPf>G>nZ$HaF8%&fyvNB`0{vl7jYk=8c*_Zw3%kfG)~yUkRssqlkRx0rEK%;|+I3n;Dn(m&1SwJ2qzLWRQSBZQ6Tpm~57`>D70eY3!#9=_U#1&rZEZpm4YlsFKGs9$kD&5zPn; zdQuK=a2_$SO5`_n!xu)}9nu02M03G9o+Kq*=_a)x=R?O)xuL4{4Yc|;ouV(L?G6M# z*J|8nxT0DJ+rjHOaTWjz5NByZ-1OcZ>=v$H*YR2v7e(s_4v6x1OkkmmeVCEHX2vhE z6csbPPdpg;=t>)rmUrRwIQ`+p%!TeV*17mZ_HYw^gTqWHGuA@I7zqJDw8)QdGsOMO z8~gDT^4#GnM@IaG%f%qVx|f9YRW5g$3sJfbgHAe|Bl1j*Tc)=C=3v%|($bAQNle+& zp;0nvU22({=EJMWs$K^J6XYne>(xIZl%&~a}7ENIfsBijM&GhgKBg4)nZkD<;VvMSX2U(Sgb`lo3)eNEd9 z?BB+bN+6r(VL@g_)$*0v&4#?OC)=nxnmG%5Gv`Ke%0w6{h!v%K?S|ZOB3i=0%mJJ1 z@1!YV2G&JZLe1zJJpfi1!I)9=-Ry+{INJo4%$moy}< z;HUIy$*BJM)A?oN>-sMP2<208S_6q1C}W<}@;rE~K+(!G^PF|gsDo3=iR-qiQ7bLF z&ZvzMPddm^m%gPkLGAys_tsxQ?pwdMih&{}-KB)IbW4{sBHi8Ha7#CcbW1l#H%NCk z(%sz%oEvbt*4lfo_gN?QdCqvp9&?QQm-`=>-#O>!y7G`~zc() zGj}rsrsR0w)m^d5!)aS==ll~(bld=X`(_T(T+hgf}Ejr4Q8T8 z9S45XVb75Im5E=yPKqk8s37I_otZQnc~%!71;G-O<=1h?jX2bxxW} zMZpyJ_Wq-Y)N)UjvE< zMhZ^+^{Wy^f`{Ku}4!Ik3 zCR?l!KB?o_{rJakQuM!@E~_adum}{P7(vdDe1#@Of47N<(GvPR?9+P*`lea!()y0> z+2~N-%V2fHBVnmpZ`OkGJv{|emeN$u#^p=Q9z_$T0)+Ap-hI=XP=!y10Q#1V+XFI-8lC=; zvE;)vQbK;E=iK-y#J2?y?=uIF`pnMa;OASsFq@aN(#dk$w0JO6YX znwFSBY4e+jwJL4ri5k7GvgB-ZlSsZ4S?Nv@1i$5$bXpSkVy29jDpsERemM*=QRNu* zNXf#)D^9WQ`v#*FdlJQ`+tH&8Z6-IRSht7U`q5r2DLE3F48W`~q>?T!bW+`g$gMX` z_8eV}6i}lKLBOgeEW~#mMHEH+8kbpx5BSh?_18WO!`@JmsF@=SY*cDwwN4k~+k9a} zRfUBTwSh(r9pwFu&iyL4=iNBVGVeXkiM5sB(R+-B*{4f0tTuY@GvVe|^AL=vS~-j7 z(L!s{l(#`_BY+S4;xqhbc%o8B?6}{_aA7>OGE1sf8#p1}?l)GltmmhPIZiJth69&VUCrHZ zs|n?qW1{URp#atr9f`sF&jLcFG&?n``)_iuDDV`zT6eiuUuM{;RK}AA#4N~B(jr-< zNey&dKMB840X~Wnh0LzpM<&t@WG6r(!k1r#%}rz~mV`Wc2tjT~@g!}EyPa3X(u-sb zyTOsT!7b>hRw@uJ{==VQuWn;=TFBomUw@ysamC8${d!*a=v07Ip*`K`hTGVkzW*6P zkGhBP7q-z^I@^DqAU(G#8nHs&!2us|p6%<&$SyYaQr`Cm?KlYdun(+6icRHK9)Wfo zl7_c_{iIBrT^q(XcAO;8j^kp?-fy5@?*WBRS)L>oPDA8PM|s!+`9U?} z1tgLwG2Oe6_5iN1!)Gn@J^mGo15DrQ5M`#Wnz#)stleW0vX_u@+`vpNRsKnz2A<4l9?Z6NwEgD z%xS}ZVQwBBRNSZgK&fWFoA;em9~FrN^W~mW8>gt==O=h@o%8OFF1J;$_ehi!d!e`? z%Gg>oIS3)p@DQNpk_%vWJV+rVUWd0IXMR5V@}zrAYaU2e{F5aI1f^pgG`&77(gs24 zZqQ=u=o?Y)+@K=y2YW%>jUw^Zj%cD`UpGX;8rY;(XcMA=BlIqjcbss`&I*-O`BfpP z${9U;zEXUPZA?uq^r@b9f5rdJz3`-^NIv#!@ob!qNl52fo3EA+m;Bq?`j+j*V+-dq z`z}zU!4XB6Nnrbac?1G`_=zOf%09)M+|V(Yd5vevF`9`m1Hg@f7uABF75+-Ui+<4; zPt%NX3QyB{YWl#thoF%`i$U37k{VTDRDrZ zJd>j&sRLjs(rP|ipM6*-vNA_J{864!9QwBkN9d?42RFGq3f=(8yqQby?B!5$9(aRi1a%3W=%)J-tkZbj zMwJfru8RTl0tdOs&cU(gDlY-r=C#&zsasI`ey^BBGAuUH#coN~;b-^8mgDMb2jR+s zz(jYyxr<7fk^%ju%kW+$n$lo|O}RDB4)WXs)wnCR)EAApKIkhkXE}ROKc(u@bEs!P{0QL^Q}T zn5K9hs^7f6e7~`C8}GK%CY=miMP}9-z=_gWKTofOqx)FOpkU-`6##$PnUtL@TaVO=o%@k^}(e_M)(7ba{F3Uw4>Qh zZHMPsbv3U;#?l%CoI;5zMVa62giN1@@N~fAa)}yr7X;uaGpeb&fd%85G4uvRFs;2+z%IPvo%I z6caePJ6YG8vZ3>J@#=9%lQ(5 ze3v1M<6y!}sPXpBmM~=sEPnG*{<{CR)hGKBz&3bbmdSGGILdlBS2$r>EZ~~kNp&D_ zFv7|A(04%D$mP&rf&P0yDwAwhfbr8Bn)HamgdX`$=hp_*JDEB%2eo0Mt8RrSJktAS z5H>k0sv0L`s~MiX`KuYNJY;L{tB6J{iCA*UkomhNP*&aAc=qu30fb<@K>a1opaxQQ z&MFmRv%rr#O^n~(nxeg~Pk!-ZG$3PP#Abzm+UW#bFPO4EelP2McEW@?gVJ95Z4%cJ zf7u8x80}%aF`VE-_QzonHEyUV0JnOxlrf{`r^UxR0rZPh4+{L9xo}I(%Ldfb{o-Dk zzx7duBenh!t*V{53E9OH2Df9W)9x67wLrYI1L@mw^b zK5-s#9!3{Fdzyh5oL6#2I!UY2No=oT=So_oGWp|0A4vrr+n%2&EU+Qdd#|K1V$oC?LN$5d& z(#64IbK~uc;O5$>A7=vPGHseL4%ZOwz`R!Rmf%hUWcH3rV0MSgq&dnkCN!%q8jN`r z+HM}WC6qjGNjWxs?US>s_QV#w?NgRfW0aSX(>89maxtE_LgTMXqc_rAGQ8t(ZZYGJ zNg3P>KwlESuf!0g$Qk~AlXh#mQT^6fI66$si3OuY%~F%-Y8)H?_^+_&*%QL4^Rryo4 zotMbfMyf+<)x4^e;WH>!9$HpY^ku%AxByN(0vOL-gWQLHv#4eC#f8y2pt%2ywx4%& z5IK#yd8u^oI}-AVby%NINnios2Rt)UCUSKHysLWzn|ySJ6Kmqf2vQ#&b2B(VtZ}ch zc@t?e^nIDMEP$vRcj+ga@f!bPC+K4Ef}uvVV63(m2D86JD#{loI9(pg)vEkO#{%=0 z*j4pb+0j6Qh=*)+PjZy1n)v(Ys|=K9aO?2EGP`VX!-QC8^9fW3=)amS7S@aRcO1La z!xleo3_w>-*1-3uc_(VQ8{Os$sVv1P@y$AI+xN$-2}s_H7t;1QHoQlkF^n)a&}UnT#r2!kikf*kO|-1|4@Tk6%b01jb|O*kKh#T4;8%v2{a05;H%CU=wiOY;KVKO! z{rE4gjAptY`H)bJ29MLI$3}6}wV8PVy;fyjEpx6@0i-fG69NjO|pxdf9P$}Z5t!zE< zCR9~kuXL>PA&p7~R_%BE2}BduXyp*ZzprKLDP9wb7-vX5MdGHKf? z-{ISVpA2_Uk{KaqIGAbZH}ll`3wz`GHS#P$uHmbMQtDexQirf;N;BgE;%}OyGl|?c zzCp32+xn7=`deE*r!L$q$$0~nSoZBSpdtO8H!I{2U4MgC913ViPlbda=gVLGN|Rr8 zV@US}4e5_7&v^2E9-#mf-qo|d>~eY4kO+pMO|-CNyZcfVuYv+nIOjBU(eEmjmQ{If z;e8h#G?u{yujBs3r56GPXh;td%xtYm@?+&OD2Uhx8vF)GO@c7s_+l%oo4)wD~p zoa=9Y6|0b0S%629%qDVA;a3*q;M0P}6LZ!qbugN{p~pgB0z#R8H)MV-12st{H<~0* zjjPz$#EH?c+M4 zikLse;(x~Ap0WkEenSeo# z&I=fjFL`j$WG(+2U$QP>?NTy*m+^)#DH7;JOznZJ6;r%2td?UNc9RWI9;AsKv>s2f z+Yb%zAl$b{2)~EWF^$oyZ`Ls2Y7<{0LXl2D8vg2;-u=7E$9^%#`O=k!De&om64?@N z#gkcO(No!J;io`cXO+8-#CH(hZomAs)X5^ZJn&I0*L}5?-wUU~pK`<}mj6jsw=25( zZklF9f7IA%iqYcEMa#?a9GCQ@o>U!?ruqCx<+5`TQOLqSuq8obl0lWFSw1-o!4a6u zMGV`PJC^d>vPE+!k;pEjivZ4v4UC_p8_yR#R48jP<^;O@0EBIp2OX^hgZKd3fP8 z-j{W6cv=C{Lw>`PpWe8DD7wy?%QQws<>RSbyL$o!N9VO35cR3lowPI?t!EVpY(&(M?dMKl=89VEGhOP;NyXY@Y_3UNA>e{V0?pr+xVJYDl@O14$J zp?TLyDO+BTZr-_bB@gX;+tcHmL)@kC5xcLV*YT1*b0a(f%0^h2)wGgXX+i9(kgsqz z(FWT+fYns9oJJyeug!=%b-K#I6~2l)v+c%yd|I!!H;V@;jLF zPh3>9+pcvu3?9%kb z>!eH*d&kGT+-wR@`C}T5k7$T{@v6e?=%p~k=R!L^R+Ocg`fk^lqgRt;XN5}98^i3H z_D;hy%3*?rgL5tH9SBN9ScGSvrm^qItbLmLoJKM8nX`JmyJr){T;;QpoJztgCg4g# z_y9IurSnIlaYb|;@|K8nk`x++^GD$M+;r9V=;^M-7G*CG=01MU?I(nU zVx*7Ma!6Fv%K}q&?SRh~j^)KbVFAGHZnLpn)UkSD$wSkMo#W=kCi_6U?Y(N@pG!sq ziOEX}=VA>6Gc=JqN6z6%KGjl~7Y*nub1H+E4tBHZYLv~0$$pN3MWonyq*W0=)Mzzl zeEr)Vu%?i3pI4zu+cxZN3347+oz%r^)-tddyc~3FSrvgA(Ns>Q3U>BYg#{c&urBwX zl53Y@)vooL2r-wow^zC_xSx1bJx%ObSF@t5p>;h#fFn4%12 z%sSgHxzb&?^{h?s>uVg@@7` ziN#rjsz}=Up>~pxw@qb{W^HGnS?Inw&qlO%IUl7%r?1kRaOAyOSx*zDd_{7{GLO1P z02GeD4UWHGCDxO9g>N>Cm6xB`M^%{7)?2NnYOlQmOzggoy#%5202%KMb>1IAml&TI zKlUv_4cc0F(C3^|8VSqS{qZk)b|)4xhX};dT{HO|ST8Sf_pqTbnk=MZ1EZ)jMKwud zL(>=dWHZHDEk&P&uAtPABE3$k5f_r?p)s?t_~46JSFwX8PdF7{ zn>Y|XSiXcPJ46p?$M6sxmbfVE9`SKV4%coumj_eCe$FHjgegAjVzAuN%X8MzQ$Apd z7+}rSd~@_cNKMh5HuZeCCOfR4)~6WL*yM!H0%iPA^<2JQpEGMi(Io4QYImyaP;1GOe%T2qp*S@QNYm3CUKy)FsT$fX>6}L)jr)Ow;b#7 zS$(hkV+~0M#xNe4)2|S$(3%3nrE^`4rR+AJv?(XxnsU`JWN0JDNa+1Z&|c$ZCmH_h z_(9Ra&-j5?_r*WO4{p*2z+C|0e?ERdczrZbGoWPlm6_h-5jH+LHY2F+Gy@H)u)RJY zcHZ*g*<-Z*Li)b9m{oiex@bkbJl(C~Xw*y!SvqN<$VNwAJOUD60pMrR3O^sAzMg|e zdFADNQ_*^#ve;&@QQuyhH3JghC8mapTG{mzm9Py5T#GhJDp3-{^c|l+$Gm zXLOzfu1;jW z7dQj&AI0XjOOF28M;~*-)5i4yUp=I=l4?wHz*SlG24o0@;=Nbi6vHLk+R{v zdST?A~+@JZ4YEg;x+Uu5lyHDy6HC45IfOSPj&(a1w7a)XcZM%QFk$dx%xO7(j9x9hWwO!4|dLoTSZZ38$4FAxxQ)^ zd#&NhLx*^ⅈb^)0KPl{FY`S@^M6qUO>o~d6t_+!7dFvn)^-sfGvyWnml_C3x;mx zOBbD9#4+KAcMp}f4bHw7L?6$VVO{+kmNh5M!KzYSH1n?q z#DeCEHaS1q$x5T`uE|{pm}g^k3qM+dye)4^#8a+4+%R-I{obTB2t;&}^tSMJ+vIvZ zdPGWm#l8+MKlZiOS|ls%N@26@zX%`PWeA3m@EN4}kx+@WEa70JuZ= zeE+{6KDf&s0RL^_gS+g3;D5pgQGY9Z0Mz~v>2xn9KV)!+NxBc#oC7j6K;lQeBYZ%< zT3fE|I~XLE4(Q4a^1&}AB&hGo?V65(v4g4bmzWR#5IdNdzKI>se~Uz=SgQbis^+e2 z8}tGdsaDuIm38UT>g9A2$saK8KcN%}%<4-HBIjCr=+I&bgJ-X|zP?-0fOnC)>Pbyb z&^}sS*M^b^Go4tSzJ`Ep`a2)&m zzGt=i!AxxJdn;1Wz!Clx|Do1}fH$O27GWcYEfxYReP_CE(tO)rj;jyE{Lhg#cMqKw z3mTqh)BT~I>YoGRjlaiJ<; z85cTpvkVZ;3Oy5wu5=WByqCqmQl!%6BxtSWgch=R3R~aBVe3qO09&=Be_$JoH0CM4!NAh4DZ?0z)zFING;-7diUb{8<9VDRl{+iw^5=e9pA%TON) z@!%iY{sr$^2eIBO%3d`uA&Bk}c5l*Fx@juZm2>uIINg!WkH}^QfEU5kxJES2K{yhS-HQXu_4K!rnIhoP>XD`gtqIHHdCk0joEwfV)kA z-vPJ@z+(To3CQdFeG>ruS_O<{{Pijz`h>@S<9}imVD|WS6~I0MSl8LiVcu84GW+Nv z{%Qz`UuiENBcVALIgoU%Ze-Lc3wU?7zhhxqMoFRXQh_(c^Kh68f1#gk3YTlZ>G|u| zQ=R=~37`8_*+H|bqWk1eO+w2hH#|7$NkUO>$D}c3JtR3qT#McB$ID zWOoYrHiAqw?LGfUE3H`K~@h~uBBoIM7DcT1kju|1$$e)YICnK(L*{7*{cc4pF z#jkSJq@QD8ze+eW{_E(MLPJmJVd^%s0SHzY1Q*SJ0OD{9Q#$QfNj^%kxS$4ItcRXu%-DvdVQ zJ?BXQ-eZO$Xc^HC(Wkpp^gEsF_X2V{%&%K3rpxx7K5^g30h%Bo zj*;cVd;9RemDlRs0zkv*W&zM;0}(+{ii!(}EHC{W^GiScZOq@|ayRBbV!FRJw)At% z52+teY=-_%WBy*r+cE#ml%JS~53fNI@b+&IYux(wBOH)ZPt(w1B%rk7<*acu{V6zhom{ao5?Vp+{BB)L%dVvR_R0{ z@8A%TMuK_2n|LvelxYCkeaw_NXKb{(&A*!Zdm7wEi=VUpDO%iq^e>10!0*}OneJ56 z|5H={zdiH^z^T8M^}n3@=ab${{d3L!dFnsnayRvds{B_|f7+H4@0+2&Y5CpIUufay z(0`cg_o4rTA#ms)yeJcKXo?CCaOyw&ujl@LGyj?U|7Y(1pSl14&*uKuj%R@2f8FE% zJ6n9hiZ9juF#>-Pn-*7r3M9!--lE(>;V7D>evoC=+-5prWc*b@baVbVrQf8D*N@V;z*QP;_`N5F}7nz*Qt>Vuw$39FYSOk5DX zfYu_6elN>)Q-(@CjMxl6Hp{z5pD)aBF+spjPS6b|NZW{ynmG|0e`Y3N0ap$k#Cp;s zxe=S(Pr^!K6D^Km2-EG)-(145)64tN88dBmR5qG~7y+V!V(O8tSnPF9#{}V&h?=V$ z?M+~lUu*sNdCCLRiMp6acu`*4A!z=CUl+XYXQRIUs<647&+C8?2CPb#df?3BaF?HK zr)89JRnT2|A;zN%jyVUAENzA&3S6H|&5%SYKDfaJ864cda=LuDEuZE|s8i9{BL zfQED@it;u&#f-M_Z>assmvn7V2}J>`Xugpe*`OQT zYi8ZtXjPIZ5Hd0tqRQ}v!{2aAAsAlI(2LgL@sVGDbR7+HNP4iS?&u*K{IE^ihX?cE z;eXJNRvWlS<2%#W_MgwD$K1igf7Cwk@E>?qF2qUiEzi?cV`-jZfBhbds|F^kZI-fT zqI|Wa-N3-vp^itRj^W5F4NdgjNDk@6lAFS;6XafZ^>x~aKA_(dS6Z5EST)a^Rk_kf zKBY79-iFr6o`dcR_J~P{rA6hKZ zdQpIg(%FAWC|zk|0z#iR#QFGoc)6*coSI6`V2f$RY@y8=7J+%<+)>*gI+*ziIU_Jn zyh#t{iNn8xd1Avdsv02`F`$r%$s!)9RjdoYUBXUWA{T4LjF%39f!T`i^>w=wG&SsbM&DbXY z)>34S$73Q2-E#zkZrqn51VWn0uQe%N7ifHJ8gIwSHi9%<5j|_zDp!W@4qpH4P)d96 zSaoT^Jft=+)U)MrEWkT7vC@8)M@{h2?dJMtAp)!P{f~W<_^RS8X>U`@Q6Kuq1zh>P z=RzuolqdU+WWg>^+9BJ$5fmQ6;@ZxtZTlv?L)c;>>-&20b(R>m!OphNPu8@F5@1_c zJPdr5%}a7pRe?zHXqowq1D`*QMcXnXt;3tn%<)0Sz<>jY>7_}kiKk4A&zVg&ZJ3xX zXc!p7L~J27m0Ht|gy0f!A%A6^lg4JdWpLaY(Q=9n z-zBVs0>fbT%Hj}KNzc*jaUDiH8CexfL2?Vbl;2T7sUn`zw}dzT+1N^#+xy^A-_%XlxwLG9Ul_l+>Q9Expf z=ugcV%?2+CA|`UBmq%O~UaN&)^gaE(f)WwRi6o$m&t1YQ^Il=2kH6fUB{NC?Am>b zQFUUI8eiWPN7j43z2LzSB@ti6+!{7`4pUv7q4)A-+>~~FM;hTzgP*um63Un796T_{ zDn(TL(!3gmX}xR(FbqsI_19M-4Gf&A~gx;iY`j9SxV zxcr_SBmb&n>aARQsbIcQ)2@UN8tItA2-zZZttt_y;K!4nQl5s_aY+Im!cF#>nD;+A z7^rTmfh7_5V3-7(f5EiqiFn-nh91RPban(4lkMmh5}m&j}784XPv|{lClH)weCJirCxyBt9?=E}6aqXzuF894R%) zLmDmkC`F9h#rUgExg+m)-S-K)X1mTe_y&RiKErM zH9I8Y7_Pc8f+|W(ZW6GQ;6 z<;gDzo%4(l*>cM+)dcwzlcBdM8v{oDi&5Il61%W)Fj4J<15~28!PIVB3;8k6!6+aK zX?(B&1;;@ewL7@9a&2+;e|J#;{I47X{U2Nu0RJn;K;WWafv3t&$_M$fL%B9MV%ff= zdJXFX;6N^9rZ+fOie@NLmTco06!);-O0v2${p6S`OR|OX4m-N>)t_@)zc6ScJN9KO z0Jv*k)ejhb!ku$5fXtmz@aH9y>?@y3un@n%$L!D(vNtroG^1x-LxgbC1)PC-n?iI!Z~E zQ?eXjrUq^hMErwy2%?1KVvQeK3Ff`?iP3CTff?3yZJ&XOYk!gB?~7{u#yl?C!|766 zhA3GstU(4f7{V6pvKaSq3LmE1@NvYI(4A-I)R=)BQ>JYNAKKR!kGIF@T?3|yOn5+q z>4LZYyQZE3{gbBXZO!yB%LQAjKY)qK0~c!dzVK61CQS9VFa|cZI>bWY&%-XANyG!! z8=g$&e%l9)cy$;1KU5e6JhP6$a6v4=92BLZsso&EEQeI%% z;8^@NZSZ0s&bS{*2>eqekDCHgay z$RaTIfWIAgGAcvXmXX*x2$tvwq!N{m$HVu~e+NYe_Mqrs0XIHo*t*NV9WW+PnA5Dl zVrb~Fh8oO1JbD=uLbD=g_M?gHGiKNmq~QrO><`j3X30`INreFttBRy07Gsv#k6j3NGXM^U?BuOcXE^>6GAF zDdlyk10a3q4SU|?1?ySRuIuchdMH+gl^n7u>>!L`mMD zzV>Qk=Q!nTR()rUl#bZ`497Y>&Eo4l)ik zj6`8^aqxbYnfKMbc}dE9Z$?IA^Qamf8B||4d}vI5z_0Wei)KA3(^~|k^ZAG+iRRZ7 zsAZ22(Kch6%F2}=DoJ5v_<6s6#iDfbaa#=$_cZi^{?8acBcJDhyLPtjgmJ*sFR3Z9pU2J}XS7HexSb?+48pf0L zB28q?gXr)9D6IXhw#uyq`=l(sO_T^bB9enbvLonyjGHPmV{N0paT#DBJtxC_Vn8Lm znf;SIq#+KHhsvcu@{mC#Vd1!5~` zL|pdM9_v^uQmz|(=@pj;czdL{{1$*CAd2ziZ$iP~x|Y#Nn?JrVI0Dyo#@i` z=#bsv1%keBS%`=H*vxr4ov17L#<&R_H}vw{V2I$*4l{awl;uF!Fb>7Kync#v#Cgk=qng*}u?O$T`O8=Hy)n<664Ejzw@rSbT>%?+?^o@jGP^ju zD49*e(QUV2qT0e1qBu`tc_(-Rx6BQX?U-{CXWq42t*+{&_N#E3U?_{m(xiZKB%#>f#^o8Lc%lj+0tLZ4)&}pV9U-frJD<5V+gu6wD!^76{DVQbwg`*BsV(q$g$t);>iUp zk)n|DAx?-)fJ0psw)nd-rI(p#UMUrX>t?K63X7Bc86UYb)uP`SBW9(1pei-f?s{c1 zev}Z$Z|X;Ju(7_LgT3<9&Cx>Gmx`f|k8(flJ*jeDnZ2zZ&{5zzBUG`x0}Y^9sKa^8&&S{v%WD$Y3xG1j8;7(efhqeCnur<{$6?6<7Mod8YTgs6=t+B3=a2(NowPP<Jb&2);xAa4v?3 zj#DD2uX9ALoUp>Ag#zIkW2x|uax!Pc?9E6bnZyJ-jW-6EhPINUvb`@cK{@csiO*JX z!y)j~4vaB)kt#Z8c4G&Q!MqSxe@5Oxuh*O1D7*JM*h-$TI!%W$ed|U}MnWDYvUo&D zcAqe`h9Q1<-aYlv4y!|qqA0%%nK0tOgS%2@d)eS7@KDDb6JfbZwu93g_FGNtZb5a# z3+4!$r@cv~qc|;xU1~-bz_Pp<78Ik$g9iV`U&Y~$rjmoe6a*t3^N6l#R-~OGnWkV* z@O#_LNq}IX9E2EeoN#Znce4t0jqy=TES%;a)W96R@FUi1^U4aCeCrMmLP%au6>X*? zf8Tp^te-5SWk7KxF)|4wI@P4}wA46Y&K(%oA2}7B&|#MsZRFScG2Ag1B0rvN0IGpu zl~b>cm|^)d9}hLS=zsiKwl9ajWqs7(9F6~QuIWIvW zc|2$EzUMM8d%&V-p+ zUmvb&_=z*ugOUSoZ{_GpX2(3!-z5jYo#nuW7_=NTc?rbG$|it3AEhQg%$Sr8r!h-O zLGZ7r^*(P^&G$^Lh)$CyoFj=xs z;D!aWWU%f0KuC6e#KP)?W4B3#B(U9SCBZ=xrQWvhw}ucB9B4-!S%TIKth(EKI|2-W zZkl>;CFy&;VUnsJd0TrQGxi%#ODFNx6-JmWfPGS_Wd)Ne~jSFIarj5suf2NIN zlBS;lOCzT^lD7IU)h_7%$SO5|$_n*NGq*bdXIes_0qBpEkbg=rS>nq2Q)+Nr@k?qD zcOx}O>`arvqx(mxf$?V5$>HYpKBjdmZ6E8JTe&&r1{gMe|Ls@U7y#4836sCl#x#&% z+SunRe~qG?)wDe~Lj76tPgLo!C%%Zhn3(I-$1AGB5|CJ$Qh+tEi8e&ZXK>Xc`!1f3 zIZ)qePkl1b9=v`De6WH% zV$Q&Kt2@+RNE#)~&pq3^d=YRtJ%kgj%}6a*l(!iHYwU7@*Tise6(gU0naN}`F%ej} z<%^QJ9?xB7nV|P!s{e59a_E#}XoYwS6&O#SEV9ke?#&~}nxZUBIp)v^xumxn3&xQ6 zB6qYV&GOwtAGdcwey3$17IuUW_~u1czZTaorehQUVvS5DrFsnmFJ$loI%-{5N&`Tm z(I$ojbixc{5;j7CMb1x0!mBAp;B#PO?waql*!9ff z!u3{2(ivbLjD*Q6L|?4SY;?q4HIr&K?X`LjlNLV(?&w3hFvAPBBLI0vnFJv3h;4ppRl&DCLj@`WVdilBm zDNTbFw>ob>2td-^1OZ6YOH>cwb3g!6lJy+`3B&Ri0BMP$i(4OZ@@8QwHNbYM_)L;2}rf5b}{Y$47R7{J<(0b7LiBGLO zPTNL(^%?wyr4cvH(T9#wCHKjuqkOY}gdACl_ULo2S1Lv|vu6U5T8@epCwBWdb3fl6 zkjj0qTaTQiIJ`vh82%7wUOe3-cGbAcGZ$%6Nq_$A^f|)1fvh*UJi5dD1t*u=r`w8?Y}muVHt_c6I%anQseLWN0S=x z|DjULyRiMF@wSGj{{ua$EF;W_YR1@ypJC>fFM0jcX6ay8+JX%r-c&TZ|hM9yiH{%K+%Tn!pNjS6n_olpf@u zQqtdYPVC8LAHuSBX&r{>C9!!uLO;ev#$4iLgoU+-hYCDR)rpOrF3>C?UUFs_ok;zr z$gkb&ZKe$~j_IW>rp-j>fDW`4m^pu|ipAh#!F%Gxxe{{ zI*8fLCn~cAgR@J@h~}TbZ24CTZCJ0q>dkQOdV{x*D?Z8t6=9{UDl#07|GXHr=5u3D z^|tmzsuoE{QaPozC?bl5|E^U5ws8)TCjC5ZL0_p zzwag4NE$OfIy@}L)`Rf)Y&jfJ&Dc3Wc~K-=rdrYD zXm=n~19+4P@v9Dqo2TfJedP-j7&{xbWqIaXVP-n_GJK=tqVm$W#)gD+CF-XeeieIK z&9L_CfmQUtGYfN1eW~LY1~SQpWqNo6A2B}D*6)81$TIbjr3@puXKDi7#dcF!QXu_w zK^N2b_+FNjBU|??K*i$d1>uvO%9U0BDc}>R*g(}#n7PzmHqrz{UDYZrxwfM;xK5@ z9AO;WP01^W7i4S_z3$yXxW3+WQV0U3%KNuCCeE}!T8P&2YrJ^qjG8{Dx&J!j)pkwT z2zh03)la=D{`>dRC#dLE%8#)f$bA>nWV17}lHz3OYYgqj4-3~W>C;YXMCZ-~Vns?B zn2refJwc5z)*t^n3SW(cLXIdUJ#)){|AIp$AD|{hqnb)#DVkE*bJ4O+mXDqHWn zqblHx`f-AbS0kQd?t1ARSvgDRpP%LRXq?Q+C>{=a$il&%$~FGP&&5wqi6woI&pLG&srdBbrBIs>V2JiMoBoN#e)ut6Q4d9p2rN9Wf?cu_j|5}27B5TOK5AU ztuexL-PrG`;8 zD3P{J-LR2xPK$d%vBJ|EvBICWA$*%ft%=7oMDrSZjKyYX495!)>=!u3Us=*zmIV`< z!{%j8P~Gz%;61|B=TCwNg6f;z;1b;;uW_PEtc z1?CNo|6i^`hVX_u!BvR!>TrukzKFcS!S@U704M$RUJ)A1$Q(J~!*S;mhFPbNr`prN zdxH`V+7(fS?-Hd-dt~pYpes`^1gh2p(^FcucjYy#h45#(r?tYV30~x2# z)oS1GVK{UO*TN6)?gbF6Q^T{gW=%odQkDh+=7+~oR*OLPD%n1OKgS$+!RJ;JnX*6Som3v}?xh$E6r^d+qo4_~Z1NBqD?LkFBsj;?2zo;|6$dy^0#-n~g) zf^U*UI|3JD+)M(z$Kh-*7Qr`3e?~Xl?{5-n@J)h$^Cr;+-y}Hx)TvY-AxEh0duJTU z$ZuK(Tew*h_d}^S2dW@6O}-3z`%cW&){DhYo5{|JEcmIK;8Blk3+5GYGPOV-uLbj2rD!~ z!DBGHG^ox5NlJdjnA`a#2FoIvgKlfFu|uvyRuymjK)hDvXm#bD2!sA3?g7pJ!QNR%Rk`JV!N<=n&Vyk-h$lt{-xjndpTiM2|b zuwRM`!N4z%YSwg_iyt0$fZ{?k-kc$}>EE6`G{s7NOb$E0K3=4!&Po^8Sw-@1|DH5V zWR$px{7B}&%H!_ri=IZ~Te>{NB`ZeZO-UR`SP3qGfpqKk4tDZLpTd5idt1{g3>yN0 zKp8-hsyJfBtqB3FpUxyJgL7w+IV<3bmjOhPgo}?P`&d2|k5JQPI{ZMm#UiFBDzUN{l&%ZLtzV9knr_3$ZR zd+EI2G#DLMr0ehbN%@GMuXSH&sS-7qRB)VIK!mP-4EOt}&<&!gFuX>Zjjf%51JjE} z+k+p!GKP>HDdgA!&VOaVYM3Atl3-TB5XdSxfVfmA=LId5e@;t%;6Tn3x-LfF{%qV- zoq{Y~(aFk(tPT7*!7s=k>_&qUD*im`Lbv>6 zk4OT(TOg%HXK_daQZVdg8!6-cAMrHzi+Gyt=#O|B`1v1n`S<__+D}b>%__r9`7{Ap z<)D8=5DYHZCd5m&2{wlSA=Nwo*2lT{)=z(;5j8oZ>;4zjDH)(TUHw&cigDRcb^;s9 zBUwGWKO4&U^nYn6rzOK;)<`L!C9$nII6pt?ZD+ub`jR?R@1DJcjcbz+Dyx=%sU=7M z%UUuLEDTGH72bcd(9pSmDXmxZ{`1*Y!sS7Mk#)Et}z% zh26u05JFQ{n3j1$1RP9^!{AJLL$-Re|E@88VQCU{V1ylb$D6V9uP<-e0C8?wgPen3}DXS z!!G7?AZGxzOcTiidIsgwjTe}bJb)?b{DLWIX&09pST+p>)_EnMGCxM``y{}`?otvT zltbl@BDhuJ6AKS&Op|{GlB+dzI^dNv{cYOEAC*DOZ}gd^^d7LjJ1|Ne@N~(TV1Gdy z_)7&1I&+^6%%Bm288ikUgN9l2{fO7r7x{Gx&L){zGIMav4m<`D-w_4#vCO zRC1X&pt!`8@&HUpM1JA526pO5Hb}oef^TBNz`hW(CNc7nARR z#pI<215%E?q|d3TaRy8CqUbtr-fW+}vE?8T3_6PtvEg^1z&k<`_>K^uFc}J#4UkC* zq!_1az-tGAVmpa$(L(3q)p{_2W)CFL_~6m?k|^$F%2GcNUqKWz77E3!<8kHnDJt&q z@g(r;{Ib1O%k#-aJ*PWnZW-)~*I zN~J+p=|7({e-scx-67U2FSCdt*jQ4M(Z*!+KD?y|_)5R#x$B&4Krh5aM`p!9aH@>QRLKdg~etT zerk6mDnhfdKVUDqpp+W!0F+YL1*H@YgbZ$;A_a9ZIuMX{YA4T#L0eAR5D{R!~WVdL`B!5Fx7K;fvyQd2Z6Kkp)c zshPNwBfqvS4=pAin27>U9cV3WYQa;7CW~H`;5I^w9D)g6U-7K(ZilzUeeeNDsR4?D z*Lixd)g!SKRD$+cafdqt@EQ?0JPowLtq4o>Uil>V?KDy-*b8#^aT5-3=&)5G4<0(q zWS6KYom5+fAjI*mb^9I8BEQ7}5vA7vq7(}K!6>EWzO0p~a-lwdLRd7kI)1(C9PjpM zW}nqwOGL9wb`2DXSICTQ53 zj|_z@tufW*y|YzBO9j6dN|O;a1n}FC8yMS<^JkHX)jLW9k>zF03U31?sC((~?Hbj$ zLPzkv#LrmLWKLBWbUGYoEbj0xF;a$l4-=ieKT8%lsaA(cFtfFjr~lF*)VvXgd{Q9D?nO^ zgMr7MVE~K4m7%qvf1QrTb)YNPccOD@! zZW9^P6}*b++mWdpPId#>j9wB2W82n&iOHYv!dB#QHyz9e*_mTXV4urn|1L|tWdX`k zqhA|9BTou9r)Ru65~DVU&*KR$*s76w+`5)tn!`#M6&(Il3l9d z8mfgG%n`qwIw&szrw+Z#znnT`Uz|Enou4|KaDgp^%TovF&szunit8WTA1Ab&e6#I+ z8xAzmQsd&ZV{16>o0X`%ybGbe|HU`;SavUP48w>std3^y$E|}0di5{24h$XU-siUt zLs|}fPnrzmZ|@z>q7VgfuRMs?W@Z!l%R2$~5ZpR!dx?|?iuW^}oX&Mi^(OyfStr4R zn?OUxs-yC*0G-IY%y-`s2!sP3oSIQR^(*LIf$Nb?h+(JJ0>08eN$nDVL9_u)ediiU z%$+I!5>$O4h(_TG@p$(lvYn1kmz`U4I5(r|2}dHao+S`OoA6xG+X91VL=s>SjSD9} zB;PRuETTP^_Ei=aaq|ocep`S=_)l08)&-UXo5KXY>hFg7h|U3>18lH!unKk#m`wQZ zoGVSI*TpRoz5q(oa+h-6@T9R^O_P}puzq$YIz=kyqJDMW|6Zh0Y@ShtiavwA*Vxz{&e|3Y@67%oMYDkjEN#`TMsz=Y#a1qN5lN6WMJ z5P(7YNE`qlNaUdx2$HsWUKTkwJZTQ49~If9|HygmQgA9eK@*K&$;idxOHlW*XQ$*7 zCR8Nh5j*6tH6aK^z+;vNHmH(^wogIK0ydQ20S#qr;1vM-@ZuGK;qn!rt?{mGJIEl_ z+C)e##K|j1sbqtK(*vgEkOAyZv$&tjOB%Wco07*#UJ3x!1C&%M$&2cNo0y7BI`f9sShCpAKnQ@rnYWSkA{5&{s~4ikVeLWeAue;$A!V|lQKeo z)C;07>IEA=>ID>tt4S6=B4!5QaRR3BPEE2UEFqUAvYsv@ne!k?)8QZKW2B4qKK93W zAA&($mS?Eck`%&=mClp$dTaaY5^iX8#R;9*;mKSJ8te(li8>H5Q#z_$!~XR+K^8bp zQ2xttLO@B>4Py>Zg`%@{kw9&iXL|SVn|~8fA^nv6z$m!-kk{)mf1&oaQ{DR(XIKC$ zgaRr`{N!M6&RdY`9`_Bl;cw*|$=Ybwu2xpr*pE+_o`2ZyrR-@W=gVbV3oP|_;k{HE zS18bmDxJ!ED2HGtH-y-uPn$oBUm|f;=E_zbug#b7k7d=%tAskK^CD!SNurJKS^aMI zGM?}B!sk2v9bl)YyV&Wg31DqAz~5dsraq;#^wBy!$-u>I%K{{}EP}yzs zbo^@B`FH&xJGji}TrBe}ngACx*2u69a6uSgmjGPUO^18(_9qjk_k|uV(>wBwPk$N< zrBk<1t(5oH!!mA*1hd8iK-M@O$Qo1h#&v*Q;}7JT@QN(n_9FRhXptDxo_l=NDbcV@ zBnTnnGm4Jjha3q`u_FjuG$>*TIBFTdrGW!MMcpY^o;kMlB>!l{8cYly_)F~^`;q=j zci=YI9q0hN15sdiK%(mVJ!Mq$@sjfmJrVe7pDX)uSHPtw= zw)f?b$(`rOhA(quVSmk$N&d)@Wdb>}05C^3a-Ji*cb+3V+x&V{n<>XOvw_xyolKLb z_`F9(ecmJU!SG@!f-LMVEYMyw2cXLxq&~=0*r7m)Z1PE?gn=06rd}LaEOxLwx-k{@ zGG33+Qk7w5F}aD>=I>9i$4}_e7RMOweSx;*#W_v(rsc#Vr@)nm`xOi*Z#r5^>6NV5 zE6=>FAwrQQ&r-idHa~dl+0%#Bx2?SvSaXa&`;<#urFXp}wt4VR)Xz+qBDcw5+irNL zT*q6|cN33{TqH%M>l?^BBuaT`Sd+oAe&*0*uG?FbQ+sRI{DNop-$B+dbtc z1Y(jm&Tv16AEMZwQ$M;uV_=-vP}~C(2ox)++COx%J|?*;!i!&WLZ;q5&dMEoy4lfS zz*UWC2aliywceRrjv>Y0{&}11etw%gJ1ho-#~8rynB)g7urW{r$VSz6$V>XELMNc< zVKHqB1MQ|C$6{~})}e2jz9fQqV&eM|#&w3c_2|JYEGwaU~1C9#9ixc6a zTqJAraOCdJZ~)AY3g96<+~1^uAE&1F6YTWi;-dx9#mGRq_!WGSS}ax;F`hGLDn#vN zY-=k!?$%az*OmWs!Wa6Dm%>T)B8pLG_k5#=qPLI47OzF3SnqunYM$_gF)o4^1#9OQ z1>$9^!})HN81Kc?Ix41tju~}9ls^Fc%%yTGGTTNOUbVE}&6nkqZ2-=a=lQonY!PhM zuPK0c$sPZ=OUAjpOO62VlKX+XfY|?#mAzvyx~@ zsODHmMdl4_Y`!{z*>01PL#Ia1pvx>2>p}sGGs_H*?i|mK(AHc%` znLezE%*%`cu5+9SJhv#?JmnYmq{UC%d-$n)7P`Zjqn}OfuWOYkv=7lulk}ioTYmbg zZJTJ_zU2I{V3V|L+qcHy{pm!HEVL@t&TK> zh{(D2Suk%;v4oTW822|)V#$Yfp-7>gxP2{PbAa};IgoSS9MG;MOhy(#T02@p3sUK{E!l2*zs(V9TU-k_33)Tr`v>E0<+@5dT8|3%V%Hf*MlzBH)K_&6^G$ar|sz&c}~*tg6%y zfVcq69tT1zh;zqjkYvj4wwFH_b;Q7|@rHXhcgs$M;pK*ISlMC|s`4W;rZ5IX#%No} zPKj~pU|l#6M(E|0@QmZdm9XxQE8!q>nQwYQB)FRvk;V>G`){D>|)NcsdA*#C%# z`J?gOHcCRl_c+Y|_@v|3ki(qu2c7~;&Eev_xww!WA~C%-iur+(O8r*mhMPVDb826+ zptrSo?SKttD)U#2#sa`-@_)r>I4>doE)e3s6Uj0B3&j8EuMoc-ETtWo);lEeZ;JSE zc4S{QGc&D8tMpZ8%am#RF{^{0<7vO*`jY<&*C*1Uw$10&pR9}YnoX8*iXE!Plw4D1XaaAGh}`I$?N=0jvbO0F_`c5}eWW3TVSBk<7BZ zZ>(?tHuOuvrRCXOgnamDBwcUqm1HEbj$VT8)sP@ki{use>i!|MPx3GJrX^WMwE0EK z9V0~tjw=WPCyu|vx4yp3bnJ3?c=j_B{6C-3p?}}efAfqEy>JHo+|hsYj1K+#j{cix zbm-rA^xr(AL;t>`|K=GT`u83EH_zzMzwhY3c}9o+eMkSzGdjuNcl19q`VZXx&y4FL503r^NB@JP|H0A!;OKvF^glTI9~_;-lLg108CXY{l)*Oy0_mZz=J(4Kl z=p)DP+uOL;tS49kk9UkQ#Sm~prOw^^vou`kP?-B`dHxUFgm21yUs&H`v-RiZzB^QS zp3p^DBhL9aEQIpv%TfGo%zY-ST`T&G+1xHwBCp*NqNx(r}JS3Y#z53m21fUb(#ZNOeD?Qe>#XqDrghSjHQX3(bbob+M)rLUIwE7qkw?uS?{l%IW_R@Lh=6z|Ce{J56 z$`0bP50DX#yl~p&v=#r=X#>5G+Sr3q8`6|H-+z|cC?RiO|3zwp21;#E0jW(;)mX27 z!F-!YE*cT!pXPlGqBOGbOY=S{VBTNQ=K{?8`~d+46^9!;vY6oqoMbm{vl#~0 zYCvOajAnOt;Tz6$jG!>BRy7^#g0mDY}VM~j8)cIzD| zK6^Jm8n`QhDcwl6wvuTsRDC2#LZKwCNDR&TT&UEse7c0s>k~kkIdrMaya^~Xoo1g* z(zFrYiu8#tWBXF{3QH!boGKj=S_^kFb?(f3(q5?mI5VjqeK?lZR17#*+MqDJw1>S$ zY-I+;`$z7$0qZe14HPC~q{+BlJk$tY!-4nU?z46xt44-Z!<3`%ZZ^D-dI6Ilf*cRL zio(!OE(eX7qGU%SBk9Rz0$i6uo5rInpmzTypxw8C{_yT=y{sX3QP_VBBzTqdsq)&- zUW&U zEq|AK-gxq+XmX#L{M)rn0As&18lU_5Wx2Aw4}5P#7!h8&xU-rtb45C%%pjnyaS&Mj z(9xn5Bu1rRz5{U(N{;D(uJMW)L`jJ7+S;W9=9KM( zxciPXp5mzm;LY^Q()`7nX~F?`GkuDFdNV~Yy_wtR-b|c->CN;|XEXLCu@wBMKl9;T za%UdOu%KZ6U+cW1T~MgW1&t13>6hZnpy#o_iZh*jDoM`8nW;$2>=4X^9Fue$zdPKd zarH9!uBFYtrg^<)X?pe6X=5LBgZBMWbsJLk<_CcvY{zk%dToN9CO7f2Mt(;#Cj92C zE*2?L@(uV~7n;~Ja!kzVAYM}Tz4v0c$KuvpBcvm|LQG$HI&)f+io$aahIk+16Iq#C zkxm$ln6T9-V&7S0{}SnygGJux`Dyz=^ZwoCFG1Oq%(}H#b~;n{>}^0Vzbzgr;N^F` z@bX`M?P_+l29MrfVq$JNbGrw7@~Yn{ct-nBxhpcbk2#of737gN#I#0N0&m-XZc@Q6M8G;+WbVZ3nc zZ|`J>x*?8@9iU8plnf(f23Q!0aU*YvBj((rwtl+4Oxg;`XZrri|Lme6PmZ7%RAviB z&b!^vow5`8S|X>!n%2BdY2y)$e;rtdg}XUX9=#e zZlOu)cb2ZcRq%$fF~M{0R~)>w&8M&L67%&p%cB3Doj- z71^Honim(P-H#jYY>`C7jiBaSs4yKs6(-XH5ei_!6v23t@$@0F?@){{+bTs3lf##X ztasr?*~&C^KN^$KgsVovD@3xt+swYN#aygxklH8|;0nJM?ED#VRemHe z*)M~!-?XC~g{As)q#Zw_sCXidjKx;T-i3^&_#eln04T#;($d3TxpKFXaUD^3Al48I zih=rAqwxL2LL#l_Ad}91 zU#}67oRPa10qyPaUAr!0dYJD%DXHEh=X~4@wOEP+tLNZN#zL~HhT1QG5nu8E;>(d= z#g`YDM-rq<6LI$?t>guWyvlA>)U(I+cF&mwqgLX1ySC^9GF>spiEvrO7* zhw;pYFenut6Fouaz$4FrQR4xBBERz9=QJ$cDVk)nLM39QVEC%rDWPonM3@%0XWrzn z`Rl_)j2;rP!r9>n=M)WrVWmDxOvl;Ic3gyRE6llM*}uCiA&aG^KW|WhfA2<5DR-o= z?v|M;nneXZ1YG%8ip?Bu-y4cmY@R<=;)Gt%G7V8HzOU6i#PH4IHk6`$S*|}MHcc*H ze$S=xR?Z|f0j+QaqHI}fGbG}vs9;K9Sr@?A7+kvF9;cmB{AM=Q+&->nr8B}by!7G* zH5bYI8#|sd9bQV8qoU?#BUTi7(JMGkv&M%sNTAG;Uv+W~$JlGBxY8HuT=*s$DMb?Q z=Mkzv^0qo?%g?;D#{iK%+u=MJ9eUM{6jexkk(q9aANTB?2 zgIb0s7I|s2#H9Zw8qh`fluC0?J#xbX;$5Nos+1Sz#cACaWX!*<6JHAF=CbeLufwjF4(kQmaA3= zI)<o#LF=idIrv6oc9bu~tp3%ip$a zgor19?m*wzrGoK&B1%48+AVzfz|o(AmmdZ9>ODpkJc^-e7q)U3WK%&e%Pr;+sZU3>juZ?E2v16@ z9bIsjt`%FD4^lBt^d?6@%Sko%zDB*}8GW^=wE5=yq_t{hyS%ueozmQt=U1&isxskmD3)nYdyrpnMI!r(v{sKO0s~ z?qI_TMQp>lNk+N3i`k9UW|Y+If7sFMT#{?kzM^=Qis&mnWi zT!9bd$aAm6!z5)1%pBo*s&?(eZm!%2+pM^$Fep6%3HCLNl0NHjA<@CsaU#!2gkE-V zr!G3U3t$JgfqZ@}Q=v ze+I;^v^Q{itA{_h#oOK&QMl(GWVa$VR8*6_($g|>p#L89%QtMQPnUWWo5d8-7fiWp zshxrqTxGC=i^%gzEY-@q_72u3Po1?X&7_^C2~>|xe2QsEi_6dl(!3{ox6-{#oOi)| zl^=rr7++)ibSV_q%Rd@$(yP{{&~G{=J~|KNLZZ3JXP&R^NqyIWekOcFJ?eUNYMfoa zNa+llX(T0rP0>S8pk7Q@iLqs;zIzB*4|Eu>*oYx0o9}EN*w?kA6mW+<&+FZ|VLY@v zpuuA4augLiv|`}(w4TC5{mEB&w&=9OhflKc3$wH*RR|-knCx6u74KGZqo=;hb;C~X zC*p5WxMA#jZ8fVw_DoKJz{y!e4AYV@CsZiGN7)wn;zMf+>>9Az@0EZ$6ZXD)M z3L%2h{cKm=G<=lhXV-21n7Psq_^Wm#+BV-o+9Ofw+1fQ`H~6aKUXiOOn#scmKMXN| z$1(IXGcL>vE~BJ=$>kyGQZ1Y@UOgEVk-+NptwdFlC>fg?O{3yG1&JU=U9M|yhu*d@ zRqPDa&FVT93tbIFq@p8(Qn6sEFNiZcwBo3Qe^2rESpSNQ=BY)_g8O%QJXs=ZuFM1A z{VkV8K^0Ux3TDUNKo|Vcu6mP?edyIJdmD`+#BL9HBy_+VSE2}0d?zySMH z=y-4F$(xtI?7p8))Nx5oEtJ=B??Fh%zTau}eox@l~N;K(NkO-b%Im#IC3! zG9Vus{Rp(jyNwfuwll}2kfq;pv`L}fQtHFXr0i^>9k4Wp#$^ZbmvP>81kzR5LZZPJ z>8ka2SE9gl6$8ryn;7G>9G8XztyV#v91WHoi~&n}cd|R^*&D$xw5Njms0uy=c^a!f zrk}7}9B90|;y&I7w2x^a?47QYrSwFL#{LyLBGA zTW&hFNzX3UCp3I{wQ@!8DCy+1kS9~t-!p&h(iPuy?uvhAl!kX7bj7Ed;=sRa$pT&R zU(ZWbumExhv9Rhe9C~!Tx=D}8+xb}@@(6RdU&^;qqlkTVTo13#dYKZxiu6`QVBoge z#_#IPbz^&4T>+C?C8ZVIyTVA~JGhaTgMzw~iHarm!S6Z64UyNR;6>{ArRMQ~!Oi1Y z8y{d%3r;maA-i5MXAegUOI-yNF+ciJlox%e$#0i^DM8c`-oe?@K8%9=3AIM?$U!y; z(69ZGuayz!*WUv2wX=bp7)77s7P~PL4YC>XJZS=8>D|{nZ5Xgf#LO-PG1g>amIC^7 z3-{j9VpCcl$@qLdY6&IaVC4M%Jm=nm(w_S$WdvGnBm?h4EYGO4X!I?M$dvD>L=G&x zig8_0l23QxFZ;DRK))8T;`8;opZVI>zvgR~VJ~V(DdfG_8Ma$m_MJpt8kuS2tyxa; zSKw>k{V9k^*w_&KrBqA*FH5yej7CAQm>E(^LWTOJRYpa(X;*Ic61ry6Ep4Ye#<|xB{@0jWQ&1{{@pAwj7gh;Irhm@QCOh&i{E$2Pq2H+2WOkvVe8God z74}OW3Ocj@R1WAv#ejV%vT&de6=e7ARSIrjsWG5h2Q@K(+|iu7d4fatqjls(fHrFg z;jjJKP19aahjk_~g<@B0OqAO_4;F+i(^o76u~dc*UOkm!t|*lqbzw&#dwctA$^|Z3 z4NC_j6fmuWmKa#=1}Pd;bD-k+(|WC0=Z_+Iuk8fF0xF;R!H(Fk$)p8aZC(qOEOc#= zBCi@l=+zgdebM`xQ~da)NwW$p{cQhh+<#fN{_kDu(BC3k|M#wS=x>p&|9jUu^tZ^? z|GjG+`deh{|K7C@{VlTffA3m{{ubH#zjv*3|BauP$GsQ+$krWq{?}ydGk?Qe{+B2h=-_3eZvCe?f82iK_!?PNbU=)aW< zL=1ap^37$$Wx4%>+%f|kVVDS-89a`-#<~5G^V0qpQF`;{u~Y1!fe-v+(EivCqg;ic zL7T^VXk=gR>yI#v>||g=jz?ZS#7IjP024}N?e#q0M)M%pm>&w*juwL+eDV$3?tOFi zatUDL-%&o8)B_4i4ELrO-4yomz=F~yPTY1we!r>^m*3R$kJmkE%4C=EO!n{P#h=~a z8-J}HtfUi0XZHTNI;9Osw|Lrcfx9uUG6aw8$Li>Z$564ev;E%e z*0j}_{wkmS<+BDSVr&->eTVrKKq%p>2w|xO5ElMq%aJ+BQGj6YBrs~r>qj%OeIhHK zz})5$N{*ochK?jJLPyU;Hm*eqnX*T1)ob3e5P}^SKp3FHOH6_zyr!%*R||(RHpR>6 zjAUAc2XsdIWH$EIvOZU{Top+J3P%g~07CsLK&Wp!@loTP3mM5}x5rAWeVKB7u*(Bk zvnTljuRf0i0QEx}a`kwUM8|_}&RE5(<#bw;oP_kxGQTNrgx?0rs%<(}i^bn`%JKBx zJ^EG+eGz$j`}8p}fs>=iG}a1X$lApmKJwg}Iw`+Ft$u^y6I~HBD!Jg%w|hB@4!+gB z?|{Bhpk+FRDOgsm2Fj{xi(pvQID%RbeV!#OnOgY4paU8pOdmdU;i&PG zOL|8L2-6`H544}nYi%bn1_eaKuRqwyroM~W9&c~h2Lz55=0-*y)86X|xq&^o)0oZU zT@rf5j&-uQ)4(7XkTV8WA&OL)Nb#3_odn+CI6f9)o4@^N ziwot(hX>fMuyqZ96usi?+xrFmdapY|$aNpylz3nTpG{FE!7>F_aFfzJ1-Lk11?Q*( zR`9&?oe|L%C13?-gGZu54MBNiXhZcGk?D9Vv7jFfbs3N_mateOM48;N&gmWIQb4p6 zsZ?y91ssfzK?h@ct|pK*0w8p?csBIvtk_|-o6<6KgaC&w!~2s%=kw@!Y%Td^nDtCg#)ZD&z;dY&v zvn)W%sPXu+WuySKjBevG@lzHDtfLq(4zL2UbRAHZj(+Y+_v}cBLlN+twF5?P9RdnL z_5qLG;@J$;W={{E2u+7ZD400fie~K2ia(n2`M`nLj(lA#2>;!BDK}h{$}J>bF)V^H zft#~RO<2v!?2Qrwj=l}70|CA3821ttRvVi#Pz*x{khHhTZomtm)1qq2m00}zCFOJs#Luw9{wlqVdZu+jMHeL&dQwW;!s z(2g-u>k?8gYZnA!FmVfteVFs_X!RoIb3}m-gL1&D}&C)wZp{WmALyeQXh(mBKMb)!z~%+AiQ{Pe)tSfr9=Pj zN`Dh~1K!c9KPwN5kd!sFlPYc-{=9r7eJsv~aqW8!^^wMi=Xz3OHPKQ=#DOO;i{tDk z3WXVs%s=ZqpT%n{W}|K=E{d%oen2ZA&^%|=9e{pnEkVU>9<@cj^SI*%+-;8US(De~ zad7#Ul<+8g3Qleb+IggLuZND~lu?`AeCL;VvXy!;XG%EfB2>vp0b=UL7npiIzRIM4 z7Ch`s3BoH71OM%r#kO%OiKco*ZWxe3>i^`y^*Z?ncaB(dh}|EKL~;|?vx&&JRL2vK zd5k^WlHv}mUmN&ulIuKo%K8Pz{ycZuz*x9i)ldU4=M$8VM;=KHr4W1*pa2p`>-2Y< z&u>mi&|P!x^He#Sy_22J>W8{f1&F#pphZPRtBz@0o%~h7sAU(z^rUU4`u8pB>d{0B zlnFxYu9~aGBZm3ToT0V0B7{7~RSxl?-!!4(bD^P|rqGda@M}HPcIG{pMrtsH_M9f1 zTswNOSGB)lUy)2Fq}##`RR+>XU3x}SSG(NFF{Dudk2(_QQJMb0OMYux`(Tx;&$ z|0PZ3`Rp+37uf}aS11QA5i=^zU86d6!Cif|cCTMZq{z+D1Z+xTJ6(s~YM-|9bbh}egh_3R-7IV4gbhs3nu=L!?(g;1cb z*KM-^^Efe#;|}mY93%e5pp=73pIH1!fGH;dnR3=^&YF{z)p|P1@XGoA>+R!FW#s1k zeRe5R2fA;z+k^uaK8sg8xTE{%+{hS5o?aex?5iKk@Zj9Y_^2R22QV^{YBY4h&0Q6C zYhDi?M=K*RWA@=x);!9M^R{)Q$lpX$%q!S!EKi5BS1wqtzn3hGE);z4eb1SSq9(i_ zf4!PFgn$iPz*o|@Ed()Va(3?DKvA(WjqF>|#1`;)dis0?o+6j*fc;0>2rL_^yo7TF zl#Hp~9|wWtXkW7IJdhkE{HbL8ybdNutL;28041Zr=|{8x-UjsgE8C$!+9>t(D~#3( zLJJKWj)@7i&>DV%`n5lX(1&=60(;Kd)lLCl1%3zcEFBozVGOUye7Osse|t98sR;Sl6z)g0Z3aq?uUTJ%O>kBk4DsR4AjI z1nqu){<3Goj8x}5$$iImM1Uum2Y8Y|s4V@hbD(5XTx8`&EC7_;Hlee_X|6B6m38I} z)P`ctfs&xXuzp94wkgkwOgY$xmLLO?3@9nclOS{hJc%35YTRIwK5iVVK@NcskMEVz zi`Wp}MQlhl{^anSCs`l}JC6+!7oZC$NbrSek8p6V-n2k+R!)FmHnTE^8=c`O(4M@gIMOfQ~KWY|tcNwn}32hA4fCn018VBmWV_pU1e5#2U_kcg0L=bO3q*7z07wVxqH_k3B4nx_@2;S3ie7F%%6MYd z+r~#N_x%D))G~>>Cj2rCs<61J)ighmHW^YjHM0Ey1DzUR*8iOxI$vB@4V(Mi}JF$!E* z-pw(Arc<8)e(^jX4CfDB=+rpR^P(~HwfRyU$I?)!a>pY@5gio9Lu8N<*xEw4iQY2K zR$n7Ga^apdSTu4_?#?`f&Wh0-BLX)#xHy}9XGhazuvv#{5t7QoY#^V9OcuuP-3~m{?v1BnGZlj9>ZY&dl8%xI(@WwJX z_4yZw9dKi*g~zfb&Lv`iX}lxO%rzI_zCRxismM>^PIl)L9K|G_obKDGS#Cz=Pzbq(M!hK6Z)E_r6*cQW%i6o~zBX=S?Q0I?r4F!p1Da<3PN{h-*4A@6|BTu+bx zLINc&_eVBGx>1iORJ0ro{UID@a`|RZ@#S4qUYO`aiPHs=tUFyn&&S~_o^BU8sS3UenjTytbcvw=F~9eYpgk9PN+F+qmI>a|ll?v|5o zkNzH*`Z2yt{baf3uLZRz>2;-?Af)ruBjQ^`7G8ldk_+2XEu=w{H)7*jr(~?ScI8a=h$Ec>Hcn)ldD{cL77sXqd16uhzd=F zF^GvL-NS#ypdqh=(CtmK@9w{Q)tw+Dx}p~$(G9VzVFlTbhmw?0#JzZ_ke$J%&(7tkvIaP>+tXDFUS+2+V}9+uM%!%T z7p3<}>6O{r6#H*mBk{&U!E(#iqDgZ)FA60~f09fk^N)|4dIuR(qhn^uXvMjqz+N>%XrMPSyXS)+B5jIzC3~sMYOt%vgR*gu z`|#LL+ee!&{Oo|-;TVx=-9^FRrXboGZoiAdT9WDqbHJ;p6NwwT9$I0W{0hURem=ga zv)TV490me0^4qC?yJL=z2lJ_ojzG=x+6#_bo8!P4W!KF486~IOlR_KtjIw=IL%gmr z0)jcB|HfqQ1nQZB9r=(kHLfr@#Hqoo>its=(m*Bx^6KX z?5PC{w7qhwmhh+8Mcb*n{T}5MA@)Ouub#o+u*e9YKJd8bmY_G%s~`p?rzm-$)1Jg&npG60-TazVcYHzw)pyB$h(1*a=R4_9`fe>t7B z@Bob|i`+}DmO^`siL6+c#uROQiPOW!f&E#@El^sY!oCFgc}r6;2=v6RfHnRg;50Mu zUg0iWdz*ngtO)X8{tC*HZM>7xnuyn^KN#?|m8-jt0f)?~8!aRwXaArTozSPf9Ea9x zWp(wSzM11F|8ofUweU~Q)9C=CExXyXXX({}!qTd#IWtUKo7Nh)o}AO|I>w{MQ9G{B z&zei$bj2cznyq-yTSo_W-{v@ZxN6lVDyR-?kXsaM+oA4Vce9Q>U)?t8xiW>}Dc&S2 zs7%SxZ*o(a5mnj9gYR;!=2*pe!WzPU^BEs4WF?U#=vguY$Y{gxS|BXY(>tV}=D?vK%O~^+{H06~&FnW)rG8mVr z-*(xZYM0+v4Of0|9}G7q*7{(RBf^U{USXj@0;qHPZ;mFaMJuBP?4J3ZvLVK)&(hJv zegpXH6HMBG0~zC6D~ykz4x{K!?gIdTt>RM!k{syF>0`Ovo1hN`d%?!)DUkaq?WIDQ z^h-zGZ(ErCZrVK7kF)g|TGQIXjm4w#{c2xgqgRW#4-u;BmPIQIhrwaODPDk23%4;^UscAVOyk@@>Jsmv4k$^AWBLae8^+uEX!*&_6iRFcCNW$kF>n z!uPuN4u;Wnq(?52p?QBDeC=Tvs}Sz6Iyq#iq-77tS4)QUGE7KU;UbxBjfV|8d>@BKl|D{j=`=|F`Zc{Ic%O$O+ch zTg}^39rq$Ukq|hsP#sRdd=xKbf-~(A&}7L+s6yu_o$y0MBI33^`w`uFSLPUzC-QyA zLq$s1&M|~Ru*#-M>E?i1WEnj%{CU~_0UtHZJ92&jpll!IL~$fyJXTg_Zr5bV^;NxER+jv6D~ep%ZKJ2HSHrEvJvZl1v19cX z?V5q=j^~wOWl4|PmfTM=XV)z6HJrS64K*4f3C}U3c(Ro8qGJx#_OUTFG!vgcH^lOK z^_>^lgIR)EH;l!ENPVL#cTm^o-XH9QySm0-C`6TBpL0X^fjL*ci66bh-vF)&KCmBa&RGhabFG;U zKF0n!=W^mmrVz~oxOcG&gc>?nkx8p8a&)~l>|Q9?wcF@PzW+LyqeI!^#&Eqw8vL?0hxdY@dX}}yNI?%n-9RF6jW;)tav~R1k zX}z(w!z5g5WACso6+m0gVmIlzkGhP6)7tf}jjR@@sn^{f zUvA3urnuIW_Q6=7WT*)!>6}7h5?Z#DgrL06TR9q)pHre2{b53G5VD(hmQOVYsyiqT z${LpyeHiqn2qk{ul$9xTP#-3(g`kiDobpnCDz4_vS`P=5<=NKo3g^vKzadzYE`$U+ zT*BF;X!)?T*@ib)?0e|KA#EC;NbrmS6qQ8TEu5F~U338W!K{Z4i_NQ#R6z^xr2AIe`P!)Kf^TdQ* zsVd&f`(QAxF9x9deZ-!LYk){*QUJxl z5JHr%`4*)$0O}d!34#y+tAP+=;tN9~Sz_3EG|lxgfR8m02Go2kJcBV)(Uu0sI|+0Q{nqwOVcU4WN!5C%-N z3cU||Xe6@ll=U711?Lb-8tG7+GG}QX#?Z9s3s0rz+Zw_xl*C6L1(m+V``~HdzUF)i z1^VV7fJxBrK6}z{9DQ$yfo{Kdr0O# z+(X9jd&uPXJ+!WUa}Ra@kM1Gezq^NKe%(V%5HIUW@E+2iJlT&QPMZ_dkFv2w$1~Zt zIH0!Ccr?H0nHQ9uMf%`x-gcA9vJN)Nge!w-tMx1c&U&#AA{1x3>nbPa1%Rgr0cX1# zAUJ?tH`ppwllpX$&??L%p|XP|!%V6Ew8&@1K@>c1&ii?OCZY>+FB}hQ{Yh5qipG5v z$Rjl)8{?ncDen@^6xY%5i>nsLR(suePO89zW?2C95#`bvcK%*?LK{o_MPd?f}6X}^12W{ow+wTe5|;z3+I zZ&WcSQI{x-HP?g{Jky1wLN*U-0>Yw%LaSoK`~FRxuN9kIgM%-o;ZJXSbVq%q3q#-6 z-52z>a~j%#={MjZ;zXKjlOUJXeF|FHe>mCL>!6bz>jgU5ZTv(0pG$UPL+0RSXg@9H#aQ#r*C;b^x>aFI#ZGLY_Kl&DU-`<21soH8r zKSV38OV;C;8leK{DLj?97>|BnL2w>g7o&Bj@>3Np{Q$JDl)%yNL0xaY%a?$*GWgGv zZ>vY<%B1>DU67@27ZOt0dFklD6Hquj$|)^S(7n7kDLW7Wq9}#>goesK#R`6{BxYV6 zcw{I`I`g$QLglkrisUwQ2b}o+jFo$APW5#rvr9Sq_NrBwy02ev{1KHHo3=LDwAxQ& zp?j0;S+s9Gzn{l=;;pTCjS9-cwoh&a65m<(;4}IW;~MQ1^Q;OxNutx3`wBRQFo&}jDFt>#6;ym#*;M480g$@zpd*W$Tog`SNXp4- zy#pWW?q{Tmx|;5V1?t&jXdxq)Of6Lurc&L@CDm$>BR)SxAiq=uTzRs5m!x%DAa~Vm zh=U6esW8YRh+9yYrw1C4b~AdP*8jL-cpFmr@18f@_!M2z8 zT$YDlQ)_GB;P`3#TzW4xPR~&PV z=K88f7Wi-kfx?JAAPZ85S7BoT?&L$l!Kv4%l{Ny$ zB-kAk;HHGy%)B362rlZ~-u+BM+c}NfzIx-Q_WhghX919T0Nkm9kRezDj8zau9IgmHt(CD4WEgHD z`9BYM0sSfn^mcZgv2u2JCLX|H4SqbvRY8az;!NESs?K5-SIcyApCvPWA(kHu8rflE zRXLYBG6YYEP%`?@PFx`$B7@cjJtb-dd)k_W0IOCAHG&Bc)e0e!RGntX^useO!+09~ zQPkh@1MWaYmUH$ZLxc!0ocn0v#Yn$SL`%1NYFPD3;X;K42h}8jlO<7!V{g+Td(B-@ zwJ6xj0u#~Iq9&>##wvUE z_xzn*9@n+@s87aCkf6_sXd&v#WH@%@KVDhZ-etQV}P%NfjT zHn{0Isfl~i3n5QBsIBf;HkA*#T6@R)L)KY>_n#?3qWkImUX*u!sITa*bte}}Cerag ztSsdhld&jR17HrT1D{mPzAa=SJ&wA(m5 zzMT}7%*qnJqd;#ugz`QeqhQ|{?Q8}^sQ3Q9@bfwglzaYqKZDMmq8lPgm4FPp@`;-X^%&qWj9> zwb7b3HT0>hR|P0mEyIthH@UobL%BZk++EY*W}VtY{xKhA<5qJ5SH+IqBv|cod=VCU zenX=DmogH8?SCO7Y5bqaNUxx1H!>2#zm}0?|9>naQNu{${r^Ep61iendci5uMLJS$ z^_jKrG*q>k8t$1gW2zJHI1AP6*4WO6xgfUn`n*v11U^sB@V1AxT zW2EdpxF$h^k}A#(Uz12-iD@3}^wgQEyFaO}%CL)cDJq|*v5FKP))>vI%~jrvfZaXL zu$VaFcJLVij;|VvaxWxA#MG%KbqbA|Di6NLa1w4tA#yMy~r#>%emA>MMlyOp%0vs&`UqAtYj_x zc>=CU439$5JV??E-Jx@{?g_DhRneC2^Bft5E1qT2Of==Hg4-u|r5pS<-`9J*ACpIk zUbojCBD$}N`O=%yN`!NOgAJ97TRL1JC#e0{*x?u<`TD2(i80ROF_J?u(rm- zu7KiHikbdv$B-aHsOkHI=gAzthp&B4m~hi(4ElqWwZ87LT=L^8o?$L{Y)0ZI1dsa{ zvE{#AxlXqJ+C>APpfN7(Jf3q%es1TYW5qC#dALLQ6J>=$qWq|!-RE1ScH*S}nNisi zQL_;S@oE6JJcUnwy>>l5u5R-O!M*KiKt2yb3M&SLZ$=*EbC!k40#0((?hpxZ+rdX3 z9))|Etrg01krL;>gxAw6+Rt(4lkBda_Y7b4#q*b!*ICxgNq?%A-6-FuaUSk@Hcde{ z4^vG|chtM6R;)7KdukH-ou+*&Pmb~Wm1T);_U)ufT=DKtirIWWS>O2zWWU^Q9eB8b zGa~V|O`vf$mP1aGB|@Lc-0C1#l2CFQqd)fq)mr^=TC4R-ZmHLiY@``&xG&zsP9iw~ zq+q8+t9N0%*GuIgtW*4j9s#4NX}{yx`lW4y?7la}E3_R6nrwnSG89kA#_c4@kUF

rfyg5f$cYH=-UJXU9ZE%|Zv(;u5GL%w zoTk9fSYscf=$k|3QvtUD2np7hCZSWOI&{{nIK0mh_&5MIYC7CO*>Y(Bau;D9=)r?h zBeViLcu*p;!w3~7Vh)MCTlXP+52esBsJtx9T{PYdFgU(U(EyYOA%xg%&Q!9;0>7es zD5n6zNASxBG6Q-T+54+nH)ti^EXwh&%+Z@Do?0Xr#bY%AlXzvu>{(IR4r|>Q6p{Yf ze;7s$3qlYb=fV#(=d(E0vJ5-*1NcM@-T=^v7K&@s#Nzgs)FO149rQ&GId zzCN}AFyDm=QsYE+G^F_05}u+$!b%?ZNwL;QjD zKB&rY9@#(XZHr!~dil7-azPvD8HO<2X=EYJxoB*~HztS&1__{4u;@9Y0&RSS(6kk9 zA&O_iH7}GnZol@*!Fk6{rx!pN@DVc#b@nNHxjOGN3`iP{ET!nPq5}>wKUs27X1Uz? zZ>2DmCMvZkt!r2eg}#f(vjT5L#{?tsvxvFZ><+ZnvvFHF>!=G9IK&AFXaH_Ift{A$ zB0B{jGb1;3WSlWEIoevU%e(8jbf{Qp?)Bauzl)I1kEDn&mg$i6>)tcYbvzp3qS~jpw$u z1quHoi#$hetwn#DZeTKPd!&>t{b$zTETDJ^Ap)x7!E?!tAg6aAi~_CxYvLysaZ*zb zce*xiQb(>qRu)-hLa)H5+|#qX#WQngW^9#dig9@=bI3_noDoPEAf$gwc~s*5uJ34m zv^s6E%$&R0R83_AQmI;164;@zBL7+zgFCea=k~*7HHK|qPLm(w55%c+Awe0u^lNrJ zAh-Xgkz`J@e6D_?94o;ZL#64PmG1aR8HrSqEdfLib?z$xlP@`yio^>^nj!(C7tp%) zq!&G|ywhv5xr}Y0f6J5=4OIc62;AftiN%^colWk{AADMyj!T5rGKTZzel!7^i=YI# zyl{J%P?c^(IcCVG_~|?3*Y{JZL2f^jca~jL=vx9$fBZYQ32~VzPbP3dvB~=(cDV^? zw4Gi)1U!3&W#cz$*N;l>H@~F9#y=TYpv<-(Ovwl}wlDG2|3&oQhV5Lnc}!m0z9!Ko zfzCCTvWbSPJDJ{|7Wjlf{X|3&OEYMe@3bCLBX{BQZV=G>3L)Trqo?tosuS<5{-HWi zFKAQpAF31B0Cx|B64jgdT?_ghU^Nj!cXuPsJ?ifC3XX~a|0U}z^+Ke9HQ-eSA(pi{ zE+uKW!(H!6Z%ay+<9z2+Sh0W5i}3FY+w@j6uxXVl3tnIv%O1pZDB+OjJ{_Rxr&ZI(g%aiVbcN&=?SUCwH=X00^ae4{%ah0nOTAJMAyW z?Jvh|pW_4fKdVLj<+%N~rHH>Ax4#^>zZ|#a)4v?IzZ|!JlC1xK!*L_}FCDil&)Dx! zVwiT~8!vPd8PQ~KPXV#6#5l1in0LlZ>Bd}lU6NeUw%J#5`Popf5u7Ec%PFReHlFG3u8mv=Y z%~xMo)aA`otuH4_eVTkse@Z>ne_rAROPtz8z~CSpId*LSOuu{ooG#a%>~X}qF6$$C znN=zFTZtg$-12~&=*Qwcl53E1&ZjxAXCvw;rzk3*#a3Fvt`;qCBkNPQy{;Z{R3$vu=J1Q{~(yo+ORTp^Mj+rEQJn z)AZlGc6lnj6WEXTkp#|CS$A#W%b@k4Ty#ZK?6~k{PyqudN9fHoDB7HKsxLSVs!V;? z&I9)-@DcuH>L8Y@+d|0Y45~z2AzSL9lnO3` z`o+s3(4_QzTt$i+uIN%joC_l!lDxW10>&!9Bs}{OXZzc=OQJ96hXOhNxI%~Kvwq8T z-{I8p*Trn|mtV|YBl$mC@AN*MA#|fK@Z{QR_*6AU0d;5_DF;C4xb$^KB{19Z0 zKT5m=q2nj<^gOkkuUB(2Ipo9(A_NcH=TXwipJn=z45ctR5J}su=;9mzT0nzs68O>r8f+#|r^>!B!u$k#0qVu84!~v$1d65T z(UqnEk)^3+i^EF<2wEYuh~%|^wl#ztc-abyK`;P+146Ca&Ev^PB-J`>{ z9X3A^z7P5ZFQL3H(dYqNWy1xam*yy#684!QnvScDz{sQO;V<~e8klqJ zY}wdPPc6r6B^c0GNCDX+b~}HvM`A`n_DD`wD@oK$i&5O z_Q)*|%*_LWxuHo`6n{8rAelRrYwM}j8u~30?W9S-eiQP9{A8BnwBj!Acj{?ML*)@v zXov9+sU!}=xZ4A+mI(m>eF%gN<(A>?I#fWk5LAi^0gplmVYcg~0gzrj5YQoyW=VOD093_6C;+(*2q`9CB??lk&`(O4i2*XFNuP^(1RAdW8GOV9Y9I=LkW1Gtq6gGy_i!*cpwH*lbwWhHb~&-YMk6PX zT**EhogY&LlH(OLX;Zwk*)v_Tq(2Eir#%u^?dCGg-cgKfEZunT??$}3vcLKgI39t} zFtZ@hEaHy(OX%p?CStY31XG}!d=yVTFf1%TGf>m{UcfHt)vV}Qs_rGwIRtzx1|yU% zU4#<{NGx9@`37;Ffy~MxDhQET8LqLD~Vv0y{ywVD>xF=gwjDBEl>vSC9-0fH91x6~=8#F>Xa>rcBap3dme_c6z z>ApMv^1^ zBT)$YTu*e4BvZGx#8%;m_Onqk zfCsNpkW)#%Ex(?KY;7Eo+o_^zNL`99ta3+>NpYFfi3{L)&@7Con@G9ZQ+&5gw-6Ogc0Do<#>>OT0@ohdA3e>GTrpc`*P@^1HUvVh-`J0p z{EB2>3M}6%QmZE_+^D1;L(LWl^*E2n;p{aBWFb{?IY`5A;LYN|Yv zF$pLxfyNMye+iGiej|V6RMync+k0IE#%7HJe((n3RNbgO$hZXd#m- zIQDZSm%=iZ+0(RI0T;^M1x5jJy!lq+TG}7>?`1oR|1!~v*k?Aqo#$O_t3pZnb(?R?!PqKgf?Gjt~(3Ls=v`aa6e{DD6N71p`(x^YZ4;!TI)V_?fgHlx+Ces=3-XJ4=2=UJUDzR;6r>#@GYojnN{i*a3_R(Xp zwu6VwO^2Kh?l{nn9<&-twe_8v#ypd-%=VnxrH}ST8Gqt+Ebt`>*)WB>B#Clyr8D2hG zwEIZ3J4pYQgrY9S%3tM!~^kIl9P@%g}zE_{bwz4Y@2fMfmkn5va~ z{wgmq@A4yu3(V5WW7N4N=9v@l(`s3A<5N;@y^vh%b(Wyy>emyeRQs+4-){00$*4)S zgx|w2c#rLMqtqk)>F~WQlbYCWS7KR3ueC>4O@yB}aOaf()RwA3~v(+EMYx*7{clmA<~T)v_Pw zv);hcrQmn$nFt95#sz+ilQ(|T+>!Vm`?mzA_a>*6cRFA4^u?leHS~%Tf4pcxS&GxS zmGI^cdOivILnH<=bdC>eZz(0G0RlWI6Hbd}(GEpkU;Co4e^ng4b6pB?=!Myga z_~Ey61IWi!z!496A91@8;E)Et_p9)rcM;lv*VEv67TyHd`x4#KrHz9 zX`SJP^%_a$Gj@aU7YI_Ej;2xA1R`f6LtAB}naV3Ad|zIVck+$p6~{x?9h8YKV=tUp z=rWSh-fW7*ZMjvFo46RPVC=Ew4a;R+0raO}LR@iquxjOu%8b)NPPiP9EzOK&e1ETy z986qlbqflenRV&OQIRbTCEODvM^hw&sC=>HnJ;>h@I(1LH@SW!}T$Bs8}A@K(z? zq71@i5<(f#7AFmq#zNSU*K{Sd$-qtmM9hIX@%t@k8a4Nm z3B>ztyajVUxfFabz{NaQqF~UM`+A$@wkU)W3n01&B?E>+!6R*z8QKw9X?Jde$JaS<%S z4M|=!bAv^=^xs7|i{C{!kFr0Ca2|3`eb{X#W@ZdGxjXGP_QUmmm*8$l5z_^)bR~-A zvzy$$`Bo!gRjut1Md6w)dhM1)jML$cd-91nQnPHmZy+oBeGy!=?e2S;_UPArKn3dR zArM$1_yF)Yo#sE-Tyn9)n zs}|*04HHx0!j^VW7@D^YC~q&0R0?^Pq|)>-L5pEX*|wjwKY@cHHe8TuYYvIok?y2jU%gE#E>sd_h>cxCFri~=#9`L>#yUA(Ki_1CT zWSb$I<&VqRK?lKO(POvsjfV(XW0{GZHI{z_&Ki`2I6!;jKzEj59Q(m9_SxuReZ;y~ zftS~m(JNpR3tZu54pCY5#`Aqwp zcsoVQgp7n~Lep4z&oBy~uAPjUk^a|TJcy~SSKQu2)}FfxGdz4sn}pAZ4AF23i2s2G zaj;nQZ?YhG{#_VEwU*9*ZqmX251Mq>+y8S4#6LnHVE>mX5dR2)Q2dJm@fQW+e;e}q ze}e+?=wDJGC?iJN+PZFe2|P<(;+i`&6C}Ud1k@z!eO^hlRds$!o(zWg;r=jr1PlBvzFQ;&n0!jBIOEm3;k-h2%Sr zrJ_mXz{b4?h?Tz9P1OFru?9`?GB|g4kW;WYs^hJS>^XSojg?{k#NwAj?-Z#OH>3&8 zH1$ZzGg}?@n@GFWZFq+eCib}Ja}Erx%DvRVBsr*m!4ECi_e!MOH~2CqD`(*45JZqV zsBK{yq>zPq{-%%t+B8&G~FEc72@A_S8oyD<@IVYj%N%uKrzN@v2bgRPmP`Ox1Bf5E*s1x2+KYNWtYVkzsgQJT1JR$Zo!J>~w5L$`(fIH9gk)hof zIpyK;AIyOs^!#$87q*Mp%BBb-aV_X2$-RW#A-M>%lI_)2CC_$!|XDc-Qw2^{@*+X_qqp8na+9CIUTo>-sY`h58 zOrO51P3IQoE}<`)T#R476Ahf}K>5)-@$UKp`x;lZfRHX!8?E;tPtVz$GN2m>r9w~y zd;_7M?pes-p=yMacg&)oO?H>bcd5J+cQFK>zJ_YUmUTpEt!1!OU)iTAX*Qxbh|#x} zJ?He8wq3@b=&3$E=g5<8sS{zFo`|NFTLM;IPCYbl?%I8E80o}2LFx3jw`HvQH8v+)|wl1tet;D;LU46BX-?6hQkKJ9ATj16keEW|~V z_B6APGOSuvP-zk1q0*(ic|}*ghmjT4SF?`XHIIkd&|m4E5r14$qNw*)A|r5up+B*N zm+)%bO}Tbcg|RhH+*)zenKN5?OiIv5jlyP1g z+cgiM`MIpsJ+I3Jupv+=akek7)K+vga93yLSViQ)O@K<2BRd+n5QH*PSP7KrmC?b3 z%*;EMV!!ks2_jmX9yYtxMF^phKaQlufJ+58zY*#cPK%>8^k> z#slsE!ZZZ%&9a2Oo{j~c*g_c@dCh{DUgJ;oP5&sNS_7E{L3AblPv##>Rb@RV z7qHNitqQr)0A8s6o&2Al&_Z0=l-(}@d|h~92*GucKlV@Y+M`GFbjSF%uQSatPinmMWs z4jf`-mFWtoZEqM1$@4a3eC}M%AX2>a#Ib(?Do5m?a&$%ea34)kwwvOy|Kx?nLp8g* z1)rvOkS>mKt?T$1*K(B|H9F6kRq6}PLo)BTs1$`A)f(N@V_uh)&gTZdh z-@$I{Y_nw8nWF0#IK=7>ec{h6DiC7TB5&3DQVmRYtC=KmlUkowh@I&?CY|yEy}S8W z)yG0w-)7@c6CZfty;9JtGhnaBIAQR7m`?Pn$W!)OqB%wrb-!-vNaf+%3e;a}632TV z01f-jkxKWH)!QF-CM}b8U(!JAYk!I!{f7n^xFh_Cn&t*6fOWGYOzhubm~oHq;ia6> z?;T-x_>S;GCgu73aw-m|5J@U-$3qGvKEuXOKBWXkbva^U(>K!vsl(Jms)dh5F8Xpq z!pM^ZGza0+1%kuFK=l@m<4DGXnp1zx8L!*B@(tH%t>!K{y=0oO^%~2uIb|^Ny;25` ze0MyX7L07Y{`5;uD%^{16a~SrZx}%EYesow@po?s%|?3&gWd}-zTrmakC+Q?$%oDi zJ!g8x$e!(YN#8>*9Y=;%vP+g)Sq|G5D!<^bJ}XDnVYfn#s56=h=JfQO3$B)H?k+C! z(37hu>6ZbXXh1Q@$;Gb}skPhCr(Kn}mubn)EG7xBhp*-8uc~B2&u{=LA1DPv1t9DL zg3O+kvAp+om91^7L*1R=tMoFFdqQd!s7h2}6Y!jZC~JBk+uu?l zHsw|Gu56VQXW@$nouG^ql)pe-Q2c4#Ais8H%0LDv(u6X=9-VC_%1d$I8?WGcS-pJa z9zPjc&ytp!|AH&wELH_VPc@nA4d@sd=X|DSIbYxJ>aGp8)L{26)_WO+!LNpxDQle@ zjqrKrN>E}iSQ0Oinp|8U)b&8SEnVp0Tt?U_mH`w_Z*}%kd1aDxgCUTApep!43&apS ztBSAlhVA^~5Pbj4b;pwjo7^Ttaky;upvnE!5oHf~F?I0Wl^6M@>>R53#D=T-B3mCy zsZr@m@4ZlfH|jnW5~SylukR@@giL~sIt=Tkks({_`qZY?^+)vONIx!~3xO_Rf-yzA znm`l)pJ1?jXV(%m&Bhf!BOc z4_H{C;-@w32l>PSO@fX%9QxsHQd+pJoVdg2Xnw_`ogY=CC{kV`uBJz4MhfC<@2wcx z$&kHze<|%0lniGV@Ckjh4y=51!!D@Ec}4KJ8S+5?4qFwO(}d3jSh5Rov&Hx*Cw>(6 zqxI;iY{4@AhJ9o_l;e?sxseFfU5o^n(s8xzE{zN2MBQ+*KW7m8`@}p_4m?-h!o}Y6 zw>4-WyukWe;QlnNpHpQQ3mjhXZc}XAPN=QkGPFu!g7sqF_=LG;NspEA%i*bOfz?v& z@SCMfKl^~2cOiVkIj!HGImf2;cRlM*Yc+;I8Ee|DAMVNd59YIx!^B->!AN;^1_|Gn zAtJs#d-K52HJaLaFjBs$+)84^!L&;NZrDPZW05LmVz=TEZ!_Th`64Sm2~_48b6I;n zb=d5GqrRhL-+ym&>oEfPw=&x%f1KfRcs)-7Q-J@^cb;^(;lTEIwURedNXg}cAWUuZ z8gY(>rIszV+rmX_$_xJzl@%(bJ8C>1s6Q|!y+`h#xd>p_h3#%gO zP|UGz=cL-BRNBrYn!@&cJzSARpbtW#-jeFTAyMOSNR%TtYW0;wWC(<4O3I`4o;D{% zEI!>&%a~#c^_f%UDwrlnMF_wu{TTfLd`jD)U&7AE**)IYNQ(w_E+K?JK)+gqxBDi4 zWGElkrD(e_(0Or0Kg01-NxkdDOa773ev9_mT-Fe~6CFLqmwQ_5l8y#)nzW_IST3xM zlle&v6s3vJCLSDs3{=K%M&2Rs7v<9>YDsOLU#kO6SSn~R6|~=PS?4i|mK%e4^XFM+ zoEm*Rl!qjq^xKk~Wr?w?CF4ih1p$QICz`*Wr;jfhjE!82zg`M1i2a#jmjnedDiwU< zXveiZ#`_gJAOVR8c0~{^#}S5I zR5L(_#v7Nkb^kfgpbsUyV@4vvB>%lu4=*>o3HUM&-L<9*O zm|lv3?Y!z=?L5P3>HvgaFYbJ{b^BXH?^MW!B-*D*zv`C0R?#~W7JJ7rS#iC`32+1y zPM{zuEDl6KvDf*Ym2Th;5q?8&`u%<<)XCk+B-T{vVmKV8xHcridTgP5kCgLz+!cm( zjHgi*Qb4Aua|L-5dMq~UZoxsXXBpp(jAeh4ApruRu#J2Drw3p^3W7lTf%7dtbD!T2 zxWxJxXzBw#*RHf#mqm^&H?xVOmLx`byXx6lT$a2f2EU6_D%4aI zq9CsmnN60MfWgl4+FCD#v5%o21Go>4AHg<9q$u>XFabxi^^YMNdcBocAP*rHtrz-J z#X7BFMA@Z~4iOuy@qG!4(kZ`vkHHc$&lj+gk(c*v9ds4j(l&$2!tbZEV=gp^}cWAkD)ZmQ^E-o|Xx?W$ga zno}ol@}}R1sU#_%c`a!+GNm#~7yuUOvJ16V;Wx^&@}Ckb1ZH~^sZ2ui|~e;xV!{Fs*gQnpE!k?$Z`N-{wWIwiD-YMQ{3U!>3=f zRC%>VJ4z;zZ)iHV@-TBZ4f9KNTW|B*Q)B$iDI|YYMTK7XYeUz)+OfZi z(5PV8Ng#Y@II-GisG`T&0mEDu5O|nNl+2C&+KcJi&LZ1)_KE|)cE@CCqsd^6Y>3!u zaHR0_NLSu7OA}6uK}nXdq<01!T8Cd^6K1Qai%U$^NI4%l2OclQ+Y|d@z7V2{Qm%oR z6;HOn8-Zdt!6^LRa_kl{kC9E>RDxY9i;ZFjUl*&blmWI1&<8N@AGEgH+>RdSRmwtp zq_xV}Uz}cs9>u*_MS0MtB&H;$?kl0pA3C<3DP}jH7W{CGMNkX1vPJdKOjDv#&?+pO zVhVrTu25K@0^2$jqKYG_F+0?jL-Fd^IocrdRR1d18 zEb`Z?i65|4SHxSWH2M@*Vti!~4dMf%WeX#T8Yyvg4{vL~$X>G5d`Wa{-fi-FP3xJs zON4ig$=w0@mZMF%xUH%Na+8WQo3IsnxOwTF`K(o1%H`8^CecgCr#z{ytFsGEE;evf zAY7MOoiO9u_t>Ya(VBn)1=Jh4t=f|S=%aw@A&3DSlu%_vJ7qvg8>)fm{u;>FhKeJI z15g(z1*EF8`^sIp$tXx-dIOsy>&uJ7u4%2Y17}r$NeAkVcr^!ncY%uHTSvevbqg$O zkU%WER+*pQWC1mPP%UASltb3}ZgIK~B=Li4iNN5@!}Typ;F=$-U5W#5*r2)h3K+$S z!S>nxAR>7C>@mE3HW>lT2teN>8){>716%A+R>X-JfSd!$f;jOFn0*2zM@WeignmGX z0X_;sp@`Z;K!^vF2eI-tkYoVm!+%8wFEd`+5!SPc&VJ1+3ow!;ASb4*%Ke4j$I3W>8@^9Gd}vYI&Z zMra=CdjdAvOFTVhhwopn0LZHYNN=mFar#uD1qTN7Pv_j3O8e=9><1Mo^ z5^G=w3Kd3R1+Ktf<}j2|;b&#H`my`T>BoAKWYiBHc$`YSU)vwuYjx4Oyg@%_Tsk?G ziVtH>kx${^i;c_dvKCH_w&Wy%c?<2>UTL=XXQ$)~`E=uz0;e+e7qX^HIPc@)g)C8P zPQRFbo}<%v-Y|=HvQ0JN?xHfJ`Y{=LEe>v_+=p+al(=BZU}RjM@3IldVf%&w+px^TWb zv}WF1{4HxiI)9_WQy6#27np^Z1VQWOzy@>(E&Y)Y2Wm{4)B{J;vxN4w8&*sQsdgF6 zNHywmcfS`cAvHoV*eEd)A*ERF`PY{iB|6Wj)3%MHXok;w&GFW9)kvtkSB9F!Bjw*0 ztZsT?8K$nS$!Z^?@mUPSPF^&!><9*&WKF}A4ZrXYEx#!^)P8IQ+hqW!{T$`aK=!lI zC!18sdD!z`jc7Huj+u|$rLIf6*)Yx=jJ=L2j6a+3C=u`j<^hh4A1=yb0qXvHssw2V+B-$uVSkik*2Y?p4bzV#}~ z+f|;J_G&yuuHXSY3ja^!yY>g8-9{r>ks5^DFvb>x$~B7zTun~m2FCrLd5p|AFt&R* z7TFOY`Q9Rw>CRjO1~p;uv_=Ry?j7fgc)bxitJ~ds8MxcFh8;}VScZjtW|1Q!POvxR zM{)P~jhI>HyoxcWZFK@P+6$l72D+~Iv}qQ`m+n3mt#E-jTz;0FnX*|qI&w(&Uf^|w zrIVVkmk?~S6b#&X@!@0ehu|W_h%{${FVnIibFJcdW@Vb5m6*0+*=vL4;kI65go;A7 zv{Ums{;t+!6M|e>U7uZ7n`c*spj45|qgekBQoP)*#DP!ud??ZQSMIsj-QU*kcyr z2K6Flslb#6z5}!sfHM#HNgL^O$^e}3fSz)N1J3PKv->I{C+9$*49l;8(#7@)uh ze$YC^CR`q-z3#w{s2?RWkb{F{8mh`xH?sg8DyRoS3t-I(6@^VeFW;|lc4!W9VUWy) z#})+w6L0uH)Qjua_GST|K&33|^A-z3j}Mt64(QHRl5!F7-=UlzqtFB8ay+yvPu}w5 zZcUkg7fui*R_uBHCjNG9@{hgc%l1isFep(0Bahz3Z{(X;jDrUyI-S#wD^m@1AGc`H zSQB0Ca(c$Wv>n)q!p6=#YeybCOqomWs|fRo+`KEw#gns7=+iDcUP0hw6NnR@FTsp> zr)|Uyb<1ir8zG9MuBD9+B-9?jO3_%mL*~Z&<(uUp-qdc7!Qm0ZJXQ&DtZS&zf(lk# zr?2LYjEfus@;kIYUz_H0@`>RR2#j0sLlqpp=L*92LY-ZbZsF)_RL(XAnU6EH6)V!9 zz9;+hUG}&iRS_jQP9(Qc|2pK&|pl-7Mj zJi`6?!qbAYwrW!AKB>RGV z>2Ei0t_w@x#A6pgCI&_8KyJ|^72aq>NjBl9@ISpKJWC#XA!v}Mr7xDGH$Nao4E;bx zACf=7Ih*i)hIHIGWvN3{gDJJ$LS7v)JSVL>2dEPSzp!obfL>ZC-`!q0_<{w)L2ijy z-B-U=tf5q60M`?$h7@;I1H2c4Dw=0sUmr-a+#Sg3o5s}$Mg`yN3TCLc8o6O2&}yYy zn=n9-O+t>{Us4@H-JVKeu=CQ^?q^Wp&=jXMPl07u*Z6V<*(YL|ll!-H2dyLEgAumU zKskA0JN8ldIOSsE3%8vpKbA$hGYf!?9{f^g29)Tbq>%T`>9ru`WFMrQBs-TDs>q=E zAqiT$Imm!`M zkw_T6XLi^ni6IT&Gn4wgXO;r)nF-Af!&8#X$+ZSaui+_4?k|v6+PUu%brYb@3y|{0_4ZdQC5E@!^twIkKkM4C{{>9Fd z`!5muCSv)Qi2av{{r{+lz1J@LQ=2V%*j&aZhf^@~B$tb~Dd)+8Uq|L$!!g5zy4gwx z^exuui-_c5%LSc}K%u8J9^Jm|L4FwY@Kd`lOyeem@Zs&>-j*?UXc%$<>gYcT>r!5@GQt=apNb=@Cgb+IM4P)@Y5JDOl zLP%Ltc-;D5hY)hW5JI*U7(ysf`5i*|H!=v@|2cyo`o9oD01zNhUIc33SP(pV{>T)l z8vln(ff~~9kbokwB24g7`Co(r1ku0#(@;Rhe-jE29{;yP0m3x@+lK#p&;Mr)fASOn zO#$*x41dOdZTK6#VI31H`Jd>!beDhWyMO7sf9bpbzP<|^OjQ&DD}9gQl|GS&Pr+Af z+`m(^M?6^j(E5C?=Uo=h@YMybf3IIylb~njQJnNQGhU`>axQ=G3TOJ6R3y(W8zY5ngJLD z<>7W@FcHUr;pekXAVkx!|439r0_^m;fSta30;V3agAWA7s9L+v;*P+9ZSuuB=}*Z) z@-&NONnWuke7KlVbk(yGAdS4MW)UUnddV?jOmlu_@@yrU|8UpU1%znwc3FDP^THvT zMbb=2$64jI^J?Ml7)M739}kNwKs7W+A6dCPhiQtYJ$` z)@jcVNxXfo$-fo2(2GC0*ZKdk_tsHWw_m@mASo@m7A;6fgLFzuBS;EJ3rKe^k(SOc ziii>t(%s!HAl=dpN(=7q0(~BzH_m?d*k_M-pK*T7G5D9Ei@|;0bAIM^W$zoL?~TYd zA6qFfdS<4Joi$MY6mMF>1)KKv3{WP7Y=DCsd`im$WDZbL!eBRto~QL=Q~Iyy4o0cA zFsx|LMB4!c2Phe6z_W0GDj|3Pl@3rY(#S_&^u#;TDT_WSeLOpIzkjKD&Hwg{2LKdD zs3dIfr3KBit-If(;}*W+%Z!-bF^dS8xoKP-AFeSJj{jwXcrCP3a-ZP7?DS znxAcb&|tItq~Oy0;BY|i(Fm+lO2dwT(c;-CNUZdBZICyv!W;8VYxBzk2@$)dqoX;79TssGUifq|QFxUVC)LUKv>@B1;3?{j2r;IYZ1^eLEG zpJkca$39{X{8V4g$@N5&R)c8!mBh#P{JmK+HEf!wrVV-|PD@_UQ&BSx!VKcp5Q?65 zM53En4+S(COe4re(mMx9%)_4~tWpBDh3gWu?(ASj?YrfxMl5i%pm@r5&Fk6u_8GgAR zirn*3eZ1;6gPwzYJf>a1@i9k?449K5*k@RTskWx=3Q$~pz@yjewZ$E_1DOfso3R31 zQ&-FcE1lN|+6y2v;RDD_IP|+_CfK_qYtOgX@43-<=X}Jq^#*J1*55cuv!Yr;L)?@JkS*` zl9EH;3d&zW;S3yf#8vLhfB&Fr-N>_k;+({DH9%YRoGV#Y7NmmHc0nVmWtbzb-iS0H2L0I$kgaMmn;@03=(hPO`6)H4I9+os~ zb5D`4dfgvu#T!>ch!>=&)31K>Vo=3FpFo=keymH2OXWMSe}1tFr0f>uRV7SB zUAM07tgk3bk*Hw`y?$zFruT{sYI(|0;fsw=0ngTv;A}iK8Za`Z(&-PY9t#Mith%|d zlea<^#}A^}pDYK5H1@c&z-A+-g+UmF%lRtxDJx!Xi=GV}M)C1Ey+`CZ|BYOVBq;)uwh?})%PQp8?ja`%?Sa=esk5*%|eN(SRCLuLk7;`5d!`Z6xO`Rj6u6rmQsUm#5ie zmB{nx}XcJ?!Xn{{gN<9#+9De-h(TS}b^8Y zNJT5`P2?|(0v2OlsN?9>^ds75Ju|XC;?5EY=+UUY9&B}cF7sTu_1qa~H(8`3m-b%5 z&DkH}=Ik1d!9!jTh2F|N=}E5qwV2baIQAy9q_B%d#DU1}85o>n@jMYL9tkXe56xV? z>AAp(&}l`efI1J((DJOS9q_?Sw6vWxifeq@{KuEiWHP3WhHSM~A`Cl^-xnv7&QpitChwoC-YQI#emy*nC1<0-C{cLvEaX3 zNAEAv8?|^Rl%8=AQakE@w=wu$PN)Yvb0|#$QLWl;-mS;v+8j8lvKZHuJ8PUg-}eeT z(~&H5O;Eb`fdep7_jXSl3>E9FyP^|QQ@(=n_cN!OVq4AdXcDh^wQ=a-HQ%_do(nrT z55s&{^5}|(F=OhGUC=Bs7W{wLZX3E) zgOh`D4>rx=eq2`~|1RVxt<8)NEBQ^<7c=2Z%YtIto0-_K7o|uwx{(Y1a;U(G#+kW@ z&bB3Oas!m#>k$peTMa5+ZL(c&*c@$9%|Q^n@qk@%d4w1?7!vi z{P)!v_TO@M{`=|-`)|2B|9y3){ny?3Uw7w!-JSn+cmCJi`CoVEf8Cw`b$9;P-Fd

^_sUFtVrT+2GmulsXkZo2HbrA*WOd zT!TqMM?-#)%4^K^>hmpUywl5kkjp#tB0ZN4@VE~Kr3yYJvE-QT9qsuhmtZA@_x=a!xC+T;Vg{S#HPNxwLEgd_6Vf+F2L!%b!v~O zF6JU(AD%j(JwXCK+k=Zs(<8tIJdbr3DD;6s32h~Xs!ZAEHm%vD@ZGJhX}grboDY;7 zp$2%M4OIje_9L~S_eo{4H&{Oy4}sckdNuEJA?VLfXJi>SzmC;)%LB98P)Ss`rc%87 zM=`)YBb1VY;8ZlkiJac+>w}rMfD`y(=>E|B$#r_R%F4JQx&*M^0~cC(0Hu52LhD0- zoEK^bb=5;W_K~QlNFhC>8E7J1R?!7Ap4nQ&>lXqr3g`oB`4sG8{>Luw@H*I*?{wAb zKXOtbNwJ!_Iwj4WP%dHJfh=2RKF_S zDi~nn`gW(-qUogVrRjrvTTjsASgSJRP%4|x&q=yyuJ%viebvvdyulWH zpww~d@L}?6>no`vcb>v&uH9i`lL{zxJZrj^I`Y-@Gw&_%xz$FCJRS}l#@S4s@VoEX z`ie^Fy>3w|tf^I@$S5o$2))X${}svGUJWgN$lKWBtolb`sUEpKGST!d^r5AUl~}rJ zEmfyJ*qH@mZ^yBpeAB!DAsnU&-c*#-ziR&qbVhN*WVB3M&yem(L8E$pS)feDUNxqG z=a`gQRS9dtYo5(Vou!Y7d*z+DcMBPdg<)mNPHJSi{mO>E=V&d$9qha`u1GRMZc3Ni zXz3-Lnw=_fWiL@2Cb);pdJ`G%fRu)*18neq* z34+Z1ZI!ZAiKT3fpr<$U{a;nOFrdB}=WK_2yPK}P-TSJgCpMdz=AGbPUZ*Wttpk0} z3lF6`oUvGe-O@Z+dw`}N`l=!+Ca8QXv=0}(T zn=h~||H!~ekCSo4$`=;@R*oZWiafTbniCgDmXDd>y*5+6`_#KtK+LV+^6Y!x4z96| z)#HXAeHn_jyzz8oGfvGY-$c-u-X%SXDT@8(E)tg&ncBZ(Hjg@h>zkBc6|b??i)4coxI!ab?DIk4R(}o(8v6$% zJ!0zgWN7VXOhIzg-cDxd>5*~?B4@HrU1^bRjLvV}kLbUUJD`BN%grBXHH3?!YjEA= zZ0bAJaa?m)u0KodlFNww&4Z4c(sV0LjQ*U26KwjVQy@b3oqS=Bu#qLauNneV1zG_;no@ zWaq_esUJ*WWZ?f^UFZ-FR2EkIL9Frm1*R@3$)$hq<^e z6AA@PpQUfzsrlT=g{4$d??$k|0(XqZ*sP5_GFa>E$tE=W6uB1xI>swxAhuC$S*>cc zG=OEHI`;HS&1&OYRPTlUuGyS}`TT^w%6)`BI2^c1qDxA%6jn2ZhGgxGRG7}}i5tx}MANCuOI{I9YtZ#0ZL&Ok)}t1U;FP?)_8s6byi?}K7%sr1tmQr;pD>KHx; zzzKDPd+ZuQ4^83|&Xi7P9DjEMnMlF* z{Ux&?QdxjqvmLA%{07$XqJNozKvkw`Q1qEww@L5YW6bl!CmMbQ+wut%CAopY6Xn$piG*a!Sr^DO9|W;r|j+M2rP3+DJ-Uqa1uo;#O?an zl)HZ9n=~tD{^Y+%e=I&paE33A(RTx^y#(%--EKpLZ$p)vq3MJxd_p`efX+X6f;V>j zK6Qbq1fH~q&F;_sP9?~oUZoPof;|)933eDf!v6g_!mjRj6=5fLKDOMLpU;SWG=;tH z9HAoBlEA_GBv?tH<6bRpQI8Mvq>pTm>;eC-(t%XgOL|9J3y+ZCtm#DUv3lE;eSz`x zzz4fcab2XW>DZY5xTVQ9m38TmT2F&P!F8B|X2TjC8P^d7HaGPKO0~2#4FBLjaC|bP zGJxf@QDR;-jPw;PxrBTbP0rTqFL+k{MNGn&6Pl2E2MXQ!HbXtm%kX^;ocnyFlN!QJ zofI)t>%^Z@tJzugkK!_VflB2c?-qdg7&Z%$P@ex93Lj? zd{4HkeX@(+aLHsw!6p!O`w{u`Sj9TH@j;cl0Z`zZ}Rd+Kl3l)i71~pwv2#%zI3G6x_PDdZfARI21}hV`}EE zXo+=tz&x;$Kn6=m6m?r62KSd4xPR?0yChx_aGqVP4fZWeRg}i?F>f_xwqzO`;!uF} z9<4&%xo%jq+R!Pvt{mUCS!m|L1EKI+D}K-SzkkzR6pj!HUR_Dv;xax^mSuV?6z5Ho z>lNoMK+o3pP0}DP<+dSPT;^>`QjeX+)&K_)9%?;x*At#}tDSS9H=3VR|p+<~Bn)9b4#*)HGUzT+(pNW^VH&_C@sM zA5L>%MRulg`|nhBD{ZUf3V`=g57$f6S4Ur(+z!D-T1q zzlpy|s{qX?WPh1_GpMH@B1}u(*gI&4%k?!&ti8$&#-8}vzBTrpU9o3SjH#+LxwN!h zJjT z$!YN?nB~Jah2$ied1A!_%st7@V{eJJ{=98(PuO!S6L!;SHdzoQZqP!9+9sUm0|uUL zPm=qGY*?q@WRb&K`%t~63wB|qNPLNb-ty;N#WQ<`dNKQ>+(pS z?gONuNhWcOltHs0UI|NAz!Cj*IBYC%)_WPRCmw$cDfvPSiG4_q!D)E$bW8(__B4`uF+i9e}$QTnX zkFI^Mz_y90h*Jt9is{cn9UV5CK6$YM6L?D=u<&6im1%NDz#d%ny0dt->Lr7vK!f6N zDuQV)Acv8v_4&k^F*G963CDM(VSiv{{D!=8t!4z%+ z@p|m!iyKAwmC9KqPAN5?5b$$Iixq-}&_+m$17H>9?+g!rEhvWt60`ihpzNF9@Hx$_ zJ%BghoxK#$n;Gek&ckcAg-Yb+qrOu&TzKZGC&uO?^C~zqcKkInj{lN{$JU{HeY;tF`A6wseveN}*MH0Xc6p7LIrYTC zZ+Gb;%lc^vr=H7HeFreOh*E*`M^Ww-PU=dZ`Lu9|(!*r3$~}0BW`*U%Nid=XnxoQh zM=4WR1ymS-`(FY`^pFS6V!x`keT8}4q3ygm%RX+amivg7ww;FwJLY6|iK-)YDj74< zUF89q*kASZv}tZ;>y|cntr6WY_O~?o$F+uYZR6@z1LJ>AjZO7O5zTD7JshRek#Aqq z;~%%nWG#B9G~O2R^Pm8C+$I3=#UG_5bldUQoS5=vv(`Rs^kW@5p<(>D#x=RaLhiEi z%SP^b=uEHhK%Ut(;N;>+p{^q5ri*&FkmLvT_h7-`-{9pU(6OIhU$RU_d%XD)z`tBs z$nY2OsPqrb+CtCbU~$yiEUz*WH&==XiB-Y>vm94@m15w0le*aIw)xlFtZCfHSih&l zk0OIoyF)j`2~@x_u~eY>1a;P+KhcZ7N(<%`;Sx!IOm@uvi1PSNm@~<{3ft0g%*+pJ zm*UnpoO6!uvGUq&h&`4s6cmFfWu-fY*k&lqr~}vsbtgaPh>cB{4w~yz?l7cb>G>iSzq)9!PN$%(=GfQF_XY+T~YBJe#ZC z{p=u`R}}X@M-sXXdp>y*drkPYtVr<7!}`p@g0*j#2lm6rmU!#-NrpH;m(S$)6uc>h z6xScG(lehX@wy~$kWESv%J%m-s~SWpaG0ESP2G%QW?+FFz2i!eRYiy9&8I6kzJeUEy(=O>LF(<~dzt7r zo2`TA{^IB%{5CLv96iv$aB;$m2IuHq3DPeP@cto4hjaAKl)bw8L5$ul5TlpD0b=x| zGI*X?TgKo0&UEk&CX9V_2}&7=BK@r3QU;$u&z~)KDIzT1R}B%{w`wp+5csO>$I zWMhS60&WJ=d!roG9eIW*wEiZeD56TOMAMY}5tQUn?F;nhRto0x5UdY*RN`+TeOIQ@ zJ=ZW1OI~E{%YWd_uJaAwh#fi1Nj&Idimzmw9sy`bPicLB8|6qDCA3)7=kk>5TM6)E z5JaSFgsQOlO{RX6D4=6?d;Z(NFfwBB#*A-J8*X4IFuO7^TwI1iK?8$`>vL;eP{2^4 z?o6zFK5Lzw|tjZKdm6L*#rnbreC zHnuRnOPQp)5uG;pj!@EjwLF+tqUB1J_{)*s!=`(@t!}^-J z4EMUolACTHqKEMfxP#k{%sE>u6Dq1amh=(ht0`V}bnA-6pfkVRk?2Nf&m za=_LbsILco7cgi@)-$*I5<5VpT6w9<>*)!iV-KHr=hHb~ZU*0}8{I16m|3^)c78Sw zO6pZo*Cn#lR)6$L6^;ntRCJaQ&uF&cd+M`^LfOmF#(oEqYbZ`DJW6UYvLikQ*;eVi zY1H;H65S*@Rz@sApv^7FmIyUB@qolrN(~4ff>7|;ip+Yny$!E`RM+(+ZsO>59Q|&K zDnEO>q%szlv6fS+#8!*g_bQkWuRyF}itt&!0<03SnS*dqv!PBT-m7U0{zCyVgQL}j ztRwMwOf`4<3lGpd2T|g#$qhSvoW5*VH)FoST3qGVDa~AuoL%U6SLG~S?mA`47_;gY z_f<7QhM!{j8p;Q}uZG;mhjOM{PTHLr)=YTCnc)=RHTu2)a!(=6^h}?}_ zi)E(}J&ghU8VD@{D!^9*;k>CouM3=ZK;+POQ_CH1+b^ct0Q=hzc5XYXpd3Q-J4$5& zNThamRa(m=`0YZ;jh+a8(7PQzLRN^q9fKWP6SebY8OI_wX^xRBC8C@?SimFekOr!HT+b|L(kM6TBaecSES8h z@s$CdZvd5a2qRQ@_rTAxK6G+T(6oxfRg;X8>p(KIM>g|yrY51uYJb$`tRlU02s3P- zr&oX3rg^Za-2KL|oVZ(6OU9DaPi~9HH5U`kK}JKwA?aphF)Ls?Zvo9Z8vm-1#Pf*} z@4AuHb=5}-r33oI+#^lD!}~~uHC|tT^^qQceI&`mzJkx8td?KkeI#KaUQjkAZ4}-L z4dK3RMLQ}Biv-u{LE99~FWZ#*ENGi5m$Ci~vfZk$*=~gAxyu@Tu%jc28!M`hH)OpL$sOd>Wu7R`}v6LKA7kULZ|mntfp# zQSCzKE*$Rmi|v-l%uUS$v5#t`zlX~IC40xjnAtCO8KZ|7ZlZF#@EiNpN?J=D!li## z4l!!&mXkPHc?dL>K&a3t+n5A*(92wb^%4jL;spngKLLRd-idbBq2n9oA~UXeJ|yHW zC%=qu?+RQTKz4C@2_LCYsv6e`J}ek#zWWqpn*72b=tch5QxTEhHX0e?R&AfLrP07g^9y;INmj zG5eXHyaxfbU})|QYolt8uj>t?FO4~H9XW~yR%AL<<@{1>u&TrQq@;0G!HZU(oCDaI z1ph&5oYy>FHt@ESYbriTbVe%Pk?JdTGZfAnxKyDqeg}NCHhB4Z2se{51>_BUyoL!x&oTqtAVHC@cIq3yEy%}ilLk)mRzFMJ z@{+q7XeD7;_XdsKZQWsnRor6&c#;jlgAGXWhFLrWk!_bCvQ5Bauv{5j8WE#zZ$3-F z2A4+OnNGoncPn(imPT%4zMwlRLbUaW47ECV6%KPe(*TEeg=N$NA2X;a^5eC&6H9tO z@={0$1oq1$rE?mQE`N(Ki2hFS{2RD4GGcZw>MgLDT2J-bsPiDUik=prn1%?$!dW(4 zFs~+b)k^RQ-7Ks0-+;XSz` z6A^%9B6(vtnMlsMePRSo?p+f0B-^?;m#k!=KpkVnZ}<6ud3+fpFGMyh=9s|-;LSkr z2}NJH4VhETSv3HilGDG424lbuBDmFXzqrg+3gr*x5H*Tgqbxnh9D@9lITZI7bBKzw zuj9q6R^h#QX5_TgCIO^Ar4Mw!KaSp4Dt)|$z%bDI~z%uw$;nCUgKA8}6|D&nA|&WOELUxqDsYbIjrW@2 zoz$f*6`Zqccg5KavKl7*ISl9Qmi=3+<}P3Z$}%ahiEB5>L4Bq-Yctw18!Jd$L+o^V zBKvekcAf{wX@e*sBmwU>A#?zZE|d(olLvtyL;^y2ko#22RHSOA#3c47k65F^K7G0K z+P&-?fvHN&Dr-aFRea4P5S0f}<_6-6>R*+Tc(yo0-dHo;{E#0tK z!jH5@B7GX}L*fNk^X|pdDbzcIJ|yxN@nUH}6akb7{GZAsfN~;M83J*O5E|^=`ac9n zqyQ!%lpWI06wsLx>qYiw=$C-cuWXogr>1R`O!&^=9=`zSY-vb zUClF|Ch!FapZA#p+D0Mb2$aASAryLV`bsTX5^VchEtzm;B%|N&YFK_2ynA9+j6p~da)4)J5DLOeMQ~a~!LcJ>d=^WJ}2;s+J zZnPE+{Cxb*P=gM4{1{c(#RVN|i7kf*?V5T5xEN4U1bu)R1ImMVzz3LMK)H$X@?m^4 z;jH(t>=!MPsHJmr@B7=nQwIt#Kp=}MFo*%YYe@Ok!@x=}g?M7Z)Dxt?-}+5|k04~b zt(|H5l1sRSqr8W%FE$gTzvH>`+M~07cy*Raf!V$2AAr0&?U^M0SVn_cA`UJ^OdtZG zribsw&}Vbk>;yXOUwtrc1$_G;1m<6R(Og#w%a2z!5R(h|GMI|lpI+;C*p5p`VQ9Sd zZuEteJ=fXHJakXZ`qT+b9;{%Jy#xi%pV7lS55 zAydGv2|}WT5OvLs|J!@07oHAs<586@m&ucdi^%Nu?p@@qBa&r6-BADV9`4EJAe8Nb z-b2snz~9|Zw|LzkSP=Xr{!3XpI^u3I-_(?4Ir3{USJwi{# zcS=$I;4C2)MgQ{ z!?dJn#i@H!IbRe~!rf3;V7R5G2D5mxAZFfIU2GsyDK#5JGWY$Q%`*2W=xn;E%-VE{ zZ~)xOH2Qlhlk?K`dMlH_Gu{&g$K+^@@8wo~chmu;aqI;rfIJJ~f_0SQak~uEK7eE7 zsq_Nb9dqHR(d1f-yEE*n$=8^?fjd8Wqu`i4J~$>XqNQy8)z5V}CU25n>RTp=$&-$L z8A$XSlUHzT?{b6fzJnZfifW@d!H;_Pxbaxjz0(BS%dnT4{ms4+LRyz1#D@L{#Kei1 zx*iB70<5%!Hneu607Vr<5pk~%IBkQ_LI26G`|t<94w&5p|D4JIXPe-O=nxg2U5pX- zhdz4p;zj(E_uT5v36CYXKtoWVf0%kpNoyLQW|laq0ZyQn3x@ zV6o!^&g##o#dhHVmm20~FySH40n-#dL;YxHG{*;=x&RvSa`<#}0#9#FU^mLWSC!*D zau6Blh}opp<|%%@^jKGkY98sO3^4Kqe49=KlLSy&Y*zzH^)EFVDjaBm-dR`x|0wu4 zom-L_PsV-x32tN2j(!JsH|K)x=3z46nJW$x|&eE_A zP!&PMVb^KSW9M1S`M6jVwp!k-^OVRPg^h0T3H(instv4Ilk8-s9T)%TUk!yPdO)PsGz zz#HsGq2B8kGL5mUW!}LB3-`j77yn42kkA# z#llzUwy|q;Th{noaf2zW=Q5#Ty6_q#E|U6>Rj`L(Xn{%&Q6ff3Pb47ym2Dtdx)Cih zWnC*=cZ`8HYv<2P=1vyw$5K8I1F>$ReRmBU4{y^6?p6z%q8D`q`yq*_@^@w{In$FG zL*6nQXw?^b8J;$8Qr2GXYmAA$-H|4a59He~?Zc(f(114cD(Cpg0)s81hLuY7w(YF= zKgpL1O+^QM-dzZtyZ19aE%?Czk1b@?C5?u4wN+f#Uqp;tJ(!yNum+K$;}vm8?l5Q5>vszzQ>L*iU1}g}F1RMC5-Cwd%3Bo& z#nisJ`K9Ylo#KZa8m0v5?rSG9xESU!u!&@=;l!8xm9K4(!wCC!O*+L=EAg3M+_+qW zd?nhcO0T_{zo4Vml&7P!if_N>+aW@2lEUlT0B}ALF6vKeP>VkviLG9P{H1j~LW)V+ z90Zt`M-Lna!q>nu!8NeoR%ALse=Cd$^pam*QXH+G{1Xt1C>s@Ka|rwy5+R{vBLgO(V$s(3ZSV(OQwIP;gP_!~ZQiWG5> z#EA|_6>lBx_R^o7iLuEAeR&UWe9#4UR>9Le3NhtT$iifl4q(v?AxCfon!ZCI#u*YW z!Xf4pJaF(`)kFSmGlPu3bi+xrUl-rh8hxF6TmRS-wDed9M_5<{2U(eF5UntmtcQ0* zMSS@7nJznQT>2Cw6VM7HPYHQH6E1swi+1&I+wcw$H2@KTDH_AY!dJY!{8%_IuOjr9 zSh&Ijm#t+8h5u8R=aUqW7PA2AVS*Zy!3jBB4^yhC8lv>Y)*oSkr*(HWncz^JA+!DG zi)J+%gt-EajIHF`i0eOnevl%?O3dG(iaO+J@Hs`J_C1j@mR`RbW;b@rp*!$Wqa=HtG7#=f=srM!>iJUy&nC2^sjSDph*Gqr?&rdlYxv1} z=s#S;byu!ooL{ctUASxbmmP+iJQDdtYLvH^D|ZeP>r9%=YYpm|Npq!h2_Yvb=cvl{px4E&4m; z3i(;{JLD?thsx>cME1bNz*P1$vZ%}FHK2eC<$@Vc219GiXQ|-m+9+0uM1BnyoUnDJ zS&;sn_?!N19{rQ_ivCRor+;@WOggpw{0^soZ^x#ds<9R$rpZ2#2>nI>elvE?C-{OG z%AXN6z%b8s%V$nVZma9&iB}IVOuC85d_hcxf*F<)$}WByiqVV7Qg?%socOjD@9jz~ z;OjAXB%hc8)>RNX$ja9|&E5&Oqz_XyVO5udf3v#*zIF&1LK^V69XyfwJKNPKkfq7$ z<1lEyT9(P0>2Lcq%CQbYbE+eZmh;Pj>~`=(HZ{#HxWf{(xh=xw8r?^(V8E>MiM4z#arD;QhhfaEsV9Hsy) zw!vfD*A|%12hZb%(8>OXts$Y+)WF0DgpIp7k32`iDVXoe2JZ95crm;&?BzxlmtgyC zf0u{%A2~J(l*)?}u+-PAEVmyd!H;ASx8(-_E&){ViK`y5!YwQvvAdb#3J2b54%)mZ z&nBvwJY1jVV}548YnElefs(K9b87&>*S~WC%FvtSX=T!-{+`L?+!BDg?RF( ztQvP6Mlq9W^Bm-`(Bs-6Hl+bmzXEA zC|IwZJ4<0|N%cxKl=#l?h$L^dF*eoj<}v(8j;sJ)?12qrm>MW0k-_}kJchq-FU^3X zBJkLqiv$>o!DDyMY%&AB23~->wn7TvjDv664$uk`UxO~uF}Z@Ez=XbVWd*qyOMko# z6c$4WU`n6AbbGfCj7KXspOg#Dkt&QZPF|l zkBJFuA&DLcI)G3i`Vauw2avmL9hI|VI%BI+E-n-LtK*@Fde2lx)AbM{joU&cM=f5@ zD-76$Z5KcMw#3L1uiQEV&|*UA5qJRwOehtsIhj9qyRNEQY?VoA{S`B&*7e!fbFtM< z*&NO`i+-){urzw!kxH1x1uj5Ob*_3!z_WU4U{()#16iZ@>3g48^5(LDE&tzV--+tm z!XtV5DMZJ5)G_Dy-nkH;(~WfbyW=w+nDiO~mF=!W zqF+B-YSOI#_|n-FtK%-S>cosnRx1ays=gtUjWUZ6eBIlHADcokmSR^M&=lYXG-3+Z zel)lN4S1|VsMLQa@)~~34J+%=rCWb!pmt)0YTYlq5_I4!bF8>qOdj1$WW@So4t+I- zZd(Ay(BP`ZekteQW9ZvrzsAt$>5ad}&_Fj9*k=6aycyLRoHsAtBry69=go{6G)*_2 zrBX8OeLSwLq$?Od;mx%DG7Cl3B~3Nffi5oSTyuXszH-31Kcx@v(Uhx-?4A%lRBqx? zrqofk{)pJ+Ud6hB5yKeBEc)70oD=x81`$FW9tV65!51zIq_wB86r}YWP>j(VJXCT6 zRT@Fh_aLmN@fz0Se+BD7xq|henbh?a7>J0= zQu%yNRP{ionJ#-dy?sAi?Pmz^1N>Pqso9c_rr8E%|EWcLyX`A*yd4ORZ~YC9Pi*vP z5%VHMQ~iIQ2+OQ4N2>*b6JdAK|7;>`IQ<_?gkib$dhm&G?`NrV86K$#O3|NQQKu6p zNOy+4FxSG7KOy!%io!}I@~;OTM5ynIev--p9$5RIe9*)v7UHolU#U3e4)eC$U{mBG zTg%nfJnBKM=sd^$n&k6SD*Vf(N{V24dEWDyMQzZkw)Gc%R=NFW{JQmh^62f0UJNX48l0y;yNnCXZDe>fIGDO#I(EJT^y5OwDEm@W z_qw(D2BT5Ix$d1XmCHp$M|rjv3LODRqv1$406HF239()qxIG7+o2PD@gpNG3W@|^R z#`&U7=+oy|GqXN6Bawjp34|2!k^zV~0SB!H*u@-=U3~F^*p?ByDs@<5UTfA+7RF$d z2Il0aX;po)1{P1iL944aWE0d(EO^um^y-;7q7D;d#QoO>tq4%y%_(?t{%fr2Yxl3Q z>c7US|Gycl!uT(=L82)Os5y-QhpH$6=pjHwUAx||`lm{{H zDGVpf)qG^lW0tnBY2RtAd^^}la57f>(5j4x1|}Zl;8v^zr}Z~QcU|nBPD_JezW%fz zf|EEo%(1``4{p4tdqc}vdj8*wVN$tbP38)lxT!#XenbJ&R&h$G4asnftjOxc!+JF5 z@9(WsKr7Y@@vwkH7V=`yiq%sN=koO_{<31xlH5@IZj3zpoq~95iIDW?%J)2w%lFhu z!bw41Lg)!oNinA5lUiK3tIai2|S(JinCwOmYBNG**?4$McQfo(L}nnGL~BRO3o?A zhXxa^g4*Z!H!vO*1jeKP0>JTdUmoKKic68MH$1wQNa(3lOPqQG~CxAv1$+v>W^B17h`KK5Wq; zmE36O&Crm`0>BpsyyIAySk1k{{DT57j`{ILv=W>GAN3CkJi}jhQ!%){rS6x$<-y3y z!DG(O=#2~WGPFa^tZ-b>@0N=%JLvjHe;m~Z7AY%UWLN~=Oy=I~_Bov=a;G%RnftQJKu*%I^LPg$6g83d6|MOEo*x-hxj=`ntO|iL0zfq!N+)~7D?wLK0Vze)5sW+|2G!?QF*cLhWEDV}O@50(csq zuc#U+Q#AhNV?hOdET`vB{PDUCo;<|_g)C9)l~Ik=(T&!C@+LT915cs6+dBF3ro0WZWFXIUnMDvprsFFIq zso~%|s`AB|fXTHC;2wr3GnMc2)hmC zLR6Cgc802X5Z;PwFNG3LunEBZveDl8tNv77ZY%M0ZcaOjkqY?QF=0h z1q7Ty*a>W|mK|HKmmQI=mK|+?s7?q0CL1q&o~rHht%(T-psj@n>26j(ee`S)@g6^+ zQOs^qOiwk3SWiE4*P8T|yYoyp85Ez$f`%y+UY8)*D&0?K%eJg~I*;!uCVFkYz%miM z!Q?B=*frjBDnu!tA7nDoSsblt&F}jHAB_Tdx(If>9a@0Wb1>TE?X3a=+a9!0ksN*C z0ooS9?lCNu($H00Jr8cDGLiC-wwFjOx?N$X>N?gyq8Q|b0v76_4Wj+ha7ilMDX+;wr#mb| zFB{YfKR#7#dh?RI?ff%A?Sp

r_yniI!xGEr@U#1{Y}7ShA;`ae!-kX<~J@241ku zedJMfYsN*f(9bmd^_3rNxwePkYkQh#PT#O7@G)5HEskF@otf|_+*K+pw%I@>aB~L( z?bFh<`zzDAFHhEQ`wzzt^1owV{r9#;DL6SqRtl^7<_F{{o$Q# zNKiUI{e}adxb9M`{5UyJOrIsSoPSoae8!0dCkP+E*hme@V$}gfevRJ~WO%}AC~fOW<-W>b@JzER#i%jDV-bpaU|V&n3Ea}#x!Tf`YP(Fh zV1Wm$ek=zHgRYYK$$h+;%7w&~SQ>TReW2+h1mE!MG8G{W<4Gbt5iT>8me}43U2Rp@ z*JotU4N+}v4$l8r%nMNp#!@7s-2)f%l(>t)#k`(*lhfvd0C=QI|L6Q~$9eS&?$(e@ z>p+sC+oQPk?vH@UUI-Ps%zk%-r}#F08K9pDAvc7DZF=W9d+VE+1KZBvqTS%HMLRx? zT3M6i1oZyzm>uJ+N%xiC!58hOXIk$z`rosx`-=Qu8(P!!To0|&hX415)=mGDp>=E( zIJ71(yB=B_#{R!Iw6-U@8d}4me-EvHzWu)@e3e!4e=K~}p0AcHQIqx0r#q0n1`+w! z!~Os8!(I01mp11ABM*1jfA(<45kX}uR^I!bDaJ%c{)O9=vHD)#Fb11mNt_X5oBY@l ztbs3kk&mXm5Ab1!a#4W8yrx4tU8of&s5$A$Y(`I-4VmBrP6029tav{U%{tJ$G3y zC{iP+rcee&YP69+VIG7H_U{5<8~-iic7|u1*?<{d<7a15 zA_xm+F9B)0dP(97-QDNGpSzy>#m6@BGlri1-FT>IyvlRyS_)+Y#5E8qJycx4~b*_@q#qc!vl@A{ZU-Ci`EBjw?U^uSdt9_x`U$$Ek1cBg0`2%&OA9pZUHT z5i&*pr&)5?f0`vv>t~D-rC{ge!cn4*Vl-+%vOb|V1hKb!M<--zjtYGo+~(r;bOh$& z@VGh7Y&HAz2$>&eChxmR(3Oq^*VIk--$##toPo}>mb%rE6WJJ;@+Mt z2L6#Vfc5dZDKJ-_e4N3^UyEJVO5khiuFj@ZnO|0|nsOkGZcTD5ku!>Ky%%C-<(|B> z&$Ft(90E_)^P|F(^%iaaNY+2P`|pzVG%&TPmr%<|LFj+5Z{(WVo|1PXh z@YPq|@GC^ae<4~QS?sv*XR`kEI$4jJ^j}NXx0(OjWWBNaemHOytv7!6D_WnF1l|VW z(fR;#@J{$=w4Ppon&5lt9RTN9$q#VYD6} zxPhOObr?a+5Qr|W?;cXo z*AG&rw`!c}HA{5{8AT}3OuufKoV^At#N~H3zX(8pC-ZBk2W);&PoFF%H~NS>y`N;s zqHA|y*5MF{ZAd8%_p0ZmgpyM7MA_h-pnjs;sg#(^ejUxH{Kc(ZiJ&=D zO^g?YlE8u#uW<@S8Gcq?^cP$dzi|pe+3~JUN*xZ3O`pD3e8jMevz#Y?p~YQj`SdD= z-$Ij(GEy%}1bE?l8L8n~925a?E^VPD$iQr3GY?3 zKO*#EP}(UOlYi-pXN|uGBanRG*VJ^Bh`vr;WXXf6iz$W556-*4mI=d${#qtf`~WT!mg9oU zglO<(!hd8V>woVON?O8q31Rl_%&5;vf^8vxHm6hz|7uRfjYr~}kY3UB>lJ4&AZs}H(?!R=GAl)T#)7>4?ozl`RDYe(|CkVonGdI+?*Mxyvxh0r3BFtyAM0QEEc?XV zipn%9b7pd3D67u?e!L_UkvNrG?|kVFzfX|kGO+*;#c384bhpK3{LMS$OriZLr_Tl` z93#?O(v+>eX8@lZc8R$MpB&~dwa=v91hhydoVcHwv>Gi>g@2xH9{`_ir+s4KTwt1N zf_P6BmZU-Ab%~5Fl8y9@XT*am!9t@tk#Gf%@c%ANntl64nkg2I)y2 zxoEH(RzQT{E)1H#VDSYNet$lYQ;d6ZI^tKWLu^{kZ<`3&2i~Hr7Uf>qa0{POA!e2J z>XnbH$9vZ{Bz=Zz@b<AB;xPk+4#amq zz7zfqK2&~LqN1Ig4Q3WLTXF z<51K~ZfB=WS`PD7b{C~Mf|tHaCDNed(*k+eu$RqF|HQ*tBLBD$@jvn~5zgQ9FjJ@< zle5*YJj`Iptn8fj8xJ>$49^PxnTNf7z&zZE26V9af`Rx~9=1;YutfOgU+^%2%+LKs zJ)0KHm&2VGmkDA=9j}0?Xj!2}rfmii9lxoBdJN#*xN<=azM!JADhZ!IcE|<(|CkvjOJUanxhOpIQgKzxvba+~jwE_8~Ue{T+g@JlY+lRkx6{`axp=*X2%9im6Rh5f4TfTQ)bw{!bb9bT)AP z7xl*R`}7~`%@z4Igdtqv!{eD!ww(CEyE(p#RQ?p6CHR#|Ak=#T(-C0(X<)Z+PE~VxUYD z6+Wa?I^E|X={#Xg5INmU|9P|TCiJ#_`sGKf|i z9Fw{UrTB3T@PHK5KkvdApN|+*cVwzq?lHM)AzP>mS%8l_V-{W?g#-2iZ5=7auOtYq zSUf2Dakwtt6d3$G?tF{j`?jsq)TFbQ>&Wn(L?%OjRS&%8tirQ}6a601O8^VMAzZk-N^C0=ZFoc0W6k&Qn@U@74RD@f8 zRfNxfSA@R?aB=;j2p_JEDE!F~o`A2+4*ks#rgHh$hH%C2hH%#}hA_?lO%e9aNhH|D zBmVb{;8NEXVV$&!inVl4d$q#-fiUxssv0Bf&YxCr`N}zOXDSwv;tsbWi<4Qhe-C33 z9M4(cBPnIwXs34}J6aM-r;q29lzCj{JCmsg4p0p3=1m@RM5F9LZrW0Wk$>7$q zH{Z@%U&_=~trv|`&qG~8(Sw7F_Ae;wi=r-Fzq?TPG>Y1H`Ej1Cu7pL=UGfFPKRPNh z8R|Bz4`;+nIS+VdJU@986Y|4wPn%Z+A`m<-y)Z zC&$}rO)yLEDm^E%g`GtL;jL6z+=%h~L}?fA*qScF)?kYO)sjCAW~ED`%cy?t2}Mwa z?qvUHY58qWC>L6^UbA-6c06M%-?lGdzSB3BIA4E?H#);+O^uF4pFs6sX4{(~rMe~*@ z&LZP!PiFI~&cJEk*cVWBQ_(X5^}e=uVJmV^rcJkHlH3+{1Src;MUdVlb?}Yt&)SGY zF}%L}27k!Kafl!uBSDkXHA)P z5S#meF81YnJ$z%3o}?8`S%7PfBtwb4<|?RdwdytjTtvnLE+Q-VrHBl>YtgBpub1<{ zdG^4mm9eQzg}CnI6;L7@e39kDdmA2mw``~nQbQ@{7KXrWWVdMAWkN0@d zP-M058y%dviVyA+QsL+9HO`cgafT>0QYF5M%u*$}0``(HLpm^8>9PEbm=e%Mn8glK zn^h@Jx3AiDH{TH2%y&-1`?W$V7W4)x$XI2z#QhnH8`A5qapx>uKR5jR< zO}mi!L2pFXy#Mtz9w&b^|t% z!;xSu!jMhrtYtciLy!R$-sCsG-5&$~n8Dh)*!^7SSyJ7sr8Y(>D6c29fqVNS)kpod zlJh{|@9E3@H~OmK0Mi%Y5}3ZqXWpsK77TsB-~`hbC$m^h$q3hup`j*ZYVSZK=nMMTN=9Xuq?FHVsK6bZ1&NoJEAXrF|e z3XDEVzEN8KM1wFNLKzID-cagF>D#ApXerg_zMCqTv<5#fyu$e^mTlYwS5bPNJpjC_ z^!Y7=#;*S&z(ps^=OyrNjwbjGWiz-K7pzB{$AA2r9_<|!lQwi-`K^j4A%X$V-8UNN z=0@+ln~;*dk&4?vJL_!MxKjiz!12rqvvTbNwZNv?brj`bPW)XTVA?S++-Irmmu$dE zm38)|FstvgF%-cLrdhPemw)?9o)Yw7{KHB#cH^yh(;fJVIT}j&~o#?~XU1ccX1J0hYY$b4FVmDV%T$*oE4};(GUwkP2XPaBJOOvN{wk z%Wl1W<(7+Xkvz)l>kM@OGYb#G(5B`OQtT)rebulB`KlJ1uS`Jri^OZEW{C#Kt`-_U z|L9sULlR_2A>A2Ybsq*VpjMMu2;GzVxb5|FrgIiQhwDUP|E3LeuR@9DeJTg1tcnRg zQ&zFo&>C(_LkY|BVZ-EBR!{S*LDbDp>sU^KF`E_jw#$6k`{03kdo97!Xra$A>&x#n z$|on7t2r*d92$CI+~Xz}xRJqox13XqujEv)y#s~0R@YRj*EUj{85?qx5{~XRVN#!% zFQE}y_~~5lGy!r=Hw-OJdXT1eX@#zF?RU4-hO#Pn<6Z3~`(-t85<{1Ff10NU@cwC@ zJ}+0OE?Q)qBCm*P(_LsayD^+peG^x{}vw2;@tLv%wCsc zW6P~1c&C7nK7p6PS({?NV%oTMQ1kW8)Ga7j2d1)2WRQ^I0svP}2Il>kv3?ydCXvtN2j9^}AbD#RKa_xy5ov!(0U z@uSGH0H;Joz2fsIb&jZy>FYLQr^0rLYoxwP1Sk&0>q|ev+L7q4Iu3mopsV35P=_I} zO<}%*Rd&Q<(KI&)L$J!;hzM5MXGHRVU+;${+M(z_ozMio`uWKmep;Zf*0T70W6Z$n zpEky#Lf_O^9hlDzl_eT5H5H%4;U=zhpr*AWcBI9=J52x>16ZNOlS1tmswJpQbGl7GX^oVy*IN%4G zj+&Kw6GANQ_3vjab<}!Goa8^T7o1f@53pdKgA zVb^6)fG*+cyAG@qWWk302xIZtn(lxBzaOGWQSvWcaBkzCPy+c$HSKPbgbN7WV9aKH z`=K#V`TGoyJBdqeQ`Y5)s}dx@Rko722MK8SVf5?ig=jl>{}P80IZqipSdK`c8cx0LO2K8LjYs-cnVSNSHn;KG>VQa5~tVm+BeW zsrZR(AnAN~zW9sb@!Rb(O!$_@hw@oBf?#|XW@kU66X7YVB1~b_iNb(sgiH`NE2TZ= zty*hJ`_Y`oB0+5u-hrbE&cmmBRYt13@O@M+v8L^HkEG?$Z2AGzF+!O#pM1VbC^lb z)U020yF{l0G$U^l;L;_Vjbl4Inq7unB3gb*()CBk-miU9dw4cjUJhpcW-k?-S*$-A-RR zgG}+jR_NJSVe}lU(pe5BE=^m|taj)UEj1{1Y=qS>H50J9n@7{X40W z%O>J`CP^{kRha?yP zmI^2xV0DqY;o(z*##i?brz7(byp``HC9H$X;g0dQDoV`~+Z&y%HHsoszn4OD#vDO_ zVDR%%p?|gvC+Ktbe~hIhXF5HDA^~iDlFmO+&A~{aAhHt+FmTiOy<;SfB*P{=&9h89 zT&Wb-iFa7Nu}8us7`Q=_Wv(9TgJA~*@vx?E*yW8j`8%5Z2m;czKlo>DF8XL?L8mU@ z6f-AIfAAMU?E?R{s#&xA4EGLG^hHg~qtMk#sf@!{Zh}V%wd_x?fN~}xmw`&II#bFY z3BFV+8ei9~-FEj}dLFNt-jl+k!;`AC;?EqL1(;0hxuN&)oXb#rm|xF{iFl9$79PGw zvqq1{IAqt@i>GNiQbU^?Bjv^)WmS&{k1U#+3npn;L_#(4tFy3-(PhHr)pG{Ul%EtI z{=gUttNYmNaC(BvdD4Ea&^^qSY{@!imhr`x0?-oN*YC9UBY1-3LYu=nYunJNjN!X* zf+a4nxFqI$j@D8j*93p?Heo*usJWodp+1Yc#!Nj8e+5P9U3vBvF-~Hb>wB4@p^#W& zmHw<3!$I59rJm0rhy&oApB?qo_75O3rz3F{uY4YsQ!(NCJ z>k68kTaCW*)5>uVx&m{2Gc9*pcufRHb|Igi6ncO(i|~aZGO4|dlRgk^c;TwS=9xf=w&R%4kFv| zS1QU1b3puLdn8MeKcfDv&rxc=xmvIS5vTL~v@!URZrSL5n3t_eeuYGBt*u1&KCio5 zNtwhs-E;v6F|7{NcqM$0aQW&$Z?+y}ud`a!=B?;mGNWEF$-%mPvVo@JiCbP_!y)II zO2~@UfChzy)T&%_b|X_NhC z0K;RR7rjiD6SWM`F`BRX<)ccjWwkY*9URN~M06?M6u3=OSgcq71ncqP}ZT~a+TbW_K`<*r>ap`KRCZs#TwM76IqRK$uVk^Hgls^cxJ#y zxdcAEP@7eZ>#Z{T30EP>h2>(r{X`siNzn1A>WamDAg+BQf}THfGEVBX7XFEu-dM8> z6rcky6plXYv9}?3f-kk-zZ=HUM2L4~8`bTgLshF>LZHrQaH?{~#(()W6{|w45I1?Z zWDD;8`E7Dkki`wsAo%n`(>MfWQ&@ho^{M9l*XWRlD*PK=>^l5;8>156QrJ2GKjVuH zsX?EK$Xuuk;th7!xui|zy`{{U#X2NH#>G?;>P zPoN_}H#%q48&3lCkE_$g?WJ;eh-(UO3>V1cj8wkRCR@9^OM?!B86a=&C`+zX5}AWe zrh8vX@Lvoimh@el=r<9@-Yf(A+7pYAHIjy}SNeSLSP5|P_EchJC7GHgDGmVQB1^l)BnFB* z*b6-w1P!5uG9&12x=@{<6nYA?<+J<8jgAYsDrJ!0C%7NVG0FYFD`FjWL`bvP|i*xcRrwL7CJAaH{yq><^Kq zRjT(<*4R^^*ZvlrX3ZDCT*<=#ulG#3Rz5l$%j%b7Zk{ONq&4z5=Z#tu#uJHEj+0)7 z)e95LSw!u`ESmngBw<)rffSg$dU-!C{gE+;h9S+U{dfeFj)NCWt<9jlUL@@LCxw(_ z{Nyzv{3+oBcG{T7>;5O{&aBV&tk0@$H|&KTl0>O+v-%h+MhW(T+&8C2x!@LJ>SIdh zPG^a(P8=z;sd9YX`u(!OHnnVNfIML#E<0frM}Dq1E_-H(8_MTC)9K)8>6M}t$GF!X zwR?U8l_Gk;GNyb$6jjXzN|4TNCcNaa+>4#sRoMkUcBZKGiXi@bbMMj8uomI)u%z&H z*7i+MSm%55xsOi(=O$YedvaVB?^LE4?SYog14pIAE`v9_l~v{u&fLgIAB{a{1=g?% zETQ=+axPM#>!<^}s92FKEBE_g)lCeRQ1uWpy4=_1Y(X9BVUn89t{{l07N=j)oDu45 z>5~PiqyGoQn6sN;f$*9uZo=5{7ki1TE6@9n{IZ2W`70!%^L_V~hcdT1WWwg?>F0#Nd z*sj|frzaxdEF>s$qX@Fz_)A*Hk{M$>#MgIJdBR^SxG70-_9jrDZCiZ9K^z|$pelbO zh*=>w#z-h8Gq#x>CV)GT8oLUuF@$)iP@|k-C7D&u1R_i(t(PX^E}pd~;7j4ky|PO< z)^)vf8q0|H#Lmho2rhvvc5f465Eyg^Rr4w7vF6_bGCH_8@Wtv%%cxsbPOh{mKOP?| z?F1?8WMA+Q?C(I#I_F2k6kVyzwb z(Yv-YfQ8PY{B1(0D~+P+!dj2)`;XdUj^W?%mg9_^Son;MSsJhvmc12ark8D3TLz0O zENgp|)ev21#x!`#6Z3s*Vs?wckZIdvNGL4lmP z)pg5UA78>-x;{y=m-x}}JBpgrV#?v^&>PG*C1kSI;TZ$|+R@^S()kxt@f8VLa^3yg z^JZpou|!^nYn!dxpWV|PG!(42E5tSrjr;R)1J2KA!sp+IW~{s$Z;=xlL>u6C9!=pho#m%>aOAi#Zn)s=@S%ZII&*it1huL^y zzMTw8rPFgOyxSC7quOX9ThRg$6XPC_PvN;GrObHFlZv0FFeO&}_v`8jf%6X26g$k7ss`!|Rl_PCL`I9&+h)%BkK4rC4184Bkh){8Mjwq{`U?0JQegNQ_u8Gf& z*T5`1aSeN|(%gOPVrBMo_8-w_-NaacD={?y6lCZ^H9e&ebMP_xG#*5id^Txs6Jj*l zB$;&~^}Q~0D7WY6LwLP0IE$c1Z&zAT+ci6QZm{7ILM1PjIC|_{9zpEN*FdHr;LQlD zVGlSXha`PylF#-@4u8}w9Gid%YRd5u4Mg`to=U7xE=0`DQ3+4&aq*`9!Kk-`F^y;j z?70T)lT(l4SR^$n$QlhjhOCUFibT5M+ArTPa>)%9prrEJ?N=0a|9p%&oX^XM_r6QJ)hsEJ&$l%jUhO5%xnednp0Pdq)mKhwG7TwFz7&=Hy^Pe^^~J`URo|O75sNuBTtPxA8&}71*)g*o`&o!=N5^eIz2DBS zweS5=%k)qRL%~XgQ|`bu%5;l>ly3sF2E@fpc~XF*aYlxpzhspkTJjxB!C67?c z&g06i)Rk9rHwo_Ug*k?=0t_eGytong5kSp?me%)P9rp?%+CPuCN(D%6@Fcln|v9BL$LAzihLLNEAi*Lv0amt32b;6Qkn_4Tq zX(U0zGv_$1Ww7I@nCZ}j)9@1OFL}{CsXEVQe?`rCyMPa=|d`<&NyjGBZdvz zXgz;C*spjENeOGRS^Q4g41;e2@Uv2O?z$&))B1Uv&ub{viZkN_-^XUjUQRzKGs?Lp<|Ln-kPK}D zVqFC=vHp!dC`JZagWSnsnlu<498G|Z4!@(ycFwRwayTo_Ls{c4mwD=5wJ2;Q^3G5# z@#n@}IY)$Iq~5Z$UVM?nu;4m;B>8Sy>~Y(6lI18?T#PL_9(Avde)v<}Se-)iZtLK4 z=TsFIPy0G~ekg~JgRs<^VR1e9I0h5|s&pnyZukN`Vt8k*)&8-gY|gRa-L{5ipa2bZ zP>OCvwbecMb4D@igKGJ=&>34wM}>#|qc@)OUS{X9BT}3s3trz!BdD1fFCnBQc?eDr zSUP^dDE4yNx@iu8=wqW2oF|I3HE`sR)SM+gW*0CfVW-(_SEOlJGj8fN(V%Do{RJ@{ zj*@+Bl%_VAM+l?4ZnDFN2=Y>IGGka0oc$zC`Z*>ghmt7CN(4qf;zc@QOX$ij#L0r?(!HLu1(AyS~`Yyn5?RwOtfDf#ANPsN~`I* zX|RNW;ojpXhLN+^p%1L*1di@b+fOm4%Eco@?Tq`{+l@x;uapE2i3I`Fo{MBcHwJo~%f}H(S4{Cmcc}Q&}Z8vTVUb_?D=AjJ>33(Na1+QF0d-LH^qY_^MGx#{>@wkZPe3OtE4X zev_D@n}~7JkxY^=IThi+htj{k_#TQz=*L}pOhU%HXV(>Eqsv(Wh5C_LR1i;NfLzEI zJ1f*ICd+`vrGbXR^hwpF{XTb?oIOvU=7<38^UT*T!aBI!H0FG}3>U`LSK7&_7N2x- zg&9#bGXvf*et33Tz*%k=3*MD1{1!i4)51@oc_o$rasTj9?viPa{!Z z)mhX0K!C(*qMB%+E%P=RKWX|{O$`YxZ0RxF8T>`G^**Xb*O$K8^=vXT4I}(%0c?_T z-%KS*EU$GqUSBGcY2|`(Q!8fI=~VD}VeTRRtNg_LdnCg6$v3f~Vz*|G5uFqyG!^bP z{LM@dFdmg9%>*i{qvp;m=460uNPh87xL1DSsC0y?H_Yr9#uPLyGEK^3ABzsHPd|IO z^=!FFwNaJ9?ZJ$XS$f<4T#0I^f6|GWYZ{>xsr+f|7v3{nmc;9vlay8HC*AkS!giYpmP$NQ{4(?|X#29mNVw)PJ4*;TPqh6U2gpjW6T-=7f+!k4jCKPe<6)HTYI-7jZ4B`WV#k zU2hSnM5Qov-@|n?Jd6P_Yd5(O#A`}gFs;V7-am5Lw{4M=mf*2nDUkPTI&Jj%h}W6T ze>4^%yF>d?Gs*S?4wa6MNaHZP$G_Fviw*&gR-GMTq5t#UNr)7?9i~#G3yR#fxB#_d zwzyC*+e-Wd_&3?o^aiOlE zx^qt8cX75Hkhk%c1Z<8msvYbm|MiRg}@2r^!pu$HTAT zFSmmjG8$=s-znQ?PX8jcYUD!arT=`;`Ic_S9N&ohl66RlB`$Sk>DF+F71f^|&9 z-P+aYw^Dc!q2Kcf=>*p{Vcbdw7^bV%Yr20ljT9!ea_LbKL-NR&`(x1e%9uokGk%22 zQ}UbWJq!r!UDIWEzUHA+aV_^grz`0qj>iDR6kg5iu=^0gBxcuK>QL1~j(z{^qJCv+ zc`xusmTf2aU9%4Z7u=jck((Cj8i>2*1@+k^m4lz&Z1$71)KJr|I;c3DGN`DD?2ED* zjy$3whokmrF?-_KD+5fp5>qwlH6HTK`zmR}tF59)MeK=e~;Ru?xs=T{kFWI*YHV)x!ElC8pMjeS`;38xcoMsHutHz$h?vvvOAVz!{-_R`>!0AQjsp;@Jk^5{su*hhPlV)--1 z{^^B$6aLsvPx6p(9sR6C7mX=gvs@6#b$1U5;FllS7qELl=BAKXaEgdM|BDThDE^xb zQgZQ|4RYN2HyfmC{Xb`e0Dsm&{_8df@Mj(5zixv7f7U_%>oy4RXC36fZi4`S);ln_B8z-2l3_lY^{|A1f6_ z^>2(#bRG}QOp}8@RxD=>UlC#Q)6hC=M7Zeopgg-lUvfOhpy_8k)_5-4KD*fxLZx=2 ztALaA+~6YF@U{G%Cwef6OVJ%a>YbZ`T|igP$p~#W(8Yo4j3yW}YN@*zjp?s>?SBJv z+s}R(Ot)@kdT^?YRz=5*ye}9YJ=ZY?9y_+3LZ=I3u-MS3?Xs{Z@$J8{Qx!`yC%&5; zQuTpll-;Wv=y~bQ3iKI$M8%xv=gC;cfq-hApIMHiq1~x!N@7K$>`|RLmuQ=mv!swL z5`;Pcc0%`j<6$usfX#UjX1i%hFZ;nZ%iU>B-d)^DDE$t?Oq~&Sz#;m#k4A zNS>&dZ=YPkF?5mHU*F0Y(w2qB!5C{j!^qBsFKzHQPI$ERi@ihdaX+e8ts@-?H>Cyv zFHr%VOy?3ZrimP~ZNG-$6Ydg|clryp-`YoRBFGiCDGEm~sC5Q!H8cSQJ1kx~5@h^E z`@3Fe$7+_rRAjqnjy0XG_;0e>6Ncq-Sy?0M)@J3Op(QY`z>(CJdWUF8&xX z{55-eOHO(mwNA`F;0?|TD?&t@NIxD8lNTT8-;k78qXIBeX zXJjn&%^kNM#ukpTx%SXx3(y;+=|WT?6YUugED-Z?a(xh<=-JF`G4u1+=Nz5`xrC)Wmt~E_&N?{fpGM;SY2o-*1o}OHiMJ{DTzd@LV9RVJ=JMa=;9UXbP- zrhRSJ-{!*UyakB;WhPVSPf$zmnKMI~Ekg@`%Kw!}mDaoO*EW zA;;$o`yAvJOz9}v8rP^S+SZ*MBii1*5&z;{o|F(KLPqRs1`2-i)Rwv*$|2kW&F`ie z1)_uLu8elwBz;iTUopk=Pl&n$Ie6JyZ57|i{J)Yp7gp)Ezo~IpiCC=GX|i3OnG*0+ zJ=XaUmO@+xTe$t>vEqVer*ia||IL^9eQI-KeTqU=0cWB3p~>ZZtL?kH{;D4_6||jA z=^}%WpaWSvYPAUjbEpQ%YbN?|%ipXKaHhS=f%8yc$L1|ONLsfJcs0&$vg3GLNBMlp zp8r&>O}?vo=4R;cYt7x8lXP^QyQBhZDw;}5UG!&h#Fm}Tf(bb>6i4|FZ^XYd{9DoK zzwkyrL-+pXjrex{y*C2$(ki{MudpL-{cmDl@sy@YL)_pe2g8Yqw%gq*N zSe=G(&4Pr|HxZB&8BU(+Eu}V~JyepvUhQYcTJ>eXP+`Sr2l?u=JCe))DvtaIyb(q9 zKr`U4#S!DVe}>4DUZf#Wm<>VdCpoW1g5$HlJ@Lay1h z;~gL9HWN8?tOT&8SdptrT54hF0~-Tg`rst??uXO=VPE?m0sp&wO~MTSyL}z4NB+Ot z*IFO{g?*jg@Q?QO4{PAB?Q1UgUMBLD|HZ!UbNy*w3r)ZHJNp{v5^P_WANYmLr}C8J9og8!?1{r2d8u&;y77eY*df78B})BDA~ zE-(GfzCHJjr6^3$D;y)h18QXd{Utrr79I?k^&~NlFv=%p1OD{-)R17Usvrva28+Beb1<-Pt~ZK z(B#Udyx+hMsQ!MmXF9!>rrDEIZR#5WcO!3v4%(f_KD5OD(k=#Vt_{d7nM zQ@{?%2-qPR@dZ01`;Gjca$+@nmy_!er)@w4jb_`}o<#Y1CebH|kKe;pZy_{Xq#%hL zT4(cTABFUN8tz4&C>NQa31IAAREV5PO;RRw=MnaDR9jOnw+&hP}KSt7*Mpg@MsLT z@QHM{@WgaYpGA*Oj`6E4W}<^F--{%U0L-`-J~fGvsk_@-k3OT!b|_!8G$1Z5L`aJQ zbeHcXnL|gXFQ>4pbA4!n6=RpzA0W@k9TwVUP8a9yBamE6_8+M9Fb3Pe_djXv?PW_} zOzruYg7zv904&pI2~kT|wsaApjZAk`q)437T&3Rr`FGCv=DA8b4X>*m`%4NQ03zRv zet(_B7{cL`V8UUg9m4qaJom1<&y&Ynq%s~O{F>6A_tVproVP-goiXKN?Y9h^GO_{b zy8!kqSfo>)JDT9?hJ6YS`Gr`=4?gFM z5!2~mnDY&vXyX?yJv%B@S)}SXw@b7rgKHTQMq~(!$^gleQ#Z+i4jQ$_>pp3`IvrK- zLpQ@GG_-9xG-4EnHce{AG^#M&TD&D#z~snv1>IFMQ9ccSpFA4jni%NWyOnVngRkJRsi%kkm6Du5fTXazx`@RrB# zTjx}{Oqo2i4@lpssXz9U$4!5+z!zL0u_Z=z9Z2cy7O1i~bxQ>Ccoizu$yf23>%y9| z;~^j`FppKmy{ypQ=F_fqwvKQ*Y4XuWV3<&R##s<6lFAd3&$s|v+8~5Qz)7jp(eLz} zN-h&NiTyp4QI7gEKLAK55MtIzx$U5^UKESU4P)g!>VWY*a?0J7AjZ%a9Hq4c zdfyOt(5#+swKMGacgnn+NXyWp_9}?KwB5EeOliAE0

M9%zqMx#iK;$|(pK(KX{{ zikY)nEQmz$wxftneI2FH+oCDZ4)oCWuFT%!shZ30)`#AUWd&B8Ub~@Is9!s{Jy@=o zttr6%)0g?6l)7m7NcqC7)dFlb8SSVN_}IP{RL(C*Ph#Xtm{|4B2Z}@$-m+lJL*?iu zigF(H$KrhwWx+U77D?D-^kik|wND3~Pw-2a?&n*OdUYO6i%F^M%C_W1Wj6Xirl_4w z^bLswgEE)-I-w6wO>}SBD?M7Rfm+ThN?0#EPZi%~fzJ+hy?WU`w6k=IM)ss{%-0uB z9BzFoEc#BvT~a!o)r@Vh8K@XIHQF`q4N4!Ww#-U1Qf%FQWsq}iZV3n7lI6Sy>vzkw zw8aoTtvL-nu?leBI;Jb+5HIrsd8ClJH_sP?Wg!y=C=lCnnZ5&2Bdnz77zQ;4P*-mss`g{9flrT;K$fvCE9mA)DJl`ACTLkW(>F-4Z1?%Sr6 zkXSQ2j&~n-8sX!g>*cCf!JE)3yFh#q9NR63!9t<+c=r70D-ncmnBAUiJ5ZdvWW=1? zv;zT)$c&tlJ&%045ENsaRXMFY)snFnBQuU@P-qZyKabPV_Cd-EGCk6J%5!U9AHk{4 zRoq5Oq=eBU1}hlu9$k9}+YqzyXbR`RBd}|*nc;{|sE8?;Ev-Lajl7LcKXn~ux!`kJ zYB6q#Ih~is8pz$JB0#a`2+)+XOJ2czGe$bq&Z08P3 zB}cQ8Y%NP#;0`l$p6?2ddC}seO4$)ty7z3OrAoDPoIk%l_F27(Qw8>xCcY-Ni83+? zh~^aS_6U+nx_{c--7^WVoLHZ5042Fq>9~fSLn0w}H6LHw$784M^NN>Fg)Twe&V#K`#N(fx&3@#@`MX>+2+&F#}W zMTa_Jo6oXv1G?twkHa!{IkjJN8ujE!JySgfo^V<<>nU-yb&o37`-4abeC%$1c?cDr z>T?>m4;u~1)ZqYZR~t4uZ#4Q8L*8c1K-ldwhN`4f04?t~Iyg<4eEIP6CR(IPy&dJ& zSGB%*SCPc*$_ce&4v&D`utvxxP`I~nB+7KcnD&OraN|Y}zlSTu1D^a!SIBb@QaLAA3c74XA`taeK^Ezx2Ui!J%=0{A#T> zoIh^L0Yd4-?x)JRH@c)A3*E`idGlliy8YBV}&r%ULheBNL*Lo3ltYG=O{lHLe zjQ3O<@;%8RY-l?~xGTQKlC3&=eZs8l=Perx>;TsA`HA;b66^yLkWtq0*826go4H4( z%#p+~5}hgFW7b|Xb5|b8NxlJ^2X5!rhx7S*UlXJ7`xMT7(3Ad9LCT}a>kp{HpWVK* zsz25)+2-)JEkz4?pf=W?OeF@Ds?JN>%sHY~wufk~w_F6z7)`!P|S-?xqK$h>tFkC*OKJsP(EUyFZASz{760GW+@! zl7Lg|#(Y+LwYM9=op}R{f)FQxkQL`fFzKEYF73eK03TpNO zNy;qxTkiNou5$7Jhqki}igVl6HSX@N!3i$G9fG?Bcb5d$4|fgj?rwqL?i$Nwim$iU3Fovrxo#rQR z_!s^h*tDn%rShL4t91M;3splq3~4RaC$(Qkb{HPm7psQ6WuZ&P^5W>GbOvn|?KWYV zg_5E;1n2y}pG@!_e}8@y+bx19XNgV30Z-ye#*iYjRFt(&qU zc`&p=TZ;i{lUP~yb)5cdoMj{H=o-G?-pHFrZ*WEwMzU)#7YY_oHjp?LT#h8#ZG;+_ zA1IAZxbEA&sK3hKV#rg?#M|Mq{wy`q0onS zA#5JhETA_cOvSWfakn{5EiT0Ah# z{gNBII=1)zM#Rc8yKTnk)R{xZY{~*xWs2f@>e8eijy>Xv4q;klxusg4xGDR+UQ@MT zRuf9Oos`Djq+%($pU71MR*lp+AH6jCLVmTa(>#&H8@ypMKO5s|@-ZV+-^7{{jXc56 z0I_B+TBXr?p=BX+XtPbS{xOGWzBfLlLeE>mvOKw7tCF|Ccc0L(%4$&^9gXT{25KcE zY^>sXcp>OkS>*k<*#0XjTa+V>ppK^)LY`e%Z6@u(_`*egI^XJZdPN=Vl5eTV-Zm8& zjd7|nx8*54RE3pEaDRlB)h8@dSDh;G27(paT_&eF`b>e)cyR7g*12g4reS$%Mb*h| zWsqV$+fHr?uFpFU8hU2e6g7;YUXn-BhI(iZpWo4j=heE#*=i}(dpR!73l@!X$a=M0 zC%#L=SzN1wxho_Z#G3XD%?Km1rTt4mn^bp*k37a@u0F(!} zm=)|nu%1bCjbEwS#7dzRQ=fVl5bWv5+(>IZ(fB5xYzDJ!MFaOqOvRan6l!%@eFA~# zE#3^hP8{clKKun8?{SP-K$tSrNXl~IKSU&8f-Y24bze?n1hqfyBfq$#j+J}1ylzNb z6)C$;i@Ud9>Eu>RfL3?4HBf?70+tP>tBLN-B4T^Q7WYbQ&-;-e&BS)OWiQCf!&L7> z#8<2MrXdo%NW;D9>tojwO78QarlG>3s3Y+blL{FU_*6rn5+B^#8$+vj$hKM9rMR`* zeLsj%pz8f6kBN%;0-?Ci#8qb{Q0z0g)JGGeS24KEH+QrOd z&SXYi^3kPmkf>)DCG*0?u^2uN24!94lgd-#Vfr5KW2?5WU&;8E*22kHTk9@6`%CR) z$d^y3pf*l^-^Z%J)TriHX*H)g)W{mB0j9u6769t#;W8y-$of~`WrMvls4Ax!ou z_AVqFeVUmRH8V1V#Dt~Uuml*FFUH0eQ(**+oy6gi*(8JG!&mn}&GPt4avLVI)N zC#?YGkm%k85!#bdtgA#;51NsutNk_Ky(_dj4sDt&Azf@0L>+#&R;a#z%6lKoiG;9I zTm-AqyT<#iikZzPFD}Hu!xJgb?+j^$Me)x*&~jQ=Z*hqbKte-~tP23U;3-r6B^$C` zFb_?K++F;&!h$@^Uw{Jb%JK;LL%8a)Cq9sv7Tp_zk!a`bJ_{|R5-DskEF@U z881C&4T}YdzayR&Fe67@R<0QGx#ak&Cf;47QqV?uY&f z>B~1<9J^8w?s7yU*==FN3dc?{d>Enr3wVxj|Io$| z{vgh8*iPQx{JW%AYy0B{ycO}uegjV658_-y{~b8BD5KdbLTd?kT<8%O`p|IHzQCUG zE*GR6f}XM{JSn``^2b_|Q*kTIsTFuY+GuIcf}P5EeCL1HI_J39rR@XN&*VZwi|^=2 zJ3qHxA%H!$M|kMn=6*G^n#aMTALV_H@XiJA`nDYR0QKUQ5DG67IQ3O^5A`)w3N``1 z3pIFGK;5ANJB`I{gK-pV7>(hPzd+tcM05TAr-hO;Pt9`Zs@##YVIz7=MmuZcbUzHE zj@~0vkL z1OXUbLK1~HW8a(?k6A;~SnM5dS-y@gMwZ(7qX&M3)>DXPR=xFKA3vPQvyLVt$pKtj zha>{?q;0h^j9i4K4B`csO&XpySV8@m=)L=l;wC1@syaOHfYzbC5i>a{0sqIL(5;_? zZ=7mVf}(E*QU`hnUwP9$x*V5xjlv3v_#p0WT)7`dj=&D#DHE(;duib#iB1JVDWytsYi4l|9#>F;Ec3aL?{b8F zjSmq{d#;Y2$U>^kKO0GGfi(h@KX}-5wAP=%$(t~s@N0(TmtjR2ff!ie z?X%dhqL$hy|c}tl$&=| zL(VkLnaPouD%`C%nZ(s*`h9^$nQOb=0nEJZ&h(8xJ1Z~ek_FVfY+#9Ib+W#e>XX_} z7Zd!;2fjNVE&=xWb1)8sh|+xr>K`Ty@O_1d z;LfHstl=4&N29NU0ZwOAR7>DnoA=9HLM9~zUCve=*-^=d7A(KNnQ%a-M*SjQVvJs= zo_z%J*(-BOmXwY_=@JeFPURg480I4IEx{YoK@*Z_qe`ktzZzsZ8#ioqP<;`F1%WN` zgH`H0D7`IN_l6m+QT@VtfPB`@%-^j>&e)dgU^s&q%T80>x$K> z3_Ehxhp$spHE>EAfTX^k%iM5v8e^;&YHKDI>Q|CpTivis;EsZm->;w;MbC{ z9L>V+o1k};nZ$5q=r%30XmwIIy|2eDt{q80TZRH55Wkm}j+q>4aNYC@a=8drrz5>l zk%Jbdrn0o<83NU6C*JYdZY)&eV$lKOn{%QO$x_rk0`UvwOYIi2)wC z_^l|k1|G~Pk}V98Cnr_+C3aFZBuwxoxiMU5?|dC~NZIv{=2h1(Kb54m?-&)-p_n!*9FU1l zA!6k-b$`^pbfx&b3>U3q`qfvheR)O)Ezj}u*-S3@a+3|1%hviYn0+b~-{^Sr;}^`T zU0q0bt&E1LPtil?5)U(mY1d)seM=Dom?+ccU&G4uyRQ78n?60QFubQ}2Z7j-C_kvz zewG`?I0bZxviu9o#z_7Nv)V8yqBHuJv$>)3l2MFL5Og{i>|s@qhW2jn>Pj(|ZJ=Yj zUf(X{Wjb5Uo5v36>NZLLX zAFr(RW0myO!Xd>IWrkz7fL}EG6m{fc+(G_8xOh6~EfH0Jo91Q{_1^8oH0kTU! zM7oEpfp$a;@H&h6dPTFR-47hIm)MKut0+ElKetSZA8*#@MV+S21)eqBE+4$^zcJmJ zo{w#%4ROZVQLf9hr+Bjd^}*?Bq$eGRE9yL5`R4q^G9b(171$=F? zSk#35Kd zl3X+eaA$(yk+jCi5abUAIKD zK!!V=zjXsS?X3sMvX#f==b4|3?}skq_Nk`j3$x_k3;e{cpI*UGi=a^`k$elIL-SO- zjsAfdLAGs~OJ2;)YAUo_dkQV)<@tThH+@|NV&UZZ_1Ay-?XFKEU+beLQJ(TGR0Zl&WK> zmr8>;s0yF8Cd~}fTvhgylFezipVxOkGOvwpFt1JF>UNs0N)d??IT)nb`47FcTsQiG zvVvU(-<*Me$Hg+j6xsvrva>QqXim#aT}w70@1HnivV*j^)g&@P=9PH3hq+XzFcXW* z;NjKgA;m0@y1^2hN%wpj_eoh-`$+5tn}*J9K*HU_NZR$o*I3qj5Ob7$gV=4TnWt9p zDW5~%!`tq^p1+e-l{qb*c`o}TEB=d%JGtufv~?hgo$3AQ=2PK~@W7M;c`9h@`j4%2mZkGOZq#XWmNM5^CGgs=7-5t-hc zx$F>eIG)v}d3vW>&NL&yi2F6t3%ApB(0O{F7n}D`0U^o3EXXEA!@Tisdv=k*xmLvJ zs+6TKg1OCsQla~q*!KZ?+;@m~Z*lzfqmW%Ds=vXSRwjN*KP(GdjC-S?xb`H)r7$a# z^yOX|jCr*W*|dlDl=^~X&KzU_ zq3;i%!%fR8|) z0)x=%aTy(K&$~6W@>ziXOFRiF-WA7_47v(sEd71WWNSX1@|7fFAtDB$A|5+EqpS`s zdNm57dGVi+4CenCDalTsRoJi5^gD0{Yki1=Q7DRd91*nOzHkrKgF}t-HPxBHBw|~~ zk0n{%@!DJ$GPK7n&@94CCV(SbeP{*M#-`}K9+Y@086A_p%5sJbkgx>0OAWRYAO#&% zQ(v4v8~f2_+uv_#SeSfiSPY_m7S_+IOm!o;K0y}RhCNW(pDrRUije^eWeyO<5>#Vk z$jsMO@SThh?aYS_9TeLk_mh(u2oQDUAoGhK+6yb-7Rb@n#!zg75EYK&2SF}L0wGXl zWMC`MMbh}}&hY5l>5i+&j*mZCvsBn!_N|l?Dl{D zYEMgA?$zfipRkz_Be2G>IdPayV}4eD`|ozn)tf;7Zrd`{P1mr-=V^d?D&k8{XuFz;<4 z;A~TNJfEAm>fx$7W}DwO;}VGPnX~>PT@<~YyDsidkG#I*PED+t3f%FO^zc?B6VpYk zO?)sz+41szgU>ofiv!}M3ew?(Oe^cM?c(*$=;@^|YH$Kgra>qI{nDVk&{-`;-4~p{ z4UXV@ob_l~_H)GepnvUW0#WbT6#U^7eg}Upb?+o}BVpangf4 z)Ym5~%>gs%>$2G?2U70_ZgDV4E_$|ui5Y-NW|rKi?i<37)dmtF%F0?M9U zu7$giaXshf+6xzOnoO7>k&EYj&#bVxd|6S^YU^G$FYb27QuK($kb*%@lBQL}w*#ry zuv6H0Or5(2^Q`{!l2UY9PWEzs)@c-Ps1m=vs0@h%0ulznNs0r_XI zH-)0LzIIWkR`(^omk&Hym-=T)jpaYLYV>CK52?aP9 z%Ub1HL)Qs;$bmc8Km;Y&fbmW^TkN=Zwjiho%ygv5=PwP0BE>hT?&}IItEn|~@=UMQ zV-V;9fAgdXktVzeR)?o^S>dLaQBEE0#f}FjifM#Q5&~{e={$%Yo^uFSA#RUI;D{49 zowRMef~+N4N?`vZwz8A`!K(|$y|z@&JYHtDMUkkw&F%Kq;sZp>q<|GjaKRer6<)s{ z{sun1P<;(B^vjw)9cFpao8q)k8%de5^+}Sbv|h@dlf)?} z%DUFekqZZ@L+Qj{=UftbNyQRF)b%5%k>};YJl*Dkq4D$QKl{chy=>ArL1H`HIaNe9 z_)C_0Ay!jI@Z17^?hz&3#E;IpMMNeZN7{H#JwIgmX$f>b{m8{>fe%B31V;h`0iIaGBJ1piGLTU|j;z)5OX2vR?Y1*^YDc%&&;fV8E95#mC~_iL=l3 zs+7gu2}54EDD!o_q5I8}Hmq*R%$Z=KMXttBN=MYjlf>PmV3RmzRqb$T*G|sYWSabZ zuY5oV;RH~36GbAOaj9?^B@%8GUmTLKjUCI>szw=xscLUj^#MZUG#)zKqv)wbG(QkS zZ`7lbJ-Aw*Sx-yOGim>a=56Lt8ibSzxsvX2p&HUBgSNDJn_e#4m0rOyl&LB}Z4;N9 zdv3QX39MUZeKXsP#c1H|FoL}n;dkRQ#kKYG7TisiY<<0a{wI&Q%w%fuveAgzggm}t z29)Iwt#O5!D>4M9ui`4kE%?w&1@^i&ynkrZiPHuSM?CQMh_+%W&~^E(;!HfX4h$>I ziTOFgjioWqU(z&aSDa_;dvggBJ3JOTU|m+aPWxPG?e7gR8&mBT?R?Pf4DwZE_d+sh z9W}|p(U{V!(q|Fo8n!>4C5^C8JG4f-+S?(8guMlc%JwS85NxH?T!@x{v*THy2-@{s z7^=!8HD({ic0xvV6vl&}v40h(HtsrFC%{*o)9VTel^b>s zsXeWd((nzg7GnCAn=Kec_Z)SCwc#~fJfUFi1Zy*maiB<;E~v0C9JF9InO5_+Dt(5s zPVz^u*W0_W^zqn4YVhx9@r8qY`<1L@FWd`7D1{gubDV|FjpnKTnOwV4W)|ZRxzUt# zYO{g$yLY%}JaB5$ecBCnt1yU=@Z=5Gr?v0AwImF%%G`o}bE&2Lf4Wq-c3Lo(B%*Ru zuGbBHwh@)vHI#wg3lRgST${!ZhHCqn$?-@_nMiN+IlsnagKDcbxb=YkSCcwsL&c>( za??Xl4Lr`xlu88oODQm-MuOri7ckD+J03q9hSImJFZ>N%JJ4_NUq}3N?*=sQ@+Z?k z=RW;tWqvI8|4Y5P0FcW$7!Rjqa~Iwc{1G&U zS1s*GTPscn{kLG&6LNgLy6b8b!**$P7e2qx_VxiXh@c!~cOQuA3H(ruM0}E$Y&@ec zc%e)b-fX@2H>f?T`EI4@%9(EQE=yJ)ZWtq;X75H^2ou+FcB^@1Z`}p^+L^dV(=o7| zj+Yj=ezze+7T-X@V-V2;6-bOFEW*tH2t3Ev{ zF>%&ysQ{4m+0k=iZj&h zSRq~88>6L4*4T`qZ~|ix$r?ND$9i!WW-Sl&E7{B;L!#}7VMY?n%H-P$^r3bIW@huz zpP0rmg3&$x;b^bDK7CRCXqieW@m2n7{VssYa$JUe%~QJ``xo1CwFmvMTJRl268(d1 z*VDkK&V+ub!snNO+r6xDMotmGV2VLvdBwu_S8ZD@Rcc0iUo~K3m4R?18&y}OB}0p{vst=W&RFv8j8`$JTv^63 z5*uVQpLDqD`4+sd~a{#nP#|%^q1#L0W$uILZJB6^_u~xeR~)`GB|I z_*SlXw&xXT*)J@2W;+~BPCdNX?BHlONJkrI7T z$zEp#n9h$@b_h6EEPl7hdlwU-m$64iIjNt=w{jwMHg?Q+T>bSaTsO2VwK3-pq!mpF zrCl!>bfNtVX)m;P8sB)AN#^rWx9a`a1#Ly24)c*?7tk5_lW1iGQoQ*|pL+Es{>}=6y_TSGK#nnA;U%RB#Sr(t^(q~74r5sZhju2h+jx+ z8Z}1np#FWKGp){3ciC;zAERh-3x zRJf`(DNyLq=y9|VfzYK-%x-W!iK_V>RCVi)(XN6j}wc?M-0SXx` zxvb+s5Nl2y4)Y~eHkvJ34B|t7pKeI~4D=d0*cc@>@bD^2f!W||g~6ka*#51gKYrO>`U4ujTfevN zBc8~d0dkOdbN|Nn4zuI#_Y$&!9!`Gv64p(<&XfG|57le@6AcI0riw47-8-iN@qFFC zt#^oD_iT^8ax$IgY8n3r+eYL3L?uV++C-suMy~TnUhP>=@mQGb8nHdUvnW+OWFf(U zU8{X{zK@k>cSCu(h*>0tzY#6&yH|*OYa#`K`YVFCOyNTDlHpOfb~D*ucBl5Pdj;-?1!I}&G#?W3rcWV+zui@cu?l)WTU)}F7^$Yxy`)$bh&HaXzcls#WxUf8_T0*Di!6c*865{lK%l)h- z(ch4O3};CPA8Ag9jXJ4D1yfm}7D)U}jf1d$7DEoPl1Yxcy-7n*16>nDv#rVXv%3(a zFe@5p9OWA_?38F2Ze~Jsw2j3O7$wR)y2OLW0C(V{qUaSG3asos2yebFn7vF}(`39m zm%ik|Hi?iDV-ti4lUWJ2Ow7CV&;tqzVf;z1gT4gmQtb2=9vafO-CFLg1p~j@jg{Sg z*Rb-C=1gQcS@<;6R8aX^4xNJfJ*f50r;XH#xt{3M?lf&ZIgt(SXLRDGk-~kN0)g)m zz?7<&bPzN-Ku*?zp8pRSJR|HZ_34urtJtdQt*?rb+_>9ZF6!y0l}ov)AuWM<!Y=(cp%_)*`(E3 z?hyYlQt=smmBHTuZgKH?z1wzjq{Iz<+&|kx)H|7=9%JB^7n%oH{GDrUN&3)9-OSen zGES90ey$Go2^-_pNC%+c!x*&BC68U??? zzfRIpzlVRflV}Z=go`5m_>}&xW81|8{_?QDxVGqY^thh6TY4TlYHV-8h{qW5d-V)Y zwrAZ^`HGQ{Y*DwfvS%M=KAA7++$B~I=8q>I)?l@l&Wa6jTf3!%zhGD_ukZ^<>(r> zR~Gl(y$Zx{GPVj7>%Yj@4C%aoFJpm!va$c6jO9HB`BTO|68u{kyR!c}zU$w~Sl}-k z3tzDYPV~<*mPPOXRmKKO|BH;xoBD5MY)u&5W5X?@`5Tie>0meEX>!1%mGtNHFscJ% z@I0`?r@E%R{qNiCskQv=@!DjN5G3aRPaYlOteu0Upv~VIPBIzqV z1~}dQA*PHtwFGV@(8e8r`ezvUH49AKiCT}G02VU;R~ESUj2DIHPL(a7T>LKggw#*& zy^$~8cwd8UJ||MWK-rHQorRRXzqqzT-At{3;q0KWYK>Hw3Usy0WqMXL;*C+6ZyfK0 zY_{kEUcqPCQC;6!@b}kl;+%m%x&8YoIzeiM4Gyba7!xCnWehgwg-YPnjEFN)WyD^eDh}~+byIG zGEIS7$KOnL^`BiTYKVF%4H0YFtGBPR2 zEU#>PuSH(yiqm!D1t(Q^DeU%I8_?Px7@7uOhSZ7H#{6p8a{u^EEJwNaJYHL?<^nTge;Dukd z_Rhw^nW*{~*8&}#F|V$cclBeF0{s8%YCYe=p9Zla?gDkNGD0bSERauY)Wu}}m8sfE z_)iZf-D@XC@4_o%oB}1bCy30_%tI~NT*6_E?Ua%4UUFrpzd-PpRCxYwX<2?_+Z&Iq zuV6-A^1{9kCQt{ozgybT-_Z8QZtehG?24M}k?t5`{rPI)$!DB`xPT%o!i9do2EB>= zC2B_uY=4&z?nM#*H15f#zBEe@ZpT!uHO!O?%VaJ<+?>CB4K+s248lS8_JzKkE1>&vzKiu%OT~514sX*e@58O@ZDIb%AS+*5hW~zjm+`lUFAw3@)vzN_$3MlX{K~CFPK5aZZMNh3xxzr8Y9$vsl>xq1&*ww#m z?dgYCpuPCG)?n)V%hq1q3{%m>r{wXKMdqY;>*`>1-s z!3O-YZNKZhCNY(N^{sj0La&{U}7vrCLKMrqea2f zYkkhq{xATTQH3x&SpTkTU*HJvU2AU+GVc-DJypRhDa#;6BOkLqs9?C(q#EmqOwXox1LT^zOhu{$*(f+GtmuTy}A1SoU<=Lj<) z;dXlI9-Q>dY#?OWp&uE$vw^Qv3yNds@+A+f{6Yinh)9NSbkSXTj-)<`J(!jl02iypHiRj!-$$9&b9~i#d_hw5o7Ep zK?$cIdR?%*#{e`{NF9DiA4adMDCem2w27OV_VFWbv%g{O1u8keVJ|?cLEzVSV(^P= zZ+RS$@wr_WU(aL7vRmpvL6CQ8VUe!KuVeBHxT(}{po@-*r2JuPFB|(srW&F{Xc7RB`;H|4h&2~m7XDMJ`M-}fTis-R z(|a=tj|-A4Co%>=*W>gsfmL_G2JRQpAb34Y6F*;(rD`6xk6o3`WXWyF;_p+Cb*c)3 zrOHors#aiaE-T5q6vI4`hefeJAH#w=3ap8$zYt?-NyVTu4bCto4S;1SMhT+%KrR{L9sFHQ(>%DJzRRS|1GYcGET1dI@E zS)L@8{_|e~l#bhjt;(-=qqUp0pOx|z7R!uJLcV-a&SwNCmyN~5VJbbAE9{Uu_Hn=f zbr3E9@6q@GsC+vZZ2EF8BxGZfgKD!)2DWqn(bX_pdM2_oT#ZsiLqGFT%1h*TY%^m*#)W)RiTkE881Gn(6F&%pHfDa0wY6Mu`U={jwG>9 z@QgG_R0%eAsuCkKy<{7~oA(EhN!bWH^jChcXu+(CKwG}3IXJgOThk}WD?bMpDvEqD zSLx`+%io&!@moF(H(IXn=2%tZk4q#=F|$05kOxu%K4aPp+I6$;w~ETHafc%o)Y=2U zCb-KY8(+aC^doh1sol_-{+6Anv5Vj3G1C%)OpEN6w$Fz_IZ3%nyTalYIDr_c;UTVx z55TX8bK2V9BhKe_>BPeZRvgO((*vKT?8x~NgY9hi;-l%u9y4YPGSx<-F~v{KDp+AI z_yzuoIQy(OLnjoroVW1*6>%rx^Yk&do=QlfQz}?IPW25{Qu)> zf&WC-{x7&%;6IVI{|l}b_9FC$jecm#f`;F*{vNeKQ+b zxdG_S5PDcguTRWJEugml3~W4w#Vjs$4FbaxA|_ydd6Fi~1~Ks~-Kq94ol|vDVSsfU z)s_~nO}n#F#=|qdTRz^;3Sy!EbdqQylV4g*l98S}{k4#-k#9#Z;ADDAFE}lIuYk@Y zV^ul97P8A51C>7#>y{wxI!N)$`y}pmtWZiBU_Z_mZ>cg=o7y)QsNQ-TMc^h7hxxrYViO&~&ZQDE@@(2qGpZBc^N|UUet$yTsgE^NkcGGqYe4DmFa^1rNRJX!1 zJL2-%EEk?XM~Z0^Yc&S&q_|yq));5*+H#~0%u-%ZpzFmMmgT0vJ)0W&@3Feb+Il|X*9S)xD;s7UYuLzF3uDM*J1I_a1|OExSgToqCFFX-Ln-PbB0jG#UpbCZ36X z=Zm)3rW`?L^z;IUyrT#G{F>v{r$I~Hw`Az!3_7CZ%~fIL6;N?~mV@-Y;f>wgM#YUv z4vPD;O=%w@_{>m9ZBs>h0gxtYDIgg9CR07{EK}X*Hj_2vGL!Xvw@2;9^(cMsx$H80 z?7I0|yh0ug|F+O#bVC^{;xK2LV{ar;taJP=&Oy7Fb&?Jt?+3{(PE$-bhH)B?@wQ|d zj@&0VON41Q6wCG$1$1O|p)On?N(*`ksh-fBXVSU7@QYFC{@2rwKmu$C%^$TNEiQ9s z1JQAtyi@#_)pnj zS=99`E3FrEG68#5WHadNn-v*mN6Z(rIVK(5!G$Q1?bL@r!(eS4fVfTflIKEy9Cdkp z^&`n)VI39FZ-(J9cTIME&c>~{VuSP(WD~U4->#9_7!`7~@| zpiCqF4l)c91D+a7fj(P9u%@$yUIP&tai9@4`?psI9%O^D{R!p3e*cqqLUqvv&YYyg z;Jco>{rNBlCaB!z6pv1rMd(Aamk9>8wyj<&KqnqK6aKGypgY&@t7&%;_D##7Iw%#2 z{zt82^AUw^vGq9YTFPa|o~oI&h1c*)irIdIN^3esvK{K+ypRI>ddOFMtCY4ED?2h{ znZ8bBovC?UUTPq8S@6gaYm|6kAy9`HF|l*Uv=ANow$y#Mo-@K;TSz8hk!#9MQW{*y_L5Fgc5Kn}4 zm9kWs5f|NF?43ZF@pKnFKBL_|L^9s}&NtrEsI2`X)~~{iB>d=4OCO@zLYWihY&ed1 ztpLY4*&;2*LSXdWM+gr*snt{8PbMs3r!Ep6wBtzAtGYzW3`M+3g|Z)gPGDA1o5>v| z_M#>UYdWAFtVl?N1p|CwKvBUqt0+m_`S(=WyG#XKAIy|h*MLW@@q8i%=+&pjyB~2` zlax>`wJ#FrH6mQsTU~pceQ<8? z4rW+SM#^e7H76D;gim~ot2KUZ?Z2GHLd3uFQTP9?03BUf?RXy6?q^RLD`2zQuST7U zlIj{9)k+_Hp>m8^FE4cbnYR0QEb{u(*{*rT;)jcLVs6r^WuwGXWce>w?`y8~rwaLln4&utBPSoXu8KZc zGzxeGUI1j2EH78H)5LQ>RQp_K&=4@!*;ish7eF<~;#hzI5n&pa#r`lnXKp5y zBRXgOL}_kudKo)Q@AK-s+3GTq^8Wo6P1mDPo@#Mbxcivj1?OSD zsrhl4)k)454wl@5PsS#SHtPIwH_K%YTr$@FT;_RicbIZycTg&AK7}1F=pG;#s(S$p zvudOdLAgvK80kO?a$=AH8WLUYihQ7?Gcwhm5`+tHSz)c-IggoC86(vxe}N@W zv=z3Fx9f(XNI%lX&4^_zK<7U9uF592E-H6O)>wJ{re23+g*~o-36z|8KjBz< zxzm&0av0D|Xa&4_fOL2V?IZ0ItrPRekks!QmefZ1o)HqKkbli?eGeo$9 z9g+44zH#L{cp3)CM^rOt(A z(^9}gqnKrF>Eq~5q&nyq_5B=<+y4#G>n@e7fHitA&Eq1OsfH)|4F8@r=}m=5G>zTy z6shx)xpYpEX00$`|J*9=W#e4xI|<4F^f@^Mqo!&a|LB!#HRku1YM{*<6+19pS`{R% zjd+CZTNQp8tqDME#U=u4-9?-<$Y3Tl$mi7&f~+mw1&D7U#+{PjpCucaiEuB+?N=m8 zqs1u=hV|2_maQHMZ&)NKnz2bk+4dltwsaxh?dtAK^4-*SQhrSm3wv|ZUG#o`l=CY# zgMp!ooFk)$1}!m*w1mvQj%=F-&oM!oMms@P)`xC|$ctM5Ny z3Z+Uf2O@a3rEF=3eArtmWOJ~gq&xI`Az`N}TD&ROELd~oyvrz`D=K6>9d|1)Y9AHY zf374bw1k%hEZga^T{ypax%E!X>D=wDMC%y|?0hYLZcqAnsQCkCb7t40_GeFdHj)As z?$71BV5uEzr}-9EXP}O5^O~MU#Y)wz7_m_bPh9MrzPj^t0t~)sDxm|DjcAHf$xzfc}a)5a^KrNVD6#+7zkc}*>vtU_B~_BeH-|W zG)Fo71ux&xaxX1dSiRY7%<1AR_wmEVl5x-FMs7>+Eic-Ocyq3qvt6E-s?f=E2J}2G z*_p0dX{1-!9F#SOHqEy{bajFFAqEBwwUR=9_IsgNKe9k0Q4$^@XTKweMc7(&<03s7=TsbE!)VpG zF8L!?v<~SHs3^fU$Q#-p(FtMTSg6N8){R}KDMfz#$TFhG#+gv$k8jVRRfD}gFoayM zh`{u&<4{{TK7i40S*$nAL&vpd%!;zhS(6tY6-Kr5Of#3ipVn65_%8cCX@OFa`*j=+ z8jLd9mlOY_LOh16v8(CQI7IsuKpl1H)YGA$*~mwAXZyQ^8nc}2W8g%4g<_Hg{z*&y zCA15bm)+(VjSCOWz)5euO;PBVL&JM2Q!v<2i}R5ae9w46r$r)h;CvGLW~ zh)@+wto%4-NACIfoi76fvLTaR-1mp}ap-N1CRKGFrQa$@7NW_zi>AP`jHcI^hOzdQ z2Ik3P_ZhvE%4=mzHTzVEIQe^`4!pAA+nwaAxQPM`kmna< zSTZ6-u0D_1+Gx+ncSf;mX>8vB8t&X6k0mWuvu?FjOXbkCQ|>a1~yPR(o*S zl_??`SshJbxnMR>`%O{6-d!#7L5IXtXw)wm@)b(wCTLADuR*GoT1AOb#}SU;o>y$4 zH-l2r5KVX5s{%MTcc`tdJ+4_231hf+a2sNC?Q5HG1(%AeL0}+Lj^;X)nyfjAe%>68 zc42^?_`ACwO9>p(l8WR2wMW{@d{z4~oK2x}rP!1LzZjI%OZX2cEqeF);LOB-8P)<> z)BeV@9PE}Z%yhboxPjO>fEH4kuOVWhR)c@}xO=q!EFy5*EF)NRb%AOG_j*-93tG>( zd$AzgT=YgYwqaJkRs%65(DkR9h8e<@nk55m8=i}Dcnz?NK-Mek5P}1OEw+DZ|9$Pk z5@YQG4rSc|Dt65QO43!HVAN4d9LemlXef}A4xcPE_uuMd`wNJGv!1}|YZ=0aweQ^uJ zc^@cxd-IxSG-{m<66bgYGKW1$`+hae=7WRHA+hWhwC&EuQRj1J8ck5;rd~H*;RrnL z^2cIrhYp3Kn6ksuy!mi%Gon#0!v~;+2g!KV@w)dm!f;|qw^uh)oGPqkjFd=_*T?nj zm?MZj*Jp8-FdV!=gLo~I$K=wqvvbD`Gn}PEu*Sy_v=8ieD1Da*S+3hmmFsE2zW2G`7$rklE+Xph0Nov)UbyD-mDl?=We*GF$$ z?RtB6W2!4j;?gF8rDuuGS8I{-A@X9`e~fh`Q-7cPrB9Z(p7Rl@9=C0KL28vNLn%>q#tS=Ub8UH!?L z;YF#wht+GAtEV+m!^vFut$8dc!|WJ{9&g@vJnW0drHay*7b$t*Q>c^?|M_%cF5kCk z(7ZfiG`t-zFjQ`oqA(#SD5S4Y`ZxLZFN*biQ`AJBZbR*p@UD915(%s!%_XTtBwe~*V zd(OIkhVNj!{{Z9RnR9+Gf`RUsFU?CIYHnBn=Y7=ime-2MpubbFlm+Y_FRAqsH%X2% zmEKG<1DJEnmC?2zZD=-T#MRK3k<{2{2>E);9Sr;-BC;oGB-(X6MKcwD_s!j{ zgQ~K={+9Y8qe-;7lDG0kc^)?4 zQUkJ15S*p+N$ z#_x7pUU?OSyT2VY-Y?bD7{lI@pbYPb&F4jy7|fGw$mJS&8pS7%7GYH;;x*cEah~Ti zp-H8d#6=p-Yw!{F$VRqM+5B2B;R}4ei%l>0m#-osa%w?&Pja@p^!HtzYcfNw*ddo!&vW_S_1$K}7ZE zgfa=YM?{6?_AbKX8BM2i3DVpSiHSQh5=SW;z!e*jnlrqd{spq%$;WSY$c@c8=wYB2kiQyl)u)5!&ubpXb$lP=p9Cf8rzLJ zFei-DBdbEpwGR~dfK|oZn$HW8Lc-L}{15P9zu$T4o{a4_xGaS16{_$0M|rWB0~3{` zQ$g|u;)e9sAx(S7xDX0`v+ZvRYU;Vhxt%y*!k1PmWf-&aGup-XETA;|)|+`2X$fv< zJjArU@Gor-7!%{N#EyKZxkgvL@G&YW0S=jVGB z09Q^9CY$!>knB-&$hbV|2{mxi+`A5r%VDSBgIL$8s=+jCA2AAn6+lgmfl zEF4FYrO8Cp#nnrT8we65Fsm)wKTp_+&@W_^{LqWPB(r6n)ivq$HYTS-FyiX0nqfi4o~x@abHb%OcveU z_Y>1pkiOGYe5|#@xR32~(LGNTQk$b{<%_~90EQCzcuhT9S4)_CW2g{(B~CF5VUuui zeAw^d*$nv@)>ztzJ*KgOI4KtgJ4ht30uFSX0vi_8m$QUUh)CW;*4>Mm^uM<<*^OJh zqK+|2a#Hf_{i6CQ8fC&6*+~lCdt6_-l(PdZINo)V7BpUYJ!A|J)_NbF3jPX69!Xm zBV7LYb7yH5*J$)FU|mGSuADbAo$>kGj&^O^X12nUiKOq|xEvZaA+ZiWqSOOXhC$dB(Y-GQpO-rJ?uzt9qaqapzvWpvMyxU zKyDOy-HG6pG_;QIJ9Zh|rs$93DtG?EbE#?kY*6Cyz{! z0vgQUM&c{-6k^pfDi;E{la1p-V+tPOQV1>wGOJ=Ic~z$P>fsvHs&U5AJgU|w$VsB} zGtU$cd$vtJ7E*OgH5|-x2MawIx=?Wi9CJQQ1qe8sNf;QVO4Q7Fxj zXot`T=RPafr%pj_k9mj7sr`r3EwRhL7$mq8K?uY8eFs$Y0B9ZZ4yllYZ-9E} z-zkL(5Ig6^8DlW^%@HY$Hm-lB@ zxmK!1b+x?Nnuy{iv#)KiHEMWZ#;kD)#@0k0TT4TGPrqC|_fe*p4>UvFdJe>jcR|*| ztUa6{5z{|$627k~*7Vh7_p@AcdVQ7aE1MFqAmDTd}%Zx`r{VUpskw3O^XEKV|q!~F&7WozWMTFzo8kH zM+=9nh+S+R6Hw$~?c5&Lk%5K{wcKr7+omD(9yKaDJ+s$jSXQSgEHMmK*|HdloHFQ# zbwEMcgL3brmwAtlA6)2GU5O&^6|4n53`r3p)Owj|9IV%8jaiH$81eSx44KB{oNo37 zIpRGU!yNEAg1BYg%8!QI9^x^}+>;3TgAn*cyINA&4rIr&-bYS3TTy3Srptwrh6W)^ zW)+zLc2`kHl}aT2`st7jjgnNHTr`KS)o&= zSF={e<2WK?L~84&uSgiK(xv_6BRikuvV8^wojux2#}{O*#8zFU*Q9z}0qU0cgX1%^ zsJ$7`AG`gShc%2Phllui-7a>fwJ;yjiM&*MQW%DSA!Uq^v73M1Wa#8S6#?WZUh6rA zUyvmhkFK2sGI~O_F6zdlt3pV22hp2xu|8GYWpt3(kImbp*WGB-AC;{`vTm%{UXyS4 zpxd0oj(eU_YLTU0GL|3ce-1NRtOu8Si7zgl$qvjW8_B(=cD$AfI?mC&5NE-#a50{G zxUI81e9#)|kXSQjfUg+W6D8p+>6h=PM|Bz(h!DFG_*l`hKBr)gj~@Pr>fm{o{pvvv zLs1?(KBZ3DNypOXiD0@#4!g0<@YL-IZl4cePxwa)LQ(b@IN*?G?9T>1S!q>n`;@uL z$_oGr2|S}#K3OQo#X<-dn@S2C>rhhtITj6Y-~8w;o1QDT<~8BZ%Ev{m5;w)TsWm1| zZ1GLfS(P^SOrAvSicI3__PX|~x0Qf1v~#7hyg-w}UEtBv^D zHGw^v=#z_#bfMasz8a|xgBOrNNtXDW)al!Nr{c$|MXC+{Whyp&FLUDzMIO(Jw z*yN-RHt*C&_!;ycW~b9@g0U32o7IF?$ThXhAbR^X!ZBHjln;Hr3&nW)#|w63ry{Z+|{@3szjQO3(-W6PqJs?U+`%ox1 zY#U>3X8_-89hW6lrz7zReeN$% zWNmVnIZx*`U`B9=rN|-pkd*%GsypN*TWqZx*oyn_G!wW)n5+QK8eath#8IBJ|C^Hr$$-c zTpcxz|2%%mrR=r&#MMsnBbbh!Hjj64PdU&0x$N#MVE5JCjqfxXjh(>~R6A>PIIqVh zyP(C;DD6vkg`OQ?4@s*q8Giv+N4UEy8wX|!+3gjV<&0hTwk&?cbLAQeu;yvPt`UpRc1_|v+=9vd8WomH zjs*bRwp*jKZ<3Yh4n)cOP`tR5FnLUa2`}f5hs%{FuQ&DPQ(739K(@8!mpzV~+=%aR2C8zRk6UVO!Ue+A@ z<5BS(3MV=`vKAi1g~-tZPZ`F>E_v9P`F@hTxl!h*x={8WsWGwurD~XB*?Jh_aC4x< zO4nMXK3rkT=ZL%SS!axy(?m zp~O3`Ef%=5lHW*U5WG{b7syWeK*kE(-yJ|RGhR@ds^zs?D*ow9Z~1i37lntu3FC=z zqdOP8!=wFOS~4Ujj#GPtGp)G%FASIuO^v5vp|9T9C_2{qW*NMr_4y>&`27GT{H{J1 z!W_aJfJio>T#VAH-edz6SY5PRtU!Z*!8V@w z%mgysOLT{<5?&44L>}=_q%V|1bLSCSA`C)SkVvd(DrWqK&%)*UH!&ulRT8ssP$9%< z^d5<`9xfUAh4*o#m~HoJH??eYHJPpUtA>6AJu9A3TPEr~YMA=;U7}tmtj!}8yWD}9 zS4Q)=G00L%ob&;6O&Rb!mJ=$igo7#&t6mkc#1G8M+;^wnSf7Sgz}oIBh?M&=_Vn~g z(|{2=rQCaFOKasE>ZFPKj5rjG9N`(+RGYod0B5rW`8zJ`7*9$Mi$vqXJv$JGMy#rP zl6(d}V9tg*q0GiR#R#5EcHfU%RL7tUorFsQ8Qz&i^-53QDfYp-P15HZ0~M7~4%KQW zO;#r{!uv!@pPRq2=}B4Cp}{hxbzzqnCQjJU0}Ho2mE>+EN*AzWZT2|teEvCo!8uB` zusD`DxEoF+wvC)OFQ#4HcI4EUqI4>O$^$#%PWcChG$xn~yGMGVR*&B#8^wL@DT~R= zgS+qu?I5f3rSMn+;w!W5gr8x1N;U?{(#xgqRDO2`YiR$Fkvy&whQ5CzT zR4ZQBz^mw$l=BPqwtW3SVxN~uJDqJvrS2Sj$~rA(D+E+ArNe4FeWO>s1wIp{K$=Xx zd_pqIB$eSK^v=>x_ZxWOp3I6UUMmdP3(bUxc1e^x+m{zD2)8=#K)0$iTokLCWO~)2 zI9FYDLKZslzN9)EvjjU36flaM$G3Zt)iup-BzkQL1WXYg%|zpT2p}%N zqVDvNU0m8^5NMw;$FLkvU9OU&&(%Ei89+{cEN~M*^wDowLtK+mSf!3TFW50AM)k0Z zq=#C!r+NROg8nYbQ~klhmb#7A7xC}5+$?kv2R<)!t&~;HO0c|!p4K)=G0x=|%k-*u zps-GN`l`x`MB7EHT_73B505#;-2#ZFpR#^N2Tl0lY~{jQDuQ!YUZW^y<~dl6z}v!{ zx+QjSM^7s+C3$|Xlz-i)fKTA%NQaVy6L|jlylkN?(5L^y*}n+Y_xB?jwiTUcGG8*E z9V3GY(K=SGrpP&KdkKDM*=8QMk<@mhif)cCqiSO59(I!40$hB(Gk5CL#sZ?a^J8nQ z-a{iycvFK2D8OEpJg=f6bmCXD2N z;-Lgt46lVH#pXr?DGcxT2#uaXOQz+6PaUSPF;Q-?O;~T!m~xi=yMPIGcPc`AS1cf} zT>W+6ak2wLEnpayyq7#iAL&1~LP4-JBZHp%z{#fAeMg}Uwm}((deheCLD5u-O0ioQ ze7T}+yPe$*`Qy*2KA-C)1D;$N(oo{~lc$LrhfyRzTHNO>4V7phDmW}8M7{}hse$J>uqS1{#F+Uj>8A6=jn{$8m%iQXwyRKq)^ zS|3_8-otK|bmO(8{^Uff3bVUTX}i^uHqxnh(*Iw++Hq3eK9U%|z_@v=y*YKi%^)Xn z>FQHs)7qy-G(-ZW7Sw6223@vcYDG5gE4(-^R9F@QsinKSfl){ZTq}7SK}s8#@}xS$ zYaZN6e%P7>;(2BLLAvRwuCr<7*qFzB`W}6d2?!iG*5yg^`qZ1g#$^t^JazF{z-TXo zRSljGj-Dw?bj(Hl!)c$m)Vwh>@*X8yzU65BFCu0Mc>1$EYjR3ol+G3s^HP7m8^&1(uU)cK>tN0yXx)Pn@P#1UagEi$e(*3 zYZSejS^=or2%H+-npXLh zem8AFEKde#UF0spaDEC8USEceC+7V&g1S3$$c(MWb-dCPTCtGWpQQ^Qw=zHV5eJ!8 zTDKno4znkm%6-n;PLr$PeemD!GSx!Q^`N!zN;%GEZ3s&bBmw+$&0)qqmVi6CtsctS zsR4`r;AGAs4QKeodK0)b>Z(a{b9~N2n$$2lZy#X2O%SSIVF^plJ&h{zTC107v&E$v zDO0DA>Kr~g8Eh75U_@GuufLi~AT2fJa6%Ojv7qVYl2l9-@qXF?JwWq8jj!gd?Vd?_ z&lC5Mv8T-b;NzpnDcp8ltG)K`di!C?bX@_r*Y_JAxWha^g(gFmFz-P+hT((wq<7C* z=DsaF=q^o1iuprgv%_(4eKTxigYC|o+CW>l*lyOw3#?D;a z@HJy0Nl1+jxqo4#AO6@!3E}p$t;XdT-ToYG3~bMTH?0@4qae|mIj1>T-U$+|UF5%u z*5ajq7p?uwx1treGp*Gi)7qN))3kzU`PQ_~mqM?Q#~O2VX#cBe#XBJXVOqs+ewo&9 zqSYo5OD*`9X#JvX_c3#RlWuBji5|x~g+g~64eD7+h|ptSfrsx%V4nkMHK9e+Fymw& zB@N;RSdvWyCY)KvGct43cTtUxQ`-O*`6ac9h6QKQ*W9Xz)fZ+5?c}`el8cVIH^F3m z^4-v88tThDM3a|NL9^eozwahe^M6Hus~+A(e>b?`%|5PNuuL`hJ;SmGsa9*S)%ybw zAK(B!%(pc6)b3T^`|-`~7rUm`VB&HF!+X!da_XLBI4IK`b26fcPaPFc94O51j}4-1 zv89*oIg~6;DPJb08BFx_v^me{JhyXcxoY_^`Qv6hEK3j2>s8O&B(AlC_9|90vNOyPBOUXN^v+exwj&0T9M7sPseXr)*u}4R%jSkvJ47N)f z{LG!ojBNA1SbY>Q%Xbhhy^*0QN0#`W1s)aAfnjo0YgVuY8P^T(-FtIjP2iqT&`3%f z?XP&#?mvT2+JM@-JwUW&24#47zxwsEG=Q8y49`A7gPVrTfBFN&4;fonFx$K0pqPO}>eX0|6Byt3EXa?>U` zGjmHHPQTrZ*F36ZaKX~YhGL5f<|5f@W^+x;G1$TPW$nTsVRybE1-~}XUu^$ABRqle-!sBP%HJ}=z~6<0i#^%BsyYo#zZO1) z7}EpaYmsym1R|-Mlzkx-Fgq(>PNC{upx`jGja98Pwnokre_d{+O2rAZhrl8t>f6JJ zD+*tE`iQ^CbCZB|+5- z+Y)IBf9Bm>4V|%6^D>jMl!qn45_Z>-lWYO^OP5-a)Z*T+R#*^mjg`guPYDlmBRtmv zC0atMosS{>;J@Exs;mx3#(G0~U&pY2WYBjL07xBslM2uAvRNV0ThPX>&}P{^k{B)T zV!}CJZezm0T~4@+=YP%#GbWb9=_yftHrjOhWzgk?Z6;Tw^EjR}9){1p?XauazD zgF7q^iV535XC^c0Q$0HueDX4HK9%)>^-zMG+I8^66%ZF9ARm*EJM?gTKtf+KirrOi z#c645Lju*HRFqwg6E}yUBH18=YCl{TsNdvri6kM&dYRFDMBQ4T zB0F(RasZ{AOO}<4DpIwFF4AEJmtkW@uti03HbU=)llJ5px5Xu+Xa&b<_O=&)&FKj(&ZLub0==aPML+p_h29==76F`^#!FRudMDu+hKB z*sISV8C!iPV}Wlrwiw~o#?pY2eQLWJDC8g;3(bCKV->^y&c@!!SW}7`kc_=ob1P#X zn{1NHe3P-+CLkG0=lV;=c5&X+cE{(VIsKHe!e&2ZEbzOHwLADj8w--L5hlOM*kyf? zj8(DQoK67ASRNi%^9j2zOEBJYngmG4d#}HLAZ9lq;&0A2D$C!eTYKeHZl z>&VeMk(vU-Co&LL(WMH)qYhP$h1qqqd%K5q71VKi`$h6rb~F!@H7}4`BM&r3LA%vY zIi&(rt(kac0EoH300HJPZ8OhHxru@&3Jl$bqc2izV70JX7<_cU0d8{@-7U}Zqj-D= z+~SiIA4#2~V$%|3HcmM7!VrrIaT$mQ{j>|g!(ZX@26>pIy;w~cn0VfBwOP_%;4Y1)4{bb#Jw2s4y&@5EM3Wt_@O_`o+e@me zz2|A|Yw|F?v}TcLi-A;gqaOE7&fJR`Ro;A#G5Zb|_0Y>cR>d4n%U8PU*{(XRn_pTq zPB$m8ZDPvjcy`4BbGy$cWXnWZEor!WXkq0Ert+EoYe~^*BqSM~v^8eCt;&;M0d z2}teu>o$HYee;W1o&8GvkiHW7t*DCj==LcD20e2-e^6q0hC~}t;|tkKGFIlUd2Ey% z_xh2t$WO-~Twn>BrQS4XRo?hu4i6uSz&w+!LoUvKSuV6g)?*%i_0VP zY*eUwQB1>byTOtN1ghgqCynV62LS#y!~AN=BNTi3%r9K17g^2c39H9G;JUnSS-&gU z>*{Yx_Laj=B@1p*3o^0?R=k_jaXXbfz0_s#gJ(3(Qt(9k2V#8yLZkhx4w{KF}tbosST!PIMtrA3h z7FPOx4-gl>0Bmo5-Hrpj*l%i9h=OG@Cs<;=Z zkrGQ8SYzPV@9ihMt;E|*p%`7I%#30Luc>-%S^;j++|vumXf>nQgkxb9&U~@uiPeqRfqM`z z{!Erlc@lsp+)7ru=jkqCyP-j;TJDr`S`)wg+V9>8KX;vNdXh~U2dNV-Z#>{<|93Mm96N)VLP*Cj?l285$@@IDsA3j zPm;Ed3-q)XJDT=O`#ezTjyo;ATv)%b0LK&zbMceHAJQ&zI>z77DL?trlhSVwUd-s_ zNX?8%rx93_-CAT1i6T(VE)>w~pK_?^W4`0S47=k1;j_c;@eK5zq?WwzC~2#uOehkjd}@cYM1`E(;k0v0Y`FwFxA^f^=>D$qI}xNY@IU zuQ8`pWXLWI^t%M(xO|Ff{C)saUyoV+X&J9kDUAz9^Crk5SfJB9 zj#IFGO^cksvtHouZ1Ksnf0cDcyTv%Jxz&Foj0)GsjKi4J4L*bryeO>WWKxg88n`R7 zPGNT4mRYO6!nIOXRbTTsj;`7*H^vWDG}M&pe3jHU6X>AmOOMH1>l#`ug1`bBhxiC* zfH^=@-y0btjLcAzu4loAgCp>9MGC79tFY)yxiPJW7FmKYnvd=~-v*sE@_=RC8-;(1 zB=#w&5p**MoaJ0Lz;zeq`bp*i_idwf)p_*L=qb-5aPR3J?$@519yaf9^f8$= zEK{n3-oADB_<1*eXsQ;ThY3XodaJ(jMs#++-HFgLkL6_NnYm~OsL|@Dc-v^*ej$wS z1Q};=f@n&KV7wghz%pu6XAc;DF-RO2nZ3%^z&*-Ux~VMREZ`CH7hMZG(I+~~1hTa( zSRh+_rt`b4E&q30dtCL?)+%FyY_0vrAGTJ~^_#7A#+bVl3X_C#Fb4ir*J@w?)U|6j z|Eg-rc|H-6b#AIHt0W4U;|jG8(wJr60gbcwk6d(Y8ADM)0$0j`$fLt9e*3D0sE z6Vz{fyCX7jC^rn}>fY=6<+MK|r`G5Ku#4Y;&hzf(x4SX9K3!a?^i?g~ycuk%dV@8$ z)!jWQ>KQlFiE=s3d>bP+cltd>tVnbhBTn$13p{q7$+%ENp#%r{TKB)=>~DNK9Z2)q zcm1~G`l2kVm5CPUZgtfs)5@;lv2~gjQ|000NWuG7a;*iGT*J^z;y@+Wowz4!1;Ld` zkHT@j--VNmDX8QcB|a0K{jKEs5b-|J{ToRbF2LCEJUP`Xu%7RX|Lz*tm&jv#5~Q_& z`f%n!qsC{-^z6kNmrCF`Dt0Eo^(l6*%dsMgX`yXzP=sTU!fHPAj=?cOS1X45_bf5$ zgwGSVwnC%PF2pSuqbp>5LM}f0x3_?6bOj<^xqI37jIIc;Z*RxvlryFJl{#k6B}@va z>bf%i&I64Ix`A}|jfyeM=_c7qO3OSq8`F;q0x((!Q$9@pI$n+=+e;Sba98eL22cfd zMa9%uY|;rv5B}#}BF0!KCbqq|KsCwumlCY1%54c&Fv+g9?XCn1MUn=k0U$ZMT=s6O zuaI}~Ms(Fk9&y&r|9NLP4Px_GvBD$o*OfV(7?_tA#cv8NuPiTprju=XWoJ`6W#s%qCM#kG2(; zxB%N-+8~_m;tqGBxZ~S}8aii8uU^B^c+iJTL9(h~l`CymnSM?%Fk-+|KITZ1`kL_( zYk3)jr)ya#UEOu2WAI&8NC&jpUA8h3KgCm$TtulWqb&a z7H|r>&!xX>C2|)tR*U!*GyeKN#Ebz@&bX$n%XNT>r|jNtU>idiC}s?{4oSE<^RF>u zxbR;wV>!|R3QD(B$J>}O;v7@>vIN9)z(?0l-uck$t!Z^wPWO#P4S@P0i>lPh22_BJ zy(_>5|Fr;%)(gl9CzkxyfW0lijz)Yhz@Gjnz`}5RE5Nq?NdeYt;;sPuS?IO^>*uay zBsocr+JtRHp24U(8r~>s>XiG4#4(p1F|=+N7x=fF@&Dg3V?bRnTA75_eOTl>+|Fp0 zy(dc*ILXPgE~eLzM8=$`Zfy>bKf`>@TU+Wtf`dUYy868VYxM9hI=5285oB{Qf3vye zcQ$t^_SWW7&x33(!DIb9o9lOHbAi9rxd^%-oeTB)PUoftUOia9)45N}Kspz-?U&9K za#%^Siz$uJ`l)l%R{!4Snoj=*n+yDn&Mo;}=Uy6vbnZsbRL!l z4sHL4Y=PUX@jrvMe?+#xKZmw|M7F>`hqix2w!lA!wtqynKv&T}g|>f0w!p2*{b$hj zkH{AI=g{_#$QJnL(DskW7Wn7T_K(OG_~+2}kH{AI=g{_#$QJnL(DskW7Wn7T_K(OG z;QcqW{TMgKVz8;pRPU@7v-OaKP|!spq_<+i1Li_)A)uU)Crm)`x(5zL_J!)JoHsS9 z)tpRTWQ~$?nd%H=QvT+yO`RFw+$`$ThcI-^hrQ_z(|Dpo7J%hDQ&4*OysV7j(=Vu% zeZ`t!3e-(Arf&U4weFii=OC&rfZ^s|ekX;WZVaMY3$%HP7FnNEWYNb#TEN3&a{eXH zE|>^ZDsnlgtoR*~B@oq$10brM{!X=jfm-$7pw?*WH>d^v8`Y-$f1%ouHqdg@(tm;4 z1T>QmAgHBHxP@AvGW#!7%PR3VRQuNOeD80lR_&E_LG8#dsC|12wZIRq{XeBz5Y$2>{1Maw{|MFoIn)9_nzR2~ zsj_$r_lmxz%rbNL#Tpdc{eA&wB|pfD+0W_@GfIe)-XEk2rVv&U+p zm`|S?BLz@feJjsGKq3Wt2yx;)+P8Lk2o+@3gcCeRqwXre*O5n9BSGOPY z=(IJwFIbJ4nlR9i52-O-Z#)X_;Lz=jtI;c>Zbmv3+HO4Tqq-ppZ+nVpRla{p_r=5a zbkg8U)K^-{LK7ip$X>f#83^aZsO0tTNHYdMw5&^;hWQJggq+R_Z)n1w z0w}f`-`lfX-`cZ$#-R4BzmUNwk5KW_kM=Ao3Fd8kmf!xaJ-dqYtvwsj^SwR$Er9$@ z*qXDz{|F#|6SkXm6k4dtF1PjBzCM9gP<{6Np&VG_LHDV4*%5Hx=p#~Z*qme>d|)t6 zaItC+kLVf2jaQBm>1eJ$x^o4C!fEfgl4eCN@!KtyDL;gGouWEOo_Zu#UYPgz!r{jz zS~_deR?o+jxE`x%#R;u#N>x3pk$65@UFaSArt%Bxh;*(L3%+GiG)cojZ^U{~fUJu_I?7_QF#6pz+aF>UmDP58PQgyur z>=UV^4dJEs&?Qt9ORtMLB;hW!9hVvS} zuM8_B{#qHv-5DC3xsLy}GHlW8D)q1)V8r~Fnc;t186GXUTN!>#yU5dxoP2xqHbd7tfi*EMlKM0zo}JxV;eAYrjUdaW;0zRp`iI;3 zVQW+;tuD~~@F(Ki`C+%U@AJccpW8n(y4=nW|5zWknfSIoEM4iz3E_OVKJ0GxYke4K zs=u2b7W7?q6zr8}Rgxbu|FG-l7;#3T%XR3W*QxmxHyEw=v(uvG+EymDWkQXyZI|rH z7QPVlapVUh#ZDho?1XpTX0^@+v+Vk6b}g?OvZx;CN)c?%z4!usp`?}XV*7*|?+Bc{ zY`9Vy8Wccg`6g_y@;Fp9rFDVaUh%`VrJhfwG|_)kt>x7Gw`#2u#c$QxM2c&k%)hJF z{@$$p5kUSXY_Cw{$2gpk=8uENUouY0GXm767Q%yzoTn4`?oG0wZtX$j-W&<2TU(bq z_K3aYwp%; zh@yP}s@5_S{Y|x&!7WDl0~Tn0n19Ux_`W|3pNrb0al1d9%>f|d;(QAre>1k1&%^ok z+?)z;Hv4J2bm>-RO7wxf5%Vn#X1rY*sz3;b7 z5Xg8CN9(%PKb|L^)JMn3)T*NTPP`){0uLC46Uq#(-XPMzrJG|s?>%`$Ke23nHh-Q5 z3pF2ysPdc;oTTI4Cdoc`MGU-JYlA1Vgq;^d`GQPU!I6N4SV2KUFh0w9f&<;k;nvRf zlNg(!u{dM~KP$s!!)nm*ura^LTU)TL`ygTKZ&s?ShvL~|nyrjG(B_4_RrONDtPP+x zc2%IGJb?QaK>lWI-L+kdr0-GPV*#J_cvz$jx&^!Dpr_IaPP-P6mJJ%MS8L9}HlI-# zI0!&{PyR@4pOSy>J>856_eRBM6%Z4CnEiDPL=cL&k6p+&Yq1=)hOv9_ejEV$f%|<` zFs_{?&m>9-szKVkyz-7#UX9%Q_QXcA@j4F`G4MDCQnyJ`PG#pZxx$&wAk0xBp<%$*Yt4s?euWrNsockujSzs!kSbbbbW6l0qJ0e9)V^O-z1^?{N#n=yE8$> zz6fZUQWN}FE1LGH+-ntU*YZMLpFrEgAK-42#=viG_S-k#zHqZkg;Pp7&k7QamD?(# z@9nm%nu+mMS}zEmO00Mo)gKgO&`y~j*dIo^(>HHNE{tQK$FeL=E?&JsY)S>W^y9Aa z!{ZVPcM*nI_0}^Bu*OB-dwP8G_yoMX-%s#5*7Y(A&`hP3alN~1GpRFQGAr_kyUnM= zS9C8FB&0Sgc)xyX`>GblTQ6djbS3XOA+BDkot~JA?s(g-y#lps-@QJ+BDpbDYHnd6 z692Hbfn8oA=+yLz_cnX{&DDN-#ryUAF*+X==m($MyWu3d4$3Ns9Dx8Bfyh-{&5kPD zIf{4CO=d8a;}|OUd1^YVD2nZo5D~s#prD9F2Spa^&pQd0s>5qQAV}BfFAKOgIC2(= z6ZeqywL6x_&ub9Wn~cb`(3up9Gi;+1NDfFqURQ13vE>|5Fj0vZ8CX#(-g^NIQysK} z!K^io%z$eU0Hrk}XTJN=>HDTHuMlaWTEE>53tEzaqcwl#RbXIEzFXkud^fnTZUvv9 zJl$0>N=U3;GTse;i~!sH#T@47e1Fgul#tYqEhr(_%2&jKxaz03TTtG&TTsL?KewQK zxPcyyY^+xo>#0iZG?6w)w!wM!~Y^vwvrPpK&z1~Co2<% z17>gF$69WYXFQWsvk#1Z&mMo1wWl=jGw(F5uvs!eAK^w6BQgau{+3%Y>kG`-fhOgN z-4vtnZGk2xV96T!BobyiM3Jg3I>-S$BIw_lM8X znz=eRnb%Y}8yWpyici+s3yMn!m;$Ar-g8bZ?$Lq7c79t827STGFe4@6RquMaMG%~` zzI9($gU9G(mAkf(m{lHzNla`uOC7tCB43d0N9#653!R|u@%Pd#Fu6SgYTb5iswPAZ zcNia&e%$vQ|oR#+Sf=SD-;@ODf2u zziTc?e~l6DCG`BL#}rhcUh=J`mn~k@@+!6#)Tqw@P5%;~FHdukffkmCFTJjNZkw#y zT`Er2K65PNFIEA=NG4hDVw;K-LeL!4NvCH~+qm!A?{iRZ0z7ogm_?zd-$2aO4X^H! znxStl<_8#~>qo~VB&pu#I~D>9*;HRX1uYGeg@}-VOJRpdR0r;Le6aIckb-q!Vt{!G zxxh81zOYjn#ZEO?2mL&apY{{!3DGC^69&M0yDAETrL*qI3z8~K9$_*4`p!CY7}Of8 z6sIxq(67m67PJS}HQVn-ko7P+{a=5}AGf?&uv0Qg>&zOcqoP(b?omW-X)QP1qtlkZ zh8RWKF~;xoYK3CqNc_xPWmtL^+w#|?;;89omczoa;=s?TVw1b6;;Or;Vm~&}RIzBs z-BfW^%HK{E-z^mjj)9hn!A5VFijfSpdEKh-mWstqKug7*d%u>7Wv9~K2K$t2pATAn}bqgJ(@ii{V@j>G52#0>UIwb!~4e`l(XsW9#mBL2n!L9 z$8wE))_tD-ZkZ$9ZdNQ|Sh?$JjXjqnso}*5!3W57t4k^VFZKelg8CoUj2MhC2SVh$ zMzs2x16@O_xWim_LW-YQe`2f4s7_e^X1h2BWz>=f9>?{|N8NUqQ2(H|l^TGs z_PuNtnbTolNYa~$h*mK@b_A6-AEkb_YHy*I4F~d9tM(RZkJZtNee-y}O0vM|>nG2n zGnl%-6)qKQRtaO92zF1BPbUC>G#N3F0O2PvAc* zvt(TDA3r*%tl@8i-!^?u?{N{Q(=+EkuG6)cA)>5GDj+{_QvLPeD1N#0oc5^XmLmKK z!Cp#r>@)=!Wez40i%r+D!7?Hk3eI~482cooxz8C$;50V#_hv&gIFPT44X-`KOyYLAHT(=La{>T40$C^eu?;ah#!)JHC(L_jFH+&Vs#7R36hVb{$-_Cj8X zT3TvwP4#8$1ilqv(8=1W86YKf_&K7kZ#!G8qEeHW9A+j4&N)cZshL70O&m|dUnryD z@Og0;LyRuE=((AXnemvU6Yd+Sw5c7+Dc>_Opy>_c-NQM5?b7~R0(nQbYJ^dKN9EEx zpx6%XQEIkhBr7!(TqZcwOE%ZnDAM-+SCMmag{pIh6m|n(+Qp2=IQq~?elA}b#7#dr z@(q1q?8vyG@Am|V3f;eNeiy%K|TBP&kt!ke(OP~XDm zni_)=5I||NkX2psat==3?Sne@!apC>S)>C!sN<*i?LnO(0R6WYbsjj~y{OXy6ZrE* zozmZ4)Hyb%ynRro`0Muvb;8EqOp-siYt`OCt*b&peoz zt00j1zl&8q#4;naZIdxeU%tPbYr$If2&11+;2Ep8PqBk+_%$}lHg}=O9CzWpJ5 zTc~ZV7-J}f7SOBs@&wU9ThQn3HJt@?7GCOT&}%wBO0~C4+eptlN`4RhUL4piKg=jS z==N$f+aojk0Pa&Z@T!@@`D^R?_S*^L1f)3E{8lLK*@3t!sDKccBAWf1&6H(vDY+38 zWEu0Hx2y5qojNF_9@Talo*OhLyNvkTC3Z}T263_zY(tO1FumBjn=n?(>CoFe-J2c@*J@AUkQD=w&9dD%qDo#I=JNJ!}0rCsixDI;pqmM~rkZt-0&W|=l zH7CxXjK)M3aLxg+#l#<1;dn_**ei_HWtac?i zJSGzJ6Bm~^i4wQ-ZW|z}^j-fV-qvD>(kIO}X8obPtvikfECcYWuVU)2Suo((mM$0o z!LU$6xdP;9OSISq3yy7K8L!wz#!&u;M~zmG+k2LHYlC3d$Jm4852JD7MlVSPhI zq&wToC4XC}{o6k6Ez^Fw>7R}`d=|8@t`Y9Gou~+Y={!wuTCy{_KyI7-%++h+V#gL{4_ zbS}CXu2>fiY`}Yxco;6!(?YS?J#dMGU;=rA!`AR5O5T^Q8J8Lf`{0soQdEPy6*f?Z zvB>U}Ef1?tMBxTT9dWycjOdQnG@e)1FP5>f&a+1+k9@ZD90Uqj#i75>&>rrGy?_;xeCiLq&?WpRICD+*pwV%hZCkFG%v`MFq&N34Bg*QmW(B z$y-j9Q+Nd2tnj8}VZk0~JTwn8iG1Kp?_ni>u*hv?usqO{93#l+y(}nl79yK5Em0Ta z$ati;-uvakDRbIurdo2X!s;nFUlFHOeLi zxM2E}FV*_#r=~?m!W81CG3~K_{20Ylg(VT5GDwL^#T>=9D4rCLI_B(TBP~Cn34y2G zqh?0-oO=g6?Kk~wlJ$P7mEqwHzkfJIp+YSN&9RJ=JTubyFzK<38uq(Nq5GVH*lp)n zxLP@zE{~Lqos&2(|JgE3a-rv8a1NK(#4tVI--k1P zB^FJwjgATkr9Dt&S8&epJHvarrD3hd^um`l~Q zBcYG`0G^l}x?B~}+hCU?FNGkf3F(ny9_je1l^$;WZFZ~v7^l9;gL=AY%r^fadkbt@ zsf8Y9{Q`EYD_Mq-$m~SZK?91RB~_@#3{;WGGImerVM7>VLiVdv>3|& zhqbc`igRllEDpilo#5{77Th5OcSvye#+?8`8h3XK4#C|m5Zv7z0!$}IzVppL^GnU# zy!GDoE{cm@z1H(=Hnr`uX!1N0l3)KK!fc_~hqB81!eRPbdu53s8AJ@*X{KbQ9UeMV8SIJ@?> ziP61^R$&MAT(YKey(Hc&i!hf4%Bg7%s{ok15nE}|`g+JyHB_VMB*>W*9rc-q!KOxd(fq~_o1{N<9^krlPDq;? zKM)G-RHPHOCFT}v!)*;+boGH-Ds6);p7sq`G~=lIAI8D)l!=pj#=V4PW2~^|h~7y_ zuokgDek>VQY69SpBp&F)VU^Bc*bld(+K;y1PbPRR8rCh3NKuTmujBJZKg4=8Vrp6us_k*9*K$*TlY0mlHTXdAB;lcx_Ro_4WiKNzz4OhA@Gm%R3j^v{&ZU(rH zE!`4)HPWJ$!cNhrh?cT*ymB!=d?zox17r(axX_2?n?>699OSF7?M?!{!r`)%(F zHu8<`@NmwmSO@(4Xa#r9GP2pBGX1E`QZJ#Ysx-&rt;Nbyi&Z*9i0f?;iR^oB!8sj+)Y;J$m`Fz5ztTAAj_azYVXS?F*9 zSeWoMzX#6@6U1HBPRI(cVvX-fE*BCWT`7kUYJ@Z6U!dJ-M+}=_xG>*|0Bc+vA5%wh zPZZ4uTU%4$@36a(fbCe31nY`ys3`yFuT{t|6ltv=sp~q4lkLYksu3|<(XrhA{ll8g zf}qV2(UEVnh_%*AUbsZ|k`Po)!5WempzS;2O&H}{ZX~3}R3CAAA(fcW5= z9%(s~&}f`c$Ro2BBz&GJLmwn>cM|Up(C=cvWS<(?YJV2tX>edqOpcVtizrnkAUFbf zBLWu%XSto0h?ufOb)5xF86q-Td4#`-ap_lnH7r6zB0NhEi}vCx zv5-PKtBUFCU%{%yZEBUmhP=}nGTzX0sm142r%fx9$c8JFas2{u)N@Pb?OaxJ5@qy= z#%z4N9?ceOdK=KYi@b;(y-X%z3^^?ees)EcZ0pP2SU5$3A3|`+BL(P3Uv|e zKRH9W8{WE1IE7ML%`lp^k+!~dw%vvPfIRU!093l8!Uh`NQ9=KH00dT^R0_Qq)xLK0 z*_tA@r}fah>8oqkUX-a8sK#jCg5|mhO5ATp1lsPwf0s@PL`DrKu32O8_fp=kYoMw@ z{sjK)=gLptb_;pCp=H0jJ~2ms?v=%tbfk(pIpY_~H14ReJ0G=_S)TLH%V&iitN0XjxAwa=xr z+CZv~eLKCJ zk>z9=Z)t8MS~#?08_~u>RWNGxT6>h3wze|Eth!SIV`>A5c!1HzgqTNr+TtJ%?Dt3N z=|@s9C!P5}_&SuruB_87wgd?F7I`La^L7{MeCTwF^aCn@nP7Ul>mx4GQDHSxoft}L z;%#VLQdTv3itn?J!FtIi_A#-71AC*uX7MAC{O)5lDxc|tMm!ZTeY4_GLf}}CQrEu{ zJTRmo21*zm)Bp-SR%giQSs;ltn8F0dhaEMO>T1&ycgh(o%y{Xa1kKI(8%cW0N#=^o zlgrFqmp4NKy4)HX1)C71;{${HbwWeqt+Q#NXOeA zCAEOzWgkot9Y=g2O%XK>SehV!_o;%gN&td8{i14}1#Vc_>ciyQ8BiDeUYPFRMK49rv46?G*~G*EfiD109|Sk@g7T zvQwYiMWZem23XJgkhdD9q}NQkdizc<`<`X6V1l%Wm?<|nM5OS+h$K38*y25`&w-Nx zH{;3@u9*Zg_4=fWw0$RceLXPWC{X&-J6=}ODFJm=d_EXr;0{bt0?+RautOE{(Rkdt zni0nJ>`yn37*ZCY$W|FS(;$CLq8c}S78|l`3-~efCced**QomqhGMdPcMt|uI?INM zuX_fV1-Lsam>rFg>*#Uv;zg*@Kx)w=u{WOo=vm|Ti)Y7xzKcJ@IPBco-e$(6!+x<# zC>das|DgW`2ZOVbQdv)2BsqW`+5&zYGo6-4?Hr_Sad63=NsrsIs14`7r0}!5nV*g> zr!=!WS?p#GE#rJ{BXf_uUwxn3ir4M; zc0r=(Ypq$qra`Q~^G=Oet{pG{?MP2toHdM7b*MknLzMhunB1qS-fwcBW7-2mSt9WJ zT+*iP_CCP)8M<}s z_LuGwu%zIzvzwcbjwYwDvTvabMh!gHUPp=7<4GY(dM8XnifIj>uY7j0VMSE%LGTg6 zB&d?4hW8>w&6)6irZ~UZ;coXNA_3k`QQ-obvejNg`d2>qNgaIf3m&==k&ynt7Q=}Z z$Y89YZ$|$nhghJ-*v0sS98QHLw&yIDVaJa)4CWoU=0{Sv9t54tmHZ`Tiq=T8w=aR% zv?}@)?u@#}Ik%-BiLcA#j&oW#;2pxDT=6-hZrFKx)fb;wYLUH_^O?MHRj7ra%F@sQ z-LmzG_~47`S)b6J21`Oom64+Te3vu42;*pILPGc-MFnkq&C2^ z(!?i|=MNlp+RbFY0}-l^Q5$mL`X!PH+#UYTf5jbcRDncEAu6YI4AY)^o@#L4c|ud=Dqwc~s|TyaK|a$8s%=VFqOt z{hpZ1?3VXRHaE2X%32pr_?II^-)6Eul=4XZWjR9YkUf| zPx<5$j4}iWGmlVkzlQNY9f;gNd^IWquyaVL?bq-rsf3!>?hkaI=T*x4D3!8SWLrkE z6&v|lAF77t23vNj&Ch&Q5Li*8wXjThuz!HBp@$1#g$$(+yD(ASN9RmnZ-L|MoX4^3 z7wM}Np1CQ2w0S6un@PsG-k1lp(U^1XLHlM4n$US5c}@xZ$kju{DUr)9u$qQKk^-)L z4zRR>T`nT+#%F{rWN$1kyoz(M!wPt3_qA8FzVQ+*sPTuWz1>$H?_nKYUUzy)xgoUv z_^rT5$jQt>@YvfUpz?QLREIuIN-sxN0iBuM zk-OrR^?@JJs0jcy6)6G?lMJsg)~#+E(zUji;L)G8+B?+6Hzs7>65A&#%OqB&ZG`2eaCds+Gq`{WAI3ejg)E|a&VE9q-K6r zU$gO`Eh=FW9ywq__*BzOr*T$i3|j6qA%*L=VkVu`AV&{qhc3mM@nJS8{E4V2}cp zzN^%@QSV?8$Gwgv4I5Hu1zDAz#VHARb2cjh0CzN3S10CaL}S~XdsJdJleKqT=c5-k zacA&@y4*L0Kcq?Z6t*^NvTjDtAqCL9Sla4ngfR?Es6tt_eSDKae=BcWv|-n3wP7zj z)GY1Iv0*H5+q#Uj65?~Zz<1ys-_l&Y*AByxy;~!}0&r|}wC5nIeIvMaufjV-lY3{2k8kTH z?hZ+&BLBEg(4C1Jk|9wvD!bpHY?ZhECtMD(DJD78Mooll`~{b+<6#cJc$0*ZqT$P& z+IJj%o}=Ih?!nsYJ~IF`+=SBBgu*fOttCOKMb8r%0X{J|v2jiEiu5AQtBA@mrm9&@ zAT@$XXiQQ+G66F(?EHu`0f&8V*CYP@xzK$*d@M0IC>Ay|eNbXAwPeW50cunGXX?}9 zY%@7w!q#~e+wC^+>k0)n?Yj?Jvkv+0^#p(XoPixYrk*uv>I$g5JwT~MxTqxEfHf6$ba zWYiibR-~F^S=@g@wzHNw%-lnkn=aHDb{BP(*6^ zp4_1-=n)oPb+z$^9){G811Q#;Z|JAI@R(M{u_|NOV2Mc41&zNMLEL3eTG%KU6U{?B zf}gl*x}U%v_f)NqcID*ZrOcHd)Y=kx;#<1=r>|=OXB4i(X;l($Iw@#?-5_bICWPFY zU|kSDz4wF72l1ZgHkS@sKp0@8ver@opiNR*CQ)h%PD8vueb@$S!xL9{RdeT(u| zfO{(SeLm+VlD%#u_-N}9sOK;igQ_oDrkX|DbES@*N{IdZfH=j_CM^RRnQIXPHnYax zf40R}MI~QY3b0iu08=bB-5@6R@X+cKvRL8nRqP0(>Y1e>x!F)vegm*#sGcw3`5uk< z!(ZmBi+2|4FQ)AG;2N)U$UKoAtJ8Q?Z%}N9(qR?^Z)xfT9(~3|Gs*L(&MXXZr?8Hi zHf~L?7Fh%j6VIHYrGtkJ#{)0s#3TT_AS=^-(t-otq|*Epq9#E^GsNfU`ow*y&4mXO z-aT!iaMe~Mu4xFv2PoA=_4=DBN3^wnVdkyZ=&-A;aG17msnQsW*4S}V9};xnnYEpl zJ>F+3ScK?CWEAQ}p`~&?#-u^C;6yELKI-i2c&oq}9yh+*V))JSWrggwMTK-B=9-ep z#TU5~_TV*WEskZB*eq*7GB#`sx1Bhlaz+;#kd5jEN##o4uz%d-?dFi?mdJg)>m|CsR6_$Fc{eLYI6uXODakIzbjpsqhwS|$~IS2YEBPZ-wfVsgmyYg>9>hK{+z8zl_O;FWVh+)XJ)F8w!pPVDo%il&;nX5y=Bg( z!U`qp550&^6R+w-S8DsES&>;y>_OdHwID4y=$K>J{A_VA+GM+OckHpYAyMVq+`+zl zcUgi+!}6590c|_@$R#o!BxHmn1(=ChEg{P2K2bUPz!$R-*}iY2kO#vi!4hjs&=m8n zAtA=7pYp#%3tk0C%%VyI=X1jWKtd8P=s-hE&Ilkx_zXlkk$uFCNX+0!87(B$Zi(H~ zo~iJMn5R4h4wxFL?W61&FqNo}`GgU?7v;{(Cyy$~Tx-CWPAY7GZhw%s*&w1q04Czy z97T~dui)^3ieikTXTnTgn^?FOjYDSqReJi~wgB}WFYm;I(PcWQF5V^~n;{^4o#Kvm zv3Z3*Vd}KCCE2;pdbyi$jna8@tN3E~CcP{VO|zqY!ACUtf{3uo&SVX}%0GB1(wd_X zP-do9vSwzY`vx3K!{I^z7bOtkM*G|I{RG`0Vp~a32vCKO8V?vtM-2<`M~TOol(>02 zZh@+_tGFZ;(=A(C=L9?^2vd1E{*aar$tptT z2_@WWc7I9Bm(`NSjYeCw#}m^LFx2Dm@5}G!ykUW)XCPr2qv|QLFN@c)tsuCGaELSYogCc{6alF?{C?I5ko&uxo zltqFvayJ5u)TKESd^B~diRuMRl2ZQEhBnIYgh)$5 zr;70E>m@;>?b7&+l~ro&D=qhglYtklzKN9Y7lu2aBWc7tvBUyF?Xas9cjp&z$e<;N zR^hE3imm~zQ3@wcn|4Tm5uybJz=3nOQEoW_2^As}J&t66E0 z4hR0QGw*lN>Vu#-GaFhif-{b$ZT$j^l5ecJVScGrIGk_sy0iQf~Z#QVIRPUl_hIcFiZ(+V-vgNh`cuv<-`fOAcLxYG*kP$ds~ zYFN7hOIqG;cSmn~2e2O)ydn)=7Z=*6&>GpEZz0AHW5e|Gg~|6N+~h4M+tE};5289g zh?QPqoc2kZwcv;aA6`SHJ2FENIx!1z?C5hXFx=Hn4LUM6Nhz8LZR@ju4w`FJxt{ z)nj_&+Pd_VhEEz2^>;aGbz6_P4k9Uw&ZM;A1_*0$*AHqB2dTNIblx})NtAXNj#FXW zyp@&3``ZOshpmjvI~;R67Q8EFMvPoq1&2PGqoCbLi*S(Dt;d7Yu2uzrMvPyps)xGzE=GNS0+2FGp;0fQ?RtqZmu)G?LuIwDd3Ax`)Es;t=yWl>ley6XM_D2!| z(c!u**RAbpwKPd}9Qzk*^_R&^IqmVY=KNrBL13+8abs*%0H@QD0!^cM3g0Ze(=-<= zY|1QJbjP#y-OI@(QM)f-Z*OMeTc$6ooV&zRFRaGJzpxPGAOlN5SXi|Q!ooI;5T}`6 zYLS$%@MMDVgz{inVM~iKKDJBSV`zfMvs&s#RqwE1Aia4E=f6pMaa!zL_@!U zxrryJK(qtDE{~XYxKS?l0_xooK(Q$Wwfgc63V^wL-1by5Rdlq1kfdAO{Fq<}CX=^= z@lp>w<*1NY{s}I>%t}|_wk{LT*N@s5CBzMT$71u-=r#*g*#wFccbVS=qu3&{tE>kz z*ock@H*|`mzt}i3gu2$kV=)1BtGo zX#j?ZPKmjWWz248U+3KjT$PqQ2U-l6P?t3BEXmRK8&E{858Qf)&p5>ejo%C@i1(b> z!r76&jgTSn5nsUQsgB=I(0;RmO=pAoFY)+`4KEg1{vjTJv*B@`X|HCj=iy^FfSS-4hML4hc;}hFB?s>$$1X@%hyB zg3(srMyF?rZ6J&y$9n@vl2zC&P4H<7zv+&OD27)nDXi!|_G`AIx05sUI|0jPpEnI% zQEtYTT|-AKP;rP*QW&Wg&%B$I$7*JBt5Xg!Qb)%D8oqmVF&c-OjRRZ{JHqa5gI zaCB-|6q)&lEW@HvwI5#LWMo6w5Pkc6GMG6W$~(lKO+fc{2rtlzLk{p$8*gPQ9;T@D zJRO_Px7SM!6KS#_%p38cl%JmyG<*$7&xql9i7i`Aw32dn0lA z-SZFuZ&TVyYnsIyBq`kBVi)}CRe$aKElgWOVmTQ__AA-tL;YFf@d7zB=0uWgo_WWD zgAR++AKR&^=V)Wzpc43%e(Hu5R?IGNU%etbKGAOACTsV{*f*+gW-92>Y4j8GxMsAX zdkZGS{#!mmOG{aGiTeGXU-|?kt*E%KUC|pkC(_rQickIZ8>U813J-L+lMLvq7x?V~s2L7*8gH2UF2kR;-Za|BgRco@{bZBt%1bnN$e=q0##OyBGMK9( zc_|bRe{mHbW3;QLuY5r3rnl5MWH)oq92Sf3$ra8bOAWrGIjH)sqqWb*ZH~S+r63M3 z2IZwQSy6)7`6iKJxrc)JjBa7C{3&E%2xrPP8Gk2FNEe&xf_w5+};fQqu7G z3}f>T;rJU4pNl;jWV43nOMr$)1=J!qIQNb#XcWfQ9Ou0=v#54K(JCLTff(2{{9q1) z?0k}v8>FlhU|&OwAxVWy6Fuxjg7ZU z7HMD0`p|iEt1s!~_Mj4c*=+3b_Y?<+HAF#0?VE({S@pij(NZ`JPW@{djE!(fX z5W8tCB?=*Z#6fTe-f(zn04)uhDzvWEE2_7vS1_b&Gl9xy2cm4N7-kTe$=P_%ENG$! z-8Kt?rZ1QmZEgXNtq3}C%)Rgtxs}QlZG7E?f!z zIN9?#Z+>-t`1bUr(}L_T;rJU459o_BI4n980T^rhJ?SaD?0=ZYZ`|Wi%pLci>^{vf z`3UwL*Ho=`lP`q2>vUI3Rl0^fcLAPu;y|aj0qab^xdbgKuaI$jR^^#m2#i zz{c4%kD3w_{G_ZmY-h)e%h>DZsK5zRlXZCVxv1_s8w_MEsseCZ3>}v#t_3NJqyrEr zl!WJjeMT5oP``xZZ#cZ?lQZWM4Rezl+x6q(2*Rz*Q)a`j%D#2(&S%p3mvH74Wvk~o*0|IWuDb&>5)cWiQe2byHh(8@_k$} zg1b^|sd?>_7z3u#P;&vsVL?~WKr^bhm9)Ns043Q$|8gc%y zWIgWL57XI_8Tu+3Ya%y=n-^|aAG0|bQ_0E%EsFE%C(n_Bkpn+eQI}Cy?a+G4<8V=a z4UeUj+2l8C?UH*OQ&K&T^4R^Q0>fUNJtX9bbbe} zT_3u5Xa7_yY13BETHlesNZDlXvxs+aS;L-iW#IuaTq@T_VWeB5M;M3rX=wq2HJIlOi%(13X;gZN;OHnUdn} zQ9k5LczoUbYF`ujqpZ|pvWlrD^l+M{mlA!!YL;bwVjWe@?5t;y?_4yl<=jXj;~ur# zRu+zaO7kO>shUrvf-9IBG*E>4@ z@NM~gW621{-E7}<82 z;+r0V56tb*x-gh)ecV9pBC{uX(u}bzj=aV`eB{E25p^)qz97laNwb_ z;Mch#C^5ah39CWotQW<=j|IC6z-O(W(b%rf>S0%=H^9Q0cwyQ7tS?{-vf?S>u&FkF z_~1=91i=;5lA!BTpRbQ(IN~$2(+@4Ih%>sE*x1CeMDu8%#cwVFof;KH-DZ_@SVC`K z$x>;#Hl_%mT1c34%U(k(UdAR-6>jQEbhqFT-YD(mY zBCvD8m9&+`l=E%(|kMEQ3gXtJ#<3VDLyvTnC zBG>Pvfly3;GE@g}m7Bbnj&tvS8}%y@mAtZybY<1eX9`a$l)>P@)pO;C&n+Ob&kBJ1 zR8N>ZzMPvnF5Ta*0Y~0GhYmZnIxLO4`VqFPeQxud)^2Bey#kYwQW{t3GYS*3h!;8R zpewVG&`5hWyn2j8r#2D#ROGcZRL1`2H%Kkq%34(VjgIjHrtC* zzaIT|EK6{KDwNbJ+_e!=TJ*iW4d$2CB6U9rs!vvfNrqa6U^)2oZyr^Vf`zH$+&eY6 z6aZOQw*)_FT1xHeHnu$v!iE`{ryG0r5f>cQ7B&5B1{FWi3G1oN>II*XkJoP7h%w<` zPz}ssVP&*ktNAqU6r>ln{A4I%i^H#l&hPSZsdZMP$QW?OW&Ofv8@5G7=1I_7oQ-T^aOf#{OH^(ZeJ^oM=ZL1cCMT#e1rn$T!%R8r9~u?QeEmY1BeL7{xXW z$x7!}m{QUrC+95aH-t05C)+S~Bh=Zv9o*D&wS-BrvE9#M3I*%&)HW z4{cjy(q*D69GO$eqTqF-r{kGDytItTh7_K>t#f64^bD1zt{}YHw_+bsVK&=b$OhIX zvF{dGZzFq1ADc$G(>kR<>JQ7iW&z&e^RX=#MDKid%`XTf7VH^+ws{hY$>g}JocEc{ zBVoJFy!DyPqdsZ-7QD7I#a`at8eJslsm{4EC9{%8EI6P%n>X|8vjumjWcVM5^*FMv z6={Ch`b>El_zFG$JUXy5e~Prsx{tM3h3$DVbSFVP3*7Kw@g8J9^V=X|0eDA1Ws!Fs zwYclyR2@AM&%0Q`BjAf)-Bt@5&SRwPW2rC@B0H_w)jW+eA46ri9L4(dUeC#`ldS(%tdk%AsaWTJ{-Ia_zZ|Q}=gWU~yl-UW zHM2-|Z8gEObb@M$tnr=xCnTLo^%qJ10n+?9{|?e?tN#RP%0EfEdE=iXO(6I0Bn?Di z2c;MPJ1sXvH_3I&$WOmu+5OmnlsI`w>^06}tr+Y8O~h(VQ!43|BQK(V z6VEfn1%3ZO&s_ABP1=El+V1)nF$4ZYW=g+5kU3G|FJ%4~F(VHS0nXjy?&wU=)C=jP z1Z3un5(06}zP_M+NkBBi{TcDZXJEPc-Y58RfX}2DP^}gM^Vv$w!( zJ2o#-W2aE-NU75`iW+dM0>8TlRC(@i1cpCSh``jwTuARtu71K6rtJx_j0v2P4b+eX zj%dmlmN7MRu`d;O{Ycz@3=_$TLH$pWS@BP1zS|-z0M=xhIw+~64k7tq2J+`c|0l$3 zQ}jO~X7#1mF4^Cm?hM?&ce-lfsQ=?mcPRU@ehSp-zGq2@1iT+8^d@wrU6iFRnD}b; zhcHA?{kRiYK*T(HeBV=TGN$H((h()Hd#B?F5L`2`X}Nq)Hq|KC6?RjZlY`rfUt(%9(MF2K*<0|{a&wJxU_if%6jw5Ovp{6C z9?SwZ-B@sv;_~w2uwS^x;nEB5V$A&3%RWT3XgS&g-#&*3W*$CmsIj5|{fb{7Uc(Fk zt`$r`7rKhIB2=d>N%OuGy*}3wZD|Iy$G_@8>>XMLCE78&8lakc!%CkoEj0FiGTgW& zCx|{+`?#on=(dQfB_^VwD}ag8-?J{}GjAvSQU}ilX?Iw%@kf3`jJi)nSpqojEvH_&wHMAL59!I zVy~6TUBg@u;dvKN=<`;g8{JONp!v{0o7`|%(3mI)sj=)!{q`Pz@w3I|tAE%xveMQA z7qO@;szVA)p6^pcg{UIul;GTp<}x^)IP5%HoJy;I^RtsB$hyV=?UAT4QI`^Y`4`#1 zpjxjuxivZ0{DDv1RD?u%3B;%^sv&2t>7OEvEDv?|uW}aL8TnKew*26Hfaot&Zvj{t zkK7!m^AH@e-ys;}D`Cm`roVWUm*ASBm0i;5$iUsKhhvpte8Le83-BlO#WACWl^5j@ zfv;AD6vfqFxICs>3Bg~~W1zSosec!K`LXZQhB3-lEsd*e13hDuxdN3ixwq9b#YW{> zU1WvBtD$i&>w)Ah8$Drs7i8~O5>Nq}xfQc;gN2W}kqgp_f>8b+EupTrPM5dBBt&_k zw51e@X^BHgW&34n#K2XW8YL0NP1XuKMh(%|8jJ_4bkO3?bXa?FDjkmrqETOE<1J{5 zW>LAJn!5vvc`I zG?XOh*K#B@L=)*D?iaM|EO++npPh-0u6loseE!y`pvHDo@C;!K6x#Ac{|;?`HMXhj z-$^Jz12TsP*wG=lY69qa<=YEzz>@sEcWd<+}3rrt~JLB_eAk)Yjk{ z_^||aZ|IO&!Gs!+Feyw4UY!`ihJnJd1jY$rf5Z*1qZ9$!Z}fQZJ>HT^P?UFWVp@PN zxY5isgf2iz1wQ0(2jE}!fj?+Ow~XHV-HSMfnss*`H=MJuzJ%5*iq3Od4q2*L%$!FA zA4j~TFm?!ui`k)a}rhdjYk1NEzs zyHnUF#!c_^&>0otsVrGqj$JV&BN^;C6-kBGsx>gCFL|&IfqXWyl5E#d|){eMWGpp#5K}x%~89IPzg$cQJQh& zK?k*H0Vc@m2MTTKd$;F%bveOh23-OLx2XsK;WlI2M*ijx+=ff-2*O`n;!!M}+YWCE z@ZkZ91IPqLAo593ZKj9>G(VjiXLr8|7;$xj9W(LQ*6V!$ z955< zM7a?8Yd5J)eB$SKIzzImge>AU?baCD08Eyp4?#HQOYdU)T8}3Y*_M_k#dWN!vrl4E z)Hg}jlwrmM4XqO#>CQ8>J(4aRv89if*BVfExG%@r%UmpW#ZK8l0NTFbWd~_+#e8PF zA5r+*KxmV{&uMx`vFuucC;ix*@UiWeO);|I0Ez*^VMN28CyX+W(^95EGdaTQwQ(49r;njHMkR~-`Oovq!xv-#0j$Z6IP3M4ttIj` ztk`Cf>#p7se`n6<$N}H^-hZ23Wx$P}+Y4<@(?FGE0Quu2{xh?6TZ{Szse^w_ulnQo zot+ixC0K!`SH;5!hW}L-uhRZi7XJ|zFEQ2q3X1_tv4Km!%i^sgP+80_)MHRv5`9?mN1A(ApEB^Dd+%a!oT1C6WdYAEJah!2L`iF0wZC6e|UXLd_#1J)e> znpgd|an-q>NI&$f&KJIQHVHKbzfeqcsDNwHlg4`LZ2A3~S)GM6-8Y+;$u7c~g^A(? zF>o5vfD&^Pr7Kk?}uEUd^7vtdzO-1pZ z=CkK7kMFIQ^~fUqTR(xCVn8AT_NoSTS)6!cZLFHEnfAJY?>N#)IzNl9?F4 zclCkX!y;c;+5fDGKL+(q=WHW`mNa!aUjbUd3o{nMS>|+M1BAII0ER6dr;szFSH!!k zm+Shp=nJKCm1Cn^AFExbqJ@wo_g7RiO0k@4FHf3YW^`N20hc=1lv7Q3sn$q_N$Ad> z1$S!>MkXx0WV{=uN8T&dHWkq*$SR!iISr_wdLz#XPL6PSHa~yL%P({tj?ifMm`bFP zzEQ>7wm@6rmC4V*8EZ?s1+9%*c*XYJ(fvgjn1fA?0f5OgeV>*Z9&?PdSP)>8!WZ?0 zh0w0**#({9Xn%N&IaK;UB}QV~td-q2{1rRpJHH;P1Yj zLO&$wsn{#;>6yL4D6Fs09c=l#yr z(d!3@F=3_)Yb{EU^r5VODR?jB@D0rjf!hPPay7(U=WkFy%}}Wp{LFUAX;fYEc+<0X zy}!0rsnjf4*1DNWlA|X6S5VCNmiF-quV2|c=F5v`yL=3jlL^%Y(F#XCsf2PH^h&BM zcwE?*U@!OW9X;r$xakfu*Gowbyh4D~L$Q)jfb2UHGR@Qore+lJt4yd4`&Jo2I4wNKBG zZq3P7w`jFk>zh+R#tv!bTYjnYX-FwzPP%~qRS>tR=pRtez!W*0I!9K)Z{Bw*+$H=u zoSF~2nvBDg#PVAchaCLU#K`@`LAdX{;SSJBOB;%!49`3;0O)5Pkg*^|Tzq#;igy(i5@9P~hwYfpaam(ETw`o8=E(v-_MwIH@UK=-(kc+swtg|zL^cl+I?baROBpSqV3=9lipJVLnNS6%isXp=kVzcd`( zI9MA4UDG^tM3D#|cERVv;_RcHjy1>FCSJ_NzcDE#_zP6)VRLSs;S7L`q349%PH+=s z0>58E;@Q*FH+19p_%4^mcJBy=v~d8cURm}23|Uc!XT0GUErX2zlDScHHgCX_9J~nc z9o7f@Nnm|{zu?e$mnTeyRp` z#^KC`Hq?sjZYPloRMEJb3X_&G{~ZD|Ou;WKMv?2NdR77vD9!* zGRB1L-FPK8x9M>}FW4=|cSl)&*_>;a^r6+v$e9(6#o->@US$WCA6hZ;y(wYrXcpw- z66xVQ6P@RXi0p@)KWf3h6r?<%O$=QdXZ}J`glhvMVLiWFw!`0(qDrg6rg5)20YzuO zfOMij548|abnV&Z81PH+iu(RT@yef3|5Ci6bONqkXon}Qpc;6cyzv$^DoPmb$T2)c zBc1n;mrBu0(07eZ?~v(f>eyr3rCMV+i|sJNub^dP0zMe4!Kn*K`kDbDQBuZx1_87X zN+IQ>(>eNXyLs5WlUpJ&kN`pCYo5s`Y=2@t{fi&jRfHt^zp7x<{Q;vb{vIiB4AU2E zsbEPQ)O4ex@tX;o6;WkrIBEw`hMZ3y>%oYoe&eWJK7exLF@evAZQm(2dUjfM4W8$F zn)AWqQ}BykPQcs%G&+ue@m>T9&iE(CrjZS%&{o1z(2Iw{IN+0`{)~9)xg}8c8n#xB zBdtlCrg(aaF&2r`{qc%wDPQ5*FefC0qsAPb|hXn}3t3KsQFumq>?5 zH%RCIx@G_|?tS0;-S7MCwf^h*FxTh#FtgU2^E=Puz#o6jVsBF-G_TynH>DcZBispi zks3qC+cv2`9B)ac+D;yCJue|&W$;rUEU3eK=4yeO;}^}Rz=tgq;uoyrftc_}{~1wq zU8%HVM8(BY)0*d+c{DV`c{<)K_r`lT$*A{V(ypAr4&VG`3a|S{-ERfwkMFnsu`)k`s*#ylIion;i#M}( z;^aCu=so;N;DxO+QD(#FtwL*wtIO@v94K~+b9&po)~was+In`a(9Krl zhV9LBcogl7yW!XInZx{#hRaClEAZYC%(ww^q!h8EP7lI~@U`Wxg<+!)nnMv0!#goT-oK?5ghc9V7Nkh15%lZX(B=t*T-_aFU zTGNMiphW1^&N5BmHqfKw1eSkSxB3)g69QQD+5NKbHeu>^FsE$=d7Vyd>K2oAf_hSY&#!msyr zhd8Vo{9g{<0Jc&cJ*C>q?%2|AzEu7ot+d%Q7~=*FBWLc9qwRSVD6wfw@1ce^RZ8ELfur>5rG9eCR23_L}5s&{TY^$Ab*K6-4ptc)$yMN%wKg(Iio&`LuJqqu4^V^V3bkKu6ElgHWkCR*vW<+oaPv@-Ce0HMcL8*Z5pQ5^wZ$HM~PB z`2fd{n9$`-iADNb2Z{6$j(nq2)SvSCbMEj-6^qK%F2z-4T^}wU~wmwyv zuZ{14hmcKBidw5Ftt~sDvFx=Mped`DpeoWnP`jVSUpjzlBI0{%3}AY+c!i7K@`C-1 zdl9EFm-4rt#@%D3p=9M+%qDi}HF&eSYQ2o}(qzotr)dAH=;yPvhojYn@Q)|RNG-UI zM`R=rjFd5P@}Syz{UDn3I;}IaQzM5R}$7AdJv;Vr8{0!bq9-em_dK@eF zr)DzH)|oa2uO@%_zHy?OEIJIovy$5VerL@c9Q(bQJjE*?CV2D3i+?X<0zaorZer5I zlqtYXP${1GqOXPI4b?JDE%p%o>01UY5+)1JP1`@YyuHYA{v81*w{e}GusJQo`~I|6 zY5_J9U=n*!ZuNcO%$tZw{w7Dkis|l)S;}Geq9RN`Yt7%bDp|fW#f*D0WNL18kL6vy zo$%Olyq7HT@}(&X`=$$zioujwpm3Zro5wtdZjU~3!v9msoVY6wZdL>1Wd5zqs&q7b zv+DKBX4Q-0-`}hTORqkFHmg~%&8q){zuc^9Qon_7R!MUIZnNr(^M7-*TJeX?sxL_}HUDz6>i7>f zs{??Hrh>-*JPzrYh6Ma~a7f2AB;db;Lpr7*0l(vr$gb$#EWM`ZNh^fzxib^gnFzbM z9`>0v;;WfLxLRQs*TXvVF6&bn5J0>V_ZA9hGTVW3Kdk(om2B|&-r;( zcxY)sMR;&uU%|k~Gc-3PVCD`FlvSFrfkB0B-^L{n2zHxb+%fqbowo4p_~L)2sR(wM*NRxeI`^#@U;!9(Qiq92lJ< zQx6n=YKK)Tu*Zbf-CayHDaLn(ZT0Tm0M_l+H3PJY!<_rl6bWDa+s38zPV6cVaNW9G zeoW{ENl4%smT^SsRO=dab8W3YIE@DgE7^3;x|0Y>e-@{Il#$3QMeRHyiD;J7{K6Sv zF?f{mFt*qb-dTnQuMSQ0V0HQPVP_eFA_0q^`i#PKn*07u{%uu|Nx`|V^~`)tdu($1)hFT|*3m>q)V`6JXdN^Gl!C5$ z;>PY%t|o*+eA;e9eD|jTS5^fr7imefvo$3;qk-NbBaC%EvdUM>5?}B6w)lxLE~6;i z5b^u=E+H#=(v-v{nCpA;C;J4=naQvK{le(k^F3CTpK>_7o@er0!Zc4p3>{d? zWqI>SDky@64J7sMmdNW_&FO+4lWp;dwww3S(D%-?8}B-FnM;&V(<8rOz2}C|iaHlA z-|#rK)lT_!6C&aG^<8?LRNuAFDslLz)`Wt|)MXCayjZC(BXu>`HJ3T>_N*yVw*+@- z0+F>c`}Fa^ZA2|5EPdK@M!BaRB8_}8Cpejk?OZKV<6b|tLN{;xgsF_=pFn`w)p%O< z;}g`d0u|NG=eu4;Z+hIt&2gukioG-TsdBeDg@xHY&ZT`Pur{Lgb-IixIMeWXBZ;gN z-6xmcjclUs%@u34plm_o|8{g@`>9m5^;3CDI0<;#-wm{4&@r zPvJudg*G3zKt313{42#NUK_-SziDlUC{sX;7*Ie=6=}gjZW3zWYou2|eD6Z?RVoXXaPW<`Sg|mGBw@$u zl1;l?8?KYMd}!mMwz)xoA^FqXAVc!93X=<%VlSgb20t-g(|Ct_wm-7I3bA>`ygb*Q z*y-XdEmhl;ZP%>ib%On9kslE`aViyx$g{66Fy<9Y3}Yv2IanZnZ%{#sbk+un?tXa`w^9;DL3dm7~11W^>Pd1y>ffBg!-x3 zQmTbY<1r)c%X{d@l}32qg8;Pg%K<$FWu{aO=3`OzsieJ+|*YyHA{Ie=7U93Vsi6E z@sf~dx^5Z`cU!{4a)NlrD6@mFj=pZv$F^l)>vg1gF!kwC7)K~?Ur;Ev-6|&UM&A4m zpIyg5(cKOCK&MY__I(>dfw3RH?-MzNiMM90FL1=JPsw+=i_=*L+O1Lu%LmGYjRQNg z>*3;b^JDf_?an#e@kT{!qKl4OTdR$&$#G5V#O(sh)UCxho*NZQ0wl14GgNdwRmH2d zNq{CG>e_9+TzEyJdyPMRw&Q3bT%LYB5k51E&H0ccq2}TW;U`<-dkV!t{O2>85KwII z?G?vGbJ9=(KT*R$ub*th-;Elq_+8SNKS&H$K>?r&f zKgIAK_6ZG?YQs?5_ZFhg{U(zJsb`8C&MQC{UdrJ-yM)uj3p9Z9h-klx%Exl1PD*}h zj!e-jyi*u*}gkR zQ5EIs**}OobVGt5Sb!t+uX8vU!!4D$K_>ALHVTU5K#zF6_dC6{&ubpUEq3vvSUD!- zkJV09e(&70JZta5-{(2eyX5rA(^J*juZgd-t7?6# zT-J!XQLv(oz=Q7%KGvgy?;mHvMNRN5E;BS0RWJ`=hqa!+!gKDLB*OdQtw-^ZOi?1* zY+ZEh5ix1IErwKSpWm4UQa%sQq>}M|=13*uQ~%o>sbHbC2Z>N7*PnRrT(sjKM)I3~hmitK zaHReNjMRL-;+$+MbT+nSKubP#tpj1|{0eheM3b&tnLCkl_e;u-{EvSkNdZ5hqy}U( z->LtPrg8vADL#(n|Kq6~fKiH%WBLDhDhFVc;^SEUKc31tevak;o67$;mH%%l|Nng| z-v-t*lEf_r?i?iCZt@#Mao}KeW)Ub}zOQwwNvh!ENBS-ut^FO0D+&raNVoK5Hk9(d zDS7y@+#DraMka=pvX4920Kwr_x$9`F>^l$NDo_5jRaTBwGQ2C)eokMmYIorCYiv=B zcIV{uWaB8?!eoV(HiqwCSFm(cagi)huvKxt)xBc9`0%Zv)mba&cPwrGEG9ejcA5)5T{~xfANkR5;@GtD+>ojiMdK;+QAP&_yg*-H(X5)MROJ^~__!K6C? z%)0YIJ3YxvNv{==+`*2hryOiykbQM z2Z!3U_lKA17i&(j5%f251c{z{|4!6aJJ%mct+)}p`TYB4EdJFR6pTLXh+CJiSFrTk z22R(CF(e}jM!WI8B-q2ZW#|9()xdnJrn}4A0 z_o=e=mTkYmCE?B|FVu=i980PagH-~au6~FZOAovD*rY>Jtuf-e0*6I%@r5VX42nYv zn$TGEY3-#hVo^pcbktfH@&X+lV071>+%I*E6PE==+cs2dQ(l<-9c4Int4T3+_M7*? zC39buBj0>`Vk%mo%*?s9DQ?e%b1@l>b^Rv-eL=jD{i=p%P zoZDARRtId)){3P|tqzEuvgJ$6_zu2Ei?gGS_krTfS^J*u*9@19Fq?Ne_g&RsclB%& zcLmumlxCk{cXjgT%U3ofmc`cH^RK}=+l@|-hrF%IM~drybhee@o$X{*?e}{2K?b;% zOm)dit|~iXIWC3)i@px3LKBM3vTp#SjxP2q=XTU4>ElM8^#E>PV??(i=>2a==;Ung zvfI2z-yEO`nb+zJhtr@38jacS9z!42vdb{t=F%6m|x6SBR8uX&_ z_}|f>EljHQ{{Vw_N@c3nxmpyMBfsyG+QX1EqjN@9r52m&oj)Z9ph1b99+=NzG$P_w zw@*0gQoy___;lSLj)ZnRfrRd*b%_}gz8faT`L&ZLE>3t1OU3zPkb$3om&nt^+bU&k|x2O1ko{`G?j)a+hUo>iX{s%xI$F0?aN10Fclh+1j9L-BPy6lIYb4kf>FT;chOrYD0m`+)S4ry zXV>F_WEW53PiPv}1*A&D9AwIBEEt}4%Pg}!p98C|Tvwk?S_J_lRHp?3OWxj&e-l!p zQcSoVro%A0AM3|FpjU3wN+)T+VEdsRYIie}Zbjm*EAQQ1vVm~XnMFe@C`B`oan!}G z8m|QuJttExvvXet+uaFjV7vQDi9q4aZUE#()BjKrW&BVP8AB=}UQk6O8VqinTeo!# zjDDDi_8=3{KGE+vUkuFoDB=(LAE}6B z3HF&!1btD67v0cdDg8YM;ziT)q-y*HE_#8_yH_yPyqPr*p7VnjO;`?deoP)V3xtcF z`y(zI0C~~8Y*9CE$w(_>HmCcr%6}7$`--A-!D>xK^0HPbT5zA0kKT+(RU8n9xetPC!>%nY)lV6(KsZ0xA2+gL zKn$F(Q0a>)H&r|>uda6fdr%C`?gyo%Pfj-&c|L@>Zq@n_w>L#mAnCLC+>`QQf#bqf z_-2KVaACO+E-V;6WNy@Q=q*%O#s_g>j)%A~r(;~04TK8=Mj>37Mg4MtDl3|pe4;J$ zb1vrcUbN&pEUVtd#gW&vK&nSBa4R5jtx&M=rY^3rNGTQ%7VdFzJg_5!YFz6(|2b0} zEzKXeFzy-4$9DOi{o&6QJe%4sN>n`30ZxlTR@zfSXT=;SO9iRCi7ovEsh<~9a6%mpi#3EIBK3fF>2N{21m`D zN26x=rn&oY)4Vt%`Ri$2Ds{W+>fY>=ioYgF@7<~(0!h-*aFTSM&k;vDieV$~)xeZP zO>%hYHN`T&J-%oO{1&8Gv|ZIpOPhpmwuqlIvTy6aIMRZO`#I%xcRiO5DK{Mh5u%;7t$nHTQ?6Oj7$(jA!kwii_2s{f+C&4j6Mi@*G&zWwN= zF$<}0(QV)TWWH60%(te8=39Nxd^-%8Z*!4=T{BwHGgNcZGt}+3a{W)9A+HW|PIVOL z5i6Ky$Xx5%v1JInuv0xJ4P4VFCG|35Ya;QX59v7jXU`Dj3D1x{WgI|%pu}j-(M4y= z4fo+ji~^KCIPCnJBFXz${zV@V{5w7(Up%?;fA&z`Q|GL^-b0UX$RCV9GBc*8nIkQ%ty3t%(*A|HfkL_P$0NAyCD;4BRo5T3ho37G!->qIVRZ6%Zb1+|$Qrhr&CP<^; zmPU~#pj@*X5W1ep!$$T1ESsOgyBd(^Q)v;Kr;Q{t+7w5#cnYgaEyIq+ZVUTTDthES zyzwI;%4b|2y1Z=`W=g^y3%mip&e4}ddmPjkZH)3?{DmWhwA z?S3GHz`3+NG?%vgeJ-60&ZRk_xpdRvT)Oi4+xXaaY1mwv6P!!m zm*Nb?UWF)Ph9E`E9)gI)fDo~L5F%y`LBs+fh#2#;SP&v+MRMQf7l;_}4=7@WAVo~} z7mC!wHHQ^}AI(I7LkDp}H8HB1UOIXa%Q;)xjuY5JZfKv-)u` zZV8r-Qk!S?i$eJzehg4mqy|$J4NqW+ubv|3W~&z)$Du3$LdJK4B=2&uTQD$riD7Ip z-r>v}a<||ONf9n#mFU-deW61o=LNx;COH$9ei0(%rd*=09=#m+ddpXM+1;8rI9J<< z$uAr6>e0UB`otL`WQjvU{yG|cS5GDOb#ZhJ9`DA+yzrL4gC)+|LesrZj-KbHhkZ-L zc{d}0r}GO(rlHC7duTF!3z|%~fRpJMXfhoRO{VFf$@Eod zGF=ExrelsL(>w6Vbo>yU876TcFx4LX^~j4s-ExL#xOGshjxVdO8_gPnS;;#haXosvT%_-fY5ORLMYp z6g58}wdTx8DuOPzZ`QZ$m`2C5G=BvVRpWyxps$Qke08v^Q*Yz$SdLpZ0->LFhJw<< z*yuvZmvytMuMg}O?`$;I<=HgzM@k@h&MV@oZ&zj2i8spy-Z8W7Y=2ZlUP+Gn>|sZD zE&h5n>)b^ieU-{A4>59NnDO_x+@>MmoJG;yG(>PY5lsyV}B^RLkMm(2*E7{BDmck1a}FD z;C2HM++6e^g8K}F;1+@q+~4N2d-98fh)&z&foXi7R_!w1XIgMf?Vq!SNvBl7UJuA9 zXzj)GfDGIz78_DdE3_rU2bYZ zxAltiOv8b*K!kDLe&l87ww|W~zpX>3b>Q^jZ9NlqTTf;8CEsR5u@Q&g))T?oI&bOE zxAmy1%oy534KP2b0ZxWAz<04(fbnq+jfH>x*rRWRpWJZ{Pwq3okDGfQ{N`?WsV_90f&Ywd)EE&dTA+=UM$guJ!PF$%3;B67ta4y{k` zL|YHz@oq6jVk#y&d?98NzL1n%em8ma9_O{GGqhd6m*qTL?jvuL|92C?hq3QEI3sOl zu5;N1fPexvzOQH$$#(aDag12kB z#k?l|Hvw>U)AyQ#^=yv$j&9zj*qs^v z^h)N7jG|}OQLZ+;r>H9@=Jn$hqjC&HK1QDeQW`s;8-Xu%o-lt|#-F6;auL<&oiE+qx1NcZRx3_I9!{h zaGB5m{^f8jFi7dvG;D05MO`jccwg`e3ya!wmOjLY#W~z2^K}c=K>61A<)u#;sC1e+R64C6E1gPUN+$qPI)zCF zw3fKug6zM>F#E3zX#b5rVgHr1pm^84*G>qt|C*k(|JsH8xU27glm}?UjsEIb@x__U7Le`L*6=A-Cgj|@wAt<Eu+fOP{7J84mxi15L{ z7s@u{o2YMaC8wsTm~ZILKBkv7uNX*%R^Dt7wwt8_9l~}uf!OZeU$Na-5Vku^n~9E` z_a{R43P|WSKO}Ttfe7895TX0hhz%RJ>UEZrc(GE0kW3g}4B!oMDuVE0$uPVa@TY2f z<0q)vUMnXO9}@d#=-4a>9h;b?a>-;Vn;x9q6xm8vc=|p?prR4Z>24)Bn3Z#QHC;jX zTiG4>rR`pSHtn$Oe)eSB{UfaHz6Q44aelPj*SdW2e!8n0AGh7hoQ0*jz_xoo*mmy& z+wP`d+dY?oI$gvbEW6)ddrg#m6OJSUko@3GGEtC8CN6U>1!R&v1es*FPs!Wn!kJ{Z zK~#6nJCYnLCK`oOLg5gQBc{)Ovp9qnD!aR0$r4d>BvHFZMZf@xf6?cK+prhM2qc%T zg2*p$>P-$4{}P*YL?tub#}h-pob`Y~JE2fjY8Nkv?B4htU@e7l!sf#Vpev$X;=<4k zbZ_s+#mWSs-;1#>Ji<5JCwPiu^tQ#K>uh_Y4ZXZ_+n5i6z(yBu9~Y0Q;QhL7zQ>2g z-^055WaZ{P5_6ev%}@Y`viC&Ons_~E&#)^LO^lc7wxmRgk|F8+GJ(4yo$UVAUkNCG zK`yXf0|xJFih5Axy^Pbxuf?$`K0^556UE)POhWMo=k5H5Gqy^3 zM9;Q-<2{z#1ppxrNX(i~GMeg7j@x$vt-!>f6<8Ez1rBIZIZ_$)!vj>ebW#;BgI7Dmx%c=JT9v6bG#8X*;2@w zmFZd84W$NB9({p(r9yM)u39ZX`B!wET@nIM5v(;oGgs`aHRQspa@lh_h1piGSU~p^ z59EG|0>|GAp!#VQQa=fU>L+_h{bYJ;6;eM{O%?thsGq7p^^?V81ks<|Phz0^i41f< z>G9D_RX+mVPl=%Wi4=4{r7j<`z~Qu|Mq+fcB?FT+sex1G7H?hx(_r zBmL7mj_#zHt4tFZKlD%74_*fz+Mg8querkPPjjqkuTI14PlCtxC;0XoR&3|+d->Vl zXHE^|m4TOVkXN?HVa}BRuD>Io_4m{#aQz(!t-pf+aQ@AH7o2|=9?idJJpNg+z4TAT zcDf(Mc5`^K{jCk0S0-_wF~{Fm(Y@PP#lI^-JL&z=Ylkahm#RszMls>RV3Wu+weTHR zwnQiar|TK@$y_rgPRz6k6TM2u1q=-5EqLBlRB)WZi@qlkL3scM&E|c z>F2&rCB--dULlj?;3O~&ES-AK0{V@&W~b>acSS#FZoV)SI8${ZOV_i-Ie!JSv@g;y zO~pG%6p+3x0JYSq4_oRvnovvqr;@tt;Z%HD`A12e zq4=nzzC$yt{CrF4d+;>X5r&MrfzFm@UCY)`-ia2ttqX6dHxH&G3gn^c^B%X<^DLB) zTI%&+OMT@J9xMOpj9A(t$YbS){1#5%ri19)xi;k3viDdbz02Ucn`$#t6VXI|^u_qhrn24Apj_}%1lT>ZL(~ptN z*KkTd7sQguMj#h7Qq)uo6t{C)_EToW3Ei{e)5}FLDEt2P_VqXu{6o!g#)@03z?Zk` zgXfCQ)BV|UEDN(7uP`l;LzZLRc~Emq4rz{sK+UlL7pOVLgfz$J%mZs`2eEQU@{2@? zPH%A5>wJyp0MXnJLz)e_;?dvSdh!Bs7N<*Sb4rG$pAga<*Fc(MxaBwov>b2kpL>QS z!Gv7g8ur|qjsoBg*duW;d3h)_4kSw-e3p@kO0bRYBGZMAqPFF9@1XHs(OS2j8bl!b zxMJcj4=0e3at%#d3Z7H2qny1(w4wA`ZJ_;rpbfm`9yg^0&T4!bNJQHYqH2oywkz+`~OVpq#(jCgP`DZ)?jE(WhvxwSo zrn25w8VhP6m$|Z?@d_}|Q+aRjsnBui!K<&x5P{4Lr7O>0O!-TrYrMv8BM-;gw=BtK z6&?o14Cc-{z`0eIB~{@qgMK!lxd%uf^T{ux)5YK=SYFF>WSDNJcBDOO7B?x8 zDl*7h1^%h03VN#mvhnw&;iP0gyj6mbx2mkB5pFXEQ*pH6j{J9%m!<8+ikTJdlCsWb zSC+=@&Wly|n2bD2PN5z`jY|B`V@7vb?g_%^b3-d1pGqMe1B8b-H7GX-4!u=FXFULn z-ZR2T;V9Beef|zX(w;&IIji?Nf#SL8=Y-+U0#b>q&l&1-GacHD!Biama_`*xoETml zo%O&Ob+#tv8D6u;!WCn@{f+nUdnVRb+?;$@)p#qnmBU`u_mYK(_PBCr3mW~NUf&3N zOH2TNs_SOUZy0Wu9@P7wJp&`$yfTS{l*k^yrAhiut!JX4{ITR8V7M1vA#V$x=%OzM z=vu;E#$!!jD&}U}bkjo#LN*gLr(fknyOmh%xY#O5KrLOxokS(zMev0^=-yo?Yxv$j)EDa+aYPwuq|d($f2~!TJu1rno%W0nNH_xlXOew)kaU}i`C7N-?hIg8Ja}{`%k-M< zoBc7xjyn_|RiDd%!+gOI0TCKpY91O2vtN^LRUsWz7?>2FZx`@R}R{w5NbAdGzHcH)z%-^X$Zu< zf_({$#sGxfK6YA7devLrO??;)xJywz+7%yW|MGE<=|d4hQGsLVx3ZmKfqrhYOFg_> z2e(Gi#3CgTnj&0>=#~WO;x%ZbKN3d-vV1!*I=I zhCdC%Js#{M|6v$@9~y=O3rE9n+2dh2#sq8_9tZOvqp83=$m^g7ndlb}vN6nqocXf{ z`CVK$+=Hy~vj;g8@*qbYdXOVP4{{#lL1yMXRTfoWkot5v_Q--9A^iP%qC+$N4-2xv z%wCD2d6oHK{Az!5=&AEuF_{I~saxb>+3mChfLJYcA10e84f^X<_qLbU9P+;1Q^yom z9KIQcQ&Vf){;X2tjK~z5<^igMUeT0az88dTUy35JN-ucLr{RGdQKK#>H8~IR+asrXl zKoUaQbzJwa9`9PsIvn2y4c1)4KM?W_d7BAVq^_*X*(+bi+3vcuE_a{YBVPoO*PpC* z8<|2Ub-|IO7e#=+gGj*7=q#1%M`<+eOMR05&U2|OAH4}JW~fn>gfD1O*i4=izsT4? z{fWn7MPiK$NuEu{M;YC_@;&q2N9T4pl&=A9w?aTV+G~*Ez4DGE!99(FDG_hdB$lsuV(a_rnn0rCPzzINaxG8{P%mhJOaP;i-q) z@HB86PWI<*xG(@4hikyb;k4j5ydZO^z4p)JZ~@}l$x2&GGFW8(Z5*y&7z^Kq=YrdC z^W$xJ_OILUg`c&vb8p7~T8Dp7^fEvGghflwL`a zK+-EvvUMcA+9UTc1*KQR0(+|)AlOo8f|*fK4K_Qc>3p>*dlbL*O)g?r<8u_W-E)F%73X zo`z$A({P6*+Y9zL5BY5RWnAVWJX(*2bXgGJH%m=}nvXcf-cM+RHhZ0ES!y{Y5^UZD zFTW|;3Z*$-=q+cf+Yl{HJO4dpg052#arz-ZMjW`8ZW$uGBr;dA)RM3(6;gZg;#DmtAH)T zWuRra=^_V3Z0-iQ40mv_?;c2eCZg3NfSmnW5Wuu|_>8&cJ?_a#iIrDGUF`DwEv=*J zWo=o^DwzaDgG-p|MjzxK<@g2bgK1lj6n4noNVO32W79c-Y0D0Lfu~+SlQN6J61{e_ zhFp)EV>AcReKHwjfv+Rlf52*f|8?&<7M5Tap-y)Apm;C+!42g(0tIUz+l`J%*DLT# zEjD>3_L(o@_sH2FB~<7hpf8sX5N*ft?T8^u1R~ttDZQ2hvB24hTH6{;f^W#iUBj>l z=a?>^SIGZFNM_%y z&bL^V)c4gj<*TE&Qn3>$fNJ`*wYcX=dh}Iesso&xH_z7fF?|-~AQ9ekbGyd=$l(zU z#{y|mEa`Q=p>w|eMdTm{+{PEwNSnW?sT4NNA>;l`AJzKkCZSaD+(qOsRH<%D?J**` zOrF!?#Xi|E7*lcVdn{CpGFKLzMOYr4| zl-uv~<1=+0*?ho*&}^&?AOQT^2>>|A|1RU+?R%iG!Dn;l1;?ObEr!MIo0A4W#`w~T z>far#$H#{Pa|VnfQrDQ*&+ASNQi$Dp8~c#_+8wmeGf!x2$SY`Lv+x~5zjn;u`?^hU z$%IGK&bH1=`v?c!@ynNs99qn;sM@p*AvQR=6S5&THf8gtbc5#S);n!L=Zz|iF{I4G z0nAi$a{tuyFl6D9%`j_|8PF*mdF+&qgPhWGiVZqUL+E>w*#wUP*;*pAYa>OI!I$0> z@bwuHb*EH@`Z-9W?xZ>~Zx&%++V1a$t;DUHTX8jnG8N(&s=g}`MN$y$ZDF=wE*8HP zra^T-eij%AzZH@gT=EEZw#-bmxx4L|Sf-tx1uio(Ts9O4hM2W9TO znnS3jZk-|^^l+ke6eAn~9&!#w!F39z?9e?zc>TUWrrw{YrdL2xHYN zNt|Z4Yo&lJS8Z~bvTgz%$v?qM39sUW3vN!1+q z1G0({Qc7EColr{a9xA0{Y<%{l2~pfRDa|i^WxpXth7coCIu39IKQ&njYeQTr%n|0v z3k5mjR_|1Q(@NXa&qc`qXz|Wmd7W{8Fl6Pz3|UOqqcHl~aCPznZq^$WyY_XW1s9rd zYga;QtVfmZu-mnNKof zF1MWN8lD`DX?y%*Cca4f&`k1Gp{Fw|vf+>Z_+T zz@=_oi)mhFBsaz7?Yqm*w?4_>Io)N1=;MTxeUcRpx;4H=6VlkOImDt@XluegWTVzb zK7AUy7N3<*>DoDxrPZ&uB(+x$lTA*oYn_Ta2-{ zhnGb{1PgflfH~5(U~F@MDI6*Bt$Z<&L^RRJoV#K=v7Ly9hBPVbRawXWvWs=?c7xzo z@2dB8nqia}6mK1+3*&N4&kSFSKj;p$$l5v=n0qFR#gaLh;4MKa0{RPzwE`~wdsU`V z5)8ryM)*lu`I)iY{0%4NSd_Pmg`WZ6qfgkeT5y6VKPYw49-u}DjBEy$K1es-Q8ltT z^~7@LaviWy=9p_aa68Lp>6=^>W-*y+ha~DH`kj(Ka4AvIMaG;vJdm}iz==N%> zDKL1dgw|aPJ=;BYza5c1_nga9YA#A47ODMKFSY)+MxR+o7aS~*jA+cn;{6)#s;%Z@7N~~ zc@7r}Pv=E3pT6;kN7GVQ`8y{oglRJ{Xle=vxozKYKKa#c=lJ;ve;_r$6eYMljTX<0$;f+aJQnPW38lKEz`h`z(z6)>EvU zYoUcdKtd@*___7iSkTO4)C7ZQf;0kL4@312BYf+osd^~E^!+~6k|4o+T>YvDnku)7 z*oA7z2O!KTgmDT{GNj8ZsAf$l2!Dq)p-lj3ehGkkwj3aWTON$y=1@Uf^0csnP&=s{ zF)9?FHr2kSnhGzaLODP=E>*`#TyjS>hSZ;Z6f4Quo1{)%RGYiCpB0hr@q}#9hO_6) zWmSH>5(h7QWn}3L)Ddu?ljxt=x!!4=-g?$>f!nh6*tO+w#jn+48JJ)nimr|7WDQpQ-9lN@?m?!e*wn*Tw@HR1kS`Z})zv)0w>1%L*(ZLQ8mI%! z3KV+sZ_}xsc2%4$MAv5*Fp_y7+ z;3bJhQzbeIc2RWvZ&=seIF13&!pZpjK&xXEovJ2k|13D;=RC zvYkn2JboEPl*sKJ*!i+T?$_^POBn(ukme7cxfz*{UqChg=r%I+@bP9yo`uDdicjbZ zHb1&LI^r|0_=8UC6%kX#jcdpuKNO)ENk8>$O0@QZs|;qHI|@G;UQKkxRN8AY!LJ$) zN^k6`mEH=;mNRVJEWf%jDy+Dm@74@L-26fMoAH>{gzy5gBKSsuh=oh9Uv$R@<`ZkO zOlvGrxYETJqaGf)R~~-jykqKK|Mo@jTXHqgi8MkT9rgFNcV4OOWA$J!g7mS$(bHs< znRbpTo|T%x5_}_!QEytG?qE3)-0#ZkePmH)B{CjLJl(Htgv4X&+!^0Nv1g+cn_G=Zuy)xpwA66rSU~HQ1@M`G$BXJu??e)6f%e+x0~|CBKkmi zE%-LY7p3Npw}*O*!rG+IWzV|I4d<9EeM3%u-X46cj`2nVh%)(j<5Iy9H@ z4O9gJFo0Wr;O}0pnU&?-KZ>c>dEy35` zYF>^gbo}))LznXsPH!x@I*;6kLEQQ~2L+_pv!JMsEmsGN>ewtp3V8jr=2dtPd6&SZ z`9_`%vp}R4lGuVGuEzF-?7A~8VAI^rwzC^-nzz83=A3nhO><+F%1=C6R6#~ z))Mx()bG2#!$(HC8ZL&~TUTX#9xH%qjA()#`disQHO+(n+%z}-o2GfgUpCEwU#jLp z@6S6zRrAKbH*e3evI)14KejOkGm)G&UtNF(N@;bis({-HwUtGsS zf4`1DhhN8Aj;`b3|NeFS%9$?W0Ps4#16{{={=s#e@o%oyo8uWBVF@-f%8LtC z>*qHuF27x_?s>IQ-T7G#r&dQ3xBtEu@@<;7sdPo9ENpzXwv=~7@B#NAy-1hcEWv&k zIN)~CAY-pE=3F@(a4X&hzULT9t7uKI!4}-b<73Qp=G;#k>(yn3ELPU-rG}m?^mz9g zq_T9gZoFHhuf{?K7u=aH*3bNC&tQNH?#!#;g4^UVbLb~LNY}+f_i8oxfmuY)z7;dg%+j-L&Cry98Wqvi;cD8Xe>lr&DWT>uyy5kNp{%ld_t9O!`4HS{dZen)J z)06tE%GvX1D}*uANpYQs;SO}Ti)TkJBbcL%=w5e8#b0GsCpOpN1E#4f1#ewJ%U&WAJDBXp`d@V-$ooA^qVVAc zmeW`1=eOmtIflQruOqDMXN-p+zPw3zL+C}K0CBRHalStqgZ?K>X;%WwjV`uBbh=ES z1+?=9)42`(huum2xw)xbe-!{k+yE0qSV$ zGW!5Nm#X-MbO)Xt!cAoD37bbqWdV+o#VAB(EIIAr`yWH4Upoc+KfZ*dR8#X^ix2b4 zXU_fgZ-Qy(*_JX&*`tX^;Pz??z#+WYnKqT~u|QQ)svuQonHlk}KZ!T!NNSr`V|cVR zYU2ImZHj)rbVxDzv%xq5llW!5Pil11g+**Yc=%C`Ji-FNXz*`Qb?}*HVq0tMX{~y8 z@vGEGL^+_07^tZo37kr~naBdKk+Y2-%!E)GU3;SXY`@?g!27D(9aoAvw5?O{u5;~| zZ*s9it_89Ow=37eAbYijD3VD$zb+s%?bXAF z_UikPy_y-aS4;AgFB({6JkIK8NQ`Pqu>>lFh_(@oZDX1Fb19ixr@ zK1LR6!8z|K3CW4V9Drc-$*lYSqG8lBc+^M1%{3RdKH1c0IZAr_Lh zt@iBuC@ZRmdN$d9)j%7~rI|FatmVu9Swp$m&B^*1zf!jt^_8GA|7l^8#^&}Z=X(o4jI zB@;MG{bduNg|DxERc~5FB*}rvlm07XU4xOkErWFI>u3dJ5T%~8&6<-hK(C-fB}UNa z^@?(+o*{HZ7etkB>1=V_c>a#Yo24g-Q&zQ*#*g5RR;NOxh;?T8<^`JT`3>1Kipouk zMh^~B*%E`qid_hB@xIxn(L)+Bu@SgNtW6Gx8Be842wRj(NPSgLc*nGq}MhJ{$M~q_C`6`GObfj7c6;ju_UQcg@seQ8H*% zrj z_`H%2ag7J;o`P~Q?623lXV8)B0dE5zY1=gvmxVgtshILp!Qgo@k;anjGMf}GYV!tFQNM;K-=Og)HX7xHSi&PzOhx9`*jgLjr#qsw#?bLzB%-hjHt`3`mF$GG$F9FV@gdxATl z&Ws(mq9XJEarTx`UF~bwE+HWe(jC$WNF&`XjUv+BAV|ZcQ$PeHr8}jOM!HM7LAtvH z&ivzYt+n61&l&GHU*`DnouS@7_kCSx3$i0B?*fm0UjAHxs-%7AZFRA-S}})QARI3J zD4CNSv$5Mnd^lt|emG5vDkGj9pTe_BZIyN|EV9>;#UF`t^D)nw4kFLGj)z%qqt#c< zedElyNEWbNzOq9-kDMZQ_%sG@`S*?+9CQDIFAQfTP=AN@o~p3hqe@iX$`ThHnWL{6 zdUjd+GO9?+LpXC)y_98K>CzG_1mUgm*eS1Vb8BQq;WZc0%l){Byt!jaPreU>-o@Op z)^JmSyOlY|W1JH6>X-B@OmYhpKQk~7-o4dU9szpfgvOn<6>WYcD3;%{g5N~{waM85rn)#7`jrRK~DQU1Gu?e zx3w1|=6*afOD+j#jn9}*gfm?Mn#I8AZAVRXW4&M}PWCm5J=#j`Za7L#bCB#?R)824 z5Lf=rtny>2?|X+G1-crsgcm=M{VEkSUQk+7Gs@VvpmdyY7fJ`evFTBF zpbfjyuk?V3yQ9 zINZ#NH6#_Vrs3VmmM2a+Rhf9V-VhT$M}H9fDOzAhz9habqNUopgI%O5mCTlKTBXIrhd8>2GSf9ocUgHt;VS_70f%1=dGo_^wE` zInu0b=w?VgM@)6S1aH?)D|kT}Hj76WJDK0IA*%;UU}WpzbNr^&1oRegK{Lzn(SN{duq=>!_-`4uDiECX$A)by@4QGq z-H7{bSC2^;&M>|ZJC^UkhTRB}VK4Aa+#YvKYCA-lczJJa)5nke(w|z*G|7`a7w+fHuE zQ@^?&E2RHq5W3to46hsCE30U^LMLT8)-h%(=uzwVPNMQ2Du-E8v-sY>(GW#L&v;Ms0qjOM(Jx>nGu(cpE>}V!jQj6&E?sUm% z4|~Ld-!kkw8U*pGePB3XKsA>PI?C*Uq-JRH*8w~q6H6}W6W@}j;G?ktGWd9>b*L6K z2NJ})DgJw(t@Ur{^6W$I@duv~7Go)WitB#P^zUZETXN5D&MNr}J{$knd^_$;@w2fq zR=8Gr&jgeSy~xItVM-FHc&{c48PaeA{%WJkLPaS1FYX{RC)o#48ETe$uZswm|5ihP6|v4;Zx~8Lcguf$EMKu7MLmm}XTYDx zZ=-uWc646R{L(HG8^aN{JA_ax^2vgG{aseFjhC*SUa>pY?hQl=kTH|LCO~(ElI3 z^fen;a-_f1*rn~OWJJfU7|=N)Pa2$HJ*xlLUi&T72F!jBoTJS_k|yKihD!e$4_~B{ zm`L&9d4E$_VG=RGB=7Lv<(KJ=RmDqPrV|__#?o@fiiT0e9MqSqb6cdkIPGUXNz3%P zIShd&8WPgz4ZJLKO#1#M3l<>?W8C^GNy#4s5T8d~VvJI$sax9;v@V>`JY6_}Ctn=% zQv&VSYzt4$gi_+|Y+5Kn^6mZ%w8@N~(r7Vy@^)x!BtD z0?PuWz-qbNHy-|#!{9b5v`Fw_I|kezMLTWnjLdTaHO|sW?2BJFG*Zk z*AGt*)?J31*3V*P;o4okG~w4ZF%5+7 zSdo8KNyK0dxrg$`|jT?)4n2MgNOL*I8f{#+Z6fgU5{GY3QPrKaN1@Sk0^h$(g^ zA$^d+OMXUy7xfDs6ozZ7Ej~uiVyhVGoVS{Y$t^9Jh7))`K`#_ zz`@t?(U)wL)Z!8@=Wq~Ok_uTZM8ZONxSt@}bLlB1~JjW@+6-kd79;8_^x9+qQq7;#|L-(fLf zy094`M4_G4vFlcK`;a2I5pUY3b@?pRAf66ig4kXYvA0$!INWfq%(p;mD8 zA=JtNyYu1jRj<@f(sZ>A&=qt|ia9f6t}$!T&A#doB&U6p)ugGEj-HsdI>= z!opd@Fe2e~&2l65%_E@gV1N@}9>jXa6X}`60Lrm@s|~tGi-V=FG*Fbkt4G9+ARehC zc9ZewWuzf9DQl2P;!Yw+$nLfUi{4;Vw(;?<)p(%1Q;mYq$}V+qME# z)Yu4r)Yu)M8rv0AV<&-XY&nP;8*mx>w;TJHv0}trQ(U*Tw)~TAH!J&H#rtIHN7}jN zq$MIyhL4=&9}=vNKr<-y;4GJ;UgIG5>SuoT(KA?{uHM$rW#1cTg@6PvIV zT)zH2l2*S%K^@sFtjXn7GH1v=)|tLNv@K>o(z6l4pD5)hviL#cLQnL;s4gyk_lMSBT%W_Q-2%-Vh6} z6(gj+sQ~U`vExg~+W%>^K_9&N%7~V ztk)L#or<-1WU*U1h&UF*PwaXdG3@#qFNb5?r}Zl4`Xu89wZIhHF)3GvmrUjUDIPEX z=hJO?IwEW10Q^Wpl?k{+tr_p)ASRFd6&0Plp*LsODyRXekLCWp6_ak-Jlu+HrN!4e zHLjiTzd&o*GRz{iLzRyu_R=atLM!P47+P_c9zrXh^vFM%HSWNUr24A{kYuTH7LVfq zJL$>w-Ta7|ube5cX`d#$#=Y90?!b6=vYRsXV|~|$zxZS17-u!*1%)p^&RI|WdS(;6 zN~8ahq&+VU)sXsqCZ#*>)Y2H3Ty0oxrT$GH`~QHC0T|S(J3&1v`_I!U2t6yxNUvt$ z3>yu8ootnY_tL~Nu+;omS%-hU!|>1NNk)U!ud>hKRIucuC(+u1HKoyCer4K-|A3zF z@c=H&0k**>3Ew=lRH!(0pLxyboLD|`^6Gkej0!WtTx)CtmYNAC9(-5jk(J@n06N*E zjXP$%wTY}EpmCKCv(1^lQUbW)ocV`T3VnefxoG=#iF)8uc$-*`wc!%#&r{@o5lg=s zt998m{Zi}UOKX50=#0B&n!!Qi9MZFWGB!8B5Nrb?xq`MxqDAmoGmAN8U%}N5IN9X5 zwIrc*(#13gglawQ6V{vF|dMCDVdO65ezlO()2 z_F-KQ>PHuPA@o*^dkHOo`&~K#;`mK6Fzf~3Jw<-kvR{P=bUnI@GHer(9vYCj&i9$g`FWeBO{uCO> z%SfRYW2sPp5oq)#WW568o7LI&pZMlR!*=6S4w|j96O&$v>jNiTv>a8@g};_6B00A; zYPy_^*8lQMn=z{5Ah$`6>&IZ|_F3H0I!=RXt1Fxf)TZI~vU8-fNYqZH`=vA#RARE^ z;Ba^Nd{ar($eJ#L)qQx7fjv(d=5v!|RCcJ8R3wSU*}Kjqkmqau=}T72brXGX^*jwx zl8~Yh3_$twK{MTX{1*tD@Y(-OeA8O-<9i~bSIGR0i~T0Abw)wdc}vZ_4VA19TVmrV z$d-6oIQK;2_msHBnidZ@?La50nNF!l!OkuqvH##$sYz5#NvLG;!1nS=eye zaw0MGjNwJ~m399#LY8)~;T5m4U34y3<^Y%SuS=jKn zm?sU}?;gpMF@_Zs<%*{3ARS2VDBOZhtBTl{BgvLT7X~dGWdI(|p%1;WG7u2Y0xE1sKn!?m2>*lS*!EZ1?I(u5T{QJ+0qQ zwSu~8!R7D`VW=^w1Y|i}avkf%W^G5f@iMZ#fV^aKN}lKsQLC~eDXeXPT5@x{_;dVC zEy%XciasQ7f3zVct*8#}hS5>nhmt#E z6l6_Y4L)?)ZthlJfP^fniFM=?k^de7Gv9+lU;tbKYZEjGNgINMEPMZ(J*u~RWaF#4 z7`eAMvVr84*B~wc2A;O&FlKqkT3GK zz1QH_w>teEXJYqXVCvKcpquhu=rJZB4LMo5182UhoX84)fvE>gqry8+|7sM=Q(^s; z--enI&&tjo@>}n@HW=Sz*Xa^6jUqnr{`0syR4zxGeYxThxUxy)|4F^p(*cg-?Bhzje@Z#<0TrF7p=TUM5 z3WuPn7fteQxx5~i*SvYNU0OVNM$_1E=amk;%F{b*^l68ynsUYr1dum;cu_W3liTdj z+Q0`tEBLeB9olgVjn!LC{F^P5Lx{%YPo!Yfq;q{V)<>MfhwU_`4%KN2mU0$2)v#yh{kF2Rn}ak9shT-oNX?ZI1cm z8i7}pd>1^F%F1XW6H(Dp1zi-uiS{Z*D#F%J20q0 zQWZfs21_=e|FlKn$^Xk)64*BUnA8S=UbUR%Bd#EGZ4HdYmLO6Exa9vQ^y+Ws6|esT z^Xfb7EsnKgL31leojw}-n>sz6w=aHrOd_j>!|{#Mdp(Tj^(wIWXws2n=cJvNdC=ZI zBFy1!^6CmP-a*Og{QHKys}Vd->p7>ofdL);WO<=_v>YAU4@^NX{5{4VV{K9}1QQS~ z@OME|A$%Zaeb>?rO$GEMKzhJ$O4G5u?1MC@#vw2GHU>wgOt5HBmh06=ZEAtsw`=sZx4LK_Ayh0=|BRO{n+k!sOew zx9YFHkbeU;&RTOAT?*fmUj!?Q5OvCKOG=zGeQnJ(^+BEUB7Q_Nf?)Nt|0z+dkmFAk z;PZ(Tv-$FHcXkmm;j^EGdh>H`PkQ&1a?s91W8{m;G~~Z^`3IVvDy+Kww8bkwlRY2G z1)H$_Z>qs$C!?$LV_m}f&nLR6A$g#0dhrBahGh6l|3zEsIqhTcAlFwz&8c!SewMp; zHX*6E;S2(n$uahPwNOC7GLWTzpW5hb`Dw0mBoI(m|KL1%;^iQK84;iK4Ie~GQa@*} zDpn0sA>sOde+w%uD-!}GVeGzJPV`Fqi;M8l2ZW^_82HP#w{@m78vbovHM2U8dbrqg zgND8fsV})HWYzAZE~p78QW6n5oaK27P1vRO)6?Seq18vBlVfa4A6IvRzrF0am( zwI?1?*Q`G^V|C+4r>3Z>3t7N>UQ+NpljuC!7y>mcA!~For-d$@Vq!xkx%KHl)W>`pezNYY+(3O=k^3@#edKU1278i@ z_t=xlZ>1oQ7+A*@vQXf1`nD~$&gVesQM5a&{Q^Z_Xz)gNKhM%poMZ<(a+p&f!vl}` zGB5*QPV+0qn$4HupzZ4TJqDSB1bJ42_M^ z5E+~L6BsD?^!XtRQVP5k4(EqtL7Rsx_;PY6t%T>v^sVr;tDtuNc@Cj^ZS4R%!Ay_( zU8ilTC1^QT-0SYYKXe(7WKgwYRE^EhFWP3cSemSRb04hW^gv=Z^kV^DuDo^cxZZ#_ zECSvsbv{leOBN@LL>VO~VE1r$XENuXBbS3guj&5OvZ_#?b*NxnPV=rnnX3jJGG^W9 zKr=52kWz{Tw4_3N=-H_1;r*q(Q;xZswRkHdZsKWr`kC)#B^YP#b|5Og-UWu+T` z3o8n64S6Zmxvu+-_5&59=hgR{5i+<_iIz5r37$U;=4q(;qciNB-s$QXG$@)n}B*_SsH@VDN#69|F(+ z+O-G(VUum;g2GV=7ngGq%Z=DYypuA(1Rq#R(D9IXe8*8?5+<9hg;m^Mo&4n@%X`PX!ijQjTx7wpaQU={j)(=lYX-ptPrO;1q3tbf+} zme`iLOjOqvsLJW@(ss!kAPj-}E^kNSU!|t5UVqb)=dlnVFL(gOl?v_OXA0HRO>2$^ z``pm6wZ`}%8;Uy%LoZnHvUNg1yhnzt%`TnvUgeiPE3{#$Opr(U3&xa47s1q-6OkFG zB${s@UYaEhbER90&iYsPAX@?+Izcp^0tUeC=qoaNFdWLz^Fk<5x~Dvn)l-JQnD31Q zapm9amZB_>WtEZFZTT*klH?mi@E# zDvU|dx5$vk$KbEx{sAn&bt7x{%=f#7tJ{6-5~4G|avO3v)sNTiWP`{8nesXN&*hJG z>SXTmEWvOXoXXiHDjo0Z>!LIKsEhGB_sl+2PfaJv_>)Y>nCBvN+~44iF~7ciORi(J$PihAIu zvg5>=WeQ5WLa14p6DH$aUFoA0gUSv$nBI7VHicZcS(65Th?W)kObYK6Qb-#;=m|eM z*?}bUlL^&819{a*1tU&6o2bV8i^LCBzR3caIGIS6#%TfgC+UFXnFa>Cp})h4blHBl zqS1mp0jmdg{+=#67!KXSONX)BsWTQ4p0>$+Fs~#Hy;{=h%By0TQ~sW3S-%wr5`Z(*26SmYmZ7&XhV6z|8}uOn)C zFPw#*xD(j)Ub_Q}93|=Z1d|WpP$Ckv7Tv8hHQa;YFb*Dm^azo5aY46{+-gAd$uExc zXVIv=mrUg&G`Fh7Nxi>{h-QOPeq?o=D0NJpu!!8*8uJ;y{g8j_UJd;+WyN7_Il~dqHO_z$f$UP%=UUAu*mjzu4<~v=0GEyeCBt3%Tns*7t zh!7)YmDP}~Nn`5cdHE^CV5c)mRgS7TCOUp)z$N2Qd^zO%lK@&T(G=-LaSwS){Z3Z- zbd;Bf+WD&uUrbXh@DuCQ#!MSH8Z^Ez%sr=+)Gfi;h~GOV+J{b~EnSQ~ohg3&*eH_QmjL z;VI}wa49~RM`MVBRHrAb({jb$dj+LcvLMw-zmB6NR$p+BSs`JQqQ(|Vc}BM|s(K2#cvgsfmBR3j+<$eev9-NG$Ew+X{XXNhPS zM&ye{jixW3E`~V0+?ZUEOA%Ph%Y?mi0WF^@L*AqUVx8tML%*sl$tmM~-D?HtCYPcn?+XR_k!g<#H)lW^` z9Et%R3aUfrW>^sGV#|0^&r1M~$9rFC z%>SjDvNKL29v@@29;5R}9=bpYN!I3RRqA$-Dx{$r=ln=9_p3&dt;&gY{uI#>sT@@b zE}5)UT*vU_ypf%|RbfsS+p3PLJipJCG@DJl`Y`l%0Td;n%`GQ4%18d>ueUX|RD-mS z9k$aXVXfmC^2r`5ssKNLY_+s+kMT}CRhr6_W;*Xz0actFXaO##PbU2KmLXRXISHpA ziO=$T0ts`zYU4-8oQWWu$o^HIK#Rj1d*Z9v0IRn>cgt6$LqM73bipkHt*5cF7H-v_ z&&%uHchyX$_fg!^lyv;}!(&%967huc|VL#!{b~fSlmT z2Tm}O!&t#_60FnJo7wvC(j&)4=c1c6r$Mlx>Ez{YeoCKc-ljh_25D&avM)MvyqHJ5 z4fB`hT)q;f5#U7Odwd=Fn^+XGLkE;()<&$n2;HG8$s|sDagMdY|x=O z6~2OqZtJ|@-*+T*?<4dMo@~ihagXPH@32nk8Gc!E%MHb7OEAz% zD8NQFR1Z>yZJrpvma-~mkI_G7Bqj2&$J&@-oDky1H@uDZV|%&uYw78zi_u5;p7`b2 zSworCWq3_2ms*L>k4SAl0n`Du7SWths^R6|JTbt6reiKI>%tJ6)vRr~{n5#)B9z!Z zxfFr)=e~-mIr`c35X-LDOp4UbEnQZK*-1hubbI~K!ujij7}pi9=YFFD>|`+}DQ916 zZl#>%%UdSiI*ft!OxztV`sD=d0Pw!2N(6dtyIgNe9rj*Pq4kvmborg7#KxB1JGmko zbEZ0pO~2mRD>51}Hin;Ng-I2R24366r3+!VTsma!hbUK%^pWTiQL|U6;=YsbCXPC{};k8itB}Ew7e|?Uo@q~zN9XR)@Jvy!To&%D8 z2~&a!OVny=?P0&@!v{9sVa;tg?SU7++ZX{JzHzN-Pp~u$MVr{Gd?>NsJ?I z=12$WlI^?z2GDyUi@^L2?#CQ8%H(}(iu8(&D~a{71}L{h zCvLyJRq5jkgB<)|AP2vb06CYGUYLB95nX218ZklHrqkNus8WZdei2Zp!{f_p&~`L#d7Bd!6T_xya{eAOCW z9=+(;!7f#87!)d;)Lb4p8*Gr6J%)w;_5-)qo}8xrhZRO}Zod9I@d0HzrzA_HQSjim zYw8$ixJ+Kg4pjpl{8+(*pP8-?^C}wjHPRFY3d$iqhe$QiVMWr1M+v>(K{nBRz1T}V z+7~4{!KY6pDV~Q4seS-5PTb-47GU^wjSfD{YR>Q>g$mSLCh;%YzWd60J8|^9WUpqg zDbOH6O6IleSazwGpYHk-P@&Tn^%|%Dj4;VuOc5fpwF;fGe!RZo;t+y!?N-QXEVvJH zw4%=ktHg2E6OkX#g%o)!Nm|d^R7IZ`J;G>4k)tqAV(|4O zFYg}yYpg%%(o~S>YGt|bIZZZYlMvIjkq}0``|4?gp1wgxp@oS8R||9F(|0l|fTzGq zCLjBrhNk{Lxde|F9|CgqM^;o%6&fZjPlSz<)sVol=AqnMfdt2W_K!`>8q$=e<`@-k z@M)ucYsDGnYZZ2wG6JW+X(-gmyLoI4>_3l34o$AEmO^!Y4?NF@= zo*s7%iyLUYIl;SFyOqMdYUW`57$L=Tb$+)Er*DayxRhH4*d|yhb%OUkuB}vyd9`)Z z`6)@GG@55AK@3eP0Okth-Y0d6VSJY03|k14@)vV1|Q) zIgYnxwZnEHuyVw&gHHf5ax^RRS>{v1&l`y!n)Wf^>t;5&^`tOfy!D8){@&3%#ZYMR zc=sXAeNe&AW|ielV?=Na2)@${$uoBMV&A!y-!%CyDO_2ImynUaW+L)C%poaar_k{q zJvkP?rdct>ddwcEk7R5IRy9dB_V`cK+J=8*Ckn1+F9TKEYReIr&#&JV^K@CoE!v?& z3Ao;tWKG&Aq?w$$1v5*uFG?c^z>KD(d$ZATI*SO(u9vNYXFeLpneX+}9C5nNKtplm zv+oBjYiGjrd7T2R1mlE=D?Xds6-j!ybcFNTU-r<1Dy0*yEymrKrShi>6J1-1EVnbe z;>xHXV%b-lIa2S*zE5!>iiA`n>dPnjV-#4+#(VeZSio7m@+?*__^66LmJMBka$@eh zW!^3#;rd8RN+%_cG*Zu^Q!XDg+cbzF!o`)@M#`EzM*z2nR^aw91Kb|cFEix!ngux0 z7fZo3ZHb8BO^IlV;e*GC7&?1ILnIQ>ZZzOvEm;8ddHaBV`s-$Ny=!@xqu9jL^{viV z{;@E+7H?jHniV8=-Lq=Lob#lpEq zYLee~7Xq*Ph#Vajd8QyYf3Gg6$EO%i>^mj7h8{!GoWC++CWfSIk0$tw&}(ZLv$K-P zR^t#B(tLB$Aq=0|=T%JINn>hNk~_-BLFGwwZf3~*(&t+xgY3VAMdY^ zO8N7+OkT$B0^X#atK%72DVQb~&N)gJlx&hqVmL8cB{b5`xlf4;k~zidD1bq6Y!FS6 zdaz#6IGU(dVaJlgL~mc~8v>o)K~|sSl(+oeHR7Znt#w2_KD$!j)MCnbSHM3_kHe3A zbgjojYIc|zr34CX(r1)c$>QTMV$F5%acqX!?FJiI?Rp#hhpA4=TTK!mM?Tkd$dQl! zMD*dvck(U^Wd97s193_R!wtht?&LC>QL>5!HZ8`hs+trND^p5tBApFfdZrX%!%de; z#O4(mjZGY4n39`lf_7sdkoTvT9|Cs+1jt(-N0a{U0#e}ggeh5&cVcLPb_`0SafF=t zHo-F=J)G9JFiFo%`#o}r+|pY$q2yx~Mb*XzDwh`lK-G*#bfT?X$3pPMYr><-OQjce z4-HPgSwk&OfzJdNi3Tf=`=vhFw-x!KDZPTj7_r+a1^=t!=d%A^a|emNpiI0f0wMx^K*YJS||tKEytMys;t=tF?#U2BPP;dx>5X{>~`=8w;ReR#JR`=-m2 zZ>1K6M^i)iU}uv>g)ET2@EBQ@kf=V(=xoh=-{eVIl0@Dt*l{)zhBYa# zlH4owe)&MS*`)D%js(Hb-n@5P(kL|El_0Rz(jE`Bkq0{C_W+%+x6Z7%X}=3kXf>VE~g+K6}FFMo+0p$pXmwJO|)B%ylm&}jzwj5INih!Y49`0qx6JQoxF zkwK;3oy|ohY(siv+>GP_K4q}8nF;D%&_VF5A_$&MDnUc)gC_9e+RjR2z%4Q4^y<`O;=S9(`X7WrG>v*!)%x_&2{J=4#tS6)68_H!IUr@_L z!mDwm5##&TyLh?h5DtKoyL^&_D>Bm3Yh~k5YvTeHjt}Z2lBmDlyxJiv>lsuE>?w7z zI_!{1wk&;pKd1NMOcAY@$LGW^T6#4~gz%|hpsj5rb$Aewk<8LEE*R_@WIkgz zh_Sh2O{-)_fXYs^6y6+KpGKGE9`aC1be(8hI47Hb-UFlMFrdI*5&5QQHp|~s1$#eY zN8VcRV=URmS@U3(Za5EUOwA%}eiu^=U6Km_#Ua(z{Q9`BL!kI$@hR6tG&5Jpppn^UF;TTNlp2|;zlXQ_*A+qv&v z31ag4uTPh$?k~HBf$_@OV}hEhE__rIgBuQ?I3;CFmg8IwuFO6eyVTjL+4mpLRL?mO zDO%lrr9HY6d)_xiBLfh;LD)ptwl`pDID=I`B!aX!vw(6M%UsN6sV#i7;;a<%!aht^ zevQv+nu-CUjo7WIOG(#9Q`shrC?jtzy4>lP`lbqze)(+CNqAJl0GbOn5id1tm$^tQ zZv?g2q@<(6*X_R0zwMc_`u_CwnPsbx9md6l+_M8Fw^!OH$bdZ8aA7|lGeicHB`X1Z zYnem4qPrSht(I&Wv}QwC+ss);{QmLm+2(>elAg3A-rZ_QKSHDf3yKYBNxjWU{E#Ji z>q~2wju}zbvYfM`!u?_!Vd7}_Cz8saKnEtf`yw6F0I5m76I|;)^hZBcwCK8g;xSY! zM96`ZoWLGTPO0=M>k@kD1E}`0)DeORkT^RCH5a-9-vYW|GCkqyKJY!-WYiO5Wo3pseE!@%$^$;R*qo8m1j5m_r+??t;>@He*lY zM*hlkkaL}@{$AwJ&Tv+#RFUrWHdP5|Ii;tDSWdUYNV~dm-9Id@rS^CE%7opc7Az!K+D3W=brvMwG~FY4sdan*o~+`F%+HOd5Eh^LL*HsAa(X8c#8tHs5_ z{2cuCa80op4_;GiDwVr=@yqx3nO;g0s7B^UD!@UTYr1Jn&kun>nFTrSt$PD&X)Tze ziuKos`M={FZX=CJL4&P)Jc7E z&BnrFe7wbqn-VAyrZ~cVq*FQo8)dIT-#yya!eW1BH2Q4_5WcQ^O%aluEz)lRR=ki_ zu<{*Oxr!?uN}QZqY+Fa!-1S|0lt1zokPJ*d*x8WMPmo-N^e55721Zg=-R>-d`@7O3 zoJ24Up5AyH@q|1NpAdUa=CR}A=+x*bV=ARXH8uHdVhl4+4W7(Ih+B{mk z9nzhPyC4HMc%v=CFG!bv&fXN_`4?-N`KER@8JCL?q)KqjWB~>5RTEO*8xlqNBv!hR z7F@dBNd$LI+#HdOh{fy$UCkf@e_iMPb*{TRWg;-2t*CpO#^XXYyk8|u3!j)RwUUoP zTXo>`dWOJKg$3iqV;SS(_TpC(atuBnrXB}kSJrpO7J+#VjB}7{-DwSZ+D{K^_lCQ+ zhO-yvCx`tiD(Mw~$_qKNy8)p(OS%cztf&{0-a-I4z%z=*e7P-~CB7dn3Tsx9xrr&uEa;*b@ zu-Bs)1iX2^W?R<}TfR=QWV@~t!{4;XT=XUp*|a;-u6~SnZ%|lNK>d~RApI@VXyC#Yfk!AQNj70#r21{z{vvD06xj~&AzG?;tFlAHUX&9pJ(--bm}>M5=V9@ z>aZ~Zs%PL$(mfES7fAat2X{pWI#`H`!{Qs9JTMKS;<3{4i6Ss1#*v$0<0fIV(+DqG zjMOa2gApu4VAj>u>wOEI)D9Mi`)$NSP(=XCZPa+-n zL^PZwe?&b)>HpjsOEj;VULS_WJs;<*_F0uiK4>eIkAtse1Nw94vvV;KaMm!bNL*br z-1vR-30Shh!u}B&1@_y{CIN(hD@B%>`KzdmpKSva}&WB zRo}{9Oev$C;sd=SA_ZSVoWnUsI|g@9fWfVx_ZIu(_E#35u9Qd@Qv=B(-<)?@1O&>Q z(qe%?nS5ZIUA=cdtrBR%7X?R7HNzq^(@Irzy!*co5~RWgESA=lu~20Jv)m`0F3%dySuu zNx8g|asr#1e*HE$E!M%EsIVm#$-$)#);3^sGm^tIKk;%2!*9QY!VXk>N8n)9U{A6eeW(idbUi$3hW z(iur z-&8Z6C8PunB01tagf+0nI4wC~qkIwOb-{O#vv4CysMdHMT%|#p_*H|#w@iZ%(YhGd zZ%C7o1;NtTg`ThN(L1+yM^Fn`uEN!>kB>ChfdI87$*0huq|{%>fFEnqZ`mcSHBwR( z9N-07NQDD>I-+VhuKH@VB10{_C*ND>Pq0KI`}^RNjCHsOHP-_sy0`js`;oKbr@ycd z^hJT!L_tFx(MGWo(VKmrr^XTt0{L~&ap8)_0k6Xh#kSxGPG-En1Tcx-tcclX4ZJx6 zu18TM@YDG&TNJnzQloEBN#`D_o4Y!R{=M^BAi(wXajhHsbUqZqFo{Lta0tV8NydeN zX*Rai8Z+TpdRLVn_Lrt})myt>IRS;UKD`H!l<@nci zNhmgv*5jwIP39~^LugsaWI9nRkbnn*t9V;+^Lilkr=Ta*_qfjOS5LuJ-Vd`hR8{J; z->bYxNOw~JO*CTjiTOi!Q}_MPcl4mAlq*0LJlL)MFw?IPeeYnZz*Esi{k{P2)8LQm zuPafm{KHD93mg$tK>f#X#%Uq``{s@2sVb{+uh{6O^1NqZGr+?a{D5~mUaij+_uWKK zqlN`$f0s95qrQOU%_^0f?d!2~H%msl6F%yZ17Y#{P29Hd-4L_a$oNYRXFDn8T9{~L zi{K9L>1=;8sUY&bn$Her6l8~|dL|w+oHAHUnz|D0!YoziV;eyh=J878oVkm(FO_Nw zNaT1%dP4vkr+6r_-S*K`-AiBA&@e8hsEL1I-ip$x0`WbcJXs8iS&Mx2M4l(kuz9ru z`#9{p5vyeSulY*D=9lPm7F8b_=`yVg3*U@{Zw=vB%v(n7pmoBiu?BoISHBv7uJxX9;jRfSa-LS*?&;2CD^_o{IVZ-Cn1`Xc<4bMokAG+ z<fTiy}NV?afXr+dyq**7^Tjs099r*_bs$3Gpg5$eYaAs!KJA-}p6d7}$h|8Q@wEbGY5kLfZ09HksgBzMoJ@7z^A ziQV~<({qA|>Z}TNW5oCe8!**-+|#v}S4Xto6wV(rQJ(g#XhgVMkNNssHCYmpd#K*^WTVUttX(%vJbgU%>sA-4{dK9l-0twZIjY1AuSCeC80D( zN_T^lsB||A1Oe$rK)PGHyQEu`2I=mOZ(ZQt+xxlq^Ugc(%r|SiW(_m^=fE8N&ht3a zd1y3Vn-U>h-h5k#l$_8+{CeyeI>%jQ0kF%{nvXH8pcn2;1UzH~W=`GS` z$uxV|3=E5+H;`uD3#1*}I)}QD5|5sw2al=LL&>6=0lGJjrl{y&ZbDrP^2u&}tnx@f z_V6x3n@Kp5`);(&zIaMU0$Uh8hGS&^0>-ziCxQXk%$3iHrKpB>QxYJp8#DX(I9_Vo zi5cGQk*kWA01HW`|DftTbMI9DaQDX3=}vElITNWB#CN5`#6{0OK6#WN^BFE5oDo4l zU%c_iT}~9;1vM&O-49%%&s(W^<&3?QbJv*hKTka-qtO)GdV6q8?5(VL&!?5OH^juRo4Jz`wS^e| zN?y|It|pIf7VNFLn9Qb`pL=;~zeibqj)`ONo)Zx)=CQm;TcLYc*UtgJPU89e=(@>v36xfs(3&vXeLAk>NW{3|SIHAUqPobUtlo9(NZM>j8TE8>%nD#3U zi5jzr3wC-KK}RyZ*zkG72M0^&B<51b&TYnR68Mg!nF^VtU9K1EpFK9u2qsRZ9Q0n6 z^rcf3)US`IHMKAwB7q*21&IRW6_?=t^3*$z3a98+C7i8weN8*Ed&77<8yVmTuF{%P z!5}_s`H1;lQAK5Y2R8k{8K3RE9`=XZ15Bo5Xe!F&3?0<=pkesAn7B0jcjGuS(C|+A z%ijoKqXx&n2De--KFaW@^JOU<+7V(!Dg2!0xb?$=#Ko~yIGD`{eL0>U~!tYzW&UQRvJE)S(C zh0XrCyL+$99<4)%Ih z7xS)pp}WRf4L^2yP=@Ld%uPNV>t4ex#~jVtL1+EptULz5{&*#f0a$IlOtse3Aa{*a z#F`_+b1x)U<$ z3!2%@3TJXQSq69w7lJeDq9keV(?=3|_)n<9%h>%jo(4rq3TabBTTEx!<0-UlY3I}E z(C{@Ly*VY2_8}bC5(4^yum<`mJ8CHf!kwQPH}5HAR04d&0-Ng`jlxQpvHl)pVW_mM zS;H=LE8dnQp#w!#%4sw*1oh@cr73zQ%SQoDiI$rT!%k8f7EUrw?T}y8nSJQ9qx{p@-0yiewWhh@0rttZ0>Tb^iFAr`g1F!T5 z2_(8GzufimzCwC=qd%&oIq80teG>zJl2lkQ9F|#_QL@QL;(=ZjJ+POz|HDP#hSJ5q z^qNJF=s$CpcVw5GL``Y#sv3*(5Wx~|vH@?cU9jv(f){rY$T;D{l;Saz*?D>*g9Cm|gvx#H5`uO&cyLi)ij6`ifX`LBT^^)K8m}1aPUK#hthY6t zi#wuqxOlQFt`hF8R_=J3v9(I-e2V(kpg>3d6zt>;?ka@rso{lGX)N}47AqX#Wl}d* za!(`xdj}Vn(YG^UAI49_u;t$8f}OnlcCX*LO9w*?|&rF>0s#~w6x&-5wD zC&vS&hsSKnQugj*m%u&Rogq0>xZ~`ze)4(L#`2NvIp_@yIdn*J&eMOpp(vBQKeDH3 zpJ&zOPvBmo`o*xa*RmSHGpXJ~ZN#*SM*f)#pGYjlqGiTMkY5Mo1s_Gl*O8M^AFA7? z+havegfI&;Vk=QRG;Cu{%W+w7oIh|$d8qu0^m7oX2?h2A?T&xSu%J8)-YFVz@FUaA zkan-wXxK|1+fwQ0ef^!|c=%WE4=k{a_rz{Ay%s~?jL0WNM9YUIOGX%RoReC**@(FU zrZT_rJA=x%T)*`ZC^fK+S9ip|n3Bf(p^%bUPB~PZh2vMIa;7KU>|>t~y+5kNsmnfl zmlhIK+C2d%6dG~cqO78ojLU^jsiO)e|>DoBhFQi|O+N2|{RE$p(^O8@v$~GyDczpQ({56Ftj*b<(uat%Ye;rZ8%P^>5 zqAAo(YOK(9H8Mu6*euNPI(1|HJE-*Xv1c{! zs9V3Qt#!`B7~_wIX5zS?7ln_;;UBHf*3*F{H+YXU0VM`!5*J{YcPgFF@l`qX=;)A! z7rLQEIKJ-)x?9MHR2(`43_}Y^8B5C1?+g!0zW2Pu`OYB1^8GzRYT>xS-V4*^<=2I% z%*H041!d)!NSn1NFurjzKj!bP4?~{zr)t)KjTn*&5{GeTA;w@o8yFwrG=ZmcW37VZpMRr-3xD0}ON2wx(fHd{$?h<@^GIo+f=# zIgW32-_G%cWfVwc(yDOHm+t2lV47N+(KV18>Joh|3ln{-=SCM&u92^+7oUnqX@@{o zy`HshYtz)?O{9Bl&iQ3VDpJ12^$BPP<%d?Yq~XDxhpGi$%HVKAOe;saTLn=c3a3TW z`HvuVywM4dJTh75-0WQ4SuEbfR!#Fp$^NQL1Iu<-#$YE+H#!m>yq9{8kuBRLh4G}l zL9Q~a`*16i-POPKp#E>Gk0+*C1P`oQPv#awo+nfF<$4pMmFwqacqkhU!Vq2UgR2~M zK$p-rEO(0gQI7l&ZKma`@ZKz|_e(apUkIO?speSh6d;*6RA5YAQ{!gnm8AN9*XC>bpagBCu+)A%rL=;JmE|w&- zTAjn`W$>dqt1jbbv2!{|c5n2KPWRIoa0SX&wH*m{dp_thG6jMs)u0pK@Ng;d4aqz( zeAqK5!*jBE)Lf|A`y-HTva&W0cjog=5bG3Z$J~L~F_k_is7B8bf9;)^oHcg~&faV= zoMEoA-HCTCzf-FWOB12DC6R(^6~(0Utn}e^i#0teqdcTR1h(~D{U4G;0Hgj7;q>5F z_eDD3ccpF_D)G#3k<7#4)+*Ctp66l95~=hT$8V(+i!a!op*vk=D(v^QrX{BK_@2Jx zWN%ER>r}*J6nT;0n8x6MEN)-oO{Ut3o?H-2!l^?-8dS$cXhXQra<&L{uDI=mEDr?_ zw`;ged#+cOmtouk*@l$Bz?Y|#;}-|4ziKsHys@YoJ${z+WI)70K;9uqPA#t?R}7cQ z;!xVx!6v$Ce`=M`K7UGyhwV^+SNAx*=iyY3a^_oteC{B^vx=hc0tS(Zsi={9`#`!zVZJtg8XNDSB{x>h_ zX0G%F-Zy13lL(&`@7etw4sK>t2gr9Lb~!Zh$)eYU@J!-!WjG2uIsdkkT=h@HaXNFd21x|U6#@#bcA(CQ<6_e zHJ0+VQvqXcX%g~B7y1uG&0NR7N~HQ#3DRoDLQWN%V@uR<&tOLt0?y3fZ%XTDh!YED zfmUG|MEwigO4Si1KYb*>f^JM;o_uFFR&!S4sHk=Y|Fc<&S{$=>D>w}) z5gl-2<5fd)pm31cWghI7IAw(1Gc41F<@0z`Yp5arVRKjz(^VHv90uvCF2OYD#=MZ> zcqAEo0WUW%Oi66$)h5%CX<;{pQSj?0(2bh`Y0~|!)ZJ(_3?PRVIj%gNj3Gn(mRTtu z0?Yb1>y5V{uMAow<@*rfk|}Mauvut-LxJ>X#3%@#5}~VcJJ3AozcGkkBHKN3L>y9U z_I>@@vnvIubjCAz#)#^hGTs13|K==-4Ghn)^|5dUEi3XTg{wG&hlz7ffVZc3^XC+< zCes5WvkLNCKXs;-&OIW%Kdx7Wgj$<7nV)hz?B#vc+LOTKeoS=5mORfsKoZiP_xet@ z;_^Pv;O!fwb_*#M{H_G4f}shmLi$5%eA4%2VicY%INFH%PgPXLclcQtk{usM4)S>R zn?NlbJQ8F(keuug>?6hs34p4u!4nxjwNJRsd^~OkX^l)`QA9;8%ccpDF-xzBEYjJy zUzBzq4OQgys@@mremClXKy7kZODm{ChBzY17-H1T}g6uV9-Ao@1)5XiWh^*aIdTMUAYFwHUeWm<+3gTQun}`R7armg+Ey-I$6d2XU;VpYp0YZE+p^__$vvBa|4V zD}=&ozOjSpohUAP&E;80bp+ML|Bx^{8orc^9(Vs*f0*{t>&FaHwj&%0&J$ggXQrjl z4(rt6QV|=Q)&>Alkkrbtv94~<(x^ToFIpg8a+>8LC|g0G_?4ju%2vGe7B{*xY?Hl? zK-miR3n}l<6V!=x4wWoPFP4+j6;#7zn8s`&w*Um`y34 zi^|{U@f;LoK9|ODb?yr`^M}IT&d2|!O9!Dlkmytk+DC7Xk{T&32CioY+jV^tN^fSl zf=$`?xfoA2B zx5}GYYyz8|oD{Ge@Ai3>_m8gvF+&Sae+i`d(M@3-R$$$A=>E9U;l*67Yp{(}n%LI} zTJMRa%$Rz~qOwbcwktiBeLn|VQvU3FhAz1sc0`ZnC#~Xu7-g78B{-<`Zym#*X#91h zQ$_?=O@#!z&tIK5UHdt2+Hb8c#ARj(o7`sD#qdK!D--es2ojX`pe@*96a5 z8Y)t+)gY2xg!rml6wz>!%17Q@sTEH8MDfY%x((ApMR54xGZUJX@n^X@DLG1X zh91fv+y@6D$4+oc&vaj@Ap0+p2-8&uxw|T}1-<|m81=ygMr?3_Q5sxeR1tfUA@zqHl`GrDE&{B4gz=GJKSLWGB6%Uc2^kPuUx&H zCVtr2yEkRee(a)e@M4Vei06Ssir;7dXPl+ZvXIo}eW|WTY5>x%^dL&t2Gxu;iCWTE zGs(;k*v_=Sw>_m$Rh{pApWBt&IL}Z$0E4^ylt~$?ZpGU|Fbw z)i%%QHvc98-vPK*&goq`id~uO)?*Js>4(xz#}&aq7b>IlMe@`WWz^<*M0#=aOYi2S zAReg=G_2%pXNT?;g={?>c0`DqVep*73?_P@J^ma^Z*_7yh5VfC-Gw5@e#_$rGofnZ zWg^LkJE0kM4+Zq$|n9>CGZETcmK&!`NGmzQL*-7*0i zZ9}SO&#&DCYXT?4ZZc#AJIxJ$C(4XWP^B<)|7d~AB=5j_ttK%u8ed@N;jJ-T~my^o6@u=4R_23E2sK-opn9+rtHxd*ufugiA?g>9t* zng>P0=cL1LQ6d4NSa}q{BJ8;5m0%IiPkTzlTfLw%_onS<13OZ5UDZfc+ZvA5@taa5 zX!I1GG4@m(l`$RB-Hw4*^gnuZ*f(B=nj+A1yKiS-EJVe+#BVHO=D>=i0L|Lyk#P1v{WFXj8yAt~l57Ul(i<9JJXxacHmjh%qX2{uMOtC$= z!>w;VZmbN%TfOm<+E8Yu0upnN^*bmJol;T>>)#QJ-#9!bQY!_VZf=uq4JJxeE>*w= zU0NmM``+IlU>0-POk?1N(lYFbawG3@6`LqN`8gw80lBUKAIYK_aZ!$poX&d*^3iqu zX7hEUJ)mpBkwE+x8~?gj6bE{ik8-d`wQ@!KywQx+UQiV9Q*#n_RHY-u+4OT>9%e*d zCK{855FA?~sn%0y8XZd3u!}UJ*WEpc1Ddlj5^) zfZUPbBnj&Yfd+c~(K&F{YY=iOgl+uuR2cAscIpwu`u(MF;$_kwl|H6V@}(CC?2cuh zzGQ*%&z7edTgLM`ebQA2DuUTR2l|yU>>|C^{SF*Q2XY-;@?Z_OWn7|$E5}s|*E)~X z@W0Lg|8Xni6TiO|8V=vZKcxUL{s}In7#`76SS|d%6yokpK`MR0YLAfO-nSZdNxQr! zaKJ{Dx*uJj#-jfuAt~~TLJ>PW!awRuZ}itlpG2xHDt%fc9?2i;JSaScqzkqa_|PV( zXFo_vfvvf{A}&K+XOJ*i_4S8CZr|M5JLj?q4CxJs(}<(_|1}BPkcHMQ>%`I+`cNRs zt^g+KBTUo2p}p%t(;F4Z)&$7-LO7|#X#kARivaJL&$C>%Q;9{%LOS8|KW2LGjV-!- zD%Dndz_UlJ1OF&n63M#nl`XW{)8!1yGmx`ki}?gt@7qE$qH9}HWb)WLj&p3DiAy!&QeJs&yCTTQe+bv+p4iCx3I6v z+PggD+I=3|)O&K60Az+hhG|D&@7RJNF>t%;fap=^nH&nuK~ z#SHwZY@t}aSGK^fn*}Sx650*8ufP-6GUK0ODp!t7sms+mWiV`WBf}(p+7l;u^smkq z_9vjTMNN?m;%o`mQcMNF=Vg()uq42 z8~rep`5q$Ilzu_*wz~?F{^TQYsuEK)ZXiSeEiFkxlfNx3OQ(uFj`1*!K@C9OEBHA9 z39PxDHobsM|I5wHN-Lr_v+l`H;|^{A$$!FBU0#FnPbgy_wnZ@4n5&(tl9NN*%rHU|m&^7d|uz)qhZBG~Es zK=$9AKG&1~+38czhkXrhE(|xq=yV2)AMp@8CLow+efzq3R=5fWSUM_ZZ0T1USx zK(nl!b_3?R!HeZX3XF6?h6n5o=S_hPOU!WUx+yz=DFCRrC)f5 zn5r%i#GHQS$x=`6^A!%L2D6|O-2a^gU3VaVQ|%@oje4k+p(1C8@NhoxF=ZR80>4@t zXZdBIqY?EL%>oxvljNC9t0lHaWP=g5e7I)-oHA7k1vD;Fj+-1b?$HCwQL0@(e=fS& z6esURv;eL%@xuq}6_>kHIwFycv(Ju4fPYoED6HNqT=bl$=4f6E*^Pesbv4B^a9{W1 z8DDC?c}lW#U-)xp3H#p)f9N6ZqYE6{@K%H9dh|ubfmp^@PDrE@dx9SjuzAmL9SqIX z1%W-?&K0~TBfc1rv?vv-kqbcyNTC#X*d<~9A4M3c3?5^lXf(wfn_9OSUu$a1TMKo- zU(agG+dX*stVWvawE<4QxK=RcQPS9)_?Lzup1ePzqq*<2J_x+iXgsS~Tn$Km z;!y;7@d))ON~>>_TZ92l58;aP@lMsJ4Xr~v_#iL82A4^hLzcMPlwviCQaa}D2$fS( z^bM)KJGo!eVf@*vhL&)X-Oubi|Nqn8+V;u0_h2U zarmPrs6N#!D5J@Xp>lNtTvD_rh=Hk6l_d}0b8+zVxkb0Y!>0pP|MoJMa2Py055`Mh z$Fx^HzNp$Rt-$p@&FZ4Bd@75KZfjjKYgX`yjaz2qWhHi19nB;Z_Ba1uENed<@SP8p zt~B>eJBo3eRIeuIT8lvw%!{=HG6%q~*iZmtups-1?m_aHRMxI(Uz7Q8Sb_M}`~Ccm zV!Wn{iR1hh{LG!8=H#hbShAS=yeTQB5VYj$E=b;#h8rS=vHf&LacWxrJ!r(nC)cBh zD{x_RSMA2}C9>)(GRgX4>4wLw+Q#FW^{)Fn9d-D-y7jIa6)`HN`#=}utET%!9d$Q1 z^`@I>J9q()Sl#Un{8?VNhym4nABF;_9DlyCzQpIjQLA8l8JNxxlJ`7sF()9M!I7aS zF<@~n0C;j!cvb~@Nm!oKq#Yr9*r@jlA36qfGpPvYRB2kyTA<_lA^0*Vx8^az z{Fdx8i^Y&23y^<6>r*slJv+ct4%%Wa25kAGd$saqad!gn#BMKb1BO3{CR`x;IiI6( z36Dlj>~2U+UH?P~DLMPGXc!p!l>el7-q1UlxS`gsDZCvYo=QdxxUkCTNL$8& zVim!;!?VwD$V`TFq|to_=siHC!4Gg9LIhlgP-<0?jUGl`SDX|Se?fw4=S335;ZxFq zCiDs0k0op9vCr0??!fR7=F9rWI046(P(hPan0mRAmPrMVv*V7 zE{HCS`1)nne61<=Y$+M%+|zgCOBrzXheL+h{aA<-y|X_X5>7=*lv>jkUd85)9jfse zSoRMmW{r5NUJ5VO+J;RUv$yAnN9wRMf0%gC!B#L*PMTPD zUGZlpaDUV9(|(YC8)XFkoqqofetl)*FeY}J9|>XhKVqMTs*)Abml%^DT*8||)Y3~O z@Mr|x$j)hSHX){xnv8lme- zw0+9Q#m^)e>hEEA5BLj)0ivs%T8MCTYhcc&hY#@&8lDh#%z4-PLmITpxRY}{$(-jk zy|c?WWdC88>1B3tq5Jq(6R|P)NS%;%$_2b|*6y3`vB*K(GKLdnF<2s^$@i&MNN9C_ z&KDuN5A9bG1}*TLhGA5Q{yVk0*4cne82W#kTV*8#f3H$@@sfh!=D9B&;Y~AS-b6+o zPB&ABdRuspz~Jg;h*5FSR&;m+TdA7ZNzXTX@lrra%%S_6HTtLPS6gZZP1u(@LTj`i zoZj*$olNAyQAlASb(AV}@|u%zSHOr9L28M&m30y4>PB)t4PWoCog_|Ag!8xhTkiFt z*^oIvyL4Jba1PM2=PB-vsKn^1YN*`4J=LFJdY*U>rodf>HCE$K*-TNn;(w57;o#2y zJ(=P^E&0z7YhloTfGI+>!=GRZ+-F$-lT4))Ki?G-31S%T51zk~R3w9n0;JR$QIS?z zY=?-y@HBguajV?LXHZ8E?hEU@A$a-(+UjP5oR=XkQJ;^ZJU0n<(|~T5wn3Tx*8Voi z7a}TK4?{K#5CnjNAQFBJA|A6^ZeD`Zcup!F@b-CPcLnOgk)806uR24=x4UoSRj83H zeRba?h`3bGJVC}>p+i5Zm-@>)Bl^J*L)7Rl&#L9Ave4QxXw?4vpFFEQ*>z6M! zqj^z|U3uu~52|z^9YxwO;Q#UX`TO?Si~iT`bH{c*z(eY*Rt(P#-1FHxnW!(K`hB1^ zdWVtoK>o$Q1zLeW60HcD>8CvE{{&jK^7dahwl-Y-8E6gsavx~L&nV*%(|JGi;xrE5 zYOPUw+O+!TD@#MZ^~LbK@+XK+G_A=&Z~iUNI+S1CtY>@W*_payyptn=xn?c*sJPt$ zKy9DySvUraV)qSca3N@l3>@=lDcSF&Bs9;|RQ>RA3L2KjpPDdg@IkJ02^Yv~WSx}# zP zZ4;@qcG}y^(UeN%d%kswZovF-r_8kzxG#Y#=D}QHn+<6u0{MB$d)M9%_cQgcGSvgB zn<^|&s`OXx6ruuLKi{HH#I;5T_0w48-zh|=Q2ohs56NW*WU-c3J(=Oavw{g}{?%3&)oLshPDLvL8;Ww1agL zEK(mdu=^rj$H0}{6tol|@9u8&Y1#R+V1_+8OC?4y5SH$L;N=ugNFzQ*{L!Gwq?o(` z7PHGk%;Y&9IyMii6%j7yKMqkR5rJZyzZ9bBdiH-RM1j8?qQ8k0$^F$mq#B7UuF7%# zNDOo8{@}i1C_cYS_gTioakLSGlKqAHTCTlYYzG)=#eY*W^bA{d)^6Rz{8+RF!v*p?uSC1XsDr4AYUh$z3hr%OGd{{bk(&v45YUBe4we}SJ26@h{Jrjk_`IR+{i*wm+t@^ z@^=JSq@TtXX0}bxj&$SKryU!jO*mv(sH`^@yYoLl!RV+iL@>I42oa1r%V|TfG;F>F zu;A+S1ydJ*v6)2)h54BkQS`86t6-KNR$#3eHH1e$sY|pA-y!O;sYVkXm-hGK4tQLA zW$mHeet1z67WT+qJ42w!@9TsV=1CrkQQU&$wR`(dl!o+p=^4Y%OAU6BH_S2dmDFdE zG0TB}K`DezcTU$<8G1G^shF$;0J-_v_kTg@9i852@9Zy16g}g$k6T98yqbaJVc$k7 z8{xtJ*q9=nue@<&D`X6FS4#KSi}=L<6GNo1bDgB6wLL&>ypKpcS&I3Sc7(ECD2~)? zZMI@&+jCL5bvuGCFJDofJ@9gh!i*^YD~EsW?snQDXan4}9RDdf#&rL6Jk>#Lrg%^8 z{@3yJb(T~b#6{}!q_svPQ{9qB;?70NA?H5TL>iKO+{*e_9(Je;BCh${TO+X10`O|+Au>ezSFt0E~T?66KSJMiMA$N$nRUCfJfh`yXl?I1N?MVmS zzWda3?Met=#n8xUejAL&KEK?T;}5s6&^tQYy;)_p5Z2=Rkq8E3i4*P&HeO5c`m|=B ze*%P;G2IV3-r@gz8+nuaUB=ksdvFEXZ!76;6Eh%O|E`?uRzY;<6s$Y?|8GzV;nnMg z7jtW9{Q14`ZzSD_(ts%@EiG0jOP4POQ;Qk%Ecp1F{hjf2>7!J9Mo+BkOw-WFy@H;j zdncJYhI0wrL+KrzUO&Ckv}ug+X1djPJOl2^k1n-~)VGoiMi-5pS5tUs-7f7Qlxjlg z6wqlRbW_+EK!g}e_w*kvWE6?KT7t%U7zXD++_QT6Hmyxh<2iq)d}q=^dS3`RveMe>f?zM7~qr0Kc6#^)K_mX^UOnRi&DGi1McB zt^QGyKsLcs_43?MtIweLhLRm3zG*C z%JWu`61aQ-7YkotfAyDf9yN+l@P9@P25i&$UW*JDpf%-}jzLP3ua}hzy#Vsc-6H-v zBpzwdZEB0uit$u2t5Ne<*Xft#N!}Y$md*GJy6O|t zRP;=v8J5OiQJ&3zXiNFu{HCFjDgS4`DVkl>sKURwaCVo8WiVLViP#`2oaP*vKU6p$ zh`yJ9*-NQalfJAwY@{s5Q1(j%AX&owZ2mEGA`&NVE`rz z`m5;tbM$(QZLbQY#8^w5d%>G*r_RD5jg2VL3n8j|D234J8d*OE^(w!$a)-h-3CXy9 zeiSIh(Mn#Eq6J<8w|L*khxY%YLphlAe|MYx@6&AfkpR@a>eNdsWr4r%vO6SQkS!H`kU$81s0C-JFN z4QyF0h>rEHV5^Tx)Q5S&SK|a_`H7c&s@~^}@lcq-iZTMq1WiJinUxgjsKttRXkMH$ z_46}=mlf%q0xSUYV}{Xs7KZ5*lld>s`twoFNU7p0#@_vG%tXQ9w?mAqN-G}~`?dz+ zR+c5Gi(e+QGN;a_I;Xmy3btxs{l?Nr>IOYmNsKp15Jiq%^ye?C{?w%oAB)Iet`mJF z>J^pHa`#EjXuXf#!ruN9y#+$^@-H}v26nDwa;Ck>|H6nd|X_ z@51=ZfzR}jkn+)axY0CAehTcE3iOS+lYI9y%gzNDy#?;GxAGN2!4D=`R1^gmO2I1S zjT7FF=3tBI{FHrv{&2AY=~9Jr6>+9mo11UOO3yiLYLsPz@i?C-b2)zZdB&rynC4Usrw0Imy>{q;fU>gH4NgB6Qe*QYoH={sW%Y2e+m1#eC{xNI?kPLM8#<%I$Ya{!1jC)acCE{R*; zBk@fcM>nGNZrP&ct1?m>9-+DN-KF$5mVT1xeoFBNmV#GPcN6{WaZ0zH3yS$5XtKJO zG1o-1$8Y+cK!m6?V9|1a?!IU_m2Ai;8uT(MedLd#CGdCCvZZ>W{P9mDjLxd;U*b8T zD$Ql`^IRSU7IHTe1q_l-&yLups7Bhhbrn2W#I3)s>iiwb#U^&8qqw){z!V_kqkGU$ zcK){KK;$`w@9yO}%S%xSs+sjXs`dmN)!UGj3qCJYW8m{uK-UAkFYPra0mp-Ao$9ws zDM2{T1)hImCw-J5#P;Uw_IcrtvZnR$mE zOo~Enm`-3mac1MXlGO%q`UohCNn<3+1%f=rW9r zFJw7z%}wNyx!b$Q{IE-w;m?fri@8Iw{kqUzs~YXuF2s#`UehgRTRrfw$jFS-OG^df zMqPSveccjPXWN)xbPoR<^=~&S-`BJzZBI5~h#M7fLiGMaj>_tJC(^O1zYpl1q7ifZ z{;_va?~6#dK!8%T@Vj%_S;p-=EBZI8Qhh!)L3^X(1gL?f%a=Z2>9Pgmze|^Vu78v+ z0Z8j|D(CAzcGOPF3+KeY?Wosz|7u5t98dp7)ueR6WeoPAgdXOb0kpDZY3y=_=fni;ynXg#Cr8}vQKyC` zPk`#w9@j+(t9rp<+}PH!ax#)TF&o+j;=XJ1o5~52#eTrX7o-kKcm70G|BnTFy%!bL z3#A@UnR2RA7C(4cGSP8+r^ab#5nW#L`84Q$_^PHu-is=?u}e9iy9SVq8*PxbQSD|X z904U`ziJbT zFK&~#klV|sHng}45%LHnWKfh5G^@^?Kvf+#MZPok+Daf4y^4@N>h>Ui&mp^uh)1JZ zpZ8|=`GvL%Ah{HgapCes9p+brvwIx)m*!X5ZO_r!87IB)-Es7sgggnwkA-NXKQQv4 zK8W}q(;1c0o!uGaOyRG%c7&nu6kyl$RU(-pN%dS{pXp#jEUV<&V0n|F!(~e7&a#^8 zyfJliY;{$DAM%%x2k_)~_#O4VOZr|YU@(2gK5NI?+SJ}$M^t7|f@=Cl%HvRDwuA-A z`u>Tk?IgxPFvzQap(=Py^{|8%S;eT$A*5`BwS>5Neue@EpX_We)4G6D0l*q(a-(Gj zRP)UL0PZrs7*x!NJo;^YH}^eG*}6Y^oCW5u?|rKtx9(VrGU?Z6p$s-nkPVG5me!3O z=Xk4H|MIfC+kY-*xu>DS#3Hpgg?T;Y@N+Vt#dY-8!znykc)yxzbxY3gB99UQn)Sz8 zpQdzh%%Q+R4QqlUv%0|gb9#@$vx>!u0KF$3+m;Ix5r@&lcIOy%ZFh?r-$!wo&*e6# zM^8Cc<|^Mxe5drNI2&J73)H*bycnMkRCE-Bs93!)dJ$>usTC8A>&)mNgqjP*nQ<>1>13>EcYFBlB!S zfo5-B#n~^&7b~157Igq%w&M7KBT7fm=SFT;5rVI;(*>qUh1NQ@>&(ikuLBc5I zb|~P2*Dw_bctrEyF3XDUTXrPa?O2Q6`T1lyoL^dZ((DNK*I z;cUm_d8e&JK$#lHp{K^gn0N^%vemfrn~xC7Ps;_#e_MXMCc+!Wkbe|iXyz+F&IU-; zKSSdaKQKSNEjx8+u=yocwFfveBUl-38QI7(AqbJaws_DIx1>2AGd4q*PaVvEa^m56 zbsC#N_bDRpEOp1+b?YNJX`O~j1YJNuMcy~=iE^Lp^dPt?@vNC)KCut$k49hF2bfJ- zM#`hDRyLj|N%uM>naAiSTf|uL&M^XQybIH^eCZY$$%;56?{-~>B>N5vDhV#DE5m+$ zGG|>$HOI1PPH-5IsWSE_WOJ~+$qgs9Uky9+jz99f>2dV2h-N9Mw+>F)Niv>}wK|%g zmbKT5t@%zeuGvKQeqJlw5e5fu2M|+N97@<~s z<<)MNoa4EoJ#^d=RY4**lKVvm2Q%maF+YUhh>?Fk7bb0~OVbD`$SD`_UK?K+sB2BN zH*nn7mQ32KMjl1&IN1U-FH~#wuT)3tw*$+1e)f9%L>$!ubW+Opqw6u(OW|upiw$~9 zZF0b`j{!wQ+Hxm#XDD;(Oih7bun6=B*Kf3h+tvuU;iPSZ*&4G$ z@UM?XLji$LrE0@fjZOo{neGRMWb5=FTEMGpr;>iFMk>u>uROSwdQQH8uV7U$ot)Gx zF|jSG+;OW|lL<|jrd+Xp$s)Rpy(~FHLl~=^yX)-c{SMD2gzo7$s+@5+13n8@rgmz; zjmx3-jG`pM3%a(BL%9)?D73m4-gvtimfP6T$s&(0xG>#tK7lw(*?O8t5KJ*9B5>gb2TLe(stB2|((Pz$Td!&gH9?Lo~3 z)6yIGl&l=mH^rAkL~sxDN&4kVmBE*sF7ACxh}01lIt-{DHn8h3r_4dA^d<&{!g&)|C9SGAuKwoWM?#RaGOfihX*BY#=ANn!#enAz> z=LmD;r3A*~264ZmrM}4J2D%H7y(-bAGJtfA!! z#S~l@NYd*bI_Nq^Ff@(1TmLv1lXDOE=(~K0w_@?ExV&yKpeWd`uXA>a+lW@KYqv@% z!Pz2Bz~LEp5{J9c!%MgJzOy)E8>ojG6#In@3b{ZX!|d@_{p&fSaDOg(oeHt?L^r=8 zS`IzYJ;tvQr-Lw0_L-Qw@=`9Dxm(4)NtY@*uf_Iipx@ePpeX1unNV+->RWy!T>16B z^(oJn+#Cf78}>Bw4%2T3Yr~kCc`x!Cuk1a7UWGXW7nkeavf)@&0#?&lHpXF3ytN-K z^^mIp54uPmOFhtF`!N8$gFnq&t!LF#7S{Tyw1!@9&OB79B)&XQf-Wm_t=4fm%k)Bd3vOr`%moO&)J1B0ZoUp7`{52X7Lsln?fHo=DMFK;>Vma zj)eA&u1P!@SN$@FHa@g1I6C%uE}oUY&OCC>;I(h`I?UvXIo)Mis$QJ-#qy!r^#kQl zm$Zn$3XKs*E|9ZNuY~JNw=HcP~MSQ`hhm-m$X$ zJK(TZYun+Q<y+k4unwFLCQgxppFi996;W$RoCv*h0nb zmVGgen7DzS;w&khMJkz{hHcOpS9s3GgoT@q?(NwMR;ef*2Rv%zCYyoL+&)*72L#4RHxuBhhLU78cU zDXhDBfs5_Y^P5*RD2@%0KPASbG*leIbcRlyqitI^wrtm*#7E7uGOjlHz|BV2r$b4` zP`oyNnZ2bD|9m7ddgigR?A{MT;dNgC0M$eD2!gr3Oyoz#ZQntitQlBSZBxb2NwHUJ z^2V*VkCjjGGF0vjp&x&5*eG9frJ`ncKq;m7>-d%c8E5H;zc+*G6;2rX_qT`avE0_N z&JmtFznlwvi3*NJ@Z6J#*I$tc$-7eY4ZM8-0x_1}&sWSxmzwnU*M%4dD&K+k$SPl! z=X~9v(TaDRbLeQs1QaJx!gq@OKbubS-r};Vv@2sNiAw+5%lIy17I$llH4NEl!*(nt z<>+!L^Y?Kh85GgVc$zX5_lmcnPZ^%vDw=;!I9GI$;vG)QT2;$y(SD1e`<>>TDTnBQ zhzKAmwtvZYrc(6TW}NC>=+A;1ei^X}J$arvXJ$)#ZiJVKg$v4Yp`GE^5$d8uYS)HF z*-8Bm4_%qWp35NdS5$mcd|bR+lEZ+OuNSe7Rh9j{u!Ez&zJ~wOh;qQbv0R~OBVxb% z$5d3Kis~T7O`e;#3q3)p=b?-vn%szAczPai`3)@4uqz-k<_?;yv-Mm`oM)>gu$=Kv zyx|=LiC)fU0qVPOue>DH-o`<@_O$ik3j9>F6%S_qm1q=n*5s8W$xAA|4|=M?ZTv6r zjT?y&;s^8OXW@V}(dNj>CvU|n$0ee1<0z7pru4d* z5ub^^8pvvM8fi?$>cP}_p%{3rfwu{mZZh^6*$hgQ9K~n9QQaMjcJ_AXQGV|=h`q8l z63rEHY8=D9JVfov*>1CclKZuG_(&^UNq2o@ZTyY9oRrUgf*IC#=z&rL#s$Hd)sb)0 zs}#+%+0?Bw+0@up$r*L#9M2lvW{!eZxhmdpuo5eKGl-0_@n^j!D}5ugeKP?CXbf4V z%n3GmdB9#jxIn8hB3Bm7@sx*7g%O7L={Xh2p<{R2b{)fjCWQO_T$QB?aXZ|)w~1C{ z46aJ^jsM(iM46x%P(5hVl`KDhVL3IUX=c=?YO?As&9?JKY1!O0-V-lPkHqtE6=C4L z`47DfbzS@y=aO_LlAnV@!tnd~|K-_NOQd(8)7cReJyB0pW>3F1A1zn`RdI2(_}Q#tgeQF9t+yu$jS+o25%w>Eqm9`l zxjxPq-as35X!n66B^x&Sn>`}iZ$WR8l6{X1XY00En!WI*jOVwDavAFBpoc3LqdAwc z`ytOgoa1zq>HNv!0IA@|TR8PO$zIBvx8ai~;wW8hQN)H_c8!X_kLH@yq%b z#X=`ZL_bqnt^tN_w@I&GD|P&WfHbPRdwz1m+@RY$!CWd+_^`xHt^&an{b;oFES2}F z=1p-~-c~nt47r!tEl? zVu9v*@udm!rU!5oh$5K&Tb4w zJx}dNbQrz4wLvmt&^0jA!v#l({iRR5y9}l z3@`i7#+%Er99hD`DZNsXE066PI_Sp#?P=oLD;%1a{4!`0qg?TLBi8~@}Ir;fSLH~@j%y>8c_SOcF<{c zHuC+YtwA`G`~g=$#QGs&o1E5`L@`1&;oWmlQmtvA@c%LQ7EpO5S=(rE3$6+7!2<+$ z4-nj4gS-2I;O>y%?ykWJ!QEYhJ3)irmvpDQXQscI`PRMnU;la*n_BhOIaPJ4>YTlw zU9vX_dvR7;Ko;=+rMoRLZ8Wa1BE)Wcos`>6P4dnpP+szxIt^Z>SDXvkX*NlDzlaf$Y1Cbe`1M=^PEMUo+ZeI^lhtPTg0PLt|f04@gXqp!( zT|>^<@S)bo{#M!#$%?_Uc=Zyvc$b0+D+Eyh{yVHi|~^n?4w`%;V|X~ww?Pv5ADei4%IhJO+N(dZlC=P$nCRel*dI!g)47?9u<}- zt17dMyU8rQMf54A8mMi^cSBlkLwy>`;bwV;X>VDIFT73XhvrY6qw`#asDk9(HWkbJ z0`6~kFO8>)!4$Tp-uppb`sXRWsfOJ5s9NQ8^VM>5TU}SfPwRD(qrm>joUQDF)d-9F;EzE& z`ZXg^0OY_uKY@jj0YV4rtrb$$bHcJnT?gK7q+=XYGprnDm;~bsw`cwWz=|g^?D?$d zS&ZzZr%k;te7@&KAGMLc z35&=SYA2&4TX)}c8I$3=|8W)j${o{lKXhADXP%PpGCGX}r=)|*gd3A01=EbA^|^?1 zJTjUWDpXJZ{VrUX!;-eJ(j7y*#>)(138my#WCcZfxwJ{kEL-vTo3tLbk4D7XLF4j6 zCyH1=p&b~yTt8;fPC47i6kWVSlrNJe_am97=v+lIv&nbqn`wHvYjKRK^gfJ*R14ea zud0F>t37X4T?sQFgVjaR-Zq8B35`@XI7slFt8-j&SY^djqAs;VtJ` zZ+ov~PR=OS@fp2HizIAK)GUc*yhZ)ce|D-L2;x+x(fFWN%1Ux>#zOaF(d_;FrrFf@ z(u3y)wV)#_QCC$+NKu-bXHNwNKuc^rqy20~VZ?VhTEztC&p6!P{3wr>eSVE&$+9wV zMaxj9xOxg&V@t?GI!wn9#$MYzo7KAco*cKPx#Z1<1Z;JX-7QAP5U0OtgQThLL9GYD z2^hInUNjFNgfEq1Sz!u*Ojw>LTh`s-t;{gD+Hz>tAal>gn@|%mWw9N!7zrJ?$Q3*N zrqX~lO06}ua_J_D%3xpws?1ewn%KE5##$tPs$SQY^=u}yDvIc$)HK|ua-~t122Fh< ze*D0~ih`;rY&q(sVc+~nQrtHd>upDXvhY-L2|JKZ=6(`;x2KuUQ16KKOrq(wWM}?u zkHtYtsgTpD!<`pb?Wb*u8w0lNb+rj>;mQ%Q!LW2S3K;%qa(~nYE z!7j1mO6I}~ea<^>@@GnrAPd&@k+uTu_|&chzVR`O)WUC&j3z$Nt086cgdq{AMY-6t zQ_gC|x>PRE<1M3Dtor&X+HR6p{@`>rtC3oj!l+@RsW3h!n$G!#UTk=h$&U$ z(Ng1Rp%u=OXc74%*>_7vfcV(J%w4PmTRkH>ktVJFnKoOY(i|?ZCq-Sq9$0cepx1EJp9Jof`ux!;Eg^gG(kTv3b)O+9P4b-{f_P3hss8A$& zUEe9SflXzn6>R8RCY&#YFI%}P!`{44@=cgsW2xPazr!+wQDBPEj;{=v0bY^EcI~?Mo_c*=U9P{*=avnz_*8{5jd(%l60?ad zw7TuNyF?x|SlNVF9lL||h2$W29rydsk+$W8*K$XQoj{6TI4NP_`#kd_fG{@vD}x~u zVDlsV9dtxnOkaoAu^}tkg}ib+z9IIxr}kz_1?R2iO$Y_K%kzP224Wv)^5a+hF}bj+ zbE8!5aTE~_#_yeB+lNrITh*Y$cj z{9lXR38+KhE+XSD1#@m`NVbw#M}WV#U!P1{0A$-ULMd$9sVL~Y|gHTp$#8EyXrBa^)>cfZ=+z3*DfHCR|*4Ma_>y7G3=CA{$Y2D;(6;x?TZn6MbC9~ zJ$CQfQ6@z+xaLM~Mr`NBX4fyQuNRRz0crsCy>}riAm4-1m$;f3KUyI(Eb{5N+h?nq zI?fsF6BHA|Z?^0T^{4p4v!_w~V}W<;bvoSJS>@P{TXbXl%E`xZfGq!ey38Z!`& z`B*HkhZU_i+stJdKckn^BX8&KT`Zec*`+V;ByDVtprhsCZHKV*=WVCe+Nz zsM70gOe{vx@n;zPcx2Nvcm@8nWpBxqjEsGU{S*UfcbEuqVZ5Sas&`+f)mWSOF$pV2 zOzHy(T{rWb2+W@rndNC)whBK@aXG$U)?Go0S6{96<7jl)4BznlL@veQ(3gf-soCsF zU1Ig-UU?%!mH=SIMviXxj6*@j@v`x_qc*5I{;om=&C+Xl!Koe#_eJ&8 zoGW2$Sks)M>p~huhX0NV%PqjK>(-J2NVo@LRtv&crCf#nbETa7v{;WgpxEsf| zw=2Y$1IH6Z^|z^?U)Q1(uUx#qTTsc5FqO$URxA9r-Su8wSWX6S1FRQ-h=Q?B46i%| zFL8TOtWeU+(%ev&HIRw~VJgFjCE^BQ0M-ru%a%oH6TN%+8t=O~zbpu&$A}-OUz;$* zPB>%(I9#pGjWs!h8y}1JT$I;ha}s6k;XY_hm~|th&i?38kg6ejB|yoO~n;PnkcxdOI%VT?pS@Hy%^=r|o>=`;S*vT+eMX zx}09PG?^E{Gf42)l)B_fHGocoL#5!$sZ8g*T7r3-)cR2b&v^?=U!LO1NRuQxnwFsl z0!%enkkixu)zU~@y^JHJF=xIajW${bXnJ3GwFFbT)9UBzGGr8VA)S>y z*foKj>6YBf(rU_+h*kVAziioSmfmtOA6RhI-)z|xTp#vtU!s)^<|hN{fywtAWrS^~ zqD5<$arKX7z%9G93G;`gn#VRx@Z^w0oP`;v7)m%Ey@5~n!2C`3BJ}2jv}GylJ)elS z(UP@m;S4k&T4T?KELB(j$jed`E4qJ~XaUov)5Is?ZT&ys_!!ZH=8X&5c6AE5l4a1% zd;GfTA+(lF%QhX2Ze_TSvDKp0?ov~t3uLHORxhf}o#2R+aVzmfi5K?5lG592e<2+L z6@ZN)lI#};h zx3(s%ZL!O~^ArE`m|=$XC? zk_*(I?{#?4jiEY5pRADIz^;I5Obx#BC!p6f5J`qa*EVt5QroS1YQQtJe8wHU)Bl7H z@m&s$$!%p}3M1!MCMOFqplI6KR`0@3laxn`#kXDjq1nGcn2BJlV+Q~-R7-W6a(KaC z%d`~=o4B3cWT~oe8@qcmzGnT2ONiHXoqbJ3?t5(G-<1$^l1pB`;;S{mxe~5@Zux}+ zOu;@;+x|2`DLaYk6Q%r+8INv~Q+3^)R*vbiEPPg+Hpi5C6`iB}# z$1}4qez!dNN8HD*wuK@mp=>LjeEK3c(rDS#tCBdy39J#ji?fRsy6#p8jo$C{7K~e| zvm}#E;<-9v5%NpzNK@N_p9!kUbFrtzVd?qi_cSNa(ju79EC@e2iCy8q!{p7NBGtsh-zASf3Y+ zpsefq7+5FL3uZmf!M2n@Y}PwFbe%8iHkm5)4cTlQ_l9N#wNa^~;=pw(nFm_;(=I9bbA)LS7(Hs4`@`8uE}(l#$~KnR#V88S2Qx;eKQM-0?RC4+EvEVD_u*hw~e@Lz#v@hcH05(!x4$Fisr7PX)hIG^$BPtcwhPDE`BUHQ57|3P zlH+e=JjWj46Hk|8J=l7#-W=OnE2-#(=6_(!)a68}p}Fxo0p-;X#-VxugE0X+Jn9R# zxLD+tIHL`_%s15aPx5fMqp?N@L9DH@>sm~tQa+d*x{527n!uF0_+a$wBR{i5ScA{e zNk-ug<;w2FPPI%~5mWsMy2{1jur2CR2)y;`pPU-h9X)8czN#LcZ|Fn*i0_4kWMHWC z7(E3|N!B4F#yb~4bBj0zqN6T7A_x#4%*il>cttgau1YdPk^fTkss83K}>U`)i2&=8FXx zvIO|!vCJ|FS6Q#l1{pbqNamxbP#gVn##K7j>r-Z}iuHZ~;wmoF#S>-X7T;Fveay8J z9DA3_H#FqlU(l(h4Ba^v(2~9NG*>s!J*cOj4e`Tr&3(g_oGczfoz0d5tyXneO_A#| zwBWiVUUVma)ulI}z;_{X!+4CW_OWTGdHjf%rjd1=5!c;%KPr_Qzima@a;qWuVRmT8 zW%?XS?%)g+U|u&)=mV2A4DPJI6wN&m2HoAki^Qr#}G z%!g3Y+0=|z{Nbo=2Nsu@xldv<6Xb;DxEpv+C+yjf5?@g6--2oOF|ru0{=g^knu^(R6{cI2;ps;nn+cOb)W3AsCVvF4~^Wu`B z$cTutrm8h%ICmCmaPs)#+TzHpV@h59av~UZv6yuoW$aeZ!dTrQAF5q$O_NI3pg*=} z`$}gFmk_%Ddv;2c3#W6&2VT|#L;NtF_t9Z%`&o^H+WVXphuohxc7kby*%r~i82et- zbK>^j0hPvOv@n6?)`Fhb!qf!G1hRZD-fWx2_Rp1Z&n)(D#19?Xtqlg?J6pWS*9@Lj z5FX4ClA@AKwq~`J)_PVWP|MID)3#F1;E{k>-)b`#;I`y?I0+=x71XDT{`fAanJ3BL zEnZzFYAo+icpS1%a_`PCFDcENv+0^rQ!XIm0k~HxzS^#pLy}!)%wEWkXRRlr;f!aA z#h1n3#}6Zzj+Ts73(ywf@IA!~QE}gK<6x&dD}TeT;p=rIK?VD8*BpDC|3onwJChT!UAo}^erRB<5(k{h3v0{>M*<)+gXQG!e8-LRu#(K zV?|!s8Zi(9!)DPBH`=mU;gd9EUqoo~lmIb$j|mIRQ!mw}jQkZ74MX|S=WWU=jPK>% zkEu`0VI+x6WS;+k8QH)S!h`vyfV+)TO)aw5Zydk#nybL`2jEWPHyzr;L6ti&}x*xVrW?vK3H2Ate*H!cz>%CCJ# z7i%t!H}YMf@0n-5cwm&?PoV}y>JLOtoS)-_QL-Xq+PcC#ue_R(>(??SYO&B*5in{U0JgXCw8L zKft1DciSt;E@adRSo+RG*CLwXPO=tQ{+oz1mLAUOUh3_16HKNhKi+BwFXc-p_`5#jK z!+ijHqua+1f4wvCpYsB!jc$+sbF#mtxJ(b5^Fsc&rT@KLz@Ie+)#nhz?|N+x)`gD# z`(gJ_19OEl@_wzD&mHoA9H;+u!PC$NR=6)=PJsVvnE$%`ws^Dh@q@>I`EvN}s(Yog zSzyb<0>cCHsl)wKF97}}=4Zs=alq)qemW=PKd1luCe9XPg(ulrI$du z_vi!Mi@y$u|9IIg4P^~xHr<1>iT#j48{a*rwEzb?{8T7 z2IPp-a%2|UC?H4PNMI&;E5mZy*DL5`CVUP)S63u^!35t6e7Vy!yw#o#C#~8B&0^Xo zcQ=>_)}g+NH&{yRnaD zls947MEL@!WkL}<|IR2qAZzfWB(+^I$=5cUoS=wvi*+%Nus(YRQ#BKUl+0^B0CHOc zX%uqyCWSEtZe;`&hSljTPY$>1N)Gkohln;j*f|^9nB=<}w6e@N5bR>66)+q!ad8Gta zz5Cn?yF18kKn0pim@!ua<5A_QT}ZK#aMwdcCt|xFBj}YKA~_h7KjYW5O3algI7}VM zG>v$e{jTupq+&s${8~y_gY&+^DM0I`{!Y0gmz1`aIvb;N>of&+y3K{A9x{}!`Ysbi z)_#bjBcMR|=;>U`n!IVeG=dRrKf1L}_yg5>x<(`(EBqCqMYw7qoO?(Mf%rm&wLn>m z&>YN5wvM7ENU#-H#O^C%vfA<(zX1l}`-rI*xlL<@k_%b3hz&JXwSnJIqLrcem<%I9 z`+-lCt;buT20+ffEhUQ87^JIwX(Qew-Zdc{`VG))FYuNF%LW%EkCFrP1iyhihuev* z&y#7l_u%91*$8kO?WD!}-~+4Yb~)cK<2^*W6@VD3iIbDmH6v~y&#dVsC__!I>?T=G zoLb$aDVX=2YZ4p`g(^vyqNy%Dr^iDXTR`OrG(Uo zFET(yDc8LX=Os9t5Tneyf*wZ($9sy*nR0e!PCgrAiK8Q|U1;oWl92<$c0y^ThZxW_ z5f_97WcTcv>&8KS>!mGWCHmDqkATOd#_O2^jipb_G9LMu*N-|?Fuap`25#aC0CyJ9 zjd^i|l$AKgez;}aa|IW0s2w0h8n%A|`2j$L#D%TvL9sYswRvr=yWHOF;|g&Gy@fca z@$Br<%1%ZmA$>1OeOTUBwdeuoR6sB+_|2LKF0o!P1Uqev83&$~YjOpSZglDu7ySyQ z_t00Lp$$3`_h+lntI%^0?XUktI>J|!P|$s~8~waGLdB;T2#oxmW#ZnfC$tZxSt4Kx_|cZ7t#@Q_sA4DWD4GkrMnLl zz9e?00qnyX>Be@&?BHF>z6`k}Jf~~V`^I490&7K)tEG0C@Bw#U^@9M4J45;Kw>Lqw zvc4jB2?h4{-sIcDhY2ZsT&Y;B`_d#gp4yzHjA?^=l0rshTY+T}q0nSjTs7Hclt~oY zYr6Sw-)X2^loB-NxW}8{(9M-Q4ogoBn`a&I^8zN51Lei!z+Vkd6ZD7>8uU zi#s;82xlz)ITf-Kb(%@!P7$?jsV*;iG)rIZo%hWm>Ffr0lob0WUvLzS-;cY(^$oq| zsNL}_vK;e#vn?sADQj*DBOu+0-2f|XrQhtu`YML@#iqVgfe-409Qu3v^I{yBZ>HSp zz$x%tkQc^&`fhe?qAd%0bN+)`lw!|r`B_C~ex29uXYQCNF^=hIb5c((2hW3y8A|Q} zkq;jk&Ohx2j9^&OXhRq^6|3J2`ixDx7K=@mjzn`cuyiCPb%d}QH*Bkt7B9oqg}nz_+X_8R9?J(1-fM4-@a$DpPe;2?PmJR%$gVdu39-07 zpfIz9yZaoSi;=W_xfdb5Z&vpz%}XAt$90A2Dq+ykSiv%FGr&njCPLMI5Le%69_IN# zbOkLi`KrO>lrS1aSP%tHfDF>r5!RjPz^4MHg8v5a?NZLS0}>aLjiVJn zMe6;qQ1rQXG`!$WNZ>MgN2u#P02OTYc58K54S(kK&3a&*SPz-{K>L)C%9}>KcE_dS zw|w2yyAXc!s-+LqP2@MwuDytZ?#Nq887fmhTq9rdwYNT@7aS4~8U)dB!VHVa9|GZo ze~J^Dg6|NbP+{-@4yGZxH}B6k&m80`hwM5Gi`U-?{t6#mp>V=~7^6Q^wnMXcJ+pdd z6~*)HIm93EeaTnw{g>d6eZuS#vNzoC2>$hRqKQ2*4gg9@1Z#Fjg!bVrED3RMvCu4p z9`nWuJOR&?O^04drSF%5M7G=86Jd?*LXHm zA)J{7=>H--$wgA9DK^+>S|0OgJKz3*_NwF}Ws?)1A<3hE9wNz;@mcXiDzh1*U()k< zGZ(zgv!{&a28^1+*NjjQXd;P@+J2H<~VZWe$ zAcYizjX)tUmaT%1f+jD1X8z1P>ipR`_#ZgM%*MvZ6Vxjz&wh=0LKgB4ObQ$X5`Thc z=)aJgBP#))n+V}Vj1T-4&Oyl*41;H+HsmHD^7qC7mxp~z{1gZg%{2KbCTHZ{>{-8h z33Y$~Lg?MQcD*<`XjxGXs<>D|jzUkhqzyUDcv(;QseD<_J&khSO^$DiSg9)UjxX^Q z2K!x6xb}4PuITr4eDJ_IAnjl`Pp`Plb;H560nLW_X4yLcRRrc9!PiC zOOylRS)s{6@L7Q&+NYjFCh@E1JpIo|!YVS&{9V{kJOS+#jOS0t86!B>$^IwdLo+$| zvw;EO@+k6PSxiACSS4abe_2dwn@n)*CoyxS?X&-w0gf%p_yjvnu(&74`5<6^mi-qI zj9$Om(Tor_({}%yn8w9VpiueULO934FQrG9tivOMzd=(4?fh5zKXaD-h~VEK`!Q5vBEQ@3>dx6)8RHDx5DEklD?VA;CuG@s7bhaS5)&ul zxe~)0?ORf7QjCRWCsztntzIiny%&th7eaUOb8H2^U?WVJmL3W z|4jEY6vghNuT2#ARJT7G(@@U4OCS-|g&0d2CGgc2)G|slafquPGS;k6MW8P77f_=L zGcsVD2{JM~HRhkqneh>O6=@YI#5MCH_U{6$3LFHIdcs#&PZ;B9S87*EL~`H%71pe#gHtIL4;pNa0*PYAI~GI-iehP@TL*xPUrjy(UzasXcTkK5`iH z#|sVSd~MFQY*@{UEw`JWyORPw`E~vfgSXhBCOdjXMcR=DxYJxPrxPYG=?aO`{oGX8 zU@bBwWzcR`o{qsK=?-U~T$74ORV=Z1wMaooTddJNraaqvyO(N1+HkA?LIn|*JHeSs z1+dyU+|-3uZ12Ihod3{TizHV#K1&6)xm zZz@pE6X&Ox#rO^GabPM>i1vWh4B6B9TEH8&_umLm_jdFDy`TRPC`OA9lyk*-5MH}sj7Zz8cLF%HJ_4=9ktu!4#N-D(#Za02Kb zKp(lp6L(@7R@5zlk1(#QL0d#gz9vXn90lBAM96kue$NkQ2O~c4={x2lRVntu2J;Dh zf$h0Jb4)z(AclVuu)seT`Kjzx)W2>LAJ~@F{}m9})FaaWD-;PtH}(Eb{P9KqRhbPD z?=sNkf0tH~09pVO_Nji<$m=C;qkg~DuX7Ff$3j8@uxCVrzT7s#_9#OFZ(zpoKzECR zX;=l-xc_Sb_j8Ak{;%zMPngYq{@X`;Lugh0@ALfIg8$P;_U9N^i~s%pVL<;^9jVQ= zwiGYn|KA?O-#&-m3y`?uL5%iCoBdz&II>P(qcHvz)X3SVum4W`MbrDOU!0Qg&t&|4 zT54opB1i$y7P)vAsaH0?f?Lh4cFs9LtwOWsl4?j)%n$ye3f}9fmeeaQS-F@LO6XX9Ag93b{Vi zbLFjpmr$<=4?1m!I5KdQKlfXbmUw7*hYPKDDtUEUQfG9BTT{c*a6(Af z0z#8r7J@#g&)t4`DvT=_Zs7_RqGPt zNQi+~R}`)kISh1|w^tk9Ui_^{`AORTn#%g=jGj^hCb_0xB&|}70mB=6V^!N*lxlZ} zuib3<_^hjRhb#N}vqxk|x9d2eQF?4l5}aBCee_-P{R?$g7dlFMs_PEc!$I!FG~sQ2 zBWTWA{tM_A-ZbnHTAo3Un{%5=6g}fDv5Dt0$@CBF#1=nZ)xs(?rEft|Ss;~%i<$1yVjw}El-XF#FKemzd~J^>o&&-p`qSDBT@G?K?Jf`f~JX{LRl>AGFW=? z3_#j}e6--rP5;!kVt7>36mM=w^v*dc2Nd_r>Xx8n0G2MPWT-EJ12{VQAv~@cd|J3_ zsIKfY6NY1{)&8CFW5>RnHKMat!dqruQG1_F+9`ws zohC1YCpu{WyaNo-kw{7_dzs9NU;sDsQsI25)Fgf{Ot{;%BTJ9OV5@|fML-=RA^!Fp z*-)4gChN{7cDY~}M?-nCvgToN_`yj9PeaX76`WT3H_H#<$uVv8Byv_LJn2So;a?sJneW2YdMg9!Tp+=A3RfDw7$S8m|#z_So+o z30Ti3ry20S21D`mS4L>!?k;5R8^GMp``sDkUaiFW7u*CfI2mtHQ17Z6qEfu+qQR!o zUmo9~1}i9(!>T#B*V$c(WY^a(bd%poa= zAJ$1ydS2KjLF}{OcwW!n)V;keFwKcoWqu^1b3lE)ZgS24%PRbLMqxy)OL4ep>fR|3 ziZn~~hmP^rz*OQAMkjaq_xqVNb6Hj6>~Ba$7Jd-JC9@#1V;@9zkiM{=6zX!fg+p6{ zg!;f`423Mla36KLQzmTwLfB;|L^Kg1yv!YQw?~!y`WPY5$@Lf6VTeTLfsCds`vc^Y z%?GYtK9j*6^bYd*2iV>~dtb77+yoq6LdVsRbty&feaovVNH_ySJ9g8J&1ZUJD8bT>Ao^ zZ&AwE=J9Q0psAG09hYC1Us<-&SI=tbq=wNX8A*uU%uEioi7xF8r?`IODg}BUA7gk< zGLdj6Lep;6QSX_{8l0U`T2OjS+4y?A(rEYx2#(MI$`w zZI=%vmUyiM62KPhqiRyo>$KO*&>|kpRr*|aTl&AWM7Hs-9t1rFnxq~ArxYx?mWsHv z?1_8yvycYn!`bFaMuZh_OsP2YpIuZqaruu>;~$!AT*WIa!Sl^rsw2q3nOBmK;Q&Wg zW=9%wjuSW)^ZS%t!{gc=ixif|Lj6T(S3LE7FavuDwl$b_$E|LZi*JuwRlAkGLPu_D z^~Zx&ua&jvwS3VE3)8j?+YH z!aQfUvIDlfp7=i%6BFd|FVRRytC8%; z-?-T^o~>nDGY)v1dSP#~y=GY~?7i9aQ&)kMA^y7}s@dzv;ZJRUD1;il~-|v5F zX|ciu^B%S&8kmZ7b^1Xi3c(rQj3bknwz^5MLZY+xXTt7WCwLk{-w zFoumw!+0<64YE9_3Lv-=}IOF>P3{w@WjCt}P`W%a5f*y4*E z>MHaX#1FW_9c)4TC_Y5so(?Zh+XXgSc%sGpGDOp-oiv1c8{(Uf7r7;7ht^8pq#P_s zFs&{&gI4WR_uL?jZ>dm{sfs@eH8guw0?H#I8Y&i4Q?(UtRloq;X+6-&G8nZ@A*{yq z+L-)GgS!8Y&kp<|^uglCpbj{}usaDc3q|wAfe-8PJKZt19FK6@=U}PeKS5#-<&F6S zkc!g0qQ4b#ccfiqe8Y@D5r%0>WA6qqF zp__B>-S0um$U5}^JOfmw15r`&d~=SuTvZL%h3V3VV(RDSDMv#uY^@!0zbBrkeJd-r zanB;Kf$FI&My@R5Zffq|P;GQRjd?Jg=mNO?5D9a!06nv-iDn}IApyU>O#}{$j+eKn zD+h|$F2h&BshgM3St|+R6`uxYbp_uQ^X1r03KMG(f8$zk2^X{#@z)d-Hb*HHsDU1P`FmiykEG;ub0k)aTK=t$ zPQy(~5vpDNe7+(hTB;XWzW4UaMNN~wQE&@GQ`=ErY2BqY;g1CP^;- zzNsVutz~-}JPrZWtC7ZeTuM!~!Hp2t8FCD5Wm~Gjb1J(*L!+!)+3VcNIiD(vI-pzb zz9|JUQeHVugcN($M&lFIQ6^4nv1aZoG)q<3D#%AFUsysqoBZKhK{5oITOF7jJ@^N@ zl2)Cym?b7e=X`a#*iqQV%A-c~H0`CtWFA9a#+f4+3CQE;w+(*{NSnXOHDIsI_^V$< zCpl`R&#SfK;wXay1u`et3x+<&V5c*PNnvTWVh3r5>)=lAXoyvnDb$FTFp#>m|7v8bp_w zd@po$afZHO_g2g~(CqY%*eGVP3oXJ$G`d>AM$_+%ofLEcUkh~hZ~hfRmT(6&^R4t8 ze|m5uJUYU+eEj6bvWG$@DrBeM1B;@{62<_0pU#FLb=Avq*>BG*-##eKw^w3W*Nzn^ zXnBo+;r@lJ{tJD5Q+oAytb8kpFwEvWGTnL&hGfeQn@ zKvr@Fzs+{Z>e@~&p*+D-ya}BzEV9V>!t^PB9tq=(#pZUp}StzFv5RD00xp z?^vJ%9v(C+z~M#?V%605#b1rmr?B+Ov(bkDnU#vAW$&1ToX^zqT8oNUQ+B-k9ZM@e z-Px?a+}Sgie|2Z4YrUl5Cu30k>B@Gp$VQeM!Bhw2qVnUVjYv2#NvBOou9l|eEfUfl z`Oaq9=6~~KZ%O&Gn}p{QC|@o@c1Xl=)EJYaCwLAO_<4r6l7T#+snspxHfRAfea}AF zk{|QHLZyth%%NTqSjF$$kZ7|Ip6B`;d?lg@5Axli-+JFgtUaDu36-XO+l&CAJkx3o zXi6z?9Ba_)xQj|UgdgNAqFgn-S%FJ={X$vc>?m!YQbc^fQH$D0s4@4)wvj$k(!$2V z;9i0`IrJ@LFb3rW6n_Cq3Pwe4-(B-Q#4}%2T^q_*P6lQM(#g0<{Zh{_X^**c4FJ@$sFP|DPEhZi%8O}~ho-6?qb_J?_pFYxE>B1fx!m{i%Ajv#A zuRaiYJQq+^9OBnL$2CU!jpF<1$C6g{GXH0_EVok~_#gDLUuqe3p!6~1c7z|)YyG;+D&bk3bmKjQ?_n5yM@F0l6tWvu*totbDXp_V~OJN>t119s?}6#SwoZoqa0<- zQFpS%v}?BnADzfHMh3yORsM_;~GvwgjE7Hm7JE zVk`Oy*Bkfr!`8ZHpB17n2H;9F6m0}Y;N;<4NyM*_l*GKMd)i~5RTa0BIQY9PNuP~2 zAR0E@FpePcb(!$z$6y;=6VPwYS#ATPOXbzsJ>{?7mP>**oN7Q5|3&*0nf#)CLgd`y zc>G^N)Fg&z|CRQc_VoCj_AwWO{*(5>p9Il9qE`P%`>YRvXrHJI5baZZ03%`h2kQg; zSF}$cy24**pFs5T4gB1Zzo&inr^^2e+UJS&F-R|D`~svG!PQ)Ugv9a`>Yu^sK^dj` z4NNM}RKY-qZUAq;r86pcwUL^93e2R>0o!>nzu70pIG4k-f%w zO;fGINotsKqsq0uHH`b$SA>TM*}SO@rZWo-`(6~jO>$>A)pNroY@rd3)7|Sfkx2ce zHxOk2NWY@P$BpamuM}ud=AFlm#Eq-@(gZ_pdD)&J>|u;sF88XeAWAamiRSr(?+Kb- zclT*j(iK<)kCgKgD*v3*;{Pj_^1Uz|H9KjixtOz_Hzs=3B;;8uFpehS6-z;bQ+GsDwqxE>K}d%M z`@wm^D(tgV`aAnYty4nA1>nGgi&3LOtwwSIR}}Kgi_?9xi1?45@e#AnEe&`%hpWYt zUKCSXj1Dkp`{UT#>9Cc4o>#%0Thnv5GhKR*-pJdv0Ex>+eqo}tB5D(u;DoXP+8Z=< zb%VcqUy@Rx2c|}|1kP)QCHswK9B7lOFbG@pd-!X-Zk8E`^YiiofrdIj7mIAl_GX{k zVyCcFhcf^j!7a`JzkzkUUTCHV>82L$dPw59jS4~T0#)Z=xK~PXytbF*ok@ray>e%B z?nv$%Ml;ZcIxM==wdUSxv_DWC&DCwrb_J#<71e7vnjlD~dyAYuSWBde74;jYZNh*Y zOo?s6%|+hfmo-^nAN%|O+N_m9?(f1{tPVPSd;;`=4i3%*6eEQC6n$E>YeB{s9Jr7@ zBJ7dO-`>DXo4>v}t-Y{}zLcAIOId03G;M`Mw|nf==Nv-O4tk2$&q;)Y5Ga7(HG8py z`ZguB!2kUtJUP;6z=lpPBA)qoW!!MisZDJB3V}a-6u=)LP@tHhi7Lodd;PYYXC|X! zShNd&a26IOMXgfFHhKnE?plm#s~|As>KhtaBOE-W^DsO?g!T>b=9pISG*i&YC}uc4 z%uB5+>hZ`*iPIHqq{CD7dnG5ybHvkLyth9H$VxI!ZYN~&|AFxV{-AySk5NAV!1w_F zJIbfx%BEO&2K#%_bp`{XAtAJysW6_fGa~~H()XC7FuIfT`E4znipERNb+e>?*A=_# zd1m!2b3@9_fX^$r*V3zgeHBSb&R3dzR1)fC`|^yqz&KqO9~-*;=px06k#fBz4dX23 z+Z^^!^v?wSS984Sq_(!T2%q6}g8Om_P_1n>6$WO~y>KDM-N>)jh@CtR-zneQe)4-( z-dS0rS1(M`4wMErhOaE=Bwty0-zeSd88uj<^AP_~MKwyqm2_}1#Z6$bEx)?GpzLiU zp48+8IEi@!@7QG`Mt4Ch$hxEcBo0ZM%IMtsK{Oi@B23!Jt2NpEaXDmN4d@i#k-K7To?z7xUW%HYIezL| zzA3u%Hc6t|zSU7+dwl6w%w@k7d|X5F_$YbV9>{6&j=^m&QtW)>GqAP1BycW>m%ns} zck6jn%$SlO)I~DbY0&^90ti4UEeAx!owlgYL&Gkp2ejF@&tnKf8%S9c6jo& z4>K$OmEtP0l2*)X#PljVtOf0+G_5c4)+MIFQGWdmG`K?f3hfFPYyRy3=USTL$zh0t^bXN9!OcW)?KV)P1M4{N%u$~oG4mi`ptWO{ZVT8_IovmwMwAlwQ$@MS!`-? z#X{szeO|CFJ;~gLT#L6oG2>%`{L`U^58&;tK6?l{BO3ONO+?|n!KxmlJa)GAf>8LH z8d9PoZ33110o_eHN}?BCyx+Ni^E8(ARs&ZyR3lbgfk$4c_&i=B z0&ZF{o9~C?-=0$IV07^1H7bg5Wmu1Bju~_*gpFq(092DW87+$EoVuA9r^A61=vQG= zl}GFAw5T+?6-+u@O#Iinlo95`U|kh^8CJM@EOrnUcrV*Baf!f7@H`$0URqlzfcZmu zDhQ~)=aUV=4Y487uu+8kEMVii3LSldNP;3v6vR)M8o+IX;%Y6kfl6F3mS4Lxjbdj- ze$18f5kPaYccDR~bgz$j&Yt1|+M>g=uGP2ZdI}CsdHhk9zFg-Zeae1p8dIa(i>@T? zV8!mkU8yx9^F{-lT*C7~wZ8j=5T?h-6#n}xK3v|jMDM^eg4=iDa1V-78ACl}6+5`{ zt=;Sa-qJol@uW_{gAg)^`E1#m(Y_0Ca_2dEl!&8xsE&b?^wCpv@vt0l|IR{u@MWeh z0GDAQW;hmKCC15wy}6C8kD1uhv~aeK66PG@)RBGaoO+`Q?KW)JTwRn#3PIa$pPO_d zo$G7JLg2@xY+Tk>j>8HtYtu(db`sC3Is%47V&s2qCpu=@O zaMjfK5>b8&)r6#kVba#&{KUzd0h$ba(p2^$*EIX!OSwK?Q1XsS@Am7mhP>>2Kmj}wN-j6e;sE%gi?f2G3x8gVQI*pb~^;#>tJxZws0Y#BN^qobmvSP|a zu=E5Kn(Zn{w&*`$>2KB#07HCX-NR~ma%F7$i8k)mLsr-M~d(Wt< z(rsItBsn7>nKemDRLPPh2?!{Xm8gK^oWlY^qC|x$86;;AkQ@XQkc=pjk(`yB@y>-> z+p4n8uG(jx{hjaLYU_us@oW0RdS@SfJfja8^*R!dTT8+!YRsGLVvXwcwMR@-YG*9U zvPkh7uQT5xIyRmQVp)2gdU&vpWha=P_6-V_TQkIx6;5j#q8H$7a!r5}WeFDR`u2fE z1=b;D;c+rof_R}6>Z|0)++i^U>2xVk+}S&@GB)DNVU&{zgb_N#& zhbYyK2fh)Dx+E*2T1yVn_bJ|>ue4YHY_ru*a3Oq6zAQ$ksDCrQ3; z1$WBxAMVs){O`>v3;RDXr=I@9oPvLMr#urxHov)3)c$|yPCfr4cPjJlug$4?ggN!{ z)SSwyKHNDqr@FtJQ;!km)V))43jT{bCH2jn%Koq1DNTesb^fRBl-@gpImP7p*UTxn zAmmQvBHSsFKkH6~{oI}U=jN34nfdPDnp5yU>rTo3Gk5A=GpFEx>`oET{>+`K{v&tl zt2xD?{N0>l`BUZ;{J-x`9e;JFeq&Bi{$fr&|HYijMVM332y-gxyEz3vg_6j;zPnQ) zKe|)22zTn*Z``RFggX_5aHrT-e{`q*HFF9+LsR|-?i9}ZKj}`LbVf&4?moG1hPfVK zgOVW1JRv<1VW;>ShH(++^b;aQK6xAQVXQ`?gNFohz8G1y{i5;gdO-?2`nu+8+_Wa& z3%AE{TCofWs4I9!KM%(^(4tjEl`*t`Jg#dm$68cScy%Hom_ipZ-kg)E0Ry8ym|WL; zds*95`*YOod5YK*RVwvS(ajawvEubE(*Qgdg~Q#03onF%N|6O$1NT0}5{t6dbjZnk z2a`rdRvfIup19}1{{bdlMSw|4rhf@c>LLOa+-`j5l0>`jU|;&iB^kJ+{Xz3DP^m_^ z=ev-CpSJ$woT1iVQqmu{{(h#U1|)ym`D^V#bpFDVb+9%6(fPZa5&k0 zM<}U^KdGcFb-ydA6|J8usVu?YDJhHQuS!bJK1t-=Hzjo{q(&McAqD3fMJTBzNJ+WB z-%g!?lvGY5q@;F2|42#2mqAKOZ}q>Wr2ZkK;6Eym1N&i!khKO*v9b^fIOTu$yezHm4& zSQV||Q4hSPTWn>x=25WvL6+`W5?k3bdS$l6PALc0Yx$c}Yc+Z0L+oP9UUM(4%eq>{ zJ~OO!#$(v_Qg(>suT)X^K@5Re55y20!{csZ9a4H~^*<>VGIfWjOI(d8WZY@_ad%?u zYpL#U8CDcWS>J9;*P4kgD4-4nNT^d1Vf5*Ab_7e-rVHK05w6>DB}dOM^qi=S%iNf# zxKqFLC}x3jNUq9Y&Dph{M8H5LKXYzOWKcQyam;eHYNx+L$9hj!3pGzgdqwO!4)~xv z?hY351*J?J?;9|I3;N2B_gx1ukkCsSCzWopxOU#F{x&2^7 zeRHJlB?HVmYAr3y^8=^@#wCO$W<8Q7y`N4d=%}a9o&6ETqJ)?>0@bbJV|tp)x%_S_kxGne&w1(#7Xz8 z5(flAeHsUr`8#&Qx)x8KD^;?PdK?-UkXv5M<&IwbBW z>UoI?g~>&yn5Yg3Fe?Z+v+X8DD_r}Sw%er2%QE#u{R1?;Om(iJpv#dQ{WVMSY-^cW z#iOqfm8kLKO|PSTmGlau5Q5uDZbZ9Q)=AQmN@S=@RV3S;pCmb2_qQA&vK!$@UBi&Q zBH%4HB^hdqea?&~%)=_@#W|>=7Bw$WbJ!fY;Uw=z&OV7|CL}ZSfyv%`1aUT2 zAU@X|kVQ|(NOZm<-r5py2*Z3tA@dO9){9#5Fp?%(0W0&$kL4VT!kBhUrm|7ZhwhKf zN&3N<;A3|?aWVS3fLn@1S2@{AdY;y28kO~zO)^z-pWsi$}9Bbu4>OX$|S z;utu=t&|U1R@U?fma!fQRc8%XXeM}Dp)M}H zB}#O1O{!Tlxm-!b8xFq|zuM{ccumv9QdnenA!Rfd>J!Rh%)ak0kuc4trg~yNo94M* zDIrHy>wcr(m;hJ4#refL<-@69?3{of`h2H=cUZEt=4=O@Sk2kui28cFZ9z4L87m`s zx{;qTRQMJMh6;{=sI31fMD>lKs{MtbD*ZV_rELFuhRXjdL-lx0*gf}0hN{8`VyNJj zl?aIHAp}wFh(u}iSJ}3=De*8^+}@} zo{V1o3wS+8zo;4IBIEl`F*zI^v`ztS%Lp%T`RqJKEkd zRqa4V#&U)StlYsC91(t_$zK+JIYW1(*@~@hj-SYKajSXQ)5$cSFtS#EtYvgxd!!^> zR7ynSzO+P=`jyzA1=R@6`Jho}4f9ehulL8Dz7zN3!{L*%qp|!1Qz^VL?wUjP+?Z@P z=LV9Xa_j)kn?}6Dd+u@z z^ydV=`8)vrvzn(MX@HBI^J_8}x7AHfTuq(BdRtz_*#_$>k5vkeKHle#?V3kFZFsQQ zG^J}QcGb8SCZA>D7<9~einkauog5z|c;D)=HFw@^cwzLp6%t03gzMx;saI`O8k3ke zHwy`na1DK4CZ;^G*&G{a?v25%jlkP@J5(UIv@5fvvAwBq(>O=dt7123$kHrk_Px~D z>rdAGUG9A1$GImLOGjS>B@ue$W0rP>GF_=H!|RBv96UTeAeosUG~=X8Buu{RmB1pq zuvL&mBbRl>cpFFbdr!P z*^VjbG{`Mvuy^q~rf55T#StkhoqN95K z1Pu2JhMJupPrE%A)(lYf6pfEIk0v&c%|Yat04YIlKU(r$1xPWHG#THq3XU?O8>YSl zMsldH)R86#k&ykGV~5j^Y)K4dhVRVP4&~YG(ypzo5-Wu7J#dOYBFM`ccB)o$uAaLZ z_DYIIuA0jFxz;=d+i}_1#9Q8Onl*_{CTjdFtiLALh1*B3_p~yuS$B}p zy%638*2cz#L;Mri(Fg2VmSQIYw8J(Rm&Fmdl$3h}ewc#|61>HgaQ1-Rmgn!p%cA$gvjdnqHxtn{)!xL`3Lnm^!a6U=U?GT3q*1Vu%aMzl#MTx&j9Ht zLaCH+B}rO=z}gCyjX=VIg}1|2=9q#NQM)us*Rg5@YoVc$y4!N-)JnDRDCYsu+Y=JQ zM@xQaY>V*o;2_sd&r;R>YJzDt~~$ zrYN`{VH0FpxN=dm_=(tzzPD*Mho-}ymkz;4RcH;T_?HzmD`_S}=ePZra>*sn-QRS1ZF#iI97 zQj3KYzX8R(oG$3YJUwTZ>~m$>#@;*;eZh3)_?i-O4{v2vZ&d1;4{iNZDHt>#q~vOv z;4(1}OeWp~=guMxcep?P#&DJnPsPLejXNI`1mn7I4)Xljp8G=Q^2_IAUx_r0II;bd?a7;=Lt` zPqpl1>2lps<-V)-5YKJ@RUYA8B`ee{QVsZs4TF%d1rAq1&5G7wfLFZ!bS4U2!O{r- zT5mu8gM>gXJE8>YHW$yudrN!XF(JG!t^19iWO|lkGz8nyTRqc*B{x^j#f2rEkn)}% zBU2ecjqy|db>{bI-&v1e9_I98$}ZEH2JfTDjiNQ=3W)p?M(V zRVT8ol`i*cwYH2i8u2_}W-!!nH3+o~wy$A|nx$X+P9{ysabFt4;s*r%hbWb$4l8WK zq`|!t^B&&w`K32)F}V4fkY(>!sNI>_mQg*4d?dJ(3ZJU0L<_Qdfbuf2^g%!x=ylE2 zLE~9DE+Fh6oz~$aGgueAbvHliX!oIHO|3dSdW_i9SNJjpaXkhW+xerDt+$KEdORpe zPEV1EQGfNB-ov9`wcgvq8(GB@xE66%L%JX&UOr75AM;w}q0qf~mA0X|o3E?kUy|#J zmLmtyhmXbBG8~`Jcexj8+~nLbCN+I*K4ZE-K}?BBClm{ZTik8*XRWcgugH@dV&N3; zhJE*uj*xj71ip9JpNZ=c^=l5C!Heh1oaG!Y4NpShI(z%(ldQ)w z#>{S{h=yUS_H1rfNc@^f!jX*GvhWw5p8HxC34ohaOYSyX`y!ZO=T*vEBU3Z<7zl?4 z&%KHA_dAvw!Eai=^!7YkXQ12~=Zw*-OS-)Y z5X?UA|166r4>Y*%3C>M7d;*0jfV*fR2m9qZahu`!9z-b0XZD}v;t$J(6OU` zLYe=(?oI03+b>JvimyB2MjgqccktJ7X zj$D$M_0KT+t~WDaO|~c{yiY)*Uv;_BfIkeYLZgwJ2CI=Dq%f`Tr{TM9<^c(e=i;#M z%N~{}*g_MfiQw)Uj2a&9JcA6&ZqF?5QV+K8jwB#ufqo^T!WbX7#|5MOrdq;k=U2EZ z&J6CvgTw;;4Xls(*>`Rqr>(?MiWHBNLhrDE1o{So#C6;=l(1avRKc*(-Ms8zu~{@q zvSY)eSUoHP^6opfExu~cQel4NAMe?@Dbj?fbwmW&0j2!6ffK5;cA`A}pOoE)($z z^X~`AT24e18cF)yFD`6Lw;3_*P!w4YvQqMJxeV12JnFQ`#bdP^6c&1r5o(RANcEZQ zplA;2s`w0h!=JW3xV+LyglMZQKMH=Q=AiR-vB7Eg)x!9bC+-7@nR*MQEvYs7x3iTh zeY513FAPT;X$(|RE6B2NnI^yRJZeQfjYQ z?-Vn_7U*@Gna)HI`_hXuRC`#v{Iuf>rp|d6))TM8wGa6B4L=3d88qg28cf;;DIK~b zNv_6{uE}%>nr$Wy>-W=`MA3Xy{X*FaMohkqG=M+C^ zag2Nz;_VguDw;Qo)~?JyjhDLM<9$3?a{=w=Xv5 zEP9p~;0x0GNicbSx#wO z!fR373fU06ZeF;!u&;O1xBuNY;`h4x)&Osj$P@{Kh`hFJwYP|dE_|~hBL=yVrL8huh(4K#)H=q1*+rNAVgJHfdrYo($o`hY1>tx(4ID>LI-&4*lNkMQVAtRrzrc^a&&`G zlzFv>U6%=6lY!KRzarIJJMz^bS!Eyc;DYmS-pVm>lhk1oFAGQBEwFnx_eyb>TgfZU zG3iUANg4Z7jL2-fZ4rTkBU&`svpK`lZN2?PM3}4QxJGi4O(*G=(7kf*ieVHQK^g;H zzF(74YT9=+gmt`3Y@se_#qU5XiJyiK7KDSBmSI%LJ79?{0H8@9A8CV2 z$1puA3`(uLy7<&)(>JIBh6M&*r}E*K+h&JKS|)gcH?INYazQ>8>l zY056ubFqRY*8r-!CFgQQQ_j{Om2>Kr(mkW3OFb;($Ii3P6@IbUy^s3Laz6dj#JtrB z*}H+nE1NACVuo<7HEu2zD{3$+G@ zBwczXv*mg^KrT4|1`nE*btizw;SGiuy>v^D8|liwqa>f7k$GamF4OL9oQz+XM;evm zve&|zqu##GDM%=fr#_@R+q+mWsi~;REQHbCU9b|Y0mE2{B7QlP$zl|rWZ8A5RAXpV zXlxV$QZqk1*x}t5JDXLwTI>jSz2HY363dDxTQ{CVKBZ|@~ zow6sYCg6#%~Zq(#4-4+O&3T z=Ab;|ls0`$bJZv@?31(Hv#z^ zcKGZ3dHQ9oai}N_*qZ+JKLey2;jtvwb&`MeJ2NG{pnH z-51e(Q>v$|vOKo3u*e2{JYeU_MG<1SfC=|f#}&h?rVWYlKCMZK1wt<);U^4S6EBi= zW4fR1XR-fbZmLZ)5#LK#nWPvc>gC?YNHiNm7A12fln5u`Y(0$Ch&vC$($^KnkR*De z_Kt1_)b6VhDG}o;o+(Q^{*X}#3EXZnPSTh45<7U$ts_Y4hltw3#GTOmM@uU;o_EF&7q-#wfq|quxt!=4=vuKWEZ3!hm9cDfqUbyFyuin zU;;*eZtYo2rZjEp)f#B(^i1dN>eJS9A&E8EFahI0W&l?wU{1&bpr|sy3o0JLgvfO7 zRY>s@n#^_jg3jg=crlKc@x}X~X7@n!kPS)!H`KMrd$l{;`1CWevz9XqR%>Z&>0yj}yDL_F+ zNXy*^<2e9UlyN4o7ZV^yW(6lW02X8}u$>W-ZULY;Ct!tqSW(0Y5F#VHfF-H`45SkT z3W@am5V0}q2TldgBsL#_V~1eMMc^`~v)-dMMY$?j5Jn2zLwn4%lLUHS0ftek_`y3u zKp65cxGV(FpVJxWFKc5^y-!|rC*Rvu0W3kxj5tn(g6!k~JF+==Ll|&^Wab$ez?Ljz zC1wGAsxu+>GZAxs_U9f@k5lYR5vU{rT%aFUqkN}LPv1NYrq5SBDecmFb5J6r5bb7} z#k+iMHS2ICmuq;Sh-5DCB|2b;raRD61Wp2gK5_~O zXNQi7_Yju5P6V10LB~}42=vB;j;RcMqyn%ae**D{fpf^DV6O^vN+3vx1)Wkec;lY$Ou6}%t~9TKORsrC#JYgq_1SkqXW(V+=tsVrPsmjMl=p+n*Y z!=#}@k_GW$fGvr%lY#@Pt#SADJxmgH)xG%+E)Y}@0oeaOp>HQ7`I8gsi9_n4>U>JX z&0s9k`RFOdC2m9Gmd?Pc19XyAf;*ngeC}9|XcD%LnU1a+TB_!rATk?34p*=x?~CJ1 zzOy+LV1pT1Yw-4U*{HPpi@sZv4-MIZHyrxgI;DyXTdpY1Xy)B1ceQhj7Yf9_=hpRe7Vqufs}VeoT&D_c8c{~wTs1hjrz$KA~)K%(6FUH%K34C zL{l&r+~uZNLyVdi>GG!?zDtL3aYiM)H}#q;_!m3et-npqtTMS=#dMX9(6P!+V_0}0 zQOA6Om`ILTp+cG~?L%H?nhDUdLo!~F8dKg4@_~i9P^Xl(_C@j2`UNPXiQmDQ^^tl1 z6h!^Cx;PaaEXiQW6pZ{@beJ0Zq@Ui*{qYrP4~mia4U{~;8XvVK{QGDj)d4S}-K{`Z zd0F3!DBP&FSLScEE?<9sfu_3NUU&xSqhXwEb_9VlhUKGA<{;rTj2d9`&n3wA0(i`!fuPcs1mrWo@Gzh^A;`N``$$_Cr0Fi4?%C^9wVhE;x7$K2r+;u z45mja{NjXVjH2)X3TrPlKVLM-Tga>T#GEcz-SI0e1&x>iYUFjWkqdxPQhUz5m>l-n zR6&tF&@kHYf8~`2f1-0MZT=m2$OSON9~dR4Uh>g+ckhL(5(-qiKIhH6)Uxtq=tAi& zlz%F)r$Pm?`l`WZ>4LjFsn|-vd*tc*MYzvN>}%1h|+as=`WS8 zU2k|NSiY97;nK6mb!-+l(X+f4 z@OEdW>4PIlb>V4_7{j*y{re2yXF7la-7(aAF7!D_Ko0;=9pQ=wOi zrqgH9(_N=r&&8x#HAsOy9qL33f?i&i8jGneqD!V91Za+t@9#|8pEifnHKBkFWI@gc zS_wq&sBh%GoCJI6fwLR%#5fC)AKRT}7|3D`({25Ok9eFV5om_7Wk*jSG?XTgs7 zFKHB?YnvZkxOB@fv*mhFEHO8ev3%!~rybT8-<~wi@>`UGHknN43zc#>KY>2yAkpP{ zVGWEC0US^@)-ypoQAkZt1t-bm>-wi|>%{eJ){}!@2p~1VwKP8n(y~Jyn=oj76QBUc z34s9gxMRY1dzfH~7$hllUxW2T(4mQeWa0oDrE|N_4YT4mJ5Z{C^_f<)rprTu*PN`3 zG-|QI+v1SOPym&PA(3GK)`~+?tiFOx0w6#}76C($fnGxLQ$)75UMKH5DP)H1}I7Yd1kXTHx-P(?3EG9~BrzUIQ0Vf$(p?E{fm&x{TPr{kp&sG)Q1jg5zkA zz&JfcUKIH|V1XteNdD8)Oy&inVZa6CLa+e_9Thmm337jgIlxJ+hv~M)rFMAUU~?Nr z)!?{l**+rYF|qK;sz_ZhZCNrprwxsO?tOBH>AB-8Y!$4eH@P4nJZ?b=mHfGm8a{sI zH;C3TR%h$-`__g#=yNHvaUSumZw)kjUW(oVW*;wNoege!jOiZN*;6B`Z%C+siyx)Z z*tuIn`?~O|z{0~?da=Z@xO6Y;SD&AGd2!?&vA&;J^)%e!aais0M zgXT`V5rxlwgd4&1BjAZFa1P!{P&$Lu*&9@yyheg5Nxd#0o)wlG@EZW# z8vgLP33AfJMP2y5gPgmM_p_%g=##c%IAaZ6lNszvc;%Y7YIHZS^-i?Oi-rhphK7T} z(=Zh#BM(Cim=NZWgiDxjasCKV?IOl5_4D|MF~1e&d;G8(tg4ocG_Z6U#){$sf)mp) za^yU4cN)fWrS>e;gS{S&pxImzJ=mji;yMi^H_gK$Ka;pB-(W`ex%s8Yu@?T*` zU^3b-r@wZ^CA?Kc2Wrm1tdKudw9ddFNjwcI?ZJA8Jc;bIf;?X@kCX?acj4$deFELa zVB8pof~J3{0=eytn`ECBKWh@x^Q!VV$^WO{@*CF(&uRo{gU-=1gTz<1$B;L=Lqnml^N8zntKm8yISEB zI3SNG^wlTd-ZTgA@IqgGTJS&=NI~!N3N-WZ13#a@ZbB8+h8R>w(1CPR(3ieuM*KXl zrjdKJWLCw4ySxUmE7Xia70=mpAA)&bU@XWPpszUer7w=g1uRkA^vc~4-+5ZlMF9XP zhD@w*3Rn5Lm~7JFYRuM}D-{Q_L%h6h`k?YB7z;e1YAO&TPfAh}ldGwHW-Gyie2m^G z?z&`H`>B!{ym+nNN8qa;*&(GcIKnoP$ zGJGwhukONy-E1MnhF+5(N#~a@ZY0`ZC`Z4)RmRp)m~Af@69(l%h*}=*g=6#*+2u%Q z4*Dyiw%^YiIq6iV=h6r_j9yA`Dct+wQEP1rFb5k~M4L+P=4I>bItZV#~Iy zH(rgCxHo&>I&5m3Cr;d17Y-OE=4ON9w(JMygvwv03k_(-=gxyS)B$z{C6Sq5EZ=W0 z+dEz{&8(mFyqrWDuMQu)8E8$BX@ipr9(;&d*k*7&gRVtU$>#12vOvF?`<->e@7oi(7BiaQvm0lkT< zLbT(^T>Y?Dr=mkhFIq2NMsydem1>EMbq?DucHktTKw(!6Vu|UBiWx>4DG;X>El?+E z^@LR~SLt1CJ3;Ydt|FIE7d1c6{foVXofgK36wX+eXI2UvsNTvE=8EAbNIZw@f~Qee zD(ukcpf@%7OZM)-DT3^G`k%=*%JFnuX`W?9>e_Wp>E)z`r$AXjc%YIdzyv=teUmEG z?cHq875(NuwlH1Wt>82b>bj`~QrRK_w^xWC)qTpOpK%Rc{iI!(Ufhj7MF7QYVli>P zAWYswa9C}b)Q-7(^ht71mK9Q!J++&F)}q{G`<);e3Yn)4vc9jbr4O(NO^_ah}e+281x-Td+n*Ja$`^^>Q+Q3133Pfg*I8&ofb6wWhZ z2Iol@bksoILmaewnuk$a!l2y?K?NC5 z0BV1?0{?CW{y{zUcPsGkRv;Aq^Z!mOknCrzzksIz{V%3}(_MelU4PSE|CiHU-0;;erMn^`Q6r-96Gq{v>Ba5VrHA#c5)sXJ(2#{ww!CN3>s$CE)0I-V%_Wec*m-s@JhW34_jp z5?)kSrYW#_uBwt=wWqGK*0@OuZ^PnYKN#BMZXl%P{LyuX|Igd*I$s&?qHhd$+OHUH z_;-lA=NrWRbA~(oE5n`lZ};diznklS=Us8W_hX}#RyAC|{; zXX^gF+%wM)-1GBK&nPE;KZ7&T&^30%o0}u#I2S}<7Wu`qJw^^7$4AWV{$nr)dx0 zbU4%h3&(K8;9r}b8mCRqn~0|8;JYz_ca27vP{$A>rD29uhJJ=uhEE`}ZI z#C^K16oH$!zfsuL_1F#(0FAP_UhN1b0T9I<1J(clyQX4ieWtONh2p^A=T*gnjq&f% zgYH;KgjaQm?txTG3z*fGH;RJbbrVHmjECsn`xXx39$5PZG1T4^S8ndU^)%EEWT3@Z zSg|de3B~yMkp!7=@G2mcjsDHGo=<1`^G}g%Kh{5wfdQ5WUjYvg@a7LQMIiFY`fp1GMp5W_D2-4bl+g$2m zP;CpS@#TBH%L`UB094uqq>}G2RGYwt_pcOobX2Er{~qT*tf-1_kl}UAf|iC!aBMVi z?FSJ==btXO;65P!F~_WweTUkrZGY5B7J zcqs!dY>Vs73|`2wHk_*_Q>G`+8L^g%lcmjC(nMI&MisZ=-Bs4yDFQ(se`zr) z_#Amt^O+7&$-5{;x$PF4320;xO=y1oZs1qCzf(!j{vm?yXU<1}{<{p&R;q6_VKW?} z39%uXa35aIK{qo9;e>h+PN)argwZq*PRN762{&+m!3k%UA)N4Mx_RxleE(Nlg|Zi*U&%osVO+(b((-PU$p zVm_E#@6BBjODckE(57&F#WCTy68=JzT4C}^wR(oqhyy}_V&uy5Xe(Oi^9EPLMAQ5 zUr%R5A{K>XbE==IU#3LvqA~)}r2!TAGGezkG><0#)Nz%&k)6v0do+&h=)@t4k2g9- z$7jtuP;F`pzv^Z#ZO#?uO=hu1rTW?_XdeL)-*B_I$dhWkTN2ttfM{FW2zUJ<+b26}p9Qsn0f+xbjMdVi?mk4kUBOFZT`m&!~p}z@xgAC!qdJKRsvJP0Z4I?}M zXKx7*#t4X#{`5wufNlgn6#n0RuL$!0%=ZfX$P5`bLlrJ8fCmcd1Uwidn1nGx(`r1E zuoz@EuwxQNfnIy$vELI8LjM7v;`j`Zjf|`TCbC2S3r-Nm0gw@njCSdz#Z})jN!m*x z+n)fz8;Bv!c~Fl7dT4^uk8UOGn&GPUHL=khazW(-1Mu*Q8cYCs=xxL>5BcdZPeB6+ z4f9~UuW4Fp_X0^~DpI+VQpFjh)L=ZVk%vyCYU=?B;?2*JL&Y|6K)Q?2Lt9id;2<9Q zlh`Y8_X6ZXF@V&p(9cOhiB0ICb-n73=2NLsnWpk^>I^WEuw`iL!HMCZI=0iNN+XWwn z6=MPl(Df3YL7Itf~d`- z^Z2-|s*`Qks0ucZFhtXgUh)J=S!OT4?3;I{7kGB9k5<+{#xqp>zTVyQa+Jh7^A!hYHNbu95o@t$&8{zV4ns+tIpwABTq69tIQXTim=_lNB@ zpIIBRkiNEUP}odt$BHuG)f+Fba#i6pttwQ|7uBuc1T{q=nbHqBiUMr#ilCvv0rrrB zpaaVKIyt>@chrHRB?9gaORkqBSKHVgtk_A?&`4C^E%B}+R(1v4n?Sml9Eu;v1rzIx zLcJ)-vgB2*jEigAGL4id5*AatPA}{MAWdnXx4wTb)K$<15oYk?tOhi`v2mfb<%IN7 z$&dgZA-r7r(bXO#gCckL$X)eC%~vQ&d(vTZUAiq`N!N6Lv?;dnyDGcMFoqZ*I2`PM8 zcj3emoy*A9EW6w=`@mZs%15qtX|E44Q}DnU%c{Gn>3M6mMA12nj?hwQ-s20O^X6c7 z=Gs6ki)gm=$u5)FdTLZOVhyUT%$MutYaj6+kWUFX9189njwZjh(FzHc&JG%~0~f`h zsYTM5iDCD>W{XN)cAWPN??$bRXYEuBIe51xKn`)p9sGpWDi7X3Od9}TkT_sN?ik?Q zKfTI4Sj6#e0{iwY{&8>9kzutu4DTyl}`Bgv$E}LA% zQTalz?nz_hiF9nOL5be-C!@iE1=sCDXnpy_EZV;1!XuOOy_h%EFuQDL>UE^mj$kak z#S13WJx5nvD)omtl&NU5_aBhFPuSA!AF8#;C#c2S>Gc{Lj2F>R3GO%UZht%Ph&6*@LxQxlS@k7 z$~aR3?;-x|=RpH1vjAk*x)UW{tpdif#bxWEsivsoSHBDiLwlcYtPpH!-tbQpMC^TX zty3te4lXpmay+pDrNR z>gIc7`4SzI@jWg_`v6*!N%u=yPM6|gZQ`%ea>x*AIkPr@B`s&3_-k4Y{D-)l zLKZ|^P7zB@(zPGrauSSwnwF!c|2-`y@K2`Yj0JvA%VC!KB`pX3H7-Z?G%g1;`CVMj zO5RorA}wdJvXR;J$Fv;JF(@quu_3ceqzX#Q@hi-8L8Rqe6M@olF#jkm$5{tT%Sp5N zAuR{~^SB(YALDXN%aN*O zrEijP|4m%Z+Hxxtmvapfm*e^60tnNDUTt)sj3)GID+0$f0g5y08=JEx6^EJtCvprs zz=X?etaq!F{RQ)q`Q8qAi5)nL+yN?M0OWLjM;8_F8*vk}4;Mu*U2Gu=M|Ic{(B63M z`}uPaQlL5L!46Ovv}aM19BQ<*7*F$v50G8L7D4r^TU(VLznyWH6i47AxnLZ>JCWY& zoy^)s){j>D(bcGwFQ2WYTFxeo7$x=h(LZYJ6i?{hMOd`?U#3Q1|D#k5Nfsb2|WdpRXBQlU4J$18`59#fk*S#0SMe*Q&UHD~!bn}&wKG%i3?^xKH`?^NCVyMLFeJA+Vl)*$qk1fXAekWzW&Ex4=XVW;l>lRwgZH&p&e_kob^qpN6A z0my$M{x+BXUE=S|S1Hv5`6_=aslS!f|1(NT^uMR1!1${`G>TY!#brsTutGUh2HnX4 zCgf{iDmnD>`C5OYpVr?Q6(KS}J2DDf8dSdq-4MTRcTXcCCk21r?uOLmIXOV|?9Y1J z6;N-R4+Z}Fmay)>fb9GWE#a>nVfde(l>M2t^}AWCzf9~X{d>o1|85EYXIsKwdk*F( z!qyk>{un_N3uO|`Em2)B6SLXI8(Co*AVPcfF82Mbq|wcSZDf%0BMg8O0_hXyhIc6j}x(qRVh?iaqFui(O=QKLUrqm746=6}_IrR1e?rtI>`)%Yt)S$3mDA+w!@N|aAln}wG0Ik2EG|%${%N!Pg7gHbuUC`m(paF+Iz2%pWNxFY4%zb(v)5F{YhX1q0mWmeH$K0-=+I z`B6^an#ZMYPLNCz?$X@7DWJt_=1nNgeV);v?G80YyC?Q%%FEV@9eEtLuq6)C=#}XOh(9VCD-4*0#KmNyX{*nuGr!sJJmb||XJTOR<=NFR zQLl~|Y^VG-c{=T-QZ^Jv`1;53Qo9@VZJC|W-V^dxTOCP_SShld8%2Q;Iqiopamgb^ zN?%3Bd>9>iB^$I|(8jN)JmMO+-il4Tn{m%>$S9-7g7|<%9wl|M;Lecz4L2q$P+K68-9j_<}KtM}whUkPnPRi83@njBo68tzi+_-bt2 z`Pe*(&moNLSex!yk=S$P<_?isr`p53k8S#a?iMkle$int7Ul(JSGHiIZpEnK` z6BHO&hab#iH1=;BG6y-BB&5Ar^2iA6(hfJ5KUOBBicgwJOeg`Hco0T+dWqIcOttXftGIAUUKKU#fZF zct6zsoh!>cN#rA$%arZ+8Pg&koiIi9U2?CD5ed=bbm-a>U>u7=k|hQk zi;If511KBlH=n`{FZ5LV+)t(J8Nb%KD0Hlqe64CpU*j#Q+NM>t>Aubh-p7DSv&k}n zDS|*T`V;RxRK8{g6mLu<04WeDpEBC;Qh&>x>K6;FbPo&z;CG2ts#0`zeiA{rA3zTzSnY@?1Cuo)tzwG z|3lkbhGo@lZNng;lmgNrf^Vj9c%0@4cVr zeZTk5bB?d+mTxsH!{o9XbXfGa|9(a&s zz-oro=BSwQ7(`!gr zT!vuD;2zLiuwZ0hX<%m}`w92*+@)Ft>jEVje#Jk5}Y+&nP|MSK>O2*=m4w)CC0hElNASO6``B<2O2yo&4=;M*t z^Ox@%As;+_B=+W#g9qXf!gGdq19zhUcjNsf&~Fm{n8Htiev@zjoa-SN?k|CUlW@JU z5C-=QcL4mSR9;%}>tLq(ch`g2f_=a7j|Onx*B^&|9=X%j54CYU{OpM0V`=(~pAGGg zPVSZUU2Baejvmm6-?jE*yq{|NO)3|nALqWSX&?Aqai6{~|93t8CYIuZf%lqE+4dm@ z-UA+5@YCq!d#9gWE$m$}+TJ~G)c5KI3Hb?PU*X>g`BS1lrXGB6k-(iv-mQ&~<-Jk< zaS0gi?>4z6^1~*7t>!=2IG%rCaYr*iM zh1cPF_=Xa$Us^yuSrKTz3+Ew@Q#qahN~X8Tcoo{6~F(l<|EBxwpvy zaF8();KT`r1Va5`*grOqJDdFM`s{84xwpyh_RIsCD=@Id?+ z=KD_h$0K+q^5a}B3h*y`=NtHUv|w#u-}U#$-g!6Z%eIAEkQlPq8BAhk(NizW-qXHA zef)Q+{t)4hx&B&$=XV=s@d$8dtqA_$<*5Wnfje13?GOIA_io4hA>IUM(03bs&hTRu z8~=P6{1EZ`T>f|&d{-xU8yE(}8~8t729?15>*0P@*i*0V8^HhXWdknT23Qzhh+gCM z$jtW~;Clw3oJ3`Oj-v0+Nh>42tV{F^)Ca~+8HQMUpArHuy3U2EpI$Dl;rTr%6?2w3 z+lbs_FK0bHSXIV7=Y*#_i#$5*6*)QZD_)J9Icp9t6bjg)pLt>s9HIQxaIUc3Wjybe zy|a(#^32$>(1tSs1*{IfpUI|U)%m#ZQRAu^qp880Y}zeSx3joXTu^p zU((QFu4!fln;ow{Y-&5&;&Mt{Gnn(HU@w&=(+|{t>R9L`}#ZcHS zilRZmK0bf9M1V+pc)=t=d;tZ!-0?x%pnRA;b7|G6m&jOa_?Fgy&~B)+Ng0bdnF+g! ztYc{#O~NQkRl3SE_W3;4RZl9}AZkKaG=wbQFF<^1sD+K(iH3Q{6wWyO=yr(Nf!*~wg2 z0TWo>>EdL$wt`vQnoP%(e-M(XaIq%5Xd!y}GDgr%WRXDm@yU zHGPJ4a2tnlCXOV-{0w4>nOD5PaUq+!{4>_F%?er7C1Y3nv7>rb-r8dKk*dWU#-7vx znEnHZ!fWk9|21kuq{sZPV;NMTwMRtgA%HlZE2D|$*hYS2E7?&9`SCI_wPU7|l3bGE zo*8apvUL4Dh5KQvUgTQ1@wCCi1{VDEN0HZ%^oxp4A%)^bp|sT6OGm~`vHq{WK!4v!k@zRI-{mi?@I@TA&4u&z zTT%;tOsmof-wz*PCd@!Tq|y5(=wjY|-BU1oXDiLBZ120G>XovhKKrT*>M@Mya*0FB z30zK7Ks>TagdYwK!k@LdO0)C5eg7_WI!ESRQ0gREzyz>0xdrDB(!`JVp#{hB|$XN+~It$`;6P{!!}Mrye`wVP>-Fz?J+GKpup2yN zD^EjNW$ifxQXJ&Vu1m>Bn9Y3k3YiuwidG*s(q53alY*;C z_Dm6+I(@!olG&YHq2vMGUYoaW!Fms2a z_pEMwC{*u9gbLa?_mR+Jx-CwGw`b(J^s5xX%YzL)d8Yip+EOvIZs8Mk7le?@URCPu zub&jHkN9IuVj7$*2S@HgRKG>2a*;J}c{BlCG(wA%VrG}Fm(M~OJ{LWm70D9MU{!pw z9Lo#}Nd*wl1yzk3zW+c%8^%{ne=wYtyJmcrcvP7&atm2hv>`m#iRnxxMz4sY8<`D+ z!ZUWiYK5J_CTyPm^mO9MN*wl7apyth4sV%Tzvo2;y6k13zu1_vG7}!ds|a0U?6=Fh zmImr*2`nvYR^#(qGraO7(KdQmMCP1(x9> z2l0`pR|NY*Uj$&O%%;}{nnd=PGh*>xyeV0Gekim*NtnJDD!j|ZtF8~zjrhznE~j@> zvYm)>lE**Lzxhi?XV&_ao6!3Z?+gZv47i~S|I@-c9oyx;=dRaDBAWAJxA+wSGbd52 z=bl@yrLO+cH#(QXPD)o>z;TlLCipjlsCt)qfqy=KNxmxF6b zXx&wcZ8ecmJr!d?zvb(AZUudxRL6#Ahw3FadxY#!+w&ym=p!Wq%jzbW0{TPYZ}J~I zweN}L6usDOGk%D?6EuX@rG6#*)5(#T&_}B>5(xqDnw_s&?0O%z1JE5K^wLkFj$ppc zq_mEar3gttn9UFLlwq@3RE|LNtqMTqVk%HQV4#(poeLmZ>#fe4Wsz{k=TF9U#=JxI`Vf z*6&u8UUeT}%PW%+X{lL{4lnDaM`&!EW7%aOb5|VU8dY1bKIW0#7Uj`C>?o0Dh+^QF zSPC_Jwi?;+)OnstDUw|NG>jCEXL{Gkmg+?OW`k#^Q(%J`*ysd&bLkb&f>ZP|1=4jy z#!ZnV#v^cZoE(?dbA)TAx!T0rdkMfyRaVo;gaPzY{RG?m(F-n+cKa-wTWo)ng zthWhzHyOM+p{4G%fsENP)kGmu0! zwfg|J(J2rWtIPZLD(qsqa?dw%h=9$$jn-}r*1)+Y!^HFmg-P9nZYt5T$S4r*35Ccz zddG@htt>QNrl5_4XR{(?nsUFnGJkk7rhFCH<;fc;Ds>^))e@3DNyU9C5*-}8E0K7E zX5KF-J=V>co*Tx?8~96Dj^(H9fZ$ZW34P*)E20X9q#L0 zqB-e$yZZrcQR*mFxJ2){Kt2QgXR z)53&E-#(3FQgTM7?|By%obTZI_2quTAnZ*a)FTbuS9{t0l|$ne)qbi1{-)aUbBS)c z`5a7{4dX!{4-|m#5Lv%`(yX+1v&5hu5!m_CP@W^>u|T(W8gz|$7_<7LRvvs$c`0_| z>|`YfU&c?7Q}Y^hTo}i?MUgI?8;OFX`La@HLXRB=$@=oCgtKQXkmAQV={0P)M=Tdv z0*q_CAZY^++Uk*iADK{22v~75v}MLvyVXv*8>4x1A?$qz8++66PEa8CGE~W zq?rpVsB>D9xEL&pvuhJ1_2p#Iv>HSmx2hcxXT^?Ue%K-(@WkFY=|LGAE#_I5s|f** zC{-OXLa)LU+znIh1=DQIu){?OX9z46WKC>AR;Rbr3WZrvg5}_6x0H!2(bE}3llQ)O{(lz zW}FxY(U(<}iqn@6@L1tDlGs+uiE7CEn_XqwVy;;%@V7pFZke*c*W~lzDHI8;1WG(9 zi}c-rSN%S|#H(`c%`t(?zT1n86x|j_itB=ha+6KeDQ*=RSn%isR)skQGTne@T76bq&LQ&FDEoo#C5SUek7$978u(i;>Gn-~z% zmm*XxCr#Ua>x)&SBf+`$(vVhk;O-Q~=)kqgV4H_CzS%=WR!}XWHxz~d?4UA*9W+FT z2By&ql^xTPw8CoL+?zrxjc&h$ewf3X^VM*SMw`^vjl=WGp+5)P>MOS+LH?|-ZmPJf zQKI-wMT${VO|xKi)4xhR_-5f%Xj90eUI!7i>J&&lR)~S@#5#%*=egw*<~o2^&P=lrkfw!lbk}k{qAB?lk#cB7HcYT2 zMc3dJ$Q*T$Tv^Pr9x?D$j$H7grwse?({4lL!q^^sRmGVd*YSqAcED8R4(=@VFY;jD zP6_CpCe?Ap#vKq~^D>1*=PNYo8y${X>pgZ5NcE1C+GSL6x)Sao4B6ctkQ*7bVKh>A zQj^^TK1@s;5$@?8*P~>_P&}sVmYa;oaP~EyfcDvET8BL0Jzw=IH!bGKu$SLDRm-w) zf-#>D`2lhQzfjJJkVP?0&PZ2}_x3`k#WWbQ zBDw`G<%zmtgUtTmd)m^}Jepw2Z;#Z5=2w8J!S;KCSe9l*8 zUQJ?ieTx3c@EZxCt19D;MuQ2ehXe?Bj^zwO3o7o#&X8jiE*|13qcW7Quk#jGY%*Zv zk9Cl2d_J@id>BHBd%G*+c0@V+p5^e^4slD@K9|*d=;2aw5zKhCu*f`7*vxyttGWj{ z5}yN>Sw3zwDey&+BO4Jq3bBBM0RP%4FRcGjeZ|DF=+MRTXki_NDaXlq(i8B4aMS_F zYlgv=!bjk3dg4rphUXsozG=@Xo?O`7fPB9tllB8%A^gVg+V!2mYR_ z#vxmm+xsd3b-E6Z_N;SiOgJY1l(Y~t0xX&hXDT{6ekv8y1One><+roU%7U+5))1nm z-Zjj5D~=O&6++HX7Jd~l_E(N7!)|BQ;&`|BRtukf{!mMnLg7N}>E$Gq>v5Ixd!vOU zKkJaW-iG(6Z1EnFf_==hRh-mrL^(krnm#HI!WEm5Q>V#vY|+1F;L{xX0*lDHc^4cS z=`Tvcc-Jx>9yPUoQlAQcn{EgK-nN25h0V>OVmv%uAzW@9+6lm zZICnRAUYqCL1D1_oT1hFtzUd6%YmuKHW9*;lS&jzxDq|a;x@Ods}?HL3%TrSJbG2c zDf@AqTFd$6B@XAUfgEv-Qq zxztq`OMd0$y+VDCsNlC0SzMmV7$InKHKZI6rkb--bl4lKgVjiPyiS0ac_NGPVeJv! z^khA$NV#v1gLAq_iM$cN+L*~W2oz?CX7J3w@zAwcx1g00#!U{71`KP1&OALW8ghio zhudFgHv|}+6j6rSiOp6uE0Y7&Z32>7!)0P+?|0S2G{3DCq?Be$&Y9U@fW@|B1`h~;v*ITaJN&oxtB)RM*{x}BcYi!~gt27G%=G-N=0 z@BN9yc{b9OKKht~Cmu@$L2H~I^IjbPhQTyAfN-VgbFvCkDL-z-slSFvc_zsxk}e+E z*BPCqb#56OcX2FvcAGXXiKIHz-T~DiL3%*TO!`ZezZDX8reevU?iD^03kq_eeba4v zT`*k$2KM1&#FbgY^1A{QSQ zNZ~-&)2lSipRZ5&<*mIs##Fqx5O=WZ_6~U^+BH2Klo!#ynm2V(HGLcP*taAu$yFCn zUtH#Z?;|i3;iJ9|UxIlt`3#BqYG!`aR#Wt<^5OB18sUm-I_AP#{uJ>O z%|7{=rsKgHAC0Vs8DhLl*}mj=LrBsUv#tY%lYw=z1_be<^Lxo_JB;r7;fC{+MiIhY z#n-mnh6y@li2tuIpJfNzfkWrNg z$jB!$zTV77%&v2~ZJFRS4EmG^Sz4nkf!tjdrvP;(|J;dnFSvmNYn7-p5 zZn-;IwTd!{hAzF3&=qXePOPKGC9afLyIQ)E5<=Pq>%Bnsm27zQs*~)v0EXhWQeBS zDBgxmaP^cxt5FGMH?HX1v@CiBp=OCCTe6MGL{e;~h)HIz$Z2b7KaxD!xj9D|R%s9| z?12LDsua}p@kpjA^_S%Ze;Lw9C2R+(jT-(?`kgFf;ec*pD)DuH8>HhJ#st+mMA~3( zYQp1(A&OAyvgh?d5ltVf8>-Ya*QN9nY4k>LU*Hr2Qv*SzHH@-b%WkSF*t>dc4%_;0 zKKh>|4a|B!Y{tbUWLZHd%T@$!J&*KI8j>}YfhKGroYf8ekbO;~XB-5TOl!F9PJCmp z=B3K0(l(Z#Y?lM$2Apt$65lupo@?Q@AdK?1+99c2Ou}I`TqjJm5uo^mw^!IpAT>Q7bgRv-L7X#oG+ z_17EZ^!Out5o>MB>hHV|LLl~-3Nfg{1OWGQ(jub`(`-= zX!IxGy{>2srw@Od;b*&FSN?tUzx8{+djErKfPWF=pE|PAh8s{53;RR9A8KjlfA9C; zpEQ)G_(xBz#!&xs)jzDiw(zfUFc|Ke)8GSYJs;n#a>B)4YW_O;Znb#~{JWX_4+Q-; za^9`~AM^ZSc>l4-Rv#)Z8(Q&yv`BO)YS`a2_G`AEHU8`}7xn%s;J;e6Hxc;HYqSUM zp9a&1pwaOj#9mSw?g9`$Pl9Hn`tW}(4Djcy{@3^4-%e5v*4xSe^H2I!L#ZVFwFbX6 znw`Ec^e_9%Q~2%dKd$We?g=6xe~#nF4RP1}j0+mw<&oiT$)~EGAYtJ<-U|74ofuxcoOm>ckOqpSNaZNli1EchoG!7px$XX-l z^U*Q8I+Z9p^R4lwc2Pu-g-hpj?U|d_jHn+ud+mkOAb13HkN@#_1jmXf=bjC!LHu&% z)Yr`fc|RZe$H9Yf%CV06n*5XLg0Zm!l8QnIdrxz&%V4epX{i!l=;~H$2(|B_I}2QS z-Bwukp3MTIy20n(C&O?^5R? zM(tKJAo_J}_{rXFHTiS;oY^P!J&M$w0;kOg*lXDqoF++5r@aO9gLz*I>uDaF&?xL0 z(jri4=HnQPX^PO6LhUxeL$K68KhMZQkJSwLROB@Q_>Dx?AS*>5uK3wLPf@$EUVqYi z925qdO5JCBphwAVNXj<|D&nMg^<`Z7E zHS1(V0yO+3?E6?wnZi$5&Fp{*+<=1J;qw7Xepob>xiLkiOgY@^>9T;rOFyRK4sz-k ztO8A|8~Y)_qWW2Fg9K)!gW}bBO}o_dD7e#-H_~*vmftwf;5J8P0?Zd{bfW6y#)*=b z6n*e6xheYb*xc3Opdb-2xw#)kxdt<}!q#q+M6bUudkP^F|l&iax#52kK zyj~~HhQ=asG-NM|JN-a?K2MjXfi%HfIMzb+-|(Rv$ndIYDKgr1I%~$X&3g9n@o{mF z0_S7obTShI9`+fu_ERpDoB^3^Q_Nu|(*zU=;Yj5j;=Uthnsw}XE5U+3d&sO3>quVrRKQXxb0W9BK0{M1u^rj5 zJXFSefI86aRXv97W|g#f$t-Zx8C!Ol8fC)lXjhyngO56B ze?tL1SxxUzz>V(TP{6$1e?wvzuyWNkr5~7kny16JABh(qP9H+zd4hbS{p<`MiFF<|OuDw2%&4 z7B+K&to)+zgUqk<)f6v7($+CffYb>!Vgfq%oX0PSz|E-gN>;JxX<#}yNv8!^k*HXt zpW|OCEh}%v&tz!$Et{Z8WQto%Hf646`HcN4o>X@_r23@*ARTjYuE~HXX9#G6);gQjl z(~%!wjM%&MeucGplX2^m%v)AI8(AW*7ctTU_n9Wa%ZEd6l#FN`wHHUQJsNm#n8&Ea zA4459{t15FqhX2bI#-*k2caD?=kb6ct8R^pt~%uyMlqrj`>6n#S(q{QX-Kp)%2HFZ*wORvi@!qHB&?Rrob-b|>^`Mj7#`-5A4H zhz#OhCrKhj%?C&YL)k5n)*>5Km)Lo~R(%lhZS5-1kjGE;)p#Nkj)tF!Nu3{HyMO

m^dRsd;|ggq`dD0?FDV+<(%JkxCq< zG_NB+&pf?WVS#zZ8I7S#u5e|2iCJI6STFs_Mme|u_$wV2rg0n3bjQ=LED8GStV}R=3nF_>qOX#GBXQ7UqWC#NA77h@%&;&^O~W#CF)}=#&lgCS3-O4etX`(L9$8OEHX?GIDUJDA$+uJo3$9k^oX?o(~-#YJqdpr;R02_KqeTe*5&F2Wb5 z3k^B-oJy3XmFcd9USEFM`2djH5L~bx6qJRV(EF)1u05<`19d{;6vCUr-v|rq-dwr$e;@4@plyCJ>Y+?L?F#8LQ!=LZ_hE99lX_7RK}g zN?Sy(=L|;wqPS7qg1sgq{$$R$aC8tOqDiken zime6Wtq!X1y{CvIi(lT8Qn|;L&Qrle7oE))=vdFTtvZ>W*mTeP)a{{BibmvI3Wq}_ zn>oCyM!O`wwM{IwP<&+&tHD-bX*tr^aoeS2H5$EK>{WH}QT8=T)GF(T z9{X|{-_U%5!&!~&p>Rc2q^RR5MnOsS?|{f*t+K~dvecI zsjyX8)9D=ZCleFjC6dC4Uq@%?CdOzklJp|T=frIJzmMm1rie|h*d~dFF%dQC*Yo$A zV5y4@AYOV>)RY`-SqgVUv*Q_lDWa`2hn!W5Exw@{SD_iwCHuwAUFp$HIyG!+G{6c@ zCk#UHh51w&E@gUNLP+qG&!PIZG&%@SoUx-ne;aaKo5{H(qS>%PZH`G>>?7~!d=XN1 zFcE*F@%mYpsx$!sxT>_2FnEnP=qCcD-h#+;eKZgEI#83kw*Jg<*^AP(NJ3XxmMQiKdy$zsHWu8 z7Q;C9mT-t8-@z6BrZk^kotT=nT4^*Q{E5LC^DH(VGhge9?4+=%KP!^cX_Mb+nn~eY zWtf}oj();7B;S-LeTr(ft#&vxcCvkKE4@vY@=NXsQ<+@(5@OKx*7LF6z<`Wsp-&LW z)|4U?P2J*X#YSIz{czH;kDMX?#HcO*Xlsu7?I)ZxX3ZXXZ?E}caC{urNsIt~rr3b&nZz{12hp7D^fp79Do`Oi= z(X${DI1U(y1dggGntl({Y^QVC2Msz`M)}>7z)QLv99{tsx1Rl7&tW`ZjV;X=W?bI? z@*08vGq>@7=r!UPO>Ov9R}!7adJY>6tJ?2pJCeWH(O%~v$#4zK3f1o_0_u4NINL}k z&{46G_&=*lx@sTsh&_H!?x}sfE=N0chwQMAGRU67UK=Kovrq7k?2XB}FY*xX%8$w$ zR|Sutk1C5fpMzz6jwbwNanCrRYsSe^bK?BM|V$>Mi}Nm0-(BF>#p;WFo* zU*R4!6xkbDlLkNZ`azlcjYIW~4{u44ISQ0`*R#ggjX!U(7f zg$fxB3gA04N+sux8HG(xbH}u|od!#Nmq?2fw^h|VRO@UNFF|h`Aq=A0@A;*vuzLB$ zb02MgP5lCOB6{gG)i>-vZ!)ndEkYcnu5i&qoD8H8KJV5*uu!Ej;Th0yT@__*}vA{6M$S>Sq9{IgTG~+P(3(LA zA}O&%sV%BGJBd6X&vacAFa@F!ey;$*X<>_V8oS{eN+`-9Gj-%pWv}5hI&fOUyHVDz z_KO}x5&P|)9u;`HF-6Ze4x&d5<=oMucX>NovaBB|emZ)4b~T1(A_!+vWJ22wNhm z;00E?NAUE`=}NgGIhaxLWKQXslM`F)wetM1&>Dkeus`V<2`1su&wNAR-zOXnZA7M> zmyc9(wp?36Ps$J)y;^n7R2fn!w&}ca{c6u0!HRT^<2bI;RTjffy>RG0_l-SF2Aw%t zIGrH!j(Oii&JUf5GkkwtdO|X5-%SC|oC~!maPsM%gJonvxwJenyxy_497^Qk zlsA#{M|L6R@#k~q0Y_@Z=FDdPxLvg*(mLc(67fPlD$HC8E#ax{aN#&OD_}S{%CXfF zMiZ|C?rW~?9@s+qnAB&^4sem_B7cv*ITr)}KKhm>bsv2*awy@^ zm>N&W^CKH?A)T5bIvq0xrG|{zmu4Io257S7T3L&haoE=@+w{PxW;|0Dx)^cu6+Oh^ z)@Pqa=kHVqIX5qqGwRCC_x?e{e;AfA5Kc>Ax@j@!kPZY&iG)(l310CiMjr(d{}qSx zGg0|_9L}>76o(rRsLdsf7z@9P!x_`+9!6`Zc6K`Fe6+5eU8}1L8#1WRkj3wGe6Ts_ z5a}zX^4~c4z>@&%ZtdS0_zXIWV)q=Z(3*eXU}0E)=V1Li2EI$Z19?z>XY!)Z=7$tt~Y z-WI*WA7k=MPVKAf4i!gJ37`<~$x1#cQpme}Qs6h{eZ_Cgd(A5jYu?CuCDJs+*Md}x zC?;G*&?7RJg5mJq(7S<@W1;;dvxkq;?OO)6z&&9IRF)-gQ>5!7{Z-uVPtrX=$kZ19=q`EC8I(L|F>{wZSn@M@kh=OS zTVPZ*nZa+#gP*=94_e$M52lZQX%Dm8$^8&Dx4$|4lQBeIinwiDonkyE&P>(N-LSYV zrp71*;NDU0@45G7ct{||Js2&-7x+XBfF2P$EaPCPj9>8_5e2F)G`P!1+^ltUf*|D^ zd?=qaZ+QObV*}&D6Bb!#(P;*H3IY`L2QECBqGikStrKlYB2iX1&>C_a;17PM+yC?( zM-Jn&47DZfDC0MT3Ob%?loV64*rnt;lggm=?5^0^K7I!XCFJ|&rVq)e9@kl($ULuU zUw<{z&417EnOv!db@9T@QsceR;z@%M-6#(z?IZ#jc8>VfXF^?in>R`~sMya&I3hyq zX>F6A4s#013Dd7AY2q8=>7Z=;`386sOcZ2t(mLT2f8>hbDRQ&T!Pq&PCFo2rj?H%V zbYqZ=z}+U;bTG+jvcyL|&DkU`Qxn?sGtPsp&HxTv@rnd_XXlSJX>7BY&^5cV*acX0 z%aZYo`Xe&NzFF+lL^L3r(v1#SmU!~f4`fy&>2n|V_DXzYQ$c-F5tN9v8DYExF=UyS z|B1yW@3A!K-(dW-@-WjbSiJhzM5~P>V^A05t{_J)cFDAi=|^t*lP!VA${Rs9H$C}u z%84NUEsU}}fq**>ee=slEui2d4!v~`DCQXJiF0^p-D9d1yR%QK+lefApPm_N`8_>T zfV<{CJu|dl)LkpRZrR6E)&lY7@%g+`4FfAm2Sm#+y8SQT@oh@bx7@gHQ38Wio0OH{ zor4g&BBev1HfKO)R;s)aRP|>2hC*eoXqn+I+W5KYy9;@f&h%FOs5X#_%+vAl;Z>4h zqQi=Bm8fQ({PN0Pp!$i7`qQsp6?v64tjo_2&rz(-XCFZ+OECvFQ-ox&tA0EyA(Fxb z`u4nuODjihc8ppU%PPyqYJ?tYqHe}9K~*UNar@IshY$-Gt`RyYMUExg-31+W`tFBi z3vJz_YD0__a6@>tMQkj{_<};6(dvrBL*ZQAzB65$3SB1mWyQE(-jmh zg3YntpbXG^>DatdREl+=2^==^DxmZ64_k2!k)vq0459Z{AoEl?uctPx|(?9|v`6;8mYtvCW0_kr@5R z)6B-fMJql2dz$8!D^uYS{>23^9I=@HNT3V+`2O6M5{jr`Q)nQ5rl7}`S**=*$BCoO zbpkL*N^ltM9B|M$Aa+Nr_rGG;+&uSwA$#(V>6-W1n*0LOe`D6~K9tU%w@I$wXdS74 z@gmGlA+qpqiVIhIWii9opC z3PLF1MxN1rOykXIt9~ugv=$J!q(QGP9jfaiC=z!=J>Dl;h;`xSKw5Va-7QRt6RTjt zq2S0*Kc_0a71#ZZQ{CBX9SiuGv?{VQqH5;OXbq)oB4Ka)0>T>@nv_SS~uz3R60 z9do%(e>apfneUY;g6B^nPSSQrOy(LTX8jOrlTK90YoByR&P)Md2Of9>sAEqm3 z>-IXWQE1QEPaS9=%&`->)8X>cBVCrIgZ>H^B=jP=Rrw*huH1DVaQ(Dd1I zUu06QrP-9eoJ-o3S`d$y^D9(8**xm~$ZsAivpoNCpStXQ^{TrLgzhHlBDZTHzd-p% ze!qNKzL0q6sruv?6K2~v%WS_8MswUMvab+SpOeOJ(x%NFi5B$Bp3ihVW7sOTUt-w_ z(2K{pOW*|J)rvhNgHTl&i})vp6qDjmqoHrANK>CN-9oeVuZWzk2~ zTJB`d;IvL&Y|W@<$n`3 zV3YvNvm@L4m`ws5wYo=A;e?Z>B(01RUv!unT&9ptlGDxaM39R+mZAQ~niT7>VRM6o z*v(5xBlB&piaJ)}TYuK0(93!0xTbwk9pZqRJ`{Uk9@ip8HL!`{m63cM}5k8BgT%kE?MhSlklLe!)j~g{+6hXin&_axnxM*K1gVd z%T^7{e)RzYobMnm@EeL7*?%grQZ!ne93e{{HXggP0kiH?JTMYuB(fTFj_NivBb6Ro z)rZlsQBskD>D2A^A?9;=>4{ofrFXz^?xZ2z4I(xUER0~y!tIcTP*ouz(<&%%P%{{Q zQ|5Syn$5w#&Ft;Dpt<=6jtlUY(EJ2)lUd+h3`#%zcPzISm52cOGb&UB%I9gw2ox#d z#Y+VlZ;jrm!MoxUTYgD`<{hBAex4{_*Rs;Rv=KmoM-}5+?@;i;#@Ucom4ov%=V!^K z65NX~Sb-T&FO)LEbn6BX+x)WU2ix2*URftVkf3+iX}oPc{SCHw4Gc$1w4dNiP;$TKN^#+P}##ub8UM;lL|0 za!zEs!j5cy(OsZ8&G&gkRdy76_O`gd75G~vKTotj>E;POxzL-1FTO*~-b$ZNUVMj| z-$ge))q&R58IsfZQF`JNsPqJDes+E(7O3<@B6p~exi_fv#3HEl#502*r6)WJJU-K*vK9no#6Z9H% zUoScfbI=)y33bQ(vTR<@OOdBnR_p-#vw+(A#+?K0&s|y(w`L0G5p_rbJ`5S|)mFo- z@~DY~mgG12H4mN&`vz*g_U+XpAfV6Md?|xGFxJdwQb2nc`fl63*ev|%ASmM$xjBeG zF}<%dBqO0d%TG15P?;rxsZQ@9h)zy7MD0awt39>mO>UHdvqb^9qvQXrgzAPhV$&ii(NuZ`C)TZ>LulH z;(e3esm#A35;OCfx@AS#?Z>CM9-L3Ak|*vC`@n#oEAquKSVsT@S_@-2Iz&ex5Oa`{ zuOwK|h7~WvsNjSS9F1P)0i{tKMV6Zg z&GY!T*d|fLA0Ifr`FqAD$c2ZBc>bN7sE#hcx@ zaPq6UG4pVvjRd6bi==Jzjp5&z!pOBH9kQpuP?;aAIZs)>r7FljrXFen)ve7C=iVJ9 zzG51?0%H--T*2Tsouj-grm!xYTyUYP{ASGi7u{)!r`8*G9lDV&z)$Ku7=I&<|w$*f~MrTvmA!x0WD^)I<6_jSS|);945iIyEl1#i)?wu>Vmn`s5W@->+9PF zTA6-UM1wTpqJ(KAlktH~#a_4Nef2$ya6Jp$_J`e3q^Z_Hh5PjN3BCVG<2J!N_c%_E_c zz+XzS&1dU*$L^GAiCA~k^&(`m2Z7I}_>g&UvbTbyA57$YO-_k2!azu}J+-IVP`}?>P8N;Fk095aCbS+axli-G#f{<4$ zC0`6Pf3(YN@tB&`Hh3C}&v6wuau|z>p&d4)+D$Jw&oorN`MiB4mA$?D7P;%dW;uO+ zsl@5WLEz`{HQf+M+d|83lmKUO7A{MJv0^v#zK6b$n9DnxC#Q&7AWM6mEeqv~_YbwJl(kU; zk9a6UZjVCLYMzVei|4I(PHP^~{Te=az>Pnf%?dB^;L`P(Pwzg2Q~h{!Y{_-&WfV|_ z+BFk}`{X@A?j=n$?n2wZ?mfkeO7V@DMiD|R-0!gHG))2*jhU8B0==ZHYOg9tKhuyp zacB0V{3my2j%7c)GyAW-nE^k$Gn@Z>!|lnj?+*~}YI_+JZv0tDEYLPZSD61N<4?sN zxbf$McDV7UeE3hspU)HxelY&@!B%+&c$d*wxJm@7ukefkctxM$teETFm$xZ5@=b<2 zW#l282~hb_eWPx3U*D)t33_4F!b63jWrh<9{7E?p-<+BCJrNyx#vMGq$g{K<8O*cB z5{V|*jPumLEL&2&Jqtr5v31UOpw+@w^&r@y%k;t2RqFgbPeVRJmFo|!vTd{nWUesr zKL!S^d9;TwuoO_IXQJZW=elH!~31-=j2-HGaLO}eeKEMhKXEF zJKHn1F}ImF)WQR8G#%Zdnb{H+Xqins-6;V$@=$R%ijO!wMQJYiQ06xwX#j0egU7pDGjCiaMfG%P(mr3o_SFg?3%nMi|Ire@=9pU>)+g7O z5GITLzTn~r4yQsgc{=rH)&t2RANb>4%oys$V+S86D~?}0end?_=JW|Zo0FT-9In??LPiP$ z-sxYPe3&!x(8+aK?X^~tnQ5F(BK_Rh+y4u)<8Qc*!0*Y9et_Qa$326BkR*3^5G`4_ z6Hliv1A4NNp(STWTe5Y5!+OWlbjfQZ0q$xB=W4>#EIc2W5z1ar1Cw^vGTQSfwM%6; zrJhP0qkPw8C5HM8^nMe-bc31IJptCYv<%vqeIj*(INUCkFE>7Wk=iY+v0ia+7Be3)h1&?>!WQ_Z#)xduSjr#W|3U%c7(0V zvQ^#T=f3#*_xFhL;SN5&t~efh{P>LH;G;AsuXu@rDH?~?LqEhn)w?EqTFUM1oO{+e z;6QCl>EEL}{=#+y{$0A`FKkEP-=#bL!gd7yUAp5hY)9bVr91w@b_D)iy5lcwN8sP3 zJO09U1pZyR<1cJS;NPV?{=#+y5XK_^9^LU5wj=QG(j9+cI|BbM-SHQ;Bk=Fi9e-gv z0{<@E@fWru@bA(ce_=ZU|1RC}7q%mC;vw$a1LXfD-SHQ;Bk)&NGXEIe@fWru@bA(c ze_=ZU|1RC}7q%nt|3`P+--70A+XNBoR%nNZ=d8VTYuVmmV4B9>nPCu_Dvzyh|Hl?rqi+B(Q;vvC#OhGwBC*FVV|fVl#-Ak!Xcg z$+gk6wBP9UQD3VPwm>FP9_-D7K0MWx>b(dzq{*XJL{Fabo`-L0M=&03YV+S=zw~|w z5Eb;6hwo~~JvsovceN8foa}1jt{`@`@4n7kYV-#-C)+?b|H1z}8MQN0OPAE79CqxcO@Zd}XPl5Z}Z?*wFyg#qH)|Z5aKe*h9#X6^^%t2U_2Xysd3Y z`$C4y{N9dcw{_l-p&9S)orwBJW7dp{*;$j)E_ui+6L`+xI{sRVVM4H%AMySlR-MG7gWO?~3=G$#^3V>MBHh4B>uMrm_&NsY5i8VoGMn0_La! zriB$41?0?}C30_^9I@w|@ZosRnF~D~MlnC*u~afDac!pi+U#5r*Up=lph>BL^S+En zTg{X{(@RA3x7DZZc=UARpG51Z@)pOZ^RUq{VCIt9KIacGuRV zKiptkr4bi;x%xy#)%>o85A?wR^Mr;Xqr9_^RCH~Mxw@t4%mCarxBx##$nMgTT2!p$ z?GRRz3aOp?uN%!zathVM;^DTzH_DH!TgYMGY=dPmjb1ZdeH4WeP#Omywwccus^p~# zboBT~0|jo}(Qr?}@b_PYr(hpE==UE#@R5^mxy%!H>w;;xvWp)TXFfl>Lbq?HM)2|X z5AsjjM#EW(Ikguu2gpf2{eh(@j3fhRDV`nca75!#>k>HOTFPPVzrPF%=4T->&U=GXi}`ZXNF3@=xq{nYozxq`oVxyFzZHr zu>mGuuJz*yxP8lu`#;&Ypxs-u9tUEVZcCwLEpWE}_{9Ty+pk|dV4pTYEEg8kFh_Qo zj*ljP*=ine)jis3zJ2)XRx{ad)A3fbPWD9^_uqO7j^pZLk!*zDe?N?GMzwwKEI2H$ zyM@^SvD>Vw^>w#dXjhve_2Vn{kl%msAOTxVZRm7N$u%&m?JqVi-yZrFmwz^K0q#Z< z+WlnXq9u4@<02);YY97S=PTI71o6moGF>k0)rP>0i zliO|PK|i>NlTPnmJV}HeKOHEGd>V4aLp%*jZDCZhN$GkB-hjxkMpoC(XF&Yv|ZrAxv8K*nYmI8Uw{Qr=q&(?#SP@Ny%}8?EB6EOfRr&B#div| zRL|KA){Je;800&*l@m9q@>6hvoNXFDLT^0CW-g`RsYrt_!0O{=Iz^s*g^%@FM#`*L zvJKl{&K}*NJ4A}!;|k4a!kYj`4wsq>^SE8}K?1k&Qj9Yt$Y`@qyDxkmwOaw0psQlG zPXOapH{HgSH-5P>omS_@M{PAEN1n*M?V$}32@H2L5qZv(Dy<$X{&Y`lelkRnC_s8l zYp~5+CHJ&7c~aiFbh1R>%W8~_QVX!Ma09E@{_9?yXepg*&uJFIZIpe-xT%gzlkNv~ zKYoy03F=EovUl;cojiZHaSpiRgJZ!U+M=SR12V1aJGV(zu~S5cD=*#2K?qO}Ld%Rs z96v+yLWx+xm@D}pFBNu3q2d=CBnEzI8lkw`0l9D+B-^~lk^6ors3nMR`4P5UuI^*R z^tNlOKOzI1aPTETnU4+V4&gm~@lkLQ;^>z8p=eZ9Kf)qH)74RjOh zT>q$14pDQ@hfpjwXW_~w1@)vxm8YD;&^77)3jz4AQvWWo zsJ>H}x6Y-n_4rOGxMeI}fvDSeVTjtgZJ?c$1RPaY=Hu^@{hE>gHtN@+T#yl>%H5Y? z-a8kY1`-*~0F>{p^q0*6{4d(Ho4hfS=mqA8QTFc zpDa%?;jLW{EfiCkI-viq1ytsaE)0B4|1Sw}&x)aN&x$9F3>;71V{MOIEB>JPmt->O zKg?{nYsKHC`cAtq`KklI&MQXkBQXyNes!$MCWlK*TYyU#`nUQ24CU|2{PilwAzO#p zR_QGUG_r4J4nua>v87dD9cyak(1$gVj&NgD;Q_G=Uan-pg3cI$tKuRZhdg1Y92`eZ``EkENbTXBzmg)=4-w5+|4c~=@xlzvyG#es|%obpyUi|FB@HKO3eO-tn9E!+UsI98u+?CI-H1<6PSxn_G$I@48?z@N03U z%m~%>7T;;5?L2K6ke&^L9Zc(K>+aaIsctx zeW*2>Zj^yo$(BL2DW}~nX~FegsQqZH@9n~}w8BgOAuWGbRJdK^tmHrUOhkqS!}iC^Jdyp8$>p^9(7$c+x4M8-vB0?*uW620O;J7eqHd zbPgX#?$$vwU(mAG+m9Cmkowt$_+&5dVwKyg}cOzkK znhjNYU*(yFte$!KqP1V&A+6)(mQOI6NkW4G!Z&2Yyti8VMI8mkv@Bn5@mnx?D^)uM zBK=XP;k@9fhiYjx4?ZK*4~Nm-N?hSd|A)X`-ede&Mc!k#@# zrrXINMu}s9tZaJM&RDCB*Y-<_AvWQ&PVWC?`pUp+W8Kk4b`Wk}kn6mEnFlv} zc5T={(R0lJ=Ir=taB=vP_jM_U)lpACh{|z%cuRBoF~{b9A9&$CP*9)_b{{lYdS{Re zHI*p6zG6sbC~$bQ)ouyGR=Q-!1{jGjgpHe@F7=qt(@N-W%vh(2a=j2?WQj$uul~^} zudH`ha~||R2}UA28}gGEuKM~22;7W)-8Ovs>R?8#!-6c3&A6h?(>*U_@YuMmv=e3c z46fhOXRC7lvTO6Z=VYbbG;rTa$vjt)b<+R>K4rDIl~0hIz;jgNl==}Q?@BGMQ>Iy> zU2=Lziv9TPx5JYXnw0~Vwz~Hb6bxs4PTj0H|LySMdYU_64J^ugo>qN{Pm28Qu#JsZ zZeVkW#kLf@m4A@?1yV!9?J_pN@R7akp{T&Jy`vwE;?XwOFVVfCN^MzfS& zQoaftN%V)LUr=#@8i^E+cksBQD6DU~9BD>%lnow*^n)&^ZXTD&TYZZ0-i3=uCx>?> zhfm>(G{EEzUwi@el95j8N$~)p5?^ccp9Mt6!L?w%^TGzOXDb6;mi(y=LV$oTP)2@p zIslHRC+&pt>fVij^JHgE4#8iV5ZHIZRz8b=THxi$;kbE8e(I5@L%d2uhan)VKWg&7 zROBDiVNOQm!S_=HK4Cn+jKd#>)hWhXOT3aphc2rJUF8Vyj_q1q zada>p)m2G_ma}BDWEUOI9i+h0q2>Qk0KQA4mXz5cqkEg>?F+tBW8x3lS8j1W=R1XQ zn)z(&#d`>WjN$}!)A7i0M=(cgrMj1RD)NjnxeV%a=Qm#uv}bcJwmvxZ#7W}al9Deh+e51cjNX6(PJrJ;ACCkaYSO$FZlr*WgH>FL}OcaHJ3a zad8L@P82}s!%VbI48q)-nu`2eMd1FM|E$}8rOE$J5#T>-@*Hv+UF`%SD5+sA$4&UP zE&oP-3Yahj2{$bP<#xJx*m6{VzzJeaVvjbw~kUrTo_MUxwTF zg9<*x9zdLyGG{B642N|7sLB6W|F1LYdqseMOq0J>Bz5+lJf2v0qbAE93Y$DBD zs4LHzcF_exl!}b@uVZDK?0J4vQyH)=Dqxn$J^ku#ui<0BtyuM5ePTwx<=$s2fRlc! zf1iU*oY-T6q9LeY;bE9((^9%s43}5ESa66_=_#%AS{5K!ZTWT5w@8vOa4Cv4RY0R8 zTI0Lin=q}G_7V26?KYkR*bcD9o#Q2v4iiu*zU_RsR=0aR@iOU0!{SSCxodg!TMUG_ z=sgT(g>Z>oWebQ#z2xl+wm@Bzf*Lhd(RK$>cQ&CUAk__-u1;$4E8J_!M67Poy!qVw zNX6%b49SCKxD|p$4+*?O1z{pHb3Ript8#YBttJn}K9Ag<$l6@hxpxQ1G$y!XoKQ+% zuk&+ zNA>`F^}5k4U57fyzEI-2wQje>AUffdS15Kiy7g;>d57dlANGZ8q&?o1y(I~`&%I=f zmmiu2wc?&F^A6ohE2@4B7>dCHqKLQ+@@iH!^M-QW)T^qV(HnJTPZb$xLiib@2WXRL zH*ZpMHR)+jl1Mu<((+E9K9I( zNd89UP-|$%aCBQ;X+B>bmPIaxlK-+-Df~+)C>SZFi@3Zgs7r<$fG3i9KI7iFrZ`>W zqKG{>?OMLx!cCX)G@CP9E=92&qe>o|!)}HR- zdn{Tye0UBDJ{|qAqedb00=?mLylhzynum!A+SpHi-4^SNH-L0#FX zKd+-pfd(iV>{63x*#Uv2@0NP>m@f*kp&)_Eg?a{37Y#LwYl`Ud>kVqsvtx9u&4aeb zqCL2TrPpfC4Fbd#%=wFyIo<(CYEc|7RL|(~g`cy$y>2P!9C40}&hZ*{Z?8aMM|o~h zxxYfasol(eyvevNLF@9wt+=J^wWq>WXrl{ACcABgG}4n(qY{9&$)(_d7LZ^Bq3KOX z5#4wP0|?{cZI7GJ`LM?WnL&dFV=8txdn0rrgC*)#<%1?UUiM{k)vrw3;IJw+8`fe^ z=N}sRs_I-TR-_AvxW{}E>=wNo; zzDFmaRyEFAJjtO1TtzYTs!=ekZRv+u22`7X6RL+nEVkInV^bM*^<+z%?OPxZ)9jDX zD!z*@(TC%=x#E+!`v}u&4Ku;#Bs*DM9=c~fnNm%tqD!B>xQNc+KR;zd4NF;c^YyL*Yo(JfA$SiZi+rpDMpA_V7Z=iV>tL0e^^LN_O7?jEb?puIj}_v z)a8bfP%jg{#sz;K>sHMZA`R0VXC)lrxx%ZfHQz`+A}E%WBg}l`Zn!%Kz^IHtTK5dA*kZLMbEj7B8Km9Os9{G!i9G^e@CtTmSnjFOf#H4} zhi;y=o3X(7`+NwvmTM!LAS2>nH*nmQa@R|xzkl)Ry6Fpm3sxPa4|NEZ5HA($&_iPt zxOL}KHj7TT##+&fbTOsz)Serf3*q4}mO48ED}&&;$rf@K{`dF>8zr0cGa(ULmfVgG z=avzs?F&555a+w-yXYCRh;UDCPwtKmK;jv?CvuFFHYq_p>bn~puOp0JP3Sw`-_H36 zZGZ_vo*qaNx}TLY69Ut+`;gvb$*;J`lAj^B92hRAYnW6RKlK(NIO&sKt8;IP zIq#;S!}DJCgA5`^9Yg1U#7Sm^@DZf@-M}i&yf;c;V@i}^`lk#Zb0z(~g*7fWFS$OGL%+XIX z5!az16n0NKz9b?E{Mx*_qa(w^CC}Jpc100Dl&XPt3|vgjyHDBi{hZWB@Y&r%2eYDp z#J2+SqsrdWi26N8)B)a8E-hs@c=VFV6gdNuYCCa0TyvF_%TromgtHSVls&2h@5cYc-qO% zp&r$rQ8G0u1F-$19y*7bLJ5}<`4NIKz&*-4Q1VPvW>XXa4wXq)a>FQAdlBmkKwt!qr#gf{=(DO><69q!bkf>sYKEa@2 z;S#vONy;X|&Bt*MNPEI4gZb8F@|IN3m3Xw7Bncl=sd$+;W6>o~RxavGRO0J8hf6Xb zi%T*HgjY&Xn(Wk|$Z{ltkt*{j&u&g&1j6 z<<-aJFW;Pcentj$gkI*1OuW(?$MUr&<$S$dr44cP@kaoT4}bbUth$?Jpt`Au!=%HF zfJhTFW6=HJBXm>?i(e9Hg7+jcyhDStGg75Z#NM12X}Yb*!U(Ar#$gg^QfBMHuso78 za6qmi&N+w}pQgwr1w?FxX$C-e8>LY^IfM2IZtJzt{!+NtMtXuP(n`z@ZR`9;s~Eyc z%pV>pF>?`GC(wtNY466&dMD5mm?I6|W7DR%BbMPGfb;S!Dejf$GNEG3U{`%oO(;x-Ui=ZD~lAd4ff+`}N$?e$qvMB1ye!K;1kaD-j)G>8i|#W~Jx(QM?0GbS zDo_19RVGulrX$n~m*!YJ61u|`^&~)l1EXxLeh-kErl0v2dtEWeH}55P=U zq~<)3<&of#m}ZUazs%DXf-&V}qfC4Ug`CMz_q;MV#j<8=upX@XJet*^Z(RqHhyfqE z${Yw8iH}h{^wtM?Ew;$P^H5Z1bb0%3-fTbeCzoYXuJitWZZ2(^FNgaV*1PnVvYCOF zxMewQOf8@^eFM~G^rF1dG=uPV;>NX+^-?5C@E9onfS38<04g1HD9A_8HcSKEZ zZ0qO9U7XD0Dkw6NKCOl%XY8F>4HgI%Fi)Gv3T&JP{A>Kj)q~{u2>Ii>iIZ7V`cieX zlfeY-I*%zUsecRL$KYM0+!`3a9M`Ky2pFv7)C7$OAED!lm>ieEiZXF13cN`=RL-96 zP|2CET{RM|AO>YLRX1Wa^c5rx{gYtl|?Cw%?|2tkI+u`zAzQY8iW;Q|I$8fxBf2u>e zJL|c)KIZJ4R1`65>W*ZurqH~pS-6b)co>rHsVE&Os>2!Y;47-5((iz)=*6C=7U8_lvzoc%s_WxiLs)vzsaFE4;N< zZtF_z6-5qsXeG}&*W+}4?bI&a~TRUFKYja4MxcR(449Z12n=lW1% z*zG%eU|#b9DjktX0}b^V-aG}ZU5X$&P#4h_LWuM6|fddbf^9EHCb(xJ||0UpLK!OYo{-$3!GuyfJ^s{ z&I;Tt#V$)3Iv*Xs1W~#VoZH7;mu^+Mk0gho50LBp4S-#Wf^uzV8XGD&l2Fqq3RdHe z5k8{poPtW%gtS({#o*sCNcxhZpsOT&#Ogo1)-I1W?n~ zUEn~X#(3C$7EieItTc{1;kz%fhzlL(_+H3@W?7Gn0P*jCfI$%|)Cj)x@qeH` zD)6KF`*R}3RdFO3Hzw051qX|b&Q57*rJsZlFKpkJ0U$ooM+t@ol=Pft_X*(&*4gOQ2?VO98H3g8};TKO45 zWcC?}XlHnEEVdpC=7^RJeEt{MtX-Oe04#U&%X;qjP>Jx$wE4xyw*;dhy+O^aSg_0R6)(+qw70J2Oh^SEoFFX!OG zHgD7-q|yQb0a0UvUO1ae!aWrFRt>I;HoH6&3&WrcksfF;YX90gw{VY21FH%E${3`= z$(x?F3(epS{Tf>;+_NNt$T{adkmRBI!pO*bcGIpUhf)1*C_fTBj%)-EAn8Fw|X z1S)-NC=F%`%P8iqQ|3IM2?|-XV`}gUlAOl^nNP*0-ff({jT>UJPS&{z^A)_h?>LUG z|6p)RxNz9@UJ|eatMrjN*pPTVxVUL4O*h5u;lmnJjarUjG;20Kdl2dro1ipgnmc3w zNhr=dsP&=xs6*}0@uVn>h@w+>g_(mn%CMQ6D$#(gM)A^Cr`u@!+CVb|5S20Mr$x0e z)QS|kCT3bzWGOe+Hwl<1+z#KwZ##3RT@BKev$PVs;0CnEI!j1YHM+Yl-oBDn?_gV% z7fJ__n^RSY&yRzSJ2lxGMKOzoQ-Xu0>KC|nD!Fvvr;eF6rdQ}xO?jA|4$kAu*u5M$ zt9ypUDg2%iyVDb$@cZC*nopT#I+?VeF&HWevu4lg;zGlFAqzW1;HY#)$};^ip(eEr zx=!PdJHUKNPt%-fWT-s|JWk=Z=iggCS!=Wg*3B<5pe!`Sb=27IE~|rjh!W7&jOJ7D zS zpXevk&|AwSkWn*GpwuK8W__d(ugdJPkaE$iWqBG{6@FC>NArEr0FN(+D4TMgHxdQx zbrAn{NX^Vjrse2_K0%`>H~52xY9_JIfO|39E{m=+C9WG|8 z*|Jk@-rAJ*XrEjLVPSXCW~0^ooWoxkN=^VpbR@-0#e1iSY9`Z1#g!dxxp``n57@1H z7$2qb)I1msv#8-;@N67F_T$}~nTNP21 zMf5=-ZHComt)$SZ;=o>koNH~Y-n8*%Wu5zG>>Q*ZhUyA?N%Q)K_pVYGAT!;~4& zBiW+_PO&A;N%jWyFPm3q@D0{VKHYsA&7V*nvp-uiEy#d%=sy;9XwjZ<+OV${nitMX zUM71}fc5b1Y;?z?g&Upf%1tvCdmT$cdgXg)5l~HW1G=d~Jm{oZ3pv;NRy07jsK~P= zZyNSt#co!C+-JCk1xv`f7fCrvN-YWivmyn6ugbgo7p5twTZX;$Au-E@HYn9bnNo0D zUS?V4A!)~k?5GvKqRCq*;nhX)2W{*4AV+WG8rA!xSgj_7u1}(6A;HS|)daT2eHSud z9^iG2#Jjp>rG%U83JZ#N(#W?I8H^P=8g*iNwmxJQ_wz&0RF>bD5`rGZ?YswyCrw|J ztE;nSMiK2$RX5GgCU$OTChB<J*T<=teGQO-XOv-UeH|V9HjL+Q)@h zFE+C>9|V~e`KP2W%`Wc)v|jt?!aE?H`<{?lF=ax2qD4mzg*R6Gc6`K&%nY`nj}($) zD_78EyZD=!4AYvcCzL`D$bd&YiP>SnDS}eN9?=`!RaVzQ8|V2xPiY8{+ms1knbc2b zyop`bTbx!Kqwfkwb?2U4+Ep2``3%m1y|qHRn^?9~RKsQcrG*efvxN^G#o_a+wu!NZ zur*<(t7ryyDKEHNxK0@>n<=?ht@aM>$Jf2{q$69Sox5@8ak}?RJ@8^7-69%);SP1x zG>L}>4|c5zQcFD@I@HfaKw#79H!ELYS2J1*HTS3Q5=}Ac#UWLG};`SXB*1n;pbpu)$frUXFV*62t z{y-rYy^%ilf-W)Ms8XR`{zDu6%@ix*i2XfOEa?mR+| z(>(z~J3-90-kSS{lA4hL*WSwBnQ-6uNSswpgHmRO^k}$w{C+q0-P)V5Zt_BLKB3^X z%-HyPycT`f@OTTbs$HS3X!wb8Lg&uGRlP$y`32j2oAWgBy8W!$m?0Y6gX^XnYLAq* zL?<>)Ywia2gK?LH4cXL&-!E7cPDM5>YOjL=`|B;1#_|ldOp2K>v@BxFB)i$B>h=5rP8bG!rAU9{}Xp z!S=y-p$2+JP=jM+CpMkiV*Lu>n|LHuqpz6$P{fY~3Nb!rH2!ToeB2Ned@cq5fc;+R zBGy2E*H=9>#lp}}YI1Z0zEtZt&=YTLa%k$0c&i$qI`Z3C6UXUGrL|4|t^ulrt3zm2~pj|A8LhgLO!F1A=29h$EB*};e2 zmt03f@8|jhUjq_5O#u9(SO>e0(Tx^JFlw+BL}k zZr}pPy~9^>k^ZOt`+j2NU3R&Q^!s@DtaH-)x!ux7h7P#5@^aa}|{1D_#@Jnpa)1+`MD>l@_U~FQ_jVpKj5fZ#f5*wQMLXMTghSU_fxSjnu6lPxiKP^_lGw?j>X$Iujeg+2v9 zNxBCda<%MoXkQnC3SoNT#f3S?07yeNdz%>bOQA#zmIPOg8lglXofunwMN`gx6mc*> zEamrfwEWtA?zM`#6r=&Ts9r&G^wt1Y7g9Y2UA>PYHs5h}n-c9U?Iv zdK=Debd=Iy^K1vAjGwX{onkz3Y5yUn{8=*$FCssl;>#sK0QYH&-{nMH-=+N>^Y>L* zS_)coOnjf8OVNI9)_1)uaNTjJh;A-4Z%KiG*X6L@)~fiH)^q@gmEk4iZIkI?R4blv zSYfz&ZRB`!IfWH*Vo`lwI2UF9jZm+fcv9P!Vh6;bz%8p_nAp9-X|3$0ST^TKlA2n7 zt&v(&XsqmJTgmP%iv7U5EyN}Pv?O4Ef352DiHdaP()5wS=^D-wB1r#}K5Y2hsU;nn z>Nnq+R(<0cximNHNYGEOX=k!FZir3nKWk8UKKf-gmH=xGiB$Aw+|$T-8_Nd`dtq*F z%Hnt_fb45uT^qs8lTFS28r$OIa(?o zqG&eFI9_~BWOaNNF*ktia61GQ0Q}R^)NcJK!Yy9skPb=A78?*DV1tII}TPX zrZs@is&O*MvA#|}kL&L0GtaPYh*-*sni$?$D-EKHJDhY#RjB4do*50O^BK#cipC#e zx2|>7kW>+@C4@?W62W;gj!?feyJw1CjYe?E|d)3OsMJNlh z?5HxPBX2f1Kf7$0(py_L06FjgTJk2<7+<~a&8hE=cvA`+&*D!S5f`ic`X1ngA=Vr= zF${kXNF692;7~S)zX$jny$3kL-viPS?*R+P?*YMx_W(m)_KO2y#ZSUxe*)sMimds!IQR?*kL`z{W18%oLjcp{ zcR<|CFHZk}!$P95rCjX%&8aWJY^Wetj_N-F@odEx@jC!Vf%1;`9i4s`4G$xXK$>R% zspN7Tk8Ko86FsAo>IP*9hW;Txyaf0y>Q6NT5D}Aj6L>#g;v@s&hxDhC_wJf_9)7xR zxCp-9d<4Twtf*$5e*)s!#)JJ20N6bW_MG?5{2`hhJ{nAZDj8tIT-hQV>lz{)I|hYH z5W}DHd$1$kD1Iv8yP5)?jr4W&#(zlQVm3nfQ_0&_qZbc-iN9Q4Y502CaQ6!AkRWZP zz~++U1N$MbTGQtj&Q9iU%J+|Zij3>jAzvVjU7F?c5=5~-#N3(A(7E~Gt|LJa1{OrX zKL_~8bH%}?_fNgN&WAlCfk~@~{5!jU@kjzg zHyfgk<7<1GgEmVYmlBW$JSak&$LaX#JmN(`T~R8xOO zJb4`XtuOH#X_UDLbQd4&gO}LP-!A1i&whlas7rW+Xa5AmjS;wC@kfxt)vo+0b{U8L zykpCKRXZ{Qw096O|r)cNsiu=nbm}i8HP9m}stIwgF{u2-r z{G#z6U@wGne_PXIQkc-|``8MPr{p^L)dLjq+JbU>l;(LD zdo(27TX-=W?Qi&1Ax8x%Tp1uj@h$55$oUZui|`RfCR9QHtm#%t41SrlN8Kno{5QMI z)1%c1-NqBRR`k%LLL6`XBDb|T)@y0S9?eVPT^s9ED{~hV)+*2S9Bj;X;zJX&trg~H zNBpjIE~tH5z^ks)=N!`)Z5SFfc@-+djTO7s{=K#VEN(EP}vf`HaYDzuk7R-60xmTj+bl+wvFKdCZc%=ghIQ80ddu9U^_Ctu(muc`1 z*k^GVTG}b0E!`$f#x$t6@I;Z!YTKd~T zEysYbKbTbhoFDiafLMR{xrp!2v#_(Uzd!$8{+;r;4nshRP3^S7?1>sj_s6xV9{_wi zMZ9nF82uT&=X=lpDb^T6e*A}Wr`8TQd6o(`4HpL2>P$qIKo*}4cZ`;dhKTISr@`e1 zBPqqz&eYjyKx2s^dKt(9<^|Q-+>iEF^6oXf7FHQ$Qjy)&3dzB$OmpCD5pj^2x-`;+PppI-6oNzm z80+#C7Ma_zU3<$77%2vIxSv%T*xPSE%u2Gf*ap`EPqSbUa~`bdeGyJagSjOUc?WvOHIaJ%^BDbx~e@Z(uo@dq_8 zT-_>hsGyD_9$LD|+iwTmihAU0ny1y0XvMo&J+O)bE?0t1-%(fQO&Noz6GYAKrD2LA z*`-_o*0AmFKEzm{Ei?MqL0(=STd-ocP>9_-<5X&taQfziRj<2GUyCOW7ban!mhcm( zqlidfQbygB-+7^gF$pIs4|VD^O7eC$R-EN!dJfe2Lvl)$LM78np*!R&L76%m(~!kH z8Qj`yRrY0a`Vge?F>>U~-2KJs5@_g_*r1Ch07qdo=5SoTV|bT|_&|1U&DdRgq2U;5( z35WL`{OY;mTg3VNwQ)Ltn&MD};SPvlI*OxZgg>&sNi?s3O_C{BZy8|$)4rMN+Glbh zV4D!->^<4eUZN&bBXjv04c3;14ZhdtGsW!S&l%xqjhm4}=^K7*ln=QnL2Q#sW+9qp z$W)?^&$;dD_UCpTyV%U()c;Lq=yMIIa{_5c{br0J1sVyF$3XY#tIszmaN6@FdHj;P z3L!l_lXQy^O;&}8X2t_CO|w8_&eDc#ps8y^0a{xtowoIUZnWEv@5=P4i3yyLetbsb z;k@F3NyQ5#TA%@OErlja4L+((s3+|{`znO6xnXq;P1~Gs)aKgHnSgheEBDv``B6k#WyjU{XDA zp9L1R*`fxz@#2Ol<;Ai-zLY#`s(EyvX(v}6x6nbq0XAlGY2&dJ6x?KJu+*a<)zVOz zZ4>d)sx)2u0o;Sq6ELviH8k(QrZ7b}p}JubSS(lEUp_JPO7h9fgm;MQm{^){@B@s2 z**ymz|7TabM*R!XdqT5K`%@-uf$+Nx3SrmwFD@x9@yi>UwtVJd6aO4tPPL1dHOREf zt`M9l`8oN05mRjg5ZADgj)Yg-)WWT@#aJ2bppk_oS=bEaRrFi%U=|h$ODqig)abNj zu5CN0K3r2g(6j2e+zoC7*A7$-#YLG#Pu?hgiH6UybsM@`?$A}d3PcG*f%%P!N6f{k zp54l_x3i-?wm)li&s5=J0Ki!LrL`dGbqa|eL&AJCXBW_OulLjA_eBb9DG&uLbK9(lgn>A&^z8Ztdz?N zl5v)BMNsb&f6(YF7M_vUMhDE7Lrb+ms@P9;8K>m>g)RJhrO6Z6v$cZy57lI`h#W5( z_{dmwWxu!BuHaGaqXF!YLoSR8qm+3sKD1<`#j}}_NXvq3s6oa3hk<5r>ok4&fL}RT zvE!@LJLd$7Z#0c39_ro~x`a6qU3XaI(1*ETuguuTwaK?8iiut$#IW9}N0DH`8V1pz zq??YKDooF!SCj?kdG96K1t|%Nb*seZHE9lJ;ZZr>plsAR2m`hb_k=b@4crZ%aV+;u zg3>H}vdSnmubps<9a$5O@ z?&ZS$*O?=tZ+?;j`+_N)8z=XlLT|}Co6xN7y=E=$O|3g? zf>{aQ%zSUIbB&cwmjSPoH(iJYJUI>;CtSswPD@K(d`fqRYaNi~0y(srT{ENC-0Wuv zR^XZpEWSd!RKH&L527qoSd4?4^LGGF0!!25AoH-!INQGmZ;_;!Ah*Q-7l0qKm(o*r z!tNzM`UkN^9&cM7F!%Zo0R9y5pTZpklZK2QZ~PMgP6{cDlU&OG`?mj^luA#Nx11#W z|095<`CA)-R1SBz{~Dzv@(Ek$VZ{Fkfa79@LIP*^-G%-CK`aT?uR97QJo?W7{&VzC zv0L%#w&gb={~!Pe%=Av_mb&df2_=DqExXRYx`6ak3q1w3hR{;JlS(%Rn{gaJkCC9CPfv7FGOP6A`HpMlgZ2nx( zBi-b___NZ3Q?(hKvspty<ma0|26$`>w_yp}!-%Ex`?zd~+ z(j|j3cv~UNO)Bz0)yigMuc>V`=OP1Db5x5K*&rgU$PkcK^6%OGKi<9q zDsN?t7AY-7OK~ryKq(Y=El{99aVYNY4n>2zyHnh~xVyW%ySu~t+aA65oZfrad+)5h zR+2CC&CHklnfyC@G7~GC30z%HF2*5t^RB5B|IDay8f)yZAcu;*OQik#@R5(_q%RdB zl$m;85@vq%L-uNI6aeR{$>#4IHLCrnbl#~^!}&z4W~yBD;{I{D!gD%6By-kyC&pqX zAnq`zdWHKUs%kFuv#k6XU>xLLIfa1+w7oF{e==Hq)4Fg!!2k%?rq^N3D~l_Vc=`fL z?O!L;lPhZ-mumHj_VG})7?jxn)f0r z_R1zXBL-$XDV)%4Riqe8D;F`LpW=rfvOg`|6jPK{9TN>RmlS?(V)>G$p#h9D^Ck}M z-oB)ud+eN?xWUW1j&9k#y79h_Xus)dcIK|i#!fhztQ>J^2Aw!m{k-VSgF#fN)r6lZ zW6w>U?}p^1@jwPYfVH*iHe!#E?{8Bf`%#%cc%Jm@jc5w&CVP~z{du^E=AxU|H4fL+ zhTtlR+RFg^BTo(t=x!7C`VDrZxb++@$j5<07u1{}ar1rSSl8CWY0%xwJ>k*N=lN@! zBkU_gBaT(k6PHTP{09nV$Hb019j3FUgu924wGs>jC6u#sAgOt@!VwD&8}2e`ZCk@) zf22B*BmL!LigCLH_IA6v*E3Vc_&vgnD54MMwmTz7Q*-z9FG?E>W^o=WRYq?m6>nBW z&y$>t=+Pe(4Kp7wxb6T>UQhnyhv0i-e11BzIhTcn$9H;GGIzELDxp15ArA~V)R&EA zE)UA?KK5ab0K|PV%m8R8#IAlr5zCY!V^5q*+!5lD0+RZDYVX_>FlkgicFY+!(3RA` zv>-mqsjUBIpd4X#WxWlJt;-w zM%(Sewmz5V8b|sE{@avQm8#i%;BJJbK5*@P0C9w+!f%YcFS)xs#)vQ2g&w~)|8w2m6P7RqBg?$fSQ%1!re8eHKFT0y=x7S=vgEFpcFT9don4W z3i)sXEZh?z%eJCdUucXQ_0Mhs1?y`{w%3ofn@8yI-ZZH`r1xH4vTU#^3OPfJ+K z@S8zqjuk9G7*{`7xGi7vJQ&II8+^Ery;DFX_Ra+0@JG#u?6+pV%pzW1sH5FS1DX$Y zU5yX6taJM`_zj#LK7GCR*MM~Hg?alg6RP6yjqf&GP-k=Vr?mliuK-FF$B z_(ZyPFT0IG7Os=dULsQ+uIW`gG_0juW+twR&@erKm6<)v=fUDV={MQ@v^S2Fd(V%l zmpL188}xYAUpBPD#Z3NY!mc&*;3eAw*gZcr?&Y&q?_13&k;5Z#SQFL#%+}KDnj4`h zU|p_rkm9~!nG`?xq3gi_TKn!`nZX9;p(cluB1exnrH$=jIO9abW-OxS^TYl+`!<}F zCkszPa=(~P7VRkJe___xJ|yn^T`u5nOYs|>dh%bD&y#TXY;>vtCFy>`vY4lUU?SL{ zlYVtN>eYl3*RK|qIee9;;%|w+n?SGuCsoz?1^8|1qL}GxCKMbP1Sl`pn{AZ%0{!1i zo~GnKrv9BdOD193u;lu8$v=wzb1LxNTRF;g4>-y9^Bx2=B`ch2A$ zN!}W?)McT=jYSal$}rHYUNGy=B*N!ar2{ue@p*aVK>usa|c7eSN~sT zo}0+ny8ktH(EKC61pl9N*E0xT@c*5+BT{U^QeBCr61Gc8P1_`P)Nc|6Ge>>N}H)qx~@DPU&9Ix<05xXu z9hf+9@Bt3vHTqzP;q@KGL$abn5g%1X1O}`jX}2tc=F81b%6u zVf&4oT;*tbN2A&zN0LiR{9SzS6h2Bd7Cf_R`2c%Ymr!f4CLa8O76*6@c(k< zaIY1-wzbeAl-0B|*+89#tN%>NlY%Eot*J;=mWmt$4Gz{53TSctW}AdSfyN7A|FUxh z|Hs~s8nQ(Pu~7C<>fSp3AizEKe8l5Q&=jotf$9~;^IuITy63wseUyLNha%qUwbX(l z{@$CQ^_e;}wL1nk9D(OEoZEAZZb&N z+wt8WEC0n8_?y^%Bs(c`?=s^2)aBm~t{6Y=nSIco5A|;&1AaS>yH5A$P@n(xWW+wZ zf%@0;`nQ$+QrC^y)8d6UG2Y)o1pemN*+qR?OnkWDM`gBga`vYd`~4!Hn$hTYvN=Kc zUoZTY__$#bVDgBTzH!u#bbpCBR(I+TaFz_Dd(9(WOVeU(fHAFi>tTz>d)fqo*8$dujehuKe%$Ci7oT}?s49`kjj zsK^}f?YSN;P4u5pDu9ttBMfvnCO?J3ErqG7tlpGZ;%QiU7Ofc-2!T99$T%FP*%sme zkM@d7M^n$MFacZCQLo@*5((!A8SP1X4w1r8Peh?|W2>moT#1Y#pjVKJ!YCG4Nj01d zamU+A&DoVcN?ed}GTi6;dK;9Gq6te>+I)5f=6lS;*w1cQ9MCE1O9o~x!df+}=f>Ce zj1>%xtD_ohlCr6NSR?R*>oUNLIHgVmtTWZlW885ITPg~p!>N0$*^qJZYr9@_oNbiH z!o}-gV{v?%Nx_4|E-P#?!AE9)%ISc`xyx9(rH+(1utKWFWLN6f%0r#R#yL}EKde{{ zm`$YnB~)OBMlNIHCk6*-rWCS92*t-j&(mSt6Dy`~OWtcS`5?kp39rwwAOi6e)`ZHg zW`*7NBNntXV^+7vdk;lhxHEMXSCEz))ell02XaX0D%sJgM3YkmBJN`LAEv--1&%#m z@xK~UH?f2`P3+((&{+{BeC+jbP@}j3B!i~-A(`01E`IP2s(!K2R5!8ARyS3J&(Rc$~|a)xpvyDsrkt=e{T1|_4hkL*JjEoRQw zmzVS-GI~nXR|h*i0P$j%dZJ}266^LR?$ARrDaL(b9qZC z!K$&iBZN+qoGDs7)VI|+{nGB2KyhU?|dK?@5v&xHS=oQFx_rrsi$INvI zbT&e>riV-~1T68n%a`J8xbobD7Kbf_zg!%kK-m#CK4owXaDp=g!W~all!n;+))z*% zFHy->)3hQA>!D2;-0LVdv$sGPAiH@5j#PZch^}CRI$=k7b9CM#z>L)urqv${f0cc( z*He4qg#df1eRYBQep%*eZ9|>!t*wUxdg826@tc0goXhu~a=FuSlO{C!%kM4Uft}2e z6QYXxSCQ@Xm0ti7B#+56VlFAagbyed4TNWd-oMNwEEsNXct4kT_qH&rgJY>AyEt8= z9?72F1dsnIMsL}!|86gtj!uC_hNx`c*t&N0w8J(GHhTjlKen;9TCzoPOX}W9&l~NI zILTK#L+g9iX6Ctpj7swhl~r;cr{e1!Gb?bYlIUuBp&0`}kXy?m4xF#~<6*=;wCY~$ zI{4@mejTQQ8y8DO&p$4uyP!wsPUZcVMJOshR@{*FPEZFO{Y12d2VoqVMac{ zrb5}V*XGFPBM|c1w;WL~FSb;FsFa!Q`4(KS-aABX{ltJ)R_n<~TjO(TBY`!6v|Jg` z8zsKwPxaA9foy{!m5_>y{EZhuJzY+HL#26au-%Fw&mvWl%c;%GTJJp1N(xE}>@@Pw zt6o$s=Jr6H?7g2~eOXkY2d#srgLg&nZK;E2>_&??`nZhCNDLdaYEZ~h%9|&?N1#-+ z*AhWIwNhjDBJd*c9#Dfmzk7kuf(Yk%YSc(zngwY2Mv{^{kvqv}=*FacGk)3d_lzW^ z!Tf<}!;j@yrS4O|Z<)me2)AAYP`Q*?!On%lx{+(d(Z3fUl$E38IFpJ_II!e4Z{5z zvTNz1zHb1&Ef$AC4X1%b*E4RBxYFlK%wIr`&+UsGG0%5ELi&Rf>;4g*I!|MNZ=aFB z<;PUKW^i3!ct+PEY>GVl{+E;V<5c}v0v`v-Q;!^x8c)_;!drvCr{AfZ&6C-h19(xjF>*s@*~|7>l&u2#f~_N1Buz$yuRzom6bi7l@&G=NjNpG zsP!1oMNP;4{i5crJodZCZHMYyrp7sT*EVAOYOwdH8&{CH?v+M(FAO|D?XTfo%W?l% zmYoW0Fix7sfdj%d?kl2zdNw9uV42s3&~0U1WsnXH={Aecz50hz!z5|H#J;7-%u?)3 zaQ4@ERSP~B>qT!*$agiC_36F@ceWLP1{RcQBac#8OHQaZ$QvJg9^k@@3cJ()qSIu9 z7GCv|fV{!lP-D5oqpZgq=rr#%_eKl+hBCi`0H=U5KM;hplgeO!zY3b<#wo@r2BXVh z6|bM>DdEf3fPSc_#_D^2hFx)4ZlV(luGttDQ}Z{x;$~`I<@kml_KzjG*Ef9F{088U z37Y3x=giHGzujmf3H^TooMLr9()moB4UQV?L~S_;Ybo#bn*YXvcISc_+A-$V9|n^d(*dz zv=yoSFF=gcj6{4v@EuLRrE4>5e#d)meh@l9`}xj)v^%wE;A;5}%lKl31b@_5R8(&_Sgl=JuhSf-DiFM`Q&>|vK zahRZ%k*<=aQeSYe+gAPsf2R0c7)OuCsfu!0*1pE4sBqbD#rPX|4CG|wWa?1m{cwVD z4#(D-#;l znbZ7PGjNE1+rf3YhwI+wnI*hJz6t`H0!!x6vzaBv3fz7)t=UQYsh|oKk#6yD+py=o z4A{q#3p0#t>xj7H8-2$I0NEr_VF`os!ibTJqfGUIVZ2k9bkvL9)WR2pext5g>f)M#%Ml!w$mb9d2VbhlGs(16h0 z|6~1an+8MPQmrm8H!n8}FB=aN?vDU4;mok%Jijnx!RxzCgI0a2ovP5?w4h9`j&Pog z2bge6oR^6A8dREpiSPh5(Ejj*kc4mRU-5Ob*-lPIt?u9JGsCWgf6Vj!KkEBm6`=iF zrbjnU9BxZb9`k^zb9=z}Q<%SptflcSMN3Ch=Z_w5tBaJ!rDZ9 zR_VaSWPm$AuCTcb5&zaD+Wbtm4RM=hcEjtVqIEMn;&zPLg&IiacP*{qrJqYQ*}Jcr z=t#gl0!;c8ixj;)a;_#F3^^F^8?LS@;|deCn!e32=yyfbljN6Z33rxuhZHo@R3D1`+PvZa9oFV4dZ!<*P08lBXaR%m2ib1DM+E%iOY) zDB!zaA6?Y1z-7Mvf-X;AzK6k5+o10F_1eZtoVo3G+XxI3gfq%erUgqm(f2zDMrzb}U4TNuw(5J$qi_~rm zAe77N>L+J=w7pF8@2qD0|=1OtBuCPq!y zHi*I_2`BvT8!UX(bmc@p(Dqx9zx#b9^Go(<@sw`wP3iuQ?LNw!bL3B#vL4BdOWdtb z??AJ70yCei1{9qzN;BK=*KLgQze-oS$-w)jvo25TGQius=yi7N$+_K}WB8ba``|E! zV4drwUOmadCTxs8w!1PZ`5O+6-dl(vcJL{eA%V)eRokY9ykcgEpLyA=fVpZz zZ6aa$q|!k2R8PLpczOA?;N(V_brs#ynmCUOB0%Iy!$iF%^~}zq&joR0R64afj7`Zo zkh$(sggi6%u(W`65!7#~0kP5c#EE=o&$xQ?u=}!uqM!kdmuG`P=xYmCQbSRl#zxKc zEFu++)1m?UPF%$yMWOdX?**lKEl~TU=`J?NVrNL$@ecZTvfb_T)kMzblgjN5 z)&N_bg57$I9yxcI#>n8v;1d5gV7Xw1Xd8kaXH^mrL=ur7pj1(vrNKUd%l_C{XJ2J! z6Ns4y!pS4ZJ(`Gw7Mx1xdZh<0@{3*HLrrLQzBgw!1kL7aG+!{xxG5_h^Yx1&!fX^@ zH}gDu$acY2EC$OePb%CQ!6@ z&az@MLvo{wOGeRu1c{QZt9XJ^`zrG+OT~QqZ55l>>n=mQdJ#7k_!+OHnbj=uhAS%b zQ$Gicp=f2k#F@2HTg!~Qs7f8fDeo#08>^v}N-Vq?7V84s*}&>^%ab5++AP3+v0Wv+ z2V7?M!1yp)g?3w5_vOV@4A>_>njFvA!+V=$%|YUI!ge^>s1pHJ(X|65|DB7`y%ypV zy-Ua39Tn%hM)4>er9R4n{>shIa>pS-W9k(+4pc!ey+p0>qwVA8F;uFuGEQc;UaH2v z7E+PAc-8v?^@GRwEd(@q2!<2jvVOMB{S|R$uNnY%C@Fhu9EG>AjrYWQa5ZShPtri$ z4zDMyt|EN`LEu`boTqEtM5?6BYj<+Y?=&2n5v9S{PdbN5Z_>I~*9iu>$MCw=Nc3ak zL!J0O@p)NHn}>yZOWTx_n|uk6hx(J;#`>bh9SlzgS$yg&9j1oXj+thF(+&~0A|a?R zB!~35^}9B_s0=elMm_Y;YT{7Z{DGo6PXZDU$zvVd)t_w`wil# zCW$#rF?Ghv*OnHSrhw*2r^aJq3#ls?N7#e<5SgTvu?_1!=C@9IkuFxUBwDc4@By)! zWYlLt{b=!6IM!?8sRKLLDs~Lp=^eHEQHh8(>sd2Xb|q8f(`(JbpA{H|p{mAmq_K^L zvqxq*+Eofi%w%rYM_fSf9d9I0|#Xd(&G=jC-455#*J}UIu0|^P<)}pLy-;y*4z|JA(E%&K-oz2?P60 zMV5{S~SpJOPia29vw2HU1{OewyH8l<|_@l!Cj^7J^CVEv9I|KI=&TVZN*E` zVkEGmPor*<7bu4JOWpxwKX(xy`L-sIH{TxH*+=6<1>0@am+V}R;w{t4?UkDmZ{}DA z*rp6z6e;xi@m@`azp8RVoRgGC@AIF#P1(4EW8aq9)7@2wn%puztICX+Y!T|$sZ$^) z=BHc}N{nmaC~#5+{r}moqT^VdnBHZLY^dJ0nxEe)0%yF;^8*>Ll}$act$M~v1#6tW zO%4s%@O|o(9#};#j_h3dNu~F8Iz9mD_AF6AI(`I&JHzF2T7veyKZFRUWGo{RBxI< zqj?k504#SY%&`h>TpYF^ze+flNO}Jqt9>Mb2ql+RF*@c5E;V~CDlJVb5e zdnt+z8&e^1mn~V8CL*ksHP53sD*}~TZ`qX9vvFE2Au%Vxj>CrVdRwuR!C{i}neR(( zUufQZr&dRNLMuD|m`pMDz#lj`JbdIf zNch6{+nLi|o9+lM!v+YEQTxBdTlHmrvXRcKuZfM=*-{T>S-YLQtjMrD(3B)^R)0HH zsNb910#PS-e-@yOepWJTIJ}txUsc#*bEz(UQtQZha<;FEPZeWaVP#w6$MVIvyGH*b zBF+{_wbdFRTdg@<1>L61@Wk3kXnN%bmg8ROZU-PhtJcS%o&oe4``vb>dv&8e;C_0< z^>3@FyOb-la@gtcU^^F|4<1mO@;qo$OezOkEMn@6w7smI+5mkMHU%_K(FhXz1+!yt zpK%>R={rf~+_;bC1A-?Or43pOuZ>1|DjqE7dabQ+8{%&`4JqERRS-V$ePqcMFmO+0 zl|XOD>cbq{Hfjk(1`14A*1tvf0~2|rmNlTMn>8?Bdz}|oXq+aKW! zF{fr2{9LM2VnuJJzSPWm>xup^RJgJx5gv4WqO3>eP80*RiaG_~c7fRl6 zURRQ}NV87n-yG6aDM^(EX^7rYjv0L>>EWerP=8makUwqNJc$%Hw^uT2%#Xk3 z-BGo^n&_ou<2$fYz&@0zS2t~=rw4lf-RxH;^xqJnNtqnmB^Uf2yBbzHLac|$wzG*8 z-OX8TpYauc(Lm7H|I!Il)j=~omnhtGTf{22hBB*V!6Du6L}-k%D5bXF=<~9ag3%9c zNkeoY3P^=lTTW2kKh(8ntLa@Ig?acPE=hkAmrQ17U(;M027eb!IWg6`LdxIcJ@KON zGaW3K7scY*@y0!mcf55XSC>D!<-n1mCf%DntFxN-)@I6v#VaWZF!RS%sdv{d5w&BR zPna0-S&?s1EcNt3JTtzb(o5QPcYXu#;n;+V?j@6D&p9`ul)w_i>=VqD%3Ykden!}I z3p^qauHE%Aih1%Gemr@(tyl3RQ9QQ4c!QToZAv}yZMi{Oqm&4$aZq3d`kt%48G zJw2Y&(UpQddl{?;y%BrUk@5VkZ5nBGFHd>rrLQ%RJ9( z#M8EJ$N(}3%Rxg1VYM2*!l6&o(Grqii!?0EJZD}Pbq05Yu}+I^`k(yqhKL-S{cJd$ z2F=h8t3z&ZMoyhhgB^#rd1fieQ zQK-^;EV?7!usW(>Zi^ruI>qLY@Yo8g9Feo4OFY%-L~V5w{fa8ZsF!MgmLjPym3FV8 zm0hEUua~_l*AK5_>~M0t*kW%nG4VNM>hU*{`4=2>z~1xgT;cTs;1k9r+)+mjIlksF z+%I`$kG^uvZgo@C<$&e1uziiL%4s^f2KoX>2(EO0>J4koE+Kwyn=$jHDjqLF(l!Ux z1ydb${c)Pst)}=~7?qpU3sm_N*cV0b)i0r9CvstjI1DRx?x7C5#>*>}>>MUqXd2vz z0Y#N~dE}83*~HyC;BB4thhdcxT)}du)X;o(&5i=)w9MJc}0(NQyY8qkvd}n0))aaAo!hP9r0Xo>8LiJ;@41L#(mtj>8 zQi~}$9Q)&L_V6m#qDw^Hpc(&Yu&jpX-cJt+xh>(|p-`+Aimo6$Q!eZ>uNHZZoawi1 z3~sDs1VTX0=M$;6u3anSiOjebFTyx}JX)%l)NaIGh0hlOwbwX>92ExrdPhQ~aCt2( zqzc}8x}&cE1)prdvV3uLv4|`P%TamaVYpPBl6~E(;nZQ0o`0@?JgiT9hyvZXd8S(L zO=te6{At}Vk%aYg>U+C{z?x;oBm_m&B#s0BT&v>lgQWm1mWi5~zWwnxz2C9hSJ*tg zwXIzmTfm4oRxXFw2B%}5aq!gGw&}1T%sLhWU}RGCt2uTmQRpC>K4E9WM`m@h1ss+$-VgM z(`$Ur)z~;|He$W6EiKVmF}ZL7ZFMmndi@vy7Vgo z09r1Ybc0@G$9k_heP#0Qj*M4bXZD+k!_~UlyX)xe2RfVL4f^~V3)QV6Hn{`r`K@@$ z<{Ue7>eS43q$Y7*P@G7sl@|UTZYa%AzEU;e;d>m*SUww$q#=qAY z#r6&zw!S=A-1Zh#bbfnYj-|niF_L8KYt(b1A28t%HxF(r>|qPDfSxtN2kx;%Y^bXe z+FKoOrg?kxdeee%>@KGRu!eBeODVM1l$hgM*~x8YdN<5Do#L;r*s4|TYJ+AUO4&_ zKV`hl9W>i&+0NRCZP5f*fXGT8hUW}#dD;36##uTnpAtvrL`3LzM|`LFPA)&xLJH+SkCqAe_NofL%s_FK&>ZEEt+Z=b|q;GR)sD z*TPuvUGkn;DvVL1vI(ekh7~!MR<-5}w(o7XMHeCQbJ%{oaSfa(1ga`|sx3Bca3GLP zb_7(_Z#bSN$>q?J0JIk7>It)&6Ml!uy_F^nu}_%JJZguD<8OnNw_fdEW!3x6eJ+2! z(mvngRC{MGVXRvuC0c}ZE30_GKsLeQnKy?KlV$pNEzf|XtU6cyY;G)1Q4~FFlysw` zy@5X6o&+>}49%d+36R!6z(w2aJ1#UitSl>xobS+08<Nxxsd&|QnLFC$xjUC@vkz((;!9Py%wn&;!0J1k zdu8wB4b2Gj4v}YMlv;kQ&Nwlul6_?Q@+praF%OU9`TCg7oP!l|I_RnT7ljn~7l}0B zJV)uh)X3h|_T@7v%3j8d80=(CiNw_y`#FmWh_)k*XpOm(^^+I9n5QE2n6-P>!A=du8 zXz-gz>8qg*CCq~9CgU@)kLWXAnO%D+v5q+Q+d#H)3#%N3?-eTK_MHA$26B7g-290+0|bZY zi~_8&gw-tw%igUv8+B$t$s@^X4t%1mUZM{c@m6+xW-b|X=#K&$o{oe0u7gZcohPJQ zpb%{B?ss|ZHa{O(#+Oe4G-g#I$H@hC&C0k1IdfXyf>z0h!vov?x*o>}8u{SV+>3u^ zWlD=7^V21NT*XXVS3b+Ur7f_s&KEMI(Ca8T$UotuYY|X74304J*Vw&0CZY>-99}uvuT2!enZR0) zrT^%V1$ysB;6{_=krefEWtf9LqLRSg<3}06O3+=Fh+Bz$)fFV|7Vq#a{Soz+wKxrX z0Jg@PXySBb8{Y85=QOFrS<=ku1x?DtWAmwrZfq1JH*KOp;~V6!EqJ+Ql^I6cTczcV z8RtNvq2WaND%(p6Ji>IOWXkRF=flq>B9HcTFcE1#eO}k8(J~N&R&B`aS9w`Wz}WG) z;&zqy6uSp}H%70NNhZe!Yg{JsgIr2dIY2&yo%Qb2N(kO@$CtbN@fjYs?H9^Vc)E&6 zU);1y^p|V%EM^=AgSHRx2v{dU=>!s9vdY`J9tw{<;AqQNa zho!3(*wvc^puT!j3F_Yt?NReHmoq-Gj;QDA@a;~6S~Fj)r)!Srm_e*L_HMgQmPND5 zqaKb(F%e1u%{HvB4Dk~59*Fia6&Td_yOfkpnF>5R$^#P& zo?M)UV_-x8{;^zhkc{^!iU^g?QkJJA7N=jC#Zy5v+1t+SsIKpp_<$ z!(;|IYy&U}ukmp-(l%R)pENZqU-%NaE0#Rj^rncC{E)?y0DqhxZX2_o^604iFle5q z!)QapB2C}d9apTlBVA8%L3kQUSypPcT^}L$O7n}<>ed%IStrymFB)lNI@FlnyG#gl z=`*tmyxE-xtpj08oDN&6Mn;%&K||eP+f-8_b4M4F=gSb( z`&&!7l-Isb;!h8Xo{Diui}J}OF!+zMQ4)3aogjZ)JqW6OtZHA(PgIA9Y>+$+z4%Hd zOi|dJo?SZrK3l!5j^cGvU{4d$7~uw39ZL=q)vM25!EKJ@`w9X{tqX#1IKVp*-^c2L z$+C3MB{6W}nIha#%YB`c*9hmn1eVJ&48P4w8_SL~#PL8wrzle3N98Km`C2x#DU;B? z-I-KKU!dA+pxUv(IkBRAOrhM;MVDY+A9xaxMitup0fvxt_f#TUTPCVFclGlD2@ztl z=Sa^MWb3ukvwNLb;Z+wk3S(doHjb!Ycad#YoodAk(|D2GhaetLTg`rG(*YMIQ2vEV zXBSiOK2?s25!8{78JAp=F%%fLCsOwb0TF&*8$AZ)r^Bc2$;U2D#2QS5 zvOZw<$5!-IjP9dD)hXt6g^v}(?$`)OsKl$yKb@9)RvA?4E=YX{J;nlh-{4j*PwKxP zu#*s~%SxG5+Q_!t=a_jb3eSH{s6!B4N*a_Gmmau$mJ*y~boDNGr4FY|`N@^PR;iP( z2uej_$O$BEUY>$)l`q;0(W8WT`$7$@f@dmi{xW5_8_CtNqJ~CFP2MooB~Tk+7Lj2DoJE0j z$DI(hmWvCGDxV)qtadz@IECK{2*>_$J?cjMmcjS)X&W%dI5Z? zaaAIdn%yz-qR7k=7;vY^R6=W}qZU-Is3_N#ZP7@4*^%D1A;)O~WVehDL=NANvHM-9 zX|)svN<5CLt2bz`Wq=?aCt51>vDxrnPmAZh zfWI>g&P;e=5xFVa?%Fm%4+Dp4sD8mrsyb@(#DBVQq(n@DPs*zusnH9g>(P^&eNS#K z_t)Ofrngt>4hnk;0hK6~2e0Z2X^YfZoXy7{7~fTc55pgNnK&nfoQTHZWXQrGULCck zpWuCd?5~@Z;q*?4>O^$aw^uvv#NiF)9Gf>ziGQR_58eA!m?G+G-h~*f4(`pVd@^p) zsCAR3yAZCU=OF}dAF~F5df2EmXl9|*;{#XIFTBK zdY$fV+}z^bMc zWH0S9p>^s?%w3aHYuB+G6V2v4-u~l3SsCue{`qwRSTV%08!V*D{(HW5Il)DUH}#Qf z#KmPPp4hm4ec_R1o4Z3+*&Aw&VI%ic``l~>nlA;N2_%5PbJ(3}O*@4lCPjZ&mN1TX z{L!mv81N`${-(v>ehsyz67j)7K08DvI=uRNA`mod1#|Z$k2f&BJl(mU-!V*v+;Y7;kYq+sm|dt{bCcd<=~`odi+X(Dm)wUqJD{f&BYNhkCb zSM^$F@?j@fNXr58)^oRyVZ^a^UEy2?d>$_ID^~ zQ?fh&OWLzGco+t*BbWNO9Ae5SU)r=KwLIu!l!x-AnA5K*!0h!Yy~_X1Y! zb)_;W3)9Hc705}21mx_Tv`7zgHgY5jUg$QpNr=3%kJiQCL$Q&0>Z0f;SP0vVr^`c# zQm&)s@z&gS1Cc}39|_q{*=qKnD%h3pL@=|lJNp%+UOab6&DL;Ke_)fKB6Wp6nhPD6 zvRIR59?}!m7*-%_tDw&pc^~|V& zAtBK-lgZgAf|{`go^8=AqFp~ILBjM!_In6a6+ReEG{yV0U2v#{8D|T=urg$nH3mIz z5dd`_nJieaDhe{#sD&=c7hp|;y&09G8JD7}FK~dARUJR=tnd1mT>|=|jTBHEZc-PG z-{r9-mQkbsRHJ80^B^KO{^;W=rDpR-bnfbB!=>wtv-s@3OOOnOZ7#Y8Bd=N@4s)cQ zRGh2`KkxYrB?y3?y)twmdd#J35bDZbZ(S7PqLiE=dKkj9S@*gfmMW4jHjvC;xrTAa z+@xF~_@@^nYMrZ@-_(@Mo{a+Z%o;^lyk0}T5i)t%cL=B2lZczQfQ#N+C4Npp<)avWy3EA^ zA&TPzOOIy0>2N~}@w+Q2c1$g+X)1}6+VEG51EN$R4V=eV&UxLgx`l zD1nSqDK1geOdvT+u9%y?KkHb`Aj3GpnmoD~IID~TYRU4|>PpK1)t!2myj1SX#vX_<2PEkV6@>(+IA*CSBj-}A z8dqA6m|d8n9`oB#(@1#^YF{3)D67U!#Kx!seCI+L?S37m7&PVn3A6fPco$=6OP(*- z&08kWu}Vtq1)(c-Nux0y(>8@D&tHt2j3082+zmjsMAep28b($Ecn~GiXl_%wy{3>7 zf^bWxRIoFCd>f(SrlVrl&B+Ktv%?nAKc`c(mc8@=SS5dC!LSx$RXQqOtBi77 z`W9c;sx~TheCI_{vEjJrkk9fst+|t`XT+K`wam~m;{IZxEPmp2cSmu-%8uPh1RS08 znGSzl)@cb@kz$JGm~frpPA{R<2wHpsmg)uuj~|O&^4Xa!;BomzyEbQ!32|)9LET^n zhHn%s{4LXy=+bz&D;KM@5Pq~lkwqbWK?y|`5WhZs)lLzOLi7vo6DfQxr^uj*4QMGs zZ*1Ko_GYL~z~D#Fjl8qbby(~AJJz>ulHC${^@H>Q7iw!NDSu#n>kq%NzL<4MF>03R zuIofsUvaVG2SYLH`2^bGXmibZ#?w;pPHWd*xtC#>J8x7bUhB#g`OIykscJ9a_8K;b z^fbp~isNGOgW;>cLdMyx!G?jVOaYVGanA=9uI z5f{KX2{)1$%*2aP@Q$g2gf`d@;V_28gzucIRo9a`QDgetH?O3Wt8Je#Yhu1FjMVe) zL{-(W^sA?(5A+x;RgiH{G|%-2>fByse&}G^V0SH%D70XDO<1tRx&CFJl>pXpvhImq za-995*xhrLOZl&|81aC0g~LGj7;7}8no>I?CQPlMIXrvF7Po`1E8f?#F8}d4J2?2c zvHZM8CsxdXZ3|M0dJN{^&9RIz@**QIlF5!J-6I`7e_h#ZP}U8N0`Ff+kUAl+h^Lfw zAyOTqgWt2_<9X3?>`Ucx^8w@8ou=s1tH)$E%eV{APb*)#7_jF9CbbnAFX(5%Vyo79 zp01B0tf0i}BfgVDvcpC6*QP`)+X$D zS%|Xf7tl)KOU6DBI1{0yD`aoqpN@TfOAi=P1Pl8;yb(DMev$Q@li2CwZS>{Q)>ZM6 z%mB)VzCj^Ons|8enGf_I2Z|@6+SQ{lN98c3w9kq0Z0BKxd4UTAw_ETrn^R%d`fZ2C zp{mJ|7U_CJViXAyWC~qDaNijkuKq#{L%ciGT(9FEmOz9j+M>xF7lI|_JvgO^vjdXE zcEuRJyd;7tDc~`#x=v{VPHAmc+`e!UVJvEpOflKa46uf!#L2$yZ=UCT$YQAz)51i< z`2<$isPo?QJ`R{T8ASwFu2h)>s!2(4$w2fFigq{2T42Td3_x(kTXBWwr)#S@!lNxwROKF zTz#??N$AxK5JJ93Xb?>kf};_R)!inNe4LMo`q(aL!|Pqy@;NK{Cu)wF;^S6Pl48vB zX{bzxDRag4*{zdF&?vB=lerTJJ#|6$^>8>hKfA>JkA;Ro;HVNzap70`R7dk;M1wY^ zkf9&+u}c}eRGTA7xHh-F{YFctqDnd;%IO5tIig<+0{D2eguH3_@eUTMeQBqRFm%V~ zs-G^OPF@>&zodoGG%F<#c9W3L!x}m0?2V0QQGh`KeMKFzu>RCih#Nx>Q=sRw)7zEi zV%3iE6CT#rjar<~HV1eL@E9$8&Tdu%uQge~ZfJyk!HxyfH9YsPQKGz;pWo@MJWqJ> zXlS4v>lzp#@OW)3R`k>t@zm(ZO zd5Jdk1AG|ih=#RM4#Bxl{ zUoG&Y(m2`@X_3yU3&;s}51)_;xyZ1~B$z{S!BPN`<}asO-rwkER@MkYugXi=DT$rG z!^TQ3VuvL&4C!G74#742qh(KXR-6VrQ0QV$*q}a%5Mh2;K?$7`j;gn`hWoVaTP0lz zod$mB3PY?Bz%pw|r0+*2qyfQ;45Y11(jBYQ1cs6hF~pcj_Lo{$ncA%>vP z3;xUO9;_J)#$MLkWc?n-$ zR|xP}UgsVr%DPB(*WoxDVrN`Q-OdmwO=k9o7H7B~S*>9=LX>9kp9^aXM!dCRO7~57 z*lD}{K=ILwW=>iNLqUYZzEDvsKqmztK-R7Xo(+2hC(<`8-EWG+;TPGyMR;$YM2v~% zER)VsnSgH+D%(ybcD2 ziW1Z-;O-yAwU@kQIM3R)cNdl|PSy22#vOscgGQC{Umv6=M|xuppTl*#ygPrb?t1;Y zt{T8k-n^NRBR22|yT@e!@6O!rdYwDs84|mZ{;JB>$<^ofE@T4Ckn%h$?LtlctrRwR zeBzrAH0hZzb~#LUl5M{BN@5(iQEr4e0DnKYot2cC>W4!F0>2yC*@{pOpN0qwCg*q* z_||alV%=96R4iDgZ=RAFqTbbZ^H+1>8kHKRDaZ=sO1_<9f_Y1!sG1b`##M1b&meWE zkR@O&gj2;pu_=0@F|YwB=%`y&(u3bg$iIVBxPaHhMQwhfjFz?TmsNc?y?r{<3nX_N zL&lFyqQ;Z*i0Cafh_29N(>H(hBjv=vr}l9rC0oF z@GRPj9=62M9c#S1K3KOtszt-Btw^f(em z@Am&I$NL$@1OD$gUR3otsOOf=bQ9tO`nzhdVW>kdO6MdbP|t0}|6%W}+p5g>w@ss@ zbO|g#y1S&irMtTk0ZDH}LK+cRbT>!}0wO8h9ZHCFw}2qeLMNOV$C<#bmVAPgg`Bt*!`J9c9#mN}FLZ7x@?$)g5?K`Bq zDLWW-G_5n3@H{{XrE0aN&g0c0Yh9a9(`uk3+)MTPc`}hZl%JD4*1h*52d1s1sRU7p z8DKUuZlcWUhc@vf{u8n7CU_b-PucQcZz|m0t;b75+9pOgeP6J%n&jp^w&t64uRJfP z$a_kjCcB?fZ!iW1`-QnlvLWmE?K*l5^rbl0o5T@4seowYPOO~OQg62ByQiuV}`oPa!aFa$e}$d6KQ$7pPqF_Xj1*~ z$kqXvxSTLFR;q@{4)$(hxu2pzy-41EdS;bJ`x0k`I4}F2l9o1JTFr3812r*A_G`4% z_p!nFYMQMNMB>suVz^4EL{OqK+ZA3j=c~mPzE>CIwV>?EQe1&R`QnKU8rS(a+DQGa z?ruXj8sK_K>b=;kVIdGCJ9@+>}Qc@5vn@<6iRyYv2X=EZ!8@_=8mJn~z?QQ79V z8{_W2(<)ouIL#o&p06N%e6T{M8JSf3`pm~!%7=~E*C&CBNztI-b^cn3l5sE%!w|s5 zFm#>##)Vyeh7hsx;}!(?r1V|kIb0GN=4*o{l?9l%Nw;3FY7{1`_~7{pRDs0;y2QK~ z!|v3sduSfm`6~lwP3>M?h_yORY}sS1>daF&id^V?pGUvbR8MW>cWkxlD8|aHJ&bW< zL#3V*+ZW)V8v$#o#6?%cY|m#i2sBn;yN?~bq}9CfeBOkXI$A*fd8Av&%OZc_5{aA% zcysjU85l@!D$81MYwHgXNm<$-UzaH5+y0;@Es{k$plY-Ps6{{IP$Zk0aaohI>@cD% ziPz-}6~={P&NpHkfBYz=H$`Z4UsG&cdc1-1qhPvBu8wy*LY3eCVck(?MSDG{l6&88 zFqmNftlBV1QK?n+W>a-{e9{a8$!?9TX;p_JEl-px`NI%q3V1e1*r;;s>$hXy#GBPM zeLciEiCx?hXhhlx#*sFE+XLNMZJemo)<`@Y;Iqy^U`vN@sM!F`z+&rZHfLs`Hl-58 zUZ~am!k{;DvBiaEM8C?ve95KaL$~^{JJlH;n{h5Zj()+a_5qQD5lP!Fbkf9v@beGW z(ZV=QqobFKtnb*VQ2$8tyt8zRvuPxLMGSH1V1U^onAx)hHiB=wZ5AWPZ8|oIl=UQ~ z8W*j?Xp$+Rs!d$9`E!)_y)*A`uRP#SQQnL1M|t&uPp$cuyop!nWsGkHJi(S!nOw_Z z=__F})$H1vRgxtUMa=_`AU-~N2|6F(Na}=b)q6XQ$0e6M)Z|gqX4H<({7DFkwUwZWEm#(`O=1sk;AouELVvoPearis*fI`ibk0(OU0}9sP`tEh8hZ@ zZY^=ftMfUvm5)76J<5*rRFssP$8g4H|g-UovY4n4Al5Q0)0{(do6&a}ztIzJ2? z7jxu(=w*O`TI_)lvGw8;_~%$BE}*P&fwos^e4RP(IUx@YnAkDPD2s+*s>DQPE*^$N zw=o!0?}3v8oKm+hh3`Y6xcr)lH)#5b%1=|T>npxw@V7RJsdsR+?<))JxGfPO7dlY+ zU{)pQSsG)`MUfZoPHT6dA#n~0lb6p#n1?-_e6bSXw*9K>jOy$@-v=5eEMj}Jck&OD zXq-j>E+?#=eu6$3-q3BLvnh}gzsNGfP+Ay#XsInWKHcQ&?RzRs`8#O%Rfc)y8QEd^ zXyFvT=&aG#(T-c|gcbSb^X)u>k%g_e^ypFE9qOKBA$*lW08B{iD6uDwdNDIkq35DXi% z4z3}Z$ZTtwfBtgGE4Mhc*_*eSZMNgita`L9uo@tbw;+donEp&*zhHaZ^l+xc!JIO_ zwC66vr(Dqw6;F_FjMtwQIwvAP>jwj5&lg*>h@~#KM4#59IHB!iCtB7nc{d|5Ko{j& zTa~g;LleYl`d`Q+kUnfd!^6y-m$f`J}kDc4$9|KG>54;WqCU`g^99N=Yg|IDGOY%f_-2 zh0GT?;jL{nx$Fg|=d3BE&u%#Jl2M{)r#%4z1B(X~9lvv-{qaC^LH@e~P21wP1Fc#3 z_X7=fu4r*W;dadn$bpuA6XDcUXaQ0Pk8eHzOM~&v5;=xO<#JJU*y#Y2Ly`gXhc<0n z_qB>mysJ%@YF!mg*f*BS&+{0=|R>~7l5=d6OR^Zw0#_;vh5Nw}8So#X*8lZ=2K>{3 z_LJ{3;GYh(pM0MI|8$`Jx{^nnEG@{(A9Br@t8#&rv z42Zvp(I5syf7fp@+Rhu&1L!LQ!r{t*00y6aHXvSpZ9qVBG%SX1*BlKJqy5!@sQ=x7Q24U}L4IXGNc#e0Di5v< zh+AI_2ot`ieC?zoUknJ9mZ&2FYpc$)&BO7}y2I%2y2IS**Sdq(Z@PoR7u^B*8@huz zM0cPSbGxz~Q2f_K-1V&)+>8NrzTH={5Z&R?mF@s_r8`*sqB}T$tvh)Csyjp+;=K3B zdI`}T9IkYS$-n3h2x8?>SGvRUZ@NRoDMWY3ywV*iIXWyvy7Oi7$-ngB6qx}v?Lhb- z9ARb_jBn`t>7huQRl7LcrNxK^%tz}slgyp__aL?d z@I`k}!1;#mpz^EkVD<;yA@z6NA>(V^!B6t(V`*~oE8Rg{d)dBbU+u5D!)Mze&3^}5 z>8X|v-3zNrz^7bG+sywhXvTT*j=Py}=ezsCF2N$XGFS?)%(~M#vs#3A_ReqQYrK6B z)JE5C$*+;ByK;-G)!^lP483kdM?Aj|Nm5tT+TDix1|Te{g4X0{V<+W-k(9OAE!K2V zB<`p6r3hFmy819a-29+mGjvwld)JmmMD!NR=vL$izr#r5*j<-X zdT~oM`kIVR`++S1UIe^tLn`UC2sG2jhdcm@^HEKLT=5+B{ZZ->=t;2k!op&#Y*-?s z3m5me1rxZiY=xBJV1@<)3C~6_0%+_YT{t927w+A|eZS9LIND;F!;o)u;n0(RqzgwY zw}z$&>B0e@%W#cJpUZIH1Es%n(mTI(;WYUErVD5Gue)%-moi-Z=Q7;ifKuMS?ZWYj zxg3A#!nOZH7f$l33zzlRE*!-F)5{6_r3|Ms6dQ8Yg+o~WW*5%+Cv@R}ugh@X1Ev2< zPP%9lT_jVIn-?-71gIC+Ou#RV+~wuT^jy4|t|^6s7znp>qoO9V&4+&N>4|ReL)cE4 zAz^u1>`+M)q^vCHyy&tPjiG@e?`)#cA+8?Dx`5c{d}Gn!S%V8L@NOIVBnkY3ek}43}40=xD}9MfHd-3jct)^)X9_A z$5*Qnx#d#6GWa%2Z`bFIZG>QG9@eIz%*zROZxqH51;(lNJgk;m} zGqaW1q+-WRAn#rz4ENBGByK-MRfXZcu!QA?RN01-V=7m#s%-nuuc~YpU0P))b&?M= zzEs)5&b9$x<*P26Z1#iiV~Fbd{Mu!MJQMJD3EGbZXuuCAXg?O90Y99e{aAno z{BVNyV*wfvfASmR{O=O99}Ccc&xrF!60{!+(10IK(0(jH1AaI``>_BG_~8WY#{x9q zhY9D81!%y}B%J>uKm&d{;rxDp2K*bs`P~HV#{x9qrxVWa2WY@gC!F60oWMWJ3b;ad zTt8Ngt-VMPi=9E>*(#&wQH}2`fqKc%p@eE#u!NPx1LvxZ7@lB+;DYd$)5t#r^d`T>3C;9%A{!L`+SfkgEqOa08lU4`>6JtSnysP2lQcD za)65LS>waoQMf@luWu-#SC+l9a$zEXmqN{9zG*|a^qi=l2m zNPsU>BsIzVg#VKzk}o~Bzg;5vi>m0ho$W1UVkY<_Cn1iOftSkFb^8>?dP%IG4CrhArd{#nmFnull zGHvs%*V7|~!yT7xWr&SB-TA+@QGw4os{SWO*DZ*T>M=hEAN2*2&Z8SbbkyZEE=T3^ z8zj!Gk;uR6sD)p2RE59jsIi6+9kuRj9o0Yb@%kdqWyj4G0q2V0k}DlG6{4f2UFoR$ z5FHh;&H#V*Q8mB#s9#(K_IPGP{q~Re-7g_J>Z>S-jv9QWqsm!@14=&0Z; z9X0(c9aaBtbX5K?I_kzRIx6r-A2r;u9{e{tD%zEf`pgELeWjxsUg@YSS32sW(orR@bW|t+;-i{;_EG&m`=}w@itG45{TCfo`nuS-Wp)PHM&*cZ z8o>is5!HKf>DDh_kf4tudaro-Gj%(?5QmPi?TXoo#U($pnT|_r+pXCx8y7JAh>TRyQqch~fLMpg-9giais?9zDe?>ElGjcm*Osv+NSSsj!Mc&|h zFG}q<<`Gkf+bgtKukcaY{IDpMhuq~wIE0382@NmskxC#GbS0NTC-)BDOoFG)`dvo_ ze)mzuL1LGE8y@RHP|Sub$J*z!Zz2Dal)bA8!}dVDxMUs~3K8YAj>`Hi9d+{Qztd4s zM7z6w(NPVfmR24B;`&cwOl4Y;ljuYf6ieU-legccx~mbR6cvkf*=Hv{LT#*S1j8T#Yf^A#W4BKKIMs2=MFRNbOgHBbfg%II=VH%ixG+ z_07oN2S;}5h2!E?g8no((obdHKqy~x-}U<8%%<{Q-)$lgeB=u=HPR-3vFRV{J= zN$xNWRnEolnz#^=&8m_Vc4nDKGZoG4!50CD-N-P{C+!OT+o-Oy*2U80sm;L~DQzv? zG2S0EK&DVD@thsIO=KJ+Shi=dFH(YAhGOk1KPJcZnl1$i^vvu;J$7ZM{|(DD>xRD- zlR!?2d~4T-C~x%e?!%?nm>kIB2tN-kAU9CT0B>+~?$C_`$5^A)4T&hRwz5(dw&}>C zY?aqsMW$fwt^8Y#8H&p!n0C&a5yMzbM2CtZJ__Ke3|e&`U~BQlnt{SqrQNvo&xWU1 zwSwuFHTuY-;G2-?;=?!>jHvIepjVxbMR7(~Id(OmTSXV(rj?64OTYcf;Z=Syz{=dY z8D0-^F$t`1*qX>48QH}~EPKYbZ1LhD;_Z@Qt*vrZB(%jC>GXvj>4&|3J!vrl>GNJh zPW@IDZho0>mr;hMN?W{4;8h4dI73y~$1khyIR?2Hr}4?PCnB{^#5zJD_a>4|aVHR{ zSC766ql?>rhIc?w%R=1kqRD7%2k@qBzH*M`NDclJARoUbE1^l}Ies2U6fec<-LzcA zb7RXV(M$`bOEqgVY z6+IgiTy@7D&gm+DgOu1(=>Ww`wekf6ycng9rTNF}Pwx2|5UbzB$E+9YToAa==V+Fmw|`@m{T1?&P3!SID`=xQ?$ z>|M|7m+zRrfL7$+MC!+;s-SOT>e*9m)wVf(O@k()KMqYH1Z7wUF;Wc@c+=jQ>A3S6 zcAUyy9e0CQqa%5ZWL9pj1TSSHK0Hvd#I>1wr6LW9@w8k26ytT;Kw`Ws)>c$$T1bos ze97_TB%77R){uh|f6wt^6aJLrc|Q0h$1^2B7JO)Q=MOm^B*x?B*U>!eUn_#1FcVVh zye#FWqJau!u5d&PvtdpO`}@zuEHeGsqqA<{9HyJe$J+T)<9g>L(z?m1Ef9m zUU&63cS#D1PG66Y;{aj#&@{SEXe^ez1pBZX(iD*l=_yU%(U|NS7f9J~O(smACdkqgq*lFxf1ht*>LdT->R91MD{n3l{ps6KdsC`mq2{f zvnTVPSLO`Cms0v43u~20cz!9st-+kM;x!FC22S((bk!LAgY9=qMcxPq)ptPvye$EW_Y9Oy&^Tv(EKetOlv~3i+Nkz= zbX<;C>qZY)=DVx`{QE;4oNO3PEjJ4AZ(I>pGQF#fxrOj6!s>Ybd1Fqc1^6!zD}2S( zqTII-D|Eqch&4a(SH!B$NBc;&clI^x0EDp4&q4@m>e-h;IW!(V;P*v2y_R1V<=Rhi zO#6OEtTmf|UX+6%)_HLVVkJ@iby2Qg>WPRA8@1iH5bJjdD^RHN_AiJPh4$NsRXDK| z@gFDU9z{9-x+sTdc3MlSta)omYk0RMH{?$4Q(I_`Jg*vR5_QB@I@>$WLK6rkeS2NfOdcd8zIw7c!OWybGAWTQ1&-e}7b311fDd;{K@mm;A7}Og@ zG8qoI^gIe(-{-8i-#;naxLCl3djISghi_@}rF6Mc%l(i%nPS0M-RGALTEz@(q7G3G zyv{VY*@PE&Uy9eg290C~=Nhm9=7WjK#_1p2A6!$TcW7)i!FgXvOh53^1vAOGRNtvP zma)UMH$^bA&#d#1XO5paiZXZ9Sh0(xCVyqE|FHWQ{|;F|rAz{Zv2N@C%2=yEGge!V zUm5H75G(L~##&JMKVYoiL#)7O#%f$H^Ub}Hq958D`IWJL53vH@-W&OyvF`uf-pIda ztlvYdz%P3vKa;US5G&=cdn12FtiYf4Mt%lk{T^Zke%9W|SB&+0h!yzXGuGJgve~I= zp)%Jw;c;a$?|JiwHhZvN56X?8T@A_we;$+r{x^$qcI4o-*P7UK zeRV2}kXU$DnPs5nIfbLeq+GF{Yf$aFj8SNf+^>jQb}uYLg80?o*;&1)Hx9eOm|Jqt zx{Y9Yl`A}j4OBO7GHkE5V&Hib-*6`dvK93%B_|~<6LIM~Gsyclrg-vS3AAFWexepXDgdFf6fYiYRe>19{{D{k#M@k_-O5_p`ftnlI;+I)O? zoR0$tIPZZOUW#y9sbwEAAtGNp>ds_JwuJJMeb;cmIQXPVA4MdKmJ2Je38mC#<0bdN%u~GDVB#TeMdQYarfyb#zOF2o1PsHMe_H7aZAM2fRO1{YF zSADN_P2i=g#47Cz*^|fliV+7u@7-AnYWgj{phs*A1fNVltuHe5`ePl*`(XEL=k6AN5a?rU=wA9o$}QPP6lRSQd}tMOXLKK*MOCod%^t;04>}IIJ}5d$ z0N!chad1MOZ?E>+*c0|?qI)H^nu&5>4tu^PPJYV3nk=(4*S_G?R`sEs&bj8@iXb?V zSO~E-y_ynM8i+(~^t2GR2{h=Anz4I4jZkRp8S$!w1NUWbx?*=aW+nGt(}95%UCn*` z#mKydEXV0R^*q>!{O6C+u>Y&YTkouyZi8_X>B`w_G*oV*xZz$_foIdk;VaZd2i|B zkgS<7G6|gCnG{WvI-sm*bz|af$z^FHjFdIJG}h@qiw`$ceia{PA`msUrABdNc;h(g zS*FNi))sZ3`qoIcgQdor%eo0;-bxnoPVVaR%O6D3&;!6!#yMq;XTLhRP80iVsQt2W zB`Ow(`*~BjMH=U8LZPJONoC=Cm`*ZHlyYN^Q9(WRsG6xZGwua-d&Gj9o{c>4P3}cL z0gAlGOe&i%(|FoOZfT@-Gfo4B3>vruWZcp(Zt`N25P+Od^vU&2qO6C-Rhbjmtorg< z2EA?z!4(2HFXoKPL-wX3Vpn|lg8RxQn0S`D$VydpQ0v_>ag;dQoA@eTxPz+O*F`m@^s-a?8e$}H%W{)n2iy5zQCG+);>We(M zT4;QX-oILWq{nDPFuWdL2)28y&W9tc)3sYfH!zp-!uYxA`1K(@Pg(wiz^6N8rzC{2 zYd!RklMh#}TSX-<)leI$e!X@*hW?t4Q+W(l7YWt06o1={x+rKOb9lqA0&#lqTELbz zpk*AYH+%XB9pCh|f2Jn!2QQ}V^r4s)+A?RlE@8sFs7;5u!< z?;S0gk*;}fp93tqyIxNDv}qpp%}&}U!ay7N2}}Y!Scuk3xcLLueDaXl7Mw(FA3F1zu<2eN?9NE|l?Fw26)ESm^nU|%U zjrn5MN_1K#o%yD`mguZ+V_hI8u#5ymG5H@BpQ3({iZnU#?X$fLn*PYqRR&d0HwH9s zox4A6WixmBuETI~+6ORk*3g_3Da0HbY2j6*Odk1v^&+@}K9@ePT+StX% zYZ7yf{cPIw|N8L<$bxV*t$_NVYTH^GoyOY@zx}nEn>UpOoY4l0vO-|R{O(`Ve%rCo z5PK+d{_J%V^kOz(1ZY{G3(-p^HZJoNbU6qZs!;G1hy%6WNo!}?6ycJ>l{HF`8Nc2D}*@> z#mBZLH1g&w(A3?C=8M})=H-paU&3rw+!W$W&WTeBTevX_m=m+?!|vv6AkJ^ZCL9nb z<_3TdT$4+$CWIjqbE|<)XGDI#Jt5(0k#Rgj9{~6GD2elYz~%CwX_wOR>II3CAm8HZ zHX|-V_P4$~N;iz#Jhx>uV>3}6~ZS6?5;|K#e+J%z-2Xcpg&^?)DE^_0Gy>;2nU5BN#B-oK6YfS;7> z{o7a%_$j$wg&+knBE)Vznp%4{fYMl(Ucf6i_C@GCXi}$U0NcsiB1?5F*#m zEPG(I@Wq_?R;&l$@W|5tr@7ugzZCJCIw7w8^-B?dRVRQiPeowDKl$pZi0`-)e|;(9 z$G|P{`KgHihTQ&dz%6h^Zf{8HNDi~58urvUF-(>poe!cRIZdIzK0Syk>gdxmxe%<) z5==mAYLI_Q?pv?27N7A_Fn}_%O#E`HOq}|$@L^>};3pSxG9)5wJHHlKA6@tKdXR8v zU#_f{UG$AC-2!LXBYmjjQ3Es_D)g-?7SW}`75%ZF=9Le73T^|PXK6C=Nxhr!DX6ett=G)mBZCjm zy{+^xR#gT880HBuyFZe{oI?C4w#LL^i~&X)sy^MXON#={jqU!YJ3WS|+7#L!<2FC~ zQYF~z5fF_cb&qU}hjtSl`1Q_qB8yU6bZ)$PV9zIjs&p6X4V|fj8>H%sEQ0!f1M9`Z+YeAe#H)*`% zf=aXE0wZtzQ-rdn;6E^k72gQjdab@Ys$P&ST*eQ zPhj$QANV*xfhZOV4ebQB72rh1^(2dyB zUU_)OkRLK4yg`aIMd-d6kND2AR;vk6sy~3I4q*EraX^eOr!Ua6*}8aq-@JCCz_wV~ z=@@&{^CO~3S1wE&RaO%T%5LI;Xliw&^fbF&-X!BAq2}CjyU=if!ZQ+MER9W?#7ysw z=e~%dZ8%xHE~s+;A$pH&ZZz_|e9;h}E+|{NJtqawoPBbQ>(Y6b4FoCp?iYBnb+11+ z&R+JQm2pT-Ga?6oMNX(Up#pSkKJi+}W0FvLc}UUnYXyF(bpI1_3;Y4y=KUw=_KMt| zk{3EOR`XqO-OI0d17*qS25*UkHHBjYUOFjw$57>Mf*q93wBh@N)R$QwLT^iZlLwsG z80(Wu-+SkLzV84?J=r_$_P3xYc;!{gher`5A`+VhUNwZWQh(s_4%~yL->ZG;XBftkT;SpM;7Rw>zgsWq zol^;7Jos(Bq*45<^^)F8rC;S(wmt~5bzymWBmfEc(oHU>(oO35EwfpdI_n)*En%a! z;1Vjuso2NW8%mT1D~zyS4#+h3Ht@$!JpfYT0(jXo`8Xn=1Yb*2@l4+5#zu0IfG!z~ zgxm1}^dCUBgoQ?{N)w5e9*TXLn1dAbguJ28!{UMIdWkks_s+K4OvxXb*p0-+IFDcp z{Sp9jO*1Zx%oSCSwPlgTDD&s_I=N)znh(N<7}xtpd2mGs9P}|fyPshSk{1F`-=CA- zOa9Q=CHu1fU3!>%;AK2ex8u*?V*G(5JHTN3q1cg}-aFeN6Jw|8nSB9OjRB(uZ&!jH zQ<@#RF3v;IT;x4UB+tQdDpsBQ8?06Rg5fWQ-UU!|`Sc z+u-}&a)a+f;7X1-8uknl{YIT&t(FtfDdTnd!&IFL1)!8AR$Y1UaZ`An7wShZH1`<+ z885JkQvnJr3smR0`|Wj@FmA_O5(d7W`Lh#`o9-WTv-PXM;N8iXLtzho2HyBdXcRk3;i4S)k`l>DPcGN4^!be;&5`QS^Qr=2F2+wq zJX2zR>9UY#A|N>)u+WjW(h+DVzz*URV>a(};1aio9b*ybFwi6n)wj4qZGIv=@hw|bXs^Cho09wjV8q&E}F$8-HaPN zd^f=Y0VH$uUDHhWdIg3L2%}1FrX>~=YHx}KCtj%nXAxHJtPS;YLCLi6@CMeO7PqJa#!mm53`>C z?YtcDH~Vr99kBGj?U%&c{q26qm3F+^t4tT>8+kD57lLh?_`}C^vY|nVvAQc5+x}7J%gmo?EEluL`7+!iFV2Tt*QElgfaFVK+JQ&DsUw;11_R)ryV_z~+4pl_u^fiHxUg#h$g&$qpl<2z6J*PpIIZT4``!gSKdMi6{% z=l%S09`HBqJeN?&gAug9l=Jjle_A;Y_-;Gz=a=(<@3!;)Sk4ob#uL3N=Y7ojr*dB3 z<-qLARi20qn=D7{%>-Vr%SZ~Ih-mjJ6XXj00urNFAIV(rdJl~ilrV4&!Xc=J$EV$r zhb1#wKp5qFLqs-9bz?1==E;CvdmiwHyx&W#1(ffWou*kIRd zAWCw4^9uFJwX|J~^aq8dVHF7W@CC0R({XP$Ak%RJX&%H)E8sF~5I1xrc-0!jWPYOP zl_FANAO1plhdZTx8uExLWyyRBxG7F(j_5A6hwgOCeh=5)!@hGgvjoUv4XOB}oe~_7 zcHF&X2MbM8O?WR(G{}vG47stW-Mlwkb2Vn&L-hx1SADtXpwj{yU>g>Dlg+_F*Fmh% zv0xoy5F34vEyPB>cV~Q<@ybT^g0$GohL&rPmmzN|K((cxw+V~0BxBf#H+3Ajf-en0 zBy8TRF1$;OT1@JCJKSgC23y%$ukthAmiCXVPB!o}C?R{bQ%I3bZf3o0eECTR2$ietpVLaDe~XTth!(u(Vj*00crvP} z!oTLQw|hTSHKx*TA;JUe9nag#05G0BNE#Pi+fd@eEmMr8cRAq+FdDSz%uDYsOu@1s z5D1=udg<~4><9vp-=52BoEP%hENTx$)5(Jc5ksv(Nh3Bn3PLqxEt6J{T9#vyba!KG z_VY&(>`E3A@&)8xSqSh6Ma0|MU<^|b0s5&9o`32}|20zOG1`eyM=+i!2m~zy<`D(m z1@tSxf!;W)&cpkhB0)EU9d18utotyCogIkPWL{iL*Q`f0hW-mDj?_NeP>Ym(*T42)l^fm*g`4fkK_BMYbL*$8I%8V~gT2}Kv8!bF!WzW~YB6BY zs26=CxzP3nDRwGbz0$NjTw7M2D+a3M>v;@w@pR(-V1X|~ z8q2oM`GeZyGfjP*3OKX(kG1rnFPmNmjTZ8FlHeMQHcifYPzHWf%4KI;M7t0I+lzy! zxwH$$ab`w6GFG-A;p2sGC zS}zIuBQ1up^C34djRc5}n@`?=RdB9+U!?$XkKp(WK2LPYnY?{@WMwY_rIutxY6TvN zJ`SPRniwI$^X7K1Q+3BfBw7nnaIgf3805VH%(@1c;1c(#b5R9k{q5~$Miz9XlAHFIGd~jcqOqK|H({C8|qT*24L&ldXO<@t< zt$AMvCR{rlP4nOJK`IIa-6oSa4y-S?_qfM3d{y!ecU!j5Y=gznv@Q;wq=iSck-c^2 zF4r)q$LaKG1w3}~3;30Kg>i5??F6ToeDmZkcRAD=`4}(MlwSN3)x9dQIw$!Q3R5uB zY$@X$Ymi0_a>>7pPz|X^(tc!hC4`b7>SL!%uQ>16MYaGW-zCKD_Yt|vaSHNj=M zZQ;i0re3D`{*F^_S(HAsn@PtD152Bw@E4QtDWPcY2gJM9tNinF{k_^?Z5a@&fmWC8 zJ<}}l2iI0@Y*93_%1em`RZJdFU8^ihsfpKNBaFb6HRK!Ruo-uRY<${`Nt^Z-12qT> zSnP=Aj59EhjnB#}27+rJ@zRLNv>EXZO1B}3_|;pAl5pO7hF~OH5Gh-bB3O0SZ%L)? z=t0)p>X>54SSVrl#ro~=h^?2c`_IcPZ#!fA^$B(hc(Ye2_c9ZnI)HU;AwLStC-f(+ zBRZ#E3~x^AhP-p26gV%o!BMs#3X}#}d}f_D%wh`cj^5x#TaXQ4{KU}?f8T14w499j z+EgXMb{No2RUJ%}{<>}RuGD*KSKhS#7Y%3g#nyYy^UKMvG(Jfp6xLu@FLIV8DvHe_ zLwx|XJ2p_5Az9q?zWC^It!I~7BamZsb6Bsm_Qu%t?L4+Feu`LchN(MbS$q>LxtdhZ zH{;yhw5>9k$TzIWz|k5Y%A0u~CwL#d&DShR7e=(ryBN)Vewu+UF#P!XQkNFEQx2pE z{pG_BjSe=F2Vnyp%kP%9Sf3uOzZH5D(ZFrFBl(0^md%hTYMzL2=@iwiTwAgG@?+7# zrNilS2KF-bu_0kps1lP~uy&hCSV&9$Imu=Cp5ZGEjY`19y))AP^d|uE|9%7hfBgoq zGXCGE|NlPy|M%(tzfb>9`1AvLmqQ&5HubCNu6$6#&{1fP#ou=D&jpN!>vaOvM= z6wBXTs)tR0cFZo!P_=?I7_SBEMb%EfOU(hl!T}KgrLH2Y9@}BN80sm`3K!LSsw4v1 zx)Z#1F;C27=i-LDUWnmZ`0P7m2LxxpB&~zZBH2o`^5&lpq&WsuG$0(ry7$+Riuq{T zmShmI9o%rtG=dw?kkVXlGNH4d>6B%ei+ZnhuApgREP$6@?9qe1;)04)r*YL*#PNK6 zqJ#$oF6J7M&RTJnt|;!q6FI>Z6C#WyOSz=HAcwRSd9K=ulwQ`Inh%+%84a;qI-jhz zv!51up(}{k@IdReCl+D$Rw-ZH_~rTAry@@vzA@}jF5j>d+a$^A4BW;B#5d+8Jzh)2 zNWpp6W1ty}cBg2)Rvd18YEDK-_WErVVN1E{mRs%gXRcX03+o1!tSN8m6p!+;x0APn z9;lXefUtPy7@jC5aRryC&uqi@$%iNhldyH1$Q>qwMNmOF*TVYEt|#VRtbz?tK{tWI zm1mykrEzBH*F)&KOrtw)Maqzn8j$FE9MKVaDyPJdHBQ~A>e=e-z3G)TKcHwga{;1;*6L z+k#XMYc9?BD8#l0FGo^DGC9a&Vw#cfn7&aayeG<( zNjeZ|fnVX3F!MeJWgDKJXaQN1Z!j&^Mt?{l1y438QS2V4_g0PZ5>uwNbazAcdznt$ zj7<<2$*O;MH_2U%v0g(vDEj4M1V8^LD{vz(h!vB0FsLUJ74M0SJy1CP={oYub1<_7 z2p3+ZkJNqwe1;FAg)MDe1n=d8umC$jACk1LsExZ1Tny67Ost!d$Bm;3I^Ol8SbE*e zk1{!a!e)qEEgCHdcc$njj7f`N?V$=UceCM|sFakM%0P#pKqyOD7Arx!-Rw{r2{(m; zS$(qiz4^De>^?lcfrs{RBl*UFwrVCTbS!J(0)9gQ|R; z9LXl=w8w*q@{U5CTC#asY;n=$hbQeSQR>VkBN?F8<~9|PTe|U9Bz-r~HLpKhCW)QB z5yLo`BT2J4(2V4D#d!6MBQTOe3>47clGaA~)lI{^Y~stm1#A6Cv?7Q%55jmuV>?+V zY_K2FK^fd>HegE#*-LK<*H4E!Sa3HQT*C@-5^!TiPaK6(>0K1aiGt|RB$>?vC_T6t3B}r(7=+PNXfwE=^%W~14~Fr zj#E(A)D&FUAUElc$6uIRr%|T7D_p>1$`y3nf>}TgPA@=s-jOpSwN`aikej&pzx?e# z&)>k~Mj&Zw+|%|zvPj%Z45EF%D1oGR{U>>LCP_8WvUxChNSN7wa853kYB=8?(rNiPQcw7P8s17yQuX~sh zY>XUv_c2W#S{hz&T`n48C7j66wgIN-G-qQYy%B@wed&dsg30b!es-UkoWGJW38Q~=@WuG@T z@?Gx4DfO_y>Z%i?jzY}?bdqdM?G3yccNDd{uZLz#xNm>_csOyH`bmoPW8q%rqw%W* zPx$J`d^ZW*cPIZei1A3f*gvR(tu6Kd%?zRbNnxO32JMw733;FRP};8)#Y#qewxhtF84Wp9yEbM59ldgH9%aR_-cNeB}9L1G_mQ;;(>7@Wop zl0{+m(pTpbepa}GiJ=8P;szN&XMxptKxAMgJP+D1u_jx>k-IW-DhCAeJ;Xozjl`o?yv-Ur6Me4I;0`!PC#noQTf;*lO*I&W*M~=K&_U1{Jax2eRT%RTXXd~RjM6Hel@~x-)CV6VGwdo#QB|b9^I*(l+a0ry= zOebc~NBha87B&i#GKF&Ki5FH~6xe*EX4u^KN)Ui**2S?WN*3rCk|6omPhHv33c{7+ z1fJ`IWi3Fo(67K!d>}4pDR7YmBo8C~c*xMw6wz*mU+EzQc)ktec(Qi|h3-9Nv&CLr zd=Fl=0C9@o=|-Ysr9%Z>2;119*ET>P57&pMQUmQP4!K=7gp~`P_YG>N4Pz?nWD0RH z4necs@Nq26m`hQ9Jd6PUGW}4v5qw(`M2bGAgP(B{OJB?w6<#JudII*<1K~jHft3kC zM9?6xJt0UOyrB$|guVa^=z~~*4f|$Z$EQb>R^6_BH&j`;&J`Gh>!e-Lgt_o67S+7B zqL^-~u5?c3_Ci1vE_qrrUh+qo3jg2WY(oU7MS&|CN1h4 zC!OH16rhf&k7pYx(T1-WFLD%YAB_U8j29G>8dio*xXY2Es@3 zc6^<(Xm5?&!wiOI2VpT)^(DMa&=1$g*&O4+PNrpmyegeCx%X@$LC51gqnpS|ChV*? zqBr3g+DSC~y*RL!4TMx^fPDo)Y}lkF4^LkAifGHdfPyS4ZC))ZNr2OdLD;aQ6BA%u zBuEUEF|ri%!l+j5?yI>~ZqKTxCP$fp&W(IZS*9Pi%WgAn5=7n%Fsh7nMxT?n$36&^ zYBBM@7MJXbMWhM_K|OqZuhIyZixptn_sf)(+Dfe zwp_&}BY_;M6r($2>U2P1VvsN`ZUBk&F(7PXx$!t=kivwDjIHlrh(b#%MTX4s3xkX} zNq=rLMfEf-;@9s7-jxQWMU$tR(cM+0p2t0cPm!Zqx_5R_lFk~A3E>*6%oH?M2?+!E zwXP+sL8H{EbpYQ=TE$zNuL#t3Eba?q=aRa^c}E{g1-V~nH9o54F)xj2iS(gm^p8_D zB;`?vL1bv4Ox49n%n#}1)e3rq+s1=F#R}zU)wu;rb6fGLS84XsyC(;p(!J$)ydzLE zLGcnNo3~EGq+DAubkw75bCyEYG&WuvqT%dDBCf1zaa-0PyE2U9u>mh7M5olp1ZWat z4)@2qWuS|q1LF?&Z_DGXo`RPWvF{J>ZsWqAl0G)uo6x^=zm)!8KF{KKj7dp;on*gG zvR^0JuaoS5^(52&b&~zkWWO}oFHQD;SCa`sG@0{1e^2=9n()^(;V*~CFNer4hsghF zhse?<(=Ug}|7Tr-zZ@dJ%z?kmfxpaw&;K{fflHgVzmEQ2NB=Kh_%C1hFJJiozkJ~> z6L%ZN`W$+Wqr5+ZL7=U`>j-+Eh~us-M=&I2UqLOm)_&1v(3?wXa+HQ0p6xE~R-N=7 zv{Kxa3}_9Ut|vX_cNRYnDwM0s_0le(2~RElu>FX$|2b=pt@P&VJQ;GOpexsSd#8er z?1^-R1ipH)@~gS^k&hyp`fo0z_{|r>Gn$Jyrbkf|T!Xk2nPIj^v*?@*SYm2kno!2u z_S(_k=F*jyr6Ma#HGT_ps7HX;Edt1@R*?jZuJe$|MeUW#&}^#`ryZVL_@Z*dsG+{G z8YZtF){a#7LwqFB?!6He*QP-#iMnrES|oKZU-d-iG0b)xt|qB2jF)5FYfaF?0DulX z02{R_U#>r532giO_S(ekUDMe51HPg30^{6{48{X3Sv`wFVmZ83rl(aIE$jl9=<09l zX2v@do2{wX4-14-V;ys#yF6z}GuUFy+qtW^GT88UBm$-Jb4G6}qlzurmcR{( z9+a*_S1QFZtlX#UOB0k!6UN;6%)(Y7aS;KexG2f3zC%dqPc+1_Hqzqcv`85N)|5yx z=Z(9~VNyi`bgBL?@cHF7VLW8GW8v!(Y$&r$gWv6>5YBvKP!Ig+h&D!~s!KLFq>Yk>augBi+@d^Xkau!{ND4YE-n}W9cZp>Qg?!-RLkK3kZ2$ zT_dDwbLZ!;>%~-gkJP2e=1t`~cYUw%(uK*X3tp#D!CH9Dc1U=&gg7;d{p}-4te5!d z_UEFH*E`d}n&tpG*4@#>F$06+THroAUCFfJVerAlyO=mBfuNDHX(n#$I5%xl3gGH_ zLMgm9nIs8}=M!-27VAw_V}UQ_1AVxREOOR@b>pF4&2$OLHd>m6C=?$-kQav`#B0jTur=! zm3XP2Tay0VX#2nr2J1^1$@4IdU9#!8q`J;EufvVm^MxUHd>Crlm>PWEZDp;;Qqspg zxs<%Z2$_4b9LEi8NQ!gm2Ds708*$8hq$E@u+Q{TsE%yG^@D=D&8?Ypc3?%FyVPeTr z!V2n5MU%(CR+i@hMR7h4NeQ4y;+o7!Lja*wL_;LD)i9fZq{_&EJZ^8BDmJbLTH>Hu zDP!4AIT~&S<;On3m5~UV0pMr_L%Kl|1NXX3MKhdiT?xJsQg=YhTlnX=1;fz2Ywe-Q z!KFmw{>EF6@EcV2y=*S-eeu?uAa9U1dltjtRGS%`b-mGf{+x9!lvO}Q0?#<_&F8or z2{6ypqeRO7z*cIOpmql@WE zJ*ombw=(`c>v#^b8nNva$~sHCb1Z*;UqNV6U0m}`jqfKtCd$6u6HJ-a^^wL0UykD5 z2#|8YNfh}Y#VN#+k^}ja+wO*+{4qW9nubZIYr5z2&ywVfZNQxe4E6nCX@h~Zy|CK% zjSM!17p6()t!7^LDh833VdYV*Rv#yVWg$EcT$M%TMZQf0fnW=;KiC3{$=7_st4wFx z*u}V^z6%1TBHlIx1GnWmCgXLP^sXpXlRp`noqb&8AbR;;`gQ~s9 z;&ntsrp&zZWqWBvR3kvBoHaYcEN;zh$Uk51l~9c2B7VWDabExu{$yPMOA~8`>Br8> z0TE0mbWI85NMPkL_mg%l1aG-84NuZ8{a6A`+N8Myie_6x9vsnid?-TnqkO^7EyMV$ z;!XDO@Vpv)yLp^BLuj5Gk>WDc^4-C5Ed2TRpK;qtr%co%-;k&{HO(0-SHTu-O`Rd( z$(jt-!at{<{xFB){gt<&E%|+TYQ$*3c;vW@6dTP@HakF~XPKIrY>MeTm~_8q`Ic!g z*I*s#rYv-{6-8tNF9tCMMNISl{4*xk&#l9qW&S!s2I+Wg z7R^^ZU%TwFWtGa|rSxI2%AQTF_+ENzx`p>X!~U*Coo@Fb{;+9WTueV~J8!LYDD`9E zfqqUOF${|8cu#h?B*}Y0!A3#O%dHspznYN8UU z_)L6qIgGZb%%B`*12F&{`;xCTuRIP~SI~H;`uxV8=u;^zoe6;0+lgLY?|T7DM8aD1 z)q;z@G2gqO;i!;kPbk62q}S$h=?0%&Y9in{ej^l*Q;MKm?=zH%i?LAS*9^k~a*`{0 zWffG-uX0dtH2a3BKC3h;(0+OpT(tb62cFLPq0>_l6iVz7shazy1a<7f4vB$FompF7 zs{3iN7C?Vz@%aZJa)o_8b|~$&1yHS{yH1PAAWZeGYZx?mlE#I-(627VFp41=lG~yF zNQGZ(@+B&73wP#EqT?mE>gRnwA5e4*!zwgR)(Efj)G!{-d=#=H4mWPVqdgmY?Qu|k z*n8jqY5j&c6zIpFPuqQKO9S(~v#Z5wU6l1_jQ6QUcYku!>q)CL?%YK94 zjyPe9?V$Icj><H>I)PH8ml6kGj=N zNH}a4T^-aU?U$e?vGzDMOMC#)B(eB&+n5aKV;DE(U|QRN^ir=dLw|@`49pPF1`%%z zZ1@~L_clwDO-A1FHQfZX_y?_26bfx&%VJKg^2=NxVuhl`{%sv7R@O#;#0z=_z<9wN zTkcjYYI&d>e1tgjBUS8+hPRxdoP!8tiL&yR&N=O5|8m=7#Wn;@J=Q-1*a}zzfAxVNw*X?JfO-G@F zw-M%ka)S}mHMV zkgZUo?_+Zcao^j`=ebE%@WvCH24^wx(%*He4XiS>-R75i{S!F-s>rfm3^C0JxjhJQ zJ_j0cFvk{q6u~N>E@fFrYh2ad0nDe1@&$I;KDgX(nU1neoFwD6wtPVqC%B3=2#kDG zvzMx1GsqtKp2uqT{$LXrA~%AB$lW0!a@X%}{RCF*kP!KY8+e@xn#>sr14vg zDnM*J&G2*AceZoPVuG{}<>k_t>-Zy>fkFdQotPzAAmyG~(`rp&obUdM}Ug9zMAB#R}Q_;>7v*0mzo!y^F@DZj%ef zfQ)_hcVdZ4Am&AtwQI2q7lF~Q{3fT^rcDAhrELvlPLvOvxN`d`4}zbTY*&38`y#{} z78ALoFRjzY$K*oR3qD?p&0Ipa52+j8Ws!XGL3x=p?>0|^OiDEIjMaVK2khpR->iC}ggS_Hm2 zC-PNO&&w$4e6=T0ZMMAGFpY$Gf1B^cxzNP!2yDl5y(GdUxZyzW4>jFjEAUZ0G#zEY zE3J6{-T4qmWt@x1W)`F}&J9u-Hz2;zF?bos0FW-SFjBwRz=3*b(wmxwMuX3e>->~) zB{tjuFS-RU|9*gguYc9Pou?k+U=G*3wwmL}CLQ#;iBMSnbCfqa!=ZX{%ucwAoVLN> z+7}#~G^P4>m|K=QPeFm6io$pGbsEPl!8v+)ME5!J+#1tii8}MeK~t;|uol>2h|h}X zJMb<48-K4lebI$-Rc7rsl;ph)!*8yt#i~^oZ}j)g2hrp$zwMRNuN-L|B_Oe@9!o5_ z362jiwpzW7(&ReLEMSXMV9+jmZRNddoQ>l&>>oS74*#_>`XICFhF1mm$VXlqm-!2# z@T{MMH_t?0&|bU*L7h2_4NCK>q@hv7QDs1cYrQSP>vtHnp zm$$#Q((Q;RNEj_6G+eJxkkA$D9uw}YxXfM&lTiA$)6MDBgey$jRdR{Vvx{%=EC?bL>B_Ym+KV-uGe$2xq%k`Z- zj_d-9ElzUxmC$Gs1E2avU``AI>-`L46)HzT(teS6T773Hq}=L#1>9J1N1ic8u&Xj0j}_lz#8#=h7HkP+%kqPFm{+fYp4WloS%=gPE7DD8s~ zDAw{apN|H`t`lhMDyRtctYA2`jS>u}I^$}sQW+90YJk~PwIg`sGMHiliP_{QjwxKU zU^aCIl1(LZ2Q+)9adhQ)n{hVm#4`y;c1pj0W{1x)y!R@>icy+*TKs`=S&@KuO>plE zgl9Or+$ds6N6$Nk4H_~&5*3#KN(d#%Pk1`n4FauVjDU>4hN6*>5xKPqw}EbBiK<9@m~IPNaSSomsM1Ul?RSM**CCpdhZ${guy8LdVPn>ix_doA?Agx*t5kDdH<(}*{zUPo z1nZ>lTybCi0YXuV1$(l z5@8)A**K5T#Fl6PBdqW;;A+OM%UvH9x#-J@yYD0EiiwgoDXN{NqX~Mh z$HMyJXwecd>{r%bbqsK2?k2t(s%7~qc@lbms8Sd8?-B(AT4Wb7(t}_?i#bqmfBEy_ z)9*CkW=86d?jiw4T5opW<^00lCD|&&DnriuW7cj`gb4x4J7itNiR2UWXuR|}y7WY` z1OjjIl_MXWQr2#zGHX#XRgi$v+NAxAuu8$S4y;rYnvN;R9a1 zeMBA*tjF;qY&*9AhHYsfVOw93iloi{xYKuSNXcN>)(ZAVq4KcCy2Ljm>)Q#P};*uqMeKtV!zoQIqrz zQj=s4)+8NRW(%9Oe{=4~QD9y~NIv4!)c1|jSw|T|H11gHgvpLlS%(sHFw~Oo>Ur?3 zoyAElRF~GJrQ{kGY*hY^enZKY)vv{ytk@;he6oA|Tuw%U^|J~c9*`t=uc5S4$9}yK zUK#oG`1~yxIRh0kDi}HQYP%hC_z^ja4>}cm_t+YWDb>oJPiQgQGaNU4IQ(0#r4$u2 z18&ZXt?G*iNa8H|Lrc()pl{z)sr>;oK;pVi{>0z>d)OK#mb7kD>TF2g$zH$1wDOcf z*7A;PndL6P^d(9by^BiIz!{@)Z6PA>hCJ#PWt;JJT3edIj$6xDf7WtFwZ?mEcnT$z||RIjpv;)MxT;l4kXQXT2Rm0Z&jt3z2-(k z^Rgr@oqP#cQ-w;ybysP3XDMed41<0Hm z$^Y6Ku}ma_^Rc|vhSJ9BE^km6@wHNP5RJc)B2_LkuM~HTANEwRo!&RwdXe1^l{>Q2 zWl>r^T4jb7)pf6Y_Z$^a>~-^+!VvDpEQ>?0Z-4ec?VKMOGkk~Nlaki(n&lNNv)coN zV~fG%4F0FpdYxJGBMfp&Lp!uPw1ywLa}DHwENAc&2_5q~(2#(Ye+ueO5K=lK3zE{| z!DK`38JfoU;SR^#p8{E!&#zC)3W_U*wim6dy?r3K!SW3%4cI{u2M4-#4Obe z4q%_ukr`u_OEdMV#EV76?N>|^4C_yujWmbSGO@cD%)fX@pwW#K8GXncBDwYzGWK$j zq65NB@zbUgM^w@aGKDUujw1D5L#s(g57w9C%BIx$Sb;@mq57%7#k2%DagQGU@m>K;3*&uCc_}3=UcL6VVaZl&NILMH zQaCB&SoY3qs5M)l3eWQo}+Tg2N2>eJHEzwRw?TgSocpmejy96u`*zIl~a+ z&`Bb4r02kmQeq=pR9{a}7`B|sHbM8NUcZ3P_xa-ddAA<3zC(DN`|OpRiIpW3FNe{o z&!=mEb(}k=B4;@oGk~(LGFq(1R^(V8r>(M}B8nM7b zlhBPv9d7~@OxA329Hc&G++`J)s8`wqs~O0AzSL_Id%@z_xRPu;45?Ou`~PAmnaEY5f_QxaQYKL>s%UL zfEoAOyR)JT;NwwMDE>_RmJ3+a#c2GPoPH;X2+6J;;|YC$-b(Xc=>%}sG68(5DNSUg zwMgOg{*y{>afLlcXS*va5DW?1e@Lgiz`gg>yp^!eYKM{-o(+&-?6m&=YDB^H8`bPu zkm;w!_*^owX|J%pp`Mh2vv_y`K!00g^k{*&T|&m`YvQFTSm45^nNs4QK}`-8xQK7A zYLg*rrZpm4lCh{5DBfV5Qtt*kA-!(6@+gX)zb47Fn6cz54LfRF`>;ts;1 zwUY&_W&>z7Z`Bp*q$9tQBk^z8hA{Jy{~$5`mw_?x?;*zjGB5`IJ;eB52FAd@hZz6M zz!>=V5aWLt7z5S+7GnG_17qOdLyZ4rU<~|wi1EJ+jOl+7<6p%17cu@tjDHd1U&Q#I zBgO(Z5;j+bo0+~-maxwWh3BBg5%!a~yh&J&(2}+)XYQkwvv!3Y5j%pNN5$QGUlo~; zoL5B#*B+dq#HhcFvU#T=J``d}fMLHo9lzkQkl+@sIeJvh2q!SIOXkt3@}#6dznkM* z`TNOD-avm=k=$dOXt`$WiU{DOuOR{lLlhooQr<9p9IP`m_}DP=QA$(y&4tnr&tg*% zJ;bx<1$q`oVOB=7Se*=5V@h6%O|t60htwIG8X3acwrL#Yk_;CRpg5Y|`j7fb9|s-m zF;?};w(~ZYTj`B_SVP7!fY;!7SHUB{!E39chfY;Sgb14{dJ0rTlrq#OJ9;pTu7rwl zrOxVqZm>j>>Ui*lby6qRpd{>3w}HAllnr*|G)gf2oE=^e=Xzv7O51BuTRsilJ8|B@ z%d(NP(2e5z`lq}_j>1}MBb1Mshi|01xy=8EgpTpMs%-{E9o2{=Alksot-IfuguDOERr1U?qc1J4B6 zF1P%~66nb$9Bl;{^U>mS&VqDQmP`C$2&RK+mgsE6jwfrqtZwIaT#E?qs&8oX-aVI; zWO;8y)pb2jy;l9z9z!%^O4-t5hmXx2uO*b>E!HxHH_(n5_6jFS3}3D|>dBTMOlsi3 zb{!$KV4?G=)cDlq5UIEWu4>ERTa$+LjT0NkkwxO(qtIb$(jEFHXo;Hv(eYC63(>&- z=^IfQ@~)dv7}L(;^(f~dU$78#O<4>>HKse8YfRncI`A4-Iv z>0XdgZ|#f6sA`mHKp(?(1R>p|Oi#=J1Kx~jEK|_mz3LupsmI*a!I?Y`(9~_a_IZbv zplVko4W+Eo`suUl@%d_XK4;g~Pb8)r@laH%}Vfkml-99?_gW13=_}U_stAlb}M4yL$NYd(o+?NbzCT>{}w! zF)G+N6rEtn3mEs>P;~?J_lu}`g@mchV3B>7D^&2uIh+mto++@2>-5R+ik&sC=r_T+ zcT9q6&WvR3uxC70)Hle4K)& zjIr`pcMs~%&)iQ+{2mLy7}?!3WO$>dRg5?B{rO0u$HWUncH#pm*pJPQPSWCdDXil( zD+luU=3(&q)&c^K)Q_!CVHahH?VRco=!*BAgbz2ou+7~h^*(=Mk&w|Oi2e`*dYMF8 z*afPjZI2TBdUC->>>*yUZx9sF5_+FG{JZVxY-e37WBf*GS4Xkl(uDQ08&U` zGr0D5NZ0cmDfREcY1((;sHMVHhOsYOf5K_Z0jP46_`ibFKiTvLU-7XwAvwO!YszX| z*^T1{t4SXMzw>BoBdX0%t6Cv@GWcr6)c=V`Ll^5QJT(W)9|;rY0hfOLzG5!T?pW)2 zZ^nd|VjqK1<%c0O`p+;LDfjQd=n4r+1pq>$2k=fq|BGV-&n1OG5Yn}Qca{qOaLC_M z0Gos_8mx)bWP#K~)`K;XFqQQZ$8j1lmG+ zR{~T>3hO=g6YP|j@v$M}9DQ3J&s&;yN$pSd#fFJ%cj8U9)xp}ymhi@-v4{?~Gw~zD z;G7b@k)5v9OXqKO+cYoo$6lTC&s3e_mUZV*FTeNL<11Kjc-cE~i!KQSIN>&oe337+ z@~G+VW>oczD??;@4Y13OH5<>hiVm}zIBYP|KSgSSn>6sUdu{8nvm_|FH`^j#wtGeL z{&_4C-3_K7OqKj(jG|gr*kg`qX-PYW8#tniTeeb|^TwGhjKz?*If}B$Ng$1e!02m6 zb!_BaCy^`1c-(gzJm8G8yEyi}0F=Fl6}4eqHguNCS3;%$f>hc2OfeZ6tPoak##ynw zfTFleE%b;Mn83EOO)<5t4~Y51JLQWiS~LW2f&3ac^rF$B5NGmB}YC^56GaM=U&fO#IpFrQIdCJ!7bj_=1BI-W^GK3ddl5^E_iZ zLHeRqd&d{3FZ@yI_7bdgvo~8q>1dN%?s6o~WrG+sg!$m+$R2qGrcX{b%AK#J8U+&@Y)QZw--yoI{cO3F_gY066@$zP`X{l*Et*(m1;T31-NCfeKs) zahr(Nd97e6+}e23E(2Zt`f-f6Lq(dn3Pr$EMsx8}>G*nN+a#`M;J}}6LQYiCiFngk zQSv7hCR*yVq9ZI`ClZ_3JU@Y5bme*0^{fRp+cnnU^$-!Ssx_kO2WR%5?1@+DVkfTw z8ZE^IdxT-<+9}$(>o%rywza^#s>3sl*aO!O7c%gPw3k`70wkNJxCYf?eZ_?C zW1kYF^J5t__&8cmS(HL}*F^?)k6;co`&|_0yod@zE?Ve(ktWZAMNroGY4PaCPHX$5(BYyR~heAp_Wvj-=>%V2uabEufi~b)_ zG^&FbWNU{PvbDpmVn4@K3;KF@K5Be+)+d<18BZUxCs8IEx1E_BLCr=GA3!v8&{MYVQb6 z@1;iQ>!1W+MkTFF+$AW6=4J9(I@^~p6OL1iaNmR$a$F-$=UVgpM*H{H4xOx4dNLCc z5ieT0SJzgCKe-S3rj|O9ZMeQfTPDxtwUfPJ1rtLl#d6a;^wH>GVkpb;@I!=uvHYTc zRRkVDTbA#I-Qz8^_&Up3`V`@1}^~midhkh9p zU2CCT^pLB_v}@L3Ftg9@bG(N{6>Sg9ewa}=&n*f=UGA!*OmZeG5^RwPYRY)X_Skq=NcY$d1^F7!62{b@K+44va^1J>o_e;@ zH%Y8!A~`c)jn=BkT@RTzR$0tH}d)ZzG73QdQ^>^Edono zL;j_y9K}5Rvr^kE_tR71RC7mhXhZW&RPHT(;wUfpK@wh-=I%So++d z;<$V$)!S@is=$3*`v5MRA%tzhbLU$^`OI`;5o>H=>$)^QT^4R)zXvYD#e3A3s{qrG z_qNdwd&u^)zxGNabl`_Q2z_2k99(Gux#bg=WLRv#}^yn=P&eDa6&xFbSK3w#=@y;aJo#x{vaArPA zElZfGe+aYs$?5VdDK3i)7|?n*Tg^>ONEznd)}MIZ9>aNTPRZvUosCC|U4ViGnTbMH z`%b#$>xU;rn;HYoM6ugjdatqnn2Bn85d)}F*XGzQY945l_gD@;P7~T4y|ud7j%O1l z-0T|876FaY&JKTJln&v97^RhD`XNT?MwpQJ<9`f$*E=Ah6W9LPD4llQ`X{3_;9D>n z13IOD=iaxaf=ma8*&FxXJ~$MI%JH3YFzWdH{YXs0&o}gNWgnI%T3U1^=69oX5&NHv z()MJ9e={F+tg~3o^<*_kUBx_NluYAYx_oYq#S-Y(9it>lHS_P5JfkvB-uAR z3@REJ(lPWDa&=tPb!U^k2i+<3bO2@d2N>;son~kJ(yUB9$T!!zj`POe`T4LEMi+R&TE(y5jfG*FbvaKxOgLNg2^UnuF`Q6 ziA<9pcDMkq_LLI;IVM)rXBqY8DrXe6FQIj6%7pg~PJEGgjo;49_AcCZDBnt%HTAL9 zn9L(M_BoQ*t6IC*FS;pe?(vgX3a#R2C^LVnw&CMSi4AA~gJ#iS&`jz_(98)EG>Z_R z^#OwA$>FuS%gi1B+7r^#y8UT?+13cUz4na$@7ktW;fixQ9HG<>KiK9;*c+~3qXLOu;oeX~p?SlShRbOzXA8N#|8s7%aU z9?b2rD0=e>#U|y_B(zrPM3+dat&3jn+T4q*ynAea3YHL4Xt(rt-MjW&O$iTplv>A? zD6c^8bmC^lL^a()H=--ADH;|~x!#sr-Qvw5_zW>^)qP3wTdIR->S_4%OSa;M8BYYj zS9PV5gY$L4R)e3cOF58b8GK4Kfk14ZOO_<+Y>23|L79(m6jJHFVtjWh={9of>1(re z7cW+!qVZ#_(X+55w1U6}tDsI#DmZET$wu#4nk#nedKYobzMc$ynAO(>ih<}7+Ks}m z&UJ+v7NwYTc^!?f#6}_=ycgLDxtUE|0wcO?=wE6}Ce7W^0Bj1rDOi+7QW+Z2Z)rl` zVaQP$`d1qzt6wCQD7bIayH9WwXHS*mSmSBgFp?T?q~opD%efPx-eyf`;9uNScVagl zVayz?_h>C3FUG`{U00ZkOg^OZL*tiM_<(z`aq18<;mp>6)F7o%R8BLa9A8lb#V6l` z)-6O^0~A2o%PcPkPD_sJEWp==Y76=rD%={S zKgK(~k2BuhbK*+L9Jgp~t2ri+R|=Q>{)RpCF$;=451X5A`zKwO`9_-h`WT%L zTw7s!-?DSv6ra}Vr{s+mTv=4|Q|?%X$Ir#`kbFyZWs6hf*T*`{;@Hb~s*THvJtEaF zFJ1%W$AZ7cvb}1~3XEA-Ems>`L-T4&V-e!dfy_~cj=UH$ryW%pBk|n6c+S)SRYWOe z_IV~GcUVWH+PZD70J9TVp=v>r!c5tcZ>w2dMF%aM0zNCgs2qfwp2c%9rut%3)ZTaVq^S z`P8aEsXOON%7OD(CypH|7I!>siN!Sq)B3~(r;2SnIR?|cms7JZzS(AHM1|ChH3tIB zlUS%1qcAQ|99~B@V1RJ<%eMZX1B9_Z1BAWJ-@IsK7xDX6jXS%Mo)kKv8e5r&biDLS z84w|ILdTbYMV|okgRIr;P$>i~SHf0a_?F2^v*WMjzFx%!2_+hS!H2>G1B8paV1V%J zTw?_yyc-_hw>-{?wLkz|#w6nfmodfG@rc>|9<$lfr6|{<-jJ9&H6_|8SHT!V5`wRM08X|^UhT`SnfW7}feJoh~uO)e<{*itWQvA>BX=I>&VsUIf zi5?U$FjIdi#f$2Orq2>3AsfFFv$10Vq>3m;GYjevjly3`AhLZu~UlMT2KM`;<2m#-5_({MWgAQ!}Cj!p%lYkTcAm9)H?gj#I z;0FO`N}bjH++hCS6L7d61U!&4?*{=F0txu%TabX)myJw^ZWKWXc){NgaQeR>;HUqE zfM2+=vp$6Y@E0He2h=Qo5^xj&M}n1+(Vqm|@xEw@gQE!e=qhnYJ-bs{{}Cfh{yj!$ z*ZdbkyzX})PW3~GkHe!u2heUB{|pk6=#db5p7i6pMK(Po`#2j>mGj!XDO+Gl&&mvAK)+`dk-kT<+??p*?stbz3N8X@H3>@-pRtK^9keWV;FaGY;lm?n zg>OrQtbKKRv^M`>DaF7Qq4>?Yugi^q5^+DzyVjRy@H*m?I*HwU6PW!DB>ot~AIs}7 z+ky1}TRj^Um>4mo?RXlpH;Bf1Fh09siG-=P)}X1FOHKTU0}m%JEmfP4GMgz3G!@&X z9M}Fd6+6I{$f^A>6`wPN#y(x?b>B<{=R z3D=>h`t%`T&$dNJu~5zIaWp3@>Ju(&`wmWt+)lt>T-#>OYCE#Ug z=`a5ExgR*~GSG1eet+0pHK!r(3gz8B#3z8HLBK1%$D-t{?7u&N-#`BN#QW|-)x=`+ z2p#D&Emng;(qP)dfn{pW!Fb@0Zr_xFxQ!4M-@{3KH*zH z$}B4Fbs^Uqr;dR_E*ZTdMrt=t<<9TKWhHb`(~Yjk}1t=j80oGj_6=bVQs-NM6-hAFhMN@1XdNnA4Hs(wb zVEu&slr??8Jk-g%LB9k@#IAmGp$;b!#aI>g`zvS)xqroPub}HSrNHW+uYfLcph)vd zCUEc71sU=RCE5*^bREo4TP`50O?BdyRAmU!&CX^~Fy~j-b*9&X9U(ep_V*NVDLNID z4vN8!klaXVSoSkSXlp>$o7^cm{}8#NQf<}}_2;)xhZ09urS&d7s=7-Q z%=BrBIqlsdKaFo<;qr!0Aa9{aV=I^ff@3RpuE*yYq*>S8*HG)8mKOX6$9LuYH}jA; zxbcz?6e2ozj{VR7ba%ockNE}GzLSJ=STo7AI!rsd@4v2DsPc213)B{>XLc*>MuGe0bwm$S_H zz<}`E;801_y~icv8bsyFNK^UaYu!LzBn*S`3>&X0GButp?67N6G1F7Y65}rk7--TNY*O$tMtnIT0ztHHp-nJJI%?Zoaubxd=yw!BN`wim;A( zA|Qg(&+)?r{FTH=+x~;JX`}v&D{dgT47$;!(9-(GW%n$eS~!JdKz1Tp#z2cvYMP?x zi0tOH=1uP`fX?IorNTJsgZ?*gwMFo7SVHu{$O7Te6YAJ{H-Spr_uES`>m_-`8R8wY zM+Osf`mF?MnSSzzO?%n)BXwl*R}vIA_*1$&f^US{3J+!p2pd#Rbla&KXT|{bXIJkm zVbORdB7Ve7X^t^e-duFeHXW1$|4P!7!|r92sgydlqv}C}&fm?M{*0Ld|3uC-g5@9Z z(6eP&1^u0jsirn0WBPl<6!^DhOc#0nI%7(Z_upqse~*{~Ch1H5l zW2OdJ6wp!J;gBttS1ubd;-zhCJ{E7JPN>5S_jwU0M&cpVCF3_S8g4N*+ALz}%DEz% z#Y&Y-5uS*b+AAqH<)<%{4l8eb@~qNK#W<~!kg*v^4!0j^Oc~u9SUj^Ez~^2X>*zl!)F`qzy4Uh$B%UO79Bew#>|U>4W5c#6+z4+z@yL$T z^`69_tbDoiOxc_57&vS;YWMqbqBgmcRG%L?6ublE3*I?6X7!6u6y(|pr3!NMq{76IweAhbHWR}^HzjIfYv5dAIKx3UfCTNzjAdp2*e zBpMG`1qXOoK=XSOv|Q9g(8RyqKPg=&qwh%5z*my4ly+!Z6ERt`Z;7Vb3pF`pF*5eY zoU9LE;b6@$}g7Oup5l5(_!vda}%Tk=6xc{)jknD~fCVY$;ruiIj8(vYb zH&jET<-_8%?GBImVQ9k+_8~Sg%WHh7KI{e`zW3pB&n-kYdw&?{%~%uBY}rQ?hcn;u ztqu83xZK@yt2Bi)u2hW+Bak_U_WKRr0~=SAyGUI=xAu3I`Sq}ihbo6a8dm^muyW-? z_DzvCjxD5eB}I^>tjLZ1vU2OkQrc&C%#-TfG^`=eJ72{NE~OppW1#Jk40H@M7)Kq^ zeowP`wlpx?z+&=FWbFkEhKDRUIFyE+v`lfkRJwNed3b`=%)q#C1)2k@HuP<1S()u? z>P|%IA5+&?%`I}k4X}Q!U%gwD8-k>j_cLSqoUqk)5z4D`P{_J)#E6`~vmc9V*nJd# zU%Z0A{jEgX;8G+qOA_A#n~GkYWDSoIJ_l1S_(M^xZ)|^LXTBw1_H<;r{^2qI$H0Ab z<&@f7FZ}7~9yztV?MFEM_Y=lHD)L^a^@>bA*%Q%vj)Dzns0jHBNHrLx_^tKFu9&y}sEzQ(LrGrT zc~;D$F&DTZ$c$s;-7O8HkGT-H_qz*S1wJM+X?SBBOmg?H@n>u|D!M+4Z+%UH67*np zK%}{5!+!h#s1^=q!}#oC1~~2I(om!Fc@L;KX!_Q1+T*>^-G#1F71Lv*uCVAaB%Mo^ zAb5>1kJ_|r;B-T{$-LbmxWtxO`PgH2yLcShQd1xq+QJRhE@ofY!HNy7+JY&>(h^++NYY0SC!Khc4HnvZq zYYbC>yId+Y|LVRAF=OfaOStp=#aTK@?L4kGctg4>H>^*hc6~FaKaL5wyOWNv@n(6K zRURWeI$=VSY=K!rBcjzmLt_cUIunIBhN@cc5ReGyC!Vd2)}>iRLL{dZFM>8A<$V(WTc(wRyL%x;>{(wwWR(??X=U~l7XFlttqc9Y zOxdtHo%6*{$53!+VF#hAnqiv}{3s?0Iqk8tp1d&=Y`sUf#=TnL>KkvqzUu8dM#Nh@ zGbi|?d%S`sYF%TD&@zh9%FgSme2V~US5x%-amy8(MRYFe7?Ufs{T8pMT|@|8?ok$g z&yLok@UW=vCIeGhk7X&s%gU$}0VySvh+q|jf1uz6z*-pR-UAz6K)=3u|M6F;^CR&F31Q>-_GcEv)Bfyy}B`-y!ey1?i3KdmIAyHb7-V zO5De1YUOh5YdQF~X?CZc7U$xsbo@r_o-4Vx($j68^5vIju9@T_PsK0n&V8`@b21M4 z1KK17!klx>YkE`(D3imZFQl039!^q?eyoIzd_HH+#%0Q!a3D=u<9ONd|mFQ2geF_6V6KbKrQCpB#^71eMLAxv;r*PJS~hDQiyS=iMu5 zO2~Z!^))TsG~o17O!zsRA3zVi3|))R5~s4S?r;y|sX-aiW0-5!$F2PJEwg|*<~mG+ zL1qgMS|!0Vq2+lf>zpP6T6*HksrLJQrH{yITsYewUA6`~58SKE^EQ3%-mUVvg6wn@ z?4r9LkX6Vn$k_-p7NA)VUAakPV?rQD58KIV@D5y$-6)HGUGAtM6`0c_L=Uf9jYRP5 zze%$KkT`28-bCgleQ}vM zhy%YV@jph019)y>Kb82|G07hw#DU+G_#Y$0f!~z)A0xzp-<0?tBgBE52=;; z!et93WVA-YIcZ*wPHbcvOt>zvf#O208P?R9Ww5r_>mNTv^c|nJbb(_2QF&-0?gTr< z>Rc&H-9;_i32|lm`U~CrZmIL4=RpN>I?64fFZzw26iqliKsE*ZWH#riQ#|NQ$hO}* zlQB>PAki28Kla|TE6=n`*F}Q6y9IZ5OK^e&cXtTxe&YluxDz0_yA#~q9Rk4#5?r$$ zQq}!dudePr_8x21hduhs^&74^&vPC}b~kapZnb=uty{KTVoeM5MZWuZ6N#vox@JWV z0oxO*UG8V7{v1iu!%h=A-L;P;rX5rR)wk)xz1`630oA*5!Wqh(xckG82su#6`)J!6 zx)z_(gIwH==i0Kg$8Z=r;j63&O`WnPUDk_$w%4)-{OHhPp~t3V`r6LC2e(?E2k^pd z1!}*xxXoZDgb;O_mNYYT=@9Tnc2!)1Ez`ZO#KY9A+h#$v87D{L5Bw3b?poFI9OayH zWte@6H>HWzaqOaY;8$0cB_n2#@sx-dkNO!3Q@ciys=7H>kNcj9>(pibORda8an_e! zAaUlI#TxzE!X)5g43>7ePSd6Qrz^7wA)^GX=RQw=cJAJ49iz4U;6vm%59n!|KtA;` zyPSi|W7iZZI9T`8Q6OQFIYnzO>efYo;;6tGadExZ!qMI3T&EkuvjZWJw4His||BZnwj4eZh^8KvOD*=?` z1t)F@Z2D)N}A`rVSqd^+Il4t-*H zKe&KxBlzvJN#G0SakE8(^4^Gk!c%b`1O6`I^Lv>RCBLnf$S!+{JV^5C($Fo2U)&gV>^U@IUj8_1JAGx}0g5V!_*5X1J+6&JQ}I z)ei2x=db&!^~|@6I4R*-&0eg)G`O?2s{Xq@Az6#TKb$KE&4ky48UGXN+8(d6^EFjF zfxIfWfT2P1M#Kderd>Vbq(^jlguwNW_Zfe!U!CZP1i_p*0kaBCCVoTTsDn^4BahI+6);+%Ax^<2JVZ8W@?n-J@8!w-YQSP&0keP z8hZLwunG4}BJ&TTKr9~Pin&>62#xm70e=s8T>EH?MUa)zsHZZ|KQVZW;vun*DeLjl zOacD3nu2T+^X~K3jFf*8>oHzt4HRZ%BlsV>Gl~V)Gd@o57X&)Xi68=L8p4bxoscUH zPIPgt(Xmq3gUb$yAC#F(%sz7}BKU^`79zhy@1vE2PZ=rECN0HkEL@q$uKHn`#uKUt z1=ub5K;u)CPKu?d6oE*~{A0jV-kyPb=)?!sokt%+@kKB_fjN!_-?nQnSbrF}rRKfWSm3|IJLdWf)cJ>ISPt$^ z>S_dFdcu`-J#HPZ-!6Xji33S4vJF;lgsDC;V5!|xd%v>CE}_pWlOPbcsz{F8+P#P4 z`}t(92X*FAElJsigCUcb#=||tmR}0rQgW+XL5ID36m)&S0x%O!IejPmd=p8BjEJ{R zX5v5)v7$Cza19J2CKynQhovadV4E7j=j8<{OKTXGlnh^wQx!OSK@OY=43#5s zftIJ$t;@AhprX41ecs9%{u;BOjInck=3KOrJ^819<06!cDoooQ^6ly+(b>-EC|*cl zW_QGafUNm4*(9>RD{P%8&m;2N($bkpRimbxJgwTZ%e4=|uY#^JIUlnRuJ`;6DJsXJ zkHx0smxg9fJ=mzH zxHt)%&In+zY@_k<|F`kyz<=VO|FigW;6L%t{|o&2oDJj?q7%ZgdDo8~Uw8<3aRDLC5$t~K{VUwjrtXyN|2hCY#thdTfbJCQ6)16gsB{Wx z;;OV3@h9$=zbhWAyURflRQia#GlV!&M)xu-);U-?zBA`^Qm5<3$rfEwqKC#OEpfx zz8YGVq=Be>5`d}59%L>|&`EpP{qptua5G9`J*^iTkh^>i^eqHo)KTZ2n1{4e&QSn|~5#1N;ro=AXpb0Dr@?`6qEUz~As}{z;q- z@Haf0e-dW{{0-0MpTyY!f5Wr+Cvi5w-|%eyNt_MvH$0nv5@+-3g|(jCUJq)5{|~_C zH%|S305<;vu=yW=&Hn&w{yUob{|^B+`oLNCKezV&o2@tSPp-ZHX6p_7lWXt4*?I&2 ztvB#bti693pRP3O^f~x$(0q`eX!f?-7KfEik@M?Us0TjGr@0Bo z*?oJx!e(+Re{~zPuBy9FO`ts(XDws*FDFt|(IlX@!{Hhznam$42{=fh|Ti)R)XRan>TdTB1+slLdL-j?f={u;;-x^_Fw{K?PIO1s^mQ+)8? zv1s7a+VF9&#JfEptE!Gk$f20%i7sS5Bu)idDp3V`G4W+z-j^vhR&;9mu19`|Do2(& z8Jech3v_cBj;%*u-qle9T9mieDdAo*I6ivIy+luz7*7lZ$K_f&=SN#LCY@ z$LBm;5yff3%i|#Iq!&|15X{A&74krNUlwYRAyl5jwOv779T!os9V7_ts@n1-UcFO4 zOmO#9yyR{s5?cog*VWovMao7Yap3QE8~O;KY$%KHURi;#lL|$J=S+1b7?Sy)jIKYy z1L1+i!9^KwhHD|?-Yl7urw2BsoX2dA-x-o4()0S40Kny>GlO(;MNIzH?Fc&f&*`UT_H-JAt$^TXd_=Q3x~Eq=VAjRb zNITRwJ|BF06?Ey_q!p{ts9t>LQ7CDW;4`sY{VJ=As07aM{ASxbHC1_qxICZ&0HWFh z=*XG)Y7c@Q?j3FD!pS#JdkraOm@&+#y;ihF z*d%n4GR56zWq7x&@R{t|;Dbwwwod4<(>7i79Ji}dSJt5-nugPZze|#=4!rwUt|!PU;LSW}gBqMl zW+3`GL&|Dnf)M8~ z6|+q+S0xrSWkkw=)Rf14gYIG)hHBNey~N*ZbFLZC+FZucg~5x=G;a)Q6qimFy18Ml zFp7c*;6pm!j9EZWe$mHk`w$;FEU4Sih3+K(Krgwk5m7Lp{;b7pw0~WHe7Qc#WVQf4 zZ*>eGjhR#?*U9G~aLE@v^0G9~EPZi?+AmxYo#mT27JM7aJ$rIan&I_=T@oE67P&@U zUl*M`Jfv93O}?>J`G764Ax+;aT6R76f5EJ}PTR_%&*m)|ikt|%l{E29ng>Lpvn?H6aVeXT%97Mh#EsO?V-%dLtKa4z5s!8h0&b#;2fcxc~vgz5cRElz@gHAckNLe9bsqEQF zB{LB3kaN+QkBGp_7}E0cSAGUqT|D_iiD zqO#?nDWn0M)uTjnENhC;rcC9YP+6yN7{`|a?BsjT9g&cVVhg&=Hg<)ff!HW0_!2>U zs@c)of;H3$E`+OcAfi(MUrLyfY44So4CI*txf;pGq2wHiPe#hxsl7LHWWcPF8lqn_ z+69g8^2Ru#Bj}Pd0D@>Vldo`hdiO!-5)8v9F_bm$1Q~S52|l!<%GY12GjfM9INVqD^4g<$L?$w@yH zWtX=bv@a)+s72d@n0R5|;02u-U}79Xh%p3Nid?H|_6$?R_88+sg4X31OtlroPsy5$ z`A@}O*e5+(?;65|;HpabIPNuV+-*lYmRfG6k{1ddMjJJqh}YX#_7F;WQS8Qh9`w^g z8?83jc`Je8r&^o+o86a{`Dxtff{xVZmZXbE&-6uE^YLE~rJ$Yp4hQ4Q&YblPlAjgq zr_UL1u`-3}aN5%qtQInbsPh=?*$n3FW9qMle4+R# zdwsQnDu;FdaX)VS@M;1UOon}bo!F)2Z@ntOC+C?-`$1er=H6LJjz)b^XQov=FBC~B z?{Wl@t!AWd7}=|g4~NVnoZ^c^bS-*aB6v~-mn%wqiu5K%^VE)Ha=o?nDWT)3)Rsnvg6bNcXut~pP{-lB~96RQ?OMikeXuHi&|ZXxX7+EAecu*piH zBROjxSqd#*&N=r)Z|3}{jVw+@;#Z+HLb=t(E}G}O^`Mj9U~cow?!m>36C@@Foi~yD zzOf(9!v0y`MNVx~PqnY``W!cgzfzu0PS5HLj7eD&i8kef;NTSh?5oeT5SM&`xvA`7T}k=C17wI*;)H*T#vDp;+HW^wblt6;S&2(7&acx1jM}30iyXZGgIlS7S^zpS1@iiq?78$W z49c1L3GMn@68?&w+1C zTxi6#EAM*SAHWvna6DYO!Mrhr`)XyiOV{4EO=QkK*3iWf1$-g=uC5Pwi8v!J?}MHgEOU#N}?!Dm_Oeu1zm)(3(b#3iMfnv&v2yqjJhRfWe83_?GVVKE6S~=P`j@o}P z;N7MpLWi~LNPaMDn0}h7U_pRQ?&t+jh!Mzgr zQc$%Ie`dyo#RZ~(j7q3-mDDIEMwK-FJBKm_#Gw=}b;NJ&${Qi-C-w(nK$M!z;BCF(QlvUr>dS$3p3T?a zoqcDw2W?GV&B*he-fL*#WH-%5`(lZH5S6Bb`SOk)^7!2g27XIE*KGENE#I)vBwnE) zUIsE@Mi3+^6-TH{oHx*45*z0ycrFTcaCG^8XB2v^t}NJ-k=6T&Vm=>hD_}R3`-b!3 zJF3;=+Ho(}!qhmlEtma8c>(jQz8_zO6g@~d3 zWpeFKnBJ!{Mq;yvLsBY;qdy#Y2LcGa6jCb1ipT@eh$8V)Korn~r!eZ705n!wGruoy2W%6^!!JU>e*0%JN`!1^N+ALW}vz0I-`1`=4S z`i|Yp(Om)-z4unk+h-YOq=k4atTQVygp6ah*3n7376%WKpxt@7ZPXST6I!cyO)%$G z9&yi&s`ux+Pw##r4`bi9nWW8T1yeR?T-_WhBBdyd&SokS6;?9!e!foIW2$OV?S7M{ zO?GTMexNKl02p{BqUK6Ej#e9qF=frxG*v6M$me@Pld36~OAFl1HwyhG{Q z|JfQG?!u-sqtVa@F5J-vPES4b=7q4L=WPytfB(7;$bz3Bn!aP6(`0j?-F#ZU1cBi- zduH5l%)xD`D@*nrp4$!bh@l4xFlUOL^?HUZjf{iD{Aq%jxWb9hBg?ciGx{pzJ zea7@Rh0#BKBMQ}vuN~hQsJA4T~X9>}scFf7Te@x*I)_t@u?DeS+R*5*EUKZZNa* zmDItTf!>>A=V9FXB!ltiEqK_zf5;W;M0OX7-3-W6iu9vIskQ2pG00Pz>q8AHvPjRc zWQuyBeJY!jQGnZ3r##_I1k1>!F#d&UIO8G=6bKE2nk?^cVJC%DwI#~rK~0v1w_i!q~Z`*qF_J^WCX!y){TeA@kJJs*y;iomK)suSEb?@`Fc>)|vkYghigZ+hi zRzhV@j2$<@A>2r57P^i(z$|fbIh$%cL9W?j2lV~;g0CO znbDNrJ0>$hA$$3jyL+L4YAo@9b%fq}D+mma>qA|Ric-B^8v+EM2%{jfdz9N59V!wF zG%Vu>=I@Ojd6p%h8qJGhH+*1fvCjxF4vHHN#g`mgM%w%)$vfMQY?dU<5O~%(`nIfC z8_Z9^Acs(h!gPAK34w~;wge3^@Dc|Si_BguRvMCI;fUv>hi`3rTYwNi-3M-3lMdp- zQw0-B<}MHxTq|*2g$^gjk9SEOC=|bN;p5-S&c@?9eB}!`m?i#!-DUV5xG%QsJy~@?fkH~nGkuL&)acvK3OLf@2%jPTcoHerd za+-fH?3=XCF+V~Fw(tDkrO0n!C;K-eB;FZm@r`~P+XBHTXFbR{L!}*4C_<&zgU5~nhS9Tc1^bZA>A=V1B@CDWI2;>Ds5hd|^r1$o`)I~myxrdUCrFE4h| zM89r|jb5Ig7U#(d$v8nopaP3mhHMzUmJ2=;2u4X2fx>_umJZ47wfF%v z3W$c5*jf2pql(GxkR>DeQ5KyO?1=Om-1{-NXFXIw{GynSP1DjjJW52sYbnSrcD^2e zLrWqGaADIFU0b9muy3ckiVCbS%r-JXTv(7k)iq^cpfVzLibiSpl2Yl1;ERXL*_fhl za0fps%4o8J?MjU1-C6?t?1S|lru6X6EN+JxX(Q>U50j9xm#W15kuCfJ7O+qhb~0n% zY%8B*L>=1k8)+B)SY1ZEzys!4Bv!%hAw(kqMo1PFy4Eh8xD7$_oaT4QQM=Y0=6SpX zV|I2Nt=i*0L_#ThupkCPYImTbY!L!#HEIFelDa7pef%5b7)wMD zjdG%Ow58x$->g32y6{A^2_=GliSC}Fv*K`a-@N`?GwXxd(YmC*Uiu09hS^w{`$ad9 z!Cba0*2ar=3fR0}FY%c;ZleR0SaLSf>p(!tHW@B`Co=y-E&0nM8zc5iUhuO@d9b#` znY!5*A|)6nSP7XJTX%QIxq_qoVg?3wrC#2~&A>s-FQ5BR$A|EPT&8k!7#4oNCGb(? zO*>bxn3Ov^?IZRj*c($*c!E8meE`utF9)|3T(m2Icn~U;kyu_9OPU)ADKv8Gr--bN zn9~EN*j{&L^^JW{??MYHMb-+bcc;okbHQ_sj&e|DS?&=QLxR7_yRVG-81*7lWM0bB&?}BwO;Bmz{+BfMPyhRoXl4 zd7mlRk`Y6OXSqZpv>K~U4e}!tr!;6t-BduxSs%&$b;van$B>QROP^dITYGHJ)BsM5 zHCogs>ueuHSdj*OzPDgr6&_oX=@SSzPOE(gK&C{GId8f+{4(=B9~xzoEpaY3pm{!! zuw7IREbaB1N_Lv?&CYLtIET6vzCd8Ps2z-k%`a%^(JVu^he&sgmp-|sCCZh8HxpWx zM*+bn<&8jWg{8PCHn<@W7k;yKv3r3b=cP}c5dse4!owW&Nz`=Uy-wsAqpeguIDs0I zjoEoE$V)1UbHKYG2YDhb1SI7V-aTpx0oT`i6OkQ!-=1XAfSlr$7-XDT7^wrnH#jOy zA701w*P9$(CUTLt80iRe3fnxjsYd*&-sY3Fk(Wusa#9=BWCaNN+SGJvrxl8>RLDpk z#=AqdlN)6q7|cMkbiubuV~lUCt>t2?ttftL&Y#TPAUh?`l?6uX>X(UnA6BKum`h(T zkx6;_czrcL1z^v{CD?IqV`S_)yD)Zz4)+r88ao&&TbO@Y_iiIRj~#jI?OpI?FWjA0 zkMq~(OW-qK7ybAd^KPF!xoL7A1%F=1{jJWE^wpT*_cCbqO}MgxY7BL-Z|&M>`m!|G z4RYWl72AE{M@FTG7{WdLm1k?Y+7TP2D_jSdJ zm4?=gK93f?ZzCs$QyA^I&=nTxlqQxWwTeEh1phdyE4u$=C^-Poz3*iZ}{QL{w8gWaMVT7 zp`x><2{!%8B%MB}uS^k6iw`_Yt<){NiR$e~xwP;VN0D6hON)N$a+&Jx4x!bH`*)<$ zP@!FD{yS>aW<&HAI6JF8D#Jn$zfL$uzhgF$j~fDJH-dt9{yYq$r%u>yP*!A?(vGHK zsjtiF>l}Dycmvlt>81li!{KrqEhs`Iem@<`7T=3o_0UKR9b{nRVjo?_-bo2renSuM zi%toPLE^XHGVQ#6Pm63xh6x>-z!RQKL@mDw#ZFGA_lN+UK%kw2%L2)O$w4-Z?sp*y zFoIJ_ehb|tT?618q#cb!A{Vm|`^0v9O@n!)ihC(;It^fEu}v{>GrIE_Wy0s3)tJ;ef^3kdt?w(0!t=#zVD2;B+*cE9qFT}T{U(OpGrf`OR-`^-=33*6 z{aeBeiGjVjTAuE`$6Q`9HA!<+k2Z^E%+j9PP@U)rB1ezD(Qozm%7T|Pgg@Sxb{%hu ziZ>!NAk)o7bBJoIf*}>7rwqp zT|AHZ&aqkYi4y|DenIN+bhF$g#uwiSJoh-)6o;|ZVxv=h<{tjSNHrVKc=*ZY>~mT_ zB{S9Z1Ur(q!StPj){k;UcnPI(+o z%4$TT%e?I&vOwW{a(>XZ?&rR1&W`z1M2l$$JJd&mzb4mr} z)V#DV7g(=i)6zLkZIlgx+9tGws1j=x(>yu?)&CfH%}vGGp6xq^R;M+N;;JRmPVo6MFn@A%Ts7a!91PQ?o9^Zd$xq!=)?`Zc$H#kY7Bn8dYn`_dx z^tH3qw3%Mr(=E5X`L36xxF8ZWG@_OA8vbG;@c*22SuwkFJGk|bT(QWD*RDr~g=g{t zhc%4N63K9ZQe~yK<4}UZ7IwAok#qVt#^kL{D}ealY1bA{Wn<_Jd=`5B@jJkRI(e>a1jw>vkXIGenZHK$%JR%IH{_!*K07- z8`fWeQxbw4m{WMuH6M`Y_f@zM;jcK>gOjXt%^;OVg_PbpOd4|M{EoZO-)H|Yb^&<1(j_*~ZgnIv zm9~uCCLkcJEie0vhgNRIXE_zbTB;y8p&Qr&v&i3*lf;-mE4DOshSRXTeuG`1{MmBy z9YQth6LRFS24bUC`ab@D6M5-kAe}Z%8^Q&w0;0*J^AGU^hujh1icM!!O+meL4SjEWu| zXkahXmIuEW-9OCAAv@jXt0pd3g}}~g#_MG+iD{zZuuL662Wr-r1j_J&XysVaD_qk`Gt*KIen>_qnQ?PT$~e_sKIP?qE>-J0I)hFAxb}LfJMCUE=Gz0EkizBR zIreRtOY&dlcXvrZB^zSyj{%;`uA8Y!_fbUo zP^4z~N2KQX5~)!+>1isNc6|J6q^1e`A0o9h?S*bKX1TuV`(b%HjXb4R0&I{`Vt(2L zaTq%mVA;6fKyP!!t&EL}HG~W|)wlmkm?ra=Fzt^lO|#fp?gz7s)ql#;Y&49RLVssz zdoNkq#GhH3{_iZ!#C;$~{ggQBlxN?E(CaG*j|$)Nb6wY>O$fNfHT(=Q*i-N!yq`P? z;UuNsERN~j*R>P(F15i8gVyb2TZ>n2dGoD*CTj-6c}Xcw-dr2gkFWZauqVu2%^jcI zT%40PDP=e^!eG+Z1J3;qLgzFYu_{O<%p@><50?@%l{+C=I1K}&2!x(k@^avKw7;K2 zqEA609gzW9!hs~~1up>AWz~FFL-K*eDbTgJyagmmBz(N%s!grC$k`vWedj*uc%5>B z$#M2;>z0$y@h+_IAn)5BXDW>3YK0*0+lq{$W9`!`$h(V(1u$=r4)yYTfA4e=7qt6& z$zYNt=+VZq`})`M9{9WYe#W!|(ab13M~nq4o`h(W2Me_D3CC%l-f#|HUNKuvuP~%7 zk2YogVqMqlCoP))j_hW1NG3#HRN!{IzL)aFH=&k2;JJFGnm%lJXWDuw(ou(sxd>M@ zAA#HA!^q#xT^q6F;#ZH~8bA(kMjFGu|V<+aF&joQtl@;RJ;c^IS&eel6hj`_J+ zJvWbAR&TDiV4NR>T1#A0Rj{7!|DWf2;ID&yRg1yW-6K7G9Gj&RVbT_s9A|)G?2ByT zRrJS_J%qoG_W!3Qd*J`$X#am|vIqWOjrOR%v}qDGG%gnUnN!&&LD(EX*ue@^O<~OC zhgWTN=n5&{({Uw<8K2P)e+DRc&u{Ch2tV-Eef(e$6Hn_PUMk2UcaP`|Gpz?IED$;WXbQA-rTw3L!#WV*T<4n|ySAg(T8<3xFK z@kU(I_?)opWGEsRVKwh`3WhVcof&=V5htUuJ6ni|Y1Zu8&EGh2| z%%75srhQ;3M=UX0g-<_5Nf#Ot8L9ntGUv!RlL3y6n?#tDeJ_DXyeRdaD@9Pm=JiL! zW)6zjj#vK@vE3TIL~QSDP|MmM%&u#iC6gI{wgrU*`G5f1l?KqIM%D z-$Bm6ctrTv}K>VE2a(0XPHz9@-4^ zu+|dMi0rwLy_VzjaxW4e51W<=??g`XZ(|5f9p!1YXS)n-zv?yJORoi$FG_laS3-R4 z`q!h#E|`kF$827eeBd3aYz!N7-aY>MmG9wHO@8Jl1c5RUQsgT5f5r8?^+UNd`{>c1|53mENwwaJ+tZ{G76uVh>yad| z+|7<-azK`4^$lc@V}f6C64L3jPUm)@Z_;1gfw=HLOvOgti9}n`CN4L|3#15sQz{y7v)Qp8iHzx?ipsGGB=!;REL4VvYn9YI0c-Q&_q zw(yH&IhkENsK8d34|E<*ntubPtMIKNOaOl&u6Ra$IdVVzlTgxws~=BU?c|;O1Y-u9!c6VpFz-_yin4EZHtq}B z4m%!e(PEfyxhpR`GACY!`mY0gr?W};mLT9nb!d%6cc4UXLOdX`xCGT8ZL~~(W*}xZ(s9vDkZPi#5+fB*5d`B|stA)jgNgN$Y_?rFam3y`@C;^d4F$yCU((^w6h)oWyUYr^H$tXHLD-I)N(FS7J8^tRgol8d3i3zr{JXX zhq|I0MACA@${3iXs}swDcwaNb$kuD?`FNWORP0&_Q}csY?po#Rv|DMf$ha)&Y)9b2 z^rnD3yzDxrzLNWU`-vlZe+n!@XvtSe+G#12m7jGJoNg3pA7CF_7g*wzH=}t%Q`c@T zzr$=*v3#A-Ji{&u{z5sFNNE;c$28IZO?D5_bD>BIg_zDPa5(1^A^yi4s}#aulC(hQUzEL+Lt${NMqX@~7>T!uSX-p|=7v!ER|-=WE7^c%0J2hu73iqmu+ zMV8Cmu1V?fVjMW(!i;GjjULO}cCyDO%2uD)g3Z2&*hSSO%6$9%Joiqy40(dskyprV za0iP$biqpYU^36X4l)s{HV_4CjSr~eDN^CSFS(2!ADztYAT%S5PUYHuMPETTQd39` zo0QT+xRbYh!A2s^D~F<;ZTf80Pr1f9ba1|e8Qn%|6G_gkG=jD7-o({UyY}`Yv@NXy zsi#alP>9O(SU5Ac2WuO>x%=|?X2Vt}>sG>UI;K$e+R?i5cQ<0D*X=U`U51ip^F6^t ztykZc3P`(18664CW6_(g9Ja-XeKgD#=V63}l2$)6`kVJ#!=0iqz{+;&k{5psY@8Row;YA~SQC+?TX&r6 z1BoMdL_Zp#>SOe6WMuNHeL>;_!67*`agJQTA;faTLyX)`$7a z@mZ9Zz9eF#i!YztmoI7Mc&SN?8I7T`&rjIXMEXRv$y=v}^HzeBfNXK*!=!%;%;#t< zROMzfX~=hpS4KiBt~oS+SWf8=%!*psPPaA61&?h>DEyh0TdTCU|GPGWBUeOSQl{m1 zTyD12@e-HUL*2 zKo1!w-?-0dwA{<b}Bm8-N)jQhVS^gREV#uD_VGQE-`c4 z$Aox;@BwcA>O`RVS&qxT);~RByKS9Vp5DHNCVJ`5`s#n*UTv@>@y=NLx2#;9q7=M|^h>yb>bJXhu40&rdhi(4NLSMX}&DgP@j zPeb}6E`J-k7UT#)JAo`E;L{K@xAV#l-$(L4=HRCe1qiVJVh4!Yq%dHFEnpLzM6 zFKI%f7GU8-Z*bVmNv>~YznWW!c0)lwYj~0@_^1D z-(5x8q2R=xr0ENd=WW({nzeNGMvD9BN!N@!Rs<1zBhb0MH$Ohptm5E97tO~ff;5v4 zjtXHpKL>J1CqGz`$A=%BDs%IWeoIzU)hoq&tza(a>0*Xq`c|h?tdaoKpDjUV`rrGr z4Esud^k;$pqCndhf;MaAGj@>5=w;QGHLKVEt$Eq9!qv(M1fAg3N?Th5W%g6kH!&~J z39QNjluB}L5-Iw?tGH!!w4eqq zx52e`J_~@$d@*ju>OR@c5OQ%w#HP3Z_!8D9p#GO(y@#oE;@#`NhV|xToBuJa*F^|z zm?q~|X-hKr zk;xT4Yt1Y^G`q>GX z1GnpdJZb5G>`0Iu=V;T!?8qK>(*+Y{5GZ15EdTi%J@);V)wj8sX|3bFd+A?<4%fQF&gMWHEc|RBn^* z-i=-VguloewZ$u!AsrD;n{JRm(lwH`ai4*y z&KV?-RHxmBYJB2TspUPh`~Zzk4rU3#4e8iB6nh#AlDLzzD{#4R&T3-puVgh549CgX!OPuSn8D$9fo} zZqp*gti@S1(sLi>L6Z6eEJ%Zj9)a-e>qhoKofWl)46r0Owa{6eY3~hnVuRe%a~3lW zJ){N6G2ol+>C^9^J{uI&S3CVBsNatGozvI9t-3x*UmDpZ)@?|s?aO!>?!UJ89ar$& zxZJ8_k!SQjd^O}C@aIfp7NJLyCHc;H-5%VskBVTJ7VD!rU&RLZ{Vb*5&(!L?Exqi6 z)h{_U8B5?WEBK+RDW+Tmcn@)0g3RcvMv!$>W7lxvbGcK0AatQRpApQ>JbKq)HQt?G zd-l9w_N{#RMs}+fGzMpQzRr2?17tkkg1l<^s~tuyMFdAn04St4cq!1{rW19N zn?0{!-^+4!`_QI#_j|zbL9ScS^xJkSRDFhVd}~G@ilHn%EhpMTW?a{Xs!TGq>Wehh zY;S%nNJw^G&jcH`#|2BmGUt?A{FPw}(~!D!-xCVKlr(l&OBdukURcp4Cjk=qK{ z)B@Zfc_e!OcJwWH7p<4p-~x0^M%`T6XVI`;V}X+@z5{^6qqqyQN!FC}i$TQ|spP2w zhF<~fEw7rH{jPS6G1ThHoG33ee;rgBchA5Cuu;APu;6zb^r6U}uVtm=pLm<*qR2Y;H;yBXLr$uyJ}D z>!(Zn5N)+nh|tg5(**WsLCrDu9{SJacEhD7Bf_XnA_)~v` zpjGQ*9{T+tNIiHT7*da-hpG-J`8eV7mUbb!LzG$`_hP+qKUM3+!3YnwQSJ-{j@%ul zTBb`{YJFJeD0Gi{yMKH`rC-H)5yswkCTpejGGPoQt@=FiE3TY2V88#Zn?$)!3Z>G7w0>GNx5{?>vFqu1KRjA+A zcxhaURXX|yEaQGvl3eSNnKJ-kGvGKodh!Mf_=$=7{aG(SXM^~G|bHYm1fT|w;+iDyS2%Z=`MN?H)hNDTt05zHA4@RpT>40qe4T6Vv(C3yGZ<>g1zS%979f_r9da2p10-PoF!*PBEfbaCH(Lj%aAwbD}ta-Khs37Avqqf=b>%Ey}7GrmsnctVGA!BgnD{UXQi(O2YgN-%&N!FUYjhDQ?x=Sf;y!a`PXZ zMFL9ueP1Gwyg9CZ2n{Pc1WIz>+JDY0$-rKjlx&(?lUZbF0DMqb1BSe%V?s`xvg5Sa z<8B}@aZt8rVv)WS6hnDyd=c@(eHt;~iBLDiLJ9P)wM)th&kz{{#!S|r|a|QRKE**auc@6H+K~d#uTb4 z@|a}QNbW6DEgi9rPU!l|PEcpDTAL)x1|A)88hG9408Q(!O~NhzeJa#6#Kz}r+jt0R z8QtA%H0cdhkoA*=Z}0rXHtGG~eqrbbNZGjDdT^m*1IDiHln?Qpv3pBmxQ;~Wumm0Y z7={UtNX3!pO8k985Z0ZWcy3dJeBk;LwGZH$D!)8MHo+1r}kw!bWRk3sLofb zoIuR@8yn&tXF zp~`35Oad4k#sN%@!zuT-#I<&Er?O9H8rBC>EbsBd3gxn=6PzI8mf6(K@J@yDXjKI2 zIBN*X1zL11?ldoRZBtKW{aYUT0-1AAAlP0?@ZQ};@phHjuTomg;9z+(N!;DyfR$ke7wdO>e?3Vxs{;>Q zR%wKGrS$&MWZ*!p$bRURI$fn)BTX|iln*|9Ke`v4V5IU? z8Mkq+k@>`&L1tx4+^zEs&Eh5h+ka5QuWip-eAY^24l+QBfdtUX-Juj{SM;*E?hW zprI>&RxsuEN@xKsIN^42t=11r8^7Jb>L-^knhO%ug0_+mtaQ}`w30Gf6;(k^uSqP z(v0YWSPy@Nvqk{v&Bi39*$o-fRn5#J-41^=uYTKxZ{;wOHZaD0i|gmia{gmkBXfPj($(%s#i6A+-5rM& z)!a~~I|8*rBoBanw1AwftZYRfQu2N(Id!HouV?r1zA;H^QObrz9*v2|<%_JGnFx^T zNtnF9n%&zfR6gdv-$89q_o%i!*Jr};b4w^XPP0c7oRH-L^)Iv7Ma;>(2hP3QMc^!U zD5)HIZv?yi;qMZ@UIk20J)RP<`WR8f9}C_vWP0ZD!Ds#WRsuEK$|kMK{adMTlU3uM zCa`2WNN1`Y?nUpR&rmwy!RRd2R`Tr@0KtOO8Yvs^YwY@@mF$aKDqn(UPA3imyTO!X z4JYBVO1Qg&=l3IE%Sd||vhNyA`x?yPlcblii0&2~%~Pg)RZOAAehsq-l*xXDVvOdx z@9nCuLa(iKIS`}KA61$_rqG_O(9>vvD7JEHLL3)Au&l+YXR-X|G`De`V{nFY5KVt^ z>I&|L3X^crervK(a#aA$gS>aq7K$a+zqH8}pQsF7NP-|A>ZE)-G4nWh-CrQLA|X3$ z%(hNIryTc$XZqlC4lz+Xu#kUd)62;!7mappQm}a7;oZ~L&?a-Q;Y@53lEx^!3^WMU->>f zebDIdJ;9AhfR74U5`i^$3!%(0I{ zO?a7iJE`AKYB6a6y5W%WwqWuvKst zMnI?5(N`KL*3qA+bkEuTXRBGK1eRwB@dk95GTm#E2pn>NxPC~5|ra6 zt`wn1kljj<58U>n%G~+V@qID7^vA{QW6B?kS;%1aU8eF*e?QK(C6G5|-z~az+q3L-c8P*!m&_scg zcIJjZInsj0v_dq!Y9ysKS~zaUmp06!?)5a&#@_LR3A(4X{m07CC{b!q%%@m?tF*@k zKc45g-8~k`Ck|QYQ-S`U%6hWka#=l?0@TN@7`>baXbKN_MQI`>|Ornw+P zH=9}gnsPc+dVf0ObnzDfD? zx{k!4ls|m(UCO^aEE~RQ1f~3@zexF_)5#ckhuS}+e9s?JzD@C8rTi_98Q}JLj?p(O z|Bq6B3CX{c@bkr$MCrTrY@}U;ItVFUUIO`&G(^`$ftJep>ko&iv)E zze@R&`roDeuzxG%&;LhKe&^py`2c9;kJCb|d?rp+@jpoUWO@)OUlAhZ%l<{mFZe~u zFZ_#?uLzOyxgb*h!gnbj2_ogIZv9ot2fkbR>oS=Csg!^GQ_3HH{6{Ij0V3t&{wn34 zrGZjDi@|p(U#sB{QoiLkDSrSWl|k@CGkDgWO8xRfvTP0D}z@`scU6x)GT zK11@>tshdpIw<8U{YlD~k^hgR{Hgwbmh$`IewXr}{f(5*1^l$~f0Obpev$HHUH+Yv zKcoK7QhwndrTjRWKS=q&Pb>eQr2K)ZU#0w+^#55YANXnI|Gkt?{X@z}`6lJ782wL6 z`M^&re=@y);{R64=l@qyet+dRDSv|%l=6Y!to-+;|0_~H@YBlw-;wfxpH{xw=RZsN z7XQ;yKK5UweBh^*|Gy*U13#_&{~akG_-W<;?@0Lo7@_)Z<^S(U`7}SR{QocI|9>eT z61e*RQvM&Ld=ZN>?Ad}bCW>}9zyawNyGgg<2aY~N5|?vt*R=D~nlE_+@q~jPy2Qiu z=<|4A>uu0;dzrEv!OYyeP|Jw=q`&m2c-hl~?c3*j6C@gjSM<&c9Qdq+mFq`R zz445M)svf+i`lzHE-ZODf%cP8Ugiv zLD+|{n{rn_`PT__8I*SD8KITimpSR4@30>Mcz_5QOBMwET!*0pBWEwZB%diZem17k=>_ z>#2hvSWf}L`fpT^*ZH05d#xcIEScXrSdU-*O7$=~|2l&O{D&Q^!T+d(h4c1rI#?jp z=MS&QN%MI8s|*$<@bcFV7VGfeb+D=qF2{Pn4i>lU_YT%?RDYuCib?aG>JvRcsxLzR zuTwn$VtoyW^(QYttk?XG^%LwM*2jOtdTR3Du^y!QMv&^QC4uHU->Lp8={Kr(pHP+l zLG^w(5UPKfq-IF@cT_(+^4r`Vq6U>szujq~wh=EmPqJpjS_ibfFYr+;F-=jN|i zk9YNRYp**qG!qD+`t=Q~PQJM#z`AxBqhN#rk)g;MP7T_3x-Y`rlDKV$DrufX2_M zeYip^lPzuy0AhVD1nc)yAzS-!QT?^F-` z&DQ=OupUD74}VZS6Y;N8`(LPj-|Ej(`+FI`PwjUW|2(w^6z4#!CmjZ{-uvX+)?Vr% z1nckc|HIb)-%$OFw%?}q!_9xB`U_Q%>TB-&KD7r-oJ%2C|Nif>eiX8`|Bm&-|4*nM z_z$-Bp_P!W{nMe}w)PM7L8`~t{*CItJoqnDJuL2@r}n_lt^Kc9Z~5u3Tl*Te-?sL@ zQGKEQ?^FBO^8X&y1HW$Vce?+uwU5*L1J?iNRR8Y3PW8ZlV{8AfsNU?~Q9bbA*xFC} z`qh-Z9?Ud!F~cH#-A%G+$>&m+;kIY&Vns%p_H2CXbCU<2jHK`a%g_AwcBF$$6;z_;ox8D18i{vzns^+*lnFQjUt+U>;AFL*% zRkK%Cj}sIWDeofLpd+75ef@>5-`r#Rg7Kp&2lIC6W4Wl2T)Q9hFEmOY^mf*; z$!(*Fa@tAz!HjAqUI{$6TNX|!6_T`bgyn(!oL@e)OWE-dhkD(~Na-V8F^37XY-Wu^fhlw-=wrH&n zr?A29ragwY(dl?+4K&T;(OD>Rm-4s|_JcK#_4+*@rS9yW6~1Zl(?{JCU`jxRTwt?8}sc>KR*>>z9V zo&5;KEHN&wNu8_r;F7W%Zy_TeRAv8AxBZimU}WI zn3mqzYJdF>0XhND{;KLKq(AYtZb}|zP`e5?AbA+QN#L!uaU4JQA0u`gv%VtMg_^e- zv07ZT!1QxI;aRhc`SiV+yRqAAV^Hf(=&hhF+hLi*HLbc2cSv(!^Er#Gr@-ue5}QH= z$ELh?E%nqEyFNyU^W@N*^gN7xYcMPgd@Dq%30-0~jZC+4I06M2)U-U@Y@$*WNppW_PI%MYu2sab&?)VE~N8jyCA z39J%%N2kw3C*SF_o}Q9TMZtH5?z-EBd@gXneSsu#sF@qgD2`K<`u3h8AGr{aDHB#U zi`hy+$7o=v>N3<$l+qt4l9Afe_%23v!sE^dAZz)TZ0?mLm%O*r1!L`n7ngbGhbUh9u$_s$5+FIlYs5( za7N-p)i9^z&Rz0*K^nHKVvVg0WE}@<5^Y^ zONz%SLo`QoMXyGYobOpxoy~S)bUTCA(u5f4awB*d4wOx71WF{O?mh#8ml~FLiQ#BY zIijQ;F>)UFOjsbh>`gw@n<&W+k-M2aq=ONi_(y}PUV z@|hIMD`7M^KOH6Fgr_nXS;g{deX8M zbi!{AH9t}X?r7+XyaqxeSVhP`AK7@lyN?tfSk0EZ(i1qHt^|{P05@Dn&mEqwvJ1A> zt!9)~&$2(Uqm4|;Io2p)b2MM~jgIa0Y?zrx#BSymv(uITg3U8-qEvsYT?>xkp18_2_5L>qrIEL&p3PP zb`U)b6b#3NNJAe^z!0qQW2SYA`h7 zW+K*_BQ1~dg%iS!Jq(i|)hBHt0|`=P1x@oGeqJy0W>xW7fN_v`2%?K_JKC^x{}C6JfXf6!CxhT;Y9 z9^QG-a(M6&NNwT%>O{!#j4-+03{z$uXA^5st2^*;4^D?-P8f^fbW~`MIE2efo~5S} zUy*xOrrjt`Ja`K)$Sg)R7ExmZbVl5sVg6&n( z%GPydIla@IEhbZTYnou1i{!07$@!7p%5}_?)4a|R;1Z-Zs7w$(2+e))3awmSir;j0 z(W)-vo1iaG=lKor-_3c7{x0ZScWT3r^&eyGHoG$tX8xga9Z}z-Co2M0u8U~DRj#?5 z_fbfwDxNM*@mjpMfkGGV&p2>?S9_&T7=U1cW+1x&1NbWA3=D75Dn`dXPFgKrD>nn1 zdI3M0dQTS&KG*B?iVS|N-(SZ)O}K|f_i}+V^A20V2`^Uj25Zgh!UEx^I_XYm5>i1@ zB|JM3sa^(|sa?UBlbAAjpUmoRqj_G8%ga)kkgt=yvA-X)E>0O$+mxm3E-%Tn?pvm& zass@p&K&&GS2)You@j(PsWQ5O?$cftjqa~`;mPRURLWEKG@b3euzAeFmQKr~~Y;)&||r zE||#;!ElX2`0RfqJ<17*>fP)xcl>DTDY1Y}J!g^sN>eXNYJ$lIZGJDKmdQp(=tLpk zXtxqN`##_vssYCIa5$RdFUt$pvL1<9SlAbosWKaF)jGfCdR4H$Riv#XSc2Hmyr{ z9N~RiQ!vY3Vl@NHXjp=_`ep^HrR;v&!zERNK{KFfrz|S5b76yrAZW#dOGv34+Hf=O z90s;TKfE6L6s`wf6J9U>DN>ML#4=CS>ml#9zA;wcGFt@nz{H9>kIU4=4RK@K*v*6>@;RVy zf2j356?R&gRO70c`~H;wlGVcH)_~=>_Xa~F-<+LJ{Kt~{WNThi;+wJ|ZmpWb1b;PZ z-dXNbPY!Hblmyqu>Q*))PqYVS!kcBSayd--ZYI?u>l_l}zD~#Q5TwID;0kyIIR{B5 zCFhldy|i-eaC&*edwneYy=@IJ@0j@fC2kET3yE9r6#Pxx8fm-h>Az`PKiOrG&i~oA z?jtyxJ5hnOtt}Y9w)LRTx3={i=`^78*SK|G;@`!sqhO_bevMl<6Mk=7_p$%Gw)M!+ zKew%cD1qXCj9bfQgK_IcQOC*3Kg6w}A#H0~NZWd9_%Cg1tl8h&)(3xSTi2veD$Xo} zZR<%|T}a!y6nGd5#;vI{{~>OzGyHdP>p!-w@es9sYg^A3{h@7L1b}U8WroUM+SZ$p zwzYxa_qKHo_<#S`xHX7?-TWJKbA%ZDY1n=b@e-+v|B zZBo*-$UZiRnq~f)A0Xrqf*f&^uD|~bziTq>=@N;=um$U_)HVwu0ed)%#YWuY?f?To ze-7tpnO{e%x|FWyz)DwUQf7+3!p@Vo3ke6lq5|fH&{0m@#!<=9Yjh)jHs{ET8--jK zy9-B{G7kisw$lJ@mhoIIk*J8dO(gZ6XQ%25DV1>lQWoi5+d2naPm5^z>W;$L>++EeU z_^+OQbgJ;vQq-)df%>zO|Li4p@7M$DE zp31(W%a-=>*i{!`rH{h#VB0phMK0^z7BDW;7xaE`?tX1yd9 zuE(xBmX&cipO^hUe66|dVgBZZB&$79l(jA@f!d|VTSk79AevEo^}*%lI73(B&|V#r z-i^^?KHiAPks?$3fRQiaj={x|!xSfOqgVG-f=tohkfaH$orETIT5{!fZ7J~1`t|$I zvauaaCU#&x~WkN)PHso+#|QCq!i?=LVIG zumfDHF$aljr=P8mBz3@hGcSk>){&g4@H)emH$}op?KI&GwOTZ1n6sIXt~v@FVqM67LZ|vnMW~>$RYl$GS4-U*lNV zmxW5`o~%1WT>zG_G#^S|Of0o)?vh<|ZooW*==mBhqb+`6xo5Z=-GxFGN9)F07mJoz zp83z;hBBQJyqqj$`s9A*x;xMN!GbS0T_LIm`6S-k(!+EosMkO`D$srG(S7TS*xY37 z=!v)r{}H!yLfMR!jFJ}%X6vK-qF|{W-+92x6lq?T3c%jCz^N{z*^!IIbd1_x7gP02 zEdErzRc5$D$;D&7IG5XDVoya!tPIif!Cd{~VtyqOG9H6(sveO-Mo|{^!iUjyG(!&i zB^K3!n_2%WYCoB6Q3X5-Vb&v|D*Eu$-nTIXG9{5@UWncp(KBa&^Cq@LikIj0-L`oy z=?8tl_ElTs%Xt-(0z)PK^MD-Z;}GfnEmgK^?krS-iQERRa)xEgUbrxUkVJ*0f!M&5 z7+KK-IcC%+a_2`$Za7R$DjLtcCv}c&Rt^G%cl47(O_~X@aRnT2CX6*5BABt^U#O`r zBqMtujV_v`k%&gLCZ$aGYkj35uAgZe>bBPbY|-;@d9`tRt^QS}ey$o_X!wB7f=-LQ zZ7sd1d^n^%Hv~IEo8>7gDZH5cq5ZWPYjJ%l!t3BPdR5EgX<0^{@W+40`l{wwL7Hllofv8D)jQ-$Vw zcO3kAB3h`9-bB)6cl92m!og0DZAB=(tUC_Nw@eRq(ucD^u`-4iluVTnA{)8Na4FgEu^UUJ9KN;dN^G-sIrw@eED5Z zzN|jM*y5^r@wof+yda5W<4C%QzHAZ&Grx+anZGKel7d+;a|#m5S4MdK=TJVLQ^8+C z`GCzYp?rhRAEEp>L9Xwie64*>RRONQ3+0DSE&n-`zcsnabfmt^Tp)-nZB?;zIGIIs z6qzpsS12H-s~s$2y%?aa2c-H^kIf_LyE@9H@$h>@VG6MS0GO93+E^1#5smouB?X|z(;jAlt zE~b+hYIyc4Z;Y)Rdj@I0G#opuD{?HRPXf zqHSNj-T@dB>T!;ItS=Ds{EC;i8kVkTO7MRlXhtc$1ZhvgqU^yZW={t%PD_ayKTC#t4$@|IYmfJCo(|U8`J2&qm zwvGpI(Lu6PI1!SJ`15QLLwB`feHs^z{Y#=-+g*TOmW6k>4wJK# zyr!xUCExFCd7;*MeroXjt`&}q3cd19gDJBfyV1b%E1^>9t4KC=cC(_9siwzMs{1-} z(x|J2m5?6Fui zcbfE*A-EsYdH0ZZ@G7n5kqx&AoWHum>Btf>rWA1?dBe!e$#Pk2w!%|$-n zytU6Wd%99pV3h-onAOF`o#nwhqMl&l2fBJ*6~<73QaN_F-xK(7c+Sk@58^rgSmoE% z#V;ryw4kNYI|YopedP%^p(@8a6F1B8GmmK!AF6wTPijCZgI!tHPozTQM?yAEP%gui z>T2jJyWd)2d2e5Sp~{XN?|fK!>#?u)WJdRh1<>ip^m*ugb5u(c_kw9lWl|OD=5xNK ze(=M-W9{T<5qQ3*4-HL z%)dlM6huN>Ks^-;HVSy|y_&JsRmXSCw8$dadKfiM{?+k9_j_tDA?;^s5BROMCo&Fc z?Rn7uO>0k-|KGLtCcxI7#qX^>iR;=XWk_ppHdG5t?dg6??e+aBwFgxGZEKIJJ%;Vq z)}F1z_tswJf3vmskEuQ2Ppv)dd*54oHCF%7+N-JhOKUISm)4%=Us`+Crom5Lc)`@( z+1u}_JlsM0|>eI~`b z;xH75PwuiGF${EzL`sF*p~E6Rd6^-b?g}qq%B6Av=m8s^F3yB}k6wFO?5Y#8vPa@* zupM{83nlK{5CkdN2T8hubN=KLcBa~l^K#{VN>1>xK>OjlgrJFhTj6n<0V^hlr3!*ZiLd>`2@64;=inuATxAr`jN zkn~_r$+`zoMJpkWI)~;q8EYV4WEA_lu~6s$r=YA)+?OKrmz)JJSFfws!tc{s2fx@Y zSV!9`Z{+U6v88||t;6YCZO-X#eTj^JqqMwJg}?)N+JV2GcCAqeQ*zppymov>m^YfC z%#>mk3}+h{3xS7A{D9eqw++HQ}-`p#|lI9cCl%V}7%&n~jQbQi=i znA8BgF^(j<9xD7mJ*o%zP%xIXaF*V3ULITbzTlc@VnqS3reSTs7=6|fw#Tsa#n@82 zhGp6U=LYP38riNjfZO&do47g^MImF!w?to|Xt$C%)mt<3QRcbiTy6e#zm&2{ zVWr}$SA}(|g@XZbVYmL{#^(>_6W*#7zn=m98yb@dd=n0i|SY5=F&RkyoXQ_{dGzh*z9la$4;W$Y<-Jl zqhjaiki2@fTo0QUwiZ8RN1wQi&Ht^r-`1sRg$UaHE~&k--t3^=f0kJUCikzyqGYEL z@T;%oWiFep> z73e%^XdkaPeF^4dDz%cl3P>*xj@ZvBaoyO8R zF~Xfl{-oX$2Y-(67F@f8NM6WEJE4y#dQ@55a?bNTEO*NMa1=vu^SN0Q2%nPkA$@Uc zS&15Z3#TFqq~bxd0jV(5&omOFB&O!ZD-B1N2CUO9pF$davXDgItMWbLL7krSbM{$6 z&Lj*+`X=AzVd0p0|Mfb=Zj}ViXl3-( z1G>vCtz_;5QB>wDMO~|z1OF_>T_d)}$ zI6KO*=N#Zo)f?ck5wDnu&2Y(;GgWc5>1bi+WUI3foG&0c=dy9h7(9w`QZv0d_rAO| z(!g!+)IYv8L#h@p=-%k-o9Rthei|NjKDKM`6PimxA9I!UGfpwyop33Z5vvt74Am#2 zMMOY~`m4cb(u7c&<_>`lVT~Z#2wdiyGaq&-^v*pepV3Sln%-j?S{yq+kL%E?k7cDm&Z@ zljPe$Jv{KB9+Rjz<%daY0d7++XP$~%ns3MF>G9Fr&FRCHRb33)k#IG&!8TY-x-qk? zM3xma=CvR?RXan_F%lazA$R(dQ#ja|pTH4Ic z@v1au!TfQ=nxv-u$cMJ%$ALu_u-={9L)?sPah-4SMJ78Ox1BvlOyjFW;!!)A%Dy1) zNp^4~+igw0kzD0RyCCQt21>v&e}~o=vocN{QZE#YM+gqB1&OitCnD(GB}96XgqBKF{-*bSEX`TeeFt@Abhyos8d*AemC5up2zY)hBN8ph** zOPs2P-1H!B5tIWK`Lk=fh*A~9j>kgu^Is+Uw@V=qHXPt0$2-k9)UV7rhsc|~q!v-~ zA^S*Ut;$^>GeFp5BJA+IhqgQ(`ky%VD-nno6{7vXy8Yc9Yu|D ziM52N{~D2EYWqWm{TRyNpx@&}Wubdw+0AYXd@0z#nJC+R=iwEsj;gMfG9}kJ3Sdij zd!uHVta}_Ct&XXtILzw!5WoPP;JLk0O(@o|l^o}p5S+WY;~Ts(e2hB|uyB+&-Fl%I z(|6cy*}SxR*@E3k>Yg%}4au;5h_}kaq{SkokK)LjLQ!&L+T9WBfeST#msQQO?m@M* z)s0QGqwo;CfK8E-*gScMKyhbW7I0=VAvf-?uOJy+6~A*Hm;7YsC|HuI7aA~7k4Vc0 zPhfMz8jB(iV4I9qg(`w4u!Rh~FszObE7o{Rxh3V&DR-J}t+iiR!Ei`-g*Q~}7a}_% zDpz7!=E1~s_Yf3vw2qI3>rg}{hT~gpJLYH39Gf%vLkmLL-vZqL6k4WKfHe|_-5AOm zrzO4jE~oS*;o_h?jD_?op75%qyN!=4lh&>m?mE=+YwsY<687LpEVw?8&<)+OPV}|A z^zvr{UkaQB%kRD#&|MUd5A2K0BVE+1h&di#}7zXC>%d6hSYk3XE^( z%0b==kQtPOLV2@e@TPWLRz)vdl3djvZ_h^_c!_IRG1|o@ezX;J2`d_@IkMVR&}KSz z$_#WGUxAM?)w&0jI^RWtoY9_>V}HLQXUMnfJOUF?>3qTtbul{vRDCx05#Z>0Wn(-> zqeo=vPB21)VCTI~hUKgqGMcqq+{$c@))->T`l)+A*P6x_T4SX7J`#Z$S5`MyI>Wox zX;vujdt$t9j-dSCQhbPP62WIVsBSn+^l{E|@DshO>KA!jjdpXdD+G-yy!fyS`iX2m z{g~v(;9J2i_*UQqV2Y{g(5ofDvfs}e%}OA;f7o-NG3#wO^(Zl|(By`n@gPNd>LpZj zp?E}^a^R}Q5v0q%u&z><_NCt@k~y6UiIJlN&G zFtGA;fPF0Wyz?8kS&&r&eABxSZ*{u zUHWX~`9VLKeAm18&#~T|m!sKMCr&wXeB?t6_oeHp0Lq53Q z>WHF}IoCDPyD>w0-S+gI$IKk0p269rFdLIUd!u~K%Ab@7HSt_h=XnUuVqmAH8Mh|4 z8ocJSMb7g1n={UMzBZe4!sF~aUNgJ%Gici_pSA9gT+86I%V;B1`Jy0}&|)vCy(ruD z#(%kx#06{(jyX5Tcta+wT7H9b3cv)(>Mqv1$-`;MJwpRb8Jhq#rAE-(eBam1!;BJ|h0Ucg{p`Em-h7lYe>FPI(28 zZTzJ4(y(kJgin6Z-Qb2B`=iH7;yTdUp)PO2z<$UWE&!gt?h<1gaC|O=>ROo!^*znM zc&l~+O!J>XrGaVwe(@~YPj_v@GwF>)!N7j(CzNf}tx0o7 zlUjjyy#(}Z1_e=eP>(ccp?g_is!w>~2Z>Z(iE)}8Y2iAz^WL*sm{#3_6#SGKz=Geb z5lrl3lXs9ZKkU#7J$QH3x)=jbohb{bs)k`Kk=VzvSB4>%oyVy&7R{it;9LzUQl#^& zKt6A1SwU26r<~@{dvh;deHGUP-+bOXR#6z{@_?XH|70F>GdjUrUeb#K?fH$j9K;Wx zVzSU8)Zd6!G2h}HbQ(-|JqvZx%P`=~-y?ck`r_Nq;TnY0n-yLflE`(Fk}WKE`Z@FuR8I#kcB<3_y<@EP zcEuDiB~#35xt2-Fe*dsDtL;Jl=0y;X9Z^&*gQrumH|bbdoRuoAMw~dgP@%rnq4%*2 z_1sicoT({~MrxKPL=H$7dRW*j7)*k2mX>G1CODL#Ar zA)`rC01tt1M?(9RTs~OuE8Mk#sgSRMnE%Eaaj}UMZfyh`yh8o4p!v@{e#-d;jQ8cr zj%CY5o{#jfo+MXON|ffs38Z%(%wi}t`C&NCD^f(A$KidIW7hgC|Ga2~Y<{nO2=a3+ zM5ZO+Ou7uTtw)Q0w!PN?d(I?|z1d7nfR$W_hF5#|{<&$9KdeadCbta6YQ1xX{rxCr z#&PRi|3h2p(s9rX@CMC*4&z;kkAk%}ktth(CFF;tXVDMcEd}penKHFkj8unEtf_ND ziWcegaQhj14 zhUK-OSs5ll)EfyY0Ku}v+hsf+8^aizDamZ+;UzpxVqzI9v&xr{5SB9UIcGW21xhBT zr&bxW@q;eb!nyWo9ssn6rs2ZGd(PI0W1DeW9OL&^@PY1I!R&vIBaf~B;^DC?I zym}gek$fav`J9NmSvlgb1IUEJaFDd&HL`Xtj(TqF z*0A9Y#v~{PXy$bofMNiHvUR;3;V8_N|RDlu{;aLe_j*6>pHe{|Nzz(^zZ$>>S zLk(}Gi0){QD2ZC!ED(+FfEIM7O1w zai7SYfo1?6DtO7%PkTn|*v7!2om^R1PP}*tQka$%4JJ?qo`z z-tHaqz7H!+6rTOWBE+pvt~L0HZy0jFzF)*tKLz=j95x=&oLnCXKZ>a2zWsInXi5D6 z0&#GflqzN)Xa<;v_C0+FWb7p*-+lFQgKDh0zLNA98=?l(zOG$N$Wq#2<;~AKrkv=b zao|qx+M~k7dFIfFXb!6wM;gq#V?{PFfH=&0q0(l|zd}JRxp1 z+I^Z|&uKd%9C4yUBvoND_Ocx9XN^)3KRd+Qta*h<)paad>GYecuNkJ#=+ zqa86Pqg1s5#94DryQw&DS-TFczn(>qVDBUtN`=T3?@h((^q!=R6ts_m?LMl^gWJ|~ z35Qh_5@LN*25GjMoelh<%N66u1~-B9Ga4kh4|OjL)3CSV=lj;WPS4*a?U{bgQGYcx zjZpvX5XIS78}nT&Ub`OmzG*{eDz!u#M8D`>BAaXmomTkJ=q9hPT$jP9O0F zcV**VOV>KLaU^^kjA1_!x0{cldoQ4Q_fo9(Htus@)w=!Z zPeoG-*QAU66`Fve$i3lH|KQVxIF~$Xt{8G_LBVIY9BBwk3o%bozqtWwpc??M47veR z`+}ew0I$#e%?&6gM;x*1$WYxRi`eDeG9(eGg8?t_Ij(0lkGVM?u{{7NNc*mHEfjm$ z81eTAdQ6ClUxRXhecR6qd~V+^@G0qzD}io6v?S{24>tgNAjeIRL*V6Z>p)f`?3A5I zcY<4a0TUfLfsb11WXu6lrm>0WO%kqjbp3^{ zkEXy;r#h#QrlI$@J-`P7fx_JUCB&Q$eu^1lk#p8~LC8Lc4Zau3NKYX3zSz6lmwB+e zwbvO2cJAum=KyC)Z;ZPNt5YAHeNud)Wh*Qq2G;vHK;P`jTsLthuTh23uVa0!ODJdA55y& zp2=osG9^g5?!&F^kTgJONo*bMzOpo%)EQ$Q(?sWoS3%VTD#?3s&;**$-DL+{+UE8% z@&XHP6_H@uUQ8Co^SOAsR!d-_{nfV0(v?Q=I4itU{@E{lEhY zJ~aIro~V0bPp{qew%%$w<0}QNwr5b4vc)SsX)P7oJ*G6_GSYX}5kQrcXT&|{3Qv5s z+uj)^t?LZ*n|prIzkP)Y_WB#ZUO!{#>-Was8X#USX_a-oJbwTaC*U*wvwNa?VSP>A zNA{$>6dU&Qif@{@Il6rfD^nzrA35dU9}d>xkQu5eE1W2d`pZEOfQPXMeJn z?-=(1Q#TG_#C#^@Mb=@Pm_3@eHZkX}FZ*V8oC+AsObIjzoR@I9eeM<3nZtDKe?+XM zxKf-rYm0fx47lU#6Twune$-`^X@1~wvEwh=COrU+l;VZI+V`?s*GpOFcIb$OSMZ6c z>K8nFxV>@?1g+72B|tE3_&nn?o%rO3jkX0603ru$Q>8sesTG>=C6SBFj-!m{@0MZN zU@n&VLbnnvrJ+?c7lFJzXT4}lo#QCb@DbO%qM}W~Vz?D?hN)C&s-r4J(z&K*#pde-vf|X^GXum^hyvjC!M2+Fy11uM!sl%5yBHX*cib0zK$Zl zaNVqD_zw3%LKex_9lG8*dm{X=YDGI+;2vP+@*!jofG36Km2_(f00#lp-v$A#dBEeU zviQ;y6Q3WrZv}N@a?36%@oO!jY}P9~)vbH24vQVh(6$r!hI3gAYVT0rU~mwQg_Pb| z&u!TVW|PuEQF{GO3pjhL?rORvSWE#1`(Z;idk_y5CLJG?v@)jSWzb3=dLSa_&>BqG zhG~kIL<27}O2A@2`^76m1;M)yjdaw`KBE6kckLH_FPcm829J^4#{n3oHSj(i_TK2su7^X<@5}zS@(MyS! zN<@slyH58m2?k4cf<|X1VAGlJpU}%>A8~_&fU23wcJ^ta(_FvxPi1-SgU~LGKL!Dt z!!D1`yEn0xw@e$N^>_H=;fx-c2_}5*3H8!GY>eMqEEX}1D;+o9@zmlQB8R8t1~6vj zkl$|ExtwUM)9UsOZd4?P&~^*)6_;$1)Rh=b*9O_whp|7_CB#o* zPceSQ9rj??eBo}YKYu(hM-7mLs;4rXn%BQPgXJ};dlf8wPFB9pe6m-H@R`vkRF%0w zBH@`^fpH{u5i@ zr7<*c@Spywmrd_|c_B%r$g|DDeB_?T`nx?XqOKo473FI{OIwfAV5iHlKWky8AEq|L zQ`OH*wK9BO-e*CWl7p*f&SjAoT!i)6Y$X?{XTnAzRmdWg*Lo#76Q*51b%rY+jfB>o z3Oyj(K1fu?+W2VoAS?C)bK12x8ujHSc#3au&y#=UmOb6+p(D~FObvm#!fO9*j-YBO zv0nXLL-^(*)$CiyxLG2`Q;%FCj37T=v{QYS2mBqv9R^``G0|R#saP?z!`h+>cY)6` zTAWtBAuoNc(-cwcnQ`F7!pXZI_a0;Ow#!6?VgnDJIe0VRK##YJicmE%lJPE0u29Y( zFHIsGe+rAD?hii3tY9JxeF*Pk{D!wrAq4Zlj{@3)y&Ca!xNWPrN9rs3pw~z#GZn&i zjJ&lV!!3!P7orR_K9ECv3*@VI^uWQ<78*HPtddSHI0zuCEffqesn~A}yUqVGn&@ob zboOoy4G|d}yr|%maFgG-8~CRp%W!`;TBq8mk$<$3@#07U)zI@W%#?nn#i#ndK;!5M z$wC;F*D%5vrQ-g+$Qp0{*SnJki(+xt-a(9#rzAQ>qxU4vI~34kiDY2V*MWuE3f{ga zJUfL>qQ)j>3fivN!QO>KyzQY36St`1cw-lMQO937DmAdg=p8>-B&IlEsp)nGS{3+CVS=aoeAz_-_HF$l4(}Dkug^vtJ2=L;;v46GetJr zn@C2f>Dut)ow`*fUT$i4bJ(mHHOisnhQn!Ao;bz}%JX^G_f?a<>DqYXsI-YZS!5=U z1S2ym7a8Z>gynM_Da>ACQB&8wJUs;7*`^uCfMoqMAX&dzsHgC{poHL-*8Xs#>Lx>G zH$$eN1D>p3PScx{c@A`ppy#iCocm=mXXm1kv44R6btt5^P8At@xHh#NF|TLCcFe*7 zGtFBe58G{iD{{?SzP9=?3SQ@Z(jdYZ>^0B`-!^E3Z~MV~i1ZZTsQos=*JOg>fthuJ zb|7gj7V8rlk~<5Jq1f?^rYcQCXd%WQ6h`jse&uuUD8_w8Wll@b@{_RutQ3`r?+8TPN8p(;umAvFQBUr+3#?hfR<( zF>bUE(eKTjwHblcTUOAy4`(hJYSX}j6TN8r0jC^GQi#!&zw0~c9|My0gGm3cgC{X% z-${RUTM+4A1ss*a-YjZY4Ox97{pFB2;CECpZR1LYC++#yhqaJ7jKg+BLd-ktcqjR8 z<>~_YpwllTWCgPb;q-=9U*;yT;(y5Mh}`oBl98Wcl$JJDoDJe6%J{Xu;tqL|D$Mes z9GqAmKQ{$4Vn*UMQFz%dU%RxyiITdcrSC{J1kEVQWAdZY8G|HnQ{A!7+|Zdzp;hK^ zeu`3vacB}ouWcd`0{kJxTWOBk7SZle!WZj9vMIV!VkaY;&MwOKRM#%Gh_)fUMCL{* zz*c; z*4<(0o2(ymE=%PicLeKF%-lCJV&t;F`OB6 zO@^Y!=5NBdah<{bIxdY6mZ*+=!YbGEb(xO%`V0O|0$?mgJC{loEqd=2jEc>%ymNh3(!n#LrU`c>s{E|0<>S z86A?5t9VBuBE4ib%yQ9mfXF~3QT zZ{B?O-PT|D&DL)a74d=Ab0tc!bbg9(3cpM!hwM>9omtmnjN}v((wguZ!PUO z7QGeq;$7V3lNPXd1EZCS`dMEpD>$ihKinGbY+>QVF!or=hoo4rHBR{wcUrSOW6n`_ zq-iuixI(aDfdPg57tDai-D^i*G^9q33q#eeSNJQFwdji-vN4qSdy$>_USZ%6TYUSh z@}C$&wQ4oH=vaVJ&BoK2y->(1{(I;d+-6&Ww)*Fl^LsJZaY@!k;J#eO{ybdH6{Jh--Y|DF)lUB+Oo2wH&q`7ev`AB2zP>9rN1l_6`zjg2xy)^Q9n6 z+|qqYg;fjGnT75o$)KJ@z~NfYnwPVw z9*PY^jTOtdfB8lOynM63ORQAA_XORmuMdv$j@0#0PI50bkwWH~U|w~!=d$w+EcWrn zvtqEzhW7H!?vQ{?nL_k$GywD8X@G=A$((E?d+?*{PdYHKlhMOkGQ<5aKkg){ZU7N= zUmwa)7#mSQ{QnZ-+Ee`_;UeueG!u_!-CtC+edbmCDx#FyWR2<7Ip`58Wn}4;wq6KK zG-`u?qESIobgid3f;B69Y1liYGoP{7OA=|s-Zr@_QdEM@gUWe0ej7rwt|5?r{?Y!! zyz?-9iSgveJGLy#$tAaL6Xhz%d2`@dhbx>{)YK~-4Wq{c))_W+-&laUEiUnmALsrQ zsq|_7J4N+xfiu7!I5#NVrxZtqGpjcDTx6 zPw4Xr;PX$Wjo6&Eb8CvV#tKxQ;JsJ9&Xbj#>3bruXc5EiKW+yP2IxySRM2pK@NBmQ zN&CtDgw#S)UbHu3ilacN2(EvF0ob7F!&aht*D7Plp>aO#F)a(G39MNOpT=n!7wM_F zb=UA6Avi~zXR2DPK5um77vK*3hW}^CmRBo35)gH(%Ps2IO&7;vjUsYxc)dFR5ls{q z?C@iG> zD50qz5F^c6rDmr^lPb!hy(b4Y+KDM(x9*@EHv-=-{prY)+6_sbiIc}nh%V*v3-gu% z_k^X44m8jkR~AA_$meILG2Z${ylwGUZ}`k|kA1D|Kk2dpZ|pxcG{*}LDrAePz2a<} z{G4-BRB|LH-6(;EY@YnK1ZpWdt>|%7hV@lnJDpvM&ZIBwg=Z*)~1t5FyWlW_`TBE;WO}`WF9+ zO1I=J6?)YYuzp#I&^ku0?@aHYrPnKh;wSfIS$WP}_4R`J2@NHA;><{5@#~-vs8AW3 zdx>sytFu~+q&=>@eBva@v2b(cS-#_7N+^)tFGh!esiuM{l(eb>EBvyFetF0kQxuv{ z$P_#j^rw`;_#~08_%*1o40t>k(pSQ_Wn(z$!K0 zPHnUZIAo!IMGdqq)b+FH&?&TfFpn)lmsm%m&)iynocr%|-n)cMsjux*Jmm6IvW0{_ z@R@vtu#wjAiDRM@|Hznog<;$%K;=!Nz1b@UMfr)(cZ129N!Dv)ZcfjGCfYnR8U$YpDwVzTEC0y?%E4oDt;r8~Ne)Gi+m@KICPYww!7(fYHWU zG*lTr2oZ0P)}1HTEp38&B~LBFXpd34HHfozsVKreA39od*`+Km@|YQ{cb=5t^XH~g zDeJ`sY`27+8PZNIN_ecCcP56P|AMyV*;RmA44S#dQ|I>sYG{p70BmSQz{J`&z_9JCj7wfkNAI@@B_a;;{R#F5B&a!|ECE*@cSeFKPCJR z8gXtNwvntS-|PIQVET~2A?tH@m$BPw2}A5c?|S~XSCJ!6*!Cd?T;wN_8_Zl9Q* za7kNqa@I3ukzna#?U*|6_3Qk%gLRw&2U<`8#dZX*xmYC~!}5|KjqmipD`B|bIZucw zk#VD>zgL;1F!l*XFcYH5_%Kq86SPf0P&NkI=_{Yw7^?nMHVd5&puS@~?~+=GjLSFi z6X$MEB+K#O874aUpxGOZL=BxPd6dsMfD3tcX)Fjp>&#yN*Wl|UUWPc)1O@2C%g>_jWo3jzL}o_1D+)g9-B4&4iVM2>RXL>k$J zm0qKJI<``eVSDA*!hYqSCMbBX`1M)B*2D#;2m}lWITY;>f%P{$KvW|RsM*g0oS$zD zox0k6?u#XSA(TXNj3Uc#g<<`O$GLI!mosC%+nl6^&hLIzHLh^AZ?+qFBDX*yKpyi z_+a3`-C}SA$TnDyF!$nsr2f(!w6eUhB>v8BHqE4!P>u%aSdaEszC16v@U9iRw$r#T zwCL^Iegb@5zJhvK|HJt=v~zo*w6Rw~tb$E@-o1AmCX+)HT{E2X1p6zG<15v>o~?KR z-Ad@WMHIQw$-w9Chx3Inv?Nb`$YopnOloTkBLQiJ`KhMug4ils?In9UZ`7yGrKyiT zfU33Fr%NhJlK9<^bT)CW?p9(%H9^+Dd=Bsl9mmgA&zI{|`7bJG44#Oox%Sv+q(4sP z?yc009)5k2kn-6^g3EouL)>gF&uDrFWc`~#Y}!QvS^s*JQs~TrHA)Nj7eChOhov4r zk^^8Ydk)rFT$!T@U>A^Lp4&X}a)!K(vTr#G0xRSS1uyrNUqeR3=28?=qmzVFVLeCx zZv7jFQ!KO!qmZw~#{LCRHJrSiUr;kZNR$2pVgLS*+Bi zKlXs*a^BNk_1({nMa7Pua+WaX2ukK~fc{rUpD7`12mH*ju$CrHU(*;ahjw;d{e@8! ze1CydAX)YhBd6na5VoRl410z=HU|uDgIxF_<_HK;{SDsANWfs z{$Gdqfxm>}|8kvQimr(q_4)Ftj3B~{G5I^vjQ2f6R@dJMe#sBLNKk%1O{J#$I1Ahs{|LYJx@Rv~h zzYg&Oe+k9^pCJB)(TCSR@ALz|qtySu==1}>qtySu==1}>qtySu==1}>qtySu==1~s zr&9l{onZ%}@}q;Az{7S4=^SV%A#fhlz7C=M-NNJdr}73l6`5#38D0bt2*W{$#5%Sf z#p5YY>fjvmcxW$&V0Q-}sRCi(x6>d*pA2^Hq6&oQLmv^VAfmd>5|<7vK^X6mrY5cj zF#2rJ*nu@e#!e5*k5){Sv%Rf;?)njzDPmK%rQc*cOrsR>VDTgDJJ3Ndhzq*sJJ$Yo z&+}P-zvmM`_k23oICChttjQnu`~^Aao=;L_1e7kQPhe?>#7kB z4O{oQlo#lrMW*}on1D&|$% zlCp6jY$7e#KY)A$xjF_(D_hf8hsq?*5?wlDDVEf7*hGm)TAJN__)YI;23qRRYJj?cH}Emtfxe!8@- zimdJV6+BU7jbBCD70hvo((8CTm*i%bMsS6@a&O;#>(r0qvC#R4ro1zS-y<}p|(?xKIkU`Z(rRSlL{#1 zP=>=s#-<9{%}KmCr>?{A(2GkVIcQB#&Odw;(r>qJ$w|38k{SbWnS+K;IIrv%dC?Ep z>g~%+NWVQcZffjz$0~=)1xDK0?O}W$HHU&McweoSrgk_$7Q8Vl6iZc95D%ZZ;&}kL z6bbmXoZPWLV*8x9B7D-w{+)-%MLy^~0`c(HTwJCiNUa~zW}yu)>!{f^)bp*vjlL|q zD0yWgjRMr|)jlGHB$>@#3UfU5M*XqSWfY0>TLq#3q`dNgA|_b+Z99VEMAIHecG5;T z2FGotl$m%|CDY^tZgQcgsYm`qUAy;0YH1*LJ2A#k%Vsc)GGg~zByLzkXFq=%Y$!vdE{Su4lKKHg@r{Eq2R*$T>D&!(dfy$1@AyJJH? zn@+{YvCjd<*C-1-iNv@ADviWzQzl-BQlED$Qr^y;w(EC$?3a7SqXV-zP!Eo7Y&4&y z2;mhNLH_(p?@+b(wB?WKjxba{PuUbCZqVx`_v3}>G;ZcyrJFr0>)6gF1*0bMI$I7X8%GBg|~U zLx@*TSqRR1@(i?a=K>h*B=*!~AbEK?W8?FOm}(c}{=4FP5`%qbU**3P-;st-g&xsG z@l$v*fQs*r%6}B!Q|LJY5C15>KY3m7kHz;8!+`I__aD7?;Gc`{SFo5jp?vh-HJssa z|5SWuoL~D^d}m*Cl61NclW@9+o*DowuuqyfRGcK=>{AhD<2~r*b~(Xz?)^ji9QJ_h zpWEl%d*9pVhfBbJXrId?|7f3I4OINmKF?)Vq|0MQ~2utiIrfs99*vMN$Mba;7O`NVVRf_?qow{LMl^K-DE z`MGIYWU@A9-hN#}@IefxOLxITzP7r6jiE)qazodu&TD)5T(!v-dV4@lLb@4Ew6*Q! z0L5v^oW4~JNJbBzqmc=g>BTlG`Q~F2AX;KRgHHh+9sP%lUWzwTMYuq8CqT}E7OLay z9F1vph*ll^&?&%R%~Q03+0GTJLJ>WopM_~D zUN!2E7JwAlg*9U0n_C-YcSf)R(ZRSWJsoY`_`%|I85Z%3jBsC3BwTV}-WUae{A??$ z4x>DbL2p(mbn}StgNv9XnVn;Mden+LZ)rg%@OCVaVFRm|A=PIMwtVxQP%iH!6h1u< zOx5Luk~NNEJQ3+I^4WZKRncn}k62=D;kilsai3amiYfm}S#a^^Itb&j3r0qu{W%ed zPWY-*cDa$=%L?>XcRcqRa8^ib-%l8CF-72F8QfXmG=_Ch<1+6MEY?ZED>HkacTP!s z1m<2&NgUssqq3_c(%3=mA?U!T@7I6sq!l`2k>IOwFRUHFptUT~orfxal>_7s}yB7jc)hL%P~ zIB!jj7+)N@>9i-0(?uY-H=UnQy^mWMM6k+KiLHQ*fqRG7S>6M#s!{7FIH#z6Y6!5w z7K+8SnJ+&NcC)HCitkZz|7t@U1_7-+U}%N733p1%g21QIi;OfMQEib$yL03DO)h8i zHKx4t_8hysv3E}XUe-s!5*z=)<7)xbdRh}4vyo=ZOD?+(Z{-7I_|zcGx?`Ev-k0G^ z>>+pqV~gMR=f3PeuNVGuE602?@qK@;F6q&xJhky{0RzsD{W+TIy1RZwdz*@-2D%NE zS`c?0%5obP!lKG@faR$K%{Gm3>OzEO@if)}_FaL+D=GQDk>Erj(>g{G(EglsX!Qyc z&3&oD_{b|n_p*zC;F1yxstBA*md8yUH*1C$cUIRc4@vjDAi*5)+YNI+t)I&PzuhqR z)B1S;@Y@Y@Kdqln0l(ca_tW}0D)77N=U(+lg*C5&7I76(l4{7|##2(rT12$JMb3@# z^I=Wf2$7(~`GYM$=lu~J6gle#e~+ABDK1HlZ$Le;d(6eU@6fwz%ph9f5~tqGpO^b} zylB$Rf0Y(i|FVi*m9OybWyL6$Ro3BbCeotA3)$y&#&PG)7#mymUT@31d{Gk-Vw?)E zK{)vm2q!1l0pa91kl-}6HGjj&(O!SU$pQD|Q4ml5G^MVSUembn51yPS6TY+OWV^Fz zS!EF~6U3A6NdFg4E=xX0Ox3KY#qVVbY5a{R|D1uY8OmhL=~HihZJ1_ION|A>$#b#Z z+7|K$ya(ar5>MW8JqF?AT73fw{YIkYC>tjwm;6(16}^+^&&TWrXDl{aoMM^7?nZ3W(u6JlfuXy$Of96SZrU@(fXMx6E7i^ z-A!y|AG!9$^NYkRfCzEui|}2agKb~O$gf?fnG@Iklf8vHx^fp?Yzcv!Ty<@mY>~Wu zAi-PKbQ?4PJ%R#qx~HlM?yYqZFmKNc=}fygKE)(EQhhjtR#+af*P|V^!~bstZ;zfI z{U^bj&IJdQ7F>cgYWJenCb_@Ho-Pc$9TY<<17k%_Q9Ufs-XwI9UL!s_y2>3RYl6;` z`=NFa$K1e&o8#%Hu0nwzfOG-rHhUS@U_#PJ7B( zcWP7WZ`^sP@c)3a0ZXyi4*#HkgtGH@7?v8ubzp6uT~1rIF59OOZr2fHX>#@mr`i%n z!;xh>UrKNVL90_1wG^2aIo1-^E{5gdXQ!!io_e(*ofX%)`p8@A0=cB6EFt92PO$}Z zJDM;1)R=*aJq=gWqN2K(J)4A7%O0>uFUe|_XV8fxR7_Qg;jPD5-l5Yg*V5@K zR&!5SmTAzVIl}W60k;#BaQ4UiMrCYMIqL%=?K%#b%!>y1o{h1#I}4j^=b&TlzgpP9Yl6YQBqXU!SclV0!F{w&iiZ9EqwV{)J5QG9`_x-;G1GtpIhUP&j(KR+%)L^ zP@jXY(*<>%D#hCRULbE6PI6_1cQ~%HMRiOul>`ytlXrGe%pdY|P;3hP|0zEQ#iqc& zk)JVgvj=&M;ZQYp_`@B|T@UdjxVuKL`<9JR zjLU3`qDufNX9&0Uhh?|6E!M(k)3Oi>Ni2ejsx@P+3a;T<6GwVJ;Z67dwKPp^G8gaCj*5dV}9V zFYK|l;R=7itc#K#tMb53ZR}OTBVoR$E0c;FuwlT!4mmB{N{R3+m_>9W)2d1csbrir z_3*NPyDZmv0f!MIduA&{jbwCLSnF)wd(1=$39#+YM8#=>a29P##7yy2&#Al$xh=4j z_V1ms`x7*(XM!E2P?~n_woUzPHC$;>Lf>b>V`UY2z2g)1{`x7vqM&=?tSRWt{s6YE z{uT$Imetf1IePnwMStX?V*(Y+-z3{d*N~0VuJGe0T3!8eB}svZMtWQ9G#mK|%>-Ri zaUPCnZl^Cjke>#k3v zKMYF^;uw zN#EHs0^TLQGNShAC5p>)EM}-*ErW}d@813B0z@YymTLBEWMy+WDnzFf%@PpMBr2$C ztvNVfyrAq{i7_~Goq6$gZ0hS!^}vbQ39xH+!djzr?_v@DF#fFL#LUtFug4`0hUF2=J0f5(Bd8njIAzBH;R1;T)4TDr8s^|MGC(b$AvY(~pTK zYkANYGh6mi#`dH0yoQldcA@>k77$t=pWvOeJ(T>c@}3-+q1w?l!lb ztiqY0=G48vo-}7KH3Yf-L6*GIO&1c3yO}QgHv7G7;mv%}A8r4W_S^Gs5`SmJSL{3J z8+ER88?5`6^0rK@P@VE^DXP=iO99>M8!^J0Q4b9Wr4!=lV9kULA6}Ksf_ne5m}uzt zdHt<`n0zOCG32MhZ!&*oA#3=PNz39?H9Coy!G>1Sk+GHXu z8=5FfQTj{Ug_-G=GOK@X05Hj5pYwN|OSB&FWwF?fGwq#G4UX6~*(!ZN4)X^W_(jGwwuFqhz|25$@l~5*f{L!3lWe;=4C%Jjb~^ zAgro3D=QNB-Oi7Y6{>=RyLh8kxPe546|wA0k2;ks-zmf4%>7UzmXLST&H` zRdE5D&t{0-xp)tj@4tbdh`9$Xd~yOX>4G~JBYnfVd)cg>`woZy~1R=0KL;J2S}iIyw?Iy z;J^9t(M5M+@WN_uGS?*8z%MPpW)~R&_C4-n_?g0$&*c+#o-YP-R|pqtUaBf(iFH9O zJe;fgA$e@v*uYqNb9RNSyV%U)aE`ceyqJ$%AqY5Lb#$Bz#qlH(szn5b5A9T}n;H~W zQW!);E=r)^s?9-%=^|T(DNBId_l3%O27`IFKR&x$C}!HRIK|s6{^KVX-auyxFQ*+? zs3{1=oo7&p#vLH*J^Z^qm9^3D)_e4C)_c9qr+VXGK-PO1`%W>*9L}e2E6+*OGXeSV zf3n^q3eR?*wtlzX$A$i|-oMU&jrXfxT#&P%gy%M8S}r|&9dhO0pU#@03DGf!mF0AG zMYF8{`}Ea+nDEM@CSd;CPcA7^ly+~x=AfGFRZD6TbNuVf{mCaK%cRNFdNLt;bMfAz z4W)TZ1X7kz##5>ny{5TL-|ouInLxT*ED^ZNr_s5Kbf6gSYx%>bE12#C z$W*3xK!T|pNPfRuTK@(6kP&G8A-@k6`@8)9d|FyNNijxS%AA!Tgs->E1X?k1K*yP)n^}?9~Z#`O_bB3no=#fFC!w&VVY|-}+ zolQhi2n72`8T>H$cReAe@mFB|gSPgMR)Za!VtcCIOFAXVCOzoLCN;mZKUs+Hye%G7 zNRs`?8PuKI1-#p~QunlS(MRj@tnmy~AK&cH)BViZ3pOeGi7`TD7C0-cMR9YYq_=kI z5jMGdGb-%T%U>gt6x`@)Hy4pKQslxKW%`mhidvbEf{H_ z`GGiUF5NYXn}kjwn-7rh*vf||$fxMUWzHCIvbd4?~VTA z6-r2{;7f&%Gw(OoX`R2uQ_)77?zkH;Y>;Q@o_a6V5K9+0RJ}g;Gey~!;VL$tDP_;k ztq;JR6ir%JIJ)f-lhrDyD?@`<$eG-}_WSUN`jb9AwjR9y=7AF+2dT~;tmq%`qy*f@ z6I_W;QOzeV`_|3RdSA>=SX>p}v6A?9Hui51Vd@U$f$el|s3cN@^qr9765|=cI!ZK?^pc}YO0;+O^(*e*$LYUq(;xn^P2ZH2t?DXu zkJIP7Y2(VW@a5J!U`?hWDK@d^Y+-Fg&C{eNWm%kSattHlNw6QqkntM_s1XK6f(O~I zqFq%84ENk~_(#2#15X&Sl-eX zyk!pQ-ju^}n^wQWp}8d9gxFRj=i7QQSRwl{;~*KeVCLK}uysw(C-NSR2V(5)S`#(G>y9%5Jyg&wn&n>&s*{e%KCX9n zyz2qzA7u;$iY&@>3n28^y)Cj4RoemHoRvPl>wW%hpnhITQVYXkm4bz<6vNSjs*zY> zv(fIgNdPlfCdNu8TALIlGn7{(5`*m=B@^{l*_vfX^$u$CFo~FF)-Bh%#B`CVOl%Zm zu!PPsoXQeWDWt~0!lw2;bA>Uj(X*|>$G8AwzAyDum=2sD?z~?^mLBKgp1pK`Hl1NC zF4K9W{Vmxye_$+?w0*5|n@C zOR}5M@*;RNYpuUfn4kuWQP}%Zw<`#TI%;Gyi|)lTu?7Rje;d^Ll%PZ?JmW7m(gFXf zr2Btrqyuhw&*$~ufSLwqZqZI))kQqj8-u&+G|ue$IywflvNe4~W8~3e*8%;TI(Pfg zz(+AcK8TDohBCOI-hOKcWFeUsFc6p8${bWnL04}greykjN^9Ppkcacn{_!K8c_CKc`A-EraUOqqx8hCAI(ty4^DGsdZGhh4Q3M*QnQ- zBkPOXqisL9x8PM4VWe~bhu z$9*%W50k5=Eyv#vptfhVe0WG%sAecN=yr|#*g*piu^lJJD2%@(kuAr5ze~||&#^Yn zYoAqTFGcBV4D&(USm#2LOy*JnZejb@+HL=4XN~vX`f32@ruRyp;baYr>@goZSTFdY z0}t4G%#{YlaDUca_D`Kg+nRsO}V70X)a_7xBihFlGX=sn2s?LfN+Ot6lA2TZ+TrnjgwqNJN#5U>3)0 zUIWtQDrZ~>9@0$dSZpVfh_X{&c;-p zF$y>MVJP(d4=^J&@Ua0+W%`1Ol3fZH7Z9k9j?2x_R=Dd5#>Ii!7#&oBSJBe_A{~{j z&0my4wRRH263;%lmB!w1hH((&}-cc29oRd&5f z>>qHx#k)4bg7~^ad&Qkg1n>ogkifLGWpb};db11P^+zu>C(k9*NWG{q`MjK(JRqf1 zVd9gXuBM|LUg6Yslq_*{DFpr1DNq6xy8cY}exo2X z3)a=E=xE}M$RZ8FWPav7{+NCXaBQq=%<2d=>#Z3)$R~=KO#s{J zQh2iw?C+$>cA`jMr2`h@U%umK89#IVOx$uSid&8GI0nfJ%17 zhZ0_Hn(N*fk*d1C9UjN>6lH%w1*Kx3g)mMU?{ReUmCuvOMh;+ib6UWSU zjxw<Y^jeYx4KTkzVX{g`r z{g5>%Zs0$qMxzJ7ZWk>`ZjB7P@ftLARm()HxEeJ<^)ZgLpO0(uHNTDRkXQQpvPj0> z=29U{_JSiKOis(`q^7qgp;LZvs+=uXXZ4Luj?mg*N|e=?TP*3R^6bpjp~NWb&i<`M zx5v6MpOLOm#9Cged}{9rXT_vBrY0(hQSk^S8pc+?MYm}ypX-) z9_tANEg8N6A9^Bw|Jdds=fPA<@95tDLZpFr`R>ZDfj57<*XEv2+p!6skKc3W@dy6% zTg}_mLVV_Ao>9!O`Y5v6-e*57*-W?b0wujP; zwpmc+9lX+vg2t9M&bUKJmEH5YCJ~8O-gTClZ19|&FWT2X-}JK{n{7rOm2|u+kZ!}$ z<41@jx-(Ap?fRTO@%5$2%Oqd24e9)~UgxOt8FkywkpK&AuOIW1kF^7>1OYC$>gPgp zs0&!y`|APSjTpk_h{!60(JG*A5pOF+@~{G#B!91Lf()A7%V^emTa5_)#=tpZ`{+qE zZ3j1}dJ}0SV_w;UXUrkW8}WUc=6qv!z2$N+ZuN5_Cnot{@q>C^QJ_!A6yh@<#;l>Q z&vO7u5WxC*Aw~SwUOHWO#aPipx=XF01vRuJJVQ;38*~?2GnXw5+!=ZNNBe|9?kPt# z*JCTrYiXptk474E7-JH|`*}_Fjat&ABXHX{A5IqKd&+85NiSF^GF`6Y9U}^zsplbY z@*1}U!&V&7<2z_MWN==7zb6!f@X{V&lPb5zS3?M5NU@-8dujuCw~tM@nL?)ENz6Rd&ROi(=*j`8YS4L7(N5c zlNe|}Y$T&oo>_u~>(OyUuZfGyklzVv(lonvBy$QQ^-?ahK4bzD%1CH z2%b0rT$CBDYhh0WJy4`|mqdG`grDmW&=&y<9v>2Wmnx6Ntc;&aF94eYC9@}ig~a#5 zN38GNfR((`v1cxc_!yN!xHlh;nZelA=b>IyMaSZu6>lIanb&m?zc74XhSrm-u{aAg zc=r~5;~pw}2GH<7PY!9PvE11tdZchSsyS}7xMhNnqYmF8F|}uxey3Ime&RIQp7~L2eD zgD1VvCkwYuQq3njPVmo90^}bQxbt2CUW_y0(lekhb%dRD88@W#D_eUmlF@qn`|D9j zoE)Kw(Y&<#YqKvR5%@?tHFw!jIp5&&x}ixSWw1_>=3lxEgD0psQpuJO)S17c`NCP8 zu=>Plt;FfFqUp-SW>nVIA7y^p`@PBw2s&8GK@(Z`n*OMunYlv-25}cYy3Z+>07CH9 zJcdjPx8EUL!pBE=vIX}oy~7jLpSN=lXN@?x-dGS&nrAvUM?HX31!pX6)jvlu-+LXR zlTRISpvK6X25%#Pb+FBksVvz%pO{s&aVW#mi#=+!FL6NuK4h&Q!I-Y<_Wm;pnk62o z_h8xto08Pl4AWUnNP~%d-Em=kD{#x=%0Sq18S}W<#25Nq6z5i*^B7lAsOy99s`t!C z-jW&`EV!E~JFKab&HC2XjvUay5W2C8r>mf` z8|Eq61fN+mqiA%dg9rEflFbIH&YF{tLDR8nd3H0>-Ib(zz>-yO9$^L=_5*EJ{?%sN zw5KC=d)?3L9DQhviCPb*oyX7Bv=F&Mq|Ho7idpIXqu&qN%C9TRlchuY2m6t=?tuH3 zY}Hv*F(^spO>Z^lhw;s1uPX$M8D+noLzIh{os-J-xIKF1;(px_C^F^c@XRHB8f(!y zo**iBR=?Y8Icg^A9!}-b^T(Ti(D^dV7n)jkQ<41&~ z)@O-W$7DUl+BxP~V^%aGZBUEyFNBjN`b41bmWe=r6Db*6rE$QYmaNfvC4?kqt@N?& zBTiJ)tyWK7e&1x&-Q`ya{TtB7uM`4r!xZZwJ z8dZBqd^+kNOY9Bnc!nv=eGoai^d`y(KlYhbB5CSmRH#@aI+ua~>S^5W`Ws4A#l*0( zv@q25a|PzJdUC$@=tYGsso1;Dh7nmw)7Sq1U( z&@PRbgR`WhTz0N2HhUA`YNa?|pO}bD^q!F{_n{QuVi_Y>>Q|la5AoOAGlodXo7`xACTwxQ#I>^Y}k)kA7 z8Lfg4-g~)7U4uxZ2e7jrd)w)<%VLBZ910~;&{N|^9q!c1MCi%(RhB!-w0|N@iYPvK z^Y=^EhzhJA2DG}Yb}r~&-<8f}c%(NP{8H4#O7kP$w?o$6C!Z!s!|=#5)O$^e)(j&j zZgoOC&amPdKb7VHCg|YoR6&mSnxkS!rBnUwI*`NKxXm!DPD5L)bES@MmtTyj9zD#K zYymHNMJ54zSt^~d0`;mUxO7U%(6PD85&llLb){mgqp)cqmr7tljxMsTu-zjHXG(5c zzD{riU0=C`-Jw1HMl8M!HAb-O%TT>sc1v9u0>`~95pO$2bo$qw0P#ku*LO`g$0FRJ z=zvG-+B5E6{Jv&&nANZC$}Kod{pGM*Dg^K)#au7iNrX}KnUG3?q-8T`eV%5eHZ07Q zQe1)=z-cUqRt{r-_UH6%8l&lsYN3KQyqI9jRohR)9M_f$lBO0ui)PK6s5ovy z@}n*CJ~=(7WsZ|bO|7x;k;ksn{e*NtSOygFkf8dxv`;EdD4VJKL>%`ehLoZ=M|!6y^R}YW>q9iXyT!8VwfcZT zo(XHUc8)J{PX>$q0Wy)DbEahRpxwkqQ?vSga-T+jZgGM|)@%2Kht*rs4PN$#yTOfS z9Lk42!iq98%K|usNtT0%K`9HS2w7G`11s<+tD&agz~d~qjCem^eqqOB^H^;`l@n&c zYG+QJgHluojh#?rLyg%}a4|Jwmpht&Q~Zu&(2G&MA5!<$FAN7PV?8byH$6&NcIFzz+^kf(f*a z^S##ldUPeZR_Yi&3NwhDP?qiEYGFGos)7s4(MV`VHH`iANm8tou^mLsz=ZMQ;p~o9 z!f+}yW*h^b1*HN;tHs+6d~{b zI%&C@p*B6?E?#>Z&ieEV8oVP)qs-RHzi|O);^I155Prtxtd|1>@?f}8T`Qd)MNf1| zYH(YrS_n*BDCtrQH;z?N?TWdR@53MDo*4x$`M~$MB`#tSVnt8wh0=>hD z;HvtH55JvQx@s$cT14g$dE8C07T~B)$iIEKfP^50%z@z+>Ydnjv~J|FUadfv*Pevx zB1(wN(|WrM_2B>_eCGShD0At}f!?TPElVb?MUkdsJViE0DIHhLM+7=`7$=P8fM4hDA1r z28>>a-8rFvf}U{d`b*dN;%Rkl$>KEOk|*6Zh+~?ldHWE6zyFR2y)mIj4nG8|M-B_gS+{AfW$x zlOyQGoGMa=o%0ELNxLzrw zkxk*uSsM3rsdpr+!$=(Ge8rsn-6Un;sNbOcS$MKyyZDt zeE%^-swsflit9wCsnsO&1JK=o|MvXb0P>QT2IJApnvTw-nB$CCSC<1PE{~{ZRr$T& z{IA#Nv)T7;9dat)_a!Biel+)*X8g?8L>Heb$2Dtw@Vb?#e;z)^D^(Z=zRuNFBGuaj zI@&PTkYW#qIz#Q;71;bLJw8!=%Oq@3&K>cdCBr)?2mWSH)9wud{GX4l3FJWRR<#TL zf(yAsz8voSI56(G$*HUEI=E{&sbv3fG3)wE{?KiGN0yN}7ubChITt8esZm``wrW?l z)i~Gv`0)7q{czsxz5PRYll%9YJ^$hA{I5>Mne-3c@+P|f3W4_DF$q@fsBkoO@qfd| zfo|&#jsLpP|94znX@5>4G{pZ7|7+fgvq%^k%A%It|JagfOB|^^@sw!$d3pZ>{yW#d zls^oJpn3PLJgczPso4Yu+-W78xDtWh1bikd)N||Qk*l^-dc8%rMJu#(1HUS(GkO0y zU&#Nkb9Mq7HYQ&g-I-xP8JEkbY*GZg^6PpY99XkrZ==;}&ftGIdH&O5d#fv?Nz7vN zsKUiUU~K0r%%8Km-8&02FQXZ*fp)ZqGcjLBV2EU+sl0ni;-rbpewYM=3z-xJTL$BI zFRsUEndWhz#Eiy+tcIzd+JFwi9*sy+-a0G_yY7SSd7<*W{JX9%#0o##5P@=OHmR#b zA$2Pcclz{a3XhBU$`l5be>AwIrIOJd7o){6_|CyGL z;yy`~_#Zp|YJKc~!69k!M#7OY^2GEIy~4!wzvM&K z?@rsL!j<^<6q2~D|Ig|D>!c-R1OHdrUl8d+oira|6dHj;X_l5|sJ{yD{3H!vox0&+DWoJDX$NHOb|HSrcO!b*dh__>sozr_hSl`@MhP_GUO3!aX?YG@`+$f zNI*HxYauXcY_rLHo1Y%Y>{t?xVi=TW2ws)+4jnJOll;^sb{_@N1rD|MOvHwbb>{CoSX6Xbw#`SuSi zsTe6pK?MFI_;)MfU$+WGn^a!r2h;-yqDo_0`hQ>P`tc8Y{}%rPMxz2eB`lQ{NoFxmIf zD)ssv;kn)C)UeqI!pLTfs(#WwGMk~%OK!RR^xL(w1CCk?cRaj1jsAMbAJ7&0=OO=W zj}dAn^VAsfmA_HCGJT*FoN+#&T=neA70xMP!*h=u7^VxWZk9R8>}KcS8wkVRuD-i4 zb|j)DPh_94CSz{>C0V`&t>J-#L)pA_81$QkX@8YjWh3;K0(;b$#zG~+v%fon0Qgn| zEoXFiqGNcc>T%9WKuFgakI}5$sXz7(f+;?8dAlB?N&PGtgEgv0z1eQ&CyKQn`ekE2 zgsCyBYst5`XLB?`I#$)Gn&z?@44^A+fp}Bjvj6mNIJK&)+^Z1&NAP#+7ZY<|KRg|dXN4|UVcZ^5FitsfvInG`G<(2en^^AAYHK676-zpHH7@BNDa!@N}YY{LHkK_rLx zmOaIzY~UpMU+`hif0on#SoPPmDKJ1KVP#cxC4jAFq#B__AwK`{sDK$#%uYApr39Xj z@f3H=t+4KYc%5wCiV3u@GjP|G$Bq~}S&9z)P-V$uB{owJX>A^W)B^jD1JT2>?S#W> z@qN0p%)Z{P0x!rgZFQjytqgzX<+`ji;w5RE53$r)fn5(P*Jmx(FG-{wok$H5_`#M6 z`M-fk zEyx(O=a@PR``~SP==Mi&Yd|CT@X@N-aPKCof=WYXh3z+iZp1NP(FWq?Gi{M029b1p z2l3q$&1F`{g7OnMv?*!i@LRnLq8K+i!UK}vFS&|e?xXtQgB*X>$+AoLF1bDWr%BP@ zrsZUXp{MQckKy2n|A(}Jm9Y+B5+fvT(Tb&u5WCb{4=F0i0?q7DjdMHSKzO*1#bA9- zt#u4Q8CeI5`O&@7R!*Rh%}l~=lF(QoWzv$e$#zLD;*6O6;x%)@l?+7DwK#2tXDsL# z$jt(3`y||is(2LXA6Fo;zsgE7lMDo-Gw!55e5t{ess3~FQVRonT&w@n4#t1&tDSPh z*=v!+>wpi)7%<*w;W#3VA;w_tTP{tm7V*}o7SSaLTCmwXGd1~{np`btN)K=X~?c=S|+cmP3EWGDwA=PxYOdWa&B~Q2-B9t+M*v5e=$Y#ZHh|=0}U} zDd!}cT3a*T>_ILBVVYrSY2gp-0)r{y2K@Gh#{APmQq3(J)aq(oW4pEm{(t?25YAW+`NCgnes{1NhmGM26-u=9jtw)lev%+U&kbPSj7`60 zFJk!#O#{X-g)AArd{_GhP2RxYn3H5bSvOo=B=a}qWz9ThbI>1Vleuh=9Rb3Q z8XQ~`t@9!tmx}?Zi%mDlk%e56aSxu^&E73|QZW zHsy9d6I*v!_2F1tdOf3AjSRvLh*$Pd0+=4fYw<%nWCd67|4T&`fMqer-n{g{(V3h*9fWMu9&P2%-Zci7-WK;L$tzSr8S7?;oJJBiJ z7Zo5u)9yj;JTc6Lm z1`qKv`~bjS8g)9!*!(J+{}bnL&t!Km8_+Bdalo^j6s$q~i1Q!#tNp#KFR$$G%cG)F zkX$Kb#%uo2XOWqP5PJG>jC{l56WOmc0ocGUZxS!DJNF+-R8UC-cu;2aOFPh|%quFx ztRa#294XT02G6q<$+_eccWwz9`5#{0{+wN7IUlo>#ePt;?oxcjJ%`8iFpkK1KQUJm0!cFSI=M#gSaKE`n{I7StxeR2K_i;*D&?A}*EP0P{T| z9m%ECDRjX7032a$GR5&7ON>SjCL5s*wBeh1f1EH60!u&oT6~&P+3>!LblEYQ7Y{V! z_lvJd@lVI2P|XkWiwc(CUG>>NvFaP@y=KyMDMzan%ElpvC0|r-E5-e+>8>bz+&!xY zsrBTN6M6k|63zB-HS}|egO~O87C;bjkQD%(*a+PjRNP=FU#Z%1-pGk2kBVeO3R)+E zV-71HYQ4y8`;s1LXB)QPFD{cXI57R$)le^NA{2Ud7(>LrDW1*izVK`D-$MimXD9V)1XlhR763bCTGBI0 z9OTz?3F(taDiL0s-y@HnIqAuhA1x>gHR0KZkxb zRj+R1sJz;9>0>v?q6ezlL!*lLz%VghPu2)$54&V!QJV$~&b`|i16{LTI;Bs|ri@4X2k?afzT4Ruf zwm)|x#72G|< zeU2-|VvywTq+zIuq9#0M`;+9X^X^=8%dXM!?sj;d4fhO_qtuk96`MrA%Xim*+L zqvQYHqYURA`AE6yz+3692vpD*Iy^SW;k9H3-}$ci5V;gq8|}}ozE~-)D(%s=kRaf5 zO&1{W>)ld#=5upN>&xpy4U79T^*sr{JRUriI# zOrnN^mT7>502SM>LjGLt(W}GcC+d{6NHHvM`PCuy~*qzzW{Jqu^n$`3gb9pr8X?}g0A#>0;b%X|@I zybl647=MPZg_gE$mv_#*ePOOU>~eKF-RA8t!@2}_PUh`CJD^*&95>#g#Q8+l=gTkSH8$NaJFl4lyPUp89ZFL^Dn z9~}ZLAH$_#KP3v!g?S+~bHW*74UGg5dHXZmehOPE(0B6ZdJKVl1k*oGp)+9yby;&% zs4ap%o%8(2Eru2zzUgi5FgVY{fUKKxp9FEYq2jAIlVx=di>YH-ki37|I_+iFn`o2P zSJ}?SEgE#UjmBU9$qebjA@F6Y6moNqZ*&-lMVgXu2mGn*U_fMrDnar}wV^@i=Cvic zub3ZqO8J|Zevia4aQHltg-2zBz>r?55C?Gipprv}XG6k}4(ImwZ6q#F$*cGbFUR1* zgtlqq3+JTT!n&8A*jd15b7Px$ZuP<>3vnu9_+9?2PBPL>?K-b|L4hoeX-=#iog(8aajbIs)ew!M zcPx2G>n>s>X-0P$tO4;FxtnLG^4D~iK3YflPJ!Ez`&~pgVV^rRJa5Q>qXtlo$lZ3u z7GhVU9 z@xquTXZ*Pl-=$xnp$DNZU$tlFuvK0wL&UlCwN%h)PP9Tt41KI#EAI%lh9w^5AREG{ z*wcc8-RJ|_79}9v0zZQl*Z`pMry#KGk&aU-WR*o*|7bzq?>E)2A24;K`tmx8fG*tT z3C{Tk%b^9iBHK4UzFQELV>TT94VA~*v-q?F1qG&(#oKg-T{xVki;?u}v@Pm()OiLJ z|9#RRfxZM}flR+SSuUK9dfRi~0RM^lvqOs3gQm}V8CYm7JtKdQN zx5PaHTso)UuT5leh38oIb(;|ujhXSJuQ%j<^dn3XiQ~wjsXdO!*`MIprp;>;hjgK0 zlT10U;3;eJ``O}$qapyyP4Xo+ntS-!SgB_HG&h-dX=Z9kbqR%n>toX%6Ly&w;ePl7KHu zMVG_R!lDT62kizR!13#W5{V^AwPT%ivDpkrNHFz|CH>G)dVOR|2pZPo+yFVvD5>hn zg6&oGmF^!{y*VZ+2nGiaGFWkI#Hnu#H8K+`{O(c*Rl8`Ims%(6)~z$0{e)=KGSN3E z9sPtXt1_oD#NH9cRlKVtKV?oG(K`D<`JV#5kO%KlAi_uj*sW!$OFNR9dX7UEp%lji zd5=uP6L5ixq$~MpxxJXp)lbdGN(fd|x1spue%1iw#!vP8`7_9C zVp2Uu5*ZBuuti3}G6R7Hi4{V7sR7(S-ez$^a+T@$uVna&=RKqu&XZK;c(SQV+&x0qrwdYhLCmjI_gT^VxkseME6Gy>I@WC1lFm{L6;lg z&s7sJzGvNi4kZ3?t&>oL;MWWKYN+^jVv{+3XK-u?1ZnmJ3 z#t|F*!(KT}K#iVO2J;EKF)AxMIdr*fdk|^a3K3nr#E@MWtUe=ME>WWfmJc7};Ea72 zq5~%h#2^-jw_;Di*09Hht7>Dik_4(7lbN;WMNbfJYU8R!Q zXd_|+&ty0yVr20Cb}`P6xEvEZC)?n00i-wyVvQ879@|<>>3=GrtE?pKl4#Wxp9I@` zDvxr5&>ASncWVu)X^#i0I0t}|ECAfsB(z%0q= zln95(r1r*CwETQwbCaj!n!721+h*Ox(huD5Nz#squ@l!$hp+Hc4sw38((L_Z5=!v^ z_K&5s1>7T6SmodB1oJuIu_*Tsg=8ZyUX}iInyY~=7q&Z!-5O#la%j9`LQxQZMyHW@ z8p)tIwub%imi10Br%905;>#>UX>y=AUzWgxlM(M@?(ao9Tvc=ea@)up5}c>PeDa_X zc_gFaZWHjm&q5}!3G?~2!IZI@i>?R(?qfkHL-Wy@NN*L)NPiwvl7Lql8SA`H~3Z2 zdm1Z|;4kabC~MJ5C|t_#$f4KGKvfO3em>L1eI|$Ntkb3uUV9{%mqzW%;!X?!2t&V0 zq`SRB4Z=+x-0zRR>Q}m{tiyXN%MmU|swM8MEE{0KL_T%}o?u~0x1ds7n zoVhRkgWaMsr=66VP^kz+=+f617{w?iclrDUEc}=c6@m!jG-Ptn-$KxW<4`$!R#6_e zre%82Ez1sT!ylzwBtOCIvrAOSyK$uUI znXqLGvAhhi+yT*(6LACtF=7}2e>haMDil3F6x}6MRWlTwH`IkVlpG=yAU_O&`1Of& z2@JzD0P(xvkQy-vEpj~iFfuItDFmSf7!Cu;C(3~6xOn(z2Sn1|BSmO)L*iY3qN04l zqCSG%Eqrot{9O{fT_N0EL!6>O?A<)9EO4FpXpMLTRR>7npEOet%V`h?0Vr89!k1c? z;8Z(^S%{qRajfxR%<-`dKs*#}d<11YBAElMpCGq`Af%BXx2hnaxF98`AUACfjRVLL zCkPG*$Wik9tjt^K;*$dH^ZRI(s;JL`^x#-Jt!qZbg@6&eVQ{dUz@I9oKULg+qQU+o zjXu^TK4#tv0Ux_At}xos^maoV8O8n8NY8O?RDaE!caAA9XRuWA#7CPE>R&(Ljxa(0N?EYX$us9vJWI=NFvL@EXhXX$--F3jxfp6 zJj&4Y$oTYAK+d6}7)QX?hzhB3Pl>MK@>D$1*W%kCD|kTVak2CYDv1VDe_=((K|2=2 z7SP@)Q&MfAMwCZ~BaV!OPX>Vz8wiZ_7Yv!sC9PEmGmAW!rHbjs`?-3gG+3OtmJGt6 z_5~>KV?8iA9d)og;3Nm4Ae=^=f+cuYk`T~AhI(4!6`Z>@jMkBXf^4%WI74tI(WjQp z;vlIiBSd9vyC7Xtby7~Heu6O1S6~!c&BMPfovKOZql^UW^WFs1_@c@+~j@G@78Of*_Jy0K!M1 z*>P}KK0FduB-~qc*{PczK^7&!<;z^ImRxfXzr+N78suE5r5vgNFUow+{T>gq9rqGY z_iJRHWyNeu>};H^ESj<`E{CiL&Md$NWP*2h++}!Nv`P+gm=a3&8+fHu?<_o+O*23+3WWHEm%wC zK+RBA6yhn8D7L^r?9@+y5IJfK(@Q_+373S2)kmEkQ*s zv{|taI5QtIx+YkO+V!W2Sj74dfPNdb|0=bxIY}r@)q6f^9xcv+Y4z2aoE-QbD{w&J zB+%M%aaI&}*3W1g|ui}*U07y?RFBd=j!=A%u@Y(1B}>cQW7`Q_g`aTx$Y0syL!`6Tbv*IZW=yDU{w1;L7PzN(Fq&*r|F!fP#vk zx-9WAusPUgItF>DpaAsq4JtT|srw^;X5XJ0aAKwl>@8ayswc7RS$d>tB(dSYh?y!J zv7%CA?!tw|*+S3%$!`5cR2;F@A&X$Gpo}?1V43nAZ6<1^vPh|3?AN8<$209K^VZ zhJA5dp`{AH-ev`qw`a_a%*swlje9GN8c zZJ-zjx>>53U5mKls+^doySpR#iJ_@?`MHcLar*aM{fsB=vd@^NHx;)lxAz7Qo@Be+ zNEd3c0Elnlf_k)dY$3=3&NvfQ7=zCFo)MQZ$hxWbLh5T$!o4Nq3zg4mRM~EvH%k1S ztBA0&z=fFl+r!x!tdS+63oRyLT zI2%b%EL(EsCVM$MwT&Oquu~Py@0QM(6iqs)m?h4bpsEfX?oKew0omEStp>4IKxm86sdy?`RmD0n;tNhg?Ue-I zF7~UP1T}risqs_T%uplqmvq=qE(}cZX=VDBKuh*JLV!9 zT_TduBl;V|lT@Moo5)gs3#_)Q)*rX)zj>f;f7^GtM;ELC&iWezSlJwGB!{N>KzH9pF_WS zN!C7=Abf-8)HQIxMn>NUHY@T^@9rjn*XH+Pq{_*YtCW{#KL1yC4(<&i3A9TQ64-#RVeKia%VFXpht`~BlhN6-MLQx{@tGvZ?9f4?d_kI{sx-W&0 zQ2)7exWJZWRxsG#UWqIq|>D-Y+ z2`j|_SIV@k9QEFQT>Y$A>vDeiNZwIvZhCnRmFdU-pHevO@7rF_vMy_--;)25oS>i> zNK8?ZlFlRFlbM+zlUj~X+8uHrBxX578o!34x-+CPauCPP0m1zB5LxX0X{RB=mfCt4p5(hfdhO!ziOvBr6qo60ZyhN=ye1hYeX_{aAOCOt@t zHRl?YTAznp=T|VZI;!<~CP)siYGWUs@eC3fs`F%KYr8d;ivGNl;y=R3TE*;SB36WN9Nmg9vYWY zKWmcfH%gHo@)*11a1Aj;aj7*l$M+j`cF%)<>hLGa-EE9HkQQkVkv0;8zy2iFmDQU9 zg;xyS%eUJ^kkbS^KV3%-dF|jgd`t*;*8sbDV-4`MSL2dpOqS}BZig2=FZX+5U_EsJ z7B6gAdITo?j9b&cWwz!5Ebi90`UkB`3g5mi)J;Gj< z=W0CaVt0D6g6k1fT8D4Pf+1h^3Cc*DHK2~&NW(=hY7kxWD=Wci+?-v>qjbMA+;X?% zYg(6h@81fWefQakAk6*_p)7qEWes7pbAUm-0z%DJG;uhAJ zNkDmLP`I6^B6&lf)zOoKsBgaqbH8`gzh%+B?M7x-fo1P{W&OI&ytT@_{hcufXlDrA zV4`$FKJV!5jxc1d)sHZ&=02pzolo;W5T0Sl#wBJFwf;%?3;xWmzwlO+y98`4u?=so zW@`O9cD@+HDvqP69$8ffK$8a1-gei|3cER2^xNiR>8u>Nyb>TyZ_cdF6S zLH*7KL)uJlNBg$K%f>MEcgGwZKEEi0i2Q&XYUGt-tdNm{9`+)>Nx-+vEdzuMFW^Ve z6n_fm66evJ+(Kj@(Wb6>5T@c1+}Khc!SFn29WK0N0B*`1lephX?0VEial_;**hTtu zSZRDx&aJDVi|3#wzNpE4Zg+Uf}+8Gd(J{b72*2v z^^dd0Wla;m^Y9|)Cm@MUQ^=F%)q3cwuLF9*a#Y7Q=qHNX;Wb%P#AqtAW+E+-AW7-N zZ&4k;2nZ#A!E}z`eiT^~o?Nj~hJDvL=M*xMKa^YG-0ns7S|~4+US=HuZ`_&m^jnAr zQAU0G&3oQz4TOh@aYGsd!8Vd`7M=o8Q2W!6FZ>3sP*jZGz6REEDqEU z(h@UlaP$@SDN@F~SXw7`vad(A4oMlZ@4@a=#nqR8cjbs1khxRuT3lCzcShrbG_;u{ z>vr8n_bsOPSq(G4rPswjH`Ldv47;fbZLVHwt)q%|2Y5*Q_usU#Q(xm${xTL-`nIe`b^08jPMeTUAocNUFZdSS3?X z&qy0kWp%uwaz#i^r<|BS8aZE(m(K_f`kA&$Ciyj^XuxLdZ2Ch2&6#3O^e34d3^73( zEksyj~d;rdJj@X0BG&y)q)OlkchcT?SevSnTaqr4E7S3;dU znd-S=n4TCE+Z>)=L0M6LOK?g6Vs=Xv#5Mk0C*Xr!k%AIZ_Vj7ZD2s2$XX$U)1tIY@ z6e@na|Fm!T9cI`&kfA`oiuj{q-U@plQCgDkV_~xIQoQZ_*8PKCU#;w+FqiPV-Kvpb zm(B|G)Oq!%#;WJ5ne@}2C}zv}e-`*FFn@%^9BS0t#&z|lVE18eprGj8Nx`8@DxOKJ zxs10T&$um+BfOl1eV6`Ru4%5%k$P*J;q@aj`W|TQaA`)`l)RL>4Lv*eYZAQj78d=r zMAwNhCw7@p_pmzs$-AQ%#@#a?9OygDHzAbL2YKZW*T)6G%? zt|{31njXEUq>~+CeNML>ayu)uo*-3@zzV4VLmIN)gjj}RQ^1U3lg0WvFun5<#ltdK zz8jcqTKc)D*l7(LcQ&APZG%w>bF<2nl(bptPgE}*3J+4F5cMgWmYt3yFW}5M zRnCFiVfMVfr1lWHj9ORK{hUk`E$s%qjaK2d2UoaGDS*@Cdd^PuxMR^%c}9wwCj_`U zE1|ARU0RRy^sP;w%;jRxoSxtqofJG(u=q0{N@U>Am+jkz`3~gdM1AYN>!w^yNH`vJ zcRmEG3<^Elv=5d3S`@#f(fwhFvP|@wcK;U3Pg>r4(|nNi1|c^(x8alc?m<^|7Xmw_ z)3T3x^EQ=<`wOcY)bOv1wLjc6)UQAlV%*}jN}JWLnftYD2uzfzYl0X)7g)(+Y(u^i zqx1TjTg%cMm=h`|{q`4u!j(*jig!P~ebd29^;ey{DJh#z1q%GF@_Rpy%+6%l z7tP=LY@BUx2Qm8jYSFEjZc%$6i1j0E8{G|tN@}u4+d@85u*)IcSz%V@-(mv465x-Y z159Z3m0+obl|c^4QUCmsG+B$FEU-nLWt7)1lB?y#;3Y!RjhGvVHHsbx z`B3MrAZv1tHNvh6`5as^p7aVHx#(-PvuNNo+xMIkS_97M>)LTU56Vn|?59#E{Y-75 zq%CB=SI)6j~)eu=V~ zuj$`{KUFs`=O@K0RSa-aBnz7}CRabHT6+g?mMHMCkh?)`6wycbym+}hnp{Ygj-&;K za1le!QXBAdDyH>__@df6s5q;gzFUBl!Z~b(*Fm@p=TJ1+UX&$}`S_=Br)Xy*G)YqC zVBC_IMix`PfbfQwgC>0WW(7?;Lv*fY2Xj3W4wF6omiJd62KYM?6aD>3O2N0ctonx& zeGUiZbTVhkMN}-QoApN|W{F3k&=z}ml9&NfSD?AvC1Tz5P24IKMBZw%~QmwSzUDM8syPrYe3CoTC+3Wx4Gr=>9VB7(=MLQ^#R!h-r3-#G6+ zC~pGA>ln@A_~oPi(*ZS9r?I1JEOUHrK=}|C zaH_6$!r+9>-60u6&DYJ6?Ya9dMUSiYfEe}f!ePBCVKZyXdimt$b6E#s(N43rw-U*y2Rr}qx^I(8jWGLMk`7`L@99m? za^QJ1h|XF=087{_Ca3;zNZocMw=GBG+a9}c@L3pMJp~3TVAM0XthluhLnfW(Su+b~ zNJbB&?1uDS2b1t7g$(GcqVptb6p~r-)VP4&c8@EE>4SzVDHh2Kf&HxVgupNSG3^Ve*6xl_SG={)w|6+)5b z`?OJnzj!)hm^xy$ptLP+jlz7dlsV`A!RMB3);U*axST}uh3y1Ike++TPoB0&D%vR2 z@JvdDq>vNQ;?OE6qr~{d=f|tpHu$xGvKH&JnJ4}Jy%-i)z0O9!FqB&`HGZPM&80TM(O<u^lo=Xx-*x9|a`_vC)Sgrd zX<_(dw{~7u9yytj><=r*JoF?4Ug^D)~SA; z!aJv#>z-4L9^0HiyStjoFHCCsK}ivj9sPY6poSBzJ`ZpI zHbrI(^1$gIBi4hw`VyWh)B*q7G~5G6uu+R^e8f^--dW&;wbU9my)Tw~?kMeNPr2Rs zUALW>C8R1%n$s^RsaMtTex@u5>|kSwP`K6<-#^M6ce@%CFS?NjK&~SQKUPB_4FUw* z^}SQ%Q!z1L*TzRg51+lp3Wm*(Yy3`hTbh6#@$+vX^7qC%l`UtT)gOQK)AsAo>5|Sq zDcwNPmiS358$acYLZ5|*sw*ZJ{@Q*e85Rd54c$Pu$gxdP%^>EN{X zvpB+SK&azZp~B-l&OeDl?$ZT7Kt$6uwc#^~DONAtXgHp!7Iyh?v@i$=N3J;rYs8Q# zV}2D-X#2cf$bR(AI3Tl(M_yOtXMt$2H%nJ?kn-U62C#)!_&lc*slKU5v+4_fAplo5 zu}m+EY9abK;Tjc>9U}V8OtO!)uo|;`e1EmA1~K-YA?P#l%#nAdqsXoO+4kdKsr4TP z54qW^_-Y0D!{QYP%Cp<%wQO@-Uz7ye%0U*J{-BSR;PPV5{+8zML0CwAvssEexi@cS z^G3XT2PS(B^xf>i9`mr;cC6{i9E)zKzzUW+-M7kz67u5P>aW^Ze7D8*QE2?bg>PVPX>)tY+H!6W?#%$2*ZigPCJpTkMAWJ2fp1sp;mhv! z&26_vOhTE;pn?kiM@)=R9clN;dHuN4-ZSpb9Jqig3`feAoM+P4b3Pq{oyC97hvUWU zj6(ZF1{+#x;9}Lcrux<}{(b57?SFFVk=RvvNqhkvFkmaJ5*;;x+eZFQSMGk8yt{*a zeT~iko1yb7UDrD!uhyi-GO(*C zP(lwIVR%;+g05)nJ1c(X9Ke7$_^&*9cbtPKW;KS|;DYGmJpQ@Ggt3LY`Pow=W^OD8 zuQ&}D!7qkMTp{KiZX#kiaUy~?{)tpr>L_@SqZ-J%ciU?6TJw!+vU)%I)ui>3U(|-R zU6a(rwbUMIVQ)w(O&oJcPy{FMOY^(5K*H3QG9Jq2DD55+2TmcVfh3CP-;2GwQ&WM# z3c1JJ;S$^wJJ+|M5Mox!qlIkQQYQSGJ)pw!Solx|p&q+3WpCe3$BB&lyn{L?YYk}iEn($N*bfVB4pd_6jd z9=}aYSz6e{UM+S*;O~6+EiP6=aZVn}U*HrY9{6#3i^%#{quG(X@qDA=C#%0#l14GR zc~0+50fHbE)NNNb{Qc*3I00!Cm&#i@OPj~zlF;A!^V?5!VrKId0oC)`vPT;?;i>(I zrvR(CFFejBcRQ71`oWvTv`7ymtDA?;y$9QjmeR*lunNGZ*NUEIoIa1tb+c1qHvLJH zw2fE_DgJ{D+%o@_`VM_RodDLu2PWyG0VTM*Ltq=;D*|;|wyF+4WvCEj%zb(UR*UE@ zjJ<5AfcD9K>D&KD);mRK)^lN?g{)k{JRA+H97B#3O@jVXo;o&&T|1$|7cq;jKu^&{0f7a7DIqx#7NKvNOXdoz=hv z`4#YKzL5|F8Nk+Pb`Z$e*XI|ewuyk7oLvEuTdC0OW~32z77T5)A(DZV=NuwUtSg%l zfc5~LEZ$yj1Uy>1go|Qrxh?CoNOtDh4KtDXM_uaoR-KB$%nX{a;}F z|HHM@-8C6+a-jo}z$v{7CqNc~g_{(SG6Mz!GcLL0oUzKdVBQdhkfa_0(W;BQ$%cn+ z`MTbM8fnuhu@7kMhetZfggd2vhEL_+{6V%36`|9G z-$k4}hQ^zW%k)a#4kJ-hoog}DhjKbDW!pOFuEoj>I|D_eI30l~|A8Q2inKN(q5$qO zrS>gw5{C>;Ea~f0aydyzjNL8jB*V?(VNBQV4PIxKBO3#&^|<;nwlSgIw%ik5|mdh#&GCnQ zVE2=JV^g~H&?j#3*N3ljDF&nyk~s- zu8kzix{_?_&SU8??IhzkvTR~F#=rw29#{;UqIo0o_-+I|>S?EaY&kvANL!*rOw{E* z=>}VsOYAcIWQTsHtF-S_6QzWjxID3=)#-pqp^*$CYVVMha;eXzPn9yJTtL#jJng0~ zKUMGAsL9AAZAvqnwrx@u7ODoZ`tyueUP|1uAqi=1>?YpX&N5WSJnV zYTbqQC>}pFlDU&!jWvn%Gr+pYDhfJ_Cd;mvLLk5_l46P?qe^XZnqpwtI)W(aOA_5{ zXNK$?7|a{r(ofYA2zBMT$p76!&2KMAQW~}Oy43>opkuCBWJyHlz=YWDjqT^}3}^bz zxvYl7VQ&OHC<3Je%^bPP{i4ll?6uApoY5wOEC_?E2l=Qda3a1;7oeA()9QDfG^agD zN%yz;xBYLIQlChEilTI^6H>28ev7vB^>m?UlyNQZHqoFTQk~*gB&hErsJRr>q%0mv z0+Wj}W8-*YL(hKPF1+jtuh5-wLM|p)y?Bc#vtZ~j(b;a5Bzr|J(qP@EnbfrH@+@a8 zYVr2b|CDHK{u&4aSQk|)(tlIXQve0JHN|o)J+HU;wgyaCE{pc!tXG0gs`VA20e#Ff zFx5Pcsp+=jirGD%iZsk}F-yB34PcW}N=X#v#D{=sb5%Sfvcz1*D53reFyeEZY?IP6 zqQWFMibhQvh3?xA*J=c*#M)D7ET|~4QF=2kP^kUqCb3rzScy{nR8h2M&r^x!C0BPh z85veC-l=G`&w=8w$-!a7iN$l3h@&GNiw7?n5ot8qi>P@6*qEfFZ zcntiVs~$^&pfHn`z{M^g>+2$vclsEhw+P)7KK~a0*7-nv<<~xP$H}iGxqBz1=-VwT z<$Vbie$VUn35zP4{)~$-W*stx&J}knHZn)bXFU-}Mghj3ID!>ODjfsPojkI>ASxY$ z%+aV(M-Rc+0QZ~cr9N*JWC3n_OR|z6aJ3gDv@boi;$vr@6{Bk526guJ;>(pGeCf3m zro#)sBZmF!H0)A)8aHdP^4H^U4#dchx|-o@-e>&o-_g%N=zH!CiJdPHRvi@m*5tS* zE5%e&F*!-z zN2lTVn~A}=PG`v-6bzXeD{Lj23B+H(Ozm;@qyf?gn{prQucEt zZ7AdTC~JMYf^A|mmKU#6j(}P(fF`S96X4MR0D-dfY>%l|Vh_2qsS+Rz(FUCe9T5dE zUeES;3IsO5SO)VLY6)Rz%>yg^Ll;0pN9zSRS`0NS7V=UlaJHT}(ej+QkM;Gv+8+=A#%Kn^HK` z@3yR0`5VH1)m0O0lr##B2&&IfuCpj5WKLWHNV!)s=x=a9@9hQ_5Mu!6o?oYGHwtkjIem{-ytEVJHn*^!u1FMqFhBd z)fgz|7BTuNG5Q=a;y5w(05NiBAm~Oy#A*V_QbN#N0?c$m(0BsENJ7X!0$6WCK&KFx zZb1>xwkCdq=C%=!% zF@H$*k$k0~d|jV>6}Nmf`+PMEK@~$mB`rZc<$P6{d|lCeRla;f_I!1Qe09ovWukl) zY(Whaz_P%pV@;2`s1*r6kFSPj$%udewidoe;(992b+>KM)sblo`K|V)cEcush}|U| zwE(`R8NZcUwG@?lht>=re)+?FlRhDd@`Yy^605W~lgqQxk$mkLSjP}C#%3&F`$=m# zrHzLL@??gA_nk*CsOB@#bQR&ju1RS}n!eS=u+C*Wa-ZTa^Tl}XG9}~->%bjsy~sZ) z_0vCas&s=nseEwAM@Sw@xp(%ZiW-|@uM%GoZX@Y;5om6sbYKBo2eU%8W5Ae! z+0fi$n3X<+mByj?pP<>?eT|4KOjCk)8asH#e#*83D|dNO#c{XsK*fruc=@UnQ=E6FjtcTF6Y15TpjXk17%z)sL(~!z}eKuDb&ER)YxIv z-~eiHugLh0kpLYM6FTL=RH_OY$gBumQ%UrE@U&p~edrq?HcJUCs;CGg@vtxwQxSZq z14&yvc0d%&f7HAQu$XdUAqr7pg_aUBQU%kyD%kVcg4~_&`+xOOFJAti`e;%&%Kz3! zk8@)5u^F!L!p#CGcTgL)*s-glftK9K26OV}J+it{i^uVDsd&~C16Vdjtjpf{56)vs z#;suJsyex7XsfE3$U{G4z62^Zu8xh!0E=-HMyL#C%Gp6hVAh-Q1CL|CjFZjNA%0CHNa{v$bhlOxcJFvD^pjDXfVpPgIYDE;?=iAbUe>i@?fCsn%MV2K>@O@V3KM!O|^JHxEcv$mxpL1+~6$nfyajRJ2 zi&;T)Siw_SA>&w)!;|3$GQ)c^5jry?S|@=v4hw8ujM$~UvV@6dxq>X9cwFs=<5~_` z>E0Hi`VC({ad;cX6e@Tc^)$&_N~1X5j&%D^WWX|bZL^yYPD~jg0QRJ3E}`2%twaH` zW$^z<^%nwPj~B zSeU23sTzh*F){%b&?Cvcyc80F2s4w(0wIssq+jp2qzQbf6i~qNL#>0hByL&a6W&IW zoG->68=YBZW-nd~$Bq)W^F5}nK(LHR`RrHua@TGG3VQipnuhG>T;SrANSfG zOCHe$JPQAgEZ6_n$T%ZuIqI};g|ZXVkITp12xdhq`k)9{MGR|`t^f8a`qa{&KqU-S zi<$WaqI1I_OQU4YB1@nGV3DQJ$z+kGu{*gFv#|f0*c4%Hh^0ZuthrgHWb*9;B91zb z`s+SNX^JI}7WX+e|0QN*mZ{OrwCYyb`r_GRGimyLv%4+3tF4cRcgR(1X=K32m(Kub zIGPqn=)(jM1ys~8@=87GfzS(oKgu>vk1Ah3-QMSAzP=C8oJjcWmrFUif|)I>}ZP|fOnU-S(AdcBEN zp;p&rCivb&e-ecaV4%z-Y5Fko(=lzl^IU)@S6cGnHj`d%C+V^S{m@|JV>c6I=g!i&;D!6N$Br3pu=5y*udCJs?%zZ7j zXLbN^Q?}9Hh}#1L|4*%nDdWB59^tt=owg}6W-EsU?=&bCn`=m;NSkqmUjrTu(3 zB;zFJH)zMFUFQ&{%q3g(9RtS&z3cRS*6tMV1jN2P6qjT+IA*~a&i9caRg0FE3hq_% z@0W7tq@1VZY^P+*W#kQI*Q8M+Jp; zZvN5Zkd~}ZwXB#&Y=6D~KLlk}6S>B07+~ zsieey!TC*z8D)tnS&8X!iTOc^Ngj!bHi;<)iAgGn84`)VeWw?`#!3okx;vOHV}MFhX{ux?b*Ep6kgPbClk*IzOdJe+d5m{|(&l9piw zlp(pSqO;t4M}WZu7ac5aQnwr&1_F5G^03fk(LvOq{$-KAH{+d}1qTH#PTG)c%r<$% z)v{1aRgtDM~D_`W|lP z5^mxcZbmn5ay@Q#F>Y2mZd$ZVWd9jxZUqEZ1sHk-7yzY3IMTy#n5t-~>Ts~CND%9A zK(YuRdDzcY)c0ZN7pjQ&__e@Uv=>{R5&1y47x`JXi^}dF)0hQuyPi~pc4CTHIUjM} ztE@W)-XJN-mCDcB+EtGzL90?IKHE}aL4{e~lMP-M8A%T~t$MhS2u!!`Pa7d!PYm3GaS3sNA1Aj29?b#`)`g*^JlOLTKtG1{6RxRXpG$!<0Rm6SU3dG zprKD)_LSbf@3;DY&;5_YYSh`1{o5>@iI@}~)u)@s#abp4-^(2e46qGw3zMLuz_nWW zRgbv_>H;&+)7;{6rsW^VqiK(vSoJd(_Pk8-YOqX;4a=?cF&eV^L_3IXfELgpJG(A0$&pN@GSC)Jo&xp)6KR=4hEBw#lJ> zf)_t?ck21K8nITF))JHgCPZo}MOet`fl(V!>G{aFszq?F3aFE&d z9MSgXb&UjB)av1xVA=b5p}i|qTj+MB13pyGj0?0{g_6cIMF-`C0yeyS(VVGTc64v zT~wUBZ0y)<{4cDms}ChJb3I~nTRrmrSrojq$$25zlbt0cT1zZ6($Fa-zS26s$f$9X zl0LEKK+Vd&3bpqKnjC?sz;$kHX!-Hyr8&?5|O6O9CY&frY zF|K1nS$k9#bXM50%3~r)!;2$#e~m?IoVeIB@SyP!KEV%sNsW88&=^r#qPIxG7?4ao z!|!Z|2V#j`v?F#kJ3zo=duM z#{NpwyT>?|YqOf2jr0OoEM{YUj(Zaqt5*m@7&5KCoXu*=c?b@1U_Y?m{L}zeh-h~k z`To*n-$z>>p*$eH7e*aVL|6FSLq(5*lC7{=p38;=ZX}dZ8DUKhOJ)_nD}!>(jN9%G z?v~iaw|97d+wXD-rX6rU#o1pT@9BVl4eBN(&|;NDPr~v908arL_*SmE3!!BPa(i)$ z8uHgD;RI3cu4RmN@+p{ZYH7mHN?9f~tF8E$dZ$H782Q1-3F!*?lT3$DR_X6TUp_tw9w4@wYdu_(6Dt4xkD|qk7V7Gr* z^@NLRQ1!#-b0NUC0$Aed_G%!5o4Y&Fs6$X5wBlF1UIeFPF{|G zd;u?QtDc@08fH*H`PFaOuAJQxTYoO0K;|qYfj_eJO;-S`m#0RG%_DPP_r{2Y{ArX4fK+AWFIVdNQ%~s09(;~o#x599G&JL z4?9hh{F^5`#a}^Z$}SJ2oPz(e0J^gCCD~IMknp-8-h6ymqqY66{oaZm7Z1~C{g$kd z`q#VxKrFmQS-e{nvrxXR8sG|Y_e+VZco)nZ-!zP4Nr+~}Ek{6sf}{3Zxm zD#lX4RYo;p90`k0A}3!#K?p%+cI8aqo!Q|tsjU@~G_;>fVtVH=Xe4(br*?1%tn8__ zuDr}1U>cwDe;Ibl{}^^2cQtB2HidV9$0zsvJPwMGjEG^*IKStt(EmW~K>tDQZ3P;K z2xwF%G2dqJ>OwjqyJP1(wg81|tw5K#Q^ns};3cCU7G7>xQzeOl_VP_@Wj@R=T+}mV zdd4|V${bIv*T;=sl{-@}UAR%k4n^ZcF<0J)?F>0Z^(mo_AGa}ifYRt;{!3chC#RiN zB~N(dRejfjzK-ZEwz}9|h4I=|HmWtXARy>S#Cwg_wVg(^=|Ty-l{(I z);j)=0LPl;(lY3+jKxkr-YA*mCUyf?pTkKR)aHyR3Wo2Jx zELR_}NZI6;4Es)gz<-Z`$L}vm`;){5h*hkM7NDxcoCke0^Qic~Y2=CU@=~c_V|HYc z!NEO|$*)YiQ7})n37N?lQ7M1?0e(mc=eHQZgc=nak+JPMRcbGRT%E;6F(m( zPiYJVl0=CN$OeYNytrg_rl|0e9;W};-xgYWpxGF#@m;b5dn-1GKSraI-TE5-k+=m- zZbAgKG$Gwg#lR3mWhw^K%W+Ws~l1O0E{Q zH6VYFL+cd$`a7kvk3B+w&My{)!P1*gmE0fn87rtk3?uT}JWkYziTM zltu@-ItY;JFRqtfCle%=9Fqax%Vt9LXQP?WHvJ;U%}-b{Qc^&2z8gJ)#K^z)Ob!(o z>GlBKpQOu7tDd9WD7(JI{p+_qY<2KP*zQQ6C|agyNuU`2NMwT)O`JWx#GS(z{j&dm zx=CG7`l}o8_zzYZOgc!TO|`o5qg)!?=8RQsm#SS`cOELezhYA17LzM#npe}E=(ze5 zSmgVrT2*kV{GCfY!8#6r)L#R$ARYPtP}YMLykprpUbT}>A2|c^oMlez|4Q$uxDC=; z_CKK1`;Xb${4;LcBrW%RBKl5Y;M~5jt(E&%Q|T8XsYV0>-e1=@c<(HiUWxnO|8d8Fn=CAJE>G;cN#%^6I+{xqj89;`8UF=RrPzPk12z;0UNCwa$ZDZ^+!sYr(tEzVULg`4^ zS)swK346*;5OfcxD*Uft{6!^b|hVP<4B!<~ zqmr7X_g5Geq9wR5MBga>M&A|`jxGgrNg-2&K58+XVXo~vp@nXsz)j+J1E0z~&g{Ud>eo4we+y(?oye{%nqWA%Ml@?Eux-090}JOuF1d$h z@e5vSjp{$OYg^TeU=+NeXqSyaM21OxzvbTZJs5xzZ=Cxr9 z<&=lx)Y^iS+;)3auUf3iSO6=BkTt0CS&}KJ#iTnxJ6= znEEw#Z(0K!J|NZS=Y zyGsZFaY1EVrMh_#V{)W9DDP0MaV3N>0Fs%VNX0@0URdmXxOa+P*Z_yQkad$#?f*1l zLhsZC&ngwMT3a>ZMjyt=x=_aN{T7u+9PEEOF+L~OE%2ak*d?O{7bhI442|70yHZyu z1JYN2*!%`4>qu9R-Zc=esmkY6{+$B;FLlsqjlO;BddWV5`-Ixne+?N^8<^sz5(-A# zU+KFM{rYZK*DUCuZGn>Ee<1!-2~AI>ZJ{Y>E-wpZ}^Y~9O`kHc%{>TRbnZO?uau2ppv zLTZm%n#du+*JZQcXQTSk`}pmEr>+IMeQMY;(uiTtk4g4+&wEU%PlRQ;Oa~@~`w?*I zF61H`MFV^|oQ@lIK~7*hnK<;6%df(I_isr=G<-RUwv~wNE5faF;lgZnIg3HF&b$92 zwhI|e>QU0lV+sjxYIu!~GLgKuaTBv2Ph~Ljcf9b^lTsIkvWeB?2m1>Rpk(_qj4bKV zO|NdW%$u<1vm1!C3xaR#OBrKmNN+%f-}rqx{R|+LDbGC>-5y`ny}35qGlI?U@P8B{ zOHphGOB8ghE26sw;S_nn(c|88Uk%TuhWzP1d^>~;M@nL+%kby}wWv*&AS}nJ7u4TxsfISb5(#4N%^__|cC2r$ju*}&Y5(-GoBUYhE zifTnZq5aue1ify~^=KJAZ4|97ei=TF14EM+UO`@Ab?{{*vkz+7X6(9he(pY%2)}Zg zm|wpM&f0cBFi5|#0)dPQrL##;@le|QEe%*_mCh!&PA7ASPw`7^BPO`s08s@~+DCOK zD$9||Sc{dsUk~D17(WIsDnm5gS`lDc5JyFHV8X2RHQD@Pl$KI}R4RtwD@#iLNuQ(S zg7y0ay$NwtAQ!&DyA(Lad7bL%$(_Qt7RGG#hnc9_z5csuEDKDXULjx7kp`p9*Xh}o`{ z!LKTJr_#&I{IbhS5adh)ujkBnB$)-^oClv3i)(eZ_j|3DYBqodTs7{Es4^cW z5i9HgD%k0A!ijjTiP7-9Ebp@_q+j;#lNDj$#KeQGG|)(R$3Q{3AFX73jrXUcH$0|J zUpU5C-kC?GR~bAyD9#sgn9tz>*Gw5gZK=38iV<%Y^fZdVn%ur~oP z0aN9Y!rdbXwsDFGeMu-uuwPU30V@YZ$DV;?P$#J~=8tAF`dp5rXw}bizxRud2M1hWk0cI-(;8&0_pe>Y2CcAwDQo=r< zq!vBICay+@Z1@oyWJI|)$nItu!D*VRLRFWxwfV4im2@K%PGWw_q2id#qm8ScP{_X` z!+fF&zIT?u#z&I2s(!K@YIKL1_z zPA465xv+mS{0eBuOq_LGQfSU7oe@a3Ry37hV&xtsDwdY;C^dVy78DB7e8rbjcjx4E zhsN^^0*Z(p-bQRC2mV`q@yA*gH#nFbs9wl*w%Tqp_d0Dc;}42IQfaV*luC=u&cN1{ z3%q`=VAo4oxddM2-#0JY2VG`>wzfQv2B`Xy?+`dhx;`WDK4evwbt^*zA(93(v%v$z z3`oFKh`Z2hggHGD43%M^0V)%89I__XUM%7su-mmcWw^OLe`H!_5w0@nRnAnK^p{ z32cgLH^TvWf{A#t1zrhfId+5OtL=>=zB;$ikNz)e1l#vcnQq|s89m-VkGF?>1^_lZ z?t#Bik#AXsBBXC_XST$BjIn`z{KKl~p!3i9>jBI8i_pC;P86$s$GoPTv0diO}X?55A)_%Ykg<@$N9yCVUb>%&=+tI%ky}EKW#%6arVo|@!~i8 zbI`{*MsBDvi1uC@;-8m$nwS27XaWlAfA-3*E4zXoK2!okem?&}@7>jC$P@S+ANQ;7 z9_1m1J5|T#H)+JFF0se_IR?`vhYMOg$8H{<@~mNrmJTDm zJ+;uJ^kWcskEejFn}0j#=8$34ANix(@-Z7I{>R6|Wfx88{fARAXvK!ncn$9(9n9WZ zzd1Lawr9_3cIqk&nw!4IQBWm^Bn=0+91UXJPKFKhMvd6N*2|;5>wB)VKI-eL(hJj6 zWuk*_4av;@wiSX+RjvDBYY8vJL`-X!cvdH`8}VU!f+S1i{%eoggq-LNW?fk^-es~PE!O0&0zFRU zu3{x#WVIqWhGnv1ND`SoJSJ(9+C)teF$SehNelm7nf8mqV8PM2w*^hBjY1_j0s%E%17D)gF>EXf3TWcG8{ z`$K~W?D-E1OGQM;kTORLRL604pLlPp?Lv-C{t?x`<8pevhSWr{MzWH=l;Ro zqt>Mz69B(;wfw%Bs6R9jhKDe}wl?uKQFN;Ds(HV4J37lg`VX!9f-!oo$OB%ttI?`* z$7O^y67(WpZh=s=>%~GZxn*d6{N)lD8Fyl2&zw8yNzPK+zq{4=JaVaY07bQ4#p!6A zKDG!zDwfeXz=jwxbOy!8X?c1K8}eZl59AdOBxQFFB*eVC2qVUc-%wO1%PbO34{_qQ zz7M4nPLE{av2LQ}5>AhI>x2y!JFKQ8o~pTpmN&CfCUq6^W zUS;=oZg_a`ixy6&^UeZ9+w2*LHij*rlZ}C6T}(W>u3p1 z?Z-qAiBz{)wNwxOu#EdvTviX7q7(|iR(T3%I$+#~vs^z?2U zYeL8|t(mvhm7&*cdN9n#$qk$Cx?1q9`&~d&BOG>sq`$!N>cqO{cdVrdiN;1#7K;c? zB;gsSr=}~IV&)DLsdb@wN^p3z%xB&{!oDmgV(!JG zP73iQq2ul%bC2$u2sbGpqSNkC=u*Fm;>BJ`KV-zK*=esj!Cy0FFB;N;F8@Lsa!k4ec(*{OLWFJ z-WaBQq>X2ri4t$R^NCeZ8A8B;Vw*};bcAk|Q++n=tCca$S-%}qZt8AydDrjxj*O-+ zlHy_lxZ;(uWc=t7owBFr=w(f#N{P2Y+dBhRLu3aS$Rwfu>2GMpDRXV;ptMT=7}%SL zW7~~768AqBu`nD3U81oRZt0Lc2{Zo9gt_U$5H*Ts$J(o+YCec@@w|d3f z_y$-}+N{v8SIMv|Mh7@3h@wS415`rCpJJQ=1VR~W&WoO&5Lh{z23v}|VU+@~bHzn* zS!rjZp)NBi`H&7I83$bBorqDZ5$(tZ zH3;P7L2n0Utu8e3^%P@SOOM9v!?CwXPbZ)Mx|SXSw^RLJ4rj5B^k-ciIbe}9HjKEu zwvVE-YH&3ManBbUqf(Cq0e~oSz$+kLf$8!%whymdKdF&>NV#Q}ORFT4%xUZ|$ShUr z0|C`SXfn@DB3mWO`-Du~oei02xf>4tg!=+35uCd6B9W0EMfw+FqCyW9nEfA|Z~{sIUnvk!ws*CVHS!YeN< z!C8j3J>wN{U(BbG{X2~FJ+qMAY7mr);R!3EnhoUXoGZmY0j4oNt}@&84xa0uQGVlv zkNfmO*!**n7S~r0DRY2H!IUUYlci!RC<#xysqL&&HW-pS{#-XfNIcT9-IuVEy)|86 zy}>y0h&O*ayXkn6>ZrbOpUka9B17(XV^vy~P9W9``sSWAc9!rhebFLaR=fSq;MsV1 zBDbZ%zQyrZ;+?EMh5pr8}HN8%eKv*uu}p3)bm%T~&*hC4vPITwhSx}NA84g{OB z@OlPI>i+K(XyFW13Mf0pOd0LqDXB$W1(v_dNnceTW8R!g`zGbUeb|ll;Jd z7W)lwP3|;MM}86^%HT$*Md*rsuFG(jmq1{Rv_hzw5hW3Q8+xE~4p^bZu8EIoD9JMs z#~KST^4MMFStP)_iw$D&e~NYZqi;kxjO+QQ+11-%UP56mIa|;}e?#<+)*kwYE=e)N z2On)elhFApk*Gd&dwru&F?B-qoqmohd}@fYz)GmR)vzT=@9A>}S6dpjsIwS9__2Kc zKO|d4s>n>EBS%u6j?7xJ@Km3&gi)}XI)$ZuH!LdrEPzB1pnJd0Np$fa17!;k%hNUR zVQ@gJ6E&F{s7&_n^7G3-Juhyfsk?R$9kD*35H8_0iQ-Yq9H4>1@hsv{R3sr=NH{7` z)VLvO5F*q6j7a^JSOusm3AExM={ti{R|jQI62=aUD4dvBIIXB~WAxxLk|1DtgHzK6 zhsKR4O#n>HOc@oJa5=CdP2kkiK{*D(bJavdYDi4f5!7gEThKg9V9dHfp%lV1@kSI9 zTw%z2PBbCKTu3Sth;}uQ9$mp`d7!L=!Z^*sIHkfk>4B*uM4`QZu{J?i4TV{h2a(~x z!d!Q{Ol3@ms&MmY;zxI@E z;8ZjqFx18jQ7p3d8c`BFj)_1FpP0SQPysyQ)AtOpp-GABM}!WpW!?|1Aw4Dr5_i|M zz;~=-!G%5o1nSP7{qkRH($!#6G8eyJBE-$&yYzM+IB@;2w|`J|`Dui0sj3=qm8d?Y zCy;bjW90V*;z(ts<9uYKc}gv^RhH!@-%1ZhRCFY$VN+8gMP+0OQU`EKOQV-=#Ui1KLS~eBWT@CN zQ)0nr0>36jK2nBW%*cMJu=15E^KNkG#+WIw*fkhknSexbgjU)HiqHmt4TD+uW_3CDI zU=1p>MKIGb$y=#=YJfUsDHIl8`2n{zlR5@q={15NZ2okY%udu{(=de;d^^Mhx3-4t zQV&Ic9@JUWCg_;lPBv8xUQOdIYyUxA}r8T7J`ECHdh^cBxvgo?*h!!-4sw6XkLGiifwW-7eGmv3(wpCO)$BKx3?jho$ z%|&RlBX%)QJ!XZrhyB9_{B;F|Rn94cM2DW+9aZ=AIsg-eDtM?hjpvzjNhxGwDuJk~ z%@JiQO0o^MG@w?kL>jL|GAZ64{Nhw|A=V#%{xlsa#vi!Zil_9{S+58(A%b9lz@`wM z{UNjrIh0@)DN6$W7Zl~GvspnTU4hN}Jlf7YDU{%-Ts}&aB5M1Ia7i8o$2=O&yxF$` zu5)=@qpJL>^}(qe(Md~#OWA@mjyKmTSdR5fw#Sq_DPXNE$V_#(uCj0y?an$$EQ>Fg zLOho{-B?oR4qL<5YIHYVpx*^j<2vLVblOj2h*^D+rq9>@B}aI`!;-R zYC!7YJ61y zlvLi$;%MX`lz-~MG=?;CG$Zud%u^wD(C2s8$FQ@KW`*4`v(%R0-4-|LAeo0Ca zTq*}IH&&hu&ehWb1JuS?3KL)>TRF(5Amt%c3NwIFv~tVl0U^s%p<(Ke8CR!N7JA5% zQVA4^pk4$AOHvP8B!wnr{2AGE$}H&xu!c%9NS;Mn_nWZ6U=o5e4!h0T=lI z@-zT5%Rq}D_OJ*fo0Fe}#ayLLJr^k($ai3+H1_>|x@*b3hBQXJmzdF=fTX>lW;E~x zuwA|0^=mlDP@jw3-L_NE-WUM8aaXD(>V+?st(w#Ng!>kQ*}PBuA+!J17%8_WPy$pN zeDl8+^rvLHqjsvW;)$rD$w6RMe;Uc)Tz#c)YT=R^;CA-KuUrLEC$V1cCi(>zb}l+oX+Jxn}&aj)F=wcI;5g-)%U+-kg&k{;c7 zd0foQX18E+ll9W`looSeI{T-oLA}^B9ibMN5Oh0AB%P@i7aJt1C0(`_mj>`>j<*A| z_4T7Dr_xJ!YE*{U-iPBXjy$cM57&L$gq&V+c)LeSdGk${#-WmJpGsnC@!FKOfVZDE z{EeTGkBiZ-R7aiCF`n*bH2z+a`>tjGxGrABnszvc9=otLx@r?#{BW;op&%FD^6Ul4 zq#nZ!go69ZOtI@eDQTO%ejAWxZq%GaSkZNV)tmoIl&sMH!%}x}5veBS%xVwZ@Q*K- zTIErmdMQq-ft4R+4T|rfKBtZU$*T~+J9zU#NFL5&x{x0z0Z>yn3f{vFt%oDpl9)^mL2 zd_3U%VtKd`y$N<_GqD@yQ0?iuUSpwZ-$g`84c9`R<;Hc(YnHBOVz<0Iw>^r48cT8=JB?YHw?0@NP)chKC<&q6P?EvNh=R0y{aBy7t^J1ap)_U!6uj1vKn|F0Y$0Vb{X*jc6CvNMi z&gyAW#T|^>uL#8UY1{R4x=Nr+45+!!dTq16;zHTYEjyxhq+IV}q{7Xhv8l{@ZT4ry zk+PdhK4MGvneLHQg(EYy-iVpqF2aIiaVz%;Inz%>+*W_UYNsvJ#xE}WBX>N_8x?-qvw3n zx0ThjD5h~3u6_0evxwH3IWe9oMxJ48tu3E2M;^{r{50JNx${0NT;ukYsyVgAV`3Xe zczG8{&gS>jHE$I?ubI_f$Q5mRH_I;(?z35jFq?AUMTphbTQAPmS-F42aP3_3iC&~w zR$AnXu=)#K1#5anr3x5iQQds7$1kwI%?UOzVd~ZYfheeN37bRj-$}g9&_UPB4k?cN zn-GRF=&6u?h~)kG0Qj*d@Jco-$N4b$YgpGqAE`q}OGP7VX;%bzzY%b>%Z5G*mb6Od zYSaI&x_5CK{>qM&7>hBCA4awXA0cZthkMw|gl-DmB?T&hsUl8)+^V}CBG z^iL^Tn1n$)@GY-9_*gMqYKu^r2DZw+dX*7gFUCn3C00TzPF5~9#o2+Bo&L?k`Bt=M z^t5!o4(Kkf);0)f#Ho^6)kHYi`ud~MX8!F!ZTieJo>9bZ zq;&mN?y-ZCtxFLH-YoG;3f{4YqN%wyskzl^0l%yYQ4%d`kEt;e64ssC15^Qj(=}Fke;kWVm3yVa{pyNBLupmr_Q=+5%ag}EA*Qeexv?a1g_(qgC zqUiZ~Y$qq>e}>4OD(Efpb-h`j4O;r~ zl)01A`2*oc>ll$Af7{npuh{5l!aBN-iNEFky{%8osNdoc)oyL|)j5eO>X?C~6!?tu z-s=Xbbo3_+;y+gw_%3Fybbk%bb4=W8$KG#p1hPQ~aLbceg2BYr@z0*N_Dm8um|P%; zu6US`zDf4Acz)Y|Ga|fMk7zqH2q$|Sam5c^Re8JAu~^(Z-|&b8`}qDGHIdeQ^W%JQ zV{EO2F7u`*X7>qk;M0ghA!Y)JSQva<1t~Xoz#xL7Au(^&+i-qrnD$GogL_cp;Qa*F zi;yj7@M1Z8){88(3sU`ZtM66P(BP$Ub*>L_#MQuD=jAeW{(Eb|%hx?XzY$~1K0O{* z{^MlVYY!Unv4G$P0*JwufQ?!ftzvxtWCBI=SAa;S+6K4mZYDa3&|7tL@i?v59x^B5}ZDG#<{K6WHj0wFs_h1 zB%ifOyexaxZ5X=GdfWh=*I(1Q1P;b0NY3{U^lv>Jpav_1-t{+vyHEKaB;L38bNS`d zS`EL4ZLHKnlk*ym^&{_5p_taMj$KNqBrPb2E@-+Blf=-W`BndE`pH6y^($DgJIDtH zHSA~X2(p1#UJ10k1x!HaMr&kM6~poMb6xeL{DvJmkn}rleAf1_Ock>6DUi!20r`^P}Fb#QK^=I znCbd3Bf#uT-)gU$fP}{#4bd%MKNL)ZU?a3V($>)b<4czz5sNF@srPljUbgp4Oe^>6 z)%YDx6}0J25Y>VOkhh7K6z5D(c{A0FKQb(<0X^o`b8mZM@bgop7$O#y|0RYEuzwxc zuvjcv*6)ydH2a2c$-V16UxMOMdCB#HFUg)CMXYSJ-Ab%pn@6xV@>*{9+Q2IFx{5A0 zI7?exE$N;7Jg0Z;RizQ98BwZZ^;1?jOr7Z0TzG0vEV~ead84b$q|#o- z(^?Bh)Ood%7D!2}iluDkE%Jpg^))M-8NQ+N0{~T)M<39GgwNi(RY3dh#QWMtXGrTY ziz$#X++OR*d18GFVBM;o)-%WXt=`U4jgt|0GHz`ZMXtxmF{AEy86i+)RV1I*5?e^! ztPSAf#BN14v5F%7$tgF}z*sN-&z&mfiTRt+JP6mgnqpzTqR8VRPmK(^)sK+^G}j5X zV~F-fn-5_$q|tIm+{S~t$uwTGLL}@U=Fd1Wu6M34k&Z>wD_=kP z2d95l$8Wv8!iQaMT77xgnC@%LHxErxzj@D;0a*m8GUC3WZZUy)u9+zj|kq$bvu zCIB+e>kp`0;lWD>*VC)~J95HESBS1nFIt%W_I{zM=Ue->q|Cyqk?k8W5}@5505ssK zy~$B=SFMs~ff*^elYeCK$WCL%$eQo?R{D2L2+g{KoQ9(`YZbD1@3e)rx+0N1N}Vly zKQD38tQ0Tc=M^(Hj3|EJBe7YG_U(ukTJ4$0j%Fyl3wvX4Rz} zRcnCNV+!v&G@kPhUWz{-Ea;QY?m$Ol-(`EUYmYiSmrxlnq>i$612i~3DO%$~YV>C& zAoJ|~UTMNMxI!0}(IG(kqc$E9_j``s?$7 zaX2QBD8F3Bxp=jsJI%ixRSxO05c!(v@sNPHRJ1^pr+?$UpOji=gm4I{i-0`rQiT$F z?TiP><@>^7^zbCPsUwPO-jd}rEnDhMu&d$_4?6}Bo|9yitS>Okv|%Vf$V2=PRUen{ zQh@MokG(^;%-6XXcR723vHiE9Ew!~`fxHp5n|t+^a-i}86jey)W!^(97xHAwhUQU>buN#}^T)=ROb1C`_cUAQkN9`(V*b36TpiKt5bjc**C5>S zh6g?Jf+YJUIG=Hhp+g049U$Pl4Jh9NzyPH9!{@eoNcV8fP`VO~tCK2t?n21FX67T> z&^S}P`!QL(n>A{tpMz?D<<5N0AId1QpTPWA#iKm6kn0QTg85bNz_!zGt_sqN?ofxQ ztq`yRuqWw(o+}g^gV|Yc{rOMyU2=G?Z@X(XlnY)PBJ^`Z==l{{OprL98hq_2%nO)D zecg03m2>jd;98Ay`*0T z!z>lNPZ43J9cf{bC2XHSxvc}o#FZ|amyV(DY0O_)_Kf2D_S`pi-6fE{-_D@U=7|5Z zzUDh2wiY9kDCT^{p1(PhQpT{`LhZw;`4Y>UOn#->5vp_*A~PKaCqEA**CVjR<7Qk8 zs0avazVa{1>vxThX*+p!u9+l+SR$ieu}qwPS;ctcG%O5lyn*C$I^8 zsUx-*F>aljNP3DF&*s6`Uw^QDx;`DY4>Xv7Aiv3rwd+9U)dWj#v{-r0;ig*0mv)q- z35wAlv3@8{-a+>v;;$E#v;m^D70@7k0vf{gB^`?mRGn@cZqj%otSZ7&8iv?7eyRDU zdCjCNfy}NW2tsadbYqmIaEH-*m?*+6__8|2H<$TnDYmPkKhR8S^vI9krm^KPP--x9 zaH@+W#AbG6W@d&$W^H^lGe|K>zI9(=(fc*pH}e$^U+ow#YW4;KiGX2x@2ulWJyzvZ zyVx(2;}-wX(&#>zC`ZULc02Br*QOFw)^6*xFn}V{ zJvA{IyY7-p1u4*=H9%e;cER^kW~(|rWPYU3#`LD&hjzX{F~j+1*^R)Q*Vj0D-*}Jx zy>K2icRrrKSjcJml-kr>kH1O3HZk9i*$Z8903UCdxINDPtTj&SD3MW;M8#;kft-fb zh7cH=_dra^031Sf<+3T)peW`>bhHNI3PTkd%6C!Ym|Ee@)-*7XVKRUKIMsblWKLN9 zrho9#6k6jCSHPink0u!WE^q1?1NK9`l_Om9)|JKUYz6#^iUsT`=`-m$wM=r|d@>d^LSv#?R3DIq9>(b(a0C@)iy)y|3Bz^+0w&cSbVbA2dIB&HNrkAbJCPw{;X zDkK4J*cv;739L-Dwy38DSPNxNmOjF904p3^DJ3b^clH-&aW7RvZT@M|ygkru#0W`#E4Kj8%8 zJHgF@3)Lz&qFS3N-#RNieA-pTVDXRBykEWk%nJuOEluI{nuIJv`^K#8--9N)0VKeG zwJa9)07#C1ejAyB$(N7?BK1|yPJgpU;&funRnpC0Z({*3wfo(CGk@QWrvJ)g#ohPS${a%O#3GVb zGx{I}u}O*lSsS=`7&-bWUXT@cWN!M5pW;(P_c`sGB=3`+KymTElt7d zg{0lwUG0%j)}xaauT0uQtuAgz5rgo@mVeIrF#%!rwgkh>!|P06_f?~yev1dD@1RM~ znSqH_7~fwF^dE1U6#vFn`KHb`a2n>5fyh9IEfM*10aicBm1ldDkItNLdLNDdZ~@M3Zb)>%+~^e6E+{|=14o~)80#cN?yQ3MBAfR zXDxxuxAaQK_fL@^$rnOBgWem6xR6YJenSs-N==qY<_@L8&W*>3;`UO(;Y&m}s~hmmBA zf3PXb-ar#8JN?Pp)7!se(``q=9tjy4!X!M3te;P#wU?v1_tgr0R|fRj;s&F`Mopw; zB7sP&oQZ;3*saWB0U{GC)cu&jP*LMM&S`S#pyzd54wgX8ZqKR4z51DOju_)5*J3CU z!n*c>T9_`i0PKb#mxThxzPIYHTo{rW`tISH@E`;~A~N78S*|Htmfj}gu5yRXtOlf^ z2ExTYMWRmMV7=+GD+F94ruY)LA@^(@>0~+2n&xmb`U7|24g}_lzv6H%pPd8d%9$_x zp8^CSh{a&h%cD$_pIEV7RLsqknunQc3Y?BCr=z?cUy8R&S!?lg72F07z4Jc&wK!zI z3u}-qPKE%%)^)PA58s8)i*W>3$38L|?V*KH>li62ZKPN?x5ymZCFRCrl>rK8(EB-Z#K0%3624oWgA{_zO(;Vfd5d=s!V3#TEy2!RKYY2yH zDD|tLMmFmG=>_bHV<5H=B7xxC}^Bs2<=*ODR7Ol!(A+{(fnOn397n zD>_kT(3{5zFdtjq4$afjAx-D9jxbU&x7~8MFY^`R%ieYxBSR40j&?>%-713;g(_{D z{|E=-=5`pSap5q_`eaLQFbIY(vkF0ljkt21=0R;w`>_e=pL52N)*-_yC z8y@{PJ1V}h^z-mqW<6|yP8FVjyG$uZi$jUZ_XCQaAESx}Mg$X09UarzadVz^i`>iVs!$oM3HR`KjJJgQ|Jy+Eu@rw2>3LE$&klMjM= z>>5HRX_)$adGMy3@x_Xkko3l1>G)^YdE>Jct!{8{-jka9v%Id=Mly$?jvaV})7FeX zT^%ziSh8-(sUg5hr|e1N)Q6MsdGp*e${~5q(3gE3rCuR1nwFyQ7(xe%9q2&b0i_Xd ziE|a30mGNE;?Nv-MXT zyPk-=h-F@)wOj0Vi`4uC8#D2uABJEqo?yum;8@6D8EKb)M z@gznSHsWG0(V|D;|8B=sJxdZ>qh*cpD6Ltrrq57VZaHSee)Z01=;h7tnsmxAhK|oX zq(FZk>cBt`crtlM7|OgiV)E$!Z&(!PKeVV}C@Ff~7REM1dso zk0>cR-3SQ0x68|mQgu}rt(_z?QpLQ7I~vCx6!8;)4;-NJ>rpg@4+~t;b+ywXP+>qm zB5oRoF8iVj;Y!9M{CF|a;S||3JRe^q_X|fj5xF=6x;F~zAZDP-{UuJP&*2#rdN!L2nR%e3Wqn>WiIa4;y7ITPv^BdiN0ZfQa(#PYtt^jASCT6C>2 zTIk?plk&c}KqL37;Eg0WYogdimc9W*zd8SMH1k5dgcY2ahi&~jJ1SAUs?Rk$ZY-=n z^h)RJGw z1rv{DrRF7hT;0 zlKf_hR!#;Q;zJBZ2AcI1pTrOb!MQ8g zLo1{}nNI3Jxg`q9$^l?%d7N+L=pp)E$;L7q%SWE$i+VGEEqbaS@QfUpBnim;j3vGv zTk)!rF>|DRn4j=-0icDXgl!H|m4r26q3E(vBNyMp%ZS=Owo=e77624UxW2fl)rrafK>5mem zh@4lDO_k$wUafZT55k~*J2KojG zSNur`oaK>90pXmMqSbzmXO#i@=iDii%WKgCu516^sEAQv7_=8P+%e zE9@(RNmifWdW^IIqz^A8UFCbWDGPk$=u$C&h9>e$M+r#JBFzBZ)lqxn#=3)@Q4=sQ9@990TiL&ObWu{CT}f7ssRS^h`;|5y_9$p$BRbd%k*Xc8m) zm_8iRzK$!UReqNLH*Dc<2JoR-WCTcSH&;dBtuMC!v;LQ0Apei@f9Y`a5XJJp)&EWD z@DY;|_i>GfsRMsc6mb?nEnWZzkW3)}k24H*RNB|fq$6HgAHTT*L#hH}sT?J{UV5)q znxck{MKfPXgUUgjDprlEMwMz(h3ZB*A5A$Qlu`&Fr-quRVbn_urj`~(qcRPiRuV35 z{$oR_2!E=8vs{SPK}|80kh(=11==nIaKpIb4U|<2fk=x0c;K)go+1DV@>w`l@&w*U zXIj@XJ{icY2tdYvk2ZGLoH#m`fk*t+CFj)8(>Jd+XpN!X^Li%5f;d6W@N_IcrDm}i zAuTU9t9nCcp>;grmU7uJly3{l_WEG+YDaa>-+|m zy*EB|k?acLG}qJ4#Sr9`&B9$SqN>kFuH~{OmY46Kltg(0&qRKq-)$2hJ(NY>svaFk ziHXOQTbyb5OGFH70v!c?E?S$%nk;hujnnQ{T# ztp`XD4ZO}ND@6Pc^%if$!-e!V+C@-gx&$Ma%*Hg)1g4MmPPV#khK#AMBH13&=oyJ0nE!Mf*>f)uM6A1N5h?{;^tbRN z1u%vgkpfRpK5eN^R^{^sxIp>+STjhtb~a zXYTa&eBbmq)7{NG#u=k(IDh!_d|g=mlSRovI~*^VC&f$G%>Grg+!!@(zx%c+!8)ub zm%EcP?PV(x^9Jq)c5MdV%Z}f3b6YGdKf*9x$}JT8hF-in>8NQuKjnwKX}mo9SF?C^ z_pCydlsez9mgu$yc*!KJYAbX~#?PJ*QkXF+zZ|k8r`d>00S!?k4@f)47P4y=YU|BQ zEgeLhyYU_O1$NH`OqE6?==h+#Qh+2dhNnkHB=$DdCfJuE3M^-ls+}O0XbTMh(S=Ei zwhY^JLr&V8Cx}%26_L`>PFlaINWWMWmks*eC5;Du=cY2I@XSR3&NG(FcwLxZ(?h}I zYWpSEaxmtj-bqDT2{$~XlS9kn0pZW6RDSsGw@A)%CY>eTT>zEhjKumE%bP|ZIlpbd zv(DZ1MK|nQ{#aSsP*Um^T566VTbJe@tje^-g$9?IB5TEjM4kAIS%sbo`|r*L(yVKY z;w;_e2iM6#*G*8ve$!m~;(QHmBh+jE`=N}}9&-i#x{U#iSZ(R-rTfRJu2H>H0*~NQ zrnh?W;A{Cf0Sdl8D5mBt>-;BBy+Sf9wG8>DpiMW@jEf{H+b96XbD`~^ywNm~*>*iS zsGOkvrI!{kz4FqzI@a?Kf6WyS+Q?}=Qp;cI z?|5dZqqg(331_=Xc^PSwvBq&U=erab)IG6c*ABill8MNAIF^0^sUAugZ~g%ZeTb%v zB)^xNmR#4n+lxThkc7-Y@U`F+%laZXrA?dFj^PCt2@r@fz)*TYLdQ z95sEBrJobAbp2HWc4|mE_@$5IcTH)6nPv~?EqwXpJ_f2u?ag20UXmB~K6aOLkqUYT zQ|8U=)i@>*e#oT(kxT2Gx{0vn6K|cc|`hIIE3aACHe) zzrE<`9VEq{)V|RuV?6@uTNHJjPqB;sS_D)r*?J^qG9_aYu;?~WdoM+xtQ7JMlU&*= zl#G!)3yT}WItAw;} z)cF&%vZ9L1T`U9jMI^_@NYOG|!E#GpB9NOZn1d>aO{*7FMkZ5iBt0>boBSZo_zAzj%DgL480Y)P{@i2`Y{Fx+n=2mcmQ~0$g z?^N{HXp09nc$bhU_(m<83pQkhkl5H+P*d&~jhry(vJ!w#Ei4(q5!p}NVvMAr6kL=S zoIfO@l(rdn zJvdB8@Nq1`Vw%Eaw_B+2WT;_AD9e*DBHRItf!%lwhKOpCC<>DBQdL1@iz2AgJ;)fK z>?*(pa$z%*&T3LQ(@2=zuoNh&8bBhH1E?ClTR1&WJKj#)pSO0{J4;e+@LazXZM;xnm~o+$i^4i-!W-Hi@d2~t4*JiMn7B`;h#TJWn& zq6sf;XM`!?0qdFr(%^p&&W7j&j405J^P=gYzuuvlU#a02;Ip)J z?Xr;4jtS@qy}|SnB|ZxH#<3)d*|Wd5)N~;UtlrQE_5$lTyEJO(F5RTfh>7(6 z2R|b;`-h+1s{D(ei4px9KXcKb(X0OCXXW~OG1KOs{LI6HcKs%%#*!DtjrrNDrCox! zNmy=RCoD0>aBW)@etA+#^^bRf`{^OBrUNeg8#!eI8Z*YMU992D{q24VP@psm59-4h z`&Fa-4_A0=K2w@~4@Xa94t=|anM+$jPb6$XU`ZRyv;Qd>f2@EgvuuI zx`CxQ+u0g|3uyuqgr|&&H;iS0UY_|QAGOYdTwLN#B*QfM+rg^0z<-gbd|s!<3CC*u zHY7@N8zA$9ht(?Es@U$<|A`c!w%aXD(13;864tG`SsaB_8c2eE# z$>!ZoloCCJb3ASu2F`dpr`|1=>8zBzntH}-;*VKb1#j_u#l>*-J<}kJzv`hdiw4T2 zN4`H6{^G|Xytx3Y^my=IJX=zpmR0AzPZ-VbZ@X zl8-nY++=r+L#JAb!KMibOR95<6`C#EU@0)|B%=x5f;^uN_1$1Ed_sTWo8UTB&8uUzje^o^IrC92%@~`FT zb3FO*yN#np4P2RbeJ&;HB3X~g#IOr`;J`}|RJ3bCkG}5e{}g?B8;t*mzINMxMBnP5 zYfRpn^*^95RE6;q^o11sZ$Y0py%7YxSqGigFFHp~Af4Pbtz`x6Pb=DQ35k@@SfDGZ zR0oMP1BncIi8Q{!REEJ!05vQ2U!fHHX^geJ{raiGY9;gXIO<{}r)f#$$sxACp%`PK z*TX~8gP}G3lJUKh9?FT9N|OvUF4LF{K``m8kP5Lv`@Ngf2C-MAl1+338Pd?X@zsU0 zMYNb&z;Kx0c*j4Qi`0aBVbDKwSkpC!z7W|C!)hQH(;iJqIp$Fk;lU3Gu^Gi^CQ@L` zhPrDhqa>%>Q(dS_xvP@@O)MhWI}&kyj=kbH1yJPml=&1q+7=mx8Qsj?PlLh>m@$?0L0zHL~{{nh_sQ(G{1|FN? zs`@{Dp2}+rdqdy9e4g{=r_X~&4Qe9$4hF~TF4*s1j%$XCR09au==1z|WW-9z)sSWN8V zRmFiuh)1w%6ojHT`)jB0s$if8g5T#koKsqtk zJyLX*ymwMfySm7T;ap3^IHBAP5vSGn>lrz}g2SBnRtFefBt$Two}~eOR{OVN>?=g1 z`gAX4`sVGY5FB zC|lQk-T{BPwgIJn)?>isXIFgKLnRW{yuSsOod)vd_(c;1R=d4pUj82?bQ`ZxCrb6Z zsw;Kx+VdaJpx!T5f@!K#hb{xQVUSi$K53kGeaUYAGGD^>z9qW9!!4gWPH`bDRtNc1 zRu6SXZ5A^BNP9iv|lE)Kt#+eTkYk^RxWWoHevS9;?|J zl=&)(>RL5)JjAsymDEI4Cej)IljjA)x{4R`nzXx=Nt0B_pWaPHOvSs2uH5qs3G(A< zO=CiH+S%>?W*{Ee@$l9gm1A_@+{WHG;humd0)uf>4ZUz1t3#So;MwE>7>Yo{Ho0i* zj^ofbIiypN)ShZ88ymfaLU>ux{6%+}m^wia8JbRNf^+w1Tj<1P=*&$$5eSBJ)?8%! zyuYj(YPzxilZ)|Kkw>cVAA^TJWFEh@@p)0qKnKLN1256t=>p|DW$@iDk%uhQQ91*7 zlfQ00nj>?ggx;;Qyh1T}sSKb0A@JFcb^{+sU-}DoC?E@UOQ@fY_vc(+cQYQHymOHv|4h$@D+_C=rSW%gZ(Mbr3cj`0 z)W9e4+$9!z5Z($!Zu&?`!+x~cth8BiO1fvTsDMq?jYRpR&aMgj9GoAt25N)4|0AMr za*wR9j6w7cGx-&z`1Q~|o)atJW@PH(`%@{&6)<((=lA$aTyJTM3Q#hsbpNc}Mdu^0 z0$v&gxFvN#W>2tcKC|v}-OcwbN8LWycC@LKW$O&0YP->2yRs+Y+lqC)*4gg^;F&-11!wevkK^+sf~Ms~l|BW|yj(brHL`$CoBk8G7;0nlihD9QTvmHw(X znojT-wLyB}wKj)>y)1FX#CAwj{~n9IuF!e_`W8ViD!458by8%|4$)#qQSnP#S+-1= z+SFS6^3YtY1mq9Yfa8vU+b2M{?{`WCh?W`5C!nOlt}`pYw+0YlL#>fyz!kYr=R{#| z{+Y&JYt77TEsv+2(@qqtS59_Dzar^@2Qpb74Z7_brcvvHCH7%2W>w1&>Y)uEkFd>G z-1jP0!`$aB*oHXT>5;OdAK50&4(g7P*ISa7S`s|u2uJ$rH-u#1D3&0bSAnnS8lqZm z8?XQ@d7Be@6R(pNYL8olVaUd7&n~*K#{s3Z5JkE*~|8>R9#IUe4oM}jz zO{Lnqc)jR`7yYq}Qu8n#%K*mE6uMePiggwG`OL32;g%=PQ$uiv^&H!ii0wpobDDm#Y%Km?w3Tax+R+k^KObi?$f|iRQ-L`w zq3=-+?&kK{-U2qzwOhWD!Af0DRk>Ay;?I;?JK82{10U`Xg@_KDo1&pSru03GD*$$< zK&_x&Am!s^#pPu(3i71Zb-GsuYSwK=;Jvpu{9U=%lOrKeAuHt3yox zB^1Rnxbp|`XWz8ew~ZzPFkLBKpMZnx67Z$<$*~%zB3!xUP<<0<$S_#~jdWh&YsDYm zER(>bEZ3gjG5H%qC{yfSaOmP^?Hsib;A=_%Y2{Y#}*p9MA;Y_1}qf+B&M zn6|SrvPe7XIf<#sv`6vRv&HJxFjdNX7<7~kfX!#>fCe^WGjwT>0F^D3K1fy=AOj@P zg*{$HT3EjW&x;4?dxmzFLx*=^Z78L8n&TqA*H$tUBMqjs^3>h@TiK-jPZjNT$ zW(J8{aE8-FXx5`CRV}`P&DpUkE(l!w)#NXi9s7v+>68%sF6#J!Um}K2ytjjf~ zoU2Q0X9am9w1ZP|JOf?rX1HbJeWEh&r1S}9XB$1VsEXt5iVcs>Z{DX>d#OrfM(ac#)I-s1HtZQD_Wq%*r`PP?73_6E|LR9_9Vj^*K2xp@S4dWCh9ZnzjN-`8CKP zIyMvN_*Ac02REWF;JP$Z=5{I^QvR=;)bf+HeJOpAJxiaTv41r{c^H9C=Nq(jfkib| zd3?{FQVr7xPTv|IU`h-OU)pv2L*~fSC`p0hLGB0?u)mArha(uo* z-P%WZVxB74S{>Q6a#N9X{1X&zoLi+~1L*Gz00u}VDjW}w1e#J+U}?`L4?lnl2|eZ} zjZIoWTXXE^Uiur6(Ccc*%cHhI<0;m1)#Ir!r`Pfhzj9>#&yO%!J~JQc+3rMXtOwRv z`)Rov%8=a{A;j`dCLN;}4d@;|IUzU3nECL!Ji z>jb`lti$bqZ`IJ?H>XJMF^sa#DKE(M5Wwx-1Ga~Z?-4U#P6UGTkV6w@U@5}O3c=U^ zjrRSQ_v_Nc7gS%lVRy^i|2wma$}|47v)ZZm{_APRAsNuvu++CAlwXNDdBtj1GTi#~ zr{QCY_m4)9!d>D+ntyi@R-64lvQHXGU#&XFEIJbiOoiin$N8+J9zE8m!3dIlh zl6%{t_vLjS2;U6-?I~2=t+VScBJaA~Xv??&a<9ebgV%C^c>vQ@0&|DJNKm`Wdvh7d zgpd3Rko$x1jb%4wb#C+<*K4f3&&&HFSEnt?c6HIuvvh*L#X?*hT{=-lJw@RSh5Hem zkc3sj%8xtvs|w3E3HPs!5}xnaeS5I6r*G!61B;w`pmJr~N+b-{=lUUVPm4&vPEpM| zk^jaT!}#%8_%R3l36Npop3;k5qmL|*^;!$`qw_mrr-K>EOBw!0{kGz5eR`W6Vo#s& zP?xO;e4<+Q3mf-s+pyAiqoIPu&wzyDPLJXXZzV{PQ0z8bZykN!a?Kl>+jZJuSA+g5wdQ!%fhQ9ylF&!vqwRNp-H|VGQCgAN604qg<=+ZU6^Tabl&q{xsdPQ z|7R{_Q8;4i2+3zIWGgI8LYeN3tO?~L-__b*y;_N;nMHmaukJF=eaG4|f0yieSbIW6 z#z}oDn6tqpB#Vf1E!*UikH0I85M;4S$#EcCN~{j=9I>t_918yp#wq{Ha&$&WpdPUp z#zV-&7VAw=;Dr+`BE!Z~{m2^3C5J`%AAulq1X06{R}nyv`>W}m@bpF~ z8B~qO1mk|`RLs{vCjAU{Bt_seYX!I}LpWLr{C3lXpxXACx@a@Bbi(~X36$E+Z%%Sy zPMw?@!A{21h>Y94%GL_v(Hd{6iJ|?K4>R>x64gD0O^7L|;SBzj+P_cZ32wOT5iC>h z4IJNx8VoM36#|TTjSMVjdd>f+uQ2vN!Q0BLCm~Cl+4~u@Xh+@`0{f9xkyJJd3L2ql z=8s^|V?tAm#@F11oo|P?RKSZqYwQvzEmh&jh-{ zWh2RzfA9HAE9XD-L{*E*GA+j#t<8v6rFd>&v?fpS%d;!neko?Ed~qL z@t2=sCpV$47^c*KK8mm3@lgD8%qxER$ifYsDbYRy08=O8Q@03&eyvK|*LRn(aEs+klgDNVpwD{hJcXD0QVF)}%1NT3)2Zdfhb z-RMuAyK_bY1_rDaIFjo+J4!(uu@mqm$-=(bHcGiV7l3QE3?(59Wt5MfNt1 zf9R5-Y5FbNfMehfPue56IV8Ec--#&Vy)=m^0zX!#@?BWD`dFC2u!5B#Bq>+-Yn(@? ze|wt`v3A)q8FB!(FscyIpSC*bUq)CFsC8s=IFGd8lsGB(u#vcw(*+26x6dT((0jvB zDYwrdOCcj{8g?ng6(EF(2rx_K@-05o#2J_TwbddXiUwdqU30|O{L4#JZ|dL<_t{0` zEIz2!+;u1L4!{HBpm2Y-f@>VGv^zIgNqzeTu7R9AP^s_H*$-RruqYaar5(6l9v zVh^Ve28tEenKWTYE%QU-;t~ldsK`m+i9e{u$`GamCIrTfqvlVBilGTN-ygSVxPH{3 z?@X2%`;C7*c114G=K)~s5wBT)BT?jJTF>*@r@r!}$?SeSe8oxJz}cZn1bbU{W%qn0 z+QT>AJ~C}(%;?k>+E;OLuYuCAf>7s~! zNSKq9K8zr{=ltZ24(l5RgG@Y%9DaYF@9Tv!h2Jk2cH3*{YwHn@bO zJvLiIVs|Fmd+J1$$(3`r=KICh^Cv=P|G7;ob+1!EZig#uhpX+f@7O{4eWTU&yMszQ z@fVYZku*PYcK|jFOb!S$6IXq{fsa?8*j72bsOZgN6n&`t_fv~5gNub9*e+8wwyYJt z!LP}xgkotG+SMlhO`CnST1luN2O9b$IgXy`9t0aB2sTjoEa3}rvU?feeW6_}MrzQH zOyx${HttIf8u%1Ob;b)qhKv0qK8OA+HV^(PHqg;wih#PH-Y2#DPHUz=CA@4eF}xkW z&l%?Set6r&NxlXRhJxd~Umbt2kM%A@?GfWnpFKr);jj3$aq zo<-C#kWpO1PsD<7(7*E6q3H3>f#FIi@qkd!nTkF4s=doEQ4A3)toVB8=Xqc&umo&p z_*p>F{RQl8F3&h}lu z76Xw(%1YWCF6yVt^uslI7%W?Eg#d;1COVLl3`m&|!(n9dhvBeB<->6JHD?^XHdWaRml*IG z;G6l7^R526U5KE$)qP0F?mQ+^LtUA}0l6~bg*He^j&Pg%nr|)TFulJIXxifYu&rB?%G*=WPv3(|fnn^?} zCQK!MJDNNCnvC|gWpWf|F07~sup9BVQ}oD5Ip$*?XytEyB9@*wUmi!BNm~Wnq?VF1 zD2{8|DXRNP#W;C8T?be0-Mj4F^X=V3?3Ik~t|aXi=O0tqI7m}CD8o4@U)WO|bH<-%D%@0!Tvo}SRgD}~DehN| zZdb`{R1L4tOD|6BAL}PKzvHTo*^A4%ngsWGyMm)HIHD@4bG5)=UbGNa!!D%8X2D!( z*@)K$n-Jl&_7T_ibFJout#NPk{V5cZ=!arZA0x9YG;xavr?SvomRm>oUMt8qx-691 zuYyYo=(C+9C z*b02Y%>UTOLj~s)tP)KpFYV2DhJZH@?!%l!RI78agJ{8ag+JKv4KnN01(ChogPLHp z#BEWdXTb&7GbJozp~WqTGU1W}Er=%dR|;ZGxP_mtzg^WcQxN$CT zj*X6%l<70x+mt5TkTzN44z{99Hl~c$9qO(~1W1%7b{8fJAjA=%*%tD3BB5IG-Y9XDi4V!l=D&9b%hpsR`Y1(0ASjxoX9t+hrDu8iN>a(#y zIDlETPm{}#&V`0H7wel|8zL{ag2+7wLzW2!%PVAkfrdyU`5 zlR-2pwA2jK9TVD_fy;kT(!k|E*tAfsaXdmYBBT{jrouxN23B_?kMUm-EEwmY36mIZ z^>e8aez>^GiZk&RLB#jLXi@8`QWV0=XOwC8VmH|q1!$8F3FYz}rRTbo;S6AL9+KzX z3G&4=K_T^6;f{i~PBGJGf&Q!xg!m9vDpWYsz74XcV6!(H_Hz>{*s-3xN zf(FCWmMl}adxa~twW{CwYvclBnLwl7tOz-b^|(?f09Dj+j;Js73j;19pabK)|K}(4 zHbEnTjQpdg;O`)rzeGWZlbziV^Xn!9fliZjPYj`%=U->_v8*<&;Ht0LP~Mkz=clot?ndG}n0QQ=o{xK@&kdjOR?9h5ytS3i++_(Gple z+4S2UU>Ka{XpKzuGe#gF)g0P3SB=L`-rPPjuka#KJ=nTqiK7O{75(7x3<=d8L2r0R8RfDe#c=hRW@Y3ECs-R8<qZ2Fk}B@}VJ zWeWh0X=9|(nKG206swLe!-Y*$SzI?MMz4cu)+7tLme9B!Ui{?(1lP?JdLLg;cP&}75PAvrMrf^*bKlEmp2}0aa^BDsv$_+m}7A zcRNpD@dEY+9^_cNfQH0t}-YLP&Gl_}#z;d^8!q4`zv z@_1R#&&Nz#z9|~H$VG|1-M4z@konP{TOg+1p_0V}H^W)%K1sHJT+p?+zha%TSk`sU zWM1=-r>rBmizY(Q-%I$qn`;ot{+>Co)mo~UZWja*L>C$w-KP>v{XyJ)VbJhyWh=|s2hGo#`wfm)Jxywd+7s{-%f!RNPD`)#t7dbZt0 zeFvuCXl{G|?6=Hz0h!`;FlR>N-~|OwD|e81#axjfH;%00O;Lyn?O(8Idku;F#~o5K zZi^jmIw=9C;(mE2qsQcr2WJ{U zkK~4{=zLORR%p_NVTR=Z{OdKH%b@Q69f8p3c@U5pi@8@h=lzGJ7?0Hr4%YL7! z;a<-r^r*(4ydf)CSBPxfp7DxHWjlkR5HNG4zup)0-CHVNL;I{I(%cO3Q%gO!5tA=W z0YS}oU+DS>kA~l?0z(d@IM@_XqLq)9#gX42$i1j(NyQPn3WW zA{3o1N$pxmZT}%uVf=^yJn0_X1%E{AxKL)MK7y$D&;Eu;ZAwtuOMpOHIZ*TyqHi@Y zS&usg5jC)JTntn@;X>hsfrK&e9$ZwzJ$OrTc;j&d-Envg4w`wr0X?vi&}2U9D7`%a z&|%QHcqj&O1Zr_8QhA63OppjzK@c_ppiKrK#vuL^$D4acxm#=Yu1C$hSGf2O$&=6J zNY75CKErVm`+klM=liU-{+%37>Eg^fi3{2ip`0QPDq$?gukH+2hk>&NRt!g(b zPOiGs>_s%Z1$l)Nj3JjoR<8{3wu$4l9Sb`bhDF{a>+E5~m|YHY$HJhN32MG&RK9_y z)q~&J2YcCDOI5B1O}q}PSxpl$D^`a#*`iHzusRnWRZdL{+yG7M?25*iIqgHs*1m>G zY3(yCdY4cPUZJt)0koHL*pNPKjua>k2EWt zC>D58PP0SlV|uj@4YEaR=U_FDAFUnk)p;JRvb>}v_0w;vdkw#w6pis5$YeVXAhkf1 z>SPvHZM16a1GS@$1?t?BCt0TZNOdfwz)iHuwI}uc-xZEd=)6r8Sz7E!l}4rN@r4yj z-1B>JH0~nm+&S7=^6W?@9HlCSq~$%HY!ilaJ7iX_2=Xpa@=hS?T)tL#{1cPe6k!U9 zXr(KTs+X0PuD=?1OttZt(Xtukky6bl$JB;K+012vzyYR<9ry2G7(XR*Kt0f=;v|zF zF1*{_5n`5iC%Al&r@h-cXtj@(qP}p0qw7ef7A8R~T%^rvkZ{Pr-#AIP3~;xKuEvd@ z+UN50?m1>Y#pKn~EQ%KKyY<6UT7ZKEx@)5pF8bN`b{TiQIo?#a!2w-fLq&x($Hd#& zy)_o;KREr_PwzCBxItd!A z!c`NZwwexx@<%o!KKLU#K`~L)3 zM$<6Aw_USf`L!H=feEv;ZEI=#0+|}SW_wp~x(s{u&psK#Vx!P>b3qk+Wn9^bNsGj{ z07nk=p4^EK)#6;fa%2@8Ln|+d3;(Fj1Z3teSH^ce93_Qq&lp$7UtGjOj)m=>{i;@i z&6u{TfHHbIEJ%lFf%LGh_7PGu)IFnh{LB3th0QuQXn@Rc#$#>(rZ9?UfG|}e2pV$~D}`q!f%(@`K|_(b9O^agq519=^J5Y_Jy9P1EF?GQX^5IhgyEej$EJ=OhJ z+5lY(&$CH>88eEi&xDIfemG+Qed8y~dx43K(&d+C0nrG2O4Ld3 znvedfUEfb3%!aR8S`R+x600i4UxVHC-=7%{D zw|l9W2f3-!RhMx5{JfUg{oEkWckQdJ3RILpEQ{%cXm9D67dX~8J3qkk8K2M z>}sX*dg0xQ)e91_@&k6zncAdM+48duv2s<@z)v830=irun9BX%NNg&UnqdohuIuDV z;oRG5se^r4qS}N~5i=Qv3q{KSmZ!fA@$w{n`{Q^rOWvRa8qM+q$}6V(LRNL4fOllM zZbJPVj)AgJ4^9svd;kbrj>sci$g?Ghu0=7IE=0w*0w{=gp~b=K)fIv22hYq`$#!`p z-fmVYcg*KjBZoee>aT}s-P~mM@S2A(hrN2Fq%&$58Mse<$<3^ z>E49olm)m47j0U`Ysbzs7D~uC0ltHgC6ih>sw??rC#4qYO=e;LOt!KIOJ@X%%wrxB z9^$mkiBp|zKJ5EU+u~%}KSmu7lrR`6q z^8AgEBvx%l~*{TUpz%-z73k1>X%R|Eo~0Ys0JK1U#-y#Jx)Sk zCz=o1^Cq{0X7)W1r=pnSq62n&TtdgPx1G#eviNk71Wx2beo@;~?;?4CVowNcyE~W) z6h8VbP<8riUIz3kc0&jzpCOrSn_pm|8H_LQA<(||1*1Be`#WR ztn&g0yKIvc!$@U`9knm~R9a1~QK&=fe1hnTde`MBM^_JSK!ruD-~bfd`eSSLXKbNC zGhTF2*|LV(&jR~=o;qj}+EIvHN7L+^XX%{pImbm^BzPV?MTAU2}rOf=eNCVocq;XEdMpjJwk|ny#^-7kvyZ9 z)8}%BBWpZA%yIyrTCP?KsFsu71*+xnvOd&ulw<#kTJ8Yp)lv^F3Gcl(aYJ;2t%bAX z=kXq?=WV8fS1i!W0O@^)O4<2eL|fCy{~+3iPXGKj(H6W!^WQ|MI5=?FYgp zQZh|`_7`Cz&1a*XJtp#Q3waIyEK_>Z|0n;Z|1ZM!b^b5H7N`6dVS7FQ-x0PRlR45} z_E18wG_XBdZ1^GGT3=<=2Tv{0)KA}mYJx`Q05<}}G=7AN7o?d(dn&MN2tG?6h1gX9 zDZky+z~k-oE42^Xx*ygmd)7s!VDigBVTY+}YO-tM!P;^Qsxks6v%Gh!#zr%orkC*N z-=nx|W08&JCexIki<`-PQa$n8kMr%}N`I5!0eHVzsd`6S|( zf|taOCPy6*5pR;JhzCxsnJFmY65$Tn;ou#si}F6JzQDwCWqY07$G|94QT*-;vG~;0 zsC)P>{H4^s6aB8ZZ0!&(?G$G3sDf&7Jo*InA_jk8HICN$HrT|={By>Q^}g>WAcb+N zGtUg)ZxBeHIdiw#bDcS&XgKXjQyM;D@+7}-#dNr_s&ErrF9eW9?mitzk=;uY#*AMC zaON^2UT(sKx!+@~JoK3n<1y25}Zi-@#@gG zQvwljxc5*sEp?ucEAekGwy#hD@VXTmEixi3!`G0)eLIH#R&J2s|Eb*QAh1mQ)`XSf zbw*M4nTOYZ4xYTkyk^j`IXRO$yN~0F-G9Bb&=U^ zsWcATboNM@Im-!YBlpGgz@yAC?cmfwn*SsAl1-<$rJ1vaiZ-VU$7Z2P zJvV*G1mFOdTKsF7moQHzY0+e+k^iFSSAwCQGgRjGo8Ya|%(?*YDjVHRAHo~o7n}Lz zEbptAMk>1_?u8LV1(;!ki%9-W1tp&e!uJ+<1$|zNhpO99ZWw7u=~!>0IfIrYS(|;@ zhJJ*YUdu#i1_^Ce80L-I0Qgxmc-@#fgUTY!?|^MM+)Y0cA{&0)o)S&&*NA=s^N?rJF^#sJXan&8*yVH2@yhKUDBeLx+Ty{P>dwBS#Eus>)%xP(Dt zhA-d_$q|l;saL?2e!cY$qF?e3O{6|J3!sMaXmlRxCVp96wk6b_viZjH~Q?kjq zz_-<^xdl-^Qa8HnOcHsOXRX*c{DpM;b+fRcLzCp7gzbZ8|4g87(|S`Q{eb+N;&rd{ z|MLvmPUgR6(AT{d|Iah%_3a3gX;;knlwRP?=Qw3cc!xJ+Jt7S;;M+JH9;`G4ldgm+ zf6r~`H>w;`Jdz3kezuT?zNpI(`mPBtqXN=u!1%x{meeZ3@dbEZovMTZFi8N_>gURH^cK%2R&-E)XHWV+0Oc5?YxbI`DCpd&t!{o8hoH}VLb=dKxu+of zkeNAj6^GP!e8oAXb2mv|IVw}CC!R9=isgsY^Sx3YeX~LCVw~>b;NwypiVZRG_mBwc1NzHjSfD~lun4I9P7Hxw;baq;j_aqI2JEteC3NX3Z z=E!mMN$?4{2dPR6?^p+5!u{bc2^u-NvykXmehJd zFRF(|Ap@dfMe`hbfYhp)+Uoyi#f<+?te7Q*)T2dpxM-izUOfZA6T@$NRNx-;9Egf_ zT?0`uj{j>^%y|Kbib;F?-=boLD<7yB=Koh#>>Y5wVJhu}$BpTS$uE=^Gk!~GS*kUz zV%9Zc_7Uu6`8U{|3=DQd6ZO!(B9*kYWoDjLcONRCfPlJ(eWmz;CZsk1DPM=!m!H25 z9weB%5Wyv09HlT~UK>#(u}5Eyjtsf4)k(A4Nj{dE+?iA04dr4b?g;>rQOQsAwg zx%+JI`Jzv>57uP6XNn6OVxMdAN$Ho7)bDok43tjx0?WLy!tkA|+g9v@vzP7mwH}d> zg){Aa1(1%g6O!4Ijd<1GUr?Kai*E$nxSCk&aDQYv<@zhG`{JTDe{f#Y0jxM{^Wo}& z#uj};5@-%R?EF;U_E@tun8yB^!-w(3hHVTy5u{v5RC=8`@Dia@&&sXQSRJo+xi}{8 z082s?JytXiyQyF2m{Quc{9sbBP(ns;I3NS%-5Nw*NB(H8>)*&nmyLewa_iv5Gnm5% zvmV$m+stIq<4tCwF_j_90@h+$>x87%_F+X>(aS+T^-x#eWo?g?F)kfQ_Ms(yEt~lc zl~+JUQD%_fw1$|FV=1mijpfHF7$ zQG~(*eb`p7LGEh0@aWp4T*86dfl>BqdJm{G?@it0d4D$_pqY5DkKqae%FU9JsaBQ; zE$Dbs<>t3K27HFxji281GhY%|wK26B(z^pL%nEd8+q?sm9L@3Kp@JO4qoziG!pjdV zyR5R{RhFDcr=5h$Ne}&%h=$Fg068&CE0E%MeMEBr33{$O-VA2=6_aVpQR#A-Zk)} zB@9S%{}y1l$1?y+Hh)C=N#C>-p199Ie}Zz1q))SbDS@JTX&_1MicFYJ8bxy4=mTX_ za})g~k_oDAj2&75L7ClMgr3v@mf*omy^kBDYaDN$4a--+6OV`Lwg>J@ zB-~Um%We1_VANdn9aSriG9C&kg655x z{UQhOZAR#LeEqR0xlN>M&gA~nD|q(Gc1prn=v9fYZ5`ft-6XrkEJ?^|`2>_HIxwUp z`5`E!Xh4w7s4;};fT#(@si@5v&}Tp#RThFF5~xrurz9taA@cEeXu=zc8EWcxOxuh1 zT7`akQ?G1+W7B97&5GeE`AL^UI8bP@4*D&rP}mP@qerdtK%2d0mAnh7WaiP(*qPg8 zs3VZ1H{5~od;mKNR3*{a1}~fPL4NiNe64NSU(h56i3{@~5Phut-9 z^IJ)EVVAoj9D_T5Zy#d>Fao}{G$Nzctmcz#d$2e^=-ut#vA{&Et~<>J7e5M&O_L`T zT8~}maM(9KRE)gzSBt~hg`EABotzFPxaAO)l9FE5X^}`j%4jqd4 zXCz!5f2*(L8+pmPVNf-XP5)j$&=pr6A^kW4YPoa_TD}B}ldR|z80bgiy~&;in8nZV z9m3atbi=f|Spr#o{UY@StOJLfe-p`%mMVvF6&nhim2_D{2?;h1v?9YJ&P#A03s>lk z&zAwfO2R~Hvd)u%lZ+WmroItK(}N7Ani?x38@Wyqop`4UPt>pr7^{_BV%_$By-fYG zaS)_Oqf_i__D>s_pOvl9_sS!tj(gzZ3ne~Bm(ix9#ZM1-C5f7wSFdbFJW9}{$#edO zZ;;I8G;o2+5%Sbk5e>>H5o0bYo=8fhfd7sI(*xtcHa25Zf8)UB=}G_URS$x#-^TDT>n^qSx7>c=%_TMPzg3a_x7Zb_wAM=L{*Z%8g{Nbm;WfBwio{mkws$u4>{ zR?Z*gh2@0L-tZ!bMbDRen)!Vjx)d1yjj{$Wy3uEEss9`QmAZT?tn@R8uBi~o_#6L? z76W|ARo~dmyboXlU+tcQxU>>It^b%lw6daG4R{Q8LhVi&#GlEd)eiKZ54+T}*JFNu zFD{&~Pt~Xlz7G`QPyrF@WNdCNkP<#jLltV;;P>}Iall}RhOqXxoP9ov1cG;+ahCfb zwgk#68y3t_mcAY<$mqCr0BWC<~fw@x%c&H zrvK?W>gihTDG=`|aPM)a^0C6@v5oI>2jVeh{9z~Q;XwCch^$qRul-Hg@?7=iL{Qz!+Pg**6JUx}%=&s(?961rFGyGo0F6~`a!6mR{c zLfyTs9)hzj?oBT4=`QYX&r3SaR{+811#;(spU->O&aR8jMs3bg*v=|mPfPkwSE5d@ z)lLWTPDA%jRw_>tTuuu3P6{AS@FXO z-SGgiI|wlWxt)3;4Ip-BI%d*VXyLY;MP+e_GgvPoIKc$}(pT7zNmhkGcNEnHHqJI? zEKZa?9stofZ2WtM(gi7XUk?L^oc701<1+O`9`O&lC?jK4_Q|-jm7rF#=>h+e9dw_BhzZ0 zZ1H8LxY>~sNx8U4@%$Ws1>hiO(eCrIe+$6-V46l0oEGm=zyPpK{5miId^U&`&_Ect z{x<-;8tqO7JQl~fM{Pzk123m`9T)&U8>B04um>F30Smxx#u;#{(VS}ET9qaOT{z9E zlUl!ZBP#lKkv7JxMo$@H#BP3K9CTS<+x3yZ)c7e*zT5+r7{B?d_(BIYAMjbY%c z)KE1lDQkz2h*}mjWQf5Ignz0)Ax|NcDdSDjb)YJqQId%u_O>O~QzkZLCw9dqc6}rA z+y)SN4iMRv6UjyssX7wbs^RJ`~NL{lGkB);Ly9I-H){pZ>fTufDS_`#ap~66@Oq*7tL)(X+JEQ%$&2O`4M< z*<&iJBbdlTsqY6;qx)w}QCh}9JLbZs20;LeBQzni@jO}(SlK_}*6-nwZ)g4;R?(^8 z2@9YzpFvdA-{VtWndhG4F`f)7UVfSSrg;gpn?>xie#}Q|-6W)Pz7Old8Wd-Vlw$9Sv=R)zE{&0@Mkb!i`W+t-e95=2�*}C-NE7UcP+&5&OLNEjO z@^XQDc_eBy{8IN0cEV@B*Z71io|vv@W@3aUwW+-O)P^zPf@Uei_UA|o#HaLvwc#*b zrR#FH$gYpk&p4<;Ua0|f*8Aa7bphLK85gikoJnF=c-xMa zx0_2vtMcSGwcowwitKuAPdzefG*+r57{z?mIQzn;RI%lPmh^m1w*y z!xaf%l@+dOPo(_xKt~wM@tz>bNoTFa3BHhB`=7)?CxtZ31*rir1Lev=JjISB9VaBE ze*lY9LqVgw87Dj?pIzjt_bh0)%f7FdF|1g8Ur19bnO4bVE@mqHK~mWE*;pGTs}Zt*;Kr)h~%qmJWT;tv*B~B<~FJ|*W=6dC{pRV!$}k}^ZnEDU=jOw zsolnS8z@lo-L(UNSj1u{W|g3l?@n7uh<4lzuP81s{W~%34^02sMV%s@K{9=$e;pZD z%Khc%j^6tRd_qeW;V-~!M36y))g+eLgGZ_1cewma^tC{wZ$zEPs+riJ`MS>F#LUy8 z18zy<>FR|n4r?tvNX>Qh1v~6ISAXrgxv#DHXcs!BGXh>9Lpr+2W5vjdN=&ywPQOqn z_|-z08bKb*vq)?cd3d|VJr?Z%%fBy65CpEd<0QJf15KXjnC>yjc9LaZ zW1FQ2l$f9CPIP9qy>~@HGY?~JN!YllHBw~NpykqSU2`gI2F*Q=4VZa}4<^lO|CK$>q_&R<&B&{AfICDAl+K>~1Q7Pq_2k0FtaHnX zg4EPh5Fb^`-t`nFKZa1#{K=DZizTjwgI;iGqS_p*)+oMB=EWgl`-UQqUp7Wbv@(Qu zLuMc@2#Reqfv&XE2;#X@(5AW!ZGzC@mdOnSIcla-CmdK%fbv1~4Uu>GCppjSotJvc zAwcXO{Z{(oGWdZ$!NAiKopde8Z1hZFWf?;zY}m@%pjP9C*J?X@HM&98z3^#^w()3d zIOv-UxLayQWdW6i`8Js%38=5L`fHMJjL)7~BVWu|NueKhE}QP;&@0rOJp5jdbd4LG z7`gnHJN*h1Vm(bK@dU=20Ie~VS&UJ>=>RURug7|x*`H?ZQrZorz%XC({J65`hdy;Q zdg@>_+1*|sZ$Xm~Nyyw?Ct+mIm4uS~C=wAN>QGa#{4u;GT&A+}VH7kBq`|mR)8sY= zEk1ViieG4eU!{Yj;J?=@8mYDD&kq0WZjBO;rtC%H#pS0cHY#x+(bCNf;46Rc2K2y_ z!CQP71%J)C`7WS~)4z98J)q{qIngL9t>(z{9ezK>vyL_fgc7q@P8AYtkyI;Nz zDkk6yhqSWpQ1T9gT4p68X;3f=u)8n1A(37NRz)M|M9DE*Mdp()3E$XoN#M?xx>n%s z|Cp7_RfJG>G(Y93l^=_+yIfV=ik-f2qi?eU-GkPn`UcOTRSU*p69^-0CoGDkUh*Qd=^jpQDWN2W?(D7Z2-L0fCq ztdF{i&jDJ(b=Lfee=Rb+C@lS~szs4N+oQ1-9L;pWiwNPFMMUNw zej8{tx0k$W^8Md!U3}X0@WLcLlXtU`{@Xl=NpSfO_csCL{+j=Ce|jI>-wO7;Mfyi4 z*tu!-qZ8}}>;(S;c7iW_l^+EFwQlW@+FZ*eZQb0+Buv;4M)0pv@b^;izqv@tNSWhE zsXh8|Y7G%*n4rv-f|wJ)n8t-MM}^>Z973q`MDWF~&;!uE;?Z5PgMJ!<6vsn_aa8-= z=Lm`n4auDbj++pKJp+!F5QKpQug1m1wSD9tTmvV<#r1pZw?Pm%7{W{t0PYhQY(o!t zi9e`uoIgENHwJWvHy=*!c3ix*d4+Q*Nw=RjUV(jWBhu?TX?89W ziq1mK+}S#K6Va3VUSUpE0JPQ~$F&1GI~SB@?hs1ez)~*2DqiPoRtFkhd*kGq8?;^K zY}2x`&Usdq^Kc4};TV36`s4x+v~`tg<3halDIdLi+5)$9Bz|GYv(oZzg59BNz^3F26FBuJ{z4x&Fk*^RuH9Rjnn!h&pST5mXS%a4Xkf)fUo0$Y#j?W zAoyh{1*LAXL~S0m!*va=h5j7J@b8#G5_5+D@b`xvI0=*R7=Y>^5=QL)-ORrC{o=5D`DzC*dO2@?k^%5 z82ioVF*HU~X(3`8eD<;U;Qm5^+@DytNfhF=4UqeLC;-phQFBRysAOQ}V6WN0?{&Z} z2#Af=+inW1g_biKnA?Hk&q`WNdAmRRlECSOYHhLK!Q28cmDhV4rr>Po+PEB0f^wx{ zk4OPxf11*ZSa3d)0A`CXN3*Ut8GTpgTUj``Tl>#C0IBBQNQFX1Qd9LPha_QC=t!bcn`-9=hL_7=8f8$ zK~{Q%NE8X-;Xs0ZW~7WbC`$;@VC#y-LYTX(;V;mncx3so09~@cIaJ-#hbp(51us{f z?3QzZ)d+?aXit+;ZiCWiozwO2^BZ$chn9n1w0CgmZ-Ozn1tMRwOzkE}7|kMPS)px6Y<4*w4EHm z(G%zetZM6k5_@qSOij}1`4NX`Ht$Ugcdz5Lr_!N{Z zOD?$s0I=|><#1pv_rS<5D)iB?Q<=Mle$qNJ_kLwZL;dQ3(2vYi3k!VA76v1!j|rH8 zApTry5#mogZ56oj&HJw>?*JbqsIi-B_Z=x@>E6Ap4bxv~>>WuG``%q?yt*sQ(d-TO zEBh0D=1r~m{RB{v=irM`2y2YAm~G2>69NK|+X}N9ce@48kFQoQ_X9Qj!Cs{^MUo8$ zRuHM*vW4orxdx&6vS9n;hy6Ov>a!0m3xt1<Og(rqnIfo9b1`o3aN}>6`rhK7F zP38u^AlXckFkYitA_aZFUa*>%)4uLemu`DZB1V1w3C8D zI17$4DAhL!f@g6fvbDUh{jm(oqzPS#5Al+gHSA%rd0Y7Tg9PjhRRctPpn!<~K>^v? z4AV(ffhb^{QHJw&tR4`&AaJ z5_X0lY)nV6_p`a zp!e54VGtHzZg!-#+uzzzF%I64ujuJF69=M;;0voUGRF@7gFBB?8a$Yl_0~qlI*mt( zD3|m(kxdPPQ*^U!=lPn){zNmtC+0|TMiX`Iu@jN)g9Ic;8(bs2RKMX^YNPMpNTVk5 z-Bb6Z&-{}56P@tMe7QmEr2#uqlbKgGdep6 zU@)POx>yK}jUG@4ls`x9pB%JIAXW8l*fur>{kmnp&M!x2&;^4_J7?QF9MeHJ`=d9T z!3M!F7lD-VmucT1{Phuv(+ZCZ7UqW(@8j2u-KF;kdz7Z^UM&uFrb38K@6uo-CPT0c zT5DtL@K>*>4X79&(mThf_cGXLfFEJbvp6EkYeaSQdPAe{+T{($)0A5#9@)PjV1-Q> z@mj|ubAYqd21e~<_GC!AghY`m>0>~)@BpA8ZwKAxCt@|g9sW&cx)9#^{mY&Xd zE&NXuu(&>#^Y?M#Wv(4MV*Av7RqI=LNHEq8@|iQR_^c|VK<_3Fk8QJGFM9M0oC#$ zO82(M_wLJT+snD^S+?aPFQAEJYw4c+Lc* z1Np+ey;e~qbfdtzeorHAp8eng(t%}NBywIV{-&zj-^VhmDrHIB+JLsZ6b0Vl-VnjY zFp8_&vhU6NYjyMbWmx3f#%em)qwSa3w~4Mb3-rys{N0rL&k3pB1OS&|>v4sq4Hadd z30$EmuA-a5UFj7Sgh^V-uA99_-+pVa7ekIQ(lB?|q4zk3FB31`$6|kq%3IrUFTLZ-b#@Y1ofU~q z2H3Zt_)VY=|NbXC8$RrLr@kJV8@G1V*Tmy*?sXWmnJ9H3>DtnM@O5TBz}|^6c8$rf zse+-RI||N1QH{NA^ykmflcsV5>In^39;Dn0mM(Fta$uYmFkQY!_-~x{m5M;%kw)}B zkx}8BdsRm2f8w+UPJkuOYJ-Fe)NQCfM$o7a4_@?#2e14;9=zGUpDSsae6bkg1WbQPTg>;L-h;22cFIGt38&BDkXq7um_IvxGPAjY;P)OWYK5VzyUI9Mbva;TCPe&Y{Wp0*+B(Jwh~ z-0ThzgAsK!6wL}}uxlxSYor$1{KW2Ef0R`=S6aLWvV8Js3w9EYgNaR0M&Yn0o4 z0|P-bZ9OG6)p5%AK-a-8&tZbp{^g1HuGjabs*F*5|DL;hQkqDTP?6i*E?A;vcJbQ- z@zctY$SB=uyoJJ2%7d>?=g;RrALIKnnDB7`CbV^e2FH=UNidik^vf2U1rR($tY$|rc@1Oi zcLFu>j0s*6Z6aI4ZWAV5VGc-+Dc+o1VU8yyaHt0ksf&NGfgn0vh$@+OeDeMtHQO9u z&DQzGSB~g%HrL#lW$JIu)~m7*w}Uede~t46Od$YRv-NVtTnurM zCELE2U>K6JMwsWYvKNpTzkm=J#c8wE->?i;T1baQOS7=n);qX32m`~5{H2!q|KRN{ zgW_7(g=Vxh@%LAuZv$Pj^`= z^}Zg~Npb}LKm+v&ijdjkj9utwcD`-_oT1wX82I}|z#Ju-fnhT?wnXe{o_6`2Nh)Ql ztVM&Qi+&%c*pBJR-Tasha81Un@g7&?CC#AhiEPQvgty!v4C}N!M^3FNRi;5{>7}_f zfwTZtXbYnrQWi>ccXyU(oH3X%BNYagkyt{HZ3S&e3t`tYN#@(&xQjN8QS3DMO}Jzc zsOFPM@e59#EK{%B#$Op!^Qq;M6pKYdESz#usA|uq0BP_NgJr$|n3E$O!7@6m@>K5j zpc~AFT$Qm12lYHZ908A#!|5>;T8HZzPD z@vgDQ=^cmvqVnkzd%}g!zX=oK?LLqCsB?&jCLkIx zfx7ul?4H5)x{%2haKxtLMo4(-KuEB|);lWkpIvB-hzsXUbCR73$68?QdCp92v9XXPw>i?oIKToNFG7xGv?wI#BTyz&gm3_053Lo+9 zyYFt5#ci}N{2Tw57xR&%--(JAb~E}U$1edZt}b6T_{Uw*#-}(kFUTfUcMQrjZ|x1n%f)=;bOHeD^S9tWd5J}jhWP7D z1hZ2mg!u*Hk)~BOKcgPB-=9J2Zc*!d0^elayB_vyygMGb-B+F*Z+fGxZ5Ei1*Dq2% zuUGB{J04E$P@}}lE%)c`Y>-;Y!Ld1lkaFpkGnScO;4!r@)pZ3r#ICe7?#t+(ewETc zVI}yY6dC=@vI8xC6-ng-8bDMh^9ab)x}3VnW-zs{8*|{*)J9qp-j|HIuMch5x7IC5xM75 zK!*Wm`WZ(a`mW#{?A#G{qbf(%qWfGAUBpH4_wtL(!HIql&6Po}lx z(L5a&*wtjwo^MV{3N@OI)kf8;-R9smirv(XG_oz`q}7v+)iz6m3q;k2jRRV`$abbX zg4avmR9Ob@Uc>GpUtTgK_sN4PVd1c6zeoHUf|Xk;30&{^=L) z#+zF7@4&X9)*F41T$FXLEFBUpknC>ZkL*s(I`X)4_te98)@iZfZ`qx+kZ>4j_xU$7 zk^A}J0$-*mve3bq{m)63Z~nOMOq@U=T3+xAA`6NSsb3`J;Y2~MJN-M49V-JvC;BJ) z2NA^5tGA+Cz~K5&ZP8j+kn++IaK`v0Fy!r`lSzQy?WsVDJ^3tpXU4`?2;5aa(V@*+ zk{lEI$}UW^sRS&Y2YXrDL^$-%%q*vnIhLOxCQk8Mo*|@#8zjLF2f?Ju^dYmjP8Z?D zPzddEDzvM`xU~^8=uN}Or+2MQSGkb}g=kekAzErK37?ETKO=WobirM6 z3db!-x7!;SGdF2460&><0E{^S6->Ff&S3f;^QLXS@H5ry)2yfYsX|xe4A>h6J4QvJ z50-uq&}p1B2Ba?(MB8)U4}Q80mktxY^BCp5)Cy!1p2@aMGLx5!hqFVPh>c2qOpp{9 zGCGuW?1V`~rLWyBt!#gzLJZA>ror2?qGjT}b?er_7|-aZ$&DM8mo#jc8^G zV2gL|cxkY8TfQ20=%XPQt=Ih{KC3x{no9i;GB~oC{TiRG;>w7B_20?v4j1=l#x~ex zB%Rw$)*ncRD~O2ivTJ$vnS#J1$0Ndd`&xFr#i8 zj@V5xSLc39+}$zJ#8o%F8i^+iKt%(X$W%{QLnf;W_af!_^V>Ep6-d}a`iza*NvK|3 zdLKb9J*roi9x}+KmzTsKk8Wy`RqfGe@Ro6*1BASxN6x@GT?T8G#}2;jOW~F*(Po6^ z=g+||IfhC5iDx1{|v zV@V>D`cVTDd}zVHW(9IWmR!6;RD+Y}@s*~hF@HmGX{0>z9=dseY=UMNxAiF}Ui&ss z6fGW>LPXpg#{f4;IwBxc5|-}d4f%H7SC&Zn;QGSY3dON$)pF@WBY?e3du)zG3A?1R;$@RZ{Rr~+V#Bo{-2LILp2wO`dL(2 zuiJrq*nJL{%2v=3LF;b&a$Z$SYl8r?8C0@WBxKiiK+jF_iGD5Fexi+4h$y2ZD@v%> zl;98$q6oovM-T(lX!j3MCr`~`$zz_VP25($%EIfRGKOMC0C^CKI?Tq@&@zdw{ z%#cGg7DvU7V@RLaQryy^KO&;59* zmz{+Myd?qAml1PhvJYyE8f;yQ=Z1?+BdA~=^a^O_O?+}~DCcHD7SMz>!NA{2z2C-t zC7?*HNlgaGmnnmT9vAWKNr^nw0G^yr-G}5nHo+o2til}Vk*JE&T20sO znG(vcMBhmrWz#Rl4&tRub-3|KE~OdWmBt~b>Q|q0)# z z3u;)@4N+wKZ2$ojN=X#C&}=_P{JEhJ24O%12sN~kOGXXgHu3AajW15%DEc6@n8Q{l z53o&2z#V?|;Jd-?Qh!3Ie14H+qCOX3DdXYOGtX$5{RlQ|jqQ`;9&@LG7P%F;t~mx9 zir<-=LV5$b5s=_VY>vcVekKmb&Y1W)Hh1Aa6GZ|#ivYj!uEbx}TL0$0MxJ-~q@*rb zHK3tJDz_2Zz*HrXQ#wI+elGV*D8<*>0I=|Lt!OSVatl_`_>oY)m z8gOm^Oi}>O&Q8wiPLAA8js)N%GT?aS{b}A?uEqOPhPSMrx9n$cOBrujCT|aPZnU9Vl#b7=w8vx3M{#kp#4+hF(RDY& z4+l}QVt^C$W2Fo~U^o8I8#h*Hn%tO|*tnmdAWM^(B)y&?@&X!I-R51wEp45eZ_Qlw zQd0#rng$3`V72kXc#2%Pdd$0ew77a?xT^TMT7Py`l5rJgauo<^WdS@|`K(*n^jj&F zTIobvX*pUssayH*T3HcVNuOId&s!)qTWDrlX!?2Lw9}Tv)R>J^Uxg?bsHu|T2TCAQ`ZniSm*YIuBk&KdSzhQC6+b)Zo1yVp=JLll;; z6B`Wre+>1S#g~CXy-q#Jdt(cjSCQ`c{jHU-pe6ug(AiH<_5R*x&M|%JQ*=^zdhv%Ucs~Zz1ndOaC;G1p>nwl0u5vF5y${Qxr9+8`5uRX>u1=YWJ;=3I!-hP&} zbCBSA+F2E%q}~tmSy65@I9q#fwm0*ps!!Es@+r9i^jnjyTtbsCMY2Me3qq~1f_eqQ z4TR@Xpi3FjbKFkCPf%N?1}m4?`Ad;nGUgkTr*2WP)`RR=4TQG9UqATJ<@+j+W8+vG zXl%BXM(+F!UoVN=!PLGR1hs6q;r#B^lP7csjA$E76t~(GfqnbkVD2k*ge$ zWebsSY$64ZfbepUFdUYDUA`YXho4x#Z-APw)2`2~vyasqA9T9knldkWvyZIU4@w$$ z()7olD)&Dz?Bo{x$faG&EnXt0pYPQ;L`&Fbo!w={-eFbUVom%}J-c3wxi+P-q7=V` zHop*qJs+bw`wuVRgdfNYI5kQA>IKAsLsy3Z&=cRFFF-DXyU*cQ;!-eTc@uNTeq( z_`zp%!;abE;Mq?}lcpTa6O(ya`92?r(Tjr2fWz4GwXg9s~-ZW#&xKnf94LGAvFbV-s z*jTJcwI%vwbJY(N1aJoh0StHY^9g;^>J@K;ildn^p$p}LM@l8d!ZKQ6>oJ**VvPm6 zrFUlN7p)cHA5@GNM$lr6A$!f)*DwGpTbht9?jFjV*aN7#E2129jqo^Wy|;u^zNZJO zj=5=A#XkZkGAvr0uKm@jRpTo^lxw@|bdUJcsS&Bj&!CB5ohU2YSLo zL&H;)!&C6XbGE{a=fpc!$<$2kZF+Brt9!`j?Jn+e6A0y7H)rvP15Z>IBiyakyN4{v zmk=Sw2b#x1&?~)|KLS~gt1fZ?LOscxdl2VS7;Z`~$Ut7cin~C#h+q&Nw6U_KSEmw@ zS~T?>a{P=aSBbOwW-)+>47ND0))F?s1-sAwX=t_2m$1w zBw2`=@8Y=O%!R~wLz}nTnrCD7;OSXY^TT(^Z8rT|1bBDfQnC;!DY;Rg2YkNrLz+(=O=~UzJ9^s4IBa%z${_T0E+iEzzBY|Y`rhzc)YdWU0xAbd~ik(EZ zF??A@H(Ile1@*TBgAkk(#49@H4$5UtiQ&D227XXKF|Z(kZyt{w_Z5pOCvXqQI}`aw zycbGR=$(1gS+qm3O%Nf#@7Q}%TJSixoMDK#rk?5eNRw&SVdIioFGJ0d7FC zr=049v?v)Nv%unF-zYvy4R^Q65BXWkV1p!s!lqN-RIzC+f~8g@FdiQxhp;$n-i9_bsa@a0F+6duJE1);hq?mg+Q z8~}o?FNHpNLuU>%X9gJ^4|9r9Qj(6nHG7 z5B>P$rF2HlN4l$;lhweV>Li3Vqn#1KQ(6`Ot#C7vk%9K~jEu6;3Ew_~^w8{UGS=i_ z@rcRG5KLyhtbVcl+~FSosK;e)+dAdC`s(^mExJ?eBo92%I+qcZR>)w_N6fc%t(za7 z(a03%0wTM_3fE4g_r+stTKDQPw16NZW{1EM`VGNHb51eL*V*CaWDmAD8j3cljD&Yjel)1X-YO=UNd$AU7}}l%I># z_qlK)=1a?tEN&NIcbR-+!pvutc`F8VHS$-p0jn7Pd6fi4M$c{3dWRdXEUCd7D+l*3 ztz5`aS9F8Cgn2E)oB7b%8=>b8TuglHUUo%MNPek<@pv|Gb_w5fwM2eiU95XoGR5{P z9Ne>Nd=(D<1PKSTLBhecUpW_E2B$6vb#^s!&c2RBfS3UrY#;W04E9M3_78h8MM)zP zN#%kgvV@?BL~L)|L+ z@pT)52pQgi1%{IX=3O2P3k3}0TkIk`1G}Cna5#Oe06V)M-J9LeFi^O8Fjy2&=w|*f zAHX38NC0qc10P1*E?h7J$H({FkJMau+Juj%@=p?jUir1&CH@_&wEBm^wyqrtj!lic zONBi1)Lb*vT$8Ekd;O7DBKvNEqHW`FdZ+g`4leJxno84`K_}r~_J2Zsb&iW`>1SO# z2+!E_v2o;S4WS*dG<8uzS4nweT; zEsv>IvwzulTJ-Verg|;L$W;;l2N7sLL`ua__WM*Rk67cG8lZP@0uNsy|~&w{MOWrGZGZ z(AIWq=oU~AdIm7Vdt%RqX6`h>?VNJO@{VXm@ay^$fHuDw5}|Rq zsQ?o*GN0EaYDJUFP=6@KAKxJ0+%rIxXD4hH{_|lHbt54X2^8cF_8G<{$XS9FTsRkp z5$G>IV1d)r{cL5S*UlTT$tea&Owih6{l*X_sV}s+AL$DhZ6o8a)1^uZ+Z(d^$r1NY zcE4Yf)G@EV!S;=?Y{Vl~3v@v)+XV>V@#+PWD zK%8_5eTk70+)WyPGGuIfsbE*h>J}c?ic-rKlsyIc2cBi*dW*i)k;aUBkq_=WC<=Q z5sW4&sABS_`E%{ly>j5^Q3H?tidO@MZXL?iki27;{LjYuR*lm3;@$C?@XESAj*okA zj1HdI58R`xDdKwH(F;wM0gc0ourK@5<4sAH)F;Csyf(4kDQVhNhx-1YCd>M}_*%q6 zg5IVcmJH^iZTQ1NzvlcdJ({E$xT8;g&GD1#ByHDUyB7RiPEi35hsj8StW4--h)KRywMTh4}DE+iy&U-Xi9ih#BZ zXZmy7Et)*{X-AucQG?6tC^7TsbPzj4{V4pDeLuD!WxRz-Vsf6VIe9+qNkVR<>rr^OvbLODhvF>utLd)*I^O8VY`YH`P6T(-Yo+~;tgJpkvCX8e| zInPSc1yHuXKVo!PTxoOe8-|^vVpz3pJ~BvP47{!2U9s6i08i>dnM*o7fDs|rEd`XH zA$p7~KQ?BF^Spr)!)dqcCg1C5hO4?QUorZ$(ZbR2^FiGh7R-MJl;yQVh-fNi1cQ~; z7U~LWm>gPOfkNAQesz`fs2j}=JMKm^w5gRapxEt%1{2n0wX!kXAKe)E`h{^ zFg=!5Z95aDST*{!S#C}&B$ypOLf!sG&?riQQu{%i-k4o5(TSj=Tp+O#KnvjLr{1Kg zOw7LHEqrvIIsEYZdf8Ckp=C`pS9cshC^6{FW)3WO2V5kAFgi1QkoIrXwh76fND zkVd6#@9b3WtIm*Rqaa|2D%hC3=)He28$g}|GDeDK3fg(@OCOQubQms(u=_CNzL|LmMXkiaJ_WTy2@EQxSdr+=y9m@>LX_* zlLx)P)kKYX?Jb~&mDUju!)P&8wD)-;ryaU=X3K}l^s6?h>GT#FgQBV{OtfnLTDDix z4Yf^*agllpqW~Q2Vcw6NfVHR!W+JTzx4nOKcaH?02p8Ol-!U$MYKPkD>uH{xRB~ZY z7^gbch#E#t78|!^Ryt`-_NrfBFXpG6ETYKt08Y-hlUFU_EJu7{gznIX=+$y0VuG-A zsMKZh;Pi+Y3dw?7v);i0h>os}7LO#&E^jnW^`e!47(#cgf=_|Gx{J6y0(cU7S))M_ zI6G6MJ9W+nEKHNR0!FXjt>>d~iZ`S%VsT@)X*}wKZ}l7pB{md^p;Ob8*ow3DKn|FZ zGvwG}R&C=xD`DI`3-J96!za1N&?RU!xBS(#v2T5qdCJKxc(0kh%JJ;h_;ZzZA$NMy$Rkf zZF2;jT?ORfMGTI3eo)9F*%+8r@vr=~ZMh7#$%|q9feyd(boLAzutMJdnuOYw&Huh$ zZbK&(KKo>)?W{nQ&>{+F29L=VWGdvod%57g>)`VsDuYmnh`w#Dvk$cul4y0fCydt| zKN!g5XkjIpuQ9xb2o~;EsBC(?A;DgbQQ$BbT6K>685v|BMnKo^+E3Hd^4Ip7>r{D^cvkX}IHw zA>Ac95CO12k=yz^z1yzH`kLNtV2gL%;60>1)&t75Z2~=f6xwbmnSJ>Wq8F0Vt=jW* z?o;0TWY|mXOAf}><>RJ-M)Lc^m%oA+Zf<+6zDXjVA4NWs>Q)zRhaRQ_^$nHeD{*_y57i3O5;y_7qI{QTHj3r)prAk zK=obHrxfz&&A;lqs4>?^r7cK;q|Mu3t)0OpZpH~asbf~7j_h2=I`c{)H+JNSnhkrb z)O1yS@vtT{iY%NGJUkNStW~;|Q_7E=-U_Ulc!$j@zczVuKuz9ne>Hg@l=wU^)Phbx zOT-yYJ3< zey1@Ye)VyY5_GA&a0-&sH09wA&sEL~HPu<09qKg|;Ef$DM(i!8Sdb?i*fM*bSWbAOQ2=8|c_U9xz5 zQ9$Wum>ZpvLlOKCVRvu*TH+11Sjy^(F+^q|JQ6NUTYK-T`9|z5o+W5N3wJzWpkhtS0plPjeE_ zwsQFIZGW*#HD*xhhKIR)SGQr+tm<{$zmQ*MvHW%2KeL6VHO8?X2S$T*Qt4hxW9SB^mfKWwm=!SGqkLNTkKmHbJZ5-6&agkRsTzLS3WLR-Z zw4!bHrOGem-YMF6ZV-JXJw>yhx`gYteQyFe@o@<>HxwwyzLTD<<)%Eivs7AD6rZ0$ z5+E5uK1=n&E9$yW5p3^3u=&e_=%NHWEIFEcyPU7EaeC-JfO{K zXS8hNJEKGuj)i4er)#(kjG96Pq<^Jf#4HIGjES~aht+9;BkBEa8KDQ8Y*3wq6FPz( zG%1Ds&09%&M@knNN!=yQKH$E6e9#`vnPvi5_zEE3c%HnehXMU9 zcGA*nWZuV^r^z+ISnL`l#|n8Xvk?K=)w^4d2=--wd=^yZm5qIdqK;9hG-wp2-BF0qN+SozhM|LI%vz`y*A>zG9Rp;= zDEZ;dcKO99D{!gf+PHW=K&(s^?@4geD|aJg^3ORP?tR57(dw)TFrVuzQehp|fbEuj zk(K`APLdIra)QRs^c^tGy2LZ{#2$W7!5QWrO;6jE_ukl*=R#n1o)bPgUKx-cAe3*( zzZnQU#@>9Hkkf5^Z)q#s<;nvo;Fo}F;n-;?Cj@q~x;OBkmIi-QER+d3prga0LMbkJ8cU`z4TXeV*Ar|)@VeIHD~@pVa*4agL~Y@xt+DL zqEp}|vR`fUUB}LIfguasn@X7`QcUh| z%ui?tf+9dbq&M#L*y*Fm8i9A*KN7oyeg8QU^89OLm+kD2IPw1ll9)gK-y@0Ae~?6IgTIkP z;GZyw|NkP1x&IMKTn1j5#BcwZN&MfCMAe}G9Z4L8{(~g;yZr-6l%e_ONFsoaR7yrH zy7zBPqTkBVe}g1G{yUO*+z3Jv55N6?fFuI{gh_lw67T;9BoX9L`|prM@Bb%AVyp)& zI`B`J#D67{2!#GuCh=d1Bm)10N&H`tM2M+BNMh(;NMiioNFv88l1TZAB&z*iBZmsw9H1^GP?zbpuWH#a=--6T?`?)T_|r`knWgV6 z?yhZvVdF8+WqWq1-g5!ft39}AaE#$x>0O|UQpRvrnCie7^0{MgCB9p;d`&PB7*4A)obGqI*s}@vMy@~x13g4J3n87_RPeOkqz?B{$zg( zc(@lz+}D^MoLTAzPzX{-Ns;!kFj-%-zs$&nh|ycbpSFR6{AOEF_t$54`o^vj+U2$T z3tBNt2;dHbN$>ZMWB^G6$}KB=Y=qEFi6dmA2J9uzGjbhzl$w_9kU0uIh#b-eAde9` ziA|GOHjsFwkZ608SQ?S2NRR|FC(M45Il{@m^p1VxI^;|4dyz4!q{u!;+cXq=K$}_@ zsZ&7R0v`PD@1phi$|{l1V?-aF63cmL=(Jof>oc4%q2T+au{wopZ>C41XpHI?X`@uWG!) zyo?;3>HBpN`MD@)k~GW=sadRopT+84L89ykjF?l60rCu)z-i8qoQnE05~jS|haLrF zsa|;$sebv%BF|V1%o~-ZUlrX?sb`ZXyk{3Zjjf8QgV2k6ogzoXNI^`V8kq3bVlv`I z|e;!ebAESF#Hr{F2pkw?PtxG4* zVbufHuSn73er+GNFX{UW$DW&9a9K|1mq4}}L$I`(5^A`Nm5jMuUWA{NPC?v=qYpmo zOUHW(q|SBtAMh?#!r$*cebV;E)>6CS=Nruv^Yh$2_$rq^v;*3MYW#lraej#C$__Fl z^z-7tHP}~TZJ~n#f3Mt$OVKtCFI}I^FJMrW^arBrq(g=<)%Q~8n~RnTO~Myhk6ZwR zn68fK0}(X)l<;B_Tm9C2Je+Wn3KguCLh?r~{}HGFMmo`B3P|htXz!*$(I{}M{?3c# zOJK+0<_xm8WOO^>s93iAjnLX>aGDexcK~aXM(-eEE%N10g3H>NjH$bYn{BnFY;xA*yJaqrKcL!^i8?hF@z;W%VXIU zXnzhR4{s5=fXYpS;A7@4V`=O6^kPN&fp@nYxBzsiy={sQBbAM0K`P^Td)5UrA>&MY zol$)Y4pdDH1lW~V^B5M$t~nSER`c@=e8=CX*3O(l6Y@jqe4#sN%yx&RLJu%oT{lH| zKtemn%xn4vZ*xNWibtvAp~mB&&SOntVn(Z@Pkuw4oJX$0LQ>Q~Q2YjGa13dN0I5k2 zp(zWVHwVT-{rmmr=Y_mq@An=WDefDMZyO748h5T5sW0D~oWIXMeZO;zLv@t+`5>`y zFL8edhhiJYcoU~^Lt}SsfpQhVFgSQys0AM&0uc;RypPJRH+j^BP<7ea04=u8Lwb-OltdnsF6s&cEPW6Nk< zGeK<=!E_@C+5pw&!`SM>lyFGbJH>osuN| znUX}lPDwt1rX-ht4@m~Um%npe`A*RDuwvrf3aS><*XEU0<}s8RmlYW^>dbXr+71z)seOJur4B*;Nznn&aVIBAOmstTLg0zHLuC|LpX6os6gwQA4r#=OjzW^zU)MEFY?I(0L=5eg1B!sQFJg5E&0&hN zn>kF&r-rKK=0A#qnclu{WRiZ_ZGRwJ|CC3SWtoqI!Soj`&iBlOWiumIDGUEM=9(fvc| zxf%0`S=m7m&2CZgW)bZ=P06yIa z#;d1KVSgT9Vh=;oNo0z9S$?#%^+YwieyWzMp`z}$@E+y@JP{jY6$O=8FHD;YUu($x z{TajOLN7XzouC@B@$c6faw|g!eKade2yv_|O9*v}2}=k)gWRDe6=B?mP~H`spxqYP z-3FO2i7y#K5N+E@M10h-m>z>yL8obh{Jn0TcrzDT$*wky6}Dd)oAWB$i&Hy_M=iM? z$ZNC0kpLY{IZ1@sPt$B*bnj`kz)a%e-+n(1D7z^z2G@KW|5k5c*Z^UucqwTkke;7< zTVy^zt{N74C$?-7@PG6B{Cp;{w#)@#OnRFlvy%0%OvCUDIelG^EUL3)2= zJ2wO38Mj_>#uyOJh@Jw%8M{C@qsp|Ing)uA0c*yDWVpnPiH(j5S5oJKQ05hSaVDU% zeCIMb=<*}6p+ci%YH_{}#}(=+?0G72XIy_(wQZ$CvBbC}w)c8lav#4m;oS)M_uB-q z1kdjq%ilMncby*?R$g}XOm{EhhK6}q&PV9ml3cE*aG^Qvsujj0*T2Y0Jj}m_lv_X{ zElg<~$-VTR^f)%q>!A|BtmZvI)0+SjlwZx)|hQlS4Ks`sy<<@NrUcL*dLhycN zoR=P_{{B~v&Nnxakr-)VYY)!D8;XKPJ_6@xBU(m<-t=Nk<>h`E8Jk0PU@KC5dP@Ey zeb&rI!st^Big#>chjMyJT%+W-yDdp~HTkykruO4n)#VYEM2R4?Q`iz0VYG)BIxaKU z-sDH}0NGMFLf;Vi)}=V)S_%`_F-z(i#DtI?cr}d<;AX}un5OR2Zwq>^J)eBGV(g3y zkV9NKzraHcRBHZ`^E15)2)#&lU7O@EVJ@W1_elDzeF@ds2EX>k@4t~L2En3&WQvsw z|4F8}M9>wQ^cT~38n_w$e~C1*`h$>0Knsa->$Rf%ADPB5jDIkVZ4mwcBh#o#mCme$mFGo8d_TaeP7?ByF%M^=eYqV zT4lr3(v^$-TYzX+Ez*@o$~mrA7O9~FYh%|=$F1#`k1=r+^!um>-BtJzUU(m8LOGOL zb5qq^liRDan(s?Cj!Rkd#}RH%B97Kat#`oIufHP7#;HdT)Ca*`#y?^h7ik!~Xc&tQ zf`xMWeq`tQkXlAZbFd8IA{wKB$-qCd!aUOWdsqSB`~@UL&OgRAppHH5ea07{cHiOz zJBnS5DS^Kqe6#cxQ}YvY0Z7p&jglgb9M8?bwb$j7lbvNPm#94ha!x8o*Lj zy+OtGhqm&C814qA1qW{+0c+g`QfdJ||IT@!c;jry)^Ytk?@4L;jdSFKvZ-e?WXH&% z-o9C-bHxJBtY!MaZsawOse845+a#^t2`sa#Hx6%`cG_w}*Pn7gT*`-TUdIcIP$0wwMpEknpHflT^}oZo_Q|(m9(%3U3 z5{lkY^{WezE5T3Pv=l?n;Q_x$x+w>}PFadD*` zbV=Zqw7HP9QkA#_5v{T8dl31f@@tbtY$^SaRnbU^hSAEaVhcAj_7S;x06G1XdzhoDyfUJe!Kea`Az5(tC?o^1z>Hl5CaM? zhtE$62YBplm+W@UNI-0cT7CsqWx37k&X~DX-`QJN7Bigv0}_O^HNUEJhU;NtwivxfMVowTr53mxblJ{ zNd{L*k%ip3XXv5YJa}5U=;n%b#k$g)$Gw9PPvv!K+7gEY(AfiUCgT z-89@lYOT-5)J$fUr9V;v$?VcG95+ZhkAKg#lzE;v)?QPxNj-vlS(jKat%s%00E=<# zoK5c}PmWH>bGGG|0b3KKIG=p#hZ#K9n6J65b~Rs6rwjXe>YId7N=_O~IyWB@c5L&% z*R1QGyLQ40hJ~+ifm1XD4k-TM4Ha&+{`vb3VPY(ffQ-6POo0CQa~-wiWMhuoo?6vL zrAs9T^uc}$-lE6+*lFqbuae=rU%3R{W*m`%kfw`^V1QfaPvF~+$kUFu$BD5xNobKR zt)SBM_)Y{RG>)CbIqj=)^2x;^Dvy~8tu6~@$eE&XP;%@0Q!T+r17nGMFfMEZVdmE% zThHKtcN7`sh7=Vn7wXui^vI=iVpB5ypUHJpxa%q6%PI8<5la%pdL6nerx!)7i?VrY z6bYovA_(ff0&r9kZ-_9VlCZB6@wW=24pd++hPQtvUGPb>XE5B$V_H(fm&b`uhd}I8 z*gH54C9#PhBEjZvcUGB^ak;@pVUdaYH%XC9C*WMJiW551cIr$cC0@3eq**BuYfV#P zU;6|S>aqS-pH0WQ*2^bUa2HhZ)uufar*py2_YxCM1QZ7#F&*#4o_J#rsE;Z_T0d{u zCIydD?&!g_EAue^F5Jy*d{O~125;Zue)!StqX!@L^%7mx4vI+_tba}3&en4Tx)z-M zEafsfNaB;5#mUV!6};O(*A5sxbYgoUUO30x+Yhubg6S;0I^$G&P)NT@>R@KeW6A`< z3%*!n2?J;ORhcmxymy1C@c|Ri%(^Xmb3D(Y?rRrPtMxE z)k&5wa9%fj_Bv)@4ivT_*`f7bST>N-7qIv1`xQK_?MqAUf1wD*)-Z(o?s7sQj2Pl# zC-$PkYu1T$MVoPelG5!(tz`59*T}GUdIs@;J@8e;>KCu-8iG)f3Gg)+@fR=6=Y@@4 zuG*J?JJ;r=w8!@~w(?b%LC3YYa=4B`NlPy8^kKW8yo&~)QUzgCh6liJMOu>b;b8;% zvD6rCd+k*=wZ9zc1 zZ|Dn@m`BC2t0Fve!g^fWxKb`Gpv$hO1L{e2>zR1#sqpH#ex}pSq;plLvqh!zS*P>K zrnA!~B77ns2Bt^~b)V|OGF>h+N0?qfq-K+rQPAaoCN&=raKbB1Za}1_q}d-*(?0dT zlA3fiRezD1#lC-$ns~_3<4D#|G(IRKwv;~WznLoOVJ$-yVAb`QMbBOJ?v4v)R$hSp z`rfpWNn&+8`29Z#=@095zZt``m>L_Gyx8qY<(bQ3{RO&#eW*cdk&rjYo8P z?EBJGo-MUofCAD)-oN(EUjxzvpn$XoE%{B&)_T?}cPzyD_VJp+f%9M_&Jb zh8n@sU+?}970tAQP!QDN$Tab-A!QFyeaCdiihv4q6xhMImy6SdS|K0s? z$Nz9R>x{7(`wRvTYp*reoWv5sezvUFwDG zS2FI`xes;#V>#UwnAN^wMkX5t*jr&;Uu9OOQ2|TjeVHk+jS)oNRE2j1$e06r!LJlZ zSe>I2^<@ohEn}(NDu0a5>fM1hA;|9@*E|5zh0 z0J(psjr{g+wUH>gatwb9NUQ$Z_!E#e8~oFco}!k-$7uLe=J(%QBh&Q%vPLrIGX9oE z0{?$lBj*PA6=+t@x)pzg0S@NBuIKwq4M5UJw+0zx^q;uB&0$E|%8R|I);fFNJGnHh z->A*oZEWiQjz^<`;?ad${2DW$c=Q^m9nJ3G%~T0vh_%B((pkc&Mv^jL+gu7{7x8H)&Q&}2y?cFb zvp4-YO`HDG;v-A!`OC57%YrAP&FG2PJBl7uKrcut&dF_p0absRceM=(>f+Pr!jqM) zQRF;M(=bMi2^$gp6$`JAuLr)OEK(axR(UzB|Cw|Y%h8wTI>lzq3a&H(10k@W+m#s( zPX{YH|094`puwj$$#!oWXhJ(+OoJKZ>E zobGxvq8{E>D>!n-K5&Bj{Xm;rH3DGVaYh%7ikG&dswi!CXH;d55{*Z@iiuyUfY4~8 zD|1OW*7fVm?6SRwzUsh$$HZUCNMiGF=f8}RKRK{fd0#0jUYmHlX6fsZogr{W> ziH=S`Q&$GbIi-_Ii^J%cb0C&5lq1UQZOW^ftR%H0tCiEgbr&>`*hFg_I?_Gpf?oah z$%*^jnjiT?gHYOrqF%PcVmGx*c6TBMyKmJ0s77uh=#z5YMH)cUN+~cyZx2etEmzn& z8}maxCX0OqgIUl%9tRcncn)-Rkf7(f;Nvr)r~pxn=}XQu#)G)*_7yXqrz(K3u1t+$ zsL*{d_o&!d%Qvj4;-aq3Y4*81LKCgm7Gt_55tL~j^UirI0$$$IX*I@!xb68s?t+ce z$!h}x1Iwg`s`qglm`&DgC++H%N6zf2Z}73Ya{k_CT!2Em14T=dRUe>Wd<{mSAc-O{ z*NPgPFauekq|OWWEq>1LyOvuk5|UCs8d$^2>%%oiLGK<*s2ugc#G#uzp7r;QM=J|) zyY{z+Q&d?Fw9-9p9llD^XXGC@bGQ+;78B35U|1KXL0KmY;QICxJb1_v#iod3X%D;h zc{OFzd$-Mmo7Tm%Wc~Mv3c4jzCA<~FjFRlge2o;G_r-2^-J*aTeyH0yM3GUCa~#Mb z`Rq`|OaQS&s=nAdv|bdwpK2rONlRB>3z4r3!POK$#N`0V(Ul&m)`Ie|_NiQXR|+p= zm%z?#y?$pID4}jgdv!zz9+@Y1c(RHT`@2O_+Rjw3htvm+51Y1pwLs$=!UH#sd58;W zQ7%6T;U5-BUu}*;cOy9{Y1rnMzgr|PK^DpK7kls-*uPmMD_aH05xD+tk#qqWsQy?a zH+aC105Wp{Ipg4P?*NcRk_h`Ri=?K@zgQ%tEI<~?JL3P+B3Wvwd_PkCkNpRbMRIHD zFN}wT}bAD4((qWNehAO*xW~&Iya2c;C8}hXHL5ye@oO2+eJOd z__UVdg?1AEXLkuuqY2>^WqEdUe8<1V)Ps$b(kf*DJ&ZUrO=NC_C zN%*oWl4PPCyu-W?dxrPM)@oAVY2?MC5;R7I=n36nLfBE-$B|kGbOq zK3+Y-hFyKSuJgEDUVe|s;-^h*VEf<-;U&XjZ4a+&U8WWT*!m3rTpNrRE-#^8eJ8JE zK=aEQVuwQLQcH9R+B@DJ+es~7$`-q;NIQogmCZv|$bj@Sx29gAg^sd1rwA*o?mVOW ztPP(Jq64G1M7Un~_bub`beKZEnwnuYQpCsu0dV3cX^=W0fKp3AAwGDWThu+@vf9W+ zV)S<4G;ARd2!0NKS!-If(%C*agb^Od#0ZbqrNA$Nnh%2gs$v%xB|=C=^l_W;ep_?$Vx*|9JJqCEPEp=t-$S_aq;iW z3D|r8Txl?_cEKaHs1JnyOvmCU^t_ zl$n%HuQQZRW1BRlc5&-2c9>&bQrb>YkB@bBF?K<**0eK~n@yq(zZ?|*5xb5A#jck? zv1<%eMxOdcJ1?vP2v53+0*Ds}+6hIYBX#Hd83kE}n}7MCtZ`U0n!dDBH2RXTl%~4( zdIDSmOutMgc0NsVq{dt*auq>3dW0{VUs|io-12|z-z+}I)xGqZX2yy4Ri#`(9SR*s z@~f8~`LdX^mzn?W1%Tf{;(UQ-eUWYOG%dJW-ST+5(FA7E^LP>*bh_@MyLQPW715V) zhUaQPN_Qu##qr(B(^^iz3=hwM-Sj@Wjt2-&Vv)?U5x$$h9YX^X{~A(EoWF50B}iDh zByX;$W<3~K$b$+QjMQR`9Z1)6? zQ`eDUFVtq5oUM`e=DsiE>B$=|Fc)W^6uoSg3+RjK=k09`vu4(Yk8AX`w`=t2$^#Mi z-b3oYa8=bTQp<)_a9vbkLU25p>^q3?w)*aqez-`U2QBBRw`t3-R#&|~#Z3A7NA8Ax zV0-te?eH>DbpxgB*n#-tFWr)^FKvmj^Cp5xYH)b2mNdRqbk4dkK^XxAy%>SH=A&2r z9FWYiH?2(OdhnJ0k=ZuG76p_R8NC1*sBkIFT-@6K9=2oMhq7+MaXz1+=c=-L5lx&> z*EI|z^KFB0o}Dhyswy@vQEM>|C{b#myD5>YJ)|g+t|~rP7MUh3F=7?c)GKn83EZhtW6Z<3WN-I^Q!=286OLmlKqXww-3_tT# zhu^)Z_~FZxH3@4&AjcT>1KscT$P%VT^sbnr|7QL2wpHLz+;Vwfm;)VQoo|xj`}f|c zpDt2tq#hO`(*lWNXuVqp4(~^dA-h}}{Q{<17i)*o!CX-&G4o|w$qW3mklG^3pLp## zDwvzFUgJGN0+l7ANUz!rZMFgR8EZXZH*2Rm?A9(3WXmR2A*Ls1;?V{)^AO$fGht6e z>rT?`b9K~7kOo{2p=M$jq3pRKuYMQ`zWQy_E%+q+d!M~q#8oe!T#{vS?`uOain(%d zxin`>=pNhIJ0@~-p}Dxjo$uCfzb z^vo3y-p@&H6*a~>%BC<+4q+satNw`IzRBVW;L;dvsw$^_%!Qe}FN)}##2_FSkaZCB z;e!gvyhMxPx&Z&^{s;-MwNQYeMk|1OCrZMB6)9;jn|UC7)j3jpk74d*-d1xcEc1<)fe%uTMpwrtOCe@kxNNx%Ogl>Gf*f?b-efNBV;A<%TN zU;1T;oY<)HI;U~nPbxTm@p5)?&GcsW@fWtds7S(i&2B<9E6OR5n_efyLO(k{eEzj= zhuj7@Pb~-^H$JcUut`ZBILtKdBSHtpQD?9rINsLc39Y&aKYYP%?IWm^D8bEKBy`=0 zQ)omQ9`gA^S3__fWw?*1N0;m14sDX4GySs<1-E)Vf$tkXPis>cS_hu@5-H2cVNReA zup=iU!`$^4kXOJ;U=&Jo4+hRcUV29dR)S5kp zK3|v#phOLOD?kw15~k&L0aifp|b#0tO-2%glm1|2YxrK^Y~Y( zU)%0*K@Dq;mfsEQg8yh()4c!Pur3^i0`%N4qtZYP>kJoA!}|LdHVQn%V3Y2wUcE0Y zn1@LIN|&I9br>V4VZB}s2diWQYFL{{Wi=}NFbf`y1vRX9&Or@pIvF(r**^{Iyvx5D z)*od5*02t%`O~nrVE@ywW?KByu-0t^HLN*pKn-gM0NIo*zWRUFus#PhtW!k(*03HW z1~shrK@DpeLQuonM_54`n>wVL71XfSWd5HttO2K`e`#2ky#Ld%wqXCS8rE^%e>JS{ z|GS2DSJqz*>zX&rh$Fdw8rE31poaAns9}xO^SfaU6q@{-hIQbq=O_J=rtz-`)LPD` zYIxOWh+HrqHXuwe7{QxSqlsS|tI7$wZL4Z2>|+mw;HpV!%k>(gw_D5+W9u^;1AaVR zxLOqd_;D8Dv*M}eREV6yz!f4dBQPLrXi!^;Iau&%4jpY~NaI}&9zaYIBNEX9on0Jv z~{u;~r(b^>Z3G~oG6w8wxeBFHj=BK!v`gE{dF>BiCro<-yImPyj;2Z4N z9MYsQccdcPo8;+(P~~$9G=2>)jYzrCc!*CHSLdRQg7KzGHJ|N|FHh~j!om{|<@ogI zJkr#x^}~bxu|K7K)&oGJS?sbZ-bajQ%?XIU*IAwGhI_%B90u8E=Jhgt;4?LmXl3i)N zeq)=0V%R7e-E-`!0-Piv)scO9Vp|P4F5~iC8#G#0AA;}{sj{vyg@SgGxyj6;*fpd0 zWTF`Oqu5!ZXvw3x5+x5=C~v~1T=^wD(;PFT4FJkY)tHI9;B)5e=io0kq)XIr7teyv z?&3^DbE-jizyRrsb?zE_F3M=>DPw!fGwtRapGb>!P*wDn`t+*HY~uVd35B)Gunb0m z)bkJbM7g^%hGv_^mf5uusxuU(P|od?aR2ZFRfQn|fpeH(pU!k7=&fb^PY^cRICx9# zCYCI4rPkRmK8-y6CKKfCb)y5fxR<)09Z>a)%^Rn{fj%#kZfE&Gumw%GP}lw)vrSJ| zvG+>C`%$7bfm&qqL^vGJ)Z{8o-YBVb3E(b4NKJ5|?=!U(@@qelqfAj>10K_h(gnRwDp z7!&;)JWw2M>ksUM>nnn&*4`LF)9`4jPPg8PIju#L)p0XGAxcZh@>;ZXkUS~#i$d0)CWg$Mo6 zV8}o> zjaLx!89==93SvGrcz!dV9i=;-+I8e)k1A`2yRa(vU+{AGHD~LwRK%5T*5bA_=hveQ z^zf3xeyTIXtsTv06C%{-3*{w^&CKgP;u>wOVS+14YkYI$lo|tGL^gD}C8uBB^)@tR z!Wof4gKaa=28#J3ggaQ>fLx6VzPsb;`?oJS#DO2k)!|NG6>v65?adqoa<+@3Qx+z(@87aCMvAR*= zx={hTXV_Kn;x2d9`41@X#@|u+xKqj z7gtjodpn)=R2}1k9)R?ayF=O2F~yyjQ9VCJsi!mF(-u0gNSxmJTB0ydoL2pMZglgY ze#mfeaN>4wg+66!l3ic$ouA^ah4;YYQ=OZ8%0tWZWpc>Q3GNPx1f|V5X=e1twG8&P z492w#>a{o$om5<%ICPz;HyN@JOe3$1vQK58dbY%M+0ePQt^tNS z7PE?k$v@9^Rs{l_JP-=$2zV>$>sKS^p^k>dKKtLlt0Ple`+yp;vVp2*kY+VO+WT8e z`6CJqq@|o?ZM>#Q)^4Lgz*FT=Fzu)id6azr`T=p0GM*swr#wf`~Hpn;9+WqQ7oDb&%BPv}>LE;Ai{l zoSbPLoY?mz!SPvA(twgYCng$@qzw}ul*}+Pl!=+5#C3~dg^yuPjz-QB8QKvVA{S(> zAl{iIGCn6XMkO?6B`}u5H+I0=iNf8fz*#&9b8Hcn>>^`Vj84fGACsY=rktumQ~wey z{Vc4pnT6O#$}k%hXechiNMVFEH3?tj=5GllggYXLJ@lQRjD%bwDuocBiNqclgEgXn zP+$f#D+Jim_*tunGj_y8&J2Ivu%JKUBzcTr@?oD6y)lc-C>0Z&Cg0wRM!yoradXDm zRRe{v-36UGU=aR~1j64sN{7Z>ftaWb3yAz??5mIP za2dC##}ilTj6A13=L>?=L+?PRV7WCHMyDKPy|^((4Xfb8(;L|ov3XSWV=;dpf<60M z?;e#Qf{&<=F~&TX4+_uYV*?MLQMEybUcZ43y?)A@3NS+1g8?0Sy#XD1}irH+c9N3Cs8NE^A_+-81bNnLP=Z(J^p#ME-9w3>HB91cJ$3IfT)?rsDd zJA%@Q{c>6wjSQu^2^t(y^by9`z)o~eyl$u31C~;}Za;|X+>X=jkW7{pb0a|60f&l% zWtP>Tp&r$WHIEr2a2_Q8LfPvPgH9%a;kPX~6HPTXKu|ScnIMkOoBQppf()FQq3_6d z?;2bF-6%f1MWR`@NWks+o3nu!c}|Y+kbL(>A*l^!B}a^7#79|j(TRpQeSGSR&k`-{ zUF(r+ly=Kx*2LT0iJqs;w4`Hnp>Cc{b>7~hPP7gj1BSX`YvnzBv^w*`lyIf8G$5i= zE{#q6zShoa1zC^5n**W!ZdP-4eEWk$))P4;0)l8HtQPeBF~A#0q_Ai{k4mS@5WICA z&1C^jQHnCE+1xdOcfL|fkDA`f0X-Ed!nyz--2^t znd3sP+(mDJG>6H47bV~h3I;DOiol^9cG6zZ~4F7?24$uBZ zI)D8^I^&2|sAB*S(|H&;&K2n%X!pRHzfny`ykfc9M#QmQ)plEU(pOemZnq=*4cgdT z&wxGsT}OYeG8i)_tuk1Rge20goe*m)XiSYPiG*TkS^;Hm&c5riQMhNMA+E!nj1X1x znR1AE>7t3GiN^=CFQ7k+s9HWDFm|7Pv2Iz+x>nSV2KdU}xB5uRm54-pGT;f*DBF~0}*h)XV}=%>LQPa9ZI zOIR;6i#CPPZ&nQMc2XVfOT?aoWzW4%z0D_Y@@N#}@lJ{PVN@4>q{$=8)tRCzAF==z zVS&Pd^E=h2{Xy>O@!hidR2JPW^yTLYi=$$Oz?X%>-Zge&<1<;-!^F1Zqal@u$rt@p zXtYB!ohf@{1D;0#h|BVJ`XlyLbNzm0YsUN ze{7bQ^{+x*76zfrpKxJaILj+W?xr|`0$OvwG|lT-laPtuFU;jAD}N8BZ)$@psj=@w z3SF{(H&pNXmb!`vyE5_6>J|ZWc$Jt*#*;w{E3C@R8w(@g+5lL6_-scWK+ug*D1l%g{zG%yOFw2@Mvy8}SRYguT%{-w>L^9`H3-0GPF4KP6eaXD%uGn*y{jy`3x(lK@0r9_KolG4x zOn

k)K&V{x7U^=s&Q|{}I(Wi2QvJC1voxq&f#tj0XQfbprnh>m2;QvCfr$!aCn> zgQ(5{q}>6yp9B9>s#Awq#On{$N&XM2bNipEPT&vLN&b`M{eQ+f7dyeZ{*HBKR0Dw^ ztn>c?)d~D>u+IMnR44Ectn=gFvCe7Q55xZ!>--O@bM)_2rvsto)gP);_>SW-%ylMH z5B#T0i@>Q2SJT-E2lI!%K26&OB$lt=#_2T<)WTJ{Ad*5Gv>(JYn|CmQ315;7pjNLZ z(&44d?G}cyXy6lAiSqYBaV?!aUC0+o`8XAKO+=;lU>&pkaZrGEVaKu!biU1{exR-) zZMTle8vz|N*lc>=cB0MVR=RFB$RI{$a0GFWOBYqSwU?XmUoX?ZqfB9{rS;uSOygw> zT$`roJO_X1V$db{f>tsf}wFdSEGcK)ih&=y^)RHM}p_Jem} zDv%%c*$aW{Ql1BIOthc-!lNS@{N9dEs6ov@|LYbXmJ-7``9zSS;8e)P-fb(Mz|E?m z|H4Jmk1loK=w3)@S zUQO2!0@9)=enEh4%fYNkRr$4y@^N0aEF^6;=KjZzu*sAkg6qYHfDXsSvlqL2DT@H_ zd~e4}HRCC<6&HtgV5)=oY_+%QD5L8VJe-&dRnU=!q1z=5QEIaS4+n&-NV3?i zCy1z$aIswFQ1x_1bghFk`LbmRJE$Y)4ZE%=CS9w3^2q;4r>XgjEkTWt7TYs8NoqI* z$HGPu{_R&+cF514q#sp+5s@~@e8g3CdK}(5&E!4XOK@uS9RUe;Rid6o5{YUfkl4=7KUH%b06mp0917vr%3Z zNM6LZ8_ur5AE)oZWPB3&M_hzKM5mk8#k7uQ3x~`j@X}8#p^4qs;f(JKeZq_wwyYlv zWvM}`H&Bz3RSuf5BP+{$CP1Q|zWB=rJ@H`L*R>1R=79NU9G}_FbiN{orXQW@uT;K< zgQ(8l7?A6DJxzZaY2K8bQ2!mSK|*!vju063xePny!n5GOh$(>{L$05C6Sz;s!uNS3 z*U5ZiNQi9Rfb%ecF~~%+pC4?s6Ea}Rq^7$CbVJ#|ZOO2_`jEE_NWHM%g7?U4iF8og zRYvg!hkdvw_&e8G^1tCa_Zsir7`-yWektv3)|MJDY)xcxQj9cv z?V|2;z-{IK+JT1Gr?n#I)g)7%UjprQmh$)rImwQtGxXFN68`QTjTIpxoTxd8oNbm` z2WdCBLZe(?J;XiOr3ysh%h_d>+0}`a>i@VshyF#^#lOc9FiQ~Uk9xs_TJ=` zm;3Qj*<}362>mX>mhd;QQ?2R`*jYcgzxKphvwg+?Bh3Q18xt(FTnnwwr-znpemKZX zbSn+A(TasaJkAT(+ta}86vNews$;eBtWAbzUH}UxgmO=99dX@Xh=|1k^}w6?gqC&< zn$9<+@vLCm<78$*U}u?n!XL16GvqE!>)9^TZI1QuT*;tt&_cVdK3!KMY=laXjZm@R zMB_vv4o?(TE)@ zYgDd2tBLP9gR{O=fLCmWx}+4&%45|xy#0`nS7tVDcf0jKr%SzF^n;PWrl^gvqV5rJ z%7V!>EB2u7;yKBm61vQ!Z!m5(Su@ITstiQzeU?RGZ{&W)v_~tozJLlXwg!`^ui>eQ z%z5pJq{1zlUBfTOS zqBl^1NX}A@0Q&db_15mn91LTi{x=}>dt_n3UH>VBF*Rk;8ELEnRvBs5O!2MaTO(DA zoc??R)6U&FI0e&bw&mzX_ND#GB5$Vi`con*tO{L!8LUGNeI+rSgaf6G&u=*bDr5uY z-|koGPeZ#o!m(Qsa)(1+7e?ZMe!GVAr-KE|VQg{AN39Rbtl3@azbwJgfVwTjM8wm* z-vMy=8WvChJanNb;-65?eyO+yAbAhs#?-qPHAkyb-x-vgcHG94#oBYMTE?{JZo|{M(S=%o;Ob zaqn`f^;JB=A9M5Vv1>?GKI|$48hiKZ=&}H+jY4?qI*izyYeZJbM{+aK>8h%C)9-1P z>Wi+mesaO_wiBVYy%z@Zf8-o2kL_4@B-lcP;DWzfl9FGKSgo}{9js(p*4LTIvQNv| z{VV>R>j5m}dgx~8psYcR2TYvasrOlVkh3PoZ=HPyJqmEX{+NtFtE@xXlI`f?Og!c& zzA&|Rf2%)|@i&r_u`)dQFOu`1M^E6d`Zw@9|E>Nz{~h)_|DEOaV?Aw~#N!IrEBSfF zQi1*y&5Rr!PsvK;;CKC-y_1JU=eKavBz!%;5$*1>j!L=)2cLO=l6`%%^23YHe(vx3 z_Zrx6ll>y2O@0-r)WQj6|6{dtvmcqxy`saHgwK&pkJSXS#|VV1#Md~pfKuQg5oG`V z`TnYH$qJ+nwf*dtE`<98X?f*`#mCstLyI+#qm48^lR)+|(7;iL>oMK5|BPH`I+GYX zjMv^(+2s(W$bP!DeSYkE{4k|(`}}Rj4bf%(DIk3TD)x=|IKppLARU08(r_Um9`@x zQ`s+iDA#UK8>v256d_L}>o#ufQ7AmgV-c0@Br37*kCtsmV^IB2Q5MBYTKtW2%9PnN zMK-yu%KZz<3CkV-{Nk3Jc+jo6%3qucptR9NJ^W!gQ%^TgVnHnDV?|K|@>L&}^b{|t zmf=0AH?2ThOp$F9I)STH{p5lpwz7$B4r53h{q=*|oRe$UJd;+g%cdyc<% z&&QAk)Y15cgfOo<5hoMbl_t-lTL+W0k-Vw-{M%)s1=6?iDR`L#G58+Stxvnz{Dl!c zQ?Bw#QwBVP?p%nkT%wl9K9=Gtw{vl4N>bsg^~J495vdwJIm!S8S7ZDTy8{wO=PGvP zR}jic^&90(@lPPI+xc*NGi*rFj^^bQ8r*di-T1(1CBUM zsqR#lBem$H3I(48TIKRl*5f6XsDtQR* zF?Y1@(K6w=g`{1z)cw_NC|1bZ2E@~J0|82uTD`>#BlFBC17Y@)V*&l0A&> z-LjM|wZB87$uEI{bM}ysfDcE<@XcDo`Luzkg9M)1L7S6p_fV`OO<+_kApK_OJb69d z_opn=MoVhIf1{FDuBU)c(cRlf4?ZZ)QL0BaJ)29BL%pgx*W|0wo~Wge2q=VgrhVp& za_Q{kM|wPt+qc9N1Fy<4jgYT4xk8ts6i{7cgcm=W*=&KE9R^0R1`1*Icq^}cKG|6D z28FP^Kp`xXZHDS}Z>`#iv7kJo#w*MD05VE0ECFENRYU{ft+E7b=1;QAQ>+n=LjPyl zDvUi5aaNxV)|5l|d`_j`G$*ROdL)Fp8GY?gVArQTC*D|htL1vQ)_&85zW7jD<(U$4z#K)P>DVN{%-Ce| zJTR8wbbUZOes2RIKGGwbC5P7uRrCJ&wb1|b-&jt{O#MOXys^v_g*^%}u0eUP^=+CJ z_}}`?)A{;<>Ii(5CTjV9$=~|TohIuA;y?P$CNREDS{5Zx5j@n}b}?_H_9};)b7BwX zaYf*l7XCh0)lDuTpG(mmBXF~lm(e`qkofgfVO;yLQHs~4s2KE~%H!g&XMI|~GWu|` z(ysgZayhQg#F<>zn--oqBte)pZMdSOh&=r1PZQjlF7qOffD?K{uE?^O4-KAjavhy9 z*ndk(@H|I?_#&+}F?09%1qkU0O63Iq0A{lC%D$Vhu;qcJ-v@ZJ8(gjRDBdxU`t;Q; z#u~lu3|=o>m4lbL5A?lIQxWgGXX;}vd=2n*tj6@pmt~?F!8~HVt$aLEoQ4Nm2usEn zx6EviqI0^2iC#LUJheDaI5`^**H2RnWJ>)|e0KLJ;nwi1Re#stU=*b3_1O#V;Mh67 zVvL#pWu(%I-V)ed;2^wEyUsmJ(;I{T#Myc8o+GB1H;&wH&^L`uNJab0O5R~c7hF=3 zRP5%$e~S9e)nM22lcD}A0?`iShxS+coxr1JeHxWUUsW+$+Q(8lpV$>lPSIP;oaHv4 zfh&EMM`=`3z8-L=+9KJQ7L>x9NgyM(dKu2S9M-yMMA3fw1<*@!>JBfi*N`Cx!QnPo z(fBkK{iZy1MyPu+gt!|{Uky{6lM)~KR2Z23)jBoVZ*QC?LY?jo&76y%3~@?Z`@ z6#cO31`y}V%6ncad8{a+xLeOLE723fQ}8JP4-aP_nE}&>X*pdaZ*5x3QEHm{U|EYn z&?z=JQ}~?50sRj%H6#YS=pL{gE2a+ z3Q_X+budKY)f&7n0mOG_K5PE?w!t4-01~RIcj_qbd@iql{2YqZJR}eZW_Iu~BSLk9 zM|HIxn;3m74%5gBF+c<>FeMBF7H1Nn>9d~?sWRh4o3QsKtW%ND%1)#%hXM7oYfWzj zS7e>-hZFgp?~LMRT)QDqq;`?)aHGtl;AFnaT1WRiVe+~aqe!7|soLf86fsFe)#ap7 z(Nd~bkrLtrw3bjz-bj5HSz-D*{3d~_l$m^%kZH6u*L^bln@U+lT7yBjQ6$PJ-N>MM zU%aREBt3g@pQ;t&x3Zr}U`;7+?y=A)+J>kTM@aAmfR+5GqCvA81&(S?s|y9>%~}Ly zUz6&2n#mt2h3Fj)K3JK-*l|*Pg`4V;rzZ?wC)MJ4+qsvYeza-)a*0RPsQS9ga;HT< zypQzpOG#X@f@f=ZnY-@#&?_vz+t9U^Z|Wc#6BoV5D=U-uHcUspisi@s+4*waEakc` z`>zp-df;q{VWjvZfLx1;mmqrS4^5=W$nLfJFyFK`?Kq>GlkDCl&R^y(c=ps&*Nb~j2WC~A^+UjmEo%tT<}?W2%3L)P)bcLgVL61kX2 zYH-LEA5KpBddqqTC+sE}2DxleEXY3f8>e%9Z5OKw9vp}PYQi-CA~Idl(BSr|T11-6 zTbsvA+OpruR3oA*n)sT-zzCE;{{}KOi3M^`gLtAg1SVahzI+g1BPP&5Mr42uc!U%R zZPtVB_4T`B9sy_U1mD)=2|r#?aMhw+GYgKSe)!hEfGGc)$Q-buiAVRekjxiuthra5 zx+DTZd!dPkCDrVs6S^V@_={e;>_IHt@W^_9?By*i_KMTKt zu`uR`W51yCn7gX0=zI#$cQlEVUKE0Zzc?Zz>t&1$CTKQ4-Ja1NBKA0e_7@{7N^;eW z3LT2%S5TkK5~IuKJrrjTM*cvd)zKiHqT~nkov!-Y)p*>c!@+ZIG^FV5*CpN%_h$$KA4S>CMy3D}hznEfYt7NMZ&IO66hqy>4S#f3C&MB+yZd{W>o z_-a}p4f-OW5YT@UZbw8D*l*=5h8g13z$;*D?rz8L`9{$bEnQ5Mu=Yo-KKL|2dbOk_ zV`+;fKgw$f+`7EhSF|In8rKngZzlxGd{Z&xgKexQBLLL0%bt_Z zvk-KdqMV@4cb;=prH2?AD*g1}y3?f#;oy30V5wQ8fGT51cS0Y7)Rsq{OQiyr0_{rP zhXNW!j>2a)xu9Kuo9rT%eJhr4HkP43mc22Swj{QT`19cn)s5A(YlXzijN{rDgUt7p zrpXgP_&IuxN9UJFrls;X7r>g3M~%4bySeqyyJ9lWf?OhnT;drE9xX4od*z-8PjOdm zWXg^HL5LL>_PKc}X7u{%oqRZ{EI>ilL{9eh=Dbube+jf=*Wc|%E6h04Gmr#OmLfty z$$I19q%F!Z^R?=eozDbhWj$DQs&syFB0PCJvdUfOZM{=_Mpb*41av!|`aw;zjazVi zKe=PJ#5RWVZj4V9H`UUiN)K{j^?@=HfSJUzmsqLRQ@bxA`Q+puB!MNh)6(77YMvB4 z_)Q%$Ksz?{JRNeVVii)dl90`cZxA{3>0kVru^@kDV!O~XKOUm?QaJ@?Gg=X5CE;Y^ zug~~IK&|*F2MH@;0^-$K$Sj23M`-e}CbS%PaF8bx;?T?Lf+)v+tKd5<$dmbTs10#X zp_fkV!yiv3uY;Q~FSknllToVTp_kK~{vG`-VgFPZKRDgKosLfVaKM(O_tfIKaM1#4 zthJ~hvw018dNVmT-1HF2}`6$8J9iD))ij`o8BQs%~>-DG0lS$lfFP zja?d5`>D0$-P!)nph@80Qj>hzv#7?f|_iTcFIQ ztP8~&fZAX#C5(FVRQ@@4*~YjGprLuv+c;f8(tEHWDO{HxE+f!W6o0iDx+p!e5ocjW z8WBDJfh~DbR!Tdr1f9!+3YP;;PBkp3uq9z56`I;BBITX+FrRc2L zS1D3D7tGs3*V;TaBx^q z(g+3!&{!_M-`E6467;ep0Msk;q!6@k`XV3F5H@I#{Ru81@sE7cPf3FII;3r*K%osW zv#5S!JxZ1VeWnkAbsZzBQ8FNlhHxk84Af#8RDU!Y!Kl!=@--yv6*9r+4^iW6dRaIX z4sW)j5sa$f7tElLH&7}tV2zkz7K$J)KR~b!f*=0?3z`65a06q71Hg`xf1S|&I%#~B zk$A0Ld=WK!fqr;?5P9uFe7&4`8A^LeFnTF|_mY48yad89{h#}!p93+UmsXx)a-Xs- zpR(DWq`f@JD*4jobz>!UQ-yV7Kk8<(>&7$c##8Hp{)=O9Go?b>>CRp_RoYZ|XQSbf z&t{R7)cOm&i@PQRT#!0b zi6IsxI%aX_Is3bv@q4HDKS1hC3U(M;kUEnNq|SUZdaed9&htLFL)8;e=h44&Bh;S8 zAj^mXd8gq07@JL7LX_&rFwL4LA|2OX!&KU zzz~oIsXRf{WH#G03q5TqJ~!c+eAPixLRbD)#Gf0Jq<>4+G(D|L=7-y}Nqjg6bTtd7 zlj@Joqv&U?GQd5ksB*3N0j0*VOHaEKAALj@yG<9ndWfn~qQzJ8k&GVFPnpO`8OBr@ zMqQaoN*RV%nS)6gnN%4WBR<_%vY!{oqexe%mMJpJ-+orG2RYVq;sPXxdPwsqBZu@N zrlv&AT(d=>BQwGMGikvpqCt^^#+h{|#3YF;qHxW}wO6VIUZDWkTvRRP+H+BwyrtPf~ ztYs8pE5rcu`!Crvq{4AYc#WsT8X#=`U{lHfAPTAXC8Owo&OdS+J-kdgof8bRzR+ z?o@4kMvNqM%s$q0_s*>jSbYc1o0w6E{}$=4%%vIjK%%A-m16@jvD6D62S`7IniK^? zKPx0uGf<+_7QeN%7C1iF;urYh_Wp8i>a#$Z#uxW)g@LySeplQgJG105qVwASZmq&% z=ijVVIQ}UF2f{ z{9k_!S*bM=7NfkoQ-?255-qvEylLEnfEY>78&MC6^kn#IL;m0xpp6nw;xCnj_=`-) zZi-}MzOUAf$GaA6iRO7t)kc|r8k;iUG%~J>7L%9A7VD>GG!CZZ4w{Z|p>!9?w`nmG z449}IKDL~51YwJgY5<{Jz)@!dQ=A`tkO9&EC{Ut1Q}gcTrkl9_nCiM_g@Lo2FL{=2 zB=ZV7pru1Zl?=`P%5oCSCRrw>Bce(Mqm7s2z>l++N_j#>EuV%FiYXGDHB*UOr@3>D zLtd=GjnJ#XxzTvOfUvp*!^Um81V0|To@&n8*^Ib8v8PUs78F@tnlBswF={&h(OS6% z>^R~WQnvXi(#n9Zk){uWdioq~thqBiR??@QwdGmOQ+34o_BayuaPLxx=$?kc&}a^0 z!ox*f!{=SB`eW2{tUCAPNSwNcK96hxs|C2}6xmW6^E-ZnvO4ALp65HL7%HNI>z{nl zxyBz=I6XMLR)F{6VOcCrIm!<|O^$AFDo7J=YF(^2ovl10oJH*QXcZx2FAj{rk(o*% zyicTxAiggtm@`LW#1P6AL40^4Z|;i2<3~xTRKn8!Mog7vTF4%ENXc6yh)zBbI(i;j zo&q74`Bg;cI*Fl$4N9VX&>7Wso79`eS)#np^_%SgE(FklL5sQs+i*oj(w!@S$YqKx zzPS?DVmsR+U&LsH@O)Zliw??lpP?+D^1-=B@%MN{Jm~H4?(~+N-IZnXz1H{1&?;-v z61}cr-Hg(EGg8OXRUI*>n<4ccwg_9(_@wX+^GT()V_lfx&#V_G{tD*XXL8bKCsQ@= zqGA*4^Z>vN<59#Urrp|`Xmdi%Jo&QOo3d~lIVPUhJF*r+!tOD++ac`t_Z=H-w`u1NdMt$M5xtPqj zU@HkdNjfiu1WCMf7|pn#dvcER{ts(!85C!`CfwpqaCb{^cMlfaA-KD{1{!y_#tH83 zZow@CcXubaex3K-duGqfKIeQ>b^bkF)!oG(s-Ne+*0ok$zqQ&?2E38&K_RoWyMMuv zX8X%yWu}Lgqw|7!B|lw%CIen>V`SMfwD|5; z+0XA;$T&x_xJK33E)XAi&P){At`ida8*Q>i&=)Iq3CePP-*Ev4>!?x|D{s?W4(w2L zrpsC$z0F-n8MKY7`If5rzYr@gg46=;op43wk{UBZ|D?Sw2M}MbOI&c^^epf@lQ&|P z+rG8Gc!b{=%Qc|O0{zrT+m`YrXIlSO0Myb4LyFS(u8oh zm6NBks$YFw*a6rWhVC(7! zscE%t!id{)Vee^oL}F;7L@vtQa(Y8Y?48E~i@LC@BE*+E+C6PwT1rnkl%0HTa@1lV z0QvLk5!NxC5Oc%~a2abUpN<}lc=Ew_OugrUud{~F4FK~;$gVTZM%Z>q3>!?>B{SM2pVtpBkK+&Vqq#~8Y=44i5%ZX@avKYicFB?>Ov_@gGtl+W3EM`leWa0;>cBS z<9S^U>H31ZxWx{w`vPJRp?S$)4oc#3cKW`3KsaLw{cRF@xf^iUDd6_s$5>l_j{@B&b27U*j~F zZqNbCG)&q~BZ41O9M9JXg=Ykjtu{1eHzd&{D9$7(I#pEs#}-*%9I7~O7~_p7(YYbQ z6?2eli6{@!7Qs^-vTnK1nLGTR5igU zsiH8mh7fH(!7RD`_@RXN?y8+{7uxQvb)OpTUYr(uvf8^A#q|$UnA`?{?HiH0=L~jt z(hFXJe4PWqdPki0?#W-N;&=Fvv&oykh4t@&2l zG2KSf^CfhkO)Eju=&ja{9fMn~daIhXPU*n;3^~xUHltyLL+kuQrIUYCi-5IGmM!3X zLIP+ONZ_1(Qa7NxbexxYl#;m@QQ;so-$IzN7A03T@X_6<5wUjNcJY|j#ucTh1akPh=R>Xa5U0OZ5;{mX}`YC_>RN2?e{Dc}6N+P@*0TDrWG0j3NO zZ1b2zI$(%db@QwlVus68slU25$&jfYnzXtBavG~wAH@+{KiM$dUlb>m5QZ}Nv7L_k z0%XH{2iY)RKhDZ=Ha~lf=y>WuZB*u2XOIk>irxur9qzJXjDaPuk^$Uo27JGQbeLt= z*lrqEoA1kwRpe(H6_}N|y+Q53nUcMp-(nD3WhZ_h8>V#w5fjyq8y+k&evVq^PRAUC zGVBMm!~RmzqaP2>&w9w;pUzp@Tw5Rt(FL21%nh<%4@2U4(~&?n*bh{1CM=t;HLI*Y%{QOOkJ{A_^u(w1R}+qe}!f)aTU%} z|8kmMcTsL;32LFs4IPkQ6EKlGB1?H|;Udx_y{Z8zHwYNOiGj)+1VBh8gh}A(1_3cl z$a8%ec_z@Hk$?c;&@@9|3v{|%!>iw7HHosvSnh$`G{!cr@)i7cs6V`*{l+P`45!{+w+G?B!2#jO002* z&YSX7`9meT+`BwJ&9r=zb8HeC|LT9hFy|?AJF~9b38E4~P~u1@T$KNr9Tej7G%j{? zJ{tTYyF^c%CBLYCd2<<2S>6*pENR<2eEzwU8}%-&d8m<{liQ&iW{KE^qZ{`zzB%lG z9l-I9`5fJR@Hz6$Xhb$EHHFQl?d_$a2(p~Y=cki$v(9@DL|19iX}J(w+M^g^MX<}E zOmhY*_OqBvPN+pBJovP|+nWBuqbM>HQncZz<+*p}psuVX% zBu$SgRZ$m>f1Hlh_3zmf$BA?5L7ZK7p9l5lVzUG7 zMh$P)U6{5iR>%o|WnASo*8xhaUGH%tfXDeS742PzByt01K<3(mCX3~L?EA9rLFeM) z&|DoNUxd~$^=1zUaWyW#0_|m@Cv>KE8)eYX$U1!3VMnhxbUwhwryclr6#Nkv6a_c! zn2Hp=TPS-{pA|&hM(&!cw{E1-Nt25Sd&lY zh+#EE<}D@w2cZkSumgqf(Y0Y+N*sqt&^SlZn07H%h~@E?(J@x@WUKZniEv9 zJ%A6`4zAq?FKh-?W5Fcu!{xS6^_g<0%O=!QDRk5kqKs|z3dx;c#p2CS#ez5u2?L2D zsJX|Ptl`-w#gSkmOxA4gfzP5gb2?hc+QnF`!nXebqvmpgsy*83C2eJ09Jk(_ub<(a zeJe$V-q?(N{DN%UiI)X8uG|Lqn`UP>Dd5;CMH$L!lKh6~Mz4hAgzFOz+{U*M{f|Oi z8M6^IlFMO1Flq!!UOlp+Msk<(Q8*yiWE0*_v!&gS&W=iW42D4%BrlhVW)FJ#ZXDjD zYPiH~uAaIoou;vjQk!9PH}8?!w~Dp%?_oG^vxMn|Gx=3-^h5QWqM_rk0umg_xq!Bz z)S-O${z@klkF3fcHx?3TL8RHhxj z^*}-J9R961w@dS;wKJI~>%ylvK$*N9+7iij-u@+yuT@j$1>23rV~9d;wI&4KYpeZ< zePCd?4yV4F?F0N0mXJ*uq|5%-^9P>rSzp!QQ0qr3HDs@PI?vr8_;NKhC1|rIzdJFt z#PZd#d^`Iebc8)_50Z4{lIDjfQjJac7ex2 zk@rLYu7gjCpbc$Re}^Mn5Tl5*Gvj_+e5vbt$85%tX;&$ftbNky%dnhVvcfoZ z)aXo+hrq?63uxtBKS0s|czwpa93@ya>+Ba^2MRfw`=hP?#x`)dgun+M6xGYxyCpE< zC)~S~`W8vB$Y~FItnKy`rz{@_(f5NPiChjU4$hI>&tw<_JlqYlOhO71oL;;Du7`zH z9Bvei*3N`9TLElSJ?wccM_HhgQb`L@7->&tb<6=7neDEUY;Hvxz)|Rl-j?4dk~u|B zJuoZSOQBbpyLDXa8yiIa231v6auG~*qR3*rEyB*Xuf^!Kk3N^?<1U~!?3)rj)2;fn zJnNee)qa_$tg@3R>J(_-=DwkG1KSv{fzK2nt!4AclPR=Us5oqbEDrf-Vmh8hlH>t#*32Ie@LtVa}QM+7y)#hkQ z9x%LI8xn}vU_gQ8rY`CU2KNwULUie^eBkK3PuXoluzsk500ku{fu0H`%yc*Cr2dq_ zg)optBM6xsPXc_bH>M8)?CbdMtuhU!heYxR4)`(I45QVze+wHYv4_t*j1%tvZ+ki!P65RJ z1vbx*=6bBB)=)T73mx!CYg9G{br|Ke;o1IuX8$18Ah+i{H~GpXSq>#BeZm=Ry=FGYf16|URRpSa}8H2P81~Y(1?83B3P0$qK=h3&=1i6C-OwKI(zyF9M zml%g>`v`E}Cm&Dz{e~|E1vhK~Id;b%&KujDeSZ5$J6|L=;K+asv?%rEjUCUgjNG1Q-}{@FbMiza1@TD))_hWAszlT+Mi^ibil_J;SgyGNfv7tQ zoDPOhs}R8a7-n_l)7&$J3_UvvQX2uC-hD;Mm++wIdXdd}IVe0YJ@3QdFnE|q&+jGj zeW-XNJ-<+B!--1ArhAuT5M!9T7aj!}^D0OKEaiX#P;t547-?r{z2jER5@?a@A3~~q z_(;2;BuKl_uNS`lrb)Qh=w1UYn1Xzhp@%*`2gS|a9f`qN49X5Z?U31uGc=nO2MYy@aI7ej0>kEaG+y*7A!RL zECEBH^%DEQrg6?K`np_m#)bMPn5<9H7+#RlRyXg2nbWu*rMe}Uo+trK$X58zb#`^C zQgXB!UVq)PJA_-IGUZKOEAlVnx~A5|F-6=y&yGGM2Mc$f{XoAIPhCxL|F46CqPstX zgBHiYLX#s5+xzanAjfFVe>XRv3;LgP16x?Ax@-JA?5`1tntGXpX8vcpsy=}HQ>@ah z;QQ>dc9&Pt^wo|^IlLtc{YbvAs~O;jul+0Fbm#5*y{xM+#Y0eBa4mX5zc=41JRPPQ z>H+Bu^=yr~0#~POH~x;p&~d5ZIU>2T3Gf!?AY~;_=j8AW8|!P7tPsVFf_kA4NBOUj zSm*1Vm##<077V@PvcT2q{2V~g_WW(n$vot_W^9WA$9jcUwJO8H_f5m`jxX>jqtIUc z41KR-90N7oDT@Jqo^IgZeyI4CjK79pfnS}-q&>?M&v}A55&LDrk_s(=4-;DXvWDgq zBOTE6dyYC}vu6I6%W)dWVNUP!{mHe}){JL4H)mfy!2JdAz2(JuaZIkrmgTplqU9ci zi&s>J)u`dpUj_0lxjhx;yF3=@Gy0W@+o|xW{r{KjmIGgH;URiLQs1t{_b)8{>^qStxuK01!LY{~YWK zX1f6>yovGQLK>j;yg#O<67N={a!AP7E*h>da#^`Y;VQ283N7=bJHE452!%u!Bx)%5 z98PmRJ>Shw+dYnz^UP29Za*-3XwCDC`1QvYDj8%mGL<6N-1*q%&&bCD4-wFR#To!$ zlNkP6d1I&yIs}!@qkOQd>w{M9xt_oTW3mBKVAF!fG?<4~O&@mJ*79v~i;!D!G?a2N zPBytZL_)P6(d`X2Fv@C)8aq~NiyA9d`juKWns z9K41uxbhKd5BtiJA#Fk)Y>VD7i4Y7BA}WUnv6jvzo2-NH80*Z-$Xv|?m(0Js698PC zg!t%}PAdlAgCwG<(dc15~5xW!vI;ew7y48WYumYT(2}d$Eec4q|$>z&ku=if^%8^RY?_ z4xy5l=hL86V5*Wks@QCnlwzy4fn1`BvT>2~>FA{DBF7f5P6kjZc-H4>Ajs0ncPg3B zwS`o!xU1Y|XV4{b*IW-ny}}qg92U(9)4j9+P`-(-`icJ7f@X;~U8*;LPvW+Q1}a?< z-~rCjgn7S!B@nZMeP@r}K@j62s>!R8spVJGM#?U;ilnGhv-NlAD`N7<9Tlx&TWjc(-XGzmoni+wNO+l*2Szh$6p#v^d}dcu0JZ(g zmswi_f@<4$T3fG%-7*-j^^>Qi9o1T-8Ss6OfCHG|M8E~$TvL#fFF#4$0y?2qtCgU$ z8-2|etGCLN2AhIb|7Ikp#Q69+*Z0a+&n)EoJL2Tg6~`3~(;)Z`e6RR^*H`Ysqpd7W>3WBJJv51J&wJeb>11HRLp@7^s=SK9M~zL`5o-9s0sezQ|B9i>P)gs9^p(8mH~tZKehH?C zKFqI{B6Uio6iJ8LD$22=g#$SWDPgMgj1L;>eF>2bn0BWnQPv!Kk##$Dz&B|EJj83* zFh>^ChQrWBC7|300Rd1zh5!*DHSps(KvmWEC4MyGgMc#2nbMcC&n`V=WCw%dzY6f# z-7c`B^7q;=#3WnbhxVYnuf#MusT4TE-1jp}>>6me zdLHv3(_OQ{B9T8<<`!_o{Rot@+`v7>j}*vnFh0GD{AIWF`;MF%O)^NDRjr4a8I2eo zs~Po2IV{CYW-@ckPX3CF)Rz)7i?YE27iN5kT$cxyofyW#$X2otC7$ohNz+ z8DvzP^5ZQ0*%%EtuFxIA0G9CEfUgI1L)4j5TC9yy_ab3+aVnb3tCEhs)<}`}Ifdd# z2bFPQ?I;z|yBz~;h3st@sK-AEYnN3cPF3=)!r`sd7@Cx#QBXDWB-S8Q)XG4I*)Gob zd6FjYQdqMt+{S6Y71ExX6lx#;ziW3dixC6^r{Q~EZnZny15 zof(I^OiBtGfRS+6)rXY7ByppmXQS^p1*mL`Y4}KITA}8kJLmDP^g4h5Mnr{hc%H|Q z1Z8qwsv=BWtr!6+fIKBqf27cZZg@>GWC9z~)mHH4Y(OQdyF5!_a^*S6T;=habeN(7 znGocKL0(xK=i1J#vR=QV=U;1ROXk(z)40i2WxNxyRs1e5WP=ln&$=u?&6wn=ybN!S z8s)#A?ZT3eb}x7z+hcYwK$6LZFW>2aKMZAdQVJabUBB8jN(oCb&y_P(l4uB2eep{~ ze+v=CKa8YbN#z`mr0k5OuZ|?mNo}Egy7fwYYO>^CEbz7BwP&xLN?WX#Jrt7g2v_Pd zXc)pdTL|{BClk~v_=J68Kj5tv-=(6ALh}pdxRHploBxG&dr*+FgE2JWa>oSxydD4K zgbFttu(IT&5>)t8sPq$C$){(p2X%UtGti0O&Q?bf8IF~a$#^$Nj}H;>Nf-%f(uNv0 zXPp_% zM`a4w7?~0$`}xv@Ay`QRK~-?db4_OY7d6y;ao)cEf`~$=b;BJ!4%r_jLlypgRZ`*) zli;R{=ir5lAJREt}%S!)+r(l|eE3?t?Gw>B&@?MVVuecUpsFTs7fqO(|BIj$hhsil*KPcABVN z6`9fuQig|}!Ea+oxGa|%`x`-@upP4}-~qTmreTsMwWA<$o5G75P>I01mfk`sHfw@K%!{w< zQ*lenSo!}1s(9nxGVk)zCOr!=Yqkh2aDCl^Z59du&4@k>zjo0&SbORN z&j4XzU4OeZ1k+(?p44w`gR#)nI=S{9=5M(Qa8qIS$vxB&3;$ZQ?5iwQq$y&%bNIO&@g+i`?>7PM`bYKE+($lJju^{so26r>jHk? zP;0OS5#i_jepTI<@(y(o3Me`3M5EXeH#^$*2-_uc)Ji%oV*?eR2;AU?n8^v{gB>t| zlTQRBGK8Yq2K#iwA8EM*ayL<}0&L_1c81|%%*Y;SpZo(oVLyB#95%TlT zQkT|-r)~)FNWc$FO7@3Nz5)gXn|V|~6=dOwZI%ndF!}UtI*9XN)+(~1hhER%nWuAU z=*tY#?VDm=bfKdPiL&E{485+aa^0`20sF*P!N{q)FAMB$dZBeKlfk*}P;}-2z~8h4P5_DI!kuB|1Y-9vPRS#7u5guVj5%t=@yY(Zw6Sfpf%UY36|{+kw1L^Q z89>_5INH$gQTfk>JK4$!@})~fv+OEPzBD|wNhwOBB2=c^alaD2nAS*G9_6v~E0G6K zld&bmpi56cn^O3X8dw18ehThg3gCrj&mt*!&dR&Vf1*fB3>c6S-6+_yO+e$kl9eNm z_z20B7@suKGiXv|Sa->!83w$Gl0hh=A{$Cb(vj*bYv^Yl!Y9DoKrDmglnl`WHwndK zS4xT_la@uM+7DU=f2;(a`~uxcwHu9$nEzQHbXZO!^{mX>kp`oiqc5vDbx3Gu%^c%^ zO$b8L|5Kq(Ete7g)fj3Jnmy&T9o(2mWF%dxjXFF4rTD%zf-x+k}@Q!bzyfl$A4?;qoN+KZ?Uc*(BseUv>9Xg_@hliBZB1u>B2+rl$)C~Sg%3JM#P(TvC ziw)D~+F!6WRr&n%v=yuEhT)}ko|5r3XWR;Zf9f$nM9(0PE*`Gcv&q7*dHkc?ro>Va z{04ExO>c%#BCQ1-y$U8y001}ymZm^URJ~?kpHV`w+VMe1r+u~VWF}^5F1)$pXf9eh zQX9jXtGyw1MaD?G1k*?T%zD9me!t$DxS3W9>`vm&zj*C+h?6Bp2XiMp(eeTAU~O|! zs<1~JPtUiai_VPC`)&yG*4dK`5WldJG zN?M~InsK*53u9~}2JsxW4I!B=DcFWkFG;G5x?aA%OKo@jA~%A_Hg zY>1SOcG7w+R_i6IIIPgV?%Le&JHM;%Lv7tjf&_+1jJgKD)m&#^Z_nL(0~QoW-nDm% zlFBMEQ2-YaPy1NHz(i@RCD+u+h7cpybuz9bVYwXBoWhBXh=&GbP)T|WAVzWnY^%YK zr{gfhNY6JA^s5~W%`Z6W&|gbZ8fXwCnZ{pJY;l{IHh9y^|28SJ>+9sXvGSQ@#b19p zeMi0CSbI!w75%dM?u&jMfDYiOdu8`5LX)mr81g(6+l$3X$CU<|bhc!k>;)=G=WWGp zxjur#>sz3bbVO3=$TFxTJvN~FrzDNfX;te!@nz{bG3u$1>A9^=&DaI7X!bd%Dihd{ z8MqiD7-!&_ONuJQ1bPXvt#qfnwAEO4GXYiG^jjIXuwD4q4J!95=O{aHMZQ?p{L?+H z{RZ%5f#4HdXvXU%(Q3ImkZzHH5rFmcY$Lh7YX>!ppOYbxH(!uyzasL2CuX|UebV)m8rjlnnlyp8QNKo> zQ|tyrIopR(HrT!&5^&=OB(vHwbZlzthsY&solmouDIEpRyZ6!dg3JNAR)A5hNm1#0 z=81-FXkSm&Hbf{U_UQFd`!BY-f;u39gO>+#EY8Z#;5o6eip}-exowXe*AVdG+Dgzhw>9gE`R>xt$tT;dGQY2+1dQokGk)AO}FnU z%auq){X=O@w-#zx7SNGZOn^SxN*#y5ye5LkYliiK@QP6J(?YL|PKW`g`ym+>eZ;Q= zc{b~79Uz)?7DTJG3O-HIe(~>CvZezCp!NK%VzGlJ?8XvrzJca%epht@Cu6?HH9pJr zFW?(@6{9bXQwVikc9P+@zq4KU02^0}V*JY=&BqoZXB^6_ojO(m0qoUI9+kaK)pPDV zgj~cM-%1){lL8})GllJ-k|Cjc%3_Kzmy_7E^UW`k`}da2+eb_TwPLxpuN2a(7rH#( zKXrXLZC%6A;#nzb?UB+&XU0P}MGPE8^ch8T=OzC^!&X5hP4Kp&)GVU24B) zov6okzgwNC>j%Us9%jmeL*~qCgiapr)%{D<49GsKYf($qKJx}LwjyRcV~Z#T!a-~Z zV z>YwH@xs2hoZ;!2A3^3kfb9on9clKtjZ;MpBWHh&r(yi^7GG1wMdDNb?&#vhnZdW;3 zFSOU4tSvAwo@jBoW?8q*66qcV*g5chZA-Ua9g_k&r2z<9`&@O787JGqWY+oysy1Qn z?K8%j*C(|1mMa|()LR`+R-5*!mRav@!eyFPk+t`{Djl1#+cnBp%Q&iLjqWYu#~K#p zmUrU*Pkrd*e{t884ACS7DEoy65!NUU{YChP`3E*K^9 z)h-8XTmU$2T(O$kV6}Au*w*~ys=CcU(=(h6{${;Ex{IHk(Qo9$x1Th?JTREzyj5b( zz1xwIVrs9j3GGCqveWJ&)OoRY)MCJj$nCzqP0!o$43IRChM6UZ+ySq@0q-|Cz8J?JGgf>$|8$@OF4U(RCt{86$ewc?Kpp6C zQ$Oi*RK6yo?(%DQFEvj@z6y^^z?s(9csF|Wi20ueeQRTuvre0yEo;&@n=Pgw>n9ZWuAVH(N3j)x1?FwJjn`_`C z$406rhtWKB+UU&7zfkxPS2%}T-?SvJrJR1^7fN`kOj??MK3T~i3C>aLmCFP}&k#|e zz9cIAzSi)x;k()D>m;{(n)1WkR5xng1o=r_?Y=Jj;J$pxIvV`Al@Vq?+tu;iVyyOP z^!4R1odiD`jUDnvOW|Yc z-?`1LC%0I|F8!4#NoHtMI>5YDL({S(kCRo2D6Ax!uOS3)IUj%kvd5!D;Ef}qjYq@H z!h)6UyzXxK$g<~9dMIF*e?pkR5Z@kwxDa!6OQ_-H?UTh*3>l1_-ZIj-L?g5g3dN3( z7t`59J$j7fe#-OhOd?=9Y8>M}VijyHkzqLc9LY1@_g0(AM}Pbp!PEZBx2!|EtOqgK zjTh@V^%rB|cUS<;4s*m~DEayK;a5yoj)67lD;(t?x|mML!Rx|VIM4^;-~c6IDw94( z2SOHq*c|{3Kk==MWG{Go5Ey0=U;nG78k#)bcejOxQ1%4;eihqddoHDK>@Xh*G^Sfl z8|ArIEK?R`cplE9mK=Z?p7xmgYL>_)G9NX4$U!*=>Og>wv7rz}H_AB*0D|h<9Z)}^ z6)<4j-e>DC*qJd`7cbvL*g*R})ms^`we|vpJsS?D9qg(g$oTM;SN$g$9s}n~OQ(yR zQnP*5ag)8r>i${lO^od!@oOXbRNw;YF*WWF$ERUP12Cx*(O93axLT0Di|r882OTtV zzLZXF-fe(yua-JpMcgYS`{g~qQ;s_dpDgW5^)f!bzU{>B>Oq0DgIpl(pan=fI1SPc z;!_w5vuFRSc5v-INXeZCq#aDI7iHn%;d9|bP|dsN<|A~Ct`9V7=Jv*Q4`;C9+P`Qol()M1v=_<9=iBc0lvke|~dmCjBEORAF~R zzWz&0c;C7)hQmb?ZRzyu)1XQrNK8mN3jUXva8RrwCF8$|30-9V783>=l7Ym8`hXrX zANc<;6MjJWVyF{1*eFB#8@(;0I2Kb(eue@YEK3eV&&TWx`kx~!oPOX|GA1y+4n_@kN=xnxWBRycu1r$}<10DT{Z_z|SAHTbEvYQb0;Z(zL72m4=$|d)D zZm$ztMpdj;=6Zd;Z8H^yaIaGzEVh`!rgP09ctI5Y2ODGw|AP%qG=i|f0AB!!l7zl2 z_SH1qnKo2Vp!x*? z(C~slx9Ekh^X_}UNT4UML<{M)p%!uVke7GPDS!F8ol*n- zDm}kG@HfmKiJ^+iGPC)0(Pjz((k?g$qmB8 zB^aH)a&p%VS|jQ1;Yrb@rzD%EWq+RTk}EubP^dZyH}?P8kH@+Z@~QUdYHya$kiuPA!8l6c~oH2)d*SWABpNnjB~d8sV#djft|Qfg_uvCqAa|ioeHRI8tX`qckTY#578_s469 zA)@!+y@r&ysi;*fFQ`43r1~SO+-v@4k!^1DC)jOC8dz(q<#GjZ|B4L){^AC`_yqp< z+~EHT8?63MY_RSp2pdF#j)SwL_5*n#MgQgo;l)7QAUQ%03%L^9XnZ(`8;sHZS8h-m z2gD5`to`8z>(#3MaDyC${{J2uG~xXxHdv-q+Xuo1*-rlx8+z|COWAk!yU1W$QH9&lkG{F$FhVYb{J}zER zYQAM&Bl$=uo8}0@hMODB=)+P3XkP>-+GY#BqJiPnWnN*4`l{snC!I2N{7cAT(jpir zHJCX#)kTtQ6FV|fQ-jZ@FP@6Ic*JzzmgX>M17BZ%$mB2sJgh4TBMzeB`9LE9=j{BT zIW5pc;I1@dTK%tPQlNtBimD*+>^}zr50LAQXMaruhAJ~xWd7Sg;8Ll5-6}00g6~GS z$Vvz_7$B)2i<(TpPqa9c`$qBRcDlGGMvLC`IiTM*5LvbE8c>!;)oh^lP+U;?!+INL zqB{JKtbjGko;d+zFpQfQWzM4TIKnWQd6XAp&dNu>j<}lP`AF&u140Cq(vLEeljf1L zChw`2T;yd8XC5W~no7jUAM|o;-aXl?UR^4^A*y7D@SLH&-!Z*MkUkt0op0)u^DS^~ z6th1Fh6B87cO_qaE6cvRP@L=r#KN-%J{u|2Vq@u#wQpPmBrbg5{Z{@;LmRZ4e>FX` zX5P9>YZ9EY>h#^=X&e%VB9;w~<;?^Vr)Y}7f#(>`m}-D{xvJ)9j}xMAz8}lxL-3Cr z$wh8DD7!VWxZH!rP`$8JgPK&>h+|5m_;@7x*YALY#rQTtqKdPYO}O9QSr zV1=!w(FEL-hdXeZc=HFvlh9Sr9OsuX+*(uQRFDMkG?}*6T-qP)T#XhzfAQyXeJ_vz zJr3YS8z$UX-{dJ=|N353%XIQlCV93XpfD7)_+14LEP=Tqf1*bj$oIJl_e-6_S7+s4 z#b19%70AhyCYNAFKZ(~~pGF4BBAXfk1DA_MoZBkRtpdWVDsTsIN5nvVMDfV)Hn+w= zfeEi6Mwdl|&_B8B_VqL3UDrn#Q5$MATuD z4b=e)PkW%j9HmV2a|_uZNuD|Ri}{=S3;#1wds3;V&3fVfBs6)EK@!ThRanJ4{L1?z zMQx{x(qSjCnSC3EsJ=5%b}K#Sgp5EuIPMKdGAPyg&b3Ou+O4C4^lTl@0GDcx)ANOY zFLV@?utr1e?n-LC*j37cB|QKi_5{0jCh{B4-T&nL@NbyEzevEIOjbXedXV#Qbt0?1 zb;E?~pxOD|_c3;?JE(KjWEq<+2PRovP^5UMrL>4J1rWXb_T>V1T~!cTg~tw|FIRa< z)rTBiIrwMAn@Mf!-asH70bf|$3m>dqc`;o<(GD$VK4Iw;3Uv})Vg%gae|QmpKmEgt2>3T* z#2V2n`_`Xu`G1QMpZ_UFyuO_5_@83L zBrdv$!k&Wde~1y=e7MvuT3cDeA?adef7*kE#M)^gH}u6m-}i9+K;{-B)I-J4Oc6j# z5e~0cci0KxdPD{ZCOyMlCG0W-PIugf zIcBEPIIvk-*2GP&J%jE1KO$-5jknhlApInTt25;})Xt!q8oam~bU!K=JUP1 zBlXzTO{c0S?*z-M=ihaykm@V4J;wzWMp?ZeQI^?h3(HjXnetE87o4HE1pcq|i2r}v z5e@#fBmUXTa9~G?s7gPshazn80M8xZmTJ8i_K8@-+|%R6l6s(LJa(5Agm|WrxZ$M+ zP`sSyRj_@zxF5z~#nVi1yP^qN1=XwnUtEbj&afa?Vox*}sq%e4(XhjJ3w}v%t7;e7r1=Kzx~b1n1nijt(EY_qC{>`5AThS$6&(>jcX%<&x1|yo;U+^Oh~g1ZqEEIEuGXRx4^UZ&d_K}nJ&ru&r#&t)twcsl-3J_Isu?+3?#+oL@o-X2df<<4xfN6eG&^_% z8+ZY9BJ1JSTB2n-@_cYwMGiRVmC2k5^-3ewg}1+qF;vM+E(*Fy9z^Xz!dxota9X#F zDuiQ@ZPBnWe&VK*51K3f0n$^_uzV`3Cqe?b5gRU(QsWZsscES4RE(tkbN3ciwgF;& z%pDJb8_96qyrew+s3dxD@(hazjt7`3T1&@oN^527l|gW~peE(zhmU1t)-wWnOnV%J zz+#k)h?6*6u7{*+42;?XrKvU2lT;duCuZdo)fnIghq4oo;b6p&|Jj9bS zcuu(=B?e#UEKNyCJs^JcY>tNnTpb}}_!l!GA^#u3&M`)^sPFdeY1_8#?rBU<+qP|+ z)wVs&X;0g>ZQGo--EYnFyve=E{cw|$oLwiWq&}SN>{|b|err-6t_fDG{I5l~!R1md zqzhfOFIQ>jFn+N!5qWyCr`|ZIZFiVqJvAA~L?xg@gm?dz^^~t835J{)oHcwYUV1MF zvcFFslBJA{Po_+R_LzY4Qng=1#%%(Z`aDA=_zGVk^ny?!^5VDUour$>M()^_JHpYn zOPJZVV;EM~W=IAfXHVBV#@gqs!O5H-Mczt`L{a!fxEy3N(X6E~CwUgCi+CRlm^P{$ z#Hv-2gV9NGFj}x|g{V~%Xo6vlNjgBj0uyAP23vC>2741O{8bNA;mJDc2|EQ(5R(6T z`R!2g5lGFVRpaTyA%B>`IR7<{cQ#wwwn?>~rSw!@kJzqXd&Qlq_YR{V6nA&)rOSwK z4xT&}n#Mqdhl`W$w@pMIqOVW41M5aB6nj5Wa<(RCA zIELaBTZ2baH3VCz(b;j^>cq4-jv%K)%xGD#0PJMD+jSWB1 z_AJjN(%3DqjL)}M-B!~eQCtMh80~cd!jS=%28@B`jS61X`hX}m>WvK86eC_`{h-rh z2?L~tlhE}XI`KB|s9r7F-`7n1=;~DsLejq57=>Q{zb@!9XJ8jJ8YI{M-31+m{=Z$& zk;n=n(5)owg~&>r&QbBx-;B*l}h~B*{4UlGCfj0SpWZ1BXd6XkZFzrYeE~kj zpm2l!+1kW$D#S^$J#u6Y&;b8zZsH)89yyHoVU&1DL<4h3?qI~8De!n95QFJ=d-*i2 z89YOPs^?XA?QP>(X{?NcN44GWK3)Mx6^z)Nm6Y|%Ve7z$Lo%wLKA74l^iM?LVwVok z^ej`HC-KE&-;{jRM#5KmimZP5geOlh9%Dhq&}Eip8e%+#QI)btXyRxn-~c2wEJBB+ zeysfxg6KLk2D0|x5!I80QQ#>4B?_}0i#-8%|00EYVmFunZ9Opb*tn8)b?%=0KbgXj zh>?Gh!en2T7uGh}wJ-B4TQ7>mTKbtUrTr2GRcZbc&2AwCZ7-__d`Hr7G!;~2tZ-+x zcGa(sRRidrxAm+sCYPd)U%QQ5L!6&F-Y-P5kc8Z$fmPA*uETg}z@^p*+mQQkdcZS|hI@yYWt;JmQU+JU_pN-BO%~e_*I_z3 zQQbdQLTdzUB~yS6OSW#5sa(dpO@y1d6;;i)?{&#(#yG%DP%kXS1u69bjDCGmeU7d= z+Fh4I&nd;DeUWilt7ywS#VsLa7plCWyd3qiLaL>L_9nF~_-|?ARgqL{JnbPR?Hh(l zTYE`znp~-UrjkAzMYq0`Uv2WE7|pn_JeDX;k_3orX8(rRl zyU;3QfKC~vSdoD(rDlOElTJlaENvHBTsD2yk3I!jAKb$MXcwP|kwq`R} zqA>R1sQLf|iY_!O@Po9a=Ss!7zxnJ>BBhMsiCgfdEvQmnSm@3$=)P}g&KL8Pnss+L z!Y}S<=Wb#WTjdt*s6A5rQLOaqSqHK3B`%YpdDDsj0rvUBIA+bt!sl>JgO#}l}q9dQvV6;$4l4P~76{@z^`2i&FaByTg zl@rQoxv!PW=0CN~l|NM~2oo51FG-h_TBxNHKOwjh)T@6t3o#tXClJtyizOn$H_w^? zIA6BfKMEawOcz4ZiMahhZOhFlAB-KS4VbeLaZxT1>n zY1+1R^S|qmw)J1+rCJM5K7|zPqPIN(5b`Y5gD#z@PW;jWD7V1Mx<1(sx2E|S-_f`4 zXP{b1z~!6mND| zc00`jW9NH`vXd7X8P*)4PnL;TmbY9MO6ulQmMe*B9ibRZ!0y?CTMip^`sIYBo!j%qQT~H7Ig|QIg95D6?p!?3Un%UQLfl`SLbu-r?hKkd zd+n{Q6Xn*{L@nh47*OX%kesHvu8wkuaq>T-uBA#o9oL3FHdskLpE*{!;MVl&=fk`$*cXxOcDh}0IZ`_ zWir1GFmjGhbtn;bqUrN5;QH@Tlsg%MQRlbOkYzWfPp4c-6HGUjxjMMIw%MYC@)X-< z&pMntU42(8M=5+SWC5G^vbs6_e57kN$*loQ`}3<{?jDu|AkDrsx*+PdH2mr7FrMFk z&q3B;<=dDCYxBK#j*hjvgAmBk>XIKD zZp@$64f=)oGdQ$u+PcQ6J@6( z`6}8iTYYNR$*Q^j{l`k@h{Zt4`k?xYi+U-+BYWG&8tFS;-(=e_m+Jc8q!eCtm=o={ z4lGT&zU-la2zuwL&g0tMNs3*Kp4ymAHuslE+Dzd99rY<~tw$jnZ6b-9jv3_e+%#=1 zH_#hu?^0WL8dzTzq2{JLwUv}hFlk`p^EkD#zTJ8@>qRzSWP>Xjt`a@#prin)GZ0^B z@(*7q^ABH$1;iI}Eh2G0Q`~@QkAExP+OYX9@4#dQEPPHV^$?CUDynJX&nz^KxL}wT z1C(l46dhV}PeySRjp{2oOBbW$V_S;P4`cpl_EYD)^A=#{miH~fRi$bYPkjQ?3yZQ^ zv>kny#Y;En`bScuXA|?wihqY=SHU8!Z8PMR~fSMbL6<>jW=K2)M+d+8JLbLtK&K@1Xyn0 zwY_iav?uraJaf;tomW903ak|~*&Q8ZoR^lSLCQQ;ta@#{eZG8(GkYAi(FO=F)aN`d z?(+IX%l+oIeF@31u~E$1o6m@n4j)k$B2*M2P!#h00%b25dnp-x%mhKdjyjaSD3k_A zIO%*>LXt${sHWgvfy~q+fuV2&U91q1;5FJIPaYBFH7iXK5+B24l!Wip@cU>UZ+pn` zId)>bJNA@$$ksW&UA=esB%&e5X&yVwF56l>j&gc53;PfzqA^?mOK9iHPhFW^1{e~C zC1y zV6F5%I(ia}A?C=285r%BU<#2wY)nI#keM(+@?bvlP#z0mJosJsCS)k%l|Tj+5*|Jh z3i4jePy-}>2{56_35Ol$MZ zdCGzpc=p!MJoUMw3l&caem${><++`~1$UZFT?t3^*|i51H-6vEpPI{a3$6<;Gz7Ym zLR>RbDJsqgomqv+;}!?7XD!K$Q%VCx4Gt_Az}}!H#jXc-dyGbHVZgDPVvB2oEsv_U z*mSBw-66XT#)Fn{Gp2HdYJ(L*ik3_+reg6RyCoWjmRy*c;%|lqbA-iJF?&v>3Dw`r|s=36ZKO?ZOwV_Tn#W|jU6WN?T2=q!?(6&yv5iE5^w0gfh3_c z({?Ww;mO^6n}pueWD|SmR=>(HuiiEr1kr!^}Wwi93TPS z?*M=o`EF>}?8%Q>d{(T9sDSnq4%Y{UOm34eHk<6M;wV#p89U_6^~jI1vD{OP7hes- zkeDxL<@V?W-zJBKU_|8>ae*c+L_Sw?jE}@RUfK%H( zpUdUOI~wPBV6*Oq%A(I9JEz=N9hqgv?i74&RC8SPBc5eq*1MPn)vNJkckun`b|%CfUDr3b^&1e&!-2Nl0-737D9;e z`w~@gam8$R(^b^#O@EF^jfgeeec(yAJ%PAU37z>q4FkiIYSuY*%oV!W{l(x5sREZp zp;j08Dsqq1sFajYS}QWN#end&7Gdl3JpM9fmT-rX^xg*K-i7cVz97GOx8w=8hDGiq z0|8GawO;u%e2U~b^w)Ce=2S4{1!NP+pr#h@*aVEBkVL(;VjdPKIFbX9hzS$=!6#9- zUNpE&qid!TZSYiBMGJ}WTG7mKcg8Hd^kaU5BUSA3DJ4a)8h_YNRVG-9Xo`q~l1ZYC z-W7roBeUcc#g#Wo(E-GwS)wGv3MViNjsOJ*eDv#Ykjcbou|fOcz^djiU{&)U{XSU4 z6$<#@%$qQmPi1w6X`r<3vYrxTr7V1^Zm&*ggW|>pb^aJ3MEoO6sp$s>v|Snm;s3{V>3)gS4Gwf&mJlVjc8A!uPcQ@s@J(6)^d!Wk z5!X__tdGTd|6{wX90_53)&~Lb(5c3zZ>DuI=cSDOaPWot~6G; zjOa1>OiA_TiO7$989>SmmE%sP;XoK;c;m@#1S%hc!pzQ*^E+)%Ye6>wgUIun$Wyn$ zg60%d2>zjs!i3}$lYODa;{)JsA(cOzz~^!t8=mV9anX(O`=q z$N0C&@2+<@NH#lBRx0`*VkwW%b)Of@@Z&^56JGqyaL};eNt>SKn4YvXlHL zw@tM=p4w$%n*Drfl^}XP_pjNS9&k}_vX?=KIrYH7fKp$?d6RWdZ+q3Zxbu<{5C!83 zDSKUtYC8qx<%kmNhPlDEa9SLZ+Os^R1BEI}>NMtLT1>xbG>&_TlV$z|Ub(DTw37XS z(c%+=lvm! zX{}>IdXyo@eCc1d+nVt=dfkg#z1=UM>GCFd$x9+E;;K!1D$&V>=I*KOW`2nN##x;2 zBB`XXkMu+HR^7eyqjyQvh;c6Rn~TZFtOIKbK!Z6UZo!8f17UA8zNDu^hJkQo60ud1 zmVDzEiMi`+JK~qL6_1de+lZ_Z4{$r>vEERksHSxWtvpxG$yFiu#}d}-i}kk34A?l2 z&nyJ%%f@ly+(d}iQuv+Af19MD63ivM)wcJ3|He~l3i-N9CMant>al;vx#EEh2wEx${=Y}UBa+)D?_lFeza(BJdHcop|P(YXlgJ(l}1 zncE#!e>P+CMIXted5R%$bsf>TSw6W7Fv88wXs)EoOglW_;1Ew>%FMJZtxLJjbMhVq;vxys$cuSq#zhKT`^=IcIz4{8p*a^hmRu&g))cF&xaA#Ivzgy8}sv? zcse=K>~F|PLZ3mu8 zuQNW@3y+73nr?kuxjQ8Z-^}Z^HWDcqMEZitqNxRckEO1lb)fD~eqa?b3|-r1z&Tpm z)Afx+)q;EzY}?DkiP^vUHTB9y4pt0VQ$c%tcw0vIH!*rstBwgEDAmk60wx@ACY4E6Cwr7lSa3F`u{Gqq{mQ7{!Ojv#TgjDY-Q0J}2b?H9pwAj&|W_OmW!qGc=$;9`vc_<4m&v7A3 zRrhzxp7&+*SoRy>%&Q3#M%v@Jvi)OQz^jk(aOcS;^Q~lIx$l8dlfV*XlxXkV>ZQcQ z^*S?al>fWTN+oR+Ept6YLsUbIN^7&Zrmk8Vi*(8w;@&ktDD8!?&gxs~fxZOo%kf`k zri6ZNKD)t9@hDRX!0l*Y{BfD*>*T@iGriwRx(?#U5Kf1Ifk;c=wJeCUzYm4+o(EKu ztkszSll6&$QG$zmHK$%=yf}gxT+nS-!2JtwG>4ryENlM_%~PK8mIa$=W05GZ{p_fJ zrDFGYd3iC)t@Yid_RYJU+%1jzV_ z!90J_O*q{GtZ*=mGgL*8SY2{hq1JH`b;hbcL!4;U#4?WjxudSN3vJ5 zl_Fh(Bh=MjE$yEfS+-1gZGh5;R@#rBFvZvTYR0=svQ8n@8SeW3XpMF0a7^h^QZ~jf zBkh1GK`OXGk{W`8=_=JvxfGFYADS~|#nvh8m1v51G8EOzUvxDnmk(@P-ymBP{=pgx zW-EBpo_w{t_`PrOc8BZzN8T@@s=5)_G(fVNEmmI(HM}pOi&iL-`^1?J8{bsM9bvlR zbG<|*Dlj{Wsp0ee$nf=6tu3~ZlzVM7hynj>mjp8Cm@B|SX*wP2im_)TfbtxShJyp8 z2vHs9Zs-LDu4W&ahNb4~Wd*_FKiegi&e=cPcEcURxoF|J2NX(N4p8&?{KYG!RoGQAR3C9aJfo(mwcg4g@g zMB9;ip#sQem-a7WxA*-*&~vm^EV*N_?^l|tEc%>nu$hmk7}GK+`U9uR@cc(t&>ANw z63<1r_>W*+T*n2_c4vC`BYsX~4Pg@TxiSMfVBK^=pk6{@^XkiwLL z5KY~}Pe!M=$S&d1CnUk;I2{ncP84{F-z%L<{CA3r61Z%PH;=xWVgbKltGV=vnR7X= z0RAKk_b$=VHs>|izf}~T4&0y&hpudPhVHu{?Zj;j=_^)b*C9CtHpG6cc(nM- z=EXmwMet041x(w4jVRo$$ubSd%xFv?h&G~yu1Mgfb}338CGf@|x?OVb1JNr=SNr5j zkSH$Jybs7dp`UU96X!S(GqHAxNbGw~W}owQkQ)+ake7sb!LAIq1U}=B&ym0O^i%fv z&4)o(TZFqZn3UQBJGY-8=?W}%qzT<}RT@bS{^L7aqp8Bp<=?XDHUA7Kd~QNSB|(pR zV^lJNR4mj}_t!N-Gz)VVSuY_4BjhF#iw;aq>DA2hRF_o%?rNvK;N<6Ri|ZF}LbI1S zswC+d4NFYC-djzav? zXK~%;_&2e){LuJw&!xb`W>Cj-@U~_lFX?of8i20Le9j%?wGB+-Qy{fD7zodc3&|H! z;C!v^&jFZq7=Pon2^I$SQrqiZaLV7d_=J#Pq623w@ls+6t1~p%Y@$I$7Rl&{afyzK zoWyohtKqaj+oh;&Pa;OdZHpt^G424=^dfk0Di)dG;uiLZE*zF!O^OWAcKJ!?l$Z$W zG8d{Ly_-)j`HHq7qSqO?1=ScYDC!oBj3dd*4A>A$;um@f&7jU9vmq@z^zTv25q25E z*f(KgnnKJBusv6CEvUda9e}ImS9Lu-3(Io4bGEfgj9F@IaT;vo0pSylSyw-=8|}8cs(u143}iO0pbLinluAUgV7qx!y}IWm z1^0>gv$upslHa)tMXnB^IQ(Uv|bJGx_OiqAUbu%`k_WDFB8ORyK|dw?)xu# z)LHQ>HR1;aX0puVnx>a#{pQjk+t}7obXhl!;DA0cH}7FM2Zp3Cx#(fS^>gPp+;8b) z5#o)(4^}{4YB_%tE8OiLT^pzEu9$MW0dQh}hAk6%Qk$r0eSZW8224ZK2F) z2FvoQbzOsU`V!P^3m8Ry`eq*j&->|31L~9%%VY+zm#K5X4Lm@M$vT$KV77K!2eRu5S-N)$kme!0;AsU_e-`>yydztx2metpFoqZ6H= z;Nki+(|`NBabPuo-$K|!RcQT3RMg1c=XI@m{gie3PaA_>x2AKQ!z!XSsLA!yg1;lQ zhBp1H%XeNeoCWl;j3EGu>eBWZ2f{+FZ0~~Ud^bouI|CK-D~^s|69HGEW+&}CmrK#U z?Mu%u&%DsM&IpJsX+A@!o^~r>sz-V~D84}qU^AQ`!2c`&2#~=HC^+PgR`AXjg;xN6HsL-fH{G{Y;i69oT1fC$ur_?4H547hm zzpB@MIXsp>N>BSkUbbk~^gs%rVPenM8wP;eiP1X%eS!*mr2ZF?OT+SRs3uh2?;gsK zEeNsswc0!$;3stm3u6zcRmhpR-AmwHy86qt8)AuoHR$$V2J5DFI~h!nDXCG%TWy3F zzU}H1%rmY_39gE71p`q61yr)NE{Qx3(2MNwKZsF#ZmEB$K>QfM%fy>e6M=9KBe=CQ zT+y@-23JAg!d{(_;3h+z4jy15?&2_Ht)-T!g+-4XlByJegD(oM*wE_en1LOOoP>;u z3aK>#AYk{$V5HQL9&}REF?#xryv?Z<`ZhxIqA=isN`I`OxRdJswBs9jl^zMd56zj$f5sHi}MPPE-p*mYwoTpNT z793iKj!3k)^jtvDg^y@-#)tEVFQa9ZRyAU?sbM8FIwT0K{Dbl(200l}^SFVcYGP+# zbOj>xpFEM!obXIHgVTEj-DR9JgYcM~s}8`VMUcL7ycVO{8~_})y<7e?3q zjY8v9){yHdVR0E!ipZy=aWKgxlFo^<@^is16r?>`|E1^XLfnp}UlrQH`3bU}lYlls z`{1V=V4h$84kz(*HX&-_t2_L%Xh=5%4dJHXP=5q^@tne-Y4s;VL93qdbIB@R;rs78 z*G|_o_a_1!6Ce4=*H&~p4kcGEQHME^w-`iqTO_W zJ2n`Oo3%)NHv!)4x%0Fb`}fUKl*!LWdy)FT*|@U@_SItOKLy?K$bz~zhlY3Tn`<3! zm)|0^w3aZXG@zJ%n?c#pZ*Rm#2WPIgWZPjHZfwNzhjTUaC~t<@tZc+qgk-Jg_VD)q(4tho;9!aqoNTP)J)al0aOQu6n5sIe*W;|9=6(g}aJSext-l0+-bWsVIaOijV{%iX`}1SRu*oqzMq=;{c?t#_ue#F_&|1X<^WozmtQak%O++ zy(Lb5^fX%C`nh-h*w))aad=I^2SY*TgEBI3Ko;qJrVjtr(@z{4I@F7!4Ua~kKHJ5$ z?NY~fl9Rh`=JE#Z^+TCJB)!bb76-(%JH)V)*cjwKrbBeY_?FXAu&tJ6t!Z^^%RgRu zpa2kH*#E_vulntIhQ{a&AFtw#G>r2IKuKo?gRUlP)2EJT(XWPNF{n1v0!2bcO|NWn z)edoI-zHRl)zS;MeJSEfNN14w1;fB-;Q)p2$wZH?Y+8!JqQ2C+LpjcCKVtLCIZ!T* zN7$fi;ukTR*%W*>i*x8Tx^+{=k%I(Vx+oxMt3VUZ|7OmE{!Fgn5=X?BiS5rz{g8EZ zB2crIe}DM&II&@~39 z$hOl80UE~g)lx{6O&3a(;FODKlva!WMB}Q!-q6IHC5zcf6|)V($wVX<9V9CKWS}Vx zPZr^qqQs+Eh(d)EjljtFu%s@fOcsNeDgvWO0kED3NJ8df7g1^LMa;VGiDZ*o$r<5L z1^A)SZ4|257!_rR;L5T(QmUm$k_``>F&l!(045lQHNbyZ6QXHKsj9CDsaX>77pag? zlm{lN@s5`LD#VnQQj}a1CX}p*B1aKnr6IW>4=|Y%kV4^?Qv1H9dSs#QTc8^fbgcgVoQ7bZ!6r&d=K`U8_5( zh|}F4roJptc$gh|v2gJb0TU>6LSkAKwtUzjarkc2_|B&oyN9t}KY_uqGc%h#C0H8>Jga3~W$K&@!hPgN6NKY_DFs!V`?#K=V zh~%3vI65Zw8aP2AGB~Kcu=a(#dbilq1)SVvr{4gN9n@cw4POw0M!~$uyGq6{56tHv zGl-iCoFINgL@44tkaT2_)Q>o{FU2WA$)}R^Px?{)fh#PfHy$-X(UX$ackCDdk=b?7 z!3W?|P_N6H^p_R!QM?%F8JDe4Jz}k#?&tOkiA4_?&1q6w`6W_omUj z@fvZoeOvc7_U)`7$MjGaFNgFm-^H_SUDl<*6 z{|!gYd8QsJj_iLdG~g&CfVEO?6PAHG>}_4Qy%`H`c3i}mP~n1IWYTAp5a`En@)Dl# zQAbX66v<&KFfNHWU!I$;jau=C^>anlL+wl?{rB2d2OCCwuh%b9{ts!#hZ1$on}j!e zuyKdQgR}{T&B*FMv~3L)g@=W7WR5S;<3}?dUwXJ#!&Mv8wRG;`fLg%vCXS2u?(!xv zj~i3$W|Y3c)86-UdHgrzVS#~KB$BnT7A#-FDVW-r@b2ZbJd9WSJ*_T5?HzdBp)4J; z3gV$FcmTVq=V$0ME}HzyzGBFCeGP^8BWz@9C3x7W3A5{oIVe`H!kZ!xft}_S)ti?0 zGj%;B0=Ax9ZzyaiKsa!s&=zynYVNHmylE`KpG_oBxJ#M19|wDKdW5+%>HU4H{QmWu z^|91a=ZQhG`m#;eXG~MuTWof7Yw{*ml>`*L%<_*KWyZRIiU0%->r89yiY`a^B~S#Y z-mMa6DZ(`_U%iAlqJqKnd|aWqqgo*(653~wDGi1-m^;K;!0Cd9LjPqZ9?Yetr#m>q zliGe{n6*mvbS7kFB-*4=Pb`lvDWE8+EZ6w1=?`eow#6$-#1H)XM12o6B`jZP9p2b! zl)NkoBQv;Zs`Mz4no^?SyEmd~rucD2!b{2i0zD<|apk1~ zI;p9RZuqC4&u>V>Fl#KzFI!j%KusA~T@&?RO<4n9_?=j5V6dT&M6WIEZzd?AFi=q5 zf)zLOh#+z11GN;~A3-Vo75YohhM&UYX3-ph5WpfA&(cKUw@S0wILcQJG@bqVo`Kxc z!bjC8yPcH@TYJ9Vaart$Cq-rN@vJJRyGvsw5naalj`(OZ%u@A?&E=n(?ez>}F{M0a z7K-C{bYu!TB-0e@e7Jq2<0-Jxn1%Ze|7~*r-H)tiz+e7)5SWzR`{Tu$7gy0NW~;B4 z4KSthxr6cZs?KP(rAyOds3K0nB;6HK6-y?H|4sb}F67*}c!F$X(#Zk&GXMbrs<}q&g2*G zO^>duTLk^klIFcsK(cK6%!n*Neh6^3e)$A^|L57TOyUJg_>8Z-OeA zpU&M4n#<_RdM3^nr&tN)YqxVuT{TB}Buj_BX&-Z^y%Bco?B82m&6fkZIR7H;O$gb% zq(x{E>Rt+kaQ{ITXLj`a+!KR3GvPTL@b=$9FoE=b-%qTj+?W6h8n)zjy`DecQXQ=tC=zaWcwoE=Z+PD)Y5Q7pJTp57BxN& zkjS=!DU$!2{RuA>!X{$clF0LcK34LM#S$PuIXO|->g+3pZ4vkH0r2y1;Y&I@QPPp| zoR7sTQT@2F+b`Dk`}y(i>`%AXzs$`O<@pyhO;6j$Ju4yRQkjMTk`Q6v9R;H2mxXVi z4_LC{U_+mDi1ap@RpXfK1CRvdV){||=}UtxHv`}QZu+~>mBamQrYo~nTl(?T;&6h&wtUUJAgt!A+%9F&g!X^Oo9^N2r9=)Wnwv|==$ zomrb5erC+JPZ7`C?SNFv9Pa~>c5Q-B0+56bx|F+axJmh3Q`K7dqQuzpid3+JCK6Ay zoWmhGqCR=yFo$3^_oe8{C+yV;9M@WaW6vM{ZR4J2-FgFo5E2?N-UD0sZbAcVh>z&)4<;Ie0@NoH`Q z#u|PqOm`nz>Kqrk-e?&+6}vsO-*{sMsE+9FyV$&8{M_@tLC%2jfslb9i{*q*u!wl|{j4ZNEnwA-iPXMr7Dz7;<@3J!QTdiJW;s?iU**EJ2!+Ms{Fp!xJ zg+y$@sqG1QPJ+&`-`6~(sV=^oJ!iNY@FhNjh|yW(p1mLXgSI1+!$B0DyOsyxax*6G z+zG`QySVzdyuNdKul(T)i7SM;(&o_I%DLK+A8B|Xn^U^BTwHtW?t;I-O%PDB%yekl zyur{h78+E!ZJ3dVL&oy0ObE?6A5WBpY0nVD*#O6!MgKMc%Pn3PcH23kZKpBJf!3^g zeN{+mb4o7p%a99wYgA4b@jFihSQH2y9tcXfZ>!Yg+;XLu8P76>6!> zY~~}(DLIaG%#xNK8`Lko5V(1|;3@3+vAip~Bzhq)&-5Cd!#+4CS&TxaGS3WBi2*WR z03wPBf|A6;N&GX~BxvBIL>t?!gJ2hgB@scaX_Iur48^`Wyjk^mDHuS*n8!T0RHp!t zw4zvRR4HQ_tsL}D)v~3mZ8aEnGNfPCh}|8Elv*)6`j411|Ldu!QsNDh{Y0bz4MF3K ztI&~Z&T@MwsG>VK`uP&A*2r6VAofCs%k3<5@XEj*AsDW8MTRdkLiRAKX+^C;C2Fz( zu3;s}LX$F~v0ru%U;u{OZu+@n@sdHpipogf@Vyt7lvRz1+z4s!0m8h@njv&i)PzCD z1lg^)dcNu4H$JvhtggSvKYf6S-6C58dxA+$Vo?H{PQQ%#HUe6!#UXD1-SCf<#uCEt znxV$`_sGmjr+fD3jMP~r9;r2P@xwnYs^`KAr18*)W-t2yjQM*X%;+cbygk&w15iT~ ze15on?$e&il!g$ijN&p`DZGL_45>__`O6a(-e1;6dA$zhM_A`Bk0miv7cWtn;VyQX z9)!~wz6O|F$h~&OQPV%M=Zz{;Pb7HWXyA=I{7)FY}qkiXZV;6;1lI9F}+w%F4B(#wcjNlgC; z;5h3VxKKY4!=2r~nO1!+C4H+|AffhMkR-Ao9ZntDCHI6FC1k%HjyTB6ySIqv1L;`U zJdGKsgpK2>*04e;MVLSG`&1UK_fe_e7~ubk;(-6QKV;Y=OlyvK+l`T(ZJJc$MF`Hycb3HFd}kula`i{b zrY$z9?`>mpvM~NMuQN*hVYoOz>2v7MY4hN(W&;@$C0`fV_p0*PCC&U*jK}^4h{fx; zzK~Nnt_5p)$(^~4gEH?y>FfJhi<_W@GLDiBXUCs^7fLU|O?46(%m$H4o&{4!xjQi< z3S$l}Uu#xwi5Sivq-pS%Kcf)@ySjBO|5D^{j?lsrYfy%ub;l63WexWIfc{mS`PNZ? zmrB!2w^96pFjh^P9EM7PuOlED;OsoMnQP~^@*d$kO!9Ex?$6qmeSCc9)5IzJV>r0W ze!SV-2c5kzlFDeVh#FeV+-7Vw!-4~r^oA$fMc^Af+0b?~o@9S@8W^`NzH)r_8A~mL zU}OdDD`AzXlUSh7;YpZm%*X-AM0E4SwbqgZk&`=Qgxq9J>@gyy;FA9gKn|FNoK^iy zj%2!{f~cL!CBFU%kTO+&MMKs*Ln@u$>Bt~>>eqx_6Esx48L-!Q=4Z0~9jl@Taz+pN zW43E#J_%a<<>$1t8H8y}Zu|uDtAz<%0bwY9C_a|?J294dv|!LObw#58CGkHAr&Dz| zq)$-e-Y-O*)@`&8F2Dug1>*0cUqvR85IDg?;qQ{94e~;4u;E34S{3mot8}Sr*vHDD z1W<|*tZd0uTb!l@M*44*VV`Tqe6>ae%GGjJ3z=lIr|HMd7xw3&Z*VZ4>F2zEPV$$o z1`7JbRC6t{VqL!Q6*`PRUoaLC!L&I z|99$wl-pcALpnaa-g>+!VvM3}bk+30Z8okRZkU34XtikX9M{p!kvoYtOAS%35S$9x ze?MhAIMLpzlB-C2BvW)#mg2A3obxnO%X^qei!Bxj{Yrbv-2`84I6sWHSVGzF(t z;6+g<<#uFzPKuF-Rr}9wQ4(JE!JY%cP^0a@nV^-6F%yNufP|8Lms1ZRUcCr8ry{mA z4n=%YKy#FwPT3Eg4Av|mR7P1iMj;5flF#B~U**4@r6F4fu=Y-tT$RO{q7##ad&MdC z(lfU6uuYc9Ya*z&KW#a)sWY`=CMo+w`P?-=`~vL#bsU5v_}MEeVe ze4=p8G};2EQf+7?+40o`6*$!({q-XRWAAqxV+xCwC2?>Z95+CH+~Jv(lr) z0aT-ZRGI8DW*Vi*l}T65nxY*`DIC^~I2N5a;6S!4jA>gYYP(f36pW<))RiVHFPfc4 zg|SS4)#`8o)+&ZXnM$hGy|3m`EyhAnJwrPVffOucJtnA6+di(9#QpSsY%UH_LRJhT zL9jOmhPL{Fp)EY{GsFojwiE&k&89lE{ z<#z+$Qv0j>s0aNvxn1tU6M*-Yd|H1@p*&cP8U*)&H@=0)8Cl`m4P&DOT=T??Vz`))IUhVIWehiSXsX&pN>+~W zZEVbZuN0J_z{P)NSy+D>R2MC1WXpHIpLQ&A_d)N=m-7M}tCqWkWv)(oC&@Y|&!yJ> zK1#XT-7L9w_V7?AaugXa63^K`5|d-2!hm^Y$yYQDJF9M}_! z{^%{nUcNou=-CmQ?OxSf#njHxT3Fp#n%Px4?#x{p>DFpuXTXn_%|INK=L!OCMy(5C zg&~D>#V4m3#XyYvqDz7aF1j%vvS&0JB!^(b`pWG5wWM07v-M0`?3>=fjM>-i_iw z-!bXrr(`#bsrN;?hN6p6--WN@>fu$NT3fUG9liI>r5tmt;$G{+UB|bj)&VO=t*)T@ z%G+Oaajm9PgaTttfVOCQx84}fUwoSSr@Ef8DC<=j?RgS`Sl)SC8ySmtl-p|^3~<_< zUQgeCSR-ST0nVa2icDp#v_nbHW%EdWoFoHtRwfQ>B@0dM=pkL{#3)i*u*!eXH8KcG za_2I<4AGbEdAg3m1GbXZl>Mtla$TFX7)$Ss8#uK=7pp09drT`r}y;OG9rxr*GKi2<5>BY z_T#4xR3h;Kf3oh=Jr&sG$N!M_j?r~L`o4A2*tTukPGj3_jK*F`W81bH+je6#Y;2po ztNrhN&OUcM=e~JfWo5nmjggUL&F^PU`!ta6`apzXTlrjk=l-cjXyW3aLV$wIZ_Xh2 z6olbH*6)T;a6RvL)x_qBHL}t~1}C1R<-QRgcSWY)M9ub$0(*Mq)Mmt~I1&1qK#qgD z=L439h3EZ+SJQ`^=Aq~I-kYsZ1Ul5mQ8gpFg}g3Q1wv5YitkKuIB!14 zKsmr?F7^G!__dMhm7x24Ectmi2cO(`BM$BKP~chSclQ9VL%1=$bUxjEP{q!f*|4sXPYV)-|2?OnDR9^XxgzLipA%z4?PqBu z!7izVGc5~d=bptF$cqA_k%CwgN8VQ_(BVRI^Pn%Z<%?G zPWoWS?TK!8$UnuSdGXTePKj{H+ghW3l+5Ug*2$GCRm`7Rv%IxZdj|LFOhI)h?OQ9m z{L7_lQ{(E7$O*!CLhqpcD8)IqqY1x5^S6iG4V@do(`L0QOYcT2e zqF}tTUzjf~2{(47o^<6Kth_BL{R|~`vgNCyUd<5+)uqO#<;$4uO(`bTh3c~93ov;okV-sM%fEWz2 z?J4hfy>4C*1ezYWvmxdR-#xc6Oe-(tYAMU_Uco z0@+LEB<3Z1Iwcw0k-$B`(RxAX8R%{{_&7%WA+J95DEhu-_%ZJw*D84Up%s(mcfPv> zc|mbGz)Owao|U;Oaw@3HZwW(ipcCt3Yk=?ZvO}Wx^&(D{lgsW-6HOFLH(Gj>0-uCs za~%fey6-uy*5h>)x-1I7LQ)ZZ<@|2o@=LY5^#Y$A^pXfSF~i~#(wG}T+c!2`f4lwL z43yk_1kDhJ7dFi@&DzD!7V@5I;l_N3L<>^Vc7SLx+Xs9Ui0P+wPI*?XWty`BrjWl=yjkO9 z>kQ^##uuBfTcTj-^!t=Z_saZWlDRI%>B1I5FA3Z^Q%pD;`^qPsfY?7KLc@)|8$!Oq z?1LL37+7y8RS!387f?=*?F>OtVbqD9q0-ML1s;TwK}1>-ICF*+ch={~$4m>=zb*`L zLn?~~v!C|gVkCBhjg$Z60{C@6xwMe}5QiveC3OujGANXb>S08D2qn6B#_2aU$Yf+Z zm*_txbC}@gozFyGelyV6svUfaa*%mZX><*sK-JFX*W30U^f@Yy3kMq=%&pzJYg5LIl%`ei&!cI%bV_YWa1-VkxNvNL40Ki%wxGHK-W{Dol?J_Q`-LMBJ?n+wsc!np^Pg*nPEJ zLA&^=2-So2i061OlifO%5|w}wFb%c{vNrzg?Tdrkkohcl(^60S%FX*b_*$jlavC$Q zy*DkyJ&hpXGSrS0aq4ogJoUpZ?!tky&3c1!Ny2*n1__TsSB z?VbqEe#SVT6W#0a5vQ0+J;6MAl_X6CalTE;gMme*uMt3<_e_br`b60AkUrxmEIJ>F z!b19dV{+c9LO;Aogz**Z;jn(aIics<&Q!db_g(~a+Ud3}Sd+96|9e3}ETVP>lhc2F z@WD2RY5GJw72Mj?f?>Qjq~#w-q<=kC>iy4xLW^a7L0cpFR@{3r*;RU&3J|>Z`DeSQ z_l!`<%M5ugq3Z)&muyNPSIOBOwz_7>vmc%P^Jkt2sfXP;)5kZl=@p9G0XG?dNe8y? z*~gE*bH-$J*K=q8JuQzN3Y*f^jePWYE=40~P)9)0RIQh0Q@bzjUreU2Z zX3Q_k27wLXfHdk)Ar~20t1o1c<{p`?>X& zKeEEL+lZ*p4l&Yq!T?UFSFYrtHxOL=&0G%v4JI{a4rAfctf3^;1P{`RbbftRIgB+% zfqFnXNvW;B6hgxzu3!zLeaT9i_v1ZS@@^`%KoBFDPR!_9iuiML$hxy+L*b`&d8G(< zq3__V(8>x1*^A`s70+5l{npqyFSU0>$x>zrV2OsgI}^9$U7c?79aWLjCRJ^`$7C;n zUrAv{+|>!7G^KW4K1-bvgWnWTCG|JIX=V)`CxDs;q(nhbXW8$!;{5c7Ve4kt9d?l& zIxmy#s5RmH0mN;oq{M1<&k&huxWL-uSUm_DSE3Fqv ziX&vOgi|ak>}7!;+y$xd*d+~m1z~~!XRv{e9|*{oB4BYf?rMlk!`uBHEGcoLk$tsV z22rNww!VZz%RNh$am!30Y#EW>tS4?{uT+5bU%bP*2)V#Kyjj#$Q9h;5Abb_jA zYVCwopKYs67rO?kK{CZjGu8BWl1CRe`<{gw&k!Tt-Ah)WQue+w^nHbQ!3QG%j0lgg z%m81HivD)FZk?wVyaRq_Sh3F0|2}n3#STe5hT{k)A&AF4R)+Tj=|`!6Xj-%;VGFLQF}>~fh(Q!V|;H(e04~ZI#i#1 zP`eu13h?lix%dLG%K(VY>?6B8KZEN7fgeVAKi6+M#9O;Rz^`!~qMG_I@Dm?yjpvEK zw;yazUJSlp!&u~?I|X!FI+FWj=?-=_{Na5qh*uLwK;B33aw*~R9mxAi7$I1QNdG7A zdwT)$KEw8(Isd`?0RIX6zEVXES9zi{`4S}?8?~)C^LvAEhG?5c%DdYSyOCDJPQ7Ia zpS<-84E77(pwvd^*zbLlWUv|Bk)*RN+L0`G2&#~zvNB7M4CW$TMYJLpNy_8vYZ%si zu|cv?{++4jQAj7+M&g4nT_SA}l*R#bu$+Yg=*_xMeu@x*bcSIpP-dD5BMfZ5X8~I+ z@YbjlIS1T4bP0b7S+XK0%MI$!vRwtwieaYYZp+{d3ZH945KoGszd)Lf&T7^xdFTM9 zKa+un()JlH2mwy2Tg&n4{VO4bbBFi1=cYRN`mn!c1eI)2UO9r8c^)NmCC*_vp;5~L z4UZYVnUeuOq`w?lgl$yg@WEGK-(GXznFXgG1f~u6eleQ}x$ncY6yN$3<9OBr?Qe)A zyn}%T65)CO_f$G?jTM7Ty@rLm#w(hvY|(~z^1Fel*0+0HMCU3n$c_Ez`MN0s=XBtlSOc0pVtM;EhR z_!(tUsc~URx%iWi_aLnAwj0Wu^9)j2;gCI|N1ic34pbuNJ`Bd6PjMynW3QF(9((a7*K}BzM``$K95(Z z00IeOBj{+|BnES|lN@{Cg|JRk*|4l>;hj6AdHS2^!plVG=lJx(fx)g9p+Y#HU5bfj zY;)(~ns>#ypF)k{_=J6%u17Kgly1)eyBM3K38Gpc<$*X?go(l60PR69E8vGo_Z}G2 z8F2@C_aUllpAFKs+N42CLts*Sb~gFq`Pq;T@EZakEi|uQ8w+T&2iqSJWQT-$FlOPd zMG8+0w7NC8b>#jA&OF~~sM$!gug&VzYpns|xRCJaSeP0&v3Ca{NHvn!(G}3DSXcfP zfnnXHIvN6BC+)7$QJ2dB;K|RwHjS~%otlyqiAN&z$D=9`ijIB6+d0}^_I`XUkvp4M zqQyJLZW3gT3rUOw4)mxJlY$eQu#P~AhppPiVgGc68;EHk!zZ?G=o@X;4O*k$Imfte zhTY0wj%P+MS<%6i36ZWA??{mWWoc{jm{y^qqU6Ln(_)OGz?%TDtZOO5tW9=enGaDo z@ZNSeVpwf`gUk+dD*)bnhp=CW^PaDH#NDUHp=|k*YS=nNtkh+n4l8Wb0{;}K4sayF z$_%$)t1I`J#axR>v93#Z3&8Y7W|$zCiE5R`mlZZ`nIytzFk};#>@Nnhr_vG;A3g~d zKNIQ9`6cICJyZ*55334}gzx`x=enALp9Cg0RtFb1+CS6z6b#8=2OIc21ViHjYq~Fs zAsK=u0*A$zL`?;+jxf=_t;Gj#6KeRiK|LlXM0uW7hxW7d>roj#M$33CvmJy2G;Ob)FfRxE4W2=dG*XBPDwEUT@t5I$;NEC3+wWrXyCTS z6w}J_nIc~H+AS6r%JF*r6@L!LYcIV$@wW}RW#ka%k|7<2+5f%^hwKaeuegWW2uRy@Uh+6aa zmW!Ky%f_(>#Z-a2%TlJZO#BCBK*%ML$j>+-bG3-6a%>Ub2+* z#V%yf7w0$jI#VdvTM!@U|u5$;@favOg)@uCenFK zsU(-Gf_VtdW!kMqxqXz@+BOr!^^yWm5a(76BS$8$I zEc=~NH^gk^ig6A#ImOKxc=6n3C)pC4H_fsr5>#HXJWQeVpo_f}$qFgFHLg1-!03SX zIDnT~V3%19aKVM?ZnnK2l zweBT;h@c(ks4#;8WPkM1+-PR<{ptCUs6UW%Or|sd^Z3YCkPW>{-t0D@%s_de#76j% zKp?Pv4#@#n@`zTRGh#Uk@7W}p?wktsEw{}F3=x-yG8!>u)0RoT?tEY$9wc=LZJgCU zqrJw6os3RiOFVh!4>Pm2Wf{h6jq!CfPzFzk)xK#=qZD5qB;Ssg(A4a`0V* zHlQ~G`YU$Aw+^qo4Nyb~$~!?8v|;@VeB%M7R46ew!8xgu(Brs5BM7|$m10WrgwJ1P0M6zNQaJ|d>;er9RNB6KbYG*OQSf7sXKtP_m^*)D@LZq9@ zfE-h{fZT}mw%*H->!G!j7p>p)2bo(JeH7sWbiN8zSLDk7P^{i9MZYpler-(f)u;vt zR!SLW@aAf#OqY$6qU^BIUTGIS24#4w)CshW=ja(I=2cQ5FQCyKmy_SQta_Tv@<;0A zXi-jA#kRyUZ(c-rcuQ{=TmJevczIUgPUGbMCA)(?po87KgI$`hGDSZkY(wzG^~=w8 zv#xf5ppyiQ6StI-HT}dNjFPD(qN&ulLKe%}YZ8t>zO$zivsf&r$f707swFl|jGm`9 zD&Z>uWWD9PF-QdHhOQReg8d>zT`VI4#suJpx*_tR>ee8p^2Wi)6i1HduD`i-qGs=X zvJ&@JpyDl6%VZm$#JS&32->fTaN?xlDG$j~=4VvqU{q$b$I5P13ut9G=ME&-%fQt8 z2A!qwE>H7XvgEA_*ENQ*xi@F8BhM9?mMJ|1kf+;9$y+PIu$`xF3MXF;TD9d>=4`^v zln-GL0Zfs0rWCY(NzzfZsVWYy{HeYe#QnXSAtU2<8D!je**l}##5x@iJ?mQ|-ZDxPNdZj8L&%tV3} z5P*(TDN=$?WU4+Q?qtfE&7xr>S4clB6Je}l5*CJCLKre0^3}_@T-2D4I_R7XA*BN5 z3kKMHg}?TG&qBK)%{N1DYT*CW-Q=qVl*%>P3!QST1~f1FWBvM^LyXyKsXB!dls}U5 z#?9k*WoEZoVI9kpTjt1H&UADo;~9e60V$FivW2A-sB@$kjULDJGHh^I6A2Y&&kbUV z6$CH}S13DCppxZ0=VUcGYiCW0M8OYd4)Sot#07|AxSKyh_R2y+4e7Wb7YNee@{B^a z)^>Cn6WK+Rjy}T7NkfVb(SCg5zd!wZ32qrr5fp(1`ZY_4^$WQ0+{a97JVXfK!G9!% zUfAVM3Lcoe7LNlTWF<9wLVthhV3=;{pxcz^!YS=gc-z5oG-U%!1<>r#xM#24esDg} z%v(%ov!8n#r2ft{-C-!|vSHFx6z8w3x?+lF$1|ai3+J(dj*JSE8*RXfgnGgr-h<(f zuk-9jvXJ}u<&2w1cQh(_FnS6oW(Ud_>nqmL6LsP}Tif#8bpUBH?A%wTWi6MHH4&0F z7UGvjxw|r#Pt-vY*>~VchS_@gHmKL^P&MY5!LBF$M&>MVA+Y(t7bF$ zD^Kf$3UZtdDz+UBpc4Q?Jx9(g=B5mh(%OmUpr@u8@kaL_5=PMxAk#p)@pef?o*}KF zaWL@lWj}wqHl$lFMt9BkcxvSq+IKMjl6^$K4i8t14mD31u;{mPf!(54j2EhlwToT< z*@|8NV4PzpuuUG~H7S+)lIEN?>$y_X5~x*tEd%_PH;ip~Hd&iI>g#&ys1}%JlnY!Q z|Cd{Fr_l$>LU*67n8>J)Kt7m=pT*nPQS+hQeyI4Fp(}QSN8%O1# z{C}Gj{g;TDB^R(fWhXKgn&Bl@GDXGwXJ}d)&qjYWD*oH7ND4^m#3)gssbv>X5Gv-l z?{CijG|&5>Tr_2@98og5;1NNibc6nLAV@KuMiv6YGeEkav)r$@uUG=2IR#0sYj(lS zcL_s+;iH>+6VgGdjt70I*&=Zgsjh4PC$(%)QzJiuMN(}E`?R>V{TO?{G|4%AVW*Wp zSIqga@dkInd?z3qVrEOI==JFGxi^dNKAHA28WPEb_jMs^h~!$CB@r^(u;?0d8vmzN zNTD7UV#3F`$aE>ZD34KWhMyVM-4Q`&<&Jp-)fT6^&&F&nkd%DqWmb*jNs?*v?bP+Es<+ zJV-qG)E$Hm56t#NNC$S#jsDBzm6Hy>SG>eUjcKm6-IoItQX<=joa7n;)b5X0!{56} znq4ht?``npBBS2a9T&%n;2EzQ%%FN5*atr~Ze@=z!TkU!8&m4uGLmmaU9iibI%lbG zdjdYKBEJFJsa=bU#Ca(kcAQZ&<9%+9YFxf4h6DN8maJTvT^P&Zg4E64{96?_XG~W= zZcaAtt>4eT|G4cRd;aN%PJ{S1tE*4_BcmBn4G%i7?ln(V^ODJ_llJl!#zhn~MD@9d z>2-hL!AkLg&u1->?si0gN9v`WglcKp`zHCrH`Emn)!GzYH90Zn*_vv>v&jHc8HsOT zU3*{rL>s!xHd2W+cn@moc;i74WFzAF8ML;lkV~d&F5Nty9ys!4B|}P74jL}&Hx43U zZmtFXLQ8GDN)Zs%K^@Ra5Y4*)%4|#Tc)1ej2_Y!Q%_EDhmBV9%O1M#w=%y zHLL`u>k-UQ)Q>G`442IuEK43Fr8Pi$mXADq1!X=eW}Ozu-zb9f!wAV(3Qo5+l(r~@ ziady%JcuMs3~6v1vL6{tLMwnVNti&;2o?vx90XG)1_r+k@`CISzSWtI6R7Z(NyeFeT{<*A`NCz4`4IkHsMks+6_a1wgba9m1& zK88C7iv2Z(TMd;Ca~FGtU|qSj6qTmnJ6jA2UB!VV)fxsD8-^jB&y^`E<;izeVCFi~ ziAzd_#V(dC5IQ2>8cNw1cV80b=nGls$|h9W>k|s-ODRsvMrB^=vYc!Sa3;!!=(DwC zNHFI^5Y&v(1hf=kG-mxd77Q^qG(TShlIOk5)eK;KH5GoU&$@6d=+O{piuEnd*cYqm zqI7A6%nDhy9jMw4HVLy#{HEKwFlXq^7u_VB?@NP#g4(ivs}7%d$4 ze(c)dgB+Q>{DLnSaCGZzm@_LEYQ{eS+G{pg4QB6p9HROr!uHK$DGEjC$7099Pr6oe zGCDANO+S}tn2hH? zBk1m!Rlch>Z!|ba`{@Q)iosD%i;KJb4wA8W!@&j}25%+txuo=>c`Gt2ic-mJL5W#y z8R{dQ-m__e`}x{Z)T`y3&Vz962Q-1 zb-!2;&Ba`1C!iz=clZV9$0@RPV(`?P!dO-rsFri&yXK2O>_V&Niyq3BSzU5&Tuid% z0m~%OlYLrb1pHN>E{fHOiRJgD^?&>nr^Gj!ri@S~63Dfy~$wsR5!pE;nXvbR$*9UGvJe}*Kq ze#;g#(8;N&b~jGi(goVs#Ry<%p+@to`1f|+M$5Bx^`SZ zx?R1j?3&CH-J8ssMn1LtBqfwiWl<(T12myvgMAhx)ne8`8Q8fF4}-wh2=mVu?uYTB z`Tp_!y6S0^kC@Qxo4UN;*q7iOOQzm|B6EspnBZEi^pkN_^bHu$Sy3!Z?s{vWluzQ6 zmBFBaQFWK1Qc)rTM2ibS$W(SXF02L{%wLNc61>v@KK#sy<=3ypov%Jm^OudP*@*Qr z*U}VMW;4!nV_a4XsRfJplz?2Q3ee`{+rLgdu3O(d2Xpm@uPz^OyT#&LxeUUt0W4I@ zNrr=ILwjFBgfc4l0b)MU;iYfaW#4{~!$rtKfqfc^5$PM-fhVM1lR5}t??&&1iqo|g zz5tAOahg;g1d0K-*rV?unoV-NPijIJw3lf~AM1&8%wdiDZSw>Gs7Zmf3EUGxv5M67 z9TaX1%@m z_~3l|qvNFrJ0E+?c6a@_L-=A}KjFSTgV}GmU{Y$6zOa=EWJ>*&1JjIPBFVY*& zLt-Q@^HX#Q(f8F=!5@z-bk7tP6t1(Ol>&$fpPZ0JP+6cTCaIeK4&lhd45Pv8{2BO) z_Adu8U2udAC*-!Xe*$NteFi@LjQ3TYciTvN%G{wi^Ew=1? zi&~SC@&=$bE&SoHHcjyZwk5XS_4XkTAa|cHEhunuhUJw?59J{D^O&XLJN)gt#`;aH z6MFpFNb$(Ub7)ST>_O;x5@67crAEb87%$@Sy@m z!40rIcFE{~tL8Mf$t7Cm4c>gLK2Us8zO4BkdNJiJpDAv!{Lf29&wvD`GJjvdD?M>rorGww&j<-2o6fl)!s$R%#c8mFEc4HfA`M%D$az% zEN9Usj^YbAfDCcZ#v|Sggd{e+EWTNbbubHQcmjA5$lCJ()`DK|-{E&-!C=gDDb35-Z-jc5%C}D_wrKX5KhHOK&=~cazy>=QP$pW)2-|(P zs%>X}zs_}AJy%&VracD?Y_B$3^^KjzAuDo)<_1V?rTxnB`AE38^9y+g1#{eK#LLtN z)VuKkI3zH~OMW|lbVmyar#_`)84~TwZkm6zRS`}59UT7<`YiPH-9D4a25_a{eS80E zy7k=79X3+Hhxggt(FLkN7u}y`XhvF1VolX|a0}FzNQTe>z|bKEa)Ips`V9UHh%)ga z_6R@dQXs7UpiE5E+J5jIu*#so}{Sp0Rs}5 z{_`lq;7G#-2;051tB|l&5kQhjB+EiDD|hY=23KMGvu%8X{TTPtX=!&2S!GZi!a@a* zWM+H+i)7aNpwI~h@$>zgWMWtRZy@tKiBSfU3F2dVJOdpVh;AM%2poVLHL*nk4gb}=dJK35h?N_H3c(H zIkHf7v%9)^*Iwznb$Y(7+gs1KxobxiKjTBta@FycZh68zO zG*Pow1AAzfxce<^n>^I zf_Lia1Q7yEN(lc#dg{?L$=S3F8VBO6dx+|}*8$%M`RIxKof4aL)nEK$ z^BAsG*F|G8;`SYn&vjr239A{hKUmL}5|A@BSaKtwYfGn7G4y2>Lg!4Rkv=iZdYAI6 z7IpMSLcL?7&lEBaOe$h)wh;shP9+v<9n`hgH@3wl%z+cqdQ3)EXukPnD_tk0KSm@* zVNy7;+Z`<2Mi~M411zedF9K1?OzPMYuHX!Mtx7K^%xWC;ry-{2%vHcd?vw@(zzbJW ze!{XGpW?i*&`E7Q!h?(&MJgzw0KpiW8eQ}c$)pJx7}auv82)O#^FK)D|0l>q`W9+r z{Fh@o!s8K{9JB^NyRmIh6Oc|~+BAtP&e41y{n_}U+JV#9!RogUmI-JfY8$G0bpzN` zR8`eP_pLWMZvB8-^iO@j=A8w)Z*3b_^dj60qrOwjXh17@+a9y`Z=&7RLRIQ{-?`*W=2yX28KD1L|jn zl79x1kV@jYxX(Bqp<>f7GYuafUQ4noDv;Rxsk5L2m;i~S($IuUT(R!YSFIe@dPI!& zk!UTDVVR@@7@@!C$oygx{mkboJxS;vfHO$(*{Kd>YY_Vvrf5CaJ;W9(vSN0!28I_(50?@T9`y# z{_iGIt$>Jph7P8m>x%}Jl$Y*3rF|_e9tkY(GCx?6k=H>@jA|{!`aB*((tGu>LPB0@ zfa0n|4b54<-t{Qc{}Na6O8q0Q$`<`cTty8OS5*VWRl9%0Rh@M>;HG>yC16nJyNQc!j;*P@HImt{e-IAdr=74FkkQivop zFaW+t%d9+PBHd1R10|AXP9R@~b-#Ep*c2hP0R>j2U$jP?{|KyvElUG^3y)|4GDE4) zK!MdEP+*lWR9sK@4g<|}4-{BA8cfB!Zqq}Y=l&5`J)XViXg(@`rey+gP5G2(X}EVR z9aQL(e@Maht$tWh>I<|ldwnpl;D`tii#bID#GRszF;+jpVDEDtiI(zH0RvMk|BtCy!# zXo#y<=2$1ntDhFr2CHZXt5vgCsG}{?hGdj{vrZA>ILWaFSB#b^#SB-?Z!QO@EvS9} zLYvBhag+)hBs&yQOk1v!Em^LWwNM~Kn?lBM8h1e^+}?3>WROruqf^KkuiVjY8BtZH zt;jAf#V#+xF3-DAfs;Xs*&ZuXrcKDMjpc$QGNYd)oJb+;KL4?qsf%Kxu7%LE4;N zQJ+p(V>PoVhqfT6G`ApaN!!G>SdebrB-bWaqDQ1k7iFb9$S!Sc&B2T|$kbGkirXd| z|D#yxmrAK^c}ioWl{O_HOiO2hPSuPq+AG;Qf1Ev7rh~m$IZ=f~vRpZTVN`M4h03!} zI)1K5&qSq+fd(TvsZ4s@j6C=y-eg;<&V-x^gJv;oAxx}7jilHq4w68s9E7~^O-fdf zRVOxUv`~CQnf{b|#@Q?wKN&Wr%B4`ML78%Cw1VAw4@X;HQZ5dFqHHoqj;(wyq2R)z zZub=`eaQC?Lp2zqIwC@cMxrvrB*9}Rry@L;B=rf0H$0ar?ulkRESESu?R#)*F7yuK zNhseaq0SxRqG%`$Y^b*sUIYgMg-Hk{#z6KSoP2vQ&9~q&nPARv(QM9qouru($uwdy z%UL2h6hd}d#EN17}eh~yMtp4GxKF7-|;J^+#mev`t=|D+IevD7r$P$0!3VL zU_kr|V3k7r!(WBlAVMDep(YrFU0U`2;Mbr@h(T6xdmw%t*3`{$aM$e2v}aXt&wd(G z^&9!}kzt@Rs(QiObog#}rdl$c(qOsz*va^tYhgQCd=KqU9%kUsf~Qk2Bl(L&jomRXbRE;HbV*-in^&j_LXDSkkIW@b0C`+6TxBtMdln)JM|R4&I-6>=v}ERC%X^^|ViA1z$fO zj-c^MqTqVRZ54I|NwIp$d*1Gx7FvzO{?=(@1X{U=21bUSX#jL=r{WgdU$m%;xzjjd zsvZX1Mq2l2H@Mf^u}9(rWD1X2HNVpkPTJ9~ly-`HDq3j<*cKY(GuSC!6aqfDd{GiZ?oWCK+vMVM`_M2pIez;O@exElttAn$joY)(C zk+~dqj#_bBTt|>V?OcJoKUk{DseM~Iu+v_tpY0F=(FyFuj?dg@V6ahHV@1!GheH6R zY+9eICkwo-E^gi^roI~jF9%ARG}6dxdgt!A-;V$8&~Cw9S&L?$VS9 zw`-Xpu~kcy&_n6&L42{eEqMWjT2{ea(Gg_6msDN5*VaUDdU`GJ!0RL#I#AMD%aLal z8hl8xD5OVOn!91oQtr=~<3}rRqnL-L3T|wOx+wwO$hhk;0aqS8Ve1+w(;p_&CZlEpk-rk1&J=VqS3&`x4cSuYd&1@>3 zX;JG-`vcq>bE+NoL#JkN(#{$aQ4$tq{wdv^h_K0a|GFH1)D=<>85Pxim~Q@d{7{u_ zb$p6YV<$-evgih=I}oyI;1^t45xDt|*K5tEABbzqt{=hmw5xrjfZI8{;sV#BX;OK4 zaaI$isVlH$8+)4hIn1Z_r?*D8o7B_GCEz_))!=@!{_&7C?%;3bu2cxc^1^)p-0|Eb z%|dsIskjIH{axFQOY@ut=Q{C$b{$|{XLytNc(pCI2{@^5X~#{1`;)js(cxJ^{8!?x z5l#N!Z{lti>VGEgYW`>9j;ITmxT~@PChh{5u{)63UG6_fM=EawbA_qUjkuE)U+N77 zZF3*YdInkq+E@YWiGf8mcupqoom7U$TkcvTfH2*)(eci#tWa;yl--Sl+V;`yVn|)X zh#DtuLFdjFVLc*dNUB)(U#@i-$`y4KFe=L>Z>Bdo6zOOy1nloaI-;RGK*cQb}>stwj$ z5v7eXMsJ>hQEe3$4GZF+? znj*)DlfURyE1U-%YI%~nb~i2CRo&yW5QAyA7Xdnan+N^}#%YHd?P%0>rKUBM>+jiZ1@2cxTb5L+TpO)vl69nWIh9J1*{u*bbYwy? zRr4?!Eg%-PMI0z;rdV+szO~aA)6vn4JL%NNL{t?KP0)-`X4GZrOwNTDqnohUtq5aq z&IaBm8DSu3iM^}O`nsYU0(h!5CHIqO-1n38G2}JHrjqBra-i!WoNLH5Va(bLCF!6= zYba!^&zdu!Ya=i$Nd|Mw86qStvu9KWuUZ#3P^xGpT2{hVRD|SMmlS1KmQkLRXV_Pi zrs-G}YtWVl3uZ{+aLkHNEzGF#TH-=12)~{I3wVmV$}0Z^@Bsf^zrNn!szyUJFJT zXQR=LoVfU-VwuZuZUBmroIhUwqkTbYzoLxfICYaJ-gcRA^Uj_E>lR_N@wrd3$kzoNw8w0cDzK047cUE8J=Z#Slo*)?k zSt8?<%LyZkdS4kh*2lqH(0b53H~D7U=e5?$i|hnG>&lO%u+`%9Hw76o6skt9%#+qP zM&U6Oh{~o-v%_eOJxkDZvln9RhW5KCWxY!$2=LfbNzaLJ^H4*Cnyklx=%vdNr zz)8FHwK6a#LzsTg6UT^36;+k-fDHEsFpJ)b4Z0v_yn`kPVB14U?hB{kjb4B@eeFHR zxmtr5Q~<4)_P;<{UmwiiohO{@qe7thK$^5k3cp?+>if7F5D*gMp0t@CD(;fv_T95f z|7_ufwv(|nae|kEoqH`WZ5YwaSSwCiIUhom01v;5eO8d^t!gu&?(UCGzRLV1dv@m{xT-F@!Tx?3Ur zuxk$cobb?M>TtQT_A2r4z^IM^xZD1$Vh29l8y^de8Kp5;>)}Ic0vd`zYD699_{|`q zvd4y>PVfdX3@Y77J<+gUJKunVL^YliWJ!KtdL@B{e1~orgcvgl6to6QjI=`!p4+3z1E1*Qj_+Kpv`WQC z1%@BzF3aUc9=9pgsRamO4+E_I?e^cgy5XaLPWcc$>uM+a;%EQv_n?`5w1896H<}#d z*vDe|!qS$$9a};>y@hOOx;1;x|f0* z_nPZe6RlPG{A=dM2iK`*Tb&^hQE)M~W1Nq&Sm?2c9iG(A^TK5W0O~ybP#@Ah5_dw; z;sJDg8+=ixA-Qv*>*)TIHH$L%lQkP_$0GQTtQnu%e`U>>p`iK{+D0KE5jhvC?7rL8 zy$rKxL9t_ld*>qNdRlJX?Y_YSe4PCdoy30ri8(`PTH-ymRx-ON8k~$KPfh*+pbN1+ zpb*s1`SKGb%DGtE8|1)y!XEmR4}rD)B;k?{4&r0mt77y5L<;|3)iIAm&Ez(JjR%@( zMOxI}ND?Mv2lA#V;lE)r&_7|aOfxzaIM};}&wdFJz)yw`&kfcGP=m3rB;#DZG>UlF zKSOo9nFFdYRml$sOy;d}g8nQ(NsoXqxMg^6(|R4Scc5C6&H$%_L6tG&PvG1x{vo55 zmb**c^jC?xe_m02zUxB-cVp-zLP%)`B{c28JfNw>fHK?KB?q4Q()asy@d*I8QZJ_S zA-GPsP>5hoH_{}xJJ^(>CHZ!u0`{)|bPZVGCoVsrxpxg=KAbIX?JFAi9-&*@z*Glr z>Sah5_e_x6wTQZPDdqN!xu_55W1zM8RQdUzZ;( zjKohZCYXGgdri4NThsK;OA3?}@z8A#wzzu5T ztYtfG3Y-y+@0SH}(*BIT91sL=nT~4HP+KL!$jh(cHu-wGret4DQ30NgyR0{xtM#m# zlyDRNZ9!$`6#aj$KL=B;ALT6Gae`*7PUtJgJqx-{#@oqv6MMSu3T-z!1+rLGd@U0c zV|ibLHz_9iCi>mHqAKVHe0nfi-U{*W6JNg`*Li>BTbv~Tp0Crms}Tp3Z#OUbvyCpV zGyM8;rof*6Ta0SZ9`2;_AN$WwU;qE?Kc9X<{s#)K76O>!9He;OYyS+%jmx^;Xy@&< z@H%+7Oq2rJQdhPV?{TyV-Y6}crV-KHD#r_8C#$m0>TJo3_s+F7u+A>304Z+>q2?UOA>fZr4-_K>-b^ws4F>h#EnfB;wU`8g6Vl^XRkY@6ACsZuuyUcdYw z_TDn64t~$p#NAys?i$<)1b24}?hXMGWaAEjjk~+My95ai!Gc>LNN^{2^PWE4eWp+M z^qrY|r|MR|q;^vK8&s-(>-n!|WqtA1x71~K6xeg0XEsa1PLWCBrE!?G34 zvyX(t5Ca8qnu6wITyiCBDc{<-3wJ$qN@+F#11%GIdFhR0@U%XjWgVtz%BOpP6tJHsd0^Du zOgHcw4_+vuqZxnl5sy}YtW%5Y+3vB}l(2F;!C>hC#}jhf>BI-UOe1cDI{<{py>UvK z;K=O-u|$UjO#jKmGlWo%)u6q_+l#14(%8v+F4@KM$QsdTwH`HcidV zK!i!5m=a-Mb~V#l5(YY-XL16yBo9=hfNSNspMO9LK(Zphd{BRpjDFE`j~XTZXC0&Kb*dXH?=;{Dp;#E~f+mHvUnZF0c{l$fSRo zu_yaIm`%VGKawB)$|O9j=Ypt(8-qwG=mkjfyCCFJ>bNv=QFanFT`b8+dRe%_s;Nao z=*=IY%>>Y|uGJnP&lhd<9it*dhxbIS%lkLUe(saG>rbKR1K>e=r||Uwq@afPQ~dh? zM!+>=#aiCq9M#e}##+aMKPFOArfM1Wjrlu<3E8~-iEd#zb1$ses085Q8z^tQ*r4(7 z5gKT2BaES!i+)8#T7NLmM}SYhaS|kyxo=L0FLV;rt@B$Q?M2)0sJD1-E`YpjLH*&- zv51ATB%EyAds-C@H|&NxF|cKBEUI|v=K!4XNwgZxN5f8l3WR2%4?mVFV&_pediUcR zwtDt)4t3}uU@mXF+%EkUHcG@q{uD^LxW9@Zt|o++mYrpFEPHkqe=^+cv&VJEHYzj} zdg{B8d=KtT>gq*^aD>|m!1Z1sj9jQekWrIk?%4B)!H8^0VU6prM4F5Q$)Ii00l$xo zc=QJg8k?SJcJ2(_(ng=*;;J7%ATPf!(#uD+puw*+(C^Huv~u&!%h$p4~LO)UK3 z%PVa}>KA3z!uIB@D;Khk`XC9+)2l2-oi;_zuT>B$kEs~6$!k2uOAL`8Hw%@KB@o#B z6o^2nrUj2x2kRo#S9bI%ilRNdG2|Uwo)uA6b6gOIu{A#rLaa#EEPqrNsTqY*fC8P`Ry2) zh+qjd)n*E2IINJk{B68If&r7!R1etXou$DRy;;)o!}RjE3@6c{M)W6s3Oxn#ho;q0 zA!q}V6Aj?jBzoYZxyeCzBP%mtcK9)q-;pA4BAQn&45dM`GTB=8Xge}GW+rDvVQMYu zJRZGr-DelC>1Or0s=6L{;ZlWqR2}x{x84Bv^}AVV0bOI>vUOb=&Pg|cqI|P?W%1A> z*D!oIk5hCrte}9}_zp8zc!D8L39n%5-1EjP6TbfD1DOjerDhADLm-SWZM81&ih~44 z)?6%9N-q`ZOTxDFcuL1RjRyAc!E121Y8J%zEtV%Jh;2)XSZ^{`<_Tx&G(c-dhX4CNS|Od zfjnwjpvnvGU7m>r{&2=c)7(`F5#yR}g(b@JH^#sygp8mwR)rSg@t1&*nYtgHdm1kg ze!jV=2>zO$UTZxXyDYm6`_=&5D@Q2!8+?q+V_1E&%mrqT0%smz_ITT} zG)e%Z=|Yh}$cA7yakdl>IX^^I4=7<(AWH9{UC#H^TMN5E-nS&l2nP2q%itTPdV{$9 zf@F%z_tg<{Pg+cun8)ZL+?Z-Gr&>FegwUPbKlLx+9ZJZ@tHW^k4?Xm7+@;nz=NkfAZ#{a19I$#Uv|#a-15o~e>7Ob#YCr? zJNnW$xPqp$DmXY&!aPMSw2@NpWWSdrJh+Jxus?OL$s7T@aC&WaRDglU8t5U4_p0Wa zGar6w(+XpmCl)|w=*5r1rs_JS?KSz3yN#@IQy-<9U{8_Q`&B~cC7|(0&CmmxhX$Th z1H&(+G5My+10eQ$mYke?# zq?TR=3s`9p<%mTnfN2sx3gW8>uGx0kc3a<`!?(S4xg+dcbJT=UfOp})SXdfAwPf(= z&0k!fC|X+cY=Gf7goN6Cbj7A%WGDs9L5*;=;gXZVRO-7?n54JvaqQhF(tgnsFJs(O zTL6{XE~`5NjjGJ)s7zdyNUf`*0=LTI59h^P7nrM?ZqTyneF2mkrpXy4aK=r#Q;7)Daiy^Na z$HgFWgoRK`K5!DWUzdrFA;a-Jeb40LnnJZ z>g?mXn=Mp9r+gs$%gYreTVP*_#-b#?Voqi@ZE(`2Xs_|yMJ|Fb1|>6MJ|iMCqa)6t zxZb{a#*WB~dk%pcJC*ALPP*Kw0=G?ZI*Yne0>iR6Vq>FcFIM!ve zoz(`p7)nxcT;=6tX=v<097M7dz`|5MwXX!D>XLH&l-#>xY$CIX zpHUX6q%Y`AJaOg(knRAwl+rXoRPt-|+xCg^+`xL~7@|*7$tjpr<`Ss{>_}3H-tkn1 z3Ksg`11w$0{Dw44C7BBHljUZ{@=_(TTj}h!t)^-G;FPxyFsc2JIJfCkD2v@FPNf4| zp&z%<8pH6q#kprpkOsC$=R-}E#1Yf-B8Hsl9>lPnOpr`WIMnlE@>RYlmeSHR)?w04 zV*vH;;MK$7W1@p>%lo)u-wC$m#%rp)qbuFQoX0?jOof&m6U}CdqeL8BhAe9If0wk(T=g0TO)hb ze-{f^N{NC!l%`~GduN&kwTLd+bH0!W7Q1qvS*AyiuTlG*$8F?gOr6rud>mUVylL-2 zbsOWe=Z|UsI7PPidzU~Tx9sd;e4#*mijl>K8f5FMMu>%(5Xn{nk_n0a$&9yYJqa{N zjNY|x7PK4f>oCya1bh^xx;VP!bTFzh+o{T^B1>6oH<-1qA^V^$GUmod z84H%VS{g&W$ztt&EZ~M-uDyZhy;Jm>z?f&zhl?Q=V&6l>~O}h;$Wiw zo%R(*Cbn43B6ZG7AEPQ=6nV#BNAosfuu#UUi$-6l#fq7(f8pl@!9brOQ0$$*zEW=E z(8>iPIa8J>>arxR^|p^kr>m+V!+h6Q|Idz`B_=*E_xFLZs=;GMBWE*)Vzg;b@*l6a ze>OOV_5rKDC#ne{4Gn~CJ|*@fr7g_prXE5U;Xv=u259zdoDwwu)%V06AgY(Pn|Ih> z;T{TXQ-*#1tMB>Di0tn$kGZ0Dy9;-{k)kmHpn#LVE^RbBO^Kl=Axue}0FY=qCNDM) z7B;it1SlfoLQ*#w%z>fdPE}F+2^bnqz|@^y=n>G=h|XQ{b;;YMhd2nr7W3Wc7T(v= z^XL`6s##U=qpnN}n`DxPjH4=hf7lyo_H1q%q##TJ(MpVyY&2HGOx`$38u1s6^7{fofg|^2_ur zk(2;F?T^S7tKCl#qP{)EfZnEv^{M9a_i{kQhsO$gr_+WKjX}W^&DP)ZDH2nFYGnA> zpYJ}(BN}T;*R(uO0mh(Eona5!%ZrhhUv4*E=33@w0Sr(;qGopS`34-juQg*Jh)b1c4kiK=RGd!UlIXF4;%q-Jobw&8+wJ z5qYnnuIX$uXg^r2UMJ&dMLls15ivi8)!v!fHY?IU_k%9pm&);3KJ)7$8Egm__1~O$ z9HC-DrYJxtiCzNgO)qww`YqGApn{>DyI&<6HYKzcxH}1vo1?u4g#}KtwcNf_&n)gi z`-^L)0yn_e=bZP(zYheDe*pyfzbH-CC0tUS?tYJAMOT5gXF4GJEWeSKb@2FgW32pm z`}j$BSUsYbYCO|GJ3D|K`M?qj`0aIPY6(b$q=ovm6G46oNJ3LtK1wS7YM!#>g5iQ*WaH1O2a=na{M**>&xPS zwlZ&`@BG3~Bj=cAOfnDLhr>~IlD6iw>9lR>VV?Y*4@EJHZiNv_RTK83DkaX7DJw#8 zX(YA@^D?dM;uEBj2TqtW4s;`5(VAp!fpp(f^DLY6oi55bc&Ft=_U>gBp>){iX^vwG zZwUYP9rD+&P&r82iU)Yylq##KV}849UyJfaPz{H5!T^1eBDO*2`Q2-#EoHYw$$o}W z0bUX=U-EN%H!aL`#`+riE&+F+%9a}}LbN6#wAe?`xDDlAK0RJGS*Cc7c)%9LjXAS{RKp>+Y4@d>go|L6&D;!jY(Sc;^+a3e;`M;+2ic zyu8q%IzH%4se+NX*VI?%^uZjh zAvwip2|xr4fE66cV|!@a@^rQoBsUacEM$^lUIcf2*gg$|V#JC4_P_U%58rvf4<9QB zv1dRS;JNosLC}xqb)*t(Vf%chC@JzUjA7*Ba;TVh-&?S0?&l>NQa;msZa&#ltAd@2 zYs5rEF6YTV_HV;9m9ItqQt@a~=rGJiJ`vNp(83KgF&|p;?;YE7CiI`4 z`H<{8HacUZXyE|57~L>>Q019)LNAG)2c(`^0f6>Z2U0>Ccu9dMrSycPURx8&VfjK0)hL$T3S4iSsOKY>_>BEb*xcIW#O6 z0HD#L4~~94eIumb+;vv;b%U%)*-@o?tMZOtp4?32+Toc{{!D*=!Ag_ZPt0}5Gvf#% z<1lFzs6<(HrfC8cS+LS*YRNDd6{b^Isw@XaGMdnO)F0HN`p36u>l)T}G@u!OcR_d_ zu*e~iZt^Bucwx^`AR%ai7QdluBil~>g+4zMARxf!b8(5^!m3Ihi{mW&CeSl3X{n;) z-peyJ!$k;5x+QeHFWN3xh@ed6g71td4_3Vf6A9ySMJ;n{*dRhop}^mt*m|nuGm#aB zyOKn)Y-xH@ zeCM>RQ(v2bu)+@N5jJ8*B$Ly8;NNX6J1VF~@ z9@b-LbRw#NfLB<_bRJayESLGo)FF}u&vcZ6+DYmD6Y@hzCvI_7sF#K;4M zt#ttT&%_nI5^efzo~|Bw2iZV6LzL|m6T+7egWG)p7Nt=l7@u|j9G_a`X@B#ytAaj+H&yJ=o9+iEV(fC@6Sf}qD-{x8PCuhPq2AtzDy7ia5Z!vG72RP<+{d>$i zys`l;JqeC^zXAW2^Tu|9bKWxe-I0IGd1DKErX)mOb6!bT5oaXB|3=QMDh$qf`M3Wq z=Y5TN4S4<~=CwcjCowPZA9LR5f5>^wrEu^!Uj}{QSJ(PHZZGTBz&WombAC8D=cV~8 z=T!s#*E#Qh9`h22`mi+AE~vKX_5dv4pnAGedWQgukZ38X!vF=;TlkkDdbDAkA0a*K zPATWZ003N%;92bpNecECKmjo4^7QSIj0Ilqq#6Xn3f{+0Sfi@V)0ZIGz*+DsUs_D? z)Ctqy1V^XJPw!5Z0e)~bE&8~SbMFjdeYkI$J9LrAYJYTjx-od%uQ3NGeDVhij=oET z%ONp-X@uZVbc7v&hy3}?Kqi&8x=o?YFJZLqn{&C`s74cWx!!{Ykl3j_olSEzaZIhy zwoSFFuvCj@o{LC>^LJVNoyLHdZJ|Jub0*TLVo_zWtAINH=Q96Zja~!BVrEU3q$3%* zq2oe4JvDZ+vb1n_GPv2bGU?lGfFcEPQ(g4Rp`^N(USYEdjiZ#0l+1l{JpHJF9&rFpo32N=ji1}EQxGDP)TgN z`slI^^-r#PciI^@y^s73!I^5bN>s2`l(&|Yhx@Gd8D(4AAyEweH@WtQa%1*MH{>O`^(xb}%eL~^LV3!}Y2R+%`eievn=A>cV)Em_2@!f0tV z8FB{8SR8e!3xjwykPNC|VI-c~7`zR6U?PVo$NXn5-~pBR%}AY)+z*nW&R8fh>EuyW z*{u;*-bfi@3;P&m#e&eBcpA$=0zynispud~n)kap`09svo}0Sg!;IOJbZ6wsO83+n zLG-kBbf>ZzcZ5C>IqwqhKB7eAh{fC?W`-Y{hd!nfq5 z&a3oW0!d1ZTJO-$$77f4B09JSBMJrMLG|P8zoXjAO}Ard*;*6t1F4Tc?`6SBlCRe2K)&>T;5c_RMj=4Xs6{8#Sm7RXq z@Ei5FUAd0ASi!@^Zw4N9-vfNNUKYoyAV1?(!UCsjpU)IsSkmKBXc@r+DuaB!Ge2Rq zA!FNC9u_i@IYb;8#4JVvTr-6^NJqafu^ri;JAJ%eJ{cm!SGyj#^!{dTyW)}Ufjb62gD1yg2B1Y zHpd;|maPvn&!b+JxKsyK_B%#Tn$HS-r3OkbNf9K|#M?T=vw~mwiXIL6{rgM%zjbKC zfe&rbC-9-I@_J}L{q4|J`}c=-@!t+@!0Vw6nf?`K{d0rlkG%^Z&c0bmF z^_3u-Ms$8h-jsp#3G{Pm8s#|EkBIZz3n`zg)-`NBa9yg+!J@@;H^y~KPMBQUk)h5< za651HcFmRg*_Zag=C0g^74#UO{v*BEQS_kcP59cxixv3~Vx;d0Q}64mN2h9qjUkoX zJJ`=25+aTm@O4Kpe}CcXj^Px|;QJa?Gv&HppXSF(Hl@vL;$4zcK=!23QkC-I?H%im z&-2R?AK`mm_;Ve1tDRJ|*h5iw3z$u{s{{#6E)wn(Wj+#I;O`eGGfc@r5i`d4V#ihc z_=g66iZ8Q^l<+)RrfrZmX&+eoyTID~Ch({ZHxt=!;embGbCWle!)0GUHPZL16~CA? zZt8|ef7|szY}@@^HQ~P5oQDJ6$&N-*`gCErJ|=yN#~2a$h@tp=e6TD3d{IL^`>=wG zo(o?GjEw3q<+iGxR1EtIUB zQA#|aPa%EgfMkXLDMCRYo!LyJvng&BG>w)d(QV085y5Bc;g=3fWCcgCY9cGc9d-0> z=ldckCwK;Rx_t33)db3`G=Ixumc6G_Il*H;h9@e_ZmIWMY4!TCZ^nGUsBG~Mpzz?0 z7CLsQ*8TNU`n4x3+Zw!T*uhtslp-{LZk2ETA$*{OmL!OabBK68Q>fr=q0SHt;qL)M z4!V&vCRG-{gesc=@sUkaB3kvPDv34>SH1c*-!0%SQN1%cZaSx`i} zwNRS$MM|QdDS;^tlngVSujL607n4{%4b^;~%leFF=_G0_@nm>q1XZc{2}KG-V3d(@ z-BNyq1R=Lm0ZAKMjgku0E{8zigdyv59ZsE=1QTbajVl`V-UNciwFz>!hzUKH(J(~8 zs75U3)@NZjc)ezY^#l_6tBX->FU%<-a-xlsjwQ04qZ&#?gX+_<~`Q>#hcH8HTE&HrP3noFc zoQ%b5q1-V&ha^+=@|p3aPdt0VPTl7TC0}Ei4kufLja<3-esi$O6q?y^GI@|*?T?RJ z=_FOvW*Y9`5EzKY{0<}ps_=8AVrGQ}>0)*Wr9wub2QPyJC2IqY)$TMU8-=P_g0bZv zTe46JeO5@S`J+-Bvclsjtx14#{ za*IFqG+VzNYcTH%T2_GU3&6t(_9&PofMu*9cYlQHJA6J2HGS>{@@u#(aPu-c=bCS; z4}Hi|zV~_fin6bZJN7>k!~ z@MnAEnj{3r8U z+#S;fIS55;ic7$O0^Xu`+SMKc>-C8ene{Z+buAlNW?bQQZKaTg3H<`5jmf4MX5~PB zxrJ^Ez%Iq))>cnTevi@SJxNlL`;*RZP>=@avwjj-dD@+ zdYgaNpBuiu-)@$0u?uZw;5Kl%dn3Gk>pH7S+m!*t2MtLTI8sMeuZO_QY%v1LNAi$D ztaDwExdb5l$jN1(v6OrB;k@i2A|T?jFB3}cQ>48gPWH4h7jG%{EcgeP!W(4UT^5oK z)X&hXtj0Alhg-b955+m-i>o)kueT}h()zG|;-?yP=2Vx!{v!8@FdRb&(zJi`Ybesr z9C0xaO4%@#iwme&FL~D3j(&pwbwYp#aqZGg9o;e~0Kw)7E?z-%q69+}3~6e06ICJh zwT!5;T|Q=ck*@!^imqdsjYy^}K`@7ix&~TE)SzuY7e=avI+(A8A3vu4PJ3dLf45Z< zp?UWi`lvPse%@4M8p8)fMn70me`|C_I42fHY!-uQH2bAPOa$$0Xle<}#!+!S)o z%L|t()RW-L=jm$i@y5hIscs$=+h4|ds>*_ZfkAe z_naUnrL@Pjk73tmOMGZWbUo0CGtWXIIVBBEV5109do{y`(YdP1dq$7J!aREV=uh@? zPKr1&fuL4py6XdfHq$%bj`;cCpBVh-hVx*S%Se$jE(%7<^M7vED14$Gp_hi|X`)O( zW@}jI7`M9@-H+?AlbPoppv@LsdeVUhiqVnSN9U`)=tPFy7rwv#t#Jy74nhM4YTN=rx`n=+q-1K|pn86aFVRfp7vXC7O8AnD7?xeZ2v5yL{FvU>&YU~zekrf)! zYK)e2P1B&rdzlG|!bi5aQ=pP?JN|(+(sF5x#k|s+^nNB=S{y|)EX4v0#T~RJP-t;& z$f-EC?LNFBE!Ys{TKGK4`R+a@l z^G+HsKhR=)SRoXcE9J-L=RYye?5K5KIpoFm;ynq@@F-Rk94d~`R|m?MGnmfdOj}<( zrHO4T@S7Eb80Y%q%P7Ba)tTBJvh4|_N>uIv8P_(SDv&e;ESIllpt73D+ z$Cb33X8TQn+psv3PF*Rk%wo7v#WcN@t%*7n@i;|qMILpdDEx=oh;vy%vxb}A$_O*I z4l~PD5<_Q_RKFazx&@JBQC7yRj9i&ZQTD+7&LmhBdnK>-BT4iqu>94gCS6_ z5G#iyo!p@+u|jWVXKq8p{S?j2PBlCduEK5#h^D`%{L-E(*U}0-wfz<*s_bi|mYgI@ zN`8_AdxWry@(OTpYE%9RC4X?rOy&v4c2Id!LV-^F`)61e_=f=!FLajRFx%n*oX7#; zR@9-wP%IvC?3gX3rx4ohew^Wc^Kvm_>AcuXl?gfP0xE?~ibf2KVm5Rl2KWVoARFo+ z507_LRk?x6D&o|oCKx!X@Sw~9AzktztnfK#xsQ;~d0jwdDgyGXU(3(b(3O1ZY5KYE zSC6>;(k>2RKR_pubMg2Ru1`H||3JR&(Q-ufYBXl?4?O`oMcU0oo3p9rJyOvQA4VCy zX+?7Wy6~-L-yrVZMIMt;94&F@I9}J)pV|R^B2j;28t<2VTL?zh8+>H&%D3x&;2;Nl zHCd$JP6Y!HJOyC4KEXwp(joh_&E6xvU|^YfD?VeC6i}0<@J==T zYn)YhdCtbSUp{S&Qmix$&TjH&1i(~1E`ncnrHg04$eKtcyD7-!nYSq<^*aS|o$-Zq zxuv(%6{6MP_9-J~e!BW-FNkjFkZVS$L8`A39-|f{d4Q_w>^-Q_j75-gKG8wrc2{E4JS0G*P%P)Hdz&< zKcx)N25R#_Rgdi!8>FUS1BGy%gl9DTxsM~MY$A0dWQQ+7mjZFxoL1C>D~VA&Yj`!# zYXL@&;E<@MU74Czvi~Q`@^+iB89!#Vk<%~%+9?(i)UGR35zDt^ZAhC#7~2una#3u$ z#+{_7Be}d&3pgM541Uy|%c&`R_h?Fu8!(cSlB75MLSK5(ME*zFZ3ZmZIh zzJ)m`d8+za89UjpKt^9gK){Pw`S9%VrS>lqMLNN^IAOg4N6y7+2E4Dnj6eP|Q5j~mj7G-CI1&urUf@o$NDdCsy>7)yvqO0^sA+dNPuornan`&95WTLe$OLD%@`?wShDA~G!1i1v*t`UIc;S~vjy8nSYRWIpP!j%=P8BuOuPWW zuQ*k`eC`D=T*M`H6VVPm<&~C;f#M%H3ZL|>f+dE`E(GUHa^3JWCPuI;AL$K3Z-_z5o!0^>VoG3%U8t42CiB|lZVVlCy)k$Sq2)?|aU ziQ4~~``+jP3O@>NFX+{P<^SyugdAk{52Q&ohJVTbU%>MJti|J}HWZ2WF@5^gn>}Ti zqsO&Ph-$?vzh=#6wFmv_jrSJbZaKn5l+rtGVD;+YdMhU8p=ca7oJkU+gH(JqS8c9~?tFDkx3`bUJXxSi@>6$bSl?w&SH& zhZNXR{BT`rL$hTKO+lvEGbLyP2(X4m>635E>9j&3IR*fkC^kG&Td-DGg52yVzMC#J zKnK`_BUcryOiVr}m)ZzN#1bMNMKO)E)Btr<>Cc-G zXGs{X3u&0#pOl1Q!OyGPHbi{;j!8bTcbkG(%q#%A9qnOY>c%7B;h z&2EA48o)QEpbNRp4%d-tq~eNzeYvexB7|x<52lcn$jv5GnJPpnCh$*uvmS^SUI~Y1 z7t~L*RRcF-NAz_8%Au)W7n`C|wpJ5XLlat=TU+joq-E>)UPG4$_)tljk^-=5N!SHIA#V)~bN6-LCIID=~9$}R` z{cr^UCN;8^Z}WzJ%{5ZQ8U!TI<{kyleRsdQ|6ODywUBhGo{os1xxTy)7+2DkbZJ@~ z66N-WbiO{5|K!e~v6p1Lkh)glxUJ1FkSPTq`9f- zB8-V|QIp$n)Q9vFl=9-`||cX`I+^_Py6Dx z+reKj(MNF)@c1p<91D7|aoSZK>BU&L5JJxPmFUCKC&L1VR;A^7zYrkh*I@ejb>g$! zCBAVKfY7A4mbd4O{8m;<0xJn4koQ31=h#()-B>Y0d07Mjru`>A+NLw1 zvJifjms$7pVCtR#d8@em(WXroZY=|3)E3IVlio9l%v+_}Q!X4&Mr-}gGg{*HdkFS$ z&MbY}!}`vVrax3TQ}u zz&s3I>fX@4IksPfIL~5%hHUo8C>DKjO!O+S14YwuSfuYLA)=@6FxUaXQb2!Wbhy=k zcl;Q;aP{7z4ghCwxF-+DI(2`0tlURv-UA(Vs}*1VyTb0l-vPQYjO0KtyEUrKZ>C{j@$8_WT2z)-f zqbX5sU`A4EyL4Se>$+J%ef9d=fxZ6858OjTe_!@KdMauThj7XJiQSEOb5HFQZir8c zAN5j-A4RG^2ux?$hAezOSy~mmx$%qd>XO$S3VQn_QyYXSJl5hIhi?5#nBT;5k+{$$R9tUIf;u72Q;*zv6!8ItR#cs;BFE`rTS9? z2BvDfp3l-Sd6=T&jbu7Rc*a9cT^u{kHl`T{In*#Y+tI8^)~0Dy(`OPI*Bk{~xj z1woDmj56F?x|DV{5^mt+vCxLqi=bd}=y625qalZ?;N*vks z^l7q0p$RQ~Cf*}aI-EL543#Won5sJEGfrQ&bg=$}Qj`sJjY@IuKCv)O!ivmxv{+p@ zQ(SMEc_P!AYO3^}F=D8xUT!LP>zh0EGd=jgYVjCi2Qq>i-XyO#W2q+%2x8&3%d%6i z9Ok3_21NoF-}O0cs?%EAGYA+e(*3sQQ+wWVLAB9spj~6kU2Vm*vU2v(NYg~{Bv>lZ z{3?}j=mcg{DZ1M_SjvYAgt&Fj?+1K6R>>%o>W?9`y`dL)wMq!Sv-BucR1@49M&Yhl z`}As+2+(=}TP19WsHcV>7NR18BzM%BT+Tlg8RYE*mjM*zF zZk}^R#=G_&p0tBQ4;eq=W0=l|s{~e+p_>fkz*F6ip6s-@S_3as2g(!KEKH5IN{x~4 zJW3DMF0=#tp8(Qe;f2Z_b_z)bfDj1scl@@3;GAO1GDIa}tc!q_1+9Env4x0lI*#ag z?+qkY4f9B3=~}FhruwNj#$m3P0?!5vB~!k}&i5mgKj4fgi>)4HQDPC0OWr${XAWV1 zsZ9c_B&?Rbq%QXy%S$WJwTt$&1vgDaUf%TwO!7ZfpG8l$eaPyWYRCbrB!Jg@`p1Za zlzy7A5e$p2;Yl}#`<4(?gt%rkEg&kU&O{13A*5N4&?Gax2gV@ z8yrH8&pRn3$G8@{3Q8+zctw4HHCGT-HLzcB-$CDcg<1yqSZ2PTHc~ z8iLH{-}RquK6yb*_-W+o#sPJzCAR2{QDSL`Tlk*7@+Z8DKF2`cUCn{J=jj_`P7TR{ z+)ozgm0<6uyYrA#l7~zr*0k>Zu2pt8RxxKE;`BB$XT9RVVRgJn5BY`4h6)Q$!$D#h zl9OjJ*;qPG`*uKPHQGcpo!F(q$*zASvJTQ)uzf#clV{*8P3e)-xExpj&H9*_(9xYf zwnDv^(4&4`V4rzQHu<)UpKG)@Mc~o-9JIHIYbhu!#hql*yb-DYqKZ~IxrWhuYy|v4 z*rDOa*QxXvx&`5L=1DrWaOnN(GJ;OZLzzZ+gz+f#&g zFkH!iqw456wD!#5Jpoc+N4?9uo78uE?D4${HeBg*YM#GUzBfXi>(KbXSFb=Co{+Zo z-mBT(dqY00N5nSAHP2^2_uMU6blC4`^&ugBz2$4gR5{O6@NVQ8&jKXR98=5hObNY> zivE{xl~bj*PP}a(Z>7{)T}@ogeuZQ6saj%VW~Z9^c4OX8B+dj~JM@oX;}L>rKDTdw zJ)6DV5QuYw$2w7NvAYAXKmix${%4S0?l2hX9i99Kr1v+X$9oGVdif&%oaj}z{4=8W z{+}Sd!^>BsXYfCR^!}0P#l!vwqNiu^|1Z%aw*Nny=uOW5A$os^-XEg(hv@wwdVh%C zAENh%==~vje~8{6qW6dB{ULgPh~6Kf_lM~HA$os^-XEg(hv@wwdVh%CAENh%==~vj z|0{`J(|@<5_lM~HKkVrJA$os0dVe~4e>!@9I(mOPdVe~4|EG8KUVa~Ujo0r8xWYcX zd4Z7J=x(7p2BvvWiz@@NIa_ILqYM*E#nm1)mR(++p{Va9y8G6y`7-ClM-&1f5X_;F znf{~k-5vsLe7}kLZ*}}CnT)*hyF{%1!9xf9FGO?~bT8!h*kL(+R~{9V#scBv@kVA1 zuN^=5sQuTD-|qj7@Lk3&4dj>5W>&SOkpwEU)zxUaD&tw#;5I1-F(ehqEVvfv$pTfY z>`QI9N-ba1sm{wn&*x=6*lzLRf->ZE75ChWT}jm;1Iql{G!%5pw;31W6C;;pSsDvX z->Pw99==5>>`?!FI>etY#$#(n*fbYa{3|jYQF1O-Vvb&7u2sCMFpt4L?{PXf{r+7- z#JgK#n6(fjt~6+Ok&CG=T@jI}Q#YVh_S72U+qpF1lf-NrgX{?EY>%5sLuonYa8N%Guu%4lb#~h4|r=Nj{W-8s=oa z*_a)Ax%o0PDsp77%uUs+wjcYaib2V+eD`$YNQLGDbjo_PUluv zOkp?}O~f|0O=D+COr>R2U_k_0LOm8G->40EGElbTa2OnwvMgjK^KgvA;K?KVS|B+U z#n-A$XrxK0+8h*ffz%k6=()KPiC$z0 Q81mB--4u{UX^JXASOT(yp9|we)xH84 zilcYiD2u4$i9BR*Sqc-;XGLKcEd0$&$!sR2LyzOlJ|<2JMt&rL4UPpeClrAC+Y2oEycsHGB6x;Kdn!T^xBUFa3}$WZN0tQJlRjFL+{F z!mJe=m>1E?7E;HSRz3|JRxPEX(`dk2`GJ7#g}?$6%h$$ z_kZd54Y2)V$M3vhkLze(7?}7w!^~Z?u$%aeHafa+MdPnG@fts!k|^hEw3&)S10O2MEWD)QAX!Qu(aLvwWjw;gl3fSc=(3`?Zm*>J%m;K&^3@uQ*-O9 zORjez;yL>CI~{18@Np&7bK}NaYIotxYNgZY%dkGLz6fgvYFlAVm*2eMGyT+7IN!=1 zC@p}n)4d(y{PQ;mQOrUvAmp!0dY05Lh_VdDT#&&Ja>#GYtZEf3Y&rKmxA-Q_wPc{U z(h%cF6pO}GO3s_fjkp8wq}qooPO&3o<9~gUZ}xJW(oqVoSj=D#4eAIEglNkYwTWul z(-hSc2p|FvMo$kSo_Otn2ct{9(;&&#ER_cCo-Qw8NeU2>y1;|cz>eSy^NZ|@qoGBs zH59VnO|I&4=kz$}WPz9JFItvb(pDzL=!t45(HSsW&wd?dORhyAjeV)s{57 zMI7XPcHAppg-{ogtWPR%#EE_kCp4ND>>9C83>@2oEK7MQO zw{_9$4yt2WESQb`n35w)LJ2hZdIUM{q`00KQbm;Y2<^{}kcio>Ycz+Iu+pyr!^5Hh z6F2XwI39}<+md|LoRUAyi!ISHZfBC&38grevYHw zYsfqs7XOV>6EBFR9;%?>qvms9Pyz$8I}6#rHSxfc(9XobPRfvd6>IP&G^NPk19%gf z9#d=Xf(xM9Up~u+UDjSSi$EJP-%xo`47=XiOq}vzCsJw0126FH&R>(z!mg+Dn&m_> zeBepw!OwC!L=F}CzV8%tkR8U2FOaPD|C)qe6Ic6Bn|Q$gs){#>VPn1evY^5CJ$r#8 zq}%9xW!HDQ=3A8PZ{4iD^E#=sv=)aqmEY!2OO2#Ci@ZWMj6zNe`S#i+K}Y)t_5`{$*T_Ajy8LO0#uC1!1YphtIi z-D6S=NwrPk`w5xW*u1VllXef2PFs@>Ba;p_lTIm<4gr&P)_7;h{!c9Zez^T!&+k6& zQCz17J=q3b2n0PNiLW%lK5B-{|3pO8#=@$mNUb3auOUXLA)v3u{ZWloT7#ZijY3e3 zSXu)|P!0W~=HK_=fd8Zj_rJ3T2mB{Rxc{9!IN(1i!u_x7!F9KIkB_jwtWk#vVi@|J zj&bS%4^^VI`4QM~UBI)vs_lC?z-j7tLUtfbk;&_S(t`v4GUd0f{4~u??}BK3xTO(p z$6@?6sUNybjM4JTPQhYnyb?A}dj(+zx9>eVB;K1bwsFxPi@(uUSM=@&a5I0Fr(@MW zZ}dEuY@|B7O+L37aPa#c@0dd0f^OfUA%(FXJZwpj88&-Ot2N#>W#6-P@@<_*h3!VV zMP=6Wx6B;Cgm8?dh$w^q`)fS}Xh2?~qe@;^xJ9uUgi36Po9MTek$;6O(ElIg-BnPX z3%WIGJZNxtcPF^JTX1)G_Xz|D?l95d9^9SaP9V6u1_dATEI7ep@WX_=+3Ru1$-r%nqjSLXI$b+Nan6mprPT8kjXS86#-M$D%iSuP|i zyjOdVj>t;3cWjwI{vgwTE#TzZK$dcBsfC zr;Z@4qPF=i>iemFIo<1FUmV2>ECb}mFR)@IGL0cX2z5HJ8dMPbD$%QQtxBoqUv=^M zepq)?aF|A8?twBB$0xrNjG4-w{wP~n8q4;*zHg)ha0!*rA0OG`;6d=JxsI;=-s6>F zr%Zgq5DCmZ$XwBZ26#G0zz695zm7ostpULm8`0PkC}MWLv&GK5Jhuke%-M>oo~r)j zK=V{uvCz4RXHPEpo$mTuQVFk%J$oMeKwPxF_|SQn&1#`*Y^MC8W{ysW!)znr}=tA8uem zHhM)A`gBY!{=%O+X^HlpP(MO9OXr$iI~7C#V+`K+X@~}EW}ENeP5|4>@~Z^(Qc^oT zdIkcXKZHPLyWZ<>;AXp?@aFu{+xoZK7U2J^x8*=I#LSo4&YIrGU{wHB!=xmkur_zl zCd$!H1!&l5LrNJEJHi%s`||cq3-)2z75Bj6&4^WC$i|n43$TorQsH`%TD^!~r5-Ns zRJ&EsRLp^bJPhlg7=OGY0B?5%ioV_mD*z@<_pN!jNr;lu-}JWlM*p?9S~p!!0djzwGGmKG5)@ob<*bq)&;U4 z4vv3W5KsSZK>&HN2-N`pizbzz?fk#s4S(1T8~0A5HB2{AJFT3IU zOprcrTIe5kgK|7ZxGZxp@^8C=@ejN~4M7Ux?g?apA=rfS@>uDi4Q4OG14k;c6$y}O$~!}BRq}CadU1FS2#g+e`on`= z3}hkuQE3B`TJW#pCX%|+o9MbIY}Xwg8Dg_g9|ri9)m(}5$#JzFMSxl>1mxi7z^(@Z z2BfVCB%Lf8PT2dEHvyMGPaHxy0Nwf&_tm?d(7DEtCt#+M6>csib&&4nR_N%eqZX>u zEo+MZ?p(!R1}!nYC{EngZ@%DPzDVnOw#waZASiJku2y~vrBmmbak&0gd`%4OI7_?Cg7XHe!Y!Lf9p@Dl+xmfyk2-B8z+ zyDLhZgePb0(Pr9P@dyUsQ5OL*%45SQS!DRn$TIPaHv9U4IbhZk0TJE-VkY&#$Ift^ z5+b=SqCLmz-fHEgAuQkL4IoJ#0R~`yY_pKsalg`U*C8*lv?bQ+*iwkv@E8c7OqgG& z@&Y3dSJyMEnJb-}GVw@Liv-8Ct-de==a#leVdOn+B^rz<72xTcs+~dEjJ@R0uZG9;1bG0ZOQ+?BeM`PO~O3?ai z?eS~}oXoi&3U=V`2bSpd!CMAk4?ZCq08>g%ptnMWJ}xFaM3YLBgpv_1SEBL^B{aNl z4XL6_SbrJ$_k!apvkx=)Je2?pxeQ|U#Kfbnx(_s1(Zw7Xx|Al2Jh(n3R5VvOMVF6w z;wu$jqVce z&}v830l50SO$A1#sy|Tqm4FqH?9E$K-h1-}vDA-rJbaR;_j7nB<#^zLf3Mxh3+6?G#4P=Sofcip1 zd5?B-L?q^d``O{u5wm}b1wj^rOnZy^W1s)_`O1!YP_RR9R72E9A&l-rdY>5%IeKSv z7?p`0FfB50Z3FntL?{ZA=t;@&P0m$m6VFdgCO9^viI6QwTx@mv99w7Uix-&ZsTT!s zJCPCt7}PML`v9%7R4aC!5pwzkEJq1jZS#TS;F!bEy4?;EEG`eV-Xm~Fi6!R|OSle3 zd#Pn5EMf9|NEqSwfXP7ogf@SCgt`Yb)$I}`@u+MCQ~?i{wZpPESj1J1f3wUO59)DM zC(qRB3S%=d#sP52D2)#TPvFSHrL_sA`?2~jpi0W|8N&|AX0TvzLp~jyG=vf)gNu#T zf=d?~;~4nmimWFe zZmrFjQc>vdu2vPP3*jU#OF@ws=|Ipm2AV7#uuQvM)Y(K_gJ>J)V$qP_gY^+c>79Ctg_2J(Fx9J`mXH8P^Tt^%2F- zh{4K~nFfj%6How7aCi9Q8>^qf6Hv?A_7>-O#)ns9F$;l5M)G9nY!u&m)wn-l2C5%5q(@b>)laTF2BGFT-0mq=N;0gq7 zT_TYvsy92}fQVlEEf|zM>bref@_Zzc(ZIaDMbI*19}A%4ULZRZ9zR0{LfUzk1{QY- z-dSY3XGe|SaiG&`6(Z6}ms|+)+{ww9SZ{G72f>%NsSpKbs*2K9}=RQCE;-U`b@edv=_M7>SIh%ldW`y`qP&sCAfB}O9xPL%5?5b>tRA~Ko!?xgNet1Y4 z$BNNsGU1N~RC$kgZ`MsQ{7o6IdkxQa* zo=@_91`KuWDEnOU3F8V(0`njV#o^A(XUIjmT(0|oHbVq>@9>2W3qSZ5SS1UkZX3VS zi1a@cz!DtB71>c)?)o+u>>5>QO!#md0KUPCqzbP)I_sm&SA2rmwE?e^`_+{yk zDWXD_1o|W$tYReEk7{$KTxVbzC}8FlN65UF%cBKhxQP~ci)@V?>1YA+sI0}|s7ZOf z6x=MxDz+En|rX~`>gwdo|TlU)pC zNlA;6BUD92Xm>tgBq~NOQ4Me;@pl&{YpM3pl;tNTyGY{=lNWtXK-8z0Kp#O7cNvdI zla*%0E)0Z9GzX~72-f+yL__L0k-mTtM3jS#S60i;5@PE#v6}h$^;AzS0Ij#F_90Z3m1;@F`QB^`uyl z%Ba7N;H{;B%>7BbDN(dfv~uSfa)9mvKNwjNSF?y6#kByZEJ3v|hW!^7C=MiM+41o-t8>gSPd-H)(2=fqDi?4UZEm#xMBL+-}{7g zRR6h82>7o9g(<%V3gZJn1BKH6F;EEFCls;m=Bg|3Ka(7ZjT1e~pb!9;7^T*RJ}aSE z5_6~mDLUs36xyL{IN2kG-f6AM#!tO9nV4nsSegto8|W<#wK>z-PvS0lriLp&&Q=1Z z!aE*ce?G0b{n)4@PrA0Gv9Ko78#T|=qy76HjbaDbJqmUG$)7aNGb-+uTQ!9&ks6c0M z!x2^MscFKyGqZ0Ntc+XZaZ_;-GEL>^6T#nI`1DpXKsP-0O2PHI0X2M zg9Aq8lJAn8F?%?VVeQL&U5IZCZ(g{|n42b|u~wtHR|c=ldKsQrVALIA3 z?^WRB3hdPzn8V>vZS(AL$z?hN>_m3p1xuM6}B znH|WFb3V@bU>cU*exIj(_w82@DsJ2$%NM5QX$`ji#BKY&{=#i5yI1O`=&R>_I+utR z=BAvkz7(IUJSv=F80~){p?T|5URn{)R`x>X8!PwU^ybIRpzv^ zCH99%?fTV?M#{msI_p@4Cs&1gb9>t)0{MaFl}aJb4=KkuQRn%Fce%^Lhbe1s^xFb* zzFd^IDN%ogL&8zqOX~W*6n6TJ=mvP~NQlMl9PQQccZ+>55_$k*L?$A%gBH}}=43Dp zcaHO4gMH1I^n{uae9-`|k*&Alz?}BWXboPB9rd>m@)CNWIj&>}o&jPG8I-9Ev;H{O zmn!dDSv}Q+6bKFa?zTa&i3?2-H*H ziQT0AHIGPMw2K&OVhB0LU?yK4i6A#IJeDIdEqFF7hIr?{uAx1PiK)CCuaY4GNvH3W z7qJ}ZU|o9-HKHl2ru$@DnU)l%0w^Brp-m7O;uD#OgiP!|z5b%Lu?zm!QFTB8EAbi!h=MDi$yE%Bf}_dn;O7~)MwZHXCk z)5N|~eECGslmvA|l16|LEJo@e9fbM2N#lIB(uA~WzY~F;{7RvNeS2zh49@QhsoOF$%ZGFA2R-c zh@X)4cvE`>1yu@ljW{XsJ4;Y~e`((x36D6}E>+_Gr zv=!h@8i7CFhb8Z>sprbiqfA}dLStTZ(|4MX!um$(N%+8yW&(Z?Z(WH-X#eIW#?*w7 z#R!-^PoM&>4P?C`paeGsrlS*D0&-|BJ=W&koIB$JpMi+OAHI2PUOmIGX9e3(f}8(Z zGVdF5G+&0-U9v@J$tLPZAT4rCHsk?edsIcPle)yX3AsU?tY2Y(Ds> z^m2Fzv^u_uM-M(e2mvM^u6UXPEplyr0P@{|0@eAHe=KiJmHongpO7tc{=$A+yhdDD zLYEZdR20n9PMfz=0m+aRu3S(o?F+;{gG?#JZ>zsOvJeEGzfA75J`zw8Cqot0KY403-I^el=Yw z;YSpdB>f%W=${An5+y818MTF!oqdvbY<9t@X76jG>A#U9=ibiGIVb|3%N5SSj zkXh8CrUnZoq)lU?-S=aKAPW5Ee7_j6BLBhp!lVW$|G#j);OxL8PC`-uPy1KbsU#+t z>5Ce~pP~+4t{L!aB2flSTgXNKx`O}pX=a|V>Uv9-xT;|_<+kg( zJLlEsQSMwCnMsnS& zztQXrV}&kswS7{b)oNFqGd6TJr?9wwba41aXwLq`JR7-d%(E*1@SX3UlWNEyB`J9r z!in}#CZ8@NHUoHvOUMbp-dZ0$?p?NzI?hOm15DO$IW_Z?10F^&3ILQ2LQ60rHQi_dx#9`5*p~5o~Q_6h;$X zRCQIafckICt~PYhtxBcJOeN(2`Agi&vXEW~2tXCaqDOMpcBgfxPL#pvI;Cim*Q zJ8{4=RTpXF3RlSlKT{U0;L6C4OMSCdLHe&o@?>P(KP&_2M@|p&fk?*fw zVGgwC0sXgF5g5rs$PC!YszF6~_WGq4U3nv6yx9q!N&I!s?pX%ivlWvV|2Stycyu&w z7z%p+r56R2Rjm_zOPdXXGb}!QIRoKENi~1qMd=K`&)Fx+g=1)JpmR2MALyKY)RF?` zzym?%OaKo%(2S4$>zvJvIHvmD2C$+7)4kS|O3u_$3BASVV2gX3v7$rJb%bTc5slaY zFEm1z_SOo?MQ8qpFbmzdYWa4^;-QgTIoLLs%(fS{bVlAdxEd6FN2>5g%_O&U>qgD` z;~zf3BK&OAIQT=mm25EI8?l;`W(xMyLUSlIY`02ed^%B#6E2@vy!s&A6#$@gkP9nL zJGUAq0YYh6T4uo3b^WVG%5Ai;^{QNNze*h3d*M!M@NO)!2w(LCiXCI{%g@cwhd(}H z=ZgCn2X@SoL#j!vr@zBfJG?^8TTWx4Q(Gw_7YpKH;>AeoAr}u~Bcy~!bV|tY3As;# z&ANn~y-e05hvD!Y)4d=F#{-Cz<#I@J)U(<^^+44ezr+ZgszPL>ov0XAgD081;{>=j z-D&$ZzMco}8cQyXPIB+>y9*%W%xmZtEhZnInA-_tUVh@*xF30MF_hwVutLPlgO>%s z#ip34ZAi!DL-x7a+hhMcs-ZPmCXF6M0)NIU{v(kaRusp;oI-+cetoWy9m5eqZ!j}N+83w$!_ zIXi`d^iZZq_?aRH2==NkV_Y7fg1Lc$7p55|3m7ElSV+QRb+Bibq~hlM;s0 zNyXYa5%fTFenLhFlObR-KcP1u(AHFBzf4%RV<*_EHUKeysO=rTz)jCK*Ju-bFJrQn z0)bS2`Q>S%mS%$tT7`A9qzOVk5~|ELk{)GoY_558jlG@@QKgh@Z!X~idjDBM9dAe+ zV>r3DqB@rjqO*S?BjP!nz_$f!gj-t3uvA;j*KoHtB&u6te!NLY4C9V!2=U(bHN&!P zGCgMcB88#4FlukHv_OdUNvi27+h_fNfj*5^A3P0(F`F_y%F~Jh7xh)DN8v(oQL?h| z1TZYfk$!0vX9N*#38Rs;45ZW@wphDH;8${dY$gQAKjEQ1E+0|UgYX6>27*%aN8g)Y z@DSV^dHa^ouJAcDMj3s*gj!Z0wICq{go+eUL6DH-UnL;{)2ugjx9-H#)}RMgf_C1I zxaljk!Pjhrfy!p0VWfI#@I7D`1$$#_B;`vu{ciSw3bT00JfcM>dexkc=X`0yUd^zL zkTW_vqnDtov`h7ajT465T~e=XEXFPaMjJ~2O-imy$|Oy2j~8`N*@7LTE1W=p^;;6+VUEqh-Viz% zP_;{^0|R~qC&UI^6cnNtd>;+3dxII70x6*sU}7pzJCmK}rHJwI=L~rOt%dZ5&;&9^ zH!E`1SjlKYwESe)&yfEsGl=W&s?n?%x6qv@sU7y!`e;roV^B$WDX~HncZkn&Ms^BHK zReOjk&o{u~_{(>87Rp$EU?l`00j?6=2H6KIT9-&+m>R90nv&7SB?&1w@%My66%GxfEyLWL|hkqHzK? z94KzOL9thZGmVHx`N!VkXPUb5L*5pkOdQn1=rnSsPQnOunzrK~4FSOL+B=Hl3}f^u zLc4(f(~1Dox*<)(^ksY`dWqZz&Hw##Uk4J{U>S&E;Q7HVXD04co+P1)=FGpL|xH_++YKx!Qm@%j`VmN_D zW}6;gi7~8kw!<-F%Dz&Yu&>qUXh*@>#Da%V7F|Rz=yGYo1F)?PtkUXv&p<_^!HRxD z6EUFIkA-H!`c#wd;YHlFwH6U}XM&@cht=c^zcLc?UMpnc`iphP7weEO*79F8A~!J{ zHvOf8ChU4fIC^}4{5%tV&K$pQC!RZBC+N;An{x#jEKF9|QqMNBA7#+EHLkXj&FF#a zGASj|?+&G)@6h2oGpe=Fz12g1s7$@lQ1rCjZGDHbYLjkHncPIiq>CEC*k>U3b$-UL zF(V{&xg#KBHt3Ndyxc9QeEef%ek+w^@#20MfJuk zdE$L-7RMHgAun6g`mU;)R1BrjLWrXreWrONr{f0Df-}auMM_rLda2DzWI%o{w3X++ zR*MWSLmQxIG$ASCN4p}$1Ko8qNR!b};IkO$N*JK?k>+Tyx62jk#Dd~ubtb*am$uf# z1FG3Zmb+tm>-|1xvxrzdnJfBbSv?!9^k_}C#1WkL@$+IVxa5~J)WcLeF_A`WlJ9mg zcc@L}MV=Au*bL;XsZ2HA>u|ZTt;>#3nd%^9Mr-Osb}8QkyRlg)X0;|+1fXXLY44Zd zZv%>I3(?x_&_+4X2A@#}`%z_Z$v>Bo+3}DS@<2t8K%&*dP!uC9QYs1C1P3;ZgM}r7 zS+|0rC4wC;{!D53Y10LGH{G4JWvF;sy?5Ol|B$Km+<5&0*YTp$8-Vn_J3QZTc%qto zPqY4F#p)jY{*JN#i8lI4vfTgOPyk+QS2jR>L%O7Tb9w>g&^GPLJo$lNvn!m!a59#; zZ~%C@B^UmKi%tHzDRH}9qcINb=qq|6gGE8>OK9P%2`7Lx=BH$Q9EnptfVQtYY}s(& zh?(+=tL9$r=m~c{AfqP7_;>?Dj?>FT<#i1zlQ)6FQN4j4a#)rzijHCB!`7t4po`)} z7eZd&0u;pvMu{fMuKHr6kuRTXtDWYXq@i2auOV-B!DTEF+O^v{`;;v6z2!NBYT1Dn zqb3J*c8Q_^g8`0u=kv^H47G`*ddVu$H^5B>d@KOxn|^U@@I)^u`w(csqRTWt`pKA& zG5iZi@eLiA-j>z{BwUPcoyLs2kfEX9c*R5YP>%A)nDQAhvDIbRvN!22&oJdVOT(UN z>-y@YW!L~)ycx%E7F=o)7X(` zcY6W4NfKrQoWuzL;gD~iUk(>PAaJ%E_8R(L?2u`a+MX784D_5C-2gF)}NoeYJ4t+R4i~f1@QL-#HX!nZACkb%ZaHI$K%A}J5PD=s;bd$(N)NA!f*Z>I4 z0n~4!5!7Iw@s4lWw<}D(E~htpG)y_WoZi!fRMLa`91F^c>VaGIBSgI~DQ4*A&~kO~ z?X0{>GFL2OGUiXcEDq&rwg`#kAa)710>m!4=19}j-ZmmRqMzMG4_9nVHF$T%#xy%L z1?YL;yT};+#V)CMHxN<-}*0eM|By<>~Gb|$!uxL55?wAN-C!+!7B(2dyeQ|OY8 z!kVFrzMxte^SJzxbO7Vm6B$3Pu&1K4q90A*^nKA66(PZn7q<5O60Zqf4+}RNudfzF z^$8HJ$y847KBr~TBh{S#jYaV1v!BR;fT%h1?%g3%P?XZ2QHMn4)(!~LlBFdI-QH>j z+w`MnuPCTz`SwPZ7G_WZq9UMsjn%GImg{XZRoFYTxcSnR@kZN7=&LmNM_Oi;_4kA7 z!q8>pKxY|3T<~pRlnm(c6x7H-z4>P&qsI_7IpI3+PaJ7DMmCSkX+*WkdMV*cwTZ0z zik!+}CfsP^u&psI#($?Hoo7d=#gwE4t0j^7-(zJ;r*v*m)j@3d?Wo@%y#4f~nrr*e zGmEdFuwrhn!r#Av4a|lo&;v|koS1Wm^Fk+mn#UzosVubcog|(tI;)QzhJ0=E>vlJ_4CiRD|7k;aZvgf$*b#u* z#KJvwXb7*b zS^&(Tox<;B#qba9=(-TvsGRRtR#Gi|YvcsB0BRMjlm|EqoLR(aF0Jb|m#FpgovJUT z+t&3{pBwjWO!y{e&jHkOo@gsFKO5$yMA8vvg4PrLQ9QQ~rGC*Qvh8 zdAv4Zvvyilb=5okFz1Is3-dg^QlOmm&K{|h6UE2;P6SxBVd>OSe)bK{O%yWh z{X-!$NIH6Ika{8PI-O2_*daoq@L!8ZJvk6qmi^f!MnFzv4+)^Va&f^r+tX$`7wtVJ z!)AV07bkb2&J^n#s|he&Gz3{kZ*W>tLa5CL6iGCpN=!A&R;9~JfXUI~2Z}H)A@Jy4_qop_@;2rrE zZ`dt-*wJ$6MS19{Pw1&^=mlQr>2b(Wn|LoK+({$slRE6q&6~ZHkF&OKFDsBnPY`eE z5v>=nzH4HtR#Q{x$w;?^8Fl%PbUBc8nB=x-v8MVC4?QV8W zCh!C&eOfOd>cFb`wP1`44~xn59U_0C&6rygpPd?coDXD}oM^dBj;tkmCgx ze+W9}u}|HAC#7!It^KSg*H)Lu#i0S1Gs<&+0*tr%lQ(@4f^BvexkXmzwgOkiUe3Kc z*#7`@b_)3Rl#kokeXK!DB!&vYBx%lC{r>qr|LGD)aRqF9+zJ|!Dt#VFs5E-KR2 zjUN5~e*roGe1BRNsHcq!jIw_MIulc;f^TvNo*D%$apYbywzt(dUTiKJxx0CD{IO9< zROn@y(q9=RM7t?KZn@=KEVt>$b2(1E}X$j7l4{Ha86Bz_oGo%9H&j1 zJJKMsV(Q%|Ok!_@)i<~U<-FZy=weC@*qZ}|_LQCI@FOPn<+e)Gr~kJA9RQ(!Qdp&o z-=2YcpMhVVfj7V)K;IyM&%g)w)%Of4Ust>P%wo0ny~p?D7YIJ{RkjafAnb?~S+ORW zUvLUd=Ldx>jj-zxO_jIl(ej6p_mu^XxYJ}Ia7hZKR$b>c(>`{kMEK=HVaIVTc|Oc- z{3HQ2gmVCXrWYd*@I!V0J)oj4N`}n>ck1xz)ds8|m%-IV%zLnevA9C!SzB}O0pG-y zhJSC$67$eNJFmr^MI?8LRmCYUE#xT^U3%}4tqZf~O+4R<@F`%F(a~hAe`A_ys-)`{ z-)pDtF!0@LOD3aK|COs0zcH%ysA~mZN~T4VHhuJ_=-Kxe+wsybP7;k(XU>!!7*Q0)~juOwT2lAKNgM(twP|^NHsE^n%$57xz^HxQ(+V{)5Wy$AcO^I(wF|8KqKc=@!Drd>< zqV!&F2#%J}k6G{mth2kS`{!}X%o*AyNhGPaW$#tR5^fo8d>gd8>nJ(q2gOYoXENS! zn3bw@duJ}PB*e`6P`pDj8Bs0)GnTO@8XkY!C}TshnwDn~mwyH4qPhadRxf6sxD3Z- zQL26F*V0iwj?^%t(i(q! zo6IXXB>Em;+PqBgP;{$4! z%(wqif&SSpc_{k}1==hZ2i9N^5@PAjUll|A7*R1JA&D^bVDL0$`#7R31)Cb5!3{7CUY~ z4l>YIolpv#4_L2GNFm|YW3JEBdQwsLSwU6sVfL8Ve5d25lcM}Yo(yN_?9#_5Aj2E> z^s{T6Ikm8*0D6Z9DIN;X!!R(5yGOC9#iGl;Eq5Jap!O00F_2G#Pysl)1bRDlH$6vX zZr#C!@-B=eN5pUbY3=gpU*PFo7-v<&6!DI2_E>Mcc zXhoed$`sKbhoenjtLb?~3bK-;Hp+I60rxi_q{esTn`uI0vN;;pNm!mU=so)_o2mgD(dbvA8;D@YT{$1oWXREUv`yRmLjhW ze9JUP!K5DdW|G)Jk(oFYlVD}YPd&#k<#PSj92l^H7rXCol%e5>Y=M zTgCFp-GeP~12u@QUT%bM;YuM~-uV zOlo5@76F+1@uypd4T*{@r+305LYx2NywIUO9NW)%$2H2~*fkrkIetR3?w>~z5N5^V zg%wr)Lmb=mXX6YVc*abd`x+N_+M;asWOK&|%(fsl)pNbWVjjMA>mhJK^*Xd1``H|= z``UEG!?GyuJGrAyq4uKni|vwxr`upJ;QzD3gk&8`Wn_@J_{t?tJ18Ihh8lzR>?Q_S zgCbZJaT{}B0@}4R6;ft8lyVcY?bw)c$d_IOu~x}{>}(;z1ZQqo%+3t8^J55s&1=oH zti5o6eHHH&(30Ma75QDOuH{*gSwa;~9piUgC zLknl}BlcKr`h^K5x751ESvCRBb&Jo;02;9n*4~D~=7LmWhkAnP+dqyDu6?bQwY7RX zKIpuD3c`XgT9QVezqjDxxt|}nq?^W#m@@gt4_&>+KqO9LdDPGL9h3m`O7Ss}xvD%* zu)PhMKv#y|e_k0Zq5kWYq0sE_uMF;9lrs`QeQ{knrt(BH-Y@FAYxHS$%196I&7MjU z63t$F-8tsa#~n%|w|RO=^IZ<1+Ai_(-)b^YyLNC3jDxQnmOV-?(W`bNoC~OX9z6m+ zUblE_W?t4#cVT%}wQxBLWt?eMQMXp{aWBR0_Pv2#_AD00M{gwHzZlAH+?iZrb!wHK8X^d%0HG@2{- zpS38!UmvL_#$5hvM{NxJ85D1PGxU-2abm4YkV`VjM9A+my(}MJ88KdeJupYbzlUB2nw;BSbm#DI_$WGu5DlX*#Y}_=Iz;KepB$68gt4s z+#;LRZKjW2{?k`mfAV1lwg!i~Z8NRpWn`(F)>Avp>nZL?munKnew*6R&p*|bF81i) z^1{y@ePHz3_4-53ZPQKNB+|xSreU|x?L>9v2QP-UF=u(Cp;E*vAIip0%`B3zL!xj>!???4%`NPz@20+c7v0$2NPdh`9IhgE zwg1SPX@7;yE-n~Khdf50_7&}~_7&(Qj$iF7v2gVcZ2kA2bSrgU7%ZfKKlMP*IZCJq z&?A~Xu|7V@a*~a97*SG{PRWr{MFAM)lG$d-GLo2rkyZj`$Y+oliUGZCZuBO9#t*} zH2RP`ciaz+W6qTAA0q(Mtke_70SdyD9NyF7%%%$3m3V1q3-NYG`jl;jY>J5uA+`0^G6UGS@3Io%fv#JCDr&j-skf@c}lgFJnf0`;YjzlIGvy<4Tmj;$!jQf5gY^;Q$*Ln0Pmc z_`M>q3|(O|$x{0eMEuCX81X)seD9sFb;edpG_#H<4%Q(+l*Ca5}T3Dlr9~!h) z7ggYfY&tN_hbW2bE}9w$t)+xqAY;N6*TEECzzH10k1ZV;3XxHEOh&b)k!w4{faZJV z@;H)~m&3`7A@OM4Ok_IW*&+^WEA}Oo){3477c@j#DA6h+c7PizkR6|3 zEq+yvkGr+d&SsNk$C6Q`ig690TfBLekG%F@_{@90x>TA#CrVx?z!TSfE2B0x796KW zSLva6mhD=oi zF#Tc6@ESc6SNp^)+iecW3`R;ogNrC6^MTMpG$SCF7+{3jlMbRZedW}Om6NNRON>>X z_^K8ob7aI3Eqe6BbdXSA7TZ;f0TIWc&jyPxTfnHe1bf<+`=HK!Y^F!`+s42_7Q&)D zHqbP=QNdB~vCr&YFYq04_j2tVFp3xTpJDcDCkD#3OUw_>$oe#Di8A%pUx0sWI$f5w-fLxT9s^#?p5*q@l74 zJht}h>z*tL7qJ+?9uv?H&`SI;g-&VE{Dait$O~XJ-0FQCn~@cd$9v`(7DVQN9EZGK z7}v!3_XM`^!SYR_dRjcnLReF}&dhktfn;T@@i{@B+^W_DWgJ}qx|pIxHb`(-wgh1r zjzCl-265z9Wf6W1;kR$AjJL~Vs7sep(k+l>@#wK*K7|Yp3Yr#W16VI6XySQQ`C~EM z3%<-tqjK>CW*un6TJJ0#d=1$*z?_u^y>}1JBJ%p8)SUVT3PWYYq6J=)cvaR~T+8J&B zvsYAh^o8ckm~hA@9B{IP09)FJo@?P+FOds(a>6)Q1N+_Z_L1CTz91T|??0=HM+#v<>2on-O1uNBk0QT$> z;6MOA0tp}q*;R01&;>4icN@Xj1QD?5-Kiz-D8&7llaybcAkSGN7kRLJwyN(|=p8Qu z4C!=hu-Ox5#js7-$5>_y^qm23yLimcJP!!xyG=KoX#^e!bEAoX-%AN3;O^Lt5=abr z9*u!#kc445HWHuS)<@>D>3elVlyMfY=qz4pIss~C6$IlGRO9d0F(VtQ;z3*|yhui5O_7hqN zj^1;MoHK+1CaucXTQSBK_~c0HDM^I8n7KaWCkBtQG6s%U>w;g3^aOJOu+fSm##d=^ z`*5kCk?>oS!}P|4swjz?Sz{~822%)j7+PCW)mLSy9rjR_$Wgf1KjPE&z0=#0Omsrv zYYD|#9ev|K3en6Sm|5DbkhK9*=SVu%oV>0(dBRA2jm6@PK+`d>x<)tSK&acCR=mH$9EjiWu=8+D z69cJ>GX&@hcJU8+{sKAb&Ys;dFAK62P*$=h^X|j3!y3nKU4T6WPT@Jd_}i&AViLN2(IT{i56XY z!l{QNDIDE}mHkB)2}@p-!q+3rfOmatO1;Z82wW{7CVi} z7MvFEirmEjmOGWncAUkHHA`MaMTZFL%+i*o`(M-f?Dp@zJoK3dw2>O%$xY{vP2|gu znv4&c$oC~C0|qj@22!0RGHeFYOetAgWlc0v^k>Qn_f=%%a!rP_5>weINi}6f6O;SD z)4*A)BwpneQi#fo1ez%M=Z|^k%X{Qcy5uW5l1)M^A&Uw<1588 zi^Y?2#FNv+(-Opik>c4O`cwTVNKe8k*Q8}Xp_&Gxx?3bPB$M6hkquIiMSdsEXdun- zBdrrB^$SB$u|W}2L@{MU5yL`peMFX9N0#eF_Af@3h(tDaK(Kin^631R!oh8Ri`ac0i zxYrnESE{c2r|}GqISk%qM;D*HFB;%3KBxakRNXvHe>!7NT=$o3YM+vGy`z0N6(p_I z_mOOWQC&KX?{oOL>z?}A{n*W&*8BKYTA3R3;;M{{<)}pSdoxAG0cXtRD+}+)s;O_34 zUOW5$zOL%3(I;yFW5GJ$XwLV!?g<45^UG~*qcfvkErtj^tcpn2Hc7OtuBQe1)jQHV zRrFbF{}^B?&Pu2NkwQxA&-%dtnvdfg>04!@_0C^XnEx*+O!1N{9ytpRb|J%g{<pb>dXrn-@~$(n9c%IY4E^*wjKT?W(lGPMR)PW9acUX4h& z6fzf$B0e5+JK+x;0NL3rhX!KBr$MiJb5t=rBVHqAIQrQx9Nw>sBl2|p`HF(C*ou+% zre-eA*k;cnbp2gTG6wS(jRL{H`uiK2M*6CPPp9!+(wkl7s||>iKMC(qf&NAl{3VV{ zV8fhHbM$lNvv0;6&Wf2N!g>FO?T!b#p;nt3c2=YPFNSh#;9yYzcco}b8DtN~hI^!z zomtdl`;R)Rne(Ym7}^;gPK?*)9e6lps*LRC(tl_QjlKRFPOqs_&36L8L?Hdy;|Agv z>-q{BSTUQ;XjP!>h)1}X1lS+n#7peF=-_=gJ}t|6Ffq=Th|J#dw#!dO2sq)gRAP zLI3Rb8CFjOlBnM;ZGX@2-Tytm2cGdZ*SURAisqT^_5a)_|KZ(JJ>YuNwPbxGw9mC! zQExJ_(=Y}d;HwY(J;0}q`Og9Vi^M+%_)0t%Px-GKIs_vI+^<5}Qp=k1cTXubEyK^M zTFsmH!Ne}fdy5Xt_(=Ir=r;DhhySrT|dGAQqG1BjNaCK}?@;pl8aMe|` z`8V2_%<4e&fdT`6ygj+`XY(X?{OD&ZzV*<-N&bUp$2$$o4&>90HAXGojYcg8B4P+& zU@(2xfh6ySu5-eoP>fA)kF-mrPhzi8>L^M1^;105Rk@7hEAQe(nt5d(6_zHQLH)5z zD}~(pBSTEPk1D3RmoB18Ee@FapN@hLn4-|@z$mL1ImN z2!@aI^7bd$>Geg={oc#%z(E$`IED$PZ&ll?lG(e2BN?2SWSHl#IA9)+HUYc!+A3Ai;m#CEDZv?k<7<7hcM}W4BmW;BTU@toNTpA5qKSL?26IVnO3B>OYCT zNM5_=u%wj#Ci*~yJ~_uR`wb6Ygjwy?Sx#xa?{)`Wr%H@KH8y{_B)qkMw;Ev;(S3U8 z^%~qO;D0NiGFG^c8{E==<4Wt!5a@`^!K7 z<1hbTeyO85qVqmHdfrVi`_^@I38a)>^JkC~Il#v;7k)b}^>V}s4if^ih@#lvXP0pY^qpZfif z|G1vAk_e1-t|Q+RmTq4Nze+#bXjLJeW|P+Bbovi(zr*B#x1xr!?utg_C2t=q)0p>5 ztwXpeNmiFmuq^kXW1dNSuvu!$yz%}|ywICR8r9a>Fo42~Mj5TjrH1i`n?h3I)j$}F zL>gFV@|X(|g>HOJxXWh=cGJy-nXl58xcPmH@2ZWj{mIXXZjXEF_j^3Ig*exp2fmyw zxz8tda3nAFgT80g`Y%5&7KsIFgwLZ+s~bH}e-V3?2~Vycw;x{n3G{NS|G8?q4OoUw zmU9J7##1V&ugrB559~vKR@6|)zmI0(Rbt~J`JkMs91K%Q;vw^-?xbT^A^dT zs<~i@v(vBH1x4iLc*hIa2gxXajq(b7U9FT)-0$$JfyFbu)m}TeEe90QnIRjBGnP-j zn=2L(3*_R)>tt#~JDe)jZws#dLJSv^uVd}=4wyatPEIl7@W0Y9ei_9OS+yj*CU#W| ze`qRo2ZIOlerrbCtnp&uY3wZTJ?MfQwlw*F%xzxM}85UaRFoMzJ?f4=`oR$14@#+*M5DBX1@C`RT+a zmr{w&I8(kCbXmiQGgm4~_jyh3tZDD&bo%4tURBFw>kmnL>E$cF|Jo2Qyokk%KT-TS7heS4=vA966zm-u)=%{UkK{QY7-2X zpzLN1s!%rYA@GOy*{*gPMi+9$3v)k@1H~E@$ww#}{DV47k*lvkFcJ2NX%%h!<7$ul z`Hx5Kr5g>9dZqQG0g2q?hM(po6NoPP%a_mz9WRgHf6QyxG^LIFrZmOjaM_bOYTIP=!zkwC94<=ce~Ao}O$u1{ zcJqv|qVKio#A7Rzb#ddoFGReAzvi(Lo-cc})Y91Ws`^k(f@O=m?ryi|Gi z-AcZxc6PQ(^Zl~^9=oRRUe`LB4ugDA$Acv43d~NQf3*J%>^NhSIBpBrkDvXypT=;t z{LopVz9C%LiCyGYa_qpH^-88-<_c^r*PQtroIs86WMB!K!&aq2VL_FQh& z`$f9q(N3AjfTR7}%cM-fT|50L20S3C>eV`&xa!msI9^&>jBaK`^MZ5(&U$xGUp7jw z8FHKUoi;`0SRhU2`tq?`YfpJ1dwO`gc}*1e(FNH_>b7c}k1C}*Vg1RxG6%=4nQGoUb2#cW_ zSpNJQ7>IORrr2gs)Uo0&pit%#%2n!M(HmC2LCXGA%=Yy%!>|1RADhrTtR3FRrjRu>OWeRiD2@UYc1yl zr(w4LBNR@ufSc-fO`g-K$U2?FE^E4H(RqaT>k$3d>bddS8L55I25d`gSFJx1J}%>QJ;B@Yd}v(f_!NtBfiPnI5^Ql(w8Q4*X7h%|qyK@bMqo@%>IG#^TM?b6a~8Y#M2r^d2ACh1fvciVX`qAV7iEq7pW zpoyL6Y1>l;wQb6X#~!=ps)!$y_cYGxmy8httptQYD}k(kR{|^lSqYpKf>r{+KQjSz z5;>l`nF%1!>w{(jofyk4pqW4-XePjj3t9=RfmQ;epp}4nEGg{} zc=TSykG)Gq*J{StNoMR|j+OpzHc_n_&=anWiC#2P$U+ra&eeUx(GpK?7`*rY+{M{V zg{)B;&4V9(b+B`?VO&&rTn|Ln$GD6WV5DGGb6rJ@e133h9;+SPWy}6Jw1f95`L9hl z-oBYlwIGg{H#i+DOs!dJhEFeu$*$fYSZuxfA;_UUjQVklcHlXgO%-Gl(v>0pm%BI~ z8Z}r4Fny9)Cm*D>)+5>)>%PXMV?VD~VP6OJ^jH$*@pqyh<(>S;CS?D$31k1-1fn^R zP4NF~6N>(06FmO43DF>%;PH=5@c)lZ*!dru0Eo4$wpGgWEnDdS5Kv!DZ=#TQV_b~a zStOEEmm=N@&^Q*rkc|veL(Y2Gd7gB9J7{`$(g7_78vZ!Tt$Z-Q?oRb~phn=0m$I+c zpD@$=pRnpli)-s>D>g*OEJ&Ag%jfp5}l^Ne5)3nzUlzh(87sx z5C1POv}qj&u**>~XRym1vP1jE4S?_)0IIBluWWXjQB2bJi{pxi3^tWe+yAt%dCC7U zt0r+!;?$!0snZEFCeY!NG#xM2Eo|)4l%UiX;Yg@*0EJFp?G9R6N2=M@bnszq()l z=v{JpS^(JQ5!Ha32CllGAIZayjbaT(2<>jPd6L;iy9}h?eP22rpBWE0nPw;VcAk!@ zw~PPE^Rs{CIYGxLPbWy8r~f0*0S#w_vlRTOl21HbT@{kThAI-XUvK(_{W64lPTgL9 zmI_?A5JJ%#Q=LvC269 zU#dO_|L=StB>aD!4}`sR;_$I}GYy{LL09(!qK93!Vsr_r)lclaN5jKk1#=JTOS9h! zyi4@oGsU&^Terax$<(g&oaH_2>aFf-Q;6sijhg%{|LM1aaaE0AXWr|eKuXM!qzeg% zDw*SCkz>QhRr(R#-O?sUSS{0HM{8}-Vnu&`qg9FIAEu3up!dd{_8g+c_$tMcC1he#N3mki*3eNpof3r7pnH&YDR=u!(*OE2>!j++<k-B; z2!5>yc;5zbhMu32b;!={n3k*ASp7ds|RRpuP^-PV+6L?D2r8OH+e0dPCAB4AEIh^lM}Al?n&Gj%<)#k4DfNV(&}y**HH{Y78NZHc5$=b>vC{@qF%RZ2 z#!yCCe=kUNru7Rqz*;0Xcjr1rXxOrFH@!ws&9eey8ZrJJmqEL-wkZQQSNLXdUj-%E z_m=n2W?(ymz)@7aRo|TGT$VNkOpjnCDXT}s?q20;2Jz{RH`PSbc^1MHUa1m*nz0U` zX6!h0b3CeycVaYUDi%qMxjG;c@&E-!HNyb5TSyF%Lw|=Yhn6jx9sN8v5Ez^No0;eh zZp;xarwfW08b0AjTG7Do2MjcIU$*#=+Q%H?FCJVyY_*MTSe2^9XbDMxwy}7vRi31u zvAbG(=U$2K^(PD`q2m)S5z+F2{mO~^k3T9G{t)?b{-+tMwhylG``>14d&Dnu<@K9= z0%4Dl(+tnR{{K37cCf1d)4^A?{C^!hh`|H@cLz_3`2XwRE4=?d4qnrWxFe@DXP)z7 z5j*lg&xR`QmklaPvt{=QX)$L~NU}PrX9U^k`PbuFMTM&*O=GB4VNmVk%!3ZVqX&Ermp$av;gDs;4dU9Ic7smEJ*>Li!_d1HeN6!%$1hZ zl%qClL^A&f7E5DQ$K;?|m^3IM!UOyy3l@LRp4;^OkN4jSC09K_YT^$$%3LW626=xY z6%$byeBBgyX;hH+FFPYGnkM|eD{p-~2*|MC7QamyKH&n|p>2fk&TzDtTa_nc|wQxdq8tFm5hFdTj+hq&+` z680J_Uai36ou=2?@ij^!rIS1J(G}N|D0(Mjx6CIIg=MQvjWAIMD8Nqu3sOG(%}8Rs ze28h<9Ckv|fj+1N1@JnChe_fBVYLPlq4DU*jls{S#zwba4RQ-YY3M3s0`%gH5}c(e z+18~a=+TWrU;|NuAoHd_au$8~bWZw6h#u5yWa}=D6qX*FXDp34_P>{ItHXB65B@FP zx}i%h)`C*EI}pNgvs9Ent^b$QEyv=WPHb#E+xurvyiim@aHF2hv0(U}S%M;nFS;q5 zoPd0d#6?|8)IGw!8BwxuC=o7TgKdiG*POT*YObS4lNG|l@53E{jVCS}s|+>n-~Zgn zZlvf;2s%hEY`{Sq?%_sKum?JU-D1X44v48||K z3j}KBE9Wbp=~U~-ROsbDA6us5;0K6{SM`%>3M!4@o&4!&a&Lu1j?sh%RJSCgHl1i- z{g6X?QFfp}0r@kZp9U}K%u@?)I-6nkZme+8cvVrtp9Y0Fa9gS}6?roxi&cVmLJ1I7 zJo+LDzL8e5efmPlExIXfMDb~YlAHZj(TE~YwcNjS5j@tEm2%-@WgRvc#c`wNSM}aw zVv(W?Q?SHrc<%u@y6(js02x##XlaTn)TK|`4QU{iN6G9O5S*BbXgJlPTU+fr$5=!j z{j%g%u8qNRV zV9F=!5kCfv`R^$gs>Yc@RkY@|2$MBm|Lyp4pA8KlE!AvjH2{m{A|^wLD3qmXhTjk1 zk%b%l6mvmw-$S}i`~K)Bp&o~c3$n{ko%Z!vw_c>)bIHHn_6297v^}~5M``P;4^ zNt#pma9}lTzqL&?A2palrBrBwC8Q=_8JPxgT!~gH!32ikcM9T>?rXL@V(n`3DGCU* z0bWmw%ll9@*vxPo*m#Ld+l;j zezG$2%N`i5?O^I|u{XP8qMLshECfxl3VO2rn8tZ_sdqBr-uv({ zj|tVo7pe2?kX2#uX7zo?#e|&#ot;3+o%_@6zB*w0)_XfDtj~u%RG<*~VFd3yjWHvO zYL!E%NlMRQF>o_MZnFS$vtV^2sbC}6W@DdogZZgl7sIR729i8rBGN3p*8@_q=(xa`u#i4kk~mT|s#tweRLg>S+2GxL^DZYG)8Gy}thDzhqi$N`5`~2x5MHk-~YS-Lg#y#p=?10*5s|`iVHu33#>Qs0j zet_fO4=&|w(BWTUPCs*Xc-gDbUB%VIXV}X(PtUHRD1BC?_)tprEr6i;R~;Ac}9W;8xeGp5lcO>)h> z+d)|$z*`=CW><&Mpf^_vu^ftt7!#9B zI^GwmS}M+s@{?481Lm}3yd}aSTrVcLw09o1LAcV<;isCw73@9;`}7a6@+6Y24RxeB zwbaM!tXQBM7@M{j+q-jOc@hu0fobqGE@9+f9MGR{(F>41e*ysbGc6AZaWn(oNZAM2 zZ6qp3cVx#fUQ1^vEl-rMk=Bv&dDe;I8`q)f$K>als8@9KWFIBq`hJ%AJW@)aWas?ex@Ql0 znde!}t=dAyLh=DV(`jkEMUE2!Y6C1<1g1qUMcMh;7GWp#fIT1qlGgQkQ3?&vcry68kGC1e_ zAA;XiHz-eCVjs6QFU&ulE-COd>_otdV&k2vXr;?AUe8Gb+Fz@%H^A(GrKM61wCffbOj z@_gn$QI!`oQO$SE#{>~b$6u#TYcV2HA+!8lA=nRcbRoy1#jmFzax;}IU@6Qqsc;;* z^RCU3oAToj{G3;{(fx)otbVC zaVzO?iZAW+Z96t8^3Re5u|#WXP{)Aw%6?|kr4Qo{dhTJxVB*KkzC(X3OU;*i$v}vt z`5i%3{7g&+I*A>JSZe7@@9jR3)4lHUUU-cpC7;Q;n0;EAft3z zEY2HaKhg7Ja9`)t1%0xoyev%KM>c)RT-D;OR`ePo&i~4dMzY96*tVEZv~i8T>@wOi z(;+`WQ%85^56o>ePwt3(WJ~w>w#njquRRHgP&sZrklP~2-Nu&Pgmc z5b_F|xU5`7$z`wzzRWmX`xMshxQwK^HmnK-i#uJB%pnNZhHHE`CR)V1IguRw1NJHc z+b5lI(LB^-WP`s=YOfhUl=U`gCbfu!%b&=-V24bQm<^7=nj{l7wx2O*TD%QWbGvVsK~G-SrlnN_}JD^OIhN%GhB zjzJAgmPC!d;>%{&i=_*kmA;L8VK(kcg*oA9mOCup#qj-RVtrson4Y7XTqg1Zc4rT| zx>fO!=WvMpkL8Bo+75Ms+NV9HrI#rkyH&9@Pl9}NtZHrw&&&hFxA^aMGkf1R)aWbo zgGdGEs|8i~W{*6Nc2(&@iyoX50##QzYpkQ%Pm>c?dUg83Ngsb1+YRV^Do|s=82s8v zXCH^q%Fj|+B=9U$!NhPDc_GCDcxUQ1Hckrr-T)|$>+qk^P*E0e>zsztie^)x1n-yl z5K2ZK<9>P%G=m-0?Dzcik(CP6OECZC_GRRm5N8<}tdPQs2!ZXTuUSY=WNg7obfI*! z97IxQryt=C|MILCSRjOGBISB4R5#?T>NZwOxvd+q{W`X%<<-pp;L$?~936jX2=Z@Q zqfH6m1BSbfBB;aKGe2Uv0K<)jV0ZloMJ!&sTMw2Gw*uZPpi|B0R`V**ekJA6cU`FR zY@?AoJw`qKo3|`VMlYA_p}Q~4urj}(Q#Urz)PYgx)IQ0G~Dhn~Z1GvW^%{Vi{M%3#X6iMN;nCiZ;?@7f-U8@qwX=4YrTv z(pbA{umLPu=sQ0*%r_hO^-H9sOQe}g#IZ}1fhA18Eh6VFT#GFnoh>ZIEkf}tOn;0o zgp605;OH;V5~pae)#{hMzThYV(0uM6xNVTlmWaEm_$&+?MS_Tc0E~NNY4=jnz)VOK zR}}6gvMvKJ#qMAch{a9tNf$M=bc6~gnk%+p5x1$&30jZKk@GtMur2{inJ0=#{#eBA;99bSB`Uc5~L z0`*?JHLU`b_6{1r!#AY|M>){riZ=HB&JUc=cP!42bk5He&yU5=w|LJF7|)ML&kry= zmeIU_+%#tQK5)}qAVsZJOsu{mulg#itVjKxm{_($URI&8Y1yfdudPoHs4r8lFQce0 zyWw0j{5>v{c8V+S984`BGMkw-95wNAVmu0YoLFJ(W7KFAFfsCuJQAfa%qeA}eqdbF z%Qiopa;R~-D|dP>a(d2rx>>il}=aPQ)L>Ed|I#eY4M;YLL0TB6XR zHmFm|!MqH<*n6}vIlZvfyfB=*&>yxi?6@$lnRHGn>l9wd+cT4?pGl~vo1rrt^-E!* zoEf>?wdgrbG&VEe4uiCBz?Rk*fMT7Hz+f=$mX2SaY+3^ z@x#wAI8tBi4-{BJ6j*2!%m?M&%;ohz$m{=JrZ&hU zvafZ6^o=cg^~{h(^en;I-Jk%WJ_)y(U`Ln;W(PEgs>iNQcQK{?Cq=Up;C=BAhWS@! zr;2%J-~e-w#8+^W#UoLQ%+~zN$ak?H+-ZUq@QE#ISY>;rkPrHTfyOccI^_=a)fOmh zDl~FjWI+hdJI{iZ1PgA3rH0q{4CDsvD!o?Rx0C&;T${>|XhhWDWuwJKHP%nmh>c`4 z4)aT_%PVjqlHf)%^*r!CM zE`rvt?{iBk}BFh_DptTu8painP%G(WE6%mNla=5D)Jwgj%}>(fAtG; z84k*=qRbw;THe%fwv3XlvlVkh3_tWA0>?&IHr2c}Ili=#jTmF2P_Fdd-qMQ6Xk%i1 zr>lk!d!$WvDMDOBQFvy;h*M`h+ot|}s-zz=L%$B1Ojf6UJ5?hL0RK?EmSdKVAS{zY z2$%>wQZAFfcQsY;=lW*yA`OvLI6`c(R+!cjpUL!Yk?p6g95>WUWo%m~2^&Q|1NT@K z&qK%G4I_gq?p-Yk@HEVQFkY93)FR+3p<3{(WqQf>@qyVq(_-7|9o`8Y&rEz0yPg%< zqIlyjB&Z^#1D&W)_~o_N^>TX`JQS-XxL}^h%$KIv?=q}aj($WiIJM21OtvsDzYSD( zj>~ybdgp=aYzE`%O%LPZRnM|SK)csxCVT&*4BwTor#=*vwO3WcMtQx^_|4rzCBS)X z!wR$T1(mVb-atcVLxk1<3j$n>UK~Y!S!T{9dP!^*ELV(T%p_hf2Q~f{LbVPG)hb4B zQ||r{8k0lnp{gxn)n%SUFj*Amqt<-Ymw=|cn?n<#Z13Q#ouK0Vza;P(f9r+AcK#(+r z0c5OQ-R}@iWNs8_o~X)q=IOd&zP&1^&zc9Zxf4uenX>PE-x?5p?qcuiU`LfO9H!DA zhS3#!&~_9Yk<{z{ar|}B4R8|6?R0a#A8gQ=}P!&jo8g8jw-?%tF>}@F_D=r6%DQ!qW`32LU*vS}}X>NQ{ZGd~+)G zgKfbF;vBrUqyu|=biW@``gN+`PSX6BPN&l4Ap<#X4mGoN?N3Dfz3&evi*nf=ZVt73 z;}kMH8l$j=%%k6J@EIU^yf!E!n~rTI_I(q-Z)YS+S)SaJVGqbb9C1z5QZlqs^Vi6} z#w5C^xbf9yCIhTBR~iLT&0qVE#aA*VKXCF3titof)RZ-dq_!}8nxi;_VCwNAahNR# zvijE0PXkVNhSEf9c(YV@if_6|uV7=()l0lx(H<(m>_Rfjviv2&C!!|d#GKx3aYT4J zyNska48OhJURKRlr>Uh{JtV38wMnl2=$DYz)wS{LNd+*o=<>57SMY7=DD-)JE$!;c zxO&Q<@gCObV6bG7qVe8hU@#im+h5r2;nE2FMdGnqbd6eY8INUjRbxv5#~0Bs8}W-? z&S)?R%TRv6kmdQ*R

%b10dsZ$=XQ>q3_QYjJr($Pf9(Ia>Otj*=24-UF=<g$>rjlwd3y3rOwk|3N+GGA~D>4J(xm@zQa_hD>E zbRR04_jGsr$2TI$H(O7X?YMP&Salu24~o~01RdQRU*3qDzY0t6IsjAo@_P=98DTYM z7;M5E^~+)d^_$ZAHt8mZ)L9UTu;~)`@+P^xv}hzdlp~7kwxjjg#Ya{htGIxlH0v!u z$>J|$k-UhTA=4k0Av8`P0&39QjC32VD9tJ0dv!WpY_<(r!wYC~9#XWrxpey`Gau|d zjiJ1*6iIR{zXf@9w6>MF+OOUhwMXx++yA~U&=U{T}c!#|Uy#oK8i1nx>ietogHE zW`YbB0Ovrq;?U?=1OrRXRi#4Y%n#V4w^-T_tI~@-j4}sB3~n1vPlr%8fU+d3!CPV(Sm9+fOFpnr)!#+xroC0~4gu z)7>=R%13qRgHl0((LSXS+bMQ|a0_WktVY{RqSmBT%1~WTOL0nglB-pNJw;T6+ zdPQN66-S|#RP-oNA&30!^R2^Zc*r4H1%Zi1xzU@`LIpYIi{z+P1G6q1sZARLVaL@( zPC}%cq(S_UQ48A6Jj`vB5$G{HMKPRkBbGHIuT z@9S)>oP)5Sv(WBk_E+gZEgv4}r z=ui97aknl!74^vK(@l;9AM6Zgnb3jP%&B`@q=r*WIJkN{3;#3G+IjRd6qPDzV#zLi&WW_Q~D0tA>Gg4nblo32( zm|B5DwZHKPM;u{39BbL`H#AK(%^*0sUGvk2v`M>Vyvl7e+yI58-g16u3D}tel250x zyF@ZmXjFs}b<-xlx0AYACBV?Li=k8URQUB87`GY#=<2SOeQ?p)km(90CfLLBuofP< zAn#mO_mx22H6Yev+6O1Ms7FROZwMnJ@MAlaWq{IDwrFimMJO!<;!npT;!kb4l*p50 z%xE-`Q6jPzWTlS39685FB||I?5cq#KJ7!>&ZU;?f%{n)aM}OUGIQdOYMUZKIy&Gqa zpm;v#|vkQuP5SU)POTf=%hh^@cHxMjz++Z2DBV2w@r{1^OqW%$Cn64)BM0GJk}&+mW=5C^m!p7nj3m_= zJ{-?sc)eJFvxg=JzUl3yayITuY6UI#2}_Jl>mZZBO6LVS4bTGnb32Q?$ll!j@Y*LC zYcDI(blS>mv5N?S@7sn$(RmAY^P8Voyp0Bl)9$2MYd{ZYP2X4Tlk+cUnebp1o&?dp zOK|qFU=|nonMWxN*TexR+JEpnT)tRN*}U#9AJ7w&`5_6LOU&1cbyRE}%%g~&GQI3E z5OfUj2m_!s9*~U^vQ=H|!W0@zioYrjS#BlmA6whPHT)x4go(?@asG`VH~2a?*ZXi$ z{o^eiyx+NE`F^s?*ZdZnG>f=BC!-jR{4b0!r@7V{@ZZ9;d|^8r=xp~^s$MZo`-KN} z&?KAK)ysEU7ltZ^d{0uAn({(SRi57puwxHRFY1R8sR3+ABtdTK?~LX@SbBqr69_|S zhQ#$v?|3J#tbRVP)<9^8s`W5fpDcdSOmWI+a$I{e z+PK0L5a?@&%fZs>`@77itMi$v&Z@C_%%iK*d8oEjivCoU(lkv_4XPyPAgcN7Nihem zMmBi=^$y5l^pjvH&#qMT#!&Z?sdR-1%^;d0oM0uy|4pTsZgP~t1s>+6&tsR8M)f^= zAj!Xl!YmKeeKke@1Q+?yeaG*czjGp&Me_uV$aoraw(a7@&huD|&Fu~Mj%hj?{Km&r z84-z5(eE2fsc>7`6dXv-9(8$5YUJHLF{`>jG6G1qB;iqcjA3=fGmB3n+zs$jVQZbO zEM+P%m_w3C(qU9mmZHkRBMj+WWVF+KQM>e?$8yYU<;h}b8v@UjrNC^lccM!qb*4Hm zos6XgjIIBT-^&Zc=@aUL1pIlQ(M`Mxbn5L76H7SF0Nu8b1~(6puQAoAJoi}0R}6B>_ubAV#PJ#9&i1bR=H>mFP5p2EX1(MTM9*mUT3K}e{lnksu#kTvT??A*}_>PZ* zBI`BdDeVgY<=TKj>JRM;Pl=lTsNx6My|PGw3mNjovZ+OVQWPGt6WiV*`~F7oeT|ugCOXR-2knx7K#648~^) zznfew$48D%>Mu)=Pw^L{UAJU*oMMQvz1mDB9bOAJVj@0(2{)MRb!Yk{eS}v3jcmPh zLI+V_sxa$pp!8w>gYjkof}z}M0tFC(psC%1`&j%1m!;(+G)JfsH87bj3*ddfZ|uOYS!q4-(S;C0*Mr4K0&=5sr`AL)MhrUrjHU}^ara;9d%#U&v2oLu z<18vDvpI+MWnTJ>UG^1IdI44Z>SMyh@Y`Q}3px49@xoM#;m#)CdIs6aigXHoZDnE9 zZ)uHB^gC{I>(?xMG%FPRNhBBwbiRR6Y|-!9k}LMS|K58Kz1^Iu)zrjN-JX;@Ibm(M zRn5;+Dfe3v7H#=KB5iE{hu3KYkghDyZ9kQp`LmAu}jgX`!$2COTJ?~*q?%{->pWuUHbLqmrJv36lJ-K zDb}q*0}{KG29Z8t*unrs;UlbbGLGMrQ*^MX)S<)LQV8z|P}&EivK{A)U+-|F+D$dz zFh0eKP|nexK_EhMl;Gv=qJ1xQ>K<~L5yLfS2(2&3t58fXJgTEE`7v#brIeg)x|XUv zKHfl8gcC7tz}15s=8zI=sk}pKAmJh~e1bR$TAA%d;C)fYuW~9FyVrXx@ zJQV4PEt)c1&=$C7M%hRbX?Xoic28zaTsg=dU9+v?8FPbDK1KC0pN)pi6P@(hfvx(v zn)2vpRyiGgF^hFg)bSHo9QE;VdQPbl-$S}zx||qp?5!|;@0;0xGP1b5+u0hLOo0x; zrq9Cmnps)!Avq5a{S_S{ZT2uQ@g9myIIUxazIZedO!DL)_s6#Y`a$05Z{w9==_kmH zJ9h|frJTr$GT2$# zi+OZ`aK|#>yE^;&xc6`+f4Y-6J=l#Cetacl`Ne_rug16Oxt@c#J_a*+e6I^(x`CBGq3*wtO)&;*vu-X* z$KwK2&<|$5Ed=gCptziH&;2T^-8be8{jIDwaCR;MoS9S%CB{wvv6^E?MP&qIW2IeI zWMy7wMb~gPw2<~i(x6UM`#5dXt8;1$d5BNrQnIAR510ynV35m-R%h>8Vlhm?tVac_ znOCSzYI04hC)Ar7vVuXX2`!509pU;AJlsj%Te{#tr&5jBfKdLi?DHp^j1;;UUM_3& zmt8+jVBrY7q#UCFIeP$Z=0N%Pi$eE3k8aMdi>5A&jdKHZVh#f$;CmEc#_DV+kn6x3 zsaS$Ih{l86a1%Xsk)?-Af()Y?wMDL!RfQuuMY^w_AFpBM`G-7`LNRNzMJlo}Z zrIzOZhqt>5s;gTQHH^DMa8Gaz?(XjH1PJaBf=t{sxVyW%1b26Lf(LgvDZ2#eBy5jS;d&Q9+Q9S#_?_Naznq$y9m8AsGlipa;rI0h(C;MKt_7 z2ISA8{{5oz7`a?xw1vZ>M|`_*g-!-U$;*W}Q1z-3$j=+4{ao$_isQ?e878@6z8-tO zf~=QgBJiqAI_s?}HGKwwXc{6371kbzi4XW*R-oBJ&`)Ah%3d3xL|5+qTWK4@n|@v! z7QBad0{2A>+D~I{1q6+kzOeD~iz-gv6fgN5(jDnhs%rMW!8*-YkH9eM)`CznGwk#Y z!SGQVPH24^OIV;(n0r4R~n)NNTTVe<<~pPzFROT-lDf`H)vnL> z{ea~<^5LL7%>Hdy3s8i&eDrg_0xgD#t)A*?&HS>r{k5&GF$1Yvs6t_Kw9d?)1la%LUALF*E6c_ zuyt2@BaPCt6XDRkPz)$Z`^8Nmyul0qczb=o=QinV6>ok~?{Uvv{{v);$iY1rCy-Cf-(#&*dDv znN7x|_L&I4wp?*fyF*|rIeeiR?41nqSq#=HD+vb~ItLXb2i098*mg!RM>SO}{2{i+{TZ_!+;5j=sOFCw#IdPZ1?0MOQhu z(wjl3{SDkxoB72gK#@C%>7e}=Iq2VL{vii^tUlR1JSv*%5TYiB{mXr2xbFiH5k0N) z?{D?Qbb$q>C26`3wlB}Dv-F_vFZcCyMyQ(q5Qn`l1IXrYw3f%yx{4-{fX}cYeVXY{ z%u#+cUJ+#b2<)a)BZ6VtCHCPV605X#VzB>1436)_P~=#3x@PuuBoW>Kk(pC?rLhht zZ5T7ApBX{)J+GVfdT;G~3;BG=Bd|U}n1{a;h-qR!Hs}LR5=%y|PF{8Vk7afhTn0rJ zbE|^xyo>O^p6l~|2pwJGc*BTkE5WK)vlSM5U}FF9UDMpDJ?-L-X7NC+$V9<1Plu@6 zbIFCm$nS6S8%rAB%#8ceb)`QV=jR-b+Iyb7Wf>UQ+sG zChd&>R>NU)V}}pF#i8D1Pwy#Q=_btJvZJ-vU)UC*u8X$-__EyA zsqLs0^f&WG=o_XWelYitnzAYu+|hjRAC5*F9GG97O?lu)IaCttsi=08qyyDN`t^7N zRoMD-^}@}vv7_KVujd3R^${O6Q|T=Aw^hX}xcAS@nhj{|W#jl&5el>T#o(SZ5zu61rLTLs=4(Si($0 z_Z$)HJMn%lHw!H{{}_!2Nf=I^HB7Oeb}?RTY{mYB$a0(EZJsoA;|CMqmw+<*i?d;7 zG##6e*(v8kSOUoK7xcnpi@Uo21{lEq5DbEl|5Y%$oxA^=V0@2$7mWW6FgS0b{~v(S zs-}mk2!SmJ>`e3eeiN3&&k)ujmBS_QNmv(F+0okhnvxiSG}DFYBju%4(yB>VR5(*9aGVvP5rbhB$h9D8)*;E4%U1X4PNzoy9{*`o zDa_6hRjBjG&&C8g{TT7_1MaGV;bdXmW$70d($)VTh`E4K$WTkj1zkSAH`Hu~kBeyrx`zrpK+q>cSq{uyiqU)^|6V8+_AP z$c~ZKg?0sH%RUAXQXXHT>Wy>8>|MIYVV(e!VCH9eI)O0W_cqH)_a5c^x*%}%F@~p3 z;A z;c^=~GpkKQ@PHimV>>E-E0j`Z+P6HD9e%bH@hKbA?8=Mz1~&?N52BGK5z3Zh`+Q`M z&)*G1wdOn8QM0|@{XjlmjG|9UYKlWA4;GClljAdrdvliUk{NXJc4m~V_-liVCpRD5 z5U|yF2>TVPMpnnC4M@Ew!2xBz5OIXG*@m-JwxMOWj!h78_R_~rsJ5YLlssxVJ%`P! zUWqy!cNCJ0YhWE4pY0)+W}3>tT2D!Um5mtSI69K7# zJ{B^o#5gt%Us52J)h$)NBzeb4shlgc%K1Rhc*kQA+by}e^etoFm9rR}Y!60cB*~Z? zRwF!8AW*{*Htrh^H}~fe`GOO07N~6}JbSo_0}9mxGme;Euun1p#p9EbnN)(~e1N)1 zIp3@DxF{S=Qcn-Vvhz)nXh-O{e*_Puwc#WltjA$~v#_QYMI)vh?JQx=Zkxc14L*H~yl#wQE zY798{KetR>@`LcBfPGdnnU_0sB){PfB&~j*QzCAQlRGqy`RS)nTqir6^u#FG=W?o| zL8b?mzp%5as>MKcVn+3wYe3B^6)8+?HAcd|5eluDL@G)IdEh)oqCCd)6Fp!znwdW9 z+4EDH68)-o@kA~oDhs@bW7ok|?5b*kq+6W}dFW)oGa>uFFq%sS)BI(qW zYFpvsR|{u?EyH8RPZ*g&FC9yEm^%BX%}yuxg7v3+CF7Tu6 zqe3js!;UV{#1Ge;c6RZB;5UG%corAB0~iCBx}mL;9*Yv2q>f#@==}F=qN0=&5A&xb zV#TINPxXVUx5oJ40zW-l;wz&`_9u8yuR7O>FHI}#xt-XoYv^81kvlq z3U!KKQ*h`+4jRSlGA>lY)UivIX-_ZEQr7(2d}A6l8*5MVcrCVuZ$R{Rqxx78YKNq| zDzxmzge=TP)P!J2ciFxtK0LH0Vmr12i^Lomd?_aVJ2D-U?i|4tZOAvQTn>K6=6St} zanB4!$(BbSYeQlib~s?)U|gTcjw@Hv$hJ^kbWQ)#8e72gqWN%y(CyxHnfC>0!)0Rl zY3B^b>am4{yd%?f!t&{^e2jc|t^j{y8vMX+42>%zQ}8klX+oz;beL~utLgF^+RtoK zHW(WafdS1)Wq?f}J8dE^aV+95l~q&xRmEWuvL_yrQu zg^k?r@yK(%@iRiCvvIjo!pM`e@nbyv`S!F~Py89)^eLc`GwX>n{fQ&Rohz}GJFb;0 z#+@Vbi8IWdEBJ{sz}5v~WBd8^;CK7jkh`C8V<~fECwOD#OhaRCL#<;&sxaFeZ0gy! z(_O36eS^~@mD3}M(<2^P*CZFmALQI(=;_%*NRv*5W;MCBQI55_!nHx@wNX3o-)cJj zYI2pC#sJi%xrd|^I~ivtaxP46PV`o8lvZxUCl0t)F6dTH2<3F|_Y3TJ(>w_XJap5( zM?|)<9Oyy^>6XM+%zaKg3YT{2y0L4yajbK8t#EcIa<MimY-v zP^Sn|$D&ZLF)oc|E)4^xSu&5`Es}DPyK#`n=LWL5I5QqOQd>BZ9y#N`bN%?v5oP0u zePfSy`d1Qk<-tMIR*X_b48a-z0>@s)UWt?yYQ?X`%yoc1=iAp$=}a%jRq0uA1Pq z1Y1DirF6{2DF!g<&B$Zf6-_j7u(r3v%#r_*8LUj5N%duTuKGR*3TzDOS5L&+94C~Qx zZhUb|kC|^bZ@rpvBWaebYn*)-K}5*+(t5z2qQuHlY|Z9mP6Rn}ico%qYM+JMQr8O> z@|MOlF&2%EHSMx6!W^u!ti%@BS`**Iao~+^u|-nbODIed!dz7f;)|obDdIhbmq?Ig z*AY`m@rhOkY>)LItPU$%co-NR`1kr8+bzEe*I~C2C7!VOPvLrjtSt8H(P#RKn!E4* za~^nm>10%cV4-h;M)whpxcWzhCFO5|a=|d6%(j_H{E|!`Pbt=}ksE11f(pGP_R@q! z^Mg7^tRO0MEC=3LFm_rO4l5zO4}@ORkX;CiHasdzHgs^rBsq?H>&9eA~sGUz>|!HOt#SH9U!WUVuko8bVtw&8sr z`nMl^xhk+}{5FpbT~3MJ9g+yx1^5xew4wF`d^mK8 z)rez32Th-Sq{BGeSja&2pPwgLNnt%K@xY@IPENjowk#7n+DvWLB zC#wSy7@od95#T3`O-V817AefwyHL#d>SleQxb#@zFFH7-@Dq5##S7X1-3=~%)+-B^ z!tn9i)YCq3(t)4btLfO4c}8U?@RF-&=J&bE%hy2A6TD~p5lRTO6a@xbiRAm&VYwU> zk6yxUs9;uHL-LQeU;&F&SVcKx-U{%yU}j7P3|UDp-(hQ$E8RWx`psE(@!oII_@2}< zFMO0#Z6( zXKg*3(okWomGc1ytgDI?=(mz;L1m{h_x_oahgu~l$*y%Oi3^zg^K4rrP$W2FDs z<=pGNlJGf5xELqX-2N&kbcDSAYqryWT{Lcz6ukRlfUNX`D zM}=2Q_g96duKo84Ps!yg@Q)1dy~2}$#V&rLUCE-`4B{}W9~Bu4G70V?=C>B>Z~)7V zbyd}GH54WiBPZmQti9KXGqQ|eLxSx#&*ZblrToaB`T9Zj(_JT`U%f$fHP%WX^q1YK zkLE9H9E>!C+E3NyUs2=;J*Uqkw1c4k>g^EG{`7W`mZE^-d-ViSy_C(K+7D~CKUMpq z)X_e}9eFa`YvhU@5w@!@mtmQ@*?COB%H`Ks0cdx!+jW`zMx%3<0H6D{*^B~CliPK< zp(Mq4oAvTt4=Nk7w^GCccI>8c| z*WfT$Nh^@HG%k(3^o>?&V717|IpMlu?HdY!e!QsF-_UcvJ9JYo5_2cY`US^e<1MR`FX!|TKe;&tC&g^lFwmZwt&Hz|PS7xjGw`%Vf(r1lq8}y8m@I(`vGP^=}{=h2vKnjLQ zlb$H7-6_Fc7S~_Db+X(&dr`Rg<)k6KEGGoKRMduh`Uz-+Q7T&;=~k0Y(iuDhQ56j>_cBvL68Fy_s+DPvT4IYWLB*51q(E! z46x0-~e|9+YlpuKS(s{sJP6Cx*mTf#ksIW`bn7~o>oO{83wzQ>(g)#w~ zx+&vY!J2KJ`pqc!7$$S;@{;VQai;rj~THh^@L>5^-B(4ac zoR{FZcjAmM?ojow?h%@s<~76{rk)9Eb?PeLA?9>M6s>{zpI@WI^EkdVcyjAkeFoBq za>PMWZzoj}t&`(8g_h>+r>;}EW;^s`NOb7^M*{3Pzc=A~%pT)qE3Yq_a&MaNN8y}u}`k|a$bJsfX$ z7!!(!{9Hbm{-hWm49y+wO859jkquCbUT76;yWWF5oH-I@p+xP=6%2(WXZ&Rw-1G~H zqpv)^i^GLzGg9s=TRXJ9^AN*>*5aQ?57WBR|V6M?w6>x9tUKtFB@Jr{<{5wi{vB6 zv7-zAH}txy3va3Xy*^`S3_O6tt^3C3-uVke@$SMUFuLc)j`F6PIBJJ9e$~b;3ahhw zn;fLg=61)Ykxw7*+PPLgUBo)6UaqYU@j{Z1&KHNt8H}J#@{`0mz;e52W{gv#Db+GT zLN9G%UXm$MLLP){Ou23A@0hHM>8q;gE~-M{hz9exZSUGj>bZ0$(N+Qz^T^6$$#HnF zN#R-~_Xfda-k$|J(B_KHx)NkfrusEOb){rdDxT+5z)ru_8ze9mox@AuWhz4K!eS5K zLqx6c^4j#6;(M^zc8kXz_ax1utg_nud5FXXwZHTJ#x?@mguG8nDWtw+ zY%NhX+A6+92^2JOOsE}5&DRitIwpK?R@ETzO^pB!7>iOg_FSJ~R4@?w^HQnBG_lM9 z)lUsRWemS;@~aV9bPBED3=7efheGNUs@)>GMcCApqKBuSJ`e)-Tpt!62vEDDb-Iu# zn6NHVr&*tg_Rs3}#MSUM#`)E|bj$>()kV3?R!Y?DyiN?vl4+#fgtSb>Q4t^Nw;Rf9 zjTe|=XRD=oB7#NeC|(gQ380ImB6+AVXaS)@2h;&nEFDslqiA--PdEe|)-gu-x1dTU5o~jF10l0sHy#H~LUgdBFH&fWFU#*5 zosHURzbca3x7>o3s?m$w+V=1#eiPjJeTEKp$t)2j2z+WAO&$zcns`sc&;%q;wO9DM zxh~P1CFt$T<83QmUjN5+->AiCs&r*7;Bh z#Bk@mIgD_H%C~A`21^ym@Uu2%7gp{MZ6h0>yrr{;Dy$LBdq5D5*~bR02Z$idBR7lX zvm~z|VFgoiF|H$*@;SxcyFv1?14=A&oBX_6#Q1$_4B3>_Vn%bmT!$q1Ld`5G$Gk6> zWjIACZC3i?$+W1)%R{`~^foeEtx}mHvYN)+eWBcf$_RCos~*?`L*WNj;K?t85$LJN zvmEJ%R=n9Y%eCZ-H|_XfK={Yd@|*VpH%*tOE5tYgIDXL=&+T|0nO4)Z zGus*dTvmen&ul@f2~8|y32RbQZoj2(OO!g z;m(~8xTKgyZGBGH+gXsqlLj%V37L^my*S+t|1|IwY?QiLM z;_#J12RMLvW#Drjn`YyM2HiLWY5J47T+wV3%3rpL7B^!6Vpos6eUFl&Dvfb^B)XXSdhIkVmLB`|% z{Sd;Ld>`&}Q#VL@oDP^Il+t0nS_`LEyJl!gJ!-`h%*O?@t^M#wKqeT$B02Bxt<}#3 zGoJ;^l$g7kJP5R(cy+H|xV18I__iA(M5(O=iFXPs|7F7alw~BAFp1d94Ld-a!GxDCaWOTdsrQGCPPFJR^h^k{JS2vP>Q`#HN!P^pw`t&bS7SNE#+AlGM( z`=*y&z~U74XsNzTyPE54SN+>*de^|SDTh|vEnAgWMlC5BQ-%?p)y8iI|6{*4bfR8j z{@Ao~Wbb0ys7D2Sf_1~lhHA|A`zZQ^<*RdM^ z5W@btyKxka=4R-%ZEfNi8Ftb+w-()Jv1?S+!V5m@HJ@9&`N0D6i>(BG^*yP=G31!k z)Z04TO^4|FY?KgQG0iUDRRii58_|vhDzLVhByie^E|GZ%aBwJ9g%ZhEF3sjDhIDwC*zE2FLVDc^ZsYNC2ss}9q=Pzc@Wo~lvWBSeWPOl?y9t~pS%E2GSncTFrp^rs zx77JPg?66TVsUJmCdHm*(%d&^H}sNUU0Dko*Ay%U_ry3G4sa)bSm^ZjcRs^*QqLhpqZ%$@cP%eT)NmCMFp75=Q;rt(U#v z82=qGyPAux4x_DRmyYuE1dKmcr^Pkb}MeRCmcb6vgFL{5+LtB|#}jD(6(J*?sQX!j9^mvt9pBvP7JU z$%KB-2$#(7o5TFJDqa>;tS~jM>2;8qK+Cfp!Lt5UBkd1y`t)&2aTKlx)>j$gw|bOA zJpB(;PtOT+A%jWIrnbkIIwMBk^XS_?OiLr6O25_aXWr_L7RH6mBENI_?b z0iTLhd7a0{g@yDwud;_R=#Av9)`0?(g+w8iXmwfJ{npm1-5q%y5>#8V&M&xOjp4PF z$)LB>z{AUM?N`Eh8&B;Y}P zvX30g*e_a{k>nyXtc|UzqnbP#Z7oEIXM17z6cp+H?U%*?`{?$nUePBZvR~tgC6)u| zF!3%WwKJ`cZKdx|NR#%FJ2hGAR|@zxanP`!Eg>RxZlCo%ejn-?(RO6W71&B)JsC5! zMRLDF*Q=ej)obS2hG+EkEUGSg(~AxmStK6urCm`?pjuaTEmCnVArEm(5G!m8A6Vr! zpZAEfi8uBgShrzn0MMvEfKh7DP-FgP7(&|o5oIaFk$0j6kM0A~=} zGQEuBjW)+-UE{-&y3nh)8Bj$f5vE6d#=ELmeH<*h4!1_6eWYxlRLf$STR{|EoNVXA zS;7n-XwlL#+)92ac-3i==LYw4EE6Fzlv+(3QCjBfE<95grA~GwQICSVxe15241NH} zh?GcgHZhpE2<0}V1%o=|mI6w1B3lA_Tu9-tv9m<)oTSqaR|*l0Szxdfm%2rLg!nnD zhRlT5jaiZYY_y&cCghhA&1yYuO+%S8BQRohUouX}aT1Lw>yLjf_^eW|>DOYMLFSYJ zXY++h-&BIo9G5B}k4K$sM=4Be6r$@PP?qB1bCO)Q{YQLu-^1Oz8-?>De95hTys9dL zbqI+5k<5|r4dr1QxIjlNpZzlv;nDykO^f?)^4%(u)GsIX^p3DWr?46stfcEjVkymW zmLqwiG5aKP(wey zpDQ;6l~ME%HT~RAPxIrFn!-DZkRK_Bfp)nsWsX(tv&xtWGX7_(6qCU3<2m~dft_E~ zZrzGN%N+VbRRUEKax7IKlk+H0%M9$* zaAd)DY|X+k4AOjY8pNFE6?;g@YlDSyq_UPj$6q?eP71a# z&Q7ZNFcqx$+?tEiCWcDhB@9_*Edb2BdSohn9Mou9j_^Q|8 zb#{&5L-BjTYqMzQ0pqD+__A$RSx)FJqR-9U?OA)t5!$2JY_;`~$5E(ulOLl(o>5F) z#zz=#!>lrsKNd1_z@#W+w>QVt+1>Ll+dkK$hwp*^p`43@DOTS|2eBGjneewXIC|vd z#vZBi*wX@VzHT>HJ+{5|j2nYjJpUU<{$-!IZ}Dyn*T7i^h*A4X5q<)9-~otbH-7*ftm{Vzghq z>jWKULLnx_Z@IkscOB@c;`Zx9n2Gc&`4t_{y6_!9=H+Fq;PUce&Yi36i@AR1Rl&<| z-&dVVP=~}55cH0~0TLIAn2#bKYZ<=L#PrOpOFu32|J;(MP|Brk;4xjSMlm9pdZtu; z;|-=t!4?ox-YR$%M$hd9%B|7huaBAJoXZ5P?^sfD#w1u}_&;KtRjUK}Bf>!n#w!sVK~E*4a4%`c)jB zW6KG1aw0wXbMOg{?Uh~_n$S&I#M7?zBxK!St3gjQ8lBs=XpJT>2=E{}o6Tp*gOB3n zDIYGe0m}Q8OR`T{N}RXE>_4B)-x`W_Bn%oQlh^G?F^K*0>LZRY!ltZ75&B}nd*}a{M#hMtv z)>N$h6}J?=%8;?Kr`r>Cg9r2KpugV`NwA>uc3Z=7bz{=_)V3+?wd?0a!4p8&PedwR zAF?Lwpg`O_S{MLxC!ies8_W;l1x^Jh(PzO;f5t;`#os1C?YtwS77Vlr8IdV9fK{WP z!Dh7N6YGTK&!jYo4;9r!)FnE4&?c0$jB+uIeAOiUiN!w`9>Nnc6|Xz;h#HxH>Z9{1 zu71%$0b@b9#?m$31jun2b;C8G3TANJQXrf&CZ8x88etpWx!U^fPxhLgCWs+a}q(f|60M5^_fD{L_FCxaVoqF`Ix*@asf^L-2zAY9=9K;RL5 zX`$up_*VEq0+PzCjRGn>l&fFBVLIS3bEQx(K7z}}!&VJ|G`#ZI-`+YME-@^Ek>1G2Iw>$p*Jy86)pJc4U5XwJ zCGOoXdpvGYtWpAROPkji1$iL|5(y2k;|PtgV+f6ikb1h~m2}|KWri`HV^a(g(a>Td z(L?ihg(%6Z#Kc5-8EH-^duO=LyByee-sIvU(Kt_iS<9Yj4P`9IHN1fifdPVrw{3|i zN0ueDtP0C(PKIV7)cgU%(FZlQL1(85wOOU0gdUe|3OcSer-D7UucR}Ze(;RjsdeBS zG$>UtN*F#;L?2ZNH6&VMce_cw$|Ca~yX3zY&hW6n3tyhr zjjTvy#w2`w!Eu^n8FbEP&6k}`h{<@5R4GO4!7DzY&3@u#d^skp)%ltv71Ky(SzfVw zGMhqav!FKTL6onP?{=ckk6q!rMg3c?BR)~@x_V>; z|5*|Vfp<#Bwkw(%T!u`KHytY;hK7j4Dyf5!bTKb5Fp;l&DndEUf@AmmMQ7I}4Nb%4 z1L|O${26j4Kd>Umk1N+c3T*Pon zU}!X80Vl|jQBF$=|zmJ;&92Beq&d}XhONi-jum*iMU16CAj zgr-3Fou+;BKeH6v?pkV}ZnoyVU|`)xb)9z#AIX>1qC;#DwX7mk@#Iz)_Vp-7-%>}- z7n4?4ykDaVp9ZT~Ye`kHiOJbOae7(G$X_tQo03niqAAP6!-(>hewkM>F2i^cA)31| zq0>Bv4N&D*=SAb{W9ldVTQp%3HOC@%eN+y$QNcK?lc;&Woqkp#w@?2 znK8eTxw`3LrEY8dE6_H3c673`^hrbc`{Tusbo0<98K;t+4jzM6Bu@^X( z9t-IWW+>Kg%4@S@)K@yErvJ#-=6>NUTEpH6`GKN{L$D8)di=DMgXxYwhsTa{9=iFL zS?~<~t_4*zE-3@c&OklI34(H*^{1L7d`Ht>MaCnrxn~}NQ3EI+C>SJ^i{mIy9uaU7 zh&@IzsEO>2FTZ7i)FfKhcxAc#%t!!X>BaT#Tg-;WN>g|D%HH`2zeQ5xhr^JtI2x1MmYlGF)%~XH$Cb72ZF+Ku?L)QZvmCx08HEAryrT(ofR`WM12HoZB<(V zhzwTW8r!$pl_kP1mNK|{&U7sYJ4<}O1v%;2XXI*D?@wk>z;&)!Z)Z!%xjg_>Rv3o4 zFnFSilwOUYlS1_7OU8BW@c0lv*^1t%jd!pv_`UUR7mw(_DH?`K%do*Mx_hq7_Sg~aW&fAny5;+&I8Cz6Sr>DP?yxoCF*$@;myhLjrl(;=R;-NI)_0W zM-+|*|Ab}?8jgH5fZ1SskA-%SgHDu}d8w+pR?h=cP{VU1Z140fh;zAL>w24?tK;&X z-q?&+SX)C{T5Gw*t5Y?Bbqv5Mz z5psqBsXgiM{Ejm-uQLPlPojw}Y`&^Ks70X)(*#=17!s#QOYpz`L|5-hFqjL5L7d(7 z9CmPN>K)s&lLbUpQly{Di!WM<-YhI$FILX8Oo^|2Rx9Q=${%qwLfap-d0@@KE=3ir zhVd9cGv>jp*`a5w=JdzG5LbT;pDKvp09xy7`q8timmfK6t_k*v|Z?YR5n#g4ac>eB<* zO0U(R)&>#Gcl-0+{5N2pC0(N@@}s$-`kZFW7u7Ud{3b~4frnaq<_GaCncD4ajDdh$ zlYHFT>@quaU67#LX04K@{dbD#q{GuAlLJCE#{C^zA;%j(yJ76slJiSuuTOG)!4td* zSXt1}F=2_ZkAUaX+D=zdw_XdMDWZ+b;Z@XK=pnmH?C%&SSJ)=Sr8?fqtPm z_2uB7AXD=yUsVMGFa2j3IX_b6{%ph$f=Mcsn(7w^r$jALOq_4SCvma?yy0;x|5AAz z3>m)0-ZhKPe4loDaLWZQm8FY6tENkNemlB!cm4{LAAj?<$#%N5d`=d4wT!t^y(*Dd zI%q7DyHC1UaMMoAVKWsz>DDG`??tJ;<`<1wY)z7?E(rx?#8<3r2IYuf>sZ?cUn^Y`$YJI?ZM zjK^&G?#B@}c-iP$J5=U8gG&q8uhw)mE*1A$+KAwYP&L|2(nReuWIp2FB8_^cb#%^} ztn8oUqa@Xd-+r0ab*9V= zqqA8)fMpa>XCDMETw*^}{ZDy$aAoWb4XYL$q)LjuXG+8?vn_+o6LHN!iMp?MaQ6n+ zBlql8I?_jU}B7 z1lT58q>8+ze5vJ#tHvAe?UXQet!pKF2^-}<+(JJBNEk_b!pT@9 zm|D+L1ZO0}VkPBr)fyBPl$PqmRo@8wi?=B9IOzT|4i)Pl1`qH4@c8%{p*~S95PYy# z5vHn4L)K0{oG&1Lw>Ckw(oY;ZEnwEkRT|OT3GCH_4_SdI#x!|gz7w9B7+x%y$sTD6M{Ky zdO`=qn_>x)^v{D-(W=WRc3Rq=w3)Qa`u%}FpPI{ev=pXTW`r?SM@ z_+`TT(800(+}3p=o(+mcg~Q+Lpa^>}MWc}u+62GqTrM42J(T(j4a?jygr5mr;Z7Z% z*#P7_NVL5xY;&D8Yg_dEbRgy8o?j|?l*+|-|56YQa*8dmzz>Q*_tAV6NC9OBX)U&K z;s;5$c=RsuC?e=7EX-4*u>y+=!y;VSa{81?p|LGm3wpErFwi-PJcF zPJdnh1EQdP09_K;`~S0+i-%Aa&+9e**DaZ=cIYu=LKc3m$u^Id)k7QrOn$TSrAu+( zit1K3e$Q>FFwOrJFYM~}^1iX=0O?+7qRI8fZQtMYCqSu_X%JqK1QvwRF`>r~^kZ#+ z<0WQ)|A8L1K6m=QpV1$2iTJepw%d5LIVj^5V$a%3DC5?}fGEQu1SE#Zu%7F8y7#CK zu!RMkFT}@aj8DlgnRx;DE$7I+dOT-OA1B$4kevzJ$161P+Mm-H6E3|T81Xw4=*=5G z-y6Q`3On=terh>F$I9^LQ#pc{o$2qR(;j^+{Up3<*-O$qZ;32)ch~z2Sh9rt*Qi^M zwI?|d{604dZJidY#FocPSGs$z;SqT#bIZc8^^NwMLeH1+)LWnj{?V}=YEZWZT;?8^ zFlaGdBoZZJv}3be1WDeV;Zz?FI*1`%BBEyTGRbg2C^$gmDp%#@j=12f5eSZKK#(o@-{Kt@gFjBc2Yz8IC{J@)x-L+D{h+j^K*T zmqi=1(Ov+E8zuc8F9hulYG4kt(_zrot>V|Ykb2rhl#^Jra{9FmCiUo3cIG#}dphT( zM56Pc^pwHZy4DgQRUmg;uPpPG_o=0OpUK>1MhjN37 z!X&MD2f-BtVeru?X*ZGwoQ6P4utEk53Thc!bwz=I$_wU1lg#abKhQ!(Nh7G)>}Ikj zyZTxtf{E?VBvp6eD~*k%_kn+I&$*`B58CGA1-J9Xxxk&}LI(qHCY5f2+3q9b15ZtG4_dTY!J7w)`Di zfPbsD{2g0>f2+3q9b15ZtG4_dTY!J7w)`DifPbsD{2g0>f2+3q9b15ZtG4_dTY!J7 zw)_{iz~J@O;ZvQ^0i41Dke{(Yv{gr`R(Hdjx|8wI7YuS^Nuen0#L}@61!_Nj^lfl5 zcx06a^b;m;Z#7sGbaZEB>zgxEEIPV7iY110ZkT_s9oI2fa+_@s*OWK~Xc*8OE(+H) z1?So;f(J{bYm>ZQ_QJ-I5iT!y2J-Mf{ixZzYqX?Wo|EuA1aRvE8P3C0Yak1tG{D1Z z8eb;7ODiUq>r74U9!^lTjQw7Ie@6j4-x$NGqS%V?0(R3R9)>aF9^B{f9v>q~%fl4Sr5`NT%| zSw|qE4^V0GWyo};JHl;*3R^A6HO%zQNV-1w9YVHqt_lhzC_l#gW2^KCrwDqjYESe8 z?%iKr_J60ZVvG0|mT?5hl3Jk|#=@lb5~lV(GYf;h^lw&=34j*Y7!tU&tR_?l5sUvh z+1Za((CFTsoQbLwcTwJBIriHygobEByX?q3P(6RYCOX@zL?#CdqZH zZY=R7csmNG2`9JC_P#??0e_D57}@Lm?EP94z{>h|f9k5h9KA1irgJQ>@q$n`{Awfe z2W@^BKYIa<6k7=p&19hTykDpZ;?wbEFVzv&;AA`BgPL4Us)0;W*TJIC1bJD( z_*sK5=U_Cg+0Qyo_=m>szq)tM$@vYH5{T2XdYVxV(#`N%X7^PDNuM!9 zc&5u{^@_46Ee2(qKChr^ZjrusGcE7k4DvmoWB=d78HTd~&6r{9H8@O*&qO;CYVly| zAJpp}P~8#+q5qUKs+}ctjdx-27K-S-{|INu(OQf$N4*)9dN!EjG4C79^L`m+#}qDU z=BrX{*X9h3W9BBF4CdrYia(fpW6FRr@(mrqc zzW)-NzSn<>jmp*MKVk!B`Ip!@^|e*Kiw)IwYf`012f7Dk&Ai_Lz#FDagz4&`>#|Uo z1-(71XmO6p$e6|R=2bR&(%=muv^?#`ueP@D$!||icM*d^wnvaj_263`pKwg{n2|gm z#oGC>$<6F>_kJMoqtaY7X+_F<$9Gr5A@O*{8!yUAQG<&Fd(1vJriiZ&kOpTv|5?kV z75-Jr0DsSA`1a9nQ*4bM*esUZ)g7QoBQwf`A9SqjXZYm3Nm^P2BO6mg{RsRdsncY; zmp=Vjc0**800zg3a9_m$okye^&7ZwuWatFl7SkyLHX?Eu+o+vtHpq5eBeX-6n)Wsf zDrnh5P6yI+^*cX-5Gih6i^+f1G9#YB%hHNWk|k~)Hd_Kp{u0HONGg@ntKOZ4)}#;g zIwR2Wq(vBl`S+d`d+qe6&2if!OuoDq4|lX9HG+bALTv%=&%|54{wu28e-$%mROBh2 z#x-%%FPUrxa7I$1ra7^S9JuQMv`|biY^LH5fD1^pxFr-->wLEeF$n#Z2ljYSsqZ&k z?T#I3KALg( zl>1tSa8-^P1{)}*7e|0Q>=!G5y4Yy`0;zycI)_l;WT}j0(rgip0rqDMW%(Zab10%Z zC&Qk_P8z9&%QkcUBg?1$l=9xBJ(#hGFJ)q&iP0$VI{1FOLeMhG3MBA6r*G;RY`^Yg zVd|c_o`5TmZfo?+Y~fm+Oeb9A`WHWKSzkcedyED`J0gng3TU za{=)cq~||snd9((5uDwB2+oJE{~8Gx-vtLJ{UV(zUYK7GzOH~*S9bx}7p z-uZispgM!}O#sdoO zhVyjQQC3qYlOlNS2;!l7{V_OTNxrEhIQibmvdPthFW+`vvwIcqcDAx1u=U2&j_G+C z)9z>08rkYmibn#2WKi-mA>U8hU;I4b7|4q@zFNQ;rt?LOSa8qI&1(*GO;ui0M9NWY z`n^NJ7iu&b`-iW&XJ#S^dytJ|dNKwtq3x2(2{&x?pVz^GYFLtLbI()XYJ`clkRgGZ z`j#@S8ZwiReqX$oY`}vc2HB5?4Vtz;^hWd;oa5BJW7kXQyLDlAX69~C?W+s*!||w& zSG}KYb_2mPo7(uIA^DvdbA~#&9|cvP0{D+~Q3yXc9(nkCx~MGrZ|S0aho|ro(>XZj z91gVh?W^}|jdscEO?W;QVYV?G-D<4ruA*V0q>gU%~@KY!DVIf%~p9UhJ!SBl>+NY|p?~p1*H_rpC3Q-Nh@>S$1gb z_!R>9i^*QIKhnGysHDc>M7IRrrWol_wj44{8Mj2tD_wWDDzd3b@}MdhVk`6`tVB^XS9(nY|p?I9o5-s44f+20Yh zGYc*oz9?pR45m^&8oNU1J}a|P!dZ%`IWZiG&)eri+exa<{wNUrrsX+Uz7j8we2Y$Uhf)ku&~@v;geS!8YTV%KXP~_V z`GD!WRd6`5)&<(DUmr~xM32U@O7bN?t9@5m6t%=XcqqI7tR6SCD@7(GJNa>{{gh=W zAg~C-b*XyxP-;}JEMzlK)&ekBP23)(>~)FqfG=a!xs4@br3}(kg}K4SQOdqeznAn3 z4oHD74f%o*8s>&ihah>wD^!%V#?N+j91jGpJ=&O(Ms*yFxpRA=EK)>@lHNDgER++UE~l`#n}~3kk)}`@BtuG{w|2T( zi}a+6*l74fJ0~gx{BHn8dSIZ? zZ&)cg1v}qZ^tiOF?RBY0lfA(qD*g=n0}gi>2iaT9VsQyF|16G`z*%-tsX;{wiAbDi z5;^+EDQ{(BN%GK}juzr#2-O9*6{87Shl<@N>Yc+W18Z$~Gc|=~-$l&n^7YXh_EW8~ z9S*S0RLPL7yW4?2`b2*94`wt=Pe9(#KqmWpJVUYUxPZbhVp39N)NLIR5})WH72Dxc zRpv{(j4(M%Dm7k6IZLW)GoPEkwKa7R)q!WsWx%489!gYBxDE!km;jlM{DuOrw`{JJpoq=In#s~Qk zJ@#OUWdD}D`dXX0ib`oL)<_9UtDxZH3x}bc#ix=L5KfrOvKF#SyPD7ZAk&;Q-5dLgNRZ8>k^E}nnmeTnOgqObnfCCm%_AG?L8dWDj9^| z=so&g0Ws52Dnp86RLH>VHtRPwbI->YuJZ23@m93Fb-K^%+N(w?S`B6oE^PvXW6oc6 z>?3COdROCm8O_~#`|rfQWL6C5B>wJC3<$22zT4b-BC?ilhjm?YjafmSK+j;}XFd1a za=xtHnR>`jB%Jy}{4AG_v{J-S;oiJ@IdZ4f{tbI`LmeYhY(pLRK5q@aQ66dfWUx2c zHU(bG+c-uQl-EM0Wlr-t9Yxz{8^JT?1;bv2(v1Yq=dk6jP0JI(EYM zAI?YW3^Yyi7u~?uGh#t0GwqJBX}P`^NTy%4SR|o21CS^Xa;h4lxvV%p9LfXATR)=k z1zJ=Ya1)8!kdakNt+Pd4onWLUL0O%JGW$1cnD2GW&xSp~V;*$&K#tj)T|Z03+kStY zLZOf0%i9jwLmdsI-e&Cn+26{-)l}XF|73}WLYOg|UERW(xX=aRyXJYSj9rBosGB@* z%!^yS3H3AI!i*pHHmjILtIM5*c5+%mZ#e+zsJ*I+$3EU=k{jaJ%4; zacFD&6Z7s+87Xx>!9ACX>Y66P5P2BVb!XOPy(;_+Vz?UDtCX0Hmo{+1y57Pn5LYB$ z!;Gf01mS9z{TJ{p^*btjo`eCMn|%yFlq5mAs<-aU{?-@eEtOe^ zGanvnLuJ9YeCGw%%M)+Lwjn%OolrdqPajw>cs(4&hR-sVcMW^}D!bXweZ%3&xNK}j zM#IBiC~QyYZ0&g5$TIDgv@`kH`rkOK-^a%6L^y=_Mo22-!013;5B}&(%K5y0= zBHHDfw9UZITEu<;ZvzFAOZu*3%ABcAfou9J*wJ;_R~{$o!r{iML zN5B?F>z&~eBdm(H4t=hn@LfoGT-hu}fwI+(9i5f^yl<>Adny}}ag zD3%j1q^5|CtPS!=-}o}iI8na2ATQqdTgp>=6dRDTP1J;w2x`#~gaYpQ?J)Ro!-lP013AN>Z5P4=G>I|Z+UiCi5 z7Z`Fjv~^3-v<%2gKHfHYipzJV%(3bWxiA2?>V^#%QZ+#v(8O54WYAhh!B0fLQl>Aa z$bcjC+l}S!4z0t@UIyTr9TgN18LO8>N8mLS7`F{(sP3-sB#)>j@d=wL*9Aoxi+2Y~ zrfSwEU})!SA#b)qXhA$Qt2(86>H1V8hE(k@Iaousgd3VkMeKQ`VyXO3T53=|IiprU;1|4+kwAFhHwwv zG`l%c!xiK#bwKhTokoNVl8$yqaf>=XQzoGfI;tJ9&*{#gel0znjY7` z!BVgalxzaWuvBDC5;jbf!gyA|s(LB5WEe(x2?mtba3cC-Rl^RELu5Y5_j;C!oM6(Y z3i(Dfsu_cvdBF0wplai`RPPSV-VYa@V4Rr`6);zi)MK?NA<7~wo>6U507~cKLLfQ{ zu}?&8^8`L+^GWVevvv`RXm6>FDXr}sU8iv-W}hJIeZy6Q0%x=811>%w=0|hun+KF( z)~n8czo=C8av+j(8Q3Mbs61%8uJNc6WbS^}M|e=2DQ^(^#kU}K7BM$ydEV!Aaq?+o10qW7LXG+JDO$*T6wUCZv z$p)7|5-5TrAfB`!?{p-1t@w4&FRqB<1JK0MUhFYg7Yl~6}-1iZ@?(bnlP#n}_G z)9a6z9`yh+TGo5Z{hZ|X93Hn*|NOO>Bj^ZX?kA*?Nvb|4GTeP|i4p!l;2dmbfDCy? zy;Fxiu97Ng3&)Kl+0=!3bP4ng_9>Bp5Ydw?ZZk>1YM1e(tRn|oFvb{O)x4>5(M_I1 zR1MLzJ<18i@`{4QJyZUqJwN9AY`R`YB+UF}G&*mu|>c1pDJ-mF!B9+MR<343GLLl+w99Xq`9$L5ib^Y|b(ZR$dHH{dQJAD|ZG@(W z^Ed^5YIZZYf0>34ZnFc zScvU%DBqm;Hgi}XNS_m?YS#apQrczo#&&|mVEHWbz0Rxr9)VQw?)@I-3R9aW&kTRz zt$j+4w$&CYyWS-li-($>u>=9l*S{8TF_s0-@f3Q8F+~U7OAf>0-O*6RtYWpOte6Vy zKZ)~J7B%EGyADcpC(2`)d7xa!ZjOyyQl6eV++#SU$JqW4 zs;IZE>ps+sFWnaicR6fnv*~kGu7&v_Kvo1a+z`iD$eGuO-W@-ldJcy0s`giZ(V-9f z#lg8&AHIqF`0)F1FdG8ZAM3WQ@-Cp2>DW{MY-sGVEp1lC2_9Z5&5GZkIEt=d#N8*i zM@4cy2ba2yTck)PH>dGZWuKC{4Ctw+K0sYAs!8cuIl|plTI=5JPkTfrf2c?=1lhet zJEaZ!X2~XjJ_dVfl_w2A222%&8K?W>xRK7%-gco=N?{&ugjr#~UqZsbtgm{Vfe_|z zsi#vA4fWC7cL`vs)tOQbf>oUi7z?{c4XYOg4O`Lx+kdIMi{Y3o> z))!J}W}W>43Vbz578QA1?7f~fDRot#4HSpH6=@P6LK;?!Rh{TCmbJ#=H=@WUiN8Jz zQnK7`*KKuno22`%A&j3dGwO~%6?p?wo)IFTJ1U})3Szk0hA6k_K6Eq2(+;a`IVt@J z@dU;F0OIF<`-Mo9i#T7~kh~C#WCA7{k;sxu^YW9pFxx_#sQe;gh!s^o%{qb!3M?`a zz02a066#=1HG(%k+*d<_r0HJMq?2iQ@70e>|`y-1J%vDYRC_omAQ^SQR<_^u3 z3HUyvjG4YAi(1ZCa#D}+D9w31)-c`nudLkQekn8A?p*@Dxz`UjL$bCrMY{@!>~8G@ zY1|361ikL&7G0Q_6T7GOOU8C`UkSgF`sFV2zs1xohD@b=JaMeT6|LnxzdKmwRUfmy z^U;o}ni@hbV7@2X@xnRe9Z{U<8_~@Gt|VTOS8PvR^6Hvf$JP?s!Cam?*y}>SjQ7BE z4P;Uz2|k@(-ohRKrbTKxb1o+%7~NEQ*8aMge-q0vX*=~Oh6HM3LbJs^+m!NnCX&Jx zYEGa&Zc|7yMN&F{%7$AdE?sX}LsB`vRe(Hu|9G;1#GZ?KBkn~0gX)MWBlPQ|mwgODsMA2zLapSA1~$wyx+Aa}1GuDAMZ>+IC3b$jVlb^P+{ z%@f;k{5d&Y0o=f4t@lby8TldP7j%n~N#DvT#y5dVd%b;_m7&IM$)QjHN*}Iea<0`I zxIQuE*Wib5jb8rxV@}U&MF-qKVO=AkX@W2G%T>XiwS+~@2Q~UjdpA%ur9RzXASJs{ z8IFmJ?wFf{bfr~fm&&(F7=D?qsGjPQ-?58-nCr{8KWj#=v;@l8)bowg%r~K$`MR5M zTBSw$5H%g+mqOKwSOWtIT6iwC%!yed>ryoFX4p);U%#9X8{rcYzaK#kRF$DRq_0O2 zL6CF*)z#uBS}Eb|`S@T+cMUlOujhl$u@ka{EsOD|6^{Wqrn3*z{j|aA-o` zAjUZNd46Z?Pkj=BvCXo80g@oYBa;41DyAWMe=$c(nQf;8leCpnJY7QDaL+P9UHUdJ zj#w%iDgMI`geb?!{h26aD~9{eh@>Jas?z1Hw%0LqW&COGxx7-%H7ThD-5A9#vi>!Y z)ho>v`IE!N>~9Ti)rC`b_Oyk4Qi1&Q3*K5!vlO#=f7e!CO36x)Vyw^U?rjt=jIRBM2d1Aum709dN`uFF?iWOTqfZ{_`)42d5``RSN~ExA{F_dG*(ZNk zV9cocf>8-A|Ik!9U5@9o)Fk6o%(O1)OG_swE4d(kUqg?0l;a&B*^YU}-zL9dYFj}6 zy);J+B4k=f)Xvoersz=;SmSsdM4*r5day6Y%N^IMa|GFU4+S#{TCCNB4`jfp*PHj% z|L5W}8T>A7A-_41NdAY_skE03{qW322?5N7^8Q;%<0h4R)qePq=%?>$&I?`cv6d{_96x0X{LH&i}=Z>Tl^Wloe+l+J>2k7t&C@#XPB*+{& z9o!+#H%L18?81ap=97f|s3Bu$Uks_>7V?0vD1cZMGFVQkW=sknF>2AYbi;?Nw!z#_ zc=1x`-&P<K`IUfI@d-K#pEw^k+!ShQwTE=-A9`rofo!|g=(C43ds@lfuK zRC!CmFB59Al0jgo(sLliL6>NCxP~P^RYPt?FDTA{KkbP1T$m|UHOAZuJx(T~jST@# zi)oY=QrikU$-#K|$;R5?7l$ld`*${~e#>gJ;h6vO2&r2NuOz${ASdfc1bIrN>gNwZ zAxq0S^khMrKR2ztwosv|qX5rxD-B=iAO&A_Edg)q90XV|)@Vs~_`y+-Bv3@;^hE^E zs6V5}WtUarS}%`h<&8SM5>rloN>Ks0HG}X($3xloV2AgqGuncdtv5 z;)T^p;bZ3Jw@QwS0*6}G#2=JbnmQM8W=2+qU_N7Mt}z^a)NWdbu-Jol{+l4nTg(j# zXG94tJdZ5eNdU(45!1L?<{R7aP1fZbmu_qWIV0T#ruTbVf|OQ(Inc6ZJo%nll}R!BW@Kl0vxwS~ z+fCJyEkB^0RMjqDc(Y5&ZTl#IP9`-Xsf3GdNGIH4k22RZlWiR8huTP?8~!t?$T5xk z1-4xXkl}9B=@vz0TpTXjes&@wdioi8q6Y z#nl9}rQ*p+m`=TIFquYbAGjnwR*gZ{kZeWL>5tVK4?J@vczou^wS0ZUC^^3>j$Ni6 z&2oA~KfeBgt(UM3Y0?N-ac1hdJzga*8ElArtu#fiK z?ub^xmLNh>K34K9gV}2yb)`fR5llUf?Ok$6-|@~&p4?Xnhy;>+M}b{Z*@f>`Y)zrd zB_32{S@L6L&Jm{AQ;hlAGR@rTv3?Yv|BNU)^-I4+|EplkX+z-NX!;eIoU;EXA3U}K zC+JFlG5=M=Gzk-0#_GCp0zI+|u4Ar*{UD`TbS0sDUm3_`I95zU+5zS0A`&GbcuWhr zBX(foV;XGd2da({_Tot2ojPm_;`<|Et5kKsUPR60(dg5-kw7kWH;Jrl0Svue0K_1h zG>UdUmR1~Jo+KTXC=u<^GCH**-mkTGptIkqrjVt?9S`H6)VgPgjXHP*l-}LZY5Y8v zB?^ei1rr$A*@4576nXSv44)E-D27dO{{=03iu{+U>j?r&Jod4Nyu)7T>fROPm;>z^ zW&4$y7@q@NQLhx9xh#iiWP&{a%M%uk1RNeeM}_|2Daus+%U*mq*6J^i?&EbPpe}a> z=pE1~dP;^^qg~F^B3I0f94dvJ88Bu&-B2sQ*a;-ky3|wCcqB7$%P~Iiqi<=)Y98(i zilW)o3D%Jso7`(0O=yiia*LUlbuM?>@H@k#_uSOn8B(9TS5@Q{!dksoebU*L<|Vqj z$@odX2KF+Q9eeDcSMZUSaQh>-|JXfdk{x zg5NN{*YT$4Gh@ggDOWP0gD?Bli$*bs-v&5ZhJJrp(YqE31gT)5N|p!Wqz8aPUCGo{ zYl5oEu$zMPhTm7W}!mkI-L)LkA!Wydx^S`uY{}+S)BKooWqff3vxCVml8ea2h*HUh_kD zbkm3r_wrf>v6|`pCH@kh#a-n}w-fR|7h^FCe83-k_ zP;@RCMlr;Clci`;wzw5&ro9h(*U3yzFDb$#PAI=rz&_B!JS_uf(P(HOq?|kre|w+H z0*p%XLW0|La!Ob`do4qhcUy*Cldo9!0HZ@`iJzJ5SGP7>oKuE8P8-9yZfku5Eu9@K z2BOIj$B?z7dk-zqprUGoa*J#QjyNNRWAW3mHOlKb_{q=T80h_mRI~tGNryL$&ux|( z%0`{TzR8em@J2waVfrKu=9=|SKRO%m4uZ99u?w9GkeXwfvOf4s=GirOp9;n9cNaq7 z5(sOif4x82iHve>l&hvPiW(+L=3{lg){AO{#4c!}NAx7H_s$Ak4*yUt#pT&}61)Xr z%zMfWsTswevQCr|Ax_pW_;exhadE=?b#D31Q>%NQBC-eg11(UN6P9rXJCFZ24?*Pa zRoOKz|I&uqf6&u1c#Z`EOQsG!C&y3&OV)3X*kyxtx?z)N#l|}tm4gM3(?fA7Dc2Z@ zS(mieV&PyS6fB$cHcB#Zk|{f)reP)nsmwFEiX<)`8l`>;i~4I{O|hvvw}c-CKm zv(0$fmqAi-V!?hcF5Y#>!Ga)EJ^IEOaEDeU-h4RwD!F5(?C#(!YKbV%AOg>h6zhWF zx@2>izqkh7ByC})QlvvEsTF6t!~6l6nB*L2r8G^yXXt_s_hb*JjL&Nbe<|vY zv_D62}Z>o|5#T)KIbYkh!S#O=5~H_@iHiGA%CUm&GBtJ_Mr4D8cy8GHs0ce(<LFd3v zP>%P7KV+ytxZbp2gdkCGZm=Yfr}r|@K8@kFWZJ4^Vu}?`=fG6;@N110x=|N8p}fPF zi3`#Gi9>?2(LcjW>%j5tX)ow(Q4wEsj3iEs?(Y_e2`V-qQ9*P(m>;n$E5K-EGXnmC%0Acz;Uz$|0*)s+Ak_?8Oj4k?GqnBUIY`Moww8N>N zje#fa>2I$U*wzX5MtCHyg%K0!l2#cJ=C+7fCJQ)JDc;aBJlldS=dDm z$)xD-)rM!f8wmD)`=`V5qTj0F?HBDXoiiXv3uT`8pW$jB8~QS(t#WsPjJY#5bbt@_qnhVkq;ZOV+M(6m9}B#gnVw{yI~*Y*JVcq_;g^*<0Jr;`B{BalXLy+;%vP#yvL*baIhx$gj+AvL4Lr5V z{38e8M!dtu6`5C0b@;dMaDG(LJ$EPRG=(}8w)+)I-DR{h-41k7Wd-b$du=mV{n!<)cxIQNUk>cxHyF@EV>s7s& z-%^&D=F)m5k{`VS>hT*+Q84vl!|_=a#*P;@_nbsn};%0w(^5E{m6M@`IUYG z2*%(|ZORkqA}dm+ph4+7Y_kTIs$pt@S*hQ#jZhyXO+O|Y5CZ?sn{o`)z_!B8o(+;^n<6*@Dna8F_XY>6Z9tE zHJ7+lgt7Y5{L&Y>ScJZ0>_=o=@|oL*sL~lZf*}Hvim(w9hZUc8`MuRnHw9ob^6?>L zrj8ePK<6FxUAMxTX+kKc;OpgaTN;%sMP|avbf#qzV1i!Y zN%PPW-LK!p-1}{7zd~)e!{jfVE8ncXBX^Jya+QrZCtZ8S1P{4jt8H%GDGb6a)`{xh z1$4>SC;6@+tDL{;LAJj*75Z8>1kt)U7y7Ol(=|4FJ@4(qr&1lKxFY8C#H};6G zg>;2M4jWWn>7KOGeN5!V0N}E;g{i2gEZ`W=1;!wl;DBj;LmV|p;_twEV(wf3C&||{ z$MA#Tyg!Bk zKN?MzV*LnaGGS6n(uHQq&f;uJ(VD;2Z{hS9;Em*e-vx87 z|K@`GY8me=I9T(}g1&UYz<;$Tu|{>-@m)y-&k-4 zNcoowM*q_V`~JlRmk0mhf|v^b>Vhf}|K@^%f4N{U_TOF5<}Vk-Ecg#DI6b5GA6O6w zZutMJ3#Q2bodtn^xghudTNgAvkNLX`+NJ&X_UI<90M3OHkx?afW`^b({uJ;ZP?+RoOHC1^X!mCjsZsAh*NN?+N*4YeP3Qge zHLdVo9Gt^Q?&MVuHVmc}@^j3%vX-HF_U8`KP3!px`U&KMQmTJ(!hByW+WFZP(^tkD z8Vp}BIqy`{VM53ubEbKI`uTum&Y0m*eB-=1(eyi?F)xX4fkG)Mqd4l@aIkU42_#K2 z42{(8QXu-^FUqsOs1y##?c0HGr%!(Luf_VVMaL$gHC%uUPRRkt#7e`%D6MfB zd1JQe4DO_JH)K_*r_(20&}($+k39{8iB-85Ww}ni^eq=xw#X;g$F zCc(`54}qkPsUK|{+xY~_yQ+4$>fPs0^_zoEi2k|A_*CQm+GEBA6$U;atI3~lO8wYd zM7|qrL2`(odj4gEMW7>BgMw&_Rfl3S^r~~8P51VR10Z}%VpjtGL7nmT7qE<7Q4uEY z_;DZ>Y$J7WSXCMw)w5Mp4d5HL1YZ1ikJH(0>F;$tV^4fow#BtRHibl7I^Ca-CKbcW zAZ{X&URWYWATstFaP+RVUbVzarr_dXs@AeJ_mEhB(^Q8_ENL9HVxBp&eehh$Df%~% z!}|Oe$mtn%iud?hb4;Q(Z!+qh$q_nzaufms&x1d33R>|ap9uN}%gXIv&l7PzH$+H$ zWs`0w590I?1(OE3dx(Q2g1SBU!H_}Vo&qva9ZK+}c~_*XGc=_%4e=M-D;OR~HOu^X z9ndRbA91?eGe+Al<4QkFI78C~U_a2960};49V=BD{X?e6*u;?Yxf`G!kmY>tSV0k< z*kDYcJWnSe7nSvD`g1-EVr3kJ|36IVPr`0R?-g@P09#j)W;*TpvYOWNN;EpkiHY)=S=w3_pKl}dfD0B06Dpd8M6=sMxLSdhV zoDda=J;FH+x+PC{U4U^$aE#F9llM%ln6h8g3al6K76WME!VEX!zM1YdID+NMk}m|- zm{+~45PT{M&ioK5er8dEIML7Xgz_L-*XoK6b*wYalSw zhlX})PQyAF%h32Lj5ihdYmm++n<0Qz)xTA__`1An{=QlVw?ajO5iO}6&F`K`^%^in zF(dAu8SUeK7i~Be!OXfi(03A<3R7K*PCO%3n$EZvHX?Y}uFZxqXYdX1gAf})VdFH% zOQ11c^%%lgiRouIHr+WNg-&@OGpUxG%O-h8av;!zMDpG~gtwc&=3dz^o51El0VD~8 zi)YSODyCWZ*|}GTt>Rb2FRe$MY%bls)oOda?J_w2%42xx0`426cy&D*|4??C#yd4^ z6rEmpas^?OeS)6b_!-KQUI^kZqXBaUnUryZ8Gy3OmchnApL=PLZ1d(`&N7MH%%v?+ z`20XIJ{Z7AA7zf|JOi$VxcVXOo*8W%j&P2&FjrU_jBw%Rdz97FQ4k@ zg_9(*<;%k?{8$(>WE=a`qRzy=zR~Kn3c%}S1jPU|`)0rixmbe}3c39>+E-s-TyseL zzPZ^Vt7F_RzkS`6EZwr(MI;d(x85)OVaMZ!xY!1SqKMyPppncp{xUOFVOpxpyvA9j z;&qaAi0|}j5zsIOpl~L(H9IHbILX*tPz^-RR7P;RqIfE5OvoZzxz_nv6$*24>bGyD zX{ZuE5H*nVY_$+NY+iV{1nF$PI+?i6%h_NdUQjTs{ekHiO&*nivh2Hnnnxf?miv~% z${ahe@r7SrINR0%gr{q5B=T$X1mkaHWIXgXP_Ohlh{k*~uszjb$+P=YU*e+*s^ua~ zG8}aZmo&Kb1xKc{AMU+?xyHvZx&MBQjLYgzjEvwv=E$qW*nr0QGSa&yo`2Da+ zCUE7BMvp*Wl&3^-p^{Q_rFXN})V25vw{%2l3r-)=L5_Z;BmzTEcHh+&80e{On;ybx zgv--7&md#b)XFNujI!=GPeJ6C)?ogiI7@agRM2lr`cMBUrwj)U0&Dh(HZisxTRd>Yf8a17{#iYcXKd`_*+5t(^Sopq-k?zSJn! z+uqm4=4O7s0?ddOm!~t}Sb}SV;O-qH>zVO@N6Rzw5mE5n_!_IbmTNiJ^e6Ac$QZY@wL+rSL})&l%%KIWV8gME=)-vlD0e>jVLsn3 zy{Cd84=Y8J6Et<5>N_FVxZl^stp-QzHGIG%DR)_gc~y?RU_u z*sch$x^V6`?CZ67OZZX0RWVl6cLMDCAZ5Uw&k`C-ckoIW@1V)MpZn)+%RUCAQZ!5` znM=LUoaC)2F*>erFvvjUgDb5G46c}_9N2@%jsgp8M!IkZ0k%q>j>@mzsF1JvJ_Gz_ zdY13|{6E|M>dxO667QS;Kf~e6g+#>5V$AzH>mhqw?IZh>gw`0jO&(x}XD%){7i-+b z*04KHc36Yl=wbDsQ$aQ-d?2lub4%FQxcDnjluTtSCx^J+s?=XgRN^W|Kx~s*{pWtYb~gW zyi!_?VYI{gy-@(TVKdOBk4K?{=*!Mgmtw9NgcUsVLs6SI6>M=SHwQqMcw?-Zy)+CQ zi}FRa<>{V3prALs+N3H}r|y#?H0tl2Y|>mfijmm~Vmp70?Yy77C+iBgZe`dwTlgg0 z@@7-M|0y4&55F5spH!0dSn7(9eB>-|e;Z^L#NxF{_M&XqOteImexSOcNyx-5a%!%< z0)Rg&GBjSX0}>ozglB16@#_FEUt!Ly<9l|nU@P0f0ruL)VvZ@b`q~+>mX3L)88e$k z1s@yqv4R;0kw0E&R20N$aZ^4{)>uhru2NVO&4Ktwv4G-6HEF>4IVvAqdY%4qrQSW_ z(b%R^LtF0-0juhsnaUaE!*&OhDEFX!g53?w;U43put_S$figw5C494M613nfUDpIG z6S^_hE*!XW5?V7N<>RS=1ahmHnG|M2Rl=XbB6AV8RhAgxojkpTusDgxoA{KfXfeY# z6Y-LBbwB`T8-;LY)?@*7&l`a5vU4sVPLEBh3e;Tck}pqRE4U7;;qzrW7<`L-b%xi) zava7ntyFRcPn?`z`aC+F+A#4^Bu-K_gnT~jSTznpH5J9yDR#$Cm=+XiqD(6*ii_?a zCofbEo%G=IIOg4d(hFrz=PaJtXQLw6Ti|+51Pn`R13<{bINg7Az4)fWq55KORSR_h z&cagL<2!+=D?@TKIYAZOsLOXPmsZ@x(D+gM7NC~)JzXW7uG-kGP=ZoXO}8p1rw4Z7 zGwC@ZCv3E3A*In2I@H#8F`vh-8NI80Y>z5N8CXwj9*!ATj7E2LL^QNG_M&ULOWX<^_)Y$Hw3qOY@)xlx0Kj3!f{-Dg?ln6#LTL=1>JZfAgKolP! zx`7M@sYPoK9|;nwt#r8BN6RS(J4*v5hJEiz5$1>7d2n5o>kUJdin(sKO-ge50!PJ=KAG-5F+-XgQQ#A&L3X`i$Yq=)wvufVvYtWFG30D zHMD=)Fh0n3 zsLrcT7+sG+9z^75-q(nuMQ>!MloC4BEvV+asn~)Dq(@h!;3-lh)|#c`Djc*^uOR~b zP@TtQCG$wp&RZfu?BT~A_6_GP_vf3+AiY{szub9F*=f}QEjdYH$d6}sFPPh)o1ve; z{05Qo5!x5efrcXR*jbQGh3D*2Csej|c6d?2Jl(83t!0{%oLEkNEcRx{5lH?1GhDT@ zG)s?Vd8{g7M(%5-mjt}v`UA5DLrEO?_Y zp*VT{NZ&(Yhy5O(wwu{-RP1$CPmd3*9_8iH$pj&L>T5xbadq z55VI0kYQmHxmI*b;O}>=KMv5E3+u6JQfh!F_NdT1KwqQP?ThVeh+TxOKJRN-ykpf} zylAYrivv6$fd*Q*!Gb|xt)yU*pqP9Nuu>3rt1#-Ae>v;&pl(~N=MWIjm!i4=6xLb- z?8jnqO>zEA+UoPxm_G-K=}G2XJ0THJan>LTA`(j1wL%0--_g4hRAFuE{m5&GJH?Nq zygC~Swc25}-ltns!>2o^d!5RVnyOFKZweriI;ZWn$d~1q$bUQ*K9Hw1xMTf>c|-fN z!qKtt`AsV~N(fE70CQc9j;%ZH@*CLeY|Y|^LqCLf!6 z=M{VZ^9PVoyi53yOS}Z#DD=-UkA<_jIM^z`fik!cdcWrPfc29Se^vRUq5Q3B*)$ns zMXztrwBunJt>6p)J)-iyCH}KVCc@rpozmL1?+3J06=1SkH2*XZ3B)jU@!I#L2Uvrc zUD6QA=D;S~TpLUc6PEW|2JGs}F8(z8^l`QRH2XT0EBbftEW`3y;f?+gQ2{d7yl;vB zY?6sl;oD{;#E(OpJz9Ak=Od;eAz|VebC(F6kYh!OzfugWqbwe>cj+=YdklBKzcpZS zH@qDB#?cT%C$UOrv-QP<32%)lV1Yx7nbkJ=nPC&)IWZO?O?{+-_aW`)91?@A` zVw5=EcqG(y`|j)67T#ATTOc_Wh}oiA(x#}5`bKj0z2}!{oi}#AfYg3y&a8FghiEM- z17@jR_JLSUNqQ=&e-!&`vp0%WURoq>rLP|l$jCg|z@So&{8 zzs@qOtdi`-zZL!5j{l|T_g7BkxQGv2o}n^fG{{A*pfZ11wGZU1bpCnR?#bi>u>%v5 z9?Y35&)c9t3%s0SHllR zIEJ1ZlJ3;(n)9I9^6ZtKjkA; z8@RRA$vx@|&A^EfgH|=C50HWx7;%lwOjkDqGama)*aMl>m4On5c&@ak283o6dJ70> z7Co(luys=aJ_4?+Jc5QMc{R2S{a~k}&wZ-T8r^mfARo<}4<`y`;41##X-7y*3gL4? zyvXNRmXS{+d9JEaPjL?M+TAi98FdTxYJVYE0zZJJyvTrPjB3Tc11;WKkDrp%w7Qj9 zyVuQMSOPxlv{(gI{G4E-uX#Zf_^70uUs1D)!Z0wpi|x$$W*4uvF02U$D1~t^Qa;cQ zsJZ~Ovg(vnYmqZsQb1kkmhKN_NEb)J2#|ifJ0<;{fv;~^8xyfa$c1XCLB(Gjug6PiDn97qP4fjCk8W%_yC3s5_^hS;rKI&=-4_)EPFXK$v>&#xnzhj!AM zj{$Gv{p>IPH)B18$AuirzimPaYwoT_C0XKuobxQo-iTQH2=5g^w5rK#a~}5T3QC9O zJv0r*#gNsCZgETlo^R*@Nnjjl*97`1YzAmTjZRy4tL;Frq|@3J0wcDafv{LOkD#DL5BdB;V58nQ{fhWM zE(khR&ep#711(sOM)&)NG(_vcOq%p-{iOvm{Nqh?6C9~d3xYrX7j19-7v-Y2Z41)fDcxNXf^GgrVc6(Cc zqC|44_|D~FI4z&f#AHifY%0*Rhz@00y7+2dP|$rmc8b&$2Kc%S3qbTZ*D^<@!`9ZS z;-IbwNLVlW8eYYKKw!A~%XOP`voq>Ju?6JI74onjXI5IitWhGVy10`tFLj?My$&lT zo(}>2zG-p=;50o)rMMFa%ZKK*H9=!ivWF@2tiM7(6cdK|bi71dLc3pm7uE~Z>{#g~ z6!J}*A5d!h;c!e)?g2oSrtjBLjuz;5$;&nv*330*urbcRo?;v2-oBnhuuJWc-W6CH zS>U&v;%_S}L?RK$#oJz$IaRS|5*Dx7sF!$&jlMJsJ2+d}nMWT*5+!~yTZ)}9t~mM? zad)gPlcm|&+IBKrULm3Ok^Tf#3OUce0Dpi#iN9X||496GWqbW1{>Y~uh`&F8KfqWi z3{J9bUSToZ6#R)<()j2c(;~w(_m7*T%XH@MP0`34mhWFa=d z<*wLKAE+undqP904I`xC$Km)mkRbH2q`C$QRUm2kZ`cpf&A>DEY^A)YR7X>B3CH0G zU&UAVnavy`B~_8O5$<=PgSOd0;8!182zVg1?^6g0ppGvig=d@om`R(yI;b3j>Rn$T z*wJH2>-eg7rIr%?fJd+58T>&AFwa*2A_BPKYX~6;l=f4D2N7+Tkv@_0robFOF#vIY zR(gh;je7}ok2z5oH_6d<$c??Tvj>a<1Hrq4)A_p;rXyRg-aSNaO<4Qt1^}I;xt09@lR~E@%~c^cJ!_csEtG2y-ZPXjpD7PR4VLrc z!&W+^h8NW&{+IG)s^t)eapq?$&jDQw7vdH_pSZk8n1sENmKDKktQz>9*HaVURQiC`$|!Q6bc_ zV3{ShVqJUYc%Q*CobP-U#jfL5ZLSr?z827FZaY~Pd|@#0+-SVl3XLiY3IJGaLvDzY zbTBEu9z!HK%WD4tEv%f+@HTNf#W9H|a^u?>T~`WYS)q>nOtKzJTz#D$qZ?osFfUH@ z6kta4p$Tu!`M@20RMgXW7h(@9(f%u+_z3Fu6Fgp#Gj`^8L#4*}zV;G2)Vb4*LK6W& z=*FH{MI_P_Wkh$*mb~EuaasU0P8uXc=K&)Un-`n5m)5T>8s~CiIA6zSlS=V8_<`#o zW@r0WbhQ>CqAnGj&kDV$Z$eCjTHzLgEniEt9z#@41c3AhkJzAfK9S0T^#?gYYy+Zk z^;lUDI|I|HWU$5INVXdk?deb6T4lTXqYtKL-?Un{F0@*I1%3Nr1pv(|&_vyZK?E6; z&o>E||3Hw5l>Z{g$YAdYvhJCCf-Ge6mZ{CU!ywf>Y}yavL;EY)msnI9LpOZ%8@oVD|PSIESr?~EIk4s z{_kl~uWkgx%~&?C+S5KFh_@6KfEnTQ#MT%9{!M-&=Z+82a7X)w9UKSYVv-PmWW5?G zLq4J))wL*wTrGp9Fuvm37LzaGq*T-#*c1VQuFY zdYu9+{*JAPuEnY$e4=%P$3DK7vbv3m`ttgl_+@UV6Mv-w?{HzuS6=;B{xjn>H9a_U zDqVdwE4Msjba=wGGwyZW^w;Qf^YlSIOc;g$=GZ%D1*;> zTN&bm`dM)^6?7wYGR-QvN7jWY(S#ch8JPyuQ%rr?uylo0N1o?QWJfVc&E(~C8g&-% zO8EH~5iT1~18DJl9D|iGS(!<`amyA^k|%6^VgMFd^;o;h_zDPTDkufs^{D^wDMqAg zHv3>qR2!of?iV)ms;p6>#+UBo!iJIs|!DeK%YnY%%YB zu)@&-KMtEm4_pe`_CD<4(x*Jjg3IxlSI9%q#>TILpg%D*#0za^eo`Q{Z**Nx=27$0 zc?}!8-BZL$JO<#B*}*dJi1zha2>~S~t%dRztvPc|8@`3FT@%OL35w13_Y~h^ zu~}g=zB=Uamui!hZHq!98fm(N96T;tXM$H9COoDFbiG#$d^LLVjL~$q&emN6)526U z-&Uu`*kAWfF5h&3dhETz>LX~zA&#b3Dba?qJ`v?t!t2AuJkzGZiAF`RG1GMy(REbz zQRy9{`akI8DW1FGt5*no-1M)^-JyXJDz^A;iGbmVBA5F*M`X+BBAla#o-dMln3UzK zmZ^V$p~|7u7wCq(_13OD{o(-gZ*r2F@>`!V!j?@!Z3TRI_u`b|OR{pX)Tk5BlFUsj zAPR*r_+Kdxv+XQDobC`G|Bt_($c4zR}mc-fw zF>=`6TAsnmXo{^fbq4unEs^UWeun_c4v|Cb0_}$Q04j+l!aveW`}n<-X%en(uAI5o z>#;{*+>4hp3ZUlV;9{xvEgv~G?&=5G4EnoJv#&6Davd!f%cRomVb8DR#UMO+~AV@8kgE$d0d>LT2rS%+*}T!C}_<{_E} zwT4itFgvOWOq0bhyNW&2hVo^5gFU*QL!tpeBKj_QSSQ|+VXtHq+w8~07VO_NxpA*v z=3E37wR>o;H`=n`GZe5WodP}ET>**Gk_HJ}N;lVN*~fkbMehT`_KZWIongG(!~lFP z4TT4DyFzwuzGszrhrm7`=6oBRNi;v**4mG~!^jdOCOlfE=uwbXfrHO#YEDsvj`2#9 z>6;FCyfMwi^PmKdc;@B51X(Pc7QwX&!&w!&;Z3`;(G;D?w4Nb5*NvsD;sfr&;fqt? z^-QZ`8r`X`V(*?p$(Sh6CD57smXRS;_pqAE+4Y7MXXS+C~F9GELJ%Qr!=Er z0>jhRE`Liw_bWG1NWkLz4+qr9k-P8_&H3iEN@H@ajF`+h`An-57ST`e>)+j&E%{f~ zn;W)#BFODUoa-~`@n%A-WOU&Je&u)venc?oA3oiCBjWn_&R(vVh9Zc=reRvxGjF%_ zISRiwZ{rLBByUgiu2-IkLkO%>CwrC$YffDuHgcWUXj51tK-t`_p{Q}4TZfCg^?CSk z_wx@6YW|b5NtPLMCzF0dsjBU}rWy2`Y7z!pn~E2A)siGWl;QFWO~sZo!aV<3Yz1*y z4$X>`JN+cE^=9Y79y^?=@ynm+7MS4zoIOdHJ)%*sWz)nGvYk3)lM@|ek*8vNVe(kX zyu^FWBK!h^`aAsrUfcnFl=??hiPVeI`C>XuW7sGi>_<&+zVzEC)J#MsyPnfu(bt9#eNdt6>BFua-oIKAlbN1_|rzaD_r z>Yk%E+UFq@D|-Cd_dGsei_*;) zoQVMs8U-Qrfox5}z=d2`2wC8It^h<1kS0%11}a6{kSQ7Uph(_GuDURkW-n{uZT!mV z;3I)`{U=QzF_gnCNDKuX*ubZGFNRuPcXTsL_2zsCi4y2sS=*{PI{~i|>f(T3^6((+ zf!%qI0I-zls>?2T;E{}!P+%7_kPu81fk7fraPx(58*auB`R%g{%@+57)z(QI5|20K zHEkO$$_9Z!K0qFs)RLdekHyAc>aCKyg+s^#fUB=p>IuoG*C!v%j0Zx_Yds+8*Q8 z6qg1_|D>Nk*ZNpQGlf(#Sg_d5HqBVSrdtI%JEw&2%V~C`=Ziyf(8Xv}BD}t`~ zUo3ys)u$rMulUpqsO2mnsNY9kiadb)31n3|pe&H3 zs3_oTmJH!Q;_Fo{L1fE&|H>!mc@CVVClm4J2o>uwsvQ7Vc4WW$#VL*>S#-OC8HSjY z^zeLHG2?;FRS*GeNU96gr_9BOzpP4@<8jVnlc3B5$EouAiFwEkeZ{opae1h>hHGL> z%^>5rZ^FJ<#{)}cU(Wj?|1J1IqTxDwcYCo|TR8$V$N^_M7%cVEtOWR_R@%gqR1?+X zb$Y9lAGYS0JhM*ZEfaq^w4cxyw!+eY*x(ijki*1dz_p-kH0UAs4Z;G6;5xbRmX{`d zt=vz}^-Ye8A;+%D9<9E^yEwDZWg4)j@Oc#!%n^UGH5(C0gTRiLiF@{5+^he_&LjmC z=$X$wB8R&1#|)>Z&i*u>wqvEJ{BABf`uJVD3a~jI%lb-J{mmJAHq4&V@Gf17jp_Nm zRGT5UL1}8R6+Hcr+#V-EejwVOK;UkrxVl=e! zIkR8lAL7W1%ZDD2G>n#6YAx7~1Gh9R>-`W{&mh=F*E{q|&^ z3D%X}$h@V`_a+9$HSdDU9kEq;z?^T66mgk0R8*f(d5X4Y#FLR?@wocfgDvYZPE*G{Mryuyw0w z{8NU+y0!@U^t$kk)(fnehVVos@;E0k8W$R~JU7ZvO($+xcS29!pM}IU z6W{A9={$v5bwsdWEupT`i*3g)*x=Q3q0&3A3ncl%`0_(+%K|**frpzpLY{`ylgq7< z*ZI;Xth3!Ox9Gx-tL-Y<>~ml_8vyVkM+~Q>)Sy45sNNoE+om_q^wmXkMPD+{Qw0Tf zY~+2H3N(0nL@-O&hqYcatfm%zd$rj^6lq`A^KlnAG2?$AH)tzUwku0uF2`jdt7IXG zV9v0gD=Vh*MKJ+oh>KA+(eno#kvXN+)A={oRP>;7VQ3u!Gk))DN2!Y^4gfzX(NiX0 zqaCRPc?mP8`k73fp(JiilTzjBwJ8id?VuCK&SBFr zsuAi^bd|ycpgNoI)O$I%By<@EAw*K?#BehGVMPYj*dS7lnX`K((-6aNCDUpw4{L6S zN<0Br$%Kdjuy8l53xCNq1uK!i9`IYqjjdsU@)Ws_r7*++aJR7Ersz;i5g*8S?e+_RKoL8PUYkfb_`I zzqg|YwQSeR1@-28l=3qEn7}Dl1d!6le%0?*6h^AT19{YBt+766G!IfGSR)zs@ERn2Sj6o?W)A!q=MV`_Qscog=c??uUtGP<&eXs()U^ z%}LDy7p<)aNEkLbE13S~B}>zwAa!bzU^Dw>X?NSTdV6KZc=GD)-4*j@+64z+I#m09 zL&#c44)G!8TU3|qfzaAnx(rXlwWa~|nmGF|U@UeIX(-1OyVUG0bc=v&DB97d*EfnS zDLdzlD#P}^4ZYqu&x|yyd{C}l@hLkGoBPOIok$cG5Ijhf(iwhBlqThLp0wl_c3A)$ zdT4>n_5oP(d91iwzVb?}&_QXm-sXf3;CiiBFBXIe8IlD0Q4G{tse!<`PR+^1WSW%oe^~I*C;lriCF|(M*6_H zKzs|`jjsZuxf%AmaPfq>H_Iq3<4=mNd)5s`3oJ;s;{~|n0iyAfaPv@?S3>=!XnNgw z(QSI?MBo-cPtb1}Wm;=!4ULBE z+G->AfQCVope)AKi>(2|`{*+l(;w=fpAMn$PVZ`jy#BQcJ4QID<|6uHJ7 z)m5{l2*+0FCe<~%H?^2-op@gp5}0{S3>~ndrJlGFbosr^VBz1YJl@c2iFK_93V+1` zm~i!61bBF0#5XTFZu6?S-!3xd_DJKv!d)*@%jhEO$YtKjz#ddN2lg2e>o?1~`&ZL? zEP2n+bC%VoOQ4c_!Cl6fTX+--4kqn z`Aq~7DkT!TQ#6d0RenjY-e(*pOtGUYQMJfkY^e+ibuviADOXS|!6Zh~`+JwIxRhZ9 zJi0lJmH_Q%_KiS^%ptK4Y{HTkSU+6fCy?aaA-T-xTeE(B<9uv^qyeq!o(Q}51rWHQ zBeCym7$6vlOQNRsaKH(!Z~fm2)V zs8(AQxm#91unD>22{r@0^vB3#Ovrgd;G;=@OJgp6Bi14{tQ;0yWUdI$X56io4+GBW zDk{k@ylMkRNy&tzfWhAn1#|*8IDzf`oB;VVL1`Lmzv1EX)nOM-A3#9jr$DWILt$Vl zn=HMVF@3o2dK%0vZeUibxSdp5;#?ZH6pXKkSbkBz5#83R<8p1HBtxsVhRr~Amw-GWjtgWiV%6M0~l=)A>VxXm-e0U5A^@&1eAhi=K zkPht^LX$v;rVnd*1a$iUZ6CAj;+{}p*;q1yQL8g;DK*#@PBI1%d_&-C(v^7vkwF`L{m5Gg zm{iLEbK8N+z3v0-trdod1)|ikkXrpw^pS2|;{2=VLk=$bAOjVKIUuBgKEs@l*Vtv9 zb?+c>JY>KL0^&o0K>Ra7m;-7wkaIU~{+SWT{h1M{{mKaDH}5k7=~Pfg(D#rL0Fy_F zAw8gh1yKngGD0Gn34*Q6A(|hO@^;&Y{ArUi2Ac7`7Z~(I6#V-$6pSzML2zrf>h=l5 z07X67AmYm$J>?-#n_UWLU>ZR`*sk_LKiE*qh5*=*08nSW5f0p0zl#TV)}6tf^{V&a z&N}|z4x!2abO`rIjrV;V^0ed_HK#;}&WH){BATl8OXOY3&gU5jJUpxj1zdQ!s_g>S#c?^Js9ZztY zvB>qkwZAWbn^WanlyXP;Pvqg<+#*P5e646d&l_$q$ewB6xejEG70_ zUc*LS{ilh=#dFuxWjI*zQc10MzKBKpApCI!N@_ zPA`>(N?2?F26izME^*WqsJB*5(Q68^PO25d6bSqv{eg-<=0Gh89PFZmbn*b6bushu zKcCTW8V;7wue&;HH1D~t5n8>0OhDx@5zqsCbVU8;wr&^xfuO(S^vl`1kCgbK94yCn z?2>sqTXw)4J0b`dV7r~LSn4u~;oWQn@q2OJUG1bj){PEw^zj4cqHozG=^xO`t%6#1 z5&aTYS)unp!2F^i^xb*K!xzSJ(052sCw}wvA{996&kXSqh!kK2`se8qpbY`5e11+e zCBO}w3?zdT7zbVl7NFyPf7z+q=$2R}_&oFgQ)6QdSRF(IK?7V2QYW=HNQE*haUrUe z$2Rb+liVzgZi9fl^N6D=@-NI%zKbYx`x*%e*v}tW8Rc2V;47a5cR39LoIa9!P+wwM z%o8x4FvGUJZrS`EAgOyi%wy!g#K`|azH(%22>R8sT zS8E7UoiaAAFPBn^7zbA!cYKS{_X0 zaYu(7GF}%w*uv+0D3f{{QV?5y#a)6H*Qu9jRN12zFfN6?CakovShjx=b{Tux!8ze0 zL%dBbGjAfRaLfqsi1a%fHy+nIKc;KzMH8#tIw{kX^^o^a}#>*VX9vs^#x zHFpZPXQQ@ao(!v}KFwGPIy?9~KTF6a3>D~nUD-`e4n2nU>8*p~4$=E{HWNOz_sjNB zG=0IU@b0Vj4avrs!%aJS=>9%vW7=n|l_$pXx?6GndxX0#h5X++Ziz7U>oID&Uo!wM zrB4A&cNTE5o%+h`Dt&O~qF8U@jJgx&;tBOM=KXHCkOKv(20%+3ap>RwKE%;Q_}35z zspm?D@0qdc=iI2Kcwq_&yB`%Vx?aIeK$6oMCWdYcwPJBLZ3h66M?KF^&-|fUAn2Cm z2uNo!iG4Ks6#*FqNynPhx{4Y)yxP=C6QqW+lsRw8-lqVhIx-g4-;Op5aK*n;YMZ!zM3?Yt$T98la9} z8yA$9qk->{pD(&{w?^-Q63xR~{HQU{9(GYNj9Y8C9(J=1s04A7Bw!NPb@sUCoXqO! zJ34Q&6Kvo>LjnlJv}|O8=qQVCG=~J-Oy1@HI~-H~9>*+GxW_SdtwA^@O_$EcqE8qN z+NzxPDgGR{Oq=faI40s>I3@)b2*;%Ug=2C*;FwC8O;a26)DJi&f7VYN^Cg2Pp!g3Q z)Bf2%;Fzzb9&pThd5^e`jb}E@qSL8O8SF(!P-ZiscjZUZHIIgly>@A-^K@dZse_@<@Y&Q0niDTyj#f4 z5!=?DZ_SSsG+x0lm&X{i2baW2$9z}EBQzLeSgxS&5r-UBH%7bbvYgqj{(Kp@kIDXe zk2rd}8eKwyaI$LF9#c5hap{wGP{r_y`xpH6+pkvsORkK0vIXE9YTvGF00kniy5Jy8 zrLp2}0x#Z`eG6r>6fe*LK)pdsdDGAA2GV|gZuq7B3hM)awO>-jAnlhqSo^h;feO}s zowqq1%m#oa6#(ZeM2-nOuhQLRhZQvMWJ9~dwOf;s;sQ&(0kdCNvW8&z{1Hl;T|X~! zNvh3hC3?yQ_+O6t+Mel>_lWZiUcCb=!OSf)&{#Oq{Cx^33M^rIWu{1MDMGMP!W-FI z)h;kU&Te2@Ni<`8dkx2+eEWDT#*x$&`w}Sgo`L>tqC}?s<;V00zzSaOSabrWZUjzz zx{YxEbJ_)pqQv)1gbiQ5nUJ&jr32I63$w?L;WSJo$(haK-?%&r>EsgP4vl@i(cx3i z9yU_C3q`@y$GXj`(#-rV2QmYh`Y`QL9uU*Z{&6Y%9WcO)1Q4RC*DYpzQn0SWjHvSd zCF&hjm%8v979-aX@1+y^upbeGYm+nzD@46|`-`Yr1-evZCGoZ&ZFh6H1&UPDaRRMO z@WM@Wo9Wqz9IWw;UJ&eARiri+0r~0=-XQZQ`xiTOvw=4YT1BsQ5}Rmp<^~EGMKn_l zb7pZSVMGI-1Cm~c7+?uhgDQ-V!fN0QFMQ!w*uWLW-TMk7gr33PEz-M;f`H$&sXT}_ zZB70~n@0Qc(xOc@`~{ni=O=<-(~?k5GOORP=~*!dHcfrqegc9`)py#|{S{KxUb)@F zrhu3(|0`_z7i${9ZS-09fEk-l zbt1h51=}g7MAVOnep~SwTR=C77GxH2!Z2Z#T!;HpB#SiqHhDq-nF@sXk(ty2Q^U%U zE$ibuHzq5?!Huk`%iy$RMZ3y(dONci4W%BUbB(zqTNwocFhQ3??m7u-UZo7g3$sHO zGsq%Sc!^|=*i<;z=%A3EsH6X9NH4i;KI%@`;A2F$PEoec|0yK7H_3mP5Vr3Sse@xC zsqeM6vwkXIB|VY4o3-f!i(WX^P5aWJRB{FdyNTntLF6m^M|w=-BgmxmjwqyBde1(P zdJnYB;r`w%xX7<#Sp$Xit>BQJCH`F-QQ{jv&|rc0PTu`s!8OAFp3%nuet<)IW#9iI zr2p59zU$i`8NK7C)_=(8v9A6#qepbR&*)PDU#3j|%a9(F(WAR*0kPe*CSjXFin7vM zPEbY<4f;*-gX$u=L#yd~b@KevbRtkj-+Ktk=)V9TGWyPX8Oc2$%bfqgcXzuU{k`5c z^Y4omz1J3<73TSXq&!eakF1`6QfkE5D-KvnU^oBK^p7F^qP(awhp&;8!q1G}tD%0z z^b0tnuPyr@8U1j~KWFq(e`NIZZQ*2qUm-mr?D78+(*Hf9@1qF-XY@E<9y0pThm4-A zHBr9gzscy!CLc0-z(0oc4!=YChV`Ez{nvniX~g@C-uXVGH^A+z17-9^{=L~-5r5C< z1%74pa^Q^qhUxDaJ<0Ekp1pT%96-_!3h8_P3h5hM7}uocI^#eg{pjCAdT>T>Kp9_k zy?A*m@n=T=_WJR5W9@xLuLsWPZ!{^Fc)=O{F~#3A`kQnFfhPqEBzHUy9aYyHZ@^g@ zw(hLJ-P>co@0d>C>tK|OrT205XBPN^#9m1B*wydb?^(*~qfu7WuxEGeYJClQoFMO> z3fyjEpRQT?*4no7W^(JQtu!L;_DpX?_{iKz1U_`p1GgVniT?-9D)GL2I=-`;qS#GS zpI17C1IuzW4HHAGFrIn2X>`pEqA$QB9*=DG#o}eUFaPubAUkUr&LbIG>1|8NYgnSw z!6J8+2{{8K=AGp*ZLP-v@8F|-MKvb)d%+Mhi43O-D5M{Z<*k58JZ6c8K&E)lkk^cl zJPbQwOhV10^XMCvb(lA6GyhY2E=TX$}zcDDyheB zUbQ&r6BL~oaQZ)yosYSU$s-PJB&6mjLcjhx0!Iw+NXhiUg;6B<#1^LXK{xGuk5+MJ zO4uB{!6lMS8}AJeQ^ab{N3M}C#l4L0L=*Y=gb=b*MOd_xcIpj6XDWR_u+;uG7UXJG z4*f}9HDjNpnB>AxTT6LAO2#=g%bSuJRJ1Ga(g^{TNg(wrDt6|)#~eZ zm;=UFh+T^BXam^nW^=7@dUcL(l;YGX`A}z1gatD90pOhjTky`ovpFIlXvMZjQVp4PCy1e=HL$6J5aGV})c<1;V)Zqk}q zHL4ITk=fIkOxgF=xW$^V2opZp?s}TRs$oqw5Y&RB8rV3~J;879j}kzYATB@$do;^G z63V`e@kwcy8NUf-FrZ9-qx&0BcDo0Zb@cd6{sNSr{05Yv{sfd~&BPs3{uxjP`~#u9 z%&8X~xa{}4pZf427PCx?S#Wm?*o1^r{Bk^ZsV4$gN>9CXAG@jtLxaL_O1JsjJFi>{ zj~161H?hRPIVBdtsHW-byxejj9nKi^c103sC8eV@bRy_vamA5`2fSheJ0v*AmEa`+0{@ zB?5pB5g5M@5xk&71oj(eWzZqwME?E|@$(MBB^ZU9s)la-aEB;b!??dgq}|^k?KgUFK^pY``aLOzL_%@V6#gDoT=R7Y1)jZ#|o|t%p zi_GX*AyE3MXEN_joNE z2(L{)I^^m~Y^2*vKN9|p*Xq)jt^Z%8?jZh^2okp+xK`&*@{~W+ram5X{4!>yqhfb@ z`1$fY+u|t0y&)=_Du#XH2$Hpsdf8nbFK6~{2+F*RuC8(%-3xM-=ROU~~`h8nZ zA>>Hl74uQ%GW*=b5duNw>|hkJXzZ&eyP9%@2H}BJ=$3U9(8cvXAy=e)gS+4_W)=}B-HS4fXK$>-<7k_Eiqt=;F zs*I)mep%Mzz?SvlyyKwf(@N?f%Q_(c=SXGY;nTls*5lHCYS!gVE#6|`M)S(a5>cMy za-MMcWm5BZL1))>yQ07RrpO)2b20rPTm-}Xncx&T!5bP`>>MmOVgsBl(hpAYUryB! z2TU)fKE<~uMU56p zS;tepEQKaE0j+i|7UtUWLyJ9)4gn7(DZ2@Y4WX zJhRv$`bu$01=6wqVPhA%QRtgLVlxC-SQc%xYo9)l=`2`Zo=lCQU9KMR|NL$~_H~S=;^0Xg}A*;P) zAzBrGu3EMw!T5WrJ0A>PKdjbxjgn^ErESK#rUX*< z&Pm-F-T7Fr#+4b&rQQI568WTrs`o|7HgHigx~^>_k9IL1RFqt^;8~srdgWt2F>cMc zeEGW?`S`vXNvwuYkX$6S1T4uX#)+dCQMP~)7S%(OJEo`(U-W#XFl6xw_#>YNAR7vv z1e-89VAFy#SkkG|%{`jPwDL(1X1^rJe{=%IoYruxiRkWD#t)>-Kn3dRJRzJOP*O%-RGM{u2RXxjdMZ{-59~<$z*{qW>}2ENC73}D}si4TCf=!b_&FwWtkw( zMYr1QvahtXr|vpTwR()56nIBg0OB9LzY|izI?YJ#^q#E^nek;?s1juN<6oX@ghyF2 zy?@qx^2!T;Dt4{c2U1`u4}PL_kx)jK8bbw-ccCOS_lD5LY7;1ywLDI$fx5{u!{6@x z{4|N(Nf@Etum5w>rllDgT?(i1m*HLIEtw5sbN-w)(kYp$+Vsf%9m90%ML>T2q{&$F zU_@M5p!H*i)>rUxp3f&3h9#M{ji#3046{wMGqaHZ8ONYPkUyxH!sl;x4p7BUtTT`<<@Bp;}r~K6}5-d5SCcpR$EHP1kk+(x!_ zt6@NfY_xBzhPy5=O9QYiy{aVq7bQV8JB(rBj#zZ3&j$_aR~K8n)x(4=;{(GM=hE3v zj&SFp1)qOw%!GIM-b9}5Cigvo_n)$fvSD@TEQ9}gF1`o^ReGQYazY-(D#R-i4_9fY zEz83UVqoJAoSf|TN78h={_b(^fqR@Y7WX|)fPXl>RE`g1`X4>cxAl1m?b6UanwX`l zufo8cgX?Pf;zb~6P@ z`J2Dl&BhmCAM9qKi6O-YuiJmNIsyMs>vX}C=*Het{_+qr83iCbBu_DzZ*#7rz#Ey* z>VFfn%G-YsvpV+^nT_NBo|ydtB4%IyLCit`K*((SEEt)^SJnU#vn1e=O#5rb2f10q zQ&08pUl;lCV!Z{}5$8E-Cc5e@c`@z%642k(IU>X$Uu55doi>kIcUeo zoH|0sOD?MJd;=X63o$VIMsD^|hVt5@=+PKacyc%<@G|CoBeZ2MuCbf+>W#j}B>%k& z%{xJ3CY?@0Qd*a4qA1a8DTL!&F)5J7h74XsidhIWf+_9-9>IJeJM-5Frb>2--@hNh zl=))!FC&;`B^vi5nE3g6z#bcZfNJE^EJ^+7`F9_oXFg6}$YD+mCNK3e7W3(0^KCR1 zH_Si;&D8oH3tTMO;LZ1*Rc@d3>AH_SNons*_1AT)tjX;bdpc?uvq4JO-lBUm2t@U>(f1YIQR_p?|drw z7%Du9n7q=dkk7HF{4IWj?Xl|t(`+eFl(+GgIFTzvOcUTrUkd>TZJ7z(-?(TM`rDxE zl)N`A&DVd>ype#`EuoTt1a_2=NjE?tJ7!Hcm#X^r_jN;lF9JK;6a+>7=4_iI$y;b`Mz}qQ03D|JRGW)IPIp0_=Fy#_zjM7{tQYtj>n-{l z)(g1jdY^Ua-*dgsb!V94>KhCguUt0%1J?`tf5Y{TYyHN0ce=U#W{=wzh6EnC-Z)Yz ztiQnCFRC0BZDdbua#etJ<+M1(td>H2$EW6<&G{5QI+ua=v>h|i<-p7G=Nt_zvTK=( z+IMO%JDZR7at(4fo6l>F*p~^K0Wx6=2jgp6ye>wMGT8`*@x;5JgYUv2+kh4of{?pr zz`P0$0E8ad%T@l+fi@i)Tt_X_+M@wIk{>DvB#oleYgxJea`DSQf!P1S!zzGy*tMTL zEX{8o7Vj4iyY?p!n~9WR^^1qq>jv|%!4Etv;7=e{&FD*g0S`CWpT_d1KaK6b@TWP| zjUk5GGg4e+{8K+t9@LM7&tv&pKeA}3U%V3Vs~|akUyvLf75%Fq+4s93sqnXgq>Z}j z+W#m>{=0r8ul{gmAdi0F-w4_XvuA8cD~HPs0s#14!vkKYWcr3{m#7g_DntXXTF}5E zWY%|V*^jvKyhAjh9rZ6h2dxvGl%m7eeJ@UwMl4rT!8bxWQ9{G!M5RB~GLXUex+yJ+ zhmjtxl%BrTUNvz#)NYuJJ^~fmLvuiML>eTydilBQ^VU=z-aKYH>hldz)TO&p?2Cmh z5orMH!RLuCJ@vXFSR`#y#w{(c^1(nz9r9lmwafgjx(ADz>_?DAE%%p2Z3kpg!wCRc z)M8hBYG{61)JD;LKd}6^sAVs=!Kjcq)5NsDR@?gqwy6D-sF@vMzB|yuCId^<03eH+ zEAzcY4O;u&qUNhGQ%vkiBd?Z>J;O?MRhmy#7>?79J;}kZN{N{plBubrwB)<}5$zl% z$-RwB71MYF-p9Vso6BR-vgF+{VuL1bmTv=Ma^mK5gc<$<7A8?E}08uzgyC^+PYGp1Q8{aJD*#OG?+b;f3d&BvI4th-^*PEps z@$R&EjTk*f6U2|{Ezl@z`xh0$9Da1`t<)`PnY`3 zp8oOm9^m@5kASAIP1CQPMMJHhJBt8G>kzJQ98q+32W5X&Z$KTKY(v9PJlPJ%_iM;y zk0Ltp>5h$p2Hr)_RMa{7$4ehNR@2nH6(>2m@W$n3u>%%dBxMlul8hKrg;iuFK7G-X z$sW=G1C8e8hdf9hdwi4qlu`dkS^{xzri;bnlBHC8Xm`FzL>EBr9OFO9tU;ttqxKP2 zJTsubWsQ4NXNqLp5S95|NfM(6kd1$^>=-npXb_@jzBrtX#lazFmubH7cE+qnztg5( za=VDnv39@t3?WwFp#IR5(ZZb}H<=XC&b`=!Cs@4g@S2Zk zUlK^xUIVC}AQAnp;Bc_rDst!O)}?9W5mcIb%rQ2sDstIf9<;fZ&6CMu;t2iR+8tMi zv5Et3hT?J>{nRGx%n8$mT|^F}t)H-^}!5Y+E{%9ec0b)Q3ZB=|<)cw*`lG zESPF+1?-pV8UfvR{c4v_DD55eAw1QVJ)6=A>`JrTP)FX;e1g2>_UL2=?!h`7h>pEF zRE84WWQa^>dT%5-yC(FQc#lOP-x6STk^Hxy5}a7Bek+Kd|Kb$Zobl+*FpiG}L9o6p zJ=HUE!a!an>^galc2rgi^`Nz?P>rDSC3n_KsJI(Xxj|IEz!{fEkH#!LY_|MAU_nyV z3Y7lfI4?RZ7#$K5i-=p#tFyJ&ss8{Pg8WSsn@WMEAyOiV^QnitXSA}t1M0TX&-8V5aMCsk=GTVye!LD@rT^KEYH;wynd z>D10LBGb`v!>UbK!nweB$SHaS;P=5($eEWK**s&^n3(|hJl(4b+MA+H)mW|<_GG!k z-$rzVl~c7<>{K)@hk&}TyYmZh*(8u0TLXcOavQXi_OVBwm@>$mTU5QIy%r8kzo3X% z1mIg4fP%%?V*X%@I()5JOW*EPdLeLYjDinZYP1MMrjT>2} zid#mz1st@~fbh-F0f*Qgdta4ZVp4&XbM|~027jlUp-1k1Tzl97L;E?5l8quy{AhO4 zpZNH4SlD`U70KMK+P3uB%Vz(0`z+#%H~+!qfyVVG%C{}eQ;215mQ^CI-}Xg_{S|i|Nb+330vDqB&It4m7hsrJCO<0(T}z zAhLnTlWdSAm}Nqf@(^gS%N1`3uZ?TZcUwU_f`Zq;l&K3qoVJ1V8PAq5KkT4>%Pg{= zuN^F+DWbv7cj~g;P|v!L;wFS?gc34U$IH$72@;lC&fZZt=6Fu=xrVsLst|)PnC}$( zMy|D=kL1c2u9M6$$LB1*jo4<|6rl`D?WGKi{*cvZZlJX^eTvD6f+Ki9DC}P)MJ89EzA$Zwx@_LBIOiu|n=PKl zY)bycRsEPL&X2C?OTb;UNj_F+(Kav}aEP+Xe7+yRs9qF}rYXxU z&+R-yNTQLai1>|@9q9#okzq_c3U6g-2}Rgh#Zb;K5=tWOsODeK!<5K?tP%KG;bdQc_qExw0;*8hu&odN#Ol>lR{ zwDnc6j0o<#0GcDpu|@eK7&NkVZUA+=D|%sSo)Lsqyb5$C5ks9O z&(9O{6nV4h+@o%yFRC`rT%~gq+n@;}SW<1u$IEXzqU#pa3sV8DRwvWD_{v z7y`YLuvuPbljY*Klzh&XrJ*RPx9$|0*WWGG-1tsdFsqfj^VS9)iOHg=cz{cm!p=Qz zqZ_DE3aU06cc2wp7xAac|ABy&Bn!%D?KYDaW!pmJ* zpC>d~Jdw^+>a!l@G;0*KtDnlyL@1h9alm(f4f$Z1+VcuRja}~lY>{UFt3~Smr$q|X z(f=B6kz`tswam5+s3@AHRa@jhN3Qstn{X^0EuokzYLr)+-)uUo$F}yKBXpt02`@My% zf?=8$#^@cQ0=b&sDkO$tK!~?KClxKmbC_Cmk3?1=r1TuN651cOVh8>}G@_jPND}%O z_}wW49ws8@>f-6{7Wi577_kJW?*f0Fvtn@EWu*jLaE+Qy{@&M^mkD|4sTN-hrQ}lf zRaOIaWD7Y7ZwcnAx-uYFS3*7k5l*yYsw8+R0(wd^JpY5mM^N z?L`=Usue_Ec{4Z?#aLv(et8~=8Kx}{^uAJx*f6<=8v?*tPftC?OXC1rh!Q`}o@logD_x?uEL>+WN(^0#erl|n8sJ1+qyPId5wSuKB6|4GiMxZ*s3Jx>?MH-l z^N30`X4@L0-LAfc1VLl|3jtCE@yjw$jP$mx-=exsUUkMeoM~BHU|E@`a{cs^PGXye z7XCmyoNF`?0a>4GWVi*y33D2qM`@%d7;%{fDj#Ekoq>_7|vn z4Au}wH86r|Sn;A^H$~8B2Etf-8lfmg5_1{-x@NQACP=bu-caFik(=~dJJ51hoTO8p zut2^+mc0M)Q)>Zv9d~eeV(fW-R9O5^l5&R?`Wh zR?t+^FBfbGGsPqvSANRD$LTqE-JLsjhFNxlsqL+N3r3T#v>#?(%#o5J)6+iUk?@uU z)FgSjzL!PO+-ON1Mr!|=sX39SPzA`H0w8=Svh<(LAn#9Wey@F#G!v%b*fN31F}Q$4 zi{*Js;VHLEDi&ASJtmhW>7mYA_0czV0oj&qHfhI|3@Dmpg6N|$8`h}NZGal*k{Mr@ z^;L!fUuYC}!w1H7v(}5*SV4uRLZ1DSYkK@6q)q_2*Gy4~>FOvnBo1B)qcyxmnk)f=sZfd;gi1kDY78?yC(oh!Xn%P}Fm8ov5y>ni z&D&rUw?&eBDbhMk+UjSX|Kg&rO@fWC%kr-mDvRNl*k&6fZ0PvR7F_vxEQP3<^+u4Inq~Eg0{s`ooI?YoXU9O^{x6~{52^6{g?kSelsg$H% zUE*2?uE40ZZ^i#(WUO@9lL$OAHurmE%=6F4m~`ClkujJK($lfOBV*E9-~D6?WL>hTCG zQ`ktp(b~umTz4~a3~VGc$O^26#Z&mL426s}&3mmY1e{w5|FXIGC0HYUhYhR8QanJJ z2?hEVrJ5^8h$3}st??wDb532^12YKJ5L&*H9KxK@^vw7a+k&(GzLR&jo->{LRZjU} zwN~Q9U8A(2i6;_KCY!PZCGlw?!z*(@H7RF5P|d)+JDkO&j6gE$#a32|B%(2k$QBK` z9is$69RVtiDa!S&EZ^jZ=L+cK2A^{k`Ms&JZ<=K4Kh+}|;2htg##Md?pjoj3A)*hO zb^L35KaQ#!Gk%SDrEtMT!-PJWy^L?FXZ0di!M80`x%415{-RyGr#wS}_3S(AhgGBb zJ%1j;eA;uo1UeJ@lTMv=f2_5ee4}Xw;XKuL8qC+Zc6p+2m|v5h$312o5PE{O?TB8s zgDye@kah${FNi#4Q)`dCds7A~fiGE2_pxheujp0jG^~Gkl-VGfFARA3W6L=`ei1#8FS0|;| zEHS_lU!ACLaS`%lO2fWYV&}*{^df;V9_kVHZXM_WdoWGOdzx`4A4k}bW*HZkBe!gD zgX^~2G*D+y7C&+sl%WnG1%`GIdwIs~^M*c?L=`0sB`WFAYa|Fq3{)5Zo z!_O=o2z!H%eM{ZU;Lec*0=RP&lKP|L7>Pvb%*4wXXI@E*9)huHk>GFTXi)WkRF1x> z|8FWs+-ozg)DyhdD%C@)CrR9^D8TOr+s%e-|D|Q*r6Ekj40f`A0XL00U}b(a%7OaD zIN>it{}{&JdKRh?{WgsCn1T&sD`3NzW#@6wZ^M{hy}r-GPHxKtk)NlOKIK4VN}Tl* z{Aq54%8H6jThb1?3jSFw-&w!JNdqD8>@wz`l+K z6!F^eRDS7n9f+&2uTfiy4~-dZ8>RsETI4V8+=?Tt0;FF6eqmw)WDvV zcLlYpb^IiWN})TUOPzqo@sUz6-P3FO_(5;4YnR)O2+XqNhq@6i_X)g!w4Yz}skQBFs_5ybz{^uJ+Q&>!&s z!%22&rgiN7*GLvi%Ub~X=D!NboCUBlz#xly`AW`rn^E8 z=`d$%VfC5As>ozoQ5vp>!r~5at({G?&G2{-xvOJnsF2;K(o6jBGkyOJWMO%Go76r+ z0HiVAj}%b-Bw3F)Y_TAdt^zcJf6LFRg)?cj;ZthN{i71yhW$Pbq3pA7D%9rgUrwdM z>b6<_&j#O$NcYO2YcrRmkNNZ6#=lxo8Ed}3TTvz$zk`pvPcS430T$Bw5)shAAv%}G zSobl{^h5Iu&@FL{Psan4a&6)t{dSje{dJd3{B@Uw@ph`k z|8|!pMJ7>v>2v?56%_;i|C5;30qI|@D9)u^GiO)RGH^d2uHgHm9n+C0V#q-k&h({jIy8#vyK_ir%t_Qa=a6tS+{S!!yWUGC~i#AUPk|HVuxRnW%b!++yId zWv;vqa)o`D|D9!M`YPPbj8)p&6!n&7sBIt{)mUc=V~RksLaE}B6E<)cJK;m60I5)e$dm#va3o8Fd_^asW$XC%%9QBJse)+v4 zOlD)|_VQ~@ka){@SK5b8nTBY(h|^(vF-{guL9;ink;V+w`VjcNk2`X#b&PSg}lqwmo=A z=+{}X^669akIqoJ-7=ax*<+dObc$6<2_%MdURN36bFar3F zAs?|=38)m~33>TldBQ6gO{`I5Fv4ROzKcX@Doon>j0w!OM?jx%X|_PVgsnFpOhwk^ zEJaT%q5Q##Aj_11v$1Q7Vtg6(`u)nm8&IprezUvL`%6Iga0$Gth%@GsMsj=dv{&U# zyeS66V6=~(zBK*A-grD49RDYKgXSbSV}O$>;-3TgEA2~n(EVFkqUDq%p5C7xD8Qgg z?TfJdo_TsKTiosYVN)KZ8_6E}-rMTK(K+l!y!{Qdm>!g;{0JPo_+Dvd!2IC-EAoe2 zjdw0vmwFQ1S;I$RUEpQKFz~YC9uXMN zaW4xr1Y0HiS_0WB*N%X(J$0S~HR(&lvhwgh2cigks1l~ft$tMF2wv#Nz%~XJX=)v^ zuLzuSdXLUWTskK)H!%UnCxz;qjgH|qCffF8CL+z>j^Np*7uo%SFeaju4F93h=J%*F zEp*+h_AvCfs}x({084v6Thn;=yQ>siwYPC%@VBef+POkAq)6h1Kq#jHv-bXAHuY1T zohT}8pGsynnZM2Ge7o8v?DBUB@YvAdG3KWY5{`ZWAUnZ>?C9^dk}Uk+wo;bXhJ9B6 zUu#pSWjNr~b5&@P(}i==jjt+3ZvW(=x-aarTKGAWTu9HSkRBs1z*$YdZ6R-!JjnLr zPGd~NfO=^#H9$HQDLCEvsb-;89SieigE`%?I;pq#Yec?qVI|b~Kpvg5iXiJvBx3ao zP$5K9hwr%R&+=kW+TZ2H=HJVUqG741BtzCoB>wy|%)!y5^(Fo<->a?IO;fg5CV`Df4lVgQ>cSOo88pb%@YpVqwVhDxuc|-lG>1Gy!pk1 zk6yAoQOR8D2k#1gi_zY90NHZ&D+5_OG=?~-W}RdXnbKdC?lnSW1{-(Rla=g(d&lPLfQ$&Zv45QTreJ5j zLH+NE#jl#Gu=O^l;E6@_o-e;A7NPKN=4K^0d6Nm5ECX0#Pp%A;g91GfZ?O*06G%(b!+GGpQC*N z!f(F*7Uwg1|3tu?@0g1G#&6AK$4{|FU#~4tIUJ(}sn7T)fBNt7)7~vSjB8hLakz(+ ze>wsimIZC8hWpu`pcY9JA9!8SYUfW?DX{*M&H?N|krcM9&g*2nB5sQ-+&o8}n~1C5 z$DRD@myV?i%wuTWg)<#X3I7{8?I?pIClKYA_^(FM|0Qv{ef^s_dGx4&6DKrsutT41 z-&ZLZ#cZx0>0c-ieIc2f69}u;Wm_0AIF5(Tp`N+GUu3A$3$_*+U*%lRB;rrrRBu@fu5lfh#9jeai^oDw8Xi6i zaiwS^M{+ooch4;QDsI%A2}(hR+EL5v-W`lGwpD@Llv56v%LT5)YwL>fC~AnCwdn)d zjXL>s+3ZGE7{3BzY(l$AE!vh2X}o|x%-MIIrG>=U(e6xLu&oN_Va5uZ*E?sSOfMa* z;ZNE7alj+x2js9P%G&WmA}h}RdG2QLcHCY#W1YgA&^L_n?g3qhMeYGtJZ+qD%DKL$ zi{9|AQ6Fov%1Ly^IveTGeqsAOPJu<=JIod>b^b13?IYe+c- zml{2$Xl+W9{gu@M-3Blu|#XcX6^rlG~oZ;^N#lFHqZ5Z-fAk@WOn6v&55#UOBu(+2vO>2LVC< zQX|iEs5Rg)+)6wF)>kuMM@`;tPaNojP&0GfqH@OV8DcF5W|t%=M^Cdpi51h|w*I_^ zFN6Vl1~9;1cV@7@%z+ulOdoDjum&H{6WE{(T>8E*odrcwA=ie`fR69$98$qj`BLaVMzap zIYWAl_z$b@U=>E4FTreg6x2qK)AZr$ETtFI^K~9y=-yBHIMWF|oC;lkRBRUtGUS%J zfJmx2EEqT~ioDG$GkZw?@v7tNe7c9;)yG5h+uA=@D&=+PH#Yeo2e$Ti2`ODWX@Ykc z4}pH8uAJbr>{Q!?%Xa&95_O9v?RglnJ}_PFQBsxB*P_RRL`!eJm?77@ZRy8^`!?Iy zpmOiRl^pV)$FnLKcDnHxHNt(}TG)aTJJZj&FDh&(YRX$5;_NXhp*UR7@qOJgIv|8T zJz}dhg>g&{lJpFsFB?Z6*M&KynQ{}nbIv?-!_%5cCF84RW>r72N|zX7codX0n70R! zL<2~4Tp^xXvL+3wyP-EdfjNmAyYAyOvyVdK{U$4>vIePy+w$Ro_H13vt0&GuM<#k{ zhK0f|R;p3sHz+iLC{VqfUFD1>7)VlhYiQ{klHi6H zESe$cvZ%b^v2nlc7#=cZcAoO@FGQe8#rgSmu$KO1e4v)zKIee?l3|P3WL;2?qHe$W3L0Knj!Vo|>MqRmR1M z_*mn~KpA)gb7|Rv#}2ICXZaIgT%dx*;Q*+si`z*JPR@Q7wKhkqe;&#O19iXZ6l8~Bx6f{ec3wtQWwP;Z2-;p)#BrzN?A*_%TQQ_Ge_*KFCjCol33 z_?8{I*8PIb*pqmOHneq&x?W7J_PAl6rOG&>Wkef07Q&nG7)mB4JykMm_sGGMk$Jb% zT8=3j+Xtsh%_BA*UtZV6j*bL{9)7f6E>8L)Ml_u%uHDKn*WTl?#>$SIa*~6g7TcRr z!KT^r5Tc9d>-exra_>9m&|J2cteqpIFdnjR`=CP5r6GVBzyu;T0?{V5fb?D9^wBUaTsvNgd9}@(L}j(4s80{9i6A@w@k=^TwGlwbB-3h1b)3;fp5ZaR z)X#bcg#G6M+e--DQn5kZUafX46D3O^%nf78xv(J;hS=deG#lpL;@opUBO|i7af^omnL=?tF;S2YTcJoU*FBC#__#LPc^-#r z8?>a3D10b*kxMi4KE#m?5oDQhBIbg0JOMPoej|8v`l0N$nU<6;lT@4;)l{vG;tBYz z8L2gOQ<|R@`4|Jirdk_fy6RDE+}O}52t z7ifKE!25-93S}bB7{=Riw=QVyX>~7#d6PUffwdOLTE*jR=I|3lJ6#J^23pT}-WWt#ymJ5*L3LD7|z+ z+D*-IN(36et_838U8DFK?Cg07cxG?sh?}Cly8$g-Q(2{zZL>t@MD8jWw3iH^1cu4M z4}$!p#+eFVSiuj2Mb>Y+ss2GyPObqGHs{&F`PVon>Q+mp^u*E64|S_OI~mxh1dc=cOk=NC6U@?_fFnM&hi9JBW#cF&+yn(m>CNT>GL;%?!B;|zl|3_p#@|2 z9zKcK)U=>-M4+4)EU=@3U)mYlWP zib%SPEH9|=ZCv=WY!({Nzz3SxBE8udcbOgCX|~D8FCb&uG!E`0Ow~Q~Scf(Gn93^U zNe8Ufom)~r;mucShIEU|z#(^mCYCY-O2^|GwSgGg;n8;-T$S=16bX!%)tt+y=A|R4 z#Oy>@J<1Jt&!T>d`&tS>Kf~jrGeqmQv*soRXYSI_Ni)eFn#8k3Ddy(=^W;)z ze7-o5ezIhcP+xIry_Zg$--Fodn?HC?7T1P$VCA3#p z?rl(8gFKm~kGK1h#v5K?+S^#!^_HTKO|r5r@N;GBP!H=+>IWLH8D;)3!e(8#qFK=z zWa_E#WaV!=-^lF+GdtcUhjf)85#~ifAY#Jux;i4jh_k<0Fo<_Jhuw2NYfL!v;Z@I9 z*ouf7)>|dt^S{RcrVV}54ob<-iWa)AE1?lHGfd>M#*+`i56_zIKc{Y7;IBeDuYMZ@ zQ}R&|K2NIFgh6NvcWA`iCY9qS|5)v(m+_I>PX=;E8O%2dn8{hBN^75Wi3T>Yo_)N% zeGwE!lli@$r-hQtH>ct~g~SdAq0(pfsfGuzO-b9k=u@9=x67oSNWx3VB8z!a8aqC2_ z7ssEOwZ*_m1(r;aO@rCvZ+Su)Rt_;Q)`3v+t)M8n55Ag?GqGFck#&5Han~3gzFaX| zLUN-Ddne~WDqk(~GuF)!EIuFtPh6g!GiD1JCjFEj!scb=_TVPM&qq^3X!{3^D?3Bz zODeiHa0cScJWv9^MqewL%nW}q(1_?WIGcMg`=T}dvYv_0WC1P1kRwmiu<@;;aj$;o zIn68%#>NI@+FH7FYtDqzXny%+eT%O$utXOujJX5RYy;2$SRlS_0I7t~w=<;|_bvez zVM7a%q6-zw@5055t8Sq8l_yCSWT!aUF2Cp=yAXfkl1B(lfA19ZTN=H5dMCRIJx{XV ze`v;>!}_4w1v*IwkTa{p;WtUxFNrG3ZE^AEXJ_yYvV{7-&p8ZO85#*)af|wF4^Qg1 zgy}sNE1G4Gr+Nhv$N=EziIa=R3b9fVfB5348(~<^PW9M1lJ>)lvX?wPf)cWjVf6E4 z8LjVE0oJB*OVu9|>FOD-Gb&hzpHgPH7)FV)e=iRP)+C-K#1dYLg`bl9zVXz^L&Xc$ zi2?lZ1=VE$Fo7b%IE%WrPt1_L+joeHz1uzv#xUbHwhHUo2?soJH3wK+gQ=EuU`OTm zD=2`>H=b)ko#QjY+4+vDhI2=&Qg#6)rOR$zu7&G*2v|SB1{h#1x-yXbt{V*H)*T5-<wYU7-*T)ClTV2B=Z>zw>WG!Ce0Ty8rNUaIwVoFhzgrC3vmi2q|A+{_QSh`NBaH`T$*RBJfO!c05Jqn5C}gTKnnG+ zKL`sF&IXhMAVJ63049iZJrG_FfQi6m+UzZ@PN#gEg~x#?Gi-UnK7B+I(nhTtX&lHj z2M`Jz{}u`K7$xUw=*2r}Eq?iZk2`IoMylP_M(|4XIzY?)_+BHuW#o!P>BV_tQ^kzT zWdcjVB*Cek+O71ny}hD9y(&TOJY?j;`J0>h0}np4i>$6z<-bpP`NQz878)DvDoL>^ILqcB@K zr||pggUuL9T<`HF&km3A40}Uny=!;wzPu|AC5Kj)-~CAuTK1Ut?(>kesA3Rar*dPag83qauS@YOVWB0K3%qjy?EUV?H@ z0EEEqFNQskxgzgFpNc~bKR*6`EQ9dt$B@J%Rm#FP1dIF%Jg*IC}#x_|OGnNjmDO?$T&3#E%;X3a)6GM%?4e zvDAf^Sai|ME6D;UOL@}0+MtU<03Y&3{L)Tf$LcnRuIscmNWcI<0PHX!i*;`wWk}~L zLbQX?pWm=a^W&b_n<06(HzA4-*jTzgCL0CC z8yWmsR*i1&Z(TboK)`+GriJC_2Z4%5PPL3IOcBr%1f>I{(XndOJD6V^yJxN{ji9aW zzsI%5)`7+kMj(ks@krd8q^}M_6-zsjsV2mtMSRLa{rtpc1i-gkskZGJ_D5sZjG$*vaYK=GTJG8)dO<9zPq@iw6h)&d=CG8Tpw9> zEOF0o$Rd6(Z#Me!;e%R$>&l#WyYC>kyr5{cu{?UlVzFe=logA<#h0j6A3`el7a(Ld zuqU$e42H?Dw}!)D(D~x;Z9P5hTWfKlD_vynzM2DuysM|<9o1P4T1ies60MSi?(<_5 z8NjtM%jhtEJ&KjWe~xP*OYTWL6{_BMgzPI~%4TYi{xOafh+NR5u?{79LoCaNyk3;Wi58Qc%ac^x;JIl1 zFn+~Bqs-f}B(M$UL}ezB$u==0zyr#<-?Zt~SkSz38t{mv7q)GyCo^Lae;Yu5U`=)? z%(zo`R1EeJCz@sciH6o4d54_MEv9D`r2K_&-fWB-WBvsSuii{HS*&1JWA-hBk_WBY`OC{id3n%ehzcN>N&$(wM54|=2-c?VEv;0 zOpwF;@UbCz55tKt8dbH+dNitfSw@}()hcBEAR~e+UpaC~#G5s3Ajuf!UOMlC*o-u> zhGFW`ooxCGXBlk{iUY$a=mi>r0F}v$%|3SX<#Lv2Aiw`56~yTYAOw(E~_XG`>*dV#c2((<11MrRVbn7NXABXeu!G7!vzCBA#E5qt1XFIlQ$4L z<2MzZE<8H~Pga>9>4yzDTtw3x&MLgEqCPspj27gvHuGUFz$DCj4{5P

|7WJc%H- zy0}Id3dXt9qd5193jjkKwt|R?U8&$E>u`T@9$IMlmwzwE?k?Q@9Urvu(hi{v$bD*3 z#i8&Twj@ghKT`68M{=qV7#H9Gn?aDL9wH)~sdp^pR<<)J${wiHO->mtj^G}od zP5kHlm~YtSn_MF8JgbsKP1EBFS0i^<=V3w$aY9|5asrfrv>e)b2h-xUpY&}!k`B>C z?w)T&ySnMBwUI`ZN574|eQy`2e)SntwG3d#Nhi^9=jGL>1JgQg#yiPE{apHdf4uq}3sJ7HCw_x|LUO6)|hC%g^$3Q|6NPYz%3Sou=ieCXR zK&T{wdVhaazXx5c0Pq0QAh=Zkk)q8m;&W~;QIloI2(CboGB!gu&3(y2rmDTHVG_-7 z^n*KvxIaG{mk7j9a6V>i-K`>qeGW$zQ-620sbq$&c) z4F%_mATD;-wm*x!*ktszVKTT(MZNW+a7jBQ)x{z8&QU|FarEnBI-1>r#+{yj1A{ED z<8G}tHRCuKWEC5!R`%reOtuf-p;&!)hR;mx;0a8Mcwgb514|0E(Gg3G3wm4ykc&*$ zt#9TOUb|j!OtqYygoZt^-X`OJwxg}#DHDeL%2}9dnrih-+_8bFtwHhfu9Uo0i<5L7 zf%co*$eKExFMLiNh|dDRL0YLJ={te$a3x*CSZ7t;oy5%klQbLQ+$$P7*fEzpp!P8X zlxP7EqpcPqd6;kdooD#wQSA?GhT7-rvhq^DA7QhrN|=PR+I*R9YjxNh=q>~OvH)Nq zbcZKVT=cb06U~C&TLN%^LRM3Y-}5PFNj9P~4tH+y2G>Io%ubOUzZF!8psm6PJ~--| zBU1BA`wXlZeJ5)|WH01oJx1gRYTIQ$`o!&NBB0e)Hyg9e$V~5nsa0hQy3j&pmTM=T z&mZp?!zgM^3kdCnw$&EzpCU7iGvQ&vO;GEK`ictyIVnMBKIDQ6TvFA+Y9UUNY#MYd zsbA2E50Z?rT`JU*!{daq)Qoqgv8CmsPEwRPa>Cq2L(`35BbCCX8%{{3>$qm5@j3Mj z)t>#qDi7TVW0@%WQEvdvF0II@ zQz?E-D?GGFDK8-h&K-0w!aV1nEi9u4A3|>8$fo)kj@4$oRD8Zfe9iJDK?ZfFwpgPa zEySl!j&Vt#t9KtCcy}~Z(R*az=}}BA|CJ-^rFDNplhXC??>BTUUVP`!%CZPszj`%s>f)`eC7o2 z*=26$WcpWhRTyGm&AbVZ#t{oost4Bv))qLyuDyM& zQvOL=qNV+>AC?W1op`L5mf+Bb*xApM^@K3oeWrHcp!xcT{u$|S3+`8UQQ)D7s%?&t zWsDo?ephKX5X9&Q2l+)s`C8Na@z=X$H{4ObDD4=2$`wCL))y76=R z5G9?>8rhyZoqfOa>Nz_wX*t^f)jR;+0a`&54**i=9jWZs2oS&qfI~C)$?UZt=>iCy z>)sC@E51Hj`4d?@>gS5dbQp;B-ut3-im>&YV@a)1Kgp&0=OK7 z8I44Nx%xd{ILGWFRN`8MJCY#fN*3bYT6$W^1ZPvYs#a}{h!R>Z?ldb*O1R?!uSx|X zi*1}Nzy1>(o~&AmNny|G>Igo%2L7Yj=B{0f<(p3w-~qh%ImE;=0#rR>h}qp_UOHg; ztN_Y+a>)^RD;L|ANCRZp0Kf(=4K01IR}8ssA+p>kOSZ;ltKBW^wO&%4)4U+XnS*Wa zTgt*iy`ud%4ed1&beyP##Y73;tm|mWA3)RMAvvH^hZlR}YHT!5=uc4cfol;5t0B;G zxIUKI&R=M1u8tAmIJQ9}>-3Q^q;^=p-l`=Mg@LX-h&$DF=B;XUO_HmeOXs^CB%Tv1 zF&u_*lqJgm!C0S%IFq1(XNG@L3xk*~CoJ{cqI*&rKerKEoL_N#ML6JPn>DvX52u|^ zmpPB$%LK3a~MHxOZRs1 zwi|p+tLA)uAK_F;FD0lw#Po&!I((i}Q5~aUriVdQvx4fFB43DtHxY%7svkSRB1)MYG-rK>78XjqYZ)0%F~yO;|E{IsM@4vn8&A>>^mU8 zeT^S#&R)|{p5jNb6i@rs1Eeum4v~CStpij{-lVAE4>}lypep0LizrzbF?14w;U%q*Q^~$&q^=7Y9Wv;drfz#m(5h*gbpbU}YKMKVOg1Bne-o^1$_Xv;vK@;&>N^y;Y@c% zX~-5b<1`UhW7BcmB~~OEeq-W_D;W+yp3dN_=%QSb47ev2UPPCVfxkHm{^-T^n)RKz z#E`@t)F;33&s6}>#1Vj8=RcyH>igeOjz@l%k}IyDhMW_LDvvewt#kl!lZO_ADhhh& zXD}#>>M70V5@XNi5!s{lBUWNtP=KrSeDnOq4)hzQxX-ZT&I*?%2qS=;8`@X}$s7aT zTlEr`m4PFh|C!kQ)Bz_pd=|kQM1ZBea2Cd- zU;hvBN|nR^8n0MYKjD7vTug0+EqIQnv4eZwd!r~GqyZ0Jm)VN0kEq#m%VAb1OJa$6 zcW29!-mBchOJ47llUQ@%E{hIa`VYQgQ;6s<-%yl)a@XGP%)&TXt3u4nUM^wo8FnBK z8@Q#vsg6?*A6giFo_6_UP(J{dq_C3YhrCN|NzoLgncxzGI|6IP;`H1Dk6lbshixPR zuwZ3{{gEg0rv)BZH0UnBc}$ zt1HhB!?uKk%U=<1;<TDm3G9~;k%o9@>=Q4jhCDVHYL1$mH3U*p>=f9Ep=m=gcwGa%sw05MAY z&MPAglx&NuSzGCqKFDqXfCE?SSkjq-eWnJASpYCnXssX{^!Vx9bWu7cBKr-b+(W}+Y10J;LaCZRL?fq1}P!SN1nlHJijjvX>0|G16I6N4Pkj> zB`|LY_SA9g5X9f@$csdn*0Bhyz`D;=A?v+^m=cM`Zz_JXF}wciJ4W#xJ)qJ+!m{xcpgyO=SdPkDuq6!0r!tKInAKHiaVR+{FEdRho`tR;&wl`s{@Rn*T3!#YfOq zgDgmu5(;a0u8Z2yB- z82hEkdi)Hs-|LxN)EPZ3%>XKX#d@C-wu(ZW8n0%r>-GKz&el7JDT=%mR?!j9f**gJ z9`+ss>xf?k7Wqk*`X7mhGu^tDBeREGriRA)f#Ls=oj|*Yg~~XQ1(+aex|!>(VS z;u`82gu`kmn_b`3df}Qg!Nn-3FAP9}DBn^~u{C5k7VTXPItv3Q5SD;jZ~PRy;U7OaGy*t^@=yma*0VQ2ma{jIf1=&v!8;%8M7#0w5OU(3zjwuS&cXaKc z>H&S7Rf&pNdBOIJPtFB*jE)C*^g`I&A{+Ti?8Tfv6Q4V z*nxF5tpmzF^xO<>NBy_&QG7MEUIzI4r7wcnPTC~oAI z8eeB=@n`%v)bzVp0`4wmIRRmM9b(rd@GGuXnOs$eJ(blPo+n@Ys(ae+9pMeOvrs$7 z=WtHu$poB*%nqN6mx1Qko4KX9<%HeIIqh4H*;6+0r(UVc3f@U>hhdkPldroWANnV0 ze8^}(f^3Fe@pLsObE(q;dVV!GgpWu!%nM8$FRFuo9z6@;5*1Rck)i@;-%0K zQDwgiqbakm8od*y-6PM|P|dY#sOdu`=o!X5H%7j72)_i@LAl|Q@t)B*+S-)5tkdj>dj55VQF*4798h zeDs#QZ(lBMN;<+7nBSRy8ueLvh{Tdi`!t?&XY*Eyhb~{gDYD3Bh*?lLDq-zGp$;So z0YNWT>(Z82!zta67arBr>A7LD%aYb^(YLJ`RYUwz4x$Rdr=odKV zpt*u-PA)ivH!S`s4S;NmzyUGWOo7`=O8D?|#}lbdr#h3EUo%U!0EI^i$#k4-Um-f@ zRPs;iG?$}@NDr*{zSWh!2fv&X1fgW!5o-Axer-c+s~xG7*SO5#wf9gLel2NT(Z2DG zqwSeWrlgXXDem!yUw?z!u|OKu4{YW3)^AT8zx?Ms?z+6G@WBCMKoh1lg-+^sqi8i@ z7E_aAi4V!cOq-4@y{DX_4W)TVh3DGUV`i0{e-V^ewS`H@M0(SQBsYzG=`KT}+)zz6 zC=hbF`_*j9b$)tB(SA48;%pxNDgDc|i(iR%4BJL^lToe?;$d_M2i6A=LpNxRD|+x# z-~#>#dA_#(NAXo4rt7@Cst++Q6NZsPaeUUX+yMnyfA?3KH@Pp2#(92{$Ai$&Y^=@Xs+mz^CC$C zP!gORZ%Aci}7%WZwnF03w0BZ9x{c+q-YAP)ru`7@&`14=*mo80$fBdc&3I zr=MJW=!u;0>{l;ipQzP&=e}ST(B_J`rx1Mwq8UTr`?btUTHU^xNBm0jy*VM@g(`01 z;A85X{ay-NGT3~gC;_hqC}5;_WDgF4aKas| zvk1U@Pg|@ffG$7AwDibUDO!$dS~x^tagC`35HD< zfWl{46)Gtmo9VilMTA%V-$WRsH5x88T~P0##8z0tkh_fgZq^8|If%PO3Y_nLa{W{z z(p0v55c_{49Dq~M!UT9Kl*NDWb*=vgc@rKc27NKo{{kaS7s!*^Kg=~1;(2!ga*P2~ zl&FXbuZ*d-I|8fUF5^`+`XrP$Zm=0Bp9YCe=GEis#DR`u00lhHd$5hwz+e#^SRxB+ zpJrE$%KUaRFJnD}0^?@+&=OIngJ)d$qEPB5cOcAE5{dfGfA?NLv-pa2h%9d0i~1j4WY2oqZG)k|D2zZ*|5!M9!=?Mm(G2@c{e#RU`J(9eLYP z&d=|JxB`M-Q{s7Xf!r|wH=+3Bm!qkX%44VrltBjC0xK#UrNyw(g+9*i2)>l2@pRPV1vaigVM18E1&^7 z$3o;(@@d=E>MGJ!QVFN@0A-w%!c+NQxq;y^b9v6C@4DtaeCBhT^I~)pT(bD2qD-iv zt6@BgD#s#Xk-d6}soi@d>>tVWa1J&pG=l@`07DeAul3!df!%4V>H)SX6uTci z4&8tc2RuIF(C*KGSc}_vdY3Xedl9#=dG-p~!>>e*`CbDeI;#HcoOxC-Q_83>vUp7i z4e|$z8#m%!AjmUyX+4Tzn{#JT$}A~WpJysqvaWd+esshPFK_GQW~r%Jwem`R&aYI# z`n-N&p{Y+KSGxRls4XVbpifo*o0UYmNzs?~{8E}4C}LfVJzMb+-Iac!^{IP&U*wJa z7(j1S7(Ixg0$@`YCaBJp-y#)>DMDk>wcVjbk7$w2muMh215BnF1zk*^afCSuY zQ>FVFqOcZIqF6(zE2~-1TT2MX3=Q53C$XjFh9&dEdA3Y7IL;5MSCSpuFHEB zQny%TCrlkZ*cZ)1gmw3GEF!)qpP(Rw;Q4T)X6UL0)ru?tP``TN>=1XK5uY%xG!!f~H#bSi^M*A_IX_p8^~$ z*10*ibUbc`d(r47+%bEmAXFi#aqDxA)YtZup4Y27_w;*&f|j&v4SODK#<$Y+XO_Ct z*7BLdVEw#y5YGxri#)eJ&~7gn6S3b}>FtNx^oc(VS(2!WTq|t{S~}t_hy|CX8X8Jq zgTSLCH}%D8I*n|NN99Vdq*v%`SLrjDN;k$HAn@FvUh2eNG%qI3ELS9y3miw#CT0i- zd7aO)EM>8F!vI%1LtwBVOpSvw3&=S33$PU5{BBH*C>67~i%F)9};b&(bDEZj*DvI}3#l0<-wD`O&4s>B70ntyh zGL~^YCY5K;v5!l}SEr^n)vSc_mM5m*S4k`f_Cb9YL|hc~-6=+Cik?V|WQRo#9(G>d z1P$Fwv^^O|se|bruhd_!4(Md3A`9+Vmxj5p-yiU6QOIv@bw|lXdot2PYLrGQ3159a z-(Y`tjz>-k2hrWbQ%gCvaWU#(&WrWCnSJO4`u=gKv=-9$p$Go9%PKgu#`R75`mGxk zq5iIy${GPPNiV|F-)}ZpUtZ}5*%PZg6XuEbNBj1*fW( z@I|mh4Zvqk=ONK)S&T~ScTS9AG`4WQ}tey?{&veh57f`l7PZLFQ-a6dn!Rn*uB3&V%gQBys;j1~l1pG8i|U&`kSw$AZ>=wskMqw7)RAtJOBRDLY2 zv0kwqov9%j+sodYGhFN+S;%2o6wqufi1;q!uAe22bG&(!^EY=234Mn3o83jQ7u}Sf zZP2@Sn8QLExTXM_IoN{_qDd;Azoi_)mhey$lG)osl4U<*3q;RABMEj$<)RILW+91y6AptUmh* z-l|Zu!h)@%7EAKmEXj}Z8Zi=Z+fi0z8_2u z0H}a5urUA-CaS*^minz5IdgiCsXFjxdTI*23rg4vE#KE5b|8QU`-%%P1Ol9l_bws{ z2z5G~h{U-H>w{oB&)du?W6>WQ{{UHgu#E6h%+g4!SEh>H^FZG~03Y+CN9W?p4oj2| z_3uo<9xyi$`U?rcu0ZHtV>1JV=u2=r5DFR8f(bzY+s*FfUT|<3V5Uftkj{Nh@BeUU z(xQ#GoteN-P&R_rQZB`O&AST6BOJUP41k2}bp$6jT_?TA@qI@4QXFsEelyu(#N%mO5Oe@I;YVcAfyvWM#G%zwx()s0`C9S`K7opu94moFu;MV> ztpz|skO~=V~3t=8GK702bWdrj? z7Gu>OIF02S`Fd%X5tdp$A`pK+Jlo_=yul*kS4Kh;29CN}|LisT5FHNoW+FrOl-8TN z9L(OPTVX7(smENR9(}lbaIyk|2pPa#SiwBVo&nGk;0L%g;RP+4wOY5{!%91GSgWXC zq?qLdpJV_Z(aAGKFGh<_?%3FV#{(rZq4)iNP!m`;{6kGZg2_NV{9)mP507IF7@Z0D zAkB*1n-Hf62MMzPemIs>KxFK4UQ$2(OO*PwikU+`jYGC{Hg_hEBixBaEfa@I@l1R9 zxTsNuy^X9DMFB}8KUmO@K0jGJr;RHSjIhO%dTlE^(NNAQ#CtpvxpyHlm?}W2e>|Tj<%5JUY9`=2Y z++45Zz zH4i0eyAtrh88X&@wTpb>H+zz`S)0nBh_hj?NQ3l3Px&i*Tq&kpaaw*((M4)Z2k%wX zvoh`D#F&!-BmtbP`6+a3E1?(myZYg12e!B`F_mmo;X1P>f+N23ZXo{`sV9C5cg=*q zHZ*G$bF`VO9p@PN3-s!sY-MTC8qfso0lMMS%}@QLtdWZmv>*B;h4_+;|cA*Ed9g#N{#bUwa!E%ygWa){g; z0=e7(ao_>y>;@hU~fMrnL9bkj6tOwGir>p;868HZv0{4C{D!eM) zE*zq=dwFE+)us%b2Hc!bQS749-MB@U!8Ao+=9Njzv}^|6-+}u8A#Fu1JQbwc1T)a& z6+nVY(3He4^YrRuEft(K0aPiqIJEt4p*b?JRoc;&Caxe<#;s_$tv_qyKOExwlG~jH z&bI)R;8RloMU{L_d$=|^b14XEh!ijX;nC5t4A@`+h{4lL>YDD!ENxEPCfiMn zU|{W7d}ZW~nNinwdgzN-Y$wgy#WHj(?%co#Sqx7FmF4V9pFGIJQ~$gbUQ?iXen-T_ z@nfEwP%pBcSBP)og``_4FGtgq#-pCEyGyj23QXa4J1m z&GRE!TJ~H3CxZ~9w)70+%A(cDk{6_z4 zv5RB;PkOZkRSu8b3@KJJIiTu>`M3SY$=Ofd)ix6NmUYmb9G}q$=@Q?6?MYR26WR1T zIc*Vh*qsO1x|hkDNN?*VML&Zv-VpAo0#)XNB))6BQncDuhEwLYp z2_F2CU%#U#Vd0p6VppMWy19pWt|8LMccUfDVA(OoeDGX(Z9qh}u>WAScu2V;?xb?8 zvz{QsvUM(3ZO*vSVi=+N%ruf+B{K8i-mU?E+|%ToER>s#B2CQsa)x{GuCu4j30Iu_ zolg)wo+D)!`CnOOwes%gqj0gz7_yZZAL(?83w!4?wQcu_eo&b|n&I*O!9vC#kzbR3 zXb@fY(Vax=+a=?&h~Kk*)$z!OWjq&*?k%N$SkIYHm!e+aHO^?YHb7tL#q*2j3j?jl zuj!vuG!m<}(bl33u z330NAA8m(U~(+NeQK2~CjG4`2|R+dJ;K@gfN!x?V9c^9;R<5a#KgjPw|XgyiuQ>*E@_#A5@eHLC9@j?EU`??6_^3NY=)l;!T^8%*XI zvshiiYE{iOt_W=;K1KqM{eC?{uZ0OE)HytDqHuKK2Bqn!?1x9awz}U^#As&?i zW>l*~oyg|kxw}=h%=rD9Lkk9UF4$e=n8XsHwT9(wr!a2)eSM=bO z>XV1=EuFuT%^!>Q^h*3TVk-@4I|n}1ZY}RaM5TEV29rlSN>t%=Ae zi&e!Y{=1<8w2_Q43yUkJR~KU#KDgiqiC*PpRQvLmD*WOs5r~8CLTvm3TXoFXX`@P- z>Rob94oi0@2H!tE%DGcyfHD0niHfgA?68A@H!3D&f}wsm)=&Xy9*6w%f)I<;vdXQ- z{6+XZyq$u^(moRgVJ?ZgZjGUK3-2u%^5qQLOy@M_`4pZ6`t<5bxTG#BJq05?FT7u+ zcvs4`zt?S0W#GGyZ#cHcqg%0*mpO5 z9M9f+&m&0V@99gw3NI|le18$mLDWs_Pc#m%=|}Uw^E4bAVVKc#)Bo4`{b{Q6Gt#__=6B>HHw(gJoi*iN)c5=+Sr`15 zt&21kZ~Nb5UANw9P|$ePOzt1wcc$R##4v%Az7Me~WAZg2UwzHVH{>$?2`3N5g)1-G zznPWcK&w|Pm{yZrZTQP~Ww}M-A2Nd4EYIb8E>>@*ps4QJ1@Z8tit@X&eF!|`MST!V zU-gD%rz~atK76;~o&ug`24 zyWs*t4R_d)j#YyJrg2SV_oESweF0bVuj&7ylQSVY*%qRc?Of>odDu(+$6=59uftx^ z^Rd9`G#?J+(w&HbP!DnPed`wCjdsQLheB%Tgga8EfE5r9)7*cCV+>iDCJW>_`V5qb?OcMJ%SXRCGsH|o;dFZ-6f_jk_?}) zPbVnjoVuKs9bf_02B8|*&$ty86vl4Qn&r_y-`%#L-J8A*a9U^~d7;$?Nx;TX(d-FdowOHRpw3llpTGO>NV*Bg_c4ueA$b z@Xj3^w#AgGFg12Z$zko3snDkR#ivvJ&YBAJVW|=I&z;t9ZBD1UG=dAwKma^!wl6pv z>&MO-*218%v?uodrwBLuMyI9J*ZxMAOwV1M4coM`MjYxj=_v(gs+$f~cZ#TXCE#w-={Zq(gmL0fw_otA{&-&0n=+U*0 zYYLQq54gi?9uq^4gcLmJkBXL5>2BW1CD(^3u%+s-@JQ5q3 z6GIm-E>#ye$xtL)>F@J`+KAe!=WK8x*zZvA>M3~3wXY)4OX0W!tq5v%-Ubveo>3&|3N@+{xmpv}7^_>javK)C_ zADgK`oF7HBy~oaa?@RZidu=Y$uzQsYgP;6ih>p2!Jc{mBca~6O@b93J=5fLuy>Gsy z52E!HvPUTYl0mv~EQ-JU?sd;NBI9R#?^u??w~6Akm&LvW!X<2+Epf-*qrO6}S*Za{ z#Hg5NNEJF9T3Z{hbTp;;^c6tYVfGotJS!c3-wD(fzc9k^}2~y+8qp8(p$R?uznRbtK(Z5n9~V*_rJrc- z4#2mI=9ikGy2YaTDDVsuMgvMF0an1%n&KpY;3iybBIa^eqg9Z;%|x%cKa@boAp>YL z{)C#sQh9fma?!3S@Ug#ydP9yTOQftoR8|xlZZY#yIaH9Y~2_Jp}{G#oZowqo3T??koFg{ zyQATh8(KzIC^5?soN*mK(NDsKURgOiPvblvk=*Jipw#H-S1o6oQYWA`hl-Sv*E6Wo z9D2g79!Q1Yl~+j^qceHl#*rt>5^BpZ3NzEus$F}6dE|#-+aCAOEmK1+RmQg|NQ!|< zJfwdAiPZpNmTlhg+34l;;C+k-dh8hQA2MQScRZxQ=rAM;iexUXV#&}Nkr4^Gk z=Yx!V|J*vSwe?g(6*LvbiP0Y z$E`aF@m$iMG3{PvOM_H+Fm{^ENg-Ore3wU@RrN$!UpU?zu*pqy+lI<(S}0aM#Z(YC zH%9_D`T=S}0(;55H`5(O^53MsYld0PXukH2_@4aS5!&!TZyILKGdVIebRu zFF1#<^36%~_LVLJ`)c_;^IAnKNA22q_})0#`)>}eL`~& z@$)98r}^Rq1i$g0JV>_wkMNrzf;Iu;WC8Qf6*cDotBe>}MFnY~=2fvGi+{}HcnSafaVEzh zWOcd>b}!drN`D6@+0}RK%CE)7%B03b|0&62S>&6kRrZ|cb7ZxV{)UYmI+)xdFR8q?Xc*CPIA^2VLRJ^dhZuvv5OYu1s!6aVeH|Y4OKOMv15CM#lj6Lq80JA;c zMvm5e}8#=$v6SVXilBI&X@oPLO_I{@KFoCBI`Apok;_;}HgSS@s|2GGR z?Joxh0sm-qjKFUP$Hi|4$Ht=^xgcd^oJa!~IF_9%>!Bop z-_4-XBVjTqr(=Q~9A|QngM)Q_N1FM+I5=+q%faze!Ew;`Q^AoV`Y#2Cpx!S9N8P}G zRdBoo)yDxT;GiaX9Iyj^IW1^l>FFTrBoGfODFb8}6#1H-t{8;4wT&%uydWkjOajma zRZ(GTw=M(Y+QIr4(55wS3MdCiz~^YNr?7Irnk#Pr0S51aDm%;j@`j9r8L3+UE#9w;A zs6X_8AFX4?F0HR#Kh62A2b^vFhaM1J!416V0t9f!wOUu3@GcM1FPKhiOZ`-!FEh~U z1fap}FZw6_4kn!d>JNSr?mtMLs-O>oP)_tYZs5I#1!2_&30*elg%jQ9fgrZle2xf$ z+~PpR_mZfeH|gLQtyX7bk1{!e@ch0eQhSi&6rhEV`6Aj4O;x=b*+0NgvC60KatNo& z2+sE~=6mnLR}5KALA%7*Xp6$F})SOl_- zAV+sZDV`%GI8AFVYB5EjT$OM>7S-!v@6pVXduOF!%EetMpRO5&{&v6Mk+*7L++#9l z^*}*AaK#qjhxOe6$)5l$IOVR&UcvZ6&t(oPp+bV^q?3@q+29Gl3=RF9PNRBL<8B{rU^%yqSTm{>Ro(&HLvFXN< zl?=dMkfLmXn07z{APDB#0W5$uIBW;VLqEs_l|bH2fT0G8{vrZk;vgUjqB;SlaEgHe z*Fj5~H+7!?+val9Q$uRpwD)0{<5%_fu%oh2=9S$yY7Uz87OoxOq|JJqWqNM|Z*I<7 z?vW&#KUzB=&0M0bvwK{DV(M42`h>qp39o4&A1zJZ@SarlsS+Wn-NQGp@2q4WJ!-7C z62$p5sPSj!Hzs}@h6P9QULdUt<56Fz()!Oy-%rC@|48~;;ESgG4EiQq2Yq9qpzmua z=xg_X2>Rmu$Dpt1Ka;+1W0fP@aX<5qnt4*jJH~usDp29q(V7p&m@^GME(`Jy=y219 z35VY%JAR1igdS{G-Uj*)1A;iuerm?#&o*9lY*@(G*UvG^)eH;+m;hXiZMf?X3N-a6 z1Gqof#Y=pT;ghMr`i$`MB&^~j-nQU!;aY+1KG%7{w$tmzsXFK@ zXWKpfWz#`QK{b^6k@$l?^IfjTURx%^#iohRo+dfad_tfxls@$*8DU#@Ab^`EZk_2iIf{~y>-B{Fe$o*$c|t_7i2%uB;Mi4mn?1?T0B z!3>{UP3sHYh2B@uo+DaB$PK;-^(@(g>g7nkKireIW}wC#6<+uL1|NET=5V+GkGf(c zCGL|2BgtW8SiwI0wQBK1(;4yzc2<4|U_CjEk&whzPmc7l2f%9K@#RH*$}Yx>N+lP@ zVOsEl97YLjfus~LGM3-!r#jp})K9jM`ia!yxB97BL8cc{KY5UVQ)7TT(WqiOl%%Y< zPEwAiwCMgTNy&BsMk2w;Xm|$pEwi+$OL!aQ4qh7XfA^r8osAzYHhW{{l5+!#Uz`cq z4E%%y;~{v9{Z^PPwFHkv9KE5;p*P*cPzRw{G8802h6$nR6w1^_>SYA;kxqh!$goE+ zJ~Xf#8O90|=mHn6zu7!NY!ny~unIDvz-V9t1E2~Dj8H}XqDt1^PPTNc6|Pin@rp&j zOC1-Noxr*yeJjL^G`@yISZ&G8ki||vvfCZYd!N6LfCtM8#m_-r3a?im`ax{{;?NZ9Sr^Il1Sd8ja6*qx%E=Pp1F zgrULQ;Sr0C9*oz z+l`UJofg?Yx|?v|cUz~m!774^uP)h6x&%^#fs2OJaq$2!d9h$6fFB zR>hgL8$U)61c&p={khiTyjW$Z(tvmI0=J$8ynB=)SeHez6Vq0cW|@eW%HFQeZtFnL znDc>-bfNmXJ1g_e9Fu+fs?_Dnj&oIAuKrnskR4AevxiNJi-QLF0VEosQGzxl%1Jiz z)Vc<!g!h-RjTbI|YUaQ!Tx>CO=X#A)w^%J89O&MUJKnu9V03)RFUQj(o zO^M6@Gv~%dkaV4MdmDY7a|0*tLy5z`Qf`(w!@pB*h|||8w?nnRQf?ePP|B^3LS?z! zvHwxnEwhfZ1gbE*>W+RxPuP?6R$Hh>$vH~N#$;StC-dWqR89}w$cEnvX-)iTd@pWL zi*0z)0MfC-zOQu*;nZ+Ie|X_ALkXQ^kr!9F5qeyBu?`ZMhRG*Qlz#A=4zxw6Q3vk8 zoxVA%Hhsy%;@-U${~n@!I=S;Wqj7Y!gLf+W*Uc%~?G3tKI!({(8#Q5;$nwqKl6F3a z_RVtMdkeKzr}V;_gbYx0w0#C0x|^E$mccG)6ovYk%s6>nG6;0*wk!%a)+te?fIqb z{u*x_>|AcxcaP7g8>uI{(?I&)xVL}me^0Ebw&y~3BRrUd`c`u=7sp4%C1s=YR7Quk zo&|6(=VW8pRo)fWPe(Wx$cyv1Lqd3M(t-aJ0PovhCTwP$GeQ2}@*2qhdjZt?dq#UR zmfKlIG7t<(F9eEkCQ?ET-P`3!JGkYshIL`JB8X#_uQzG#MzpOC9)G0$w~J93bTPty zXZibL6#AboMr+p>Blypg5ju1-`gJjyPGt}lGX8ZjYO`brCGPw4T;u?qi;y(AIKNws zxcXJO(y-h6(C;q-(vmXaZ)9KGor)HSqqU#ldS~N~5%lJvnv10V6PrpZZNuF$U}@j? z`+KxVmc_bo4k8T$Nr?*@6E37dIYi;IALcdRK0+4Z|8XHfYnrlA@?ZB6T%z9t`|9{T z>D&I?M_|?dYafB2@UMMDj|%DGzjQpb*7xc(cyR4%s$5^+Q!b5TfuSX(fqmZrN_|x1 z*%cSp>tNikr9(mX?_k{ji=~6d8}{a(ONYr{xj2zAx7y&b>=aPf5n#EilN92mJHocB zYrLz4!TOCaeA7;ndGxl+#bu!LPQ%SH$H6dA;G;<-m~sUW!Ph^C;D!EN99*SLxP*}A zTTO=ubwx#VuWdA?7DINZ2Vi?Wn6MF~%cvOc3#cBIL~UxoJ5A zeY@KjW=`QN-*DQvW4wc`sMosISOyEwh$*8+_c=738lFK)WPEwV``1R~3RLv?)-3M3 z&oQwNBUxIJVLLF7e>4;wvSEuNjeSMgsCe4s$(~s~I+uBnvkPaR*jK8pL0*~W{&~i8!xaX6-;2ZHlO8@uYLPn?ml=4;&u^jDaZ7&Izyt zGll?q@Z1S{a!DOY5?E3X2;wFSu1!7T zg6Dd<%9LRPQ6@0w}@QyQ!{z5e(Mby#`LB`bA-*XQ>!57_U#uBB-dpE zzA4Gs(_g>JH`U zDDEv7^#Y)V;Y$?2ti8R9{#yX){~d(lvdM*K+J#A@xEWb&fCRT zLr?N&>aC;$-^LlNB?|9ys(k--B!VtQnBFZYPrk7EYCt;Iwr{q{$gP}&I89s1T#(O| zI~?-48XeqIVP`?P$Y~3^Og!Ahym+w4sC{-_^y2Nkd*I)G$q_$v8Bsdb{Aos~3x1KC z{7)fCshVfjsTL$8QNq6#lF0u{NK)$XhmfSm`QL>kC-vLJ};=|OPRXEW+Ik7B>-Tqz#* zj#dTnTa({bY!+khm}(eKc0qS3j>Mf`pqE83LErL@Xb3vh2rh9@X&y!{2!1THbFwEB z*yT)%j_~@%7kyJAV=2z}Y(3u{Vk=}9*45nZ>6hVUx#VY$RQb`pG$FuOKI86VF7k1a zg*%=Z_IBXM%1O}|lq+gZwqibX^lhU#>s*Xznbn${_z zk88VHDi76Z6poO`9MKL3gCvEqPzgKYQAaoyzQ~6&km|^?I3#}PfV!5F31imQYw@}@ z{htL)U1-1RvZpsA$$6-Es#N}_+7vN*7hZvA_^r0SS#&DRum=P{RS`DSA%ER(O+HtUdn z4v{GvoNLiHeq&NA^Yu=Zuj(WfH)<+%?)u(0CWUZ2epNe5N1Uj|sy?Zmmr)~JhED}} z*lkX9Itog~ZXdm7^{(iAT78+)kAI-HQK``|!i8+OZiT;rsHq&7mPg-rr$1Q@QlY%r|vdX={4_=V-YIq6U@PhsiQf>!w z;6}275F7Tfr!@9b2>O`)BDDTI!3Rku#u4g>VXX+rbRj@dwVE?!p)5YR?ue=R)e&P_ z^}8cR`Nyx0n5qS)siT2EJ7TyC(B_aQ6TTWj9WfM^zdB-qKlXlTkGevhRvEcYv1uRr zlKY}PC-Dxj?^%1}MmSLGB>jjY!{fkmZnn(>?W7Q2dE?V&wg~RyEcBa=RTG9zajf_t z7BzN4?eeTBTtY_Srj;6dj_VEa;yHhF7YkKCWQi~%r>3Ero(@17fVXh*QR|$?5{NaO zuYXBzyiAEDP!b|!Jy;-}{6JNgA6*{3?Czy;MGQGdACxCwwn5HOcRjr;9Rg2n$T_+; z`ash*cb4;!t93|o_*v%qvg|MC=p#@1qhf{+&sG|UA?K(box)Z#lE|=o;bL?~QH-D$ zk0Jwd`!`V$GM1x}ukV5qsy(J3>2)s|D=w*p_>k7Ajm@niUfuy&uAQUn?D_~9H*>gL zYQRk^fEaW54OK^vHm`(55=V?uEr?YL8RA<}buU^^NiUwz3a4XgSaBOKnQ?-AXT|%} zh_TvDR%QEqx0VJ(imgXkCqQ#uH^h+)L~2WC2jN~8UMyzG=gb`$z6HrDu(hEgZ3RbR z#CMJp$rcfF0*A~bE#-U6uTRQf(}#QEShD1IkGSrS&cQZAzk9g3IsNQQxj5Y+g{vf- z@koA+BH~JC_y+()VmZld4^sI8c#3*@KUbiE@AYL3Hm!_*5r^{(%@d!E+!93J0hw)}6#eD9QojKxb+;-8m7O?32f<^F-7d%v${+QE zIK0fdjqhX8Z8}B2hTU(lxo3x#9y~w3aEqN(e`x3ze-y@`7W$;7eq-MG$!Rm~L~QHi zqF+y7E;&O+)BvryqyB#eS%x@TNqq5oNnv zb?3c2eIA9~q;lD){cijYqXRIc$+@E&{oz8POFG0)MJcvoL=L#1U(kOO>IB~9-=nmvh;wL z3TE zkBNHgLjTfZz-=Kv2GH8j`03h@vGe(-AH(JFw;v<>fAV9r{q|!Z{nTS%9d*{czSd)q z{L*8ro@1Wudd6`}C$+Gb{`ZDX_#cW+X6|Se+erjNG<2vyE^sEuvB}P=Qz*+mz2(*R z3%7Y8OwYYLmV$lnPVXUadNQMTf_@`@&&fr076vU{I>q3oTr-LJ5__wC&@&^QyMZlw z2{%GmHNSSKArxoU5Oas5JhHC+t^66UW?~R}lYb1$T@1L}i=9}w{rSmVykNuJgw~vk zlq|LN>n_w;&f0jMDLDfDQ3c^Qz0VTvqe1N}c8fRsoHCR;@S*mVXr8`|wlYrZaN8i- zJPvG~(;SkPlot~2(!>O1HifrXmQrh~Hcu(k1_3W3RRCVBI6pa|0PFLN(X)&E(Q{ zMzk0J{D4`|n*&Aye{uX)YlrUh=((_S8c(C@Y`zeBdLdl{c0n3XoM+B`Y~98pd`2Xc zc5}1Oyo+|vL$`5iP+9Lq##qDo7xQ^7A zdnlg=4f#w&>72=gK3maJF&HPjO(Z>|2{FP}S6|%FI|ZMv0lL5**t-UV1L>gFIwUxl z6=GcZ8`5E1FOEHTj{6hR`IFJ%{{PJAaQ|d^%_0eb8+wF63 z(r~789-;afdVSGl*;N=a&LDPKgsaeNq(reY<#(kK=()ne`fOlPoHvPMN@ky`z5^3_ zV(1N*OyB2ZpK4T$efTwzZMwjp5_K#e{{C) z@cX`<;3T$ z_4&yR%R+<{Iqvb11bXjc6HAf^1y8YlR+ctfs^t0DcXOcG(>^RV!7-+NRmlGFxw`}z zOI}fE{!M*_ED+rTAVBA-6`n*6zuJxVRJ^5O zGc58kJ;ZRLesq_K}kLTKg%nL&0{-BcpgEFpYm6GBnyLxnnRx%=nHu#Wo~fE)|0mC+7%}JZuF_GEdg0t!I?=Q4?qJk zX`s7^Y%wTB1EYn}yMVSdFgJj|MrRt30kE|`NYg67_ZRcEpeIc%m<|fj!5Sog49v!} zc118x{78DK>O8eY!WlLBO*4SDNF(OrLnEa&ZDA-4zMRw0zQd0fT)?YNx_7VWs^m=? z-5Jvq{j~3(P&$@_5g0Ik7O%J&9+TzQ0%n3zY1OecSNPgm-~K)s4U7O{uo)A^fO~yBn9yr|+5!dlMxgv2R9*NpzsCb8foxbXTaYvqMtnUW$KcaZ zB+`exV^tczZt`2yg_`^rXrAYTde|^kn0Fjlf(;XZYeQovAjq}|LOMQdLr6zk2MI)tXFnnPlNyJspgI1~40zh7He@2o z05Kia*Gvb`i@%u;t8A$WVe)MWh7T#6DyG40!t}G8dyye-ilX6W(7-$gx$1QeuLow} zMvW}{a49q}D=sdhPCx^*3=A5W$NnCesp7llr=WrPWzJs%Gkld7nwaCEi5VK0mF=N{ zIq&G_z-;IHob^8p%*bACQbN-Pan$=VuvxXew9pfEQO#$cV#(&%fA;mc&sX4deqUj7 zc>Q--Ut!Hh<;I&^iHY8o9)hj94exOH@8byX-N;@bk%s@oF|>c;7zLWV9e>~$Pk-YW zix}59M$k2mVUqMciG!$zHk)YthlRp^yB5M~qHUxd!T~Xv;NT4t4od`Od|h03?7iw) zi3)M5LW5aZd>L9%1&;9uyoM()ixta5=~~aN8ggh~aYT1csKOIY+yi9rGSyL)ZiTT+ z^yX87WQsq;XP&+D_lE6Rv9B^7%y@ujQh9 z0-V&^c4T+*MuZ9yb!X6rYzRMlfVoeWd8O!zxbi0XgL5hA?}6+601fz78YXPUFzh@Q zf%7GRrSfT5T>J)#XSW&z@-wDhN!U!2-1}lop}SdaLQL{mutwZ1MfP-xd&I23;Ju%s zQ*I=RIcs$$ssA^6Oiz4{mVDK9P1Kn9v_FXdWS_vk7Et&rWKoy8+`hvvtl@K~S#5J5 zWVm5^(6a1Od;XS7l;}|0uXH5AtjD(xw%HMW?hfAHB=_wT3L-i zWi^3|80}g28l3zJpgvIK6@6<>;J(9tS`>uuO7h{TdI4keW&MjQiTaZn-%WwFPKA^e zj*!JD%Hqwp9Joek%4pjjyN$t;>0j`E>?iejnWk-m5`0Wai1>8X1AAkn5h7bDzu;XxF_b6H`Pc==g%&=Wg^_w(c{|_J> zap`OV^V~Gv2qpl0j8BA-0S58aFc!om$lmt@C4LQN1#p9^0E`OnZN^yvE-F8kBFZK0^VTt9m0wTYXTU7?uy+7jBWj*tmc8 z(6e6m(6gEzG?$kAlCanC<<&tFcJAfxszh$;L6C&q2%+Ly!d}ysy#r2+0Cd1K_+td} zw<9I!7hJBV;_RfjuXYGCQ1l9NI(~xEG~-iHnx;qI@#S@z#sNyx(Z{rt#;5 z(ljjBX_~MbHxvsFhp}J$4%6r>o-&rmL1CJf#-&TTZG#V@;u-0^m+D{h%cBJ1ufsHN ze}-xBpvF6k;f8lm{|(_^6n^8I!8(9SDGfy^Pg#&QZ2iw4 z*R6LEOf$V6_AME1AL%q8x?IkBGGia2%g=Ov(&bl?n^~Z5B-H-e#Z5LgF8T2CA=Gq7 z3pL$!qC!n~wf_%$Z~atd+qmz#mUMSFNOzZngmkAg64KqmQV@_-a?uFV(%l`B(kR{C zA*p_E(5K$#eLwNtd-lwpd49S12bfvcbzbLr9BqKVu0Mi{hPIkbOf@;>EOm`U?#CGO@>5kg?&U7c|(Ojd?stt(l82NvS z?kL!BJGLHa?S2(xwg*giyY@;X-hk=u?J1^sO=#||>2A~F&U81@gor_F&G6H7H==+4 zElEPs^H#ugr{R2GzuwIqCtY+?T410PKZMOqT_qbg{3<|#M2FiQ%gWai{k7LO4NYL3mz|y!z z4_QI3C~>)-I10-9i?9wkD(&jq1R$*2`oRMn7qNajET1y{(j+=M1a6LH0&*i6rJDz z&ZEHDmslhJ9jfA~FSO<@h=E|kmMOo5neAORb4k526uUX&O?5u2)bdm4#aj?L_zNMF zFbZ%irFYL3BC$`12xWR`G~T-Av>yk47Wa&Zzza3EeNu?|5FrQCaqC$Xw-B>~#QfRz ztRZ}Qk}fo2*ny*I8gGoPX9y0RsJ=3TN^e^=LnFosCtVjS;=6UHqmYpr3KhvCqJ@S4 z8XNl;m;%jf7R2_X$K^`;8pvh5V>@PLh|eS-oF`~F8&9>&ZK1wW`!*KhYi|ej=?jqZ z?%!eJgtq2oJsd|Dl9&iY)S}c*!&uehPPD_$CO@OwY1DiiYDVlE9O1pn^wqNWUr)%*P zi$AA(c<|*8yDIcnDF66=ZkG6o%j|ms<%v0zXaPhFpMJYi?@xycFMy0dJkXQ{5FHLc zo4P2k@n7(p(QeDVt&#`7Rx|XvQVtpi%7^zCHR$dyxWpMxuT!;)21WHQa%! zd-REvBz+WaswPR{h5UvmANXaL)y!5BihBrNS-e$;sE;*?%b8a=M%Am7-C!5wVp{dB z)3~aC7*(`-ojRO#H50;v%b{49qS@_iLD_G@pg1_85B&Sp4}E)j^C)W1Eb@7bkx8U2 z-OkGj{%8ab-3z^|6^;3a8%E{vP{C3##N#uW&) z^Ihd)+-`kRL;PFM*dFS}HoaE|rxH}iiiA|iA0&A8bOHx;2*)LRWUrfwZ_H%a>eM`8 z&D?~sKC@AlQJC#aVrOp!7vR8#LsooyZK&<>WxxaJi)_iPLA4;*8k z-qFxSn?gT7xiBv>hBl{PwY;}2b|OZu5RLl?$35ut?Dt{p^l@Q1XN&YrIc0AaUp}Z~ z6x#Xos@IU4F9pA1ZS=MLl+<0$mtu7*nzjuLp6;1CFAZSrD}MJ?MT^ySZt`Pbg>7xb zmm9zC?6{ZP_yBb{w#Mwmh#8gm-8ubY=5{t6!~TqZ@XtLMXP>RR*)&xRBH-T+=zpv^ zwVHmB$nFK{5$_hL_|YG~8eD=j#DUB+gQR33m{a@jmQ>-#cT1{89s;f1l2&G{#Gshp}h^j7{l7K-Bk5Tq#C2H*4v><^)fNs7H;!c!>7a+oG>` z+GW;K+2jO-dbXQC!J=lAD|}mo3x2A?fu5woXx)Pe_w9+KMSZ)JrAr>ZtqyU{t9s<3 zq-|lOT^?pZL_|4_aQ}>l#IK7Jr#JLYTqN%EVAwSobKjH5=EjhS;KuNABM>YuUGCfL zY|q&Y)_@nPd`qR@+f#o#F5O7~O%E znf*jGk3y^uXTdq!iEcSC1)E4sN}P`LI#8lC5F_hNg-rET>*_b|N_VPFiP>(vtjxb2 z@jZo*;^U655=f^V`y!#vfVmvv;I#dgJ#|vHYkb?{wN}Twp@y3->JkP<-8hbkW&vhc z4pJ)q5H$Pff`oM!sFOcgj_a!3+><&cL?caF#2y3MC6j34M+dd2UGJT-OBl=W&*WJ$ z-2mG?&sUrMuBJAnnPfWIrr3hrJJJ0c} zDt>%)U5(&6RJF#G7HwxM`}GQ+cCdCN=Iwb#l|6AznRu!Tv1?C*aGoR#4P_Ow&Rays z367VAUA(bR-<}VPf664^uxEu$ED8O~y#ZVnI4~dp6J*M-x2s zJNjm^ghJMNq<4gEV+6Cmuta9~#%}bM3icl-R}l8sf0FNrha~scEhlSv3qG<(p{rkPG z;5BuJu%0bRmXr<>N)Ja=X}1S(8w>eW6Eb`9Vl_DpzD;q3Lla7OIG79Bcx6fR4P``f z_|1s!yNY<8Ta&y=VUUjbU2W>v;kGt~9g6y^HYNK%>rIKiJITrjKl|C6`jqF79^;jZ&>LxuHwG2Xs(M(zdrL< z@b#|y0rSH#GUc5He%t|=-w>m%Q^a7mx=B~)q{9Pg-S6m8q1if4b5yMSyF@m_k8xA3 zR{a}ftVY_G0vNITe*n;wpIWE9`A3Yv&}owS<)@(%<(tU8TC)nnaRJ9&aTV`_)%|3XC<-IM6yMOIcC-0 zvzI?f zXQQxEX1_>h9e*XA-94gQ=x|^GptG+!78&Jtq_aO>QJ7bNSCrnnR}>cD6=naU#_cPL zM#wjIz0CjacFHNg_RrbN|6ET0xt#uUIsNBy`p@O`pUde#m(zbPr~h0| z|GAw0b2*i={pWJ}|G~>CE;Ll3SWSI5j!-V~^Zv#@w)2R}&URPp ziQ6@4s~+nYF@)FwpRw*Dc-c%v&`dC|VAY|=zh9Ygk3w8Gfti`A3NSMxD*$F@k-*IC z5jHS0OZYi6YX)X!5`=%u%uIH9+O?0`fteX86)-cCPQ9I(;l)MPaKRS*d1h8+SE)BG z+?o{t%*<|AW(;f2byPX0GoROguFT5XH4^fWJ!T<07+t{34Ev+N$SE*0>$oq|dB(`d z56sL)GVW$(J@mlL3_0iL%uL@MRczGOS`7`DnUzocF*8G#{xvh(IwpFt%K6us**yRY;s?{ z^!Oy;7mzUc(u5K9ig=;dHx;=$5~}hS^uv7J>F)6z`oTo30%HD3`1BY1VgBSV?1%Hc ze`P%wCR)`=vY?DLW}E=VBnb|5SS= zZRRrC6k`cv^kSZrM%U$jxC}Kb-;CqVTd3P|=9AY|y=HV_iekja*&grs$txHkPa9y^ zoQ=4U8G~PKJyO*aBlV=4yM2s3SE>()`9A4-tL{3#1x}!*{sEi-U;I>e;oqveZtT4; zw)$HX-n86&54r0yI!pYy%ea4@{wFS?@*NjZ@HZ|Z! z2a!QUuqZ!6zMY8sgtZwGFSzX)R ztWNjj@3T5YgS%N>_M51!*TAe!?WNHp#oQ%iMaD(eX4Ev&&X!zk#BlkMN5CsahW4Z2 zI)-vLO6SeH%^lI9lXbS`)C=*K{nyFQPgMfP1TiQ#C*5FV>!6IjARh2#E;PLZq%Po* zMY1m6vUZ1#2R`K1si)NPtpU`%wXK;|@w)B9^aoVGIy#WAPhM9!TI%#rDZWuABJ7=Gm{N9KOdTfKqI6HvR%4R6KoW%^LN zwsa)oGb=l@CysWZ9dutCon5|;Vl1Pt{v-BkNy5vZ7Faf2$+kgiqc^4kYy?rdjbW1n z;QIqoOy-@g1du7UC%DxVG18SCPB~@cPu>PdN7zlh*Ow>cMX}I&>%w5iC`2El)H~&j zvrLGg7a~FNn1HD(F@~xBh?U{_j#rTG$R+2%Svj0#^doEic1-)^Y^ONf(5s?l-sgs$ zZ)6I|vmcD@8oa$I4(5fM=%+!ObCau8&Av!@zrG!tpF^WJy4ExScb&02{u%4ly2Ly_ z-P8ajE?QcKn+DV&?jJe{6!I4x;ca^UVYU{$ZN;prCZnc#)bxgz?`RY zX}(wIEp+|Q(4(8nJ^T!3K6=Of4#O0EkgjPC{71P1?(ec=Jk>jkL+<%jEDKs>9hX*M{&vt(HB z`$C!N>0OaP`PujOq83M=1bln*D}=$-OofYmEXES!Vpy?WlqD6o{4k_3GqbLvB%>}_ zEGQLmkL$y33hscEtK_78R5ixrz_9Va(6w}xhY>RBymT4KPvY$5Bz9lXPAn)D=D)Tw zT`S~_=R(#+lee-ihD63@PPy%qui%H;(z&cA-ype|3F)GzbVW(l_O~yLlJhNjvTD}k zLCtkK<^7;6ydc*|y=TQuI10~dG74p8hYu{qy0WDNmljE+KcDwmHy0xoi8Cdr5cJ+|NNBf*ssq_mq?RoURT3(qD8^ z%E)a4)Zm7V{LO*+EHtWjV*qv|TRo}p{mdGIN4M-_pRL}^UD8yn&CUeHV_8Uwf%jeG z0H_A{20JMf2W%$;u=kd)0PMXOZpHMH3h*b+4ACg1r4k0>bLu?vpFOXy@3&}H|ET1> zwqHKMalt#I5Ao`we~xC?qOj~7aFWyjUXq(LlX6Sp<}iqiRz%CW?FGBN3&}10doLJz zB>^UaKoMd3NJ~s-6x)CjFw*XyOTbYueGjC2UcS{)5Uq)Ym7pPm<6mR3dXdxk;C?tQ zHex2#S%z)Tf>v~`dGaf92`gU7z@!4=WmEO{sBO_R^6=sP@L#d(6m~`9OLLh#ej3sS~Sa$dI^u|u*1SljFUNS9&70& zxm*EL(pG8;rAv*I)heUWA-99Z!brQ9@(cAH8wN$GO3}wX!j4*yAW?bBVW+dl?!wjOBGu@`W*v(rP*pVzv@OCQ2nh8Wex;@= z6v@6hMa4M=U8)2T-8aQSftG251o&oKd{?zTV-1e+6OR6y)~~@N1*V)vzy=<>=BGlg z2P#t9n{LrBCE9MCT#T%%=~Cqr@U#cH8CBTg9M0Hi%a&@3~9hc}Nkt5Sp%YP38FGcAaP&^IxtL6#~Wox=w_l<=q1livLbfO@4d+H-hTehaU(( z3940#4p`|ezZHU^r1)Te&;j%vK3EF`f}Z1p*{~}RW^gkTED z?8Y9@S&ZP2qPY?3rg z_q5yUCsky8QpOsfid3AH#46Wo9zkLQy2^878{deuCSt%YSjfnaZMg(&nCd4Oy%%%M zQw!@mM%zh5gK24K%x5*lMtMv)!?ASMWEzM`n_N!!ji^&~NbVVa5!DtEM>zhl=_;=u zwlGw+0mKABVkTwH`+yqFN>4?-XKz@O;7MXpOvvu3LD_ZOPHuWf-M@(I>IseFAJVJl zLyn7ZZ5wx|1?!f&pM387 zi@M)j#W4uzv{NY$-t^VJ=j0xYjn`#_06OhjK&M@DOWnWzZw7fA|7nmXRJtm+ru?fJ zJuh&nG87Wxf~N4KW4_ohSY9hs0w)TI%AYy_%F$(m9%F&qLF3*3ir9&jfDjUH<(F={ z#T)R^0Op>tTsAalvmpzE{>x<4l4-lLlVbUL{pA|z2Ak6X=T}7VH=r8LDH`Y7nZK*_ zq|~7Z)}_0>0HLryem-K4xZA`}%o^7;dbkjshstiWZi~~!a6D&RNOtiD@#f8mroLs3 zXR5dLx5lK#BkXynG`n)r%Pk0i0Rs*wV>`i#hWJ=kPoLI|7R(&nn|JPod-Tq1KAG44 zp$wKC(r1y%k^I1xmDt0C;14uD$GJ8;|_;RmM=yC{cA`tro}kcLSI=N5udo|a%XhvL&te%XXz=!&dzZdWdlo|Waf zHl{MDXo>{vGl~}eplXNVF0^|;H@Xg@B`s9nwV{^SQeuGi<8ov#bn{x$yWrrbgyQD3 zOB&R!7zWeZYs9394Ta>q*`y{S6Qe5DR&C3`wtS6dhtXH}R8U#~)UMCo#fVTxn6p+6 zII}I(W1KzDIin#(_AmO#8MW{z-Ix8?t?@Bl(z1xjLjffLw2V+4V2?gnmwv{Iksc3FeBR%NbNmzmi_lhVosM*za^1-LA*_RkLhp?S9`L8JwDgCr~iv_ zz-oBmLTP_TztpYqRl$~-!IG+1-rhY^M1ixRY)dHQY!EbsazBZMdNqSCi5$`;DtDYl zH_&7}r#^`7Od5`^*67d^R`gj`VM-yKM zlZcHaiJa=b1nC7g7GmR1JStSA71Ff@Prqery5Dt~ph-CMz%%MPNmoUHMgc#x0KDD$ zD>3jGB~3Z4$)N^Z3XS-HOTl*Y50?T~>rargiOZti`vcCP%B(nI{@ zPm~_lmLK}BYdo@fb_lk0NWI!S6yG9^5>9_3@<2WMfM&3i_BFCp322aBc#puK0 z=VO1_-^hDoP3NzxKE~O7Yy+s5^8Z4;{NneEdWrs%dYSZh>ZQWwPwJ&_xWeOG>Lt<* zmbDr zvKOWEF*Jv`3nx}=2`}(_zp#4M7xNZV@qe4zQ8d(UmNAJ0bfPVP^k{ zoI(xjbLwY$Nf1S98s8K|HGEamR&rJ*Vsz0*X{zb{=xhA^CrS8 zLxi%vFV+XseSMHOSY|&w;pfd4DtU9Pk`Tg)ayV(>GpJgvqc8GWOlLXT=lTYblm+#j zV$<7c5KNgLdh|q`6e1M@i{IdxG<5p}LXk|Fn&apgd;%QNEO)imio>FAXs%}bljzH+Qy>tke(wXchIc9)h0n|ZRmemKION`X=Vxju9qS5EFBdNRH4ByUIgCV(SC`2pB@RmlL7OMED=U!E1k)tuep zi2DNVZQuADRt-x&QBicXoj*4tU)y~?kfxVr3oYY25QgmgAPl;v69{qU?J~SetgWN` zlnS%L=9FxV67ZXut>CVgN(L$ZAWYPIRq#yD_TX1sb}OQGAbzVoF&GmGVrl9t63N>FdVa+~80B-dM|zhq~)0 zD2bvLAD=@KDO~)#IJZb&dkmM@r&yKLx|M|qD@CI`SwQ?ohaPQxa%?&IjLzQf>`uT3 zc4%9;vwQS>fvqO|@=L(?yWOL*MY!oNc8|GGgyXOAPybMPud+8b=<9dx6-~94_~wgE>T+;$A-pZM1;zTKDui8V*{X8_bjW2 zNC#jA_;l)&ty32iUb2^W4yWJ@iFX04F1(be)0s6kl)2`uq-n!SilS=-5@P7eC#|+% zi4NO_uA3uCR^ln%YT8`A8e7`npK5*kCpD#aVQe%(2csU2|qjymFHG(Q$oJ2C0&rS`TL;7yX6VSOKlgkgIL-Kg4(g~6OK`7qaZ6Zgo{gSd(3 z2G~ymwAeE^VVX`>zdr9l2)moJAGltovbKz^dDM$wJsg}8#GMiRDpsqEVga2 zhQ7xTUKvMfd8A5;YJHOrGMqbidYJ}&#t42Q{5Tgzki#P8IhG~#*WkSI>9Gk(3_x_H zEyC|DX#$9@AKGelnq^w>zEpFC#8_GaL{}8NB#QGU=yyi2Hj**rLB6MQmk%R3)QAcE z6kXCD8<=s!LEjV<_lh2IK}VRtkHKv~pu!BMr$q>KW*{5Q?mlIrzIfyqPyR9Z4V8F) zo{?|H1DS5SE)}f%(%tr3&}YnGF7UfVXeu*!^~u^9hfw8GEUCafXC?It2AOdIob2{u zr0n1=p&^tCTjhF%fW}#~I5IN0r64XH46Y@SRwBEq?SL@y!N_*H7_>eao-%w!trH%8A} zbom3|oo=*lI;ZhpUf<$epC)rd^_+lfwJs%lnHBy=1gslP3FHRU74Ml>jUJM7A`r^C z>-|;lgFI>E{_TMT^=I~$YU0Mm&ZV$+)5B( z(HU{0@OSG^;0wR?g)aGoy!8aL2^wGTd~FpDqkSi|l)o^4z8~np*68DOvES8dU*)84 zymnpbdw)y;$v2VOHHD^Tu#i_=VfZ{{FQ+a)^Ze4aOt<8-dUFW!2{1*a2f{MgHLd%Yu-uEC(#{v{jL3b`g#Ay3@bb|(+KqbyeF|u zCrG!iw~u!!&(kKT^$xHqO^3eO0pQ22(M)loO)kqnr|_#10(7)P0_;|( zJ`LWathx+ns*;Sa5h76xyKzb$DkN#5#B8!)+jrI(o3ZCy`i5rDpip^W-h06iXGoNJ z5DkPZdXIy`5JkIqdXsk6p<MolX6p=@3rU6K|*RUomsbg{<0|tMCR0kv~wCvg$#+ z`KlcVf-gb&ny+OaRfvqgu9V%#=^yY?O;$UgdHKWP-N`3yr_{M+x9$A16YJw{WzQb3 z>R$KNJ2cEK_MP0q+W;8DN6g86uy48V+5dnT;bpX!!*uN#FotI^{xydG_W&m8BnVn6 zKwv^D0JU~Y00gFXOn|`jY?;6oMg5Mz)PWBWnCRdCPGI5;Z<4-XG)w>pOcG`QfGKYb z05J7rjvl$^h-v-_z*Jft;VusVm|TAYFl7VN_)Y-8H1i9VF4gWUw336@z-e)CG zF8LjhWE91{Xo|yKfZ~J;2T+_6g3}26Zg79(_4=e4`-nGe{G>RodM-q23jq|T1x^l^ zTdloJ>`L}9rXsBA$5K~&DwRU{DToY39CLraw?9B}N)Fn<)=&3ZXf0GntXEe3#AAp` z6-3Tx$Z#gvF79L5@#Y)4HA^x|yndC#)lJ~Xdq_^Z(2`^tTomx;V9qN(*?G~N|R zfVvm+U>-lUu~+ts>#+~IXGVflDvT0U<^_DrJb6oj+K zVS`l7c1U&36PD*hpTJ7MgL^9OI2sT`mU6n7CB(nQmKq7H{@0oa_zbipHa_9)6pfHi z=h>^?^CO;^d2ev6dR;g#Et*W`cX7csw(>?4@{SB!91@o_J$!8Wh|y$%-Ds` z;5HxBk=r}tF$nu^7YB#M2IbxAH(5+j&FF6lTQCjfA)hH+SVdnavV$%pYQh%seb`tf z=6;OT+p7jW^cih0E*vG9Y*ckO?os^g9hn|+%XN;oN?O1NxX#rw1sri_D143p*O_(1 zoluiKg!otf^a<){4ZKfkap~vebTJYTp2fvJUKu5SDc?U-EwZ zJZWlcPwOPpFI_6-DhPX|^a~cRUb{uVQN- zhqBVwpT}bCwtT;O_i&7-dlm6@s2Qn-l}fgF9GvD=ng+vUQwwfYIV#Tu+y$F1fM>-G zej}H;y(O%C@xEyq@`n0^%;MAdMS!-A9_!BHRoN#_HrIYTe)<0-uKbk4l~bO z_3l=Dk4O3U*rZ;2W>$exG1y7;_q-v@9A8zPn~FkndN1g>W$jCLWp0QVuiV>a#_4?{ z$ja*6=pd<)+>h{$j49Sl#xu{FSIHz_kbTVXEK#bR%b{yiVVa}q(N+)`m@?^SD2!c>$p;UCkkfFmYtED$C3Sgrkso4ZoPo;k1~J?}anJ%A4a!jDs13 z_%yK0ShP$#W|LlR>?=OB`cN+r!kIB+pck?RnGAG*c`CnQG=?Ed-V?Ab+>3HilN=Y( zL*9<*$v)Pm0MGSJ8felqM~J@A;S}5^UFX_QiONS;X$q`3c(>#q? z?ZKR%-YpU6!<63q6G`SnV`m;mU+-66W+TehbSm>#^QQn$>XwU z?eIKi5lI`Im!S3bI5ktja2uu~6rZ;t5bEuv%He0$EFWLKm#*1SEiMXgxNGDv*)hY@ zV=E_?tkHLKQB-3Fi$$_)g>lhoyKWe$UCf_^hglz*>+G!IrN|=XJ0V)u8bswPs^*V7 zpw=w)GdA^fUdbAA-KuZMy`QL9$g=WH3?| zj+<3T@sv!KaDIIpeyVSRv;p;vfGitt%^Qol#`> za+Xwv`9(0L5$1$wz=q%J(gsKs*NiI@(VR^t+-k#Ej=GFxVA- z)o$) z3ygX;=MNX7y47*tNY*pzc07*Rf-%vV3*O)o*dwzU9d&}pY z9@NtPKt7Fs<@yxA7>43r9rGNEQ$y1B2~BY?UhQUY-#U=?i)yos7Xsajw&0J&mz z5s)hevg~c^#%UrkmU)dDuh}7VlY7mM>egg2_m=OY3;=|17QtFlx2WXYIFm+PQ_fb6 zPnMW6kW<=;oZ8fY&y99-<+QdWL2-&YUtYxx`T%Vvx#lpgc-rGizWFOXV~O&G;u1Dx zlg)%oOY-mE92}C2@P=>dU#!1}AIuHIF7cq4f7w#+l+(1#+gaSl-H$}zOLyuZ+?TXB z<{;IRT3f}lJg-&r9>Wv)JMFn|z!BL7#%FCaAxJa70Nhf;h7U)q!?EcI?6gtJ{J3B2 z!bQh1pOM^;gk*auNpncQ)5n1C&rDl+PIC#@*&Ca6d;=ydW2C>`oSDB`9uUcWvv_9U z=J$h&OglB#gWyatt}M(I%DX%EbifO|_oTfvJ>#7f+S9|G3=|QvfyLZ(H1k8C?9@Wi zw+PX8fZKqc|415O7d1^@pLmPK*p}+)6i~u{RUxeVeLFDSXJUD7o!+JkJDql>s#uUe zm8toY?ve3uwY#7@uscurYFd@>b$#GlQ<&gKqY7*Vv7mE z(@VF<`KBOCEjJPS z#h%QVH;xEQ0-A^=|Jc?BiLEerqK%Z_23;ao4Bl|v`VmoO;DL(7m1b*d+VE9;x-$gu zJ?7?mnYzEsa4MTI`R17!A7K;sMBy%0EclFPGrOCOYWxGmFuBs{y^pOa@)$1zqX7$B zrUI+37C!gJ^TN&&jcoQCgZBfE9+qn7!{;!V+A?8Rvlqx2)yAU~A$5H;%qP&TK@+rI zj<(|zgtn1%W)_5|DGV!W2@ls)K)QjPah(9j8HpumGqha9yry(?2BJX+=;DW$h%9MQ%4_;S;JG! zSArh0C3FjEqUOh8c(rw8Khl$a!e~J$VM!CbVsni=O!?7x)2=heNFKH0HWL)>;>I%?~uW$N<27$58- zpH?TxXM!JEZW1IKzfi|+tUp)*KfGVE=+C#9;e&Y=d|@dpZ-SCGoD51`l3CCSdc}+F zxUo}PMpnp^a+oVcR-*~KO#is6?v2B-oY^|&%ej6XltRAV0EA7~MGW<|*hViDsYpl5 z6wgy=8uNhR2!sJd*=-$-zP!uHPus?U7%A(hFdy;sn8mtTW>0E;YM!a)+by3beIxyY zDIfdt>X*bQ&j$g4!kf)CgKlMqss58Yao7D?07P?F?%Nsz^${JxwOjn8UZu@G$}1)} zU5!Df$u3s`HFutb(8&*7+hW+tCirhz;({^jrVi=*Ac345SzmwgdFJ;ot>a!9XDsH! zC_nIIJm^yw5c;AGe(9c@JnpW3xGQN6>;9mYkyDTQUBx7za!a@?&{0yBv5RWQ!rc|< zCRny!g_}26$5x-`)3UWjh`%(K}0!f z5am4?0{SftrY6!axSk$I286p<{Ln7!MPJZJd5UXYjV+M4m9UJ45L1^otn*BDQ9P@` z9lirD;@MZ+HQl7Q7gQZK?1j@)vX*XI+{|J2Z`^G{!2wY^Pe^dr^4dQZQscwG_p`!QlX1{n?& zU=pPG!fO$D^~oK#J)Ob4K&o@5db|5JG#>R!GRR!dsMHs!$tmtr?}3zDPzg>xnU+ro zK{2Jlc#y9&=vHZqd-OV5eLGLxpF!2#*YC+B=M*xiR6gL&7FP|N47gN64u~UFo$}I{ zoXH&NSfQVHhC?=`orTwVZ^yf$mm)}$Fve>G5Ihw|tcfbu*da#)HgeXJI0_LCi1Omh z!3av30m)f{IoGppNg2Tmq+ZE7OdbzblDj3BY9akJ!V1n3o47R@o@x$biqu~-AHBOY z!h7}|EM&)44ZB#0YB~EtulBLWBJXU!ZPk}^nOI_Tfnx?NKfiSirCz{XfJzw#mgKf32fX}^bY_OT5&{5} z*tZ>w0{K{!$zat|RJE|{h@;hDIXACl^j8`a{64&KXX5`J%}4(>#!iPt^wV_3>I| zU9K#DC~@AD`Tkl=WO&S#PSDsG_kK$mEET~Q5?X*0N{q`274HC3LeBm8ok;1LJVUrh zAf@E6_AkgS#@7G zsyvnARq?3RWN7I|8XFfUdS?diEViB4j6r|0=dDer;Ow-iX%mBwmad+N6Z}c_<()r0 zb<+`{c&3VU9D?(p-}n{R!;WSPf++jKPo@}am@^xedT(Jr#Y;NObD1d#N}x5UI2=r1 ze?t5ub46(SS}YR4`Fx0X6HA-z>(Eg&jeE#iqRSiu3E168VW#IbhYK6ZBNGs#Ae9Qj zglU6CVpVZ`>5q(~|85byWkB&9t$6VM>4uI^gyAE*q81g24cQn@-U|(fj@<2&*$~E( zB-?2kaU8wI4`d8W#t6H+eEi0fmGRv7hxEEoeu0s}>y9i|QA8LGH8!1yuf zZ?JgvJssq*5mkj#Xq#$$y$B(8{; z=OX(REmLOaOLILzaGk=+>CVb~($f)y?P9mq=@NT_W+*}k-Qgq1y=x;6hk=Ssa6MOA z@ZPsYLzr`_T6~9vri9HRkx1mq8-BY5NuC%9?Kz`bP~W;8kx%T-)bqPjP8nV{t??Vq5kF2Y$@62D%*%H zI{&)nn(q)DIvf%UxlPb*l6kBMH6w7+0~boxYAQupTZ#3LO%_6Lbj`fGEw_T1pSRF7 z&@VSA3rO43ed@B@^3ccYhm$ljJ*R8fc9>+nIeZw9ZPbXxl=vXxfPM{tK80yJudOKq z33^R($%pR`uo&h#)To(x+HXH8@kIG~NXpWhdBGBdx0oUxC!>0iZ^E~jA|Yk`tkAJB z*v+%Jtr@tR(k-Y1A`AhfdBJYBRcGk5vi;+5_ItM|46EX9g2dnt4hIO5{cjl}5!Rf* zbeSDVC^=qF>^D9u(A5UeDPUij74oB&vqW5S#Z`A_X(@}u75$Js%M$wWSU{)H^JDMz zCUy#<>XE@qD=RooJ}=hwz)Kz^$zaB_yi5|aU#OxgO>6%pI_9U>3Z73(bWC3L<(&4` z!aK!R5OquS%hXGwtiVV=5BUS8-ARZ$GZ<8fcHQUfVjvYw(W3@&&M39VNXh4&#gpSil2It zt9zW;oHZ{C_hZ5Tkj?U_sJ4A)y!qRS?J4jmASE=TDTK7nlQ3m$7~tj0x9;`;5>;)x zJ6XB?Rp^DbzQuh?mGXT>@)|Pp#A=vbg6X62cB2uRS?Cch6Pdp%f;1&TpfL_f_#;kw zYQsw%U~2@vKgj7QpdAL}MF$eqVJ zXX|6C-`IUwN3l~H4OPF}c*^hBZph;B?exAC8)8r-r=(62ej%w}BKPZ2K;l-*z}bh0 zG3lSrt2!{qZpYeyMloh$B`&2qthV-ixACqkn$)gQK_=A37 zW|sC*s@u= zpb{)%2ULRX!l#{ww|;NM`4gBK?@SW5z{qEe z7!pC*F4!+k4Q@A{X1a!x*t^CMjyZ1O^u;S+B445V#PlvJ+UVo-q?{^;Jgf{#rRAD zdvPHn(!+R2MMbIW)$G#LC+$vdB4taILS@c0y2$Wg9po8^1G{b}3b7M)an+vLT{V=k z|AYN;RS#eI2=8Q7UJ=S81h}3d?^o5Oc$SU|3K$O&h^zx-PSOq)kq#u-qLuDt1nNl| zEKez)kcQRN8D)}5%pA178Lh{Lv6v43;ks?1{;~iKmLT9g7D?Py5`XhT+>}(UrV`upbh$znInHDrkBk6L)Sp>#B>IDymml zBMo`>zFrD+VW;8n#=ZCPUWGUDH(T$Er4?XLD*FBA<=vjt8rYK}=IS6YxtkbZcYcIZjGMzsY990#Q&ZVDv$YUvi9y&jjScz^!sr@#>h_T+^%E2K=J zG?VZhbk(o6S2yeMG{1q2RgEaq{np_4isx+x0&?yR=58OYX~00;4TVKJ%p&?6t6%PZ zQ?2U{<(+yd!mqos$PMLkE;=XDUtW^(nd}Jo@!IDI5kASW@-tc_`!P+G->ospHQUNE zEYTo2W3JIgW3Q1Agjk|wD!h`g$*!|n?mA>cvX5$;n%n&JX?NRO-xb8GYl!>)YsoVJOTBs(nRKieWEvp@zd z!Y&!yrVHk*5@AYE_>tYQS#sMIent52Hs{p=598HNz*mJSf*3jq#%Q;n5k8T|mXBJt z&iQw(@jl-1MdHO4vo66tEfNvNkb>M3;iWfUtwkdTd=eh2LsrlYi|p!1IBY~NdbMMT zl5-MpOr2hOcRA0IF=YT=kS{NNF9~!bpN&}*;9S6-x{`^G$imL{dW^ike|at(;Kd-l z8LiDB^8jJMTys_{Gbl|Rn{`A4(7&&~L5kh5f{B3(pHxiaMfTJ`qStL-#;I?fYk~p9 zkm~YHweTn?5dHauiTA;*r`Qz!!-}qw(awbT?%6Hei|Ia!!^!UFBa_$6i;08Nf8Zv( zHyJ6=;pyNucLi1K;9I=K!&j7 zo}30FQREs!V#EPdU4vP2OO=pzvPzY_wSlUu6dV~zVmLDQlaj;-C{+!4h>x!ET)-Jk zP4qz1RlWt^b5Y8v8aZu&S5F&@`^Vm1wQce@>y9}0&GZJov#g@+b(+3c_8xW*;`Q*G zF~eC>ArM6g8ebChf)g69MWZnoAj2p0DD7xNgBQAy{!|i>tb zyNas9-?xUZba$s9-Q6IKba!`2cP<)fkyw;;cXxL;(jC&><+ITLKKtzFoc9^yz4=`* zxN$f@$7jv&oc}g_0pJVDAH)CgkKs$={xN)YhW}ys>N1zr-wgj> zgb(;{hL2$ix~lz`;eP`ez6eo0Y60Jy;fs*}r{RzO--f?p`;Xy|KD-(J9>o7*_^0Ck zHvE4G-&T&tm+9%>gm1WcoiCpQx~sKyHwE3*)|?wTJ=rIW;9Dz;VlCz%kHjCCy9pZo6aX4L zgX74v>An;ekq%qLvgcs$B_bwQ=%8!K{;E1JtFCih2Pd-RQ@!}Slk;87ldVVwC1lsj zT_A4ew2I>F%U$DyE-3t4B`5!p)OJU1)g2W61uZJ@OoMhB2!R^YU_<~M+w__w^(dit zAykusmbu2jy-dO0cYR=4GO#QX;D9xfwji4$%Kl zlOFzFx;);AVD(`-J8)SMyU9Zfw_lrt0$k?C8_QqRPRRyonfvS5@=to}?ta5Ja0jV- zD{z%9Yo|rfh{}>w-fO$8V~?He>E!Y85+fv<+VggE{r7GDgX#OR3U~_v&q?oQt_xuL z5h(k{8}87sVduEciNk1xbzT*@93R0k1Ycw@T@!T0e%0g4#p>LXbQzBgv}z8=3T zh7hhk)?4Z!QfHy9gkf{uhv$46iQBEvyKhpb*VBuxR^z*{tkyj$4xDM)dP>7YhO)6P zFrF^}j#x6PMOfO6udKHe20pX%c0ri9ulK!@WrwZ|9)sDDU%D^XY3va%aDU*Dxn%*Q z@Yz;s;2F(Yj8K_AVWYIT8$l$e!gC^=6CTSypLu&31+-ITi|UFwb0rdI+dP<6rnXyf zRO?+(d4bCfi^Q95^6?%&2I*#09$l$Pp(i7etbbW0-KM@OM4)j=;eNjm%~mF{DdKmq z;S|F9!*{%^|Dyuoihs>5lQW$2hA9I8J6A~i9*I3yKWzB`w#?3ldH@H^(=&zA3>yaz zyM++zD`ogxV`5exf>G~7VwQ|eRsWdY(!1M}kv+(!-7KE>1#D z;{#I9QVC!^>+HjH7|)&w0s1L4ef2yB@HxfT36?{X#R@jZ3B^$^N0~Vk42u+i94FjS zA-dw?{UL}|lRj`CUTXvrhA+|YcT8KEP0*~^q2t}6g8S$kZIS$MIIQuQRc^2-(WAOa zc|>L{>TtUey5B&(C*Z0r2$!m&PTgVEbw^V*o?M<`myo9C=dZ|1mhO`+$RHMy+io{2 zNvyM^^m-TN<7i_qt#f(q`*#2=+YHq>cCQLMP@2a2PVovk;WSUo4{#c{a%4pge%_vu(gW^N6f{0 zq$6K5@n`l*$R}cBloWrt7ujSl@B|w5O<|XEqX+)xf{zDFd!o*Z#Xo`kKf%NS6%lhB zV4IBrn>=6r2O4E9#Y{u0k{;ruqnx|Dcqpm7Tx!yQ0~V7Ad^{pMcDFXDU$*{eKZ z-E!&+2XMT)h6P9bc?AzEdq&y=L@;iByVNPB;Gb7ZpR@RbW1Af}=+;VdgrYvNca=N| zFif(Z!!fvn6E$Ni0=@$JYcTo&8?bG-lep2>Hm08~Sl_#~N8=xLY4yMYw00b{RX;>K zs-!*LQ&fnW5uq-$MfP=i#_@gilY>TLR%IMY9Z=W-osWk}01k$_k1>Csp%~F&KYSQx z2sB0`h}%el7}#0mqFB$~ib0zc z4Zlup(Wckb@x=w9eXM*|Kb-{)5KyIWZrLW*vNtZ+s00+7BQOV6&Vx}1U>}^MSExzC zV8NwJovQ>CT$b}C)WrFaqgc2#OWJTkPROaK8K?)8kk+t+@mM3Sx`az+>KHi_prOHE zIf((|JHXi437^oNQY(XiEREhjU36cIf77h7SOgLeAeTs_FG?Ak`!c`b)UmuCK><>w3^85}yS==MK zlO(PhDfPTMc4IIIXX&Jb9w;e4CcwTm$-C|Jcmef0K{mVJXnva&x+dwQ_@_9&{rFFD zd@YHWnV*z(`RKVwE%%P>WsXX5#{&H5TBbk>7D$21 z_bg1)L>p}Le$2n=D74#*FMaW>cu}uOYyrj*pmKQ%ZsqLQtX(Vl%Wr$IYtaFwd94Cw zp|0Gf=16|EmcuDvV%oyWco?b{{7GlEOd5-*E-X_vUovBD z?<*1s;I^p=0VT09%JPM@k*=^OTJv+wWV>eX6Du)#9lvgn@ia;n8#hnr7T|g&O#@;Z z!s;B=S=udSFrr&zx_ihtgY-Z#ZOR*tRW>6=8i7KW30_{xX-_eT#9=qEs({V%*&x)(_#KUw~TSZLiT{tPD4jg9DRl z4Tv)bnO#kY&D%YH>gR>(kTn3`Am94ukNX7Tjg{^u{U@vle%abWYQFW)r+mL%)_NKv zDo`JWFrw8=p7|B5|M572;AU1GMM8c_!r~W2Td-yFXv=8BOvey=ZZmvijK9m_J2CIF zpBd@1z}9fXfUcmoVtP2lS=qLjW|zaL^<7^W7~3%E0tk1hEC(xpK$66a1`Tf?<^pw+ zA*F%N8EDrkr+5G23bbr(eoh8DWWPK1L2U#?dAa9+4%t&aF|`mD_Bk3B5B^1|+_D`^k$uj0K07Ry4s8LU}`HNNlP`!8eEgwg%b# zYh#H|5D;BAzyGhfTx#P$`5O-JVu6Vtg_p%c`LbxDReddov5w!FN}Xh`+8K?PvW~n{ zhm^0|4)ry_PG^+emWWo$H(VhbXd89U4nlguzScT4GJjBAspCHqO%Vta@djg`1L`Kp zBW8<);*C+|zBlU&8A{gg$dZ0wFYgXM!}tr)ZzApg6UF()Zg#z{)mnW2H}1JB@Uj<- z#(abf94W`HnpBEFqdxEBw-GkE4grBBA>yda)3>DdVaPv8ZHUU>E_eNW5e%8U+a3#R z$fsiVi~(L3x2q9hYlqv7f+I0Ax3Vg%lGhHfQx1u`E^1?eGP!5m%cR z+|4J7Cg~L(pH!3X;7Q&?hd%*P9;>~nK>zWEG`Shj0s#MQ5BuYD5kt34N4;iTqT<}= z3(fl%Enn%UZLroZa^l;v!3?o{bMHjo!R|Zh>Il;Ir+DKX*GnDHR|ZV0z6gp^xB{w6 zUd>Lrk=I!@9{XskzH3h3M=LS-W3{`Ji>m9r&L&Ryv^+E)>XXJ!^Zz5t-AX-{MX}+< ze^S|8@gz6sy6AU#M>7*|>tyv;&O*gp{JMU6`pNA!oyb6ge$b!fX|*3Qa#u#4HWERX zM++M^cF!s@)}!(9Hd?S2A$jYo0uiM>DNpH;K}x}{YxJ0N0Iz#DTb6u(_{@jp>7-A} zmew*>H#^FUj~OcR%~x+d1mU4+pdNy*WE9MG%%nuK4^DBvjP(BLA&8+F7W&Cb2;=MK zp{$)pfin(ZshxA+=f*;t`Xpx|a+c}SJ;c&3Y@U*>WN!3Nr34`U3=F3?^qSEhs{(o3nX;gM^fnD z6=PiAiD~*_LaoH+`Gy!66u~_i)`{}IrhXlJYJZ^dYEfhC@wUEVyTjOQ0K0lE4CgHt zo)Nav%yYyo`l`J-bXU(E|JpHe^+Y8dw+(fEgyr@gdH23dVb$xy1Z}#?WXFSxL*k2v zAT~fBJ3J2kBT7+4CRoEes93E8rUyGUbGy<;r5AI1xd11$w78A5R@z^^@lHr8TEI5l zHY8xF%0D6Y$n-sGJ&B}N3mmK|ZS$3{PF;frGFMM3iMFg?SH#}EOH}bZMDv-)0Hb~q zU;(YUDeJ_2X&P^D&3-|y%t4C+i&Uf zR#=ezR#-shGsO)^A!j_4KKx;F{+k}=w#i;; zvOtz;=lvZRp}fqLcV9dTL+q8gwh+wWWYYqp48wUE!Od;%w=gV_OlLFc5pl-%HqT}d zj3@r|71%~Bl2m&Sn$8|*5d6EY0Nf#gn8Oz}3#_@+re<~e^gR~g7pM5T?aw@Sid75n{O+-wovAV*-) z5Euz)6l!D$RDS2>&;MO7N=6`TZmDk~*Nxy?rV~dho0)U?tf9VhP4~}X66bXL^Y+o6 zzvc{r=e1{F^!;L=xe^X&$?orO)q>nOB|Rs|plZQD zYqw>qp%&hu%!XUJ)E=>Ss=Xa_3o3&xw!7{d?efU*cx>IT37i36-PZ>iORXPv@B;vT+`|Y z$ggfaq|o>B?!mD!){R&i`H*Yy?YLCJ0^Zs|e4rO%IxsVf<15>5*!A3Vfoqln2vn^` zu~~B87q;~&_tYoqL+08Sq-VOa79oTDv3vOfPY%q&ONC5kE|#uX*yzZTk0QrR?q7Ow z(9`IVM6!3+8DG?i*EU*zJ6hZ_@sEZl0djGimSsK5c|v;wduYUtXvwtd^9BbD&4-Q6 z4-tPw&3rMG^SvFxgGMf7vpugVBQ4%2q7Dk5pu3U(ZTWC``eDZG#Jp}h z9yGW>4?*^MeF`8!D(K%7yg`NNVCz?ypQh+lLgTu=D6EDk=b^TMjv5m^o#x*KF00uH zUbnfyx|(_1bY3~fozbb4Hw2&XIcIE;=x5kE813%>HnA$kXvetGu1FM<3}SA7Bj+2S z%7Yu639kIlRh?aFVR3{w?9Aj->kii6%Aj`<8b&n!#Lxl%J%mwI0fqG<8_`jN$V zhg70oa9*4$1bawWBL?Lwa~Czok%rz;{wDaFW`B_S=o1L3Z9quP&A=p6^arUMmn#*B z^4R`C>cpqe26zm1nY-SVY=K-UUQ;t6buxDT3|-5xrW5gEOe{{oC0Sbn`Psh-dlk!p zh+tf*CsBIA5muXlv1M2Ix73f86b?;_SUT{0QZV1_1(i|BNgJUC$W<)oIVvfS4Osl}+7v7>JR*mEJ@a~n6008(iuv9~0F}z2DQt`$)o$`4~ zPirt1;DKCI5d7R#Qb+GVmcI|J{uHj{G~=Bp{Dnc`Oyl&{c+q7QnwGb!LiM9HvCWdq z9ASrF`uH{_PoO{V1B0jYhu`VuOm=-Rx|cLiMUX;GrQyp`7{^Xl-Q-Ki&yMNOivEuL zQ3gu>iY-GkX76KYiO8ij(uC(5T7a39-vL%d0PH(Ie^66mg}XlMsJtJHFy|C1?vyFS zd(a7-4BmjcQar=DJKbEioEn~e-fUI9Ht*hZ|BtgV`x^+_+f_=H=5eK&lbv*14{yo{ z-J;~<{;lue@G1r`OjfKv(Ts`7=a-8uQX&Dual5y}(Y+N}*>>2ivQg9X`>3hfZqo;! z0Uw<&AjR#8#Obxpq)&w)_WcRM?+$~OZ9LHs>ZWBKz5AZ~y$S0}yLo6zbGmsB?dqZ* z6-_oaW0SiCw{KFkyA_@yz{qRQm?=?~RwKalFWRoX{Gs(!!do^TY-(J{h3+!jRugS% z^rIT5kzU;H^3!WoSJOn3Ctu3TdY8_+0d4_Rd2wBqUvrUngj~{1pg_UG{d*BE4rEuJ zg#&|v^}(tph0F_R6cKTW!Jg;7G8PsGu;Lnf4I(zJNsEc%DYCO_ej4K}tV6EurynoD zpSg`JeJBG=5AZMfci#V?XC-YwP@)b4L0v{e-6h)_7=_nylt1Y(<0f#@Et1 zK7|6ZHy`l-6GiV~T|xX|@Y9hyUu4ck)hvm^_&we$7WE_=oUIy)CkCxY-&fLKBDLcB zI0g(l)Vc*djrG&RmC(st*?@kzh%l{&00J(#Qa{4orQt^DL^DY4hUtDsKbDJlOT%a* zJ`y8*2hklE<2tTbM=`f@s^GKL*~UUB{SZ@g+peqJZ+O2QLY6T-mM{{AS?2BW+e@dt zMlUjU*k_J)zTIc>azfV~(M7F#NHxa3wL_jVBo-BrfyyDruyz&T0PN8aT@NQ%Nblr7 zlva1s(3V!O_0w3_R%Rt?H18^F=)cUwRLgbcy@7UI(iNof%#%hE2()|0{&&#+5?9t! zCCk*&^&DcH3goY!QYoFH(7KjKl_W!FH~UJaEG1x_PtXi3#kHYi|Hhsx0Bs&~!n(y{ zR#MlggMOaEvajXzisKYw$r^<#tu=F#_LfSYFNC{gCGSGSZRSI>LygmM*ICqR(FTiQ zdj(c!f{_Cp0d}pQknY(ToG*KE*UdNW$=~4)nw~g>Esx#FRoPXi*yQjPHB1qL3N5^T zkqSWKgj59LxGY@vx%^;esklHfz)iy$<(|+SE$RR8P6T5=hi$q_+DU=Z=w0TW!D`uy zfp;`Z>gUawEE*eFJ8wD~O&7?fVH!xtMLx^Q%MeJwb_}2Gfhd?#qKU326o(RctSeDk zZ1dpQ%rMg$To$L2&s*#qlseyA{+l{CqWr=cawDg47IZVdZi+02 zjyUAo(%#M&oMjrG?sI?F(PrtZDR^}RmJ&n6mcby`y5{c={d$;~daJdH(n2#sM=JZQFJ-F--ZpSp5~*x!;PVxX^ddcU=U6Lgk-)~C=u6d{J) z3UKgLep2+^Mjl!BrhYNEZMH;Bco`ceL4M2$dp|#!VU}cd@o02|__J6R@8)VAh#JoN zlqL|M?mkxrk9E;_$k)|VXjdGmo7)1YHOwF~9!IyBM+4y>=6sXCe&*{#Jc>8s^5KRwf(6?#qiVF1R`dS(Pbn-VdzHF5QC zK=Wul(fR^T@Q;!Ie-Sx8(Xl>=$e;ca`Kqro*C>d{sqOy|d9&WdJMVvp9E0x|E?76K zlJ!`crrg<%8kNbHAdG?Y90FWdr@UwT^|ESW#2m!lnoDN z1!comg$Zlsi;eRcJC9X1zbK|9wx2TK7GV|_wkcuO*_t}f_L47~I0poCe-%^39@GO`e?ANc%vK_gSNdZJ?sU?|ojS z1vaY~E!zv}%g@S40s+Cx=5r=vwkOMN&tA|OY6T*JzbYkldb5)Dyw!CA~gQd4IYy_ZmQEbpw$U}{(tesF4B<`hQT zJOlzrNUHmdeuw|Vr>Yy&@6wIS>YE<}9!V5vPIuq+`<3!s0MfJ!V%1C}^4&YT? z{_%P6P|T(jo1;3tews}OoF)NoK~rFl5hFo6anh}hG!Za~M8m}uXWYGQDCRGq>V&=b zYucs6Rd+zOd2hbY3g6#er^}wOx6^nfzcw4DPh<3XC{LVc)1U%9zO7kve8iZ|0*dGd ziISpM%r9DTTaziI;Q&ca8wc}6(CH(xx6c>Vn7 za?qLFsy+bth6k_?P```R$u!?!*Exscb7#yJFx!YUr;Z#z_vFn~COB9g{^n~AcIr*S z`7^NYEBb5g;C6knpw4a~*WHDzUKpP+X{I-Bgue@=2a10#5`j^%b3A8E)*$L>Gb(()B3B4Za=F?TgLyC1@*ih-q15YV#lwnF~ru!;28(Qt7*PPN@_VgVi zMa4#0rSzbgnt>g034_il@xag0XW+FrjgD?JFVZgq;G(M@wLK9znM^O~6L8LD+~#Fkmp7!Yd&hy7lY zVXTKhyNdc{7@{2|?SS`kvyJK}&7=Cd1?=}JW9r&ozgScgo^LqL&d01zlOkuiO@(Ix zEd?g}x6ptsD3zse{H%iHeB0HZBTy4e)CR}l{J9HRXh0*aD`Tioj`Uk1z_Ly-{P+IA zp-wPfz$fpCvP$;i0uRf=BKAPQz_gR0o?2!03y?YzenM1TL^6n`Zlg*}=7tqN38MG_ z&L1XA4(7#h@uA+c%|_P8|asliFdI!cevfGdbI`>twbJ;xf67M&(mXu%~mQ(6CP z`YdY1aGF}8Q8z7|(&Mkq<2lu9SW!eo5*LZA8cctxN^EOlXSzZloR-WGl}j?HwPXY9 z3HD6WJ!B=vQUZ!D=nad$-jH-jI@`yo3^-@B$gy5C<$bh6x85x`@t#SdB5=zJ3Y7%d z;(*SiFy#+znk{?vRAJlzbM|-G3qPKu>tP=0Gsu^{`lH(NNNyXGuUoZ!8FA)q*PRu8 zlXoMFKHoniE3?zg|G;72qpLrw@iST1YTqJR&P&v4?l3-xmG-H>Wv-n&IdYb=u~!Is zeF6PSM6H%oIQd9r;$!H-K;l&uL!S(YPjKF-!GqpQ)fP&8BE3t`&wUYC^t~HANMMOu zlEMXNp74yo=^V9AyE?<+oL7&%cd!wa&RBAv@ZR&q2xvu*ErsOG8|6R#ZrT(qtIiLP0 zxeg-&W%+h4Hlss+&*9Cd>_!_mVMXuqdq9K^6_-JH|}iSE^34~pl|MR`+zjDl^BI{4@XP~d0rjK) zSLsufTdXE$@WHSzN~gG2`-I=^<+;SB`%u6kNuzwhbQjCOFL%_4j;)mXjvYM4jFR6G z<_nDvWm_woRjz^H{S2H%$pj|~r8Q&Y1>%g-{ZrQy?ApXVw>vxXBp|;*VR`>-&S9Ez z5RqX{+p*}e*C!jLoFa@%5(UtQ^{ZH7n7gMEgAK%zk(PjRCmRa+sheVeA*{Q+{A!oa zd2_%#W^4I|%gYZ2<+QJvM4=6z@cdaf32oY2SF(!;I1v(B4-Ng?#ZuAvxsJDhttv{e2lmM00E&(TJBn#iP zU0k{!jWBU6dQR-L8c8$>B|OSoW=%3nxTu5~g>}qu?Qt67Fcr5ttLX{-bKN={~A=lVxB2Q_Ml5eW^-SJkG?x%S;KJD zmnwKHM6rA+? z^i!Pf4bTtU_ddOAno%z-Vf=f)TfAdf?Rg(<6U$XWz4z&|EWg@sw6Nn_Lu#}{(m#)! zG-_n*Y_Dx$Xw3rR4X>`HyQX057dl+e55%ac~!n+T0ZfZS^7PykcVTK$2 zSRe16T0W@afkl8}sb(^wvnu42h$ppiB`d7fa>n3$qG5ghv9^c$=rbzhp66@iQZns& zV6V9Rg}EY7sy%o0Cq4)I#Mmf5_+hkFu7-KgOmt;0jC5pW@4XkKHUZEFidUM0@Sr3W zAOx%hEqTm~CHEs;5bCR^EJSQZ2z!8W~O>`7HJhK^}CGmUaExCw*N)GlhWDPrsp2*PUv> zF8FW_+(YjoH{f-wBBJJa0=)UYSs^VAfaCw!2NJUh60}8K46$op!{cQPS#bC%@Cq#r zxX}vnYu9eKHEDXwfB1;yXUY7=ci?bp_-9B|#iXejzOoaTIBdk8?!cqSKW)P|pt9j% z8C$5>7L<3LEXwk_j#nwdA57OJLh#W5;mbeh=NB{7Ywfn0E%3r=pp>y?beRAy010I` zdiE8dUJtjip(^O}Mv1fAXv|-=`J{E>%!(F2fq38B6*4}JeaF5rg^_2u|BXd4@E7l~ zPyY+=dvqZS4SWM15cfEf);ppebR~1?H(S}AT3@QSFoBlxF!80Bv(S?gn)&o4ydkc9 zb?54AxOb+lLx|y_25bRSFybF^5TSE`VwGTg@3nyem0%2jB@e@Xevy&5+AS578jde> z^l=qW2&FwqXZa9QC&;FZ)E|^Vf0T>hM$a^S3JRjZtRO?F`QUsQs*kb z2fcGrc*dWAu^vwpg_q@qE|@toF*&B8eh^%i@0WW02?Z%!IE+&oO;ShsVE9ACRK;v5 zZa;fAu{@9g)U4Gd;?^7l1BjNsOeak>8HM^x$s%jhhE94M_C2v6TgO!1!n{51clc_V zBew}%O9W(yBTJTB1iuVQGaEidIS3(-8}^@fg-pb-d}>e;jz^dnF`g#zUcQSV&X%nt z?(&6rLOl)*e9?&Kcn!A2{xrdFIM7my2aAt3u>{Cj{qzAVIlV#rcUSVg1ZPo(8)H`; zPoP-|Y|SmYl3&LbF}sH*<}stiz0OsT4()az0VCq26(tAhm3Fk>1$;H*x<)Hh4xDtnmhgC@$)8iJR__4}C;~lM! z%XLvmh3NXGGrnrWmBuZSTk&u?zDCg?@)&&}l1nSNQ%Ha#4aE*phi^Mg{*-&Av4PL` z3qA)EzFw^b-@qX>(}l124tKVcPI&-LJwatnJ(su&{&vI2`l@mkv|7jb(Qj~;e4%~gfByKuG-LK$ zpv;*Hr{YqmhWnNdhmh!-QzW@XL2{DaOJ3xO>0vYoONa2q9WlecAH}B+H3RUbw&wLD z5zDh=MG0P0@u^=(6k((n7}W2uhlTF92QQhXe1g}OA<~wy;|g5`FI?bCv6GMk+>IDP zBRAJNDvQ@oR|XX2lhO&)UBNv*IpX;DY(#?K4qvs>%t~#h= zc!;xK7MQnPL^%@B$NngSkKX=X+Mzb;@MMbNq0mRoE+<14`IGlE@Ze$~&~LP+NQX_9>L2 zP&0|MjO`e>n1jz$aC`6Pbb^u%#8?FxhhFUCYCdlsD7*3N?C6S~$VpUM!&-k3LB*1L z__&ZD+Y5C7cn}&5g6$-3)_s;+^>R3P&G_jO!E(G9hvjOTuvfVkRSnK-+x^q&`OAvT z9Y?Lq%yWAu|7)EXjZ)M@qd6DP2P?3X>R_NEWL%@7As$7mR@gEnDOzP57lfHPQ0P9(;x?I6q8zY!=eYx zBVJec6CKiV??;V&;xz_^S*BHVr-;W+s+0KSV7b`YYj4*)^1XWeA~lVb!8is1YtS`g$j-G6=PkuH;b>VaQJ9V0kU{Zj(;p3Q04b; zjA#4@<01V2Vmz4h8^%Nb#rR9UD1&LgspkI$<2|j4{%!Hr|FZbxNlJ#9y~Uc!`aR+Lb} zoxY}HfJ%a{>`XM5)*+$|@amTy4>bui9X#<9iuOTMs*MT;RVOnTD&7c36zhdF2ZYvQ zxb*bwDh7KXU=C6sSe|y5ilDAg$lW+BW6)agDR_51>D-D`I;rH;$B+LS4gk$GQJPxt zRb}Ao0GjsAj!|&b`6Tgw#*CboP$t#sI2Gq62Gps%JS>iq{kxFRQI0$dutT z6;8~-LH1Y>PrKym)}Tj9(3$$-Cb{V~!OBqF1ppd$0k!QZsB`7hj(mBNP99!5| zLKsV~iE4gPdW^B9qLcaVXN?J+@JJiGrK8!JPz&r8w&0r{QinNv*wu(}#|uY&6teei zp?>H(4h>e;;0pfx%%loL@jwEbHWPft49B}8#!h-v8SF}hn9-jx2e5dzIxck;0sQnI zF0AITL)F^$hNSC}C>gt2p|0@c^j=fqux0zOZLE68J#Y&ad84>-hsdHQQZhqM>8$e? zBq6tK2|&#-WM(Jmqs=>S#W1XkDb-V2PDeOSj+U$*xDlUc#J;@|{LjKuXHGPDr;(6R zb1a`89;BKjCELj8Z7wI~Pi6L*Wy{YcFAz(v)DR7+vLd4Id#z ze!6VTo3WDA{C=~Bn-W&Tf6`kykrCsaId~1kFhpxVUdiNx=*o46I)A|})2VLfa%lk12 z

>qN+973NW*L;m`|~uWlx`=w#CLsDjAzxy&W78y4@!3jHuRk`m!T(JGk14UZ^@Q zLU--j<6oIMb-lh0zv69wgMOLn^|RiWXO&TM_o;e>Dw&{&dVDwv{AeQQa3_pno%@Fi&%mYMlz4?;5A9NjAy^ulMQ`)ImSvz$W;P(FSelc9j?tis-NfJKiw7gjf^P%45t*3t+&>7vFB0u z&Zyby%CtFgK7PD*1^Z!jZl`N$7WPMaa`+XG+1e*dtOmzl&Ci!UtsiZpO3 zQcJ&%;5vg1>VT#tGPMJBK!2^KOEV9BiCW(!M{zBHwWIu)! zuWgxRD{6?Ef5j`~5J?i!un&PW*RXE~GJ)^b-O`jVNAs10SMLnvwThT7JffOuH4{Z_7%+%Wg!dD%>$iu%sUwok<6p z`5dQ#x~y=N35ylrSQIPA1-cME1H%A>qhe{+YEvrylij90c5W-UX3JRC`Lq62-pD8R z@9{4sb)>XDuRr5o6#q5;1!>nQaz}cId@x(ZF^IcPYcZCAilT3LHUN4FPr{$60iezp)rL40kMLuWC{+E@)ns)gs3X8!sIh zEh21W=vz*O81k79!M<2~`n{}+GzE?p~#{DKwEa}rw=NWtW*s(%}?i53}6bB z4P0VVn{#JvyD`AX7CrG?2?{s?Xf7}LbYb4VLkNxgYxK23BaXPeh--jl<_o3c+vFD^ z3WbwmR@G#7XW(bI6QmGCys2a9{u(xt3$c)S1C2Vypz*^}3k|GQqLZH(kWe41YPo2J z6@z0nC8!bu&=vnoeu?H`Fugz{cD!fot=5*YTF{qE>K3Dlm%d`swPKX&VDV>!Fn@^l zc4wsd7XCWNsTE+dq6SCLY+!Pnh(rcONO(6Ya6QRu$v~5`aS9B)01E`HInjQJI<(Y7 zu(TT6Sg*R)NdjV)TKqPJ+wNwaQbk0|5~X*yMOA(og`)7cY8GBMgXF@X)4cNmO|8uz zEmfr`!k?)-FGKzOeCpg2i)A(`n%^lQAP6PC1fI5s$F!HxXHw!OvnDTMLm42@Yx5;m zMP-c4T#AjQR_8>LXqpeu^qUFslzbY(k z5X%W2P;A{r!0MH0M6MKH{?gyTT4I0( z5^9<#G^eDC%w5wFn+UQp&m~8d+No4OXH;0X15naEX$KH8Noy-|k-L_kDt;^$EO^yH zH~9?dx}^67zS9zayzza5eava6O(Ss8s^%<~igVa;N15#Td9*0)ZAc7H7;CvfOpwbC zG$i)zL`k}8e!a?~KTiPm0cYv3-jIiojjKV(%{vJ?;j156;q80)>UZTl6yMqwLLFre ziFnR6qX640V`U$XRAaTpl&5{QtveRCuceX&zmU^9J+_`(2l>S2q(8!K?MptvoUG(F zFww_(03Tc*Ih)=Zw(md<+k}~4E9M?&;vPYlk}^z5DCU*V8d?6$MR$q~a%~qaE6DG= z=p7E?-^o+6$Q>V7BqtKLb4u1L>>`x0m5zLark{-UmSN4(t9toFVfo>!R{&? zknQ4araxZ|^r`FbPR2f?`g>;<9LPC$cG5uk8pDe+RddUb-Z*m7=xlK#mkK^bmVP)V zSi&@e2=lcw3|h^1XgLyIgU+?h==gs6V!y>B=Xrr<&O=x6`Z0Xjl@g=xS9r%~@7MQ8 zKA)yIp0^og)bNlrQU2tzk$#PqOYg8r?8;qJ+g{sFN8Wj4^@o4SJhd-T@{PjGFA8K6 z9D?|&yI4F$NnE=G{Imj!W}o4#0M%E(Sg=Yc)6vsouUUIh{0VYu1l8$}{P>y@fEl1~ z0$}}6tHyv{%DSUtkq)nDMHJAFJ4<(31NG5^N1kN8*Z zxlm&{kT{`o!&~aje|!e8I((JS%zvzgzbX=P-dD)M4QA^sU0~wAI^uK&6{x5-g36mn zU_w6N1Q@^skWAtQl)pwjwj{cZ!MuC|UmO2uO|7xW({SI_sFkKf0fCb z5fx2-Blz8I$LU&<`4ptHIUn-!Q&$_zTZVhB-HUlj+lK(#;=y65JIwyjKjMZPS1>9!+9T6TpZ~9XT8jZ4mf;w=B9|U9F@4rZmx%avu=iBnb#A>>_kPn0O1i_H zT#ZE4&#qcEs<1C(0wK#4=EXv|?cfXQ#0WT8xN;os;#x zYRm#R^q)PjAoqEc(1flNfgt{cOOV<;3AUs`Q7WWC@TU17~UFBA{o731oK zp^d1l20eF}A02dV7uV>DzU0E&LIHHAx7dYru}$%KgG{}3ErnSQr;swK;48cRc&le8 zP!Q-;4L_A8S_}Ztt31{@^-b;O4^5NoY|{7ANuSjW)`(RdBvdW5KGT<|Fnq*xpyhj5 z;|QJpedpmzY-;Ja^3Hd4i(w;+paZkm3wg(*FAnaJvx8y0`V;d0){(G-qme2E=?$jJ z23F?>r4lrX-(!czQJCt*zY)eI{|RQh?WQF;j{8d;RX3E(Z+=f0CV7+Hu2_)l_8t9^ zT~g0~WcO`GZg|=TB)h<=4Un3LTYm>(E>OKze{0PY4-NuK8B0c!$@FY0URN6NHgDcw zTtfrX-*s`SrOLREs|@*bnXn8-%1u^CE+fw``I;RuAIY{jgx3zpP5tpLZHM6bBA=&U zi~CU-=i#pPC9W8w)^7*6P*;z(qeoJtHj4{omUAa=?BHc zw?V^k*^-Tn+n_2xh#ZtiVJ5gPDlVL069w@Uq#pz%g%~R6e)Pz5D7J7CX`3=xVNR9I zGK$b{8>NW)X<%bnk$AOv?|T;co_$gbkGcO$!`lFRH$j9`uf4?InH^{oUCp5!e@eY8 z1=@eVU#=d*T}sQvEHDZ#Vp0UII84M*+5U_p@lR7u5fBz<^LQ%^Pk=-E!6o8s5vnjw zIAa=*{-G37*(N(F)o@A2l~6E$aW%mI$WCXQt9M22C zGdZuWrb08KebJB*6RV)JH&!5iQE+i~HF;b`=;u{L3(TD-?6alW<{Y{biLY(Ssd77j z(_+?U!JeNf4Dd3UQ&ANd37?)H{h~F(iz;A+`bmj9fiBT6QW|{1nM9`;64i)0zvRl& zlC%rSmaq#@<$PG$#_zYlKhm02gCcTihsMO`M{|AD&tJcP{Nxx-$} zw#}s>;~4<@pV~Q}Y86+r-#v2_H%PSXLOzUs1X%gW~L6bx{5^a9?1TI@Hdbh^Cyr^bA)TV0otI`%|2l%HbCQ~k?9Fir)5reka0Hh z55z_P#mQu4B$ZvT{quu1@-P6`7Fbm%v#Qe1Fr3wJo@%0OGZu-qX)fEk;Nb@Qq_n*I z<(&&gHh*v%J`Iu+v@~dH{`ByhrfWZwRKH+#ls&$<(!%{VIZ--gcd2&QJ{C647ZtxI z(mXf<8x7JJw78?tKK~!?5b!TO%aGxC`Cdl0io`g1KUiueslTVBPm}{{dskdP&cQ|C zdwgFT?!Jls|7*biBH%OXw^{m|KeP1zLx7b^y#TaUrubIpi0As%MueucNW=-Eb2A?4 zfO842I%0`E{?YWJ3+RfU^*Yf>?8MJIv{F&B$}(_Oje>1PO|~%!lP<)i$DQrok#rKZ zmaM99&tRTBF&X>0V5d7R`&0hUUg=$}7$2QMoqM@x5PQ`$wzP_%`8-&l1@ZZa$E5`1 z@D*EtB)Iqyg?uU`U%7icouLDq?)s@7ARv8kpeRpo1sn>B;q2^iN(B267DZ^Ef`?SH z3E`bzy`7)r_Ptd2^e%o(9?k5K6nOb}o^)61fwc9;t2W&7bc3e0r=a0^O{->`#TojT zGm{r;_PA9I9Y+IyxKd(q8#GO$4(HCn+MJ3E$Pm_t>PS~ZE(ZZ(uzID~E zAM>r-l;XXfSWWeuR&#MeGZk(CwA7=Gl)OyCVHvQEycx;6 zuxSt)Na&kmz9O8}Pb^4>OZXG%3b&zua0RMxt$WjT(q5>Cza%8Cb>y}%GB~Ah8>Yha z_6}$FYu?R|ug>JQRd*A_lX27U9+%*n2n9{XiG{-JtC)l!y2$B@^(++U03!7zklV7M}+YqvR zZkn)Wy!T92k!a^0QfUtdU+~Z4Ia8omu))IFT3x|Cs_9%z(Gmte;KdlThjVh11M?ze$dp$Hf(uLC5A(D ztX?sFc6mQK)vvfssyqy7|DC96A$6~$rivts(y- zY8__nP4~r8y|TDeNg-@34vMyd7r^v7xSc3hLT)Pg)5hEYiXFugG#pqMvBFn|uw8}{ z_defKAVM&kvxwvWu=Z9#akbsLHqf}c1q;F5U4uIW4-P?t1^31!5F8qJcXxMp*Wm81 z`8)6TuC>?x4|eT?eKL=`W>wdGo_pNmxMySfHH%4t!l&|&3 zsySi`+piW3ZU|%FT)e&A5yb|v1z#>NfS$9jHNN|cFdU?U7D9SyZtZ|8)Yth0wlm^} zk1py3+8SNJL;h^wj>>{{rVl;ed0%}Q#zR93aetG}C3o}1hX_2*kgks1m80Z7^h>_e%VF4<#g~wTBw(k0mKa>fj zavUF2GJnE0zvuOauDmF@dBOYJv~K@@)wIt1@1`{~^Z#mEcOU)VHm!mGt7*+}gLX=U zPE6%Vpg_W{#el+URc9Js^M(|vC&21IHXif=_7U}-`rWldkX6(GTP3H0oR4S}ZMwmW zeM!N9 z%a2`7m%P0oLo|Q{^o|*`4X79mKnE!c%4!2gqq6e@EzVOaSRm`T>1O18GF)}_+i(81 zHQRn2>72pncwB=J*K8a3YzXx!fRWaL9%Ecy?vO5zRL)=cB_82%VUk7|=^w4?R*;Qg zjk*bN(~P>G^m~xw7gtJ~Z27Ot=tg3xLD#4WMkkJv?gU#dS5Tjm(LJ~L>nXxr<&{=j zfV3`y)q;$Vg+yKuNR5*v!zt~Hjh;vMs6yq6A+X~Hxgo3JTlYDYj>pg;C&|Q2H9~;{O*A+ioq;1Cs_G$%l0OoSh&XQ;5=Z3lb?h0;GRS>b zvF*)_Vuc?UDSR&&Yxk2)D7DY#)2x0a0sdcBsf8E+sZ#IBgR9gq*ojl9BZS~4b>eTM zlsBQyA9#`fhbA>!?|(O`)BpD-^)pxZMLU1nq4{-Y~V`kRN*0H+W1TC<2 z`x<+^1~Si9<9#ZlM_P~99`|B?I%^;^<@dZdDc&K08w_3>B-(m-k#L{zjy9snW#9(# zA+pqS0~*sx(RQuI8Ac)DEL$T0b`(Hy9|lANFg93 zsRXn;ZbIV_$iLH<+j;xV=>Df70z7MCxEH!P=wH;fzsa>NQJkI1jf535Tj#xg^I0YA zj`5SgA6=YQKMd;0iHJUW0)}1DhjyEaaPTsHoqpw-K?5J`rkUn3vl2m=aQ9MWZQVwW zo})RLZt-Z2RV1*MsbDmwhQ3CvPM=W&F2xP8)z`XMAY!OJSW1N{KI~)t;`gK0=D_e< zmr2c13TPylzo_kQRd>ydk>%kIO!zwf^}L2ue{*U&`YQTv^_XQs$n^T)bH08GWhPcW zRD`ggr{)|EeDW)nu3}pmIF5P7WJ8VwY4n65G}D(?8z5(x&VvL#2km%4k=CrUsxBC{ zOslnjKLa`Y9QhX3tf18+N1!Wo(o*r>mq`%kO7ty_{iV}b!RN7Hn`l(NHhpMVeh}ML zBxy_{Xy9`=6dL(@JwHB|g?KG9!Q?+hYyALl(Hfoae-^DH`u-_e<4BqjtN+uq_D1`` z^FNx_=-{Sxu@R8h2oWz^8QipXD*m@q02n^5g=TrlcBYP#!ocxLTvci&PTn zGwE_KD$_=2oB0&`Fk|P=aUu5wv^uu4dG->GD}lz-5#PNruW2nR9ebq-I9eJ-oxRfF z)G>gN#a(=G43|(%+bO=2+vp>#rJjc(2QGvMwj@C{`Ux}Y98$z&2MmE{H{uH9gDJzQF*cX1r3Ja}crBvx=Z3aA-q4X*X+2K@iH9e%6s!zzvo*TyVcwkocW3(7m4~4DUYqo zM2QuiHvHe@=Mx#uzu0ZD3}J+3}4{v>;i7D4Rmv?S11 zWT9}P0`S|SS%UDuZ*L#2%ttpI!5hEB&LPmzJ;iRhp$p>QNyUX1jOFZ}Vm_u|Sw_5D+{*8*gN!79e7 zCI)7uuQ@W$tA~eCN)YlPlLf*0i%NUwv4k44euoEZoQ@a~5KsEaa-}2LLW8^=Rn$Wj zoBLYrM#SXEvtnW}jrka~LV6WTJ%hE3Bh2piR|xru+=o^a{i53oh? zdH-E6nJda!sE7TzOe%qP1TN$t^1RSj?ly2{)rV(QA_s0!b)8AQwrhqoIM+-g9eU1f%-?nK>-S% zFN=NN$IrK;RWMh--q`e_X%s7&L@F!gH(j$r#yweq5WZi3)uxbo-62cJUNI08_;@Pq$QiWd-V}VL=sPFy?dPY@K52gRIlV1V4et7+psJwA zA5x6s|G`_gjicTClGQQ!QYw`>vhYXlE-(N66E?#a!T6DfLv|i4aWN&Ff_#FjwX*ax zB%mWVlr(V(hlu(e%}FvU7)NqcZ0CT5f6nGG5y(CN69yS;na-UpU36_PFUWZsbGrni z+YOQt*>z|1w+bix5)_4{h`gDZ$gj|puC(Q0XiDx5_jP5zD&M-NY$**=BZb@#$W*G$NZom>zwi|MNWARb)uej4SkJZK$8*^d}+;Vgu zD*RLZD&|i)16oRt1)SkWAKgk3hApT`L^N=J;{wj(^L+-oM806(_gaOyJSs78UEI8X z$~@C>3VvEhv^-Z2&7>Q9`9yafim2eX)Fx|+PZzF}y?oH26aEKyG5V4>RLf1=bpiCa zg{sJZEXJH|jon8XCrsMBu4tj_C{NmMl~r~ihi16L5dV$g>z8l)ed*P}wo+f~NB+Hz znqrOvWK@_DP0K7XGC;dqGSOk)iy=Lk&;hZ;&z(KpVE+! z(ZJSD>Kdn1zj%FUh^|=KD7IUt8 zKlfBhVC1|B`o%liaH7f($IpqkxV>7no2L@3sOGagKH-aU02_At%^<>&1x@iogD;TO z@2OYDtHkz_xBlYQIvC6&F&8j5tVHqVQLHT?VTIjACceltKugHFqiYI?NmJ|KqnVUbq#JT% z779zkd}e!JHJwkjO627WkICba0E(fsHzB1kK8a&DrrnCFUk=DE@;q(^py|5M0tpVr z9LuZiHwCiN3H8cnOdbTe2Fo6JP?r|*xtI1flwb>0vVYVoCvbkxQ!YVR@zVQEvUscg zRI?QgI4qQbcI6d%ASOUcGy%8Caj5i4<(dlD5E-S+DbFRTA0f4es+<(vVaH_R@-&|Q zj}(&$3^S?J`YXj;q}z1wSw@;^pR1!eGqk3;YA3c)9E;N;fnVi)#9P23Pk5wp@}GtH zfXR@a%1T2%%SlHD!+bO75kZ7Mt0y%|09=c9-xQJm38tBZy8O}zK;J<#)pOvDQHkE@ ze>C|MzA~nSSLxI8NUds76(L9_u}4M6tApVG?~q1&VP z6O7RQLjD(_&78fF_M1mcviaMG>p+9fy3qM4H+~bcw}vd!eQ7u3?;l?fxa7Y429kAD zncGlj=#9k|At>B^B}`7LJ1_jAXq<` zBDIP+hDQHtk5uaTxV|%Ea>e#WnL{w}j&n;>&X?_*jJDJHW$p9>`g}EniJDqY4kiwc zri8?n=u*#g4%p*^_dRa|+K0Ep37Fi z9Al$6q_G~4F^|pJ&n3q=`=@@*(OfUqhJ5Wa;kqYuaauD0GX1BCbeluIJR5_iXfq2j zR&6^Dw7;%Q44RC=ywaiOE~JO=8ZrmUEa@1>gh>HKc~X>ubVn*OuF5l+z<+}BAx~Cf zzRF-l?(n;XAv7B`Zh8oy{K`&0t!KH-_o!i|f&tA+ASY+%`%yxPHilYpG0Hel!+tO8 ztC&&>l|;*CCvzWv$qXUCq;q+sd(W)Nmzq3wtGn;Rgr}OsP9Z{1iUAaa<3Bh4L<)^? z6d+O2gu)f=V~ipvq5!ORF&{!w<0Wv~o)`4cCcq4BCrzos?-)8FVz_3qPp&+g_Xq^0 z6Zxf~)t?}M(fVGr=j}y9zyq7rPiUSKc|p4CyOc|9GSv>-X5R!CCnd*ksl?&P<44hlT(!!Yay*JXke7C?!xgwp48kBU#_nW0;E=Nl&TimxDreO~Kmi zqfInaO~rD%7=;AQY5g!Jkn@p6w$&6jTUFNj&c~%+{nUnAjj^^V+x*E7ufjEOa+FJ$ zh?5w_2iN7~gPnM8EhV2$PVL^skA@^2pn7BZSEW$~H&gNCm{b{F3^Pm^J!~hHDGAYs zPn6IvgPWvv<{kq{f>2))&T?pe<#7C*p^*hrsQh%kKr7Q|$cEj7e}BkXq3mZ2iW-UC zzw%C=zW9sN?t^3TEEwptsIA>|=qr25qTVd(TN3D}FbPMa(PWrBtHx|O59sFw+B1>% zj$)j>e2$0u1HrCW5OoaBz7Gp`TLI4pHNM`%8iy%dwDy!NW6r9?gc@R#mhg*iV4n8u zsR0W7}S?!sOewM zTCol!5D+GtfS8GDIh=w~?v5>Bj`AQqagpq{$BGS+oX70&1C`qg{QmtBF`|KaMU3t8 z=qH8F>t|JC>eiU10ud;frK-O??Vt5ZHLWJ9&U&JoTQR!}`Qld}Xi`^wH~Q$j*8|KvCr~I zM--n+=|lol!BWgHE@?B=;Fw)%SM2+VPY%w-yjQtx9=K?etX+x0JZEkTBg^kg?)VO!cg&B35vZ&jCOMBqpbkJA{u*e- z6gw*Rq#ops0u%j<;Cdz~De#MOD($@8b45!~H(=o6F=NyR0eDZ+U&NSxh8SW*s)bn;l5{-9j$QM{~EBUjfyYVpwSZbH^{XaqJMMqegymQip

#t%h)dy~ZQZ;G?}=^EiTn3b!FzwzgM zFR_T{A{*$&S4XNgpo|;3N|Ko|e;;~Rj2pE=laE%*)Kc-G=9*$Lrdlk&(rj>0?V6IY z3X?O3^y>T>`yO#WxW0Zz$p9qAc-)=u{B!o}#t~wI8Iq?`(0;?)?PMOVhkpuBX{63> zX`rgnSsxpxtOEQmeQ8Qz*#lH9Mffmqiu)N_fo>EQ*=Wb6w7KfNem=GREX)rXw{sGo>Q3Sb?+6w#K zE$_0?+_paMFvk`pJ25MO`qI+0Ry&~ zJ{tT5Y%|{EA(tF;Il>yY&eZ7#MM28rWg_v+o*iH=xxthGT(ipBk<$TuQ*0ol84;bs zNXox}?I)Cf0o!-?9Cq>q_$eBNSh%5@*rh)h#li{tupe}S+3M#})7y^$_7(xQwL)i3 z<5V>u5;gz{=q3q3z_22Ur}s6^JA1;k3YuJImLiI3%3DRS$iQ4d6dR4J5MpG|O*LA( zXdW}`eFfyl2H*tl+Z7>KOv3Ct`=4(^h-aYlS1B>dRt?_P*tH(tQq>p205$zl4YTi4 z@oNSio*hWneS(y}-&}!#x6?Z({f{2gn&`)Kly zUlu~9h?qVHW|C&lpiX>+um}T3-M)7ny?prUH~S*O`w}2MbpRgF6Jzv(RS;7mavb5P z1uyqTJCr?k@il#VSNt)%Uev@I0Jl6LW%;!NBXKD6WQ=qaRhu^s-Ah~KBebj9LKgvX zEp*iEDcaL7Q=W{`x%K;2E}LuO_EOs@1eQS*hDACkk`t~$(*%M7>;0$+${8KRLdW2? zMVGBQ0Sz&QE)zDO);qWo?lk}(PR@H)L*dbqQ%L{!aUvzFbfaUy))*;>eja?S!x0XU zZYz70^F-=3-ILaC!_y2P^tOU!-gs&9)%Vl5^mEC|_WXzfdep2NGD0CyNrg<_3f<%e zTO`>Hi%*(jNR|l|FG1?b_X>d1Ab<#dPhrt|!?~K}V&+8uoJ-EjP(awq>*V_RIdF5K`mKtRY9@ zCa9Bh-qI5gEj z$jH8?umx)0PJ;t}7-aCE?UC(+c1SHFjP;nm|#*W ze>BEMKA{zL8s(_V96Jk!i6vWckAVo5i6ILnh#|W_Vqsy5+x~pGD_?NfI0x^-^pSJs zM<6RmmoNfDYjk6CLzR9BwSTq-f991VptDfd@uPmBVeW##zG1v26|kj5lp($dZk+L> zamMhWv@(jG2*$k}`mcuUXCQ@D5^DpOZdbX0kzIt%TdFqIMqhkuv=3ypx&AYFyznyq(H#Zcq=z{Ev4S=A*Q z;*wnw(y9ZUbYlo+c5lb)fSKK466_UVW_Mv$`vl4-)2YJ^ z*!im;Bx(}Sc~B=rRb5EGe}0D&3KydpEIZEzq_0}0wYp=Ec&N*2P7^uXe@{;rRMfkM zHg0TVD^v;rl47NWWA4pK8A>UwU9e1e`}o=%Nfs zp3~;bl3~@yimunDe!#JuXJm_W$}iz&VQBnD$yr)JN}6SwWY_()K;lT`55NKTX;q_r zlMjrWz(4ad z2nYIg0XN#vRBlN;$B~n7II6D7w zHQ>B=3ax?^kGX0!=Gs>>WnhnIbK7j9tbm$otvP>l zeA1(!UL9P^ol9fi@FsrGg|Ie5&?90|b6dQT5Mxy&-<*YCH=5y>Glb2jGbE4r%^aKw zr$RUMz5ufSP7u|YA!OTqV zCec_fg^@20u|vL#%0P4{{ZI=k0nMma?k!x+ZB_A89 zDgz1WHmD5N-iDkY~v7F>rEE=O8xE?7CQ-K}wH8 z%R&kES}H7A3oOKQ`YcRQ1&qAUmhJ4IXLaCT{i%59s;g;))WcT&lDm$~{2d_tDo=JB zZkJ4n#pV_^tN_gFinMFq+lvDGC_!K!o}qo2gom1<_6P zqYM}wUVJjk+>6`CeLw0Xn#0rH0@2>V=Dq1h!gbM){bq#nVjucY1?_?VN#Hb_cs~hs zuw~!eZii&S;bS2TGMZk?l6o@v_&j#-!4}~FKjfDiU^LiJ`Sb&}A{6xmacSS(Tek<7 zZ-BTSUEwgUdYj{tOL&a?pE^2;H@J?@JRg_%9Hm?(eWy&fnLGJg9vwwc9SjujbF6h~ zU>;kCCvz^Efl!~%Ei>mMdtA>i>=;%sY#JTn#oAD#$7PZKR=PXv1p5ONhr1vl7g{O_ zy#s`)V_Eyf93VAMW{4D>2g#b849Q7u1?6Z)jTOK4xbG|m(*rfLAHpW;9L2-J3{uWJ zlR#u3)}3*cl5ZiyB(Q9E-!a;DPI5OB`CSY)gt=w#(XI+UrmNBeS%v%JnbN`zy%X; zEEw=B%sY-qQO-M<6CvHpRxar*s=<^aao4F}*em089LGYWU%s2;!P}45ulc@eO>Nc; z)b{~E0i05d<)fzcB(2`;)hHnFB>qXXbgdtUs*wphReHnO+x=%+(o_3XRm+%BqM5u$Js9NP1F- zy8g9?Oraqc`4567b@LxnvzZsw)U*s49b5KtN4}D8uf14KewLFWwdbK@5#RG8Wd~_GjFrlFi&0Nd6xX5|N6w5v{Qg+>XJS{xz zIPPl=ZD!G-&E-5-O=*WWPN_8chs%+Ox!~D`V4bOi;q7)kVFV1fc4_l+3;$YAr?V0> zj3XN$AElw^4SDApw(D~pkhZ0@C}YdWNxr(|!0+=sv1KhJ@f0#TgnY1`dikgMsXtYv zXTMd_uN#6g1Fk~wb-pc2)O@icXCN{aB*=7hmkp>yC~i9?C6HI8@J=RK=T7`sH25<& z^8Sa2W8)W&Y%z_;NG@st*fuKilUYU8fwj<@Ny`{_XeVibNnUdwd|(g%4d)WxVFvCK zkwJ?RRGBe-aaBUnl=YFI1R04@Yl^Hkr{U8`*OYo5N44*JU>`%!jOf*FS>PpKZQrPR z7IF)h2;9vq?rQ*Q7lTsY9-78paIW~!kL=|kJe!Xk&jt3RVXj_UsfMwTi=`B}`Jl&v zx*(e(oDVc^y@9sqLR4pcCdF=t)S{a1qQMYT8hC1_3e-d1MV|(Q?arbbQYlF9q@{L* zK!v0LTI!7*o!nDl@73y5v>2cvyTdE2F%ECU7$w8|!c~ik(jLiaT!}U(A?Se=AP8p5 zbCLl#A-h4}$pGY#(4a^%fHA69eq_zJKa=9){cBeKYsE(z?`w~Ky=FDa~g-|S`6}w+Vr5t-_XIrs=kVgwa zm0eD`$IK#kPOCm}gy#eD#Ad9=N9&76&lov@ziFMXN{qxVYJtr3%Lwio(~5{kqKWGexn1+DPEAvsmbQO>~`Czq0Aa-c}_wPhhe2;>TS~%X}+FZ%ALYP-c=y-B05Hc3+ux_W8ibF0?x1J=icLqB6V4eC;*gWf+>_ zRax~)Ikzb>sn{xTqQ0?&7fB)@E>r5 zUZoKf$bGM29t&sbiq5l)@92X3V)JWENG6f6e)7Ktq|U{9QjVs1U z?%m|^7Ra!sg!aFWO7T=(#>8}ZIO8=??MCK1klIznjv9Gf^iV$U=qSZ(S-O_7;RFT` z4-AE06|F%cVquO#NeBFf1kuR==)ryLztd9fefkUl@+?AadM{m)u~MiS6#EQliBgt`Y-yHXe#z1DNA51qWCfA&I*0b%cTVK$?@-QG}Rr!?_cn zO6t?m_IznLkSz$dE*>g6#{nxLwP;OzZ@>RT=VyJrw(nc?Dwa(GRO3bjKuM-8rWaWH zWI;mduq+e>-_Ae}NBEgK}XCOK(N=kGD-S#p(2f;8Uo4^_c?e{npcE+^=A0*uoUm#VQK8$ zxS=IIAgHWb@>t>bzJ3gPI6iD`i0RD8NGlhTABAC;EwheCb!m;14KwDz+StV$oIx+N zbUR|jdC;DaN^|tCT@#8EBxMB?pF)e%uyB~^m(tN z7j|h=cT%P9*Qd69MJZBqiua8Isg_55>!pXF8bDfpqG=J?N_XR%;_8ArC#{Gz4x!W7 zBFr^vKB1`w$XHNPWM4ypVGTcrxI+!e@JMVB>Jz@V)3i3|TPl2GwB!ScD4n@2tXM4o zXM)QKNIcWPtSimVLCf?uEs!e3&gWx|3RrpU16Ceu7e|}SkT5GQf49-`l=ord?C^Li zEq=OFs#F{QnI*e#^3~Spz1E)|Zl2I%hGQ!Xjws7XO8r>|R80#Y0$Om;d;H;lrkPD* zO3ET5$x4x8VAtY8E-M~;-J&v8fvN0pUJO9nqn`sWF!kY1MF%B+c_*Go@ctaz!EfwH zx93X3>H-!V&x8vrnxD!`yz|?wW^iq=TYltLqt@pA!CsSbVxDW}5tmJw0(zKV%pS=0 zE4^ycl;NXXlV+R>&_o2{701DH{h;pQkiYD~%!TO}r^dDC8CZHlDI;8sEjnsK8R81? z3R!h$D0bwI`5`Nt#P~`jq_)Zu7jdM`&gjCccj{$%=EVi&{4Iw)*qe|L(UW>G3Y1F+ z-~gs{O&JI?q0d#Vv)_aUgRxYJ+JTC+)$=dQIGWXs>&o?G+rb%o7M4xDqvDq%k+8x@ zt#`k;bEcOu(;26iuOE1H#>z`pHOdQ3aogB(#)ii8(%{*{{FxA2Xby9-UScr)-*zt0 zR@eni#z-KGM_g3mB~=I|EV1*2V`S^`-IRanMBX+rhta?e9nA`pkz|2hEp@Q%OF`(C!m8_srR-{p_BLJ)Fu41bo^ z?U{QhEbP+U-I+6noAmYbmHWf(M6cg7E|UZj<=B$rLgo<$?X&<1Z=}zHmkTH zx&@)(^GJnxXBh7gsaPElX1`sQwJpE{tMr!jDYDmw(v@$UMf(*Jz`AHuJN=U5Nd|cv zil*Jkx9_r=f$0DBT;q$^Kzy$go}S{g;!l?^b#XpG8vdio5(pGUu-BMkg)EsDU)EIv zOT1i%0VC=5zNd>xXwiq*t*dt1n$*JmFtUQi?e!tVWZl*LdoPY_S!OHRoy}(5`f8qG z&AM~EI*7%23w1#w9jFk{=S+lF_MmO#3!M1G#=2WSk-Qc&^w_G*}85(R<|mawIk8jRKK|d8R;+ zY{k@d}M=_K;v8VOuF-%xZZq*JI1@1*@ZvMuYfHnsQGR zXC0+-C;jzYIu#su>^D-!kDHRoWfhSTQ5KC6+njQR@FFpzy25KVzpERg{7mlNR3@ta^eW|1k}?Q^U8(YR&QfyF=1%K! zwNLrCQud3R88|r}Ua%3)Rc|D%Kj40^Xrd@-iaDr&HCIIauj@FXk(~7;+HisLPbmV( zz7U!KC?==P&d1VdJ?6ESGG)~fm29hiTIYjiF=J6u7PgnW{U6ma^60~qLw8|~cATpQ z7g{s@qch9G(UDdk%EO$3;5tO7SX};C+E&ObZUuZ71ZCy;_?BY1m1JuUkOaVJf7d|3|a>n7%9wj__ z0|bkw;a`H)YK%Gigco0tq|P>B>asQ+lE%CODtWc%T-WshYM@V{Wu;>FZFk3jE#kv)YSR^N zYm=o_KIWf@8k-2uXerq1S65N8Uo-_qQw4a7oqaIu z@boYf+la$MAdva9buD)i@)RZn41Dk!zcaD&xR0LeWglQgxs#&D)eQh@8^-puqBUlA zJ)d5GTk7lxj7}f6dvcw6w$0lh72lDx@;IsLH<_`P+5 z{gPWn;2>7Z-i9-r+sJRWUztW^NZeyi5G7#6Q_V3%Gu^}T^azO7<6wnJNk!yFy(E63 ze&3uCWDR&%rc8GGd1%i_Egamim)dRlthY1dF;IFcNJEPzqtf?sdUzM6pLuxaP7B^w z0!1@}7F7YJz&g=J?M#;zGc4_;2JQL7pU$+$zv)i){daXMa9-5a5s`t5@U>c(C)$WU zmL=G$$G$L<>PPgmbYi8(_0{GjTvTUS;Y{Vj9m)r6T2L{0ma$S;hv0VQTxD$m*-yAs zRfs*4HrgSEIV%KZ;28r2Zj7TGdR3#$Vs*Y%R8#UCP#H|bLguXIGD#BU;K}VKK$#$= z922o94+xDr9|GTFzNhHjaI3*C9zfmjiMsxPAXf?{UMj?;Tr%-kZq#%3h+CQU@1z%n zt5SYZK-S*z^lpx_?d&P6e|i+T0Uci58GE%K(!)C+$LcF~2zZa=;lUK?D3#y|+9;+M z+1r$XFxdfkY95HzbIF=&=oY~y>Y{a2FGY^vX^1Ps912M-~W zK#7<%7i~;Iz3Ew;zmL05VC!)?bMimdW3ea3lzvDGeU110_MojAhdhRj@KVuVLYx73 z7v8!el_KIqap^?-Ju_(a$&!U|^a9+VKjz@;OK>%p+|?mr*!6p8zBn)G5+bP3 z1RV@&*oidq&OZ;TO76N=-M5n4MY&ZpV;PprInO)UArj2)h0=yIsJAbM_6JdI^uT5X zUH3w-e|HB$n~^C+RJXUNcaEzUNi#qA)DIh1DbK0p6ku{Dkjknydw5nrL+wmFG@s@F zp4W-NS;E;WptBC}9bV~n(lf@S0pSye1ooXiHmk_61on+W6t+-ePN_A1gUu}#_g7AS zRCbuyT%g->5&MUZ#j945+`_AC`?ZdjW%4W^KsvTsx%*+C>mxzAyZw{#@wc}yJD4py zBDXa5C#8B-A5euRfCQ?W3^bt$U;|QcnuF0+zd9jF`(go9oJ1tlW8K;`@uQbuv{l79 zTL3e(=~HRVRfam5=}jpq2i*1#9o~pOh+dOMClTvul^@Kfa%i=2pt2kU58(tyUfr?k zMRE7Sv}6o5Nu-g{Sp4jo9z=&4|1J{jWH<$7@~JTlAiHur98irG_y=DUgJ!hA(Pc2`T?@cXm~i=E zNpq$(1?Tx|Joe|$^xcTCkcgDZ2^utzk~V+<7GE}`3^5mEs}0^3x^{GR_amgz+_kZ0 zoJ;UO=f?`p1%+8A$%ag^w`5x^klc6=da1BZz1ksh0HKste{%FhAHPVXbP!IZW{0=s5&^Og;G)!uQNi8xmS7hi~Sg3?AQO(mqW1lOtGsvrGF3{ z!)D=R7jXQ@gH}QgKGFC&qiX$zvG3=E%-E4cf~&t67FgkOH|$GKgw)Eq1}MWFfmN05+U0} zc$vj|0k;dSS(eZ>4Sm+OA@A}9rPlez2Qt@4p(1p0kK!SL3KJZPpA26tNaRchoBSLR zU6yosbUXcX4uiv{cP@ktHu(UP+mGd!8MTv84;ND*+{0X!eNT%aQ5`*^Ij{7P?;;Ab z#FqU%h)_P?k)*3?D6Pq-n?K;DxJ@99W_fEQesp6xV>E-7c|SD@T5tFPjQx1=Nv(0R zbMN@gZHLbm=&=ySPLinkhhFC8y$`zI4#hk6@f8Qrd*1c-ZZc4lFj55Z8Z{pgpz&=2bq;*xGz>xl3U+6kC6TW$Mfa0|!fbdXbTt3J6GstGbl}i4_x5CBC#UMrADG`p1lpxgrJmGPj+dP%*EAdSTKpAX z3o|AsKdh0-q*9p{d&+$4`c4DS$1Khfhis4Ut*R!oFH%!U3`wiBb36KQ;gYo|N%m9* zup$|EUZ~u6A+rxoGFr_!e*7A_+fiWLmq~GRsXH3-?%mZYKzMie~W}hw- z_aOGaEugX8E#CJVn0e4mkK#3$W3Ct8rc}zKuA%oagOd6{aV#l*Xtko&%SWdvPy3w2 zQS}CZ>yZf@duwI0AvuXO^AkjS%r=;eEq;l5L7PGoyVR0(#>z8(Z?4@Soq=ik$+;?Jk&LJK50ICF}(zFF;-(Y3La zeCCLBmwwHw2z!~kI|3OYZGU(%Z6Q-h)Blg9_(B9N^}!evWdel(_PsfJ7AiP| zN$<2o9xN(G?7gu^*-3{eb|1o)3Vh`OXo`n8!&u+62{9QV5${BP4W+sr*7`x{mP)$+ zA)#R)Pa{ewq5Kc%SVrzmibgBXgC^l(+T5NhG&qA!UXFdcS(|?qZ{HR=norHrx8zs_ zY$`^7J)cqC+@)dxu9@zpA=s7RAmLNhs9%5M3uqdZK|0By>{I{be+Bgw|9k+{ooj_& z1tUG04&ONhbg$6FhRAZzP&(~=Ek1ZjCAmYmfhMU(`RqnWuU2Q#slj#@ua>7j>3 z)NQm~v0U+u39yr0ss()8hf(kx%dtOo{f0(up+6vn1b%VAf&q5RGwuT^;W*GKF}=t?N=8!WDWsA#`Qvmx*=BCUSX1Bg9GkHRypn;$gC*Cx#_gT z2G;+sl$bOIo~`z5LjIx$?Cq`wXKKHZIfYwYB2%0|r}yGH3x!SMf1MWwfG%MYKB*AE zkSFR5b3B8(4FDg2Bqva^)fwFbeH}8Wh516gDS?VYjg({eQmbr)at?g6--MLj_Ypa= zj0+4?UOKwcx^z9YY)dTJRUs^sQ^GF0(qQ{UlhuF0)LC_vzz}c^bC*D|9l9c($qc0; zSy0QQ$HlitEnOJV&qlPPN}yW1SIWSZDgh4XpHjAd|FOsgwlla;e%f&OhOMYrRh%Gj zE)gw-IR21?hp@+Vm&1}2GA5jNa~Kl6bDo8i{)VIYqm`A!f>SLG@_ei{Bg*+}h%KX0 zG}Wp~@SniaxV1lQ>_>0K3W}3?jE%_)yy|T4TL>*(b>>;xuHyUqv-r}f_w^E_Y>||{ zxmRx;PL`2h%ow9?-AEBdd#vR}a?_Wkhw}ChMv(kSbII~lX#mpIr}y%L@ZkGWcmL`H zgvY9au=xvPr}O6@;Zb_PZ^>c7q`HbujU*S(Vq@uEODbl0q;6RRmK6dEZ5EZhYis-~ z$D#k3G2#mYsG#oLKqA5b90dLq**Tb7{G~XMzA*UveGd9544{y`v~b`{pg z7BS={#^+lz0D#Dh0R(t08LH@bLKBZ2RCRsq>+?0_sR~r?Xf$(kmd9@lG-OGY4F6ywz|i-BrD{rf270@~OP`Ka>`qv&%c{VGx~JXy^;v?)^`>Aj>= zSTT2&g|sHN;>!nhLjq8I6d4C;?83-f=}&~GNKQ)OUXje})Q}qgAA5KG6m`S@dt6`v zX{Eb6q`SMNyE~L_iItWTkXX7)y1P@lLAtxU;VfR)eV^}~Ip-fZ<1hQ;jxf#u`~JM1 zkBT_e-!gKRwU=q6?;^|fsz#nFnV|y z{=hpcglAz`!+5IobJ!xsE+x{<`mxWOVYTmYy;bTXyLknQ<(c}w9;l&)O~`tg%y)83 zg(9Ih8;NkfO?O?dQ02Rf$tY?j7JXw`gg|?phqfs&^?oD0&Q)qb{zv4OoNR}5^cLRe z=8fd;#^@HY?0kZ*Wok3@=V9{r^yRPNEkwY=xretK4&bL6u4PZoN|dhCTaSJZ2mcZ* z$Km#YstCoG*ha+!9=I9B+9Me~6BX6hE5nkuE+pBb*ZP6_8xSjYO8TB%SmFCx$8Xxk>e7jgct8bk z0Pc(#MekdwF)}p&8J45Wz@|_#gLD^R_PTJVIyrwX@)wvJ@vBug2Cfcm-QYngVteNk zy2*#h=Fb;h6=5d|8xNDW&up!N-hMavwfR{_C&HYbw?Ewjxj+rd66;$12aAkZ`Qg3Y zkU¨m+Qf#(#=*QQ_Ak@v~Yp)eeHk-Zb$S|^h^vslQx3%Nx)}P2T(c*l(B)v zrWbEiN)RxkA+$~@`G(nX*G>ZMii~u9K=iXU>z+Y+5Svu~>QhE`!`j~7Qb^lZ=YviS z!$zemtc)*>Hf>NyZYFuiRoGXT#|O?&ZiKYX{qf?`UOC-EWAo??^S6RJLRyOu-Yn*`yXOL{!6;I30l_nxtpB~oOZ2EK z9Z&Y0_(D2nk}u?$$~2ONwWoL({tVl@2hKE9innp8rECw2ZlBIxPQ2l)mC{hWoB6pMRPfo_OLzA!Igl$SyKMXjV&Y)Xa)DH>sDP5_u#WYiF#QZ?a>T<*j%vVD5Lzj(LE72l zeiA^t5z78v^!(pFDLtW?;DnNEAI0wze}GdEbkW`eyv+nd}0cxEHZ zLs6sw7r%+cGCW_jiE%ZR=^?nY|1mD5Eob%Kv0(Mu08;U7a4#U}NA`W<)89D5jhrRg zc5m5=!o+formpgcjMV?6z^R&S7%n|3yly}#-Vx9u)2kp%Au_n?9tv9@?c2Tps=a-y|}0_{^kAwo!kZYZE=@!TkvJ#Zfi+gx*O zlug&IdRM8?Zx%wI#S=Qb!0l z83!!2#U@FUFvqLi&z>ox)cgmxOBsD*YM*Up zja>VM+3Q{q^Ef{kg!BnK4dC3eUI|?OnR%&$-&6{dc~+AD>$I9zJrQ1{%hY7E$6fXK zO(0x|8AOio=^GFv75FTw6YI*v5ler8F$xj17ce(sgdtZ!B}VIuvj@oU&;V&dP@5>` z{95=3MdN-ag~nw#%?QB3|FKpEdDTtH4TYXgI?t|+BoZzd>(aj!@XMTO|EjHE_|f@n zf9LO6^zT{p?^*QkS@iE&^zT{p?^*QkS@iE&^zT{p?^*QkS@iE&^zT{p?^*QkS@iE& z^zT{p?^*QkS@iE&^zT{p?^*QkS@iE&^zT{p?^*QkS@i$+vuJvP2$Z%Agw$(OS6 zOVjSQwv_+y2JZ2H$91iw%+3S(Kbgdq5EN9<>v_|-5w0)=)<*X#JqO^A^llmr(=s(xR zVr90ammDaB%4ApvVrcoTHkVzC1!rQr?Y8e6l)iD|ODf2-El#RRb%P za*PDr;dNtnfqn}t20zAli-tG#nbn#EcSe{f({aTJ>d>xqhkCyEy}na^b|fn*&~B1U z&x?`c@Ihn_Vnlh6MfKg$>Vi+c%>g*{Ph1O+#It<>=@G0P!BQk!K}bgIR78nsi#U#K zPzYUqnQ7wtK3t%2w^+7PK0rq*+cT0lj+N6tbIupu0Y_)*(AqOW39rSETIJVJJ z1lx0w;Eb^b-J{s()Mg%ssQu)J`#V(Hb7rauW}Eo6?HeicMRkH8_L8dgeoB3Hco3@X z-5m9d4%sV$SFHMr*(wq%|FEXEgr8C{5!ayQd3x&cK3}8ITwIajf|;R?=|!s}&fgk| z-zw=;42Z1Qm`(eXlet*<$)y-EijaA>Sp7-6vNtEK{qY9b`#cp!nk@;V<%PgI)=Cab zPVpUz;xJh}4m}>sjH>yweN1J6pTL|Rz7+`TqJ&xAsRh1HJOaB<^@ZiJ#f#Swk z`?ULF5qT=AZ4TzHa9~^5lr&UwJ(>|NrMpqcxSw$r8Uh!-$>B4MdW4Pil=C8tX|ix@ z*AZX*R73JFE((evOdm9&LYoBX-pk@d%%+qNuC3Ls0(ibWEaNy`0!T=KEioH?4a!)c zA)psauM!JPtcjm3_IIP~$Vhj~#0rxo_;727zzzuvd<~gWNO3$lQy%?KPnBFzCh~^6 zWkgtSt$!cCq_@}|Mc_%!JPRV=n{Xx$-E@C6N8}3Wb2Z1>LC6I2BHBe15g%M1*Pc%7 zFc_`%+%-HuZ@j~n`!S6A9`6AFXLAzax_fuVS@mCeT z8}6}t;#>W@ERd!zfDq_lerT@!F(6S)91BBF)mdr0B{#tE<@UkJ}L?n};a zZ~Wlqkeb$P)ZR=Cx&t;xGzAD8FkAL6%h>fqIj1q+>Y2-Ks3UcOF61 z@Ji;v=KTP2y_$JHR;s~f-m*Z4>%%EdTv^qWRNdiSTHa0bb8JGtEqy6Xxezo5Vm3!e zvGHNdq3w#Qp2pZ{JvsOZsUNrOu~#yG{EDS#Pss>FZuqqk7TBQv+4^`C+N`xM{<-E6(+EdK2fB3V5%YpJUj# zR1*i@t2(VA_rC5`MZ0bAQ3?l(nN|%P;XbbPupZYV_qlMDc9mU*C(}$_5`3dj3I^76 zc}dJBu+%{m*16Xcu7cMJOtVs9{}oj%UJy^p%@<3gme8m8^>b$w=)(}XOoxrR zD)6vr9}^b^y=~3=!vo20ib5qFo*kfUg&cZ{~mIs@Sh{RVKXF zjfu?p)}IJ+itoP$32LoZ$U$?Cdhv%&Rg;8HteI3xyvH{DpsOY$7wlk@8@Kj`#X*c8 zyjGPjf#$ZK+I8h0sEPY2r(_PzT{qF|7{GG238yup%(qFR<2tbMmW%<&tLi8&d!QUh zME{>^u&be5VH9qRy)Un-*|J*1ucH|yyjI(D*rAm4IEHa9s@U6#z*@jnGO5Cnhhu#- z#X|zC2j{?)3jW^tvTdZ}uRvT$k&e5oyp3QpLEDt|UYdVj^slU@xD#H-s-DQ;Xz=Gh z(O_T~xEkEGqWHOj?3s>Vby($1h(?i*ljXE*S~GgG`#CCTw!XPH2Gq8*DXwxNo;=S4 zX7l)7*}QC)kPT_@RhIYPv8vqv7^`k1_0Pmc%p~dbCB(=k_YZ2m(bjt^_=Gy0m0OHM zkf6h1-s&iC$)4Ufgi%Y&q1^_{H=$X0`2N3fVi4av6cNzJUnic$srR)(3@7yFwL!dr zTv8|r-l;x-cdFiw3i3kZ`XsZV$Wd>^)e5-5s-86Xf9*H0s)ucelY)+EtNkOEBUSiK zFZGy^N0tc)lp*x{jnGL4vi3vAExsAYMrXb#`#kFGZ9++IrJ>r=W(H~#6;ix`8}TKT zyr&CLo8g0Ovn{W$nIhC09Zv#*japKEoKZ8hF-Lo08Y61duFanWakSaOW-T~DyfH#~ z{CRz3yTpAm;RndK+be{R2-EI~y^MM8#LaDXhsjxNEXM8SE|PQj;Z2eOq@{rSm{;rl z<`r@`?qJgf|OuqhR*cNrew&R7`d&RK1fExyx zVpc%k`~Gd`jZmcVua(Un5s3+d)ECPq>bCK|Q%(b?hlHe3e)22(2!|ojr}0pT*|Bu2 zgq+jk{cF5KfhInj?LVyEImHW{`btFggTMQtl&l@WRb(Eq#vRGYubp%ns$86Ex_~t% zQQ^sAlhZ+M7$SAn+a1AK7WcaNj)xjVpEGlNkEhcE(2gm99?c+he>}tH$a(YlktgMP zpCjSA4@7AO(1J*=`)URdhCpNnXL4V3{g4dTuEjya<^UzAb=HYDxbRzpx4~~%=heS zlzeV$Gtmd-VxR{5i@(#vgMlzL|FA$zXiPDmT@Lu%S%mZtrWDp9UJzuh0<*l*8u~1Fs^si3#iCL}d}N37c}EDugAwTFO!QFF)#6 zhEnc6sa|i{Gxgb`ZKYOPNcqvVxiv|cV8yqE(PRKg+?_(DTBdn)DR9Z6ZL96` zObnNL)>~7vTE-_vl;kqtgenjnaf61W(Fiw-+)V5aZP%A;Uu`2iRfR!gsf%gE=QPK`K=%^AhrRFs)GR^{v|zfS55Q%V<7=NHqiq_l9*9TFOeyF)1_-(Mp5U(VNVS ztjz?_3o<_5L&$O5W>_$93?{p+;nBU35&_9e;*KOvTbOm2YA6Bx!7X=^q1J-u>2l*kwHsJjG@~1 z6P4-GEFCRc4?&*L%*^V01T#NHBCpK>Y2b`*||v9z0!?V@i03RsK}p z1HCWl8Q$o!A0b#T2msXemZ-q+HH>l9d>zjAppQ#khnb;CFiJOcXn_?Sk3h}tV{8L2 z7yVzIvu2Bvs`e+|%Qg8*d0eY!@2hDIZmAzYDqCt9@G*Qnm9N`~=U$BkptQLt(e?5GgI=ZlH@DNO^{~nXp(w&G5cFq#P z&Y5B8x~ynAg#a*6*x-ub=``(Bri&TDn9t(-&d^!PoJ&{=s9+JpJM{aqjs6%3FnvQ2sNB&#ic%h%&kM2eCB6%=FjIm;l366ZVr} z9yL7YiP}Vd@r5F91s10Cv`s5dwx+B(jNwvC*Opv7JuP!6;?~Zwxt!$~fyu{%j1Jq)jtEQB(6UiY!v%{JSx12X730|A=He3cS1i@5#$t z+Lz0Y-nPDqWbLdF_&)s2EQ2C2&REsq$4{2}Vi%-ISY<2C340|Z-w~=G*=$zi*y%z9 z0)X$l=|k}v3O%AKF8Q(g%tk<$l1B>eBWQaehoLKpo#QYejm+HsFgpqEH^x zn!zhJ>twsL&KO))JSCPz=vupTOBx89M$!cTZteSH+bu!wq zR?bsFf;C%C26nBb*WMtf82~r1?f(@gm9*Qy>~+k{hXzjwQ*HiC2t!|avFndQ);KIZ z?=$&ERzr8oOTSvB%|1}nj=>%8!i@(A;Lv^a|9sK&D3)8o{Bt@+!R+7B)%t}=BZb- zGsTrmP)!ncYkkzl#$q6|#eE-+HD+9oX8;pfNK%ePEDdGN!V1MsYwgD!8Usf`)#|Z0 z_O)DS-b;hh^7uXM+7@nTb&Hg5ZWo1jU0)6YX>{~VGN&yiVQ``+3_38aF#5Bn@FZas z_2C23Tqk@I=xjn{(Ym{&_h&6`Z^5&5Q>t11m%Y^f{%hiWhL0RF)1}|zi6D9_IiI}= z#cY3PYPu1PmFm?nwRVewCxm83jp7%}Ukf7WpA|`PS&jt;@d~Y*C_b-XJ|mkhVpCJC za6As}!)EHJidqQd-a~GKCw!{5h>20PUi`ASJDMa0F?}Xmat*HSH%nC z|Neqg8bX5^0BN&i%)zbweW6i^rkB;7wZi7dl9APDxnw70`U%C*12|5~7k>x>I0A@) zXoLxqUwNpj3M+()U|ef5x+w1?)QJ7P^UKo$TDkpq$bUNhsC;<8z#wOqRI!jr?F;S$ zPju`~zVUHs&EvimoVP>?)0_L&gpU&#hju+BgL7m2i!5;4X(%kvG5(7KcJ06W!E*3^ zkag*qE@fkHzCL?e(E%oh_2kPkaK?(Du_jzNIpsU+Bb9FI<{D@&emQ-?^h$32oNb9` zN2XVhuZxc92uE{4KF9A^#J`O%7GpNHR9$bSJo-k+QYQ(!TznXxd{yJ!BDRV zCA*-y{@X`vXtGpcoc2(&I*V=LUy54TAC6sNPI>iioGJvj>OOL%t((j;0=3NZ)(}8w zD=KwvPo&!;0-tGE&rx*8!ud2le9~{8rMEq12CX)a0@q3Cp!7BCDF|pp{_M!E2Y$@feDDr=MPpjh-+L zHVNh>LobJJ)4L@Da}$(#vqK&2t-0JHVsf0$E8FweqRmMvYjoydFJW%*)$r6?h8v8s zXtkzO8W7TWUyG^9&QhU$IcE!RWN}^ms9BK)zTbp-<=xmP0gZSc&eq?+4_bAMjX&c` z@w$Cm2=TsI{83(LC7sY~TmE}=F6j7t;$YeddA+?aaoG)lVNcG2y|lY^gO~JSI{mZ9 z$4!|%IuyVT_2iP;Pd?d8vv*7w+z6q$;qxK(MPw5Ga|GgLS0H_=(lk{5H5}?CG{W9T zGm?~#vu5x?!oU{jwiMNms*fMR&D2_OGc~S2ijpcS4yOpsbph8(Sc5X`#`TGueD#Vn zwImB}c)R~fjXg}t?xBmsw}q4Oe6Vi)V>$h7FmJyy zbmbM!RDcJObK|b|MaX{!k(b~>WaytkBpP@S2~3L^ZRFeP=nGKQfA}|=db~vS8cmgX zjiwSit>jvY1Q&y&sj#{*%{>1`Q>7}0|B0sZj0%9GshtMfO-2S$p2xp-E+@QE%js$> z;qgM?M&kt(0cUR)rgaAjeN)R25%qdx&=7V;LJwqog5uFk z`$!_V`)24|4FB0s%~n$;fDkJ_qIn#%GusaSCLTl_1jUHu<+m8jWBzzC!?EX_x@khV z=gvnielh~`Tm;|(k*5#6W6!w2d+LW=6!%%`2fG#5!%fjmA}$I9 zZyvyD)M?zdy=>F9pAI{Gi&)*Ize-DCz*%t0ktQ>KZ3#{NlJ`JKoN1D z`KEophc)@=*}r@FK>ai3Qs8yd*!i2b6})MDqQLw&ZWK12 zCN1iL)=jjyu0)rnSb`XJ?{;`J_N8>`JW?OTFJm28D>Bmil{RP1=G}KE+3Q#iO{_2E}gDw2aZ{(n8S)IPfd3^51wApti z?zrl0X+d$})QFpG$ec(f%->z%H_G3>(d#kaVj3nB)o^&fFsjA}3G0q;jv@5rQm%Bm z9LDt--gRV1qitmGY5E|gYum~UC74Mu;G~#<5<&JQQr@kQ z%sRQw!K7`b*;gc|l<`Xf?lffb;5DLpy`IT}m^N_kRuD&_I`Z2$I+Qt;WUZHbzG7is z=uudLQMA&uWyUj&DBH4AwFFz;Ck(lQG`j`6_D=o^#o#0Ct4G3pXKw^0(bpyCl)cDF z)r*dLX!0{b(Wd;UYi|26_N=^qo<}Nrz9I?ha^?;;Wm<7{XGqe3dupiBLmJ3S9k2(~ zykP0t4}&FJSg3&AL`4seOcs`lGZZfZ~KRR8#ZZcIikDf8RUpJXce>Rz4{@G-P z7ZAKeP#bjvi1}X!|!E_x<^n5K@}TN*GK~Yja+m2 z;-uxL6>CAX#j;SkeG4o>U26KV1J*ouUo}taXYKJGx46~K?zdw5bOr7FUxjmQKP5a0 z+A^xDGOE@m;ZOm^H^_0R#<@az`;%EdKJQv7um?dFR96+YTgs8@2SbZHwAGHy0Bb76 z-GNzBX_n^Q;7ums`JYWD7Zzf3q-*>Qc#~Pam>@iWTLyfS5sW)kZ8%=|PKx{TeY~&U zOi=t-TX~nu!5~7ZfnH2|j4kYs=LEi1}Y4m4r1b2{2!boDpRabG|3YE9g_iYNO|x|XqJhI2{L#*aCVA2tG*h7PTAO-mpc zD3hjr3rbA|VDrB#$@;yD$n?`KZ-4B)mn5CKZB+fLp_dc=@H&h+YzDa1g0rPaDR#AER=ApCX!Gw@G)Hr5V0Yn#^?16UguyOBZ6Uah4uAfr2$9Nt(l zAL3Pzl-p-f3r8CjmWJMzynTpmoK%XI;*duhW$rV7$K9Ebzl~Y|%r>?}XUY0$l`Abv z8O|jdDjmY4?iNd|?&yd>7mgFZ8~RgPNa^TXE&axs*?L<3nckJRQM_j?bt%C=dt*?VjZSJ6t58v$= z2kL9S>4g1x(KxY#)MKyz3=XuB@6}EQz5mdGb!yYsg^G2#n_vnLZr45+4-UQ#G7%XM zBKhXOxH4`Upep=lk=bX8Hyd0p(0xTxih_LLKdA0XFPd*}P3^}0s8o8bx0{M9)7H~^ zV6BJ?yaEMb0@8skf}VYdxaG?5#G$?NY_?erXc5U8ZFd;=`-e^l1|bq%cLG+fgG`Pg zyeD|Yrq`y16n-3R5YMPrXKw~^;0L&qqhPhZd}$<8&t`9ULw>9B+L1lO{$%uE1HKIU z>wPjwDPdGp(bB)lUUc{BLboxAD7npsC3)@0&Y)EX0@?pP4Zc%NDyY_PkGI2)Xli0A#j|WqYf`!q-Ad@tUw3*z8PHq&UlhdTd&F zlujCa2CWrDUK_KFDE1jCez?U&I@F49MogZXlnPoNv*wvm0GR6|GucrNwd)-3u=D8x*(oKTArbN}F^WNu- zlU;5^KJ5I@r)6%1egAY}KZ3ikBDAoRxXU>n0d$UE#|h;3EReR;35rb2zB)%XnAdF2 zDzi~u0k+%Rc4JQ1#MU$C#va;CB3Z)r!fD{wA*OYW6OFW3%kx++f|J9=ff)MU`=!DE z)?zy`e<=neDm|mk#Myvru?rg;s{1F3=AYr(iE^-jDI>oV!yet1Yx!-OJtsPC3qDp> zZkT`O?;GtMcBT>?WMd>Md;r&Cg$o@TG^}_iY)vtDGdowr_j7!u7eknk(DVT)YR=~$qzcX?#~<3 zvyM7wukb=-l&n4q!#g%@@JstJN#&vp;dU;1KI!}DsnyMpnY zJK&Qp(dnSo^$ASujt6863}y+D*)sHLeWo-fNcRqk1;P;&c?X3J!3rw4gQ9-#APtVR zlb?N}K3Mo#7ov2Z1X{a;;(PQ-KH7X2&sL# z>fSy;!9idKvs0S~wPpS`mVDIsQjnDY2DME6X}gZ<5y~6_xN>q_I%>50EraUh`GUwU z=>~$W4KU_)nsMiK)qg3Brk!R zm3}Wu_pKf7N=}IQGNsg9KcwWZum3*=z*X&xiubJ8PJf-&6 za5oZy?}6DEP^FoIj7-vNOVdZ3zr9^OScVJ?B&bI=WuMWCTk))JV9)BKZ)b{PfvGiUptQ_fkaSs?#Ge zTURs5EI+?7#*&p2-Zt-yfbx=j4tddQq%z+vqV4Zi6AL!EW1f$-=DWtY$9zEzx=}DTYaqQs05&-RvL>;!ko^&cb!4csxRk;re@rbC#g~_ zqR41Hp{IXMS-w4dO<87I-*6>PQPXF!O31q=GY=8la%}{$+H$SPB>0wV!(vb^MPtdU z&9XIZyZs>wxBd`?B4DEMG*$bDVdS32itF^6iM0X(@EQDNw09nbSyqCL!Y_?4$44V0#etF~Rx1GvQMAlqa9;C3;f0;0@X70M%6!>f2X8Y^7xu^fTcu#wp@5 zq;o$d^RPybi!pLsk@a*JF}`iilh1&uGfN7HoJ=2*R=T?v`ug%kcF(HylEUfWH`JOf zwV-$v*Vpdh0l}JlCS8s1;XSYpYy}nh=I#zFeb8SZ)H^Va+C^?iagom$Eu*`z`7+s| zc)Frn?GWK?%nhv$>MID3*i%k-{-A~Hza)DaB7y&)g-u~uZBwM?S8g)?g=+jz!7 zMtK)(hV_9eRFz_jZ?uDC_lVA-RO{0eEHZx&&i@) z?$s<5zyzCx(aOL-Xdz}8lssP`5-~ztFkHjz>DvLJL~Iq$7Ikk<4I|Q)<%?;`unv)N z<&b!pYSrb~T*tFLO*p`Os-4q9 zv@FzN>9VAaCZw~?9gB}w*AK}99r-^$NEn!GwT2x z%WSLLfdqI!LX?AypaHVDvw(*zG5#xz?(vvws%od?6GLtD!4DTlmv*3DXaF%>fg-0O~Y2ecaM%-S*iteM!7QPQ|yIskq$!rsk5Bo(RCKvz{ z#3jfG20#F01!oc4(R)Ba0A;Mbob~4 zEep*VqWT3tN%4O2I;)+RRdlksL`hJmy-|uUN%A@`Tq<>Q=`1!4)-U1kSi5bYjak3t z2LJs1-ckITMf6|rF@bealZVG%6B)HHz{!*1|tOP^e*|C$sv?TTFaJB#!!C*#6ef5>gzEI!S085K5`Y=6gx`P5^dt`~AIB zVGAYrUpcdqah4;EgJ)AXYovnYajY4qA(R(u%%`v zpl@d{`o~gpi}@uqtElL#A5bsP@*hgg3{0v0=^KuwyN%JvaJG;0#Uu+lH6;eb2_SB5S#3Ie)v9^!nhYXpMIJ`HGwvV(Z(8>jfCoALi(BA zrqGB0gkX;DEsvY+=!ls+N0`E*ri$^0DWigdxOh!m!^qDET#EX!@Ek z{7i*5;V#`@C*;f6y2Z-~v>x1PUG~yDdI-pMj?{^$pZ@mxVn6?%h9MvR;6Gei!~dO2 zBj5mr(cE|8Ua!470rh7=p#US7dl|yFL=+IfN*d3C>K`TTwPkpe`gMxMG?YxlBc%gl z+(-{%lCSJW_H!oM;y79soHvVl3e4Pg*jj)`&+Rr}y1;ldF)& z|E(&en(2eK#3CChHe*JQJ!dN-p_-^6qtFkSDN}P8Yt<=$6FL=|%tx<_`b-ET-|D+k zxv@nuC5CIX-088$@b8HL|&DzdU|(rQbJrm4O&+ zj2pRuuirgjgo+J&xYE7sW$r|Pt;?C(~FM}lAV%!(gdZEh2%QAFwr zf=1daKaO#Gsqe(xhOhm+w}?U&$f%?!l=uB+rU4(p^PJVLtYh_ow15NC6aR%(7fpr! zE%bb2&u7PK{5lt3<#3BrbK?c_rml%JqsRbxffd<=8zP%QcltSy&u{P{f|8FZAHqe^ zT+PH+9qG_oI9UEXqEHCt;iC~hoVOFqsI>A9x!Da_txm!Kn@OFh5~R-aOpgC}KE&g` zm%P&{uzH*jv#IjE8#fC)9o6B_IF{p{*O1{(0v5s+{na|t=YOd*BQTX_(fFjn)i+t= zAX${TjwofZeANsrndEW)gyYY_O<-}WP|wrf#aPAAB3ReIpIE(R)#x%37Y=j}(lDH7 zEidLJb-J+PkfQRQrCBD~(1aw%JvosDZBtL5|N4Hj_AY0r7m;lyF(OdT+NZer-7Pb` z1dl(Ysy$y%U#S7G5_~_v`asp1Z+mhtK9uVH zTiJY*s6GS7qf~dM*}Y6_anZoJkmAE?gs)xa-S=ud+=2;7#GK*bY4eP3%e%mR9t2T4 zwfxmO{prNSpdy|>Z}dfNXGB158s{$kqrF1jKKN~vT)_8?xIzSXlhx#AJ_O5`3n$9q z=;Tm%kkT(Oru;Rc_B;WPq*=giL^iy3W$}Z9|cOggdmt?0dF}2D;xN>mtFq^ORq46B>kXN0joKij+O#cL#|LX&o`qWpQfI z*3>1#VXAmT^$!?ZKI-yQeCcFWY^34~zZ(?cN-Z5kNA&-K;KThhrQkMowaDhPhW7)l zQncJhVmctJI@Mt<`-ESq9OlWWuE!2g$RQLW zOn~GH`Y{72`4EZ`cn4@eaT&VZDY2Q@cfq3SCZ>UOtmHPW`1{IPOH$b^Ir+ z$QGZz^wqD00Nhoi{jYbv#>LUx}? z$^K52jS-J}#&1poB+j@yHh3d}j8#=DqQJScw>B&O|AMohr+zX)yu-u*+ zSBanX6qTv=y#3Pfy8VnX{ov`Ja;>t? zG+ySF3QAt2gO0)VL0e4VPMzyI9?t#f3k9zMd->*S8Pc{xgpW7A2wBr&viNal@0?e~NcjVivgB6d@me^P21c+py+V4a)+>XxtWhA|)Y{fqONOU+#*uSjs zZE<^z@sH4Zjo!a$3>_XYN|FpJT_>$gFLDPUpK=Y+e!bjH)GaasA{{cr*j8b#KoJN=6gLB}C zE4NGx3LA_yD`=N%0EEch)(*0c$;uK@mQ5O>qSnF;iMo6JbQ7lRk*=M|UlJL7gSX9< zy~pdwM<9jVC1~FS49!=f0`~pN1hS-A61{(~L0Fm3QT2S~q3Q1mpN7JdMy1Q&Vz6FD zyrjQY#I#g@Pp8PgQoHgs(9<{*d4YNVj(=+J9y2TG72PXX3s|;zsVhe3eBxE_Pfk0M z@l9qfO>UOE;Gy}LDPrC%I?61^r)3q0#vXUZgVA-(|2`1-NmKvoO2rgx`{M2N%@xh( z^Wqr{A9K$T(A{9*3JvqRZx_v#B%BRm2egx*YJGUy#8KlnN?Xy@Xy<`tDTqM022*cH z92qa#?;pQmV%kWxG_XN0zvw|6qeR?56)as{O;p0O?SYzMj~bLO-~;C#(MIaz9a1LY zv~^H6&z1s=H0q(k8M1g+Umj9s#1URi#fj5+B8@q9IeFKwutjRHMqsdojnYt5ZphMF z_3le(J)(@B@QKO%Nm5~1|2Eux*{5@PyNGWD)IA2@o{;B-SWuQt#w#kiy%2*UI?5}K zH}I&L1!)}~Dz?pnrm;{Y+MUucCJ`Ie!)6g*jX>c2@GBB{07e4$*T6_%-mirxhHtM( zVACHY@ai8V5L=1&84p~)^nQrDai!CjsH&nxgjTe&Q1cy65Nih4 zFV}r+GD}{p&B9Kf#iIGfhrWT4K)%gCNT9<9Yso6(ccZ0*ycv=m1jmg^Z4rigG&0BS*#Afi&7)Bb9SFkPbS406rh`xdnC& z#p0}_&JP{X0)eOn0==qp*!nX>H6U3`05|0GKB$}vkdE&OyiUVmGt5O7LXSwcTol`& z#N{mWxuCn8p4$NlV*v=j;G_W-0E05$FFuiMgL$U&dI1cz!8XnGa_JakwtN+l_ z4mBEDr8n+4d!#3Ae|O^c(0KB_2}xtV!uxo6O2K>5HT?%D1RszAS8-CPW67uZ7*xkX z004hBi1JBs2oWe+(ewSb>{5|k0gP>w+z;0&5dy%U4YsW;>7{p#y%$zke%cXSW;=nh z^nuH`TNS>z+mD&$eRtAspi48kY=mcGchF2ti|tKydBR51_%wMEw^>>r&%UFs}(wT%t-Y#!XN_Q>9@K=Fr?0AsKaaHN4Q&)HYmj}k;(D_+A#Cf1FwoDF*~ zGs+bR@fivUXjlFKc5D*bTEi7n`azFWn%MmJp?*v}U&7|s)69iJfW z69b1!4Ix>)4vm4RGorSpuD*4s9?eJJZ7wuik-s6YwS>zOvKMRO8c$go#Wp`dbbp9X z@EaNqz=OU0{)qO{rlIyDr05%R-?>RO!wRD7q#ds03<9BYifOF`k}5Kg;mjuk&V5tJNkIzr0cr4t+nq3`}Ga!O5b zrc(wKqf-Mh(tM{|G0Bt6;)sH!_kk>T@4JHhd=FzVAzRIZUoO;~r5W)FM|+4kk86b` z_Gbyl?x7mv*Dh9f8}RQu#}y$Aatp=Q&OMFjKo|Qs7bjt-4}GCeg|yH?ZJ%Pb=x?t` zq1)KhLTy~yA+rlFN?;@>Jn8Ti$yv1TMY345ZxxMW zf-rv2DR#+X!CYUMh7qKKoLjxcZlSn7cY;3IKe<*gy_Ae_8tJu2+#n@Yoc1b;Wa z1}`e33@jqCOd#fQB%faXP zpIA=(#H81r?Dk9rZ0C}qPpG-Wn~>x3VA8B9^0MnC|GvP$!}nYP|Tw zU})Fi3ha_)8N$%7A7PPy7V7`tjI8)YGlWA$*p*9#P=&=NBlN98caw~_DLhD;O)kp_ z6)A?(B*9Czai#uRd3#oXwr&GBZMaBp5O0vQ&!pWQXJH|+{_5-q-?Y3sJ8mr6Wg3Kx zI^KYVZN&pd1)LDUuHSZ{%}X1N+aq5Sm1or^z3ENmKxDb}m8w_z44AMDU!$Z56sF%Wr(x<*-Rt5wLV#as{6K@cV)Xa*$*pS zOx;k!FS)Rs9g^o0)RN10=?qUo4!4Mx^WXWHhouF}5Qejm}fmr;D zx*C~9bL!3vX)6xN+@#Xv4adoh;SRn!5OPA@4X7myfL(_}0dRnXFa(8B0c7#Y;I73( zzU8Kux*V|s$Te$_DQ2~hHh>n=|XMS=%uYz!>0eDD$Jy(Q?;+!(! zgl&&LAYp0%HiQO9n;QJ#;4UbP8bE+y@#Ff*mnM`E$vYlwrogfF(2Kg`sra^$-tkcEh_wPh5E5J5L;kNLr z4T2BiHkcr)5nSW`#|E*0f3-n+#eV;>K|Wv&QQs%AF+D-yb!r7%KJBpBr0s)k5Ie$M z(Y7=Sl^eU86GNh)v5MGz`o-%{2F@O-Yy?>8?I*M62uG20<*zn~j#`>n9+sDgpb+`# zQ_5kX%!wcfY=fkRD(t%HY8XLvvQ#|8EFp4!f)afEMSK}%H}{b;=j_K1J6}ixuR%Bc z=c)Kn@0Pp9`5RDKHxx0*x*B{*e#TU}3}!#;u$s(RqL=&{LhC9y-@zd6rNINTzbBD^1#y>`{A4F;NtZyj-0A#Y1jjGS>F&+gAWYNbQRH zAQ2hR*3|sd&JhjK0*BkYGg-R_vP-pACSA_+odvg*k#2Q(y_Fb~zEIejtrreoVNkpN zS8}9+{vpJvf&#d0>W`GMDYx4WqEMZXRu_7S84Z&70iaL+@*kkfCBm2w-^3)e?Uw5k z!B0~i<0wkH7fMtf{qaA_PdH5x=)nGmEP_MP`#RkGd28(K`=TS)_|*MeH%h7n|AM;z z`XAVX%eOZk?;4DPjhDQInp{DQy3ATj!QH%E2Tf#cSb|wTLLdRtYK9*DN)| z>9%-;>I|n##*Wg_KE<(6uuT~J#iQs(vnP%mrjr{i0W}BWbtYrdCz;-5(k%@|_ zjxavP`aS{YYqi|4oV(#isQrwg!d}P{+~3oF$jSeUvcC$8@_o3lVY*8?q!dBAI~5S= zmhSHE7zqg_lp4CEk&y20mhJ}W?tJete*bu$=lkAw=ic!+X2)YL?zz@F&$UjX>W6lb z(&mYMvx$}(oi!xccOYS1%@S+TWgDCcS9Mn;iTG6>_6k@4*@P^B2r{^uJU;*iK;Fqs zE7P0If1-@UO&n%r#_!YE=`@%oV|)BO^p(6VqCQ~A`4&`SACYUd7V%EBlj!qM!>)%` zuFKXW8-k4^-_TK-y-QTEo~f26$ToU{-J*ZYc{iD!={aNm&Sh+#8 z>pR?Aj>RP~)1YF(#uw7VcFMO2;Y8-&*hx?m#_!ZUD36SA!<-RJpy=ZkQWFprP%|(Wy34>6Ybh>9>==n zHMPxKD$?35B(O_?r=%9#917Wyzzj)J;h;$9j}z1h7yO{b0=ZVZ#sYSBbTyaXA5<`u z;uBxMej=Q*oGLQ`e9YG!;QEbDmEZ^j6oEZF@JAkg{*+04&W(o`G)bMk6ll0o!^<4k z<`XuciC9S3Xl(;UVza@@{o37U)KEeH&0IyV6*=uF`x*$F952pLYCnvwuQh*Vo>MMr zsJ9;`El48qL(inG3Hb=gypxKJ`Z?FnpwI$iRi{lR_k*{aA5UyXDQU@~yX;^=3>M?a znFAaz`4^c_5*FJng7){iKf%6a$b}b`xV56#pQp5?xma+LZY#)nVL)8pYA6hV=l#+p zYQwxCu;gZ*ON?sp9*tZdfA$w||vJKuZ^w}i>Sjk^y+|;s97=D0XwWzE!yo_VB zq-iUPAVfEH!)=_@^GvDnlsXFpnWa0+yAz&*KiKo>fN2R4&hhUYm3S48`CHZIri*Vb zR5PC?B#XQ={U$eUW0eK3lfbYzcOL!u{nRJts*lthNi555MU(SQKhcSO3nv&MeIg2|Dzu~m&F+GXM-z#;)*`-j8&r@m;ut1t)yuL^ z#@UN9>O6g(Ttd4iF^J?iN*?`?kI%hHeI za223hYe4(NQ(K+u^E>@)X08uJTi*?8{?xr5G?FhN@V zu4v8SYid92o_v9+s?}XiWYmY;u9Q=IJ*=NGqFWq8b6m-&dZuR0!DVYtW}6TtiJ63g zDuO;}bG<7&Rzc)r0v+7Aw7$BlPtTGYy@eCx4MH_4yc(^Oy392WQI!iBz8LwiO}CE*kmN@N<0|=?gTF|4B72>aI>AIJxaSaS?c$;>X8hr5#Qf{ zcmm(J)^e}R_t&}#$ll!rJGBnFaS)*0Av%#g*_moSogQJ?G2kbB!(>A$Z0WSV<*6$g zwql`v?@9cQEtBQ*7|%RMSSQacZCLv=C}+H+*mjOcpcgJ~Ev$Bo^mN%FUKMKl2Yco-w^NV2Os9m_q+9fME*`7~Ki3O%|A@cBdUYKpf+1Wo*7!#>Ab%6_lJ7MQ{& z${zckpe2-X_M~+*1@DjU#osNlSRWKFq>5?8xB`A?J(6p(Kk|89K7bW@;fSHNz}CEQ zPX!_o)rS-mhGqfMuc^%qt4lh(nXW+X_Bm2`}igHofMF7 zbghx(n3Gspcam3k@IvnKZqt1x528T{WKFk6h12=@Z!{v|kH5RRAROX2I3Z_fI3p=%b^ zt_;_*{7XqI`#9Fsm}!dOdqFswCt=c2bM!Al^+Yw65E^8|MyJ4>LU8=h-@pz+a8IGV zz!5@l6!7P=b3Rhwav|WZuDhwwHse_2n50@;7;;x9{OuJh`yF~GKL2X-sOW?M{Ac&d z9qwu`5jZnwkguDY4~D1&oS?^L+N1ke17`a5i}#xWh=V^1<#i858el;V*)m?iHeroL zrM{$fLKZ)>uNKi_ARsWh0gB_P+kPo5xo5_&@ zX8>e+I>60}s6nrPnZOPKJcZdj1dgTvp#JPUGW6L=If;Xzl6H#{+W-rYHh7c*fch<} z87Lu8zp|I+(eR6DD12KzF|fxoI0d-12;V{Q;4|RAS{|(O9P%0e3=7jjhJ|h4J>-L< zpTkK)e+4f*hZB@#-1c3Yl}^yR&6|%<3vej+)&SO^+s&V-rKS*t+If_IMqIdTsxO3D z>NRiF^=Pm@e`1{^TGT9HLiK=V)J%Kg8o8Uu4{Iu=qb7U#9c)Gg$B!Z3Ek!YM;GHyQ zi=yj|4KAgEQ^IOysYdQK9}MUx(4pCtzf-Likbnb0t3H-r77aSg^~^q+6-HQ2g`O_N zC3mQn6}@%57{B&k{TxqJ%uCh&$=JvJ@pdj8HJD&tQrwZTK5^Vg1YwB0L>7ESsrzX>}$sNZPxX`I1&)IphDY1B+Kv=p3;In3RQiFzCcvzITy)~{2Ix3{+= z)MX)GztAOuih-wo-4*!L!@$?C1o--iR&k|omT{a{&U<*b$IK#x+Z{__z79!H{WgMQ ziONv|`mL~f1}Lm3SNi{@uyXvA_gi7L3n;9*j}Detz61^>D~#k}6PMb}bEg+bDw3|= zx0>gPiM}AFV+#7%7Et=(>xd>X$bFL5OXL&5>FxL)OVim{TSI3`B09o z6I`*6N?_haJ&`S(gm~_Lup{XpNUbC8{)%<{V7^4-MSyCvNI;|EXe#4*v7b=L8&8hW zuV2W*oe`hkCqxQW;<=xmv|x&HeLSDs!n9H0rpI%XnO*Co^(uVgGfDRA2=uu9w0%4W zYE%R#jl({L<^-=?z*>PoKW*m5y6R~d?L}RpVoA9J&YudCByP(E;X~@>cB0{;0V->b zC8N$#bzd~nY49GHlxWapR^U)6vshY7WoEBkysjc!XP;*> zl1!=34^vipZMVXGtXA3h-}UmWh}X`Wr64y^QGxjpR@g@Y2aWq>^N^xGuAJ5 z)E9&xjLLr=PLug#20MlE$IQtkkJbQ4UNyH!Q@)?U-6U{e`9I}Q_iz8bU*4i(QvXlC zoLn+iw{?hgY{pd2a+XI0<)$dlRnkFXL)8X+e8XMOt?TC0z z^1XGfSmLDIcw<8c#{OjD;yIf7*KVNvSH-YDPgonC{%B&ht&QFw_NO88}B7y*#qExphHO1IFATBq&&UEkOq3)L&G?e4-Y}lL~fGZlJ+b)zmLOEqy9$ zLN^Eg)a9=8H`&r>k9`T=UbO-&a#N_;yaQ>(uDy1!-Zl}pa^5xx`11`cK8S0={%QRI^G-~DD3|P! z=B9n*mq_(RU!#9BI>CwBd>EBW?@1P>%)c3e@yA7psmb@uk)5CrEyK^y{J4Ik;HzRl zCi==4C#b<0I$8y#B0=%K_^^QA-DCL*{m^L!vsEaQxH8-6;pIClHNHVfBBs>oVbTL_ zXLgXQOgtAyKR;Vo|5c$G2S1>6Qmph*CWude_MZ5`IJBD$uhwI8H~+0HN#;vZp`6K= zFt7=z1yZ5g=Gsf6C_GpRSc;fGW8WxSg+9gNtkaR-xQT-}onAQlN|UUI^ab|flxb(V z_lREX#dLoOtJqWMjn&iy)7`Y5$P}8MnSj&>HlVt)J}MbuGi}MKCb+3ScdU0Af1}5J z4Qo0y+!tq_j3adeNS&y5+{9Dsj2s=GQ{Bd+{*pQ+k7h3%g#4B|`Q3Sr9k-W}bIUob z;r@A)+;Hq*%WOt)T?hvAqB1u@q)w+3fYa$~bM{qN#97)_z9lFXM!jKihda31vo{)S zNFcAf3W40*PfjkA8_aha&6P=l)=iSl4mmcBRj3{2IbMa=m48bxD9v`gsZXu4NbVw=saX-j`4!fwziU9P7`bTkG=An?r`+!4 zdkJFcSV6<{MuK$GI=K!t|#H1(s~-yH==Lq`nI}#>Xv(es}Ku<-ORUlMTk)izgaQN%NCp-3IeB z9VxQ&Gj}f+IdaxbC|LELF$Z^Qfd;JxE^hDd2VbC(KDk>Te0%_va1YBv3kV|~HJmSB z+utu1qG!3a{4qXNxVh-!;sK1uIV8tj19Dt32;-4{IcNX~pE4dbZ>k`|Cu)H4Xsq{r z!~htN)XvY<>+qD%w@a9tt9+BwwvF8Tx#xv)a;z{V1+|Ty8s!OVvMv)p^ut8sF6u4$ zfPxmxz%=c5=kUP0Ve{rv>rQ>FD+sHr2zWPi0NJ28rlbMyhF7UdiLG8Apnks_zE7Ki zY0yE3ARh4U<@n3Fl~BT7u-*+GS0-HTckwofYV8FI$Oi+h%-+&JQnNMO$NbW~=GHbg zvbJV$($uP~bR6vKRJ@x3#^Dvl-0XGF{e~>h;kgdW;S^Y89{5`~1J;>`r2)kqgc6;* z#2T;CWww96i~kQ+<5EBC|1YW$_9vFbiN_EkaLySUe)0VnNk!t|{Wn3h6dXSNgnoF7 zJjNO$^li0OSKrsWT6%q~K_Y^JgE-0vK{*pt+kx<_c%7Eo{Ue45tew|!88SANqGlzY z&`(oem20HA)^$^>gCibcc|im^n$bQPLnftE&m_mFhJ5=(*(LBP0yl7YGb<$gTmy}$N z?sJ2`i2>G`aC9aUAEd$6XDV0M*mV2)MezP{gl!pU+T{G-0u(t9G0v2AaXtF`Y_8S_ z14huiSLG)h?Uu1O=(KBuKC1gh9(-XqSxAnz^*nY3=nPYU&R|ah=!`0^Ez-Fbu=P(n z3*zD@;GVQy2J(Ic4c=%hUkwq;KsS}imITsrxJc009_Dqp2~Vo@)WUf^AaEdUEIEik zM(Sono1%jPLe|sYA*&e>vI_nUSs4I41J>Ocp?_&lFqN6mK#?j}Cr(UW?aWym^0eFzBHpY2*kE+QHsin#MJdTY-9JgzE& zj zK}KSY`{ZqG28Mtczhc&tc0%g3=szB^;l6!u5JW^q-mjOm!|^+0-Q)*C*4E4H!-K*W zE}{~(=%4-X4qK{tCvE@{*(N5-Mg23oNI*me%c8uKV_E0+A#B@mJw`mPU~xCR(~ml} z4WaZyUwhz!l{=hSx=dJYW1{NPplbZvl1uN(Uc*v_3YA|mD|w$%ttY4$4g_g3iPZN2uyqrx3^XhF zb22Oy94#O!1Ftl}=7GrbVy%OBEHuz8ni5-=lx=IVN>ob~=a`+?`WSF@CMfWw#sfCu zuzn01S5W2Y>L`%^5`pdiO9W=m4)K7I0Uj{#-ySeoEWIl%Z1pU`kW(emuxm5cnH}!7 z!`zH2qgUj6TwKz0bf!`4G)!!kwS46QAfV<|{Z(J9wtUvQ(wkYL6Em9xZRWDq!u z{`e-ic^h$^X_$V!gm3s5{6MDLcSoyJ%3s=yC;Ng@J1uTyCBTB!I3U^ zeTV0X=v$?FEx5o_{p*k2t1((18z20{*=^4xdvdcHhtQw9jBL##3?4g>sffd6`R_h0 zZ9!fBXauwPN%Up+w}TAWA20DIgSH)wsoJ5or`O?`37=%?QY3oVu#K4lN}JX#Zp>)=2d0J zFm_rqcUyYNO+?du=>O>n^Z8Ftn0hY+FWS`*%FkH^{tcGc zzi~R5$XVQeN4)V|kt1o!`)v7(*iX#?4z>3G|irk<+gC>FZ*aR+*A#!c> zmqLWKe5YhG9ti@20e9F(fZypE0y+qNUu#PAZGaAfrjVYU{nvjw2qhUHpoBmOln~O} zw~{iY*bsY~T&c1I!pDY}n&(0ni9^>bF{W=TNn2gURkNbhy+i zgtlTtJE2jtpWC!`!e_z9B;>bL(g~ChtbUacoK$TAx+fWshgqkU>!@v4V?x|vS}TFR z-LiOG6bv}^!gKrfTb_wzFnQ^tRj6SLmId|QO>GO96b`yZoica83+C0 ze7^kcERcgMKFHZi$cIp$^{P7%8z(VulKiW)khCKy{coI)Gxf)yR5}@H_Ndw!CoblJ zL8NCcd7~n#6JNiX@jbg*$j)x+l{Mz+@8QK+9H+zQkTEGd>#aa^h>OPW5=ZTjeeMrB zhS4NG=mNKXwZxuA{hS5OnUH`C7{^{a;nU#6{wXcI9^DLPd*u|#gTy?gkhL$4!a%As z>LwvmM}bXb(de-@)v?CnH2l6zxshs4cch}50j1kl;-b`l)1;vStD4xM@cYEOcESn0 z{mb$_73N0v8EeeU#Z}|4D*HRy=GRYJ)i1i5hXZ=h`Ehp-U>A247{i#4u};4`XvEw8 zXyB%>eEvyTB_t@Ue)uG)U~vJv$_^ET$YqNb6KzN0YkD3q!dS4vE;5PC7tFlljh)6S zp!$fW)P|_i1XhrT!v#I*euSCoz(sxSS7pnZ^pvsturB>K+OtFzJocYx4@;bVT~TjC z+FdpM5fnQ6hY^7@_)WOY$#zF2S#oyR&vE%gfry(N=@@MGZe;3r%oFmS|Sypw$b{aUjD5vKtqt9mbv2F+G)G%BAgCJA=mpT69ja< znq>QG-z7+K!5aX6Iw0n;czQ4=^B(7?Brj1dMh9p{gesu7;Nb@8EkJ?(0zb!qc?^C; zYl8M@vXGD6yr#gZZQ;ges*um^ibd6|V@b}Q8xW68TdAY~pORnq9v@cg3-Z97j27uar zd&l?z@7Q%G1OTeF2LK=`ptj(Xt*j(K9lnI1ev*eHmf)e_+CcJ8YXS8)0JL`h;rA& zeNdp1`r-x#PDUK#)%O@h{wKCB9p)_a8fTiIZI{>QF|=c*O-s$Hs#es@`ah#P+T>>Ifqfxi`KwD>QE__j0r;FnzLZ1L6a{ zD81Yi_q~2Mzde?-cTnKj75sy>vmg#Juz-Km6!vK;+Gn7%P+y>l2+%*J0R2 zj#7Q=B1w!H1`&!5lm_%~f7KO$U$c<9Ld~DL0%+m(cVFSoe(!(nD-8axq);n_6#5Av zgI!oefUV3XjDOO2P6SgIU#~_Zd1*G(4i3^*-~l)xv43P`D}bzQ@QQ!ZJV!J%y;st^rlqQ-jNjvS3jt z+!cPS;9i(*VHG-&r4=QEE6f=IbJ}kuxhv8cgnya}9@wiD03`GZ5S5`2(XlAUP<%mN za`iy)w770xcOjN}-8T8&11XaElCmdj+Sm%zxR0-iFwN3UB)jzabX&xc_`z>ZRUmw} zA^eLdh+XC%QCSAagUozHuJ!a)aP7*@_CiRrzq1vjr;q_bgly*yTiO=X^V(g*JR5@f zbRL89DBY!W1T3dVZuge@q#VYoze_EimD0o8BK)Z-SObL6bOs2}l*zo)H2A7!qOJv9 zCHzFOCTK%dPgs2OJ^hk{Z*t?#y|dX`;YzB}!uQOQ5h%;O<%E);|86M^{RiN2%aFM=o^)%t2xB7%f8pn+ci4BG7QY>Cf`u4cMD3t~pB?-zFC@FwO!T>D^S|f#aKWUc!y`upAFFdFfz=Oykc+kNw zJV*zE2l4#IgIfLv9)$V3qoDJrqX0r;_IM}5{v%wo!Bpi^H6=H#Xu|DKXko#sm`rYm z{qSRh;G*AEuVrgFiTT=WTiU^a=jLwhhbNU|AX5v4<~`x#MO$$rj(YRku{JgZ7T@AJ z16i9AKpqi~;P}|5oC){6Y$DcF@5Yw#@zI;1m7%ZP%`w47?YVEU*ky4?LpDeQ_FijI zO|4UpzV50C`>mV^g;JUbJeeP%*iLa!@8kJ_ROk8Y4}}R1Cu)D-AoJuqg)ZPn(tduI z0#vN4A|7G5q?nVs0`8?1s?EI`{SwllJZ>+}U>JwV#FyZPL2(^U#uQZa3JHE`FLYU2 z25!@5CgExn>A8T2?LEj`6}RUf6I&L@Ab58YOrYIdN9{+m08Mqz>hV!pL%VNP2_IZW zZb4iBlXwqOdl+jgMylwS)S>q(APko6^-?(^m!4qi=*XBMw^X;q9^dpGL`wY}RQ#*< za0!2Ri_`|Z`qtJJ>8EYa2`3$s2>%hWvHfFWdtm9`CC#m=7P<#Fb6 zAr|}D(xH=8Y-i;}#K}^Q+aB4x`q&YZSTtLDVM$lMg0mq+NFKv*iZ=`$v>iAzV1Os{ z{e>~zE5hx-+*U2HI`m5;m8_mQIZ;~U>$f=S`V-u6M5Jv;T7I6Tl0#6PxgkG^3lV6$ z$omr4JzpDx*a<6d9!C)WSdDHa&+ncs3`pcWP!D@j4c+(`^X1LXR_j;jz zd()zJ7LeoEabu*pDCNt}&YUH_Ol0L@96#uDsAK}_G&}-P@s(H8Z9k&U2TRA^ zA)sg&g^x$K3^qQa#b-q`#q3|Fr9Yfyz>P}x^YNMijegRJ6|~U$!m-(XC*yO(DHAgO zb$LfueF!HORq`QdOoTvTbtiKSAi)U6HkopYp+3Y;b${?)g{_|FJv@RQ zu(SR7GBx~p!={`Bxf#{NVva=Jm9BT`A*u=Nv@~PC!mA4Ar3?Q3^5OzXXv@NpQlloO z5x2Yv?U!>dv|UDG#=ZriA4rrTUNvL}8^Eh3_BE1;Z!XFjdj)rNdhxlG$?%}Lxodjc zOi;1t?8OIE4x{Lu(X_z;PXV{{tQxZD;%5!%gqCgxQ{SRm3-r=kby+Qj!B6?&h+cXu zBR(VP^t3t)<|;^vMd791KVFS#oDi~#>}{68Txz)QJiFR&Ud#haeugE19tKC0!CHf5 zE@7X-Vop?ptuA5bfPxI!BJV_k>AOJ zIoQixuZO(_m%aDseX|wBMf>&z(txZo=~4X1F`lixPYZMIOf!i>Di~RYSiPbt&V%5+ zgLE_l+$wfmldvFS^E2|?IQ|+$G$^M1rBU#F1uO}OzZk`(Y}7BGDk67b(I}LA-`lRG zo@UxMO(^}uC60JIu2Eq0jHE>Pg=rZ{2Rb~GihetbWpoc+mr(CPr0j$X{QZ0BD6QzI z&O>paLsUWiW?T7$RIfUAbi1eB`Ir;Iuz1bX?y&!$6>j`Fukrp);GB&o9aQCLk(hUD zOuI7>8^}4N;a*BQq@9WGM?ZW+DP4}~tr7W(o|q7w;cCYDYP_m5%Fn`%8N+&2dVlIY zq9FZ{t8Blho3lylMziqK-6sA+E^UwQi`v`5ro*HvuQXhl>iQ;=i5COfHNoFif9j2~ zIFNJ)>>9lz-1;@N)A8>^J0Qr?4mxCM=YJ0EBw6xA=v)%G^o@%pQM)rb)pYkrFxWMJ zf2-EXc(HQ*TvLhIA2PH33XG)Dv3XI~8?k|N4SRykh z%8*5M>)uP!!Osrl`A)e_kTwX|-vwRPg7$*-$rZzAM|nZG^da;qn^|ZC@_Roq+?eW! z_^D+`5;sVRx=ijS*b_;Y9JcfREbWM(gUULL5<)ACZV2~?Y;rjUvz^i6= zICB)+S-?LHkqOBQK9%~KUnzzWLcCC%>*&+3lJl}0o3}X|-BHY>4VcBhwHXWgil*IE{kqMl03kK>7p42YzS$-`^x`Sr_X=WnL zF@*f$e)_c*_IW+9wZqC=`y|R|;6nq6$qudD_Nc9!81MS)@aGvKzKz>g1~ZW)xitlmGcCn9y;qSU@~eov*K z@*y#rhnBu~yb4}12bBy*9f9V;TGYJBX?lAPdU)8x z4vIkXJ=p|3P9^=!g-T6>bzk&6@~-hcoIn`mU;adIGRtpmG+WQd{1N5NQs^(I-Z9|R z%Y+Qb)Sutw_>o|E42<6Oa^q{LU?P-6Q__}UE9k{y1jxP)OoImM(U|7@v_@#5MS(lEBm>_8 zuE9bB)jT-2&1Hh7Z1dq!hKB8y;l};r6Gx@9z0hI$IpWG<9v&UKCcRI;W_Y~UA5N%~ zFK?LQFL%KQVBmbe1f#^m(vX3qFFV3+>ZI5l@P4eQ`^wn#a|bM(C3Sr{_m`OQ0tcJG zJ*Ro|M}LP5L0$RAwtq%VyTcVccN3W;3mQTuEgjhK=NQMI2YXY(5rUlCV2(c;au%DI zvj)VkdiN{jRLy3Tt2IJl45!Zk2*QF94#Qut_5U;1`U&7#n;={(_LnS+C>osYraZEV z>hc__kElt?FdHTfw4h#waZ5=B&@Kbkr=Hpu$bY1Hk$^N$1t42xIA?6SSORKR!bpZ{ zR_+wr&;lp;@_4o*8Y~Oya%Rw*MNRB|n0V~4oe2Y%DeW1#`eYbE>&+`GSmB z!PwSNsIw)jv7Aj)Q(oH_B;J}ykpvu|a56jQuDMT5ppOb>Oxx${yXCnuu8Qw#&%e3; zINcl%MVRVB0G9~`nmRn8yYohlbuFEQc_oduqJU5wNjlk@m*|FgL(BZJ!DNH$&LQlT zIfBq}u4OH^eW)WIlQy|HL$k!?Tl{NVIT`Locm6a#9(IrOr36{mKyodTvk04I>8jIe z4)m!IY0&zxOI)N$00e$*2H@8=2>dz#fnWc{z8>7@0PJhTqMBPbz`o)G?CX2Ln&^WwVA^PmOz0ygX}$c72RN?%5eF-d3U(tFnZdiZ9YaWr52k>=6tq8swLtF%@(CBvU4MPSuzj3tDyuYnM09*GfyBZ^ZOvQf>MF|^mKuW*5c{o+Dp z<^ATMc(LE!ylVrr=wZoAk}2K3yIHdh*Cyhyq>adp5?L4G-`2cSQox$Gd^_rPsj8n8 zHdWYrYEtN?KbLHIzd`%_6p`>&=S#JO_S8IdJgti|=R*DKE@xiHzGu>^hv!|ZA~^B} zu+y(M4B8Gj1^n3+sJrHM2MZ22=|D1BQ(jH8#;ocuHR&MUygp2meCX+Z#~JI%%|)uC`$5mp z5@SrA3RK2ioa*K|%$*EV=cFa#tCxE8;^zX5D>hp}8=s1!&uJd$keb(8){=Wc1t}-( zm+0B*risbwa;7da->Cw7wK;3l>FQd*tttgV1#|`N3f{9ywVhC=CdriB6Qxqxh;4 zAJ^?2X7hPi2t(H=#8u_#!Wj5oi?C6N`(V2AoX3xAx15o4JRme+Nn^y1+t(zs(3oW? zFqH&@ww0V*qKUjI3Hz5~Fv->7l_r~Sz?)(Mw)DZ=tRqL$jHFLUoH^!EZ%0HA*IyKx z`!C9y=wTo_?QtnC(t4SS#s2U=DWiH*@U1i|`5V>mnW|VM4ks$uTGKBH#p^QDPjBE6 zC*O>{Udn!#)ii|dg~?8-h>iE`O)E=klo%|xOglLJ6rKR&-(OLqz{fjAdqc~anPT-e z-1Vu$04F%eNNlp~wis!H^{f+2`QZ*cjLwpu%6if%e@AIwW+5*J!*iG})Nr`1t9 zWXp_A6I-Q(DGyT|9s$1BRWz+#iEGPcU!Acg;k>`j2Gfhmt?Bq}xyeWebqKRJ5;DUm zS%*hHW!D|3Jl^`8WaV;9VeWf6rYlL(3p_mb-UJ*1qDt))4KhIQKBrh(v_93nm&KO5 z*9Nt0m8dT3_qAk2l@C|d-Aldcw6C;Ju4axcf6i!PyLXIAQ0eb5)&3=9m`X}r?l$we zp&NTH{#bfR_w^@&cgmAd#m@}At)@{7dBG$!a43{+9)9@L-0L=mj03U$2mCm}U%{ao z@lwGfsC60UlVqnp;5RgIv>;(!-dJTvm*fyis{92;m^P16?@l9!KE_Vn$CgYY?i;Fg z{JmIXa;b})2e@2tKVL&m5?>Hc3DBXO$lhvddpIcfC+ zQ3aP3*k!)hTK5=!jzQ-A35G+2dqEh;!GF}QE^8Ret}_!AL-U9*!<=81KK&GIMGG{8 zI5HiJ9^ZFGQ=3><U^W%u9$AAs5ktCwq74g8ornWsb$6T zGAc{{Md0w=1)ffyoddy;b#4t-2UtJ`jzF`movrMhIIu@${1b3OZYTm=I~U-DWK0A0 zs1*M?AzOYqA;SPC(LDJO1{U~|+EaY>f%d7*=RA^-(us=vAeWbF z0J$CmA=mW+MFDa>_z$_xhli6L``?Iq_`kG{vgcXZ|F$p1ha)a3{})jQ2z67qF94yQUa+G$$qqCW4@Q-i z)~VS*$tLT`$aa=^sKhyCsyD{70X+SZsB4++;QbUG`q%47X>lt0pNx70({}xHY8|Z5u!_ZoW2;q%_*yfOm3-YO8)oxaBm56W z&Ck8mU!Ah)Y64D7mYRua%R+;&osx@N4c7wjVuE!QqN1HcnPP#fOT}G?K7-fV($81x zL8KpDE};)y^1zD>a8E&pw#akUADUrFxDon#tI>taZ(eQTPaF|Z?82qA6SxS44ilyp zfDmX`VCj~`DrvF4?@49+(8E=?q#qQAo9J2%Sp)f58GeM%5YeiRmyL*9bJJ1yJtbuq z)o$^hQ&NP|JPVV?i}DY1c<%3m5?-5=-GE@6V4QXhc=K~26QJMrkE6B0IuR=%n!Mx0 zA1(0HVcaT}Y*NJg(%Ph~F8_K-yTvJLoL6$@KIEP(hi!0rUm>O?t~$|~<%R>QWN4}Z z;~|o3w%t&T&;k7XYpG*fswVB4?t1|xbD{1AikR|o)PERt7{KjF0Jt65c~)Hy-P8ZB zOg$7s+>U;)lB|Q#9+A~(Jgz*dvM(i)zNJcP*^U)Csjxk)5LM@F!@@uVcuxKfa7!8u z-rRwufW`(R?!vM_AA@;zVQryn!MVGzh0w5IVY42bRk8y+Y-EVd9uR7&pSwomca@6ff(S@(%ck08!p)|5e`k{8rxi^0@w&^6t0s&h&qs z-C2gr?l?hacPP73W#kuIy~RAzpACUBm`{hQNhaR5V<`Wm;9MCvn7S!tD(>K8k$+m} zyTJ3Q`oswT9Tclq9(SAeX)K=t1iNhkjCVGg8g)Opx=5|cY|;^#KQYh$rfy*%zPn^# zbm!TXRe*=~S3UCJqaLP9(_}B+sfb+UVGs|2dDGWgs3Ywg zfVYMHqq?gC=63c*oX~Kn>5EE#6taCQf|^SUd8yrgQc#li%&8^zkVkk(_uRLx{CL8C z`1^tS4>fZrPFH}oZT~OP9gJD*w827k11hK@4gO6HG!xYN5672YBaYq?GMDRG9?99E z{Frb=@KIjRWHPhw-6vRwqoF>?LRABzJM%8RFST5&g+H_%?p2czuAjbZ=+zerX!#)P zjXupXnraS#Z5g*Fs!yZs{#|niMYN=WBq*+pkX^id$-0jzJ27Q^34*(y;=C@de$#=G zyvp3+i)f>tfOzSTezGfPwyhl-L5*5HBqPH z-ok+BC5TX1ZJ{)$O0A;DKnAuJv_Y%ruRgOQRnF{F9rp+liqps6nBlJ-s49FStd{Ae zX1F-|&F_Knu&{8o1W(6X51ERF0xMrW9VSu)?U{>O`}(7&TlT7FM%%;y&o%w;IU&Gx z=lgPPJu>w|#pvaGsro#Wur8`hUWS(+Z!19`svZhs?E)`pKCXwFzDX?G=@DJr%q&if z8~T7S`!yxIF(?N&j)eV7Sr5#7rvYI7vB}6yNb-VBrpW6j_hG_GH@eXIyIZZ$-fm>9~b?@PS*w z48GD{c=u~kXz(gL?Z|)En%P*8spQwKp0+M1e&aksSyOvjJab@EP}j4FaY57Tw;Cvxg45y^Dn2q82C(}}HnOV*NAzG;7;Yeh zqLPN$MPzHths;2~?46TREs+Mg?+pDHltg!6hY{d>9|ISU04bPDmW>kbs)g)#)>jB` zHDRvCz`{RZ#nBs^k)0=&%W4m$KWEj0zx;s31EslKvzGHz5-xY&q*SFYpk9MJ#z1Ik z50M{kw^?VpA#*$qJ|VjS?KjJ1v84SY_;TnQOu@o^6HTa%%A(uVJgz$EQfnotnJr@n z>Lzq3;h)132oAqGBEGEptd1{Yi$wNnb9DWVpMv=*UlJdBrj!0ElhRamWo;O7yvD~B zP`BPO$WUtVosGH|XY9;Ts3Un8rc~VZ$DdH`&TZD4r6@Vm*le*BVa{!1%SF=Ppki3* zl-6x>GjPkivyd4|cS!uhFbuAWLt?n#ei|QkD^gY2Jg(2k&-Q z2Zssl;$OkOlY*A{Q4{)mFX(iKySbVm9nRq?=uy~fY4Ry|1pOVTYNuw%l=?JvIzdBi zWA%H=jPeqyG~@UBN=509Os;qK54VU%nUf#fdW~{13ahx*sG*dokYFf~WCA4LP7|?U zt{is?!R6y7#ZS&9j=Pvk1?72;MSUxGrA7;o+MPj{xlh6O8 zhEC#{cJHOpYkMQ~?l>uRPbw(s$=|aOi;{gdQ|~i5}w#- zs_-AFe(FD|KJ+b+>VwJ&{yo;mt8D)p>(AJVoBfLQU$ZMv0I~jx%&%BK5y9|r2#EDF z%Eo@j`VSx-a605P^Z-snTHoT1v*Iid>2ie4>V}fykB9U*K&l^;j07$11M|ckPG3L2 zo|x-#s-7Ni5*4r5l)kU`GA~(dgNlwuk@q@3CR*5QRyjNq>e+rK9Sd=E$U$lP%ULT_ zi~Gjd=U|67u=w!zKZZv2z+rD-$w7xaD|M$E@WUm=lIhv}P`Sd?^2aYfNoWZ4ttwuy zlbT#=``@#^WieAP{U}nGJYHFr>+b;UsC<3j%%u7*1XaX+n@-37@?j@`q%tps#IiEHN(qM*NLoRDXc;IA`|S`aZ5 z1e|d=7j#6z@Ua|~%gpXn0^_v0Jzb)dWGKf9A;JFb8T!n^tbXQrod{-7(Vk`n$fSPc z=AC`$*aST4OHZZCYoNV!<)tZ7T%1t?ul2d;!n}P8Jgyf=E6VfXl9`4r+RYo|GO=ifNTpG zWSE19_F+qVbe^{b>X2;#5WwUO9v29j%yYmJktT1}!d&&!3juI*sh9cQph?Awr+N(U zgnqH&Jh%dCWZnK4$TH>#FhxeQVS=NS-Jxd|&}fYs8Lt!w2!>Y`OG}(Zs_YgC7ldCH1&$!^a zDo&%xGjFiL{m-#G?y?-Q{Fya|GUV93h+ztUro+*zgk7I5s7|T{E|lVg^#po!IV1zw zzniU!-3^&l48L~Pm^#z+2y*ML`a!+>@2xxK^R4@RPg$9aEFCj5d-U_II}md0-ZS%e zT#yAB7f}5f7ZkmJ@8y6Gqu3qz&8X?pOvh4f*@!l_HDkRTqca>S(HGC)8_KAEfh*PU zx--ch%u549_e_b1J+tN2fjKi;-yO&;zvQ74qZ={NSz&AEejU8g_H&fV-DJC*D<|Mn}idkw42O)=|=a*>N?AXK(6l~RJFwhdJ*QZX}0 zJW}2EdT0b{AIojrZoZbzUikoN40tldux^_uQ>Zt6-&L5v9k(Bh1Wu||`1Es!SoU>i zj*L+_zQWf&J<#_OyHW3yBKuGy`xY8aFP&*ee8YffiGddUO@P1jRX_x`xjfVp<>#9% z_rVFRZIG-oKm+I?(L}T@vN{1dRF485s`tJHAFAgshi6zQPiETIkM5iOP_qB=5vz;_ z=L6T#?3DUf5ut!=77v%_O~WGF}9Bz@3Ac99O-vt(iL&tHKt@G3E;j> zf{azbv}1-0_!;D9`UL;|tJ%T)S5p+SpOm6SkSX5Njn8^yOjBIjiO2UNaK0-U?6Udz zamTg4>NbyIy`ulC=m4#GOhUt0`DUws1B-hC@wSjNJ4N3p*75!KG!eZQy~?2d6yfqf zkvpc_&A_K(Rukg}ytaH5WCJ8rw^=QO4tjUeUNm41#?21zy%(VOf;&hB5V5exeF9^% zIzx*><$|QSo|^+OPD;>>Arl3_!>~WD&*aB~C;&{D-*hABn0`P*abAmI?vu7_nYQ_D ziLfJkbj$=*(AJcG8>}x9_~7Rh?4@P`nNgg2?Ecq`!n1)SiUgTfJrHfQ45&g~se4b` zF3zvLh<6DfS9COdiQ5&_(2BOFQUyLxM?i0Wzq%jUXK^Nv+HVjsE_V|1GYEEy=7q)M zLHdfrJ7z??R(-`YI8F3fLw6xr5vFCuY1O;(qoS?~7+wg@oM;nbv1`KkO-}{$lViP% z$;=80p#A36y~hSL7-#ke7VYGVv=wZety9E%tbeFR(^;(#`1xY)7g%RLNeLeIT-11N z*gF^YPFLUKi4P5X(M7bb=3_6^?__!BJNh-3AveLCzBAH*Vy{)@yb`BCwkY8$vTL5U z!PHhX^^SqjW5&&b&=sv-mt_y2MyaxLqiygccZ650-@y4bNsPNTu)~aEnL;CF1`72P z-b;}{YPToYq5}~WtWb6JD7kqaB5eT1@S9LO_T*9NTkS9(G`Pe#qVt)s^w3x8SxoaM zcQtJxJ%B-qo1D=AB+odrxwMJfH`$am&Y4-*_BA%#!j@zps$L*XVjxPIo ze^(SxK(ybG83poc$HkTU-x-CpJ!}y4SXjl&$bAz7d0RR`s0_ve(g~Khq6HWs^|>#e zVyTCWni&OS$lIbXNrtgfqv+MXxF&t4!&v&LPcF|n)1XABV^eNev4JqoQ=K^tGUWmR z7*m)P;$F4{ifCJ|X~%szUeF-%`?ie%OcxSo(JydOW!xMhUdAq4$MZQ*O$i}UY)EKL zbShNl8K5$}JC6SnkzMXWhns5bBpe`kUAT#hR%#B=r9LKF>q7)s}PfGVt;5w~(nnl%ArL zH9V>d^~UhA%pQ9_zqpEsEM1@9s?$})hHrgHxtZDXO&0>MEwA=M|GCB)wOFPWJ!1II zJDb)G%_YcfdlqDCAq?JH0RJ<#2wcw}eq}XrDjk5L18WkPytupTT>6@?&~Q50{FT)) z*R7mNpjk(7EglXfG_H33E~RSkOX^P!lBxT_Lr`f0ikllHbc(jKM1&@&aM+A$?%U_s zu!#Cl>0)(xpD1FFzkDRJenF;H$mS9^e#H77uJV8$A?d3aqOHlT8-f&Y3Us3ZU;(dCfU`(9}krfmogr5enVBCygqo8fWjgs1 zLBUi^6w4C2Q70`qQ$=%n_y)#F2j}MGw~^Au_#2q6D!S83fuO^zh;^Wq$QZ^Fy$@d* za?(aTspy7&^d0MXZ#&o_Um>S}IOK2q!ry}0zJGUTx(VQ@kPm76w3T!}n&rHj;MLP& zT)TRYmPrX5uAzhx^~*5>;_^#7+IWUHQ~O+cPL4giPXSa(->_~a$)ho(!4uKFA*81O zLN&zDmq@s2ZVp0s0%?Bt|JDb$38yG3X>ruB$ZB?mrkebC1XX}Gq{5Z?Qk(g zd*_mUeldNB^Z7+>F>lg7_WAq*8}}Nw+DKl7Babyy6N}2B_6=dT`&nxs&$j^fpg5g8 zVP}Mq<QIC>mh6!}BR`2s3}e-Dx?TzpH7vcg|UY*^1OOJ-pC%^)#*^pjav#mk`06Jk?* zlz`6)Jsc|U&GgCYy33gTE#Fw$Xjk!HOU(}!k-1M7^DPk^7{Du0CiAMCTflrH04EMT z7I0H)$PX38WAs$Lz)C(=S+|@J-_I5N*Nr^nM1Btn->xf$>iI-|`dHwm zk)MLX<_TM@(+C(_OW+TeuWC3mI=on_mT_4C<#DKYRq$iH90#u^4)6Jjev?|}<`#?j zc%up~@cD{fck%z8YwSa==)J!i&$~EvL$2uSYQS@ip-Tl^A%2FUETh;7YpMwaqYE#& z6r9b71^BpnG*Sx@ieg(}tDG)1u!aZ7Dq^vtEOlxL9frB8p$D*bAHx<^{V2XIkhbZ~ zuIaUSvfMcAb=lb_Lf;L3=`^TB^sZVV1!-HQH)MzlgA`7fvL}enjaI^D&vnuGpc95o zZnHiwUck|?MsGKcCjSi_f-8r)Ok(3F{==)n*AgxIBTm3+R&>gS&Ddeh59i;b-N+KsiFE;S&D*o)>aOkNZmdGp!S`d75S!k1B7tyc)h4M_DQq zj(O`BpuDFS5nf7Jy37DAGrf46*}2gE)5Z*h{$d4_`61J~o$NrTirGC(owW}{NhjW5 z`fCl;*ySc?C`r6~88X5D-ny$ASpG^td-gL6geot2rpjsX z2{OG=NCNRkFmT*!cd*ifM7aj94}h;9`E~Nak;D7v$f1U2ROZV$tpH|~orA|#Y{XcR z^&d^3V4V|LFjXG9Qc;HnLvN2T`(Ib|TR&dY^)dKPz1t13${|aTZ%bMo0TxRJ&C&ph#wkd=aZ;~46;3$QBmcneLOVgQ;=z5qA+QR=pgG1 zA@DjQyXSeG;rC~q;hoKi09j}B^|_a~wvD28Vy5mmjSM2Z4oV%b4VWU09CFy<#0H=y ze47D6*UQQee6HgV8&frEh^F6r)SB3F<{C1>+4k;$7CM5=@?{tq=AF6) zIj>}t1dlxDhCP19KJrBRxT%q|sRJk5n4w+q+@hXYuIV7{%RH%mM#2Tn;Jq|k8}W=4 zG!$CN#tUj_)D&t-R32){qghiE1Nwomso@Nu^0ZSq){%jfUC|bzIeRNFAx&M{=Pv)e z*L7skrIuVpx3=)VKe&#Ed4C9wdjre}(ExwTu7IysFCgb_4vqAoFQk#=bBFe4WL9TX zXd>Aqjc<^wv0t_N)QB-63Aid$-ge6G`9stul$?K8{BWK*FE^MJqC`P*O zV<~9K@YNw>?zsNoa>F*6oC!K4o%0I%ZR2CWU9=_w(vYpOyNs@Yn@v61oo{xRcRrsb z+deb(LNmN3<|tKg@?IW&R8$f{Zu=<89A_)Flev9<4X*oo1}EufW$>g$Wd@cVNNm}9 zUe4|7zoVr(JnurCmRRK3jL7+;=NvC#fT&n z%c2n#;1+~Tf(W|t7GeGHBh=&dzDXkpd(8@ZT`;CzRixGw2pw!J2#dVSZreuc|LJY1 znu{(@CrCgyQm)n=pVK04k_{#SfGgbksu?Fmz+L_#@8_{bCRC6g$B~-a5y^5N$@7kFIg!}^|V3x9&?tLe$6^CNt80SP@g z%?WI6b%W0tIMd%0v(AP4xn79jllYRxbL$235R_RWG6Reb!-IWTz)v)> zRQf7Y;3mMzdzMX*CV5}QDt&6OEHZ|e{IJxA-0raTL@T`}U*?z#9GbsB8}wMctirJt zWvzYE0sH+?NYU#gcdTc(EVy?SCwnW#h_$?=A1Mdl?Rrm=o@5xRYQBQXaw^{2d9?a;ajNp|-*Eb0v-yUHhfor(u+#;|k^IEl*sN zGP002<*M$2@L)55?AZ)JCh!fG9_N&8tEY;Qd_}*Voy$gvlEW6Y=4zEHw2vxuWcK+p zftu(LFHMbg9UaUIIZH{yPs%VeN8KFed{Nrq1e4OMoCgwbU{}#du$h~gi97wV3^dG7 z@Jk3~B(u6!PysToc3v5bES^FwjHyT&e*$N&=04v(#1ue!4>1MGz^1^5e@y|bqd#N{Oe+VTx>=|VwLeMp3;+0c>7aP#N zB=I*&H)Q_-2i|{}K=vQo8XY=yp5Xn5SZ=OBi{$hE<5%*Rz(sXTccVxfdZK@tpy2%n z5C$>;S)>p@l5mQXIM+k?8sH#bXAB7&m3k>&waIJJWD-x$MV5r8lqY?xI2|cNo)+AtI!kGz z|LF#r>IdM%ioIQn0reCBNI<`c0JzYxAXH)iF`*q*<`jeZfbE7uK)RFGGI7cqv0JUC zr!LS7@K1ruOP!ovG=X#ZF9BNG2@N^>fg4_+oI84fpiOp~AIjdE)wo7108%`*|yyX%jeKFs++Bn?Zl!b1tBh2aU%AH~R+wSnhMxRLRPK0S`lzApij7 zGXRjM4Wc&zU_(oQuwDRg(B7#C>-rN*fcGD$2){vkCIB8F$yN}gI#xJ^&pzPO~bb z<5~S-0xQq-X~<~Q&xI{RU}S3whR8_lB>;n$X8iq7Cc!aZMAkcbeKHqlG5G7ydomaB z?S4@LqQZx)m~n~t=^2#w9{9m)1*(!xpUZe~&0RAmeZGq%~caYnC;M3$u2Ct4IGwbv5KH9&>`%UO?o{#srmq*MUBd7i=Ilw-H zv-KOB0_#7?fu2_TY}yYgAh;K3wY(@v)!$yeFyU|cQMO!v;4lHe(H^eY?fr1JN|nJf z;-yep3&OgWdi*Cr@dxwbD7emv$OWKKbEY`2c@*j5-nmQO<2QGIIg5RYMgKziO=wKUVVVRu&PP>T zO4YIo+G7rg$mND`D}BiswZ0|slT1O6LqT_2eAS*8euegk(Y}mMKF{Q&eQi9AlziE7_LMP;3N!~*dpOEN@oIk%b)9{UQQr7<({-!=CSU`CXesfk; zG%Y$J0NedNfdwLzgNNk6ntSkSgs>U-dLP}kUGZEa!JQX!z0Z*B<(Hx>&;YUlUN)M4 zB>|uBuPd9~?xTJA`n-DL{AcyF{%7^{?RoW-v?YL9`NhBbisr57!nA$>(hq?G_WdyVmN? zVQ}ybBsTyGu>g<*e^ZtgDWf+oCG#F}F_Y82m7UQ%$g_4f)=CIi492M%@M!Uafsy~! z$^BV;e3W0DwEgCZw^KasL~ZMS*4i6r_l}wPn%wK7NPj>h1{~pMe54{^d5#{GaeaDH= zH&qO**@|$8CpA>FkK|enpL1GCOvVZeN*&xRF{OnJoNytR`d_LHN_;H#n3;PY3}k7X zgN96BLzh`kZofgYr~JWT@}u8x=a6*WxMPCpDChNrGa|I?&BU^0L*k_|GoIx7&a3HD z;|8CpS6>a(`an{)q1hE5%St%66(eU~j{ytlh$q-Jlk-t|in05-H?1I10etaTV@Oos z2o(|)Frx_8idIoRbWpJ&GU+3==Jl7JXa)@1-T=n6JHVIv36M+u%(Ca2r@>sQFokdor6A5+0BAfwIzH>ZQO#`AF>G(z$`k za5QjI;B%FQfImg$jf$ElUEet3qKZ+8&j(!n$V8&!sduP2Dv(qCeC{{;SZ{$;1UQg)_ zcHEQ;dS2`Q_W!DiU2lfr`f^QEq{T6}xG-e3OXB7QU@D39H&&Y}4 zzeY|N7;=G-krUCL+_(`>+5e23)c!Ma3Vei&oKXIIqBAK;Ob`qKXM$O->eH67%K?YVy zmGF6Db8A^;Ntjzu(36ezer-Ne*w!FwQPmkT)TLHPIzH_iJXkYyw@^zH(5HO5J+Ex% zZ@1^cKXevpr)J0kXDL!jy;BDYS;;NW7=ia0@eS|Td!7hs(|K5RWho6+58f^P%zGe|JozRnI%7z$Li9J0^sm5_)OJ z(wsM0bJ|9p%o6O42J)17YyiR&E6uAS4~AChi4wi;xlBJ5ldR(TR|KXGF&oSd(G0iv z{C=Bk@6m1+Fbc#VuP8 zL1SA?1mu>s&D9jP5=M`|kprbFfS>d`kNxz%!-%!fX9Ooa@B!y{JRp)l@Zx_Yfd%lS z3e-#we$rQIUG~cNvSWP2AF8R8wDCJ(;ubxQ*DeX3;#?y1;ewPNOr^~9plmTkVJ0D5 zKwgLQ-rED-$cdn+b_K)rg0?xWnKZQ(+PdTyfrKm95I`?9P*PNf{aX*=(|C*tUq$kDC(7 zv2U{9!?R?F5h+CFp{WFRh5C90Z=n+HBs+XbVHFem6gfYYX#j-{yz!SD9ZNbTT#&lH z0B2xX-YpC=>WiqG>$Uyy0+1bO;tFp*BGC7bF~6R{u|cslY8KH1RVPd6Qmw-DCU~X& z3bZ`#Q4V{tf&UsL1eZo0v$)TJHO_er;Q~rk8BP9j0hrHRz@v$lRzU$a9v*@0GZz4a zcmXE1EP$}8dbtCYja{Q8%osxWj}ewLBO~qnC_%I)-HsgkzV($23=SOFgR5gFa|p(L zunM1%Ykr39ywGS(+;(a~bBCs@VHZ}(lXmBF_-S^4jH&D6Z*a=MU$$g5C&gP8@Q4>dFH6=0oBw9Xm+vQ8}&lYQwS7#c!<_h~(lMHU!Nko!e0$!zTiFZ~gKH^J{tHq*pm zpuoe+#Qr!fnm6=L2P66i*FJMEN_4*akAQJzqQ*NozB;@V;B{5G7uuMl)=XhC`TNVV zA`!;@Nx!S|>h3HMLI72RMpd(1fK6eWUU{PV3^|ADlD>ofJLM-^JHLx-0nLjQV5bHj zOE7arf^BQq?Idyysh0ho;%q2`Yv2r-_P#aR&TGR;bIZWX$X2UQ2aCyk^jEOEU0!=B zC%g&;(^Y$qO6$||8H4UUuyAKk^P*-MJq@NNDwew#0!%T?-dEM_A(X`q0KMh`B+=GM&TATnlv1|dJ?3hFtT*CtvqEU5ey z8!fNErK@EV>e;h5hoFHVQhOL_;A4w~dLQ_qhX#bI0-(YdA%0*zS`b)^l(SZHZ<4Vd zUEg}k)eItG0h#q&_JZTq3i2DO+dxmp>Oz z5(<{-2FU&tPuj-zFd)T~?|^hM%`M}`r6pG(vjxAY6en%7w>f6X^#k&HyK|?jFP8Ay zbAvBXZljxW!y-k)=4Wtbonf9c~FB>#P1H>l0|3+3BL!C6-p-{Wd%UQ z%FCbb{iY2!G+@NwJJuHfb0FSZbCNVtNPpj2MH-91ff)BXIMK%nNTAnk; z+R((=+(ZNljgs6zH_lW@ulY^0E;Z-=aafR{U-_f(X`uDM(uaUiy5e3G2lt(}?Y|UzEZPqlE7?sCdc~@$g@0$lM;!{1>n`e<1_Fm^1pRSNTDF8p zCpW#(yJkcj>D6Ziy3=IH7SQjB49!PY;ThMy?|7yFJkwd#p41 zMC3ZneD339+n9~&F^&_;6m6lxmywIfB$9-{AGxkRgds{XmdO+zWW-hkMOd&&@evH~ zUURTLKNC?NV_vOXD27_G!p&#_RFDQD9yAD0HeKUXdJ~LHCCW?vo0+ZO_9pv`)u! zgt6@0_iWRG45_E)XbwnoC()uFrNcdOv`a$;avVQM6%)PZVUFxHUey?sfrk9EK&p9d59Sp2x)`->Oy^6Q)h~82)V+40>Dw z5b_>Oy;_JxA7dloF>a-A%seqK(Z>_1UI%3IW-{A@E&D%|J?t}Oe_H+)LMx1eY&8IU zFkD8UJPiOpHO8Rl_EIcQE_%guTFao7XWB@xwns{c!ch)y-9sxNU)%;X#Q}be7vi^t zAo7iG3oLQivT_Hq217egX?NwfcbvTsbA95bpFDs-HzXx_*cUz*;=i}zE|j1qYM}+4 z#GGIF`JK!o^omRosDW>%zYf+t8}e11IG0^EuiS@9f!fJ!-}M$keb-4LfuWn)VkeBj zh)nbD{O#rTgp+mX3$ZC656O8>hr$I~{2o|N;~ zd`jB|tQ!xupyo=XhhM;2x>GB*Amat>oB6EntMNW3;779Eh_@*n#9Cnr&hqHwr);wR z;3~KwLcmXlgalAZfi>F;=_VyZ7ne3%zb^1QvgGpe*|Q@5bEw^9wN~fnBfLstmxT@{ zH2Dj)dU50|Dgj=RKK&$7-*#)Or;%ak1uDO^voD3=I7%V0*legN3F1&ovN)P~t>w;J zQ0u@X;P>Bb-*9;L62MjP(n$2hb8{R0PNM7*ao+eUf{u~3kmU1pT-lDvc%$6Ct0<$~ z#aEeM+>vhW4)KYcG8in?wVN||pjO_OTrvBhnzY>*bZ0n9tSj46d;X*_hb-;5 z8eLEUdQF2PyTZiIn|fpI;_g$gIL;WjE~BCiP|3^sYII!_t@oYW)!dEDuSwqJ+nLXx zx9!bj9-(-!htOdvX43m`2mOpW(0CNKM=tQL6M_S(zZlF49+Rq0gSu*-kTSy(YKDb= zm*q~TUvV9orHB?L>prNCW6u*#Boo3zoISnqpa;ei7K9`J#S?(fcmn4$o$UF`dEcrR@7V+lRBI%Dx(bZC6#k&v*jz z;vg~vPuO+FqJDTleDCSJ03-2?CsZAxADU>5w*wwi31rtATuGkXA$Wr5S?xiKfC&Uo z&|RcXTQ~QmjV8^)nNi`8`|%Oenzr^ni%xj=u0sotPDmXQ7>Ma+H% zQR9e3^Z5bXeOO&is7MZ0-LDp1Xv7-$vNt%M!{J|(YNIbmfoy-n;Yoxa)?N}r@C4*% z(>{)ClxdELfw-@b0i~Wm>t$dRI2;b7X>X5>R@721FvG@6$(7@}&2|Sm?-!5N`r|wP zDDAOfH3oGF%-gz0vYbrBe(@63{Q@{qTK}dKd62Jb`WCPEA{*_?R&wdJv?;Er;z>s!V}KiDw9nR zqd?E$@H{Y{fC|AA^8djTdjG)_%CvYq+*(!}ZQM-2cme_hPw*OZkOFeQx!5=#m>a&s zSx4zz7d#cTKF_r)eK_@(W=hMTXGlxYBhzGsHs#SlBgcQkI7NA`2@JLjk#zr&d`3H& zda4~XX`WJH*_ir`15=KFX4>|4! zek~~cZuAvIZpFZ%CyR3#!2H9tCEdI>>ReTbho&qRKNUpBC1n|gw`~CzB*w^%k(nox zmq9~#$`>={4re{K%gNDF$DfYB%l_%r!69q?B&RtxojR2nE-LVlNz#3kw=s9@I2lRf3T)ZVso$zJmuq9;2Q-;7Hr7s!A(7E5<@ZT*Eh%UAS) z*#^Ry2i}n1s;#?H9jZNY)m>vfjI+w_+9A4(8W@@SQvISS(@A;6ZGkUv@fdMwSJ2$h z<(DWIKiPlkwps>qWHpI>Rru+>_1q*u+9`zfiA2yWh850jwO#j>EO<8z&UDC zKDgHP@IB>KOh^rsR8GHx;$IFB_a7(^3Eh%!j{W%An&oL#y>Qgi($bsglk6J^49Bl;3kW-_V&&bm^ z6JU>`P}e~BmU_CC1V7Vz0%bJM|8*LbH~TS}6|CaZk!jesCKq5b)d`JO^JLf7!K3$< zu%qun6c2ft&TkgQ`=@@`ffF?Uw3`P!WdC`u%VUmE9pZRB%q=mu4(s?|V>R@yMg`6~ zV@$%nzkDPkI@C2K`LVtBDz=S*=5VuflEji{u#pXK=eJXI^xD_vkv=9H`hHs84%_n7 zrXO$-LFSx`m#o%e5GDnHSq1cGRv`>Utml7t|4IBrxXCmbCn27ZZ1-?d&-%5s7=|44 zOsqwouh`HOg$;Q%Z|I@H`akGd|8M!D{{uVz@c&$#VE(@V3fk+L|HosjkkEjO{_|pA zq!Uy}rj;e1K3RU5=?;MzLPsDl!yFi9Q2iHXKvcAwu7OwRe1;ijA^g7-gGZJg%Yo4` z2QA=gUvaHT{u4`up~i8v-QwhB?=#Hc4dm*U{VOvl`N7Q@7(rwPU5L!ky@3Fc8BV}5 zgV>1EG_rM@rYPcfNlc7j$cw$iJIpV40^iruy7)A|{D#{wCDN;eseH#!=XTnKcFwrQ zqAODKrZi`Al4O-qF^k@^{GFmjw>=}GFoz6p3aT@qzowSru0%sEkPMnhZR_$dfxJw(x zQDy=|4t0+JgkHr^;Mjj82QiGBKaxYjy>T8z_{RT84%WHdCyO&E9}*Js(8B$`{-{_D zEhTW55~r;L#$VUJ?DA*iaur#LR^9Vj)iOot<*vUk{D#h94-kJ)ro4 z$?J|kY1!FHaJXGv%&M(?qyw5VeJd=-Qi-#%lhN!Op8KMw?QN+QWPHzA8Aaeeb0o+GZw0q~sUv;p)gfyZ@`DDB4=tFJ0)=pdG z3$9e9aHtrDZC|xBsK@7V!+&fN4~js)x=3V-N4#}`uZcuIME<%9{?G*M#TOnV`-G{o zms0aRme06-B;D(m}mer+jWt1|_j?1t;5h7#n2TM@_Li*5~uA-YW^u%-OivSH~Nn9*Q_S#UtSNV?4y2XXJD&}NyF5MLmWi0 zF>N6+hEJ%F?8c{51ekFHc>s1YbFjN(s`QMlXXA(A$f0mW;~18~2jng$M(p_tD>1mb z!YxH7@#*f8wA?ek7lVEMhnyE^Va;g{olirScT(`ZajBO`@-A?Z2ued5@^NCSmH+NdeY7AQ6RGx zzu%<_9;p-jerLRqk!~i*n7F`Zl~TClU4_Cp;0sTJb5Adnopy(6k1b4hyPC$iLg6rK z!#cdLoN_CAo5eB}7@ZMpOMV9tB92X4%S*;VM`8e4%DfM>9;&adUzl}8R4emb3*!pa z?R=&ut9pT!r}M);JOsq~0>CR3_XqEHwqCpPtAd~oNFlsS@!St;EyBZnwLB?nxy##^ z%FC`{-31|JChd-xkH=hR z_Kklotd4JiywCSO#~)ij|B=Qz`sVuP$D5n%*O{`{r8Vw%9$(zc=+K9^u_DpW}7WS z9BIA&vC8@g)r6nlIzSOYh<=&9e~Eq!g8is7U{nI45?8UO9Nx~x+{P-OYVySJC`@j+ zPG;Db1xGpxPLfqOtz+FQ{vSb66+jDZx6KLfpNV65J0eBTM1L+ctIHfx!I#xvoE}$M_@o|Z=B&SW&21w;rMiyf9CmCKHSL(`QF9qsY74c^` z@vR2eDC3_T-zi3RAIb{b%i?5zOR?ACi&1d8pJjqx$s)MjDQTH4Rhj-KdxeToXdbOC zhJjo0Qy~j&FVHFw3Up`&Km#8x-kJgQp))|*<^Us@dj-%Za{wRplaGBw<2TydGI?QQ z2=Re4EYhi1MY5#C>$}W#6!%JQ6NG935Q3Sv0m)kc1VK7d;O7w_sK5e{0|eU^1;p!H zJXpCt49)wN`#CG=KXsEGqfsr$kjyfiKaTQDDaB9>*3Oz>V|&7nNdvw8>MrCT$ zGCQe$tORZIJ_PMDuYq}sAqa1wGM5k;$%0W|K3)WTM?OROA^2BF{BC$@sTac&%uF?k zanQcpym8>ce$yj5?`m9z@R-@$EF>pSBZCCV$!qt8uUY>#dfkxKnV|hp!qA?)X%%`% z&jI>u1;8SiRwt^iMr`WB{A06s$?n4H#JdE1_-y9~+P4B2!;=6dcbB6;s@7oOg&5>y z4d4c1m;poh^TtAc>AJsV<)Q%R**V`<-QVD(rc=Cc@z((}Wd{)mG~G%$c(bVPg;uph zbN<>t_O0!&zO}1){mLwjNVyw>^vk@u0~+3(9>FcQG@X{Vx98mYI-1HJpXTZj&vD$V z`8DZJ6OFSkKQ&IF;zs6HItps8u)Nu>E8z(G+I5l2C|P#oUc3bA)Q|aXyhv9j>vOG2 z{_)r@I+um(Gm9+*jktYABkn;Aa^Uw=F~}8k)QF;%Y5?=j_9R$_C}a#&_$xz*fMtm5 zWvMqnr=7^tN0}ti=`lpj*JM6lRt)B}XM0<_C4h||FBhj$dtJ=oUoCjULHSllDx+Xm zBg1e-2=#K;jV@1NUy7)<{Pgqbxu~?qw%JGT-cK0Tgq%y`Cp37c0w0y-m&8COKve88 zBK#`qM0N&`>Z5WK(%9r*j2pE|@A1rfr@lrIr)I$xw;Bt;FccM5mQ-ZmeD{Y2QUu-h zDf-novefbT|FGuq+hXY05L!VoN_hSxc}ASDn7ix!c`Fg0z%z;QqfbJDk-b{8R+dSu z;-utvV|v-1(9bV{gKCm=Dr`3>=rD5j;wQH#IbvQ)$q# zULVVSXWCL$sjO#NP3%-U>FdU4?8;;6nq-~d^ADu>p}=*Xrj5XZM&-e;m0X7}^`a1b zQ?vzMizLNW82UPXbWn$GO;w+4Ulh&5Fn8P_xOP}VWT5_@6@y9JFByQ`jNlin$ z#c2c70V}pb&|7){J#gK#lhq}N+%QGC2W+}`9h?h8aEqS9e{c(#L-BC6-$T8Rm+41a zx0sU=-Y@zudN%!>xh#i78^biEZFf#f4368UMEFtzV$2ukDS118;S%L|4l!#=+N8gY z?I27TAJNX}`M)YRC__!{X60$~G; zr?}l{MZ-TOK8hA`-;U&b;u={%pVLjN=}Z$za7ve2QP^U9ItoJK`WXHG5_VbYAJHB2 zH4w2m@O0~6(!C{Y{y(I<3{UJM34QWZISw+RwiMtx?jBx-kEuf1Pn;0%J>>9uKvqM; z8?(u|(ZZiccX>pD%DyVe7pJ9Fhqj+OyywU?qp{(EG|lL!;z)5NCX`Fy zLgcDvkrVn=ZEz*6}Slc=~Jwz1M)x4j?-bp}m?Vo=HWnFGb#2o2)>d-aYF!RDapYUv!|Ei8r$hH%aBu2QdEL3LD#D8EupSv z#%-U;q0eKwmd2np5h0DY?k{_T7R$pU9FK5b+aSHZi*rTVD`k< zjOYgur<$S~kL3l4sLM5`iRNiN%OLHoiV;uo>v!&>epkmU06Wjfmf z{R^!X&Xm}FJsvhsA;Tj-+had|7!QjAo^XF+V&r!WLkXZlW&kfRvwO-|oE>wn?i`L?iJ+SXJ7|EZk=E(^N5*`cxt4|{dwsXPhtEFGYb5# z8hPQrHS#ugp1VG2o?$;VLPQZJcFetn z3jB>%T^UB@)AzakUoqf0%Zt;AlTLM|!W}6!NrCaqAeJCg$IOGk#n5=^mYxgfu52sN zqY5~&`&(Z)_3Yf760U&cu#R>|6bfpv6M_1JIfz*qUc0swa($bPz0Zohi{LMGHLpT#H{rB?oQ60o^pi z)k;y{1=RVQp+84y-=#iuZ#E^1kh!F@K1Bwl0}tz#_WY;C5}|ziBdUza+}a(~;3V0+ zSeQCZMoimc*h_5~o=>~Q-+#E&(GG+!RUU-Hc1Ro}MJ*PoL@HQdOG8xleP?PyU~Jcg zF1n%T(v;9B>MpN?EBbWbSO2s9Qp2jED{;ihl97*5P*u5eSgz)$X5FS4e%;Qr9VukB^z6j%>$Md}p|>?ZxR0t{<$sEphbJXvBhfeB&5UJ{y2o z9e9OmHN?hFrnMsA5ro7HlecM{=FO@Zl;zb)9zEAc6+N?QZWBkz8Q7|>jl@M3d&pP~ zi$IAZo7(47oHX}_5+Ry+sV2ge%#v9%RWB%89>k*#paK5D?k!)zm1`goIRA^?hx`wA z|DY?a5A%%O+qyc_C|+|BoI9l2mIxLpb$!FSP2}OL2@O6!R2jk;3i$gR3%S$Y*It)1 z3?5mX9&~g||9JY{Il}pUR_#JwI?)5$0G3EEu%HxJ;e#x3Mm$e}Ug$fV1x}DV8GVQR z@8f-O{%iIBlOXqP_?sa2{x?Bx^8ZVa3;%C|{62mEPlB92u4E)r_XUvIs7O9#1h%Kn z4}*=sk2#Ca$J+8Du|3!r!Tdu`yzHv8+PAq`v{MmYy^%4ZfGwsmJP^elmlh4J=@uBkfnzRV->^i{v&uCG2hxWFlQ{q-Amt1^{C7 zC17@<;th;~p-fSrJ|Y0|8?Qs^$$a>?#!5r%8tH24Gd>hIm}r07ro?V%Kw|}h3*;Ej z1@deVq(DBD2OpZdmj@}3ue}bx!pHmw_j=qf2}=G?fgDpWUL})n+J%rU3v$f8YkgM2 zMa2P#y2bJlB3-+)HZpGnep_ER=$*j|Qd@hN{0;QpdcY36u!ow^$H>N@SbujFbc%jC zkivaT(!_OS_<=wcuJQ!-ks}lL+u6SH`=T1}G`{>bfe6LecDN_|{gsfj{9Qt4#@6ef zTlZewei)Zy;T;Sd*xboaTRV#j7#BSLs3*7KheLChM^xnz*0JWq2MMoPTi|~;bkm0Y zqBsG*2)SC?8Lk8RBTZbC(OI-~{5%U34(aYL=~ASn79pUBfP@1`gS2$Fgh;m_-Q6G^-vM=>y7xZw`aJIY zADCZfX1&+zc&?O3Q?VI{HH_Cte9~K%!BZcxUq)$ieQ#ZlL;{Ls62fuFoam!0+Cx&m zdGFB^j}P8C#heKz!>^*BNKU#Dv+{sIcjinrj1^{m%X&JNjfLZbA~gd>A&usOZqR-9 z7qr`zDCRbKM3A?A;b;5drYyY2*Wwk-OeQQe(&@i|71Tj~P;bF~>YxWu$>2S8i1X&g zYW8~P+c%+_OSt4O%L||$qqO$XS9{;m3Q31^KamFWYl3W9vsC1TsHaHuJ!lVXlLIGCty%E9MwfOV7Cg~>XDvJV{*49S^xc9_ zMj6fP0vB?CXmM>@=f$v|n1K4lPEGu`%LSm>Bd9-(8BT$BIY9Ral-~b<-Jhpn2qho+&K2wNkyfl`SK%DJ5B}OAr#S#qpWInZ$h16Wn^vdR+l@e%4!dM7 z6RNCZ0?Vr-YK$Jz9Y95M*J>F7&Z~!v-QXi$DQ`D2Q$A{DAbz#nhv+jtxlQ)&*oTPf zFK}U7JY+GZ*ig5q!5=+w?tw$NK=e?J;Aw3T2~-gHN*iPYhbtSLkCYC6tOJrE-*osi}rSm!?)Ua5JVfd{sfTs9wZ+2 zO$K2BZWP+O)Bjt zlg&P#BaCbv>{NLOPgjM#OLCbH4PF|#mK|&mW)!{8l~J+nSSIYT6>dyV=3t7&yDt+n36*_UZylRml>;c=ktVvQdqN( zrIZ7Dy`gN>i4TGe@+*($U#`Sjw0=XWc-YjQ&5)hGh+{JE}tZN#icJL$1cbA>$>Zua5^*4l5_cLVh2wZYU zQ`JzPZEMG9DR9|Sibd*{07ccGCw5kyb7}>A~Iypxm`3zvMQpPa|#;UOWj92suXj5|;NRX9YZ> z52D66TL>mv{cu-WXyeXA;TFOX7{vf&4){4>K5)8Dm4BC2ldfaj2l81REj3%eTDZbl z4SwLx@SYF3@^To*z>r#@{VVnEdHJE($^yAnzyp#ah!sA!2Ac>8Om8Nqd*=^6A(0K8 z?5#+{IwRuN81pZZ-@LM_Z0Q6^jR*Mc0u(-~qpjZCXNO%yuzRmB*$g6R6bqR|3Jc|D+){#j zJXs|G?G_=zc|it0;!gsxUnJvWyr(Y+kg3I+kTSK*ogPB}4GNqk31LvMq1??&N z4hxutkc;^w_|d1e)Ie7N&kRYxMS)>Yr5GP#otfqHpw{)EAN&H2gCTwCODP)d3=f8w zodHV+su$n;((~0i{1Z6Kk6|Jp;JEL1a2x{yj;leyahAzjZ#?%NGA>n##=aR}Ko!Ir z-$j&GUdcBnFZvXVm#3t<-0jUk; zD{eY%@lR8h&%`xME1z#oG|xc2rUxx8P6Q?ET#`D!ve`wU_y|HB94U`7jpKtGni87y zJ+&X_TC=O&v5t#>x!aTg*D4yP@fxRQNs)yaQ7nbsOlcZu=%uac_KP{VX!7_q7kw>X#jycC7NqnNr%D zk{lYzx5MB<4k2F?$h~p0BeZpF*#K({F05WS9gye0>TCMlE+L1O}#-%dAzVYV$nqef8dfgna0WD7_@J z9)XCY-m`AhyERI>C`jE_@3@|AwMck8x-gn2Z&sDhNmP;G<>BOUdmWYGv|rMcH5X&? zprl-{1HK#Xm{8-U6aCCMjZSAozluGHpTbGv6m2aUJ6vYL@{Sy#i$4uJ+I|?|CM7iC zS=CcCb?L5h$8X8mc+~+wZcXHG-TK_XRrxUAMi-N+n1JEPsW?5j?r_~hQB?ngXW=}) zAG6O{YawK_wt>8C=3?OO@xy}Hh6@pgaJH`oF`cy!ji90Q-bAHncV;KDRPsIIh@Fi4 zrVDJlq^)-hV8#1Q3Z|NL8{HSvw63L9!$65=JTX@jQW=<-&9gVt@;;~2eDjcNHU=*T zHOn5gGKD^>&9l}AlWf=HO|R|%jOFp-xJD1z;KY@)Y|{}W6kScbeQ2%b?4}~v(y|)+ zNTUxNP7K0>N(biLi2hbmi_7YM85Tg zR`&o?iGz%w?7>0epj>Srr8=Zi<=ru>$HtcINNx>Y_S+kcZ>D6;< zYf~>9eVsR&wTx?2zTu>J)YvzIP~A*3(MoZ@9TKlQUm~c8?MBzQj})aIe{BTEY-a9& zjmbd7_#Enzw)Fm6%nz{(OrDL5K6%6YF~&5($g&V097_hdxU7CMil}x4Uy?z7X9s~v z$U$tl0b?^Ms5A$&g7=9CyHiWKVz;7fV;-Rx->8lE1Mh+0{{7NoC@9-b9eY(!qb59x` zK|EQ}j+Yok!_*jlQg`6q*5sKS0QI%1CiTj5Hkk=t;WxLF+euooEbnP)mf#2t66qjQ zE;NwN`f?QwIV7#VBI3)89xs`funL6|2YYk0h7|EW7mmwFnFA9`KgkxuB`3#whsjvK zXih^Y-y|E1A^(SY{vzEbVMQpLC0u1Nmtj~1{6>bm7whpbx-}q&Gt+(So8!stCQW!q z#kG%ej3fZYDF`+XA>+0XONR@euDK|Pbh4pp9vI8Qag++TL?vpyJ^H!{acwm>$7cDt zyHV4Ol<}1VW^&#H(x&{(=~tAQ6GUeB-Xs6fh1&-Rb)O*5rg#l^crw}o4JbP8rWevj z$A`d1)*u4_h^p!AQiS~+_;v#Urp)}#!jxTZQrR|z+vl$w$g#Rng@|^gWxDHR`Sy49 z-z)4<%=k0cy)S{9IWsByI#hB$38o{8?SbW$rpWLlndX3HW`;gIY_3UnjjHCn-?Z7t z>k&n>bQ^HegdKsp2$O~C#pCf(Q;Z?k#3nqqTpjHO%mFwl+R&xRs5r z^E8r`t!8zBrSbGOF|DIs_1kOuXb8G9l^6m(QC~W;rV7n>-@^-CuVO)WPE} z95~{|IzSgqd&*Gt!m_8xm)9t^}+I3?22;WEPQV0y4XQjkm~&AI`SY1eb38*heTig zD=WJF+_17PZyl}HIn$vc>ie1bF&9pR*E@m|LE5+3TMT?E0&?b0H~zQ0Gy^gzs=w51 zH3#oCS~Lz?qCz6v058i^oScn`aeYbDO@_Apg~Aiykz9|WJ>iZATo(haY1%HsgTy3=p-+?oBpZ&mN8 zsz3g*QLFP<(E6PB3Z2o5k`5Kzp25q|@|kkde8!lvlo~{Pw=5NL7p%Oa=#cOrUB3kN zS>*eytoz0Ix>3j?(2dMialDwsExMn5h*jgf%=^Z1&28ZU8wNQoqprkuZuwOEjHlSZ zQPcBSoi_xLU;)9^lB zp<>Cb4kN;b(xpP3fAR*U#bb{=Xdnp*mg9sRuu`P2sW><})j4g@g*mvN3Sr8)t$2k$I`y$AtUn+aj zZS2nZyA9ruil@&8r;)7T~ z*lCT(bgFuK_qu9+JHqG5n@p|vO{Nx#!FyHP80IEZyAf%JHFtk-b(&mysk_Jc*G#Q7 z5Jc7XUN|29(0ylJbWecFK*C*=HF|rpP=_)=voQs(;?ZCd=eGhs-WReS-?wMZ@RXNv zg+k@`AWsFGm>+V5eEael-CmuW{+^@!_(B`4XP!MIT`R2c`pNW_g^ka7A9t>Wgfis; zD`O?gwa&+w02@?6>-gP=Xv#I|beBMW>SV61OFl{jG3#i)=A~}Qr;Mbgi(@qJ{X{q! zj`(}^*ZgNRL$OS;DWt?H@lp)z+FU64Io%g?ROTwMg$*vF0q9Hg!vkx&t@ryQ0^?M# zK)o^EVv!B}kDTb1+-O)`VP??>UkNK(ZpuqsC05!i5$wd3MG)jhGT2LN>$kF zJNhwux`Njylo$G&M%*X!C=xLrXWU;E4QzZhECYI1g=KE;!j z=4*SIVdqIWvv;BmEn5O_hpXRx=AoqQzVCxYl4~C;^XV`@?tX0olWRkns}O-7AKL(4 zix4VmV13j=d$lSKxZ8{ElL{Lg5N+!J7&pu$Jv`jqDz4ac3Mtg)Y2Zi6dxToD1<(=% z@@9O7wwEP55vB^ptA!*u2sUHeanBx#8%Mi#F^FYFkF8&BhUAS+JkHj&cq-oKSjI6q zXHMpBE)|d*ICb`kVBprlU9~&)OkiBr9I?;)GQ@^#h^Jz)XrZe3JnkU?VQ>v@Jlsop z#E(~d$M9QmNvsx1zUt<+G_vV5uhTd}29sr?4gHqF*6d1u1cX)8{|E>hfblL(3Xc|~ zz3$uugkSv(2zx*R!l5?-;ffQQt_1v~3F=z0<809+(8@k*9pOL&^W*BMCGu`(>NugC zD5R?NC(*8X5}_SDx1JVXzorN3q*>U2M4jes6_ z?V=s&NPOpx=?v&iZ?W9H%r5SRg*4@MdZKLEd5>{>La>q|h!=SOaF2lI-GuLSE1kEj z&#Z%9M`9R{{C%KRq}yf8?yzB%So)6Oy!e;GuM35e^yaD77-Axae^eIt0XoHU)WtaIGOxBZm zA~%8H+u@p)M|%&9%^BQSWOmEAiEz5DeB8vHHodyZFia-dDg{cytlJ!LDRGPN?T8o#~k+;-@HhRF7F5CyB2)xXOO?qviKk-9`{`hy}~ zl6B724NBWEMt~$<+l`7>hq1-bcIJ!prh}20AO{R@y!%ePzHB-E!`aV~tJE}>uaoQD zY{LlJ@q(_q+^RJSZMoUw&RZ2NRF^1-C*r0&9&6jY-1;KPNXs|2*LE-?>0Bo@9XqT}KAIH|7ZQ}4!#T?+l^f~zhZCvbxg*U; zoTz31$vBG;@tVU4q6lRNgKF#pZewa7Ao5+5XE0`CV8SN(d zdu9Pi{(dx4BP=Gru=L1}Z@+_GsB*c@lDks(jMjB;nex`o=Vk`_dR}Etzv3!4kv9AU zc^k%5QPLc)!2o4PBWR#Od4#67f9ztq7xuwMvNnw}7*YWi-%pIc)8-CqL{B9GO_M9uBbx9$ z=Aq4mKg|#<5DvxgDysRTf?VWaCOb7y(pZKL7E$m($;-D2Wp;+IxPhO1?ZHpJ_Nk|*3)=U=T=MmA zClByW{h5e6{Mo!r+!5*o?onp%t2F-+H~*^uDhW6Di}c9hdwnHT!{^J7F&7^DU2C2l z8GB{(!V$_A)Yp1lqs8tdC5=TKFG`3>4jLr^wwEl8{lUO)Qel;kyh0ywq=)+_p3KxM zt2Tez-9BV_Rd>&42e7~BwO-wT{}(sLo4wrV?OyH!?PqhJZvOo_OId5U1*8W&o5~R! z8weLQZ<{7YV6IO4%3-D%f&-M1^9XLm|FPr$)i2ZgGE}8pSW7E z5vjet4)N2a>)iB{ewb4^SJ=C=b3@qY=|y;s;-&0$_d3!m^(>YP69|oonl16d1#EbV zIX=@2G_#zZfFcYySYhMeA#tPa5}i_CS*|6;iW+IkP$iM^>34+#srIK94)H#tJS9nc zbe`z4o#Lw4dqVt>d&kYu!%)_mY>0C4)dxMZI`gDxQH?2!-aB?$@n78j?%w)q zYnapLXKdK}4w`+x{gH`zezO=SEIZYp|Fl$9Du1|&V~QBkx%<#{^K&X$SLje%Z%${oKc8cnl0d;=;e};|_n@ z$0>c+YTXW<46&beb=sc{vBIU|?Y1W8E=>DUc4|}^dt(+~0K`M&DvM(Y5d|Kse93`4 z51#eRASx(6C($L~_{8N9vE>z=xrA@>@}j!;qIfeRh8^)E7#3U1LCPF8VSrU`m#60{ zVn#b?p;~@Qq0x4TYGzg1aVDJ>SF8GD^;r&lmY+TCaTL2u zIfr2cr~)8yVZgA@@}@4l@M~SzP|YJg{0CQS3)w3CNvk#dRjY;4{Yd$9AIE&Vk4yX8 zeO%wK`#AbP_Hn?!7|2=v7|4Ns-N$LA$9l=s%v2w$E{_T!Rt^mrbG#LfA$hmX!`B+) zW+}NyK+Le{cU->nIIl?vuRsf&)vmcCQpx+}tX)lV5xwXL^3Ei>dqFjpaqh6jh%>N* zgg3PGg7y`IM*ZlEwm_=sX1J8V{T7%h+h;Hqq)MU1^)(ueJsR24%*Q_E9gm8Xht<8s|$PKE=Y|FT&mlZKuE;LMB?2+q*ejWv`*u1%~+7u?D zRjwXez<@fLXtul;4et{0#5TsEHWeX&>it(jx)J#)LMCp;al+V@qd}fc-WmE%^nR|a7$o+XAmwfuCeVkkK-|yp61s4C^J`VV0Ag6pg zkVF5=K<@vzkLz0vO4ITDd`xs8(I#@x$k=~@C}6L&4DI09f=2|-X#%1C9L-%i&;9P( zCN9wvhnPO5JvyVl-%~Y6{UF)@h>troS~T60K)t>Fnex565lH!JP0-A~^aY3~3}~r@ zr8U85&W|&nZZE6QY-rFLNH`6D{NUnv#N*O|^vHd-y&k4W$-(9Cmu z3J}?K+3}h;L|p|=M9eeJ(!zbQhKAYyP$Vo^Txb>53>Sd<6l%F0l~{RZTy6NnkljVc z<%6aw&Ui(<{zdr(4(N*TmT&wtA&+Bm1+UgNMqab;GK9?_?eLy6 zI9%WNc8{`)l1u=Me2(s+VJ^)e?!w!|Z-aC0gV1Gqr;7SpoeZ_%wn|G-J~~-HVIh~^ zw?wDktayE%j`EBowZ{7jRcoi6VD#xwsba!jQQeu5%=obs6^#(rq0Ib&7R{l?%s^!$ z1{ewl0uKSN@5!sdTf?+rk#?47L@61XZ+U1@cgwo2jo3utgiUC~VYhFA<#9k1P_*Eu zI3O&dz9jcBYf1e+V>uYF&`$pvn>d(^uSAWZBNUpvAHf~GAO>J7Wn7@iOY!|^23Cyi zGlEDt=sk%*Nrjb|ffLz-k1ITE$_q^DF5v{$qh&Knd*kP?UOEk0y>mN!PA z3};C_n;;%3$aa;u8Lt)oLCivgSv}7$FYAo|sW6M|5e@t^VmA3FFJF!Xe z<2Bdk0QW-Utty*D4@_#eXTO2g_tpEbbu2Qdr2-K~Lt-L1Lm zyq^({#;s1Ym!Ll6FUT!|HHjO$94H6|m-~_UkYSv)ad$@|;?=b-QYjm^b5HK?w^w*= zclC^pTtyZ|Z{J+PAnIyb&YYReVm@6RTdo*K*fZ&ijDnZv!{64xCdl(x1n1^8q$&x9 z2EK+yaSb~n=Vz0fkck$;bYD;%c4$AvcYjB+Ob}D?DMK?{DCWa8^GMX&vvB1i>2Jz( zGwFS^@))Rsnz3&!TAfN=E10{d5J+9J2k&T%q~}}mk)BMw&uZvUFb1l+KGR}NtJB|S zkvGd*>~MyA3XZz}MMCaHo+QiyY#GbsYvur{5mIC1hzuy!xHu?IG8<^8N7Pu+lPAkA z;;_xogUfDz9jT%Hi;-IDuOl_cE4II`)E@uqmD-fX|EATh5(?%0Jyr|+qSZEi6K?ru zTCJP@I(xp%>Y|fgvmH>zm|jeg#jdb?u=u1v1Vm?nlv%xl+>O{>9=wzp&&3WK@ir$8 z0lnK=gfLoXL|Y^eE?+moB+4tDjx@k0t3T;^9dCf^ZN~T<2huUFfOL#Eloy-c9>+Tu zopJaYCKlp>wTwYb0N>D8qdDwKf(4=vK_To-iO)t4iWN8dKTx6!n(=q;-e9)pMt{X@ zMgLpOR{ifWTi}Og`~NS@7Wkpr{*Ra~@LyuK-G5-V?HTUU5X@HThi3a z1uNLCf#K{8g@}xM@@||3pBpy##m;-)5`!qAw82!wAab~daY@&aN^tTc$a`ee51qEG)o+Ej!`MABTm-+HS4`%TaKjm47YGfb)%+%)oLvL5=Sl&^LqYp? z6y@c*WZ<6}xt0?N^iYrVVJ&RsFl`SS9l(no=?5t#H3`s%lRM%d`TW)9g@L3 z6mb5D4d$En)8PRjG^=gR5GrTjGt$h!@{4xg(T8T<?rS5U}D8H)@LEKlG|yi(dNN17~$d8ghW%_?@x}1eXq<% zlavsHVQBf*y&5T6bQEsY*k{}y=!c43dRcYxF?Z4-8iALIgWxoc@wwy-fW1w=7lv+& zCC@hN5!0G>h&dBmQG{Cl2n72iwjZ@QE76_d9{MH4DjoA@j637&{vq{iFxBWTttTrV zhz4Dw7SoB>tR|@?b`&XgPN<3>n=ucpTDKQ*%i;wB>@SzHxJgZSf^Ck3n%xOULIN)b zJ-uwBFDsw$yB<8)N4Jv<17<|>$%5ZhKX04iGvr>+nGEn&<;;^@sPvAe5TM*n2s-!U zX(trRdOA}vr+&i9e=ZnJ7~X$WFFmNdr;@=*u~=Lj8Jfk@uksXJh>SEp154==>7&#i zW$MmS5yJE#@34qcG~ZFot6Ll=EiYDFROup+Fp8}@z2|L)Nw~@$DPTe$nWPFY7;v8E zv0HmT!I-h2WeE#|r{*|j?b6z?;&dwY)vZZ;%hP)MA7@o$rJ3xAa(kZSxCiopt5qfE zbviaCnbWdDKea*w#8OM)^$3tTFYA$+$2{6P`9A30Q#9{5w}zqYOb+c>KKPuMy_?=2 z(AVc>@@JX>cLl}kn3;-*zf^} z4rgD!Af^b;@e0~iv0JO5cki-oBcXZwDLDB7NEI-MkS%^`UH<{`k6`thD=9D9wTRQb zC+S=}ri=YEp;YU)!RoPLi@`=gRO<-EkLRLNPAx-2wO9bu+Lyq>Cg=2ZW|42s6F%_x z+n?l#ELhjqrbgG!?xsDTrFGfMH4)z_1(@l-D$KOg`3yxFbU3g#yF`Jl4XMGg4?$=T ztg=JDXu?bw{RmahkU9C&xAQdi8gdFvO`X^{DuLS{g1Df_z*i4JWYn)4Nu9P@wbH5w zzv0;9cV-pME8IUo#AUKuuzi6_za^s(wC$M&iwc&K0FlBQsD0!7D%cEuYYExZdBIXH zOHn?a8L8_oI-C25u$y4n#sMEdnWh{T?08}^K*esm&gl%_H)>r+05))!Q^`;V;MR-dyNkZ`s1S-*4IB-*4I52Y&2bWt*$O@+o75bgwTe&A8c+av>`vGV}fgUikBKzBc5qH?Zn$MAd-@ zdvl4J3gbiC*er^%>W(~TD)}z|KUo6;f6M{@YhLvqx+*dFr>?s9?{w8+i-{CyN7kr$ zx1l7WfY=J~0woCRJGM#*@TW0$xv&4os_y(LtE%+hXH^|h_!9Xa8%7V5y~vc{U`(^# zo4-^b&4UB?*c(ApPdSgXG*j-vdQGf-&#v13?5--swdJ%S_~g!5Z+sPu0%XdrOivC0 zhDjy#4xyWy_lp&A0TRMqcpNp?ZgD*x&S*`vC;#YPI~$;iEl4T7nX`7wX1n)1sN>V; zS9{r$P)JyqUC`12vrz6#3W{JR8OS83f@aIujz(vhJ_&>}gjkx`LKpi;>4iEp`yirX zKp|5xwDPAE={J>$aH_leepC)kxkdKw^?z{I z=J?B5`{j?bcG&N0y@;~lQq$YDUL+8Av(~#A>lyv+Sa0qnVG7_ZrEw-BUac{@u8l`3 zXk4K4;jG;3wTz(O=?>A^B0p;6KgN8CtpDklkNU@$ujy~bd~VYfg7$TmgJO@f6-yj} zc?&ba(LTwZLn?7O4(6S_9r4%VAgzU`g^|v(Rc~}t;O|{AsZyib%_}~)j-3spltd1B zsmL(v5L$drpv_r9sWSAGAi^H*6s__=TXp3z*+OhIi{6QXS9XO772Z&(h3=+f&DiPS z_^BPt`sat#DCZm;*hh+CBrCE8`fLXsaJW((xXNhYF?kR*DyLs+qmMpmwn?q!@?G#E z9po#G2-WAl>juG-hv}u1e0pi6OFK_1V)ZmCKjYQB_Q!tjDeZ5k z>8u~8=>o`U8q=aio@7J@c5)!RLka${&>ZSK@?6A|>FnS&=k4(t_)o6aavnn+ z$5ieI2+K!%AS5Hpf;W%99)J`Y56;vcQP;kyN)v&G9V-eQrzi<2S1OqhS938C6`p;w z_~qAwx1!Jd&x5zoBhqC)J1!3+XLNwVmw4~NhF1IJ;|VoU<*q5&kiJ;Q*zL5g+iq)! z>tJ3<)KxB0|7>(el}H-IeF;c)w&WBYu4%*clX=37vN>s(^b1Y8{*#% z0B+gm+h+Dv^I_kdj#C?U-c@)eW6M|6hLx;iW-?7SkLMl~T1QlcE%?70%s=e2MI3vTA{7BaPTm z)o`h3|HPu8Ka)L}$gk{R~2GoiV6yacgxti`e4x3u@;iyGf?O3lT5#D_boqKk+o zLKQ+2d>~7nQ!avr%~@iAzQot5o=H;*%^N-_2{^)-r*&YJB)oU;5I@>{+kQ8+Y*V%4 zo~{j;?nLxJKF{LNT)TS-?I+Jll=myo>iN%k)`X5fcvkqIJS+2Gcvc)Ch|h}lyU$wC zpmXE1j^6sLam0DctT#MsBY)^R@BhzuR!U6My!e3vtBwb>rAHB7SyUoFxYh^%lxrpC z{LZz4`(r`Bds13%NL;FTF&;cn)`2X!m-e}lCiKu2Lu8%}#cZIpIJnOvV?in&se z93-cFGmyKP+m+wW?QD@8<46v|yiVd&<3Co3A)xVNQ}pmbHx^Ltx^nsfS5Az6+_s1p zC2yMwr(uK)rmndr0280jTpf9$8ZThn7H6T1)P^ms?@znTt{5JlxbxC_e3@rAs~x_F zlO^}@xHy{_W$;Uw)Z@Ow=BLb0{GT=&R2>s=h+ah+h{Cv^aI{^~*ac1YZ=yVr*k9dx z8+S@i4X+)%tMiFG9AA+El})ycMPBIYjv0=Eyx($W^J|co)D`gZTIZ&m3fB1DYMtQ> z%eVY)wMP7EwSvD}t&jfSSgoB+Kz|t@aj{5Un)Yj3Jl$^6%>Tt|O?v-#R%_;s)ylW= zo7Kv3W3`I@VYMm?0e@Jn$A7X~egDpC^DQv%2p+W6RU+- z^9qFVOl-4BsGQ~_@z6oTR_;RWaMJw?aYR1fz;UVDQQ#6}6o~fQC=mE#6}bO%6_{gq zSoY^tpx|$-K($~OmfYnjqRWKet=6nRtk&d*|0t*C-Ih}oZ_24+e=4U|O9KBGLXILtjk?8UFtM`iLO83uFj#0~em%hX=eWnv^uL;?K;Kg7XKVrZ+ZQ5o^zj0V^;;4%wG*m{B+ipzt(Wm7~ z&0B{YxUZL#mfADBO~u_k4T490HtW4rJ3&{Z6tpq2v{pRA-)|pQezg~U_Y{KN--kFlcz$J_1Jap%q7sZWcpfx_82TW{ILa2 z^3Y3|=?f7Nu|&e7bcjI_?s&86l@Fog*WY#4KH>7 z}{5tfT|N!~Z_j3|`aVB1>X z-j(F#k7=i{0Z)vYqf5dIN{XB*M(FNmmZu@X^Rap%^;Z!0wBS(YbJm~TQvfCddIP(t z33)c;SNQbZpW)L4LB$*Rl)H{CODQ-R>lQw>yn#=XZ{Sn-pNZ1B+eB%IpUX|6l>R1B zO8+BK>U;V$0Didg2>bU$DezmP6#r+V6zzMX6gcy6SwInZwNTmY*(-!R*(gCWO)-&i zcVz~g?EPz_^j{}R34TeG()>u2wtP>N0>3s&-ynvBqk2dF_wece?w$g_!>65p1D}@u z9emn;+bC81*(m)_6Q$^XBuat6TlW-zz^6g~6h3Vz{4;#2@+*95>oK>RBr(oYhdWEQ z{UynTjCqW*0osO%**sPWIX@kZQ`dMG6szvp?B;XsPrOuV705nC`@K#odc&Wl2qFMx zmjru|YDYZn;x+W{Z}8z~sxd*0lRZ{<^-IDFnbq{7f#jMt{b zn8G=>^Fl7(XXa!6C!c)cn540@v~W^JwK8}3`&*XlV}Uf`d=nD1J>s__=%&wu13&~?miIiZMrvLVgNNEP>3!! zCe~h+em@P-n@uwTZhATRRPy}?)|`=aCG(AIxo;WougI|(R0X3uk5}1wupWws-^+ZD zw>O!exP=TjaYIWJ<#LEbRB6f=TIyU_ELG$p#11^za+51n_ zi-JOH`}Tu!KRrgAs0?fb;cLNlc2uGYm!65P-XEF8lm3Fp7u;vF?uD7mT9ymIG0h>< zNu{wNJ!Ghjv_3?KeLE<7fFWwGP3Umhw<|ASOo}bNalf=NBIkXO0A!`cr_X)v!i71 z=s{&)-BZ?^6S;@3)DN2}2B2?@( za%k0+=81tRmDy_jdd%zH4_hP>v8Fz>*BTB(%BWZ_l4ldF+ZJiPua59l zRv@2}cDq%r6F|y zoLq*B9Xr5fzds)Q>ag`BxmD`<`&d=}^bkh}8;5OtYMGTqb3dgP`W`Ve+sa7vSk!Ia zT-SV$cLz-mHA-@Moh$|1q?beXi3V9|i6cMt-FeHi4x?g0xJU%-gn3mQJG?WgJ>N^a z1KqXO)IWE1{{_F>i-|Yh_K#m`kCai!KjPNjT(Ohd`QNP5pVTS!-%+Q)|7M-0|FBLM zSpT_oD)PfRHD=q)wIRw0x&j;6!-ucORx(}?h6=Zik##Xe#()t_L3p^c4aF#;f|`Ub zW#ORs+L$y%qLOB}GTwPGuPKNCFRt)ogUE5&=arK|Z%pHRdNP3@TAy3U?a+elO+k`B z-BjRLH}&{$-PFJBh7#X&L$@Zv{z*6V_&@E20)HP4brY3I%$UJCT*M^~{g5WNK__S@ zgOQhjL2}R^xJtLI+>Zr3XwQ(}wkoBx9y3)JkRA)k$Ql;yn{CJ@z9@jD)_%3&a0&wx zw(V{10mOstecV>(&xd|CMU!VQbGCA<#ytCb0Ae3H!w0?Q1<`NZHTU_BU#-%nvlcfc zx2v3*GK-~p$%G2VB~=BSy|@sONDwz#PTb+hrA57;*(++3#_nmf5m4ifx#27DboESO zfnmB6UB?Qlbu)GP#d3V%@ZFIU;^Y@6-Tc)G%yP$*pPbtx?Fa?~z-{13hTbPzpSUp( zXMk%t$A(A7G9QibyBF{;mw8~M6sx)CC%dX$1r-i2z)qq)Zk#wU7dTGDch|Wa561dg zHa`-gh=XgwNGf<8odrKU_~byK+GsB>D~S!KiXZ$g=nbwEf1rvsjBf#1sbk#oo7B8) zgafC0ubW_rgLPn2k_4h`Df9gj8hsP74q|{pCof=+FRRE?pSR@!4E7wqEx1E$5Xe!7 z@dnFDv;ZB;qH-oqf~ZDF@9#S1_NK)*M^Had)MI`1){3WAUM7gGJ6aZ_>-jr_BtJvl z3l^V5xTuICc4Ok^g;(A<8LD=Vbf4IYb=@IY=1E^8aI7Jc4r>wa*KeE1?m5ThJ>&+` zU!L8)`*i66S9#pw6D4u{47FXK{(;He!^7=XBas@HIeM0<>@#F#!KsQFzo1%HwP2l4 z507J)8lUGh58P!9>TJgP&o^hfWL<}ji$i7(&9vAiLmj3T&ErR9iUSei2GHu;Sq9AB z-{ZokOE16o@d$?uX|$+reWUVo!fYoi&|6rl^;*e|yCHs3ErDNiou0xs-gUQED@w0; z0nCcvCr44Dk8xyY1DmK}7wj^#&!i08=V-p?ASzu$^1dx-;^`CH-0JtBT5@7IIa%j;7l z&}{KvT)xSAh$v>BMc>nKG^KlSeVhYRP6PB!cbHZfDD25mX1Y=K*v50RG%ne@s9b2X zwpGTYEIvfgUT1&N1iAx~n;I@UZJg52E=tOA;8auexxIGZ5V#$As)|>e)=Hcq&@akL zbDON>$!c2s)2s>^Gromuh9S%-VRw-CgtC~Ayg9Gykucz7Oh86Cl;W2IP!#}LLT(FE z^VeE;Qrhub%SZ=uNim#a$r(Vk`KXMd!0hvlUa+M=V-1zx+if(S%LmUwrF4E6xTDU| zQ;vv7=cFGKOg_> zSRM214E)V}+bDMfX;b3oe!K5a`|T0JLTD- zP{X$ttI~FJMghb~YI8Bgix0lp)e`w>eeyEZXh`ZUu`ciPTS4_5xdeHMpCw0_1k1m2 zW&7%PXPiuxS+z&*#3i``VaDBhPKen%D#aW~!~?@+gBg@qvI!5`GM=+& zx@9rWLaOt)iN-Z_@) zuI(2mHnx&E)i))Td-rD{l`+tjd&uA7F%ZCgQMb5qh$_kU*P5x>_!zu@ zZ++F7@e#7s=Vm~j_8M`eQ|N)r3{eqp%sziKEhF^!k{TaNJL&d{qet@Ec8LcU+wIj;bTcZrN(a*G~# z!BbtzPs_AaczXJsY*|4oM;!(If;JH=O*vjD%u;1LuWYx?s-MR(4N1AELb)B9?hip- z+Uhhln9(~+yu+@-#9hwK+1`!se~O^xE;I`s+MGc}=sSSnLM7Cl>8wLed8!b_@Vu2* z-W%{j@{$lzWOUs{!9@V74grN=HbWnj3=wBjqPH0d@OPTVjzuz@HdO=H_FwN*(G2g& z!skX-CAku`M@~EM*CS2~_*Z*h_%@Hm*=Fb+U5E_r)Lli7bv&jhpotKH;$leWdYS)d zD{AwoU)?~fAKjgz+J#o-0kt%FnO;tMXYZV6ZcS6eMr{?O z=hr;XL9Q&SSSPx$#iuA(a5whuL;_tn5r15J=iW|qlR9m8Itc{dV}wkwbrRWF2Qm?b zx(KIP_wRL0>@W;!?1gw+0U`>rAeLcGnyot_-KSU)xjPIGF~meE@immp)KLW}Z13h) zOEaM_Y291q#1`SQ_$-I>2vb(nK2yDMqjnt*4js2~!ISBna*P@~y~4RSx%KZy=%3yCW+BbgZRJBge3 zo`eerPfN3^TXLF?(5TV?p|gno<_LY zx^GRV4yV(3=+E6!n3JNdXNq2%JXx=!q0{!JUKNJqRD;`v>0}J{7;MGrpKRaeRG$F9 z_Efu$cYIH`*IuGNQ!=D5qqtl;t%QiU$leG$ry+kM;?_Y#+)6OFQPbJxzS&q~!}Ey5 zj`j;`EALU&9rU!PjGXl@V>9vo`pfNgeZX*I1Ggg?$_4dt@Jpc-@;uvA^lW2f7iRRF4V@87hV(m7kz| zWpZh2TT|WjX2^vPC@WuhGjWjTFxmCac=8F(uQgSL-)pMof2pYgf6b{vYO287?U#6m z=6?cl-5?+?-ggj}LgMaE5O;Lt{dW&{?0@ladHx>64U_tJATIc!I*1f3F$KZ{$^v?C zC?&DPE@Q-pk(n~Y3Mr5`*p(Z5# z;GWr_a1}J> zIa;@zN|36?q4zX`&bGiLveEdzDKW`@8@O(BYCXDpZ(Lst{i+;N8&E8UewGU5_WM++D5kuJ>_T4@d)WKiVklQny-!sIh2R`TqizpEmYj}3F>`} z1yA9rp&ih}p7hRVC;Yca#y$1x{J*}DK7sWd|k zX)Suf8QlWIU}kuoTI>F(!>fvO-Zz^om6P5T^;_tDE^aQi{uBy_D|5jn#_QW!yo=J7 zos6C6^07aD!V-qjjhK6iQm+U8rHy{N-6nwezKm!5va!Y_%}d+Z121Couo6&^2Y29_ z8(((x&TAU4Hd8F?(^pmj?;128sY0k!ykSY9Z>_^`S9L0SY86&5&d5Pv!DE&jvxWa@ z(no$lWGSh+?i5Da0(Uw!ZZilRcO&t+4#Wj}&QRm|wkk%jJ4E z%le-qubt1eG8kbHCEp^aDr#OD=|g>wYVXkSJle+{n4y{1qAEJ8;N~?<2%+TXP>PO; zl0=$&4|u4kECS zj?Rp3I!}Kc4fJwkCN^I4rx9jpgdemX4Iai-qd8W3qJ;x&cW!460?M;~_54OI)V53~ z(owW@lm8ACGOEw%scoGn68tmn89fCVW-?2*KS@BXTMJq!n0&Mpjn5{kj8f9s!+oWc zg#|BSXI4i;i9VW z=&XU|#phf`fEL$UEkc34|4s0oh=3zQSOO543z8Z1|GXdR!vRIoniR9S#2ihNXw z{my5I6L-rEfy?&U0tF;(`C3lUD;D8Bv4TOdmlhohH9G-)Z2jY#x(qRz(>Z->{vM2m zJ982o_aI;IFw}=YD`QofVup4&St)r^30HCVi#{=pDZGrWM--ULnoj#x9?#xiVq}K@ zN{kHspTx+P1pAI8fWI>%)BI&dM*hQ$ybtw<85#f0j7$SEBd>QgjHIaT@gEvBA=9lv zWSbgiQHzkRBRo!HK1OoU*|RL5;Trp|Y=GZX3QDf>jrQlPkU~W3fa9{A@(eDWUdJq}`nB2~3H(cfUyKJb_zhy&rt&BFwR9>>c0J%knv2~^< z(BK{Q&{W!s7+eVlE69in0{fpWCWIJ<(FB0EFzi88fZK1~j>}ELL-D`S%a-@oKi>Ga zeIn)-JnqFu9WH-OF7N}G2W^>&=TQAkj12gno00#w#K^z?UW^R*%Zz;TPt3@xm&4i$ zrpcK4i-})oUSZalOKWl$GV$=TWcXDA0{F`yDB->${9#0v{4*XpRW7oCQZ@=Xvajx~ zz^BqYXY@BQGVs3=BP-64GxC?eHzTJT^0ZkcaG@~6G=;a;TV?%3bdRVGNFSEN z-BeFIHwPaEInKm|ARKU z9447v)^Kepw%LUKpXSd&VREq z4*>pymKpN82TdSFHS6=T|5?=g>ZGFW6U@73kR$f$6a13#&oIBzAq7uwQJQOUh{t_v zpvJ?qctpbTqNb}@$95Tl9$HGoD(R`Wrw-xWCJjWMk#7%UT6~wBydwm(yKfH@Gr)d$ zzkS8m;FK9&?vMl&{bc`B%&b@>HCEQmkWVkMof_7wbd=ttWRT;J-$2&>-KYo=qwjDQ z`rsz{@Db(un-?<>O%4JVAnZl>`&$YkFO#w7!4&A#50*_;5sLuoJj)t>njvwY56A#*ce28YWoJNs4YIcstVeazQRFAsiPMD z5_~`!gPNQ$`)p$)CBSWG_1L`<1Ev~AkF2aAIOJUf8MJQTeUz~R1s&QNoyi8w5rAaT zp>byu9gJ}@sN-I?4^%dSBnIHk8`LYeOHl5a zZMU&-PPQSV)hG55VpouFpVhYIm3`OizIE6<59m)0bpGYgGhX43)*{L236tm+G`3mG zm(y#7RC$yWD0de$lu!~4fj(SiPVg)qSXehDAfb$p1FQeaE`X`V2nRjY(r52nM-=A< zUZ_28Y-YMnK!}8<5W>{wbKN^;;^M5e9zoT4pHpfy_{8pMQa0ZZ!mqr-< zor(*;`~K!DOKRANaKY6E9w&JH&*0srhYFLKXqG^70vz&TV%gD@@(Q{<4 zbSX1`>cMmkv>6wvJqsThEoP19I<<=uGAEJ)liq&xJDega)FnB*6v7G$SxgO(;;&7J zhm{#sO2&l{2Idh#5@Gruhiu`Hw!Zvi!$cNt$~o*!;s0pYLunMd(0ZkbvN@(!{6R0eg;x)?#557sL*+o=Bbw5+IRPQFJr9Mb0$E72H9*XSU1O6HAE4p4~U* z2|=b`yzQA$&^k>A|P4%{+AM+ve0e!y{2NIKXb1C3IP zfJfk~C?r0t-~x?Ctt|(TR18uO@Eb~yHx$;a{9vj@7F7?Um!76~K){u}C6X8Gy4UC@ zD_s)*lD!PUEgm*1Mgzqmo!bO^6UdR(Vb=vex5cL~1Rj|0W0ba*vuBa9PTcahWAXOm zG>s>~)`yr#qj)gt};*pU<$tO>MLIvj6#FI_GL^CU^L~T z9oas!@qVxG?lIB2QQH{Z35nL&M>ufFyRjvUn)quYdTh~kz^>}#g;9;ygzAF6QV&qf zCM2`0wxoz3#a0LhI=jG{mm_w{K zQdbUc0l^>qfJ@wXM}s>AdG4|o2z8~#Q;*zD$B`Kmoc!!HzpN@!a#^@+RorRg>4)5k;wCk2aeI^k9lQw=Oshdi72~~^uN&sGYA!K82 zo*8`g4v}qM(f3_Cg8^W&D9;yxVa=R1Ct$Oit37n#+f??9`9V94?!-jnRg%*#h0!Ll z(JmgU7ohwb8JmACns-zalB_}CdH&Kmr-o6|D&>gL{7&l{0Xn~NWCz+KVI8;yN!!3z zGqZ?$kh~kzOkEw&Qa1Hh-?}vz9Y!iAC5Z+b_tKPSpGZ#sVX54xkyUI|G3((Zw7z1S zO`>?jejeE-xB~V#XxmkbYrVbHo#W)_y?5Lk3c#-K0hrh*cbo}dEjmhCaq!zcZi}%i zllhmnY|1;liOtesOaVJ|DnZJNhqATRevLS|k(k+ok zoV@f5u!J?`FCE^|@}fh4!qgNOV4a<++?@6=PTaWk6;|~6qhFFp|0=0|b^cWb_>v^- zv!oXD6^!Dvf}VvSDg5kPF71*XqRn%DGG+H~Ovzs#*eT_8+;)VVTvW6a5ceSLNmGg?`TJ# zThMvPi48b3Ml;dQ5$}G3rwV8G0*_iC_@_Pmxq7($yVXB-bO_WZ8f^Xu^ftC#IhP-rswvgl;$!|ysiL7m zhlzI?`kO*b(nlhXfl=R#sbhken0%nZJ4iYhHzn0ZsS9^a zbuqx{nPutZlMbR%(2h)6JSKpF%+?XT{D56ewJI25mc`P5j^R?osphEPmZnCfUQWrO z0hyi*mz~a^`*e{t+@@7=Bbr|W+@`2_HHQ-KYEB>G$VZ(qCPaWS7S8-PTlg)=7OwE8 zExZ%ZnDzc2bm325bTW0LH;Vr#s)O_NP;v_&+0&xHtbe@t13w_J--j-(s=PHlCjuD zJqJCX4=)zBzE`&ZZndjrzz-Eph9LU1IGg6r_u~jvMCx`2GSeY6&H+=z8izE)J=Pb$3y znJTEZZB)0o=*(+6=R1*9tzl}PZJPMKuaMEj*3&WP1YtEF#tS8LXyC$G;<3GHPccRA zt){B}M@^Mln0TTi<&T=G)}J-is`Mk2YIx$XkDvD;{dq@URs${sl#Hi4L0;OCRxpBj zjzO^xnSh>|-vh;+T07e_rm*7yfdO)_^RBepy8|K!65MkpGDBWqV9|c45_|*iHB#TN z-^E6W5m&qB(nlQIG=5?{RG?YU*chcuT^>NC_04LQYOxqc<#--DR*J|vk=lxcfX6cK zVY5y8Nk1nv=!mK?>jwQCAf2cO#OQO%wReQ{#srjK^WI1FIK1=V+hWo2jR;KrFMF#( zX8+Jzt^Pmx$E*M5AAiSm-V*$We|$CXtTpK$daHoH53VA<1y}#-trl0XbPDgIXSPRp ztXvYs?tc^rGddvV#wB_PSx0d8t%7j6)$RQWjp zyM>6X@P)ZtY6@#N25yi>ZKDNh^5s&|X{8@6q|Zf0O365-Hy}VM zGcPSpiZnH8hYPo)b+fXQ3j2tD0+sH#!9HxZp?Mm#BJ$AV=pz$O^MiKTc~_Fx|#q* zRUCymb=1==)SHtZIsWM}78%k>9M-m62I<=imwi3dx+` zp*Y&;!>B#LgG_#)=)S*G=d#047~0$X&e!qU)lEd)YPz4@VxuY;u%0)lYB_e%6YQ=9 zWgL)*yS@8yK$A1yU@}o$)$)}5UQxk3z_cx>8XJ=g9LvIZk4&*!mZIK4^vk{I09Z<& z%;rYXI~kj4d^}?$Xbf5<*PUM&P;h!+se<2f>q(^m0ulvG~D`}4qRjgy~2`V0E(FZGZ0(~<=3Ae_&MMI3Q~41 zPeE}0X!x7<<_xHM-9JHaBg+`@Fao(Z5FGFa3H~Pto>%)HKybB87gf~rlzxsG(n{@* z$S+=jI)jePPVE7I*IkXfSDJXJDqJI#*w(f6KK|Ch3Eeyr=Or!lBu_VLtWORVMvRbX zNgQZ2kKx&x-YNXroYI*AYOaFPt6EMFIe@A&K*lMHuzAMLY%aY-5Wn+9KsDV_EeGN` z--S!Hk8fovmZ04wevQFVWYl!w#-p}6DvXWY0A=I8)@BosyQ^va{mLV9IvHTFiVQ-) zH{BF~#U<`&?H<}l;dSjkJo1#B1X&?|$GDv!jZBjQga1w!kD3$!Rue^CB;umB3F!Y` zLiyVJ%D9TjelScw*t<*_W_Qn8$J7O-IDJkaJ;!cnaV{$3^&ygC%}Tmj>H0yUdR(ql z(zGSS_xoqr=*E$xmawwr5&VEt*=cWVAs7||-}f8xjX840+t?*2D}gn)Y_2E=BE$Nm z5|9pg{3-GNoJ{-Nb?wj=L}qX^%Yf-NRtsZmUE(-xbX}FK?)o#TA|%xnC;TH-O@7zg zGStpIGsZgQ7VV+P!jxTF6l^8DMOf=UZ0Rbe<})j*B7 zW(OIRk)=Fp7x6Buhtxn_?snUfxR@G#>^_?t_j8p(hOe|!d4@Q|$S36C`pAHRmeEf- z^tW^w_xUan*V)~NndIm720To0v&xtksYof`W_<*6Si8S|h;3zz$gVm#jC}j>Ryec~ zx_#$zya2gbB?;{u1^8cQz(XzeOafO;sHBP;6GJI-rvt^x=;J|Zi4kW6xBiI!i-SS2 zlRpUY3e?}7XMlf-h?nO6?;+x4^#2(V|93*%;GZDkZrEG?0D4{U?Xlm@r-d7RJ_*oPksb!wq6 znZJPYoS;9k{P%&)3Lm8GNc7uN`E&qV(xP{Suq6BPFM6k6NZXxg`&w#temb+2n?=4O zv)?Q0>JdYPCXnzyiTh^H5`LymnZA>T(N2GXk7T2m94DivPE42BTDz_IIk4*kRrOez zwZOhORD! zI5eDymsit`;9M8fNrIIItDsCVF@lbCmo91962xxll8URZO(>7(0@S6uaZ6dSN@a~e z!YDywMF_q5Le^qI0CcDX(cm@OpknZODR4>~k^vCIMOkz*v(RL|YYc>%=9Wd?-22V6a(&<$S-v3maYJbDOc|NVY^gS2#mLTIDHa7nt zJ|-$Yr%{$N$uG8^c@<;LU;Ae6%4urud0-dp3YkR#lk+TJP;{`RPzO8=@f8>0-Sw#5 zd`bX(f}ZIGu(F+G)bf5{gbp1!?OQXV-Jh0liP7gqiFECQ+e!AB4XqV)?~} zpvnm1qX@?i0uZk!D_wg8W6DR*DA8@d><$5nhYpGni=AbwVllsmP}R3eE-8KtBH4L6 zmbVnVRfPY$W4UhSKU9SOIF|oww{pP$`my|9yOjg}ACBb=f&c7S{;%E20sk8n;eR-m z|7*8$!2kNO{9n73ll_m5<$(Y4Sbhb={S(wJaf(yLKZ z`N4Uv>UpXU|90eKnmAkAhq<1YbJzpKFkpL9WI;i>>UTk?cIw9ksue4V#;x2B|U~g@HM2X0m;rx`-BJ?a^FY0T? zt%OSzIbDu8am+C7!E|6UtqJ@H4}}M~saEsha~_OxpCC4wYf!3Xt*7yiFV&F__I z&-0ZIi8vB!R&a~Ot2u;1fkxH%@F1~D&~yqq;pd0rQNng=lCU%%7^v){ccAON2eG9J zkGoz?7%>OKR^exBTY!X`8IxKM-mKBt@1zs;afh@D%it1)OxO4_17ap&GQ6=Lpl_2u z%g90-KTvk%?=etWNeOch%`iuo!BiM@p7Km>e>OdGl$Rc@GMPL!TzD974~eioG`v`8 z3d5~_B@lu%PtJAmRI|vxi+(A6uu6UBE3%vM=UG1!!0`|T;bK$R9G=U@7|ZiQxPs}S zjfPO*7QDD)&FVXkpKL1d#-L{rDZ2QD3S#ix&!n&{lPdJE?0p1nfNEERZ#setuJFSHVsY?NGB;5?iz1;FT$h zJ^?H|gS6%;Yzm8~%9(-4PMkI-*EV2=$xL3vPo$OgVSQCBTkoZ1P4=NOba@AUfO!>6 zxW;&i(rT6BiaC+6y~dB_lR|*P$%LS@er(ekKZ*6CR%YO0T0Jpf{u6OaVJDfwoOtMK zNO{uAD+lZ0^Q2U()fCpT>oHa`62LQv8o+XjZ#~D9(0tDUGganLIT;#l2A?|V2{3Bm zfGtgd^=?BIi)SH(u&!e#43W3>uWCcPV?`j#62k}Ut665hAu}&w45)3*0{1+26VAD{ z^FN0B6ccCAZjmP1!~LFSrGDMxo_Y_3v>_S)5|W#PaOIZuqu+Xv;j#iD)=jar`ZogT~8+yJh(P?}MR!ef3=aJE+VMg>NAhFq_&}+pO z%H?j_FIlNMau{Q#E=x?l>G#`eR%6rpa?X&I_(Wd%jAT5RuZU)`2k2_vUX36Bb*98_ zZzXI9NA@j~3yJuAJg`kItSM`8elI23LK3l?$~~sfpG(jCCqi{mG2B+?K-&6zNQ!S! zErFKh`X%wV=aX?RVH)S%>nv2LdD^5^i#!3jYiKy_NTMK9x_nEH=2`Uou8;er^LOKh zH0tB{g55}&tCUD)FW@ym1OfzFK-6#dXDaiJ8;Y#@uju2qll7&Mk_FtWhhG9tN28vc z)m9Ft`%likdUuCSvfh79@d>FBobrYynm~#NlMi*!c^_PM2w0eOztGF7DGJO9zJJ8i z%dDw2FI*#IB(mU*9&Z=u-!K!CWqy=~nck7nI*C0)97dZl+f|W%uweU=YB9QxM=+SR0@)6hM2H1)=2C?Zz~pNs zh+d2}92aCmh;Y+m+9q)TL6fu1k03N8j1!(3|D&L+sfu@mlf2$SknXpDAYAzah|N_+ zfzZe>e+<{;{Q^`l2UpR)H6GD3abmpJw!-Q%X};)3s`C}mniOV?W3gL|m~3~X z*8DH3cic(Z{@##^Cw@kwYtneA`MTe~t)G#c6BNE4rl(~2hCe|9%DXNx!zDlBrO9bO zRc?REC)p)ANvbit=JFqwhTo+7RE&2wLHLKrkIVAtW!TpyH?VIjg@WWK@9qkkW zT(bjX$R!pmAC|{GpE%m<7+q=NYUA4q0?{n$qm9N{tQ`bspSNX3(h~4Kod`kT64zNa za!2HtGtVSOfLzpP|qlF=A|!<-q1I1UUQE$0^rW4u9tI7yKq>-}}=$k}JMJ^G#YHXukFhnrGe4=~uaT83#f0yq0;T6L(pHH=^1;8Rw?_+5E$|v8rA^mN)=t1+mH#(fG^k&lQALxBjnWKING6 z%ZN^zwLv%CwAOvieqz}gw_G3QDCQNaF{i_BZit8KS62BPm_-eOSHiepa06<&&geFzvxXqW#MW7 zYtL43a?z#mKlMULd3ZQZ0h9pbs@rRvYpSnGd=j zny2gN@XVsHC&j(}2p2%%Yjwz?L-rgd3w^+^PmlCUo&m%3`R0blmkx{4Tq{e0^D}Fl zSms?NVAV&8`OrSV`Q+_5cJe&dbd+F$eurTsl2K*+sNB`6BYsWWWp7RZu zSAK>rA!$5p$la_GDD7dC5?u4E*Lw;51DF@E)t&?a^F!T-z@I$uNPx1jNCVAx_XHH? zLB!s%Cfy)ZUejA6v>wO!iW2>^owni4uADhS(*<$yz+%*zk_T5i-WlC3F~b7{d~QFA z;k|7WG=o1$FdB~p#W1wVd=btDW4gQcZzem)8>>L{ssKbVuR5Y3k~-oX%4xxS91<&= ztuaVZn82NExO@;O4=@Cg^0Xo**q!xpMiA+jxaL(ccd{H>`k>{5s8ASoHCw6@%VsxD zJ4^+sjS>fb%lRPA_0jSD;JkAJ^F=JPb9C5>Mrt6^Ib%pR#aOT^?!{xtZCJ|*eT`qp zi`}vPvJR!GkK!e+X-Du}t$grrZC86nR#MRFfyKV!@eV;2FoG(((q8GAW^&UP4893H z9tnzCX)0C2&l>1hw2sdmwKnEBo^xoSO5db4dd(3znLL1&4@rd9J)q@-qZ2=9`4EU+ zKMk-14IfT~FV`F;%s5s#R&9##Y4L=C4jsi@K#p-^dB|qri!ZdI74{y5hrlX>q1Sa% zMCGWO>q@|iWkz3kj@;xAL{=wjUGY~Ok6nwGfuQ&84A6;~X!4~>WDs#8NNPt7L4B_` zx2k6Hr$_!(Y2nS2j$AP-?)q00;^EpDm ztDrQYh*r-zhcm6Dyr|G6FYwmd&ZfGEA7L2~llHcJfIBFKU}YjBz=n3d^$W2u-mlMl zcSyRh+48)L|GThIEcV!)NYLpni5|d^{<@85RN>4F@mWts>Uh=iwi*ri(myhA&y9)5`MNWX% zihif35UUj{e%ATzTY|>t(QnS#IUI)mLD4VDJw;KCr@c}1 ztfjp(iNf0{AB|2gM7SIgKB#y3rL z-C1g<_r;_V2P9U|Y2389?w|mE*4UFKc6G>TSW1>t?1&BDAVbyfLWhMSZiX-Jo}fr18S_-D65dy{ICU$`Bm0+muOUq{DE|UPp+G)a#}9 zwUizDr2LIwO-E};R)2yprsexmgl~y%;l5P^G(D}AAZRa9xkw&i(;N#dMuEoz{M|Z& z?rj}`{pn{+CtfPz-^AR^ zk$;8M0h4u}moL=u8b5~jsu+x^R~tZ5dEU!+zRUODdOv%AlxL$Ry|eSLj*Ke>Ipx8G zHJ$2jPO=9(sIp)3U#|fpe>mmOP(J~}AH`QliEiJV@;qU4A8lzXiC$>c{w=27fDIQT z%omB7-7vtWp<+$F81Ho}1mf@ke*^IYcpK%$Iv{_I17O;geDi_ z`9ER5(xl9o&xiidQcFY50cq!bmA{Q>3BckNVOlbTX|VLA#FqvPevlU6Tx;n?5TVPb z@S3Y5kYxqNaRef3`iaL+k|T9sm%tM4A}RYudR9%^#+%;dRmcF|(@1ayiIufA@UWfI4L~s)(`Eg66K7@M-d#VSr^crgtRTSIT??B zo%;Am{-{SFT7SyGmGceG7m3J4RtV@Q@b(EhMe19FCR|Qp6clU-pPfn92TQy&P>h;E z_xxZN_`Fig2Dl%ps%JH~gS34wr)CsYIlvuV>M(JK)8R&@%32$V?JeODxaZcY=C(*L z6N25%MCI#a<%Oy}M>3**AnusWu*OmJ$OW^C8#EdCBB|E~D7NlkY9?~7ACe<|2YO_lPf?yc4zUE~( zqzT#TC2;HwJYm%|j!8)zseI)8xkn*o;X1tj5&s}|!ytX*jryF)PFfCTQvIo3w) zhYd?s00;O`zVJ%@o>=_YKRWI5k6O_K0Y9JAF$FmatRI+XF|?N^6av9xM3Lj9MuwzD z)}Nsco9&+sjVxQJmN7nxPaLd4%I+fNOiWyhe6B?{2&+4E#(hh3uq)y z6YJi+O((QA{YTjj>mTsnrV}o6Gs^@I0MK?~{8T~x{V0u)<&-8rG-V2Zj#gy(EZjQ> zC?#Spml=TPT<;1vW3$^Q-;KNR$omzB-HF6K^s`;? zBX9NY91eR;w~z>(1rO4JvFm0t$q(aQ7_|~Jyay=8oechQVLx9Nq*R6fFr~? z(1fDSBm;L6wtxHsCs3QZ&fezVRutYhrLEa*%zvyX*tj}FO_S+%*G=j{D+(kXFoThfZ!S2|MPVd+ppfnQ5Z+Kb>(fH0m<@hf}S4?{ z-)-!npn`jfS&*XSm`TrooIu@&v@)A_Qk2!b#`zfPw7V4$fLe4eZ9XEq=Wjfn-=&QY zm;uaaGv8L!t_W`eRhHhdBW9^Om(SNSRGT`qez&EGBJ@emyE#^5#_VDsJbGq4nc>b3 z7pkwdNE_~bQg>S_y8%jIQuA%U290@=w6ST^*ng5Q$b@5$2s(4Z$bW!BB$x7T7i+f1 zO=DK8N$c6m2Jl&ryT-8kK^3vBzQO)BZ`A+WP6PgJr=ifHUgr+lX~-EmCOxHy5!$E< z`!lLOtb(lh=xsD_J@>3RJ-zqRBk8D`>oK-J6hJ+9a*uZ)X@1o*&9c5nsp#3?dhWwc zO-Z{5-YpA)WuTmUZBF7j%85}V5r7(;Fwai+T%^C-zNKmylEi?&y_*w(?a4X)r4$KVh!>>=a&A~pMU>j2}$fv`e_X=dt`O7nJGYw^g zwnq{X-2rNiOwddt<$R^3d8#{>NsM}B%`BGt%-5-Nd7!AU_;(XN|2V-RAms1yu&Pb`dF5GS-OX*fUCx=S zUVpvD9uuU^?^<}%=BI+R`CT`xqsZ6e&Cuum;Z`ev@9bwyetk(N9dj~VALvreCH!U~ z4Dk)jhE`x`*S0p@>o^SS3cr`P#C%}oSI|fofhQX7WQmqXd4cKWmZar_mKQgB_K^ zsC}&Jb6Se^bP}7hsak19H8f_8yyl5GbM4+B9QH+8Qak5}p@C;)M}OL&S$bf?A?O#9 zmolAY`QCVr+e{i{4Y*Eo*1RL~8d?yqi}MeiA~kgCA7IOQ`+(JXUH#_pa*o4HFDPmg#wn%c`^Z_7|u5 zp((J>7!O%zd~VM8LO{FD2lZ$XYVo$-j%0_|F*85XqW_Q9)^;#a2`J(FO~A`Q#{K|Ub`FH+ zn&(AZhxh(0%oP7dR224729fyEGX3xs26X}EO*O~h^7eLhp@f#cB3_=y4ZsBJ&?fIy z_pZUXt%`%{1QGSe5AWYN)a!zRO5$sYxFOLrKU(gV?mqb!p>8r6xjd()2LY1GI!4%g zl>v38ot#g&yhTSXtu4>;s1_OTo*!l`hW7Sv4tb zukHC9pMN8OpJ>s3NVfnJW&%Ka*5YmCyy_!d^r!}q0wJDukS{JDUiJqOuFM)_43W#l zsG8VeJ1&s>K$o>m1z7(xg)ptV#5OY}UqcX*FZppo|HAL*@EekUmCy>(@U4|E8?RLZ z&rV_7;ycW>0y>F=JiZGf9+Pu(J%%*0dDXcOj68kLf>aB;Fzjan#1XhNBC~_6`HC+u z;3MzTQ-ekoJ`=)Nqm1mlX6X%L9+k7n^nE4@GrK3RXF7&(pJsmBN|5}ymG~u)ZT0Gh z=$fiXYXm}_x9_h@qH~W*T*Qp|&+ACOqQc7;e`V*Jo;=80@DwVe^bncL{-Ov^{B1;% zonr=PC6989ty*H|`fjdqDAMdY(Az5=w+M-2J-HY&r9h)#z=LT!oL3IZ3OvRZCDCuNdA%iXw zac0pYY!?y28a}y!a^`Fvn-8=QD}pW3H9tLEOk2)+m+z5!(+105$Lwn;pBB<{J?tTj zYSP*ZZJJ>8DeAvoJ*9I0WLpJv z{2YvXB#RQv|zcON)G=yYbQ&;`mwC-;&p z1RAQ#fBn;V-v%J)+i{tC=`IAa*<9!}Wt|Uy{r>d*P8nF-MO`JJ%*M9auJF|h0 z7EHsS=Z|!ObrEmGmeJCwby_yIjxf5K(b~Q6$8>%$wZf|57Qc+)4Ss1w9YFp`+nRRf zugytwFuem`yzf59aT`dPnBtDrmb18;Z@zm$*NSP+4FKL>!h5%5dw-AjPGIFM%T^7? zF2Hk%GJUPk47SD}P>jz^j4y~I(K{GTTk(ZJ2jL~#QBS-8NpxKS%O&+E!@fFakg`C% z-b5_Fv?oBl^iJ7X(RPmZu)(jzUm?4iZdP&HO|4~w!&=QW`$ASam2>?kY3fCALETm( z7{Jnih5`F20n;DleM0)&GHnEiGM62*Rc>k{u>|yv&L|Z9f#<6UwOREYYQG*CrDI+m;p4YO z1cu^{PN07mmF^R4L>0VN)cm%Dd+@A&YXM*xsPeO@tg(VoryHeXHa01cbzvABl!dTU zF4$&QiP#X6W=oxC)SpbwRNxBp?+UD+(_4)z=ZuQX-?HfsY>Zz@AQgnjzvc`Y%PIe8$rajp zM~g+Zdh3Uxr^7s7Z^pT8*+6vMAV?c}=G&713eH6+pgH-%!P`%f^y=i1_ZL*823`|x z;=-%EO(EPJvMrXd7zWcYx$$q>_yDy6=8}w7*0PnupcsM_F5Zi0H4(CW#@polJ&m`nKXP-7I!JZ-%18LA7RQ%E3KUaF0vm_z=qkfJkp$s0ef5pO=KRifo?}&UA{CR zul^b6q1!mHE2s(TY8!{UqEBF zAJ~jzZe^@h9#-$CZQ!w<)s_rVNAglX^Bk> zI}@HZ_y%`FClsY#Cj~}KE2vwsF97ONS()Pp?@z3m9;NIwqDU<`;Cs;E{}M8GdwkNX zT0_OH+Wu-4!*gXada#~kFrSs0d#5~26ESX-I{`G1TYviCsj!qva8Vi)S<$(htBf$o z*)ZkK-u>m5&4U66)i7CEP=8ZFWGzEo$c506iJ#!$pWAkTZ)1>@f)Klq>gLsL#}qA z*Y@AXR%-Xv5tYaYwpmT5DuH;I6xT>xT_W^m=cRI9GGgf@cP16o%Rd2WRn|Xat$JZ( z43#aCE9u_s0PLy(B6G>SQfLx?Y5{bOpu6`$QFakPti?bHdNTX3w;MiA#n=iiJn2ayw{q5E6wx1PaM|bFs3`gUrK5qiP6rZY` zMh+}qhKjdsUI5Y^dD_fCdI0V>JwR_wef6^r1IDKmeI~7{Mq{6Q9hG;AYNp zTdv$avhL;xMmVA93fz_y8h20=x-~b1PRWO-#fw%;gnMC1fe}hO4Reis33rs2Mir7i zKWMuii|v_T_uj#T?`+&i z;Ez8%0{eC0|KJh$St<195#VuHm*8MXTMJ?NF?vPVT<-M^~_aJyZ-bD zXfxaW=gk5q+8>*R|2SCy{QtaJc$+NrC#4hMGk8{k1p26eFx{#<8H2M~Ycv5jgIh28 z;DZ3iY(GgX3oTs3c`fsE-G#ZL%2YA&3RZHIF0vF_G_$)f!LuHsi%sqE$CI|j9_=wH z!-yDlL2O`&$Xw*_77Y4dzE81@IJ_s+qCW&g^9GUl z(eu3;9MQi1u+3W>%6e{=@^l>%_^cLsY^X1aL4Zd`im?0n20km|Yf&-A)f`gG$6uK; z-Y)DxABcx%)RJe(n9^fGT78?+a&}DoGs2xrdZ!95M1rD_68E2agqZP2IzgN_q`Y0I^WKB^;+Zz+X5s_yZ8X(pTlKac94;?A`}?f^95f_C3o86MXy|YN4H_uV|8CHL1c`o9mC5mt z0p-Fe=AtHQp-=SbiJMl^UE2(HrUVAlb<*^%ik-gC6NV7$k&icXj~~p3>iSoypb4Ns zG(FU0WYcwTurB9G0mm~yFU@pn#e=spWg9VaR*YUz-cT<^$i_x*EM*1*22yTP*^vNJD}~@h zyY1m}S*7gJ*q9!g-NiQsXaiht)xfZZ*e2r1JYNXj=B7u1rLyA~td|pS;V+@DaCj_yo=b(-3k@?A6Gj3_4O5 zjE(kLZbVOReIDXNe6#y+Fac2&;TQoA!XCypV>{~lc$pbk{)my#*OqN72p*;E4#ah) zuJqjCEK5rkj?ojoQ^wjRvKaZ`O@yUP9wE4T&u5#snv($n~1_hUW8 zg@#*&+iHp3yvad=ge4Z&HeuLbisOKjk#?>|b4CVTH0tkmjJS1+Q{tMQoPv^Q`x#?T z?bN`gXJ{ITD01NDGc*C@)&1xHkG6a4ud`p*zTenr<1{uK+l_5Ew%f4bNYbFOGh*Ae zZ5vHv+rCCmOs~1toS*xC(pQiN9mj9~e>dREGZX{h%akT9?zuIgPIA!#d1xL_>br_o z*F=5WU>?t>S@R|K3kjk3R5x5!jFIAtSMG@;b0k$-5uCI_YVEW4KVld+?JThTVl$6ph*} z*Ukdq*=5sFOgd#dZwa6IUh@WLR2ekXKDfL1+fcg^XsA8(*HHV#??dhW@b81(nhKv% zzdJ8T>!lLa{I*TInSmu_@lo&DM})zDBjc;R+Q+ZCS{vIm3eZ+K1>bh3aW7%;y)ELu zcN3NzB54OjZhowe0&)s7HgUTE&`tq&6%?JUP-WthbX07M*dN%a8htTme4)@=^gm+3 zo;q(ZsqjuEW)$;MdbT)Zhh*ON!PyfYblmOId*)tq4~p|m8LUvc?jlFmdPHepRRPVf zYK#`h^J2T&6MHVE-+wkd-CiYTFyKYp=$rCxc5exdeaW}da=svD#x8;GmnQ;Xb{Y_I z8?5hy_lLQ~x>v{#xlJzL(G!yU<@cl-HrRbv9(&1qQ?^Wj=WkaXvnITL=MTB|jSML` zf~3?Za=Gs#w)~e2VbD@L3*`A}N;J))r!;7(y&e7XC7*szHWE&f#1W#{Zn71%F zY1hVaX#g@TLy4d-hZr0wDPC@}2gZNsKlp|^@AKdae6ohYCpCDa?}EkqX@IBp=5W!e zQKbv_=M&TsI%tJm?jE$lj&AVS0BrBVBmp!ZkR4Hnx}rnW&KXbo2FL@MjQ9L-vLR&? zKUWX4yptIwWY_DTq#(0KN$9(~vnTXb309Rkbdoj4@#)4hbG(J%Y9@_Qe*HxtG+17< zL&Fdh8~h>=e*Pj50$%PdGK9FH%3<(#f}8VQNMFFGO5yZ;_5*&6wl~PuLm?u$Y)k%H zZ9hLLUIof4!{P&@SD?^Iriz(MYTqOi1{H*LGgmX{ktlcgpK|hj(!TO)ifQWoEMEyE z5JeE%bdc;-T{bjq%HY|S?@yp$NOk*0If7PV6%hj(qpGMHw`63c``R8 zUo)|LAITJ3#&L4F3$h;THsV5OInbc}uy}3q68E%LMbV0ytA?D@OUs=f_iyAJIKHTW zyCs{Ao@4qI(n;_(X0g-hJ?-Dr83EeT-bcziKaA7K9{`^z+rHvXV#{*Kx+GaZ!}pDw zET0yRl8>?^ko&9E=(0aYNX`JiT7J!;r9p1b$MKY@d_G!qcg ze8K!`B!smV2R;Y~n>RzLVJA)$K<%X6sdn>wim$EwJ;lG+4@sT@QV~Ng-u>EhZ$bRW zB+uktK}Nk~#bWU+PD+XWBYhx7JPFq#xQhH%GbV`pn-(_~u6aaV{EcN(cExH!P^_w< zk9QhPBqn&4q9T#mnz)99vo3>9^otLE+4}^umG&iWAIf8}tsCJB?D{HmGjSdsTN6OJ z1#R=@yCa~kFW0oMDrEItPFWovW@xM81v1oA|3?%51WwkQ%z$lfA&Zmw(4TM?dsQE3 zcl^EryW1m(hPsLQfgI!uiEYo-xb5d?XKiI9MG{Zk z8?KA+#~^~=7mW(`<(M&?Geq;60iPhD5p1-(JZrll78|H}AM?(32Rw>p>TTd(nAdbC z^hGAAhUR5q#V~4AE-eJTGRSH5#Xs%oyP0Vmb%!OSCPaavJVpj6$`4eb;{CPBuO2@@ z`z~F8cYBViM40_*^3#^@464b}F{prVX`!hQDPrN%7YXd~&`Sbbfca3+%mB}j;7rAl zx3Y0L33bP(8Po{mW0BvKl(2^dq)60a>`@+~6X_;ZwPPS%U5S>O!gl+5_~ebWXY1ox zuaQlr8uk_?H9?dShSULH@OWSLMKpJKSws%o zg%q~h)w7@}g+3T4>9F1yKZ7=dI^ZxJG@+6YzLcl`Zy}u>6w=8tehcY}?!Slhw#y(# zm~U#YD6^>m8?QS+GJrV@Cf*fUM)5Id?tD72o!#~I6EjcJcDXGJ>V@THn-5!vB`^&J z`n@uhIn~XFg@rWZ^MlI4lDs)Ggvg##d##-C4q+{Xqh0>_L3QWTFktBN+F_x3)M>|NG%aq%b!w<5cDKTN|>3aqiLuJ~d1a{t9a&0G zOf4NyH8h=4M&&&K8ENd_C`DMDCgck~x!k>(<5hv9200Lu--4TB(Z&)V-Cwb-R zd6BmukS8h)y;gcE-cKD*SjYd7Z8&HCz|35qmSR*>+0JV3TS1OMJ;ym*mO=?k{?b9a zevkd`rPP<1CIDZsmTAi zg(DCAYT^0zzqRlxahc*jTDSv1;a3bl%)mX_{7VdfU~bW!Z2OxSUXA?M82(?j@ORFC z)4~ru{%qlzfRX<&hX2vRGyblHn)XIsaN!CKEnsXjONgrc`+o1O09)W|Yp#HbStym~9)RpbCk7X2$ zH9tZ>ElQx;^i}TsA)Mr*bU$k61D|^jGt{{fMiRoaM1UxrIa5s7MI{BWz++|Y=T0Dr zMroGG?%0Ya+ZZd%mG;#gMj?wQV0bwWjJxJ1MiAGk#SXZsXAH+y0=k8ROq(KF=2yMS zSPXn3IP_VsJTicscDb=-QVNxF2QnPpx9V?f(g;=APF4wTglQJ!t3_ad7!{k9VBSBZ z?TeoEJ;EK>w`1hRRjp_{H;nRdhN|dQQ#+y8_$|#{Cm1r<_REwhf$I)I>ctcpGZqpJ zUhq$s@hlGT*;!)NX`QQfQL z`j@Ki$m99u=0gNj5s|YP!k1k@i>nvn&wFa`-7uK($6^;<8=_W-wg!#N)imy^JEqwehT2hX^+kS7|)Ct9+(l8&&{p}F?4yA;<+Ri4Hi(TvtE>@>6S-0q2 zg$BMVPZfuhhY{|YJ)r)$V4II9q`u=Qd>G~xM!XiMh5pnHh%zcFYc5_Mzf!2voGRDT zBT5i^iXBgzU>Di4tR#JzA8HHL4Z1G@}(B>g*Y;Hi_ZEZr@ zd3M|XVGAUF3yp~?ZsjsEqPM`s=mdLevT{)X%;3jF=QZ%&>5zF@YmDQ~Y@>-$`84o_ zGoDasx$1*H$8**fW4=wr8-m!_K(g^o*PFF^!N7gLi(a);#x(heAy^|`E4P89mZ+P@Jac$LwaAxveX2_h+sVnIo8s&7jK!Me+NORA z4UIYr%|od^MWV zxp;s-9f6$ft>gi>D{Iur<%N)^iG@s7Lm~%70(GN9w50XVl#GWtEh5t|84mA2FZ-9P zsMqimJBkY{VtXPjjcxiEzhRrAb|V@lbXqME_>s?saPEh*jQ@%^5tRaOvmTf^SIlu+(PZ;V%DH+#0hAJ2)9%u7cf@R-tn-wrhkzh z4lYvu(B8spJ@l+=jn(@8DAA>3_J;df?IGH^!)eAc%p7qv?eY`JY=sNMXURaWwD)(y zVo<|Qnb+Lnt3Rn7AvgpI$AP@*nefTSB~e3Y`P| znx)hQH)E_#3^@_YH4S9WaKv4_+m zFbuOu$;h*@03u?DylM?0g&@U#cuaIFEKQk8N6y%e$ptKV3W%xkBt7NZdk4^216kv>km~$LZi1qCQo1?i!L^= z|SVDQ4~2j1uJ*Xc`^ zFdD0|41sO7E%~>>&pn z(E!K+KW_7Chm>3zimVyCOXq1^(u!4;>NTy_+Q~dii{%SR;z`>A*SlhwObwTrou&?5 zk&#H@Jj#0sEj%&&4ZLB#t?92M(TO!Z>5%B?-f^v^yC+~le9_e>3V)eU*HqR(3nt!L z;xeJNvFmtKFdcv$4TIglU#G#-SR%hhu$NCaUL6o;e$&sCXU+KQf}@iO`h()eg8yOm zfXDVEU$kgjGTO8g<&QBlqA?lWXBX2L{Pq4h$W|k?yXes?df9HapYPb_Q+E4Xgn(R_ z(D)?H^aKoc`#P@fGWzx_9iQpJ&#>#M8H#s!(oA2DK9RI$R{$l4q3{89c$-~DpT347 z0Azdd_#L4TeCzVV8Zwt6y$u>_2817)Z#eyihkUBOGJJ5cyefoi9SGn3=mw|NiD4ro zd~0}6ZlE{C`_1C~`w}7@p7=`{dn_OURa&PX$xYvib5bw1x2)I-wah~$n`KM z5Yh&~$|h~yH52782N@-J;VFdEDL*>j=mJyc--jFmzM3(4(>wBqF0=-S ze}*0lBCc1jK9H${$JpQgA@=Jk6p{F0fy=0NWA*xMQTCj{?KRTojRa* zZUl$qhYI81;V|dGi&X2!#z|n;2$Tqb;{rwvoQS&g>&#)vp)uU0fPGi>%(;x}mcX{! z{rY2)5@wQzA%@H>&Q~&GYgv;pS`ldwBjJ1?$7p@_?ufa#fHO8%>VdgmBp@fxv&?d8 z%S8HOtAfi$6;ER@*?2pzL@aLG44;??Cpt@nmnX$df`-5IijegQT82;>Sp%H8M4o|z z9CS#bql?lV&f*k9?Lka6ycUacI^4peIM@CF+z}}$X8-NFqO~IaI}$eyux=Cz2w+#b zdknYw&|`&FGW#$b8_GN?f`vcwF^GF&3ytI<5wQ+(wiw|+Sl9QX(3H*EZbjU+y$+8W zi>>K!rS0-J!@V&MJc~M{qy@TGM(t3;^V4Xc@=Q-?Zfit)g=_!RzMs7Q)-1EW4=TIxoI; zQ6^J$@N+68U-LndhSTu(D?~}Qsb7n@JUgH=;5ojCm$|@|w5&vIveYkSX`Z!5?@=diF%M2yc+$fgtLH<1$1)p~b(&n4G`8lAdI4<2)=e;*w9WE{f(io}qv zdnkPqF3FSnUTi3%vk|Fiv%APA7*+ymo=YE0rmckYyAk-05Kk&`wHkB=`{vD+@XeJ` zyD!g9*mcAJjo7j*YOB*ZZXWlPq^)gd+r-P>;=ezS_{ZyrffU#O&#of?|LQ!Vb}{sC z&m;a%*AbRJ|L!`X^?2#x)_C5Dl7fnV=1Owo5{v4}WPXZ601#cY>}!H<6~I@kXdts2 zV!_Bt%@2(RnacBIRbmX|6+gw!Rjv)&$D=nQ!#kyS7BOgsPI1CCyYaD$+qV%X>(^u1oPUO>xeE zdB(=Ru!OZI7|as2s+ph>IG&A|NV0G$z1h?z18&}mV4UB zYv<5bqDKqpLr9a5H&%b@a?^ZIb^uM{$YxVyfImbI8dV@?EAi>TT1O@Jd~I8pjZl@I z?ud7PnJ70KoOxb*1b`;&gzq$@oG@)43x}5xty0ha{{kHTJchu&$qfSCLi{>~D6|5^ zE~N|-Y2;mBMko^0U5E!KKu?0L@;<@?nB4&{m-QtI0#wbIb+s0>c@wBsGT((6zmvoF zV80kdJTk&~;4RlJU7f&!zW2_EbOu|@S4Uy7@|Iat(<_V4WiTPhTg|kef<8|M$_R;Z zYEo_mPgG)t1e?u%kxM?LIQa=T*&_f%#xE%<@cUhBHuM*Zm@f3E@CaL+n~CE zAHS}Vq^>T&K+_jA_9`kI;m&!ZT|Ybu8PD#x$(W&t_VjD|2_ngKl#Oh~e9tAb!*~Z~nVY03U_vL*0yBIy{z!;&L?(E*ZB`%gk>U1HvMYU; zT}O>YX@*^ad%&v{IiC;}k$maw)*`mCQ>s#n=u9`zKF>QSFkvHj+`kfO*T$~^gZ@Q< ziOpEwD`{5c`UEIH3q=cHMii-Nwx8Owdp9x*J1Pqm_vK5^`C110qCptGLN>04;CXThj(c#wTq|-M?Q4_=YH-3xI7PtXSfzyeU(_R-Gnm@s8O+XKm*0vK&<7js; zMcKSY>SVNzMu>RlGNHdHY0ACI7y(_N-s zjL9p~*Y(vhb%TzbAjTz?OpN<&HI8n*C6%4q(V=X+u{5WAE3(19s@82eodIg*mW)9R z1iOS(Ch$V6wGN~}luSBGpZhA!i1-ROFVOgEVR-qN9TwZ0Lp`@YM@@tCat0}@zrniDqD4~uXaRZny8;mkpD>vK zCg^q!GnfQpTKtCs5&9OSK!kXet^Te+Jfpwqz1U>2;rv~J82dL01l_-7ApQph0$(GE zg$n}SRHbx8J2Xq|K7ds5bPR&2F|DN}W`xN*9vZ|4F* z5wOb!N++>2@I!@z_mZf8C=h9`J0xp=RUjVhKnlb`(*K}9B$)nHfj~L67Ek?K1!DS= zkf*wQlpbd|7}HPk2zMCDrtT^dLswS*ZO?rkOM5vS{k@EMOxZ}=CXfE(V!Dmj=dGcA z9zxhMMT+L(kFJg<2&fh4T#&tn5~Jq!#iRw_*2k2~&(mAw3es5I{BSs%#j*Q5z`TG+ zyf6#^^%TdsU@_ih@%cO&XSnQrxqL`#J6(!|@yp!MPwq_vzY0C4RK8AK?mzbg7;)Hv!2yc-Yla%6|{{0Z=o~T07ggSs| zQaY29DlH`rRktwyYa@JYrxx_V&-3+}Ei1Jc+i z-x?}ef1VI9kp6}_088J)V*&mp-Ox_$eOL!4zP^04b*sSXMcjEyB>8P4Tf&NHtF98Y zPZ@7dVP*ReQRs;$KS#=W?cLQD_K7iFSFUO!PZ`{IRlxTM*FEqib9<^Y(0~Osbu>ij zyk7vDSnqRkEfHTXvK#cR>-|p`I?jzGef+@T_wp4^r_$3?c4 z6$shItB9(fltbqybWhl7=A%8gF!Y3DKB99>$Ilg=(PYHc-Y5=MHZ~&Z z5=azhh%xP^gQg|+ld&IX^;vN2WZ(~Gp$x<w|O{s~F(<5^D2*Q&a#+r@U^ z3p^YOyJ{*%bBWXio5%np&lO&`-=Jkw$yE`e6@AB!IEm$E#mLbxZ~*=DI*%O6JZ5Y9 zNscYkit-Wg3jsXIyE*8Cad6U4U|4UMqe)`<%z5~ML=K2dC?4TFx+aY2`d$9?9!MGj zz;as{N_53z6sJX1<44%%`MJe9tJLi39z7ri1T+aimrCrMUlRS)L97tDXb%J)kQ-f( z`hma$`Q%^Vfy<=dL0L)Fs@Y-js#jC%^olHAocE6%O@|gJ0~&;P@?`}`!&rc(*5ico zUFfZt)EAcFmh|uBGF%9?R^eW?c-=R!x$~0^Oh))X-B|3Xo9(5fgZ_ z28B$}0GHckRu_l|16919>eL(66IM1^@cz(jAh1Z)%?l{#j7S5Z&a-*sF(3LE#IltU zi{5t;5&eBOXXRU)F@?0_>>QbpF2VOY+s#I%FXPh-YS*RYvaQ02tRJ}9$t1uerQZOO zl79ksM_7-`NFF`f@?u%Z3axS(D)LpdNn_-rYbB0bHwEFe2fWgc9UJvvJSWw&Yg@J> z9amgdTBx!t-jbpj7#e?E5!LJbpmp^jxw*{yM}tkRfuF;Mv_|1>_dBeEPNu;GkDulD ztu*|3nE99xPa3VWm@V!UuhCy0B3`CnnH&W8$Q~O6c-LQk8V)0ohbWGf8C=lDiGfH1 z?HjikJqw@#9W;h2h%hkHG|)G|buQH7>+oA4-(3T9-8s>i%?Z!D97xP6qqKA=n5j5I z?~Z8Sc^NSAi*x-7#Oh*YDxNm zN_xb`ju$7lH&gs1l z1#=7!Flev7FM*HJ0`d>K)T3doLbWCCZpPk`R@Cq(3{3>CFwdGy`7}yznsBT17=699 zOR)G@e@tzzf`hWaabktKNydP3?z^r`Lj%vyg*z4xVhXGP+Bi~1VSS1qr{DvoBoogz zhr6bjyr$%+TiyjMZpCUyfNh=0LxGLxR083p(a?`IMiQk6-{KI14~8nXWcTksK;X$gY;hSBe5f?pu`bYEM3CU@?szu;az-G;rnG)r=<@T`){{6aILzc6-{<6DS~{C0R+}6CmV# zsW#-lmEx+&arJX|^==}FJEKI3QNtfHO1fEniw3a7sK1}VCU;4H`H}TnJy^6YIQ5wz7g`?NT)o@I_@0K0P3fA>JD5E?*)Gp|r zuMI`2$kZ^Ax_8l_fAk~MaqsEpDOC3JWvYb)MCv{nv>BP9-=CIPaBI2W=0KG(=v7s0 zQdFdEnhCS$EKT^D_IlozGWePU5@rj0i=6eyR|QpPW8hEe3!`!8^k}8HAwls2fT8u{#Yg6V=go1HC6-kO8A6{znR><8Ka7HM$yiq5W*hvbnvJU50HO77k~72`rzBFOSYEXG+wOC zfX*OyLBQkPAp5+IW#nT=V;f?*dd=y@`xE0v-?R_T5eFp@fRm&At!9WvAW5KPhuB`y z98Y8=V{+Nyg}3;8c=_irU&Qv5yw@@z-%n%}P~JyRTE;eS`jBL&P`@MWJ)B&jKLz`x zYMuNfV0_b10}y`X*7HJ>=-gv>(!g{ehy_1wgNdB0l*Gs%=4jjIskbewsW1wOgsZs z<*W_kv2vQ!eTXz~HQq6%TGgCHt+iz`)1O)nfk?hnx@Y?-G+tD%Gr2KApriTu@f5kg z$ZC8pfc8{Dzy&btqO)3a8l56bKVMI`>{p23!dQ0zX@g5qw)yq5r;G!{vx9ACGvNl# zt=>^6kFDN0fb6l{DH=%$o&rZvuhv^#Y(9ax9xS;2YXd%g7?zF2QIRbvZQZkawe(ql z5r8}r;jrYs&sPj%AL(Hir6ATE);Jz~2)|8EBzOaYw5sGYSd0pMO_1e9oz<}Ro!iel zC_Br=hc&Q4j9Qz#YAGV*-?JTgy*6JH=P72xEJFY#=nR#5vHXDa4uzh(4-t6PXoO#FQ3a^hkHiq#W|9A4N4n& zVDj!gEcN>GwRrbRU}t#`;Ia53F1rn3<69ni1k5Exd<)Ra%A44Vv=egc;vdbD#uPyd zv*H(5mJ_o|gOzQAcUXPvFobJ_q39G9StqA*5K(nzuK&=Ru+hurFzgs59`_+lxuq@p zyN8uqPNVcVL8XjPi;DlwM}cUAw+LDz#@QYvgXA=Xw;T=knXqcb=8KIiE_z`sqhQaN zd|sjlGHZaf3uhB=Wcsh7hH@@RjozATTS#0KqDy!&b~7SWKh)_=L}4VrMQhWkgQn+b z6O$+?htMm8!H0hy>5oqN9+|J=QglSZ-%Qg@cA7vPeYJj*aT}dtDS(~6nIe0?HLW>C-MDl@q})vV6q#K_M0@-@oiAJlem`ad6?5|aU#!-b zeb1YwA}bhpuWk-jwG%vUuXvFFuF|@w%xPB#8&;eB_lf*|^&X?wMwaj|vPCb<qyP^5yG9Ot-F4}UaK3X_lja$WP9cZRTVe)6#HqP4anQ|Bw`;lWH`jLE zruz3YLNC!eVBijSE4?ptC4nmoM`%BWwkDVGSuU}hk!A3^+;Qr8Ef*?TN2n&dIPV`} z7@N%v;n_JbY_T)A7-L@9U2Mta3(AMcFtF_L!nXrw>Piq6WZTX0G{?Wjw!)Ba6AxZ~ zO?$qjpD^Ig^r)QW3EiE}X7&XV`yzf&c^5Uksl7%+8$Jnhux+86z&zoho+hUetrkVF zRvSvXL#LQRjy=R1ukBb<^lbUeV$Oc-TzXOohZ%39HP;l)7R((z)D%PHuxr%orHawh zxyIH-2aL#p!$A4-*u!uX-;_j>2Z+)S`v0iZNs95i_nedkZMB%+HSzXRAdhUO>a2%2 z#L>?zY3RtAa&R@1e`5`Le%*GQY1P3PNM4i3HIXtLRu!4Mjg}L=|CG)$b_luJ3l_>t zZ>^uK6|Wz$FFIedy?;EGhIi`;=2i%G{O#-Z_}m66!x06I%n|&{n9L8em8q&Mz(MRV z0|QF3eLL2&=qa@O4*uubR=L)=wjBJ=__bQ3xWd)Dyg&)Iqg8}YQwHI?&@YjSo%TBB ztz(KDU*T6fM&*kx?YYsr>NrzCoGwL?#>S-&wty+th&j{p*FF`bVarOWM7AdV3=*Z= zSwDM5NlJIM_Dk!ZdOJ#iW>c~3fM)LEtvvc>H<_AojT_Uf@CU-FSy^enLk{x65ih)G zFUpT;J2S9LuVJjr^u3%@g3>h7TQ<>G0$WZF2$-BxPYXdVG9N4iCF(ra>hH&>ytlx5Yb5(F(DDtV-k1lj2b`La0NAnX(} zm7I%)e2W~zYQ5RiYwYm1a5MEhvd7p9kRzi>GqSSs!MrlpBQBx5eZZ7!Qq2B(&o2l<8NV z!ESLL)thfZPBa$)YIIofG>&1@=5RS%KjRh-<0geD6qF5oO1=*PIR|6Jwb1-0Yth$C z&MYI9s3YQgxlgy@RL){wV-|s>Fz9#yC1w8fB-!%GOLYIOBSmSsXMwXi?id30>=`I5 zK5cfeBVXm!SF&kd2e!SG_DQV0T~+U&R^L^%xPF4T*^0-@ywx!<@lE=RK8q%Ljd!$& ziL;^h9S!BqnRdQ~?EdbtpI?hQ^RW>ZYsEvZH<0^Y?c#3Qyi2(!NFYB?;wg6kd553~ z0JjX1dWQ$fMc=o-pBgkUnuI1U)XAh?xupqrOMtIgor`Pfi5g)4?EJ}rT~84b^#K5s z0AhKK-R=_X^a`e6VSmpSxKf=%pYt<>ZFH7flv;kz_~xL7IA9A5x-5czPVU2DJzAI9{^O$dajNU#!;s`J&vnE^_Mu`Sz^>*Qx}cJ z?<(1ZP8T5Cj9EOTr#~Y#h>WuB-ZR-n#&saC14Uhgzry5xPF<|5TB%^Q(nFJ{DF3|Q zv}_yFKdkMh{(}H50gr?6Q^*_MKAWN8qWkdtL;)V4#3_~a3iViP9#a1WHWHh+xEXNo z36>wEL26sTPNt9jf&L=$rHl`Gy~;j=?nlUQDz2yH zM~14+#zc0tE}GqEtZP{N4LcH{vh&p{Afwkm)~QgkEEZS;dsG_iD&3GkaxDL9!8h@&o) zqddL8+8ckNH>#5MK=cOM{@>6WEf%K6ZQGst1Ri=#H)V*{G3Rbn2yQHpqJ(5 z#$G7O#>r-1b@w1TR0o-N^yDg7ww)>!}ckd=T_OqSe|Mp4;SHEC$O*U9VD2I5bVt^uX&1WoYIhz4Zy2n`LgNnv!`2vZbsp+$Oe607TCG%uI6oHhoG z+69GXBXzN&$-SmHtVBQ#)!T7o&|*liJmWJAQajjme>6lq%bUaLVc9{=FK)p3?ut#B zRbzNP*r5xK?e0hBQ@Pmd@|Rq$w}(Zt&~}Cy1`H+ShTp=2f#R1?@qoH8^q02HB!u%N zD685RX7X$qmPt{VYK1Ih)_cG2UKHQxg{}{LA0mMn3XzV>w_MgHt)J$@XG4=0?Ms$# zGO(L2k;Id1zEQ9XwVV@^RYY@iK+R@mynsstr*W- z9*kT>Vo>kAgIo??!vj>s48e!8KzW~97;->`m-(t&d@1T$?!HNl3(#@ySw)we#WT>c z9CXp|RsvTeHaO@uT|U0up0xR$oy>nX<2^ zVn)gXSl|y)w(?Qr;g8(Fjt$&^}e1gXmXDgVt__PKMPd{idsiNyg=gtEXx+sTSD8cL9 z_QPD_*LVGPxwl82m<@nH{uV_WcGB_oa{haGn8Axv$Q>BVq!SqgXtg(YVf2ih1DF-x zMK*0enQw5R&}HA?05to4a@Eu)Xc66)etYYz-M15 zT=&Gc=(HLH7mUK@8GZKz1@F07do>!7b5N&`)0<=tEn2`RLT{EADv zD5R5SE7%+2l?m~t-Ti7XOo1 zxwKgMS~asm_rv6juo^QNPl)rZ^2NUFMag7N7ss~TmMee1yyC5;7a29;Yc{VWA{3KNX?f9rVi1SR5rYy>ca8W!X8kwD!N0A>Cljw+%x8VowJfkCvdMT zJ5V}9b`$Vs@q&L5CwjsJo8Q7pHogV0Kb0kZd>MyDxg5~K(46IpO8xd~6D$5juXE}1 zB4;ho2Ok<8Ai^>z7&r-9u+Bk_)Y+DhaK+6}Zv)h$wKBaMw8C$JC8{fi4N{+|hFf@b zb2CWtN8B5;c)R+j*!ulIRE0se&5bEa+Y=8<;{MB0TadXLb1R&ITk6H+i>9YLGoIG#05_N2j2SlG;`zxaHn8+5 ziX>0SQIKQ2tt)-xNBZj%J?#w2P?^7t%~CKmYY#5k1}dUq5I9o+U}2Mg1dOo1u9Ur% z#}@?FvME*=E?rx1K_Nw0Em;q%M6sF6bWh^~u1|SLl*WmbBj3u+!8MXNmh@(AfS!I$ z?=%JReErD!MR94PFfXZKS}7lesMdM#J`wRG`K63Twy2adxV6iH&qis8&axL08#OT< zH2RB7-7$A;&*GDdw91KSJ_89T*D|lOHv^QtB}iqKUyogH!cvd)gBBYK{OD@n`Oz#3 zP_SRv)512}Fn02jE9Pp)6f%lCzA&GrSV)T%|LxPsl#;p`1@j8W0GH|y4I4~W892q` zNYD(2X9z2iMU9|`CMqJ;#MEbj_Ru)B81G8KXk0QSONtrmCeoy8Z&t;@(h*);PEvX@ zS!b$upAJOy>RKpw+&@@wN0Ca42gbQG0cgJsI2voC9kHFajI6L!_!sL&FA_S=gZ|Qt z>dDLPytoTp73IHDZeu?o@Y)wgL6%-D;)OrC4bAhX( zq*v18TZB>m=FXel)EWUzxFa*p1l0m{L-*AVhiDa?#me`Xk9_)5v8xQCKFepK@ijz8 z=6@aLU{9nCZ9s}v+RJTGEVp40B(P##RcaxMO^ycbatJU3_ck&KJHDXoiJ1X1{7K7h z!(p^;*sS!OO>O$uoIVZOQZrho9TIl~x~}C<07(l^FXp5sOcudTO-{j50Rp^2XbGH1 z?B($TM_#y{O_thLHN>RZ;HIpmZ$MvXg{pRZ7D3P5$wmU+;2QNn6HjNQTX8^og@Q|% z2|x)}KHbT@N5-K+_<2<3@aBiG+v<4!bJ803$4{F^Ks!y-iLXJae2bPP$lYkWf_2)s4 zHmB!=XvOmF(cWa2>g@Evj#458VC2;-&T4M6gk0%A$#0N$IVZ&Ol& z`uXH5$5wUAV>i#TVm=l)EL}d5aQ~wN5y|P*Q~%hJm4kF&RTh-NyXHQ7p=5eKV}JE& zWymjW`y;1Tzz}hGJen#6g49QFNIFqup-OBemZX&f*aQ8B%NeUDvvRbe-B1Dp=&_Tx z0Zi$7z{65xDuB+H&%Y)&Fev{zxuMf#-ZV`Owww%v+sSK~&JSB$6}|RD86UY6rN4zW zanHGi=ghz%0!u(#uKEP6I{jLaef+bY+e8*Z0Os;msDabOY|y<`NaJeO9y{IBHMFze zFIM*^A{2i(=H#{d)@J<6`^F!y!>%huEVb;(J^X9M^ov17#+p%EM{}+LnPD(JML;`h^vx}g>AxJ(2dFj-)k1quc5Lkl!KEE2ZBPm`Rj zTcBVIG$EK4u#6vr_uV5bXs?0?r~0#nW=|kFSmgl<@QELT3Z6t ziCn8!r@*m67y?3B6AfvwIe~YI?*mOt)7wS*yjhkx`9CGk@~=v+S~mcN+~75+bT=6W zKIv`HPJa6GESd~`kM7bkpwHj!hoF6jTVb2SH)(9$PN}Uh4UEJ>6ad=lBcRimPvG`G z(kZqu;N&h9XFXE#kZA;I>{y9P%J5nUAGn%57MHuk8%>j3HB7-&Crvt$T_;I-bgm zyiZb@XusF_lJ?A$9dZiqvjqvMe1K3=4}sbp+e9xE=h@7s4n%f>E}|3x14I=&gZTc@ z7lm$n{7lwc_pqOEu9L2+u_JKjOyAm3epvx!Kp_QaZZOSy4+Urd7~VMOK|3<&LA!fD zneatg`%XP`y9AvaJ@i*auL)qS3-k_{5Aa0^nn0j1fGx!IY>~L=W}4GM(q&Ff1L1h^ z4S5zfE5{qM*+5ck&@=F{g#`kW^MmzxP1#aOOrjtGQ&xFApT`=^g<_z#GITxw^zORw zAKzVf9GGgYjLsMnRZLwlCZ^vB^4Yk_e>XkINLOe)IRh)PD+4{deqd5C`rBvMWuvhS z9lAw}xqvJik5${+@g#8e1EM-+B%VA$aMwVkFy=!&CIUW^OJ&&_jr6ROHWg`o*Fb0MKhYgAY8q3$bJxSD(&nKE1fDr=ofgc4V`I4kR-^18L~JaOsr2vky~6e2N?#C? zHBLNqslv5fK9qzcm^!^jR`guJi*dnTGP@>z0Pe4&oc>5AXn&kXDe4b~<)}*s8e~9Y z;rvnb?!1EpY6F%XEfJ%eBLH?2uZzH_3}`&Us7th8>F(`c(p}%5>F(fHx&u~}!{aM5 zcnPdkvIIZzlpe;b{ou3kIUE9x95uWx*}YqwkO8vSWLUf?thk7xB30wcD#YEWPF>5W z@)e%_h-NO*e`X_*=@wydHe}6Cfb0E;oQJ{F4&=^+79P1I76x3$g~0@tXF|infM?f8o4(@)c4R_hNuif}DDIjWijaj!yJA+W2XM?8MFAZ49N68@KN@}(JeQhH|1Cvw1?wM?Ux4?GhkE}G!-zQ z0}2PbLU|Z}1p@jF@OEvYYz(*tsl?bMiyz+$tnYwgd;7N~%l22v0zP*@iE{obRI}SP zCoyxLQ%&-2%8xl~!H9IfC#uxHBq|%wbnmZ3rFUL?F458mVpU6~ zJE{YXR2Y291bzswO|TTG4;6&9l}y2mv<5>|Mr1Uc8K!w%>yBz{3GZ-*+)ihqO&OUQ1w2~2V_fzvaAZHUuv3q zu*5%W0y`f;q=-zo0M$Aw9zc-|0wY?8055++_$lv(MkX55cU8u!prO^f4fO55*L&J9 z_(kP6W()XcgC5fqC{3SrVR}{SZEqL#KEcLmlJ`F8{gaqYMd{7yiUek}LA=Jz&nQ_% zynQ;3pU4lsYv_PH{T8E}=9Pc>sCd=zB)PcCOGdV-L19d1dCl;Xh$hD@=~WrJlGBvV zv~Iswf0hEw+soJPaZK-;%jYwjtSL%=duocifcuXZe!A1;lie) zExr;c>4?}h%zrbkj>20?0UO}f7GhO!=yCIw(QB7_1-BDt)KJydDSr9Bsjg9^msF7- zOc$dThk-%@H6Hd18thI_mClO9$9M5_D7I-X5tMj_G22g4u$+GET0iTx$o$wQ#;hWK z% zcTA*oh*S=!Vl?>g@v}vT!MQi0LbcG=Be=B&L?hSd6(I%R`PWqjgmGH zIs}q`jKqZS&Ocso-D$w7)c=%{WKLtcWe81F&82at_JWLP=rMP4$E z5w_yVT7}?W2`tA$_6Gdo#=S{m6igCVGu~*>D?s8s#l%En(xhJU0NQP693tw4IMR62 zc>e~gDRg{V84h0J=)vozLG`$S)oxfdIrKY4gZ{k85taVg+>cZ~906f#C=_Hi2|;Sl z!RzHcq@10W4|7{N&APlRdV_~!hqB_q=*$SB01FtM4C;0vo1{fsM?>FzBioJY3w4m5 z7Zzy?CVq-LG4+6*|2V$bwL7A6^+0cLf32e4Xy;w|aFu=*`g-cbd;aNS(ob)FleFZ?7oJ9e{0p4cbB0gRMg*pnC*F0$urh`9&Q0s8CpZ>haOH;z>$G zJlNMlCB&QS$O@mrOnc_I)CJHXe!=I+_u4y6FC7=YuI_~vkHEfv&3xp|RA;(V)_5s! zIEP_TM&fqmb=s=-=tVsAIlD;TfTL*=$7jSwTPt6%1aFY|L*4Cf0a}79zQ#ks)Lq1a zK|cwVAV^{jm4N653L(@Zm}@4elEFK4zEX%&bgwF-7dKs`=vQ3gk{g? zmFYjPAE*Dge$>@TD|-IN_2X_w*-w<^oREhIlHVi17S>HgR}LyipRXLe1=5>eKU|;J z^_s7q8V^p&@b|hz>N)g@`-P0jaHVA{P(&&H!Hf<5$&3xPX@;_}=vpzz6fe}9FCp2hhy?eTEL!>o=p%5N3}@hPkONndM~Spl3ZR61qX;7*cLP&l1z;@9D9 zP3yed7h~(ZB1ZflT{KDV?NWjCmFjBbH0je1r7dL{J(ae_(pDT!@U4r_o<}$CigXPA z9NyH7EE^%i+`tHe!LKi=0s2%ldISPMAr*}Wbkr)ob+`-!m4hguR?^R(b`CzeJiM$) zT}_R8p}R3FerK;PO zKI-O*5u$(g&X`Z}m)mxQjtAc3Ej%<8T)6G=78d{&q8T>#n^gz1Nq>Au;mTZVaOuROzs7F3rS~h&ur^83Zu^%G7M{c*#dYi6$_l2bL3}_E%%)&H7T;o z6K&>y!fUq#KgvZ%&A9*f4O4ZruB5{6bw=doY0+of=fuuK;Zya;^M%SxEXDT2R~w4 z9@o@~-0)m_@YHXK47rNJ&w-5F)GuF!ip7Ixb)s^)`++89@AW0#N@1RYHKf5P~K z%ZgT29(I=2ZeS6n82xh6jWYA&vRkV3eU4;{sSh*tA+fyYZy+>o@oK6w+_6u0G}xkt4flJO^Q6x@Ggf^B6noZ4V8sx z|Bfyude3km!!H${;T1)DP7u}9trfnwQboz(Fkw3L`O=MUt5+5A92wJuU^(t(F`27e z1}6;%+*&(eJtpg z?NzT6osGzTV2qJ;*D76GPo-3v*vUgs;`8ycu^)gG2YQ6KSO?s%fq%t+3b@39BoTAt z0Z~>60pf-`Fct^$0LO#ED0ev(_dS3JVFD81-4O-|@Qeq^A|3?+_d_AVFfaf*L!`KT zxi9r?JsB+2%$3GFDC1bToq;o~qmaE9S78p*1AJ>C#85pOTP=9?5#iJ*r@_EYv0=M@ zw^b<==r>Y=wFMi$e^twvB$xAJgVrB4z-QB4`l`&+#!+s4tVS7yjt27Vxg$f-l<} zV!L%=OSW<(sBRUf$}LIaTqm2@D(B`YRapX-Oa%cyjeKww$dkzKM6b8tpmXDUm|9sy zmbxC#v)nG@waz{Y;d=r?h(t3yJyS0aZq^SNd+?8EeKdA zf$3>B96!Bn>-*`^&HX{i1C3PW8`9748nmyEIzlepn|Apz2m*-o!GNy@Dn9T%2~3RW z6$;E=q8OujBK%bBQAEVHUI65;Q0Q@8Rn#96 zi>UWm<<1L)#jZJpF6O2@1{Yke&qR;Zajw5PpAY&jh%hZXn8vmwb4R`eP!cxsajt-R z5)=kN-2oXBI3hub1tu z@WaejtKYpQ0ZxyMwi&aEijRI@v(7(n)F>3f>;t7}7g>z~N(5A5MAi?0RXgYbVC;lU zLo(p@TgO&ugjNI9PUC7>83B7HAA{*rzUaioMLXFCAc-NfVq$iq=Z z03Iml6&Kg%a8ga3svnef104r3E8ClA$wy|cV$f&yAb|nshqerNv{!o;!@Zb=?vmGr zl{%M^#Q+61L=VvX1plD~VMF8*wg7BLuo}=niNXRM=dCK#s58&!vp&i$oGynMjXBOa zYKx~ib!tJ!KJ@%Mum?6Y&{q#Z~%Tm1uW)r)Qe?6v~=YvxswKj6*a3G@_-%GkrYX387}q zG@N<^IkME{RhFQHM&+N~Cu<-x1!96w4D@-S5CNVjsF;9FJ_ZHw2?bRdsyg&$RMP2Y zkJy`^!EFBe*B%k?`v&UoJ>slD1#=U{U|FS2$U@L4e2=Jv=?vc^mYMCx!COmAHNj|j zHU8HoTGK?z=H|MUol5}0xopV<*r~s&Nmm_-HG5+y?~up5(YX7!WJ>YD@cSCmFIg@3 zdU-CO)R}%u)qU=%Y7?{kR)4ijxtnp_Sf=Dr3{Dbs*fUSX_Rw=J;)e|&oR)S?PsFpf z^Kp!Aqaz$ubKH1$fvTaoVD1l2+8;kEkC)~LiPgj!+tRLox)#<^;S>AfjfX4yGtz5d zN34A?j8wGd`ay+^G)EYBUo^B6*Daa;lzc~x?xFXmCB1_7^u7h*9hW=9po??A`D>hQ zMx8t1@}&WD?6oGo98IQ=S}3yCxM5Cbr8#t2%&$`mpYG2(1)tn!xpQi8ie1-FW+oae zF;>F-I+UC)>f6l>!>X(eW^g$DmgTVA6tAZDq=zhthz(K8OT?3JBE)StCRN zr}`jfgcX3+07Qq`+r;=K3qyTXS7wT5(*e*j0Ffb>0xkxi7mAD)-pd2h8nTBEC*^`2 z?aMr)phY2u^1)2DNhFE3ZtMvtGb5E%Oo%h^l9R5Rl{&A#8LzCld#X-+~@deiunwPitX>UnH{>FP}bFcs3X}m)&j^ek%d`{uu@e2Gt-U z+S>pvp&%>L;LmKYW0mw?J$B#s4szZe5Mu5!8aJ*_^=<|7P2hj4dqArRh=C3#c0-6b z#3qGU$b0YTX2*m7*By`O?T&}7;RGNs1xaC?!>@8}6(%d6!@VhLFtl(G4+5sqUqdN! zfM^#Q8DJIx(t=vA{bg6e^?O%RuZDwL{N5Dr^ZC(9Co_bkFSXy(X{UI()k3#mxpjk& zP2zQa=mH{xh|B~ZZjV&93zZCI>86AQ4;F8H{mMnwvZqEv+*O#VU{qRr(MjAT_njtbjr}Ts5Y_h;_iO0kxWHgA%llkLg2<&pe zL^h;C?&J`B;mx9J2G#cCA>P+l6R&SiNt=c5N@mabCya4spq(7A1vJp;4h7&LX9WGk z(aSNL>f{PvN^eBe%XzKJ7_fQm;-c33MxvShR6qo_?7W&aq4@TNsJ>2-2 zO;$O;brklxRo=R=d|8If&rMb2ns`Z{37YlR9GkpPuB>>MF6QS!`p%&C<$E)-mzE2# zzbl*AnY7LyHOR)+x4+BrXTRUAZ5YU zBfN`*R?a=y%Vziyz=*+m2gcFmMO4Q5R_1vnPgBxu=>&nG$l~Dy zwC_tRHzdee+W8e;_NnxY1$*EnQOy+nT(7jP4&g-Br{gD*Z08k^;kZv9V0Jmvrm!5S z6XJw|xHV3Mha@BT6<^Jh75&(5IvKm-Ln|d?b|8AU{6I+FxJ|I!2CTIWiHs=ybatXT zT|<)aklXwO{hhJ@Ri$hqW<+gG&U(6jyz-m%p}cTkRA)6g(o0#tT#^q}x$nod@7dj? zP7Df4kW7@r!PREdw!n1^7AsVytTX&zErV3pgfV8hgv7t?vGRS)eIrFqZy8PH&t>pI z$cvjnNP=5_)P>+NwTaF7CRwG(PS)j^)T@TZrh?{L-1QqphjR8q6Fz2VfyOLwja~>M zY&n$K;>l?Lom$S+!Fv}Xn&!v96dg}L0HvD06&>myT>&l=EMllO*>U-*#gE2KndEqw zlX`~@D?5Gf(!05v^#_GF>DK9GKj@o*@=BNE265aW)HP5I?&El=ixD+;$?fOV@4~W& zNkT%vp2>mab2xt-&2wCN+bb!+dOsF6df!O%P-!c$F;d~q+E00em&_uqO;f5Bxt3#B7N|!@p{0bm)PHga!oqWsxLBgyHpuu6 z@rd~30PR=IV4V&3wFT0-;Pvwx=|;CEN7^%+faW_*UGTZ+>}P%!Am2NH>Hu}qh-twW|-xgcTkv-9{RAf zRMIbtsvNpFmy=KC8ETH)ltzedN+Z#=BLFiV`Xl@s--V7;+1EdP7gwBs#{e2HBGWKH zfsRFpt7H3;=4k|^OG0-Zy~!-UyN)J)9Q85cL>5r&jmicd@YzGsm5}nb1@`DLNaCTW z$cXtofUOZ&8Y%w@8>lk^3j=70ScD)Crm^SKyMQe=iaM$=-buSxRks$vN`uV+6enVF zBOC)I704M>BJW}ZI3GJhXPpTm^9iBPcNz^jWXdDoq6%V-!955wB7kEhvLOOBY!sfc zM+RN&Uh`fXRoWxpMF5VH!0H(FcRX@U7!cl8?m5*A15}!*gn(T#7!$8cz)|V_b3^ul z5ti?vu{zp92))2X28z_(hVtS)0PP#-K5LGbDrE*Vk>YB1yKZf-=C-Z<7HU{?xz@Os zPH<4g)j21d^!!s7Quom?Dir99g)kr|v#aQp092h|4nTDiWQAY}>|LYa-E~#6?g2`a z(Nw{(TR`*cWCkD_f=Y!()ZKhAQ~}Co+#A6U<>%}L+}s)K+g_Lf&=sox?N;_ zmz@3X9ab;!8QKHvsi5K6TK U(_IiUlaPG-5EP&kx#x8Mn+0Qg>Bk*w6({7La-)S zG1(;a>W-b;HO5w+&mYQa{_k*Ob-5SH{qO~*+kCUHrOlMK`IB2X(phFNFm(sR^<0_n z@B|!Ja!?RuGgb!72|y_2=(s;m>N03tkanK&&RQG9){D)QR8^#;MhMCf>KUl-3EKQ{ z*K@|AeZSrF?5FP3qO(>S+LNtK)d%&jz8O^O=*Vpdn@`ado@en@$e$Ggv#MyM=(_}Z z(hWqeeP!b|0Km2bBA`z`D=A!GHjFLFT^jGq2u`T7Lov*ko5|Ln=Z!!a5sxNW)l)=n z6Da`tO3{c&xo>*Q-6-_aKU%h&a`y6ENbSdLjD%pa zA^ZeB?1B6NZ8u~_lc4L1KhwKzyPnk-t4EkwE{#M)Oyzw1XXP;CBx7Wm7j)}-X0bd$ zIeKWpMPE|bpV;PK-X9ozdd+g|^=7YHG5s@>^x@q80!o4>)*&~>X>#p-Bf+($G1z$I zL5Of*15nZj#)pb@v8#+sEo~7@5y_G|{f5#~yixLZB*t%`w1I)-w#&lKc4K!Lvi&s= z83xsLRD?}ccx%_~jz|x(D<2s=wVMLjZPE6jT)9c@+Sy<3dY3m}Bv?nQwd7%gx4WA# z>OXw?YL0ug-q>4bzK5n4Td^4|A9E`iCXq#+St)SkzO@Vs)W9vnwQ$R@^Y+y=(B}ju zB7senSYLI2_sxCg%9h!g2@3zHFA+@mtz#nI8BB;%`WDxos%=iaUf#N^+Gpyp3=kQ^ z@J1K`&{82Z2y6g*D#RYjv@W`t^%#e4Dr!YVA)dQxS?wK0Q7?GK$$xwPjzk(E?{4ZX zz@?$Z*Sh!2NufMA_wXc@~6B(I#CO>1etE95eJbj!bb zb@CNk0RqvWlZDDz689{pNreP=ph>SALzG3|6xS`jMS2B|`ps|UTkqbh^i57zURiRa z_qVoxBvei!qg?Ve2Z_V8n>C@|Gs87dndcY3_2n18^|q8x^7-TZK|!*UF75SQv82Ao zMFWbA)?>rZGITmi`S6^Epy@?JUE)}MzR`^}+Y#%QH73k*rRZY~I3`UzhKqUe z6bY+-iFw65-x2zFmfVVY%ioJ-ZmJXVtBjFKBUlz$@INJ@=^6Wor}$yUqYOF!KBetn z#Jv6xxS99K^LM`5oA*b7J|+}mXl=D}FQS2_(=PW%2kh3WcR#V|up#B7Gv8T|ayY1w z`WG2~cs^9I@O?tRB&l&nHHQ*W|75R(`zZYBIJmvT`}I?cE+d;5P=h9S02#in&7wcg zL@G17WS5^|UOmn;M&h?k7uhc#A1E=i*931Er9Eu9U>Fctlx8&BMLTJPkrK?t| zB-TXspX8SC#SOW|wHkXvZe7B#HIPR@FlSQ`69Nz)i0lv0n1fWHHwT7wdH8{We)S@Y z#_RWi!8pBr;r76AZx};NJzzZR+s%Q&`_BWze?BjmPh7&!3+fs0^MacIWb^jCprZ1Z z^THI#-<}tMm!aVMFcJ$;AS%Jx^`?%7!=yy?72EkEoCywUtq89;;DHh{J3=79K8*I9 zY9{KxeEWpD0~WF%Lj)AyyDaFGLL{~}y5!8{Y2!9_!a>4 zpTK|Hz{EuSsk_Y+;jy)1^|Ybl8aB_pp?PEOv7s${0}^`T;*jjY+#~)T#ha>8y4y|F zC|k#TzruQX|N2-Q(?lW3^PNRyTDYsq+wIg~w`VbEXM7Dz-^)Zy9QSmn-lh1wlJfFB za=v4bpa`S+RB8)bVJsrb3-1Yw5m8-OWMecVvb;RL)MG4LuMt*P^vD8g$nbmrc8^^ zH&x>5XjGirXhwTe?>b}$=-_nEXI78@e97*d934qN%l3Mh_3PIUW0V%^Mbxp&-o-eA zRBVrnL!$YqgiUsj5yadceO0knY7`!XK?xW5yqh8GW2$e9Ztk?5REqQ6y|~to;<12= z8B}6&kSQJlxa;$4ZC~iL(#Hgfx1HSu-!})(>K!lv zc7_l(RcWU4td{zPiBQieP54E(rBQR9_>2!>j{wl4ll;tfl6RcFnPHE=U}#W37~-^( zVDw`8VB|t|nJBn5xAhKNC)T*13)`X|uKabs*O>_Ic21iaY&{65je@WtW(fhbMi4F( zr==xbmXZ}9gb|enkcoz{LdTe@mhsjw-EA*LxLvL)+>S+(p&X&`;tohA|EO#`BHi}f zGUk|#rfkIeG+7DsRM%Q~__Ikry0C!Qus5kG>)Q8mG|LY{B=5zPgO)))S!Z^4kuX}P zNysKLnRSIGe_3E2?zM$22UFXn|3LH@UV41`ZM%-cXafS5z+kF*b-^fR*t04{4Vk>H zfqp0&Gw3ln<2*+>z(R~dgy0E~`JmlAFStL6W`d^YQ>R=Odq-^I1b8=zMu)pZUd_;# z$w9ofLAWB`$y$`=1EfEKNZ-{PA2|Vhl+f<8j0opr^*6|1&D33Y9G+Y@Oy^QC&CiV5 zKp)#(n6`RuhrM=-C}$G;SF<`tE1LR5m`i@Y!?o_F>}yf7d`Py5r2>P#M!%RkoL|(poApqR}x1r z4^K>Q@yGHkE_PVNceJOW&uSQ7{bA;axG{5B&mg>5IFY(Bb9m1tY4NF%_KiL;YAz&K zs?}fdK$;dF#t`y;YP>0EnWgn}^T~pTZvCINlxqE)Kc2PUkO zO`~~(Fn9|ke4)uH$_R7@C^zlZ0NAb=M0b5?Gc5s8UJN{>m7jWmT>^xi@Pl>8twe+5 zR-(abM?Ud-UH2`3gM|7Tp&THmKoL>epI-Li3hNcS2S(oCke$I`w5fC=won zt;Pr;O?>(=9A|mi&jc@vxNUzgYS4%beEz#ELgdbzmje%rs9tXN3CTpxi*zWjhxye zfc(s=VRA|*-S_?jzx3Mk+if7~>?w!OO5MMen99iQVe zgsaousyjQ&h!^Zcv(Hg%eL^>a(j|bj91!#WU^WPY&j#5M{wHI==ZHd)oIPB8Z{$wN zynMYi@1oWRs(*|_k|V6(uMx2waK?N@Y8%BTH)W$wSJL=S1EzpUjAeXp99O1-VKUSI z9Ehq!A%LQ2`rrAUWQg{q5;OHgiT$vCBwQuFx+P9LoW!P1wdz2dB{NTwtmZ2EFs?}W zV~Bdh31%Qf>03gub=Ocw(F#9z*u&jALTFY6Lr6FR1^RT$m*F+iwSAXhN4KRFPw2M( zH0j#|G$i}Op!&|F=A@VCR3mZ>TILQ&WIl|!!BkK;AK#6PrtuE(BYpXXERFad1!83) z5gf*EeC03l(IPnPf^pkewTT`a#63TLK{&=sm%X7{4p;cg-6;GGZWR8iC>14`Rz^ZL zAI-nGYiBGc9b6>T|H*%Q{Nlg08@Mgi{@}lzfAQaw6c2zJ7zzXmN53(Dq2H7Y^xJn= zbf^3c-NFJ%8#B4odqj5jJe$tjH5?~t`z=_C?dL4DPe_Tb;zRg7Z5#;iTFaB!KdYcZ zxU@5m3OeN5vPT8tgbepYwYP^xm8jjL$a@10?-lq-kNX5{w+`vF2^4bFoLNz@-j zT)>NK*X$3V@s$x|j<&^fVo=pZdo7jw+NYl$9q++vGX(qSi8FHkkp1tyzyF+G0@}&Y zO+pvOD*hgM6FD3=;j2eqbL3|Bj7360V8`uCGKWl2#iV}%u6eMV8aA>4jmsJGr);d`k3Um>Be5*cE?%h-vJxPCr#rTqHE;PDZQ1Kb zuXP`i)V)Dq)hs6b)Af)3hwEP$HexxPXhlFfuu&JTPP5^=V3Au8-)WIs%OJgUv5>pX zU(oCbjPF~dLGgLGbx3SNx__XmpSi{?qDyCgfliva(9d)X^@g*`fUuB0Yr4N_lSz)I z)6QQ&WirE(!jpWe#D9zvp8Z5Xk!Jo`NA9>nVb(;N!Ss*dPx^p;^N~ser!U)G!&BYU-4E^K)W(JXa@8p!S)x6=4$Kte(6&lQxGLs;)_$bB6)X^`6X!&wzjZ-05z&pZ-y;y?+ zFaA5KDy#8J@As;uEFpABqxcLLF5N6d^B<9!DlR!`GrKu|k>iBSr*GlpxKP}C3!wTv zDu+mkCUrb*EuCNsy_5jqVUrDaDXymh4ZlN1G+g|T*JYSQ2N(bURJ~Y!m#VD#Dh2+= zmIJm%yJroSHMh%qx&fS9qEV1dv11iS;0~E5^BBdByig1^?u);)NXN@($dv@nYfzY> zem3+;LqU!s?0Q4%xSBdoz318`Mw+bJzRKtg9h@X{!(`m0UnVHTQ>Q=pK(rG7)yq2q zkHi0AWsUf&*V`<5dkN&${VNUgOM{kP9n)0i`3@~FNQMMpq7JosJTGw&a%UeSGdISw z^&H`b~H7qb=Csg_ci>>CJN%@gYe0yp>tfd^ma&>iy>8r(48-}TS!L($f?yh3gmaJ{M< z20U0R=Pvtcmc0d>0bjUfz*ia6^(jTGrr&&6MgA7tzW{$~S_&T{o$musYcw*1T0mhG zM1WuoU{!(%p+9j=>#?krE(lw#J&gS39mLaVgrR|=dgT~i*GLQ#ESq6JlJtA)a@n&F zTDggn@G0xSe&5NjcvMU4ss(i-Lx?V)qTKO5o{cfx`eodYP9et|f*bcQZ;bnwe;W7C zzB<)Z;PHrq&(Bbj))1I9lGPOqp39gB%4P~a$Vn1Ih)cH$$jlbXENC(MG_k0tksDb- zsHIsus_1Im#6w|N`0aqy@Tq@l6D{!z<4qx_JaWkwF+w6?!&xl+{YyN-Zn@fk{U!>X z{w{7D*FFZRd=h7HzHG&~^6g94xU!B4eE}fNee^C4UBRlP=&_V=on-uvB;}Lr$zZ|W zm0gB$-6O1rzH`v%oUQz^3JTL=zI#8&Fm2ZYTb>h|FW4FSgnkjQeAKuCTyLU~Au(0Q z0ygik;F#kygc!6D8alq#1JI6xxS@OJE&}}?)KRrhn!7Lz@bH_C(cF25YxE+Ey91*> zERgh!yzw7?r-6|;{Lbw%u=|CL6OQ5ir64fk^BXh1u>ab#_^B6{Yfay9kyF#lv)DFZ z1L=EVIh%NH_Zmude*|X2Y3=-%$wP2j`+IjWn*y@s{m)eQ9%Su^EZH9^^D=RRJssL8 z&yJX_YoIky1Zi&nNE%yH-#WeV0?Cp*v~*$Lnc`N+R;2W20YJVGemAFZhIap6IFRC5 zMsPB(Ro`~7Qt7$9(Sxpfja{<1x1qWK{D{J$#Y-c)G8*u{I`B%$r^L5Lvar4&1hAs9 zr~o;8Gy?cx%W4*)ObEXkUg*obamwcvjiKdVRweHaGaSI*pFt0By~FP-K9_Y;79W#t z%%=96(U}I?)6t9}1&OYlrrRVh=kg=~W>0JqrjLZ~YlU3~$@oVU^zchMRg~>x)HB?| z>+?rxQ=g?vwx7J$IX5u4ak$F>pLa0`5h{V6*J$!UlMyl-;1dX8!tqW^Cgy^9{lvKS zr(3mF0=vdobO`1EM>{$fc2T&8rsJ^vE9Y$4u8GG5i2zwBGBvh18GUhJyPzMOpk1wr zcMSq|T2SPH)KFwEz)K&D5C0r9D}v5VRar2Q;?N?7T#+&UMPATFYB^-zdVr&oBD2#L ziP>!^cP!o%8NQ2LgrESGVaS|7I4-&xtV$BJg$QGQhpdGHX#1dPfNwB04XHaB)PhE-9wju!yLj2_Ou)GkS{gA%>Ct_?xu5)m zak{PHSsdA)P$xJ^PJ>6DRmE@WH5m}kI-T7t+DQBIlHmSd;$L34S60ZB>$n+t8@Z?xz zzYEIGVmDBXPk0~vzsOseVZK2mTxKZy#aco%P){xfs&-%W`-7JV_XQf3%<+8epJhJ0 zJC9ynFC>i8@E|oOUf>G~`W@Dth7URf>uGr+NeN-5_Lil1Pj3DtY1F$1cV z4I2Pf1$bfcWrI;c9rM!YOlfUBnmb+FO?QXt+}fw}lP7Juln_3pPDyQF6aKmdrOgGpc1&s(k?BVxI$PHaUlpD)jL`mHxiQFd1HZ}Dooo&T)zP!g$B zneq(d$I79Ax)7sP^R+L|dkK7QIh zHRkkaXUUp<2j&2X_<>#^0I;`y@B9cr-k zH=yT;7|#=z6O%=AF2d`dh_C>Y`JncH;HQ7!r+?t5f8eM8WAM|p@Bi=MCzStd@Dn%X z$qn>W2Zx^S&nYEY*Cnc;;-^a)}r7Uzv=P_@X3z{dlVZJXW%$}|BE{# zS<>D5ss*e|_xQ@GhN%W08q(&rXjoa}G@JF0EOnIt`Siw}k@2|kqIat`c{4a#3_Fd-~hot zr}sjjoaQ3er@}qMSRs`N6};Y|fV~Vh6)>}nLI58^U!I{U6T1U?SHs`X@UT z>anXg-&klJ|73lx{P+AsOD4hpN$5KHy?BX)to>?LdRAKl3i^iBtU zqmy*I%a|a_=N{hBa^Di-;Zx43#}YJ`lxcGW2^ko%YR`-)M8jX{9O_8d0%RkoFX4aM zvE z?+PE7(}a)^Zwwp$GRo8h#Cv9EN~)R6>}{1?F5WDW><~Bd0gN%!d-wjUX%Rq(NhVD@tq~j8;^-AQ!2htY3O>UB( zLo`%UOrp4na*yn;&coXST4`Jq}vV7_k?i-&mxEalKJf|~Y@Nau%fYYO(x z>yvZT48eQz4sJ@#H=AJ9n@up+`k36?qEEV+?&0e^c_V6>y0)i{TH2#-88XL0%Kw|J zCX^%h>rk{vrW8C8;(DJfuDOgUK;-$dmT|Q#!%3H?hv*v|@l1L>J}P3BKE<9Kgj3)6 z0v~ew4{z2|^-Hk$44e%lO0$(!dK1n25e8EiV6@N!p3)gXyrw`D=F1Ti|t0Nn2BpLPY;6nAK zvL^)I+w{QV$3#v7C(2rn31T@CQy`;Pt&+XYvoj)IX^Z6&j__ z^_f@t>JUEm2EPT%xOg#1J_{;9TzhogH+ed;9CQskr7LrNmAKM~Uzq+yz`Od!IC9g{ zoY+^(`BzJmzUldOfU7WD%EfPgo1emdSw56=XW-9DI^TRGVuo zBK4)&$*L>YgXZ7Uc)!Yc4!_HI**9f8V9DyQWxS^UzKmx|_IG7G=&v*$FV~v_vo(aT zDItoPh^CG?rS0RTgt=*&7MaECn-pBuIpWV`Iz6RCxT#jeK5KM3ZzrToqIL+IP_sQt za1T+cu7wHBqc3pbJb&tY@p{nZO$hvwx*XnK;5{?a%as3#Xq6fNBVA`B()&lpLD|ao z{8>I+dGZvlJR!Vso@C^ddZXVsPuSqj6S-@{`f%VLCn^I%4B+hmrX=4GGrpqliUwut zg)!)AbHQYY+_=}~`CB&xLfT<~!X=z_Yn9>cY)jJ4*tdtiNu~^W#S$8yD&TND{AloA zpKbqwTGsc&OBP!-&}yIG2-C7-P9h}XNOt<2p<-4K$Ek#@e@2}F1JmOtxbzkXvXUvv z#YPrMDfCK>m|*5NWp8+-A*Gp4mI-&BG4|zXWW4D@>-$e-JLqlN?s3UUf<|EJCwSWK z{p`eZ3>K_2nnQspr}afnPu4xnA9uqZV}N1uO>b>Fn`;Zu7g*?NkqXvN1${~Cddm~< zt%w;-!(A@H)8(tOp*JrcvhlK%H=}Ct;+s)*pjE^4l#ZUy&8YffSLAx3=fLnzuRMaF ztsvBO8tS?77m_fr9HtV#LUT(Jnn%Oh+VrGvNy4W)>n-#*Bw@ww4M})YyOTcrxljXR zKiyt)BmM1ii6qh^6ZzhINOjROGAW#$Jv)=N&US##F+^ENY=?0z9syq`2v2)w2bK0j zdtaU*&Ose%DNA==9ZkKc5kXy$&~)$m((r@-G$FM#zV^C46Q9Y+|ISY){D(c9KI!p@ zwHoNVy--%<6McrpNOdfN0G*)RXC5@ z<;jn?jgd-57gg_eHIT-e!x0I3=e(X-I9p1(Ya^ha_|TXRI=J!SQg&$ zOXHh@134p?2+0dA8Z@ubb(5WIRF6mRLb`ZaECC!=G(sq0*R-JY7@2IGycSPNqbswQ z@pI#sss&YemfK&G1WJ}MCmwWo^<__~7^U|HL?^v{=#(m$^y1j<^nHCPH?6{CHyK`c z*d%|)LtZ<%mtK}E*kzCU_`#bn$%#^inR^P2`MIBCzrM35p9s?j{ZY&t$)NZumj^eU zk-I@P02T2;OK;?{*|QXTUAk3P%vX!%`baam#^9d`x{k71Y17-A9riOsuK>+H;kUHV zO2QyleLe+!1GU{5tFH4fMi!<#xvGo({m%@?9v@iU`9`@c8;2cJHRI|ZVtk3vD8vc> zFy@dZoki++j0iX;EL8bIjg&uY6KNJZlw&~CntAOGV%BR@FatibVCI~&1_d+5pLpK? z7CDB@rP+<&n~51;s#}s0wb`{^R+Krzw257_o6x5Kx1vMnmsx)oN5Ep2p*S9N+5u4StfJ@WX*ZR3nM;?X8Kas-J4X)EA zA-_w_Lm=>uK;aaZ&TapNWyYu@OREb>Eoqi=XQpup+_8j+C%6RI_QS=T*`C5Y$`O@H z6S|y$SOm3vN_TY+y>3U=GVbHHoyyp&K&@hxZ9%pCESs_)MGX(V3iIW2AH-AF2hBCd za+nxQa5|N4xM5;YgFTB|Db1}z3=Dlx-pst3Ok$R(zR-D~qkFVCvk zpPGh}I$j9X;yAxCleO(Dq?b7u91pSB?Q|;C1*!_5GZd>i%)MoSab`c;II^wScY~oS zO&lOrh56Bd4Jo7g{Z)#N2NSmqy&tFOUlTj>ufJQBQeTWFz31ii4Y$fJLEU+eU&JM#8c!B)vSm5nu}HwG<1%5r=jtZC(>Y;?7_$Hhw8Zgg z`vR49)8Lue<32E5!CfOqZcUw^v>dl%j_iMlvg5%mzSI14*u~v3=(NS z$H98RL*Q`IN5G6ap2j;LXz>g&aBkoM*4oba0yZlX%D4HtFO#_?Ikbll1kxaDH0sEd z<`BYaA|)usdGs=gOz87+lUH+(_FXDIT(m&_)yE&(^u4JI#Jd#N*sQJw&2>I+t%__Q zDqM_b1xSh+ zN0@qZ!83l=4ta;Upz!V;{Sd1I^j?V9odgCaogZ5h+9peOi?vb??kIp^H}VT2*~AG_ z1Zhg!Xzf=W_yE}!=8{0-SyeyK+>I;-<-6q=7z$m7HVSSzhS$G229YJz)4B5`MZzRc z0|J?064!@RpR!B85oCNsggg*%q9f)t`@bK;yQA{25ZsC~A#F+7C#?Jps``u>!+ zPQ$cs;)%`F-&BZM_4V8JZau@Qiy<&#t4;5$-^5y07j7?5`PuEm_>tc_H;%EV@F5+r zB@7}bLGpr?J=pURCL>6GD3zi8m7e&UQuJzIE)>`;x(oLnM57}k`OAF+>|dkeL3x

VfX=a)z;&Dd_a7~1* zDyO_fzPIFO-gO#ZVo6-&i5@Z_aUA|UzS3IA#Rt_nqwt znfyVUe3s!D1t4Z>N<6*Ij|kHzW}RZBI7bG15(3a&*(~?(b7Y&Yq?`8ko##`=(}70H z^XO}e{#dmlWZ-?5zf5;+Vw?xKwhaT#+&+MLhU?$P(>EfBS0wj2Ar1@E6PNrd#r zZ4zqbpkwyCy?fm5@ln_%W98Js1pb1rs{~}8;A@9J@b%B4zjpYZ;A<-=d=2?azIIF1 zYx$J6_0(W!8WuYw1v7lO)9@TxwD@%Ew$)BDVgCH&?sk>IaG6s3A*uE5mE2g8Ra+~{ zvz9Uhdcql4{O|5{Bn0-yiHI@Ex1p>iN2Ig5@@(JkCfkr2*j5i{B^D72?NcCq1GmdR zUG&cO=>EOK2l=ldKG461_)4FL@U|y=sv660ezoG{VG;r1z$Xdb*%X>0x_H#X;Bnl1 zMt^p9Fv7qwOA(vG90{L^AV_aniO>)@q(0FeICQ=5jnel$_p28;IKkeA!MYFS;{1|l z3U0ETuPnVIyx%>ZPD*@`HyD-~B07U2GvFny{iWw^O;1+&C?*Rug!#DJpB8X!fFgH%Dg3=ty0yKtc$C*q~gm(Fss!|EevueAuY7n3Qv>rW!@AS{3 zy*;CZY5D~+n0G4-n(~G+mYI%y~lF1 z03%*~Ti?Sp6yyB?aQElHh~=X5#(#M46dCRHQ?$lI3^*Z~|6GyuN)28aOHv9GPfQJ7 zM~aemUHT3(chq2xaxF?D)K6ohZmPa1>5BePqfFlEgRuLxuWNf?a~EtMojF4%mDV6@ z`n!Os(3L}ao}Orn^M;-yY8=M#O>eRGv6da2rl!Ep2;_xUCMCl2vCBi(bbe`Sk52&r zNe4Zn-yz7zbrZGBL!O<)PCwcQ9dLbW!~AFa&-bhZT9A+8{GkP5fQp!3=7sqALHnKC4@+I>Q-`!m35r5!EM|HDUi?;EkIO7QYi?1 zYs16fDoXqI8f|E)T>L(DPv@=8SPk&lkAerWowFWmps|D=T0wcXIsKt0o((B~pjsa9 zI=G8R=#$FQBGwbn_A~B%x#BN8F>AIMj-mY3M7}A7`8KG|);bzv#j9?Zgs<-NEU!v# zaLAN!`OHlnOU=$sbq_CD-8xF8IzvPLBh2^fyll|kH`t4MeS7-SMhSj&IAY#5-KBz^ z_@dI;lm_Go#kidR@NDZ6X^q69Y0s6%&(z)pCR*!_xE=jVXS2?Kn*D?2dz$?_$u1t0 zf700mn3kshrL%p&C?5*|0b(9Vc#N5#;OKZ{-ZyTNPWa#Gne%%4R|B7qijSIpp>E4k zJVO}udROcuI~EMY+ki-gwu;*W(7WyBE{t%@JDrwNI1M-%FK=b7(>53D3#(<74?m5H zCEL0De)wp_I1<>Rv^oQBz}-cMpLJoh05If{2q6R3`PL2VpigYr6i||zReEXiu|K5c zFOs_u8%lEL+d7-iiT)wE$tT*LL~gAn$I-1r)_$nSorDAxxr3fW?(%kP5hH2dSd>uw z_Ugf0+*P8+wCSmyWuB>Ld*4g@a&D1N$uq48yGRvlgySxv9%B&5Q<+ueA@R5D-2uh( zFH$)2k4>_j0B?IU)rrfiq)p;ng!J?9|qQF6jDS*{*xHoiSo zoJ}d5zIaaB&)mjXo6q|@9UGD$@kdQFxp@Ca8Jqp& zemv=UL0P6VmBrktY68j#UW532Tn?lxl@sx;%ZPrudiO2F_w#V|BX+|-v8HTRKgIaC zkj5ry&mC8X+ib8QfY$5Cx$l%}AA0VUqJ&#SXMbtQ$G=OmPfCwm#!xy!kskr|7SM4= zq)L|--xTvM0*@kS1ITeK4qHu|r>B+{2gy%jJMWM-KQ@hJXjjJkov3n##ZWS-(~;Nqg4_FGIBs`QwO& ztdmK=)c=g|8U7jJdw`Dcjk^5r2p_A%zeo7~uAj;m|5HCP^-x64{#`%y3%zh_H2iyn z55TlXBf$K7a_^_)pUJ(c0-%uyg_gKa+{5_*6|)pq0KT(aZoty9fF{>}c~BK9h}{b! zO3Tg3Olhj`VM~uCDI)JRd5FDh#&f%=yw`zh#*8;tMrW_N3l=tG_M!`mRtNOq zZ(cc^778r-asEIEX3!iDT>lFFfouPi6WmFU;$z&p?0xxT2Z0ief%KTdSdw|nC%Pd?SumYzz+9eCw>PM~kXbb=?$DNRNzfGYyo+4L;O;~3Uk$qD#G9D=Nh_42XS|D zE8C(sN{`+B_h;YsGJM^|?|+vAByaFD67@~`N_dE`Gvu2prW~$+G~Ad#pOTeNQCWKQ zLMxjYB}|W)duTRemX(E1D>hJnRuhAh%B|@zOoq z_K231$Kdme8s2sT4TA&AVBybnfgvQ(71`A!BFgsB$6{?NCdahKu@14@uo`f9Q|R1y zlm^>DIbAk!S`v(AYP3V~8WK#Ir{C#;V_{^dwba9#^4g8lefKe~?zCh8uZ89QO= zmtR>DX>XLjBm3C_P?H7kmf(qz(tDQSWC(N$G2uIM7EN!XhZ5^XTGll1{+jgn{yev- zrDA4Jy&8=>tb3)u*M1O&sQCfP>_~W!IRroA7%yvkWeUD5eeQ}@ zX1W?r;f53D$!d}U*Yeu39HIl?g>5r(kM*yfqNsv6;hR}X`?lH}|F%^=pyK>J;buov z2%T`FS5bsdlN7t;4>k&$dY++Y;MunJ`43S}F=|nd5GMkw8fTxu7?#cxGRpYom0=WP zQ^22WutlxX6`Bpo8Q4eNL9@ZpOy5RkmA|t=hNo;WY4X3b!36WCY%l{TK?UJyFF|b; znXT=2m$`o^zc){mACqG&ylp_SRTCT$YQ=UvJBGXS{&av1uIbe}&%GNMdyN_f?^*e& z&G#x8LVg}u2}<_V-G(vMBbNUb&jB(t5GUlK%xZgEnAv1gn`WV$K&Jk-t4}ld#~$c| z0t_sImT2fKX=O;6(rAN;ezl$AQpTtCi#I(hQ*S40U>tBV&X}&l2kh4NoY#!YuV@1C zI9APzF3m2DV0YStOb;g%>}%HZo{bOM)2%!=XU(45atyi6tW|VsuOF>CHaLwniI?5TbG4>!w{2L5w> zP5%7`S_{>_svl+voKDN=T^dQv3hf*jD*?emR(|9N*hM)mTIJb~uR0S~wkO43|?g|R}qdv~y?xp>9;Ms9fi_6~Em zJRZ#W5l7!lbpEd)eGacAwMzOBzdnhbavPstFp1zsmdYQ5o9{Ky&FkQfjd~lzPmjzr zEm?Sn_{wL}G=aT1-Kp=PJpEty-mqmQhd`QvpoVgMJ9Cis$S7Qp0A7|f!r+#o+4m|l zHWlHjacRSe8DaBT#jk;}(bv(wmg0lKMitTf^IQUTSdl*c(guN?=eRk}9u8g||JtEj ze+m}~*s?5{q*83pdYYwE_7J9}*@{FPCMoUD?u-leTYl7mLw`(-2BD`?nRJ6L9V(G*WeEzD_VX2?Lt85pp2DO$`mr&%`9* zMX#435C5SO-H#d{uLl21t4FhPC}16u`=iy5(mF&$w8Z?;>H`)hz9>Iw^)}0Yw0bII z!;9{SEC|Cc#T0PHSTKzI!GwtCt&WnF>^{CAl9@j>HarGa_ z25*n~VlQ{IZoT|p{xU3Qd1Zv2(lDL!`TQG6g3nLgIH5(Lj0cGTnCnD9We>>R)}2Jy%QoZ*FSHQqUG)Ec@@>sSXz1Y<;Czj&B;L%T#K5Xm z@H*m9rwhv|hH(%Z&5XQ{?WN9yZ`A`)Bj3Jj(Lot9evF;YWPK!W$jivy`Y1}LO_NSv zb-a$YCElN`Ktv`o9z@HDVRAm0*X`W^S+!K;ZK^^;!7q^%R61TP*`1djJl_vaPsDu8 ztmM;c^arru2IP?~>8b;6!@h^jVIZ5BxXsHtkq6ihW?Swqy0_AXWo z?Rk(fs6}bzFMeh zVJ2#|nWL4xD%A&5;lY*-{rIPS`p=Hy-z_sSmqhA18fr<7*X!%Xst1?i`e*i~7Ly+f zwqI5;`^XZ%C#%q*A(p7v6arrJZXF=7Z*z7#!9D)UHL7E;G}yEx5&CTRdxK%ZLx2p$ zSeI1sQXd^ho%I-U{VJ5A0@b`SmMNJ_y}ew=R?Iw%oiI0O+=n-fRDLvgaEEsY1Z`nn z3Pt_di>CWgy|=?PB4RR=5d3ln@>-Lh4Xb!5nzrJ8_1l>s)(KCJ^zcK=Ynm~YP#SP$ zX1U}dz3ij^Wr1pWgTvbY4dh!xg?t#OkpJUJ$p8FD$Un&1uB?0#@+~rjKKw1@FDUCg zJLx>3^332L_CpCPS5?PXGqWi~D6Gq0N7C1*Gy)V~hxr~3;1~M6tH(p?z#hzbM%#{% z`5e~V1C~ro+Oh155ik^wgbyjHJ=#&JKnk*&7#Ry?7sK5YpOr{_#X4;5Em(t|*cFN< z8I_~e_gyUy0X8j~!3;*L$rmYLxx0IGoFB!Cfs*022RW}`G)sZ_-g*Sr{;hl6cN{)j zw{mXUqBr4r_y-RkZ$s}ViWi23QE!Jr)_dQ5!MHM1)vOZo|& z;>p_gNy)NposdIrciz`|(K3DSk}gl+>D_w)s%k_Eh{CnEHD8m|kScCug$$d(IpnvU z3%#&yf(n7&ne7aGDXOB&W0d@9|3IqKgS264iYAO-36+M``o|~+{kDUlgvuni@Gjl8 zurX)dY1u+f(@DE%xGtY6R6FGCS=1IXOTpjjgXp@6$@k zvrFl5C4N;o^=iy6wt`X>N#4CCH~L*~UFPbjjnpDMtfZZ60S3wnL3ofKzr5E+gd?S@ z2ZFcjaf(iff}TfdJ|@kW%3PK4irLx1lFZ2KS`in+0J(J=LZTZSrgWteS7sv%n2Tae zdKRvQto*D4vr`>WJuG_l2i0>c$0sq1KWe(+>AS&bQ`FBQJ|vu!TQ{#-Z43?4jS8ZK z2zJ&@RW56hXQY9Sw$LCNr$b&sDaRs?$%)lg*hTAv1mvqfP4up8m^Y5nShO%Jh3z`P z6M^t(?O9Ufqf1rYRC*fdp`BhI>QqgX6t<*Xg$PFFN>M~c@mZZYvLA>q=mwt0;zw8x zwEq0Cc4#ee{RO$K(q%ps(F@FQ^R;~1#RdHHM?{Dd1%%DI7Y^#rQGsT4gVSC^Rz8-J z;H@Eb5-JLO7FZ1!$w8|8D4d}T8+G+e=jzkK+1Ef>9{F@*Y;csONvyZxtYPh$iUy7_ zYK;@M{yeK89>vZH&)b#W1as*PU2?RIw#zJ=!`@amZi5odWL2DIgt-m1ZB;OF+)_L4 z%mz_1!Ob&H)t!1s;ap8!fA8`yj~^Rn=%CuYMjh7T$K|BXXVt^kobN7)$=irtFa*vU zl&D*jtH-|Pxa516)CJdVnI|bnr^8&*t5WCfR_ujdz&U48-53uXN`e(M0~5Gwcwu8i z7HR8RBbnIwXUTfqxX+z3P@~$~pB2U|u5gWIuOLrBKMvtRDrK^QY18r&Zv&)NQ_1pF zj?>ok_H&g-?S{AYZ!&_uT*r7bEmYYdaySjYXKH{ zt8w|iAiYH=?U%e+tUT8p%(3~;k6w$vRWJ)^^YGm}DRD@%GLz7jeP9{?nro~G!y1^j!h0Bhh zLu7@S%mET2D^||f2ii+l<_yiD9RaI8-kAc%As`Y+Xb%{FKfEF zbocZ;h3`KhhqdeCjg>}4)rQ%o(c1L&TSoYA#y`=eV2%u#redop5R89mg!lK$oNFEu z`*H55FR1a{z8WxDs77obPI7oLDi4mIhClB5^6g{f1?3Dn1X^1lfG8&HH zQ%Vw62%n-QJD8YjI)1v-fAS5FX#+c;39m)Kl;H;+p#|vKl$Ce_tc<3Zs!n45u;<$) zZL8sOnuF}u`5Q>PDss*K!mMiL&kh;R^Fd+bD^qkV|q&S<0>SWR6E3RFxLm9%l+aY zo!NS+wHK?k_0^LY615T2V}y+Iyw`C}HT!I5G_rPR=mT}&x4k`ktk^`vK24!D2Hmr3 z2lwkU9m8@r`PuDxP8AS%&~BKNLIbQO`HH!A5C*k$y)VT71^w@)=`W6^QV_Xg>Kehp z{TG7^^C7z>?WN$hbZ0yTZLgZinVHqIHwN~bF#?8-23JgN&5Umqef+k!dTz;P>xR%v zS;st}j`xj4^B3H>=R;hjie!|rhaC@NQMd7vf=><=`(F-~jZ^rOL$y@<!J2VFq}}yfpt2@bhw{3}AInv@ zYe6=!5kqT1>$CIk)?_^8a>iWx2q|w9`v0PXEWE!6^m#U%)A+bJw^rG|B{*#Mt}`lZxXpcze5tR>g>gW_ItSg302JdE`O@5^b;% z)F8g)c;WGvq2=gNY4%ZaW?57ktkspCWm!kPeq7`<&^6HD|6K#!{`A)x=ypipo_n5N zvixf?Avk{pi_uUtN_pi-6L>M6PwB|G3aRG`l-}ss18`@XTCSl6>5kIP;;XW%^jx!Q zBiSK*>XmtuRe6w`{I^;hfaMMq3sGcJXZ;S-^%=d#q@~Jof+NF;P|9kKr5CSgByQlN za&omy1q-=FHwpT2V7pEI@=>_d?2CEA-_!?##OOyHKZ> z-Xpzp$Pfy-MVTZ3!p0JYrby-)Wh>-D#NDEPwQ8zr?Hh#FDsT@QpD7s7=fSN-N9$Lt zl+A*QiyZ?faOyv)CUfrO94_rkI)qA|z#?<-2PwRTUt-ysQ9FbPH*u0k2ZnD}1|cGk zd|3Z44{EO4{CC6e_wR;ZNq^D& zzZ-s;Qb7(0kv%8vLhc-k7ikpOSH6Q6W%E8>hDM?8_4tZgZhC+*+)u~m+lqxVH+MME zJ2ap)0z@b|-)}S!fhqrb$zhGD%UEg&c5%!n zIAK=quvyJbG}Py$+@GH>nys9>Bv%T}f+_8A=Ysj32anhIghrD0y)$m5GWDTv3~Pq#&L zf>+nLO4JR9Jc(OrIeNL8fd5+nf^_c}aSvW!af|fa?Ys^&fr;Am!`}i?XB$&U)Gp&{ zO6nT^@U}0huNKx7^poO#y>1@gcdf#3v}P z;wPXhq;e7w1S;C-F z&-KiaCGFS*taw4J{DDraZiv5%>6Z!b)=+CsJVLfWyCh|%uIKI&WhGJVR?v@+MH2{= z5M=$j4<_0{GDI4@%KkZU{ z+AlVfDn+%+_AOq-s>f=IH`)Idkj)R>o7NA%C+D>4wJ%R^wY#F0)4_D*c~;UJ!-M!3 zF*z$7#}ZoW7OAq8)u>!z$MK5XhDV*r0Fa+VAVYof7b>b(?Z~G30q02s8jL4mLGCYN z;auOQ5g@fhB!|7%1JV_cIDv~v1RrbEhWEhBipe%+=^RI#XBkD28(l~xO2lX^@>UfE z6}=Yt+ih1Z9Wnv?ocC^T@UnLQEWgke{k{C+^j&-L@8uVJ?JNQ4@(YT!S<`=(UsNMS zX{-J$zo=FK3sVRzu%CkglxYNh3Ns*nWKBcnEn<68j=`#^SJGQyi!-F>?_DD}L*w8i z0HbLH4k&o|Z5ja=)~^G|o<^X9eJri9c|hQXfqiragz2E0Shq2$4BhV;Ot9FCdKW$@ zyej07^sfHGp8A#k3#`%|q5z$gW9oVQaA{X=Eu;cJGiO|E=(h+5#a%dpj9$g+dyiFQ zwaaE6{kH=l^n#>w?qcT%`fsZi=)et}^|J$SJ9#_Z!Tak55?*XGG6u)IJWP_xan+R? zpEZfxNS;4frIP&+y=2wsC3v^BbGEj>FNX_JgBN#}n!It%AkJF?#*~qma73`KI(+H| zbvGUweth^6;zhQ#2)w3662tHftD~%wF)VZyK9dApP-iaYNgw5y6-l6UVNsY~{b#xyJNz3%)E;FdL4*v3c=`H4!4egs8k($Yb6A`zqtVq71Zus*HcCjDM<(XQ`Kw ziPoZoDXWPJ*Z))*|5O?OR2lzN89)B1GXAMD{;4wlsWSelGXAMD{;4wlsWSelGXAMD z{;4ufZQ#GZ{HMzJr^@)J%J`?s`2VlUh=C$uQ@q`FG&YZbQ(V5AwFyIAjhUeGk3Gi7 z#D$mqjOf8}%OMin@J!kSn=LI1&)Sv|n|sPK1JreQExD)fKX%BtWsGd`_0G^$-@VCD z7J4%w=ye}sSXUrA?o!wGZWY&zwg^KiJ$?9BmdNRv4`A>fffcsJ707D`k!qceYf;M* zZjfx$f1G;NS>-P;5TyC?cixc>{Uqj_7kE7?8a9l&+uo^ImW=0k;)-85S7uYmZNI6# zI%eAcBSYO|tSg`lOl1phRoy@=5AJF`ZdW%9=K-<~5D`o256y%Kv`N~A^d5dIiuO!Oc+PY(QK%}O54;5s2nm4kLV9{7IXJJ& z#F2sO*U6PduZd4hJ^;Rih#au_&w&y`L_*1yVUiGwd!)QF-O+CS;Fi%qg-iyixu|gjtn**Pkyr*p)H}8h z$i#cJG_K{VyC^qCyvr$bQ|^I;c)Ml!)qI?`A3oc7rZL(q8doVPwKFpc zI*G_4OuENU1qBu^`x6v2DP{nE41*F74?&`Z5rtm-#vs6W1ScI+Kdld6LDz@t_<;RU zL_UC`3VF&cRmQ5mgSP{Ul422q# zS7{f@d=b|rz9x7jk;r*+_FoTqhQ>)~m;UjcJo^2dQm zhhX>H4r|Z5px$YZ$=5Y|ou9fc)4kOjA{Qu&nO>zn+YMAs@YmqFPyQ1$e4jR6*>}s--k|Nv;JXwB=z}!xDeE>(7Fk|7Z?jOt`6>d%wOv zw|P)<)10SuFVcH8?&#B(9$s7b{%=SOn=c%3$}Ey-D@7Hd+hG!*;zq{@LPC-7;Gq+% zH9%Q5n1&_`8Dwg8085{TYe_S$oDZuK$yw93x`L-3e{=qKC(c{%V|at-G& z7O}B_a4sS#i~^vOi%0`Z44yQr9wnd=M=52q9k$u%%Sq6kNKdu^x3J59ju z6qxj-FAHt`isR2`O?emoua!{mr{-%AR$a10j5TAn7A9`pIIqdKtcXKm8YxYMwkJ9@ zH@dGsiv-qqvq4eFOH=~T&IRfMfeVnEfJ(t=b8@UJ|5p>D0c}D&o{0`1TzT-dwmk3> z{2tKzSOeYVf}&TAfbaquIWXk~#s)k=NHhSNH&`B+UqAx`Rt1RffeCLgEv%3nkg5+N z1qgh=IKYrThy;-G0n_X1j7u~`?MNm%%lPJolxOx-)%w}K_fdRNLgP$;$Qe>u`pM2( z+fO)~09^2OwP8A$^wI>~H4kB5^|sfru#?JQT4CG=j^umha@*&j+|kiS+vq+HmWzaU zH8vA~5iTkl;k-@GhbhATFTX=3X>J=_q8WS%0)IBGp#h5-2%e`nAA92G-baG$17+!D`P9s5gMyz>CXXnWejq{>-Ei`g&_%S z0{?c=$lKSST_rkt_-;VNG8zGB$f|3>#Tz*HKz;#a zEMO2Za)0ppRC}mIPpCb{vBA|< zO#--!7&Nr}URPMlM|;KO=xzL7BB}2Hz$?cM*dXm%PHb zdWgPp+k-qYYgSm7;k3x50Kf)gvI5Fp$V5~)uW%5^`{(;yaYH{HPt6657(MGMKf`p|s{(UD-Y~lS4Ms8B^HV<`17+J^&7`s2o_qmn++_7~AAyq*!tOU&j&A0Du>l zOt~Xz8*ET)+~<;${<%KacqPGphGY0O$@eNfk{m3o%`4sSOIA+Sr+0S8&O>^yYlA-4 z6`j+Qt&aI2js!o>vx?yPFa9JRb~~tfo2ho&%rX29_~;A82Ybd^h~Ic}yiZOx&&ejx zfR)q2We0|eUgf+m_zmP0IJe~B&18A_$x7?Bgl)nuWZ`M<^SE6h4Sts*N2AV2PJHbi z!Q3}0Or|%nJjAEn>urmKVcPsE@vYmdMK$tI_}m8JM)Bed=!aV9zLqr^JTubAO`j!# zKHB>i$i17!n#Ic?+O4eij&(5{iSBt3e(~tuYpvl3w8bH@67(3QSIc?7#BA@zTNrsm zKRKaNR-3ye4J@xturJ#ouS6im{e%y=lr703pXI{ZEyEF{A936i)9GU#H zE$VTFEH|J7LmtS)g8t!e>@iVa)LbQ*7YH?d`5uNb3QK6A`n!f~8T_Uzsa&d<6)43m z?GkYbV1E<;)&CHMMcTgF2ybn*$%0Zt7Z7&9WaG>3oo1yhR!3A)eTi7s#E{JfAr3;& zQNR_~0sS${tnTt)UPE{*J#|2Dv`zS)$<^SweZ~TOR}l$-U~Ei!KsNyilVW^QCRR$R zk~&@@PT-2&U-MJ+o6%e_YwPT3>C4U(Z{QdUi2^9{Kt+TB16XT_q-ZUyumRgxg`>SN zGN!;QY$Rep1_zTE1{-*X1O2^T-Jz2!Y1K~#J?4xDL6$eYmo7OS*o+@x<)(Krd}KP? z9jKIAlCz(#l@_5mx>U^xqzFwrJx6ju*-D(~Iw? z9W0~uGW^7_Uf~2-UVJIf6ZQSdq+q!+>QXZRd^$$KL#5HdY=@RL?6jj^K;j2RkR9Pn6r5?VufxfLf=kNnIUp&kIb1~`GUnwJu8iji!iPCa=&M$Fbd864I1-jA&G-Crksh*~&GYE%R`DnllQ%th4ls235x*9&^7S&YWNld$jet6F+o3ZKjT!^n}N zzU!BWx1#*@oJ2xsL4DG+yED;T1cI#L-0|NIHjGj@i!CE3GrxZ=Es2)qnPdDq+Yn;H ztc_LxBt|oBE3UWlAmnzbm1XaCId{#P{+T*wke?C0E=U6#ps`3nr_Ld}u6L|qr7hgr zMj;j$43BKpy%-eG{X23W9DBqvcv!0JO49xo1E|KIvL~J(W1O@n8&Bsx{Ah!v6wl_Fnh%p-$h4c3}lP}MxsTPaReVK2| z1!LR$e7h?(fQBv}u}6aomuk%ShH_i0S503Xw_7537Y{FatVmTwKor6m6=Q-t*8kz6n#sTO=QM z(;=+f`pqgYaiUs`X3B_O7nF8In~$0%1# z|C_6~+_dRF3|^=t;`6+H!t1(HKt>8xmGGq6Y9XG5XkmgLU4{dvhVut{nuW8(NC4TW z{(z5ift;la^7UsL5`Dx9GMwi=%A3dhR`zjcF-A7h+Tq?I0S3ODKz|V`6*Wl`iF9x3 zVjVbsHE|u~Ov2}_6f}ELe9B(rPJO)ODLnzh9Yj3*uo$UrX5tE0`=Y3d?!2BQ%jk(O zx(9$ZEh;&G2lA*&(v$WMn%=_bhHyd+q$sVrD?l=hq3G(Z+ z{55*)yU`a-For;*3MwJQ5E`#U{2i~rJ;f^w=*N2Q4?gEJnlE0*Kx8;Yhew?);<-xM zJ}yne;)L3wf6cX<4@0eSAB5}6^O25u?vB3C#zFKb14px09h#7V=5bh7@AFW^d3cLD z^XWgs7qRd zvpOGxqb@R)Ik`KXBb@OjZq`iebLR{4V7_I|geuAV(g?cknT<1JmFlEq@EbU$u9~d* zF~6x9YJ6-=5vFXV%F$y_O^pH=0bMH1>|AVc7i-J*nn>@3L(R58;hg=LcL6t z5M9W>|X|4Asg(;qtST(NKyNmfWrrmB4FG%z&M@ z8OUEa8Dz_7R-9%~>!XL>6AZe+7Eo*9wdEseNR=|f7ExQ$t!Li@!GB;bs(Ga+n9FQc z(iPo(s0%i{S>Yw=rL#?h9}-Mc+qV)5gMbn=Gz7*LbGmm` zU_FIxBvD#txEyNZaiyi^nP6W&>>gCw^m)o=Kk6$3v7sDb9u1Av05JPgn;c7uQ7Aqw zM%q9ZBdJs_sys*`n@xpa85cOKB5^wv6S7`JdtaY$W-Yi+9MqKJHxDM{no4F0QLQn8 z55py!R&)1DxBR7&5?AgguH@6Vbv-+{1^Gch_!tr~3@Y$F0)&I+^wg3#|7l6!0UJ+r zBGG=MJ-d#m?h@Uw3VUA8R(YJ35s^LJx_u?E>K{BysKC%0if3sGLGi3gvSInt#vq2M zO9IiQoVpvak#XR*ABBiJch_;Oj>gi55gP}AV@_W|x;YE$DI@vLc!C4Al7!7V@IjQ^ z5imuu_}TN4S`$8R0!TteWaX!Z1|n(RPl1T=UxA1SG!RMXmp8J4ide!>5li$h5bJUw zphPjw>4jOqJ{?--WDE)-!Am($r{`=>|7giz?lt&}zZz9h&7$WXCxKQ$4wig1Jo8A( zR=H`adI|QIj0i6JZUTtkM90)8%Vc^SZoWeX0F=pnB zzg%(=&mtW94el%sx#-RV{f^LS@NP`uJQO2bB~*Q}aA7*H^q`CH{xM&k%ZfZ64W}Mu z)w@17FruzE)58{o1%&1zaY57zo_H!rvp4U20h1ay`S_!RLdN%TTBge2pW&e2KeiL6 z+8#50xGHU+j4cYvGM=e)joZwjzU?3mQx72sP+{_*a=w*0z)liA6MnG_v#`Zyxg6Bj zw3>{s|D;n{Ed;s!*SeR{rGFim*LdE;_HTux+cB$K7$@akgP_t+wVoV3pIW)RWO zCc5u{T9Z8K78agW3P!AK4;VSc-~+-RQP8E=G)eVDk%=VjC#Jlgy2q%`R%d5y@PbmjxQD)GlemN0qG*c)-a@{Xy2Yyqs^tqBC3x(o&dUM7_={G zOuEZ+dsh8#e{y$}YI}^g*`eDWG~g;^CjMy7p1_*;s3}9Mpl9=@m_*x^X#hLoBYMx~ z%;r3Xge36lJ2F0m$S3tRZMvs<#+np@pdk^WFzOqen;net3l&E65C#hx$?*<4gJM{- z(wI*#-9^~AAj2@RnaW;Q{&*c?KPnv?t8CZk1~Egkd*_!r1VuunVzXP%8G{kCq)FPd zKy;eJe(_}={Rrf@V6heyg#zD5zQl3Qq}yPt-v zOCp;0fYOQ$KiGxJD_DBS2d$+e`t4PM9II#p48w)uBH0Oc*FB{@t2m+PZ?nv`7I49J zk4yp(eU2dx1T})dumKl8fk^{r%h-ff2 zz}t94Qp8!1IFEBfsPG~7_bkovK_J-7jtSh`R1DUyTH zlp4kQRwrJnL+g(aKpO?VLn~&sJZp8IazMmvsZMfxH|Cs95Mw(y=k1Y}hQ$BB~ zbP@d(n(9t9y!ypCH_qC`X?3k+;>GnG5ks3BH)~g)bz)&xPamh^gQcYeZy;KYWjy2;kRTwf&3i zn;F#$TK^VV?M#m%YTSkW8xR{Hnu16STjdTM0mxK@o%nA)4_%TwlHwKyx=rHASUWg_ zr5ChB0fPe^4%vL#BCELvSR1R7VxTB=%t!*MHSuP}XYmUdY zyoSc6H9QP)G&&ih0;Rfd;E^eZRBsKZ=mCR32?9|U2m3;`|j+_KYOi}p}3>y|7 z$^i06R3a@8Yu4|yXs2K&{Z^aQm07WD(he4~BQ6XWNS(THjY$o&@_&$z?$CsIi?(wu zdTGy$NNAmow;;G@Y_xSz*uuGjEt0{GC9>;Iixi0U0C5=Xpmk{LkkeNXP~R}QmB*QE-Jx!+e|Uf`oaP#T7q z7GpKdC5HW4BHAPR5RAJzLc=XO(Ghvhqy=~;Ad^ChvENczvYwJ>IR-{pT9)S&v7nQE zjpmI*<*|s${v?`!=wgVoEjw~S>mnv8%w1_3FjW!sG6CWT66^^|+PkXv6VXz*+PvUR zrjqXTEX*$gqv`4`#~U#A>bO}Ke$ClXCqu^)v<>eWnzh)&ytnkc+SoLdkAOTJhwYS6 zKZJn}FLK}*e1W=XR7MNpri`kh~mlK=xEVbO?Ww_SwO z{6bo#7z{KdAzN@eQn}F;WD?u&%FM~Tt&8n^QavY99m2p=mCoQ7y+myBh#Y2e6|`WEsNBF;OyfB*iWMoLy}kZ;ImpA4xeSZ+NyMJpM)I- zY)lUPAm(u;;aq#@%vWP5eXoTNepWY&e1_S8SB-9X!NN8!|Xh6hy zd$~acJY<2vz};6QTnH<7>F?;e##iYsk=ozVoHyyD#;ZG{Kgl_8pxdroj+Ve+cpA*@ zhiu&5{O#C!B}gI=FT<<(Hh(-X6L{f>luHiIfeiK59x&#R3!_hzJ1lXA~3!J`(Mr zeSm%fOalaxA!0zrJK4O2-`|DsSMA9l1GV9H0xleL+beH!1RP#r1;F8H^2pkZhG{;U zNb~3#hwtQSss11`&qqoPgm?^QOG^3fc+Tu*X5uO1>K&*ODC|q1|Mvc^p9Vcy`ZAWz z-$xeYrMifx6Ts0RuA3)S{aqo{K)-y|USEd$XDz|Z51ls{!gxLmSgYyQOK~Ko9txKL z6mKJ7;v930eEv>l!{nwJS%A)OK!v!$1jUht_AxfB5zTmqNo;%6-lvs_-W))6LMDM# z8v_`fkey-k3V>uMWGdaw2={DC-oo2xkN+R? z-ZCo6K5YASs40e!ZUm%TN6ON|%(>9`E~p z>V2PQzt3K4@BOZ|_b2AttXab~*Y!Wo<9GZnW(;adUVm5%@Qa{r7I(?nb@Zy|mkL?S zc>Fm{?152BgA>03o@Pp^>~nRsSKH@RDh7j)cT$>2Yj9^AC3J_~Az9z2mrK@QB>U4t zjlHAT*Sc7jH-ATcjS{VmOi;;)7ldR!kY(7?;>|FKNdoW98Xke~A}D%)yE6MaXVG*9 z9?{jJ=B)v%^X;9T-xyegHfLQ)*B9u5;OFp}PTJ`FE+M{$P47OKfODunO;uBf(1 zw7~wOg!yZXkUNj~O9><8RB%cEM+qZ%;?U}8oUcCd{`L!xqbnNKCg_XA*BQ5YU=->v z-1gs}x%j0=V=Z!-AOYP3lm?Ov79EgukVF7+L@$(`C!jEV&pTub+eQJY4G``UIzI|P zcZfrYN7>LuW`XiwI_!4OpT+@rx1gk;*9}fcuy}9ft7Yn*E_3wQ&Z&^UC3qZ*M*|S< za6I~V$1-o)Kl`Lk#k)c3*Y%8XrTiN0^bW;-B}3|#i6Nrv&J(d+W<8%w9$RVoT z(&r;h2V{0Gp=9nvZu2b)Og5g*i+2ht1bC=c4|>8cb0)S8fi4WjO@1N{&##%8k{j(oYogoZz+jE^qpU*8sJpQ(iW3}# zZKBc=ds!7Lp%EV)-Y|3lLVpw)ZldgW2SiUYfXX zfmc^}&1{9B-l;ofzHXN6QTFpMwY=I4#il zj1mL0^H3)sg-^f+wg-`Pn6J#DKm;K0K<#Uk1_@D7=$eKlUQ^G44t@4J0b5LD z>9IJV4MDME_{oCiN)#zb9Yqp=)k>5QL=I3_p%lSh6_iS-sZLP7_fhQ_3DNcYG2v23 z%iivZy5R3yw8vV)p8_|_avB;o>hE2Cv^3~mI1%6Pti@P=*QpLFt58Z1EO1?gqQ;1x z2YI0=T4X5c7w5#Ya%9-A6fhWyVkdJFX3$Cd{$y&H&(~c5l>e+z%NRAh3ITrJNJ{C% zkN400KR=w)a8Q(r-dIK_0tD5rMrcD|29tM4>82toD7|gvt_eX9)jG5kQEZJu+ewHD zhd(wCKohfhxl#szLl}yIvTxDOD@~JEPTiY>@6BNK=PP%q(A1_e`ub^bs{qO6e{-}M zvF?`ddYb&|5lh~gyml_kh=k0j z;*{V26&-Tv@^B+dCbhU< z^6{oA1>x>){ji?!#HWLP&t?ilq=cE7xP;`p6vK|ntv_vrlD=cC6nMgVO#a^d<+^0v zHOk;Kx{_T3NyRl`Nz{5Z+FU`uWL&8fF(lV+qObA=YMk}160cD)wA!xmkIDpZZLe&e zujoA}uY)p>`;^`Ng~a<5^;&wqLzjtgz$$YoR!%9d67c3>GvFA7SIe-h0%=JcqKD+_ z;%8DtPa9v&Fv}yZx3$xs_2zc<-eI;whS{oe(<+Yy+@_1EN>x(7o%gsgd(H}*oS13S z-50OmQ|#u{=S1hjM(W)v8uHgWK9@0TwgX?rZUU)wD1|@NcaJLS^fx+D^zp7{SKg1& zuvNak*d@YTTSiB`Nu_dKXI0!A>BEK&2x>KW$-`ys;A-emGARz1*utOa0_G`#hW4FR)|=X%coZv&JHVq4sR$<&u_s|IJj%_B5Wv#H)+=IPyMHcZC_ZvXnciE`Ky4 zcHg?^ljwiW5CXnHBrR<;Jb|?=H-YT(NB9+$I9c@}8|VFuiWBIUPm@z&8-ULoN)8bQ zrB!fBsSLH#QA;jO$*m_!FRJePCd4`9S_KVBh3`ACom4EiRfPs)y;2WfCn|d0Fh`^nF1I6 z-{o!>PFB)dl?YRhQQ?)Wzi#)YwOMw4A{AOAW+&2;E3h1LiYWNp5N9TViJD zSLxwa=&8{$x(e&gOz>fH%ijx!mpX)>!lepfhDxZb3n53S4BtC|ODj!v2^)v_#wR(dLhQMYQ>&+Q~g5H45E& z6~-zYT9O89(i=Dg_p)IE{^FVgA+dkCJbvGK92)2AK-)R*#bej5IV)vYsF5_HA94_w zWRjYR7?WCvfQ7zox=!dE)iM}nDqVde`D@c_%KiG}3dK1{Ad%9L3_bR9EEDZ0U^oAb z<=0HgQz2R0vV(h8$|K+O?PJQqD?dfk^OxHNp}Uf64r(u~Vb1nhm>y|Ndc zrI~BNmxO?YJUj~iJLKL}`z!mKy33y)p>TPJzc^LkpX)lFYqiIXeYBC~?cX4y%M>3Y zi6$N-a)1g9i}L`UU3`A#9(TRi7$+M!tWnEHOyL)DvXn7W`QG!8e^GP1`J?6#1a>1Z z4zloX?3GHa^O_vYQh&0mT9{Sp5bs%LP&5Lg!ZGuPW9CKMeN>=kD!Qs>D7nl(398rRzk{g+O3n)*wchg*5MTX%)r`u#<|Q zr`E6QXEfT7Gof!}BozgvIelNVGutU!6Ry+y^1+oi9w|opB#=o%2yuP#4ehGw?XvWG6MPlp@n?l6@0YOCwUr;kX0KxE<*e|1@gI0f3D=hQdq6A%cf%7(oX{cobLTbyr7sIqdXK02z{Vdc>-%Q59C_B5Kb0{dxKP(y+!FTB)^H+`35>u#LORVW$mC40q4)lKU z$EL%;17O*7oUg-<32iXJTT3`2Ntq?ObgAv{(j{-!p|P)v!2bf5o!o&Ew{2IaujPZ_c4>u?A#|#r3tgo&hXEwWaG%q~Jw3;| z)YDt9%1_QLN6+!m#YZ$fBBv1{{lz+4*M30w4U)m1jh&*&R}I-go3t* z{D-e5pGw@%&yF8F6L!(Sc#)L7<&138CS{^E*4zXAvK-N_96$M0QBdZV+PG7$r*oXBJ(>L06iqY?nV~DbhYwx} z{7Pq6-g)Jj+By#xdX2n|tJ=u-n2Ue|)tLsFZ^g)n)K`X*@=;PMtpiNTcuqTV8Jk$(<; zxOmtYLJh?(Tueqw%BQG|gEWQ5`oT;uibtMZ$!@C3|7G?JrORvTxOZ*(SDH8X6XV26 zLGRO;;;BTYZ{ha_#~j23$L0)=R$x*LkS& zGwq()U2&qd=Sw3?0bo_kp|#%XfTt1=!jQD2;rH`jSe48laCjVr)Nu>z+kec6%sK-8 zc5q>g@nTT=9ZKz=LaD+8Z}(|8BHN?Pt8stJ2HjVNijzF<`9diJ&t)*^wnbTRB;yNU zpt74}zO54|7*UM`q23`_C9-{s`Mlp|T&FiErJqebhc@b7l}Ta~|R* z=x$og(xf__+r^&r-!30_I4jh`DQcMVd0J{Yh}$G0H|j@CX~n(HorthYzekZam50}d zx}kKm1N+N0E&&{;5j6JACtqWVPJ4QHke?ls;4YjWx zj0Bf35sr~pzl9xrCt}>IkVxnr2$|s@wHOM_S6Q|Y)t>6y+c`UQl_E zgu1*VIX`;2co#(yOlAhRQW??)O^I+avW6^6K|U`-%8B|Pk&adJ2U!mCLkV;dU@H;M ziymOnB%!yb!E+kooA(u?X5UHdC|@Lx3+0AG>zTEL0vf+~D&NTP^%}FU?BBqs+NU4k zM~N{jV%UW8M;|l>nv1`XTgy$=^E`O{HXUhvwaX9Ur;(f>hJ$P<_CZh2nE8jfoye-^3x}X((vFWgdcdR2!T}(qz!7;m==OM6B=kOEziV)BV!C53Vy%WZ=6Ng4FtP zrbopXZzX;o^O9{>alC!a?Q?e3Q8N2z*9e>T_hf^eqw0!+dWi}ZJ~pOGmOEU+6cOw% zjy^P`G!*)!<2jD=^P9?k?v6TeDm8Q`3`_hS5dFkP>(xt_axDM15?6jgPpyd0Ji7H| zfo~X$ovGqz`yGFQ>E);cK}cBBY}jC=c?vP|Zi4Q`bErZTk5a|->|=0oNJJqxb4<70 zl{4GnKx>(5b?;%P((|QK4_SG$?W|Lm;-A~CO+O?3aH9fO3DUJRohSD8@d)~e96^8+ zoDwK!q3}Vz6PyWh3N$GQ$%&nQMv|p-HM+Htbt-mOO0yQGoreJ410)+hbfWf&(9Fuo zJ6*is*M5EP_hA%bHkFmxFTZ4+mu}W;7FD~vR_0zQe)?X!-Qm(YX}wrn@t$*m1Y-fk zcH)+Th(U2$?%}CYa%@ZTB{_Qf&z+58!!PkNgqqF_u)+gt0*am9pwsO*l%mf*Mx+sY zp3nr0yiqFcyV9+;`CeHirBQI>gT?n$`tmXA}*G>h)=@_p^E-^&&1EO_t)n#fiQ zr$A~ioP>A8O+hjvaCI!}>Att-Ts5SqGV|Bn->*x0{y0LdB%b{eumr>YY8o!7TJ0@W@a{}x=3?zgKq9`rGxGcwS)6h4=o9Lb%1 z&EYgJ;o(1eqSmo-qWLv9e)AEj+n2szG4e-lzlBh-r7q$%+_Ak<*B{wM{K~-|CHm1V zXcvdr-;!~&_7XpWv0-t-7*5 z^lH+O*cI@%|1DMNpNz}|AtXG{E zzLkr1)+;~pP?dIkwL(`O18%9_yUl7mRfI3n{zdgmj0S!4%&*zBC0!Mp$~fKBt&LdU zC>)7NWNDNwXo*5YPHtc|3Z{YnBlHHwaO;AwpO^_@V9ouDks`h(?M&`p)bk!ekEs8s z=KVHtm))bI5S9DIUm$KfpigNTXKnUz=@K)+n3E4XDG5G~Kd|Kxd+kxDLaS*)qB->V zn~O;NuGVxJx2f=D0cd#(3&03N>(Y%7q>yW15Cda_I>oF=SZj3x@pNov{7P)|n^4i) zftN!0b`qs1&8%RQ{oi^KYkgzt z`Hth28oFntDqPm7Q+ikCf9pkds3t<0Q25+F3h(3BEHaJ!3_i~j*Bcjtw^L9q^0mie zQT1O$&^hkIM-=(Bu-ro_clyTp|DX)@I&CW5qUB4XSJ&%WJFla|m?&#p-aG&3ko zysL~9n!xmqEH~DLqER6*(1)al^GM#`@}qrMLk_ZM(EEV!K&~o9Hyaw6(i)IPiX;Qb zS(H9&*fjEsuRnk5w+!ZJe7VGccndKzCv`R0+Sg)tLVGMBo3p(L&fQx+Krj!^1!`td z%#cYiKZ~M7ewn??pf0(;i3+*|3j;(XKr#@Y7;w#@q=D83g4{plMk4E;>DuF}OjF#* z<~fB(98BK$V1Fqsy3m7zMx3C=+YAHq^NYe3N3JJolSFk9iJzF4%*D-ki@vS@6yGAA zt$%;c$k++XtsMXGyMo4Jl5drZ_I=FC_X~3?6}bWMZJK5@!F>k*tJD4T#go!OV%T>~ zhwK%-X-1Y>mgNg^`KRYNwD0m%l_F30R-Ni;`X?1ukP~&2*yXA}nn41j8RL28g_lVecJBzkD?8}r;@m@V z!41r1Quy6Y>C@{CbvLd3r`njBPGYGL#QxHsZt!WB4Yd6dQeEa|&qRn)+A~)HmjXCD zuFN|DojQUH-n7NhNsv#0bcHN~TRP};nL0imJ(Bkm-`khuC3Y`3H^I(5Ja$MZppd|0 z@po+Q&D)lmhbuRbsgrpso+PY=exo+Zk}#cU(V(AbexASfJHKVk4cyP%PW{f`Uupb7 z@K&(StsPaTJy+DDVlfh~5qT8R{PP~aK!vH$PpeZRQK2H8^Whf{lC+Y3I7Q@ougSE@ zWA!=|39plkAWrs^yQs!Cx3>Mh^Bc|sQv!;k z6}dKVZG-ro^@RdF|EezZo>$hB{t$cVRUPI*&H=3A?Y=A4FtMnMXQ%6)Y&}hOmr(dF z7qtx5b1Ea_o9%A~NNM}@b1PTdKb?o?sD5>+xbD=_Er0h2L}ep6?yKPtRT?i12a-z^ z|9qp%|G79myhC1I_@KCpn?C$ZA(KzFcr_zh|JZ7}UuFZk zYaDKzuS1mz7n0zj4SiMWRp*3yag5iQFEtPS#u2(fesy`3uORuQ-EZTyptJE<9MJQv z&P^TWRH3*?VYw2~qc=V{?Mf=S)YH+OYjK<26MxKY1nzD{5Bco=QPDId5e>TyHzoH= zeN1Thz59h(tSveUyO9y;qa@^~GVFX*v%?!c^~6t=YDO^dB9&E&WsoWIWJiOWSrV1n!dD=Ap*tq4pm@(3`q>4R-rJgTQPH5z-bOn28LEqM3~zO zS-|-cj~2X2h7tJ39$H`X=yp>Tpx{3>eJ>Q2b8@;;(Wd)b9Nu4-WW8f_pQuOulw5Lk zX1u(i+e%W@Dsy6PespcMJDs>JgKyE=mbRYB`*oC4Od5+u205G=*vqJh0&YYdB z^+hMqeE=FuFdE1Sa9o1Xve5or5%BexH9`-+y4TiLt?Y)<1$U;`5^N^7vc+%5HQC4P zWDX3t;*(To+QZ*Nfbj|piP4-;JsS#}gHSzg`%Y87$lMGnT+!-7J6-$Ct#}zKCGC60 zs{ktnPS13rsjDP7GZtO-VW&H21T%NzPDA2gai3#N>?-5G;NPH=7f%w@4nx@h4<8;m zhEFuO7>2UY-lNoaR8uBxCbRIR8b~D1R!8S(W(~hTxKGO*A!!aubrC#}a;L^@AEBsf8|?BzJLN6=r~rn-Q^&-z{2CIHhczu3c;hhKJjn#n#0<=AZ|G<2On|p z3_xQvj6(X4OYTHIR$=xZmt59-%fGqg)?EDa`49N+<)FN-xpIg(++N*q=OAY46AwsT z!?+NqS}?gz1iZ7ju{b&PD}+a#Kt2pXUww=NBYwruhUCBkYHPSr)sI^cnh=bpD&VvXZNg~g1TJlea5TV=zMdIbY@T6K z-N3!}I~hr%TQZY$Yp1L!rtI!6Y?>Wbw~5ad{Ocm7lLiXy2sPRp$#Sv0bM>-10#S75 zsHk^#+Pth7)-MURuQaOq&cWw)1TAgTeWbZa-^FCD+>86tE-WG^8hpX#UXiaUTQcul zVFGn;Bsb)*MJ`44=M7w02%>=VeUFFU5@WF{SV)1nP*!Ghp#dr{G(ffKzQq|eVsZz~ zPg&rz_>)va5)cnC`1OD#rFv&r?=Q0HSq9#_C-Ehoy>F_19!l;VtPAE*^j)UhvMGGl zu1GN=RxSPP<7Xc%pcMjVhGc^mA#iF+`3bVS-TCUgH21ukTfKLN?s4`!ow8_3zWM-4 zL*NtyF7WB-N7@=D8(JepT22?O0NDtoKw+-Fz<-@V#i9^xa_I;78lhyce|#@2fHo8^ z@9&Vb)X(ZT&4|{uu)l~uy`aGH9TfWYLpaO6y7Z2DaqQ8@v&baG6Hyac-K#k)=^uF4 zlpK?^ud4+f22QkyL^80P&IYNcRQ}^@adlVKIArh+_Zsvs{@L96%ug(}&6P>n+h5A4 z`jMEXR$OU`f7%Dy(wAY_j1R&x{9+~0;(7%yxr5`HWbz+XAM*}snJXW6N^Dc;bdPYi zvvYpkR}6h+!eAHn+l)?SXgp~+L}}9fg%B$$i`+!IHW%!!z^O@I2>4WQ4`k7g)Z_IQ zLsyIaqB=!P0R1YQ^432PjF;LHr@TQ+ESxQr#k6!iaw8D(icOh6l3pK}QQ?t;sCHZy zZhRM)^p)WxQ$kL`DmD*>{=>UI;Z=HlRzssoCLT|;V^Um zAjqjUaA!Qqg;J>yKld7X*YwFm+5amtrA&RrSe`6Y`n{llIv;`GY5dJzUiYkyCwqf-&p5DedDpqP&Et2Up*afM(sV}Y@G93Bjl zi|TvV2xCleag53W`AJYZ(0qb=3L;i;e)~JAJnqu>y_0_5vvt@qF|2shSRkX0qg&w0 z-nVjEz1kzOJ}l_wz%*wOel@+Sh4j)ONu}S}l6rMD*WuAjfKS=5zopkh|9Rh~h+NXB z!KYf)onaPfrWZy6$q$NnY~tHE;VV}y&vLLn^KUE1&QDu%Utb%onv!OBJ<7M-oD98_ ziX3db!{=oEQ2Kh!qr>9Z?N6o~qYDnp8DY_Pg3`Zcb9?lX{oK_%|F2ncugF;)5cmS; zgp30-9T*$9w1yL5G@FBhAQ%JL_=A^shuex_miwB<4&JQf^=e&W#Cv)`N(@d6OePRG zhp^j_za+*MquI0HF%*z z!tuiBNPH9ctcjq3pc^JM5hOR~Ed^WIbWk29Zehq&2?){J2VxrO5C^IIJ+sawVPy)!x`|ED<+ z^NK__*x$w>C-ixh@_m`b?E!`ddbHgaczFU+DDbIqueIr=xfwJd^kU5`U_J;TLRD?_ zY;#Q+lk(9k)tbgmVyB6-xqxbQH`(Z2O~C&O!3@qZ@WcQ|DqI9|43_!uI1sr`!@Mq3 zok5%Iz%CMIL*g`@^Y4cwh`)v;V0Q~o0MJCivKifrB!3&Q^sA@TM{M$pWiAq4qBetP)YM0)Wm`Uw3esiHDu zxBJdoJ%ULXf#GX>MasW}N6Y^)cr+fbtKI_^k73k6RGL5r8m24vjP(u_NE$-<0e%%e z6f{T^kit)ufb<~QPaqF^5eO!b9D+{?$pAGW_=?2;8JZ1J4e+UMrcnNp72nEr)W;mx zku~rdt@Z|SNCZ8E9n^e;i9qnd{zn)!hSxQ~PlnOro>)uc=6;YA1B$z>;BGR^u-a}M zIR=50ROhK9)iFTKH1hD~_1S6H9}@Cf?q5hqu&n@N1x#A#$4L=NJbd_HNrI`@R~OY} zfk=M{O8+mQkNYp6j}8#XqMJIJULv0X1`il9AaF+9=D4IrpXPcTv#x%bJ_&ott^S9h zQ$aIyty;%n;%}PEACJAxtP6zw*>nTL9TYv7S3er@9qF^!6TV8Rp`iM2(RZ7lN=z?Bo@wAJaWoC1Yk|XGcgydfjCdl>D zaw>(NSB6zw8G_OpY;r)G0%d~e0q4&!MzJX+UMs^1l2%TMf?hT1ULhD)?0VZW zs?>>>>91EsWo&lFBNyN{Kg-ya*Is#of3{Pp5x}e!M;oxbMGiyM!TDQc3^gcys2*~g zd!+HnyIWrUCWlrZOm36rl43Tn&)b5PoAGsFB=$r}`7!kzCN6}8?52w@ixvs3ipg-dM{j=*WU*l&pLS@JPcR~J(T=#8} zlPY_bf_F4UOjgz3QQ@-YmNiRnaix{VI?i^Tgr%HM1D*cmyx=ZLzdtx@El_t39xubF zA)~;18Ac&z@)Olj?)PeBf@^)b_{+SP!?Oa>zbPp!LPC02xPLf2R*_jiP1llyLHOJU+(|F)gD zY-IS6zRn{m@~WCP!A6a^%AFB?GWEVfQECSF3F=snzi@=%UweJ^XdGew^6>vb93kZY zT^xbgU;01b2r>rPv-3i<2+z<}2?{NF(tg8wU&A^pFJGQj@_l!0f^ zp-{=b1gz}Ft$C`6wn zOGLf=4rYvvKwvU9F(AjrBLwJ!rOf|!EFt-Sg(YbHcd&$hi1@C!r-ZTZo-O7&&E9kb z$y5@x@6SyVBuiu6>DLR9=Aq8L z_>y4I91Wwy%0AC{0N$ozQ?n~a+o(zSMzeJ&)7%P}MPMu4!C&}Mdt=uU^J1Cq8Dy>( z+f$5e!OAJ12b^~yX;C;Od-4YDsizHP#v4_D<`IJRo+p0o=Sh}^_g$HlVoiOilXrRD zLVsFldyS-h7U*RiY!m4?hw|3znrtq^KsPY5x!0qo zdq+4lZ2qOa_wIc%wSSoTOk)}Am0)k9JEccds}HQ$`d(S{qx)V<9%igFD&H5ttOuN$ zxGYpMF=MLXD>g3KrzG}*2<1XcC?J5tDB;(Yh@Tec@BKf4xD@1Vn0YsT=A#$dGN3gD z$%^H`)pZQ&i=a&YkF+i1J=RaW$jNcYE+9M0ysH)hjsv9Y1qx5TGx6R$?k*^O@D^X3 zjqC0bgH=+dqN||bU5x!1$#_Q!8?XA3s7!IF4exJ*k85wANd@^7q$s<{4tkZem4X*sDtD_B*V=+HzO|O?}=f^ zMksA+v^*+wcnHj_(Q`D187Pw6#P7|-r8tudpU4GcZ8WjI6@w=^xh<|cXxxPfup1F$ zKC+M57!rMD>H_^?Zo)BGrH*WzyV>TBTfMTOQ%@H(c>2+D#<&xJCQ_sbg3er|AD5+K zL7h0B3`s$&MoSke0O9I!Z<|X=BOrT8t4Q{kMGRf*UygT;D;AlJNMwc$Fau~(JwebWr&Ofvp%v5k0O(jBG5 zyWiin_r~f@QW?v0GC>2iFCCtsaSp}KQ!Q4&w_QUQIsZnceb+3Ljo>46 zO1Z0~>iz>)^{;0U-;Pn@Oy~q3`RVCIT<38@2cu&s?Cg;zi4f$^CAphX)99iEXifm-^=NO*dGt=m_H{Fs#i1Bo;v? z;u0}$Q`J4}O+I-_&lTVzgzYy?IG6TxhV9Wxw<}x)Vz;Gr|7S*4t;lI{sriZ}Qde4H z&Kt+P5@^ICxP=NL`!JRa-Sz~spAk%Zn@=6&2I{Ac%H7JcSP-y$N}u>Ol``O$m26?I zMOvJoC1&aKM=pBgnt&%4Nrvm8`Ap`k2MbbmsEh#YN#U{6IrzRpBi0-lcjG<;?ecq) zDCRRoO|@Wrx`$t=b41Y^L@0u+LB@LO-rjG`skgPAoE#VK^CIthN;IX-Y;Rq*d->!o0c zoW5yah+zqsebB$~s4PYbJc%5$_nj{3ioJSqnQ?wvj83 zD$8puM7zX0N?&v-eR#K{ji;&=V5>@ESLdi|^+`>Lc}!v7xh-xsR+4IJfwrUcp*lbA=vqySnM3nW9Nf;^TLZgV|g}wP^ykD^to%US^8?P=Mw{`P~VKoulnPaD`nv^T`KjPsE_0)41$`BabBOAN9FHM&Jv`Cic zCjQd4;cjjjPkqqchAj_OJFqv2WF$|u$Gd!qX_sj>;PIJ63G3Hn-YJvjO$!GQqk&|g z0!u{$O0}wkJo&WS`ZBgzPokf2)(TMHVHl5Y4 z)W&EvS{0x3#!kJ7Nkw{l(O2*W-*QSCE2@1rXzcLEp6>Fm_VkHcv!gTM);JCoqRKLE z^;@pu&(-^&#UDv((ERVl*O~t|zAiTk^vlC9fGJ{+vzbDwd~BMWqTzBp?&;JCwS+vb z^~*DO%QJmWE|*1gRfA=$#_~_b(4k}3V-dl#KT!_no@CIHh@kN=oRFOhrTM{zGnS8O zxK{6ez24=kR!B}t&KVkAdRZfneH4|P;h6kl+2lVW8-pV8-QQg>Um$cRpc=&|rmS@? z=D$u?|7(V0|376oIR9&iqcHG~1-(!6b;HRY3%YK?35b4!B4?EFe=ThyAn1D%ANT)1 zVgvf`iH#rsdx(w0lU?@=4+RFVK)E=oFM5A@%Flq>XC#|xJweXNKXZ3=;$Qn&w|xzo z-(N+NF<6)+b?$r2^-MWy3%?!vTSD%$vNjI#UJ4SNGGH)d?Mkk?9BGdU!0l_7(Gv2M zs@dyCe@qpDSJ5m^KLQ&~5LsVuJVHQX42l}o(}(+YPC?uY+-X6x ziTx44qy@!KP&PaIbmb8xp>*XWX&8g#AV_aP6N}GX5FG3bWy%gWyFEt2;RAmP7)AoN zwOSrmclBb$3q4;R$kZgdXe=n6L=;|50Nhp-HSmpu!|-dfgoTH1=4a-J7G!MQHU*Nc zC@m5)#of^0@3%kMl)J3|ELGrL^S6G+4t8h>Sipm792RUlI&*$5@Vgbo3?yf9Xwi~p zCq@(*OpuN@lRO6_6FhE1@nNJFf|xcG31F_lp@B>8WL?^KRHZJ0-Zpe!piXDt-qLO3;1b;!vVxST1 z?k^}V^3}mw9;udx#011W+@D+j@kr;;9s*}291(xNj@F~tx6&h3&#S_5#HU%tbCmty zL4uu6u)Li#-|E|UBuhAa+u<&_@8fBi(q~&M%esMCMA`!BxdAurDdh_H(jd9yk(|Qw zD}2&TenH(kkG;4Qmz)JZ##tQHJ2dn8bwD5+31@3KmgINmj7SuhsNvz1#Z7vDpJryQ zWvvO&1mMAFXf#otZgN9kDsxuqVl2QA=RWM`Tb~r)@0YxC0>CsGmjoy<65#2)cNr*8 z6G$()l5*e)UP|+H6_SxtGg?|@*TAu($P4;0eDe@W6QD#{86v4KO|7lO(fO!H;qek~ zt93!|rCP&syZ$R1gi-W6PYv4&J|kNVS8T343Q!k-$AH!6o4pDa0`Qo?h#%}G(R68I zs!s(4E@==E3qkn;FG2DiaCwLh({Lg06WY4}@@D;5159nO$uX?2K~x|CJ$}h0zH8)x zwR++0bhD_zV{mzdqQf$%lN?bniwY+ z7z;dp7D4D3Pz|K4;Lp)_pGgVn>rtIL2iqS%KOIYkUcNKzO0y7_QD8O7dx|+cx z{4a6yy*6Zw(6H+BqMZ!FQDe=VeZ9@XS-;x9#LaO5bCzskGcS4HV~5?>8~ME&(L6IJ zG&BAT^Pua&_4^-6m%b0%&O1sL)THDK2?;;AGKz|A{^)Ykho#-T z0o^2I`>_FcdBp_fkoQ&NMobkOf8Q|E;n( z9X4@o*Nv>x?ioIsDzsLWo=pgg(=iVWpjCNG%7vw+NpCfNUtiJPkjI$m-BlP(F;#-q zh>06XYwQbr*K@uXhB}kzCZUtbLUwPpf~^ONz|051Drn;+L-|{uN%withTA^{Lxq|p)#f0u70ocz{Mur=l8>`60t9c7WXjPo zXSyF8wGdbQ^N$BirCNzsHx;mg5QYV3BaHLIFUd+7xu5ekYH=PfD)g%NDt04uuvuwp zG0QlyLZ0pkvqcD$=)B6PH=a++1_kCwN(d=9*TA{Ol06}lzjrn#`zGk+=-&6bCB^Ni z;?_K>O{;Gq1v)QYSUyVQTFqja29TdP%(C;X4;`aKWbu@h%s8)E!#vfxX(m)G%M|q- z)NZ2tL9I81QYh_qy(p*IckS8=$SsCSf9j{wLzuWA7j}*^Mk#lOM}V{jf|ttNJEr7O zgdo3Jl&XH^PmX~MuODT#cCJ68rVT-)27*e;rKRVfv1(!V&Ka1>m2^wJ8vb(mi+o%6 z(plkhp$u%QkY;`~Ht#7BpzO%hZY&>nI(uLLThVSa##n^B@3* zr1V#hy8Z5zS(8~Y(i5d^B=#*X$TJ%=1yN#Qj!J)}6~k#!`MT`=cPM4x>xU+{R-VHc zi%}b`I7-;WsY4Ru3HKBSuQlef27Daqf*u!Mhpc^+U5v5?={|Ol;L|U+#xbGJu$A)>KynhViyt2pbAZp%w`P&%Ih*5k_)9SxX|408X0uIdo zA1566{xibCE7$ic-k>C!aA-L1_;orfIiE+%u{3|`=r8KL1k?thtRQ_5MWjQLvw^I- zU)xc!*d6h6d4nY@kwcBqut}hl>CQ=fQlvad<8Rf+>T^2H8qjJx3X0Nn{Z)lC4}Grs zP&qZHH$|L)nR6S1x!=hjyz8{r9ZcAKjUQA5{_|+bp6S7!MtBkH6D4>@jUwY>F~~y z5Po@oIc@$jlc>u?eR@Wz`@;(ny_J4IRj56|q0{goducg$0Yg)O2z1 z66fC_QoakK<`5`!zqyMjk{>if2q^H#o_~!Ph@TT(jCjJdIt5~^ktD+Fogu$II7&0C zw`em>>%J$W{>}H#%&QGO!C~t&!Ax zWUhK;$_0y6eiePs^=PwbMRZaLMJ1EgU1WV%TKMi4*(6qaonplcKL!5Z zaLB>5JBkXFeZwKcTD<#R9uRt<7>S7r*Y}CopZqXjoGl}RQljgObhg1D1V+NRA)1*w z(Bf+MuoY)bR@P2bLOi$8*PX9J&LvkuTQf=>mGcW`b#jb^|^KKRgsWHMy= zfK8$7@%W*f!y{FSnqS9DEzEvAmy~;HKPqR7t(!{li#hYIk}lKjH-;VC-&Z@O);Dj2 z zPQY;vN&ri~byWi3vl3GPg=5bx&e)-83unQ*3QBc?y3)?l`dA zWn{LH$k|PLtHm(Enf+NThhA9bAbRp!4?#}K%{cDuG3ZA#b1;|&r=}JxYN{KfyDW(P z!O}n5aU{GsxEFf$dI{G(>skiD)8U4YI#862{#ty};Rt{9K^<{3m{Wl4cMPtI(SQ#F z)#?*9Zq2ir`c^JH`O1^aIP3Rs@S4NfyP$44 z{EmLm8-at(8Gn97K1UMpmNk`TYtReavD`U>(wYa1GqLi*dO z)(QD_Q`xtzm~-&F5P#R~;NHNn05O-B^f%9;!U(6{=tB-)Tx+K@!->uj;*0--y*H1i zvhDZ&TZT1aE%Q8;u`*@OSkWM3LdaA}5|YYnC8aWp9F$BYMdnz>Mah(83YkNh=Xv%! zmxilr*!RBoe(vYl_kR7ZfBaFeR9+nC`8~d$&-=~(pxZiD*>Cj;BYApXX|=dPTX)NZ zQK8tV)M#sl7*5+}R(^xVus7({ny6Bke!8 zdvFRNYP*`t(Uk(y`w`OGs;A2Td$td*0`xy&`-uD7_JL#vgdjBCe@FR2`@d89aqVBO z{DAoaFE13=e^vT{|CdTXvLNY4M}P2#SvHj`qgXcY*cun6nhd*wnr0RDzgB?Y|DQNO z{!#%l=3N(40xF}Cg8x+yh~U4G2Snyy>j7b+t1qPTC#wFlHjtukHV~D?|J(+mqWDJ} z$kP1r|GEuC@*mnjpgs5RY#{VMZ6Jv6HW2C`HjuRk=x;WVmLE0{9q1_x*+35c(FP*8 zZ3B7zdm9K8IQ^$=AR@oFfmD67ff)X31F`$F4aE5$+d#yA*g#N!uz}S7l?^28uWTUL zKiNRSY|;NiHjtb@+CWrDY4*QuApd)9AozcU4MeKhb-(txXQiJenS5#r2%Z&ZufI}{ z+ro&&nfpF$?3!Y|FSB1ZFycUoGrLrkd@bYfoz-~%8z(P6CS#JatObK>i&3icXPDpl zM6=KABq)5C5dYA<&eYbsYQ-)R&}1NWexl1n&?ZDbytGj$6-(#>E0@q*cz>lYL7$vr z&saX*A8$>xTZ)VAYJ25x<@5UHGIG1~(ECYvwDpDTCjUAw^S-YNmj1^E=HZ^4L1$l# zbI8UgTi*8C@mmdI)7xuIQ_+8b(B!eGjO{8t#2qX5*12zGsfF31kH>hE^Yyyw@#e?2 zm1TK5yw74Z#ci_X_a^2!$%=OM%VYN@FR~hc_$>d5P<(E^l#RuTVBN)GUF{LlGBM|P z+pX6kKR6&(w*UPS@kM}2V!mzgX{bm=(W9^r$Y~Gp)j>*rl$}(17 zCHlQwFG1b>z&QhyGBBLn>rprE{ZgQC`dOfO|1j+_MBQv;g`#-QfP;u&Q|-8AVc$x( zP_7*L)aKV_L~rC39gMk6z^S9E%TJ?}8#SuN%t+i3D?QzZGp}x^xl5ga`V!}kgYgUu zt619O*MclZt;dzFrEnfQ8m`3oF|4`iYv5aB|7=x0`V%;vGRtPxtUnhfxPd*98i_|j ztqF#ot%=0y?bZad$8kEAO+mK~;zP4Br$zU2tCGIyhYoU{pTlHmWZ}2&7UlSndumI1 zLqILI+T*N)<*K-pLqP%@Z({f=g74N_iw&PpE;p0wMZNU5G@$tI5_#nx{~+SgqJ_ZZ zL*Xx5w=Sy$y)T0iQTnyXW7G~2Pes6cM>MO@`ojlzTVyUv zC+%7fZJ>_vzon;w-*OOix8b|bd{nLAfG4H;bji(F9YB2h$-w8z|)|`J6iirIp6qx{_FVF})q!X!!bRxBX(uuS*_+6x;#MwUD zS$;vY>BG)!V+)$_z?~Yzyvt;643sKJ2tEoFa}ID8zU$ z$ew)U6L`E{yWc|1xbk+1MkV$b|Fg(-R)aT(SOn)ZBM&=O3n!cTy1IPJ773|FVA7%Mb=_$ za#q?bQQ)P&o&a?~@B)fXwTZ5*bWq^!S9wV-PH_D!Mhq{Q$GlRQdukVbYxOOI03w;l zLl@CUMFMwv^3!syZt3@j{GmT{B-%m%>dzpG_x9RhdX&QPFT7Uumqt{yx^zMs9a^w9 zAF-ky1;ld_@7nqE)-|5!DQdJRcx*&k6r`$ryjJk~%m9NmUm8|DF|naKNqLU!ix)7z zOu3h`^m@sLJ$P9TXFWCd@zl;^EQ9QWg*Vz%D{_4`cI0v=+GHhVKYN6}eo+%9HuHr9Dt~<{yP7I3t zVltushbEJyA0`v;SU4-b=(J$(@^3a1)8A|+7Swl7YL=Y2&82G^ul{vP&1_kN&ML?W zb5D0lQG!fo%=ZPASG9<~nE+>0p_KWvLrGp#Q{Exb0#`5U9C-51wXD?1$cIJHILkte zCAL{t&y_avavq;n%S7IT1gX{w9Jwi1owJUDJp)J-^YM#@^x?@#J|!L>h9UB(PKP01 z&`OpZI6iATt+ z%DDDW)v+n%_*Yp0d>QD9L*_v^gz$KzInR-P@}A(swpBNkKLs83+|YRWTM_3dRKzI* zvOs2s2HSGf*zd&{3hvn4HL|5r$`8ULBJ#8<)k>Q#(&K_qlX=N>z}5w;TiuaP9ud4#N`{2`(moK3redPWO0>CG zA7|CTY=6k2bSI#OBaC56;KLZg3mL1wA6AkxM<5zKMpBCvsXg}sU`BG^haO9y8BghS4cwsO#V3h{t z^S$Unp9w~cqGvfr3n=qKksTf)>I7^UutXuGAeV(!6yiGIqN3#im*)}oAeD+%918CH zL?c+hJQZyO`(fsj_AbZDMFT~zOP+Mnaw_p#^vp;oi5TA{21I&sMA&(-xk#-7a{|gs z)IP8}uyq_Q1X@4imSIN#j~1E@I118mz}|uQdMXAnqft>dy>2FJHhdPbqi*PtXkGfp(Iv5?VA>Py0n-MTywJuZ?%{68)jaKmHdMO7RHp#y>>oiIU8xT7H^MU>r(PtN(=m_s zNYsQD4`r<6yceSn&<}u_M>^(0a^31uzSzx=UaLCvOU;LX)(3;?$_fDnWggK=;4 z*&~Ssb5nJx7BX9B{sha{*@oo@=)(^}5%Z5fVfovv{0KbY5i5qJ~xVIJKMj9i_O$Wj?*PgSq%lZUk>j*ZX(aXwko|R zPw)Dngdn~YF0r{=-UKkyM#YFW$?d6R-5nje#s@AZ!Wj>=b=AzG-1moYx5%Tq+Cv&$ z5R1KYR01&eggqt|JZG(B%nT~HLee=c`p}fD-tt4hB~`1I7j`73+xmAbS?d#Ep5qWwk4s@O`c9KulT|`PITW}t6 zEzc^VtG<2Bq&F*GPkq*Ra)lg7JcYAS7DH4)ICyS^PJo`Qcsq>f5zl59Uw>1Pq?QvV zUfHQSi~OtS#L8qYURbEe-5h3qtf=BPDVk0+3Gq8J-^O5*xog9Q^yJ>bltEZ+=}U`k z+KRF_+8USxrKiy5FfqVoj5dG;gU2)QlgJ~~BG^^_c?EFb1{DX;(Zq6Vf^+Rx`>vi= zH^2JM6yKguzt}l3(L#ybxpTRuerv6?M==B9kD)%hO}w7#YgX9K>ROzB+0gT4xVb07 zHj+`C_wjT56TMarF8m&lPKjj0Pb9lITFrJhH%oo_mdn*)wy+~H#d(Xr?s4GO*PnJg zc^$Z|vW$ipQsw(??JPfOMu>ADHh48Y)gyR&`CQ%~9x~#RxtgBT&3(&BM5M&6%OW+< z6JmiJQuh2k3j`GG$gm+_AG2_Vks`VmMa#sF^y~meOOA*4yboy?aFc$C4*UFpWBpAV z!vi_3H;-u6yT+JEkdWHgZAgg!=lB<&*Prjz5LLD%X@p1^Q_Iv999hms@>l_8RujX#_C0;4YhA|k#Rnwe`f>4 zKfr^af<5sAT#SQD>uJ$TS6vHZw);X3gVZR2!;=x`7}(|bg{Ig5t^*;!>hF&G&IMW9 z=7P+8=Ys48!7CV+qu$l8MRVi57&6u?APPt{L;)c{6c7`p)62I=6cEGj6cB|3(fzWY z=rz58FLF32lSjET3;-< z?1T|USKaT`y&5|{Iqd?rIuZOZ07@cp{9w`vvkyAAc&}jSVcj6C3vmP{3Y-9rn{DtE zGx~gK(lyyy#ezpKR;JF|Z5B~Vm68n*f!;at-@sX*>|RjLO`Mc^O(F~OC2;eKx*_M0BgjI zk!{3-$wrJ7tOU^BqGkmjj$(W{Ha;=qqVn>eG==lk~XDL@7r}AuyjV|?SC0{_SC+MUc`~yl**iU6ln?) z&PNL_3AbGD1tN^p%6vlKeVq3~lQq;m6UR3LGR+^d?J#N5mvfzECQ&6kEx^ictT4Z?K-frn%e5*3&Oyu^6B1C55{rJZh?hv2!_sL$mX6GM; z`6lv|Y1yN5Th{z`pXR-|^| z>zixQ<(oovOI+Q%jK37gOPJ;MPk6%n-+pPq14o8{Q_3Idq6{i8+qgJ2~IAymGqyavj+; z3qfKEA_u;}umf)sEDBFPdeQ#tCBC!56nHih^s>js#d3YhQN?FUoXs{zoaF<8JNZn~ zzT)rZj-SDJuob1suV%m3t1=7s)}KFlAaK{Q#jHBxS6j?`zDl?FQOrMA_Dpu_Z1|!x z;e-Sal+MnWpMKi%Nq^TWHlL&GXs@rq^gS8N1P_T8t%o_x?m9UP2MWyR=)Q z^;h>=XM@w?js3Oju%98x=o4&4>Mg}}KT?te@iO(Xg-RpZ(b82fpjv@u(8c(=>*$o% zu4!29R0>ny3BB5sOzY75CTX;iSGAll7J1Ne!c8yo-I@#N{~;SKCdo!~NwU!sAMX}c zCl==AUpQ4DT2y`~HO>x@#UZtJE6k?-0odES?+38g^y{6e-5SOhX2T$sr4#78h0``MD|q8vWm%e&W-Cw&Mp6Y&P^K1x#ijWt31iK57E^1 zeEB2i*4faO0d{3zjLGmiz&iuug&c~|R-GDmiv{GF7!@kSaDBo!i&Wy3!$eh}oe4P^ z(5*NuxSEM!;%7W&xy=35cJ1Qzw5s+o>N^l{_jqC7bg+7dTo=pdos+F>G}975SA&L~ zJW%v& z4%@y|-nn(^=&-KQot3KZu=EtcYB~2ut|6N{_ZCI2Hv0zgquue_Jl^B~5s!E2{rW10 zK_;Bc;?|*C^BZ>*)46Iv&mf8wn3N%~x-+Qp524t#6JG+}kD#=N?@;8`w<|Nwbl>4P z`!+o3^1;%96eK$?a;`gWqOho(eYsEYMuQm9%Hvrm05P69jGv~ddk0pWO_i5c&cjnJ z)PYzwMhbd#bponAAS4^33?m00pkD$!g(x^ZcM;0s@xGzU?=E)+upfOxwyWY0V9&uM zQ@@zfVG(0tDC!o?EgWd^onu#6xOgWy6s2~ODT$=jd+ zP8~Q4Ae4(?hHZc>S*$qWaxQ7+grF@YC?2xjZ&YE(BWhC!zYO)dJ{7_xVWmLAfZ7E- z@5XThC0!&9$Si_e0_h%{7%T&*7DMH3?;cz@M_ePNL8n<$Cgw>%H1!3pj!?Y!|!@#>rE{ z#Uf*RCC8o24`@b@8_yiHW0*2dbdB4mk!z&B^aq6K1Ck|=@ZFL(w=!t>!;-hq2mb{j zx-$3-LWtUt5TarvgeZs&#xU7=K=$S1WCbd-F~SF4Y8EwpS;~v9-BJPaQR=p{hAHjt zGX3D-)hW&Qb`MWBl&;v%D6h#p32?;t{7#A|Op@ZcW%Rozc6@?B#(8Xlc!dGJWo^F- zSL2}Y7CASr${KDECW&FDC75W77psJ+he$~@eNjI&*$kWvkgVIZV|=OAoiX?zYQacf zefnv;Zb$b6>1VH_*H*N9fbx%51R&e20t zsfp*b@4B$Ad+pHUqM1p`7qyHV=~M}rVOQxxEnM28_Di0GWx>6i7V(EbNgJRcVwkWf zgEwB^10<)R014n^M7Tg0`&1&v1WYkPqbwT`FU1%rGk-J6bq+SL%LZ*5<+%RRD0c=j z%9%n&Il)=6dp{f6IFQB!&9atYk_jO|rj!Agm=R~pOQ8sa$J{8WD~+xouT>;}*0O5s zQZ>}M+3{sVzh?ZJ>1Ka~PpHu&tn^D`DPJ)fz1+CU=;MU}d2dWEgusPpTM`OjJTH3w z19<@OzJ$_6DeBzucZK2&kh}{}GD2J|=>0JSWRAiaASS%=05TNz6pRi)%B7D$;R|vn zoypouWwk9CrS+8s_U3`MtxaQaV;ZAQp&pe|4{D~NzAT{F4>+pA$0VS@95}m2pz5Hd#vp6u)m>1^{FT=BZI7}Cw5gv`3Dd9S!jp<0+b%K zrN7~%^@NY2pRACm6zgjd_Cddvvx^+Q11x6Pf^}asyTxD8re#AQ+BCN=t3o~7NMwmz z!*Vdlpxe_<-S1CEfzEVb$(6src$S-=a3|%$!$5CU^4hdxHT_G8FCEEE=t+jL;0)8+ z_L1uHb2EZ~CJx0xEBOADCLy)fwp%c5?di3+`9z=)hY})Nya&EW&m<{s0Y%kv*nsh_%(F*EOZB`d%BO4jn`a;@*}aU7E-n! z(=04_Vm^F1yUO{JXlJ{GusVJGxFgq6+wNU)O=mkovAt)1r_Hh!EgNg!v9;QE`bOLk zS@A>6bO5hx+1HkhM~&#Yvw6qNsZ$T~jn9~V*ds+jczKgmnF=S4U_7Rk&B)+v{M^+IWB*Kku7Nu8(ENi zhcOW1KcgMVVhMn^0G&iuYy(y%k;3S#FR~1e1&b8cy8-V796zLZ;4MTOF**3TW{ZNceL%U+ov;m{^Dj)`@<~GzDj**!~2)Rre*fB!RVAP>uT16Gdh`8+%Pe<3=2JjphArQZc699D_7-2BA zirWW*!_kbCX-O>u`+(yK$gI$Y(=om)UU@(RdEfb@sGz@p*%Jcrk=YlQ=4`_+&OqK{aVFad{UkCr5)ny zYu#skz3;AVe5AJfTzE-nPsZwX9hGF`$ku6(*yRCFvXT2$Aw8b`76!&{o~?^Po66cR=s*{#$LTedzDV>jjJQp zpi#>-^EF?P)KAk^yeu=zXtC&P)?q6&h|@xx6r?6f9JqlaX4{ z_uzPAZC!t=n3>sDdhz4kO>$9$Y}1k@qh})ZsbO=?YvGX6r>A-EZQGf<0Lw_T6EA%y z!`kQYYn;+V+FQB9z27Qw>m4`7nSkRViB)}Vs}FKkT@jY1jN%G=Ep;wLl=1cWGLhaz z%Fjt_8j?Pk-?y6Ozv%t7Y3#(;X$2HPTQ{d})_OB*cd!zFI^DbTgY04Zdmc|MD5JR)g!vpZ?|J0OuVg9J!SBLNZ_q!UH6X`ZKxh_V@`*G^9NjSiWB z1UQw}?qE+l+W_Wr4X%a#BZZs_$9F9dG?}8#w3pXdR2Z)G75SfFdg%GID$%_QsMaAh znQ#w0Z;q%u-=a3o%0SHvq!pg@K0Av5pS>`7WW~wA7pQn69qk<#%;fD9y+ z7wjMqK~e3I`061Ulsuqzel=jifi^0}qt;0A+!53H6>is+dGyD?LGSv|S1korPpL*9 zcgD+qIHe436(e}?eom8vg#6VGY$tB71|&<)b+&sPqol3132_JHyTpeAjC|vEjR$ai z{b&;v99!Jmr{pri6=}V1VqdTJ)|;i!HqRgt5ltvONG?4s!y&bzB!P+ zzU`mkmt!~Fw;958_>(;=;Rx$&&)I8h>+B9aOU&s5i8euUb0xp{Y4-f)r&-to(n=7< zWWCJ*_YUoalux2>Q1FPg0YOBB3I?|7ETjMrdL9!d272G2Ss)|BG!enas}6ONj{Lrp zbl*X)`0REkDgSO!F6iN==Auw}a(pF{hk6$X4u<1^ezVs<$?!)nVZSjVrRsos-lrV65k7j0G;;mwtIVT*`FqOai z4gA(u&n26p$;oLT0;lDmBu2j;H3DVt(bB*dPP+&2)S*>iJAh>!S`ry&aIMbp)I=2! zM$mGCqh0VA>d`g&N({WhK~_U#{v(*_f)~QPz{_s949dIf*jl^4y~=B#nGe54eq{@~ zpo_qY5mw6)(9m}XWNIUMpkYs`0wE3y0uB`jN9aM+Qvt0uA(ev*kjTLC0Gtwn8W5Y% zmVlUn6NjaOsSMmp4x6h7TCM}B@i)U~WDha6F|^rTs9$31I9{VXdlO)*5k&GxpZg%8 z8p{UF2UI)BxNSghHP!@NZb2hq0>G&T!3B+hp*090$h`8p1uYL|KGP6kw?NiAgtS_6 z;E4%?MlaLZAGoks5-u!>gbTBWaAC|4F3giy(9)&FLBfUEdga5cc4O#5(w{HXGUJH_ zw$T|wY@oCp#cdaRUikfe)yWV=8x7o^=5(o*68pi~t@>}u^9L96VuO~Ga3tgT!)@ca zX>mQVZn(emAdfukb;K&wcUG7Nq=<0rNzIRaE+ZqUO-!q->HQ#wB8FQ@m>Uk9lh%&C z<1~8&gxXUwMG@YKjw|=~TM5jA>OUg+_NeysBqf}s! zk|G)<2&)HE@rbkAt{wiK;#KQ8$sAY9Xq&QECMsi-%buMUkBafTqe~oWEn@cJW-rbq zkR&|xn8qFaiTkBwcks1*)A5k?S_7pG#4cztZMA{eiy9iyr48xpo)QOXvX~=GdY%4H zB~%8hA|97osXpbR967Xue+>uFa+nZkpYc!*qX#X<$K^1*wB~kkEq8`{pWRU@^*-yq zzS;|QGSNpUkopU(z==qCfx_FO>l(l%z!}t6AvcDpbJyVyi+DFN{RORwO6^JecI}h= z3MR+2^L_?Y_K^ZAYrQJ*SPrgL&0v21mmMZY4t=)G#_nJXf&(rs=uT&DB%;HTi){x6tyiUZ5h5WE8cw zZ0Zakf3%!7Z&&6U+j6}qafK+KpB=yIxO6AmUb~3esE6n^xtTK6nc~oM1kB7~m?Lka zku+5cfoqP}D@#%`7Wmet0L~4;0CwL-V*yMJ#Sh{tF;oPHWJCZNCCSWN0|F?K&l!3? zP%hibl$CBuGk>o7=FVLJn; zmVUX|gJ4%3jt=aVpc3T1%A};2JQMQei(WwRxtQ>#Lg8z#)$1d*b`*V%z&c(7b#9nY zGQ0+`aK}tR=jKE?S`^UK(_nzWTj>ATpoL*1E43pGXFd zeY&{^;u)WUc*Zt_{TI=?WMJeKiW$ZYoKRHEpx_b|k^;ui?AKSXr~BdNnJ2k<7|9TXUSj(_?|q<-ib_rw zZRHNWRZ_Fm4sdIeEIf9sw2kjG)REE=*>*22QHM1;MAw=n+^BA&iDfiHxi#_-D}MAPgkm#k3N#y^w`u z;F29y6-?(+o(0%TSYIGMg84*pHeLW&NsI_rY3;T?M{rx8bDX!(MPQIxYxi*Pdirwc zhBV-{!tgTNNo#LjuRJ#Wm?~fflIEm3&F%{f-`WmoFhd;=2_7``ieCn&hipwWtW>)Q zQ6ZQ!uy2~11PDR&I1F=ZG_2n{uGBN#!n6>%R%*$Jtt6an!)TmnRfAYIrdpy?LUG;FVCV=&X_MaxVf zO~croxFcYz2D6v&8L~oCfVM*P9heP)`~h+vMpoPcq+2lsYt1w5GbyLgDq{UkSJ`nJC?TeK*5tM*-N)-sQ1)5Y-@ zv>QjZi5+DSvE#RqL%9KH@5Kr-|6$sw{08Lc0D*h4d-3Ms+jB(UALfV`Kj#S3?Ky&w zSFq=oIbvpej)2C9TfdAE*Yu>P_Wc+mIKPb%*Pt{$G26F6 z8Ww;zoXUx9y`_ms%%+JdDE7S93ZY!_M3$Q!%C2m3KryNZDY1@63uM z)oP;sunu8o2ITCbiT$w!`2cM}gh^Wv4p5tkxrA_En|SniSP)otz~#7;anD?S$_3~9 zwjsxn5ad|VI<9(PnVsN`L^%J+8wi{D`RWJ#=t~#E+W>7hBy3gIMN*S4^h03v1n4e* zj2zfKMu^2p6=9$dBF`h*w7O5{Pf%b};&tV?VA`XOiQz zLh!3gAp~3ust@+}GxHZ=^Z$xxrXTF^1|%Y`g+#>nuWi+OU41(em9@9zc*Hr$gBYz7 zi}&VE_`p+&B-F^onND~{ZFx)D9XR`f^Fr7wS_z4L?9mpm+;iuxt*!6>cNVRs1Akn! zn*O6j>*@bw(VF^g(W>xIEm{{wE2CW*svMJ+#=V&G@d4my4O&``dJpTC2WHoJUSQ`F zDz~YuLa$9~*{L;5n^R-X;h2@4Jgu1{41|d=lz#}L(s9pCDqrFS_SIEJ(9wW2CY!Pa z$_{8RL`)NE__0zwC}>2gVs>oEM{xQcKKY@V84&kjnV}P#qY25+zY|5Z^+eI$qAq>mp&I;$}4%_)a)(G(G{zkWnmW#_m$9Cxj(XQJArr4 zgx*}He!?`q`2#JC#q7%Ux>au(JlDGT@{n8o`;2-$N;{rubvd=8z4+>Z(X2}s=ssPk zLUXS!?6oi2^4NldB3~$od#?@0B3mtSSkV|QIIocIp9!;)@7-umFH$J>;r1p&ZuGO~ z*`VFrYHDOneW-h$PJ*E2j5Sh^=P_9 z*qJ7oicpg8!?#!bgyI+A9EeJ$UfsMkbMrt}XV3|Z(gF|+LKToX_d;?-xCp=oqfkh0 zmnQGLGo3nsCm3~|ylZP8xOg5Kp&{cTG(zKm9vsC3(*oU|NO5RrqJgg7p}T)?FQgRk zx`%NggB0JP^i%<4`5}Olfl3&P%cc24&sk(9v@rd@IzwyyD`w~~;g2^lwc)GRfMpMo z(bgLZmz+Pwvved@lK<`lTcd}b_KynIx16^b+m1;O(` z((_km?0G|DZdht~`7K=EaVF}7EdTRtN7*TZ(>mM2Mf_h((?Ab0z9Nr2WU-x1+$*{w$A!#sq{Is=hg4Cs%n< zuN6=^fj$C#*Xt!B7+}1h(Hfe&1%cIhXztDh-umdBxK`y}Y#Fy#-ew zk%eZ3q{5uk7;e=;?MNLGTKM@-v@pI-GK%8Tt@I0wzJa&fuNp9VC>CD#yuF9v-11kc zl^inE68TPBftOtkzcw$M}C1{AHogx zII>iOZS6&@1gHQYMICA{u!Z zkXfS{5h|{T-MlkipwR)kTYL2wTB2_DLr8kESZIlQY5>6sI}Q4*p(uR_XdFPO0Q`A0 z6KX?jn>6ak1oSTBl!5&hggX9pe#?l-uFbd;yEdca<~BZ+7w6vEklbsPp)$|Oh%L2B zHPwH6x;i&KYB}Rofgkk_KYXdjr3S21X9rh-M{J2p!(25xd+Y9vq%b-TN#X!WeO?=jWZ0n zP?tm|-;R7m<)(JxF_x)`gxwD-LpB~Bu3_BG!T^&xaQ8Z1sB^IVhxo18fh2x&40uEm zzp?!kzr}+O6jbbNH=Q&~s=}k`u+LL-ALN7uCgIj?F9?60T1W+Nzan^aYkxT2^eH8R z`P!>wY#KK$UPiQ?WT$I*vO4{^(*Dr4^6fN9`R3siW_VU7XjtX*mCL)lu!gS%J8nSA zx0ABAAIyi9APx~z2%y!*?8K9_ZcKmFx>Y$+S35YZ$S^!n`N}XDNMEUi$}@oFl#?yq zI*iinSGv%5XV~fcO4YFZ3qPxXMdF~5Xo;u+O=#zJq)DQ=HysDy%Jz_G)QRyP7#$AU6; ze#9?8+XC`W2ZzdUblbU7*nEx|cJ`27V}dWl#`=M!2XEBecY^3&(E*TU4V**i66UNO6V2WzC#1{!VATF}dO<`9Anr;}yi zy_}vHaa(|UB+@(c7$DDm(Wbmc55dkVyB&S?>E4ts(7#e zMzY`%W7?ThmYF;~<%E+4q#DyoS0ULD`V!B-mxg1RsQa+&vM zN(tg`9BT8G-i0o4rFIVWUY;YCUgl(0vU?jnW#7qwS99v*ijH4C)tK{ks9tirdAOD{FWz#C} znipHfO+s?o*lD0dEx20V#~JX-DPN*Yy(>+c)lS{+cv`tX;;%BaegZxsE?{5~#qj^rAng`N{S0@3YPB<| z$UxW{$n1kI>WNjr%8;7#|3YaK|6eR^Dz}f6W-7k0aEV*#f1!R>s{P}H(-~GFmQn_- zWc{%vspD3W6j$(HwT#?(KDddM`{sjO|JsQ00LtsiX}8FZ1<$2g_Jp zytDy@&O@c@3FrhhupU$P=(fp78RvhIZ3;wLsaWyRsn>Z0XzDg~%dapdNG;hNp1vhD zPu#6Bc*_;M?nU6f_Teo2$H*3=i5odAr8D%gy7hSnf3YbA=w--yeijiO-+SWO+GMJE zZh65GC#_u8>ZtE-CCyK%=hj0{p1D{Pr_0|3B)F>6HTr5Ey!j?u0wSRpXP6vF2*ntG z+j9uR(gA-M#*iLnA~khdhG0)q;?#Vh9GU!f$_fOBVOVKfn2J4iZrykN!6d_i{4k6v z3kAc>dl%aTrs6ctXLQaoCsW-j z?(lqWRhP)>>2x<`L+ZonCbL(Jtp`1%!22?cFzs5dwjoNA4-8dyU?;~gIeKx1@a$)F1j z>5SVtY!-M|2_t>=8NE?lrJGCj0J^(Xrxbg0(yJ1f#GoWVv;mZd?PYcW8Ld>qq-7|V zT`2f*ME})EaRUNu#3m=3_t}6 z#~#l8zTsU{oAYwMY<*y%msCoMxz3(m?6ualVbGgv&|Ms`PbT+tZ}x?q=S92Td`cl{ z>+^#KUSEqo2VYG-`Ff@vB*dWvRazB-@-N9|$98U|4j>)nt{agRWNMEoFnzbrsD8K4 zO#azEL$KHHDg%gkR6M17NOWE}5G#dRypDJ{0@TJs-!pNJs}8zOsY$O)G*Wf0FVqm# z;>IaI9i~nr=0gUV#BT)05xsC z0$t+ES#NlV}4RZlj!08 z(65+Z49TjqI?``CQMGbg`4)u124+hb=G}|UbxdePItAG(Z zy65;Ix{A7D-q&xdAKwo=L!M0W)eLk$MG4@K>tW9bw%n5&3HF3ScgMo_cvH52UX8hI zu0AYEWBJ9_ioEkeD_vOmPf1L#Li!(+o(edmnDglQ8k5Y?z{K}++x5u zQr357te*uELug-Uo9oF4^)P#KKnx>P^gK1o?*AdYn{#s#)H7oE!NeRi@vt#r_EE}W z?^#d*jd`3J_%Mv7gH?fqd7KTvGGlnj-L?*cOCxA5=zg4i8LkB#zwyi%d1xl;Jprw| z*;p|0ph*GJuE&o;u>i+K94B}`iVi1RDg`1ZvAp0ID+UYsuZ&qSV^9D<7fZtn;>OXc zWQ8uEZyX)N0qMQTnwea#Mz$@7>Ej!wn>C3!N4?Ez?PE7v{tq*LXm(yVFBBH&1XXcY*-o!Y)$rpZ| zx7+gisj}DxA)jN#2$6N1Qo3Kw#i*C055;`tUygrVf0xvj^sdi^&f#(V`A1)C*U$b` zPsr}PR;1$VP96z|VceCl>W z@iWM&LVLpKfp|4~&pxr)3Gn(P8Vlo*{tjO{6Jb8 zoR_C~P~n3<)k}Q@a?mtuYyJx{(SQm=#q`$WlXqAA%~eBiF%iiw0av2jGtMd0rXbGH zEhpi=K0Ef;eam{CZ+QSoQXb%2E_Uf3=VC*I96EQ=GjRXUDTr($D-rns4# z$>a2H9HrU6Pd3H=KG_sn)pE8SJa$2{nmgnORHW?oT&3_XWfFU(qU_VnI%{R&?-?eq z^cuAhTDB@z`#co! z4z)wdz3(ldDl)h&O>`6@Sqrk5PSqNoV540j>kU#XvV8$A20eV`I%n%X4ny}moRmVVi z8jctC2w*}{;;>5aA&`;{1kq6$KshB$J5maI!mu}?um5G{RtE$tGqOS{sjvm=gHSYs zvx=GxOfFEf!=?eR3L`5={qW6{2~pcmw;L-Q{C1}cr?)l4PD#H4_r1PQf=wS>30cox zAR0=k0-*&QLMg3)Y7LeJMeE9yoh);xR37xH(6WO}CMs$uINb0MD-TsZFB#xUU`U{6 zk7Xspmx4xSDmE=0)})Tq#I?LH4+2|c>D_NJE80Jc9@gkq-<8sts5v0kYE-o1>6}{d zNKOb=QrEP4nf%R3CO$4Ry)huR>FM0O&!S$sT2NtwIZ|+84B#X&OuB!{=XS_AuWSwN zL*xi)^=L?&)*oI!ad-0ZJvXgz^r~#BNRJKvuk*Q(P?eO=1qm0RbdDkx^z$M=h1jAw^=G-Fs_H9Bt_r+7`J0k|Y z>yWXbemzF&H8HrUeamY*5*0c6k2{%_DK``FOarpsZ|Fzc4ezFZ&)TNCdr6Eg_+g7H zZa-FkceU56CH1=8l2G~!kYI~q#L}nSTH9Ai-fkeQSa4!l0wfer9tPr{krHHF$w2uc z$`>XLhCU+==*3h61|QcB=G7(0Ib8b#4>OiiP=S|(n{rF4v2QBGv@flu9c<1ma+d!)k*9qoDWp>BlrHB^e63pF^vk5 zOrrxN)9B)v1Hqp;qm>#5xLyoKxb&? z$$mi}g*A!Q$+Au9dP}-Y+Cu2e-^X;m*}!0YX1HU9FW(NNAp#yQ|#VxZit|0 zPbQvj8*xkZv}zln%6WQEliS4tUyrgKpPM$NCsJ;#XvJ^U_YkD3?7v*v0!#Z0dOteE zEcZlCs2OBGIeO*#Sjk8~MW~WwAQ;p@bHh{#@0$^FFp#*0;wRJuBG-43ZJ7bFNR&Qd z;xXb9IqW*YBmpr%NpOt9__L4Q@$hPsLy>l)f$}z7@aW`P@9H07f>cpEAg86oinR!Rh zVe-FkH~(#KH~0Vlkr04)`+q|SXzR8ix?XH#(UQ655pxQTt`t*m9{IScWb;iw!R-Bcx<4cCz?L+ImF^$% z?D#0sSQodEcIVYp9vL~xs7U@vnV!6@Os^0o=gp9Tp4UH=>D$J1d&rp1MXkFt<&ZPE z>WLC1P{xd4gsQTw%m_ZP{|-_F8B4=B!vc|VfEWwn2oqOs+EKQ-v)-ERE9`K!QN2)Q z3f*ihpe>=)2fZu^CD<{*$qJF}UH}JH#7?^0MPskKn`hmZ=f-58Rb_0=<$&}Ej5=k2 zxItVN;C%<(dK!*Hx1LKCW)L+EF=UF5myErWH{Xgf<=7=GcvIK#z>?TKOS24{^eb+Y zl;Jk_b;gsqxtnYXDWet1^usQFkG7;I&hy`ETFP{;x|CnjcHfZZwx4&MzkNjaFN}al zNOX<*Jrm&6UoZjeVqf!F?z##QMbGVh|134-(?DbHz@F0yJmq4^HF1nbLj#Z}cT|6H zbnBq7Jl!mW^2xuE?ie!k+34y2$KH9zbN%oAzmN5qeC$25va-vT3JD>bY%&VTo*&UP zlEe!cg$UW>Q?`(-tW*+0*?VulxB7n1xX$;S>zv>3oaTDw7qlF*G)Fmek5F~p9l7^fi7kU zKB3ci@Dp@Kw2_U(-h&TidQl~((;~v`e-s*Lu@$Kew z-Lt!+FyM;E8`81gz5A6{@nGS=Z>0+Lb&ETAq72@7M{A+#^C>@gfLqaN|Cn?wf89)D zgSwj@Y5S2X#_m45c@HMT+K_~+<)5)f<%L#;PaUeh)#9zC)%yVd zjhJIhP0=hMcTcLe>kiRkT)|6F8wEiNgDSR8Zz#v83~sLxzn;=i$Q-Vpu8i}-k-sS` zT^)DB<%%uy$!C&oEy`z73wYi<;w3=M)gc#bF-}mGLb|AUAWrvn0s_~K6YP$XUi0-l zxLo>rH{SW7VM7i%a=yJ@I6zb9UN2YGR9$Da%M!}sQQ7RhPJw}E`3SN^R85pI<&x!t zaxaDJ{%$nycBXjZHwOGcBng6v$ZlXa0cdN%StPe%iPg@_2Y=t1bNKf)=YP$blj1Md zoS^e2*6(Nkp9w4)U`e?xG{$GM&PO<_o3a?RiwZK7DGaZg=#LrOg?vbkm(I9U{>Z7) z6>KSzD@tId7TeevTua`4|1_Q^#vuGo`ZFTX@_w1fn?p~BgzK}NzaZ`*b-|j_E zXdtcaKF9J{3|u~bfU_94q#otEAl_P?U|LBR6aNsTPbrR0}%14FoxHNFm(t z|1^4lF;MBj@c%7@0NV@He}WL;BKnwU^@Ac{f2PED?ea>Pv0P!hxTQ&6s;75A&0K-z zkYa4RIsUuw1qOs~*_L)gqO$nrD7pTQW74aPN(X@#x7HnkDRo#9nT|Z1o&(1dkx=?o zmxK!3%0p2=wP43Yq#$C&ZpTkX4T0hkPT@tF^&y212xGnAEF$} z6Xsh(-xFp{i&rIf=Xd14iuq2p>cOg*<4*aqge`r6Y}Vp$^3h+M3b}Ol3Bf6^ptfF~ zBV&mwYKTT+k3fGpcdb`UMZ42LjG<~mRN)> zxDAS#8fl0T)Ru!HPVQa&ZxqhE9D`Ok*B4Ehrlgla%tPOu4VJSm5JIdZX{O zjB0_e;Rt35t@xsN7emlnq4i^koKgm)5eRnFm8p-xaQWQ1U&wKse?gAR4jD`RC_az- z#ITW5^C4yy_W|69Krkr&5hIuLdobqj55`>m`-3r}&y2D;i3&}hvOA8$cE#wvu3Zg2 z*h+nMM6r|D2LembL2dioos;P_h$cK}-V-cIlTuT{ zLrcq6q6flruMKIPtgjj#ssxIyXhs;+*_%cD-Q@G3-^u6yUC8GP;K2w)A37{V@Nrp- z*(>T>Up4(aU1)vZs^$6GR_4bX#!h~!()q@Aj_<|K^acXKk~doA5MPi?P7SyC+ieJ1 zB7CXeKURns{@+xH!2R_?1gRFy^Og8@4~iJx5we(!G!apgXuFTUv%#N-bYl}KDXNNyp}74(bfC2tI6=z~^Qjs0LCHwiC?;s7g?aC7$ijqoa#$e#PefrU(w zo7=HQYVVSs+rD3!Zd`sauC^2m+@|0G(2He$3NFYJ;F`JQk@QvrS2QR@5aSMELhsBv zgex4d2&bCg0E+7<&- zoz4t^YbZD-4F%_=y9vf7k1?)NzbN#6a%rJX+heS8a;dH0KkBOhb^|4O$S5B+{o9Q4 zw0}RNT=SpGCLTuBa2}KcX|<6txX~?`?q%j z`IeQ(SBZF6&kzhuTulwzoIi74bhPE7)YD-%{hOqSwypV2uff3)(%nU>QTSP0O1it-}Z z2Vm+mxiEhHDT)IIq`#0K1=8s#5f~G2N{7&?Y-V5}9VHI403#2OUIczxU?!576?jJ@ zT@LR6Z5S4y9!G*9Sy&RgxNP|E4Z?s``+Pr&o6XVbr} z12;)hS|HRyf+pI(Y1IU}G-w!THg7V7PkDJt|A2@?ZY=Zn3R6*FI*^2kkf$aNn318` zcq+?t9((J&$&8yZrPXX~zhz2q>bZS_lnU=A_wsm5`>BIR{8IbAVBjl?hrQD;ivq%d zd~n|>kh#Bj+s2#w0eYsi#zrYU>>GS=1rBM3kW54aCz?pXsq4ry$_J^{u2=34yzSo? z9=6LF${v(jsumi!mt(6M{mu3;>;q+eF1ek%4R5LNIoN@(-e@?J+ESEpQ{QyP0U@Wk z4m*|JeF`7Y2ZwlVyUqB@kMKDZ0d5Ig@Ig1iobW~UsPiz0Cbjz-bpmu~pkEQ-Lh!lY z;cNu>_+q330d$Lml_9l3_&U@Wd{BlYBN%=Ko|GZEq4aw+F`R|~GJOqkp$+jQ>4@tH za13BCfP{GXI9}5hc?SkjqLj$6X<%aq!v-4wbsMBM`0#H~CQ=wT@SE!~#jc<0v3tL+ z$7;(uF6|$@`hkzq`MS68C7!&f3jMw61MA85Gx|J;B%Oa5y+# zhqgrFeh3A|=f>^v5Rl5B2>r*ycL7kECyB)G!VsZ^1QUvQj%vg_3Jg6&HQ}?$pic~= z!c(*%*a%=aJW&Pw3?aqJbV=wAwg1F-0#MG5wI4{3jl1mLJQ zf*O!tLva)AF@w%9Bn!+2%!MIE@aM`%&cN`N5lATlkgiHX0sJmw*$&Av5TWZ!0OA8o z7=NlCAr1q_WwDKT)LS?$obaS;0$zI*;YWn|lLpg23XnA9`6m%0Pa!MI`CLY3Zj8|Z z_gkp%oR?;zg1TE)VkYKCw{zDVe9q#|xRJ>A;4&d_GRktvFV}(@?|&P`1OqASXib@+ zK{JbB_M;)GyPK&8J}XtouUmY<6ZY7YD8q&7Kf8vT{(23MJ-mi*mw~c0G|HXoK*M*ax~%^ZwxV;nM+|HG&TWr6XNo4*2d@a5q@?v|Vu zn&Yz*e|fi5{*${U*ia-t1>`c(EFjPjt55YCt}KXCg+2G%Qmo$~`<*8kPzLQN6c_gjRp zFTsZ@Ce}wY^1rH>2G;WaRK-O0i;Af;7wEL04DhMda9bE|@1WnmRt^9qcYj3JshCF}@4M?B^3$x+V2}gX{Drq-g5(p?_n6XipYIwK*`5%qC2)G% z-rCyAWkjSN>D-$9b|ru;HEmA6_V2=jF+ey^Vus)OVE<}9Snl6Am|gwXAIv2Go7~D+ z3jWru3|MTz>4^X2G^YO>r!jHdzYVGVlc0v z5BM~aFrgOyoW_Z+kVwfoqbzsZyS4$eG?J)7?G%b8NP~0+@H9b;P%Tj2M4|(80*E&x zM=A3H4cO9f39S3O+mTaCGq}AM00QzV6CKs)gLIh!nuvrvf#i9lE~~|M^aL3WiF7=;Gwqmv(jx_!_--Iz~PRhJ{nlUN*Xm;!1vBlb-VL$ z8wnFMcU{YEFqMCHAUcr0-#h^dSm741A%JCr>w(sJa#BF=fjkFQYhSU!Ppb>J6i>aL zdKp$V`3S#Xd?s}cKQNGsCO><2F(&n316S>9PQ18FS-0{zbfO{4+uWJG8bZJsJ*{r( z&Z_3?6%?>MEu(XA=(LdA2h4X-Ot=B9g`wBqDzma2-h^#;48j zi$Z4R*Wu^0$5&QG-?Qb>Un4zGzMWm+qBt1vbSF(M-DPi^V8nxmt#`q4%}l*g5iw?B z;_0lm0#DcBIQ^r|kAysWCg ziJMpjwV!CowbH*!z$JYsSyw5G+R+II{iP*V|hD2~p;^F2OJ|gE# zW!YX;zeG*!c~G_Q%vFPWEeb}0!D4U$0;M0n;N8MGt)=|vE?Szbc{$L@^aJs1riJAF z7rb(WC1me%v0o~o;{ZNdWUkFD`k(`oLZ@`8z3X|NyajirX%xDl{3C~383=4s;(qt0g zARkT%AvN=Kuxv~&_dTCluA7>8m$b)JCO}T4^6^^JQ!4@@^KHONhD-?f7Qi_Ot8knk zxd1Xtz(G|3ToWSxp$g&B(0^g6ACSHvjSEW+1V19Nl(HYb(T|j_%jl+-j~$oItZE7c zZN?ZOz*YozBiOM3d8bG@m^4@v&Q0dW^~p49nZ`GI2VFmNV^sJq4g2l$wBVFH`8hya z43CFmEF21uB%`w!t^`syAz7tB2|Sb{DiC(VF-hX9$mM%tmC!5k{pvT}2jXOqNC9m^jwLzbcLBbPH-pgcsK?5iKQ|^Zf#Fyb@*mPBo%x5gNkYG= zP5SUJ&?a3O_(FTbSBPL?_*v-6_H%?<-o{;6L9ZFW6@L*{&ve|JDLW!Pfm1YQh<4Wwd25t0@1fz=5WL zAe4BCwVdtb^CvZZ0MmkE6v$W7sz>?5Ti3`i$|o;Gu-5MS{kG_6BMZ>oMGF2f9R1$p zPOrFu$kl%Q9&%Lt|J~%y{SD@`>t_Tj#5d5sL4F!C(RY7FNJ3l@avu}}vv|c5r%H83 zFDs9t$4|qqgw05nPWY3~J+o!=tp{=gQ2y~GgtUf=+fiVtjMy5ud?jNeaD4|BDd4;W z-WH(#GEy3{@Ujm=zw$Jopn~K{x+>Z0Ig>R)zT7rz9XDA=h_xO&@>E>(?!G%+eyn#h ze67z#Vfc&FJP+CVQ?4bY3SWXnVu|mm8ouBD9#Bu6VlqLR($`Q`G|5rdiESWug7m&(whZVu~r7~^sg&t6%Ghwx@R z-O$$&<87?O>?;Hx!`|7vc!{pCb9FAYX)`i)@upunP1+Uxf?PkdzL^|ziwM8!5eh{ zv>E$6BH2FDqs^SzA)vX<@LudJiJLNvfY|6{#AoKxu%f7k184LlG*uLz-1z<>!*>6jrUoQ5zPwrbTA?9ExTl-*b#vk`T~9n~*Zc<^ z11{`^1s_57|6Ap}Jo58%U#b5_EJRpArn&fNSrN zLaGywYnb%DIPvAh^-RZ@1r`f;^ZLWebOPJY{Jarbsx>+qA1ORLS43T2s6 z?6uL6Cn@x)?kga3U3;|Oe6@0$Efw&akXXQcL6`}N9`rS#kPX*|wh9W3#A4u+1Q`}r z&DEBP&Kl!iPSYLQZX*jUA9isqIDU$pqFyU#fB0Z++?S?qMg2(U6>JJNb;!5u#wyw7 zsP(ON9@W(KOpTHk!N{qzdrXnV%`$JoAs-8Wr74W{K0e+@o^X#^Pggk}9_v%f(8A{ogs8l9uZzezE- zZDcze(-l4r`dym)KSr9H3$9U8fRVIgi`kWljXx97NiZO@&3 ztNZMzf{xdLvXQVR=@FqRK4!Tss^6hub_0jooW!oiXEQFJg;<4Mr<~o~?^<5J)NrkX zV38g#x&Q}?*=Q!*uqCtZ!jf%fBjL1@^Y^P}I%J*5avwe_M7J$BPgH^f=LZniL3{;3W@ zj1Sgilf&;4X-uDp@!PtYW>m6^T!@1xSpN% z@vbRwb~hy|Z}F*4tePyoUj6+Q|M7SS+>+h?5nbEI&wR`$3F|bnbJLuLE{hR{aZcDh z>^7zUnzrUQmWx=k*n=$FN6NdlL@YNLS?d|3c(=cpchuZcs?N$9`5yR8Bs%5oQ3?o6 zW4@Vnul^!8bQyNaei7H|lwEa9{rg^}`Vs}m%+V*jk2arZjU6!wEUCuwIh{4LCDSo8 zy(IDC5*Qq5=<6&48BHinewMA=XF}!}0pIsC88cq9f|2iWcExqnZLAme1%Ky@E%fgQ zUOS-u<%l?(s<4BCw=6FJ)(sTT?~%!WS7cI#>R+CfO#OSZlJ@`JtmJ<^H0*E2C4Yy8 z{hiP-1zgvct&ihnp=8Mc+ts%Rh9JZ%X$6;GF@EM&hGj-4bDpTfq7MfVBLKrFpXr`}}d%Y<{p_{-?9% z>gvx~Q)SZGlUez2*8KKk)+9ZgH47ALd`V*#Zmj9(TCKQ$kNp~H(a*ZvZ#C(sqcp5 zpHN%Gf>YxNcB|;WvK<(Kkqht`Jc}Mi5QcxE4L5>AWA>IIJRD{RYWSfa6aj@Xyb)G_ z#|pyLVW8Cl5>{)N!kfUp3Mmpt;aOIG{lvo}>JY^UA>!TYpt7-S0#DZ78}}KC(_bYi zPXtmre^?%FH1R6BB_BE1!Ms=V>+ATEQUsOSdd=bM*k0f}DfBwVJRb^tcKABh`tdp@ zv{_R6@j9m3_WtoY4$)tX{_#5g`8ZZDp$6T_2r9!>%Yu=!IQ?&Kruyucww_CEEP-F% z%9z8qGIL<^^x<21O8u9&GW~_0Z)MY8-^%IGTX_>^XQN z`C0UKfd*~7b$>$(F06XF0Za2tP-07?Q+cg)AUzf;Q}*fUy*yp2XQ`Aiu^ypZPx<BekJI^K4khY|a%|ooQU>A*ZCbMD1Jlr2Tfv63J#W;I6^IMb; z?e}FrdatCM#~NSJqGNf>Pv7!{?B(JdFEmy-0orHxZdVt^-6fUL;=aP-mqNb4UX|Kf zGfOtUSUfE4{77E>$@ycMxRQ(939;XDSqdEHFb zK-{Gq*bI6dY3NFJmFm$TP5eZ(^zP1s;D_t%7u-ojFP{uq2wzYOcsHm^A}o$$IHHn&RX%^ zFypWqZ*UoAB?AIm8P)xg(vAbJSk5 zO`owWvax?B~F{H{mWgtSA%XY&2IDK_?P=)m;rLZ^M>7z z%G|H4y<^Sd!KLebNODP7Y08DN1?$T9uTN8HsA>%rET-I9MYM?}cqh1K;l};nGS!UD z+E^ybKmwe5hXNeQUj#U>*T-mS-h+y$!;+TbOT};J|D>b^_@yu?XaguIh2cc5EyWyW zoe#o*l@x{#-{*l?hvA9T5X=NHb3BJSVjc#pPhx4otRF_% zSvvVUq-*1!KQYjg-MBY#q2-cJO@YV#;^ybe14q=sFb6ra1kv(^PTXvJjlWBa(IW|7 z4QoTAcn5q|v&4pzUl{wllgV3w_^yYY9uiZnv$8dW*?;S10s~)#*L`6;um1#)24=t=0ePa zBjuQ#G$RuI?t{YgxvzMcEKgEJ_=>mEODQ{h$B=3zqt(9a^la5~Z@$``MiuNuMX;dkXe`6{c0F)Gs<%$hBtEP7Wyhwwq!V)rPWewe1X}`<&(@Oxd)Pq>~fM zUs0fL-eMFeZgtA1srPc?z5G5iiKi6;xK@e%tAS+$T6pio%6sXQT|0t#T6lI1JEhSU znlh`cQ7t@PXl3n7a6oY{?y~PioMOP}PhN*1ej?$J*Kz3wucPN@AtB`tg#>)Z#r=aF zjzglbxw@pOu*&YGyYpsueb4+L3JVNf#tBW1R-Qh`E)A=Hv`sWKN7N|t%tc+>&cbCl z=VeOvk22L~NM}rHib!5r64Ef6@0 z(ZeUJ!*3A~?Bl^J6=Vg~Qq;2}ipPn4%BT;s_}GuwS`84~LBe;!y?#SMfR(i8!#maa z{QL%A#UYZFAm5oG7j5{Kx)(8`eWWIQ&)5k2s;Hm0Dz+uPOt!qk;uE;0L&GfKLjOei z6VE|s0FZmSZ*=zF%LilE1Qj#N?ab<2w)Mx}`n^e?C8Xzz(us2hwBdF_-h`Be zt#0PqF^k&Y8x^eA9xwWo4j#NCVZ%ky?C9&0!*L%GC3&+QC6B7R^|ng&8;}vrJ%(O- zBzDe{-sOq1rX9(7<75LzTLQcC@2OvZJAPVC^K4p9Sc*o*ofkfO7RHP*$6UrEk(X8G zlWZxOq^S#GTy6cxOTFmCFUT#L!8msUFA^%$ZiyEE^csVyp<843 zx|n=7X8tW6MDk*eYRQ!IHV1-GGbbf~Ve_q$GO0#%Q=$j;hyz5(b zO>TzFWT(wMTngnxa2b|=H8?d9`899R2fo&x2 z6UrgrVIJmVf=SyOqSO(L|AWll9(?aG`&4v%(}INQ_bK^^s{s#b>m(i%RL&t>wLi4; znSN`%j=Tc9GOMdPnU*1~xS3yQ{mlhyprkP9Phx$qm;!e0cJKr%to^Nj7lkbsoj>UI zL9-qU4~{ork=LA}JnN>VVY)9tjxJ>szFA6^^dh!0eMSi%uGb zXI=}nKJKJqR5IAo`k+)$D%0fU4x!hDwO9-4c6E>Z@wQvfP-bJ_ObGa--|3KnW(q_m zO|Aat9fA|nl;1gm!^h(Z^7GE{?lXhx*C^H#=-0ZG1990gW(As(gE5n2Byj3-!)|8G zPy=K~G~nD{fM5W(Qda^88mjVc?xBC!5tFF_84-q-$JeO~yL2t760#w(F}Akm)+qF7 zImSJc+)d%#mts?@__h>tGIbMBQXx{nZA~-{?$gD(;Tc2O6n^aqQI^Sg4%x&uV~-); z?#n_4nlJ3=Oh5I08f@=gXk+&LA~|(Zxs#?*D%y5oAW3-#SAKCw+xc8w@bsV|Bc4=q z|2^xSYsS(dv}}#aCXw=zPjPqJ>LXW$jELDB327_nbO$q}{h#6?Z&i=lz$r&g|EKyTeEpCi9g`G=>_bn_{)0 ze8rs?<%CyZmYMH8btDVKLESKt8dv_yBG~$uMeyyzMeuE=lBxq3-Yt5V)1LFTl!rt&R;v+BgOXZ>6{ji?1VX2k?L?NoZss#(~Aoe4Op zn9Te;e;WAYo0}O;`NytYwB8eB6p%fAN{mZM{8kQI`j7fPDOBIT|7(5!Jdl}$vr2h6 z>LfaRLSMP}>B)*-@rS1q$R)DZJK3{s^Oj`7JITE&{o;ffzvHm3|q8e_2U&!0H=*7;(_ z;_w9;nXG`sb~#-!opX9N*Ne2%Xa%?K-VNd*jD6zgsTA0b5;=CRcww7a&zSdPnT_Pw zWq;`p&TtXT;MQ%a`j$7m>y`b;ouRZK&)m6+nFB8=YeY3r&&f35lNBN0{ z^0LD0`rJqzP=AVG!FdwtiBPh%b9IX@yIToI(ej-9=G> z<4kvk!m~TKx6)34u5rp`wCafpGFn+4+U>OCW3D}4#25sXtW=Ee2ZY@W^11S-WV2CM~IT`UtDb$@w!l9X=O|=W#p+*DC{yI%aYuN_IRoyh| z{EN`v>)IoIq6b(eyqG6kg2HEn8wyG5(>!Q2jb-r$3%@EvrsAY6su*{vtt`GB%TlQK zSpBw#TJSv=RVWza3%0zr?Q8B-jmW-J07aKcsC0#{D!S+>1!nI&H_aN_4Ba`CZ`nbe&?eY?la@(2^mdqYP_s&W_JCuH5823@;uYIpv@rL$v72P zEz`Z30tzSv`bkF<35ZaIF7##64m37w+}>F^4v7&pXTSjobZ1q?2$;X=7#aeDp~&a( zl?P?HkH5II>B62T51wzdZ#UA|c--bV!0Wt|;hef^HW#xm2q+>D)VQP@YOca$S4TH` z3Sd}2gMm5Dj;M~7SmHjMzg(Zoq4qf)vqwukzA@2#)*}|YW&2X8zp=PPc#Vy$Y0wHJ6SfXie$US zGH`u5h`hHc_JaFR@KFSuKi}cui43NKk!B5t^)JkQI(^Rim*caK1~cyCNh}a*1i!Dc zeqUw%zRLQ2mG%27>#we|uEJFJ4rT)f+`p*2TR2#j&zyezIg%=M#i`9Jjlci!fZ%Cf zA!XZ%F=T!?qFl_nj#E5kAyu`S%&dOisI2V%?Ye@Nnj;Ppj9MZ1B)Sq5LB9p96~TdmZqE`2qW;` zA4LPc4k74aoxn;Ts6;eXR_r*aEk zeiBVeKpFHwAs5@NsENhxZskoabsp^Eaf^q4Hx&jXY(RDy%^Ew32tix?LC)}#Q2`)E z#Zy#xvRlFQ75SF^EBI3^@Cz_-!W~J2PiKWQ!+^a9QWF~X;26xFt82B|KW>3KX9ZBvIZ@qZru9rV6-OL4|1lbr*lB81VR~> zfOivuwhS^GX{?PGa;V&TShk?i@gdL0T~u-Xn)F!J{Vp@+y0^WrNy@YBkn8d0WuCf8 z7R~G5UM^fOR2OnsXu^Luj#?(b_bwt{5&Ej|yQeFLW zbC%M?lx8lpGhaMzdcI7)ltDwUsBwZ&H0V+{VVm6HRDNo3S)_tNh16J9^J9gFbI(QA~q+pxH~*7M~^*TeOZuPwDpcvU3I4hG&7 z(9$6`)qqkr-6Q~QC{#HpK84@~&(SDlHvcX)3FKI{tiE#ZX3=ohu~#a@p+|#x5Z$a= zb^}#AAlMSaik2;9f79EZnyj925~yXPxp9BvvZna2x~ye3QJIJrUSr-GI1j!gBM|?q zk8HSKj%>F~`Bmra5^gN|?~I3TmSZ!m4LI)$nD0YDG?l=SKm^};RWmy%hbDLOMHm>w zHkS279`_^ZM2r@Hmk#inrS zJ4{o3dBM71ckzreU$~J%ue*-?+`2=+G(yRShUPf45Dh);)GK+LyuzD>viWjN3~E%| zfzjOYH92W!(h?W#mCqDUzLZ_iXMQ3^^^mqQ?Sz=0^7 zmcZf|7_xvLGcGTGRChUAWW@^aiiOuOUw!oCf-j5Cch$RgU2&7#T?sPuN`2I4BV3XG z1)NVpq9-kR?%j`0MVkhcioD`*ef;6|rIyL3qHa<$sqwe6SE=OFy~B9c_~a$pM;@@p~a(jZp= zDFf>Q!}sA#r$XJ5{l>8K*jEn|zQSU(7_&}V&Nwhy+fBTL9g0RtkA3w2AsT(Y+pzEv z|E@7+F-V}=exbx?Uv_n5sYD(q2_nUSxhNJ%lw!xV3xWlaY`U-4>F8IL2f9)%qKgL` z-raq5p?qut?ZO{n97Ni(4W}YXmfgMb!d8`jsOKE9HDQBzSkhPTC{4D+_$%O^dJ64pcg~o&|!LC^$2!_<|UP6XSP^mH|jrOvcE}u^fEQmS_6T89_CR zg>7t1aUSkO4t)l_g_3UuKsI2QX-Fgj@N-=m?C&ed+VkPx^Mla6FE0U^1`H$1w{xoB zzn6OWYK{sj8`rsG`0mN5gI=sDpwBaCM%~Mow3C&nu_wyYEsv7i`n0S#G9& zbKJS?<=osq&~#^Rv|+1XP70~%0 z%m{LPftL@0OE)($>$~HH$5TA>Uy^&a9xv5P78J-W?uvCbUd(M}Y1!edP2i4N6nNmx<;bRL-VK^!GGT?;6D z5w_ThDHhR>uQFVePaJ1qi6aA1SqLVO>Wg55ZG&20#2KbsWM~QxX)3HZqHDNZptn20 zc|&hcy#1k*9xGt+Log922LTyB#07%B7a+_J!2t^eFZ>YvVB|T17MQakIB?y}@yU+8 z%ib)Y#}tKWb(go@Oue=jb0?L@KL}SET}0ovB{L|a%-z6tyo)H)f$)1Dd4j4or;(xa zmBYehjh79G=NBJ^^Gk4!pDr7} zReko=tCOX1VQ2@@LhefoZ!5Dv#V#=i!?5?O=k9l~RGuokYdrH#Y46bf_ny1EItYP? zAV~eKRgF{w-RuZIa3u+Y1|_Pfu;U%~%R`5!lRil9GPe&CkBmM_eui8pvFbK#vkF*U zrVoum@>Q)Xig^i!f0k2#Fl%IR8pUKCQXkK=J#Qj2zg0wkf6ybigqVB~kP`TASLEi& z@k*=IBLDffS-U-fl!XH2r*B0zB1$r`)c1V!I;|g7J+}n2`^3CJyB5ifn!^CbN0*e) zPW1p+i#$pcSJUGMu3_O^RM_SD2S9|C#Lb4{^(IW1ll#C0h!`z-G;Vaa4wVHm(ouk5=W1Lize{y&?-{&zHWnSQpnzCH4%H0Pc-#{3c0z?QN%WQKHpHl?uns; z59Az6pc>T#*HkfFhQpD5)!%ddFEiEPKWdOW_k2)5QkNI1hxbZT5qi{w0cmZ(Lz%n6loP{JoLYl+#c zono5v4|<&_txC93Y3NtnM0cF_uhK@QYu?}%#&&+WvJ5jPYgo+4^7WKdd#K`jb{mk! zBk9m8=`Jr)IoNUx91j5FS7Hv;8s(<0W8-%-&-cWY&!t-Op*i0@2)%fbzD@D`QG=M} zBkK zef4HmDQx6UG0&@Uswpy(ynW$ABuw=-t`hf4`S0;s$=rQm{9akh&cwt1f%4r-U6Rx0 zb3=WFm%A}FGRl2!toFyJ@;{@lJe6m7a#ruoI7x7ZA6*~`A!*YP4bwo0pt<~zSZ=mt z3jx>CWBg}Mi0w*Q0$K0E_MtA{SZ8fK>%ndT8_48FDWhxAx@*J(>Fw5^MS;dQVir)) z4JQ*cG!nXV_pGz~>*k_TzSH&b#vzL5*bYRPip9frW%Fj@42I+#Z_I=}7My*F1hA(h zj4;x;LX?Drs`M&t5EV{;;ED>eWRKUs*wY(T?3A+&N6k{`we$w&b&BQA%gO?mn*@Qnp;y2>QB4vk}7T2>~Cbw9A zfnOT(g0F@o47z$Wnlatp4wkPZ`HXkXAFVl`x?=rELD^!-^NO@Ai*LN({#~o4wwL__ zJH`GYur*88VlU5_0cT(SBV{F~_ckLSBxaDi^p7=n>0C@rZeUO9p=yr?aPAo41% zv`>~>koPwHXz@a|fohv6O#D;yK9xLOpYD~zwMtQ zJI&|6@+HhAukGoxbS*Y>hjk6|l5rT2E#4&$G2W*F+U)L}v9m_>^N zpdx{I^!u3n`L#l_vGEsOQ z#o@5bdl#L?g`4So$Y^A= zkTCFSr=DwE>$&#%?c=9Bhf=PQF|KXaFskv%Ht{|ceD#kR|426 z(&GSe0>cEp)?!E;-v@i~b4d2M)rr!aW4sSD?s#bPV+wZMe01EYzAozSri2)IK8X{@ zdoe!;1m2+3?5NazV;B!YZQZOnxMu2XjqJ$*>S9;f;9FC}{4+_sYs#@XTdZH$O zxA)SS2*-zCcSijwQ-M|;hK4Grb2%OY|KDB7{%-hSHY34kP#l<>V`&*wzj(67t|4io z;^c03h;SEHb7^=k{J6PCnqyf>DYWY!x{K(XZGPK1m<3=WSSoDtt^qr0%K z9TF+`sS=KelvgTSUS}1uSc*?}e)mLi@xrv^G188*)IUU8-zlNvivoxohm-VfM5FQ* z?!&x{p-5{M9E!9euo{zhH!2Skts@IR60H&Ae>2gF`zw*wfpVsrmYFj)KO?O|seg>L zhBV>AQPb*!@G+USH*8;s-MGc;33*Z_F1Xfx=$2?~edk8#hcfuYq@BNEx&F${T6^ox zaDi*`J>HQ$1HaB8`=wp)$rEGt{*d)NaQB;%05eyc1w}iylxZ-57W3lBB9p0QNOXr4 z#l1I!FRwL>%N0g^wzp*no#+}WKEI4B6?yH__ENs>+$Jn{U}E^XO(3Y>hy1HI=Y&Nj z!^@v4)*iL1yc0;aVsN#&lkSTieaSB4!!;}qLdJXZqfyI!k*a6Ws78|8_H|yYwf?Iu z;p_16tgtUIwRdtWk_FXS@pKInVf#$-6JVWBP&KV|L$%Sf5>F+mtR_Z3qJcH4Zw#Tx zI;-;P@J?E43rJZFW3fFRYxv!* z<++|44uMh?-!Vy1bezvjJri$k-yiutmG!D1u4}+teY-e_Z;zqChet7bXvzCS+vjU~ zC&{g7oZMMvw1>o2W_0!H84&>#WE4Fc3(G)XolJtSKrG8%>M0xLCk6W*qsEPe>k$-M zA6_H(?#~>(ddi632Uq@hUd83>oecoXL@?kq=?!Ybj4o_B=el+0k&whYj-G66cp57Z zj#_7t8$eVQpxNT}<%?ZQkV;S_>15Itd9UFKSe98MAg z*IKU)gfpFc4cz?6==jw9+{HuAu}Jpm(0pf)O}LK;@^;M5yGX?_P1?izo#}B$$ZZA= zep2aq@PDX#tFWlse*N1SVt`>7kZuH|yBiTfl$LG~0qK&C5kycBk&ug!4k-zdZWWMj z5Rev7I;G)1=zTxW{j9bA>v;Fx_ucui!Om>_=9uqweLv^toJzxEy!!H?FT^%8rl4EO zNsNh`*~7ORyxGI&y)nGe0de>!gxWYEZi8dD&hgzL+52V$Mnu?Gq%{PTn%)t7qbJ0_ zKCyLRD^+I!?oS0Z`_V=uLRjeT+i}T|w*i_dY&xtg=hZ-KuvS1ohhi);6}R2h*HxuZ>f8PFn3;WIweOeXPH_;sNWsqn*oa?IlhCYtF{4 z>j;NdEk$tI-S|3irCz{f2L$!uQ3&VX-452^xXv5mbn(SFGa@YTO1pHrVuYS8!%^*k}=Q^}$9OS9v#DhDwNCZ&Uz`+CNwnzrxp@E}Kn!)M0 z$@EX=y=k)60%TlZk%90#cm@C8WZ(P#|Hr=bUb64X|10}Gjb`7){-3e$+50oV;xjJ$ z|A@aw{=baBM?n5S@5=kQ_IMFXy-l8%OImt zTT0QOGR5Y?9sVdmjm^wqpJ3r=FYinGN}l^obIHvQbeTw8mA9FK5<>$&-hB0zDPZ!t zF`62uhD%%8tsp2gO!h5s?KoBy&zwoB=TH*p{R&mO86+pAZnp5-u3gF z>*3{?@`>&Dqh9J(n7#AE?qPBK_Jc0j++v(XA&1i-D~~C^ND^1TOGbB1Pe+dC)P$+K z^1W!^yE6$423XmuWL77NvLsN}pxk5bILy9DuXpAmEEnq+$6c$sGgQiMmZs5Mm|q(A`IX&= z$!{O=EB^xC4^4-ke7)nrs8-7~qpM&r_&v!?PNZ7K=FJ#UZ3G5|kKxy5kqWLBx}m~K zr|{j?ucguH7kD`ih3l?LC>ezeiHwKYYX9~J>=yNRn9j>kYv zOR51zaqjAH!QOS-W{+;W$cM&p(zgq4W(}XV2~?o~Z7Q4`avun%!Wn3$9rBgG-g64H zqC*MYuJDP3Q}F1E>I{>-*6n!-TvOqU+V7h5U8`JH_C`h|4|d<_n$zX`3#80h6a>Y!s^oaKGJBW|$d$k$P6ot#2K ze&%ScVqTEHfhJmSTtrOlxnR4kV`H(F=XHkD4VHBA@!|6vVti}2=rtOuRxrvgq>2=e zZB`QFDEufPCsUgJ;rok-`soy(n8KP4qG!wJWsl5=TP6b>X%@wmo^OF}n+u7&wO@i3TY{NZ0x^_%7)7t(CtU7B;+oJ@Z^9?8AI;?b3VueWcYR*R zns1a%w0NMI+|J6VdZX)oN?C*!ad1spp*$vakcpwpDPxzP%gm#+DoH}OU&Oc@-dMHr zsk=|VEcmiU)L9aoL^jO_r&+5aoAAAplw=6s3DzZ6u)L_8N{YQV^|3bKUX|Y=)MEr7 zKH*TX9F}aA37hi}P6m#KCry3Qu5mu_{ul+SC2v2tAg-I{n`jy?{8S0nYzc$~%HLJ= z-zERq8POmPB{rGeaP#(3UBLZjsx-*u8jmTmC{w9(kJT@8>Lt;OSldDQ0u>aHZYLmT zT(}{KMb|C$#gpVk(Dv9#UT(`3kCdmV8~s@ zsP0^Egg7F&748j-MCyPM@v@0E-# z-rVb;GI;VPry{1fz`zdgGR|~RkJ!N zJq%}Jn~Wyr7b{|JFZH%oq4fDn3oCPJU3Z;o#m3pW;HitfXm&N83XxL>_NPr zi|RYW7#DDVm7JT15v>-O7{;+sjj9?liu{n8dgt-OXRz_fRzF8wo}|=g`19otngBnG zfRW0^{Y!?Ki@Bqa@Scf-!n|CV2#3g>xLb+OvOohF4ioB2Ox$z4vlyy=wd>i65(Hwo z&^w>_843;Dx?y(LshJUJg9_XfheSkair61VZg7VfDk2ecqv4gxnC<+W&6w9Z8doX$ zMN__bEn6qw{N)HMVTv|>~S0&)l%k!ltS{`FT8ihe`xBjmFWM-tbIX!*Zt^0Ddy9~`{KA9 zSC8l3CAJN@G7?{D^Q^*A>CIZ?q$@A)q1=N_-)X?k$*B1y$l~bXM8W<9yIuStL@+*z zVLdsPgOB-M%SbzaGY@A^)coG#gZt!jLAbQrfmM>d>td(q4#F|B&;c6YW`HZCHR<_D z)F8?6Xnnq4RHa-rV>Sov&jke!$}WFLXXs|DWi5w~VM7 zKF8naJYb5$zlJWUgU}&p?-}XdIgcV!{OU+qWkZQ8YwmG!YUEUeBrjgbw22hkZE#AS z?_+bC6eK3uc9bH`AF}KQs8^GPhr$#Z+ zz6L{si^9*#Nvt4!{MihtK`pt01-G#Yt$8}O`U3@nM2H^>291gaZHXs{MD?dxj`Q2y zT6}Rz5XpK(pe6aRJYOW)?)O6{dF7Sv9)IV16Rd(n&ia&r$`uN4?dS08Y15eYmic9> z?4&-&ecM_e8dmg}gXT~%Hp|JV@d{cSXL9<=2;|HVX^$w^VB1{V6>?XvQJ2RDwrvF4 zq}p0O?4SJY2t!shvM6Dqtan@)PTg0@AL%uQ5i|sxbteFNKd+sb`_IJ!id2?hJ zNI}{TJ}KBT#-$}2|8_QWB3gP&{!m}di|p%3eoqof#5>?BiGPjEqgr5yRh5MA1|gln+Ijh3bK2J6CpzSfHaU{BAY6de zA-)i(V?lTWjXf9x&|*b60*yo%9hhcCAkfW{Ype*mN)(O*1lNtZ#0n=6Jctc1pQ1xO4hwl$!d)YVW z0$~E`bLeFI0l>q7d;Al)ovgP2)$O=+=!U7Wc67-X3Yho7NFiYW{sot*DzOg+AVfy% z<;R3)Lwj58RhueNGv~V?gA(1&id{uV1w*%E)?%U8_wYWG+bM*$oLS2hLCMZejKWomGKUN+b>bWyXf*PsZkVCs;U! z_;Dz32*J}sE4@F5;N1d9Zv+Kkc#1~}Ah&R@gS0j{J|v*Z`7P`Tl;{AxN1MjnIz{i% zMxQJXjljSwEF3Y+vk~-7RyP*T4Tw8Ej(v+E9zQKyzX%~9@<>29pU z4(i#RD!vdV4@m~M3SrkF2UROm_#~I5 zc4iDnM#7V?se%Vu1WN^2>o%9&1XV4f1e;K(H!G-?L1V+|Oh_mM-2j=zj2r^dWiUq2 zdjmmGH7Z2_gMx*d=(n#x7L9Yb$fMshJ>cJk?i&q?!Mg#by9iYl`Onnjrcgwq z%32sVlzs7F>gP|uObnhjP`N?i0^*fhtdqeuHv1Ar_&oDNQGNchQisjv6?APn6J zhoAzM`EVBW>k^(1r;@7q%NclSML|0Q1G4_Z8TiMF!gQ>DX+@C@)^SmwF70nfSYhcI zhX-VXejfDRwtftL6=Dzi#^9uo3a~f^=Oa-bKK+<8meV=sb=4^)-8y-(>vS1trsB}? z_POgA^9{^*o#N(x5mDZ*?}t53yf>yWQs4Igo8)$H7ju>uU$esMe%lz)O4G3=xY3Gt zsd?9F#bY9zi|;h`GstB>8a-M^+j_CHhKe-3>w{u=sFXXsisk;_ixKU1H||8441 z{qIv>%D<<+_79pbZ%1)tBxLs9ef>Z;ChIjO8RNSm=V4Bfl^fW*61k=1F4zC3i4gm* zkcC?{9ZR$_%(}6G{^5(dh(+ zlx|F1J;Rd_#IP&|UbhJuQGX!BYg5AA3KhQLy6VwpaqkDR_$JNxhZH>MMB|or?l|M( zb+!IR6L+%yWBh8k9KW*A zUnl7CE8rKN5UO%L)OklOqwKQddGm98U+hWJpN?nxmiZ?3C+QN?4{I`Qa3|9&`pF&TXBw|nF<>CsAYi%^k5%gS z>uQaipQ@!I@l=y>_oClk(8wrE76!^+r8sBx@oY>oS#|y8yKT{MxRq4=Fwi_&gg_L# z`dM9hD8}gAE4l8%?*cFW zAr5`l&t9mXY?VRm{W8$`1bz*g<_40K34|fUpkJ9_2yI=tz(z_#0c-)zUzN&0AP0d4 zkOLhJ0$%9!5iov(pAFDS6MzON2vVxb!r`G1%+2^9bgttIk_v2+;%7r=QmS5cz|g2F)i0dh1~un%^`W?+dUlS zH5l)UkYNwDMA;*RoV7#h>r7^DXc(EMmyD@c`7YVIg=y<$H7ASP7B?qEMRe%x+Qc%@ zI$Cr2y!D>JGmNBtn_Y?`y~5Q zNXJgzkvhvb*`o&!4G7p!wr=5>u_9rNnwk$k>!kVY$P`F_xIgps&ScK`J`S z|3;HC)oEGKZR)jJqD=WiwCCmvN12h*xB-bqv0Ed7R7E^Lc_#4S1(z5c{<9^jpln|h zW*s7D4vTsxtLU*b>f0SO21f~F-VS@Q^qk2hZ4`Qvqnxnw+9cKT%P97+aeQv$l2Md1 z#l6Y&ZSFv4xxxGAWSo1CC!jrDVXP}F1~EAB*G5X!qc-ED`c4epVL#-H`NKl@q=>is zhqeXIxaRrmPo#4T`)%dX_H{?-Nt+4QV9JBmz=j-ewG)Lol(GItSnLO#DqKD6X?;tt zVXEPtT}E~meu(vQ*DQNsmw_tRH8~8U01)_>YN&1erwJn`}scP*fUDAPo!qE}b>f)Q7-7l$Id|##^dLBV;!IPGdtpR#y>uM*O z8oe*6vUi_VQ83&<2b6Z=-lktZs~0@Z5XO#|4^dO-wfNLdEia^=kZ*gvP1Q7r=q})2 zA-IOEWed8Qr-9r$HaYZ#DR5mOpaaVBaAFj$g9)#Dv766ELo9hrz*^WQ{h&=PO`;S; zE80O%vo?J2vPExC`1xQ|seAjknhxjd?`R50&tga?+3Iro6|d^31D~5sRz4B^zGJdlUA73tz|j( ztqsX5wlvAwuC@LPe&B){*Q))K6~@u4GF4$H6*;KxNJzM`_qt+0bT*PxY#cB z(E5s-;lZ6%8QUq=hJt`WdIfB;Z(#ty7$!#EQ^#1 zin#{0qdQME$@qaiA^aM3^vS7)WZ^( zC&6hTx4s4Tv~EVB?Up4^<`HD;g$(etoC$N@({=U=n=G^M48kI{gj? zlBAW-4=^~c`+wha>ehf;|S z)`mEGa50U~hzxM(OFUtRxsL?@D)(OGt$M|P+=4>uW2+eF@i{TUaW*^$>@49wf?l+M zG8C@%)rlQR03CeGZFef zOjSH$m)4%j097s|8@cd*mW8z)PeQH*9#4Q5Tu3gIX{^Q0b-Td1!PR?a~+tiL0wPXH6)V_)qwcGqHYM1;YYG1t+ zwU_-*qV_PfpXcoyfHmT?UZs~c4tK5-A}yzKG2YtIE5;WE{8R{X$Rluv3SkD_>;MH+ z2-YgnXnZax|IvWT!cVbi+$)xKMwl$i(>tV5;{!|h$F!T-rcVa@jZY|J{`gZG7HB>^ zrtBgGZn5|*m?dWq34q56ObGPH;#1N@nQzZz1|J)y1z*OTyf%WXU;QiQ1YXr6D6Utn z8rjTidN;kEEg6%O`BD}j7Sxp?><0(n`JYr9ivnuz z{5u5Y_jd@&?_VJ(bIGU~>BH{^Cm6e03LB4^ZBmbt#-_EpBhK9wE)c1^$|of8C??H` z6O8%Vsfp)Fnaq?gTykMW=J#8kX=SplG81RyYSKm5OFOZ))o|++_!oCnkCmzWDZai_ zp^fugcXFntc-LCC}ZCd5`}iMVePIPvi2BIJb#uteCPU*%pmF-aIaagG83E`4x+$7<}Zq9;h$JrUpo7bS*g= z*&@Gw4Hy3c4QrY86z_}qH5`_j`g^PD3CWf!QHN1u7=NBJ_yh@519DyHZ;q58(h;UU z(>VTonhKN(B1O%e=EM=jPsKrM%K@Dk>MR&@+g0>u- zYh>!;ZO>Sh=RyM8J%~gYxJc_|CsnWH3m=fE2IE;xZx$jWvYY)s%@aV|>MHfr^oj1i}_m-?N zqb2MLvN$?TIRpXsTO2Kte+9LmT$e$uwo@ddJQ&b}vk_#bFHhHURo>Cu42m&52A${x z7gWmo!LGP z*mIhsq|cs6B@P$S$C8n*Imm?~b_78>I>?0%b(O+l7Vv*Xx#9(c9lHX8 z8gW@5pQ<1!_=1qC6=U>i6F`0NvH_t3lCJ8r51u{*Rj!b~QPJ_zx7A|?)HjzMf4mvB z6>KvkL~K&%=XA?MFV6O~)$rip*Y0}CQs;cSz@CWm>L>0m`UY>kAGyCX8#&xvckD90 zA<9s>wr8e)JUru>c9c}0U@0^{yzY9RkBy>KidZt|>W4_F<4W`+l*RPiV|(kv+H9#iBFJK{!ctghcC9TR-rZ7tH3R@k!x z$_;``?DQRyMyw4S;;7lH|l&JzfWrG1@~sMvjB_wG;e*c(|z^}u3VL&nOAnzYAznG zLXjYp1s*sfy)fU}J{JKu z#_=e?fiqGD+Vlj7x*$;k_R@ zTLs!m#@v4l7X2Lg8*G5sGeSN}t_NzGj|P`Cm^ttwt5*cor*Bt;>8{oBwSu5$gcPX4 z;U$}V^Ktf2dQ|HL@#?y>eM&>oo0-BOPXY`CsVJL`>Xev&=7)?ex!ysiZOjJ=T?s#- zx@M$f1Okf;ravFQ{m7Z7pT=gP&8)ntD9@g~8>E`Hg%9Q%W`2nlQ0ErxuW5;=h zhJEH3(&T|X+V+s`A@6SJh7bEHr*~Yt`XIZx#a@>c9Usqk0V_r^YKAJMe! ziodhx&1LMf2tF)**7YPvdR=gh+yGCaIc#AFsBjU`K#G7Z`VYLs9-~N>jqtw1Zay$4 zMbb*1>uV$Keu9g9zis?!Xb3~Nf`v7f`TW&@lq=@OkfC|gBlg9{_fk;&@rlPtU4z48 z{;S&vc{^&M#@0>Xatp~@wM>e1gn$SE1ROS#NY`|>90iDe5;7s*y*Ye5K2{Mr`N$5R zW9}I>bF0>+#&T}L<6pI&8V51OJ-h%yH*d$MJ zQH(~t^_Uv$tYhVNF+tQM(uxLyxmp4$ARdf|05d-caWMot41hls>;~XmA+&@p`hr(0 zgmhrC6#f4%w~_b|L*O@rq&ACXJHwIms<(+h)gA22a9Q9rD2se=gy+btx&J7Ubuans z7%+L?wpM?7276aox%xo=9gb&!Xu-Zn4PMyIjk{!7qRc$um5CdjPlhqx+6C52d@t^C zs*bgKROJ>Y*O3V1AUI6_A+!ikLW-m75gB&j&UYv01~qGxeeyh6Bb``aOS0jwtPo}6 z_R4NgFt>><1lR@9n}lOp7z=H}i>sgCgx|}8vOa2OR8P*lnx9H#m&IGS2Z?ye3<4u@ zxS)4gKv5(P1+@Phv_;}@L$7KAK3oJPG-Cr0zQmy-hB_|A3Ab^qt=QSAlIC~QTh09f z(l2osz)NLhYWya_O>n~z&Iv>e(Yu-1G4x);)ew&u+wiiEEDAV^BPiKTrUEYut<^_x z0)kv5V$+74{}D7o7h3C5*4&MVTpjsl2DLcs^G#xAn5AsjN%?Q*&3{Vs*DeAdH@bNLloXGD zQ)*{ViwH7{4S@7N6uNQgMpezOEAqaFcB96i-KYp$7R8OY2PD*D*V*W)0O17ex<(^> zzqy+-2Zx-xNNwj1@1m7X+;vr_!=49EZa@0yL!3b_{y5qu0^y+5b#+at;o)koSYyPx zxV!9k^J2q(nQ*;xhj*0QojiFPMqksIxg*3urZpitDdCYFDug%W4En7JDVX6VQQdBH zvg)TBL{BCA><@2;N_UYK*X%87a2lEI7!D-Y8jb;c8$vpk(Y!r=PFzy@MUACz<0(bF z5l%a_)Mq`1sGE=mC$HTq4<^oHnwRK000Lr!--FIV?zhY7zMlFG@xaA~kOjd>Gr$_H zwV|D35SKs#>H`tXfKQhc#@YL+`A79E(uF>Z-C1>k%rUw+K`8egl*yumi)iuP3G= z4e^{tb5{}L7#Qe*(^GETy1oBNiaF3s?35`nibUUr(VK$8?!~bM;E%%*f|n3geq|i7 z^22Gl4^YJj^bc4soRAvnUIfP~pBeN`uu7Hc9zI2u3txPKCYc3o>w_ROJZ>oF6qt*{ zAr}>>n@}hv`kKAC(D!}?cA%Oz=mWc{7RcB_TXMro2_-}9qmOOn>7`=Pw5|7Md#K1@ zVHpy&+XbSgV4Tb!k&=uw=cF=~*xi)(C;JRF%l#5Kkn3dXhucnG%g?0FK08T+=_wc& zq!qxYVX`132tf&MD8gZ=7zQj$^V5Bi0$aWtCN^{Q{UWf;`q+||JQSl;|IEyssMWsP zf$BJMZNx;;wbMqad<(ll>s=V(h#z^k&rf|>6 znMtL14V#O&$x<}YJ`J7uq^QLphWzk4X39J2&G*z7yUWq*)ZR*&aDnUmrbBT}>z-V% zLBb9x8%?emDc+-PyS(AscoEpXEWDfmd@dXULQIc^EY~yo2@yojU;)CqhPuCD`_Y%YtGj zLTqT@b>NahNCHD`5oq6>ZwK4Wc`A-V*MQhG@oG$KuLwcg*TiGQV;lk;G02g(YjH5ZQORzTKw?F z8?wA0sE07v!vC>r;ZVh+)0vz{r<}6OCzWA7_Esl)`s1dkACeq&f$h3gxzB1|*_-fh zn>}=gQ(wWq2)y`~PCxG|>+y-Iy7;#ycXH_8n%pr4lbyryWcAZR4o>IUT6>_0iQWh2 z0&7fsy1SMn744@9BGvX7N3y|cnRh5Q&oVfY+M>?l6*~|d6eJKKxo4gzw#lVWV+n&H zEIcM&V@})NKFXUBb@G_83uK}8WRKgcBYkAkfrBcXi6m7+&z{qUiBkF6VN^!WmA89w)! zQN5a)-*IG9M0K)vQ?kCOyXsH~wGP8t!-~9`@Y%2bqx!(ET|!Z4$M46%g9QJVz=;7) zgQu4L(rfwTo#RFX=-I(zAl1_DsZ+7O;rhM)u7EER!}x=#vp+GQdxcK{G(xUoO8HWm zPV3aAxFu#d*k-JU3(!jizl4hj(TV(&Sg2< zr4vUNq~9XA>;kX4MPSZ>aa4}(Vl(CRd9d+-#%rxUY8Ykx9*4|`>AP&Jt~g#@_&qY2 zfb8~6-)ZpXg5VaCRjS7A8i`{$3sz5c&oMjLydY?UWWTONYBC_1WoCu#N$zm@hL}Wt z9xM6$$ZP4AYC7F1ahFySYb!Beg&^G_aF7f^%FxHrqC;jg+iEL_-yySqm4^QgnHfI; z(k=LO3>%@p!(>N;QGdc@3Fvx+lsD39s^@pJip0P1gA6NtVwBfUx_B#rb%7bRi|#7N zD*sq7yhx9gD=q%KmHw&UL_dUE1hoWLV@6yMpc@g6NnWfDQ#ZMje}3AHiA?Yx6l;JO z-CiK%lx*kz!LDzyDOV%&czn6-x!j^&)6_R{;;4@&@Ags~`sR-|2OQh_ei?h8dz^LX zi7CaS6!>KOogRTBN&*JXc8-pV>5n*d+zY?hnCAS7oYGM3k^AQ#J&gB?h-@0Y9JNk~ zS{?l!1kYPm$(kcMA^5C6`ZCrigfiU}1H*t!Hv0HS0_fM#zcueIkR(KC;_BdU;_3iR zTtxxC57^Xb^g%8j-x1}zyI+{{xm5V-n5M zGVw-l%tp98d)0XHs(r*AHQvu$y7*FdZ`I(pG==oPN>lugF$0^(ct6M%w`|}amG&t# zetDBR8xp8we)49$_8Gm*cM7IduBXJuw4w@MAD3!xojX)bMSg2W%0fZ{w`nH@pVrrZ z|DOD=Idt=ot}ktJr=~>ILjOz)tzIcHiYy0St@zw%l!0~=VFw8Ugl+hO*nXsz?acX`Fe=G5Cdzn<5va#lYa<440JUzNRA+y1d+*i^9nwyrL|=CPBU!}w3x^1b|~ zbx@{DNa_Io9G+3%^RQM)Je z0w?Z@Z4qTkvVOIT67(*z#hu+7`6F0B?dEbnf@owuQ_X>k^HxcD69Ylm``2-jG za9!XSKVt+kWRYYV#yIcD&SC;fEz_DY5dmHRO6kn4yJmN^t0W! zKYT`9&?oGv*CkXNyyVJGm0q=H#?0t0lJhXe-!8}z6jJm4VExe-|MR*K=HgnDm4vOMdQ@Pz(n z_U-FjvqO~OaF5Ns2TIfK3#Xb(dX-G<*xovgLu5mK*Q#Q@kE1q*F8H_aN-Kc#N! zxrjcWvVzz}0%pufLz@y%w@6@#BJW9|7jYJm<$D6t^}&{sUa%Rr%qrJ~Z*jwBNwU%_ z&veUnz*Wvd_NG^`F9qK!FbBsn7)mJ*@!Vg?CM0d}P(u|lW+-I|OFw(J|3X-+r6(w0 zdm%clt{I8a+ffjG_{vM5S&@d_uUs2Z`7y?&51Wk$WY$bDL>O%_`O2UM@y4Sibcq%HUDy%)@>~GTa<=sCcXE zXLtGNY)O?U7u7P_Kztv~&2}GM$xPPIT>8hlFOX0AbbGxox7`_asEOLwcctnP z8heDhn?_oGPr{N3-2aGVN5i?k*~Nz9De$!TaUdeEu&>66Xza z%1r}&&%>xpKlWi07fjOaU)}(&R;WWdbN)z~1`BUzA&DgnRH#|lp26~265MZfMSKgs zZ=qY+=07r6IQ7zZhsOt1Dp7R1OCN(;&BFL4!?$*s&v@!19a&P@%zT<8|8M)U`3 ztowf)=AC|A9_IIHWT}(b6I9WQ#;8_#J&QKJLd~f{=9HLX8?qmFp2jA{X<|iG69w84 z2bcsuzlqz!HceRZ>Is!)-AxMNO6GwCc!dW5X z227lu6DBH6!@qn+nLOUyVkPhs)g~EL3#VTW=P}kp?=IUh(Ys6S7NI2?5&su~**+hK zYhP3J%tO_U@HF%~4X{Fgk*)S0v>D2B5xA@o*@hqeOTM!4K&kEli_Pu3PW!%|s70M3 zM^WAN2d=?s;Sh3{UU>mM#GxALeg>Wv>6ck{GS&La4{SySnE`T`AR zgb@3Z>K8T}VvTZ?jt>38QlIRBJzkax6v6_mea+g;lR9f9_fe!Lg~;+|MeiQ`WvK)2>%7 zml3gWGZsxzM)NQxJWt1M{B0^%zBH9Xm#qAxU`>on(eaYiF#Ib#>obGJYe6%Z_xNg6 zY2$OF)4qSI+q{zP>Ts|1=T78iwf{iRYwR_oYwy}GI<0z(Wj~B*=`j_Abl{DFSt_Uov%K-{Z0%iivpi=d%RK#<<PaL zeMc_r7ekJ@;Z+Z2nIfAi1C%1^6Ad&#Y*-K^Uk+N=j8Qn z*1UoKPwx-K$8O$zh_5H1ifX{qj;|J>{`TdE?!z>`OAGp~(F@9IyW2uWjgX<=8gxh1 zn|X6)@vhf2qm%V&Q^VsvFoxSj2iWy|6n#~bUJw%hvTdLH-DBElT%tuM!-ve}@n0aC zOkMlh#mAtK+rODZiRUX@^>+b^7$?H;sYMfpZQ_$~~v_}zt zU%9&cay4bvSvYS*a0c~#Y{nIfy-?@+mQwkyd6Yi7_$B$Cdk|>{pZ)b7*7q7RquG_O zqw1(5zGa2}WT*DbZHY{qTY~(kdPuPRTrj|^aNsp0*QA$|*tK?Hxb$;lhn?HAooty~ z$l+UT(|SrG3NR(8g6|Cf^DoEUvPuaKQvqA9pFC2c#ki3ZL2^)3*X(Bo$A@b74TVE- z``-prCMrr)qr-|!)K`8;f2FpQrAS+Nqk8y#NKoR8gR|T2~ z=ZFo*v8?W@nwanmd7xf(_!}|ziO?`bawpej=lvj1w0kdvPdT=3pv6@a{UT>^n0?+g zctPZu>LZhhBTXHNfXL!aDaZaQbTZmB#jWW*-CB`Ryhqo2Cxg+Umy7C>2?H$hCDk2% z1C$HL6c;j+B?kwh)N1eQ(fQ%0m}@Nw5t4c z40*^4>H5aQd+58qT=hBbnXNM(VXSaPE3dGesEqT6t&i;wc?DF2Jx~D$lw8v+k+u7) z@Q|TIf0d?>JT@D;8w*ePoECc>=?(w~)7Vdb$1h5YC%}j7PrD=2+N!*EO5gyLUb&%$V%PcbezYd z74j=y0wDnX<_YKuVe}}=bl=9fin9V za815dxNNs?{4TX{#J$3|xR?0tNm)-~ki(c*6(g!Vapj3v%&ELzbKl~zt$Va=cN4JnH?%j7wh5fbPoE$0x_8?Mj6p3_+$f%v=yT2Yj4n=*MyKwNK(_WcX&R;_9 zmR_&Uc^St`X}?=Pr}+eCwto;J8)qh#8gU$Aw|#|u-1-|a1lRRfXp0q>kbHrYT~ZpBqGw@z)cOKe*7)M*$!UqT!*b}gDWgr$N7UDWnaH4RBRY0K$tEQKpOXFmnRbaN+jDq~-D9grIsiI&v5|W{$CDC zxzG0iJ zN3SwH_qUcRq$vAZCl!!n-I9=C2J0uv-N!g0e$t|JQ#o+JZqQ>#Z8we5qEVPARs9^z zY|}RuvbAOxeOHQ7*e_}n;=z@RAtklD%T1b~{Wvn6s6 zEWcxVzk%(RaQxiXTsBzMC@bwX2FjTEUa^>Ab(CfYYr^@HYFK)Y zTGmpalZ)7d1uy%hVd(`U*wTR0z!J}kCOu2#KvO9;8H(IxU@efL9!KhKU2vlHdpFPP zx-o*R9F+U@5@k|3XuNw)+wsUzUNXO4Tay1uwHomR$?sTROFo`6az&CG-_Wz!WLeXI zK3q|q?)G+2493^OZvV%K6(`Yp&%7*5j|po8kx?Cgg+8|9cvG`aE<8VV99pL_&rOTV9wmzU`$FQF+sjr*6mwGN(4S<_0qWUAXZC!b zNt%?hXY4Rx1k+G8{rBU#YI^jG^=$r!nRB#x(Z?DBs0M_EFR(HhF++-w-SGFh*VD};y?#5pVUy{+n7pDn^%E=9H$*oW7S2E1}+dYl0@$!lviEx+BNj6IEEm!() z*vs@{o`mXc7*#2(Rz92}dpF5=Qi-$6<2Za>w)N9F%~e?oJD1iryP>R{K)mLpTaP;Y!Qx>l9ia_qLFd$YMN zk!sQY(!LpS)LOUn6OV@^DBg}r^3|ZO+H!p_ven-E(k|jg9jjW_HZ~tGys}canO?#h zTlk1;>j;|kubnqrlC zU-1yXGqIU3C^kTyD=;nkssX&o62^=}}o+s?)+ZnjD42 zGaCqH$us?I?oSV92cP$BMs%(9QJVOh;V`o@B-~58(M*4d7MS2>u6Io>9=r}KId`w< z*6nim>(Tolu}nghDjD{bySRe#3Lm2 ze(YQ77h7`{)V*52$5+ZXrMo`hRD?st>tqDJeLjj^?0=ZArqgJu)4dV$*52@&4rhs> z&q!yXu1tw;ok{P%iGrHc= z&^}=USXJ7z6HKB{C)9qZSX61wW@>>+^nx zdi)Q(EZ0z&r`HyVMn3(_iz?S`k4XwHJrYbPKK&GmV88WPsZP>^uM3tiQrY8Ltcsb# zdO8ox$BTKyZhI;10oEg1gIIkiGx2|8vi&I_iml*adPH4_r^!W1g|`acYhd@d-86aD`2UA2FGb830bxsC0gkCq%*UpaCu zWt>m5#Bc5lvZJ1*Vw%aNjD>}RA-5uC3)zK}?~q$jubqQ$2o6jW<08XA?bM!-SGZd- ztDft0QJ<#4Mn<3hdEuRa%SPWy-`uTR6G>^Jx$j2LO~Ltf_+93K#gdc=^v)o7X-8%8 zq2|h)QClZ`x!dUI!Db!Se7HGD)%8-czUMoQpeQ^Q73?PlK2)U@>urwR5?o)uy=WCXw7=kHe<5{$R!p_7C$>~O*fztD z1iPoPFf1|@;ly&R%Ji<10spSRsSm7%<58ua`b_uOn?{vX@Ju;3Sk)eCj_R}Fa^ zXt-`L64pE}_q4%-#iu#VaU1$d)d#(jtDY@!LJ|}|c*$(Ed$+{uA3+1J53fg$h`Wxe zpya#qYyw+zyxap*MgG+%>4f6pkxs$AP zs!`te!aB-$%HfQuLmA$$Avb>WZE}d;WOIfEQ{_H5LJ}`@%j-HD@w1*X8?IRMbN0t>?PR+W}{*G*^9&C^A`@eLXSz$5~l?fEMU z>MNin3ysLu`v`7}G}_1Ja-`z>dj2W$Jn1L`&7MdmNlEVjMG;!E*|FwLiKwL57syoY zx#ieut=MgW7c**_-#56qJ!SZh4<%oQQdK}K)}##KR6dOgQpFf$(@=$`%@sxRKB4at zu9WQSl=9(jG-T$15l&PRFp%li6{zm4;V#*i0C$RXk&qlIh0`o3tfD+P>Xu!a)smfW zQ4)aqosp}zwZmpwDo5+){UEg28^n8Z-`mmWM=$@;ys?PiaMG2Y{tq&MOXKli2b=cH zj)iMNJMzuTDK3q(oJ#dq1R53hgcw6MS@3v597!sQM1UARnhrFiAUMK>iUSO~q9OpR zu4qi~q>7m?;9+inlp9qHdfgi^;zlI|^GV?Bk={KubA+CnIX>}pr^SCabF}_$=Db35 z^R4~6nL{Wv76Z`FylG%UQ$dST+Vb4&bOJ&W3xAMnlimu} z%Is4i$&cHB7aeWDW-I8F21styMMY2+e>$ zp9f;P>Hx~%Q0W+UH%d=Rq8+9qV4}!8qBOq7%#%CNi)TFB30CoD)A`4x3y745CxSLI z11dC;h=f{}d~F&G3|>7|{!4Fi4s6m-WugOM^ZN^+FiT_mQ&4h+ijDJYSn^O5y}X@_ zv0CH(P(6mLikhbYwgWgiT#?99L6y?ruvvameJ!~+8DKda;)gmw$qx<>fG0u&NtAo# zV?d}}&EdONSK?*V?tOW3yh-c3w)fIFJ!lP^%2sh!2<8dUy(BHKB*SBb|3wHm9oIoF zQA;}kt9XDm5n2k&*F4!r8~~5cU>R3U*-0L7ONJR_7sYa-#{OAe`x>#JZbDU;C3k|Z z@!GsqCVdz7mo#eWE^oGg8qKT4{o!-Kj}Mg=I^!cS2!z*EzaKN6ZW(w?)qDbf-7*wq|9Q)( zOJNsxEWRTj9eepeb79}^VNj_2E1t&7{qCMbu|>u!DY%J-4S_(}%l9bveDzi_9o(U} zk3>QE(lfiVv45=lHMqKxH6tcn3#+NMi;xN z>&a7s6umS^eA`ir9nY`S!ITWTotwoiKa|qxOS^2UG}sPb$|zjA`GTViXKlMlb%DpX z+%)Ch-ekl&54`rrA%rA171@X^L=p5Dc<+cmuHTH;lpz07YPBNPVe^P)R5%Uune9SAX7o(!1enQ(sh6w0;WERhTc*9V|Wr{29^Xs(m;s{8aa{4 zN7qc_b3I+Os{YuJ#H0t4nhmhF_z4p`X&+!B2vUZ+1^84UUxN=A5ri=DnE;s(NB|f; zL-zs(0??>1m$hTf0>@@{6n$qtHtv2o##IKQ)X>r)&^wDd8XGj(EnujQwgcq|yha0= zLMVgfT}acd9}V<@*zpD$dJNayC1L6^K@B{7*r(W1CF^I(vN(^0!q+If+S}vuiira&fHk%UaGnU^B#KKo-3jy-7x7xr}5Tr|} z0+eZ?DMI@^1Dt}0I)=~A{0d^)dZ0PxF;8q8X1neD|b^e8H49?x2{6Xf=RFs(d z(^S+bef^8SrlR)IEM|Q!3DuH@yK;B-XIMzt9Dn;dxrZ9Ro9lQx0DXvG%W(i-O&4jj%w_~i|g8Kd{kqo z=h@!NVBl5{4IkX-1Ey)&>xFov+ML>-JW@q$O&55HifnC}X0f(%X^$=~P>N2oRS7 zNudSOX|V=o*-z$V5Y+03Nda+Epzn~%ldd#K6%zB8N`nYtNg`{m77CpY*lw*&(pP6Xv62o z=1?urH#$4z`uW&M>;+TPChL4>rDC4J#_aF(tC~GYzL*vIuB5&9{3_M16=j)L3m+GL@Bf-)li0%iUT0RI7H_7%C{G@o5Y zv9P!Q+^7fzjFXWdmVFL16ubj%nydfB&K%TzT>vO(knzAB=ax@BSiYGu5%gPfAA^n5($@4pbIFb+2>VrQIfW=-U zJcaZu=2`WOr239oeEZ^$0spmP;699+{dVYh*N3NZa&`A?rPJ$Z*}Ea@DotvJe-3|% za({skbjSg`mIo2Rgzs-B6rd9UVe+8YQjU+qMa?{zJwilHNE9vaDdP-Z4CQ%U>>R~U zvvZ;gXJ2`Jt{~(rrl=z1EMNRg&{N84ijs57?zkk&&6KzR(G>Jm>H(w*AUyDY;&Al; z-F5tLmokyQjs1s(*7r1o9o_F5s@fKmA-{Usc0tPNZ3j~;LFe5(zfvj4&g*~TC5~aG z45K01rB@l?9d(8fn{~zJzJ1xcnukDyo`AHFzE{&2O?0_T=RZuw)?((J_Za|Ee5!DM z9g-}rUODTDUYyaQ6oVga$xq}C;-d<=38F%#0HQUKnf^8r(lV=H>ucM;lRb$4L$rq!Utuww-H@H$tx+W_1Nc9J zeAvWhQT`{GPf;k!n*|%{^iA3y{r2g;o#%V6W`;CB+`s}9cSuGA{{VlIks%vS0)IA~ zy7_~Oki{@KqLi)1keMcV*++5kY4CC0C@=KezZ$?KrsOA zZb+n$k_iVWX@Ff7!~i7&l!ilwM`Zw$Zupl_5&&8RG7r=haF_tc4pdg4cL3j;;a)%q z0|PYZdcaT_0xb~Q0>=o|2l!vW3qYzZk!x^GkOtNAB}AK3UJHv2pj|;;hIW%tk!0Ly z*xr`3R18x!ElqO|Nb+r`5ve>L`oJ}lcg;60?&bBB`~@h@1Ebe(;W;%Y8A#{#ceHr! zUEHTQ@rGGKS%mH^6GYEy0jn!i67x^O@$%?QY7N|1rS==g4?`NDN!6sL*qPe2sLOiv zc_FNm1X`R^M?WL|C#%%WUskE-eTR=$seO5E7o&Yv4ShCs&g5xka2ao((cl}zmLij{ z)|$x{-*gPW4IFy|Ce`S8=$0&-Bnve^vn-SFt&g)PJ^`WC=qzBcX~@p_Aac>SyznKt zDtM=RNMuFm04X>%9&2>o!E(=u;MujhydOx!J%7z!|7kmBUcz(Q-ee(ruC-Ug8y73& z4PT*2ec0=tH#}4xF9{n;!ei>07c37ips0QLyEa#9{0#~nADDkQ-Ui~Sx0ZgkDxNg> z({j2A|F-`Vx2hk0VdZd;(qiziWm}^$-y6GDJ^2TK(E>rvVKq9;2v!UCi?9v#8GMKm z9piuV<}R_F>}g=YVSmelTL?9N9jw5U?zQHvTfykj6$Hw2566+13!T0ql-qf!AuTVn z@6TM^LqTw>)Jr))ghO%QFvW*Ho`AQt!=t8>?wK@4!7)j%X!%N&nSEo`^myWSnmR`& zSw>+&Jk4Vsc@3t?B$(sX&={sYP}YJ>fMg=4k4zNV@D(8h7->Of#mP;WoO1-jE9l@m z1xqHxbZAScVtxh42T-wzX;~u(XBo)|Rkb*Jb4=DNMPES6>Ox;m%{^}o09bM1@d2v= zR3fFzb4sIHTwCH!!tM&2k%O~1cuDQeo_a^;t(-<_q6mJPmOxk^K?$eK{nRv+9&d*f zvEJKWH|p=t%6r{sOug9F+%T0NMtrZuXblVV0XrR#IMj2XR0l)_`>4Bc1txSLy)1~3 z;_1*O#vVb(sD`2UGSIV{@Fh6*?xf+)06DaOVw~-FkZ4$$gXP7>;=_F#Z4%|yzhATP zQU6@C*erZeKOJA{2*NT)`i*a4)h!bUTd(|dhN=v_PvR9#@AMGOb=~`}z9yiEPKN8` z$zGA~8%%visqg~+@~zLM{OaVd{v}2S8|RKWo|jF8lpm2?d+!kmkXkU<_LX!Zn)T6UO7wZE9nP`-dKScrc=(^ad%ouxp zQ+tr}4}*M6!0SHl-7g`)K|MMZ4CO>ApdW$G13j$;G-jbuuoP5q-dX)xIaa$4+RywA zz2(9;sC`uO-?YL2TLW||>XLXYGWMH>$+yX`qFw~09vz^1$q=E&dRXydXeqdTGw)=X zJ^(5W&}kK!IP+TW|NSOJZIcWm`Y~4t1L;RU=Ix8?%Nr@W6qU6_YlGVA<9#_~eJu%x zH{DUjBHcs5ZyHXEV3kg~S2Bww?Sb|OcwFS85?ZgXSlI;M72g3mN60ULZ;cQ_tDY42 zlnN2by$AfG(D9+zfc6|TLW;#$`sTn?p#?4lKPKz-*L6og$uH??k|5rg0USRFxrfW%B@!R~&%-|J?2b|<3l4?Bzy6pZb^M#1nU zG!D2|D(8QO*FMyKq-t9JWq`QWAy`VLJzPL}_2S|dF$xnkpkGzIzH=%}R;9^WJYj>? zI7U8z_Z8_B?{^X(k+-++fiO-`@^dO&5; zQ04|{LTJQ1ZqN&`uX2JC-m7knHL3ijGl1mUu61E?QQx1O@_qX4%UnF zKNPZaVQ5d@4AWAlo!Q(olHbfU#>`~=Qc&gLu@Eo(peyV0eLWD$OK%T8It}-lt=Ram&H=A3KH}2m328>SN z2w^Vll7UaW=;U1DRkcd@i@#YtC4CJf!|Fb-zGYs_udy&_bGVjT{pr=7y-R}6psbQm zx;YJAgeJ+u>eT|+2jQZiB7l}b$Wu!OA37}V|Bto(e}T2x{kK?KA_W<_YbUPV;1&0> z&DI_Gyk$?of#~-ISm0BkpxVv)xkKNpEXG+CYJo;q!`H-^T%9-}<_M~lq%9A3E-*_Z z?(didOeQ7;3EdvVS4QWpxEq>*fFKlVu>LrLo_+LorAVN$6a1!)(QMXUx|UZnPv9Q5 z!@xwbn;2a7k-$J*<43mS`Ec8O*b8k&G=;w~I&JebVP*(M7XiWOke)EQA7x%uJk8f5 zRVhE~S8_(`Z%Rv${6d$7xl)GTi>X*`g~4;+)7|n^=O-;7G(4X-B!{e<#1cs3@_71C zmLgi|)Nr|Z+Pq}9aB~ecrm9fr>rS67BJ1Fr&p!bLrrb%s7cvak|9tO5aa@PeyR!eK z({H`JZYf`<>IWN4+6I6oxzq39P%4*gU%Qc`UR&XiUhxL4wX7jQ92~TYqhyffgk5IG zz1cIkyV8LsMoIjDBT5CK^kDyk(iv-hb*Q{^v&~GDsNHPR3?Sq90#^nQ{Mdz|5-{8V!W~~=Q{Hg z+OISl)Dva^<`z(C1UBxnSBF5LKRP~a`uq3V zP^R>6GlK~1zT_FGOXIk3|5CIAP&DBgsRF63i(F_VO~gBktJY(GzP_V-&Z>A$^vvYu z>qUUg&=}l00O)AK>qESI2lViC&_=%@x>tBoWD{*Ka##+-sZ;$)U?>ot5sbmt(w5YN z7PKQrPV4REQeDi9XROD0X~zx~(R+4l`*x4Oaqd&uq8aWzXLb#YFCG1np|HUcgNSJo z)#%0&|c(7of@RZwZ2_i!Yl9Q!Z2w?lmYrfDblhx+S zWuD$S6E`JQ<)m#k8HUrxRxsXGs+(^z;22>Uu<^1(>N&H$J^OF`bX?)kSGSuEXNCBu zxRd@Z3avquxieF~P+`^)LJdD{eFh4}Y%VQm7p16M%hqX?A8hCen%XS9lFpRMOP)_w z(Cf3N>jhlDEnWf&i%&gra0GHZ-^)qsw?=J3i{#*F?Qy$bA`C`Lk%Cbuvkir!4@or= za%BV?iaOKxD&wwxp_Bgf3E^CUBWKA24c8_8kouL;>A^ zTE-e?B4hRGP085IvB{*blp5_A|IEWWL$OXz=?#nXd4j-Aa!<;gYS>qM>*7uu;b5BV z$<5@2aQmhr#o-1lt`OL`z62x(;CUIYxS4J^Bg{M5>mXUrBK0m2iwmQ`i_y7f!!hT} zOFiJDNBmM|^4>M?mX@a6e|fA0hCY-=bB)P=DcDna%YT-9K#Y2L@itb4l z-D|gNB5D!L+RM~8w%%T7R7B~zz#!1QaW9DZryg4{@VM<+mvZJER--@q0!l7T%CXK#s>HiP3x#<%VjR>-R2j?itII zMrqGE$}hBgb?#B4RK~zoe!U?pmZy`zc`2fN>m=&$(z9ymD0)?1RMHf%Q?~5cq+eI& z{EIC2Y9!lRH{pCf<%OK0vkvi|$4I8A^s-)krUpBpZbey(;=bn#1 z+s%S9MfvQLQ}S_(46>>4!0mL9q?f`ACp!L%*Bn8no{_7#esl@(6~y8{_z7 z@I1PqN?tkNzdW!?=&1GpOWVTXexw4c^)!}&x=Kq|;Y5Df@{btdc+RQgAZT$g4*K2- zgp{ubNVlWI?3H%$%NXT7>7(xTKkOy|juITfYOhQN`Az2HjrDNYg_w=mtm4|JMc?E4 zg{Sd#nsX`gK7O>&bgrqXKQQJ@ed}GGLWW4DP6m!$?-ew_De!+RQ|_FPmZ<|JUn7WR z%CkACX}j`WGe$jQS)J99g&&%ld3vsg;TBArQekpd(W1Hiqb+!cI{N}*3tolPUNN@C z&ddI?OqpH~lJ*er(*@5N4zvWk@Xfh93~y2WBFknT{WE{jmF;%E-?%Vlug$4So!3Ia zqDtMcKKI?YVFCd{tGi?QdaXfnxK0#*ndB9dR;fGl^@wRHTkDUsE_Rk49ZR zTFUALH-xZKi6P+QX3?LE5s@89o74E3pE{B$DTl{;=9|E{23C@9oYXPWYFtq%km3wt z;OcprlPpv_7r(c$`T$JHVdEgRqJC%W>#E?a{BN3f;4yF z(itQP>Uf-*nC5j<9aWq)R|ZH~6->R#4u5Zckp6@k+DRgMgK`n-ZFRhq>3H9MMsAX%mzBGm9G!OxF9)m>Qqo-5*a zTaPtW)DJBYrLvS;!_wdB!eZ!SogfbMYFr_NwJ)E><#}ZZf%a-#S;i#l%a+T4F1n^S zQIugapAL(oFR$ZM_6Ji65XV0(R{g1-`q*?q%)(sXaD~w0W#Y*wN*nVeTi*}%w|yxF z{J!B5A*L$NJ?=Xg4g>Z%AS&?ayRRwFaS)sREc1?BQmX&fdyO39C{IsA^j1AlMz+`ulJd?q!~p*>+e**jG>opod4{WJI=yWw5` zIQWqHXYfI&;_~423*R@s>}6_>w-oy5TK15^2kh7%zfms*lb!}2UMROCc_a6pLH!wg zXuZGN7)NC<|CN=PuR7@0 znK+YbzuM!fOlfzvI`E*m5+i)Fjit=~weE;$=3Dn@9Cm~lhn3Xuz|u}*DfJnbxmkFK zvqr|lcuGp(>wvfc(sO}1y{{xYif;y>>_7AgfM zL1xR3H=5E3Hfz)i_neh}G=KD6;3`rqGFZ{jjvR~r?Ad0{iFMXVp{X$Bb{F!kvJ?#F zEyB;iHt>~jxorUdX6nN` zt=1rGeOAR)9t(nDA#X#=*TvObm(O7eBb)OF+r}_Q*JNeZ*Q;FwsGJhAn9&7-vAej~ zf4NB8ng3-Q<9l4AfJ{>OVsZYRp(K!GKV~S7!yYz^CN}W)yc2KKo<2%#)JR6dMWu9V zip6=5gKD_|rxsLPuwQr$-c7(`h_W|*^~TM^X zC4hT1x}(HUwb~$*Qk&5b=p`e{JEc9rQml{ zCey#^Yf=Asf@72PaG!Vqkxs7HbIc=537q6KVYoULB+&qA?2V^C4yJ60CA3--gyi2mZ*i)-28sMgU zZ&S;LDJ7r55ha^3-h2=$D-xo(tjMoJw-!$Rjj%W=f8F|3@^9MxCBzX)W9#DDr0~jD zwxyy0W@zFL3UIKD#m)VS7*K_B{F@zO6A_v1w|$0}RfH`H>aPfdSMk?5e`+y~RgZf>=^gL$Di-4BbI~@I&=Ee0)@4 z<0@(-8Y&>w#NVMy?m$8kBTsbZ0=chh%hzdU>pG0A(a)P7HyU3(xX|BW)p7%T7UufPZtBKH&+mHe^7 zy|@NiJrM}xuh7-Z!s^)-R?g!T*E!Rjo+kdF(?1ENKR#nqpEnu;v5e<8O{VkC<5U z3;3WDbP zO^JElIsxbFe}?UTy0-{;CuuZ6EfYJ(+$d!hLoHAwtx4KE^qOELrzu$8?71uu+cBrco!q|UQu zsZ?mk`U0*G!4ZOVbKe%->kFJi(6C&kZ_jA=ZL$WDy~7He9j#bY@P`3 z6r5@ES2~vF=r8nM3uo}*Omqh-r0VS$<7BHP!nRoz=hSn&Ji+L!=m@N=lUGRB$$`gu zz$C-KHM>3tgkhAQ0ys|42oX-6hBj@Z0rV(bJb>yuJb`jLjA#C)nA@905%)grIBq(9 zQ!VW`R<-%v+!r=p;p9VnsaL+W!z}5)tw!Ug-F@Kg#BQnv&_3!5_-?|q^YmJ{N88#~ zUq5@!ECu!AYbYl0DGHYmNTPyx9J``$aq$G?EQ_tWs=#jcMQZ@NwzH^A#RV>pKX4R< zON)J+y|+{=m>=0b)P8G#&iZOvC&?IK`iRR99j6aie8iO{%<5n{dWS>*;Ty_$`-yeb z)dx@;b=2B28txu|bcRNXI&MmJtq`UeeBN*8Y7@eV!ut;d_ zF38}ceW?42U~(G@M8`bvmTb_GaeipGdAsu56oVKp3yaiY-(#*o#xoFzltaR2vRI~n zIq=F4EeHz_(+4evn_e`y8ZJwN2-!sVdjROWLCYZe+9Cms1-6(ZFeHaW2<~|x-=zQa zv04|4a1uZM!g2EbX`J8|fw1}a*u}3)p|)(U z;jr4C8!wj$7k0WudNp-(8r}!fQ%C|${D}1E$GX%^&5Yf;$e-`T&FzWPfKz@%M*J~j zbiZ;NsKG4jklgiA!C}7y{AIYh=T< z&Zcp6uW18WtHd=D)vyVs zRlkr*{E=Sb3O*2Bn71us{>UhCP!*TDFaD#(HJpxbDp(^*Y+;^f4%P+PwC~kJSibVz z-Jwbe11(W@&qtok#P$s1TlMkOB8$g2s5Qj3d#M~%MALP7fVP$IO!fZ3JN3i2I9f;D zy*^wjKSuKl)~=>pIoP}8MZAN`R$Q>lkuODbiodbEZ=i(-wCNXBcN*q~A@>9Ir|@=` z8EntnxA=E>%bRRb^%UO9NDvi$B@-Xr3r8{I3rkVgZo_tW=c2gBv;Ak9OZ$mI!9wFD zODZyIwT!KTH%=6T6$MvxWgav7uruOI$(QUnVAywVkgsgHIWeI(+FH@+YO@JDp=%&@ zm?Qe09}IbCL#^HGtu?sHTfT=Q+&4t1F%oLuP(=2o|1xLk+Oz+)X}5;mQDxs~vq&TY zf@~y@SIkM$uiYg@3sayr7l+3*GB3P2yg+ z#xZ;OcB75iV#-MRFOUd0&{+L30)|_Y(LMZU1bhXFfORq%sd6F9rVfu0F!(70w#CWZ zf@Hv-AsI0K_G1QY@st5mD_Y9^$$-x%R;HOBGvMOp0O6B{Z)k_X1V8vih7_v5QCr8! zUsg^C%3-T-1kK+NE8uu6N)tKx`^Yj0)E44|i97`f2cvp5P+lU$_!GF+RTG>tI( zwSv#fa$TBs?2oV`EO4O&N_Ek)HN)8KIxvR1u%u@l|1cKIan%-eVwq?(`!R=q$@NNF zPw^mV?$z;c_xXG<-w8zT5u#+T|JuIJ?kE_#o8E8g@HxG`+z~xk!}0Pg?b-U92lc6S z5OSg#c51aKPFVO$sFw!#KA%+UQ9==HaBejCPicMs z_CZk~R7-HB5PaB6H%TYYkJF>7X-l8$B07S=9e3?TnJzr9`tGuP{$g$=tXKU<0=hM+eekfD`9qUExE7jHf#*!YE7N;q zVsF>)b_l$15|)SH^*S1SwIX{JOLnLX!8jg+Z&yR`ST?=I9Te&Mk@F6A1^cy1w(^p+ z`C(2N)ez24%xgW}8z0c-)fdifgb)(_`>W zrje|Bv6Y7x`2zZTVnAj!f#B?m_I1U~sUiVBti9Q%K%626f412YvK2w);Tm4Fdi&l` z!F@tq``!8UGn!RHo{rXBK&1|Z4KAedOMcXVl8)*ci@7qai=GHW6aS?F-Sjy)LN$BR zfRdrg>h{023?fz0%kWeulp8;j(tAWU!VX;yZ`FjoDc?k%Q%u$Q|2WOk?EFRQk!q=M z{NzA69eo;y_=^4TL*i*1!pV7Df7DNfxS+&oKaLx$;eMEb!dvr$shFo=)>=)0BjN)$ z8GlsTaqs#>KV}SfNnlG(qi?jZt)8`Y|0gMOE%#GSO4UyuesT)3POm)6eqF;9-t-bctPYvK#=o_;;Ux7KxA%u*_7k+>*>eUECGd@FZ z&h+2~M^dDx4PU3stsF3mj!a*ye2|D`AZjx-75%5tloP?#mkZM%B{!d+^r z$=M@USl^1oL$G=`JRORf+KFIpJE!jqck&m*E>JEFM3zk+lMJT$^8#0LH<77X z4;&)5_xb5cpTO7Y2O5Bi0c5APC*%#5QK? zKSmc&Fg=Erizl!V3DQG!>^q|;+P-DJ1@!e1@WFg8KO%+`+69**%qZ7uh=gZR)Arzo z+&*mTMcZv;G$@3eCSty%ezdLJD8)HsxnSic)88dX{ucUGzbaC-b`hfq3L*jzg!{(L zt5{Km6>aVaXBzEJwGy`rae6cEidlcFHK6OXk*e5f)F`c;*5Jo}M>b=68r&r{A_^Iu zkh3}yHyTh@4-w{`E`3|6xUcz&lU|@IJ(~@*+qy}h2rc>&qG)^ZqrgXeizP3;;#h?@1Dm6ipS%#tMp=a!1|D;r=KPqx3bei6sfpir@zGE!B-7R~LWRhA5Ps&{+>o+U{ewi&P zG5m%hqhonTGKYSFn-Ze8tw?}$6_iM)#{YB`!ue3X?aCld)qS*2+$&oLUYmfJ0o!3* zD)A1$AhUFwa`q>ybUCZQ+uAZJ0+YFjUHN%=5gcDSjMc1|gML&_MQKFSS5k#40bC8v z(fO__J?hFl-$nq9>ri0P1Vm^&(}$jyh8f4YH%XUbVoJLrOaIx(kp}CvQ*v&#j(oDR z+ewdKgy=L=MU;)M@4M3BdpWux@1gmL0n43{!@&E56%@Ce2iYO1Gvc zvZ}icu+RLxj8YgqkU@n)0R8#`$nb*r&e--r$l!)>^^H%JZ@rDLzq5Rgu-!=bO}VJp zu$QtjD-{0oJWnR6@$?pB2%Fl*%bN9+ia_%w>q?Qg<`Yl7uT;`1)K0~f0*`&yRW)726*A}{ z{V+l&)n*nfGXj-7e-cb>IJ#gS1!v5$B3?y*3gFcgDmA#~Y_FFQ7S>42)=FxaEwf1$ zRjJyUM~>+W(ep?_)UXQW_Ru#{4u+b+M+w-mP?~2xxb2amIWvkMohdoNwQhPLnXI=~o{nZ)pi9<$l(deo*L|tg2o8WHy`|(zEaj!UCAQhZf?v*r zir82w=_uOd3ln<~eLnWOdJT5uN337nb^k5D*hv0iLgUNO;MWTUyR0WD9OGoACCCM9 zcoWYL#O8dny0c#0*aWtS^QZQ({l=@fcF=nydB8Q_P7|EKWt_(pBKbU?4>Wn$Os;{? z+?cSb2RQx70O;Fl{3W9YU8KW1Re!Ps=-VySx4tKrC+0y{9JAEr!5S2pbBP~}E)%ja z^W{9o0@A%_mvCC>Z7;FXwQ3X$2#C4yd|Dx|dQan$cN0qd2O*8d3quEUv#8tT;GQzz z=NK+FbnO+eFosLU4Z{sTyY|4hNTXaJhOI)$w#HA~hgN8>gIAI4H^Ea_AM6f)C}Ir#&}thvt$Ds71sIqi zkO(_Q&-f0PeN=e&bK|9)lH?y3a>ySSaxBD!9EJEsdOyV+lZc;=p3DZhiy7qd3i`%g zb;_r=D!v5?54;%YwX_kb8rX-bNq42ow%%AouaGnsn%o2TX)E%C_9ff9XW2h-iGJlJ z(EN(_ny6^tZw-Tpkry`~#mIiq<+nY$Tr2SguSIw(#N-G`oiE=fu@3Y}*E3eF)G>kJ z3#9}Pejzjcm{8Bq?QEg_Uia}^Y4n$fnC)u9QF_JJN-+ICnI=1L;fQ6y5o!nF#-MN% zUbnHvbG(MMFYBY=w99!aB=9&bP-_%5mGqz>#*6MvD*5`as`+4A)K3o`{uqnF0lu{wj6&v#3F6EHYT^0 z5$QOszXfk2PsYEvaIV)hCN0$GNnN&JWf3G-GqnGm{$X3d_)M2$z54|l3}YsYEcZ#~ zDR)NB3M0$xzU|cJm!HQqGzk0ZW_lOu@nvtjKIf#q^NoL_W2$!W_|66*9Bxh^bDVhHHq-Ff(XSIJf}dH1;i2l zC0aX&hwv8$zLR2(1Qc6UuRa(s@kGR;_9`8@c1-Za`GPIbibe7@#6otZ?zl_Hq1O6X1d!i3_Q|0HbE+$@>h16yQ41AT~6M&t1@QMKaqQUrOp?4OiM(?jDZ^ z8u#vQqqj>N0|}qRYJnvHL<;IPa%xwudJ|;?Cp^GL2FMlSGExVT`APEMGx^w|enIZ4 zN&lAh=7L>=G)W}waCLrv5M%nG%TWXX3UQgiX1vVj(}8@={U53{8}W9`TfQae{-!kW z{K_X|oP`Ye-Ve&Gg#(h2<&tOyW7_iOx@+XME9qwT@Z0$l1x0dtOYrwS)bR-RkzX_s z>kt-9s(l^pb`|3%@`kp`Yx|H0FZcO92m8Gj83!Rsn>Ow}l#(xHuh11C$~g>1!2LZ4 z+$vBEG&&BZ4NHuh^I%-8BYv=!y3RhSP;)uZBpr-Q`6Grtc@#sZ{3V8tNM*rzVMLkg zu5R|fi=h`E#n6UCn{1S`?uVZxE#ys`@}}?I_z%?`a(tom_!^B9eveLdJOsRJ6HXk?6jOm8Y;dUfr~We;`V@|KE$iEXX}X^~v+Cm~j)@{@CVyCyW` z)*3DLvR&DM{`D>FSLm+SOD~bRez7Yx7DO__Zdp|%{sO+~qA*e+%8jc3mJjXl57x5m zql?bGRz}eOvdj0Zy>7YhBg4j8<$7lV4VF(sdiV(N>bXqbV^!`a)lVob}Y1a&C9lkI|Mxt6c~Y^ zJu_oG$|1_)fu4FfG{3FJvBgpXnbGw_mXiNgeglp9NCrkvT_&l4#~;bSh(|I|DeZm& zNb$y{z&m*!8(HT^Gz9A<%TzXFy?=<2LKPv54~%=`n)Bykn$3=ChD>;%C`gwM@ipVj zdT1nOxYE4=F#s$$bEL^Av_<+WCjt0kWm^H7_NE3bI1v%y`!m2o3W$Wh6gF?+5asvq zR?IhS4Y;+>r^wNd^TFP|`>hBEx%E&PG<%)xu@5UiwGXZa##JhhKhJp~m5a)#KCzFM zwk$yC3%R3eN}+Z^m(n6pl)~h5P{E9F-;Y1bX(iMZDF+T#(MW(qUtA76v5DR-@`A$a znj1{@-&Flsmbw@Nnf;i6`WhN1usDZEf_RzD`XP&Lc&Hed|AtB}*%@~`*J^Xf04KqF z)>G;21i3jo#-F$Ne`|Q>iLjI}TCTA#tfe&3pnf{j zV8FQI1|+`)5rX0I`4Sv*S05O1SB@O< z9^`lQemyh3yqMi2yhH!gUH`a%Y@lXncs3C2r&z^oap;|Px$5)mcTD%tg3qy$hK?u9 zltJf-NBvua%?dI3lWdubYUaI00gid@<2@g^EX(8VR$#jV7e|cV=F=62<)Q#Wpd7DkwZtdAlmQJ9Hk z?(<^Y4M;-u^tw^KDyH6MwK5*p6*8iinLaAWoIyr?Fj4O*;AZr~oJ>BpD4x~Ayu7`w zhnr?$TMRZu$xrD>aq6gJYOi55cGGS%9HtMD^Lfs4i!I_9-1Fv(-Q$OkLU2!h!M%oT zxov!BIUZ!wc_Vp!=N2g9M~kbIr%z5iFyHoYZ&^&fZUK7UfylvpQW~v2Gbr>QQ>Nsk z4@~?ce(Xd!QjUXn4gPYIbwS)@F%UNy3Perj3-jSx_GTH!HYGBlgx)uWP45)e3!0g^(ESb;4Er1#c_C9_PWoYwQ(?8+$OjU#I)dAb5%^Ue z4jwpcjj&|0R=IkBgENQ}Ty5)IP)y5xLm#n*^MgS{kIMFQRUE_bYeti#26eR}?J-w1 zL9?DphOfMJmhuP>d+J#Bz4<*s>@=~tv)n}~YWceXw-du~Y~}HkobJ3I;r$k5ei`ZL zJ&!2II9@a@Ck~R3Vn9n59dlL@IXJgM+(CHZi;Gic%7UXU@Vj2XjC;8<@DRC{a*@y_ zF{b4wW`C~6NEt7YiH=Gvv*7-qHxB&PL151JGI|1ruRrjj;z^DmKq;_Yg-e9lr@&9s zJ-nqJ71xGms%f|`kq9hjfkvuwV7sEqlvpqo?!)2-;|k&FS<}J zrY1WgUDcAbb(}iJyR&XHVkJ{AT%ltQ=a6<;mr?xSmOJ!4f(cXh7$B6w{6xB}MRjz> zBru;Upn_EZ-wL+$eBxrS#zUE8-9{D5_7jhB!exqtm#pMH;t5&UJ-ml^txaABQ8^^Y z&eqt1Rsq3y3<_DXa7{H^9;_i)->a2%=4e%6ezRC4}LHu>o-746+} z?X9eaNFsUXEAxuyx$C9^h>VzCcY}{>bJkeTez?^lC=OyhKcc&4f6!foM|2mtX_G>vqf&9>3El0g+0(Q; zz8==j2Yv3pc-Obt<10~&kBiS7>i&n^?Y}nG&tJHds3R|%Q9Sf#pp6DK7`S% z9csn;as75#kkxA;lxs0LkM%xsB~QTl#gT#(8)i*wTLxPaIO+Zrh9OyG*SW6NRLHMo zDX-(p`qbwVF#C()da9Nm@@|34EK%y@yzIg-H7A$z*~*61V(elXYarQo`-zrW=V_*f zDCtbsj;H$iGx-(7VWSIV7*%f^>53v^%-K5?*Fn&!?g|@$WIG-42l`Nl4qfMzgihd$3dIkmYEJIhF-_ zn^B3a;J8g|_l9$*#~VTYW$^1|e#m2W`d@z7_Ht&ppEnI=Xj)qyBEqQ>cq^v{pKc98<(-4r(IMNQkfwrd|zNSSNg&*5Mymn?5 zl8!1!iH4kTaUqxXm6r^8eC_{>x3`L_x^LIE32B&&CN$HU0n|R;%vz~XY^{#hqeLL(jU<}6O`km)_91D7O4qA#bu@7!{xQ^_X z@Cs&EnTs`NqrVnD)igwap+ytt-S90#a@!v+uf;z!zO(1=WVh`DpWtb0dC!MlzrYOH zQ_m#|dqJ<@O1a@S&)i%(=0fnz6E2l{4!5fSnOCNY5w4s%ChiUWqvb|LvgE@Ua`YL$ zJ|2$#Jb&!P$tCYld@Hq?W22cW>u&(L1A`orkg!^a9XpFyQQ#gzfzuqQ6)U&b&u;ol zT8!x9f)Gj0zm~v-&?WFSbP4Q8=_Px1Kxxip!7F9OWnt0*4WtZ>dkE#PT~|6k+Pvhv z$NhRvH|%8iMD{;JYTK`alKr=#WPe4A(|9P^fBP@8f9zjmf5=ZVz7A1Yyt2Sf0xV1_ zzemyN((UR31+!r?$jqoP|et@5`QZlskV`6B~#xObgd$ zwy`tjO+9Kr|%f< z=_zaBoC5-{uRQ&w*TYiMm|q)8_Z%2&j1dZ7V{4x7gyB-T3-#r%ee+WdL(9Oe0Hceu z)YLcfR8Ln}Q(A2RWV1!2)e}E|8<9ydX>^}uV+VARA`@v&do=AYVLgQ?AA@wyDy(SO zZKa=0JDENYPY{1i94lV@ZWSxm2bBCZ*`-=_08he>=OvHY@KhS_l*&>UPR_^9$(PPN zc$Voi27YkGcyjkOyg+U-6fQ8v)Mr)NaOuIfo~pHltx9D64h3Gpz%0*eC{gzZy*pia zcm~>tr`9L5dr*d(g0qt>c5!ZjU`Y;X9_JKR*AW{lkB%L+RGY+2p6}}#{Ye)Z>3phw zkpVRvLV04=7(M)FQUtZ!U&mHuElU;5YQ%F;pKHFN`_8b8rNU0BqFqkI#1&2QO&$$J zDcT#_P}tco@a&P?#-15?rY9)KLKb;VVG#;Ec7gFJRYx;OJL#0qfOawSRx@={P`tDR zdz**8V|>mEJZ(1-12-U__@3MNN5cU&H81w!r7$tgmondze*zI|Pa z9AEmV?#QOf{~(k=&4GUn%N1_^iXAu%$LEkN)_CtKYO4LC-^g-Om^b)CQ8;RkM8=5S zjG96O>f3tCZrN)h9ce@^XRbJQH=Nh&^<(Ykw?6a-1f^Z~a7Z<%XNmxWABYJu@Qxnk zy~)sLAIEpF;d;5niYGzpOtkDFPLBh|IT2z0F!aJ%Ld%G(q^@nA!jn17DeyI1H+ zKQw)m0wugF!k`|@3drfz4~wy*XkJcynxx99axHDnyLC7fvv6K@6CT?$WV>hkC6472 zvLr-!FLF6%#rJzDEMAd282Vw_2ZhXIiq{Z*k*F0IyJf-(q{xMtJjjI0@;ZIzgb{|G zh~Vfp4d!oVbuJx%tZ)zY@|kp z)e~99FJ~H+-;9V7)`93!<_mgB&f`zH#V%(LRifa`;OiDjqqOQ8?yeO|;Tt=F$Y>Mt z*B>~j-p@W1Mv)EY&_x5m6(D9l1JN);zddc@uJ;?DB za^cd{CDt5@CfZeJjz6*pBy1&3?*lCWmjDnM!eBQA%K{Kc17+&aR)Tn;01=}~5ECU9 zI}Polqu!{Rs0Cv1^jZ%}4>do!G`;ZB(n+I6^eHmHPJ>J+JN#86BqjZh9F?B!`4#zd zTXkP_TMX$^Ui`0K;qYYPExzeg107t7Lk#{O#^YZ%#(zNul4N`ha4`4Lurd#_(ROkM zvpeGfmo9v6+;Fy{g~PZ|V?yHttD=pRjkg#F7eHedejilC1o?`eL-}s9g(lbSH?A|eaRe>HoYmUK!^3*kLsY$j@8z^XpS1K1Rpp2zA#MZ z^3G3WH6EsF;_|;V)g#0-`RI^hl|$k&rc!hm!5Jl{zyGk}*V-~`q))07x?;^Jv>X`e zxR0ymRDn@S3~6n#Z$#U{?@3C3z){P*xn0lIgJ>!9%Ept~f8z?4=(;K{64DudI;RG4 z2JR!|^Rat|64_Mzo%izZ9)AlW*)yuF)Gh$5vUl18hsGbgmEuuv_&V5EEFr8r8@H0w z0p0z>U6)Fa^M}ds%f=L{TUq!;njXE z7Ld1yN7UzpEl^w)z<79QC3(j_^G&GLF;-@bn`3fQMul7}X{aQ`K#+jgCVD36l8IPr zT+)i#QbnIKYa2V{Lx>p@>gF%#cmDRRw6q})V*dAlzZp8<_j~p<;CCi=T1<3qIaTSt z$KYOS!*u9)``3UU@}g-By5N8PXThJd)bZ^1l0ULA?{E-{iKz8=ctB+y1dkG6~~Y);kma?L;X08r~dyx2=G zmMfeo0nIuPHTTPR@ZMV<_7rOvT#>Fm8Gwzw!X!hqyjTYwZvLEP@$vOaE*TO+>3X^c zUeab=)kG0VgbQGuh|dnOvmL&_RI5tJ$Fi2UnAaq#@t@;W3ijrHV;5nY+S>_qjZbf)dPQN-8Gb@d&qvQJfU7sg@!!woc+C!JI~k zCr!MX9a_r5yZ%6I?Sb`}zUF7u!RkX%3=Jnqs3~wF71dZ!zoOi> zZIFiJ9I+hnfUT?yw?|5TgIVd`qqUx>R;HHV!W5TZHlwb%>zjjR!*FpSts3@XLotWk zA)!kAgz>bg@0UdQde|x5`>pt5T*UGR_7tJVn%fi87K+ARoW$ZtR;o$i1qgaJWZ=Pj z@xci}I>~MiIG6mLQ@RK(Wn@0KZsVw6oo7)$p7zF`(u=KSrUlk<5Th>aw-(504BfyB z5B=Dl`A44`HSkBD$_&+~Hq>5TlYTqnupEgf9&r0iDavwsYG$T(i+-z<6a+e6_j-Ka z7xg81LTBmwRtTi2G~bIyniOv@0r^MhuLfta65hJQ2^Dt2;Ai1nP-rHXdwp=waI$2j zj++zRLPH(w3HVf_LqWHOX-d`*Lwq5IIphLe@}DBZ_E1`e>J2ImIuf$9=l%oLDKh~*Ty$Oj5wzD z^ZGYbk(_$*vm)-eqWy?^>Ej$;?DgHX>q4(f=@G&MsR~!vs9l-z&@WJ2=2+6^6E0JE zCx0pwDxi7A_z)F_nkO_E{$s1CDepdqUtRyl5~FR&;hF@IgF}?=OMCT(se+_e_(-;* zE)ZgopNYez$+XXH^-%m2Ja4JJXX+;>KT|}AR~+tGO6QTkzvM@7KZ5e9m1(8Wx-M9( z*aEb-9S@uv<=v@DE5g!K)Q1j)oi5HA1>s$jk_zX4^&;&l@OVjbYaxNP6HBovI`;^C zq)r?Nr9?%tF9e!;SM_~!YL0r5!sxVk10ZcZUg5Mke%>>`>c;ku8@ht?drktIZ!;-~4-VwtrBw3hWftSVBVbvYPQ+m$b;^97zvJSbgDA+B zHT>8|y)oljH(fyR4t%X_ACg>F#rX&&GlXm1B>qEY@H#2e>QQZRJB`025|Vj*?Q?an zCYDP6crLbDO3v(re7yYNyVf%ne!WEWb3ASfYwr}s&5!FVyU(aHUfYMdHyb!srnAIO zXT=;PRb2ONvPU-M=5gRr5Z#8=pi`1VBkirq=aNbw#Tdk)hgOy(C7n|sy8ffFj#09! zQ9nqmR`kJq0>wJv@+jd;=*txm+rWLh0oGrQC}rDM^W(~ZNnMuhgPyQ^Vi86Sv5I=) zrOqUVvW`gc`9U0KiP`-$XU4QNJAlywQjtGxHFfWMkv7-)CVae@f#2cEODSawg^#Da zr*V+^1yc(Qj-o)R*&;G(5~%-=D(4Q%;T-57K(^C6{CFMJjQr*xF1hzJGw@{v6&DK5 z8#Mt@LV7*zf5IVmfodPgj;ayq^j*q)ME1oF12He9zzUMf$sP=8}3CT9vEor8>VeSYQ};$(vt9Ql6U zT?BV?IvRw{-xO^}P z%8&4V;z!8szCK4V1?ryo5yKl`!k4X)sU2`>eA zAs;YRueNZhuqe8lxF+up99dg(p96 zWjI7iq1caSMk{&T@?uJDUUh6d1s%Bk*7aM|F7qd`^tEehx73hZGHU!AOo8$QrV#ua zOmWlzbrjDN{Vr&)hdPR96?o+tKU+xqP3Pb;_9rBR)mt6I78g~2=o~?ytcv+MJm*Jn z#9yom+^>R`U|}2W*t@KE4xIor)g zV^_G6Epjdz5ASX$7793vV}-!u>2fRBPe#oizoz4UXZ~rgNKY$~$f^W6D-`1Wtw364 z#nW$bKQ9l0XU@&5L7;LV1zPi6gBC`5_`{}Ny%;9@fTXp8XAr{PB57DGQy*&_X=40l z&B<7f^J^o)d}4E=57Uh*b)O9FYBGt%zck9$?%ULA`#EvN8Fqg(%2-g1vH%U8rD#4y zN{k!z983Nep#n-i$qDYsu!K-9jlfaw#Yb*X9 z->+KNjAXj@X44@1K3+BBcScKT>ex)~I?6q3FVQdg$JmUBJ%NDU{c?W~uTtP#%<6XZ z@v8YgIt8j}ZdXS7qiF`+qYy*>P1Ef0x2C!CJi;)XV0MIcN~S&8eNmvd!4o(3KqZ>n zbN8AigHitb`J~Z~9B0|3%vrL71BLyYkM&UB&eDeZvtggajc!kxeruU+ zsruE!Bj*ZnOsqk*_Qx?utG7S$+BHYOHa$4wH^quiUEn$B>h#t7OS=A;%L?V1vH+A_ z>3fo>>YMXB!-*VbHu}i%)II+2^V)I9H$Owj3lm*p?6;O5SA4y05uw7HgTic^LA0DG z`g@m)DzH8G-cBt>V z{w)Nv&(VID^~Zye<))O6s{QGM(!XIvEMdghpkP>z&W?vV+_hUsK8zR(!qo)H+6`29 zGx%S0H?*qp#|7|Wzw5i0eWCt3deKS;pqZ23hV9CKFq}TPw(czUwlvjc1q_A6X0A3h zkbIYTh%<(Tb89?$1;JmDa&ovtakf0QImmE6BX|o^CZqNt(jn)uVZq>1tbL(+0{lY4 zLnepA1xLUNWXKy3qXGqj2;LJAn)9L9!S3$dqGYot3 zO#7-qBk9q2k2*S-NRV0Nn(|+x5eaP*+Sj!@-6)a$le%xU5iK2gJnK`03`f(;w?M1Z zb+=i@WWZ+3==->o57Ih#BB}CV{gb?QNHsT|#?lB0&Pe2vz~FOU7gcr9@Ax0|Nq5qo zT`uNTTqju5;~v{FvCwkl5g+h2ya;9;F@xsNU(wr9E;>h{hHv1>@Lgvzv*@7^eVHZ*;7BU3E!8ni1|RUkF}CmKKZGh5D(4yOP-((r^&aPTTV2X?*s# z)L0TLGjq_)9aH~762dc*?oG`8sjCE;&0U0JIR8=jq(u(*P}urdjpTBv!eum{J)#2=n1c_u-;{R>Yc|;lb`KjFxQiFGE=-CcO}lmO)x8>u4mLs5mPCrN*^=6| z6<6rhF{odjtr+8o{pqNLxm4U&e^|_9y#9eoLFnfV(`a>1-W?#mhE8aD-ch6iwx*nQ zQg?Y1QBt-;bzhARpZg<7tkaKlt2MF@V}aV3!&W)}ne0~$eU=%N)7b42T5F?C2T%N_ z$}KuM%8c9oNfDa3hT8@HA-5RB_{?4^aMLsHfx^8eTmk~XVjiCc`JUcBi=AX33}8b= zrpDo*`66%6T}AU^YY z{o_!u-Qg{BMLPb{>tbP+FKoCY{!07ivEHXu>StmsGk0KS8-Ikp*F-IQqccD}0OD1w zrOUFM|2Frt7^N#=ewr#Ms*{bC0^(HakG$%h`ArD(%_R=Xp%+54)XmxZfghX<5iPGl zw}~AaL77&g#2x5fDW;;B{%b zO3McTr8ksDLIIe0<5Mwqb|axIPdj3PucyfAPJ%O+)U&S8ULkzQ?tG7LRb`&?R)a`q ze8Pqy5)n0$1XG|x2-yfg zD8pxj%?H@a@F`(;0rfI`13dk!;m8Hhd3sjQyA$`o!t)QdpX5`4fK(73vi8F+%bC%l zBaog7trC2Q95ASi@|W%rcre-YT)1#FX=lwqNI^p(z^baP>&koWYj8{{c#_#NUHEF; zP!Ilw?H)fo!OrwI!t(;w!yW3%6Q06{qIDqImmv18IVn~6zBJq77!KIAo#AV%#@6f3 zacS~(LfGpr4>B#NnEVm@ax-QNg^tMeo;L&SJVyGZQQg$iIt{-ZzW0j{kv<2~U*Bo# zCz0>&lz<@h!=5U``88k!x*!{6sEbbl*7s^m8rjEs|oqAFh}l;FAU- zc>xrbSCPf-#I{Pr!pOkP)?5mEDYO)zJH3GW6 z_~Iz`j3wv;RJ#P!04N>$>(IZQO+HOcXoU+^y9H%YCh5gi!h}D{h0xZ+rF^zv?)E5{ zspjai=Iq zCAX84*TjESQ5Cc41b!(Yy8I6D)nGLitbAy|HaYCb095v6@tojYKQQTqM$Dv=_(ewC zsPt1tfjdf0D}6zEIPnJr0~K6J10>bgvWPjhcg3*s5T05e6ToZ)$`Pq2-DU^_hWzkp zfLUxzIv~Rl8Hqw)Rzdf115R%)8T!+A`cX{dtjJU(g|m~rMdrXr9ZUxTll2^8fKC-dB8eMv9a~dLIxQONd+JR+Fk%KBi0Q)SpQk zUKmBd2=_S--IB9@IN?6CCcxfh1+s!r2=JR2PePgv3T3`jX%tzWL961Xzur zc09waq8}9s9gIH3lzktc-{uc`*FMrS|74vGeTH7N0?BsOn%Y!5aQzUI2><#-!z6Ed zP7CMecO&VN{A!@iao~(u_B)O*f}_`HZMpiWQyWC(M0)(6?o?=xnguZ%>OYa3n^mq$ zLv%J>wR9+rdW-mfpKO!1Cm|6dNTJs@VE=%S`X%oQk7x)q4 zsvG2})A_3^pe;)SF8&JH;EK^_1wDTB#r)Hk>m>AeHI4hy7?WA1FjMv=L5Wem;n{0; z9anM&*F<$*uGPWsCx^b!y`3M{9NqSX-D%12(1q+~N#jONFK{iQ9P5{~;hhbJf$-%! zg_rop*Ac0c3RK2Nu5`l?M9q?{N*6uOL0hfxbCTQLAC~RCo?EY_5x#lHbBl<05qsIq ze4}Vi-4-K5o#{W@cI?R&oUd39-#@B3&yqN*>HRZlNaLNp73JMZTU*lVTSq1LPSXS{VKLS2-*xagtWK7WnII-_#bU-48=9d*P?`_JvYW^Ai5!3|%O}p1m_y0+ zm?uZ*OrGuRmb$Kr&7}tZAakTvNxke0r8T40xZja&u?JouU1@3)umRheIUB(hH z9~O)0782Cr(aaU;lp1Wc1qxN?;jc@xF-%ODWh@RINWpil(N!JQ^~m_9v^1L?y(R*v zVd0wOqJ9P2IX)`~6WB9YK{qT+M!g11Rc|KU-1-2~2n-Th_oejTOrY^q6om+54NlEh zQS8LbLK`S*6-LOGi>(R@T#oTj@3WFSh?0`?2g+sTgYh%0qY`6-1Uljs6$5I~9qQ$B zj~$uG_TclRT#yXBa-Rk;5d>w2#J?7W3hpRv0o-7Gd2HLbwc8CO?9Ag7p77`7B3~(r4o#`e9nixW$I1;3p!CLy+j)dv2Ex`8|Ied!89C`I5`J$>Zmj+6*l; z)%jRQYsGg=FqEo!E?sX-uk|C}La5~gF0cx6>5mA!#-w~gER#oCMjEEXJ~}Rz&uw00 ze^Di)Og{SgZ&dZ8&W#Q!gp1^hu13|ilQ0(vqq^iZSS@AZLcXna@BQ>k#vWoa2F5hdXFKQ`qn|bFmWYp{()McRr&@?WT^4 zYH?i;9rZR7s2dx2gE*Gm_9Jog(Z(!fImy+{iDn(C%qbH>A9=C<)x+q#70bGvPsR9- zs8_{pD`*1eJMa}&BF&?7df|uT7MV!TNKkAxu zsLDxh!Nw0Ne+P%@v5G8SP|OU~BR|X+y^49|OA90vfSy|`C=_{;eKrOU8QS-DZ4C!KkMlA^5ME75KAwgw5ty3%8QG&BUM;>!sEIk&X*NalB^EX$ zS&37)c2zlR^x1-P)`beCFQ{M?=X_i5Z6vXV08NL)k7B<>OcY#LT!6a}^c;c|*Lf_~ zV7;9>Uq@!`Oh8c|0bZTN8*LDt>|5^(z;yjR;}T#x8A-9hTvTvcjd5m9i9DSx%LOu5 zjoT3K*{;@g*UemKOFMe@)W8V(oB3fNLrMEn^zX9lnq{`g^o#``kx=PV72Q zUTHi@Uj!M3wxA5Pi^JJ7<{I+_@#Dy?MTxIg0}i1hRs*g6z&9Io0!aPMRB+Tb*k{&W z!E|OUU+hQXz$X2a(8ITP`XrzB5UI;09V=dw4GB5<`$aP8!3VNaQ%c@E_>t?5S*pZ$ zCJ8-^S8mTQ-LKyARY^--d8vAm&)t3*+{2A1|FDa5b#Kr*{%{5J)_Ne!kLgrr>l~f_ zTncWHz=0zCYTfS>#|C83fIoZHRVxGoSqOeq^Gk(S z-iM4BvhfkFf)DgHzX`;|@|tcWCcbCQ6qJ7sQZJjJ2bt3+dEvYU&__{`u}k*f%r?>3 zK$8?4gvu@BQCSnA(asX`Xb#Vdr zuNb(?W)&;Cs@iOlFxaS+wM?DJ(U;B#`%Yi^3P)(uIKN(EBgWNs%AX`KSN5sxDC6RZ z5PUu=ASJjV6W)$nS&DqFDW~G0Eh8XrSwIuCYHVOv@?ARAC-_|98nw@=CU0H#gQCsFi>S_+wG3+}-sA3D3j^&=u-=x=eA@wnjwYnT#&td>dN9LrTZ9U;sfy8qtmc%N-0OtZhiFvZ?~ankQi)azp|^ zWL~kH!du~X_n2@~wC_hMa%6OogiGO(jk#fTQYf_eHfO##k|6v+=*GW%X|bU8V2JM( zP@>FX3vE7Y<)Z%ZZ7=GJZW_w-c0k0^z{C3xESx-DmKleS_sc;dH0qS=4@cgL`MK#9 zUEkL~Ao&Z`1@H!s@O5?$`3=Qa;5STAaBDb0<`@=5{UH1kDDj` zK&l^zNOE!u>pSv{&Z0qX6fY-}ne6L|z?lfKfga(x`Wwn;C^b|8R$Q-wZQL?`>rlgq z$-?F>iXn)fZ2n#%1`#o#t^IoG0nE4I2SUal2tX{O$!Xze!EU)r&Jrg9E85x=IBXtH z<-t0Us+RaLx#e+NeaNG7=-sF|L(q+gpH(cm@|}{ev|i+H2TlotaUmT6y~Oj9^j4N* zTd%F;!I9IKR{<-S8M&{+~sVf6F{$$V5MI6xF0jRJ@$ zM701mf-&0w3Kdimz?mLI2f2+ScuLlHuuP7hl68BJv8bZMaL%X>J!rD--`+L_P1dzT zSFCLP8WD(?_i>}0DlVYOdV8B=GTIK}Q?ibxlzFpw$YrWkXA?=6+AN}qj)?FB$l29) zypOeFRL&4T%=BhTq)#1U%X=Cfy7dt5Bt@R;2R&8+4Ver@+f8$Jbb^CMQ*_I3IXZ+VrDbuc1SY8F^Z zM^AGclU5CZY%wrCT!$U7`w}D!iv|Q@foY&8B!4;vEgn%9&g6K12}APmh7=-%Li}r( zlrLjL+6_iAtgv5sp)loFLA7tjsZ#XIybF3gj3;t>orPSu1bZvHgE6h!eb>1o?2dAp z=*QK*m8=E7m7VBM&chC;AfJK2JB;rLD|hy1p@6|X1{H)4@^Jl8gL;lG$yZ>aGrGGL_$k;!jCXf3}aL`$@B)g7V1>M5_ zzo6jY082Vq=e%^sgahlb@(sC6-me>{NfP}F+mzoFK7 z{xfP_=zq;xXa9?}-qHVGS?eZEnAE^gHrVk0N?Lyo_ivzec^sI zLBI3keJ+sNj7bAxrWZB4^eA8FO(zaU6#^vEpqhzxV@zVizrgCiyGJAny#JP;4%kP6 zh=IXJB+&neOlJZjqA<~oTJZ<1KqW$+@|lcO(x=aqWvY##EILJ9jpp#l+2@L4U%!zZ zCDV2!*1lm_x>9=Skozl1l0-pU#CQwk-m2r_C-O?{yq5W+L}~efAkjyl(1ZcEX2I;Lqz9z|r@T zHzCIQIlpx&R=PLeWfj^E7@h{joaE^enA(edV+SAP6-Q( z1LQsjPeI*i9X-fY4g8zvcyPc)A96krI*dsO1jeC?11rOrNU$WpU>vF)pezn@fz<_~ z7{NKf8W|csa_fYp`Z?bZtR{}6Wn{RzG5z`$I2;}66Fw$2Y+TuE;>5$m-RL};Umh^dhJ**S z&Z1$%+5=;=Xn3%7z|UE<7r08_@4n{G<`1oVVnc^1R;fRS@3sMr3}kZlF*hBf7ZV%9 zcPIq|yhsb=>A3DEY@Df&1*os7n*c~0i9k{8qD>i zA(MCd1@w2K{*Ab+Z*75h9dE!95P{%^PP_qucuW?y(D9}FE5bE`@j zEZ3*xpcMVWQG8Z&GOD7noUb}%`EbniBK2}CMoE}&*ORslgW0qu3G{=SYMB;%k6X;Z^0{||{ zpRy;4i5Uagd&*je!l?hc%K5SOOH`h&@)_t=&buT0bd`Hgwx=JDGqn^63HP9V?61}M zBp1z;{W<5GVxq;%xZK2N_|)ZP&fl4N_rwv;1PiJNTxhM`2C_|E%pAFS&W#;pHYCD$ znRpQu5~PzqJMv&}i_h~VJW?4*mCKYU7Q(v_Wc#|60*q$7@xoLUddqrhW zYt`@1_PWHr2p2$Y^c%i**H9!ViyWp9rtZ_3Uv;?fuQT6M4wD)pk_(+?Tu?3ZjL6ja zguhgaHBG3V$bGSB$}uJ5LC%-3b*kWug8KLMf13Mr{Zs$5%xL?`OkVSkQw{OIajG%@ zKb&d@FHoMOYO|)d6QqFOB`PPd|VLB^wz-z6R>?x)z_QwuBfGMK-o7Ru&WAOG1}L_)U~L{D3bYQ@uzhCf>iksY z;ympLHs`PH-j?^z@Arm5tzY&~%Oo zP@w^(L)$B#MDd7#mn9B%jboAb-)u*#Dx9nMf!n|I$B^w8uTt&+*D+RrIJ-dHbEY;lTgG8wONUC2Me5{ah?jQ`8E(i9YaW-K59ID%&m2XBJGDnM&p#b8D6*R z$8F9(4OOKB!!g-A%@2p^AHAjiG*p>ItstX28!dmEqR{^`ML8)!O;OPHTVqDC1#gZ1 zgMs6JG*ruYhwW-wZBl>!POAT_po;rcP~|ADl6`8Z(n;P`8vNBzRr}LWl_H-M#M42k zgDT<2$sJh^bhrz$-j7HRrBsWHN7Eu>!D^H;#MJE5um}m2SFkBOeg!VYz%;_U&r-Qq ze`TA!p_ry^2|KM`{OT*-1W7KvWT69%I%#&lAogY`UERvy3YvyQ1va|ZFXy1p&^PF+ETc~!av?c?|t9w>BIT_sLAz# z;Y?{U78kyiWz{}nS0sK>LHIuV_M8H+(FaXK_#PKpE%DW$&hPpV;;DKWyXWZ-=9q5dT+yR}?QtV^7N|jt#BN93w-6E;*fdGJxv#AUW^5=jm|x zvSN1UC`M=K8QiX$O)&bB5EYWlF>~R}spiX9OsAxDAHWff!h~~EqTT+n`C0G~sM;I) z3HYS;#^b9KFn1z>s=cw~-V4%xt)jX;SR5-+DSzia#nnd{xG~bHZh(<~k+tSqFs?M6 zR{HU>nYZ&M7!K<6&U|uuW3~QqdP}HH8rR|_rTKA+e{9r^ItH|lqGhJDxLeJn{CjwW zMMTuK?B8%IY=DVIapcU`M9UE_l>p5{=3$!7m~xDwCKeUH(FXF>7kTv(KMe0yg7SLN zJzws?)*+v2ObPD*)f>_T^uF(@$ao;IE0gbB81N0gewh~Zz0U|Nw`8XNuL4^f-XcRw{!@WX z4S*Kd=KrI>Hg0GCPk}Ahz&ZY@z*b?w;Ul$?W0SgDAuKQAQnJ-wDs{NDvV*wWw||QFD!vVFEPx4wDmdNuT6<*H9>$vh zoje#!K*ky>0e)D0Nh(;QuOMmP5MQNdA~p$DBI5Dte-PpFvjMmhN!rgzb&vF(uC zlP3xM4|z_c`>lCzs|zWiY4Ay6W z;ovhM`x^=Y9Nq$8T7<*~IFf=5fbAkAOi~s0(f9t(yX{Q5GY4d^_2QMZMGu`^&ZMwd z_NM{$0W>@$%(G@@1|mX$ISiEquKEL@eu>8W9B)t2gAKuVghfh!wW3T@{dhD!GzsY* zdno+-xU`UNd~HyZ1R#)uA_*+)A){f9iM4tAqpo@5be_!wZ%<7l0Wk>3{E++Uu-`AP z$#-mtPm@|HErfTcduJD-&(QqPotv0LY>z@4BI9CSt850L2+1 z3+{HA7xy2LP)j3dyR8{x>;7f}!1M)^0(%}P!VL{)hy<_@)Qip$XuE~rsokQ${uBDP zp_F2D_6O4vawhnMX`vbW7p7%mM#a^a0@`lzANtd7VKKRmfVNxETC$p*%^`8MEL+D! zPvw^Kr*ezG)~~mcPvsWtmyr>F$}I}vu0&7e7Hit+*gu$-8V10n3`_ua7vUU!|4)~t zaviu?z#s*x%fR>m%OVC5D+ZPH4#(s-qL_g}dwK&lrC3B%w0lY&;BD8pKr=2w%S z6;UEX+N$-+a5mwGb(B6e4(yM{Znpy~UMTqJVDABeED2E^HQJ8GBySWA%tD^M`6skV z$P?Nm{4cZ#1qu$?^zXBnE5CK%qc@5)lI+~82yNg1`0kDJh5_6CU0~yp8Xckj_pOsa z`6qY@{jZHb@De)$D7+*-34CNR4L$_2129+t?Mm=lpu!DJ96+rC`ydJ)6?Hjm0^wCq z{j;VgP?d~ni}NAu$`&pDYUSVP830QPrUHN;jNuF%d!Q)-Y^j*50FfseF;vW=UIR`B z>^o7>2zki6<23fqR4RLUO|Z9OZfZn)vPg@cY-aT6k{L@pf!;g-eZC~dc{u)_MX_Nn=Fv^u$VM_WRNB4@d{;)(r+^^-(PXqp>2OC; z++sw<+5fG{ICxO6A1wsFbfZ#`Nus^thuScjq;JIkiwy%FPaA2rlBF~codw3?`x zxa&8qoEhN}DA!(bLV_5pM>U1n&tc69zI$l!9C0PX_QsxZ4(^blyG;1Bop^-YR6gk8 zS;83Z_!3sV!-!r(Ps8zZsF+fG^9eaPe-=*WvxYY}^piAYe@K& ztNqCeg*+vU2B16cL3-$pyUK$b^t9s+c-nEpChUtqcic}i?(0Q>JOLdaBBq<^_deL- zTJ6~x{DG`z0TDbi%v~S;XEO^oJ?R`*KDMPQ0WeGMC6RvLnm}zsS=`+bYh=|Tr&Ba1 zc6(;wf-d+lgrFuC!2LFm3{r`oC8FFV|X7P@2Wl|pD6?`|B znNakq$knF)E&Q35%wfQD>x}D^*%hskhzB>BM~sX!rCZ#j|GkO%e<5OqXx67^U@##v z_UWo0+I9^&W1*oSXX4f{8SLs2vBb^1x6{K-uo8A`D<#KRbrj-eM85bxP0VqBOw8>6 zt%>=6Az}u;)*#{mU}xxRa+4E`PxmN|P540X{kA>Dc;EHX=fu42>Nuss#@{TK7sQ9y z_@SjH6#gy^IPQktS$wPQ^B-4;fhsOApP94N=N0SusPCEN4lI!I{`jPG%X@Qt#2pg-)7?6- zEpxF<;maJ*myb+^uO`seMZ88n}q=a+fmv8ARU@T_)dEfo3%Hv`odHa{QAp9P zBQ%%ozGye6Fbs!s@gg?<^6X+XQ-w8C@+fr1_cHY-m$P-v zGt=p+IquTY>ID||1*_|}eAekXFy$_08NoOEuLyHL0poNq zfy^J5uBgS|E?r=w;6Gft*8j<+8w7Rf{#TVQ-`^@-BFK|OH^Z3Gm*W3#iSAzxT?AFN z|5>8@`0W2K(LEyhpC!6v|EENE)@KNwy6kLosZPLs(lHmvf_iq5Vc3U%Lw&hpz>W*p z16Cg}aRu8#I(UyhKTXv>uu^>$Ho*9^R9k+iK#<28Kdk0duct8Ij&c{{(Xa!rF=OrbE~{X{geAKa{PFue+?H=B6Uxam~i zwj1Htc5Ox5=WyXLl#Om`HZbC4?O2tm1>+73h3qHjhujizDv?pIilgf1McEI!Qau{k zsvloC4EWz(*4Sz7lP{k~a>!@#bG=A-DP=9fz@N!@uF11)m(x~(QT31|{^1MsgO>CG zgG~7LwFVCZ2K!tLg)4@d8ukp!SQDI9 za(%KF)56=bu9`HlJfwk0Ykm3pd=x(Lz5&P}0+aGSYEw$EQLDpJ3UzGR;sm%#px&`W%-UZ#;{_3kG-S0a#%)0l=FW31VthI=*g-F-d#$WYuRj~t6ct>Aj35Xs+ti2Qw=~Qv4*=R56dIb70$BZ&mH-7Ngav+Yqea|?bV!0IM6+?Hd7*Ab@NE z3<@MnXj2!o3cMIc!6Gv~I;>!aPB6OE{O``xoHH`vyjGqaw_dDWyI*tx6YePZfEXnb zK5*}jg8mG0u`U8&c%Tr-9HLSYOM2&4w~S2nt3zt5*|Op?b#Yo-n(rll%fx4tVBNs2 zyVHpku6FLV#6ImPqH52#Tp{J0ZxYF;LVa)WwZanx0WdEn6%bgD%7!bzOpY-*^G)uM zt)knz(ka-x!`~gy(7+=G)D2NZ8#-c;p$Czq$O|`F#;?7IrSZO#O4nbQhT`aE@2sl3 zXav_=KaEF_b`I3^BGwmMqP)#BsrAqzUG2Y2Ys!4{LYLJ>EJF9;RXNegSGJ-gDF9aj%T}7G~r}^c6hvLb*|=j#$Eh zNh?fz2%2&9$eVRBwYx*C_d;X#S8|~u!*~ym^Y0qA8XfZ;&pUn%Yx`;KkJ=s?8otHW zng2vRs9)Mnf*aN|;_^|7^BJQ)!4YJ28OEzGnN&$tug*?@_^lYF>y8sQ@p6iiDX6ac zg0>Q`t+>>qEm;qE@nvagl$yo%lbstK!3(1*CrC*V8&i1-8CG2{aiXXdZT3bk=}?+b zOZ6d2goOLxHB+od9L;x_k(z zWIJHmzBhpasSUj-1VlM85;i#%5Eour>(EkZocWr1crl5xQ7g)ESxcw+E0$E;+o21c zlxLP76|R9SDlj2HkOabpwFH=wK;-%~V>(LT8VBYNS>BkAs(ca`{vDnFPWHL;?>g6n zZAuI}u?Q*hHz+nSYSV6vY;1yRZ#}QVxCoGV^@##TPKzuGbK0NPU%7b-SRl4|#BFUh zX5OgHh@0}pfB_dqbZW)dvae!iY|P}$dN^W12(2SbZuj#hTJL`@1*2L;?^dkI+M_}O zO!n$z_dE12b<8w3?^NA;$djl(-hN%D81&2QY{u;B?o@wW6$ZS3N99Jzk)5-9y8Wnt zg}3;w!2LQp5}@gckB!b)Q!4e0B+%GE^kE6Gw}qlAnIXLhVxuWM{zS*z9lk)CClpml z;Q#-z_f|nw_u=2Jba%Iebf-v5cQ;bf2#A14$f5-4=0|t8ba!_MNOyNPybFDvf9!+3 z=Z$$!wkK;G4w-S7^}VmpbzNhuT$djI;4)-JpYxasOjzhpbFsMm(jMmAz$a<)gw=8Z z>^kEzLWBT#UvNo)tT%JE@3__?0akH$QmF$5m8q)aqKHmOf?#C7mPaC zDS4nN1NC!A`59XoIaw&CB+wT1zSYbY%O9mGDw`(Ls;C!;qz3do+EH7XdD_#&k^3B2Oz;5^7+FG$O5GcyKwE#c`Ysi>q? zvl++{p$PSpnNr34c7@148kH}-fS(I%LQ``~;ihc?{4BvH$wy$#5}p=920*rgCq+i+ z7>AM269%}iuwzB8?RF$ZWRqEhokaKqu{E8=sr z;=*6Dyeq6TqAxRD*ci*ZpU~c{tDZBHmjcJ2`6l=p^*W~Z6vUC7lsh_k7Rn9MF$jRV zL{x6gLnJ9V-T5(b{WWWa2jvbHjvHo*8z&|nms?HIzGWEZiHRaRSJPKze&Q>iZsrkx z`s>29$i2(%p)BqtAHtGjU%j>A$J-_^uC>ao>yZ2y%6MvsPH-^`NFfyTNAFyvIX zJ6A{s+RzSAqp9y`J<2}9V~pB-bdpBqd+WyeK6xq@t>Ta&fjz!^?2$!Ldq~E1!7jc6 zJRw+;+uR3af^B4VNi^2j7zwHbm(Ddltf`xNPbJ6kX6aR{eRTW49+&qiUU!hyY|<1o;0w zD>6AKf&P7vXRQW_fcy@on2VyEE)EwuQe^_IZzXC{cQCTp#I-6^I5@X>(TEyde*WP_ ztS!SKBIPa{5p%ICB=3x(f>hu`3(M%XW>C&YpH*fnh2HB!6H_T2Tu4=>`3DHT+}nN@ z#LZW4G|x8LRlb$je`50bz&osr`lQB?>64a2xI1?!tCSta8kAxw&gsuCd;AWz6p}6` zD*_o98AN4)a08wOQE{-=!s?L&n}vl+A$@l+ipKjPBuxNeOn8!44o?Mbx%kL4KWPRI zyGZ2jThwRoAg6ZwH^@DMHsc^mjMA|{sDK?7_>X-WCRmJ5W;m}^9~1hN8yyPT*m5_x zVzn#$@Px=Pw}f&2Y-a@Jxw2%JYJD!sPr7BR1vTv?@8UAa zBYDdas8i?jk8c7Y3q!;Y)q~1C@1i_Z&s9W%v7|3$qs}az6gB#F z3s4a7m72hHjhvjm)Y&z3at65W)yzhz!XLTR=STLuwGquwh09RIZEvrPjhzzC@LVM; zut7Op96B6jABk@gWfq;BUfSA_@NBo~cLY2Z^seO;2-gNG+aIot@VYahaU%NRTiCto z=DlT~TtbCEIol#MscCd43S>+Agy_(XuvP*+SKv8g1mPx<2~B;1QF*L--bg^5XjK0E zamqwMotkm0N#0bVj@qJM>*Sqa7h8G;GALN(S6Zb{|6tY}mA|%d12)dwQIyFK?@g|& z12KCcz3TQ|;z2BDZgCWMj9q7M$zIsXEMS8N>((4;uRrP25H$HiFcX&YGzTa>{Qxf; zVavV^`(rdrA4?6l^0KX8T3wG{hTb0a9;VTm(V`PL0o1Z!m zD1G?pg}mt`XT-8BGrScp+Opg_Yk~g^N?<;N5`xd1L~tf+u(@moQO@Db44|}wMh=3S z&G-E&)dSI^_R{h-tVu9Uk9(Fzxybl2-MgQjUSt?ImL@OtP=2c9nVu_Q85LVJhdW0urA-)(+G*GLJ$bWF+PFSv)dT;O_j zi{oep+pRYV6S1b-ZhHWqXV}LZM_c}Wc4Q%!Ai>M8Ykk{&RU&y@@!WfnE}={n6iXtZu3#HFEkgh(SDn=BXN~ubw)Y_oUeyPkm4%bUsxKXs(D2qmI#JIeAc$~h|Yz} zz-xd`98z8EIWr3PgxYos35o^=(rg<)KZ zhkn|nl#^6kWI0apKZhS+k9Ur@%LQT1RqOuf+Y^1C{6?64X@Dt}<_e|QSj({N<)T*? z$RBZ+W6#Gv*>w$V#kE5s&k5XVf1G z%@X2S%pSz9nE!E%P?E*K6oKWaQll>5jn55qa>cSezHo9 z*g#GZb?ag1dm3wnZ(v&6oR?@v(^?RGQo!Hq__kNO?Ls;1ZkJGh%@LTmISA9mg3~1R z>k-nY*}@9yb^;AJ%|t)xqOg|;lmm4Nya)^~EV-0Zz5*8nE6^%SUaS_Yz ziKzy{(eDe@qEV4bM{iggNTVBWndH_!84;G!4R|ijoW1eU$xd#gLBN+X-4}3zO^F4T zb5L0kX|_jx?BjD~e3AgN{J`={wE(2-xJ78|_xV5M>2SnvM^02Ln|`5Dd98qKM}~PS ztoeo)nFT-Kku_&CB-puRg>-~KkgpyVue@l6WHhN2S*?!BCBl?@;&*a{N%Z%Y)yb zn5`4W`JWX+I{D$@DquQ4K^3Ka6}_y=OxpT%|)rQpl*hUKE)j8`{b)~ZsJK4 zF`aL-dOdHVo#*dw@zu*%ZCrO9= zWmoT`Ch2f>F(zn^@2b9}Kb%194~L`OsjU|d?hq(!`$Jc={1U`I>9`|)-x*c)@omdm z4m=Th3gTkwL3Kj}(e;Xe@HXDkiGXVFKuwZy1wy4!VL@7u3k_g~a%C@2e+k zS++HxpawZlh)!2V`(uQ- zSwtGMFfi1>nI~Em$Pi00$n3+fl485OCWz+keQ(G$q4OuTCi$5Z9cJZt?BNu@Q$xz? zHchHUJLyW8F` z#?#WfGP5qp^D>|FeHnh$R7W746`HV{7x*c>UrrLbrJ?etT7CfX1?*1LX~>Y7bVmq! zj34n8kWLB)jMKIeV0Ehs2KjAYQ!-I83T$F9J7tt6E@B`h%W6?#8SZSCIkIko!U-Zj zSbMinrwqos!K&5nzPfqz=|-V;e9h(d=|v*zkiqSv?}@jF{cAZ)n5Oe7(<=EuSF~v4 zaXY|}4FMm%&p(b(cJSK?Fm#MY3O82cBy^U*3ZV1C;lXbFP$z;S0GPo42Cc&l()tB7 zSqQpM6T}$v`|x1<)4xgCBJ>oB{CwjmWVGnR+Re84vHqa1GWEWO@%V*$yfN5kNsuFf z(|zNv975(0BYpM@nIeOp9v#kwy--`|6%+lh8E<5w4RbXNg2BcispdiX;BRw+cYX(Z z$(060uvbXLgY<(8`TEYsNucMffCsSl@r7K%abgke$9OFhWt8?%*yWg=$mzDH%$U!L zn~0Q0$yC^`bnkbo4q#}FLvrZ5klyA;H=@@+P&x-Nliork9eW-+5>3hTm5?~S=w^joCbNbp z^Dv4EtE(i4Y)sTzgS+*hit#|<0WM`W7b5VOW}+{K%sOGmHu;YV#h^WcA*E_Sh@Pu` zM|E7p>}t5JGsU|v8ZYV%yTJ~zsiN{m4H(JwM1dn?5qSE+ad%j!+ntfcyMo!!&Mw*@Adpk1IiU*e z(!4Wx)bP#rMou!SWUzUS&+u*rs3=BN23d+|#4%vy;WXIveGt*4ZdqNvmF|7nFa1VW zoHFI1!dmrJi*H-P8LxL!O&$be^{PTDx0y5EB$gmQ#|UoKJURA7fCj^|r>Q4&ndvXQ zF7~{@M}W)*u4R(f6xjoH^T_+7egE({w42ZIcHsuApsPzTdABdN{#`2fXU3oeegM@I zmBGm3hW{?<&gi?vpmT@d`>Xi~#T(r#>DH28h&bGslyVYebeI8oDP6QK%5B3nAwK%h z*$7`R;3Au_1ASKeX5cY!Yy*HoVS*ylG}IJD>p?Qd7u1$iXrM9+o;*yto@~+?!j{E_UOcM>zeb1ZNPBqd0L?8lxdG8Fv<-lgB zPqS)}CH!pUSe2L_XdO7mRXGhHh2wTZpS@AC0n)v}0RB-p?l)k91Q8D+0@xz~U*5_h za3vw(D1bNRsEnu-@vuI}Zt6%Mapn0KnE;MRuzV8khk?qTR!*A%zx(Gx= z_p0^#6r->KMC0nd6daaH@e_Tjz^kqdwXj(eNuSkvI~nC=t*=H#!e3sMTP6h9{uJOz zuV?A!d^9P(bGte@)ORqoS0ivu&E9u}W3Mh&<*%#bF0#5mIV@RWPSZu#{d}v)|8@7s zKg<{;&o+ZE|G9{F7D;C$yZvk82R{(q(qgEC2wk%-katEqw@y*b;q*SMzi^#p9kfN zXY}LM+p>pQ1a5PkU!ra6f`zi5!!}H7zPSW_dU~UIpe;w7u#n}qLH(BeXgYWu!EzfM z1(-KI;r3}!e7Vv=E{IbDvoG`Y&Ya6*jiymH?baqsZ0=7q6fB(7EOMerF=ac(^>@al zbMQk`FP#+-NUP1BlvH*0LwXQ1?oKb9?J*H&hwE2e!Ki19<^ z#`>fykJ`6vr-Ey#UkESm+|cZm1uXiZQivR&tjA9mfA!=UWbNK@(a$J;C7sDn@o=x9 z6m5)@-M-}(_L&&F$j^C7T`O|BT_V$#v3*QXt$6$~-o{I&Ut6&sXoZ0#0DTP#OjjPn zkk8L%x|$PeQ;C&GB9AbYH7X*X!8~b?g)0LFO(IH6bY;VFBr}*EfALVW1QE{BlUcPF z;G2%uewqn?2|>jKac^z=cD|Kk;-|ed>WsTQou!nTx{QILWd34^oM1kah1C%WoQx8= zzbN4zW-sb(27{%w%K-UKE$FE8l47YESC_a0x2Mc<%n%c2+V+AyNBu(xjB&J~-PXp@I9^&s1Fyr2{tW| zARg@35+@CQG{Tm$fs*;I9i>;$v^;mY^~}y%y-69{Sr_?IYS@JKT<9h#O<`7O#lM`5 z0&5^e$y2EA*kG*FBMy^BT5Gd)qtxuy<3D8aCClT{fXEKia9FymA5Sx zhxa3gJ)na}1KSfZQ~LL^-#Np$MYqYyL5tNbx)2fB3AeABMw_;GKYtc_+!8vv`R9!1 zZl87EhjvZ#56$_ebVoV5{P9KD>2;mczuPQI_TSqqMDR9?sraj)Kj_R|j^ONHoU`#C zoHGWDbGpBN)+xOIVCMLn<~+2b`Sry5gszN+;wQay7ptMLLppQ4TGg(GOMk48r`{w)#uezR|ZI1%l#{UQW8`-VrflzUwX6Gs>lo{=^ri`@ml^ES!|RVae@w z;^nG>l7c?;vkgjpqo5P6?DpHD5XWZ27eURHpTY6tKiXjVIigAF2 zK?;}KK}9{SH0)cZiL&>kGDeNm(RKvbYiuvsg(k)3(CDMxyeQqLaV_O4!8^FC#_%+CJ^WI$8>UN^d}6$Bve%8cnKxKT_|DgNRM4o zIf;nPXjYnZLV!MEIB`EAqkN9U*gLqc_ZIvmcMW_N(O>?}r!o``KJ%%o(H`0V@~Qg# zd)PlF4wLS)zIH2&J;jlFJWY(`^awqSTov>L5<$Ax2$8)$sW29Fmf)?-a`CO_Z`E50 zJ`U37P!(q}E>61kotdukn{&4crr(zXmEw-^=~&0Di&g~GYL_RzBC_rCz{=TW0MLTL zR!PXh4fKe-e8ub6wl;xEthTYsXvJY5Eys3(><2#6qVyPNMV;k(!cRziwvcAyB)f!E%ks$g@ju>l}17*!6bp8p6hnGKnS zyDSMf97lUe)bV2qEeMJj1Woj?aRlQ{80%*2k;&|>*I;4>*kz&Nfoe8fqfwkZa6PCS zlL7tNnestXV~>J2L6f(#)l7q%!B0eQ*2FCa43m$$*djjt8~QYFXge#G;&xD4$QHeo zLm-bdH>3x*PQil7`haoyXb;(pbCN$7X16~VX0tBA{zKa53-g&%$|%c!T$n+Zsg<*H z|DKo&rsnpaPt0gGe<IbzcU)g7zlQR| z0R%^I2?5WaDA1t0p^eIesOqod)rz+{m(n0y0VGOWZhxOA-XBIwf}6KQVal z4vjucJ}(5@pBI7(;Dw+pcp-Rq@Mj^IUwS}w2XO@Gg`pBCO+N1dKihQ8{cq$$|JFnQ z)+w+9{RT)`nMkXw;uYp9{RT)`hTw;y7jjn`nMkXw;uYxR1bX$ z)8$u=@Bf8KF_Z}!LcjIjPpvsP(hxSu&+(9Eab&5lPhJRnx*2g39K#ktqd#RaAf^MI zLOu5VGs+&ecE!#v5^Bxl_ptrf%{Bl1kDCh;?Bh-{%4fUEo#n3Tbo38uEVuumhn}W$nZhL z3;TV;6>==QD|D%XvQv`5sP#@s0;24&AQ8BsQYdjcOuAa%+xGL(=&BZVD$IVsM zX~&U36WS`OgS4N^oIP)zBI!vfqf4aZpq+4=bR^JhBxmE(U2~lYAss|;STss$g~S;q zLm5!tY#|HHVnvCOf|>#fG*|2l9ur(A#2by%|7nFk2UQ9-?F#xigIWQ_KvZUs6`h%V z_$E~Dn5uqVV}kbENWYj-z_ErU(%goDDdgq{{Q7RFzJ%DWvPGDx@RguAPOln!CA!{- z@g}5{)8f>lUyvAH`L64)e1z=z;WZ7RutE-Wb4!6g3|jF%G9=Vf8xt6Nn;@ zbRO&xKeqJ=ES=OS-TUM&nm2bKefN(R?50q^WP@|HC}sikA^p1|W|>GYr2)?UIDZxV zQiKg%*sd?g-v<@B#x6w>r@rRLwvPMRA|hKLSKn2ixkT(vCHgF5mRu~3uhT=|cz3gt zDbbr>`}$E!(ks3?363eJcJSK#P;9w8vMD0)Q_NMRQb770y7DCs6M_8;58ikY(x*)pMa7|D~t%ik%b1r?aNrAFF;Z zmJUYX6z+@SMv|3LnJh`unbBCMc_{BQrU%u=g0#RoVWZzV;Z(v*M81h7>+{elLh75* z4-~es`(}N9y5&p0`L}@w%C>9=wWk!fiT)faL)k|NOa_Fb4DGtM?6~UZyT@VzE+9=4 zxvvk31HGOoUGzNtEv;6(VpLYUSc0Lti4@quiLb6j_twa8lRrvWJ}D4bTWl;u;ntS; z&9{dpwz`I>fu0`W+FPAm{*$2#sR4gpd*dDtxL=F+FIq!rEs=occ zP7oJp(((+6*k(9lWiLh2eud+6ZZwa**B|ds|F~AF{UfZL57CB7`NBP!<~-=(7NGnh zX{Pw?fu{Jfde20w82Kx&cQawr`!824DT6|&>nB&+)I)4H zf3xW6JW`Zn?r}EdGF53iQ-~EpCdR8&2X+|P(*8Gx0jMCbet6rBvur-$gZ90C^p%aU z^`~e-34>!NZ9YB{ms-Y0Popj%BpH_gbnOkc!g)CG+T3N?q=Ipg=KQbYsp7D>N$i=h zQk4qqNbJ#vjoS&c)o~mjcMiI|u4!Zhi>Xm8ad>J#YW+7W^2FMg^Tg zlQr^PyEV$)xz8>+r_P~oZoge}C{bnh{Iw-fgThad^sgU1_|_g1lkM$5yViVtk8a5( zKGELN5hEp^qeU97!Fe z9Ye3wM$G$o{RV?BkSC;fd>*DKTP00Cs)x(T9`4yRz53fU&Gp+fZO!{mZ-;XWh1UCH z+G-%RrF=aw8HP#>7TyS7Vc~<2&FY{|4Er121|6GfS};`ga+e2<70RN{7w<_);9pTR zsMM$^iZ4lb*572OsLKTfS3cpH!8%IX8_FG#-nfGVjb9%sm&y z`lJAzn9cdQ2YX#Y>XEJClHE5y7dl(E;R3-tE-v6TCgS=uSdXVRZ$>9>6Fa^cwcuX9 zl%aTu_#rbvBUO)~5;Wd-w&>vObT;G4$)Dbm{o03QM`+wZSpcr=OVea2s@+B8W6y_{ z8#05MCuLO%8E~Z+h5+WLz`AZYpr8Yb2TB`CD(}|%_U@g0aS27tO(x?!X`F|>?8$0E zooRh9Pn0cR?)7CTMS0Us#3r)FGVd}#_AyIC-*&34>#}&u7 z;`&bgx}X`O-pjd%hantz3W}S)tEZbVo)I(%ej(W7`}MZ7#}3_6?(jtj1O1}W#dZAg z#Td(299Ht=yx#+{6cB@sW7mc+hN~)xWJC(??MR&+Qup3_8PWC<#<4^+yQS83x2y+F zY$g|x%9AXz5U2viqI$W|#Q(^z zZR9b?-B$?Sp+h@wF5@+4=XF|QE;=r6EpmVP#?nvt*tr#RprQ#2Hw3f9qJ3f#Uj13{ z6UYf`_-=(c?&^#WK+C`-hO&8V2f_u@4e$A_-NugVTTd={bwQBf}oP4T0Ihf za;2W``$Fo=f6J!wQ_Eb~1cw8^5qvO$)s1W8Nhhu4&BR{$T zkE`$P$y>;emK`Z`I3;!G8%hki2B$h>iS;_ui2+UsSOY@~jO~$|dEDloAUa_7asqcV z#tUXJly!@gciwAY(hK&d57t%iX&c}!tn+c-CZ0THLAov+ZkFyzXz1}K-FiEjjy~v> z;KWJNYs#B{iI)vR?Tyydz1>QC?TV_^q#<`>KRVzkv;6{d$emUIg*LxdW}y0R_JWtX zywL{1n{V>hlz@6R12G$wWv-qG|=dQLI8TitJ+yXUY|ulRIpW!!4b$Zh&3{F z)H{Z&4eLk(#%e`$vlysD@}pa&UegD4y%7;S)vH<$4oW&0rns7%Ux)8>c+#pj7d!oI zKqTpcI&OGc@p_#c@Pxfl6986MGtNw${XwrC>}O~RVyqpd)`24SX&{0G0hglkG11fjhFX01 zNKA6yh#<0-h4?XIUJ|hg34pAl;|chwun ze8#Sm%;w+q07JH2RTJKBj4}SNroMU4*jWlNvMZ9}T0Q!AB|I6y43)NiVSKOIG?SqJ zu&u4Iu4g~KJ^!Gg0VCA;F@-?EqAit{^SsjsKN#zga8^~`4*H$9Eerb9Lmx6FcxNLR zF$G=8I7a|#;O8QbV{dpPR)+B_dt+_HW)f{B@o>Tg?(MJ#MH@+}u(K4X8Qnz>*3{m4 z(5U59Q}1}9NP7){P&^xe%WyK|shP?etJZZ;DbUrbQPisNH_&`1o7U2P5}3n0_8L)> zJK@a4{ImUvKN&{o6C#-|)F$MQ1M}j%83DN%f3q+wn)@#`4GvZ~(d1#*n|Qn8Y>j#;P5u2LjJRz`XP~3Onox0h^KGPAKm}D9 z-PMm`%-H>a&wLWB3ONdB`RojSe58}&es^!tStMg&3og`(&g~b_hPzWe#9ZIMjIh0LRM+exOcT$PPs z!w*B*WUuoqQqt5-ci#l{UXt)rDaS|Rms(c0kf8F%5Lp8D@u+m@vr1DUo;k7>d)~09 z{+zON09h|8E&FxmFdn`yf1p;FRPw@@cN3Pn-V4g$C=_58IP`vV-S2I@h z7nT%eptcB?TMv&*&V7RE4u>!TLwm1kEbRO1o~59Bg@)##fts!gVF&UR3dq=M?l{L_ zMI=%&nn#D4TQy`?Bx~WN?4`F6DhGSbo}HClB=6R_nm2!vaow{=9Z^IYOn-{X1#tn= z#keo=#`)W*C`*>Q9lS`#0}DSV@VP^8^-`b#p2fH(AdmdcU)7b9M*rGG?Z7rs_5WfM z?V!~1p>)fHxNlCjfaG-)BFI`206i5PSB2;f$=2Pu2FdJPYkCY{ zIia0Z_g|Kll{Y<(I;-&ChnCvPV>r-F*Bh_4jNjsNzrcTdxU7>9>Rhuw^yB*YZaNy! z1RLeZCKzQ2?o((UUy}*fub))#q~2?)Yb>@pO&{~?GwV(B?uU)vZ;uHu$==y2$nk`@ z^QC%i$2Z=Vg3PV?+QUL%nkbRnrMbV#PJBeEJ!A`4gvjr&qFzjL16Kl$RKcofv23LUkE>t~JO*;6a;vXlwK zmSXm}|CXXDJFONg$t^GL?GJtlQIzE|f+yIuIM*;5T%K1cN}ART=9C1A&J>k2niX=j#ZQ7Ea!<%O{iU#_ZW}Pl(Ao7EW8Mg!_B}RE+XZ zhKz#!L6wAVR&Sq30Ux3rzA{9?Q9?#X7HW-LUQoI-r>v0kxR;Y`EtUY8oi#z~nhst*UA=t7_pkr zbh)hNNvwx5WyOebB)DaGoHB-(WFkmH;v@eEJHXbCrAVVwx&jc+_@2(j@!mIGn!Fpc zn>SC{^uthp{Ih)V&;Hq~9I&QRFdg-!fV}dgT{$;YAmx@*j}4S|a=fnVaT6 zmf0U*%j`PXGAsIQnQcuI9QXJlZa^oOg;y@M4z!>k;(+E=c&%6lkbRdLYNk);O60qW zB#1RL?qe7_if`NR&{bkX>-#CX8B>V#y9N&7Fm-k`@C1C!q3vhB6AL!5Z;pTOQkK9P ze@9D<*^MJVp1^r9OT1fvFeKPd;quL1W^$^RaGlXqroLGwE{AzCntsZ0A$nM={DVvp z%3(ZaI|#%#DVBI@`H5Vv&t!)?gnsKMo!d)rjkj&UI{W)za>$xj>J`SN<`iz*s*1>?kT219~QC+b$U&J;)sd}lvtlknV7nwpdJXk^urDD? z)&<>BdC!qhi$eTFmbx^kFdQv1SEIzFqx)VXc6_O(syEtANgWzNf%+L~ahLsy)lo*) zcsnAtbCJX^U?96T8u*ZjN&u3ydPPKqk~%Jqf`5$>ktzY(J}J!fO-BNa3u7vENrad{5j^?o%lHQn}9d!H>@C;MGcjTa6tmoYBS%t;kkDe`bGJ_|!Yq3B!%l1!b$m3QV+oU@U zQsH*R#=TfGDosy zOZ;f-5tKO6VS(BQ_D#xb^VMh^?b}pdV@r?}DX>$eJ9naSvAdg(6 z!paz0=Y8&t%pgNjUY+l6#jdHPAGJ}Kh0tTOI*Vo}6Z0{jneD7o1^SskSPK>nAB2$k`|;E!em z-;uUT7w<>nfly^idh>N23;wDj)+!(FM5~JY-ya%P`KXrSsTquO>S+nz+UE#t3PVN2 zVrrEFcjU{sV+rS?Rg|-yh=s)Gf*ypyCg-ioeRqzA>b3oY)sD|6E4tufPORkY>v?>1 zio->4F-JDR_(aqlW>QVR+DH%?I{nR0i*E8kX%*t{*Ls(Mhr1l}-_DX-bKw7@`6^rp zpOrP=2a2z?&Iy0wXkX)3&=A+)RxtV6*c5U~RSK^~#2lwO@DKvYBcosVdivcW+i}bo z0v2fFDqn29%Bzr$WTnT~c3Evb;`U?!k8ey-BI9z{FYoR5(lq#N&C#>`#RpdpQ*JpT z_>?hsKB-^NeiE>xWZJG*Ze0V94OYb?iRU9lLX4cyH`b=U@;MD~*yrS4Zm$f-!w1=KTC8m0_m{qk5GT1;xGWn^u)uE-Me*QXw` z+YA20h9|ct*jNjAvXPx(C^sQ)?PTL0IBZ`bTMUBmX35BYmwgn)oBNYe!0u^q*~j}p z6ho+SgiV598;Rze&o;0OVkLk1VaB$BsLqRQ5z5!&gk*{1Tci5`9k;F*%2EJGAVsKV z!@)wIg~e$x^gza2Jm(lYa^)40{Z#94f)3 z8~eoM@^N*`pHowaHi7WxY$c8=dLY+rC;5ISrkyb|=MTxaI8j*zr+0^MoS};q#f>wT zCmRcAdSwYQM5^ZS0w`XM#z|0tly(=L#j;XFb3Rfh6=8i657!A%ADTGj%pG#Xaz6I8 zpeU=H)RhOc@HrAoqq-*us#n|qy0!!TJ>xC z2BBlQ9oJaXl(FtB0)Ncx7Jprkzut_l^Hr7jrQa?biHlE{@@Zr88X;LaAR}W7@@ye` z?QM(Cmfm<`VuaXkUVdl+EnNPfqu6nStgL)YLa<xFFrquMe@D^YF@+z4mCQ6VR}c z5=d0BFm0nSOd-c-HGrZEJPt^`uzzsPk7N98`}lj(6&0G>`W=!VqjkPq>=3b`sIqYH zAK~K3`>Lt0tylY!>db||73xPG30ce=zV%nFpn)qxn7GeAQp9J$$M)}_QXZAHd#5p% zm3JlF_wu3o%}0Ml;wr_wV^XI`#06RvLK($*n|X`PJk? zE)j(zHPkK+V~L=vrQ8j%RyoMN>Rxe_BKV|GqohKV2ahgQGfa%d+gzzVa12ITsgded zv4sQVuJCw3u{&4>QQU}22C`B!N*ckNyk^sk=L{QqNl}miX&+8gk#M0pp5dL$)LW+P zA%QanuBtX%blXrpbS!PuAs>_NQ&)Rkjf1Sk;D}kcy{M#Q-+^=d1 z(1=NITo&KSjbEbdYLm+oKw3b51q3Ri%f~Pw$pUOQ$Vq^_2|@{g z7>|YrqhB88-UIN@!8ZYrF5om^ku{q4e>Jl=Lihnc`r)_$0}XT}a8B$0td-q4-lr;> z`Y8Ld*qqXXPV8#9voT#7<{@zjhpeK-%<<$Md3chiq0Co5(=RWK<5X&1G1iyXkg4mj zsIe!`FoKG?2e6ig%@CRkjDA>ZB$`%f>sJk(x&cO&=y>3!;dT<50LaLH@8>X5K~+xR zvUCNU{Ug3WDWUB`OliZZddC9_=R67ChZaZgp?KU&CDyvI-N*$|ml+!)!L<37L3KA= zEPpeee51NhrQSO($}evTZ?$k?>oOFpJi z++ek!zE`4ig=4)CVGcM7qtT)v75MtIcdIU_(>2zrTyujJD`;P!a$n5?!d3_bfRG4U zg+#M0)6{D}u27@NjHUnCv{h61e@$C`fN%mPwNWje3s?7`!PS6%wa!>{Bhq5OQ6ZD3 zMqAJ{B!vUlg{*73Vn*TIOw-NTh~kF~I&V_7bw$O{XuAi`r8iL4?>Vt60T)C5})U}(WsVY3xh%HtTcdgEiw$_wOg3BOA z7!uHO$H`8>|7Wn4<^S2ME&biAy{dwkBEyDftG-d|P>~2*?jkR^oIrAoJj^IATi>sM zkm+o)@@>g-1u+)DX0N~yol=&p?Cf|Y=tMe9~`)vio_KijMmCdA&_l z1AJcBdh4CToX)airb{(43#&mDa>IrOjHjcpf)bEBwRK3TEAYtjXw;7o#^gx&mDEdQ z++P%??xA#5cp%?g`%Z1GaRu)JlV#GPqoT8xWjh(S9&m-36>u0{gxh-qIx^jPASGxt0Lr~gE(Vd!c=%W zBsn=}RPE^l%!?{*Iq)pHspX+S+-SSa)ZDkxr3&;-=s^l#NVp$I7}ka?g<#L?>WIcWje>tZMt`34RFe(>2%n<;ey5a+}*;nO=80-x0*g9rpGih z8HrM3(t-piXM%I7y?|0MIwfL|!t2c5mWg^>OCUNE9IP72M8kxPUkA$i5k!E+aWq(f zJ`3#~ThshDkgT>A(Z0fZ z!qYW94#$Pe%Dc5bZmlnt#~)D+3JPxJU&3V0{WMZH{Gx=|c!w%X*h8(J#JqH!Vr{#i zXDR$XC>){YDsB~pZ;9ymvd(rpVxiF~g=?J2%|7i!fCY|TqnxOd3kDwBaDmn8=oLe^ zpv)lws`?lw!GkYstZr0f*O9pP5^N>4#E!$c?{gKH8V6}HH)n2g16%@|`Z`{(cv}Ki z1YiTrY^cN%y1!)r41sRqXI~vYnu=U39io}eC4C0V0KPuU0E8;l7u>(Ib64ptm0M7l zG0(UCD&Uy0imMG-YjcV>fxQLP+D^iN^i%{qJmu5q_x*!#w2M<62Tr*s1x(N2Ap5jS^ zc6mL!_KH31zZ3%JLS}Q5PuKMiVF{SZ04o9t0c83ifF24@hy`i08O_yAzrSl`C6ALo zNM^cn34B37AtyQ?*V~q4FS-;z3-}Nn##JY_v33Z{BZS=s_D)C4A>+cal{R=sdW`|0 zC$NN2v_Y={eN`B4!t@fgEtS@uLH6j2gMNA#m?eH|3zt!r^dcz$g$tb;2y;ZhhFAiu zF_4JiZ*qA?6e0NS09GADGGKWc4hG=i1qT`uY>!V2<)}!gL*g`nHnp1f+EC}Em9|{_T2N1@CN`Zd$L%{qn zmv~SeX?A2arbP>oR7B$gLQqg1Ydn?Esv#i1&;Yf9DAvFMCHUw1LMTaq6Fw3tfG>;^ z1waab8-XMIsONydHM%i?UI9l02n(Y600KAY=)lZd6eOUp0xlkMNgnuBfkIhxBZLmF z9G3!wBIqr^`)EWVKoSd88Tp2HsYYN>mtn4@y&o9!LcjuwNRi+v{kLEr(9!PliKbee zW|TDaFCJ1n6e<{tSFZR^dg>r|B6~&vks3H@2o8Xp42c9n;Qy^-{8Fj;zc`2~r7s;4 zD=eN^H2R6a4&rU)udW&Y6GdZf#EDe`plBM2Lf0DAU;r}2o7{C)H^4qPrTcacg52YA z)^i^huoGpwRaGz=er+@#Yp9FE%ExHPViDa+wdjNE5uBpgVZtS+@%+(D)3N@4Hie9W z=5s5o*fDS?V?@yu4j6SI;-PQ+?_`m;hW=)e{}-~zoS^@!5#;}9AbW!g^@J6lZHocF zOGIK+ghdD7&`6tlg8A&=oCO$(LM9{*Gdx+!@V?ba^?p|1Iv;x1hQ}{ML@5&H@)!c) zjVSo9YW8%^SCzlC#4J`^Y4bmk)DK;fw*vuW zP-ws4xl9R0`P}r)fhQ<5X~?B?K&cu0RjH^0ne0#Rc;mnIj;|cW&!B=T?Q7Xu#pjc` zh?lp3r+qjgD2Dn%z&0F>2(X(%RRT4+xRzrzabfoH5j7%`H+xe=>x+!!xL)m@#LTd= zqw{CpxQ3SzvKNw95VDspg%k7@GaDmk-Lu*)OK~#9FZ!`Ijg%AR3km$vdQ1zWd45%? z0>7#($KQ*AUsbgJysG&Ac~!aT9V{LB^QiI~{HOxz2S2KieX#iFRfX~Qs|w=ttIEL6 zFr=GMjdqmr51`)%i5xQZ6ObT_%8D?Z$XfJBXUw|+oP0#21HO}>mO#t_g^}QBq$(+D z5-Q7AQ2Up*v|k4j0p9wqzym4j349HorI0SlAs+DE0nq?Ze~F3@xfony_Y$0hhy02M zs4JneKrY?@dP&H35HrAF5;AAaEic*%1b_g*;sNDl=p7KcK$ACmE2M`rVAKcxz2Sx+ zNdigqC^NvCIw}zm&VYgh@fBF{MaP3PC~^YX2`vFnzUcU%rN!z&7)L1M0fnb;*@_P~ zSMjC!I-C+w@(ZLius+@=vSW?~)sIqt%!niW&t^nbuo2e=lPf)U%Ap1eOt7 z9twZUh(ll*u}1q5<8L(LJY&gk8gWGz$Pz-qMr^a;`%^*$PBoA@sb2Ey6}TBFm2s&< zE2g{&J@4J|oPM`o?gJhn@sAucSC8tA?(zWMbR;S)ybg?sF>noM^5B{nEQmz7GepdX z4sfJHB>?huk#K;KTO@3lXOu7=_@Rrm2z1{e`Lh}*dI|@*W~4Q7hbT1KSAPvvU5lyw zplC_UJk>H8N9H*ibuN``I3Jyh`_uf!Kvxbh_=3U?xNRbfgMR~?Hjzz1Bq{t)%gr}e zTZaEvWE5C47$&W38A3JGYGM3tt0KG*P3 zT!Z?3u8}SE((RDM)VVs*cu%AGUHSv^uMdd{=uRz(@?<}^FpkaJ9FzB=P#}mFQ2YY^RQ8lr`|7Pu{jpCv*4z% zt*{d$(OrF&-#!OkS2K_kL6qUkTq^ZC{wFOqB>QHK4LU zmgoV)St!1kDvW4{gR_SkccpZH3!VbU4X6}QE^pFFjHlk7>gM*+(zk{IZ z_<@N0fJhnwCh)Tn6&fNO*aUyi_eZ)@3yL6I-6CG7!)8u`(k2y3Fgi~j4Y6kk{a)nu z`c8r-O?hL*TEDLP?C9-FJxwtOi{2=}HWGa3(EkL7{PMJv+UqMu4qmt1dqDg2r3g^d zglY=eKn%pBBhUj8QK(4Zb$v%J3NczjN@y#_b~nX%3SoaCb5(FAJfE--O0 znn0&^5KObDEq)T4bEmSMA~?g7Sdeqa5G@W-{VZg_39#m&U_uN6MA4|!5Vn9_9ttsG zx5fkYr+{($y~;IK0S%aCUpUez(>Qtsz|m(E@QX&Jgw#X;hVoGG(L|dD%ii{{U1gU# zLg`@ST<`&-(WpG22clX<5GEe3+rT{m>CS8a;eMr^Ds+3BIMadlpvGr``p>0P)?Z7f zlFTKNfm%L$Q9aK)i>A90KdX|)8&q?`oOR1+bz?qPLsWX`|SO%E?A0^ z*GXnEPTS_fu8XHwPUtm|%-FB~*8B8!G+iTWs?7PX@?8#YI z1%1rrC7|i#$mdbr64T{04Q#9`rNiTzZoTv2U?+7;Ce%k~O0m*Yl}wos)QOX~iZw_o zX-+<0#+7X-k^RP{o@??gJbrow%9*#^(?oBwEfVL(X1A;tXJrLJqL%B;gkGOzj8-F= z0j^ve){Fj1Gu&aCZ_0u*l#~fEO}0PpOQCH8xejEo1PRBW5_UgB2_~k` zd1=-rS!d8U86KdV6PXH>ADD*zdAF(Get6GJH{Grz&ffK#@3sOr^_}?%(QFz{y29*A z(oWTbm%Fnf)=JpMh2sd z*UC>aIi-98Pdd^r-AEx2Ub=^HPFdKu70(GfensET@{RGk5){y}@!6ZPNzM&$!me*; zvLvFShGZM(7I*o*rr9{^H9^8sRHk6?ZB7CgT*7^`%IebeAxxh0 zc6%CZkeg2S;!$|-IH<5jzo1OX*W~J;M2ODOg%x53ukwv~`N^*l;)GyjL+e{tahWUU zfuHbNPSd!R3yv~*#W8Q%3`&uG5kY0D-{f^&#%a*q3&{b~c=H9eE1|mUklmkW-5RiL z#JVwvxWx*>G|;uCO8ax5+fVH-TCa0B(vwEQqI&aRzlSqBgxHH8gBaBNBqnCxL3F!) zAFisP=<3T*&kIXc2o!i4*Bb9SISHDw=}GMQ&Z2)#x)yi(ZbVC_eK7u1>{jPGnmLyn zX1ipH!N>?c=5pD5hsi~sz{Mo8HPRdYR7_tR*k&6vr=hZ~Ewg6@q7R*?KZFjp-Yt=& zH?67l64ZV3r7UAqV>HC^^Stj^d9>{NzAe$W^5WUW;TdwdA*CK_B>GWrF|V$BpgAbq z71$B*(lFw$YG6#TiC@$BKX4b>3U1CJz%-{I4ywH>l584gx;2Ur{E>}PyA$Xra4YOk z`MQ7Bi*7|jLVIFE$9B<_+e6$kZ5GYzGZe1Gz+5|b4P!_2R7vo3_l>KaV)Gp{obzhk|dUCd{(1bnm*< z7oHlbYFJtRz46On4dl7>X7TPT7U#JMh~%>#*(XA^Q3!_ha5^DmFFYj#BH`?0l)M56 zDlARwIXA;5!CvviIwp~K1^5e%1;sAYG{KaI@%s$IgJ%h6;GQs4TtKA&8=ZTQ{Z(Z2 z%f}a2PD$tN_&in-E+328PSJ4@q|C{5X!_tX<`UDKK36Sin+>F-68d`_k;q;}N&|+8 z$XJkzmVjF#va-a&czbkvs3|!SqDQZ~1#ERoKH^{l9M%x=q<%-#4CdpDmMPn)8Bof89^K#+x=bnWewB( zqjlb_uGkNS)fv4On=4aR{4bM{P5am1=E~~bbO0gxSLEQu0kJhQo!0gt%v!5Zvay+R zTrbT;%7;XAep8@;8XCh+GX$O+vZ>nVI{z&OPLZ;H9cu@f5iNX>82Uet-g~&quOlq#Nl!33B|>v=3f8K3#=aSM=!Ng;pV}o;x9EP?o733$ z&JccWvu{GU1~9fkrlZpQFT1!KggAhoBnX%w7Pne)Xx}i#73HY60}n>`ZkYIfCbYC%{@>JdZ~yyxZi#=a=eGL)x}Ll8k9uy=>i^?< zZorK771KXi$?ahEtNMSslH2NkSIG_Fpu^KZ{`dN~35fnyzPf9<=aSk>u`X= zCJGLEhK-A&0O9tsHq`80%2{zqMGSC+fl3PUMPA6~6!LOW9GqxP#h7%ZSQ)V-^`fqL z+@G6|J~1^FIqrirjFn%R;M9XE=YLgxnM869iy}|@RFPS1h2G=s4puxaP1~}R-$!}D zNxYCp&3yNC>~5tMS&%H$^a&*G zNV{_my-mDVqQn?8t_0=b($m&qk-xm&&lD-8wmKg$FWtlO@{yIB^u+zrhK3z}kFW@e zh{H^Z;dR8w9p!xF4k#4u(1hH3zCAVJ)?T|PI+gChV7I}9U@3CPFg0xj>DmnIBaa$^ zFl(mQ)yE!r`M9>~5E{`SWV=2%&qI)gsfGN`$|}7Rh40IrPB@*w)uZn3dz{-W7l{^h zLy0t;?~UH@o$(|zGO`v?ZjFL=yLZRBN|PJpZ4UnQ z-sG>;6qNYoC|cN}seH*^5x3%F`ylvK15WlWmB&t7Z0RP0z{$Rt{8k3Yg^gwdc>~v? z7K4Z&98JBoYxcIl5>0hbGipV%|5%F`89+)?1n-`yWis_V~Bs>KqQwe$loYR7I^ zO|I~X`|)^bf)@>jTS37hzL^gv;jJoK3ZrI)eFZ`;EcabQ(M7R`Q|~#9xS=dKj9THK zwhmLT&K8za=}n?|%f*qHG=m9#mEDl#mI}EhNJMHAzHY`$T6#lSJrTtW4X22?_6;rU zgPZwK9$G|BBz1060xxAGLrN}}^?VKAlsZO=Z@k1A@kV?xQ#FW7+Gil%#kYt}-l>F6 zy>z#cF8%A#T)Y+m87EcHlN)_0_vR#}T2gHPts}nrNRg_W;-iCAAkR-3v}JyRUML|V z%7f$5vfS=j_#4Nsn$ewE+3~$bUv?V`Gu*tZgIt3$1tSnOza}D+s(G9kBM7Nbm;`0;Ttgd`P9 zN-}f7dYXzSE!Nb>wOCT-=S#MlinA=a)PRQ)5RSKeHpE{bO>4*wnmgmlfNIA?4}8erHxa@0sN}5`QcxsqD;wf_Xz+U)!5SXwV6Vi@G(h3o#0#~a3dfNT|h8p0g!RANZluaNZD{IOZZwnY1YKJca z{A#cX0JB_hL~zgUf|l`8lhH+4zXvI=v14uH^=H_q%@5$_>$^G&d_|BmV8zBjEO@z$;5dY$X)frxwjq_OkhtOw>jn?PP9pH$=8CTU9)>lSI&r+@as z-;qn5{zA*op*hC!7!~shnob#N8mgNV3R_x?`f>N`v_^r5H2HW#VJz-0MT3ozRSVV8 znBrZ8*FMKSg%|kjM{zZ|-ll5k@6FewgCkB*doMM95R5fk86h<~nV8+)36(phhtar` zLziA;w2ZRAEN1b@6W%nO+~0Lc8Lp0fyXOzM@!!hjp9}yfT2N>~+uUh>?R%Fub)CT^ z%zC{NqXbS{-b+*6hRTbamdvz%WjhikPdGnrBvdEA7=HdX*L4}f&sM9t`|^k@5-$kp z;|o{}XkWoK+fp+r+~o;r7!#-*ZX+OO<<0Ge!~*QOs)RuRc|Srj>Yj7dkyrrT=7HX1D((su+!~M^l9uAZ$e;#G3ga zY1c`V5+CFh6EH`SwRqq-P5=P%ttdoqHl(HU_N!g^D4Y_r8BuQ{Fu!xK{&11BGkamI z5&vrRj0eMt!=D?&$`=FvOQ7{R`~zPiQI4eANT1`FhYgUfi$DN+`LT{;UV|tQp4%x4 zb28OviHWP0PCrMQ>9t>YEsnPYIL20RDeVi6v8f&%3VwGZS?iWv_HTPYLTPuZmnIco zOn*JP$?7VR@>h~=T^b430#$|eB? zj!$g(Usz>(LbYXWH|ptlx?ML@UJLac?3AhcC!JFvNc9D{uyOs`o}0+IN;Zgg2G={ z)+14ek86}4w(n z7eiqNp@CewtS5XI4E9Z0G=}keh;pK7%@0)O2UJYHE{`FtSt|t11fwZ{G^h2a6IHtn z&~DP*5H|U3x}kAV!Qp~|5o9`}iUl)^=SoE<+_6Fg(4+RpWxJZi)+1^k=K;M=Itn`$ zW74-TBQawd&TQ_3M#PoJo&Bxf4LG5#b~rQd4i8I{yH2S|smBMtvV2W`y_A=iFC%YO z$Rquw#LTM1T`e1<3PC%mM_02+|9T$QfwzQhRxXe%xejb1J zE=+D%F{QfsmQxp=HJR})TgaxisL>8=010Xs4l$ zxx`*&$~)8SQ-Us0y$~s`O!eyVq=#DSPw!qp-P^;kgP{?MdVrv_8 z;(b9ae=V;85Vv6C0cyU;%y_bJ7M40ZYx=z(uM!~x&-7669%=NSHdYIOR9|E~(TOdz zDfk)n1)ZEIZgzSjNz-!wnFt~2F@Ybox1`VrRb(G5I7|YqRI{$SDIkR;A#xXlV1!T8 zt{3r<@#tUvJkW3j=321*L1T|N$c)3uY2hyeopTl)MNU5~t6@@MFuOXG1*%6Xm}9@l zVanL*fghH7)rE*Lutv}1Yw?*_?q1eMTq|<74Wqcws(>1YMuf6By_xaE+G8uZf9Oo( z`ol76Mvlp-Z7VqU#;B~J#(x#It;1Ly> zOqD0n-i7HK|H@j*Af8+-*`*5*SaI39S`w}E${!-~hXvTmk!3-O1pJ8-^2A>jaT3XbhX-!dn_rV#uj#0UE%m*ZwodebcB%Hs@Ev(z73bV)GXC<_`>3zrzU+?D zNYm~kB0(4$bq)$UP{&s9? zWb&X>C<95E$A!w2FFt+1=L%#|K&S&76M!W|Btm`)Ov@2?Jz*nnrDdwN46qR*Vz7I7 zuOp~kWwGij$vYBD1ln{aFY;U&r|YA+8xec@JTy9?f7emorM|>)auU%)NU7sI&gJ=0t_u zK==X-KE!)~?JKe`^a4EL5dfhIj}ML;5vsyd0;gY*rC`GQ=6MAGLt!|2r2G!jdxL4n zG>J)M*+JlE7x>Qru!g1iF zEi%MCSGD%BmUcNp{8Ugkeor~|z)DH)%9Re0u!M#26?}y_w>-yqP2)DTn!7}D&zIi^ zv&+lY<&4qvV#ihS=?)@2wXWebJhQ>-Q9{eh+>787TF~qdmEKNAu%+P-$V+HB)Z z>*!0Ihy2&S6iWwK<+fq3y$eV&iNnTV9Fg;HJV*%8Mx^t@z7qa zY!|BIZIU@iZHev#u-X^-Q5kfmB% zRJ>K{%+eo)<9B7YOS)_%jD9DKD*5OnHfA-mUcyddHFLxDN{5&o>hb1!aD^c8r=;rc zsaT<$d=FYvfrBNN?yCLpiX6n!?B#rhdv*U7tzg!rWXeqrN zBd-E2>F-fVBu$^=v5NOp!0+}OwS9!K9V@wv6U`cE;YV)1P;c!${j(Z5rf;?Le-fRU z%V)bMZVW&Y2r*k2GGz>t`&NtX*33urb6D!#y9~}knbI*LN^(gnHOIG5C+~q{0Wu-JDkB~k6N4iIA)E_T@fW1?| zcM85wWcv8E+D!KQzCLlg0ehT8ql^QShz4O;Ew$N7QnQ$iT}g8VLWxQI+w}kou>j~# z)zBvu4G2zbqjIXfRD5RVTzR=<%Ib9bK}308JnT2QwIf9>?u4`=9|@7IO9vVFcOuFs z$~Kuoa@Sii79xBWKst7-NV* zx+(%P(*%AkG{OyYLes7dUAJ495;Wk5e|Gj*XbIW*fv=i3uT^*JOOCcWi&+Y}KHfbL z+(t5v*>w74Z4U8`))bYTy5IYPW5{pw`V$7&y#70Rt@%t|EBr}bD}u>u{(mH|FQFdi{vfXneZS0J(9-LH zK1g}qPrZg=jP#q@!KlX$dt<%U=M3{L=rLnP@JpAcV1A@085LaYJ*XT>0ZC!VM4(#k_S-;6x*oS< zTt@Q?c!TupJ>Isu*$I6vERAemcH#bd&8QQ{B7-jx#gf(@-68jpwjO?7nfWuhHa1}^ zzc>9M;7z}xetyHKK+6lMKR5k+E8ad`NxwJ!mQbj^%>nmFrW6C%N~$$!kEpbe^sht$TXz)miZBDT9S@ToN=bMTnoP`f>jK) z*!$^U{9b(xO6x(?kv0R#w6B1sT9Bshnm%+u2afap{*OERFa)#oPKC)o4}`RYi93dCcV)kQ&L~mA1J^;Nx8IW2uMSBM z9c3<>}67JGPND8=p~!eeFek=<8Ha zFf4z6=r1=PeGw8n>U-xVQkHj-)={i+A2qi~kaYE&WZEX)aO%HEKkC7&C~^(|VGVLu z@S71dE!Z*44-tC2kJvpOeY#ctrR5~{;rMbJipEc4XnTYl34lx5Pet<^x3wtV zkzmZi_`*upH1jT1F-mzgefOBlOUf20&c})yjYrn4%B+iN&aqR?x8stwF3C;L6YXKR z3$JKv;wmVS1!)Ism5B#0g5Jy3BO8>_T=FKr^|8R*tUcHyfnd|nsD_Xno$D6@NpIQn z?Zhzpeb%p26kBE9oN7=(B-fv}6FLsYz4AtHdPjpT8ZU}r6%Ega70}Mu?^(;PcabCU4P&k9np!@A%HX;Y>qfs8$}Nfa z@C{_uouqy*nK$5&sXr8&iyLl=SP&Qz9EHt|jw{@*bQhB_J~RqNcai|MAF?@uSHHt1 zss<@YbQpK_>P~Pf))!e*^~f9eE6>3sDGg}DEJ!LUys@ z?uxXbU1h$-el;0TN@tpEo)@7a};>MK)?a5WN{b- z)xMfRFeJpFtNSfv+wpkR5(un>n{mKR>%Yz&jYlQ-gv=+Ob9^SUQ)!pPcL%Za6!^+k zI)jNTzEFYUtKZX}U+Zcdt%ms1LGtJk=!~dp!P_kq)XMvyo_D=}(T}UKA0fsyQ|KfYxoZ#$28AU?rF-=oXhv zqj`>e9NQOYG$uLPKJ5$G>Np-whxJ@#dlc&RJD|>Dk}7?0?J8_3FU7s1ZQxgz(6_uG zn%8%buVwUO8Mx!lVd$zi!}EKN_37SO{6wOg&5FWw*e&b>+c;KhpK+0@v7SSx__ zVScVm+^5HO2ISJ_nO%E0S?fDrtGLp2xm!UF)uoUOf`Znksf58p^fhRZw|_r`SFd!n z)=vFM`+$Fvxt-uDGEguTzv+clqHV>H3=27mkO#97emxc0!`Rrv~ zq&QYzf%;{dWdBD#F6aAoH}c2y^iW3~d;TlXW9vwZhzyv1+>5}=lUB+fiur8s3cq3so*=7xvwi|KVxl{@v3yvi$97%Y!}bIay?Yat4JA^cR}VruGM#Z4?&!AEMcN{|?Ot zbgzD++0SNn@seK6%IA_xM7jJF4L8+^v?Fv&SNHGU4|86hz+`q7@7F)cY?x;<+YwA= zr#bY~*|jxL8P@8ms9MUTQZZ6?&vBw-D7q?Qbw!R1oxi5-F_HD5dm;bTC!dpJ2A=1Q^Ul(o0J)vad`bk$PD% z!>dmO2D8zUp22K&Coq_e>G%hjJ^FVrdr9>f%>L8Mwqf|Ym+fg5g7Uusvz7kQ#3tJK z%fwcw9qzB?o8zWg;5jl||JH`oiji_&Jh^*IfFV}9a(q-?AuNd2ujqF_3TpN=fH`?S z+o^&ZZ9;Kuo)`9l^YP>t^CmKr_SVhU)@T=S&3;Um)b{ndZLu21;vtmWk#{BR{;0Df zwB5=C!aWv1LTHMWst{`SM2b81znoO6-hdgG{Nh)CJ9N)0G~RoX*hC%?+`dwH-~f%p zHbqia%2&97lYn?ExagPNo2_ss6VfWoo8Disi^B@*IDaUN+9PlKf_eQ>&wNA7OTqT+ zNcJC&cFbQ0F~MAWvb8_mkE(ni0RfQBI*2E6JneV;A%@fpLosvIo?NAfpMQ=J-goj~ zy7J3+rXt@jrotXWNNRU|xo-ZZzc-+i-SG2{i-8zvVrE3@sJy((Q)m(P+|O@+*+B{J zM%E1merUBd;z8R3rQz!wO>;tjP7QzSo#78YR@cxSb2ZPY%&(k7wBwz;-Jm--)+Q|z zL~b4o2iy_9A8(%8Zniu{AF@KxJ$-vutNo0|siQzQSG`y6>ciAEocXM6mSD!(#xZzQNKr zp5{L%eU}LSA$db$Rd?&04<~$?cZ9@Ms z@(p}oMPzynhP~&a{|0;Wm$P$Z9&)K`jl3x|x=cDkbg0fhf!oP5u>BkKT_GcN;0K1j zC4n$2WN~K1sIppV*SDmimGyznH5FjuTk$_3z5#tzIC9WG&v?If{P&FaZ^hf_FU7ly z#XbrZta!(P{z36hd{(?U|55Sg+X5@zRpY-EZ{`03#{149=Kp_+cMCcB*vbm&Dv#x_ z_gBMn7+#?%rPOP!0>-Rm(jXUNxA3E-frsSJfUp%jCg^Jw75R>=*-f;KoXQd0dR@-g ziT4jHMCfh*T9q?`N`2BNB2jP@;XhS>FQb*@)f ziw@I`L(so&J$zICnBg6G<{jD?xojYf^#+HF%AR(gRCtoA+EoN9L@Xumune}0Yj;^# z=kg50?FFn`0~#!o2~eUAM*>*dBBPU2B50e6ULpwid>YeVnz{TWbZCsea@UUp6W&Iu z@d0OF04a9J(x4xS zuLKF?+OyxkdBWH8?jg9!*}qEq*fvynD7=Co(~P5t;~^81v=v&-S1;|`S?T{(xDvFh zGmNC_&$Q1RBf0rygnhJTiQ85bu|#w+d3kjczt+H=UZ*eupSpE7@c}WaFSPX6{En1( z+WN7CUxEJ0*5<;Rc4ot;cW4l@x&)kZuX_q$P_i+e8gzZ>VOu_OWgbsBW=R)ax*7_b z%&$c=pWz!i@5SKzW%RqF^;g(7^iQ?{paEol(5wPwvs8ll?&s+8y%WnOMsq>#AUJkI zQiVb|Qb+n2;RtSnXrmNS8suXwWIrqSOwKu})0U57p&uLqOJq%cpv~vt?N`_OB)J-n z$Mi?^WW*821ZPy{%=}v$SC%!0-v?ILP8kPi#$pgnb+H zoyo6YZa!nVtFNbE2Czy;riV;q1ezJ(n0VCibfLf3?Cn^~0Hg!nCiBIG{#u#S;$*q5 zKRGSTNK<;g;D5Mq7b_`n&5X~pgsODWb<)IDjseO;;ILo0D?5w!xYIC*O?*QIGE@-o zSj+~UqTgQ^=-?4SbE&Vm83xe%25Dc2Gi39{YX=;&dtgZyQAU{=K_upeOw&DX03=ih z3J~Og$O$4o$R;WF%bg~YV7F0UzM!@n%aPIAQ`y8aPNjw>GYW(rXD{YEq?hT}&aBE2 z9rUtGs{;Xf?dvrI>D$FcIzYIAZk?>eV)Qj5yy9Cs-FyYN7Vc>m#cY0DLZu%D63(n1 zDC<2FWiIzZc`o-ag|_b+Lp*iO?{Ku{3_v@!v_wLMAUeN6oR<9B226MTsM8fIU#L6C zNJP-NT8{VHD(}?@e*N-nyr#ad@4tb|cQ#Jre#7PVV7PqYk%nAH}`IM844QUMU%VH1UiK#&6Hzctqmn_(iPfU@VZ0IEy_c$)2Ho z67m(ozpYA>|FekFwlvXBk|`O#&bYSAGR?S!_>)+q6%NMSB!RH5mCPvC z!VdVW`Hg#rcA65}=B)V_0T9zoe~9LJZv@cDU5vy8`)up*Ic!CrkTt^yc6C{?!J_#q z_diARI-p_;1sg`8LP!`(wqw z`BrG~S^^=M@hf;*qm`Jx)u}7PR(>1_L2H^lksfL1W81j2x#W7a2Xz>td6Cfh-iumH zLhvEWdzHk(O)kN%ATbr93Xe4v;`|LRtK&*DuyVPqhGvWQ-HFP^s)2p6&~X@r%>1FK z1kh_h!2>avGDm3DOc96pudqrBHW}j6ivZk7!yDuAM z9j+^1WFkK+zZ>Z~n*V(sK8ud*zE0J+hVBb>R%g823}~|Oy+Zmo?=yEXf@TQK@RQ{^ zUgGOrQe%*%Jrz@{WFIJ^{zoY3;D z9I?&4=L$|7KQ{DdaP^7BhqX<@Xy*6>e0d$0vEOD1b68aAV^zugc zyRCPq8W~aOE*Z3j#rN>mOI%d9SS}W@l2+3&pVxIe9S-3Ojr#eLXup}xk1iG9rT7PT zZ|wN2Nv2OIUPLa_rBtedyb2p4Y|b(5GsxSNEOVrczqXlVMeMOV&`u*^)69l(S~0?j zONg$taZP&Ms?Ki&d|lFobiTCu%n~yY{#OQFeoNho}7I58~~;_p03l%z)`z^#F3^0_}6r(v1r zPWnQBhEB=n{)0n#R*{V*coge_$BP*qQb{XXya5Rpt;#~hk)}8z){M0?nYc0_42D7> zEZa;i)r>3ZEOcYoQ;1{4-dby6JH^hA=&spPO~G2`$S z#nxQ+$xbawnyoeVOd5DefJ%r3%V~mfG?q&_<&8N+jIe0|ide4K0|W?AiAbbg)9V-H z4dR7WVVe8*8Rn8^_;=)Um{35$S7n=dBmxix;Kq)?9@RT!Req~KA#kt;uAaL0N#lZT z;F~^7u{LdU`grXgu6SkG%e7Kl>K-XiN$}jV8^3Y^)HwCj4Dy z`x}l+)t6P~v}5SMVcqBi>%EqW|{IiG087#6F(J)46^A zT}PVE5et63^4aUYh9iX-e}MHZJSKaa1r_8sBt7|Ecp+*Rr~>l+DMiE9A7Osn=rx*r z;vc~%xkOM)K!)P4quKM9RmStzCqTQ^D_js`AjWv9*)3ntu502__3dO}Q~{RPg6&(w znbAC<^@P4VnmCci4sUIO=sj5SGEw_ZGok@q2S4yKL<`EFg`8CM_EDc$Q_);Lu04_e zajasSZuMd1&b?Ax?ApV`gZRhY*Zw`smkpu27}pOv&0~+(FWfBqLVW4Z)VD5P(Ogi7 zK`!9fk%V7A>PNG!_3Q9vtvKliA;FK*9FMw9>Q5ovpAZAOM5tu+_FT-3)9o)fDAFtWqiCp3b&uzb>IoP42+u%sTU zxFg@)HWeQg*QU{5hW8y;%hIkWGf=mG=(|@_b#s%3@Lri|YCyDSt9be_>Iw zdFjftnyR`5LRY{u_C|nut7DYwF_fUWPUAuy9-i@1E>JZ(0v;v9`K_aaBzjR!{_Emw zLNne;w2otDCN6awaI#yF>s~vnLcS@LyO^5b9RodNSc?t zHL4QMMx<0Rp`M~$LX&49l~*gH=ZGN~k$#CF8{-)y3+#5FFp?<@XArhi%bjnx3K=&W zDG?&a-HVL2xN6(SWiLZf1(q%XG2)20@MmNeL+H-N&45NH3bE*g{nBW2z$>p5P9NAl zc2Uqmxtx?`?UL%RQC8VvTRup9m8E(liZPRDQA?dB$*CAi@E@jqzh%NoEv#c0gGNoI&_c8^us z$%`zSt;NX<!PKbpnw5VN)QEQc znz^|S6E}X_tM5c;_m&1lNdEHv(Tc*9&E)3w(rXE-E)wQ3=zJ@vP4zhLm`usa^7$Ej z`|8ii5FGf1>wk904>x4&=Cyz5ia zeqmWx40STI@5gpHdq0D=hELL@2iU+Ma6p$0Gks4~fENHf{E#tFX_Ma-IolGInz+zc zy}-3U1ycQxi6|uaxf*y8$dwN_%>5O+I7a0x66-qQE`m=8vAhk=hi|&g!T_Z*WK78V zO+fh^iCFgHzIWuHY1;uWB6cfC_5iU2bAj?;w2jNB?y$?~EqR}b) z0F?-V-kxY|h&h-^e{1MhO?0oZ9nW^nm(=#Mvzv}z7UKY^Gp8c4>w0ICEf^O=#p4h( z|Kls8%^9F5@(K%7VeKl(^>Z5SEyiq$%z#F#Idr$X;mi)ECnv(w8c<$l)}W6ylhzR0idc z=9P*5uRR3I*g#_tNx7c|?mKjrGi7oKfkb)lFb?RPBK9j_20%hV7StQ8`yUN*0@bvwLm<6jAl0up=V?dX%OJ^6* z@dl2Rl95oNaIXJ2>)o1Yz_CayYlt+;S`n>XMrX7Yh7>(NgW^fxL5-xs2+KWWgi@6 z%b*0GIei8iDB*n(mLz|^>&1%#Q36WuUtuG_W`rCR4Ue_y0a@a&2(ZkDi5V9YXk33p zE5}?Z^$f0{QUyr^(NyrXDh3f|d77JAwh-Sm#b3`2AHAp3zE$RI|1 z3o!$bog&bJQeqFjWIpZDFY(kkyCmMDn6%~2e3c7q^SD0H=zhE_F(FY(_o>;q&oGV| zL^P@G&%k1-mN+$_48NMoR*RW8lL}mGtdLdyspV^IEbKw`%{nEleEJPfRwKgz=c8HK zo%h}8rGm4$lNz4am%Ia)m+ZA=ssarS+@&`6rM9i54sJd>qiUPiSBq1>-@@#Xs z@@}Pkqpx6L)(Zf|IBWvY$`zlMto2#rbgLcPT7jtBvFH#%irQG)js7Y3owo?i3Kn`l z0(}0IlvXeeX)v9uZfEwL&z(m1FFC5JhT*d-iz**?ZrKxcqzL({ImXoCvuyiBA%c0O zsD~G^4w`1TO>Z}HJ0bJyn^F-@+qC)rzzN5{OUL1Gc}i>31NwtVIG_w!RC4ryBHB+? z`xK1){1xTPv5!$i<*NLng)@8f0W`nRzTcQ$R9n~EYqlN^@E~0gS=IBC{qWm|PUT=a z$TE8WWtys~_w3t3XR}Ddlc46Iwj5!~Qf~0(Yf-Y}*~kq9>m7Ub_(k(m>cBQd($y|9 zK`b7a0~y~tOD?~48Uawwt$nWe!XH;tP1Z|}`uoe_H%6y{mY>-Zu9YZCT4tca35tgu zdOq3|z?Ww;uD=$hy6w$n%1^w<f0fEp*N$_qXP)p-Y?}V?%N%xLZrZQh z`=x4&5X$_`*8qJlxIEctUZvCb3YPPS`$QVa^&!FI0?`xKjcz<01eBBMtEAJyk_nvORb=zLJBLE*(E=q zoo@QvPgCQnaM-dgj6lEfPTEx8U{1u)CBcEok&lw-D*cDS#=;E9(R!P07&8fOhV+d|l19ZR zOyW_Su{Ut9aqqho!P z)I&XIj>TyJizRVX$S*;lk#M#o<{@5mN}|jN$$*rYzUC>FR&ZOS$E18Ee_ub8{1V*cLjz7FUIS zQ`pz$M?g0YqsHpD$RfV8KdHGz0fCa8X@YcB#@Il_b zNn+pXR@>l{LnXoXEMToH@C|;Tmlc7#e%E{_y593+XeanLq%x!O2c(i8=XKVKtBxxNv zAIp!#%DS1JYWQ!b%%yb6J(LN;PFzl^L23d;hqx_%IQBwNa!u{Gbl z*}9pq7K4eRU%`Cp5rdgXH|utCp3?C-vDb1$o*{H{!ZmPrY=1UfID(yUR7GU%B`KWGO{~aK!`aVJJqw zUbbX;a7Tg>^Re5s#kFHb!ST7PwLq~rI)Zis6M=K|@m2xb%X!P^JWr5LzH#qGe5Z#z z?Fu_>kEyVkUvXG1iAv>>Yz=fGh}%WgNZ7P;sV;rA3bSRI5E^(_c9lr239d`vOuYF3 zZcCuyWa7u`bC&#G zp{IQ*pgRJYf;ULPr!)5eT$CWlCHc`kzioDhsEkYQ3|y43$T&CryC?xc^%u-S&Z5b@ z)274)4~k`OitGvoKr(?s%IH7+K2&;YipGbqj$48jmq+#_WTscBRAM!9;xV0lW^AB| zhUuNYb;Cy@9)G}g0tFw!9|)d6;SkxT4O#AVM6a;%9;RKbeKJ$zK4x|}XT1|3`1D#K zJELnE3F~7`Aeqc}Ed7kDh!Nai3<50$wAWZLAxI>SZzly-f$=6(OoCOd{g7^mXrX|p z$FnO)5v0L4Y;DRoBIWw*Rf)~0IG_b^J96-Ap_fAci@moBsGmzZWsr_~+Z9KN|@7c_9t4Quw94uhA2QuZ&G&lZjCRe#VXFP5kQ zQVrMb2vK#(pf!~EkhiVDqslRMk7N^vevIJyHy^aW+&8K)_f7w*y>3N#r9P@MgX;O2 zsLB?>O$n#m(N}1HD%A~#-o9;Ze|Zg-4Whk9-+LD+OtZzn8mDHeG}UiIPW)7Q=fhL? zIMuXZWfvMRj%XGj`iJ7+-sV;){0)UWqT}cAVcwG0@fe(Rr9~@246|R$-iMuFv?kL( zl!})d$fOgAXZs9}2|ig3kX1nbf#>Ay*z&Y>$1dlqP#qFb4F@5xrg)O=Vx!i%eG*pY zFF7?3ON?9pCHuW+xWGc)X*0+^O-Fg?Rc|CaI0eVwnmhs$C~ay}G3=`!ogy6tnS z_T-)T=^O74W)el|j~nCzeyY+YsjB%q%|#x(qD5(dYXXeV=aB{rKWvWoABWEcU%I+b zw^&y1|GK#myg+0^i2jn#VID&*k?>3fE~Iv!(QD4PX$wQ%fUglagNHCOhW#AoP|iBL}Up1$g674A?6EQawJ zBtNAXW|WLm^Y^gJT5t%ww=bh1GW}J*r#P=Dg6GYEwVD}q*pKl{$q?oBOPK=IkK7H8 zk$KLlJwIOYR*wLh*S>U$z_KYOA#}C~CpQ&4hJAmMA=&gb{fazegt6T`&MSwcoNu~{ zNkuM>6FzdKvn-qmR(dna3XTmgk|*Y|4$m!iB~JYA16F>xWIxEm-X-IAovFJmz6tv5n(TZ_yg!{g{{UL zLNv4@E3Z9GFuU1QzF1!a+tiD!&HI-tb3z$Ef9J|2qFvo$sqoXHezvTHqa=z$&$?3L zs|n{tQJCwV=Y8*>^{Kku%7>J#NpIE3S-e$F&Ls8un5%ZDA<=8qCImY8JfR`sjwbtO zvM*Ir%hjD!l>JV;*VVL~#9yT6mprE7IL1bTw*^Xi9xtbK5NMy4>t|3}#({3X;Vx}Ks~Zz zYExNwa#%*;lTZwdc!G)OiJOoJ%`l)Vr@bx(EKRdK{O^M^!cXA#qGmJ(k9AzAhqJ!Ia%P?HB~j6GrY@~J@LaNcj|kJHhK3il{P{f z_nY_+oMZ+q)4h~kZ+2BdQWGd!er+!3RwDWo*zuSzESz$2#sn&kr#0jbe2YcIQ?Lb1 z63{-p%V(>TdPp{Q=-n z5mfbaQrbA#yeH(%iYK*(EQ&U({!m6oY-)|**$D>)%ozj5f?#$8?+&H@FNRNr~hUcwc_k&#* z*G)?GhJ9koZhQ2?SNshvMEJ_Z6o|<~pqF0~*$4V$>zS)o>R2$53S%LZ(M8=1z9epDnWmIadWIUkI;^ZqBvB*Eh_)ferC>%!6ZKC;-}iIv~A3i(B1)@*VQ0y;r)5|p_x zRI$ihPTH1AJ||pPA^(yw5PN6v;H`I$bM)c#mVMVlH0qXFV^V7=iLL{V!w%YHtj>jF zy_N}ifdOyIvKhO+Af@_(+jiRL9RU+F1FrRM2@ZJX40w5-(~L8o^laE#Z|=Z)YBT=l zNevzHfyNvC3ys*)>mL!>DIdHM-a&O+)b6uOQ1%gD7liL2W+uULc}L7&U+6EE@JdH9sGNcvNv_F&=oQI?~ovIC^Qhdm^{%p&u^i! zMP*f)7<6;u*Zz(AZp3|>slk=y!a{Zs>!o!W_qn^!LFJo4ePL#ro|LQ3!MLDwj>vVP zLN0}RiZ6>_B|8pHvzQ>sNVAGP_DymxKa_=?5=8C`xye7yUX8|VphBc>%>1J*z9mV9 zoPAE)*2~b2>>AeqGDXOb#EU*zJdXp6-b1RLXC9uwKq0;;+%f}zQG`#)%y4uhA?fO@ zKPPqnEl|PhkbxhU@&1zz=ykqlhCh)_e6FE}ES?k3w2}>gu7$)*<40>*=tL)ND&A34 zwI2QR6)xjbcBS7WPfTwrEU81|VbLkP(Ri&UhPG)IuUhGu82+MBp-- zIy0CAhWwD2p;-JaZHYZ#|6K)2dQXq{--=iXO!S{!+HitGd(UsJ-|rLI{|YZ%e1m`g zEUO0In}PAzNZ4?RN#u1R&FIDw^*KrhVi#QdeU3FRzY;=CaicJCEL5;hc*A^a?(1B0?XlRE0h2>_aU+Zb*KYdCF>Q z%ehUMhA$lS@^;hiynyfwf6}+*MXNt`&g_&oDA+PosNtuz*Fb@o)ulWAq6}?o={mj2 zgB>GLQ=6Gb;<<8J@zcq2Mg#UV{g2o0iDO1kIys6eVYn|;n-%~1U^}!raW(Y zBXF59|8ev!Mdt-RCKX%*Mk#x+socA8^Ww4D6Vpj=8Fl)x=d%y%OhvjqB{yu2zvBdM zl6sQw41z0cEsHv=gahcZCO4B7LTsDzm4+K|xC0Sm`r=USzyLxizStYR5N7xf^4I?I z?u8mZM9eOX{Vqm-JsFPry}Z-|J;v0KTtS+=ch0?~rz`Va9&3ST45HIoWAR;iz%mUk z@ujDq>3yG4P;H}hL^N0)IO(K!?Q%^*D}r5nnPP73=>eu8Nz()7`!HERmB8^F3LA#H znGF_XsxT{$$?y{+Fqnc#2n%{`reG@5v2_ddE~ij!UHsrz&EOlpH9bY%tt<7DbOAoD0Kt=TDuzYM-x5#vtUQ}-D zCk9xzIR~~+ke|L;Sjs?Id%)AcQ~vID_)=4K%4d(CN3m4(FdaD^MUtmmeP;ZyHVP5zBHml3XOC6n}EG{G8QB5Y0^npcVMneL#4MWByLq|t!yk4 z4%|75EF#)AS+H+eN1rx=(uy;W0<7SX5j7rHZUvSn!0#hzXwdLSj4R5rd8__nlsh2< zI=gK9cAZOcYtCQI@j59RxBd&Gto}16ezKUw4089mQT%Vng7k5IVtAAzIApdmpVSpF z$0NShNWQsrgcZCxqCQa}DjEhmd~H#hXn>czJ*!8IWG~wZc#WQy{Jq!VdmUT*8ncOu zPFw1T)<*@er_l9VLJ`~Fz2;>$j~`x0zkBoY@0F3OFPM9cHk?nA>`N9mTeUjf)8{lR zXZyWaPKO##??%R5WlWNir;2)t*sG_kBac=>UXU7ZxNS3sT7L8FkPIK;bukM9dY=66S+iVc~FHG8+yibjM<~-G9im|$5^E1|a-)FV(iuuKy z=ap6lafM0+0&rE0fqq&IBmPTE!IB1i)L6r%U+Q^YJH(9mIn`nZ`Z>r%f1_81m2MiW zB&)(Jq4Eo#lhvyIYY>A~5~4~ucypQTcymH{4f%7pCq1E~Ps5+a)p81KaOj)#n;9Cxm<4A_Nm- zcHwd5Um@cbs>{riY9C{xQwn)q^H& z2jBab@_KtAQIXha{v$dwSmADi>ynIf8_J4_mPvbD%$=3P(5s_2RVzP{orFpn)&kT& zd?|Z5A&=rkmHS&$G{#cB9D0689pt9HKbpxia%4A(eJnvB;8-HX@$7*tdsS;jW?q$M z!3rvzSN%a4Q3It@*j1~Lwkj&Qgti=FY37|J(W!>?EPjg1zuA{XAWaJM?i0Lqmg%r- z1)hR5`)vLtttz(Jvz_mpscgY^@eP|6r;Z&@s%d9^EK$%?MxzKlvgs;Z15H;xFtM8{ z^vd}AC}6zH!&ajqLn2lGn7vFG!If%y`cV(sgP72r=cEdc=p((B7y0o$@2eLXaU)X7 ze$|=#*gX#YsGJh=m4||eXUYsG^YvG`5zsjhtI~s(`(|e8vkHZk6fhM?c}F67gZOoS z_0vUy#pp{v*J@STV;vlyR&3+esImD39Nv!}N1k!rJSrh_$tq!W-ESEN)^<{vj5FL= zvU}mb=K5(DjKF=aMH)!ON7Q`2V(zX{iNi|H=8m3Zs%YY=P`9(NpVT1%C!z)sw|9n}+F@PfQpg8$_gCFn!)zfHAPnyyyc|Yx=0ef46SSoo3LhEUDp=B_wI1AEC1huUUTY0Zyp(oz?Xz ziyEKj^!-?}0EknD+~VSY=;GX+M1+ch;ux&xfXMp_JZ8H)Ed*UcPz8k&EnH z;TuRhJ$uY+51iu0oG!i`Yuo~vZk3VWugm1&Iv&Q!3+&COTzZ@51E&w9n%sJXj%r(% zLC-M>Q2c@#)i>)&b4%s9ePG6<#NIx>>%fnc8gi5a&;0}xLg2B)()x^s2Ydn=-?!jQ zrkVPza$_=r5(KqP907xl_6>V>>EfzErI(+cG+DT`}PPi#GLPniAp_(xI8{^ForK zZ>ZHM(awza^;hRyg(etJTY`L%w{KkC4MbvjmErUcE~Q#i^ZYKLhl}ml7|W}{%kCzJ z-SkE3tZUS{DoYpE$C5Xz@Y5+&6u%38YA1|wCl5oxC^p9B-i#|Zt^!>_4A#qjKHbh( ze3ZgzO=5G(uB!Y;9iG0!94+gfxen8NLg@(%YFH}fha5gFDvsx$GYce2 zl=Xpb4@_z(Q&VDCQ#KZs2J9Y$@fkvxrL zd1i(RVb3|KU+L&!=BARqKFnbL;R89D1GBk}!lBv=XpNBMi^j%vhhG3Xeu8GFCBA~= z_WJVe1=`y8l_(+Iow)v>;K)W~FNF;_%1HUP(EvMA4<4&eP^}DpeYRTrMik?eXPfVP z-_M1T$bW~U>69vMA{NW!R@FGuF(FR=pd(#(k*wh1$o)y4jCVp6&y1rZ;VZI_t7Son z8V=D82Kd=?ifM z4whO#i4RN+M^ptYp(4@4X+{7Md|*OQGeCugM1u5aS(=DH1V$3jIdCp)VZc$ngQ%fK zN4JvMs4(B>BjDmYm=g#*#?T|S+HTuZN{VaUEk9Z?FnN{QN7eD*x108>l^6gyp>j}3 zINHzce1_2WUq4A42*Qxel@!AZN4_OQh_HLWebV`11yFTDO@}CU8SeD!Ar%p(^g2KJ zQsV}IoKeZ(LR;8?! z?|H`;U76Verr3?&ccg&uH8c{k=3|Q_a?<(_*Mmr(tYdl(sHY|=jzP#eA*7#P+X5M{ zFqH_3lmzu<;8XXbt<~uo{Zwna-#qoSHzEeUcq7xpEdSy&$VzaEd%)KjWJb6Jbsz!< zogB{J9w^5_$A^pK2aaZt)#2*G0Ww^4CPdGsFEO{ZwTESp01!y`vEC>KR98SgfgJxT zII34d5wlWy&t&ETuO!YY1N_ z2=G1p2!xYz6SfrR9cc>ZGL=?`CL3D$)9mbcwegW+Gir79DD1?$dIdYPlC19vyI|kY z+kk68tT4-a=pW7VnE_Oi!FYO$W32u?I6v=LRC2I?^v19&w|pBgxPNHwZ`V_du2s94 ztilo_$n>;$Z8Vns>3+aI^kQa_yWz41BL7mHGe@-jneY=XrGg}E{Q0S*3+7S_=7a&8 zxK{0?^*~_i3WE{r!LZLgu$HZIE0|t3vFY7UZ(v~slMT8!y)0OL`o*fGfZAGKYW`G3Uh1$Y^DTR*E77g@6BG)}H}2+bz2v1dJQ3&_gH2`V<6@cG1}O8y%URZ+zYcW zfz3swZZ3w$wi+Kb$LE~?$Xn6`-4>or$_mwZv;G-3y08tTTmRf~JTH-_EB5Ft!K!t<#0`Bezu*1P3 zggV9kqLt9vgNb6+3b-5s$EUU2ry?3cROvC$63EPz zfV5_g6P8QN&iv1<=(j2Ao`=t0eL|htAJqZ0Yo-VcbM*W4e=7ufch?eJHB{?#kW3y0 zXomWf*)c*)Qy4aD1~Q`Uh;4&bVlG8knU=;zLeQKKUzy1-IIiC6ZU8mW%!qEfEfar< zVqknYOcbNsqy`2qnK5a}{-|JVG5=D*h@P&&R4{*;U|v-1f`ElvFqLe@zjZIf?>0Gy zUpajKFc}lw!JtTjO0mXDLNN3qfaz-jyNQ{$!#<@t=1MH)zhp47GL_%#cw!_4Dc(H= zI-Ri?@LKuHd}eO@SyS_sWPYMxZH!nU-$?<>wGbTPqSpKCHu^;BEeVR}!iMfb=1h7{a4ElLfpaJgs~)G(Bsv6QT44HtHBBBo0dN&7pg8k3M-x7Ev%;J(i1)& z_9~->-~KYW1V5Tw01f+anTd3sCKD;2AH2dMBCph~)p!+FT!{v7*VJ;+_ zOKjt#!Td;{ue=EA$#Vp!Ln%Pb01^Qw`~ql_!y*K34Is}!n*fG97A5IK-~g99jQ2ZMoSH!KPaSJT246VDi3C6e5x zARta2iwb%2Q5izC9v+*DiBHdlYJq#@syD?}(&RY`Hx(O~G~+;{Gjv>)k-*+;B{6o} zQn!n$5j%@X36LmY5djcEG-f~qg!u+&SHPkGQ2@&dScITMK$#Ph1ZozlmX|zvXet#x zH5A1`S3=q=d>@B5$Jm%L?1ZhU0=P?3?ALxLZ5Mjx8L%g2SzSH`TN4VZfk{u*}cRYBUx>Bx!~C3nedS;_!~g@bA7w)R)`i? zKVm#KY^&XkW81A=$02zYVEi)rL4#6{RK>0p9mtk{YuyrpY4AI`JLkED(N4R!V|!zO8r{zq)BeNAKQPGe1BlB;T$`J)g+ z`A2b({$D~29DbM(gFU)m{2@6};ND#X>!JPS5A70YO{(XE&gKGTj!6{OdFPiX21fM_ z1@Yq=a{n@t2!du%aGwiJ-^RTPnVcI%Wuy2{e`meL3W&N)q2Iw3JTV|2eERT z$jtFEU)BM`HriM?+hnU!+YpjVkEKhDL+2S4LUsqTxsxTsknI)4Jb?glEI)WWZ5{=Z z(J*a*1&oG?Y>g$3@lc7b0w_MkWR%?7L$%G>s8`_Q67=l(>h4L_BR`PbS30h?Q?Mlz zOh^#xW?>#-x}ykjWL6AAO&%r-6}Amgqz$mj4{IqN^<-6z0+e-7i2w_4ENtk9-BjNY zeYTtlH9f=XqN3kOA0~`^d&Y-*?GzKo3|EQ|zPgpQ{K?o%{mIxcz%n*@e=;@$%O$B} ze`Rd?{%>b&p#QC7^Z$LuMtAWouYk0>8bzj%6*VsYAxm6kCOqxO%>SdXP4<5Y+r0ii z4cqv5dOH6VwmCJ1x}V-+x1BQkZdM}=1%@B~CCPAjlw@S9c&h(HlHurf-3(M5LWqfL zDHfakdt6mi#v*Fh5U8?L#EiU3?w*T{1p@O0FgV^`Y{4t{CR0Hr7SsFVd%8V^QZ_4+~B1N1K+7C(EWK?{S&bvgiAB_ zHWqu|zM>ocEWC|wo9HHDEr0p<7MMQE)*%fk^vlXfJ_pXB7f-T^%~ZUMX4su&7)LaY z?h4iq+RIH8_MhBaTU-HERXk#N{hAw~T^x;)dvInBX0zDdaF@QTfEkS* zZ5Aym|HWn@1hZLWvg(Kb+hzgydV#}0767I<>?vGa3jqN?U9^EXit*qW1BG7pAm%OZ zv*&b-hs1!cH<F=sGmG2hc;QwY&=##_(^ieSB;ZVteAPfw00OA8S z1PDasY=B-6laj>lt8<3QZ+$)2s{ZK4gv1BCnvGU{ z@lzJggFe7i5R(lE_61YHH$iCtun>eCc$kO%pqLOu7&HYO(trg3BQXpQ5COm`450?> ze?uyP5^)U1T7?S;7!D8;gS-cRUO`BKZZQZZaB>BKA`u*l)6uq+0VcU70Wk&z1Ktv_M|%7kFdj-1G^a0p3+>DtxF|rrWl+ez z=%3S1}KoM&EXIiK&R z`Y2YhmMmWgA9r6NOEQF~HC_E^EwnmCEKLI1Bq4YpJ%IBVl?=*;sO{MwZuz;9FXBP_ zl_n3$YO{!j%-Cgx@fc&hWbB4lG0kKux^bF_M4|0`Tj6npLc-@*lR$@3VOHhBJ1uyDa} z*7cG6YE4E@+H407yQC-IT63LC5m%M$8O8h9y2uu!H_J4(ZSOB$7bfvoaGa(7qgzlL zTL5v-1!}++lQUfxmj`K)Gm_uswlzGpp}_=3=a!0qf9$HCgZif) z&9=RAUy-a5xM(+U?-iAY-hS+ak?!Ni6=*MZNcEJ2zzSgQjqcxF8X6+HvPocRcUocZ#zJ5AhbJm)XnhdIqzDI|cnFqkcczvGV^-+RB?2l>&B-w$)+ zzZ9j+qlf0HPLkTit8^8$t6=?>`MR=;qa>%YAm=t@*bq38sPspTe>(q*ckw1=#X3b$ zoO3ZGC7s~{ujI9kNjc?0hwKvK`Q+3!?w?ub`=KBH{m;PhUZc;OLHcs5zN|vsy!jkD z45o+Tn+qR#x4MEOw*li)yX0Uw*T2;G>g2@fqPeJLiCreBf!|RSOsm$Os3EqJyp-8HEtT@{=PMGhkoFAOJ}N z@DX5I5E{Ta2_Xat0Sc3l1Vj(7Z#d0-z}6&$-_!`^OdqJUE)Wx$*3rwjV0d(O#~5?m{!LA5Ye^+-0rr>VLuqp-^&I@+I(ILC=_$w<$fCA*8X^n_DyrR{g?s>k z-~fYP5Dr+I?aMDnHV~o;aRZ3}8L@~I0JR##7IXuYFC#L+wR8g#3z%fJXXseAAW#y( zhJ};~JO#s^;Q0ZLkI1kKR4|qh?Bbqs9(f8B4v0a(^w1YZk8_a>Ik)zz$GOP32!Cb+ z8*DCO1DlJSZf|J8<|40%Jd$$Gml59<7pn_5)K8XK-EME>nz5%_KdwcFSiN_Ed4`r; zs}VwFK4;HlLUh!wA(^p)*=vyjwRqu=zgkZ;m?espwnx`q%=NE7EcTHW=kU0*RNIS? z9CJHTHMr7m@G3KJE#B6+rQL~Sh1#QiTzmRdeFulN10K>5)4*gp;@#|Cw&IZ+HPdf? zGU ztYwe&1M)nRG|tcmasrkVLz3KhKe z1=jU}H|r2*1Pbev=3<~U2=Y#TXJW&+eHE1H5Vip!M85cTd_~%I z$^?{bK#0gYXu|a0aDOIgC>TI-978^~3VO~wo`4;IF~hO$qXuB!gQ*c9uWe2<0JKdA z8P#tc4GhH&G`=-CgO0H=c;0Gy&1hO5;E|6%7=!WguC)rAkQxxy)U3rh)phOm@=)1g zJbCN=MJ;3-G6Nzb=R0$|W4%)Q7cv}HN%997c1mD48v!1&!FYz&e3AD33r4dg5}U2?syU#ztVSj9X7s94w`tL!XqwT z{wy)}m+L%NDhQv}so@5mP@h|;@_`7a0EZkf0VokL{R$y9>BDQVE9FW5DMRZ&=c#lY zkaCFOcB;XD_LF^0aEN%jr1|;qZw?~HxzWWfral9zxas% zw+1JZ$B(I!^*yIG)5=R4SrQ+*PnKn_Ks>4C(9Qkr8m`w~YPAHkcF7Uh0(i1{pa1 zf=q<`mtU~&2q4^tov7LeONX_rQj^}|WK{us@wHQtU&i}k$S+$?YDi0Tkb`Qlt2rW3 zZs}95yv*_ZHkA2_pJTcC(y#LaX1Ds7o4c{;fKo*;k@N(Lx{8A$;F1JC$SI2BK#Tj6 zqxJwLzYcb|f}OB58yl>kl-m0U@k$sad%4*H^K^qd2SFD*Mdy_6(okiG*FvMvOn?;u zq6bn30udn8kl#T$BrE>yJi4F=^cMjmUVs7_7Wwmj9EA!4~o7 z%39G*9E5^9wJf}~L1`ymtNS2Hr648!M4SbDZ@y-*( zx~2xG1h<~4Pd{Hzk*Q|TQ`e0pf|gv^9tC^BX=&4_)(yry1zhKj)S`a}JLOz3%0oxKVIVctQQUW^*=j*C!QR z9hzI;HzM$~!mYLds<&utz(XmRn*D~qQWp6_IV}n%R(t6~-A+~}?kXQAisP=sW9H(j zWZHVHoqRl2EU>W&3a=Ug!sn4#XupGns7defL~9WHiC)hQ>8VzE#xuLZjtiH^cCMR2 z!goLHM1X~PBvw!-fVO}n2Kar%AOgf?(U71~ln8H3ZqNA&Ejh&vEtV;U`H(W3qRZOz zp;W>!x!E$m8O&{_JcH8^I$KP2+ag?Gsuwx-H=yX+ok&WPJZWUHGv@NktUIRG?Uihl z(CKLk+p>hQaG&eANz?~1!d5c>fW;13b;{@9Z?RGHZsEymsb5YvBlk&QfFjx-LNTUw z--R_6h<8GxK)8T76Ey=(PH3X=A08Bekzq7S62+zE&wdA1x^q&u-~1K4HvhpP0uFL$ z3YeVCFsOkk zc{CkBSq}>h5L7@TB$*?C#MjhiRW)_hCSQLJNV7OekvZAbvpYRI1R|D^>_I7UD@aV3 z^KS=zN`Fk(e48-kCGP-mQXmdUe?f3Jz;PQY6X*i)c0;3Ms<|D+ZX>=K$7*1-90a$p zu+rAgeA0{vzexS4lW8OUB#LV3%I}H!8X3@bhxiN*j~7U3MVVvTEy+~0oC`A&(QX|iETZ>`!qGdd;hdk@41eq>dHH`Vw*CtGv1i5hZDH1rlCga za|S_;rCpcy-|7RrL9+g>o>s#m4y|b(78nKqhMA`J;=y(vPv0o9&kznYIh@kzC~K*CQlf}4R2T!%iq$e{rgun1F-)=qki=4hOT3F$K&oV>_d~Jo<^?{2Uz3#cGrcu zi=~@#C7a*x8BjN8r4QjGd*+u(RtU>VVJwXhJ%HkdAcRn3KH<;lgORgiT;49VcVg-ytnkH|1*3Q;|Y&IFB7k z;%$M5@G|u`3#odSqMx{kn0LVmh<1B8A|v}x{HX3pS?^kj<6yuVMYup=u)o6!|1Z>vLwOF^b^Pt!}E zs*-cFduvTn&jv%fqJe&X>W3zwMRlO2o(*p9?PFNasi1k`#E*bL2^Q9a`X*Ej{0Zxs z;7@9*^4fDJ$aY4aKI_?HLw`Tw(R{4wXI0^2jA!;lf6I%o+!G^w2|XFd+pf%f@jGBS z455d+YXl;PA;GGRIcy8QEbeZHZ%JMEoFc}d7L`%>`ZQ~;omv8@jUj6IpS`oYGd*T) zMzANbK3%gi8+7V1mwy<2!k}#eI}->lvMQBwc(&QKsQXejx2N9v;;H`@7=3 zASB_<4^+6eRrCl0bpzK_%vUfF%>Cg_)oWv%Ef+oK9*piaLgSReNbE~VrTro=#?f4p zhn+=#oQl%fY#GZ;)A?+=*PjO+H}nEiE$-(~x=SiU8?t1ZCft-r*4@tXu|wPsiZv9> z=>+r?OsGbCuVtG`}SyJS#^Mn?Vc(YMrf zf)yj~`0CNO^imaEex-QY{9I$HdAjqnNu_*~(7{(n?k^eqt(_AvfHcrV)gz*-IHeZ4 zyY@FpHLx6T^+;0T{zX!?!$>M`zl&cvo;oEx-}=0S?zk5R3{RUEnI1{1r>7;;k0jN| zUnG?XjHG&H?_HvT)%>#g80kXE;3w;;Zx2J*7)iM^59ZHGM}yDTpYVQTIvtSde6~v_ zOz^o{-|0$lb0U^&Q#_ox*;8v{^BB8~OhX%jiu#=3VMeWs0gG^0GEmz&T&S$W9CA)gIx^FFRxPb9&);3r|H@F1$iHBW z7r};Yzlob2TDHP~n0E0)c#n@*wC{)0*JEZ-#?b=AyDV=5s{iZt!;ht2a&1^YSi4U-^+s`QZ6t=in#9u(VhC|M?^~bc^wRq zB3n+=Z%t3Si=)IKVSbF*;e5a2d5qZAynLI-=|!?G@r$&a&tUu|TN*n|z*PA!0aH3U zIsp_OW?!;}*_UWx_9fxn@uF@yp%H7E$fn+Q7Sa_KM(RDhGn+!!R&wKb44Tyr?!+=A zlp?As;%Bh%$O%S5p^Y>u@t?or2-gXaMqjcO@2egW-5OTAE` z{e1h~<1Zak@n1S7Pjesd5a=Ht(|0PEk4fs$$0YT)kI91R-##Xt*KYXJHw6QUFdx&= zzkN)|e|${rCo&snPZ`c&I;Kq z{M7n0@80u7&+35f9bcc&uWiB(xre18jn95GxuGc{%DN`I1^mAVEm8l0mL7%{YI(bD z*K8hu!)Ka@<90Ti3vv6>nw44dA1Z+bMN}fn%8tSkXP&32^fyn^N8XuS+kMcl`g0ku z^Hx8_X0aYn;DwM<-KIUboi?E^xs$b>c75LLm=G%Ci&y{|{~8=NLfRf%hyz&LA!HEX zS1rP7N}i~x_Q}@%L}M+W>IoK+^ipd5#N|fwM}RT0Ib%--d0rqq^udl4)b3S0mGhPR@^sQ!o=AnDdE2i4FXS%=3(_6_d~$= z6p0N;MQvc8 zA3{YwH=XKsA%(e7h_IjKwmvlJfy=QcxZC1?r!ZRi>IaZU38n{q0&aycC}@Iy|70b& zKmBp&p;~v^6aan8^UYv6vC#z6x$b=Z8(wokQ5GO7j6p6d8KFo~74_;^6_ai}WxnS+ zYL|YoVr22l0|V}Gp9?=!pTBa2er1}Vn5E)i^Fv9Suv)#9U`L-p%{RH+rsEGDn1vRB zu?~O@6_|ly2ge&*VErXty3Cd0adZv+Hu*HDI1vnN0MZG; z09*thEKg%^MY8~tc4So`r4#ZDU=)Pt1I%3zN+99_Q4ZJ)H`V8@7f*+_5 zsd?Zb6HNgp1kS(BzsCoj(nhRC^wo)QiFPbdx`yr#yLeyDLZbvU*3lP9=URN*zIBqN ztn;?4k5lm63P&HZMj20iNXmoO0*j)U@jzxWCN2;vhN%T?N@3sw-HhPQ{}EZjhjS|d zX7bRafly|!#tVDT_*$(R=*QUo^T3vX(c|XCm0Ft-YpWzQhp7p|hgd%Ta*nqABUcrS z1_tuq>W9T2cPlfBcXsAP?qbY!^*RpSSHc|;{_sjbtt3RAk|v)y(eHSHtT5B^cG~`3 zj6v3d1eQ3C-@A*zN?TE{Fn~e|LI(Zc!AAsthRF&49wzIUx2FZbhRH^)vq$Kk1m&z$ zy3b}tLIyKe`GU1*t|?wiH^%==GBF4bjFg*92m>)) zV40bzLOVnxr}W2jS>tZ2c@UM)^{B5r0q_nF!e-()e%tFmn-g+Edn$M}P%{Z!br(MW z?bN8Km6TvFbMNljvN*RWbdpsOk{qI@toZa zgH1bti)?uq$&BWybGNlM((;pxv>KAK=aW!u6rEAO0(GI^V#w64p zQhF5iY{DWQ@b%Xj_m~xR(SJvhhwfNb$-K~!L*A*%e~)Kf(AKLEzK>OuM&~y_yRI;o z-WPKw6K5h>8sdVm0K6K(#6!hL&8n!RAwN#;1MEjINi^yBNu%F*ITy+*E}?N%mz`wD zCw;mrf)c#^(O?ygpA#J5932;gAvly^P3Dn$WzRrb+snT5mH1d|mCH6}btFrXaihLU zjV>W}?H%1me|eT&l5^%bU~vSdpIXZd3sJ_VQ>6!#xUd)i#!*asjU#Uz07CbgrO!jSbBu@qFrjWyD(p9cHekV^pgF-#ulj?Eck z|8MPnC)Jd0jGTt{l{G;u#ISYWeEF?)PwuchF&TP-FZ&DF@l~FoUhe&0YruE#hmA&` z*+&eRh@)x*55M3lH$SddiTdyuKW?OllxnoN@^Ze&{mGIAamE&$2+zuPB zhQY?GQ_voywedB3p5DX`w$mOr-b<$MEk9MgygzMk_1xesI06Tz)%0WRr~79^Ui_{d z7e0BHdU=?Te%IFwTRq;ex+6XzYtThGR-H`qd5);enc#UB#V>9Ls;Yi?`ZS)G_HC0R z&nf!`9pHD+w5ElI>n}_&8XR7~yv7I4Wa}J1Vpou>49xG2)^7Ov3n2A`NW={O8wLgWY;^0fWzJM z{lK{ac9bcT0#7Fkh4*c_!$%`Xl@;MVP1FOIWL;Xo$gK1(<#34Sslbhco9Oa`7`Q42|6YJQvRND~+4XrZx-Mt36g zj>c16c_Kh>2D3kj*L*BuBU=vivs;R>Nb$HkFG|@8izOV3Z#3($h9dzq8g2(cFP+g1p=6p(QyD#D1;2qOGd{AY@smnwWoFf3c-T|DCdv~ z5IlQCPso7#kC2wyb#=^p5cL1nluhq(%GUVzl&v<+?vUqyP1z*=Ic2lghfUc)e^1%& zTW)?#X|NGz_2k-x<9wEAzpQ^pDyXU7nx~5z%@A=z^RH=}k9|`8?So?i;G=~}_>I0-3=<;NT(nm-Mt6s zbUNo9>t4@#)_$?KZ^mCRKG$`f=lT5}2kJ_GHF&=VCBt9QxZR=78$HN@$Ps9Pfs`qH zR&d`Ih6N!6&bBa-3rHEd8d8Qn=y@tb*Mt@?HxKCVy_Z3C**D7SH#R5sh5{s=~O0 zC`Vi%ixl}eIs|YpLm7&FF2Qjj5KO@R7)D0#5^O!2Q0CyX8F~I1gK~{J!>~qJcG5%Q zlnfTP!K7Z+v@I9V&W(g;rnQJA8vgTwk?N0vkyhS!j%6E?WBKNZP~Y)%A%mmM<9fGC z$?PEclwS7jSI0}T|OTRdTxL8*%Bc-6sQcG(I21M_`>CY=eI1KEzGV1lj)AV?Uvu!^CaQ_bS z`Be=%@4z!4H-W1O{2HVkRGYvl5pySpAEM_p&UGxFixZ?4qsbm~F7(*M-<^8wy)AMh ze!EB^Kl7>cg7gtZK;G=?rXKC7mKEcxO(9JKQp;LBQ^kq2vTmJPS?zMhkS&y*t3O*P zIb2n}?lJN6CQdE-!7@@4cIuA>pY4+^1ZnnDs;_UzJ$KY9W{#h)GVfMPkutm((>`Oe zPwZbyQA&kXR}zddA+~%;LpHnHWat&l5WKI26R9DNthj1A93ZFZtR?7u=cCmY^XGd! z!wfmz8nov}B0UXvy_0OyZaVdN#JluNiPx}L4HCv{70K%p$ng=o(&SHdU9?$pomrj| ziP>2Yc)indmd2t4Xr}P1#7L&$%6F!r_@7KepkoU6M~O=TbEe2R@LfQ94}KM|JsH-3 zkrC?JEx%U_1 z*Dc`&kQ{KA02#rNjliNtU#H@K{RX5HKowDB?LbKcmIO*gKM+0-WhUz1hD+EO|5Zu| zURC1UB>V*|w&f8rXHof10d$^+&ViH+Y;q92i|++Ah@ddMxky*D;KQ@oc8b=5;T$;T@3y^%PPc*(;wWWl4r=b@O{rkU6d}D z2(#Hh&i)qH2tjtaO|jELMT%qN67923_NevzxHTptO%*hqV2q2H9H+YGUh3HNCl3GX zAS40KbQ?}T)F{1O;GxC7b&z+9N>FXTvfH6ipzJ~y%^w{N!5Dhx=G$J| z)*mtLmo!c81$>p5V6&%pgEiF=|3gOuJbMY_R@@iST*Sv(>j4#{ z(nqy->Z2+OY=ZpsQF(m#Q6Y6ymk`xekC>=O339t#wy%^E-S-*ebDx>3+ZgC$Hk`bu zbL?y6j*=h@67w*K!0-(?2f}VRb@#IG@b*Wv#t*)6jN1tBSi=IS+lFu05=oIn>&y3X za`E;*6v+9}a6nGVknCXff;aYg?U zN0M1U`u^3^)tfvf$>D+FpXn_0-vVY+0vgd@`7cwCF{1y#zcA1$Za-8hQ<4V*XZRPf zQ~V1G694j+n(XRpV#fOXLtw0qdjTM5pkzSj87|D=lK?)&96r{<@fX4SwYoXIGN?x<&8x(^;&W) zR|0&3?j4%-k|%5wQD{XYYd-Gc^4KdUW7Qsv zFqHWtTY#eY2DI@ZQ%V1`OacA>G*bYczs4hD`VX)t|9b%fUiiO8p5Xq1JOSU@d{fJh3!33|AKvkob*@E4(AWgj?k%Rr#Ltm z`#J=$jKk}J>_=oj(*Pg#29O-$-32}{f-hh+8VUoXdr&jpA5|F|XSVQ*nyC*h)?H4k zGV#AwWxh9Mpl3~)Y^Qi&_Z)r!*X^IyVrnE{d^A6mC{aiyN*nc=62-FQkyh1mvles* z6;OD?FI@O*Lx$?lh75S5h0lhJ!a8{)7qYU7YbwS4({L;Z$nk+|iS8_TqY(5vKUf~3 z6qzsT@@7$b`ER;2HUX7p4@6(4Nj!=_?g5f7;MS1uB^t&3ty$uHrzBotT4w3j*E480 zVS^Gm!{de7A8#uj#Ta}IJrz~toNUDZQKB)d7P(cmhUz|zml@Ed(rGXY9o@hg&{|~) zihlzhbHMqueRBA01KRLxzorT>x7yG*WYA8%RWXwz6S!L)c5t&W{ZWwZlO{3-m6!`; zav6#F)I>2IL{HMA9QeDca-g}#30GgdZ}TCK;C+I23177^er!1OA*s#taC30!7)nX3 zt{AebFT2q|P@-(*aWrBYbx_xh3yhATWO!?_#80l;c-&L9U{D2IBm^`Byd4n@CQdsp zts5yl-ZUBp73u@$S%KpTlmW5{Vosp^ zC|aJN=LGqU6;Db)5{`>6f-3*D0azdj5s>n53w$P+Wl(y~iNysgBdPbz{_8pa8R;Rh zWaU34Juv)*^e`^3D;(y0$j@G+`dB`3p5a{_*M^sSAuu+COVZ`wf2*Fm&Rv_{s%~iKevwS^R6b)sX%-I4EDl^ZpX`Dc*pXdU|^Lg z89DG0?PorS9-4X0%bmE4gd`st?DJ1ZcCalPbh(aG-qz`4J6m@vMZ>kmss@*j->nS2 zvmKMU5N)4rr^82(Pq%Dj-REq_uQ0N?Hc_SkZuY@0lEoz`L^4Afho2Bt*%iVU6~HjzB)lE$ z#AEuS?!VUSgXXokG3;he>-Dl{^?LOSrE)#rtC!!$xD5Rz`u!Q(|)99152t{!s}*>LmX~B?Md%#K#1oVQ>+= zU%MXwk_n?j{MqktBg#1({Ei(TEk`>dS`ejo>+5VC#5hQ3_ZLS>1sn4xAn<5=jz&2;5^&J1aMkMdH8+ z_|$0w#q6|ULXTp27aRgOHDnr4yoUQg{6LNat^~lzg$a{X)BUs32M~XV%g+5D^*R1^ zo#QI9_pDD>uJO>fXL% z1Ka3t-oBKZS9#nypdwPGrFIy>`9#sifp)o!e7d@O7GoQojQDstU2>(uV5}q1 zzPr7@*DQWEvlf zL%^mu8Ln0Vq<+*d-L^ZXveP9hg>LN#)8LxUnPkb5avBjMa>YtuimXdR4K=R4CC7wYxjz@v9 z13VXOl)}yz(?5hSLBQ1>I46p$9guhocjKw9b6M^dM~a4rPDR6!E3>w{V=F|4i@lI% zdrIHX#7lE5i0e^2(buR2P>SCcSM>s_UN|}8J1rFRCoQ!4@Mymu8FK%bai{u`aW~Y8 zcYW@8caQzqp2zGP(H?&f;&bjMxC-2P!W?v6B^0E~(=nJ4st5iYCaaV~dYUQ6K_s%D zZ7vjFzo0a3^621D&$fPtGCfSstDI?Q#e}5af1e7oc_`y~y4m-%kAdrAyfn^MW z%UCNKU)wZWmWBcQ2nH3nPYuT`R>UN@4MCTRHf~Y}xueKoyAF#W8U>aEc+#=Bi-WKU zXd$3l7xyBh3UpOse?Oa`*c}2?T!J@{dH{*VQ$RUi4r=i+Z=g)-fveTnB#n4{Y+im0#&mQm*8>7J31 zqV5(U*1#@&$i>%5ZNsso!Izrwyj8k6D(~vmAVw?#h-$_kPQ|QjuA3)y_yg&&X6jao z#I>RKU{i-YPjvZ5%GeDZzhrnHK=?+eNUf_MJ!^|3*;e5$4O$2pm2w`mF&;}CsczPA zAtCg+Czx(rDiEmh@qnM+=^A-irf*0o$C&Br4uru~s3C1C^{IZk-3dpN-JzG6dUe(- z^NfD|!sSy`;6Wuwh=sAC$E&J|g%ukWo=zSEaWE}VT?EHsK{BXPux3x5bCxv=)YJ=OboQw43R<6mo&yY#dE$J@)A)zU7Ot{lYcvIH<$Xe)V z@2pp;jTd;)0pmen@f0~5*58s1nrNhbx839760)3>m3w|E6e8D9Y3Wt{=7|f(JB*Y` zbc%KQ?8*7>D!iNLt6R+Dgiv-YICJC66dVk-pFq5=ZLYSNS}e#{ZS8u~7DCC#r-Dcr zIGL*Qufg7Oc5<)%GQZfac~mLzkBiW4Z`gsKUV^+_@zni0!)M1!4N0B z7557PZ z*}s}aO{-PY?5v2=zVw4+R=fcQ5$hVXzQvZ$r}^}G5G8>zla-oN`nka)A!vQDBHcOCD;>wc`us!pc+ zUAc{4(l&8NrFzgi=WS!&N9p>!y<#2s$!aNoAAZ!cxjHvsrx0X#vSHR|(g=kV0eCX( zDjF_QZU;F0;oJbAK}kW@(GyE0@I=mDx2UFhq8c z^Lc9M+b3nsg!_G`+y*L}9m#*nYp^Z(h1cNr$mk@-j9c(CmOhfhJ$O!Ss*G*hDQRgJ zXMkmVwZ&pR2M4W11}zFAy#T~)P`GW)!@REEzB*9+!C^IHS#zPp)1~IzME5Ziyjp}) z8bq)^9KCIEHQ4V4PVvs`DX8c;#p-st?bl%akB{Q`yY*b`6V}8pQL}00Q8e(QV-XpR za$DxGvo~FlTgKPu;=AA$^cd)chBU6o=!|0&Fv-rFY!Vw5N96Ye`+S;$fn^>zB|(Q% zTa>Mqa&MWNZn5&>_WX4~!3)2LGuNF1fj!aGK`u9pzrjh-v$Gav^?@-joD`A)!oR_V z6fy$oD`12A7ia23vQ~6nq|<3!+c_i%I1lw`wYXYJ^ZDfs)dh>I5wl!IA#xr9O8f%? zjhwFH_Yb{y%DyqIyi0I9G}H)|n_#RDlMGZY!3D?$3^Or5 z(eG3E5)KC+(~Fbzsh#s1&^ww1xXbWrpzs9w9HU)fiLbRTR8ZRNQUe2hu z^(88Pgc|=ec$NGxczx*xa97y1ODCz(a|EZ>u7)#f*Ok9myZ*dz9sIC%{j&>~_@5Up zXB}eGo1s?jL4y+nvG)zGf0e;Enqf6V9q!FT6TNk5sEjqx&ctPEbVvAg21$V-^7@tc zUtGU912PHf+jluGTh-665rA)i&?o^#E#^(L@` zL$88&c=#e<9*!iM8UEWd7^DKM?P1VToOjy2m{_j+KR$+mTbbAZ91uYXK>8Gn7VPZd z%YX;OP)fkmi>m_0h@s4&V;}zpfJS3s;&F&mJWUz)Ew5XB(h4p{W0`<@5-2AKn1PXE zg>!i(UFwXM0j)SV3?SAAcF(jtED$j{=Q_U4ZI@+zg2Fz$2y=s`OuO(m+6^WR^a_wp zWoPglQ`p!V89r5=T!|xps4Vs^ZA=GsKtoEWudmo;pQkOazXeU|X# z-Mco55?j59v6knHY(6$>pgabPUE=lAQr%o!{di9_d}QTH7n*M+}S%&)xoQ8A}Jt(Y^C;nJ9+dY6-`jlL0fNtFM00~42i z)Od+X`K_Px65B~3TcG%8c1Yj7S-oJySnP_!@CdPo4X;5C)1|UrgP&v6c>O;eqr(3( zMuDt%xHRA(5l)3!>gvdd)LMf8U)b{tg$0ci_ZeX;vHsJ6vG^hTISQKHcdWb)(?Des zT#t|DsegG!yIlwH17XY@ zNV=Ejce0-W1Pss#gb-A9n*uGiZ;m&OOe~&rDeHEFE&2Hlr`nC*q z>s+#`R~^0TrSVqrb*5D5-PwT;f3m&C=l&hri)Q$Y?G=B;V?3u3cPR*Fi7YD*e=${A@#X9k-~Cv+1(u#gU5QW9a(mA9`waEHY5%zT54z0 z6Ro?qVa2`j=K3pRJiUbV-!jG{IuL(jjE|`NE5b-e*M@2ir_s4C2rW8r+NfP_4HixSV_F8gu3wjDxm@tbK1iXpVXfz14EiKMVq z^QTF|6zFrF5fQ%hATd_)wrJ zRfQkF!oA1Udp)7+WGq)?5Ml$b#cy<-sPr=oxYE^M%jr8wD&6R4%NU48aR0wB?LicP z`%5_4@9FOMboYC@`#s(L|6sa9{Ojq?0qJDU=p!!BqEs-^6@b!}J)2UpKmX7I_X7S97-P zCkaJd*gCSFnGu$$7(7;vdY=1y6OLFPEpVo;a~!rcZdsO~V%x{w)azVyKbL=az5olg zQ`m+NiTM8f+^Bt_=j#WGDjKZG!*g}CUMuqM69TufHW&l^rg^fQkAvY}6gVXEgbl;@ z6!&@RRFs?*eGCb%y?GTmi(+0`Mvc+F(;v5SuuWQ2UF$LjZIjYoiz_D`Ujc~fu^}lr z#gWM+48*q&VU5%ksNoL`Gu&FAVBabLWuZ|O zKJT^tWJAN;n+?1zv0i>VXw=xuymrSDIx#NXq6jzIPj1%fV=X=p^0i<_vdJd0#f}2< zLM~2e@nhnv^`7MwE-SAleHW0ZSXBaY#OMi45$ZOfty9K9pyqXgd3OyzcHuH;ac~>J?-f~{A_JAZgNP-5ePO5f{B8lHO8c;IM^ag|B3!(FJsvld z9)2I}*!k@Gu+L7DlBZtn%6)F8hc&#QyH7>${=ryhZ71u>`%TuS9UfP!OQHq{=3AGP zH|oN$89NEPW`&HIau{#&@eHind$Rfw*Vc}1%&)T+S${~`41C;?pre8aSbmR95@B;o zz3f_l0+wZ4{;`S)+4jTC&pGdS2Y1V5UuQMu#;1^NJ8cQ~f5fjaO0UdHuQDywoHAgy z&j~LXkQ=e~W7v_5X5#w96^+Blk05yYj_nC=@UoF$8omfk2n+B1ADs4wgN|}4V}c|v zJ~b}0e&X4ei}F_7+kc8;p!gj9-hsO3=qx!$-WY|hiFm(@)c9T{?J3CJ(DC)Hv%N%| zM<={RXtE-Z`}p$HU{XIEYqgg1lqk+WScdZVDm%_thJ;9%VQ68roSn4a zZCt3IiC$D9sZI=Su6MNF6r4W6M&CT+CI)1Fq!nP^M$e$EKIR(0X{8U(NWEO~hE9vw zZ9bUQp)V%Rb79cq1@X-cA7f*%7!IdnwY83yRua}sCk|i^QBld$;dHMvfvpkefl-^Df2TX`*2_{g-gcSUSH#qb!N&|8;fe<9HK*`sckT0?Ww)-S^2SO`zu%` z6S43VU5?=OxM_EAe;b1Y*};Qjqlytmo)$z^2&jn$^XXS@;RN{TtxC+6Pd-F;-Z9DOBx3D+y;Q2Lpufyc7S?0u&7+>y0!%dhL)r*nj+({wVV z+EJ+og7JV#4on)=M6(Ily+)2;-|z9Lv-yv}ngcEsYRV-T;LJsiuh#%oB%Bd7Z^Rwx z*uo{jthi$6Rl5Bae6xhJplEslgbpzcy330)U03j`6ITMoDFwJ#!C45K+1-ckEU5fh zSZ&meNJbV`oqhh+S5+1VIWu@(zZ6#W(L3a|$zi~*8&@1~>k_b>!4h$QfhB^clbAfD zw=~Ck26gY0UUjr+R2OZdy7J84Xi3Zre4NBo1G_hIq4dYLyk-(wcdYe>7IMjhj6c2I z+Djd{Lve|Xuwc2NmG(OUk~yPq4&Q%*5z7?zdhAHP50-S^SDy#T9xQXlR*Y z_ZI*NN92@uPq8?I+44*q_~>9$+&bR<5-<0+usy-6osUrTUL|(Ug%9^KeF*cweRK)m zdaC#=>R_O=<2!q>KhgY5Q!-y7Ownz~t7Lth%%d5})@P zbCrGE*gYRS7kNM7ZC*-`oTlj~TwD1j?b>I#h$!9Jd9)0@g~N0~)v%RC<{7VP92$|` zqUvrL#JP{+Rf)Agp7k=~y-?l3t5Ni8w3%w#HBt)1>F3Mll+DA;vF<9NvK`haN&DVX zM$O}MgoLW&6xhEjP32miSoD}Ctr#$sFfM6$WZmNFIH*LbCDO)&=6jLyZAsEi-B8<# zeHswy1jWP3kvYeI*m7A6WH~`u5T6H$hvYaPgj(NuxE(^Zvn>)r&=mWNI#A=FedJ<& zZ}`Po^)PZ`p+r#Ar3-m(S+xlC3*>MK(uJT-HdTRJ+7++d>gU%?`+L&t*HAB!> zJ60v@>-$znx8U5FTd;95%b@$aTX6CJ*e&?0TCh*!4N@(L=o?3M5XyGGbGxV7pLEZ1 zKI;SN_!zcK5x;o%?T>RoPGz*JWD23g=RW1$C2M2OQ@!#BrfcdH)75tILVnsJp zvA}`QaGh$bDWo%+4es@|Wdk+V@QJjeCiCl8#6|ocD z8xI?yK9DDBOPKbFB>NqucDPNV%5HVpGhO8wJ1a)(;@v%bM4Zl&AHViw_;s`fZ4kQQ z*jfBDTZd};>hZ!d;V9{&C+{A9#r5imJdAONn5=4^+B$5{Y#k2a!5N#c`)8)XUu+%j zF}SOb1!~4mu8>anl%BJjMLGP6tcP#x_Lu{Y9uf-1(!#j*11n&GBWi$XOAJ>EB7WNvFt-cJJCPHdyyM z(9X(EDBRD@$2Hnw%&K|=BxZb#>d9%6^OA0QcGY&v-gBx|C1J?B`R2}K-8OX~FfhKV#8&;*Q;taP`XA>JfBIG{=Iv&Ua^| za@YN6bpsJA{-(EqYRq=^gF%|u_JsJ`FwE3#o<+tRePNHzF_WGvp0A8o{vL<+Fd_z%JI4Ba&{&7+Ltmmq*a_1BHF-sKMMc2>o zE%LI@QAXCzM)bs)k$Vqa%<{eReH{1aM^PojN?OWy@GoS)5N`!;hlFH^o~6lnSIlqBBdeM_;#q+< zZw?r(a%R2?_y=;8#+fZu`*D^zSmEnaQ?8VZ#G;Aq%0$mZwK0=< zHUAZp-F}0|hzg}Q263~`SqbG5n3F!)*C`mthnU~V{xVIjM#BEgvwW`Si<swS_2U=f_teIjMCh`EKuOZ5^N_IxEnu_tcA(iFSu$D&@bdSt){ltXW^4u31%y z{#>)>mI+n)EivX_nKjDR?Id!yH9T9hvY)P5jSwMxhsZT6cP8?6JM5c;WKE@Vw{*@7 z-jX7JKCea6nC3(5uV}e>!P3<;*Sqwx@^mAQHnFBeS-Zv+-WI(R=P5wOGUD7mK@<7m zYW96a66UO8H*oKv!;8zxN{N7*wYuxqx1QUWb8dS+%Lb4jK$LvkYN`o>WbsxE~;V!h%lVy;vl6#)1Q1mw48NHlc1^!H7vF~+Q*$LDtJ zU$66$3!3}EUC{{R(-bi2jU@(`gru&lN2$-e@Qbktr2BBxJA>8WaH3si`sT}0l|bM+ z<(t~CX7(SY+9A;O^e0?0OuVNe(UbeYZ3JoCqXmWtC?otCoy%jiF(_S@6ePc=kY60E znPL&r#};^Rj<+7XlS9i75xE1~cqNTevl=vW<(5(G%L!wnw>+QgLGTDBA8Qp%-!^!m zyV%>v9&_%FA$wO*2X5uq`MSq=#WM>UoJo>f*?kJq}y5{TNkYxdZF(uals{{)9d4|Nvr{gPSM+d*-KaG!gA z%!jYT-#bXhxla{SV;qnc30Y5r$#NV9L=F$dy#wpI=(xFBop+=8k9fy*i*@HY^qq?Y zuNx)dj>N)NvMt0sqA%Z!5^fKvNger6B&VInIJ87oD-;`|ETWO-z6|gim#%wzYEeOD!20qB4LCiebcod-62(3j9l~D-^>;N;;vs8f1<^ zsgz;YWdp^E;|C)53#c3idA@MQg$2*FAKo#Om+k~_J4lVQ#TPKAi<3K7T|S%Rpv`#{ z-CCzu2@V|zwLhlIb3=vQR8M7SvWi+S9t|Wlz6jPTa0p50`VR}N)f4B&5)P@8vPt4e zZ^;D7D1vY4*mMvX0DFf`B97?YL-BltNw7%J0#>5!aaVUDDQ@aG&ytYrdPjJ1@X#t_ zi@Cn))aT4tFOsm~dGt1ZL?vMt_YV4t#5-9)>OJ%ZFlHg31;^uTo&FTX72N)L+9EV9>DQj29vE?dAl}Vj$?7W_R@saZOn=3}2Yg8_Nu6~$4yPsY& z`v_c5UW#w$?I_fb6+4-4y%wDULL2I?i5}YTCClPz0bU1f!EuCzWr2lD^Lp9<#UCPjan+Hh`iQ~hF zf!!!IMCWRYLRJ0^cl{Q{xZ^>UZWoV@O+Hcn%G~qXbxHS2U2V}tp6j7kE9j>jh-ZD| z`tn6QHj6P1_aV@{UDz`+NiT%i-|lb^eqn1yy3R#iCt`Vi;vGJs=o9i=SIX()2Ktm& z8R~lKI#$7}wFhXzJwzh*P9GkuN|jTkd=l`b;h?;R_K@PX{`vaAPU<%8w8Ag-nFqe9 z3QhI}Cm+-_^F#D@tY*LQJ8T2_DP$Qr8r+|P${h@3x-18MaY?+X9w;7#}I-I5A1c zh;=Oy+s6+s9al4pei1LBo{E=fbrr+k>s-B^fghLp5dV&gvVtBlKODCpip8q{FQ&;K zPr7GU4fWNrwfR;BURd6y^|=UJ_GKLU1s)2ntS2bKgUU)be2=OxbxvscrQY|P;<8lw zxVwDU_=YYC3Lv#(Yik%Ph-{zjET`zhnR@grY}Js{QwX9AH1 z#3Y145(~U6`zS{RSn$;AxpM57l)(UU2&cYulz|a{hx@J?4M#btBlp^gro{@bb_P4} zIoBR#f>YxCTKHYWiG)>C_vQ(06F7`cyZvQ3|gp(=?!yzhRQh>eg7$N)x<<{mglwVKm z(OCDv)H1wwrsVl#6#4{@t;txBxi(%}q(u3v8!N0|H_+y&7cx{hg1S^togOw-*PfAa zIQ^N`Cx@O5-DtXudu($W3AD=I!|?oU_L3eput)K`u5(-pOG>WXss>56i+IRleM?N=eeq#HlLq|E0H zZr?uzlM?&{lj>@ssiaDEZ|+UYccnm!D5eyu5Z>fR3Ou)xVVQj(u2{*TdrT2VV9vp#@9< zx1-(k`I81^b$Z7=r~$7++iV1{FMa7&;+#Pme-C_ll=!} zOzeZpq2UF)GE%2{*-G^xT&6FO8Tun8G|yvzjg7%Rp^ax1u$* zsI~N`s!9#1sv>MplN~Y13%$3r5XWMe=%gEtNvVjPb1NAg!wwcD&WZQ#eofo@+q;O0`*}v+adS+DhCD1V{_N7!xA>6PX$*6{rYN2hLQ-gdq!TG`mY|l%74yUf)H~E zV-lt;k?oZZ^GRLq%zaH6t32{nZU3b~r>G3!;~S3rj;dL4NquTFr2hoXY5^s0fv5&| zw!rR@D5E}8`8AYJFAF)IiK<6jmp`}{aLB>BUl(pXj&;4Nq+^R}b%JS?o#V5(5kVx4!lU-t?l}a7hiI=}{NQ)s z6QdX*DQ}CIk?+mvO$=A60Mxv1l*I{EM$aoTV-L>tCr~iUrWzhUc9>HTE2B3`+4<(? z&N@L|X)*P&G4{F;wNhh$xrYcC6EfUvvT8O;*nw2mVVy7V_lm7$Cc9z!P5jYgnwwza z8;l!|aC1)OF&??9FnzToP|C$6MIgsgH4jS?96OVOED;O>>#1w3se-j-dY0B|WwOD# z4|j=dE^T`=a36N8-*DqE?^j#iy3+83W~xtqEUx-U99Cmra^s@(NTo=Jsl+3hs5L29 z^geBa=C3pu&s3;9_$J}A46Ki(UAbIj1P?AO*X=18X`p4$X%pAJ!_t&V(4a=kdNWdR z!fTJNNPEKUbzrfZ>6>XC^HIroSD;zS1#~XKL`Z0=UEdQ{@}IV+lj>-zp3&7ANOq)w zl~*t>gx;y@+etSOcBc9+MXJ8x&L=~6UsbOe^m`|lc@+F8G@}YuXD8$IU!Cy7dhx32 z2b~^<+%JI=n~Tn86=&kpigO%U9Okxxpib-^T2f^4soKzwbcjalAL;OMC0Y*Zg*N8ri5#YwkYxm4Hc6S-;+-W`O zWKsgWp-^VDW}3}zu!2cIkKTW!!CwbF4}~(Juzv(q!5E|%VPl#$ctar2f`A08Ddeh= zEKlnW_!z~KiH*%b7L{Yo5edw;1Psh z#U&BFyBSOu{9++8AcU0oo2x11CI^e+*9-}jVfjQMmbjPzxaw|%Qz=eZtuDsG#9l$e zp(LhJi0slNtbZL~<{+sv@$_&3Bp3X44n7s9sI%iod9oePlJ{7~hc7^I$O&KOEHjM_ zhG*kM19k(45S}!%*vQCQiE7X~7N~_`lHs=0sd`0G9Z};jbAhTzOfsyY>dSJ?EbcEr z=3Q)ZUaJ#N%4D&j9?P5N+9m~+hcn;0;R;TxhNf)RtQwp@M%y+qQEf&z5`kTUKk#D z#R$KEB3BM5cc8QoXK-Z)YJlz-)3u8U5_g~^*aaSQv@VvHH$^sjp)A_0)+<)uoH>icx^eT8YgTacEBml*j+>w$zOk~%2kVY2o7IrZf8kEs?+ zWvV+PFBYm;dUit#msdu&Mk{BVrxJKK1>^@O@$Y74s)?1A_UBl-x;YNqC+*~X!6|yg z9Cu}_c(hPkEz`!IiK3s98N>70nwqNPy9l?0?>uL-U^&JY;q3ZRhyA?{dnedS%>A#lBMIleKOB zVd)UZcr2i6feJxVfnEz#oLFtM;!jQ)m3fH^?PvFSpgIk|h#))#l%;;bw)iTg5jJAF zcEz(Ac5$+v_6l(^`ZqbZ12Z1?Y37QAeH-1EMV6yKh|l9?{gs3pwNscKbf#=;RkE5c zSuRAy>d~YAxP3|lx21KO9zB)YgxzFJjW|T-Z#20uZM^c1-Qc#CE0u;3@s@!8WDd@^ z#`73N3J6tlJ8AB>?I}^p;_Kp^PWEC`*D!lT8?VvXHXMEqc$2B30lI@lFSgJ*+`vGD z=H1xPm0>9x-h%2{w%~5|#isXnh@r2%x@1LEd6`*@>ktF6`p&dDi!TB8jPa?O^bIcFZC$`)J3?>Yu{MNRZ=Lit6%7fn=Vo^yah7 z&xAILAJt5jsBW3)eUVbsCQeo$C*fNpWO(|9@hPHB@r9rBy(kfIO9y^QPRaVx`Xj6N z-h!Ev&U8T zv)QV&M?HA3D{Ub)=^0}-ect&KcO%aLdc`-kY^uA>k`>($<>!Ku@2yqq(r-lM=}HaC z&7lTdl}fkcd?4aQAV|DrMufwkj0i*M4P6CSv**+* zdI`?zUHi&G~cyvcv?%Ifx2sVAy+#^$h!_WYD>o{9t1*}ZNH zDf9rgaiWtZee~|wyN<dSiOrRVm+c*e{3i0SQigGA3uq4a+;&g?yP_Rd1qgg2k-# zg861Y(7nnKeR2VweqE9}?dh_cFL2|;r$x!Q3=%l;FCY>Hi8}UqW~K>s<3sfhV;eC= z_6%Het$0mQKg;`@ogyF1+B6R`x#U7TR9g7Hy^gy@mV^C852Mj(^F^yNf7iAfPQP1v z#HlG0XVV<7=%8%FIXGz`!*hZ%dn+{MlLiVKT7cX}5?{PsARgXuS+hB+6+J5d zW=~B#qRq1`=jG-bbC-~^i%H}hy1Y~8N?wRWBc5T1etHr6ZMW>%6>Y^`@K`c#lB|c^ zxSzxz(w)!RzLE9l+D_*~$ip%Uvx?My+B-gNJkA+zP550B3NVDzLFoM2Fyb)bNoEOc zjpIR&2cZP}tb)d!3%zDPaZiX z#Z_d8r&b-Oncl7Oz7tOI#n7nm8{K*SEeOqr?o=%F>3i767u^nzbcxzo)>p#bduxt~ zTX-yjnHvOfgvGJ8*hBPp(0p=5mGEti?kxokaf`)aMpO0L{fuEJO+vSF!sH8$XbvO~ zxU+WW@%_mSL(GfID_><{HsTa_ynm}OD&54>oLIaX-HNmdfG0 zka%#h0!f3fmNKirvYF2!tP+yFWm{RBKQ^Ibx0)&FR7L#h9{xK~#~bmiw9@N%3Nm^6 zGV^S5TB>Ef-2WrUJ)k?VE=+53sP(hz>_VGAY zQ*W5_a;6Phbgf<=Z_LOmsX<3Z`2mXc3o^stC;*O)P?di$aJRT_hqvs3uw3R$tGj=d zQ0_?tlBuzaHQM=|sge4FsUi5Csj>2tsWB&(h01Mf@tvt5_&25o=aOaazT!pnHVHY!|{3>qut1V{zLti=FrX;p!d(Dr*3L-)FnYwkOwQ+qP{R zJKHtYR?VWl7Urdj!I z=G5h^Z`OX6BwDPyI*J`!=qk~(*8zwx$V=Dv-uyBZ5`(1STV^bBxc+bT=*x0CKU=1_ z{eb{tjchrGwJZ-DTb|y1ajOu~b~jZJq;!Ri|AU)wUq+Fh_U8SEn-F_rao_xqOAjl_ z`?gJFvxqt z+$u?3i~ApU5{^c30lPsq2i|jH8-3HN9vX(nHnd;yh{YxR#lZ8vb0JqaWcPIwcv?d| zntgRt1WMtnI({@s8Jf%zE1v?HdRB()yI5ve3MEV%h)Tdv)4FJ%E*mXylW}v!`pRbo z4^VoWwkEDjKDQhR(W>1FDtV2#P_SjRX}%?XT?<52oEW%3rqjcors*ZHWkOfEKSdJa z@lfNF_6e378}@@Apk^QK>b6`FA+Kjr(zgGyunxH7$qwqAdUHPpRkZVw2QpalnIG6JrVa zt1E>lbA-e$?Y_R|%^eOVYbWW9t(zB-7GeaNZMKoZpVsgwqa-1_9rkdwh7Qvt`!zs4 zMY=0SlSisg)`K`6#Y}kLCOlejL!g0ZKUxRR3`XV*A~ahyF0nH;3<3`CrgNc3FSLvd z4WsQXOjLOa=o}&uB#d^OF}cHTibFmkI*cUuXb2}CEZ>7pN_;*d767?@R*S;hAu4~} z6V|LFxNfso!*0hrFyZ1inTvQ9aIJV_8Rh@#VqRNCN|ba@5vy~DXpBef$SQCpSw9od z)+pQlPCKKhOr>}Tb}ievas;>;KhiFB%~@KtQH4B&>odETX@(?f*;2k$8ozi5$>y1- zpImZ^KiHRUQ27o;m!eEbI58V-b7e2)C-0TrCfwWh<3Uu&P zx}fv*ozpqnFC)WL{N1*I#V?lgBjyfpwxItpqpXy-s%#0p7d(aTeUncR?Ovv=JhxH} zlXaq=R`dugzDVHwYroGS9E5;Dz}4BKR%wPJYGM=KgjD8TMEUYI4i@u`Z@d&Xn}91C z{yO9N^embD!$|GFG18RIc|;t5`(oLwbK7g$BK&NtfF`^6Rv*O46EWzV%pWpPFdd2n zaI6RyT|F5aWofMD<;UG_a$lMc?CYGP2fHfs&ML%8+Ty45k6i21IkvvvO?IhmU8iq_ zh7WI)d(4v$bdj99uDv`_6`WiZArhGE_}VEFra637m(c)qxrVMfr3)2+U4_}w*3t^A zI8~~#uun_gkMQ35T^pWB-6qT`&q(C&95=b@gC1SXy{M)Qj55e&6yH6yn0Q0r=^c6k z;Tyb>;t!@@`UY#u_?~*MoaN`E8L+S^V8~nuA#8hZ>*QAS z{|cSUV;{o{^HSPG(*&b!6VxgZ@r{>>LeQ$+!`BjH>TM2O{;es=gXTklyq9OW^#{i| zRS=~=BSP^n2!-)dg z`ISd=c2o0*r=luS+&+sT(Xisv51ynX`K-_ z2}m`S{*z)oGY)+^Sz9PNuRM8qH!&={Y@+Ne;clMiAhTgE*<~*Cnj^t$P?>5v$!A0x zS^3jWRV{w>QbAP_alD}U(8@ukk4bmGjIIe^z}u?`Ze{Ua+=(%ZZ`T4K98WiK;Z53i ztHqK%Ec&9Jh^fqbS!on`hfrRpawlZ81Neho7!CSL$9Z?#|EII9_F@z%Qjn4o>(_?E z?#6*nBBNv2Z4h1_q$RQSR+G+X1VS8G1ZS`j3dI7=AIz~ZrfjS1Zl+(1e(r*4wQ|51Mqr#iOR(<;|VEro;L)>Rnyg z{p9D3PtJb79wOM}wgYkZh1>Qx>$$r*?NGxJzw+DKOqkXkJD%J8ZIO(|AeUJTC{R!( z$O6!jw(b`80Cki+1|G}6ejKegf$wen#KHgY(1Gq7~;GbAvM#FqCc)jgaJH`i*|67r+J5X#z`pko z&FvoVY!>ys@2NHkYJH_h(3j&q^xjemO>?B}C*4yWHrKqmNv!YTQ#5M@wm1kZXx@Bg z1Bn8wt1rVTW%(#La92d^Y;QqLOdj>FQz?2Yh(tC*OkQnAUzxU9V)JSuN%bk#xRZNt z^Nl}XmSwuk-?ff-`gm2#>dY$k&)P@yIz-Bvjt^pMh?f%vhlI1NJS&|Be z?3XJ48`d6s=3p#5QfVQw{!TurlGJ~)f1m@bf zu~evkcmuqn}-9%iI^wAr#*wY;k3`Qc#fVna5@8f-nLl( zjc9kaU~E+p_;v#7LW9$q`_|w;m(P;KFxnx1-*(UI8h3z|q}3v9?}Gq6;riN*?%8r& zJ-h+QmOKTdu5GA^^0a&%ZCn%~3qDgL|5AMO>Xe{4Vl*S1oOJyj(dIq+9?|aI6aF62 zM&x3XiTobXb|TwQ{2tLx$kWrimgskC{@)|ocApGe9_5}4ZSEhc32)1a9Vv(hhgJC9 zQKCapwpZ54_K(-Hd>vlfp^$DKPn$%2Xf>h#Mzk>i3+Amn?}=A_A3->q9i2rBHPI$r z#up9P8zD0@CyP$IA8s`wp|!W@uBmpmDXRBW-$Zi4h+Y#|<;iMySw*Z>JIgGfxE;Vi zT&*Kmy=i@dnp#OMeJuTiR@gr%1w!@q$JnW~ zqcsFrzLAXc^hm=fls@`-mcEz`WyNmz%pIc+9wv!(_l%?p#3mL9JNw+4QsaoT%}=M4w3lBQy| zC?(7UZ%_%m$ZHXjr_>dZ4jsdmSn(dL0E4%u!9+GZmO!*ku;Lnbyw!<1mAe5tZ`$}S zAj%TGHyk8XlE`Fig~|DaxOao@$a^s-fkYMDsj6k@r0g;GMEXv5pMN%{WWS~cwpaoL z-dcPP!rjw9tx4IEXEuK}jFy>7xblFB-QqbOHYStP&^X>p0)u&q0BPA}!O=!?3 zdAKsU3Aq-f1qdt=V^y@)a)>mT>GQ{E^X^~#y7q3FgK|dIIOSQ6natkC?oIf&{q#O^ z&0ZNjd`xS8+B<35QksC*pA*N2NHu`I5WGBs&Ch(#@?)9LHs|4T(fL2olAyh7W{pOclPY^FAEAYeurC>`e}>pnB3@O`{EhlrqRv^m zkpFCrF%&7Rs%cU?SbcCSRn^BY$zaUfAwz57WR;4Q{-bbskE=X|AZ(qE?}-Vsy6_i; z(@z+cek6rK9`Og@>_u4Rq_q4|Vn1omMP|mG7#f@`z2=ePec+ajJg!#q?ibx(YlJXc z7=t^tz+V01=;o5z$-+?dp7!FKWY^TwQo}tKj zT5kLOVBTSA(lAct{QWoG{~>y7gpN}SB4AODajoW*B{V5B3bn-jICuUp=z zIy7aA42=cao1k@_c!5jxeMkIa4ZcQL<(OOJT<8#A|EmCCmL@f#5k7W+LWe3omVO~;sm_^*JOXf9%5oJvF{IhXP4UmiwG`lLcr3tRAS1)4Ck`Vv zT(>&X{!JWI55z-mprq7SSk4#JHOok%<9z5SkhC=80EWQJWAVMTwBuS>>L2C!=QD);{mn(Jt!Oa{P<|HxY-vNx#R0)kqLtw2oTmOE47 zK}@NsLDWhK4uq%rhV76Dz@YnfK~iP{;rW37rXUBwVNKW?Z6YlRlR}G71CWE(^lQEru^N3XT%tla^}>M;>I}sSXK@CoE4F_w3@b;_JI^X%)Bk_@ZpQ;;{M|GX7hxLF|-RZlmZejop(d z-PmvQ$gPwXKM^`r*qQmLTXT;rX zjP%CU(}JbwAHz`tvVhFk%&9W$HG*gW1vZC4{JdC3{W zzsL*jpx06)ye-W?d8#Uc^*Ytb9_ST4W!-6>C z|K(koPcm!5Y8Rb(9A^ne#0z59^!1I2Y0jzK`~1YQR0 zG|l^jRN!HFQQthL)lRDg5dRY;x(Yje;hO5=Ph-MKX@L(nQzbm)!NI)KVPcw*!G?Nxwb(P@%rel! zq55tgoRKePYZaF0J)d8TCUZeGTQj5`13v#|Uy$>7aLXD!-Ymo{B$cu&+w7X$&)N$R z4?X~l{v!^MeXOvA`s;)3b_z9^vUT>ZMDd&Q%Tr1jUd?&~hTu^l_=GvkpJ17PAYv(& z7_uB-*~#Zcnea8P+j2qtyXpwohy%8b%Y=A1R7jNNDSeh*Yu zSfxT3D!0Eq8v$1w#E8uxb=YV{I!N+Hv)dvDZHx^;2)BAi;Y7}4J7V(;!tQl~6qEvj zR(62eirGNs?t#{>oNj9^Ny|k4JKVBQi}R9B&OB zSng6v_?=#BnBVKH>s)jZX4W2kOO#}CM@%-+Ed7|FY^af{wP|Oqi;wAVTjYWfU@sk` zJN*ZrDj3}mNcTbvYaQ%uNgLz8k(l4VqeI*hmozE zw`*EtfFeAZGNlta`9_(v(BQN)`+O?}&l43J;GkfjtH`rj6T~7ugg>NCi1o|UIBKZJ zJ5RP&*ZZ1LXEq=p8)=1Q7PS)Hl4{r1(B zvlbYFrAvLKyX{aybzW z;PUsqo}!)7h)234}rfVPSzZ3*$Jz)BXsr`2O|0aTnb z;!#XlYozSdq!DA8W5Vc>meQfHmGIKF%Vj zGdP{^C9!LQ8&4g%mrx{qGSQGpK5dv6@P4uWh?H6f8A`R!!PkQQ%GJr$5xmiRU2i77 zns!bv$?{-pDgSUld&NJ_E|!_{H{|R*9cZYm{MT?K@JwXp5(I=zKl}RUuO}frfU6gs zE#Du)w{D2wUExrP}{tXh26EU8`0)A}ij^7b3pTOR+-1Ad_q;T1*k5ieJ_rA(0y z`sxWmzsH4a#^t1Mr7j-fAA)@i`nb2`MJ{#yYQjo^g{~o=GZHSZMbC%9tKLWZg1ipU z!c-Pr*6lO%bGC!S=D-VB)n%MzfD?hh*4>^k;!XON?Nvv(Sm&$kYxm~SIHEG<#~)L;axf?yE&YIaI(_7k-jC+%{6n7V3{GQX4x#Po%{%Lx zt|o?F-?3&Ms-{Q$GQGR2;N(rc=B&spjNOT+R+~}21f8|4=I>>iLX4Xp)h5eZleK9z zzPQqjUgQuQ;>Gj>*evq$8c#Z+Cod(S3${E~*;-IIyKmXC$FCF3UUA43F^&67U;nE# z94HQb{diIsf@h-r7_fA|wcY0KDQD1wT#=WOb&7%xa3n{YWRZ#p`f*{wrO>4VEVtk$ zwB8=$v&!7+Uaa%1tRA%&A2-u(EROOq#G9OFmhRM-bk7OE+5eb{s>h*&PdV&qKZ9>2+Lyw2y=aK&n>i`UcmPe-` zJ<_}nASmm9P2u?9;)#gQf#Q*dGtZ($o!`Ql_=o+-C(82csbMkz1&7*;-FGMGD&;SO zsW0UpE8~C0Q%*NKp2|JP{E^4Z?i)CoSlXwKsOeIwQuIFu<)T$HRv+10Z>7FPTDJCR zm8Mh7puRA~g49hgX6=(28-HXGB*4^;+I+_{B5CjrKw)XOY_(z2sLBp|ksV&IWB+19 zq-#f(1wR%zD9meGEa^NnZrIURrYaYEOzNPgk00r@Ba9qZFq8BkE9|g#>a{m(ha>&$ zwX9fA0{Xs;X;q7sD~p2mV_d}ii>PLkNk7T}7u*;tn> zI~(*_0p(B8W-~_Gvn5O!PZ%ryEs8Q0w$XC~dHrRAlgrKR2h#n7sI+nQdF0c6a1` z^%RD$!i`&D7;6Mq{B=JAA_U7lIL1I06a+Vl8CAqPg zJ;5Tr=L9JGa&&XlfWF4N`F5d1^QcEtE$`W1al;7aMK}8WDH0z8Q?VMkU-FIc=HPpZ z*1o@FA#o9>a6-qT7nTMujE$ZuIoM2jXwF=Yx#DuVs z@k`6D{KWY}t?_k!X^8D(^L0SX)tN0gNT#Qg+g`yk{>sIg15B^hj>RMn@&?YYk{#KN zCOW>i{TwM{bfbBUfKqCZpkfy{C+CkH{#=OLYn1C@dt+-t{WZ!EEfgy%cRe*qeI$wd z{ANO-;oTn4aI#V?6Nf=w20z2)Ihr5WS9+$L^?>Vr0}mp zm#~ZzFUg#)K0z>_1ep~rXk>b8-idOKt3H<}ZJwtyD~nM-ZwYE(YEKDAa3VB{gT?w9 zX&`rJy*ZuTWUl^p$Va9KoRM+ z9oIXrO|U!xox*2dysjrr8HyPcNX1LJ8I=0BBoLn{P6qBFu)IOXXmmFU%&hY?VJu}O zm6tJMKPrcyy2<;^7|pewnB`0ZLpVXR!D}U_wOdMRdkS2iRKA$U6FlRNwA>it=wa&< z2j8uY0HvasS;5B$7-G0z@RIR(rW7Eo5eCaln)hd%xwBDb_x^@@6rpp@klWe$y1cw{ z%Tt6=4pCGYC+<3BPs$M@`6XT)my7MPL z38l|e4Dg?*k+c^4%QH~z)agoi?|hm#Q^uVPw;;5D zm+!+ed3B+kkQB5zICH>s_zo?c_~t8QAO0(USSyOp7$CQ`^_RI*ghIX~=J-5b9h?sl z0b)3mk0kz6OA`7&OlSf2qogbz+` z)t=|v;G|$&&OT&zg}?L-*_f!l55rGH063hqV0*LbT3#^f=g~0~42>n4H{;!;NJKml z`A^mbtwkp>Np#E0oq!-BIpH_G70e)`FvoMnQh@mSxRQi8&mPn7W7%pcgPh)oP zN+E_=XGZRw|2FnPZ5wTrgsLDAadMttPAYK(JbBY*ASd=E_k;TL`GX*Q#ti8A@Cr|N zHH2K0fM(?wi=RRVco!|FoU=P@{VF(D*+pGp1c-)yWmFFOc_T+1xD4RWdw8H-Vw?c! z*!^Mz1os-oRvz^yRA57q5{Q{y{Ej;AKt~#z@e{@Z32!^|l-cifqNIuVMc8dWQ$H|! zQ*&ns=!kB_fWXau zMbPk5gFqq3o|ZnS%e}Xz;b#so!vu=QOCZ&V0ZqK4wk6vsGQbQ@RO{%I75Wj;2wK$R zxO{I$ z!2u_gFb|UfH<`y7VgjpS{4Wg0ICD7ep=&W|s^G4cewaBNd&8@RwOm4jb+_F?>Bu$; z@2I5jNf7w17eE{`9C{!sJ5t^DG;*fBo72>pDDx<4hTN#9s!eZlEIP6LZVcl)dq1Pu zlOoU(U8ETD+WGO5`mY;8qI=>IKa@Oi9K!iVMpSZn+*JAZgEKIJ&rBsnvbG^GI*w#^ ztU7xOmCG0@5W@&E6i4oR;7nEy7WZ4eVJfNw(2A6x5CE&_!CQI(A!q@DCd8A+3$82O zukAGL&@v3UYL_diHPD4}{gs{Nazy2>Jjl|@rhErPQ4BAvQjfxBUZFS7>|7t38L`eC zGjqwXUDMTR%_ChC9vkWBp%~SjbyU3)`LNCs=D4OgdWCm|6Q~(<4b;_W&-_a$%i5e( zd(o>2A%HrCTt81LB>GmhEiQ*~FryT!|FX<7tihy30rb3nMmy5;uy>0zmD1ZrZ}UgA z7uNA494ZXEBUnb;b%o!~82|=@8ln(tXIB6G8FO)nk-Ky(5NpVEx@FIz50+pOTJzXk z7N{4}>6{6BvCHUa=GWzAJLXX3j|K+YHmeiwa=;|C16FZ%vcKZb(0Fkl!2GYUPA+BK z-hLrx^zm^6?6#Om!FaPS4a|7Z^{2iFeV+86N0REW+Rc7=fx)9ojDTi$JQ8a?(?@$a zzrilEO9l?YzEDX>OipdisB0n|FV=yFhv_aVbP`iFycV7TMnvzNE{!spr}j+ zAwW_w6)NBy<{pgsc4%TLw+T9Y4Rnx~H+Mah^0#69--lW;^8^1rcr)iG9*%U9M5QN4 ze6^ca%Nr(74E#ugJYV7bJ&*A}s|X)+COHC}B2|#6hXHM7_Cz}%vsGd8{wJZ>Klvw` z%Qpf-+OG3sxERxJvPw7JvGanE1Uzm`Z2$siPVQ99Md>Y38g~IY!q>SNy)y3?MHE29AZ_H1GwDouH31<@l z-!IS5=pnKj4anIElZ1+g^bo%5EWl-G%pow}naJdS(lYL%*+b`WQyH%OZQQFn^8^rX zji1p58hMh6Pt9>78Enhq4VJk@;6Lxtf;8VhNC`9U1dKPu$%h|C;{05N8#e3O6M?t` zLH%jFgVWs_k07kn`QdM^prSV^+nE&Z9pd7hY`}fU*aw#XRZR4V?r_?`8OSHxz&CHA z6@LMHucu_T)_C(cneZjB9y`yOTm!hnaLcA!oKHxRp?d*e$0tc>qesu+o4#<+6_iFh z*HFq`h-Yt`F+9rs}6aqs|&!u zt$|CrxOs@hwHX+tVv!|Azw|1RyS25|v<~JBX*eeHaNSw`9_E;zTHn>vLn>Q9n3IQ@d=H#HTG$Vvoexw;81f!uT1r}X-+ba!01nxLqe4%%}YlC9jiGMA>f3~BxduEuq?H-Lc~#1c08 zb+p_?Pv>djzk{8RUI)fqk3q#Gs!jLRXI5Dg-4o?yF(U*PMrmeom*j1Rlt-pLK?1cj z$&1KSK#^r=N+saT_IkiAaEjzSvv<7#CkWQdZ8iWHd@jEj2N|x`_~cM2_MKlUD?jFW zy61k9AvctOvFnox(8&dx`;GULgBBxNiHeY<$!`F(E+JSR+ z=gue?8xp>(V6qTQ{B~hcf4+i)XRa zY!byxQ9)gao0>Sw%@Of6A(NKTL|F;U!-H^eJ?f};UrW|XW5GyBy+h~^i!|*bg*fnt zIMCN>BogBOIm<*P@tb#RVLc0JiB-j)s=xEu?4mM?FQOYAdjil}!@k)U(la8e1|ZIupN@XroL?y`?(gZ4eqJx54O7*wjj-{g~C z8C`_jpHFc+-ZQJ%yP?7owp59XJp25K8fljw00{qiv#fbBH_63}a)!ZH#qulz!OMiZ zD?jcUCtA;B-KlXXfx0DMfv1yQYq!! zVS6IA{-mSaLsXMIfcI03P;RKr{pa6KQdW_E}F@Mgr0%3f*AP2Jux- z#9o}n%T>2R)v55?>j7h>DIYSF!6_0iEhO z`EI2G?KGuJMYXo_*t$1Fd^^}#n?T1U@CLCzZqhT*ODOEK7lGe$BUc~e`4*0bCqeGD zWAb>>*ZkPvN_3{xBe%5T>M?~Up?Pv#`JJYi5>A!esfmk=BZZfl+`}mFbC3d=LgR3v zxP?695e%C503~lkFIbjOVG1?UfVa#L(V{=ss^?a5Tcq@eWinqyE zKr5uG=gQQ(#9lWrsUpIg@;+wGuYVVPRZ_IZTpkQhC92QatNo|LIla*A<_T+zPEy)UH2AgwvC2XoV&m*CP z63>OkiscZlMV>jyClFX?*gNUztt3QHPW_(3#-zJVJ$ph%K9?ko10SmHFxNS4#h8ei zaiW7c#qT1$?BFD+ht*YMbW6WBbfx!U{PupTw{^yA_5S?g;mc_c*fpE*zD#nY9Jz*m zx`lG_QR$_B#gsns4}&&y6@xRdRbDStGKwoSefJ7{oEq#VJHqJOjigsz^@Hj>z0U?PK!=fP6FK|0eTj4zj-|^H3A& zCy@EBl4Owqu!9TV-LS^Z+aH{Eh50QkBf5$}uUX(FGQ)q}@N)N!Q|?MuA+|u>Zi)B# zEQgjUYiUmFhMLrplFCH>Y@<|Ze#pa;c(yW52Y2{Ph9M<8BuBC8`zM5GG`+<9+6VRi zsX$Hdh7)ZG6JNZ8B+N0Lbz*U8S(?PC%h${w>s5e`_L0G*$0Er?hOile8~gl^MTAx? zWIbn(zx14cuTZQFILOVFf8hS~_8yatOe#y0HRRs^eXOAq08@~uVs9M;pZqwq%1w)J z|Bi}#f3yS(#!CA%ulsircD>n{+;>;g_QUh>V4>WGPj%1u#z>Bt`{Q-4EQ5VDfRhWh z>p=%_B}H#z{l|={2C%R(fPF!BhHT0@_yr$*)9X>tB>TLJDbezPHu(x;<`Z1k+4}-P zwkEQE>sbZOa^9GOa01JpeBz2$@W1loE?b3DG_6-`g!|_p+K-C71~J8cy<5lh{ih!h zvWc$;h2kd^Ph&sju4BgWN?s8)?R4k?0}OIVxDZ#)WA?YB@FrVazmGRiTqsu#3!4xu zy?&XEqW-~nvhk&`rvGb}`1e|D^So$35%SGW1i>jVcABoj?Z5bV@c`Jao~O({@)ll8 zc8<>qiB=8z9F9=>=rL9XaptT7T29JT2o?;2*8+srbBL6v2M}uHXHJu{eziP(I_aN@{pK z6?cmzUMSQa@kMI-K`8I%(r51NSdR5Z`rmWb{d>Ao9bXaZ;T0 ztm1L&T-9r%X|e6B>stZ&FG>Dt&O`CBIrpp9c=9ig+(A zXDU^R5sN`HnbED*=}3-1N1#`*7o>w68NWL;E(O-pZ#$=Z4OTE#CFph|tzFHl$-Hc9 z9!N=|aKd~_e$UU%xS=?xE!IwI6ZIh_5FR=wh0xgx0^F!0%c-oeI!khYzLrjAF<^;n zG8nFn58eBqIZA>J)G zPFvdQOjH0!oX*fFMc^woM)P>i|0T)9kB@)vTECNIF$Y7h*{-6ZTHkPe=+Xsx{D#(Y z3&t%#W#K^8TD|%3igDB;8mgr=ZrmicsWi@ak~|FkI_Vf9%CbNBog{||FN-MOL%W;* zy@B5_hwVCsd)0^HHJC~@jpZ|v@vfA!TbvJIfdF;F>^;QK`q572=%2q z4-jV0Y^**e+3?|d+f((rv>8?ARZCH=3G=OHtmrY{17Zr-$ue6x_Ac$?x{ududoS?Y zaB<(;kFGDg@jD@~saRz0DiC+TW~UdbGQ_Oc_Lv&Vpc$6W>Kpag9m-(|#zPg$Nc!Gb zRe|7AI}2t`(}Tfw$4SnYdQh^ykJmiKc>-*Q@6#cxbSH&pR!CkxA=ClM>*Xm4?A|+n z_MX%w3cBXHQ(~#tpShuFcFpuIxiR|MPoDO+FMdRm#LPN~5Re^bay~QMY<{eEr6GUH zD6Rsa$-PhYqkSFMQS95txfsRql<;a~LO}XjQMM=zZPW^x2Yfkp{Pq;C&JI_E7njUl zWQ_HtPUO{1Li>T9VCi{s>nz@X4&|6xWWCE>eCYS8>!#b&Ogll<$5`}fj{Qg_us?_Q z<*q&YrjW1oCG?ds4CRG?_NSREf;1knCsq@;b`1EW5%#z#4 zd1ltv*8Meip065tiMR2d1Ho32Yp{H`?dyR4R_i(5V~K7wj}^JzmC&apoo0oI-X}JV zKgr2uk}|7|*8Pr(CPQCnh~xui)+#)$T50tXM;FE5bvq|>P^6AK@qpu4HF{m@l{^=e z<=a`Qq1r*osD=5rUMYM9W%~C0Oe@wP@`Px=%_@>OD+c=r=y0dE!(Fxp2JooAkX1_Kbi7WpVUcj(&XS&2Q|;8J1g-hRH=$ z84!+NTT5;PqEI(w!rR3geAVQNlSbqG8JUjDf=ImRRF;UnyTWr&L1#SaAp;TJ3N;Cr zl+=CC;*90=&!oGI>yv<9GIx;JASH$`f^{{XG#zC<$y+3yQneR#TipjJQ{{hpWl>#! z-H_XB%Vj)#?B#9cCS%|4>LCtPyyc^DC;e>3iMCcTHg4a9GS4CUDhQRPp|3-VZHAo? zyD9>6pM=hHc4^)+Mm$WOXj>kV%`d7ZbNR*2-k7?Hi@G#k3V=r^FVo9WVRr)$&a>s+ zo+d%`J)h+kK@^mBEK&x&)+<2D$@WtHQ){dkcX zm^;@g^6gn}DF+=gK6<0%>t#I#mw<5PROHgx_ez%*h{O5LojL{X09X+^H=a&zshZxU z3mO2fTRG~>fNktKGn{YFvc6nKBG-UKKg8}MS5)ovMEyq3g{tVrEs#MARSFQ_|F3uc zW5;>>eUE*h;Im*qZNYQGvct4Nw@&j;DS;ExCQV1=@kN>PBwSo^X(Te*8S#jT&i|#?o%@J&$Dh z9vXpM7W^OU%5OvI6WgZIkuIlup-F9Cl(y)bQ%pn_ESGe2@!1Z1>7T+UKOcgdItSP| zJ^7b++F%j1)M;Oz8$M&1`Q@>JzJ>$CWexx_M7B|GhvOv)C} z;C@TbYaJgTgTp9K=d>7IZT_!!20%w*ATZC5bzXB#iePNb#iwM*AEuX zpzlKlqhrUFB053a6sgbLzc?tNLq{xzaBjno+=wZ(_pO~!X7-Dy#YnRNMkmS0BWn$= zDL=sftDmt$wL!k?XXX#ZaCd{v#0`SaoBjcRDOFLzI^vS$8tb3`@@H*?KRp(i#^4;* zL+JmLKO2QK7N%?mBNGF5mY3&9u6+>WA;6=EDC*3bOH2B0F9qP8x}BHo|FQ-1@zZCz z!JBmbSt`~1m7hRv5c{oarglDyI?_;9PYOfHGu&gIJNzN~7DD^bD<*?~?35jY8$gu# z?Ho(R=pcG;?lR|2s!|HUq!(EZrqmlRdEm-_%qXUYg7by`Y!U~^2&fuWH~Tx)EK=8B zj0rAi2`uB zpsjzjq|dFwwdJE!qI)#sv_AZ@Ydli&R#7VD8@|KC+&-O`PU(6a56*~9(TP2%HK7lt zG}=ap^mR7^Mk4o}2D_0;f;-c$LASND5~T)JZc^AIEgLV)$x+8vR?B3g?u-13vuE(C z1fInI#o4L<6KC@|(fnLyF~cA9=-!KpjyKO-ooHY!skceaNP0y{zCc~H-B}V@LOIvF zaW`30F2)_OV+(mRwsXD757ql-J0l3RV87W;JV0T^@d~K&?;+Pn_IFIK8fM||^Pekh zh@*dQ=NT6eQR;K(S3)hxp5*Wtsm}B&irzL;rU@ObYjU8<}PH zt$MCUx-ju+j_I5b>v+_pkuWf}98QKlZCQZ$ufcw+o`VU)dGAAwvKp;qgL{|)e1FIR zYi6s(b)W9@`)_zK0s(Lu5R@h*>ctKlh?}EXKxx+7GvghEdo!5FfDReV=x^3D){cJ- zH~ev-132)5KZpj<++#P2ZG4$tTjZQw?;+G5>E5fa8GpCnu}0T`^nQRwwS*!9nZ|C)eg7fP-iU)YQ*DrUpB+IaRh{M_@Kr*IVHDI`+&mI6=!pet zx5{^m$Q{1E{SXK;Z6qsxS`U+Gh7QoV=E(2M?HGv6a5}K&IBPf>B1K_QG{>3be%SFG zL&JSjd0?mhqw)X{GI?(ee?TuwXAYSbDXD~(87vVDICkmep&YT)>;-1?uN6DspuHhB zFv*RghuW;6D{|B7P5Q#2xcFhpP{*=)^-?%*88=?wK7t-Ww)UV)`!m*=@n_fzHvw>A zTQ^1%?OME>bRBUjMlT(x&x{INSq}dFqzydqzy!gxMsP5Eg_;8F1zwGbh%E_o2SYyJ$^pLDlQv)(aFg`~Iu^$dSs{Qo4eu9SRwm|P0 z1Dti=fF3Te~uBPr!KY{11G#GO!Dhz^{1Jcl2p_dQ4AJ(jlx&wrTdA(PJUDb1>c)ZlQ zXPEsY^%m}4pY=?Pxv}WUJnjeBqGv}aG}v?A>$IY$#aU)IfuPJCxH-pLdQX<{Q9gh3 zs*&QpN+UM$9}9}JW!)y8X_=9_?x^a5f3H2fFTpt5v_#YjOX~Xk7mc%Teq?U0qQru? zPFZ#~%=P|7&H#YkZFw+hLCfl~{nrv&b?f%{0=l8tX z@2>0RIcM+vS!)%7nY8z*51Tnf!-?C)aWJ(ZCN0qOP=yu$Q6&JBExT(YXI1I6G> zZ@P1Qm1>51q!??z*)~d=DPB8dana(tzQ6)=zm_$x;GlxP!!NSdFeg3~%DAZ?J#)n( zg)-(c^VDCMfdZKl^-<;jVFurNB)#3C6h4C-a+K?Qj8Cf3{xMK{K}P?&;S&`4QCp`8 zVvYV82Q6m{%E~l~8G5Q(>17hQ zv8Gb!MX|7fwwSMN$D}#vwVvA*TfPhOKOQEN%{j>*%L}5jg=X9E)}~}>y;-;ccN#LM zDP}nhqh_QvvJy@P*zry)Hzu=m3`hpaCEjjW@v#LHRF9B zAASu>8H28pBEw9J_5@Zkw`)+m4PwDAC;7KG6^3X4F);1KpnXc{H+vtiS1ucq?$|`{ zBTffyfodB0Y%NIQ7rlTE+|#0-LN*JippG;m~! zBW)dD_&7I}kW(_pN*(hiy=>>1jg$ZMb1eIMgrT5|1o&%1K=+e!7XF5c4QD@IKIe7( z;j{?^I@+RK1^&z!rb2=@IpgJ!-as0iIxojeH)b_m!zU=l0=}xT@>WE!%SSGW!~a!d zaa)oH|EtE13~nbCemJU)GH=6Z|J!s~NUoHTaF|#tBvmKncj}u%ZBH&u(RYAn^P^zW zgMXmXRb$eH=kIH&wUtBsRFFda{JnMS2W*aauz9>|q_%JR9@|JEZjBrGPhoX__i07< z(2M;F&bmMyg5ALax3f83yT^=;liDrzxMTHIUHsFJT3HtG{tUB@86L#0ksC6M*>4&t z3Y&dyTQ^tw{JI?9@YCydk*E10#TNcX9XI`Mgu@AEQBnNNTv3$>uB|QMt{aiA1DxpW z`WN=R1rJYtJ~PodZi(M~!s}qj?RgT#x~;Gpoq4cIIXGv)$OI*t0`z9?@-`CH#i+4XjQB1AgJ-NfSRL3pb=2+ZiMP2VBy-G?LR^3h#O z@mH`>DU-f5w@AN9Rtph$O5iE}4NBEa#OM%SVx2N<>d3(bKOIf%uKc$KXdoFE?mr1V zBI4-ZX_(d8oZ=P*U}IeJe`pHYwC*XfiaM+<8fPRZ?8U5s8$I6Cg2vMm?F|{<6=#UY zUH7$A3zpItxpVf=m&Nq3^7TBtW^`2Gj+Vv$Z+SytO+b>mjY78O;2x`=I3;5hAlyP1 zSo&Am>~mUBoB6Ci1pInDe66%292;Tga!`!d(DSTXBC#CANa4(#a4aL4htCujBqhEiTBfb6?cE*@S|8w3 zD1dj1(?=LR3YaFd_nZGMWqFYNu(pc2oTu3d=D``}>+UB#tJeM3zH1ZwR=jR4VPv2( z##g9tr@F|HPIuBqA-v2#j;m1{4||t-HlM{Pp(Xvarj4SF&?YNma6ldUx6CRfG^VD* zRx%5py|^+K{NXam^j}d0b}3^f)`k_&E{;RKFSOZ82OufMLZ8S-`CAk7Ao&q5Jq1cU zXU%FOgcv_DAIr5!LOM4D`=`dM5+q0O2iuYu@^#g!shL^+&W0)3ZV)}m8h4ofz~P$A zUU^eg8{F5ao#z@e%7iNhSEXyIJo2$ZhhQ^aj0mgLwoA%akCey+6b8VFF}ozO0*lC3Hl-nF zn^KfL<}SEAL>sm-;{uPQ0mCFkGFC)C5LS5BZi%U8%avp+JDmvDYwaP&C^Th^2kVgr zFP&^N7#Ve03Ou~NPcRxKKF6!tZ5|LBOJ_ow$TRGPb-Uzz zTuUw4tON3@d8>0#tVV&EB!YUs{usq_I?KjyA+7j2c91|l9V$zVVhR)Mv3`Oljzq!O zZp%KkinohhF-${h2{FLa%m;CB)@uaoHK|Y)`Vo66?_ku-$a{{H&_wYXg(}yXj;rd& zHO_;4`&a4kU&#*lD@D&W4K3o0vEZHYVPk+0-ZetAz~uXM%7%W_TAUve!f0M2N{rSQ z6tFV3rv~i*??{oaxeWs2iNCjtO3}A7>==9G73QRM3b96e&MGCu{RPTNza6c(y*|5K z14{A$%4-pBzpL;b5fl4IxQ*idrPJ2S$YfTde&=<24WDkQ<>gOmiWm)qCvMz!xmKIqe#scgX z977x^!U3lR?fYN<7EV*N&QXA#x6}*iM=>If)+91#!y~WG+a+Ce%@(u0!dPYJ@X6Af zPj2BOR@GtNVTk8#r+xZOoas^%B|VjY)v=iGRb`s*3j5sxQh{}|WAILB_`UgaU@-t= zQ=u<2^1g{K*dAjUlXwQwucK8e$e82sEn~iRBZy*(8+*Cingpca8%G;UypRG5!^;-i zJI51!)~1T4qiFdNQn*&T8`^)Dp4dC<@S6PtfhfhIi5XHMEPoS7zKi*+%FjD!^r+l# zAahikWIsgH6Ix^OV_@!il9{qH-~b7tpS5v?M=J;GjO3k@TaaD=>mDsNQp3JfLwFEG zutI1pN~SCCAB<7WQantALV~H(#xe=g*cC!CY2o_6J@zisgoheP(c@l*zH+r-6Y5#j z({K=OM7b7MFp$bPJ_2Vs(XQV}+j&K_h)KR#g;N?jR>&?3f&zU{q+FZB z)il#(V3jn}H#ErpPzwh*FD_I(kReACF-3#I>CFc(T6wB)iAdAH_k z*rE^|OcuV{y*rG%BLB5};WfN%bqqyO23(#n+!!9frHq~o<{O{N+$$fKPt!y1<@z-k zynH-n99qy~hD|`e?*fE(DCDo-$?7r;=4?uaZj`;Q7?Fd$8S-Gl6e*=zDf3#->bq(z zJSPv@KK?)8;6-h|I&YKeq_ALp1o-1gRTO`P*4IBjswVNJ5iqr|@WT41^zz69NB>7- z^zabGKS}hUl;a|VqARV>8p(Jd=vN3LpXCj+6d&<$!5b5h2bXc^_T)r@t`+OO&LvjSzQ^;)|t#}Jm+af zuV4of_;ZYDUGlLS{M;#Tw+fyG2wvQ&i{B=ph?ao*PP7I|LsoS26W*n7K0_%{xGGeP zQkWdolI|toojqT}NaZ)>S9xdWZ|aleWh5>vEqoNpxtShG@$SbReU> zMq<6Y+=JvXvCW2nko9gTSeB35>FB$?O4x~H+>*iW3KLU-^h<)$>@pGzQfxQjHof;x zktLoWi>S9{0iKa;?V^QvyWt8i3+fr{^N{AJf@|7%f@%5wfpCVzm#A!_dg0GpTfAx5 zp~7Wg-6g}Hix80uQ31akE_Us4=)%>-HqCnOkCUa#4;8#`Q|kH(;`+1DTXlb%WZ9g4 zg|d=Zt7>e4#``0#;CDLK#g4FD_#l|uO_l8>v2)0+Z(v zZY2f%d-Bk`&@hqKIKx2cv`$pEFP@hD`8AaQlz+ds%MP@Au(PLhOftd^BaF$~&i-vX z`CH-QHjQ0fWr7Su2FJdAI|!3bLtm-Lq=CPXH8H0!Rv=yUlg zAhlf~mVis9Y)#2(+XkLi|Fc1<14z487a4e;$-@+$+eF0&?=OO|8 zeh~P10aN!uY8guC5=mSCAj&Whq-+`{6(tyBjQuwn^Sw>Jgmn+cFK2mabcb~V0DYn? zO^KUAdtiY!!8d`m;LeJErG6U$BXXpjlT9mTANH&f=E|lo+p*{}n>Dt8LfNEZ3lAcp zvw^bu8i~d%eOWN?w)S;4A-u>)18&$z`QmOl*9zVV65M}-;3OYX=yS2MT{)I!Ls za@5edJOa*%M`yX0y)bY`L#~2R61r8fP}=UTKMmc@>2gBh5lbz`jvc*TTnNz_O|&4 zkLBCYzmRrUze5M(k1HpgKNteeBK5|T>x+Rkhqm?~-{=|##geeKP^&!lH)bW{H^CLT zn~~GwS%$)~Xirm;CQwj-`%H$Dx1BxFObnnkqCK_bi&r2$d4toIp8xNc%D>EV53NeN z6X%?A9bA-y>8LJ{G9!{~`U)l+-KHaFN+w7Qqf2+*uydb+bD>P6SE?qU$s5{P8%3WNILQ==kPI2+OS)%C-=e}7V8jqUhLR(JQ&YlapX(fBHnsN z4|nU*3i30&kP0BCGLJP58m)ZHi4EmZ;KSti=~M)_xC3Evc1L2YV8Sr@m3+#KV5sWQ z%Mdk*Mz9H1>E1hO{aR6)Cy1F!OIq@+-EPuWNQDB}-CiRzMdo7dY|I0ldKhdji4^EF zJU>qAS1`vEt;+kdb>!_(|l z^PH^=pXDt761qsa4jITzV&@U_eX8TPS@sMsg5!~*Z-C$AIin~#rng~s4OG_1@Y|R# zsuPX7@E{N~0FpRE87bOVZow|CwCH%F=09DZ17B6WBUqPW?4-!+Mf?56&+b=g&lBdd zAOT-?a;ktOh-|&6{)b_a^RjdSeo9)5_W(}N%wj7b7x><<8K^|)TbN(1aXFMOEt zth|!Yos!Hs!Bn%5(2aHz!7%7h6zIS+x6m)(FiCavf=Ngw_MhC)4_)ow?RyD7Q@tXB z@l$@?p<)2fALi5}f~7&py?*-qVR~?gEfh;TCxd9V8?Unuf^4*!?wstW;0x790cEFj zR_j4CgZiP?S=3ci(_NbumRr(y@eWToX{dQEf7lxqTQ#&4@X$VL^VK*X2Q+BV^Bhj# z_s{QS&;eC$;RdnAVE25&Ql7xHA0_M=Gd{P-i=zOV6VgGzAV&qB1frJFgt8p5JKBSA zs*AQ27#lVv0|Y;_0lmuDyni#JJ+P+_*~Zcz+!uondPwg}Yxwk%-4_xWKrP(Dip|3x zdhY}ucXDGmREy(!;kkO%7v>U($(@Gw^QsrWJv#LMa@mVDww;GzsFqfYE_&@ko13WI zMHtY9JSjHINg6jIQ{EzCL(IEG#0X=&M$Y`k;*vU4m0z#8zv6%?z7O*FUPGceRW#m; zx(J3vZ#Zn2d*e1iM6W*#y_WKa4<9_|`tlEtEaJ#j?ks31VhSRu@5qq8oRc5lokQec z_==i@y@JyOI8jLa%*60fT$geuQ&S5>DKMYPI&j>XKkDU)#G>R zLd|{4&NCEkuWiSEoDDyP$%B#o`S*ZfwT>$7j_A#hVdK;iB9voKLYJZ@kxy3~%U|*{ zr@g_g+ZQ;xk}W^)Xh~EJUvfj?6j|tPnsau(wjO)((dHe+)*RiTRNqAv^*gk5re6Sj z{jrH-b9$3SUzYyK3`f%KvdKt2b@FFa64PJ;pE#rb{Z>iLGMZs+*kA90rVn_8fBZgB zalj`l_MV*W)Zb+}-0FAeYcDxxEF?kr-0#Mg`u}QP&*9CCd`~c9ga$O&z%3RV`X_v~ z&`JelqCLOqf>9|%YCe>lKb^G^j&K0C+~eD+gfO$WtVp8REh=HxCz*LrADmGj^nUNC zO0q4)w{&ExdC$9{QS9J1E0><}y&XNlQ94hMHTDJIGf55rv5x9ON_`@O8A-MgLADuo zoYw>+=&^uxc&Au~cje?ZlF~Vn+lspBE7<$e{7REuM`!&$fc!}Mm4-ii8w55iqSzYu z%~WLkL7RueGcKdP9U{5e@G4kEa}dFrYX^|!P@-JwO1 zo0E4fzidTW5YaMgN1C)9c)YwMf>*$VifC;18j5`+Hc?AEoEdNQS3Y`te5B(5-3VBA zo&&abRDiW^ESt#DKFcqZV96Noh#?gCIlqO>!PF21%!XXU6E}HlI7Im@r z-WYpoELGd8ezR2e`|Z3T;b<5evC?coTD@|=d{Nrp!Ab@J7fiD43ogs|pomX|RY}@? zwj(L}G`8N{@rnF8=`HPM`UEYV)fxF_JZZ!a$Gql#!*!yZ#bO}4t;jGZ?@6Dn0W79r~g>f-AnjD46(+L zX?R-{;({!Dk;s4k04VCa5C7tzT5*8gXzd>|;zYsKv`0hVGa8i4N)4k6^OdlNq3wuch%l~cw#rs z7s+ECEi@EjO?gtCzVzNEsLokixRKHsv93>Vnz=(l{nn-R)SwBzjcnL%HnH&cO3l(!Te@(n zUnzU#4||<@Kh!m6f@v*{ve4OB3*Br!+}GI*)HIoS_!#q8Z07Hkxho$JG|VNQ$`SPg ze^k*I(c>b+4>Q+;x=bl$WN{YIh4cx-nK<@Z8J~gVIc@d(Wn}eBMG6G8sCyV?L1xsR z?gx?qa4sIX`tlL}>?&$H1gR5kn}buT`@Vg>H%&0uttl<6>8E^~Lv&T3%C3!O&*3Qw(aGlE$gd8I z@E0JT#$LBs4*#mi+it?mgQ-7(?5WCT-2>cz9Xl)Wy^TrN(d3G2;9e|Jt%u%eamhMr zSEWc`Hht=4b?>d#stmy#wU`Ru>T9P(5F$i;|A+E^CNqJJk~X@w3ccJS^;i4;8xOI< z8Gck&;S$SjPh_3~=1E<_e9akae_Z$O=O}Rh5Vz3XRh6?=4(kqs0ncH-oPiLrb`_;A z(}(me&WD`jrxBx37uFR-af|z}QjlwDC|S7YFAzbjnq)Cai9>hX`Xyh1K zyaR?c2!RCBGL57g4;`=Ih$9J$+MOR~JV)c?GpFsg`fpq{yMR*+WhwJ9ws3)W0}UYj z`3vpFyGM`3b7G^kyCC!VM_XIsM%?GeqYnQJYb+f1jY2jrwLu7I_YEZbi z5iX~x$9-ieKJ%^g*((e7(~;1vuQiCQ{i_2hgJb8fFMIiUs{2e6sqAnqRF77^JlF>oNy9gtd5KOPvM;E-HXGKEOoRFY2!4vLAKv50kOnl#mB%S)D zUm${g@nmq~FXQiP`5m$Y1%s z3%P&3S4Qc)Yyhd|WiUYfw(|0rugeUf)o*ZX65gI!=IOX959wH)L zYluaW0L^_pV^(9x;VkuS{NeglLtur!`(^2|Z37tocDSr#?d%;3@2d0R6~wkKk=PHb)j05 z=pXJ}sDu8%8^5ElwPzY%-ai>|Z?WZmyRp1j{Yzs@ic4m2{WDk6XmDx%)aayW^X#Wm9pf_;iIQ z4N<%6WU^KaO$lKCxG;OKs>V{O2(b*KyE{N>PX_hg zy&JaGTd~6N5nrZkLcug60n8h2jjZgX%sjz)18}AIl9excrTToy%K0c~{`7AkuzktO z?ZpSM^fr&8CXd=7bTngOa527x!4YjS&yoBqD@w#h@&d@c)l+hWtt>F`@r;5B-)q^C zqM-0UA)wx$@4J4yw8SGS4J9Y_; zx}!7$9h){_2<>zwA}?US%-a4>c-|H{TdkAiJ(&E3YV+}bmjTKx&*RarQ##fup7}!Z z<_i2?t6OgH>&2C;jcy?1X>v_KY z$#Zv8xDexNU_9XA^KoK}qK4};WHA9PfmIF)Dceh(ajZ@fk3YZl6u_{c_kFYog#6|;J5RoV|Sg?wK614$wK$PPu)e}5x~Cs2w}S$AX@MSrf|(F zJGo~!@+BLoHR^~4=)OUt8*VV-X5-ro@k{;hl9kIZ$~(m%K9am5ufu^2gL~L=0JGkESI?E;AIUGQ?C={IaB=QL0?T<1fTU5{6Y_a zFz{I-GsLoVc4`grc16gqDcDgHnFqiA4Zo6xX zFjj3XBMzsl!*6iCyUbxVjm;q;V~TT2J6W#pJ{SsH$L~!GJWbQwtGlnX(%)SrG*(;%#J?(3{2Jx+UXKYiOW zZ*_pNcO+=vo!J;U-j%Uv`JV~BvD_++tpKmu-{eb#p6i%aqN$_7HB=P-p9melNL9lB z!h7MgAdk(+)gq;z<;&jXsQD1$t{nA5l1_kYJDR0q%Qp(W2Wf0zO@8lsmnpjbyRm{r zV}vo7ES!s=&tE`?<7BT@ddYS!}$-<^>##ZpcGYL(q9C-^zWTC|ptz%8_<<3wTKbA`toAW*2k~PEDlD@Ut?W%{ zqGg}XrL(!^&G`Tgt+S*i)K%BozWp`PSkGnSl^V!fn{*;wjeg9$(TCZd%S7>}<5%27 zqm1vEbQE<;e(VsCYT50F%e!6Rx3+9=vznSkp+D~>_Laz<4+DXv$&G0*@Lu9+d1b2Ls!3n-gpOjC)| zA!g7Q)tYSc2pD==!{I$}kj|9-`DMemFX=f(;*_WwUgFZ8MHNn2u!~w|FXUDSwq-~; zeJ-yJyj+Y6+h6NcJcuN2@Q7&zp$Ky`BLns1>tytN(8YV-te)sii=mqToamM5+=~_F z4GYmtX~2J&0f)W#UY$YfNJQps+1lJ+2CNs`Zhqc%{QzH*glyl>O91Nj4Y~K$1Y)Wj zB&+#y6XJKk9pTf>@8D}K@$84Lv73%yuM@F%TDhBpryHBnX*LD~$Rj&HY)=R7BLU1@ za?LHmdzkip;p(kUFNDO)h%fgD6*aW*b9h%f@G{cJDKLHbl+Yd=g88^!aH4;3$8;C7 zcyKv)6IB5qU0w)Gi>#O)Rs`e%ai>Km`^)>2=n$+U4dKe*lMQS8wG~8Q;@cAw_V&TUaq$c+oQb=XK6tq}*%ONd zpz##DyD2~Slt-HGv$X5eLFVwB@{6Xuu*wxG4Yn)$_GX2|Zo_wf=Y&1$al?=Ga@gk6 zIiH(Kx6Ve;5HY)*Gb7~j7g4%TAI~2!X`k)l&p(;qDq-RJLv(T4?mxg;q#HQpl|G@( ziR5Ja4~qNl^_YE%4?j8hc;ia8eoN610V|&C!;htU-_dK*{h5}V>3zcd$}~)-(ngnF ze|2j|soTt?bPq{yOSbWltI5q_`g#7woVd!(RptvVb_XB-O>^cpc^SdPTRjQCV~mw0 zS-Z|$G5F(vXC5(d^`ot9SZrPH1?>7Ev_nHN{xO5^xV(Jo*X_ksK6>TJy&iV#0^dRIf2`$%rK1adPP-VJ zqc$O#m4NRf_!d(bv1@lr;gg-iQ{*j6N_a!8JRy4v>dOB;4jilau;kH54|wI@+x+HWDC1@7OgWvm(;~Je&AD4= z^7TUwqImT&FZJIsZE?W*=i~iG7>e-Qms;KW5vd{~=@$DdRa1=Lgd7|v7P%T!!#TqW zw&OijWK>Jys9I6L6FJ7nuMB?*#~YoT%|9 zr)%&9;{1-q+1Nb(aea23>0jkz+MnOvQSLF}NPgxtDGK$#b&J1jA$wc(AC!>2U$%KY zUM{q7e%<{H!ztUcvvvxlon652ijX*EEej>Ckgqcp{s@fG;U+a!*X-H4yjB!VNo7^X z$$qp_JK9Y_ej(5;ixQ;3d)(?H6e-veDa7G;GJn8%X3MAY(JDrV+vgI;#>W&Tol+670=2m~x&>ORQ z+aR7;9GEpAtG)BQ_c}0x-wi&fl*s|c-!2kLzuQ9oKFVA+( zX6qaUG$8+|MYPqR{Hl_GB%fBt{&iwTqUqn4S6okG1H%?`Qqjlw ze1IGM4{)#yg{?udtP!%UL@2Za_km2U*>fsJUmG?i$VHwAi)GTy(XtPnm`u+q%!H*=5DBWk|ym}q#yZf9u0`sL_ z&k$vOE*(ROINZ`~GZVdWuiPLP1D!Rzt8W?lp7Im&S+!f0L_hV>^f3(Jb#mHH_>D3G zR7lde|45fHj1u5T5ixhvrqmKbT&oQ+g}L(re@@MLatH0`Gy@cbjZ4Qz};ob4p&9+jj%?Q@X!(q_n@Zmo>PX;E2H%m5SZM2 zCc;{NX2VuknDp3EEnD)s!{>1B;?#0J@h?9~FfjINS|*541|=AG@1u8+gQmzWe}ut@VAs08OB~CmwVgYJ@QVMHm@Vl# zY%|S=3OgxENP(HPL7=icwH^rvu>buN=0teKX<|aAUF_~+Cr4wKPEJ|a6>Rnz+^F;9 zHq!|4s==$j!j3^Bah)Es!@rWQ$9ue^5!~OsJG>akC1M+9MeF?lqV}(LV;4bSNd62y z{xJKgJ+${Zgbs1-1yK;1;$x?~;B2G?^=onhtD$KCt3}pAO9r}WV1mvDs6Do(J#m=` zU13ju$~)9@Os07>&YXx_bk=B-)X=XufR>f5YQ5cg_ec}meh^MDkF6!Eqx!6^R7tjv zxaJg}Rwx>M_``luAwbCX>>noli&!KXR9cG$(^~g2sJV{vCk37-s|&-3CoANOfdiU& zJ}CD19^N#&M4q3ULyw^VfV?wCWPg=j2l?l<=!|-U(ry#^nk0)cRej&rjnE^CP*5!P$FHmk-GqoipQv9CQ~xzvD|eUwqzOr++Z$Kq324X<`)7(F3-BR z94pI*@T;C8X#ARb5wR-sJ3gYk?vYW^Ixx zQ>RXI-}On)v!RT|8LP^#O@_?u6=NL{L8n_NS9K#JkyEvKVIK)wt@yQ(iCun`(_M~~ z5ipa7KO=d-fh`vt1`bta3Kg3psdnB-kNP5Y|2`N__;pckahaB;6nt--?mCK?ZVkqD z6lcz_)DS!n0gKv6ssm>gkIB4fI*J;$k7i3N8hzgYc9k=kt#m>7hr9h!4KBhS8fHuO zlAmVhKA#Id577)4P*ayolU8y3PtCWWSo z2-a5L;~P57=UuW_*T1q77@P{&Yjf|QIGbhXjZ*5|URJ?HjR!b%627`*+C5&9T|$6% zm&b0>Ouy>~;o%=R7$OwL=7!Az6JKpdO783I^uc0dRk{pBzm%#Fih|X{%AW(S&jfk} zxY;hi2@>oFbK)gQ!j`JDjw#TXbVuX(C(HaW4{H-5d78?XFq3ee3$E;mtlG8=4n^=&z3j;RTjl6>Kmxmm~+>&Ez;vDo6Pl5{EZM>4Cv#ivYQ_*J` z=`2vv0$(IWWSNQ|m>`3nq{3)AAab&GAv@e^Hk+y292rIm(r#%wJhyNOET~IQo#y3j zoni4C1iv8}V~ctWc!UvXhGOc>jAR*V>LF@`1nz_BX|=SlLcTB&f6K6F3d@c^TF!%-fJc#0|s!H1JYRc`4A(dANMypq!$Y zr3)9u!Wc#ceM>p`6lRwzKgeoG>fh!Ou0MJTQvQizkpdfd=W@j}{T^+vSs8TJqhFOl zWp1QG{uav>XBb1GjFV#t6^KE_oNP?czAI>XtA7Ecd2-zDJV^L58O_A_IuISi#D`2{ z;QiPc{S3VU-BVN&{h;HK5$3?ooW1tIzjol@Gr61aif{HBL!(m z4s^Jvf)m0u&REIq*0{~i>|7XfcLIGLuwY+6F|z$p7W<ws`)Yr!b$WBQdr}eW{c+o?dsOqJ&WqwE z5rCG8@4={B4+1u1H}Q&z5w*h#XMu%!j1cn9JJ=fbs`f*@$MOgijC)UE`j6F>r!&GH zPP3zlupQZ6{I_mA8ssOQS0hpqX!$1Y`NZ4(2DwBvxsR}tQGRL1oaFYC+^uB76E9un z?9i^H$Gq&cHy0hpOCTt3J-;Jg94mlu0a#OTU1Dc_@Au>*5w%p1@l8OoL5Q3W|DdZv z6_~YAgxZ{eRJ|ppSTy}sJF<+>s?LjY_%=a zidcNGJx%~~TKmEi9bsmzsS&$)f6jC7L2$X#*H*A#e7L0+`<=RY#-xMsf>yCi8b~ET ztckKFWt2mzdFQ8O_`l@ASN8w_kJ%TQeIp58jfuVaamx+!H*T0?aLUc=Its4J+%k5n9`6kX)YXRwtEfjkiCl9~q=dWFy(_mRloNk(bM1 zHiN$hB*jiK#sO{pY1vIr9YC?Iy*26~WaUj@ahAVp4T|(b2zn8n>Zg5?&d1Y}#fXR4 za#MS;?}Xqvr4px)*zJUeeHq2U;@?cH)S+e zG&8SJ%GvyvM zt<<#QG_r?c9;>mQLu*t-!dmPM%Cphqrc+Yn$sw)(-iHqU1)vd%-`cSFQ&5>xLrQQO>TVwPNYXffMnR6E)H_nTvG|JU`4nm7V8Z2qSM1X4Q%F z5b~8J8MAUzs-^Kr$;+c^hBvq`mZWIR2f-iQ#|AcC%1j>qlIY&+n9_XdxO(c z^-Zvha6ZN}!ch=2#x1&d9sSr~7K|KNW{B*WrH&k!C5;@|AV`iFFKkI7$HBrlAYaHQ zkdX{>J#&f%z9j_YOALA9Pf(taoen|~&5_elJ;B7wk@D?W=Ozo&6~Bf;+YK(0C+z)7 z$qD@By5##A2@qS~qQ;8L@K(RAV@dTw4m6{t!xO9VfllSkk8MniUuw1Nd2aV!`<%`)9lU~1XhG%ZN1mw4WfA0;!14xhz}IEoi_5xYvJ1wsV=OYL0~@(> z*~`vwTHLq)JkCYn&a8Q9_rYXKM5NBrPSj)(n9Oo(y79z#{_kAUbE=YF=v$XU4FfE? z!KD#5bb3{V}&ssP^qo&zoS#Ot#ffkMz%)+HVxtD`1%MKi1>m z6s$MF$4f=TlUX1T&-tb>KYidx&zhsx5}j=>YhTzt^(~LzLrz7gWanz;dJOD$_gVdw3}_@|(L_klEbSyTiKxME9<-1;bmQ{6t6np(B1A zF5Tgl)pn>7^1?&pZbn)5eV><7zKF1-f309R!}*eYS9M4J4^Z&OxGyi^i1enW=D0DS zAdIvkdkel|baP&aSF6NYS<%`Q^Gf=7pA3{aP`i2N`bk6{?{yO6lN(W8RI?g{eNAkd zD}t2PAqyxYjWAII@Z{@7bh>u`U7(`=HjyXTO;(fBIbkO;^~mfbFPDyrf*9( z-@RYXv?FikCar4qA^#Uf_*yt#XZ^`0xh)uxFZ%`kN&i%sd1Lh7aZg>&58?C-?Y-z` zHxDZ=#;I}c{f4fj+@t##;@LWqIe{Ws5HbPgjnKx}mfANd*?z=~L_&wBb^$tPCn;sQ zR;Hr_fbFT5?){bbCoGL6JW*WLWT*31vsa=KJ35me$(qAJ)Onmoj^hyPnTXa8=3+|D zT7-xn1~r|u9&rwEu2=FYeGzuUb~qfwyi`7%YkH5d>~%X9KbJALZu^yG|6vq!nu!6J zz6^*SJL|Cr4~Y9b&(P%YOiX9P9$FwwhxBJCkC!KzBku(l+F?)#olM_V;^gtY!`J3> zxo7w8Q#{>e;Y$;`Op{n2MEZjEs-aq<2)C#2C%0Ef1RkakZ;F$x+)US)Y&Nx|S;c*J z==iPPq)nk3<`|iF#|u7o4~HwJ0V-e(vLVokn*9;K*dR7cB(@)I_#|-ep|h4}13$fJ z)zut-6@PqQytn@MQeu1xYhSZ%J)Mdie!=&caNLCj55aBEV%2tX`QxCBjv^u zlT#pvd@c=*i1yiPEojCfjR^0}ATJ#&!|MJk3eo+VG{5*K2L2JjIaZXD*G&?)D)`8K z#0cp|2OBbB2%0SUn@}+#DG<{_r1Wv(jml{gUjP}Av}5-+n7DT9dAFD#0yQ8ZP+>@?|-OvA^e37`OsQxAH91$YyT zMSxKV81phRVTD?>Y>R~J&!7^qsfh5!O4g^HoLqS7?0Dyc*b4h%1~s_}+~RXsmatrD z5tl>!{hdyOx9;X)a4*pRqZI16+YJi*d0UXjYNDE}$U1nZG5o^OY2bP*2Ytn8mP9ch zTbw0dth)-0=C7wX5kU3e=FBPQ0rDYr@^9}p_#M6vdpNc4Pb}r0KdeAq57hb?YvMua zUnar|#mV9*>!&{se;Srogn~Jw5q5JV$5(~47ai-q;jlwXmy*_%c$Fvk{^6iuiSxSv zUpu@tXwi(lp1S-~tWv%IKm&iIChq?Bd)yx>mGz&4uhKSi?Ff(n8B7qO+26w#K!W?RN6oq1W4bPEQr^T~{|Bj9Z_s zNM&hmBtGLxPX~l#?3_@@#gl_i3A~zFl?xt0k|yZ}%z^!Arrp6YZYaZ=lDX}_SZ?mq zo=S)RqaC8SfhSHSi$MeXU3!X>FV-QP`!g^Z)$PB3K{wSp^1?m2+;`PITFXE;f{T0= zu^{=E##riNN6=u*N>dMwZDP$SAWp?^boBq2I;*g%8feiH(kZa%?nYV~=|;MwyG1%T zAkvEDqEouNyQI5ILK-&Raku}u=ljmfdgO)LYtAvp=uTE|D6M6-z)$J!>!g(majBe1 zu)DZE80uHX2Fnw3u%Pi^K!jb1v^G#Erbv3eXgYbz2tgu;-Z)scpJ#c!B&_0r^z$|1 z#2DNcVRg^%aKS?-sZSQ%(n?6j@d3Ek*?_UHF$J;rGCO+e_NE`3Fi#XMshEu z!WzX(4XbLGMeR!%enlk2 z`365CrXQ@fT52ol0ag>)>J_^5(;gy|SR%D;hrzT#l!K8Cb<`XGT5yqNBt}BH58IxErzw1EY`zSk6 zNVkhc3^T(T3y38blQ!Tm4dz?rk-H3-)VZG;$D6#qOEO77+9;(xO-OZMjUlf4q=sfU z02c{1dRL7m)=G^v>xKfaNY;UG?tn&I;|rx8 z4Ss|x6;i}Nmn%BBFG2k-O|k4Mvo@NA)1Yl2%S?DfoBnZNj7AjnS5DmtvvGTv{44GYdYh zPPoIkl*Giu`$|B(4Urhu6nGbh@&O0yt6&mXXcOTt9Z=DRNDI3IC}Us| zk#=UIl{B>eG9{29XeBCXDrhp2eEd?Gg4x0h|9719Q7IZO$-caT~U;v-Bu=(JI{eTGvtRPr8K+O>gAM>)lZpT|uu|s0f zTzu>n;KW4&flH-}PwR(%__+IRB(;gw)rX%UOcdDCx2WB&h97n?&fMkI6Q8eLueI+E zZ)I2A@F^bklKs}z+x2#HEjPw{csQ-FWY0FhHt=|eVf8@NtUVac6Q%@ESS{1w0Wd2a5bTGZs*pM>vngs~xf)#BqwCy&0__hWm+#pJ$2C15p zo%jCdqL2161RDf!Lnz1vv%IXm@YuZxEi9%}{w=zL=y6&zb<+s-)lTKUE93ffPp>TMC?gxQUqex$!UgWk zhnRK;;7>N$BFnnVr8Y_*CXyo(w9JD7$rZ7w;c~UrD6JP{b#*=T#SG(KzL8b59=U1v z&uP9z_o+n+dd6!n6LeV9s}wrY3iF2-JkCUGFc$3IRYH5DOkS0BUpmQYJ8qzYe5^6v zE%6VFkgTPdty-009C%KBD@=vaUKttJOtx-$2EK)*^?TnpxYZDtk?;IZD*qHx%e<)l zyG*OH!pD8CwAAQ%`TCG73k%=b9iIs|;MTojxp6hGDSw&NLaE3j_l0_xi~g@xkG~u< zXZ?=#972p`bXY|xpO?GinRiILR`N<+P-j&m0UP1R*+?9Bn&1zKtaE;cu@Kwt$XV!= zQ!sg*3IFOdjn$wrZ8@4&A_G}7d=2Y=;5SngkF#b-TdU!Q_(uby?8-?cUeDd)&tYv^ zd5oz70;OFlF;PQ0m)7y&B#x;p-XFZSxZ<(S;0QyZ;5SQ=d>qd(&6m^-)W|r<56wFV z1FFFf-F9BqhOo3Q_V(`%2Z)I-a_oQve^gemguX_t|0O+FvR6+y_fARz-T+QaT=-nZ zYEZiceUuw$j`oB0aYO^(b}^?5FtezAKl!sIQjH!14GMJQh)+X-?p^vj1OaYkT)+ZQ zUPy=wmD0+0yL3-Dd>+`3w`f=Mg}nb5jJk9(tqW|_FAx~^>x~%P$cOn4HWJ*o)Pr@u zV$V~CXhj8-|DeY<&8Xb%7|V%2C3YYf)$1<}Hw!?bn=fzoxM^_C7UJJBrqxi@1Z^DA-+JpTnXu^bDBOl! zsQ+o?N&ji&HNEz5(B9BRM_Smf*)V={6P-lnNq7jL%#$PxVEBl|_Zv)@eTR4c$$XJg z`c+ad{?lc|C&YH`*YCUIVo;6z(i4Z(xs)X{oMiaB7;VXY=Nd^P{w8~bnC8?6-se$< zskxKmfTzm|EQeesI0DU`iHRQx&QF0G@8RvYS@G%sZ^_%Xq$`l{@HRp7N#nZ*we5=6 z(89@I5i}DBzi}Sym+!!SnA^=NN6S&gzg?3lMOn9Qj7(G?(I2Igf-%oF@6MFA=NCu+ zushhf)~@nOv=QfqqPnXDn@ZjsRW6h$m-~iH>uraN^IDmpmKTg39*bpFU*;bU%ppIv zG&K2GcVe5TVeztBUfmm#=Guw1Q!yN{FQb;WbP#4sxs}MYDVBg62XpP97WpbFu`S}v zOqil#UfUSj^VaCy2pXtG9`3PvWcen-aL)SoJmT!9qyo{u1~JZr>MPmjYyr+6rp<5! zSgrz>;l`*(CZ@wibEQNjA-XWU4{DLg`{Z)TYa*MNV4c@AM z`alTb`!JWOadjzJJRrVov2r}gRi80ZGL~-qM_j`pCRPGf_k59A{SP-G&N#ey8|llO zsXt6CuZGGFWFMe!6M$PSTO5HSOWeRya+rbpAOk%0HRErZx04mBY6$A_SB@|XmkGt; zYS32D#^>05I7LG&R$kbcqm<<>YddAcEmk(H_@yYU+4vIhZHP?)CV3>Y4xMP=+ysAJ zr1i5L+8E^Iy_aZf0M-LrjadcUNyeZK319#Ze$3v_cWeh|s2ITVO zASOok{-xGT)Kf;F?w5B+i*VN``N7TvV1Piz5hRjXPmh&{2aT)mjMwOS!X5 zjaR;lliQ%0oyItAOzF4ap-9JsH8mT-h!S8#IA`J}&G5$`vJ?@GYl^z%Wv58f49Z3H z^^&B`og|Xs4i>%rwV&>c;AN|pR!nt~bmqV3!%?k#t$#a!srn(c2O8@e^Q+^o7lX|1 zRTCOF$x=cqc%_K6lEv+ahHaMBY`IET}}CFIB+hoh8yG) z-IXmA#oL&tu<(J3kBxPux`+Hhc+pUAf|m7WHS^i25R5Hpnx;z&yx+C~5X*^;tJDg# zbNV@tG2Qav0iRC}j7OC0G|c*+ zseN?lV_7Y;ja?qp)ZW)XfW&uhaIg@FBvLBrD}Cwj`q}bB`^G7j+8)_?t)!xOD%L%*WCYSAQ_Y@1nhs(qDyT@zIM-rhqqief)ACG6p z48yMp!SXV*0EMR({^+7Q? z_kq@pN!JhCD*7E-Tkty_7IF)$0OC6+uT9cA!B2y03aCxdZRSJ_@Ve(QJ?HWse5Jn+ zX*Nq0c#W<;Yi?=N(~xFvmDOVrc?WEzR`&B^jCjRXHmv%*Ils=}vM`vT8SD4D3D1At zly2Z@yo^O3ah~#{Ci!cwZ1(ZKsrAR$gizJEb}#1lW^21-KFs~b{m~Iz>xa|f22K{q zQM805JbeJ11pcbr=yvdlM7Q+tb5l7U18pB zC57DRLz(0XrP{JU??b6)mhUyYXBYNVQy~6-OmaPil(YW6*xwE|LdZWRc}v2%avj|M zZRl1`b>?T|4g!_AR3*FUTtGU-fri(JVYh^&my@Okzv~0xVT|@XMC0NT`Y%bxlj5Mm zW?ExT+?X4K=cGX(CwIWrx4q=xX5-8DC| ztq(@kB#E4RTei-EHpMl%Z(X&8iGG!5#H<>xhFlu0AzTLdKmg-Q=!@Jf@SP8v8cbW; z==%bm8M_RBC<(`L85-CW?of49%n4k(iW=y2U*|qHuNU;4SLhf|dzv$-^NBKgC1eR^ zv-OJ}j-+QBI8$J08i)#=z9Kwb=4Bq;W9AR}o*_&9?MqZ0)NbxPC3yC5 z(`cz@j5o-Y*OB!-UD!8_e+68q2SzrK!=l=7OxvUK^E|=l`};DJlS}cT6QTVSM7R$5 z5cLiw!$79j*MEe4_ltIxOr>*kKShr>LJw64L?hsjwm$NuFEPQOx&EaR1r>559%~YP zc;i^=m0-_jCGV6_wSMFYo30K);EY<+ zkr8Qr-8(rMd@FIsy!l@J(YGVw=VkIg!kCbcB1F|Ycpm=t{S+%jy7VRHS(9VlfdT?lJ)kE!a23R8sqsb{qIh_`}=N30_QKz)zV=#7x*5@&Q5^# z71MCdb==TK0Qm!=us8EPd@rkt`UMSKVF-F7g4 zFCU?qm`fnBy6Wj;)FU)PAf)IS7wigIW`2b|jX$cl6DhARcsP_&7GeD{9Dm?iUFgS2 z;qtRl@F&0My#2ExlEt27Hgcn>@M?XFo{E65uuq<5V!A{xozH@b5t%(Ne1ydt3QT(7 z5Nj&NEt3F;X>s;iNA)Gw`g19)`SxV`wwnw`|9i zFe;|5o+$-}di9~~DTi>T!$!BAshgzfC;fRh5Y^xmxxKPz6mTesxm$v8VtqbLVO;2u z!$h^(@r_Jwx~8O0J5(gpi1&hz{%4KC<$Ja~2h4CMR4;0qX+?nb29Z$9n;dan6ypWv7E0{S^Egf6Q{5rc ziz=#M%Jc-(thj{wSzKrQeoNrpE^y&+p%G7mJ@IUQ&_EyD__+Lj*!3r3Ue-M)rT`Mp z@500Uo%^12hE}1cUVzF5n;eBo56*vGT=dsIaPo>vg>H{?*)@I|9#Y?Rx2_e zTw0yqll=VD-;M)~pf>T}L#nh*+n{|+1O#hpEHt!<(;rO7)-RFV0jc$v+rocb`Ue1G z0yJhg;{)KQIu;&g&e|4=*sjVkX>4KEVmnYyfW`{D2W+Tgk-sBgUMIIQ!R}* zWFwq`SBd3|pdglz^sUq1P2G5!k%>L`0#V07LnuWW#b8O>%q_ODghPJSU%D@y%n|d@ zeRsmh^F+><3fJwOU7m2P;=4n8YmqJ%1EokMaS~COBF?D`o*Wy^f%7R`&|AD1UNJTj zt^HS2Ac=G4Z$G7 z^uF;XQrHgafc{Q$B&7o5#AtkPs?dL)1DM)agm8bo0d{OmD$Pu`wp`Vyf+F=ouKl;1yli( zBxoe>((=nH6s^`OQ)(ARmyDHnj~5i89Tg48wEH<(iRwi+uJl#5qlVv<3vs&2H9Hhf z0W2Vl57bFTT$GQ$CTQd6_P_rV3(qTRz>6#TpdzWheDlo4!4aDWz@%tQun7QGJSr_t zJ%UFP%=}{Ek4b5H*MKua(_&zQ6b&DaLL4xyN8)5?DGbuhp7WZ5+J1SgEGSb4vWNqr zw%<~y?Kh#{628jKz(t49$OU*;h^B@o!ICSGkn$D6>lQMd|afT9RZ5{yLHC}iBlbQ+o&V6Yo(`D2o{e^%{Ys-$lo6Kl->rWv0L&r8oixX0nW9$trI`Qtv&!wABzC& zi(YY)OfiG#=}7rHkzHbgGvEs@iYz!c@61>G^3?}P8b%pAca37W;r@(NBXzPb|LAm? zEfXra^>^_Mhe~dHppx6Of0A1y9;oDYG%G{#mnYtpcd#qgwH9O2piL31u;6x<3AYC1 z+yZ|9x8$?q2S-}-6ewp#jD6?(4DJoJ#!fF1tc$PRZ&J>kQ+i2D9%7fNDoku$&M^ka z4x0?8A)!VrK2u}R1DY|ttImOsr)ul!j^W}lhrQh2S3>E*HZihI$R~OcFIu2Pw@(H$lt5g7>K0e48HRnmchacWgj7E9*mSw624?vhPq3 zPI*`1n-4*JvMJUa@@Z&FWh{-TNoCv!j<|SP%fD+-)L1K_gdIevbo)E}xwK8>oB-G9eNFC!)QbRUrQ-q9qgRrMWgvDf8@~N50nqm^ncj zSSYG_pOB?j%H%(AJJkk60@0kHe#Dqrh4~RIz*q)T4uD?qBhUr)A+@P}r;d;gsWSL^ z_mG%;I-XvHGW!*5=B;q~%d6*p_F_c_n3BO10^V?gjKKh8j3<*EH)V&T;Zf3L{FJTY zXW_BURw+Sptsm2K%|r`*)6Q1OQup!!o#vNL80qb$M#6CZ4Yj%^145_}s$ zYY~Rha=2&Hn#*Zu_3>_F)BSABBsQx8#Z+?rrFBM|u!{1FLSC7`DraSs&ew&vH_|`0 zpvvPs1~7!XZI6Ae*G{>>aChZ^;y&Oc33969QlUadnGESSnuvc4)#hYXL= zr|ZwsZVjpZ^W=L4oSO>~WP*(hA5oEpE+&w7;gN`=0kt$#Jg|lSgfu0t8#n!k%H-V|y=`!e6w7ULj8Xdd^l7TL?+*#veXiqv z8im}FlPMaMIX@b@Ao9c=_|zVn@Yv227(nvEt6d|4?ri%Dt~;l3+LeB7&V5CkxS#VyMf<^s@eJ#-=5!*ZtQLnZ^L_?i`#(BJ4bM96 zKxu|CMsA(F5%+Q>=}c2}VdsD7py9CPd?+0Rg@aAndmb8=K%EFN>~@o8Y4V;=0KcjQK(PYbX;lvd{M5BDGI1vL?_PRUKQk z%fx_a4jvx)GRDG-yfan26s0azd?Zc$j#Md)VSgg$n2;y;3xB}3fq1{LYO=az%~Iuh zK;aiM8W_)VsQ_+n6tq5IW8jW1Y|{5FPSrUWR580)&=)Qov3JI_Y;=u98?*_I9o#Bi zs?Rj9^dz1a!r17_2=!!b7})#)1Nhw@O2t2q;@A$TKtP)2oXqgPc0Xed|Ky?|HFC*U z)3gyBPWYU644m+hgA#!20n9g0Ztn&Yj096Pez;hI|&oh|r2nEXQ49 zs#}-w#%_cy!yu^F7%3cqcS?}btY0XRBQuu%fb7M&)i5L;cFw2wmJai$xw?mYB$6IU z)AID&0J(ic6>q*Gima>?Dd%XZ3m?Qvw(!dA@Kl}2+J98g)A2x5^x?Qo2RT_8{-|9y z82Z$)?~d-%BM?N~@=v~Trj1Wja+XM5w^}OKOec3>MVow#_qnos)_mYLI+OCF7TR_$ zyR45bbfWAbo!w=e&uO#vSa8?uo<{b2i}`l?mg1txhlwQhO~dMWSb)e#&*|%WXD|wJ z&)}EpTEg`sK6~}DjGjW(KezVh5|7&wsOaNAu^x4IqDBu;RQAK(G)yd2MBZ&m{@DC8 zr2alen7kR5axxn&FDCW2_Cj%)j$UbgUQ>nsR-GF)xhLX4|Jiz)=z?LY;X#*gHY z=eaV~E8o8`wch~w0-zSy7{Ejj#EU#Z(D}I`awiMO5CplylY>bCST|I>MkXPU04%D8 z=DlMeU5sFV20-3|NC<=ogXUq)00R+_2f)pMK>?hJfSh0nfuEld=}|^_2V%U4n4o`H ze~5yJpkF`s8bbm$3^)=6@xopJRAL|^pgRr)7sbDMVX`CXn8p}z!ba)<)LcM$un=JK zEfNKQ_XWfRs|$2np$H&|VXHld0k64x+0LL&=5Nr@oJ&c5pd9Sa3(UwnVOm)ne zz558b1S5mMbGe$g%NDZjf*sC^Mik5XQg^}DGd#F!MZQi_?#2nWPgDBe?@k|1ja)5V zKI;0WFOPE`XGZCWHm%mz zF14sv=&&i>xlL-&G^YyuwSq?^V~xXETqVVHx zA=SHq*?A_(9a&GbcnY$uN2P{Ks>Q`)=#bySs+BVStUaP(WfdyVVwZpI!CY8#7cAYf zD?vtVU;5e=5NV`M)^J+3ka1no+W|}FF@f+;y5(B%%^xb=%4<2kfjYNVetI%4ak$QP z^!DW}y|vSIqQ=_}7(>qd8M>|`J+z7m;kq+?guxLd-72lVKH99S&o zOLTPFTMp;6Dg#b@u76A*MKuaWC7^UZ3hJB~oT{y=J7RLtYYM4>-&zvIUodZq(k3SB zU(_B34{{AiE@+XoweZ~u1M=>mDR753E|HS3X&=#rk^-uEgsgnup~`8O5m&r)OQc;K zCCiPJLE8Cja?^;dL#dyQoMAs>eCW6Shc_scwkUs$U2&g+(^Co}6l+Eb>=ooCb4%1) z?gbUD1I(}FYu1a}JxLiqd^`5AEgOL>A4OGcmHlOV{MFmBy%OcOreF2}*&dADQzG4| zEsGmoHLl~ju{$a6`JGSmv%(WO{@H<7-?tXecU-g(f!r6yOT`siT=+KD4Lkd_jInB3 ze0^IkeEGkvWu`84*zaWc-T|;TXr)KfnGrMgAdMdq8F7>NrJe!Kw+JOJq+h zUl_HTn#~*aEbj}^62lrZ>u+Fz`FzvsH@I9sR65}=`X;LPjeOR)vDz39&2sou6%a;L zIG^rVUb1wZ!3K{PgbszIu$v&LxSUXG zU~VO1dNH@TMj!;^$Vk`JIq@V&2vXR*Ay)7g`#D90-icd;L}G#d(JvD0Rlx~uW54E< z$yeMR_N--x`2)I~(}U_=@KKjX+H!o26dzE@|DH#!-WU)*7r88edo^sP z`(pRtEKr_#9sNYZ&Od<*-B0>8cLbEMDezrP|>p$b&2pqp@85*O1q!!eoS*M#@F<0XSGh%Qo{-kihP*sJQ zolUKijk`0Hx$Jw}q-r1ZylCn8*jI7LZD9{@$F8W6bx}UZk6!FJd57QGNNLL%kq+_^ zcMP(MwWL)8&Jv`~a`|vhM@*P9b%Q08hL0sHTrSWLyahsX2EgT)ROf{2r?9nV2Ui)v zGL|V-m5W-Go$}h?V;$=e0XDq;oZmRsvhoJ*VMxP2P3$$R^<`T!2<0Q?>vHcWZO#%B zUn}Sveq!1Qcr?IBSkj55I22undnEe(wE@3w z?-J(ruAtQZHhhL3hv;H`N)7CBe(GN)>SdsErTj)uBY_q^C&_k^Glhm<6?d2qA@Y3x zZAzA%+14YT`)$5HoFYjJR8qyMyLYs{tEB*)V+Xo64XP&5YoHWi^E7zIs0;MU^6)Ha zxYUI2{c^5z;wG>epjUL44p}?QXe|Jpb#H}@*XS(`9W9R zc0HX9@#pBWvGa_aY6TV#Q&kav8BWmF@MjRZ4^F>TqiTi~i8}lkA~~sjz<%z%I(y_7 zOCj&PAG|FYjC>!^kOjcbqvIQMd@ZKNuKuIs*M+yM-|HyIi)d*#(8<65>cFG4m9r%E ziEU{v4x`bc6IJ6HtwA=Wzs__xY9E56BFC#!D_iGaD_;2-+%%-CIaMl&e!XLu&wfoO z!e)-)z^I*~_JR(?xFUcUbeulR#6o|**QSSC8Q4A>QZ=NI@dsa%ijkxq*p=Y(j8Q~| zRixJf?}AbBar%Cx?)O9OoOl||dcV8t%=Y+!^8;*Q8lty4ZZ5eKLU|N84kiLp`9-)BBlnsiQZczo;)U1W ze#5l2FB>EK%R7wEvD}ZGJ{~5oY!fCcOo)d(#pTwhs|IeD@+9XY@=8>@dug04#@ogj{ zJB>06{%{ghY{sq@(^(?{?P&jmRf>{aTQ156*c0|fdb+5MsG1H88|CO}_p9higOR0! z-@O*+AQ=)Mh7*$*tXBzbP#@as^UEC}+OARhqmld)i$quAw@gCEcFU04wP2jr1M$?W zaax*~twh16-IZV2cYV#A%W2QO?+|FJ$zFH94XbffSwYuX?=U@mDS<4PIIT+)rMXl% z>+!s;#XU83n7g;;Ra$L2|I?zx1^?{r?)>!ZQ}X;h!>-Z?Y%kLK(lB1}L7|(L=5Pc= zr;1kqaz1joY3aYqZ6tJAav5`00R07KJhRbM{sw zy{%-+`5|}|H{5CjLxoIhP1`cGnF+3F(>N&%=9IYJp8gJR-Q_@4yoy9toIpEFCdL)b=-);g(b(@7)%2W2eyfIqyL)81)}^Ll z1FPJ;N+d{E25!55Be?xNEmsn$cE3Th(eGNe`&vgH=u3yFhT|WwMLy!@co~DL6F_8? zD0uFugS09oI$U$^G70yefVCnlX5tbBgEn#s?vao9=`5vqcz&0;Ie&9nLTXAlfeIez z_Ork;9Vhmnb;xn-P{v@*rj*3dJ!@A2aco-NPd$xz?n25vX_!x|EBKIYX}yumyS5s`!^qFs#eW_JSTfP4=f`DF zIh=aDD^G*H#o9dqH8l`1yl=xJ&@GNe365J@5qa%A*!7n3*OH28ve^DizERka|F7;W zy}cm_A-bv7&k(VvGu~5vIb_psm#zdygSwM=L}e_c;8{ML!LvFLB2?NL3@;2K$ED2l%N>%d~8dtZlHrwDf zv3qWr#6GjIh1`pLkJ{!e_b!OR4lzK*SH$gGu~POSGksssrqs&;H7xyBa)qrkqQZjT zYqg%Z_rHZ->HhN!3EibC^V(PiM?n^Dp^JrH3FXzz6GZT_`*1GWdXR#5(VUS*`Ql z{8IAKabsh-FBAqPw--69$8+$>Q~SwNCmCZnp~Vyxevhk86FWh z)d}l$%%dxy2LocXF>}ahw!~rYQZCbI>gLvRo$mG8xR@)c=Zz*b%HOES@&KL0_zdkp z4B!^r9REa>$Jn>=OoNNs!0)K53?-`89S(4lE0~q`m2N==eFKVUf?tpwJI$ZI9g zDLZ-5i%SY`fkQ6odkDv2WQ@F+s+8FjKND_C8}Rp^J34TPT~i^s&IRApdi{;5)M%Yd zz;@c`!KAfa(%R6OwX`*A7%e8A#Q3v3O)`^^316t z5%>SK#&0ML14S#_U7^~wfhjqXTUE9TITtasRh!3&z@l7j-@=5?6*q8C$tyQ0QXIuA zJ}Xzym5ccUR&K80hrI=&QX8H3^4GdkX~&)iKlQ#Bag(SyVOj>9I7iyK5)i!mROM7s z#Kc@qO@`flu}vcofzshY}*er3R$1WrD_wEZxXE~u<- z)cL!7P3~EuZ9-n0&Y7`E2Wl4Ng=U*m)ON2(H778o%H*(sDJ>8kla}@)?U&)|mI52$ z*pT43F}riz7c*}XTsggb@AM=!J|roA1mU+l2l>EjCK@4|Fc!RX79u$C@x79_J#nK= z6t>?R+$=f!jX%_dw7kCO!^fSUNm3x_qsE;b%G?zee`5 z2~2>{$Wec?28lXTQm9|?0#lcmG}tEQ6F<5hMWo*2y$ee($}|O-@zID$wS*}XdDNcY zVMP=kpuNiNA|TACAd@4866Xcz0;c$AJh(Ui1Vn~$bJ(oAe?A@C(=Fdv0xq|R(f*f>t735@%AFksoYiwwx3J(~?%1$z->f|c z@ou=m{X}A8`v06jO=jjm1q~K6T;&yjErvma;>zIh$peo#0E5MElZxyl?yk5nVKu7E!%3wHW z6X$?Ndu%zpeGlYM$;bRKJvZh@@N^S1K3WsKKrDd#6;5;pz5OG0x4w3X^-RySz~k>)#Ht$^5jY(79k5`&CuOkI0{uJ#nV z5VhYuuB3Opv8Nko$S=n%-6Bki*3WYGVJkeBwhW%nNEZ0@sbSW}*8#W}!xp8{RMaGb z_ExQNhH$QACQmz&kMfIQv*|>>ePwv<5&DP{L17Oxf>D@Y6@X1J3N6zzoRA`n{jrAZ ze(o;;vAc>Y%^fQ=?GK{szKCWKHE&_%LId}3;gVyq0QNu>E{3%kan?z@w*6_Y&&1qZ z*vi|g7~&75`Ew&&ABVSUV0Bx{n^@2*n}Bg~Of|e5&=e`OW9muNhWbl0PKLS)CTbkm zR7ar$J`W)yLMNBTA29Ke!LybhuMi$=ffq6~Q6NeQ9|e#mM-w)Ok2c7t=-+&0@89e^ zbM2V$O>Ug8c!jfHIKuMB=->3c9)T?8E@*NPY*mzUzMwfenHmSGZ9j#sv&DOL#6n9e1XuRrZ5|Vl+ z;AGll1?v^Pl6(tKjNfa!J26f-Erj|Y+}#}Zz>GIy&NB-`o^h^Pl~R1`#f7$wqSe%p z%@JY&E>xDi~V7Cq4CGs z?E*P=@!Xn~r14mDTtVlsqe%oj<|ZNn7mbNckB8!{-%0uR*TM9?5ihyFw;M`Kh|knq zPPbJB{MgWhQA78O9q9%*eaKmyke~}J4R~t9PXieJ`>F!p$hJdVbb{5ix{j*?GvvBZW|eL&&a5-rI#_k!3hb=? zQ*S&{SAmrWj^=ixfy^T|RehIk+8-R3NKp3%YyVeC3K%QNH9W0LzWCygqyilA(d)f1 z1mz1P8&XAghqqd4h*jU9-OtvAGvx6uX!rBR?uHHhkVXW91H$sn(Tz_-3VIpQJ`KH$ zsM9R55Ha|qoG>S)r<~y2E#>`ss_wUvU+gp&2;L6XY58K=q_yD)k&I+kBhb@az%N8+ zS+w*#|J?3cik9%96ATsV7)}&Kr|^_)Gv=WjoMPUfZ2x=h(r@N_T(*&_{az!ts!ggf z^hLM*>Q{Z-sV26P2DJMLvTt!xvMy8Mqn{r*k4D+-%oxu4e$QizHDHmekS3$YeOMO& zrUcj5_50eH1 zbrlgjlzbdwbn{rLj-A+4%MlF=esR>inX%HUW9gMSEVGfrKj9xNkA%PSl$bWtNZ@6v zPAB-DNOm4lsKy?W>p1@_o2XGwOd7fnz<=O?fE~1t?cvr`O4$)MlS%WkHF(wGjKfj9 z60xMe-~v@qSa@ny21k>ZPkut1ep()Co|NI9STVMFq%q`L5}YI%iOfS~w6ZKHtWx@V z8$~)gvq9*)?n>Ruo^;l(zjKT~n>h0DUKu(_Z=HYRW9E}jkV*;v4tUC73n7z_%G%K# z{Y3&=WU%F!X>k0EpTxJ|*NbFg`=})r+2s756_h-!Rc7BDc8gUD=XvAX%;O z3O8f!RVx1B=PB`Sh`#@aQjXsoJB$0=$tSVN2O)wndGhY@eM17&O86sGsDWub`wAA=I)Ju*&JrfW*>~`R)~-CBWWe% z1s~z1!K{?>Y(#y9U5_%HMWlD^6Iwle@7b&CacQvXcPMLvjGrH4GrD|Vt71f6NDt0e zn;Y4u?h3^ zUt`l%S1Q+qpMAAh0E;#6hDdKf=#N01XPN$gkm>Xk_!|-g8v}!trTPdV<(x z*LQ`lpF(Z5L6#mG+1%GNJNusGH^p}~h6S|ofEJMbgm19@SvF9y!x#8! z4Wfdz2J)>zPT+|Nk6eBkYHyLR3;2CHAEm}v_Lnpv0U`k&+tM=b);z{BnA&Jo^(NYA zyQTFeGFxS6Wbo&rN{{?;Lkb1_R7%dZ$J)#)SbRwc`_J+s4>bYI&qN$v)S|H&=lt{c z%fB`Fu}v}UT=9-Ru5-5@36_}HzUe>?Lq2%K^8VDGfB{y9GdR7I?98+@y#+&zyWe1J znl~@%p+nr$c$wx^HfI>l9_zhwo?Q?St$&C4vtCH=UcF(sl7w5?bI_4~I-?r=d}hIv zJ_%`J>Ol<2|9orRdg8Q(7;uL|c@+g&v|`%%OUJNbiNNPK$nW{Gnly3Z_}kpYk`9N6 zXLQAL3I;r-BM3DgsNR(Se#SW)K0`)mZ}8KI`Qhy2#-xf!(B&m7xC+_^5+Vw!rtNn% zOTpo~%+K!dp7R)_h=;aYCVjmx>mQzG=M_kn>c&zVfh~$WVe-8gJT=B#_+?vlq8E#c zm#4ij9vv~pWyG>z7nTAOa(lcO$-5tPPJ@J1=HQrF&aiz_=vKzf2`WE`?33!YOVf#u zCEyXpafHTfrRRT9VN7t&wL=2sM8cFzP2cOu?nIh&BHFhV{xwxdJD_)hpiD{C*xE0p zD$M?1nGg+{jm(?jCi(%DA80XY8^GZEe%otVrcJnK!u#hw2qGQ@vV*b_NkE5$fvHDc}Py0=O9}F%Qr!Qd^TCYg@ExnYZ&3Ra4F;%5Ht*x{c zMA@l1!nAb?#^ICS?pNod04tEoq*~!7w|LUq78ZU>!S_d}nI+&*J#~!8Z>4;QTRy>G zruQKMN@K`lYdCYeTY=l1ADD2=BWT{`*^T-Gf3i_IvVT|4S{J7jW5#(ATW0g-Q(MOpB?xlD$h~{W3||xEuX%Fjn@WjNcnbUrd1YWGszPu7}C? zEfvf>7_1uMl~Sunx&h8}BqEFrdB!Vs?b3w?0?L>vV0;UW3OxMbozP6dUx*+pEwr7O zu=nNnnb_t7LyXvuo2M5WcyrE@OUoAbXoUx{^c)l=E2QC4Dz5EZnJV_>c^t>zUbTTl z-vvm15p)7&Esc)XACPgZ{9(qd`VgsRda_V$-vmU%$u)ve1I?~slX*$GH1WHJPOe~} z>BKD6N4ie;Kp-s)%>(Qc8+yns03sORlWpDzHankW;+PyTJRH?WDkaPqc87^>_?b>Z z!$UDg*quBnSTQ|qjepR6*VzZ{%NNarFqb?Q58caSM-Ve`p!pGJdRtK=b%I2*`J48N z7Hb|n$2sVS>p^n^{#(r&TsjF57P7o!rjjSVt~l9@t?|*Xu0ZxjY&?)^P}}w;g-|Ud z(|`+~ZVV-U5u|MfsP!X}GBJP~4!UDm3L*c3g(=7EU!L6sumS_~e^W8er<5SY8<2e< zL-$PesRwik@c4kkRcus(t%6!DoC*E<(|b#XgCrnJ4O;+C!8!3A8Y3(Xkduf=PVCY-Kcbc0j#id~nW?HcO5p}W zZ%c~_uBs3K&X$ltaC+px1}?e?Y&1ZIhfa_3mv~#YEjr<;6zKenNCYbjm<}RI;7EpK zlJ;gq>owJ}ZuQ0m>J~--lu>B3u=l`O5+V^P$9{0h3A^p$x2b-oQ05Az3Md1yYHwq# zcoSO*ux(&>z|H_4FtNk{Low(%`uZa}5%f6X?h&0FRu$j~LS}+x1wK5X3%sHDf9$_wA+Qlq_P5SPRUPlOT;wL0sbe(WA6)VeH5xNsTD}CMg-zzP#IJjId4jAHcy|n zOp&LRlfK5!*QG{EUss?m@nf7NP-C6j`RIQgc}yDXz6yNh2;ooXj5K%**2S80D5Lp4 z?QprMepnqdS&Ir#qTbJA9{)nWr(Bb%NUc(vO21m|)DtND9t#ImgK3LsIj=7hCkfZ` zG?OeE^b3Q<3@{AdJLF4IbKp{Y5wN^3VjwKRQiQDII=wgSF=e>oi`=y3e*ly(e>u@1 z1WSFTr0e2I%hF`i#~-&3Y_M7}TpQhoX{78cNRd^FaqJ#V)$AtcI)TaxbDSnp+>7qvqvvrE1+8^MPlH?ig!xUCDRqHZ2>n7 z9!6nGerrf>U9SJxQ#LEYppabGtF#dd6NMlAbPs7qOuo)+V>jcb5GF2?S`&noRMf z5CcW3H(Y5RKRmU|$(_3bk#k+cpad5~=1y=x=$P7u^y@=k#_(n`ynDF;@^1uKWJk6$ zJgAeZ2{_vfoGRZ^-02s|?51eL%;bmZ%O}>2PN(kYDAy#DH)ZrtQ|pI*Kz;=aB9mg7 zfVYaJj64nbvRUV!`J;&fOK3s8&q1*qe_2ZdOnPx1KccZh5;)p|zygT>I6e7px`qB}KJU`1CJrI9m@s{zaBesWz2F6ob0o|z@z+^l35H#lq6ggCQHjpC#`JB+;j zUwo{7aa`5_=OZ#KJJCfoXF9=^lTD_iMz`cel;hFLc1x*cH@VD@9G5QY(!@Ev;d*c( zq2Vxnn&3TdxN>qJ(P9f=0?o#`U=61-^^3CL#5K2y8tk05vzsId=y|DpP!O))3#^GQ z@#EsfUJ)t*;%;&dszbr`66|Vf4u>~2(LriLlB*?O60A;@Y8|XjJgk60>QWZv2nd(Z z=9Y2oAJNJe33{zF8n#;~aw@jvvAhziQpsX5`Lvu61tS9PBvSxpt%|A+!oBfw4}Unk z*Lf@8?rU3`?^&7;Kf~x@I#(zr)8zP@=HdF>V?8Mp*R_^BT$oZV>B*HlB^u<{i@dak zuUo~)iT{A&m~a(l4%TVXA&XNE@mvCR5E!vLzDOgKD>2p{cD)~^> z6zXmA{>K@lL+y6s(p(=o;WO#?&iqXzPxoh#$rfR4P*^u-RTLWp!rys@+va%@pbkuz zM+M8MyrH5`uO)2nm?C^8>-Sn$={POd`kcTkKRhOJ1BB8#-AX4KFOBF=38_O+!t0xH zW+#L?ePVLbA-#Bo1SaaaxH;+(lIIs0T_aJ;g7Py&Q$88YetfvytFcnqBhGj~%}cHr ziI*r^L|4UkH)6i;RnX|b)zMPQRJuIJ(lxs&hV%x{+Xp8&e_p|^Pr5O@wxh6=1)3Hu zr4a2X7O;Czk&ho2g!8U18dL(K0kg7_o2QVzXU=k8gI&z4Y4h2yto1h1xWKEd0p|kd z6e!$GuM-4Ka$9(XujqWNP81)87fi2xRn^BHoBzg5hTKhw0Pf1P98-Z&gpAtsl5B?8 zJ?Q)^VTa;+G+nvOWU6}Nbj^)_)Tb_Ew<#FeOhArGG(3JhS!auphF?96R)xMd#}=mr zraA2!LM|$ssT3|+ijWeKKCAd$mo`c|>h{P@j@)(?b*8ULiIV=g%o!{@W;&EC^Xin5 zH*C?vyYf2F;=4*8X=u|U(lX&cFzzHHmiDr!gl6*@eQI4LAM4I&OtrIGqnM$n?~eYS z1Tv^-X%kad;gIChsDUnxvP1%6YNaw>U`1(10IZQ)ztwdyt+Y<<`{pQ=_ovO*1~X;@ z(B(j@gy|3q{TAE0dGlwY^@Db{6U?U&F5^gLatUY!$7r*i`zpG} zV5m$dL!*GU*#mKSRZdtdNtP;IbTkoVS5RgHkz{PtM4?-RlDG)S%#4f!cvF%|)j8r7 zo?mrCV^LlcvHOW=MHQ3)gL|46>gV|KRy$xoTviHx4Ge;Cv+){p^E;) zhTQP!ozuVHkS`OdKrtG5CtdsEjr`h>7tTL#$aUxc(}rB12DBl!b^NsM{)q$UnsY+K|8b@t-#2IVl(8!ycCA&DDR~kTa8j zHsmi!|J{Zh>*9Gs9$EEsL(YZymkoKi!OsnO#m@~nbAq83*{=<`GU4-v9B27s_RkG@ z5gKSi4!?II8u@EO&NQf0OZoqKLoWZP4LO7T-!|k}PXBR34m0zQ4LN(>KW)e}{@WY! z<>G(8A@Gl$kxzt}9a_iv#)`naJ{lDChC&>JFHsoD@Y{+H)!-l-==Z0Lq zu@PVUj}5u@|8_&p)$nseUgZ3j4LPI6f3+ds%l*$A@&Ww6Zpf#9Zpe!j{%J!lVfH`0 zA=eiF&l_@Yu|IFf6YfA8a&o`FZ^&ar{;?rncp6!*6YPy#_jqF2awu#mUFxSi3QZZh zE>1a_AKp(r>rj5PZ(A}ID;c+cy?TE{@+!)%m~Cg^7rqciO%ic$M>h)%|kiu8K_w@{&7kz} zAEZ9HHo6ll>EkGk>s31NMjxpxDAOA7JQSYTrCcH2X_gG9)*P3eQ3EcpOO`YLPHq4| z=mzvNx-oQ|nZYR-)Z~IR82E1Are`FSO|WbL$;h8Il0RjYMUaQT|I6HChqv+&}=-@y&Jfvlh4hKUtR zrJld4oEFS;8p{*8m1o1D?#tDtE?C~Ar^wI&2;6x4liWD`Np8UYBsa3-e=gU}`QHh_ zrk%bhfmwCPlm_eAh?4t7Zn*x9-0(s_`Gef}1#S?7zzt@-*7zSnwW>!OVhuMy0x~oL zfW$v#unw0Xg$2A~2d|Lz^|+F3qo2O>8wjrkxt5VwIKMNVE7SD+6SkrIZY-ntYar2P z@V(w;h1QQSiaH3F=}t?FV=KFk*RM!^iV*R|<|xjQ8EBq?!f3A*fKhywVr@wEp4q z*96M3F1f*8uG}ZJ7uPN$d4qYgr-Je0Pji9+W+LrVjlI;GnzhnOJ7J;$L*gg9@!^d7C%U2Z4|Jn*ckP^T&u18v2Bn0wQaY)5Z`*b9VoP8qsp7kSka)&4tL}XlnDal79{YE(lWP}mkSCO z8@yA_(okG~fOKzPa>f^qY_~1<7;qjwj#*vu=)-6|7hFAbfPU(G2k97S?Z{;Lu+zku zl`PhUOyCmY}HTJ4C`}C&$3>;^~_3vwx4^pW6%2_pz4p^Nk&0-Q_0U0PKtv3s1-II+lCez(K6d$ z=yG2vY48=59pV!z?|$48qH8VJzGzReD&E3S%PFdyr-@OCn&FaI52eJ6d)G6cc8oK) zkZAL2fd1QhbwuS$(nh-Pq3O~rIj^=6Bay$KhtHqeLpvToL($ab4}=|#kDRd{Us@i+ z)JJ#50mte^bUu8iNW2z!`4SiIuHUv7?=*DAmHhSFAMczn=YHf-za~w+>m6sJV6wZa zafsU@MUoT_HwGRJW6+>CImd3Av=VtrCA>=G`4~-in*=m0g(1N-mNY_}ovorc_Cc{E zf=?7HE&0WL5U7!p#!sSoehH==KMw>@Uim}p$-Y2=6pL&p29}YdaAA0FJBF(QO}Ji! z^Yh}|X@}N&YXQF@pyH7d!5vnBB2$_;@Mf)`$kd>K`#M~p8jJ`=tJCXO*>DzGwHTL|lOGJw z8m(~JB@I3$DA<`0>8>UVVf7(=_;N4q&#&iqsHkX9eOg|AynmS3;j>!CyPl`D$2ts2 ztnm&}d~e9swxmXK!K`1pz}9e1$nYDs4{*g735znG*hifAp26!KQX)rJZCXvH*%hlA zaWYftvGHNoFq->q=!!KE*AI!2r0ZScK^2^xM=FeYfy>BrznArrRZi9Wjk#q)zffjQ zps^nkIm~e5x{~gG9WcTV2~R5m#@OKgg4>7_*S7*R)K9woW2nE6g_d#uh}=q71Z=V! zNFCLkG~q(yS%V9(l#qYDWtg|UTp~b>_ww}KOV50F!e!C4H?Gc2T{4#cEIfq?O+-I4 z45+Aug++K&{aW5pq30&N?-EIXQt5LnE{oB?iVMFUy%$E3e9 zM58*IkhjAR2-sn9R{EDv+Oj%}Kxl4EQlNAd5;g%H%h=94rjxhnP1S3KDVxY7?Jvt8 zQ#bnt~7c!L)3Hyrug+Ll=TZGpOphFM}8E*kQ zH$sT@RQp8Su*kckP|LkkXd^#$3<+R@-$Y`Jp9Ma^3T!+LsYEZqPZ=AC)HZI@t!pUW zZ3=7%LQ=#+C<)nAG(&C~{H{it6U%7@iBP^R03;4ZVgN?|K*5IH!O?}5&`;+9F4iCk zgL4B3YmvkNuW@-2o&gwo5CC)H)WY%y00aGJ0OsZyfU)a-mIY{NueARm3z!7S0_K0p z0*aDOf64-=zg5Py{{&!={s3U+|BwY-At^k|0^6bWwj zR=4Y7^gV&AV##&5kszxn&G_uQa?02$9i_vj!-;a&sCa5 z67s}9qBH`}Q5s?-P?YBEIZ8tW<(>L{QOp}FY=aHo3M_i~8fSKB(o>)z@Far%t&So= zznfWmS`hS$$6-AP8*!kr0TuCH>`_d8R&{5CQo=A@Bs_|VXXQ@|6x8p?3D63 zJ5$%IaT8p~ds$s4gP;8QXo2wb(5sc_LJVz|dh5dKH1o~Kg*s(P{de?U;EmwW7n_8& z_6!uTx(wU!LZ9S*fGTa&7Y%7i5(D4xp1nvr3RSQDO8Nn?+R+h1P*&pcBVPW z8v&G^QFzYI7!ss>!?c9++11<00~gk&SF22ADy1H<$}FZHh&IT4+tOs!dN80`XVvCF zMz7nzzF2TndquYJjJ|XwcGGntxXkGah#oEOK$wmmkpO^^QZrR_#>|nLgr=NiOH1uS zhHu9xOQb1g%=8H&EozmpYwECiRVxYASp?}+##7+^EoBrV3ykDuB6lLD`g^+Oc~jZQ z?(0-;s@T$~584xpOU84RroZr+M*kQI;&xLg!4#?g4vG&}wx(!*JTsLw#J7qi$~!%--h@D>VYTCy|!$cP~}gr!>PL^_jl zV15=BNH`2j3Z#iZ!iU{z_sUeS)bjyKM<7Z6LB2@+B3~#(ub;`6!jyj~6XZe4gr1wp z5RfwAYXlO%04;mreaLj9wahug_7Gx3Rw2T8lpS1CjbOSz)s{hKH4%ldYqFUIG(PsH zEYDB^XBpu!tp^28!{GNCPC#!HECN8xv`GcwDJEQVBj<#hhpb6#>+B(@(b7~`FPd7F zbs+W>dL?fsqGM5di6~8w@+1+KyDW{A)beEmzst*8QQ{?iy?g~+d9%!!wP2<70}vXJnHWdR5xTC$dJyX0eP%QFvX6b?JFp}VU7{%7X`;44VFpp}7-4V8nZ zpi@)$nxb|NS+4e9oeK#+oeL{JoeLeq-~Z}daFkqQl+Yq&hoTFiF(@yIm~8{=xTnBN z?Jc7owSp+29zCT-6@r=A#JhE(<%f>UUyNMIIH6oI1gf?mVE|rh)fT+sLI|v5n^z|a zfW>vlz??`n2xQ=@rDMyKT6^ggR*T~)fevc0xHGmS>F&L}^vE-8o;ZeFv~=q=wkAA; zh3&sem*<=tVT>`mKi3oC!p>qZ5BBp?g~5^I{SYr5MugVf*0SC08MI*60`=3eppH~- z<*NpHZRM*D@U@)>e6Cl|MZL%9c;KW|mr&=HH_03IAlS%gMl!IeH;`vaV@9c0imfed zR+relriT}83rDMygXW8<>kp%K@Fo0oTBJhWH{UiD7j-Nq%41JoDe`c7Q)ubP-zvvdDw1oFTF>MP2`W28xC z?2a?+!~$c}r?82DNOSN;fr8ii(+WAl>w!{TGiK)ZDXuNtr;|w8Trf2+!<=b>i-(P& z^qTm7Eaar3w~yY$8Z4%ApV|`mA4ki!v}PYx?s!;5#ID_#U5Gn9Crq5fYE-(;;qHBy z^eg~x)dSk`P7O)Iy<%Ppw!=MqY`cV7a7Ghu8DS$7(1NEq=eG?n2VbRIe3(0I)T#3$ z@qvJSSo3Vrf_HcCr*qNrLs|*{mLgoY;p9nhTHjoWUh@nhUDX0nEwOL_DYNI>%BhIV zzM)a?>lvt-=`iFBbILxeL^g-H{S$UHANvQ=037OeiYzvOEr+ z3L(_7ayo<4s+lft-7oR7)d^El`|XELjtXTe<{`>w8OUd*s52H7fV>!(auS7??N$i&{)-N|%+*J0ag)feA_UTrnBTq5N2; z4%MX^KdM`qHyc~qd~l+m>`>q;@vtXGCUd4OP0>>dZpdy2Y;YB?~ZaGNH5fI#4qujCVVK;uw!~5Oyg(nVsm1v#Y|?b2A0H zyF-m2;PO8}M7WzmSwOuGBxXQCKdWak>(3NQVv%f8uNeruQugER`;=Mv5gTj&ok$Rp zvSwijqS>+)W!jeH;E+w4cjx8C8qTnK%>AH#g3@P=5)Ulob9O4WR*b3zaB8{hNCV7z zS;oqIXv5c##{=(&_r5=k$u!Y81zH{*QG!Y+#=A8KP_#zXJ@nlO0MUZDuc(a=6t1De z#J9v>j(u(46I9!GZ7e$|gqJ#^4h>h^b~Pa*zzst|Z!{3H-3D%-A7bKhc-IisQw?cNM2RpRfzOe zALohU`;laU;fx=oL8QBRgV`blBgRA7JMs&HJ*QBB88ry6fR(2x{D45c?2KDk`R>4q zZ%T)C>23n=>EWy4Kp()lFlCWe&qmy>pD? z1YgImKx>}nt1NzYw+F_CAYfX1WAyP0Jymer9X3!ID~*4#57jlK%KesbII&o?!zSw4 zvNLql6qw+ZnXp{$!GL|XJD|JVG#aCDRkV4i@UJ9 z2K5t@#*bAqa8pi_D6Ej?S74oqer&++Kp0x$GTwS0boP+2g$DeJ7-zEfV6;{CepWGDnGp+TqYH`wGxVm)+06wVIvEid3+7@ zJx8HI&*7=uS5BfL1}BOgsTye@2?_zCS)yPov)_uxNQqwzN%n`syR@()dtk>=pHGqG zALJ;4q9DVPQl9^YY?>r~G|+WYq$(k_V@*z<$MZ5`|)nX66oD1|kW9V*&{i zk%-Vgxdwmz;2<1A08+asJgZ$4fNecUc)&a%EPS9$FA5g$HVgp?BI5zLA%sN=?M}KlQ+-=Fct)`V?QhpfE5nV zB;a*G!%6t}kO_XVz>Gc=dFj=ve_8}+ee>p(ij2A&KfzNgKl zT)^3GZIr2#J0MJ%dW5OaSKia?Y1bF<;?{rjCbh2mhX$-CV*U;Al^i@4;K53%(9@dcltjH>#8LKG}W932ni?ISYJ*EF*tdw2qVel9R1)^SS-x}qf(nmO2xER;o_Hc`4wFSjC?eQ32QX-E^5dCCz{ULmUNwtSGd z+Idv&cCO8wU8KKps*&;GEuy?;59+qkDv6z4X-RhOPwb_66~aOQ-Y7-EwF1=EGtQqD#o_au~8% zpMw|498CKG296|Crgg!ml?y>%#rl2Xi!O<%k-tSLb~+Md;9gnhZopY?SJKNIy0`(` zxmI949O+CtDBYl(e(fUT34kSN8MiKZbem6pO2f$K)M>B z9x*09porOx-dNzhZcV$!479%FtWIEq9Kkh$r{|bIIFw3UJ^>nHp-I7}O0<^(f?jr1 z{b>8Sd_{UN0h{n6IUR$lTI#cwwsMvrwtXd=ar~<~TG*kBcR<4YDTH^RSz!Z*LLmQ- z5`2lVp?)nW7mv5HE!qOf;)@m&Z~GBCFo2(#ynJ!mSYPazYKzFlW-AfLOx&w0#u>S0 zcWf=dzeI*t@8sWuC#|Wgh0d}qjscpdBK;z8RQjssS$E?F_ZJc?9zc#&ev8+I^ zb)iGhYn?u5>)+{aXo>%!yV-60rMsE_v+f4)(|7YzcZ2x9)7|JdEk9OX&eZ+;hKKty zL(Fr-!%4Rd;V%u3FJUHhMO<+ue{Xo?iQzgtH#`7+poT}>WkXN7NZ4cWDRtncwG-aC z_Jc5|>toB!#9?1T}~`@XK%JwHDd+%CjjPxW#aHcNlUl(;QJ73 zHxG#P-05t=*sde?B$}u;Z*7GAUS{hB8XvVZ3LOGPC#|I0I6J`>Ln)hpp1Nyu$XM)8 zeOehXlh_u-T9W9_a0=2dSga_}S`bs$LTPBbvWJ9z;M0tJ)Qc0twYq16QV*SzzQfhKKm&ZT*qO`%xo`T8pWQcy((3yfD?=}l@VoH_&|k|*t2mn@4Zs>%qgHC? zG!n6b)Hn87HxZV{aT*9^)VWG;I%WQ>zG2L)YMe;;slI`Or(NI5hah`%OC7LxGN?*k z5HNy|gE{?9^oCfJjaZQUOhpdXJI&u&zmTfD zIwKiE5I=ye)i$t2Mq+2m*dE#LwtxHwJvf#>phxvciQfD=B#7E`o>+XXg5Fea6XM%k zw&nMcO_8M;aS!EcL1|r7B`Yi@Jcmsk@sw}EA^|0)UGgqox*{aS)b}%&(y6OI#_?6B z)ww?Va2^_dK9!!`VAmb`a)^(|qUjtmYv?4aXPs6dcJ4aSnWo>$Cg}5Ul?Lj27(RJ9 z0YGrp$zKB>e}S_QpV_RkF8{#RmG& za3<)m%CvJe;>=3C`6h~-izR#rWYt5)21vd<$M*T;rnX=$30L><+OyKq)gd`}Zc7WK zfI&~;-Ct5v(&WdD7k@jp00uUO_W)}IIY=g&m-)SXb$!Y_iDq%K8hxF*tnJl4ge>hw zvA+!kt>!$5^+P#t+sW(lv9u>W(tN`PnoXWv|DKvRX6WjrKh(?2HT1gYU5uyXv4O)G z(6I1~F!u>mOC5jgD(&CVS-y;1`uK$qz^{Cht!FOYj}7(HR8$t&G} zXTw)Y53EwEwun|&V&}OOa%&T=oToYoEYIjAFz-JCUFxi8ACs^aXq)mz-=nLsXt;|C zFR=K(^mjG6?3xCQT3I(~2AKvLaJc1Z2Yq_uKzmnes_P~en+dQ;-YJ!oy0E7&rh(@= zOxl;f)|0Gbd_5QYWiEQm9OiQ63~>{hBtu8Lo0Y&oW>LMHSfQFoe-(R!z~`mhqne*V zL&z%*U#W+TqR3d(5QOd9O*dqpDQ6iXS9=s(u($KAS-O5It#H`}@00nyCWeQo z`MIuuOC8K+hfNr65UjulmL@ZB(VlY0b{q)ix^)g;L4O4patWUD*AG`odRVg{bNXP$ zzg&plhjw@a4gsaf6EROP5LOW#8!VM(xA$fPb96Wolh!*;0m5%9wwZ{E+c(cY?b!zRoVOsdcw0*XW{&cAaDRf+?JD z&7}h}qJ&SkBuE;Uhxo0Av{|}v*6ANM0dQrQ=Bh3EDU|AMeKAo zLD^$3Ai|=y11T9aPE+9;C`4lorAHE|yFxANpY5>qW4JbkR| zlp!y%awMVTx1%IdrzNJ$JPQjVTZ+eNiiu)>03s6OZW3GUMCC&b_~UvG6a5!q`-ROY z%7ha=WE2~#bx7=kLO+L4WW0Jzf|7m}T2eb|g-~)hJ+*WT*`UMHMq6lU%7gt)i{3%q z6{eytt+=R?yKq z1e#?}oO?g^w=e03jMi4-a&!m4atCyL0EG4CJx34U&aRb(GgiSqv8m-n+uJbf7VH^L z#&wC7dB;7pt}EApk2Z4AoH*+@6sec5Cx47D4!>qEo|ZTZeHRza6)Li^e#lqLd(>9> zmP?ouJGH=Yo;Q6ZlY>R!%T5!+LMdWJezJe8-vklOvhFeu9z`&%!Yr9bHg(6PH`YQ< z@iv%rI;}M?wS#hVY-q*L5D5x2Dgz+C7KD*)CS?4=$ZjRX7(|`nHYCg}GE<7Awc8g- z4JIw6K6t}RaxyrcRkBC8zG1^RP#ZBv8`{<_{I{i&;U$Z=&!v)#f0RlNR#z`Ur4q}V z{*kB0I-ZdtuvC2rH$Bf|z}Hrvttsen{_k~ll+`orx7AmsNv2RkDm1%4|G^?{RYH-17g1cvEP8$Z$RufAod#&`~TY@_8SlbrQZ(Me*^?{RYH-8^rz}GKd{KnIA1At#ij3aXk$R$#=PY zsbFk=6Zg(Kns$P6_{(V*>ffy%P7MQXZ?~^yjo_|ly;j29}aoLC=$xV${x|Nlc zreEmC{R&{r@H=`TOceidK^rS|rIruLfCIRusApHq7^ zD5j1W`}${1u;j~X$;HL*IKL)GhT5HhOP zUjtyN2pLcpoFd4;q_gUqj3wP2Rqht?gP#{s1)}#&N8RDK+NGnwgssdEf(n>;Q$8Oi z59i?z;HkMFAM%r8`%X%}SG$0zj{Xo(#hhc?b*j^fvPw5)b58=+E9cc<=uSS0tGEnZ zBJqfp)TU2iV{SUWtHB$pl^Ws{)$JM04yOd1ut!P7cRTc}4C{s=t7W_GJIN+)9heh%bX!v<5TMxrCpTk;x78+cYw3M zw^I6bW6%z6-yNvrmquhzlRLqT04n*deRW}wcQqH*C`0}@bah&c)8{R=N5sggiE1Y@ z)!OO3hr#bT?QzjV(s5~@Q`roeo5-nW*ETaYYcuf80bv2BxSXeaOUSont2dN*?Fi7? za7Imhv&+8&>6ymAwUX5=`*z{x7;wMW>6~w`$oM2<;FI35Jpzh`@j)S|0WIY{NPE_=SwMh| zltVP4`K&#Qnj@Bz5v}^xX6rOcyrqE>G3ajK^`-%0NIlhV6yb$4Nrw3`9JDf?r$XB6 z*J$JCuV5tBBHlw$Gzo}3YtJk}+B5rN+1Xd%Ann=9<=!&-(LxB|?F1$oV0#GUIy=o? zHY|oI;hQQ{`FSuEsvJ}$2~oMX6c}1#6D;=>>Nq2I73KZXMI@ z>g_{G8(ybP)m#_4lw8eP%XZ>}#AjWcUsqeWh}j@SPnY&E7eK&Uf55 zBqg~RmcT&HFpYIo0En}cv*5dp9AAHn2HQg}Km6N)+6XBH-Wc=5j;5ZA1`?ljPEx7A z21&0?%x64sHk2eGc?p<5YYc9E2N#whFPbN)lfuxK6M=ofwpP(E8vMxZ{yCfYqp>nE zAJvy)rnfd5aKe=5ka^?;lOt)uO`&?)p{i~{`Ai|0W$7nLGoxn(%MTv6YXjk@yTg_h zKnFCCWTZxx#W+!K>!xI$7jo7OJH2k}fGzGq1#8%i3jL&iKce+)n8zda)=$cLG%;)T z!)d~v?u<0j8;Vnj7vi!jtqd*~PE(_tl^apQmwWEmm&aF+NUEc_LaE^?cgK2l?w` zu3B$IS#m>uKFWEMs+vC63o*(SQSeIClwt2dfwAk@OK!QEogv=pmk9-t{xjTVG!!hBA86*ybaIo5 zrN!`Lj0-(iz+-%n=N3EcE2H|jhJBEx-9`X~>v7yXa*N9tM#m-`)0H*x`9vD2-Vg;f zZ-z(W_&2Xzb#pY0!8P}>V)m>)Dck0a%K8$=JQQRo+NSy2T-w;u*jF3k2NOr8em_!6 z8dmc@98BU?SDB%b)fH_*hmRdc7|atbvW(h(hsh-vpNO81pCEWBxD~s+96?DA?UVq> zrZ3W~<-tI^Kb%n3G3RDqTpR6JZjwapz`AGb9oVf5*E0J49zYe z!f!cLL88LdfvS_q|CZ35kcEPI$M^C}E!6D66d+t^w8Dsr_DtCin6(89>Ke{RI)<_7)lMkw)(6$H~^% zXJJB{bVll8&0L+{{OqSrsH8R%mvVP5anrY)u+tI?+L=fjcGzrLY~}%#Yge&qS5YNo zuu2`pCdjf5lNr`G)+&SfsrWsq7 z`K_NO95U>jls_=h9-^d#0-IED@BlJ%rNf0EwM?Kfo?=nadYa``3JVVNXmEH$C@sGh zGag&IZG9djyqCWYSw>CBava=Sac@mzoKc@9cnaN8=$BKwKGV_*CJS}vHETzoI-zi^yZa)q~n|}_NILUm~Ti9Eh(rYX%x_3 za+Mwx#IGQTE#%p(2x)!}#^LCK!di@nYy2@`j~&TC)vlc-d>Dgh8AAWSKjq?}DmM&5 z%b+wO9ecm_Wfhd%XMwKvt51NBBC3n$(_zp83+5}i^u!<9=O^g=s_JMzF-EQFrE!~F z;Y?8oedQQ2uURCE`xY~e@ZHzU_l3R5Y{G^>e$r#GzRl~_DLP|BpQz2FFZK=t^5aY} z0rp2lH>_lLr>J5PaC8B~!UL|13iC#;=lYu1B-}L7%MITGzCFbm9mhEV#(AoRR=H6p z(JY&+5!H4|81EuBEq%p;*AVudY=g-%D@GyjJ_sI*3vFs_ehN{kz@WFKgieeQQl>=L z6Rc7Ss|@;7b{dchWoqw@1QXkg86L3KuLBozQX`TJVa!0=>ti zxp5sUZ;b+Xka#Pu=v`=~aIaG8E8eajq6Nf^KUEj6@{q6xv>Vy40icbr3HdTH4s8$J zmn1mJ|Q^_%}Kz2Z!|rjHA*IWAV#2pKo@0+MWiJQs|FXf zA>c5C==Ou_)^CwV{ju_rO0CjUYBbh3v_CQMO_8JPTXfVt&X|wu87SMu{Tc0_o$#RhY$v&G>c15~@4OaAmqiB4XG1uTQu|&6!VgJuBWsPUXv}jNFc@QWZeeZlU(TdF{fWFii z_<-xHAtGuRlWWBtFtOk_!DvDz#$~znEyTAx-9}yeg%ovpyqkU~lggjEVey4^gFaSZ zn1!HonXX0a`lT93KGxsxopX~pc(%><(!|}N<|s2dR_k5DmI&C_uSOjDkefT1IPN~S zt<&piFfB_Sbr`eBPDY2k7l?kTvXGk|@}Ryp@zHDs>$gyunKCVfbP#Y*(aUxk>A z7@TLas7FxPt;fj1JF1xf1`vxwC8uLqE@rauMz%BEe9uwGX5I4H&|JPA&0fvCo4F{~ z3l5FFBdWQ#-0)PJ5}}#CR~!CgGifErJUAo-2#o+YZ&|-~w3)v9Y`bgLscW?2kO>(1 z2lY zbH+FLJ&_o0{EQPt9JgL2_+&RF6XuaO9E{of0ewuip7hLyQZ@5tEhwBD@^tRVEvEfz z+lO$SYv^*@Y{;=VI{>N9WD$!wjXq#NT&R;zXpof{V~7=e2ZpO_nOweE-TXK>|1!Ao z9Ydve(4+P4y9Ms$Wvx@;5Pqo=V?2I+2ltGg|yqdN9|%dYJ#ktpqjkUj&#F&P3|T2 z!R2v*fPRerhj6JJ^zH#3-K585Zl{~4t2>D597gXF7kzGm6Jxq2SL#hBIqU6}wHB}B zC$6mUqc@>HpkAo#n&Bs`qJOEUYTRaku$d$Di>hWO=7=2z+XIfu8S*;a>5tF3>PeaJ`iy(nwOmJ~ zw!|P0#(Ku|$X-NT1)+wzh)t-Y4U!=j(Z%3X^G&1L{Xr*;a>{D+kXK@B?~ zt1l)2;1DW$3YkTBX6bv;(X#@PKd`}?2Nvh@FcS(AK9^33ha6Y6fBah>@r_@?S1F>C zjDVdKLlG2VBcBHecJss$g+?0WWRgg6^+69O9%|IAGtM*SK?~f%X1HF?n^1F7V zf=8mUtOz-a6I{8mUd1Zu1Sr)__bH+{7oFb^)x4tG$fnsis^wassbHD`PjSw%qCIfy zxtPnUVEIOu(ID|{)M7Iv1AROx=^z*=!h?z!*D@;1&xJibeHBrIHxk*eDQ~Sa zB_^iXEcTg`k#U+v3cOzm>}ft372MG!$xI{0TS!+$8$WikW_oBwX?KJmOF{WUa;bS; z1Wu>VC+$G?M%UAOOzn&FSJSljv#x7yO2x0kr{D~oMKxW=j;2OmkQY}?E!IK3AJ;X0 z55W3@-Wmwy)k1udai|-C*zXyXFI=?NyjL3v*;1xQV7;U}R89%^IOe@541HhECO~!P zY+V1n=etwLUN~lvukKoL*%WqnmMkEfC+(u9_r`cam7thXUWs>nQ!|$jKH$|Zhr;q} zSDEQA#jL%J%EhS$qKC0(N4^3TPK+K2dVrB3NQST$&HTYw<<80pMB&G8q~Ml}hR#PP`+| zJ({R0T9~YMqM9bE`X&m&0K_}B)b@8st8Q1H54Ej10&wSsOnn-xvnOlZFye3DLUjf$ z8dl6Sc9ynojY~X)8}tr|NN96?xj_H!$TwQoXjfCO(Q9l#HK`?A!xs#XR|meE#O9P!z)Mx}<4k6B z!}ae4X>MzxveSg3wyckcI})EitVRjvw(TmxXd5@qY!Wn@#YV5Hk+3!-Sb9#5Ze!v- zV%_0)3HA?mT2(e=i-J-*uA-HGcER`183A-5jaT4qx~DT{Jve&6^Qi3whVmtWa5aIYAoWpAYexS z1SmXe&TF@GY);a-w<_%y`C>Zd!0vhC=c9a)irP8Z-lTR=*ad(ozwN%!I4eG46>2F) zYUt`-nLCuCSqVqEv?;X#^9((C|GMk?w0H?WjmuQR5!I@}kH|?B-iABp9x($i`uRcL zUelt`-pIm*&O6U4=SLhV@mW7wR6l3@+={LK1J9M##19<^TUcnd=GO%&s}%T2#Q9&- zyY|!v<`-d-ssMCTq+ghP8(T3xODkPb%1MjEsZW}8>DqsO&-e7dn7ZfhJib3%_-SL? zW|K6wZL_iMq%rT<)}6*qW81cE+jer&&-a}5JiqKeU}n~=nfJc-^#X&BPKM?_y_SXd zt}40GTcvRKgOx3+{Zr<`^lr}6%XFU5l+Bz#pF!0YiCM!%an{6HKp!=^#Q0ovzAaC$ zw@lFab|~L6m}(E=)0Bmf{-nX2#a)1>$;8vs&LgCwmvj{|07yK>!>+a+zX<&^6&1ef zWC>TY{tvI!UcpM)6K)M}vaBhkz^xqi!7MppFN^sdWzow{Z-~I09*aZLCSK=dAy5f* z+bpXwH+{;BKE9{ZP48Wn6&LpnH(a$M5fD6IBQG(-Chpay%q2>Lr6zp^X>xao>3b!n z2r!GRuS2+ykc8A$o3t?>@Ige(?sy|;X$HZf!u@-LVu+{fB$`W($p(aV!w^=;|0=9#fDei- z>01EG#(Q_Z4H9+>0zN$bvV-?CS2q7TQn1tg32SXm*6Pgkc4xI(jhW}rcw3r&1`z^=^Ns?YW|*$|bx!d&kX8UT`qV zUqz2)Aim0L+UYo$sYgK>zn9x$%NZUhJa{YY@6k3##oO41rz@=XHWOt1y==0()iOxM z1~-TX#M8LfX2nkuoONPyj=}Q@vDa;MTl-QuC<7tet{%LCa1-sG_F3N5;QjZh{W89Z zoD`8*kuca=#19B)3obSmNnf4j(#oz)^Xh-QviMAPaaQc5hz*{$JGsJP=t%eK>E+KeaQ3=dEGCX@@viVly!ar?=5zc=1_cx01?g z7oR@KvDrwI7I+H%$k6aY(+Kg!5P;dY%R9opn>=o;%bylJBDx&6Uud1qKg2lK!z;m1 zU{4R~s*s$gD7KY1uAc&schmR`&q`eKVAenA8>AWbsw0rmdbo@b*CJFB;B!1b0xd)Q z1PW-gdy-E@^QqQZh(=)u8AJ;Naeu^GrQINO5ODbPPtiWoc6(|MR-Cz9?mJxmx$pqCGNY0JuFM{ST$Cd2 zNYn6ftcNqTta*o_b|DP)EXnVk?lMHylIp$8Dq;voBq$7X$@_E-fO$SpWakTU&_2&yi-}2 zM5Yn6yDuHo(pjiWu~VDfX|&N~Q3+>QZN7=5!Fquvb{MXi{5LRGqB0h^c6GB2x4SF#lO2UZ|-(+x%o| zflYs-3e>73>gd!8_OkLc4oy3Zar;H2I5LXV7Gtcw7lDDg{FeatCb(o!r>>#tvddBz zzLNzbx!B+r=T}7{W2HpA#A^42p%XibPJ*!F-8jM)zzsq34d@R90L9 z$mS))(UNTqy8V3sb-B7@-B+;a?&a>(0`TSOmTDPaKJ>F94MYD?n5F9{5P?f_PF5cV zzCq5k@L{vuo_3`y_HTra;|fXjr6+J~PY25aKefM_6j{y9Ez?Uae)X;qWzS(t1p2^8 zvHXO6t*MD@%*TSSsyMs_Gri+uHnmAdi92pBHX64S(;7Dilw#Yk=6N5Qve3OIMWior zR<`i2<26s2y`F!39Kh_M#=Y$o0Y14?4n@HxCy{yRLESdI-B9NsW<0k>DWQ$j#j+kM zMsC^y-A_c{ab<4~p5C;Ir&!}4K<^s(;M&;n@3O+DFv_aMy?ZKDrcV*=bbI$a^A9a3 zHDUY}_;LvW6@1kU6ESyG9s3n;IsLrs#VteWe8C@i_46S0Z@Ix+?;))*cM5FF%@78Z zNOER3(ht~)-CE9gp*>BiFk3tq^3HO6#zkesmwcC${f79A|Bu=|YzCqKqIMSn>lb?1TZUl+|$^;dNWw*7#$6_5Sw5l{8)}=-|&k*ktHKR#Q z%%#`ZPR)p4R@3ZOXOdg_E!^a)va=XEo=LyQ7(Ns%$a;I*{Pv~Vdr#B#2#u8VGMsz* z>F^Q_n@t+NOx?!6EMVTRrzM7J`^6&`M_;C{#0m1)!zMt3pci9Sc*u1XLlkaPr!}b7 z49pjkY zaRpBX69tNIAJLkUf^jP42Af^YDOfv;YGhRCrC@%_p99dNNSYW>%#f3=XYWUULTd(^ zwj5EopTU3}$m{oq2OxK2trHlEmq`oZICTRvNPFc zZo0#EAJp#RhjvO+cgj%CtWdtp#o+1*_b3v?J za~!`bm&wBA8WMXIm;$YEE~Wvx;Ct{a5uW;0jV1t?{8pSj%)w_uYn6Cy#3C@BM+A7% z?nT26xQ8-T;WBmdEUN9R9dvzpUMJ<}X&G&OjK;1Ax?5|ov-v* zIUaCmbvC@&XkS5_x|LR5ViiSx%s&@Q9tovg4L#ut1?`4t2L9rIh(w#Amw)Y1c_x@zn8M&Npr|a6fV-GG zaR|`xWA*7=zdgR8YJ8I^V2yB@%+^@i!U4=0;nL8o)|JT?*myRER(5HH>w#TXu%Lh2&X7;TW7{4W6xWFMKSr_^sLzJ$VUan-(gd${XGxu3=(2Vq{sIwcJAt0&8tY%eR^_>0JS7m(5!^> z8bJm(Iop$*5~toTzaEQSpSN18Oap66-Q}j zRTqdC%Cb26AZSezh?I@t@H(BJD2DO+lA-<_{sX~QtdpTy@;dhg?{aQ5eDBV{t~+E_ zwW01<`Jt#B4dfQx56eem11zTxf62Rpt4jh^bC3UqeF&izFkmEDHF6e6T%viP9G|&r zylsA7t%AM7tR*FduV=SBaBxylA0VF&DK|_lR*IO!Pf!$mlNtz8JqEv5u7kbyOtOZc zF*#S$MdF`}N07q~KdYTaL-)=*T!3ic5&_ebJ2)ZQ-*NVo-?hVlKm#;v%r$LYns`d5~4Ob z5EK0!zjAD{Fg@DI1JAK+hv!S#`Ni_CImertqv_Me{jJ3PAZe09I9Gy#Ijt>t$CTs= zOfTLLYh6D=z+HUc2aM`(*V&U!oC&@F`E+`@M>wocYAw$$&z1x6phTVA`N2x6$_ksboRl~0=mWG>Y3_Gq||JEH~}mt+yVG5F2ku zA~4j?D?KF_V{PcK3<0dB)()Lm=?hBprL-rsh;(o+_cv^P1bAnmWD&R-m_Zn zK-{YNr%wJ)`iBE38JUXa+wFJPRDrDrp?K5iYO)%t&+2mJWZST74zVfu!r_NMY}n=e z1gy_KAwsc4!pYyHG^jCNnl2#iOyogi*{;kFbT6*W;qE#&C?dr`8IlJ90;_moY$t#X z-)>!`?GZxTtF#)3Kd*&nRO>%%Hjt2!<*{Ub{_fz4X%$7Z-QVsT3OhW6ZBfo@*rn$# zY}-#*NLWkLOScZQe?jTLM;QZ(_v-h^p+S6r;L8SV@lMG}5zJ<~4fF0F((|mcU&WHC zin)Bf0ex04-NC_gb-U)r`BGHb9_#h4It`RsxqIQsy~Za;#ST3P;6_N{WrObgV=X8<^C3(S3N%;3b7=)dqc`{*Z)mqHwdS zCCxm9*ldP;*OhoxEWBL~_nL<+3-gE2tBwL_+^UWYF7Pe-X`C)UDW#nb3^4JFy(pv0 zo4BR8D~hfqqoDIJUZ{VmPf4jCt^Xk5ji@atbK0wr9%g5=2pd-IqzD_U*{H_fVF8PFky1b0X%txqACn9w8oF3N zEIS;JlGLCipyeqtxhSn>YIrF9lxev4u_tQia3%roJ+(MU8A-q-1bS7O_hqMt!6cRg zKUC)+&ucDR!M)HXtW+DOysX<8LdrqtUp(!6&fHaCcQ`UWKI1GdT!q1?b5UUs#3+bH z-WjI3h=(!l;()tIA1@H`3>gO?=d{Dm9wFcVx6z*KPUnS|g=)Uz3|2x0xH&DVyDKgC zF4(JQcB3P5lcs4KaaNfezX7XVShU=H9K`NN&H|IQ<@jT2d7b*jB$bOB&s_Ea`%6wP z|0gHEmK|tu)AI27JLy)9Ers)r&V`vS%=LorVXhE}<{ zriGqIk!6&R`jO8@yXns#5(`(2AGfxUNV2)NQsc2)0&VRED6H@Z4|vq-RJk7V-U%~n zQdPBE^_a~n|I~J-jV@E z?Zt)EJIJ~|t4Y4VssyOk(U^@2XI(xtnMnz~^JdLuIqhAaAjKoI;af0Ml2+Pej+^Pa zgZxsQsdZ{JbLITb5_~Aas0Ho7&p#rrbW^E8#Aa%_-ChVI{iKF3;)*-v62+BnV6ceK zJ$?Pv4Na;+C_f01QMi3**1n&?SjM4P@hjDH zv-iBAawJNybz0u;-Od+Iw@Gy_{0-OJ21p!@{1YJOrfImybU$+%Ra`hpRv6Ju5Ok^v zhZ%s#U`wMF(fg?r-V4}$^wN7^vMbm5gkPv&*L%?n?|nQ0ZeEMp{ne%WpL@Ns*3%5q z-m}TWZl3AJBU4_BQSk`Bud1d;c;uXXh#jyQ!Gd=P3YB5_h&T4*bACRd(SE(2ryU4D zTzvf=Evw-GbwtpgyD=VdT$p5s$%JH9nEkD4&0FE=RDqB} zI1BM;L-t8ur8>IS#(MzEK_VW)2K@347u!DQ5$Fs!9=^U`7WUB?iyKdK z@O7Y8Q*}05{PmdsCl)o*6SrqIGB(%`E&P*V_ungp!zC1-vUA3SnT(unsw zbbsW9^+r9X+=*8}H%Rh}Pnz7oLhrfRHrs-kJ5Hiipog%YV0 ze1xh9OHu||#Hx2b^2t)M8cSlbe=8ZkuhsAv=QiT_`?LDCS+*?9}{DfK_%Mr`Ot(&efO#F6}#j=6?=9j1J)n= zpNj1gT!A~QQJN4H7UjcZB=lrgd1Ge8C%h8C_@`{fbg7Kfd4OO@kJg4!t{ep*_m9QC z<^E!^M^yjEVvm%&pgph_tSNs{-zM*E%efU+B!TC(We(`L#R4(Ia_7)ii3Nd!3*mE? zQzn`(O!AC2zhqmPtONH=gm3n$IBlHqssKe~KiN(CC4%pv^|4#;wd@)K~ax+=OJL^ME?qxet}C;hi(Lvh!)oMhY^~wS!Ar*bRyZz zN+X1MZaf$4g|ka?rMpmNW0P!yCMK&&fIu<}^21^#>3%#X7`g~Wo~Mj&5{HWM?^~?g zcX~YN%MjpyGD|KhlNkMxE?*wX_8X9J@Y`9QO|SZTh!&A!1xB|(5FT!Wz~!N=&N>Lx z_7@pCch3%E{N)yd3^X1+^kxhDs!J!PW@ZG+1COGy$}6%`tJTlCpDA;2cX^glB!i9q zvn$^e1QTu*6paV}POh7BmiQ(2?^)>XNM$U@IVrxP$}TgmvadnaulWDcQb+-eR?nL< ztdcO!LOEj#C(ywwH6D`18coN7&q~pb)#`AYVE$`Ro3hf(L;#PyXfMk)FB%+y*pe4 ze{HfiHa*WhPQ}t_;!da3*O~z`%6W8UKg1H+I5!+hr4<4ep&vy3c202$jfgJI+$OzU zeCJc;T50NL`NMBl$~o3E-nHAg1ei8QYjuep;mcjCy7UFxz*RpH9?Rv=&NNQvaRE@P zy-6bv2q}g$ZtdUn#ElxM*avB?^{RR{x-wruUNQ-Pc!YL-z8_4ax$V)EUgjg7d0(Uh zVjh?rYz}*GD-joSdIYQAe)>K8!Q}DJM*1az7#P9IFw}qpeQ_|cfcPgUkbwP#4Ws+l zH}0H*N6d=D+`}lh+jiTun@Quvh97j4KE=nPURUL*UdwEE`>;y&S{yz0!hIgKUfr{S ztZJ3y`#yFs+3R9nQ3+=ty;>T@0u0%9;OTSMt&mwfr~3MUl3|cojJ2Z)5pdq|wj=(< zyUnd;sP>|&tQ9m@6(Z$`8-qcnA0Q( zC`f$R2Vzb$*M`5yj0$YkSrT1%jOI%SqBu-FS*W1L*+5&z1wGUCcmWJ_hknlf3_!u5Ze#Y` z2s=vzN@40s1V&2*p72!CejH8aoMEx#GPC=Hj3ju3R1?&lsFcdp|F`^=tDm%dN!)ub z3@+EOcEc^Too56sgIS7PJlcwYXEdQomtT$q4@y zZAV0!y$XI^aO?X5y@zd-Mi>MziHj{6_zoh&)R`w#Rs-{S4vW#|81 z#@*Ed`hORJBLpJwBe9QB5%oV}SMpGZ$^f7`zQ(*qT!zl6PNFzA{FZf-u`X>^0OT8G zSed2W8i}kID>yMyU+5qOEdI;to=LoiK(wU$QKEfKgMEF{kGI$<#Po1$1%ANC8HI-h zxzaXvZUa$=|A3XQ@MMw4@TO1HejW zoXi4Kd!&I!#$lu7E}Z_ZhVMpZbJzyN{fliKzl*J7C64M%2ju~HDETk)+2!knF6Q%u zP4p0P`D8$Ku#aBEVIs=r^#j3mdo6nM9Dm4_$(TG2o8@fKbs2ul7=ok;C(lp^}IArk_j7YuGOm%fyKG>m`+QekmfbXhsjwo*0w2D-@gSE&m!=EsTZ+$VQLUs^+}qXm{gTbH(%F{uP4XSQNc3 zdbq?gU&y>W^%dt}gV9}W%ZzNxN6!3eZ2e>T|0BI$IE@|uBfS?nURl3L@6u@Hl{J=s zq<441xccbAum4DI===pbPJZQ!l-*6|B*Q3h{c1Ilic(pr<_w`^LR4%(r1q3JPQ+QXAMJ``(ABfg}}V|hbH zI(+9qRp$bOUP@XPvE4$0q^3bhUSvc5b2S>KWWtna&fhMCY;w(09F=jkatMMyinaPyZJE)cK*3dL7B9aCW+9pLzlE7B@FKcnJN99mp8X7{rV( zKkyDf^D*{=Y)Z1A7&l5YdQi_vm&csHV%%i1sICowvP;D26O2o)5BQ3-8pASK$Mz_R z8!O)aB7bH=re%)tz5rbX-s&}}i{8)^(&Q;u?mbY$9es^jcqmLeA!Sl;LjT8v=YKO0 zC%r1M{*MV?aih2mio52f3ep|<;{&jP{02ipS@ty{`BT@ zaD&O^wXaCJWkiHIV-30X*7Kwq#{$uYtwo zU)R)h6>Vpj(K%jmZHIGHa`ZT~m!)qy>$K#L<5y1AT9Nw)wA-OsA61Xa$AfA6-!KhNuSaZgl zTJ#M8Kb*d5vKc=(bU+C44E3Q4^*KfFk35N7zue!ZI4pgp7l}9tw=buhY6M5FV+8Tb zDet~##glkYqCp7%VMi`9un6%7CbGH<;^gSLuJ26{R6mvc<_7XKwf7gve$$+_3INFr zPE70Y!w%()Z~$fOX3I0FFGDFIiu|wOD0+RiDNXhfIBKhaNMnL;4oc<(nCw31@mt29 z;SfHoA0uAo-%+#JACr<#^O5d{0|1>s zrAs+P25YW61HYqM#o@%HK4)u!HvwKla1asQVYs0h_D7*|O|8v`&Ux7T$P+(Icu#G5 zl4CGP6n3H+-`M*Y%`mBaPm}xeLTy~`JZaLQB%sJZN>tj(I6?%0MA^4 zv4F!wmEj9wLFs663L^}<@{x51NrAFi5uxZ1zU*3x5D57XNKSIm-`V%^Q-G?0zmc69 zFiZ+3*(UZ`KzV~jf6$6y=caHs|8h^gmG3IG{w5(twGe-Oguj(ksLwR{PWO`tvl@h3 zVXZXc20yeL6Fx`xP9-AskJshYPqdGCtfXAU;FtF_|L9Q4LGo5MBeE;f%YDk5LC&SE zp{T>Xmsm%hGZw7hj@%g+RtNkb-XRzRjj&T^kH)L%NhwGbIHNcVVmS0FfS%J&Z$o+- z@@kg(srYHUWTk!2YW?DnJG7 zmB{blx5N|K#HU6u*dgYEH9cU6(h)by8LHi+i5&WN@oFGil_?8!BrgM})9#Ay7TP~e z;n!}9MsAp7_T+#N*xh7yO~H%Z7A^pV!>7X+dy0)}Pu+R(INC&uK&~x~Ud!A`f#g$= zmc<}7e{;eX8jwpNmIBNrhVi?Ad-!8N?;e~^tp@g;e={P?Qn(OKl&T(@_E;wU8YFE8 zGyfYpjmHfazkxPxvFoy|jK zxSZFpTYKt31lSxqr3o(HMeTU|1COZmH85AEgUqGF#STMJ3c_9ceL`{eS~s=6@6 zInVK;MPOxb!`80^AdI{x#q5Z#e3Ph zFQ(vZ<4;N>OL-0;;`PSnV=G9W~b9L^L_RnXl zc_|-`axyNg-kka}&Eb+HuUXAuLRy<*L17TdMn)>fy9u)2N(Ny{Je{(AcX~48+>u2? z31+F97U4C-G1#NV>w=^ii12mdxZ<9y>xxUjPB}C@fI&!_VFq1`1FQ4*fDJqWeSY%E zQ-X%fvc-h^mXLQ4&!u)G>rNN{@idGHL561emzq^!_ho$Hjcj9p-q8d;8$xf`RM+o> zY%D}8v70`Yy9TQtN~YznCoPo~{}!Li z*AqZS3L=7)bEY|}&*P(ZyG^sWgLD+Ann@KUO!ktD`?3M4*zUKFKpaP?JzwUEh zLdnBUsrKzdJMs47`2KuGWq7L4b_x*~x^`&7l?Z1)X?$^k0Flw7>xe~V* zoE;)d*;p@M9sCSs0HVBslEB0x&3}0*yZ#4WTH%U5m1B5M9NQq%ydoBuQkMG-UyD)8 zfq97JMv~z@80v3eIskGnEXQQJ7x3m`PMG3wH!r1An2wX2Vfu8f_Qv15@zLJE8c&hf&YphX)xz@(uvH;V{tO<2woHTk<3b*)$3lt zJm8-)lIshN(nHbpigwL9uBc~Yh8h^xHcf673s;L+RVtPbXRsc^ z2Y8lq&%Lxt=*-1IHw@sZS_X0YT5~b%8lUJc}_hGW9UtU>8!3@8@OkNA9n)0)2wj2 zbPahbQ5ZXTtQrT*WHsXO0yS;*2lo<$(qyUlh0O=@#Ek)#SKF7$RTt7xV9{(c%Gu&Z ziU*5%Q)*Ne?V50O2D1ECsb11u@ZH%ZkCgSyULwM?ph=iAf16THmTkkw>e z=8bn*moJ4>--GWJD;RB_4n)Vc15uTPDW5}=>EVyi4fqFe`H5~yi1{OP@Y^y0;-c2x_OU%Phkef&zg{} zx1O4(tmDeWrpnxC2wQGulQp8K|Jpvz&)lo1G8fmK$5R&@ytB>(&5O~?8?qFocuWW) zl%RKB_$ls6D}lqd>J7~Y7zVW-swj&VB+M8tT<>=#ILI{P zRhpD^I{KZ7Ow|fSs%rx`0=bcb?i7Q3K&rnn- z&&&LcNUf{t_!kZgu6=i7wzBy@+XWPQf6JfS&2dKI0>}EwwMWbKCOg_v>(2)*(`kIp zEP{*l03ND&;;RZ~X4{P&r{2c}QM9)*6c0r$t?GI0KnL=#2~U8_LUsnLxf%S*GXnXl z=-Q1(HzbaW7DDJ9Hqoe4Yxs<6VnwbKdckG`<^4#|I|jlXmP7J~?(|At=x(KZv+NBw zjBJtQ`&);^v6(AT$`3d3gNd^DALWe|T})+GU?JUF>rClj{W)i^*)X$O@o40$YiKw* z4Iz#u{EAe+H`xvvdmfm=Yw%2@Z%p~gvv`*P^uJSZy#j5`+XI$Cly?g05Z&_5pJCW3 zH?Kx5UMg|GMpeIa1E)%n(E&lqsZDvFUEjB6KWNXX%YtQz;PW=;w&#rlD`DDR2?TH^ zDV)>!HlH-Dj|!V-y2R*ssopk>!r9N>^t)Qk7N$^Ry6-btM>IX1^IIVmaa1ad`9pDG zkSM!a3|Pb{tp@lcFJqjSSvb8zJb-!$;pAtc?wewD6ynER&ykg*bI@mZd)qZnpdPru za3)k-0BPy5OFe5jWd6Nx9YL&5Am~h%2|`I4TQLMwiyRp&6WVE;Wtwhr3X^>`exIN0 zn{E&*lECEYflqdS4(ChFR>vkmwCZYl40cDGcmLX_>Si6Q)dm@7mP3b~1{?Gu>V<*z z{jnvyj8HT5mPghB#>?nMdu!H$);ZzXFVFQxz(VUO;pqiVKAH?uE@H)B5naYSH?7Lr zMbZIw@4h9~bFrkccRg#MzKjtj7-itsrdCthUy60X$2aJC1W>;bX@MZx#Rv&yFiU}C zbUyuXsQ|VKq(!!Ud@o-6xA1C>3oZZ0rf8kx(~Z&N9ci;BDFNg_(E3t~RMvdl%8$WF zF!KhXZQ$K^R5rkN)fw!0KE|^s8#l{RJa6NYM?CTXd|$_$)XDJ?cUaR;tLF)A;@-#v zq64SIU|M@2SL%o|Dyu)|#W{2@B@+bIE)tpyhO1+Pci!l~rN9PrtPf+ThRS2#jM%8( zx)+rFXNuMjLYZa8MDU>DZx(4JzNamfz?Qd6S=#E1m-B1KHs8Y}<_0g=noMUFpqM$k zB75EryRUQSb{23{^Bz|o7nfy`s{3!8sKqq4lvyxtRuuNzt=5@SUK@`speI;br^imD zn#!aBt*6JnB8$HZ#aQNUE^fz%M3zi|cFCyN7PNB}mB9;hVRDz#3obEZ1x*K5*Rs7# zx_hN`jkLNi&X* z1r3dIZ=Hicr>K!`oX4yy@oEPgw<0?@IcO2LY#Fe76B!eb$cmTXX44)XR-JBs+x!5H z7f>6(Dh*qc=WO%`#G86azP1kxh+egO{mpkn`nTnqzE`v(8+yW|i0ap2yLQg%n7r8m&Se_o=Klr7%T4Pp*CGc@I)BHZav!QT7NwD5zF2pzZ*FS)d6C3tz1>{` zAaC13x1Kru4^2QOTM_O2R|Gr|y|Bp*;6{&TH⁢feiBPe*t-t8+ciOpXex5uqgyuP-I;Q^x3f=DCccfIpJFb1CE`1%{y=Gp6- z4k=VI|I7|f0qPpovXb@CpxZv}AL9r{D7Z1P;lO*2WqgMD0+`%Nqd^t18l}Fa555;q z42PU0vhMxM1gJ-mLR4wx5Lq02d*i{}+PC)oe5w2jiI0Q3F=B2V>ia&j$5e{_q={T6 zXLE-y!-?CP#Cz{)M0<2e9bm_QZf>L<*d=!#%?fO*(K?ZG%`V=0C8y7#nOPVYzo@j` zapzwH9#{3i|xIEV;jfMpR$OP zq$h|b@gqdIF|SX2^*@8YyUbQXye^nrR>|L6o@u~-dJx{ISxsBgzPv1|L*q%h7Uh>% ztmGnA&iG?P;84#SxmmJTX%`RZ9=>H_&EB4jA6iH=tF)X-b0 zS{z8M;Fbu$LAzvdDE?Z5ysY zbsALZ2C$ICLdF@IrXprD2l60jr)Pp5KCZ+1_;){D24gUmVc8M%J+7|mU98#Wuw6X4 z~;8#OYA>e{Y#W8gPrQdJn^flcb;f%S^{qZ7>kbr-9-gA(?5<;~x-x)`SLSSi-poEuWHxY@wKc_UNW;%kOHuY($rApXV<`2!D^oW zselV$Ah8E0<{;I20c%hQg3h4THITA~*JOzEB*N{*90(*(f2gU0u!OYT+~CCGvZ0a6 zGQ?9x)*M`7CX?voIfqpycM;GM*4hgE187SoVSJJ;9fU9ZoacCQnJgMDTDxIRTKHJz z4KOtbu#$Icjxr4MYv_gK@?ysN@U$EanQwI2@= zNgDMP@G1Q+w`~6^rYhB}R4sp|lFSHT8?PXF^`cI^6Co=;-CGuG3As((aPX4I1q=tW zlBG~KE5|E#T_k3EnByTOY@JaJQ$5S12FtsM<<$F6p*#bcWP00{pUzW_>v1 zj(LxRER(x&UL<$cP-SUH{sTh$5sEsI2IkE{iY2;TFvJ!`Gi@8GMr$=Pdz#VuHrM)n zP8D*6{w9gvCu1e3A<#YqLypK|6d>%~xuctmu3D<&>h8Xj_}aeqgX?usZQ})Fb??se z=y4zVxR!H8oBZpLaw+c=HC<;_6)%68fi+X9>XiOFsC)OgGX!^(sGYs$i0r^s+zu`6 zo`w2LrrRw?06?YTTYV3Fb8_Uvop}RR0+|B6A|VjC{^Z#SA@on0-;71|ZC=;_JL*sW|YN zfIHP_qwrA^Y$#h;SzWJYwgS&yvXD)19LbomQ^5Ay+cKHp4_n^YGp9ALCsH*N@7+{= zsW|xqNW4rLnHkPfzKip(V!(y+siVZ6+bRs0tLaqcq)L79h-H?DET`@wTGEerr6prW z3P6t@o}CeB@k!Z|iE8}hH%3`M0We_?DtMtHb0?5Py}ObS_E7r@EEq(-LT`^bM6B01O?!Lp}VL?d_89DBa*qF8sRL*S@v$TXE3QT@gPLk_4{$yM1 zxVH7hi}+j+3x*dBZD7j*@(&b_@`N&?kn<&>8nBnIEc(#Y0`T?#nG_li*V6-R;1S6J zsE~<@2AC_nf;=j?t;jiJzwIc&Kq$_aT9VlzOFl=g$zJ+GT%7K3D#mk&%_$GU-w$)Dv0ncyVW3ui zAz3M-`dU}>(js-;`K?f8V_+42FKx5O{lTC)3xKZ(n|<-xq*lZJobt-I;D$lGb&4T` zwmd}RWVm-M4mRs5{hwdhEy65u?=%Oek&@1L@ z0raqW)5T&!b3TWOxVAy8=Vfon>=_trFRwEOz4z!jbjv#~7^Fk;R4ieIEflY7Yb8jn znhr}A+ZinL8JuJI=s3}Kf1t;xHOK~yD888*HOW7iViNPdh1)-=y)9`nn1!A**oaON zWS8*NX|-(+u7za~-@Kv5SYf5>E$vj511>=V^>+wAq(`D7e-hItI0;%wdj*U-CD#Y( zOOLHJV5C(v6n6Akr`Xhn*?DAwn-#mzFATq#)4CQ!IPLdu;Q56Ov%2!NeafLit?5e4 zj4>vQuZE*!IEe{_rm)qFAzCyCh``%=8xl&knBJQ zScp!j9Xd1~b(iy`V{u-;c?r6n%(}dp3??>u&3MFn-bN(QBFpLJhU@x2-w%=J4bZ)8MSvFas1A!<%&__x8fl5riTdP3Z5^%t$C=x;BM zWNq#$bU{9?E6HN`)2#gzhd^WQ1JOqxfpjOx*rY6Kr7O)hMYM&Va0$3LiS~kJ->T=5 zSbOdeWOnIF;&HfeoPd@m$jktR?CtsGH%Viv7JN|5AFs5&_HRqU0>!U&y7RYB>wRzw zul;Cn*kO^sDI2At3Rb$zTW+DTKA$0{)Ej?MO413%uhK^bOHj9Ux6cE88?u3g41NL>b=e7CKm)b61%vC;)X>Yw&RW(qV)X_;y zJp#H}t(!0A>ZbIuiL4Uezeh>Ll^Uc<%w=1-?G9T5^f%A+=M@AFDC zo_?cuEZpqvR}@u&V%w-*7hqhiTB4mY%4Q*;<->ft}lj5*I2Ni&OCjJqTN(lez9yaVW@%Py0@7F@>pzd0b9Ga8>PJauSb`F1U&ZmO) z%o(S&GXgw3AuuOMZDo|+=&AGZCF7{w-t@!p2B|@xy3bzaU$x;@k5&g~td0+^37oH1 z~#S0hO{zxmxPB4 zr2J<9qXN}3FVp>E*o}mg?l;nWZ$t$o=`tD&kp53nAyh38S(%!kZ7x--jg&3sbb}Zv z=hRo11E_drl*K2>cGJ?9_K>)B{3Hm5iNdZt{B3yZfv6f21DdK@uqr|R`#`#%nxPSw zIMSlF4cX{uyR~Ly$uzjge#Q=Ne5AfO&mf*)*hBsQhq1TpiYsc+C~?=qA-KD{1}A86 zw?J?U!KEOO5G*)_6Wrb1-Q9z`yTcU8+tb}2de(foe}KiRd(X4a-c=@`^)T?)mi;D$ zU22t%n70#a@KLuuVyHjnybA@593+Ip@_VBVVkoo|{o(YwK-c;`ixJ zkSQ5h^uB3A`!`?FvQmxQi(*@z6@AJ(3)rBsR_edoH#3pdje}BSUG9Pu%zEf#MLM7+ z)C#@tR1LCc`!eFM{w^=u4|wo>g66%7nosrPJ9R6{;TQ{Dtgf8lci!n8Mejf4=ui+N zm+uJ`E1lDdf|5u9#PoPsE&E)a?n-W=QB_jR{83IyA9gdQ;qjRDSRjuA)P!Gb2Y=%u zU0Gv-)<^+__#|0EY+((T%XBWH)S`7|y0#$`k#^2sQ$Td5n7mxwh|2Ouy19m)E$lN_ ziQQk>=d&DJLe@>sAbZ2jZJh4fPXjG@W-v``nGT3`w&W|%^%j2=^|?fh&Oly%T3l-l z-+G0uWk~8h|3i9MY1KLJ@Xjjw&su8$gcC^J8-sS5ATQ+)9mJGl(q$6C0SX zjgqIs*Ayx1KzFoDKPtRjW?BIyErE_PPVfqqng|y`JI9vhh|G&SEzOapb4Drw3k9@b z<)H{zGb@r1=2uo);?kMfY70&}%7THnZYTm@G2G8c>!ZH3+OzRseJB`ctA@RO;iVfC z9@Mk`in;f(uvIcD@#*J=js;GH} z=Lz28J`ZsgvX`d`-7o3(wt8YPQum=Zy7ixBwlRbn=*_XAcIUg_p65Ze#tV{2NnF+1 zG56Bn3;n4V#&8`=C&bw2z~{xy65ZzV48!X+fc>C>Sk(pT`q2(1cOSBLH4nJuF(a!P zZua)rf*+R^p&2O?&u^Lgm}YKBn{j`B=W{M^kmlJ`r$o4vcxr~`0c>4e+G!25jk$#5 z_L#}p^<<9L)OQNT8hk?gJjye6w!sGDcc{W^zS2CZ!GNtidTXV0YT`G>6Sj1xve-%i?m5GAKN7-SN2LX6UByZBHYPAofE7Y5lVF8Ve!=vwJC`E3cUqZ~ajab>BDF2(^hJ^e+lZggvQSv(w|UNg`s~hb z(FM4^8q9=z6;8J9%fVct=2w)%6P%}A{;NMItXWtMm*!fcQU;n;ZzOz(>pIAxHP>x) ze$OU>SjavzI_~mGz{aJLy<#H5LIL6RSmVWZ*h1EejV4B85ha;BZ*(5|z9@&ew?Ly4 z(T(Gmmv4~Fyir4;ThAQAy>i3Mug=!oSg#N1d*A~lUcG4-#lUi(co)JA#*d7~Zr+>t^ntsmj#&9<^>?|AY`enH=y#+q&C7ULI`r{Jwv32q=d zfF3R|$sr9v?=CSJfLyKCP5Dh2-Sb^)vzC2XGI6TI(!1FooM{IJejh(ZU-EBFu=16&5W@M?Ia46MisRv=Q|V^vKS*o$szoLIDDd*F6s<#vq+q`Z zr6~UzLQ!$`lfua@$b91qJ&UmG`oZ#{zIS$x2&~&X*G8ueHLK3F{>n zqdhHyy)?nR+nS^ zj@5nOWdY8FG|+xhzw~5ahmnV*VH;9LucL@7-@jw2Ycwq`zQnP8BqZBZMq5bwg81DJ zdjC!8b-mlqODDJDL(U&N(`ZA&tVPAG-R!=*!p0=|`>HF-ZQW@)>Iyrs6s%wYLsIVlzG zP9T##xKY1FulDd#l1ejfni>6cynKU^Pz4`EzeO+FAaaEsCfMS?(uuLiNoA*agGZg@ z$;+Mp@FgCdY$rKubm(K3%Z;MnriSLbtscL3d<7#>rUI?>UUanQ;OE^qn+31PI9 z4JBcf>kY8DDz2|+VAV33w@=XC1=0FUpre&e#oM6kE6Ub0%4x$GTDk6&73jO`gN&15 z6HZ=JReF&YyzGvb$1L(zYsNJiE#f(pslqlbo}1_TDJr7d&CZyl+x9O9kx|X3Zi(bXP=|I}*tC!Ae{i|k7ht@eewU@-B#hY%}9#-y_pXjX`F|12JTD{*Fx+2Tq z+y9i-c8F(nPb%LzsL5VFRfMcw`dQ`_O>FGW$cTdgcU9sSBj9_x7Gpt-a-_^n05SQE zXeBZKcU~gi^KQ}$kq}XgI)2ND%Od#R zZ6UVS9DT^ojAOieu-_UZ#zCIFnB+h{O&Z(Z5GF5C?@l+ha4a?aHE}FGa1hc1tS@1n z`D2L#q`&U;o~n4Lp0dpbXr@}v6#RYQ&J^6}D5ggXtxlJ7hoU-snkf;01A~MT^trqp zNLrq@dZv<5-OhK|F041-ve}--4s^XWnr6L@xN}Xyt?nRA3I8~*5=P(yA<6Ggu7hbF z6R9gxR{z-K_nNBn->^kSctzR*<&wdC!#|%l z%a8yjH!G;3_XFAK(Nh6Rv$&tA^$X<6|uW$^OD5PUOqdx9s;Pb|E*N_B}s8xsV(Bla7-;TZB^L>@t zW=hJArlM4pJ{>n1%fii!-5WA3-(R>IWJm1%8&byBOpy#T9rvh_b;sw{? zB)50~X;upfUIdpRT_yCQl`6rx*~QDoZcy>KC>?MKuKJr3Baa119$rMy*sfi?}nzOJ8Y8YVxmA?omh5N%xa3W+2rB<>@zK=ezKxLw)Q4`Ix<^? z7Hx1g%@#9GACi-4>`xKd-75)f78XBD|6&{y@t45)G2b_O$47*wvggTOgqLT)}BOCBTJFbe}zY@VpTMX_CP1a0l2 zH`=gY_f)Jz3-1N$oY!os6#Ely`-%?cT-8Ldgc7S>S^TaB1?ZDPOi=F0SHGNY0_!1$ z=zBb%{BH$fv0xQMx{pjuSy09tJAyD;GO0A%;!AQAuECziA!c6T6S?$z839bDuD0lbb*H^Nc)}2wKE@4Kxp!ld4ibb7vBp} zEQKJG6O1)>*RnN}+=Vn5Mn&-*(e6VU*+UiMta+|7ad^v(#T zGl)8lk!%lJ=V21Y*vtJ)LXjOk8fI5ljP-EU06x0OO4rDE?iAbiKTuV*4}LOP|0$$0 zqRBMhsTlJye*E%+j8`Q4vK?Ul^&oE9@H=G7VE?ba?xR~jIW-c@Fep&4R6LN2?8p+v zFmA+y_(@ckXw0mYjl-8VXI!3ts_d9dY(0znkLowF>SR?6aW~&Bnu!I8)c`Eq@$h{= z+=%*RK@!Ua4YY3yiQFabb0*{+4ejL~EI}x*F}c8tyUV>{(qB9(xLBG@Qzf6&Ctug0 z6pc9q=bH&LIaml`4m0hTCw>4gctaB=5~|+ooO=xvdiBj>1k#zz!n3`T*2iFAerkx6 z-s-dTQ`pTzpfe=(v*}`&*oH`v%#>o_jW3WW6te?xq%TeTg@R4_~csb_DsZ-X|xB zdM|5!?ul3)FHYdBt06n$Pfi9($lEz#GE3J69uj-haj9nCLd1?TcYjvc3S-~s85Dpw zF3+D@8^LpN9e4k@`xouTb9p&)${Y=8TkbYcmO!gBil%JECC>D7V# z`tdq``c7Qz+n`ZNkntHV0Wil_%R-}{i6bBwDEAX#(=d-7O!QC1geH?ka~W#l-f=Zw z4x6L-(t1leAPjwM*uFk(Hd2VUVLS|f?Y_+0%FQ3w5}>|UQw<{a!-){-Nlk^{RdSRd zA8Kl9b~bQ#1WIVaa0^RE-X{Nf z%8;?_v1m%VGDjm`C0QzRtljU4Vzt=wCaafjIATF|uGfbU>sH0az&=!{=-8U|QjzIO z%_BihZ!ygG=k)X=;BSJ*pG65{mmP9RgkvkLTLVe$2BSInm$`O~KHTW2N%=FeX-TUf zyDp_He9KiJ*;sp&1NM_K*n8SYL8l#8IjG^FcN!n>$F?u%#meEzIF%_ARX&CuV3Phx z+^y0*!5G|;J%n`>;}nD984cAXHL5xAMn2ZcE&p) z(#PW`d2e9s`(4s)!FXD`3c&|frcm_c7@5=MosJ#g2X^;CewlqD-E>DHgoB^eE8IT{ zuQcO*q%XPJGbGMoZ}{uFFebG3{Czq}+$l&e8879!3+54VcmdD~(xmhN#Im#nIw_s5 z0j>M@W1s{Lym!F(1W`)}g(^wI7h?nG`48FeKuO_98(|%mhs&>u-=4d)zv+;8mqpjB zSyxuTa9cKH;!cObVz(HZ;{Dun1+b}iP9^>>5TZ?O``f1yVU9SXNT-Q zP!l(~gYULmivc^+;Q(dp_(~ods4f5$ua=q(bj>0u5d4xU<<}hN*R|wVOR_v6lo$W$jaQhO%K1W&50FyCDBBD zUHX@wGhQnWoAV3@`&Lr%Hs|9qaeM9Dm{TKW_{mwIudNB_w!h#9Pv6Rf2kbRT^pGnENm_Ia zzss#S++)J_xJmww$=~iHT8uDTwGRsS2H&ZE^4dX*f#&ee|LT{~mD7blT3Ml`rf-D) zoNUT&>N*p(r1tKz9p1WNz!WAtokgO59+6WrIEmxDuT)H#jS{%*P3)N*SubpSw23w7 z^HY@`mtU9FD^Qb!Z`o1$?OceTgWm^78i+t(()Z`nJevn|^moI!Pt36Wh8Q}}KP*0{ zw@LQ;ajrUfH}D)jEAYBht+P~|@=X9OWFdrIuLkG3MzqhTh$i~UqpjEwB8rmyIc*kA z%v+0tr_-sWo1s`BV`-(Byrx~fT@BE;l08z*9Tg&A_C1o|DNvRRy4J^;ZsP3Oim=qS`bXP} z`1od9tAVn$8~l%#J{4O}{`L`gc^@GA#nFWsIQlTL2C) ztBUY^<$9%s+{{Tu+bh}P$Q_^|u>GjbEa#1zDRkMjTIsC37 zc0~~DGCr64%E8H~b>uZ^qUSb8@&XF@jot-y=nSEoE$4(m`)m5ipM!c9P3&YFYG8@( z0D4}WB>X47>Ua%CotkI|UB>&Y9A<7y1hRde*Yp-vn_o+^v(K!%6PR_MdMmG3K30x! zW-G+R_U$&4jf=VP{;-6QhSVn+1-2#D{H~ZrtLC9JH8tbmXoIpI7#tkT8J-XXaspzI z?Z<3VW!wB zVEmYaWjk8!i1uy3M;)|6GB|Vs#J@nJel*Vza7*Chq7_FSQVcU)E+go`njC*@EKXQh zH$VfDiggA_cr!W3^XWX?jF~?5D)Sw}Eg>b={Krpz*!oa%TIA*}qFp@WQLJ#cvg$lj zyG_!=Jh4OeNxTN@8qX<>lfDdaBB2^wKrMP`c&1J5zTbEPXXMQbyc6pD!!T^uPaj52LXBA@*Z}P_pn!YGP$>7Ud0A$0F)XiFk}0nOOo9hn zrv6qS#KnCh!LzCTfFp`$5d55qG3pa6>8144ir8~ClVCS_;hUR0`da$9Wm637CbtJs zH$IiNwC*vC>i(%z7B~|0ZKj*e0`?pPmJ5&39lrq8HO0m}c2TcqF`}bZ zkD5+bL*=bf-mE1AjZcI1*$a})i|Pp#qW$?>2-};tQALJJkl{1S37oM+n(@Ezg)%aNQ`_t2j>5U#C+g#yhA9Uy} zSwnvuc`)xYx~o&MUd%g~TxIpDy`m~-$f?StAxBbg%@qUB@89)0r+z%>QOAW}-z{B*7BlJ9b>B2Yw% zX&cU;FJ8n@MffHGUXQ4ij>|bjX6B% z*fXV>pKfx%>l^J^)DK0+oFx(*E(WO|K0T#yPNdu0zBMB$Y8fAwGnkxa zVryO8=6+w1)e4Xo)v4DZ)5x(q*>kP3qo!3_uU|`Y1GuWcwNimEL$_M$MRD!)EejSk z*%4qA$h`mayZ!SM_8gg67FbN~`OFa~Tgb?B4;GWBk`^95=k|(zY5Au2gj6~Jd^3}q zyqU>8!De#Fq=Epq{6URibmQyG%d!ofRd#Q0`a@@((6*^9F&eO#+|{ns7Az*Otd@?t z*|ut$5wRI$7<`|+7ZtN@~RH%WM+FGo%N?g7&?4zM7a7 z8_$sE292=$l=w)apNlG@1HGSnukNlzf$GAV_0LsZ&tKQ>#zO9w>9@zDcQ8-3ArBr3 z1Jk)(6}HQNURy;&e-@f!u%9Ym&$s4$X?gE#m1P1zA7R)i94Jk)t*3cZ%m)@4Rfr67 z<)SV%Q~2<$2dZNY2xpqhLwkNt9#b3yulC1L`Lw4877Rf;)so(MFDSblBP z@~>@59$;q}D=>GEW>2&k?R5}Hy`+9zj9zS_Wp*@JsZAv2{dWCMlqiWlS_3%=Ct_Pd z>v@5#=p(GgaqEZ1w8BDKoLb;Yeu#}WFx=6Edm=Oje*p2bZ&hS~bx*06@$`JOWXsC& zcU$3pt$LqdJsLYS9KW0(TfVP$8_nD#ISqb&ok+A@G*H;hxbc{!bV-qxA@klU@y&Z~yXhBEO&C_749+AtbgSNz+tlD{k+n!8fFw6b(n9Z6Ip=RiCaX z6Pn`@=DVxiHarAt?URE0aDhChKU@$iFMcyLPoU$Aje3Nhn7rR~b|Vr&XS)S?ip9 zWq$8-l^U^x#tJP#cf9Km08pniydpjYbN~>Rr6UUgKXNT!?=8FA(nS(B6c%7)cr0;gZHZsq5uLHUM2V%ulab zNz{!B`Bz46O&N>xi8SvPT$xEq@fK?tDv=x5xXmnffY!yz`bsRid8o=SNbHfo)GF?< z3Bp7}CIAZAm~k(F$(X-9I9NY^>nQe+HT>R1jb;Yo{amn_(ht*A97Q!o95pza+7`a@ z;8lh;IH5hAg+)fyqvQZaSey>y6+cRbzgRMA)8p{A`$@7M*ns(V`6R@P(_smeA$;o>OO1OC`l=AgIel^u&RiCK%!MZLPD=$*3~ zj7nDkDaYsRbf;t8CqEw|$#L^2$yz9I<_^o(TJFHOSm>xxT7R$tE62?!jyM<^sf4&D z>T~V6a*V2Je8#EL+3>VEchlKt<+QXUY!0+@ZuRKoi{N)u^)GAcb4~tV<#@}Ra@;c; zF$}C!UnDh*k;h5}E5}Phv9T8DNNoTCgM9{kJZ-1#mHMbnTsvUp_#)pw<#_6TQ>2~N zkH9&__XF)9WqVvAv_ZmOaw)Zj1CmxG^p_1FcY9n$!or%GlXLbd6my@(!cpS@2Scvv zWer}6;(ip+bTc-!lodgqf!TEHLFg6IPov(dxuW81pLG84F)4F(uz_{G`6QdxsdsWfM7Zp{Sr|IJ|0!QoSLZ}|U@R2okI{+`)nny= zk`x@s&l!NrUU<33AoyAFYMq}PrpPG}!j%!5YDCB{eFv&J4fQMnI1GE|#L`{_Mz=kn z_5TR95`d^@03uNPEuao%OhOQF2A~1C4RZSmAOY?iy@An%!x%iSC&Ac*%#;7P==MW! zTn49wEP&Xs@Zp*tw;mkLU}#P#`5osDt5(2VuJa z$bc=TwD@7K_Oh6rA?G`W-fgX~_oFAc)*EOJymz0+^| zb-^u9(?MX47I|@O1I*DTE`HAqbbS2F(Te-Dt^LJl_1!!gR%4q|=ie||yuTRjwAWr8 z7^AJ^PtvEBm{K1S9;agwtpYt`;8Jouq&Z&leFvJ=LN;`AH^f)pTp7g2jDX)9P=&ii zTYa-Ui}w_7nz+EE>~vxr9d7^!`eQPP^b(sBI0t55n}3)}{bgUx7q9=auLW=HD>d&I zmpAs6BWrjc%)Sa@R8ah5Uwdx-=+d<1l(@>}s9iJ%PGZ35tC`0e`kFhDrmS95`i8zL z@oR$7*E~Av@_`-or@%JtKfN%jGdfXb8YyFt6N-?^Fp8e^u;LPL>}#IUbYT!@qzx|} zUm}=&H3JEcb+zwJt)V-T2GO%p%Y`<|21XcfRBdhjraGd{Bev+5(Ojh$*q{L4ix{I3 z1<3($iDBE+g^UtFHUL~b*qunM8BWj;0GAqQ_0TCAt@GaBh2~q(w~XH3=tC&?5CufF z#xA3Ih+0x($WwZ-S29Lljy%^cansRUYQ^`b=7lskn{%j}M%Voge#LhRG0pRTZICLI zuO$4|gOU>JQzE(4%5>!^kFdnP99^Vk=Zhl!$vKI`nOKh}8Fua$%&j&9x^p!$Y}M){ z&@&+?O=x)ep7itS6FTzI6H-_ogVPFc&VdV|@KAUPqY^G@6If(y2ErfZ>_TL|!@7SH z8N+P`w*9!#oFaO!buo(E{rn~}-mH~Hi&BSVe)AaHD^f6tYn__%A=p+PoQD@@4cSfQ zL3#K`#-wMi{Q{SLv9VKvg_xLxfK7tA<>~i~qjy%b0%4baeK|T(<+GM?%>_2AF8CNThnuJ17;$c_sM^!s>BB zuA#h734#@zl4-uCPN)Hw$Oi9fU5Ft_6`s0$xyGlYfLjI3j&G6B|W8I<4c8>k|`atokvp9Pg|$lq3SH6xtznO z{S_M`>{2Jc5?Muj!hC~QS=2tKy7W;BtU4I|>>rBE@sExV`7ToW*rBtqDHek&l+XY& z6T*jnE~{gw?tqBhStlI_@&w5exRiDLE~7XZJaquujXnR`jTd_C{zwW@h-9*rWKPX^ z%riH-F`~;566^SilnGv237%Ab8q^b^7amBxzaQY)P%>%`F$}xE_(>YJ8Z6#*nvq41 zkpjQ?VZe0p6Kw;b(KaVTR;K-Mdw`g5y+^ zppDj@JoBtC!nbhdQ9l|(JPc*I`QuT8v;XRid*1ZMO$PB69EIMW7;>panmwF zz|KFtvA=KHo8GwOO>a!=Wqx%RGm48JD0BwW)5avCn^+GB+_BaX)OxD!xk~r_BH_Qm z`V)ujM`NXK!XJODWho7P37G)!Ok%Qy!U7z{72iVQY8FTp4MvfwlUVCCYlFo2MXE;iprxpx z*P8Vzal-CDPu?do*K)ga@dCvxxOaG~l@yt)-2!WI>cfX^PdI%H?sfq4#{D8#^V2EJ z78x|cIoE&^PkTvuuKoKsmk$;7VsNI-R{a&$xSAk;EL3W#I!miT%2u&tde@voMKT&M z&#%)(OpxW#C?Z7a?Uk-AuLs|SKXpHoJ&{}_J-%%9Yp=d1PTl4f*_|fkdNQY3 z)uC!D-LCC_v6h?m^1r;|66XF7p$hP}hZO)e=)t}rs*l12Sq8lyz6#jLGvV#A6fMju zAq7PkzteslP4u^zj=@6Q%)by?ig}-p=2bhud5|UHPF4lG5!eWQQG4T99r^MFGnfAB z#@WrbG00UAEQm}I(&np2*h8ytr20Xev65UdKsXenGlpXq_v_j6H6o`t7ia2ZZWy=# zrc@nhoNquM!tCVrh&6lInFwk`Ri1 zl1pR&_s5}niN~jJV~#(BKg?L2EbUXuD#l7~@XMkarzrYM33d{x#}b$i ziR&3#AR34J9v~QKX0PF`a>s`(+rDR{>$MmYWBSNL0Wq+4<}D6^#C-vI^V5CUMt~waex)5+{8XqQ{wuJk`WDu9x@JHE!eWFSR$pF%_60j^&a`|`)vdlTn*bz- zfX#&4UO!>WjP~kAkMw77S`UMrGTOoaRq<@qYBM^F;@7>_1|rfttknHnC`k% z{M%Rei%`eN_!bUSlt(u=dBU~0?;SE}n&>*xbWaL{eDyr@H=X2wgb%8JLhY?D#_T$p zU%5lRL|nvM8o+p}lcvc{@=!fXcnNn(St`qWWBb<-N?A+3LTUvQ?R%-fm&!sHHsE2| zRel4ujC)0cWx$3iZ!+Ni)me(08GmgCe)~5WFxIn_4waoj7uQl-FYfzOK##ze6_!?6Af6NPfse8WUZz?kTr`F~TQf?!ItcZ5|x z-=L6AnWHRb9C+mJt@ET0>ict265acGM=(m_PwHu1Z38Rxl3BB%qT$#5hCdhCICu&h zcN{>!#Hta_X1*&(V}WT!9bO0LM5LamOOBBNVHC#&&z5t=Fd|YPBajA!-kvvpxfg20 z8cGV5kA2za)z04{(Nkv^t*U#{7HU#&hq;X4!(16ftp6nlCQ*;QJ!Jtg)&Rhs*l66% zX@-+PL4rQwrmoOEqq^=IfFu;87YMN){PwR5GO7n~Q%0rF+28MtAOt}_n zaF9)HhYEl_CsBVET&@$D0M*q4$ROcC^Ys7<#8s`i*3S2pPl6!m27na4UGhZ)pVbm2 z7Pjcz7L&-Gv|_6*(Zz#CUByp;6(n{M9oU^2^}pPiZXn}nY!=93P{cI09dQ4CLFsBy zma2=>-R`|N?Dx6mZ)u9xCv%$?T87zLZb~872gYyY6d0ds)j|DCH7YR2j&a&m4Wvvg zHuEIzyy6*i*zVo$=&gik5w(kGEly_u_9CbKR5r7C3U_Ipy_`ms%nw+6*CP;nt8m)* z%SM~fpS6=*{NY6+YMNC8C^6X%c2$m-S?J6^uRdz2yqCDsW^vv5FIVN=72=aGv!NwW z-@lXK!i03lG>Tui1MxYs{f2)@BT>kk?jJjK1!kwpAx-F)pZ~H`?dYPAfnat@km-AK z^VU{gar=+cyYW$F=? z_7EN=rEgY|gs+~;=6D*|dcGe+*U9izsYSJf-PBYV71CrSfxjgVUHvs-(g!>#_~bgl z&!t$iKg^fSA6pRoZHA|emXg)7o_6uGUT#RSoCIOor$Vn)$S6;=#N|%M%3u9BqrRxK z?qh{ru{?8%%YR~IHwSV{%xxGx3YH2z!l*I^E01Lh?%cU)n~27v!qgr+>3|wX>%wug(Ax1(Ad&t(|HljcWRwTqf~os?G5$80a@`AVp6j59Ns$ zSpC{lzy`l|B>?gX0&8o&7wWwGLx2ZuL* za88PgSNULWs`93k2$;6+N>}6XcYgh@{*y|zmb=3c%Ykb|7+SCXfO_FRfQmV{ zm9Kiq5?;VW(|ex}`_pgfhNbW?^gjC_xmLg_;@EDRV{OP*x@g_|Hoz_ zpn~MB)9C;hK!f`Bv4}yW=s1+1n{I#^WEM!T2S8HSgN{QE2|A1ekU;rDf`$&U2q9TP zQjweI@cRX3kDYb--XXjf;z0=o}O* z;Y=}IzT8dM`<#R+M2^~028sjVFhV|nIsiD_Fg!NN%Z zYBC#;fop#gK6+xbE8Mz9J@n^Z+Uq-AscYB&#KJjh#u6+qP3dPRyGw7WEJ&k*xrC_HvPDB)Y6A1niCt@;JQsIl< zQORXM3jbH#by3iIcg!}>q+SdJXLo7N_ua(O@O5#8hs%O){0U?XN~S*#7MLv1{~!hS zykZ?5I}`zZ40PJGaE{(F;M*^k^V=}t+({NtuLpdi{`W<+6E9kgx5-`C3jAyjn)zGsU{ksSCxS; z_x>ZI-zC0>Jl!uuUDS}C*;p8tyas){skH1*o2zgACL?u0Q38o8Eo#jLw|q98M&+{A z0D&ptJ3^Q~W+F64kYlKTXa2Fh`P>Ba<9C1IW6mQy54ftCpv^8$5c@VZ2XO9hMz_x8 zV#bC~Jj_l+1)R}EYUb;{_9bkf-Dd%3bVpk8e+SMLOE=3G*7g0(=$4aF?~P=YJEP~eI#&24ZFhH?Ka+_Zjtt_Y4^gaf|n((iL-Ux)XTre6dZulyFF zMuh%ksvGF413E$%sbuSe19H+#gR!_KhN=E@LVr#Q+PUMjF zwUq7Of~>-QV?RD4InMki$eP3R7G%|EDvJgOSr6pC+wm4|5Y8G=3h60cZBR*n`9`qM zwDnuJ;*bQNyOzovrQ-Sj-(&*(zc!PK|FM~1D*pFolK!8~b)qg5c;2+$p_S^*8e@3=%I!l$+h1){_gu(byXKKjaEYp92l}o zS;e#z2tNc3QBaTFh_T6l`>kn?kLaoncK+ttCkSW(b+m=%e25_u3vSe4Bl{P;o+W)e zLh`yGwGL53u`hEwb<2OHIn*CP9rgffU=v)&7tF3v2#Ra9C~ipnIw~azGM3+mOPl<6 z8tbtFCu<~Z5cSnS`Nqy7Uo6>eRKZoEvy<;UTm7bvsTSeYvxe_vFWMP@gv1@eIY~f3!D{n{Eh3or%=hg-!)LH0 z)6kNtfNUKA{Cql!wM8XX!eoC%I9I~&B46m7RaRo`Ul&w zqSs;=_@I*mY%CFriWxSi?cRVxjuF(W-4(AG(mB23)4!G*u;k|S zpX8=emRSGed9$hRd99&EnM_#O!_O%7V`8E?zZE~3kuNJb!s>p5i=TzNm-wHrSf+B#Qvgy^ZZUmHe-HIF zITx*^AA3hE6>jA5_*u)oDm+=-z;_~iUBt;l(abb*reve78 z`U2Ls^ff?~?La+kp*nhi+D@=pL7CYA094*>d=Wemi1-xz2fxn-Fabery&>zeN$)lb zX{f7WfoI@rhkUV*%0WrqfzQl)E@fbi3VIU)^mw8< z7g(dh#0IK*0Bcl+fZQ(_ql_46*lGZ(xb_<$~Q0jWSd zdM05*pI_Ix&;e96n4kmMfttc=-5Jlnj*!oJR32!HTyi+a7X>P+SW->~eXKN-#3^&r zzcwWRQZ&Wn9g+j7(P2=oc`!2)pZpVGER^MbojXr+*$z%YBe`?q;MyFkp(-U83HB2{ zR(U!XSBS20`KMi-@T$TT*7zopRAAXI#1Kxg`eu-Lu+d`V#(w$tKa??@b2}&U0xx#q8dk8bmS0X&4~wM(=WF_sHe9%mKGrUw%y0<$-r0{t#bY`RRf=9RX?EO4s}F@ zWY#20ir`h*R?MjG{rx3jh(1nYYwxUKoYmZFzHWeLHb?K*5YTe}Oo5K4*J|EFT-}!e+2(^IR!nj(@J?a6wl;lWLl4f|M}C$4 z3=2D(2zmtIio*_ABj9p^4A`;pKss2s+E4?6AVVo!JRpKWOXxaT`9NVGZ{;tRI>mIP zEm(0S-;i&DhW;liDvmT4<>hBbCkdUtJ7s*Ec{+z|qtGN;wkVQ^)AqR~h&gsuTiNP$ z<+kbLuE=dHjq%2>NPUb;x#HV&-c=LJw1QQaktD8Cd{2ztwx|i5-L>hpnV)Y}G)NYi z|D1g~=?0EscsvC6aHEW}es!9kb%F3^J4e5zHka;=iv&3}{;r{J?l2b^n*UZu{n=hG zR8dP!E&UVEaP2}MukhHnD)lCdLo?TE+@?vL#tU1AU+qz&Z`O@RrA@?T@F5e}x&gzp zEmG_9VahIB_?Ofk?UY%QLZZtoam1c?n-4h!D^MaH?t|{XE~ABc1T?tIXuM+>eQx~L zW$cZGfmTThdh0S$m`}IB1+<3LGq$yLI1C<`pCni2nc>xWV4eTG``K9?qNKHJQn&Y~ zMChH>SF`*3=9B5X`9TU0Z_h{f!ZA?i!LewMr(NNlmjwFBOCiNGdWv z)<2)ZodP}#pu&ca*K4h*u5u=+)j7{F+awg*ydLm~v4l{2^xU%>^~ z?0s1&u*~S-5bLFTgeAlz(HW|7BELc z{5m$Wp~k+)T#V+k>x(S)p=Rt63TkS{?Q8tpU5XlT{0x-nZ4vd<7{5gESVaBt6n1oK z>T3F`Gr1i=_+9?20cQ`mWsmd3p_qDnoBhj`fN^5Kn7Km#cT@3aJwf_+BHx_A`9ur2 zw2#V4fAfj9%5WJ1N8o&7egxXO|1j=PtOKUpO^^FCo-_tGTXUm2Sv)`8bXSLPUUe$N&EK9K88k2@X_X6 zs~mg_jb~1VaP24{0Zy8$T)}!)ffN;RLx8I}d{0`wW49ixm$Qr4MkdFe&pBloeBNcg z_r!WvNeA2F%P!o#K=Kjh6y$Nnrxp2to#4LbX#tzHMq7lU#s^pB(kh`bx+lZz7d|br zuOVAK$;wYfg|rT9jW#--taznEZBk zR6(UpHg)cY&D6KsE95^0oRGV?k=s8l_coKNRNyOtbulbae=z6A)Ka|ajlP?Dg#93F z&*FSR72rH4QO-3HS_k5mGUtbzF;%UhzX=%f%6NqSBVdS#SmHALCt%2g@%k%Zu-ni0 z)kpnowI}bv+E_3kS_gaiGWS=&km&*zF!+EW)uqTQ^y6y;ybNLH^N%pI*4PD@&+z)x z_SvWJiR&p)^LGptst1s6#82hYI&3}ObMwK?#!v$FLg%&MO$)Z_-`}DUC|%*1M^(F^ zPWeTIIFkYy)@%|tKe9 z9RdUk9z3`Q*Np_X03i!^cXxM!yF+ky_ul0Dt4`H9U8DMp)1yb4eF0*ch(`9ZD}cy-7G?KWHE0 zs9_taD5_#_x+^Fyw>Dy}IGF(z!&rq-6}37eSPalC!0`}!3JxfKgQBx_&sX5&&)4iq1w7miK5}} zY_oefsU$X}`2yt?uQN(BumYaNbwW$cXWSy2d)SLuP*;RyJ9&ZC226UWN&ux1^BVv) zg@py3stx>X#H0W|OktryEb3MKcNJa*z+fXL-kW8%=KT*P`ev_N5CRc)@6myaMoczL zhEVaXi`O(4qRgY$qtQ+Sf?fZ=j)D>S}RNutCrgr4URDM}`3BFQ!HQ7t?Zs zU|O*dOv@H80qX_R%2KUY!~X}8VRq(4}X--)S z@g0}H!S{m#irQS}Eg$qrr5JH!0s-xSAL$_DAWU|nj!5m46g|zSvfB?AoWUJe-sO>z zOxFTZ+3Fjn%?B8oZhx3N@uj`OK5g~g%s%?`sx*~oHia+y_Zr0Ik%)Jk@@??RS_OF7 z6GNI7?fb%kkfz1%Qc$b6gGGm$UPJmFvI75mtACmnou9(ontJKup95&gT$FU0G_*$V zfJj>mB5-prvwnppC2});rzX;mmJqQ^!e8;8Pnh^H!ydh-oAX826HAjr0ld8}hT^GY zP?NLm?{rbQ47=rR#9#uYvf6{x|3kYX?TLZ81KSpgl%Gyy&aY-YX1{^vC0!A2=tc^W z`!9kZ>59YNLZ|0${2mgiz^%9_Ui933sZ{K|R4OR{sZ@9Zhkvl} zh#jtVx*cmWW@Z02DOz}oDY@}FGyc`2m;%Q1aR?Aw^OBtL6!xQF}x<*`z^n=fK~7f^Z(!UhKz<>GlgU_Z+j)wUKtT{;>)>Zp|2=jqkib#4`vfBpl? z{`DOl>6c4rE@`J_k0p~HwyNDBsWQ}BEQ*Uc%3T+dI9+DQSr{k5N3vve$lk?AqO`u9 zHv#Zed+l&^$XKc5DHd3SSvz1_i|Aty@_3Qbsb^8g?bO87Wy@vea2jw4>uNkE;-#s| z_a|zajZ5#wUvJ_YmBIcr8!=-0XdZ%(x7+ZX&sb>K^k>^9lD}uX+Demss-H-Z<_9v! z+;!IPkchGSL#yD_@gDQW@N7Gk-J>U?wxPvPZaFMG1OiXLnEZ5Oi4})B?+Fwa!-l)6 z8Y$D=z#mj4i9jErGz$kFv9X!Jy8FNC_l#Gj`_)QU5m;(&h4kq%=}y+(%-ox8q+~Uk zS`=~K8+c>tK=8Zw`OCxu4Z>zF?Ew!#7A|fqX*ttbhS6Qe-;}Z<+B`Lp4|?AxF4FuG z@g~zERIt}bxch9$-=Z&N<=0bt(+n#e+J9Iy3S*AUe(n;gg#cU>_}1HKAwoLb45Q(6TJ%`sVV+}a7HDRA-{*yljmAfy~nHKpBw z5;U1f%A^X(4TM;{sZi84vTcry|42DCl=y&(8$2vHeL1hZUR%FB$mqp3vq3ssvBwkmGO$InIr}%Bq`)mwiKkPNopK3eCm38?{Jo|gncXm^z(+6<-VsbQ9+Po|&tcRh z)0RQqS?W7bH*rg2YFibyD;;TLzT>Cj|CdDhVyfvmBvu{E@$V=~^X`{jhgGYhAJhLe ziUO(S{Y6m#;&TuI7=oP`{0lp&`7f}O|45zue4$SC1^zR2lJ`QLMC6M;{&&=gcgKIC zPWbENf!cErD)=vM51ve4< zUvQKEGuou|-)IwY&?e^E z|2=I|K=eP;CQJx;P$X{^CbiTjJ~7 z50NDmhSOpsDIk$D0!ait{aO*>@j;jyv-fTLbFZFndcSy+Y(qCeMo2MSZJR^uiDO9T zhBeYUsD&bwb!_mhCyedQ$yuv%@Loq&p{Fi(%M~;NrItWL2azfLjo0u1jbByux%f3M z*J_iRb9+lT;O1jLws3oA^> zVr;njxEW{gkUl9D5a^0J;O`Mw%hM>(Q`Ahq|2;gJm)8GVs3mS?oQU7-0G>+Nf#i&MxD^%x5m%@vlF;`_0(-JjoD21mdZnSDGZQBMZrbLO6DINML;TN-{^Gfhv!}@E}81w@kWAsWJI`==E!2 zL>ikX!8l}hW?rx-S-+=4{_;TJw@Nj1J&9~XiCX6mGTiPixv9(iC!KzcP434(Rzr3> zlY-F>?6-KzM&h=X8sWWMZYY6cqLwCt&r8Hl-Do{t9jKzL701$^SnrR3&teNZXkigG zbtzWItpkkn@v-f5`qYiusxi6TBQvuxtu{tql-b+Wv^W9DQ!IMyYE9H?*jgJnB9vrS zv21x3wCWQ^8zA5mi|!!_&Y|_NvWbUZ*mc{tsR-H^_SxO+~zi4etup zOFq2KO4)hT)m6VN&e^#5aIt{&<3cf_2I2SY!PG~1&F)PToEjhyHB8R>5{aM*Ov+T( zIQ%EKd=~YSe0@K@087)C>_9%`fj!VMvB^o~N0BtuIx^Upu~e@<St}9ubdQnza@UAifSyvC1o}&c4NQj@TtuTd-9|t#mXMOOUiGHPh*-36kH>9 zZfNZRpLjt8YI}!M^-i711*mb7A53IzT|)ur6&?YO?v8V-b`MLmAqJObs@DYD>%Z%vDI1oD)bX}}l~Ecy z=>*;6J=&KFR_ORx>7h?5?x>chINL{VeJD=*luZ40f|oyvd|E6?NxoeGU}Rj1*W_h( zdcdJR7OBn{!EbQoK_LOgkB{@;`58np=kC`8qun9&5SfU#PkOH&`aa4nLOw~2sr~yb zL|suP1h(1ND3ZGN2XKD|a8eN+%Z2gBXIYimTCzDBhYkJqB7e2>G299`G>e=6ZU(&Z zAj9w?WK{dvaX0m^DSQl*59pyB&z(pKx_+nXxh-zW@jAemeNx};+D3o|ve2FLrBRBHjuN@c`@EiF!$kY={cqq#- zW;ZX_M+%xsPULj=w!}q-y~xLiN`6Sbk)L5SN%0tWh#F_W`Bxh!yX-&`jELtD5-sE{ z=yD?C;+;7d+1NnqNScQ@rE+I69j~=(0*QOvnh%!SysyaOZUUd9D=5}K(iTu^jV*vN zSN?oRHnJj{1yxoRPvsOA=Z~-u;@n%VCF*RoYZNXOI6U=8G@`&b7DjdN8^YiR;(S_Y3 z`f^Xos|30e(=FknQ&W_%)@7P72^eOuY8O~&CMD=PEIj1@h^K3QLFd?e?^Xob>!35YN5nh>A=wk`d8s)4T6A?@j;M_Jw{~ zGH2F|c|zT|6!+>tYh&bEOA|*qw}$+iOw-+7Vo8|C({6@->eiJe2D9HnXa11H*hhRf zbDU^~d~zL2*stNaiKBW0CoKY=j{5;%5s^vll&DfUZpypMKI2n!vD2>ls>2x2aanxF zw~Wit{!D}Fz&y*aG{bayQ_t?W9X z=6UFM%H0GHDlvVb&ce#gm_DUYUby$4uC!k1-q3>k$ zbOcNn=EpinT53g^f7Q1Kr|#~r#map3V{xOd$fu$=$)<+Mz9cAyqtD<-KzaC0ZK(c* z6rN?d=Hg53JHlYHo2XFUjNo@(;t%9#rj*93aBWN)MaT*D%ahs_w1$a@4+PK3RSY1m zmbL^s^w?wR7vSiks_-qY9yY!QXPmdny89DH-BlRZk>t!V%Sa2DR@97t^x7BmxLX;N zaz>HELrxEmYbKA!$&7<=#H3wVuTNiQw1hpH_b{Qgbz4(dLA_B%-<7;eq*J25@0gq8 zk2CN}!)C5@G$^c3vow4lD9HYyx$n5DvC8$a#wEq%J*9_O+xRqGOvI^KyWdV1_((N1 zMA2pyWvB5<%T!6Gz;hY*M_fr=W?@s$cG6vDKKc&gksayK4DT5x3+Uo zu^b>SjfGh)e-Id~FWuR*B#^upZsdP}^6>46&$(w;~{ zx3ut&MHX2GW>cfd4Hn;M3$i#ccJIwa%xVJNhbW*atyrdUm1LAwkfSQvE(lY|hzPVR zG&6?1-$r|p2h$7Nz#cw_p6DbHzLFT1;dZ$qX@ZH3x`@he9saqJwSmnnGJpLFw!Ew0 z8?3^EnIJhsIreB5r51h(SM{%OM1fBHt327goo;sYv{vaou*%L&gQ0!s>sRMoh<3)_bm|@`F?A-4(p0Gq9Fgl05yX9nwf$` zNb*P2mnLo?Djo}u5gT_m!Iu$wP1Es$Jy+(S`UdPrj)57~NSOe~q1Hll2^Ejs)`^4_~v+Bjh63nPFmL)6gT zU;SFiE-41{$xKxOURdt3b_q!PNTMIbHxYn`X7uaNJ&F#D68!)OU)@`LTi-E6@K%R9 zdPW(F=gq@p1WcFA95-{)yTSHjRR*+I=#JwnW6PH~{CwoOyVo0QiZa7r6Jo~e=`P#F zM}En?y8km7DVV@Y8vy;-gakB$KomftBS;7A;caJltNQloSn2K4JHhSyra)J%!@JTl zr{>$y8Kt*g3at+*Om3o=-{_9+2-aK2uh6bw@vxuH>cy|S*6ogxt8JUj=t>*z)}&T8 z#iQ76ng=`VmVHO*CbsniZc9s2n*8@$)_0pd>Xv_&S^XX`6uPFxxwO`itxfi5{NYmv z_$y-Kf<4>*?0Mg^*qn@tpFKktgc#d3k$jSys?k4iX79IFJWfMM!xwSrRbHwt70mu= z%znPxaBm%%JM4a!-XKWD%yXnyhXeIGY~klM2LaBy8P4!~%5fQ_JHF2Pz&m=JcY5p> zub`4onabkLPF%hruOq6|m8Wq=pAP!2grg!nB!eHzK=`js3eXNW$a#({zp}+VQyW)A zV!Soow07F5H41dIh76U`nXsF8OsJp7WBKk@^k~s(kMmf>^n@<&Kyr=0jKO%3lHU=C z)Pp0>42s)-B#gH9sH{oeAr1P}R>4m21qD~T_UrCoGk%L>95L-_b35BOCUCu;@>9p> z@dA(f$pzp(%BkdNPqeYW$y{6NC6T$&BzD0nr46{EoD}c!B$G0OHgB)D(xo`}* zH`$#a@_J8H2^H8EdA*7Sgi6AgJXSty(x6NfuXuT!;g(4)(;U9I>&FyzzUnZg-(KCw z-O4B@!_RBcgdYxGvj#Q^t{iLMgVRI)k=IY;Zo831t1jBU$m%8p48Yuhg_h30J7|Ze|N}3MgLW^+ErV*W-PIxa*-I?s}a7h`YXrvmt?w z9I<6zcefEkP?KJ+CYjNi`nPe0CG~IJb}`q>v+#!+t{RyJ6^aN##ogb)>L+lmCjvxX zzk~&m*XO>->zz&!n(a-HehRmOHJ!<|M@l}`vm2NxjfPz~!v}sh6Rm8bO4dviwPH`7 zqY)>!0ivXEi8bx`ltpfAO3zG`1w`ll=;DjUjTNSoKA50yj6^uO$QR=X*Hzl_ov`tB zJTZK3e%B(=2QFxK!a_sM=2N2Fsj_K^N{x;_acmaxG z@I=*hJENqcTzX9#fecCx$WnpuS{wi=6-2G4+#+%+6$}4X8?|&i0~XE(J%PWJp}@9l z=y#Se&5I@;i?j1*+f}sfRP%y!pkLY9m!E0pVo{2Rl2ZF6g=3|9tZd8?1;s&cR|uRe zB!ysQhC9Wgh%yD7Q*lk((M)b3&wB{#ll7{mwi~cT zc8SnTI=+=_NTk#m#xSekMsqC)YjHKoMZAd1qXg$KkU-mC?b!PBVVleZK7o#tmwf?- zA`lz+k^2|K{9a2EhygLb?^7gHTs;+q0)NHtN>#b;M=#=cZC_8tj2k!j36>w%pr&my z!4C7GEp43n-Q#Yr!%qiC@9j!-h)ClF`9A=F2bx`JxiP*j}R@ z@|WT~kDy7++Tc5zU{4F^UEV*q>u00mmTYHihr66N@67K-QXV$2;bOJ2gD>b=Zd7Gj z_B8J%(6f%N%KTR&f)2mlhBP8tl<3I(er(4QY7M_3pqax6sI5`*(QBJUn$2H#judbm z>uG!X90NuAu6`mp7|AWcmBpiEw{^_k?lPsrmqJq%EH>ECoS0W^uGEHrYupA$jT6RA zm9QpDpKO-$6Opd*+{@Uj(Eu~0U^}46mH)oU#Nk%q{vy8&FPDO>(zX95UC8l1hXAn8N&Nm`WiWyFudNSQaJw zJ<5Rq{GpRqXj`2Q@W&48EzqD28Q%C=8Ffg&z1bq6JK^(U^Wg-UviVGN`JC{?amtUT z8qTqpi)~v!z=hLXqABy5R_1din*V*MB<}s-x}c*A(S|9|plwQ?s@cOAYYRfpj$3~H z?#phuRWOD)=E$jXRr4%5rQa%8wRbIXt~%M!#+jgo7ZvQoi^}9`8Qu#ff{5h>c0h7y zY%&|Lg3U7ua@~1I2l}KWkasE@n!Zu=o{$(**@)X|%Ia034HPG8nVGj7j3t5I#H(}y zA*9jd2O!wOh@f4Nf^S&V!11f&wzv~wv9n^zhSe*RPV95@+i$LIkB8V^immvP=POCPG#0x6uam~F&BgECUo6boi3UwtEXaR$S;Hc~i%1JPR z*WMsD=!YKwk2lB+iU!E^2C?Ipjysg>*{9A_m)AFxtnOh>$1?x;sjbc*3!Hd^a!@b$ zvG&Eo_iW=flmST zN)TYG1~EgW0!PXqTc~?L_cN#vN(n$#0fj=b0DuaJ9@t~XBmw@YfJC4~0SZ+R2d6&~ zazveR@9JI;DDOzrs4*=8U=U21KlI&Ga}b_#1lW%{cFeg%IcBhGElhQfIjU@^?)$ia z2vtxs*_|s9EjGkx%N_jOTV+w#_qNZ$IjITCjz9Q9~5akA1gf5RbDAnQ} z5xDgRw+KP+lxM275L>s0q^1T*phe003Ewmqz;cJ?5UFkrEJ)pJ7<3W-!4wi#>Z*{; zUzgc&BVFlOXAsqMqwFIc=X;}%^@*sb5Iuyrd%Xy{?&?%VjBV9-ur^8|cq^3f{X7b| z52#yLfjdV6y|-Q^Y`cp>6H_jK^s!VdZAnS>V8p$JKE5IEbs01Y!0$Uz5<1=@J z0tcCaEelGh?@e}EYx=LX_lc6Jp8e{W@-G=C{xA^>Xjx}dm1=38A%EwWnDo$P_@D3Y7Ol7%@)Afb14^R+&Bv#?u?PZ&*FPK@3)*&M$!V~E(RM#B$jUzVPd0VlV~L;1 zvb~ejsNP^PsW0L+%{ou_xiZ}co0g{2!SWl@jK9cZ-AaUmq!4m4g@#*RU8L-B9+}fda~8gRLtuZvI&#yf z71cF3`cW=_!FiS&g;xY-z{=NvuL!>%G%*S}G1f1v8bN_mg*tjg!A+${^s^cPS0m;R z)ADr%zK2Y%?E{h{LPv6Y@##% zDCy8F_GTeXNO`GfpQz`$>@=A9F_l2}Ov;>*>;X;$+^eGuSPG;ZIz=urJeB_OpyFuI_D*Ms;s)!hQV_&)w0D&<_1ey!5ln?{8cSWAcZaMAOp(4zjv zh4q!P{_Y#a31VXm5Ou7Ro90l9CSRiXBHqN8eB=%`Al}Uzw~ZO%Sk@7ii`tNm|1t0| ztuSfeoYlF#fW(1DpgO>th(y}2rIo2zJKd*%?pSznHdrkLrrIo`**vb{;H4~QoWV$T z%r>Vzbm_U|Nh@a>;z_R;9~w2?3QETu|CMmaWJ9hc*M#pwHhCDBY>LM8u$$^vpOBWE z84g*7%%U30&M2FX`z+RUvI&L4$*W;Nzng;)vL_YRO~w@7Kae$DvlsZQj9NUMyTp={ zvhP*D)T`%taN--TivxBmP0-FG#d$iJ^n~eS7=N}`C)+Kh%E{ysFY(W`PP9Ni4yrh! z3vu1E>C<1L<8~{-k8<^gRyDLij7SE`>njDh$YScp40ofkqte&KEUI>&9*}TOHa&U* z-E3Les7YKpp7I8`O4i?_-Q;-bGt@Y9jQpa!DS56thLd>6!%K+^f=8uEaGExjaCWcGl~sz!~9(_aT%`UPIySG2WpPG4Lx z&KW!L^H&3IzyD%F-N9ZJsKpQc;O3c@5#I!6;?8N^Gx_?pEx;g_a5Gh}`YmR(!yzI` z?(du+*mYyXr?jM}PH3!U+P&kX@(9j${$20={eH%SIz-DqH}#{IxL?B4TyNF+FI4gw zD+%NjlCP%5QDs%w@-GgfKbYw~R`0u=Up+3eLq0HHI$m4f2n`Wu?UIbgUi)1a!=|=TWYO zzK3}wW`Y6}%E*xWIyuC*(?60c!z|uTc|tlYu?cCt@*Q(}RV7kQc$(g>ZP8HY8dNVy zy9D^w-6t(zGi7ciFOrJueY{3h{V%OnaEhlZhs8qV6t~91Y~@?$)~AaChsc`r<&h3~ z&)V~G3tp{X^|A-@jwa<2;Qku_xujFDut^hw4t^1+g_~N*x^bX#X>;!A%+lGlMY!K7 zwyddr69%=BkwfeX<%demir6moM=r&N;BlKv%?%;w7GG5UW$pp5QnPi%h0~b~@H|a7 zzkg0;maCVt@kPu%c^r+4{MM(sM|i8NlF%0dmebF&%Gv5aA4gBNl>tOeI>zgx`k z=w!;BYbAKYz=dcE_a>iYpeei!x(@QSH3o!(=3K?pM8N689_FPSh#L=#$ABnk?@gx1 z*;@Vf`7M6dUTuj@z$>zRF8L}Lq=oc`w(U-zeOX~T%rn}P8?Z41;X+P&frcPX`qDDt zyG;5vhl#&t&(N>J5VI$){RAPlJ>2^mzZbLTeiAoqb#WPzv z{7kj<9GH!`Y<9o|g`}Tc2~SL2AniOV2o|aA6iPe8R9GFjBp-(muu+@Y=y4h2X>x2` zj#iH7F9ht`62mnMT|42I-jWMPn+=E4Y__*lX$T!Y9|;pS8FzavZdgDG&CJ|#pNlN^ zpzW2#Al^*figq>=mj=d3ZZRn6#@_0nQ7n9O+}6;GVeYOyDSUxsRU?}_y4D)YR~ zSp+O;XW%~Gnz>!z8li{iR;bIryw_0DZO~ee(`r4Fk$x7#qNOHVP;Msj!6JdhN~c1F zjb?{;Af8}MVa>g-mK3C)syIfonjYT6<(SF%n8CK|M|KPT-h7n6{~T8B)z~7Xxj^}$ zQBv!SpA}g9RocykI^YmxQ?uyw`t&fF70Z2rqO;rODJb_5Bf9~m_B;wD)Me}&HQ|(@ zsDZ*|U26p6Foerh8$b{DH!)A*MBBOE8GOfPbNBSShDnruFDLEmABXLDXW&|{y^oHL z&FLd?Ubq6drS!}11T=-$3Fd*ym`qcJad_{7I8*n3w6Sp06=`Tj|Kuz-f=0;~O5F-Z ze9t7jehTHiEQ4hJpyv@`&k2ed5%X_QN`BT;o4kzm5CfdA5ne)0oS-pbW07X4)+=HKaceeP8D2RlLaYdoskI_q{wC`%zXZ zegR%P9KdD1CEhh62>Inp`Z;W8Au*C6?3~{-#HPN~#uRZxZtux>_>JiE*!(xJrk5h+ zN$0}-^@V!%ZFZj??VC>~XEINSVeP!tL_r;O%5Z;Jk0RxSm$$Z?s9vs24LBn3+PwUI zvozpN)|I?dabO;1z>KgrUUY5fGEiP9a9|hv`TP z9urZi?lY^NO<6lPF+bFtWVG?o*l|5tv8H0g=NoSO0uvWpmTRxann-kSYYC@>SEIFI zpzUwQyH^>S0v~1??WPYdTt&6CZ}Os$4@` zG)?58d8aOtCQ*kzpd707uyo!B{wBw_*+OOD+9T4zdbq)>yxMC5y?4S$!x~_$)MhYf z5zQpqSxDwyqouJ7&Z8TrOu;MdVLvn- z-;b_(Zrc?azUH#6?%2bXQ}v+heY7ju0dkJ(^HCHDv0(p{doNQdj$Ccv^A_Pc z^J;)vh2ZEGgXrQ4v+F`nmHx#=H>!vGbK`tws)joc@34_`AK~3ktZt|4jbknR8K=ZQ zg^Y<7%`%W&OY<*gGTS9NTOAjC%vo#Z!5zyPysfV3MilCA=wH{11L(l%@V}Zhi+$#O zcpdyA0zSEm8%eP=n`3A$&z|S}@N%8U&G~)p-4amJg~;a4C~km|s~V{_h*T7Of0#M~ z$X9Q>(-&)1f#HUHeJ$i7t;)(QDi?7C#^iiF=Q?7Dz&_w zAa_*DcGLE)-xInQZ#lbXQXU`uMRPRUjz+nEgZhUlZ{V!rsA|6?FQReJ_J>=>HP};s zsx~2dVt>@;ozS=>&pbJ;VWrwTB2#Q2Rby6%n3I{ae(Ig+$&*jhpQ8_csXYc<-29u= zCO2ItzlhHmI2a1$o7|Jy1?dreG*<(#WF^3NWK26pKg%W}lA|GqPmOE!iNpuz%^!1N zdG81nz0i#82yFp2OAs5<%pt@+8(|;^T?W`%g0S8g4tUEZnr@xF{X7CCRy0Te{Imp7 zfxFcLDb0VMe#HvB6e$yYUmo3odf&Pu zhi*f$Gk00kF7?8jdOtXP3QpkAA!;5gfsTva1kJvRZ=)*xa+ zK8Eu5?1TC;`}$F?XJrcKf(+9S=%tQ(n zo;7rEdFChLBJ$h^i#a#JEoBb>5!tY7UhQ6D349#Xwd;}eDL9EaMy#QPqND#W;6p%~<5fjw+X0k9pxur4_pth-FJVR-_lh12i!=YTk z0N^wb83|t!KF|4shp@@sxzmGDZ&Iz>xJ0!3d1x{thOll%9nhKvdJiQG9HoKCp+(#P z%yh`_ei#Fg2{CCvv6Hcahb)gKaf_pA-;oVagR&Qa@N|$gi17%oj(g4q>ic1@!0V66 zxu_xOz-~IoA1Vj1$pGm?jR9jBpd<`eT_J;pwTO~4f>isxNP;I;z$+8v3NgmrWP<3Z zhQ1CzDFv5nn-#7XaQ9GUa&9Ls|2FebiBFTGF(#%1h&bkn8v%(dkT_H@5S9hPhmr(x zvOshYAJ%9VNEX`T6+oN~l7G05OEPXQARe4z8t-u29z?MbUwSSm*hQ)e1s_U8i*@9DN)29BTdue;7E z>;WGd(^&Tr6|L&`M9t;aK!keu4FkeIR0J2;Vkua2BALO}V-7-ge)GbH(Kj4(zd?>N))^iwHeY%q5p@{&vWaJ(D1 z_w=)Eqs|W)a{@7fX+E#^_|8l9upxVKagv@mUv+-^`X(v=Lsd-ZM$<_2knB@pT)%*X zZCY&O9K`xSv{$dqdK}R5`644V{y|3VYzOR@&X?Ad+4IH+YHDAe{ZKREQJ;?(gWN%n zO5k^BHJqrq$TNXjFv;#aX87fC9NBYH>gg>iaJpJmpMDJ=I1?XczdxqcVq-}S-N0z$ zMi`wFU+02LCEiI6W&z`jv#FYm{sA_pOC> zu1zL6M=-IeO)`58+seS(vnP*M=fgny3b|pz$ql*Glzo3GO}kF2PqgP2aXk0ry?&i< zURjGm#N+oF3i%3rJS$&eA78?o_JV~rgdcZ(k(5Q?_22~AkQ($s~g*EK=lK6iJ^3JdF zS8Kjr9qu`88#zI^uT;1!xgj8X&cB*hJL4qk`GZ# zY9re;?Epfn);py_VZdy+ki4@>1NCsA3`6xZBVF|RQPYf__tUVH&S6196v2S&*yjZd zc^86BQQCzqxsM5E;KT#E{O$^7@a>6V=w2U!1FzK`)_3J^VZOtcQurQZ)PJS~e)h|i zfrpOCgIv@O&kAbBPOMomPla*gt&&BV&d!Ol&Q%t~AALxd`T4eso%rBB<9Ay+d@3li zjZR9YEPG?N?vW|1t%%MVH$w+&u>vHGkVSg6`#6pn_w2jk+bd6JlbS)A63WoeC{-ol;#onUgNK5`G<>&C$Ru(qe z$55!pg?LbMkCJc$K6RXm2=4|lDpdlmV@ib4UsD*J5o0=}T!yl@Jg@CF*<8yp-Y8dd z-}UxZqR5jKJh+UxQ)@FhwBe=X?F=b-vzxuL(;*0Ap}_Rey@O~Jmh&W{x+p|$7^OTO zB|bUZe42cH*WOyjw`ruxzv{8qWktbdMy7TxdyCXfp+aoyz|r(E6bG+~-}I`fBCi93 z>s?Gjvfe3Pzw#`KGW3E>hsw3}3K3ezZ+k`GVUV~4xSE8lxUoc{)wh4JjT>Ud|K?#a zTTBFn&A@{W5_bx_TlCaP!#CBCO*x{no-}(DQ@a!#3rju|9Y|J4WHLR6_4j|P3ADLI^NmVV1&WB%uejH&q>-Ock)fnZpiZ; zw$&zJ+4=YfrjP8XpUg)uHW_S$2Wx4xe`W^kVNyEVZPmrQ_{4p^ zuI_ZNwdnO$!c+>UIMVd@{C(wn9pX}IaHjNF%2E9cRbIO@;+1&t+CGtNuh6pmNlM@Y zLLo<@vxaGIEAD+YZ+T;5SG}8~_tz)VYd4=o+1e^;eV=w;7ucL9{=MSJ156Ew7VH_T zC6F-okchcE>(mXVB_c;(**bz(LAR_!$9LHCmHS8}h@xxd!OQ(vjxTu1c^v*q0Dbt` z8~Ee_;^4V%(tHr)#nW#!T1-|^zxSRxK0o%475Gw@5}LxbHgug~Q79N)wLknt;bDBV zuT;{F~hT>yj8+$OLOV3&d{!I7x~^}${hnECto88xIWzSQPA zq9eI(&-=HPgiQ1WjcJ=s4rLn5iLjL#%qvB(Y#1hP_D(y;e)r6ZNm62VWPIuSR~64H?eCQm#I)0!uxPB-mrK+ zH^?S#gB!9nz7Ft%4`$984pxsJ3FFdOJos>VBUe3Vu&pAhmAfv2AG|1ZEWu5%er#Kv z%W9kS_HF^7d$OoQ<0_Z3UjYm)IPj@gD!uS+}DYDGJk@A+Fb52 z;r+?dO_okx0=G>}(rpnN1pEw6FB=C2^LxCcT<9OIV4SB=-@@(Tujy@ct}Y8dO|le+ zTP_$gE&%VfFo~g50XZ#9fUx=FM18@Cr_M~z)?PzEp^Um(hmew!{^e(LM&MZslO9l4 z0J))#Un>;haujsxN6YNW04oZhMyN(0Q4z$Bn9Ag}YL4A6_zcV{f*fEX1wYlwD}iL8 zpdr`c$;u!Ss;9U8y!_90Y=KAh*oG<-(YC=$dQ>?}Da7ZjdAoGJd@C1Q=u1GkF2n<- zIu>N|e6a9&h)KWf$m5gVG2?H_(Bit8-0-t zD%B_j>CdZ@3u88p!}xxwnYZ_(Uy>>+9R}J-`R>elWP@~w4TD(7R7Rg9yCblr)pBT_ z{f&b4?ay}n7Wif#oaq9jcxXIj64?sCK4}qs4OJYUvui8fe$)I41w|AB8I0GH1O)Yn za2>E+wGrL^)UB5%ck2F>R~Ln+&w3{nB_(#rAVF6M=hQ-v=7#Z;?1JO1)RhtgS_q8| zh1hZ_>Njk>V`##>%MI5uNLr?{7i&Da#z^-wU#I0j(lQ->$g+DafW9)3o+> z1S2D+!@m?{MIi;*Nq~n1lN_8(jak8e0j15(!|rk>*vCT`Lt!=jJ%B@E^D(iS6eb(Z z4GvxW63dB!do6(|u#iwbtpPpu(AQk2;=#qd7P&xo3|3`Ed%O-gvv3Jz>WlJXNxEnA z%s={p6ApGNF~#_rsxf~x4QE2OC$lt2C6+;z9?M|or4oB6gC!3B3@74Xv>fnKiCytc z;Dc0R`#sO!OwVE4p>IX?aupHMKxya?j?0od;a+`=lW7@$ZEpKX2hn4#!)UEm z+b2p-;;HWTLj)(8-3L8_m-uTKE1l|`W@)3pDhBtWoy5d(e>YKl(!HQy zi8?Cikb)d$#PDj;X(zQ5=3nhsHGqr;1Oi*5;~f2t`C#2^+T&g{v1t>8DMGo~9aD|n zJhEEMkYv5Zi8I8-cF=*y1yz#RBzyjWZu$)w=wQ|!g^;>bykflYTT%6^Idn1A*46kq zfGLXZPlt07aS5ZF;Dq#&L7l}85zQSmVp?y6&aGP=>^mjIoV3<+3H z>hVlA6o)3k7&hKAudt;t28gqPh_4X6b`DSsgGmJu&k-A85`w!kK1V{bs(v3@n9LPP z<~77_B)(2mftL2%twk==3(hZ^A(;1L<2`!7yU@&z`FnDcT=yU41%u}sTk~bK7mfG# z5sltQLYDQrE9V#att89A9Nk|H*%!)>_}K8+!;TAU)T$3&)*AVu7F&Zp(<>Hz*&RQ) zF46w|+`9Zz56rkZhn(#>XV7&Wd$8;u=ge-A1|C44DqI_Z)qY5imeLVo&R%Y3<%438 z&A%tWS?ax4`%qGd-MyvSpPHz022_5`U^3(``ZYv9R}@`3Pk(D7$!lKrMri!706LQ` zIO(%`2G+F=8_Oe&@;TbEGFCs^P!YS)RCI6BX2nrj6nHogZa%X(vpFCK>mn>!N{a&r zVW%FBjGQbk0-EPuprfPW{BAeoLjJ&ZLOZvRzNAK4Z*+kI;UIUzbwYn(*lj_>=EDI~ zTBiU)`;`ULY?GNj$?KT=BBnxLSZz6T@mTQJAQ+^fKyhb!>KH+Vbnv(x#mM zz9O1jc+H4Tdz8llkB?i>oYyKH;w$5tY)cYDFH3Q&;@EDOyq3QIf3bB}QE_&O+OBa4 z?iL`pyL)hV2rj{$1oy(-Ar$Ts+$Fe6a0u@1?!JqB-MxDKYoF8+gA;1hpx$}S`zb_f zZ{mC(NTnIkTLex(qe}>3rIzoGv0|OZHCmyI*OHrK%^z5DJXu}XV1GB3b1Yzl8`m{E z1lI@aLCxQDhvpEEr!o~`ywVX>j#!C9&aww)o1;qrI$FbQI4;bff|VMHU2=I^&x-)a zyH@@#(VUEm+Hpx@!0>KuV->WEZXhi4{IN+`aef*pbqN^@c1SBbB~ya-QVFqkcPeJk zW>d{V>?cTaGVo_>dy(ad+UYt=`Ru!xk&s|=`Mevp+r&qt@$Ce)E>+hvHzj{$zK@rG z5)EAd6FA;OIs-b$(gWU9w_H07jSIP-K*!ATQGn7+M%1ruwfmwPB2+7l{hEC|7j&AP zz$-lB!>*x`WUqBl0-ABHDY}JwJ?$~5dVY0=UnhRO<#nr_;3Ch+O$Is5s43Uzd_f#p zJY2oAV#8)aJ7QD0;*KUc14$duU2JV{}#r!O9snEK?C3#y9 z?~5Wc$@KOm->31945fCvjq*=}QF)bL4jp#btB%=wVmdb8hHh>f>pR*j%GT20U63#k zvAC$s1BxKBEXqOSrkA}sq|kU~Y`e|A8k&9e0df?f8oZm9=TlT)sDE=~(KyWFQx`Y^ z1Sg@`6JPyFi$rn1(@Y|A%4lUjU_LAx&VTAV7j;h%xf(M05b)&~WAR=pX7SSiK0v+> z5zOPh<>Yv)He6F%>2?H3nm(4bf+P0>n5~>(mc##KvR`fg0!I@C3@^owZ}6Wv^!q25 z)C9U?bd%a+N!&UOR;^+3jLf1&&t+LGYNg?=OpfZU0-wIf=*hCH7L5O3wj1;WMZWBI}z!9qxb#ZdoxemLh^GWs_h+dX0&YskY?)VVp0F}lhX&3|P?DF2^NBdvc}0T(eL3LY z6~hmke%Vx5PFO^LndSET-CQW-KOw=%7m#;DJ9D-ytvuq-cp|BoSJWEr&c+r+j#Qe% zbYN#-I^O>UGwP)pZt)Q1tAyC2vJxy^c4SsOOdvg8Dq?#Pt7BL`pSxW%a%c1Uh|{=n#*S6I3*7@pe4nM%@rYj}?(}UPM34 z0*d20Cxb0NAX?D(KQ~}K0!Ts0yqGSI+##kUN)7m*sECD+zAAh@RP5}0D(-?|MdgXk zK`89zs)fSbI$$?S7%9?|x8%0sV(^-ECcVnveq3|DAtE&-!MDs`*g|?&rJNfqQn?2~ z%A1#^lr^xvSuFRko+LEM+7~MEPTz3qOC5n8FrTKsn0WOo3<=qw06N|d%$K&ZUN72C zt9LoU)|SU%6`spd#@m#U8Ssd57-N{{xX7MMTo;|bM{06W34En=$=l$}!q2nfn_km# z0ye-V4zz-`z33nb0U`7_nj(c3#ww6_zM(1|-HG-CGLGPCXrXDp zygU_)-6d`0ctvO6)EMnNr@wzePc1nfru6v4~R8MHrslBXFUPcUh@$;51OSKIEz z<927J%vR{j7Qp1fc-&$6<#D=nN?*9jvC{+j>A4iEijm-Lad1iCy`LiGcPi>#6+o>Og)%X~`ws zBE4v@K7|~(K{tQ46;yY8m&!?0Kn!3g@m5(@wE*zSrtWc>N(lWr3v>6sGdcBI227Zp zHM<7S#D1P#J4o6%9{c#ay|E;{jiO$;hDnZ#D$%3q44dOktOH7z(?ZS@|vE5~(BI?9J+P)iQZD-sgND`YTR|t!PRu z#9jcBlecR-Ovh(Wb*4`ck~% zh}=KZ|3i9`tlVl_w6cV~Rk~`F@7$;wt*u2;V?J@^#(oRePJikZ_$~hyFC6B`{h12Zly=f*by(g+Rx2;5y9O` z{U-V>DT9R%hh%Pz!+Q*6{?klaOQwq6?=xX(I`^cjTMu``Rmf8ohq%VVn?X+3x%SZPNr zrY`l5_nXczU)5XXf+j1qL zgVOm)t>2fxL-gO)6TmVv42sVqi`-PCSFWl{sejo9C)eUGsN23`p?h13%9F!m?~!5G z{)^e<>7*xQi6B-{>@wl(?d8lclbF=aCvyFP28d>kfdO6#j6eeoI>eY-Ak4N%igvfF zO-3{_8FX%Y<^wIMwLkbPvEjoc(e6^kGW@&v&>X1>V@20#OH1)is&yeIGb`$=$^l*s3~Gw9_^A5+u3coudPa6`FQOBiA2%yA&BpR zOcofF0Ki__9{kM`?a(#_LCn=XNj+T_YChY7xOQa?bc&J-x!VS9e)&FfbTvUf_G6uGv=t ze15q~Ml3dMEk(V~yYis$y1~=#_#I>no54>xITLgZL4(ORr&Jj;rWH=laF`cC6->g@M(IWquZ0WLfaM%d!t%>g zpar34b616Gr8Xj=C(ugsX$TJph zyyFC_V}c3;?4X!OntfzXAc6kS>*usu#P5KfZCirr;K^wmuJeWb0qqP*QQjICP$KtKA*g>CDyTzF{h5*wV$ESF2~7jG=SJnhb)@ zQH}V8fkc|OMh!4lu%{D9y!gB)SU*Vmu1mx%Zj1rrX(Eq1mIleRYmkrl&FEAk$Mu+D zBj!jKLp<%!0GD)Cy4XP-RIiUDAvz zP_N&pX>K}8aV*-}DU&Y!$YvNcZb83}GJuaKDAT{Z8K96?pJQ*qf`?%E8qPMh1SQHx zhAS>mILH}AKRFr2MQB}m74b*!$DuR)ZV9C53C_dsvy6IOA!^ z;pXXzmR#P`k{;p1u+_JlAoVpX8HGyGj&d+*;vI{K?8s65a;I!{T^}>xvNZ;oMw#Hn z>35j7pX5+hK?EwycrOPbt=TQA-3ojzGVP#$c2|t$?Jw7Uh?=qGR@jI=@Fe!xcJh=A z>*;oV>uR=)Z?K9CcM^jdR&={|(l=qq+0FB)WR`0$05aF3VFIpr!#UtP3s?0sthttp z7k%CH9s93?fhyaNkqnTmwz(<8j!FWssMW02*W7j1pDCQcq|Nl>5s;{h>xQgnysf;W z!#>*U1gwuC&0YnSuwWSw#{Z-l7|zJO5M%uy(_nZ>_1t&C$%#sTld zbe0B5#NOf>3s#dY>}F`)Jm}maq*B|JPReA;>EST%oR$5&{Og=ef0N1j%;B;j`4aa zvR#3Nmkr`E-H%NsrckW!CtoGE`170ND>t!t$FtJ*N8+2=f(8faryq6jo|?hrHFtdg@;iTsBauKbNYR)s zqFKC4G!-G6$z5G3jP_uCRI@60-01e*d8AGtgCNGCQ2=XxwP~T5m#no*#sJI=F++g6 z=B4+(N5r2*PauUfIz6u@4*qUc!A;d5zq{to2V!jN*AOiB4w$WK1@D_e);7kxJ?^-x zzM%xiH=Px=XVe}~Gq)UZK<>l@25`~{6GNIUlJwyBwOAtjzGefPi@TLb6{nt~lp$Hw z@XWi|0g%idbk{1&7^rCvf*mGxz!ZBB8d=_&#Ki@)DdI-K7?y>;`Bn&^os@e* z!aVr_C+$IKglH@>-QA}>o9)J(@3qEwOh>?yY^d#_Z!9S^n@L$0i1rPHTPm}GpTB|B z2uT~z>V~d{=~b}ZZJ!+iiMiL2-0-SIFv5^3v zj3WjOkX{sr03L%aCUH0#-!=xQB#MIrtZ>9&0v7|WI)ac08SozTW8lg_QYR1+5%dLq za{?ieJz%pF2#FK|@trXQi9wHg^ODks*r^H}RSyFqG8uqiw_U}=0CrO)MCeC%AVndD zKj0p0tN*f``}v>B_}HC0%2mTZmGP^bN>F(`+vh>R;5ztlM`ig2R2eTgAv{K4rhVRV zj5rM&*jnbZ-td@K(RaS-i)$Z_AT>YtObOa*h0ake9PjeFG|&@pN0{>-nD%`5)<*Mn zDG@l}d#X%-xYC+z$M@hu0{I>A^}}HY0_YnHGbi>;bv>MjvrkhZDYKd*n{Fz1kO75yK+Gn=F{pg}*YXg7`&8WrhwDTS4y^wKtE$R%A zF?3k&`o;hOhucVVX3b9DKTV&mCzTJxymk+EM7dF?|I%r(4-Ub*Wnc*W8iR%bAV9t6 zd-_Vn3OA-kxHu&4uxdVJM)@W`VnR&DJ@I?xc*1@d`DU3h#Z}aR)?;#9?zMo<{ko$| ziAZTx**LV*_wWXEd4gf|m6<384vn`8op`5DJAi~E2M|@-8*`173~6r((uSxQ)>rWz z6Li|!%sQEqk)XlOp*4=nQ;`0zW_5VZhD}3cdQ2;kYbo@z{3OxW5+js!UeA9{jc=6Q zP>;K}J+1cL^Hcsfu@341C_Yc$|LwQsF)mZ&6MkgL2eS~!atLA{6>VlylDfSD)E71B;7l1tLrNqSYwV|X`#3BPc`bybo&~AA7Ai_=4`HZd8LbL z4S99Rs=l!hG|!21sj)#GmThFKTWG{XvNpuZeYz-HCk|CHbg#LNDOWO|I<-_AKAmN` z#8I&Yxx^0tu*<_80?G$ldmHCciH}^lQ$Lt`GG6VTP*uK!HPfK?e^kKJuNpqtMDy4i z17ee*lK>ViL~0eo#a6$hs}wtE23+UM$-2_OnNbUK6v!ayaTU~lp-Mw1*m5fjJYUn_ z887q-u7g!&)hZaxF5>}xHyg|%JUP$QX7K-JzU8)V?iTo>_0vPcD=PL)&GUr%BfgA# z{&foIYl(ZKq|Tfe++nTNH!OnU&gh}>6+G)i(?I35a;)N+?BTj=^|-H#Wx=cvJDWf? zXK;Fd=%(S30BT9&(5XC>oaDZKMm;0Sy!ygN1X&Vk#K}vg{)Jn5OaWapwC;QRWOl_* zSiF&=MF09T*|EJ?$&U5TW((YFy+bkdiy%f?LFqcNpvb7I$Rbh}B-OWP8(_*68UY|Z z;=@%u{)7TWzA!H`cOk@3C(9>eew1A@=Xj*c0L6oNWW?vdK}9mi4Xd0ak@D=2BslB7 zd5ZWgO*KRRSerFh#Qik=?I*`8d6KsVNX_Jp^2;%CJyYX^-WF65h*Wl8ZYHGOWHk78 zCht!N@b+qXQk!Tb&)DScK4e8LTvPxnh?jK(&CE;I(#&sy&YKN!X?3xso`qgPn{l)# z+|Bs<1>y*Zt3>Rc`dVrmp=s|GtSYz2Z5o?k8ov{YjS|nsGi2DWJHM!f_rgf?7Gq*( z^)&Jfx=hRrKdS4X@w9Us&qn)xNJcl18noc%l^8Mqb8lLynZv~8f7G>#Il|~_` z-Q&rP5AL*M6(}!Mt9)(HwqKhT*(gusUU4W=VW>DP9vzYzKkY6hF#cBVaSoIBJyF*u z+UfG$?-R6wOyJxkv;(9+eWwSsyfD}aA(OF_N6bpHo1VOA;V{K$B>aW)cgsiUf7V-| zo^r)5ZjcL&Kb=vzjf?sO&ZLgE(AQ0`MZ7F#%&+Ke>bCKIW(CB0wtYU;S3w96i8IZ!=aJBI;x8$1BEnNLf=l9?TlP5Io@Am`jt1*Hca}5PO z=|U4R&gq|4*d*1ENP2U)kBgrA46j*)kyUG~r(?8b-kpzcwRdLn4g@?c=KvmHv>V-O zbrQx}!Jl~B42}4u6$Xa!bjO4)S~Khc5cxe@Ol5jwFzExKdffWY_xh=V?0j(PWoZR~hz*RhL&I z_J~xvbB^(+)ey@!30AG)YtrBY^~^QuKD^HUTCg^r(gCGeMPTzW`bU7bl$9oa924m$ zqsLd<>e8%|;KDct*XL@3@!G18jyrop|Nip}-DCdXJJB>QyjcabX{yVoD7WgD3nIj^ zWRxdO?1+&Ac!lE-u?D93Rbb0gBXn>;k?cmV&ww)?*C+lUPwpjo*CWo$o^h~h1FvB& zSr(>B?mkAknhl-mUkE_;6Ldl7(R8b0EnxBqIy=N!EpY4vbW{olX}EMK$^~(0&w+fQYGQp%7NGJw4~jZykT9riFfFZU+L4G%43NThlxo_#p!gAKVZ~ zk%7jHvsu`v&c41N_`s=tA&Xlkkbyq$8NoUPw8=oD!0LFIbh*~aVC`Suvv_5M!znr@ zUvU5yW}xwa7Xa5Y&}hIv13zS<5dr=etw4XL6_!c=hgR5TJpDr}{v#_m|0OFpjQ@|U z7?;NR-?HLYWu5LnvLb}s{zbS(;=g1CAdIHqKeVFlFRgfbrxoAte1UOOfX1>7Dq_}v zE~9UoP)67vVRA8u>`vX6EhOB1U!=9hJ<_Un@`B(Jn~V_wLEO8?b|2Q8O)scLMx%XV zf-rEkDEnnYIb8{F!V1!HA1&I*L4y;tXKVD(c+}1lY)#|C169Ud;B(vDx+`uFGi^+^ zIBK>2rXj|)`bsasj6a)CfAe}6=1>d%r5I;nNE>@F-|E|laXKel5 zyp((%16khvi>ex+l7s54VgAY9+#vTpj}aCAgWucaJtj4eo!g}I9`gZlilsGmdm}kB5d7a-LXz&5Kv;;VZw2{ zZs>sb%)MbUsv*jubr*DTpR<(37`v$fVcDWrvK}7y~ zuDtKdD?TjIdU#e}mv1Mg9yIk(H(8aKfPN|@A#qYKZhyE#eYn*=c9V-ZVULV_#Se)d z6N&Te(87&_T#o4pHxy`L+>_Bn&~5T13<&x?#{y__BP6rQGQ0hT=u6pde#*@AsV77R z7ME9-H}aeWKp@G{cXPwsPJ>M*Q5xNyxtR>hq9iMiO=j`zgeTIkkW3=;Coycz1zN%% z?_q2Ahz{Fc=D|L#=yfp#h^ zh|%!eh-!-(L_1m$*`26yq{0EPl6`(|K>UduUS!a0LQp(xBFw`( z%UK)+h$fu{E+-x2JqHS7<`}rf%NHSQ_sIkH*>^Eih2^_44n0 z#Q!6{&VRs*c7o;ZFl%EA{gHSBP;SBI9foX>{YlARr z2RG)|2s8MBfmNu0c)CRS*g6W!35xT=7n3Kbm$^R+4YsX$wc7yHJBs>f(~r-6J?0Vh zb=#)0vOYmo1EHyBK;>LCEI=i8fd?}s-{H)Kw|dy)#29I}25DMh#=iENBUwpH&2Jat zjG0h-q2*P)3VP%Z*7jGCg!aPyC9LClY1S{f6U27*I;RlL;MF^YZ-diCukCN2W-$|@ zCY^c~r+W=2n0@He6lQ9;*vAbo#T?#9Rf@%`9SUTp*Otr}-vDiNodE6MQyMZ)H4CA{ zvI}i&EcO=KqHox)J893AczRwMGUQC3l2wQe@re9z3;)JTKHyUwYuRQ&hMUE{G*VX z;4-#aZkCXJ3h*%T*|Y9@oyIib|1=UxKL4wcQ1RYKsC#cDApC74ZPx-wHGTQhcmg5_Mm&71hr(0ch;s5^^HF}r&|Q*pUTSeWZZH^240UK~zqBD9MbBNgt#&?YUp0gPCSV}(rD{&6~j-EbKhhL44 z-$}2&OJfekKw_RR=$9-(AcCjsq(3D;?{?kaX)CM&YOr+ytuRx6iwf~<+LcqTo34qe;XHX=8VkiG^BVmaO z)JOpTPa|O=57bDY`L9MoYU)V{S6n&eYG5bo;jIl>Y7YY7anG=V(qhkI>oOn9QrfAQ zx{QMo3ysO^7i_?&LQ=9!GmU>MKdSNfK}X|D*5dl|!*-Ig)f}adUpS92@&Udk6hB$x3T0BR+ zPP($qMd3n-UOK|_KW+yYbeIL{;oErDh>0q^#Fh~FG63PYX_CmML<<;#eEJEma4$P% zo7mj9oL1?a2NTvH{n9sK$35b-JtnR<;zqZ4+Jrb7u~f-Yl54I7l1hT*`oKY5`4^+-+g!)$#_6$DdK$)R~5^vsOVFL#lG;LCLffT@Rfv17|?3X z&q=&*3@V;ee-idSh#|f(Sc?dTTzL)RA{fy|KD#YhLqm={Os*u_+!!E^9`2G5I7*9XU7u63h9gXc@WpuzJN(BS#21>o=EITdK} z9DI~)RjP!Ep(J!&T#vlFuS-?&qBksf9*yi**Bx6vjwyaHK0wZIrWCoZ->G(#%jq{c zaZl;0u>(_r$DfIPM7&q5C;VQ4q2ZpxnqT?Cc|6)$n^3g2N2hQi1PjNA(X*v$9gbAu zEbz^B!~#f}m$bV#z3lM-_A>wW{50DXK|CF0_S*qci&DNoJk$e8VZt(BRv$Sl)S7&I z*89xgauo5W+ww2L5xtniN1n%)p-Z}oyVyc0)()uVTF&Vs`d-;tYHd`#%+BW)>MgVv z;AKA5Z!`Qyuw^mhR-$9yE?gVuC zQ>m(#n_q~2UsD0h1imc_4k3KB;58mKss905Qz1&S%<9$iU<;Z`sc5_q(H;mSoN=4GK)jMBNUJELIMEdJjzWwzpRPTO;?EmlApp2 zrQ3hJb%OUCBN2J>Nbq^L2uqs#`oOzF>cczt>{!2r$xdjJWd`IRsps5hd52B1fVhh@A zbe`&9r5d!}USvOcdTFgv9oR;FwiG(MP3q~$H* z1ikfgegzG)o7eb`KU^&VDaZ3Q)GWmBa{)tkH}FV2pN5d*)9?pkX7K`H0;*W+v`g%E zB5t3)Qk_#(f7hmHy@iw2A>a}O1~L49U%;CX4Usw~J^~2cmr=GyXPrFWuFj(9n52o!Ld+{jENTUN`9;}mCz$qFQMM@d!nsqc>k5IPl+92|N=F~4~)=^dWYON6V z>H{2z?xOeYsTFJ#A5pH=W);!sh3#)j2Xypi>yzy@<~AEowAnF(St+l=hr~F?G|Wdu z3gvYgER3MN&3V|U@M(QPOCsd7$LIjY$8FKN$$K-GI#Y9}-9YB;!YZI?ZBbEmlIz@@ zlJ%jO`JDw_w`8HV?)0yFGfOjU}w0CAIh(-?1P@DhSktg<8f23SZ=QD zcqgzq$b}~oCU{zrC7#g%YYHJT{R(k6lY3=vXes+0a^>%UWl$J&1n*%CuD@Xn_4?97 zL`<(MlYhb(`0T*YN;C>UEvG`*;Prd>!a1+pu5Ko(p?R|1@ju~M#r1+uOG`^T z#Df^Q(8Ghl+lO6u?5-<*|2=WA@uj=UfW^-qC|>Te-EItdik>>A?)u&QH@UA-lY4dWv(%gfqKQc8fOMLpu1{!pU0<_>M)^ljKtOqyp6u5 z6CW4@4LLDzZC%gog{DLoO!ofGDHhC`VeJ2M3JE;lt0tit9`~$_n&8%#);!Dz=Uy-u zI!y9We&0PuaQzXO`?I%9g!3z1Uvo$BOjyX)79Ter?XO=)7>BG4XF{O>yZbopIX{;y z@zI+>c7hJB&V=JnubioO(*$oWdA!uRHP)XEk+WL3(}V6}iPJp0 z`BEUXTeg4>Fc=Kr!@z79&>OQH;ka$cpiR8AaX-!Zmb^-JB_qD1&@v*Y?KiiX+nbUW zdCzF8-;PXMPiZqe@C+#U8=7g0$12=*3eJ>hc`0rx(hSHtCe+JE{9*X*tbdj}v>a{m+Y~COuH2sZ%9BwJy|JHk84A{2_7>oEsJCiqrGxuSg0iFVgG! zQ=Ln3LtniOiO%OO^c~4c6B)_g=nE#Lb$CFr;S;hox7BKGE^Gn#UY_5}6)QU{o&$&) z-KTqUPKH@*<9^=#>}RV2mpxllzdX+FcV@B=T;7Ddj6YH?pUd15mMgOMz7Qrf+R70~ zC>rRFH{Jn$Gd!l$18cW*U7pGcW27@HT@_#3gB)!e;oBEVnrBeaZd4DbOLfN;rKuBj!m{TDS{$_R4)K%7*+O&51;PjBF(_S>yEZ$;1K~LS(e?1R_ zFwDtdtx9951T}JACiDmQs{kS0YiWfN$EzKxnKjR0r3xV0qxF%$R84XYX+NkS(T@3`P$M!!K@Dy0%+2QyzVt|r(Zh?g^WJNTcDdD!Ba|{CYm_K zxXLK4a3O~dWt`9q(LBhd1}nO|h=ErYb)#2;CR^+rqtLY~p~{7cj(%jHJ2V z@-Y?ZMRE;8oMV=~Lk@;&o9UvWPcWnuJB$wOVPZX6m0Ts~4|g|9fj?Qfv4o zVlRxZt_o6G2eh?9cUV*QQ~RWOc(|u<`K%yw|JlGm>xSX)*2>fWyS0LY-LMzJ5h-u> z-&-qU{~23hZ3S(uApPI1mG*ImW**Aprmvu&GY*q;3`g4#Km$2tCbYQP{uH;tz+6L-Yca6MQTW;Ql1d~+<^`@3us zh_(y*9KE;75|iiAKgEoqidRvp;YkqMV2W<6_A@L#)B8g4@DX(y6HbiTBxCB6Q?LZ= zw^wm{4>!mMmw?~|9W{0NyM;Y>TsInyN66=aufK=)E5vmI*U6Ia`OSH7;X{V(1_&FNKDW*c*6IGlh<1l|oKF~$@C(D~RfB(wFpB-iJfqcE$VE;0NqT#TW)zlN<@ z;~pE#Z&sC`fdv|F62Hp+j*g@wVM=fkwwLt^7D97S#H2it7s@}@3l!jsSUID z$b>a7c43+w^0H>ApAv7rG_sHG?8QvwBVIL_hJt9siD!3Ar-+k(h_TJ6aYB-fTw?M6 z&MMz9UI*%EFs+~yLHrs3Dz2d8fJcJNJUR*SsbXZh+g|};`7R)S>j+x?zXIYDa9{-; z8Pv`w2}L7@P75vshuxVEs@&k(rcs}H*w=+BYj1L;{v z#%Xv(Vkh*<-=##u|CSQ7aMMf7Q7u1ZtoALcQszZ`5r+D!ut~*D)W~pN;@$l4{>Vix zBU%|o->1(gWkZGA(oIo80?H58|={fPq0>&wV!mGmy^1}~So3WxhkdILsoPrBe`~lZK2b&|< zsz~6Yqr?+hQ9(%M8mb5f(en+YGlL_$?Gtl-bihFv<7+t+RY$ck5qTJyBMNOKH8ELs zy!#){zpI))!x*(%?iX8ObE1o$li|3EVc6+&!`Mm7dT+xFKD>DMTdI9J#X9FqI!PR1f8w zCTP{|Njg%HM?gvfuUV}z$VS79tJfviLqprU*NI!RbhNv=w7uXT*JY8q5B2?3enUyP zHSG^O8TPhJFNl@5+Ko5ideAtLul7{)k8i^1PLgb#T3h$bd+oX9Q{O+H0Nj3CeffUm zGn(FJ2K?@bfrVDN!`@yjH&OU+BZC42k3W5?>h`p>0>hOa z-&jBBxIk8uaX|qZMS{+VV1bd5Xq423=J19A-iPpdU+Pd{*Eo{Gmu;PN}PwS^cU3m6y){7e_a zpSnZChkocDUrs(7Rpf#OWN`-UuFS+Rc-h6P@4o~+dV(yp)2e_P-_SWYI|A2-4NGt@0aqS zkBrZ$LH#{u9?8<~{(RegK-inB%#%{5gh3iV%(vN()1CG7E}M#7Vhk`v^fw`;GD+Zy z6SQ}kr43ek0A3H{6-L5p{0nK+%%u5xxwc~u7 z^L*`|XALMYqGLS=2&g|A4QWr>Ja2p4Y4n;TC;`fTpPRvb`@zXo#nk!pd`=OmnTiNm z^{g!DNKe##W<~?{k!1KPvg=G7Kl+L&P@&rM!*0Uc$HT)RohCb-Owb72kskO`VHr1+ zQ;d=F*>0cH3UDPFw46-{qX9b-V;S(o8UKc(q|P3-)y6k#IvrTOHbLGd@!ohTgqtLa zR$qGmcbL7PSaEKpL5JUYb*km^HW}1-@!Lp+MrF1$UTw6{L@d(cZi$tuq}jj1+#@KE!VE9}}DVu+OdPYULho&7xp1F#`ug;RL9K<*BUg+o^VV}bNeCeHq2 zf$09RKn!m07U)!YRmnK?bIjq1d9yV^>Z|2@3#QJTLU8bJ3r6e>`@IE20BXTZ!~AW* zm_P$SGh^e14g5L(q+rT-{+)sW+`YG8G)$|lkMIlqaIww=U)4J2E<5uqLNga?fOfti1yKI6JuD#G^Zci6N)Zxddk&ohbadqtXT-GR6Ny2) z7gvuN&ke2(&FYZRbbn_rBmj+VD4^L3y`BFxdtv-Od+}CbCElDVU%xdKdJ>;rnBT%T zPqjS5K8in8Qok@KL6&M8Pj%U_nJn|8=MYdpWvbomD9kJh56Yj7O*k9#T07UURI@~z z%fY>!sK45bm`iywQzob{BK}TQH9yXLo|(cvD^@3kb7hV8^a+-nH~3ZJ+BXOH;QDJO zy1TtFQBo#rzql-mQ>V^ZJ}_Hw7+<40?!$5N@t@2p2`!oX740}}q-Hr;gI$`!(Gq~A zMsQSBtBq9VN6w=1Xvk|3;Dbcj+680raU)gq|Ob{Y=*P<5)6bul#t2JRZ6RoTL$80Dl)cGXE}gBu#sZ z{%fIQP!_b%(R{)STIitq_d*BJe=l^%zb|y)e@@4OF&YVlT5D{fY9agYQjGS$OEE&V z{AS|Xf}37eeeb0hMvXhMf0bhDuv%pT0RN<7%Ibc0gLBcvhZBAUrD9yG@CuFxV3RXTiNw3-e?l;Ov?H@}wXCD|rw zlKEF;mw!$_hA|!ja%uR?o`U&uz8Fj#B78vLX?R35^CUOp&0*ZKm|7vfaG;EqO6dDO zs9JcvLck}VJs?K$u=MMNgxMSgS!2-H$H9A_*zN2ZANX{Q#`eiBr26=_vFY_s%tS1` zHt}R~{grt}8^6B%t3*O8&#D7Z;RcNaz-8p>8tr&<2sY$J^CKG5_)m_u}QOdXK!iNTftZFDqJVa=`@gEl&Jfb@sxq!4{@s&bl zj!n!~*b7?zPit_d;?3zC=vIKfnwqOZ#Ld28z2O%GvwFjJ9RxG-vE~UD)U%#C09i_z zsRvrmHSM_lzk)8S=`*09OA&4Qh0OnN&;_ZnMUb51KS7s<`58rky6E&^65s25<(}4j z&)O3gv#{~K8>0(R&r{B58lrVk=mEyVi$v@Es~ZZ8`ACR2eT4Y#H5ApYDCrW8&DrqE z%MwIS*L1-*qmHfSNCMQ%Zh`cZ!WL(OhYfSzd8YQAw1Q-yM!FFYYvH_nemTgIPq49( zWNnC!E^H+G>smWt7$)@B)Yq6MK+T!hDbRN=SkhuYYA4OZ$!OYG#+|hZjFNY1t0K86 zUk)+oN4uE<$1VLv@%0?ivN+c_+@I#50dXi#p0E$9!*!fBwrL#pOca6=p8SkNmbpqM zuyxb8S~&ov1|&`BtuHoR{A1KaG3SJm%h4PF!vVr#W0XlAPWk$SW$rqj zq~a+5InGKdGA2tg@yonR@D&y7%dDGv^nLISO69?q+nD_!@-a0TFA<=zSYZ4uK!Z z=s)q31WpC^;#XHA$w^^clk#ax^&7Y_(4J4HRdmcbS^p4hr#F6UI*MgqhMTk;{EBj^ ziVG9p4@aH^-KB{_7R61hJbB`QK5reD4-=NS2#+KKaQ*Cv9m`2u@cVcxm~Be9yGAr_ zU8V83oYyGF5#HJ~ni+!-TcuwPk2NgOTK;^l7en52-1oy=8~GYwLNB72Df%SoxQlWm zywV$`&qFzH`AqUxV*Bl^X|;T~4@%;#L+laL=WDn}^zyf-dwpM1;O4Slrzhd>FmOs@ zqg!Sc08X%H)4F`<>I6CphpMPvfmChk;p)nFj2`Da@cF=ddYHA@ml3+n?7Xo~bH6fl zCk?w2n{Tr#0yA%jwfRJt2y?cG+c!`r`7CQM$*E|;Efme8eP{!K02PxEis;TrqvWSZ z>=)MzCCh#`57Fw%gdWQh@Ov^#V9XuHtpJ=c;G^*e^To`_CmOF|2o$9smXxESX~wsj zU(*$FX3kkOQtIXxgvHopkT$cWh8KmkXRB(V@i?Wv7L(N^yO+j!r4TT%HF}>SEdfEZ zC7R-wOaLtjbA9O>+K>C{5-!gQBR(j}>^ofk%ImDvgP_~tgi)QPH9VC8Z<5wqnIkw7 z$g6A8G}kI)*VcS+O1&09)HKis9-IBcE6$H&+Z&zrn>BKv*JtIxky;{*erQ0<^h+Rck$|X4doLr9alaqS{3DGT(218S@A8o zA_fPE+cDCF4d7q+A2D5Bh|>AGkb>yXPS3}j|KJ6JK@7`&O?ESoxQreLERW=P+VyFE zsr#gBG^ZJ637kv^F<#(?&2#{n!PvyZ=WkIC3wqeQM-Jd%XtK(mmCD%qU=nnQg$a>d zGd<|NZas2f#`eL@wvUMnHQAW^KQYXi;&=XB^*6xIpyF+XZeN7vJ6bZA$AYfu)Ws8K zn74H_Luh7wz=B;<6oFCxKD|VXe{PfIl~!_3fjFC~0Ds&jo}y+_jdk}}N7B;qljve2 z#a*y;2RX+kx=tSqmL8Jam!YSDeouJjdhOYQ@3C9~&-mPt9e@)Uq3RNE$AcRvX)qcB zKRGOl$U>QqxcK&SzM9`MVr3H8sfK|Gn0O4d`t*}*%4H6>WJ*Wt7H@Rg*B7}DXMS%P zMO4fLWffxhD-a zY+phn8tK^_%&!lTu6{^=Ca)~R9s-a%*=4skP-Zz`)k$}n>TLc{jNwK$jJ>Rp1Gohv zDUx@(?x@3H3n&SO3t$*D{`jX>`{v@v9Ydh4C_n_ui1A`L{n*Qoa5XE$eKbs`zRQ7^ z^IBcj(5^@j86m^y7maUx{iH>P9p*>^8`j_Hjo8tf`2VqYmtApn>!Pla;O_43?jD>3 zclY4#TEQKH7EX}h?(XhRaCdit?#esY+H>uF+Bx4(Yx7I5KLEvGJWs!Fm8Xm^<*aSs zG!F*rMDXZ?pnK7bOU*vrV=~8Gx{Fu;uu5zoRtdm{fDHL>R;l~Fpxokrvr23rR*BHX z{eQDc(*F-uY4B^RsFTs>YhV?|r#~JFvdL!`7lOG*Y0ucd8{6~0ehx?|#Yqq}II1^Ud3kIBQ02>iXwR>v& zYP4C3{l#(A^gU#EnWLHAIn-R_oj{9!=LX_02DNd%Lrc?1sFLO@(>gc?=IeG}pN0Z7 zw$~E1N|eGo%Q${C)v+kQD&xVl1Vt7BTEIaUKkfbcKpSz-K`nk3;QnI zp-RLCR(l`IW8ZRSSSP$<;Fu_&zaSBbn2DsG ze#GRb?>u|sZem8E<*Q2@D>{t_;THd*jzZ(~Z$%_Cr5Q)1vL5YsXoH{t^hCcp-MZo0 zeco~H<{hL-dOBNvSu!n_k$m5UYt9tdR1L&F9P=;++k{-Wyo{M%Gw;&CA17A90^k|De# zLCD6yGG?bk2J=!gN<|1ak?8*9sk2nV&(Z>In;~9)PQkU}vIT8HU)#JbZqmBHiNyXA zQ4<>`q@l@cFt&-*R6Xr*W}?Ag`3R+{iOBs zwZs)kkuS1dCP=qn^&)Qppp~fQX|>G$I=-~y0D^2LEF&iKV+Ih-WZNJ2>ue(}m4~w; z7ZBBUBmce>&D_aA^-q8Zr5Z8rZ-A&VQ1bEkAtv_JGm<$B>b8-PD?ST=-8&gp|2Z4SW3b$KN$nJqXoFQ=M>}&Z`XoYvB>^L?sy9NVPHirNgQYV$5{4}RbYOy4(rRA<8q96YrLS)~1>Z&}jFb{|5 z?E)6?mMU1mZ@aEtC2*=9_6Ej(rU2V$DA02tkMKg8x<=!-e4g8W252O!Qm*Y{aD720 z2s4(pG-^>$iVowV@G`;oRs~{t2((XbUsA|Cd4|XB%fktbO}}eLZ$87}s8?4cX_p!3 z-=CCfYIZz#oG$3Hkq~a22+mNyUYzQ6IJ8JRiO28_H!Gb>ys0M~>W!WTzx+@$#vfrR zMIbIEB5ti**($RM0X@x)}A?nmGpS&3@C7K7d6aXw!Row-6r-blTzk% zan=aP>SUlXWXhH&w~w}}oQK+u82c*JjbMZuc*j}svrwiMP#`nxOZX52Dse%7Zm5HQdqbxXjCk$0r zCw8jH3wqw~Q8~a2p|FcJFU@C#EfBul^K)HwomfOpY-i{@L8IPd=KDY%#*iM%%lP9q zCk$}hJt|9X)#Kx06qvZ$t$G4Dcf5hZMh*<8kJf?uy`RJfkVcocO1f!u7~n`S1+Pr3_?=D zwiK2W=E3EbnfXxKD46zTPy1Z8@bR5oHI^C{K%nJ+<>Rq z1}?rO{h45mEQd;`Y1`+$3ed5CtB9eLO98t5k$5ACdxhX&WcnHw`k+5E9aQY}Mof&= zMzfFP$Qr7g&#|Rb@K8`fGldn7`>eYd?2CN(=LZ{hzZy2wcm^uAR~c(Mpj<|m>m!J^tv?{?Y8{N(l9}_@DaZ9)Y^1&1+e}SP$)*YXPbkss9??>MVzR6nP zF1D-tIulqhu;;FD1l|CdF5MolW~ifv))Un#6C4#(l)V#yfmA~wWEpe(EyLj`Nme*ivtww_fcm~TcLtCBmEnOa+$RATwqWie8zkjYUkm7mQ(IYF zM+@ezUB)A<&@AykRERV|ceN7n#uwaIA3u$-qO{V2@{{FRW%pxm%(Fa;lbqJ@faM^a zjSJ-00ylq6ohLPu-88!rN=}obTp!7JM#71p6JC7$J%`%Vl0DAk&%U%rI$3+do7V9p zDpKOD7;b#BHB;)Yz5}WCW&-#q^IAmFBFR|@&D`F(wDl-Ryc~de;a=kY-qG*bN@e2f zwP+tRm0nBE2ivgL9m_`-!j+-Y88#g)9XI?wkGis1WV8;%ha7 z_P)o}BTs*|wQ^4W4&P%``bgWr;VU6N2bp}B=(!@No$(^-!flQpTnEH2K?6NQeV6z~P;C9ZVmwW|)f`6k?ncj%d642LFpg-vPt| z#li{LD;y*2a=3qeH}-kDjRH0fvAkc`{TB+Q_%9SH>)$ApCdF&sf1ywo9{pd>r26dm zxd6}$?t@)CN6dDJUvF~PCG?n<7ZPHc%(@U%?+F^ETL$X4N25|5@DyZ_c*dpceXT^R zU>{p1wB~0{A+aX*^n2Le)I}&LAh|Ki)@VNv%gl3r6xhW+c^275YO&gXP07}Od%`y`pyb-!&+e=Tm5|dWn^M#h{+nOi()^5wC zPxvAx2`}u6>B@myoBL^a6-#Z-MgZ$Lyn6FknVhYGQCH9wq55oPf_rlPW?8{GTpv&M z<`9C_@g-J;ketYSI&hT|(DiHDHGN+3GBU~EeG}vM)8+8mpXQH(`$e})#4@sg@~#=C zzL6}xB)>~_KA$hv`DPgz_6oH3j+HR9CtogBU!|JANdZ}<`BK`K6-O*k9yX&051>hM zZFDY;xVw{@E5{&-J$*WRxkhST=w#1gG=Vt?%p?!+ONbx@rO>gO(^ClMi3_(f_vxb)J>Z= z^I-TEP1x6YI912)Zju!Q1#Ut0_CNfCk!Ewukqa}p520aO6(|wdF;CkUGd7A-*&S<$ z`UB)&4MMn3MW@QnJBtQ#`JQWkZaAO}mD)|NA{uUV8ee>r0;*QixvCN~r+7D;7&C%b z;XMAQ|MbNL;mzFb^5XD*`UOVd&ftF0yZ+6T$Sx=;P*&>BgM~iceVleRR4` z&0W1s8RS3VtWtser?$WT)8K{IKmOC>E873%KZ&Mb{q>&!LEH+YOWgZR|Ms6Q|K&d= z{@Z`D)|}(Ck>N3Ti^H3-4e7DUGqKa(Pi-X+#DCw{&Qc-z({id_l^D4gJd+jEYMX)T z40Z^4iEvIi$d{Sip?x8?mT}WLO`g4svm(nh8)xf&R88e`QFBj85iI}+_bW-BpPTVO zchX$E$!ZY`g`*Q2Kc+>Zcl_)@A5~6glLiu#nV(B1iK};HbXZMP4@{ps;rOTm&y^Z) zhcNdvWZu~b+yr_TRRd>>)(^rtzK%-}!Xe!(F`7ci**1h|=vulpRbDKT46l1bNhyol zG}TxtnncvK3WRsO?+F4fh-NmGGJj{^k^G&wkZT2QoM^^1wU*nkZB|weIIK2U(juCF zJ-|wgu+6NROb_{*(P%r<5C1&r{7r#V4eauELPqU3mEPS*m}UO;#F^#T;`*fOijdMz5qZG;-AHbVMm8-ksa*- z2`ZMpeLu=Re8c+GVX6DyKX}xHF6?chZjl)e7Ouoix6|;yB||*zmhX3H&&m9v9-cX!shOp~v#AF-s(W+y@bH7WiIDNXx$Sz# z8oy->JoNfB6$O^vbZH3F5O7EQbdwT%ts|B5&^UV29_)1@`9>grbMSPhTQbeXg9LqK z=Z7odz<(rymCK}cNqi62rXpFj(FGc^Tn1zp$(~xMKs{kyKPb7w_Y6eY)J(^e+gj9hu~U6%TOaPc*EZGD6%aJ{QFtj9~{mbOMyR z+z1PpBYC}eNz-AUhJ&AJ(8{EHflVDkw5K9nZGH&hY#p|MO&vf8qCk6kyj?lh_x7gh zCoFZBqQSk7&#?H4D>uz?b{-E;by!^s8zeNn$_@h<+J03c!lc7@8s6N@klU^M?p>Vl zXFtB#ab6bjyq`q>xib0)8R}B zz@yS3Eb{z-{YLWTYu|xI@4Yy?Put-K&$?h-@g`7~o@LoHbLg=|pANG+!=LM^iP8G;?DK=B`atEVYVzFll$1jJJVoj`pjI%HsW9xvWg$}} zZs)2yg3tZcvC>@J&xbsNN1@-l4x%lNV2MqD!S0vs(9I>Ra>j*N@`feq8?yTKcJSk+#udn?mZQ%Y~K+ z&;#4jpgfcJ;$=R3yW$U2J?^0W)Uun@g}nJ$d! z)3$1S-aRRyGG~maXPw2Itu`7jeaI}5Bmv$fbLc%(j)Y*ts&?}y#jSWp_=AtcuxjbL zs3l;6V1LR}pK7V;YKQHAB1V40A!?$)s%nDjO&U;$AA<<*Pcmss&k3cWhn@;hU2@JQo^%?$kaxRX z0qDYyK`xwMmvV|Th2ddo43p6K3Vo$HZ?3J}u;K;;hRL^Vei54a)74pfqWg8^*zM>M zi}X03&<-uBX1OdGxju4?1vtl#AqtpcF*qT%@lO1xBxEl`b2FwGoyujjhg4A3zt}+! zMOc*2;xxBYD}W@|^6$+rx+S-P<04t`3NgN!aKjzjoJPXhB5L$by8bADcy1&bHC$9K zmj&Z~csS8(+g4b>AE(ITDCB5QB44twJ&w1+n8?ftI#~`1Pu9*4%hea6&y|LhVZTnu zv=Ws)KPgvPFIqhOF?`*K1$!}WB$QKPt$Mv69FgwazD9?yNcrohnF}?b*O1V`6tYKU zv#nh2hL5z64mI3pm><~QfJR8CVtohm6xWvooY9YJgzb@Lz4n@PW<^I%T#x11gJgM; zP-q@rKA=n(2ZA@E5yKbB6`Ag(uazOvpFFu6xhIUH_BEn){o_N^0_*|G)ECq$o&&l(Nb3 zLK z=(L4y58CD2+CnEpxJp_m-&uT1=ku8Wk`!QI0Sv~hd{zHvIBSKFx>RpxE&x}!@;G~u zzNRuh@_aPieqKM(&wx56LS|EwLat6|&59U})GDe*I8i6zIXfZ=s&Mn_?s)nrVFBF@ z+AQaeLskvWo5AwYF!*tH9*i|18#KBF>=G3xoe`%#pGy3ZmoosTDDXo8D4~8SXT$~@ z_@L-T*9DXRS{t&>uWGZAy2X)cj56w){^EW>Kxsi~f9*4&;pUA((I!BTV3a8zu<0Jm zQ;h2|ni5jeJ&E28{W6cyT5d^(+-bvz)v_F@t`z;49j{euEAc6TYU@ul*tb2QBUtty zQ5Hj-$ii~EP4!n`@Tn=nz*Ay$ctF+;xm{MBwy0hia`rb@2Oib>VHaR3h^^st?!Zpq2n8b}YJt<6J&Wh7_PdWmaP?r$C zr}fAI@U2{hR)Lj_$-J;b*GCRMpZNp~kOk~&FX!htQ@4-aEzG;n=b{Qdp!5?M1!nC1 zsi^*@8*Q1IXk`*|DB+L^7BG|o&H_8!5_8kddNApdKmV5Wy4GcVO(!MZI5AV>a}9&> zahddx`#q+U+Y524oUbszM*FNkCon<>Q9=6zMKhTZGW)0cg^;G*LaXcDV5>gA3D-^{ zsUTC0O`7-e{h->M1^Qf%QC#mmeP~dR4=zti#lZFl^T2l3wM!?94>Di$~L7 z(}#4ELi3t6THyJ)FtA6_fWV2bK|_hUxN*h3F;ETh(H7XR04qz;t;@4zDNrn}7!*sp z-K&>RT=*Zcw3XaV;D5)`H2xJ!)4lo|OIyot&jrQOh!<9;T$i{x-{w38$t5hOe+T({**&&ipE;lx6KMdtV{KJH;(c^nK*{&2 z{Q&71RH2570bZ({p~zK8)z&y?qYglciwJh>zHm%q3_Rr zU$Zr$%o=3=IsCz*_DpAA>4R4Ui1xJ)+|bh<;x@6m=J!jAI^1S|Px>;r48PpIZE$;- zn`LD36pxfK3oS9k*Y8Ar$prNuF;TFXPY={9RdPL@JHNPi!$9gaf_i9KKmlnC0!0{a z;(w*jO#Y_NN_>8S?lxPN%pZFE3rkL*wYrfhp zE6ZV@C`1i}xkVcQhXhXCqA5doC<00E(D0$gBkO(pfg*QkIe<1E_jJ*?2)UakmltuP zNn*mvA49Ku&(k7T8^>Ih2z?9LWL7peU9>av0wrQ|z`AxAwoO7e4?*-Fg6Ka4(SHb{{}4p~A&7oi)1G?{-v5Un`u{mW^x<=h^8dLc z!Sw&OCGjz}k-;@&M`_ddvEPvy-efvhOSlPqwL&Kp{k9l5s3I_pPDNp2V#dv$17STf zIy$;v!BM^VAui^l&1p7eqi5KYPwo}J2!@bP!i5iM?`f@=z<;CnJ)ErT8xVCLlLX>A z4QN@9$qs0+Pb;&3u*>qj$B#ud&4|NHVNZu(L3ZlMk-Cs=jcOdUu493w-R3GoyG%G) zuPG-;3dOMP&pI8>W(9cFuj<_aTbs%=K#8nz$^q;2XZuG zDuXWpLmDwD(RI%`yu&|?y`TD4bH2uHzVE^SgAXyKJ_VOPM*=4gF#wIA*)8*xg;xK z3huwx6aVN8gPbKXM=s4^|JNYa1vH2)U(C=cNo8lPIUfKGVm1D7ZHY~lo*TrQY!d2e zJ8n8WhLzeWfXIT4PLqrG(#zF!?#tcG3Em~p95(eB?vb_egt7^rx^m6aQNOSy;JqD` z=jii3e#_GLu6nUt^lo_b)Bk4>i(O*MLZ9vam0@FX_2NGKx-=5m%hJ z4Ofi0oa4E>T?T6zwe?W3*xeG=Yz3m%u0=s2a#k6#w%idsQ4PM{38JNu?sDriU>65* zy>=5_Z->9pya^}=hfNOKO8y=H-CR2hNFspE3{gY^R20A_Cd5z)OjT93ZtR9zuVJh$ zESF?24*h*p#_!V~Ndeq|!)5>&)RG?SxuI7LI0Au zur7HvVR7nq8UCKK)$d-=MLksO4`+1kU1kW{ziTfX@NG-SHf*v|R>hUe7-yiwSmrg% zVnaw{w_DDOz?#o8pU5mO0oypth%c`G(tMPFG9$5@zC4qZHIt6K~#- z1w^#?mX8q7lX%RmymmrHd2yZ1rs@`kYVUvdj~Z+zcPqRkZ`H>`H_(8hg3K3CC~qrw zaKT)J3J^9an983|23f(M z)v9y8)gUu77!8?%W}rBS5-hFg`pm`+_#sytKSpDwea6tL$qvW;?yE$0 zukOVt3I3YPZYc=YH7yp=(MD1lnX-Z1FkJT|f2kc&;DQBycR?qoigFA7Z&if^G+)d@ zx_a!If_gG$?#^fd6Y+-B+Yo%`1pev3WCY&2plgC#0Kd3`KyrjL-(kZF$+Cu{1$-Y9 z-V*Ae=2F>}Jew-DSh_(HxfnCg)TL^@VGmDW-Ra+kOs&H2-z`BZv`xeAY*Bx(lcB2| z0GjG|d4d{z*Pw>Xo~%&&@_X7onJt-6uy2!{a`4r9gDxnZq!^a&8)(OJnB43+LN8XGUiBJ(%ODp70O}GaUPpgldH3QL`)Ass+ZOpTGz|f%Ct#xu*bh1gJ{2Jyi@o29D7}zZ zIAyWUZ%UL@Fg{5-=??+*nKAJI3*x2$sr|N!va#1L^PIM$bCB?!Tv#cd=c-5w8D&7w z5VD@%tDH=1(^KXL?_b=c?JsUZevG7uYUv2FO*Z|(yh%fjx#FBKTguFQF8D{zOU5_8|7eq24!ESO3<)NcL~`=*{Z zSuW9nm*mB{g}LyJ8Nh7ZY_vY_q`J5g<0|@TEKc`MO~Z^TcPF2}3{;kBfi}G+NY524 z?~{sRf6w{--JnVA&lr9r7F_q>qCv9N(q^$vkaq$5plc*>ZFm7s*V}AVf}`lL`uUYn{-v2uzme&3D(buCTG2OzAx(7IFRht9XJ)uO7F zotM;2ouPV-@owTpfB~EGtWZlodHDUP@HgXy;9)2qWl6x6n6a;<|G{7B4swz~}s60q%!8*yziMU@>sjv4}kU#w9gl zzQ><|%ciXi&B__QBtL-)ZK3s><1eM@0tHg?Ur7$guFw3oNk+M?DB~7^&adHOb+8) z2?<oe3lf5rBiA56?x9*^>U;72|Fl{>+ z`!&Khj942r$f?&*+^6g~=4V;(A=Hk)FhiQro|7(Rm`v&S6mtP%oF;0t#lkWVHo{Nb z+V@Y1j8$WHb49IQ0Y4IR@_=t_n3Tp=HlM9l8TsfIm>5@S>eqX#qAIC=clBP6HkK&y z!Ef4fK8{SD2^NIuqalC5ljuSoAl950RTM7^sU?TGNAbL-s?=~uWc!;qAqCwc=o2=& z5rL6>eeLs;O^bJ;+B45&2HsC&PyvW41}a@sDg{?FC>#r1CbCd2JLfzhnk+yHOf*%1 zd<#f{nRO+wiZexf9^qVOR;A8&8=~OfbTAAb9{cetAR#3(M7Z*$M|*i!G!aQKwFT%S zhzt2v)x<{C1D15KO)||LCWGfz)$`MV{9^Rd;VPrnJME?LjBa_rZbL$l93Y&>T9G%m z;PsoS)q?>=8lOnpU${!(-b&!&A4-N!Xe8^;pAqgI1;h4cgXlju;Uv+U5uf`mbMxs? zGhtTbMod;rX zbRHC$=Q|5MLYv2jwtn`OHjv@sOF@b#V6d4In;U3wlY(s1PqAPx6)Tf(<@upb^9POw ztZfZ8=sf2bDSr|hH(2lrsH=rWKs&P?6ntQqCoUZ{DFHOzLu3X_Vt?L)=WOTC5{W=;Xcph< zHR}RLjU~|~q4mmHWC$hh%sA@t?m7x2gN#>3-j^z=Q6s>W_uvQbBiZ=8*cEc&c*;3* z_k?inVSx0>-h<38^H!jjM<7Sz^8-K0E1&Lqrn}%{$X1~sPwSR@%6qm8JeD2C7g;R* zwN|v)4&+Q#lt!~b1rDg=x7j~wOpRQgoIC(g3$6p6dIfo=dXL~ntmc?;+Y1Cg{ig%; z-$uj27{BK;nJjXtg?`Br|3YYnYpk&~fB_gtRFX}WR-+W1q8W7V zzfR>zseQa%=gSzus}m4~3Dml4-8()`LWE5F-$-AHZ_jSolLis|XlUOJ7`e8|R!!6M zWe&C?(;-`d2-`6D0K9T|VvdfUE&NtJ4|*NTYQ!IGqy7O>!P1M)c9~Mao4XEP{zVfd z6SqwRH-a2w+vE@jjf)wsN%9B>5 zC*gc`qu$h}?5f;v9DcWzo%ad2z2g+(>bRn=4wl+R_qB)O2ejxyb$wN}co8be*B_K~ z<+u65h;zhTw!EkS9~NgssP!?K7GN=-hyk}-d?UD;C{~Q@(>TI$k}vK_S_icg+zNTq z_~2OoS5mq=q~Vi)-F>}i?p>e=JOU3d=4z_RaDG z_^Z4SYwluc9I$M2aOObm@~|WqZTCf&NMnGF5wAgb^G-)$SKT~taXpor4htWm^gr)nt?w_s)lm8+;r{4bLBjX$w4ck3)jQ)mg$zMDCE z3X^?@$NvN7Bf(g+J&OnRAbB?2T07*FxhMhL4?tP{Bb4oY!-zPT z#RMCa-WPG2cg*M|lj>0wkLJ<>JfJKrCZk<<^NcMM@`olJ^2g}qpUyM$4V|`kti{SD z!)N@+zQ+^bW{qT3i2-xJzNYCb&g@!m3s^_*W*4Vrw&$8+MIChISZH-=+2z9?KM3UM zy_7tObAkF?BxBJ2r@yPz`v$tQE#=pv^L8ua*6$=Nppz659)KJFE|&9(>iCICzHec- zRr=66?hl)t;}Z1E2cj;PY@g>P$l2%gKWm~?aB$oN6}eP`E&u+5FDy(GTtMk|+}h?I z)ikN=Y`8&Wl1kXbs#galIA}Nif`%2f&3S8ah<+>-@FqCW6854_n=)is3@!*Na{c7M zxV$#QAH=Xn-ChY?kr`x1c(*GCtsLA<02}JiDFJ>=my$eOe-0asHa_qrTco|d)H6c} zmBvj`S`j3?=XMZplh+qf2}gG8#E^64eT0|w$J{{{LuwX)FRVpHaBKG%96^q7q%yG- z4|aPy?>X3@y_|?LCKK`;ZIJavyyr0{G*%kpUnx6X>`p=XGPwxChaTCj%0-*L3T`wL zp#liXwd|bGda%iLW6L-l@Py5gO`oL1BE93w2Y3dA&tR-XCxzu19xZ^cAv?ofX$O16(9O0T8&A}OF>(IIWAxvdT!j&T zcZ5niLQh5rH)+;g8Yz*CSb2IG(z)i>m5>K+Ijl3h*>%UI%Vkx1M3qI>meQ6*-Ut=b zg7COVhc?cI3VcVsD>=1Xl{Y|Q>He`d zw|Z{@n*2^?fiezA>G^7%@J)Vxv|)KOMv8NlH%_u1r1Yfpo&2KtCD*Dd#wrg&derld zTiLQ|_?J_)PKP+CgFoEq0o(_31)!Uu5%hNH6Y0tpcVwVneWt+@^))yU(j(v=hBG7L zqJ0@z5q~7IufYf3mX3Nr2k@f=y)Rj|RbE;^>wVB(Y>sSD`#EGb^bpQ9IvYN)cr$N3 zZ7%oBuE=JmA>Ybwi#9PvJ-YjL(5&v%{hlSI-9pEJuMSdrC`V&Gdsk_3KF@I5s7yz% z7AQIm07Kr#UPv;4KKNoyiT@})(kw?`WB#S|?2E^Plpamf59Z8px4%pe2GS`t6B>bQ z_VObCouJ630R5ivSwV}|dg27oLC|CjGPW^L(@F_4s3|N< zhyh7=`+EkqlO#&DXZ;==VW{kj= zIb$_5-&j}4+2&x~h{Y4>6Z%JZ$PpX=S8 zU+CkSxsO)Gas8ODz#E20)%wlc`pDEm3FN2S4&GBQ=glAd0e=@-Ad8Q1Vo7-v;z2Tiy$)ih8kr$zN#r^4FbkIOp)lq@ z;AszT@zr~j>%3lq_FY!l?c-)EK>IEae?0WQT(am5NlxKA9r%Fmq>wnxHcC^|`d5x1 zX!~Bpr28&&@117=jatx`0G{$K5O*5cnnzH9ttd+zzdu2iM0XTT=2O7Qw$cQVJL$9r zO37yDGH#^>V)kRO@@fpa{sc3Ak0-p`)x@$?575A}^umJ839`QZ^v0J&6eOi~FzBG< zm2kTMtV#1|aQPhNbW6`7f{XPNyGu=LsLk{krv^>7M!Ti?&wn-!kJ00@`ys2gn*~&q^ zC}OUmuLYF4kqfjeuF|5A<9Dw(%4X>ZL!mS)OXZbzxJS)jFMJCAjzdA5f#`bVkO*`- z0pp`K&sAL;S?ONTh`kd3%;VTwC-(OAYD?p7Lz%FR*WO6l8Q5!MAU0L#{djsE#lSLK zCO|Xb?N)8gS_WNb&AM3*&4F%_b&4DQXuQ%D{}rIY-hpK74Lode-n}z2)&4G=*(hze zIF&523#HgkQ_Jx_$ZvS+bplO3FJ>2OLNp3f=%GIZf{nUywo%FaK5Ar6fTd(sMq@;P zqoq2=v-it4hT@-OzKl2mx7!`|x72+rbiU7@{JXGO>P0F=w-NtTE1K5~XJ&5&`^y-; zWJ;cwekB&hK0?lB4#9XP;xYgIy&Ci4-L^@8-fk-_2kdj#Q!G)+X9EN08&wUXK95(& z!zsHzYa0QAXk-jE!#|CMJENe8Y2b|+D%haFESW|$44rg(ubd%A5xyTr zo!av$_(eGkuj~BWQ%`u+AS80m#=VYNMpp0*&MPC_EM;l z_%10w|6z=XK#b8Wh%usOU*pMB-RRve5uawIl4uY|_W7~itMr3YhqRNC{O*2w_UZ-g zc)gN3piTpGi8Nk?Blp`J(RAjgf(SW#^8=?oJS(!?<<4-Y5`sw$AtE+V*k~n^(3qc} zu^>8)T>_nMHQlHxf+zhTJAg^=KH=eCS6HgaGgZl?gBjF&lNK9dWYfjcKHWHcXSp|CXu* zfdK@VxPXqO+W*iL#!OH$o1h}@0Qw5x72ZA$oNE*3%jD(p18)^+ z;n#<9&)kKmM@EBo!-+3$Rr2ohWxFqxJNLO2lEEyV-0~bVF|CJEYLDj0R5|4f;g^+{ z7hGgfLA@)hg85+rKWb{nZ)u$?3^AXdFDlKcf9j&@x<4y2`kgqm*>n~bTSgZUtPs<{ z2L)cMF1zXinBGKh5UCYOAEyM9b`*4xM*#tt2z`+*Ib20WoqV^@VmKn|Xb-w)E;n!8RElhrGv8LM0(m*GS zHlESZs4!cQGicDb@%f^YH-joVYd1>R!9l@RQY}G;oV`hH@~lXINHnOrcZ~p)+Q#Gr zh}87C)hJl3H>dN5ia9)xR_E*h-B5HD7f(mL*ZVqygwC=N8V&h-4!$BBf=mf%w|`8D zSh7pyT0`tom#_$N7xMY)wSL;cw{$c?G963yg3^RVZqBQGVI)(#u*DzY$MK5?bCmR#vKiVzeUh?Ug?UwWruWG%E zm>NB}$5Ke2bRV4n1XsI*SD2TJG277uL1T2aEGp3u?r^3-D!O}d><#i_4z@}w7|8Of zcGXFIV%sw5;%TL{oDd~bf?gyGp!{-uALXS=4U~5vTv|V{>JoIvAk@4F*Z&pkL$SQ6 ztNi`Gwbs9i{x_c*>sqt1%c2(jRfNiyUKpq^?E|VmjJZu4ajN0Vn%#etfL+T$3vxmG znS|seDNA}u5g`5gF$sg-hx`j!$;=hDF9`kKC@2XkQW0&6D-ucNP9%wI#6vj#Ywps? zM_%h~+(g{R=E3FHUA>61ubzbxpM`X=a=V7%yo9zYsU!|A=BuuPeG@F#11^UEA1@Rc z0QfL?tUtGP6#Kd&TTPSQIv*%d=jJm%gsPnUpyDF;By}Jeqy6VC5u3M5gk(>KUBJmh zU(z7Q-5(-cW2mtX?GDiKF_6yZ$coBMDFQrfzM>h_X z0$K&7fczc)DFHEnN6xoMX-{WTwVA5j|en zpfsvh67lCIxT}s*WCcSt{kr!ITF;fm@>R@!Yo1x7J}MhrXeLhZVc`!fjH2@>S?K~i zG*RWIzLmMudw+3j^GLwNDEe}{Ft|(P^-C&v zyf^0F0KDy>q7%|*?vpaa$|iQzh=NwH#I9}fnLk6V20qrW+)EiP0}co2g#FqYMAUUS zB*ir9pg$gI{GJV^ddW{<8X_Ve^x5|SqQxPP24RopCjoh6vzv}5qospU=xQMCmnKXr z!|X=g^SZ+FJWvX#(ioHi(#rs;E#kC)Q$YTuPM{Rf^u?EkPbu84e^Wq82TS??q=0k~ zC%5JOXE~Qsz7qsWsb4D7TReq_7Wj}~&|EhrPjh<&e6v;Iy0WinDg8tkIWtF2`rtS*zK zhF}VczP4>&xfGFB!yCh~cWZ678ZI!OzS7u_r?+8If+aSPk|q^>>N9dHQJX`cvgsEU zW|tR)W$zzVjxU5!W#jT@p!YuB2!O7LuF`X^-6SGmsjyxv54K-XD~H-~^G@hlyl3l5 z7+L~H*jO!j2q>R6@cgE}L5`70l~Es7Z=1?+)2S4m>O@>8Y3Bub!trN1YxJ~WxqHr% z*t}KqcGpNNt4;z~P(k00s<#AgFWK%RsqTXqP2NInH}s2*1ZD2E%{4`M#DK2#WAk%T zbMdU)Fnxh4oW{e(hw-}Q)SOc0pa$rSd&GtfXy33V@HL;pCWYTSxUwx=sg_98IzbVO zMtKf`sg{LpMl1(Cuk&a1mU8;>o!wE%#~@mutl*z!QJ1>xDh9~WY>z{8I(EP+A+lC{ zPXMm+c2P{b;xDlPCFO*&&jYMuw}{e&$eu_FHdY`us|hiNpLG}5Ge4c@p0)J~H|}Xf zHnlLjirb?U1qQcw?^jMZv{-$^gyNUG0XpWO<3l)k0Hbrzsr7~2)_R1Dz#OeUQd~of z->82C&e)w)lk=_tp*Q?sNMlSB=@ozuzC%2&>v~p36gb($_Lpn}1n!+YTk8mR!|?;K z0#o=_;~l&|_5w6Hu^5(-c0$2E!B^YkHlWP|QGTM+Lh#%HNd*z`__MigGHf+f=eJyGZ{Hik{n3~iLq)x_`BaB*$|TWu6*qh82uBS z0WeuxX1p^R1G8kFPH;5U_DC&K4&2yW{`J`EP@%cHxwOD7Lzik6&;OLa<26;kW7lzR z5Qkg!93HQBE~WAOCc+uPc2J9;ve(O>k1`&m79R^r0|i@$g^C`?ldh$lN)#09|4jqo zu>LQ)&M`W!{!!bp(P-kNjjbkWY_qX#+n7d;lZKPVwr!)aZ8o;~&hwoAIq$p9TJN_# zpJ%U`-`@9iU$=CD5TQjicp3=ppJ||;CDs?l9?D7>6CLjk5Kj&!8Nyen;%$Rubvlrp z90s+>%hxs$of5D21o=R?Rm&lU#u!r!GdN=nYuY>2+YB+e5$*P`Dt}nWslvE%3e1ty zr-(<%Y(}(A^Q^<7J4@>%8N5K_Ihgpss2G+z>>^jIChjei-LDvuA_1=)C&k@VjbP}6 zsXkRl!{x-o)V>3vp!iFJo)){sGTZ8td@Yqn{fK`g{x+b6WYL$c(#m)+(szD;fj-RP zBKgZ^Dv8z3!7_Prau^767UqH+AAnCjAjUZ|l-gf#?Sxw~e!*Lvs@caB-C|~)vVeBj zWI0B!Z1K#LyPEW6+fDB~8w+SJ7n2apI?4pIs6vBHDOGX=+_pu{1Ap<3RjPmGyNBey zCYs%q@&uuFdQDF`YpjQXZ&Ql-iFx)iBYUyzIV-7Ve$ zEz@jabULQ^tVhC7>U>mV>a_aT6>Eu?!EsBuds$rWP8WSwpH>0qoXPu>x3_WFKSffP zl7g=(jLjmwZyWFFI6i@&F zxGXG@YHcad84!mAW`BHF5fp_2V8D4x2Pwi?+5C+>XSVP4syYw!5(GMel$3A?K>UsX z8b~0>+z~(mB=A}2?VkvJo!73{j?}NHq5hd*?HpB>n$OsJFSDOw{F*Z-^)u89bu`2` z)PuY2pZYl6NpN%qFHMMZOUaeUZGdFus~!qfOapiG0?nV*~o)0T%5K>bP#UfK~R_2 zOy4)EgHV5le9K2L8enl{?lcg5^##9&;cyCVB7Ch`#CPHGMAsRCRwD%6VdmSHQT<3j zgy4&K?4WfSGHYMFfacoo#O-H5GvmJ6d%y5#%8~&6xWxVpBz1R9Wu%9YEd1U|Sxjzn znrmQCE#0r&mJuBJ07HUE?eH#`g6zY>3-tRk?B`knmdZQVX`mZQ6qrafdGN?``FIv( zZSY_A1+}&NT>RROIO};n;I5ubIaqIl_xF6H09_DwwiBqXle`b34f^+@iq>98 z`(ZPkgH*+kR}aymVj7z>?Jl}NM%~!hi1z#XD(pRFj3*%fZfrW7)XJYLfveww(0(f5 z=gt)2g=#-08-O~xv3cbh%8kggQ!U>nB`M&XMB^IP>T-r-<~qby;F0P{9F6eb*6o%*TuB)+wrE`H+@CIIf+0ODWysLBk; zsCE(+!!+$=!;8VlWX}C7J>x2wyBY|$`M~=+&wa%O?Meea#kI~5EUA@RgsrM(keT>A z-J+iU`L}(0>ih7C_q(Jf%+3K$?mLoaJ8r2~+ZZbJk*QOVOED(>=XvTiK80=4-@!ta zj`B!U75sjneN&gPBO_7tEARn986?t+EeY#JnAlYgis{9U1$vRd!4<#(f4p$XdC^L1 z&xw=y!eC|XGr&_C338uti3-%#Do$hIa<3D4#XpsdV1)gBuQ8P+?^*S;!^DM^3YwmL zC7|YkXa7_5T(D!+pHAJz``Q;54xLtxB2*}@J1x4L4xRSV!cEE+GV7g)GwsjY_=_Px zz~M6~TRlgH8EEzfjaZb5U8dQ@L@~DeF;fZ;o24P0rqsws9w*raoi2sHuq}|Vf%X;B z`>5VV>SesWs0kHa`v zRy^ugj`}9r)D47I8BhJs=YJCrB}kgYox}2xEVUZ3+?{MNjqF;zar=Y~6Vze_hd~Sd z;DMSD&|N=vD5z)+QvlRDfXxR<1$r33o`n)TZWSP-8bp0Qwa4YHARcs*#4vdhkQgyC-xP<% zcf|t&wnl8!81nmTSD1}4a`u&UBa3d4^*AAx@6WHNN~H=en+l}D&LYMHU9+}HO%E)! z!@|}OyS7LSD;OKuxnndsfE6fSSqPh370JU|GT5%i${N)@b7VqoVO9YjIOFhI3`i-s z(7#wv#c}A>l48&;o@}5AdU!mbovxD3Usu4VRW*3UuWay2{oz(8nQ+EEm4lJs&5t4_ za_DLH`#FewK^^5T2Iv9?Cc+;Dyb*1^ml2~sv(*$oQ@;%(N;|zjz!JP#FVn7Nr-Y|s zD7*7$;l-;`4yhu00J|rOJ1-*xy~79RjXSGVb8Mn?T|QF|u`+FCc^kRfe3}y@J`;df zTSB;b44I2NPzKM3jQ-br2p|SLA3~x|{gIGi2IWQk?K5)VYNH9H(~2zv-U5#Kc9R1* z)D1n$kDT6cCE(|y9!8%Y&IOR>IVs4TITQeMUX#&g>zL0`8h>zKvVF#C*eOxQ=|0y+l*nR$(tX7L- zk9v6j4wBy;@|WGYg?k{zhNKV=a|af$9PGM?NXaOJD%)(DJWtvwANJS3{2X>d2A7(< zO~9pQQl%O^g|9$&rnn8PrAd`^pJsy)W3Q;61l@UG-(h*aUXdsk8u4udfR&8J(WVS_ zTbnWWtlCS5ffyXi;)wTi&Kmr;t23g+v9iyzQ;XO7t||#Y zd*p++Dy2l9#3r#5vZ=i1N4faMFGr*+Cm2j3KH58Z2<7uM%H+?n%`$6JfDMb4DPz2dzxg3X6^M|b|V^4+^T$R@FKe%%Zwx<2>qY8dy! zU!vN*v%b!ioxF>ou4p#I90EO&kEPpXZV%+3L(JybkF7dmD(!K2Rq6rY=#|H&J{q2p#y#P#-D z!DFMW%6ci}5Nws}{)l5)jNOH31f3GDmt4sJO&^l`vOJ&fX3ISHNcOs5iFRhCg$kt{ z!8FB$G=W=9kY8^;mDPe+g>Ks0x}{iM^o^z%eN2fdcey^$Te&o!7YAlGF`GbzGPRO$ z7QZYZI=sQ3&qUp1E+W8B%T^$wdc(eR7 zwuZ0PVORS{jaN$%hAVGL8+NdX^KIb7oD{9^7pg5a0qkMX@2g`Hh`QRh7li z_+ux*KN>G&CJugyc5QX9Skm0;8H?|{hj7wyN+*i7Tt$p&|V=HOz*7g$aY`r5y%`LZ(S?sM~)w+}Fe2oyK&t5gK*2 zOKqX0S>yK-%++8hOJK%a5Engre+mX-C$m>rJhX&ro|G}k7X~CugD$}A`fn@`sJpE! z&CFUd#wlUlr$O>YzAa07&m=ew7Ehn0<+_<_9JFRD42@feNJ-hu zZle@2$M&eDg^uOMHsZx=+r;X>S7do3v7c7-baM2Bi_Ei0)l?*med)O>&LDBvx#4ld zU87#t?2_{cEH&j~4k!!fXwSqf8U*7KNow`_qP~|gS~kEwwGa{70paQxF~3HC|I5l= zLMELaMJ{4iqkEl5+wy8ycm+0uQ2@i&NuXTZ9auy7_9a(C-(#GLzE$g3iunA@ub6lz z6IZz?gi|vZbcQwVe>d|wq6}7BE?-ZM zS2Vb!l7Ry(g5Ql?EmB#lp}HMx0}v$|e~42Mc{Q+{sO@}A19$$WrVqex77v5$L^nFaOWlzr z@yx?C9g-(Ku~S(NjydwzF61HWS1+q-;?Imc=|SM%aU9@GApSaSRd!Jd?%UspcS63u zIS()Z-F($s`2PC!mGIQs2xq))U3AU9{y+@sxLmFTIg8W*aUz^ECtjs4J4D5O7x|6$ z7{8UTrM|^_&#IbHyK$eE+r?xs@A?Fi^NZ4EL#2=0yg7?s^6(6VTc|1Nb8)n!gdR;( z2&ZL+BD8?w_>5|Ox!LTyR%PmUmXEBfInu(#P53ExXd}C?#{o_P=uwM_^g<5%ULpFQ zi(ef1gXCF$jV$>b^YO(0%J*TT!7M7Ew@lo_AA!oGl@jKI3^Fm3gGc&wKstOS;Qwzv zsuqx}5pc;}%&GXFVHGp`SGXkVCo~g&OW=P3QgBMDlwl2;-=m$lkw?|}x_QYdv0iGj zg+|Vl=<6-1xh)fIClmE2!4oYj_gs8aj27i1vK?SBUwKF36K$nwLeLqM^7CP=Y4D50 z57|y1x7=ZW^Kb@>rU#_b8oZyW_^>tR4zbb1wpcf@V~W6UzLGHvSG1e=cN>(9B6<*1;!l6{rSAB1KUr7Jc~Qp5)G zLI|F$J2k^Xq3@ht_(f>HOq2mU0~zJ0x_0{rf)uXM)O>_s3oS7Lo}`6ugu|wkv#Xy9J-qzs zzbT+|Cc_@~fn+HFB-p-&-ivO!eKQEY7-$$X52TU#{v{wk3V;x#38<3-U=7RRQab$& z#7GHP1-DBOsQ}HWHbXgh&>SP{_KC7bHlPVAz$NGt4mJwNO$*=*x!c4~18{_dqy<&d z0$3o2L7TJy2grdYMLGaB6k#renht}NX7{0STuubb00+w1-On69`en(^ZIC|$paW77 z#K#B_gk%Q!G6IZ&PhWU`lkb{5z>{cPwOU_sdgGEr8s++9BM#mC`r3g1Ty!H8L&iG2;g2jir zxxzO;!n%Vr68D2(LP!labqXz zdWCCR8T}~34%E;EP8SLbJP|XqrC6jm8X+4%FGSZn@Q_4zIP=af!=$>K4JKk2-`0mu%=&LI0Em1ngvy3Ql{G4>Bh{z6SuMpw#Oz1K|p*c&9{5!1;CTi*s#rs8-k- zv!ajwnWFc`wga1ph(W2=oHM6f78*RkB>ATK8FY$C!)qAlk1>@Jn3`I7P(JvyrThNj zqxGXP5m<1scP?u|?oTKFFwx&mX@&Zxvj!r)7PN4^@}vEg{=-m4uaAunf>o}h4GFOR zw+)@HvJPj!TzfdHO#OP@in6B%4^Uw?FQZZ>%^M(GnuPMjEQiMEaoPmXxf`CM^P=HV-#Sw8PoF88>;=`!EAPcpzb zeel^tqyg&=*D3QWZ58IZsB(A-rQnJFr6wiFj|3YJ_+31_6{9CxCfQox?$1NMsrWG& zE>Fq^KH%1o+8=@4Ddr65poG^+8lV^m;a zNA!)D`vqeEs)xC(YC$B)u_&~PrwiQJRKZQ9skAA`sL4|$^_0k>K+at884AF>uU==; zl66Hi_wk!fYHw&a%W_@vc=c5&w@8~uHogngY`SuopMfPS{|Z=df_0tI%ezxc#{~X> z^=-{^$~j*jLmBo-t`;oanQ>nqfM723STP0*6>Sj%yWB`0nm`M?*w!$k#|Bj(u{~@P zWad)dkEPeg4~O>&kf9j>52m!1unOdB1_%O*5IQTKN+%q~e!M?Oa(-Ylh06xS~0(-JZrOEA9wjqiy=n%Ij;sQ;Hi-QZsryh%5S z5?riJWIs)@H9tee7nB!qurTUw`w{#&wy-qzIa1ubEvwlkc#h-oCHdG^r0?fxIDMs+ zTWV&S!<82Q52K;6I^!;I%*psVC2hmd^N$^NbAnOGX>AWP<{M2Of0V>pbjWo;CVC?i|hLX1CiBO=j943rDF zBYwyq3_cyFzwY}KyRAmb@>XE)qdHZLjen2RM$rG}UFBpSBH{E<9ULnGR z-l@T9bcK|NDL)nd*>sFMB$Lu54q}f(ExQ=m>7laWR8ll1-$fh^l8+T&=j*Qc+g|qKPmr zR+}uCSB@73XMDllohD}!oQLVUqqTe}(1wyFY^9ybW2Lz{QL^kve79#RP)wy-#Z+Ak zQ<2$6A)Wr^su&E9{!EUsa=koGUoTocI3!=a|gj8jB@4|2xR6 zcFd@2VS-3cO6B|i1ewX-0Cfm%%R%~*CK*POhn%lYm6-BP%2r>37itir62?f;1}TOZV& zP*2)0dZ?+qov;TM4y00$tWl9g*YTHW5)E^cF~m` z>;fD#t3R2(RaoOI1m1tY*E1s3sYM@L)x~Z7(iEyPtgjE{y-0b`w8s850*bgm*wtKc za1!mb3x|6Ql~d$fzQVua^O8~ijb_lAJth^=b|%mH76}VPb3IVDb>_$)ORDFP(@pa? z*SRb-h{ORCz<}QLkg|iyyGeL?9>Tfz$2d5{BAWd`pGfMu+r~dK=@iaM6yjfx`3izH z$j|{CP7->91Z$D-1t$rfMAajlc`e=@v_BYh!Zwb2`*+}CP zj_P=@?1Pm&l~IGsO|`zFjL5|T=6hckLxn16&liIl_+a54(x`m%N}UFS+BhAfWlKCv zHiFV$Ij4MFa>yH=lGxyBQTWS9Lhh3boy<6ZD~C5(d?B&nkHq{ZLO(T&SWRpOMoZI` zv7uW(9A_Drp&SOMp}jo`se4vJd}5b%G#y+xZZ6Jxh+J z%7cXq;GZ>bNEszj>$Y0UiCnNsye+Kb$+qJklQ?GjQq1k*p5_8GB!j-gU1Xn5#$tVn zgU0O62`8hq^*8If@Q{2FLh7-vg~BQa@;dBwL9KP=C4^6g)xqU&PNz5He-f9>d|jpg zSmrv(Gg`@@Tgl7hNXHmerdvOcBZZL{=a`4aekAnkRMhxc062uKjHikZFB(o$|U)$oEpRsM0cK(|IcbtUoR%47R zef91_UE(JCaXhmg80(cN9RwCp=Ug@CwVlIOu3?dhBs=iNWY`z<$+fxA6al&VS1J8S zRwqevi3f3Po3@~sc5Due?d8%5!ypHJ_WCuoZ)D{NXrQ@vY)YUNd6C%k?fPDgIY(ZF zdHug3W~b9vf`qpj@tBKr-1W@LSY5FH+ZzaUfxM>0e4R%BcyIbPnFf(b3hlY!ed*io zeK8L=!@CtpgJ`D-_J3FYm;YPrjXwP5;PTprb{Z!R4*Irn1HJtl<82o5CLpRt(yzBt zeWtDK0eE3}%^yF@zQ^b#EJZq97CAW=dxPbLUB<*#6r1yIX~r!=DadT> z33Pi1KOLpw#Sy-R?L8uTOXm+_^Q4c37RGB*hD;xNYnjL^J5Ax39{L;nsT_a_wNwEn z9&aH0(~&RTIlDJM1aP-PTOb?`pk5DA9ldTIg=Z~8o>*5Ys(z|{!CdFlMkasJWOCNX zRtFdkbW{o2JKyxwrX#O4_xm5};u5IuF3n#ol0&OQZa-bGH;QBQdMw&+m!As~TVEqK zc4RMhK>58w+cKdDSyW74>TlM1>P;Na9^NquA_P0?2aF+XzvvP*Ujuqy11R>dQj{_w zC}6gee~^jI!dx|aCFl(u7SNj5ditW1g^aP|3fY)?;c*G7`b=E3eLFP_GTKI^713lx zS&zI}L>Js#?huz>+dhK>p1KXDqiytoBD$~%*k2$NS}tH&BSp0o_*y<**3XJCL>}q3 zxtt#!e6ha#Wlj1#p}=Y@fRGi5-2iVNMrH-k8wy(L0t-^mLC;;-GCaWApqeblzF((4 z%A_HYFO)dboUPD#d5o17t1nf~k?!VZj_xVL_W$*&gX4a$N~dKJTmI5|^cnP<5t|NJ zSeDbcbw8dRl%w*q_?C7s2hh0>A|?-+8=Y-uG3$h{=ctEONEx<~#*F4|@Le-hHw*zQ zNPJs;M;LikXvcHczghw~nS8Ey0!ZI%#<543>A(|z7N>ZclN1-7qxW6IZL5dKUyRrEss6mM%9EWV!(8Sa~)U5ad-u*h@-<$&^cN zSGfi9UcR8EGG#voA-#s|HwOKugob|=;Y|+PF!7BHP>=NI|0u#oz>4q}`IgmizuY>Y z-+qNdjl4ofsJ{+cJX2cUa1a~24~T3TlaAf&4)I&8%A+LJmtXX{34zi!ikoKK%S6WB zOH-n+VE2t`EKbL;KM3x(S~yP~=Dzv&gXte2GEdB}%--v8`^+{p>J$)!IzDQJdcZtu z)Z@4jyjfa(XL5~yWZ<-58F*&jLLD>)eXRs&XBm?c7*TaEy_aaRub|`=p$wH~t1zJW z7`bmJ_gV9pces=*3pzIqDia~KTm>muVfqk4p{rO8-Qx42{dY&U=+e?*CZEjE0O67z z(k%fr6@8g_fLj~_X-~fe_o%S+lA;3d#IM-$Qx(^KafNS^nP7;{8D^&i$gn&kb?I)9 z)-MhTs&)gQ!jyOtu!4Hr0J@+ZbsS6(vpWD6v+f}TNKqFEbs`6Y4l5chOqvXeo5W&4 z5Ao8hb~$v8R0a8Pz(nGMrY6DOi34`C1D-}(PUK2r#Pb?ek^@UzB=fF z!Lf}eQozy^4qmLT6vNc=7En z=Pc@pqm&xPE|q-Ko3_OMFSL`se+!^cRXt3?;65|tKRUj@jF;18*UX{Si!I}@va%8W z*77k|S7+*S-*;=Vdsh86nXq?Cy~BTnc?@ua!&N3(B-H04cB$R;#I_(xt>N2c>zx&e z$(-|UNc*?vUfx2x&sYxRrFLrzG0@gkz_Y>%7Noi+wS?a0o8C^JBz(TpQ@1 zj>Fon%In1C@fOp?o&gLVSqqFE!ua0$cL*dNK;CY(6=zV*Q~iRcv5A>%nZe~@@i-NX z@2HhuwN?P>jI6S&+IDTnsn38mqnh!-t|K!*dcz9;Dn(sc!!MwW#qW{2J0e7^B%5>R z>-+e@I7c5Ug}Q#to#n*06?N$h+wf~1i7CZGX^#?i{0e^l((5;OO5t=AEhOcP0^@?7 zJ3&o)pLFmRu@5=AbF9y-(8r0Ls)_@YTgDT5wjG)nfm>C!(uZ6#eOFtLL(H-1d0HN| zD{h09sHYfTi4jmIZg#e1lfKo3K6WUT2;77(`gZ5Vd*5ynqr)f5KU{J3G@k5O#H_E& z-0SN#7ag@4EfR2%ohMDB$y|>SKTt2J?pt+p^EdO1@KGw4jgl44*uCq_y*v==h{rJ1 zoG{g_wO;3Ov$|wF!H8WDI6zPatsT6ovV@Y$Qs|Ami%2`=~Ot5q| z!*G^MkhqfX2W{oGljR7_a)T;3vli-Aw=*YOoK(1nyKvC{9VMwP2)fPcza(_k%0^h*)YqIak^m? zCOP0NEnOZG6@hD^H)SCGl|&POPb*)8+=4h&h0x{3q8@Y9l$ zj@0X#RB*DSp1VT-6iokJ?t}cczhIqLa#RJRxJW0s#P$%dOLrl9@0}>XA=UaT0t_$K znTg5My|f=un(}I@yZ4+JR!x*IA5c?uI?;A6=XDfZnt_csS1`Sly|8FZwRE(!e+p!> z9<#HmNY$2he{9^Rl>l%)L`(c-*5xC-jr*D@&xpZI&vEppV$pJ5=~KmY{w_^f{@@M} zinjWyFlVS%OH0}{=fbO*Kb32j<`un0lw1IQG2k`6uQmJkjomtB=u8v-(DYJQE+t~@ zBa|K0CQc)BK+5USuyPd}Ot-rsi|u#F$dUUun@{&q7!P@uK4W#0qu;GbZ!4s({A=cd zLtSI7Vx&Mpk?ioUgm_~!z-2VRY5?pj#NTsVB@-a$PaciywK zRyjRvLMt>cI0P6ZS|<%o+8FOKUHeZNoJE|In}E@qv6Ns`WX+Wo!`XRT9TsYy_pG$} zrd$o?C^Wyn=OGjYD@|uVvaPOpd1SwJ?k|vXy!vr&YH@Xy?sF=3)hD9xIA;C^Rw~L@ zF~BTL(bxt~Mh7dLt8ZjjmAZBn;Vc)Fixo9A_B#ih&qRc~r|O^t8X3Ov+Q4KgRjo?l zNhX;cWyXlOEj7s}FEH^0Lz}q^l^35wv{w)jG4cSp1FeuMSknEtm-5zQW=shOV&PCG zpq`N{>B5cBE$_{3X9ihVb~|!`j0q*AXCJkR^KQfSFTc2XO())sz%WWx|59Q7yuTXJ zTf9=)jeMvxK@}ZV{qevU*?w(~#HvbKj|7gSZ|A4oNu2fRQrYsd;L_dP+%%>IQxJ|) z9#s6~JdAP$`a^suuhg+`xng!|ekXOd0(63b=TFCC*Kq4_Hdtqb=Oi(p9-=qn^m`XV zT0sj`HVl7D5cNk7UU6{0qT9n_T4ATWJQNkRb8Um+DWm&t!og@u>}T>nVa%B*v(1lx?8eu61Ap~3 z*5{ZDcmq^z-5WFIn46_^%(RJF2#%!XjTG;) zZwm_MM|tw|2h8{_ODcC7O+5$9ztF!8N5q3sJsHc}GN7>XQk*fBHJoPM>hK7K zm6l_w^TD}7^|#WhHKp&&)6J>O7RhYKNaTx{@x+6yBimWlX2;#dC44J>h-yaUW4XB6 z7z24@n9rP%8jv8F87VG+;j|Z5#;c+`=&HW~TL=!x-FQf-UuFr<5>GJ&a+5(51%{zt znl!KDh{O9)0l1s>2h6(=53^GjTq#?Nf_WDzI9t&o-)He8;pwEQsgMzCo{$)A>ew7k{J+b9xOtsWV#^2mvehIrnx^cY6(Wi!b@MH7OnI0nN z^~#W_oc+Vy6uqtSl=ZaQ)0DM(*A$V?Fv!|G@++<#twGEV@8SY2 z_^ztTGuz=#I?awcY^y6>nmG%eHjKP^5-T0lrJ5=ZGe$+yf2AK>1TV-36KbE$53STC z+|`3x_X!O7vt1hc-c!JvnfzCqLB+Y@r00D(bg6@=Z!r?Xj3dORknF;kXYbz|$J?q{ z3lQaP3(q^(cgk*(1+X7N5jcm485V(LP-rKd1Ad_q1Di6#IA6DP^j zL(uB`sWCLmzUNb2UR)+F1?UIxIEoT}AJ6!8Of{|*T4|ZwYwsn@0XLCA>8}&Mq=CGp zFkC~<-)yScV*v14Q^&D|?xX|P5V%99*@nm+FrjN03!I`l6=0iSLmu~Cpc(XFcAsbP z?7729OvHCPVG2rrtQ&oHSGNPgG#-)kU%1?2vd3q~!9-J7QUIZ%_e|zq2Y;_Lpj`Lg zc%zM14lO>tlyafvH$@Si#9fG^dHJ*}+TDEjY#esXNNqozbx; z`*OK{>2@t%&9!E#Wx|P|JaCJjhS%K6bvwSY3l6O6ERC3f9`_K8n#uqsOB#Bghkt2Q zsl%-+G3pV)trgO=gQ2P0p=Te{-JPw%k$};uayv)O`Vg17!?=mXiWyAkGV!HMV^;> zz8LCGQ`kwZW{l^srvkfe^B6FvBUFkji55QdTQP=!DIAr=>{O9~h?2BktFi?7fFyrD z6`@CmvTF+!KJk?x+7vK_^JxKvr-F1Cl-!6{r0z_;w#;+BL`YK7WvbUf?=JBN7*XMh zrt&NmD}GnIoLgB21#_jP>KT#rJ$oqs-`YQBudxl#%bFvFjn+4gGKI4&*AJgl z*+N{j*0PJ+-VE<^7gjtVEw@}ce81h2AtTJfH@X(`UkGQce*Br6?y2T`tS{G6`O+dx zVTQUNQZFr+w{VfO3}VzLtV}aqWB5sa2g@MM{h+A8*AUm0H`sJ z*)zx1YJ;$-o~S~`a<2tRhalbf*8ijZNUM{dvkkkp=1i#1)geiqX@rhA6=I_q0`pfs zTDMgt#9)*ZOXp);KYUcNL~=i$h$c3Ldl%;FIsq1CfbW$e&7@T(_GELGHi?}n+<5;{ zCL+*)$usy5bW~$-C3|sz@P%+~QHTU~O!WyL-3c@i38g0r$Vg_(TRP=%!*+E&#>R_E z>X%phpJLZfB5gLZ_4LJaD7SgmNMs95!K*7I#eq~7Ik{osM?c%-zp6rWgbvTN_b2j{ zWE_^?Q>V^_x-PPit5(Cp>ikL@tywUyULph5O#Q0_V2JM@`9}%RN3Iw*bwbY{l{b(t zdySiR_NCh50Z!$Qi#t2&Z5CJwfIK6DvGNtpPVF8P!-1;*j}n09TQ^tU6c zL@o7VpbsKzVBr2sK zmpJm5XNc8lj0gH#7tr~3J=G1ZOU7;NYp45=g9o*sMj7I#Kj=G^f5ZG_%ka?fh{EW< z-(4u#`&BAtHmKKKDcbuqpVoFj%XeCpdv{Mv&)JPcIl=EBD=g{!YKhIhST@QHeY`7L z^|9Fsuj<6uaJv8P0(^%CD*@^m9wucfeZF1$Lw+z63G;a3>TXAYUR$ zZkiK;G!fcFYA)GrmK4=@Wt{>hnLA|BZhd00D_C?QTi+YXH zD}(2%TH?L|9@#Bd}y)yO0xXYqHYEFND}? zQT+1u9w}9W#`7OG)qGg`-B(+#Or`6WfCKY{df8ZW=Vu*qhwGFB|P)9qS6nX`t2u$!W8+4@xY*+@gUZUvh zd}{lAl?v*vtJwJPemxkG{X3sA&BsR!gGyz|A{_K&#F2u?d!je=qa$|qUEZ@6`zRWH zMm%}lEpQex+6=OlCtOlvZnA)Phw@*=fxmG=)h%BGIaqOE7GsQ)L|^FP7e>cLkO?H- zrtm#@*CWwjHWS5~O!o2JoCZ4%&fngNRlk$+B}ZmFUHV(rQ4N3{2QQv62GWxr0`@}N zxA;p#WCmu6lZTIJ{dImZ?kfGU7tXHmiVL~ByfLf24#Jv99v<~=0>=w3ThvgU~UAM)`nNd*Pk7C;W5m%qha%swM`CUrq1tl4h{F}Qo?w~?rypaU)uADqQJ_$B7 zs7fyA)g`YNJR0Ut?!G4UBa6!k@hZ~wb&Wkw0{!J&oTmb6pNty@6Mn%@=sD z?)7NA=8D7}krO#qBk~S|IpaA}uAj;qy*PBdAp7{IIakTzOyvpsE{Rn9fRaMj{P`}( zed9ckAg&h<&0T&*beAQ$1}Aufu-*iDtx432wUBT^&s7m3EkMyQ?>d{W{6BI~=Xp>J_aJ~3Gp>clE}IMW7;<`lS=^k? zBIuTPx`qYv;ASlx)fh!Z2kCSw_{wdrj!V-dgLf~e4 z={ZYFoQQpn_L7}q6k$9mjg7d&?ZIGQu#c%kVxZRy7aAk;^E&(SQfv!BP8egH9ur#g zJK-J~YcdxUN9o|21v}}z8yuyU;sx?RWyJkZ3yfh_us%?rL-Fw9v)j1k*luwpqOV&764(e=_~w8&Qt;F)^xf6Ml^IXk|#=KMA>PKL9vuwgI8h;5zpYc5D6b z@sn87wU;Xvoz;H4A0c&W6d(6JY;1QjVH);A%qp05DJkn{mNUWPFyws|PhTPl4Bh8~ z^nWuQp}hl1D-u1}blAxJsdHFlwHO6g6<}Io7gY1P;(j4fQX{>+#r+n;Wq$iX)bzt% z6_*_tadPLR7}@Fk>2#vr%FAFV1O|i&x7|Ww_L#-;mQZ9s<>BvPO>V|odgE5;CX<8$ zg?h*0HIdeoFH?wH#ZX(z*h|50}C(s^cQ*kJ(BIIpMR$9nSP- zAz68%Nr*_f0k1y~97D6%Em@SHz*tNlk=!n%`FEZz5}kzY5CrKl)!vG|!Gdts8(!LU z!VU2-&Cay!JDm%r5~huv6C*HQ9agtZl9GWZE)&$e){-mbCAcz3o> z2u%Th&r2UNTDW=VzL!r#oUgor)0orYml__%w>!>r>+*^4drWnU%_;5ji9GSif4n22k+OXXHr5u_d^vA+@&Rr@QQn2eot{;(%yil=gB#tgS4 z{0bP3jBKJ`gqWoIkPvhO`i#k;t`5K>=mdJ1lfiezwGY`kjw;od-CdOPQjIj=%n$nS zE{n3MB-(&tl~XiyBr|suVuO5!TE2jG*9A9zXYypwK=jpO;?b=c@H-V<2%4KN z@_K}7CbCmUnP_N+Th$f3uzOg0%LunSXz#Y^=kW5a&*n4Mo;;&X`MXJ`2@)+Ew*t@M z11%D-&dD@FN4Y;;az&)W4DhJjS-On!7k3P2H0qyq`cxG2oF8JyPpMfQx#f|oxRzC_WuhyW-S5I%GY=f2m&CuWDE)~{IZ?A15PM&@i zX{SPo+*`c5%Np4BjX7bgYDZm^Fb}v|cZ^8V`P(8=`M0@eF?wdb&OIOD|*?##q!cC{P!k{=)tkosQmyp@Fq8sATT+UeZdwAL1 zKJ)%K-X^W=&_^-g)kGF9Ts1?;j!L_9ovL);ebc)dVEmyYVm zDPo5`mDdU19VdFu_-mbTjPXYL&aoBI06X@O;v>_*DykA&lJ6(VAYterp z>s%OC&5nXq7xK9%;4XOcEAl#N(w!g4O{r$aZEUuvKTYw@Ua^suhFxtlp3QhC z?B$Y_Sn`Q$*(g%jJ$_*&F{NHO^o%tUmO~8b!XI*;C3G~oXkGe3ZO-SqGw2+Bg#|}W z`C)bPv%@zG1+FY^m-$oVpB!=?qw|C0$!KdjMMpu}Qt=KaUIAsy7$Og#OrQQ|1=bfS zNWP{9K^!J?>aLggT}Z@AbZI0yril7LF=|dgypt(B9o_w_n}qOdhLW zS!+GRPG2fajRKZa3(3kSy?Snn+kW6LlSD}$?Fwmv2|S#uZ#HqRdpwr-Yi0v=t94rl zHuppu;(P&z8#t{H^Xyf?*|!`-$kHkrp?PfCV_cS2ZPQ{3Io9Bujt!Q2Qp%S<=tMsk zSe38~Q7cT()mByqQGmym`!W1CNzRn4>~1_e_s^8If^Ljz8lMQP3!{U!LWN8ZPWEzEzTQctWW z5Sp0}=FH~o{J}yk|D`v-Y4i@2xwY!M%7Rg=JB6^5U(asD${C|M)CD<$rKI6GyosbC zze5kn*pNY1$2_gTu!!at#@y|eZc#x7FspUsOdC4?%f+Hv#klg-E#hKAzX-dL8QEef z^hbY}#St66R4a2*RQ8GUuw^sz@?6=lL*>xBd?&ka{&D}=FuKjxtk;sPWTEay}!V z^l0G>z`mCBtzk1-N&ccF3iR-a8%A*?lG%n{J8NA>t9gCSj$y^Yx)%A{TCk&5fmeF6 zQX?Gl@2PvB-_X?bKhuuKba@Sco@WcPe|hH7*guI|y#flPi-0@DJLRU7HSWEbxMwJ| z&qZf`*ZX^b^v9>j;=h>T?0CTgYK+-+ma9f)o%L69S+J-;Slv&De6+sP9sO6sZtEBh z+b+qytm_GXx@XtodjDjsplY0B^Is2Xg>0=%0+~t1o4>NHO6YQ@GU|CO6lVKg^Xi+i zPF8QfqICvpcFn}h@of4_vR74BSx_5{igkALbpByE#~NcHXG5{R^b=3_sbK2%P&#{1 zn@%=;fx1~#J!-To@2KksescMx9n0qSZhT(nMZ@R?)?;t>oK5E)yjTxE5wDYgaQaW< zf&8*O*zNxk&Ff&GdBjvQh^G^mvI^affy{Tf&gwY8e*f#Y0B@QR_IJy23Ez+HcVUcL zF7WE%_{_5-I$tCG4PUq}At2=45xB{QHAP&_`1MsXS>SH=99mGN!7_>}t(AWQ8xC=2 zDECO*&QH7!n=_XB-X~LL067U!FBRx(omTMp;g=EAm`H`2aa)0_@~Rnjq$hO~LxnTu z@cv!b%m5&FCHjR%3nP&64l-sN@`sV^I>_-*VAEi@dO{sL&5F_>Q2n}SR;E3O6-8Ti zN(TI?v>_hYSYLpI3dyxz_-BeYAxu7mQs(NN(`44**nSfXGy^)O#E=tkfv8?GC#rMA zs=dqILO%7Z^%~PDf$7uG(q)5C5d6vAVld&_Z~-ZAL`Fu-UT?Q(x5x_3bPGr2fn_CR znqZ(A<%QcDk&R)k9DEx7Q!N;P;(pcp6Qd{!UT{!itLs}uc^7~PeW1RoX{O&YKjINA+qMb)KYYDocO-1P zwHq59r(@gf*d5zWI<}39ZKLCK?4)Dcwr$(lb>Hh*Ypn6^ckeG}{ev1+$92p(?bSfn z;Ic9HE#u0Cs-Rk43&s|_ItdXLPw5gU-U&u^T5LQ(9K@5khOw0|G(Sv|Orpld(%!He z3Q8da%IVx`jJ%x@XSds=1MT|GqsQ0D5ZBW?TFiT3@>7yZGC`usj7J{l03hD-@M?uI z%iTSXa<#dk_)K1(Bo?~EWxS=`^i*yGo8J&VDNN!IqY>idn{1FF8uGwJ{ENz4>Scno z_bW5pXXySFoOQ;3PIOK1+9p|4wSw%Vk5s(*ff^hK+_O~YF8UWL62#AarU)jzyOI@5 zRbgy!ODM4Ws9^}ADry4?RF@WqkNHRCPEImU{NRRHWFod)%v@ped8$Z%Tu3Gho}N%o z9fAA=upRlGVvAZNf5KI<>-kmmbtTn1edQ(;cntVy^nMSw&LVvlRk{0X%$k; zm_X-MGOvKv_NMYEEZ-Z%mlbM5$6WKxxl9E8K zt2==%baAM~ZbJ9@l@%^Fs%rB5$T^@CMY&whietG$Np!Jfm0-29XfrWZr?J|0_IDx zimkE&E^gstkjPvTE}e;7JlE`@0vQVoqzDel)GKLQk#v=7+J1*}MYf^H;LM3zE-!0C zg=ac)>SO$OalOiUPE`W#790FB}Aa{5>4gpz8 z1r7HPT^xd#w>lLE3^N{;Rf06IqsnmlKOI$>6I` zac2Nu|H}8$WhsRN^|~AE;5O9UdQ%Ay8MsbS{5`_MvbKp}zn<k`J{slRAFu)!$H>WoxMnN$E& zxfE(uCPGX2tz$-T51L-TeTY2W6mxc+@^`%q$=6LKJeg9o9EzuX(XAwBp~bd&~ws@*gY)h8L5EG7J>Q3U{eIm)R4EU2af%hbXpQ%w952T2u~2>GapSu?+_CLey$GVv>a8>)>S3& z=_K$VhDWL&XWAZq&jDhxlk1WM_3s3zz!3h|Bl(~x$mjG1V#vvUMX58O*kxmO)Pn+X z|Mh$tp3+u$(cwd8-uco}D&OK$h4+!&l&uYCpd)HdatF%NA4dhdRPwv3eHbpluz0a& ziM)g=X*%kccPS`dKXw~NZ&@wriU&jnk8y^OZ|{T`9gQ+iN{@8lUYfhQ>_!x7k(q46 z@{2R`i&Ey(3dp=8S{BpzoPy#H9%`h?lvXC)n-Oe&G;;+cMaZ=@qqO4!0OU;*T%V*km-Aw_iu|iG58aK8R26z?ZB&I9kC} zcWk^+NX{HU;*-27GDO}Y-%a9}U(-yZhfOU)8cZ>;hW+PowblNKZ(Bu{Sp)YDVcSvb zg~7*GGtlrigbcyZTT}P8SrP#8l|Q=Ohm4Cb#$EO`c=Nx2ZX{g(1Y}t2Gc76i+GKb8 zESb8kYdL~PCJr&)!ccqN8{IE}eJE%5n08H~y*{LS?6HG$wkA?rEfwc#~ipP{-Tc7T1WF03jBvgYc93Dqep;KSbJD*B*@I?08=$A+GdKLkPBrt!g&evwR+I z1^2|WYxRE{^Pn~*C07v86|i8X8ebIb? zoEh}b`8`7RARh0}LL-|1vfgwwfrkKzA&pG0o_Gi&^Nq{U04+zV2?}pp(?13`<0>)Y%CG~{sngEiZimg?yg@p zB%jp0V*u!6k`i>GKhGRfw|cRU-G2mYbp*S;ckh6OYA5$OteUg| zpRp)_&sa4f9%`Z!76Y@d@mxofiI6#+0tNYhK#o}%k4!-%^)^r>W;mcoV2JZjFGF{H zf0Wm+a}4lVzp!n6g%Fz^-VQAdbI58wRR#Cg1Ot@OI|L2G&FXt1qfUd6K=&djEJRvY zg-Mk!AWX*?4QNVQD@Q9T!;#tE$5Sp|K;XZ5`n!(V1R`1X8Xun@7Z{Y}Ayx@z7>9U5~^> z_87oAkHS8O3mbuJkxIQ zQ{6gEvxrfIAv-s75G`f>EprJp&)SH;9suL<@2A-6+jUZkU^(cV$dBPB#M>>@7@!p} zA)2%n{CmM0W@46WmrjJW!}OME*>#3?I65!i^$9?HBTwzKHTs?uqZ?srE*$mV!}{=# zBFHCY)e=RLC?AMD3%Lbn^m|sw(568pX5Zw5L>JBYiSp_mZnoz_&bUb(vYSRb z^atBNtii5t)<(&-q{Nq_KQpt{x)E?jmH5&qp(o?qz*J;?iZ3eWR-;s3kT=q7JDKro zIJ&S>k5V2b78kEt$hx3>c2XX0t8~ooW7{II(?&S=<^;I>!AK+h|7L*p-;L?rx$${-)Ynym~I^r_<$X0Ed(r%yRKwXS0VF zXy#RTb|bOfNVw>cm%GzTi)-JzM9znH=fRV1nG<^SD1V5Fgb2U+NC53MBdZMigT2!i z3fm?{^y}T36igGVM~-hWKzm)+E%qtjVQFJM#Sl=%;+RM<7t;QQqnshwb$~xqHdK`B%Y=3$coOO-Uox8!DC2q7%+w!`BD?CbJobOwk@k3_A7y92WwCjVGH) zbmRK|7PJ>Y=7Yjjf8svjD75e7l6-39yJUM3)qE>#J5$AqpWX~rOP;I1HxgW+6}YXpf; zd#rIZQ_KHz!tVE+R9}i*)bsuCu%h2*?>?${(63?h?RjFIN1Mb*?m4T6dDqs7JKXFZ zEYo^^8Lo5-Q0nxzJQ`g#DT~nPGmj8yYVO)96Jm=VXBxj;OX(sOONW|xIZn%Hq>$OR zKA407ZdwHXCoPmA%W@N=TX$run`f$3Wn|Afkd-v%szT*(S_|n7W#vu92KE&)P13TA z#Oij8^^LaMlb5mA`fg&Tr^~J}4}i@BuOFDEv}+jWN%ZH*()R(JX{&USjw@c2Mq4nj z`J)V&o#68Wz48X=GZ!$)Vg3oqAky@~Ymfebj)=4vYL$w#R%)HHHArOx0;F6pnKSWQ z$gCa-VQB($_RLm>q8I6(X*ROWM~PqP+9%y^7=O}|lJQPzOZ4`I_V9`9>+*#qOM}23 zsQDVj)z%TGj8hHL3&YWY|I;-BREisV3MV5%jAwkE)<>B%;(HpF(GRFBeK=48$O?e1 z5Z}e){&5MQl#$JUKp~8gdqtg|`dk)o(`juKdDX8f^FgXrX3cerYU22t(u?FBp z6WK$F9Va76@h)oz^mN8h>#$h&tN={w|Cd$p*F=3o4SIkh9Gwd7vLFLES*9{J4-h!* zvcfC@SDciF&P`835@jXD5A)z=!%cN?=y6sWRGt^N1mQV|gS-6Eo#w~@IS5i=iUN?I zhiMdhWRtI9PBy*XVqQ`VOGK~OADu#vVwn(44hPFCz`XAY3j=sifX5S^wfb$EK~kZU ztvos*&Fa&wQwok8`(|T zM4M*0s5)8IFIhJzN=&+?PMLJXCLdw8UPd3w!4~K$^p_RVZ;Xvt7PNpqj~3BZ^_Va0 zs$p7U1;sT>+yvl5g~RTSHvlb#lv~a60LoC(w(;X!0TOn%VFHJw%2nCi0b$h-{S?fh!Mm6KU}>VC;Z{i>z;@hM8jr^9X@QNJIlM_6+QO&-^6P z!1mu>8klmTihvrp-cxzv3ONr?(GDKhf`s9c@7unX8geF;;%9iDhafPh{_`-MK{FjR^tg^qHuD3@l7zod!p=L6 zp{}C(^~`S&FRWTFe;MP!=_JN|q#!}GWR-FdPdprbJsifzF{y7bWE4YronI8AhGr_p z9+lteiy^i=wJtB*Y>cn->KFhhh?egHK;th$U*X)frdao`RY;DNSUx}A;B_TrUwNr#ENx}W@pdb;D?#L;awDk5pEqEgC$pp4Y}bp1#bncH|m+YecUx3b<0C|i+fMm zYV&7ZF}<)))bDut@;DE1AUv@Pm<9Ou(LM!RDK=yNd(x}L(%gW-C&m|Qex#?kXISMx z=_>k2Db?#wM@BXeZikVN@Yvd{xAR-Z2#DR$sDsaI{CIJi-j?L)ln z*ZnP8)A*(_b-Q?6{mxLDh>#KE2K=@ydjUDtkty07w(odOnm#b^M0U>CVyaxi+VYT( z99W063tB=`w^#t!N;?HRF-33#7|`DQiF=R`4ofF`Fqe%~xi1trOzP|db}b5f?yv{~ z_nZ7(N=o&+3qH0`I^=sMHeQXd!i8N^iGhh(*X}}^Y6<2 z2kQEI_HDq%sM|ZlUV=W;y`XC$K?F-QJ)RN&I_>XYr|~|Ce{@^Kn`A81nu(d>+U?SF zTl+i#wLhO@#{=(xxKMvZi!Fp0|Bj7>r9W0|ZV9Daj732H{E5ze2|3vVX=Yz}jc(xU z>g=6*bap=<^x39-80A9r#)!Dcjd+45Lxrj9MZ_W5N0Vs)IXKr?45o1&+Ta=*B!u2Y zAI$2_8}MLsuv6XzF+pc;D#Qw(p*cN1S(px}<(7rZf?l>uJrj0Dw}Gz~j4e7v7P3_=Ko9@Hdj7NIkWNjgj5>%Zs^&@p>a8s(;WgSW38XD8GN`C>}El^_%k)uMe3 zlaHzC7((X&rl9ghbp>ZTLIH3FsdD<8)pN3Ld(^FkrGwE7Y4XSF5?$e{sN9dk*}y#` zv@3Ps2lXya)e1I31EVPe#5?H$!NT4}$zy%WTf*t@nitOHDsO|m5HdQ!!i_B4v^M0l zg~kbo>IrNU=!BmhqH=HAV2ZbyO;P-9tZrvSLdo}_9(WuLF7xp_@9;a5GdN8*RAbwWp>qTuJ?Es0d(+nbi;K-V|2#p6MQbsp_6!Y zopSq4Ce97N5)tFgKH@hX$e%=(47OG2!FCP-0(B3=dtI`R*>G|x#xFPO?_F9reh78y zie*S$5{xa+#6yA#TKMVTnTCEbAx4bx8PXFg#mtP7;#KSk*F@>{=1QcVsen;Gvc!^9 zdO#MISeWzsi?Fg~nwo2?$|eG$37P99-pAM1TxfqPtFdsv9nJ3RSe9mly0 zF+?8!Mb`S0GxRqPrk~*oi9a|BJbp>K!&ni$p&+>?8B+4sZ;y~pO`Dku#+aC&I(52W z_hGM!;&|OmVIm>Gh_jxcH2AZ50nSKudwxQGbDoFjWseWKR5C}#(DOjWAa6D-cY3}U zTW`MQmgV^utEuq+IVJT^cijW<3_{V7O$6{`+?VFcL;8#g=Wx5_3(_e{k$+NkSG`2r zlgnd3ekr^bo+~xq6Xw6xa8cMLZJmnTBX11lY`&Mhy&n<^jPSetEHng|3MT2?k&XjW z&POMWgXyXHB~fpDc%V}Zs+5+sOkBmrw@2XbX%cTInxNiPAvbc1wy5Iz#eH78xDvh7CY-eOSYOu40og z@_k*9ULnwxnrW;gKx7?;=Py#WSs^)F0XC8)2sHDcZE%g{xkP@E(Gu|-!Y!KZrjcU$ zYHgHJQlItC{|7n){0}=zi^^D5!YZQW|K4W?hB!)GW`OI2fac?@Sm@E)--?30unVTI z4fjobRu?jYLnmIGT4Z7Dmr#rkiEM4Ves{@EGvzD61Ea_&DXSMx!mqKZdV1hg)mk16 zXC%I7!lg&Jp7b+Y_1uThjDnq+VI!GNM%*PWwl*N3mK5b_Estnr}EAF?`1OLI;b{JuO*QJntdPvk4-`k!8s|nyv66v2U3joU ziwF(WnT#zIa)F_V%3&|}7tdCLLc6OG?}r?|0S*l!12SaV1d?o=T7RtUB30u&>iVpy zx!iG#rs36HkYk#eSQ1oJ@=}L@g_m0)X)H+=`2z-4Mco#Vxm|Ew@6hu+{laO)Js%`K!o@}`T zyjK)oO_i8agS;9ywtN>%7 zlT{w=up(x*-a%(4R{#d}tglH5xbsB1oAV`CvS*)yf!4bde zqTs_3bO5sp3WbFj@k#Y~!n8=8P~#zhvM7sE18Xk}vSsiSDv~W(ct|rfFii!OYe)7Z z8^%2b&Onsm)>MiFa4LM+Y!gqky*rGR+9z6RCZ+l#7VTrX%%q;D3{xGIz<5KB3qGn? z7KvcEAAvlW9;@id5|%RxXx^HCxadwtEu&@W}*3hGkJxJ)bk~=Br=Ym`Gyx^>XQk+b_*dasmbKzyPQF7%P z+ji_>3#{U|Dv0-b(Ad%akd>en&+r5H%#&rj>;+QCO}y7~z6#Q$GD9O(lk& zqahs@_6KI(9w5*3WqlsM5Vynu?5iZ*jbqeK$-DMLEx*E@5*PNr9Z33w5tJe++^gGj zj6gVpBp8<{e~TwgMV2VB_ThbQ*lC@V_?-fM&`acJ=585@!MmTev4ih7_ZP zEjE%=8zhad8J7k+YRh4Y!uzf?m&RlT^L-p!Ftr#XiT}sML?l?s+aSs-AbGHoHyvzC zT2iZLlgPdVgXlLRXmv$$s3IQigeQF12-uh@L8M?&+kFzv0E}p%53X8YLY;`1P$}`| z`n*ZKuDC}|li2OA{DNTSgX~Kpn%2PN417dcUrVP&bP-!J8zCkSVVm`Bcf?<~y2*uJ zO42gA9w*T9xc4?_V6yUN05^SDWS*T-)G9jQ(c@VJTo_1cA9)U_ZjR}FSATm(p78~^ zH+KZhp!&=EzCLwjIru(yzYKsMMT1YaWj4v#5Vb@4pvdPU7-08qrdp(6)J#?60*VzE z@$`Hdxld7Z-ccSJS7Y135U+EbmM|L>xkbA9@t+1J*5H@DVb^HP8hGnIpnQyVVHyjr8Ir{3t%~>OF_q6M~ zm#tpySkY~lhm8ntPRa3^_h}sa8%t@k5U&R!H3E6v7AYvtCe;3%k+AO{SJJTW4N2Wo zz>i&-?bpYXCBO)*lL&`{9%NY%`7)`O+jC65tuWeG5nrg+(yx83q`&8p(y0?V>bwS1 z-?!c>+!yV&SqVIv+aHEHTAl_!yiK;MmLOW3Twzg``--Vu#SK}FLrpiYf0BhR5~Quz z?(BCj5__j8?kh(3D-n^3-}UW(JP9_=^plyp(yUKITLKKEUvgTgO~8DVMZ;k>OU5^q zM9f8!l{jR(s1fF>pIZ1LW7f#vQpycl{`=fLpLE(e6%l2UPi75oRfKv{W|Ms>@LxN1 z`nKxq%kTaX&0Cb+4mO;Cx{vrdf@p)I#YOxeAEeF(?()~Orx3S$i|%GkDiOsPY~7>{ zP($j2NE)7z->LwaAh!*)gEe6rL#iVl@BovB4K=~bh@-LnM1O;lLPVYFa=(q$DgBuH zC&n{qE>_UQfD_iC_W}3#OrUWMOz`{w)EZmt%lR+{HwqCNR;hB=jf_@ z_s6t&;UOaZE#DK8L-*S}2LL(PEE8d=bR^OL5p2G}sFb7GGJdP))uz6IKR2wAvb&-8 z-xSZJ_7G~lw25Ma9AD=_ts>AG@XUR=3`J?3yM>XN;$!Z2wN(4erkr`yt9Dc+?>YJp zJX4)6n=Dk-?cjq1c1E`9T6)3)(>v*ZUBKO30YP7_v@8JSp+={QuRDgVzFH>jl`4Z` zYr|@te604Kc~i-Ru}z-uZ$Blzsk+u)R z`!z5xyQ8$hkOp>V4}xK!C6K^)jPMgx>sGLQW!{B(LZ7AA+Nzf?=e>AY3c9nLYM`)U z|DRkA2{HiZ3dBDV14BxR9KA&Tq?WI4*Vdh)4PuN;w(wdkqzAQ-`wt?8iy9kQLeW4GmAK+refT%B@8pu>KLX~b6h}DIJO%rh4Kx^5j8xRGoCF}vW==Ua0$nPU zJQ9I<99y{9*;skH5&TSjmtwAOv4iq?lsMP~des21Uy(6QDdX+;?LW5VG;04itsK!n z2-))%MLU~9DZoxpA-gOIlc%HXn?v}sQVCZ(E9~}cq9Q!H$m}E-!cTH!4zzFgW*Ate zwJl4O(zl&9a#J-*77C`@6E0MkLFa1~eZDDv>DCM4hdJtTgG>}U6J>lq5geb(TWOAp zgf9XlvSjD;D}gUlhpN~Qfet1)Q8Pgqutz?70b@Dzb;TY5(WPvGUokB)!oLd*$kly| z43aD;%4E=C@c-t1iHVN0eh-7tT!Oskrxna28fnaN`ewqXuU@r)kXia^z3OT&)G&lw z#fBEh%?8@;07^zwi0?P20~!U|T;eK#ss{leXwmIasjqT$C6`NJr-1wZ(#f62TkN64 zyQgO3(UAAO0lqAY8bqfE)&dUO23FU?zFhc9$Qu~a8U3%2j>t?&&mI-Of+L7eaw)RC z(8k4}VJMBnw_=;cZw`Mmg(HooQ~E$I(-)KG3#r32woos7G_)X-MB&*bWn?(l0X7+V zAtM+bbB&m%Qa|0Ik@g-kmQQme!DuF=Io}QJ;2#_Rb9iDqF6j66Fb^pvV+hBq%q#|@ zj8RLd?XH3(5Z81VicPV3-9V^agPcmg4?dx2k`#!1QxnpFG{gu}{iX(hGjti9BR$=y z#Z4CdIRWx?S6+ZnVO`k`kXxij+ZV##k3z)yt2##cmW5ANx<@soTI7hRC+1JhL;S0k z6H!Nr_ec|k9FuHq7B$WhaHrqt%MRW#1Lop7rmMAp*yBphK?uvc=J!!Oq@MrboDvar z*dsvkU+_#p!GBT3pMtmXXpks;kXZrkhFHvVFVH#O#AiVt8o+ia=2>JLEg0^b561M zX9jVs5@UMqPQYF>{X6D<a zx>+hfk?fngDP1Zh`4Tw@r|D;-#0wvUqJlyZ80QfHWQp=ik2$hkx6?Cn{rQ$pMUhR0 zqTpirBjn8?L(*68rEp|BZR}KJ8``5Fkg;qOW!00Wrm2NVzjP7KGo?$y+$YeJHUb9( zs5W5!t2QWRTA`GjbvnPsD%42a&{fZ{_|FNc+-v089T$$SZ1eD7y_&WLFk0jX(u@in z1N`A&e48vvE0yrEvsoPB#J^h&fQ8grtCGjeA=Cx=vrpiX6IbD&+_x$8UKc~5yI6i} zhL0-&<48XS#h|l1rPL^f76nVXkYKysJ3P1tgo&#(0YWei6O3<$}waz_C?9}&wJm@;o z2ZbaH>mBU79lafN<=FE~x{Fc1RuifEUPOQYeV;Li1^mTG_FjN7!S5Vb!spS&d}f4` zv|^NaVqdz9&KM2)gcpxrU1mLPz9r*MVH7#5rqrJR{UdqB6bdZFZaZzU7;{QM1R*?g z2fW4ROku#w1Ytz^`B(t8FBJqit#HjBevm)`5GL!=H&l(aqqlNGT4enX^8cY{0j91L z6HyBmO2@q2zHK^K`32_Mabh|og&>C6jWc7sM6M8tScpCIwQEt9JJtrxX4Rd1@pFR6 zWb98MAf{VhC$l8;EC87P^CJng@VnrHY4cJkl}`Q@*Qd#Kw>bL4^B zXO&+d$Q`-zKrgm#mjR_YT3x4NKTl3wNT4g%H^=+lK{qIgvSdFoXprl}>_ogxNc~ho zU?=`J=kI!|3g9ScqN~UC034T-%n+31;&Q!v-KV>v(I&>rW{`>}4wzzdT-`zqOW0~R zxnId@(T0XCE1Y7%GOO~Wiuv`V=n5ylB?GM>IB6>NUd59r@@>Nbug5|@A3{l9-s2OB z>9v3pTBV6f6K90rxKl$9VL`r5GfRMPqI7&RXsO1jCs=u*#EPntHW7UL z`yfs}JjnlnXU-P}(pobq5Z(_eH_a1B|r&oQwb=+X^#_{Fiac* zIM_6p1C|bgReZcQ8Viohv5Yn2OoUP(HBE`ftS?LZ_?!<7Zd^#Z=nD!kGOfdS&tlK3 z7+VNip}?yxQD8W~;w!}ozHI8ARP5`>#$vm6zZPaejN>{Ylw6+0JVyqQxu61OPlw0- zxG)1P6m%|OtzhFFqtpm?4Dhi6Ozu$uP-3k*#i$assUGMS6SPEPvLbh|cnK@&V%nBr zE_6cd=r_7~3q<|)xfPO=l&Em)Jh(`Y0L9Fgp~HzSPJkJltV&UDV(@|-4iy(1HDP~1 zlZM9N;e$T;IZKJykwWC>DW~7npM7oJYdH`{f6y%tr_p_sk`+<+m_K+Q{q%-_`b2+U zH!G;zFD0@1{V3mRl5SqfO{1paP(V-zz1Ktk=Q|~pWKbFTs%t4~^KS^?GLDP7{ z2SJEp>SQt;3_(ao^jNPr(LxKAAs2FswVDUn4G?}0k1vD6QlEnhN%*qz7NGGD4b644iJva@Zm|czpG?&wCFT{o3T?EL_-yCDLghuJ$S0i)oNI|%3$=C^legU!jTu%7@Q&INKx5iprhTE zwO$7pXVrR=l9>PU{7B9eQ6c0Q+K;}~_6hsUdwZS({;PNH;uHZ`J1WW~w4!cmN-7r>%HS6MDDTPg<}*^Oc~36v~{ zdEIBmIdWbZ6s2To;=ZH_nx4z4#^?7ElIlT-lq^{dOxvy{i*gqCmy(6;ia{tEX-7)o ze;DiV(n{qvE#8u@C{%FSG086(#$Li!_0YW3V)o?AtA;9VEv~6Tf4oknev9uW|E(wj z=AA9bl0@g;OS>trmjBGFCET9e;8WRYTO7X{j{Nx(Pj0tyJn4h3BOpP7+W6!TEb5b_(W({K55-x{* zXi-A-8{avSq;WnN8Z0Nu@H`gk;9H(5AQ31i8f~IvP|7T^gYD7RcYiAbbN+Es72riH z@vMk1_)w=2XOttMOm~IFWclMVyi>emU76r}mNBp4|G`*yAJzy6oNJu{3T*SZp3C)4 z?lm8Ykol#E96LxDdf=Zy)xfn#Q+v7PoizKFZ!+is;lfOc02qqbp1^R-R`^q87R1ie zEKHY{%ml1s4IpMMM*PiTzuIj9P?6&?2vN7+0+zDwD@)QwqONqA3~-EIQnO`=E{wTk zPgfrbvPtT6wEydb`6>*3-kB#3HEr*SSoLoTKnZZCVR znz(GXFhzv~aF6(#NBc%~YUKh(S(kCGgKaG^`fUB^9kemLyd9d(d+BdE@wj9^RY8qf zq6Aq$q(6QaM?**R;E?l^F&Lh%?Qvb3>}1neUwxncR%7uM^JsFi!4U^BV|!LpW(!=H zeC-4$i8e`Ok;!D%v-huBrA35s+&M8^iskCK+2=t6v;#_UJ&l=r7u$+h5A_Jl--pLa zA``8}cT>P%jSW6nXh=)Qtq94HL(9xFqB=!7#;Qh;1}Y1zZTYm&%I}F^BQ`4AHY~#X z+;0#)MHu@`JKV(F1i_Ab_>C{hIGQ$YlD?^2+ENeH|MZ=+VG;|5S865-hM&#Z3AhIe zj;9m=*;ml0Dzgzhgca^`Ia+m^LzpNVp8qi%zrrDR?KB8Dwb7H_{>yO8FpT6;8NXk8*z#wJN);q-(Sab+tPW6c+F~E8 zkk)qCq&3G%KQhRNp9U7TA{BuN3Yn(B?aEz(pUBuuNw=ayPHGje$|Z8`$21Orm#JkHImx|9lpqOFymN{0PADvf!ZQMf8#X%Qew{& z9y0^Y%zxF#8aM&TE6nd6{77D#2r1z3WeIF&#Vln7Ov*m{4D22CyF&19@E#Yc=nD%+ zdwNNZw9fMk+oB(ULfN(nP&e$Y@Mcuh(Jk6OjHTeyTzE*}wwiWe%Y!^{3=`r{NnWz1 z<~(o=Q+Gq4f76$P|4DB9ipthn`Wg9NLxqumO0MH|B47Q8o!)fKK+AihNKEVxj|m5J zj*9tQkjE;U`E0vIxv6WMdRS{bmIL;?3sYk$xyuQ0v?Mk9 z2y+8mFtI=k$+Mn1dIAQA8b(^-3)S)%>ypthrBNn@spoJY16DSXZ@YSkb@^LiSf*Ky zh8BsQwK7V3tbs;I;^8cf(X*zq5u(7;%<6jw_?ZpI`AnL2(V)cz(3u=;=dBI7B5k!n zfnuM;UUvYPZkYTZ%ooq(U*>ySrTmR{W{r5kSL{WObP9Tl!OF+ad(37E=M_Kj&lHlx^^h2aAh=i_t5+ zDn0uIuX}>aHGol9Awt9iIK>M!Sn8_zwLsu!`11WANK!r%Zi? zpN}Qv2Tybzu!`1eMln?sC#s}r!FM0fVd3}nyR9)dnhyu;@oxfy?WSJ$p;vyf&9Js3 zaH2VEQ^&VzgGpf4>?`H%H4^7(z2uzKDTHl5FeQaFY4?sK1ex=R@TAjxRvAU~zo9Hu zpxcH^cjTaMF$hE7r;f=!1z!=O#}j)IdU^2kw{v+a`wSBZUrnj)iC+LP;4Zfkm;gQb z^_>z}*AKMjPM=p7$KLfg+288^G={K`!<+b>1ypMm|1C8R{g2cL=a&0_mm2^7oW`~f z#{ca!0{-7pW2-Te?bH`*7q9%kQlk(D=GBdexiTE&@1iaA$I81-L&Eaw5d2=F0DrQe zp?0M^B>Q4S+Uv*F+ne%UN2nYse)+p6Q!YO;T92XRKv@2y$R@tbo)ALO`EvFiahJrw zp^^&o*Bw_2REz>JwLO4$#4iwV0S=c~NLC$Q@?W zYqnV|BqX`dx*{R;m?u}dU9sSRh<@RJ4|7s3-uvwQN>9&Z(u6*);4ewT>xaF1Dt~%1 zCG^E_1hj1ie#Eh;*EA6+5m>z>=41q_*sQo4ut51iku+u35y6JM?NmaWQa-iE1((tl z#4LY(4Qvd-0wBMXdrzEaw`wT^ri=pA*Ry`D=uml2qRkUL-+{>TQt4crdLW4)bL;+U z^%1KcShlwJWrAhI zc^DGTLSXKK?k~RdH_Tr}7n@#R0*aC0OTTttNx)(hp(`{=S8L{oYOL34RKF>^m0|E~ z0aJVF=QE;!RNw#wNKqKG5%%skK`eESz&Xg&3ID$+rZo2OqoW%2)VYxKKG9B)4gQzY z2;5rS7J%*TZ@+LrhD7{Li(|j&Slw3#>_%gYKMhOq7$%a5+S!e&d%XO8?a|Xao8a;4 zBX`!y;ky@3zAKBe4((wRf5Em6a;tDkI8pH?KxXU;dl>b2Z=8^nQxhA3sL>hXp%Ta`*dzJ%{ao&)7*`?tJW z;7k@&6DK@j+4waY@neAVRd&B!7C%u|+7Vc&AQhcICY(MSFL>bJJ+;C1h*P9tEG4WHnhZ(65M(^ z?f(%tqzR?ud+V9Ck%h1oSp6~Tv<;P*^TLY61#Ph{zaTx5$fIQkaP_*46(2;BX`c;r z1p25xR2fdwhXC72@s^M^Zb@K$t{gp?m4bd_TrBl!#$+AjL81Cufa9%|wGh{VOJnZu zM;vVhX^$Jsc_lZE;bsbEH*36O6znaLAR$mR-v}k~BHK}O&8b|76~i{^8pX_BLW2}J zrGok`I$YHOd?iT$+CuCY)y?m+&p=}}1&`%sct~hS5xD|i9kUVfq*s$WwIiL38rA#X z=G^6em-9~!>((1jAJwsKJQPx5+S?#Mh zR%3uOwtp@wd#sE17kN7z?+Q5C8;h+>tBi(B>vva9!g%li$wTC;!4NAK=6noF@&s5? zpF;x)Uk;EXjCnUIgN=^$${lj$X72Ize-eKVeKyt6ER%*jOxENd@`*C!QDTbPaer58HQ!C~=oZ>4_!d#y-*L55Fq z(wAftjWG{ktN7tUeBglbJTS*h`4%niFqro}@{oa)m%jQ;vQoV*y^$iRaUvsAX|oqN zA=ae*?6Ob~aXXfyH^V_rBmUX@^CsImdQ!x58Exm8@$2uxv`%;9Mgs;{Yhc;!vh7VU zA=<`c$ncyzU6r9Tpj4f5ZI!_fUiQ83Q{serPZC&EN2NKly1TW_o%jdX@rGL8P`S`p zUR7#Wi;KBt{hq03+M`*%Q7_BVrUhT>oKniGJr&QS*mB4~X~$@R2is(}%O)K~o-Mml zZIe7dl0sE&1o2^<;hZX^9JDr9K(l41j@myG_lIaflSU0k=PU4U-4N^qL^J1YE=dq4 z;(Zrj^C$ZQg~C$$7s%?NV4>m@9L~d3P}^-A?)zbh++in|r?8u1CVP;0eDIksB>v#Y$x}I}$!Ln_uz8?6`N?T*d1ss^>7ai% zR~z4w&4XqVA5wN(B$q_vNrxlFt-k0VSQKq_769ei#wOiX0`-T(VoOjf`gmx5kEb$iN4a_~piVuZSYM@4ka3hW_Mv2QDJRnc{`x5$SMuz39N0h2 z1O+O*xExoEj?a)Zt+Ro_jU`~i{85a%6{p}}){jb(L9#8y5(q!%95GrF5Dt}9su#X3 z)jm@RDUW%wFsv!QJH?chakG;the&6b6N%%vFZgN0#iINbvWSOrL}rs*B^pmVJ^kSM zLb1z0*bzeQhV_^7Xy}a{V&}Eig?ItbQ9R)DF%CH^DrA&)=GZyV-)hL2oEyL zjmIkX=(mj6O23wl7)DbS`A{qPQy{%Ak;S1XRM)+)X?ZwQ=wS-uasJ?X%3>LyG}$=R zPCNUTv7ytJx$|f5K)nzl*WSuJYJ9y?V$8Z{v>HC-42~>!Or4Y^9YY)#t{sjiU1oB! zDAsFs=vqNIYfSIgHy*ZKCwu&1My?9@46dz3T}LXPOb5K^4_d8+>oCS?(_3A`H`K6^ z>}~m53a=6OE8g`Fme2nm)7u&xhXQX}3!~ z38gZhH6)k}imrls=RIxP55>MMv%9R|yK*htyL)NrkzDYj^pn^5`%z&7#OPj%=XHtW zecOYL^dhMzFRggpQ7LCFD``5cV}{B!^Wv5PB5bI|uKJ(b-yd3|gB(;eQ!Y=aR6>2$ zj4dwmMSdulLib0UB6Y6;Mtf%R?@~$Ail*WER#F4`RxhYz8x`NpySM3bySB>`upj+Q z?FK1q5WrbCX;)d&UuQlUr8RX^W!jL_>qQRF2`QW&pQNH}q_i*82WA+*|K;9trYgQE zV-YIX8>drZz_o1P`}^Hm#i9QQp7~Q}2EVekzg4P)n}MeF`~KofzBJV6LI^8$vC%E~l}-qFNAiyemcURiopOw#G|TGz02 zcmlH_z}xfbzL0$Mr@O-J58fOqKb#jBmVl_|-4Ukf$k_G8ae6u!E^BFA%fkXQp#f8~ zvyuCN$Oct4Mw0%*(_<^CR0VX0U!$$X*$skaH~G?Mams*_`0RP~M-^l#eJ!ny3K1zS zoyEYEQyN?85OtkJh)QnMy4joxD#^>Qs-T};IAp>2)Ta5Se(Y^o6*37akj2zymzNM; z1+Sy{kPoQQdpQUO=NKqN11skaf7#zKHo_QFGyrXn^cJ=NU z_N8ReK}G;j%&gG4kuPJn@A5j*pvJidl&%P(6+zMdAvZzauO|Wq1iOWQ-!rdf>J@}u zv3-XBrn8)hmvK_UVf@44JX2@#tDD1l6!-=A9bFgpqZN)=Ce~nI4b$1ZQ8KWhKDS`x z?od=b6?7^*?gqz1NF<$SO6Ctv(Z1QEYP9T3rtum851|Rm>(~2N^!jG90co}DrHK6u zL1LVh)mF3s<)9Ta_W#4yJ+{Xgu-yWVoyKfz+fHLUX>2!E!-?&rv2EM7Z6}TGq{*K4 zdER&L5Btmff;r}x`?}AymU}6GYh8&-j|0!)lBb$Rr3_Sc#X33orMlNqASEORKJaH& zFV*T5BF_UGPbj4=?JmMM6zYgLq^)tNGoBD@m9#7TqGFMgSF<4J_3*7$x&hcx%MW>rP0^OzMLq8d zeqK!l&rX5@8c+~MOhReNp4P<;W;o;fk5D#obY zq=aK;b+$_x#WJ`Rd?+LHMR9}lOW}6`2}WU3SX`+YNq_NM${ERjLBUepaUuo2>fbZx z9$uN<)#3X>9^);w1TT6AvCYFk==49%XDWt1u^(|U_%&kbHNRp zt9a7+uoE0(Bq)_!L8oJeh;s=`$}K9wOk%KQ{|OLgH1VvWe?J*!g$(>`q5*IWsub|2 z_=nNhz!^^F%)iEYSz1OoSdqK+WmfJ-ckaf$$}BAc+KtQu|FS3zLk*=dzQUNl2gP*y z(>59*@Fur&QG>uJ`K4N3nmi~_yoCAO@k9!pF7 zJ{2)E7xr^#nd+<1EQhsnkL-Fyc78k|{KH5{z+||$oWYvqVlh#Me?FEo4WKx&2ZkB6 z`aWOM)*qNHgoid#X_SgkhVCztf*rujG;d;O;GdpuMjO&NL4QE<$M*aw`}M>FAqO>l z^*B;d$_#=VS9phLZfqrASXT+2X=Rxi(qRHV*ZPkxjT(js$Wn z&@Rx7pBH(NQt+cPKTKKr{Ptjb8!>KjFym~D9RFC8 zbp?cx^sK{m<9Zq5uj^mfWS`Vm5ArJJa$$F(;E6z`PC+t`;0z{0AprXkgi>BTp;jhR z6QqG+!bVTDwVRd9N~j}PpMkd-M^ZPDZ>5K`;$}0l8JDTohyD_wd_5L2$I=0~*!Kiv zo>~^7yD;rj`E>$4yGs7U_BcflRmp*2my=DK7cEKV{t&6d5s}i+#0~9DqV4|DlR|=J zMMOs4GA)%Cel!-2m;jpaloZ>Rbv6-pMW+o-Vk#Tv-g zRy=DPs0eyg_uiR~dOrQSi*F7b7#Gax zj1*j7-FZJd3ZQj5R{X%|{SXS8C9v%6g9Ed*hL^0V z^Hit*$fmET*<`kj$<%%WS+sqA(vcw~&>07aOykxLwOgd`#ZcLyQ$ht{`~ z2S00BK3Olhj4|-;^WM5^*xq4{aJN{taU-xnr(OsS!YD#g$>$x`2PMqg`|bX)FtM=jgALjJd?_-|uzj~W;ZR2$0Y5?_UE-?O>zTdPdP zKldkJ^*}Ka5DEog;?P-8r_c6>J|_w*v8qOoqv;3-L$m)jV4VQ<<&RAri8P(0ys+jm zx?A0nL1Q8L3v&*>!&trWpWBCWoZ~3W68PzzM#x%t)M|I206YZ>K)b3AXT43F$^Loa z83TVPG`18%^?=lx`YjiPl{c=7?LbPIxUFX*U6WN^N-hBY%y-P3@`RtxVt;hnNcC<- zy-0ZXDLG!Gr&V}KzTvALQK>7n8hI>-l=$cGuA<2InO|-nIy@+Iu-*J<9e%>+AMd-| zy4n_oeCRc9T}ef{3IYD)S7i46UjT?M|NjSoZr4Bn2kt*UjY~Z?@sqkog_|J1mKN@i0o3>4|;uVx-IGc9Zc_(fY?tX$qu*YMka>l zaFhxpQlUVs0vk!0BD_y}o3&W$kJEtiNeKLgCZqjvN%3_63So#F^o@!(K*q&nlihk% zHyla)m2XN=szY%AqT#N9<$b*3^ZoZQTQY!Z4XVN4l9tDuARj9x=qZlN$utwg^u%(?$iFeOSGI z0Q=VbEmO#(>Q}exAS%99Kw{$$7jmoOU*_3<)`PPr+P|Z@|LCeyt80Q_ng{)ETO&(c zr6&7o@V7sSDv>v^gtMJv9vpj3v9cdT{LA$+jhuOzz>|&K*WLw}FDh8eRW1GtCqaWw z42x`(|B3C&!m37(6Cic5%2(TogP;U)%Lri{60N8I#~lLx!ox8{$1!cLE*BW=qQDWd zgP%~Vw6cg9;!>f6@cvx{z~HXHoO|=Q@J^Lj9vqi)9<(aVCdx#Z@M#W@QjtFAMjTWu z&*pCw0+-3nGUy|g)hRT~f%$pljn zsf(P^X{DZ@)pq+-`(Qnfw^F6kab-r{g`Jbjj|TinDMtxkL0vuE^F8YpWT-5>ldAWmB*T zUNvrY6cAM1pO!V5<6A=8-J-&%3E-oq0k=@r;eb5`1& zvYwoD&kYr>K5_B3{z5eN%|cEr91XTq(J^mkn=n<%`DPAj!~yb<~MpS^pm|{ zyrsmTqP(e5{A*@+>TvW>24W@#AhyE8-o_<&XK*4I0zDZ8EsTNwy)-uXw*gt8>JufB za)kiMe6V-Yn2SKO9n&>iV)y81%}g`* z*yb1XyAXMIKMq@E^EDoeK?~I?{t*Bb{OBt2w>zaMf=JlPeHwaQ*SIw7&*YXGrX!a$ zMJX3SZY}^UiITCYsbB7Hx;cg8_196)38-c~3~lw#sW#(09c?9>bIvS&GFGux*Ar~h zX{AF~&`bLR>dSks7PpMAj@(;+_A^gP=fl95=xF_N`~EDVxxIcEi@SC@xrG9N=Y>8l z*Pvf19NKLPPQ^vV=mT#>>|JLVZT<87a%&{*RaYPv8g30Q{c-d~XFfzf#c{3}99>#6 zz(Hg3N2C-hSk+=Unl}R0(l;#67BAbE!^`%g31;s%Hc4^U5F!NV<-c)j!^=%fdiZQf3&_Rr#Tb&cSU8ls<6ZYZJh;T}x+m_iO;DVG{uS5XWnEN{3AQ zLoc>VZ60W6;Udbs!-gXDl{38TUMo>ox_+QHH^1L0!^td!xPy5a{taRCMqFU^lCyQD#@O8rYz*xcLT_V zCm${2&m2%DDbkzg0GCOCa3YKV16w*n=zNH{w&^3k!y{5T>BOzUTjD^5a()y=iE#L# zOAaO;(G~cM+HB9yjt%h-YdLnh_h>?Yfl@sJUN z8eHxVu-Z^Oo;FPr-VGMg|E%~q~yCJ4#jNekbCI$G3Y%`+HWemMy|K* zjNAmVJFl??IeU4Mw35z7#>6-ht~q%|)B5J<1KT*{rs#s=7NfHRCUki+<0JwVQpjg) zD9LBJh_hnpBHt7M@6g=h?hVC@X$8BHN+^JOOeu+~fTUhsb-s3f_~;t5>0R9cw9rf4 zTzEyfJDyF#G~}Gua4=Q5+5#WY{Bp5i={|H3?6osQkvFBfnD-t-3w$&&!?hXdBfY{- zn~CeR1uY8Qrl{MlDGUml)TCLAs5`k#8+BC$(VmxK5H1Kn{Z}Os5Vgy zU6<`Vm&1so2&NU-Y|Un^~J^Z~HcCH}Q-#;pD2~=&U!#sgl;Jqe$O3BY9o%%_Fx{ zzSEG+ZLB|l8D6nTMC~iBwhZ;Fz?Lti`pd+Nt#}^FxUc!IaoBAlFG?xyp$sJT_Nhfx z`4J_d?b{@{S@3-K{kKB=sSL@E-x0appm@oT#`KGyFV9`14d3eQgS}xS-#wEU68s9@ zlt*FO7?LA{-{R#u)83Cf&bJR_`X$QbH?rPiB?J@!);5^rN}m@j6esP5L#iE3k)Ms@ zvuLtmSIzpvTNDEdP_o`$I<-%FG=nr6XD-zzcQgMpoB6pPy3TB@>60wEdgLaV zNi~bVC>9oIi3m5~8q(ZpjJ&}W# zqwdo{`b$QkgDeu++#TCf0h4|4W4{`&7}C1~CUMLCos1CYN905!ntt?=^fDm3(UL0r zJsL}Mg7rsBO+YpAQe^`r`^oxM7$)2O;rW3~>WKOGVRM`z5q}&C(N|%_-0D!3>P4Jq zfwDhc4C^#&T|MvYE=@LH&9CTg2;=xAD@Aa40nAUUM)dzGkM(;mm~)Qaj7DGhHwk`Y z3?z`(#d7T~ue8m;+Q6GkLq135ia)yAcg@4YrzG2QFC6li zsE`Gdr$}H11CpE)n8C2!!6pE~Zd&k$47r^DQwVqVL##Gc{r0KsmzSHCls!|h zn6+kOyc(_hqSh!Oy=9oV2#9<$wbT7n4qD&LfkMT8G9ePDH^{i z8=4Drqdf!D3?aah?$06_F_HO%&{$b5h)^^J6N<2Z84+@QIw>6;Z)G-v@aGWh@*q#9 znmxMyDh-O|~l$1lU}|5P3?N7r)yxAIum)pLZg-Fn3H;9Mi)b#>C!TM$_dTb#@v9LCjo*d~UE5V1JrvekPQxYt$l`R|q z=Dj_**|ffrxQyB_O8gdZQ_XY4-kqxwn)*B?(AyJNd_UhNgdD~hS$4OhF#C`WHB!bj zZtij+1%;V6#DUkJ!qDHA5(P`cJ&b# z#T?wB3R+*Xye6n}+ln~iuWH5j3ue54956?gggv+U)QfO;U_IS{BjEm4 z7EX~=8H^b~LDwL!rRtaK&=+OzT^#Rtx}R3r_|THEhV8mZ$EXvJM|rgF);Okw&RlNq zJ}MP%>5K425B}c=pPQ{tz%Z9^A_&&NC{DU&Uuoq17xv!);Ozm3O3%6{|!X?obNa7jNSii!Gv49Q~Fz?J`W zMJ@$-l!oGBhw?TG%1aa$a~J=LSg;a&(`SNsh(arH`hO3}s+Q&*hHvR{f%wC?}B5TjcR@bJzy6k+2wybPd zo1>ouJpFSv8Kw_QA7J4Xt@!z?#{t250>y0h$LksR zIsh(N1mpSlbabrUADC_zii(F=)gC4_6JzzZJH7B&?tta(S^D%-iVDmKKW|vh;3t-F{K!=%n;l0;|qO-hn zrCnAJi^y9?S=BOY>0#S7X#M~K6_#o~=(A|Qq;U(_!f;xg?4n<<(d$R~@#D^~Pibhl zEk-~N8@C>2LPH(T|bpJucEPL+pFpi{w_lp8`7x!=X^-{h!g$F0_Yjcxd}=>>BYfj za%6-Bs6Il_?~dY0THlTR=lrepB!aIyVrLciVu)+H_OljJVmsZ%e6aIyf?q>V7+v<1 zK=YMNRy5A744%%~hgvak2iN;i1#m63-D2*?RtT-1V*y$PZSH20p;F)dSGkR6v=Z>W zE=AccZnSSa15HN z4SbjC4YTH5irF(4Vhew7fH3y%fuTiM*q#302*@dp16=9GE-7~WW!S$6$hY;4AU2UR z0=LdtzMQvsNu=;L^Mynd#`x$o1b`MJU|;@swqiiJsqEhnNIzZ$&HHkbRMxKW{Am>Z zX`GxO?p2NIDk>&sl@rG@q%RN$grpE~4BuBaMG@=)(s2P^Z}p`w7u^6=c3M8dl|!F4 z`*+~C3GcBdS*sui@9?@w)=j$@A&xz?af8#~m)@lZFX1p~l_O)_t` zf}|?#ylgbsx^6qLtc^#CCX-BoCjGi>o)Rp@*DAgz(qMHp&~*3FGoh)>Ujxuc&`}Os z=1Q_aqAVoRHDwE#z1woRM`fE1&OxbM3QIn8Px3C@#dF`umsvW}%_^;}>^WT!q@!`` zax@S%;!%|yl|~I6lw_gK_Y3e0QQLT~S_ED`(2ZJEOnW9==xK+sY~S@2#mmSaOG7vw zO%~T06nZndld~7tPfZ=u>MhiSquRbgBd%y_OSg}W#iac#=T*{VI7Hp<70D1Ze_|w! z)p%7;P_j?KW4KbBOJVOiLr>#a$iRpEY;tc5K%ff2u1v%07bi?eiUp9EwpC$Z+oh5R zEB?yqr*^~G&=&4X_|Q5_9`wVr4o`FZXz^9*cTkulJw3>J97!SDht>AZ(sjTvUq@7H z*W8$yN2uPuysm4@s>`36>CehshF-s-Lzc6v(Y#VTv+i+w#_j1e_xK%%AB~c%9T2u; zkjI{4fk^Q>6cA?C1`l{NBABQ&D;866EWU??QZHKnHD8tCde}f){70SJCI&~Z&zq2R zZ*H4bnOD{PgPpP2!ABwIjIBz)Dm>Av3A&6M^{VHbob`k3VF~j&7!uxZdAl@vm&^jm zeVcu%mi*12W6~w}t1@4P^y4k+Ogl&Seo?9t`Y{z^9_uUf$2q|F!!xdb%YfEd<`lve z{72Y&+s1xG`#!R5T=#Br!o46nQ&I#r8FD**RpN#n~wKeCvPqh_vATQXbNSRtq-`g{(5t=dP2SNoFjqR~<4h4ziM zL@FO}Q>U*p>E8>}pIN^ok8PfW0`nj29wO8IX8BKIPr&@gmVn8hQ;z2K8&%|mOIz~4 z`HzGPt8gtw$umgHP9kq4tOCJtJXKE9IV1yTe3>Hyz{rv&w|b*8vzWn;b$Iah=g!-+ z9`FyOifNz8+m_b6oDI9DkTM(jWdx0lE~86<1>n&!{mEg5GD_DIl=c7Z|xqMz;zM+-fq<=HdVPC4WG*2Kjc$a0ly8gP>smH7b%zu<> z=|$kMf3-w4o-oBK7)f;zCrrgECBYY2{)n^+ff72BBicwhgD5DuCUm zU}!n=V|WdtB-CLVo5A6j4M1=d`!9s{z;4vi)fH8Uag=cfuk4ibc=qKPSPGLSFcJ1Y zsf|!0>x9$|WKuwL#+wk<$IYS?rS8Qt{NaG!F!Z9_lcu5qOiCLQC0ER$;xMGOl(&bh ztSc=2-a>iD?~S^E0fO|2C@I}6Np32_;7Xp##)JY; zJa4HUHIy3v+Ui%5WQKW!n|NqBN^p=vV-+|kXJ{4>_VTPocv)H~2unAYqoYS*Y$}D_ zl3=3imx43>#r%U~;d}oPgI0RCn?dJfFh8!-_ySWUevjR3iblcIwXSG0?YHV7oB&?= ziuND2j=1=HB!wZ*aVa2!KL?f6Wqlz4iVL&^0bF5vVWO4<)OVAQpmY%lJ*nhkiLq_W zKYRtyN9O64;>O`(fBx;V-pjBM#9nupF7moN$x&16i^R-z(mf6RG;)B=#SnqU2BL_$*}#bGx&}l4P`nR{MJvJ9VXZr_jxGo>OnJ$ZE zo_vx!6ELuJ?;m??KUpcEo8$+~al{CiCFu}Z92=Nq1wKGbu;gU@j*9vobXh!`e}8gz z^2Ov-k8@!Nb9}kF@wU+Z8_CdT|4$_2>;cgeF-8-S%=+g9E&COS+gc5nU3GG+B^C*& zRq}=<76IUJq7+)Cvi!#ohw~)|ZaBRo^5nO!{_>3F=I(MD4<&-~jAtJXqgz#(EsM{D zLt+bJ*1(@`HcEjzo6YOSOV4&8Xb${|Gh@dbPYtYh;mL5eM;IU@iz;TD@M6HeyWsqqmB0++DFZ?0+Z z!q#0eOnVy(C#~IA+e}Vq6lWlr><}0U0Y7*DxW0^cZiZ|J;&0hq4{w=FV4U-ZCQ6j~ z+|E12wpFHq$PR(b2pw=LW0LjS+igJ`NVj4I(#e`~-wb?oUtJ1BQw3(D%1cNCrsH4) zVqgJ!4sPM5ce&T4l1iRC)8J%?Irgpj^LW9a&L+Tch5z4h#oPaeD}LJTpg7$QeI`I+ zLgwG?0>c&gG7nIM;gi7xzQAxrq~(=!lKuU)lwcJ9b$>u{$5*!z$H9AtDPXvQ8yK!I z|8Zw~?ng+_HG0_6|DS9H_h(H+EumAtC=ODAKzL6+EsYV83zqmWR{U1P_@{>L&4WTJ z3+XwrY4YL$_tf13`(d`W!Y2CugH>{kHP#h2njT&?>(KYD01i22v39Sq#04QGo#mT| zm#qa1<>3X*d^Y91?q2@xUz1U6 zu+U|bSF9m@sDyMI72m`VUh*6J9T0Wo#}b#_{_gg*?3Eaj*!X5?d& zITOYW#i}+(d#Fk9Q*!v6rj-~4;6z+L8+pZbB($Iygo~O%hIfP^Rrg++(YDKz$d@ID$xH0T`YCYxH@;i%%p2S?XVpn8-UV~ba&yV;lGF9HGiD(%7uG;duHe z2-~MdDIN44L~+48^NeFW;89|c5kukfxMOv5RFD9Nx8`OHWUL{S)`KejzxY43&xU_2 z+@c#_TQVs}z>b)ZwShg;6uwM~u?ceVAbG{#YHa+6F#830Q%>CNIlV=}Wo@iFY!vF{ z%E~+`Qx_#F6r}7kwKV=}aB1ElUjUp*%tcj?xD6b@SCdBy(Xu=BNsZl2GAb=aU@CvW zsVo>kR_|ZdKjcmIlM34k_ue6uoKW#JiT-=$-AS@dH3l}o{7!Z9Ix8uICj`EXw-No( zu=g@|9A8;i{2Wj%`}V$UGNyN7C97ycXE=J&thb&t%oFd| zF!x#z*y@!9{}fRAn**i)Dp2}^j#lT~sFGJXs+8#!FV=UAw9bw089!;OC7+}8yPI<< z!G8dyKR^O=z<_7Bf2PaILuF=>@_}T}M=*6}WWP!BOPnew{jjS)kouEUU~63&wZQzS zJ3TSi{4ezfmy-7h_ovho-pqYHlO5})xvnoZmVSf>4B`k*YO%Qy>^it_3Rz{YO*XLS zHrOO>B%Tr^WumRw?kqmESDdzh}P0!r|L;J;3K*0J&+ofs+v_ILL!F9|t8tv}AI zFB}t;jTyHOV)@8Auj7y?2-da)_x=fDkZ*F)1tCm(4ta}XQ5i~zO?GI@X(aFHH>DU~ z31}uav(=BV(NNLQH{zUVS`BpLpZ2d;?KV$0ac#s@KA}@_Z;B(`mHeH?o88e~z1auOgV4TE}KfSkx4N7;`0_C+JT^nt30P%J2RZTvxk8W zkd1Lr;}zvR{3aJuWjQ1#Nqkcr0H6yuWlIb0{V-Z6oNC+fmPi2Uw@so zaw=h3meAUrij`6f*Ad4#n_h5Rw6!!%9UC-{-^z-!TQo{NeW^Pg5Zr|_`2E$epcU!P zthZD{QE+-?HeKsXw-e+~LMMyItCTrBLLT4s_ZZ9C_l-zT-|p!RDe-dFr&`nYQeRV3uPlk*Hs?07=ddtmcwv{Iy$*Z3ZJkV?qE*Mci6l)+{_;;YWF^zkm(uN)rBlkG41bJueelahEG7u`qcutik}{c1V5f|EBrs zIW?-a57C_Q9@DYPb z+|2bUsEa|T1;Q1Z#2l2&z)ct$S1K_?dRbAXv= zVv!oaiSp)yir-{9LyY`j_7vZAqkbwoaln6ZzesYryciN<5-5xKD&tJp^@vtg%zXH@ z+dKXARRi~f`$yOJEb}2Uo$oyxTOR4rbvC^j$Ik#;%29qtcv*? ze`&t%khC+;e{g?!ss&|GzXTIP1>kpN59{gZU)=AWbumh$8q#QU8~J*SOpv$=>X6q4 ze%VEbN6eqYVhf2lKtyFjOD!NSwZ zX{BT@Q~}FqMJEBj)YM3q9$juM?T1OlC6JU&6xM@u_OhFVLq-Ks2;RdHTH!N-S85fQa4K;h*g%Eumr^OA2c0nL-U@e=Q|FsUv{|JXh7K9+<&v2{U(jLd~I?l7dm; z;AJVG3q^TB;GiJ>ukD|r$AfYIA%kW0nEzX7(9}GA)Y+fb>MUdGukFuaCv~C<=VG?m zoEOp}TKqX%XgXrKFai*=!u7NQDeTr(?xquw*3{wfO}eDHlm^;<4v0z*RL8mO3@Yl& z&#pkIZY{E)um5a+;-)+%g;ZJmyeg|3z&}&Td)Lq3BW!5VNT6O-X&JlqC^iv$xWyN6 z8dM6NPjPDT#H|_>#T272iEl|@dNkvv*@4@lnl{*13lagC>OVOE)V0eJRpo=!DcYm) zVv@-B4SnnP=%agf?KL9aA(C&yzK|=P72%cgiIm4|e8!G)Qr2QDWcX|Qje8iJ%Zjs| zanQYC|8&6owf%?cU;f(uhz6$|4?||+(RLeblz$C!pq{nwm(3QImKih zj}Fj`@c3b=2k%>^tOJ@ATN!&Xjwt z&s4WAd)J+>hfn7-)@8}?uFH$qpMYO%ZuX2q)z?pqh-s8rk1A&spl4;o6{n}| z{H>$6eEHX&aj)~OP(>IVcO()g!0O ziRC5r?%cj5pzVf;2MkGqLrV?kv(alHoq=YS^FIzZ^y_{N{e%yti4O+S{?j_kcfib* zWX9G%+OPbV_N%RXJ!c@t$1j-vm-df}xC25B|I+?RlAT&x;|-*e?+DGQf=IsXzZq`>p>=`}-CBdbUr}5vPf`P+UqVf8RKy50$6ABPk{5 zCK@OJ=-n1Yy6O2BZrTdE5xwcJ#5mbslA8>+K5@lbq1`1K7{K^Tkg}!bILQ8}ya8#y zg~C7Dk1J*c@d>IB_Vt*&1bn#wNc-W#I5c~qoTY9NT*u+dnC-LhZq~I1x_Cfj$cLkx zui|$h07{rr+RHVF&t+WGH^pFGN!$dGfP~{P8}caQcXzrLd@3@=Y+QpA5^T;yalknB zJvJro69$zU`S}<4+IlO}8o4JTpX~i)HBwFX_YR*`(qK` z6UAoJ&5m(X8gz+?ayCk&njX_L_Pup%NW#vFaT*YMXF-IS&Ljx~sLL>cCXMDR1EuT{ zOZOKYYUlj=QWCJ85L-z>gli?0()kA)2Q?*i3{y3wE@+Iy+dsdan`l)w%Rq-9tDO(S z?Te#rt`gAI@)&MYlp~aaF#zXv=|5XGTIadPayA7^wX&+rRmda1&XP?@;kwiYc=r@g zST2cH@}+xQviSoa=IQbB*kBy$uO% zGQwO?5{$>Pa@2qz#sP?qG4Z$!h~FB5m|q5ptP+0xf(@2Szzn75nf_s|>yedhM;Tc? zMtw>E!Tflg!anwJEL;dtKdYHLw*lwa;NK%m*61SI*_QXkpr#rPY^{ryYhC2aoj<&F zKrWM8*e{^%Zvfi0$uBlO&?s zxnU$uJXAik_+QI!1bKD{P1rvOwEPZa0`#ZM8sH5ER@|%XD9h>%DkMyg?yxkHiMH)w zpziavUT!~JsZF+Ou->CnTh&e$q?ip_@XS1#HUEW zMEDQvE(4$IjRARNii{tyhupMtw>VEKkKodVO%0;4zIZmpO8ecBM8d*FjO7S9d{)oI%?-@aTz%95YaE}zp z+X-oz3wwd%-^BA4VItR=jH~L6Gsa%?a+GuHsA`bug|_4I3&Znh=7;!)`6)eaD_qi|1Y0h4znOVLr+LkDMfqmt z*RChx?|&J<%BXoFasm(vZv(F$NH^u%c2}8x5?!zAKc`pCr(TdO826`L8Mr=MyKYRs zpdJb`pChSaZ^oI?RS@koH~B))YWEPMX0{vd%1yc(;xtT;u|P~0cA78leOed>ZALqI zCfZ)`t2R$}|JL&O+~FbcSPEm^YHy19w4k&zSr!LDWjXmpUBp?gy!e* z+ftr3)9;r4SOy$Sp3M}q=8uJ}6)FVvbLqjxP0AFIDRDkpO8so(_D(s_D{d0rBpiH& z8{wzcM5!DB1Dl}i-w0LbQlFq1vnbWVge*wSYO+#83f8a3Z$tO>NcUSk%ITP@CcyrE z*Yi`Z73^L;OXC>QzYS@bbp;B%DzYB922Tnq)kYaW;sDTU@fVlMB4*r4^+)ePGqSIY zJP`uzdne`Y8m^|9DFdsdnYpDwZVIrvL%8EUzz>jDJsPr8bdNX2J`*mNZ#-4~_YrZb z+Fn61?T}?>g*>UVV-wk?7Se++u0!9YugXqH&VIPaX%ea3}^}kU7c~VLKj`4kw$1hXo z%qA8Z1<~N5r9hq^X!$pYNR<}#Xh~dtvV&3pc7j5eDZuew*AGlHcw+Ga>Sm}fO>BCs zXeDk%ggEyC%>!Of?#y{-v`J$T{$hRy7`SS8NFe6ltR7~p>X59y%s@Yz?=9=Cz?~@T z^{U662+ee6qznLI5{Ua!Ys4qXJ%_ITn#R3& zoSsrRr_X3_-r19zpEZOe&h~iqWv@7i#>Hfw-Fizm91wZyp211|5Ay@&3s^c#S$sb3 zjMYoNjx~W+8f-+2rVgJD?(cLN->ft9oUib^Ofc|-6qRyh;)Jk;u&@i)tQ|d=96};I ziLU<`SB+!0gz0yZb=k)UDSe6^rAOdAgVEVNUp9z(s^F0|blM!cXcWa&;IN_BRtZ~k zI9xT~(US7AO1Mnf-&UjkWz-01;Gq7qs$5PwCG%S?sE5#zx?Jvt0L13`+6IEbiAeJo zer)z0!Q{zER4l-Bkn%iUZz_?MBONojB0HVuhP8Rd)~|i{{xc&V3cnYYtRHLQ#&*Uk{aE*EEs`8K_Tr71zdvtG@Ui zgWhv%eLgwp`0gedb^7(RJRXXIqD7_fM_vW(;!nMy=BYRQ%r~+gQ4D7*53@Q?l0?uJ z1(4*SS1!pQvy zJ9TvEdDtexlByX%DN#aq%8ttuT!KwB;tya%Z|B(}EJpQZhwb$8%4XUYrZQzKI&fZ2 zxZ!)z*USMGOEsG3YveYIIUIYrS42!t9U&7#GNS0~RI)OF7Sme7oT&>=u6+RBAEyAj zKQKnSy=o$*J5l$3eVqZGnZC>_MgA!{%t1It2%ON?2WFPW*}t z-Iju#P?ldbUymSqn#GMkXGE3GJrK)n7i38|J}MaSV_r;Im{#t<1om|o8X7iAXJTUPJ!Iq5j6*d*~LsgRW+8901`KcJ>KTcmH zY3!RlY9@h@UF%<`KWc}ssIzDMJA#gN*1q>p)a~SE3d`v7pkFjK4&aj`#5$Kjz0_eb zjbeL=PfxxF=7DeyJI%XiD@7!8g%ZodX`b%KD=x#BxU31|QO^U}`BE_@%a*aoJ*(@{ zai^Kd`@*DdUeLWUq#L>DKAY8ly1}azz6g1by^@e@n)}hW=d{kjPIEj`3ZgAHO>@OZ=3S3yYg64;iyfbvq*?ea{v7jE_Ws%x7@flc z_2mT6>38tna&K+!XI_-fM*y8ZrC)CUA8ur~_YY%<$4)01z(5^|*Z`Mn)L*AxHw{-^ zHT>7^ovwW$ zj4ylH@KEx3>5_Nanh(te?)Kyx%nWV}Q+QY;E6ilkw396M6c)Y(rf);ad$w+FgCS+& z*U17PY20a;T&1@dGa>#`mHp4@*Q>Mjtai1ys?`!9tP#X8Z*;n+n)qP2y*3cH@s<

oO$DC_YUU)_e1L%o6*id!IAW7;IOi+Dz?8Cf=+Ba0pxZ z3VN5xXgV(i=iKOG)=9Wq2uM?NyMKgTq8zbX?dA^emRU89I9qUl62 zO^)Mxus@FdndLNf&V+I`@zf_E{L~Q_b5r<2wxj-o9HR*pJS~wA1!7N+zrGaR6p>T^ z1e!l0ap++&J2s_Ik!K_;;}KinouO(*0Fkyu?;7gw9wL|Xe z2+p%ihJK{%NV|-a8Diy3!3Tt zsqNHLuj9@Wh*Tt(f#=_o_;Zd42l)gi7JP&5XYyp$&&0I^CX7qR?lFeKvebUvIK#K| zU+s;rOwMDmSTA`Uj9Z5e0I&gZbDvEOhKz(H0lh{C&+r3uj>n+{%x+G@zs31~QMP0! zK2*#;;}ep@Dn#=Z?J^(_r|1@dWNG8d2Su#TUgaMA6!O0ki4P73?xYbD4-Uz)WSt91 z3}$xAQ-yXrp{hCDV&{_&BPTFNFqDoR)Q|~R%%i{PAnArqt>M9W0QLm)jCBS)l^LaQ zr?63OIA!AQ4|ptaHVzN#x9fL6tZ(rcNV9~TucTFct<-0J04$b37B$dwtRlz};jwk; zSX5DpT7q*sx0o92$lpdd@q#H*so>^=7igYn_HB&)1zj6%hqIogU*eC`dH5Z8|DdiC zqC_Lx#IbkHmlQ4N0)$;KRnan)I$DuV$wW6m-3@LY(ud+ik_hV*(MalHJ&Dttx|AhU zjWhVrZsJ}XQ}v1-+k;LXA)i$O?h*4uOiY;KwntCpkzD%JTRT_uuN5nS(CICvd(H=UiW{Ph$UX6!yUXBC-EB3VYyxk=Xwmg+1`UNbLWO!XEfv zB=-MCVGsN-68nFnum^5Lo&Nt#?Ej6z9{67*_Wwp<5Bx6@`+uXb2mTj{{l8Jz1OJP} z{@*CZlN9M+ghE;Vnw{0A?*$akr z!}!s63y@YEz(yUdn!J*FLv3lieYit}&?)v*I`KdO_<9>~D)@c)7t+hMx#VD@U+_8) z)|{8rXM@U!kP~aO%jS>*3eWgEC*&MbwzOe;&nxQ$o-G}SNb*k8=<$7~jC2rjJOGdD z2UU4>x-f3!$en=WIzol@#XZC9VsHrYB9{8f0UJN(`c|zMM9}Y%TBA-Yu4B4K!Sjgb zBeV4skZnAGNTN?j=6ABiLTj*>JN+?S^CqnJ6=l}u;dC>BR$`SRRA;ES*O62cnl<@z z^>E`;_{T-VB=F6rYIjxoE+T*TtEa zyLG{mG@LB76DL7kuD4nvL3bJMn>kNLe9vX#6PunIhv#-_ zZME*wPA#-G;4F+9FNPJyr)+Y4^Txn&2OW1u?8Z^Zbgbf;U`%5#j5jiU;wQbVG1Z-Q z{CtMucJnEb3c5!g=Pd~n{`ql<(WD@euWWQ#GCqL|T5g}G1Jt(k5$C6qZ?mV`8zZc_ z)}s*wn7boO$%YWAqwD>H>;~4-4Q3bOlLl4<$d*w`fVws~ltnC@DUMOdsSGdF0;W&*$z`0Q7UUbX8!Rv#%vBui& z-1A`|Y`DBz%$jMEK(-DJ%Xhn5jCB>(n;C8ITkUktr)HHWC}_Ir(?6E#@~uuw$|1q2XdGO>7?yteNq{#jj*YWcM z%*e;T($AdFnc-s}2tJ7*m&Bz!X|v8_zTXl`kkq@@&M@J`Y=n^_gFa4CA`~vyc;@ou znlYW;*?~UNwbPZs?hL4DMm>-#o05A0;)j0SJ#+bO*!Dos{%hZ`cJevLn+(#$p0vi# zHGTQi<1>Pldt<_uCS~W48@qTpAn!J?PA{$_6wLXXeke(2IfQ3wiTUWvWO7_aRH{{+ zO2O1{`aMARMeosd1M(ey&b-sib45o<@vQM#be5ygI)u(npV^)C=((X_^qI>X$UEkm zWQxVgzX>__Ei+Uv=yx(9T3IO@XV*{lJ8Hp-*fs0BSv9+Ih2_czOTwlZ+G9(!>@Cmn zx)WR9Q@u*O%BP5URffvGsA#ru=DiwZ<((0p+}M#w)%ciS)<2&_0I=+F18!vUE)}|iIEX+9AO_7i6(zVn_ zbEWUhl&K8rT&{|B<)uW<<}gCNo%H3ZB~XHL?HRX46s}^@MuCjW{qRI#wcp)8+QRnp zXC$}los zjiAz1gssFjV9qpfHC5&)2-QSwF4Qvl4V9|uvg4&wV>h2a?_eWTh-z-hCk7Ep*TgOk z9w1E1I!b~3(xK0oIL#X{)8*jgj{e{nKPCDiCF^h0wna-vEd)h-gcB>A zAyz4t!xo$LX!Z<|(kHz!l0YFNwTj0fM2fUy3B)}fG=-JoYk*+#c9gFpjXG^ISLt|k zQKY4t^~9e5xl`OK>LvBa;aid|a3sl#VuzU8G9I84)eBXuV&%@W4cg0vY z_Ecl(y~FnTc@<%7c#8JNuU+2LQ18VT;6qgJ8Tb>ckL|5~?;kkUvAAtT*AfAUhm>Bv zm*G!_epKU|{O-2^)U#&CS@FFa%OXK7pk|C>_;@6qfX+IQ>bYh}UL4&QanmivZ%81B z#e=32TA1xD4~h%zStV0)ev#Qa2kj@8NR^fpLibrPRN)WFjY4q9Jw|;|2^{@+v8@AT zzlZrSl-@OaIz66?wHIo$-A14a`_)161IY!k@S^Le46iPmDj>m#^Q`^|B-<=1nsq$OuF4 z9|Y zvk(zwI|+1^)DQJKZO4l`whyIYUiH)usT`V4QKe~l3~)M9iLiY|4xS1`X&UUb04J1l zr@fh=;yE=AV?rKxLexH7?l3d*^-Z<0;Gjw@+@_>_NM_X2GxQXH;-19jRsFT%Jzx8H}L zA_FHMFJNizC-c36(E7|o(S#)Ojr;4|dA@RaJ>>oDCwbWHR#}VYHEA|_;xf;Le#-Fu zaKPH&$$8g>hPJ-rw6Zx+Dm;6730&w~h;25^iGo)q72lY|!C{VTLC)PqmOk&>eWz=D zcq)|rfpHgCGi-H51l)goO1l~_FSLue^s4Whi^lMKl`ySZKRd6exrlL#lxmX^B#K**byTKvD~F+oeYlc@GW$H+^b8GIdxUt;F*jp@&Y)2WMd zbOlUhtg>kI?5n5@hLF0KfA#v(A^e2xhVhv zhW3$9R3b4?oc$)J3ivv{p43ALVrN%q6}?h~yi95tK1Z6LuQWP9OKYcqHtGJu<5Y$x?1zP?#JSS=Xhk#O3-VFeYKFgn9BctXPy>x1gP#Ct z7`vb=5UBhoAPzDMB#;dtgRBPWX9GSVgCc0$UDi&{c1UAEiP-=u$XHNQHb4V%AB6D> zfDPFMqW%Stgd7Ih{Q{5@ZWEn~1f00nk(d|L#Ik;T-?kZgZ}Q(!pYSLF75xGzLf(KL ze}SL-JBT0$AP0U4iyQzqn~4hhv+LS_ePfaohOU zRS;bPz#ftTlwJTJL>^ZDHXUJk4-OjHL2>K2xEKuo0L908BSgxK+JAv!&_Mw}oQSBe z2BtmU;$9ykJ--+#81k<0CFw_zxzN?cOgI$cAcSEKLvzZ z1keY65ZfZ~2!fylO{A7jR6qBpa*#5h#bU9B*#N*ZJFU=y644Rtrx%P~AX()^2hYQ| zoF~4-J;A)=d7WeY$A4dZ&@0+0``2iud7<*X$`$K#Np}IBY>n-Ql;ucX=C}86cIRL| zf1VnRoXa})(_lTD%eF%Jr54IJy(9UG&z5jpdW9>VmB6$T*W!(O*H+aor#>2a4;h1H zX4k3X`r-lwvX;)CrN!##|ORF zD{r?0_Ss?B)?=%vcbPQaCP23O!!rnO6ieZ`*mcg|br$`b>+NdRiiu~I(nGt{>!A+x z^rr-XJ&^CRvLvew^0>qFuwAFB0;!3^v~SJWiz0SrY53Y-Beh2PU^7cw+WXNQn5-k3X zAPV@%BS=dhvAEu!;_7EM?)+*K{9VO;X3%Vg0ld&?WIlser4LyiA652Sw84WQ<&j{n0NxXh&lG|33 zdkZZZVw9;WOlds=kDQPkdFW29hjgUe=cK2-eAQ+;2S(?t1hr9W0Rl*7LdU5r2@~Fm zKl_qw($^J!6bSFqil$%>eD^Q>je3JQ6JR~%Z*}%vEWOMCx`oOUu5}j{G*tqi0IERh z4->@(O5gl$Na$yNkTiUD~c%9%$B_fS+k zbNJNIR6<)CQBy*@9u(p9_$K4CoLp=-3$Y!j-r^+Q1m5|5FCFn&2>|qzE$*Z3MRHq| zXJIkVD_M~1LGU_ zuUb(mrA=68CdBS1s9%6N!2Oyv9A3&v;BdJUjvG7qh{}@`c=obpF{h#w8s<`S&Lg5; zF?+yd;4X~)&s137+|`T~lc~%DivqLlH@OxT8;sFm>Ob4BdrfMF{x9;mWh+TI(Vyw} z#W8oq__nQ+kh2fcT|XK0`%djQZ4HRL@4m*44)aGFEJ?5ClMw-fzy@wXK~fLE2uja1 z_a6e6^dACu=+7S*FoBEw4}n|%KLqYBw(CCx?g+uI*G;x^;Nn4l-U;?+kTQRluw@mmmU@3cnS_x{mhqI?D3sbC7R`+=las{-K z0zTcoNQkONdW}Eoj^WM=;k{$(N0APigwCZ$+rz33yuAvF-Q2>(e&NFWiF=z`3aQ0Z zpK+2FW=*&B2?OuB4F-owrg8PRf7_u(2QNn}c8&dVK*-@bUAj(^8Z~(9_a$VMP=XhP z`FA)xR*LTXkFiQl|LfguU07GI0yDwjZP7pAEso{mf52O}37rhE9Ps~uw{&=a!P_V> zc>9e&Y!f0K*HIkJ!J}>iQ71$iW_~#A|AMzc|A4oj1w|~}ZNIz0W~K%BsmkGp-+Bhq#Mqjf{5o?P`f;g?bI0*uF65%UgmL8!9)G-fXU4KzYp%Fl9|^;+_Z-H{81;zPescj} zYbptW3o%(uKMgZlZO{tYGv$Ar=K*)_>v{cJc^{j3qy3~ScMjyW?a*=^mKhRVW0MQEe_|Zrw~*x*yyKc_Q)A&l~T@ zx+wL1>Du;BSodGx>p++0ynu{%o%IJ6`0y*>PrN($&rxSmthnFMFSNCV0+Sgw(8I@8 zt1b%m+Nw~N%uVqF_ovostuBFeRXuhCP5d&AcO)gt`|HjO?LY@&H2&k?_~*LINx**T zWfJ_{hkR=D%Wh7qE7Rq;M*EzS)gGJ>e2O{HF6$a~RI?ZAr+aU0h*ORi>oNmxjkP~Q z2(VF*zH}P}G3)#fJDLD!=TZu2A@J@s-d&s^AfopzdZ&9AJa>)t>9Y^be(7(bK8I9z&wa;K99*$_Yh;&vjIMs~G~a zPL(Rl*=Mmvf9cw!vaoL^kdS+chIV3fM0932rgf?ekx)~z3flE0@V%9bA9Rs~+DE%= zoE7!<)zPA^Jq_9lbRfOx#_4XLgjYk4@oj=2)%zD!_9x^0sa6w(f$>}nI>NbB<8gos zSz)9NMCPV%{Vv&m=~|-oZFL+AwSaFp7M?f=%fj`ZA&*2?F~T&TowqrQ_=cFHZnM?E zo1{zrc@TFk(fyXV&o$1;9%jaP!6C6)BD(Q`k}=N5TT)|FMs7I?FP`R-s3GS}d|m7l z{d=SjuKsMrEs)qd+ET-qpd%T8_VVZIzpja$%N2H?&<`JeaPFbOMFm{Ar)eNu@uM!^L@SzD$DlvYuelb)&2*;n`2E}w|B>PxX%^{ zB*T4UJ|6Zy`Nc9@6=2hY+8Iff^0)bkRYupOnEn(P@h;i6HjDhb%^M znj2ob;VM|ePb;sJXDvm`U1)+BK!jKD`g%}MLE9h_-9L%K5O_bOLN%C4@`x;v=zK>r ztZw8+ln*NbO|^O(6G{r(@RS74fAQL{$vicOY3%2WeS#8?d}Ha@dbHqueoL0h_-icq zg71&abTg=?%l_Y(&iZynjBmFb9oDNKPVtD{PO^B+0GXoGs_A17IVksG99<|M@R0`W~MnXtK{Q_ux* zF`m3E3?H7uZtT>9x^(FxtT&{J@f9gu;F)OPECUmAM%wI}C>hAumI2HpuDz=z(0eSL zIe+cip#QOJYcdfzWPK*t{@S&(WMI3N>L0sy*#e%&@SD#m7q)S>MDudA(s_9bV`L;)$sI{h5og%i(MFnvj9cvr~?LxWqqp?ZtvOLopSQAq$p@K}Y4%xEtf($-l($-|y`!||kzgaM>!OHx z1UgM07z-9y1yeVOxi)icJlV%ZQfX`<%m8U4n#ZLkNsnPUPU3JvL*=>%zx=x_NpKX25V#s z&ECIsE!p>cq`~aHa+xbn3N16e=MzA~m;FwMhKL<~0S$?KJ;cjDs0V7eAL*%qW{uEk zRHhi+gAShrO&p;|VqhjpYq)#6-zn?w}u3arzPb`j_11O6P-!?bH=2Cn&hGp8mPJIXj<)g(iy?)yM(@)sTO;2G0OLI)>-nG z&4)Za{|^>$2oUPP5L?YLO0~rIn!?i!C1O^Y&3%KHF+@P)3Ds&1C&r#H`_HIY9g?XH zYs_Rl@G@22lmXj#q7}51?$FVQTsJ#sA?MC~3%=d53)JFRTDUf93fn{pmE^UsnqjFd zFD@4;zHx4Ix70BAJ#WLG+1_h|0}oR^m=1Ie2}s)Eka9A>ECeXW%B)4zh?BL%4uWm;krg)y11u*zE&91G(B_KEIi%kbAAxGuKHzHPKQc6cRCFMpGnDF6%0A zv*r>w5(?xodb!^FVA(8vr4;MJmbKO9N|V6;5~qPy1F*hn8>k{HNa|XTGJZTnZK`%> zaT|=pzt3!{)-k>c?v^?PYA;oR(Biudn4Ml=jc~bL#9~uho41{Fv;JVMDE#r7vv`S# zO$eqLAf9#rgc*-8DnpDjpceM@ogCaNI`NTp-vh~|Mf)V<=i=gwjH&Sz+_H1G#`I~x zIxTm2372QoWP)+nP^vgc)znENfo#q)!lxpXQOw--11$d~=_E7b7Jo5_3e`L+>>)j0 z%FBtk4&@BYnVf4n__KR{0AYadY`Eut5@M&bXb@zx_CKOSQmpSw2!V}a#KkW`P|@j~ zz|^zHTWU=3-68xSnkb9?-BQ#FbU27Z2!|jU)-Xr_LK*^pN5n4%x1*18>lag&Fw19! zKMeXb%YIRLUhQ#t4)n&K%Ea#ntqfu~oON?z-Uz;{ICa<<$aMcCj3Op|-Q$9hlyBzT zT0r4(=a;*A0Xd6|y0g>3ya1d}SdKV5jrS*+PR=^;LKtz_1#N1r4}G*Uv9?(9{PaSS zT)0v4X6_|Xfs~W(p-8z*m*|<|W_v8rx{~Hf819{#Y*2uv^H3arFBaXg-6}YzHxxJ7 z5m0B$;=}!jE;X|Bd%iNpjV>b&>ib7RZ}#t_w-cS8k|e@ZiJSSq zlcV`$r!3KHXd`p zMZTgDnQ>7L#ZC?p;ghxsUbIAvt3}>VdS7TnQ6EXhJMf`3tE5Z6`;bg^Wd@E1#q0%6 zO}AnJ;ST4%f9Z9}JsKCfb+K%PMRnhlBX%>Mnf5M8c%&5j(4Ba-HM|r!Xa25dX2qC1w0u+<)qM=)r>b$%lOhQB2g#0&MeEO$&m0p$y9vdcrgBeO)_(3NWCpWTo%bwLUpX)94!g1#82Iu!A6ltzwftOp}YZW=$nSVP^K z3sdSq0$}oJ#A&_axCELjythVu#-_Lm;4u$9(}3Q}cugwLnOEr#!?ClH|?(ipuOveYUAiN#V1% z90FEu+~Fx+`&RF~WZA`DBN_cM8IOQ0*K0Gs+8`a* z3$UAI#G;6;^O91s}pxzN_f~|q{9VR^}w5i9ekTCp%Z?}F;E z7GE`=&E>k2(TH?+@RU zzq>Z%EXdM5de6#q@Rn0?;q~U!muU@^B)3_W@5H9miRF?*6fP%mdzniZsThVUw*fol z7H-y6&v>H>2e$zU1cnhc;aMzc;VnU0TmZa-Shkcms|55oRx>iwSq%uX0i@J0GGR6J zu*Fdf+?32Y1yD9{JNVcrbL?|d8c&G0{ashp-&xX-a?ayhv-Uq#=RzU;4*hr50}C03 zngOr+xpq+o*iZ*tF-oV?=E^#T(rnB-jbSM^Q=M$UXjy+R?)HzydPq z1h_+*f>t^KnkcKKgAzFQP}z>I-nAg%E&vB42gsufpa#^gcY#DcjuJ<+g-mo=xA4U& z>;gIXE1a`3PPBu5kb8_{-kGcEEM~Rhb(bDxHY}_y(rbeUQqQ*i@HTP{JYw8S4Y+a* z9Gb=NG$Z1>84Ya|ts>h#sVrmP^uy)zZ%(ky!hQXLWfGIeom7k@(i`_Qn0Q%KaTrlb zOzjDZm<6)h3{nZaen_GTNfG~YeVp%W(66LUSO3GwipwoxcR>I0{kP}yz>$6>-SK@% zV5TUnXg6w)rg3o>ZhlHID(u&`K9x8_4r6L$jqhrFykV*k-XEbe2!aHvMU?(z=kVo5 z!znxLLx&5C6hmX<6D4d4hkF?XCBa50V4M>4!I1->NdL6#Bq&g+9Na#27M;C#U*GAc zbINXqm&$q+hUL!;Y%xjFgw!-m4|AdWfsB`wW|Dm|P1k)%k9vR4wMNx$c>4 zo(3S`|KixX+fZDMO>z&$$o_TIo&!#MP9X6PGGJlJB_sGdsc(qop5hLc@QTgL;N4g% ztPg-x8d+@|SluXa4dYnctZd)5{X$KZE6M!&$-DaKUO)Z=yDXrHCHM zch2WEl@lQ=#@?FugexH3C5me-o{&v zDq0pBO$q0$xdNkY1r)jdJZQK%h8@4MHR$%}*0IkS1DWG69X}G>G5%U39&Qn~^XLYq zyo8y1Jh@ba%u&%Nb)9c!W$|F1^=b|Jom`ds8A-e0nOehJ(SKF{8BspKiSo-f&k-9~ z*Ja84TAF+Vu_TiA7%W-b^3VVi7_cPtKnd}6Y)~25T2@iZVf1(qJqy4>AoIcuGv~gN zNPtztSviO%%GRq$%KVxy&-d9tH39|r9HEPP;^#Zh)hLqd;jPglNojk07O#i@Y>Y~( z9I47Vj)KUH_?3y*97W5zCTKjfNCGM(U7vHA#dq?K!f<4C*#DVZ*s5T4)w zJJVuOB}>y2gDiK#A5QVNkWevz@YWGtUbu~huR89%uBDTKxu$FCiJpz3eTg3MYu+Ny zflnS^@&ZKR&vhVjWe@Y-LBwFgLl!#JQP;Ck4j_N5}#5^+*CL=T{(Qg zvT~@8I+TvJw@M9C`~JSfF~rJeq19e3&R=sVxlNq%S-YpF$8~J41;XK*)fM`5?_O%h zY{R7Ji@nM=*u&yr?|i+F1^FZb@E{pM$%z04$aGL|B7hx|74(=0;Djs$F((0LfSIs4 zho~IK#8$qj4mE##vhLk_BSFoxCv_GwXGtAhU4LBu z3A_H0I@doJo-+4-Z8|p=(|Ph1w+cNP>D=4p7&}LF$?U%!R*O#A z*#DDw0{F#gfzal=opffGoj-%4Hptt@(VeJ=;fnLcDdDXUuHOkG$OIzgsdz9Ag1{Zb zWC8#{5`&~n07QH-$S$jTmO^pJ3TTavvWKWN>**V>$hL#=eF(hg1ePQ1TyZ<`^DnqG zi_yOsATbBKT1;mo6zS#!!`_d^7OI{72AH zf$S4xRE6;n5y~PD-9X8=&jkokw%&#YfKGKkVvnx(fZN4NO%hIZ?4;+@H^utV!?ewa zW%ZHO(5H@a%WHwL#TaK|)5YJi3LgITYWu(D$sBk4p^rb0qF(GLw-3c0=iaCJx+ZHM zPv6n`Ex|Fe|M6OaF7jAYXJzo#)^DAs>o4svqEZ{SW;UjjGm2_H3B=~E9Xp`Brclc> zK3MvxbUFbs*oGLq?3C$`JxdI4pt&g`EApu*nsuRG&J#@^4X@MaB=t3U18KaPp&k5V z=LiDCLMnhDQvr+;m710)!3!nG+#LEP)Ru@d zN6?$Z2a&Xhwi*(ocO8GO+Jb$LU|#>;Rlm5>{!~myfeJUX>?H^uVC@2a_VH%wC%J`e z)sjB1SnmuPy%&>Tj=R5kue~=NbtD{Wc{c}A*bPLPKI-OBX`54l_b7~KTq_6Isk$47 z!5Lr+MW9`;+nX_1(APsVC~;6wOPEn!(`BcWm6hoPk|o6+gqDueM_pt2M%g!)c3L=& z%at&)6vqB~x3J|FVd$ha^0?o;!{Sepb7Ks|Lkgb$(Kg)S&*G6A1FeL|DFc}?@Y)O< z8wx#1V&6Fh5$9_#P{CDc{{k;ehJ4`yZ0y?jcfR{FcA+^#>W#oYFyn2!-u5cw;^6k5 zB(%YOi(zl6D-xm6^u!6NVggvoDEciMO0%2kj19jFv*1CJW zbslbdioO1lRmL~jb|hUdbjw%lvU^%ISZ_HYzAM%{ubRI|ofWDH8Q@d7{vcI|`sLzo zz1@{!Aef6hw&`bd+vFe^W^hIyHR|Zj)tPAQEcxuFmQ|7w;>Y0> zq58Gk=6&P}uOXF0q$9n7*66`*`Sg=@Pob!sV0Q!HwuQ6?{t1o)@WG(w7omsX+66sQ zAbZ|qEN2fNR_`OEi3G~}{uXV_4D*QnK?PqX3-uIBAK8i`xCx?#T?0o!v7iht06y>( z+0L%VggCplzskrdj;up}t*zDd`C_?gdpY`TAr{{q)*Ds(5C63OU_C>h=`uh}lqm*2Au4OWtLRdj{&S`Vf%+uEY$;b$jpPjCUfzYTG(V>ctJbXa?Jm z==0EQ(Lx@z=3pBVgX?qkDyld!5L^KDJ_RaJWI0^Z>jctVNO8elzmGvj<}CIdf0ZW5 z`Fg7-kdof%1;hH8n6;&ST61f0oA>qQES{8Pb$8W!07bp$Y+u&J;3w;NfNwwB`5OOK z?>0@d*ZITlZ1$1cyMiCn2Q0f(+U=M*8hnqNtRXz9>43@WkUaP8E5Th{p#6K@C)O=S zXeQQp zZ!$vT(f(i(jXQ#UI4gL&brc>v9@`CrpGHIwG$H}ir3x=)tR7E&_D7&XU&9i5J_~CL zBvb-X{VG+~}%$;O#7dl2=G6few z$X{ai@r}#IgwxH`<9!8iWV|R6W?ZjKC|7$u<$!%$RFioOM3}NkE1!mFTYHkSTkMI@ z6J-fh5>&3fv!VXHIthc)Q~3V9@mV!!dhh6C4V+blJc)Joo;yj=Cp3-Bo#TqHM>QoD zUJO$WS{Va08S{udz!gcRh|iw!wgj3vzGIbIb4i8jyzb>)jj%Q~Np1tu3eJ1*xM7pM!@MLWO1OaC05+!Mw>W-GrF zDs6iC({uMy6;eG^_DwkG7HtQXa~}VM4Y$49@)IY1uVh4H9WbuYuz7B4bQ|SOsn~D^ ziIb|Ib!qxuQ=W4mn3(e<_2uG`v0qVj9+A)TXY}Cou1QInEBM)I7T*F-n zh-y!Z0}HZAysAGHh3Xq29mRuw1bUr(EXc<3yu+@`fk)YiiO+PfIXT3@TNlj}hQ#vw zqbyl5KV#^5pB=(&&|=-Bl-@&{4H|0=saYR+F45x3OQ1Hqzm5}=pM8kk`KIW*;DI3G zANXs);C>k85u%u|!NQd>4^dzI3j(VKEQ+MQ6Y#`q;~MuTqHBW){?r1W8f!=X$JViJ z|D)KH9zOa9ZkJ|pt3P4HL4Bwhk-p_3%K{8HUSAQGnO71@)$RSFB(|N?9G!{vInrV0 zW1!G9KHodnA)`7kOtt*X&srH@c|12if4N6Kc_D}jwc2mB|2%ul=M_W9t)D^9?b@m4 zIt2W}+-4pE(7K_CAoem5j_MBwqHdR)F$ES2SfYo$Kbi!_)7Vz?V&+5fq?`upuBD;> zwK%c3{#u-yG-@|G3kBn|vXtaBg7F72^V#02z|3&IGAO}T-hwLqM>@s_%dwp1YyW{= zSISAA`gCh+Wy@uH?oYQ2^vg75t38##$cm2(om-cG8j2OUBi3zD?uXV+DDpz}F+RLU zkZL3Ep;QwWlpicYt0q6YMRLBR9yG9uWdXMwQG>3LwTT*TiT%-KUwVPki}8*hcT5u) zEo{T>9e#|}G@#pr|5%j@GnT z<6ygmv@Mw*l5Mdo_lGwQc@Fc$yH`3B0cw{9$vdR2Gu2X&H#D5La4;RPsoVY!fyr5V zO`*%rI!{qCF+M}4^1;U=zB62YU{mrl79~yA&o2k^zDqHkC#hE{v04gF_I{2vAA1h1 z6DF1jsZYcVH_#>~*$~#CPxE$|Ps2egDt>Q0wZ713(#obLp#iB!jjvhr_2fseI;$r^ znx@YB$nS*I^{uQciaql$Z8k0y``y`mQxmFdYzV~#g*Cs#nrrTe*nD-gf#z&g>*k&X zIRsHlc|d4Q*OZ?QP!7Y<1uE_nQI^FZD0}zy|e%P*S;uF4~=d0k58j z-Dk5Es2AT&36^iVP2XWVgcIUEQtxn!OCn&Vm8$)6ew@ag28IlwqRKRp&G~CY_!Am> z!526J)TB{~QF*Ym5gf=Dfp~Kwd0|mjJ30E8Uzmc@!sFA0QAaR-))F8k30>O4B27Pp zq`Xj&OE2+gBPh{MTpZcFQDHKYW`-2I18zej6JK$KxcqEHvuAvlDoTHH8*?%T-TE=Z zib_!A68$MxHZJC1N;~s`3K0zaZsUQxx;bZ^^Wze*bRI|$wsK~)1Z>)I|84I^UjF;U zmHffEp@sVt<_vjK4%W_P@|6CSAB6q6pE@Psb3v0U9TAY2i`3>YD$@*U>N)?KRoliI z!NTs%f6R*B#-cq<%i=uDmd=Ur$Ks0mQ_I8X$C~a`U+S7-ZtXDO!zdfcWRG??+%Rt{EFg}XgPfn?d`2=vNoP1qR7m~fZ*(g@$hBCmx_u(k= zH$C-!pGEfW4|^7V;NM#Wn9`O5p7a#A+C8j#jNQ7}B*k_&C`K_>K?=fH#K5p0YX%Oe z+7-O)3~U;3g9N6XLX=aK*3BGaloV%|jTD{Jdng^^Z@}2uw@Kia>6yh%A?uoPk8pW=+wgs;Rde?BCCklAj11`Gbx+o? zC@(7tLn5^-b9f$v+0Ahd&wde?FbIPp|v^47~DVlF$QTOUt$dOKloWT7P75U zw|c{eqJwX@&L{n@qIB_Q<NlFvZZ-ydvtuy_mi}I- zsGD_EBic?-O23w?+-1vBqqdli{vr9tR5H3Dlp{3!Gw8vEEF{*trLbP6%sS7gwWfd& z2mH2&^O!LXpRL3!=R#XECAp-Qe9Ff2Qt~>?De?mj(fE9MR9j5y#WJB5X7dJpbJm}~z3~=Tl`J8)ZIJkuFxIk-R%o?x`=NNh zLJ;1lC>+$}d~f<+T~okY!f2=l149Zobe|QfDE__*PBJb)hmQ~x{{tHj$iX-@$DI!Q z+kLisI%-Tf$AVPh@TzmFg9gQVOYpAa#+IPN6c0SQ_fb+ zM+--t%zQ=DP$Wu-GI0cq8$9j*j zfmgM%RF(U1J3<%BZbW2y>Cw==%{@dfXVHC-8`YUE%uDI=xuN?m_t4zhGYMGu`*|)T zGQJLzHM^Ky0$j7bu>~j*zk~!Cpn?xEGN%4OOPZv+oVby2fe!$LNx2$OJcNbDjFaF) znBB7o|3aGkcWRMx%mg*IF)`C1;cZM#AlIg4xbE=G*GkTUG=aoaMmTTm3Uy{3l(pWb zY8!?R@9LjEypNnecAS~6X|=xL&sA{hKWRnu-XDRNF^St3=`r@{svEzUFRgSnL$vqk z3$j~ed2q>=*Wy;(qwcDy>k}Ug(2ujibpkB8#^BL;`p!P3D!i4J(%5gd*m`<>!6dD? zhb2m{*+QS-j}UK92TZ$y5O=`WiS7qF#7u$(sAtPkZ|+rUlWZ~fXBr?mtbRYy#2bQp zVr)n@@vu9GvZcMh7r39~d|S>MR=3KpQ`V9j2VkfNP*LXT{rw#YuRFy1jJQU77Qc&m z$r%bNIG%0#;Y8vv5qSCgk39emM%X;~nnNzbw4184IT9{M0)d2|(I0q$-qjfRFf`i4 zM?;=YO9ew<;Y57Kg!Chq;;`=R#Q9gWTRz4g3Zmrv%^oO-bc7)#Tbq$URC!tn%?oqcLsl233m0cdrQvwUIU?3&&B2dJa0sSFB5 z{as#HJNDN2&qu;#NkoFcgEjKr$hQ)DH(T9aHuT)B)q$VL4_ap)*r=1s4fS}1JHsB^ zcR~yNzIH-+!v-rFQEy4p2h4hSjeq^ikq__-;`JD*1@H@gq=|+9>t6~6NL+og^urZ7 zZI8L4zve+4jU70Tba(YUI$h(jv@!2U=H7XI^s`NeYy~OdViAx;_JVh@it2(~uRp67 zEAnx#7jm};K{769b9Tr(Y=ihEvG7shy-4&X)d^M)j7q|&KnB6!WbOrDHHouwec0aH zzEqoiqX{#)!Ux~(rux)ZO7r8Q~T6JAbgN&LF!^OA3Q$BU}GjL{2> zLzXgs8{N%{0?WC$Z{?$Jc5FF|)SeW%I0LFB|4^3GQ<=zt_+ZMi*e#@ja9Xo8F*-cj zkIz`-!M^g!+!!bzx)j9xqio7-p^V$L{|vlF(3V-g98tDNFfNL@;F;JTMnAV>Mx__4J=cx0S^v zc-K_)YNv|Z)|IFVSV%?3Y1$|CeYfpEei=hmTA zSy2R!KXObAYr7807$=YQ>ke?8WIAZg#FBmhv=lv1O=9j&arUreMf_%yUA<0xZ8r7C z4zJe74#-!*4$qgw4sYe9#{zwI{PdND@$<;n5=q{aIJm=wZ9HTuXrN?l)Fodk+Klwv zFq%NYS1rX0EDFKso8Z##T1fR7XM_}WIL08U7*V}IB(U;4&s??cLb3icofPS@@l?1M z#Xi}c@l1__L%I!-oT@4j4&D5Fz&}Cm>Dka(7{)AZLX#vyY~b(t%3YWHz2BKaf)C~? z17%Xfk{Jr+VH{4t#62fh1rGh{%RvS-t|cVBd|_0SH4?YGvO1gZ(01RbaCm#Rm=n%7 zm}C)&z96o*a4x%b0<^LsG4J@4OjMsSlv}Oo>gZBuP;PRqWGDt21E-fD6@?S86_rc| zivFWkru6Mt>TStn&dIwdJ!8o&GB0zk{0FU6Oa%^C&;E~Ei7%SSnDBd;i$V=|;G@Ei zseAhqwg6nL;^?&qCsXTd&4HQa ze0p+kB8hF>YfhzK6@y5zP9mZD<|R{O0^0O9`0p1XzghE~)=bF1Q;k`3Zn?PMIo}>Z z4EfNEdj+h_*R6F!1;JjzslIBjGz!$#nwP8FzfjwtsefMPHHeVjzJ>E4j$SQTA>yp^ z?MCuO^*-Z2@b=3%Ab)$CKi0P2iU(G9BnnjBH#@%(FAe{$&qN#V6!1a8`4F+Ik2nH$ zD_?(@p_IWO5NaC)#xodT4E4V@UF7ZYS7q>+m~e}3Osrj5U3S(p_4o}p@qYq`yQS;< z>qrdkoeul}e*53)=W5GIoiwct{Eotx6$OCH?#932?gZ$I)U4emLN6+Y#PR4AtOC}Y zPJ2qybNeTMH^NJH`5I^xd((WVZvPG(2jzit5}&KGpn%t6YH+ygkjsmObHjF>^R6=u z4BDr-$?6HD)Dj2931L$}=78)8v6O&Ysi%{9RBX#ACmisnj()dYU@oiQ`45gk!xf+C z7xWq5;H+*MJSo!?eqRz|aj9u&V(f6%DV(U2D-_d!LF_#8EdTCm7DH%QgzMNH57N#O zp;Dx}lK;chJqAbGwGG>jZQGnoY$p>t6Wg|(^u)G}$s`lowr$(CldtEx->2&Pv#Ni0 zRac+qTKn1#p|LWdX9AT>iQ}pKa~!q;R!+ar(L}G%8lw9DXGsD<$-nXqQvj>iwEdT& zkP1y35BxH_1!kB~RAOo74p_D3S>rV{@(7BYzT&^$HP{rvI{>An-Lln&P2(zNL~Gf; zT#}+4_NR)QFjSO;EBRcD+FVVtv6qXE5UcOv$;QawFMr(`G8|y&6O+8jy!?F^y1he& z?EN4#+<&=3|KBnVAQXa|j($%KuV#tf&P5?AVyNM%Eqx&4ZCh-kiDkj-UU3*{*Ajq6 ze*TH3xv<$Rmho%__k$!1HC7Ib=e}uVjN;)JLE`N+?T(4( zH5-|}s8Ij?$C{D4pemvqx%TC=aaWGHAu`}fUkEaKXRl?s1^H@-!=9x)o2*D-{|W!b z2=KNCPLst<{8$2<{5Xf6wTv8YqhIYyL6qWKlIVKpu@9asJCKLq(h~y}j%CMS$)e`G1~d#6N4bOQqzw0>z&(QxoNsb|whM(8}Jjs2^=vZum8NUf>|s&(n)eTc9GgL{#zwS;z0tZ@k_NYtmvpBgg0IRl4D0V8ksV}C zy0%KA7Z@3^)8w^+>=>gL%GDE{6BiIM9I|`Uzh}_j8>Hu2N~e5v=LW4#TZ2kuEYyDp zD|s2dXjrgMpk_xG0E&vyl)+T{YKJ{wQ#*44V(pfNMOmKA-7D*&A&JXsn))t^0RymSyWj`cZoZ^^ zc?rDy=S$i&nIQk`YtOhatbu*)RxGfuJ^MXo6pHbI`!BCu0_L?auW0|vYn`MWbA+}# zkbu5qA~LggS{i&GtIjp4Xq82HXhuo?58B!CqE>fzQKM!uykBx*Q%2Xe8&mCMNO-_D z2W$A7uruJGXcWqQV?+64ib>{FxW-|lM<|5af;yV}(YRC`$4JH{G?F~#3+m4>k_>@A z-T>1RF8%8jPyTF_`Mtl9K6U7v3-oqup`L(%!txYJlw%Za)`7DWL;$sRoM9kF3J+OiM$@;E)NqS*&vR$u z<<6Y1-hpokfDZ%QY%j_tbwi;lmfAgL<~M$W*(3>w-`%E0@sx-#ymDhvez6wur`QEvB?m~YfCJh8(j=7xSB;Ny?h0xQ+kvOVC{zgSY z^|V@O%hcz;Pmr0h9oi_Wz3bJUZq~3vkV>aLfFgvVVh2gX0~iWXUzqVo=3Z#QB9@@H zR~^O`xk0FBPEb9@T)Wa9W&F-S9K!*z*7y}D_(A?S!`I+)8%KH6)J}rpd_QILxD(4JWYe4X z++q0W1b!Cu$@*Kj%gE`7jqWPE>@1oM5RnOQ4Z|YWhO7O4&xiQn?!?1zZwru*sD>Q) z$Y=eTCzm$g(ukzRjF+ql5mghHMNH0?%XDubOS`t9iOCW!f1m`N4aIop`W1>a{0$^G@4B`|UniUg|RqD2o^j z{8n%@Kk8{gUsoKyy=1u3Q3qrT!;nB_ybgvQv%UKBeto(#k@njia+G>f;KGr&7H>wpOLD`B8u zoXOVo>@RvNO7vwH6T#7F)_4J0*YjbcDLW8hDpBJd0C5r=UgP(D`O(}8eE(tb+2eANnuGi zRw>}uzD1s*5^ts-)oER#j2;3fOgad$3W0I4*o-+5smOixRW<(JI!$7R5|p@emv81W zr9Mds6mEW6@JWmF1@muHg0Ge9 zfDdyTR=>d>QhKkJ;wyf~)}1eM1Nq3^)Q2*oaqREgOXNXDd`EXD)nBpnnma?lNAw~Fgm3mMf`*@0NtFGWQ!7=mp#Ujqf)*gMb)tHo z2D;A6(uD-68PRaNQ9TxC>tAvKAAK4DnnXTT3C+q@wKWjz7A*x>^HGo(9R^0&VaIN0 zOe(!|>3Jo5)Y)CEtS{5hd!p&cat6D1hn=%d*%$>x=}bfk?GMl+cr}t)@Z6GYP&vjP zD9X}1_6#+>_fT2O-T+Kq42q~X`E`v-$ERQas#~qa>rCWyV0Fvo2+juwkwl0LkH-X=sdw!C{4N(gcJqQ*cBmGxL&F*&J6|u&Mhz}`EQcpf`QT`xF=AW93W1P z0sNyT^EduVoW|r)!IvVMW7re*^1z}#84zjs^tC$f$6*eBUw|;;G-M3oKBAM$gWB5< z?v^+lGu298y}}y2uwNe&ayLs;Z2kvL2HQg-=zl3UD>5^Q!K6YN4-Hid#O(akB^u}A z2%IETz}I_rke~h`;S7c%kY=1ZQ~e1bX4IMCjvIPum=L7z$TZVB9;FK9WsF(*Y7ss;T3}PtX9G6 z=7=TL$flXLYYhbS2XZpPDdWj`x8qy}aKu?!Fa9(p>~;P?d|2!_Ke-?{S;2V+P^&@H z3oN$vU~1R(@R_J5#f!r(QfZj@By9Udta^daCIE|bYx-Im`__0hEA=`|b7`GXs;X3H z5Dc#2(5CS+lP56A)k`*}haA>J(fkN8H_Po39sI?*<>=GGarPn0=~}nLP;NlYG~S79zLH-Dc%mo0GdQC_T78l&Bsj_c|X%L z8(``n8w&wUa-qo()=T<49^_}h0a;=oshxh|7F0TMFC1v!W_%p`#4IJgt?|Tv9M-ozwQI^jO{O z1cbl-LnZC6zP}Ln6BaJk0E67-HycV|k=t%#IbshCa)168?+o(ahSqpRhIjL-A33I$Z?H_tzuoag=$v5(e|mVY zIiXJ@hS76=Q0E9dEPY7S6s6fj72z-DP{9R;+$gWOXw!R(+#ygYP(1O*OH)Q9+qbfP zG}s>Aesw+lSKvxtblPz27Av`3$&TY^EKYX~=)M4`fD>=Ax02CD;9-j9B{V`LNJ3~` zwR;NQeBQ)|Tx$xJb?9D<7oVJkvc=mGNP6g8F$QNLzp}p8L?ghU&5Px zyU3e4v)>uDj!U5JpK-0H1y_CDf6K?_(}I9DGcm#9Dc=m$`{h-O*P2u8ZU~-poMZlK z_-h%(R7=tl>=S88FI$4X3!}$hH;0ERMl8z6OdtrlaXCep^B7Vo7_i(^ z_K0GX@)A5ge&vdLd4>(`btNDPQLA`StqtNKsoRC941nag#d#Zm7v@Uot{e^9NDh8tPvK%? z>03y(SLhE%jg@kRIIx6xkk1BAQnLGVwuwrz={M*@5s`$}#Z_Eh=?{PNd#Tdxk~Vif z8bjo@D?nW~ZI4YAV{1ZFOw)NH(wlsieZ+%JotJRA9?BWVXNOj+P>}0jL0jW5`BvMg z&IsjQ&gx%NPpks-9hvE*p1=s%TeaO?*WI!EX@SnTrXy0bk)mg-HTG@o7cpnZkV%&v z0`@wNk9@puyb)%#3=V$%YJo@6i7lL&ao}Q(1HdN3D)7%ZEu6$E!I+AKA&R8$;mF%@ z%t^*?V1}$7u|O_6tn2hi827J2M!q}C2Uf^4>U6Ha3R%M~W9MImyzlikcB()1Uxlpu z1F|m~pTj)x4_K~61BH*`b-y+lB(53jp*Lt%b%Zr^Ivh%sOSiJ|G_@LyG&kl5fOQdv z=8ucOEQA}4?=P}q5ggPc3n=`;@6$dJK6Z*WaRp!b?NT*&BPMViYG0A3lY$(KU!5=U z)_hXQQd2;XA(UNmJ3(ujZ(!ilrQt%LtQLRjZ>hM&3c}Fldn$)*?jK57w^`oFEc$kS zv=)iu=w^N%m8bB>C?>Lcm5wDgKp9;cKM8ntok8`;%q~d`tgl3(0A(u&ns4mG@Z_K? z_$1O;;*uN6xWV=-Upi}_0sAGV23BzMiAxM9_O?lTj6>b|McnMKYP$pgD*mk%n4bGv zi}{MVg~(+%zbV?s&DNLS*ir7_fuh9cK_vCT7}Iv@X16%96yn8OL4IfkK-)*4`?nGB zI^6-%Ad?kas($4D65GRm3mB>hU?d}MYKM=Qbub{UUk|63Z10lXo5y6i>K4Jw8fIvX z(Pc?16W63>Smz17DLSbY3$Ue>D`&AB$LlyCkyvzer0w$)*c}BP4Ux-{QG}4R~=%KDsC2zWs$JV|p;@8X0 z*TJ)-jE{!(ZFk8*UV-2LtsZGvLAP^Zif;r-!i^*E$cgQtWf{t+FK!hw+WtlxJ^^d4 zizgp?9?9YoU0%ue##Ri1@stcT6@-tQT!G$(Nf>tov58#73-EK;qIoZtwz_lAe=#kt z!&BT3=a#wsl)tEp%{CSfFPp5d%Sb=4S^tWip<>$Nk|^bRMslsSt#E1ZldCWEUb{5c zJft8kh;lib6-vRnHS}MHoFJa|Ux&=nSYUA;8+_2Khp$24(xEyt7pq0PpD9g{YQD}b6MvEWiFBO#3J0};f{x|;DW?oA@Gt)?@8>ZueiMkwz9&o^~%EE$_(iw%P+Df5%HaBW_(0m+( zndsOO6+&e7)>^$PVaI3L#J;YaVh4JDd^`XYf7I3Q+cVghYi?YjZOpSraZ-i`QziBe z^66s!)xk-0!RI87wI$(tB2shZ{@Hj8eh*YkF8oAFU@uGtCNia-uni$=@>zH5g}w|> z^qeRh?P!v=(%6bd5U80M`%N-IOBL-J2NXT8G7aXR6I905KYmma&9^OEZRU->ivk8| zY4e({GyBV0^;o4|c8pzUvfQxMThqLA9whmxXVUvN5ZQwp0_}eGW9xd6giRg~eQIdL zz-qBWhQbpkrc9F^v{okKD5O({C?@CiS(;;JX&Z(Xf7EawM?w<-L^GT|z5Vk-4suqv z{;oYm$qY8K=CnMVt)!~gHGXJBCjtgy`6sTQFBGau&n)pz5%}L%Jv*vD5+MuHfzdav zRR`iT`X&_2Rr)5+PNXr#!J>Bv9NkIHm1E$W&EB28?4!WyJL9tqs>dn0dlH1~!8x8C z6^D~e%9x}w?`&<3^4WDK2S9asOjHf>Tn`Xwn>{f^m+U*{boEH*+K~aj>V%FPtdk-v zp5p98!*8{$WUG#sQ9$l`O4~)`6~wuI3}?UZHxBABk7ha4BRsj(n}1KCTS4B<0E2+5 zw!?`=ozJLIm~AuG<&cx#D%d<&Dl~%i{<+zNS~2qTHO;4I$<)ft3vlb8`3?#+Jst0w zkWG;dz)m;$_AfH1nznA|LGa9*ux<+Cw_MsX3Kqd^GevseF2PmU94m{xfT zcovMac7ig!k~9{F8p3{mxp%E#b`+s6eBd3r?z`rf+U?FQq8Qb+tXSO6cHe>ZFID{} zc56Lq?p()Cdrb}i>=OE=fz5;GF{12`7T9gC+(WF_vCED&;zgM&_P5hk`wI27sb?$v z!hfh|Y#y5DRMf6*$Aw-j&eUsIO_|ouNL=Dt-2moP-M9jjMclR{y}}F^gpE516h%kf!U0?i<#@m==IN?B*Vi+n*(G#^OlE?456* zVkk)S{~Z|GwZ9Ux7OcPp&xsDKwvIBpi$k!#kIhN{;kk8QD$}FJtbqN^i|@L^LAnnz z3B8HEDi!6-Mdw|&9@xxz;F}*TSjSkOsI@P+az1S!^SEwwCMAx;iSnjIS5o}@iek62 z{D9Xv7yv{)1JdSx;x%@|Zj^klEh;zVC=F>nF5~g;E-dZqx25tggRt5OU%g1Y>+VansS-QeoM#i2-ui$M-}%KO%*z)lDjgfY+7n zGtzFz^j%vX;CA2IOoy8qB|@4#Kf{VC(FQmWd)_2NOt~!cD_BBe>Dd>r9kDCuFaP5} z8KZ;$<3Nx9<3R0SfgEV+KMr&*n`%*alarf#s8Di+xuuxn$4jRZtu>Djss)e(l>)Rk z>J9X3$kzisP>7hGm7a`0kSjB-HL|}1FwcuMjRMBtmT#Uxgsv#L+5MOVhPX2$M$8L( zJCt%cL5ZCw6ftuuP7yes4@ZRPbX;K%#2hTFvdS#g`qoME=5Zy1{NSY7=-}UKYonS9 zaS*F3kM1DM?gdzjqO;KAPufb1CjeIB+7lLKxVG%SeUHr87~Ya2vzEE5TKP8!TBgn4 z4lXZW;r7wv-}gfSU%Y8YVh~fYsCX;@K?wLCeDnAPb_&G~jhqDAiK7ThHz%;xUgzapEt|{Cra;&t#7}21}o8L0LfsJlQ z^B{>DuG2s|5Ir67P!rcGFUB?LyCoSl#Nl+?1qT$SLjwuWU#WGVpPx@HAcEtN9?aO= zLk7Q|mXHOb)iiMGWNz^^xY)^ha=BlF?P)GA*rM%$KMi}Ws3Do#6hT-|)28|4OCjZ+ zCk94h`q{+^iOb5$Jx{@P@jE}iz0}KUR6KzD`@LYDv%x9K%vkfm&#@R&1MzUIA=*vB zfE5Y!x$2h^2jA53&6Ag}qR=DMhfo$N)41p%U!UC7x1)s-d$mr9yGOEfF_COTWgTwYa`2kP_oi`Sw#XN#SSR7F z&(hLmRnJl0WM;P>5T+f-Z*n~TK$0kNhxf95w#bd0~O z!}V(<#BTe;qpywzW-(4&a1#b_CyQ_d9f!;8lN^@IX$N##FA3w^QhnvS< z-QTrI_<6Xbx?d4Ovg*LL<)&`cqT&Eb*FFSadbnhpfz&6jR<6nRj5n1ri5#@}6n?^H z^w?LDcKgR%(Rf&!2+E7n=~e+ip?S&t2l>-__LBOF1pU?4Nf1pqg7liMfQ zT_yTCkHICi*LfBB^bWnUdNT1i0Xp-0P|gk31h(G@*~)@Y(ArPfWIv~p5^`-Tb_AE zd9T3r5x^iyNkh)@6I&x_W7@@H4-o2dEM>!9|QQD&AO@<%5Dg)fIh zCbVh!T>UC|#V+8M4u0*f4{wmFP74xoQ7{gBUB|q7PU9Y`_|Lit0x|98?2nv~1FcBT zSk`BWKOsNq*5h!dEEKlPxi<*V-PWs(Z~Mk_U1HfgMgZzi>8jza)o2Iiidf96$||WX z%|SZ>uFBMMn)sZvps3#k4QJ*w;~Ro9Vo%F^nO+X@q7DG|79nueNZRzH&j2TIuT7|f zDr=g>LQ?{5Z`Yy?hu>C+r}2|GbF_L^ZDzBwQ@zshStPxJH%r(USs83hLXh-$Q)qj=YISXK-rd4xc4fP9{g2`Z7LAK^L(1{91xGLfApwCiwml9toaW9wkI#CZ<$lyrKi9{oc|-z!EseGXm$d z979hblQ)Gw{Dxqg8k>MY4$)gvQ=D1^5B%fjxxyRuW4$V~+KH3S2-=tuLE~246HL$+ zelXl4g#m>NAqw1JWZefZv|BD%Xo;ip!R#OzH^5{f@Exf+^Pkf8p_*TTGnF*HQ<->9 zNjc|<1uqrUg1f8UKAJwjDxoEJL%`y6V0dhRvwf?dKBFhK8FG-R)awAA+C@)U4o(1E zeO7F+ba>(T3`*9gW*FGU4Q0;!QoNi5osYV5JMOj^tM9Cth)T1sI!jcl?vAYZRnenJU*`t~=dSHrP3x!EOj}l?UbLs~!C6nNeH5$>~ zJgt9J8(DNHY?D-vl!oT2%s3ln3aA5Eql2>EMGJWK0xy4lxKiC#!@ZwhruF(AR5foG zb4MOdf)k}KMT?%z+f`Ob{jsgvFPv|xw#lt_gYRN!O)>b27@}J%`f)(xSI4|g?Ohic zN8~5Q^-kw!L!ZXl@0QkBV2-S)dbviwd2L*5oxM z)kSL^*J3}KGwVBhh=_`M6Vy{rc2suPtbM<&cBv4R<>A+v$NON(`&nx|sx4r}Khp6s zFp>gOTqTt{B#2E2K;)y4N{%OlGAiAA^wwJn`HSt~T8C_wJmE|KZl5-PIq4t*tABS_ zJJXT_9e67#qU`dXtJQ`*9+TC&$*iy zjC^O-Q@NCRWWdTah@mMOyA9Y@v3o1lOb0Ed_5+t(+d#qc<~(a$+{mh&9#S z18L{KIGGyKrD?m16%OyN+dkEQSlu#cC9hH^r)+8f6{LABFW@|7HP!hKR#y2P zwkBrI`X^_*oT_|{^*r}7`LqeaGv1gVy%bEzaN?1l;AvI$%l5zbOlrW zSzYo44L`Z%Z5_7unJ5vocwUq3jFj|K9s}aeGfK1G{$uxSyqq1^RMkP^JLo=_5Ik+# zVqLPz=AqyfBLaJrJRJ>`Iq)vI3qIDx!9x-bNacW|2@;mmlJFo$70(>PV-l56!L@w= zF8mBBSlkQP&5sRmPi<%}EgArKfF)c9SAZ|~^Pi2JS(nW7OG1Jl5H8R<%4mHt(-#xV zCeeF+Sw|6#(nEgrUk9{hngb1Q?9PuF+;43oSsxW>#%;4|L#mEZGUB$AoE<519%|`% za-3#Fw5f#btH2tBs#Irp&L2mh@+1ea_^qZgKH_3D!%n4qM1V1IP_*!>4E2vD@ueHl z4vFPmjX%1k_5F$BNx}k}E1XI0J-n0(tQQ^7st$UZRRLv6$l2(b`!YaK zk#<9t{ctVdOGr@fhOyiN$LL3+i-Z)q`3jrv#}YzMv@vX!U&!F3dPXo`4pahUA9iMQ z2kb}nv-?%8l-gYxnz&2+0gbAoy|$3>2#j$2ZKH_;fBqfRW?F$ie=GuPceia&DL#|l z0&?K_95Bc5)ut&o3ECq{52y|{1dZOc=PtnJ$k+5j3 zSyKDR1`B0N6?s@nphwjP0o!5~8 zUg3iaMxE93`S?*f&Lo&aw6xo~UWP6x^D4v_0??|fFn9ami~SC?tk7Ek^J}X(CCe1a zA+YZ}$Ysj!BU3E#?K${y;63(hj=wx?Igk*J;GD19II*CA4Y|z@SlIJK6XncpAn)7! zl#w^dN}TnidFT-vOOXM2+g3pq%wVAj0sE+j0Xp9f(!jIYc-z^UHP3C0+jhvEWtMG7 zQ0~~DL^y-%o_0yCxe2+*YwGkI0~W)L+&uD(p9Z@rRv4^+-JoJhH+p5pj?FZyS6QQ0 zob#W}dIJv39>{xxwGCYF`hU3IS-XzjT2no(FJ8?x+BSVotZ9+9%Jlulusia-S}@#o zqi=F8oxzX5?%@C*^Ld`TJ4_9eTFslBN$R@3u6e|Dd{a2@dWAbrgyZN&xxFIAN} z?ZIb_2PYk9KFyoh4mP6^B0^6zSPyo3vP-GanHWSG`OdE0?`a&(_T(>HJ!)ceT$}&x zd*Qqx%FSA@yDLIWW00=))mUZzd&4badpK!bbBk=6)b>)}BtlOk;AGON0|6Vf9e=~Z zjND;^H^)XhVGsV`8%R|oMZ-!(#KeXN*#4uq&j-X!P_k@X|56`~SY}d{WxQkmO!Q6K z7NU1w0N!2YpTBE15kT~%yAl&*f6>);xB>(gtp9G$7Y9<@3;zx*IM_ZmJow2(Efi#Y z;`|$+#H>WWu++nePw*9?1*V}??ntN>O&|gJoNQADjePld;AbO=T@|M1WdP_JC8zg1 z?@$EB*RtB>23N#6p{NLVVgSRob<5sQHc@-vO}(rH#=Yn@aKoqj7SMQxKu2TdS7rI% zLmr0fYI!QjOuPgJ*bCwY8AJwezOp%L(IyL$|1F;ocq7GyFPbn7PduY_<7X6Xf<#@6 zn+pdeP2OjPHQ6s}hjDz$XBoUBi zBv;+Vi87r(KW_GYau4s3pqgz0H=lWWqGLNs#=Zs6y9ppH2Zl&EiBE!PE=ZsFISv`Xu( zY4Z$F>LxW!{#(XpIBuA<1KGAtMO1UOp7syw?kdxYuQXS_Xl65NqbR05F@k;zYRf3n z6wzwncx#&pGt1l$k4nYEMkmsGy@`U|>FOBGjebF}L>@G$mCiJ*JDkUDqXyL14{$X| zbM43vI!;|(!@QBJKU6;Bk$%xOt^QnIN^(*-LFZ3?m@|uPtqezLoT?pEwJ8MSr{Zm( zF8`T=MwFUsi$P%C{h6KcPu?cSOt~xIwUyx8wM|0Kx5?zBwH&mq9V$c{>wW)E-UcV1 zzNo)cLWvoff#;bc|8pIj_DlUuk&3hDlf5gFWLLKV2yct`wT(#jL+hF}x*~N9Pc@|u zs@r0_Vh7-)p5P{Al*K8le$c z+f_GPn$=g9DQ>8O;=1MWgt9Q9jK;$twwl_g+sMULeoO8Wk@CTz>35~fZDgXmgMDo0 zY7*6v(GxogG?1+h%Vmr$@UQp)1_sHS__i(RJd%OWLLT1BD|NHAm`Kh4t{KBb4oP+f z_Aya9v{U$;ZQ87T=vjC&NH5=s#{ayKki4j@n65NXVx5jHr41+8f|Iv~7J`(U6cLLj z{4L;~dGHrX3oEhMGn~#%@oXcNWB#L8RA&HRIQEk!#kv~V&tzXI7PQ~TdES%Ts(BJy+4B{Q@5GEa6|fvbkkC zIj?s=LeibHpSL{aUA;I0aqTz#D*KLbiOyH~*Y3?Dz~qa&1ta>Bn*iU}>ov0q7flL) zl1Wg}@ZLOwxf+ec#>O93yz!S91^&}sZ(_z%x6^4{`~iZ$i1%38z}I3g%p3jQW8wO$ zce!6KfUf@jv-d&gz8%%RQ{7hiGv|Euu^)1vEkmy#daHCK)mB8mlSH*Gm>hvqw48Gc zn@>(d(D^}2>GG)vWYxBRiE9LjsXaLv4g&mDty_w)%lmqy4hib9I0FI1vM2gdR%Lo_ zJo3|7?h7#|a@rdXKE?twMHZbL^fi@27X2rgaic_H!n6%*^%_C_(8~h&o)Zzy6s`KN zmC-wd4k5)SRIk))M+{QH&}a}M2FbW!!k+JYDOkm~=~6KIDzF`AMO&hL!O&Xc>9EQ5 zXTom^r-XxE)1}H4JPZFV1w0D^Whcf7N11qyW;Hvu<*lkiBn09C`;Br7O4kP4CN;k5~YRN0MW00+!84(bW7P7S7G)OKE5R&ZV_5B}nebn@XS6YLk z8pDsU|9i8=qL;K@R_QYQ81hjS{0f(->jl+d19Xw_|CS%_Ahbf9xB67Qqig|yA0BC~ z{inmFi;?H&T2}>pqZT0MeUx`rF9dws5>h6r-g{VW3i`U9KlL`a z=~D?8Fz^8>C#DEWH($i3lm$^rkno%_ zG8H!+I?jxh`ews?P(e}Wp6nxaKUCP+qHS9CVn4icg8AP&0HBy`A+bkBM*{7{z^%<{ zw}>=>_$~YX$ctFyJcmJ_{EwA8UBuG)~+XHyaU*G7WpC;tfg`<4xjves@|I>2A#L&_;w0z*EY8SqICfui;9 z=R_xZi$0j%8Bu;dXNvvlOt?ra?ZF5Mh^$MYM0pyF5>-gA^cG7oo_GAU%Ig{EWdSso z3t*o0xo0@^qb~5h#8iuL#ce#pJq3;UcLx!6ESnxpE%-mt`o`q;bNA@2d|HrZ4XQrC zk&eThs2Dpo^ev{(e(1D%?{U7S?U*35Xw}7x02rCfi}zS(E+xjNvh||d*3m1=Ef$hS z4>K=xT>X+147IT{VQ*!7_W);##k)O3%m8O$h|duTmbF zj}kh+w^b^Y*MNL~j2L!pkfLo;wxAOFcg(Ix)1=VD@y5}F&b7)EEfOoPaJ}?R?xh#_AW7E935s{H2EeorHI7al8<1A%wFOG&9$Sng*iD z%M6F{d$KI4V8zG1#NW?qa_~5fW7C11xrpl{+HYb)pom75{0<+`NhFTvC|JJc%?> zvSkqhAlE)q|Ab(()0(<}gxm_SW_}o`*+}3&4${1-*i$U`$2;&79Q|`&5z7!ssB~|h zSDzZFLku!Qek@b}d9~LJGDbV#3FiOAlY|Z_E6{&#XvBap<dHr$MS&%eq&J1*fZ#IGa9N{m)1h1E8 zK10Dkra|T+hoZfa=G@-c@7EwrEE9#E7S7{DbV+w71$Y97+EnyzZYVp^N`YK7v$bw< zDePG`!Xb!C8mD33tu{*m6#7&JriV3CK+4bS6CS%v^7A3k)a5jJT`w54V{|xXsQ>)w zmy|LQY7|&%xL67s$+-oDUh;$|;k%#~{**~46N?}9pJ^HHxvC2ip`G9Cn@RyB^_fa2 zKivKHsb*G0wgSidg7s-{&ffRc60-z~l^Ac$eGp3RoEMAkGSG>1RT2IV00%(&~gYZ@foJy@wW2 zf@lmEp_vH8bx^+1zqiDR?+;o0l07Phq0uA$W!=XtasZMgS}d_mzw}|W%J@9bq zPasK?^!;Z0QOvsoqdd?C)qm%&nhU8cw0Q zej?ISo|0)r+0YLE)2`>YMoyZ6+BI!27RFQPq^LiKp;D^JH5Mk|kBz#y>hO1#z;J+6 z7|fntG3|oN(_CU?CP@ODo*LFOTl?L(DUu(xkElJ&*w2=OhpTpd*%WKKv*@q>yW;(# zztieGlrP3gp@hFMV+97Xv!RdV9YjdS+S=NkbzPxIe|6ukGRd|JirvOs0oKR!&Fuy> z)aprejFvRQE$jXOLd#*SyrM|1I6GcMVy7df+}KaX2zWaA8*_VCim)X*v-0o!xA6{Y z+rE$QIDvwo%KQ{kEN2~nO4Pm*CPZ}4@%rxb=#>vOc?@c{e@JY|UH_6SB5j2UnPW+1A+%K7++GEbxjNKpObB`J@69(W6nJQ%;o+ zCa|Gc8O+@NCzU3_K!Qg)#>64cJ7`kmpA#{<$39CRh9Y(UbL#=lM1b0DEe1K7()>qsJ^#`(~Xu-@C@KI2v6 z)TqTq)GF(e2u!%Xd6E?EUS_{BOcAN|51{$sN4H<`kSM%qv7iSMo6yMitOI2s2Q>`9 zUGIIgj6U-~nI_OYUjkhx4C&&XbgVeOg|R~Yu5kVWaKb(!8^fA;UUx|E%9o4`qRrr_BlQ}Z%lg!|F#Ow&m(gt_6^ux{JI~ZN5o-4*NUGh2_w+wE8Ly`aavefLe7chYe z9N6v$AohRfauKCo-&ntEor$^yIZCX}dEhV{lYmF1aU8<=#NSP;i^S-59ozlc&%yi3 zk0lR55u`_ftM~)M5kt~0vtV}%O{&;xXW3()WkhEk8%htkr_T!?clPR0tj1^ zkq(IvPirQM1X6zmW+jkuPkTvOXc(&uZheOY;L^BGvoueQ4OLtBfG+Lx=!o(4EOs#3 zf|hFb)b`bAf~(~I{8dVq!p30WQZuY5m$r)+^61ky-I;n$zU7FMfmYC*&QZVEqOPfc zkN#QnTb1jnU;P_Kf&D4M{>8lv20(@9N4?l$klSyf65fD}?|(V6eztqUoKc9b2YMRZ z01(dx<3-eP>QvCfHh>cLVOABJKVDQKHW+a_W2&X8RhKqSQq7k6Rd?Z~|87*&s$&yzkZhoDXkk zBO7~fIk^C9(AJ$kJ9dGalmYxbx6i32crg1RAbHRxtxXzZrDvAX^_2I8O1FFf}gq>kR*%R|&jZzzA1 zzB|?HJ;GG*IW+G?UHXxjJDWJ2es=GD(^IG46u;^4pg(4Ka{&Y5?l7H8cQX~_Hvp&=Dj(ree$o_;0R z934L~vol`wVeOmDavos7^`qkKUlGYKN}jy3GtZ;-_DQjKZAAn_J9dBD#Bs@G_^ z;FCT>HwUZbPpljB6M&Gm{?0woTvE{cx!Dm8^p)b{7R#3dq>?q0L48{Yly||bN8}tKuhbk z_77#3|C+Jr#M3~+9ds-IBwbiZ0>8DM#lvn#81@zCof1DzBH_d7b7!fjuZ2144qd$5 zoV-iLRSW8ZEf4%ALDiJ!gfqfh?Aso z{XW;@bzc98cp$^5mN~;t!#jfp0dG*jbk4Tn{GaE*7r%Zb`YoA8t@C8|eyK5i?CWb2 zJCEMi<9?f>LZ0jnD8V4od}7O5eP5 zpw0o9*sqv!$P{uctp3oBhVYquPjrQjb`fBkCbA{CSa6Xr%&kGUEE@y^XPpJMdhQ>o9}Zn9O3mp}yn`aQ(MFcyFoO5BNA}l--GDUbl4}o!XA^ zN8nqH3l9ccQJ+>N@Es}XQLl#HI~9ir{HEFZGEXizoq%0JF5tq{!TSApM`FCHOL9LbBap#;3gMl@T;$DNeDtRA{5`NS=1G zP>EV=rI+}TGr<0G!M`@Gt?yk z#h05mc|rU(T~lsF5Osi#&SU9Kp3PbXo^xKuPTIw~iBrfLV6VUS{A6_khPsFwdASP4 zbJEEC`b|E3s~b#UYwB6?$<8cfpI>JAO7&*bbz=Z@OT8*;;E};>B>@6(CU9vF?zfIZ zl=#ugtm9yO%`NsQ7NOb=B*UkzB6oilHPNO;BWii~)>xJzrT|!qX$UNxzbg|43zIyg zQ(yh&EwYYrOWW6_Rf}aJbsu?g7s|oW!r~vV3Vrm)mC&!4Hytf8T(Jxx1`K>9o?S4O z0r;!Rx60t$U@;Lm?Uu6;Q{a3G780(7d(iE}F-+1X(yk!ed%sl@ntT&#p9NKj7S7ek zr#Voen9?xLO9ITkNTM(2--AYEAsLD)7U0^%)e7Cw-nIzW2uFN|-ck)rQYX^hYke@5 z@_sG1zrP()E_oz;OU$9AU_`c#>!xhT^Nfi6II&vuRWs$x`KcN`U5gvj@xo}kDj*}1 zc3$Y7#jWk(P2m(fjqm8~^7j(`0@qN~qQtApQca!7TL=KfW8Pzs_3@VE-g&O#zpVrg;;K^bh(qpx5U;Q1@cHaExd!n$ zgtP%3Z)>*+3phFn;Q9mkFX8k$bynf)?pg$l-n$kvzMVwKeL>ue z!w`U2*}!)Qyn>n3`!4F8Y2Vmm!CMw!xk|*&#v>L280ds@?Ao-}(aN7$=l{O*JHFA? zU8*Yj!!ZQ;q)Fxfqv|f(;!v_i4U<4{3GN;sxVtAnaJS&@?%rr{Cp7Nv?h@SH-QC^c zG}(LRo%5ys0Nq?&RnNMMe+*t2goamu(D1Zb2c&dvx$rOH4DD8RhK~jo!V~j^a6{&M zc??98k-m1k-Xr&ng@XMtZG-Da^$fp7xz^BbaOnUj3J}5N`ccGHx;L6Xmz{G51XB!W zY?<6Ie7xju(mr=h3+|Dg6m>&YJoY@OT$K<`vfdiOUf6Z6Eu4x{tc4=oT9#RYxd&hP z`*+`8maO2Uvl1d*7MFAZmNcj+i3nywv zemer>UZ?NMKbDwY(h53@uNZYd5Zqg-^e4o3JjBzvX%07I44A?={Xl>%w>5_2RJJJ(l#aOt~{2vk~2k zzI7z*S1#VL0g-cc-8X30Ogc-&NM$uu$XM`${k2ul-cnEGR0D z&6yRuEU6MJ=dvg9hAAY584ijsm%_r(ZLc>i=5l*cNgilU%5bCjMoJ3K7I*XvP(1$> zf5b;DwuEQ6pU$167ZQ+f`L<`R2=o4h%!(5 zmIN3`9IrtvJI{9?1rdgLYun}O&#-}Emc~5xM|0Km|as+;fT+gwLzYt&W|TeWHUPnf*UVyXRhq5cA3>cSfY! ze5ZV2b-Vm)7_Ab?`r;f-vJ)y(6|tvQ@x?R-5AZ$DupkLQsmY04>cd{kGWi2-K;Bf2 zmz#FZbtt#&2x<#})E+o|pE|3qvW|;E1Mw4(t^O-EgE!8Tup$zF0V>wg3U)nmK{By3@yh)E*1>hu_Tg5!1!&S3<;Z|~@hg*T2zxkGB$@P4O1ObU>bqf8DkHwlNZDK399*ia38e$7>?m^E7#;o zYrzApN)=%@>nCV5ofQTg(gIff^c?5DCX1w$HsRKxa+OxId+?8L-+>`asJH;q_5&wY;Zmra8}Ax|s8@KXoV6i5MRvUVT8dzhQ@GJ1<^w9Va2PhwD>F<6Ci?mHBLov>o4; z$6A#IN*Tp+$Nb^dIBtT!9qOMOz7g7M;EKC5e+h8a{C381O$|_9mwqwBCR!*rJ4GN! zcA19Vv*fnaO2C+QgRHMon}xy5XV46xPuEN&OkBe3G}bE0dVtlm7g^wh1+BOWL1odX zC6sg+0bW&d{y{+zr^XhtxeoMR-jUCiaTvb+8cIu_esD;w<8S@bFle)TVE%7$$L+l`l~!pgHB=F2w!FMPk+um%Z9kxDA+sa?xUpw8HjKfF=r&hbUgpP|ShwcSA?ICK zY@==n#{6s+3m?=bg`WmeKZh(75gaE}9B;jaJ0^XRmy7^>d1u8@3M3qehTH&2L92jm z!fLq*fnkF*=%JxTQRxhZD>g58IW+o@f7$-kj zY?YlcE9cTv=UPc0aYIm-VqZx?cZv!S665MG#}~>#R@&XAnVS0+snB1G;k_1mjD_R9 zFjpm}<23-+DU6Zhj58YJLlH(S9%6F<-jfG26PXh>p(hH{qKSus#Ny<4u2^}j82x$b z{Kcy+EZ;LrL+NC$i348W01Q8!@_vm-b3W`f7RD{%wnMuk^zJ+7p(tz1NO;?;XJi?P zFCmsVzIV~^LpGD&)D7VY)y+yaw&>KD$Rz`d@nP$j>@>lZ;PO6U4e$wuS^(rkGrf+`{1bRr|3@ zz*S{C>L-GEQq9X$cS8WtE4D5^c&|#>nLX=xMA);T$BqdFxaaa&f8^Uu%B12^pTV{` zABhF{C^sCU42G_cPjjeDmHcWH6ewhlf__1ZGf~F4H8jMw7GuQG(Hz@@8Q%9alEmdC zBbjnm=u4Ujt4o?tW?nQCc^Vxt(YU3?qrLGPy^c^E)?dv#_Q z3x!T2Bz4h(Ja2h9=PE$Rx%&f@L+Pyu<2wOZ{@!tgxtb1r#7x>Axi|pIXPSd(|9wkO zEEj98eSXYLT2=kXM}N)I92G*XcHe)5KXo+o9}u{GmT# zD6|m@EdYq>Nb)@0D}{|my2RG0t2Zg6G15aM!USb266lbi*(EM0u+_u?bh(Bh}ug)ZFGmf4SBSbh%tR@9O@H*W;EtkpIy zp3l)9E+nm^&Kfi;$j`7?GOmA1q`?viD7N1m?>5tEls`MC+LPu@Fw-<)rEV{;6w&NbFka@<)a zdaNJB#mnXHO6gMIS}*>Z)peiOa0B(c`MmsT;_KiTjo@LO83{)tm;g9HZa(>v2xj!@ z!Vw~W@h&SNw~!{^XZh{vaCZut*y}emUhNZ9TX5V}!aBNfK3?5t|1sf^MZX4u3{!~C zWZvXmhOj?!!6#N<5Bss?2xc)oP%iwFjW^Vn1pYPM1t#TVRpg8dxXMsPZxFQ}i=egd!)BgMeGwyx# z<&aACPk>85+XR~~A#CRwzJWj4capsVNr+)->|a`OfuNegakjMb z^m_m^Eo^Tq0HR@!k5Y35le&t9%>(P_3R0rw#M8XwSu0os?Hw;w!CBj{1f*R59DdPu)|3Y-2~U|v*UfD5@NKk6 zk8kk#$|(+nT1@q$oY;HKRORusE;gEfYNHjVl7swhW zWmF4`Qvx6YjjW97uxpN{gRld9OPa==Mcy*jh< zt4YjZSP5r-2IyXnuwo6Zjl-ks;Mb|efhP4KuUilXwdZ6@#D+NPZVx4!H$-M|rb$y7 z^AuX9MassqXGo`hO{S!G%~nGpQ`LC#gbc@^N`AC_m82>)xtK|z6il{FI z2-p}yo;*k@C5!9biA~3C2^Yw@l28Unu^C@dJoj9%u|@rRc#8LV3JqF_Vf*7Wkwb_G zl+CMfxtk04gOlH{SaU@ssk;TBD^>y((IfbCpYGt$ewnbQ|2k>HeM=0)SD3&7(>~lw zAIvRM3XN?Gdz4)MJgOgG(%$+ef6$V~)ITk1%A*k>i13G+ciZpT>W5Usp|2*{kVTGu!>M_;@(&74#JHXpGO zuhHsurO$$sJ{6XHbYHbV)8K^W@<+ZgJzLWxp(}p&h3014Yj+gD@4nZrt+O|$1K?5Q zUh`Ba)Y_Y{U+#a{G#Ds+DlL-m3f|ylZW+(wmpdLOh0|k^em2LlX7xjsyb<#gcpjrb z4dXElU5WmRK3-`-aeO)JuhTQ`mi|XjCsqlGzc6dBlg+ct2nUAqAy~+{1#%_(@knx8 z7yW)=g)!h|P}{ac#vWrN6^e(h9Do}%J9CX59DLh7yQM6pI-m=jrRG&(G`HUKAj+LT4 zzgbaw2IjA`N%$%;7!gKIOdsnYXfEO5H{=js8=xaGyj+KoTvnIY)@zYq38)UXc1!zY zTzo_vu+y`O=My}@>de>jCXEWctR*@*%os1kw!>fNI5!x4KogAROWDh_7b3VEb@$Hhb+v zv)hN~>ed*ZXOpT=BE(2Mv!Gk-HTErx^)op3n99RWTAFi&7=Ic@;xS6DZ&BkKrLd_( z>2(RO%#v0nvYnqQApza;5X;b0+zjE(1>$D=CgX|o-@M@ldMhwUgbfr)F<)X_e6Xh_ z!tujuLv8Pmh z zxPQG`@Dq*s+EcmKJhR9$Qs)`tSlid{rmf?5z9?rs3aA9t;CY-RR8W|v5&LWmXwawh znnjIXR28l(=;H;?Q|h}9b;VWW1{G97!`G00=JR$dg{GMuOailCpFZJ46Z{;iwIx8d zjRaaYBVz*^P*d;6Mm7}~4{1{nJ%L_uQsTAcPajdHcAOoe=kAjf0ORNNi5{5I&w24n zBv0A7Id>m{2c}L|ZW~fMFyWmP_scL2PW2&PiFu=lP-?NBy%G*?<`O)Z`+UU@v(j*p zk?VM>Z==bA2Ga_tFk1zeJlx}g1&DyU0cMP>?+^f@t52H&O;DG0h&DB{uXYeqXl}L; zPj=@L&Ahn>Yzr&g9RASzhz)sPe&J^>C07pM^aXN`pSVo6xup@sn^?fG#T08d+WdY#_oJ@Mh}fC-clt! zO;RBL1_~rVHP%y$JUm!*O@&mvns51pr&DlpSKpJo_R9?~DkXv>VEte!bCRr>>=3P= z?*KEV0OeX46v;xL$N7wOw{Jjn+U_3b@LUph^>Nsciv?yBiTLm!fhrE3bYy|>mOx%#`0dRF zhH$^g$yr)j9`BENxkyRw2d)|S!xr3<^|sMkz- zXp729Vesrw#qgz6+@}!pbi+GU&T|9v(+x^^agT>?;dged#$5rb2nG2+{5PHZL zi=K!@HORXIsHMRh@bAfx7A^3w zM$vcIovmpQ!6Hv`LMK)oaCmw0-+8pG_>_JQirg#NL%+~?S|HeMMt(9@+ITsr6xUP9CpKrTsac-tGI19pz~g z&KCdFF68K^ee~DILcy!qmz>+^Bwf!?QbG>0oK31#ZQi!)?=!1ujF?*~Rpn>CTkcE8e)JlmGP zM_LTGxJfy44QCn98I<2@0`+Iu-uJCiriW9G^(PqCsrA=oExhCmoK`vwMjs%;mJ;r0 zsW7@sF-GaWOq#=)k z-fDb`&>A&o$QR?%R%=;26y~m=?@SPsKQYe$Z%rSfy1+-b=c~Gkl!hiMo<0PB&z{)# z+p-k{;5@3WhFY0j(o2oDzOjbbMP5djX+i+p6bbpJ8VXG>^KadRg2vP0@4tYXvxZCu zy@Hpauun?JLY0{!6g6U^7Eh(LkCTnaC(zQrll^wv)>I&}UtpPv(`vl+`!CcN;pjdo zrH*&8f4MK+?yuMn4-)%-WA*J{xokNJ1Znfl5KS5~SbY@%3{qZWQG`9A!~u#v8U=nj zE?I<@oO-{nn;0sJF2Nc2yEtb=dxRZo2go+d%cU7;QDi<`+*7^fQbn|`sFQ_{4Bs&Y zws5bVNxjHI)D5_{CbjHO+P9*LQPVYaUl_iEF&ii6y4dc6|8Xo>$|_njw4_4&FT4#5C62gT#E)<~P5pl4S82D)eNc=%{uh^Q}N zlggv+d*lDRRFRgz`X{MO1p?Bqz&T=WOH= zwm}l?QjR>cA>EtFSSGTSLZSrF9w>oo78qHJg8jwdH`|EONTI^5=&O~9pRHN0O=oJ@ zR>ax{@~!jiZ1bkM|FaTsc@b4b`M(MNUIE(Bx3~8MKZN%^!9V;r!B-+B`q~LMMf~n#CmkCit~~6a3g-6~n&?zPpR0IS^eRoe;3tM$MW29r48%+&o)%+_@4R zWb7}3jD0y2Ly)o0kVYG9mC&^JSPR-TMk*JbD-{~9VMNi*r0HL zm)MO-ABsFFzB``2PtL}EG-DdnRj}HC+e1g6gB&=lm(X^8beavTtVCw~gr<~#UDgT8 zK;;;$EWe;=)d?5mZL;)sv;Ea~;cw=EPQ-(LQlF<~ z$>jY$DFQGCm!3Sv_x3DpolJ?p(Z!IHvE{s^) zJ{6v2690^2%VIP)9^?Aynv(P!F7nf}VNV&e9MYQPI25mE4ngvV%<9;ATC)REF>9hz zqIEt1ZLgNwwu$?pk;~EBz$?m_SLRe*tp`x?M@LY@w+ImVG)v)hS>kvY&hLM+ku`FQ zn4mYw(fUFAhkiXJcOO0o3GZC(N_&ESOv9yc3(|h^azB&gxtyt=bid_u9t8-vCpOgC zZ#<0MgqPcx{Cq|2coqnlNHy*KBM#PH`H38B0S_bEVmTa6#%vUPsL)d+p4kQQgqOV> z2Y0Hvi{NRs=njXvwLRl9cI~9)?PTrRjc{o=Ga%OBvMSYcExKNzIzd=HWRbQ zTLd6G5}F~PP|7$-#8v2Ww;{D)t=$VX zATx?F<>1F?N>M?c4}SWF-H@=KcL@j1`Mi{Tl+jI;eBxDn&N&O%#>UgXFEE-28CpF< z{?5Mz8hu9N)LM;#`1O|CilIGIc0=GEZmOz})8?1(>kic06N`Xydnm`hxjoBP{T(bQ zx3|Q1$Ljx4Yd_)t-6Sz*9(e-pI23Y~naAsj^iLCb3HN`N`%^G^Z>w$K%V#u9q^Jq7 z*ftu^6G=QnSF{iA0kt{Zz@6#CFDzYvk)cX&LXI{KswmZ2uhodHK zTKFY6!$lpSg}t~Vto!F47v!dA!mag}*x!=Y-xF317c`q~-6}3<1c3P`6TlmVgE1Fk zl#7Amu=cCbIk&VXA5llyDi@}^HsTpCDZ?$&20wU_OX6VAtt=7?8kh^>&KB`K%YxZ%!{o+yp@jF zT$^w0TXoR5pVK;5(of1ln-HGQQ3duf*RHzc`-kdNHsjFe&s#Z`AMDln>Ya%q4g1Bv zFqc)pWR*M2lb)^}t4BYPt^YnnhIO-i$RkMQxZamfga7zP=m%GKNHCFM7G=pb zt9?-=JF-k}JHh&>oA>u0yy1jl9`pR%{pmP))6r6WC9cMl7mR~Pwilus0VLcRiR8bL zWysIyy}TstZ~U?f1*x&>_3U;l-7Yv9&QzbB!VtLuPBQq_p`)2)LsG`QnKzlDl4vb; zuB_OuVx&A1Y)d3^22wbaL3j!)Pl!R&_Wj!!zhWJQ%4}|nD|_A52=ZzYtu}AdK8I5z z*Tt6>3Y|1u9y5!Ua&YmQuQ2wt7gP0^!Tr%I57JOc_P65>(EE5DG%Uj!VE0aNm@_f^ zAL%fwtI@BH7YtPnHCN+)f9-=J%mW@(tt#BFrowOS?DkL|d??dS`sJpPW zYEO4CG9pTn#b_*6lyz+AK84(IMn}u4WJc2E>6dbefhdC?1I$E4!{$^wb7Fm$>J@#2 z#E1Qp-lck!DDomFYUW7XQBgP;i91(+i4~i=!=Rot2~|>i|AYOCC?=!9DBu+;nk?FX zh53{_VxdxyFdtGl0aQUlV`1@umywmm@jUKR3?J`~FF?eE!h1sykH-2B89(v_BID)5 zjL&`aRD_?l{*v*)hb>f1K+IAxLk5sC*i~}a3MzqR1G(d?O`@uS971OV0&d8t_rSEmr6@x7LO41OL0;`Q zQcP~yD;%z)SyM{3X!0`h@tt-zDZOtsm}%87M*0@Ta0G6GNXiz(M*CbCC9>Z4)!Sh& zAMBsZocO!p2T*1X^*1vICNH3ILbAw$l5sU49R^zXR|7;ZY7c?;bh{FiZm0ZBw~NA` zy6r*f_SZEPE|CR$#Rq(EbztNo8m>72aT|Z_Z9dU+Y?)SHZZgFtSW}lQZzTS7YPtA; z(YIyIVfT*rTfIkKv6za{+Qmub%kdanD~H|Abt)3X+*ja=a2XQt3Jh8`)p_(h^%!9&7uyGQ7hrg< zTYXuOx`a0mSeBv0k>RBFlqx2*0@uQiX0a_T6t^~5$Yqh>!Q)cn8{^w^!Xm-B;;oRG z=at#kf1UL}v7xH_77*SI7CS)^BGg%I%qFg-Xme@#l3^@ps-gYjV?ZCUnc-rm{LR3l z6j&&L3s;hfm?k4JOvnO8Zu*5DP*KKdK_(v|F_MP>*o5yeDH?u}Y5{TQ{yzyc{&MFv zj1a6}8-4$B=Pf$l-nsKl#(%kUQV@4O^)T+f1(As4_#f_kJDcEuAuX%K7D~*#QnUna zL4w8YFL(a!ojZSi=gyniocblO?ot~nHT0kTJ46Sx5sDv10D;3g6<8?^J_(-!Bli89 zlex9n59QL(UuS9`4=z7q40onm!)e#f(SivHMO^^+rH-snerU}vy5#9HVVgpf#* zQXi9g5O&VY0{%LdXLuy#r z+MbwSpTg)cu#2D-G`hyMtg#mBV?4KU5x<)UfVgwkQbnLNB0A28-$1$p)GrY4b~&(r z1&!x}DR2}Kos6zDYq!tR>AwZ^6_ae~kS>w@8X+ru))^xDFNTZHsh^nb6MD#xbbXF*Pw?fegVHkn9V1Rk2OHnBUEwr+P0T8 z3&HZXlvEE&)Cc&Zdzvm6QHCyv9Kz|(ZlN4EYN;J(*^6hzS(F2}pB~H0CM^}X-Hiu; zbw{YAfNH7R5|_-G&^sEf7VQxU$8ssB>Ef-YGPIk_Qel63AvP)IiPEM$5k(~7#9qSE znV>W4Q$m)1s$UwzK=-Ih%fvmoZMF8V*CQ{UT~Y$hM0Lm4gszX%YtHO?Qj7~&Qfwuh z(rA#Mw)(P8>(rdYs?o@0i0McdTUuWWPTuUfUBmw>2Y z5PK_3Xp5Dr%*e{ss2{R35oS!Fi4NF=f2}48NmJ3th3wS_C%h)tULkH#R_zCnivW^Z z3I-Gg<$pTMO6+|DKbcsZ)DqT*eF{qy{mF^}yhXZ~U~PV* zNj1OPO2ZMoBV*3}^E_x1+7wtyadczQdaAqDL2ye1u~eR_W1kmb|5@@hyXp8=R?Dd` z>h9}8x!p`-S9c~SvYDzCDcY9Th$tW}>K9#c*0xdL9rm*)7z`oeMP&o^y1~H`f9M4+ z|3(R}1*zd|Q+XK(ihN({+sao%A9N~}jiZ@1oB?A>OY!b#&Wg!?VQ@3j)7nBmdvjaF z8<51*C21di-udP;^-9b+vfm#zcYu6*WnHT!gy(?PR+A2IUrO=maA-(?QkCLW;g7cb zPxSIXH1>7e@>R#X!V|Os(Q)WSR5Dz4P}_C$xG^1TIW&_k%E%$7PM+Xmmaaapzl@3+ znXTcR`_)-5vl3&gVXv_{Rsj^W~J`;WWi+8WJ zhFBnUxn<{v4Wi3()Fq|Mj>7$pfXE%4^>} zZVA;t`A^uGhpQvQQ7y(WPu0Wa7IT_-=S3d*v~|vGL-AkkGoKm=A)gxT_)M zuG@tihoWVBYj)0OOk?x_vK1{A#&L1uZv8<|1me;dO3QIfKFWTff(;iqWR_X|;V7ws zcfv5>UaZR7_{(SVQBMppA3_&K%LCRyY!;&{3rT&;J_oMlrXk+G4?rdK1v1k zylH8Scc|?fuAR(rE%`+H>(d&N$19}GxWcesmn;VOP;k%*~FN8oeN z-@-R<_6vldkE08O?`F6xZ9RktqH2KTnP9AeWw_39)pa=5__5bFcju4Vw;a2RokvPOLD$ z3jJB5%n|aqbYirv2~sBh8Hn~9O4U0+uG&Wl+$PHLY{suwM{*{uaj#Z%xiU%QYbc6y zK?>qK@PrfN1~R!&NROm)vj%kIDW%QJH%3<(r)NTL^3%LxnxEyq;Im@e)@li*j`9oo zWgB)&yLo5|5|&Us&((>gZG4+L45vMcmg2`5tB`#7LPMjmXHfknZ;fx%d^ynSArCbQ} zY0C}yb$pfUx|JtYZn0gV7e~$YF6UDj^#fP+mPkd~mhpGyos4ncyaxpzmCx!!k~>@# zW=|@UHx7oprbnylBIqS&YLMv(`#W+`Mrg6UYW;%sTX#|nW*%a7L(8w<0Cfb4&GS^N z8ImhPy^MpIe?9I+EoSli|MR##K^`|g#YAw|DgtP}ha(XOTj|K_2&^-oGAq!n?;^Bhg#KoYnv|<-kA$h+W*DNUtf+ zDg0mAoBAp1;6DsEqBXexouqZ@c@JZZ-G8!PP~p4g!Z0D}+@Uq>_fWWCYP+fU6`x;j zmz@4wPq^yewzpY)(OPNp)_;R6<&Ker?x8j3_jku#?P@(-!#lJj>8!&YDw%zNv3o`m zsml)|`os&0(z?1o>@=#-Rj<;u@DzgXU!Te?9s%lq>)r>MPrf@OzVCH!K2Iq) z!>LJ}zkr6o9DASrd2uIz*KxUnR|m|-^eqBZ_r8!v`A%5=x9)`^s@0FBk_K9PP_Q|y zXcX$c*S%JM>)tl@^%uC}gXlhJ?y;oV1b5qvi|oI3FK##OKXtDeX#u)EAsJF&QNdA| zmq6=K=|FtXnXu~`WDWU`1M$9QL4v6Vi*Z!p$DXaRO zLa^ykE3(a>|9|q^76?9>E(}?e%=G_J+-iR*?vox6#jW+ox-R$zHEZ0y>$3 zHn6HtrVn0awN3BzwdgE4Wacb8Y>Z>Bo(6CjbOeLMP|&!ymgw`^;%@!C z<#y0&1bWq^^v3K7UE9(x4#$x91UZi6EK#|ow0`9Xc?CtGlbk!s_EhoFdSq=jV6tcZeGOHwT%5?`kY>d`gcLU zjOH59Qx_2nus>o4wYeJS9DwmUTsE$37X4;`nholE8+vA=-}_#tT&vu)kha($Te*S% z_Ptrt?|rX+biSk9fQ2G!?F3Ni(OwHy7D_hSCH?~NEP#mqpPsi~q4-K9wae(giWqv2|qag_>PaAKuxvzp4vbIN8* zRu!eHvF+s1$6+yCtr2GCF5n(YYLbJ8lmYfyVo(B_LKNL1buu4_=BXLxwvuFeS*3-9BBMtS}jE1_5H#zzi$Yg#kj*)wXWU; z_I5I{N}5AmtF!Fx1T%YLPMi#m7u)t8M4%qgoh64we~+U${>&?nn(3k47>ABOj`H;{ ztDRD}8XsI4_VvBerSU`UO3LL7HdVqU7f6S_ono2n$mKkC@c_%X%L+5&$4cKyk?P)_ zlH1TK98LC)Y&4q3NTV%AW4nJ8{{A0UJ1ezVOs(Uc)i(W?)wa8;V)}>GF50VxHoB&p z`IptM?MnjuPo>-YUg_4;+3D@I?B6O2$|}= z(hWR%igeJPJ}89FqJL+#B_6TkI+|}eKKt9wQF&iA@GD_AN=KSX@p(j0f+Ag@<_IJK zK&4)WKT_GdU@eW6vq_%B=yoB!3bC6sw^b4pVq zc{G-PU1_aBU3oP*ShE-SJ(D$mgxEbV41M|Og49^KK+*DhAiEaI>oI+Slff})-*EY| zK(}v_AzKJ;3+;^X&v8~T<@_>0v7t@E=7e7iGS8M&Gc4uoYVCR}Zt|blQZp7@Pu=1tyzohojzofRA z)H!nT)IHX3bSWJ81{0}wQG4mV#VyipG+Eow>;OLT4iT0GeJ$z>~ixA zx_Uk}R~caTR1O!M8I$IV)^3m7@|$9GVoZMTcb?mJgWjQxP<~-0k~7q_%Rpi1n$zE4lv_j)4gDTK+Rp#5D0RkcBRyFD|%7k{H?<4K0xi z5L7>KcuoFo?Sbu5PDqnPzF*S*L(T3JG&p9S^w@*v+ppwghM!RTCB!8Oc-^6A^+VdH zCw$N3r{_+7{I}#gWjbfN60Qb^)cmawg-KP2>)Ri}5QMy}2mQWqoQ*tzjXJHt>BZ+& zg}K?itvNdr{(#;n7Fw?XO`s-=az?^v@z^>I>Rt)n$59mU1|5A!f*{g3oo5Nu1(Qym zKaI$W2t(fS^6a2MmT7QBp<6|D`I6G|@V4zE+;O~llM9R-0u6w+c%Gf_C}khs-t#}} z98)Ya$n}DkMlhZ4hYVneuJ}w`{K|3Ox_mAE(|W;UF-ZODEAh#k_#_A22)aFPIGg z`$x>as2*HDz-TYjO4|)sFnSMbW4AzIt+GTGjGZarTtcxXa`*&qI$gTn(3qllwaFcP zQUF5PEH7I}XO&dQge9-XeZnO&Y>*#$9}^Lg=P^Lx)(x{kIUm`moLy!r(-YcpO*v>&o-J8v<^RvWF? zA!1l~0Q6ld%R`eb7I8<2FS4O4(x<4YFGtkYo}rd@hrHKIc2N!scv1v$nbK1y1SV)e zZPocS0%Zoa!U?K^%2%J3^`ic#O+#`Z=`**OU%^OS1&00CSWr z)02Z{mh9y3-H5nOL0%qD)rXZ?>r2Avf}IZegI za0da1AsN+cMP&oB%*|}BVg|{!Mo9e!+@wsNk}i=@rq}dkZ>@U4hasF0bW`lUS*_ou zb87`^K5jWoy$&HN&C$hICO7?YnJoEx6*tEM-Gdsh-{;B*e$Ru8vQ);TnCQfY6xUcZ z1Ijf)IQGy|JW+!}_^n4)k;6NVee!QZ3j=Cs_1_!XOE&VTD)B20+H4ENAS+lG5)-=* zRR7r6FImdGDLxv_f*l|myDF>s`s%NZ{rutd-Nt6IlEoyxhbHGM|MEe+)5~tr_Ls+I z&wW2KCg&2K@Ij<(;UIF*-fN}9P|)^C8(YLBUQWlpv2FPG(GLihg>IC>c0cw8P7&W+ zwm1KfQ-eqSB=~(SJH7V@17I~8IJ{mXJqb$p^x+0j_OBo>8HLrSfb^~~gn(gD8a!Ng zH;CT5&!)0}{L`zZqfc0sR7ZIWbZ!$)VXda~&Y|{mr^+T4t#>_@$nfOF@GJXVMM?6_ z?tj=(7jRiDLv?)bkkzl~GyLV@J&mAV!L>K#U!1iUa8Ua3F`J&#iTB(!R3?y1J@eYs zBCQB}buvbC&ql!UhlCEn?lT=;(=y47VK-vOCgf;OTb=My8_l(w1oRT)a!j#`r5C)& zmVJ_~J-#+u@~1gzIN;S7D#?dBU^XKfB~U{c14bq^iH9#r`BM$e5=?UoE3qnL&7!c) z=lPtSsWHpH>a`Lx!aI8H%dO>eD*M0a^+q|zR{qa_(QAZ%(QBaQ2Q5!|6Qd5l$EacNF>26+4p?v1Ig-gCxSYs} zIm0|IP#ko(WCChRM;W{*U=i8_Bk}}n2u!F!O=)Dxw${-eJZ3t#*`DLp=X@Mak|?g!4{V6q#r(zWVzTuoUCFO(GK z+$=W2v6E?h9k7WRjgnV}OI_#lS)`cY6XNtwTiKX3%{sWiTs&*RfnGlS zw#c#P>~HPFSL%Q4$aimF*Ti|^athZWKR2;@^&T}Fwl+ykQZqS&wxqVfOrT>$@1SpsQO@?JX5hEnz;lmbt20NE5AbESe zU7+&wqmDXoWeSxXN;KIobQ;P5_=fZuA6UbRhV~&E$TN+~sf04M>+BFecOUa!WzHpf z7)L)h#V7N;G-raU%so(*Y4&fGNp`;s>tI(8>y_9fe&?&4--IVHZ*zwz0A)M@v@cj#Ok@>g*D0DK z2em1^#e)!~&5ZVK68oVAS|}c-+Ew#~6}+jDklTqkxblCDe^10&jF- z0*+EcVR2e&s8eT;(}>1KbiV*G!w;_CeXWg+`_tl03JDoS1qM+}$^g~kB*VOLck{DWy!%#=5- zX+6tuh}>J#W-ve90UOQJ$4d(WdWuvv_cwS%Kbz^o37!qS>uQUQB=&iWcS+w@D0s_L z9&Yg&nSrsBV#s7Y1_K2`ntV)WhKo04(=#~LV)NKQu+b!a*oI#L($AC$1wA^yb5Csy zJLK0d)OJSgXB11JC4|dMmvTw0fUvk2xB%#_-boNm%nzc8sX;Vx)nA%eMYUNAaA5xR zFHJm#*_!t+O{{I|3H6sIev{93-8AK|9mQ!VGaD=}Yg?L1W*L%)Y~Ks!A7zD36-UI-9!lhNguu{quFLJ!$t#4!Vl9KA={AD(vSY5a8&rruDO!4`8d z?8^_24*i_kx)22K8(WHavrWS#ZWU{y6#GVORuzhJT)0!_wqKtc$VC9W&d)60Y2D8w zf1BK1e$vkVdiV9LU{*Ne$IS+Fcybasz^wd-KlF)dunbd$a<*vrKL0v!4F-(}GN!T| zvAY!b2^NhGpb5G4OYb^AYve~@INdoUAIqot^dgoi=sWCa0dDc zUX`G0snK`Db{$cY2qVicwTm|Ams*u3=Z8J$?faXrURI}(gmscr=86YG>3HY3qiZ&O zCGfO&kr?djeuiKM@_}gtHqjP6YR=|;v)yh1R>7j-0HRZT?6byBW{$bBrYYQTv?f$w zSN1K6fB3d<3|WXZk9E=+%1mNrb4=%q0PHvu0E=vzn28Ym zqB=ZfdR|I}$y8WhQ*qhwLOrRu@Pn|Kf!=O4{xnA7=X!;QYQ}W(la2&QWz#8(*%U6r z$nCRVY*_iquoTM!9H;mA1iAoY%U0?(k$&wSWlq@U5cyL|&z!z2w*?Eixf$fn+nZuUt+fidMlCunQ zy6v=Bl%2YnS4A2>4}!)LV}NgPXk;bI z)`Y}O;>wU-@Vf*^=pl*8nz8;v$P4EHMg_bU%?x{GM#zMEkuDlYx{OK;h;iBaE~-Ou zLnLjFz-T1odlpJ4=J6-U3{7mA)c=Rz=8=kB6Sw`QbOymQ>X3aBMGy06zK9U+f*5mS z6Gd|Qyvuex6rL1JxqLPxq%{(^yBbzq=Lhzo>==BV3zGqT4tRx+eG;AZrz3R>C;suq z+5WsTXxK_#{?n&PC?~L77_8tg1&6-<7qlBSbx?}q+jxp-3ydeg3BEFErv$}BflX0kUsG;>6| zM}C7tavhGBQr=riNoPAf-upeH=HRhxdhqq!qc7vYm1m6l^#8}zJ-64jE`Hlj8rx=L z+ici4O=H_`8)L>sgJ#CI8#`%i+qUgIGhOR<@4cUY#!DE-F|O-7KIbDbeyoHgIexYC zZE4)EzM_FOi};yf4?Cv|t8=Q(Hel2W1{pwV7shS&YP&5@74e<)r7V2BYq0k+q8`&K zSiKjUCuUmwhxDELhxD!bzWnE%^c6gAjLtl3d?$Tp&g$<*yUF#v=v&RtzVCs`8^BO& zew_3-owa-T;DjAvv|$t#+?6CV#8Sv}0&N4om=Qy?f!>vd^W0qlqsr7pa}!?wz46s6 zs|x@JOQ+pX18<$(iJ)5jSUZlEJ79y4$$d41eXTj4=`~_ApZA-{g{;Kbroa94c6ffi z{o2o}g-)~}0oL+B*+ruoJFL>rxXB+|^0oZ)FghNUDZS>j)OO658Q3kUoY4JzCW&CFf`>3VRM_XCf zMWMOvk)!zn!JNV1#XQBp9v))2q!HPC3MFCC@x-;w_s2>#_q24R!&jPK^{=Ovf5I)$ z5a3`lFu#*)9k{a617fR0IT_$VE@z#UYP2L_HBoYWfP0GX!fvL(XazCu-c^UIeB*~} zwRH7;D8HuYarS#ih@yzrg3+8Q^hpy%7>UiAAH3v_3E2#&Nq(5!7%V($k~W!OhOaS* zXItv;6GhNY(G3eW!{6!(@r5^@$X`-rx7YrQo7I|ODNLE^zl?CPGGnpw$z+(&XU)1I z18Z!8)!ssFC&W&}?!d2d_I_C9)ARY=A!MO@=d_1<$4Jr!_xg+07pf;(XTRqXgE;dy z_(LpR$GofwjUWTIJ-$#UADbsgv3q+|Wa5WU%mU%oF=zp#Q2UavL*g1qqUVaRcgjEw zEX@U;m^7Uu+jtl}Bm>(90|mwmKbU2j&{C_46*4DJEU1s`Jt2Km5JZnlCKB;HpQ5DQ z_CcH$mjh=W`SZ_lq|`8*FT!50Hq`Fc6jojA;UvrgrxCkH zGk@Nvj=;+>bZh`uz=3YUN-aSF3`h$8;kHQZr78UDH3EkWEn|4}p8w3VY_EtQLt<|2kf=r#b(!_Qd@~MC{&`$@#R)W6H!S ztX8@E8t&PfQO^RPeie?jQ0O-n<>(x}{*pP$uQzUHqMJt+KRUNd8Cs^`8#Q znW~-z>ThB&0>!MKcKDdpbp+U#jFVu>`Rb(F+L^1WyI`Vpo?V zD9G@?CxA{Y^y;{Y(4J2xzbfZZu`P4=gS3tF>5rBT=-G=Og9ZET4RNLL8GmYELwX6; zaBO<#-q@+fb!di*V@c(9%M~vCfZ?D9x6HNz)U#cI5W10hj5qw5#tAl)b5 z2upA+OvJaPk%(1Oxj9XcLev(AsD!&nLTM{|N>c9@5lagi1JjhWC|{00STAq(D1OB= zljfwsF6YDTKZo4Oo#^wHn}Lr2jaI0H_&sBy<*gipuE!OcgvMF5 zMp(fG>{aS;XX`590kIReFR}9=ih9c%a4B5X0kJ%Y8Mj+Bz~WK*WwapN>ORpvi6eT1 zw38t3gX2$X3Db{^bUX`why=NnDrk7qEvnK&isD1V#u+aiw>!@`qiQkFLoh>y)AWt4 z@DT1vv56qb*V#uJ<6p@adj=%=g6SoV{*`8u(J|NTG^4aYYYaG#-l;AVQaE#EBtkjq>ymcLO#1J zM*bF4of+_!klqm=q+Gn=eKv2v8@LGBRIodwf4GCKep_MAe~De=`=qmJyl1azHhvyC z1m|*am)0KINZS=`YbyENfix1r`(690GrhX8k-KIZ8)w|eK(=8u#zhuF!W|`ZrZEtR z@)4OApo#6C9(2ghi-q&Z^|^7)Z}WA$h-REh?odY?rVKZ7kO53mTWT~CEjb$3orNmC zM^)=_m`pJ79(W(Za_W@)MZ!s#v#|k=OzFhL)K{^Ke@t$7y}lFXI;fHmOIz=4^r6S3 zu`YYDK~ca(#xCsAE6+Gy@bj-Va8OmUpn?5LYJK^_uHW3v1?W;&qQDG^s-Zv-6m_@v zY4zeII&I-@c!dp{as&=IkELd`XmcPm(wa<6-v1nY`xNj|d(9CzK#W(_ueEp`p2P%PEI=2X2&Fg7e7s zIUyRoQ+YFrb(y=H)f|V`=O`gCC&bqI+Jhz)R_eS}YBKYlW)eTdc_|TYix&9@&FQ6+ zAL-jD4Q~j1GPh8 z=I#FgwJnjZeq|o&i62y^QuCg~TA>TuvcXif87wtA_Kjk)!dQAZ5l?P{vb^XQKDTYK z)To7QnrThR?C6;a*vj4aMX9|mW9ZZBhqM(<#nn$SD?KY6P{U4aTb?XMTIHU?7FTB` zJ4jya3YEs8I>PMw_RLifd`8yv9{ws%3LIp>7T`^<8*0VtGaGN*vh2Jf8HGzevrqtg zhWUQXb~x8=yf?vedfI~9yGm!}y=*o&`Jj=8vB~yDm>FUQD6oo20Gm({ohZv$U`4$`BO#h!zvI z_tD&n{d#QA7y1CRh4@Dz!fEI}eBbV6-x8U(G98mWe5e49Zh(T2$Q8ixjtuzm8fq<-J?R@z7 z3fPb9u*)CCJZILLahh+(waj}`90@?M5RT?a6cFCz3n#LSjxp6FnRpbs${SwpRL1f;FNqyo?-$J*#;z8%u7 zaMf13Bs`-Sp?p2k=pEHx_Tti)l})d&*;aS(KrDP{)A;7CSl{Oc#kyoN7KWqM>N>XB z^EA_&RE< z1{l1h1UF)d@|$qcwPnB>_cEx)Wi+Jl7E_@3;^jg)ZEV{&n$GXNxPq5y@wb{?oKjx6g6#kK6znrs{U{ z9~WXDV^Vz#WL7%Z1i)D3ik{H1R|=kFvE~;3vaV+!*7dZ;EOy-hF?<%Z?<`TfEUt|e z#$Wsr83YzZ%P#ImSl=zc{sKdX<(85sD>GFD?>BY_h{m_+(S$A&1Pl`o5MT;^Il zFn_j%iihk_c1&Fm-J)Y(=+x8r#JGWzcbFJ3hyIe@CgPLpr&U!Hp7Y8mCm^3hpvl%MH_)9 zo}oR~Zrw_U{`^unHX==8w)jej!52zd&J6c$53O@Dr|v-He3vjN!R3&L8ysoPtm4aD za+gnb;jJI>p5+J0My#>2_U-1le@-Xh?Au%9C-Yy`IRv+;k~1gs@|Jv3j1C`A4>!k% zCa_H|5#jpeYQ$zuVgQEQMA|AxUsy{4`b630Xvf0L;~^>n@vPZIFi<5MX--f-O{QlJ zrXxAo7K4jb-QCT!Gh@F^#$5t4o{&BQM-tIt0g_nuqM43P9@S_gh8-D?yoDubhrBZF z0!0$|=(=^7z4#zAf!VVWB5*_w`#`3t7E<#!_2TBwf?gArqTgkgzo|;YlxUFYQ*PkU zKTV={wC_@h2c#$EN6CI@Z8vA)peUxxOZ%OpLgFf!F^w%ydlv;kd2HCMi+_YZeEXP9 zujFR!HY9XVdDi_vr9Z}1g3}FRTkW>iit`Y}HOv{@ExzsNK4~45@KCk|KzTN0IA)!$ z3?mMBBvc9yJr6pA%+`uQmqjBF^J*Ju&_A5fPliASQcO|v`mh;xxqcqL7vz2nv7zkX zhnsOBmaW2)UyE|QSPc9<=UWw^qH61l@lD0tuNx25KciWG8@)&=)xBSR72~zgh5Fq# z8DsnqtMRT{ebhC2YW?MSL)7`!i&*wC=rJi%!%S#PIOD$pQO+^201`rTG+a^>Z(mk( z=O0Yi0`*GX!VgE=x$WOtA8_Vev)O)um{s~)5VOkrmsx#yXI52Bx%HG(k=Cm45?UWf zK+LN2zs#!UUuN~ozs%~+JF{BoUSXl83Sw44%IYXcS$)v^kFt753;;2!5l8r`xI=O3 zW~jpk22TP>>|(~8r`#IbjSUAiQQ$c1CM{78)yF44Cw(gIV&6~+F0DT3xjZ$RFQ{9H zorbo~Qanxp-kyBNgae1N!k(|pKM&S>ci5--))L3UFP60AKZR*~mTxE#x7XZ$L&zcF zOdhhAxU^2@xzzCq0c5r3)sF2sq^HEQGE@D=d93Vjc2wXVqx&R&65g4=k zGhi2;cyG2Pe4SfA(=M!rLn5f6E^nBybhm5kF~0!|B4U@ldMVy0t>1oYA>S=d@zSm{ zYz-psncs!*&x-(>;sh5iDjF|oH-+bSx*sz`)8MIRqn$C%0Gf@JW@wO@?|+gwA}Lmk z&P*o<1TtQD@Dxx-b$DqZ9QQG;9a5*81e0qMeEF`K{1|U9*k&kY>)%^{p93x(exP4A z4q=7BaR)~o+H~(M3(0Injs^r1;3ZdNEM*n39N?@c7jswYw`kakrmbw-N>@w#+3GFf zjeE)3a!8)v4w$x$hR6R!*41vL?%SY$#yMIxPIF3}a6TcGT-=<%PG|!n-1%6D~i-C@QGE{9=;-!W|Iq<2_6yJGxk)dWG;F3MS zNWfiuw;*}FUI^-_O-0tgQj8nQodep`TM)hsIJq{GcP%}&t?hS+?j zUKasS3?>glC09EEn^$d!r(e>f6vLXRix9}da&xH2%V)z2ryi&+9BLxwrK2n8_x)7^ z-xj$B*mW$lT7R1gRvmoa!b_md2nY;3N*!?mUvHV-{%90D!s=Gy)r&mQE{_5LT^1i) zECJpM-Am6s*Mpx9IzltBt{RmG0a=tImev zw=6S^MH%^*S#6+tlK;!BPD)?qzB8*{@60OIf0$Kn%Mv>G8}*}iX4Q&Xl<^;CRplHn z;fRS$Ntxu_ahZ-Y>#wp3Skw+~0~WB$Jh=>Nh|!;=*K{~h>YF<+!_Izxwz0@3#MBz+ z0MMPo8(Ak6>A zE$R2q`di^>_YlMvrS$Vi@?K+m$GNI5SxdqRdqyA!PMvPb;8c$Rs)>uXDEJ)bo3pYj zoyQr&8nR_kASdu%=1CxiK8lv)uUBpuPogJN>&(@nZ_!qFpca4l!Lw89_nrRuyheET z(a_OnD_Tl-7{H7=UAc^LMd0+5?mUp_+>24~F4%lYH(N(g;#}46o0^umedS>3(0wq7 zPYk8qS&!MKz4{Xep!JWLpjcTw_}Yf8&w2Vm8AcnAVCkYqPyJFwLGqsM*w)eui-ZqVQTqsJM`j1rMpDD6s&qPb6_DjdQuk=j$K z-ikg|>WEje`$)aS7dV0S5=F+Mh9K-e?z$p-t2Puw@i)LAf-#+}O_cv=T7&$`(j-r$ z2cS~8pX_Kp1Iu-``Py@E8F|(nRGvc5X|p{!)pa76@7gtb2i*cN^9Acc*cd3 zCOg_yi^`1Dxa|H(<2 z>IF<>F4ROM$S4hHtV)li49!&6%2OG-Cfg1zu>aQacswT%okEXr`tU3uUcBLUKd3?0ZMrZ1^al0%UL8qhq-m`xa6p#?nu8}%BzdP1po>Vin~W$*Y7Cta_9t$3zr5+=5 zhQ`1_0_g#@>#lP((2yUB$9$;@)UF_HYt;_2v3Ac5P1%cf)gn`}QO0PAHqi)*+a07c zzMubMj6~uxvAEd=ab!FDJgK3PA7pvr;~n1HBH);RM%JW@=gv9Gv*Kv9vf~xU`Yq%# zfGGR36>n1B8bZT~qjWq$yv~5Ai*VMsCqnd-7walsua$ot6cd{g3 z14l4XGz!?YUcAx?%+~kR>d-__KDuT488?h`);Ywb&T7+NozVL278ZdeOj#|k$nrJc zIi=|n2_WP7kV3~5MMBLa?DW)vE)pTA8O9=nc~Ol-?wBN`+dU)oS*`r2N6%l}}(+Q?MTu8|@K#=W~P%)#(pb zZk}9N9@6(M@xu}TEu>l`6G!2S!_imdUdZ;1CG8dtW08YQYz5I-uNJ1fqLl44M)wY0 zZ!xFge1cda*HE1Ya^BLy{%o#u#4vs=r&>@B#CHXBsppu6`T2s8JuslAE`4qtLuJ$f=&RRo@%Ks)_xH&OTLAQW=? zEsSvXk(=u&pq|aG=C(uejh!DR9~rGRLYtWLSOecI-oh|-^93SNmxC25B?W%YW#Bk1 z{cY{~TmX>W#*{4%y}+~FcUNRfi&>fCJu_cF>JjW!I?I2|DPYF=vvh;CV!8!l(y|Mo zrM1rUxv4UBl{{>2YO_sKKC@qDRb~hDpGQKti*8B@5@01;uMAGe$O)e$rz%_89~`G_ zz|T;{)kA?WS%Z@S=Y+pys6iPeUrT)g zVzZ4|l+d#9NYFWTl+sRH2~zLx?a3EKMb|51g~`yt=gUUt>!Lc9Shpf zM$38a6aYz8m1n_Ib-*%x`_JUvenRfGx{-7&oO*~1PpTv+DW1MPot|#Ne)RkWo9cXb z=ZQhP$NGnURDst<2sYyqvKGb>AowW`EMSNTAYr9c+Jzy{%&k%>Uxh8u|DWR;M_HEhyFdw%<9r*Jbwh#a#>r>newYM6c zz{)1~%+OQ|%Myctg|)@ERF=3oD`^f9rjsrF@3r*VtWA4UJIXc>Nivq$C+Q;9m49ZM z`lvKC>ZDoqhOunY3T4+NJ2=K3#UdSn zOhQ+G&LKGUnI)*X;&JoD&?Bs1?`;r-u{~^{Xttq?pBASmF5d4EZ}PuNehhPz%9hgR zp-7}@RE|}04x|-%(9kBOO5(_;=-X#6vKHD|0EcQxhDWf!D}n|TjLgWIAWiF}3Cw;P zu^0HFOkBw~FsBPtkm=sOF-_b(gj%L3vkVl#-caS#{C=>Jon*I15GH=+0 zJP~aVP!m+Urh04T>@Ss>PWnZ|?Ozo#k)FLc+yjM(Q<_3o94^xwgB)V;02iJ<7*os0qq*Ay^vqkEQt$D<43?J}fR-!z;3wSSMVQ|b(Tj9Q21)X#d+!&;C+T@b1^&^W ziY>S#yqjd^DLFJRtg5^pE|!H8?C@e*R_1z@()~GbUl__A`*|}(gjAXHq)zvNf8H?E zKanB9C!Q-O@Kv?u!w)sWU=0&b>Hdja#C!#7{jtcY^)%8_Q5+yfS44ixgCf1Hg7hY3 z2c;Su`9$hUgKLF&+W=%*LT3TM4R@txhyk^8n$n+h_Q7r1ns1$1t$B5iS`mb0kFHX$|s5If-nW7cM4PGS!ISbxJ+LK#>{ z7--Lx{A6P8j5gU-0SgEQ1V)#Ee-E0!ol=`VCN3T{uI?f5miw`UN2Vxz(Gc|KA&?Py zsR7vsh3a*qEqA!T0lkV$2D_#%fV)A?98deau6x+l`uBmA)uHTg&;nP=dH$ZJLxR^F5jS@raj5wyg8o$q^H&1W3x9V1B;BZS7%2Fj<#+LQo>1@sfgh|CPRw9~Jq zVGb?=#aA!4fuwpt3`i>0MH>5CO(dzm1i?8LI{cG7us-^+j=#ARu;L?jXkfpB%X^Uy z7J48-dx!(fy1dOFD@=%$WqpSa42w$z0&-vkDUB-ddAq1g4beH z^Ks%O_Lz*~H*;@*V-;oRfpzToB3|#Ac-F?<_yi{GD1>d^HtR`D+_Lq{bD;SXG;wU9 zoOFb5;)#7TQH8bGB2J}KHG)~vs2Ah2ed6@(Xr&mO{?$~KQe(P@|D}|euA4G*ZWwWR za_sD1p>*?IC|zM1ndB-KDUomD{+U4i07nhhybSAage^3j0@bYN>z(fM+1{$m<>tdZ zwFjl!qqI2!qA0Oz>1PK0Hv3-2jx}>T3e%k=ZH;vT3OG$8(e$rB?n$#6n;3sE0TzuO z6@?qKK3(8+!=s9!IWWqdb#R;|O9Bdcq07T;RY2_dGo}G! zz0gGwf3Ywy{q)1Fuy$uS0YR0|AAS~YM$(k|!6Vw~21?#DH4|3p4XZr#YGKu&ggQ4b(%pW23~gV9Q?)Z`VY^&lQ_ECxZJ$-qyPJLR6 z1PB?m0K9&d@M%0PUcC2tD^Zgs1U=E%$R9s6L6kFv8h*C8Gb^21yfmEsE}=|iEWG%( zLtCObQ2PWjL6do(QU+3AYSE3CCe?yf9T8EwE*+seG;y>k<*_8S--%AW@tRk#av3s=z(_?c)@%@ zl`ZYZ0qc1q7p1|_29uYo3f$mRwO&nJXHPX$EIZ`5JGn-qpr$Cl;2)X2y(O095~>0I zhQ_4Ftg;aYi~Y0l5CCSiO@54KLW-jp1oRn3#i4784CheoH3PrUbvozB`;Kawnpk&g zNs4`JmAya7=77)1hAMBYi1g{P8E8F=AqS}10iDr2D>FtQ`z06Wtn6jV5Ex>&j)z$= zneMJPBkDnYrIRK<(D0GiGjs|Qe$b@)Ip+vbMcQD?kBwR|((7laYl!Xr)N2IpFt5;r zdm>*j(e?dZFTt+em+IxEEermNqf=wE09lEk@NgZ+5ki%XHu1 zt>=!Iy^wk~JZ^^09k1c;r5=R{ z2|TStaJR4Kk1j_48v;;i9)s}1>p9SV9)lQwQmBDgkR;svQ|gTNcn@w=aJfSCw}7M= z()tA68+clhdo=YNOS&V%9QL#%Te{|XaMlOk_G)f|7!il6nXL3wi9TEOGOJ5rad~GY zKf&5%Rg{;y>o0vCTHy5$JrUor zLW5l55<*a#`faR<++#BAsUs@}nGTsCS#Qr1X9q9#l_)W*Cp3#nL!s0X*y}K6# zZY5pwGKr4Mmq*EZEhTGohTPS?^Hm3Uu!KPk=vO2c+_1__5M|71PKLFWSfY$I&cMp_ z`)RV|gm}!I*6*^n8!Y;2%RkQYqP>$A?(r*B9^Kv(7VbEgxZAS)V{e4ixz`1GCdsU-;zrG&g2S=J)oQu} zuzq4_u87d3#C^~vz*p1XI+vJmtxX(Lu3B=76oB6=#2>yp+p`7= zn15ahe)V-MsISzv5cLSkjU0WQ49j1YM=EYh-NEnn^!nn)OV^;#2ItTMdTq7fqPEVv z*&0krMr=6uHIh75rL1kYH z2oj^xTQW8TT@HxVtl3W3))d}oMy*{of4E$JcRB^C3ilk@cFE$&LE^Yjx zPb``CP^r@w%`h1PM+OGo#rHex-I>IK`#C9z_avoaM^)gmh- zJ@+z$f{dq01}*rfPwfQ}N%2 zgj2Du*2Eso5Eqush*8%Pu2V^r2v0=Am#_o*%FbW-OYyi$6c>a-5-Xs~d^p56Sr5jx zV%;ObTl}fYUJg$fR;05=`$(|}pP!y6hvIQB!|0a1_Gefs#;l8cw=6%St@g6vg2&mU zf0Jk9%mZ+cTFhOacR%|$!DzVr-{X7*JQr-GACLq~uMGPNx8Z$=UP4AsKwTAQ-5PmG zngd>ngfm>UqkQf|KpCTYQmdUCRgp~!*@Am9Z;~knNGT0Lhv{dfMM*TeIg$E`Af=doP}h~6d1gL!2+-+OP2u%cBI{a z1xLB#3*$ai0-S#ebIKKwr$lL9jegxUj-T7wjOj#>aQ?(DPe-0Ex2pgAoVa@kBcbfC z#$wmAJ#2il>FBWb`~C!%$oV*(&kQFGq&=mKMu;7W#U#?W+Fn_)UB*hfX4}?DWcMd? z*4KGsZIY-daLbJ2`J}7_q)m7C8Xx-D9Oi76m7dIY_RgqX2 zy3Hr|ThrCDDxMY(dV=QNVI)lFqd-y@RpH;Rgn3{@gpkgGLLc(WtO!n!T#l|;J+VUP zv5qPH5E`Ed$C+~Kvr9oLuX3VhM$DZWgN>eWdIbw?+OU~H3l{`dO76l=O&ESO9ghDP zC$%sO36O6AOmN&G+H4d9xA#!+xf35Z$883Xe{^!ZEjrTleu^}zC)oM=xcC{^gG_tK z{$+AVq#W62AMKh_>+Q}_$7dtnNYJ;#<0L%v0~LwUEek77kU7tpScujHItrF@4pN@f zWLWX)3VNtvxCI#3N1>}f^-jW9VLTRvQ|EZ3L$D*iFjClvmYrM_XN0>LilBQsRbe3T zfRUJ(tbEd~o}TF}86vn_xXL^$7beS!ub;79eYBH|CIvY0%%ZUdAATqykz6sx?f%9S zcg;~DMZU}}WXP3(0@}iX?p;#fIv40-0S^XvzuYN->f0DJ0Lk7n3QTueqb2 zUhOcPfN#o|qWh!K%M^Sb`yLLRADSkJ#yin~9({t0O@ksV{8LS6XM7A4JUF;qV>>@L z0F&2>>E8Hh4=)qYgGSw#rcF)}GLOQkS#WY@Fe&QtixJ`Yf0`_`WosrLQ=o<|h8M=Q zE<6T`J^Iv05CTXIXJN((C2de`fn!*hdXP1I^{Bu#8f*yw&7Jm_WfDFtsKo&3H0z^G ztQ@5zs16H+fksx*D>N~b-hiqG8QBcYTo{ZubP}}QRt1dW!qWmO9BvVc;P=$^uWyi!}mkBF+h!b^UzdVxbs7c=5i{#B$0 zhO^VlQ4nc#5D4~R$g*qv;+3$UzwPZe`%`+Oc5ikr?*@8vr;J<*<4QrJ`jj!GTl>NA znMZ)#gPeL?`Ec9TlJV0*hON8f_TT|O32eC%Q**cu3DX`pY9%HVWDlRR4NKz;@$?^u zf}*}>Ab}kgEx=L)JCUBe5USaB)J8;^3dPakg~9|Ci#x408+`1xr?w~-#;|hNHDdjk zagZWBr(vo9X<W;?LNh z=QIo^g$3y*Q+w1?FHVwPbA4i?5Y~@@a}NbKL_^tB(EyZFgrW5=vmGV=dfv*$jISK& z-_#zH)jlsnxA2i!ZfYt2TJ5irwM=m3`BCGU?lpSCBF?evVUSVjk>20;T=qb*u3{4i zPY?=Dm7|Cm8lXOA6W>y}zP_ zjq9HPCe(?OZsWp$0(KE)H%UH#dHz+_T`wFP$zezL-iTM;4&T6M!AU~_3C%6!*jb|( z4V)^V#kD}+Ica`C=bDbu!vPY{Zx`F+pFoyVen)_DWA8nje@tvUzS>m^O41(#Rvt$P zRs>|C2{;#SmlnI}9DzR%xrJt}k!zPqqOLN_tU*sfJiEtaP!20q4w%13qP$T8F~H&4 zaHR1uNhGu&ChQ2<4F!69k$ZI86i~O<@F-0&g(WQpSi4Q0-;TXBzb{KxoxVACAMhkF zw92yP+FTJU`B*#HI_SEXcpgnu_S{I__O%VwOSypBzCb_wp1cz+o3X05 zo?u351x>|VgmWWebHq!7`r{_@FhqETK6eyh)pKHCGHR0iJc8lqgA7q&FOM75dCbGN zB(?n8=0L|Mf;+bHG`wCMyKPt=mkk2&m$^60QFTN)wC6mFKl2w8713g@CO{ANsFBR? zeNzE@!l@V>YZIwp_b9vbrqdOGzR?`Rj_`4zNC*?dGQ}nxrqmGEn>cI&_F{ z9|=4-18;7|+i5Y$P1K1R1p`@8JTnuL8MMaF57+__(^$mfGifork1wwwr!Ip>=CbOg zG3#I=ygWS{??mW&$UYyLMvqTI1mlfLUDEL-k#8B_!4RuoG+AA6x#JLr8)kcB!u4JK zWQVN9dpxOsW5hNE2X_IY8e)sezRl}iaY{%SQ>={N@+jeAMq~`;FIgQ>4zMQ*_%63! zs?dp)+DuU%kl3;V-`dOJ#}lfq)0VvsY`PWm_Cd60Jw;g-ApGf)?ac#7Rf+i#8{~(Q z{Er{X4Dv&(fx4BLIN;nsr%DhWy9TVP#N-CQ10Ggl5&<)S=v4KLzcF#a!QFw9RhX3s zsy)9>n!>^LRL^RF;MJJU;Ko4LYD_bDoSC!?ZhP<5=V73MDK;f|G%&~%+ZOQOc;Tma zyihuBpZV?e4u(tO2uK*pWd*kRdCSwfSoY|f$KahKz~~jRJ|Jeb`_OaVt4Dc5Ojkd zg=(CFf|lN&UfoB!|GTXh>5 zb)hn-TVAsG_52rTf zTox=LH6{;xHZikiJ9#PQqad>h$MQuVrpB71qLp0#Y740_;svhW4fvG)Vcln_NSPQz z{of@b%N2L{dukS#E-1417P+=7x|8(AfYJ@IL&ljAcCoK=o#?}(c>V>P3xD<$RLDgD zT_Y7Kwn;+P+A$ovean}NjkJg%(>bKNC{f#zIMScxgY?UQjs;hWkXi@fvsIaCeib=w5aP zRUtS8ggM@nqYoXLMFV1TC@IE|l1~xDn;G&b`mJu(?$5h>>cxHVV=&GQ8OVfhnyeZ8 zd4yV%0$&@9JX370*jmYqycnk6pC~y=fzXh9}<6B#dbtkEGz~XZrpmr)fH!}18UP-O5lo}$)?%9 z8i+NHDnRKQG@fqK*rh-SDdc{|fbYE~dlvauEd;&p^B9X-JtjZQ{qjs(a3t3lyQt1e z`u4>_qvRBzG^rH&pzQdp<)SlY> zhBQbT?b-zEBbJcoeFJ?Lc70PEv7bKiSfn&w#8X^8yg42$(O9x8T^!i#O*eCWb}j(U z+{7a}1ra-+wCK&h8u(hc`;WK>Y1u<~cPxRO3QlQL+c-w#F5}A))IekW(;IgomgAVx zt;D%9@V0W+;-GYq0m>d=;^~R&Jbsq23O*ce-`U|BJ%i;)>%F;BjfrKx{lxkCJZe~v zZHxJZyE|?i(hRacB(0Bk?X7NlFz3(c9ap{ndtH5ZdbXsk5N#o`<3Xm^ zmS@EbW3q__3e)XzJodKoT z1+cf5weR41BT%k_IO{m}J|!uA^}q;3YzC~CWS}CnrS)F;DYIRtoA4^sm3P|@ppp`3 zN34AjvKJ7` z)s|P`EzJWOmn>-N`$agyAF!jp>8-t%7w=2Bm44fNTIe58W^}85QA`M~416yW*GZst zy3E-{YiSzUt4#F=w1iGs1R^E$Xbqe0~xt!<{7m^>wlIdk>P0vMeSXzv)>-eyPi zJBCI<8{HRi`HrF0Lt-XTh18Fv9P>%8xdHGV`g54jXif4P!L+Wt0(`$K7wkQ^d5jFp zCze9|m_=2SL*DGUd)ldRaVGJ`aB*$^L*kLfs$O|lnJ4h&=2wQE-?Z%vqyrnc4>Vaj zx2Xtv#NDG8Si$n0Ut(Yp19kfH+uh1Z0h;JN-3HIM_o25SlyCvh~4|n?41=V%HvAZ!!gYdJMXoBIH@{r#BbVZwBi*h{gi?QOGUVk2a7xl&$N z;a88i)s2F%pL+6z9#Z1XTmpJTv&igDafC+8eLvo#!hk;S8KtX2YNR+UXiuwFH& zD!gwtxBGs;F-;t4*YI8y9{r~(+%k-7>;|d|OJki}7Jd1OA>pXoH%2u{lsY%99wCM< z@joJ3ad7XyB3iG0cD|u;h>6O)YNFM8G~%*Gj^vyt5Gs^#&>G&Hb_I@J|Kys2)#T1-su9{0k8^xh3N zqZ}N`95${g08SR7volrwQv#NHF98?JHNXBX0sne00dGr|kAh0T%AgW(I;aE;fkyxB z0l2wPBjbSN*1}z6g=-N)6H9y^S1^{I3vn3G1AQ!2Un>?kcXTck%Z<4N7;1bazQB-O|$C zA>A-VKpF&rNrQlNcY`3^-Q6LLfYg~2mw5mM@XGxUU?nZiEXX)qP_sAb$8s@6P)(?td>!#paexo1U z)BoYKUrc;xpis%p7tPsqk&nm%3H2K2+XlCH@jBITsPKa6Ku+3g-DIhsPFkV3%|B3D=*=G} zP5dX6Ho5Vdn=(Sw0x9VRC^CkLB|o~(@>@^K>HMRo z;TI1*>ST(?f=_b9-i+a>n1z!=JAH@;e{t?Q`wL6jy=Ez?B>Uo`x0I`1>@cr`Wcb zveG)(x(f~HkqOv;nk;+Dt#H(VewfHq;G<9h|Ypb|L!E(BA7Y za;-j_H%`iu+FA)sf^GmJuEG-l@Qa?3a5R5eA!yKXqt~)1L;Aqh=j$gCAUWk|n<5dg zy#B_+H+L|9@T|7;RDk2zDmm0v%~Y~;tUThDSoecd<&`RuCt{)Ka{cnlXytGFEpOYZ zu8C7Oxmva+NI7q9sh2e=TT3=;dhYF{C%pX5&N&6Snvbc=0wh*3yzOB50QK6it#T^n zH-hcm5-&s_O-+>h5KUx|3DHt_3te zpVoZ0uljKBh@L~|ymtJ3(*Wqo|8mSWMc_4W9XP7n0FLS|f}^_qL7Km#y1>sxIoRWe z(*uB6P+0ef+Ua|(Ot`JAHnDmq8zX+T(DJ#K!n(NWyQ#&5=h-?n6Bb@JP6>HNA&T%u zS9R3<%Kcv(wCIy!xn_Gn>lwYSh`-h|3opk0tY@T=<$QitbqlBpz*Su!Z9LUZM8+aO zyy)k81^}AR+`}7ZjL~{zpO#V>M#mOGy;rcx4#uUhP3 z{BGF(y`apb<>CA;g_MGn+`3y*@hNyc^IQtqAVuC!oWGq=H5T8r|E0Ep`4fW(-#r9f z_3RbgWv=+p1)CQPv|Z-IB8*DhR<-wJ zBU||SGrFON77>4aCjLM|EDj}(mwgH}h@vqC8wpmchp037leoT0uUJOwv<7hF>765@ ztx>W!c)MV4RanBQK~tSP@Kon1p&^OzN4_zgzJV`p_)P@as!5&go+ zG>wOaNCi%Sg>0X#4^lLle>hV4QstE6rr=8s9?~o~eE)7Iari^4+T0Bk_ukybv$vI7 z2~Z`UKVbr%c3HE%HqGbPQ5!>YZ&I&6)8PWB?JJL3@4My)Z~nh*d<+&WYJP2eRzVw| z%g2om)ZZJQ8Susj_i^JxXlb|lxbaCR1Z{i{e{Ot4UxPP3j;Wg-604Ww7v0wgFLR~R zny)dxwibAv!j&|}f4+2FZJ-CYc7YBO$oK$mg7ZkuW2)UNCi#xZ^#;jpt0-`9cN*^W z;i)#Zbcg#9s>>{=??El4!W;YL7w96&0T$pFMImo#1ZnBLF&DST-tI$&-L2svsxdF9U%lN|j8UVnpxqyPyVOhTy`14R3xM`&aB$ZY=hiY$Waa4m z;=MUqij7Mi&Gv~ya#vx}EvnK--B<%fCbvn^Ru;jDle%nSWFLkjaUQPg=^BHj2LkbW zNe|g7W+=e|RDG#2Zpu4ZFTr+k3q@IPEWc_3aVxP0NR1G}U8+22QfX*#Dc82*UGoU| z(=jB+@g5N($nj|VGDcoWMr9J5OoRz~efWe1e2x-Cr3E=kRD?v=-+lzM~-_^|;$ zA|=#0_(msBH=kCKz4YVAfxEZbtroC*=@3vH(`B~BA1%6+dK6Vt&jLMf(xfM^=e%3L zbdrsYE4OyV4tSebImpq(dk$&9HzBXdbL5!#v@`mQey~>%$$r+e`9waPkhHm|pZ+bA zvk=lu^Lt5qxSz+)usICq@=mIPH)dD*EMKX~u@^2R2B^*MjvMKBu$hPVDH8r9EeufWUK;Ak&X zP9q0^<`8D@i*UJsskoNVs<)L#RdgyRE;!?R8X;-p(Kf1nOpk13aQwZj()_a_1CjkW zdC3kWPE@>rUk7W*iaUOJu~((78-K~>EUn@2y0}Cf>9eZFnwO356b40v3v$B0Ua8w_ z%|p{$IHJ&p?%-Y5&ofGLjg%!24a&;ptIPpHhO7YObb=<0@9{sWYmZnVo;p3}op$$w>k zyH3%+dOQ8I9_kBiuESgTdp$(R`ZyojasthV%Kl|O#2<3DW#3%{nh)u9&)~v_mRf_? zL;5Sg*&qyR1@Jlu<+6DA{O3BzalRvP0F?Fh24{V>e`bA|erJ6lerJ6hoVNdDeVv9{ zCB5)l!CBwwZlHWH1}mgF&^H(ZWc{a9eT#k)s&DOxL+YJHtzU!eamH6L$3$e9@XV-L zQwYSvBot16aBSs)9kJ_Z?UJbpS}hJ&CBqx3g;LnNTJ%>;b75r_Rx^Q+LNs&E1@UV} zdgtj3Ki(Xt1TA5{wvSdGB}E%|wWhJ^qwg~ea1t~?#zd4z5er?DV^6ij0pL2QR&{?9 zyQ`rRh#Tet{q66T!+EElTz6Fr*&-!hnw(+KNl&2OypBn;Qy``O)BJ_qOp7fFRyP6f zeGI{S9|kjQ(<)WuuyY0ni&C<)7_Hy^J~R&5%loFUe4fF{edz&mn_7fkBFlVo$|%R9`&Wi#mgb0p-)4;l%b?h+dY zGH}(&`Dr>mUCOLj z3*joQSeJ|8Kn>;8eZ1gH!@1UIId%5tCx)KD?OI3BNXQsG5(0o%Lfd`mC+}$1FlX@} z41TVJ(0{Llc6Fy6kijb2fY9iSNlY5!a zbC$~Z_a>+Jx7$HQuY_sm;i}#_Fi@M56yiqt-$Zu4>E09(;zxu^z$@%z(Zmul%Jl`6EO&y7Tg zMoGvY{{sD7euI7`09^-I>Ak>Bl}{6#lFrnjNkp=8PgIfnNiNekq~F*{poxP-zYO}q zKcb(uIau_|R9R|Y%@-YEr4p+aMe+Ku*#7DRrxsZYBl-Eo$k_1>`tD*0wO^$=)-+kP zGRG&gapI8_nCuW4JJT(P4t&dJpJrQv9r6i>)P;!ImYpc(LWvCd_!zUp6WPTu=;o6Q zN<(;(w$l8VbS`2JZePUUsOS^T*;YZPvNE)|5QVb6%3Am)Q6JlK0ZfX(I6{~{)92L| zKP?4DM`E}_wT9O|iNZjGf;6ush{nKz`tMNSze9olqoF{P5wMyAG!&2o&U4_{VvE}J z6h3iZ{I;EDs-J;ePxC!n`Wy(<<-{Q%*AN%|&Q*Ek9Uv)w%J^*)M?%<&6S#c5F-_^R zQ4fJG>N^Y+Gs97Y^Z>@1;V?oj0>7ByU_+7sr_FFEpg{k(Zq0DAAOXWUL8VJgT!Ox5 zXAF-`I(|@-F7n}Dnsj=9H|c;x|I(yGPLd@Af1>}VNq6*Dlg|CGCY=qaNoW7NN%uQR z2e87Y12yT)bKkLmnsg3WwS$nPG|HeRoiV6MNA`yJhhEwc?dehYSp3A2przlwOv}(g z9eUCB)$EAebK0s5&6C$_*k7mERT5E(=I-O11$8wQ=@-2U>)u~127@^i-ls7s20uBJ z12BieBwau7jm2dDMRi#58ghZcfV>IOI+Q13Ye;LsH?H+qVj+p3c1t(5&tY@hno$!D z7^%Dmi?1+W^Y7qb*JmQ4!YuvbP$UYew;wqaydJh4Xt<9+ZFa99qT$gby2g|58PKBT1}SuuPz>FV2a zjYR*w9JwEm?@BOxQ;<6O7`hA8>2r|eY`h!{FafH*$nGN#As4g46#{l8jCDt~H=>i= zxyJ7q-srQr0VXeP<&!TRhRjm-wd3Un&I7#gv|UI%kuf#w1nNr0fN%Lgr^`Iy#Ffh! zI;(s&pQjr!fO1c8E+Lm|kN9yMAVISrLqQx&z>^h^^)F|u>t3bYAC@5X#iT7d*nd>H zsl{(o4XDuUEla2H1Z^+NhLi+z;$_rc_^vctetOWksxb%`+{1LOj#={Yen6pKrg$zd zx)g&OaE^ZGevVN!hSoNa=%m{BrsV_O{QNO;MI{HCH;K^)D; z4`9zH*=nXQg5MO^?MD`_oewdzey_7V+I^6~H5$b7%s_4(g2#BUga=}U8J_9F~o8+PLEuvGCAhG>6;AqM+tz%YdPB`(iu6CCN$ zI}c%f;3q_6BH#`Z4h`UEgsYofLHt8RhmUvqT>MMO#$BEWpZzAcnQqVK4!sUzb?9CK zlCzhC{A8)zMQ!u4{oSRA{kwwX?t+6y$&)alMH|Zh7U43IKW4M7*uc}^lGaA5`#_Bt zs1Uzi~1RnZDAAtwE z`Ame>M(f({qLXwKu4@=D@ZdW@(o1E-j3i<%I(@9ST*3G>WioekU)wJ2$?7cvJ4L{e zlf#PS9@>^{Ol-HYgojoRT7WiGs2t|k`7L=@;;bV;Q@Hnr5-=ExeOw2k_*$sFtv-L; z$#=QgY>QfM3X;znfq@$SWbNkebeg{rwKaslX>ld0c_@Kl#%o5IB=1L`BFl@t8Y?K? zLIO;lZu+e08mbaWM&}z1&CS4td=^_|g6(t&L)JWAFhNk@2b7b}0*G zeH8Pg*YzvA?|YB~dCmhn-xbWCn4=z@k2k{my4wTYj)>WH*nAQ=M*Vz-1mM5pk2iT; zwxOb?Z=5!F05$vz<~ttB{L9nrJH+q-m)Sz0ZCMQTMr1DV65WI`OA-AKbhYj`xpIl< zuF)0!R;O6o*Ph9z!^OFFp(mc@ol_C$zIQ==2Ic5}Ohy9)?`LROJLBYc*W}C`l>Z?-{?{d=s?L&=ZzVv<~K_p9jk~-l~PX#QfBHBl9ZxY2PHO0 zqp%$sH_V*xZWy=j<#|ked=HQo;FSErf+kfuYkGs_TxspZ;rAKYDoTQ90kW9KV%q_9 zX57T9XBJ*A0B@U=9qM|mN}C^&Sy!@dj=766WWC4G^(=(kcJ+fn=7xf_#4L6W%%rHX zUxLY4LJZM5i_&-*og(W0BIdR2m$atxtLDXA7@Ex^@T=y9nFXqOQI!5u^ZG3B;SHPt z)x2m$z%?&=z3Y#lnwJK+=CukFQ^Uy8!L!g`k!ckNj(PP17rtN-ASjGGqH>1zgVsBF z7?d2=ObY@EtE7np5`PScO%tc!T|-gSlR}<1YEjtDy}m%WM70pUN{mgjS6ggzKyr5s z4uIz@+-9jYt$Ma8k+zpwjxHd}3VAQO4{w}K&yhl7dvq_FPSjFi*l>T=FBrT2HmF2b zkiG?8?BuJAW2T=xeSW2kYr4*3YD=B0j^i=4M&R(3dZukUu4gkh@2n-?c`?QXJ)aAFH~R)) zDLA04NMd$)i(2V+9|Y^_3)^KJS9h4K{Ks(!i&}i6rd#pHaq#{($Kf~Qu;HLh86@?S zaloymMps8Fc4H%g;nuvkQpXY8uGv-L8W-v5RaE+$aR59z4yFI;I8V5mqs%w_%{ZL0E8zZQ90337I9UI?;}AJz^xJXZ z9jo6O3UXVv6!4qpkWPBu71Nfp&|RZo*$`3HU5;>Pl4Jv<1INA4!ErCK4bz@65$Qj1 zFNcg?IFf(jUI{S<5He@Ss821DMYF>jrVU1>flfsjLV!}~m)7QZt(bxDmqjI2$aqn! z;$k|hx)mH1e_T5ae@7MwU!xDhK>8Zn`pvbdM4nQ=ZEBD?L5=&e`nc6ld7i%mrPF6n zv0q}-^ANd@9NA@4zWIZdBO@V(w8m7Le@>Y7emIx`si?Vb2~%7 zH)xcj|0KXFM(VFD!*+%5Hr_*Z>Z37;Ac?nCvo=GI*M$|-y^n-T4Pgc<3ZgO5q%sBc zU|YDm@BuI!fKdt^s*Pa{9f7^R&}2lyHA1gWg_w5t%!g)xE5#TAka0lM5{!F*i@u1# zFT21AY!`saTaR{uwh5q?a<93~!!s!@NzWbg^~)^#CqlJQsSCyL^mFnn@6sklnT@IV zQmd)r5uJgPHr6zO9g?glMS$&rHjcgCkN^i&kF;;SWU4`e^BedVqt66B%tAT5T!i${ z_Ttr&0@NdnWAQoAx!*XJ$u<%{+vQduVI1 z{lMBBTpEDg0Fg4YwpEp2&2u@`@~^qjY~DH_iStdtGJ$+wl8s4GFEh)!gk<(%A^K-M z(nD90Lo&+4u*>E{R$LG7Rb}=R~)SjB8pUYzPW1LHj9JZ2A$*RDL$a*@$ zD?a$My|RoIP`;jyE|Zc`|1A?#G2%dUT0Ml-QP)5aq?;gixD-q^v3)V;?I8L5M<&Pt z$pq>iUZ@nwMA>kxLpg1k#H+~kec=_RpP0%jVag_XHl#j!X2xP_WYBI2~)+^1) z;%N!d-KtJP4X?$usa%f^6{xj3ukAcsm)g0xj z?JwaE!uJqcY4d;JzVh0j-VH_`+Qsp0Q?L2iP1x+SAh|%QR&jemcJAP zWM%q6qt%}Z!m04=|CWLf(-aC)5U%hdoRqatKQq@^%vL-xz)jgZ!PSKm*UzZ^qadu# zQZqHCLPtIuP8P$Bq=Qbw{cwS|`S#Obs<~wT4c&F3&!mA0(tDd^|IPC?l&*(m`fomv zgf6zHXl(zKg6%)iI^pG!gGy*e>#i_v2*) zl2l?)00N6cvkjZTt6T!%@7fr-JatDI2xN3GtH3Wsq%D*I*_1B34UMj0wL{vD`b)${ z2}HH5I+YLtUA6-^kl10XoM-0S7`uXgcLJUDK{sl&@!b}AkOF+``WYOUM<*r(U6^*O zbMNM)y4Vr#IaSGy-F|p>a3Cnu@J)O?yQ%}oudB)52j%rL%arBDH|~8}29oT#>x`wp zZ;89iOisGB)@D5dL}V^xHBo8d`jJe6uP+eB+<$H+StYN^r2_q=)QTYI%6xcR_%-4j zW5O>g8**|XEQDM0i{4Jm2L3?2xvH^&;Pcbk>R=xivUr(DLg%9ot6~5p9BJ)oR%D=X z6$U2Yo_(o~7%gUd7&+J(J)AIfG~My3VAqrN5~$Aw0kejX{Ds_5D^9@taF^X=9GF)ShQYLzj~C3qU_xcD+(+ zmWFekBlodTL}~}`MB%o9*)4oMq8|{f#Ke0!MagdUa)E0-9&uY6Bye>$%}ZC*T@g`w zQ>NI!l}~6`fT#`5rlwM?hS6D7^cTk}momc0S4t}R;}>=gU_b$+DEPu)Z=T-8UDYtC zEEYg^!z=$_%0HpnXTGmMk!jIsrEGMb;fS)=y&|Ui;@|F zkb4!oxU90mCx&Tbl8%h~+k-eRy2Q_H(oG`@U(3RJ%DLJ^z0P8ccx}U^_|sW9!x}f6 z1Y|RG;EXoeWC|?3iPXl1KUlVmjZ3b`R0`Z|lFB>?rfG_Be1>IPNew$#C;tOW!&`Hw zwdtYUqdphinLob~E5O+C{N2!m6rJ}o>J>F1tX}ytz{OE}$ZHMTiVF78GP^O1@)z5Q zw#A~uXJ_96PSj?_7X!(b){|2g7#e3NPO)+kei-cI##UyI0EPS87Rby@{E zQ@XuSwZL4DLQ>cyKycRkx{IPlV8w#LJr0hG)!l1mwsNct8>P+?UE>@gOj0(j%`idC zzA1bLBrDW35>G$M3MXJ$0c}oK`_nI3K}EvIn}N6Z8zeU8b9iiV=kVJF+xV-; zSs^->q(ZkN{4ZGn@b9$3OR%gEOIQC>RxpWa{c4Bm_q?$-;bq!s);H0IuXW>uGfbSH z1VzWx%>mJw`EDxy1uVwb2u3Z>^O}gTb!e7hc=b#>^>mPq^$wc2SuH8L>>Jk?kbPzc z-#DDrAANfEI+i<=&DwmJPtzj>kaU~+)x)XISRJ<%uGIJ-461XQOHNX8iRC!0(FV1U zE7djeO)g+YUR`Scf$<^K&^M!fXNc3-0QT+j3>0R#4P=-U=V4bM4cE4x>4XqPKb}C) z_eiy{hsr>7SM9EEN)6SQuNQ?LBCU7t0{827G%1F>kLGf285HKe_rP?Pay<`2ZBhEj zGXEY#9;ki8iDVr>D_>$v2i4CE2PUnh>X(zDENWNvjj854j@2dT(U5kuA!%H055Le1 z^Wi0=)3ZZl!*VpJ=)F*6WBDTMV?&Lk7N7iHm@!v*;?K?D$1yf zF;skbd)&*)lNlF@T^Y)*Rq&6ua18bq-u;`m!1B{ufC769tDbPlKfMJHXUb>NmnN?$ z6=XF=XnQ$gVFgq^ymN+VZH!NVdO5RO^*xh;SyrXMMQVk(7Nb$Vr+mI2g6!y*L~ z_Nt_8Cll0|wXE8PH>h>D5liUMUY|$)vKXRiep(DIk;-`Y<{p1r47U&p!uB*Z>S+2QZU3ZM}h0kQ%8 zL77B72kjQK{ceIvU0l6d!GvbolW_Be81!pG=6sd@+!aWkJ}K4eX}f5?mZZ06$3|a` zKl-8E*@E74h{?LM8J$DvfQ0?|I37-TTkzSL8(G*+;@y(sw#sl*l&q>!^30@qvpE%>a08 z&VZ;*BXgmqY1<`}*ZhHs>1{{TYk`38-IA|(MTHJjG#S}*X?Q=8V$2Ac-@K+qC4K4) zuLx{^au=D*ZX@#gsT-hXo_UY^xI+=*lfHL1itIBMmgm=C(ShIhx9E@-{2}hO30QOx zhmLL;GmNSORK5{E1isa1kfhzI-c0s%z8%Su^e)h%fg!1P|8$Po^e%X^KCB3LK$)_w>qmbV?^N|4T9)SBZ zQT061SX*eVFLl@-Iie=Ry1)2zuhkkm&y;)ZCFnY%$g9}$aiCbDm|A5TR1fa=_JE=^ zAvLq{`Q+APAKq^#0QQ#LM6%OFscTtNiYOcdEA{=kmMZsHKM%TK)?QMM{T)d2n~+%> z=h%&Wey^)Wr>+fw;}y8wFqa)LONWJ-A!*`UKo>ion~|)Wocx5*cBku;WES<6d0bAV zTKY{xPQ>Jd3yKQvbV=Pi%8Pc;^$4pZ3O-D6fP5rX4oty&(3o)(r@cfse6AvK0j>km@- ziLWYmQ7jao#>A+8chp8~^uPY>s3jcLquYu{f`0wrD0j&L@X14BZRN|RzY@wj4Y%Qx zcuKq8lSzl=v!HzAp7T>kz+UD<>BP%ZI&{s_ky-w+Q!(>Q+y_p^>v_*4B%0v67P0*Y zp-4p56y+isH1|@U=Spo~MF&W_w%d=9wtWzk7_@Fb8Cmtb3gs*e*;{0a#;Xa2Ggx1% z#Pim^arNpLAB#T|xnR(hSDr z>e}1&))#a!1|bx$vS_!2D8wIhX;ec`kc3_x?70I{4j~SrNBXs#yc%IKCxTq#_!wyHA_k{`Smnvyi&e~k=G{NIq2g64rb*%B(=1r80%A=K3vU( zw`CNN?rPlIF2@g2#eyH}+k>xCV?|gtRhw&?A?l;1++|PRy|RaHB zuXP75zcacY!DkuilHZg2*F9DOmd zIwL;D!3rTC2{=XjFFz$6AzW}&wbQ)g-^RtOQh?&jEi)*$C~zqH|Wh$ za4_Eje5qew{4jia$b4j@k*bG4R+hqzM0_;=r@h96-ye#F{&9v2++OPyVrT-j*Mfhx z*Qz!+bmbe^ZzA7BeJd88KVR#K8+Q{DtCL7PU`F(*OMw?@Q{F&>*_RvrvZ3zv3ce#X zhvXu?Ss^ct!}BdZZzDWj7ZPMR@U1i)H6TY0XKm$&bWahg?O%ipH=#bke27?Mkgfw7xBoJy?4Y4iP9`cAI`j5>@&8j*=Sx<-G)@ zr^4`OZVGk0rZl_p%`XxzC%y5~eLRA{bW_qd4+)RCF-FakKd)n9^hZsOll-=@)dtw| zl^J#K)7&LgCUqb@-V3ghCy-b3r08d+@Yq`&d3G&ulQL^azLap}=hJ@ZK~8!mdnVnM zKl2ou8v|NShU5u`LuuM9t+-}Kuf`w4BILJW5&WNqMdfRqpM*sK5pGfh5?~GKi^cxJ zoqW?>hefz1iB4%uf{IlW8w?k1{X3kAa9FG+gO|7nN8fvl^XhV)0&-3T_HI-2hk}*} zX?nc#px4uRF5}|&DM>G+f==+Zi}|Idj>V01d-O6#&xktSB`8AyI6^jac~-tI_0BwF zFvD|frGTUO{9tL>VFwTrgY)lPxkCQR$m=W?mGCPThdxAOD)>Lf;@)Q+KgQyS zP^JFF;t=X>2Lev8;Q6rJuK8Y|0k$a%);69={EEfp_ia4J;zGS6gP1case_;tZzY|> z!`v13s6G)HMxdhuDzUP2CtmcgFteoJmcYX6eB8IkKY`H(jt1j00F*%;xVaBn|LYDM z`YOUGj^_IRM+WYteDDDEK_Kh4_h%GU;}ikRs~+!qIR=%R#rC?p2rvAdA*6Lg9!Hpz z#^Z>$_xpgS+YE3y2=`-x1_xI=)7{SmD*kusam?6U!giI`yWT}ZPaN>`YJmbwIPHM% z0wZLp@234xoW3lMH=+X|cc%hM+nhx&a5Fr0=ImZ{=(;NhrQ%(=|X)Zc;6Ulo;iXATHI&!_gTJtEkF+UmEEz*afJ5)#%DzDsMqlLh(D>Qv67!D;`${)SFt^l96 zGKW}wt3OHPPSYTOVFe2KgAmIRFm0+WK5xF$nln^myMB;Lbx%2rAqe`Uk;YZX6{*~(#WI6(CMHW9Q2lz zSl-es=~&t4}UH@0pU*!ByCYG)3<=nAl+ z*<)D~Fjv;2S_sO z&8xpVXl#!iv`^p;n#@z<2x;lBPxTK)3^_h_HpJM)kg;4w*YIxSv!Tmb*%W$OkZaM< zVgeblmB`q|Mg7%>zVvt^-O>u&m<6V0}{=&L84jA;X`8Z zIGeGiFOYV2ikZqus*j_Q1$#&04`^2QaAz_F8zH;s2R`7#G%k<6#(o7XDk^F+z*o?+ zC=6dUmW|-@UJ$nqyFn?cojsN{HcTYQsfPZ+L~s^5k=zot^WAi3l6T!XH^c>aDL(|_ zKa~NlawK^XuUblV`jSvy!6bQh8e^0eYp}7!W7>i{PR91GWoDKyT&wIDF*6ilZ!F^z zRw|%e1%x0*yrdN(NW+I6hH{Kf6Z7m#C${C=x^*~I1I-Kh{E=HcxJRC9=)UwoCrTpN zwo000{Ns%jN^22WL_1_(*dQiv7 zcaxmPb*Ruzkw=pGeAc(QwY47VT8vWodUg2$Wy=Hm%b79E@IFM^<@6i>IT24(Z+t34 zr2d`pB{j`7Agf|?9^kX|5>YyU3A=%M%;4?PRFL0gj{m(A`rJFN?|?kTnMoN>r@QaS zApZrF{?7bNhOkND>2r}7=-`{Fcmkg5F&)-RKhE{eNsE~z^EPoobG_0dp;6IUlWp?g zPa?djy~DG(ui)NHI*>hGSEqY>Rwq3D90VO{iY@_Wl|m<98bLH-KaDXX0k@m`a=pW2;6gO85#~S_gWiF2Ezchc5quh*VT@5w(Rx{H`}t2u=Hx* zQ*Oj9Dr+=A%fl`Ydt94D*VqX;0$ebMy?k&7Z?02;A6C(cpvNBufTOS=+U`P^-79zd zA(bRea$?#vrjLv;3hc!&fV~(NxSJ`{qcX++^kUo}y_jVzuorXUskOkf|AbSsH}01g zv;2=2gE?i=sG>Z{Y0I|qGLaEaBCybDZRD$!LA~zJ3J9)M8!c)~v&hyG>m29o2W;aKSQHEi=&o&xu!^qzsl`N)JPU1raJ(14@8K1hrg7ZRD6PpymNq)RK&a`ir3z74=H8Yt+cNG$w!yBLj)b6 zy)WKf`TAU*rOpQ}cM&h!op<{V)G^FxgNAzv_kF{R;Nc!QZ#`(Zr!*v=EN2z zckVJX;d4G?uHVAL*%o-X=NpGWRDA>A5)%73+ymqi)u4fvd!cjwbtD;sq#!r$oA>5CX7*FtxlqV1KgBsYJNoJ=wBsWc;Jg4ggn=_>#a|Y+poY4lG zGu2>oM&oM&2iTkm1DP|kU~^^)fdjK1zJd*G&iI*@I@o2n{xoOCf0;AnU~}f{FrR-e zK>s$!*JBPhr|%zgM%)O&QR&f~3HfEtY?{*-|2Ah5Nap{|oZAZW#T9)!ckw3kifQzkTn|u zzp0cBwhVrQiR4b;Cs=fZuUg8`?dn}`JYI88Wb4`^sPBC!=Q?WH=^RDxT z=#f6YDf#mH{=Hcq1Yo~xGBf;vh9?7P`|7^oy^*|DS9!ID`5ZD&!BhsxZa7=&+GlP@ zA8_x9J9g_9)O!;AyZ0mw>OFCQdQXjfg{qhN7tbjjn`~j<@pD)Vn-|QfVl*md<`A*G zjOfFZrn9Md{!w_9C9<~MPt`^Jpn|@4`)vXsM}+L%Gu#ZgPb!>zZ_ijfCp!pxY6&@0 zbg~Mp8ird2I@(krM@d(NQB?FK+?f6fKJm&a@GpIc0tcT~LBXewkHIJMliT0Hr^A>` z2us!7*ZaRch>UiyY`w&djDY5y9;s>e9I@6Q;pKuLQ6&2AJMb{1xoy2a`ZQuaC zZKPi~QZtO$yoAy2id4I?HON_7y`RFRnF)1ZQa zQbC}gR0k+11-D*4cYT;FbHNvtwk|P*OCzfQ9wMH~A{`~J2IAcP3`%7=tm${S7vhH- z6etqFtN}nhDZqxb_Ccgr{@chuL8+-57*J5E$n#bjTM)Nq*NJOf3baI|Y*^>oA(_-S zCr2%88$OJrJJ7ffMf6Rov^W%4aqw7_s#5s2HJ7A1$1STMAj6 zjFDHi+N)e)OVYZYK{uO$<@*+boLou$+3KBJlE}*Umoa9M<&+h459P%w@pd66yb>dd zfSlg%iQM9K!X#YRzCkZPkcq}a%4pK#{HQyGe`Bf$AzKTdsINY+oW39_+js>|5))?=IH zHqjVW{8>Y?oFBHW+b*`jo{$WmFWS|k!!vn<_KU8~aCbQD;QgWmc)vLO zUFP&Es}~0^P~aGNgn~&*;Z#lkGaEI`TL0tjl3FU&W=lHW`+R_sq^Hfw)s43$Zv~aZb<#yx*hYf zbLOkEawk@;UEq4D+GBO9d|d8@XREWXS(q&{budVKHtl^M1{|UJ=V?u|hw>Q4D!FU(-}}P_fDn?+t-xK~i8G&}tu@N}Ne6 zDHL3-3ia9b0#~a@1TW|%A&SWThvBfxihPb*Jq?HP9E1^Cy9I7Ckv?C%Tt<{>!c~-a zA3#ai3eF?a$$p+W5Bw5}PE5=;PKZ=u*zb~?6A0H2p_z4nYa!-o!Zh9GA@)@eh#$onwd_`>bcOZ7*fy}8N!1_ZjeeimVpZD2NJsg4>>z(xr5@rEp$f3k zm~sa7g1>tta#EA~=ts~F{;;n-Lx7h~j=D&kh?%&Q%jRUg^UGBXk^vUQ=c$n0Wa~?1 z%8Y1(;0p95(A=|4%G34d+>>rrko{shMP39Uu#HKy4OK`fFCxOl zIA&BRKHOVa-Zde`*3{X+#P8A`B2v&ZYrj*6_G>z)VWAwn7RItTE;PeITQ(}ii^HG_#YILAx z;B!51M`K^GVeRCK1KGrJDF739v9}8?R^@aOqBVn~4xT3lDz{Gb+`Z^h9XH1q z?=*;Nzo35~_5~h~C%(9I^?|-~RsTwGdAfN(+j_dSZSG=AR$tcPN)K>%%HOhsJlX%b zZr>{W;bpQmFK&j$)%-TxAZAohzROhm#ivhAdwa>ycL|#wT`QO5$lw~5%0Zg{^#;J@ zVuMM?jY;unv*Y5^TVoYTu;d}B(r{w0=BX=f$Mp#t`<);2C8n< z2DhH$%vSm^T>yCW`8Ch|@?;yTC7z!|T=cxgmZ^*G8ngfvM00)AbJ+2Ca6ozvr)N0s zZ#@UnRSB%;K!Ws~jlc99#f)fgnI!#yS2r110{uUmT0v{u4FVUgZ&EpHIF@^fPVc>2 zs|S7XXQ{W5txgNrWrr^$D2waXFlb`01qV`W(^fkT5g?{N+4VJed@NL@O-msiOIhlG z0NRcaE>qT>l)C{9Q?alB$Vht>f~ciC3=wwDY-(Z{x5ZwcTmO9mdXGfk*H}xsQR`Fo zn9&N6(P%-c{qZZK6-N{P{4t|756)<5e*|Z=+|(GxE^G>jff6>r4NfZE1A}yXjd4zE zslq8U01v^a%}0Ug(NJT0fEr36FfG<{cL??i5>;N8D!=G-#BR}KZ`W4|;WV~qxATR! zvkAi=z8lC<7gphOTPviN!=FmZYKN;724EhV5MAD)M3o6UsvU)vqMxQa77_>g$kScM z3XQ603csnz+fPC;ykWG~>6D-!F|JVYY9}zITP?39uO@I#jBgoG0ZyHwW0)T-)Ajbr zYqBXDK4)ndcm0aFByo+_SL5+9#%zJwONPFjaX^3RVWvrd6>3popBZ*Ffv7oyLs0pt ze()3bYE)B4%me+iMg;ODwdA5A8_uTWa53)@aWn1hk+55DFH7%9S0%S+!R0{3Gjwv| z7xR}?+fF@M`t}C8oJc?Hw#6{+1DWZCq^rd0&w-I==u!Zz+kl^atWTgmR_@Jv1l!IT zs+jc;Ku{mc`Bxw7@@F5*YlOAqXCEs9)W>=W?qflI)ifk~>|-^;SMVE&afMPIqPJ&} zom^NyUu=HvKr@1RpSVfKFn0Q6TZJJrVj;U;XYu2phK+z@KXhcxI}L#4D`@}Ppj1Hy zChgU?$=K4Jk!9}T8~nUTDp1|B?X`!4HH$}q@!OdJf{Ix9lfD5HhjUNAJ*DP?zROFB z={YH0sd9x-9oZ02#hPW?bE?&hw8}7L^GE{LDd$#W>Q3B?skjb&N9K81T$3@0gSF*o zQ;k1RBQ?PJQnza)JB$)=!X7CV*Xhu!l5^g{&o7_RDMocYU;phHt2ru)N{@=KqtA{o z+u=E!E25~y@P{g{S^Zdxy~T-)y?)J-7Xv(!slcrF`v=Jo-GxQGJzDwvy$v)C&yamAEPwl+9xUPBVCpc(Wln|eNaz1 z!WTDac_yT1IId$}&OS3Kip>l)Q$itEi>2Hv=`Xsiyuz$&L)H4EcSxl!?=#L8$bSi( z<72I(8G<*=x}c82gNAjz`qY+0|J<;;KPIMpy>d=Ez;1?ciFR-cm+G)_r3h&P7MP z)urju_*}X4jNJxY7ZTdh$R)HA#;k5@V*FDposTmo!3Bq66(pj)>2HV*pEfK9mA*4# z&&v{j-0~08 zl6?vBm=pHI(fj5PXlT+aH;83eciAG$ggWgNkkLVdD{Xo#;6+R%Aw302gc-s%i4}f) ziD>HEkC{uB;nPvcY6J-lcNMkmO442=T>PP?NO-7N_@3}fD$V{__AxGd4jY$u&|sW< zP$hBA;g@2?+P{wi#o94|)nokjLtbF1mW?YxvE2*{To4+GEK4iAdc&m25;{dFWky$i zfk&kV<3ubDp{fqnMgQ2)1o1^P4&AQJvC9`VeCVPuNmAw7VAoi+=YX@XOth1Tqg-%Ja+1T4>8p)3A?b zI*K|<0Qkd29iH|0!_sL^WhSJnL6&cltXf0YynzP_8EZumY(5d@;O;J~#9~@P8XMsn z`vf06-Sw1tm*J;K)`6G=Z-KE+ z;@8!7zYq9becvm;ldMMl-Cat^XZD|QZT5h6mmIWdEF`yu4A{w27-{n;A)x+~9 zYXi{<;%4I&AV~|dTlb(sYPo&Eh5SzLkM#-#`*rW7f&j1MKFe=@JSd-#$m?J%3=x^Z zZe`5_o!u`c<>-IWExqe^bPMKx(5+heVv42z(5;$xbgTCr-QxRSbSoO`5!Q6c2ZU|` zvyZW{047sk-j%IXljOyBWy}44lr7Vuf&W|CI@pUIVf>41Z5_`UM%LY5VAD_Lbet%@&6%PYrD=6QUrM*WNRND z@T&d$Ko_KJmAxxldY%82ExOhUPx_ja-QZEl&r_-)biPGK3tOw-KOLNmNRt~go68hc z9h!Qup>>=IGS)hoQFM9vr(IzqD-p#8ek5xm`Zn+Xj2-Bk%K{N%Dl$ITB~5WE74OoV z0X3>kStvsO+gY?Lk1vY{L7E@|cX9A|E0Aqcq_avaW?iK|t(4ceau0oW5J>YGbfE9T znAgT#r&9&{U&e+5l(9LJde7KQm{y8~z9Pooev3YWBz1@K3YmTLBE&J|`OU3FdafVz zEyrgdC`mwm_~!=Rr+d^Kjhb$;k!j^@OiOjum1aJ27F{%?Kh)jkEcbP%=K5%`NKP<< z2wxMj8o#NU`Zu4R7QUJ%Q2}nUG#gG0NxLv=;(7_6Skx#GE2)~gdeHg+{wiOCs3JkQ zSJG2B_KQopvSlyZqi|(;T$g1Nt;_temI&&v)+LJ?;H>)L|J1rzh=9T_m^gs{#kq(9gy|1m?>JXy=zlnu zZq`4XOYBRpg#W+wr1Gm7+WUHv_P_Ncz8@+TXgwL&6^tPI`==1jWbiXCQuM(yCV0;g zq=PNDSpnhudJ+z_o-~mEe~c%Ovn~jLIH!{g@9W8{ps1z6lKU8f6fDqs5<392p1k_I zp3Ld#|F@o$d|yva0M=jwjQOQ_COf{##EnK=f)#k4B-T zDB*(Elkq2qB_EO{%$P3>(8)U+<}777W?rthH>rauBY^*{CzJix;7KM3Izj76w->%M zoVdU1Nui5px<)$s>jXua*Z658Si_!QN{;4xp!FoivU30XdQw*-T?DkAY~e)2I8%yg z*?J=3`o5p6!;*-_2nYPPo;)D?=m%O)_CG1uzm8MXY*yJEBhn9TP* zNgE^^LF>uy4Z2{$-71)--O z!(3Fq4wTpnLALiTckUQ{ywy^b@MU1ukW@x+UP@c=%abSGTz``3C#AP@|F^ERSH(i< zG(0(o|FfVIFM}=RSPoiOKK&o-O6jBjb6xq?RbKaN?J%ANMo8+vbtT{+(O;wiG_OpG z2F)wUdIRD`_DFX45@~EJ`5u`V!cbD#|2V9~XD zqL<_q`=4yF3+P*(`YzN7&3(|ilGqiruKai<(_J_ZkHrOAS4xu5p~L_0y7B=egt0cX z1%iaI&>mop8V)+(p9)qj{{KM1B0g+}zYi+k6#QPgH2t)QJU;D?Y2#ROUKM1PG%;KYq^0Pz^{}} zL*S8ShsiK;MOBsEu>Vxqc@2{`?*YK#!=wyE0omQL<8i;JW^l zal2^>Cn@DP=$SyaP%ads^nhRwW)y}tqZRIN{U1yctsp8>D{wl~t`ew~{T(kw*D0=c zSWD$kToATyxlT>9_}JuWm;2EiPCM%%0?Xg%bPI5k$OGj3E4NHEN&3zUKB1Tqri$!E z<|8qAa?@C3|Kb6MBN?t7ve0}3M5aq^H8fut6E>?%cQ%}q{l2Q?rRg@!^45ltZ6uT= zzj^t*Mf!NE>wvg;&Nx7Yi8vTSjBowhtl+J(1zQ!vS+=kj?Q7=G>gvTb^cklAhBx;1;uw|J+yG zstQ+RD}M-;)wvV#b55T8bLGczjNyI~E`y*|YDzm4+^741ZzMTiLM0++hlsNiV3E1f zCRR|kZ6f6rS4doSdya~FmiF~r83IEd(PAR^Sj?^Xu9bkkFb9~e#PUf9rx_g)0SMCV z)S}RNBvuVz99vb+pi3E@SaH0k-4?wbCC*oCs8j*cgJE3O2--kJ8jvS`#$uDyf;}Kw zK3JIu@wGg-#Jh{Fddz^_r`~Ai`oB zb$}f=pigb&Pcp|z1*^fV_~95jg+4eCY%q>IQNW5%u(=HOa-?OHl{-($@0x!E5)I~b z+Ni}nf8SSVl-x(opj{lmj`6AAlK?)!qOD;gXT-+4~k7*_)!F@vOZX~d)YHE^RHlDBRLQ?PR6y3>9V-1o^)BFjh#K~9i0aSscZixQJ00W<8ls{vu%C!? zfr_E;L)5yb?Gj1PyNlCR)GBV;lGYJ6=N3r3;z9l>^0`NeY@yYa+GVI82*yJSZz1_g zFSc)=OX#QxejNnX=7)4<89jgDTu~odo#6K$z!-R`mi~?2GsvZv@;VFP{QmH^76eiA zo5AasvjOPuk1AcW3-vCeg7yB|W}7GQjpcob8nO)yTB1@gbWxyo#WxijPI$F>wy`v5AHi!sgL@LT4!X?@UT6<=VB#K3FzcsidA zVIW4f?+&#H3-N6Dc8KM^o}T*h@i}Kudlc!$7MWl|JyjZm*poSn_YsZm4}aU=!`gQ< zP6m4KkC)ZE89_c462jR-{t4>m)3ZkRrEgK2iTK~69kUlh9*Zf*8sq2S@5l-}*<%fU zFu9gEyB;*1!mN36-Sc*?(hci119KnHslbnbgAeGWD)tt2DSTIT4pA*?6ig{RJjKFF zYYB1X*kjbhT)pfX^un&jtg0x?V2FCr8TnY#m@M9wUU9r^<1=1fQ0DTX&Zn$)g$?rdFAP+*07kf@{PLWxo|L~IP$ ztF^tT`2K=rik?K)9m;S}Af;1jEt_-vBjnhA+?Nhjmor!8PEhq4-JDO=Z$aPS2bDdM z{Q?cqZ8|ql;43x(0M`pEzx&J(JoC)lv%rIkP3$s*>iDkce!b~*(}$#ptJl~Ar`krw zuic5{t{z;-4pC{qdjNbGR3#RA6JCeFjD@Srs#~ zh9|KwvXeCWaX9X7f@q3EickKs46~RfDH`<0f{#=Qkui)IusbLA^e6mRx%wgN&UD2w zdskHZ=G(x{EpVn?Uw!sW4Z1ntLm&Z{%_xi zEK>agpZwk|r4r@%Z}hR|B`nIa2cEg`$I6dj5{g00%bK5-Yk zog-ECVzQ8(O){?%|L^2syv%hU;O$8u6MzpCBYFTbWyF_v`51UW5(rRo)R2S*5?k3_ zGzLoboN6r$5rrGQ+lXib<(7v7-=WC^UsE{9GP~Ra&BCEsLRy&vBzgfWQnx?)D-3q< zhG$VD?+o_KYB|~Zjbj>5X-@I!oETr*eha3KSCF}EhDK2DG0sJ{#h+nRUp;U1~9}h`*>hK1`Ypvb1T=X|}R1>3g;Djdi4gxhN}GO&e?y zv2^VTdJeF5b$2Su=cEKMeCf8|NXu}CxU(dx$ZYZ~&UA|05At_yL#9nN1{(E(*j$+aAbcpyRcYa>!9 z@6Tf-thR~h?Jo3#QGefg5lYhQWQ~B8#g9+F)hg`apd2r|keWYSvyAGSH8qQ?n{JDpUw!YqOLcZi4 z3XlaB`j1L2s)e8c3~$1&%6GMda;=X?FgJGs+N)P$6x(n}j+b>WsSGO(g_s4+?b0f}M%0f|B*zpu5XwsrhY z@f~Fg(>EyaQ-}+$*F^x7gNw_sDb-HE<_;Th&HKi_6K2M}~Ecv~w?1*#6Dw(t@yGrNEOOide60AFvJ-UcmRM(Dh3 zJ$oYugltd%t}k&X7e|2SERT{4&-I|EgFhje99NC1gV|JF6cHbL=fYqN5*)hVrS}e^ z00}$JQYC7}UzYP!O_ZbTo<00`Cwu=;k}RrqtHtSYEVwG%HY=-X(8!d=ZEKmv={xO; zgJGzMp(mj+8l*Babb8xQsXJXimUG6raERO}21rW6*wD^B6s{vM%z25%*70m^rK?yO zcQoh+2o>lAwE^?FLLd1|N`5;zDDkd00bmYxiuu$hubcL>T8varS zc~l2r)Kk*njHAC>r7tw{;$pq;mSl?ZW6w`wpA|uFB5Jqy`@AKm!ub6Tq0wFW%(&Ri zpZ*F15A^PCwbLHG{Lp=bawjNiBHLk6Pxrw1)NPjHCQaNN*@bHwa~8Qt0?pvZ0l=4( z_ZP{Ni4hOA#SA9lCr^28(XjZVCPia@(?ncRH9zG1bTtRNpF|nAeT)1I#17ABmV*yx z(0=%d9#()~c57^(@RmkhcW2AZ4fIDAZ%sH9v4w8gySD0uT8ql^Z4210&#m`vI&YP* zgUvYSOUw&yIMXUFj3g+^RkPahFTM%e;&|uzlOW#yeuw=<1IcfP-Zvdw z{BV!lnw;6rGPYM(S7fd}U+(;ZdyZH2 zD5fZe5QnS$+b1d1^=p^YVEE?s*cUl5Yd@M(a%LeX-Gu?#DAIsH$jLKP~`qK)wDkI}o>k3*-e%_OsOXB{@PD_1mM z_zJ<=k#zur>3%lXZp3xwXtMtgX{bzbM+b5ErCVNB^8 z^xzVx$kSzcmb1}zEsrE@ISU_tPKoy{HVv}4NJ0TPo`LxZvQFE3Wg4xD^x7DbE}Vx| zwxa#uX(%mBHF3Cm4(hjNjj)dPgHNIe05by%n%aIq)k1bh;&EfoY+N|A9qH|FbrmJ4 zHJNTbts$4)4|rzXP%Qbs*lm01w`Jp6$1(%=98bJ8u$;L|Mj7Q>y&bnyfsVcWP zDaIS8f*Wfx|1p2@Y75uz%+^#fm3QJm!0#uvzhQa5Zj`kk-Wog0mPFg(wz^CBTj~G+e+(;y72^*3gj3G>fZ|TX;hMYJUzngsNXoCdpu4 z^z%y9-B3WRimeN9pH;bUR?mi>k>5G7;>N^(di)l&hY;LN$)@MmnZdI;AF1|LZ#YCB z3|k+c=GK@h32YP*E@X>_d%=viP{+PCHN~@+VZk@l8{2~)-uE(-C*YwXpK<}H_NB~( z*QHFTvn^UlK8=o8=-z(B;i>$t@8r?M^DTSq_UPqh1goEh{9yp)?bU^OtQanXgu)d> znYOfh6HLQQdaMu8!kcJHX5N+!UbY0d9ZI}>RJh!|f3_|h=ZJxUysi^OY~doh&I}vJ zE~%9A>MT>AOg*Z%H@p;>ykZAnGD3^cl1v;Gk1>Q_VR(hwHx{>BIF2b4ePYdz%6_x3 z6Ur!{s3c-@5%4^s2th#*3D9>{x-z8j{+k&vHp>t+8LrUOpSgZP)PLy;;a*yxb+ zrJzpx6_|G#!nr%=pS3qZob{l;)!AoU#Pf~ai~NZX2qw-ly!w#El9cysQtjuAJ+0|^ z7Yb6|r|->Knbk`gvhw4^rpdp}+0h}Iuo|bUn5W`Y*VUtDi`B6+;0G=YLO|xLxihjn z5xF~FJ-^jLCE_sc#3pyolN9rlg)u&-5LVe)>;j*_+u8Lwe@@${xGyjZuFHLQg?eMXF%{ZbsF%`Xi}EbPz;On@b}-ZHreg$At3wVYxCe3ZxEywT zIpR&N4AX0f=>0ZCC|;dpe?g0LePUk}s+W*YpP!u>kw!kF!n_19cSF>XM-gwd_ z?1|wGd>~p$$XD$Z*UrNY(D?wW()KLvD%`S&thr%5(B^2`utVY>Wa06!AaC#UNOnH#DUo*MtGbQ0JipAFpR)o$Ka?|>t%DMS=Dt?lBeo~nx z?!Ez2pg>(cSzr$`f{K*2agqBh)f;?S(Y78JOtZ|709=RXM_254Zom4IW8r-9s1h5r zuhI&P+Sx59?g*Fd3%5J_k?4ARuPD^+u^lAk;&!*n(gjGU2;#vYn%^7#ZkWk3()>Pq zzn3Xn<@0vqC}8#;k@-T*FZV zt(Y`mO@}TP9p=7lSmvz2E_vtKq@~8*ie{<9IJ$)~nhHg9N`Whp z(9+Kt!7w4Xr@?4FIF*{-tiJvPF|7u>IChyJ#PiVxaC4jK34=*4wL}YMf`72 zwxPM^@Q&HBTRSZ2xbV89LhEay^Nkv3H%GP*Uw^4|6=2y(hnv^rpH-*XMZ)vh&9gjg z+$c5mrL1nZfAk+N64%oVxn!da!#$xZ8q(G6bm(X*jLR#DAUN=WOU$g;KPc(f79Ejt zQa4KS{EpOn$;B=Ptr=8`ZTf5`)Ck^c<9|8FfoVO-8d=)PJ7w4KxfbR|+C2OKlc_f5 z=*r@zzb2b~Z?EF!SfqPU_f>4Jj5uK)Qku0gHqFv7ZgEEIcau`-7+K7g?MKw*WDyTR z)tS85c`tO19al7~FB#IZMsYxvpP+BBMlcSz^qdLsG{8hL@v3m!O4i0UzM9&U*R3fr zOx}m!SFkt7q)XN&>(4l3_i)sL<&@yEokrglF9JQcd+z(;ad?)}#1Enh2hl?I-YS0# z1#h3UIRi1FrTr(yHt~aWA@H|VUvxvZBUj^ANM1L(dwk{8B}uEv3+F3sKKU}@zAoz` zCwEw;e}(3;>BEkt8s9_O77MJ)1Fru>BL{5E&reY>w*^W2Lr_1*|BloxFYLNJ6+!y` z=f|AGFV3Gr!c6HdNT%({cWSi`(o_na#Jgl6X+;+#1EpDy6&I)hV9;Vw9mI)vm*6T~ zHWP=s(im-_`lx0VA8;evw&!pD>@f;r9NPS3&8>7RGV_#^b58FApCMuV>85%9eg7LE zY&sr|4qid=iz;6! zwmW)Jag(gK8%`s3e4k4GSIEU(>6*`XFo?IIa2l@;{%i3Z{mWdYN(X|LSAoI7uAPS3 zF;_Eg%Z%<0A5mx|75Rk>#?v2bhyV*LJB*n%8QZJRn_uMursgQKfkenSga8=g*xbQ> zWJs17`zL{NYq4pBhNcDB>cQPM>{kNn+Ge(8<<7b17MmYsdmUN)ljC1j+2IQF@~g7N z8>?;!*}Zgi%-Ji}%-!;G@WU5#0gzfwiJ1-%4nq;#78_kHS`|ke`#?9B>pV_(4JIEz zoknaQi9+2U+HK!H_s-CrCxF>9#Ix6iB&)h!!%yfok=SUE6U!qZ1qX6s)v~`oygRXh z14u}+4WzR^nxQ@f|2eTTf1OwzI0v!?+*#4w;Bc$$90PPFX8)9sm{bv@VYJL@{15TM z7q-wJrtSk1pUKJoTC$&ML6)q|D<%40OV$PF1`re$_ku0V?QJ8LHSM)nR-DOW!o}i$ zz(2<+#;kQt@&(S~nIC@e@~QD+!?sJey)#*9 z_puY%{r9>io)f53gb4*`yB`xL3@-veO!{8x#8~>g2B(jN03vP@n}hIlvk#L`zpvPI zY$UAVEbLx=My(iZELu~vEzW{%KYk-fURc(6Y`Pzzs_IDcqOL0B(HRw0fRR0-(neYi zPPAY>|9BK{S%`R1XC$-R&nPzleMKa;hH7t)&Xf-(K$*YVbf9V&Qpm z7WkN+c)ZOZc=QH8iQEh9F5sBbmf}3>D{r>CT6LN@|6!LB-&rRgL0bVTiC_=`f|FMb z9guX&_&6BZHDUVkP1}VjCMm2NIY%kTPcQ1p+oyJycXyUH-7*@Z&(XlY>l`WY_U1#o z+8C|`<_;(*q_v#-@}di-ki1I ziAxG_#4tzFk5xkw1stB6r}CSS@rr}78j$K2c#zs3fk`3kFi9~hWaCIxFu}IhEUBj0 z#jW`Jiv|0f`dG^v&!aW9;-!{2dL~`zPN*NuN8P@;4qB-@o_LR>wVI6rUhP=T0ma?( zWi>O7YJ^*{pHr_C%6HiHzffCDMI=iNno32~^>GG;&;##(kOoFsH|5vLmRRQ+H&^8m zU|Cm<4dt?+9XwfyTh0bGr%Q25FM5`Y8PkDsQoX(br#D+wsU1z}+v z%ZNBvsD0H7mAQfF@ug^Lxt>ibIxVK5_l!el=0qU;__ToC$B`47_yo>gnZ+)i5y8Ya zoyrI4v5@A6)`Y08=bR?}w`%CpEZj^1ipsAG!ElseT~~PE)BUjX0E&L$PZ>y4-1oG$ zE0dj&w1(P`S&hI9*wC@zx~?AtIF?6gBM_T^W!XK_L2ee4l__bEEGs?%l4TLCzEY-i zWZ?T=OUWI9WZ9Y?Q;G_CDMtg`&yEY|HTZC#O1vAH<>*^BNR}ny`$>Yy_4&JKuM$X> zoh-ska^E0E2K=A2EbkBhcUpFnn+p0lUmuqUiepBqc}ygMvyW*+ z%l$zt>ji>mchLU`atq9CMdcxeW(x~3LIfP3rA-b(N_|cJaqLXYoyc!5!d-{xDk3~; z5)T{5;*vq|`!s)h?^Z2Lfd#+HHZpPwD6)ml1>oMW4AC2!mMiDVOA(Aq`UK;FS*F3F zizxV~q0)vC`Avfk`K|Npq3zUkRlE5WdbW(q;88oY>+TS^b|GP3p#P~yPs8LHXK}f+ z5v;XyO_0kX!Lk%1!+f3V~udXk70}rrX9zUdld95$M}wLnC7jxn8tpi$=c1G z37Vt~1)31}yoLUeb6=N;Stt+bbV>R()2KMdlJM-M@>42x_)8-70n#ZSErdlV>dA&? z?Z^`opR8)ii zL&dPJ@@pUGOEG8G$@m=Md$T>THp_ZD`1EaZ_$hG=jh$*_u8>PsCL{D z5!G5eMDNGw43c8~1Es!6jsijiU6iZsK~(I4o2!I@<&R%sh2*j8_A4J>Z2v^1$flRM zgcXNY710)lUYaX^UTu9LZ9nlZwVUzTlKs+jY1%N;S9eEdnov;8Z!~NazX9F6Oif&Q zwwyv}3JRrt$@Bera4!^Oc zzcbeB8Td}ZYW*Im(E5HDE)XrGy$GrtQ>DFEj`v(#172c^-8DQTqTk|mPH2yi>ve({4m$}t*u;iHK?XZrE^LMDf5@V9*c5D<&T3vgp5DU2%tl6cAkYqHj9#J%wk z;586xF|Bx3xWp|!_I`>X3<5QX19F$jObpu(#M^|pgfK7dm;3|qR_V`lmy2y|VqGyr zr44D2NJl?FvY3hcoh=DOub@#BeWrAbLM4U{DK{88I2{S$^YuO-V^GqHNmSy_)JC)2 zrXJZj1Z3E>8E?ht5IfXhwaEJ8PBR^+0k9_+A$rv^; z)zY27TbjO~b4!y_Wm0F~fM!(-4cf0W15JuY0ETrE#(8Lmtbx>elp#Pz@gjyuxeV6d zB&!RS5RBCH18bwUpa!vr!+V1`?nvzIpU;Xb>JgY*I`En!u6mXSqh>Jr4GGjBK5QZ6 z&^7N)8oCv8SvN#{frxkMth4^e`pwlO`?KFmj-(;GxIU+ z^40tN3IW|hn=>Ce>WDdlb0>D^)NkLHJ8z*s9y1;{qGX*tIOYW12d&wiwuDHvJt{r| z{;ckeKHOO_Vaz!T^1n5`;?fgh4z;5vkrXgLvW?(s!lQE5{ehy;`9mHX@#MH6GvZ;$ z(+h%U;SW0Y6Um9VRy61U+!82aN*!1_;}W_8HJ; z6GcsxyrTI1pogsYx-ZAb^8A!vwEomrt&HO(yYc^OPWr_ks{pT_sXFM3ZP~%@lqo0XUc!g z;8t=v#JB1uY=fDy8)A z{Zg&pCj!JQl5>|aCJ>H`VOH7ry{{<#G(nc|{m&!d6ac2;W48@RhWj`L_X@vZbckL| zQLN2WRc+lGc1imSJPiprT)gxB+=qlJM(rd*CpV-#j}*!e_hSBQwiqC_MP3C36mUUF zM^~K1E~~o?AVGihRgFP9>|-)m7B4Rqr{@=&#_rY_cO9|bfB16dE#T#}BjM(>SEE^u ztd0bVvKy)+?KaOCN^X{XCxW~Xlz-xi9nj93W0AMNd{(zj1GnKv7;nD1#T|TX{9xXK z9&-QHxp&QVk3c}_ML3t&V)(O-s9WDnS(FS&X1$bv5|>|VXL7#zJ~PfD=4qin?o&&iGN>yB&?G4j@z}vJw7Jp=4UwpO&%S?JfQF$?v3T zS)he!oQPlV1I;a;-CzUw2HkSkf?adLQa_3iWViPPkq|>qOUou^eo24eS@*`Lw55y2 zR>%j%z!FMU|G<~~PXwg9vOxlyuOn?3jRp|61j{bM5^|{bgn`ps#IK?Fqo#a<5F-{b_K5f-ss`Uay zwQho_*75(LS~<;$^Kqhro+7*K`wlC%Zl^0jRBP&As&$cYXj-zv`kiV8vUmQKS`|Q2 zYeYZG4B(w=6$-MkGvd~g+Qv6;|4X$x%BH4*s8)Cu*D5^gg+$Eb6YVF{B;;hHuUSxi!T9wY{=oR*g1n>S)t>}55 zvi0DhWe(n@))|o0${Csh$dLUXs`a~!y}cwlnm>=6%HL*i2%Pubdo!2-)C}HEt9Nic zjAqw`pE!x`BHpfNMx=~DlV(8hYa^D#cNEHLS-PQgm?f7%LZ_?6z~@{6AJGzCESOd| zBjHMmK}Js`3WWkT?bytqg$V#F)OX?7CXC2ThvUfrang;TqjrUsiJCh^n~f&m_8v-; zHOoy;6UVdFaD0V(BSXu(x^{iL@L+jSv5d^T@tVfiha47*R!n#upzo0 zHwfQ5-gpdXdBN^uBjZnqV-6ibsI56v#8!EMAAU<$ryQ=XpoMINT7Yqq35IplI|*Hd za$6Jt*v_>`i=jpmQt1hnom`Y|gt{0CVS75AU?K4`veMai=c5Yoje;2`h(1MfzY@fg z^D#I=Sz&f9o7e2O9|g#=WlX?^dZiO8P7(PC#kxP-^BW2IGxxIOIpl2(G-P&0F`R?d zvySAt*?b=+{uqCCkb^I{t3%D`?2Nh*q2kXCpq;F8j!xuAvk?hIQqepNX0TcLA8b%m zdzp{eVnGerZy}kZ)OF5?tfTQyh1;hf#J9LSz~%kc{xC@-r!qE%I>S_{$(PBu4G0B8 zR=)Wb{2bO#_)teVwu}>jmt0{<6G_z~S{EJzMIL>#r~$M_v#`vBlDeq$jL(hHlG}Y2 zKJt6{aJ2d)KGt0fJLT--u@_0!STYW9*F;8kLKupfo5sgu@F5rmBt)5*a_YN$6l(E}vJDg>+XOI`xu%cjU zeFVqJdEE8$-p}Uir%@cI*K^05(a`qgZaw*FXrnPSr&lCKszY+^a2vY*s_`p!)akW> zgNE^X9=c9!%)6jbaiHNjHXh)&jfS~eKLe|O$XhHbT5qeOYEj{7J`E0+2&H993B$Ri z>t6B@;j`j>@G5HJuWv&~Yi{jH40GzU1aBdGN&^a?v&( zyI%znXJciaSWNq;9V2bqQ5!-|8;21P@(MsytfdC^<%<;+6G!I3hu3z;B zqNJl?fg1v;($S~^?53Bfuxm=9FrOW#bUxyr+hlsB7P+FrSS#g2jjra%S8<1Wcr8Y+ z7<`GkKOg1KocR`{%qgYKHS_p=D3VG7mdCG1g3 zmpb`Q!?ev80IE5nq|V-}J^C?8FZ%H1x<^8Hx=LIGRe{J5R&ACUL)JbtMzgSZeVk7= zdd4V}!Vb^Db9(YXkRUG2pr-`{#=nYiF6vExz(vw_sgU$+u*9ZrzeoihTta0q@p&#{!}`+;wU3rG9@k=86@~#5r$EE^-qf>=NWgGu>feAeCb_dfX1VB z8fR@78_KV+?f{?L=GB$p@0e|6vIQ^F>Zt0f)PnqCpzKrhF_Ha~;g8CGWrd_o{J`69 zUE^)QV~RCL+!XYjhGfo~*+va5B?64s%3o^ScikHFm^t=`h}$P1@CxvSSF}cAHo*B8 zaUq{y3PS;B+UFKGxFZ0i__Dv7;RVuBZ;Y5aZuJ+8;FW+@)ZMglc3=GPI2;I)WG0}c zsa3lUZhgBW6XZ&=k?4kGq|bMpHY{e(7o`o+oGd#>>pCE6hK!nu}GkW1! z6h7>POHim-l56m&Uowxp$=rk%?d35S0>w9blp;Qnryh#L0mz48H= zSdd&0n&4NH^1OyN;zzC?N;U~~@C%_u$J3`5D+ zh6mnjPBKT2Kl6Pw@lU9~RT#e2=-u`r?N2x3P$bm-B{G!|iU4RFy)fsod$(VMekz`vn zsZD(gq$Lwq(Qnbx8Gj^P9UML|voo3XWa}DDbD&rU35j~@RR5yL9#KYJ+kd0Tk)SBD zhs4(#f{bLZS9CncQO~}MoyC$nww39Tz~=6@Epb358Tj@5#76@ZE|VT5dvS^&>AVh7 z{xU0=(Gts`goi3>6+j~H#fJtcLeqGNffK#R*5wC($RI4&nGBO3+i8=5MSn|7wT+VTC2B(g88IN zP4M^tj&}>jjErszld)@mPFQkwpNt0{AXkX@u)4ntWNw@Pw3CHq-mPCTMj;KE2&zcG3NkmHb=SK1xELX7@gQ=RBjRVYpU(KVK&Y( zeR#PzE!&~a(m~a+dsO20I<$X^GFD(&z*XQX5m3N{LE6f%I;hjWjobwln59oMCFm1q z)!Pmxuj}6n%x{92S&XI!1hr393&EMP3$1J{_LkaWZ`gM`&CgMIdY%TdluV>aDgY8A zJYrwmylFk?u+ys*KBBpvP~-2V+fiyCAEqp+COUADOHF5F)l0V}tf}5?Eai~!A*7oW zl7G2S$HaY*i{E^(CC_^^v|2Udm&o9snwC|KM{*n1q&`B%Kk&535?JJ3EIx?r6f~ik zRF8m$a4!-LmWIpwB|KUdRZ($V;|*vce}Uv%#yt8l5m8)-fqT6R2JuAa1}Zh*d~F3S z;suVCDuPxJI&S4?=36W`2%+Mha+#V1;(;qH+l;ceC_hh^jkcK6;E))&;6pDe%qW%Q z#m)|^HqCqyWSt@cWvdXArI>n z>U$xa8!mvcnI&N3G#UZGqr;@OOK#4I>wdSnV-D?B(dcv$sq<%RvqguGpQY?{1RRW7 z)sL$}Deo*QCKV~qeM5J1&GD|NBm+Q9ctR7s67@HfuWH9g1MBuG30f2Ta1t(0ZN9nA zEy4h?>Y3%_`kx-#rTA_W!vk8-?vG_@p0%!=7Y!_VjVj=s7;(uo?mpm#`=Fa0rCE8> zRk_mrZr;|k^p3of8&@Vj@nMmQchVK0qrXlAFMKe00aL~O>R9%oh7L|1wP^3{=vSVC zV)#QI?RNe`32k&e`VZC-G7{Yg2B#uM)p1mLv38-POeo!&gqO=nh}5-pY69#5Gkln# zU4v#`ewfkWQ0E37804a3ic`n*5Ul`1L3YYQ>(cbfU(+P6l9{<5GMYU4{Lybghki@R zpmsFiy&ZkzIwW{dan}9+(~j=lFXpE5hDEsd6xtG7X->wAy<;$H*XV(rbHagrR&Hg% zUTRJ^l(o*F>43P%%H+1sODhmMGjJ8&@>;<`x)y^ zsjR-ePLnpA^AE)h&e4Tn7qYPY z957zSKXc+$WB5%Xd{t!kC=?8XCShs6@dluYgqT$TLDrI3595 zPTgv0cYdX5-5Or#T%w5a2v`kX`X%O+X)y*zAu2cHp-|oAw*bjH&VvAxO2~-3nKbUg zexRBIu%?)}(~LT{(dAk{uHbjGh3!CuDI1I9VMA2k^7c3V9Gt4ShwA{Yh=?y8h5UNZ zjn0~YySrb}hm1j!wi?NRgng9vj8myqPQ9nroaEu`?aO(T(XC27PxAJ1cIWwOsY~dz zZP4bb(uNG_eS&0j-9J6uYi^Zr+f_ErL029ZC;7uJ z0DGeTgkCMjEC5g^Jiv|Z@2c^|UeRnWRezTs3QAKH8uoUuE z6}Wc8rgYd9la93CNT}fTsSbRNIoDZaOXs;7S|;qkEPWi(3YPs&gr=}_HMyEeoA5#(k^xotHpoGRPi-X$7UO##*$P=;r(dU3uVd+<(WPbm7 z`TQK|>6}Nr+(-75=13|}(aE~gG>Do?$x#QYm&C(8_#9elBUESe=#HtB(~a*mMKQT( zyQ?F0@|h8(wD_R8^TEk7IgI$@XXP^F3Opey4mhnz4Lr{m$~<(LJ%nH0T@uEj0L=?0 zaaM7ak~Y?`r$Kg};A+rCbu%WxaiyYF4C5r;{o`D{gnKaccJ4QjPc7EpyQ)g2uXfM3 zM0Bw2anaE>Qj28B#F7CPgKLmctFu*|S0arp%E(n=l4y}Vk{6#z#=bQ{Q6n44>Ja0O{4@PPzApPb(FHlfZ?cUxtuI10qys0Oh zS)o*K_6(!sTNz#4rhOovf99bydU<+RDUUi0Im=dRoHpgExh;`UbnsN2(ruY};; zkcpgjuf>+h_nT0gm4C9q+p~55N)4VX&F4o9wB~@FOZOtJWREQ`2h7b`Z#$R8CtF1M z%WORfU5*8{xQMy0?Fed4PJ`3DrWtCS2R-JB{LEw=l<9aAm$mR+LWWuC>05e=xUg%yFH^ zeo0ikS+cvU2dJExn}7Y<8SI#r0pAXEI<8PtSfrAFUZu^W!iqc+yANn~+4oHF$SLe# z@7L0Ty~~9vr)TA>*%Ghx+uHk5v(w7rZ`x-ZrjDXLAiKj`Y5O!kb>nQpUgSt!{sV8$ zjXXft`udVa(kWcZl5jh7>EekBhqIkxmd&jrrUbT(sqKZkkWDbwK^lIa@tF#^C@!Cu zRra~ZA%rhj=}TbRO*a!z9+z_7wRaPdGd#)E#<&nmBKnZc{#YfBm1yj*CfBvmJwQQQ zE7??jM9~j24I|a2+_(Ru`F>ArVZ#C_9qrkCH$WVl|LaYUq|mUb;FkOFR$%K#)k&n8 z?Tg3l&TOfTpxV~g3u6WF=f)?B=@LtyKf$~r$Q`bF%+_yT{p?HwMm>VH?4Vu)8{Tz$ z<~PXSCuQ(p;eL3XIjuF9p-M>Vd|)?1@d9S-a;%LIyr-+m-5QFP=?IH$~v6Nkt9 zIKURW`@4NTMI-E(_Bev~>VXU+IkIyZwnwWCsXoJdT8KSiS=`N^K&%t^B?BGtWBQ4! z12g}p62?BwNj5k5uGP)1SMAuI<#lprkt4zpm}E3=7xzwlw{i7G;fG*-`DtJlAkipC zTfh~{^Fn*<4Bf%BJl#vU0)+*UacgIxUMye@X@T>SkHjoP?PamP zatAT>jjL$u`k|lONQ8Sd0fx)*;9%p92-Ir02Me_-P!pW~Ewb{iRH=WtgnUIH6mQFs z@=17E(O2l*9AXZuzZUzglm}2sF`Pei;5pOsoT9>D$o%_>E1UC^G;tjBeY5PSyaEwZ zM8zb&M-u7^Sj@wFkZUNRwG<#JgU!A1y*A?^dC}X=Y_^E=@y$FEttJtv8XN97ObDli z!d?<4Sm?D=)qr|;{nqPoKF@FWiy7hc>EF@iL-NM(lKRMt{*8@x&92RlE8M-OM3Xps zfeoU5wT!#fPKx+ch;n2L+pLb`)s`p2wrjnbw(_Srz@zTPzoK4PI;y(#_5)q)-3ZO< z+|uby=tXukPD?RnUB(6J5+#n);(J_QY`&kuEk{#?-Vi#mOff|~=r4I= zB~K|sRpgOVDJ?4@a558B>;c@hijwNt(W!xRv)dq7<%nnMR6;!Kp>%C)fuRpuFh=^8 zlsC@TX`;&sbzWxWF^1x@C{Dc6Jy<+hds%Fs|feef|RW`fEkL~cE zDE+q->#qhdw$&tGS@AIm4UcGr52kIMdU2^t$-W1|JZP(N1;|;0H}1OToDJo>bAmu@ z(+zxlcJQ37$z-}1x|xd`s^`_B`wCxnM;=d=z=7Zt7_E}1gl?Ndfv>2hnii5ZL#WJ1(BbUl;GdY6vIOdpdixJR;UVS@IHO@^AGD^Cbq$bUY>gTS@ zWfaI|rwt%; ztSEP}L%B6E=O?yn%VLM->E7nyCn~e;WDHt9D&!e)nl*JM6FFEKNICCq)-Ygxt|S>} zIE-t}I-`@7hfkxXmV{4>I}vW8!2g9qM%G^Q9Ul=f#C{t^K|gZ;9*-G_^+8spQT_0W zYTdXTxA;qgYFZb}8b7{yPzh63>jxycC@0QQ%Vd1$cwVTm2?g-Wm5HIgTH-|_M$Wsr z8?W@v$W^oc+E@@7n>V*hsU|RLUV>}GnNwz3d$t_eZ_?oyi_W*F+E9>6j{RuevAVXV z8Bjfq}41m3A4PSp?_1|-W7=Joy5Vj#{gKdxe!4hn8ZE;r2FfNl^pf~f+j2iDq zgx5v4U=gxA>gn{H7Jh5`VAF-?IYWJHN!ixq^8`b+MlPTrGO3IL1YV-HwLgw@^9W8B z+$Xj?Mqu47=N^(dJ>on@&n1%2T!NkPyLq>a{VeNhC)8d=l3!!nd&dYg0S$*dC_xS- z7@h9R8Arc#%nC|L&pM82`YcIVeOKV$OR*!b4}jP1W>C*BXHM^Yk`c}=nL4ApAc$>= z0KBqF7Sp6{&Pq!_)L+o)8evU&dC3BA&3SuowH_xrX`2y1yZmiiM8D#f?|-(}>QybN z%}w0Y(Hyqd)*i9@@;uhDQiuefbc~0R+_T4oWVRu&J+Pa8E}!o^clvMunC^AXkY*=2 z4Cf>g4tGYPF@6WN0?;+lRQZNipp8eSpKa4uZ}Q0F3c@*b(n>agbJ-@qNvUTjD@v-!;nRO1&6rkK4Sh zf+qTBLd!?E`nJOPwlSguz6Bi~-=SdJ^_OqMH8daQV#Ebk;jd&r?r{!A;ooP)XtF~9E!N011v!&_O@g42#RX>UtVMl! zIdF(q$SlgRZ<|EetE2ttVeF*GZtJ@p_oK0(=`!XqqcttEEU;siNaCW+iTXU8Jy_0+cW8{qwnIYU1yMme0J(OwI^FhP*^$>NW(0OG4 zR^BXWxEhrKC|>FTt^ypA?R!LV?`l5}b><+;_6wyTMW%C8wBaYc(KUQ~DvK0o) z{!iZWNWGjdE3l2Y@TlsWD?{~p3Hf7Ch3ZFdG=dwvKwa6FAh&PbWdbs?3j7(i47G@3 z#YJ`9Sv}9gt;lEpWIE9`VF3mEgs}y|g9^`~=?!d}rFBg+`+z$5PY^&R8^YQm+UtQo zTNBAxp_>W^5O*!-MU9=u3x*4pFWD3382$(Zm>LFH$wu2$R$5OxwkBIG@G2#BM)~5V z--O_8>E#>u0kf@KZ!07tUXXJ0g;RzqMJ+??=O8)B3ep(?s_YdUq6%cIke|(qgy_oy zvOv|r^w0pnsT5I24Hf5Q9__DB60=%4d`r7v`XAFYLKtP+1f^v+!L+q~q5I9Dbp*%Q z1?dk*OZf3sk>V73Y;Jj+8U6v$nAIbFKWP}1%|?tt_O`r~_#$RL^sLC1Z}Qivt{Fl zKX0^3O>BJjS5g^@u$~@7J8|-vtyr7xp#Kn8(|xNxzUpqi0sW(% zpSg#7dAK^;vhE1!MRE8=?-V`l6O=$B7*HKLnV#J|(nt9byEK*8;`g7%Sfo&c z2e^pzvG7vL87~zx%-|vJc>@Lj5MfvGby=`f>VJ#FpBUz%0dz&Gs2H~v{*1Fpy{o2j!nTu;EQkc9 zD+WO^V1gEpu=4@C?QjEedkGOwzFbL_bHz-5*U+HYcOUtjIE0otrv=Le)jt~S(@3Lb zQV>uT5ZVn&=tV~VvX8A9m5P5&E>0rhN5?=ccNnD16#hIro*;R;pCrtWj*t3lPD(AN z$JLrt6ViKC=<`?eBpZHo3gCN`fB@u{XDA1aLAQeD;owaQFT)wp3=6ER8zQ$Q=pO2N z%6(q(Hq~8U6(K}risIOi=*M6Y-dpT4d@(XUvhW8*mTR12!=I$YBrZKzWn)1c8zuYi z4Pi=rH}++|>mqxtZn9^MsnLkwr50HBH`IQecPCJMnN&^=c`q2k)Bs4z;Z_+}Hu^bL zRj8UT?FH%C!5Q)eYdhW?jz&+Kd&#rgmTwK4)~x?gT7M_AWBA=Q%MeLh3%O<{F61Xz zV?R!NGxST-54g}c@w$`C^GK5zcOc)3h@&hxZ761XpbWknIsX#zDq1BH%@8`tb5UW~ zI{Q(aWtJKd@l35SgYm=dk=4S)G=&tegL& zJmS?D){j!PAGl-v%KOu%L4B1|x17K*nVd%({UzRLggHcQ5)QoYYYZAOc2_(QKjGlSuae5euF1W z`B5@H63?dCQ_>@P*#3fMC8^W$>+L8jD(m9dD`Qh@PEuJ$)<(2NM&a5G-52wK-&I%Q z*n&kqNt-^eU`=0ruqs+sopgOAMaj~!mg(A5T1yo17rHwxLY;S%y-}Ki;0+_o$ir94xtv?WflOhG1q>l-&ScB z*+?9?W}NP=6g=gTb@rZeHKKru-xOBXNmK=iX^LRd#()N8S-)Au=|#ohs+m4h>7k%u z=^H}(B8oU>~~xX;i0F(g>6IPZQLXAdhGe(e3vB@c7*2+`5&1R8H+sls1p zKZLqR<;PV3CY#_&7fx3%X%dHTE$mK=xGcO2k0lqbD0)_yaTR9 z0Un;f5Bo@s`4qu~Sxc!^LwExrpT;q5628BfzeN|6nqtnMf+=^a-QzPVr`rbU$P;O8 zLiIjYCfvGDYu8%xTVf{uTq{YIt*9hG71dL#EFOAndxdzssdwX&dtgBB=)j|_rPQG( zl`>xPYv*)jJ4 zLe)I{8K^>0UcLhUAGbFbS)u}>r{)+L`F$bt^N>?K58N~FN38i|8ysTm#}*k#+Dnkq zO`ValBhlIC1fqKVb>%R0wP418OmXpS+~XoJXk1(CqX#3ct-}R5?2K_2go>HOC|u$v zr1uzy{bTo;7@p&PwhDAF?10Wm{q@iBgXhC)XZU7+%0vr7bxw z_m}U#YJZtiE+W*o+Zi*V&Bum>ORi@^S{dZ|nH&fbUcNaU~t* zk_d!1?1Z__@=(HinRf$6@qA~hpgJZ1v$ftf3BFPHA`CqpZNXJG?b^ep_y9fh)UXoP z@F;xO@Emn6D$mN{9*}mpSAQM5GaDu->Ij>02uHNySPV6Cf<2ZEMjJMS> z^@w!(ejoGoHBbDiciP7?jnhDPHeOxVyP<&FA~Ely&p0~3JKyPidEbYx@LB{EQ`>bm z+kNw3#x5-(D3`Nnze`TX$~#F#pRytM+^a#Mrl@$}%c?`)2>Tly)5Lg`WhH$D>-XP3WBoSDZjXDa?Hh3f-QaHpUU0LvNB%erh z_)T|eEx0}LE;}{lSticu42a5J4rtBM0*~ZpLdH34EmNM0yopc&hS~y3@c$gGC^Am} zH{XI@#A~z}KP#;O%hRCVLykSd=3GtqmYw&rI6Mm9@8u|s^$C5oDF>pQ&wgw`14`Qt zAk|95-eR8divj}iVZvyCsq5bQAN{P4{8-CK7@J87oR!YFk@(U%9Xl8vk?2uRXz|66 zt|37SnsulP`JO01$N1!Macn8x(7%Tp7=({J)PE0ZQ5H`BrZ-9TIZaa zA~Lk~ka8KpkLOCDq8~Rl4ysCOm?o-9?XZ|TmoEtfO9@4`vk+TfRGJ;d8bRQRywq#7R+-^EI@_V^JCeCLE+-9G;k^-2BH}uEn^iK3nLRH>GCmuJU&N)sPc73y(m&$zhw zl6;PUSE#~*zfQhhAgB`8{PNAZOtK6H1mp)YS3^&ms@Br?h-;|LP(<9OZm9*myW}Ia zsG^k?muA=#Gu{#9-?EBF$h1!7rZw!hsopEZ82BQ1`D##OH2y)BudEp((AfUkUw$?o z4TqF!UDYRkNY38p#v4`0tC-6|DaGKP!@}=AJ7T1ME)VFd7xPzJjZ7?2K4wN=LuDY zQV7gIiX~ekp;c#wHNsSV_=g48OvA^9-_+P932<_dc3u#0lFG>I9P<#y;uJXg&yt%^ z;wt1an?$7i@MtaiLno(^VLyc0?y2MVI26LomKCBxxvB$9FP#+vD^U2Aw}E%!pfBo{ zGo6`tB#YDCB=E2c4AIiAzCAhbqc_-O;dGecuvb!TYL?&_$6?^uzzn@A(iclNxiHuF zX(@g_DlWp?kBRo$OHis4+XN~YpIA@q8!Un?GdEa1{bT5B(bHyMMbTX)-8lcp&~NWK zTG#%Mp-&q~T5ZLI1;7aXIs`-G|hA4n~_ts6i>K?)QkPA@{YubSa{8;M-=&@WXd}EMV7*d!`G*2E-kv2|nfA=VhB+ba7i=ih-sZ z>?9YhH{kyg^uw39cIf>&ZNXrIp3&D8pB0aOA<3v66A!R;Hp});H`2fEpx?DS*9}|+ z@z{$N?IZhY*3?1Gib=6)Y{)89`bWK|mk-P40i}*{L|uk%k2>%vb=bfuES;sax)VM+ zo2oo0wpMFQyfNnYccXK{eqcute9>PULo##lpYjd{D#VC^zPkmoRO_4 zJpr?+m@=SNm?-wnBEO(aYc>FN-a3SeGIQ0`p#Bq0#Z?Jx{{y%T0F^_uCG25(_+_4g z%YgPSU;3@%qO1K{Uyj9T;aDC=%K(u`-*qqK z!+&LfMZf+TrlK*|AKqJ*^=QkzY`EYFHmNFdBdi5%#8$I!FT3i#ssLmunn40Y3A6^K zZv}MBM`!Z4uVkgNUH8?=X`)ghQ4D1AJ4^Fu;#a0j#Xh4$P z0;~4T{9zLMGYWZvn?aJj)HUp{W7PUb?uX){#Q}c^`grM*bk3T?=y>q_2vI4%?7oT+ zsWY3%#dRj~Jx@$tF&w|XydtVhpz!|-16DaSfi$BNj4E%)fr>nAUgG&o`{0kq#<9%R z1=P-8V9^%Zg<6<42arEC2T;pQ!VwPGpw@#?`xe1Jx?t3v=N#Q{0(I?bSXpvUTh?J1 z-uhlo=k&RXvFAj0&=|KGZRjK3?oo@i?>;@@t?v`_liKeWv~%gZ5AR#+y+FwFIv&on zfC9`r10ym*qdw6Xwn+@N$COXA3#p+6Q~J#IW^J8WIqCh#;y%Y~gxd;;pu@p@tGU*e zc$~;fcO5U~Z&`zI=J`@4y-8AUedEy<<*$kyoaXPh)MUr_)tHH3?+7E-zE2tsoE90o zPJWtkX*w9;sr`%*2IoJ|RY671Y#2!W2Qby92rrcq!HG34K01StYzvXKHEh(BScf<3 zz_V&C*fE4pJ>arELzw(lZDF;T@?RGKH6NZc-7xpJ3n*4Dt%qP3`_~1~G=ONhgpdcH zRY5cj$X#45RP0b1e;W;G+(*4$}=O#pXKAlnqOh#6@#@mPpj z_Nsy~#OUJ;jcbb%Q(lF)i{|l<>~<*1HiGR#h)^P-jGP;Qc;G#bE$tlshifZ+Sqzp3 z)S3`57unk5uK#5wJn_D80ndg;?1!4lteXr)Fk|++3Fs$a1lIV-XBX39Lb0HWJ%)jt zL*4eb^ZDG0x9Z!+mRvjx1a;kyU%&Y~PVXBF=353*)r-0`@vJ}E#YFUKY<`%b32quU zUp+g5maa?&Lxr>T<-1$5{g(w~ z;rZ;60dc!kKSR&Oi+l;UrIa*h`zJdv5b%(yuBtp_)y^Q$XKtL2ob&J4?(*pgOu z)Z7|_frRl`@Lc$sjM_>|{iEUsBU5k4l;O}Q(NwHg6-jb?7WgmCPap`|e_a5n3}8aa z6DE(G*|2;aVbig#0gI7@bL)$7*5O!R!{8vlmh3!6|DI}yN|#ZW#qWrlqa7A6>mjIgCw0H>;Q2MUNtB0-y# zSHr@=Yj-zggY8K0>a_katW>pgbM}jmYPb$_w%>cJNyHHpZ6Sp%2ODx7E9txs z6JI+6%3aS>bj&-mNFSEN%Yj>0J8iv&Y*B zpIeF4&jd|IkEgKyX7N|2Wb+}z?kFF4!u_H9ctO^cO|wKZUEA{7(GN*LFg7W`Vu`<~ zX`E4~szruyoPb*NzQAV8Rv1Ku>|jrbMiv^LI;J%VVfM87M`b90MZ<|--2M*B3H2Zf;CWZn}^CL-CW(g1r4t-N}i!8g}D+wW|_T7NkF#vptHU z{*49le_&%Sdua>qYvyv4SG)#pGXzZu-)@%%4&G}qgZ#L#G@uB9){MjjL30S%Dap^T z2D(ltls}?nM)MIjKW0s;{Pa|41rzy!nnXGoe~J8BR%lL|Du1MzNGJ?1gD=RT$*!AK z|0D9r!9@P_!-VHF92@arXxPT+$&_QHAIr_d3wOT302aH_~|48?}SCMGejcUZ*QlI{wuHvFOYwHG^5?yc?&x-^Zgo=oIV) zX^S=6F8Dr6qootL$@b`yd}nQue8=Cw@GBgpCTC4#D9jgnErbFQlUPhkBpVZ-edt>? z6d|VDD{mIbTbh!x_=Ry`B7ul(KSOgZ!)DJ90J=&Z{i2De86~am6UOzn{vhk`9D%Y# z3PiJiNWP?pBVp~w)9TH|GfjJ6PIn|b@^m5RGkB1%WlD`RP&f}UtB#Rr89|ANfTPR6 zrh=N^7@XC%%2I1b`83E)5Io1Ggpto#rgEy6lBPI`7m*jU z%BP3j4|+Ap(u1B>x}Bf=J#nYfaQl<~DfwO8XxD;oAjfuV1L>{|d~h)EvdaTqkmhLD zTZQX<>XEYlz`Pfja%L(2;hq`TT`-xk^BEY+FBTW;}tu-5qA9Y?_jf%n9L{XO2bY_sok6CA8M%A;7C#7RQ&|!@(2U zkM8SGbu*@uXozb}B0sY5O(iMKhXeIn_yxLZ?+u?^_HDj&e+7pG1K6I#x!{nXPVW|e z#be#R2R90!pmzG|eEjM+uj*B<)f%-LFkr-?BuF-O!M`nUL-lgyE(zrZ{~4J#1wmTj zO#B%)R~xW8KrVVYBJ9I8~{~l0h{5)*@R2&^GJr*D9VNiv*7@!vhR=lan<s{f?~q>a~CGD7UHkt21e`rmh@ z=QHXoXfmF^V{4AETQ^n)RFKY<)l%2ZHLRgC79Rb-hJFax&=0*1!26<)TA&A%u%COY zJb9~fP%gH2KF_K)+gO^NF+5-!AuAs#_K)c=dvoc_$fP&aZmZjSek^=w*KqVvXc%yR z&${$=JRGS^uhr~g^TkrH*wdyuM~`sLEw2#ShLOyRwAv!Y&vurb+uwucH^-}anYb6= z^p**yNq{l8YD&wu3>9rN%pVQ>L-g%V&+u&_o1yAWLf!_a3trn>P|d=J`pv5iM;)?R zXix;PT&OJ!K$#q?Ljv8O*uGza;^%eFjbmPHTUx8+?qI ztG1*pQM)Xz`yq(;M=>fG;+HMx>wcQlc78Wn-Zvn%@}NVr<%}hrEJDxRC~znug+GrW z!3DO?o{43GsEqMMl_Q_TY((gHaTSD6G$jkFlz$NkN=+&`0|Q@K#;X5o6nc4t3vbDK zamfd)wpFMepYM8r8gBh+>3r%9T~9j{?kx$$zL(SOeNXdrXhE@&rc8ppMUiZY?k|`=AAt=1ltjGYreN8 zcb}tES8rvpEpb&-`h5I)c7| zKTiUZzaK%2eN)DaG4=R! zwHUxkJW89{F4i|ia~qnEHkFcc(xM(4MYjqqv;`dAnv$pV_zK>*DXNptIK}(8D@Slp zG+UEKa#CrN=-oTQ!l&XgOeHv5y{k4-sO=+Fh#E3bHrC!Tmear_2N9@o9YIkDNg+T0 zDXA!^9;V5>OmHKw=}nz6g~jo%{Yc8*8@Px?jNdFX2w^2-3|n;Zj=)L6F1SdrIxr!2 z26)^yec~$IQfCp2Zu~X+?i(x*AhG6fBZyK6s1Dla9_i%$m^UCYR?T!WJ(<}>&cUAl zI9o@xfSZHA`VOB>Ra=c_Jw+$-%DNBEdXB-j@2({VJUIsTO=7p2;jvvzhSrLf5u2dm zdfNRcL}}0Ntny*RM7DxK0t;^%G|a$Yfb=Go`b9~18dDwY`LEKcjaQOx?O*dLrsHT~ zwT)CH-TL85=$6fx{w`WypiLwO`rd}FZll4RzxrR!pDzSH*dITzreE1lKVA#XXV86< zG1mWM4X%@BCw=MWqHr$30zKin3eI&HW;hy>Satj?p5#y(G6y7F9+Kj=y(AzGO?eoG zsEkDuOx9tAfgiY!9M4Tl@n4$&D6Krq@1CTNb~N^*ClrC(1kEb_0O+xQZNi8?xJ@Vl zw+Z3JmiLLHm4mxLt;JI>Be)=0b=m#8apEV5o5i(xyAIa;fAe*Jm{7dYn=CChxP<^~ z{=fWUavt<_&>xc=Cou5=HnZS<%VoRDL8pr;3tgzO&MLQxl_SDU5P90k3pr58Y-d_C91cM@S;GeI|BnBIN0@rxa z=RCgB8B|=RoYLDGHiPlV=czw?jG;ag=II@nL-iJ$p-%4@f?pGXxz9ZtJlwR#dXism zA2SDe-a3EYYTiaL1g#tfTx_sM;Ty9Dl;Reh2yFW>JYv4~1@U@LR+4&VN8+cM9_$W# zsYM&dBx|OesUwY-=IK0Wr#)JOKF60WKATeBJSJ99 zmJBkWjLWhCoZtzrsf7qZy!F~-+c{|u2piH-?+K}FrrQ-rVF??O%}GD%fbAmiPl%bZ zu^)>q5IZO?7!CO7cSCVk+YNnwLx1@claW;toooxDCc*?*=){7fjnv<@=&vb_l}*sB z@+O|cNu?A!!7KLTY4#+{kj;*w=LRJQ3MZ!t!|2mD2W-fzki(IWw58g_wwh~O7>;BF zrBK*4%VtC^&|YqUq=xxwwL~#~o@sIOns_swAJEUo0P=xD5Sjnf za0EH#ZZRy8Uj=Ea#axEo97|EbGwvV3G&T+pVF_9^O zh|itCD~GJ!zleWr1(J6Kpln8W(gEtn({dlr4bo9Ja^3BX8uTd7h)SW|3raLk5yZTQ zuBtl*EB+t6G03w_Yc75*GK$+>foV8tJ>^H<%Hs2140MOrkS z*q>TD6aLv;6=@vbW4)0qs&2CqiRSZwqYGa!4Q>!j*USVI2jl?f?n(s_v5jMJgy4|J zB!JTU_1ZY(?~bQ&$aYRTVy)HXTO9u+Oqc(<)!wNUF#QI1=N%a;Z^smG>kXcsiBhp_cY_X4cMwF0`>!34W zz($pXF(}HotVPOnkjSA3?0qlm?Zgk;PPYsSA>@aGfn+*an=DspS%Xm~X|^HMOO(H# z5?XT;%5?>-m4go0`rW={9^FbK`s;XjG~O6X+wnZCLZ9ht$VKyuFSyUw_Af_3MG=cd zIk^8=kz7_L@%vb+Ep7u{XLORYy`hNdk~WE4=+?x!n0@aOKW-yr<(OcbJ-(njcPcMI zF!nD~AmTb}V{V2;6S})4wNr0sTKQh!pXusG574G_UZ&crgJwL0wV1(o+Z}i|lDues z&1|NP^MS}Y(x`?IsRy?U#o%@U(rif&XQB5jPalft954{Lw@T+8!+gKvQzIBJ=iO}D zxOt1|bXVSPN2k^i&DOr97uh)nhomN-Nf#B>v6x$)Khl{ zn0u^!3D2nallhx2KuE{l$quj1&7a5L-^YOof0gxuB0ICR_*$~a zeyaWKBJWN=9{q3XQ)&jwJrc9ML8*mWozYZ|ge>VtpfU2T* z9==gICzObckiPv%|1}vEec>0pGC3r*{Q#N5QTC6;LQBg4=8|i;h#1OGbc=d7TC)CJshCH5}BeWtKfK`yzh)a^!?f9I#;n*bt`7zYASE?+Nd$$+$9*;7#&)?I3-2 zQw+8D>r0hU&Tk@M{uBLy^$F1y^|)I9HZbWw?fW0;zrAa0qG1Qes%0=cVupIWuUjmK z|LHy1bbHoj48b1 zu@kWWtkZF43AI7E4;KAxG{lK-+huD?eZ3C>=$F3-k>{7%lgjF%cpnS7XMNV&Ed1W$ zpXv=F1rDKH>wc{2b^x%cXJP5}S>{6#qDSN&-WOpHhCaFD8;ou@*odc1N{eE<*A|7a zWegI9z1U(OiObIfr@WO43dlm+1MT_Z^ryx%Kd#oz`;p+el|k|#KYmrA~@PK#aCdkZGNh8no%d0>?Cd`kz?ZWrx-D7AC;WO_UYeK*8y^OsC z(&;&&*rI&gc|KH#=ez;GUOeY>ghJAZj(Rhc9PS#k=7sfoy(|Bvy#xMtPjBMLr-P}s zl}xzHy<>Q?$`A$6adfxYAmV8I22dtRR3>n~^fof&S0>WSkTaMA6P70|{v9hA9PIiY zXNS>FEUPrO%b1?sKELHB?V(<~pi;68_HPKZBiqPi`A%P#^tZdLavvMlwHsD!u$K6J zMT~aO+a+9=$JbjwsoU9_58Ao@tmKuBbv9}VA*ObjNdI5iaI^?68-S8fk2}R0zRJ8z%zbv|%<=r`G#hlEc5Wp&EB-0-QF`)Pu_gga@PwM?GUeJ@Gi3 zClU9Ckjp4sMP}9fEzOkFoRmHAo10vE$odNRlCjp4T}ZeObQSi@%F%V0p1=JDv@@48 z;^`>ics7ZmHy+T|gueR|WyES7m-Ji4Wk92H2#NkwBM%XXYKkpLu`wrea7MUMPOX3& z^>M7>Z`puG8+6Qp?LX&5Y}gxAH0=beb!_ZX$blf@i0n zztaR}pa~Zwyrv7pdJ&*{?iv&qt^al5U-%n*Lx;;;h^qT+r4(%ja=KxUOYtqS)7+)`T$-Eal=5@4|~x zAEMEGNZ!>3ioiI3GZ^O=Yj`-rGfkRD#v%lcXXLy>6~7-CO&6p_zZC~yDJkGlJWLY2 z?+_ws6aRfnx?np0)f7Soe}pK?_8XLz{=^u#RFDIg3S&51w?wr?TR)DgX+g?Rv4zFi z*y#I6r&fp5{iLB}HXA5^O9kP-r2@o`u?;EfP%i8HPvRL;x>t2! zQGhMKluQ3vhxXH^T)N*ss2a#@O1j*={N3@hdb}aB3x8lQ^)~2x;S`YFIm0! z85Gv7Q+yJ0eaNZnzQrD2ZL(X3`N09s6V&5PEcCd3JB9cZ_SsVJh?>1U{?4{zB`rwI zT1yPbjj-o%R}AKrYhargWa?n45%4ZGumO~FR27Y1pnSSUUGVs#gzYM|e!KLa$8It* zZinfY*V$k31PK0_VL5@Dr|6&lGwo&}&K(j;$aReJ0)8u>HS4p!T+{vw@uz8qIsOOn ztEM(J`tJBUfy7*tEZ!eLeE1HA_=`#hrG@%3c}rNV+nZpFAMjJM_)B}lBLKEn1^CQ) z8^zb^U?VZD{;E24lRr1y#cG*EMUkv&o3rqaE<|NS$!zhv*My?uNE-jE6NKS#g|fpE zwxOZE(3MYBr?uaDA^9=1G5R?a;GH}`s~$)j-3k8z-_W3#b18}j|Aou=lKQ!C3LibT zTKbBIF~=GSbp`7@H#3PW6B`3)5?57oPVz~YfC9aTM(*?`%x{eBM?55h7VPTZO8|c$ zSx~U$8>7hh#`@W@S7eM!Lg~@C*b#cliI`!9jm)8CvR^43iW}#JA>Co{lOz;StS242 zJn3H35(n@*x*BXHyo=W)N;p=W*~?^nZTduP0@L8~WA|$Zp|)gV=4U&Alo(XYnP!4e zEX7>^es())!Qb-tu(dGf31xj|?By||dG2Xd3@dq+z4h?{D$bfnuJAi_pWn(7^|r<4 zpT;vG7mZu!E0t2ai479vm2>LWM(|ZB36!M>s|MWTMdfGDg&pY&d99a2{6qY+^1FzV zG%w%f*)ICee#)TI!4zNyQda3Q1#c+l%O$*4H>Q=+$`l_txD;kT+F1-0IW=ZBgJcYd zcb|!xmq}+$dXcjF5PwBP)#ufFYZiLSuq?4QQ7TmYdB%~AIb$MQ}#^UE=bcoKm z*n9(+~G zDz5yDe+Ui5U#nl1x)uMAx||(+^JA`_=<*pgI-cgt_Jv<9UFOb${KQTPTvvG3ER%mk zClzCck8MOcLei&7Oak+BnlT;@tI1{ez=0hXsG|R?@`H-CHC*L2YJ&8!1!PD%x(_hr zbh8~Xn5;R@hQ{{Eazg}Bk=`)d>tRyZ7wR+Wv&HWeRf)h`%X8!Gr7;xu$FKp;kEhJm z4%JadkoOb4No|#wBp8&gJ=Upm-=?n^cx384>!o(pt!R@jDlyT4UD;oz->WDpY47UF z&=Re~Zh6Hg6!PWWirB;&`2>ouUT!IcTR&>zDVOCLWp%j-^3Z$wPl)=$l7qE<=xL$1 zBb#1xmUsQt=kGXf{AhAcIXM>a$#foG5Pd)@%uZ_<0$DAELzZM@n{WX(V)6=mh86p( zW&A|ApDv%h^z06SY1d`<0gQ%kY92rMwjxp)QRVgH0_VoQKHFm8c_9$Oe^v;^8PR+O3-n}#hH8_A`2OB^i|4AV_3-5ovo^$Njh@#ma^g!lOTM~hI zchnzLk?E7(p2J-?*W&T+ks913JW81%e9Y!Q*NE0=e_oE%_60JUV&fCcYz_TbB~hw- zgZcCJ&$9w|59=qIo-HB{1Yhoh{lf*x)lgV5-p&6w&`s_Ksfc6Ba_q}mllmiEh<9K? zYJOEDHzNe3czUiasRHdhI9Wox$1Dfqpn@89hGcv2wH!tL<2Y2CQN*%@MCKQt_R-fCN+j5T z_&|B|2IM!I$`mcWBber%Zq;Hl7lb8{Yngzj{Bg!qAQx;9=;p&*#RBK|9-S4ND=Hx;ClVd_mdpnz>O?^Dx%^ z;KIo5{^%wmRROj4)56u#!;rKxP<#XJ|KsW&zw>J2tzpM@W7~FP8;u*=Xk%xkv6IHO zZQHid7){csF`ujV-g~@bykFM;u+HC{^YC$?a&c-wxBwLNi(Uk)Mwt((__CU)vJqWU zH1!%6HjU8;AdO3 zbw_2G4N;s|wN#v!Z)<`;zv%pdsV@W<<((jS6MpJ*|3c`0%?EW*^I>*|(nfxkAlwb0 z@JTL4@W;MAK*@fEHO~~m_GHG*@`^Wd~K1qP~`laL0&3bW^L#*|D4w~H@c11=_b=!e2 z4J3lF^vwJl3dNuF3d`8JBhgaI18eBA#8rmFt3xWRLA$~!5dw)9JSc<_v*>4mJ;F;-VY>X9X}qZK;;K=x=k5S`2p7K)vcaYRtGzv zIKA!V(|Ob>qC4iIJZJUM-?XBL_F-U@E7UB~G0N$&Kqr-t)uuegEk|5q9j@UdSX1IJ zEk|hg#GXcPQ9NgS4D?qQVx^Ktnw|-$Jw60dL};EmQ?fluJ4Vh*n#q7~IE>g3D0_vG zbH7~h1$|1cV-L(!B4f-l6Xw0>T=OE6nFt`=^3;Uh3MX<;4J*Ec=g=rx3?gj;Ix?IQXpGoFpwx>`Sd`ecR0-dcdj9&ZjdV7-y)jhk*8sO%n4yztPsa#qF9@=KO+cT~huW&8 zUkVnNNLs%f1-WdD{(52@gdYQJ-<7QXNId4%<{tJ=!C`cLO>e6iq(L-2o$?LxPn?!Uvg6eI&+t*{MX0O#Okcr+A-l21Z?1FOL zNng%Q_a>|3oAL~0wg!^>9Xv(3V5So&{M5!)wP1HN#~dlPI?Q*%MQ zU+F^UoJI3jfBQOPzRfNI3eyj+*7w-qg^S`YnVvF?v=e7)SFBsQA`+xS(0 zzT2nRIDU6NX}rdl5p#<9JG=2zX9{d-JVhBC{#Dp0hV()%>-C1U6e)^S`$S209Y>_4 z*p;isRRkp!2JewX zV(#=Q)6mxt3N5ExQ74faS4dHZwEKj-q005Qq+fRyXE%LGsW;l->VT;Z!%6{c(w9jo z%V0TnhS50$2-u&R%fxr55q$oA-7$1lFF-XYr2Kgjk+~8%q;GRbQ?9>f7G{Vi9D_EY z8$IOCPSj;$(N{RVhXA`2dTv@C(I_<$dytiaDa@A-i6F(n~DxUj3XTX=#RcM8s91n z7aK5mq2<)UZ<oZkoW>r(Fi9SWHjE{TRd zT3a{O=JLG=7UySJEJ-B={!RPzJbWu&g_t9%>P5Og5|&NEb3sJ&`cu(gDwwRApr6_Z z3G87Sm@qh^zZ|o1mXXV5Mp3Am*9qKU!gsZE4tVG&tWyGYTf`9FZr|8~1prIw4Uv!D z)&<=-?DW}eGOL1yp2o_u2i3rG7U?z^ZbK4vgBXO$gl`afHS<0!Brt=FZUzLYjp(MW zTfa9^eb=VCT0yTVvvIU?1ar7e4VGDz0!oVSQU#Slo6Z%HT7f+1(~>dgXE4nLG#8d9 z$IM#;){4byNBqA@hJ61hZ2}ice$`5!NPm(X=+At5N!DZ|WaULm$vxdJ*nA#T%5G9> zxDEv&1&wRJeiW~ADhci!Tb*;8kF-KwL(`lKj&4fNK5VkiiNBscY&Vybk#QJ3r=AH?J@N%TgIVzi+($lnlWhdG` zSJCM{bBnis2voUsTl>F@4?frX3~vOnY1NP&`h7#p-I9tLMraN_WQzXMi#yu_;c&`( z(HCc_k2GnBg$EX&NdWw36s+RBT}C_+`1~^pPzY7%pCOHw?f!_ks>CB{@-BR;G&1dr zP|K&CUM%KNED#{~bly~2{HEK#aNj}w%^*}L3r|C6k=d7?aQIqo)XspND*V|rM-y>| zyW~gH=Gm?Nmj~&(ZVV@7L<5P)uOj|Wg{cH{2qTf&KNGQla&r}t^xxJMns-KnTpM|^ z@TDzysrD%2XRoI}9EDJ$RuUORz8!i7gZ92&-~W8?|Q$MLsZevmP0VrK` zP(zgmlW#H*6Cd+Jku^3e&oN!YoRw_I+oB2s-WR(2XcVNp+kt#@X2J~;>DMdX(2J?j z%`t*Vj|J;(Rsm#<3aaN}snGY5ke7G{Jx^Gmwgd35?$ApQt_i=x08R>%@G2cA-lLBns)K>n@Qb7ce!f(k9E6V?jDDdQh?CA3EF77w*4JEJ;FtsNe21y^&s;6H+G^bE2Pp5;OXcitzulbm{>I_Cw&z-ySc7Xv?~5bKX80HR>2sWPEo z+0Y9WID?bAEtI(KsrSlmR}eR~S-zi?mRtw^BzbX%eNr1pi}IJ526b()JYn)b&VW_p|UPHwAQM+iTv%P}jMz#<#So%HQ7#{XbOAkY5GB4CdH z5eFqY$0os&xn0g?163ej8{`(&%4dAF7lv(4`9jO&t+d2MZSMMkz0X=U=@h)5BqU>@ zi=pU4&11c{KbP?EQ2YoR&ZNqVs89K$2n*HI(YUBy29I`2$s7j8NI-5)D7I8*Y~!y#HfXK3KT9EE5>vss#N5H0P2#9aH51cTklhQRgNj}R z`U@OdbzOVKjxd%-0YYOwUdF z3$L~#dAN{V5nB$4^1p2j^|3n&OD{!aSzz1v!17^dkFDOeM;yUJbR+IyAl}w-Koo-C zKMH{b>GJ!p6tt#%Dk1u2DFV5lg;*MQTNvTSkyc=weL{aJ`&Qd?JS7P^7pnc+lJEd?8O%_>1`Z@%ieVEDmONWBF9cVF@dZcv!wcUJ)k@2&U=uCLmwk1J zD`iy{l5LtvceG*NXu8i^cV+_0?^@W8{`m@Z*4gPu4I>DLK3=6EIc=jL3W1uuGv#pr zivpMicI~jndVFf5wcTe~Nx^=TX?ABqf8rS()fxrp7Q#gIG z6lmmL>`L*>$4JSW!U{KYNIL+`-zsPO;R9PwZ)M1dLt%##3TLVGzdyc*P_w2H!PTTU z;^A;bxz05wTNT{#Ag+RRgS@7_hj@*L>M9}3fK=@q|08x2in-!oVXS#L!l;0_i+4#FJZ~l&ET5Obhp1rq4b9TRLlBv1+T|bIyV0C!NT|o7ZYdz4 z(|;Z*)E!BB$9#AGW<`gNGizcb@9_)WT^>@~D^{e!88Jm*2ulvwd!H?%ouyVd)zgKo z!i^qh^p9$e%OoJ@Bw@QXQlO2jXuMsM^fK8~-W%v|U9lF!T6$aD*`o@RXi7+e4hi{| zoi^F`jf#Yopx;T|&hw4`IA+YrUb4w?+v6f`6Z3GR$TU$@>D6+)l40h@6CA-U~5mUCM2F)zUsGc@)Ci zT*9W$I-@~%HgQaxP%ktHE`P7ML6ft0t-F<5%+9mp$g#i?=h>(jRnR&3*B*p(8>i$r{TBvE9!%3MgUeK2T})LBUK;w%rwq$?L{ zEBYCkg)_{u8Ft)FCV9c3zE*CM&Rewlipsfq1w zXPQ0%zmZ$(-0jcfa5ygb9ZlPYAK?Rk#(!{D916B=A^EDGDMEe5ym4B`obxpaq|BoT6^5lq;xY z2k;8m-!16kv-Mz^0y`=_?!B=IjTEy7Ho|DowmSMTbJLF)w@6O8MDDPlOV>?g2Oy+y zB9SzL=&FsaYIu5W`CtWwQ^^x%FJeex{6#2;BDrRN3rhJTI zLBq&NhfyorrXY-Ak%E_}FpOad1J)&*1detvSsmHbUhfm1^Nu>wKS8`les;sV%h;~_ zYlZ9PZipoQ4U0?IuEF-Vk51O7J@!IBgAnyICtR6-Ac0i=B?^|5@g5mp_ia=LusgH%%n4)UgIB!s)KnILX#b^Qg)R8c#3UXHSuSWgF|9)ZJN{k1 zi2S5Oj~@SBp8MVgA>%9$P@|1TE8}zWMi3`{6k%%8Zj=~knTRtx3Bgl^UuWN4VOCaV zW%66~Bl60KW5r{=zrG&&1zUz0saKWKCDuaByZK#epJZ%|5Ra$>*m1?mslfhL@UT;d ztN5Q&fZC>(A^YJ&JP-6{1Tw2-FFp<+)Ni2 zyy^F!1SL?&;&1jQ)&rI;KS0T99$$in`;6@KNn{>!Jxy!k67xi+J~63A@ohE*PEV%z z;P!EACds%ivifJ_nMt9KuqgQH^ZiFhd(96Q7T1QcEb)u4Wx&i1n9X`0jiI8$aClC4 z7!31Ig+Ngcy(J{RhGrtoBl$CtH|=>itzN1h%L(L|f-;0TdMkq07DATRgbR@2w*pgw zbV!?JZ{L@c<{*JgNjT=WSB%*xVG3va!IXlw`8!K{{BfF|eM#)UNCeF1JGNo241Z*+ z?*2STAf7%uxdAst3I`mO`wd9@WPM1V$lr29X0-;(R!)(8NS6Ezu@q&SSy%zrB!`Uk zHGcW`;MKrIzQnq}IPN)9EA#QkOiWK$o5YYd-7LwO+Y5gj4MZoo*BbK0D{wBgJ3V^R zQ%(&s&P%mM9`xx>#dRa$48!cwEpm15CZltSBiN&bb$|-=?d?rrD=}=?;HDPsag>K% z(+&2Sg3%^Fm6ME@myiq)7i+(^D|~ZX)^q7Fm}XMXmTvdeIg=I%VK7#5D_qA-wgHn{ zne?88JV_3X9;co2sjKXG?<1#zu(62Kb4AXOJ7aG|OzBb~-JP?{$nS6H9{Y>;Fs3kO zeEcV}RX~;JI}$1wlJ04Dkod#zchz9m=KNJXh9~bOxo-X{N?zQ7{H98svGSx&8xUU* z!mVCF23E3xiRWdB(N}>#y$vJStSP*LM7$9_+~D~U9O8u18Bo%a3+xA-nPg4Vx1Q1mNY*^`*5(wX zXoOVpoZVS;jn`g^gb2b7-`kF?W*YAjLuI^_GIt0bq-=2=2s+(Y=(%398e2I8;U{ju zt+g6*V9*riO_bBNt?l~4dMSy1idnpCk3 zwCi=@y!4q=O_Q7VUv^JwY$SW5xvOUcMsX~~EE!5@54Uwjw4sXXrt4faj0cpk4@<9T z;QP2*Uzw+NC8cc?{t#|x!C}G`VU-MTNAJy*OSTcd>wRe4kvt7UB(%H4MD%I}|9i|5 zUoWO{C<}Wb(#CWjVs!OQ72DdN0&K{|vg2MvOqXvK$ErA;|F1-=_^!`S3Aszb_fJ5)ng+lkyS9j`T5qUo&G?Sr!|3s8@si&T^Cy-KIuKiG9RKa@ID zw!NmQJ3?(op0~H;0T1Wo*Tf`RrzQML!(@%!jDF^h#*>n+-KAYJ6a1ApPb&$`BQ0)r z!4^I4G%c>4!%yF26SG=*T!O^){Kv#{dj!DCG;luqd+C`|V9_KUyR;5TgamY+v5fD5 zETF#PGPHz}(Ag5P#9=qe%lC$oNE4DQ$@2HC$k%9CMT?;+&554ZE#h#*@EW-3d^5eP zSxLI{*65qg3&`7n*{!To-@z$L4kB^N_K+_m9k3hL!v--29&TuKu=jGXyjURS00_!P!Ir}yG1sU6u*?_Ogwil0g&Wco!_pu@=d8bUGK{}M9 zIfr-mma?AnYo*u|iAjTj;&g=@+rz~xg8i~!%u2cu@chsteDzlH-BJAq0KA{WJuSyx z>00*d#413aYZxr}4lyaLT+ziE>b!J9&!OT^{cRy%<5nbeWcDAL-JV~!EHG~Q zq|KZdIXsIHP3m!vv=K*i(lXSoDSH!hgeZLiDfilz* zJA096bL&&J?mOH8v~?+b?`vtuOzedz9a+>|rouKbkSO6haGZzgj*3AJOk`$EW2dYs>qjCxmQW<|&AXWQesKpfC1X}|G;`xzZ9bF~n|4%ts#H(#+ z6i{$u@%!?v{1;CC+CSw$An6fYsi*aWzWaZa1EGJ)K_sdRyTNO%ExS1+uY44Z2<7^8 zgGI%gCJxn@f0;SH%OnO<<66)Se~^iwm&g%NlWx=@1a&4=4qe-rw*euD8_3>c5WFmX zb$NvTT4?R`)5xRwT$JAZ5iW$%>u6@Mp8z<^XH|2a_{)OymKv@2H z=~!6FEBUF*J3Lpbj?{VK$O_hEUwJ=ZpK*Xk%vtqoyZ(L6W!59qe4NGD_=NA+O}`iT z%wq2uwrcFG@XMyBPW+Z-VT5G+-R}AI-cYz)h(Unq@zAgR`<~^H-$kO6mF!>H-RJAW z{247OJ!eQ&No*skjz|9{mBxq-7h9y$?P#E8PEW@+?m)UBqSdCpf|{Uu%1kq_ z%eX+9-F&2Sj)xIMxhx+?z@g=*WXV-7^2;GyWA(Hw@fm+ON;Mp{9d}%SQQJsaD9;I)UNc*GBni7Xe+V zuz$507V_!R)Nde&7~=noTmNsxz^@{+c?5}Nw;SXjj9pSy5taj@AL&>dv>he0E*Kgt zTApIU8<0zc;qFHF7(~FljVk; zvX=pH&I_x=ptx55vTrfRy;{NEr?r8Wy&}CuZ~W^?HV+#j2ofz-0~7P`hWIBhC}E2+ zish{O!;eaEE?Wj=qH*%ds4ad9zmaLSGj`q(D}MhRf#bhSUrzOQ%)KrsWn)&ZCkWR? zpp5(BI#C*(t6AxrDDZDij^i2pj=69#hNUAMNqkngCKu)x&c;kNwT&2RUi^<~N{NLriSfXT(L zr3b~K(+8Dd_e@)sNWMLnSY$M`2FI&i>Fn?8E#&ADNc=n^rQE-8ezmFGGrut)xsE~Lf?NNH^QVz4{Px5TQ z)-oy~StcJ*7Hil8t6;vgaV6G;6e&lf*N+gr=aP6!D7ZcQ*@}Zl3!-_I>c@(`GkP3$ zh+D}T2oT+VbG-;!`eL5wgy~ifHu0LZJaDwG_-J`K0T@#en?99DXG~;Lh?VJ2i~&Sl z@=ewhB_d|)E%!PN>2sPK>o!ulQ&!upc+r2~mnD^CrX!Vr;xmw)VAUfiuxS7WkYnV$ zK3)Re`64R`$pC?TtV{H*>xO%o=a!$U~kz9p?9Rzopfd z=@%fxw{n^1oJ+uhE3R^vt!A+ka?^SMv9qh$=e4~y^A}CT%)(xmHgfK$+%KoYC8(a{ zNO!@E3Se8-Rz-WRu+Kko*{qM1zO#!4MX?e;F|rx;lKo;auxwd_+mxXF zI|1@g^5-xMvh7`sY1{M5@pygA5%z-a0VzP?r_C6_pPmIqC?>NIw9D$Tzi6E=7TyZB zAAi2g#gg6!w0ma>&B>!NXZlZvRQGkY?Q3H~l`9wUxc3Wu3h+c0pn$qm^Fz}*MLUqk z#~Cplm(VFjLvY8$Oyh%V89TkD7TbQ}zEP3TCohW2Iue^rzodu)*$G}3moGdZI|2BI zCm@T0@B{;o9{qQxZx6dX#-S|)0;?H`9RXdiKW|1CmHoU>RJqKF{KxRX@WWoc#sevN zFQ#6=CN(dh$>i0vr3C9fj<>c((1Wkk$WI#Qw;O2UXG{aMHnW`8d}w{fKP?gu{smKn zpw+urd?GGI>ffr{o~4zzNP zI&`FuDk4>6I^5{aC(rBkSeWxn%zL#%clk_IuZQlP*)Rw0J1qozi?`8v=DpK9z~i}b zd9|-maC-l^{c3VPvdOA43|SS!esvNthAXobJa-*j_^@{aL^5^1)2Uem0fL3+^ASSQ z+Rfd?ug+&>877?u_I0kNL53d%>|gDmj3RLxLdfpH6&%e!@v41a!(7ERE{1f^t&HX( zfaIHHU*TO5(LK4J$_*@1gF(3`8wUSQj%nreJUBxiSfcw{{OpmAYLO8PYmclLLtrsq zg)Q;vVBW8qO{;?(zu-kk5D*$l-Y!eDn7bh0M1-hb_T~N=Y?^_&KcM&HL_!||8hpX$ zjD>5sOJODAqx^*XLw{gW@BhSwF4@Z~HA$Ho>P11ye0>7q8Wh{mtoCqJ^l>(QyJwfb z*M_dMaGPlIBD5=vx8xbQX9A&oM zhil+?o%jfd-yZT{TBerd&5#%MvILezroIV$Q8TFJn_dx2QJ2)7KhP|+=i-f3X8lIt z(uyjAsc{29Y%JzOy<{44Rx-z2ns`_BqJlt0Y@41@W}s1X^?h%R{{eYZBtGQW{4t`Q zacV-!^I{gYY4uNG=E=FCq4q5k^}!iCzE-`VFXju1r;Y_qL7GPAcVKP;r1UM=ua8vf;qNsnz@LP+rPRUqwm;)_460TQCVr z8@?3xAGk2}AGjdSkr?W_Y6bEZWWjISk;e^}zf{Uh@HXFvYB(W8%b?V58 zR!kHD7LCSE}#b+9c$P8)dG%u`V&yd9xwNSBMs22$4 z~K$yY~cx%l7X3AWvsD986 z&FW)kJQOYb%b5L0+QBE5Vd)r;(X}I5IY2=pM#SqPut-;m(t&54ciedgrXXjC1LZTU z^^WqAJY76L-#0h+n^@^-6uVA#fA)W2n}}z^#vx&z!n^QHr3p#pH5S!hC68rz}F)S-$F&*QnlX}~^ zLv#Q07$)asZ5lxyLqU0vIDHw#J#Xwkk3mSr0a_z8`sK^j7uH42)qQq(q1;6#-CDlm zg`kT3V@Y5^7y7oO`(XVpY=+;5ue9Z>ej=H-I{P{rUws;DEVSCgn zS>r#DVXk?xnFZ1H8@vTSb<4qTjSP~&vTMPq*0vaujHv+25~>SFb>d?y90aqTf;(P$ zLC;LOClX8f_Yr8yo`7LBypHiH%{#uT>_f@vBtQwDsAGG)d?yxnntvc%=L#)2h*%pf z@OO~A_)Gb3MNzGs#mKOiH#0E`(B_IzoF;T5;RbxW4;R^2w#IeI@93+AhYK_IbI!&Y zLK+;%l%Jo%p_DrV+Qsiy(h~oP49X*k=QzYec%c?d>HM+(LFVp;@(yx< zE8@g7ylwNDEMKazo_f48T9Wm&`-X5)TAbMb_@eB88Q z2**#sWdn~~S@^m&r0*@5NvYXUAB-gZ5%qz>yf})6j3M7l)K=aja6%!u4*Hw??xNqd%T$&R_)Yd2I1FvqmwTdx^Ab_jWgBSPGfEczKgLBWLRctfjd!S~}d7(Sd_}TTesO@O6z{|V>I$B&gyMp|Bu#CLbCnk%eCbo0(l7ejt+Yl;(|v6FkTuE4wDtmB=Mc> z*U5?)X(W=(K_vyeWvanc(3N5h%u(%(HnOKv?p3ounze_xe2mQZ_+mMnd|FJa6TXa| z@Sq9l665kM$*r;AYd=WQRzEvmnWjr?M=fFJ5YD+zXK(q4AxMQ$KC~Q8(M9XMR_zPO zxbM4DW^cMD%q>a;fTA)$=6Sp%lG}=Cy`Q-chvOzx6*S66^6V_JmFXsMDE3_~JAk=0 zt7ybosW{)>gswV2QkN%wf9uB!2zQ9%R3rZ%+(9Bx+W9Yzi>9fc{Mq87SUp8!l?WSq zLmLZc`}bXpRim&>csrYzQSDM$Wrr?_itGT8?I0+v4NxIPA{O=zpQRH|co|d8h5GI6 zqFC)k6~GA(5=RFS>Y?5^qkwRS=@!>x!tq%P0qOnsh-6CgJ;cT|AFbAIC=<{ysdU#k z2G~YGU#%!KBmK%ljln91)Fx{GCEH9lt+=(%tUEc?^N`vn;(5X1&*b(f%&H`__C}*< z=M?(oK${?nwT`#o zq4i&WK6#$*gJlxVS6A+BZQdRbU#OPj*b(5EQc`4Lgi4;J)eD%Z3R1ez?8_>v zaOo+*S}W?5C~0UObpCNM9}(%6&W{veYV^i$3H4K@W=jTFI?4QZHj0?*V~b)kI|)&L zAiFTBlDa$CFLmM=?5ZBZKF(kz++W>K-r6E0gY1 zshk^9*iDnG38`l2@%+8iWy~g=9=aYCcuteBhxekGyZ9C~Gp`Ol8<4%(m+)bPq%O8c zv;2N0^B)7TyU-1(VkBQVibERlK_T`@*FSyL3^CzMy~@)zVEcQhU{m?R=C9urGD?Z9 z!%MsYc9J#PQx3;GK= zDRn(=s46cEr}>;rTDpsm?jQiBM~5<)fX*TR$UkaZ37cAWLTpx@!yO3tCqcvnc!duy z`3NRJzi?Q4lHtd z;5X*SfqR;Wo;0{w-VU`JqeNyO!MW-bP$M+h6ifpN7Y9x#;IPNBUADRxA^0k^P)Tm^C5qJ$sfKAVu^m5m-ohH`~_1-@b%9&S*z0Iblg)6pdia8=KsDXlTx>}s5 zfw8p?jQWuSA8HW;JvZ*%EH9}o%hf<|)7f2YcgWsV*Yn}S>#S{gioDy(67EORvio-y zk(#Rq7Or%f?0dDdO7OGt;?C344#6(j21fHM@9f8gHkjfBV1(tD$BnXvpeN+A@4$k0 zo00zEcYDx+`N(Y}t^IapoCCoce@-wjndj6td{q{lFemn+H1?`2_eGI)o7Y#=6TLrm z!o|oJ=_0R&BImdKNf#VoAEMNQrIUtR0JIs;1IMZJLDbA@?%Q_POP=y1 zpgB{hjC~X!*%li-)|Fu2Ph`lXb?S8vTG~rlG@GXN;fq1={LNQnF7Vi~M?@Ek)2?j2 z0S_tkYNpa?BY}n;RB>ns!15b6dEk!3VqSKpExrcRu##RJ3iOz#g{%tPV>qNR4Y+uVQ07d2qvK>5$#Frz#{rfXT4WgE;g^jBB` zDu>*ZTokxo6f@m%&B77sVY z_5|V0g+~w1ojCd`^~jygO}_lh9cbsXb%$^S=LzyW(>{4`AP*J1T6_yz1)?*p#r=+J*c)O$`um9rN$G&p-DpkY5V3e?0@B6a${*Kptv5$mRdPq zjJ{0BXC8ZS8N!WQqKQDWImUPKNI+~1SlV|n_(_cd5mioDZdgT|YR@vUl6UoM`PCJW zP}kb(9uZAnaz_eBj>5RcG5P^hTS*(PRCX$#pH!*b75Vyj-2L_W)Y^^Pge~+)aog~+ zk%}tpswSUV@EK_K@C*y|z|1!~W#Ks-5(K4-c(I>ZEAQ3G(jJrryY zy>4?cBGyhSzsOoZf7TJ*A)OyzFEG$ofn{A?VS~2c1|3AmLOuI}oBCK&J67dnA92=m zAE{L!%;$OfYqOcc9Mak^rT@AQKs1rAds>4dCCmrlS`eYa7So+m3Ljjx zgf1neTyy&bc~flqbg}xXIy%w}iM-IGA=E}&p?_>+h;p~M>?_X*zlNsh{zj?u1K z00YwnJC=(y2~D-bR<4oZ zWD)7Mpd68Wr6p)%owziB`Zza#G~7D0Ly>%{qk_YKXqu@ z7BYd`1gV8T>m`q+qYbA8^cIAVA!$v4U*L9MnUFM6Hnt5|B`$?}JGfrkTv7M8jsEoA z>UFyvd_#KMEb`{98gm)Vi#sfqTv-p!NzgeDm|ZL=w1J zYU%f$7IFurUq!srJer;Rp3a_!Q$9D+0+O}DUyNO()9Y&E{kPX4Fe>d(LS?uwLV|g? zj)M%K@UbVNAT986~lom~$$22l2;i4j4DL(qPy zoH(l0f}fKP{Ei#4VM^39%TSPY`uN9nx)bzCl|aobB9tphp5+y2#0Ae%IZL_(x^OHT zC1TKe*GX!RQPO~v9h%OcW^hLbukHs#&=Vld?h|XMk*fi%qmg^4LHdePKE*M49OsUN zuaZX4BYIf&XW%QUj%&F_$^U%ROV*39d}HeE)P7iDLwqw`tm1>(W!;0IYv$=g(6U)C z9tHF`2!x4hQ)qqAMNk{ZHQyvrYE?J?tPOK1WGb?p6xCjA_+OqStz z_p0&7ZqH2 z48EzXZ=zvjz7OT*RMjF%Y{u!|v>Wib$p?Y>dmv?fd6%Zd=@mVKLN6kEjUo*1ZOd2$ ztt07Yn8Q4^{;_p`U@0-?Ak^Psuxu3OZsB;wEw@D~ms>!55qprCw(|(<%BRA;hq$Np zX5P!ylG88;MHAU#$w(9VC}YV;>b%mK2=ZP?;e}^!Os=qnOy;uwyc#Q$*h&C#_E1*f zIp2@|4V^`TTqrH;+Fj^LXGV>OT$O0?h;~_}?Z9hAQN3@D5$-&U6rKHnj(cCGzvg;$LYs*Xv8Hur!ZojPrQ!9?hd2;t7Z1k6B&e|H#qGR2h5~IF?g%hO!JOJ*n$W6gjLtcf903zCE&_L<42u z0ZMh1`}(fm{yXj|$?5c5Kk_z7OFDxGbVGx7<-+8|P%Ptm`dN24b;S0*qTSxj_J=+E zT<*|EhHz)X(CGb%!I3LH>T0Q)+I;UV-eZC0_E$dUO#>sg#v77 za3Y&phyuAe|EJE3$9(H-Jha_%rJEPnXiEYGUq`EEGgv<3bl?v!rfIHJ-A1$%o$sHD z36m7eJ0jZOhooAtBDY}AgjF9eyv)7d;G}WJPDupu$U&czDo2b%=%{~hfF|aaF)o8(FZHa5_sI@R zPFn$lUO++LCzi}A@~0HkWR)^4)lLLRueA8ok->8}kpyZ1a$G#-Poa$EKi1~Jyv+GZ z_#cIJtS`-~&CFhv#Eg^Ki-k4}pn_wUzZQD@{DMHmg0S`WGeg3X#Wyyy*5APer}2Bl z#GRvZWVI98`E;X$gkfkf)G-FkZX2QbqjEa%KDMA-z~3X>^rIfP&L_>9NR8@^WO^2g zx&d-mBY}HAKctR%eHp{P@!bNPAK#g~QS;TH{`6PVQm7aj$JwV@Jt;fN^~S3bG5jBa zDroatIS?|}&tQ54DBARheX=fIU|omBhITJhBYe57gGR@Zj2v^{`wk`Cf4@)Tm|PqH z0}^RJ{c`^wVgLA^SNJY!+d*U7Xl&b!Z5xg4hIeCIjnmk+ZQE&*#?W5#WTAz#9=#0Cg1MTU zaZGq>PVtSRs8@JvpXz}ZSdQ~xK&%EzWm=!)U;uxbrb5KdV8%O(1n!dt6GpV;ZgYtQ!e!TOAWdAy=%5x?Pxu$-SCjYiM`EDZ$qC)l+wb_HyuKeb zq=1*r7M=dweC}=hwq9x3boz~=7L7R**lV9ToUI4gjh)mi3cWa=rKXVkI>FW3?O}{L zcR^&nybO1&76IMK0HJOrbTX>NRO5h&iu)Wy3inmdaliwQ(%t$Dc$#0Emr&m?Kjy$$ zCzV2CY&MClI_+~R^t%u9i?y`f#w6Ddh0^p4R>9BnR$Ec081R9RHbx7B2+=(2_{QuH$RgCs!(( z|6u}crRW4fUyK7s^`j?{0h!}8Zm7sOYZ4`G^rra1-R`r@;QF>NLV)en(W0kq7wbJw zN-$`W;eJl6HHI1H`qe8;e99Rf!B`sRRgOG4d-Ern7o~AXdtlA!Cnb>}0i+~8=Gf^w zp8nv#V+NRT$|BeOnMUEy1zHkIQJ#qsT-k|t<(rT6MC5@*{RAe>_Ms+|0?HsuwrJ74 zjVm)3za8j+VFrm*z)qf|HF19xl(G73FY1}M zKidoE&-UW$cabiU+woC@$lkoKn>b@7sbL_oBRT4maU<;W(YXWVBsI{d_+G zz#h;-7DB(z8lFBLat?mwGal~188Vx0*_sPH_~53r=rnK!`}4s(#E|E^%j-snuzNlg zVRXtataP)>(Uv?pbexHt;s?YcsJ5N3L&;w9g1-%)D;hzgA+V&GcFeiIr z=1C>pHTi%d)VON3y5h)(iy2^25)5xnd7#H6Lzip%j4PxF+>GaU`PD~W33CGtQy3XA zsQ^;eadh));SK19HxxSy_7-OMPcq-(KVgQkPncn2ej=E6sMAC&`zz@Dau2Nm0;kD< zg1soXAc{f&%1m=94p&_vFq{}$6?#iG38ejlFZ4q>uolX8h;qqQp)++!3wP*N2zg{~ z9nI*E{Mk^MTR7q4E*)6&?cFEK;1Bq88N&9%PZ(F(hCjmzfqfhb-R0h;pLYhUXmXGD zUbPUeKHR)d$`sc)i&t8~SFwh{FroPK$es~gciNdf7kR4}C$(j{XK;}QI_7JYuJ@BW zAEBq;toX;4pCVePFs&^|ZjzHq8v@(5GT2T`#AX?+C4no9c~=q(gjL7km#C&e&_nElC_ z?`U$_&oAd`6(zx(;= ztiFKGhth4!jAN%L9_d1MTqk~!sdK=`BlUydB=kZi`tO%7D#y6V+n}LF(i>{khXPvw zz0&4Mb@X&AazK^#hxM&NuFR?D^ED{&vp$ar~O5q1h zVZYwnP;L-+sjnY{^2O6~ZSsc7M}7b^iA*?zdI@bAFLo*DQ&uw)(*;dp;vv{T=nxB4 z^x>5l6wKtzMFp&U!0yk_N}|=V!4&{c)UgrJ?Hg{e$Zx~1RYiH?iu8hbU+qP)?0W{0 z&PtyVVCY1&VA>RNT`L&eE-~V(Ry;{SfjAMS*yn_nhy7q3d=tp#qLqTd&f7kexSpUOl23w z0fmE6+ELsUdXpjTk>o%W4=YRmr1juGMAIX)R@kg^E2Any*RF#X9`Qh)peH9Yjc zWvR%akgRPE&6|5wS5!T9$?q*1g1sU@FAo+tfhE2wuISO=TpUJ5QY*W?9d8uk-uq7W zbWzAooA4|7Kbg{kCl_k2fs0xgw+yvl$qik3l!(KSY(bcQY zXu_yF`x!XMzu(7&p{$in znWsfwp}Zm$B5nG}7iwZlm_J?n6qC*&_hKAZ&MA0178gu9;r&Df}(J#^{_ z^t_*Xy~{cCm@9d*wkp$jc!~FcB5Ue+bf!4+id^yciiI?=Q9|*lK!$-}4nu-h_L>1b z1@|vHAz&(|Yv<$Y?*HT#@HlNIab+L`l&qv4b8^C(G+|lB&14_Iw2d&95LqyY^+$dd z4dy76D<&$JQcb0)i;NW9`1Mzd02>Kvg5K&JQT}COQ@o=*zRy`7DJQWR7n-?YvY$W15`^jp7 zjYL3#p~v+qygv@SP1TUInML`aQ-G;bb-MfsXAT%2@LHA_mEd(QeBirPerjGH%9=uk zLq0(&9^Inc|A-_`KO>3wel&{Z?Dyvr@Js+KmITJrO&#f;j^LlB$?nfY;!JHO-bapJ zmS|fkt{wWNJ!mEdm`HHat#C*YcrXa{$8Oaw9=K9Xxh}Hl%i3Jr8Ereh`vFMLZdMqt z;myjBhC=OAPSMP9Smpl59y|o&Ee;nQf^|6b@`8CV-8EbIsk4kgp90 zpN#}m{AVNa8)_cY;y8e?;MjP}ADYLC)F=g!4Tnt5w4B+)a)iAx_A5Va2HX185W1#< zlY*5j$W|vw7t%X+>+{be4%f9je_$dp-L$+we7@wB=uFEN-WClY_ZFV5JkJD6tPx*y zAiqmK-iINfqA)@>Gmq_=OFRAJN?D3hWVF9I(I{(BUjdDKV`6r6wm||ZdR#@UOJK+%)%X%bh6guQJ{t+I1pMK@K36@JV@U{qsMy&+jq}gE=WH9MR%^qZ zkgZyR3F<^yZ8^wq;eS68qQ*UyP%O(AT0C35Z7p8}Ez?|N zm~?fd6Gw3ba=#vBImCRu1(3+4vH#i@n5cacVvziR!XfmUGv4 z7+ie%-TnNbCickxjwBd9BZ>C+mD_?V_%*8Rz@XnJ8EdYf2le%PU+sVj!?XHJId}gD z3;*lY*;L_>{l{J2aZT@>KjC>1QS@8+uc;1YM0!g?YF)uj-P@laK??Oc>w@+f=7?4GV=nQ|A<#-ZA}H6je7ismw3`{=ll6$$~s4=RI5BZWC`u@n<8!c{^==aM%0ajRfnwC*CE& zCM44Zj%DWb0CT*PHQ>`E6JM$)e!?%GzuZ6L4pm54IYa(4huu64}PaK!wgXBl|vh<44P?zbZF_aWbe zIrHTWIl2>@OUC#&n|a-~A@}e)xurhz0t{P1jm$yfo?C`jK_Ycfi@qXbG2L!l;lGwT zC=j?`LSuvIu6B|8l(==l|mqkp2apg&?1d&!GenCtH#~+CU5(;j{H*ybP@20Fzl=i9liZ#SmU51 zQoL}oR;~sj4AHhi)~~dBLsQEe;^XoXgftO?xtzCrcB@_nZb%e4$@^bzH8@)~l8e9; zdE1gg&7)o^))vqk2xAw)XFY|U2?2CL9~uU}5PJ+4Xnkk2>g9V0O(1rKRwt{Y8@WoH`R4G79siKc2K#hRO}fQlbF_H9d~ zgJlB7WNJfJg1dbbVa)rrNXp-Pd8`SGu}Vk?L_S_&77!8qhSP<9(JzHbD#WZqA~XnkG@V4Qsy>@!j3zbJKStoZBc_Eytrv(Q8v=z4@@K6Zgj+Zib576tI5Ykr>QFKhN}x>}Up z!t#Q0r}k(Usmv3^VJUsdnP(?AD9xl*9Sd)57vhmUjJ%D+v$Yf5NeT#NmHylDblJ^0 z=aX9lY?obGb>TRmhyz7e60^;*Qp5z3*L1W^EWxQ5YAnq)!3RD~M&mu2Wh;^_#iv$2 zMK_HCcd0z5a6D_#n$Lq$vR3}&tq)TtZGb9b%q#(Aum=x^2O7Z+aIEPHoEhc%{kotW8{}IKl`TJo zL7PV?w!zV77axG<1m=c}7FR>+tf)mCBy6WB05`rL+`Wa|vaJ$YKb=2wJ zJT&XH3)GB&OXdZ5v8bKWNy7kp1Gf6{F&>h7UlgeZXZ8uJUwA0Mh61$^*idXF26<@V zbaED9`xq_^A25#}>J?5ra+8M_`k)Q{|1b@z_iz{Djn4YFUabO$qGm5=@9+Cye^vUQ z@`yg3$I^jJ!;}IjpFRH%0dH@>#RB9k@1GkGEL+hiSuYJ!5B**~*WCB0eh;r7PZj8g z;ly#Eo*EZW(M_1oQ$hA{gVoHb)r`(}=esZNOizR(mbkUa?Zkmz7ef(KQA7un*XWy0 z20U|rvDZYb9NshySDNXxl^dttL|C-2B*qh*4#&*5D7*TWO7b z<^$r3W|jN0_4hd|VlC2i{SptT{JG%8eJ|SrbQcu0SyKO{xl=%=mRyb`6=VLjmH&r% z>YsyO`WkretzsS8Xx{7fT27H=Y54@=s?Z5y0ibWAv4{j?L5F>989aA}$=*p5%Y&2a z;vy{`&&68fO+ONEJRjWE7IYJbXec|YqB8i5hf>Y}wS0l}-veVW8fn9kJKOBM# z^AXkso6f_2YbMVbuK(7qw`sP-{5%=)$c)JpA^DYc0%AI?lpH=Im52Y}VFS;~uJ=)3 zT1!Ne`R{bZMbntU`KiDw#rdUMfWbXaUZvrMk&K7MyoN8p6Gqux4X;}Y;$J}_9Y98P zarXiuUvmM$?5v_C&)4#C(YB^Q8hEMJ>(GCGv4X~Mz|6@wDgVCWjVypgZH08|`7<9B zI;G7l&6fp4;xAb{c`>O83rJT@PD1FuG(Qa11q>gm{N^iQwma9*ZPABe#K(oYr6u<{3S7bmxra>%(1QDdAkTblH8z5LVKG`<0k z&dtJh*t`v#ajkOaasG9|!HC5G0!)p$6ur7H2>{ETxn&U(@3dZv?~#`YL^J^d;$Ip= znXR#NWevk=)2CDY#|rxgp;-x9z-u`cZDbFBnldO<{cij-YBt?d1WYSN(RV?(Fk#uW zd```idgkbTRXX@4;8e(FgmpwT{sgAF$i!Os>-O(r&YjZcGCv>8?Wx!urAk|3o@IZl zs|NHmv<^{dYBpMO>yNYBWERW(5eL$BBiXpS`h{EJ@4&R;O^@{dJ*`M>l|p1bH)&nI zJ^Gv1bzH19pAZ}-$R^Rlh%8yPVrm+0R(ImW>Q@jo2oxfk!L{xGhY$fUaYS6Lm%=!^ zE>ToQ6LZuXVx*WQ$XJ@!h!jDsq#Qoz``RNqk{KUaODhXg8nOuXiA0cd4^Anq%~EgS zD|VNaRGYQRvUAy1>XTUK>>vNFfwb}kauKgT7i2o$Tk{#p!t?p8D}Y)=uLoKlP>Ud? zb--ROO#Y`uSg!)E9~o*=JYE%lwpx9A337i*XyAITt=vac`}shSAv7Dk56mmPwA58I zoi=_GS+%TP`Q$bMeD*5rYvklRLVR@);~CQPMgmyoEwxYm#2uf4g3gYN5Vj~-wISFS z1!J-1b&G1|ux}yD3UtlkiKsW%g|nXbwBa~oI4_CfaK!=T4synP75qLad*7Wy)B6g! z`vp7SwC*&S({A03{&!!2na3~IkQyQLs9SA!+)QtMCeB0bzc)nZNkdy3uXv^0p@vPd zr5nKffiR&+xM-9ohVv0)FI2Ub^J@$Ha3$#^&!apEhc$ zxZQ;d-3os5mCk2ZGc7u&Qs1ds%cqJ$p2*M46U&1eFw zkuku=0-K8!c6k>>i&%v_nE_yPq2T8J7($8x#i51sa~<7r0e|!!fBAH3;wcshkE=pL z3+3!zba8kikRm9GNdkC`l|myQuTh#MW$L8dfrOBK9I?h(X)Wn>BK!tXH{_z>kjD`u z*iDt`hG5i{`k>D4EE%;5d;x^?JCz1^ku~_2_6_uS;aYE1L?!uhSMSwmWrZR)?3NAN!^q?*U4Do@3gQRsM09r&Z+4$-;HXk;YqSH@kJ|4Jv| z|5rMZ{x6-d`Ik-r{=1zRzO|TeFQ|jxTk(wUj+ z_Gq;KV}!1um1sy@_-Nad=W0tb1G>i4W~jchZnxcKq`U^zhdAIpp)e-C=Xs6*kp8cD zBG$@@P6ri6Lw)4i+(3h?ICz_0vN=iVw=%g_&R8|dCm2eQwsq(LGlB7Rh!B0h|LsP+ zCUmfPzJ9t9!h}D{hvaHrmw|3X*VMY?qUxs`;r@qg1{Li(F}Dv2W?~_Cn)~CQ8}T<7 zY`_4SR)`p0th<3}*3XhpR86-}C}47)?n`s5&8_uUMNvq0r$x?WenebACrSdDUM79u zFtC#FWCfryr^M*@skTM5_63djf)nElHVP>22+$v$m`^Ut-5Sm^wi*r#eNPl=QL_3k zAws_UGNdW?&i=RHI*%M1|GV%@rUtm*+NTiV9dkJ`S(FspF$o2jROc)rnDY7BOg$C# z8A)s%WC)9`^;;+_i(xg{1?Fw|-Si}nFIyH8&oXvouNdomRuY1T<%6#R6)GxlXP-ob z9Vu)2i?BUbXUi83?Aoa>9PH*}pP7W^XC{F+gDU6QX`0CaG$O#6Hyi(IHhdZpkA4xn zIbp1wDL>VaumRq94?6X1rk@}LdfV(B#U}{C^9e#|euJz6f)HA5n*b@JDQrhU=&m8Y zmvZ=mE8#7e@VkgY3cl}Nvd-vX__|77LQQ_Zg{r%NAjC*X_dY_3MBb}{dFsJx<#1YT zPpRR*B*HQoPhJd;J{gone1&lu`e9hRGHMQhW%Tfkb8Sa7kX4C<3n1R$0J4#vBI za#mQNqpC;N*$A;}h``!kt=&A4AH;JIJAtj>*Om7U^~mo|C_oTm2M9vsq`2`4&)R12 zX>$F7K1BKiA^3j-L5KCirQ^G8-vcAWcnYEuw34qS7h#eXhR5JBvLVt~RmsK5#HOq=)-#B7U+z zmyo(>#rf-bFKN;^)j?F`U}y7#*Zf!s1tAOQyMY1n5KzmcxqiBQIE7ccDKoTC7~J-{ zN*V_fbi}P?h*@Ue5lLdu<`(%8`u+8yF!Zz`KRJk8%hM82Nq~F4uNLHI0s$i9j_w|0 zlyWhOjs;LcV<)#cJo;`Vshk9_Lcjh7>XrB0O8{|)8dWynZB!!s**gfqMw{q%1CE1c zzA2))*1zDZ+L4a$Vkt|c$)s{WG7wckQYV=)yVG^&-c<9fWZ%-E4WBdv7eK5x62OJd znVIxdS2DqM`IyvzaM@7$MBW!J9d2_=`9{iP0vaB%qkz2wQUOD=#Y!!VAy&rm6{Q}e zm_bf97HID+w7TWq&psgi;KmDu|4BdKt3dKG5}z=Sf_~->(aK}gPbEGJhAQyEr>g;b zw>yY~?^`ryKA<|Tw%5qrTF$bdOYFbV0I-8r%$lYpyt--}IF~;voDN#7N*4=qmjH`r z$|w^>wjdhpWdjg=M*kVJpl*jN7BgV+Lk5M%%CL3Dk35Gltg zTQg!+CHj*CdIl!18nc_dEg&7eTV3@QSwGelD(WCB%aW%{%P#K!@{HY-`)x(c6CIF3 zXOeha?eBi5EhGRq9X4FqI#S@4)If&{%a^_2V+>JzoQ+$Leq4A9^oNaDzslPf6TdE} z0e`R`cd%PM1fchmMVNUnSgM+zbaV_q|Ia_ti!C81RS`#JX&pzoNnxUTsXm9(wd>cjP4|W6ah;KH|gX zL>I|&g5@8C*{uXCC=FaO0_82^0Go3`TDwpIy#AjcME1_T1_cm=NTf_%lCkjQ>!k55 z8Oy8pD$B1)eToK-!ydeJSYM2Fb5K_SJqRD52SEq)AdSu>ILr%f~QrF5>+%J`gMviW3 zYm^Vg%~iy>dXRile6cU{3YCjaHg-yL%V|bSbG?yhM)zK5-|aLCTh+j$;na^tleX0f z))+*tX_T-$*4Z%g;OUo5Ij^dH4%GkU4*AELz}z88(Q=;5QGT{Kh9D6pAuV4E&(+v= zv~4ET4DWzB26(@s66U0->^Ung^`G3KP?}AIv+y%_K>N%c0x#`9a|eOX+ySR*ws57K z+I5jn6!<#n<7x=!-j?s&jo#cAo7ie8b{AWcyv=qhdxdRFLq4YVAsedoU9nMGT0rT& z*IH~2Z&1w{`aX0H>>Xx92N!GSt(d+8q@P(7m~GYNo>^>^5>jjvhh8Qe%XWUg@kZ4; zsi@1T8gVnmQ$g*(*yrg&d#u$<$+Ozkd4$t8(%srKblK>ir$Yy4&ilajGIM)=Gq=h| z-$X{cq#?TgOTpFo+{r}3qnch`F3aZft6uaruWr0?QDN%(=B)Wjja&3Bh%K-PF_xa^jY^czu==S8Uo$*GFh99AG;#hJ@UujGB9wB$3wqdr0|K3 zfRdIfktxL><3faOR6V)4@Aqd4yr7!MsvT4({5pC(gA-#N~8K<--<8W44 zHeH#c!a5yON>BRkL(5fh2KrBh2ttbdv0hijqvsX~&1=lBx%Guh-*h0$0KQu3w1b1ml626a zZFe2vp9=9r=Vjr5SrBD0zPeT?uTEG*0U&kU1Q4DVFAS9RoL~>-3SGG(%*`Y`;5@gC z-B)YR9mPH&K2y5sx0x2TC1jV)fjI1Y`7Yl4?fmKr1_zJXPhR}&-fZt<_o+hUT|w3H z>xSA~{2ZZ(Qb9W8!EKXU;kGk+@yEC)ykCa`st{cNRETt5^BtfHk+kW2TjKoA4_F;r zZpeh2>Jrp{fraY1zQEpxqKQ10Wfh=-7)eYZCu?IxsPUcexk<%jPo zuQvUA3}R>X8q0ZfZ-t(*tJfQEVZj*OlH<&rc*fJFtL>9{hRa4AY`B4y6DE;&9)*D$ zy~hhhX)8UxQSn#f4lRLQ%idpQOMqA>gETOUCL?VE zNl@)Oh$Nhqi@hcU|3G_eHtnGOWk%2@nx;dX@(d9&=fK zV`0zCtk3G9ld)($As%xkoQ{mxn`J!8q9AXeJhz-$EnDoH<=~upMZCo_Gth;Q|Bnl? z`}+UyLNM_M$TP)`a(Mz>2>;l8FBU4)q5|49su9*i2s)Km{~utGL!-?&R6@T10J5Q% z$A8TO@X&|oJ;+(*>-m9bI+TNw)N+NVnkD)l7~+4p5M?7O83*aOjb@G8wvnxBQ{DLD zx>PH-(bc_4xNC{napYI{0%99w9%u!ZPX_%BkEL!E56jlFeYkU%1pRF7MV;)3%wV$D z8)ay6qkvTM+KkOj+TuZDRjzwBVxomfF*L+NQ}I0pT{42#Q#1z zc|ovp@ZPtAgOaGfd;~fOx`wI6sb!+Aj5KVDd;FOJSqvT<{4W{8w7+cCx=E72Ku!qy z2lGzNh)~EohX+m(VyuZWF3&(lIRHUdZx33K%mtj14sTvzYRWCQNt^^FtH%n?7zK#TpCTELST`>!~z6TKm!cBHxYsPDD$N4C&&ZG2rA zctucn6JRbLtAsvUf*S9USac{vQ9OngCos0wd(F zCLg~gk5fv?Ee*%`0f%dIbf@oc?+B{X$O35*na`K{?jGqzXXqS0U|R+eSUiM8-?rgB zY7|UshBLDM1a?XqzC@mxr1E)FO%w3x!BXDx+l^Ku39B@})NR}=HTg06fixs=`BI87SB-<^2}5)$o+D~SEBD8PG}-6~!} znjWonGpT%Pnz*!k8rKUKge1f%N7I)j`#k0AI}CdlP;33476R~p6GPaR$=MHnJ^L*y zhhE?4!T)rf5$us`+h|%koW_=K#9jFO4qRvFJp30kIKfr4(&65^X3$HWps>EhZbw>y zB#JV%6iu>%On@Klf3y&)n!px9x;Rsq8I+9VMnw+rTQ@a#<+OEO*3eSq zfq)E`y+^Q&EwkczJ%!!2ys*;wSL-jg0d%t8Sjh@O%5(TLsZ_xG24-?ab~-OQ{-XHJ zb$H5fwtYHzHFf1iP6CwI^I2sLa|)Jq&Rmtv-tCfrIYn~O1`$Mw*v(!xV#|6V8!gep zlivkK52U?qdUC*Wwt}ki8%cqg@I)bR4mXS>TGI09_!feBeo+3%y;!8ohC}0V*h&^2 zJHZr6VP2o`=r8I3%DCDJm{qy<8MYXB8(=i$PBo6^lk@CSK(LlF zQg~1qA|xN*H*U+@8X^^TU>cvxqlUkvG-9VdK#5-5GeAAp43#shBSB119(~VP& z2=c_Qk<2Z?5>|Tl7sN?+bH%IwRT9vEx}P{v+<1YK7zWbn^aMIS$o_$;@HyO(%fzDE zk1AiIx>J-uj(}XeV!Z&!La>NH5`+V4CgIPf^~*ZTuD@-F$SFToo^+CN*t~b0di7en zQaoTWC?Qio0w*W>Q#Mx6vB6vbDFP$#gaA{mSU!XWcPAQ#Tia;3E(o!=->m96QK|DK zjfmRJxJl_C*tTD}ImImm?4|>l$>o&Ilcwlq18P3R1xO-2GYdtPHWcJ0?fi3_U4dOg z*>WvP601*EYY<(=J`b@3+*OW`5D23^nkQYuQpVsx39WjG-ZMp0} z@C(BU%q`^8)?GX#E&JY^r|aXlI6Y5>Krc}xZJ7Q>O1S}n)(nUDH_R+CV`^C-obPcc zDp`7*(x+6N!r||R&)5KmHvvEnBIoY~%YtIFX#=~48_}SqZk;tl^NyGD5)vWIU$msf z5FxgcHs4ez5F8zR$iEw6aAr2-f==BJG?aux8nJC$VfU@1CrOz}I2LK()wV?(qY!PT z9ssijl+k;kV+aQ!Rv|Dh7Mn3ALRGnUk*dZ3FW2!jNMFSLi%bW{QGEGXdanS*i?Sys zftPFK0H1{7Tb>W-ts1`b@V_ab*y!jQ_EJ9mw%yjmvkaE(YDZCYZIORVLPSFT+~7M~ zg@kFEbVA+3v>k+bk28)_f)*LmsxGHs8*==OBSyJ7PK{DdWY6#pBD$rc`s5;zi3$|) z(G@18p<`0E;emYc(;m_ydq_p#m}BKiDDfn6WaZ?B*UlNyV*jtbo;#W_o`OL<5ygOb zT8nQJnnFEr6fS<%MlpN>7&k7_)2dk#9bL|OH@_bSVOWTcyO&QU&Ssqg{^k)LF%j;z zJ420VH%gYnt;n!>W|>$Zt4RN`r>S|ph0IvyMdAHR9%)Jmu%lc0#b?Z<{G45Bc{Bkv zWmt`k-{$uVA|(0{#g)^&-EKaQulFgx-286P{)y@^L-pxvt7CadgDa2 zFH(>RC`>1o6fQcEm^S#=#;8=LtR10{9R>qR=+}!3QMC-dev1+2{_o?xUtf=0XghSXw;*DnC{(*% zNUQv`QfFIvpRNQgt)dcIz?8woWNOv?UQ8nEh#=zCVPvr-eIIAf1uqA!v@WZoT(({o zSri5Hu{<-H?X^R@2lq9dhu_2N4RwHMI~rLpuA#H97$ANelfwg73S*9Lf8NIfgW_&T zsOkL{?D#i!Z)kiWaM-3-AKH0R=U9k+aD>$_W;|uAo~2=nK9bgceN5=V4BMbNj`YuZ zko}iigAWxh17;?%%M?hHA&D+##BCIj^9e4FfXTNk3cimi?r%45X=orHF`wWB-al}{ z9U!0&Z-Nz`M%1*@;3A-Y5!ehrKQ$%PRJz#rY-xzYmljp*_iUTf1$2(Zl;llx zK`J;Td@C-}k(e1E6G8MMc-b7jq!!WiRqqE~aM-g_Kf#p96|E4z9Ou3QwAg^-KjqK29*=X z+2@6J9P8Zo1hmiaFgb&W`cGEPIJCZ=q_~e^KX4;M2h}FJQ`yg|Sqv5-kEifSbwLk6 zdJ{+z`7L+_S}MJ+C)y`xxeB5DCA0Rkpuyd(1oazKZo7%hQMwDN48YQ^u)YH-qaLN% zG;{$oh2I382pF%KrgIXU(mm&K>hZ;yaS^iPqqx!MsnSri@HhQ~h5J2QT>Ir%p{L zUxlV24+v(lT63`wb;eCV-H$6@cE*Jcj+Ho7p!G2DU)Do4(0a(lyBm%wJ|Clz5zqos z4|-c0*8fF4cr4i?7L5bYwG_w{G~S|YcnxwyBoQJ6Acmt6ntR@5(d zY=yWXMl$wUbW=QjGr7SNM5`lRiyZ!0?bR|VVZ&@@H0rWJFi>uFVo@&9yj-D4-^l9f z(|X@l;x{}fU91zA#i+6hlgGm|!Y}s#mDk#HqmvO&V6))0>|PzR!P;|g&A6OlxsCrN z;UDafnDWN_mtXq6OxX3D$wi)*Z~nhB-9%s;!R^O!=?2c zJ!SklsKIptx#pPKa9(!O+4^}rS6r02+X!fuFL;#8KGI*bSgqBH0vu)Pxrd7t&&1xu zG7eNn%K~3wRSm61rdqN1)M4~nE8BWBwh%fatD9h**X;fuZJGpX(X~2l#V7uuY+o#dx@|-@|KR4Tc`!vH0ybFm(UZ$ zaksT=a{#LBig$+edH{rL}x(+kKNT@*imyumO>I# zN(SVEowJAJcAU*tS&ZrVWiW^${6yQ*{FHhDDr<%|%)jV<#xW<5-==8{RnK3`lI}Ua zDH)(Yn%`Gra*%G!zgDh~T!z)(8U-jzWW;zdQ)$-$t~s%TXDE`?%EyK{MID4J zXdEUqwMzHjT+XSd#9wV(HKca-?~SVuVF9QqS$v5f=R1ly{#D7fY83DOTa&*hP*63F4l8Ho>zFHM;-&c%}n5rf~`TJdKt#1|0GPf$zdb5%9q9)B{ zn6gYS6og#+fO4!6he<2eG;CS3TWkr)l{6$DJ5YNF%1u-j^H{9Mm1f990+Qj<1b`gL zBjjKR^5Y&zYB=<&-fU}hy!=>$M2-?^ePnfXfX)* zGFbvKp`tskps{vdM$>i`UTXE2JW+i*@nJD{FQwi4Jtlv5e598)?vh{Fwm<1maU&+t zJP_sg@8gbKEw!FgP@KaIG4OPJYQX*JFJj)b;l#sL>=FrC5?-7ob}pD?%Bl(CUp?LT zo_yxPgI08$nwSu6NAxiy5hfu}dzcl-ej@?irawD) z|DcdE|EE3FZG@~xHTebs97`tk*=&ZhsCKoBv|687vKMx--NyN7@5_SgHb*~hqU+1- z?rm3c?{E>ZOwy4M=m4he8EstscfPnXjE4-ZxF=m**f~G&BgEU`O5KNQ?UZo!rxkqr z+4(w3HB_uo$zXRLxT%#T3{w}uUP`7eo>M9Aeh)7~&g&)@3SjBPxMM4?<3x_1rC);8Sd#rbMiP)-HwD3zRju*;wGdd>zcsf%mV6qrTPc}vVM1D5BY;% zF3)JMU;f1WE<^fdr_#hvW1$)j?-QYiu;bey!QCXB*L zE{oXT7!}gU4HAd1Vgym&Jr~yz*X(@5X6#mMEj))=&@6d#lipY;{~fk>0hD96s2TDr z-Uv-VS$4lFNeRH)sNcR>(glUKGFmcCGJHY9%+Vl~1IjU3Eo9_$0P0wZoIi|B1u8Q$ zu?&@{``G-zV1Si7(B_nXZ&xj-i*v+Jb`y)}v{iQnBwASnjaYnjl5+!C3DB2OLH$m) zUS^hIn=?}po(T` zsCAwNM$^$e_IwxK$7XIz{Q}cfh#7|C!gmch4&8(|3e|-LYL%lz59O6+tZad+?m*Q9 z7c)_rB?@m$vo21{G8)f2os*Fl+cyP{O=zYSFx zdx`oh0#4PABT3#T(+Wu&9wfE@JfqgJLfL&ed3v+4D9pgpo-Y4EcLi%~om!#_rEdEn z%_F6;m;md(LsMzw)5NztAUYM}Pe%DGe^D5*m7v4kze+qMUvvK+aYcOkaF+HVXLQ|G zbdZ_Bu>LYrQ^R&6QpNKTn*g?`Pb{f&P+*Eoc}U7-ry5B_&hRWpNA+*`BtP=9;c$&O zWU@%4y4;{q-w+vfzGO+IHTj^5S=d({@bf~Qdd&DmDw;sIwrxRfvf>tD^zcckoBq`b z)}P_RZ4?yRgbP-pG2ytvgnUHdcjY5EmvY&rvV1-AGa5?`sh0|AZ7FR1UJoMDo!Ko~ zWnR^QcXq}mM_-AYBeqI|%J4+KPu8Kwi^VG}8Xzdu(E!nD|kI-u*o&}I6+T!$BCUpK>#j$tFaX+{^3<1c35vSI11>$_2(u7hId zc6!3?7CUru1hyL_a!GbXIYM_cxg#!^BdEw0!BkHb?8CexRLoCMAnTw5m`$;INEdTPn`QpzItXbGQK)4wTs%hG9=5j3_KHvP^RGWM58xqoa{k$nnTsclLUGGt?*+OJ z#3SHk%##|mc>M^V(CCJ5=JVo;w4FW~n?%R8w$9i8TnC5<1Bs($$oj#qS=ZOd4cq=x zm%qPjA4!3%!)_s<G z&s+1;a`Dk#Sy>Jz=PBx^N;;Ha&6Lx;G4#9vhYED934NJQm!HdoG*Jgds zsuleuAM1`)-vNy^;sS9kb#njkJ^s1yrn^Qje&hCIQgLP1@_SYRn|N#!h8JQnit@UB zKhHRtS?1fRY{j!_n@9mEj(ED6eG$gI+OE1|_MhAbM>3-fI;ZE@E0Tc1&VpqS7SVE9f zfK~|CD0;qZ&sWoOk87#-avHt{+%b7!VTCt>ZV%A;f)*UQ0s43Y^E+?%w5dD493}#< z0GF#!D9A@ntYpT6!eyv-c(r!_Xh_>Quj=>|rEIc53@x?3iMhku>=$a!6Q|5NGfoRi zeCN1$VBatCaHZDzH9`jkyWDWY9JvZ%ft&3Pt%fx<;FgxdGSD|(mK=khm8y3^SAhck;m7yGJx4jFhn~7ncm4izcsT#{%M>$L@=|@XB)?6ufLOtYAHI5Nu3>DdEVBZ`6GcsL^Gl) z<+}eDRreGf3D<>-IyO2sI=1a}Y}*~%Ms;l4Habo^b~?6g+dkFb_|M*B->loZs;aTp zobUToQV@VA7=71JraGJ7F&0S{@L3<;YQUqbT3%J=1WAxZ!vOohv`rT~mE9UXZfB8H zyQSK2RBrwiBey9U+A5hT@-8GB)Y0ujO$#OTjfzG;Rw}DmzjvO^vuK={4oy=)9?Uug zfUfl8bdd?vgl1WxK@&O^qjqlw8Ke;FNc64m8UM&;lp;3MX?T|}v^wSskd zdkqVb-nlCVhTd9K`9fE&0ryZGLOMGn=%h4Hl+)BmUp?e%f?AwNll|5cfz>P363t&e zyufm6pw5iFu-dF~A*wlJrpu8PH~FIva1wu!h4qnB6DtFG*O)h89GE^R!8dcr|bi9c^nr3E?YQKW*xWxF4Yo!Lb@ za?o9uwxK8~j+---0(#9ddYAj07(U(m2Z_R~t1ks_k(mygvF^Pcxr`fYh`7Xnks1(x zZXevA08E}Ab~cZ&_NKQM7dbhf=154g*pU_P07C+%QI5FfO zOOoZMzU;j`2$cYIdr5DAbe{F$vH9jAY%bYut8<;B&VGT#GlECl>qcD3#b2cwR-2$F zjrrtn`Z~dodU?tBVcQRE?e^+uRJY^sDTWNe`U1DfoL86qcbV z7=0!)hFRS#MIysa-(Rm8O6B>}_zX;0o9kFxW)$sm)T}V?=mCTW9h)C|YV24Cb)(@| z)})lN%QvQPxpc@z@HpT1+b<$Wg05=T2pbjwJoEc#Hr~P;A8GsvGRwMD|D1=N&aPrl zX6#CZ!ljmRKD53U6ccfnt)tzZnECJHsbti#!&OG%%|E``!BVlh8S^TDsz4+Lp$DZL&K~ykZyG|6J>4-` z0kx_^-=H^GY)~TSS1wyERa&-du8b3rp7f~?73YN)2rCT%Ye?skR^LiL^vC>D4;C`v zZP(WKTv|KALs=KYT-GUn-yycEH^S%LokZPxULVh7Sk7@rCxuf|WWF{l z4}_x29>B4O2+2n4d#+Pt3t-fS(g=&Xy^2D?G3R#+_3u6lcPMAfGkj;{r`VeU)1RU2 zOZN-QbiF1S&uov=*tsQ4xHzQm`=O(TbtwMyKgV%HsL;}OM=4xNw(F_unEPZUE`R+4 zAkcUW(<>LP%jjF{aa^uXlKcZ%2Dw0Dg2Cj}0YqJ>PbsMH%*%yUXNLg^YFV%FMC>;H_&3hN{a@h*QY;x*oJdHSH~e7XC?BgJp`OyVb|B1k z*c>=^AnN&hN(j|lZVLOz-F=+V%-1DzzCa|1o>!wi?YE=%X;PiuRaN;%#Btjfnli4j z&=aR?S3d7A#f>t|%- z?WNh@G7_aO9Q}a256Qk{dCmsa*=t3;gwrn(!Pyd5>i1`{Z(l>WeTScS|}*l9`2$FU{z)E*o|qo$0LOq zzA#7Tj7C(EsdlK^V}t-kfDFVq;QulZdwA1l98>@;kvbCkz2((PmWx+BHEYFK)uA-~ z8&teMJh3UFB?!gb{Grw6&?L=6xy3QY%}81oYS|c4>Vq%%-!{;%MW^?{REh5+ z#E~6d#j3ry!2cix1|(Xks>!*n-0>mEVtjiCyWBDwU5hIc(Ie}VV7jp^hfzd*Oq`2h z-6y60jZNSf&x!Y%E1B;EvHPbRST%rhbg{(|9tj5QJT-TVM#~1r-Bsol^p{hIBIXp+We=_Ahvs;5b{5!&l0Q>Y7k#@}{!tI{+JXEMmtTF7+LQ8)03cv8 zD+=pulXMRgbrs$!42tG=t1aGaS5ccKq1b!Qyn(S^CbxskBweZ}vTT3YsWySHT*v|Z zRrp?)Rk6b;Rh@TQ>qrEF3@H*l!$)^F0xkJr4zGUXli{Ft-@(+WCIq-A@6Lu0u)jG` zG^b4xh@Mbk@7K|GI>tvTyR@JlXX+2g5lPkgPlV8%@A1YTOzsDWFWh^tbt+c;~^9UE?nuwbXmmeor&5e8_H+wR{Q8 z0mH0oI}3aEP81hN$xfm5DN3}cf3u=*uo%MPPZ!PeAjR;p|>@x@eMQymp{yqhtVJ5y9aR$CbTi!39noI?1;601Kd<>qiJn3 z$tjE5f=!2uPX3_}*07Ji9Xjf*X@TeiC*Fi_Ju5H#NxnuGK+q@+BY0o zR|EUK5D0KKIl@mcJ@2q2r6=5|L%9Lnmk&fg6?I1Ett5W(_SUgAK$zHo1fp!^v5PCA zTjb@&Xn$RJ44Yu?Qub>jf%^*c0ex;#&i>^4xd|R~>2IkY*5=sVXu%;{A`&XZTmTDN z@@UK0?EReUJ9D7<;DJ4;hDnYcM(wwDVWF2P>C(e7&XA_Y0W=@%)8-$0Yekq1?&j*1 z{^WQE&Ps~td8#l1iZbxWQbhZb)tshX9Bs2_dhAjU(!;E#tr9O0O%|m5`e1t)IQ#O_ zk?+iU^EL8vORtXQsvm0fL4f2#6d_=C1uQTQNIp2K&npcgA3$Py`lhQDU|IPx5+qOBLD>{BqxWu$@S#arKRKEoRGaOruoYbly z^ZJ_3>W0Rjb|1-r&GHTBK+!G3xU(pYDL%B9A5)+db_E#2vQXux5w2 zw@7^&?kveoe&6-xHY`k74m%sb*o`_D!rPgjJaLyQ&T!PRCaKO0R^#nhxNrN^lC!#H zP>0>iT$wj7FK*AQza#ThGIuNd;~l&uEOh+W{*E7ZO|PZ$L7?N|+G~{}Vq*OjifW4gCi*R9|yi zhku%B>nTiXX*9?0p#rTl4nkCBengu7ic)%nXY1pyPqE&+2Z$~6f2JJ#&uw6vV#PpZ zAOX4!vqjd&jd}7e=ee1KrT?$n05aV8LXcgIXW(>-jQh!xctw|Bu;ip+0&piw;Bm-_ zw*#^b9k6uyO05vNI{yE$4VGs%-IT74V;14^=Cm0F8>><~*QiOx;AdOhthG^I zKS_-6)pE?eSzs3Or#L(ppO3#0{&n%^%D?>8QOS=_AJnZIWC@qe)#1y1T)Ytz=YmIx zjEO`6_6lCZ5N@Pk@nmMxuz34((OFER*jRA&tC+enGs5c0`tY1RHE!!))n4gM1&i>R z-8jB7gN{`rzZX_(z2C^ty)SH?_5?3pDP)HBjd zy}`l6Qkxf*gT?dW(ZWtpCGS^-cL(%rmUTHu2zQF^Suq=ER!p;t*Ko%L>|tYF=Xx2r ze47^~xDbF&UW2)N4xW!cR5nBE8XK+@mM+#BCxEX#=Btu_q~uT48AB(4Co1ebVfXTo zParBxRrE*22ONq0V&V@_)8^i;wMk6bm;@b;JDPz1XDq<~^@?)pnLeCsD4cha_Omiz zUq%o7-u`IF-PsCU7HN_8Ht12;%jAP_Sj1Q9ag{qB$PK6i5(`?VNE*pz+0L zgoWdO!ot9ACHpqe%#vKRWDyiS`@(fUW*hkcLCy={3=yO%;siUTSBi4)pc3o-qJ8vPAw|CeQ zMiEjDI(`hTuomQ_3@RdX#c6A|i)@+HaWdE>_?d>^a{b2))WfHR`3hQ6cz>NI`m7VSZP^d8C+rj*2ESRwU&sebEw9$m>9Z?VUav~&Z zvFxZA`TEAbA_n_7@1((hzcwpE5G(UKH@$SL@1l|jIDtF;_^p&gKB`mTiV{~Qz?WEL zE%jRZ=oJ*MC?(^w@85(gW+nOssu7NNLS6<=Bn4mb2TMhE&J6NmntX&c?LT9|%W410 zitz1Jh%O1A)8Zs_=$7js!C@c7!R) zgFJ*d7?;`@h)M(aNQP~q#W;{Ud_c`0jQt&9aC%F1u}NcTW7f6Dy}$9|ceVP)QY$wK z8~};s=A048Xgdm%$1vVOr*W_G^+$>jfmDcWB)PsZV3jN4bN`;rTJMKu;05Xl1Fbjg zsjga(wZW62pzTXXJ6ZnDKMo(Q9tnKrC7fP6Y^u=PW>x^ID8Np#tzsgm_p8P}mBLaC-TS=w3@Mw_EtN7ogVWWZJ4W+&mW7Aw4ff$QeCIB?9lZBFAU5^=E;5 zG;c$&oF}EmT!mZ}mt86=k?qtN+O)5T!g5hOTQl?4j;&y2$aB09V_3BSKP4%rQE4_C zF2GV+5fELDIx!u6616ZgG@vb*!~Feyt^9o@O(F5oPPP81O?O`nMUa;?(MVmD0f)}Kt7}lLZwhE(D$VeN()H8-SnldIgu^mwaK>dXgHNn&xCA*{Huq z-x?Lxk4+BSgt@3So1EPUdiambF~-c)H;MowO4r-~2iX|?>2zG`V9o)Ej?qxQKd>>s zyBMRwkQOLtY0(e~DCki>j_DezALbg~eR%DB)R2?_-^1!chpW{5ki%)n)1oJ(lMmGs z3IWLwm?Y)Z{0XNKJaN4p@-P-}HTy0|+)?m;ns{>H#;Ka|X@LCb2zgX;rAc2>ge{f0 zV*!<~cMCteXQ2R5UWR}kCaQn|CX#>w0sN3~nPRR~avThdS90>181f=<9%+1I|Dv6^ zzqlFDck!AdMep0jZLQ#tf-%pPVhIlHiU8;Qlteu|W?L~{vMl4=)Vu)ElV&39WqYsq zt4TTJ;QI}?JfqhZX=tn`8ZO}`=lch0Ycq>xQU2T+^jB6gxDbV3 zmZc5dFf(Ku^LeK-S^@!S_Q*7h5|B$HoS-opT6ITQ;5O*qzY%3u!btv&UFzx+ zu6^eX0lfIb74ptSA&-H+chNKTrqUat+zf5BUKbs{8&Nk+r4}RP1K;2jWO62K!+D)8 z7gk_q+&_xA!Q(T}e}cf&EmFOQ9*}EkLTfU`IJgdW<~Kw{gYV)B2Pz7pJacpmyJg4! zQxs@&tZxq=&gXzZ6p@R$(!QVg0N9*~$Wk&T!K69}-v;i^v^f1z^T0O2h%3Mt^;1!i zSR)BMEKDu}P*FIsV6LRHmR>MdQp~t%RI4PzbsKlHNI*Nag)++wyyfclGR&F+-(x?3 zo7VBv&&Pr}6_B0ELqjNHiOJ!KjUgsG$w2@r3MUa1(zghvpkwGo#5uou>said;JzIa zjob+Msrjp8Sg84@X!u`qmjO5wm~uo`m@Pz2?cSl1DQ80K2pdmTE9IO1JIdsn#;k79 zk6ubbs?%*f@Cxk~SeZgmu%tOUNvj-+hd9W^O{Dlj6_lQ=Hbtp@KCv9>yDId~_#biS zYKPc-pqUY`%I%{?qCgUTo=!y*oy@}NN?V@bD(bK?V)zmNN;D}r&jbZprYrr4T&7|( zV7u<>-Q(m3tK#ix1OMOg>k6p{@;KzH#R%vq^a_6e&rvW@I}-ipC@2wn{BsoQ9j#u_ z`L@MzZc=k1fVZO%d1gv$a19OaK4jR99@sG;nQ+&TeOw(c8Dw6&8n6r*ywnkpBmeNZ zw1=gkAEeAUU+@?3{&=lLnpoB4Ip|s z%@PKSQ^|sRkTL_q4XmH?&<1Cor%-(h!nQF#2}a2m0PQt64;`DmjP4>uf(+V)IBM>waUoXl_$ximYLOOu)!{E`aH2?(V*gnE*9q36*gGgdU#Cl|z&MmpZ!}RD z1RGB>RFfIA2;UNp)^{SyY9ceOWYz%L!JNM*zc6PAIYcmN3hBMHM(Ol#iSc4b1G+cP z!2_3f(e;lV@M*ck(OSyH&xTy0`X3*8=i1Y7fT8NNEYB)^KBP-t%x;3h{+JDw;qwA# zi#4mcOh-v?Dit)yYFmAUF1}Ku9E(ibbeeh!L`%(>@~&=hk_UX2KfyaD1o5<4AKFzn zIclNQwl$fpz~aTdk&vi5@eg)N$~EO8z{X zgbPJP2EL3etSaIdq0Cfy5hrJVI7u{jq)Kvf(uJG^M0b1R{6cy-!c+8dQj3Gf={B1x ztkOkXKT1&x6QU$8{Wl#lTw#yAaf?2U}{X+atQrF{*X`M*KD?*Yq_umE3Z>ausGy7Y^j-VkbfQSbO zu#eSLG{`8yfpa4p281bx&CqX61%re%B_S}yk_{PUuXf=BwPI`_cxbtU+Z(UBmSXs9 z^OnyDacWVAqjJfJmu+vQr@2Nc^MOBiDgr@~6%^%heb0wgqo)T_%8;<2-#_t^NMKXA zz}PE#*UgLK-gxqreWtd-2Ww)U0K+FpLPU<8K0Y~2xxyJCKV^4Zh7)hNUWl}|LG4T< zr0$jv()d%TkLJYKePml?mC4M$9Y!k$a#79JH^-&0XW0mcAS!ECgdtdMR*>aV7MLE^ zP5BwVIeo&LS4w^!1e&UzVr=QBgLaM<1PuX!gP?d=I0aMCEYVWvZF1$z(2dmVP!vklPlUXEPVvbNETn&1{Rc#gL9xSyc7sl4iJN1NmFkwUt*?&lP9(i*M|7z?2L7 z$>{l;FL`tB$4Uv7L`_!L-S<9rX;XKt=IKw?ev3LIIxCTLftb<0!s&xR$~ z1!r+&CUEm7kp47)KQn~opYJLlP|=w0^~ZclJM`C!9Lri)0@f8Uagc|jFjl=rnXEd~ zNm3&Cx(2W~nuBuY)fPPszK*sP1;W^J?tDWIk7lL`D@yAp3nAy11zrQ8?uRc`Dc(W# z{Bd5O_|ph+ATbDQ^;ytriC@!|7u)&-4JH1$fiK>ax>@yrM3=Em;`ui#fvBl2z5&B6 zGMdgw!9I7o*me@`Rz|u&|=A7?0#oX^5U=k^>!HW`*dch?E99(ERYy zd#|U+0}|8#bm+mv2GqVi>rPq7RZT-g*J~f`pPzZ4OcOu-UIJYwjA(b9vaC5s!dM{+ zE1jQmJl;atnaw;MI;9Kb%WsCh&FAgIX)Cf~DqaV`>Ji&4lg26x@@127a(~h=EU~q+X&M69m8U9;jj+1gOunI&X9Y zq+t}od50Xfz71#j7J<~PQQ!yLHWY4&>}U!FT!|$>4NAl>3WeDkQ$&?=P3O0cEy03) z@lqxvDa*=)4WqUU8`$TbT#TK_twg;Q)A zObCIDV!*_yfKk!ypVqg>UTsP6-N!=`LHmKuIhQg|^F*^}Y1}91)_8lA^DO=H<8O() z!lr(==#4}xsi=lY^%YY^{A=nC@Dl(=_}nHh%+BoJSu$&}`m*j)cod@@Z)LYh?+#e1 zWiQ;}_eSxaSf)F1hOq4RVYu9P@IXJ7zR)K%5M)u_i+h)EX6&OxJO<*tSz{*hoV!b5 zr@ox!r+vB)A$q=yWAwy7hTPBjaECT>vHF*T3l4{E-RQGp7kIxjfIr-^DE5&YFnyDH zlt2uO+sNf`$h;gb4+qdiOr`qku2^Dpdx3 z^<%&Y`J%-0W)F^jnC_-VCpFO^_`@H}jO>$_l0m0EeSN|bgpkc7l9We{=68O34>5Ne zIjFbEG+!&RM33*$&8EDpu(m_GzIagju; ztPx9^*S4As_-)Ru`zzg=;qyk-HfN zNk8~ z@WE%CRkpP@_&4ZTcOzxS^~IA3{OPNc+ikJzK5Nxp1H#_-UIesn+-2YIF&$5vcmlU1 znzoiqHN@7iu)CWloAu7lvj@LWRs!d}QtIxoTyyCcXA_R->0dC`3Bj$p7*n#g<}Mud zg=OQPHh47Oe){ zm)xH+;s%9{E^KqyLwV!s3dZlKoa7kbe0|-Ql+dQ>!{~WGC^G~eo;KKZR1oc>iZV-h z<De_Hkr$gf0y-VEo8J_<J-q(AkW60YQFVUdPvE$A!N>#fLtYtz0Ik`l~V zz!0Bsn8s|TqvWb;7NAerqcMNDlO7TbsqEjtOGUGZt%%2JCEm0JYV%;>TEsS{JX$4u zTQ(mT9j&Mn5{kiqK|z`+ql#-FBBi6_tM z?tzS?=hc1d&3Mo7-rh3-pkjqoN}MFvsw2u1l;J)K(%MA~PWgc+*+#<1oIkxjFihpj zD{hNO-Gwj*H{%dKV=7o^wK2Zq*)0(|Sjj-|BTlF~n{Q%X#xb(1Oy4~oj#iNXY~IPd~jCOFrIf#^7GV?Ey^4)xz+z%4MpeM16KS z=7;aLsjuRAOF#IV-%A&4m;1WlQyC$zUDS)F8mi+)cI{Ue15#N|9L|?tN;Ic9fH8wp z$U3{dt%_oJQB8ZgwktU7qIUJON-pxQAV{CKT*v$rJF}4e1oHE#iq?8Pccq@n)9mKu z%@sPGtnJXx17NMm-q1Dr)nfEc6kgyMwK68PIB0uNop3pQy+rzINggK$)dg&5b2W$N zXjYyB888J6P(#P{Cu3E3E#xVojd4rc*P~KbVEUf;e9ud)fIuHfc(^3;))Q4&qi)4| zFkgF)o=XH6{MtLaAgTm()>Lg(!nq+~AaL3(XR)Wi`4r42Tnh`M+1H_)q)ntsFZnvjD*9zYK2F^1}m?Ra0j8N z_pyrQ>a$}hRpPWi3{>4en>^pl?ozDy9FrZVlBgJ;tmAsPoANv(B419d)_m1WIrWv) z5Vz`aQaWFVY*z)OWYW&#U9z~fJjhYIB+8;&Q3)#E;%}pvNZ3?6HP|X?()fwNvl}c7 z6G;aFIRt1X5@_kDdU&J{VNxcPdu>pZy|?>KI1sGZ%lffL80_PWs}sc_Pm!HOO(4{pnKZw}wcjlM zzGh@tScwclTtPF{J!6yMG&pSV!taksHy`v{a9GrN0c^&*ElhOL>on^3@BFm6%l9t^ zM5Q`og|==g7@t6Hh-nyqJYj*O#~ROsxeGsBYA(`C_rt%A#I}Z%YCKq3$pwfCzY9=` zox;$~X&VYYyyywe6$zlPtp3Uvo1H)Ud3J*&Vui={xEqT^MqiTI^aHt!etI67UwUD% z3lha;Uc8Tiz=B0GV^q`lb~eG<=DUa&K%L97buX5>HfKL)J`JSHSIm#-o!R99bk6p) zSpqUzIzHdNu2OjY_Y>8Tx&^vBfy{GIk=_O`B$aV=)sFNj{lWyAsG@8i@%SWhU@7}b z@0q+RseJ!hO@5CQX(MV2pZ3 z#0qElIkp8`i`S!MWdSxIx%N`BW|jNzm5q4b36a+<+-%iG`WWZO4gY_Y z0JYh&Gxzot~rKhM>mY-rPN{L1qFQ)5f?`UjX+CvjkvG&&3foj2Ds~jV& zx)$1<-JTx}Co+3D%}N5W@FGjxEoWepmX>28>-ZeQ_tlSD&S77sUV!JlwOqN_t@jSU{p*&5dTe!IoG=wUwf8Mxz*3-&+(la>{8Y*)p$tF5e9BUTlDH(j%?h(SNFXw z9k$eFT#C=>Dw3Lv^NNuW>-w#riZ&ionrs#Y8oa07IZDE`IID!oD2tQTpsBv|Ckk6N zvEP2y{GJAZsuvbzrU08?hzC6U7<~Os8-q&gP0&7BFvS$;QKw?hfvv7_ozmG#16x{i zE=7-oQt-M4Kiv*{q7C`Ga}g(!?tZ{$V8oK^3)|4MCZG0HTo_1Eo{V}a@5t*8vR7TD zK)0tIzbM7+LnO{?{}pa2e3H9fI8HzxTi^V?27{~TbwH?^o(cHNH3S)j*@bpiQJv{1 zjZ9Q1vg6WPHoLHVlrDP86)uneXjBGUMc@({p*!;j8VnDCd+~3NQ`k(!2$#)s8d)$p z^@3~lfX65uvq>ccfjoER_BtFdUwn7dX9HKyjD(WT~$RQJ_e%qrAsy8G~eWAX}yEqmx;Of5da+#8UWLF%Dk#yE3BS>Dpz!$}thQ~#;n zgg`0mP4y*^nFtnzN)%LwPR3+R{-N|d|pk&q9Pu^S z4*1Y+^NZS1CDpsb(fzy+ag@`?IpMP%s@Dmne-eb`!8yJO6dO3r6d`6XJZ|6PepcJb z;Q?H3qcDNAHUeZ`l`s6zBzuoJTrISC4rRc7w?HM&mWv|h4hXjD5cN1Uw3q+>DGk*T zEb-{?eS+%nw$yeiV(y!45XW|AL?ZJvWFLBwb_;C%4&o11^%b=WV>Q?kJNG7{*K8{< zkhgiTSY&u}Mn$mpYw=m5Ehe|FJvuErh7X{M2@thE_FQj#>N+Qs6{4RIS*@{iYNuC# z%yV<2MVZ2Vk!!A`w)!u8@bK%NA3yGs&RKCINlH*?`hg@pK3}u+z+gdoFv&l{mJ!Kj z_i6MuDDtadE#bRF2IpilBW;LJZ!$MCJ(#^jHeJiA!D((48C>tG zyjrcW+Z4lDb8POU%LqGxMXqhW?RbJCt6AqV)T2y?`s}FZ^g|=;6lq=}Zt0tQr1e{c zVqhPs=K-Pe++-#9hX1{>6LC`k_>Jwja=SY9To(hRC(Z-Wxf|rqBo4)Bq=u&f0P!Xf z(CGuYy!8}oNV0MYZZH{Vyq^R~K^fTszB3$y{IYQ0ULi$B$77+FJUZmGo@xde>Vs7} zn260!5j|RR8EG?$5M^#j$NH#(bB>E~pWm8k8k+Tk)bD&$!y$794$A`op930iDU7$S zlcSVe-zBR6RvuNN2aA1qZpom%U3ZI}ZpSrZg1@(Gb1$PQ+KesWX9Mv{5HCPmO}lS~ z%+{=fnl2jXHwc%7o^y(uang3>LJdQNp7DP1>JPi9rgg$ZMMm7VDwX&f!>Ptuvq%O{ zvIg>Edaj};OA0P3qWNe6iWM|n8AhxN<~B>N`+58EVJ^EZZ4?p%t)=RFZQ2~LH)I_p zGu<-5NB1+5(7|nKa1K}vHqY`lpe{JDr-8Nb3MN9`5PD7d$y!rOM`D9|)f#4$W-H9^ z1cTAGuwU_nk*9;;gXJ3Cn)jz2w-jqo|D_mcD*!Zi{V!xKnSc_Zd5Y#lV2puXBh;rp zYJ}_MXDxbrzbpPO{eLlrMya~;z&bh13Ylk1S=Itc_k!P@l~W!?lBIdHNo%U{vR6A) zY(&9Vo@Q4FH~}_jU$V%a(+7QpvrkWUNw%)J=;_~%bI(UarLVKPCKYnc$(6cI3?Yv?8>I4ZV^Fg_1CDR)^Cob%NJCO1X zBP>T!yw|`t9f5EGNr+fd`9?dl_I<%sya*>K6eMIYd}n+%YoO7J4bKn;@|G=Hb$=G0 zj8F$8t&^&76m-vhy#aR1hlVOC`BoPDIo&cu?_{?gAT8X($q1);=_5x)Yb}a)pf5KI z_Xq`AEDzfEprTlCMzTaiJK+T%HUc(gCJ<>TaiwfZGR^%h{i(Wr5rS2lsSxtt;d^Ap zHuT0@D#5_b=$&2@BZgD(@p|px4f`Gr<8ymx@Z~i0G6Q}@iJaAf#C2uA$=&3Cjd?G& z9tmKXHiPjtDA7{y5oikdOcvL2_IPPJE|d8wAwIumC3ri`-UFD_)0q}eLr{|78?(nl`5L~iL%RO!YjQNVmMfba^KGvy=;NA+$z{^VCcxsJ?X1*!7 z7_gm`R~6HKU!U9;d4){sZNKE%7Tc>)0Rf~M0cu#B5((!*I=)a+&axh7b^ z1nJ4I-I)D}{4}MvCzQbi8OW~_S^dw}N^>bG#}QWsJTb~pQw(FzH+Fa<>a!_6<-C!A zUqF~KD(e-jREEqyH4e9#tX;@jH&r{$W_-5}o@cS%&R5ZIFQZ+0zhRw@&QVEfLjejZ z=P`X|e~~6ScA_Pbs`+czzWPS|t3{sa3jY@3h8GKo#~g-^yj}U*6oyMppR2a!b6#ve zzIWe^-9fyTgrV-3Tip-}262!N_E^4(8Ex@g;XT&D*)MjHeD{tGV4ngmc{}c|%MD1|{?ev+CNEhs>_;X!UC7ujY?InER#j)SWG*OR z)tbjXVnjSq%-41EZT*|3f=n@$x)LRKyly*>rDKw;9pn?L!ChKskYwtsg+CV6hJ?o~ zHV{L*`c;&UoH2#)eN!*Nx>t#{SyC!0>Y z%=?Wxw&{IDVM4f~*@lk^2OJ;-9PV#J^d}_sYOhHW42*~EY9m7ZtlIWNwCO{8P6w3O81#!sO+afGrcDv@nYlN#wVUg!8X8GQSR#{x5E|n z)!RjbuF^-VNg?=af-llBe6#14`;`Bi{cX+GCvd}S;o=6cJh&YF$0#NdTAM&@d&ZUi zC$Soq_!w3~Z{*k)ee?4x<%HYrQ(V0a?JK^imWP}thIl(`T7$kuXaTd}K)AU(sj7__ifhH??5SYv9VkB9LCl+zUx} ztprzs_~Vj`H{QhP}Ox)%XQ95%9}eHP_W-XBj{-c+aFk%%hYlBn%8J zBBlcAg+uE>zhsxpj~YWW4*!zx6)yN{R(7-8@2aS?l`yVP;T9Sp!(+fuL#f@aNRX2( zMy9})&$$K$TdbEdad_-2)iVaz35K#8jFP>ZZ3#3}qf%z!47*r z^W~**CI!O?10a)?ocmjN1&!B?|K)ZU1>h%sAPm2ehaf)qc+xueU$XW-{5&5U1TwR9 zwnO6KV|Yv4=7TeE77uRp6lJ0x(RP`=GGq`|P?WLX%3iXets>ynr(Rx<5-O-c_pW*q^bz1! zI<5X>^kZY!h^AT@snz%EKzX5V4VHUmt-Gu4SV!*fi0Sdu0kI`1zAIr;m;78d!hHSM z?{OOiB3jK%Rcj1Y&97euOwQST@`W>aQ7KNz%svGk@bI3yDb^EPeER)@dRA$dLA0oQ z)E6i1Y=FW{5mh3Nhwol@kLD}pBR2J0yn(Wc1(Q{xD>zA>QIA;_Bf7dhPQ8E13rfn8 z0$d;)@G|X0A zIV;rj2uGrrJ9iggojeJvLDSfP?gD}66q2S5V6x?Xxyc%2&=e%x3>axZfGKa49NLQ^fKaT0(yX~w6ejTuFgqJmke!W7(L4B0#mOH#`iw!|@&2`g*< zMG7g#AOst%KXVM5)4f1%#G+b@DUcm6<8qLNB zpiTpp6!dZ4Y%F&ho~%J8!MFbq@*zS-6H3Yd);nt}2Vp0;$~Ee|4V9St!ivNVZMm(m zATyH4t8MS*eH$w=ge2QB8|aiRVd_hj;XHi^u$z?l6SBr5v$?P(V+FW-rd+8)#H^54P z-rqN^!TZ=NR5cl8Efka0p@w5MX7$mu__Dg!rgVRiuhZ$SkdwW+)Y`1Zc-X9AcjY9E z7e9HJd^H$i<-&rWL0N$iOZszoFyYG)a)dGeMs=v!sX?VvzS7(yzM(i#eE74ao@SXe zcfv(2L1yHU*xwgvi3tsNM|5NgWdQa+a z1eMmz>h9JyPhzoc?+R)|WA#FFWlj0-Iy}rZoA*q8vtF&rjRrZEc5V1_my~ioovC;x zr9X!Zl=h64_^>VJyKFLmDDoV+mEX3>^CKx#zl|Y2Ofp@`paM&gQz z7qn>9adp1}o9c&QCm>omZ}UikI1%r=H^tc>C={2{zd%+Gg^HA(;BX&egW7M~@!k*1 zJy?(eWWwHlJ3?$+@uIeV$(wir(Vcn@0#8|D+&adWq9 zVBKFc$Qzp}_S^~;w|S2(P~jHgZG%jhFXAz_&feeun7=^@B$UZYMfs;~*tZi@T8p$H zrIoCNn58pZV19DiSlyYVNjU<;5Owi?a(K~9<3lQLOXQPiyy$SHc{CRN152W<&jO&_ z+Sz2<%bmcJk{jqFMMw?Y!52&X{C%j%Nw4Ie2d4PJ2gwkBqW+BE= z(%6Tx$)(&(OZe-jbUdlE+j06TCMeJ!i_3AP=mZQ&)4CfNJXnIZ%pawATXBkx<^!lC z86?}%EP?QIE)k<;0pU>D<@({<(j7C^kP4V53xBmFcBhyC*%>!GnevEqM!Au=PWwWi zw%jZ#Um=V5C`V+r$u*+!wA0fMUN0283`CtF)b3bKlt;sF><~Mzb*|qRI!gzAKgJ;7@_{dc>B8qEOxU zerA>7P@#t@jK>8->nV#B<;f-e;K)};4`?l7WJH{ zd@~*Kqd#c16RyJ;r_FBljNVYgMsjlK9%w{BY@ng~p)hL8Y___g{=**N{$URt2*r=W zTM_72STb@Rl22)eVJ_UQlFmTvfmwtp)}{I|q`W6ZE>)y(SHU{Re9bPE{d=%VuW<<{ z09#k(H)nPNCN3R#QFOgQKFUsflRjQ4#?IBVPR{?ZhdREgD5>SzU&Ymk9C{PYkj@2r zUw^cGX}uo$j;Gx(^(B=nd^eC_GAOzW8(j9R?LL(Hx6JOcgYPP}?e6YlQxb%sCt2qn z%1@GmdvI}s<*xt4PmgSjwzJA511_H$N!pW=j~f?LG#RG#w3%n*og;;r5UK#?(LJoE zu6VF}W%YC$b4q1MZ_OjKt74%JdE-c77z+fyT9N|`#f}&ynB?*?LK+yMy&Kn*GHeQ; zXMXi+2?2W5$eGVUCpM$xRHX3$G50o~?mJlf$nN6;h|(V5e+MFTv(8q0*^kDO4)Np?L<9^T~Njs25+6 zwOSdpAkx!`ydJmqQT_mF$#+$E00DJmkqHKq?rIA$oJ~2yEk@Yx7fMZdwNSKueewt} zT2as5Yv0@c+V zDl)TTQqG^(dPe1cComfWe7v6Si^xaCJrrlT_;RU!;l9AI1OTF*cSo3_BV*SW$LZ-{ zxNT(ctPTs!g$K>d&qnS8A{*7z8A%3;PLHjnQx(x2e~z}5<}?ab+!V;1#i^9V=ggx& zsv=7R8XLW|LX#R>tDxx@)YelFez#V^YP*t|6bou8C9Hqx!AASBOTzIgkBd%#SiA9R zrIXRa%d1STZvbE)#UGM+;ZDhMHSP|^mBsap_O*Z1_j8GJzpGTs5@53@OSCiQ)7S)Q z-T$C1@JQ17v1N8cv#l(J3p)%($Aes&_%(9LlGB<3_E)G^{v10@6BZ8~aSxVtI}LqXX`{Y^>qF zI;M+9vs7SXLtf#?-Jz&ND(F;r+zqa&ut+-Zlx#6>$-eocTD06urpX#ULJOAn&-btB z_042M(%*8IA`UZziE-A}ThW4)L)OgLp5^?1>dRDm9C;2Fz11|TWuSgnt&xLYs{0%U zQ9^PMsL%pB_0z3hAqu>(@rBab3OulVf?O--6!AZQE8~AAci;JL40kBDe_|}wXb8Sq zMf4*BO^61O-(~s?%l}LWtkw12&VMFEC!0l%$Ldsd18&t>NPR^mmiH_3M15n(*4;q% zBqCEbpP%FZN7-9N<<+iRwz#{yyM^HH?(z}b-3jg!3m)7Zg1c)V5D4z>?k>S4hx}`8 zseP*Iv~%+`F1V#NW`9Q?qaX9n@bQps?YVBs`UuPkUzn|W#sxrJTq1t-WbwsyC33xu zsSke0`c27dO`)cdlm9f zRnls~swj>KCe_qmLihJ8K4Y@a;`n@pxr@*7Nc=MpZsfAs;D58tR}_kkf9m;{SolPUowkong&U4PivIp~M?udT6PG2>h`i?BEI0 zlU^z=$Qu>2LWN*+Z78AGtQthzw3-*@Z|GgR=O*h%`1EN#%H8HVjLUNU4}zo@n3r@i z3j}28y`j}A7ssRiqrgw?LlJpjjKC%YNgIeiB+3!Qz#(=iBzGhD+$wyT!*rJ0VWb89 zX$mgLbW=ckyCpf?uLC<^~BWo zO$fxC#_fd9M4G$zwJy!tk*HxTP-!S`x}Y)1`698pzVAwGPhg08jY@)DUsW#WG&NMc z^B&K`(A#IO;S?qWKlZuX+(F>nM&zWVP9#fk1ALhb6ku=j9!HLpzO$fms_)D&*wm$T zqLPp7rF5DX)xQ?2-P|gq@KV1|Co})d7HIa9Q3FM^j~29Z;hAgourx%3jb!sDe?wY+ z-KpO@^5!xhZB-?f##fXf<>!Hl{!2iuI~sVCq%hO$lO!p0J|oN}_YxG+Ruwsw1Q|sF z7$Eght&eW%Joaw&^tIEmmI!cv>^0u(B1>d^SfMdBma%?jh?d+^K7K1=?k`JTh4*NV z;lB%&J{GR8UdQIA+}-%~sU4vsQf;5!uW+Ei`|l)#26)f|6NA7nIl4*HX;Ys*0&{rd zx+Z}p0)=#}u0f1SOPcS^|q~ z)=q@5Shjd2N`BEQl@=nh`*dmxF{4x=1ight)S0KwTLdK){vOCBm2}3;GITTKLCY*x z)JfvQ<5H9(Yd#ccsQP^5<=>Uf+9g*~3ZV5Z_L?rsESQ2NtBgunhRCr|4o(4Z5U}x| z`bm(FBXt6Lx?R6|E|#6`pwz->jnddzF!y0{?A6Z!AI)VDqQSMsu8o9L zDHq9vAFx<#M0;Yx@d)r)HIacvBOClR&JbJ1VS04D=Snc_5ULe_6Or}bOdBMb`Up#l z?*>PE%P9t6 z?dx;xT`R^f56tK_vogQ$I$H-JvZu_yp7M^73cEJfTMOcS2j|!=2#=H#0oT z4`jf6;4FP&OCmJ7857;#qwC>&r0Kq87`xv#4wx{xXbO}i{202DGyb}ms=pDnG9iwN z97xfGuBhtcGe0zJI=5THF`UsW*wD_y`S9^)+hDw(U&z^E_%i_g)FyxLq?7oV)TZ=A z>u=bx)ADx@Vh##!7xwdlOJ7%!1`;e1N*{LV(>+~_&;sp*PQ}s#Y>S|t`_g(K%?8IO zL8Ak!V=nXlR>&)8+Ee1eRq4t5Q`YxAh^LknAKT4{nlAM9&v)rAZ;;C)4-MJKEFOocl5DfNIRJ_=vzHv>>x%J~;+VHFe&fh68`MBir{&!CpQ)b+ zE5ti@i)~G)Drcd&!@c4rUH;Cln%}TqH?pnH2*!6?vC&TFZ7?rNs?gKTZP4?{g5& z7Opj3(1JrbxQ8;AU;oh442;h-r}@P)H^q**NLA)_zsoIMC!IF&rq3EK+#d@~%w zlnE^ZX9}-e)B9D+nk5Z)&t z_~uxu4qcMWGZ7@%aXksE9OfvU!q5q2x;o)MwIcY`Cvo1t)ten%dDaIC0I-zWarT7PO2p+zzwpoSt08I*N zr*OGno+@D07d&4rGy}-MgP`Cr$YkDs(4!78$|JmT9P1sXiUwd>b36KmyNBlyPIq-2 zg9O5@z)X83?dPuPJ-bm7!praE(93>S(6NHkN_^+C-kjW^VJzqi+QmxxqV$>87WtE| zP68?9GJ1)?`xJy>S6bk@OGj`@p(X$@ws0wvjGG)yzXa@YNIe0r?gtX@DL=pcswQ?VAJ^Ncf zjp31(jkH8*@G#LY1_n)qizhq{Ck_GrpRy05ug?P22E(B=In4JDUEeIVfyK4wSH{vj zAx|b;{+q4WMGM8qCiREAE219>ITyaG0Y8t}Yn3IthI4YJu86}epNYcBpLKiZ@|?`y#r-~8Djq(+lhuzUKSmgSF(7ttS6=FAW`?lwe=&nZ3ixe^{lz&9?bc$!!W&GS zu-px=dl39hr|3ulm^~3+a|1pPEU~J>T}j{ zBlWS*VqM_7h2T4Vy>llwM2|D3(h}A6m5Xn7{mlbW0lHzT%>A-4Rv#wK@q;j%m-GmQ zi~(IcdH)Cy%ERZ>^?1p?PSxRe)lBMj~p|1G2*wJot&GS~@Zn$q2r_vho z8@5psG*GLnSg^jQEyV?Fvzbs#6@3u~u%|DHqC?`2-*!bK=U|PNYbVt3;l>MQ1P`mY zUwv0)NB58y)P4#ODRFUWK58>f`t9qL9hk>nkvOS4e*9bFRXZDdt?9WVYi=nKxHomv zc{;IQozu$3Jfp50@5*n|%9f7GVdmAwfyoKI=H|u6dE%08TM0CIo236R*{^u4pbJ}t z_jR}l7T=tlmtVq4sC+8;W4@bSQPBvC8s^R)3|yT4?@E{qW#_c82OmVKY$_|6SUG%e zMkP@EDZOHsHdDTtj2v%hdnhE?0*vKfU;7)v%!=t2Sct!!@|Lf%bQ8x2{K_VQy^nDb zXBp@KzOxIu@u`A^np3laT7`YKl{SFU!D^3llsYk~^A*b%;Ncppbl;aoG%t01{=YpzfbZz4r z1(_-ydwF-n3^wiX;IlZiK+V<0`A8|A72K6#Ih+vHmH|^J4@U!+rZOr%Y@0?CAS` zOgBCdcz9f0J!4$PPgz5__q~mC^ZC~YOCGWx`*uFrQSG&00F)V=eg$xSo!&U= zLs1A0UD>3+Dbx@aG(E&jQhbldeCj`mN%&SJmWkjaRtDUyE8Cuua)8lTQ;`6*)x6;t zJp*4XW}rVmOx=pgRjzn6vSoWaLpYnc>@`RY`WOM~Dw>Btw7RQ7D8L9@9)2GaS zFmi1gRFO>sOyK^tJt2P=f5C%PWm-U|K&UgcTG80@75{B^YM9t(pK(vl#Om0!@9b9I z3;^+nHF_<#Dt*gR1E4juRoq-@uJ&0<8_+%@?#BOGuqU8J(RLUVQzY}oyp!WdjaHKc z8D|M#UPU}QXMfti>qtIAfxhP}^kI)?Y>S}W1g3*)s1N<$4tDjHy0e1#xzqTB+Q;fp zmALoD!`0ajr*CJcTnxwYITz-#(47oN%SK99UX-$>Uu&PA3rM|7O52Q2^yO1$j3i(pSmF2_%kT8b02c0kiJL;6A84kQoQ%;8UWtxc_daFi6N7Et~Qm%fu^Lhu-U%lR)EUtt+3s*`x8HOdhq4p=Ag6UPb3OgjeZn9FXjZNFZ}ymSW|WemZ+V`(l*}i-Jqi>C@_XgN zVvk`LmAFuzBTZMsYld1&&t(UeAI+cPaI7YCH*I`XRlF#RPQ6Ftg;E}l`e4hble?y? z-MThw&$R4lQ;*2K8sel~f2?B+zp7mcQxd;hVHoKlJfK8TH;{$%xe74!R%#Z&2ucl>jCXAo68d) zNXA;(*;b_Vcr%#wJ?4w^e6RTp0P~L%wOcPJT|rturekLLHvFYIYN~52X$?mty1Mzg z23gNBM_DP^kZdmfB(r>~Sh_t_&+av*Qp}zqZWcgC&Gwa@4SfKbOPo$Do7K~+&%{UfVL%j=d;q6N&@Mp3m3ya9}~a5B{q zGPH)=zqU$E?t0)`AZB%>8(+nyO*tG+=MrSEe~dv85+e7BQv(XysWMqF36JS>k)_>y ztrKd{m|s%r8p+Mb8^JXS@3R|AhsPl+7PlDmuziT#Y88Iq&dj8SM$+i%B}?!R)b6cU zSzm^8gjQ{!eSE^^VVOKjqq{lC61t6G*Cwt)wA%l|`8MYQHn@o|su2E17@MYpE{Vvh zsyPZO2Q?b?58|Q223yG%6bz7Jt_F0R#O%D)ToWf-du+YB_mc%*9)vSj z;-cUb zlsgO@xW34%mMT4vdA$z7DU)?w61B2ba2Kh(+(W_Q64WYWIGP7H`;|i%C7wfo*;BaO zJUkFOs}Zg6S#QY>E)I;E8tkRQF-ZFG$Qa0IrDA=4UWN&k(4cN&zl*y@oG_Eo?@_-w zeb*O}R?eoil8xM1as7sL#Xp4Q?X>OOX9}#^2jNOw2Em!U_%ykKBc6PfM72jrblsry z!#?QNbP7axJE9cVU;p41U?-?*tHTeKYcmaR)?M zvs76ZS1H1nBu9)ESh-}HB;V+hSFmRLVaf!zCOP(C80_~J`I+^{Ycg`CJ2UXOC+rOvUj6CwdLB78tYJLy zQ0W=Z56a(!*{ZAsZQ_=tgpfL?cmh!+WW9F%3OKb06`t;B^sskw(mdGzjADd{#xqqB zLKkk1!x99BB*4!W6bqQ(IZlcqiOH!`o^-z&WQb+xA}xWkT-3E{qg zoH|PvD<743_7}RV?CNZ4v=>na!}`v12a!%ZXFjBV>Xbkol|Tq*-0Li@-{UC7E1tP2 zq%)JadhShCFJAv7&GaG=1vEMtvBG|h{|&b+l94K+yo=qhmT5U|zlNWdL3PNm68nJkKCqWW$S@}jLFtlfVhV+mU?G}|@C2GH2@*2T zSI%C_C}VnnJ9Qt;^ZSWWY1RRz_r#=e4l-ikfyJKg_mtzci1x=aT)l zo>#m<7uP2Z&9YSkz-#Eo!iYT8MBea)fNf3x^R>-z&KaP}50TALjBJY42M*f$z!$h@ z?jTyr%B-6YbTMr0Sx9qw<_c+@w|$3P+cLqbXmP}G&E6w+C*Jj zGfGn$&yc(K&{<%v%Cejmsh&XTblRpdBVL%0P&}wErpnk?{$*-tD%DV-x;ny>jpdMs zQ!4r;J|jsLI;<7l-GzJ?yrB_7Pu$Z2#wKfU(Keq0YnY+K8IP(VBz>Zi4`FSq3~&&gPcf|{_g*2SkOu^( z?n?oDK#e4QX(b*@*FVSpGqvRkibk9E>0~07Bf;IJK82FCcxU#Pr35GIVR-@|8=aE=tkVOINo&z{F9n;MQhAl$>E!+-SXD?q!E zzWFM@Ho4@b|%w?TO^^yM7{Z zq^|VRs&^yJrz6wf&>gxS9WxjQdK_yd^Vi_K2ub)hjv|`!GQ``f6VK>oIBGz%Z z^(~h%q&#|?P8H5PN*#9G=A(-e@9$XitP_!?yj5B{!fXetUiF(Z_m-eWEHJZA1&Fq0QTa(8e0#Aye zQC97YxO$8{U3^Za#w%NLNoRH~Q5@d%QDkQ+?-^vpz9&hN#s><;ptE|2qXg_D<*1sh zO5wXIr)d?OGIlvt7a0mK#lPC2gnU^x^~oU8lTSb{P8DcR-;U!t-?2Q3PQ3u-a0OS$?m5u9UG~@jIu)X_G{rQRg~U3}zJG8G-C}R3#qA zw0(F79XR04`r}cgpIdkI>iXJ-Y@EZd3xy=-W&AcgHNNdRG?-d z65nMfeM>5(kzi+IwC-A-k4}UciD{p{T0kP@8%Y<(M*?~o1Ha;#!A40|k&_|&FIp`z zyBlHenLJ8-XJJD+kC0xzfy@S?i&KLt2(L4B|PL?ZRM zlH-J#j0TY@)2mV~{d`)z9E%by{?1;jU2zx%du}4s(?vaX%$?YrZ3Aa0Dk27_KS{AO zxbzU^lMUd`!GXUprmc?D7T-8`vP-}HIe3RN+}>4V`B8R@-wnU^Lco4rOx6eMo*7W+|W3G3$BP{WJyR~(PAtetbLt21NhJeXHdC{-WbLOD*(Bd2HWA>IF@( zDSS}PZ1v4GG{BGVJSx)zxArmT(3M&D~vle*Oq%!`S;R~Jzf8eB0lM<(o<8d zP>$W;6sA^)KWx1qbyV*AT#+67=~Cez)gey&iKs`ot-sdX?ma&cc&v@tz8KWqrFG<*>LSuoemcPY9epUj3D%-nmxs634KCLl%L_zVhc!4j z^}_1)M=;Kw<0E`VHUjtWK!QcJHxCE7bde1#Rf-^PhK80|v}KjjB*mEz2)(~g{2V3< zcDN#f_87FP|9y@H{M$*Fv*-scB3x*%xli)fqiBaVl2Ko>YI0d{9}_+4Re@4BOiyF2 z2Jp@TRcG0lm9ET=Mty)y49U=~ndA*QEF zy6LB&s;&RXBG{3;2VYZulwl?>BA?1)qU)=##2V)a)m19^s55m~6$N8bqxmC9unQLF zg{TvXnDJ0cbO3?x6EImf{>{`cGQ*IkBsr8h8}I6f7hREe;W4b72jw?4U^kZMX+T#oSZP>J zmshW62fY`bt+8-+hUj&6j4rna@^=XT1lF+A%S=~z=l^)+UTkTlRoQ9QsyEkavP>ba z8`(5a4VhnLNBdDyg)?+$J)o%IA_@npO0-adC}8B2z?qt`99CfO7)kIT{4QVrfQ_D_RwFANs@$P z9UOv|ks&Ebj!q@_Jy&4%Ywc3O9X>@iLuM-qDVSQuO^#6ExY9}n=Zt%x3Mm*HU*SDd z5K}O3iAgTQCYO-*8LBMzTY@9&Z9u4LcdcIiKxs9we&CNVUNC3h4tt_ibWMYaN4|8ot~uqr0&JZvgeBO>iNRiGt25x7q6!4K4-e zrdA!LY%>Njn*Kn|2&vl!=jvYKtC6mm@(mQBx;4xnVi)2sJhDA<)h`M?bTbN|bUHLX z8__>e;c1p^Xz=ybh=+ck0>nfU?1c}=hP{EVYP|}4F7?-?#ez1}@2s}t9)iZyp?{EUn9YJLl`g^BxSyZ+PSZvpRZem_aH-(=4Rm;~_;_Ozq zAbxeQRt3yyEY@X=_UX+}U)F;kln}or5gRXff#$;sRD%apee-s~o*2|gH-p+&zV-qr z8gXPwE0yHiHr!uu2J)E0z*pI;=*wi)(dxRWSA**s5$GatY!cGa99ma6#E}yjuZ!)O zXOpAP35feoIP2zw6QDpDsSXc4>o}+O|32;{J}dnF1I(j}S;WF=`V-U9_(N1G>g((9 z@dV9ndP-xgp66ii&#nh*>_D_5Wxa${7+GadEy7O*xC*k$H>{t>NhQ*=9j4q25z!go z=Lee7_*zRkf!US1G=sscgZP9jHWew#cl`V^Y6Ge{6$*O<-yS%=-u8w49!+4pE1-{0Q#u;U34_k$?1V5po57zAV{0Uyj{qiY{IOs_K_xH< z0SlCu2T@f9q3CHh@l_P#t7#t1ws_?4dDtV0k*D$>C|09^564uI`l`aI=i#XW46-5R zul;E|bn!v_==sVq&WnpGZ6=W`1Emn3_Lk6}XEkWXBRtYWcz3l?`ex&9L)zL0;MAep|!3+Ic3@ z&r4`Je2Cd;zSNCdnMXW(|FgLxdWZvnyfbpIB00sH9^Gtu zPk26HP4normq-(A%2I(ENV@wKrK^-d+UlgNdwu_>Z;=k;q4pa^{w?-#6`c(j61j+0 zV>(Iqq?CO%AemSFJbffA)>gD+0?4l|Dsx(Xvu%HN0kU>V3B z){2Xo<=l)shX?72%qy`G@%rmEl6jQa2QgsgIUJKhT5TjIFT~(`a|u*t%S1O>L<$fV z%?e;awWa8z*8E3#?ZGvM+#oU}GPm{#O3-~c@N0jMD00?**{VdyCKHmc0m0Fvh|_UV z(YJnP0%<-!-Zer0!_Q#(R_%~X$@c@B+K~KR$lSdd=A}mWF(%hY?;0_bWH4q{T(!9F zi|Ocq&lhzC!FtE~M#lTY6#6j)ZYY?9duB|Kht`LAxIYnIPH)Z6gPP4aUyWr31ipp? zNLT7pzuo$5;zuVipCJ*~Z^g}X#Q&2OzG0bLJ5PbVG;8dJyB9o^q0Mx}?Gr09q;0(9 zw+_E)vHn8+l4m9f*E}n2bO{R<%IszcVf*Y0-1_ZpRs4a=(4HI(vcTbJ$V<!x*GQgJk8kD_sx1D_u zY-tMp(!t>L^Vdg+XH&_ z?MF?AOKLF7;1O9#a2AR)-{2AZ;E@lCwP!x-0V5~ul8qeF)u^@Kq-2u$Fw(Kb-@Y@pQfE$rw~o)b z!<4vmWJB8OJ85jlYv{-ByR>dJB8u4trn)NlU-?TXqT}`KA_l^ zZ_5)p=knz)Kle9`I<5o15+>Aw#k+er7@Z3leOlof=;Sg@B9l$DeS0FZdE zQ<;$Ex=Bo5%}`wpX-ZVK6JrpvRHiv{#)v~y)_2c~iP4a9Kk>(rd9zv<{z3z5IA(B} z&n4K&$my!Ot|NED-k~AkS3?EI$SZ^j0B#j$&v2AdNQxum>qmY^P4>o>mKSpUB5`&O zXzR*`)#pE47F_^P+TClZtE}W9y1dIhSNCgAE(nWY4~g*Px3dgDc6qRl^rn}A%=`Cj zsTMAT1eO1Ayz;J2hm|RpM#Ori!FsZhAf|>mbFTZ@EfPML+6TV)jg+aWNJTD*oLg!4 zh16A4{op{&Cb*EyKZEm>v46Ohd>DAN{{`o4tN}2#K?BJ$z88wl-R&?UNKtDyGmCDb zs2&bFmiv&V5E))6##pD?7{nenZ}?ye{c3gi!o?AR$i{u_xPs#RM<|q`(~1IS&OW}B zJc7uF>PZ_k6CRa$ssl`T=<{r3*k{sNi+3vbhfA2%55_hNOli_S$N|$eGjAot=PB~u z73k6BzOdCopLJwGRc*@kdGK%&kT!aGM{B;)SarC6(HhkUhhzDEftXgcn~@G80>eO# z!VPl{WhQu3V`MYoo}L)C(>_Za0k2*BCnV&-IwVEE@fH+QJn>8!(+_V`KLf$HtY`#- zxZ*4v{R$ZuOTmI-GDKQw5+?N#&hmc(jLHQCP~3KIC_ntt2{jE$tfhTJyM%*=OF({9 ztTPTTC8l=WV$)2A>io_Xfec&*&PQ z;r~qpgY@?3&l`p|f-=EO=tqQYuyUuK%hG(kr7)I9o^c%`evV1u zoOxR~{X1}3elDw$W^pqyEEMyaW#{KG#2p?5)34d{Zt{!==^Sy46&$fMY{NK!(rQTM z&Qp5nk-&J8#LP=scV_Q=t$LFzjinQ0lL+#1Q8&{!1eDK|r?Y&XIq@lz(Iz~l;6#0R z9oRq1>nI~KV)Vll*awwcy<#QJZ3ft4R8bnfm~QKHy0Ocp<#0}!9L)UMmA7BFgj5+( zbp6SyEH1fqYQ$z^BCnrT{a}U!s^tGoK(UbMS zrdxKBBq>7D_z(rndl$j+>)IduTj);Cq0j6OB>LFV(=(Y!X5oqE)`SN8u<}(V_e0tC z18Q&Pt(osi_pp-xfzQO+YyJ(;cz@JMqSv#s+M{0LPlxCN@RY7bTK@)Up7z4ZpB+X>gccHcp+pxOb7%^%WE=)-s?B7WF*v=9BoXD<|}vHxd!=J#uO zR?F@GiqC+5^Rs%G|Kw-YyNn9?D=-OU%l5=6iSa*n#Wy@e3hV6DLao{R5yuTdK1JZK z;@{aQF zJ3s?R6y69x8%Z&4Snnv{CjfEV0ELthyXgn(0c18lT0N zxJsfDna?lFjW>Wf4|@&ni-PDO@)ZM<&!39-dzOb2P3YoU+xG+9vdst{G%FSR9Dg?W zs?Z0?p@Sl8ZkR4^tx)w4nyKS`w%@0fp!3W{4F=bL^80T(1@=}AZ}FVfuO)pn#dISw z=OFK>49}Q}EV`w18P7hj6!Zh6B;~;;X&c7Iz!E^klyN|TJ(2{Pm>BgcYVWJlr`~q^ zNT0=P>#jf0;^U*(MK$sE8EWVHh!Mt!C8hL%KQSgOf^qTZ;E5snu@$F7U2j9AikIO> zQw+O7DsH;T+PaveRu8G>dNO94Pl?r`6x3DWg;{%OI-f5&jkrMO3i8mVEAo^*Br?+I zj}AI?JPiQGU{FC&YDK=C557kmezeGZCr3Py$dT1G(@Z8_Zp~m!r=fOGe1>4^l9Eh;o)bA-X~=V`I50p^z~F$Ce+!F`c4 zF8Ti(Jp=wX_zWNPANWiOlx*Ru^9$nth|m5fJ%d{Q|DdE>d&AbKe>inEnk zf|Mj;1_U|etNmh@%rm~>=kLr3xR}Ju(e(GO@A*LD%GpyZt84YlhGINtN^8WRAxxVc zm;qa~mBVtXwL~40_cZB-*K%G>CYqHuU&phY=OVmjij(>Kxm>P$vxQX$miZPKtFI02 zhFg~hfbhGM-rh6n=#>9kX@)=`TY&L@bY?XC_s$I8Yw3SFGY~lb-I;NO1pe&0`ae1| zd{O^fX9m#n(k1T}Q=qyuP>W>$yr#jdiT8Pj>o507khFRNu#vQCirzxb^>^oRN+yMTk%i?9^=ZJ0 zOK^8iR?$T6Mc9L9I;Teio0K{KzF!ZQWYgzCGrwZSK`e`S43bOB(|$#MPeON!>P3Y! zF_cvZr)B?f&?Ab~(p6B4H!@~kczb?%0I+l$p+}&N{vc;4F1M=s&BuQ+&BRJBr$DT| zSuW_VEyk&;Tt|F+uR_Q#AK~`v%N{M3M7JiL_)tWcKK;s=l=O&0ZQkxP`OiO@yHmL? zWEdJ6zY8GO%zrhk{_sPhfcL_OlMYI%J6^OEJ0&cT0FcZ<25SNh1NAmr*3)e^BIPT~G|RYbE=kR&K#Q z?znYPS*cR=0~STlr|Xj!aSbBar|?;_e95kZ8Zi{lA5CN8TT3*(ZZ_AuuK&W3{8KjZ z8@*5V4UIy1;mx$&jXzfkY*^~guf{PNMEItVRi ziJT1AzZLRLe$4`kTWV`8X%IJ99~inD{iy(>fDf`(L;9r_>I-{iFO-z4iLpL6aR9FF zQMU(nk(N~y(NSHg!EO#aF_}|+ftYMr2*fSDV6(Iq*P(<9Lx%LU1cIU2;i+u7Iz5k? zrKEVh)el|=bG)?b_`+YsbkgZE|AvtQd2njN($v6)(ebjA(=b98*Z!klJ51P4pMp-VLJ z5atxr0TzP%Xmf108?jFp8PLZfNjKBrRy0MBQ=>AlCOIf${pNaltl3FdShw*6-AcTL zLHsDJ#aZ%!AHgcLlZG%kgY4r4#}a9ji|}7OM%}Qssh}C#uGyi#DX^=W<4PTtLce~X zFv%Gbp&D#w0rKv(!4aTkn_shn=}sQoovSPs6>cqOnu8Gw1lOI4((z{V;Wxh`l7W+- zfo1I@7%7y8+uT!b87vN-ArxmAkD`wx(JCcy(jeeJcJbv4lz0URbvu>pD@|KWvZ!t= zfN!!X%BXi+$sfuE>tcJOZu2v9sJVyeAE;`RMoJ-*0Mb{136O^s3Vs2I#}3>v8Y-ee zJoXKt;T3CGIz++EL^OL@){3%<8A0K<%v&VUd-bBSjVg)%_MU9g^y0bgZS$+mTo(>m z4eBDQtO%d(q<`Kdh7E2QIU~}v7&$j^wiWS~PbBb4HaWs_-wNT_jMl=upkd>_YdC2X zz}y8`B5y+2*pRVEp6T=47Z*OFfg`n$wd4clVJ2 z@w#u7m`w3*mE)V!rf|<5r(Um?5Ygf@z?*HpcLpNT`a>ZeWvt>Hlz^F(mA4B;O-sjX zLk;^Q`1%^@hIilKo0Qpv*+#y1p-c!`WAQ>h=WTpKB`AVIIvR^S68T9TbqE!{$3)P1 zS=pRPbBS-w;u_nn=1Dps;OY0Y_CnAy_H1>YJ9HCct4sDk_6e~MP3@({_US_pK(v%* zF$yaW!MS&~MktBAqW6Zx*1I_jLGK>oQik8p?TKDCrPlqs<9`5J&~ognu8X1mzW{9x zJX>vj69hl6ayl96&yA5qCso}hUuV>YU@AAFy|!UY^R&E7*s3O? z^~}uR^nkME9pwmt#qn?nL{cn zf%Bk18iD46ezJ&udiVb#wC8+7CjtH2Gc`&Di`cg=M=_p5iRyoeI`Jqm$a0SI<2;_XhS&JTU>Q0;2&Kr zgd-#bb3jt18M~A%eKBCFoquG8zSg5N{?Hh(b#9YsA1|YZA8qVe{iW*%CD|j%^kdAH ze^!9J07NEIjMrb41^Bni(vjKhj&f?xGOEci9UOsZpl9>@C7EHz^(j`RR^}>8o-&8l zi7z~o1QAJ)IEJ>^{W%(|6DZ$*b(;~^*_UR1nQyQVABTE>(oXW&gZ*&s9pJNoOOz%gaHEZNxx8SrP zRtxfNp~`nanGxmcf6rzsyZ*9SW)gG@e*PP!m4zrfVg~RJp>?Mj zJ0(qf)X2X9dp=Vui;O9-7fqQ&B!`B(Y5Z!i|2Qwj>NSN{sn9r9iZc!q>T`Fzf=SPQ zE28Ft3TE^XW=N!PE_aPV)aZl>Hw}R%k4( zHPn_12J$Q_9TEJGOq=wrCx7{COwUspK`5Dk1Pqb%_4nUcn!9CH z)JxDWHVh&8Cq_ws7ncY*dV41Dm$1GA*2$(|W@|}ZjLW(8;j792VyuiTxxoJ~$Xd;b zKTgEdrL@~(?%HUQh#YVE8ozc+eJ{RXw5f7za+~?Xz76wBCv237Ov>M$?usJtK{B7f zj)TY#)AB6-gCEh7K1o}^jMmLN1#demYsrTLNv4h0aIhm#iOfW2?}afNi{NWQ{*WBwl6j>_nWj1%oC~;tOLdmL2B-O#p~_?2&^Nn^&$oN za_U}3ZG_?me-fdGTx+uPmp`-(F|?roy~2?EhQ%&cNb#Z_Jh|@1I4?CSLKj6Tq3{DI zHAAJ>xeW;0ackMg*l(s48omX6fmSqbm0A5yY zMtATP^jrS>d$OI)Tu64TOj@X%L!MuGtD$o!uO1SEUH-;z(&>$YK&f>aX6@8xZj6H< z#>h1Do|DMjcc@iBV$PprWTWTG2J9*-G$|ZIwe}w6cv}mE?A$Bgyeloxdt>R%%kku6 zBlBa#Dn|>0RiAToDq)nc`5v)e!Ea>#E~blQQdk^PVE9=1LxjVDV7^sHJeb9JCer z|L}GfQF%q(ny7=jyA#~q-3cDt-CcvjhTsz1oeQ<$3?`@3z+K|^C#vSlvH;C81dL1P=4Zt|=mj1#D)0FK zf<|0=HS&%%iR;4x}PHge9WtFCrU0jOAz$z8=l`#QUP$#IH^db8g<>i+p zOKgru1HO>7+XHwog%=He@WgA_oUNH?S}t%K{b$SqaY9t;7o_-VJR1bJs{5Y8qxj76 z3#*kwedJL*;kpVFlyK1d+y|@8XOVVH({&Tt7PBq9P0*0!dkJ@<%0zAoeU2!!{fR3?0UJgGu9``U8`#N)qC?{JnnUcc6TCfE57%3`?&8Jk{r-+ z1dD4nH14W>K;EUJF4b{Nw@0`ug>4abw*0T=JB`tVNdU!h|tiS+A)|*Q1?SSp=e<4uquybAA~Jz6M~oE+uv6?!YPk^Fh-ZdppUS}}sk3r|NAr<& z7P$^QY>_Z%GsVQNR`o-qTvc_jhky~J;Vt^VbF9f;L!^1}k(4%%9u0ko8MeGCyJpp* z3QBFh%RK=MNoPpm!JeW>Uap8p4M5Fr&iXEjmE3OY-`N-JfS=bm{1^-`J{kko_b?GA zMQ94xF0pkFrb!VuVIRn%F7@{5pA4!hSD*y6akd+E{?m~1cwDFVLzYk@7qDl~*eJ;_ zYEwf$N$wdntAEsZ!OBr8-a2Jc-b8SJ9gTBGGGp+&i?HpxfT$UE$4zy#}A{ z9HJ0X5%X*d0NB-o-k#zE7RIf1>snsBv{W&Fc_jv|Jfb{C%!AHdoD+lwk;b}kL(bnx zP5;TmHfew4VIT3LGAQ25{Hk>%h;jV#eaEKz1NsSmpc0`bGu@tE;y=_lC}1?)!&^Wv z)B%#ivNLb4{~d@8A9U2m{oewyfO{82%SR%Xcrd6iL|1U{ra%5%_Tnwy?jW`gTKhb0 zEXB(s=aRH?i9x=GAWR#UEXMzKxF|9w>3<8v-ZHdO@S-9=bbs~|8rP|q>-rAsTW1Ii*_n_KhI|6^+dja}#%3|}_CqceN~g5jpl z#UV@5*$$zYTC&KUnM{t$uq$+mQ%IQ_P6PerUesFHH$J^1l}Q3USN)4Wb5`u{Luzd0 z=i#+ia*gcP|5q>nlxtZJQ?Bx7B^0N|}-v^OoE zF$4iyu;eroO@dDeeCMfg?LqTr4t?&k>XA)09;T)*8UrZ(I(Ne18JZsg%QZ>jFXMww z!Mvs1PX|{NU+sqLLE~o5@%;0f5vmcTMMmYbJ1o+-2q_?-U%!7g-5Ut7=36T$^O`rp zTI{CQ!;WFSg=||MPySEip8PS^)G$Fr;RaAbc=7p99=?$b)m zy1Q}hDSP+Q-C~j*k`1x}7!{lPK{E!f%2~V;-6jJ@9^UagPEFx{G{7J` z&M%Su)c=ma{vxvepApzHuH+r|NlSa>hs{hwMDY7{wuZt#UG-#(22VA<|0@HV@Q0n6 z8gfa6WyrjvZCwl=GBJR-bRt8zqsq{jGxHym#n^^KGt zb2b7hT)EP>`d}9D*p+KQ=--;RrBh3gR@n==ma^lN^DmOKp&Sitw5mXSG{K2?yy`Qc zb`3e^>eY^Ut{LC7j5kt-GES#cNxqm)F%yeD6D$3S%|b{$MSV~bUNf{%0-OK;hQwC? zAhCfD6T58t|7l`>kk}Cazewz>-~XRUY~cSiv3Iv>{w0YG{Kdrnmn1gu7ZdwmlGwms zOzeM2Vgr9MvHvBB4gAH#{+A>+@D~&NUy|6sUrg+ONn!(kF|q$8i4FY4#Qv8gHt-h{ z`(KjSz+X)4e@S8ke=)KDC5a9E#l-%XBsTCD6Z>D1*uY;*?0-pO1Aj5G|0RhH{Kdrn zmn1gu7ZdwmlGwmsOzeM2Vgr9MvHvBB4gAH#{+A>+@D~&NUy|6sUrg+ONn!(kF|q$8 zi4FY4#Qv8gHt-h{`(KjSz+X)4e@S8ke=)KDC5a9E#l-%XBsTCD6Z>D1*uY;*?0-pO z1Aj5G|0RhH{Kdrnmn1gu7ZdwmlGwmsOzeM2Vgr9MvHvBB4gAH#{+A>+@D~&NUy|6s zUrg+ONn!(kF|q$8i4FY4#QwiY?3ecwA5G^KiJG(b)X-(e{+bsC#hP+2u~Z7`@r-9B ze>)X7<4{NgbfIvh{m%6ftqBb)D6OA1VzQBa5_{@G^qQKQ&A*l_j14*u#X1Bz1<|kU zmji-v)@aTFot07>n>cqgkuL_62*hKsV9aJ>-_Mu%V^&c}OBBf*qmcR4Z#_1F^W0MrPvb9ibcPK`8kFsn!jJ9L72_5P%+N1+;vD^4hPBbkSVWC#azR%nrq zQ|#yd9E?)TZXI<}0i%!jGu_sk$Wxwq@biu`t;V>)z6r&u9-_PZtmC@|18jkiD#pUW>g zHD>|KOw(veTdw%mX=}0zj7dpe!IydkKy1u(ZmAnz0X=g7k*3Ol3`eHSN&?cS| zF!lYq^aSgO>bFz2i_%``FbHZ7;=c#E;TM#@L4Lnj9?j&u98_PIB3gJ};eIDPHQibo z3)$BvsuT?hFnUx6y#~XO019xxXhFLBF;fgo;55W)90eKpian6%3K4NM$B?<|+}gB& zmvj2as&y7Sg`x8Hfus9JHxZe0MxAl-alFetuW625qCXY33OZk3bfzO7HniCvYitjW z)qhzvIs|S8hu)e!elLWvuF#VidR;>oYW?wmOSuRV+*qUJZy>Y|%T>JXh9uxI*Y*2N zB_4#BzG*Tu4AwKvV-l!1?Cf$z@l-Gb??Ng6nVfZmN&=#o+;xPiDCszIXQ70eW((<> z9&pFi>1m)d2DVMU3(KVKp_hXNeIy_=d%X?+uOAs^oJLOhRBX6|YltSE{{714-*!iE82hEGmUd=IlPwSKi7!b95YSKU5o! zumgKSk@8d4z-e_3t8K$j#8JmLm1o))Xydvs1WTcz?Hm z{dW;MKqQ7Zka$ZDt77@Fk&R4Pz);OoQ*ukf+d9`u70rVCd(q)fo0b3+(t{$Z=ImON zc-n&%tO#)^O0*m%&rRc>VX|94{P?R0>P-{dO)FZ3htIi0To{WvzAsmOayLuTzq(n) zY=r@Dh#&K9!C4BoXYUs(4Zt@YgM+UP7Y6xbt1|8Z6W@KYL^UTQSJ#_$SYMH4g zLC+1vxczKD&hP%(Pwl++(Ya;Wr4IeHv7riP<}W|oIwr4Yki<#?`tkcH65MpoTjZ@Y zaAO%sh>f1!e5y;cOM?qy>D^wc^~Y7neFGDHdpF>eccLWAST;n%t3A)4t6kIi4o02Z1(A5jS>5~@rwtJ;KVB|a zg-)>6FME_mhH2#;hr(?hr)=zk2pUHuZ z`ZE+XT=&KZ4u2Vq|WYHWpQu^Ww?_Z&Sh z-J8z2UR=u%dF>PkS|i4)ElcFg`*VTOYFS(KwgwM=91kf{zDbT{mRS=y+^JA}<<$=q z>Bf0*4>LIan^?vFw5`<$3hSCJx9+l#11Qt0lgi7*PMfYy(7u%GI{6l?Fb{Md)AZrO z{Whu${jjYQoOpxGKyN}%6cB=(p3!Y;?VWl3^AM)FZY*xVfyybDiX&$Q{rS4;v=#=# zBh;nDuQ3UF8Uh$va?WDrc}0iCy$M3IRVR+;+{rh0W@ISLDYay(nzuFWsi7Ng*-1-0 zwXvHW!ebtAA%%!iJ&DMxh}j3a>~&wjV|hbQ(rRtxnpqWn4QDGY zK3gS-#jg1H2%zfVm4ux zq>Q6pQ%X>R7f@F>w?el&g{f^dOrX*TsgwHEb4VC+y4%Oj1`hpq~g?fKZRk0^ZBTw9AM|_b| z*mhC6s2ox?Or*fNqa-#|7c=I&-t+1&W%uAnx80Or+Y?w{mk>eG1+=#5$)QDBsUbeQ z>`U6AX7bC2H zn-*ZE%!Yj|t2`3quS5(J;1sn1qoto|wtos&F)YoY+EM|vp*TOd@e(jPlgnD%Y!HM) zQO$fl^%(X-?MnVp{_=fv!-GVf6;IpbA{+4p_1YdJnWh{7&Tjvqd*)ra@ z*L0nD_%RIUc1U-h*%|iOGhl0~_A-bt8qV#k4cDDj+x*B`H-m{aX=EbPv=-|oLn`ix zBy^Z8af!+c(82L5h`wfKM8Wx_$CKCyI|2u?=oV-c-zv%j)FLHJF+q&!$o2=IM=9a? zv6Y8hzo`X{kg%paFv6f1t{k)FrycovIys_=#q|#lfo2E0Wi^jrk=sDiaU4WVedaF=B9J4L!Wz zu=~OD)IX<=DgFn1M1UxU|f+4L30u!gA3lJFg$B%nnerE*C2(d{RXR8VBx_ zxt4FX29sG`1dw&|bX=2zxOEsl5gSp%LVvK+3kFWd{6%@2W6IG%<9duUzj63~M`o;o z!CONn)03i60?HIfju)?FCde3^?e#xF#_tvzi^HJ|tL|K+H%{n>$RhHZ<_i%PU&U`j zkhsxMF4e;dLM$j*D@rPRr&iFX<9B3^m6 z5|AD2;Oj*;78%O9j=mxoj&E2Xc*RQU3mN^B=Vo_pAb%~GkIlE6af48<(1ZZ~O>F55 zS5(!Lc32?K19xL0_W|@dW7#m&g6`(GfFTlJZ1iK|BiWY9Nnki$7zjmPG;+ zH-hxm52GO?236P@P5vnmAyEf`t?6ERoF9XOgfar*6-_bzif(-qk+g}awQu0qno@`;t3&Y-HwJ4i`nK> z$qGR-crT9}K(^z40LEkOWO1=0I7m$$2UeaO7|bqV`ZB5%`J>h(w9iXbGH`g3@? zrKokLSK@6Q^Cl6mR* zOxel+U|=lIab?wmIZBt>%5cSXe(LeVoZn*kDo78OuY*V$`}9`ii0tE5#1$A8azK}o z+Qa5bkQqcW?pw=50@ZXLg3;y4p*xmXh1ui)!V3wPSZVy`aLFUFATWNiiT&vZFur2w zBovI4h{)v9pA$Vg4XHZTYk`#q!NPHDr-)6UL zZy5M6d&FKtzYJWbu+|ei6%GppxPM?N_%BtZFYe5^PSPCb;n3+a+cjBWbQ0sf^Yn zx8`9em3}gxcBN2;3F`^6b?3nz&GgK1@TW906Unh6O!6EL!*V5K-X!mWRr`{6>Ic6Ewm65)Bfd$J>wI%uvjV2;yo z{2hma_%$bZLA$qj{s{gJdG_sVvaNW-_yi!AX}jFN%q#O2&=fGklT>|;<(5r9Hx-vm zPydLpLP%=W!I+dGIC1KzCoG$IqInI7lwzHWx4CzwCLeXBoD``K+{=+4iSkB3>xbE- zx&FlS8UImqHcYeZnw0KmCv4Mv zD0q2O+<98rmu6JMoMxxtl|}`R+pl0cZCigrFv^<37rP=Dp+cir<~^N%Xm1O!CcnRX zQweDgO>tV?o7SQTCf0bF8?8;%1;5ds4ZA&Nv$i~RBz(~mV#=>D#3A&@E|}4Uh&a1m zeH^wVpX|a$EH|B%Rx95Tw`@NX>#{j)PL@Se_}{9hCJD!mpwYxET6jtTFu7JANt44(7RY}V==5WoNNnfkz> zhlbCvuQ17r!Ta1bSmP)Qa^1dZI@b0q?N!L+b_%)Ky{21dAk@W1ek1`NK%?36 zI72Ep5r2Y(en| zi7!t<2|{7DeOnmDYr!}BR2Iez@bZ~VZ2Q(`n(eaSw&kr{W}ZF^XLS2rqw(^5b_#-| zj1_aW5yE9k*Z4*?1GO^%!n-5;GWTqC1pbd#Qk7uIR={yf1ekBp8g|5~?nn(e%-f{T ziXh}m6Eh$A^EczBjs6Yi@RJDiQa|19g`8Q;zC2lbWhOkly1PK*X%##=z*Jt5YiduU zfCn}}=!jKeP0~$v9{-f-PpeW{mVwAw-1WI1A9Ed@XNo@3DHv;1hgR`$f^tvIG`!$j z_&eqN^19l)r>177I>req4Yu7%6*nFo#)DWX`DVa($~9E#L8f%(bvXARRUO_z6+icU zuq@mFfoc)Oq2e!D)%`-$K>l?sMV06w7&jJT<|DN)WbAV9*`YY0|TzIAe zh4MlDQ)kiHOV#84UT0Hxyh^Hz>}L-T4P$VIV(`&v?Gpv{>9dHEmdo$qR)K1x4mP8J z_3)jhR<{Xd`}D}-?`6_h?ZCC*Q}UQW2R+FS*(l&qXj6;43#Aq!&It;#R`M zJ?o+JPjk}AdyVK58*R>wlPVq$Tc|E@$cpiJYF2oOZQlS>#n1@(eQXC1d3e|_(THz{ zy{IgS*n0<61Bhru8Ea8=rx?ctFPzMpm6-dgttnnEzWx-)S-r}b3qkl{yf?d`}T<0GGj;312E)&!T4kLsC8(*YP2~a|8H1iQ|_agY|OC3R$$s%s2C8 zFpv0S&Y8@Zy<~T5$e1{LM2pj(dwdhknY2Z@)_~mBxup?eONqS}#AZDESKRw8rR+9~ zg&1Ci{(7m}8)wswq8{dx6c06gH3akag!g9xOZC;0XBP2vfE}N@pW_^d&a^GPm51Wi z5LdeLpkfJkxKmI&#{@e^YF< zVwv-&)cu>y!7<1iou~o;VGjAP0Aa;C6H0w38|9G+w#y2ab2>l zG5`JVJE@Tf00kpya~CGdFRX9z!MtxNpu)3J8$J`?qn3K%rVP2UyePExbH z(B83!KHn1VPQm`zt1yO1j;Sl>&HiLt6w9h5)tUdq{hcaY3O#TY%jBZ2!0TZp%!4#- zdt0cZsLQ#|nryQ#o{OmJX0p`Fr}yF)KGCmMy>4yYTBS%9gBzmHrC8T^-cG!fWS) zoystZ(t_eXaDC~3k@&$VRX?)IxN{^7l*-t@Bb1CNm}JC(dct)|wUr#R$0ra8NQ87- zx;f@YH1BIh&p4xIa<8m@Ro37=z!dkM%!m4Z5b0YK8?>8}qpIxCbiphMORrRM%oBE* zplQ^r2E&u#s@Bzv;p)CbWPM%b{`*q$7xjK87POVdS@G+S7N7AZ6C2*`RPD|zz{i8# zdO3QQOY>!68a{gc?WQCpyCHXMqNg%*9&Wi)V#!WHgG)lm z4uL`|AZ*UyCwt1r%0h~?LxzP2k1D}>Uiu{`sr>N^BhwaL@>3d1b*WbArE}G(yTDCe zu5)8CohNN^>u95i&YfM3Kj&0zKqkfQbqGnm{))d<)&@aptH=OR-C7IidX)gl;FI<$ zO9uF9?#Xkg&&e0p6dPydgWx5?F^uoxeTP2j>#)-!RIn}y-zL*v6TB}C-pdCK?JiJS za&HmMz+}VHTlhA9wC>ZcUIIu4%17B0tmCTka*Go9YK z;Xl&#m7__j!rJx0n@q#cM?T(x>tIl>osJI~-umbn@F&}qq2K~PUJ90H(d!9g=D?;r zg`Q~fW8SEozpmCv2?|YoBhie>)!3iazm@Jw@Q*kpM*J|tY0CURJ*`*czer|rjwM6f zzuq~NE$w-aT!bNqRXy!IKck!s3vKr${>@Uk~R9g_PrAHw#rG~V@m z^|eaRvvN^y-p3kfU-IozUnb6%&{XpRPaO0zL$^P+z4z>OpOlQ$oeiHFe~39njch*o zjviDswg7fdGW#(qktLYBWJvtg1FfiP*AvAuTncfprW;CD(Q@MD=8)4?c}=+R(*z^7 z(q0GOgWvFS;9S2JUl&aPyMBhWeMSVBpHp3{(X^4> z$&==PVB=6gyQO4a;xvj8L~rvHK@RADGA|eqQ8A>ykyhu%e$iihE(g<_-{xQMG7`+j z(`^#9LONK3nTBeWJbPSoH@fz*{&nkPuD=qs0OCEMynG{jSs~73NW6teoS^_ifM(tZ zaW<3|-lPar_#4BjEX=zkKxUeYxY0zEQCp|_mgO=$m5dQqALwW?8BMSC-@LN+BtVaK zE{+i?$7p|k9I#R0iYzY#&sS(2MY%VTpb7Wqs7HM44smO+YAkha#hp+Gd(!`ymH3#z z5w&j2vj3Qss9mZUi5jU9ebNp`TaJHA%NqLlj*tTf<-V8hrNd{OkFM;Poi@hRxetZR zf;zHJt&Xr_)<(Rx6m8ZY0O>!Fov&Yy- zgIy@^rdsbJC4*gH8+e-KG7oMDyF?;{AM{M_#@Iz;?6LeSUKoAdQMVfFhVEamahuX>eXJ@Qxhs|~+@!F9 zok38hsTD&|jyDW`pxot~Mo!UG=0^~X^y!9MFHU(IYTG%Zwm8L`f@X#GHkIjuc^+PM zcdKN~AizEgp|1Ne?W^8gXhDB-ni=~D0;qJRzt}-xPBI7t8U{czL5-5ykz;F z*^oA=#=7KYC$U|l&&?m6d0nzRJz7oW)1ZHTZeJlJfbvJd_u;-Xz(Y^`;sv|wn#XVd zb)Zq$mbe|NBhrf*a_PqMyo7FCCZ$ksrgMtSK5D!(304=4mqp0_xaT*~yzqN7v~3rz z+#KaeiGKUz!ySMi+ac+h75p=w7<%{i`SOSrZu>b=1P)plD zX_#?HX$@$57DFap0t$9`$;@bO&^X`J*Z+B8mD zP&xYfL7<+N8q#%|5%PJ?^t?*p)-$9XlCK;xj(y`WD9ufX$JYH%N3xn>7rMo)m)NDJ z)(Yn_44cPZqKcl}1;B{*f9~#i} zh+-lEzrMdk6*a>=a(+<3m&rnbYTHM=qV&}yjcSdp zaZH}u<}-A51bRJ`BfrozbfB9T$EY-pf1VP?n$k=xGmemk{)JSpa#2>0%mp|hOrgP> zpu2%0TdTVd^&e4};H0Wuw+B&h(-NeR-ho2RoO_* z*lpnk;+*8py-7$&xZOA0i)dYuT3XHh{SW-5;P3ZLZX}U0!XdwdriE<>^h8Wd^$!%En zH%Nuf2f5d)I!4(J(}EBx znE4yJx@+WyFO4b;kHvIBIYG_b=ZLH#y;7qv-c_%cUfcqhu3^}8^Q1!*^Uo-NfF1?* z&+Wlq?^8lujosS>$_UJk%-m!hh*oU@&5FiS2m=+6`0+qYxWE)^G_>{ zAHXeo%!INU0#l=WY&ni=DWgdnDyzrbzl7PB`;K^z68ZDY&?H?V$s+r@G>LupaCA)f z_0k9As08fP{BbBdgMB*r8~Z&KqPN8+cw7S?V-M%baLrGv`eVe`ufwl;z!_TR>oK0a zPlT=06aUS#Q_RgGzAa%wwfwXdQeF6PC7sPUk~Mbvh!qB##=DT7gL7t=yzwMnMv_xJ zv-dA|88{EzBy0LLzOfBK8um!7&EQ^l39l!C;lsU@s_kHccp|;`UtVR0a&N6HgJse) zL5Wm?0X3nMSwCAw`pDt2fUZKv%Syf_{5psg(6J7*EyuYqU#$iu|P#Ub8^7TC^;lw6iaw_Bf%K z&F6xbiTYAW^1DxQvSnoExC_5Nu6Bygl#iXi?6@z(g1ebbWR0uT1I2?L*itx1@xI7MrMfH!C_fp{yS9ViEutISglDg zNT-28c`lB-8|cXM&r>;mFoLG^r1RECRc&5hd+?c7*;k4_#4e->nSEW+Mf*J;ReF3S zsraf8k1r&JRxgrHv_%3oeBhsjx+aXPLQI3b{bmrf>v*uH0xN%F1>%%}2InzyyYgRn zM2rXWXy?LP+GLgBtWU-1?mG(IO3D}#ek^BbSs`IJ?TzZ%f*kAXP|LN=#`0_@4?M-T z`!ie0DJYQ#Tyl>#HAgX~kAAn7^oOEL4B=i13g))4;~-Y9bfeU`_@2Yf_a@Q+!MlA?zE_ML^ zA!NlYH9bPIx68ic$4kh!pcQs^U1c@Rl|k>pQm1F|oCz1~f{b{X#~w^n(QIsqoCqQ% zhs8EjiWO!2P;x}`b2tbm_nKM7MUZ(MhwDOWnY)x3pH`em5w#we>@iO~5uQxf2-=H( ztj)r0WS=JPTuR2%Gr@XnRA*HgJ$8WMG=54ROGL*c-Lq0X(0QxtyU8|m5)D9Q2xTWu zBH55gS@XAC5m!|bl?)h57BEF;1z_3Qc+v&K0*56F4UbmEUpKc*Iw6pwh?bG5zGXKY zADNFW$c-4Z>&te<#12x0IF-(5lpsVF@MimMMjL#_TN80>x=ph%dkMO0&4DCoY)#={ zcqF(?*Zo4v?4=9+mQije&+Gpz;-c)2r|ZHi1B{agg;$5={|cwJTZJ9a2cX8Fw0VpR zQ@`K%9=?oVF5`lxr3>cN;=1l4?K(CL6e0bbQS|4jdkW-uetyp*)u>Mz;*i-0GzOZ_Yrt)H7W0-b zvTwATh(Bl*$8~6^*Gu`}c^!A7$76$gmN^5Nx7hEMInVg0OUtgzgI+<-2!+0)MhBi7 z-6wiB>e-GnxG%EF>yzSo+t%{0!aeI|SGrk}cU zT%MOjigArlL=?XftWc~Y!og*p-;*Mb!zi-K2Yo0f!(EK0cL@c{Cifc~$Rs(u8)om*_w6@=LFb0}TX7;?N zt+{_-CBiJZ7$J$d-EP|Lqaem{5FN7?lNX<-ez7!o0#nFF zOk~icS1c5|lj@8SOU!Bf?)pyBmRtbq7khJpnDqu_oTF6ZWpY%Bwi}z!1}gF8nJ|Yq zNkfw^xnmX$Q;jh3i0%G#1cl6;tm4vZRPCD=5@{Ou)P~lwJ6XVzvh`F5p(;ZVs15u#Y6awZdaT}zMJ|n|cfq5O2kGN{ElLl7IB`*c?UW_FH zB`kM4dFK2z{|D2@6_^}+GK=$t4`d}Ib)s4Fh8Px=g>K|s!Sul<_v)+A7-s#BSU)#) zW{47zPMu9NcomZT?L!`QfDzS%Lc}LSPw>LJtKTS#6a=lAP*LRL+Q?D#V0y?g*Vw!M zh9jB#62;HdkIg=_M#_=FHtBiWH(N*)Z|l^jq9Axaw#lEPP-p>pcP*oNmfNZ0AH@aZ zWCamjgh9uu@K^yzOm=kI5k2p^;XR!fULBQQsf}|LfPek*XmUr=)?|jgXXdU)|HeHD!oVZ6NZ|rM)b*eD zqoY6CO=ntJYr_yB$D$wu$rJy16drY`k!Z_+XO6gc^Mw)%+yO73Y`6f%xHDhMGvFC9 z{8JiF?sCpU=6tx-7&LwxGuRqa=y%f(kM%qw<_xpV6A_a3 z{Hp9iu6u{h@IF{<1b!hQ^A|W5GhDtbogVjY`W20@cz@i@x&U|#=$FiPU?~*-dwenPVXpmd`#~Ya`wHgD^Lh@|J(Yd&qzlEMI6CyJnaE!GG>x>Bo!u ze|ui-*jwW~9|@Nw;0qoAYoB`}-b(0PZFPItkn^@y2eRQFw9eeo5hj-#>ah!VhTXUC zgckS#JE3301}hqoZwb=}%zD@#OuQ=j2qM&ics)u=0o2D`THL-WsU~~ef0a%@i7RSL zUlftkfT%0FYaW=<=mDbe?BlDM<@Rq=3uE4t&V$d_uX7ytfT>A(24~TqQU?Bcyx6*} zaG8v+d-qJv4IaT*A)i0#gtSl}@5xmt<+?lhesT6h0@G;_w)c+T=pR^{HO1({4t}_oG+$xm+v#b=5+wR_;nnBH3o|BUte2-XC~jUwLJ2EFiiR zz?@n(Wwubp{jHyHFq__%S-u=qzA4^u<(ikT`)x$Eowh?_5Ev?VMZaUuUr~M%Q!ssP zTl`sJO%ixoTjq#?S1c6$NB$JXIw3!BU@m;dYQj|OiA90gR!y#z#U^mqRP<`6ire-Z zeicwiM$2j1_k}iSx9vcF8AZVzZ&#FRc~4F{%`yFiy12K73GjF~zP|bm?ZR8$iXLd} zbd$`sk4g(%sxFJK1`+oYX4OdW67rWM7;*4Ws;2Qu$;+c^gx0xsC{|V!LE(%X6F}Im zCufX*j`r>H|2D~V(3*)R^?=n<^guR=x;w?$&5{+~%O<;e9sk;F>W3ayt&i@XuZ$j+ zFNq%3%1ej#@vEhlVPT*dktvbnO^Sg$T-e5jBLf2@qa!c*Qle+1=7y033S_jtUZ9Z( z{CRrGKMws;$ z&Slq5EUl~v)H^;!6P0HarB-X&I@**O_?tW{X_A4)@6$^lUxnkZzbcvx6pgQ%ahLcf z_3c>dZAoX&$-5{%qsc8YFLSOy*Drln)Bc(Q3|G&ZF)foYPeXsh5shbv>mBAIQNgIzM6a$3#oqvEOe9`JKVfCHq<7@y~5;r}4@m!U<;ZMAm0Z>zYog$(hz-;o0O` zZ*b;y{BL?uxD~bbp!k(FTf~fzVvMeOcqw%##!at|XTcpOca2StEB6yIbXs_mDfPAH zKxR3gp4^*sd>i+gW2wy7fO(iZasRDj+yZ0bb1e69A6LKGH2GG#x@p0%>!ot8)y!9& zb{-*?_2F7Q;(LU0x2oR;!fjxx?}+#1;~#?v$Fq2yaLYZ3LwATNMpN$XAo`NVjnte2 z^fvlc-D}-h&!3*Mh$uZnfrrz*v2^zxy3+GsNGCpL89?+Mi=*v+&vj+=d~UaJ^$V^4 zqd#n(;B=&a;wM96I9a9|h-5!pEG*z2Q)0m$r;&1ZZq4}i`Gq$({~oJi|L6V>_v?1c z^s8u-`36b`D&LAjaqo-rH19=@n_F6?dTp+52hm>7TJNsuKz8*?@?Bqh*ql`f?;r6e zpL(=4i-nkS>>)B{E?c3p`Hl??fRaC-VlY<@#>61_N81hr=Wo_GnxWeZt2Tg8wMio6 zTGwL=tD*26rtW5(s^BmPQu(j~u6SwlG;(o~@VmOqqVRoW?m;FD}V8Qq%$T-5K)l@aP}lzrY?=t$c*#t zG}sbc`HW{v2!C*yd9hK$jB*HqwT=pVW$5!WG3@(a#yLTxl=Cr8z=3}w$~C`$fmFir zQplE+M47q~f)d|~bb%mk5M#arSLvJWa*!~6ek=_Z0l;K16 zZ2d!tYx(_xwQLXW^aWO^rTegtHJ=f9;7;p2W!i~((x8*CS7k14gyQZ(kC4DoW&{Pk z$S~P%77(gupwE7hwRxFN1Tsfpu=>9Wu?tiTs0-=)u$V@w#DxMhl5(;Jf#$4dY^Lt9 z?#KR8gbkY}6FvIu0H_zLure$A6%sjbc8Jf&y`cjXa0E}wJEn1-LQzs42MG=}4G#5* zlrJ$8NEzWaUj=<1w&pIv_~0w#_u;;ZNnREYx=EaHV%B98&~DpPW;kKS*CpI8hFGrHPS z68G#vX<*@$K9U0#|L@$qtS%%8fs<^49R>R7qrnE_xwhJb2kg_^Cih>L$hE2W~9r8 zEid5yS*tj6qhchTW2JG|be|#P>BSlsianwkS5oG=xF#!h(W)S0o4GjXuui<+7Sy90 z@@rE%)Gh@7j<_?(kk~R($Ve0U=9XzH^ciJ$wSv;W7E{V9=1XzrMAadp#Te+6L_W~K z^4zo;=@L_Q@|CPzCu%1OSB@7Xc+PDBdRcxr9;=y|BM?t%}0o;5$nIJHs z8&S*{b((Y{OgR#6PY_~+Fhh0!tjLgW@8hC*67y3KEWaIp=jl@@p|JkXTYzW)LPMT< z3=O(%J~xBP;Oes(5}LE2doY|p-~oU^fBBV_U4=?KZC2&}Eb0rqx)@j$%%vuLNBMKA zdatl(rvEsoCb>n$ipt_fMXOiIJC2zYKNV&LFZSRC_~|d^0bki!Xi=N6GY7}s%k>=e zMZ+-CuX)&e0(s)^x|AwumyrTrPmXsS(#}4;#Lf&4?87|c1Tsf42eA?;^uGe=z9#-q zO^KEiqsHmRcN)1F3Rtrj%D;p;MLtGo@t#9}bD0)CrJTi*@8T5gU9v5^Q$ zfSK?JiVIynebT{;!l8lMAmiZ&wQoMdn)dx;Pe9CYS$*9|$7}J@zZ=wg^E|fR`?9&+ zz(VW06KvL((OeE;IKH^@f~RE_5n;hxL#}f^*qR?p(him5k__UG&I=?3WfkVW$;%G} zb&N`(G~_f1x=_H@!Nl{-&k55?rz&X)t+FFNs=T*&-L80j?5qf%`mC4Q@-UdeTJ@?ciO~v85 z$z6XWrf_I`4ucG_zTJ>2b$zLY>HHU@7eVyLUWJeg`u{rMUq-xIrKyzOH~U&XqdYNA zrl67ju>Jk@ul=UdclR9d2aOWE==biN{>2OW(l7&e*?0iPu<1b>xVIOdIsglAWBerhQL+3 zZL_>(^+3aoFv#-}F4%XUNLz#boHxl4;1sEbKsxeoH?t?&1(~Z3llMCf!KCG%Y^m7v z4{pCHh~{EQzr`)z{9qG?B#6J;n_Tl>0vz9{n#!^{V$~mIV7MFwVgai;t6tPmj;6p9 z5M8WzLSvCui`31O|E(wlTBRZ^-@ci+xK9~Dw?E>Frdu}c%swr$W!)fo!XbNuhRhj` z)_wJ8!JzW-Aj0GjW`qIXbx>ilHvC5peZW+)Uk|;{&mx68L9@4D#0NSTftt>{zlaoKdZDSBvw$Y@f@J^oCtMQ8@pDNsQ z7bBhtbvw2vq#pI9T^7ps--{3*b2CK(tA$x*xMriejzyK9O_DBoIm!{Xb+$LL1W_S^ z8k^mRqFwQgRML(W4m7*TA09V##%1`M@tZatvfbVmwx5;_Wf)e`W!Nfs05ZtnF#E-I zr%jqq(MK54S>jjOB9uwws$HjZ56w+!@1Ky4BEZ$<NdZ z!}gD93>_~$Nn$$uRK?{Q=oo%zrL!u3k>}T|%;{GurJWSJM)1?L;m49( z%L(|pWLo1@`FU5{f8(w5x}4Y5ke9t;(LGP*Wpmr{vFQ+ZkcQ<5e_yZ>=}}E0%aNiQ z=}Jg3$bz{0ME6Gh@@CF?6Q=9c_QpA|Qz^CGB}LB{nFM$_#f=gPUut{Cn#J|VW*67J zTvV6Y@vo|1Ru>hS9!-`Ew{4_Fm9p>6fN>G7J`j4_&%cqXgd(1r0`YIwHfFfwzi6kI z5B1z3fqqMOGbLbRj1-nPL{7lh9c7)$Um?_+xo1 zFm$GVp1D1o{~9k94o2ck)5`3E{1GB+maNpj_-gAmCy>Xwd)lSwS3RJ!>qK&kbE{5{ z^McEvi(;vM@(irjL!e^)<=OHS1Yrpy;%Xg)^R$ZLjZ!vjyBCCad-_HG+151pfJbTt zPvy4Pd2=hp2jK93um-~N zc^KBQb^P}fcdY`o0^wgFccg<;WC;`xnxA^gu0AUtj`wm^H^eHWI7;HWxJ&4MQj`Ms z52)|+iw*C2WwsqTd6>B>OxRlY+iP{+$;tGq64%U*tT#{M2dKHtyH6+b>tt(0eW5do z54!UeRk}~U&;aEr|6W|NhyZqyhfnFZ#FJI=2c9J&uJt7tcCHFp-E{$aKfm*P<1y%f z*_Lg64dlJNc@A)GU!(w#x%>bCXKkP~NiYZJMQ#58L~%2bl;>a@#kY*~Qu(0!BJB}w zre4ly8`*6l*wZlJ`<*8nfC(pt^O{1Jl~~>HtLF)d1;AlsX}}8)#iHWFp=tE> zd<53&Ju-Y#2A66x-@s#O?i3FF9qtXY=hG?H+8~(Udam9_LTqzBMaGY1c@U{OXIJVI zjUR4^2xjmMhQVEVip%Sohbe(+aJ6YY{;;|do>$9`5rH-6d!{VX`+AqXxF=#pJi z34_yrjJU5p(%|#AzTigLQx58`-;9&(Lc_aQ*IoyDLfn6a3%fnkXlLQI`dN$NFZ>1N zA`L@bvzC0t5M;vTA$(U7s?f>ych<8c2G}flM+?kjTg+nl9}5# zNUvzb*jb(gsQjhCNGZifjds}n^ z`AW1xy3|V9!r!=zDhi$La=P`d6>mKu1oF)j^?(#7~Q7pLYg3Bb1DbldqW>`N)qI6gzQddvXM=GFlLl=ny& z#Ra}weRhb|XC9NphaoYux%O*1+NXwB?n^|E|Aft8UD+0pmtfmO5cHf*{qQ;S@hpuE zI7rPGk+EsLCgKDm63^RY4Y^H{e;Nz?VT&_W>}`W^vYv+5xT$gNKM*X&Ua!IYF_S$l z0r|GuOtcv5Q*K8~)n))a-O05lBNkayz9;7X{bs&S%A;bN5~hb6tK-MMCpy#@Q`VIV zvyw;F9XdBG{0=jZ^FX@jxJ0f0cW`eGL;5xq5N6s2^<;>9A$KVo(WI?-%G9BrX8XT$ zdzHDW_$SY#1|EYK*s1>-3%*om*YeRH=-gXn?zsNQ0E#6(KXS!S(Oh%V$=t+_s%CB> zDx0f%*eYUv*L|rrLz4-3lE3pB;&H{}kgjhax8*j4I0oq}ICyLyHTN+yg@fRj=scM6 zk?3)+0I2?^VtEDHns)}Q0x9hk(ZadyU%mceBj3Imw|J|@{57ru!UY<-FfFnqtiLfw z9Oc*I52&(}OW9ct@=R~Z_v``Lng61>q-+e4!H3D;Uf5MR4WxtVc*o_(oF;Yt$GiO^ zYJF1FI@cpg%fs`rWfabK@uA<-ZniXo6oc@T#WI%a>0HnbpOxd6k*NJH{hLFCm=dLd1Prw1HIY6pr)Nzj}P(;^APo?uE!hC?%W`2@62f zed@v@QVCJ;=-YrB`}GH+fNu<2naySn4&EtK9Mzb7$^B8SQ<1@B$B-)&G~=c6j}^Y} zmn${IcieH*y-BZkHxG7s69*oXm-~Bo>vwsVjnz_z%wOJpukAW(#456l{*|-&Ev(eQ zzeqig1d}umDVv_Id=)8MR!z&!+nRvtCcT?QR`F7WeoI$bD#)H;X+yE;nV>0u3 zzsam8y3SAlJwOE~w$j1z?%cVUY`){0#nEN%1_P5Qnf0{4da2AaTe-#K>7W8cX&%Mt z8fUf}os*iaQL&I-OBCUFqbBEtKP4icqRtPrHp zLt8+9A1etC53JhwwbvC9+9m?5c2Yr5o>*`S1&-5ZGRFw5#x#q5+6f}M%Id|aIa5$0 zR~njscF7a;B>wkyP4~md2dd&<3|J_zM&}d)r}MUs13YPQ;f6Ufl|o%NyP1`1mt~t( z;17$wUucXudVW=FGi#N{>-Twk6-`w2MD-W3U&(s|PX*mY#dSW>`j7yRay{;?v$}Vg zE}f`Bx^;DH@-K@CIJATf+kYUl=_|4skan}$IB!#bN%xThdX+AohHIzUh@MSS`sc|8 zi=u|uG)ic8iRAaI8Ax7Xg<(h2MFi2V|{o#F3piV%_!NN=L3-+-!C24lp zpJz#LQfRLU79o|^mNKT5oeVS3O8YL-#1xjiQirM{4H(A&Uqv%~gf|NE*$V25@iE4& zcthr%wybHS)Y?cgKCkt&)DXD&L~lA^cig{kZRD}Uul?xubtC;)z1P|)$L|r3O3@yx znMX7B@2d+1mj|MuXV%~7Z-$*`0JMTyHKGZRknLw`cD!BQpb6J;KU+d`ir<3npFSOL z6MgJ_v&ApT?cwRDA?F2WhLvyVZ!t@#sS9@zb&1b-*8tvGp;hDKy5wAb_RP`gRWx~U zyF~~5Kl`c_zV|JB%N(z%nRUS(-*x%O=iLK9E>y_Glia>|#~>Y9FgJSNEND9+tw7aB zARp+^H@io-#j}5)j9esiLCZynUzo(YZ)gTPGmCCz#C)!7A`p@#w(iIXsxOk;=0@!( zUwo#<$><^)obTh_%QM`zVq9lCvbSHGu@(h(<8?qm9A7pDcd0u)_C|n zr&Cf85pe+8+Zj!+9$$d@{`=53qqKs#>4kmXF1bs|aKFumh~6&eRjv!A&Mkv#V7YQX zV;DD&+#{S=SuEYU>p~TEdN9pLT!oG-)aOYL5Sc7@k|Z^xkL~eae8UfIYd6a@XM^cG zNK3};N{WljHVk=!Y1HULuU0~w($s2aI9mrBr4WFG<8$jFT9;i`%yF7}$w|Ym!F=tR z=I&BT7nQ8Cf5ASif5$>I<(s~z?$Dc3aRs~9o5&4cuGTIoton+DWcYfU&>q|H>VM8P zSkYkh>vFN&s_oo$p?fjsP97`irw8nPex)JwKew`n6FEcQbG1>)6-R~%Ycc$8Mn+B} z4Q~caW?XOzY`dfIk%E{aP?#3I0&z064ERAQneBXZc@9p>pl?HPT0v6yF0#H1j2Vq{)%4v1l<-MbC+I?s8<5OYW?mzCKS08(1x2~2HD-rlBrh|-6>HH zYDRW8mIjAkLi0krMJ_YjMdbDq>!V2hhQn1yo}|^)le~l1DSN)F-S}7}N>w;boxRMQ zLY&6kK0S7g`M5cuz24$7Z9#mZH_HQk|K|>S!Bph_d=-a>%Qw2{IZRg#uF@RxeFOp6 zr{4|ckiD|-j`tJ8OO5nn#zE(?6Zc@F{chgayUb=?m)H;)<1If`ia$QL8H=D_)9Lv~ zqAS}H5;E*|%UIi=Zgpg79j(tO7B6vg?LBa2VzI~!>r-GXO`JJPv@i5 z&3y@_bhsp_C8V_znAVX@$ndMRWEjSDds*1XX}Wm4c;k*KX^DD`C&1Joz)CvCrl!Vv z{%=RB)e5IVN>7w8M%H5p=Du!`(I8;4gY|n8f5HnyX1Qd}K)JMibmvA%M!Xt8u)sr_ zw~3Bh4QCaS*0zd+v@tAQdpbWl3}8`+C?WeV5*p*LhabCDGyX)eV!D0g0wRVrffHrh z3aV*0L%V-)tK;U-F@bL647>L8?tXD!DnEx5S5TE;hINWNW%WiiL=d)s^mg1&&?`Ke z86R0kB@I~?G6c*pTEIZUK?2YdpTD7)jwauER92Vllw)DHsnR91$~ihas0Fw5IrdAx z^Ieqax@s$+Ee|hZw5l9*_v&*`$m#d~m0#kCzFHJVvUdDYW+LP6QSYb*@Y3^bJL7-X z=(-~_n|v_QndAuv#nWW>E1;PkzkzwKt0>XDY!l*J_}iWGE^PMwHU!YxHq7|v1NYg5 zP3+AomH}Z>G2gHTTDf;e1+{+Pk2yqIuL%aT#21UUp>0+(ul@jDT)1HjjYqLHCzus{ zs2RZ)!}Jm(36rndLcowUo7FY_w~d4JqQzkNAY_^E6xYfl;kyc&u^iFafMjeshuW~A zxP;cx0kR+Lyht{^jul{A07|It)0bCVPiO_ng14vFG0xufbSB-tE4qleK$OW)q|~t>S~Z=&NHiZj_bGDh= zjK`N4iE1E;E;SC#+W2*_IHxr}bm`TNk^6wUzf|5ma3X0faSOGHY>c7$K z8?@o|75*|#Di@8U14n*oC4BhaSSa~`8466Co>#Qavt5{jbr?+9Dg_mmO*6eC1N}1J z6Sy0^5DL2dc2s8s{}}zfdqspCVr)QUER2U_Hp$v-*B@fDfrw-$S_q7BP2Nj zyo=LG;#Vgr0^CSg2>+HORAc*HtO+zgytnvyjm=YRxRHnf(NR1+Ap4%7%;frgavI|! zkLjG$*SHJx5YnzNY?ewdpbvBI%kobd?s_UvAa7Y4ZTBc+(%aT|Zi;IQBXe#_H8 zpkElI5#ZrF_oG%$1u^fIpMV*Fm;3IXNJZJdaeen+WPTg?W$Fdos$Y6N%M^NKicLEZ9Y-XP6kj!$(Y}%d zKTq5UMtlj^3dK-|&a&TD8+0r}i_)Xu!+_lKWlPfo?h0sJ#PXE+hwCzH#5kjao0xvyH#r)wp$6Sy3p(ZZo2Gc~>)Z0v~Ru`gZkh zjjVbB{|K7;8&G&Wear4sJLg_*(M^z4vC^MTRF_xW;cqJ^=X?Rxa9L+uaY*j{8b0w%nb zo)WJTSnWbXL&>0vP&o85hd1*en(yol4+ie13OP*}Y`| zh?<`LftlpcAHbaH;JuzXnTgy*Jh$9+cxf_%$$(Eq`r&DD5FGT7i z!Ob%`ww(VlWq{v(Z}QZNMG=0d9w%S@U{kQ~(GlE9#ZX`HQh906Q}jv`VRKyC zq<3L;#I`meR^+M~VMcoWA@zcBPJ?dVVo#KL7%6CXoh$|_+6aFn8w`)iWS^wrZ=Zv` zX!AXPJ%sL1P|Prm7T_C4)bmJFS~lln>ai75knW*xR2mtP0RWmg(_q&_C***!Tuhcn z5)qJUT(4QcAN8fKXT8oEv&a^_z-^-}Z-wAFkKAi8lC6khQf^ZSX-8pYSlT)4SsQ(F z_zk@_Wyeot{rfhm9EI27=81b7H4~W;eU;GEQyB2&n!`4wdBFe^-wK5%C}u*Qx@4<; zZo)lW0M#9rO-gOb&t;1}8RzZv8Og@#cM!z+LszG`<(G6Nz|2i^ znipE!M^W-R;d^~y!81t8sfCNJ$F7V%WK691h`_MzKkX{xttiDXuU@ zS-x7HShYI3xF&V{kNUrq)WT64WT3@p(EwS=$@UOTL7^EK zbd4$`WYe1Y6MnnOgea9970O@7&Yg|GALZrC;}3nXw@M!s5Hq(#L&NP0Qd9_+?s@8- z^D<%0CEe^0*EF?Cjo(!cn`P<*n-_`1w8RrN;IAWttfL7&1;`N<&BM4TMGyxxHTdX) zOKNGef{Z&MKL;V8q|gYI`|<0(C7{J0ec=6Jep#$ldJ%9yVj(mBaH^vxu9WmEMZ4Pd z%~bH-MFV?8j4B`WGAI>dLvKCer;Juo>;aqw%?ijXc{jXcD_amvB$#O;^%qWHdu8{Q z3rH4f5aK}9K%8(_$lj9irKIB_;!vRFcb+nPxXHTm#ny|^aKt&tN*?DfK%miR(E?ut zDDixmkL95Md6*|m2}VLA0-X6s`q=6zPGKHNQ z)`;zTp!5&!fJS1CFYVm`Quc1>KC-UQb&o0=&-L^#J?;yu3)#J@0Y0xddJn;8hl(4{ zEJJ|YNt%C9GgKd!jsZtu!~F}KR=aOA^19BClYY8p?pX{ko#Ooty#6y3F4MhUcin9s zcc@kE$;HoiyKnM6wG>paz?=E%3+?UqqUtbK-9rEMiXWF(Crr9d7VYyik(IL)=pOdp>NUeS=?xq_5WU7nF~wh zmNy%1~a+o=eoBi#6EWW5w+#E{-Xtcs8mHYe7VX;NWL4 zzCkk6z+=dk>9g#i*iaWl8M8EQ@PxoX0A|&!gaJFow6H-lw@)!zA|>CtB`wZ>6Jr&0x=8Y~*7+V_KF@2qy}i--50-Li2o)%S3{KPYnZN z80uE?1)>kv4oNR@U7*f8L^k{^aE695syApJV)xLd<4k1?HCf!R>zYGd9`IBo!*Fe` zBR6^7lo2`rtz~+cffBdp+hdTfWG-A0p@$|Lnjwl;#;q0}c$evHEcjDKbT-s{zC&h@ zNVFjxFi922`hH*+1)E<*r@&3y#Ru+-;;K=`|BVB>oH#GZbiF|N_ndt0@eWzR`~BOH zz2i3SM;E(H<|d}?QS7@fukOZ4Z;VyaV;IZ3GDfNCM^WO+mOVtW#8;k)e>PdWg9g8W zmUC^#+T0V$mC3XI;m!Tq>IX`(nZep7Zn>>>O)<#)dA!0vpAqrERi98r**Y<(2qS*v zdlmwqUlf!|=O1kyR1{QEOjH!U{!os!H{%^Nd)F*hV%lqmNvd^0H@~es@fK7dIwz4u zazrwA=%=g?5ItpTCFDb|eY&bp%{^L|;iQOKryMYo=v?S$+pGO7`^3waOaW||v(^dR zakJq@lmHdj@|3JZi_BUJo_+BD0XWb2^%q;(vrI-lv0-N5D?8Swkbx(WHcBQ4LIo9=3NGm zwnSgy$C}&|;!QV5JtZk?sVDTdzE?W9=|MJS&uPJSQ?Wa9n0OTb=!HVMHNu(vMY_J=j6eWXbC-@ukq5yb6!vKFMQvAld9iooQP?#m0 z_zIyfAOH5zies~r!+~rD?knw(f@q!~FKVNpReLjGQq7wC?>K05lfN3kLLM}r zIV6*ZibiYKHv>gtFuKMq@_>sSS_x!Ws;~KKvT5@=DET-qkVg&~W6>vY;cD&AtSnody>m<(UI+W#m_X++8A zulLC{x~m6hdk{f`nfO}z1)U`GqphX<;~_PkzyzCEW=ekW`9%iMaCrs$NCfa~MCLL$ zsm%boE#O~!E?xU4jVNJZk|?w3<%NbBRg7A~|7Z=@jWfiB9e}gHw?fWKTkt9R z$UE4UV>XU{W6?Y<)a8TRUWW^ntg9KHS~YC!#PeMR+K9K%ISw_wI{Y>NVt2pyITM%X zlE>rFb>EYHVO=L^Q7W^pUC;9Dip|)h1JpWNMNMpdy%>lxQ6 zsAo3U@pgWvwD$Vz4dCN^-?_wIp88u--zTTM?)k`+biN2C;$p};c#@5E9ARxy?_cqP)$>v5Ycuhggo~QBvF;KDD7M5N|$PsC8 z3tnMh*c+;pM=@0}mu4yv7n{dpLw43owOi_8JCdc zurjRpVD0!tFGJEfH4W|zVBV*qfNMAqX$TGY6(|?nije8lk%}^^UW$bZQ;0LI-dH9^ z6upWoBPm!v*<QB8@}1%(Islm9_3AN<^gWHF?%(#7RmqT{GRG5rY>dZo9%RT2qeLrN9@>f;Ooy4<$B~$? zGlaV9|2KYb0v7;nj(jsBs1_l7AocYxkf@5OHtHIiEqkCHDu{xzW6`FmjUVp-^GOnx zuVFQdBk9Qq{QkwTS34>g^2O?&R)8DJYNUwEN%F6PM%(5Pl8^WSw3rZUAx5vOB}`W< zOxZ2CgeJ5)=Qe$L=Du|6)8p-IEaL8L%Az*K0Rb5k&?sGPl)82BTDis!y5feK<9d9_ zkof3`GUY~scsqI#*?l|3=8^U0C+<9xn!gfw7k#d?ECC}$bSLslSbDpg&gIc@afZ3> zFq-e_+#U7l=J^Xnc?O*~D^0h|Jq;}+A*3N*B zxbeF`;L@no(@igj%dHJr_QG`|(E+qisU@U-(?y{<4$lWX^mC8PM?Ku#eUL&{BMxRe ztY3${dEe0!;w}?fL&6vw=KWTOm46}$)^p%9!<+1H_pgp69zh{H>g|Pmq!3)Cu>=92 z)D!U-bq0h2Y3QJ&E)!XnC(7N@hh@+W5jgu3K#AE+Kpfn=8N{p7cmrqMWh%=xH3_e% zCl4*IMTfjGM8kXmy+T3=GtQ{YbNff=gI(R|v#*ODVVUxQS#p~O zl60jRs`c~XkgMQin%{yBqLmjYPi!W|{BwKQ0XSJH{Qein zwKF-{pH#2V)&2o(^sHTfI06q5DeeVn7!=7kQZ=RmgNIHWk*E^Q){gK(K})04_Y}92T6BTY$@Aq83kyr4L>!k4qcd;e(A_#6^AY z_X2rv>$LeSU>P#Wlsg{|`JI#FUlA7&fcWw5*1gXM+#u3OdRKZl!GSLbPh$tz)+Alx ze&r~YN0t0|UWCPKqFGw=;sU=9s}S5lzQE)XpT>%P)gKzGpk@IKv?jU>aP9R#)zs zx^nDa^-NZpw^jXu{*HbIviI7s7++*E-v_tDvuS+THaXO!73xJ=!zBgZ{b1=m#x6DP zEW#$*%)ggJ);05B4((7G@)^tm>h_-FRi2|O34SZ|Rlw=9N4DTAYrZ(9z$u}j0K#Nr zdbFzE2OIS6v>-yIye>Xy#$hqL9o%l5lPOlJ^Bj8y%}_87df|iQ$HC0b0*!{&uPDK zCJLZ6tUa~lN8%?s`#J2FTo7qMM_*NpHOW1;DCtg^cgVGKR1Bmczk~6eIZR}$7kdT>YXMY$VuS10I71nA-lTZ{^RO}38KEfx|?!d#0Ufe8Mo@Ezx_fU z1gm|6r_pmquwOWL**!kKx){jBz8^*jiZJs%=9uHMtvV6rEr ze-eQdU_N$00Na%v2%WcA)U3+9v&#FLAW4k-SY(3SfL+3c4SExxW}R3d3- zvTDXG2a3&!tf!yt$OVlM6@#IP z65azfdBC|9d+bG_IySQ0mSkvTH4GyPx{)8u!tA|8*lPfI53|(4A>0y6NTu+YL+NS> z0DlTSvT5pbn|OsUk|g!8_n9(`tB@4yCw7@kWhpSJ&OZx9>f#q_O9m`N!kr13KIS<0 z%Egob=S?r0`1(^G!E1L#MYAkHa25x-&oHV5h^;_~7-)?R5H{N32!>!NME*KLq>{Gl z3F}m=6%y!cxgLl*#B_~8k4*e3Hi79DdyU0_Mh!q>gRkG2LCCasb(}sIWf~*;CpYG? zv>r%fF|vM|LjG0a6lfk%0eLCPqv-mJMMK_( zJ>Tsfen}#<1>(ME4{IrkD5Qekw3HOS9nzCvfj z?n zPhvSXfY%Pf(;NBWaPNF#Be?hETN@)s{!AcQsD5DHd4ZtmzGL5y@t^x}G;*-;={Ky> zQKi`twG}jMm|B8|aO#HZSkxr+?Sx?-D?5AM8`!#Yg|Q*t;`?9)AXL_W%MFH-XQH)g z&e{EGy4shGH0>C+Wc!9u5DYEoaI0_1dF1FwN}HeD7^-+R4bJ4)741>UL}{;(ydx1F z`OWo&+aEk?6-WJ0hHXW`{}euQ#>UO`{z1YB{_iz5+-SbTb(8{S|?7H6p3H5~V4pBkj);ZaJMY1eqbtLQw8l^jx#K>tgr zbz5a}XTCdl0$KdKS)3$Ec#>Tk^JnGf_eH0b;|A*-`3FGJxyU7xecNVK;(@m=U;HoY zv6q2^_yn{Xc07T&4lnoj=Os8ltoWX6G!0k9+M0R*;0ioc$~AvB#gz8zyOr`k%ilHg zp|GC9hjQ>?s=!@p4)dtFg^upN+f4e_n}VDJ!Jp<4A$k|s*Fb7h#r}kMTc@mMN)&wLeVxd56pKu9Dm4no7^iCI~Yo6KTCsjpc_lH*2D! zI&pEso1zwlMhvjisrqT8(XUlKu4UY9rgmIxGJ)JnHg}9=C|aw3i(sF|NKs>WCNLLM zg7Q(-xKSs0Icbv&sHTPKg0637bj)DBF?)K-0|WhCMy|jHg04KOcu5B7B`2v`K>OD( z;4;%d0FF)n=>x^2L0QFp&W}s}D!h{b{R2nEM3tG6pBJ!MMFc;S3_JodsqAQ$_1kqs zi{&maEusF;!$ZM8FBZEWlHYt@+ZnhIDM4e|7g+zq|ADbGXUWgl0YR+zv(mTZ2pJ&%W1LtZdkQN-TF6X3ZI+LSqS%4tI5@vM^tbo>@;P&rlrx-hNOp7QieMt@ zxWEr#Cg8wRd9{KDO+urdOSU-!xwpnN3=+s?hUqIB=`9K&&2kD9u~%4=f)?;gKmmQT zxb_k~Owh|HiqOA%o`E0@I#)I@J;k0uO`jyR`2&idRvmnQVKl9qgwgg^Fr#^oYK@bd z%YKvSpwVm}EO}~2JK8HW)d&GKgkgrvH?L~Wc{zfEfgva&%1PJ6UBRVLQ z)&a;5L*RuxyEDv-;8JNw#?b{FiKTx8`(up{M%|Q`ody?S6FOYO7m=(-h)n12xW5md=~YvmKbQGu3V{jr!t`kvmG+<(CI`ZR zNp%b=#Tu|0kwU2lsc>_JDg$|vfd2b2`vL!<{W*Eu`BC7C_Q#-M0)nNW$Qao1y8>Yz zh5?CS;c^I1bleiMiX$gL6AP9tlHvLIE^6N2)YJmtjfZUVL zJS~;Z3t;q;e_&u3V&Od9BqKhgjKm(SqGuQhJ+e*CFqyx~6P8U0Q+s-z+zCyBhs>#6 z)ltC!Ck<7=Mmuq$z;Qb}*{YiVibd0TIRDjt4nT;-kM!x*{y7AMj(Rk*SFa6jl;2Y^ zYe->N*Y|uqEbHN|d?~rHm-S?418@ko-w=GxrPa@4OMN>jG3%<+{7x~`!w(9Xeh{M1 zoS*bSzoSjU0>UwfI`k`zl^1WwuGa+lqu^fMGK5IrE5ua8be-M-#)T?gB-}KyMbsvA zys2^1acq0-iCPO<%GrTPfAobrBkvir6r0*nJtua+z(l=aw{VW6?Z(Lmu;9|N* zOLG~Y0oWIB+3C46iQxSI%J^6s(D;JhvIRiI$JpmJfUd4I$?-1rl6yjX z70q}?GXclzN|*(aeq*D3HTg86DFt?DV}ho$Q*8i9yz@_HF#z=UesK#pDb^@uKzYVM zB2lTfLEH9C>&sKhj~sZ`8Y~};!P+O2j|0#xAmr97n<^>F$svl8t!5Y`n3qkJ`mW%^A7gzd zD$@b#Tp0dOdSzfW54r0gh>-$mdewsGL@%!QzkTMI)5PhywIpN5aCrR*PP2Z85I6w{ z8zyzcnHs(rRO#{;2?(xCb6;IEw5VZ64si*B4%nE~kr*n!kPW zEmhq#YsNpFc3-B$KR2ijXA+7ecHeFf{ioGPv>ibe!BF)H+7EmS6&k|Vovfh8wxa-c zGumtBvBLQpBHApgDhV*l#@&!A&dy`XoF-Yyth_gL?;-R7f8Mq`DdpvgnfE7P(2Me!U9VhK&! zs!-7F(nv(DlXChgTv0Z(1p1KND<8-A_@h}wWH#YYH_f8{)lr2+A`ft9?| zRW0H5m%(M5)V3!U!OM28FIB18b@^K}{aKmI5bM{}H!^lL8rSmYRz0pSm_40l1&)2N z!=dAqy~0-XvzXEi;7H#4y~0eJV1=m=j^(Qsvx!oa-hO^br!I#LRK+?Rmtz*)Dza1z z{ZcLe)A~I{EJJ>@{-Z+x>(upcr_7=Jvw%M={r67G>2an~W=8gZC9B>ll8=8ha=|q%}Y9p~w4;ey=-f5r0QkoZ;tHEInNU<8u-)Hap@iqb+fDJCGM)jwO`=eSYX&EmY+ z!Jvn?KmAUANLu@3jRl#tIj<>m+DHK(>H;NWRE@YOF>5?Ta6lk0Y)6@c}oEvK|?0N3E$>l-2i_eRXsKO zi0m)iymA^a=y<{G%sn=!pMB5s#0PF@Nbyca!v$>jgPl$@LM+OpJ%FO?OviJe*Ey?x zs#GdVBcQK8_4UyDRDW>Z_37Kd*o0T4v0%^rNV$PHcv}byZs2^G>Zs zJK~tE4oJ(jgfyxYcP`^Q91ek=Q%=I%94B>-W<1V%PCm7bRX$q0qwv{)reKZ_Ts?jAD@8+gg#1qhsXy5TgrYe};dOE~WPSM|<$dtL5fpoTh_1Uz_ z@`wMV1Zpbm36=yXN?K3nuh)t?0wjP1yA8$DK5uva#5B{KZzZjWRN1GafgebB{s;4m z$jnt3NcbpgpeN1zxcoqX|6Kk#4f906alRzZ4Kk}7&I4K38k<*K^&eH9UMK;B&-s2M z0?KaOf;kn`U(dZ6LGu=^c>{XT7MYbUU|IO0-l(r9alE&DCELr0vJfzCMfRGYXf zf-lj9O>xq=@WBFsPD8-|unEbesMV0`GjpBSu z@K|0dW-;ncv^3_%b6Z0zjcuoC>@>D*+t%5A z-uIj_&X@HI)>v!Y_jS!Vg$+;+H{v1Rpj_vE%(@F~WB_nH{%EBVrkaIaHo|Z}ut=W9G7(;dI|t{78ewT1}wpt7c&!&-Q|~I#z1!0#L#_BaytgrEGZSD zrN2D-ya$EC>JaS12`7NH`~m-I`7^g(aQ!r3N@a+G`4omf*EA1Vx&DkyBHD&GhQi*# zk(qJT!U<=l>swO|1~dUHrfb!P>DqGx27Z`o$z)oY`{{a zOWvEI?SMe~^;mK6H?7j~5Mbb#9NQ@^K*J3Vs>5rl%lY8sXHA_1#oYNEd%2N=SkA1K zaFaix3_AnTO)YChV*oBgjrINwuKO+H3>8!+l=w`o+d|s^RrFg+y!4M*Mm=~a#OgZh z-?HivN0Q~gxdVYNkgs1cAE(kg->>_hSRf9HAu<|?xQVMafIfGDm#DYmtC5_O5-d?BvUx>5B(~dl+FsS&XK`xDp^xp_i63{gH-!Kl0=W4@rd=J+bFC*27lt_%o;B%Ge>~?W!%`(bw$bms-K|mAF{Ph=pPvSy z+aDZ)PVthufh*^{=wdq!st^Z8z^a==UOsdA+btean3K*B^ixF|$22b(|1{anGh3*S z=LKCThkeXPC&s|+HU!-@{&#*}BmY6p@p2Kh8W@k=O~?(*q%#VX3*Ji?2c4*zsGF2O zkH|~oZlQ@ANmp+PAVoNPn}Nu4Ci@Wd&JA%m6&5JM>rF0j$Z{Uw`+r^by;aD?Xi zr--ptTzo!w6ZZ<9q}9?Gk(~=i;l3!@e&WNy+Y7AG0XfmW$`P*bm|5zmAZHXAaNJkk zbQlqz+@biOcxt0i*mTX%aa=%nEY~FXRaf=|F;2=@lRff}ZKTgZMDX7bYJffcAM{xN z>**Jt1(tJk57ZAOnCQ+?fH{FYHZ7&78;u{Xhf0hsENvsHs%TUb8cR`jhpTq%*gB@k zX`#N68a&kwKn=CqJbrbat2f)f*cf~rmLG|Gq?V*?A)bwP$|0L;e^yN9A05Kde4%Oq z?5iiI@w!2dMli0Nt|;dNIw^qQ{AbtatCVyL;5X*#K#Pz~KStD78Nwi6>4a;~Q5wa1 zoNrqx0c0~UTi`tczo;pXj!5Di$lp?5O^ch+>&+bz$j9X~vtC}#CC%-79t9`0M3q=} zCy_21M-0wS1z)L7Fa3js?oIl2yVrxIymF4Ig#_Tio_>TbQ)IBG-=Ew}1QYpT=LKRE zsBjKTiUjub^Vfb{w5}+UBW@Lk%p4VT9!SAt4Xr5A1o5&`L0_gLHH2#-&SAM+t#^^{??!)6Bhe#D9P|P*RwY3RaKsT~KZpXN zWCo(FF5FTaZ!e{Vq6IE{gNxgUJqDeDeYZyA67aV?FJC4tY;XKe1Br<`hFYD%i2sKZ zFanqe?f=6Br2Vi1B{jbP6+UK+ieaLdjvV>Wu)n%fOg*DGB{c)h?S37IL|DG*M+UY z8OR2f_XkE}nDaWq4=-!}X32qOaGCQ)sSmBPg(IZTWOY>ffeYVtrIa&tv?ElGoMnHN ze!OEP_)E{8p`N22*8bN}4cHA4C%dp}c<(39F0mmfAh?&ZR+?l!)q&Ci3%PKZCU3g6 zShV-Zyg&k`1cXI|Iqa^1DkiHVu9b_`5k|i^I7UY)Ctagy2_=%3TW?W?)Ix5pzpaUq zE&tiNI<9eFEKT1<&;K$5R`+uezo@~FXgT$GD+zosRNdZrORM-KRqBLo!5R? zn@$Q|*zvVVT+vKi9g0@4tP!zyKi!7;b7wBza4)ZIJ-&F^h?uHoA(Ckf5jnJ4R6_i{o&&x_>Zb@ zDp$KPbqCUxvTf`caaVu7uZiH7qDBD7Q$2I7RCk zve17iXbxN%*ToTFN?WJR5xS#XP#_b$xI8KWlLmggVA9~nL;db7kFL^MX<-c-k~^B- zdE7Cprg7M$@jrWiLwC5^M|sn*NkdpF}RV^+}% zOrohL|CfZHZOB^qDw&1Gxv?ieNA-K|+;9jqi4@vzFf+m*Cw6ku%#boSmuQyhq6JYc z3zIoQ606A@8=G9>cVJWhlxkh%N?W+6n6H?Tj(BnLO^t@@g+5UXJ8#{qufD_ajQ^_F z0CpqLSH(MlZ|5f6?r&xX6+&g^(Bm2n`y&x=T2Ro8=+foO3Qa_*1PsC1w3F4k+w08N}l0CYfD%fmlwUSpDAbt&uH>NIP$EL5^>W z&vD1=GYK93`^Z*#)KqVINI#GZqI_w%oTCe$yDVE~P;lQb&FkI;Zb3T5(M83bacwup zBucBHw@%=5Ho#r5J!FuV_}N8l4VdB2zxT~iBP)opDZ8-qAVW@krB6jy9MEV_G4KQW zA($bR)T&6Vz`z?!D2N41dfWh9)h+yGPiE)7)sfd%3$w8PZe_Z4+v=gL=|$(kTAce5 z|62)^wdx(NF917*spsu)mZ?I|7zatLKl9pdG(v8Cb?@EBn3iASDoXgBWv|V@ga;1HD z-S?_`bJxOR<;LMR_YUsn0J=6GeZQSF#3M0DdV|XR6kDgs%A;#HeZfEa$zWw7BC?8j44tMQw_UZBP72`6U1@}5@%b+8iQJQ!Fw&KLDmGKc>gevI0+vfMkBcLR!K zme0ld(Z~evQ@?_dV86559n`HQ4D6nxWI2UATaS{T*AyJ}uC^?9J(Yavq&MTJ{N>(h zKCaJZ0c1=4-Kh>Vw$)iauAz-F8Y;PaDq3*HucpPSKkpkQ-K#5lCVdVx?f(=`hq!ULxP zlo^x@g@K?aB8*EXd$#G6Zt%!4Wa^N@^?kz-GPJ%kp-qW%)ZYaB#5@* zDSc34S07|m;S9pj4t1eJcV+W!9NnC&MzNX4>>jSqpAxVri>~<2=Fjhl)H!)vK|hND z8j#+g&0+uz>;^-rK?(?^1i%SgFX^}x7HJpTv1ZBEDl4&x(shw?#~o-2_?Sgfg_n?@ z1v~po5DAQkI^%e!`G-eyFX}uw981|FLrow*XNJuTeVBTr3hPQjn&xg&xzmefghYq_ zxC_y`JPYdk)+Lg0%d(uVpC9I)&=#)n`OhP6w2O*1Qz4`4RGpbg7o#h%4E*iD!}ddX zYx_hh7i+kuj_T^!ARSrnl4CM>voAi71UV5IcZa_xESkDy)?I`vS7(Qs zvJ%P1^8TT2e<53=yg-FU%54+-b?^_n>yBdhl{T`v{;@(8trZ-%e(|bTby}HQ>E<7| z*6&?w5sDd?NnH&l#{~;O8&&yiVOO+Z%n&=8w6Jb?O|G=czO9e1eOm@kd>bIYQ5~Cw z&YtDFXGsH5C(lwaV8C~qcDxs~b_WIwD90F9{{aSXvi|^sH!xt()nfgryye+mQPA8g zOBoCpydCL6&wNb)IPhN?s0nyM&+Cm$`!pNs;W*k2N3;(BZ(V8D7Bk}PwOM$xL%B)4 z#x@Wt(?1EZr6aRozQEUQJps%YfZxfc(7iPAE|azXCSs*pTzfX4>v;S+ zR@}kYa{*wIMs7X7x~P1Y3F|vFFWZ&AVv!Ml?xzJXV8EQBbs3fm71%jL%*7wPDK?v% zl`$}2hhJ@dEhHxIt{f!rXH^aDt>IQ_;3VOl^Y%|0U~P8SU^&R^!v@<7;X1`q4~C-T z-)G$ygQVWmVoemAg7bsNqb0eIZSVI|D*@GVbXy#`V*fj@ZdI>;J1 zgIe;n;d5;@YFB2$j)ZoLDR;L)lKAvIhb?pm?YPTpb3nCOjAS+5F76viMYQL8~6h1>z|sitz_Qd%Pq&7YZS1c7!f@K-O`ofY^)W%2(#eBtqjikpB> z$!ve?bi*)61H?u${t`5%5L zHb=$5Mg6soU~xZ+;=MhW!pZ3IB9@3x0mRRw|K@)G0s)QxFAzZVJ!#}YV|%4a&aE5{ z7tl7HOxIJ%+n`4U67~jA15Mz~x(cYQ=EdwhIL)lsgO>We=<{#}l=OJ$zY2U+>&Zk6 zvXW7X&cz&?joyj^g9KgLV32_1b*1!m30E=k-Vm9ptllbwBY6B!^wvXG8w?UOfk6U7 zk5d$;Jm7&|JDs~k-baeg9_^|1w_nA#@n1%s&3=pPX~2Kl{#|he#J0%=X8~f)Fu+*= zjL6Ep(mBK7q)W3bF9TeC&7G?0AKz{{9Zc@M->ri51WS2}z(&GATz;c(BM1sZ_x z6xWGLSJX>^qElaN==;cC?AVAvwBfS!S~1C&;Cz5PGLVF90~Q`GTh zY0pKk1fQ1)LhWMyO8Cm*`3;%E5&%=Li!$&hO}!?`{9p{e=FZpGp~Gra0kFcK=G77h1#)eQ&=~s z3>fBo!Y1G~&pXynyn63AW#$8)<~ze39gvw{yOKn>^Z73zqviqB-i|{KY<@o+`NEs@ z@wY}u$;eeQt+pm8U}G5yv%(fKOv?5AM<^G^L8#fJAl(Q$Kj=P2E%GBj6vv&f|E$)< z2Bfqm_z`1sblvU7e_MfN(dJ>N`i@6!=VKbR4NA-CgWo6_0@;bKzvHT%eXe32MX&9k z&%WX`8lAI|YG$&7tY5hVR@Vld8F|r>V>83uRtBW=`af(YTIeBgbJiM$mzyToP0fe>;l;9)L!dKrc@eg|W-s9Cd3p@MC33}z3&3mD=)s|vFY zIz2O0dWl@slG)=?w8Ylgf;gx1&9O)_>9M~ zhd8O@rJoD;{hdaD8O0fUECxqj3V)&DOn044@X6#k4@Ut=FU z6~Rr7!mjt1=-ho;HTnyi;BfJYPPf!59h3Z;BCA(@w*4?x8FA!eS|GC8df_>yy`Q~; z1!Y4-uGeQ@X9u0Ui)W*qcd8&mi)>`+q#eq7RDy4S2=P_Hu(`z5=nrIW*_T_$OSA zyRJ%cmSQ)weO!Erbu~^rZ(AA!*5$XqHi?j^Z+6$L3WQQIB3g&o9(A0Cf0D_cNOK6B zdVY(%-M-qwd)vSq_po`|iF^s_u>tBsPBeIboLoiHF=c9aC`8;H8O|B1qnOVbc4(oP z{~h;UU@^Sttp}24Rfu^L1l=-DIPi5J1@_lL=wdE< zTW^d1Df}Pr5nlZn+9#iy;6mAU|5Nz;cz>h56@_{^uv{>^zRVT&xODx>n+sO>|6uqe zyLBGxz9P8>=l>Wkd!;D16-#=+RB$?LW zO$yip`O%p*!?aBceA9=lX4s(UzLJe)+#4c+h*B&Nt-wW7iD3sb1m+4H&nBZPN7aC) z-};-A%8EPiLp76rQ0;bMLy<@yk z8viTrM^#8c+YG&YMfoTCu^I|1i z2!z4avad;WqLX7)V`C60g03ed-6fFkT7^fpz`28t3M&&1x6IzzzCUzTByQeDPv2=c z#xODv@~8$dRiV^+>jqT#c5e6WVU!A3ED%cS66)HI0yaHBSbuL&+DDGie2n+Jr8aU4~NLQ?7i z3W`SoY>4>_S%1ELlg=IJQ!s!DSPk~{BhS)!w1PeT)qZYTrwMr-(1j|f&TbGPFeEPQ zPY+JI0b41??SWlQ_j_WHSkb=(qAo(W2*+PA^VI7-^Nnp>bFr<|vE~*T;&B^(!U^x3 z{>Jsy`Cu#m8T^A6B`eSrC%@TQ)hxL2yhH7c?KHt#iC))@1$_%)SUx}2?Cn<>M%p6g z+}?J;Nv8;7g5f_+Kh3@%c_{xpLXxpSFcWqw?>ccYW&j65yRUCH^M(kG8GF&L>q6oc z|C51M4y1Uh@eF?hk9q9g@YAglN_y%bg}5hEZ6u+h7Ke!F|ix444!_4JJ@Q0-JS>|YR)XxoR zgi#fRIg6D@l7}h$NNgrdncQ9R+)g3Z#KY4<(4Z62p@fGBQgPEN?nA*T9enrsXj)3F zo2HZ_qY--6i1LpQgc;!N;|%a{{6Z1D@84gqX|6r+o%|_`%{6f7RM?Y48RVqgs|h%> z2^ZuA{th6F<{{vv>qx55ZfST{`eba*3OQ!>S0Yaq2}oOj@yLSst>r}(;;TAwfK@N4 ztQjeHxB^;EI<|;g26@95M>5 zKUIup`r?+eO&i$nF!mp}Sxy+aof9(j9Yc8|pAL=Gk$B;kZR~#6JY4w#@Q06h618X( zCg3V%vm>lGW~ZHj0J1KBbGH9E=_fZ8%tFat`g_;{a1?&^At6W~<&{|^ro5(zGHwu* z*W^@J*HyfgZo%k$sWSvW3fK50Sx5b2+{-XeS4YcXl`D&nf=&Dh^$7Ps(do-i{mlSdohHP8CnPUczZOe7RDJ#}Di?;8)g$LqU^x^$ZZsEP(Y#z43HK7ydslqgdDVK0iD1pg}=O#wU_! zT1237HZBMA{#vy>bzdLFQ^RG#$b<`G=Vt*IBQxWTHyYLS;-|GLqi$EKu z^=)6lp8(T>X)t_sEjjhjEj~pzjIT*e`4hc{)OAs`b!2jRUZyWH#06ngFkVc1s-rb(U*DXz|^KEY4t}@H3CA zSnRLX<{g*(tYPxifAE0iYfNlH2=xHrj3eNu$*7xGPJfVKLhEzoiv zVon1)$2yV{1qoM=p7lFMQPYpy_I2iZ2g;X0t}j34S(LGhP)gO#)%sWZVSuNWd$9sn z$=8&m>AV6?K5v*y#27K?cJUk?GbKf{Km!rC&)=~!mD`%pjw!@eA-xQ*?$Z0?MN^3D zl(5KtgK2^^mkt%l?k4*cEX0s0d1LOHdi*J5F7UXu- z+1Hw}s=^zqJB6Pkao`lBO6G_W3FQ(oM^wluDvpHFHYso9=&0F0?SCHGx&LoV7{;2@ zFq{ByR=x4P8aU^7WOunyP-o25+tSIeo_n)>>B7nqZ>Os}1{wPGg4>e`E33S*agX#*;z{`FbNwiC5oK93oX z`TpvvZymlAJ5sk2)c(zbhz7%&>*lOum z0ZPY|CJdrPKwN@p&8*;WjSg|8*H400}4+BM)EFO;B7;OGO z99?$TOl7ixy0ZX^kn2JMV0aZHlx|6!e4X_k{-!@=6gtVFQIL71`KaJFslIHLW#+-Z zb4Q}b(~5dvIbI1@vT!Q?|AX_s7BEGf<3>!k0-DS8GAO&A4|5dn>R^( zajtC+)dCA_Fbn(mJ6-(V@iI7pjguMgD!Q^GW~4;oPn)hkJ1v`FQR4+w3*0LG9;B2y zNqKZ(#|HTL(8c+u{%=)yo?gNhN;dYkm~NxALb=gd1%aM6*oq!Iu#+-Ab*DUk8n}e$ zswq6D<#x@!U{uqzpokYSAqIjaXF_V>Fd6zh3GDXqr*Bz zI&*i=?A{Id&C4wc!Q@8DReHYz3l`rU>I}86h9HYdXSd|?a$UW><3>h}i%0(&&GH+~ z)JvU|X6uzY7$@0!oGk@k?UHJQ}dqLhr70wzjjS`BE=aZufC%LKWD-4u`V*&PHL%AVF4B#1jW?ieRdRVd zu6SIGxwN+WI5*rflSK84I%guJN=^Z6z(-o^CWg29FRD_qUvC0#f#KUN>dSaOQg@*i zx6*pusxPP9!a>L@XLVvAL-n-Cj@?SLB-TU6^T)R$%?r+Qz+Z5YAmYklZW@-pf(!V0 ztr1pkS}*@jEd$D+2U4(oqDfemiA~gT2=m@TO?N4)6}P+mIJ04KeTiNNYBTJ8#~*hy z-_SF{quh`?-_WsHe3-s(&=ADTN%Kd1J*m_V(c2_=I?K^A%{sVn6oFN8`pfWl*jyti z)@xJ#GMkod>oDnczP@7wPE*Wme|X?9mgq}+ka?%1Jb77;hvN%h-}O%QBXGOz z&E&3nA^FZnt$RE-D0dTXtD^S1VWf&|&yOI=_3f{N%;_wNuoXSDS%hM=0qqHp3jb3h zFjG>_nv#J2+H@26mn3%d{7?v*8?s@;kORjUU-;u$MNQaK_~;{pgj}^30$47k@&lwCFBRz+##PD3hzQ3Q z{kMb3rA>{hHAAn3{+hOHXK0)mpU*wvq*YMHENB@5pHHgMY(Kv8e^J|C1p zMpfZ9_`ORX2W4qtw96GmUi^AG^?>20|Dur^zly@NctbIz!VO_>|RGf^CWLl zr=^o%vYuCHi)D)?rfX#PapUaLdwx7(x3t1^ zx*ILR7!l)rty%+)j63D`Y>z@cx8DvU*p&;8Fa#^UIgUwJcIVsZ3olkQe()Ys^P2B( zeZn#!wU&!M@OS5$zCbVrc&q3kXqu_|tr7pR}$tf99YQ0V~_Bc>HB zURK>44RNIW)#>a>k0zh!shg=e_JI!i@hf4LKXL^P8{{)RK~ue8U|LpcdA?mSfOU2d zzp~(SseKFy;a>{Go>L@N%gQ0tf9(MTT>Jmp1L7;P@Fw>ADeLQW#t;Siq2n`4U7tC-guJf&PA>8kvt(u5=C)XbeUQmNqGQ`EwS&iml*iW0QR#^yx~ zsP{_$!g0U7zLx_n6Uhhr$5jOt)E@cdQBAMg7i(->%;33YllFw7>Vu2V)K}({)RLf8 zM>r0DQKZ@Y{%Yj$sn1(Vcwb$oj^Fl0lYCfaVyOrK~E^M#X2%`uepK3}gep zp;V=?2pnC>qqx+RT^g)VdHsNwFTZJ|0dl@sw)Lu*$!cP^j5q259L8yNh>X1#zsxi) zb9(>$u(S5PxwlZgSpjw`bI|cKEbjTYIKEo+`JX2{A4<;@IKDkPcOR5vRy9MGLLt?} z={a{z(`W{>YB_AdH6xhxs&{w-})kX5CfmJR)|soMxCYvDDc&16-iO~2fpIUxKM zVC_5}Ww^8yVzzbflh{xOcIx~gYGV>9b7!9=QxO*J7`KO=aMbm1!fqUcOixrOMWF1z zC40^Faf@r0$t-mRS|l|T+-FH6HFxx!j)oJ&-vM=n2sl)Skr<{bJn63xjBS=m<>1xB zfs`2qbSENw;POD#mM<6Cd>;%`RS*R=xI6#_E)V!P1gV)w*75D%LoS(59!}H6<_xcD z_Omb=He9AZD%tf$sk%Sm>LC`-^d&J`Z&+ZK>`?IE*`DElmP=1(9Mc-Y{ksm6OQ3vB|HfArVN;uMW= zb?iXtHEQ6a@Ak~}+I>;=?$sH3pz?h9M&NA9(lg###I~>hMe4dsHYzglRAT!F1cIsI z8>=;W362eM@k3aPZCZw}aQjH*2x^~0j;%ekH&*#Ai+}&tw7m!KHnYBO^!nsY&C;RY zlt3JW_A+R~6wDG_Yz5s~qy`@s$vs0xRap#uL0;l5e=k#~E&3E?=VN3D=+y8h^z8Zw z+}o_yTIbflPI@_eSNbz{l(rQ?N4I}2>bEgp??rrIJJ1|cXKP#pP7W-W&8*wRH97AD zx+U+!J>Cqj?~XkmwwwFt?ae>ezeQv>1ju^NRJ`B83E=2W2OfN=##xgh~=or+1EzjBv&8c}m+NwoQHb7H3qD2aN+02wYW6=$B z((f@6S|hM?4Vy$QC?qICvO`#PTJA>`<3iCIdvN3$jM9Z*@3D)L+*{Y4`7iqb_~ zZNketst-eDChxgQGtqH-Qf(TYH-pP4V?qne%7E1ixaOb@C{_71?uV_{PzrL4_ zp#c*93l98RR7m|VIB+~vN42vX*{yOqd_uD`Ht4r>aOo;tYZc@q|JhpR(Mp~zPujzn zvE63evp~Aouq<(9wpQk1i>3fKYxky zP8r)xNNt9+xVp>E`&V2B?FyO&GU6&Czv5Q_s<85Y`aMWi_jvFszK5vi}R-i&) z-qB)<&6u@>&Y0zY(E-05bN2ohzG6v69wzV9s#x*(DgV~a&Sr>rY=qatF$192&MR)f zjVi>r4q67>UoT}>+sRHK-g10;7^|Dx|t$9EjD7!P^Zu#WcX z#BiC7v_TX#Wy)%3@OHd*_u^6WL^NbYaGljA<*MJg0LU&S-lx9CUUxB2p4oIH)bOiF zmJ@xO8iq=g@zqbcet$m4S^~+t)7l)#erj~NmAywE-sH3MApDf)v;yu8)Cetjxn>gn zrh2~2Ko7bz`1a|Z8k>8JA4+J9^3t6%5cp=p7|7*<@X8J9Qe20rvIkYC0f;ChH2b|q zw0(cr9<=lfISfDg4~pYc{ZDkFysk8W zHQe>R(Ng$C;6b@G&oy^#`j=u7Yg~rZuT5n~d@{C7+PUDE5ga-8=L)Yl_ zad_X_z}bLrm*8vwi_L4JsJvj{A`brAAjg$9;UU5PL%xl^*sB1o0_?gO-A~$V zO(7TuMG6ydeh=hqTt>dchZUqHxXy>64=a029`3~cSni&k-NY{}CRK(PA|Trg050(5 z$`8Vv`XMMTw3MDYYw_b@?W`Ch^is9w$QA4orU;ra8P;FTG+y$h@nuw*C3?JpkcOtw zJwIfpGlR%vRNG<@A;e3Bd>n&a5u*=14sZ5!*u-$T?*B-H{S2FbvxTH^o-ZpMjMir^ ziY6>kXwqN*z$?q`{aBFQPxQFetqNR^HVmQtR;5o{X+dvAQ;h=Pe*G^;s%fy0AL>V?S0TSK0X(Zx?|qQ)&0-R^f~RC zHp<A~>>mr0$jpY@%%Ek@N2|zb!Z5)`9|TT*s*D9Kk&R-(NQ9nI*D0BspoE zUZB%VfQ*3IrR|2s@`r zyX1}R$Lo+bo1d13OW1bT%V&EMtC4F~UvaGz9JO+OkHawSbN6owxA)c6^uXuOSkBgX z&vragEuSP4;mt~BT&ba>Pp^^KR#Z(;Y!dM*gYZv?FOkfvW)`iGy@Tges@Q(SVmla- zD!w^ahNcgEeJz$nnaOmNH|DPt@B{6cy8Jvc5=Fa8Zxkv|!}&erfAOET-<)!IEN9fD zzWBS{{x)U`(zrY!msuqaumGBb+kZ8$xQ>ht5{GzBC)DT$tnH5kYy0<%2s!_0`$HhS z*WmV;Y-rRA%)aROs1@k}^Q}>i}}i%hAdB0s0{8G9s==(NvbA(x0lqX5?u*9(ADlm*ip^N)l5STK^sc z`g|6Q(*L={JV2kagH%LJ(+xmGY|op*;(p6h7sx{*5G1bv<95gzoiw?rHo+C4;L4~VQl*oWp%Na zv&C<9Fn3-^PjR`GNA%!reD7L@5~|L>pTDc>nq~PFv8EdO9YZkSh{d;RfM46?^ z@k*YG^PQ0MT(n!XTWKZ-ZG`?QK&8{R`xu-NuZqY5$UERnW z|2?}IaG%%RmJ=x}Gp1=k+3Q!n9!=a^%zQ8X-L6s5F7Ow_6Y=M`S48|+wQX81zPXcn z?-T%!2CtUyDX{!FLBN>%0-4&nJA07wb}$H6j@lP@Swr3du?4C?Uu^Y)8Vmp5@QC#I zyYNVDW=^C=;wRal`Bq#;sPqc&*Je7C3A-7FV&}p@3Th$oZmjB@bES1Rs=bPcg2uR| z85YWy(9Z3sZ1c(pzSw{If094?Alf{DI3x3lLK z#RA~TWpPM@ta3i?IEyHLK@@sD!q<=JDln9J^)$x0tzeKCGCywmYLAWY zi$*9f((RR78AlH+5^&%4$;=jdu-y{+5SO=PtM>btpb$2>YWr`GMH=ufiw6}k{5(pY23e!*ZTXa)KV1?U z#y{r`;#lGW!HL1}rV+_%qp~&ewV}`}e`t{=e_KB(w+kz210k0m>{D2Y{!_4`a4Hgl zNd(RPDt?CSYe#U%KuQ}X zh~`4!Q3qT3^U&V9dI=}{@H)v}(S2MoogD=RCwMB@T6i|*GhJvzTd!X6A2jOO_b?1{ z#;}2{(|45Ui2?$=$7(4Mi>Szg1mC;r-2FZhda_uy{n7nnz3#p6WOjl(u)Yd1rleiQ zow1B5&+ctTq(Qf!AmatS$%2j*6ks_WTKIW!fV?;S3;wMY2zVKYL~QNdoA@oOuC(5k zHOO%+!~TH^A(HdXei`Z^ojVR*{>5XZ6F0zzzH5Fqs;wTV{d+1q-r)vVm%N>iRr(H` zUvIyWK`$*Eer2$bgQ^~<>O+Q`xa4jIc+EvZ9$C7F>cfCo`sY{zZ{2s=Qq zrGF(6Z0WaI*~Pn?BIT#~4ZSVq2ES={wq-f>G$Q`1XcD1!1r#i>eD+DY(dpW-dy_t= zbMrU>_ddYgp`Xfzp4hxyqh5{oKL5=ir7lffuGN6eq8hyLo;tc@K*!R+VCSZZGf-nX z`|LYo!xOEMjG+BsydUShq>_JDI|ek$k02M+`)TAN?_O|@d19SwsWNXm)0cL7&1&x| zeB6vLa(uU?f9(h_ofvzEFdH}f05fZ4c#IT_93}%QNhwhwF`GP~IhUCv2*3Y`SfrQ7 zfnYcsBIJK#>K86lzLsk3j0q7}sYApSeB(ohZ4etVhRk~eVl4dqoYT*>)I+-Kt!A^H zW=L>eGoav>#>eXiGZce%vu=X+>0bF6_Bp%szY{-lRi8-COG zw7#BNh{*BYqg`NKs~kyHK17|8BNpFhGKHT0Z@u0<^pEb{#-y7h3eUJ_^3_wKeA4S; z)REf0QT;q$D?uuN7R#kN7DE6p^W2VN3vxt9h`)XadXZ#}GaWoH|4M=QGS4K-uGdYT z$#B4d_@H;Rb58D9rbV&J2Kqr?g0sq$NxQp@$QDtalT- zf?y0R#{Wp#zN~)DyciMuPmFJL=KYpmoy*PXf2T8H|MNNQAWdYs6&@Pv8?)Lc*-s@%b`C2d~4BpO**t zty=AI9wXbVwKrKs18ebtjj2Ms2T~UZgE!a@M8oAu+C=5KRGTb#ACQ@;p4HSd%vnky zHb~awxFhtBy-I;y8%MDOSt5>P$4ZLhJ3E}w8XQl=c~q@5-C5e_Wnun0-X%M3(m;Y| z?e$1|>uV;v?zRt(h&mWA*?LAO%-MhU=_t}4vx2dXpJ}baW66Lu>iJU9n?jpkouJ!c z+&0tLbJBcBr>N)_0~n>Vy6wG0IN-(;$^CUA7d7BF6^5M18T42)HkpRWtWNM7APsO1 zc;0op7FY-J4KWiI)u*}pCrrA}gh{=gRv}~o-A%ddy9~vXCK;BiYB}GNYxwB@j+aGu zajpeF`b8LkmH5E_72|h6NAIexz7D4@CnH|}z41mJs~XVgV{-FKDrk%#NRPh|L-q1# z+gRD}Kt4^}@^)b1oVeVY41<{YPl^xnC{_BxQazoq+6x7$ zT=?l=jO}|{$5;+gKl#Qi{Gd$~h}T4IYFll;0qo8bOqc;L*{d8%Sg4Bs(^bX&8!#2A z6rZeYm*rK^4wvQmqR|fTz0h6RX%w}nK}R9!9}VMdsS~a+CSt4QF<$>tiB$f9b6S_~ z*|gd`$1|L>CRD1ORb`<{8AUKfF)odNR~yV~sFKKTlh?qPUdN8#ZM(z&8EnWesrmv; zNyg}Za=#wOy*>}$+oS@w#_r!O`W+W z+qP}nwvD^*@4Ej_);l;J9Q)eVXRjcf!b1MMQ2DfuDw6bKghEqYW$jH9G`s)x+D1k< zSfaWP>sA}X{TPBd({)$5iOx+j0~o7tM0aKTHLmQW-g>X9k{2Sy^fao(Z(7R*{sw z=Vc)_7`&!r)!4)&z+f&P(lBz8W$h0z>*#0=cCXAa;uTsjikHVU+L4#E81PsBHy4dc znwDUU8Zt*%eq)S8Da|Pe)En2YoQt-AI^KOohUV(uSa4224JwB(A>5y9q*6KB&th1M zb>K5}%3HpyO}H4v;4_ob(E2HVk@^`)@WXt#5O9GG4n5M$gVgupQUUl*5{Pbp83z$0 z1AqA|CPUxFYxLy5ZyPl?LjoZAWBQ9kQJvTX;0u!zb!)_qiMrEf~qMc z@O9Xzl8+cZSk=1QUo8~|+bpix7QeJW)~7mJXa`V?o$Pt-PEh{y9yLpYDo*v20p;Cpg* z0)Nbfyh3s+CO>Cu$WIEORP{m}5v@Bpi`((gH7K?qnsrSEba@c2HP1VKGg^=g+PBTM z;J((Ti#yzDK29T3O5x66H8h!Jmh;HzeEuhBtTUBGs)rI90Wu=NR+hwAJq3G;3#)3lMEZwq;Q~B9@?W=-U&~3odjCw>+d~@mOV=?)|X! zYCitP_+>jSGQ_$k|HJrW9N>51<(9qTT7KkQwHV}vJ}+FcyG?eJ==spJADy!ty?fOI zZ_KzcGrqL(0rw_I_@e;BWx`^{R+0$~4Z&`^?|Uq@Mn7RvF5qVeIxb+jr9rybHXAV1 z;QX@9Mc}y@&a&CoNc9z!*vQK)b|WqO4I0?Z?~gV9vI9hwy27htnTBcTB~Q7hGajC@ z<*x%9K~`;^mo$1FtJ{-M;IP17)w*TzyS%PP>gb^k)kLBE>h;CkMrn?z9)s5_Q@RAX ze{@jTZxa{f@`Ds!EQ%q`f8V|J!5w)9uvyb;IG|ERu(+Ja)P0u%xxBXD?mpd)#Zu)+ z`cj^}nOM?~2Kj8bP=|I@;&h;dWUlRB3zutWr`PJ3?{&JEl#HkdU8da5R3Hz(!Rsaj zJu>xp87GhYZ_*qgk1Keprr{x62rJF15uvoP&Ezx1i@<^M08DNO!GjW9U|cII7HpvT zA()-fe1#`ar{;T1HAESF0657SP;apE8PYYvSxgDJA}ZYBy{m8tL)p%_(#Lv zONl_OQ2!mR`{P^1hg55j)2CSS#N8JZ0oUNBFHxQ<+6I8K4@;;tEJaA*>&p7Uy8qg3 z7yJ!m)K-&B6x$dYGPD+Y}U;iXd zfu+AJ^rv`zkC*Cb&p-D*5mlyCJ_IOtKpOl|Debr3WhYSq$ynE1bMn0jzm+HP9>rATE2Gczu_~*BjY?rY8Tp$j- zHAV&*q?rAs76nZup4Ka+$5Mpz!DRYP<-@OQGT0v%7u^J+MBi=*zRxQa#8|hQPP73X z>M*%L*@5MC-;e2i+rfz*2$)-fcTDm9X)-==%5Sn%L#eDQ*P4~2^KXpj7Hir5f8D+^ zslTXk65r{)tyHPJ5rlRUZpx)W61Gm6^0yy^vF*ao(WGC;rb~yWAku`bE^+$vAYbLP z&W)!|dW-cnX|0n6r@O1@>Tz5h)!x*9(+*)KArunijo6Z8)ZPMR;d}_CXtw>ROaGzGFpMg}Eln|0xTt~0MHtQducMXx_vwy)mS0tHk zZ8#8@e-yRB#ib_vaQ<=oaWYAusZflLpM`MGf(h06pzJBKuUB~L(>sx@M&KE6anR;R zr80{EP^s2Z_51oUW$(uQVAK&4HuxoGzj1rvwrJNJG}D2l7-1$T%fD?Kl)%}g&Q@Ai zNyROHB`W9^E)XHGIL@^9HxBx4d+C}@0e$T^$6UW~v2lXIr`~I%BOh2rnm_G|HEgX4 z5v*n5mgmV52wEcGIS!AS2%QyQsjB^g!kJKjDS_IE8SR#m+8!;pt+n-Yhwg_hB23BZew1RxpHA8FLIh_JQZ-pUm=QYoSFy^l-DyF( z--~`zu896J<0w0}o{hL?y;spr`{l~iSP-n?)eSiwczYIyOvo4~5Hq3eY*MmS2NKf( ztl-Tx`zA2lmx+Q4;D&P!E2M5ci2s=CzMW$>G8}c;H%9F1@o9(^=)&HNA|9(^kkOKx zHi4&+nxOOy+f(ryJAjYJKunj_a`yFnku*HY9ZHGyU*$uXQWc%nU5LiLnMaF8V8RwC z+~!Vi5vEEyKh8?;H$yt-wdDjWYuiQ{dnr981?sz*%8m_j(UNii8DXXlDEq#GPWV0F zEu4>@ihe6#82zDTsW2*yfA7O?{kH9i+S7{1nu`s}BOe<*jxk#}~DLeZtV>fNA9NoyJ#leW&q;F8`(R`zD%kJctWG;U-LG z0Dy!LW3XLLIk)(-2aM8yu?@tH#uUKqFUR}IPAW(#+J zEwN}nhii0F%5SaODY&Z2p`ZP4g#eb$EA-Yr7GBv_;2K=ya_ML429Z`iJ7LOPAc!mb`Cw-tEaRgbCaTrr@AZMv&3G zaT_T56dth&re{OKeYR%yy=QM2%*#Z?vd1F5PHXz_h!CDOKP-y-fUH@Cxrtw$kHbZ& zp&(X0FM(0B*B$f7JN4zgg|M@m8gFkO`<=Ji6mM`XXPhS}R}MB2h&Fbk31_T|?B`fk zW1zUpIAw5l;EflB_Ihoi^Vp_H%F}{3GoPb}L|~PqisuG^YpaIGHgX?`JcN!eBH<&# zw9STMkru3K)K;oInC*a?k^v1C?k0w0@oRrC6K`C)Q!J6>S8^ zSE3wxC6di^(?|nZS!&yEu;%?9YJItl-gP(!b-x~(1;vc-Zdw0cT$hyXa5#wcqxZR*i3>^*hq>fP{qViBY|kqBEq{e zlwQQl1__e)CiWN$^9GPLFP#v=A|~=ap+w5tg7gQ<&EsYNiI$@~jVII%<@?{?t$<2^ zjmEr@pVi9mlmp9Erzpkn~ySAsf_Cph&= zNJ^RHvcjK-y<21$l;1XbolSZ=5KcD#gBnd=K?QtVcP5S4&NndgSFIW(C_!bZJNz$Uq33If*K^RwYqph|>j z<>Hv`KkgrRrW_Bq(~QL!I{?m7cUr2}tq1Uwjd;jfCMcvHfc^QN=>*`ciVMca2d zc`Z5j_m}SSE!irDq%mUrVLe?u7T`EJqdkRb{~|M8AG z9nDYTbkPsYYngp8v%wjq_~z;{?htV4&$q3@9%wEkEAB3yMBs5=9bIn=WcFFg_rAH0 zUp)wD#EuHW$27b1RxVJTv6fv`V~r7w42%HTOq;dA6>jNwl3M7J2TG$OhC@EB@&d9c ztv|N_nr2?8d2c;h&aR@hz4m|59j|rD z4M<&HhdyBXXJo5P?RLY0tfvPHqrzlCO08mF)rt&IpHGH^2+FZhI6lM8f|?E|{dX7e zVbfdqRk+dF=N`f1`>O<{kTU(4DKE8{yExd%-~Us>=%k7q7L?NnN=Ypm62!6GFB}F{ z1=2s|1JA%<#p2^0>E15GUZ;Fc6H;AysQP$<0P9ity>_(v!L(zuTpjxnf4JJ~J6gTK zPG_NA57c)eTrg=0eXs2bX&0aLRV@Zw;*%pxL@NY3qLJV}or!G+IXi0t(OJ0Lr*^Ku z?Vs&Yvq#rZZIe6i>aaR*&?c$%wR-B*T3SaJR4XeTAGCmFZr=PFkYOs8*m9yJr(t!+p=N04Y|eA5{WM7;?}tpLlydMZUP{;gVcyZPaMIT$Z56@}i!8aV;`DyzDV-*vz7BAY%4 zRx4453{9~Mk*0S4j0J#(h#KI_tu$k{6k&`1vp9t542~$gxT2>N*UH#Ax>VWIvJPJX zlrvTGrtM^Wl&Elz%a0{X1u{Q1>(N_^@i31Qa{hapC(Z!DjEc}7RQEtbP#jx z4d3+AZRsLvs;i{P{%}6sLs&~7{EQRgN;r8yUT<(_sE!95+Xbe0zS)PDlEaFC9u7Q!C zRL;Co%lR|xfMjo)X#;W!fT_QljbY#Fs4K0fbfUIZALO*GudI{lK(B?r9QYBg6&ZO3 z+Ef`c6d9Y>iA|CXjjN@xaR06n+l|iuhU};jw2sxnBp+MAZ1gSfdh!iG<>;Hf9H4D{H%Fh zIvaiMDAhkw=uxl_v|rSqt`;pJGZ5}UwY&LgoHCIz0;XnwK7~Y#-mNJoWd!HC{(DiyFzZ(GLeb@uChp*SdAdei?Ak8`!?JdPO0iE@^mtN zB7LGOwHHl2)gB-de(TsZ2$P`gfoVpEZRfJRbkbQhzE=s~UDv39ZMKZJI zzv+o5t*urs7kVKytktEPEOTXgI(>(eT|^x^qpjxucvymN{Q5}{Lw$W@CO+Kc8??oR zw#a2ntzQ)pa&Bd+-x^X#>~S)FhatjmUO%~Yt-VI-(%%AtA?!PblRag?LC7N25!ZbF zAc$h{=?`GJs5{5>fNEQS-s@wL{A0u(n2()$!MSfs`-*-!P{8FeQ%&NP6&1@hF*}j; zQjRo4#B^7_T!l0FO8GU_He1=c(qs~`XvGl_ZNsO)G5Y-5%^~dUgY|D`V4JxW?boLv z5m~PW>v>0@ryK1VRLc&e)-6fa&WUsf&YwiW8gPJbb|SG0DQ(}MVc*laHeXXtA1o6q zXiHjY_3X%sA$Ej+Hu(-e0rlM$Ol##y_aLi6X)QV8C9R8Y&=BAa{@3i#$?yp#%!?`Q z_1idF!^l}nvN%%jOc2S5>xnpbUF=oE7s9N43WSVng>pR9`YI6!ZxK3(=e|DToJ~S` z?q>jvUNTafvrP&CY)j*4HKj-ucJVkQLsUqEM@a1YMPuk}ZpCN_1okJ}Mw8dvi-JHV zb|-1OD|99hr7EGL6Oi6#s!IP6vD(q?Q*x#Q32OC}OLiX8RzGxgeo|SYfm7~!@LrX1q z2HEH>q1bBAoNJkl)hP9-f5`!kvkdA)!^+=k?jS>6QX;1^@x}CDBUJYXGy64P)bkIg3yMka-ll^Gha+Cjk6( znJT6t(M`l>!~XoMH`p=B{|`!iEG6syxiExNL-o1JCXuHvuyEl;>o0%0FYBg3Ni7*I zoX*i&WhA><65S6bUh9|>EgM|k{;%I`ogQy>B`+6UTg7SUSs3Sz{5l+;b%y*;Qk?hs z7D~;&--gMZD(up_pNc=E#xOmnz6IcC#qRG7oWNVRy)9f;;BOq#8FMuhby?R1<36?( zJ0Vq_Oy(rHREi{7_nVVDBpCrVPBXFUbL-w(`?n5BE!Cc~u0KCEfkdj@IF=|>IluJG zngYx?D%&_B)(-t9B#Y*QP>noMKBqglhII=jRa(1Pq_mX0rt*We^$c7O`=bHFo|W0r zX;cTn$>wT2$_6K4(Lnvowz7xh5?xBf(dBjidLY|8!;X1 zJ*71yEBH=te%37J&L>IY3MRI+dsvu^TFtv+fw;*4Y!l_v=?87(<3OFTq6fa`xTaRHq)hehYb?Dy4XM-M%Z-0R)qPC6j{gs(|Muy(+!<$N+yto(d)6&o|F9k;Na^Y8o3#Fqq*s^w z4$SS6=A_22Q7_-HP=KGh@vHx^?yEdnqVKrDbc!54998r8R|tv^CEB6u)QQ05~V zV&~q3b$-jr@#SnDESiMwvMc;<0__M_eZ}J6v$tsa1~#!6I>qdcJ(dC1_npTC5+HOJ z!i!b5PHp(|kb)PNYDzp-`|K-~g~bm6^}2D3@Uu_$g0FSsf-cJBA0T2&b;d{`)|sjR zRT^|m^#d3>vu6Z;rco_0W03ejo|m>FHmmoz-f4tW)Ej zwz%eRra81r1DgelD>i_HcFRq7tCSP?yN8M0t*OtwZe2&Eqm|F9?|}STcY&Cu8kt|j z5${}W(?f$-hhh6EjhIqH`#sC=S<=CjF+PcSma`~6Mg}EOu8__T*aaj+0U*1-y;db! zTyDxf2rZ3vn2Q3OrS0qe_l*BaU&(K}3QNfpz|-8jXEWC7Mh0+=r^z@B2IW+?>u!7T zR{Xx!(?}px#SkOAmtbJ)-fD13YI4TFId~~ng60XHP=@{puX;q(+b;`HmA@8J(D=H) z)(9J|f-Z4Rg6#3Rp3Hm1s_f%n*s0FGjQ-s!Yz{p;i#QkD2yw|_+g{TWgJYmGbS~8d z-H6<2RANJ_+zz-vmO&=|gxZc>V#3EaWdKX8CFl7b^KYksq3@@`DdpYCY{!_yvzgG% z#xsUA`TEb$ zA_Ez)Qt9G~I&Hrt->MwkU9zEF{P{J17z!_G%P!|{E@NFZ9@J!BiS%Hsndopkpikv` z;PUszbiec5$-OmynYE{x9G;Ery}l58CZC%LxXEV5Gn=o>xG-XKs!{M{|5FK}_X(`d ztr9yx8-Vr|_2Z>>2yLSSs+sn~iy<>e@n4PI;$mdm&(lrA{P zmDvHPvSYp8_#I>Q;Q~bhGtSl<4W?{)6{hw7GweGZSa9|}GUrGD zzzoa|nWdrJVe_tytu1X3Km>&E{b5yCyMr%6_X`!sQ3dp5=-HF54^ca~56V+6Vtu^9 zRVnS1^m38hbXPow9TG!V626P*`LLg-))n+;Gsg2&u-%VAb7t)7D&L38*AMPx@7Vo% zL=SmgQm(44v&gCWA9rXTa91r=#TNDk%`s(si&BOEKFv-1CCT_0q&)yWPvPfdf8G|_zA$p}}RC68L8yqPlaZ zcXxfV0lU*%Abc~Vw<+wv)RQeR2}wz4_u5V9_=FpsbawXHO}xAI4-);?R&R3OBGc{H z&)W3Yr+~o9@$cX~vBRQZ?d~gGH%oka$s_}gUpe&29eXwTCwS3`dbH13yWR4Tr%#_Q zc$OOY2+sAr)C6~T=I?UjEvvHX9QgXzua&o2@)jH8jV~6ICc~H}w-U0oR`G;`%Ve`j zAHiw~74#xaQrS4VhrX99b~N}%c-Pwe(1c&%h=tE3x&TW+)2!sBsVDq#o|9fnkfHkGrCM5rIrr zRULNQa`2itZPPe)L)Z&OtfS!7XKv++tV`wh&|!6$io{iD<&&GiaM@4{=Eb(HHfpEs z?D41_F&hbh=<{PuSH*4XF!mnZnjWv)SeX5~v+clx3BpPu@5(mVgFNJpZa507Gxk6d zuf!-tZ>F9r+ld_2W`Jm2Nx^uPa&JFf;vh0}&g)vfsiDd$MI<H3~kb_mWB`F}Gj?L4gTk zP6T&G^&?@s{YqENzSM^yLNjd?4rlm-pTTxZ9(h+iyj!sipf8`F@om_1a37e#3qEU@ z7W0Okfu@NPwR2T_sExwlC6!($=f*^hfbhxrgaecpm>N9G02c#}LOt3kz{T63T{lzECQ$JW_5hb<=)3qaP zQ@tG2jm~t4AdH8)ygO>@+_+uKS;N*lE^_H_9mST8>Z!j{wuoDd-z>~>d^~3X4juY) z4uk^*j#bNN*DSMVj=@*Ci{}Df`Cw5!4E7HnM%KEGtpW5WmYOAz7?4?oR^8L&HURPSN=zOBTBwxLFPZhF+ z-LgsOPiwbhIBx$u#KRb|rgcyoc7XZP|1tJiW>Ga<&=;%q`WQZSvc3$jd7?mB5NE6TDoC03|xd@CiTZ~Iij+o6hdXLtj!MXFICo2&uMa!k9 z1BWq+TR1(e{nNJGa|(I%9}=p%=q*ZH3scAcSUC`6JNQaW@9+gE&hrXISH%{qxu$)Sb$qYNQ#&imTErc;ji4#w%J)35J9l-Hfi6Wl|26aYNRHY6 zDfS+~F<4A&XafT;kLB(rU@|u*C&2sZyJj0oo7wN82^=pJ(a{XQWuc73y5KAw)7I`e z3UHYtwOPPopG85Th6QnzH3`*a1top-_Xv<*Q-Z8q=_W0LVI|8^eq)3$ zB(gUIS~f5Oglva{`-0J3nD6#BVm~S} z$oq(+JRQ;Q4)bvf*KDO+7n{%3E4uSJ1Dz0Ile5Ni}ng-o)KEc4UzpnW4wX2rF@aXxgMuven=aPHPKZS|xb`jLY{Q zk#3)%=&rtqgGQNv*UNONhgNUiq38?-xvY%0t<%C?Al4>JA3WVF`T!Dd4UyPhzgwSs z8FrLDwEzypE`Tr9;HRW|Aw{l=z))>w&6pNi0GVLAFc`GIjxPUa{^&CN+I@kx1?m1d z1uE|~j&tm7C4Br{8p5Rz#*ZPqNBFJ*biD~pbT{nldS6=r>7OcBCmUI6n>IFzg3e%< zp&%EpXP1Qrh&Oc}-Gv4=YVn)&=pDY5be*94Ynt90y_>DYfEEGkPzxH*M-bJ6e`|Y) z{N$|{i1EN|ckRC8_g=No3vYe_81m1ZuKe@iX4DAk5w-fpe)i@`eN8Qx#(r8GtA-Ox zt5fOmkb&QT^yfmLrv2jgv%0|X*hNS6)=>rBiX#{qnaY;2oe#G(f$dAF1k>;u(psu7 zyES9lHMBj4sGMw>bV5g)2zvmJ>8 zV?c*IRy34;c^JUIk{88hz5_JSM?Q!K(A;A;iDOK2nOzya<-#{nQF~WK5*JM>Ye$=Ekf&lbd;xiW1 zZ4H9m;z$9;(XbwpGbjN;hnA|x+Mo49_t^%H!hxvtVQfUn#M@#iJ^mJ4A}+Jt0)dnL zYGB%uze5_3sfhD%T29mZ;m31K4fjnIz@__-aznt#6uhA@?sNDjC8H)9R`P(Wl{r1Y53h#=>vb>F{%xFx?Jo>Mfnr+b% zJnw{_LjRdWV>qN~n$Wg`JPjLA@IhbfKYT%77;V)F^pN@f;;)=!{~1~v(v=uSXf^fT zTz0?c%VVCiI>q(;*UwvO2@5!l@gL_7_VQJzE7M%y*Vu^KlEA0G3E5$GwTS%2s+$t| z-C#VXSu!GE(IHmmk2`}S3)N|o$n>qo2V&W2c~-6^CG{h}4-eqa^rLSP`=UUzqSo1i zZv$x;At$r}cBk~3e`_WnI-|en{v?NoF-)6|3Lki(g^gqp@IFwBgOn2oEE~T2GwfgF5Gj)u^ zNb$r=VUr`y)Hn2gGB{3hP@5;VW~AONk|gc@`3qQqf{6uc1RO-cB*P^Srxvt>y!eW| zR!pM-5u1(Vc7G&{@*kCW9R@<7Vv>+;L1gbBc&U`m&2FZWNYG1Y?>(heoIVnCT6-$t zbhD;|#kvL&0Oe3I>ES>hVVDylG5c73flMNpe4uqedl5_?P&XhL8YUemA#hCu^EY7^ z31;LUNAkIhzmvixKj{B7YJ)997x}*T{1s&Sd0Yf!6vZ@Wei$&5bN^$w#QZRO7F|-v zKw22t0~%aL6B5}2{cKCS718&l6Vbq z5`c$@*A#bpF!>xCUkUN`2UD59(_32-^)73u5NaAztkeS=r`Wbz#g9(?UYP8zr$ukS z5VX)IcHOV!WfvL&2IozzBYfMPfy92MFf;h_E=!%C8A@q0<7UT~t-PCDS0_F$Zc_S= z>%B*RAds&&3frp`Yp~?&>|KAw>nbfzv1E8P>kSw}dL!}*bnCyvJDcLX^R|TCz&6<% z3EGhEr9yr&sS#bfJ$}d;BWKvS6jNZ1cx02Mr@gZ)Ci?sZYzxr2%?WqW@y_2h8}lLh z&|Qi0v%MTu?r(lUiFyclNJrCyftN02TdX#)zV*5D5{n!QNPGYFZ-5fD6#BwZ4<|gK zQGni@#Zb8;B40ctyPBr?v(KoNr4a4^us^cJ#{9Sts6oZ)I~^z-g83o){ituQn-y7a zz$=PB`MPo4;)W8(u-e9oX>#P~Wbnd2j?c$hFn>&cT_bAe@7ytyE|wb`r7HS367;fa z14>Gv__8lQnS8oftp(}-4ghHMzR&C@anLF*{(

18N#!?ABj?_63h>ue1D`%on-C zxTmAH3acw%TQM3AfB{Juq#5bqpXDlMuvGBw$O}2mF|YS_Dg5b8C-P71yTb63X<5+7e0t zB>KU^82jzU=JKgpG>5H70gYaWmXGxtvXWYOD;4S>o*1?+pnA+^7v*iTVnh+@;?rUy z+?ltH>tHslKvIxpb_fXxb}q!!Lz=7McWB#8kZJbM@F=wmr4mPt!25g|X*VhuQ%XU$ z0x3jc_JTS!igZ-m5BI{L>n+`b@A*PVJ+v~jX2C?YrqgK#ZyZ1OszJsdx(s`>t()$v zYnZn>g@?*#RGeR5C6B9B_U4oaS+i!Im1#x5Y!XyV08gV@zFOd~xmk755Q{pTRiFV$ zdGQ}5(xDBHsy)9CZW51%GD|Vb@Ag~yLcqIsjgnAk<+q*EtjwBmcETT8_`CEUdX2>~ zQQg&Zh4O+NWa13R+OdCoaKBOW3*ppth@qu*Ou_z8OQ3o~bjXjy_%MKT{L13XiKuU9 zAZw>3Ahfs(xqrFOY16W6$d5WNC3;da30*FsE)fEQ*d~J)XCD25D9|HQY5LJ;#l12GzSD zL>K%=@CO~rYJ`IX=}=9v0OYTgPC~3@JJ0y5sfi!K?;A)t1|dzO(3nruxap*u!N{n~ zlHg%?vjS1r@!KD>&fc-13K*oSU88I_y2+SMMzqL)|IbWRaW*Zi^&5 zprzF;y=vKgKN%WN2T{jD5j=3SZ!$|gxx&7GVl>~BLW4)__9s%`-|m})>k6-?D{5WZZwhwWdws;hZ=d0jmfYTBH~_|0<2lXGIg-vBmR8cboT1m|qW* zGRdb6a}(YRY`tK{SMvIP-j;B*>E63Vaesic1^=oylUYqYXOLn=w6#=tIH0u?9B-n? z1m=aD?WTham9_JXMuIX$bSy!U+w^1E0y5fa7}`283HgwCSxF-o#aK-)E;KP|0I}+c zU9{4 z8!*Xr1&tq)DJL8gBGvrlUDMH(QIV_~t5e({oOnw5EB@z(_)oteSTDuUx8=;GJ07uL zKI?;lSb#sJ(O@Y+60<@eD<$;J@Y*^}6CAPsh&uDo=PA+#HKmzixd#*65I@HD4)9kQ zoB>)rp?qI$C&A)U38Vn>yWgH=Ay-v$WFi0PLG~Wyta=CB;Ely7l5jcgu^01{@X0*n z$QG?Sm;Ucibtx6zoR*hVJjYp18whEtJ5}Qiw8y&n_j4{?KbVHMk&Y=>Vwcl5q80Nk z%lP^wd%oeh(ADN?Sxcr5W9}L=%)))d$BM@g01>p`wnUMJXPP_=@9S0dFD*jxV7X6# z?=&;g6i;Z3biqGNQD2YsI&0@9oe;DUUw`fY9YoI1abV6AUna!mG9=GtK|?LlsnQBd~3wVA4t8G68d|B9$Ju-nFycZLKY!x;7(B?f=f>fb*`JVbz^d>&^h z4o$7*)>SlLnPX@<(ci^{d;nLp4|6i59qimjB3HpZwyJ+e%HPfT`#=)r!Gg}TV;k2p zYl>{(3Tuj;T3~8e-KGmd{~O1}mI%33s&ABmr{d2h%RL1BJxxDdoyH-B#aI`Py=aMk ziaM6hLFlbxk5g#k1wo@2Lo~oBO{H6hG>!&NJU$9ClhIeJOnOmkfu`{oFW`Lbj`n=# z;}czF8jCM0GV|@a^DN@`&?=STt4L=T3WF=pW)BkB++B^)w2Or;a!AsMlCUJCjc$9&E9tC3<+t! z1VK~M7z*+2M(4M{coGtHe_y%}#cef2`y#K9upR9dYYti{f%0ggB1j6BM63oAO1=!j z|IzA?KE28(cF@gb1mCp!)HXB;A<`7mZBdMci}4zh)rzK6d(@++HqWg4zhThhLrIhV zM9r^(sUIFC00n>xojK&3n)M`)90S3RC;ZT@m<5BOixMNZ8O{cqjYo*3YT#K7f3n= z6!!H7uSnoHyggfGteIu6>p(Ue>%vN_l-3|uvY(^{m}=Ql6@{Gt>J(Y;wGE_lJhdO) zuQQ}Qy;u^$u*NkLN=u5s3 zhMLIt4~&GfVQ(l08N}3*aw#y3#1HR|G9x7ebkhFPbhLnE*XJkVF+Bo@NLNH>t$HKy(lY4I&${G z@y2VmhbSKFJoYnfoJ#=Ua8xHV_OkV@=r!9QnKjRFr!~+YL4H~e$LV}XJDRaS`4|b4 z;{B8RFELdz2N+v~!6nNdq&Kd-S?{T1@PU7lF-I>*-Gq`I-kw?2*@9SmSWX;sH^y9Y zJK`Abep;!fvplYlrm^Uw-QMB(R@+f9B}OV1(MJAb;H-iQA&;yq`eZ_ky*u z;7{+OES>GetN9!Nh*B~=*1|hu;9=<@LnfSfji0kwKN5!s$<03P>*H%vsvR>8GIJAl zeyE#+C9d=wE}$kk%n)g)+gL^a{@bP5ANAd+k4ErIsPS?%h7gIs*8TF^VcZQ+u-IV; zW+m1W12^X47Ztd91<}Thc~L>?)^zrS*!1jUDEvsf;u6wE+A{&#X}V57M~}g~U3>!1 z=}^T$-+&W=XoP^V-tIXC07cQB(AHr-f|kNMAr~g(YLH~6)maXDo?@zKHx~TJ3zN_t ztniP)sM`9Gvp7v-D73ExWR$@UIhN9r%OVO)c0p2$j&j;-OZOwqVZ3*_=dc;%xdnPjW7w9K#myQ2NV;%WNK#9igtAbdacSiXVGOlTmv3MK}qD3DhLlZN8e2ilrH zxNd?W#+y_42)u`F)Wl6St?vK~gg80ZFXtOSk0x*03?1VLV^P9Y^skL2t6J!g*=nz!*P94Zq*Qvl6$gn_oC*VaAh8L6O1x(kC<8gDp%3nI@BPQ< zGY6D$49(*u&}G7aCf-ro@;7xD3sjyJ+*cOFTWAeL9nZ5anM2XMu^Fu8w4*3pF(f>t zXHP#pGSfNfwlb`|SwP`!!2Rds_`Wb<6q*SitAF^C)@s266qN`svjGpe=+TdaCc}6R zOvgBL1fC)OYofxa-Yspz;1fiSnjh4zloD7!{->P3ek12A0ItQ`^dG4``fMBy;59Hv z_%pC>>`(2sta&`WFZq@j4?ttJ?{UBn;6F7?R(c<}HViz6iON3Jel+Wi&{2$>G$1X1 z)+(LA12$xFtD)o`n3#Gb!a@+0t%3Ozu=oyxnfjRVH2#&OcqG8GFSS2Cw0csgpEpGu zW2@RAgTpwONt(@nS$3JmfZjtI2yu_W1h9@Wa-WZbW|5o7k?tx&WO#R)oEGXjL?C)M zlG73E8+1G6!5P}f#@t&@%EcJ8aii0TS>XOv3H~t0r7(KHh-z^hiv!K%92y~<;t@t4 zp!u9ySeX~8u)ku5BDN1r@M<7htt$hRCM$=e*Y1|<5jr^g%dg!ohw>;7FU|oa0NC5A zyJz7f>f=vBV!U@cVeI8!nJ=TVEg$-nt-)eyJMF)qit*S7Z&);D3K*0JG8vx-Vdsg+ zral{~=TM}?^V@dDbjV7q6EHs9z#j04mHaHjt61U{qWOVm%aM2Dwr?0CGx?oyYY&{2 zF05f`yO)QAzoNv)95I<$a^K4@(fUK3{Oll*NujyS>WL15m*^rFf-EGoYzAT5tF`@s zb2*yGb=hw|=v6*PZ!cQ z*tsX7M+ADmJVT@Rqe*{Y%1(rYKVBwK&|P~0EJJh-iRSLWCjXO`X&2odHiw7Ga3!yC zFY?TjXsh>(HqgkEbhvwt2iag>4u7!BErQ@>uN~DPDmn{4f%ieidOD zvujV4?+~3_d%c(4??LZ-sq@PtbgifhkoFOSoI6TyZU3$E;c+tIOK@G#l6P$WC9-WQ zS<7PNEIIid&Ndc>ZA)ExlJNMkxtyp_>aqM}`f$Jtonf=;5V+Bbh6(W9Cs%n=%`Cdg zTnM|`+}OYs!VnK`coLnIb0acRO+Av_U#+IRZ)CIy$<=r%l&;%qb*1|H@=y+F{AsLh(pj~C zP2b;Mpb5UGwW(ee0pQ0(xbY#2Z}-!e>IgJ(2Qy4ja$}=yjdiPX)>i*Eyc-hu*(>%L zijqX2jX3I)WocIG6U-`--Zy7ra9APYoZCtTu4ITQ{v*8a)?{S9M&{eUJ8NQ(+|;DP z@;|pJb=r>g|oE0$%kl^-I%#d-;qgX1_aYFwaWCFbNnyVV=OGZ&Y>ldAn~b@dq08 z`p+}xh3GOH)aT<16o|*7eT%ie#>5BL+Rex6u5JQX28cC=4*k2rU?*gm%ev0K>Tu%`tZNQ$xP8_npg zS2*QA&!W+~bJWg~9lAO4}OD!~fz?}uFQ@;YNh4jQDP(8kadNZnf`}BKm#~KO>csXlUl~<*9%6!0Dea@Oq2pITEJiD+f1MpUrZ>7VzBBCR( z+b(AyCc}B>E+kwFj{JW_-BWaBT^BCuq+;8)Z6_70;)-qCSQXp0ZQHKcwo@@zyz~8M zpL1?TYwK>_%(mv}{q0Xjvk(7Ye)<}sYk;fFA}jAc}F=sO_fLkul1p?>fW>A+xteP?vcQo z8bec57NZ^2$B~?8>J|BMX14D8Ta7D6Nhx}^0w<>W#ol(UM@lyB!o(q?9oqwn+$nN) z!vV^r>=Nw~#qg&EfX1uV^0zvZx7c@rdfXtk@JJ~OHN=lnROZ2k{1pW+PS@riWEOg5 zB9|MooWZV_KsxK70Xre5Msji6sf!;NV_&!kD9&s@fVVzKjv|DIm$3d|63V=eOxAn& zdn#RCZaH(7`&3F0Xf@b$)#3&2H^BzQRi%;Y2qg@AsYBG|Z$Ezb7P zXnWbT`JXZH(=Je%=D0J5C>6SX297n$vnk}@A+tQJbRl>WOy4t_(}zi4bd%7tP6{~{ zi3+~S#}C>d?0I~omt;4mE6qo3x)L~XZM||_4JQkF&b5)a=R~TO))`}Z zdTz33T`GS9uHB2aT>dkO2us6ER>XL5lu8xz~M?I;#3p&qmzcbV({t1Tkkhe8u zdRdhv;+7tRLN7QgH}55S3btdhWnuc5O_Tiop-qUZ&%RzOvHYb-l5U)NCr<2-^_x&# zgK6s!(cQpqFzLuOv+P+iD=2n%5vuf_&$nAS}>&MKcai#sVskvhV`8R5h3jDlJIC9Hu|{67$G&T%GxUz z#I`J+O-s7B_?0JsIzkgYXba2ap(!8AV=LW?+%l-$y|uQ1%9t)<5zmy1CWZ!Hs9I? zR#jUm|52oazepq3vS`FPGKZde#ztNPY+m()$V0biz! z{Y)8@JE-(4DPS^}@VT?I7gELlq1{T$7=p7|)xC0vW^j3gS7K($ivrTxC`$ijs2!8_ zDZVq*qJf2`1B_li8-3U|wC^h|(t3M87tY=pCUU3racAn}-pCnYw+=V#A^=<`$qWiG ze3#Q}u_NXeN$;tbd+tJ?Cf@G{0N+yYs@taB(6^URG$HF_=h`Gu*$_$Gl~^V$pB|dM z5VSbPIuN+EVk-J*Bh}4g6=T&;yI1eX7%_Z<+W_wIRQd+6#S}U&Am#$xkgQB5V@}R zz-YO$l~I42UXW0kc4)qOIakChpLtcG{EZav?kj8~9F*M;Jm80pMN1Nv#B7&O)eWrC zby~R&)UxfDR)>F$4W-)E(09A`)y}jkGFp!i!cv4qvN{moh0kvX9H1Y~B;7o@Mc@>j zw^Z!D8p!*MhI3LBG&kUms_W{?HV)h~cB0Ng!cy-@^Ugt#5}=w39u$B_2yPCvQyRk3 z^&$@I#}2{O)c6IX#Q_ltN90^I%X-jJlZdU5jv-;AmN#f=j*+Ep7+N}LZ~IA4=I%-K%D z`M5w-y$8P@-^Aek%$wTA0ERrGh%E1%r|i*NAeruH<9{>fgC_cEKe-m49LkaDX@3!Q z?Eg+Pqg2XEtcu*eI5}*Ddb2kLbq)mNBQ;4Ia`q(wXH_M;9G@=+ppxu?$Lw$FU;#&z z{@I{n=c52tdopG_%YX$1DTejS@J{_P^MDkts%w zWS#QJ0kjTTrUUYabY2qP9$}+`R4_ zG~Y41^HUw~w^Kh5zWX#|_8mKNN*kb-e8jd;MZE){XR#F^OY)fyVBoq;2@p6Du6iG8 zwW^aiZL5g;eUyHcgSgOnUj!5Vy+@u0KAH|Y*D<9X)=Z=D`rG+NS366ox`XSf(*5RH z_Dq$WdtL(qKH9$P-e8G}c0by-O@f0zJG|{*x7^OUO})3CsxJXnZ#eq4fk_!Angqy; zq}S<6UAC=T8z={wL@e_iXvMj=B(i8x?H7UQ!FAJXV9%uA$=lOhz|ZDE;k-LaMZ<|l z(s}em{P?3{q_l$hyqB{DrjC}5KoQV9edeM`U(XxJ)K*1A8V!^x21a$>yqgjow z$p?)v+NxlYGg_!Xz)80^!K`kqUr)fW9}icD!{{R6Y#>?*($k;K#vKo%`%8}b*QYhC zRw_4;o!doDFqJNAlu7KcHZbTDm7k+SYxe$@ONuC5e>ngSa{jPy88P#D_mij7YU!1IQ5S3`PUD>=7galiV1Q?=TnW^a>eSn$B^ zL{4tEn?m2ozq9EcW-_+w()xNoOAK#6jm5$E3+)5KOT?Ogi}FH}5AxPDEiRW2j;7H1 z0^4GHvA8re>Y9)2K-jaXXu)3v)>$VezgI@hJ)2^yjvu(3Xs-Pb|KAZTAk$QxG9~ z2%sZNpU_u3`fg`2$PN<(kOX^oDs(iLl8!!VjlvV53O9at27hZ$JHnf9YCki^XKMqI zj6Sj8K;dV{MM}r~xIH7#kFi1l6JYu8nCzL0Xy0>ZTm0V7=V-@n5hPgF4FP&`Zvr{A z@doA2*jd4YN=4ZE`Te2S!NK4hndNWWk50uKR(tIS964E}o=T6;=hZz_ym_?c_tp1t;BBS$|~)zpHsG8g+l=7OK; z^w=XW)}p*}^jsB4Ot4prf#dhCoW@w44tUW=DVoKYEIa#3jHg@riyWQh)2EJGSa6EC3((tb_@02NV6ZfsQ^;-iR(_@s z0|d*5t!n0(A%`A_bd@@4r1R&A8hU`2q0UeLClu-WX46 z444dMJq=#zgc`vuJ369w4}X9lh#3kTiJ)dZZ%sh|YQ7d{kyX(Y0c-y{8NPgj`T0(Z z!fo}8bP=9(pVok7UixlB0!=gl-wfp_AlwKYqz=V7BZK2#sEo0#yco}dBfP3{BR!;2 zrWYi81D*q2YVaxKVE|BK?>y~EIwa{>%)77O?D~f?S>{5I{iJ6eZXQeYAiG1R&+j$% z<~Qn76C^;Ne%jY#k^}Y@V7dJ)a5sEF)qd{&erKih9X_=8V@5=?OFKBs;WWqbcnBHC zmRj(iyALsOIJg5;3T%H`Hf9g$7UAE8_{l^Vb;^5UN_5htH4=)Q1bKUSL}4+Z@zu1O z)r=fNQ?d<}hKDW#*`w#iQfGOvXn2;qz?#9_Eg%Ved2M%h z+n=YF`WjYjYFSvH%49J&+R>nj#zlH<8a?@@vhrfl0B%%_Hz(e;Z}mC0j(hQf(iQT~ zFx7ZtXkEE*@ck-a&NzZPM#Y-&1`i$$FPT-`&uIF6C($znbA8^`(VD}&SeeH|pQwQt zKh6+3FaEz~PygoJX$oK7CFCXVFT$N5tkL@@mft6Nx|z#|ij%7pEFexeu{GnuO_lLTGEUy4Fah+&$P(LCckFLLWC3Z8C1L2F9~l+Q&g<}97> zQP+NOa8boFDBj~CEha%#>D@i9P{^yTuqSF-GfW?_O(VhZZb~vobcDv+;%XN7PTTV? z|31Mg?|eP@hq|Z+wLa4@ah=Vvu;R)Ac&0}5x!46yaOGzjRNtJqYq)CqhxnmbIVf_4 z*8TC1&fd4u*6CH?VZ$lzVGZAwFsc66f)!Fz!~_$)4HFU`kh6V>)}rpyziaoHH!ypo zfQy^qh|(A+cAJ8EM^C?^)#aJhFGR}`rL`9_1M1Y-WfWE89!T(#1{_h*d-2jWq$u7icdKDj?kES= zzava3f-W0YisO7K*a^>UsfGp>e@?M(z7U=DBo+`|Q37HO_V1NZ^2qVcO9|}9B=z)u$7ealHxhh> zTBycI@qeWjdrOepf3;XDrw}7h3PoDuJ0V!aDNLy_B=C7DxB-BnY*KPXkyEN492PMkR1QZv*!V#BTMH*7MSxAaQCVhn za#aaE5(vOO{&QBdCt(W<_@mTuf&165@uC`cFHUCt`$ZN-5G&~@I289hF z3>2ukAD5K+FpvCw@-yQ`?ID0UP_575funZ|#Aj`vEuZl>wJ5H3iPcDJ)A6h)zT(Fm zYg#CPLMXJRRZ1SG-ng#K-?_O}&El;zxuZ3tE_p{^8>s z?mS&zztEsJb*1O&SyIF}kG^a(qf7zbM*J}-4~drdqBZg;SFw`vJv;fx&kH5TDvVN~!X80|XQqgw?~t#=M)hm-gB5L@Ll8@H(h&fDjS%ZZzr`dI**aEI3n zil(O!7(OLzAeaj~LcnvVoAO=S(~#^HjSygOttT*)yxcj#h`8kS(qY%tHthV5b($~p zKOf81n_ffZPN+cy3ZE&a35gRgLioRA2=YhrfpNHAHCi%BbpQH97Dk(0MZiKu^$uw( z`pe{Bx#Cu^USOy|S~tT2F$DpWofx5dfqvONgZon8>{k=+UWp9T#O5+t$w%V@uA zgg6&4cdzNV5*lCsGF06lCInTnkTB8k{*0T|sfNv-$bCxtWRtVAP#l1$ha6G{--Kr4 zW|j{v`-O{bF`K?B^M`JHqz;o*+(ea3-8a$0A7@c6Y7^edARMT(sF;_E;D`nbz=M&V z=Xj9``{^H2(|D99)#menTe7XYNW}Q-NgHGjSdZkd{A_9YZJPJn8A0N`8^MM|iAnIN zY7~!X*?ybmN8s=PaJaP_%-6x{6*0Dh+NK={4&?T&;U>qa=dhiNpIYH-|9;-2+PKQD z!)#&|WWsKq7Hnv~`PR^=M#)z}Q>e)~{`<|novI}Ay<-kacTr=t^wG+yxSOn{dd$|u z&{_ZVa-S=84AS^1eXJzKhKG&=hq`*jg2RDKt8l!p)rK`>7{Uqpz*cs~wX-1sJAkOY zjVz;WUwepY|Br+brX9$8!f;1k`ak(Cib&R$^uE^HUhxT5lv{{(InOd5`yVW83x%b6 zN6>%NOl|<{c|U$fUw^C+U*M2kN$x$Tnd>LzH|d>vi-h~#E(Vpphgrsi{p}ZDN9#a{ z`reBqzhY&V25YnC0KrcC^^oG(b6HUZ!&3!|!qz>wi`%m8V5MbI4|9L1X85o76T8Q9>?OET(Vb@ReChHh zQ$AuAT|Y_nvys%S*TRtA>BG*5L$2n{g*IkrhcBf&up&1v9eN1)Da~NalfKMMS@Qo^+S5G zP-tPmG29T`BgmmH+O9?Z`w?^r&BH$Q)6s6K8m-?ED|aia4xoCpozEE@ zFb)xJ{jS%jwzWN&Dz6{|mS(21I~Ow>nBiDxqlOE2Q3YxYm_z;8#}+uz`+0KM@cbKhWD9g9&plzPp;Q7 zzJ_L%l(?rdCg<1%rXUK9ZCN0CC_q;pfUc_rHJv9RQGjz%jv@tcYx2~BlF`=T{4wEz z{v3>gk;))a=`XDJnuwKf{7wYR{<>7J0u*sXVmweN_5!+uC@*xc^J+)QAuyE%& zxDGq806})5kF*_uy|Ru#bHABqQ>Oct^~aeyx9*qu6=i%s#cy(*$xHOniRORg`s@?t z^nc{~UAg!-x$bC}%I$_m4{)&gJ7L^+Lyft_#Z-cneW5!R+Qtm=9o3Xa5W~icJSU61 zAkTc7e`<%+c|O%4U=}(?AncI(%r&em(8Ry~C@){^7Tm+Mqc4j#;cwg(8i57>obK5PhYx71MtnRZ<+*M&QAzxw zv}%Y&#V*8{8whlbX>4hg)(Bk|29&?;E!a`<05B}RI@ zkm)E!k-QwnZVGzK|2A3Ura|skdc@w2qHd?~5sHh#x7ad_@VxMEwFw~4m&P)Lx!^?M zMY3c$;R=kv9n?S;R|Kr>fpk`I{#bZ`-njm5%q~cAMw={10XU-%neyVh6xQ{F6uk=z zyT-coe%>G4X5O8Y@FKa{XS27k?Tq8!efspeUixCJQJx@J-IXZJJpLrFZrekpN_yd# z%<_#t7&e3kS;-evm47QxELY^`*)f6W4n@*&6%qK1+Z`Fz<4_~$$K)fDxDd&ebds13 zCvjJ7WZEqh1k6vIU>FzAMc0%>NPV{ibzeurh&YldH?AAkDb8DC9H`;0E_#dcV%@ICJFg-qw;+%X(sN;K!&oi35V1AS9T-Row+1mluBhV+SLUgA&`L35P(^+jiFC= zD72*ahLL(Kg+=v)*(4Q78jBo25T@XPcO*)^aV#&BVVQZMq8w>z=y$(2fw>fqg6+2c zKm%QRcnXpIFP_yyRIabmmpU>nlJ-*& z!+a(3Gsdx$$e@)u=qXB?FY!Y>yrf?qp`s`2h#~Cdsp#Hm(LvV-ZPz0?Rnn7%Sfc)U zy{{-5d+;*Wnd`~4^?84AG(R-NWNtmIq^euspV85+)t!0<`sG=Swr&8fPwK8l5_QjZ zzY9Fz@B{vX|4>q+dd+9-C)7tbckNch!q)K2k~IkVeK-F<2q!?EJS-eM<`A9YlkBBvtHqCXPv-ina%Yd8p>#OBp`1_hkQGao#9&m#uMt(Ce-ZnJNKOE`;muCwmv=ui&{x7dLMpbU=6aWQ)SxC|F!CdRckV1I16@n7@4HA*AwGmCGJu;<0-wH?N_6IoOJDK%fi z=PYvTEL!_*mMBLgwPFP^q2TIZQxZ{NV+xt!INN{{y~_YmRe3N8xz($bHdrN*swnaH4i43eZ2n0HP@(ww<^a#p+* zzVsyANzv(vMRH3C0}s>i=A=g>HRH3?I%W#;n+|X)e3AG{y? zI|?90og~rq*&KO>=ns7g-!LA|9%n$ z<{aZS7ArAxyLZTBs-@6!!lpCT%wNs_J1Ty;j^Vx1&_w8hX*aIkxc%O$Fh@ot6HGGl zLaTBp9&MqJK$qqpRZx01+DU{L{7US=+*z!-B=nB7Ts6Y|mQ@j$+U=tyqyEJCJim%1 z4o;$a_S;``sH(73;Co|_Np?E}=AuL`(u;VJSzs?BA-CE1{qD*7TEJ}h{@)|$3PkzO z)nTt(P_iZXSJVx+d-ziPQa0AwaPzjfXTluFbO_z?(jA3IUu?oy#nTAG{LqRb@(+VaFjUrX>gwJDu`nNfqF_mi z2cL@P-kjdHyMnF`I4wJMs7%O4OXf_-`zb4CG{@!67=I6<(vQqB6NZIY7CEMf{ol4( zpf>z)vy~H1*neN^5zV_$!ht4kBRjxdJOPCd;UZp(NhO<~p2Lqd?$ThgWDR6LNX;(v zQ!VdRTiGLR+D`znzTP>(0$n@30kF7(qt5ltMBDDVbH^Hd;&QoT&s_V%F{9dw+{Str zzG^kBrRLoAOsH!;2Hx7mNVT#qP&3N|;l8m*YMW4dG@FBKc5h`H-?1=|p`Kd;A^Kq# zJ;w-@-zJ0Z`wm#smmXXF{`|=#bm5bEhC)3PkYVlfdw&c)JQ}aX2vh#7bVyp9MjvHD zy6n#y%XqTFf}nw&q0mtVB!%bK&96+BkMt;b(0*KkxG#a>^Pc0p8ypVqt%-atvQ)>| z@R>32$%d!S>BUA$;xeK0fNb%XM|rUR>jl1$q~0rFF``{e$l~sWw`_dx-?pAllQ>K} ze@kUo#G(e|3R@MAAEi5uW_{LFqFd90L>7`d>0Yw_y+qG|VJ2=6;z0jPpj@|=Pj>+x z!zs68C|pPd^iD2uR?B^BD2bk0bVX1}ovjH9D0&z;S1Dg&r*h$p2+5(7gHes0AVkV> zmbSN-Kt&1UkyTcEB;LpjhxU86EVp*T!@0scOlSo-_?*YF>%h!i#vPy>wlc$$N25s5 z!v*vZO5i#Q6?APpk~=JuN`s-&G@{{hZlO$x3$K?g{x27T#vB>8#`m4lZ<1IaGw6CRmq?6&@=(L$>3WY zMjdee~T)S_ZOy5_c`?hZjbc1;+h0or~ees^k_5*8a^2N0@EK8z}vC&4o5D=}fH zZ?2kgjpLig%|3q1zXJ*+D^FFJL3?6@HpVwbH0RBc``&ao_5;a*Zb2?%w5IQ({wGf^ zQ^l=ukLf&Xb0D;R66BCbx>|H#lhv*X9IH*zfU=~C(mf}|3oi--T&(XE*hcETew&u~ z9TO3Kp-L^_@QD`w)b*D#A(}Hc2<4QA7&EL6C8p+lKwTkFzc?1JBA5F++Ih|y_&7mqiakFfEyq+k{1BvRx%&fx8JX! zJP)W#4deX^Sw?k5VUTD+H_^oQz&*b{bkRB8$VxJVi+B?~DG<(NE_b#iXfk4_ZG^@) zCgBm1un;sn?N3um;q)Y6jhr;t*GDBCXj`$A;8^;2INYZUBd<(7rwHS23$oD$*ftB&-FL z$Pw=EzR8Rc)7p7ii<9MiB-*QRAPpF7y=3*RX(vfzN;=l6<2AlTp2HArr+<$+U!hby ziDhB{9E90~e{i#2R9fMvihd2&wiJ51PU8gT7QTG@vc#yOWRN7D(Y7 zP8EIpji)b}#n>^u407wCa>h#E|N5Xh(z^X59QF-Ip)8C=4-ZnGF-mH%+C8j%&%+YI z(a|6DKcr3-zr$n#>?9g|F{c=$KJAF5HX154P_ev?ZZ^21(iWo7$PN6HZBgIHMmjYkiFtfgkhA55Rk1lG@#L_ z5#^{q?_5KOzZj{@6CX%KWMe2OjZqk@D<7IDzqN8wl2K8jS@A^CK&r36tVC9xc{6zn z4P(`johk?b4z=qns|R(3g5gR4SQ;2qXlQ0pJ{(iniQ|9{0%0nqh5F_hb7ec$`sap;gRg<&?;sFy0iC6!w-s zIIyW|!3A0LYZm@)`n9rNIUMLgb#M&^4annzrZW1_8312%2ZJO0d49IBr|}AgL_5OA z;@%mIl;gOZJvZ$I1Ez7bPFJ!(g8-A|6Bet$)H-!69QyC7NISj+DZ+=+0ddHcq9ZgL z(wsOmoY2Ces|!j5{~N9zVwaeegh=Oa z`Hul|wxOSAytBmF1uKCt&cj=5ZSfAEXDec5eGj4tSb1hT%a`9Uxu^1IHujW9tZPSC zC^d__S`G}_TPasGdtrsAGSfpEC;mRj`0ch+C(D+6xRNj?$J8KJ1ufL*JR^r zh_N23hF64{$sV6@IZ&)8N3ZslGC)aY$1uQQWz{|F6ps84A)nXLzdg(<;7hc{AytAU zGjwdF)}O}j5i8T4uIR;F3W=^CjG#$W;`H8&Za$8>NQc@U*`^M1vEVo!8BnBAo8^NZ zkH6-~09k4vD?NVU7L+=1FPx~fb3TrP;+dc?`|e$TN4o}sBDH~#b)T|O1vERK!YzQZ znp$%z{Ry$2KHi=&WF(cHH=$)uqb2874S;}K>r9`W=Iw3GJE1T> zscQ3dUV!8CniCy^=hl3Je*Yy)!SS2b_zTz;VJgOu>Ua(Z!FrcR?f&rFQkQD%h>2t% zZx54|64AP*7*N7wp$W}*Hg+@Uya!Nm|Ipotd%M-y=`A|8Usm_jGq!eyXi`Oc&mXRX zhZ*eW?!MxPHp>vk!1dvsBly@l$X8#IW)o$`x14Pb8yIryyY!^Z;Qd`7p;RD$o*_+^ zL8sesv3$~AVLbX0vX_}nxw{Bn_gym@dQQgQ4o+)jw>I#Zcsp0SJqaM`snsS=z(STQ zcdvt25QbMduL%)v`vVTW&BDKG>i z!A>3HG+X+xXaKd?!!I-ZOej6W9a}+(T!FoDK1ofM&^dKS3yTa8i-MVwy`rFA1la$R zX_Q^l;n*zygQ!~|pzkw@-`0EeI}HD8d4uo?YjyA{*x;=g%VxXD0Wo0QcR6*7aAM*U z`wo@jEmPV3s?HJnR}f?h5=_Kxof)};oM>%E#j#mvD#W|*4;Uh(+n$c+kn4!L-L zao4Z5SZR!s`1cC$e&g)@;(sl8K95_w6VTqJ%_!|lT!e3khf5flW&sij82xr6yZXPKj-4A9$%Bx!&M^%yL5?54}G@?iJ z1X#*JCTeX|5NQo$pa<`_HLS%EgOQVgzFXV>6gyqB{Km$ZUnP%4MH5Qq)^WULKK#w^ zWGZ&cyUS(M~d*_%>|xkTbD{TA~4!DU8U5-SwwE zbcS(PT7|XySwIZ>-HDGVq{m$|GdaP!@2sd&s=dyNF8+=D$AE^-wN(m(^iAyN(I?CP zX!M?n(<)~OogKVj=~%v0J?tt+6oQtm693;vPKd^O5o-nR@1fH{UVFSw& zCNUfS7aJDX^&c@i6feB1KZwn~1p=gU&4#rmV?3N17>a=M*ui{&~Y2RpBLNbhhysAKO| zp^kR`+@@>Q9x5QgRsI?+4}rr;g6^zURY($9oFy`#?kylHhw}lXmQN*`Jev9W>PhX% z#72B>l?d*CP&ny40OIHjB=fek2$V!Ngf_4?b4Z8uOviB1zD-IFl&;55DnvM9O3lnw z{hPvaOj#*iyBLOgmFDpH39ka>o8452O4N6bb)r87Xfy<0TlAzIDu)G_pM_6vV-ewZ z{M-PEK|Odu3a`Jf+Q7?gR+EQCwhHzqNECy!804k&LF?GD(26S;S zdrU3@&_QKMM{3njNJ&<6S6Q_3Vs7EkB)2LaYmbK=C?EW_&N)t}WAVMQ+VrLIMfLzE z#WHtDJU`QCL;m)-tKo>ouyl*(Z4MZfo$%El@P0L#YZD82uf2AO<;cN&cM$q=*f*c@ zxk`4j7{8G^c)dLenBk(>boen3foVX}`4ChLP>PD!@Ue>eyCV;OU)duTLIe z0M?reHG6qYTMkUPh4i$ZvI60_?F{1zUnpt*Xk$mc4xKRLR9J40IWCX zA?*D)Q)3ab746Os)#tOvY5~;uaW(dv@rl~Df&%(CK=uUKG^l(W<%%{j<(dExXtw=g z+RSrYgmO)@x(>+q1^_E}t)`=dzd3ovYArkDm;X2DZm%|v7_>*neQhkJ^Q0}07i%=z zi@qdCb4AUbO)<5Q$y%7ZG8ps;&0yN}2l$N4drT@840* z0*;sDZHnCbPPwUH3WSW2I|W=1tajU}Y@k?_0CjHS4<(Ge4$DNpKY9Pe8;C{grz?BU zlOuS*ur@^SSBLCfHNZe0dX0I2t^D>`OmJ6kTeqt2mq%%P6MU+ZADyoa)*5fDG{C6) zOVcGv9fh_~`$`3Gdjr(J@*pdjRduua?$`3Y8;sqpHnkf)&APTi2bH#Q%8B%qU;$c( z00Fj$*2@-eJ|q5rWD;8L1rKb3CYAv#slIUq$jdz5yLv?#F7O}s3T1BC(5l_Wb;;w!)1nW;e@;6jqxnUJ=3@7zqcyvfYtnX>mnKqmr#0LnWhQ$ioy%+m1JZs0o6kffi=-8qa1Jnp~T zbV4|#;AUoO-6MmW>n`_Nu#SIoGwOA#OeYdpS83~DUJe5f{e*GePk0J8J>3#oJA!Zf zPeX{id^zi81`+NI0XSeN?jU?yuu=p%UWOpLeNiPZX0M<<57#~ zV79mfcgaZCHVbxKmu_r%_K**~aiAZNE=wt#b^<#&SQzHby6M?zrlSw7=u|CKAAJA$ zQ_v}SdLR39mH)1|hW*$uh3t(1_4&Y379kxur%p>)F>50}TgomqXV+7xiS#HHANU+2 zcOXHi51f_b@*A=*`T#Q8Y zeEYl)2?y8GvWf7gx!RFyKl6_;Jc)b!$*O%C_(*3 zm)c+kg6?0k`*86CdNQ(y8lISUM}h~UiCN65ITO)=p4X+wRwn(vL+_$g zOKL6H07boCdwanK=IQ4L6`u)TarwwWSLNsW-=gpzves~NRxje3f8Sc&ug~hO?qxM6 z6p6E@4^Q3!Y}A3R=iJD_j+N+rrkg~W0bNrwp0av?Uo^w7Oe}vsU?HR%;deueL4+6~ zfhR(#KYUuzci+B$f`fIv+yEE8=T=xc$!q=9$WY(Y3;BFx9qmgseHP+ty*CVlOqE^U zrKM80l+}4(rXY4^#2?2=ZMS?5KaWNEuQxg^wqpUc?;Fv$c@E<>p#D5QIQtHmfVxR+KCqkUW3ts#1QbfcqYAoc{8sZfY}2S~?5j=dZ3dUm=k&eTpBFm!JLu z@lJ#)Px}{1xeVZY#_9P_#5GVBnEp5CeaD(KWDcqo1KJV1tdwBTcyNN@9L2`fAqH(w}F0V-iMKrNS-^_X*0=n zp%iEYtErRD2KvlXZ#|Md9`EGpA2IrR3>9`rUsFgUh64!BS(^*T^kA{u%s60{yv$zP zaqxCJpZ3k88$z}%iEWWd{|{%2evClJ!|tAp6d#!&{|sgqe{hBl!1c^93i`&=ZpdrZL#S_3nz)OUseT} zN(zvaFSCRYy+4V&4O9RBMphah?v@i&(^j7D==eb<;AY<=hh^j(zsY(b13#i&aULzc z$TEQn?+kR>`ju{kC43PrS0fxkrxt?&^KrarDx^_ zc{151z|4#M==%9PsjE7`M>nA3T=-4X?WMcX?6srjm~hxXmLN;GA?Cys7~!p{x18;^ zl}}{l%01>=&)rBg-~tp1?mD_ z{yw21gX0_(9r>Z}_pI=87|0(#0G~UC(-Ri!`HVkrP~?2{Xn!OH9b7aWAiRuC&?T@j zI<*{pAxHm32|xL2aG41^yxifG|BG7Ge`xL)Em{MLa98eGA?_r3J${As<#4>;M?psx zrM#+0e0O*TkwQLZN ztJZQNba(qS7UD?2I2y8Y2OIoT6zm<*A`wtDzrR`%HFoE9U6P7}_{>`zn`QEQNX#;+ zx}t0LDcx#h_{!3mb)lwGq@`BxvQBhmf;Rl%B*Oi(#&w~tf-lhJUp8~+I#Oso5qijG zb+FhmJ;$whf0(p=C>Muec}=B^Cse0^Da-i0v0xQKT9Eg3hbOa-nC0K=9^f BQ6g zU~Rvel%JQ8TU6RO)N8ljv7<*$*bk0V#iUUg0C$i0TuwdQo=#VQ%FGCTBaaz)rlwPM zbiRk70PJYA9fX5wGvGqbxV^#}T(>#e%$deDR49*hDN-fxV86`_fToO>B;WIx8kTA?Bm z!8*IW+{e-yGFnc7?Q^34RHaE=w_A+!4>mD~j#{wPBWdsvIm|OY?sFShP!RVE_0Wx=D;@B|?^>T9tZ1~~MGe#6ZUhY22)rx4 zyuvl!idHM!!6V=DgM$TeKWmeWh9|puwWjmlxbePL8jfmtPP)ecufk&KG34~B{AX90 z45&ZBfV?Afh0kBd<)lcaQe6l5clH?hmR!#NP(W^hk-L@Kh*6tMQ51-6QL4~PQW#Hg zUO8pV@AScNLbw79o8uPaWm7KKxg73lW!|6)wU|CqncDWR+tGdQor5=hCW{}QJ$J=2hMtsf0k^d(nD1EIzH}H>w$>~j?(R#ZVG$s>KX7tA|n#K{rvM#fd1sj zlwn?WSl>@irsGd^|JR^TMbqj44cgx`Su!f1`}K4Y5p;PdvM!hh z9hX3Qf-yDmJdTuk1Ve$lUIO^N&Zk1iw(UT31Vzb*p0Lzgd?#&{Wvou;FZ<^pmCwI& zUGTKKW(nnFk?7;0E5#Se#)Gf>HOnG~a53({(e@B_hIb<5ZMj4MJIj5;algr#k&R}i z)e?ascj#=NcI7@s2{e5^_s>Hu`Z+hgiRG;-%V^x^D4eZ{t>u!cJWzZC;BgAuSg$4K zl52Ij70t2z=L+%|cM)?8&b^oatFSBWBs4i- zA04_MIyIR(=uzAqXA%1$r*7yPVn)$Xe@m z)Bk{Qn> zWQ~d&iX^a#(t!r3FkCzY;R#yr`*6@!ltzbwa#TcIXd&;|lqD^`Oh(Q4PZp!y@kZJH zseVw`lc1OMWE7QxnId%!bj)`gFc0B@vzK`MM^Omdf?fT_*!jb(6bet0@pOFw!~{=E zen74SN}-9$-o|G7zIX=(SJ7Q)5BKv~@C#c7_INji7JjK(O}r<-Baro2p+HU=Xc|cd zY9Ok1Bfx*uVlykCMr7kTRbLSeBnCjjARd-b)j10z2gR@y(SpaV{Z zNp?6b*lw4ZiK%1;;W)cry^VR%>g7ctpiJqbcKqpn2{u1|_74YRksR_zLS|t@;`;w0 zH(Qx9H!CTBv!nM*gD$^MCclaJh_~@Le-iv^ow@5Do+hUnnC(Q#bkoUCRL)sgwyf}z zaiU(60XLq<(J$HpF?*AXn(}$7I2_eC@i1!zoGwLZ5Y0Cch{s?Yzy9RW44Z89R>@G5?ZIygoi9O#q3R|@z;rcq5VgO(#u|9in6QJ*yV@d7~!zUOCpnksbX^+!3g9Ut;aSsrJ|1Ze5hIx-?H_+~P) zJ?24}t_0q(h)HCnONXbzo?JW>&_WG$-$4(l%yXO4V$g@$$Hi@C@37qj_)^0P00@=J zoSDnGKu}w!g2>fZwc$>?M&)R7g7C=sAb18hjeEl^L}zGPx{Nb7vGq>^13Us&X(=89 zJn4E#>#^~wYSSzJY$>PSqh@Fq+97!DLd+&#m!U@oq-XeyySUof z0M*i|Cs6Y{)s=6wqzb2$lYU1dGUYg7xJ$M_LznEGvICbrIY#fh&4 zj5e2q87b@LhKxtjlli#YbDa^}g7kono0|@4Gz)w_8X78i8bzlVP3bNQ%y}P?q!hvI z_BD5i;10a8TB@*xZM6u3*j1JSE7m3{p1hw>L!lBsi@Na5=sZClVVjAwre#3pF}WT! z=iSY$(D)44A*ESh2(`N;UABt%{NfwwTnG?#moyL@vpwDL!VbeeXTOGm_JcgO`e$~2 zw@uJXz1$fAR}&p>iu2s3?$f@uaK{@hY+E~%k*ZCx=NWHlez_(JUKYm%h}JaYzD#eY zHN^nm2(fmccj(z0KO*Prf^yB~CXdm!Zi3M>VCXLt;AaW23J_l`v?;x^%Y=wsrL}&J z_$8<(fty9jeuIOtalc@DV4pF+s&_8g_htPK?x-#4;i68<1DpSVTzI~MZd*&Zt+h1n z-m(v6PK^7!>L{rv7UHuc>}MDE;CenYvxaj~i2RAUDSvx9fEPk#tdBJuLM>9P;6Hv9 z+MN8&_E;Hoa!2E?%O0abuJOJ+K(ocjE4&n;o2$_d#tt7*unCgr?X)TPRMY{BvMc_* z1MV(+Pb~#!VeKFe?lQGlh;&lw^2MwN4$Rd$OscIqTZos^Vsnu=uuHv8TF z8eNmX*Z*!_y{GDoh|*CN!*9poA%#EI?IP!f*%M7$Dq3)1%8$BcYtAggYMfY5#*jQ$ zx|0$_xmQpsh`F)0Q&CXGHdayag2mpseEIuaOQ*C_2o35BfE4M2wndRvXCjay9ap0} zq369wU-+*`pZTvyXCQ^@~H z?qXec#oTOOY}l!|bONQG#8Sd3{G!;1kQy&O!|(S^N)J`cX;dd22{Ni?QXQ9J*wQFnnD#%X*{$0GTm1#73O9zI&U?U>qBdl z)BCdfc7xdmF*^+{#LU_EStvcDDHAw~GIj7dIx91&G^*E#>S$5t+W;{*Nts63-S)a{ zs?ObjRq+P&!CJT27?WixV5n5ZH!uP+7BSe&7Y7M^u#bj}XrgsA9`@|PYXz#kg*X zNa$1FkjXiqFq??_o`sQ0c(ezbV@WQP`~MK$JW{i7i^@?Wf991v*6)v(0GBGc(t9-oI_bL#QGP%2MoE8l|J-Ich;Sb)GnO($D3yP z^UGu5t9bcOpC)3SeB!}jhk40A^zFZ(->9xdP#)hVQpQ?fJ^`nrV6n?a(}wND-CT=FGa2zh`vTePiIk z{=gI5sss4cpoVIS;p*gCezVz`PR@l|P%RJj&+y%4@!o)^ND&?m-nU@s|LMtx81K~woFJ*r1Lqw`h1MLlMA1MOMQb*v$ss>lA64DQ zR{!6ioPqD{)%ApqNHZSv+gfUlDkd`+e{da8$qVMn39sme_dD8k)4*57)zp%^!x=su0VV znAqwDEep0=1sEHePyNePAc=0~wx&L;qu(%l(vIaUGfcY;rzJH93t;1Hxl$N$F#d}X zeJPKcnXDQ)=+ZoJa_7i@%EHr=Y{-LS%oO`ZLFS=29PvA6tEX6E@Y78B*RLb4i-juu z1a`yDzZEgTrC)FezkMHD2Owv&+@|tG$w^DZ@)Ki)Oik{DcWZ=J3PI*yqszCitK(Pr zeDHtx!2(WK#v%Do;0aD&17Ja8fos+P6rec@pAC?8S&v$cMN6NqA;D}yASqey2LD}& zT`&fE%$aV=@5(fdFC+ISExzX8#I^cJ;4c+UwAnV$HK}NvMXx_R75dyEN3A`7EI)-h zLjAv`mDd|9o$!GgU|{^IL-6ymyv{EbBjYVmXZw;m1rj4R@0tx??i!CzN+h;f6qSW7 z&SBFRDp>yBxa1^B$d3CqvDgZmP~22I8A_c4i|sRUk>?`cIc;exgu(5QnKDi6bH0ed@>A0D-G_od^fypRvNI@Ejv4UU_(l7XRX14F zgN1kNtof=YHP4z%k$8Id>uiR$eajI~p}rYxYq0mngC{gMZGJGj><6vWdy%$OQ-eFu z*_sd>%Eng1d;{8w^swyoTcgy^ZAD`_XSVT~xy=K!I7+_j4?#r~nXFVnPraiwix%KDk>xY^=InO&f%!M&ho@nVWSzPL$ap588;ac zGFZ*EZtVDOlH`0797|smjARKWgNc+@o=}6Q9s0L%0%M&-OKoq9DtdvMB)Qf9tU;T% zspt{ZNwx7M1)?YQm&X8!5-uKoixuX+wj$adbENiPWx?8NN&fb{0lz+62M^1$2iQMh zSyoxFu=?bntZ-fbo`!uZo^-4|bkLitu1IVgH8{jv{QL8dW=py2;NQgE;89V92}2(m zpFx9#tyKqxgOL%5FPY4yl7*Sa#z3qojE*w~dUh4_FI}E~$(J~&^29OV3;-6siRPIz zJ7RK;gtCvQ)Ubb|tc#EX<{zp;XFAp>!chq%MCm&>f9Vz5+QZ^SDnrV!S&(9~BpY=nX|G8c&+Y zhoFb)4u9n7j3+}e-1OY%mzvnqmLtM?RJN{wfPBIjS-4#|P4cNL%PI96ITBxc31k2S zNfH=)8^8{3p2tE4#Vi#urGsfg++>EW5fa!oFgm{4{!=$nKLQgDB;SHq*?b0$^{)yglk618 z)p4yXLO3)*Ro?g!+=QBRUW^(}XY+@C=oG_`P>Ef^D4DWIAlhtqi9 zi?;ngHK3>`4xn9!oZ1q=W>J{jA5pLl_`Oy4aKJvX@c3Z90c0|8)((IRS{}T-1HhwU zg~ZjLNXH2wakZt}3-2Co?9O7S`If-NGED=`;N9Oyg9?6-PH?|o{2zqe(^tdNu$rLKlbCt9N7;Bk9k}9YwN(~y8s1cDWuAFZG2(+c`FAK zq(m0CV80{k&wly!2gTSZuC-&OvVZwL`my&J!kXGBP-zhLqzG8`pE4BwfEZY*Bjybv zUk_nQaN40qpb*#l%jrYieqz6bfzkE=l%SF`bsTm#4_iHTcv23!sKtg6pOKfi%!|0H z$+>EtO^)>$3`xLTV&S!TypB{=cUMN%&eidMU^ep_%#;7hm8ih3%?LGg-Y+`kc?snI z1G7!Cw#DG6*Jjb&apHP!W=JJ&6~Cf}QkznW_RhKg`&3=gPH?#XP~8o97KYJ}5x=}d zI7;kN{jyU(ZMg{U-2=!-F%J^B{HewX>u&thBAT_w9f-h8iS;@{8K1W54FJydqPih& zwZ2Eo;qTG%Ly-Y{+ruAxWE?*LCwkTTI7W)Ci$mX$IR79ySbHD9U~p2)4CqxN+W)z{ za|A2=%A1uPz8Un9o;xrhT%*4F+h$jcw|ZX4JrSCYkf|&xT41|f;RUSLT`3b>elEB4U64C?IT-TPuLQkkq&oNSV9TKE zV#0Y8amjN7b*o}4x~EbewN0L0=6%*AM&`iOVjba(#0rM8sWAIS_~wYGI`!vG)M1#g zGCj^nqRQuloJ65vs^b8rJ&znzWy54XzK@ z`}GL)X^##*_v7oNkpA)g{#@T@J}WSgHF6}~p>N86PcRw4wlKn~6 zSYB~s4sTJJey$%W&AF=Jq3$+LUuA%q0rRb55kjYe)mO1BKopi}cu)8D_Gf;|p<!m9pKgUnHXgtGkF7jvM&v4mV zfYuLFC^LHAhjtoOa40StlEluxrnmUxFP=F?5kJRVZjLPa&YHfdn#gf_5?1XdkvQ-A zgRQsW(E$8`h_Q2DH1<`vXBEAV+20*(uqgu$E&e}vzw`P+e6FfoV%1&gBcT_KU;cFK znCUm*LIxa3P|3~7oe`4z&Cc<*^uK;n^*&SlUJ+k>DzcaKz;Uhag1JLvFVYz=J#1OY z+Octv(_ibP#RXpJ*MNDyX`c9sD_obfk-5p3J$m{Flw}ea^H#?AqkYjs=CX$g?KJ>7ZI1j8^mowh>WI&|xZ}!V0c20jN@yytS#dY0m!} z>L&}EsyO0Pq25~K)F06nFPY3PTXP5@`Bsbu!!cb>u8; z==j$ezK(~U1O+u&g5q2`GTMKQuD{sb!>MAAQ*GwFHr)eoM#_t;gn|pNE3>9pbD;2V z^Y4=Fs6Y(e-(v+$Exq=t5x#bhXu6^=Nk~&Q>*=(jHut`?-Fd#-)nPR}VR49UPr%Z} z+U2bJoJArd?R@9V*Dr%C3_B{Fo)U|{%m>CAarxqzbsI~YIyl!*S|h<7CjbsmT@U0s z@l|&4%ZLSb#=i9&=b!0#+1U`85<~aX+@%+OV;5xQGiNK6NHB0$kBXiWA%)qv=`w=?Hd~#h^kJ zcXt!5^cefe*h`nG#FN;B_#S-PZImjH4w&gjtq6EGr!b0F1N1FKO%y}0=&uh)pFprYh5gQ_@G;VUX# z(hVY}&?IJi+Afu-f9k*7Na+tPZKe!t6os@oDHU1Dq^{y=(>Q!JcaboVq0LP?x&%j< z!?%x_bZ!=ILjnioXWb7}dSe_#xZQ_v71mp8ML9^K>ZacsZS426n>3G#xF}ow;XE4C z>@rSQhLHz=@#TU;&x6h@JqUuwnJJ0(@?Sg9ko1gM2Ya(WIcU`4USJ zr}rPAi^EbLcEHmhVWoXZv%n(E-UofPQ9Slw`S-nS=1t6LZ)SIIq^-Ua@VCHG=CekH zo+0dL0qn?>*08+V)M;2@! zSS{?TP-mE*r%fog` zo7;~?70#ztnF)|P%8$^B5d?T?{IgvKRE3(fz{xsCT-g9fQ;Py=YQ@M`wF+JOG7A+5 zbk9EvZW5%fP8SuhKVWEWLN=9vAL{}oaJNd})f?8agRbZjl>CNovYw-LBx_9BwZdCk z&lBF+J(g9f`_MITiB0LTqB=)Sl)kt%(ZRe3sYo%VETGwh=IU(%t^Pl{)3OAo_lBRo zQ8(ma?}Ezo{wxJ~AeTLQFK{?5W%-Kd^q-f_tB{?}0plF#*g~5kDYd`H>{Zo%^g4l=91(<(%+8K=6`Y*rIV z+8*ZUW())J-~^ZD5#*kW6UI^$QR&S{XtV`ebpWxB#lCR%T?M3*!tz({AN5~Z_ltuoR2d0&Zd37U53A1d zk54UceT(*J{F@nBObf5lBT_^FI}>{`7r}CAi@wz>@#BQ{hwSX45g0DPkcwwJaUfPZkI(nZb08*Fxwi6KL!#R(sF_7I#K1H3`rjdpDi82uL1NgqE|c)9!@lF#lQ6tM67c z#m=mLCVRqf6e>->kk%{x%zvl8EeQx$N>x*tG+^aRWJXnrC6LNwX^ivV>Z0ryT}mr? zJl)QBEIMXQT9X@MMYGe@DmX)|Xo|wrvP*xj3WP##Ul*g>PsE@}a|X9$}{rY3d#k8>Ji5b!joIu!gnkBEb$m(MT;w>XBCHy9{25s!91P0!8`axjiZ$O zNRok3+gTPpS(Tt=LA2bLz$v0H9WPIaB|=el-{-oZBm zP1yM_@eKAfrU)DuQQ5ryv!b2->e(`&d_EKtid(_f{5sCse*KB<1o_qST^iUID(_pq zo-KLLZhzJJp?B`2!OKhRR{!lacy%1yK8=PCa-D@p(K@mUN6=>cWF-jMq#NGXrqMo! zxiXK?zNLTxU*sO1ve!aY+FWF9OQ4-TpbhMW;yV83v$HOE*=$$(t^SPjNn~L<&oGeA zMvvJAG;=50b9krFYnptdh2zwH;}68sa#{qUK%{8C`qG$TA<$|Ir&o=xd)b2SoF~Yl zWznlcZHX*LTtgKIo6`@>#kM)Jx^wS#o%j)6Zz+0U>e0XX(U75uOzd;9(rtT-1oi=5 z;~pfb{rz#V8BuxOJ|!5dhXTRK?DWH|BF*^n^?{45&a!YG)OZ=5qDdQHedmtVP@@Z_ zX*6BR?t4;e+TH{i>;*Y#cZ(ra0pW;K-bgUAkFT+-{A0JoAp|_+VWK22fLDF<#x zo<&e|%+-l&&bc`EoCMRiyYSV>j$zqo!2;mFoI*W6Xl7(>9oM$k=jR6#f_4bFa)kms zWyK06+^8J;zQ`YC#vJsSn`bc=U1NleQgV}1omk1N39`zBtUo99o+kJ%e;g1rnF{Pm zaF_boSgl3+E=6bK{Z=aYGY0ueE^=-%uPcJ~WKVw+g1<%@SFzAsxbbk%RZgBUF?KeJ zC!SnWOrDRtp1W389)tb{(zUrM>e5PaX&b05s<<~MglyUcYaTYf$1FuCkr4ovXjnJs zAyV{;#;j5DFDBQ}l~=CY2b1mAV|&-e?0L3{dMYG#%IE4_{E2K{X7DPzDc@wa64T5; zNs&a(-A9~6w9dN^RW7CYzS@AdaNLK&p%Spv+FFZ3Ej$0D(f4&wlxrr9LWxRjB=kUe zB;Ckgr^EA#3@K89)6KIU6dWAOk_JMkh`f+bK3-w9!+dtRXTPp>@ZD7|xmN5HYrXGe zd;32R0-S?M@MmT3=$qW(t2f-CEzkkhgm>Q)zz!}ouJjqeD7NYTmN)rBa4ba{vr zO>nS2N#x8Y05uK*Du~yRhL72eQvJF-$hR$1HtlTh(`L1#!v(8+BJ_AE&iFqmdSY~j zqU1j*n(cq2XzT_z4g6j$#c+7_nJW!gR(G&Dz(+2m|9WN7aKv0(Yvgwkz7>0x=ia*% zt(Etq!a>&&*eHOLGj_Z5@-hPVE=7X|ir$|4lJ=aS#>SxeZ1`LSJUq^3;3s+ClUl2E z*|ghInW|!Mw?okv!idVp^JlGzOuAn`;P+)~Nbk2a_XYP_>G84#9{qK0id;z7+WZFY zB;==lR&T>ixW9Nc-w!`?2~Oml$2Wy0!UrAYAO9+O#5;^q#Ys@U46BU0BL$raOn55f z5_DuNo_det`GHguPoTvbAnZjT2~=D;^}Y)<9|u5r0bMV8gNP9-#Cu_ zIb@7(DW}x&GU-#RUgajn0GZVZq^aGcO1|6DVLIEB20sH)2%-1DTLX}bAK=uj+}N9q zyDNzT=v$`f<3FC|zPkb|N#^n-ubKI}QDBf~@htB#`??wXpJHfv#_495NwY5L+m`B2 zNR2{8tK^|`Q=6?Cvg!S-Yf?Kiuy1259b?Qbr5w*rVeS=F_rWt}9^r$bR4C%g)l^7< zcCUkfP>F}co>0$N-r;A^l?sO;Aw+&gd6%C}-sR`fqouXKluchFjm13$-{t2>#wAdm z#z!p)G>H5hyZ70{W#l$t_H`;FGfjU9$$cg2fV{;Y0zdCt?h~vYX{F+dls~e$d(sWF zeoiJ8Ht|3A97WrdAnx>#+}d=Nc`syr-wW9SKi8yUkX#x0b&Ac_e~E0sFdMFr1w5Du zlE_{|64|nb2E?r=AyX8CoP z9`9HrC^qzm78k(YBYnZ?OnCa8+S* zV6e(FfEqLmah(NBA+B?{*=h@LJt#>2^0uW5tQJwY)CIcot4Oo$BBH*l<{50yqN6e- zb3zdBBaB&%7U4PdAEj?h5ty)80* zp>Kt*RVmD9 zAv%x}6J817T?T^|KQIquGgESl>q+Qb z(Tt&fU7vvzur2cJTvnyJUo6sh54S7e&As;iD_|vCPaCso2Vg7%DQm!wW!kK91twzik`9c|h(*c;30?1Z zG?5^o>wT6i%2cVX>@U6&eowH8qXT3^--S9+#A%}vh21g$vO!@f!gMmB92|M?T)_pe zkn`Z7wQ=Mf17Z%%xC@XyjQaxoPMO75)of!TEg)pJJSfW??l5`~Z;D3uM7(q~Yld7Y za56cyYqkmoBPonV(DCF@A%x#s6hJo+0?$!UFEv#Aw0Of!QQ2&T=*v6vdyKkJN^QGY zep2p#mFJ)HMy&73^EVsA4>Uz=QLs}igS%h_CmaHhb`~vNqjcMFSGzKF2kE*1s*(1p;diy^}Vdlznr*>zQKKF zw@?57wV5?+PpZKTH&~>g-qI(NBKH*WF?;g8&{)WkYh5MnJ!Rn4uEi>2R(8AyK~~xb?FfLkjn?ep{(8*HFH$(wwf>y-GN$-i=e6C# zRu&Zp=H`bM!+{GRj->P4Jq_D<^E=Cw;iy@AH6CfT)RPg6gney?y{@J+w$%2Ke-tA` zhLZY9r-oXT-xe@W?84L2WKvEQjYDl+_zJIHZUe}41HYjtTNJ48Z#9x8|K*2fTWI(D z2gLsD%RK((PRLAv+^&xE3N7nNHkc1Yfd|U^)3vpA*bE+mj8Bs)sU30IHDpCa`3#s! z`VS8Ij&W9+{sxhg|42<6JCgHUjBGkixWti{lD9YYva6)*Jg|rvU&QY{6V2GT8=t`X zI0|Exv(0=G9lLDt@*H6L1Wyu^FC!W5lW=0wL|kSevWQ#mRE1>nZ`70inODXfXgZ(a zU-n?OkgpB-&lPsd&M0jzz*Q8B5|foY8eDW3ceJxgnP|5Lo0t*Kq|Z>T5K0WiKKlc_ zb*%k`k-$tPm{_t9bh)?+4*oM5-z<4N;~M7{&ib0EHHGocKP~ljLJCBUU*A&|9q-99 z8XD;x892{+$MW;@9IC`a&Br4P5GuE4+PAzN z2JjnpzmPqXTpfq8#PuS1Qh&YBub$6PS?b(WIO@pGX zbcag*&HC#>OS_wUVoIW}D?t5wmMx+{-G`Lr5?{UC(#e-pRU_~vX3FS$q}nJ=2Z>ad zH^|>3RR_)YN_8>B-%eR0{`7!MIY@BHh~{eIGvA+w4|d;Ipxu<*xHPL@?O~^|c`XU4dGbM0;NtjvMY5-CJ&Eb~bWUGq5P35=_mg-0^)_nia{%*C#1K-A zr!w-L=(y$&f$~qN>16Th(Tq@`bZ_L}0a{S9GL-=vJSrBe3I9>XC5LQxC)XGh)D)!` zyd$%>wYs?1G;f?LhY#;8P2hJ=Kds$Ede_Vx~!o*iqK^GidKMr_U%A62&i$-F|DJ;u zX07bK=b$+JQ=z{ZjCa?Ykagh{X(h=I)V;;_44gv2+p~bL7G7d%o?>@hhXyeSh{wkow}F$B_En!|mJ0cSozT zlwabWms`!tY2ZaTZaVBC+B4v-P70{kuBns62WvY^q}0y-&2bYljkX+z1O%YwqpYy{ z$8&JAs60iDxzeK_)p<*s7}kM+#~EMRvjLfQyrFl`zc$x0tYtCR*1mZ2D6J=Acdz?$ z$=kZmJ~Nb4e`Fs1CUvC6g`2K+|FlOi0*HDlaGGs*Qc==%x>-rp&C`fyx#yREwiECj zAJ{Ur5qQWeOl|f#D&06}0cqEl+H-N_JgjB`HREqrk`t^69-IYW?0#JywgI%3FuW|k z?GtOPOIKcKB?cDtIYo`mkX#uqu9qTizroegCi-8jk``u`zRcU0#VxP5`hD@H`Z#fn zW~>Cd$5cuj@6I_oO{8Dtu{rRxa|zbBhm3_E`EZU`$9#sM{4H>57?h?Xk$s1Cdj-2k za;lc0PLh=Yf4(0M@*95H|%ldli3Kr$!CANzJc_4B>xJc{Ti<61cUDL^Z)%3L^Rr9nEvWIfd-?Ebg5j?7{hFP0mGRls&ys?McM_tC7>%h7zzaNzsm|f=G zx{C&nr^erZg|Ps!hfW8-!jxiiPD=ko5SS!Tc3`AZ&Ep1TNGIknX{9Pe_}pywuPL+K z&iK@;*e|C8gOI5o!@fi%75bWyiT5-_3GSWOEMI)Z%dE4aV~(5vU-X`MqYHvcg|mnB zmw$%8#wqPH%i+0DepP`RMn#&}sKH3c1ptP%%pnQ>*%e#*`l!)hyc-O!Tg zi2(9@l#uVDdz8u`Op(Qoh81)wyPoofIK#9WXE4R;TqvA&HCV#Zt~j{t&}X}#h0y0j01NL@ebE zKrgoJWFp(i;_;a{d7@RE7>lNz%uIZj=3x%Cu~egyFq14|A+t*HK_hcY18NuB)R{;hBie7Fb@)7-F%L&~sB;-oR_wW`d^#~S+nw(}A-63S0Leo}p?h#omG zfyARiPI(@X;H~!XlZvzBb*3$hY*VL3GHg<`t4UJ28$rjYwgwf#4A;f>su|-t{l^T; zSb(t&u}MLTt#lAf81=;$#v;pL+@%6r@*a0F|DHkt(|D4zlPQ%x#5$pI@5hxx7gP`^3o_jWBg-ejZracXVvE-mwfS2UW?>ts(=ymi6~Zat59_Rmw#hb!ZYWN1-+J%UjS!wM9^K9V-4%C{0&l9giwx2qs#?l(PW7)55}H z(Zo|;ryL_cQP{pw{kXzZJB)MAtXfR_-HCcox+|VPgHyfe`>Y)q!Qr=n6Y@_y{|YZr zIhsPQ7o(t3oxv^CUsos5jE|nmDyD7T8UhkG)g^pSt;{+Rd26qqBAlmZ%itH86bG4t z%*2$=a^Y3?0WCrNchJ}ToO0LbZI3UzqyJpDi)?c4jy+G4K~c9Xc2;|xS7%Xk zt(_Uh4=%7*FxcWQx%e=2(9gX%3HnA3>Y|l)oD6&g+-TqOZt*on*SV`*)SES*Nm0Vf zmsqSLOSFJdGbdMP{_(4N^^swzoSVaUr3GPvS@mX-+CQHaC#oQLEc-)d!9mhowq>oY z|3+Z&jmblJ9-?8XuE^laDwa@F#61Ds0!d&U8`!4-6B{(pFp(1S$vxC<0#v%+*5QER zE^p9*k&`J%W->A>r;JNEpzqJhuMY=65>Lhyv&-d3F(cT)7)aW3&h%QsOsySbce~=b zH5<#n%y2$XGGLDU@!jMqhDLH4?Ma=Ue<@j@_^)oBsb8aD=*8bSpyv4(&F=3XI;ne> zgH?HSheJWx#XnKPd?&;6N;GG(F#0Tms3uW2G5$7O@G7S+y5JoN7lGtz4wZ}Em#{U zI_5)FVn16vy9}(UB>ez7_F5X|Oo>fykI+V3pe!cd>)x%Vhf32d@R&WOn z|9_?H5$bvqj0ALJG>8R5H5dIE(D^b=sVb(*A!kHA=T5jIEDobi$dI5kl(!DeDfIuQF#^D}iUl zG)+0e3%)a0Y>SprWobb)a0eULo%9}b^j1OXq}Kk>n;pv$+zOEBrmkXr9p%+Kayx|o zG9zpi`HOgva;~W~>r=e=df3O{Kdo4o7gl9CE^^ZN$5ZMo)}^Xdh|~a^J#pdzUH+K zEr*6c#4iihP5DdhXoArGUhfcbK(ogXjhu!L%34TQieTN20}$a-J+N4m#V_#To`KMW z>`^L+fAe*u6}v(2gYE%IM*3X5&EZ6dNEE})02!2wW41_f!be4_#7?O-mOKI=@rCl^ z5%g&>0+-|T)O|;P&`XuybAf>r@q*)UqDwp`X;w1{ZWNa8*GiZ~Ge!Ihqs!OLy&&-E z27pNz%+?98s-njfo6Y_l(a${7a^@|;A0%UKz@_nH`;%!KfkkuPj)7Ft0hRR`;)H9Z znZ-h))N~}>n1Ii8Xx3EKELd+7Ko1(Dl{GCAxO0*vEGjr6%4NvVL4+%qK?=*$E-;JS zm%+m3$4S7U{8#T09ra7pN<*I%o zy!ubMW7?1UX%y3a1O2R zR~!j9B>fo zFsR&$OzLprvs-~L%C)OZhJTfv|1Db#F31CY&(AWI_KRO{Q!4H#V43v_)>5#^i(f6W z3fuJU(N2U`R>_=TlL3?=BRSmV=gixljffW6+Y%HahBHHU{2NO5->4h$Gigb6pOP9L z{$SkC{haWExmw(GTQ$P7QeE`Hmj$E@UMYv8^W%)O4n)IqaTisTAKItHch&o$UptOv zj>Maf%5yih_2>D(B7tw)^dH@x-Hcw(e-Q4EU<`o|W|?UZ-fTgER7_>0mb&a_vGV4y zN10ai6XHkixJ+5ho?^g^iJ_$x-i{|SSi~v;?_F&Zzu&CeY38A@Uf~}kT;hx& zRcC5dLjz~^G!7>2_%D6w`qgL`X&5ngwDg&V05IBTRBn(4j=LQA@JJFHx6$oK!r~1L`#)tF z7c{McFr_LWaV|P9lpF=~2t^eqW2Y+z%V%BIV&F44;jHSdRWqRlx;2Fy+?6^Q# zyG<{=4)cMyT$%|lHC9*nb5CaHkf34Xrvfv!JPG@GTi+^JpHdsNdNZ@RH!zzzGnJF* zSMnOvrVL@-W{!r>fd1AGGIiCZ!>wCOhQOmSjutNao$C}d*txIZ6|vGNqHCy+>Y*Qe ze+|%cBrKboUh3CRO&h*e%^}V>h@&yVnBGBkC4@t>fY-qY_+YOu=qMnX*dM@pFHDx; z&8$()32)P<<3-3|SOs+lK5^Sy9PF$fh2?{(z~j?Q_wFE<-G$?(`hPf*6jV_W5gJ+ zneJ+@`rRnM0$dq@@(VPrZFQX!%#mit*3Pe{CrK8d==OQYTP zpPjyMGqAtF{VP~}&}QIKRBTE>N#<^!l{0-x)C~7$2ACUX{QOyPGyxU?>g6#f61lDS zlb1SlG4&MK`w1BfbTv$Z3jOo`ZkU(~Df{hb0hDKubijt7kzrYGc`L~yXTUH2<3jSf zJf>YAv}wgyF(d*3oxndC0Fz)$Hsj7Hozzr)&DZh=o@GLwP&(WePWwYOnEePK z1*&O%NwpL%YfVn^paDD}AKicJa+P4}g3TtKMt2Y6y3tJOILlf*E6Su9xW#`gE1k4b z;su%xw4nq4X!fx3?_c?(>bazjO9o->mC3)B|i6v2{43#mle<-V!m8d%_fc1AK8QhW-{2R!(=G0kGf zMNXJ?CvS)wE3x`A?AaHagE-`j&!FEwQK}R|SDq<=Xxh0i^&X#`5(4VtX^t0HKqHd( zYG04iLOtZ-5O2BLS(t&8FOZkEHDTi6S5D*bV+ z{_5s?P3$)#sz?Q(^-B3+bY(_o+%M`I)HKVjm+( z%EDdv_WRT|F_1l5;XXWI3zmD$dsZ0$X7@>dLLC@iy{ULuMBsX>!viOg)ln=vi2B3a z4cQ|q_JKh&jbENP8S6{XCe0hRqq&G52v$2)46^pF?iro!Xyo6!DTHw9VNw}=?%uNb zZqTN>1lZ+B4eMOZxESg`KOR=EX87627-#nwRcP*yjvK9)-bbw`T02EMepw8?4W}Dw zh}T58qOb}tq!!*cIMM2J-)%aAUGwI?<^u(jVsinPalOP|UvtxkbCj!p%xczO6H(DM z$ZY@e+4^XBsf*-HBeKPE>qiNspdd4iAyc}7fPIZs+2V`up#vp8eh@}G{uctJnX|Du z;LC$k_Zmv^>&`h{+x=m##MmW4ZnHQdvC6su%G|SGEy;>Bc6UG9eUKfL0f2=}n>v7r zP8k#kaR(M3^tg_V4!o4)2!;UeZD*EA7Hrc!oaNwJNjop7;M>U8iMO0=qGEHgYv;V$ zoy9ckO}7jeODBx$%;~Ee3{I|Kko>|^VmnJK{X$0W1u!`U9mCTinU5La;xWB(Ji4GL z-nH+OiqAI!9~Iq`=~aHz_=?~|SE~{^)}{UMvLB_JOm{imZO~wD*c%kHfsG9u_!4(y zU0S{#e~pQIvg_Ly*yP5}{_yh#N)shPyTnodRRrq1rNEJ1L@1D?6K7_D6GGM}f z1%I@Gts#~2jpAdijAEMesTZ_GE+F|)|}W~M?`j+hBf=9TEzi&cU1fO(+|(Pevs%7 zY*-62Oy&828Dgu(6W&ak zW(s%8(>fwREf0(ZoAvreV({c+asV9Ig!L7gS-@5>5<}5hPR5b(_z8I9%qSRfzHR zuy94bPtXIUoN?XlJMZf^8-4S`u=IpEa#&I0e!WK)y_`lLdD%| z2T9t=$C@Z_TjQU$Nvt$i4(?t{>;pN8>HE0I@EOfpQkr?hXM71|*CzEja1wz)E|CFN z+(>ta!c~&+B1tRv&fxnH8+T9D^1Rs}QnsOMZ#e+OAMR>!=K=bjb7KPeXi{}tnOjvH zm%MA9-rdoQu#pa@Qc$tD)gwAz;HGgckNg!eT}qD=;SHuGDUXQVnWfVQw1B2(ld(3o z6k?vr+*S=6QS=q5Khialo?3lH?a9vATK1qUmZt5Z5D60~yW34PKQtH~E030r(;e|8 zzC(~nE;>h03L@0bPMFp$N}-aLV+-|Xz4J#-*Kmf*;8*@-1>4t2oR!$+=CTRnCa#XY zG7-rk4V;~V;M&M9fTWNE-ZBIfr}U^%7U~%Z4^I>Mb9=Cbf{?49jSH*xLvAs><{DC{>)t(RHXaZx*3>&d*g42h@G% zWSECT)fUA*8sJSKkpgo>o`8JjJ*2leL*y>^9dB0^?t`>#!%L*ppIjuGka+Bq)$??c}_i*jmxm}D|#tTshiBu7- z@7*y;r_*c4#|gW6+}A#5$y~}QfA&RNLXUGnJq~5gtQ|@Ha&tGkdUUG~3pnhs!`i^gsa z5m)f(=yxmz1o}HBAOkH~1a47FN9hjRRr?5aJg#zJ%3j&?S8qsGq;I?xV>e$K_s_dA z{ZLP)J0!okS1)_6G619sW##<$L-X|8y4S4lqUm(nD(6QSL!C}2iD z;4Hl%OKux(g5ZIU7HWv%O+eANitnbLxXHA7BXyV?5cM5Km5|d?n~wfF!n3!= zj(!_a()zp+rgA6C7mVDlNnY#mXtYgI!fEq(g^%I*@M|6mXw z5mx)D!EqR{B8k7X)Kajm6c0oAo5aU=%e$pmZ9I}H_K~JK8%eV~d7Phi`J+secMIo{ z>RE+3@8psvwW!BVOeCuGsSg>fG-aA)7mw8^e}4QuTY(GBP>z!fWh&G;zr}Ve1+}H3c;|xIyFI3m_7=F4h9A6`H)2*Eh zS)CmtLJvtm1NossrpLgOQH_=-=@33N_?0<)+Ww{~k-XOs;MMWs+vFqDVOY71o( zSL-4haLOxsWoFzVM2P5g9Zkm5unw>Kgk+D<)RpH59)NzHAl*2o@U`%>HWW*RPm?Ye zFovMo>ZzFEq4lVp5W%RF_Ewf=I4q^BEeZ!s?#7kGd`Kn!=7f;9D17-#GuXAH(X&vK zo+7sxsM0`Of&%+NZz}Q~z8J=@N+suA)z-NtgB`tf;O^$sYj@5M?tx4z^pOgny*=oE z=UXit4^;5svuHT`iQ{yo>9eL*;!9@k-PhP=t}OM83s|xO15-esh=%A#PhC2QL&EyRx70x7H^|-TDR(2E){|2(-Sfzsg~9k%=n3QxjH-w zy9-QwEQhPbAY^$xezXn_%2Zeo31pfJl~(Qtz86W{Vm4w*fE-cC@SU6PC2>Z4@enp) z`*SGZmELOIN1*0=+{Q^OdweDEk6}y77~b>g)Ha?9wV#?w)P)MvgT88lcDF?(TMXhW z$8W0h0xr`TJ(g=BqHTj7-(gu`11|x9D9(y|ogMX&D%OVfmUCUNma=XygDw-{G$K1- zgP1kk&MLwbOtaL{^{TsxlaEb~i_crl!=+WSZ5Hf2z;Vsl^kfy?x`xcvi#A@cE`BkL$KdmaKABKbGBOa<%W`fxSB(eze`{ z;1m7V$mn}hE<2ux!hGmlx#mlVD>F%1VAuz)1jL)+V7EGO2JPBRIIanGi)JR${zAVt zFF}8dJKwBV+fKtm%3^`yfvGq2P#UNZC2>jIv3{x1&et;Iag}1*Oc-uhSE;4yrk0Y- z{IYzN=PrvaKm9erT9(zD=``~ZCBizCcF1#+$ctVo-571c6jpiK~# zLLQFOjGG38Cmo`n|=D@5kHQ&b8x z(2pV84VZx@oV)nZ$Z}sN^|UF`$cPZ3*Eg6S4VI0JOXriDA;#U4sW5ixEr*7&-rh1x zt|ffY%#4~Mp~b;+Uo(p!&Jr*VCf@mw48M6dm|L>rmnfoa<0Zddb6F=JVJ`l8umJSq z8jBf7gX}%b*Gp<{z^!H?G+Y7(l zQNKz@o}3+(I%2W!@(^ByIrnXI20CyT1l&_MLqczz6ox-&yQ4K$F3`3l3}n}O`QBzM z@Upsu?3gc~6&UwVvSy1TZD1dhbsS`c($6oeHMDWt9beo($8 zCSpT1?`lT+?6 z+T}K98)bDUOu}%BP}iC{2Yg5pnv|Q@bk)&lZ0Q} zz9;`QO)(7OVE)t}A1ba(0bh@e{h2SMeqir{@6Fl`m#;kZFr~^@c_)Y(i+2c6czKFr zH$GR%DJiUNXwI|f8pymC>vxA|ApT~w_E7$om2Xk4ijA+p#ElAR67Y5qz#>|dR|3V; z_(B9KW-aB69AVV!LCCLq<;p)Pw~#SAefjD9=;stXg?9pcs_WI2Hx~Uin>ovsyM4E(=luWeujo8GCisV=^w+dph*#E9Ug@}jFefM z-F@f>e4Gnchl1aqYXZ@XBy&wA>)rU|c)Z;6Ggbvpx&xY9ypE&4hs}4VhN2!gZSjIv z_ggE?aK7%>FCEtSy**|Mngs8;h4JqYxQ89z1B$be1)5A=!>YI$Ik!;kt~A`QnS|E^ z2W@GM@#ue_*naY(fgg9Iqv> zFUc4JdL^OjLfCBZO)@&LHMzd9!+;b*BQY%a-ou&Ml`JHUL&){z@V4a$`IiC~xC2mw z6bX3d^YP(2LX|QH_OOJDk<;x@Q}#Bk43g~ZnQAyWcomZdY-(R7lY@RbMlM|8OyIAa z@1D`uWx)d*_EMVPjx*Z6t39ejz)iGMiNJG$(WTwPY`|b0seV*4T^@2Sxh@Zz+iJJ@ z_*pJCP{6G=OpVu z@D|-Q4CF3nvu%dIovVTcO+`)T!Ng7wf956Zp@1TgbS)6Ce<*^@eoQolk9mMO1(BK) zBeaOYlPl)vTT5P>3305n;1{3}F{XU{GW`Hub60$(cL5W6oIIgwtm#GIG-t-yfghxS zLSXLnom#-u)*f{gtaX_pDL9>WBQ2mu(@OiXUnWR+8MoAtYP} z=&hdT8kbrVDfd^i7@$gvnD(s62m>CWw`N;h@X&F5kURA{^ zohqlP46*)HGri;h9w zKQ?g&Fz|SnPJ~0=Y{K_AJ!v(Wi=Vj~5=nWWP8wZQH}p|#`@!C*34$mav(L@kf`L5m z9gX4=Aigq2$-2_*IT?im?MHvP!IP;6^`=Mzm^*c_(l?xl?5miw;{p>eOH*n4~h; z<5>y5mI5ome74JQonoCzU?tc*$lGrkMYn=)d+K9x)^^}-DdcT73$Lr-iAOjfm{0f1 zg_Ui35y9$Ytp4^p5f>>rBhsyVW#Xn~${F(>)XsI-(cZQ?i6tSH3r{)tCAQ_*Vof_= zWXTPuWJf0wL#`BY&gRBaT|{ezLdIYM>>EX2 z%1)AU5jVPHJ}h1)nPX-%S2ua%_A|}Y)2R}5$8CtH{cYGR7i;dh*&NWz*Vy!&ue@zh zlGuCdGU~D{u9VbC!GYb0Y1Yyxy2ov3KPU1ii>>2)pUVqx)>E=0xxt8tR}`!e6+VpyP1*qCN-xAHKX&Up={+Fz}wH;i}op;6oJop zE;ks@P25+MK;le>+x9Up8l5krJi`l@~mgvr&FuW zw4EM9?r=bFW_<v5piMj zLzbt3VqmaIffD;HQmhJJu!8GZ;M!}Jl#^|8cc|w86rfMjx062?LcxNqMI2YWUCdDJ2>|FxL z3Cd}s&C-BUC3C<1jo>oCQ~_=S#qAJ0sVuL!yS%K5URcTij=l{T;zK1wU&quw@u`r? z41h;<)*Qb;GzrDIfy}&qMsQ)C5nTK-)!MB{1fgz%pYuhEPHT!}qVM0V6Shy;+BqBx z8=Gy26+=W+)1O#Mxd+5LX4}TtARRD5luQ6fzJ$kat*wKI!Hx9$%EjJD6ML4i;KRd4hK->gH!Gcwc1aIHR&v)31eo0%2%d>n&9|3 z{UWEGNJo$bDwmO&$S;>athp;BY$zyG9Y9X|Fn}QA_;>|FcyGNxzns|+nvC_@mrol% zHZib64ap7IFb`HS)nD(LlOG*wmUEnm^2x!#|m&#!Y(CxpYblB`UmV z{uUo4y#Jc+7P3_z8h(mOD>nh^(^oF5g+tEMvD(Xz_oLqm7$he*9W8${qpt;PVC_08J6~qa0As=y|Cu8zU%Uuwm>Hc&%kzI z*@VDpLx#><6g^E&Fi^X8xa*Q^P9Ly#-b1!c1)nD1`*SM}ShP1l)Nn+IlfF6>xX%!5 zs+xQ(*pzQ>wKfvEn+GDrMkfJY?dTn{3Fo04C5t>78Wm^B;2%GHVc1)YdPtNUKsn;4 zgS7NVA9+;bx(sGv%SBMoYdR`hST8+KT*Y$>hNtOgLY`xM5#>m9?km!3!ZULJEYSjt zg#o`L+OSPFLhBb%qu1O!!_!^@jX|d$bsOq3xnfU;{e@9*;P2D0T317m{o_heFMlxd z*~eL`$30PiWJj0W`_)Q}`Zm%1ON$?faAtaiGy zhC+rUSQE9>yK5&@!y%F=e+thf@a7%94}rrnD*WmBHlcVEGO!P&cL%^5NV@USQPW>V zz2l(5FHN23gH_Z2g*^M;fMF&^Ti{fFPO?1-GQNBLHoQVxIdt=!ux(JsihL~6~O|< zttRU>_!4`7$J+h=jLO?$eVoInsgY>mSgH8ai9v5-(+E@f@6NQfr}3x4t({QIGdTO( zl>@B6m@=Mx`OP8l>_1XV(iG8;riw7JY=E%AH#%zXzQQ>QecdXgd~MmX@9|xrQ;;3d z@w0k=&S{fJ*YRgL8F$VkM{XX)5hi%CDIj234<(;`^38JDE9qZsTLG8Am@o2ww{6{O zPmlJ%wrvKm6}>5&qaJna8MkGHb#Q(=^Ecc!1oIDWYs2stZoBFq-Jc<~g$Atouu5F% z{n?%*JN6OnttI67ZReJH9M?^bWCio$ET¥HvN<;gn_#9${2LjXe$G-j125y zVhaPE3)|Aw9KWQv#osZ}9TBF7>A0-Bez4ik#BuxS4#2ll5agD$6f)Tv{;Y(nX|>B9 zeqpo@Sf}c0fU~MR zHDZ8HEIJWH2^MsK|5e4f(FF7A>B{t3e-L@Iq2d4; zPXE71UTSYJ$%{1q4}g5Gs0A_+k_Xu*Z-m(Oc|LF}M&BsG(Fi#l zy<(b^5!#DE-S`*Sx8La>Vc#I-XV@2r#jQ~WmVKFDfo0#?cPn@U#Q#S2O$CJQJyl=T zjW{kzH=jJo%m~)n^!o}e#m4O{KM&1t9lPmTk4_>e`#m(n_~~v6#g90;ho86Zpu*b5 z6s4KPk9-_FHN#xP;XW}6vrBdT6WcO(58GQJGJ3!L#GvdGJJ$;@I$|{GlUC`;%xk(y z!Vr7VP%I`TDl$=+_oray%xaooNWeXal@XU5=#KY`1m@`7vw#`-8Eg?b<0D$xR9CTB zF~893Z-#@BVuQapgd%olfLZC?Z)}tq;9(4){{2+P=eY6heMs!NBd7f7OD|`dX2l9fD2+iFhGL z^{*vGo-Tz0&vBqsp@CMcuHF|!8|dlwUt0@8~8gy39{0lz`}!FJ0&~*rZw2Mi#z#mHRu4*p5F_0x_;X zn1c>?!APvf7JTpvx_hrJ-{;CVUj^dUml-GMiI&KVGcfXUyqzAK%1o1_Q817V%{wzO znNer_WcT$)=27EmaH#C5 zF+bFuUrY7%KcWegRWZ8B)l>XNiIraxkBPyIPFw8MgV@Wk8G(Z02%YCx8~?@|CW6p( z(Ritivn>}Ajp4fU3=b!mYZnwF+t7>L@?i%0X~o{&$eAJYR7Y(L)oMRXtxS&u@%Oix zN@P$#OwV_|GDP7v?FBf9LkY)72VhkG!HIF{hm*lLu@M+2hRi(2&Ve^aTl@ql+fVmq zFR$kKwEKZP7KBcWO$YQIW|wcM2rP%#Z?B=%*cT0yks=pX4w+bEm7wh(=|UQY7n$`WHbnud%1n(?3JoX zR3rDZWM_P@*9(_r)nO~QX^w_JR+bRhUhH0IYa_Ucl&&x(@0?BAh%w`%Z9YJ2W4zV8 z-|VIEbv?81nrm$5JF1zj=BX!kBh6fYTU)cuXM`Qxp2W0AEV+!^yQAcCdImzO-JrVu z(5_6Qdo`{H4LKH>^v)j$KOO_~RS-La2gB@`~KVp zPZIXkH?Xjrw_6~e`p`%JQyPr;_cWNj^hf!>O@nnNF@LAQTRUk4p)!FpI;Zzs7*oIr z`&DBB2~y#>X=&AXg^Q#K`FNx0$;NRJubj#n&A5*pKp|5a72I(c$oC~8A@J};St6sp z5fyz$HSyk3w|J-x%(J^CM4GDoCle`x@CW(V9xL6mahKpa_^N`;2(5YB|8UNrf_JKm zmu?HjKwZU^oaN5+t5^JiX5ikk@%nfwJSQVJTbN_J1vEff4CJECR^5F^{3zu25iR&y zZ8h;7u?-%^%t;>hYNHm6Rkxn=m>vWfQH1WPW(5R8hLb zAd$!)BO`e>U{nM5%jvRniw5I9EkiWE`Wa+);-;3MJy8IE^RD@)h>|WJ`M*(+0fPg& z=YJGr=4S$xp13Z}_&@qgo}wIEL; z4FPV8pE$WYsV;^&6jUTwZ@u>3VD-9`*0BGK--8<4NoexV|2g59`BBieeh5?FU)zfD zHnu*|U@)h<61cIQVj{RyVt@|Tkeecb<%!Jb#;uh*ZA?bdM}+@a8tXKDCWw^-Q^>{Z z&lK{D@}fT!GJ=1`E$9!0+@i}J#BPtwoG-1NgAa3n3C@e_zLJ?+r}(eVXV%aXC+961 z(L4Ef#c%|_R#&!!j>Q@l*p1ptD&tu+j=fT>^z=vg+yg2<#=-#xnde{MU%z_H&~gCk zKJ1&DKNzT2I29N*ICgK9RH}W$%1!);hM4Fco=@Iw+h@ySgrnhjNUjR8o`CFbjeOgK zC_$ecb{4@!C`*xs_7Z$-0!Eg1(1YOqAj{>H>Ceb=v|&8wfSXW^yr}hMd%;o5V#~^X z0KI@?0uZ4;o{r_pCZdBkA=AS%{ASmB(MMUG+dxSfWvz%HvGm5lZb3*!F6kh~IhmKh zof@-JqQI^Jlf?Qi<}8Gjk^{R{lcTr@BuEaGP@P%PA7e5GK&Z+Hl?S)TF`hjyf3?VQ zMlNTIzgpyST9xM(`F()7@=3VjKDQANQecvf9FydJDy-MsI_GnCH^vgc`&|x+_WW~< z?C{Sqa%|5&V}lrCHL=9#%dK*q|%Yl*?!cQoO+P-Ii)G@_4ZsDkl|tgx4`t4P{sr0n9=VTId=9} zjBN2&jI8qSVq_1EgWoao-Cr>>Cou)MMW*}RBKKTAx5yLvHJra%Ig zl#WALBXKy1MyY^fPl!P#N)F4w;p(c~}i_)oqwv#&ZY|o%&J(;j6?{o~uBuRyCNFx&{o7cE2<^)pE(hDsnD@br z(85;9wsNd`y0Y0$t$egOM#!Ak(q9r^>Woc3yG{_c118dm{4-RL}Fud-{(pX4Z??9&riTyFih;xeiki1;7KWzaz# zHa^hfcBiDe@w6wSg6I~dcuif3Wrpk`hY1nxjn7~JLLtq{NJwHROcKWZUPlgH@y?7x zDeZA_Mv)J3Z3OoGiCp#X@|Y)VY0EDvPB8-!#*~5Jaa`a1>vMU$vPO{0RM;vt2|0&X zpT_%+N^9)+PkC(7YZ?kJkAXw-=D*Wp8SAF>nsc+Vb;4OUsxDjki*;<-_x`(%Og}O; zs*0Jft!-sohn804S;DZNoY)Dot@592Lwy-*Ik8YLhxVm#1_| z6{khLW1WVcMIF5RilfgXe9{@6or=sDjE_>3+8q?Nt1TV#nsWv(bB8PF@MM3zvE z_-Qy(5B)}WUpO3!*bAF;^WOJEX3%DOve)#n*CMs)A^~7|@A6=HeUI9<&U)t4v?=Htf-CM5w?Ah`{aP-(uYdHw{tDaeK#Z@ z@}?Sm+Za^NdP%9a;a9=MeZalUUMbTSsvNt2NxM2zw@eH9U|SSVU!p+xDc77tr1MgD zArBjiYpczx$RiJdROJe3Q@~}rrq2$a9AgR?xEVlY z$`o67f~LmsO7m@7snxmA=t6|kq4`3OJh(e{C?0JnH(no%gqu@OCfXTmzM?6gl{@B~ z0GAu3noBI#)h^W2vxlUT*?pR;2uaCYpABtMvZ60M&1&)IQ!3B66s zO$i0pZP6$xI6KxE|C-YpxeMI<-5qPMe;OEwj6N{u(&ve=%HaWb$0OkGm{1)W%FY_+ z>@(W2^NhXbp(|%*IqU`5S3h5fCTlV4=5z9n`8mzR|)Oe z!`xJd78yd*)Xn*!eVl+o`ndwm?ogVku*SV|-i272H2*?z2i1Ot*5K-B6ZAH`Bpzo4 z#UIH|mMvd3_3c~LZXb^#&q{Y=Xs{r?dfw}uzNt)hMwSkuHk0|n7!w?Y0t0#KNCq5p zsHo7e?OuK%{dxo#1An1gV~$(M?n9P+JV=hSW9r;5(+kbT#T$w07&9q$FCzajtKEeD z6>KJz()1!}9FJWq30AI0j=cFxEG;2LNSj1#UH#X1+I%cAiB-7$N^FRgz%vMg(ilJFnYfb+ZV5Yg_&zEX*GPrmKm?bRk4j&)4 zAb+U7yw28qdaUOj+kcUs0p-5xe&T(7y;_Wt(O-wZG_=arm+5J6698cS1q z1H$%$JKpf!&1CCJCd3)&01-W@JD=j`TVtvpeHIzO6AhZE*`tMB;MTW}>CkJsjYKJA z{=^^xY8`yqW8jPGaGE?LC)Mv}4m!Jk^~tXl1E2fk7I{0lun*lA#eHoqtNaJ1t*gf6 z5P;$jW+?8SU$#i16^S&MPIA??#$j}1qTmex=XVyIA1KGXX%jTD?$?H(h5Ij>fQu({ zOnbe_-%J^5+b*{4<8nRXA{=C@k{vN= z>&;G`YX*!sgCZ=_0i%Xo6UW`n1WDe9p3ax z)B;r_*lULP<25JZ1ytX106l$%M*aeunNjb5fz7dJ?!$C|UtqIHjFrFpQp-S@=|$S{ zdcS)IBjw+{X8Ye>^XLDq*X+BnAJO>RYcBfbHQN`{_{AYSd(D^eFfy#G!2K(T)Ri{8 z9!7a{-qRnC?SH^#g#KMu;8;35Zxp?kqifh0*lTW-R`&Wf2lWyK>@`pP@|u~!Ub864 zv)3F6lOoRePhK+&*lRvNLXtVkmXk?C+qBUCRVVjVTs_yx*O?i&q}S`6VynO_{vS@g z7sjLFa6fs^iRa(SpSK-i;zWDhms z6ZgwWFz8HQ{}<>yWPOIcee)OSd^+lQ_3jCuMT5pw%Spj7as*R8FBGtW7I|ugm>t8` z1@J9E#wCKsn5XP3F%EeRQb5DS2ZqQv9e`V8g}nHY%m6?>GI2b8AH+KWY|EoJCa zeBJvzPmg3g3y?079g5utEQ`s~PvTfVCI#(T@7gE{vw=eTLYs+r5Spz{PsquEC}k6Z zT%BE23PYzRWybsB`jFg^MIPW1CBo~o@2j81SxX0Qk*rP#9QxU^!OFQmfi$h%033?e zWTmU<5LY|*7QPY^i#;0No`$Ghld1f;sE4BLEoA^9&FMHXOuGnqs|6^5e#c^N>ltvK z{x^X05pj)GEW_fa>X#gvu=S=-845Z4JmrPu_`xsV0HVi&#r#8K`KbxaHIp#a&>~@g zCb2T6vhO3>#TB~q1OzkvG*yl1T|QgCThwb6pA{LI88Ahez8{6+?1d->c|W+w=xgA} zNX+U4oL_%Dr;!Z4dm(9X#af}jBv&zZBO#Y^cFkO=3A|VGYqA!-lW_hEa0dI$OsOK1 ziJQOtW(~E{Uw(7r5^bnYR{j45a9;WaI3q1hbrZIMCfqPdK#${ia2y%TobvTuoS~;R zKQHtX<3=d*f>8u}%2!*|1vMgQ?poQumdH+jPN3rscpWv7p0zmKOYIG+aK^=faxYv3 zeRalV04g6ci^@!9?S!AuYQZtG3x3Uc5N~`VQKmWDG-8YdzJOzYOAgd>9ZQ_{dHUjlre%t3M6~|MY$`Df?5#L)SuG$ zW5>%cS&uQLDGZF;7;3Cu@@_EP)~eS~5tCMPJGMgSt3_LiCCXS+;7nKm&E{I}^-v+- z^q)+4JlI_5=0)L?ZRcJp0IMu49WSpQaVM(nM}1t!Hj@y^o^9Y{ex*l|g}a;_YFanM z3<*=92dh?v)6V;FHIM{9bU1+op4Sqp-Cc{)RU&$wX#=%p`Jx#?MBf&NIgL=AEf-Q* z8Y&1~0+$kapjJLLSG~O6xNde@`BYjY=X&~GfIW5G-!SHQoC?W=RneWhhWpDZd{b7g z0r}B(9D*ciy~O(vKAiC?TiS#5JnF93S(nT~0Ub2Oq-&DvO@2$&0BS`j3R+=_PN?Tx z7=a&)x0rJG(d_5D=UiAf^>n5r!5N$j+Z@4W*<4z4PtAUutkZt4QlzWpDsR~wXo#mT zR{;#%NU&4=@*cZw!SX0GZNUQ{y;+0!5$DnFpOWH5CQlf!*17te6!*RXC&kW=^Rt&w z*GB7qONv=GoJDQq+yjP?LH5|V#6YgE2bN5(xz)&<3!a}kVn);4gj((tHxQQ7WhRH& z5}~;^AMN(z^OmH&h{MMLc>}JWUzaxUlTO@(-@Ot41v__*Of0Y0%+4JOk~HNEH42b6O0y zn;lO1+U5d&y`%%~7hR{O`%p70`P4omBLvN%r1G~Ccp?NL5%1}^Wg~MJJK$TU5bz&Q zaH}4fE`oLQL-YC#E!)qn$=@|2S#6{qgUUFtiTLhPRSPUrv}B8ROjaV_mGHk4nvW&m zAHf#C&AnpRwY531w10$4n@L*Bcd@qq(n?iR+F@sA;bgdb2s*&UB_gaZQ4NDZc#XcH zAofYUx*~QbfUKbbDw$_P7es*v{=chtY?qKzB|U{%l&^fH?*PdrI{iDbKK%NvRuqQO zX6}xK{(yk$2=4n;Qc4E+r3`lXMNfSzor8jHqY7iPm>o2yiGMfP4&Vm+{cVLu_vS>w z^_2EjW8IRu!dD~plcZe~*tzk|Ak~RC0l5JY%0H1fCVFt8K&wllD^5O_6bMNN{)% z4-lH5o(kF;FLo|%QxCTN#;nrGO0q+scCw8Q+oA7BU8}{?qkWYfu-I&|PHoOOfvg)- zYu`z&oSMf#?Wg5R(bksIj|xz$;vPz+)0ZF&eFioDOam|dk^OdMQw#2oos>agajOUdy^Lkyza zLdZ;N!N!36r%wC=4p~yGtGSp8X;}@w z<*Xg!Z|FUzW$?ZlrZf{jLlCM`yfE~|%Yg241c>RcaPw4IAM^wW@=iBE6R+TKfDU@f zy4%jU=u6;)oBcJMa!;t0P408T-G{{aPYJhvO`b zM&17_;a)9hdnYB@D!yUOW~fy(&M8^O8%@&B#{5nAvTFy#IfRXa9Hki$FI%m}gKPA~ z6GV28O^GNZ={03@agzG790d4)i3g_*5}m-?IRs@6VZS7{=A{;{E+@1N>x{N@sz^0h z?!11|&242d$}W2gveL((1vcER|BEl3DQ>(Uwqwg9W`Jb`eryuVdY?WRf z85*^EJ>-^u$!t+OzyHMKsnF|0adg}Cqdj&DcNAs^=kc*o^t@-o*E)^!oj&JBb!(q` z+Bxm?x7fZcD!|kza_6ug3n_qmP4$4)4wpIb377%1o+b=&N|nhmn*fR295-!VipIt0 zwpeOXOW$$NEXqeRB9uKUl!KQfSCbcwFU!1~%YG)2O~Ja^kw39isK;7?!RJj7FC{`;fdz|O;H6-6d=9gi+noLBtcTpuP_r0v+y<`DbEbXFwe{c^)(d=> zd{gZddXe7Yo4&r>{lI`dv|&>KAppB!n8}WHd_2GrLA%^lE71@WVUBxmRUq>1_~J6? zEqbc0O9AcnsbflCaq>O4a-4p=5rD~UMy#DhaQd_%M;OKD)v*LO=MAXNX!VIuLOZL4 zS_cmzbgvsPwgyG!Y1$y_9R>q9-3C(r*LK@V1l(?CDQHxn>cf+9%9|cw!hey>IlZH~%Eni9T6Z+QZXl*hf?k_2%rp5h8}! z-%*V12YvpyX)5axgHn-f5(#cawKWy1!d1nCQ14i=B(Tc*Ww9jqA?zo4MsM%C`Q}ho z!XwtB^`k}qM)5kRNkH}wFD?FymtNXxL$-}OedeX}w>|sgH1t^i#!HW#JoD1KO5Elv zEkn(}cxfxeqwi3lQq3p_ljZ9jbA63Jy!539^xJQ#(O_O0=mSS~8Ivl+LiQ@q-kD2X z9Q}UUZ5M3vSTndZtumD{3>IaTFbqazX6d!HV;;Mj7wK|-YxtH>rbl2uQ+fD0rvS`L z_s8o*ye@g>rMs{G@X~Qbn_ymAy(P+XOb8ukXMpMwbE?mOD;DEu)07;A2D%BtYyL-t#RDC(!Bdgn!Cey z3_UcD!%Aazgf}&Aa6qbK;LAHkU*j*#(@hpjk}u5XDU(48@%?urj>YSK5B!l;?^QK8 ziYij^Wa6PtKh`TVf6TI*&B-LFm&sTUV?laI8DdERc@cJ2#5Dm#d1$0qcH|@DyNFC6 z4K~GMmZAGK*YFg3f~?~b5<-Je;u1rAoYNO(Z+AU>+tOIu7=jDh(R+aN-KMj2?ZM&+ zn8T89b7h@g4NS;FBE?M4lFGP9kbE^VpoOmS(R|MpOxy<}ToM`7HBYVa^2pFK+ayk0 zCLU=GzWeGx+Bu^T=*uC@?Vb5aoS&KGgRv4HW_O75%b(v_<@IQK0~rUB3dULJLtPmu zI470Y@sVDl1dB^*lMYJ(O{n9}0-|=;ak1}tFw1dex@JU}KI$mCD)iLi97e-`@-gs7 z#LQjtH8N`7m1yJV=EtsbTlx^RyT(AIw_Gf5>+ilHhTo~UCz^^wXfhlEeGC#1AAq1L zQhv!6g^mjox>DZj?6%dDCh~9!U<7E#Bm#IcbV%*YXh(YY(rw#Ny*Ds)N#E7rIOmF@ zAbWyfCa@WRm~WbGUe&zXnMS_IwjPxBUPJs#rN)4oYCYl_QvRb-tNu}`rDf3;%8dWN zRO&C!D)nHz-fxv!KeoN+FO~W%`%vN^RcfHdTi~vEoU>{`5sT>!yh$5xK?^aC9_<=5 zkAZowfgbXS@yXK8$6rY8W)`lBKFH3mb+(^se#ieRR4bprXAeG}P@ln!D zZ*k{7et(w8sSC=~MBEk9g%jw|xHfN!;+*6HaNpuO1aPAj*35@MAHG^I*&gr_+XF)5 z;xmTGDP11FTf3D9q}M8DpTgA(>Nzj0Lc{?G^GPdQI9yYzoR+(O!n`^VJZMDAJZ^N% z3cj8>=5`zHp)&M&)w;dIzJ2di13Iu}z)m{thTzAj$}*?mo!Q=YN^4&RN8u|IM~0Kn?gYYmFOn*^)WC_o~xN-gAI zo&(wG*M{>>rT>bw<*X#&!%ZP2l!y*%HvcBh1@`$H-!gnKQcVi<1Q>Nn$Vvc3~1cA#9SgPI_f>=tie=*+u?sn!@~7_=D_r-BWm8@AfzP7>ybmjguyg(b#qx+qU^cjoILdZQEv( zG&Y~uwzJdUTI-MZ-Fu(h$Md@8!JK2<-|-nv3Pk&AD3RA5`tAAJ;GSP65N;p@*FuhQ ztpogj3{ENUPaVQZwo(O>I%u{Ah)HJV&~2myVDzIia;gqGXM-8M#Sxrut6`d}_^V=? zdtkz41zKK1ZGTT73>5pZH+Zh#arDGEAE=sPIal(}fi+j+sv(UtC-3Odi4yZL)bqwhm;ms!p6O$Bf@?KXs zgraWzI@irGR~n~_+da9{6=cK8%P>NLek^wVmTGTL&qC{lN(_u9!y*DwwV^2i_8Ig} zMC>9(blhR8=tFfB+{eBiEd4kK@cO#!7F-{VOV;QTmgD^??fE#|%6cOEHO{$UwtSNB z?8xI2W$c8K*LNRnnjAcyS>~(cUxAIY@#C(+C5;1jUT$-S z>f*J*J!kt86=OUW`}qe}#GgZWxq}F(#)&1qq~X30h_#-X0(&9Qb|K<33Ej^&{uLWy z7yO4UD!)mNPNR^5*m1Y?mjukk3qt^HLh4HQez4%T-HBBZc_k({3>T^)KQLS zRpS<@_Gw-r!76$X`PAjVo#{xF4`&(&MJbx~XJV&`9NQC@Y01q3Li4$xfHG7&d<5^zf@&ig%}7Xy zr8FpmOB$A7BU^3zVN`nL>&rRI%=g+yS^$)@Wvj;*n)8&+;y1ZD()5rzkW+K-W7=fkXgBv_MpD@^d7H zqaM|d@N*h-2}QHvO*qK@R9buGc^=?}IwN*c42WQcLsg%GjJN+CanJj9&xY|l4bZ81 zWZh7<{p!$)TPwa5%FL&k5@VFW97&UYmd~Ea{8q%_?$_38_{!7xopO42KcU1Mm(O$= zk_L?h&h1YLK#&>BLPJYp6c724WE^&hM@0lC%8i#HovPVv4}Q_t_0_YI!0hYz+wFGn zkJQ3R)(0J-L{WGIl;u;f_idFYBF$l74{ zgKGa|Z{mL}N}PWE|FNk5o1%sgZH1aV1p3P(l!gP!jOUIH< z>Uzr#nF5-RT=wpHh1|RgwKUaCLFZp9{syLQrd;x8~yhpD(h zDv4=Eaz_$brab80VcCl`0mkv%+8-P|@C>Cd8IZ0gpZojto_UZGU%Tza`zhC8(w;~o zGSYaEOZ0bmn&x4cAW?zF|0_-(sRW=#4yQ7s5DEIf^7N?#TmO#J?=(+ZxBiXOH;%7) zZJiQ}8OgYBdM5U#D{V)8=@cHutj{*3%ie%SZxwi`7AMLI_Yx2{r=7@KzfU>pg>QEV z_!Gj#_~z-~cx~oLUyFweR zMgIuX%Mg8p>0jlg@y}W(;=j|u4B3&G_T-Rx_OFf+R^i`L$Jq1H9BXu3YVk?I$%kOT%Pc zAx>pey@wt+TJE*%Gc?0S_@yFZU1?y>z=3$`CE0&P7?R@x^j*Wi2K+9RlV8{E61fx) zA`{Uvjyh*7je8<19uKhW#r?VdTrHQoOPCCcrPpOZ@ZI>434!ekb6PcaZ~Ao-mqL`o zmCOd&^)7RT%&8l~_6Ytx^JE9^Ahzue9H-kRKKSdxJI1&gq73RwLC@mllwG8-d+V2b zQ-U%=i8DY{f_4F?hfCA%eEZr>OHq57x*weum&0xA0WrrlkgFKGpM}X2jVQ zlWZ*taYx=!55$A2@GW)+ciq?DN2+bqszSHzLkI_F})(riKY{iJ$o|nn!9^ z>DPjtftCYk+_3kbDWE3gBY_Mc3@U;olblNC@&d5KV+jlhL&>9khB&5;KYY;)3#PX~ z68(=AnJ*%wNMik4rKTHyQeD;a8Lc30&HPa-{Sf@d<4F^E&AItnD!s18+Q+9k3tl)Q19=pUbyN$czff{%EZ*l3MnNtT{o5^oWb-BW2*ykGU?p-OsBi*zU30jMn z%B_OhirWMRcXnBpsVL7Ku^;y)i4+)&q-qmC zKb=*YP^x8Xeb#b)lBe@II&ZV;EG#yU%*S6QqWTmVaH+g>qeb6A?g0}|75j{xDMb;Q zXwypm+F`SI^**5jzO0ngdF-mkg@36`6YNI0M=xoG1KR3r|MQ;8)DN^9`q*{zO-0+R z3}w9jSC?wVPRNW@Kp+#H=4feRx#n=hywsbyq%undo?%~RezWN+o1k{sLy@$I<~KS3@gTsOnU9`JtkCEk|@Hpa>oP* zgDe@27`AxKlyoUpL-GlMsx=s2!O4Mm$!G+CoytZ0Up*j26;shX(w)B3Wk^ArL%;U_ z7kiq9%5E&{U-oqCKlZfOf7{b>#tx|BMUNHP#Se!PKPRFw*W47U@t(@R`jO{0!sxB3 zljV68YZerlHA2%;Q<2g5a#U!f^w(>{0-OgEOS4(GEf$JIjC50#g?u8y<@1usQl%uU zEE|b+McGT;(IKKfN=_s@WXQMK2|=AG#R9+omt@pvnxM5&?k@Sg?@OjuG#pvmdMUlvxOVkTK;SS2xg4$eyu0J0bh z4b$U`%B3hgd1^>H1zDIih zcB(J`<5WYCng9vwFes6juk-m!jas+NLnPO^frKnrL=aooK>IojO+b6N`(I63$X9Wm z9P}u{{INmiJ-7AR^4j%UzVM=7g_1xyw|%vW31a_8z}_MKUQwCFy{O8XyPznWcbTbr z<6c*T$ul{DJ%oLvNVn?X)fZuYBE=Y0#bHi3FaFmSI9hnj-IZSw?NJ*kS3|ti;KllrYJU+xAXk>9~{>z>?S7U=Jb&lPxuwl;z&Z^~s)x2v2Rt;&is=DsCmvaC>|5|=? zvzYY#Y9Q_^iueNGOus_7FyOA#{CB4*OkvDLu|y{Kb^FgLKnz~RH3!cEyCk8d$je7vBpI+F@$7vU@zG{I>bu-Tkkm9{3Czb$Ipx~1ZNL4x8X@g+ zm1`h;$Ai1TH8wq#_*jlSRBg1UQKQF}eyj9$?v}6PQg=RzQL$hjgtOwEU7c`gd$#p? z;n{-PNBpB6oL7H)T>_)%RcGDm$n$igJBBIPgnr%;*Y2B1^JHtF2*W3!2gX& zue9F(FHBneKbZ8qF>KWbCJlweac|pb^7Mg8=P~i`C9SXj#iZXpWfVbL56U|r392>bfB%OjTZ+`k>0f3-URZAJrF-axp*H9&-tivWQrb@gapOzuKaZ#$2 z@&+r*$^u|c?EDudEf)`&(*A)-H?-7(6Hts?5sNL4&$yQP%qOTM1S*WOog|Z|TGi1Q zn86Kv1WNwMv(>mVL!W|v{L7Li#|vcc`Y^7gFNpWhUh*vfwe&sqHZ+Q~W)Gpk`Cg<1 z!IQ6Hlk9H(rq-_}wH#@%4ejWMl8X0{smxn!ON#NEYL6zX$1mutoSK6-`9mCRkv*lo z0IRee+;6NEVtc_9y3g&`j~4K`li z>j|~ep-=Jv1lQ&)U(UA=O#1%+1Cw_AUzjw9`8OL@nXUgXOuEpx!e`O-Fmqx_;D(LfLoR*V0&{1&5uHu~z+5SXv zHsSgiIsh-p%koUI>)ZkuX<^3WP_|I_waU<@tp-SFi3JN724!@Xkri7PH!;=VpWjwK zz(%yptc1^RuXv(fLh6dx4-r~qR1Yxya{LH#|0mN8@*tRzkr$;|?R}X&VX%-gO5_tB z8gc$0q*bQ>33Y?Y@)Q3pNi)25kT(2T{*k0hn*J|I zdJE@6k{(>q{*a_?{z}sAACmN#UCaNFq`N*OY26)0jz#R&FD?*u;D!CNI%k))pc;g~ zlJuD5Qx)EaB#rnFBrQ4*rN8=%6X^qz&asR64otNgqc1N0K&xzHG)vx$%J| zi86|(l>@qY4{EMjr@mJ%({?mvvQCW-`qFZkgEGwhsfiX9Y` z4#ThSxZy6U?y40(WN?!g@3y)reXCyZF0$VtzfJ*+X^you>_K+-A*D8QLx^g+8cc5I zN6(FgW6zvsEaMG86Lc2dO`^^U0M~YBaM)K4B5gGb+id>x^|W?PhK>c1y5r6UU7N0r zGMiYXJg6!(!2#t;i-8r-l@1~%-5XT05=~tfJmP8cLHh|lzF!E(k$j8{N}`mZZ;$Au zgm?kpOdvNKwW&x&2}i*-RGa-=etcr(@Ojc%NpNGN2D|wxR=31}Qfcq80ziAy3Dek- zDrzwh7@ozyu;tU6B_G2}(vwI8Q*Emp8bcRRnD5JqH7J z$^tNLFANpb-*0ZzAxEpAODvOq_HS*FWU*!rRr;t678O1W7W?Do#3SHdL2!cHy7>d*SQqN3#J*ww%lQrj2;*ekCl1LwTp~}$JF`ZlR8Gq zX%o;3GDr0NZU`%30!vq`e6xw<7n^l)cofo z(+YW2u*w&-)s#SPZ)tlwDhu}+|0=H)!yuFNrjsyv;Hi=t=c6n%h{5C0IJVKX^WbfZ zGW{N~t;2Y}FMaPC2=iO7_N#zCa#rwS*3YO|{4}3ltrQ;3HnXDllt4&js;#_8Eh459 zbv)AqbA$Buckn;oQj-J5WPiqYSQN}$zo!vpiq8^{a$@=xBHv#!H_+3-AkS3cJL$Qtqu$UBR5cI;V4G9$lDhMbo&O7z&iD&T0~r1{C~Xl> zG1OctxojvRYF3;5A5hxa#~sL0L?n}0Rg1f_*s@|y-SnH5E#eU?#!>hDt+Mn$)T7*S z>v{P%4XLa5(i_L9@S>0y+@tMEF5G6DRnt)UWfn3U;1Oy?SHX?nG-d~l9UCUQF2~Bf z%1%QUar|iJ;Fg|aBFNqsDh0LozJ>FG%mwb6LULrADUWAL6|R>aT(l5=%jTN0EqcnW zGlF;N@!;F`vO9j(XSaoH$MIlN z#j^Jaa7Wab09)F5H6tC{T9FDSM+r75u(P0yMc(6H1%kDAeb)V4$C$X=AOHN`+4jmR z1gA$qP_**O>qWZ5Q+P74M8lVc(z{P8dg`x-63Ys<=_p>LK?7;u`r~I4l#8(p%mxRR zHChcuDb?l{ufKTjaN4^(mO93t@iqqXmY8o802jW5G#6e!+{9?yzV&0e&6CYQ-y^S$ z2v`&k(0S|x=1jZTu$>>C^!XEEXFJ}HHKI2lVdQHN{vKxw)vY2F zk&YrNWC=GT*Lti3$G7*Q)vePk<`v0B(UEUu!^-LV$2KDojLR84=>yzDYkjXq?dmCu zat32;K5XpLj470SQT(ifMKqCOgK+$hIn3(TBKi?Hb-`aopbDF7;WKEOt);9Z8E4|S zNvw><27{2*Nh!x_;-BEyQomA+TEzi-4rfX|hnV)Ep@P^H(Z$_%WC7e{0Whyn=khzyc>MQpkc?6Ckk= z7A8RV>UM#`MMH%gQ^N{rd>ef{4Ttay66a%5zMH*)u7__Qo8D$*yRBdM^->u8s1*7X zdumsHKJ{?4HI*9!cD>0SLQ*RUxQTyeqM_I@;u7LpylYE!7q^N{ zu%OxOk=_evon>76kKn8!#~zYQ#Qw2&`5(cVDfQ%j{J#Zfo_`6>z>60BwOI${`Q<2Q z0jSX!t(zaJ#uPbQ1)gP$GMz0jMwj@hIXvZkViC-5S%5`9-A2L3W4v%o3*4c3-9(E8 zP_bs9r$|E^6oq6&E<;RWD`Y;(>UnfuGiZcN^Z0{7r zwH|WXPCJpy{#wUe|0w#Bx>EcrTUnGax{eBgMKippXAza-PkE!{Ypf;(zZEybl^}#O zl`qlX3;~Bx@KBvfamFg?6W||UsyvkJn*g*B|EZ_n41=Z10Pb%W9E@}sgfh$8(at}8 z-8T?D3>$BRh3z>Ji(rqxrI^LUwRfER-q2}g69jnfffQPJ@au0j@y*l%c#*z)YW!2* zvjzF)CNSmU4tbW=Hi@HU2o{Y^z?kW`!ih%q2!O98XmF?(dF7#ZD>W)6@HZaBS6_sm zfd&91B7pbrATfBi;Dj5vNciv|REYSX@F(#`+m9rSxI)hf(;DV#vFs)aqg0VjUfts# zud-C`8ZlWJ;=M1IJms4V!*oSQ3QojODA2-Dg2YLWJCONrb@gbjjOUEfE9qdJex@_U&^fW;u0OpN zTGJ9*jNVMr?y!tEVZ=+DNl1BEtX-mOcI5)buAq?u>XbX=^d=l5_QT@`hTfV=zby@f zT>r5bLhu#s6po<_?cv;9n_Lg_Bs&OC^7L=clBdM+Sj8Ita`Z!Bv^JwUA}tASG<3cV z2N@!*+|wIB>=?p!f-jL1DJcB~0~)0rVl9XKL}sTvJpVaxiAhpjw^kbOtO> zWea{NV7_ckMhjhP#dKJ*#MWSmDd!Z+SI3#Y=M6Jjtx@*ph~k53UQ3{>>Ar!$iKfGY z+CvkY{`lt=-{tVsHDMJG^QHq#zhMV2;hjS&ECeRbuE_xdtp${gz%W2F0}TsvWl($M z40HwkCek++^+Bw5dM2k8P3zXw)F-?;gT^sRK>MKwR(ioQ?+Qs>Uc+MIICFy8@plMu zF1Pi^i!<&hDtj+VNtPjXw8ezyrV8a$Te4FJIwAfP$`zB5`mHl}k$r|U1XK^)T2_UO z0>d2OF~DB+j&sr&62&yBR07H(bhbc7Aig^j!~%M+{%U0CVFqXyD5=JHhQ@4Qp9I7q~j{%F-lc%-@?Mrza+ML zX!Q$f1$XdVBxmz}atZ@(oOoGkcx%Ims%2pS#@_A$i6?T4HUbTC{ls_WRGmJ(_}I@T zS%@|}E0l5R>mB&XM#kxZL4&s5z%jD*vZX63Ii08sF z#-iqBF;dH~YhqPGtc<0px|k{MFfrT>rODlfZpe?Ujz_; z_BAk0`&;mcsA%^I1dfYfLugB|KQ(-&CJn^P;g*$j!^UBDLg~qPh^+%=Lc%+vlh^V{?5t|!n>Alj^7AfwvJs*wE@jN8pa}t_4S|oiWCoFzTDMC# zn_pC~o2xPrWgbS!3#yf)!6N@H5Xph`U3IKiDi_6fV++}QE7A_Q8T$zb02+M7qL=mP z$2MmfsC4dt?}t*1iS|sS0Ba-*T!6u>F4sBl%C9zyY$gr@8QJ>kwobd}oI?#f4@~0{ z)$$gKg}1irC^`u=`R52!cO5E?4IlRHApynnw*JLv1KGX=s`MEBWweEX_#ccmQWEmN z810MSnjefd0DJTPK`Rs8(#i7r#inL;QbwXV)UTyNGCsQ2q9^^}f&U*zTUVX%X?zVq z6tA&r1>E1_nwv|SqjPVTnDxbm5~M-iRk_>v`^{34++~A@Ojcf&p&gzsN3j_yOUqyG zOtmM&;>fy-%B6l(T|?f?CTtgF&4g`bS#t9NEfOBmYVSMCMWp8%u&wIDIN$=bz$xQ% zIk-PNR!g@LemP{9BcdbFhPr{()+OGDBllnlp6A_e>buCC}ZoN*;ejS zZJyhP8(%AaS*$4OgsAu;O6yllD0U=mxGOH@xp0^wTcpyvtP!mcP?oB1&7d%OYsV9o zwDq@Y(xxV`EjiavwzWs%0|?_h%f%8reVRcY&4KyDLr)@>5=UO7N34vu{^Etg1=2s% zf6&A-9|Eb*M&|Jap8=xQ35B2hl5Td8Gv8p1vZtv%^4Ijldr4_D<`A>)2n7V`rfSu} zFy0xqQWqi2y?=eE$z__?o&U18OXQrqiegBP0=0z~&E%q9;v6Klxtj7#3CY3P(dk>5$nf=Fy5G+u1D7lQB@N2h1qaAll4cujtj|Sb zg8>FQ23Wq&gNESti*ipmr?OR3eNMmH!{x9V9&nSZ@YfEjo~mDM|TZ!S^Nw`D*^f0;p}*1OD1X69SvE_;89NZ|XT{glh#uGnTUITEk$0U>BV89>omE~bP4jI4 z|J$=$U}tc^mD1QXcjEyY=ETqDVA@-cgm(;GIMeBX(vxj9r?|6F z91O4Uy3n;aKKoj;7RRtw$2+e|&+PwdKAUP;Hu9ChUv2Pz>FNf?ykZb2{w)@jezhX5 z>9h@K?bEj~oFg;IL~A{0*MaeLt|Z?>(qi>l>`jbQOnX5*dxSfo+?OfP#Z=|MT;N0k z{KsY5yQpRuGwl%;ur|e*lQb@hfFM~cEN~D|n&9JhRc|@KIQArKPDf1ZZ#r|U89G~S@H_ebd;r(sXCM3 zaYeJglk2maR5X6Q^FPpbM1F-;GR#XEXUye3#CpglFANzp8ikcr25gNW??n>_6qNNhXRE6suT~VK|(^^=YcA|gZS$p)gOM7OnmK{8v z+Y!ymJSLRabm$?EX1In;{=UM~7a>dxRw%rd;Bx)#Tq%dsQMcfGO9+Z~qb_e}n8SA7 zheZWl{c}77ylr70HQnDyXz$MQj?jBn-0`X1yBwpHWoqdMs^En(s2~gGrMP7F(6gzz zl)5auwv?JbAl&isO{#q*vBY-HZ#zJ()zPF`WvFo!Xe*CJ1@Jk^mP!8TaHSTX&KI`h zN0~P|5Ji{|FsY~^OH0X1B{~-c=%=FnFe(*caW>*Ia;asinU67(fqQqQ1+eeU~G>9o;ru4}!6y7}%Mbr_UK+i{y6BWNyR#lY}k6lKS6mU1?VXAdpwEy_%+WSySkozX| z*$5>@BkzR>O+|_kKO>QLtb$zpD?FWul9m_w9Ht9Nphw2%$vd6lB?3nr?3ZeGyiZ0z z^|)q0PE@!o8inFFZ!$zs9odvm;oIZX%j$(c7uspFGgPqPp#&n?blhS{AEQGG26ipE zQLa!|K7f3=CTLbdJj{qLmX!bv*TjR7I4n_S1ck3KLQCOdTcTZ)99|8w;j`uUB{tLr z)p}u4&N~lyT8RYPXMg|KLhQ%0)f0u^>o%}>g@7_^dxt9K8u+a!6ay&k5?BXS^H3%- zw06C#&lIqc#bR;&JVNRiaw&`nU{M>@u&~$EzrD zYme?J)yYH{HpTYLT1b<%}DdD~bN%#1#)3F>KkPQFe5(D7>ssc9wiY zYvYC5J6SjUU<@m!s!yA3W zJrUE(fvH=(=6<<5KMJSsG}?*d#)RX3YY$L&lJiA9fjyVW%5H*7!y`TQC92=Uso6*s zy9%bth#&%DV1Z3WTz;KlazdvuWG+=MKv&SaaH_!P{ z7EoIw&3j~gBQLYyrL^q$R-oPN&ZtD=7du^XmA0Q`h%6%I9HVADvN%q+cuHr|%3!DL zFE-`IUJvbwai5?dpH#ag2|->LBX!6ydqv@hU=}@*X9;SP%6||ZTMS=-7m%2kfKK~L z*m48I9&D<(Tux=+IBP@%C++gKYp(AKTBhp+o5!{1-Qn-ztDL(-Wdo+@uAtw06iUB} ziAU54dDqf)%j0#6%mQ2a!_U7`-{%{P){`Q@!(|~lk!c>PGnIYNcSm*9f6cj46*MG% zQ*KroxLbC}x-mhIbUj|i@qK?_>kI}4jJSM;co7*;u@#L8IdWgY6%kJ{1;0ypx8xWY z+luxD92fWog^3MVQ2dnj-qMDpH&=N}EJsK(luzdz&aHvpygY*HD{%lL=gwZ7)#Y7--ob?CvWeT?Na8BE$ySwZrrhy< z`!JUX953Uh8t`uI25Z4| zG69X^dh-*B{M*p-{ZzFqZ{sj}#~w#8q_cuH(T0R06fwZ-)}WYO!;h5*wTR)?R#1%M&bx)Kv=$MPB zICB`#7WvGc)hSVkKRLt71AF0pV$zsT0s+++XK&U`KC?C(5m{hDpoeI}Bq1)4!2A7ioF?ccTQgBAc`1I!UXbGQ4+0-@eGsIIzS`5 zEAq-SonOg4CluVgNYdmXUh@5M0!1UoSD_Kf9C}+-W}HWrfe7}VFai`kWiWJBV&ppY zomIBsaEvqmdqPQAz#MxOm7eaTy?p&xqYS1-d@w7|&<_v@JkAq2WwqD7Hu^W_xG&PY z`$TD90{eoj_Mv3{rSZ&sEn8wSAwVtD2cjggzsM|ud+)(br9j;VT%72e ztGF{|cq)Ok4EztIQ6lMylza{jvQW~f@6rm1i3z8&;!s^}^|SLSVTkup2Y`eod-tQy ztTOP5r?Gvg#!ZYEJE|3bt9w1#n{?#21jYtKo#zL7{q zlrSKlvM>9~C1ZlPkOy#z6;01v^R%TvPY1P&UqpRiqzVXjj=vFqQKV3MA@Mi=S-6`m04*!SJ!O1~%57vNS{q zSZ6IB5Mxy$_eNwBkU_RVG9Y#T#K@b^?<~pJb7@UI?RIaEmL+v_mC^S@ho--Y!pKG* z%uV>B6-O8g?OWrQ-A5j>);GY2!R7x$7SfLY3gS0)e17AW}=e@IrDiU2Uf>iH%% zU+AqkcLF(yjjw;8;YL(a6T`@;44|A3e9Y|!K+|V(EX#B z|Em3~m{aQ+J3#hELv5%mrJrrQ$7yeoe#&F5L!NlM zK_lS!2QdeHDCSSiR3>^N@TO+-_3c%Cso_rk2G`oixNlUpg1P^#n9mrd7!c-(UHwNf zpA*r!l8n;Vsjr||KF~ggFl8;QI{3z#-@Y~tzYhCFB6%1r)hPujcQh7IN`v;m{E1{u zkr^yJQA&T={&!I=m>k3{PEPW63i9w@=L=z|i zZrZ>Q053uihyfZ{;c7jX`7m*94+f4{ETCf$(O+#M2=2k~7OhVU8 zqGsa>llkMcSsMAU+wW1{A~;UnvSGQCIjQM-;i3-P#wPx1ea9f}1hVR0*hrWrfH+VQV6)?axGPv;j9z@d_6 zf^)Wg@PBi6zSpokXSQ$;){=_$le^_T}T1l!>wJW*jnhM_;gkE z-_2*)cslHi9C8zrYUjzg0)O&3PC}CC(>THfP&6IrJCExy)>qjW z=;iW<`e#<)qZhz9y%rGvXJ(z`52_7cdf@S�CsCbW~mqE^L$`!i_QutvYZs%c50GueM&7a3AXiid59KjFB6l#+JsWpB9*fIwY zn|(wc-n3`nggGTVF`gi^QUt1tL3n23qwa^}vD0bCz@0pzLq?+Qb{E)TyiSR76@(>e zR?kc$bsjaT4Li!3mm8S$#kOyeBhomda;xes%pU#C_(W zs7@Si?Y6UdJiU+kkAzR<{sNlBF z(?wL$dHT(Vnfi_Y^irs#5F|nMSLgiRcRzsOvT~%p=m*lTVSE9&p~_dgoJ%Q}+p11l z1I*{u*RV0ltPskOA~JO7BvesrT7q*rRvGKhDNsk<2!iL~6<1~OmC9DjB8#Hn-xsGw zvb?sw?jn3im0tZ;GSW97ndX`qK{TM((apS zCsx1f`=rmCk~H@Tlh7>M9?q|~%k0doR^SOhi$9qmE6^_|rd!43mqAMSCxKc4TaV zeZ7dxW952|1w&dk&JNc?yZoH3de!t>bDj_sc)!^+Wp94`aQDeYdbSVIrhtSKKJ)N1 zt(ViA``p=?>^aXgFbbXHk8*5o5hT4`anajVMd? zXR%r~i0dtfpUr|6Ylip+#w8!FaF>1hu+w@r%yG>ny`4-1N9vL4MT)oz>;Ykr0fu<` zf)KPG@T%XWy>eYTUo))*b@ayNIupXYgI&Cn40yIO7TuG>}EyZl%3u!go8nnfIa<(q~)8U)*n zC&G~{blc4?w_Z(kOTBDr$x8As0d3*Hk;ZxD&W$D3F%gcVIDEx5ph}W=EtY9#TW8xs z5FN5*q}_ES(V4)YD`u5=oRy=`$#Gj-Qi`9gp!L!rf6Yxv*Lme*YHlvmFI#i3bZW#; zgYqUbb`3Ybc5r1f1c#P-z1Sq-PFPGyO~7?XNQOQIh5BXFe%d)1 zg0ni2lOA@<2WGcKe2BE$~|NYE)4jyP!OS-&K2kTl77JPGg}@ z4>Z)>P@yn^y{hF8ZWkX0_^K3-6H+3Ng(>toqUYhGi|r~mCBE*{%}suKI~#!gvU#eoj3ePBI<8u2z;tAhP8M2}hlL#cEj=wC@RbRR1~3}kt8P?F zX84oAExS5p*ic8ZDVl`gKCY2-r-TVr#?rdX)0|Y3iW(y%am+XXBeovuLeB}EM`%K3 zhFk?IudC=AtD^RT6t|Il3ExGeZpl}7OJYJ;sl`6mHo7T_T1`n&l0vRp>Zr@It z`MR+q=$el-_{zh*ya;~8*$M>AVdc~lty~y`0eIG#nRanOTFRFeWBBJf+DhvM z9mI=L&m#IpH}=sal7|vN%SThLnTcnh&BcgwdvL=sJONmRfk}xx{3rgcIQlR=kC4*i z90Q2AgFys70ffNB)B@0MwTRUSetHzui1*${AI8X6eUCUAFB^MrdW2PW-=am2rcu;A zTfp&mq7}Tp!MdKAtAEZdwQbMN#p_gIq0_nsE!X<|N@83hJ7jfYzK|j}j8Isyr{J2s zBilta5HY9rtTI``5t+c{W^&IUq;6kC} zEb7YV|Cz*z+Jza--N4S6x9f&-&sP*6=Xxl@j2NAjU=a@?Ys`Askl?PZRx3}t0`(hr zXr`;38lFu(LZ_Bfge_?31K#et_^Tg_F6@8A0Uoy`9tTk#qF63ereb}@BE^U|72|l^ zDBTe9h}kq(?Evm?*1x!}wEY%Ix=fz+wXIpC(b~eCHMfc5`iJMkybG?=9eIC^ zt}nB_^GV6Q#f$!Il!k(l#JoPHL$Kw^k5q7e@NF4@H`>LIpDltDA=d8p<2>4AEt|Dn zKkFsb%H31Bs&IZs{3H~#pD#h^Z=#8CQpDGBY?d?=@2-Jim)N>f*Upo;g<>Xd~$pJ4xZNU*vti4yt45b-rQUNC{42(Dx6vOhE}InyhIU0XZ3Qfo&Clh zXetGNi`9;798oeQO3zd1C;sZHHOZ$xPwjgiwe`SiK zmIQXnji`j7=-*ynS8b&b2(r6oUOANZf-D?K;_nAw+t}6E{qjUK-ufg~JeF-6CQ@s| z9Y0&P1QW)KIN7jMoFL{r5TV6AmQc>i6=uJtS^h0-3;jfl6!sSKCOzTb`m_VGSY-i? z6gZXi6jHm0#8a`(@eSnOY9;Web+Tp}lw3)wW3-Mp>0sN9(`peJdM@J&q6nZl^7axUQ;m}8+Cv~g7X#wa#zMnxE0;vAk*QE(bVvWJ5B-Uei@K)(%qasn! z2gjy2xcur&egv{aF?Fsr3e`YE&+7Iyu&eug>DM97tsA)d_eolUlFB+gJ_R0F8 zV99?6K_Xm-V8F(ydq}cK{$~JFA|l}68;@~_s#(I>dE|7`>^hl+|8d01I6*UN`Tl)f zPD-tfxnSK^P5(+vg-IdvtyX~t^&vT%j{LF*vzi0aaT}@uJEf@O!rbQO$2d*)Gp9V9xwK_Kd3PR^aa?k_ z=pjBhmJn93yFNSN-_nU6^nWYL!6XSs!l;ZJ^bOt6wHoZ8L5zP>D#l?3AwC9qX9y`b=(~ zT2r3hS`4JV-4SqS&14nmjhtdiwoyi!+sX5sg>2D>+%ZO}hb7cMwUV<^UnyiQ%BRf^ z)KhHLB>$cLzVk|~|HarIbj=5|UC^bL?^-PUYNczt{SqxOW1-Ejhe`8j7!&6Nbv~?q zG9dUyemjrl6jFdII1egK+9cQgYyuJ|Fp|z3a8EnV6>B}+{E?oF-L~HFNY61A8K5E# zPn@w7bBPUm2Z|urgLxL>$d}V+?@nkg8RgZz<96MI*~RY!3QnTo02pshF9}{sC6o!> zF5qy$w3oXmeB#`@;PdsJ)40k>h}^dQJI}%L9juiG4nM|$AA&2>z9L!g^bYq|5G%KD zZg@ei^UeelXt>v2mmfy9V8j06xj5Q0q-Yad{p=?IJ`WJHxoF&489IE;`IbgWMXYe{ zXjN-;c}$JJ;y2%~2561$(s#4q;3o7)rh5yGUc7GBIQLoNP4?4F4Jp@I+i}&({3LLC zqDq>{c93qZrabE@@R9L820s+%Bze`?%WkE)j`GVs7G&bOX?*c#5Gj$@q$J_JI&9G>jc4Z;pKZx_74I1Ddb*01)q654POZS{oKpt@bsk znEgMry=7CKU88P^OK=G8?(XjHZXsB3cW2@5?iSn$?ry;?xD(tVxbz~=^X}gJoa(Mq zUDaRipRj7pIj=Fs+9H#~@1ejGnhAv4gLSV&&6A@040G4@=3fLjJ^ zo*Y%~x_0f0q(hMcMr7(^6$-ne83S17%fph6hS@XF`{Lyz5Ho@Rkw#I`=^|^QwUiUF z!ct>yqOnhywJ|dO`^AdgR+-lTL?}o<-$8SZ=ij~P40gJG-L%Y+Uyj%~;i=L+!8hKg zHk#Roqe+k6a>JJ*u-nhLYMS=Wf5n_?$U07)b`fcjl}C_bj8aIAdM>^D#?~T8EMY_(XfNHMhhk zKcD-r{rg)mZU7eBFF{uR`JPW!!etr14K6P_+-ktvPG+WL+m?V_H0F8S3b+op;gbRF zUe0R>TBco%|F7n$t``0}@P`+v9XY8L_EukK@?U(W(#mHw)en zhf3CL$@(3L7mF}^h)||PsP}$9uXf`qa4wE;SONM9&620Dq}MnYtvl6R@-0}~M$=T% zbeZ^-J|z51`W=O^VxK#Jyi~K>{jdDH?jQNLbt!Jul@U}*YRKZ zw|e*Ypa06gDceh;hd33>=od>_`@@OnB07(2_?HuivjeKc>{iKmIz#KX9D(xh^uO}& z%>N<(j;K0|C;l(_cZf5*5ES`0hcfzjXh1AIB-r*p_U}9m>#;Qud!C7SsiS6tF*;Ve zCjp7gRAK7r;lr532v}?DPXUP1>G7i1el~yQ-&RmUsOFY7vCeobSV5}#P8?$n0tSduU{=e=Y3E8y!6m_iMMY(M421@=}yLn0s!wm&L*nO z)@tk6*4sP<1+;%hGgXuZvF?7ExDJ^_5KHC(2g<+8Q02>KyDI56b(Nw7YHjx-gC-C4 zY{!A?agn*M(f?ikT{K6!$<6r0zm6AK@Z;4J0B{oijfVPixX}HMKYqg#a8Lr1!wJeq zSPj^OZUnt0cpy0+#4`UryRqP*tmd5Ksr(+1SisNst|RR%e>wuvX>|t<_yYZUz|sI| z#g;C!gt_7A_WFjO?H&8ThTtJ9j68dC|FpvjyZaK9yQ6y!2hhQ*PHc;9RAIhltg5mp z`+b1Ud{J{Du)5hX-u@+!gvfRHgPI|F-?)oK1Lx;q#DS1Ycxk z1oDh7Lq5Uhm%9(vk&bYA-#rEC&W^eD=Zjx%0BE%>!Dftx7FNCNHI5cLNpCK9TYodw zoom)0C;nqwGrpJ>h4^qzkn=LVOK{?*+U4sPHAM`IlYP;9OwOy0MYoxbT*lYcXaG*0 z{b)64zS9HSz&4$A(96;q+Q#VT=@ow7*C{+a9v5UnlcnoglVKL7K(WZ(z1LWSyO{wt zYhRkIWBH1#oOd@*cLHU7O=*f3IsWrqbxTbZc&uW5_`9l`4MW1rKZsrk?m7r$Ry}iY z>=#N$4TcL~`Z~dos(H!RF#Uhnx&d~-(9EyLWy?A;w%&Cp9=MAa7ecyil^K6QF* z#!9bmRR)HAviL!Sd{BdM#8mfXM4*EMA?{v+EEk*ZRa>k%HoMdaB8$fe$ zuYl(lB%+Va)@KyneCzk|NUWwb6tJ$~SS?C9)&d!2QYZDK}d}UtBlu z_8G=!X0vL8i=&ilp<7K~fGO;(vkPwTCBUK@aME4twW>OK8Lg#3qd63RlY_$O5U@=14D|AZ92qsk|%`GT8p4s^}X=)A7XE zLQ7h;(gP}`IYF|Q5CpI#25*8|2Fh%_7hQ3C#BE8ydnVgoe_%|N06eDfUN!Xt^}|R{ zWf$>`1pIqG-Npi%A_V(#&OZgra#ZiI=Q=LD_9BNB9hWa2elG+Z-(4!YG9jYb#_jGA za7v=MJBy3K7asK-dWaURwY<1B2CoX*G$pn~Ch2W#l@wC_T1~<CJw2m=g0f>6z0L-Hm=dhwHQGAa@ZEBaodeE8o;YHP8tsP9zcy#TTla_D{ zO-b&BIEFH!Vfkyt`pNmaPG5eW?|8I_j9}&a7A8y~=jjg`$mP?vK7}pwz?Sbb^lm~Y2rC|0 zd|hyiF;c16#&lD{nH*I!)oGu|`B7vtC_I|t&ksH10fSs*D4qeH0(hu$No&-jRPB99 zdA{cO$cb_|stLx|kd5@2*LxsfUlk#X=GFh(j9p%Rkqb@RivI769Rly1^kc?8!Vyh3 z1DvtrTU6|}&+7qa?9vPB&?{2~W4T%EbEz)u_f&`-7l*K9Ct6=a>{?QPo2*+b;y>hT zv}Z3-dOk05ZaiVE?%jGF-v1^#s^?zeqcYAe{!L(xo~p0Clmi^2ukLA70P=dDB!5G) zE@GduVRZIdP;+AUOGY%;#+ezm{@R(?4SJI-4vD8-i^G~SSKRy!xq*l3xD+RPeLSJN zZaiWBW3x!uRJ~xbQtS~s$s_9S^MVOO_2EImNwM@wIkRmcI7!<}i@2hh_%Bq;ujS33 z=0-Ue4d{HqS=IbpmMoP+-T`R1(_m}5m-w89n;Ko}-yQpB;Ep}-n~^s6%ycxp&9x3< z>ldI)T++^p=F};0$fv+kE_g;AmHWdbuGFFwaukOt_5#rj;PNyE&(|-LyWyeU_e(35 zCkh}2ui%l{%3+r;LOy^F?2R~#?O-d)_qvwPRe${m;U&0@YKpE zAqo?fMA3yD0C?tmD>qOhPU)SLYTk{ntDYj1drwU0SgV+A^65AqGc&;RfxI}6z$2Zy zboi^$C!KgRMPXXco=`bhnO4@q0!bk`WK;@;eb$RAob!Q*l_0)x(H#%1UHt@Yg+KZG#4w_h@le%|^Oemc}@LUVPP3&@Kyua`X(Hb`8IwTo|I*t$Da4WE-5 z8C9h6++sf@AU8B4Ibc^gS2RT${(MKlUr?SZ;r!49U zHW?0b)_poDunIrdzj9Y!{FR3{XvY!4Yi{RC05wpJ9ts!)=)*Wnje9WH~bC5PI= zeFcrfYvvTo@inSL4!nWW#%sEH1tCtm41G`dLE0}vRZgZmy@I;A#S#d7L0v*+ZLS&w zPMxaCYM60NSFLw4bIf|R%h&4>Sa@|J^^WL7J(_aBnOItHCPVKxEx`QSS*0_$hZ07L zU%G7)9zZb^X)wIhnah-vv{QYXMPfAo&324 zk2QKvds-yPfEc;KGXZ%KGY%jC)`_D z=sP(L*&0Eq`Z7Z*Nst8M(NwA!mvIn*T{wdk10dj*FEO6_s}{vrcNrTtA=!~z*9RLM zChx;GPepXXmrq1453F6BR$$jK3o<{g9Tu!=Klw~jt3}Dv0m#+m>drN|e&KrxEbaXD zmp}gFFNgWZU#_)O^5?I=ys2vBUw`=yXX*%)@m=~z@xC=T96L5uRjN6=J*iH?Xiu{> z3m7DDSuCb8Sa{d~P#aDmI|#ybhpxSJI2Zj9*@TO@ zk1S&4+w+o&4*IsiFi+59V?c$x_Tf3V{P3KkPXj&Yy8Dk!wDlBw&VN1U5Q}j@&-t7P zTv1@<|Lr*k-2U&LbAb=f`OiYq|K>R_$5i<1IZyn@bKds9dd}@ETWN0ud83jLv&;%d z%Z`FM{mI!r%vQ;K z?CtGQrU~ukrQy9qnmLU#n`1DYa%kIlaGz)12xXn*EsNJ{mYWu>S2yLG&g_!qR+Eo; zs;`Z|fLS@k95+G?NB$%L*t9Xd(#I{jo~ni(%YF8p zK1fA>mh1| z1^)z9TYkBYyny;CYultoOEqjZB}J!fNdh*ybLlOTXSoNyPC6~bkOMz=c_qBkRul}a z)YEV)?8L~A^f?!hZWDUM$uQ3jnGQMNy3jj^HzoYp!DvXQEMCi5b2m66#hko!Fp48hms^s}$hxYz^?EN?a) zeE3O(@o}&hmw}y{e#>{YPKaGgZhfueX@n0Qdctm6(k(!6qVG^m$=Iji8BfiSlrF(+ zji|q99M3y9c2S8s`FFTIou9}b=YQt*35!nPjzkYOyoks(6GQ&nUknj_?}v6kF8?#P zpF8042?oyX_riv_sk1{>2*1=?w?fn+DZD-;QU@AQO|Odk5%CA8>UeBjS|`S=PlBfk ziDRMzEMrM|j zILTN4Unlt!sa+`n*D@1;k4-+pe>V96tGb>HAT^iwQ}k(+1ox^ZmBApI<;qS+m)4DC^JSiJvp(o{q!^ItI(D1R};(cz6+K$97L<9!H zsm)&$tR0E^mZa1OrN2>*wxl*q71^%`I=S?`q;a&IkN_S5#k%N|JMI@q@(WFdr_EfW zwg#J^D1NMdhj*cER)XHr%#-%}tj=!h7`EBX4_$4%WX_Ijvs3JFL|g6A9)f;G%vq+} zr(Z}qhn)qd49*>6EW1Fsm%S$DVo%Ga0rqQzVMKjiDHO8$PEqbCScL|n_q zLW%%}gk26<4faRI0*Ys+|-CQyf@~) zdnY87E7+`77-_Jk1@H3H;uecBsy%~79X%T#@k77voN<11_ngF6gELwlU-|KQ0l^t9 zDSQnEPX6)#Yx4gyH}kmkbc4sj+U#TU|N7{AvhqyxLw*Q%9ys|2{Acs8Ky?GnX{4Q^bl#BEr=qLXC zDesdq;nmU2b=~Ztgqf;1MDOMk!>dgXQie=om0RTB!GA@>HEAhT>P5{!yWaA#1_Bp@ zdl9XE2te1zy8RP%xtQK(SYpKQ@U%<6Ij$~!4u0)XfxEspoV&N>$Y--yh|L!EU>_Sp ztM@hZYHt)MRLi??;>=hllAz2)7}IDY%1SHBG<-k-AstC zxyOdJ@FF|P>{-2~0XlA3DM2D(JLx>t7;s_YTSO;ZQgy38-Df`9}^r6qpz8e1K5EH5TSWEd!3o zFoO$;!@CG3dM24pfyjddK&z{SjQKAW@V0jCPZsX*h0NbXi7ebij4a%Xiw-SS+JRWs zk%DGiRwf@`Rw~e0jcW*Ov?o6fB?bBhg?BXRWy`p&@cSp`oXog?=LrlBHtw!GzrA8jLC7R+iBQM~MgCYU zBs2H2gi4-%VV20!X>_G+m10BOJkh+uh>$jK06yR!NxWU|a}96B!Z)#<)n-Foww$lea5mdFAs4#V8(S z*YA*d%gAixO_w<5)iV|vKDK%y_!)Fznso}DJD}z^~R$HvKS_{)hxM z`q`mZdg8gC7-AfYCUAxJ09y42|XZXkKmAAU60&dZ1re31sal^&t zk7R=DdOU1IF0MBQp?3v^z6-tY4bH-P3V~r7u~DbCz^+AKM#W-+qkcM=LG!lVF4^kb zl&)@BsR795Cr_2of4%OnWfb5-8Z6&=x6yCeZbW>lvAcm@chA_P08t&lhu6KWDzmi8 zQf->?OByIHPu(Hru#{?+bTR8hB8#wz+nU0>oo1iv<60bNjahC?6a%4Uu0S%w&{Zn( za>reZkriL)=b$#P8c_TS>|jTgqm7Ldm@5A42o5pN&;6o5xT8xyX9D?w0MVF5zy8+E z%$2gJ!K%+VZ(YU2nW%sa-K;Empw_+K{jb*D^sm+(^dGIeavA*hlBw^cuntYbK&`t( zTS8vLh_KX^oG{J~EEc~8#kV{V;kS6O^Z%}O&rx0250Ci^7|i?y45aT23u8*D9B?A^ zW^^<X$7+n)B`d!Xd}Shx=BBIC?c8xIY!_JVLs1B21UgaF zT4s$`QAw}Ka{5d1yy6$BzURJce~qlMT=b0X9Ac|vMi3N|>-XB%-9;hoA>Zs2m?_NA zCShDU>kP4^lPEGq%D+~=_`;aq`#lHA=k-I* z!@bh)>;K6X01#=(Z5ucqIi8F>-P5@!;0rScG3!UavV8o^w&s-{_Z2_kS33g7e6`Tkr+t(W$ zPmYCW{aAfHkNB_a07!<#ia_;1ZT2+vz(-s5w0N!)z2Q=K!s1ul(Qou~nOMbc;tsT& zlOP-^kcZa|{2@PltNXDT-AM%Ev#&Tg9weqz1(EX+ahyJ9Dlw#Q{9(2@oDDmL2@S)3 zMlxC9Tcn>P(LH}O-pnyEM7p@IQG<;B*Csz)ZSGW>4d^RT+l?+}o)fSZ%k%pnSN%dG3Fs&AH$c&Ev<-~ymoN9 ziC|h77_|4y;$LLT9rXt=;4Laqh$cNK=d9#`tzs2csag%h6ks*;?&9;G+w&7S{!Eu) zdQt@;%1@VrwYdmJ&JH6QbDa?(jpVNu;4kFdTP)vUm z#*@RcJ*@Er!iF*N| z63Nk>6FiA_#CCIdAIc<&6ku#h^y?LfVd` zvnZ?WM{#!%DB-;Xv@jEN`WT9R(F{4FLKo|93Iu7r*l>442$(*f5{Bta_sfnm1$aWn z5QcFSJGt}iIQkSyR&*77&d&B&z3M`QlbeJr&OC4&xdrUV!0^AZv77~cN4VV&N*aSd z!9p(s2xjHON;yh#)?kdvWkL0}nd{0n5WgamnzHR($8mDYpgR4AAPhhzA6EnEZykpu z9)ryKR4LXK1vTQF6y;~+LJAbq-<09`C62tobo~CGUi#C#E8JAff4uaM{lhjU8ZRRV z6A|1_x^R6t^{tPb4fALim@`J-WNSD4-6BcF+rWriY#CC=OM$@mb87K83L#)DV8_3_ z+jGIef67ZGgq~`jGWVv>=f&0E;zaF3P4CY%1QzHU)$kbPXJ!>5y|U*rLdOC;#1h3sAlnm%8T zhhk85HVEI3JXYXOel|2QD_xdYzPGm5C%v-43jb~<6oRrX{I@5u+fsd?LaE|OG#a{AHFAev=aFL|Ho zCx~BI(FifqJRxb|Xw`jXYzVJBKdOLNrxLi?EeNZlD-u&>84bWVE(Mnb!C>BeMjs=a zlBWZ5V+E4;WZg_29rj1h7i?jAE^8-KxHJ~+FHsk?px`wF$5rSE?oCr&@(Xm1q0Ym` zB2yb3-W-AvUY#p(>-uW34_lKRX$y|AN{!HKbbg}j;6!n(S5^qBW&hp!vi3aaX2|{;Bn-ygHNg393b+kIwrI75# zpyG^aOOSn`_>dnMM0AhZ*F2z^KCKTnz@cC~l;S^T`ruMYim2hj!x!P}6h_no5kvrL zwEqDXMn#I@6KA59p(nW9X*N6x9O_Ux8fVg#93k;O-Ls;k4$w`{s{5~--k+4m=zKqC zG1@dq(o>);L%S1JS3oCB2Uz;!>MN%L8R-399U z?uk51kPeTyjm1thR5^B@P*@&A4R@02Rv^d)mHwiaul6AXVRwX>HcGn`cEt9BnwZqh z5JLE$&_sppUuYst>0f995*`Rmv?u|g378LPVz`z$W;GM3vF8v%E-?#3L?4e&L}I5k2Ct9kvud+!U!49OCXV{xGK+e8P6<@m(RddFYn zj2CCLsdi2|;YhE+D}1$3Dk?*1dzrRM3sB&)QI75=0sX_yz^-dW@&901#jA z_@>o(#A~3@_5<3@>`Ax5W^2Ng{EtF$7=$KT3RhJS+_t6h-Hh0F`F|a~5CjBmwWe;H z+6bRGxznz4C$^XegupNTx8#nj1C z`~YvL*x-|=yAO^w8t-zPF7?}!fVvB=88ayme%ITdi~SQ?S97>CBZ_3R21FQ|?BGBo zE-)h61Gh{NF3KJ93y73rgw|c@2U|ff0%R-3w$cb-3*0lHfow%tzxyAB8E`p2YUL=W!ICeMrUqP z@Lr*8Ve7uxd|s4p`Yb?8Klxuv|0E7i*KZ#e?H6w2unSuMJxG99$-HD6JW^7cLRotTL)(;F zDo=Gix~!SbXl{kZb-xAqOfME+JT{M^BZ zsv7%W2u)}#R{z2ni#~t6HZ?CEyzR9rBE>QJ%0N4_8T^NDyxh>9mZh>}PxZe1N7oYd5*NMI?wMSyWQ-u|at%n&Xk;`)Ce!k|f z){5uZ6O}A+Lxkji30wYy`BS>6;`$qKI+8ND;TQE5eN4lsi%(2wyGa0JDG5D~FrndO zwt;aT-)y-j&Pr*9zA!gudHw5Ud0=-aZC?fo2B0WsdJPKU=l>Vm$RHa9p2vZf|NPR& zBdJiJ<^P)3T#Md^16>GJSvRo8wkn>O@L1#MDBa5c)6Y? z_n|*!(@UxQNz-cu`*Y^|Vfm=D85w7xn(10pSUt(LFX#Dr2$GzUR?n{IlMFPlBfIvh zzNgY0*`Gc<7Jr%IsK6WmvK_X&n-zef$cWkvE$7W-=eTp7?=?F~4+#ugbFWcIjgG9W zWSVq_fcf9aCvB0SUl%T-2Ja?Kmr)@AC;I1h;J!;(ISK1+%vlb`m)zpzBqp$40UE@6 zv5uX~J=TiT8SscUx^{Uw+)$69zysM46+DZiNzSdL8|q@#22pJLe0I)ZmMkD~?&7nD zk*xM@M_0}mbPA4-uu5uUaXzi=&EvM_gJ4~u2Kvcwv)8ZcwN9l5wGML=%LZkBlsfdV z1W9yP7>dGB%Tdb`y)>15ePG22Kfm&ASr8qf(R?X+U>8Y}9x!|S?*Gvnc;^6^eNt38=wpUNU+|4a;VMC8 zQ!J|!)RS*#EI%HCqbWye1Mu9PbvJzU29CZ-{`}|-sDJbZnzw13?LP~x-1LV{tK5E_ ztE>k02BMC?ljnQkG2FkvWqmGBnbIw>O~tpWZ;&e|iH>e}KIKT2w_H1HjWikja(( z{0C$r{YU}-5Y2h1zP#hpPbaf@tDG(%o7f)69EC%7&dCShnB?L~EMyEAF~RC4Iv z_@1SkKeOgSx6PQ~B7eb@hrsSAL3`A!Cdh~)4eSln@hVBg({PA4f+v4dTW5Kip) zve^g^0<^yp0(%1lhm^_J5ZJ|tTp|{lxJW2oN$c|A0(nJb{pjL~IHy_tBM&=&*tMc6X!vH9Tg9!j!%8oAuMIeF*sqrGxSz zRQ|UpPP1fsBv@|im}T5uR!6BfL$3$m{%duY^WDA3tMaPBAoTetbXU-7->C+WG?xM& z%l0401c8!BZyxmX4_PE7oWaunf=n>Ri>myk`5OL(Os@VrWa7D_xcnC~v7DCu1I=#{ z+2=oFhOSgUyupuxkquF=Lclsg@q%xh&TeAW&VXsN|hBbQbfUk zkjZvm=q+8#cv{98SqQi-WUmprI$>jd1VMV4qyK`P%^Mwo{V9rN#p7#1KnBD8_{MkN zO;!f%)k*iAUo~d>Unf@XjM)`11n=lV6T1aF0hOesHvhdi!1_On11A4Z#R2lQzPI^v zMhjWvWd6Ar^<~%OhKfQx@-rHXZcXV5n0{H$jZlM*(`Fn_0+&(%b-9hon&ArYT4zer zB&55=c#p5wi^a_$4j^b>?=rY1Y#~8&V&^hukID%1;{s=BDc+2E8KbxqrIkM`0`10V zvAw$GcX7IM?J?E%cg|<#$DQ6cUG3@C-mYl`TNNJM!=x6Aa{e!OUO@0<54VGR@@+w> z*D-!N+dpD{%49>rU~Pvi(!V87bQ6E7wi*8ge8 zfsZ!hge*g3TGqvi#(H2^0NMxpRKp`oSwfKlfD7Z^ppXr8LKLPY82 z)>`7KX~VTfG78gYK+`WdTCI)hAOJwq2;*@U+ZIcRi}DJb4|mH#W7#z*rs&D`rdbu*8`G`+r7C7b+fUT$ z1=8v(smZ^+;38(Ae?@!8Ph)qEMRQA)h?%c&dQ@spnExk3aIqFO^sO71h2KH{pXWRdzYTC;kpK(aMs1~?hcO~z zQkC)e@B8S1K5ck)IIu|IHUTUWoaDWK328EjrcnJ`B&go({+@V&k_#*nP{W9LzJAsB zrZCLPy;Suc^VybCjO=$&xv$fp33)4OY@}~|=^)vE{j*NlQM2-*rp)>orkM4K`&}ft zSJwkCtgj{c(-znV3l-x!06wIsedRY)xU2Fgc&P5TuO{%XfLX^zs~&Bl^c0HN@BC_{ShF@xqo8F zxW6d^v@3&uW>{t?at8JXxUzu#0m4kLKHhY&fBOTXC5SuU;dKd`PPL#+DYhoktee*GP^x`$T6}~r9RDWn+o&x z{Ngy{i`sBoPks$T7KssM(pjztNhXLtD3cueweD2tN99FRbJbYQ>$L9sS9sr|R|K3#Yo z7BX-cTsV$!txpSy_OLlUq}!jz-=X2?B1{j~F%$U2QdM{e$0phcdf{b;qYN)xQrzzz zfD=6a>%s4#9T#rn2Qnl5S>X!H!2ZBb0ppB&pIGm!2Wf_9{O%4NC18I5Fp4;2*oWYl zwYIxY1r}Q!7Us`}kHv2%m4uu6UfpE>Tr%N`>K6ZF4EH7J^Pp$uHA$4K8I#%7q{IE? zB^ILwg{zj+#Fyv^6gkr{#a*PTD+`?O@$7wyKBWj4xF{_oLs^DlH2(C})*@zb44J69 zq~mgX1S3OQ_00LuDPht#fYULE~jzR%`Ao*t%n0!#E?ihVs+ zFpI~lAe%y}gJ4;YQplJgT1STIzilpx8Q)HojFqfhlWeuQo#)P&9ziW;5Ud&;{g^1f zGO|7V1=|K;4KZ*j_d1V!&+@8qswv;Rd;w*+k7nK`k&O6VW?ddC6p(8v;)#%d&Wv(4 zbm{J+#hYE0c^lUwU>YHxs~~V!5uPE*kDWFk>h<{r%>On-Posz^Q%`dV7S9IRjjioB zqIstaLG}L*dDsZC&X@Ieeqg+>BlZk2$o>0$8Szc0`3_F)i^;Z(By#3?7Iw(uu1OJR2 zzXjQ@x3>)2zkVMG(i$(U<>Gkqm4lZ8QX3cV)V2yiU#haUW1(kl z=f}i))2AQR`vimj_xSw&-|)xAE)nj3bX4-5wSf!HTQ;LTivjH3pN4cdjWV-*kzTv- z$b2{?Goei?=Ni_)t9Gtw;a2DRLwqyWEYaDt-b+7X2!Yu{1)N;;zbXEWA<)q+>U4Ny zO}~%KGdTw1qV8g!9kqA#WQvL);yMC@J02BYmDuuk?QA2JGV|%lRDyvlu`@XZZR3OJ zuV0+k0c_H`>_fmBf>pmF>>mw7p2vNhs6jh}kWaOUy7WIU0Y>1S%TT{- ztf+n!n&9brxfHM4f43A}AT?Sehf&}~_JQ#&IPo(nE@80{RIV0^KS^e9eLQipqyDyX znK|dQavT%!JApAVpEpfp@E##aj*gZRr>(9?9`JRHIMvEiYVXiSKG?^0xwvJ_Elf!}Yoc4)WQ(tqgLueu4X|QNdr0#{w{z9dT(1S1njQY$ zp~C&64Yh5(?Jr||@KTJ(uV8PRhCgxJ!|3B;E6GTC`ba2o?+6Q(RY|U1^fByUQ9E8& zi$$fiRV6WSRA$zl2JxJW=o|jP6juEoCl&5w?VPj zsAtW_6+clAZv^&45%0?CQ@4Xr@Bj~S)WXzmA!@fUVXz{7Frd;R;;*EdoGw}$q@{+4 zY3De$)5TlRJisD?=!*A#r+R<3mU3oXsD~6ElGTeW%UGGfJRbzHQ17&HT&Rh_BS_i1 z^~~`XDYUMLugIpgpRi)O_L^0D4(J8Yj;(`P3hO+|O}%Ah5wnLu7YOOU-vDaA9Zdhm zD5H*ag~woxV7O~SwR!GPx=%rFGHxN)tl9X69X+(qW=J8>WX%CrjSovut46SIj)}8h zTl9xXmfs_-^+s@f5&~P*5$a}PG;fc_77gOdl#37<0+sbGeXbXeF~nj;ZSpr z_jV)zD;jMRVOQRqDWJ^U0vQnY{`f6GnM^O8AWjVwf6TRy!Bz)33B|@0mLJCY`ss=u zbrEtc$A`uN2bTL0Rvf7VYW@31Eull==j-U{c3PkB?`E#u3U1n?NpOP2wP>-E1>52( z*dm+yy~6qC+S9Z+TUh`wmN4^5OHgyXf|K<9VPeQ0`fOsd-*2gL2XI;QU}x2vMcmZi zfX?sbSAIQh(@P7IuzMFWGN(v~VPx-19NF*MMMwmJ_I9bS;`&VsRy_F|oR01e?ibVA zN_q%gqy47FCFe%=KkTOc)|v9&b2oHcvW;F%!lsf|b+p+gR8zm4KqM$WVhL}&@Zmk?uErJ9bkCCAwc|@WqpfWl%7@ns8nL7`H3o&}hW|+=eBEO~?JJdk;*49Qe3VuMv28_x zo&fyQN`L~k5}=W+zyH%pAoqM3{RS5$Lg3y?S@^}*dWe4dqm`g={7)+ZwP7HLujmhq zFql&#T?~WoipbAtrq+C6Sj+(&WZ7+d(kMp*93(N-6!W8;aK@7^7~V1_Sz~y-F8;c`^Q{{)jzF-9 zSm|1T{>;jDa!G#N;3s1-$WN(naiYQMmUIhHVq4h?J-4w2#JC$GfR;ZQ=B6*fckOvl zB+cz<9Fva(SDAWJw9H<5FmG8^whFxd&mzvM{+`$ob;eevT2J&cG@-Xfk6WM9cIv(Cqb?ha3!p8} zXVIJGQ-Bx!L9K$a6_aJden^p*$RiR~7<6CVFWx$uA2+@lyaL{W01p}PET3wrAWz6)*8+xv z4)7e~+jKSg6_i!|iGa1!e+%cwn!TltdA@TT`%hngi6F^ejy8a-E|~7&&Fd_sOx4T- zyU5=mrXqck5aTxT>CQp&aQkAz@2%S2G!lRMj;7ttznah1`m7_u$fa)1Xt!Olm%Qa| z+p#`Ql03@OyP3S1g~reN-$b!-vv*!n)CNgxqj{f0@U-fRyA|79zY=hor`G?-*;qjx zBWxSPZED<|-6aQLLC=rhm~LVJ*%J%kDlZthcSkPo&#{Tf3OYmv9kKRz&p)T~ScKrx zkpgf-lp%C-1^93;6|E!gT4xp_AtEw>J%LwKhZ`y$-kDn8{JJulbQ0GzGZtKVH@2vj zp7>wd3+*a;!|J|KvIaJj|F#zZ-{mZE#)JjBcNW(rV8BcTA)2Z0aCUg_LfWr-I1f$@#bOBi%7+;wnGNv5C*T{8Z}1${j%gN)Lhq>~)aS z4`jMn)tZg_K4|Vxtf$K5!1jV!%s=e~tEQi;UQZ@-f%70k%b&FxNY8}j)0CTNqCe6L z9ET-2)9TT(zE|r)!1O|jCFJjiQ|xeZ8F?`xZM+;s7`15cJTC~Gk-`#`Jv97s+G}b}l z*HO6NT9VQOFK(`IXo`ODp~OHcmF83{yixL|W)Py{0|>u&9dW0eW8 zhSof6lO*Ivr%o#{GL6{2EfV0BU;>!l-W4neKP?@fqz{8kW*FnN#0)6BP-E2$ZY34H z*}I540)C=3{Omj^uhL14+0bg1m89!_7=TrjJ=H1x>e

a2r10%v`F}(q`0x<(;<~ zy=Nu-*exUci0M0Z@4|TV%k!SGcBAugc2Py?Yng}dFh*zoPAjsTkKVPuy_f71m^A#94EuieuJv=Zmwh#28sQw2 zn;zNwlygO&Hr~Z+e%T5~)GNmSMb|w=M;dnRqE0&O*tV07?R1Qe(Xs8MV^(b2wr$(C z)v@jD>hD|s+G~xm_sMfsHR_*U9>SjT47#jZ z@2kAS*j9B31_a1PX}-3afP#BAGhIQ+(+17cW@P>STiV&X*c=1FqRp3(XNzJK+bwr9rypaqHa02B*}-KOPnRvtcq?M)4)OU_?mHDL=0L zFmv?_@qw2QlF%!fz_u+F8+`xqw$-t42G#ULazbR4af+V=o`N zf{jX%^cAs2>Rp1Nl-n*+vn&mYDVCi=0_c;wqogoLZns<|Qt0O3Lr0 z!~Yv+^Vq5^gy>mwyRaMnSy0Km?!m@hMd3HPv5JB>IQrk)k3`qzADWwGpu-T=j(^AP z%A>7SiA57j!byk+^b_=f*;Hxb`Yx;w|R zBVXXm5r>TOq|){4O%}M^egd3Z{5c!bcy?vG_M@~7u?=b)c^h%?nd!V#jAGc!d%dvPMZ(HN zMeDZlnz<3$0H##c>?$(y@P9k(%J4%dTOx0X(X8t!ASPR6ZW9(f)l;^$yjJtpP(_0A zIlN%{n7CX8kK79)x`@ek7WvUeW%N8Jy>>;cO4!|0*3DKJu|rqHk5a8Ov$Ft4N9*7B z%bi1BVFg3@cn>QdJ*bqigRC57%PQ>R@G{99iT8$9Nein=ps+KSsf*US7`W1f3HHAc zE{O^suN2CXUFsg^8N`eHQik4!9)C(8E1F&q5LnCBA|FtB<*(R=kukQ5e7#pGvq$3H5xXgjOk${ayeIH)f<9=ET3BjPCy8 zMz7pbiL1_6HRSltZp~-%Rnuzj`lKgF${;x2V2vudV-1B6Fd(nDaje@k?`vd*$6dO0 zjFdc*2RJV;>Zvl8V(*AA{+96EPRm+)L`$^zLqHRTh4s?5-T}fkQ)Z zQB{~9_Vpqt-qd3KL&h^2kGQV~`A$>o|M%OX0v)JPjZ1L%xvsd{26wsW`W4jky z-4)Mocc1F;$+t58+?a_t-CZRR1OqjCTOBZkD3A4#YT~H|iu7nrjrvhXt_|cQ1n48Djpyw;ov_F zvR7vC!yx>prLsALkZ*@$Vp@vdAzz={y;~E+tC!1JH6iWSIu%_ ztPxl=0vVAqair|<%QDd^nP%JPaGesqV$!ygC_hFFk!*HCZB&Vbc@2bR(G#Y`_}IfT z4`Ug1EOJw%C^?T>4}HCma;3?}y*+$5pO2jd{1v{KFPrYO7?J*D|k`sRPSp9YL)gj7xv*YuZVWdgazrS~LBqN@Bbd@KYl2AoSz~F)g zP-js~2=jvG503@Fp%IM;DE4^0mwl_G0nU}vRe$SsC|l#5y}=uc5+vnz*mo)69p#T$ zKt?B*6$Z|5j+bF>%Ua+49_m||mngJeEd8B%N`9u?-q9;3sbGcE#&!p9Yq(hH4tdGA zCp=or;RmDYZl!4;k~QG)jONI2i(`BbxDyz+yivK(xT;-F31TbSg$gluo%XckH2`lp zXkVsGQ)c;f0MXvLEFU>o;&@K1%zv60PJyR|D!hnrqd=s~cAeF8la3F%gs->xKL?Q` z6w)_G($8P6YN=w^a?npo$!hrOn{Kh0T4&k`P{{B*RxKntblHAT?^J-;5)0c65*bhU zA|av>o?(1giGO{}#y!g5q>PsW*-BSy>XX0E!&coFl@7LQwnfoCrvVIm9vzziC40Gk}J%9f{R15U0{sy3wU198w+J9d~W%G9kyXQZuMbohS5@6bi z^M6!}A;|4xw^JyfYGD{MPf4i%9Tz(Y8zBH8s`I?uh-L_?|ytH zmgO*c(qi)5?S8DFTO%|oJ>Q3V0!VevUA2?~Sq=yJRsNDVxci~Lk;Gm&G@a3SJ)60KdOaqepWA&2(R)#)gtQH@xX1Ed`tHNo)Z8luun(6T9LUMx~80`ugfO9Rs701 z)o8mh{NMyeMwC&~Q73$+cJuji8}_j`jnQ!0QRfomUH(|EyU(XP+j*2Q<3g0XY)O;l zCU`=)gH3*}Qj z-;6B|w)}ESEPrcjidkfLMp(yE9c~dLM;|>cT_`Ie<;E5Dk48U0DhqasOFXi|tpVy5 zF}fRb=D16=&_Fw1eoFLaWb9@(5d%U#W>u-^vSp zr@yIF>a}k!yzK0C1IoStsZ((#@?6?3Bq*SmYm$ahaj9hzK|gUfOHVDpCjhMJZ4Q<+-UZ2xqiltB-4c8V>9@%`e^x2 zlhlK*K!{YaIgE_IZp8wZlzPR2jX0D25Xqqa6|rY5IUTw)=eO#qBS)xDM2?~SW`>B6 zGhk7<(C>KJ8Hot+w26CFC5W{4!3CYmfm(w)cP>}ma|1RzqKkXO%Q z%d@qt?>pMs;|P>6Qa|OizUK~Sixp+sHTZ62#QgauVURoov#^3nBAgs9lB9;t6RBZZ zTZXb15E=|b1Zff6Qiw|$RAuZ4Bjp98!su}(w-On(`T&%C6GxI~K~kgQkmW0Ez~_Su z`4hqHP*w?jn>ViS%)1ZT5s;EyS6?)f@L9e0Z~L^{y6-rc0M9Lz6Jdm{x#~=&HkN`b z4(uFXK}l7cI79zDgWU(HbnH}G9hoRI0nn$V2Y<$2{FRI9n^uifOvY9I#R4;*w_ zqPOW8turkKJNfvLhSc!k*=*K870#@5K=`=7(aEW7=CS*u@*A+W{4H6lYYW-JM>T#g1DNa!+`Ln#Qqwg28ZK~^N~-~@IhZZx zZ@BB(_-;dG?^=ZaF!?Y(M5z{)=JFRD<9C4fz|VnBca!`C6=Auq zIdV^ogkD%qJc$TJT7(cvTXK;BZKzZj;8zIp^!TM=;2ji9FNt#R7V30!zEWhwK6iCw zWE(4@iu&CH<(yCqW#n_$BXJ-@F+P&qS#%t|F~@{9=NJOD{pWK{zK`4>Uk-B080^9u zKdKU^Afs%;%M1W~NY~aTISID_>0u<`CIu~1Kw|4wbWdwUFpudPuis#iS^CQa<%hJb zPiSX6v4LQpn$unobJhvzK!)+xiNv_}lbcES;LbDr04=ATi1@_j#$DTN#I3|Mr3yo>xAMC@8W39Wns6ybzi>SilCmNgsF^7;0Fz zXC_fdH*CZynU_RQoMGr_N?`aI4Ik}yXnkR-1J`3PpuS;tJs>c{L>a(78~i3XkW@tV(E6D1H1?IW zWYo{1A3Ja>xJEYbFJB52#&(T99+y!d6D%9(s>}+k{*>D<)RJCKH;U`nmp`e$iyqqp z?H40Gu#dOkP+>U!fM>K{SNiOp0RS+VG>}EmyK{Qy&sgk3OuT+kb86GZM`PKVo{D=NV5H?=2C4WDKrCHuO!!zDO!MTjVVDC`p{ zyOeMSga#kerle+@pL27=ie`M6=!?CmOeEw!#1HGh~vU0Yt~x@kVngt>Kq zhbX~LcGN8U2YT$wMwoOAb7yV~#~|@OF>m|>JrMqZ9xVSrk5nM&0rWgJ4~)~6C2RkA z9>ZIPD~#%qY5(;+$f{#Y!Uj;Tr*%mTds4mdbgL!-r`ab(HtZW*kNA|YaNl!=qjX-} zTd;q4yOZL)go@z64eXVf>`bIN%hxj5l0KOFB3Jvsf}BVqj}tWFXKO8ky_o2jV&lz| z3Zlu~{S5Hsal)$JqITbju7}>4TV_C>41i_c784>*W3Xv4Vd``EwVCe)22(jq4Evph+H|6%W zj<;=JTIc!o4%X_w;ErKkn*N85%Y7>@f4k>mHe~-=LyLq9kh8wuK~u)OT3;kwj(Mft z;o6;=e7co#E>U{*UUlfypE+2_;L0w;GaKm*I1p2QQpqgN&QK}4;@{fD6~cgmSZ)@T zMQ~9b8oS-jA7N`$dme6Yj{;gBr7M5t0R|^ZfOW3}%dn6kyC&jI`#eT7ECChk?!~xY zK<)lkcHQmII7oeZXFx6_5z=T{p|X;Xsf)xqU26H@Q8f$OP(jzM+d;pUEN`fve& zDID$^sX(qlJe}qsPj@^pohSD8e*NHQ}3>*@F*t$({)jD)wkn3n)phvPB*d5Avm(% zj)b*lgN$gXKMk3e30|9BWpV=H3ikEMSL)d{L~hYqR4yrZzaFdm0ez~i*I5W)Qu%h; zR$cY)@V0(kl!#cL|~>+_D}%CqCv#pa_{n!C8mh|M+9+# z`9DOE%)X6A+yGb)msvkhh}nb^Tx7U1qm#pUp{`-{ABw@A$H(_mxjDgvOzodST&0dG zS^vgR>Q(@_F|*wY+JBA9Ne}uj*1-fXj(ys4S1m3l*8BKwe@Awh9UfHVxw~t~Y^4dL zyKZ33YmI{JhK@?}`+zXo3A$(fmX9X`UhR)ryV=m#1n^I;S8Ij5q2S94r;ENxkXTq= zFIKWK9|&*K@bNj&$qRB}OWw3wPnMB2{pHT7uTloU1LN>5{OCAua~UXUnhTydlXy(Z zLK;f-AJ;T>Dud}rSX!Gpwyq9H*Tn$Y#YOOYyh`1y84|isdh)==p#rjhw1~2PeLQ(l zoK0L#$>WF`-t9sPG(}^Riaxup+Qf(b<1Y2vwX@PtCTI+2lRKR570L0V@CCLL&Q?tx{M0&$maN}B z8XXmomw>cLdmO@?w&lG_28!++glAj!P3~_Slc0kz^7H7njz8KiOg-hVnYAlhtF)Sa zJGLL=|CayY_AAwCas;v1!0{JLs1yKb_2p)00^Sv>IB-)gzH7wy=31Y@EB_cK`ucab z!w(cZECI?R$Fh5A^SB50Kr|CI)4}}DYbJ@D6?J&l^0LEAk77Q9#A)3UtD~_wzrZ`p z7iH2ynL+1!#dbN2GXgpsyG;m%4a|y1=47d)M&=rzLkf)goDUr| zreU6#-3_^*7bLBq_ z0B3@jt?T3n5Dj<1M2CiVWOtN}tD#0F=vbP>s#!vcV zGU1O~@npQ{n?bJ_3!DXo8N9Db3IeU_Wr55ISXwI}Ctq6kOcP}`s!ifK6Kot}lo=aW zT1V`UKb?`p^ce-b%R3W9Lj1-)=O>hS2oS2uyh?b4*oCyP+6K(gNJj3gleyvVF$?< zQTr4&I_EuU8Zxz3$@hb4?CU|0%xeX(r|UZh&3GdID{~-O7AwYl%0z-ku}drc%&n!m zJ5w<01pm^f@0ClVSVy5g@{wRCHEc0_^-*VEjY=tYQpkX}%7nPA7B=Al%Lu_&$=@wQLc$?QQa7H|~c*z%n~ z5=u*V!}+i$QV*;<8+J0ux*s|%IU0S#+X|m0v2>ezQutSK$%%>L$tXaJ5?*_|61u*2 zHe88{p0QxqDMqO=PTOg=dMK$t>+lkxRcz)|rs6SY>O*9RiTcE>m*=Lctu58)e1nBM zS~fWR#AASO8clIp(s9oYQP}@v4b&~#b2jh}j1Z1(Y_#u>L{H8bm)3Jk7DO_(Qhnxt zT~8&ET1DPzzVq){QWk&;ea&m-WcDCf6rYeaTeq&V{QTdnRgZ-$k0Elyb!@qf*N5}* za`koZilNcH;jF)Qw@<~%PT-CImwaOKf5|8L75_i-NlAd_O7_|ZxwUyko#|RF&3aWF z;D16WPc-J}`mU1GZ%7fzAHVm9@(~^wL>pzoc%;*(;tpTRCay7EA~Gml4Rp@km(iOySXp3xp^Ke4>GxNrL0klH#+^+T^PAW}N{?wA^NCK*oqJzZ4$L2`hL(39x0oU(NGZD@4IPKiS!q9yfR z^-e`5V?6_&5U{l8N&tc-kS^|s{R_~BRGRGNT8?y3T9 zk(D(`wY9W<`4DoG7ma1Uc~drj9aHcCVIKb`&af)QyX0X}8@ zPiF|L6D^dH+X)y&DXW?H>pie@b9tO2pQB5ZHtFSN2Qj{$czq=`L88mu4-Y0$wB_S+ z_mT(P{#W-d)MgZ`aT=>*k=uQi)^_`^nG$rY*~3zi~ZTlV?qUE`Ni1z2rW-R_aI{}--*DU z;Ucei4fw+;X0%SGOE+~>dF`_?ZaBQCWMt`y!R={eJ%fhBsd@Z0T^famfZ7yq&bwjF zdDp3nGT_CeVDo%F_|@pCVfOiuy74cLlL;r2kwz^IT9nbRAV-*{*G}vB<9mWBzj485 z9izP&Hm+FPsoWb9U8mLu#gn&o4w|MW@gQmFbL4URLD)f@IVKS7gqXp?CJ_SOCN$`P zVXt?-?p{BQS~>@?o)cDalEQ62y84NZlQ%3cT>xa^Pr`g2SsIF(T54!+GGpMAAFK&E z>@%#e0vkj!hkAgI;%3dA9F-Viu83LjJ02lrp(RE#)u4=JDhLhwrrg~Ccycmup$ef- zl#Zg_K5V~3NlXO6XNx!C0_2RxPIwEZVNRr! zhw722!mQh==*PcK>-D=O`79ftmK5y1Y8CO_9{)ajd#hVv+Iv&Fa@k;MbM1lk5=j#C+`W(``uq*ObJ<`py#SoiL7@35breDYZLaK z?Js`JokcC5Wd~4i7|513H%}f7efmWP&T)lzLqCcPAIrj_O?k6FPp8Qts! z{R4l9->$3lWcgxvbxm2EYaN+Yo*I8?N61L$20MD%v^25td*&~zAF2@=(MQ^@P8Qg1^?J76xVaGPJ|E6#_3JFw90Qxx zeMu#km|wI8r$hzOBZ4`jhKLRxkCIk#4Hpy-G6K;z?4>~dmFtc|-;3%> zmf`pErROU;d*1OT6c>D~D0O7ms=iE`B6yO*bly3IGEE?GT-+tz<$53U^bz%<_1!In zWtRFa!%cP-U@Cpr^^Z6a7&Y$RPgaF3TkjWG?d6ni5sZrW*uWFrnMFrtiYWriKY|ba zvwyq2h+*^9uqwMpujuUNpBrXSt2@)0jP3AY@m%8coefahQgWOwRLTh8s(o7fzpF0FQxI-AY}{3f?xvQMNBR#s^?&Yn)u zcGw4??1cSolW4;8o6K^_oW62t`{>TKl8i((@d6)3-X<17HKJuPi&H!S%F3{G?aBP; zus55+T?r*vysKHXpDt0%R?T=Bno<2343BR<{9cq;^9E=ohuM++?K6D`r;bTPEiaVy zT7y`-0Zqca2$gx-!KzqW{t?>;`hJYa@%K}}i=70c!k=QY{Bsy3zt>!+pVG|c(vnf5 zm z+M?LCMC%(56$j!BAn8aJaSaDyp8oe z+*f97<25V&AkPRBF(Zv{+h}kGOZ~oC%3lbWrtU#Q<#?zwZtNX z9N+F^@MWT_|0;1S-J+4E+}851eTJWq2VK%H7sdXRv--)fp7ZVmKbY1KVQ5)B)qrcG zY+d3m644IcYYvr%*emCVUo&y9OmRUuhEDaTvyOrT;B`qCD2?mw;4Z7VsZgs0xHV>W zgiG`Zz`Kxn@~j{Q%pi^37dq(O7bn1b?E$1%_x?1DBj$?Hj58JEH-~F7AT=2D z1R_tj=Zi<$%@DH|;x;zXNJLx>aA4H`>Cb8*MV9q7zDFnM*9=%^rT#?&FD7tTPUwhW zMw6X(ltvkFpLPCujVMlmpjF5GE%o0-l!^y})#uTn=SV=-wSrFGhqIN6`ZuqwV9$|W zey1erl3*PxnA6?l6hHR^V<2wg0o?j6n#BiEc??R(OiuN8Dkh8olt~aEfkjLtSyBQx zI4wdL_W);`0G-$FhhIZ`|0#abU@4J4-O+5(g8IV(^_CGa^hiGvAZfz27@QVN1WtwJ z4tHBKK}ksTkWHtN32WY`It$we_Zzf-Hu>Ed=DB0gR4B7jK8TfFZZX2vd^GotGv_tm z*pVRV9ItJIgw1$1s@DJ@HaocWJI^{B^K=WP&l#@y;B+yaHh*>{gJNP}IBC+Pw~@3L zENQGC??R{_uc?8+q?8ho#pN@2mFKJf8&5aneyyz6lT4|5W>?le#xy3ST-1lHlTvLs z;#KNyAjU_SXE1>}Qoj9OyMD)acriwFI{0rl0@>1xVFf?t!QyBDIfkpUD}yqye$083 z^tn*JGCBfXqI+#V>-BQvvZTb60=dV&%Q+qi0hys0%Mz^useE`!E7k89rk-r3UxbKWN>nSeH4St8Q3G?Z5Fp z(Z8(eQdkC@Q=0Msrik(?1Z{M#5I_HHY$3V5h7JnBO)(hRuS`9G1?cq=e*PMZg8PwM z5@#i7`ODLP94@IbQ192oMiWMQRZ~&dkX4FxeWMUnJ?bUrjP%b#%-G!${Ag4KMV|fFks#;eHChjXX4((FpTT z$zOv)49j0TmFM<3qmTrX70R(8Lm=4~)oU9rT~6nn-;IY8n%(Ezvpw$a;_3Ee zb>qoawixv(0We?ypQs|i>(3ckDGaD=*HJ!f+@8)|j(cLMQ@lc?4r;*qg&G|m8P5)m z3E>2H_B!1&N9Mw1ubr^{*Zq9mY->4`f8DW&lH>wW0VH8L2IE6OVgB@Uh{ak zmY5J$qvRLl?JJqU$@d;Qj=h}L?K_j++~u6?;;S8Bfc5=|4#<~LwMeu;s+F(82pGc? za0_JgWDCUWQ!4JLq}L$^hAWhyUs6g;aRULdgkDwB;OwBBrUW()1qUnDuAds10X3dY zfC7T_K5WGjJ?C4Mp28pPVGO4LoysIzvf^@_NoP}Q0bH<{44tSXD5BZcK zj)ntVfW71#+lx?$mT!?ZEC8WQ}Thmsx zmBcx%FNBW24fV5^%1Z+uqgI+onqyNZy$YMdx3x%cBUVjG($nhy(k>X~H0b0l_C%V6 zQh;sOjY6Z5jg(^9YI;_z2PO_6y^jpy&kkU3lXxRTv7*%5f$bd8E@4k**q%6WYg~D3DM@_}oubqCnIn#dOold{p*5z6t~QgahiO zG4IVdeiq;emm4h6;lzKP+Ju$CX{ufa^*y=e;r_+Zb+|yt`fg3Jtxncm`nPK0>zq-M z`}%A3t?97E+IaITzKo?Y8NYa{oNhIADhXdSF5YPhHeA@iq-B5@+b^La_+wj+0|4>| zsDu8oTGdyfX$syXyo`jLNxr*h%0OXKEU3c?2a_G-hqllFZ)LZvi_spHV6XK9?1x!m-k8;I_ClMWZkirg8jg>D zkb~GA_pY1%>P0*A2+dh%@B-90TcD2-TiS?%_;NSXYDaN?^;aB)HAxLSH+=Q?Y0Zb3 zKUp?hu&q71pjy9aLd-V>wjqqaV`21Y5azqf^xovtvYs5w0A_{;>WgCizT>wwQRe!_!f)~y^2^s15Q0iPFWcre8r1| z3x64@DO1NVpCnUV&Mn~zzIBUMBp1Q>B;6Y!WPL(;<;+pJ6>N4#1-L2JRbcb~>`7&L2v_5BOT1Y?J&*~!D!e%0`@sy2Md4?&ZgkeJ}rpu65#eO zeJXKB#R9c$d~Fe@XVWH0+3b#Gjs-p{e@(g+CJB&fOL*N^n6|>HdH3_Yj7@Y!e^5 zd?LBC-Jo|WxQcu%&5sAN{cg12eyg7%s3x+45mc*O@~XZX0k;hAnOA@_{=>?bOI^J#kB|In;@pme zyZ0zMcbOpv;>*{LgYLLPj422+^v}!I-m}o*k9+5(9;Zd5q|%3rEYFEs-u!Ei*w=k6 z{~78yQ(OLDPFrzrx0gu$2Q7iSX%IV1HilbIC2DZRsRBI75?9dYN7Pe% z8`VO!ykf%eJG0mT-zn*i;dpZ_xt2i7cso+;a9Y6gyu5GE_Q@H1^gk~}UT$iCpFL8Q z?S(LpqMfQY>wmbEeS1j&kV{z#x3RblZqi%&!Vy)^>mb)a1r0s@z>I5vm;74bkG4am zF%OOItNooX5qZ45Ph(Ho3GTF$#+sAn!8A+pLoJYAGOO3hO^gk4DV`K4vTdsZp!Q@( z?fsJwux0Ntjbj^};OBj!!yE_!^f`?a*HlNYPYAmLgYgIF^*&swbXV=7){-M}0Rd!-Ri}j~>i&>8!&x1S9xM<`ajxD)&hT{*I((#gq=P#p z<$`Cp`Vna3$gU!S^uC~aQVc3!LF3fcMOQ^LR+d*mGZvkbr`6St0#na3!jNS1hSC$lfwyOL+UW_%=Ax^CGDn~kH zfow9Z9oAZ;>D!StT^wVj;qwNzyT+J!la=P?L#w)>8L8(ouh7BE)%2hEv{ zctY`2BFgxqV>Pd;oHXE~zQP{evh-*4Xw(I=LqZ|)UFF~0#hmekd*dvFm5Q``^A(b` zWSNBFw@Lf*J)aMr$htpDzgf!|GchF-@NWXD73c%Ll4^}bHe`a;!It?TNTXKQTcP-+E_Vy!EMr}ytJ z2L6`Ug}*`x-t+OAME>C=D@)L0<^G|PrYRZq8$~UoplL~BEO84R2jG<(876~5u0U@^ z3b(%+dmL2y<;@DSSppV}ZN-~mGK2A;$;Yo_YIia$T zfQSncCdsEoI3%r&lf3C2cC?3u@x}`+5{*s3F5n9ZV zRqsK<#eZe>=%k~ofH5)Xi>k_N9l>Ig9DEfeF$2#ZoRt@# z=&W2&=%S9&%Ny27`8Z~3(oxI6bc@m!YUaadXu*BV1&;Ig#x00S7eQ}|;UOOXRSpyu zhTJKK*@9a#`!+men()7|#nPjTg{eb#Lj|z6$tzdFdQ+Els>E_Hvr97qGgtSJ&ajb| z03eI9xY_NPC+S`)xR_k4<)31UK=VT!VtJGuG)h&y784Py1Jk1%9&Rm!f8!FUqG&oh z(An^hV*phYH*r>zi>rFsW?os*PqDoYu8mqv%<69fLo1jNVb#%$_a*yszFfnXA3-m^F!?<55x(dk-iEN!jCBySBnmCKm{|)MP)Q1J5wwPYYrHj{ zB)ZRN46zk!?B?OA3T*=?%TM4hz~8{LmSc6|DNoz=qIVYAwZ{?g!QixvLCEcr(PV4k zt&XTNXIOD8XXM&0+Uy%v{fI?N=vD?9(2nNa%G$UKeb*nP=+KZ2l|J#@O&&7`>QG>J zs-oaN4SLC!38phj6R7nzNY zEUz_|GS?EXXJxgB{aB>gj>iHcOWuB@fHD^#elm`YZrq^UxODZ=C2k}HVSxAv-VZ}=c^}44iKwfaa+rp) zpTMI7CSY5z(arDkUx}=>t-tF|1QBm9|ff0VN!i=t5$CIaVQXTtFNe(QrNu^lB zsVuod>7p);chIe?RNwLtcWbCb^Fa%4LvJ83PVNetMXR({#uwQQX?j<6q4W5RDsUHY znKh`|Xz4Yqc6{uw+{DwDK)cXy8*bZ3K6Wgoczz4hGhkN6Q z8*Yt9CvS^kkUMfqf{uJ5O2j zq0uq(*#a5JQUK7;9y5sL;_LlxEur_4anUACu!U)ckVPMex)znrZ1qzO+6B!Qt<2w9$}GSn#C=>Lh*8)n!4e zS)=7=Eay2Sfy_xhtQ)f($Ugqb&X1wY1X3A;LR)MlKx9{xI@QMmh|3Zf9?q#bobZ77 z%Q=y^MX8i{mW$TjgG!grog7R(_Uw=|4o46m_4hyK1pO4zc)e#xZs9|Z*)LX7T8t5l zJ3R6+U@oGVEjiX~LQFzQXmPaCybRcD7ETjRO`}rlx^w@>oHPTKlW}F_f6B?e?871f z0I8HRb5t3Q63CqBgRJOnJymc^n>%buCwGb9oUvPbYbvd+*|V=v#u!O@zAmMjMFCWe zqZcUx2X%IDs@bXaT`R%w!Z4hnB4$P3#A;%n1qAdm-;Da^MZQ8*~wiH=qj+Iy$DfVG9E+LrRpI z*m}!C<#GB z{P=6b0Ym#xIc*=Fxv~J&rwlVv^#~aYZDdaO#qS))m~m8L%2u-6m0^~(M;fHK@1XCR z^T1zK$|n7(z{JMg9miT8T6PJ*Xhuudg|4}&%*AQ|23888`ZRyRXM@&--CQ~=8T$u+ zeU`tPrjS1nIkcUMkm1oM#EV^#v#7+fMzNPEErJdM{1wT1J>_yp6ydzeTTIvWbK3^IpDii|k7?sy zMbAfOd7+rr-=xlYA`~X*OYb_0FWe;D2sHIUEvTWL9o0@Ul`#tB$ow6@W|@zWh)oe} zNmPW7tCbjE6Vg~R@>j@)%#~3QfwcDKgUuYCH$R-+_BQ)+ccwEPSN?j)EKyD?nqhtJ zmr4}PneQ^E6}PFP?u?(N2c&%|Y=5NC)Cm_4-W6!WaEmoD z%y9Uvk4QND(fM;Yo+lMrjokpqnLjAzo)aI2y!Kj^>dL9MY4G>osjEH^dhnyU?{ib3 zj-p%y`N!JD%Dn8D3k>6JhrA28nQj(HV!>1Hf&&nudy(`fKV zzBw3!H|jM{rqa14j=mdcr3b+AqL$bHX5CrkZ^uw!n#Nxvh-S*@bbGb(Msu+MS|{2- z>*RWpH(Ld0ov=eGG5~zQ(m+vqV)ZqX?s6<{2_GBqwaN{}sNeA>w%0ZG6EXvKA0hRF zfH@S;e>oJw_>z0>FGmwcw+)QZUN3#@iI)mq3myR|_9vyVA+s5&?U>h)bstsn0&71= zX@0LMHD~NmB}D(IsOkFYRX*tf*gL)&xfMRS1H;eDSF#;tfK?z2ZYU@Pc{F%vi^{ZB zLSDu0!Fp=IwBMW>=o?t54$Pq7|HIxrg;%;ZYQB#vsMtoOV!MJ$s^W^1ie0g7jM%nq z+qP}nwzEggIlr~O)!n;$cVB(9uR3{8$I&==pXdGE|I3{cALw?I@?x;k@CH9l$FH=E zfD15&(O;Jj-j8S6)X3IqhHR<(7SKYf`)90|b%@!FLhqJtKYj@nUiNJ?XYIhMNHb$d zUwFZ&6SXXV3eViam_XKu-IuX=76;g!L9B6noA>8rSZisNS1F5jo%w{{r;}2DMx@-0 z8E8lB5-2oo^YL0<4CWDyD2KgGLuL_wx?^2v#a-Zf^N(|S$Y5ddg*oh_) z@N}8jxo2b)KOOg$BHZ#T<*{<@rRvuo&{DwIiRJIuNozhxnJP}$@7M|8JkxT8xbvP^ z)O#yi#Du8HOouEapJO7kVR#%l=Xi%OE?ewRjbLwZWEQN$y^IT)E0aa`Hrk>Zg2P?-0HiJ^3t zU(~yB#F}=_ziTH!yd)oqmq<)pn`J_QwG%t`0qG#m$tIGNvCx7m+jT)$RVgp0q=|T%{GIW;{cPl- z9M*LQlyTu;79@N+9sj@t46^`C60m+nCnd%}3s`W)S4kGocIjB?>yLLK%#o$BuF<%I zURBFfeAmq2Kp}Iz($BuuXtF zOI!1OfD@@FafQsoEouju-JY_C!#V4U<~->s=yxfJdSn%V>C~a$9$xaQAAidoNilz7 z(jR5#IT?Xr2P-=&5vigYi$@~ks7#XFZO0HnNIqsvup*?_@H*mx5bqLqGv z$ABb!W_f^I@htYs*P_=px@D@Rul(<IsG1Dw@gALrqnqa+%f}bf2tTcvjmPmh&=ZL7m3FlBD+JB|Oc7x?133 zE?}n#P*A=aOv-&a+g@$$)3b`ObW1k4vHZYPC-%;Br4}9S3utLJSwx?p4WQ+ECCB)B zd%r5&mRCR#l7qWMKo0Bebt$)aqe|OK>I4-{9`Ov0n2XXg#HJqgw#H`j2&|rfF3HBV zo!V=10;?yKO%7yxw4x>l>sxItBkyUGz4y5QK5H;9%3I{PP0#@CAFJ{e2Vd9KiyFq_ zXi|+n1Ikqf5%XgqxO9|i;^e87YojnrV_znt;tW|JB5aeHgpWr=#HmIEg7@nK6W)^T zuMu7;uO1R}gp#sMv-(5yNg%W1#(bfMK85DCB#}bgVKYZEePKX~(18R-Po&Wyt?%66 zeIC7?nzYdm*B3T9HRJ0l(1-x#ty(sDzBbY$s4Yb~Cwv-r{Sgini{-Ghjom$&UyzNJ z%zvS6yZ1t;MR?I2SN)ntIJbVd2PJjo=*hpT^NG&2c&F*JFzr%iUr-n*vC~w)pZ)7` z?xxwgecfrTn%Y0)v3`|S+@=~wVIIf^g^gO&TF@SFog(TKYe@+FFf~EtFJ&U{6<&61 zelhCcUH<8$v}>gf_W{nuWeTWFWy`QofCcZgG13TMy&5_ zl?{`AjYj}HA96+g)ep8H{HQtmMo_h3q`|=)oTC+Dr&9Ikn5}>p-j89>z zU!@d3Rr+aQ*eyo_!HG(oBN}J8h#)Co4hFVYTc0_R2$GZ*^u>tI%jF=^C@Ci>a=y655{G|JpOYNNVTly4W$KbZH%bDTmLwFuXCMpDUkwo zfE_O2UBjY@&*wH?@ZJnG)pp*{3_ZUmzQRN5oSANBYIr0axkk#n&` zokLwR?Y9fL^@en)mj*`e-ex-;j_tk;>!29HA(VTVAHETQp_zH8r)P-W*v?F&B6xjj za*B5m8wxpeU!lE$k?5xa$*rJi+&-&w+kA3Bf(`H`3qOL~;U8wQktdWIF=MYP*F7Zr zk@qd=9aYR&zEZ<|=3E|<%OBPcm)&$MDH--9YbNS~zZ1;j5=j?pG{Fpwrkje6Mwg23 zE(%mCR5CpwlS1#OOxmOnKc&FEXAcAKEJ9ESf_8&k7J(^J72hP=<`@+zRV*+^s z!+j#FIw*^W=IY+jTK0gerH@{qA5BM5iJ4jA`>Z|nWG?(AkFgj)35?K?0ukPfd$*Wa zr$#2V!%xZCIHtmA&Zy@k9to}WTGu$rmwH!#p_7)XI8qG<@aOCH_t&&hUSHqrpqF7x z;URYS4vQ4e@*uwx6Z>pi`1GKi#%Ak!h9{Zr&}aDYbO~AEG&lef?oNHl061Js#iO5JU$||AsXw^+T?v z;JUt>^KmGOO+a53@;UzOvW_x41w8#i1fdnYl;+XwOwvOD{$+CtTH&V(aTCwi8Gnb@ zkzY>?x+b8;bYe2;!KK2uelu)_CB1~SA}S$lCcXsHsu_te&M`$cZVm#{GPp1R8?8zr zWm28d*!Va#8%(C0eWz$YuD1lRY0)#$(988?Ox-);uK<2|LWZS0bC;hJ!0zH)kUIR9 zyPNQr`tR9}$4Xrqq-Mu!T6~Aby0;3l7KP>tB>25Oa9ySpOb;s2_$+^gPTW_U7vm1A z>te$CUJ}=D?#NKVNp2}@^^q#Dd3#x*7ey4X)yydJP(<~}r(gYo1@e{>E#WniOoM%crK+ZrudK@6gF@>JBymOKIFD$?Iaxq@!Q%5WTj> z0ZwMlExSP?Eg~b2Y1kp|DZ6vPyWSHpbV8puZt-^e<5pSQs1xCS+H;$i8UQSv#PEwI zNx@Esm+!l_QEeunMhqQ;pe}y?ARd|}zmg}X1H4~-aq*td4fPXsW%(y`via|!6UQy7 z1-Mtg-SeXCcwl#z+TKqAkVf%KfUCD$_s)=vXZs^>nV%WowmRNiBD+_#KH2ggLFj{v2PQYIZ0oe^pqop#X%CA&DZ+d0lK7>9 z3LNc|n1C^ui>CPTsqxL%_uE_)b4%E*bn<9{04yor<8DN^UdbZ7Ce4m2d>mIoJ{+}y zNAy*Spy!L>u3y2cvn%2(4ERO{s`BJHc8}ddwYcQLe_^`U-B+Gg-_yVox$3A+4vsy6 zvf>8;gH+-TQQ0@^UFbi2&7?~vBR`ipx2CSrxh$qQUiO&kp>PXn*RnHW=fZbNplK80 z2b?&ql-#wQ5Qy{9j`Ay%nOis0NLkuZU9mk=H4|kvMqtuJ+jJIye9tPb)_A$m^uq@H)#-k1XZGo!6)H*nzVz1U8Isq` zI|c{RF&3JNAWedLZEpS_P$D{eRWkh$NygaZa`y%VB?dR1%8^tg-)`2^rB5f2Y>9E9 z+lTE)WOpj@BJ_OWl!SBnY=B9VItix_sbGBVS?tNLmm9G0^|XME_1FZ#GTS6fs2K5A z$hFb^;G`Vo?k%`NFF~q8Vdp~6x3bdWmfY$E3Pj&n&I`&jZo8TE2gCJ?Z*5dcTTt{+ zy{GAE1U6cau|#^KRSXS^YmIXRvvvjhpK0!<8z=p^a_l|gBopWsP#SewFMIY>Omgf> ztEtVUOhMapWb6Pr#g5A)2@C=+@Ez&psGOW*?r`EmNtW^Qd7e5q@(c4nV{lRpzB|wa zmr$A@Kb8=)Jr#`+Fs`esObq0-h92%RcgH}FwJUFh4GxAzlrScb;rGqRrA+0n?0L8_ zg;IHivDLypj`%w?0X2zzvqnZa<^k^ndu7rT6q zS``OvR~$pG%w6VpoBZloE=h)J+c8PMLRCJc7?PA?p~H$*e3syVlzUst3zK(7G$8Kn zaHD6iJOJRN46yD^I7XH?tvnUnytd-*s!o$j0ACdXdmFX_f3a?2MSPSSi29yLg2;=D z0H15}zC!RcU>Pg|kQS2jV3- zBXZCa5R@Evgz-fNxQK7n+}exB>_sxgM2c%+r+kN)qoK_5nF-Yf8~9m~u3w2jN3GSb z0}j%Pxi7G+^%7>owi_)a?CX-ti2~)WpQIhn(pbd2u#s#4Ps`pG20dH=tT1Gwe5U+3 zMJdBls_IapTs}ExQge%A)++QoRt^*+=OF}-V@{Ljht8U4iKq4P+C0FHBf^H$cIWlm zQ>r4i$himoi$+Zt8`G(J?5-2c^-SOsJIem(=3{*ozv4sK$BAWU-irR(2>_j|7=v^4 zppV;DY5n~9TGx&XX}-~b*p=4-aPyA-s~qo`)DC6K4)C**&JE5oXH9Bs{#8RgbFt67 z;{i?pxBI}8VKOegnH$J1z#*R7K${1X<1+pSF9vfiNK1nIea`T*YMnWO^LA1nt)oPw z4tHO#oWu_o*J>W@)u3<3?R#J?KriA<*D<~ZqR1ZJ9-@#ySS@j7tb|U|nfj%ns~+Os zKFSXhe_>@AgNJ6jMNiYU$TYsGYrul);p@(B^tYv@$E@ezWXrYV56xO@>O3-MHKw=F`Zk%r;NI*Alqs_!f^^yAEI{d8@;WSkV*F>p66USL%xqU zd8OOjHmz-ztIh zj==f|v8*9&S6(e_4U-H9KCzl<;>f#J)qs^Un?Dg=|Kd#MbB&`b1iik$)e$~JJQ7bz z8Qvdq1>jR9hOUP|OC$@ZA5A{d38}kIeaCW05X^~4+ygTV-9UjFE9d0-Z9wc-ecs$M zs{JamhBGnOE#e8!fTM+EXBXDqxX+9_d0OXMVon)HQ>025rvNZw!-PQ?O_n!Afqlk>l#yB`B zJYU1gq|whIkQBO~o3!8XvAsbbZXuHeXnc-D8yuxJA}z1>-lM-@KvrKL!HJ$_i;2b} z?&`}UY6<1)2-V+nigCC&=BFPKEL?2Rogd>fsWG|%4Tz`P825)e?CF+r7p?AYawkQ= z`Ni&R#?jry`ia&F`3ghdAWva<*X2PFETPD%=j5fYfV0&j?=FVsd(5O{7lEw3vP9Yz zx2C3?Mo;c4c3HLKZi7=pdpM>TD%VJ3-guwB71{Jd{$;q(J4-s%a2vvwLs2 zXmGe{+0Uk4zIw@V+r4VtbAe3|<`6%xB?ydfToS|3pXFuD?wW-X8aa~602;ac<+3i3 zYiIee@fxAUE&;;Lb37WSa|l2Kg7<5s-?r^912QXPQ%(*a{a|?KrP&dwQ9b;h_kG6q zLhLP|rSyjTj6efY!l98DZsmZm#3G7*3cTr)MHRGC?;j_d!cUo>kqY5Q$s`}x?QKQk=bKyi>^u%#wut zlO<`)p(_r`Au%rPbOdHeP_sMTKt7GTU@7IreO}mm$;y>*a!p>S=53?rQ?Jc%Ly~{f z9ZhU2DQx7o-f)8>kEqeJ`ip>|%NMHw91Q(c&VCz^^Y*sOx%vgN{5Ae|dT`PB(MjEJ z*v2fYr=CJqkFma|hdS^&(byJ{tn~mQ`UShxy|lgzb|s4;yZFsdy{an_`RD zD)n8Ol^+?;zsuG_-3Ayt!2F295Y+VH?c~&oJpA^T0-*vbkU6urqXkuz#HrW48~h)u zo=S8NOxQ`@qCZ{N0RdZsqeFpEY;`$fMP)8T>!E!ne4Bl=~ zQ^9d|sAYCsZPXI{mv!f?(qKX>qi0X?Ep9Cx553&V;|7pR30VqG|=_zMM~S*1qpyDcDms z{TF)_p!LY-2U?FOG@$kPNN+S)X2X%ul%30f2nVo7P&bb}$};rVsuY{-RawpiT92ZC zSr2(lWvJ}RFA|IBgsN=Gkn@rs&MN<^lECV>|94dqbgXdsttJcmqIshmnsUc74rNzh zmEo~8LqLc&&Vh_Pi{Bk}A5g0DiFU2H>ue$aQ;@a)j)ME=Q zCS<>{M@qBjzhjRhl(C9rSVC3s zy^ocr`K1MmJU?Uo?SmCSvGD5K1Gry%T#2FfF`GC{k2yiUCOjbCf7TP~i;al4YT7Up zbMzdxjjMz>Pflpmqh(W<5OfP&WOyDUYdLUY=Mal^sgwLWOOi`Hu3!TZX1mvNy}9au zBeiiS9;H8~C#ofLrlXnJvUEHZ@c1~$wk4z)O|&q^ z;7$$;-|iol$7e}kNd5WRJ3MtqV;{Gpbd&vpF{qg4$AnY$vst}Pqh(eZSe?0jXGvA# zY*%}CPMw1ve$evoFv*bGDsGGu`H^gvGx6+>5*z7}xbkOk3C!s^Y{(OPiYzY;rr1B zh==<`xIsg^JroQ>Z=%58-lKxxtB9le>Stk0UNc7Bg7g*Xj0d=1kO9P24H!b4457^h zK_&-=6Nv}Ey@yac3Yeg-G_ir1XhX*h6`6p!GdhE?D`1RjKn~0|ewR|b8&0K4P%Wy) zt`3PrF(dQH_KkFljIh;q2+PS9@N7T*#8%98G7g>fSo2@U1<>gOaWn zzq!H!AorN40t0f7UboyiUkf@ITd=DqJ5znfylJd61gB47$&4` z3H~to>WZiXZ^DKK@E{Hy>MqPmVPayqd2n~Y*soNXk;lBV6hUm25CfAH&B>`47gtX< zxsxCB@q8bVZVw6+mGQK=m<-tpJoHYV-aa?-WcR;zyb|bKU(dw$eQ+bE(4fZvYL8P! z7TKBJ)1V~qq~CRt)?6`ka(~3+d36HcAOPnu_q=s;0StBt>=|?Gw|$%@H3zC6h716^ zh{<7h&+k5hbJlt(LO$)=7Ea;?qlF{a@x8zJnTa<^!1m(EBshoiAepna0jo4$(Y=ke zSr51zXwkG6+RPy#@5d+Ndq{tuZ_GA z{($i@%9m+w#mQ)pHJ+H?IgP`}Fpx2?!!^o9RtMw(uvbil#n~OcN%T#fkYO#)8~~IX zEZB1)>hM?YZlYi6g|Zz_mAZcYmK(Z!ho-u>in8a0=Jvnk24a^f)xYEhE)0(Q=D*90 z+dHAZ<%S zjdmO8tCRoA_TR}3LB9V^Ziure8pw4aApavb*8Us0k*qoX{g@djH$J*g0azB}v>Y3N zbmJenLB?+gBKVKo`10S#jgsGT!-gOGUN{B@C*{A$jocmVG?vo3O%l*0pxg-fEjQf% zk{cWbjsG*b0Wj&5{F`q4huqi($_@8_i`A`~SJzzQ zOK$M}EjQ-=i`+;9$_>DO(2f6Za^vZ@+}Qs&xsma2azp)pDL2lI;zNvpLkPw5)zsy` z%$h6X@r^M){7pGX|E3&Le^U;-|3W!v|ATU*i5HVk9}U(xGr8@jiQ7n^OA%nkjblWM z%25>GU>7OmEz8f9RoTbZ7MHwg=#`Rwq~GibM{qhkM=!*;mU&N#U*>54ByEc`KdvbF zqix}J2d~pbmC3~`f>*S)_Hk9)St#PRzDSSb5?f%=A=J$@uolb0CUsk+o+kwb?b>I) znXP>{p81pitjvV4!JW=aujlJMiGO3K(1G6!%m`Eh3cFon|Gs-a)k=nIcU<&Md=U;h z9>6L2sKMK%17t(?jrI_=_gR7nGJAPOTlBJl7;(n!15v0>B$Z@5TiY&flX)3SMI;9)9t?t;X zror-^o+yx{&0nUN&Mz0-`qZRF%%M(&TYi749{J`V2Zay%ZGKo+($6|oFJ0aQT@H$@ zzLldQV4b=hjQild!}eyL#ypi8&iv){O}cjUFlBRy+GOuc-fe!a#tC!Zw6Afl3Sjyx zk7A{Jp{V=JB%#56yVEXq59*28qHVDFcGCr(z1dvt`1%gceGQ6|75176`6stXvO-HK zQ1xJM3#Kzh740_WUjp}bY#&eDNE<804#2BP6_ZfJkk(A-CduRKR;V*|zEJDqnE}ukkVHnU{x0zw3(n z+fb^Wwq<#XO({>&vGll@(n-E|HoSw#DF`h-qk6?>>wf3$$kEz4kz*ADMZikh0+?$* z$+1ZMWt|{{cEAI*2d^f%t!>IHMnVkhrg^bAct2K2MR_3wE9bb+nG%Mw+#Jb^GQa7K zd@9ecx#pUTNKqHu>0tvuN@P5b>K^>)Xk21t9kx`lkivY9T(QPc(0g4Rd5BaqWAv*= zsdHO-3&mUe*6*6-6Mzir8vvZN0

bx|@xbLdvYZnY}F|umbX#qZ0p+H%dpD_d|u_ z?2)3sN~%-$VEwV(#^SIk2@Qcw1#{l1hJW(~Z9wt}? zB29LFS3qJLZ+u9=b@mDMC@o{BD4tkXN(~8rcQ}#}I6N_(g(ti!P=-35xGY zLVTalV|09)Kr#9WpvU(qv4e>NrbJm*0HzSP8zQ1mi+A)FzM4WuSU(hqGyPa#UFQS- zzUdHodKm2e4?FIUFC#47bWYat1{Iy`<2Wkj9{9*{%7HmcjY;~fBcaeSobWL7Qr`me z^t3e;{4O!jvOyJYT?x8F*7TM{a^$iMRqD@_s@Jkh?+uT6087r{cd6^yjEn1wJXfjL zS?klcZxl?+7Wen;m_+F$orJAV_wB7t8XqoR@H(#hy!T&kxyqR$)<88M+6+_8beEc` zhObff3Q=z@NXL@9uPyZa%Pt79GwN^MwW3Ti-_;)Cv~DP(VV+-9Ey~wheFyJFB&Q?d zcOWOR-!wE`0eS8z=>u|(gKl8b-lKMEw{Hqeeod1@c=12n)3AY<rqz9Tx(G_KH312KU*x9f7(*e@WmPKoq(Yf`!=Q6&6yI8F6F35yV0t{AC_6 z3hBs-xpAxJk=_bgW=;UWE@j}=Pu`iWpc3%nva$4KvVb`|C55NwtZ1yKbyn_k8g6^| zxkzW{o4Ee-!fjxf+`FdsTJRo|eY0iWp|d5Oeswrr#seJ_KyjLu`etB{Af6g<&t&e@ zQ=wy&Ad}^5b@lXtq1o^kEE_wzWLGFYanoKOrNB7nZd8^XlkKv z3|^SOQP8kZd8FPk?%McyxhM;Bw{j@ZqB>HJzQ82pFl4v zOAwB|J6ZP~$sC4)3ApZ<%)Z!qKU^zd1+d3WZ%3|q*#LDI_6#Jb{pK0e>XWSLvtcANXjBLF;YR4c1$Qsh)Y)qpl z!&>+`0F0yAjXpqmC3d$b`uV-B^_As2wB~2L{N-036OtY7zSG`CO25$$n>LYIcOB~= zL~uMT8?&b;Vn8|6Te?)eIGOsuFOK2Z0+sM)qb)DfIzDagjJ}iG(8B8P&tgWc2**cJ z5e|(O5p;z7=npYJw~Mp9yO89a<*C^0R9~Ct0_ZjXm9#+?II#MGaKfDDqzt4WcdQu|y-)LZ- z(7nA(muF8iCrCNkHPT2>ccpDHHH1rHh&Hw(#bJ*>v+-tpK!3w}y+6F7tmnpVC>nib zr@*jp5V~K4fE#9`?GJABYekKP0jxk5>?L#096U1NQ{NS5EuA=oGT2zLs=xm5ch9{e zX~maDmu$r`xJOF2FZFI&s>IhnBKy+Q5PsM)ogW?kT9m!#E`>vOIeGG--GjPSKR%Z7 zK!1KuA508;<}BRY5ke(>VoYcEQa!<{MVx;746nv0ipq<5CXEyMFYo~XiVwVn8H>Ng z$A_MO#K#u(zraWCe+xcx{{|oWB*n#h#=DhGK=4ua5BO;P8+=%ocDnurJ_dh-5BI;p z$I-vQhYjDqgAYJzTSa9fop6QYV>gf4dKWUOnX;juMMI*V;4Bp;fl5|fbLs-c6I_Kw z%ROz~a3TBT`LMv0o&(FGv|o~hLvn_UhP$4T%ac;~f^MJ5x6xZd=#TcA`HcmP6bN(0 z)~jX@BG(v-JB6AJwHMD;umIah?I!fHz|j0w>2(|7n;d$(-gxD$UUd0a}lj)I77SRZ-HD1#c=?Wa}%qI+wU> z{7!0!xaBdIfM4Lwi|j+1_jyXliB_(w#ZAk%?eeAHc(Rt%y`pjiCowmrDiD+$og+k_ z1Fe07)BxorcFFCWFL45SwjE#G{AC@8;^5lE{h+i_(AU|s9Ib1uvphp-3#*Hcugrn% z51QIiz6ArE*k=Lx_M5$AXzZ=G`UOEw_k;!Fc3n8zjt=_Jr43h$-T&Y zGQcv^?Rh#5F>9N)KJF~R!%F7)%Cj!&Y3^xj8Toi_KsAJS$FSQX;}Q`n|LQvk2u?9y zAdLJj0n=k+L9;j|a&cEGu>~fXzMcNKECoz|L`dD*^y+-)l(Kht@c)GRflV3PLp-=4 z%fIRiFdF(h{edR=Afq7geEOiG2Xo^D{ur?dIU7&!1Vae;p6!#&|HB!=8B%Zy1#H_V zh*YG`xTqqx@0p{Ktf~N^vruB zQ>%dSpqq*RE8menty1bWWtaTqb=Qpo=<8%W9v6)3+SYXDm;!|xY;wM_Uwn=3{1-gw z)k)a|e@HHXKV7|uoo5Yy#X|1EuhP?rx^Xyp3m9!KKUM47qH-E8q1rhG#1vaFg%4(IJYxbDMIZlyVF@@&qUAw&9 zAi>uZ13y$1OVmdMo~Caf`(Vob?mo}pev5CMf$MoycV+4v*sc>nkjV#Ai97XCZ>bST z5UW}1wM1Ibo!zF7bfnw3U(Dyu_l$^6&)Nu6%;4Jb1r|Q!BX8W9nz`~SG#k+kOp{ns z&$u_NwpRISG*0!GlBAc|#3X;%!Ni9a1F0l#4Kvq0_^!!1?`t@9ygEC45JK@6|K}*CPuo8RhB?$P>OQx0=y47!dEHBl ztW*Je9(h^6dme5Es2VpdxGA|qJgVf?*|iI?V^gsP#b3aLIbGHsFV46^$t_*TL;=kE zRiqUZ_m!n`N#>tUt!Tb;C6X=c4GnCaISLpsoWUVGsp}eLG$jZ5;sAplC4UD!Mrb}q zLHF?`pPGq_GJxbdIf5_kAyKN|vSQuX^^Cs1(!b=DXw19G-Nl@2v00Fu2@%R9C`=w6 za-X2DHplpX3Js$vN}o@Ds=)&|EHduWrpL_fkG;I;;#y_X=PvuBhO7sE?>^7WrbJ5l zu=HaPZ&Qc7asCm?(&Pc&HDrq_80BW|#2r}l;7lnf_9#tOXDBu`ue~^DC_GKo_TRcY z%-73iQoM)KI}2KNk5>%DSgrUQL*+xyO>lG^A4 zxkMzA^_gskvdkY5MMKfy@psbWBhC>yI~v8CmlEi&0sJ!GNMO=~u4oH~6UUaU32Ebd z)nvI3A2RmO0cBMbItD;%5KLsU2IL5GdNu4-4Bw`n6YTVbSDYzwJgHeKtKQW&8sVZj*>?cucf*n-53))YPGhao=Q82&~XV;XrV=Z#d! zjtfK!;$zM4fCjrHL+2OYJFaptu=?f*rm@Aai_x+Cn26S~4*j>Z_R)tt5G zp%2dQsbz5}+dH_~y=NCMoVk@g#x!2LLTCIPs@UsU+yXGs=tno73f%1#C(ymA(#$~8 zj;vL~&PU!ne^4a=20f^*U-T+BfI*K2V9+C1G&-!xs59i?LGyReBSS?A{%K4dP7tfE zTou&Qs2UjbVErBRK>H`?QMOYz0IWBV%5QMC))pBiUiG0PJN2r8b;!0jEXY<=Bbd6fZqBgR2$zu!O8iV)Z0}7!aUo3wDYcOkjSUe4?p0wQFp4u zm%@e%=V#}u{BVjJ4B4U0b?8>Z-YSH+E_y}9xmwWMZ-^H?E6zsSLt0Kt8W2mXTKB1_^i%MTD$2mju zCSKmt`qJ9qefh4M+e)vMEon#q#$gghxuJr?d6}=pjp;2P*VHZldDNrdB$jJjUapP~ zy_L-(K1eC~L_yS4HBZvHm2KuGP~e_{LS~^T%L&WX!zz0*N#-p*O6JYC{n~A{AJD?O z`3fiQSPr;h)s2adN?WfKEEjd6>rqdSe^H!T>1qTi?ONwycjUQjNM9SnX(+?#VybOh zjSg2%GeC2vmj$GlAaM#_os5#d{rsHCZn;`Z(-IE{T+QpxD_L-{mFl0G9SuCpL$AHY z4nU1od{13y3cJwB{$`is8Jn}M0!Z=`+iDWtHV%Jeq_v!fx&nBV2IXkC-1|3~;_%+7 zqU5tToM%82QGTy^=AUKzJ*|*KYIoSwY#&@crfRLZhW{%8ubx4z8ic#gY~+~$J$RGl z+F&2$5a08aySLH*S)L-U->?9bn{%6fA~EpZkqLeqrry#F#hi57_~GUj;OCE&a$;9N zv43fm+*h3Tf;btiUZW+&>L4%BPA@of*^JGGI_mlL_~{ z-5FS)>w28^Y?!uQ$;g!h_@TZEDwCS2ce89{Z>{vF!x_?6bHn;Y+?jpuV|-&;Ys5#2 z+8>7xu-y#B4I-BM;!CpaW2NY+Am4RT;gPC{@9EU!|9Vg9t|1>K|5^F>;}P^{l$6yq zHKws5)ll@vu^rb*CE?35cXvKNAxNIUYK+}A+qqXJhqXrTmqve3I@NNV^`3^y$>F9Fu!ZmY-5#qZ zjt~YLDG`mWL2hu~Pa=}t!_Pl5@lvHQks)|*?VgOTqjN~Iie&STueXY_OE`y$vR|M% zhjyE(C+n!?j*0-F{g6`jyF-@6_7?HPf>{N@+<7zBwB6SBi}X$peKy6_v7N>5ImS*s zX%evvMgq|sq9COXg-n%aZ~6xcilsN_cX1*p)fZxj#i6hG6mrzq983 zU{Pn!Vhrm9$p2`l^HpNUn=w&jCU3C>+fE2TnANU2l~t_LdumC(-Jmn> zi2TZRE~`<=it?JjLM5!Nh}spB8@{77H=ayO)y(;Q;p;GtVr3jGTH?t90i%R64&%KF zfjWGXxTxkHrO;TBXnG)RmeZnuQ_DJDJr%-2`!oeLyPjY+EVFZ@z#_8L1JUkxiXnYL z*d(jO8_F`kL)ApRnz^aQnGwV)FiQ)&nSckM$;>JXOWT9hG89hI26I>5Mwb#`H%mrM zjS7EEMvIJVORzG>dBZKRE~(Z|)m#8T6}a!#nWO0E&-wual~XO7+ZelJ_}SA}#MmS> zXC@0lm!TXL?5K_UOEN#gs~5OQcIJdbAbMaj)=~jrfm8-%w~M=rAq_v!JmKkF_}ZZx z#Ex{y{Sf+N>Qp3_bIzwq2Y>A?CQ3S8(LMoRcTv$A9hkz%FqD2JA|nn`rlIfJUs0$N z(MVjyG3zrn`XdchNMRJgYmtnIBtKZkj~=3zdbt(-^?EY*R- zPq+UB%r!PBCN4l+_W3h-rOtSBP_y)4p}{Q0a|;ZDrWVPNGG-&~K?ly3_u4w_^`!Fg zJdnrbmxv6Lr%2H{a8yO_{j!r{(`>s8phe_Zf-RcLfP$*^PvxP8SKahT#;_7ZtZ=N^ zfx+_=h3Fp+Fk4MFYhJdZ9T$ReAsA;aGWD4NoGrngquUxoCCRetk@nSlO)n8he~Y$} zmJ#T;9bMJ`Qsn8^yW`m26T`X7GwDR1A@T!pu}r&O`dDwm8GFaT-n4}!!R<5SHO3J) zy9AX5O8zo(X0=k9(@>0>dXf=$xp)&FAn^4&#NNr8HRe?ep&9%uxSN!PR`W!|{YOz% zz$&CTc~VY2&Ws!OFzdkMUPhJePs`L1)D72IbeBt(4wp*ym5z?kgZ|Sn8}=Fl_W7;7 zYSSEIrI>gDow>K~$F`%}KX?8*4aIM^zofd*32~FjczA-Io{YYSo3V*M)vnE(rn^49 zk$UN{9}agQS5?eMKpMH0vwqAZ{cWpQzX#*!q zXOU#pIyN-@qPO4RdkUwpz_nmQ$hT>;EkJ!)yl!!p5-5E4q~JWhW&rhc@2K5Jc&6s~ z*7SBjjmH_+{wsm7fU${r6iW$ogT1Z;;*)9z35svC)uzm-lNNUE_y7~scxEd=2YdV7 zP}^rU&dTLPeEG9N{oXq8U`L}NEI18)YvjJpY>0O|$1Gf2+O=TN>Et4`$aRrzXY{zh zOS8&HU9iMr*nnFS3;Yge>rBiB#KPRsq(s*RYi&pbG75B*dZQ%llz_!)Zm{D;9vO;= zcA=JQ*XRcA`ukhiL3^je89)kBt5@)cM0{Bz3I>3Q#g0*;x*;Gti^rV&sh;-8=w2O_ zyWAlCE`*B0n2;YGW80BbK%|_9auH{o0U`5f*MzShMOYA~KkFm%C&BAT zb4i}1!O`jZZ*#C5OppHq##oYN66;TJwq)915E4?68dZnSLaA z>CRop&6>BR&K;D%JsI_Ta&8w*l~S#WDI5a+-h)}6$-usNwb%K1>I`LGx%GW8-@!+@ zZe}5GBZNER;DWly{l+e)>w?$e{Hl1azAd|461`Zi7jfg~W!T~!2M49)phG!=J>`e` z0c(Apj0~LM$+3z6FV~-{>=GOeWEio{0rz09O>OUJ;qNCOE6hQUG5&b~K-*M3kTP&D z$#=udUSYLgc)e;jqBvt+tu-yPb&Vq6Qu8A`%gKl!TCgrx zbTjz9(_2F1J`6BY+N^EquR)d7S^E&8G}$aYn}*Lgb1X1LrYl($V)GrQXee- zJO}W&yPf7T(~OH&wyBo@s78vqN~lI0in~I3lr5T}uH3L(EJwkl>NzoUdbw zzN)d3!qYVFBbxC9L!N7%uk(F?-_$|gOhmuzXR}}$+33ob(t551IA*?D!Q&W+bbpQQ zC9!e#LS2gJxcahem&n~hKS9K!4ohBx&#t%NQNefhW?J96ZK2gI1(HeIrjwr=G31c) zl7OysfzP}8Xrr1$ojQQJ$$}b8M6h?=OhGiYuNo7emkmN)l@g#~M3k8^PZk+<@Q^8t zX{Wd0)yFl}sT%qW5EV|kkz8jf!*#>24tP6;IV&OOU_qZ*@CyjP+Whu1BO4pVecsY@ zT362Yxq zI+kX#U3BzlsC*<$fZ3gk|2*hzvWhUAfp|}EWjC>25z6v?AHL^6R%lq-PIEdfJ2F=k zrw8a2pEx~iL3w}vjzSxh(>TM#{?x8X3i3m(0#Ev=cQwFrLGM!c*SI)H;D`mi$r@fb zC56e_KF>!Of1UI#OYtO~sjMTK!7bwXrMyom@G_Nd->gE0w43(U95SI!dMTuJIY8tJ zvQB&pm^~lPMMTYFm$Y(zX6aP)ZhjTi_7MeSPiJ)#pkcDJV)6?KSt|?d5dP{JppG3Q z)YCVaJ5!nPy8UUd!*spb4>z)Ug#?lgyyHzqMj#IK&MNqsi15AaP^S5P^>Ay7$< zfiv#@m=n0fET^rckz0J4<`6+aMef~w(b_N7Qo7uCYhNklZqGD_GPnHji*2_$J$*dy z^>J&lkuCO^YV9OHNW)durTQ{$stvK!q*G^TtVR%D3j5uR`kfCWSpRjU9$OH=7Kd9? z=!)%*5r;giXiqjJRk#(!C>1mWN=sFj(IMx3QN$V1n}q0+DRsSY*i+i>GX3_5r)t{l z0%(t?e+v6yU_>Rxzg7}sRD&{}J7+Q${dudD^N^q$A7Z3jT&fV^HCX=tVeK7*H0!=> z-%3>4m9}l$HY#n~=FUo+m6=s(+cqj$Y1_8VlkdN~@9FN__nt2&VnsYNR_vJZeA=<* zZ;ZXhKn2IJINzBx=0!pI{AVOc$h5b8xo(Gs#a$f+5ZcT1W05F>_mN?7H{Ba2# zk#Sa0WOf3A$CgX}eP z9TPSnURbdUr$+1^Tpe-%mlU|Q>-YiZcW~mzbvCgy4>IV?dhe2CYR;|iDC9GtyD^i5 zIqsK9U3Z;TGFi^6@ZDOkT|vptL+C)+kwrRP6Q#mEx5Jo4%qv#N+*ziE%Xt9vX)MVV zA!I#QzW2gK$^5g??7uYbquy_1faxRm&oE%+G7MYj8|;;dbU&G7$=BC#bFRE>@KHPd#M%_Owcm3Bz{Eu zi2ibrkpD$~laEi&(4X73EN%?uWA(BTnEmB`@MU*hZMO=i5B!vi9udxCsiYj7h$Hz+yT0AYf;-!RIca z@sl<-sIQVzW^p^lc6#+QLj=-w4tD0nE{BJEg^o`8l&6!g_Tb%QCX(dmv^&3Oy?F2` zz0(bkG$I5`a;`}aC8QSLuT{Wn;(6&bMy2XLs{=`W0*h~x%h?UlLnBXhe9NVieugo9 zPWv^bZu}cw7fbze|9yUA7ON^Zx%n>|5;gPFMinzyJktnwCX2){L9@W%id>MfwQpMA zsr1fg&-@5(I+|p+=$f__XF_(Hi}9zXGCbXs|3V^&)tSy=Jvxl|fAIlE9Mn;ZYDyQg zwynI~D()?HZ?ep12z)9mhvh+kc(WkKSQOQLj(#HePO`awtUo?4=QMRpt7?4wQ`>yQ zWqIr8_XVp{hKUoN`wG77J|Ci;o7hr)w|jTyAiyM}miEfw@bHlLMJK&iw3cxL{v~MD zS%SatB1XaNG$NyXKe`X_Hy=C4`jM|b@mJ?McbjKpoa~iU4T8Y{5HC&Hzb3i@$00i2 zYFJSEaTVVT!spGOVf;P`VvsO!d>v|Ed9Ra1$yG_4cD{Fki*K8>#ddX%SY{0K@k5Uc zx@gwJ(6cSKAhjV|UPG`BV|4W^aU0(?CiM{r-jtFjI-XCK^^7wBYR_L6gD5v@awA_c z{lxuukeB(YIkpbnJb~RQo)e=s#o~5#Fs#W6dgp_IG&yTc@SFD<-#=L*z7%%Dq^+$* z9Oi$sY}X_ge6g0cZBBRL`=m~Xkoi!~_cvYhevj~NWTDPU{Szjlg`SDxJ_@EDW<1<0 z1ESS*=R>bN76bTYjmYy$UUo<_J6tj4!_#s%I1=M1I2vpRe5Q#&-hE(24tq329+3`S zlkbprmeZ=OI5X#)i^NadBN=*4?@nH-0HQCPu^i>x6xN*szq|lv`s7UIPrmA8OCO=a}dEl!}O!SsIbEW?+ zxrpVC72CkG!Ve7(J(RMM{|pv6Ih4|wUB4j3X8|CaFGAS@Z#`T*OM@D!Z!oHj%{s4L zWiJ@?264|bB0a zz7E(cj5rPCPS9^V#|(mFJ}37v+Rf&fvo~&0W_}NQ$G6xCL2)%HM`mYHMW0b4>6~k$ zrs=F3qc#fZ4kQDnN&98>QFYE?amW`f4*({6Cb7iW?^0@yj7Y;bmHb-b@Gq}L4Dn38 z-%dC?b$Ckr3e#E>mwaJ5c6R*&z$b4qJFf3eFhrqZdW+w3R zY%0$59sozzr=FYR^Cp(|<7VpOkv8xNntZiA*xtYm(^A1M!@i4Rsk}7nBK=iIVwWO4 zCd-A9|A47CNa{nWcU8NuWZ@Y4mcQ_=kb0T9)qDGG;ro&9O82_vaqQ5Wt+I^-|3a_D?wt8L2s&x1?wX^YR;+p7mjZAyB?J_rxeDHa-%uk@d+qKyA zBTw4v*tA?-h&|3Cp13>7&6P4H(;mACFk!L=T}19@Tb z`~}Hm`Yv4zRW9GN=(SrJW!_=T{&JWnkNQP#F=_{BqKqa~Ez>?Vn9{NQg3_6$i-=lf zAz>?_M5D9aBzJnQYE5&$%_asSvowtQcg4P~6}gr=F=9JHg`^B(OL(GbGgVrg656^M zAQ-$Pz#{kO&J%@QPfGk0)Y!+F7y8IW;NWw6u1_s1G2%ZS3z0bueWaqSscu5>KFRLu z1R-;y`MQ!8Xb@QALxDPiTE)%86PFSiJtTv2w$NgCV3@~v3Jp)n!4wWSb{V0Lr3X}& z=AuF(GO)aVXwz>U)OqN?s$F(`CX%E_uP+BFlo@K1)dv{CN3c=OXKQ?%N4QcQ1nzWm zM>a5Zy-2GA?W-cM15t)UL5h4s&m){8LBAHH9*F99EQ0_oQwROZ!)>L{@8kV zY3CH~%ar@`zOP`S6;gl-2Phn~>CwIlVy9uSEj#^ZTj ztTl->YCb<_I>q4h+x+LXMza^B6(_vSavIgZ`Wu$Y3H*Uh)*?aY@YI~CQDhPJe5A~? zw5Iq9@^x?n2lp3CqR2c6;Q3-zFZ%EJ)bg*-L|gE-Q>1y`L_A5-E*0k*Eki;*@K}2(X5og|YZ+9=9ka6=p!SNs19k@dij$dGHfe=Aio;IgpmA&~ z#8X6Y!bJ+aC9!ril}nvUj1S`;UYpK#XavAPIz=dz`C4^o^wVascvjM^tB%T5QUR9V zbJBYOko>*6rt^JrqX*&zl^v7Ht}-270_|4JntUo$M|2~>afmX%MiG^GjGB&?c(~=% z6f8AD&rdluS2R19wgLxCIsBY1^67OpjTBVEW_LuCrA}xSR8D2qJn0MVuj+*dW*(u^P|%1ow=h#^~c8tuu_5z7)4CFX1B# z$i>D)jZm6ayJE@|M}}2eMwR=#_HTq^tkD>)KdIiqE96O?XI0nJ+wSErwdhXL=ASIn>I9H62 z=)4(P|N29rpTLWyUwk&u_2=-G;k1h?utw1L818y`N~r#aoAZKuGl3^}J$84hB|SNQ zXl^bm4f5Bc@JSC$!C(3=+)!i1v6&tZ&=}e?6 zs|HDs%86){O8)#`|0}}`+~(;8yX7(jRUxiv=It3a>g9 z%xVriIL+#YcnfsAHZ_97OV>(MLOv$3+QA$zxVmlwjd__h!4l+p0PK z33CH13WLGZUUq!SrJ9^Z&1VUC9k=~uEv@B|M!XuC>uG-4j;y$oSPC+&^(fLdUbrdq zTMn*URh0%sz5^+=R7Q?p8XiqfAm+V8Qz*lcZPa?NdwKxfe<}%!byDI`+c5eExWNci zsra7m>jCLUO(f|UGD?K3e?wAS5(VlR`tz;CDSn!|OBfAr#@eKWoxUCri;`>=k6QHO zM8DXQk9M(fVf9pOVcr@gPbQ=HFX~IkcxZa@390cyJyy3qZW@RxdQoq5CM{SftOc-_uU;@ z7j$iq>|pg+a(Km7l~rzEB*cB*`#w7a4s(kH^Oyudzp_zBO>ibEk4WymGuwFow1M+| zT-|PFt7E*&6Xqq348LK|qPUUZC!35D&T)MjCK74K-(9L0d+JJHF0%2yA&Q$DX%zk> z%63uPbz@U7?`FdMnu>Nl113#a_0Z^L+0izNiWi}ss@CNWy#8Z>t^5Trc7*Tli;7h$ zlrhBZ%C{Y;kft^slmVD5+ELLfBc`LAIKEKD$LylLxrEzza>LZK%)mEk7n(DmlUigT zXSN&+Cd6RmphW<-S(D3bV&O^45%AYZoFRYAg7XFCkiHh-RU>-;At`-zgPz@DuVf!B zica{ltSw1t*Lrv9FlI>$Oy3ZT!N4tHzmiq3-$F=%Q70{PKO`7dz zriz-S3S7=n|4f_srB!ObWHqFq`wANC9Cq~jDY>_9=dP?cM59&K{9&7K0;0d_D&bwU zdS$Ub$o>HW?YJX%CsJb^Tm7}O(yUQ?PjT23ikzOt2pwi=Ts`lZ!EMD~sT0|{e!L+cCDdRD2n>*^DkZPJ}INo$a8Ih2bJ^rqa7{g1_Y} z-z9PwWjssutG1)2)m_hPzUd@Zy7g*M@C7~NY!v|k5;vQB+KTQg_%o#B=pQ0tW4!wXT6~R14~Kv!dU$J$ z#mNbIBTEadKeknGD|o-nqZ!+Yf;#{x-g-Pi7cOIJ!o|XX*OGQV8qB=m=8ArF>&=2VN;xiyx+YxS%Ep1p~jpgWkG;P>V%4a+Cx7+U|c~ zjH?M=a8FZ4V6bkIzL_h=!&ou2OdysDz9FSlA|PYtM}S&XW&5Mr)={>II@L%!Ly3o8 zU8$vSd*`U@Bv@CxNVVlu=Km3kp{GY-$4!;s+1@Ol`zc?@d7GQ3_dpXy|6)F;h~%ZN zgd!THY*v8k-QT8Ss@uV3vjPu%n{$!7Awl|mLQ-EE0c)*~D}l=qa!BPHU~tk%U58$3 z^=IBOjV)A$fWq3L!HRO;F?p@OY^}Rc<%u*v2_vf2U^ZhaX*VvB!~HSg*1u!4OpTJx zEUE+*RlIVe`N=cHylboB#N6*}xn-&p`cxbay;lmf30CyBW zzA6cv!MwZTa}ouvY93 z&4TYre9eDVb0Xo5UNfBjygr+5MHWj)?S)jv88U3|LF6y9*|rzv6y)#$`h(*I z(yNMZMa9iY1LpLyx#J*WTzaI@5n>tX;_1dNtM4|v;`-gbX8weLBJoh3crBaqymzAO zKr^6u4X;rdx1{m>YSYY<`mR(*ZO&0I!CO@m(6b5wYjhzlqe%i9 zS4%k_xmvdi!q>73jOAjaIM-1&QI++{r)Z1BzoLvC3Gp>OZ-JXx`dKyMbB>-b`qF|% zjTK^WIBjG9?b;QHq)t^}u=|zEnkA-IA5DR06o_+3+=`SYMteT7kJQN3VP%#&^{onwEy zfwfc0KA{rhKtgp5^QDYsKsw5J?N{aGz|aTUOB*T`pCQwqsxf!ZD@HgC{W?{drL%xe zxM$|WkqasP=hDCA>ruv5ML!`m7TRn~v15^%^x_pE;$;(+fBIqY*pG>qemitz!-{w> zvbaXQu8vJ$0vhwqLoR+yoT>8e3UaBsXqqBy5VQjZghgN4a|crj6_lvzfc;A!nAl9ZonXu+*y_pb)~Frb{y^IUxBp1w9mL6Y5GhV!dQ z?gb%1(3sI!Dr*3?HEYnGU<8LPd9hw&B?e6b_~((O+217u!~yE|Mm>20rVu>AcU6VVTs{1bE!F3a=Ayj zl5HJX2SDU+AgB2T~n!9Z?%GeWIJV1X}Pj-(~qCPA3yQNEx(~)EQ-L%^k}e ztLzf45sY`%H^s|(1Wwc{zTnlK6~0x}I4Nm&4MYX!itaYc-|CFGf&=UZ4jzE6sL8C|)Y4(BS9F*~Z}B1ieTK z#&mIA4ogbLlh$#2cW5CuH4ES%CKjEEz~F(E^%ae05-2OM-FktizsXdw)Z~&2-%T*% z+ty`>ma#QGCGg?g@9%maqeN;}>`jWQ^lLTXmo}c1XW6P8-w^LJyRS+3?EB>X4xe|o zJG2DjY!Pm!j%^EOF#5L~p;^`TVZXi{49;6D2;FTojn9>fb~$RVfJzne^41URt<>8Q zTD1RRXSj&uTSBd(@fZ;f@3MB|M(J(7Xq>F8hktMeh$TgC~ieXer)!F#>fm>;nEBl+e`ByhDc z_I;4U(~!I)%aQV z`Sw7m)&}81ic6fYOpKL$dwaWxV=0d!CoM7BIwTPJDWCt;Qxj$uMt(Hdy4pX9-l--p z<*VYgAF#@k?4w#Bt0g+5oa~Py_u<4*D|p&hm2Wx~{J^GeB;7kblLqGYRjkKQr8ZRG$QMjL zc?BR-)V6%^x(y-qN2n%46@WY0+DaY4`z|a8d6!s2*4JlBqk2YiIu~&I&3kBfuYqh~r4?y`{MCQ~ zu9l#|Xzj@+cpF*^NCO?&hFD$I%GSxYY5Q_RfoGtnsNOQ~M-1a6X&RCST`=@=<#>Zb zo&|3%!NYG;GfE15CkE}J!a(E13Hy(_u_Gn!6YS8=16aVvQ{>%3&Z7!@eIw|BW2?i; zqw1NjT|J5UMJAP>tJNK`7)R?M0#n1QA)Dm3DDHGV*!yD|ieH#FLZ1z}e zwgA4UcifDSJR}!hfI_pV2Ncd!Qo$yE8NK z{CIof5&uNBuH{EpMbUNWJ#^W5>FrA$*7@=B{o=WO{V-U<-ND>fHTJN&NH6PHF8KnM z;uJ6DV+DJ+r6f~Kb34OVC(8oU?>Gkz&W~VFJcgLV zROyPOmoj`Sl71bZw}x@{oG8zQMQ}50^}QS2vXz0XT*e1(emim2;EX}NR}`~5X1*(M zR~UfVA?%3_bmvw!wVRH)IrZ^F%!RzYVWxZ+({y^VXRIcP(x7AKw^gPUt!fjLyV(u+ zi5L!>i&X|~MyB$hWza_^Z{bnFx88G1hcn(4`-i_cfXA3|GT;aLYZMa6c<%7eA)+75 z89HyV!iLGf_4h8leyo(WlkzYex=JbaHm~e7FQ_|?ZkadRz2qVj*k(`Y^dyy36C{cs zb7@R}_snak=cw;!90?rJ(naLX%4|N{w42Ox9|J(M-2d zBn8{ihQ~CAMj%#VJ+7@VDvN6}Gf;j>0S+wF#ahOzoWoE_oWtk@P*Pw>B>F+H5o)62 z!ALPnFjmy~-QYe3zY?aPXr^EOEI=DCh5sa%s!C&hMg(OeL^b6@I>$m&EF-rxvN^FL zUncu>jiBbmXAyQF3!3CYm{F#-~M&MWs`3=PNfGD$M5lOXa$A@h3vy>`q%fss$OjTk6#F z45@R5O`FO%-EN0=*Ih1v@85<-gxVKc93Cp=C~w+3O(@Pf($m19O}2=6=(s*SaNGzD zln@#IAW%;(!`_#{*gw%)rU7uE ztp7GQ^6C0Z#~ZD}mrcxPRR6&|9ps06*{c;E@Y(Cb`ko)KEOUMnNUbQ)S5PJb4pEZ( zWtoPOP;7-(nm%5qd>S`k%Fw4Bt>{tj5G`d_>%?!`u9&6-xD0FjszYkS$r|g{*P~fR zrJJCZ59M=MyzmB-JMyl{h8nc4`V$=a6ZWf0*QmGisLs!&^){|CD#V%suXL^xFLP7b-JwDpI@c z`V5$&TypG?u?h2%jLg7)^r#Llo#-e)fc8VST2U6A@!KsU|% z*0oz5iC9IPxj76Uv+9Q)x@m3fonVUY*@bW~WJe$Z0yusYPrvtZ8k{o+&KZwBzs^gx zEsP>8^Gzsd0qeVd$uYrVapa3S1lx0teBrdl3aY<2D)QJQ8Z@9<+_08?B9VN1#s+B< zA$yzm4k~@jA}0|B>tEiOGr&=Aq%KbsQ>tB!8JhN84pS$Cib?sk_&jMqd1AQ7N?V3c zxiQ}jC^B@GxysRZSPJDxugaZBzFR%zU*{s_ecdh_Xp&FQ-B!aky%Ca{<;tcUjLcW6 zDNdXTbB>Bx$%-C4gl(RHLjsou_neh%6d(4ouN}vHAl%iZ%SzPlYspuf205+my`o(- zhUvn<4>DPA%})!rBM=zRPBI$GvZG6+^+28j5S`OJveV}z<@xGa1T$``S50Mix4Fscjde_O)+!(Oxi2jAf(cyz&hg$b+jhyr)w4V`iyukK1Jr8V1n z(_d`&@WSa49PB*cFpl{-N;a%E`F=XX7k&zF9Con`sM=;0;ckg5@1lKCGmlEb9BgIM z&54fxpt*OaQug{|6r`VaalLJbS>0&{lqJ`$eD%e;HJwb^NbI~-O_XcL8l07t4p^-W=FmulCLfXvuNVhw%+ENi9AW9Wxd z>0#|KZl{1#(v*w+!CMsJI2Rave(!{%7~dhS>Xt0XNdu^p_~wha$!{%5naNQX;LA)3 zqd#ZFj8Efi_kx!ylcr6UOAmZLUQq>z-94W0{ovg^Notq5(U+teioEZp$x-~*ZB#@F zucZhwNAdnl)*DEg+SjYmac8&Xrmt_?@ zY;+maNTJui>o|fO!I3?4G%}ns0j$t-G%~$Khw8DWpTq42Dz3Ei1Mx@%Wb!JyI;}Ad z|Caq)_?uq6)bbE-c8U+NO&qnHq)+Vv>~Vp{l}6sOnT(gjxs)%8T$k)kvlplV{2rPq zTERjadEHlODygIT4WbraXs7~kAE|xP)V2%eab~qGEE`CV;ure6`DCmxV3t_sX~P2B zC47LIrXrJG@ze?$=gH3Q_#??TT>{q`t!kxx^9N|QYKK+8lo83r;=u?jzpIz)N9 zGdUS+R`*jK(T@O?{URr|J{A6?wcFT_Lfe(&3lc(%MnO^a?E^Mt7K<6P>$2lMsb@zu zHl(&vU**Ve=_Fiq2(TGXM2 zrH6hb!CUb0gC@tdII`P+w3F2W!9l2d{t%+f0WCsct2S>Sdx3D|ga+=wxC$C{Xwruw zc4BURTm72)tHpbt>jqC}x3N~8{gEh+zd+%O8_-M5-CK|c{G+FwoZ{t4jw(J#Qsy$Y zd}V6lPPkSBTGG7YJa28Ehfqr1a?S?5@BJ@OVhoBExO`fcotR+g$b|!o%RG|a!bBJx z4q4z@`)H~^mnhBV?~P1KWw?iz$dM+?HNi=bU|YR)4DVVhJ@xCjm5P#$6VPG>!|PYb zV-RRvr`xZmND_Cv7%hiR;( z0$%mcAZbhZNops|NGKcQJ4R=+)P#{ZrU~9g*a`{(+vLp8OtU+={-$#=?H7E&ftwp6 zDA_?BVu+IrfU3y@xg`tTxH+mejFauZt5&~|p=EFUN7s>DMw_K<1rqxr?2T?jX12_nAi`Li>&fHP<)_uX61b3JNKJU&dNQpQANQYkxryBl?AE=?0*4**8>hXf6YBo@l&RFR+}!~ZFLj3F(z?|5mw2ZNc9)+E&Fb@IxjgL5mf&!DA{YG9o+p(P_jL%Bp5?9-Pb|)R6)ZM{o^jq9|s0wt1D0F{#V`UKV&E1cVWPD|E{E2r{eTW zU1_XN`4vG_Fm+bz(2;@KPnta4Wv(%CoID6-&L1&YzdHI-o7b^A9Y$!5pCGM~RJA!E zeGPgz>;1cbnJ)A|yU{p-S!qjmMw;n2^)B>}cr;kc+(6ufwby&T;~8d4u@hBm!F;RN z&9L4QpYjkDIA<9FMiu2dcl8?O|fzB;dly2cxR~jfP-A zX-C5g24un_lIQR!R5h_KpH0Qaa_PmGWXWwL>`R}iVy%*amv4?I*XxlM8T+|j7ZK z3#AbV0lZ=Nghher2u|GKSq|ZsNbI>ZGA&dw0?H7v!Qw?3?|!RqqN_U@ZXRbZWSQk5 zgGE_)S4RuL74eNqd&8@io`T=hL)@0{*2D96B;SvRlJz^!jw#sK^Ud++Qv4}Hg%19? zG};Xe`9&Vwk0!Pu=Rk%l`u>xOzwRF%yY|dqK<^w0*F?6)X@DRnlwrflaaB zx~B8UY(37!t;t{2Ahji9y))Vv=@WI@GjepSc~lxoYNoBb-E6_ym5pN&8VBdvX+I;_ zFuvF^Ylx2E^^RzzIlI|7#i5@&n}gyw*)ro>Ee}n*bEw0&o9`X-YSu*jPn*F1xLfzm zw^lw_!3fpstKNJ8^Po%g=zp|V#wEk;1A?B}=LOkS8)RMm&1m- zqNYazG^KLsMIVWNSTT#*`ovM{q4hT}+=0F|cd5C+I*W0m+lGUI2|4Yt*ND1TT?Q`D z8T%ze^_B`ZZYJvBLjo+S^ghF1{7Jo+aBN3)8cHBro7o8T#%sUgRf0nOeI zpveHI^@0O#7OJmkKZeZ=v#9~Z3~#tk&VI)&OP1#Sl6uoZPkK#?+kqPKg&?>^WjM0z zDky6+)uo|KuD`eoMDN(1riqsT!4{1~fUL<~P%1z5LLCFV z(QGrZ!BOeOLBU71zVzHj4>%IqAiWf3pE%KU8+MnCH_XqN+7PrlS_vmMN=F)qLDFz* zOqti`vWe#|{ldkH>^Ysk`(B+IIQP0#ZdQUumr@7QO&9hvR<_c6gGm%d(_u(Fk3oJI z1X8l=W|qmxADqPdg^YlQoG$%~6I~L}ACAG2ucFal==!~uy7adqgE5$`BrOedikIT; zDDxYP%Ha;u7gomqpRRDLN}M%R+zn<#UX6IIXAz0D*V?>`<>#X? z;uW_HGumAw=zH60``)v5d(6E5B!&i{iJGP5gwDY&q1IDy708MK7;3MURU55FqtRhs z*wZLmS#|D%H<{3D1u1Y(R6cMjG;m3)mJ1U;^s{A;$i204X4 zW&tnjpPxgtIY~|UHin^#Qtv*wF60e)hWAggk#|py*W6s~K@8PBLEjzxjVK+To)C3t z1RCcV%@hpw7#^w7iTX)V9qq zH?`8z51iQ9H%Lv@(eNyCCu~PK-sp_%zfQTA5dVA1#ltuWv<*vmF(g2_Co&{(60h3N z;Ok(1yERMgX$tC5yhv%zZD*&A8U_Zvi($=O0p zh-c;gWwU-r@)F<{UD}>W1zi_&Y@~WzT|bBCmH2+jq*}A?rM%={(B*LXj+;|L&y@hK~E?G52^z~^b4kieahwXpS9%u3p$ zTXdJvR$6nE!{%5^FeQXQy7yf@AA%Ghhb`0=ldMy7j8DzL?9sEYwRyLh5xW(B*<-FR z0IAuWIr?29fk1fNp6lbZ?Geo0h|Kc^pp$X;r)g4f9Y%BiUcN9~?k_d)!a=vpL=Cy> zt2LFQgi7E{p!wwH;Z4T=)1!}D8iff{(O4C2elFiuhY5w%T~()Gbf9+YV|n0i9{lgO z3dv2gD0+*BtrrsQ2DyWT@~`<4GM1~3-?RGppOyq^_;1MdI6DPio?5`JZu(hhfLwV@ z8h9veOx5)l)YbX&zur)F!s^+cUb+f4sux};Madj-OFuh)^i|y41-Z@HXV++cfj}uE z$}Xx|0)vEU(#+1zcAXUAi4MY_H>A0Zr%%iYb=5@RqqGr}wX|{TL$zh1C^TqOW$G6h z2o4!FGnU<26cj?2K)hh)^-^qm19CvH$B^*mjiL`X+4Dq0-6MZtkw+v=n~)xcRoC3r zXxo@5j@hV1K^!uhxsV!^G0hZ8Y*jmO=dVw4`82HX;EkHz<2s<9NEqUZD-xL21dB7) zNwI>a(&d3nnh{cEdzU1Qij*YD?xtt%i)3!27#D6+CBIHH#gFyqNVig;0)wtpEx`-k z;I5)2V;LL+wjqwsgIN{&*3$lFzmJz)*uA3K#C+zO=L4QdWkC*6W8f4$9l6J#9Q}=F zhPZ(2@W3(5gYQ?rNyh&grlLJ(Mc;IDgRGL+<2c=Dv_Z6tAm_-*_{{I3%$(RgwcQUJ z*$Km_r-oN?I0k0~K6P#;0=u2ntJuHljAa?r<{&#wXSR+G9L1yQrv`52yW;{x-el>v z_rGZ}Ha_*a|7o0%QxeA_yKZD=GKV+;!~Dq9?3`H(F$D)7a4O;mmJ@MMAdJ~&1#S3P z(((^d@a!OC0RONH1Bb4c2y@8yIWIInX{Ei1FZGr2%lG4JMz zI2~z0wp62IQ~zSzRD3bNu7s&h0dMep5C8c`WciBtwP78q=UvS)VAa-=(*h$c)-1&J zT(}?bz)W_HjXx0{CF?RC&_hJd}Qtn6$FjnLVKx~3aU7SbZ{^4H!2oSVB3x9JdHSHu!j`(dwGflyp z3RJXY2vT`n8>*S@8j%#=i_S0jPSN6yN|=E4-2o7F(ee1gWGnOd1r6P2R;#dR=M_a| zdsmORg!pYu33=wKbS}12oz?c^Mc*vVWPLt$>*X*t%XnI?>SWPt^^xEhj9`s1!cHrn zlRheHJ4T1U5Q)VONx8TTD4oXi*qvnZ@+5ZV(>aMHq;vFkTQKW17y@3h5kyBfPx*kr z8)w!$YSfIlg2Xuv^sZ}BG0PCD=esK^{hv9yDYJ-A^!YS+`2wm z)L(h}`@Yr}s&J|;tcc7tPm0R+A-#el|^;Ceo&M zpiim$#^|m^Kxqz7T9nDv5biY2yXSIaMop2v(#KU6mpGQTD6d?-ekdV4QNmAn zn|Uf>Rdv*vM$_kBBzd)_!_=8ZHuyh*JWJ=-UZ7V?5p@vTYpQ?SjXdIp_`zn!Kl9wt zd@Ax5`QKb2a~xdQe;KCIYo?vc2;>ct_lw+4e)OKktPS2uJMec5VG*I=J^nk>6GI51 z95atcv)z#j#ht)DB$i%cjMOmk_$9Kqf6A{5ZBO&_oqna@YimiIfrkRomJ)Mb!#|Uy{QRb~57CW0f3rnCYy6_xPWZ`(eXrfj zO8(f(zA>+L?P4cRjk$dd!M;gE>u($>na3hHV%q0#A2w7CgmC!}Bx}O|pAz_gJwYl3 zEu}1+@bk09XK5%e{3{V@pEQW;Ni8uSw_N&&e*ZS@#6dM}=7`x}HZcmMntO*w`5%)C zN@~>qgBYWYzs&EqwR;RfBDk|@H=s2U1s3UE*28AHZ6p?DR0Zm?@SVut)Xv=l^xD4% zM9|TyuxBVbF-+2q#}G)jKUAstU*2y<`w{+$=Pl5HqOoy%r9ZU(qrU1#vm(Ix)U97D0;(x?zfj1 zVaW++(78N*FOGB=YwBD*^CRH_ENq^ukNM|l#?KSYT0sV-Qboe9JOhj`cFoCO&g%Ei zg*&6TP9IOpLmwI+h{pPr8Q8@taXxw;pdWhF?|2i_Q%=I;=7}5hFuY8>F_tDBe`E7c zQd;*1gDP&wjzyds*BqoqsK&P(a1TKmCLKvgBK|`pSup5aL}xuAamRo^e-HX2(V(+9 z(A39h9hp=PKWUPOU{zET5_ze+W5oLGNngv15^x# z+HwzrzqXG3%#B+CuZ<2fpPX_PRkPKr_2-BWM7a6}%AN9%=f9jTNpy%O_S1%lr}?Rl!~$O`I~9_m%+qIF8439^RIl z5w(Pq%QNFqzd3(AuII5}v5qD%HVEJM8R?^kR^~re7|8T{e)&GCHV)X1*$f@w1q6{vKF@es4j;%EGxD3!I*c3cAhz9?Rlo`3eHl+j`2 zO&Srih5@Y+>PxYlx1gc?z1cGDp#Q9T(57w9820=_PQgaD!MFEq6z<+W@x3DE#Dq<#ZNqRW4Me%CNlr z@EABV)k0Vw)W$40K=o7}h6kU`!1bD`5DFh?LR}f!;iYd>Q=__wS{g9$rWctfV^IFc zK5(yqOZh+~sQ=a)($u+W_sl_lL8Q+rm$cph?*Nc@Mm_LT+zCtdSu~_<7b6}U+HFwB ze{u4aGT&%&`8e+z(bhvPY6T1KRaV{dtqz;o5IV|$B2`2EfryT8-zmz4V4b^6K0;zu z&K@C(8>LI^9To$sBhcRU^dGQumC*nF0zZC7@)9ocQu1rx5D7PE8>FB$g#rKI6EIRp zS>x5{eu*cK2>ZJdx9hskTj$$dv#~|(0UyFD+E*`=yv^#nrCx@bP7sQbGnC>A)+9bJ z5fnl5b(Dy#tbfe#d*tJJ`!dbMmr(dyNH_VHjA)!%nU*Ax8G%H<{YI#3Ak|C3j!u8- zId=@JF{A>hTwo+jK9NUvFY0+7pPzl;X2)v?-QuaZ?A^)6-#4a2AB&!4AW70t#? zg@|yO!-DLqA8~h&k!gNhFkP!^4Pdc4PjSgKf1uA*Ci8q=8m72YFgObd%T}46+170^ z!MLb^d76cJY7Tdg8~6qr__hMUBKP$!@~`)}4`hM6iW)(S#*P3ctm=6|JTO!Cc>ok| ztG@}3VHbxtamdAEVQd><6W?IIc8vA1+rS3@D$jig20M`R6?}lUtsHR?Eu@`e48bq7 zDl+BDY9V(%GH&k6@yWut5VVxkVfI!k_5et1!P+^W@(-xG{f8Y%@~FQ{~s)cM8DY?Ls#N|RpMKKQy!Zb~Ph}sd$}-%$@{Cu>_3Dx~mrEX$5={EZ zn~fpdM>k`h&f1K*hiiiWAjY5Q#-Gpu=iVCMJsFpu2LtmFjd;S&2pdJ5P$EUEN^`Xq z`zJPp{L8eX87SAzd_BB=`MHz9^kv^q_mEjSa0P|2w`VxzW3dl&$*3eh4Vu9?T zghLzFyvD4OS4A-Vr)ZL#q7WfGCuI@0k^OmZ-+vhU_EsD92)}{(6Eh)qiC)SARsO#= ze1k^1BxZ-Xn8-Tv1fGL*gUYT|Ll|H6dXcw#zJAOLJqS~FOkfdC2ym|*L~e$BB2;hz z*q%{-6-E~8h;e%Xqa{z!VBct_Dunl=tz`Pu>0s?vq?2J)jJOW7mrQQ9@ zh4T+E-Rh(Pr@KVdx{Pj*e4|y+Hz%8ZhWml^I3Xy=72a zeY?JmdvT{|aHqI?ad$5c#l2{7Em}&7L($^yQXGoA7k77uH}rmN@BM7~&pVSzX7VB5 zvevcE>o|{}UTBbeG^+{Q{B4a)CAw-q?8g)uyj&k?ee~sEQd9M91mw>R-H1%wHnAQR zUW3$_B7j(7B=7G?F$o=6$Z!UZAH+TjMMY%8U?5@x6%K#@mdfUr^+aYJx#aEO-22Fl zGPETA&%6?LZ=1?dQ_(s>G!15C2esu8jyZ&0X+#VRmv`)i79&e zo2CCi-w*<-hsU};hT0-6d`XK$)tN8VJ}YSTJBVcCrhwv!5G*I|^k}kRF#kMhmlpC^ zCQ|`FPi*E9w=C+OX>LjbE?30n2_ZvTCI$PV6STY^=YvdW2=W)lkn4<->-lGE1Nd6o z__f~YY)TFx+zf%I7~Jr-(O;R2g~s;N%dHB}UC~mas6QMeA&eDzRspgynCodazM5~s z(!>vXn%nu%uCLkutvrn3u2rh!098ViMv6Eq z-{;u+b?g=7*7XE^n`NbiH*QooK$7t~|ESd2$nx;9D#4Rg;mZ>%4Gr zXy90LWCEGVfm@R-oo19r!LKGSm$^D3>Y}}rZ7H&Mvr<+XICwK{JTW}>DC3h4FdZ{? z8Wv3I)4`=1TsEj6A;p>1kJHK}8;s3rcY|nL1|x*b2_7AVe+ZnBU0LAw85}zKW)>N= zex_Ptn#vmM4qL1D`kh4>Q%NgJ2BD;PcdXdqFUU zBl((Pbn7Yq6=4__{2jyDz0KMPiV=>DdBt!drob4EfFl^gK|=O89o) z(`w_uhp!7pU;iLG6Qq#MIV?|*9Y6$)Ghv16Xt>DQ_Tmn%GFuI8nyBw)jl}VJ4>cGL zM(9gP)Xm`12UiP;ree_We!#h~8waYg1vR=-DC_TB?A6GA-ifh@qzb-|CCt8roZY>R zcCZsW$QU&9L&i*i0xBNZ>ume%NW6LsHZO_uh1ZKjA#V0jWUF$+>< zim1=@?M#H4x=)bke3@?fNYd7)cn*3fZ)ZX${x7KM@>J%WR+9Zt|C(L=i7s3<9RQR; zRu*couW<%@D!tWN{&}?P2Khbg|0TNs{s}M4OE9BwnCTK#;769bmPvWsaQs-7CI_+{ z3G%3$d>?s&G<9QNJ11v-)fMZ;?^PCEtJ6if%7we_oAXmf$a9KDvNzn)#Wk@XlFi1M zhpTvNY`!v};+sZBgqA6_P^z~f?ZO1EODHxJik0j19$m{V-qv5 zo}_nqr{RNte*ya%IF~(KLT-<->A)FAuSfMJkBa1QQQGnt$yrM;5}XSWV|XhOlU)q( zlQweXy0$nAABIz=q?6%hhTYq-$&*{dN!||gBaEZiKB^0U*{e4q>=#y+uTce+Uj;ik z?5Nwlt6!KK)~}svx*bk67uDGdh=_gn_E=ySR>mqKrhsTC_*49D`Bs@kKrr{wgT510 ztJX8aIhaTWgB?;kolVo^?LqJ63D5iI^0}2f={>|K3_rWJ!Kg4}ld6Xyps zqHcalMUz^lTxZ>xEW?AEi_J+A7UVKID@kKzdPWC935t>I^uxXBZRRbQ7nrF!K0uy5 zHI9g{8(V7wc7z5gss-@0CU!DFZ5red7Z>{0B`41=YDp5+_MWSm%RLmGwM37S5sNCG z5!qCEej@RVM)KZ~wTs1}1<{M@e5v`vp|`R4f({<gKsaIVyaotu zaEYbKh7>jp$WFHR27vsYld6h-;N|>gD~phG$FQ@@`pM^nNPtYj}}r?Q;X^BJG84cJmSzgb?di7NJOJK2|Jz1B3ij- z-B?KPqHunsbK`K&f8&>Ik!V*q=!N#`+1L1*q}=vN=4#~Ijvn$A%PRMv1aQj#rblpw zHGEA?k*veN#V?-nt4~N&R^_i>%Uz3mgN*+|MYW@+ zj^=GUeG4sGpSl05Tchpf&0ih3(&GoAh9e^_U}C#qaB<2Z6BsLDuvBn+7<2CuvQf< z+i-$>Y(_4%-tyjG)zi{i6dzgiRW18JJgOefe+3$&w%`?LE9R z^?p|SujvBnBsg6_Um0sf`g^({4)NauQ~xZR_p$oO5e;xNk@3Tx<1zDpMDco4)za4K zD0H1d=8rP$ah@S>2W0ZggZ~0CoY`>f-G}!{-sYOgzyR{J&voV4L0b~U>Dt%#qR;jr zz17sU4Z$rom;&jG9=c00fX-n$N*e85Y?}h94n?hS&C{n*l2e0D43sOnFcvL6=J(k> z5?1JLIOSEOPP?$EzM-O^Pq0bgmldpiPa}z)^thA1txe1W@TrH&^|SbYz^AwdU-7AT zOA5y44ak4+DSg@h2A}%>M^7EdkpllGe5#M;f5WE~JO2$m1vEXszWf_;WVzlx{^aE~ znwu8bYe#V6i+U4c7%`s2+_OisIyibT3bQn14iU2)B(<-{bBZa|Mc0PQF z_Z5TB8`FrRRD}`J{?u|;w9Qizfqk-VR~gA}>xcfWD`o`*b5=JpV9x5j z%OB3ld>YJISv#yb-ImjiZ2(}ynAS-ABCg)>=-7iq?DF_7UpcGvb}(m^H2ca~5y}25 zXVuwdyJqFt7Q^U{8ftdWRNU?9KOrM+S%58cuhCYNA*=1S8}4HU%6%dGSxfpScmV#V zwQeqB@VKAFkr6)Y zxD%(%)hGV^m~BUQ*PbGXg=U1uvN2u8G|c}6a6YkJ;29i1Jsm!( zQ^P1DyLhAR7mp=A&UEiofrf`nJLaN^AM-qy8~s1mL&zF|lbmZ2zMp9DebLmc>Q`zc(~LJX>!I7Nc;kG-l2^zX) zL~=9669$6oR*%%}S+4arYkQE;OKgw=B->#(BS!1v_MiM7bTU``h#gdgdu%4lx1M(K zd@%?Owf)LtsmAf*GWX4MfU^uer-$grCFT1B zNDkYp>5s`RUrIZ~+I{ghFFrl{MJtxLhSUB+u6O+t62R_gXc+(#p+Sj6QMsjNW)Dwn zv+Gg`40usd;Hx6G^Pi^9Cm%RotiL#`v{9zjwAqJHy~lr#QvDyog4Sl8SUqF((1$X| z6`bQ{u`wv%OBU=(fAiev`Q7t!;UJ8&BC$;-ln)qz*uyEa4w-{RI6;W6E zvKA^XNH-FSXyxn)P!~8m!+Xp&CaHVGq{;CLtuyq2ap&YtqOMqepLGUc`f>4{BCvGr zXGl&yTqP+``oAXu{%61n7fT$G0+V)fVETpDRf^65a$h6ODWYv8vSEDv6?KBA7DdZ` zhWqrRy>#h35j!^(^izj7PX^8jlZU?`aGgx7g>qt~^d8xy$N1WhWd``Bzc^^&j+1eO z%pQtold4909uAxxXe*oSsF);p%%>!oDLc0~NRwGp5x#^L@}PEI;=xlCMRcLJinB`p zKp$h;_<{3{i;R+DhxZTUB;U7C{?x~+8f4Swj3Sr;RIUm!C)_H-R9{mAH}tjx;2Biq z+J6+L8vVolp!|G|o+zMA)Ukk2aND+q8dH^ng_x|^cl9CS(-eNPT_}kryP4Wp#%5v@ zoQH8w=JkCkL+?^J!Ybu;i#x)~UP>u2kxjAQ3HQ92x`X7e^Z7Ee= z>@>X=H9IAgJb;m2M}^MN(IvpQT1lQs%@FggU{@eoR%2V>oN6G|+g zC9PuZX+vslv)EbfZ{dNce+IKio;2HW=(Od5qP8*0wP|M16VO?Q+_cSk9fe+1^oZ)_ zP86q*bbVr)94bg%1>y(?JMOz3E)__c`IT(iWfl4zspi9S87b#n>L&a*vS|_OU!@Ps zG7R9`rR&szAMCjKO9>&8*a^LCV0h{59zFQ1>)+}02m8aui}v3N^KDW{1N!xWq}du8 z`q~fcJnIc?5=tjnFnaYG$+gNFSamUrCA|9gJUT(e8se2P)rX2(EW&fHyfzKezhQHj z@!dKK`EwW|bhUC>kJ=~&$?B)vOPs{5*-Yj0vRIv;dWV%Ba@1F5%b#Pl+b>hc%P%+! zPxMCZnVT_!+}Kp3ny#$;KjTINlQCd09YhU!ctz9Vz0&trIo|sUD2~3S2WWiH0(@;> zZfmJk^=^jGf99e6pkrL>5H3~=B>ukW>I*_MNB`PPu&*CPFZB3Uiy}1inL%cpW2Lb4 zk^?GSMonj=aVT51No?bzTB=2yPXnp>59|&!pNz6~@=(DljYZcoPTwsct>6oz-@7^) zfxwb$87)NiS8GHzH`p4{2DU~>k^g0l5cd4G9Mz?dnu(IjWdJ3Irr!G79_x>pv)!D92--h`6QRnTc3ifZU z`#e69dj_xc!$Hd1$;m(y0^?druyBIe6)c?i2zREjp+}>ra`pz!y!m4*pI*|2g9Q4`{+EhX*+)L^CNZ=AzAI4+>f54NQBaz}1}NvxD* z)NIIAeoxHff#w1H13x$_(FApxC#LLPpKYM%S_|G!mYVmHj&??d5lGri4!gt6w>+aa z9|2Q7@`Zga;tPwJbwkxrIkZfWY~~o;9xKx*V@)jc`^I02mRJp!pf;MeAi-;y;oRiO z{uOJ)Zaqz-e_&hT9FTp&A*|}9cnQefQ71+BQo07z&bqD)G%gcJ!3^ztyB0mNLCGq!NI+up<6izYDgpw_rfEQZ>RPpdo1bX>N$&p`3KY zt&91@+m4Z7Y=POm$vfg1g;yFPZB~9*#$XhhvS{&12vzA*AdU1X3?ldwZOdar-1GD@ z?tJA30>A$Bw&yPldrHY6m=A8f+7V7AL|@uB@bB79fFO!I8pijxwRg-cK$6gifsb_` z>7qPe(*wBaJHa1{M$z-#Sim+87CpNYUCiVVN^@U5v1WVUQZ!jUx{*Q-B9Hr|Gua_I zTZ^-`T%~bJ%@|M^O}(|NwQM>`R(LJd6ZlVnJu>{`(z$QzO)9ph^b_u^-edv0S%}*2 zO1{*Absh%0cSp7;p4*{7eEzUe2X-6y;n5Tl^J;b%0h7y?Wr8!p_-JqAct5poZ6%Q1 zDrpY7K zmhY3qbP`ToJM&Qzch_+S+n!Jm@iD7)!E4po*vQ(I;2q3z-nYia0;-K|qi^P6TkFio}luP|b%K>r4_ z2|IB`4OO2nu%GrT<)`0pLIKfG?$#xfaL^bVnaZ?#x%5|7aP3pLWKvTp@s&zP_%Qttpr>dZE57#QPh<&m;_WrXY{asnx&m1dz^SaIGf7HOQ7|r9d)- zSy^UFMa1YkHQDex*f^Z}vPv)Xs`KFQ>{-hv%W}t&LQfdYGzSa|DF*JAi0-scbU3I$ zvTQ>^E)Adb^5v9^S`LZq<9*|fXI1R1j`I|vOR%bAc-o|{Mtel?kZ6J4m{!%v`JC^p z-BBi;Jm^fW(o!o_@bkaG2}gHIY?R{vsc^+BKN;sJ?jwFfPu3z)yX)qeg9=$v@lvrL zqanEr#1n@Y$KuIc>2(uN8cY2yO?K+M$R%?Y_s83D%4A2mQsaM!-EY)z2tHbqv;X`a zsq1deCJ^Es$I5{ByV}~@uO#yS(cR$&`*(MT!OR#j>EGNP<98HOf|!xC^7f)br7^iJ z8Y~pA?hfGpyS$?TXUD6CT(S?cs+9Nm1`jmGhAO&&Q|IYvbU2Xz$zWiSu|D6ge9)0Q zWMG525T4Ri#)(d)Ew1qK=d~G%GaE!QB575(sVF+3gfa3u5Tf;G_9*KvX8F(8SE>I_ zAXy}KS4Z`u_*eUGj-5I#bwtuHo781C_w-S+a7yu80T*c1HXj6_&( z-g3jcgy%)|UatweAZRSh@r$+$M%;lMA9FiZI~tAQJz5seG%@X4+-{_kAjxY);zThm z(FEzg#2&>dV6lg4OKN=&{Yb@~sAF8^Qq|xF(77ZT%q>h9P&_1qxrIR=vO585?XTOZ zTD*5x5YVai=h_?G)}nzs*1=NrWck?N%PaU1Yuur>U1}?ABQc9Dz2R4At}5aPhR+z3 zTKc|f#PWycw}$kswSO0hjm3Uj7wmmYHN(AX)@T4#`*nXThno`8^_e;QR>u$xZC2kN zJb!#_3ub_dUBy6UQ$j+k4$0ZNQ}%=%fCn?w>18krvo_3CN%c(y8~hEn}PaeQ@rRAv6%@sTPh1pi0z@sR$X6(42e zV8sWJe*gdE_;_Gn3EO)*{)gj3%5~Efp7Afo$HO1T$737V@gd|JJx&)xVkgn+fkG%T zJu@sys?CbZM8;|{@8)Q-q6$?UQkS>+^6^?;z{jBFvsN>(j^ji=re7{Ka~lIL#S9Co zIFD6yak>%L9y?m85_n1P$xx$}D9bmWNYbDp=|Np6}6qARp385;{(41;1hurvLiYU}TCUn$y0PjPZLfwP__!_3EX}aH5nOLx}?pyy@m| zl2=0xKi8Wg)GegT{iOOD6k048I%?HUawylRwJXX4eQ^$p9ah?$6HSq4&`lT`Oc=D! zHI1FnL;x2Xq7#3@1N235pBTySYV=bf29Ll;Vwi^W)W^Vy<=_9ys|b|7bq`@CA-? zcxhT-%?GOfAI(QX{LxLHeiW%pnLZ=)bL&4!T4(<#X}Jj1`@0yP5ZRyoYY7YZ-&eE# zU7m1kA!r{WihtbP`KOpAiu@Ra>jOA35gwe>TFKJMWI%^{(V?>@f7i<;a#PCkwrNFr zYZsu~({kITGD%yA_oAtu%A@o`^Yrd5TXUPlZ8;FtdgsOs4$<_06BfO7wkSu(xVv9o zd+I8w{L+G-*M~IdW7i1qvs}@4#zu1yMfSHCYL($C{*FnS@JYmFF9kxc`ZQL zLM^9Ws(U_$_4iRW6VqiR-(db}j8s#Nvp0mY+)AV-=$2VMOhbwcLO4s1=C9vp3C9VW ze`wX_CM!q%xHDV96V!mX8V4FPF(-Nr4@4utFXnLrs# z`2_Y9%9;|~b=j+9nY@0Y|746z64!@aJr@8*SJTek1)#>8n4yjzORcLKZx-^1bdlHn zX-Zw;F8%6@S$k=K*bJnI!pf+v>D2jqQ%d{L)Qy)i2`5=jkk-p0*)N3d(g^_~r9n<3 zKz*HgZjTh>kPJ^!BF*%a|J~kie%!WP;j0;Zg_=aN(f74BrJn;s0gsVu9SJz~)a= zs#mA~Bn8I%6+L)m5N>q1+*Nb&Z?yNT(H$*h=HTNyY_LnQ$RhX=c(5xeQ5x0d1Hr;b zaCkt5Gzz3ZlF4FZX5_|&I;}=_T$2bNj7LU*J$LR5y@@3a`BMH%f#4NAcx4d0njpSX z^fVA@W|s0Bhp^4X`l4PBnumP8`xU`nC=FW+TH1lv$np!9(+WdCQI&+O(NY$PtkX%< zr)bp9*4Q{0c|-ml8!p_i+2kD+8fKQT1b>MWM@^qT5p!{Rn)*`*KRjNuQj$iAe-9 zY6WxNop)jMdq~mXK30n8`I=v1o+^y+sb^DU82)v?rrl)Y%;ndd%g5^5fjR0kgsKG^ z1F9jiq!qM~-`^q*?%tEql7=kx=?s$PK5ZID!e^wSX#RN87)TTjoML&xsNlb!AVvQS z{3D%Q`ER6?*RUOS)>V37XGqtpGi0uWg!V;EY6HUD0_w~RVM9R{vMf9e@Fv{~u{fu9 zf1*G|+%|17G{LL5D=4u$$C5Y}jX-cPS*>g2!*$WdDNde;j^CAjsg1L|5^|(@@N|Oo zGw@^M*x7gVVuEh1Xoqwj$sTU}#G|6CeOsLvJeeGd3Yr3pdiK4s0d-Z)AkARL)mG=T zoW5NA1ffi&`^ne~YX!?IF0psv7F-%};IH_qe+1$>(62~ylY9sJExX&vl;Px}XZr^! zCvdloiQnu!X>@!$+%!=tY0gaehMAGQ3!GO4uhd>k5F>C~T@qY+3Q*HpyXh26 zM?nIqeEh!H7t3yyceSfjpF{u@KxQDZz^+x`UL-KPxEDXH`){igjh)I(_r}LHLdqkA zV7ZCQN35+h&tH4n!|IAW^${+bK!y;0!fikzK+0*eSzFUv91N z6UF%T=0+1AZn+pNjj57f^KXtYMr}$yu-113&NYuuY~O~3)n?Jga9)1L!no1F-jO_> z?}Zd>rAr1MJw0flVy~td@jzhzS@K+t!?NUZX+I3>Ti)G|Wv^A%X49L>@KpX(!-hme zpfK%A!V6=Ol~Ai=eB^`=uFg1DhHL*>NdPlNY?)4XC!{T^aq6UtzEi#b#ELmZ3PjyM zx)c9eolr}}(w`w2fBvNZ4y{mq1%iV;)}1X;P&1uURA1Xmn(=%gCrvDvWvrwL4{dMoYa zpJPlnUm~9jA`>$z@YiNv8xHu?)W!2fd5qhy;Q@jA&P^_#FQ)~T(&ODki*0SIjf@#? zLgJMj;!)F8tq|>AE>F&c?b4oJF9RD(WpYm#@QaY-7j0fcl8mMN@jN;=FMo=eq{}e3 zDrFw-f{8(55Vx)BCi#_~zJo&MNF0u$XWzapb<{>l%|J~x+h#J6$>Cd}_Tds@4q+Rw z#Nm;lv+(f?cgt=Y39jQ1$$JIk`zkneDW{mx5wBevk@=K8s;bat^uGKRP7~cnX5=V& zV5Y+Fhjjqn5+gUw^9U_LGnHlKqrL1MV|$S|50Z`Y;^1DKEBfLLdR1$b?QVno8&duG zvQoO*#*}s3&zyR0@ONY-ZZ?Ly7*pCgJPNXIM&apb z3RG;?HJA`AI{E_j8mz${Py0wl13?4XHIATe8?taOx*DvR!n*l{Wt!;0QPsE zQc0Pj$ckl6s!t$*2x!H6Rccmn;dkq_+)Cm<;m3FKDQ1Fi>A1SKjG^Pt&n3 zq_-~x_V;iAhux-0mz$a3aj-5PZY*Gjg)(tGdI-0+HvQvE(XOsB?vu7sBaVzIAoSiV z*P{H6R|}$%NdZt=8(5qH|EGFGQ}4g6H(1%Y&!i^D(mewM2i-57RBoXty(~Q$1_Z!sR1n2YP0n|NTzXe>AtWhF_9h>@Hr$Q>i|PFUH;+LatD~ z?NH8izICqMGQrlB2kTX|&gdU7!VFi(Eb(0m#4#q>ViQ)U}wi{M}M*3oX zJTTE(bK6_Kl{BgAZd4A{ODXrQ%w5aa)UnN3BynR@J$VxU@9hSSCXC6n#RX+5ANhpT zhO)il3LkCg4d9wh@+G51u;|QLbVJ*v3J_XQVb5A~McwDXu%`Cp489=8Mbrw>!`%O~ znzIikKcR?`^Q~Ye>Pu{^jh+3X=EBR4&sev0s>|=#i1fv`G)@flI{cssx7@w*7V8+9u(xFn-} zMcj3*1XXzbry>#jS4E<%rJ#JVZltUUmj~-5`te|%Q|mQ>;9U%Tdo0)5IhHiC^-3^w zQqHKtFkZbO1{tX?h2fR2!z-s9qhg~Xn?$2^P&@>a$ZEYN5Lm%rwJ2_}?rH_~gfI8b zR^Zm$BN>l&#X=RZcmte3q)3oVq=OTP3~&NrLe?W-4K_Cv*TeR_CJ?1a7U8L`WE~eA zodA^nSAt=PCcv4-n7k~+Q%@5=a~bDQiSPqCyY4Dpz%2x5I?EMB!8^*o3#br4LTb%p zi->mWQsVG)z?m1mL1UjaiyIppK$KimX4b19?aN`y=sHGaQ}vDB5_Ir;9VErylb zE5HB=1{kQyw>(hw0hX9VO(e$BFC(p$8u3Flq!L%T%p6&>2bE& z{_c|G_`-0YkmDZhr>R_QrEGqP=&293S^@Sc zis^9l7>&Je`5;!TB!aZ$>wfrdHxa6~CUUXC0{jgPLor-cw=XH)huA%vQci3PLUR1G_ zsw6HSb&_`VLUP;26@Gz%EZd-N&vEs*S$kqZIbA_SkNZY?k=`yfVK3kAJ9W8O0F3`~ z&s3$5Df_(ZF^mvRkTlAvgE{Q~sF@rssuRg}1V#{OzP=BqYW6KIsTq6A!iYsD(2O9{ za7&WRD>~0LD&)JJ8IQ?M^+3s^L`f+MZLtM5dI`)vLJ8=tk`hajnr@J?uL}w+J)ViZ z@&{2?+xY2^(&GaogJQr(^vy7qh)3T@(N_TBAj+_5HxK-V-?G0U3GYbP$R^jUyKLLO z+zw7tH-8NrZoXKsfYhl07GOGavqwmF-)1*YC)N!k@K%Sxn(keUo&WQqGS6ju{4cf@ zs~(A~=A8T-xz_IbD#J>O2fZHiPsfM%B(uOPX%A1Oiv-p-{R!Cbv+vzF_6WgjfQ3Re zE<>w9Eb2pJ#P`Gs`sVVM0 zq#68YSz|gTZp+x43X5SW%%5bj?XuqAV*(P!v!dV(P+m&~VG-G|7>J2yn}mLeO*yKD z{-94Z0A?gK3iTwhCb{C5Ku`q@;0GM@bTR*v1jvXM@RlClD?AZU-F);ct^e^eAr9KE zW4HmVr$`l9I`T1NUo^&x4+N5^%Je|LE+~%{KnYm{`b7&MVrcl0n`vZ!sWH2B^m+!u z!_k@Qxs{!S4IpDZ%+R9(MBFOfufS&yA!n`%LZ<^bLb8AY=m0p7b|4TPARMYJ2}Dj0 zAcflZ1+B^g2%#CC{6I$Z07ghh&}Vvp49XJt&g4SbfI|Mp02#DK51>X~fiRg=k8xps z(4YcgG5{ix%&RT3?#pFjSZG1{3;=1taz%u6GNeW@$h;hSPD%T*vLkD@tSM_m^9m-u z<{s|)(yx120=$XTxGWN-DQ84)bv~!~p!znUEk*Hu62!m=aDX;^L_qTPLn%UD!y|_4B&N)ZFBFChMjIKtxhwbeH*weiS$+xVEv3`1aRg9WfyYng zTJZQ;X7FXXVCoQ7&o&qXNu_N7i3`)0TALxUVb0{4netLxX}km--BG|e>gk(Z(idxu51u~NF6w@vN;LGdpWPgAlxpCDw^!dZn!_%fERrzv zDxs{jbbzzzX;bA}+b;IfsO-wqow_fo{npQlyG6qHElg-QAn^3*4msQwhvU(!N4&Ke z@MroY@fwMm?!T_U@Mi)P8p37L7LvzNGN31v{BU*;tJOrh=JpvbtFC&FSNI*N@B^)i zTAW1&WWTQVEIw&)2{f2}-L2DmN#M^>0M%zWkaswbZrJKp38f9-^%oLXG0vmlMi zGjeHD3#FYhfCf7PQ=mAse~0csVM#Ri`dp#wh_3`0EVk;Mo&t8u*>G z7}*zLHTVfMtJT7snvD+?e*E*!XCx(wG5f|mS#0&L$!79A|0hBndFUE1cz5ODf0)>h zCg#q8e+kgu>|;m4Gbxt=TLZy|W|(<_z4KIm+g*LpUj00C$lF*3acft1REO6>ZTaTz zwmTCUwWL}pZ3Hj-SVdXF_$?B$2|a)0xvHfETpaABo%^6#-m5gw(l6))6J&z{pk^zR zB2smIOSY)H>Id{iBHlnxWU3e*+;NuU>S@;XtbRZfW?(0Q{A!oY%mEB;V+M$5xlnJ`v4^n4<>*NNMk(hfwCx!n6(fF;d^y} z`TIVwd2glRJfqEik*|4QcUAt8`@Gz8R)2ubYH8b+$hm>#3Q1g#5A?b%LinOBhfy)b z?W*r5<3wuM5=koJ)b#3s59btui8{pcqBSspm7!2T4-DzkEBP4El_Gt!oCZQpGQ9{| z{m}7ounZV8SZVPQ(^J|b^3c)?$&o240Q(|$%T2T7H!k)pG>UB<{Wo&^i2#_LWJ`MW2T)SgiR}qSmzi}t{qUWN%4lba4uQuDukPbhu(UW3nNuh`&DQb z0ls57@O;o=Dsi_aUCJyeA?(Mz@zwVi%rCEn>rt6_|E}MZm2AJv+T;Fbz?l_fMCD+a z0s2D^xE3oGb9FuVs}~M$@gbR9dd<~NzB1M`kWGm-f36Sv!7|CD zy!(YYEN$z~)}t&{CGiV-iK1&p1dDH7D=3iJXR)>KbH|T_s%a`|Ug>v3-p z>LVZDqnk?Bdwj%#X^2UEjG0(o4!db*{RyNI5i#)_@^~hZX=Z!6R+)6je6P4)-_PYs zf0whu3E;5M7MeAa;ebBZGv|Ucr|Yc&FMKl83CWWVuS=^Y#9Ue`80B+M4=E_u*1gTP zVayi=9xjuC?`4M)55KGm#K*zB`Sz72`OB&P1@ftF01yP+q9BDl17&VeutKJSR4f5l zpy6o>4M=zp?=}S+WIf1co1zmEww`&1VgM2;vZZ2hyE4w-$fs_P0ud5&wH|4o!UPi1 z2xNCa!4Fwb|Kor{3KB92baqHl1Zhy8c0?fu2{{bfJ*N0TWFWm83l1QL;wA>Go;YS^ zEmre1KBETII6QWN6jmr$d3%V10Y8dCSt$n)8U`NDbS+7GGmYeVLn0c;L@#pWczyiY zYtOsYtpe)$Wsxh3upE}+GkXLMZnhw0RscR!Hah4dD?kYH1Ly}UfE9=p$(_k>djWYZ zXxGb%O{b!a07P#hlY-k2Z``s>GDsls?eK4VlCE_qPIKr{LP@BXpm2lb+L72Z;rJzn z>u1kX#vX^D29(SoLO0Czx;J&pjwMK|csak1oHb|12BQMRJei|9lL@6)ZH#IN0!AKo zy1%jUJGi{AAqQF>6mw-{V{MselSswpF-Ef7{z2DlB+TkX%zJo+f`+$MJ{N{ z9)u!bN34c3zPO(S+4(z2X5~u*WyE z1!JNZqVrITyFSeIW@;_PU)zVue+Z}k9wX|S3Lu<)26~|YutA-r zf!+ZCK&V+=5Yq+)BWMKx;Iso*;lVw4WH@i|DRa>s&l`dB`GL5MbhfFgceL+q5ssXLDJ|2r)(MMP}^FdISS_bY82To#{^GK1Dhn0kh zjLm(%7P-u5vP+lURE~~$mV~YGfzP`OL@o&+1s-vE451LqDyn!74!P^vM=_H6xrdAt zeXuzgBVEyEWXGc$Dv$p0!Ukm9X6c=J`F8&@r26vpc4e!sS|IaCF^D}f8Z&S@VubxH zuO0TMoG9M-(eH@fRdpF1txi7#iVnSTwcz^TLaPu1MAau&x)CEoE`dg49sDm7pHcEZ z9s?tD*Ccu3Svkss!jp8!=lPQ*uHM=H)Sjfi@A;MWx-^yx0xylD)lP~jFsQX_%D?;K z92JwUw4G0FG)YkWzFTd+=s3&3bti?kGV@!Oxu>nmnTs*uH$2#g+r5-H7-I5!MugIr z(({wrJ3j7uFfvd2nnp>fu;IOV0kZ`@wmml$_?}`o zG41Q>VM1ID>VLV25JR&){ke<)7&e~WU*I;i5*TQzzr3WjCOU^`Xk;8w2<4wDhmh4WH%3%TasayW08kUuBQ2cj?_LQW z!yUvQpJ!~pG4W~4U6d@32621>u)=x>NxOXkS$_f$L(+r7J^{2KkwGh;0OXLyAV^O@ z0KUkV;G}8!d%g1G%LmWC1gqHQA3duJ0i&Q4Pk;?!t1Kb;k4J2%l`{x|e(9XRq69y` z#&InJmwFJX7eEIR4dm$sU|<%NAV*A`kLWTbhit!vpfL<~jY$)stzcw19DBLdfV($Y(*ywt#e~c0SOF zEr68q0mB39b*VG{1wOr{O62m_K$O3Xll1*ZzC9(D{K33IR_qS6>kgXkn3N2lvxTMdqDbEX)wxa6X0+eM3pa!#O1`r zCv|<_r?rl9bNJB+Jp=_46s?=##N4$akcW$g&O2@t>n_;rv-5*JH+*)Q!hGWMTP`H` z0EJ(3#KAD`liF6VRuw!;a=T&Nf~OI(cgzDRNNe|^#2PxwvPEY~2ey@?yiiET2!UIy zi{W;d4dczKooBQg>YE>t?0r13;|>nR^3CO-=VJ;%AmH#SewV#NH@my%`ND%dTXz%kP%i#5-woz&TNRy2ZW+ML_Z3E64MabN9y*rhXg4ab zE>(5K;OH$`5KN1mtou9{iQ|DDlUrsO_^}LH-EDaw?^O5LawpV>9a@9Q_K_t-|LsX| z=mYq{2KGYPsgd5#0dFkrjZT4O%XEMm3H}j!7TbdOsAnai4kOoVb8tFp2dhU0Ccz9= zEP+#FuJruTv2&{N=dLYLIipWf-U*9d688L#SrCj~; zJ>C_8?|sl6&9&abWBPRgjy>(u4|PH^=#}5VI?e}e#;2yc^mlIA$Alj`o+q%gWG)qL z3C1GsVo-l=qb~Y@AE8p&P$Xrsu{%kFnfv2AZk6rtlFdP8?~Pcq9E4Sm7U_5N&ai?u znc}4l0)}~2n((8m;zBZsVh&I!JEx4|_27fG3NxOy4R%f8Xb#(3+Sc9XQNXr!SNIX& zj>}AqnN2IpAU4$KtU+oLH|+b0H*A8V*2VX2&}Ib^e&|&>9a*Fu6v7$C4d_wIm?HUy zG+X(TNt5M?<$s0uN+tp9y45?IywI!l^L2}crzt*?nAt%0$;3g?ij1an# z=pTo)zvR;62t;tl>gSo1zFvoM!SiI^y=g<62eF+|P`w)wa?aWezgUW1oE7V!5!{AI*oq?qzk$g1hn$9NE*A2kDPfyo0eKWuFH~aIAz4B5?QT?$(Hj1O=AMsAP+(CSO9;> z9Z)zHzyvM$wMy3hp+XD)a0UNRxL$z+@D37qcEq40SVlzsJdP(O@GBiHrmwEz0UwMw z9VkwKgUKFu?8UPY(lCjF8$C<=Gc1Qo(cI={v=d-_z)M-6KQgol$@No0L_r>GAIyrB z!l^G|a>)vX)YT8ObiY}FiEp4geKp4MmH~&aXatFi_+N0=M!Zx9!n7lo>VKId52G-5 zor5}E65=?bPvS?h5_2vNzt}$$L~y7%YX(-!iB0f*(9AGX>~tAs`B@G7JPs;>1-yms zzU%`H!U6#3(GQDH(D6nxWobi-&komLKn%D55LCMcs2dm10clhpiU$~ngzTx;CIEnk zU9@@=LVzhGP!DEEOJoe%p3HU3}6CD3IdV= z!hqm&;mQXsXhR{s^E(P9i?>6B2d2cu%3&BBnEPRfn@C0M~7`U9G?5FXoAan|Jf7TA@Aypq61+x_aw8kqD4yRs}^Wm&|RFkx-o zSuSY-ufK0j<|v9T8M?Nr^DO!BZD1z!8v>gQv-aeemi65!ZZ8o1AG@Rw*SOHafPj1y zj$)RNmBTE})R%=4W8(vWn&1b%pMmU=%?YooB&6F~&`=NnpRNn3xXpC#Sq5TS2xhm~ z2y{Awx1{jW`xSWYwm37dF$-02+#U}v+`J8X6AXBZG#2nkC7JZ;j9v`nBn}|LS+0j2 zV0jG+EFdiyW<_$VPC*t5c-yjHA0>Dbg;>o0hQKKlv$DhMrzJeQdUlynl7C|fFPIu3O zxfGloR7A(!@+tMg2IL?C5Cek#oZ!q3_W&Ez3OO`OA1=VomhVlMCRgTRgKT2IE%~Om8b>K;&3jOLZ~kELb47zz09IiHOse8%FYhlQ z)JOIT-n*yrTZE!g6%@9bTktd0OD3TSH;Y+nRMfid#+I`uSw~}U&-QvlnmC)v+kd`+ z>h^}rm~VxUeLTTj(a9KfFX$lXd5_q!FR_z+J7I*enwO=w?;b1t->q0`f&a~p<=?GX z(#-#t70WW~S!^5ny2`PSqd;BAavua?vXMuEP~_2{vD@RBhmx;#h0i4_^HUBQ#qzT6 zr-hx%6NW8leTzu6NmZ;=w!!DaJyd~eIp|3}(eMpfPa z>$=hW^Iv4Bs#Y z4CReO^uE8>eSLP)%)+;o{7QWWa+dl&lp%Y}Cd!NSsBgAwu^HG{5vFwDW+es{*!sl! zWaW@%T4%eSkINRMCe&hQ7-A>P!qlDtcQ>=_{9v+JPhw;8VyjPMiB8GM9Y`NNsTO46 z+Fx?JL@E0f>{{&57K-{IpLI(;iu6L7ARrQShozMxim-cm=Pe8OGsv+t2oGXK2MU2H zhy0)eb-@HS01pupFfi;5z^ec%42)9)Q2PU!z7lfG3=)KyZUFjtX_$X|cNjJZIU8sW zteZ{B!>F~&s{VlMtnAn+m?f{hV$ZHrTDjOQLqNw}-!Swn-nHky`f8xAmZ{HV_d+A1 ze*@Y9EdX`(67Y{*zDS@xzd+DJ>Guv72OqO{Cr|GV5cbNh>z*Sv{j&5978y_Ded67h z{xVZ*g6lG3Kk?G*Er`1{5WGT)Gx_9u${et_$l`a2IwyR%svr7%OcDS_4Dq=V7#}9d zGD@))+F>?jd6nXq#x}Yb$vKYiQ6yiZM2Q0IEwU88hVYcw%~^0Wk@-j0Oc>8Z*t)TmFVI2|BseKNjqWOvLYSx~wQQy?fOJTAyt&AZVkBty~f|QHqZ1G$q$-vKQ!3=T( z{7Qma5xDT@mpYp`uxofFMWWgScTrs^KiMIRm>_YH+ndi@7tFNp{>&Wyt%{fbQx(hL z+|u{{Qx(UE{;7&l?aco)#V!y%EYJ(iLsnYWRPC{?BOn{rnFG-v8Zx zMKAsOulN7PX9Y&4HVQjuG+4yArr36juqk&T7@O>a6nnj;Cy2O3Er2UAP4 zUC{tranTc6e?nOfaEm^h)t7yH@h|e7omQoRMAR?IWKVEoPLSc8<*D>B&b@O0fFbPM z?0X7cpS1_V&n86OfgAjrmy{x%$-E3?lG8CXot8O_6O#1kp+9zD{9>Rg1Gb$f4f5fL z7a`RC%D~1{6oz!wbnGiHxBof+2(nP%yBC_C`iO*ru;t3&t@vKHPT*L~W}VQ>2?3P7 z!zi{9KLeKi7F2CAx;)H-J-nMBi)D@J4y<46v$QnuQ4d_P~la;!G7LUsGH}NxWYui$Ls+0+zUP8;;(-Y1^YeGj-`tx^w}ytMiyF!DPWd}xjgsakQZNcEc!lr9 zQUu;VkMB@{goT1YpoCZashRgHhXjl|x>{QcZ0lUmUL+4FNVeCyV9BT298V#W1E3e+ z>nyifx%bcSTJk!W?^@PBBCJ91ds^p_h9c41)DEg0dC5P650F6wiKQ8Atk&vMw_^71cHV39eR^h=cGCYL z*t>24CSP4wet2|YL%2-uJRbfz@#xsI)eOk%*Y8-GaGR!SWBU%5Q>jS z#YvGldR4DvFD#8}X2a}idkguWqaY$b@TsOee$&&Bj}N?n(7qi@sNoKkPk7-W2c|Vl zKu-P`cQm!%k&_2MvV6Q%gD||GdvvBh=3LB;BE+Kby1FD%o`tEpxQARi{8LToSUpXC z0*>$Hr51&*o3SnUfJf@lwY{)KIptyXnzaNoGdFN*sDlC3>C;J777jD6~u@EjqWoO)~Eu%Zh%a!H&o-3uo`YNjJj9>*d}A0asW*1SiQ!hc;u(+$jdn4DO^2PHN@>L3jYNCV5M4Y9<@viD}d)h$!e~&04rfg zh3bUtS?BvGZl+?Uy&VXN?^hm=cer}Q7c@St)k69tlZ#lJj5DX##QHir7>31g8^pp zS>;=dewf}=G)FuN5IyJdA;u0{fR$5d#aN;gWKM zBYD)aH_oZ7oXy|?+C~k$$}hBKEqIVOcZIj)VI!BI&sM#mZtO9_%7l_hkZkJt!qU># z_qs~A32t63E_a@hz?I7Yv%#}_c~OV<+C9|osPV1g(uUmod1}}GxisDYvSQxhyT{kf#{q%C$`?FXK zesmipGL4J4?^iGJJj%?>ea1b)OE*#B{Fqn)k^P&{$M8oTj`zOSp~VEnhq!*~1g| znivE#qe)d}v?71N4K1iF1ZMJP0_8u-zQ2@3oa`x-pVFC@qvzF{T35m&+2a+vQ1A@9 zfxs`C*gC}oDpH$U!pu%m`8G1Wplk7{yWSL5l#4>4$k`uc#l%)!)>^OX!VBiz?`� zhf?kv4V*#%<({qfI{#bEHPgmJQHiPr zf|XAMg3DMMa0U~UQg$?KAa_(8Nfk}00_7e_iHPc|D$td@Wfp3)EteLivi*9J7Q+C9 zv;#y=eI37^{>jXTOAesfr`Spc(aA7X?8;b7UcaY(>y)27dRhqyivhaY^mn)^c-KE> z4N(#W-G?{ZniBUcWmBWxqgLLIL#ARt^f1YgyBN@O>@>x2io+<`FD{u>hV!P&VP{_< zLa{(OVhz!Y1<_Cr|IiAV$#M=!n!`)aYXwe~l&wX^WW9(j;exU{*@=+MSfHwXqSCiF zp_eGW6;`5!nEsZxPi7Z`;|QC41%ep|FiY5wfH)97nED!KY^OLjM>__?^s40gID;g6 zo?Phtqqn%gfiG*6_z^hOD0jTJ5ZyoP)Jn}7??SOH@6N*4XbBm;a+R-Nirc?oiw97= zS&xx!2uXLem2>|1DZQE`RH(hm8>#JG{*>?rM>Y^p zyzQui>rA8f7kP-HI1!}$~KLncS4*1?NYi9rCk={+`IwW z#ceBK@(PwXU-%+}pftY890X;p+dM_o;$Bk9X;aeZX>1*0*x66|Up^-N+mK-IP0^;%E2El#>4E`az5=@%ZagQGy0KM!c*&kJnBF$faPV81KkP@f5 z7vBveC5n2sm6EMjuWNOI0C#r<`r2OZ+>R&8A^ROWdP19Q0xEQtK z1Kw?rm}l_*UhG$-V3B;MuE${r5)}|eL`3ZQALIwKek!1u&2-M-}q zLgnD3)T7+#P9WUDAx_bTO7S~fT(u8fiyww!@>*vWG9V#TAU+y$!KoAi0D#6IXk0PQ zmOy$5Z;AFM|Ga4_LFu$YdyKcE@bL{KKmvFczn}uKF}tfKmZNiEnI*icD$K2%I$L9n z`b9a*xu-XR{Jv}hZO;&04GvC;$VS_E2J%A!_&Z<+L6rp26aME7b?4}Rc|*MhLq1W1 zs3CTeARd@Mr4ft)q#yVVF#oTe5L)g3wG%@BZ=DdtKNw_2^*?)?|E;!xz=Z(swpj}h z-VhLH_SqU4}bCl3yRNj@Q<ZP7G7-w| zMrL;#p_HPEo5vcEYi$rUawUz9vK71W2xMZ5+8T{=yH`Zj=*@1lek>$W2l#_9K(O~@ zySO9wc>f0pMdSdG&>wkokSQGy2ZA6)L9-kLSr>RTOoq_u0*{6W5P*F6g!oXd<8k)@ zS>B;0g~;iF42X?rqvJIFPy>!VpO9M=sEKRIiFPdQmR2-6w#=j4ynhvnz6~ zP8)b<>89sumFQv)ZA$Oh&h)ACui*<+-z*;cCl^tCkpiVT*86y0=?~7=rENSBI{4}G zU|Lx#tH-E>UA75#IPQMfC)=*@!Tx&s^!Cs#3&JPV#xm|XrqiX{$nwB#m{vz%nZwuEW zDOLXxCZLDz#unoDDtcMxcM_>t6w}XzW_*jb(bLJooZ_w5kLPUlOYe=~qd7|J$#*s~ z*g^GX|2vD4zNXhir8g?36^Y&jkzkAQkm!Dx+==%pZhVE;(ST+%7E(6N^?kpX`B_vw z!35!t+?`h4=n*m!n0d~?{oeENKo(fJ8d$2qG$v~gUAxHb_wx&;x}OBTpYXJdL89LR zSo)*rySc@s`tr}e#(#?A6czFB*qQCD^DD1wJB-Ubm~YCNTfwKu=5DE1uZB4<2Q$g#Jec+hp~IOpTgy&DnH9H_>vwq>Ch(vj*l19 zG6@tq>>qPp85Xx70(wqvgk5Z3%mZ{+6F+c{Ay5zTQJ9EM$piHe7DDm~y(yaWrnwJO z!~IB24`)6*(L}?}%w7G^t@eEnrLO|bl(vbvvJ-)EJ`2q`TDMVlfK=lha|BAj32NQ+ z&exCMfB&#Purq>;s-nY4U9Wn!nM+RNyl<*mS+0qjgeL(zmZ zl$|ly^FNlO`17b8Zs}s9FQZ z3`zJ)ZY9SqDS-*_?PU;fxp7MKC7dml6aM%Fbn3s(DW8*4L;58c||7} z$!{9x;lr3;N@ZnY!U(s#KdjGkK3sva%!K9o`5akktsOn?t+bqh^GmpS1(*)3Zqr_> z%!qGmIp1}355K*BgBTv?j<)-eVKJCzh2zZwjsI&h;HWXXg6AGuMIm^LsqtsM{lQ_g zU4Y@WG2?yqveQR!QO+^1^|!c_fX~cNeW#n2OigsAq35%RbEaQkUu~OQFjLm$7*>kj*0O{eB9O37`1=6q0%3qQ<5h6U`L(KI*H4 zvHgH~BwJ4K#R{=riOKeQe3EbVn#E|aC^CzPHcZj4cIxb@R zmQrxul2~FbSEv!kPcTlZHeVAFQ{Ix|!#@J8R*w)XTn1TycFWm-1%Zidk@2bi5t!O0 zJ;>Ev8p*1I9skl7AsqupE$m4B!kD%ZMG}ce!@=`ZWQXr5xc1*xi?5TNB05&Y|DRS% zmpX!jVFWbW6~G0wTIT-@U}n?&)Kn{NI=SJ|+Wr~9m_r9JfRPi}z@Q`kcgQRv8GPhXu@qH{Xde^skw0B5m@TPgFopS-CVtAYXj&L_2 z8aX4Y3;74{j&!3I&(WmEw-QQH!K!lK$Zq)(BN#-N6Hn2eC+c zs2TfF5)hLpm9ygqx3A_mHG7#lvS&}7ZCqC|13XDF^Okep6Ouc{1^g-t^oN5p zBfIL32ro)T=!adQXFc&HPX?E*uCsN?Mzk%^AM);vIAl-$yv9FqAd`VU z3tGO<+ChPWQ`0XUqv~Hz5t(mFj-*+!&WN>;{}`coPdr@T$-!1WT!QVe@#P(v>GMqs z=hM9@XF9E0DZ zDAm}{Jvt!6_?urPm+yhXFDxCN{47DcY(EbxQksRhx}U==!sF{gp#`^do}(-k5l@5(!f*+F?Mwx7b3ePl4|I z9gEqp1>zjV#hUT)(LuIaW|_>*V`f>+Lv*N1`4jE|v4Us{>R1IzD5bM!d5If5jT;io zGc6WI$y~hYV$^)5sFLR;T{3FH1*)62M)hIA@b`ys8J<|2FPvd>#f*&RP47?B7048!|@Uw)b&8T_|OZvq<8D%Z? zA*1F93&Y;USCts5$kdVm-RfE*z~_&8)~B@Gi0=kZY)T*dU3>@p6&on5XhHJ2C^qqL z!rtqYa2Te2wLq5GEuQNp&NKN%gFZFthbupq~q4 z5*^6cutq#P$Rd50;S^HLCi=2UNk_*EDLn0r_TbE&;Nr9f(fUuXr*G`geh%&Rl3T-- z4PE#1G_J!w(Rdrhe{tP`_Iet>d%eLZ4y}l;p-YM*zvf7F$x`F)NL{e&D8PjwqL*JD z_5(I>@N@QI6Pj2N|*t8T8v8=H;%XfP?sirsym zQfSy= zVWaB&S51dIA1BE` zq1a%$#Ohk`xb8iDnP-KF^$`O_P-7Qu)4ntOBon3Yeee?B|GIuuAa3 zi}xgOxbJ=$1@e>{QnO6!>78~(57gSv4lNSEHxzz3+Lera<`|;2k!Uk2c4?eQij-|+ zMIT2i38_z}0jZ!7!F@}mHa&ihH0Y`Ol4wc$Lq?>fWcZ$*oHdcDI`&|8rmBEAt~2lZ zn`ZQ6In^1n0C62tH}TB!MHFh=%hSWX?%!F-q-1yKy)wBTq`QzthhvQCt>;>VgrM8% z{BrMOXKv}KL28yVM({Xe-K71(GQ9qlaL6?4S2wYM=;Q{RG<|D`LJ};}ij9R7(lV75Xr9 zHEdtOjMS{>E;n!drW~`Nlw)DipiuEi$}ffk3xPJpc=;MLY`ulL0M~)5vS7B{s0z6r zPM9~SraG$p6;Xg5a;`~8>4||R!}HccRi`?z2s*Y*yalb8KNcum?Nq zgXFE5GlNGex%{tp=%%ryEqMd*U9kl?z;%g47b8>B^x2eS#-B_nIu14e6Pa0fIu z{#YxA=0?|EFYe4qSLx~71V!uO-Zu*j+3d_EWAiOB24m~!Rww9IeR5>`X%lYA&Tzw3 zB}LXvm}ZOR)-muZ-bqmyQz-Jka4}-{0yP}H8P+2{S?IB&MW4Hr1UkF*Mn79UTVtR>~;qAx$E3gCDeOD5zsj(0ty~E>+~3`Kc{mv-3W5r zY^7-l^+`T>vg0-*qgpBz`uyGW&v#?dI&Yp;h=W@w(=V&>$0)B?6e}kP^rjKT#yx9` zYf+mEjnsVWjo2N6LikQf%_)gHznvi-kk)Wn#~cGqWJf6{8PG%;`>Tk&OW)aIRjC}} z$~sSW!mp4QRRTk-epsejNB-3KxIh;N?+e8jrbF7GS=d&S_bvg*!fxV8$3eBCQ_w6d z^rYJJL86KVQ&YQyZ+pC%F<>Qvx%iK}V;yNXl}ZgA!h;=}#jM2g+$4-B4)>o%_Z z6o597wd)P;FwqNfUO*F>32h?JVDF^g?IN&igFO1BpR@z`!se}_+<(yv?+)!Fw-a@N zENmXOEj>1 z#uoz>e4P&|FUCXC@_$7i#@{wF)1|HakR;2zq0LIZjKEtkX0q*e$(f6NK~g5ud@DST z({tl2R}}f3(Ee)ySKmPB2cA*=;sAHy#Z*y5o)r54^H=&1E!w5N_tyel1B09E(;v4K zOBg7M?T>xq_IWSG72zHUYgHTYcm+**fbq|{|PW$>&1$)!%Jzzsd0t%j0^x>c_EjPt|1pnBhiXGHCq0NV@7Lo zCXEOl;diG&cZFEnUpNJ=WNM8 ziJke_S6sOcL*{2j0D30NITgIFEaDJ#vjeB<7x7xTaCz$K&SeCjT<<}_nsW_B`mm%K z?SSU~`$GD9qS+79$D%M|-FNR;FsornRHaPN9++#>wWg4jwu&%sVvttF#fg(OlP@-g zquY~2K&%WK9zYY9*T57vAcnyD;G%^ z0J?If(%|!lTzN6bQ%ORt-R#c3MQE-6Lg8UK&MdZBaQ~>dCI84TDL7M|ah4~=j|DHo z5C=ni^F&|k09ke)1D3o*S3N|6xlj#HT8mK2R5LghoQEoxJEBaAg@$sofb`;&+QMlQ z9=Pz(TGf5C!I!#O%3cwL%FQ%UES3-J+X$=0)Z0uv8=J{&8eM%8D~WNmS|iQL;i8Md z^C|ZzCG?&WCe1+mRzS)O6N`3&H76*^P_Q&e`mA~g6H7(^+`;JY54&x- z6$O1bV10b#IF=sN=@@-?$SZbAVAO<$|LpVQ4U+a%LEHgybCh?CVosWFV>!_8Tv(-q*qj&VPNxYDa>yDVB6iWL?6?J z>rL3Yt!rQM*_p;`#bffq$!y-8d0BLXr6G6G3Z{O)H%3eJB)F)4t(-zWk;uFRH#qq~ zbm_sB;A4n(M+ian<8IpIjvhL({=q^l6kIVPO$9uP0JuUIorwjXP?yub-3nX-(JAtN zL6+bCBh>oy>13Y_$*&i@?Q=KLYlIDtsrj9j$hNy9jfQ^Oj_~iKI(EI|gE_+n4apY4 zuOb=0Ka9Ng3JJMow4E%|-TQcPwz$1l=0qD-j}0#PdjvMm88Vm;T(uJ5K838z&NoQ>tr`3Z(Y zu%~Mi#yGnQXc9yPb6o=&Hs2tgx{)v?<`nnBzOU%o4-_z{!;zZW-&mLq{XNtBqB)t2 zlqpn`GC-rFm8rFU0x%@*`<>M-kq-fqP=-V}lN2>u1Im!J01U}HC_{4K4@<)ANYDKr zgruULBmqE3!U2S2;C~<_)Ep3$Mj-F9cN$FKzC(GxyZQEB$n>QieESBB@Yf{8JjjA& zBEuX}rKOMb3-fUA1jSozD~Hh^a33stC0pG3O`ZE4Qib?DINKB%6TMW|SbwR_4!U}$ zQYTyV($v)0!R^KU&_gqnATmr0vxJ?;?W)Leenn&;wpZ!m1?UWmRZTpVa#vqt`V!N` zP!G!cKOqp2auxv2A;>M#aDff*6+F%8WJln`fhZe#*1M^C#3`Kgcum|zuH*4C9wmrE zj@}Bkif*U1>jiH)>&hwNtxi+hSlq0}7^WX|Citz};P*^0;@n0ce=n-=oHlh#HFBXw zO~hDRGqc)*tRbV9WMq|OBq~v0h9~!cX$vvMR7+*tnX2cr!8iZ|W?e84krm)1Ju;G# zPa_n4zfkSL(-^EV!YAI@(L~tVk02o7X=)*e;j#OcFVo1WTr`$O$|R#*?mQor&tU|8 zQg!k44qd#N?0WShzx3#k^qP>%@t2!dd29c>?Fm2g4^8E8VMYAo=9Q#YD7#tKOd7mS zkp20q7ICHF6|k0h_>XGVI%5&sh;)KkW*H@Eyv9gPGvXhw7gs(2&l&1GT#hgqA zphW+uIFqEYKXpeBI;_AUNYhH)3OG)%-%xPTd}4Nbm#%ue^ZBf42=fRK#E{zoy!}uKAc)bAe{^_d_z!OX>DBl-_tR%?E1$f+ zSRqlXZ>HY-v`?EYX(tdj?<)D&-`lu799FLT_Su^3!9HVgpMaPa;E6$X+%ofYV9*9U zF=hcLb#dUtjrUbf9oKFa$Kf+j%e6 z^2R09QKZwaAel6T8idNUrqYGKInaNj2^~9zTS^;q<~WXjy0lL|FTV*Fze|xVDDUjc zSY>OM)|1^P2x$W_ey2+vTqwr>x@f#qp-pBDDvOzGWdo<@5(BoFFQ-0V(o%fNWB+4| zsfXHPDs~W9wM56H45@{eA7C#K0_+7%HQ8EGD({p#RIBO5&XF8`ibSG} z*^C*f&ZGOUSOWHfK|54#H6L}Ty+G*ai0#kc_JXH{C%lCb`3#k=Jl0Tq0ockzNNbit zf7NHL;YQ#;`U2Jb2@7iOFsQx&597Z-m^LPSi}}3yvIA}tSe7|Ds^muhUY1SVsyhr8 z-KdtDq_3!hIhMzOWf}UPWtsKsJRd5p+hoTZ99V~xx>2XdN9Dy*_!zT zKU*jCK^7JB1yvYzx6=v3uM)VKO*=`6phg-MR$CcF3RH@b!i>R zkYuc}B%wBW%=M5V#)i*fx%8i@ntZ5kGM zGaCNHVm`7Q&H8N8U-o^)2jx3MN3{{SEFuKrR@q3`uwXXhB+5wfFU3A4R>iIMwz4uS zjvW!lxS&_XowJ@qius5!*mnXGg9sW*3t(cP1WXJb{+Sr)R&4u!9t!(CF>nVa1}iXN zU}G@&m6KcSjGqPh9^u+4%u65f1+X!2--;guCI-qK>vc;nCwQR~1B?+rW0w7&sJzgL z!7?y0kcUnTUPC7azGIGrk5)X)Y4)@ALSG&HjYWtle4n)aqa>8VHCO#0Qx*(ojhZLc z$FlaQGn+15&hwC$V+5Y`w?)SHZi?_ef`8xEXCi7^1vah9=9nk>kGlpJaM!p>y~7=S zrI>{%Kkgb!sJrG&25{HV0`3}Nz+Gbxb=SOJ z%0I4eGPl?javfR(+%?P22Ksj=)y!_%mah#&A5QfKYUmQC?iYba*s`do{x z!bioFW;z$BY3vm-41u7lIOyTi6}W=le@gpFZR?4pOhY=FPMK$^Eqkg=r`Cq?6Y41R zC4gdHD}b{?8gN!f9;Z`dvFTn^=7I4ZO2O^mE!%!Kq284{?r?hk=Us0#2;4uw?OOPK zv%M>>&tHsrEl5tdIkDSG1q(iXK`GTDiNqnaN(uK%4*>=Vu}9!A6c0y*87&5(T}6NO zrx24~hfMUo%O`<{T(^R1w)2lEx_NGiE2ZR|#q}Kc&>==y#ItJbrem#Pe0`#juk68d zG*p(vqIp^L#nL;y1k3lrsJ4YOW$-$Xpd`1>JfY#VAc(%PzYf}cIkdr_o-NO8U{uU>G$8d{8vH9L&RMO#1%e zqhWc>0dN!+axd+@WpQ=)^^pG4pB={r*M4fTbzWAu_x9-&EIC)JWB7XifOk~cfBOLb zAD{o9KfR6zrXQit`&!IenfqGSa}m};@q3!*WlAE^h1Cu|DMP0pXl$2*)$b=nNnQif zj~bcnjfxL8ehtsuT-PCqo*F-Fk$Wx3-4b$xbBCz5~+_`ou^TND9}dJfEEUwrlZ{Z!<_7=r`sg z63dH+{#XPlQ?4#op3m%NeF|Wn4&9|g;%aE9!7K#CzNwHhp7q5y)wUR~0%0V6p`T2F z1)K1Qh-5|C!(E(*rbyRm-a07Lk|iLYs>|{<+^K{m`#1e;dsR{P<|1-zYoEK`A+yU9KB~v3n8WZn6^WWsi&1)oj(I0!?xp@ALF!rj z+3;aZm#8{0;b@OQa=i&Rj1r<8lqHA|ylv!I&weI$%UHsn>aM_*F~|HJOoLaM7&1KQ z_lE6RcrvBNr)Ozd^H#d%#BINz6OQ9*u^!Ynz=VVKqH@GRTMopXoGq~`NbZk>V5_OF zH5JRwch_upbj@(ay(@p?Y36moo7aHlaVj}3F@F$aM7v2x!sq|7W}Tz@=To?{wZv#~ zgDDMxr$^mGqRVHjc4H6VF!)uPxmJfT-Mz)OB=Zd0HI_>c$q3;;F*v6Ary9Py{72n6 z-MeZ{CwHY6@bTStTIC?hPlCvv#b$CusO2C2iNR`kA`wh9!JL9`rC4ZIttnP}BICZq z;{cZmfC^S;i%4rxvx zRunn<}G|#FUU}BcH`Y_(?Cvfb#yOCOnEUTkT6}q$YTek_4U) z-QZ?}w~U33AC3bCbVViX)O>WWH|IBkxTM@}83XN`n}-BtXOh_UAPp@!u@IgY2I#m7 zDLZp_&gYpbIw#u2n@Z4kUV_YK8AaO3^N6Q~f)I-*xLJ!K4SoztR#BhSakVRcIbBa1 zCK2mD5F7Q}<=aVTTl3i1lv|6YJcPaX0>8DuS2~}BEs7FT{N5&N>DbLRFBnJ(667s z@LSRB)9C!6dza0@M#NJri)y8JRELyCOQcL~=5+06(NwB2@8ii;Mw~5Whgk9}ZS&>=fm1Mmg$Qy`PeTJ9AeFWcA6G_+dZwfTyL zL|$=RUSJqG5x7Kf7&L{F7gtNvGiP6{7?_8T_Ouzb6m9>_S7l7O(pYO13h5=K0!bu| zmpbIGX9KX4%=DG8h`m&M>3apDZE4DO-%35O5+u1#wP>MV!Z8LW8kJ1=Q}+J*kQ2;H zc8KF04ZWszcsH63?&2r7{v)<4Bn-pom7xn)X9geTPtgv;M|2ZR#~c|BpDN%`-;}jx zPRs}xl+(v49XxAVbda55w4m9?6`(r6t*Kd3rcvP4%TmcT+>h*m?B4kqXMD%!?;W3WDetS!1yz(Lk?4kK z2@4MgV@^8=yMSptr}8aa`9vQuu zEwhg$UmJRnDPZSZOsZEmWXcuO=ZUgR)i=7fNA`L{2F;}|wxYS#WyyS`^2^H^W!AP(Y@723+MIV;pA;854NJ_w9V7Cvf_1>rwDtY}^4jC}d`hK70$nmlzjShT2wBklGdMGx@yGNa%e) zJG8)hz4R5*i%RHvofcTHr+;5@acDJr=Y)Ru4Pl`yw$2GyuUmNsw-5Z+dR>ACn6KAf zdPC>y0mfu-(DgbWuwKvPckuyO=m*2(y?KCzhV?mH_$I{e=;f`Ib(&EbRO_Vm+qcR- zEMx!?TcRNZzp2J5LCf=@&v=Oc&izGy4JNGjz)_+tdwOVxNwN`Q`O~Y+bhMMXl$Z?G z_T^p6TQ?rW>>8n+%a6{&kdP|}_)Mpe~>L4WGz zjyg5M^+XSCha&NPoEs%B8SAq9LH3OG#jeLT#r(1Dmgl0QTVw78xQNr%AHxScH+$Hs zduM-+w6!m>%+ne8@R3mrvin}wF$eA(?nliiS^MpipYhtxgb`5;#X+Jd25}&Y4GpOJ zk2ZzKchJ9GxM;RPYph|N9&yirI=&v3#3iuhhS-uS)tK<=4iE)>HC9tZ21G%bB9&~H zh$+w<@}JV=*REH3de`8Zy%U|#mdyz3>XU--*oWusiq#-Cg41HW&I#dm~dYMCYya$ zB3dFbe1dX6iuFwA1yr2Um*euvADVFSR^=T8rxFMrFybiKoI2WsgLxy6hw$emb`+Xu zv)3id1MU439(r8`R|pGvXL86@C-^fzg`Wj$Zt1ksTB{br3@F{C6~W*HPEewzV+!tq zQ80X?#djK?K)*ke*lG}E#MACC`S+z5s)?28C|K(WuWAZ&i>A(@(-@j<&IP>@l=rP0 z3PgtJ9B^<7M7!F?vu3Hr?n=Ab;W_!4GB&8!_Wn^^@{0+~#GOW{H_?O`%oux`OBhI( z?OkRo+U8ucL7xr8*k4YvmEFde9)Rg#G!HOyD*g1j6pWpC9+-8$EH~I2SkD=v9X9`x zU;A|!!Yqv73)S-nJu5IY-Ay0cQl`F83sNYnLms#!vmY>46Pk+D*+XYg_CP`n#jEZM zHRI_dj8QiI&JRw->rrNe8T0KPmyqGLQ*YZSC;2~np znLzv-O+hV}!1JHJ)y2om^R6GlBwQhRznH!#5egKiI(J82^LLouq<<~5sn`2{1sa*O5BvZ8XqHrF$|WdHt46Zo+EMH>_udt_e(^$LMq+eEy$84hy<)U z(J?=T^+S!@g(JX^VJ7Y7%VM$expJ#*gk@dT-ACVEiJBUHN(IiJ9B}U{Ozo6r^Es0( zRGUo2W(=o~4g=ses$sFs=L}m$?s*Isc(~dbX)hPK=sZ-ckLS&%wXTu}$-VZ6D3-g$ zAaA5rFL0%88uiO&U}PcYg!rY^V-+uQDS_gBp5C4aJixaha08cvgy zKeyY+g{|h~1h8dEg!Nol_Cr;ekB=T&=PcvaEz7G>&iO%RZh7a5LVM!`C+ZVe9xWur z94~m(XOmAT0%cDc0G0m=pmq!~L{s}K;(`yRX|gsu zk^7Z^$s|Tj;;ntr-tUlH^25_4PBI@Z6uD=^AM*zWSIg5R|P|Hj$lSq&JX1fln zfsG}hb_cFeVo;LpeVBJv4sj-dvFrIYLqV!~E%qxzZ1q`~$TJo@Y@^q{Fh;B=4P$w+ zO{XfUr{q}V-b*bEj!7#1x@8bvIte4a&28DOyllE*=plb!Z??TGhDF{{F4uB zz6!Xa5R6-2>CP(F<8Y-9?<+7IDJxyAq#q3P;~(`|H7OU9=%fMExyJ1 zI2}E;zcv2~wDz7D7k60Jz^03@W5+9y(3ow{b&@2%Jk7O_@D{VSP!Ek~qC!USyg#R} zhSlkh=Kq`LiIEH;f9fkAsOBGU3()+xJyTyU1T6oZP|N=;*a|7Cu_~!By|(|IZtXS* z-9&YErJz==pJizG$4f_cD?VVL(%m}|5r#YD>4Z)p|4r=^rg*JM)5Pv@t3^51oK>Wf z%PRI$%sWSa$m6%c@__-dJ1@D6M2(bfO!{ya7pA>9sW6B{bJJI_MA<)b1FuU}zK)by z(sjB3aA<1*UTL#U4-|Jkd>i#)-O#O`ktjN2mqcAwI+`wvicY!n`A=H^Fk9^BJx7>N zIho)u4m`clMu;)7C(mK$QdomDN>w@XPudYDYr4hD4&87|o5^2B8oe}D0mI|6b-*KQ zX9IGBw)%%qC-Eh6?UgNM|9+CG%!8!qou)%@^V`GN0=?S7A!slLo{3|36DB^V4SF72 zwzZ2M>*D-)+faAY=)M|xZJHG0{AT^N|HKZ_aAH>y4RFZ7*vbR^bWW3n$Wotqc^z1iJ7Zb9kOr0pSANNum^<0i*Xr9nFZM#YK z$j=>pB;8O%v;NdUqJ9Wg^Y{mZj;*QE0N!%@reZ$^*4lMZg^?PSz9xf_TNdw>#8Vhj zwdv(9>G}ggpQve4F#<|ZU~&l~`V*=IeF{~A#z6?&3BmVti9VOT$!Y=raL~_ma)8LK z(|uR%LR-dx|Lg6*7qVBgvUFA$!?|=k;F;yKI0_mumtiL3P}!%{dGO5$NpUrH*2xpH zBHDo6z=jL38?Zs`2HZ`PEfj5hGs!ca62q{$*xIoAG$iY*$-nIeM1SlCAq?}PauRZc zEdSaK1fX(*yPN6z$>}q|R3*bISZ}7kYJC^aEA$y` zZe2$3Z7ut<@H$7gMyO*Jl78&d9M~X1>-aku@6HIDF@OV{#kt}Lpl-(s^Tu^-(3``v$7%8+Rg^4^znqnQbyW?7tu_SPS>|p_sF|b= z9c6}ckTdY{fB1M*lE49mx6K0N27U*_t>S;=2EPEg!S@b`$>?hc^02G6cB>QU>`i)I z4RFG*+!i?YH?iKGZu<3xMxRUdVUDK12(o};F^Jih9tF!1Mhs&8VIxh7aS4iB-d6$Y`~-2FLGyF-qC)AZdw>Tc>L> zp`~l6YF+9cD68))^zQEYx&t+tzz3%0vz$a3{4gVaFTCdr7;-C$^bdPqUG={iwME8} z=7m=>LBEuF^Z&5-mO*i~;i4rT+=4rFc4wG@4KG0%99BoI<<*T@Y)?=k)^ z;J2?K-)B6fl2xfe8YSZ>1|^AUTb?uqb%W>rs7IQnU?_MW{6_l;(HkwxoZSrjqe%QG z`bvh_PA`$%lB{HfORmcI+cq5wC?C(UrtEC1 z7DE}WxUiVMZHW&FWva4k6((0gO$Wh5pm=5rG=>KcHno?X1o)`v)r@#XpVdNpHNXZa z*lXR9@~R~tpx4d7U_5M&q6XY4XHwOM(Qm7_XOImU7e`J$nMloT>{l^x1)qZUdX-^j zH$UhR4HP$S2~&Wcn3@2}+INV!yPBC##>daw!Jvnb+}M>u#pW4}ZU;{h+jAQ74eboa zlyhHIZKT(GhZ6gTX1Z!dex-9aE?Vm3s@&f*U<=FeJjlcWb)`_y7KFNoOp1s1SbSZZ zhEkV-2_V{0QZ@XA2%p0 zwvRg4s?)B$e~>LWqjNWTz?|{y_#CG7u)r=~C|eC79cz*=2J)BM-L~4Z)QWy7x*Cp@ zbiL^I-6|a{h4V_#1$6nQw3xgne|adJ|wJkXAFLkL+*`LVL? z<1;)}aUQqhPx~RfVp46Y$iUBFdw%^<+wKbrSb`F8GE6p@vClL*xRIp2Z?}wnuWpRJ zCH(6!;j$QI78UCiiwWfA{=)}dF+Jk$HkQR778njlCI&OR*z(MitM4l+IB!z71gqK8 z4t#PVe&rnt^Rmw!zLJg+c?p4Zs7$?{xu&sI)^EIQCi>}5T#L_qOigBIEQ&az|DtsN zYl_yd&qnA!F#7C~%3rf!w-dOz`C}6tU$@7PNcC-1-h4KGWx;2elXIqPW9;*$;agDq z1ch%G5FlBu#R+njRTuRU(@OqtN(KtQ#r#{at|yUhR=k)0D8#9*PF5!zV(asPT!<+wm5^{e<>Nh zN>ldw!jorE+Cm+VPXQ%ELPK(ox}~%P?H`4?5VBjMPtO$+mfDeBC7?ng*w_yF4=2Ma zZgd0wT*k|#zMl+egMYefe%essR6WL+OHzH4Ji7GpD7$9(tHsX(wD{V97GG2#hh2Xv zx%zkQe`)avp0)VDzvUL~4`7Z1R(yqBz>1#}%JSm}hf$Oq0}7SiRej8v-H$y&rYi*7 z$4)S;~b{~~sx)`+>aYC{Tn@@s{5Xt3&+^83a+6vV7iSu~F8k)F>v z*yFY|dc{Ve z+`sD6!Fl5zS3nu!){Yp66NQCbgwbqa`#K3B44nt@>mJZRdHSb;@?v;~EK!$u;%@_` zsx4$)I0#;ZrR8-5lDt?XVsOVA1tzB&WEjRqE_bF%glis=XmU^QTY4+<0^M^1C3yY> zXrP#O6$1^Fe4v4%_qTyE`rJVIaf{KjT4^m)Ke~`!vVd_qEVogBl?#g&CkCER%nwn2n!Mc1P#*T zZ4>e{V^J=p@}7eRvL0Dp>neYP2JA=71j%VLa0bcq3B+^n0P$)aMOqm+bO__Gc-7`v zyowKqSC1F0wyXDssxr@17|VXhpig^}|l`A_Ql!%L=8O%y+W|@*=;YXz<0W&cL z6E+sUw^<}A!|#rYtmn4f5t2U~#P5>P#P!j=x{kWs^V zq?4B6K75_H&#dNpdtUczkaf5_EY-=9L+70-7=sjrk7d z^co%_v5ABtX^>|V2V1<~0I~;V9 zw7#KY#`R(G;V5}kzWT$6$)^#Me+S}!2jYJR;(rI?e+S}!2jYJR;(rI?e+S}!2jYJR z;(rI?e+S~{63M><@&E1vG35WzK-`hjmhAht7RV)506^4q&ong!JL?)}&wV;W;Quuz z{okS0|Kq=*q2m8ePp_EeB~Kg;yzQA{FNGe(vFEXI>`=2mtn z*c8MYq)sfxu9%EC0qZr9v3dA7jHzd9Bx0#w3N)!hth?OuCZIlpuR&F#1lil2v_w>w zt1#>jO(}*+Nx_#F$pZ8xERLhps<=Db+LP4L*zDo%?<$_c^ieWeSBI_8&iC`20$FVY zdsX1Dd=!{aA1KCTOGC6xqu1B4OCp`@0TXVfLFnK?? z)9J$*6)v$EJ4TKf{(wBnIQJ{OUqybJ>-!F$9Os_boRUBadc1{6{gj`TV%Nme4Duy)B^1A832Qsv)sb|nbA{JuVy1Z6 z`h%mBL~Nd@fmXDrXHBf~&lKxw-S!fGf;^0>+vq_=R9e-tl3;%(!I&n59~#gAW`)>k zhySxL{Hvf;Qj?+nrChHhT;LU~>NjL!GQnVVDt7imj>j7ny4(F&<^s6)|EvpBR=rA7 ztgVXpZLy=MZ^81okr*o6T$!XiLY6M2Vqe<2MJ+BLw4JWgj+sOxEsf%i#z1ZLbBrl3 z$-lA=E@Z-5#BkX757nilEyS(BOWfDFl)3CIEFDpjwi2O1p0Bryc_xEx)Se50+I{-K z3`3&^k{p)Ip)W0yc)G=92tb)iE+tF`p@Pqrd-J;pz;Yi4Snde`%e@+4xfhVq{x8eD z^got+v^#Hu(E6EIwZLlFXLkP8TX#g~aK#nr5(t}+$3&T5uQsk|_4hYl-zgxy`c>xW zeGoZm*`L8AW43jNQGo)P< z6A<>VCYE{V=5BhCd_Ms@oOu1~oIJBY#n(K{y1tB}VidjBWn}k8SMQYXWDVNv--6`v zkLi7iwNF12m7sY>{qpjkXbi9)9TzAc5tqw}bHJvQAXsc5?8aR08_k;(wq9pmC4$q@ z_>M6wj7hyLjAbFB?&QXyw5&sG@rXPr@*9#6^e_wc30*_hi4}Kzd=DGb24U~Ynqk99 z->a6nr~FKz!8-S@S|MJIz5eC*Wa>D6VnlsxUfI_R z6UioWp@Uq76QAaUzOb@lSj)jMmJPfjz7CHIK2lDq@yZCb6sgQdcLKJt`s(s}FDv;9 z>*F{Wqc?x3GJK>$70j0KUyc|8GuYR5=2p~v%^lM{LP%=3^S-(?>s^)>a_7)--;$tD zV1Y8E1FkHaG=Xm}GI<|`Tn>-T0UPSf&1Ypb`pE8`)P>zIhfZ*x&nbHL()WdOJNt(g zQB*$HLu=B(q{t~-w|EOh?eb8klIIIuv{M3}K9g=LAs;evHGK^NK#}}Pjh8lM*UEDq zJmk^uK>P`3Og}#dtks^DY549Q#@gU)+-cc0W2x4V?#JjyWp=G0OA2l8VMwY6*GH3L zd0GSLw`Kr*CDZFCP`^7c%ApHlWx^ve(PC(R{Rt_$K)w!_sxurb>4U0Zm&XwWdHewH z1#H?eX^{2$>{!(KsHLL6g^e`o@d5f?H{XG5sxzIIs-H@a>M|8P*zW65dLJOfLc!&h zc)kYC^XC*yZB@o9dTNWP8JIEFu!Q?1HyND?Q#oiWSj`cy;xOzbBKxT0RLx!ZJC!@k zRPSxf`PJ!cT?D((*L9JsvFF8Ne}!W1Y4a~{Q-475b!-le2Uu;+khpJCa5n8zFNZ&2r0y(2FX{zSu)3f}lnYxObI7O@@H$-{WwL(S@sBoT|8~vUPab%2upp=|P5 z$uEYW@uSGD#{|fDZSpXY1`HCA<^dTmukLxuz2}SpU8}7)Y$L2a#r1P znKSDyNeN7T^+heO#Z;g1pfBk*Y$3`ajhR8$Zq%ppXWiVqp<-D&2_Vk|ijD?nhOI&U zZ@-I(ZhRj5dfsX40~-Js`9lCBe=A_*UyaN4J@+pL$G%Fgd?jC3JTxzQ^+o1Fq4JQU zl85}{CJVA`Y4yGwMh1VpQ{AS7YE%S1vC-v`QxMtUh2+GgLV#>Spv`0OLyj)c z`O=LfRfI65AnkTudpVAd#TKpdLDZ|*rj6lQ=1jBT+@r;!ej^ESh>x=^F8#{Js-d)_ zjm-NV6{2{PQiCXX&MB4#B)|;JGbf*{qiS4wwcFZ-L^v$u=8U)F= z;bzrUHmIA>_KNk_xnqpeh1B?F(RwQ04d`_HNy*-NzhVQwGRmg zHSqH_D7B$E|D9wDK@~awI|rG_P{%$D@9jb&HZ|KItpkZKlPKj%_l=r4Tgu124;&EQiGj-Td}6!TKx=jN<)SSE%<~LyR0I87bqxXZOMl{EDBnU`c<=@sM>er zqJF~6a^=X&7b-2^ig>AschsGALi8mN_f;b%?A<<;_S+?*-c*Mh{!+l=7Z1kWO zRDBQ30`}%~9!5>6Z;jY6f@gtj`lJ1!!KTDkBy|}WZ=gXzCbmU&pHk>Cd-4hTWDx+5 znO-4C^_eRlwk;1i*VqrS&kN>-x4v5=I!2;DCK?>1OO(t!CmnVy{#Avsk7XSiN8wbp zH>(#;gUWMR6TW_xF!ruJMCG}x>BV?g{kN={^<38cbU_-?VIVjfW1Zc|s@6!l22JRf zqkP34`-SaYlr#%Y9}(U*j>E6c%n*h|PNn9jwBN-V4k{fCrFuMXNJ7F*pdZr!G8zN% zA(oYVfK&x9zt`=Bg> zs+w7tXZAbLQaQ=>ZmZ)l5ivvv>to$jdZuI3QhK_W|DobXoy>(4kpurabz?vLlkaHnj$mgld7T zj8UGbqYxmmIW&J%qGGJ)8mVUVa@Nncta?%m)5B31m%qO$-)@&DF@c1=M3K9oi?Yqc z*Zh{Epk3V~M&z&{y&6tDeX`4cJefP8=&~_>Uo0PnM(|LvYbx`!|LMfkXTgm zWnBR?&ShyjoO~NbD09^_ORW6p?+)<`Btae_m#9}Fn8*{y;}Ymt0^d6!x)Pniu(g=? zW_`U=Lm?KyCn*Fs5U~Ws*%OU|JEL+{h%LEY<*^82(%*?OhIg?SFv%|biYX3 zkz^v6+4g96rTDM#>R;j2zrw43g;)Oyul^NY{r_EfCI0_Tcm*U(t3k9Bdk%HRw1z*avP^3aW$vehcTB z0Bu14%R`{W<~z4;OX%L!pMk?LUm#n9j%XXu1~nuFqQ)igZ7nvW;{(<`DPz?8@Q$pU zcy=D@Ly*)VI;n_5i`p%lc+pSf0ewL@0&2gzNMTanIt|A;Z>gca~ zJ7qUC4|4*;&4j;1_8}H4RSf=l0iFymFxo!Caaf^qYId`O4%WY5YX zvvI+(PBNP}@mwySF_rD=!;^} zJS7*bj%B<1!3kbwI9z&*b~V|Nu@Ace*Lb zPod0X?3dJZgZLE=cjYXUE1fq9ZmcOeeQ_M$+o0wBPR2N$)N-kGE@3Fr1zs1p+Tzha2@nBM$ki0=76#Ri?DpiydK{ zBgOPYWkv>pP0wbBR6a|p!vI?E9P4XX+JXWBy%&w+VcG9c^*;=cO;Ohd*6d1ieD5|q z?=eat_5FZ_KNGS(QVNVXvBbcL15xbrr&dhI(Ri;(ZCH<~=+z+6y^0NhuZ*n>ILUZ=*I1lMCE=Ch9!EGoZXqMIl02ZHg|59ZTB!T1#)4B)~< zHl%g+P5DKVk`=cXYtQV?s+!1-DV`AyERu9cp=?kSp1 zmK56~I*H8?1gZ6>EWQ1P{!(^JBLw5JM>bRKYuZYyx6;(+s#B&+F67T`=DE{9#{JGf zn>l9dw=NHc+WS73Q%EG9a!P4z1;cqU6IYb<@y{*kwEZvrYXKYR`LF2s0C$ph_G{-q z0|pYGD^2pK^-Eo8e=ngR`Gt1{_P=@Re$(+6f?Xv#6c@{IV9GEx()jEIEf%Hk^G~f) zdt9rWwnPILOjOCVxGc07uPfEL+4IP$_PW9zC(iT}UntDWt17U=eh(>K_&U#sfn_bN z!w_ePd4wx6dwIS%vY;7*;q_wWxP5G;uCJJNS@@&q`7~j~x5!|+m7q=sAN29SkIv!3 zG8+^RR?vu_pg`CFDB>K55!N2cJ_iDuR|_jp_IcthYP=orD-ppZZ;qu|VG5V`+7(N9 zu@uP}xFyrs_LB4ClbPUlN?o7D`Bjt3N+5;7kXjPtj}ceQCk8p9;m7w1b?m&W_$uZB z<(t#F(o-3NsK9FF5JKNM{wF4=2P#;?THEaG7w6t8ofD~Jr`F#-oipCY!#1?*0W68Y z58qdJhp*jV|k?JC#!x z`0WEK3~@Jq$c8fexV@!vU%g8%xPO0{^zfCLu44706#4QEZ3q5L%+|Uyc>||g-p}i1 z(n_hjVZR*ysI#qPC&ISI{c;7bxFihDii1Wx_)%XME(m%#`2gHNa|6?mX4d-`M-ZXz z(!NdR5|!9YTn&p{>(hl@7|oR;3+%-(;I`}1VugYzty}Z8(+b7Oo8MVj;2;@&h)%yO zegQ*4BjM*ZqUA9CFp8Hw$TYYNJ%ck(rS5WN#t6SdtTgl4>qB^TjX(t1cb(u}>XFq~ z2HVcgb}dwhf+p$RK1#TDNNI&GkC0^4uV5S|CD22W4n#smA){k8)(Sp-M&e;JLT^|rtA^Wxa2&q7S3!Sp4g-2!DL*j&Z&|zva5S9)4{#F(&a>jxdYsMn zyZF9R3trebW)f_6T8nKmYlu51TPF!h-3hT$a6-csl`c=3Hx7q@*)U`ihLCq%q5=@# z2Wd;tX)GDWQ-Yq}!!n4;FzS_bJK2R_*aL3eO&!g5jdKYzKtRU&IUqCh@&LVJB==eh zxCuKZhwlFYk>bA4phqzwU9n_7e0DyMEoBWr44VMCPxjC8h$nb)uXpX!`iI`fjX~$sqLQg$Ai9 zqzj;&S$&<(X(Zxjwn^*fgdl^34Pv>V(l`PSmL(Duw_fP5PZ{o zB({sAy;I_{syr;3@xo$I-UK8q|HN>opJTW>@|iJzW4QT>#Zwj7Wzw4|-($X@6iUV0 zkh`PE0FoA6*f&}bm_PE4`!EWd z!}YF<2wNsrsq!ie&&vc)q||D9t@Rhe@S3MaC2EA8`uw^6qM2^5xmoEw+K>|qotg{@ zw7kv1@^J{!j3S&7=Y75E$26i1e<*dr$gAuxjO2R-lAT5%2yZ<4eWKI!`K!DEr^{;J zl`K_b$p`AK##=h}V@y-lirf4m`muujxaS@(v`|Qj*SZJk%%6tc(BZ__L@<^;ql-Pm zfY77VPV$FNIXug7RZhEAaEjn(O&z9sPv_1!X5lV}whUkjpy zy@poRg5F{yV(enJ>9i1SM;X-84xdm%H}HVh+|~i820mCGRtXA+2#$mmg~lL))mTh> zzbu=a#TZ#`8l(Z|-Zf)lu0qY>U*)859+=-l%MNXa98w}lUJ;Bpt)oHT{s!qnnYKU| zu=hZN4OJf} zpvnFzesUsM?PgvfL9*LFKNcpK3&$KWeA#HzqKL*^lEHCKlPnZ=|1gLHibn_x9 zX&uwcNf~zI%gMgA8BP;r7-%}MG#1|T@D5C@;=abiMKBSE&h0dkKY?@R3*C>AHQ#*GY(>jFa%}~I?$LFkPk#a zQF#n@@jUwL=eKEOb*Nmo7!z-CBg$A&q?Kb%wY5$0eQ9uHsqmyA&|-+yTfe8qlJ*e93gY; z_qm{T&EZ$qpm7?5z$OpEOvbWOe%bt}bj1ek{GxM#^cV`9mP+d(48M2ID=Wh3+I~yM zv@d>Q_@D8`r)%WY8^b4_o7AujI@T6M%JXuylAb5@mUZoF5W|vVLeJEIOXklmCZD}O zrhZejuOhgw6%qx{#wizxmHL{0G)p7C3`B+@nH6;ouEEz2rh{|X%^GpiQ(&c?5eV;X z5`n?u(mc?wD9knuyi_qv8Rf4ei=eat#(u=ugJiFJ9q#VV|n^CUc}}a=y>!i0NiPE$};Gqy-OV z&PNYSpAYva^sUrOEpG)jm=DF<_Tl$d<=-v5ncf{I>`Ht2_9||pGqRB!g zCPWP@xSs$H1=ah&tn2KgRM*BYld`|VW$zaJz*{Oo%eWy*|rBVhU^Qz2}IuJv-ph4kWB?F2G&Ll z=l;Bgj9SUYT$l8_(Ckl-BeUap3#ZC+Cm+4d?PQM#nex|Yx`fi@>soX3f(jkiHI}jd6 z8+sWm)VG;##TuFTm=Z}%A#Wn6U-U?p1|1j$F_RZcxHx1T=7_n^oqFmEejA&`oPL@a zJj1tjf=dg6VvT{oWUO2@IgDhUNbj%{A_X(MJi^af^k?z<*-*b?qd?WhK!jv!6&U+( zjn%LfERMaOy?d&KQuJC1Cv*+_EAY^eF_4UqOC#2%sIme&3T58@AZsG7x~cbiZ8vW? z=YD5P>%~K`*3Y#jri_p1F`Na{GEG*dbmR61&t|<ikV=*}ZO530hRm3jN; z%h2o&5Hspv>rhkB7zjXrE(b25c%D6%z}Qbq04jQ_->@ScW;>Nx8Kh~tSUdQI%BbHEu_*Y&$JqelC93zig9MAx zI77XaLPT78635w4>iZSlS)KtS8D+o8{*~AZHjfVt@4vA-dL=3~Vx6|z1t53;4exhA z!<%LKPSxv#^*2Az@TO$4Lq9*;IpV#OoK^uE-alg%Q^yUjv-VRi-n%jLd<$6>fxMi6 zTOnuy#C17>7jYNZ564Q3aVMm~5TpqIE4twr;T#h}8<7oWI~F6t4IW3PtO}Z!K(~zb zxm$(-@EU3MJtQ-H4qPOS@$KfZ@9}_jeM7rLtj%JKS$VWqP9_lO`ojlLv7c~^Z46mz zQYa2DOoaPvDdmMH#VcDYsBa*tR>aj+4SWBwuixlAxAZD3R{49!YN1`xg&z)2e`N@g zd*n*F5&FB{%DLpNYwY;K27@|ZM;L9Lnew6wS;w56^i4j}w8~#@KCjPG30@2rHrOvP zz382>qrIkqw!Dr!DdKu4P%^&7Ih$_%3`bzsb8Snav4G^}8-AoAYTWM#Tc$!%?;vp&^&X zir#{XKvj_Vq6sxw_oW8aG(3q=$>OUCH);)^!6r*XMNXJZ6sQ474b?ODfLI#}`R{)m zfekqyn+P*!3)+c2he0F2b1MEK7Sx`4YA8sqOO{+#tk&8ef}ZzP*tVC4AR7yb znTlZ26V?Oa7IIayZy0gZ0#-jU4r;&iKsjmOiV$l{Z54bg8M^qi$}lFe}QISQ!*d$YH*ifY(|2W=hyZJID(zJ z3wQZSN){m;^t#jZKO8?dBPe#HWEyh?xS1HpX3dc(Lm+9IoTgF9R?^x9+TUj@Lnp}{ z6HoaOsP(-S74jHd^#{iLR0;b+tmg2*0{S&#v=f2&m6;LJztVX;N ztVtZDL4XLhFyUG|C*E%K$Kamq1d71;-xvZ0RXZ?E3x&wL7%DJ6>O6SjVn@Hs#^AkY z7ay?UGHkqSu3bt`8<07M!LM5tuv@6Q5^p-T(}X^A?xPVCO6Zk$3=_@-pg0hdYD8sB zT|!ZfBJ)Da8TmvY&@;n`rb=_4Hhh&HEelQ<$RBFNDe(R}Q_Q!r7<8JXdk;a4qOYGh zy;lW784{yanxF7zif2imTy@o%EA(uU3G9s&M7=_~O#V98feto1(IM|Y9c--aEYxj6 zJ?)CcBD)_7oRmd}DdGamyz_8_whay%Y#%(Gpf|~tA4o=%Ub-3u30pS0_WNrpe9@Xz zf~lh_|KjAS*b_>ufseY8F4c;Vz}xnRul`G_dCziiQ)_j76X2s(x>mJG5cwTWePWgy z%};gungYJTbjR?Q>O`{~WFGqY1{44n@CnLt3u1t+hPLg3XkibaezzbJ2<)|4oT(3v z%Zaq|4n#lxw(#v)#E~LTl;Y61b^0Nk{yK<7@}bhGmrRQOCniB&h6x_) z_-9)=mqe|9Ux^|My2?~f@?iJN-o!u9lO!YjR1W+c*x#X6+yPJMvV+}CIdjzv#fD0-(#`|LUHy%cu=Z+ z5aR#xgABG1D!LEKf@Olv?Ss7GDCD4;2cQT{iUG|D5Dj!jxy8)+coe#Q07?R8PVYmI z0cCZA8jyvA!gd=3zuoW1+cjFzJ zVbJ@e4DEdYjl$wUlOI7kXv=CpN;eAP6NDaJq34gF*N~1=nMLj4FpjQ-gbq* z8J~C*{-~X%NXe7t#9GTlG4+y+rMk*3>`BNuM=$&!^NWhI0J4>F^(}v`*gt`JF+|5-SVuZt4-E%S$gfwPGxPzvj@qmb}J#XkuIm(uTrnXzC#ED%a5V1V~BDN#s zCqTq@G1`6Cl4)-_On2Fj%5Q74BuK$k9&+a^wD&_?rNrao%suiTRo0xg%=1^h#Z0fi zmAQeI5uySSv2dPZI*C|#$21ZZEI+e!3JDcr=^+kSVpUxQe~V;{rv3%e7HvV)gxg0` z6VYuh=8z>9@bYRGciAWTql;LdBEe~$`V~NZhY?;oK4)=%XG;dB;d{L-e;o_uI0c!* zQbX@oK}^uLQxF|uP`C8sc+>7FNC*}-0SYEXqT@TrbvVIZ+v{we&+dWjA^jOT<3Y#chH0^8@frArb$=+jlT!JVbgMCf%FACjy04UuUMwXq zSr;Vp8nLM{=S;4@$xPK%G29Aj7W%wtvdN`)aN4F_3~^_40BIYscCKb4Hi$?{cN04+ z2mM5j^W++Lp95sK?IilTY;ZMJ2(Nh$E?@S&Lr9JyqsH;bto5sG^m)*5qT#HZ)O5bh zT8_z=EP7vzTAEu;p_ypS24hKkO-w`?RtcB4`_`^$(bdOA_S55=jhFZ2j+$z%TKM9r zkJAe;6WvbQd7x5Lpa{6-Q0VX!NEPxZ^LFtFzxun3Y>v+DP6+(L;meXx!%{yUyoruU z@64h2;%|IDrO&!p=Jr!<(wF12huj@KP3V3c(2=KD%&$DNenH5-_T{Wkrr5+f27_b)Cbcmjkx3A`^dwR=1}}{g70L%u5#QFbV6+v~#q`(%_t8be@W8Cbp(sM{?hDn!Vi- zyw}~vE_XvoFS>xPiHD*NgWV{pJ^4ZxDMW7ua&+sa7d; z1BPovp$PkJXybYvY`>P9mc~nhE;teJeD1ew&MF>(FPPg>(6d7jUZBmEfETJmc&8FeEp*?GlA@|N4+f{!SNv)STG_%YKtiw7-x|TC zI+TEf(C3HA5vgmTPJGX}K;2U9k|a~OC}!XkTO^%po9~enCX6;kScexWZJXreaomAh z;*Wq6t>t#{zL@CwQQHnnKm40)O*b14U?)+iuwo+C2TDXmMtop?__k6?!d#$ZT~T1- z=McbJXG%NpqtE~{KHR6D-!w~jWdo=;Xm)iKe|z2Le`PmgwE&^wyvusj3_jp+SLf}E z*g4?}96n9gVX1D)xAV4VK?)Kte3K<@Y$TJ!uahJJcI#lHFV}A3MLHq1!A9h&MY-^)j}jszLE3sM8lU)U7U8B!6y_hcOkpBg*DHBC;_DiCy| ziAQsZtmGTZP#f}8^hJ3^AU!iXs%q!W0VZjv>AJMmst@&(2q$%fLH?DEaAJG`S)Kx44@- zH?Zby@yVw=gzzmj`3#gXT@;0v!3I9*f|%^Qrm#Q6Zsg?NZgoWI-><>km7vCAB`7@c zxh~qm=g?#c%F;s$b}dhgo5cf>&o`ujatW2LkhJ#izXy}R2f7LQMjwKUT??m@VZdI` z+g3>7CG#MlWUYXVnlQF>4{^P0jrzf0lmE|4!T=hYw=y*N4x|Z3$q1df17!lQLeBRf zAJ_rt-aRN1W1v?1GU_{UpXD@{?FS9`14@PsgknE{^x-J2p!N?SCRjBn8zz{XQHQ!~ zJ9C&p?>`>$^eGjuCk3v@w(GrC-*R9&)SHH^>NqAUvoSy^M?mC|EigH=;wE-n{PFy2 zAefa$sM%?F4HxPuWvq}!-w>UcY)+f!Q{63Gx@G3N8m~U9EOY z$Js+8=>nP13doFPt)+pdg^B!XrmvuLq5O*U^C8m2tY2^E%layLvpbNQ?<+fCorxQ> zs4ot`95K9pnsVvSrOlU!;_(QZ?!c4Yshvzsk}Qse(Jj~BuCD@`v0r}g29dFncu8Q( z)27Dj@S`RpX5#%!N{-hsy`JKJzD6sEhmeu4D*Rc{bt5#o9>qTnKq%W=Z!zZ4D?t#J zZrZDZUW78cNN-hPdQ?f_p9ET`eU0jQOe-w?u4m0G`pu%Zs7z$X=y+KDtD-?;xiPoA z%@cj*IL(df*k83JJ9G;Ryba3%9l-``qJ>rjP@R}5n#{2A=64=r=g<3B**<%zqX64>!kVJ->nO(%I!#fem6)1&d!_iAwCW zCXDbi^_M=`5Ap?rZKhV!ko)$Iz(;FxwR zBJm0{(O?V)1CaV(P*=QS5Hegi@-(9OFi|2tchegvmpwgotlfuIB;I(1P`K2}4xQKl zMFJN?XO|!~76{Iwr(YklTT+sZ&La>{6T0u+TO-(~z>vAD<}oR*D`2cvp|F3Br^T>C zWu`&8aHzkaAE!ZQaL4dXi8CM+Sh!;)X!a~{<1@^6F@l~l_9_@n>6e>va~4a?P^f}2Mi;5_i@xLg(WjJ}gkum@WcP}ckpT2JQIp;HTiRxi{eT(pBtqz;zS_-j=ku#gL(%r_m>q~q}b z3an-sXr69bEb+uO;yKbENK-6L?c15N zdhfIc%Os+UIp5(OSK6eZ#B4E(>6n|@W>KUo6XZ}uYt2xCuE zBPkF$ufPPWB1-ZFoogv_sKNAenx{{4+>rxF)cRnsnJrf}o4y?DO>NSXw#R3s02WKJaUTo%25vI=0y! zh?=iKq7C#4IUbVeMROYf|1fdnqTq z_PN0N8)LFEnMGgsSMdbzTd9x>aTN#3Nf8G_lw%I$6$VPH@ArtG&-yh6#N*>nz=4h} zXjS*ysMlg4)9z{ds?(@U9UHA}zd|>lb=x5&Z=Bc7_ui2BLruHUteHz6I z=lY~}&O5eiD+c4D%GWbh#D(=wDay7u{`5P0A>`&agzdK3Y}h5$WF8-K>C5~1qn{PT z3!J}@&i-7f?~)U8rK3;2*vA9*EE>rq@6;$Fys3P)-lW~V(~j5z$=^?k!+FY?LayL} zPA%<|`#e7Z!|Y>xC~t*73(J&&#`#jh_g-BdU_lH}5ZC$Ljhpo>nr)p5849aE>Cq49 z<+h+`!{O@kF(PK*h{}-&O=#-My+4~Q;gmZ3uo$1^TLB76?X{pvxNrF0>09hFM?4}S zLa}X$^b@~-$J{`RsFh(?5*()lp}DO{lcbN5{A`VF%9|&m5ToeCu`BwSue9DnR090I zWkWQ8$W=HA^P@6tTlRRlAC_hHhd+26jF<|hYV;4cC3_83^}dwU#L_Rb%jJQuJ_2KI zEWeIZVK&S}^&0iMDGpI+QNJK6S9E0>qP|?@<*)L!jKi)OvBYZ*T23&7e^@zv(<{YS z0l%ULP=Dg}m%{HHk6ph|H4a@Zf8)u;&>yEsxSS63$<%Owr=B#l7YBIisb_qrTxcT3 zeSYfUK($|jPyPi`|GxoJ!~X?R{{>S2Hvm#0s?oHtrT0dS9`#d1@ifTX`Sf`GtYMz> zBo*^K&K>DVx{NRz0<2TUSTBLj_#)Jk8Z9B&-l$$ z_a>M6G=SgyA*h;u#&2#KU2o}zu}Y_sd_)(cxE2s%?aQ)8IllyzZw0@ z-xOF$X#5v{BmB(YWc4m@{LlECoYDUifAbdLZ~hnf%}Lq+9KV75!{0Ci{0%?A-zdq6 zRJWNC{tx_3(KCNzB#l#@`pn;C4#2Yk{LKl?+GKRb@KX)Kg+kdn=ezqwYbWspysZ*> zu|T%HUbR%JxT42?bO66OjIpi})3LT!Pq$Mhea3H!g3SkG)Y5c_vI-!PR>|Quk<^3i ztDt%&216#1hrJg{R(Fqk3hK&_VQ(|nw9^vFa5Bj9~bcc}cKiQrCgR!>^s&Z|>wh1Yv zySr0b8l<~ZKvHR>ky@m5$5OhxyA`C7?nb(#TfpyL;NH*kyx+__@1Hf!`mtvA-ZSp& zzOUmv4)e?SIHpo&&Z_Y1h^H6m*{L5}D}8&Nj|5t;!G5$UZmWDRc|8&+LU#w;D)f>uD6e+0 zRcN_mkDE*eD!lTc7~Iki&^yF5wA;S6Hxf%)^>V1Xa9{2|S@0lzpG*A; zOXaJPX$VyfR}LV1h&+P=q3owOh|WGQ6~*%7c2<1XP?DPzXO;ST?G4c0Bq(wz)f^vU z6S>VVJG!E;=1QVmKcPIcu$8c;B0UT?jI9Kdq{;Nz@RuXVYf_r6)f0H=491{{y@^xr z5fJ{Q3A(*`qm>#>g_%iRM|UZ{p)_j?1V;1)y3G~+g$54kTXGJbMOFV+1$(zp(X)@W zT_s?~ZTvXsTHjIeecJ;?mxH*e4oG8+baN`j8#c9ZFm2MCBA)I`a`e49z)Zh@8xv{p z%`f1_#6?61a$f?VxxHZBL*T~bPbZ%31l-zrVons+xx~~p?PKpzfOe5QeTDRS+xqLC zII&yNG!w_c>LhWQKmFg)(WonkOVvP81C?ISEZ+iAi^H8kA5kD`v5~?0y9cIwe#N2k zU1D^QIX{zJ`frRcvtd%^<3R6G(N&p@-^N{_l-TgSHNxJXy^ZVVTp(UQInmAm+B_)E z>}?rwI=z9tLUzMju6H46P7A8)_Abw2;@pup95QeTbVjgI1p@d&dcUXsSZ(gS)@QbU zZi)wI5EAGhOAV@1+j*v1IEB1cLYqJ*tJ;qO-&QaM?^0h*7m~~F)>?o@Wk)xj6eTY*aVDhxQSb}|ybtB&5qTRU> zwZ!3a10EcqVt&41u=z%G*Pg@W3Jg6;g%2GHCLE>Wq5P4KkAz7jW^(Et0mw_(6Ix`@ zSpG=k7zdZk3*uq2N9Fzo3k3sgOTma$yTxwWc_BXp^*y608diy%s}vK==o_4#Z%Hp0 zU*ohm=CqiWB(X{!O#$yg4OW*F*ncrInV+yshf=;xKrUZGdj2N?KKfVUBzSogU|ZH5 zOAT9ug*scDXq~6useH_~s_S@{7I{L`A|CNI(B59<4Fb!LNnsDR5rZ{SQ#Q}Lp*ATY zc;PdduM|HFXQ0h;n`1|Eyk_|_d$Yl!W58&>{f(7+@wb5dEuqZ_(zvVEhSIMs=_S)| zBZH$^6$%Z|(#a@yLmJ8`%sk_-M@zAz&`jA}JTqXy{7Umu%iwx}zPxz^_mx^^~TCbw+ZoE62@fdgfjLBh76@+pv0tk z&tcUxXzN0{DYUCnPQGo^+LbBnc_L3TW2S$*hm2Tq6I4v%;(H@6^y=q<*)@4fcDa%yyBmJFIWq zknNX~vb#{RwG^3z>CXI0W&>2a*pf~*=7I!V%qCggSl$b>ow&L}5>6vxvXXf|ICv?URsQ*ps9023hmuKLVa>O8QsF=&*v#Z+;meW-LO_uB`z$zO;2 z2P|)F=EvKH=BSjt+50^4EmlwvTi^9U{nEbHYE)-E9D7^;<-Oi#efTgvo#)_{&cylA zKL;SZPZTaYDK4;@r%S8w8BDYd;_Kv$D+jYDLuhB>Q?waGzRc)lJNV;8Hod>AK{KDzi z64gSSgIUkqznSB&Ul}~p=f`lmAxkn6X3!LTX9rsN@oPIa`wqLmcZ4SGIutXoYI5Z> z#c#EEgE8dkf&m4T0ggz^9Ef6pONCkYq^SD2xYK#1u0r+k!At6!O;0l|ICJ@+0+D;8 zB83$ZA*8VWj2ITI)MCsyDwvv6W-MYut7@2ZkK<_6eh`M=Wyjc=G7c6QY0QJIfBhJ| zpd`H$vf_hOR{wJN2hiR1dM{YumWqt7CwR{F&+A?7I3~Ip?XN$S68@iFw9&vTN1~E% z8t}tcDMH%jUpIdFsWLF&k0rq1=J&vXrU*C`zke5{UU)(NDJppW|=&ZeID$7d9ZUX>EcC-WC| zd?ur&L+D%HWb)A^Q8(D!*_^|uW&uc>JHyPlKr_rK60Bql#MQrhjucVIjuh5>)%Qb% zyLLhTz!9dxo(PF=1F!f#v3xB|Fmf6)pDaif!SBZz;vu_$f!~6&6r38RpxF?{OIM=jP0=2_pKfP=!9Rvi%a9UkhUb@?Z z9>sFF7;5T|L~oa|Mlpo}BV#q%U$NZYH)1N0l@6WaCKP8QR((d%x z@0>WQ$>pjwswEm+2kP5EeB1VH3>t`U+X3-yoP;QD;3g(QA#@)RD2##sEsSOK^tcgz ztxtuU5pv4&BonjZceeu%O%ZgUj=nz(#!rfZidO&yPSag2QY^94-L#GUo-q zk7#60e4jDsjW0Jt4*`0g?e6`d#?pgZ>4)^U@qI>s;~34_d1THo*16f#^;3RZfa38u z2FY)mc9VN&va&as>kd-ng0_uA5W=)k-xYn8GVcQbmI44^S%AH*wg-POr6vV2TB0u| z!?zTmkqEbvXrV^e)WKeWTpYcgC8vnukQ=x5(|_~dVILojN;>7YQb-bxyy+UQ`ejkX zD*z)SD+E8#$QF)l^FAyv?K?5`y0PNB4{wYeS(CW)s>1zIB|3Ad)>T0r0mrUIY~a|{ zJSROs`VKgDDUY6S@Wv3Tkh!m&05Gw`-nXij@OwXT2u%DXjo2`Zy#PWJUjgT?E6BOa z?KvC|aPG3OV$s@1GMl&+FRQnXbAC<`${(aOz#mjfUys!v7ui?MP%H051R&QdiX_tl z1F~dlYRbg(5`5;Va?O@hnwU!7-3&D9ZiVpu5L9kY((Zg^Vnm%Y`Co5^BHHX zNc|f(Vp_L@q@wR`bQ2{B9Ek`x%cmKVi3$bU3~Hf$bg?+LSTeyjBm6rc%z>R`iBimO z`RMh0I7h{^Fmj;yq8fxs$sqXe*3VI9_9w_4xI*cno;u$O*!nYvV?W*XImuMMv_o6a z+WkVNf2)|^#p?>6yV|al!D>@uCwgPWu~|D)doX#yAsW}bWT#tt@KgoIjqW8L$e;~& z1n*{D{3)b3_yA6%qDBKnm@YM*l0?UX@D_;tYSSG*9b2C%8ZMF;dTX6Y%3tM5PY^(= zXCm>t$aSAlh&IkbTW!kP_L~@43rX zzdD1BW`aOx4pM8F25Y}{%9BF8Ig8%o#q+Y4A9eK5PG@{pr@UvqNO)0 zR+mZTGV>WS6Hm{?#qef^`i}nz`oSLe`dwNXjI^Ii3gl6EyMrobctZf>*84f z3+7R}m0C`LoG$ec+>aoqOQ8APl(PIb$*!%S#SMJB4>Z585}kq5<;DM=F3W+_<=97Q z;B>kC?I_*v@8PmXLw!m{|BAk{cm(SSiKB_PJ1I}r!!4_ zYSUOK?YErdxea6CQF9SXu+Oa#8BO8Qp%Q{>a=#ZZzH-vL(SH%>smetbOgN3&>RLP| z45;oh%1Quq`iY$Wr*u}w29VPdVG4bquWt)1^Y#IBn)VT$HU!XV>qm4N4Lz#1_6tyi zdqk&;&h%ISbb1Xyr){3lX<7iCu7{x0lK?tB1EAB%!AH65_lt>;11>l89}C>kb3|3h z0T&54;Og~@et$aPu0jsDyi|o>3dk5Ts6hXq(?Uk}DKlgnl$hTcnJzw6%$3nIYAje3 z`@-LDQNUSl!H8-(rup@Y^)aG{MJ2hmkjx+ead1u|vRQk}SdaN%kLYxLx^I%F=gQ*& zw*~sBR{P%rZd-+$qh$c<54YMZ-YaIv0k?62Pok|L&j2{#mY`bQppDO(_0j!SvAOwT zI`m%pE&J+=)B=xn6ev0N2J@bVQ#$w}drDQU7et+LEq9HQ<)7c`xH7O%JH}RLTi_zH zsiLj7wsN#E8P0+}x_mFmKD6fc-GNR8$MRBRfsBaOxZaLZ{`P)RXcBZsuBjR+HX@b; zIn#E5fg>%}gQ_%LB-#~G;^UDv|2${%Sp@AB92{_@ZJVuMU@}w^KopERqD}J=yQ-SS+xz$=c(-6QK9Y4VO`W^fq)Qd2P77O&mda-@j0pi`E z|Hiw&)y==m>*l{DA#X5TdvN!DZu`i3xl9z8$g>W#$OR+yq8!sLumGsn@?X@8kbVG9 zEfMS`-=3!d8RZ{@m!#D9p6sKGZ+Y2$$9&+Ac_KE^uNzJIRxvm7O+D$|*>?i{e+1+EM{ z+V8l%=i8X+(XCnn+5yyS9YDRPA5pK&S<-2*!Afob^{RuQUMxSS8uTHk7k4lU$l}Az zAAwB>>orAq-tV)`uZ0TxmRFI+ZXQ0wb;o;3y(=vhu;MjJ>59X5E^GR4TVA4nBe)N9 zs#AS|(#Tg3*xhs>n1;EJ5UvClK-rr0>IZjFR_~^YE(`sz7Y;V+8}>EN(I#3VK=b(3}0hx1ev&#u?4;?)mPKy^IPhD51D`Kr-+FPw>K~;6N?|Jw#;oVy$wucc*k!|M zL={KiR=06~;8|}#2G#tdk?4i$3x1g|Ho2*Z{ZSo5b`eyAvV2DmiS* zhd)fkie-2Y>)DxxTG5t>xE@V$9$+#?V0C9r4@e_)%MN4m+i1H56Pf{Ogw3P|AdQ%V zNF#2W41NOA2t6)o#V&SOw*jm5A2+#H1zl=TlS1WyGeQ>`;YDY}EK-mIQ*F zTuj$WtqL-cRc_{lyrTcywX_Mmq9+6v-q)Oz=rv>Fr znjMJ&5ZlAagxP~nv}|c@XyN=*Lrt~$b1Oe>xa{gU&=s%0?E;?kK;pZ27nnN zWE8T3w?V*(`fpQwqb6IgO8>4bo<|C3isQZyaFG%DdIZtE>yPhdH)y@#-i=^CrFiGk zmSmNwi{`o&EmmjxW)&Z-C8;a-hDh%?ut!i*25}JU-vkF7UeK zI`8fcnTcYw5iZWGUk#GmJ$LVu*R86Klwu~Vvgk_h3F&7yN)aBbPb>qCi)%^JW>6$4 zcD}5k@e7fRd)c*!j$BRij9B{@AcDsLMDWWr>s``3U2paiX^YNrNqBER1C`s3$1Lyo z=5U8X&HKv|(v9>U@b+ID*zWq6kmX>+n3(PLwt3y*-`FFIS~4~BB}U3~rfM@8($Q4J zC71O3*eIce){(0hp(Ur!zSA*9miX5nJJkEK=w#F7hmZcUK(S#_CD+KrxW9DoibKci|UB4i6US*zVwzA4!cCPWY z?sviVx(>oofGyri5m@skRxSXx_$Do2&5P|hx%8A5zlvu*sFial2k$rl&-bS8M||AW zyTD?XZWLJTMnM+4jQPM~SJW`4@_XebULvMVc~gW3_uf>Yc8;MpPg^l}q|+}OQqP$o z`1NC+-^6!WRsm*?ud9%)#zpU0u5QF&Cf!Pj_tAsIBs4_7`aV~y9V$%-aE?gqqrkUa zs;QelLwn7Z>)%ig2Y-YDa-rc)AEkV46_yyd)&J>LgdBISyrkqMMPQVNP$`8R$!F>; zN@QGBENZVN>=$AM9nai~lej;B2S`hrt=X3VX;}r3me~Ml84r+_!k9S!l9sAZq~&Xg z97sU?iQwVQJ<^8|JU~Fa0uSs!2^intt5YL+y=B{JPb^a zV$L7S&DtBd-+Ct{e8P=zHT_8J@RBX+N4BjnKe=>#&k(TJ^&hX=k`jxHWpE(*=^O#9 zKGMf}q>0FE?{Hku^r<$c`mISAbpn*x*f&UxjogYVF zfb&idoSM+YcL~j>id`eg4em3{UYD#2@G0RPpnpHQ$+m5lNNsnR{OF%vO1MHU?9W_p zNf$`eb+#a$=k~*_6h9Yjl7_Z{*_to#{74Y_MD%2!gZW~n5cvk6btVB?=gr$olqXo{ z27q-gAJU##Yu!lbT5KP}kQ_X|BNs*C&<;(j!JxYuchd_hcw@=xZGZ-cnW<%gt{!RZLVBrQN=5BT)Aq? z054^H{vTHfez4xk_^&3>5Caf?r}JAh+UGN#44KwmzbhtOQ5avBNaPB4JPp4LDQGJ- zd3h0p<8Ukwvd&n43%%^0H7k!VQ84^8Q9dR?+bM!E$7~z;D~vfI*ad_!vK*Ul=9;G5 zqK#-zdtLXVzCT{#TpyZwB&y|~W_G@Ls40xwJ!h0;#JHiZ&bEcwjrpaEVDOs2AU;GB zW){1Xr(n$h=jp2F5>Nz=8o4WivVMAa6H-UfV!(;|z96IIOAGbipBLgMj<(){Wt`xJ z8tN)bgWfFZPq^+G_QhVD*_{ZookoE?{-<6hC#5wT!po>NEU<(p3bA8Rzw_@}JNYbr zGqIs^$RSkwK*s$aVa)K#lP|`hlt{aMo&EI4#FHv!`kDGLx(`^Di<$)F^>+-do!4zW zx@tXI8qYt;oh86F1)pTDsXW5L&{bP9A&8WIPESDGf|c;VKtj5}Qk1is6~dGsZ!WEi zzxb+vgI-&^eKxayX%ljTL@LzL=0xis$nKyb6%ag^v>rmGAR@GfE)t zd4%z>^BNbIe}+x2{|=krfL)UeWY@G0?3%oRT~pxWu1Ox)HAOz|nxH#llX%p%Mjm%f z+%ASC-DitxkX;kY)2?a5=*#5euBjQ=HR%DnrnBQTuKbLaxH=5Ra@tk0A(&(kDFx%t z2wvI_>t|9-1QxFjvhW1oq6jkKL0`Xn#(j29wfUc26T*S**=>Nngo%!M-tsYb3yx%v z6_Fy&sOXAdF8Po?RG(Zq=S#p;4+k;T+cm7;u11i0zgvg>&B6lgnhYLyP19JTj`l|> zVQJfg4!o;rm!RUT!#(4U2M+Aas|zJo+fl!pD4z4JbaPR%6cji9;KHlg+Ab9{V3+$x zj4%cH#*8eCMZ~G}=3s{j-plVy!@d<-lwqs>$FqZzuQUr%w)trtg;WVuDXX zvhUbNd!{c1)K|Pmp8I*Ms@WsYE%>|7a{ZC#KB#au%nyU`+$2vtw`aQ5dl)@XviF+X zb=<%5M~$3Ov%m63I8>pIEH?HXVmza$7cZsZ8nuY>Yjvc*!fpWaN3sg#ES5+4qus5B zO~2$v?cJ9@8=)V}S|F_5n*CWm`~HRmD=0@S)*3FO*XV>2##kl@e}5bF z_s0=a(IqG#)_OKYi!^<=$C7#26t|EjP%<~VL*V;cGM9Q=)c7HUU`H2HGA~|p3|*cE z{tk$Xx>U$wSgeEQz)i5rPZIWRgRHlSwTQumrme{JhFiU-Ia1@TLLB_8FE*bCp2 z0r%q;2#`Oz0`kWOn%3K-7l8b+e5(=~h4l}pKoBB-)C&-vJJRnRFkaoyFX~cUfEq(> ztMCYGjCZO>L7Jhr?h~DDkvkR~B87RC^VXr9$0`e&cRQi-6*#Rx-Q?bAtjI_ukQY0+ zDgWhpBQawMT=$m>|4w73cgGYuML1_c^tvD^32wO{<{^Iiv@v)FkT|-3P;i1q7-p~w zGRc9nDznZf6fysRhzr)xs1lpP_O12UV-qRMq-~a1hQV*(bSe4 z>P*zxbM9NKnKTOQy8`C>PmmFp;TB}XMGTC%&X0f*R|7EOA_7KSMR->`ziqb&aPyP= zs&SJ#aT-1(@|=_X9aMi=x%)1#EvNZYAXAGroDSkCPrW`4JgUp|K0dRo@9;C=?< zb~Vq^6^Ek;sqR~+#gT(}aP@cNO%cEb_S7iEb9Z)RdplihH>HJI%y^*v+{jqiw)XBh zBa-nEu&NR@5h(4(ROQz!?yH_WP1U4vTS4~WEu-pM9QV21ptRw-m z@OSL*vg}VUzlFSzw`~6Fy&8qWHNThSBhvhl9kFb9ere*0wT9uLkDL=ClZA|+{U@uM zBo7s1@e~3IyQT-;LPBcAlTL)D~1wwP2{kA!}32{QzeqcQn80eiZaD9 zDGUjBx3%u!s^VUPzTyqSZvZOGJHla(kQ5lwQ#Gwpn;eXA$Rm3JyNM(6Y(AJ>nVJpM zU63l{{x-m3>Ln*?bs=%2 z?I$|@Fa}C(P+6MQUUvJej_PWv_7WIEi91CS%A1ygIQNnpwaG;<4~7Do+>dnBe>u1% z-T|gc<)d{AlFhjVZm6OoxWTx^Bms~|h{oG@Zm%C=`ML4$HKicYwqA>8x%gjh9oWc3 zq#lT1Rp!I&l+4%1k+-M9W@P(Ia<{Ci$xItSliyetTi+*q3XF;!m zAsUr1da=Y*v!JOaugI-Lal(T3Ex>=0e}-|l2TbNYF^%Sl{gF^U_QXBr<2i^Yy8(mu zN<3O-c0Wpq#*Bw(CLpgEox|ZbvQX(}JOJU1tJCs7LU@}`5T0+m9@cLPN1B66wJ3-3 z#IK6iKYN^)DXF3e88fXs!`hL0;PeaE{k~|aCsLDmo(^AM`j3|Ct z+=;*Jse~fy@ebs=hU85Dt-{ndUNtbRC{>g`W`_RYrOl0G-m?^I)*Qpgr>FD`#R@A$ zfcZ=5U3RJIc-1;2i~uT}C;yVF!W@vyr2-oC_KAVIAYtm|moP@hz!_!B^vAa4WZEPr zF@>yb-T*6`OUTNmXtm7Rufr1u(FZ- zXJumvS=pGQY*pH6>xc63{J0V|D<#W{q&L<1voX7#8!gd&&){FSQ2awrW-@_IH-)7x zOTQw?X+H>l4@tX86aC@hX`i^R+hlG${KB;K8&Ped!>Prld>GL+#BR)d`z(OyL)S(* zs%<&wJ2qqt$q$Sn6KWx2NCqK6(=PKO!Qc9a-&LBWAY(`>8EwcIlJQz8>TwL|2^ra7 z6xb8Hq-WBV^zeo}j%<*gMmD=7oCHkpyRa^y{Vaoes1)}CXySq@tw7%Go|{n|$h!$& zMEfpHgS{bjw|)_j!9ye*kawf&NY)gFFAzX zMpF2vBz~Q0bn#g+6wd+aJb-nwQ+ z0_xNU#9QP9Xx1D73(w=7s!ACm4X~ZbF==UH@22GPup~fP?>Iv$l2yJ?OVZ%sJ7;JS zP0lr^k;nC#$HKxe~qvppQDq2i6AyjKC89qY}6Cc-}kOh5YPn)jO28hUDi?tF) z$X9gj#o66&HCcg?%@i=Q*#ky4!FfG2&mBWcBjMa3Bb$6+WHUA-taka5ik;faKcDWa z-z3QQ_8V3-UO7XAIzrTv!2ud^GyGT0{(}vb2);blW|o!=(UP{_56yY)>hzUWYj&^I zt*i8u$y27utm+KnbJhD~CK;U7rWwp6tI}kWY$TEtvka0K`c#^4?e;2{Rh4dI;yl(y zX$KhAHO3W*isC-(F)4isinEy~U%~o>dL{(M`VC~#@LAfw0BfoE^H-`gL)oc!*+OfU zY$f;#-o}!|cjNQh*V?`fM)a4M@MA@s_a8e?Dbc)oVLgf=>}B;6d#T|i#cvww6Q^*a zC%>0tdHawSjGUd2fccja>HY@Ff(JD?rUP|%idUQiB(j+^}DI%s09{NovL zO<(0MxTW&I^;oDY`y-8F91P|Prbfpk-tS2~a*w!cnO#PF%F=;bU4duy4CM`T>t6;V znwBSoT-StL`;Yy(Vfi{gb6uc6r|_Kp*B+NLq(2AWdkFOBZS6lqU*A5yAhFt)e&JLX zeK_dkv}k(J+IzIfY&~hd${Br0)Olb_A}WoCUq;B6qjT&1?h1N|3IlYkc#i zL*!nqN6H=(`i;rK6QX+Vz>R3bjtodbwG)U93Es=x5c`4tnK?syF0?+7{Pd77#nOu8YbbD5i&2 zTzD?nWN?JoT3FyV4EpV=;1rQPluB3=3uk+x2)m3oR%o@}EPB%7W-p6l_g!bTyd_0! zcmj@Oji`I52mbbE;+(-r=fhwLks*%D+Y)FAwAJ%QBNuVQwcpt?6vtjmJeCe%(`O6l z1vmbjh#n<))kv3HX z(+|?6lLxwVcK?Lwram#SOao!MCP2{EyRU8$4iU7Kr3mA^aa3K_-;Zh_}|}#p?ju^h>Q?@Dvt$rumTS5 z!{*gBpRwSZ#RyLifd?_$fT*$xT6R^4aT*v(|)|bwgo8K+u7a_l9C~$Lf`0 zW&_`5AvBp*spC6Y^h@#%64g#Bm_mvm9W!S4Ah`k~3cuWs>It7yf1waB9~fsPhIg^S zoIqntlDZ))4mSB7M`nq-9Uv1MdYvCTmD+#na1=twonn;~wYPww_s`C{zO+O`lP3iM zrk%rJ^lu#B$vn}5KNm>)zM&oCSMc9~L;5uNhr43ZE|UFipBsjA?(Kq?s!&2@ViiVE zA)g|s=$i{Zf8iIC?`I7JU(K&m{;{qI!ix$AvZG|PR%G|36!(#1HW`9pHIo+z1Fq6I zLtqGI1Ao6&wY6$HCc}ffsP+IUh*ypdCQdrh;UCbz|Aq^=CknU^gV@>r7*+l`>(CeP zxLX^ratY@8#m%slH3_k@ zEzo{5zwk5f;a8r!?R5*?`lNjP6jWrMSsIl0p_@fN59PkM{oFe3*U{a1@3v)0vz{D| z?OF$RRWlE8Js-dT{841C16%L@NXgJhmuJD2<;8$neAra@aG=+Cnku`TSTFSO6fI0%ulV+E9*g9yUP&L)7c)^$ydUVm9@ibOPkwHDcUWUY7qvesP?)|%rWpsHE+ zhj+2qeU#5S4+>$~vj)^Qwq%KBBgoCX=6QvW*B`4~k`)ZPKRZ~m?E_g<=?lx1uwtTg zXM;);(sd+Lt{Mv`qYTkf2&mbh5NSDzc@q8~>lnet5gBe6A9f^4H$nP-H@RvjI!*U3 zzy*CY=H@oN@Ppw%XhxAJKGS_9PPK@26_Z}at$t#Wm}Y*J4WKhPDn`a;(()=V?i?i) zDve`qpr!Onfdlt=4{1~}%1Ds}kBYb}8XU)inyBx*mq8u5JFRu6KDz zTW2t&6luvaAf{_ci0NAMAJa7~#B|LIn6A5m^0=1%ZsjbX!mA&$QzIEc?^LDi**rYi zTaZo=g;+nSO60113Ml!bG8d&5jJO9km@D=69h`M(qZBjGg`fPW_~)!BPeN@*U130|-2@S8XNRQA zLGI;GxzfWPC>`~NH1IFCI`muJN{cQVTjYH7d5;UO9BQLZ4}KB)PF_L66@w%|xPq-l zfZ~r#8ezl(BUR>i?O^%o-*5%@T=dW`MHMb2Trq*Q zfNTwfD>9%mjh8NPLv;L5EGR334io2oF&5?J6Bfi=Cn2ngiCLvtCpxbWMz>q;2MdJ> zM&|Xo3-$?m5CPZnDZjI%sSjMF3otoSBKJGgG!a2x8ofV}PM`LF%4FGPz#<|0UMzBd z%EC0y$RFRlcD$3jGTjRyh-#EbDwkQ6Bm@G#W2jB^sy8>^$pgg*v2ux z=023n9x4oJv5wj&HKzQh%)2r2kx;=WY9UU6lV^bDaOP2S*bUJf_E}@Q;)Ck%veo>D zxWP|6zSU&ONWOMmzC(H1km*tLoDuQzyNm!44M2jVM4u$4NLcuFQy56S|CMfpggoED z`zzguiK@cndzMq?S+C{!Ahr{vaXel3ZM6-MZuDU3NysQZIycaRRf|437Zvsi2ac*% z1anJ(ieTfZH3B;*t^5Poz$O$sT%T8!rmEqcAd2lSVj_rQdpdelDgjVzI|7Pr>Fl+C z6x-BKifw}siv;dhZ&xc5$cv>~lF8SrSohuDyIs?TmZP+mRt-HjhD z8zf!EAUQpVWg~$!oqerZBi)3dQkmW?Il%&BEa_+^CwdsYVszZCr&ewiGd4vQTd<$)SY_y_| zfO0jYLDT**0(V70b3H}YBegK@ovM=080kqZSQ9zFy^<2u$MToc9n-frFR?w50(K_9 zJO~FLa0SSeD{RA@u&3^MeAU zSs!>ii=3dQdFiXoCcZ;<*X4D$L+(9}<1f;`QH(F^QOV`0h9U(?6Th=U z8{jIM58xikkpShFLZJL&$Lt{Fns-?etmbgG_|d*-s1OD(Ir(=2XS2+*(@M3^VRN~j z2sef>KM;N~a0kLKEZ{0PYEop9)wT&B@R9%oUhKdNZh)6*N_v}Q69~A#e)WX^C*UIB zv~@Eqe!lQq?ei>{!kroqG*Me*Q68qiOsZ7(E=3gcoC0v2DG*(%+1Ah&s4na<)z8XI z!Kt>#4nK(6&l^RaLv5^GpcO5TSZ+G8pdSLRGh!=<>#PWHo$1B;)R&ikT2)UnZ*3kg z-~LGWDY*G)vfaoD7K4F<;*U>Seq#A!dHy-!D2YdrBYPdC~+@$UJJ-NzRpGw>47wJh!_+h2|g_|NWrtuUR2jY-iBllyj zk?lkJUL-FRefMG#!OB1eer|iHgf5E>qWt0MI&PDRkMSHN*C;s2ambN z$68|rP-{f^;Gqu!a*b>!-v66xobVD0Ke%Ga1agf58jrcgrxyKNEeuhmYiW`+F5yLc zjr`}MccCfc(P~&PlNa%@Up`yCGFh;zaF?Xu2rC^B!6W|so{Z0S@%2(pR>*zg@SuhR z*JfRjI12fToi`36>c133um=VU(M1RCcLQBm1EyJb(9o5)_34IS5C2hho6Ox@bJY~5_QbQ57 z>oiY-S3rCnKyUNs(d0TRPES-TXsD($g$A5fiavY%&;#3U=oT~hQQ}wDk zQ?&3G>a7W3cqBpqP7I=Di!Z;wiKosP%lB!0%)%K~(YN>Yf!ZsMVi|@5Q^Y)(9h-lS z61K_hnzXD(>3*l}>+ne-do4W**U9Izt^nb>8$`JN6Il5H!gXzka9teg{W;U{loSis z>Q*Y|qi|ggB3#Eo4m8^lJAMxnNcbV!blz7K^3)k#M~C}+ z=nCai=pU7Wg76|tl^fAe|j)|ds{br>E?60epah#z>*inb7B+*T+o+TuXkVrf6O>A zdS3S6MhDmlK`FoLlia5 zo4Ylyuisu;_|dUf;&aSEFmiq|*=g?9$5*k=T=oGWNtD`aX$sjM1eYCvG`2n`-zBQWw;}v|xW4ICj=%XWL|ZjZn{CA=wQG{V3VfXI zeP*Whli!cjo!`SEd$(|plJ{1o0uaQvC%3711SOi&x)NkSp3AWy59rEZ+~b6w-qP42 zVAL#XE-h2Dw(!y#Exy3VXL8^JjRjGpmVCNfSk=I0Csgn4e!{bxnyOW~3}OMqrJDAw z9Um%BGm*ov{w=rPD$;a5{qH5~Oq#CW(Ah>1?_979!|%uV_<$*VfxiV0evk!N_11r5 zXDth>POw|=@FX#wG&?=9oG{7Pn8Yt6(C6m&O>o=A@8VgFW`E%w-+&;cuOl}xw6IQ6 zYIx=cUrE2uHZWIcf@^+$ncaX_lY$;Sx^99mDe>I=RpTvM;xBra5b&51HLmQc`NO5- zARIxTgW>b-P3m#vwcHOrN^m4`h$rJRA`N?NA&G%EzuR)RxP+>PDtnMU{vZMMDg%4J5S&?GT9`LGhF_M-G&RQm} z>6?D(mFsBYHYSrmtx&H+_02sbU(E`mF{iIHA=EV12vWuAIbL?Mk{Rc$!BWl?hxQ?X zO^u+`P}qF-+OHL;R~ZkoG1AQHI}uy}57m&T>suQSO>4q!(EOa>WjRo<`e}Q~cP%~z z-@g%PLNJ-@cl+k>EZ|w;kq+N9#q)rWLSG+foLq|(T?T|*e5P3Om-EfQc4WZy zR|-Hn)L^lG2?};;S(E!wW!#QHX?l-nD?#x6madnS&YPO?P#ME!Ny~itb#}g2|9t6O zP>7UnK+Rw4u$|0G6T~_!w=4mh_qK6bIz>t;7f2&r(t-%m-2&2G(kuidr6iVgcXxM5cMAxDbTL>24HG>UGx1&zK(my3 ztM@owV!;!@S<;3j;vp#^XB!QL`GTG*ukv?n5uX_gzsL-W;1-&{%q>4k?kQz9ZFe5g z*;;xPnShY}>Mu~;BNc797Vh&` zYj<%-Vwt51SUv&F48go!Kk`nH1U0!@L}6wIIaHXLLHgiJp9Y&0MV`zX8_j74)U9PV z;?)nUv3{D{rHUlSuOiR$!AQF`ExTk$ukxhtwvKI?6n1X~(58!ygUjBSf+hMKg{cX& z$MU2}k!o|=_qW6Yacl!)JAYX1iQMWZKc@KblU4y)irAJNy^PZR6K7Rsc2hWMbhf;a zP`RU(fY$a3OV^tytl(U}UqyG4)%8 z$DdmgFB2DwVx-JFYo;~< zz|6n{m>D8$&Z8;G3JO8_N{NoL5UM_0&EF^25Dta$gd!U}zF z{F`LJ_>_xs;90oCcwo#VK_IuH97*nHn|Y~Ne`S69ex{gr6DU_H&z-&;&?7#$PI+#Z zM}doib1vvS3bq4=>D9zuv!fvuu9o<$-e3mvN9$`udwB95n%!@=F#ww?WLl`V6`={R zsX_poYVsD$rutogd{h~^ALJgZ%N^{%?3%sGF-{_L8vU-nw!*RSfV}<9TEyP;lR%ii z>u|B}lp*`gy6DH+U#5yQ6I-ewD%8iX-$^Whk;bVODzO{<*&Ar_3X#g_{jKG?8yRX~ zmakoSE5-Eo!vwL;vujSN$FkJuK5#@rFCF*^kY}nroOsD+1|O*8*uo_QYYV`R>PKP8 z@bq=16S)`*MPv#s32*rJxR?c;n=$Wgs*E0nv{JyKz554S;BjtW`Zr^DIBsM;ECPr4Nq@)!>M-HJ(gOu;VXZHPUQYTci9g7VHUzyl zH1slA5L4Z%mT^sNci`B^zkU6o$hV6>YCNWrW3^H;S-#^EnxNLY(}O=_q;ApbPDjWy zl6(<2|B1maJ-=R_FEeya@Pc_~qhzPxOqpOM6Oq7T=Ho`7)I4NG0!YnI!!HRGN2JLG zV;k(}KrkgiG?dC-PD_e59|L#}8%-&-+7?zH?L4mFFikml@v^m<^vT zEcn{Bx}suPg9Z|%@Xg!kuQFf-JYWu_)nQN%m_P)|f5^58Cm?eQim5=|AHIP5LydjZ?%w_3 z3b;QGhfpnkZoTT?Kn3CPiBWH}8{y0@{5*S5AJkRWFWn4Yfzg_#ptPnBEpC5kO**D; z9bmMkOen4Cter&gda&ogxwckT%KJtJZ@Sz3;%8~=OG`Y20wa(gHf;iXs^W`NoxZom zbRq{k$vX3Ch$m01H-`iVe1y2k_MNa556sPj)4vw@Y2Ep8a+4hQ2|d*I{;6>?2Od+$ zyaZ@XO8~7&Y48uNX&az5O?3p6t+5E(L^1v(iqn;at3wKc452wit8JW^0Bl*-QsZsaX053oYFXUQjHxUE(;fL??GAfuDa3Yf-Xa!Q~jOjQL=5rrN!Z z-&`#2q6d1i7cZt3b{g!jXUX8P?M)9gxt`Cpx zY@3l)4hARIz-K&h*FSq`|7^pG48KHiI`TuAOYC>I1VJP_$<|dJ>q#+0n_+qbdlmut z+^*~P4CVGTR9iZ1M_GeSdp;F4j1Ufez*wRNGnO#^V=U1Gj3xY;SV}Ns2@ZWe%vi#I zZ!94Lj3p#Hy7*7j+rfH(vcy`=Y8X(K)c4`gzf$isM`#|Re}#2fW*EyM<6HIsZ9fQ~ z98Uy`zKhzZol%7!83PS8l$g=AW@Y>R&;$pgSO?^d7lad(c3x*>rZtT0Z;OfCU}XCJ za5Xb9)yNAGJ8p-MviLncg1b0@2;M`i?pk>dSB+ypVCNw04~B~)xtsOi?RvqC@Qpoq z+5rD0tJL$XyHdC8_m-co#9Bhro=z?Q4BbxmFa8up_j1VmS_ZkKb5wNbAz4c6&?R%{ z@?V|V4>q`Cs!!&)&TfPfODYm5QD4s*9_NjJn+osYlk=<*;_ zMx?$U^-925DFW?pS=pc>vt{C4bd*`v;O-{()?15OiZGxf#t z9817yGLzM1=Q6#wzqN}6!;}rqJq62q@d2E&O(>_#2H=$OKsjZs`(qb?)P(5`Gompw z(?>>|6$a}~;qz?$9V_rguCS22_SBS8ff)gigP*Df&gbNB@NjZ2`>=CHx4|yQ2m=*! zHkO(SaS19#dQP-!(fgl56w&!jJ)!Vfs(bhIt9$n|4b=S%F`)P~C2P2^jJ54@N(QI^%m5X@rq>u~961zvInMx} z{kTzox(CU81L6lW|NenK_$)T0w|}oxyZ+WIhEDj^(b0vH+^;vt9U5D+Mqk-DIBJ_edbXM?nyL5bumm7Xe zv~ao>ZJi2DmL$@n^+qPUOU+Qi!*PHkD}5&)Wk!)C_*=)6?`Q>WOaGZUnb(I6DdX_` zK7D$wIS<_Zh*a<|&iK}4BYZ|{>Vot8IXi}hwluuY5WlW!=}UI8(2+sS;N3M zMh6aakaM}b3K5xm#`Fw7jp&^fQ{DKpUTm?8qEfzw<*(#(5siiwSBpZEW5N2znu^65 zEO*nd$(}xN_X@3S=g&%AzHsv;)@Rvr8q+Q;PH^fWzQV0+(39aBEqWku(wjD4&TRKd zrZ9skd%^V(toMqTE8f#{zUm7-As31TiuzwR8Wxm|whXY*@QC8ZoleeO9~91brol7y zUxzwy7krT*X>Q)!>)xg9dU{$%EQuE-MuJ^(CvGet{e(J?h$))XE1s~Ze3i6(cJcv> zD2~A$ifepp^EU@k6o({8hZ|oorynnUQYweCXdp>`ah$)}H?L%Fw0ZL1n>A~7&pFjR_ye^ixs}R`Zle*mXnpS z6h!ULFs2-w(m&zKa2@*9oJ-jN(ku_GvTH5jl$J5#XzH0=PI2>F2KW7cJ$1Hteq9Iv zXobro#!#i$*w23G33-3|#e(9}C&?%cpGt;qbz2eR^3 z97Sw?OJD?_0OuKPN<(DswBWW!4eBudY{FmuEONeciRyS5j6X~9_MGk*2B4)p*|dIX z`_yJXkUXkv=1H>jS1WEPfR^gr>NylZ`wTEjXXU! z2mok91fh62=um$1`q6u>Y~C42r2>{P-qFD6xv=Wg_aOXp`|QUoHdv| z4wXjZp3#BQ*c0-&hoj%eO7@w0bL^uoSVs1{}COV>c*GEcjUyZJ>4zb&8^ z?i|!XNzIU^FM>=zZ=%*O%HIQZ{nP-ipFNoCr(Jsn!S5o#tl=}Mycr%9SGTm-$vg4K zlG!lX&kaoWGmV>#{pPa*9!lt6+0O)2_A@{_2$e|SJ6e4KBoZ2cL_!geNb~^`35wv5 zzY>YaynBfRRfgj9cdKdz$Q}joG(GAXWMuzxHyBN>;BG;-^hw;D-RMnqhMmK0`=UJ9 z*wPHm+LdOvmgU8*kc_lAhGb(o;D`P~^vYz6n*#7dzy4u@^g%^*OT#gfvhQn5UAP^; zq}LqIh}jS5kbP%v<(YeAIiP8`$f4eFftQuzxAA^XCmC-ScQIpNc;f*N_DTIK?Y~sz*~BA#i-IjC3n}JpaCVf^ZIXr=}uu47OIVsktKKX?CGk9$&Yg}-UqE* zc#d)FQp+v#Zod$fR|~Vnr4W6zP({#zwR*LeJ}zLwt_BrG;QtXuxB$Y4G}raFao3hA z0l)CFytXOe8;e=NHz@6R1)sqUzsN8idi<921%wgQ{}M(Ne1-}m$^c=+3QQQm`$rh@ z3M!0%$L~q}guoO;{uFD^jJ`Cp=iS!C7x~@C3*m9@m4Gl}(kSiIO~u!?_c>Cte1oFw z`D=)wKorwl5L2R9BWGq(O6L(kT_qSy#GjjB-zYRwB0&&B~;D5<3RX zTouG~4j3ERv^+Uf!)$4{>@%bjB>1i*Jh~?I)Y!gUcZBd>W>=3KmBQJ!E9}x>W+r3YP-04HmE}BS2jp~F5kdJ2dvV?UDPPd=IYbSQTnE#CnLE(A#FK0Njv(#82LIJ? zZ`dM~@&9P*;++m-Ts|Vcaw%`dliHy-MQ!C?Uh7_5nKI?luX2)ihaRjYC$2c+hZRBr zhOy8ehH>HeDwo+Im)Z2|C))|5$q);~fr^4$)A)ym^Hb(2Nb>G6nBj|P(!XP{BlhAZ z$4(Wx2q*d~GMT`bHc84PF@=o!R-!O-$IN11d3Y0YX9B{+e0jOq=0ESeaz*vI z1|ky#%-haB7jipK^OQ5hzcg+^?74uJx(Y?ION@5<3f8ZElAuS2HFe$mfxCn88v;0E zwg)l>hJdMy;IPlMw6dt~$Ck5w4@b-A;SOguxrv;NdIt7#SKg@vYlPRMfq;FJ-FjB0 zdMF`D(mJzr*6^t+(aS4I{u{(*b3d+e#K_PY;VgII+}M$7kvhP>X`ctPZ-Pky{iekA zTtfq?ue@g5(YADB%7!^H`F4x)jqecF%dD^dziylp)EZidM2$Ka%tTx^v-`WtBnLy7 zHSge7q+}B53pY?iR8@-;_)Di&-E8P>Di!-4u|RSO<;@++-dGgo6g!CMCaXCxJH!{d zUCNP8jOg}3O8~M1h?y`V?Kn}FT*2) z8U|+(&uiRnMOgs*W`&aNCCt8A4cIr$(ro|QH)lw`Jcijf&7k&8FFVNyp~|BVw{eg1 za~DfOD5QaN7n)gp?S*Xj@X2}|*`b^VcuK+Ltn4kA1by_z{TYONv(57rnY-f%ds@U$ zfIzbNq=%N4Azj6GTHJ5SFxddl3Y_k^RK97?_osx2Ep2WEJWFtC4;{5lJQ=};k=L~N z#?@t1O!Wg1+G`P4-YU_Hm-iWg{bp1F>JS}AqJ7Rfw%12 zw*#8GE+nGFzF#$1kFT=yqSjE!oggz;EZ6!lsC~szBAg;Vef-YNJ77i3Q&R$tZ-v6y zY5dZzRWY7Hn~?@T5`&9OG-+(p+%$P{;UlDyU-|t=#X=cZ2_YIg%XAF;2b?p{}sfjCV&rHqi{61QkF58jxHN-Aa3_BN_WK69 zM@*dol(Z_d4l`I32~0_D_}D55BswuyiJ#zD;pZi zK7Q-&*iwbMAwEl^ND4?2;zxTEwmFz_++ ze_QJ1FOnLyL>^FYN}bhSWw_HBFajP?#eY1a9DqmEmILsJ@)T<5*-A_tPP$_Hc%mAS zzSITl{S}Eevpgu^go;E3pd!(-KO)f;VHWglYycAN!ab<=O=ip>%;wFNt0bicx}z_ zFDzeeMT|_SIakLp%y;?G8#-GTm4pFpbw7IV3P1X)>*eI8HgJVi&4SjWm~2|YLZW1} zt1N*`!x-Q2*WYw)!rSwsG8nRd3^dqQ9!#z4XT zrNH}Zbi&5U%ki-$ENZO~onROC;BDjC2S(1(Uv5aPm5PwcO!mN6iLILDN5?==rNThCo>P!*jK3GRAk{ zX+!lY-?MrKWxs+qMssxEG?!IL=+ufXbyPp5bGd8KXu3KREB!iVW+?P6$nF?O^)6G& zvDHsOT3?gTi$h~kMa#$gAaTWl@z{IX5V`5}J4N#6-^!r*2c{#!ChBsYu430SuK~Qu zcRrFE)VbhsnBHaJ@{>F5eQVvVp~@#0^FRP%8wvbdb>9JA7phM%WZY4StC{F! zI&wM7dGNNOxcua`RxZ@*f~WBa>fOCUFM$N*sH(cZe0lE=RcAW`r~ymH(C=Z zwYBF4ye=mfTW`7#J1d0npx z7A*n+h5zmfcsFMS;nsjk%+(y9z@`{N#s#yk44{s_YyRoWW5k**0&DF#2Eli#?~X|f z=RlYo+W0{lAT;qotaeImu{QfDIol5;@W4`BcQqm7gPr>k{WJWf8A`C0GjEV;bGV`N zOs3gf;pR?!gips51g`zs(dTVzWzBD>I;I?^jlaZ)ASI61uR=w)1bj*-npRn8e z^E6TegFW^-Z7bM1fXig`MjmdoY~LN@WlJ%Ie{2 z>4u~ASIbpro#YZJJxcFhkiR2u4%@Wu8oC{ody0SFkg1FoKh$&fHlM-&%{L)&9LuYB z;-hh=F~Q*x22-itS8;?JKZ20HXH9o`2kD?SHpdtxS!UN2y)J*X_~gF0F5K54SNL#) z6hbTljP3y!DazuXQxr|X^$1VU4|j;azk8T&$nXpoeT@rU08`srk-q(B!T^*U2P>zW zP84cQ@XieXEO%K1guJ$uBkdGW0pv4407;8Ax$KZi0TS`*?JvhxB!2l4`4l6MQet6H znop`%BlxlJ*tDQ_q2O=IQ!xhD9j&*AOJD_cr5|X_)LA(iugy}df;#h5#2Zvp-cg8c z=FN1HW=wu~jnB~W7LQA`10qw7>qPp-F4scSkFRKfP~9*b>qHQjWapLH(|+PWGo*Hm_s(MTdJ(q{JEP)AV zQ@*%KpiHE?jU!6STX!bf)5)5A%2#_RS0Y?@vsG$^#hi{+>VG@^F?ZSYwYgcl8Bbg< z-h-3XuT1klGZ7s)&A)x3jAWpDVrlabL=ulbgD2OU$9l6uV(kenrwfOL9dLSE^I?>D z{FH|I9}mB=Bo=Z2{zq-6xvO8`?I=macb<1QrfOzmua*hZFf$y-YD(jb5Zh}q zj0iz)p2w6Zsuf$zppH-deob42-V*)8sU4f`R|@NVj!f4U*{kGdn|%dGSgTLJ8YaFM zs}p_EDyZV#`=%!ZkoD;PmGuk*vYv;fj|Y{&Vf~T9zE$$KPv6!eo*6Gg1jK-*j4IU1 zg9WwnctWi_7(_Z;qZNIS$BeSlpD?dGPkv$YB0ULCHd+`{vV9LodE7B$ z?DZd!%nm<96A0v!>gh}v{9e0O93g5 zdMw5kt;iXpYtXeiQjbBteXy?%wWSgK(ioLj9X&6thf`%ljNqUYCR%FRR-Y{;SDMga z*N=~u=szYu7`YJLAO@DS+p4k)@aa7?lFJXZ8Q6a|YH`4pWRrjJ5Z$V%E^%~Ht7w|w zYtC7qmh}v1>mfV7GkS82GrFdt)w9nuWKqV-W{{uU>@g)RiTp(_G0{R_KaGf7uKvCA$zln*+M#9vnVU3JbkaA0GvbNU+stGmN zs&=3E&HgO2a^QhnjykbQJslU8oL+b z=$mizB+v_ZuB6N!HH!n4x%il5f0Xa7=R%px-024c{6cc#_UyQIU z_BzXi_|9)d@!1t{0r$wqm!F<){gQ=KGfjdJ_cqwC3y?qk%~HdIU@o|hxia%Jv8hg= z>AL7=Xx#qmh#ZcDVKaU(?F5Mh8yWZ44Fb10Esq&TRjnoztQM3Z{(Ny=f`$_%>$jR} zXQxcjVs9GxhoZl~j`-YOE+D#xrzCkqzX8ODB{YZK7{etyT(?zwvg%rwC$5gXQR!w%JipFuzo~Z8 zMCAj9?2uPKi7q7G1sK{XI{BryeqzD9hf>n)uxMc2yc|6`27ze7 z+nFcf4vd^lAC?6X#}Jkt)oN@+Ci9(mZcttCdC|YwCHnwI5W3oRjw5t=(abXJ+M_)F!)qeBxu7Bog*m;E$(j^isj$Am)uZ^zj88yk$S1l0k#+cH!%<(ethh2^E zn>ef|*8N$%c$GSyb;fahZ?slXvGtR(b`GWaVVz9NLgqiu=1RQRg|C_q(h8%w`Z zTTvyiW=sVh>vTvQeS8qvr)Z5IG1@OumGa>e=Dqg9fZi zy$K`XErxAGyz*x~WNvGKak;V&)nRKb+f~w%TBA0W7-PcK z%OLM@b2EOg-cn7zw#-p;JPApK6C)gY zlv~%TH)Y_GNT{u+VqgzeMkI0Dr0U=67V$-~> zewXQ|zo^Y=YzRi+mk%k~m`;VI3@ngM>n9B-)LUjF4--0c$taCPw@fUy5NBo3T4Os6 zx~Y;auB$vW6(}d)Kk#A;>+bPuN0;)i(iM3kS}s_06=z_{f(D+nBuXpw*6t{@txuC@ zUAMp{8~uL#+oj(Tw^pZ+Ycu+G*tzI2N{dZ`^tUQ3+`ZA8g4`ehKGTIryReD?O#kLW zq>+hTDj$w(!VQbeN2GR+a%iEBb8h@J(>RZk(NQE^#qGaXqKiiiq*rJuBwaDkJ+3iC zq415>V$%=$Z2S_elBx1_yvT2y#5(er2Z>6!a(otTfrN!gn)v>LQg*Lm4ujwpG}oTd8u^_Tnrp8&=)Qsc_zubk1AKN8D4%@~#%FigGMrF7H-;)y z`=JWe-!?D5I|)dd)wc6=6ua9;v@HA#H%PZ6p|dpTv$n_3Ht#$vXS~%izR?!GJ#w3` zD2Y>&SOBo>z_dJ74dlgLpLgTDfBsSFcVjfs_={8^G0tb4kJi2Yazp3E)=1u=5_ps? zxN%^Jjh9PlI`)vlSL(2KlfGlwKhG>c7emR*nuSGQkDIAp*6mB=I1m}P*bmJzkl>B7 z)Zv{wq63Zt<9hx zH9Wf_xTAf)zzq|piq^0e_zS20^sx_qbgNNHLGJ^x0o|4X@!elOJI+6RcI)-?6FNoj zkkua>!0G$t-_y4u?DU=cAE$4@dlFp!enA2&TZ;hsN8oYfX?o` z{fEx34yCit{7!EE>`qf$kaWN%tx!IQvIM_jTtE^vA0x3MmLQSU4f&+i*~HaYBRY&e64qk~-s` zauO?hJv1s!o?^XKnAXp(RP1Hy-`sm8Vasa5Lq(q6**zK(^swL64vRv1K`|d!v{K43 zeGK9jUn8kAK$Q5ijfR-=bQzBIwl-S3y-(!Y?R8Q#!H7dpbXPrJtdkTZ^9)1>-nIYq zg%~jhI)+cZ7JR4jZWS2Ak$^EA0T{#K|BT@xtroepZJ*$%@XlE5tmnjdt1llCpdDD^ zG7CKJ>eqW!Ua+HBwW)e~cKS+WU{HE+_9xR`+}&G^2zI4-wMEyvRDy!) zH8Syn{!M*mpwyM|`)6wu`O0C6`rU{?rkzESJn~)EPH(d3H{zp_2f+P&DrpdUKi?*_ z{2Vg%x^wORelGnV_w%qNFmOPp-7CFkxZ{0bJ}pgJD*7yG#vuH$&4mdL2YoybK)6%r z+nhSjd^><5+}(y({|mz1JvK7Y>Kj~KAAoS*=fErrkmp7L5bj%>bvTT_oq+o}$;nfE zpJ*L|Mk+%Zs|$b~R|Bx)sP5TuU?|1?mJUN8TdByB=~jb*w~_X-@7I;;f@!>e;Bg<- z1~dMF$4Nusaqm}Aout}EgxZ3MsEl9(`Z`SC)*tiM>tFh|=q=T3^CC;r+u3@XY2wgY zzP0bzs+R8K8c!;i5$7%sw#|3umw4^Q1-c=vOoxrqC7J0}G* zaBep;Mf&hgG{2M&2zZUtl#t7Td-F>FV?YlNJK*v*;>9Qdo5%nII;RtCK# zBMzi=7Nk!9;Tbloj-uH=mu)U@#%SQOeaM&1-C*s`^FhrGdf9f)Re-S00rJe+D2Ub^ z$O6&yx)Rbm2Vz4wT!dWDffzBm8`*)}wf@HOEND< zpvPPi*^P*I{Nl_eiQ&gru8Ph*OU^p6k4i=TN<}&3wiRal_nTtKGy+rw1qVLjPL#+w zf?UTl-#P8dDS)qY?Ofl~X1T*s)HDO`nr2C<%7nl7_Z!6BPlkvt z`Qg^BWRq3Dbh+YY$rqGv*2Tf;b(#jvwUh6lqv4rXKc6n>pw3oPuvS;SIAt3;Adb%7 z4~VuiB479U?b9bhw8<}Rw%_YLV6jR%3`^p%zKF!A$F_scjn%;1Sjp4e%CzVzfAO8= ztQMm}lfrTZll}MEIl9+yA~#^JO^_I3+$`~sIO}$QRgVV-xN#^Xw_+?OfzNnMg0`huGZCs+up8vWEmAIHr$ER@#Ss| zQskERCCR6?7Q@WlKhK|InqwP@73WVNdqlIG)J=^W8ptl#*dl@kvR9DBIuaS=56Wwq z6XXr?f(^1`-FqQCiy$UVs5b1Npf3G1w*smS1J6uvZ5VF3APUiyl5Us414E=NFho*x zL5D~R=n$!af?0m$n(O%KTI%l*nd)EO7bSn5|E+>!AYtTF%bO3ZhkTHxMGyVI7;NBV(lWtuAVT8RK$D;d=W z7D=svYh}ll)Y(OMMoZ~iMk8wAS{ZUD=9~B&?4$tr>In}V-$$?7s^v;lu3HbV@BIl8 zpScklk4+n6M+KcV5a)G#<0kgp{2LK zXAvL~n2MK0hidQa5k^tw!?XoS^!X#gPXE!}Qa|Unv`7MppG%Mz3u@N!pCB zyj$}eOfX?Sebq>Ay+z?iI^f;G#!@&?fPeQB+A3XRayr_oaG-Tg#F-4=r+Xq=urT<5 zZ72rFwCcj|``{T6u~l}xa6Wg%v7ENb;>XmwD?C-&{^Cut*tJR9Q$^Pm>vT!01x>Z$ zl&pxG3osCBn>{jT;k;&NotO@?yfU14T!(?^e@FH``}cbXMqUyrVb)+rhgD5%`_H^Q zxu50KAy;o7LNhT0qY6aEm=$~aV<4<$Kj8+7KcX4Yd;u@`7k^~R2;h%O z@g1VW$lBO7MInk+AYUYzqJv(@Ocf{)Av_B5wi?)7%OQWowVIexT@uYOv5J51)`)@U z2CX8Bl)pLorKMlo;&_HWjUL+++@c5N{9FVDKXccMYIibC!Sv}+UMQQ!$p)&3sv#Zy zXCE6=_dm~$&MzF|&mRC;iZx0d@D7n)Hq$C4T|iX=?kdBv=q-dloTA7LXP;<0S*HeZaE3F; zk4CBfAcYctz}!0@%ltI#9ihmd%Mj535miHn=$}vgBKMO6+3txy`=qgK0P!aUApUso z3^YNBKi#R^z;zHH{y^R)PqW~~%@q}CtVphT4rpuMBY&TGnH{YRm05UVmyqP$S$_Ue zIkAgW@fZ0U78UotDr;u!Z3P(9{PbB(xV4Oo-+yKPKKVEE*NQGI8RGQ$p81OgFn_5` z0p#z3LOhZL^CMy>JawYUxdH(Bt44vHD)^}`5sLf`!EW7NtACIIAb*je$X^}+`RmS= zJYA!HKn+9wN{{n^Va(qwfceXmwE#E8x&knN@y!CW+o87c$Y0XdSSa%MGD(SSk-Irjq_7E!{B8IIAb*eF1IXW&d*rV}^eM6PQk?D0=IZU4mhy8&pwYi3ru{VBG6;jG;Q6lC)J_5gWd5 z=_mj?o%HV(P@4|*3JqY>0smK>&f>jJ2X8$Qrqc-mbUGyCfKDfjZut#VrxTFeAc`V2 z?zCV{`kxwuf%lEU+XF6t!IJ$DUkrbW*U&^Gt!YsQFLyCBEYVos{8MU&L3e3zpSkrZ=j0W8a{8l6*;iMdO?muA2mJdQp%=OB7r7*`A|b@MAB(9I zC=#xV1(~~)@WG0N{IDV+?~9xr)n=Gw=d*D$6DPoxNAI5^WaYMSaADM)FS3pxU+Lga z=C^dnd#qV~C$LGr5!Xm$7oD64{vRH}+Fk$aBiJS$IFI~yk6_pv_z?OAPE;@BtZmOyn}<%070Zq^LJfP|6m(f4JFV0# zp%2%4pqe}>E-68q0(dan01u{5kOcl;59Vp%dv}aMR9t+;1B974W`E^Sc{W((r~;@Q z?E;mf26Bl|pmHP+MtaE7iiD~LRE`>vBH5XyeH{F%uh5;-gXRk! zC~*@^V$0q135wiI@yk7quz#ge8(Pm1EjqvB;l;dM&OiUd#_|YxuZ?1+)!sGVX698s zOK)5$3Mxk%Y?Yb^tWud>p6yeZYlbN+y0Y3bnhfI9pAQpRYi0&+2{Oi+455?KeIC zVFljlHx|DZDmcv>&yCZMb+{N-8_+RVP|8|?Ys(c08rb>bv;_!Tdyc3=453RSSOMl`{ z{y7?GW>Ho_e(D8mx;>T^I8;uPI|f*ackLiF8iTT+5K4mq8htzdP}(}>*rN8w(~BXm z*}OVEabEUZ<7tJif;$_afDlg*zZRuAr{p%v>ZJu^yrK;MEkJ~I~L*?uAMt}tuANV zCq*(?#r%7{6%_ZfOmiVEs4R0B6``*HtfKFz7x^}8=ba!Fy?N2eF@Fi|FM%JEEnEKT zvBTH>Js8K~jby$#+o-#*Zj0pcvUQXF#BJqI+R2g)NIOkvks}&<^bE&bzW2(S--`xz(*8I zn1wxoTL~YwTWR@(e1_yG3%@`Vb3jiY�l)a7c748DM`tDl6ltD}K&LG!XE4$?bJ7 z8zeFZMD)1U%~>?Lcpi<~{0!}6t~01H*lF`^!6s6%9C-?)GY43n%E{Whu7rpQIDemA z?7nMDFFewY{~?F{afH5l%zB~`t*YMxGgrHSEDR!^3t~XPz=GK3g3J+{6n!8Ixxn)D z*(C%!55x#6*ouWFboe392!VtSGLXD-+|XNz-S zWI3CWIk1o^5%!2nYm%ZbBYCy@EZ13*c0JMq9d6 zzN%$n6Pq2lRrBGKS;jz3gogHn0tnW(Z2p>C8-#PQcGYM_ zWE;&X$cqi9#^xXRW@q2t2iCY3AcCF3#f%z1-r~L%Xw^leYTW7iD932y_PtT)o7=1U zGW!l52fg2m;w)?YZEj=dc#{l(B4X+E4#nli`idXM(lX0e6R)C=9ADWFoDcuKQuTXf zmU(T6(98>oyais9V0HT^_^-aV!linibB_#Y$LYqJGMO^2FzLj4C$Rk3Gmby$zRe%E zB9QVGLQ)*bHt*Ccu$)=rWFYg3XWSGW{LyJoZrt&N_xIeaE@qt{yXxxO1lt4`k zu|b?!b+|X%2*R8IB0)&tfk-8Q9)pEZjjmtm_x(&abU?UUVoBSA=4~_zPg-6)*Xk4L zG{6xw?Y3CcoI`End777!t4}xdG}50470tHbMRV^`jhRp|khh6d+kT>*%hOb(Xq}md zKuVkth?y1d2&WkeLp<(?(D7?E>`j+K^EMRu;J2;065Hmjg{uMMso;Kh1g-sBUG3b| z(ClTb%d{roFomK~*2;;z>E(qB6+L*T0ip*ZlILANeVE0(7MjgEj6k6^xUe zmpZ!O?M1?8yT3KOhPEq6EVz6&$&<)8%qKoWF3XuXfC!F@wc64nSOiBXSK_=ETcI2O z>UCZQik~-%rngY19aT#a2oOE6GVten)#>NE--{mf{b{Al9a5E{Etwt9E8i8p)5Ukz8pOr?>p&3miBaXPtFlKuVElh_G})h^Ihqg991W`_ZQLdh zrURc)Z^D8!UO2Z+qFVg-Kq+#iv)RvS+38b^Yp-hUS(D01YS253ay#TbpyVVjO}57(1IE-MboJRA4G<79pc!zJJy>*W;V%^Y{<@YxZe zpx*Md$^711Q?p}_^wtC8Z>)7yK3)ac+sM&8X+S+vlH#eo2C#-c^*7BrHI${~+dpS2 zI0Nfmf2U$K?=D~=E&tQwFpwP7b*7yB^#5+~0jgR5$CJ}4Pw)LqD2rIHFujd zee8pAqCAe%q_HKjdbx|8h#k;066pSkg<@($mY@47^<$>Fa7gxVPUzG6%{;1 zv63}W zT+&RU7B(`=g*XM4b?{_KOcr^>W6;!>(cufuV;dirgg8l(zKNp>yX%@Rw>CF_E`T7_ zSA*1F$6AkRWg6n&Oz{Nt!=TyJPTRnNB@S!7hQVq5x^7&_~o>>e_^VOTIK`V!r0l zp|1a0m8_@gYv^ZP>akUqg&}9o5c;nmR{osT!w$la@3-5^8!^y)#npfOKis`#P+g0b zu8m8A1$SMzySqbhmjs94Zb247f(L?Ia0tQO-Gc>!ySuxSJIUT>pVQ}b_w9SDyFU4| zikeidA5_6&jPbtDQ^$7sh44j&npMtxzB|Ud_-kCnI&~Z(ST4;a#dlW2TKkBm<9FhA z8XSqobs$`*FpfmTdSHK@4VjQDsRQ#&k;lq^ot-Fa0Z`=ACY_x1c}zmzKYQiO?S>Db zlTO#N{`AUy6PN)i`9mDByDHC>{3)Q4pUfM7VvMdcTl2e;AHkV^`>{vpj{t|Kb8f(MfI~(}xw7CS;5B#S`&ijm zs0x&%UVr8{elh&cZ;&_tk>4QlfZeqSkl?8E|1-hS_V?xW%%aEFo0X;Oe^_42H~;JM z`dIC+<#llP|2vk~ga2lEz55@>HMaiuaSg4?e~N4DHUGP5jpyaH-1-0WaSh%7o47{d z+dp#q|9M;^(O?Ng^5&0J#(!5RqsOId6*s>Yz}hJTSUaLbl{Apl|7AuaXP$KP-()n- z)BnGh(SW%6|3yXvWM}@58I43BqrngEvl;xYJ6rd}`mH-_E#8}x=1=a_&nNg%pz*ocI|c22@z0Dt0m zhx@29b4<=*9Vk!81X^G(mhQMo*6nYSSgiq>_cI{#o(W{$u|wCN_zu$0Mz0_KA@Uyn z9C<&dU6WM~0urP}hs)Q81V z3DS~mDSz?x*q{a`Z%>IP8?n?7k(TI#q-TOFs<0I@^xMxTQ6m$-$j*)fV)ruWG=v0{ z9_Kfl0O=Vf-UzG7ErA&W|BpVOTg&fJv1m*WgwA^Zn0Y@%;mTk*%9Y7eG}rk$5)Aap zr_+2XU7gwPcTL^M>-^V2g3z#1=>q2AbzNJaeOO47#IgerE;-J=&z{t?Z-f^v8?u?v zzI=oX@QvJzm|Wa9h3!Z4K>bSOCDfOPYXRrS|G<*2Pc*wX zOFT{n;X{rj>K=l0AVm|a4?#>|F-zhPpk@&n54Fu*!K+%yb6Exeep0P^Jj2(rY8Gil zAc-~FJ}O{JI-CaGuUpK{!i%5-FE%#z)3(m{8GiC4^9X$}$f&Ax{|1XY?n!+LW7O&R zc#iK;pW)H29ez_oe37%=|1pmiz>fxKKjTNC0sJV@pdT3*$+62PunNgv{LxqzE?$5? z8n5SOu5+F|mPmU7D`a7{jtudFwN7KCcI_)BP^}^_0jgE7?x&7}Vr;_P2delo-G5fA zvWR=P_f(Hdd5nJb?OAIk4l4r!&+C;79;MWT=I$u7WKjTqVqJAs+x{DV!pm4G?B-`e zm(Z^yhQ*0{!QOv%{u@9_`3xXc8IwKidX$?i`h!18&LJund!GjN5#r&KebXUj5v_#O zXN}Wsf5`KLmpPGo1zwn#6>XiK$#kExn}2S8gEWQo89dg`PeXiXd6hUk3=$=5ivuj2 zLKAeacevZzlI(a0yCyUN3+D^IuT|oS^GhHp$k;^kWl#zfiB)3jG7z^}QX$+5>m2pv zH3dkUQq)V-Dg)YbGJ*O4pgjXMFTPqCX2mPJb&5 z$pVETu;o$$7L|oNaxgdib7Sb_cVo!4{m;fw4lPg^LIw&$(0>+&h9NEEp9@1_Kw*dm zC=Btn|1JzA{6k?#2X7?-vHHbxVaN|C4E0zw=;aLKoW0>8YJY0gp18)cF?%gRW~Df0 zAme}m{)l3gzfivBGh(OuFuYg&uD01$CtvVSO{Gv-Hp5)w5E**KTO4SOqFgT&u6$$`BL6rA_&ZI!G^Hc6uBH zcF)9*mNuFwBz6x+l*xv!UKP(Tj?XsL8J>aGA)y{Q>ipJ0EHK~}Wq{G{%=|OMi{r=e z0d6C`Ds_CTE;iBXWXW<9)rF^~S7%L{9aujVT3SjOaEu$X_X|pSgbRhRnS~=;3j!r` z2FOd!ZCFI9Mw-d4?|!OQZ7A>UcI_I;lu#-EB6yb5-G$pfb7=X)Kh zb%8q!j1O>!0Tb4}VNNRT1Ou0u_es!L+e}_~=hD&UEuJt3 z+?_-7u+jy(50=jDNC3{=3vtTw5Zx$wcpwbRPGY34IlhM%INvz8j|C^Vh62N5)YPBD zBOx$6PI3G(JU-8kPYM6t><9*i$Fk}_hDT`GfD zfSk+$2FM2U|NQ{@0~jD*v&8EBeSl>7rvdT-K)SIJ{T?8L{x(3?{YL}jh}!?%0O=}J zF+#l+)XPUg1KxBz7c)89t{Qk;p!B1uTB(WpD+WdF^Y<8((m4Qj`^Oj*7|21*&*B3y zD7x!+D$lp8OX^g2s0JP7gH#U$s<6)!_FGE{tCnrr8*-c6FEnliZq8 zDTv~TDRZhk{bMA9NK701CsSXCdAy^8oE;Qfe@H9Le6Tn*&Y^O@Ud|hyyV`kG+B+Uv zOZ96wJ>cbn+cnSiZi^q7|9pY4wI##$;hhoj&DgNF+b6Gxg8Q+?iVxjH;)S|y02z5naD_9^bEh)pDd)xd9lz?Smr&l zTk6#pKf2d&C}n%84*#^H9@OhbeNPtS=Gz1(<~AMr@{8ueS-X2Oxc7IniXpZ>EV0QkSF3Gkm60rb|fMz}briUZ+Xf^`eiqU8G`X6P7?$Oyrf zmV#!JK*M~mF;;E6L|@{)_W1v z8Z#{3vjOwa^5zezS%v1dkLTYC<|AQ~{Z*B}3+94KZOSRqq=?LD=u7IJ@1t65$Gp)2 zsTqCA1b?lfy@yUtVpR%=N=FG0m-}kapcNseX|6h zZ+D~#0QBua1c1Kvu^EO8_wj!*nUMYq`UZ+n_~c!ww3+ZlXUg0B!t90jhaZV-sX!T^ zA<-xmgfC>GV~*z0dNfzu%*f(z8#3;#7=92%lo>{O7OO0Y4EKms`QZH<+$IZv+YHoQ zRPPPJQS5yN^9^PR0}iBGYs5YBljbW5j^_BD@p-! zKSI?I$zFf00vB{_bQy3;omtTL**9IQ!;sjz4G0h9Xe4N&L=JtU)oCvgmfyW_=~L`l z?dgLM?z@8{WYBUJ(cM&qx%f!#M^5u1%svCfL#eH;!WPmo{eXOCMN0JPehP6txQ+^o2lhRzM0ZcdkUkVe_*|rOs*D>Si`q91d0-` zRzYM05znBo%F;l+SI?j@rQe{i^G)68J$m;|3|Jh|Mg=H_)eCGRhFQjW~%5BYp33YXdJDcjrP6~%m-7%fcAXA-yxfu3(d+x3Sr$?s!-Qru}g z--MQ_MT-~rMi+F7SDtGR+qyvQ!FQ!ct_-__J=79+g_P3G4Y5^t|_HLoBJ6bFUyxJ zS|=h5+GuJPJ5V^aZk8~N0OsQq=ubk`#qvWy52E_d9>n?#(1XZFTvx!x!j=Gf5Lb1% z>^}`Fff@w(A9@hAl*+w6d1i+EYM=wbJ5oH`KV4V4%F+JkTgdJtc2*NT811WUO;i@{O;U>uV0pf7zfBth){RF z5u2g63~{DPG;9?oq^@`3$xl4Xlh~ZC?MT`qa8Uo0Cn;=tw#M$7`6myBy|BOiQK^_e zJ{b5d5GS^OpcFY*yw-xz1##0|fjnW?Pz|BUpU&H?A2P3PWU~QwCR^;oDrb;?(WPZH zPgr0g1SAvKJ7mKp{Y9zu^^Su;X)u#^2T1+dBz@zTgtxumpKgLF9l^G!)OMiQAb z*OqVKXb_*bm&z+>sMa1$=m}FV=Znh>ERVe*%BI~Z6UnJbkyr9ARGK>+&K=(j8 zE?K%{s@g5ChS>iW8-IIS9Twnd;Sg{(H2q?-ovM|Na^Or?tmeG6zarFMscq_OP&$SM zFC=eoog6;etV_Qti@tDQo*`oe*!8Y3ww$%QQLhG*(75d^VjG-52>w12uoxa$6OBf(?TP^b*dLq0F?l`Y zE-F4wLOFobN$Vuof?T&f_1Wn(1vs4?k8+lMX!9IHDNcU0M=LFv>NryW++TZbYAo9e zFs5IR=T`!ZY2G&B$rxK0*-;UeOZ9JDK%T71I7elFr^vLGY78(WQ<}6<1GuV>3=nh8 zPqJ%|Y3@SP=(H^~DM~(wU~Bld{5?BD(eAlm9d|9C6U!L0?8cw@e<_lU07Wtrn=H7k zLTL3s%w*^{VY*~MQrHzBOvgSDcUHu4$!nG&`xO@I*0?Mc44+TLoSWxl<1^uWjhFFs z1mVg4CQR#p(X7U47@FksRvNe{V~Vx)lPiF|u>i9NCrF3L@L)uS-sAh7D#E3p@b3im zCkhS@NJ7*`WSM{QU1Nz7K~JUtRWem=5L*L+S)gnQ_>t*mv`}ef z*yAB8vwh%t;VFuM@SNVvI+UeJ}nAOn7Puu`u`db*u0NCmfQKrG&Acc+K)!F zKMIuSvq6CicD@3}67Ett;m;r$4@ZOYE;K*z=TtXmN;VSCRF<^n6nKjLgy)I5 z4!SN>fMqN`-zL5Im=l?bCoPwaUJS0^P~ac~vNjs<_A~x7VoDA>^hkWbJFg+VR)K@U zfl-q|g8y+QzpiUBPGn5p4Qi0vOKGDUl;&W0q9`$&s!DnVmprC5z)YA8cg10rspA9I zK%C32bKUv=a_lsjwmPthuic+AIQ3fzY9=$Hul%?XEom|UtFmV3M=NX!ka}%WacfwP zZcJvott?$`k6P5KP%elAdAS6;Q?!h8a+Jz-u}gWlRgQ>k_v_aR54v0h~00Y>zk7AjssICS42Aq|59A0)Nw_ z)xrYFSIa-G-lsE#dBzy2MXwrm+{H=UYm}SgqXWNWC7$AtFSzk#Qr>_gS70xgwsAQP z4L8}87$7@|K_27-9)XaYd1#Rlyk*Kqm<-*YIc&qw*Q;7SET#gis%^0wPg0@wfJQC8 zk6VZOe)qk~nbd$!*Yiau91EifF(55YR3CB-db;^oTga!1cTWx(qc*75YA!?(*2T*f*h%sSKN%`&ad(pI0X zyU3*Ar5JWAQyJy!plMYJYaTFGD#`0U*YIX-&}Mhy-KVsWb*Ke0K&ZSGTlK{}0Veav zd2(u4(}X9?aL6wmph=_6nY$O?*w%;EBopESUY14QFU<;D`?W6i&Tarr8tDuLZq8j0 zs%&;l{2mJo;H2Zi`7aU`wvw@_5xpboXTwU03b`#1#^|ri0&;jw}e&tLeK4Bm@ate2pz9Cmkr26?%jK9h6|*H9Q>Fk z%?=vE@}kZucpHSQt;)@Qj%^LZAx#$YMXTahr@mcl#73K850}1kldRhBYnw35Bwik- zUcQv1{NaQXy8Xy^kd8Kb_0Sl9p<*LlLDb{c96mrX_Tip(O+hWhCHM%q782ogO&h{2 z0Ki|h2a*JLA-VtoDi>jUvFpKp;9Qutkr)G<3q8BEr5s+TJ?c0cj&)CcmD5I+6N;P# zu7xcH2g(e=r{7|b#nrCMVX97YSwYlWdLVsRN|hiB$wxyx#bqID#21q!pCvHTI?!YI zpsLQu&xw7f2;l@MR+~Oe{Gweu4hY!G0Mn@p2`D~#8aIr=2}lMyM`-)zhnO8d)(iV; zpRL2dv~|yD3Q4G6N;1E>_zApt2iS(-fR%Hxsbi}ruf<<;HCZUORo3$+Kioxq4@Kve z)iHM>Ai?iZ!W33{kT^Z}7=w!1y>#cf&gl~5Tlm)(@W1!)AD{6Dd;O#fV7Y6`Zlk|z zT6+Vx>W-OW z4YAa6m{sz|8JI7-%jZ{u27~WDeLr7rTXUkPN-|iR;RbzNuPEka)4)*RcKIpmw|%Vd zQRW)C(3x|N>3=AtzAp*9n|>u#B4)sAtNS|6h5(AQ1xLXv`izOle@1hF)x4Ah>AJlh zQ&*>2u|;sHV=sOu6eT?FS7C7+os?Ot4f`qUa62v%2NfluR16F}ogbh4`t zlvv(46zU05ck)F~FR>(9z->6;a14N5YS3CDMl_Fh#Yji4A>MYv_7nj`{6T^-%F44T zn`qS5tY{-zBYKQmqUsfrnjVY<2YLq@*tLsACXvNKyV{wag|b~nq8X!<79Zj3b#8U^ zKY6Is%Cd*q0|30WjGv((A?b{L@gZC%{3(Iv8^9F}Ed{uunKQ)U25Skt5Ex^2n@XBy zUdx)bBuG}PXXl-vGsGYF5{@k@T3cj$*KuEO*|wQDR(CCeH8}k3R(@D7dlaj;?dC`( zZi8kZWRUwoshhQElj6DfgNKj6zX(%?7d$9_DAYk^nUK+R{ibDJgQq4t%V>T%CN8dY zJBc{01qs>d@!2VpV&DBt7`i z(k4OkA88T5%V7`#{W2xujpmCFXF2wBcfP^K(57VUugX-Sq+|q`Li;GATtvGRb6sM{ ztG=}gY8U=wv9MD!MzzNKF7&QzZLoeOxO`7Z7#uDaV$_X9BYT+nh&IRF6qyK6t_>Or zbe5z)6HC6w+*QdH-bAcV;20rFzAfHJ*AqDkm=SOT%PkN`=aIq)#5FTe$ZF@Sh)E&h zDJ^B=dJhD!C9v;_u_e|?K>89ur6G~WnQQ^pXfxza6rT(OjkHS781{il8m*j7JjtV2 zopjxwJarRWRqp(@EGX8_Z7^+Z^Q0KM%Cc}8fWIo`dN2UD;5f#qKpYd!NCol{iB4vW zD>erF(W-zZS)4^^M@e%)94#vWyP-LFUa<}&^}3R-6i@B+;i7D-)yU2isRzo z3{Kc;jM|#b-kPISdW1U!)$>ccdBc3gJeLqV93$p!cwuVM>cunVMc(R_tLm*DbOE6ooK?qZ~ z#<{X9-q+fVLVwSFH22{Se0gw_z{UMxz_N3|Jn{v5_O?vdw%!2lH`cdTmP2U#;O*L+ z{FcdAA_I+-(S2|7%?t%icn%ouNQqI$1p@Y8tUI?B@WQ;s_O`(2rHp;3qs+pP$kGJx z4Jpd$A=%kJ@WQu~aIUqb&%EsE(XXf!cG5qyV!v%z*Xp{)LtPGhXNHUgaM_n0KMlZm zO8a~b*RLwaxGKMeJwN)apaHJ-P_qOt!h`^F=~sYU8kd1{L?v3*w1lCZ50Fc10di^7 z(yI^6!L*@5s}$;jjj$ldOCmaAdcZD{gOb*yr$ox*itL+1zBHSO%LYiUQa1(>bZwvA z(ic_IAL6mxDGGJJZ(703);}prV{tn3eT>i{5|?iN1h}P#Wq`$zuK6tPT#zRVa$eDK zui`%AX2A#0-e$?tvfF9{pH6Dvt{S z^6%dlqZtTGgq8J$onF%Lj;L3ezx`ylLws7_TL{(51#q;vb>|6x;TQrOZK7a+qdg1B zDt|_fY6B!~x4}6P*;*CmIW$_T>U$1p5f#Z#Yy|9@S3mcf;4!JrgWdLP1ILJ(WG6V= za&|TRlEcDYl-&Y2mB_DJkZSD7QGbxMc>$94Fi)#BX2lD50`ZxxwACVg6q-kc{3FJ8 zE-ZYcV_FXVW2JzZF;FE0g2R?L&-T5#gHDrp@H*J>ySIqh9b6`!XZ3iFw_pmo@XYRK z|82f|7o%WT!GY-<+CI*4C)GL}T(+Y5VX9D1A=V$%y+OSKBs9L8j_YD32ixIcj|*^q z?`l{INPa7(LES7d_IEIbu2d4C@!H&_Ji{g%zruziC9ISr{o|&$_5q%@cXbK&d4hol zI0~QBYN9{|OcjY=D3h9t^GJPOi5x*0fm*+cTCaoSTF}#3=33~?IB1^HX4c(ZFTE_V zn)zTk)s#w2qaAlZI)7gp(2*Mwln)&ZAI?(08Z(f2V_~ITHgH(wA=~2Q^F9#g{B>r@ zu&;C93RKjJ;0U{yaJ$<3C-n5?ky;d8a1yNVg<(chH&O4~tCJjXmjNiC(& z{UWZ=8SuB|&h0<+otdigTqvJ;+T8$8TZ_xt$1P93APQ73dF1UlnXmrgtM;(`=miO* z)wTTCUDJM+?c*fR(~V}(+@(5jELHNI#}}*RW+&mJ&0FspC0Jhy9+K_*Y`X#Wp=b`! zFZA)d<~*V(h|K{US$m7@$5S}H*Ka?7*)6_YW|5mH=LXpKT3-Yer$X!`7i`BfFk)wg z@5P?Gx&kJNtV|Mpd`#wZeS><~oiN*hp~bA~d7oH63v3pM}_EmO$R ztxF~JJOQ+$`v<+P25UfZkAZUG$DQ>$L8`C!*%8)$Vg#&+RU-f96ciO%GAuNS5v zBHYh=)qxcooBe6W)pfQKA^aGRq;%lkEGu}ZsPUluq-L!o zGSG7WQ~kSVD=ruGl64V4Rug2HG582o-MTbB1@|TC_*TSzZx-&rr0Pl5g5>f;T>@@c z4Ij;>a7^X*XtH~4o9<+j9~QvRw;dtv>)i@61bS*J8wLURj`l-0cPvdwkb)827r459 zja8fkHMy6FwyFsS!%(Y~Rz_)wT3aqXFYoIL>?AZM?p2XV8{rfCBvrX>D1B+dFrk#R zY-6$Ad8Nt`SyPxjVjr_$B`U;xK`PG<>+=3{b|f6*K{}{@gkQNWvArMfzf@^KrnEU~ z+=YTfJHx^E{zO2AEPSClm0qPHJVLPOVp|_#{~&fH0LYMWV2-t!HbG|ZHTp0$F1+I1SiKFnT~84q@Gr{)G$`1_e8MtN3^Q?uA*_4f2D;U-Yb$D#Rjz2N^e6x{dk=Prd*hW#Ae`K zcx~$g;UjyZmx3Y>`5iE5y)hB}sJuwTVT>O>3?C4W_R^9+n9twGOZ(E+|F8j};QF~$ z*y`uLT%D!FY{?z0@Xq1>7knRYzg|`kJ_nF3I;0Q&V4sp7!)*)g!GF=PM{BI87^@J{ zBxTtJ6WCIg+dqCFlxYff!Th?HiJju0)&Uu=wkJS@z7IdB2ou22Y$iO!*_0K0tE|FE zGZOLQMQ}}0N3fwR-IlWs6&}VU5Vqso&-8XB06icBVY_ry5GEpU$X>p7Q5lLwO7%yA ze>wFPG*{-&30SRx-@9SJYF$4j^7Ft7hB?!nx32&anm*Cf7>tN^McRR((o2C8l~xr(8?5INXdwuu?9;ZFaQ&gRCI+Ll-8=EO5#WU4jV>7yZ|C zw(3_-DIYM|I{9tox%+K%BeM}BAkcdCmq3fNM|b0x%`tU_u_&f_sXzbKw+dW{r)Ymq zbXUhewbrA)U#RH5&Ep3g6FmE~D)6o|vUR85uL}>ourfQu0<_lnT29YII<4P6YgD8w z0ywY8j;GL$r_F$de88Ut#+ux7vz&8Q9g>dmxd^CIjb&sZh;U;ZXc!+kL^m*(|0?CY zAwh_ zwrmDGd6tP@>m%cveqki00IEodfu%xwL<;~|RcpI!)_nu&kMgys>Gqnv+TO7kW^#DOH zo4?80!H*Q^aH?7%jZQ1&Gs_{WApU(xvtVQ12&H%%+?2*(%A_FbNHSj5W%5-znov3c z`aSqThr25sdF6tq5KzhrQbP2^tE70GM~>RD&2j(a~a z1|zvvXvx88Cf#T3k_=wQeUGPIF(lNaHSI!Co1<;=1?;F$0RBbelv2kWpb*EX++YXH9wMP^V<4F?GqjeVk$2G>kZa)6_ zF8E(}A}!AK)Fo^PInVnJVCk`BhUS|n`a01k*JXC}zAkRSDa#qS2al5yfgd;FPM zTWaVU%8Q0xdw@|0NMak`etvkTDai*>NVJXES6@vx5OXjb;6`LLL3a^9p5G(!y_QUQ z+-s~Fp7!`BS%_^Op~===hXZPad{(^V{>1z`QSsZ*^qq2<+p+<Q5&`TK%DW67HIa5}Y?q85h;2Hq0T z3_ct(GA0&t2M?<9*vqmFXU1TT7^rr*vx=En=C)PuwJEE>oL_rYylb!ID`;z$0^zBr zKoKY8#p%sTEn-KBti6(%I4ek~qo0FZ)U1_5(SgPD5$7Q2V5yN5k)U{mq{599;DQJp zEXiL7r3M9#km%-L{jKy;0zP#CmUsytVRs?G5^vmB;kcxm6JST6(T@bo+g*_UkG*qt zq~2(4Mw6}$I4p)R$s?C%yr$(gO%=hTpyO%105``5DOFzIM zGi0f#b%-4Y)teXi5a0Y?Up3Yd3V(b;hUDRs()#M}>$w_kMZ2d%Td2brhr}}l#0yeB zS4_ZbL>03avjr?6LyE+@L|K#Cz-j_UZu~|n>bgN4g-Y8b|C17g_JD{9zFh06VP;|Q zU4F^2I}MizHXFt%{^h&C?)4ZC{WBRHjspofYFf6`z4?GVI%MZ9F3PL&gwF>7Tnw!d z;XVjOPZ#HP1%bFyLw+$6D09GqziQrtx3}RcK0Ia9=Xu-ly!NVIj`IGx5WVS5W zcvIzgxVn9}bg)$(an*DMCCU-i>nbZa*ODujUb3!Ag!H3PO2(`{JF zisEE5Tw=LZqF4nl$FRGIX(>q-GQGI=ueF)geyKGAcvTp^I*sHSw4!g?AloS$BDny` zfTBsU3Yp4--sY`V&P%7UXt2y%X}x3kn#*j#Yw zu+|}vGEdLAeH4M~N+`k}TCs}$i-xY~8XlOjLYr3XVG&U@8MBWl8r%rk{;x~-L}an! zuv62oNFa*8c<2Y_ZMKL3i4FIC>cXpI4#5i@H4%OzJv}@9{niHmOmGw_r@?V8viY96 zT=0(Dt1Bnp6K8aZc}CR9FXAulz>0LPi$Ra{gYe1B!%OAh*kE~C0r}qIW85>ZANj5Z zLqCxfR2i+O`NnZx46%KaJRvIC@^lJ$WzgMh+gP6F!&wr5*rn#}gT8{mwwz03Zx`Kf zk7~B+NG5(uc`x#%#tEEiTH+V|uPm>&GX1OJ|IN zG^%2osR9;?_n$btTk|45c8z4CuAQW(nipwk(JGgvJ)pDDqR1LVQ9oWLo>rH}dXbP3*ixhx$^eguX4NIbx#O>< z75sLzPS8%v5EA`cDKNn+RwVsiNijPZLSmCSdLrn`%UNp`ot#0ed+iNPmoWZn(<|I` zYhRGV$Z{qm>ttIaGAE}@coxNky)d0%plozxk4FIaaXAjrfhrwiy`^#a zhTY>nVE9Pm@=T&41W@09;(OOv*7xG{QatzOeKD>0(`%PaGjc3gj>SAS{Feom-V)6KnWg zc!(2+;MMc(AyPg|^Z(vwoCbU$ru8VTQo?c5o_=0=IDz%q8L3^pK9E&4F51K-ZDX8! z8|%LtI{&byMa<2_(d*kGq2tr+U#cr>8wbj zUNy)s7#*0Q3g1l^SPW4U?@kBL?(_K}sdJxrMx%oH;U9)Lx7qaMwAN-WnurqSXxYkPd4x?i!zlb3%XVwSENN>Zo|`g=T#vHXD0rh(LqdMLQCC7{ z>cxJZ6|2f8gw(=%jVK=x;>y1MDhqzyCCT)mR|JYoJvp)ZC_bjj{#W1sn{w&CaaCO`Ic(4`dG6}Vn#uo=Ye09^Q(isjf;E^Tpa2wU*mU!YUp5&jJ8(73ml!(UqiYoN=%7`u@4 z^Z#rsZYmPG;rPy`^2T!fZ^E%p}Coz!Drr+AnS{| zsx6mFSv39I5w6Q;Ke6R$_1&{dMFlxAd|WQKnI|S9S7Th0m$X!oelA=eyk$kyN^N$h zmH3@YgmMDvp(x4XqGNbRo7em~OU74x!hpT%{=Nm;~s?hF+oT zBIKz+ZVc<7C>S$0Sq?&HObB{C;4`2b`@(o=&dz{3 zax-r5{iNHsFLh%4NWBM)x+z?91(Unb#Hy&d1ZhPB zEqg^)2D*$ld+1Ny8O;2jmJZ?iSiVNQdDYRQRA%3oo&{t8{|7LTDFOyEaQL2-x?~IU zBt*8CgQq^owM%m?I9rD7#ATAp(lOBlCKWB`)}MQpL{|ipenT2vk`qo4K3qT;pdZy1 zllw)SD9!O(+SD)edI9t!0sxmPgAQu0XPz-aXm9IRXlg*mYU-b4v3y|n=gv+Oa{_xVD z7W6T|;x^B*q-qz1^_6jqKBeohLHs5KKJKs2Q*8S>LkIywJM^14C@RoiDQu&~t%WeQ zWAl6$8$mlaLzudqZ-@*#V!DPWrr<{tVcPO`%Q2&0bNbA2Vw)mNE{am*SAb`{S+o%= zqHCQCC}!${HI}Jn(!>4UA46SC9>4UsRv@^$h;ehC352Wr1$IaaXvWel78Sn=9&L5P zy~($v^Bm{$s}s*CN+;ji;Ft}pw~pg_Ei!X27bY-#1T7~e?O2Fnm4(QSMOe<0H!@BJ zD8dgUSo%BluDbNA2;L{5VsSk?!V5ATw8Qbd5fXBZg%ZtTSXClb$@HpF2DIu#JD1S{ z4OeL;#XdV|_nr7C;q(Z6FQ@HKe02?cb`l_ihD)VRpx!4sN8q!RJ0(*mKp3H-3%oKD z==4ib4Uy_i)1q;IfxRY^!X+7cI=j?YPe$5B2h3>i6C`f<_ z$gWLsiR#={ud$Aof8!f7oF_c=VH5F(>4TlD#}~^l+y{Dy?gpvOU%!kUY*%^ta`#NH zUX|cV_#Rl*SGPIuM3v2Ide#sE0`Pk}V>jEO(#Yc^pDOpEH6JYIz19~cShYB8ARVsR zbRKz>w-lcHl3y%T6-{) zWHfgVMKV!MPUuj-^bsnOBvzET+O|a-6Wa=FiB(ZA>x5(YmYVDt&RMWL#%ed7IXmF6 zKXG3u+s_tmuEo)mJ$t!sV8x~!b-WdOe3u<#(GcE!4)!H-Q$n!wA~s+>ccp*G0Y$|K z$enoz#!L4@YiV{5entC$`sV)B&zk+CeJ?_NI=T6yFaws4x~k{UsqYfuapLEp2TaQW zX3Eo>P}R^1&}x$WeN}!>c0;LBd>4LP6h6l5)sgoqh&kH2>uQ@MAI;B=cr8{vO=VJs z>iRog41kMXD8=1%#H6?SkYixB2$Ppl@qD8MrNWqRO6H3_6k8&D#B{n7HUClz+<@K#(B7yhJz@fB@0ap%faG7$1WzhI$--NDhpJu}nkMAEl z97zXzxzzukzqq4Z=W4(iUARkvwJzLy_K`cwxI=a;qv8OD73DPh(pN){`WWgyII(M6 z11FcZ3b0V+a$>ypkF=(!?)j_ey&WOeJ5BXLP~xxgS42nj4aLT%ddqTCWRIIILrsI- z#vRuwOS0>P0{vTw>{d^w89i6ACFod=re>tdP7UTujsePXe~x*M<@H_kSl zM=RJBbeao@bKgblu2ucS>iqbz9=7qFE-PKONlg0nj@RvBXd$J@*S@k<4+pl5B&O>L6Pc;1I&Ak}?B+4mL6K!igk*vYIEXJHH#+C!a5n9iR z8xQwu?*$Y}PvL1MiynW3$dqlo=0dB5q92toM1B(+JHJ^>HOuu{^hOhAMO4a)=qKm? zRw9Yd_|!E&CIRWoo%I2nA|@?{4+ff&b&pMP#kO@Q1*s*{m(V@zuW{kQ_b}3cH~BnIjWL{z$9TUX$y1 z)IVea{2_*NBI(|$P+Pn5V}K=F$=Wc(lkH@SL}!!h_c+7uSy3a7t4K>u^Ju1gaWap# zVv3eU$PQS`8LZLVcJ3bv*W!lhzo?W-HQ+P;pmE9=I-7{;ZOG%wXqg9F1~_V`-c#N@ zF2W^``pdBu$U$FDHyaRli})nQi4$eBAcVizu}~Hbt4)sMP#2f{PUwFs3a(To1~|TH zFwL&aqt@IL@%pzB+^;~i2{6MJ)=WmxMM7`r=%)aV@4~(jmg7SQ4GNYKOL&SQ74}Qs zL~lt2KwJJcKwi5>J_|fUn6kxB$~GM}`Z1oY80>i9U`lZs2~F!?GG92P8#1ZR5W{6% zi;~xo-7#sEr47d^PI=$(P6kw#Q*s?J_kJw>p6swex@zIzW0tUrtGZON$@r`E zi@OpvNdt3qnzXguy1q!h6A2hsgee-Ppar9TT|)nN8e9h9=9yqpgj_c9;6efz6;UcJ z*G$k$xo`!gdsK)iMFFPHpJ#8$`jX0;E-^Ij-BXC~ifJ>yl$S7am%1+Ni;hZ1rr2~)>69(6v&Zw3q{n%mE`eecQxrBj+rxg*`S zSd2F^o9}+4`j!B$vHr6A64pFaPwJzy9%6hlM|2w$Dm6u9e(_3>pl);#hVX#r}%Bz#wtZrZbLj?*X;zltpS z>Z%(M)fF)`xvbTbUI|L$3oWbm%0!-4Dw%wo;jJU$JS_PHp*qF*LEwmu5qcl5%gAC3 z{?sFB3r}AQH{)D#nCzr-g+G;rDS4xf5%CM@i<%Ts@5#V32~4a*{+sV*Tm@CGf})_v zhL1u%xQ_fWY$#t|QyNrF78YR^Xes(4CSeBWmi5Ix-3@x^PJeHSijJ%WvKr5iKG_sz z_oT|*?U&~$~l4R|TF_Iz{94nt{ucmb3x~?oNzK81gW_?0{bvgpq z6RonBJr6RF8nxO7Oy*e`f-j1T>j_jQ<(RZ6`g<>f`3eh?$5~B>_Hg;uT#*2ixm3*X z6x(3$DAQ1YCCwWjZZ}tk1YhLqo^u_vQxj?WTz{pqo1~Rc}Gfh%)K#j`=B^=T0u-*CBnJnpiBg9br86V{=lEO(TXc5@(YtDibxA1v6Qa zg{$@ID8Ug&GYZ+Iw?qnMP($kK>K?;joJkvjmKRAW-@P$)#<&0s+G%lsUGM3eoDdD3 z8Qe~;Z6t$DCy`xyHdlMd+Ha$V9!goO@4@)ppQt{=iukdUbn-5L^&bS7nS@dDThMgl zfW@Of=L_-X{#e{ihhh|_!1V0bm;A;1Dy_r{yx`L0gxJQG_Gq0&J1*Iw^XGI16UWxA z$SHjk0dRR2Hc&s<=7NwY3KD&sSp`(*lw==2dyi8?6tR=Z6?Zo}_E-WmG%XuDkg69Q zdTuk9!FJE$YL0D9Qr$zR7ZA$;HWzp7mJ`a7bD)+T;p9YHLk1)7c4Tn-aAScuBR1H# zMD2^U4%htyBL!8j;N2D?{H9XX(xQN9N46>a?2lUuv*u9 z4ZDmU`Mvo4af;?73n*LLt5kkC91oad$Mo5I$n>A*i6;+kwXUO`3@178_Y0IqELWAm zB#+h;>{}R77yDfYu0$emg#)wIKTTDMyVbN>BA%3;^!8gJ#T>ave7)w{zIpei3e7sf)5}_DR=eeW zKl3ZD$=BGtD)G8&;-`7)~{ng%2l9Tv&;!(UrDZ$dfgNmSw@R zBM0)ehJ?bHZ0NH5%0(y^Z{|y8O+WKoy+|yVb`XxW8Js;Blp`!5d*aOjlmpQ&f?KJh zwPG@i!C#ehy5@XlUNJYJZ4m9~OfM>vcqADn7L?WOxTd{d&HT<=Ycsnb1kRW$99j$D7>4}D2Fad@~J$}bpcvSZO`kHDPfxX zs93r8$Y1*PDMp^T3-DgOfRi@L{i#eYY;C(YOhFv zG^d-!R2kafA}}gES?6qNVacb}o^2O*q$tW-0z<0P`5X8cqMP(+e~2pNpu04gC)YF# zGyBQ~jeB$^@1fC?2ICx2d;pihLe$&`DXmCjH(|vS@|1{}+6#DlkbXR!jl4z855Zc7 zduq9YTaQ#t(jSv7h%9Dj2Hk1PucGuDaz!gyA&u(MHPmI6y^h!Em>xVj zQTPG4SlPm#)mTQoI{%I&%zW#J<=oxo5;Eprz4Lg71Q6LVvn3i_=Z*Hhmy11*bHYNU zT^X$lM7d`2#Qs^7{_1k*b&aOf8|`3}`FKh=Qr4eE>9~)xg|X{M>wXrcBl*38FbXah zrC6U1*iLNB?#}9)iH7Mf4uJ^>%+h7iO<&80jxbO{@1-mfPw9;Pg^f?*j-CV-`0&dS zn5qCe%D#1wqI9<-5eE-rB>L4d)C%3fRb%sAnC+Lo%M%W&NK$!80{c&&u=s!bo`Er` zYAJwU;;$+-&;1!=Z@#<82Fr3(T&UF<`s&*`Y|C{Xil>`&Gqv-y^1?o`qm)a|>bbDA(LMi4j62te z?nNAgc9`)!E>`Vpii-OHmXFpwK< zMa|}16hSv_wR5R6vul#PgN~xc35X%J_vwhdXvdA?DP{ilgaB_4oZ3FTHRXwDK|rVw zlrVV$M$!z-^edv7CI`SD<{#Ur#ciBQaD+*P^+Fv6VttTvq&iuHFIY5q*pn!z*BYRl2h7() zFE=dn6G6}g*P6AC)l>N4WV(R9g{@+lzr@~D>6ELLfq zreaz+nhV9={qAl26k3|1=#LN;cMA@YxXa6g;F)2Rs3dA^*a#EJRgz zC6GQvjz&#>easPLO7^aIY4CZ`TRoWg&!0ZF^!_x};n$muSsFDse)F87G)(-phB3Z( z^@EX}prGIRc+lBXVX%5Ze9g5TwVC>HJ%2=b!etZAokFyvG%?7vC2fde!-tl3ZBr?z zBe3k&rK6Uhn-eg2tSOICeMb@>EbyX`@2iWTP5Ak+l(APZ+a@^LX2^WA3fm zr2e?(O#YA_%8+CjV&2dAiN69}>5sxAG|}qIij?X@J{C&3uNoV=u$#&O)H1ia((=m! zQHa4yBvEg%Qa)ow%l(X>D3N(h*TC^fuQsDD-P4F10ewD#q8Xv?p3VP)nt@j|b_t?Ju5Al=upYfBFKjJ5EB_Qz=u>7C#6F2*;9y!JM#D({v z5`S!BDBSRA*K`=T-4c!5ZretnLgK)G`vCs#_y6?Qk=3-CA=1#hvh9Q5yE2zn;fqr^ zX05ZR2_w<+4Y$5)?9jgtpIle{P55My`ftN0An?!diN@d`;S<0)5fVPp{v&*{_}>bj zNWS{p@X0dz|0sL{RHgjS!YBOyn(ztGiT+UGlg6Ln6QFzXzYd?o-TrIBCrkerJ^^SD z9yELc@Hzc&!Y8@^+wchx6aAp!6QDu;&+rM%!9#>kfJxB@4W9sTA09M(0-*CgX!rz> zQ-09!2_RMVpy3mMf9pZRCqUr(gN9E49hV0Up8%-p4;nrJtTrArd;&=MK4|y^P@a0w z@ChKC^q}Dr0E_TJ!zVyj$b*JYfTOkt4W9tAnGYI10Wu69G<*WM>OW}s1d#B2(C`Ux z+54d36M(7lLBl7&R`tIwe6muv^#g}hr@l*2=IHq#WPxKw$qkL4}jUr}5`tvyamzd#=HG&rEbV<8c zZ@5c@FAJDEvA>t##W4lvvI{8R>6vnn#J|H$lYE~u=n?X)B%`J1P^^%IZf9qnnnig0 zn&QaZH%48gN?KP%+weutXwtMdHI2ti=e3}?l$UMFt&;d?U|^Y`ybHiN=bew>7B2j8 z6uW1ymF2uY;*D1d{wf&%`%qv|QQNQ84aj4(3gyRIM9k+k!|1xJp`bzI^P`=&xSZ56 zIy&;&G=Jnz$g=;MKf$D5@gQ0s?}mP+eZT!7BJJXzJb-`tN!rB-R{Bru5ni#45E5SD zav*%s3eOyI7IkDQdhpGyF9i1=ut!ME-(U|dw!dJH&)uGHe_@Z^p+B%k;ZN$(1)&}Q z#JO?yv1kAP+_^C$|F_tK1n-|=kM|b8of{xFDw+S_+>o^Y3-tj0o6ZfJe+~Bd3-tj0 zuRAx0I(|7f{-hqj|BG`&>+T=0M^5ekz`21A|DQNF{-hqjKRP!K-u~6O@$UaK=f4=BH-1A8;DMAIzo7^4K+28Z&;xiN<;HL50X&d$<2UpG{`bm_e?~n5uG>OfXmK(S zGp>b*ZPWV>;|QS7ReE-zh~u*bUd;1R0fIJ10K_$F?-hIlS@wv!5##PtJ+qaqx>Y+i z8mFAim$62Xc@vhH|8vVa?%VR!RWk8a06hX$F|Qh6s9JFAH=d zBJGky*$=wVbJv5-0SLAB z%G)+R&}tI&LO5Q3jMm=6rTS~x<6O&OS^Qkfqx|Qx2UPAa*Qm2JWZ8pS;m>7{(LqL; z1xlmDK`T15KTM-oy`!xD7<|TD-rc(-{6EIA{>umO4}Y`lx)!5C;6ILmOQZ*RFp43x zqeK4)?d4M^jo>)JEH`QK>HG)thTh+rH&6_Jn>R%H7r-vR%p3iGm^bQEA?6JmkzeMG z>oM5{RN(*Iyn$Q$x8{v0yMJchX!vd3P!KW5^8XL!4NB_2GjBuz|A*!cJf8ng%p0M= z|26XlF#_K|nm5#e|HQnZee{p!4fW>#zIlVu;lDI*TmgS$-dOvqd4rSl|BiXX2>9=q zH=OzZ)#i8Z}rB%)f@j-Z~R-m@o)9U|F6^=4F}CZ^@`9*P>@I?^tlKzk_NR{nsF7Y)Ine5^sJ5n4axd^)=huAHxD(Z+O!*i?cm zlJj)P5M}QXQThvJX0}ggFD0JHGl?FVw21@uDzCegUErqB;!#fbSyM79?l2HJJHIfH znNcy(GO|dnnS65YsK#sCEx1c3R}tibx-abd)@?ACPW_$GszXUkw14}nNwD?VQttJ7 zAd}#$!^4-Mew(6V$~wOwhQo62`P_S#AMmfu?O3EWJi$GN)$W+5v?0kcgXQ-rDZrlw z(aM~^Y;cUCOB^PwLZOxeCq0t#9{>Hv)(3fYBXkK#RR@1@N!1o~vKx`dJ*>FLrapXg zV=r6Me!#(HcgFE?bD%fb0N2sk5K(v3Eu<~W?dyUkYji)KgoX zH6xsmDx>$@nc9j~Q_>^C>@qii*t9jF4Q6zXT|6GhKo zR&k=uIr=LUkG*}BjEe=De=j6=p!S(Kr{!fJXzXT?PHuju4i%+o%*elN*va8JgPR%rt5O z#4B+X$}pUnfy*X=3i31buQnNU$My9!npI2B7+$WnfCkz8WE8moX;__Ygt*+OyNRNE z5pj%<%Llz#(8J#{?tr7GQHHP0kX%&b6|Id39X0qKeUKzo7|vE-Dl>(5(D?F#+Yra_ z1ZCXvarb9jXpAs1Cb2~(7nYgeOqUounfYB<2g=Z+9{hW z)A3DiL=GrL7?wffMtZSR^uj)S_d!Uul^vfy944b%dX?4`DhG+hY=6oA2LFol@ya&7 zRw~lfW&mSRZh;AqTVP!Knq@_Gm>APSqEC_J4S&^0#SpR^=VK_jiPkZn3LI4*sz(;v zNhu2qChUWCdPrUMch{wIj1wuEv5@rWny&SyHHsZL-RD*CB91A297)p>)>JxC-XDe_*7;C6SKdWi%^* zH^V`p&{OsH5g^t_VAm{=+fyA^*y5=Zt;x zQ?;+}QQOq1vfx?@%PKp`_}`gdjwqd6&-1*Mge0^%S7Jz7>A^{PAXb2M$a!HleL#+= zWE~gES^Iuv?UvP50L(q%rtGMbhpB?r!WKNv9LYB!Si3ZZ?GcR&Yr&ASbIE<&E!ypz zLf3smn>|%5zq-R~U$wtZ2&9(QCZ}}Oz}q1@t24U(z#E0HVp`~I8K=Fa z>?cDgy*b{g%5O;ei4Hyz9Y8V+bLk>*~hBCv~fWxsexCn3<5izmFPQB=s-E*G-ZD zEg2LV}Ez%+@F55vJSi6AX#Ft{KQ6#n#lv!$_Ek3O5? z2;*J!ou;>jV9i_3sie4rC*apfASN2+Pfc;*?a4Twhn}*3^9#@}%ZuXe(}h&QG2-tn z|5ByH`Q4JhT}OZmlR(;!4ko~e$)Gyu+xm`V$k&OK@t)fa)FY=pBiOvVIU#w4q*3TJ>gqD!I&ZB=^oDeOw8%Iy{!)$L1H$4iSoLYt#pBL+4AC57LT=9AqI z9KA7$$EIJUD@%&hH3}_msDDPxX&cl;UzFkQ`M6oSj*DO0^%hqre;R{CcRyH8EKp(y zz*3RH>Sj-`PrQgU)(yo(`gIcZ*Hy58?WksH+mA}2G}%K7kSW}Z66KYD!my1e9_OU4 z2_ButG2_>tK&i+ zmwEbxfcVUM*cil{X#S12iagNlF_+^`cqH3Cia<-0}OsKn^aeV+1P zE~qWt!W*WqLC>7poWgs)>`$dOksiK=oJE`{_rAtI`@2+2-Zbw}h=Yx&RiPW64os5M zIFc1zlSuubuNS{V%PHv^IM{~Tmq*eNMU6C-%B|IyuQa&02kWMTHle@OOJqR)+XFR& zdT|`AJ_BZ5b5xM7BJwRM$!m=+d^2Y4KDKXIgj;o)`QzUXNkNNigX;{F6V>VHsPG|6 zA^o>(@&|1q7bT6AZ;iAyor>_?odnkeB2kGZF7;h_8)(Tdo3})!LPVr!(U%?C`0Rq; zUn@Jz5XdMhC6;Q(Dz3cgFXyA`6~Ng^ww=(?4wy`G`flZKSOeQuMCu9oy4iv_9^o0( z_u7KqKx0xRU@p%lM*3d!81S@zYC_yh2GiPu-U0jD#x2(^u`}jj`I8stqOH1(_zc=t za5`6cIFH*@P!|tr&brtLAD@)0$X;k+b3VRPN-@{OVU}l1av}Ij*hP3dNkz>c+JzZz6Og4ge zr3etjAuD0!`_$RpvG0lYPH^Q(1I*Y`*Ca2(T*TKco@Wberq*_WRxGO)Ak%xRrj3C#%_@j+wXVEtSeXYd_sk^ zK9*H{z5gL@)wZTCz`2OdkY0rK@&){O()R>lS#l!Yaam;G?nPzhBo8N_tyZ{ot551K zm-S~gMotpatuCKRZ3-_acKaGMR_E5{bZvL`tL>|+`gap*B#kr~blkf}=a`=H^{MbD zv9-rkV+2%mSvPBM~W|${wmkiZ+0R|~%M^KJ$S^|%IrMp?woy|I7^=3Fh zq=@oQzkf{u>wf@N+^$B+nn#6ud&qCIlSPXMCFgAE_yQ2znH@veh5VkBSyU-yx}f4; znvQKO3XiHbrp$&?J+jqBEXocHI=pmZx5fPR z7vOmz9}hll8*)zKCREibF?Jt38KFF+w)g5&AAR_%o$>TScl~zi^J~Ld#wyVrc{4mH zmdjhKnVj_DfccI~(py;51_@Q$7HnA4w_Yn(FsTX8UgEaTa=~`$FbbwW8e^e1#_cx? zrO!*AQ~E4v-^Yyog(KtWDi#T*#US5#VHp_Qx{uR+lK`x}Xb>`<$T#nPh4QM7*fZ)8 z*7`dtXP!l&@80Yov7=Wk2K7SCH>Dhoog6pRAL~GvnOBto0~%XOHPQX(CP}51x4d*a z3E2MiCd$fa0lRx+Pj6S!Eu@_9!R&8K3g;^E;e);lx!T4r`DD39#4d!s(W73A9VWBVyC4k^ia0@vSMF*b zQ{QVR%FWy%#dFeQ{P~-Bqlr*I&5Pw%vnb!yzjur!*k4$-t!0s@%lgA9w82!^;jK^@Fe$Frh65ufuQTLfn%Hcupi0b z_(I5OI|J@21kpqHfDa2HFUIp=&ms^5bRf8-2y*H>gFh8PPJK@>Z80eR&r|<2m*OZY z{qIiw`C<^$i*obn(gj<)YTqQAYzfbbvEeB;`+odAcDQR;zgxneov=%~75Ck`_myDw z5|B2u7C5#9a_U>uzbpmuLBl{!{rccCko6C{<9%kfK#)ES?#&Q!Z%+zSL z-vlZRDP!HrcRK`bd6c#nsi90KRwYpV=|@p1F=o3Dhjva`%oYVN`qKd=ylQXK))ezT9uANCO5W8l`pzubqNCk`JUrAKR=4eqFE9v`Bc?{Ap zn~JWzBr0sKSd-@kLf$iTl0&Ow5?2#--5OT^un%Irj0%b0_-hA&!FLz1fftAp*dis% z#`ieWAIti$oPdt38JiAS(;xUa!T<_E3|5K*6d%ybzv2EM;IbPels zQsrf$sT-xnq@kAx5`?!qGAZaTJegaX9TuKGgYKfD(y7!NVz$zi8)GbLN>5&u{Pq+wiMXAmFEx&pqmF!B5TFt$Qpj;b|j=zgo=%Y;qh$G zX#fuTgLe2a)HOYdC?BzZp7JgG_Z20b3{S4Kv^ogVK^HT+*@x z4hRfuIFjxYO3bxS#pU;lJo5~qAszs}VA-9qfkVAP^jKU7*5Vc&Ebrmk#n6iLahy(t zF2Oi8Aa{Zx1I4|VHbm;%O=Yf9v#liwDG800Vx$R9Fn2VFryl47DMDk}_|p6cOGTt< zC}+((o-av$-G&IBjRA4i6ApkVe_k(z20?NpKd+Zj$&ZGjtF^5e$4y-4U4`V;cx{f< z4T=*A+VH_8gCGJFn_bP+O^U;1Z+WkiI&fSZ zU6bUIgVNun6jXtyRIdud*09n<#fuZXKl<>Q-o(Fo>5C5#{ z+-1v!we48q+r%d7Gk5!T`S-Wvys>w&PSB(=%gau3SB;ttC@E+YI^ORs{9*fFDtJ3> z!j}n-eHg4X{1FnSgnn~+bW8(9KdEnQm(n+@-&Dvi?n!C#Of zZlKFjgB+uXL?fuhQ9zv571=KD%g}UtcXYV4u#3Bj^6Be_5!BLgw7bUl4(EW{yWXTC zq7XapZPZwJlO3YxN%c}B?Vd4Qc=5z&Jm3zqVkiC8r3JRfq;7;Y;mP*6BRj( zCUEpCEyGo2ub3&iW70^-TdouQz_z}OpSRYL4rHShMa!9(!k*LI~VsyR>_!b zsRpRWHdF6I8_>e|?w#iG+jqkKAQ#tGBqS#s-c4G83(0HASC2fE983Eo%E$CA~pX zf|5Q57qv*TH#2AhN{_!N9~TKF_fYxt=qt(Uy#uyOtGrOd=;>ujt_6BEl~H58o-y6D zGp>|^%jrIiG-8F8V%Q#R(FPoB%*e{9Y{z&Su{?eZ*S6n8)&7ll1zrAo>GRRY2{G<2 zBw%IC;NvPKvLPN0qJx%RZjC)fhhqpshK2&<+j)p2QorKCi zCa?x<;J5tVKT>m%>`w<{)2w|JeVmrbb*lWD%M$x}3tBvFn0?xenXnkWOn^%hOze<| zNRtA_1;mHm3(ME92P0ZLJyOJ7Uz$N9Wm}=wxI;NgT{-iHa;*hQ<2d*c_U9YXp?!xo z?*~ z0@eXW1Cu$CXpHlo9ctn8F_hP^fu4;RUhl(Dc+_&j9(~_>$ySpOp(F2w=d_5s=@2tm zB@lb-8zo&5-l3&!)`g<|EPo4evMu;ga#W$k{S>WpMOUg^vr1yGh^95j1Ds-Q>Y@XT zBsV`*(cvK{xun?{g>5($b$3)MRl97{ouRoij#a4|Yz{XX!iK&OeVQlD_ECdmpoePVzQ}lS2nCOmw&0S({4@NMR!uny=g>}Vg9;s{*>>jH za{N6MxNAY=GZMm&Y&f48^Mag??HUCDnpgZART1~PdvA=8KqFG;MQMa6+hoTKYERjd z$Vk3bK)-8nGYLJHlOIICmyKq^LfAS-(l_~JLVKn9zX~&j(IlI&`pYLGAlrRBIis67!xOw z`Xa0f@mMDNFLuxl;Lv-ao}V;_h&$;^d#hrSYPVf1GU$YgJEbW{5f$RpDH~2?am`s9 zZDHdNZkFO`ZQKmLw&|A^j?*>5k;H$M`bO^4CnQG98+tgTdrqWptw-YjB;AHRJ= z|I&J5AwpVD-A$?1*=V9_B0Xq69hlJ;3u(dLBZ60GJ-gO5n+Lr>ov~OLw^=aJu8v!o zD?FErwjHKR(i-0jHl7(S@7dVyS1H>GEQ>v%?2V)YThCc31M|lf4Ab?chrh(>&j$_U z_(LM$ho%xN7JI5(ys5m+p%=5`!<#k3B|jytD3UTZx4>(PkrzDc$yNbOf;KVI%!s`E z2Mz%S?rUwe3zs^+c=&sA%mxwxT0;4XJH6wial_4i8Id!Y=ivlhhr0a5p*nPor z8+e?7i|Qh^Jfph^LUZ%(X;UM!`oeLq%WGvu%88SL=gHRB3#{I1 zdN~xoc;~I&?FDp^F<2BeeLefS$ZN`A%h<0fzQ{S-F3 zmg53u&6fnhd_qR?IHRq%&<(Srzn~XTcrC>oRxf^wmQ&OrgtWsy2Q)L-$yk!Utw#{{YM8Zv<4Ss3uC z*!Wkg0udySS}&K67A2bptjeV0s<+d3pLU zPl5KPP>)&>PFi96%`!s#hnnFYOPSD$Bt~vnD=Cjc3P(JZ8?!B&ai*^lltM4N4C+K1 z(k(f(QSGP%?Z=~ABFOpwP@n@JiEL=hLWvXI=r+>Sgu;ali3vg9A4@5sKl=VsJ32~J z)%a&;{pB-CLu|iMZDe)S*hDRn=oD_Ax|DE)j`I4AN)YoSAYTr(xGE7*3>9md!wllI z=9Yx`6*2pyLVmF1DWuPG)uZr-sRY8)?BL21J154a-TK>dsh()_eb0AvJICoV`4rar z;&`n}sduLO8spr@VLNgJuY0~z3uADZAFoIoTSVRGBJX(fgA&_9c~ zkMeoEHkoP8aHN<0WA2V#q)gYmv!S5Orax4M-AM+cWP^C1mB3QjAP{sC*g6~Z0$LcH zm<=+Ah66v&0kJ@6gmXNQ+%lkr_VFGK?b)ersc9^~^KRD#s`_{6=TmQOLnz z3T&PWqLsOxa58c`fqHvgh@h9cYKBS-XT9s5a1Eu?kqVsQrY#ANd9ex3tgaXfzYF0F zZL>Px_fKuGxg8+)&1dq|aYvVQ4)1>@aPn--6TF-YA_Cq|nK`YDs5%<4-$yW-AID7} zHSS2*UcO0HRpbtucF4aGh^{NS#uYhx`vE0&x^dNKm&IW>Y*(}2E_=i+@e+y~4>k03 z?hvLRD%&%mad*-4WUhEja%QSMHD=^$Kn~hyP>r!3yj|V0&zF&3lFI2?TB$7iMkjQp z!y@yJ$b+O-Rt&{ONz1@b)a~o%qtyKE^Lod!kt2)?n+|G0Hx2N_Ac+6j`qH3S-#1;N zdfbM4UA!AE93@DJ!2FfoX?8Pcc{p`Pe>FyP-`Yi#0sAzdP3es|-QV2@cqQ z2t*DI1I`};@jh*Py%F|zv#{oVe3k8GXYkDshz{UyT&C{!iuyU^YKDp&Jg{k|y47S@ zfE$6|VHE0S@A6&GeJ<2|1T#aj-Ls)ub zsDbl`L0qt!qD|NB;EiDrnMUyozm96MS6Hn2u-#W`U!kON6g(Wa*&gN3Kk8Gbj^Ira%?Dej5^VO8)^N-&5 z+$P?Z7hPc8k027#`#x*i8GHEmeX-pp$2fSmWBTNfDrdQ^UfO4Fp`tnl;Pj6md_2gQ zN)8b+rV6}-jHx6R0wvObW~dp&7wCtsp#T9k6pN1W5tP)z+KuLm-nV55oUq5;flX$0Ulm4Z@_Z z>$lq=Op53dkSzCakUp1blKhMFQy9Nf^gRszt6MNrDhTH<4|HIaQeZzo7$2=`O<0u= zAp{oV<_S3|wE=Sk?m+e_{o1KN4t^{g-qFUG5Pn)1sQ-{~hr%d*O#Q!9IYUu0@q#HHx)v*FZ>_Vp{wmo?mM zt0;eks(pX!FRDp9{l@VVWQu>z(-EX>YLP!$L_s#MnPF`&dhl3r*^nW~I`^4=1M*x> zZYfRu_f!x8G_VPO+Liu!GQQ;y@f{^9UHNw&j#SIFOSx{8Vj9w>Zw(;RYG&XSr*`m* z;gRx3ww3Am;)>ry6wjmdpW1|6kw_^AL@9lNo+yXc`eW)+`N!1d42p7RC+%8wmFFsV zoH5L62PSvmKx~MV1}XLR(@vJCgZKoa3xwiJAX;hceGiyt*g>y1-RTY&#lTwZQ4OUg z4zEA&bK_FGAXb9IkodKyKZ`Pc9Tz0;iWMNFjHZP6NuvpFq`~Xq_GE>%SKgG6wv4t7 z5W!%85$?~r&rx9!3FeEv-VE`?FCfan#B77%x*DjPZ;zhwV(7!);EVWJaqC?NBFIAC z>k68Ln88{ZAfiXAZ@?ZIAVQ#1OCv8VDBAI+x-?tBCG(1O=mwAGm_)W|H!hIh;`wv_ zLEVH46H?EEmej4pD44DJS;smE=31YFRya*n5JpL8aS$mW5E!2+dB^tHM=UA4n3p<; zGY2#98NJzSMN9Q104;;4r<;n+M!;+X{n)DBE6Y4WLBu+M17Ti8=?*Y3x)pG(7*wb6y_nYzci}FDgZy0eK6XP?n<0kI=E6TEPdOPvx^fu5 z)V=UJNqGJ){^rnZ!uU(lbmGVFvca0cD}-%HTRQ^p7pq*CQ6$d|*y%$~FW}9;PH}$*MXtDQ@N!#EvRv!eW{@;_fnIj{L&?ww> zBiU?$N;_*px2L73Xo?f`X?))&wE3~)G1uO>@sIolQ zlqmdQ9kT>CCbK)9ZcTQOaky8~gt%=U$M_c7P;Z^A?uGgqn}4V(O6GdY`$**}sz^Gu zEpZHy=GXNz;Qa-V2~KJO^rz^W5}8rwh3x!qHa z21x$RbkX2H8!t90{xM!$0{vyWs4Ro_PHpl@L*(G!Ocyn;4gZ`j@)Ti#SBd{|x=0td zE2stbu7})@Y|>vuY2FuTdxmHDyQyXHuPG$2D=-_p)!pUyw;5LdoFk4wgG*nY zs4Y1Wk10)$B)7c(?iLSu(QrO7hrDQbgXhs!XyqKkP*8Ugm4=|2G z*CA8HCcQ64jzdUw8+~25*YT(IV2K9MbGgyV=DuaS14D8H$BJ-`Ckvwa?&E@gC9@$v z&URr)9l+PT_RZrjXMST@pXSZ;!?D-t+x)Vu=&M-+m&-P_&L5J%Z4DqAN)?w-RypE~ z@ZfXXHZHS-hA}?+2GYH&yvLNQ(%p+G$BJ}6(7;a`L3~d|qBzqiT|Y!_SZU=r&(6p1 zQ-3EmP|XCEE5Uk=AX?yj!z&&6THNXREzSNTA*%NF{iKt3jkbhbBsuL+C^HC8!ogWk z`$K4&Kn7Nf!QdJmVLs`_?&g*flzLw8$2G37%3cR0_uwn35w7>-^Kfsp(-rl+o%c?{ zuX!(T+A%|sj^#CB@djkC-dN2Rb`DNwGb-xpdyH(n$|oEksxSsWX#z0;wAMq-ne11c zf-{ld?-(u0RF!HCm{HLeeU4V>T4BVGad!+x5Xemv({rsPmwNh(hDZ-Br<~OsmGmDI zl1T1_a##zTd1GP^$ZI0j;GeM0QnKj!AOCQD482j}86|l-?mxHp@3RNhgxVQD^%LFDo zv-t@nJ(^0?K48rv{e;DsUnH$pd~UCfk@>50($u75gXyfJ_G#$>E>V8Ar@QGOnx{9) z7B)~!lOiqDZhyg^j`R|4P?tTgd)OB_v&l;+jeMXi=`HLWB?lrUZn8d7vZzhm={r+P zGX?#{bDFP3_8BMZ-mCYX&^E0eMrKYUsk)Y7-tK}rG#=FL#)?%U>3g&>WTZ@oRx|9E z%FED!F7`I!u2dZ<3*FZZCDE@_z^QKDw@pCC@dvCPp7dP8bSz~(%^cD_(U@u$+V6bo z5+)n6p|CYB#-YBMCLZJiw(h)KBy89NUA#PZEjdycoFwFj$i0Q-zFm6RLaUw?nr5-b zEw7%Cn=8ENnIy`1gNr#47Tf{-=NbleQct#g*=_!z@#jB&v}sxO}S^a6Pdi$hdpx_?xdfJPc1u zip@hu?~uY@;Omh|My_wAxkPjXDD2`VwHQRalM?r__I|;&Hyn1zYH2w(NN$B~E2xu| z$$vXc0NMTgeuQr<4VB6)^Std7e^+-3;C@I~Z{+c_U_q_MPc+OVE^vQn+ywy+Ues+f znqB{`+>ZE0^M-?H_qF}f!c@i81jglnyfnbjQA#pboNWGS=p45B)ep|>nrOKtM>?fE zgbtDkCb=xK!$QdMU>o{jgWT#uY}2i!cg3I>ElY@sWA*MW`>u+0LxY;|r+Nh-TR?St z)BI_p0rJ^XzgyqVyRe^ikv2@T_j(ogv$}bO8D7ldHOUdfr_y%c$iSXA@CNxWl%Cs3 zG`&4tFcm^ebRL{27)QQ*9f*?9J;iI#!kKGIm4w{0YByQGsA7PhL>ek8j}WScV8z<3 zk`l8gb)6K8tsma7EWqyu9+?3=thE?`mT)GJFEQ~2CY*fQq758oL6Ahvj|p~W>vTTb4`uXTY?zCIupZ!q0AP>Luta#^2hhI-~N^s^3>>6&2h~N zi>tyLv-;#{*Jc6Cwgbr4)^oivuI4RHl=LY$Z@GvAC=L2Dh1jRDt@Oot=_{6i6+!I{ zu3mQ8C5f4yQI|FOvo6cjam(=myT(4X{`>n=42=ob_Ek|L?~Bix)g#F3bsS@}-Ym6w z^>%@hc{uH#;AU+;w#Zevf8?0d&0SPl>*X4HL?-7XNe%bz9$k0eG_H*eg35wTEqm~aiE4K`kCkrFbV4GABdKOQ=T=QtodId!W^9g8 zM79A%9kshe8C48f0adg_)>oK{5_%Drs1?@u8UwTP8&_E|4+3>N*-ScEwE{#62+VyK zoh5Yw%<=7MJ65j?I%|)1j+E-UxlRS7#O^n#8vR_LtLC0J}wWJmM!0)A{dMFC|0@&zn&9Cd*j^mOLMMQxScS z6P-QU6TziePuH}dS%1`}Brf$!$pA-`* zHJq>$(q>J`JdaFK@-;?Im@rytXvpc$D<1I29gm}658YZfu{2gR#Txu_;2{37d+efu zljIj7BWFI&@OdsfLTc-E7t3`in68HGEaE5c`Yg{wg*TR-q7))Vh7uw)*u0L~>E2Yv zMM*ck5bLIXDlmTd;k`VYN7m}P-bLi4t%D^Z5$2!E7h*I-e=J`JqH`Q359BNlOu&q5 z27gs#17|g2f66sw5PwIL^s=Cl5(QzsG2YFRe^L>@duglz)?Kz~rjoEN--BX6B4w%^j_0=?-QZRpsHPXv*zWwUAYh28K&4 zmQw^*qOH9~cdLGmh*_t)ahx)g?v7TpG1VNP+-~SAH^a6J9o6XNty0oZan@VeZ5JRi zWy$(@{!C8m1ihF*Bgb>xs=Gc#&JQS77Oj*DSqrx4;YWK__;I^S9FL*N7A>K(l2x3D z<{8DxfM%_T8M8r{jIf^NX#j8X8BYXmGEc#@;fZ$`~>sDDY;mrh9bbYV?xJ6Uv76O`LM~IPgWIh1xe@^ z=C})W5+$O13|4VXsE`wU!|oI@=%~J7T<}~z3A+&+jdOu7A^+N=N?)&fwvS2u2jab_ zeqXq-W;JEfW;48kGZQGWDRk485244paII8EUAj4ZT$~9W-@f~D<13t3R(%26ifdF| zDIv$_^ZIOjnrN%-)72|{=-gW%^qpEQB0$SI!aRYr`JH3AL9*E>tD+t%uIhUov|UgB zq{U>Ar7)X|vgcNh-TU}D#yVK_`0vDJ+KaW^^{&z8m9KFLWbL=F%*Vsat9rGzQ1znvb*Va<)V~>tfqg=Ucdq&5puBU`(iI3m%Iq?CvyM*v-GwU-dV#&-Zgy?lo z4?Io^kJ{8?BG8Qk%7paXwB#+758N>G<2fV0#J2kMlpde@J5AYSRH{M2VHT5RpGxv)21-$=g zY#_Tj8|X_HjZh0U%({p+%}7`1LcZ_LEfjJF1=M`sn*PDPxE?bxP;-oFKcwu5nWuNKnC-W{u82(k5uE( zW0nN_&{lBKkD9>hpZH?c8`@jA5k8RwutoaDsh zd`X?HWjuF29$R?@BCwevEub{O?JOJ9cUZmZyna*h3i&*=LJs!$nXTu|>QZs4u}8_1 z>O5$;BjW#KW=fyO`pn654gQt1G*o#(k|j(IO=1rI z0A@|vJg+>?H5EJpfx62cBGdWxvZ5GYt?I71pvx0uRM%sR_5<W zcTRqvz`q7On!F~yYMo-*AddR=neex63RG{=TM5s&W|%kG8fnJQ&+cI0Yj6zAoTG@8 z*=hHK$d@-3c1r+UB43U1wgw|)xyo^M)l?^1gy;8W{ohkkp|9devB+)VjKxNx%Hp10 z7g+xNVz=JLAO$tzF13F*S;1IH|EjC5j+e&>-o`wqYaG!jDOl{tc{Cs#FF^GZY1@v6 z>l!vneQkrGpY$7PmGKBX>3Z{`GFp1oKbF5!W!crl*A}YRvh8pF!;)9wN=aB`XmQ6| zoSgrMwzmwb^Xt)fSZBI1Q8y@Vr&$tiA#Y!82Uf?hyy+l;kzp#d_$h|15F9^Ef@F0INXip zvosTqj2IzSwUbzdr|?R-x6`@`M^jx(Cu%cwEuo zng&&4r$y_C4&PTg>{>qInGl$KH;J@)OEo6&7Q=5p!FJbQ>~wWrS-%%B)i~*36WHw{ z)lm>|c(6ZhDTQ^;>#sX`Jv4>2%C;X8nri|)Y;>$1zp@MyKG&E5pDHr0WWGO(vx%eN zLTanY)dCF)#wv2mdo4YG+q013pL7kq{o+AvF|)NEsW~cGQMS?)nfq#f@tp*48mN2s zon9*h^q-rD-B!~n^9-8s$#u!N5QBq|F-apbwbH zo|(105?f7It;{-qhE}-NigkAHWH%f@+|-rA{-iY6Na@XTudo0HI*ey&7f>gzE|#DN z=frE`!XormPrnGmLBIeO?Kuks zL751D4jdIS@5#68>FdnnN{0VTfy}9?*#|4wc_xdnI2tu4zGNUTv3LHQw+oWzox^;X zSK?R)<7OIQ|M(RIe99KOI|hX|0;PQ zbt$p7{cEr_<~;}k?Sc$}L+U3k`W(j)NovGIkyKVNv*V6nEBi~^=2WJ8@Dk?2-776A z>t6(3*jyABpPYaEVC5$L8zf;Nljd&z1?+$z!j9tz)-qM(--E9%?XM#&Y3)D$_Pav< zutj{~>Gh$^#}|tWPe@n_`{<`~@$-sQTwfC8$msrupliwo;Ujv?;mC4ic(RnDe@vXB znHfRR+i}$scrVR$47+wOD;*g52#3iPb#aF_n z4lN%x(juVFIy`1qO4gS&os+4M8c97+wqJ8el&*ZwtJxlIJhQ z4I(~8rk$gCn7RQ3bzcP89TV0nOMz=J16oFoAF%k~@R_xT__jFcNk`ws21#)sV^i(_ zpLn?c8xA)XU-^k;#{?L!TVNxn7awvp5(ssE=F)6x@VD3kiS81&c@fo7MpBx;D9yJtYqAM&G|h5=fA{wkn{880HA$ zh-KYOt<+L8rCiDJ%EJx)KvH*7NRU_3e$lQoW7Of&t^sdOkrY}_1fnt?vu&m2Gh3_3q zM-zIV%8`lUV$S35j~W>X*8Cn%i?r)+y?d%u-zL(44d1!kmukOST5|!}g%VSpRFuPf zA;@<&(X#_|1&jskLvk~YT(pJRa5C!yUkw&2bWU7bwM3#)l>blS8R+;_l*Id+ic>Ni z>wn@ISr!MFp8!xilY%T#4~l2}fJn7JLHSI6e_MkdL6-d(9o_(}HLBWA^Kuk=+z@P3 z-1_snZ@hF!11xDK8%_T~p%IOPC^YQn<^VtH6%d8?1w^5_R0R=8?EOQbv55^-s{B|X z=dvM8@6{ZNu@Q-3{WA}O(5l6;Qn@f=76(>$Sw5%_xB6FifwfIPDj0~ZBZgLY|9|-? zWNPDpm)*>em5Dttvk<8=?5a>Qz9YGZLGDXAIv<)a$r) z6S^+nLzhf^p7tQvGATwWB&e&8GQXM{g~*V3M%3o|0p46vOdkM>n{<=FB)&2 zZDl`(5&0!WS~W>8!w~wl?7+OA0o%kyzgL|qD4L>#V~*@^2pO~b240L9_0>X?6A7fW zwuay0CK!)D2u70j@`2sF9#s3Xf9sv{1)+}Aqp39Jc^U4&*Z`m(3(2<7_DI(b*w&;0 zzhjKl<;}1FaqAGp(~o`PnDxCl&;Rc)W}gfT{I7HP2ZXmXtp3DhSlO^oZL{a_2$a{^ zN&kHgpMRxJd#@@Y=P%f;l8vHKtf~sQs}ZKw97V4BDB5)${>^Pw3dVJ&p1|-frewXW z$lY%y4_I2?T=%SojMNNja($`bMX#HHK5gT}`On&C2?0HQ%0(s>4q(ts(2nhfY~mL# z6(%|rl-5~{jgb!HPcQ62uIzW-p4@$m5xiHiToo(#efu9FXHZKAcMm?`$7uhRQWbD* z*uZBr7V^{OBtuPZsz^Lwr#w_s@jz2oQM*~EoOw~%1AUa3-ed%9Mi8@^rFMTgI@-)$ z{vS>96)){KhyGWP%=w2&S``r=b@d}SXpWEFrkU{XIsTW5*>iOFe?eb?vmofptGS=P zPfBwlCBvT+NZA#CfwiSx@q2D^E6->=O4>I$u-rJr9(JID1B87+`pl^4nqZzN7f8hs zOT3uaa>&Y%ekUfn3t%adrjFiDHkSctw+5@~lXzwYIg5%SZn{Q(2u8Hw&l*C4Xoly=M2$EGU23SLmC z%{PKN!d#LFo=dMP#>cdtBHFOwXt06Tu>E+{fYv(nQcOv5>zHcl-uHQ*y>hjHGKpMA{%g-Oz^r19?ye}pg#<`k4ea?$ zM!6Y~c`dFlm$Nc4@&WL;+DRNpq(hKTyjVJj*0JK=Hk@)#CCCb}LhX1BvbZJs-f7!@ zz)+Qz9?CG?YV$1I(8b8qD!x!>+^1;lG<+(O|4u-LXX95*E4>w%Qr1Al4g6}+tho~} zis!PuPUQ8&`IPoeQhXp@WQSE&-Z}lA(^p+P=8rR?J8Y1-`GUN#M!8oj0x2Q^N-bap zy_n3j-wKZCh$FC~jML9_gqJBCbv3B16QP!J&-8(NNtPaKI@#%s`{i08Eg0KRrPln3fNe`a+rjRuc(zd9FJ zCHgZZJf6F^^~Hn${@Bx^Rw%*LT(ci(CfJ35^o>5tUNcBVGSoI=%w}&i>Gw zyLjG(ibufoh&XAN7{nsT{+mTm0kH^zqaYT+>HB}O2qyW$k^i6wgPTLkuec$2CRe#X zfN>#FeUY`vQ?!eY1omVL{;ERAEk#UY85HZ%v`#R;R{d-7t!pp7I>dzx1Is1=(f3)k zn3mN{OJ*+hKoj}D=z`t6}ZPh93geZKDkZ)Vp|CZQ9H2qa=JA-Zt}kW9(kR9GB)(&9|gcWrJ_K#KRg*Rysf& zV>)1O3qx2*AxU~Ds~e9voi~z$(aLC3vyuEz0cl5PN!g3G$}@9=q|onneC_rRhBWIL z&^bK{QWPaeutl0gc%egVa2k&aO8zbaq+&_?p$by5=zj;PST1G18WNa<>P-($q!VjG zVck~h{%v9-kE5S3_YN%c%Yv~k0yod{J;XMF`Q-z?;|APe?o3H~vM*=;3RB>}y}K@& zQ&g_hCX&~Y_Os={kAt85ks)&~XOse;rB}I|d9`mx*AZe+BaYYJ^i9(SMX2AZcagam zo(xMAsk~~}r58}-sYL@y?wqyW0>u;^j@gjfe$mx{9$`BBLe3paRoHhRa;yjy$i~7Q z@E3DsWC?g)vXY~`bjhFU?jzjOSOak$Ma?O>#M9G37PdQHWPoRp?_mpa9AK3pB;oYN zqNw=dMi|Dh0t2~I%*PPbzy3az!ux@wVW3W1{#(Ee9$7woc_5lF*QqhhxY=q`V%g95 zW5YKco+nGa!DR}dsg`chgwHE_`J0bf6gv?kfkV26H$l6^=L3r^;443jQaIr>61-^~7{cJ~#N z4M3%|<{K+tw-w|H?&rtU20A6bB6Ii8 zdD0ECf)DP43l5qt_@8#1^Ft77KxHaskez$Q*_tS*VYNz&ET2*1n5pxN??*-t2c05X z+|onwh%xO8PhURz*b7!D8Di6>)Jk!z;QbWU#1SCaBwvL}Qkmh11 ziPCR?%NhZ3a~o&i`VDu;sIWTvjfli*Cm72L_tmFSDY<{vZaU8%C1|omh4M1}I_!u8 z!)kns_2AP}$kCu`je{WJG)O5uxb=gDx9!0oF7?G%fivns_M2J#q8VAG?+l1qsP7K$ zM3B@RMos)}Mk(0qV3f!gOnt_^OE@c?Ly!Z5yygg`c!M}2aIUe42DRF(|F+s1!P-Rb zszPlSA*S*2gLl`~Dfo5oLV3?@QgOjsCa-B$`*O$YY5m(}*)RRcdZybPsqh=izb*a+ zJ?_bS%NxZ7?%+!chUCSgf~Z4C4IlE!br^}7k-b8v_$b1OXE#oh93}wuc11XXOsEG842;&*u^Czh1&lIfFC+NF~vHT5hUE6LmAal*1o?rKc z>qqsDy$6=n zM35(74~*E-@qHeWF171CCQtby){&V5C8593Spz~nV#`XYDnrqGbXcVOn*$3hx^(4c zq84d>yoZ-zjp(Hf0aTR7EJ`19ziKNFBFg-6C!lH=l>>CnX{k)@3Tm#phTZfWys!r0Q6YnMb$=r!s@0}KYT)GqDob4$* z*HfFzPo`yYWnOvD3ob*VeI-|q%@FP3nLiJc*@Kbj47~2N6bo=aby)iTfyZ&%6A9wwVOy{3j zvM|1^{snN4Phs+zkHGxh7;5*@_6udFoaDmyqjmjs&wI5yatn0Vm3zJgu{h!Pej++*oar&1b+|vAJ%agHi$2c~*Nszq|rN)(l8h@k?!AH%x(5QQ&cmjvS>5Hjb zF3(pCWBM(Wv7hFJzx8-!rha2A#H*auhq$IIXOmAuT=;HOj77?$7%MZO{K zr300h?l!MRi<~%VOC8l+hu%llIvaEXrT|mcPg*OKNIFfFs9JH9NLsdVFqKqLNae0p z&`oft=*m~kkQuPPk@CCh?JhSS&2{sb&pmHW~|A!;69-q3V z4^+X>Y|T%4m(Wnsu_wBA0%Cz?OHmks`hlixmF=NLrtY2z8slnR%0;&l3^sZ=JcbJM zBL@#+pNj(I3%58N53(SBHf=Wy42b~0vgw!8PEA&WOE>;)EdW=&R8iuraIf-SNh|>Y zGh#eobyKi9lHjqU!|UcxhkHZAA4Fi%b8`Vtgr{jt<+o;lrhbx>syF>Yq_n)6FNJ9I zsyJKd&B!E13AFLMUn019#3I53_sssku-FyWpH+=H!fZ)H@lQtBri z3&RM}&G_(@)Pl z9F!-i393^~4G?eW5E(FNRDu?>qP?L9ezqAOl@Odr1Lm!a(RJ_f}4F*_n|k z*S@nJx3<=Cf?=U`sun5D_qXQYZ+csfs42e*qzzs-C+9liAh()ts#m`8T>mTm$UvO; z1tIN$b#Y=ZlFojSq_J&97_^LV@p!2bVtyI)G?knJ7eZi~d^g;Pa$}!U2~7kqk5HH{ z&Z&Ty`qMCGYudZpNS2H-4HVLHB5v_L2}YU(uz^NJ(Oz9n<>*=$iy>o~CRpq58JwrK zO#(^xV)|8}cEi4JhCZJg1G+)~%Y%)X*I9BcU-+-T?S_rE!_=;gRLoZO9ydo$ra7_5 z7M!szg6PYkv4-eX47;jV_FrhGtrNj*tw52y4uScgq13<(?;+s}QLl9DPTyD`Yp-zF zj06<5j4fFAG$H?nvk8iA!)3XPtC7hZ{O95bU#%R?*AV>gvx6Ez09TcTynBjpuXMLj zRs0?s3*;X!(?%)FMi1=Bc|;{2mI-^yJhtEmhS3M|bhNr?0+Ma&3Ir08+7*l@c)+`` zOp`U`SqoS3(AiaVt)chElwrrid3(cqWf%SqCk(yC43EY5bAXl_10M!C*DL#uPZ8m2 z;n>17Zwn3jb9;&`hpedOU%^t4=A3{L;I4eqqYF;%3l_iRI~}-~rgn##{m=}RP5<#~l^lW6&6lW_?ynH1`PwN&E~pu9e&lc~lb z9)Vg_XF6YnTYSA>L1Gq9gN)-Ocar0sWEp10T0c*{QuqYHzGu&}QCCVN;jw4WaIOz2 zuE6rsta9J`w<`4RXG{hkHjSvQ@!37fB?S23yHJN$CipKFFxgc}wUJb&B_h==hS zG7v84K~0U(VSJL|1lSjP;ImoV`gp?nex9<X2p zx0*i1uv7C*Ndw8n4ZXL#ZP}5Zh@bXzR#Fy2&S63yTQZUTG7W&*MURGVpvFfE?%9dw znJ?rQDyoD~66MRn_>q+~9A_a3?jlz$DhIftz6WxRc5)+A~t%>N;IM(OQ*;5NP zR@lLB-%#M3Bj-r=pv_`TuM)m$i@`eRMGq&rC0-AQUM){oK>Wl@X}W0_lIc?#jsT*^ z=|J2j?$6*ImA18$xh{w6cc8AR#*@n?7*NrWfcyURDI%}rQrs1g86jFhrPYGa z?er&a>h`jZ_V%DJb@4l!c%C4X4AcBa=?IrLCvPHo%e36g() z0ch?zHup)~N_qeG3TIJ@U(ceV4gr6L$a~HLT-&+N-UeFl>s75*t&6sxFt;{XBX3-b3=EkG9p zrWF94ufV4&c<~Y#aj4A> z;8Wl8orWwy0sR(~IIdz@oF(B!=HAF{`0A)P)j<9poOF=CryU(*c@Wna2juT5g2fgI z@}k4>!w%?ztQY5vv}fUrLHCVpe0mw*jD6ZVj%Fdf!%;Balru{K#{X%{F>wa-$+mmF zD4gd5)KdW=pN~|)+IBi~`oKy&*)fd-<2ffQqmw&Wm-;CB$zM3TaZ-yMV&Ol^Tl(b3 z1aMDP;SK1yR35|<{)%V$^{|C@rd0`FkOCO55$HkBG=gsFzdJ3aN;2ytOq2g~TI9wJ z|1_=w(Zf79j-76phkh@(67mO~T$q)>vOANd>2MoJ1AI_*j2~1!37_qRkVpLdr_&O+ zEb`xz6jUBEY4RcaYnl&3FPUMBURool>8Lhb1gF#{hC38#6U{){l(dW zUX#qZk|g#BuC6>8;P)-;6GYTN@Xww@rSdu-_y-1g*^1wS1788~^R9%`@7+V!APi(9Uqu;F$@mG$je7bNn{{bo3@_Ny<8yKfAOR$~q? z6JHG25SGXhhB+LcLBZNj41ffq3hHCqh(szD3K~y7g=6juL>fP$i2e*B4{F0!CrJhh z9j0bbiu0ShL>Bpu2h9*0rg;|vLWqoC&ye9ko-*SdFN1W6L?No2o39GLq=gMT1dHYm zX&GoH2hAa+*!l>d)t6Q*b|`q{Zxvjb_s^7zUn%k?5o>ttD1{{$gbFqlQZSAIGPVW3 zLME2XtXhM%Mf`QH1Epwlf-yxkYs3s2ToJJI%W?DoCJ*P;M%Dgk*sM@gK6qg<_PV$S z(YYhM(cB^I=*KW6etk{raNWONV2J3`@_k>Q@jqRh7%=z(ZKpfv^3of@oCiyCe{(*; zp)B#|O?v21OM+Fg@rOU!)7({rZ&#s5wHrz^H&p3{NnVttx}ZHX@(4s-m+5k%aCCUB z1RCELCx7JpvLWOx`*|vvSdHM2zRQqrO|{l>CjPAiPDzN;1YbO0PZi+$$q+YT*lcy! zk9O$>J0M02NJ8m{^u71J*veMBa|gW&L3T?rbvVeYoFkg-cVu&r{;Tk*#Eqth!_fSUIanF!$^~ratfO8DYfN?i(tqL5Ehpd(+Sp%K zZG|#$NDMpq(xL;cS?H7~&{W6sLR?1=0sbAN z0^;^1t}zvz@e?F#Q{eVh5XVek=@IF=@+Gm?4ATN97qsqxLH>CyP66o^&G(^rfDN4Q z^m_Zl@5=V4y=C_O_fx|S-O|>%y!rjh?NM7Yq07L}E2O^6hk{Em6E1+zQqnAN88K~{ zqj$O7Z@DqQ+CiT2^i=0fkMm7`mCGUQ{LBC;z!r79Wevl-mikZ9QtQLTo|}gDP0(m0WO}Q5`JELrx+)Z*~rLxyIUDil-($R71`8!uX!uFFxF1ik=d1&!8?9rF|%rT`1H(Tqsi{1dgQnKofBHCz2u= zb%53=Ae)#ih|Ff)v(K)9c_qNEaB<>@OnK3!S;qx4<7*LMf|ud$!zvra&5P-5`u8f? zBus%&cQGEEe1$qD<-=mz>Ohbz8!~^tsKTl%#e;QoX&qRJ%XfOhy}F_@YZ?B3Ze`FO zO;OASe3pF*0jaQWHbE+E;Fu`t+E<=IX`)VfIRo{?hzu>qEDujF-$nwK8R=xeb$%Y* zr&k+6o37tK<;dC*CydfiO`d%;2l?p+u4ZLC2D3|&6ScDi8pax8!+ij1mgWO4&$mSa zhG-Ol&jiC`Zx<7lcE&1wZ#s zNX#R0I23waY>ot`6rq=0>L+=NUD?Wp@Q~eXNa`FVr;ZbU%+(?n&u}!l z-teduLZC|-5*pt_fS_9$`mK%~nMj5GzaDv<;gQp~+h&m7lT*&wY)G(Ejjg437#H0} zu_iHDS%O~nz@73G7^_KmS%|*VzE{Q3Jz@T8fG%bbM1C%^h@U-7 z_Xt(%`+;-yAzh9iNjwT3>n*sltWtVTSOz%MOgJF_36Kc*dXVxJu|yj3A%%YurA*i}Wic078Mh!D z;kbHRkZDO${0r~%itP`9-wIqQ?vT$R?NCo}<=G#L(?AgRguIImggmj{T60h1a@>C9 z{KK(E51aKbZG)2^KC?Sspc1E}^j0WiEE<%`lC$UlvcgX8DtX&ajsC7Uyc=6f3PB1@A)#1&&N%<*#gMR zH(r4DtxgsG?I1nr#za$bywC8MOZ-6;VeFjsQI*7Qgl2bFWu)B(tE&_muAuyCh0YTH zTr*z+`4a7Kg~>xRk5IHH;}y5QnfD*5i^`t66E4{>-2U{ZP(lhvGrHD zC3>NDb9p$ZvvyI6H@;4{e&Khoq>6V^v97>QcPK(6&(e2+6+AVH4`(!HL`>@sr2zTW z-(@wU3T4`fKH_n9cM9&Z6fK`7z!gb&&(ZlRvIa#OARmNm90~b`7;*^5Ydb6@g6Q&w zq?bl5^M|D)7R=~P1Z$nX^U2~*M8hd->yV$dbU&hNO=jRDM+%ljhq&41jisqhX~zRQ zX(P(a%tiOVWmB(DC5p8>x8iHV;z*DKpHxaEWoT@mchec06jbu!T(LTZ1H$Jq?+P@Y zv3&hBiB>A{2Avp%mo;uLs{e>qjZ0cEzMEH)ZnSvlFVFyOxPaqDF#_D zV2id|lN^&w23Tk9U+ z#e~Z@{uCbv>CJ@8Gmiq55BsXmYt^zf4%p?&&Ks~hEW1h9^2jKNx7C`mJ(m8VZvudE zBB%(=C#d8Z`nVi}}tovaX0kF-{#K z$B`m~sWZKUZ4Rj#rW1v1USZ*bYD5^_3<{u=RSRO)? ziGr}I?zLSga+hZ=qKN0I|2BV81*_^(#zR}cTr{cCi4s?NM08GJ3e5aHZJEi3E^0U6 zK~j)p4a}hQ+-%l|9fma<`C$MM@aMI5hNJWQoKwj(5UqdbU0c9$7F7U2biLjxX|QjD z11^A5=`ld;ZlfjF>DCo*9W;moCdee@+q}TA$kQ;H;rZ8*f7&%kunqqmGDQE~M;UV= zbGWL^NjbEU5>aEvZPEZ_$eDQ5;`o1N5huc^7@Km^5(CogD)21vZfyu1@ zn^oys9OSU1wvwg*+={s9%*?D^vyqFlf()=|$L~FS{Horldl;oqh=U2t`L_JEN@gpm zoVmxn@&Z&ul+>*0j)WSfGZ=e-B>IUi7inNq;=jFBy_pFK^66s}_xvhl4^sup3%*)=P=Ng~N6BJWfP$UVIxH{L#BOJ9z1 zwdfaCj3?o)I>1^Rs?IaUppA?;!~3#$V(S>0_Q_rt;+T3<=O=4kCg`0D3BbZq{AkEu zSI5@E^y<6ajBZ4c)sPh-5Y+?hp-18ctn848HF%PS%p%R8z(#7ZKmD()!*~uP>(DTU zSi==N_vf_Ty#GaB5^Hxr4)Tw=8751IpfL^}DnrE9KI&($5ZwMD*kFM%{nINm?pb=S zG7ECyMk4>Zy0hu-O!O$WYTCCW{m?}a=IX$4#szbU2__$xnjHkTF3iMh9D4i+)D+)3 zd?KG?M`qmtV!5?gw!(^e)9yqZNS66nu%h9MXBLm`ekSw?7t1!9hSvA{`)K>oHNq>V z^B%kTBGHDu?hW8I*vL*hhvAKPtLupbG-zvyr2q>41S%50JNnBCZQ{wA1vpB006osBFuG zR)9sO+^#~IFs!ZOpQW^ZtI?2cAI(@D54Y{o^(eD&gNJY}Pj`H+SNqMP)*v*F3jpihI0rEIiU#NOGf~{2MI+{~v#@Iop&i9aLTrF>*e@p&?BHl_3RPB)XXrJ&t-t@-3?3Vl@4vvBTWp6sB~g$UpP9B$zExVp3SD8=>#XX5U`!rU0~S>r2(NrA8i+-*Roo>WhOmf;bE8 zZAqHG{I(>yNXb{rnZOv-B5>(e`WdvZ%Nw*`6bsyryL}j=Ju-Gw}EIuA7j?p87W>yN{K{`Bt4-cYH0Z7)(6{cP{YiQ~g;uFPoOo7;JX?WyiuMiQ*?mH3@0s1P z-Su2`k55eh3AB`^hRzn)6@_(T5zvKeD_r7OOtvz>S{*M=LZo7YSjgE+^_TL?6d_q^@ zNSJ;DA-*WTxP$vUmh~Q$KE)8J_R!DDnh`qrlG#)c25(u6)WS~5n%%Tl7UlmoVyy&P zEn232XtbL_^#*uHNt-~QuRg#$dS^`dvllktS`^WZ<*w8yb^uBmB(&GXWK z{0r7d-T4b^Sh4;K*09V4!5SU8|AsXPu0gPdY|}rmh74Pp?ItnkelN+d?7k8tKsB#C zqbC_^=dZ`hen5CK@3ym3{W5&9&#PwI(wQB!Wesa6BORSQ%1u`f0q&YcnhuXAZc&5_ z$i8+&Tad2hEoQk5IdAUn8ZYpZDJf1#TV!6djc*hT9ZA=!fhIqzneiF01*(o(j`u&h zdC;tRuiU&!C}IiIxbmF(D3@SZ36!eV-*$#|*?inIwt>uSPn;uyTHlK&Wnb0GBI;AH zL{%S!$&lNCNY~g6GHX$6GYO4cbCR@!iwb<9g4~^@fV|P%MRT8_He>&@+k=UoBVvm2 zEn)pbJ3Cu51!wMzlwNnI(RzqcnVmNt0HzGqs2s(6D+f?aOXg?yRyhFnkVE+W*@c`T zXC3pJ8OSuCb(ZyoPF20AB1TNhEn|{}Ds`5%&`fqL@lh(bK?Mu-z2+9Dkh(Wey_dO( z)(;LXi8;^=9Vsss3W<%^3VQGzF06((?5qsA_r#87N%4QX2(wOO<}fwJw|5~0tmnna z*RVV4ADCn-3%_k05pG!!Smf0CfVA=j6uM}WG)y015s-fOtpUFcg$WHZXm|gOHuWuH zU{UqEeN9gf%+MScH+$~&4^>>>aq5%+P#!D4-$S}Y% zp7WK5bS)N1?U-Tk++ZmQ>}?v1GE5C;jBnxTgR_1%Rh>@0Pc&NjZ%9h%Ct4wKbb2m1 zoYir^kTbbJW%WoSKZRsvt*#vi-$aZ_zoC^J%(bTAuL|6$G$C2qE$%^SFZ`eGP z^gav(F* zb@%M+_2q> z%_2pPng4I0PL98t_h<7l-k$({QD&8m6Upa2@!XX7W-Yf%>WkpEcmzd@F~u_f#=zu} zPY0+K3u=sG1bN;pj`L>@&~Y*E75KD0$Fx>{;uS#kXV&8DqnXUIGyKfHA_GLg#5D63 zWL&LJASVFc=sm$CCIJya0)(4?U*mF_5d%#0gHFn}M_pLs_!*VhVE}E+B}WPVn(guU z5o*G8`|rI1yPu*3us-ST;DSpzFCZ3ELYSmJ&l$n($SFVz* zm4Pln0BKiNQxdZ!NxKPq^AarjbYybxH!j_0SGwhc72^2 z2w2NHezHVvYku5ueJ82qQm&+@9c4anyQV>lT}(}o9z~bnRh#?`t^52kjoNsUFu(}H z^e%Ph?ecT`W_Phy8<{rX&zbZq-zN=Y`RY9P?s!Q;FC}xpC(ii-`BgX-_9gk%{a(;z ze;+1Vd#byvY>IO@V(pHqj3q#k%yzIAh(0_wi+T9Ur6Fik;* z8YpDDquEf4UkLv;?ikxF9)7({@&X3hGabXQ+vznUdZxIwOWP;8g+60@hDiUIXhwWV z@d4fK2+l3uA^wYTZx50$jG2L1DV8X5S|pyi7pA2b7cUQq;(I7hWDc|6&(YsM`Y|tZ zF;r`^0bg%WTWdm}xd$<$y=g)nBCpAIS^Qs~L!gff$T%xPqL#M>RgC*W0OLTU@ZBWm zIH+{gM;ntL5sFA7~ncl%IR_9z98oc-^@zk%kv}{;!GCNWS=*-h0%DZ(tX}RcEH)w42+A|^-8}-uS>H!0H$W!lt~%!C*Y#p96W@!sZyA@oJ$NSk z=G>~w_coF6lu8*AGtmj1&`@6zBMk#;J+5~VM!HJwCx|4j*(e% z(HS~DVlSB}65H!dHspcpLcJk|85><8Klpr55MAC`W;a=eO6*&!P->(CWf4+#-jF6Q z?_9M@%Dss8udp@De_b)Y6gw4XML*52gJoH3SnVSUN6!D%*;xj~xi#1t3l`iV zxCPhXL4r%L;O_43yd=20gy8P(B)Gc=m*B3!wHliEF$#emChUay_A@Vbt@ngs!Y2U#BW?R(4&8#rY_E?}e$ zbKD@u;%A80hdNcQ9+oY1p5D6bobiJo6bd5@H8EJ zX>Fs|ysA>a@^7yt1&59Q%D-)>f2eLJr6ez=c`cc<@J8u7Ch70U9CwnrzR2EUb<8*W zTZOI+P7E(Tor~>sU~8}mV&oPoSaaC22n}@SXsi%Vw>;%&cHZ@~(_pF84s;xFtM&&RH-pWrjry3>D#6$y%K z+Nj%oKu{YdT;Eil_;B!Lwxg&SSH$Y zv8zwfLJtB=?iI(m*#URMniSsW)av)fWq7Thb9*Idb`yRc1Vs34vnd-f)wfG>HjO7c z+}l6_8cb++c%uEed%Cm|gGFJM>mT0|gpbCk$mR^iJg4H8p*H4o6=Jwn2L1yc?`m&( zy8UDbaUUZ4LypUrZ^X~+6I7>NqV4-GON1CQO(cxridEik!CvMz3?~k>BF48eSf9bO z(SXn~^&8CvApf7(abuV0&O9$SVWhaP?WXaqs{c?4mw8#IDIo<5q8 z^8Njw%+gMR=fvfL)j;{knUz}${V3>NNZ=r)YeWKcAcNcKA|Qpee`Mxlf`;i?ZNtIG z@r5+7{ntz2KW_Pl}FJ9sWV4C7vsDmgAg!9MP7?emEa4eCI4mJVx zmu0F=ErAR)TFzzUW-mj2PN8uGD|8N%j|Io{B9dtfi}+7u{N`SsiY2I!4G? zcCUP+N`%4F$X9LJLG=;{H7~skwdA0slE$?XYrP{-Bx?VRaH4dp_!?{#1A0;JYI9>Y zy6S*~Ei2=l>AGNZ&Ol1K#zc?1%XK*5I>!7Hb=b;Uhcl3T&=#^TmhKBm?;RZY0(Ass zubR3;X;isTAY^~LyYQE9E^dW+?zLr-3s?N&=^Nfr<_uji&8|H16UsT$YMl{(8G;aA zM#W7`V0&MvOL5SOOEn9HV;elIeLUq#h8{t!8qc2KQPwnGG=j_v4?vw$g3qmzeDgdn zTB^EF@H6hkvA)KVzUjo)c3Ob!c=^%(S5$iVC(Iq+SZopbrQm}iZcq=C6q~D(ztJt- zF+(w_4qwWy1dGtdq8rnClr|N8@N-74W_7ppXwcD(Ohrfh%m~zp>;@YI7ZnUL8Ksh(b z%GTdDpW~-rHXj}vq!AXEk0tqF=bwO^4=CU!+xR=+HlyPB)}0+k{yE@=jV~bdt?4-V zLaPzJJf)nC)wc;WPB|uW(6T-E z=hROtr|`T*H~=Nsb{1R|Z|fMKZd!ArkSI`dpDLMOJ0$94(=k|&o7_`LdBdl6yd`KkHDh(k4INK=jeI@DCxwc(=&@& z3YpWU@rCQP_}lNP3+dQ-S3t(Uns^A3Y+&Pl$Rb$GB%nU$3b;z&v>#(8IF27xbe~_! z#P)(w!Vzn$@{jGVQ0U(SXi$YDe&buu-}n}IzfULHLG0{VDC4Z3@NrxcSE88lm08oX zgZDtPX{v*g-0{o7bMvGMg;r&JcJKm04jxSllGx9d9{rUWU55gAtbAwMhzPl7=dL=P zTyB9xKk!tZ zj~#lLW+%+5e(lI|O)TKMuw*E{{;l;XHfVutfj#hRcK)u@iH0v=jHL3kR3Iu%{nULh%-B@avp1*H3By80*Cq5T7sh#x z3(AEBr-&V-y@GRm0=nDuK>tR@iWYE~!D)zs(yec(-!fl->U0o))#)^B&69=}+(4AU z-oLnd4uiS>Va#d`!uyEkhE-BbIg{nW*$C#M^{lihhLn^kTFYq_127}?D=_kr`y zD{p-wX!4p+H;V-q^IQj$Yb@*Cz6TGL%&gsxUjs~Uwo9^zVPBAwmQrv*Z=MCk6C(!L zfBtR;9nj=&3UT$n6l68Ckd?N(cy+kCdtw*qvna8>~ z5IsbT>n5Oqg5hpjPw2|@QAt2=v1!mFaY45)di-#|?jMOT-J@s|zR^}*gd9V3a7Kls zjEBKS%p=8ckBf)8lQ4vJ52+)g;>B9K1N&}**LNv|wJt^HlSKTtMMqfC{OY~qlQ#jV zD@;FjcJX;rv-2G;93#?3#wP(TcWyD+?SH%dUteDIhNYD~oI9_zPiAq>Sp{xm^omrm zFg9g4*}>)z#_c5h>{qr#l=XW?vf>HaqM%{wKTNhJ&~Q&Fdd04zu@i zv!0QisNKV>(7(CPrGbMMFi zUYhz}dqK~cBDw6fsI?V&7 zht}O*yxrPuSw~4np1ILY{dE9;KmPYmUYx4`L|j7+u)2Ebu4T%)y`#UBS8FreLD->e zj2cHP)2t^!BA6L$GTn z&SfpUXJ3hYSK4{T-}Bs{6N5`wvk#k18OxZ?S1c2U1^=<>hy<$exC*6l++$ znEn3^tMdQBsvxR*&q>1{F%X%3wq5{vNPMdcH^nQd$Tf94bgZiK-d3ySD_2+tpCFLb z`tj?~%JSks%8o53qyPCj(tUBUMHIV$xEfc5@BL&TJX^3z2HW?+Q{oqRd^emMiP)TX@ zUu7m%&FqE=6~)-VAfsiMy{Y=fVw|$p zG)B1~{w8UG5Pm;oD4vhX-T1SeKkmgNIvC6Di6Q=n(mse96xEKgjSJ`0niyq23i1|g zRM!g9(w4R;g!RG5mZOD0-jE>(ccc^|m_OhW2u9?o`%d61No8rV2%Av2LmK>rHLM~* zmi>j5ge-0XK}Qk)!%q!1K|fTusMz_8Ga>SJ`|3D@6stt3-Qxrdo_*_?rIKbfm-9yE zXJ`o`m%^6orVwk3^344qBMok&IKo?{vEtG`!q&vAB$=dpWIvU9{=${-J%Qf<6aAfM z5MN4)yJjH9Y9h+&n;j@hWNOO@HFDnF7|aLzG}~9 z(bK8caR9#zhC8*}7pHCO3F`vd!V|x``y3ioDbvr3a!Bp!(wm^R=y_~1v2TPbC^xgC zMVV+}Wm#C_U7&Fq2Y7&Rsj#VRoXhgIR&E*r@thY0cVEm@As%IhpX-vdF+=Xn0z!M8 zmjX7g;`I9x&}_H!kw$w-`smTrcG!+4AbF!gw2I1gfpD z$~U>>A=Nx}c}|Cik#K1sMGQGV4bvi~RK3o8uIQn%be=@Oa=ye%qQ8q#Up)8Ymjgi` z$#8*j*Vr0Wl@IimbrEkPbGp2&A;u%H-oPY0#z0!&sVw`~e_LPc*n7>4CQH6V24~i1 zxds%eVk2YM?FJU~tnoEUhb|&2tx16LZF_4n6TU|7s3?p4K{^q!0>=vw$aRdHh%<5}rQ6q51&>E}G3X+yq zA_`NIxkhcG(MVLebCa(LN?-bv{p~)cu@?Zgl{f5*3#D=&zhM?k+0_#Sp>w6AHM$$Z zWQ`Q>1rp0Bn;zcj^JJLp5w7kH3w@CqiB&9)*E6i>tK78^foT~)a{0nhvyzZ=7l`}q z2FVqmn7N=yzM?hjYKL)Bp4JtTp3ey<7I9e0k!J8zb3WrwV6%pyW-XSCLKwTu>SF*N zwCV1w8@%;iY#qq(7X!^|{`>_>4VnEI5Va$Jo<+;1%-q zSi4^g_UempK(k006yJvF-u2@4OP2Ni}zioG8vAK{}x7BZH^k={_5Tctl3Q?y1^6ltHB}fh|!1r?u1}me3>_N$8K&TW{Zs8(veltpK2~FU2ku$<15xqD|V^F*43ELS!>0s7)beA zPRS8Xb?jB9B}lAA)`q*h+*zS#M{Ig_%g|GpdmI8-{iRoWl0X$bfEvaj=bVNBvBiR0 zgk;8*M|^QaX*3M1Mj#=WCa*i#nPcG#6CnHu1)XMmq8MiPkwvhPhi7J~>w(M@wrB3p zBdC7;szUBN5!oSuLl}JG{w}8@4>bB7kOP_Y&Fk5pD@$YTUxt8C^YCndd4h7erzl>Zh+fGW)*ArlIy1L7 zf%-UgmzeqE6Y=M0w`kU=N#?!vG`Q+#Xjz56wa%#*@qTG!*Yk(>mI;FV%ozj5R%QQN z*Y2mN(HH*}v;_WNI8(u|75yL762vcOn_>;DY)cR$YTGN>p;z!$-aY+NcpoHxC0!#( zdOuT53vtuvEYH6E)FXho5^<^E0Z#I;cAn>o+3*S*PdnPzB7*qv2vw|R{%iT#N)Vd36>i0~uCKX-j095uv7@Y787kbUnV|xJg>UNsFXP7X8R%Ak(*yQaNXYmv)XepI-za zMCjSv1s=^>N@!P0WTX0~|4HWkAuXNAF00A^KUI0n1#W=+bbkvtp}n@s=9jvN&xzNf z?=iu0e&U5v)?b!Kqoxm-wXG@WyIX?kOPapOPf_aF7zYjSBX348evsY{l2_X9>u(xC zEiO8IU%5fa7{XOWTP@`CUq)X4CGiUU?;@|F6)(st%k|AdWOeUszYbZ$R| z2k82x8Splx1Bw|V`MebQ3pLfnzjNTSMdRzdIEA5y?$v3bnR z*t~(!evfViNZ4LD13iFH<1cDCA_3x#|4&-^AF%T8PoDfuEPunx-i@`S zxA?Jv24`xzo_NG!Zq0qdr#9F=SljrXI1z(BzNCqCu_oJTQa6DLsgdE zE|!yR@jXN;Rj}p!a*AsPn+V?HXSVX9{a^UAxQs44wmI=Qk=5MVNTZHP`fG7$vSgWd{c@OXag3^h_kLpO~S zRwXWhD?u;>3Pj_JTbKS0;#CM7x;*_=aCTqQQ7Te@nA)f0vVDiY;dbN%C1=HI<~$M; z&5Km_i)y@{d@m%9U<$Vc=^8`p(J8D%)PYpCgT6=Z)67Y37xFQcx}ukm87-eDLP#p- z2jV5)1UGL(_rY`z9O(2RInC^#Y%!>pqV}&UR^_Xr?Y6VN9PQ8P z3jfGhUKU~$ZcK{;62WF!J|&x-q(MLnhip)g#?()g0d4BV7Y5;o^W?_L)qgiz_0 z$g}bl+ri&V{YkW*4BV(Y zNc~B)b{!M4ycLyV#V1HA?`JkxBk3eNc*Vlagh6lTegb`Jlbgp76?s}WAL0-g>Gzyi z^}36YT$%AFMsC5F$Ry9Y;Ah`5JUX*b%pJJzs6y5UP@@;!r8RyKe-%|3clnviod2!j zFY8taWZiP6F;3KxQC{Q~vA}+vz0gu#ice}|55UomvbxTLam*KNiEqm8&NyzPTS+x& zz-h^YBF?(eCbGks{J{Y)iqLoOU+#6h2_OkKLdv%b-D?xDGu7@(j~9;8>7uJlHY^2-L`kD zuHgdz6*jI)TJ=W13-N{t(vbS4*{0%t%99#$y{Vl?%XeMc@eMkWeApkc8-F>;qbi4N zx+D0e9zV51L8rf)VnmQB9SD2}-FsHY1*xjFx1lB5)*{*Tu1aD!eme4;=g`ftt zcdTg0$Om^On+_R%6A1^Vdx8qWD_Oe&aLC(k$nG?}M`Yf(HF_(>yn-5g>RfWbhda_k z1(kcb-jC!M8e zaRy_O+4JoUocpxW&xw917@ZwZAoL@?OieFtgVs8Cz76h8!)vm7o0p${&>zk~B2!kt zQ-x``xG`3|LU6NbBDi<{D+r1>1PX#~9{~-4ALA@ZSB>D&YXGkLj?^N%$d(nXv}is2 zh<-Aw_~y%Gt;gPV!}R=o=YA)U;hJbY?N4K`x6f(#R;T!fg%UnXnoy5JpDPmXD9JjP z;oHEl?WoiL`6ck*eDo=aWW5$xW}tL`R%Z`SQUqJYmA6E&YZ#Em*L~5Js`%zYO4ou> zQs4{m`X>gdP`_gO3VTY4hg?>agEFSaQtN-qvzyzm=%@MOBxna*NhJ1cvi+3Z3V|XQ zZmB)BMHs1F9Ah{1rQ;orqw0cjN!$Igy8@9A^I@cl1F%7)ij`JK%MARLb;x^Vft^yY zXQ0_j6lU}EH_#ky{{=MvlV{?P++V)yf`r0{dbAK`*-qNfc|&#zI%32Xk8RL?Fo4sz;1J&dQ%8>esJ{EuzpV~&OI3@`pX zDA^`9L7V@2RQ9oO>Q^;*vr#(;W+D{hDzipzW1fH}r6Pnp6Or#J7!#wmDPVw~Yr4FL zm?RtL41C8w&KV-qP>8Bmc^a|qM66pz+#3&GcD;+@|01GZ7-oP3D)Nf&Jb6XWmCm|j z;s`dHkDYXWnq{u8uS*zM4Fx&cK0Y5tggEXOo6untYRx+5$q!wNH28$`Je((G>^fFP z7MA?J#S_%>Ew4@mwbvAgk^{6n8?8S4JxN!TZd@7TFmVrlXZ&;{ti~}5&Db;@Nl4Y$m;yJ zhOUhKe{1Lh{;i^mdPM!|z1rt079%hGfu?oG2_}us+pPj(?Rw_1B z${MtQN+meqpaMS#Kle{$WVad}#%BQbHmX$eggClnb#sL}g}7h;xDps(umK9#Zy zZ%D$o5cW||D2%ceDA<{FNT@q2pynYE&ePu*tt^OZj% zN$j%P~P+IHB0d1*Zu~b<~8YYi;4x_K=!e2qBg* zM*iC-8=^}pmX|wRw%+(b(va+kv#FHq2eaBP2sD`$rFLYhd0C<4)+0U?t;H59x? zs?M;*j~Cxt#sUz|k5%`ULug6huy`;6CRm|2beO3w26zYiqw}NATf~ zC+kL?`rDHoLp{lEl4zaIgh>Ma8BjhGOSz^TIKOkvL2{4L8ibxojyEIi$CFl3g_^G? zA!sH99w;KueQCy)bDau=FrW*wAZ}?3h?Q3Q=ctKS zN+g~UrBU%^Z=HD{SfyF@B?Sd~YY<61v~|@>a2hrUk#*?_eJzRFiaGAHw=rl}jc~#| z>SOq-w^B$YW}0r;%a;*>FN@Q=#NS3cMv~`{RQng}YrWN+%_GXf3%uK4r?=-&^nWcK zqFEfsBY~W-tH&!+dB$AF9A@lE3Zw&Lv&`aUbiqcqgaSja-b)x08gLyULj-$-xLPoj z=4id%AxR=b_`GIsEA=UT7B~LISGtKh#Lj^0NAI`{f5UBeuebc70>kO2>dIE68kjvV z+~+eoy0;c=ZR!PITq;aRj=9`n|SIU+K?*y34zh*zB~HeD{yL4_fjQd9CpWHXCp z|AaB@6wBUtVl>zPq&m|;kTX<5^NvMeA(XWF!lUw_dF|F8GwN7k%dS`6OQvp)5lJnc z?u#p)IB+?54)!B)(nMSM3!FR;fYO3dVaOb#$iphY%a}w1s5)U^>4O&S z-V^7s@DVbLcc|YobbDISr0{ePo>#?l8#W0tl5wmk;J&Vu0_+N`trrpGd&<&tV zjdy?@ZepT(ZFhTJr6ZuXGcTVh!lZj>bc(dUDd_sTC-zN-SHG6hYySpJe-8Ak-C-PE zo>tua=I1rL(dRWgFVLDD9EOQ}&AOot_{S2fZ7!OR%g0J(+;yUa#Fhl^V75PZ!22e1 zu~Ht`nuOjL2ulIwggJMEu$xB*sxIhPktZZLCiTZ8%MmM`f?7aWjmr=-jb_|}|WJhMwHxDVM;tIOnw!KK5SFFmM1oBLb@Z(YL zL~x8;HEtJ&mSt*=Fj-^5lx0N_Tz}C(FxoD=^t6+IAD?tXI&~mYUb1R5_f?5uc?$4| z!AylDl0J(4aFc&iRpwL8_l{JB^-Ga3=qeTD=ZA8zY0ba2dpN=QSq_DuXLgDwB2Q|e zhkCFh$LCGWiFLQ3&tG|D7uuzGf*O*x1W^dSneL5MMuAWW*?Yv`!^Y`|=v}NWMJb3% zn#<5=<<2jpT;1#17+-^NM_E^~2Uv^BfAReGnS{NZKTgbEiY=8)R4JA0^**;)Nl_hZ zcg&ZsR9k&zLrCB>-?Nz+<;y4OBE3yy6*x)%v-($HsWqE=ID+h_^YDY|SlP2^Sc$sz8gd zuGzwWdex2<*3}XqZ(qngD>+d`L$=^bEGxENy)lhWT}{r>Xd1@>-srp=XE;({wLP=! zC1~t+Q@GSLsOQ{kth;&h!M2YAh9)A?7|oGkHSIT{V1s&wHURIJpb?-o#uG~ z!b|~AU`vezOjSc%2y3wNP&4uppX^D)s@x&x;(d$(*i0gak&_Bx181H797l{$l?~Y) zdzH<4B(Sl7vp+E_UEg2NzOmHoC^C3**4%$DSGL1O|6uqOmOX;s?@&VR%Ue(S`A2ZkFiwAPjwvrLF6SJ&JLzyLQoRHW#Vcu&75W`$o^_16wsL~VnFb@HI}3e=rX5Op&2JXN_$02gh5*kknl{Y0og)H z&8D@Y$RXR7TvhlV%*c~I8Z?&4Bpradsr5X zrDEG@vK%6Jg7@lbL)&i^`w z^wr+HhdGMsDP8%N`^BH>g_p}lcCH0?BL`u#|0pALpvT55E}`_so-D{$F4@eP3b07l zM%=?5uvS%tC|A$HljsDg_(`n^gQMv}@27m?oTcxwH2}eEM&q8;Q0u006JOL|Uw4mR z_PyXE$i5$hHP37JfX6}kZQn~aKZ0A7emMBkCzzV?+$UHmIxO&61c~@nze1%uN>#95 z7FouMb*I8nO3dT?PT!xH1Se^T#u-GCz}^d(F}d=iW=b!WvJTp9i(&fABRoBz{gDN& z)uZnOhkn@BQMZM%H_Sf}A+o}zZ>LSJrfawTRaa|#a+3gG&o8Z>56$_)2>#-bhsH|- z`_tR&58{C_K@(52NwJNC0c+K`2=lwcy;N$4_%?c zc`gHNx%`%h{x+A(<6S-y*gfCM<$~1s7#|P8XdizfM3Twz3pasxOWB!ypQv%W7WYj1 zY0<4X1?jSE&OM@cr-@kjy+Ou&e8sad5ByT*<^L;Xo-FLhhnJ>o|J8lGv&U|OlaO2Fuvf%#f-2>pS;R7?u zGDIcPfEdj@E2+Yen;@i~)_8}{GiqUe?+&g%q)K; zLOw0GRxiG^WUxInj{)0Jf3^%}(Vsi~Qr&CCb4+Wo&5M!u^!jbWCBYoLBs^AB93Kh0 z_7$`-OqxJbhU(L+1{JWoL>Z2y!$V2B<_` z%x;it4`aN*2$bGCkqxN$H%Ol*u$j$SKTi*+m3IEjKGicFQ4@(Kf)^LYQ?*AJ*hHm$ zH;=Q)Qa%ZR*SM2Ju?Q4xiloq3n^|Y|X7JAr_`Wg-7w@Ga@8BEqoo8Q{3nKr)d zI-e}$rhR>%$l-O!&UDqsn%=xl2>qcd*e4M*V)(eZ2=7wV!+Yzk;VK$n$4MDkqjWTH z;e10B8S9mnHctV32W<}MG$~;h_4${sN1b|>hLkJW{jd4te}gA~G0%I0fUxh6Zp}$M zX7VY(L0zW<`~#`lXKbypCQjiVkoQ*|Y#KzNB z1xd%#=KX|J@e#21j6^=s0MD$4c#9OPiVrZgJoKjKnbZ!Of0<_Ihgl!rkyc=P?fvtd zp32r?{uHyexfPlJLC^1G0R|Nr#TMnd9JN2iAO;vu+K?rayV{0re^C5n4oox6;XB`o zg%gJd_&;i{rDY3pIM5k`jCVy#BRYtaZTRU|udcCPjskc@_L#wfH*6j8qW;7WYX%|S zuj~Z3g-^pG>T%I`(8>m45%6xZp?$hKxx6R!khome5)mYDh>%YPyN87EPPjUT?XDXb zG5ALAsP?Xi$d2p;t9iSr40xU#`Eu74xIxE`er6L63_~f0OjXNxy;R*DEjST>jDEjj z`XlfJIJlop_RH>-w-#AIJn%nNgG!=+D1{~dso_|_u&SwX`Nw^)y5iI93T@^x(nn;Q z2mv%P7jaU8Xm~(ZMiK?6Pm$ zB2!epp;M+WK_biLd?1MKeoRmPOII zRWeksH}_Hs4r1hm(3!`}?cHqqcFrytw}w@sA>@6L2N z7Q-NIrXDmam%8sy)$a9^Pd0f=)i$ux%@@`RLFC&}9Pl@HJs4a(rIG8*VcBO;ROQ70 z0M<>+<-Ad>aKf>t5A^w9#3F}wH)N)3&J>)uj@Oh-_;>$V$$2eKv#@q@ct_5LG9onn z;HT=*{tRakZq(kJC~0ib-Itq>X9ry2sFc{>eeRcEdERDwtxXagzvRD*#`~&rX5e+X y;q=r{_1Zc2*k=~AwM%D`gg{F{Dr5~DV}A*2Hj)X4&-?xf9DfAjHUjf2#Qyw4sF? z>HcuupoKa|tD+*`bgPw+0y&0F_|sRId3&2tpd%SXT%LqQ!MO3rvEB7kyOfU_a)=Po z_4_Ncd&%1q@OJh7_GEK8vqgSeX`Etg-mdZ<$s|u6MiD8TJ|djb83lO#qLa;$dV9L> zsOyW8PXUDa5{5DEc!~B!lu}d~hYfAEr{njh=128$`cl8{!#ye_feKUN&-f?ycgIvJ zMz0*ajTs)_=dYMqTQm$BL!45k3y03%h~q&tN1C#I0MI0@`n`*N9f_%$f+Y^%VJ@1# zCXgGz!Ap@o1VtPlNZwRJzQFy$P%SOVAN>rsURJq@F1tq^-l zO79(GW_){PizI=g`-+X3_stUO1OX$i;b*HvrxelzD#Pe+f_|}LB4sh8Q4QL2a%eKH zLo{qJE`7!yP%XAgEP2Hm^crefcoL#j1{7~ygm3udJ2;y@Ta*Lu8@tJWv(fh&^7!6zkD5yRZh9=BP(GEv%c!m zP_fQ&sp!5Zc-y3UyEtnr{u#Vua?!F}(SNM+Zj}^DI#H#oES-?kjD0IYdW0z{ zY$nR_dPE4f-U0n>0ycWj-e-zanlBzv;83bE)Ca#a9~ToRur z?Jx$b3N!dlj7m8zM=2UX{3D4gZcmL!^muq^ZhRFOV_Nr5T>cumhSFf+`c*x<)#3A| z(OGmK-a6>-Dyy5NK0Ld`VIu- zn--LCuag{x|IGNJ7nJa#iI56#QRg6|SNqrR_NYQ0kfvRR_h3o5|Eh{8&Ls>_(TFKp z_h%kl@N*A%-d9t~(pUvYTa@sqYetdv8k~qW=2H@24AwxsT?TfF zJ>J*KJAbDSqgNQ3gc{Tc2f<8p-@BHBM&Tc`pM|oVAQkjYA$7rlqFmoPC|ZMD64Nba zOPm-tb5FT>U5)A}oO;;DUr;eRAb^I(NdGh3$bEGc=6D!5@!bzI!W?V|CUMFb1(JL* z3A}yC`seWzkB!BpvmH4ghK!DnB!+ZIHYSsVSKJ%F_{AzuiG0w;(il!>ZYhGNPPbci z?-EX|@OJSNNt!1PH}nr+j46p3!>v2B(hW;6vuj@~(I8?$##j2M$YFqXZ!C~dRX0I| zsqnG*-i^xi;^(G3V^AL!{I|AO{F{sG$@gIi?iOfVc!8siP2mLKsIq-iu^)VAJe0z<)9Z`>Cxj_kf*+w7ZTGVO_?|PAc~r#uiQW~gI)6EEMh%I;T4im z-K5OP32uHygjoehE+W+Q6e%AU#>f(aIojfvxLe0^TDf6kYM3@gZ`-+VWEV^%8j*Y^ z&5ZL@xQf~kyJ{KaD{Z0Iw)&2F?4K5x-OKCMMcY$k8x9jElquw^>`7aoOb`05IcB*? ze_g-oACn~^SIH_&>q7oRZn=FNe|>hQxopQgj?x!@S>iK5oG-B2wb-4BOc`%C`-3d=>? zizEN?*)?&(aOI;CGSsyaV=~Xen!cP9FZC43b|~6W|GEPO;#HNMVpQYnBwc%gc8VEM zAKI8!gM{t2PaCS%{aNnG`F3ow2re~B1hrGK!wrMDU+h*GC}AEFU` zLA2t=1*wi>R^AmswFH%i^`bgdzqnW;^yK`X9)Nqz#We348%w-&Al@O^-!dS! zTN<^pA?Ro9E4UoK+HlU3R@>HuTIX;TvrK^lE}*G*EZw7%ptM=(Y>0y*!#U4cB9g~C zU5L~bCEw2T zmgGnW@vpqz9Yuf&TLznof$lW~ zjJ3nZYV5;Z{4n9GiuY?jnA}jUK?YxZPpYXkw#!M7W3MGj0r68f|YhX_} z3a%`VMNU*aiS+Pw+t06o^!V?b-}7G<0eXs_xg~u00|kE>N=J!o#bNmkREpEW+ncH8 zZS}&rWv|+2qmK18?aVIM>cEV)_k|9!nHMg9RpQ!BeWO(UK9)b&ww|Y9x-N@#75ODj^VFI z^XEz;Z0SpdH&~H^tf#)N=uxS69~?1ny^^a(98)FkF4_0Ee4WSi7t7^-d<|lF*p-7K zKs33Skqu&W1t|P7k&G`!jG!@afW%9IOLl@ z3ExYjh|WbkEo#NQ+O*lvgV`76??*+PuICUSTtoy=LAa0S?!-tAjfe}a<M zyIG&dal=&l0fJb4sQzYz|4L~p*Y@4j(S!r3c3W9VFS3$9fm@g^uk1&Sz%VQ&wPOnoG#Z``S-x4f*yWxe;Iy-uhB)Y9r>l_-z7 zEB0`*LyjzWvBot*EWb5}4sE{FV0z#zih`^dH@o-k&Wq!{2)YA$xk6_2^UDoQDK*Ql}2B&;;;NwLEIs4B8r<8f|w=|PZVAi02GS8Rz6-?ePK3?)?xeTVSssn!kmif%mX zbgDREi={Z9(I1ffs!0<;&`!lZz!qXP(wO7P(2;NLONcBK0%%5}LAr}Imp4+KBE_~O z71BtDyGCaVvQxW6bE(I}4Aq#mEq;+krFvDOLeE+B809<)4$R*&a+L`CaYRXV15pde zz2jWe6KQUbB#zU$eNc^Z6-Mc%6`rA)(GP+b6)(WN)$gD(=%38zsSQR#HAa9Q4fXK2ljFJy3^#Hxc<{LVpOhc4;F4|vI4=cyhe>v-m#j``kduVLn%ztAJ=I7nh$vG@yw;g z`||Y09?-vK^;$t^kw6uROApj#wn#C}($^E6rvmd4%`unpj`FybFgb(yk( z)Qnouo1yTkqP9Odl))G}ZE|;)(>F>f#^UOSe6V4MRIpX)bw|Mfp=<&wrfLKCrYMRx z%%u%30`g*6h0Hu2aj%%CX9WO5J6Ak3&(YJbiU4$ByC)n*WtP7xy{#{3^(z^XZC?&- z3E*Zb4=Y$h6?wI4(&{wX)l~O|{F6Zv88o6yzZ+Q&iI1^11X$DE(ChBw64KKzi28&& zWet@W{Wd6Sf6z)Yz5C-kw%K5@U1}22?{Oa#h{QsE9~W5L-D&;VlqVC}d*txy#=+Rk z+MAORvwPkSR;6}T`FlM_m%Bw@s)cH6fWQex(LsCR+^fKB*kIndAT>6%ZG}g0g(hP8 zHUqKRs$b@yzRRO1g*!ht$UGdXUJ=MQ>C2YbJ`|4XS*LzSGw^Mi)(N2v&t|G4AGL1t z>yTKKZS4dYUf#e3fMx6z!Ok~1QyZVc$YBEX3HllYSWLMX38w#64=m(Ij_T;}V5)1dlHkUvd3`nG2oX zt=`i>IbFhZL9~ALSGvA~xg~r4IlziCk$slY^`j_Iqy$A+CJ2T@YEu6@B8n}c!_=2S zIr@w9g}q{?EVdc_=1n@MrmZX=q z^rt}>K>nBE_KNlc{^FG3Nl4=t??E9~QX>qUW{ZrTiM+SGw21v^suo7sc3}QW?&-aG zkRX>vT889TVm+zW6iK9N&fz+^+xkVG|J&GkuiM?J&zE)-ghE0Q`uujEyj2j)f>~=& z#;v!z7wa~o%J%3`K`O*zw!AIej?i3#bB#FYABLyIi3NyUrzu*rpO*M$159oh@BG(# zb_5v14QfVzqF{WV!YDd>N&yDoZGKFFfP#2-yiKtgIq9H^a zJDNd8OEE@Dr#kOg!5jnz+EB?7suTmYHWQnAHfQxZN^?6?tBf+Xe>iv|L;lolNs zk8^VqZ+|amyeGs&4*^IC${9#4c*V;XC>`M&+=1mRblZtft6Pm6y-i+XvI%M)wI4SmiAzVjdOgKYITb|iWQLwd%_TLz7T67mapHdEa()i z><2}U$SO7OZuxlgadD^AZt)S1uFONAS6viy!&W1<3H}MA_q>N0lBF@Ffi;aP+z0F< zzcL0*O34SRfTu|?J?{t8fWIB7ALrSw1kIYK{wo0df~h_F2sK)T^=@t)PQyP#*yoRm zq97&4@W|uB^X7_%EvXvDZxEW>X_H`TUlf`%sg~wZ8!3^# z8CQOI>*3YvBUo=^MZ+N?C_1%hwYi-LEM83Ms3wz){;VSuEdAIi>2q%Bdzb3hV>Jh) zK`sN|BujEe4t&<;4?b-dXM5LY=SzIB{cHidW=Hjgy7|@FVp;$OmIc(J3Bb`)W^(-D zE%z7E*p4R|29@qtP)v`p_NjEk4t|5(wucyMU#uXShimUdGME=Gw?%>||C!mF{|aa* zGmmeEa3AWc#+l<63di9s+JQHq3``7+0lNhH#wmMIU{P?A6H-nhf>@jG%|3X`{T7t} zcA4W&@o-bz^cC)Ji~Y0mA4Q~T#g%Nkv3HL7+qz#JXsD*?qpKtA4`^S=)|7Oaa{WWJ zsF%6toL03hfZ~_yGH8S}Ax>C;H4b+k5lX@^dlknc{tTXN&aWZEO#}y+Ek-V=F1WZ9 z4Z_YKx6r)*E{_q&V?s3*W2fTljIh7ew#f1q$|!P(+qt&z$r+}=yM(D^eUyk~kg=95 z5M(PJJ7$lYuWINKD~}}&=MrDwn06)P87p;ct5%xDQjG%@-+liK2dAz!*e!sbKyakI z!eoFH0!389z#1Dz1W*bqgyzjo@ghI3M0Hd^MI3lf z-;_;RpC-MRb}s3g0|H}hbN4~6D&3%J_lRU4u9@i!511a(jurH5MyaY`7AV@P!d$Op zrI0<)yMBBZYnxDH_ZvWnieaZ2*Yi0(z0YE8C2UZbI0HbT{eC>zIe-F?3b&sj>z4pKn2b(S?{>E@*_XQgp=g$#Ky=< zyj|jmd#fI9M97x$g*yqz^vG?Ms@a%$8A@f5JdwbbZCNsue}{2J`*0VtZ`lMx${(Ml zV;ib*CPSEA=atUgT3qO)J~Tt22*zC(pM)lIC<)Lv?5R4T6P4dfWi^X2Lcaw!?mlp9 z*G{iXc`%)hZCs`>zwDvye3IfbxyufWFSVCSUf;T(4%u^Mfs+p>PCJgMEu0bepWXm*JDOHmpWT*!UtRfWzdFlQk69~5^J;fyOxu+z=Z+dCuT`El4MMuwDXI^G2(cv#y@gOPBx`Q2Np9R z1*13hTc6xMf?xopdgQO;=ZU9u&wN!HE=UwLxGYN1?jB<|E#B9)-2TSq0p}4Ck_=+( zlm^l2p)D>N%h-@OZNuanWCJVzr?=oAlbi*wL^_F|q?Q?^Qpo=PmF(2+ENF|MXL96& zqZeAm698Bg(AS`uH8k#Foz?7=jityd8@~zrn0_<(NY7=;K$mX_b|X(uJTut;Wz4Wz z862bydVv2J+K_#GNl2Clr=%`WWnhc8guOEdf*qV7rCTF`4!z8|&)_9_p#Bl2DMM0R zqkC1as)+U@ts5Vg%6#7<4fTL4Yj77xsyqI5lq2Bw-H&f{vBA5}GMBziNauVeVod1s zOg$*&=PI?(oxXvAkSQy^k=5WSoh8vYPe@{B4Q$x$h^b%Urv?!pn24b`WWI4d7KQMr z#DwdgpZex)xK_mx;6NGw_@3!`LA^uJQ^-s$8{Plw$7O+3oR|j zOaLa`{ABI@`_qC^N~Y=L3!~p&4@62-VqxqNpC`zBKho-v>-xYtx_JT&<`v;hCD-uI z-mdDDJ?n$Qxn1SRZ3apTG>|D<-u2j=gLESBkfD{4(YfQX(_&s^nbMo%9IQ~ z;QlzVWjBNGiq4_ z!+R%>{@QxFB=AFHiC83eqs@bg{wTxM(#47!ua+@d>AttWKKrmmF>ImCm_OuQ46JCq zMM7>AN^!C0m1jn-rE5bi%w;h zIuK8AlQ^XA8ExEFs}0qI<#WbzXHPTvadSej2D_Dhw!h0wP+V>pruKq(QRd{iQOiAX zM?9Iys^HB@XVRjtZ?~0<=bSQz0D}-hWQ2^M(J%)G>B78oP19drb5^25+JpXovC2PI z72rR^D*sqjfd34u{9{!C{xhudk5vWu&#=lrRu$ks!z%w+Re=8ttNdeC0sb?r@{d&o z_|LG)KUNjsKf@~jSXF@k46FQORRR7ptn!al1^Caf%0E^W;6KAE|5#Ok{|u}AV^snE zW))BzVP3rAB~5!IeTiUpkcS$ByUj1Ay`RQ+lh~j*(^0K2K*m+}`#w*e4w~_MU{C6f zy>0|i)|q;gaVS9G{7h@7%41Ut3|-esQ(9^Pl__D)vxRnwr$e2czq=d%h5V*V~sY41!XQVm3Ri3 zEia@Q9zswV6_A(HikyQ^d>}hwN8zpaq%vI3^EnfN}(!h z1{oa8B2g-TT>oiRqSSH~GrU^bCGhp5<3wHu(z!aLH=X@9@j-i&C_^iSOt|~xCrzDi zs;-T$_cL2<%b4_?iYb-mv02jJSzwk)bPQt`bxlzG=kS>j zP3WkZO3PtBjH^K!&*41-5Iy*!USxslJ4-9rOU)z9-VI%8NyK!8=q~el1@=`IHq_mItskFEtV1pjbqCkGboD>KVUQvuKn`BT>Y-wuEaZVA%J?kVZXZr7_%@S6 zkMW0KOHYA!iv<$&NBy>s>iJl@Ryh{6i(~|4#&cxu`&6Fqn*_uEMmx3duScE9reRJ_q9-G91;Tvfvs#IxZ=l+3Lv3{51$g2CI218BQLm58uiR9U! zB~*=W8iF@i9V4fM8>eo|8#(dr-CTLDHElH(z;_l--m}vXTJptX)#J2#@m$qfNLMK^ zf1|kAsk#|eGCfHAR8fe&m~E|>LPVwiNm5Odr!^9}&$WLlb^|=fS}Gk@e|9!TNSeHi zza4*;dX;w|hX?@$YlR|cz1wzL`j(kVA})h@(qLdM|1NQucfx(LQ@k$s!bNaM|5Q&2 zU_&2nW6(Yv_W|djI7>FI<4>p3$F_te09pz5-Etb7=rHFD4h#!wB(O};D3-qot;6jY z5+r~)a{%#wS2BALc8z9`u-QA9lXDG59R9J(tr>#m2$r1TvmEN(gRzd~JtfdvGp!N} zIFiEY>B37fN;Slc4L_;_!fB1HfXB0b^so-Ci8^jaA55{*{twb%VG!srG{|a>D{rBV zr)O}T=U%S|?uQAjAkkt8BzNK`v5Vx@vIg(Wecr@cE});Be8!a1*UT)3jALp04-{}^ z+9NW+2Rrt#r0&AFHYXNZ!}W`@Wh*3ovD8XC$+U7O`|LJ{cp1BjQ>QW6g5;!3icdE}Ut4^?Rc~5>)wr#%A0Hvv5uNquv z)31Y4r4RRtTeX(>Y~0TaT9uuoYY*K%`~sjK=UGo6zhEfKg;tf7M{u< zrW<3&umf@8VI9p>V*4R1h*SQnjj7Bb(Y^AdWz8lj8UkjIrR7J~x+vosfY}eWN9Nip zS6_!`c~F-nq>}SyxiB@a1r^|;RTlo8#w-i{PGfe(^9kd>D}@p`(DEKn~+qv5_cx#Af2KNIpG5qufv;1M^P~0o+h@RkGK-*KM{#^APG=x z+oD;OZak89yhc!qsUNF=2`9t`Q7OoONQ(TX@7)<%MN@vUt8GpR6-_Qo!zgKYZy>KZ ztG8gPux4(yYx;fx@<3YBVG}*^b|2$Qz?rk5UY6!W?TNXlEg|u2; z5n~aAt^*O=x&3TJY&_*9ms{g>-W7zVs@%U-x2OgU1)9+n!oPfx*4G*r2{S3$6)r`L z)ABW{PXz(w20smsZBWX=l&?~U5@8@mBm$eBTSxrzoRtt)vbJR>m2iS1xyf+9^T9+TktGG>Y z7_XjfZ;(IVo}E3xw)oV<3tF(>csV}0!y&3dHw-P_(h%;We-(AnW8tLN1@`8U)g znerd#y2TBRja26B+FT56Z0jT*b64^qz42sf_+7`#5G)34^E7dB`wra$gDx|23tvNo zk3C%7oOPvhTeoDdE!*e!wa@HPBSOy*Br}5^a}mI8vUx}7XJ^-TPtnX;86%o+IpaUc znBGx(1uCvedqigTZ5MDi;fZ+Znw&7M6~uUXMzYIhX**y#Q=^iM>BD=o$8`nyVZGeU zWW%o$4FB2}#Cl;&?&`Y*wt1nbt+1)wt|v=v|OYQ)Wz z7)ivwDl|5A;={GeCcD~;Y4YN=aJFQ~dbn|>-o0_PuB+pH)vm!w>cm}lx^zUI6Vx|) zgE=Qnky}Y;T)|spr*}#^GhV&=X*f{xF;^&6w0MQrk4*@L=|?~@@Xd>$D1&ylW1t`o z^hrTT{Mt45#zXRUDq~cq)*c>_85Vj#V}2<3#gFu60i&nwr+_ zc6rNPJBp+FmPv}>1yV_nT)h6mG8jMNZGjx!X(@euRh;l(dU+Z0S-vdvRJ)_bWGg6 z)z=2g&UE7x_M*fnXEOZI8NV!2F?GD*`l%@;OohQU5BJ6{b$AgNxL(yD(es!t2En)T z^!se_yQ_t#x%Gc!i)5mllT*ggk}^RxkvPb`lS$oS;D?q0IKEB$#&VJAY#8QDRdL#R z>V)R}8mjkZJg8cCMqT)%(M=xh7ppSw)i`hWleM2{I=WYUY!S}eT&@74Wjk0?2lZU3fH4MF2`8PBe&^2 zVsDF>GBm2U0J!Hi4Hg*pzP$ZV{?0B*&UmleIFlUoFa~@c{1xqw_Ahwy8PLC2zT06Q z!#%`^gZEPUk6p6E7lItc_ugp$r~_uVQS!W1;fNf5$?9sTTWMhEGZZ?TJjC%vKb=_Xtfn%TM7TCOM7GdWv1~ zd7X7gg@(-#VeaC-i24uG>P&-s<3Ze4;yp8R<7p^fN8)oS8)lewZQIHf!~Qk_fLJL} zd1xKgbV+-xij#LU+y#tRT7^QU%k$%*x{50D_{lZQn>R6|Zcl*sm)k6X8B-)0fPqh%u->ncNX-W7`V~nyX*N=u+zQKWCGU}>yPcVJu9FP|^Op1{ z-LNHx0?6+qD5Pg`DyT)WhYjo9Rs6&|U(E3(QHXVn4o-%KwW-)tj0I|FH0T;6Q6K{? zjf&NR4d{>$i-@rkLSsK8QV5h37EPjzzVW}>cA64cMMO7qV6=YL5(Wqn%<;nwlT%8i ze!*?#UFgwxDuqZYy)WaG^K*1tz|z|3ISwk}h#_!fXfVD{3ZCaRg?fgnSQ+X%Kbpo( zSW!iA&j^xoZF6`Qqr@BO49>&(GB5hi*k`AtKJsCXS~@Kdz^ca5X6b&@^Gbq!`f_Jq z5=L@$UzI{4A~)|3@eK$!g{wwTRBd-k9CL|7W!wkR?TgJYOFg3nQcyH1bst zL6Q2Z-F&Tx8cSCkqwiDdq7dz4P-b$ZtPCA6v?D^s%GeZ;vO0}BXDXPPv)uSS*8Lvc zLRas0=QGupC(BlP$)XK>3En4bVy1JitEe%g#GRuLTIvA7$=!%_Wzh33MW@_|zxL3} z&qkz*qkIAqVNj2G;)xUZma0XlRFgz1vSH!|k65!egRc9jvOzPMhu={&=|?bg>49u!CpuE)5@gA6Ok#di zkDEfoVhorbBW{!RC}As=C5<%`xzJ|STP8_9FL(2D%RJ}kWnl}9V(p#rTd&n7nK@>D zAJ$m(0hhPL2=fBZD)^#oE8BAls-(R=%O9Tt02TBkH3r&z5mcZvLM$KwEPrFlL^u`A zTBS~X%H+1gpmsU`P7zRDR$ZtPjqo|HHvRs0M0Fj9)MWnB)`}KJRkWAxp@tcwY!|oB zA}a;0J;YBTOVn#v2%Z>R$b}-0+*$Jl%vURj>EYiEm5trEgbI=#cZ4s(090#=&syaQ z@sziQXj1sTqqG3k$6~%buxQwu6sk$Se&=aS=bYD%oPMW0VmJDTQ{oA0b)4rAjJG_m zo{ea-q-}HsC>e)YtkNWTl@e@cyE-Z3c~j)~)9V4>*i}PU5{n?@nQK3%^rf}GCk^aM zes*K5-HY@-TLAX#Wm*780M8k54YJ@nol?+3vQ$`6ocq)0i#K&g)2kf}_Hi0g3-V*> z=;5c#CIZGf3_sz8y$s|i?KU#H1JhpvUfE|~jK`$i@=b;}f_CRA~8;aOStJ9xj`oARZoE(>&62xV>HQ8wq6f0t?cG z9U%?bV`dOUT1sgXh#34C7Y7d1;IuvN`S#d%uJC#u*?e%gz>J|rxM*1ntxQsXwjrC? zxj5{N`!1Ae}6It4oik4(n>=C_$5T?Si}tnIG&f5l;tJltnvP5ez77-tsP zKbE-51w(Q$mb#(7ZwOkHjLbszDEB*0$=ua%LFEcHh-aMKXALuGb^TPsGM@|1-UvX; zt;E&{(r1Dg2cx0lmm;&t5*9kucb*vvu)t{dSe5g=;41+f(?yHUs(pq^Nl{CW$VPn; zFy`$2Z1YnGj#MmlI+9(D_s_6Cx)z9(Y(r}QoE-WtgYH<91($ff>tL_oI3@bs7wBM_ zc+l_v?A7_ruUl;`geU?W*RXw6Bh8?M`?(Or#$+(U&7c3Bhtb=}pgeaBp)tfh#fBoVMk%==UhY`ZBIUnVhP^NhPwxnU zd8_9}T+996^Dv){zw@x1(?5AwzFSdyw24Rxmbpn@aRh7PFwhP`KiABXDkyk4U^RnxGu8^9TzX@K`GWjvolZ-G8b3#TpJZK z2nA=a9oLX+={Eg}ChJnJ^>VegWEsk1X{0umaF@<`188D*H!TqJ(@ISeq@_5 zR*+`_&m_koM;1qUHJMZNm@lytjw$SDfRkIO4Aa9q6#9`Ty6P5G4@+x#twZXT&z<>l zp?PM3SIXVtd6n#jMc#g3cP8S%``~ z4)6E+y}b+H#`*{NEE()SPX=gtD4olSwq({XCC={pmyhT*A0e$&4ibVbQ^XO2J81fd z#~$JCFN?_q1`X2O46XETU~n_hbD4;hjV!=eu^&;wx?-WK%+f>C*hwPr97-QZC{5#L zjM3)EuP4!h6@dL_Ou!zkZxx}of87d{gQkjJZIlEi+gjqhe!tDNM>I}u(=CEZ=%%n8V4$=Sx#E0-T5d*{+ZKMu zxI6-OS5wT6)qZVwx#0GQ_rS5tIP}z;dzUo+6nMQkJJ1<-v^6LDmVGEgbB8Y#s*maY zg7#h%j`TzS9P%(jQzAS_i)QfhGX-7aFnp3>g?`A&Zc1^=4~l_>VUMp#WJ$F8=H#$_ z%W8#CMofvf0QIy4`C??=&LhY|KByhNrSSJt#T5H66~ExOpc1P3G%+@@^RoBqcYf== z-&tErpR7c77j843&@cieYu@S)`)hY-C$I9&STgXqM9m);=AArPU;Q7c?j`b|_CL{s z$5pBnCRx%WnlBLIszmpkQehM3+K=Vic0&LDfLWlnKxaEBLAPhT2Xt$f8C)m#`?bK~657H0z5QQ6w{sG{i2f4mLIB3iX6S=|3zRN^6588ytY3Avr!dwSKY7j zqS6C6Lv(jexFenFmsdYRFe2oQ4n*&<=`vsEfWf0(UF5MSMvXUV5^AE?KAb%E=P9PFY8zI;y z5SiB-Q4SokiUPIYmX0eGec4M&{JW7`iPhSoa1>p5QG@_p`!~n-^*H_JSdgZ?daJM} zi@wzIC+DA`&H>YFC(9OuNX^Di}z~DsX zFRv(x%$!~Y_2@2F`RyGyEcC0CkyS3PJ6wl2>)gU9g}nPbUl^WC;<7Fk@XmG24^BQ6 z*}Z{48dUFBy{=Ai-|v{unG3+}6D|pnN*PLTZb#vFa>>p%oI&Pl&|EMoQlK>JtN7+1 zi0-rnxBj1##j~xsW+M^RS`mwDcf@?=vQv76V*Asm)wdq;KO6;YAt^4S!1j&Ges_#{b{m|k=z(eI*+W@kj;&vDhz4gPvM zpnKMW&qMmxaFJ3uPbpeKSOV?empM(j66`tS#C4HENsT%6*x*-WAzl2AB;E0#|7zwO zcK_APeFX9*$rtj~5~=+3^gm4(+if^W#VJJ~1=o+m+pu( z1xyCY(QQG|?l{dSi51?#AlBQuFVt?>#uoVj4GM!|>C|U>R%25iXoa5Wzxo~#4dFfz z&(Ce&?^KDya#Eh;RlQ>djj5ld5$5Y@Fka(Gt4)|0u=2c%UW(vnkZg)|18pV#Gp%9n z^1TvLN_KIV{^g9HhSq}f=lt9om}SDNe{UCsN5Bqhf_J=qJ_q&U3(ZdVKzxGwV&wJt z7*1Vx@JV1kk-*rC{m*_8f%JDw$1pn(e?RKsD-l8$+bPT>FJPCTlw1_LHBLSyrML3_ z^!I)-mCWrt#m-0F0=N!DP@Xf6onNkEx)z)Jl7eO+I5HuzhyGPdJYtB(?S8p zDrr*19m|;zLv+?cL4V4lEDIzOU3w@I*4lWrzxVq4cg;h?CBY`wqaF1yOl`VFiANoX zZnb>$LBmJYb5ZITm z*W;KVp_9bu|C#9kMuIV&i$3M-UR0r@4YcwKL)TD7KMRS-O#^EG%@_*a?=&xrcWJeW<^ejN47QS&|rL3h&0x&C%Nj606%!Xpu3UP2^1PhLJI7;)y zbUZ!NFm)x$(f>75WSh2m%vE+b0H!&v(^9YfHz5WLf215VtQz{E9^Uy++j40gM08B%6fEl<0wY#g}$)WNzuq`xT|gyPB8}CQ~&q`sNx&jUtg7)HR0%3 zp8ZwSiMIT!sPk??I*AES|9=*Bx2YZft*EoKM0Vk}4-P$Za`vQ+VY17D!v7L@x zsEE_XPZXa6n^(Xj1P};P#sbx-|Su=qPk#HMNVQ{(G~o}K9Fau{lbY1MU>rB<-T^XwFo!= zXk1T~JZ;o5YrQJi|NUH%ECY9XUUuMYykdVwXMMb&jTfoXMFm@looSscT2ALT^)zG6=oa--ga=zU^ z9I)}}hEka0<0p9Q_VO%8%&y%m*`GSJj?++2>SyH85J#aiBE`BTjrI)0D9<<@yVg;% zrY{V?3T&tEf&6M&yjl0U2dy}s_%!YW%>e~)(h2-|xIZ5@^O@c!@%j7Q_q&Tz$-%a4 zrgqCy;=pzlMa5hw4uqt{LJ$3h^~>r-8wSJX&l3i4)epbw`jEE~vD1W`uP(1X{hzk` zn|61TA?*Hvz;7$G|p3Vm~GXlnoVr=kG=tF%5`*<9| zUu@%fN`lJP-x!kRlisVNmN~6sc#-kg4m-u6Wv)bt0FpmPUgLJuY?>~o@qR0+a96D5 z>*|^vD=;muCF&aW)%RE60GC&qS`Zq?^U+ROMc!gYZvrb0_s#$=dPmSoVL@?%WYTsU z!_c2-QOtpKEdHzNw3hh4FB>XK6|znhvuqvEqX-Lkc2V66Tzqe97P@m9GviAPfK~V# zI%_RxyWI_vZ^ku6(~iQGJ+izDw+rwadmBbDq>vz&1qr>hIqX#tI<0jI=;tvmNTX4A zLue_UK>)I=pI;;wlWvM2?k~L%b;DSVhpf=sNW?_&p=2w5uRAzN?Z0L}e2RfXt zNqFankb4i^O z>l@V3=-(4j8*Se>>uJ*86Hz;d8Q%r^|ABpV&#}i920R=oQLZp@nBdaY4@Lz{0d$Vq z$>e}>8rzdmd+%mRO)z8{?fiDtzWqW|b!~AS{Qou<73RErunivPN2KFN&eU(6|JXsu zD_Op@o@9bV#QzC?WO*7)TU`?hQxYFth;%HdM!RTtI9St}l7eO`D5z+0+DTCBCv#tK>{ZO)lJ06~9{iqU0w}$~o z`|$=sJ_p}IxNDPSZC(?T#mwJbX5ODu<_`cr3`WMc!o7BtNQor~ANM(%=X8>w(xAb~ zpX{n)ISKVB*fAQh@{8S~qPc%x;w^edcv#ISXLxhHzcK#+sJbZ&{O`ReTM#cM9D#C; z;ata^h~4a<`q{>zYxl*=~~j}j>--GOMofE{arw@S+d(GIo-a#@T?I>|oe@{Trv_c4!9Ta*7Mael3}0|WTho37 zv%EhuzThhVz{zJa=N3fxG-{}XK6==%K`1-F{MFEHxv6It4Yx-LS0U+{onRN+LKznm zh|cc&5r+#X*ozH)CJlA!q zEhS|sj3x}_eo_pY4fEHBHDEd)AYv)CDz{;x5MC?&v!CT@tD9$5Xc0Rlst=p}VxK@_ zD*nINdyBX@*KBV)c+kQ%xVuYm0wlp9xH|+7?o@DhDcs%NgS!WJO>hkm9NuDQ@9y5+ zefrzyeAAxXtU(QGz^|V5Tkiy+#@Ydk^+Y^pMX`_~aM2@p>?2 z+Nr%$-!jt=Jh&YqpHr z$ODc7p@;eIs(k0&&Pdx{XJysKBW4~_Md2ju^ldZspuOpI;JCo5bKJ~$=A)Ua1RHPE zSMM+sBZpH0!qcxYz5UI$kB10&4A(PRBM)7(ryDF?dq78XE;dC zyZuopLv%*i|GrbKinr9;xil9-5C%kFpmMEV^KBebhuJbP&Q&H45cE|EYa6i0h)E*- zgsrClZ@^{?#Ykojs7aA!QffI}*$P1LgZq$o!2iZE5=L5wF-uLE8=}&(u`q!kEPKk2 zwOZr+cC-i4)_MGM2Rr8nLgroG*x#seER444q$Abyv8{Oy;-_scj0ARewCko^#X|HZ z3AVL}=$9UgMfX9-rs-NUqNL5N9(fNbJA?w9!h$95^z>Xc={ZkfouGssCBGcqG~Z^w zt2d|XejmQI%tzHl?|mkj;*llewU9KOp(K6mnmcq5Ppxa=O7j5J{uZf_Kt+vyI*f0F zit^osGWl2_Y6n?Pau>LEFPmz*hO)cK_w^Hk0kq;iVxb(ti|)8)Mq%5=b^)Mfk$#Dd z!*P~9AkBSuS#*bp_iCaka7@7FaQU2IyQV6YM!3lgqlW`oyrq#=`ZXCrkee^om$00H z6EH|#Fx1E!4&$>W#eLWw*4B-E*@Micqx|9pMps*HlNcQaBrUK-&`wPFI-jg&W;s8I zs3N9MvD%P#zG|kuZC@}9Z74^juFnkiX|02cC!;sMu~WXnX83q1U!0OLu~u)=M*@-R zxd1*_UZNVOWpCX)RPW*UAF{fw8)a$qg!h!1Rt&FbhA#}2eAya*VdfG(!QU`*u0YJs z_lx9akr0dII-PkTq9!_TQB2Rv*i~ySr04ClH+5Qq_i?QU=a@iNm5z zZ2RMDN7Tc}_t%fvmWM+dyG$0pS*nx1_q-{E#8B}!%5Y0lQp`!u##9msZbP!~h>;jM z#cq_K@|R5B5;qI|7{_fgERiRCdef>U&g$G^%8tXRAa^$dK)pjT$I1BT4MXtPlfr4*yO z`QV2;ScbaHItQ+v7T!RC?I<>KKeUzW-x<27@kHojaz(}IWkY9 zoOv}fW-8N5aT>7EuX`3bgsX!5Qzz=UDX-__n=YSM-I`~1C1Hm*$wl$LPx73k3K6XH zKR-$)23W#N@hQ;EZogwANoguIG^BN+Pwa`=fzkqkey(&Ad}q^7Z*?4 zk!_HCsd?;wgsV$(4s|}kIf;7%r6CC`_6(dwpUJZkEIB)FQs)5DPuLN?@a^hrHSgB$ zt?mU_Avh|tsn+dl0_1lcH->R%e!rtP*{vq!If3tV% zN1u1AOA_TZ(`LIBy_1F%XFS_dPm%9F5?fgI+HhLFBSE?^y_z7J9a8WwDw{;{3AiQE z_$v3jS$)cH7SU??$7Xf?@K$XqSMS76I35LcXV_or?hh+vpUFP9s{CCI2cs-T?Ti zAi+z~U75cx7;c4xv7(D3B|prQ^mjI%?Nhy+)SwdYWJA?V^1qi$xG*k|Di-&X8pw9P zit0-z&~vHY4qqT-Msra%B`w8Lr)MgNl@Y$0D<=%O1G2{YlucI0Amz2RZJ;U?%tSVJ zs0M9)(?%i%0(3!pX$vm_B&zKKPQFMuD*uK&IO&P;uk8>p?2 z|2ow*=ddG!pfZieOVAov9vJ?cZ9LJ}{%jkg4E}B#2Mj;k#>0L3!~Qn12K-yNQ{&IJ z@yc39VG(6;vaFh~hd`lfBQQc-9G{AB?mc=TKf8iGvut*9!Rmy!d^Vix%;Bxb1i##hv{- z+4c&n>eV)HwyM+6fE}Y37zu0gTQh7kRh3|E)~+`FO1FI(R(lZ#ijx zLqPGL_;%iuwY7!gS!;0(fv4yv_-y7#-I1!QuEB<{_AhSc_CAPcC9{3Dxh8kpTxY$=h?sdRZ1wwSDNi!NYj zU*hBhJGm^*q6fMTS^p1<;nB!9G3AQ8zsUB~V8$=l{Y20rd!udiX__5219l~U%7X)G zMmSz<$>Sv+1`VeTI*iI$U7|`S^t}ydg-9rHY|ait(r3rd?F+4W6T6h(WPV>0cf7n7cd07DG7G3wI4l=*ke?G<UaiL833mePzYuQVUqsx%u=tsn{R#YGXIYX>{YG1smv zC??NlRHqrg>f#zfN`CAU<&}L2oc&l~*N7hfBaX4m4GU8}Vx#!|!YhXW38@Q4KmB8g z^hgsuO-uOrRcz;tgp2RUR7r9Bw^|v{KjkJr>uxTv$oZUUzt5M4#9d6K&u|W3QpqQZ zSMTLgNLNbP^=|nr%sPNkO)^ACA@8|vFcSIt@{P37*VS2xr6 zsern>4kq2x!S8$U(rxeBQUaRuB^Wf|ZiZ{_%<+NWv4F|C=XHX#_Hz~ig}dpjSFVXd zi!AHdw>3!QmTTIpI%joJX47SBMPZ+KYvlIWQ=hCg5IY!%xQ~)fSoZJO3_*Kb@rPUX zBd(A~$=#KjStMpChNr_>NP@3M)(bMgJo`}|RtW4Ig9ee9%88#?)%2%=JY(kGn4`jP z^Z;uJJh~OWZVcWRn|d9~gm)rlm#R=ICLe;D!-)sfPCdb1t?1(I-u%kKrN`p%(n9Uk z&c@}~e&$}xN(c1zX?bWtY#|W>`MI16^H;yc`3y#|Z zjv{tXo;b|^p0_8x*nd!0{Yy8t(e^kawWa5c`R>2y#bD< zT758$Rq#iVRMmv)NBNxLPM6Z@ihPcS>lX1u1-2z2iln1YmoVFnX?wzEmwmNv3LmIe zgves8-BC0K8udy>US;bc87Qc~WoFt1CmC&@rT0J4Rh{u;>sKXPo~Zz}WOK=xR{zXREW(f{8d`#*AQTv+0N;@I`B zzc@DVUqN=((YyZx$o@0Oo}&4S92@u#AiF^IuY&B?Qon)hCWqfac5FK3U*y=)(O`~k z-269=4g5!tEoACek%M5D<3LqrT1e{S8aCwfI{pLVw?T~*69zdx=f+ka!^99#1bd;K zK8AOqCJG5}XVM{|YebDc%28kiDUp2eeh)+TT(ltgea~Fv7XcniReX_@27R=Vcdhm- zAWz%paVTc$3Xl{q3tl#(2r>XhI?a$?lIbUU%#7Ss1&tzTmn*?O_Oxfm8RyO^7cyE9oLQD&w`R3HJMDERf^3Ad(QpY z%nI-!9U}oBvF&dk4T(U^{@(^ilKF0%bf1!jUmrbU$p+c)GW}4qM4Z`hq?#h5%S#tz zZ(kd-0a^pKx?Dev1!@Q1D{o%}jV}X|)Z3|AFweUCUy-v@RP>r2J8OlyLfL7LleO&W ztc=~C68bjjdX!k=+2gN$Fee`v39+d=GUlz@v5&lpH@;*q1THGaJX36v94I`(`?qi& zlSXG%)(Cg@g*St#;dd-^z!jaGib^K7w2TWN_w1JZn`WbBvCDJOiq?Ehs;Y$68&11Q-Flh|C zMj~@b4rvn4$Ia|LrCbOTmCGtwfN!qdvFNwl?HD@?4N%S3vK*;C zxSesgko!}x9V~g)i1M$FZN}GBHs|*V{!FnQfMBvcPQZ6{AFyD}K#d@8y?DVYBl?xe z8o?l905*G7Pn>xR_uM^E>;2C}l|8mCS*@3E+i&dV=5pa}eZy3-UUWEAFu;gr@&F(MREq?#WEJZl}?+p8Qn0;ln*XpbRx>??1>jchYz#}hNj<%8B z(M>+yWg!~Ux#RfvZd#HyMaUnesK|)27i6D*z}(l^;_!X4(IZG5-;`X|E1YXEzOstV zkHMDKU@_~=g^B&6XeVX7Rv{N?qkp`(e4Nnd)}qE_$#fuFIj(Y#Grnal7QtH%tmiK~ z-I^gJ4t0qK22)QGNw`xSMc4MfI6|vfpVTVIV-@OO7EO#k{jfV zgR>GQ-@RfX%XTu~mmkmHgfqQcf-E%D+~Jvf>%+!x22{>E(x7^5^HA}IFL_ff_eHk2 zNI^~kp*T}aH{iA2Acctw;xa|-8_LnM>{@Y-A%dFkxgSWbJ#@;m6I=9WE!7x>srN02 zO*QD*w_ETtL*NFB+4>|}pFY?97Wt_s(>Md^z@^0fwhuarunG33)9vWXm{0oF?W64YY(9gdAOL#A zt2GXfI^X(`P(AG{4O|pbaRKl8t&%)LRB~x!^4}+unT0?kZ%)7Zw)Pr&^`NH)G3>@9 z$;fk4!Cg9m!}rqIJcwQL=yBhvZY;(;!hEL&m~VjY(tWyBasAF1sRY)Y`Tf=M2LldL zeUXTbGM6Uhw?92br-wR$h0g{xuBAH%rL<_hUtSswro}lqUeu`8Y*iIz3zoFO;5kIO zl>3R^YzXvH0mpajGFY?+fU>gr>*!BWtLjgNPri#IExj!nI6}1ku(feWLGPPLzX!wt z2|id4AiXtVVe^f~J48<_F#_PX6Qa}1pd7T?5yE9pD?`eXNtc$%e1 zRWIX~wAH9)>VV-=B3?KX(w}ldEmIT%!W>v+8-v0t^22#+msDVccIA&cx>+C;~O} z2%n=UYO^y=l@TsCTqj?-E+AY$qygDdzo!%?GxU7 zE1PKeCAN(S8&`XC)r}kwZykbAEPCCTLn53Q!@g{>|Z&((j z6#5brC4O~G8ZN-yacVS5P{XG~c3M34MvcB&MN5`C<@0fcHXr7dAr*{fo-rk!q_bx? zX|`+$v8`{7fzlC&BhO(09_?OkZfuOKq}%71$1mqEy54bBkzAz!)3+@=Id3Ha*$h9r zZ!gSX_<9X6lv8@SZuA&SxW4kKZrlN$K4Ae}u2z+niy0q!fFBL0>h7tw*jz{USOUenc={_q@uA`G2~iujFqBGNFZ^g zF0zF1?gYfO)E<{U*8B`Ol%>Sxc5emXUstvN$<%Jj2b}iIb_(M1zC#?&cEryW~;x)H4JT;c33j6t3^sxbxXx+@s6`tmVQ6+8_D*G zXq_3-mAmNM$uk17|Me z1V1RX3nu=c*uN{=Puxyv;0tHg3r&#(k(*@-Za(4`d(#Ei-=MNl$(yhKE%Eev&0NP9 zJFVh7RUGs<{H2@Xw4G_f%e*7vZ`~92}|OVKsJa<|spjd@_~ml} zR(Pw+)d_Gs!L?m@yBjholHEv97ntk_=yBh*iHO4=ul!kc<(f)?7sk$fQNi}U_~@WQ zy(En%;q`3$~*VU@6W{UHlMa75*k+R_{l1;zyxQ~_^1*% zq!}?^utt;m@x11Ojw#~FGgZTis`Zo>ja^-=$#!hE(C;3SY31SN>H&z}rNRV$3aHho|S?Z;q^@jYpPOFQPK&DLoN%Qld+$9#jggoea z8XyR?`Mlm*D1%t9H}9j57{G}8N0Eq8t!M4CU$V_=RK6xKx;^WkG;}WlY&EDFsj1JPI=y*hk8+A;B zaCDWdpNX$_QwdE;LsgG=;Fil(2YMEH*hv!xOP zRar1}^_V0x8c7-?M=ehZzxuu>@$veuu8~>BKm5{=rqQRc&{e)l4oI#U)2OU!(G{ic z7>0nX&E3~qufPI(fSE(3rzIGClBgyj#y0m(l}dXqVc|OcrKgW%MmFjbsB8dE7w3b| zC{3^IarI`rVATYqH?sq>`kJ9r)G0ekdmo@crA`^6 zXJ4>wa{zqE zTmz8g9Dtu{>S25mUUTDuqwI!5XLNlnYn#SkmQHQrn<-LkNK#@5IVo?U_YEt5(sl1K(6>L)&S8%`D`n-hk_SivnI|&37c4$um}4A455|%T5ZV`Stt)AR zmvY=DqnctdU%r8B*^jyeT=RBNeFCMMsx#8QAH$*BKbbjFpNr-Wi3YlG3=xBrEt%pfVn!vXOi_IMY}w2e8m-#u-E$k~BUk{EVSeM|CYMwU^7B zme>}&zutiLto2#^eB!7T7vFJ*-dPQV)w?Y^xwsGR4(RQz&0#BrcZu4!vK6 zY-a~9YhuK~i*bT{ETU-k54&6FS?3f@7OqD~tnr+Oc5)6oA%ffIFw73wYgBjV+~NWb zK1IEf_!cspW)TTe#@G+on8MK5Tw*0^lUEs2l`f<7c#N&~)a@60?L$Cw3Gfm=qHXZ9 zGQLTRmZM9Wk}VNtJdq$`##*6`8Bohtpz&L$b@hcz--X!tB%HbnkkKj4UoJy&WCZm~ ze0tuvZ3?41X~QL1Rm<`8Q5W1Az1nTh)exvE_pB_}$%mo!?90zDBOoXKFGaf9QU8ZK>aM-xUzSt7S;*#ML- zvHDz7`NHaN?`n!P{nT@n0L7d6gd9D<*eHf^*IhPD}8eQBh`GVmVjbGspPw zuqHs9D*!ZLJA~&VByPa8CrZ!8+2fB|g#LuJg=77ez$2o1_xV2x*^%QL!jctS1_Tmr ztDD69tX-Ufm_+hw??QI9&I6AA`xmh$@h%a=F7fZ_$KZ0tJr+*p;^3=%2g(p$=rzsH z)la^cAeFB^AeVymJE3FOWRwxRa0xCSf(GI=z$hi1v+Wp<4X1)$Gu!KIw~n~Vg`Nw3 zWIC_gVq2X*N5HRN`C3IP8p6RZKL#7U^ulbdb%}#b%GyEQsA+NbIu(l%$h|mxl^xp+iDu`p)AS1 z4!Q1z&$Bgo zY;&x7z+dE`!Uy8U3hltCAO`jdNwSsUmwsVs0i_EAG~sl|yj+1lLqU&z01^lgh}a*% z3K7?!;17_60DN^RTZV0)XKK5 z5H((3?%2Nt`yjpD>lM&bShs)TOQNod7*68;{8FSnD<@=dZx{T&f*+@p-jGY-nSQ1v z*PdVXq0?ijN9Cr@u-In)rUq-ZJt2PCv#+SreY(~?1VtiNCQt$4y%lD#39>X;^vm4j;7ON? z0N>i%;IWEqvJM0<#4+%$C~4}V)ne?Aa#fUk(d<&Kw;8zOzEsqXn<*es&`q|Xuc4E7 z>V<06hJnhrn@LITvJ15k$lf?s(Xgo$9v#VnUtY%4hvZYxZ%m@SCl}LalQ2kY;J$%5*e(ps%r3#RM6ZN0v)BmowI! z37`RQq2mR`NgtUtqXBJ9xzH&JA!*CTz4V?2Sul`t0|?);-eTfXpOvq6TKK*#+%l4( zo8uunQ}+ox6eDe!CeD_wmZa$1wrt3zs9f|5s;OZh#{7`vAeQsNjBF^8B-aDpPM~81 zFb#y|w`S%_)NJCrt8 zg~iT__3n*>Jk%3tp$Obh>X$WJF^1yVJ#d#Lh@_}N38p|{R=yv9k>e`q!-_08c}$%p z*S={9qBRd_B2uzG-4F0;UZuPPa#3;8shk z#qZ`ydVW%`Sk9yy)*p3C2v*lu9SAx#bBee2ulbk|4DO06@`=cU!5yv#1$~p!gz})Sj9a)eq%)wEB*$@|v#f?lr*d&757zSLJUy z-`&w5Jl(83ZGQEw28+E}ajzr?pAT1!thkJ6?6h|jSyX%g(3L#E9Y`rtP4YuteJ5SG zD0am2`m7uI_9ILk#M(h44ZZgjrH?UuD?T{EsfE0XaS?S~EWfpP92S-U*HW+2yYp9( z>f_C7z(P0&k6;j5MELGFS$wROOxs73iOVud3H@*^%|yn*xHpJf|lF(BdM1 z9ijk)vIO9SY=Z-x@&ULZGC(x^05Ysu*9qggQ8I$;C<_-*tZQ@Ut}l`)NS7ZV3QwO^ zg4FP%puz~mP!8_NY}SRW_b!bnY_mq4`3B@>L=*b6-pTLSTm^g{v#WH^q{Ca;@+Pbf zGb2W#JFyUlI??0&v}H5BkZyCZc9FuElA=%4Z)Qv+c}mr7nJ>fnHUIYT%^owI;T4+# z)+JqzjiY1XJy17qTm=2y4%WIV=P}8v;xj6X<}2YeXEwS_4B%AYA={0YFpiK>I2E%v zORg6b=%+Uz3Bm#t)PN%RW_o#ds9}>RJ#r#t*}^oY zgAEW$4S)z#Y7HO+Nz?#HXtYCRu({Odjm}urU+QjZHfj|ikex%??M3S8*di+qBKcNa zj?<2uZG+Hk0JzXiH8%wyMjHSzgb_%_2B0i&ItSqwXlW;cl0sBK@P+gCEnGIzdEnXZ z6uwGGjg`FhxYO5nTXl8>_XaK3$6M`|Afd+}5zWh!30@mQ;0d6R{sTKJ9iKU}Gn*FK z{^5foX!H$$9ByYLCxkVv2z2!ZKnno?k%|I%AnZXJqJU)xUC^KgfEG9)- ztP{CFc%xox@S!(1L;@?8j!Id&I8lkUh!^I=j65h}WqHng%T=4&*)4D#KfjH`BhTLO zCiKLIm}qlt61s0l8Gn$tq57phnZIBYV>NPLqYKvtwyr=M4&H+t#KD93i*x?4`+kmc z?A^v#ky^1{n33Dd<8hQIY6LdiJe;e~;@;yACm=LC01@~bve*GIEuS=0?5^+%U{4gL zj%jr)jju1nd-b?=t2070;prx2PB`&Pf>2KcgNW+IRg{D8!x)B663PZz!IxHPe`?rf ze89f%*iJawy@+#tx$dvMMeEa@t9-B%GL8zqHvCobT{3LL+KvPbM}+l+PObMmwqQxEkVd1LL(mZ)gPPo~ zBcKG5D%tf-yS#F})6LtE*E%aPFBW94)4%r0QeAiLg_HBU25jLS%b4<%@l}lfke9(Q z#?`ZqVM+@0GPJ$Pjc`XRN^L%1eqW39xg5cC9~PAp7cQ!_{FNk#dmQizTU8p(ZmZU{ zA}X%Y++Uj$su$-U!HaU4MQ^86D7{-a7$DJW(f!2Z5;PBzM!UYpLHCPg-F>ztuy z0(CM;e{JmzUz2@hq-Nv}bdsW*HB>1a`Gp)5{xw+FN>tfJYK78pW(3$&GD2r@5$rLX$u_Sa(Xm`5Ro?2r zfRIcYn{z!-n!9pI@36Znf96V4lUIJRd>_B6b3Dn2w>L__z@}bwWN!tJ#Aw!0F~KEG zZsP%p83b)k0LTE8GX1C(W`$UE!(vf*$9Eu%uK-2@YQgSdb56^WG9MV|SnW&mj(t&- zH;+;JGNwKt&949oNV7SR_g4TD@SwZ<2!_Ax)J1+7-=Y}QOLffx#*2Kg(gluc9Q9OipkM|v|yc-`-COjrsBHfGCp zPH!#?>~THD?Szmn(@cs!LVc@XCK`5);r?NKlV($w$6!@}=hMp9w>&2T6yiARLjHjR zZ!+)I*w!AMQX1lWe3w@8GO*?v{prQsN%`dqhDqDGMUOxUA?)DB2xnVL!KasbVVT-e zm`=JhBOHOW*PjY~BH`$-cZ2}Sr^oUzC*VK&^*$v_JHYU^O4qLPq&X5vY52#kPy!F? z=-q*jH)S}2$J*h8h(5U}DyrKY3jzmRwj@)*CsH8CJpi*nNFgyede_14*jVdFu5mBh z%dN0_=?@J+?@9m$dCxtKmQY-!Dc|GCw8N{ciW(AgSzPSnOmJX-1US)Q1|-x9z=4lj zsqH0wWhEmE(rpFMU^Dxh3G-e2G#%(HA@|k14YH-_UtTN%rL_Y1*-;s#ck(tgo|Fv- zIxn<~bc@))f~r2-mO(vGigoF1ZbyB~N&iJ2EB+L&_+Y%lQ-owQ2 z4)o^38@hJg76_Z@)uhI8R5xxppFoXV74?$c*mC}OH_0(m32)!ZM>Fl_uA zDLydETf6;G5YpE~u6LaKGm`J6u6^SVKn_s3Cf~Et@OGK!0a@RK+yi6x1nNtihy!DZ zBzBEo^HGyj(u)NqohlSe+DbUNo90T)B7E;9NNKO)iggJeI{Go0g}Havp$y0e*`NI- z+ObXqy`({$#g@OxfM-cbpyh@@{9&o)ain3IFIw&JXn#p*SH{LeSxnay~o+{^ndCMhjsO_{vMj0W~-Kolh8 zH8`Hy0}Kb%K~kOo65zP{>Oo=5GR;`7Yk-?LOGGroL|&XmW*FBZry-Sm@+lvw z-=`z(?IkJ_!WHbZfn&jA14hzvg;9Cul>?`VgF7}$YL9pLb9vykhppbKM!UzKh(llO z)m?sJJp%V=wV`G>fgkK>D4&n-X8s?%K4>}+Mf)Wm@;9;@^aO_hLB}Nk9>|q65KSpS z9A1{~YNH>(y_*AaDh2SqEISQKjebK60&xHV%#;n8FUTq@Ni}+7+MZGadM$JYKW?P) z-Q>wVDXT~=KG3TLNqs8^m45_a%i|w*QUaV}^K97isofF;2fFSosty=DZc`0R0(Q$T z7(64EEEf=)%5Z{L91E;*1g~{EC#l<1+rlWrZ7Az7j5fkg>Q0Q?YPW17ui}hvh#HQ8 z09Od?#=N=M=pKKrwIdQCWq>+SAdyH~`wGa@8$hNCoU*C6v<`56RS@q=)0u))lf*S6 zma<=inActywlXZHJY5pjHZzm;f4y=j%Z{POczU{w# z+kgAE|MqSF?c3s${@b_xw{QDz-}b-h+Zw=qn<*r)d*MkA4PTEI{v~UZzFqgXfI;Mz z&UxfMYZfQpw9f>k`b?%7Qi&%M9*y&xIdZZw4LsWKC_U;5%{TdxP46|QZ%~35necGT z%~m&r({KAea=f)vQvymF;k(iu8xoq^=q(_jTlVBgde==UOTXgI%zM?~Caubzt{>!7 z1P%`7(&@H?j`h~Od~qaSwrS_5K{pBx4o1ul_M(_$T?QOU@P4gDJI39|Z+A<(Ws01# zU(^by7xD&Gi2yKwvB6b?T~vrE41!dM8&V#KAbMpMW1V}}2egqAN`qolgVVal*N*R3 zTcv|5a%^wY<`GiYP4y7iE*)nHe25no?zhLbGs-8Bv_8_ehhgb6$J3>hv2eAOs`gnZ zCxk-hm-Uc5#?CY@*h^fZZBQGnuL@8s*pr8aaaG&4Y*G1uD(L}yzzpr5s6^Egp06$4 zQmrp$cL~y-*hYx^Vs$LkXvgYBngo`_iNoiHtWHCZHd`W}sbPDogKzL)R2t)hxsYd9W~QIIc7;8%{D#1cZCvailh z6?zlLro~82gpuJif$!92kP<<)Ld$QlY556(h5;o%sCinZsAt1`D1$aoRdVm)O6d=T zFX%1?edCHK!C?+xu8$mqq`>}bBZGzd$gxCVb8C=drK|5ZaF|0;+RdZZqU8=pxa8Kw zYf<8-A=VFNl`UC?7LVUffQCP5Q`2~5K-YK{x;*;oJC zpoN|PqMzu|BBspen@-mSHcaoqGtuN8tC33|;!A8J#r-29b@2Rc%3MwKrztavbMo&~W=Zt@ zOyNIGnJdhnr_5}#ex?6BWyYHWPnk9AeodLPj-IE?+~6@YLTX3z+{aRJ(bhW>w|Q)J zWy&AyF^cV)^1I=UjNUej73~!jpdwaW0zA>O#SC zDy$UsC!{-+*AE;Dey#L4fX;F`khJTv1e16LSnBh<8R8J z2K53;q=t4f5uNd4l1Y)I+=d+3AeV*%kS>nCGlk;CueNqBro}G`&LwnA#K7JoSaoy! z=yOgg2cd)k$WdsWkj|0=G_tCtq1AaZK|)~wCIZ3Nt)(j6^+Akk!Ym8Q6|kj(-$=dz z@Max+WI#b-U~W3<1u6%B5GcsMtkW?S@>Zwy?yB8%xK)?rT;F@7ACE1gLTI!ZZd2fb z`<-OCsoLHA9lvZ0QeP6zttuYH%+JfY(iz!T!>>M8gpQIptat;ZcUC*y=~x5MK}P6YHtL*sVHh2B;DV#Nc^)Z0^m4IIO#jNi zOWHos2M|bi?NaFjd^`s;Q?QBqC=WwyLf_cz`8c3j9uRj4sBGsuh`KmhqO z6BNJ>U|{1#%-;6X-$3C#%+bEdul%1KTJ!v8hnCUN9F*(~=B8M0kv|5mJ|ew#aWwiQ zMa+uwJyA1e7Bue+eh$rC`R}!IXdSehBfU;+qraqA7Qh8^OPgqsU)vO+@ju@3OTjTC zWpcbV#LuB=5eitH_?S_rD$gN#D(+HyZhqyxV->>+%1a%>w@toc(7uOUFE6i zLU%eJMw3PFAE50sy&Zv9XW$J0J_G;^?|YPQ^9Gy*>g9N+%DS$2bv_0x zH#EBqV6Q3;jx~ROZUy22)IPsnG`gClF=%+m6~MpWt&y z#do)UXN^}u9B5y1bhya88*Y>p&Ah?Md*oqRf(Y5!+akS!2Nn{WD%xf*MaiaF={Ou# zaB-G&7I912eUd-h-cYmw4T&hw2DLIck{q-(v9{dFF1)EdcSY`X>&b{cwBN&1rDO6n z4Tq@SeilLWGZvta;=)(Zlj>=4gR4Ns&yodlCaG=(^_aq^2V?jjvN;B^4bnwJr_`*3 z#B^+;l8ud3d&plIO`?TM<^>n>`b7Pp9JqYJE+qeick0kOuSfUo<8kgJZux%NH3wkT z5N)a0d>VW=BYM(PR9xdjkZ+{x zRF^yRwX2cLJwGtSh|IAHlb%j8H7X4Qa!oI`Vm`q94TFF_OS$qyJ}A;1KmhR?RN@Zc zr$*TllA^ZspPH%_n{wgw1qLQJ1*wF$v3l3Tn#S2UHT!6RfEvq9LBj?VAbz z{>S0zk|mw@7W5(Ic=g5$5k`Ms-mudD@F>$asiN^;sqHmP3&~AMmz4pFunKB0mD5q@ zP;b-Jx85*qtG_PiA&nC3H0v->z3N7J%}w&czfQ+sx%m}ku<&3-EWs$t!!+1I~5j=d>SwIT+#VRcukUboZ1O?%dkRWv5IApb}!^weg`ZWX$Y9z$G$8 zE)(mc#*33Ora%Ouz5=~wzuFvv2%ytuhip8UyV|UWip2bUe71#UD==Ug;A6=};z$H_ z97>FADFyXl0L%b6N#r*0Y(&svb1hOdsu?6c=p8unq$!q8QD4|fXcv3SDfKW$U|xDldY}=bfLHk(L7)Eb7@RWS+j-Wr0ddMtw_~jKV29HnGM84w4!T z1UVOlvWXI5fu5dvb*N#&3Fw9lm4MfJtjbq_;PO@Bh&iV_ESp9;_I+qxbkZbw_>?7K zw0A!gyvvw3aVRK&sd(Wu@}|_Wt{OE1hsI}2m5Xtq)^IvN9?|`6jY%5u^iirHL_bGW z@|f9!QejoWie_J6i0T>Ti1XvdOHxm3yqj?4=lv z0wn40A09~FI@v>93%voYFH>w^zSXk8Gxgh)@uBG_Gu?cfmYx-TIMvaVUgbhGO?$65 zW>RLT*a{vFq8a?`Sas8Nlu1w#N5a|~XKc@;eKeCP+KhfM3|OyxIZ6@m-(lHcki@g9zWqVI*&c?wh?-$B?!Y`m9>N*lnyygPE6>FzN$Hidf)mv*px7vP*Sz=ZoBv0CrN8vj{s%HF_t41)lR0KG7zK$_;vP1 z^|H#dN;US|1jwsJSgG4N_K5L7lpLClFx#vXMk$(Q8k!lg5IHC&n>*kK-gDd!8#@@ldoBxj&w-x5w``=pyieiyKv^WYr-SqANRef> zBGNW6M=Vpmu@5`gfawbeH(N3Tw#qL+xJhx_8X}euUtCV>v*`SM%c+QB;x&s3^9ckZ zRMzeK0Drh!<8&*$INF0ev3k7HOBm7R`EPj_zLXOCm(l&+n(U)V2=!m7Oh+q;Ro{1y zWsQQ)Zko!zpAb=2+?H9zS}QiN`Q867wB4Qb?vJluzqM4A2dn~^$EfLTB z;(TyBlx+G=OnsfnQ(k`3{A0q4XL*6*$ZB4AjJhdb-B0Qts==!? z`y3~*uK~0syEzO%Yy91=&xrfStGmV!_~?&b0&l_Zc6TTR`Jn8|kuGmZT)t1-$i0Lw z$Et%&;BQMX6fVaOzwoOW=ORJ9y`S2Vo+QUfK|R0$zXg4sgCde4CT5-GS6}3+?7oPf zO$vm64aaokXLO3_V*mzoUxn+n z2Eq1_)1c@1mm$GXTe34iVP7o1RBDpDL#mRQ{&)C-cs+lhurJ~)EMWOonO*jKHCjHB zon?2u^@n@Md^JeSzJ?@)5aNM8^tv=2_B{c~xR+9a1*Ves^=!5Y;d~-%<*r|ka%}nC z4racfi81%+^uF`#5-%1N@C7DmL^oTIsYW8!Qb0zuH$YJ~f)z^@Ril1#ANJ8cFQN~n z{#|Pr>DMK*#N@6Gc#3mB9}9#MO&Owx%Na*{xog(dF_S~u=qoRWx?Zm$YR(ww&U^p1 zvcZV9vZFvlQfMD-P*lpSlE_r*YcHAiyG}TcF7~^c@|IE_5$rXsC$8#8c|z~}nsF(d zPeB+{kKZF3jC|SGm#gRbT+X#!JPFuA1kT5c2L*JPlWKwL1%bABh%S>I=Wjo;I~%4M z0G$`IVCJU{fdqfV@ml(x$aPaeOoctjNJjCKg1O=2LfnUTzZJ8uQ=!~iEj23ryGs~& zIzV4vj$Nwc+8xt$5;Fvn9i93}OW(09s6?tX4{Mn$8i?A+?7kJWjYd%dgEnYM#{Fo_ ztTPx%X0HdjApHDI97Pwr&FDn6)slg=@ej7)P?#+|Fq7G^FT9zh^Ued$-;6CvD+*#F z1S4c9qL7xZRxuhQ;-JB`94z|JrVs`Fr0Pyns4Cu7!NO(XhCXtH4O>ePaiXaK&9s*> zY_F0@LcP8A#rPKWuD{RrMl~+AzMS*zoo}KYX1)9Z*QS`5Ajfy`;ma2qBD-p{9avZG zyHtGs!zRwGDb)Qe_ar;- z2@beNjVECT3^LbJE@>*iPhW5w*vM%w*|S4?c|UGe?z`1gr{QaXlZSW2g679 zPh)05)7rjK9Uq=NroCU_0J}4G?J3IZxZ#aa0DLso5v(FPQ9+5+0>Va!|6zvo-iJ02 zmD&7kn3>t^>?9v)ts}A1p$1=1Pv}`t$LKOlKYm_VHVhiH)r;Kzu?S2bmEwZ?`oQ#& zh9UqTF}kJm#1(HmrkX0^SREE%dKAtNTQNJ}POoL%cYqbvlp|=&)b2;7OvPO9f!Gm& z%?xq&HTOag)-|p>%3ItHrNKJv5Wa%7DX4b~D)n$0mebK`OgYL;Q=6lUQnR zm?12UFeI37uPWAkC%w!5!PL=;)P81&z%{jyOoqob7_6|G-=5{DvDX3Ml5Mf7O}5Oh zSNIbwkd3(npC?)T{26bI0%~A{-*(Q?z+tWg)__>8jghW4%qm%|h57DoD8C!-4Qv37 zeMCd74HV@Tc<62X$A~q^fv7dB6$(yWZ_{Q)ku}|&V@aHPoNTcMLBJi$%=a-ouhzqMk z0Q$ljt(>TreP@A1V}G3eg>IymH%Argt;lPdh>b;9edPjF%#FZ9IU4=DoH?e>6uh!=`A*Pui0rBr2cB$l9L)#;=+<$E^s#~ME_}T>7=@n5-?$_nHVj-@B-j)MP_%Zu`z4pcakFR}LJES>$5wKu^X26OH z7Azdn0KuX>;+zxxp(~;NitHH#7`v!oV>g`ox3T-F-EacZNOv4TjWC*~igHW8Ezk%M zES3%Af6V?CEIhUV!Qw6PUxI~YLoQ7f4H5 zyr~t`GqCwtC?Bg!Da$KT$i4xAzE+@oyD?!2{MW0X&Q=YP^ma$iMg9kvmvh0iIj5r3 zg}kwl9;l@Y%=k!F=LcO2;mcs~Xmq z0|*cj{s|Cf;z@(r%Oa+jR7>y+%$14<(v!Z+ho>V6RNhc10s(?LI6%<<9UurPzqrbr zJ1P(cDeq1sA{5fqlGLB_)Ereq9k3x^IH#+dd&1$QVd+k2COtUTmdqb+CfQ>GTjIRM z;@i7;U((H#cArXKVwTg=NhF1v`(Bonaec#16i4MO-cP-8>HH=Eo)WJBPlEIC`J{emK822QRjf1?4819O!N1Wj6!NovMg%83wd3> z18mmMTs4Inn?#9XwhwY9@4h^{&<(2m`fErg*M;o5)2z)ou!JF0;82;$JVbx>RTs=6 zb^-E~@R4c*gLK^XP$l~@KAV0tW!tDw4Z*y~PM$Jv!W{byS|>k9((FTp?+m0_?PLXh zxBQ3z6JsZms+E}0Nnt#LEQdJ`g_9Br7FjB>cEGc^#s@7JW9%?>GVq11RQQfaEuDIA zJm-p_HHcT-CvYg?RXWk3T4;`{8$7F8zO-1bd^{N(@e%+ZMv5DjtEJtVkW7K=_o6a$ zPt@CS(Tfy8?8y;i^zFnrNRAsO_*8$eHcNZWHMSTK+0f* znG;J!jirN)yQpJHY$$q;sX#7w)lGXCt}dbhqm6B<9`|3DNV5|1CI! z0K=IXFr2ynV>qv}R!v}IsAXyg?XlHuGY?u@<*R=%%U)01XXCJ2m2uAIz0n&>)V_K{BMeTKMuB80 z3(!+O1A59GFf+bC4~hrtDG)eY7|oF!BkoNHXS~H*{4{g|emL(tKCVwaH$wY34uzZp7+^Sq(Asda^4Fa*7zyJJz0nutJr3PBLr?J;p0;#%hP9^d zl2!ObaN6%Q9^d^?^-CHh6Ur!43Q0zNzi&sm4i)d1K-3l$!1%5$|yJ4 z2`=$h^DN1jZvg#SBIL_I`g5tx=?n4kSIgy)pJT~+oHX-f4L|kYyGO{s#ca40$72%J zlA8uk$-Fr)GZ^&KJ8W+oWq&5dd?$d}I^;pXZ@_o-01O8h1<{*$vL4`D7St_4XI zT)(#mOpxEqbC5l3iG~gVRYDw?aPM!uRP}qf@G988j>mJ)08=s;i;4XBH$eTKa#tfB zFhMSDIFgP21@&U7)RY6-76KiMjEbCZf-Dy{^~tq5XDQf$lv|CAD2{C{52D1U%jCiu zo^q&JCf2MA#;vZGh)+JA9Q1{|a{VnoTEi_89Dm8jq1KJ%^&ZmD1P-`*&qWCesNP%C zn4PGVKLRe$`+_S_98wr`1UXS;7TItGJm39z)QFtc0WWy^B#QNS} zrbd>(&#YB84|_LolDqNf)F$Hng2?wys25clhc3F@d3k8ki`O41vpO}CEXtFqB(5B> z^^@iq?MqXt$A)>C4_nJF|GBg?X51>AqjDho-aXEQ6`R8PQ?+`*KD& z72v=*h2FBoBzdX;?N09I^#U?~c*|XLK9FKkQx4t?5WBqyHba30nID_HgPB@BrpF)a zq~=HjYNhxCB31QGL)!J;2rE(ANWRcqO%q&kH*yL9)#$(b98ivnFYkyt)`u8llKoWu z1>)FJ7{qxCBGshujz+9VRWVAC50JYSD?ZIfDg1I@Pv=KI?w+JB^t*NM?zJd%t$HR^ z=$B(C&wk(oxvK_6#GP2_sJmk z{nOJPZvKRSa{LQ)dhW6nP?dA{(0{n1HVAI5FHJ-lDP#aw#Iw3psAv!7im)kt>#M+A zkq5vPougpsuCOW0&b4-j^Iu0#T1G8YRSC)fToEuxP7EF-2XjSjV6KQ$hKM=4n5eQ@ zQIowL;EKS5}}?&Vb&xqY)c7y0n+MCYhxfD5>ViNu)In-0pWiSJujFiaF6%`$b+%&lP|Yx0C~{b=kBEYw7#G8 zy`Pi-6_XAP>9i~SVOF^IV(}c{V3OxbZ^X9T^p@0i#^gZSRyA8TBC8~MBx`gOsER#V zi#Av=ecZ{>pM2ci`yy+?s}dkO;!nU-A5&F=PXliIpgT^I&Tgg$;nRM}(vNwun`$sQ=ZuT9PfW|Kg)tCs+q^jX{o0n8@N zq2LVRw6CO#nXlqMdA>m$q=z_-sQ!fCCL;Zl2Snv#;N!Wz8vfUM zEb4k)K37=g2bxHYGPSQNy|UQ!>i=9EqxgifkiqD0t3X^j_Ss@DljDZ1Knb}3l3md|=U zH!Ij*bq-Trxe^FY)As)y^yuV9ygn>9HP|NponF_ihCW2UhU3k9KUdTd)0`GGV8zJi}28A9os$1d7~t8ZlWPPL~= zW;5;0?#`5h>$&L{V|(kMK{zzunvFQ-a$ofchMoM@Liwe3W=@kB2Y+j!XZ7ZZf-l#> zof&)rR*68N!Z1EFc#~aDF!1*#`I?np?3bIPpS0Q@^48*QND&%UIb8GZ@=+B|)Jc8zgU zZkhZ0Q@Xbbu9+JKg>^m<{+2?TX|8lGOj)fUi!b4&iMXLt;{1d-JlN!m$ubMhz;@SI zK;?L^F$kbgZ{%ppMk^|7fo)>>100P6Ges^11mom zbzx_=K!xcM(5ky{yePKlc`#Ef^(y3DSY1ThSx~r2u=ic=vV0JDkv$c=jk#Op2>7=cB%seZ;|F3kzZW0kmw|2ekJu<>JMtTJsP1~6XD zy#V8NK?Xcm!<=F>fyw{^ZGU33`2LNf!?_i_LsJ&zjm^)Nx_R*N;>})HMo6AHTz7mX zTgJ$@o3F2+{2m*Jjq_0*s@yH|W5(+!S!(kjIz*RQqFc}P3+N4i9U8TgRA7fDNi9}G zhPGaWAZd9+Wa;+~jhw46A{kw8%&T|CMU-I8H5lsQMgImUsOox1EvUMP0W&)mauMSt zmAex{t_bprt9NnI+b_3WKG%HA^rgZ=z~;>&64Yoh((S=vAVYJXt$`?Iegk(eAHtbo zs5+ic!(?a=x3GzX)))BA`%6gdT>wSkKYy(y?9he#%iZ)lX`YfvrJ{1 zUS-!68scjS8UUYn?kLDf&GUUPZOra#Rkugy`5#R|E35ihUGotk039|CGM{cW5WZZ7 zOhaY29Aj2AZ-Y7~`I%0i-^W+xcVtIGEdzTwg7_4Q6mR|bQ)lalY3at@-5J zdZEj@VO!DaOLw!>SZ2i-qYHtdCyp71wBB6gI8Xe^LvxQi14 zm#mjhlRf@~dy1HE_1=4U`A~9eW4~N|$QXtzthvJjK|P)p08;Ii)AW)r^OtsJ3@7~4 zE!oc?#NSdao;y7j#pp2J&l?q3(sv^pDF*L`Hdf{ETS2se>*nl@jqiW@)pq?rZ=t9J zeMm%uf9?UST5{#dkCPXg%s*Gs2@-IjWy&*0tg3Yn0I62B^OkimlVNI3p87thcz#6%tVSd8YedrqQ`_0>G2SE@aomz#+2YnQ4;4Ki=s%p z;~qjw=%T>L$);Gbxpkx%&w@(foN&UkScVN`vvX5SRL~sqiRJx>|OpcM{4caNj!k zud;jEsf8x(e~o5jSf-(Wd+jIkIVHs6DW@+ka9;~>dJj79T0~NvqBpWs$UR&CplP80 zuxaBoN-IkuQtGLZZlZ-WsR80jSe-S<%?j1j4`~BvqANs%kOR6RVgocw&IkjfbT1=i z&W^Ake>4`+ajNa$;9^F1HK+T{d|UeNNx{XlxM3QYu>FyTBpiI~ANP=R-q;i#ea6<# z9NyDew`uqs?TQ6-YJkW`$tJMb%-g%+^nG2ObyC#p`A}A`MaERMexlfurWX*P7@^$u z{Hc{3P2$v?)6;e_`}^XjyWb!DQHu8^#{a0U|9tgWe zB=4vu)?a#41@5V6Br%wyyY;(RutAu$c=qusfwBcWr{;t6rDx$*a11X@{FIHpww3X4 znHi97D%Nn6MM82>3DB+i`2v4RTQb_UsS=e-=!1b_-!C@MRD$EpFZUGRbTM3PO|H5- zvhe90!u;S#{^+X`it|6nG(a$R7zk)WC{fh;Z57Xce%djL%4#&17Q$JqC_GLWbEQ8o zkHJk7xy`RQsSZ9>tF3w0)Dh!`BssyvZBSW_k=1<%){1i>kH&=;_2#veiK*?hQmD;z z^=V5j>Kfnde=|viF_qix_V=AT<48o@70>dXv)Nw;Tg8oFs~8(}(Px`nlK^PNafau- z?yGcyd~f7|zMx>{PWj|U0tjOln1D;HKfu~}SnX?XF=VdSA`X|O1yhiAvucufVt!cS z5~HCJeslBjJ>|_)Xd&W7CTf;@&8$rI$o~LqWbMYkdA0Swcr}~XSHaYN`yxLk1L23{h2dJy=1(jRfX| zL?a;xno|A;$FOHT+BA#XxW~fj zB5t?5A7P&t6UwHS&VGMl8TrG*zKqvr+^ z%+v{UJTZ9dLe5^nw#l$5(TLX`JP_4aD^w8nTLaOi;jA4X8e|{F)-J)?nIhj=qJWgX zQ3*gr%~8Pjm0cH63c>klW9RD^sIk8t%~tuyO+T29!Hw_z?pP*si=(SF-bnqhCC}b6 zJ^X#{i#>tzMfnf8V>z_g3hI^uw(Cyji)Jrp%m}{kaFvdnp)qjK)@N7JU2j^dSI&3S zuToLi7P_f~_l>hkat~*ZJ*uNp=>UOr1Rdt+-4AVTJAZnba1v{kY1ZT2fDe%b1sdP= zr<;|36LVNE{}6MY%&wdq3UNKp7B@mQzZU0z5fv5*V){i`uM;p_Gnw@$8D4*XMaT4D z^O;4AF^NQWSJGN;9ZB$BqWH7$a(-Yn;>;^W8T8!(>TrrAR;Q@wmk?hA1@pK9iG~U`$lw#cQZ#u;s zr~UkS*v%RZ_yWKM;gfG9c6j-O%S!{Bl zt_s7%#+J$M0|sRTwYsQ8NktTBYU!A&>p&B{--5QNKT9U>g{sbBmIjm|RMQQVkp0&M zN4<(M0bJRsOA`dk17Tml>Vd^j*=G1yWr*v%EY8Mf@Hy$7!`e&1$5#^guvXU1CWblm z6h-_saFb@%of3@0Nm zJ=t6XIy(a&3dJZF_rEE;bm!r%n(jPy{YEbzf_M1C2!z5ZG}&8Yfb&qfEZ2u{D3$n> z*YP#80AotAKweEqsE786tdxGDyU!to#UB+9_&G@=WtJ<_HcYg_h=JM}D1wSak}73* ztzwAG$}6QgzXlPODORrwETKy|ZdFJpePfHgJjO~-rLsQ_XVD9)N-hX(D(80D((Z_V zY@GA+Nw@gPN7d?0<(agp@w|;V{(C$o{D_v4eJ9Eh2+2M03(EFKnPZBdp~Xg^Ob3!201SoF+{vnU;ku(|Olt7*O1jzsi!a)X>$*``W9eoGZ0mn8jO zr#WZ|w*dK?M)<9yd$x!;GRxz>saPH2x}bfLFb|nos|=LdZBYOBSq#}kw*->mAjAXf z$T#k36jG87?>attlG&f)qj{>4CwYN7`#;%gSDAGt!;o5BI8lL*AG(n#{9`Sjoj zx%!T?ZM?tW=bTjYqX>v{2(1%zu@84@`_qxTM$S775ajx?RJE2TsdzwDuSR#MaJ#ja z2^~7orKcEa^jT>WMV!%fujI+oju%`ViXOz${kmaO!S1H}!t8df@&MA$1H}TpSN-7L ztIU_JiQDRPuBV7zYXji2hSTbr?}v!ZcT6@sUaSGM*Z7G!jQ&Qlt3R?~SJpFupB~D0 zH2+1)f|1!&Zu8!s;dM4hI50HacC6rD(wzd8cyKQ%p?c>fhsmE_(x|_CNkI;di|g}P zPgQ{ffiGVeme1|h+XKaNFA_Y0@K zbBCd#n(!@X<)Qv(yB)mRT!1#BIb&*_;op}H?mU=v>)*wsQEM4+N0J8@FQ8>pdXFnA zfL_wdWQ?H=w51Dukq-;r*&c!94s154yKv1J0@ma(4DxP{FFNPbPu{@Jo~Q7<`y{qLOcFqS3J}x~ptG1G z-OyzDMzkJFVD_qgkJaC94-Xt@kgGi_g;&ElVW3u)-aw!`vOz}e)am$F_*wU>88OX; z`=Rkh!9@gI?RiKqY2o|D(?r)#7J2Z;k-5wr@?g2j^u9N!E$x~e5_HwcK4Mi|`~%nm zq%G@cj1`!(eE=cz6o}aD>lJvoA@~g0nYCK-z+`<$Tz)BZm+fPOD&{%<^-(i3euw^H z&7t?~wGfqETerKo5RAi$MZMEQeo*|R*fp^kUy2J)I>*ZWUC<6ZpLcaS_iJWe{u=0Gq~LcG?n*J?7_2}w$ycMNQMo9=|y z5#0*n?#RAVOu$}Q|{+m7<0`1TmsY7U74lR!$B}^ z#aO0@@kuf>>QU?EGQAdqNB}S_6Yk*NjPYR`h9hZP{dV8Fj~i){X>K7x$R;(YYO_%r zbpmDXfa6^ej4`Z;m_Axto0Kzg_oGr|UP3R3U^Aw;;=FXXxPOb~iE`A$@)2rJS<)@w zTU7eF2fh6qOqlgYQ$mGTJrM}>bY(?%G;~2PH#vzI)g}YIltZsxr)r{pOWaxCFuE74 zgMQaG<6r4x)U04Df#8UrDmv_|?-~+E?atcP9Jx=b$pA@GJ4@IXRh1%})UAR?XfQ_) z+ODA+mVh*-XN~*SeV}&aCQ}#Y2#@c2N)mt6gf1ybxX80S;YKsedu~)dpyTu=%NDk| z!+lg~B^KZa{N8vT&yNHslx8_X>9W$?rg^IilUDu7tjqFzX!h4zT=9KP6VB`xu6S1W zpgw9gUmL}d_B|5YEYQY)h1w;M1ZmVbfccdkZ?>RzER%rlu8FTx;VLx*3-&SQgfMHW zRm(T!L!`v5sz^N+1J$hpiN%OZP2@Wr3G?WdDazl=7lu5{2H8WQkPnNsvUWeW%2Bza*+tp=etS!{UM;EUZfbrFMT=$i*}e>Q9XO&UsS6UKT%?n>r}S0B!Wzf5qUdNkgz#ZIH9SeI z01X<0c4QwScB+LH+jDvrcyP|hI=ZAq2tYkdXar>W2oZQ9-n)4-)F*zAn%e7sb2gh z^Twt>alPu&g1yxb*2Tvorfc43uGW5Wx*UnrHTb}s^6_h9@;68rE$*m3+v%Q#my@gY z10{4HcN;11+o~x)%`43|Ag;|tP3>+Fay8gm6jDdW_om>5f$rI?XCIorvxmJ{O%FY2 zD;PX(;D-R=3RE4|V!0~umsz-$ef)&3)OtS2 zBgd2MSV_0ZaoQ?4Bt}U!#PUrpW0g@_z}V?Nd&@MO?`-vwS`FNEC@BXt9b)sqf}0NC zqKP;fr62Mw>a7x4N0Lt06cLjYqw<1|Ocwn05?(3zrPk2|EKBbSf)Q;3RIIEsuGB}k zW60hjdi*Pin!vj)q+Q!aFJmE1%Y{@8TT(n6wg~#kXt`gd0G`b?@V2O$=>mFMmqECD zoz6~Myz`iTJqn|VL7Y~MaET0#frYdp5slr*S9jlZ;e#!aGD`m^5fwra5)ct`_3EE| zn#bio`LrvO)GHG7@H$@d3m~5+mbuT>J&y14NVE8zPvNe{CD zne^(az5!(Fi{c95GN+dKgGoBtUM}e`&V>BZgjH4!?3LjtmJs5-k*qy(T6N-PpWxWA zjY&7~KBIBje~M7TNiu^3T`7}&*!tGPq#)v71mVAih+*~9&^N|~Ybs$ph%PGF_x$UU z+_Eu|q0k5EvP@(x;vw4a+<<62geH*U>ShhGoDGrd;i|+p#8AgfKkUgJHu*wTAPbu1 z%lubXp>-^Z0y~>g0zp*c;Sff`dfPQw!!(QwJFLXD*NQEp%S2skAnM2MlamLm5Cx8_ ztyR!7d-{(j$h38w3Exx^m-k+5hs0sG8|y*Cgxi;o3(H_fS#tfqQ)tn#KXCPg%U^J{ z=sr}7Gu!`wt3x2({Wo0wq_t$s71-L6JGl!I0dcTyz&=bvW3sFQW9T2QwR=Sx-tV$? z?K24WtqUIlBc;z0{PsHXr)D#^60e!I_4UFp9exi4!FSsS2jqF-2d)F*b9W^E&x>Io zfd)Y9TY#}%wuQx=kL`%nSl~BK`OX=K@wzh$7zlEpIH+OMc|Hiv@=@LHEh7UJ&nCQ) zcb8lJapXyNCrGuJAhFcE-?O@Z?F_7;_txH8JfG^%h+I zWK_c{E&H$F3@BBpy?1?#iaPELP^_}GW{J&Dh+%#ltN|m6z(5e`^-s)S8O_v^zu{^h ztYAK+;#l|9{C+T8ZAuI}k-7atSKl?JXNVqQ85d6EsF_t|D3jO@!XCc5%7!FzTX+N6 zsKB2=z2oP9tmhg~LmZ>fIftnN#;ecETz}KmiH3jZ>ehqz+fXY_`JDV>NP9b02B~&? zwyDSNT7)SB)2F&0P!kH#`VEp1{1y@XIxN*`Tu6Bu^|62)%O~?XawbTm`)ZF$-8XLbKDyY zB$F{)yuzpFNRSzqEE^QPRj0i%Pw&hwlGBZwuT~|U*WQiqrzjT6bNz4W z*D5_bww?|c^Iaab3S~W86kF`mBCJtZ*Mk&)nbqdkmaV+x%8QNu;J^b?A=ymN79`#K zgp@0%tzMlfG1Ig)W(uimdmeRfD`F0go+%ek;8v*Ouffst)EN*x?<5fZ6+IVx`J0}e zq{m@2pB!G2y&zMt6W|F_>zW5pTGbe(kXBFEkI^XRp`|t70Py5aaY&@o8}X2_tf6Y{ z!W?v!T$=rmmyi1i!jgIAW*%xn%=_behH8C>SZZVoAaE8$PyJWmjM~T#J8O}W4nOwZvRwj96=?L1cu~gn^FDNlJI~hDa8p;b5uzKnSx4?>YUvs#z!JbT_j7B)c0@1Ms77SGc zrjvW(P9RZOLX4#roq{;5Xi%b}NCkE3ec;2ozw)VZV7PoUTpp|5j^LFQNx|EQeND-; z;A{q=I8;)QIy}s5#}7%HxUpkAF*ydjjIv2+mB5$?pDhyay$l}pH@K5;z=1QoSTIr_ z_9DB08UT@>bB%XEcDIzCkA}c_V%eCaC+X|L+9#56Rm913?Y?|A|nG+{6NF zNjaWr1vbQ|=4Yo$HcZBIOj;8U!+2Cl=Eg%d5rAtw%7`W}6uFix%-JU5pq8VFUfwJi zT3(iL*!ML}iT+sAZJEH90@VC0U1~QWIp-hy;{^=Jc8dL*ll2P|6uP&KS7feebh0gP zi_JZEL@9BsHR8D`?b)tcmlF7Ut%6>~8EPEhDFX^NJ?Gy9_5T&1#tYJ={YHi(>-U1t zu8kzb8kkth08cC(nn&3ui)7roq{`P86k(}@sM5|yJF$9#j4@P2YDu8x*QfR8OQMY~pxlc_dV5uX&U8<%JlC z6RV!_;lhMeZ;qb3XvleChQ!R+d?6p7vVzP_ogn~d#^=*TwC`(Tnv?elX)QEwn(w3a z20fT@@~GEQSpXVv@)%MH8{CG6*IpW*UX;9RQjKudNY{^o}OWK?Zfi_5xE zBqlb4M0VdrwE#Aa(ZK{YCMH4~M5Ha_)linw&mi_N3{bg4KKnWBH^LVVFIpkaU=3GZ z-1J_}tmmW1P=0@gZu~^@O|`1^Cg9j4NN>OnbMCvZlZJPj7b(n6D3%#sUNP;)gs7%8 znkx`5^H=|ymu3$9^*1m5rQ_QVdioEil&>w|TGPO7{!o)NOP;af1)!rbi@JbW1Pyu= zgL1sVa)quBuB22?c;Tl1gvuT@_@)Q$r;G1>(*FvTt$5N_7z`4>;j1xz8qb@YgoXLy z3#7_sK&t%h!r=dbNqcW%G$S%Jr7P{+lM}9 zo@qb4LR_yLWU4vaANw zmaPR3k%u3FXepV8WB!E6YdXjO36otdRlq2;3iQ8FXvIX<|De#>C1cuuqtL$o=wDWE z?W$;yA#{bIVZsInP&mShAk2j_Y>V7Cm-~^i;a=uNaa;KxWS*tA>WGF{+uIMMJBonx z?atHeT*epoMi03$V>^!opde$d^Vpd0&;l6|!7#L^?pO5w$EoizLxego4S^N=`C!8|hax`!_-CzF=EL#khT$J(sWC=r zFbS_)hgfK35-M8;Put@jzR0%LMS;|MO9%Gk^xG1j4RH5O;(8{XVD8lIXtV_*|K9mj{H6o$hbr{kObm&`RLO^D+;3y9TfU&!mx-> zNSTH303ps%3azoHML87#y6oJ;lYe|nBLcaj?VG-ML1hZEpN3Axf~0K`tX@&QE3ucK zo2q>xI=LyZx9ZdL3-aJy+xIN=iR4?&NH)ykh5r!^la7!#9CNdS0<+zC2WQs3K!Y@w z{~@o`k`>H3H+vKRW}Fj1Zz4;NV3`d%7zry!UB-M!PyJeNLFa3?<~QxS(XO6_t8P>) z^A8NzQf_^ROcVmr7$)b1uWEO!f=Ewd&Qn7VDSWmB0&kJl*geP37T9y&`Mu$_1Tx`x z`RErFQL288jA%}P`bPQOek2ADmb>Z1piX>i+) zvDEysQj9@hjG17~s3j{ifb$f!Rp{*b+hbt=GYj|Ty+?cWBd?~7KxG!eUl=p7aB7^3 zgRV2ly`~4s-5dr>V-(9aKkLss`e)^MZhoUvPBq$o>OA5oRFzgM>d1@>iUO^dwOz-~ z1#TvK#4#_IX7Q7~T*;m# z%l(yekffs^j*;gv^=qL+IsN{6Z+<=Yy(R+kTm$rfBH%#o_k><yNGnFUeO}XF1(uNErPL^Vcf8}k564Hw-kiA8LQL0$ z{FW|Xqw$*#Qt1jpF7oe2l= z0xA2|c_k71Y+8?Zz+o|rxn;UBA1Z=Yk2+?7Q8$P?IrS|C6|K`ZBSO_(ZWe26ncRZy zc`{AZ1MHJb6A_Zf@F@K_QHM?L{etE+d~w-v0;{jnCn}F}`f`Ztpd zBZ&_n$*vLq6G{I6*n6v>xYtMRGPpzIE+M$POK=PB5G=vn9Xf&Fu8jtF4+NKB!QI^n z?k-`PWbgggBj3!Kskt~e-Bnys1=aQI^{#h4+>L52)Itga?$w;lh3D0Uss=*nCeKFl z?A+P=G{&ofNsE%P2{uIiT?dT=NtJR0cB5Zxml&zBE}r?|$=Cbe!`&+2`lFU@`hXYn|bUXk;+cl=vB-cF+YE(HA3JMLlZ`%k>% z*Mt8_b|e2&4E>dK6@IrVR;sdHfA}4}-0SvNPA(tC_czl6vraU()Xb;e%VvJMXF&As z26-RbwDCf+gH<*BI|K@37?fuha(Rf{$*9%WT3P^n1AiGj@OlwmIyS zM7-7sT(elv@y(~SI*VtxD>RDfNcp_k#|T4=g|?4RY-MZ;jb-P}F^myOxmY60GsIsJ zb*2;&!iIdJV&;aV5(S>@E9B8$NA-R-jm@7`9r77}fG&AKNG>oayh*2>e#OKAIf zb_AP%D<6B|cY4ElWBdv9W*clM^mFHkGa-pgVjbt8_S46pzy;HYaKmCtAw3gF^Og>CZ4%*iiy^{z#~w5?4FGQ zrW(Q|R+K=k1Hl%Q=a7IcZ(9F{XT1FQtQotBtlt9(=KsMnj+{?bul+nOopG(9n-=7$ zvLOvfLz`ueFP&xX(!kV}Kft|X^?fPEcqPt=#x|u+x*M{}^5iAVyWD|V?Hl&1(dtalPyc*`UBRJvdT;3KQ z24@kY-eBt_T5LufgMlf=H)v^>CFOr7B74aH5|Q=8U+Q-h{}Pdl0QX=K`BS9>aNsWy z83F5;hzu$I&myv#5yMJI)Rg`_&c=&-1aO_l`rDq8!ppY4%6!$porYYial~0z6hKRk z|Ge_Qv5;?X^M6^$(+Ya8Fckm+>-IdX~2xVvSku^ml}f!PARBguf*6 zqdN+%K2N)U_zVTi820hM#E>POO^D-d72pl*yQaCGP-?Tl3FAUOIlE|0lk%XXr(cPMocTvynJT&ooGyOt%IWBbmQ7R`vquD zCDTnKUzER+|Do(oYRG?+wrX9Fp;~zfKM8%kYAt|F3?=A3C-)L>6t&d{fw#hY<>r&C z?IH3A9^`KwnUK)5i5RDi665qfakle-rt3B_4+w2gD{98v0^vHc`c;`&Bfp2Mw$eJM zlm(morR75mCxnQjLXYgDYyxll3Q9+KSn@;sJE}m$@Nxobq@3bG_3PeIy7Jt!IJ%-5 z*HLBc?RV*;+>8Ze=vWdb*8b&j2O*Kfq@uz56k;zt)D7YB19apeZpF3?SwqrNMZYcM zr~~r?ix=15Wh-luWkwNbr4pHbg9QgNt?gSASo|fe4#gL>W40Q?%P+CH!v?Bz>QP4p z1^i!AU#8unzH+XTx~O?xwI^y+P5E3<*~4G&W1V7oQbux=knvC4cgyNG_l>HyO^LMt zbKfqhU)&d1x+ul;8~n0^xo@H1zvaFNR)28cR51574gJM^HJ-UIW%z%@edPwg+&9wX znfprq9rw)&`;+^6Uq5qS;NQUSU)*=y49tB`pLSlh{1T1pdg21B!L5u8_`!c@Wk{)! z`0rH@457zrtUKY|tAm&C7q1@hY2^3$=!-XU1?x|9ttY;jUY6o;>!Ua~Fp%l;k-~0P z2Nq<#<)OZttk#!%}NOVy{mKIg!cck<$&@s4vQIv!~jGU>WC%QS<(*cP5KNH3d8k zXlw>mAkkJSM9%iX&$rY7$u6YVb`o537>5P7uwR_IpMK1itt4Gv?* z65es3Igxi?0G~}`r9`l4991mo_j`<#+AjQgjCA|p z`AHx(H2%bB*xlJ2JUJ#P2{esjvU{oBPi0C1^5<2NZtOR1g`BvoR=5o2k0!`*vh1vs zOcKsY{@Xag`56*+a+xX1ncT&(CBYhc8J!x_eJ&eX@`VXkC5<*HT(QD>z+B)Im-#EJ zZ&FSlAh~w&S9v%;u=Zh@s(AwV;D39@&5l`YaGd|>83UwQ=v~4K3FoOIQ)pgzDq6X! zW)?b`%Lb@o>!2;TrD?m)LAWHtdNd5tu?rw~lwlbHkn)5+MAYh|iG7uqo>kb-#fWfW zf7XnF!}l`%V9)pu&Dap}ousQ0hTvpw{`>h6y>0}{B%K&H`F%+}na##8%I==Y@qsdY zpM0|k=}PEt*IGs!Vs1?-n(}5DyKQL=>eSM*edRA`_X4a~wwjvA#Xe49CKb-@R5)}X zH=ujb_|SflH{re6B-JgUlTCnDT+^6PqRv`Q~D;<(E z)dUVrPQ=v`o?q23VJlP#;73Bl>i{%&YP%O4D?kzp`j#YwkF&u%A zi*L|YX|?pd+OJqenKo+?tQ=c;=v$VXqx{aqLfMeVC$a3!!CEnVqxL6r5^a0st9UAH zfJbGilVav1s2zBJHH30!2=jH!!0O=Ol`MedIsG#lSB z_YYMP0_QQXZA3hs3KMO7o9$LI-qm1||xMHw=%_0mn1OAnhCb&+A*IJ72*+iQKoI z`|x%qtk<^j+kF6Ot6Akmm|X%)b?zx+9+%H^9Ygo+c@c4jSN+WGz;!13PNxzV=j^1R zs=qu+T@iXoKZ`Mz#2+uYd4PG5!R~a8m00*}wpqNP!y|-~@(U+11|?7 zVkREUw0;QCZTHPZOz#MhHIrwl`|&KhQ6xjGWj`Z(DJ85h7`+V-ud$?H5&9N9c686B z6(9J4k<1UW%h(u>Kz#B=b%p|$TGPqlMj+xRD3$N29Issz-QVZ~8MDN-xw$vx>od!1 z-G^!$epp{@U#5oi7+!sb_$bAxl8oye4AzHrajdnQ%VvW&d=4F?wouCa7DQ$)E(k!R z!)H7f@I5!)R`A_4a3rr2I4^LZ4tmAcev892Z6DEHHY(H@mO+*~fAdFA@DPZePotkUZ{^^gz6T$2K_Fh#%wiNVSh>z18ce ztSshzQQf>$>p0$*3w7`lA3HZsv~;H*DachSrbC~9_mhViH<7w`4Dxe$>;37Aku?_V z{`l*0^_nEb>P-o~mdH5hpKSqsZE4-=uKu8kmBa|(%r@_jmZ)o?<$L#IFLtk$GD*JX zi6cJDBP*Z8&>X%E7u;A9ijbZaMV7BSI+}G?~nH@w_DQibk75twSq2RR}YZ~a`6gH zqvb_%gH>QBEIMKfGbH7y5yQqkG{V+k0ECTiZOE${pAS>gdssi_#g*=;qXxcm%ALAx zB~;h&h9b#GAgDrQ3u&+GQ&TSHQuC^(X^IMgO<=a4=;$r-^vYVD!LGWeeXW`5Nf0`KUH~uYTVN~ez8agff#rt>7IGNQr3#`vq>)w%m zLVe|zP4?(c9LuF4nL#0&W5cmWj7HI$cFBhdlaBm#1y?UiPm2D2)WWj8N5JGcwEJA# z<#Bhz>Mb5tcGN6jiL<4D|6&a*d`jsWj#y}C8NCOv?DPZpkWgTZSll`y$J*Q*C4+KY zxumGro^lPhOzI9?eQbXZOiDd@;9vRflV0-m^Nb=&T&bdf1=b8JP+GZOTgHZ(xogTH95jK z|1R)grEuuM^J4#r|4xFILu&;i__z2=s9}q`d}FgYHRgd}5F*>T%SFRA0e^~9z@8c~ zf}MqYMZYmI&i{VAie4zdKFdB2wdy>dgcqe&F>;{N7W)V zmkLVoS6IZGwBFPIEH%RD2;49ge9aHW4m{{E2{wyaSxmvp%dZ+D*L(^k#*0Y9?R(T_ zZl=yB-#aAzjNN9fd4#y2$>9?*{62Kkgw4GVDb5MfF@C1L8frjqZ0rvI6M{$_x`4T6 ztyiAtg9Aq<{c|QKmEIYHh83TA4p#RCQe_FhgzZkfee+a5X?K!2)XinOS^T~@iJ%{} z&Mq}I4%C@$_@^vIq2Jp4TwuAF_H+oEmBe&HM7lf|luc3ivj4g-L-CsfxkmFgQyeuQ zN!}QCPVomJ!{5|bTjpA6yv>dL-Ayl5UU%hg<57e6S1mjL2Np?}5|!hH%teyJY_#uY zTU<9&S0_tBD>hNW4|kECZ=lr)ieLX-h=P3VI11_1RDIsCN2zBo>7~FTY*9b8Sc$VeBK67vLmi*@OZQ1!xS>HRY26QC76xvBf0ic0mN$yh&gAR#-$Ck`ig)|5mV2 zv)(Hb#^ZpR%~b@kC152tb-sK&Y z%g;AFj2lDKC)vXz*$O_l;_=T;uaVh6ltb-ohDt%1q~ZXLdtQ%r6`@Q6)!-)>VkExj z9`mwFYvt4ZsfbstRrnY?z+@~`f)*I2f|JJ}yAn&&4Ypy_DHl|HDuSNkjZ4TH5>Awr zl>`iOV;;84&o}y-{TncOe^Q1e&`-Uh>Vgxz4a9iAfgEqC^EUgf!`r$Zf}MOc+pCX0 zYj}FW=6clf=qGYJyByy6afml@$9{Gsn+D_1(|H70R@$Ff=#4tw;?CtOO`QXqQ|u$| zp?n*{f9icW5kN5<`@v!oZ=Sa#lqgP|Xnt!>#RH?Br&J2bY zF!RNJ;8@c8M7(>l#)V(&IYf07ZJM17iGJG~y)zt+qD!RbXJ9{Dl$%$Gi( z94saNu5371z$jZyN~Lv2qbc_!eH-6Y;&`AEYY;YG2GK$Zf%>_)tggY4yhitH^9LC0 zah+3x1-k+ha%^R;s?;L8KAKSwsHE#(`u{CgPQdy^vv>(wBE_ z09|>o)@!iSa}$8va1ddUnz)%pU`AEFol1_W*0Q(d)mWXTeS+MLe(%gI%{N0ia^7cS z)_G&PTWvD$w2e}^O~`6WTZL1XOAq8%lXz{TV=Oor;Bn4V5@h!!@{~`bSn~^;rO8RJ z{Z0u<(ObgC7a!MBxH>91KE9zouko?&Et(NJI@+={(FMKa}0v>sh^GW3Ro9Ir1TQ7xsC^R7%x@Q-0x2@H#W#Jw=R;N#l< zk?Pk~V^gNx`9tIx1a~F^hjbC%sEW2m_>JpsTGV-@ip~C+p%@MM&oUJD9`C(iEm}w;R)ksUq44@5t;?NW&)=f2;N{VjboF!asU?ihyw#XG=^N3q+o?Ck zl$fva5yCM=%4sdX$#z?%li?ox(m?%|%s`|GnPf<9ICujdqAH3?GWxd2{_!N|GjP34 z^|}k*Cm9B)>=c!44@Y-7R^D_mE1!WJS(@QI{#e)lL$4PcSiTWRZ4o-SG^!ZMir1?o z7A3Kkhux<=&+H;}NdYUsksRq#YhVR<)yc0q-50D`yi)q50JHp3fSCjSRDjQXHZbQK zzOoCvhySerTmMpk9}=a3UB|lb(5iC)KXel@yyp=@e^P*hKNX%zO+){w0B=J- zE5J;qXR4vecyug{mT3&(#cY~Ouf$5~WBV10bN^C+S8D!20d@r|z~ymZ1z7zfSOKyx2*EV-wJRN#GeXq2lC%5z?zE;Oe4<<@bw8;0iOJ=0F#XUp#Upb z{G9?^=UK1m8*5k>3i(?A4!tg^i?29*pH8=SC^Xz?Aq&js?efMXeFTjqj(>3^ZHN}) zf^A(JbpK?RedV2L#um(EqTcroNBKu6e;k5!RX00TDNOR3i~(+l1hRNCpNONjvO z_UiT7coy4F!b9VgOo&O5o@&kaH$njw5*1qD`UEp0eV;#1;w88~fv;!wT%Qod2iGS8 znD~;2f#t*Cg7W#2FfAO+Zv(i)b0Bq0x7=?pE>Yh&G^53Sq303c%eZNoM3G=v zV_nyWoW=i0PH)KsX{E^Ati_R3*#o(Fgo#^9S_hm>KF|bblN}b$%`!R4er1!dR=>x6 zk%vlsp0ao69Nqfz!FtylFM5RFb0E-hEp112#FLTugQB@oP)Q{gdItP62u8G`vn#2b z?GwU(S;G&WO0r+Aj+@A3YM;HPtnb6ne3emDx1;ohCUxxpu-2?PJ!6WETPid ze168`E;fkG6(OS^-|!`gJp7TJ=;GsjNA0G4`UVcQ=C#(K_Q%u!bQl8h<`Op+>(O9K zgLBy~^pFvZa2L$(*4Q|jxKa$6O5XW08pJ_p>h%Mf0XP{{YT~gEq}By0ZGoVXz8QgaI4du~odn*7Jji6LNu z*}q07{=3Zyzk@$2%0oSTe_v7lBcdE%j|Gk>r|AA&M7dD5{2v?2!1;>3TFzPNpU#gl z8Vi{br4Xb;5Qww6W*;^tUwo%fO;X+!*&$PlcTH9qI_VGSCz>p!u#;Uh-tqWK?GZWw zFGkj0I?0+1PEPPx{+G!K7Wg`q4{RiS;N&}q=P@nUnk;{Rw&5> zm{2YD5%4c>A0xut(LW#;lq{MNyjkq{`B^g0fWG`Vgl-b-*u4RN(q0XdRA}xoK-4wz zd`rXiMXh93iC4`q;v3F=3{3d8fx<9gK5yd0|0oMwh?XZiX)VsxgyZOPi+JRX^E9YG zLmrIMUCcaErcRk41X=>&-z*Zz7r?vk$!ttPevSN|rC}RNI9p&Ckp6A^?nP)eDWyhx z^Npj=J_<=5jMKW=RcrB=B1=6qm3}RYpFX!9<@V+>KZ(CRyq2HH*nxpsU`gVxeGUC8 zwS(LesDC6CK=t|h8{I`(%%N=i2;RJI^A#>Q3kiSExZydIkFp_wNIWAu z$Bmf!OVfiOma(8iP`T_Qr$W-pIS;hF>a>~$;4WOo!~3ui$s)cBx(IyPyOAPi+Q%O> z-<0@azs3%mj>Ca2`%#L&yrp322uU{5#QV@oJ35t)1ddt9u`o!xto6sUf@9XFpD2}K zaHno|=P2V%b1#uO#aW`1wKL@~YhL5qTo{$Exo(kw63Hj=e;R^I)};h2rm&J`O5l<; z@Hu6T4*hS+AAf~Ewse5cDQjk|-zjSuCN)}Wv3`NSOIfqB|C^Nc$e{)QpW%-g-NrTh zY;qd`TV!)|w;u|!=+t|FjMoucCP2b%)sD$5u?Q+GPbi!@ot*^XtQ!Oo2}+$6S+n&& zS^O%>w|a@Zw&)td-!$wON8XbuURQre*m8ZJaVx*;= zg@#6;N=&`RlLZz-j9}j8<2m|pAk8LICkIChFSlp;bigAgN-(PYo|5+RfTJm7`>~K+ zao8+ur#jVD@^PS!gTFF)YAkgpNtZg4EFSKwS7ihU;b<)HYVKQ6aPnRnA_Zr@V8x#U zpQLhrJ1B@lnPT$3uLov9u6>9WGXCSq|!FWz{PLzcr;yS zO=>ZFy{a6cwhcr2?pMx37srmCYn|u#OB1ikj5+oqYGZ!E47>~IA1&-+^;{FZ zeME3qOi-wqC0X*o70N|Oy!=TU)Ucb z8Z}vEaUd4}n;l<3k-Zg_#XY7ug>5y!^@5PJK%8SMAMt?5NaKK53rq7W%<(boeWqaW*augR%r;=keOr`MNQ>kuoqocs zaoooHN2NXYi8W^qsjTrB*II!3BXWMp&&sthc=XY2vs50@1voAJ%0IHwXZ3G&tFeHZ z`n+8*wr*EeS%AjtwNY^9Zxff}XeU;@t59=i$V^^}(}HeFyV;t14pE zfCeqwl_P5Y2Qc2pr-Uyc z`BV2CGQ=lUmTBO}1yW~lj6;eD9OFno*Zi!{vv+F|h(b z`vIC0=4arKh58DouhZvuMMklgA=HOiix8g>c&}?If5ZS?etfWFgzz7LXCM9}Bkj?N z`A0_D0&c?}%Wl5!U4cNzu4G|?|C5rPXf_b5!XMQfF)0u-Y*P}EavnMY`b+Y_UCQTo zaNnKP`6&BiG2I|e>AXxf1ls@Q^Edk7}$Bm z*~oDKE+X!Ii1~J%^mc@=uLpna(f=O`*uZ~dVE?}^U_Sz{z@s`g#M)08z#@W~GzO=P z7Rny=+Ku;fysFnQ5;4(TR-wlA?jA``zD*F(>*HF|b0Kfr<#0~-se<#yUJw{4z9wYL zam(Z(t)_e56wl;nz>Y*0G`Sj%Jt z`qcneFxOqUS5csfPXK(D@N26W%7tj33je1R;{h^l`BFWj2nzt901*WMNFcmG`~d)Je7ynRUTjkwFdyiLA}BN08DwJ@=7&mNftF=L}(4!@STW1z)b0@`S)!5@*nUAbqpZ` zNm!pOQ-EgLb{dF93-A*A0*8I{q%M;&jHcdWb6=U^2h1zSP>_5OfZAwv5Ydq-Pu>L1 zWSn;QZKS9G`8#?C$xZn8c|5U>65Pv_0d|5TEcAQ^fklSXt8Y}KBjk8GY^piRzlgGS zsxJnPgx#P&(@Eo$79@<7%hB(dp2=NVO$rFy#aN_HlZ&OGBP{?0aP7;?IM>ix8Ub4z z{%yXrU$JJ3x1wfZ0*qoDQ5Ah1-0oYs&p$eB%sT47TqGx5l{Q02wxTo2g|IeIrq5;3 zL0XQJpBoKt4xN{hlp7OwIxxJgFfO|6Uya!w)fB*ZOUMTCaT`n@SvVmSr5 zNb0T~w@f*=$qKt1@Uq@YUCgX~Fj((ri%2^?T+-8o*m+Sj$PbDR1`wj0zJqsQ(}+;g zrV7s$1&wI~7)gDog>alK;=-Y(6%8>;a8Wb@9oc>kcBbSb$N0!>=YoiJ0K^avAo36Z zIT5^<=D|o)Q>v;tU;gG?(9?t2mtSM$roG;uL0(t@0#Ir_00|g<{`sm=>l*Tc;pX0X zk1!mh)cB1neeiUvkJY(Vs&zl`Og>JH!{`I3;ChRr&*~?~(-8N#@OFOE5Sd+txwFeC zsXRx$x^PgM zlu|h_;sQFNL87TJOvaV^iH9A`)7?xfqR>If>IV2tUc=tu{N}hFK9$P4x|u+^gQ6a3 zgz1D)3YaK$ZXkH>1RfiCCVuX0;JxXRlHtgnz+<^sLHyD(y~w5X-)Sjdn)v)USS+AS`+3jTBL9aFIrd)2Ro;?ffagsp|n_BHGz=m4F@77 zw6k){R6ZK}36etF>IKs9HHK+s^YnBVxIgy!d`D8>f!*4p7K0nY7EKWlo%5L@ERd(VWYui1n7RX#&n9?%U*>V;KyDzjCKIOG;b+1y;;l2P? zHP!n$!jd&l$5y^t(OS^E#USnG=&V`|hr_vJfBgX|xFO=)R}zXF_i4VYp8fMTEZt@@ zBgR=|soO@D%3aiND5|BYdtr#rbWTeOkNaDOsf89UjI-1n-LQ){@Hq}!uEn7%5tNuP zDMB>BXAVy*In&42s26D;nC4uQ6^3IHv|s(2RI2r!x=Lj25$Cwhy{-G6@%X!418Q-_ zxMvKOF#kqv*i#Sjc-Vzpj19k&K!ZIOBJ*a*H|PdC7Z=cwcR_UeMZcc-7HhrG!dudp z7Fa?-wFXoU4eb`d5xtKmHMU=}`4m$838nf1VYy1E6SNL3R}%-2s~R4&sD+9=;x`9{ z#u7eX=cV2++?PYvX}_a~ zR-48s-p8`@Y_gtQxc1+?$Qh!Aot}^2tAa==#Dv2`!3UCOlV4_8ON}eV)|(7K6|6Dh zWsAyBp*U0(jRhKdd^CUq8eu+(Tj%i3P*CSUi^42xT~oh{#BWVB$(fc7Ey_*N#R{sIWX)a;-(K}=~o)rBw_3^)mRpv z(^Sq>?od$BC~JO30Zo&j^8%sggdORvL$)mjd-&3x=gKbL&gN=YWael4Ome*A9($_Rk2ALEZCzeBhdGAoY7Xsd z*tiR5`!vgM(rf|YvS@E$v$DSqe6kAEWP)~zCXgA9<>?!Jw4^@6GAuw3eBJRy<$Lga z7K+1UFGRFcN{YM)IPFSq$Tu_SMDngFS;5sq74o|0IjtG^nn;rJT@ERoG+0M7syTW zJpD+{;;rAywT84s<6ldTaLfixH`*k9hjkgY83h9!^sB)OElb=HGAH}O_mJ9QHn}|? zJeNd9Ah)kM=$2$1oD_|-sOmxkvkz;hZL52B6JjY1U&cYb@mN#;;1ZLa-spG4qkM(W z{;|gjFLA8CKOd-Z_w}t<@#|GR4VeN&r4BdCM_y%55SWG~k|L#L9*t3_s1O4C9sxV` zyiDojqqO`Hst8>?1c5qpl(t5n{m@+@3Kpa=X@0Yb%Al6v`CTZuyHCgF?84H#Hq5{&9$4PULSjH6g(?d+3G4Px6bR3}9ZIfLu-!^I;-PVkj5y6*pRM{_S9E%q%ia#6r%yQI-JQH*RV~?Cdney(5 zQ1Co^RyD@0sr2l%nGZAR2DBj=({`|HLm=Q4K5`wujfSR|ET>-ZkeT87GO&2=1C+Kzz~F+VNW$t9vdj!PbE1g8XCcL-KYPq2I{&R&Im^YOG$ zSZG<;T4FkO^{CqyT(ajukKsb)hRqFWs*Y3X3gPLZRuc1?`*a&W>awGh6Z0wUgLdsZ z$IU1TUlAqckP^E!_FIH+iZ6U2Pk@*oGG5eReq(z4deao|HVEG&3|ZcT{uSJ+O*d@H z1QI&t9MNilTeS*y%X(J!Vqd^gshXRAFPWx2i*p>bgNN}qqe=N#m>BZa{ii*OIUH zhD-MhzEE**5Pd$sa!#YD8?xpSc{6&Mc9>sRlzn~c+^*VJQqYUjhTxxrg6N`}?OmfE zs)@^J)`8!Mh=})-9f@3hu;~7rgF*i+REm9Nv47<8uA(_b^+>p#Iqj8OOdwtJRk1=b z4_c_KYew=)#T0j)5K}u++Bvn+jP@O!k7usgQP7}w8&=a`N6&}dADp2-G*8?ycsNTK!8 zpj&tVAyMnQSCQw5OGBc1uk`HMcLI;}p(gbbd$PoMzE6Re6#;m_0GzKI6%q`~byEqY zhbk?|w^QG1uHsi+0tJNWAfjYvIaKe$49C-{>DJZVFUrcV5}tlY+~H9;IKPGP)!txQ zZ6&B+S8ws!Yu-|ZxJ+F(G3$#GEWTkI94>%SXV003sJbMtS@ChKch2!xr=dVwgB^jJw0Rh;mtLP zStGwiduuJuAU={6T_uyQCv%-0UeFwL5ofrJXm#Uca1E`=UjD$KhjQwNV~USYcA4iR znhxnp>s$NRU%y*n;NCWjjQIE-oja{GCEw#>L_LIrh{+5&o?QvdJ(In8u!-ynk^P&`=Otd4is^TCTz$~XPtK-+VgxB zeh-A>Yq9qH;&8H{Y*^xYTegSgi9uyH0S$<3PlB^`8(s4|B67G`OFv9I_V6_7`$3JZ zzuA);ZaD5v%Xgd z;D@iM8WUAck`Lp|hHK|=WhOQQnFejyB(>|OgAKrQfqfOiJH~uX&?i-ZIjb%vdZ!ef zY?$wu$+FW=%c^C9`>cpPoT6oJkp|v*$&9Zf{qiS4yK6xsPh5gOA9~JP)+6T| zh0OtTAw+HG?<{gW#YMeO;_PVIxr{Thmew&2L$?|Qw_nfrRHneWhP*c>&sI+_q*w)Y z+kihp4m?1+HUKJ+y9T%n_r?~00obPHj9pS&v{(8FTWTZ8*aNb)1xT>k(;D53A4}hw z#2ZN7noKt7NcxOm*q=z3GgX?GwZyS-{3K6DJoF5Q`Q(s60bZt01gW9}#OVBmUtUkt zWaK|`_+(OVb}R>yX6mx>(U5#+w=Insgg0M)7^|05{lM!86p^z({n=$+ax$&K*A0!= z_ak;AYdR1LF|SK)f^&nh7FSHt-ZNr^{(B}EK}UR)i-juQgUU|T{c5ThyJyRm{*Owo zmevTO=Mcw8lyYs%o0{^zQ=6bndjK48KwoZwBgo0J_l@ahDmg;2{^gmVp0);#fV^W@ z`65ZK6Qjpxq`Gv3js9`7ck|U}uz0tUH4K#BHxr#rgNoq`Wx@u7c;mQ7sy*vtU66aK z>|0{1{6+eW)?l7I8>*J@N10N64lVrtz8iKls}wfzE6U_JP?ZCK81n2KH0l6& z34D2=S0#LWWUG+1n-ptC3cf_z$3|+_>z(rQ+{171cB?Pfjci$@4G}c+{fAps*mF5h zX9eMr8ZFlH{LF0HoLY3)YkvRT64GcjxExqy$D%K~3%TI@s~k9bOLALI*v~DmGWO|L zIdFoa;&$SJdqw&wDfPJ=*piJpHU%yRj;#{hPCz3h9f8j30o*|EdCm48E!YqH2KRI~ zl@)$b;5QEK_U@sLHn>;TDV0NKmf{F;t4sn--|C1SwMmA6mxCiMWvA~nq9@n;;>j1v z%K7+72wRzDu8b>dU3p#IJlPGd99eb27SLl$HJy2*33dEy(q;8iXLMyT+jm!}cGxK= zwft3sE7gvf`(!NI13X&}o#A=tl3`qmDv7|r$}nol;D!eKrIVcDpIxAKYyd9Zl(q3= zcHGeuqR_FQFpSLlNcCfR)XL>)lTc8sYr8YNMY zH)f4ZtfQd<2mWT3`7#$zk9vQ{mA3=maeOS0NhhATd<4>m==KQoB^;0lp#_qO05Cul zfLtR0vcNWL8Q+`YRig9FO2!q_ZX{x!(HBN6W-tmkI#}+2)7oXxYLS=4dc*WMQWQdR zEYlI#O>Y!R-+T$BY`-&a%B6@#i0qzIPP~>zmBP+aLzIX9eSHu_{N_ny>G}F#t>ktr z7o-I|?q(oUx0ph1lCKH00sQb8)a{A#rt}-YWeIZ)w9MIeJlS{Oq`4%Cr8)TcjzU^? zvs~BJqUqMRX|zE$#YpIEc$&sT&PwQt^~RDMU}XexPUj^HEOtvULLRCzvC(KncU36} zI0Ybp&;zAR0R)hYpL)wGDN_nqN%ui(QvfV%2U_r$h(O(kB2UwF+K+UNq7@QUnjpk! z06jw=78{))3;w6jX(r5aeEkN%pok>}uiQF?*mX&IuWFhk9wfqmEdDFYAg(Tu(KLWn zMahO3BOg3vouspbJZ6bE=>f{M-sF^^EMd!^=MKsvWBcMCx3fxB6lx*lhEKg?BrCN% zU6#-kd!lXZhpbA|dFf41g7KND#y-3%~#BBDv7L zVLkBnKm@);YtJu629{mqQ{Xe+EE3oI=(`XF=gVms>K-G+J;Hrf!RUS-8MB1Rf>h98 z2^jHdgLX>*yjTRhI}46%z&vjk>35fGlzL0Y@f3Ajr2te2h>SXkG5`()C|U^s4f~#? zJocaul%fO>fsh0(Dgopnh(UD900Br~A;?@AAOo=t`l1YA0{++ypv=fndrte1EF0Mg z3&PL~3*X$fKR?yjCz0l3d~Q3nS)6Im*>`_bo9Juo$T?G5fat<-+_RAzdG)lH3RT_! z&7mvV%cIC4{4*37zloxl~06d>y zh=9S+)lxrNo6!6&5qDH25q$pwq)h=}S21Y@->A5!++&S@gm|DS;}s^5 zWSL<(#!t7bd>R>Ak|TOR*8E)(Ny3PWaXOd;dSbT4IZZExII+$M*2`tR(tqTN1v3(1D2U?;-N5vy!7vEQqDzJi)19UPm zq@9^1X=*_1+i!!Q=+XHIG4|2RH*j{cP`X`7uvmiWvGa{ON)qrCd1B*1TJ-3m5C@=C zdUPfTSx`Ut4OqO4{#^cEHrJm#st#5)0Fv)<>pqx0P&5lFU*@#)JfGxMatE0Nq!E9~Hm+0Fl;!9~HCi(1bwESm@~J$pw?ruBr~5 zA}|D%wfJ9&szJ+G=;E*j&fN&Oav+32@Y5G_z!l?n$PQ1%*l(KN0|hOHkouc?AfZ42 z1^rm#NkpcN#ZS(N=nDrbX+7}}2w;7wwZOw_)VIIRiqPwSofSm{0@OfvngDVTR1iQK zWUK|S20d*7m_bkA!<9P3V1P6P$v>VukUeLJcZq}DMl06WzCzr9V(J0dz@)Q(Jc6iu z13rQ<`0pJ-92@@K5kz3#|K~>#9{*=Y5JLZY1Tk>-#}UK{#yVnJJXjrm@TmRu2;n>P zL+Okz3H2o!*RJ1bd;_QxR45L9i1@)bn#t(dgyX2=+q#BuIJt=z$qIdO!htqO#l{hnEO-IQ4nqV{(uqOphSD+{<2F=|5aGWI4$=INVb=tYL3g`DhGx}S~Iav-`92=Q8rjqKr6MHdP>O$)M%(4mNrT&q{EM`O{pIR+=VXHD} z{BSXy6O0v|58O#b-%{^F^_D<_9tqHifcP&O3zsb?g79x(3JmP;V19TZuq)|XS*?SI zx<@>m!NFntS^?dV)E9L@)bP^N!y(6`qGrdzpQlX{Y@)>Y&2~Kyoth;UaMjg@miN~5 zZ)N-r*$^MRw|>wI8{FRR37&rSDN;3RKJ3x1qoYpg9xS=pIiCL-Uz5<(8*rh_2!fOZ z5CQe0V{ohkbG-HNb{yeW0}-d?!NPCNinc@Pt8l{A-*a<~Io8-e_*xa$tQ<5MQp&PB zn`HOE?FV9xPgo}V#>7iZQaoY`eDk9cVP85gwKJn$Wj)5tW}f(lUF$ZltUo5YZPdMm zo6@vskq*sBcUb6t+CbfvxXbIUP3J}X{Fa9>0QXGX&~LG>v2g%YDhYTA!3`Rg1n{%8 zvIV6d^ulK?p3>C@KxL$-QMn+5`DlJzV5q`|q_aYpatY;b(c{`Xycco28>2!2@k#+$ z<)Q9B;^Jv{IpK@26*mS#9!qr?lf@yM8a{y-`_K%q)83O4)ov}6x@SSb5s)E+v%7tw zVUTF#%hS5%Tr}centAd|Dx`#!m?`HwQU+C z@0;!rq`Nz$q@@Ly(&?4p}fZx22cq*Lc@Gj-(@pIJ(PZ_Gu4= zbz#zx>K@=^V>3jIjz~`V-qrxbbT}b`E5ynx(8}>nmz5iQ(Rgj(^;a8EsBJ=l_j3?> ztZAEC_7rtf77HSf1Okh55PTXF?Y!YQ&dU_~`_C~y$v8B`VG=p7VZOuJ{XXtBG>W10 z5%4*Mkijf?Var=JrA}^N_k9X-<6MH|S2Al5L+*VW+lo(Ty!j%4`Zx~Rx+Wr8Bi;H} z>7ONy^VHu(jZdxHg;V^&J~IVJ%@YPLLmsXddsIs*jPXm}L+Q%!v(cu6GY{TAYHxi& zt!U=qU}zpfQ5#YQ(ShfaP{xt)x~bjRUy~4j_&W5hqDqR@InQSngK^TiY!4aE z^P5J9!>;1fueSnH4c}L()C7TCz=0@)hqz5AR`i1f-6IurNszeX*vNh zF$gzp(jw)LkrB;E)-SY=yV!=M$*^zB;t*YC<@P{b7OwQ?<}^U8800>DD)2=NJZ+>c z1IXeKHh3a{M;syyOGj(F**^?8Q649LM+E83$`Qz!i+`!Psj}h8os%@;!!}|iMt}@I|z&50jP$t7KEg;=DO9MYWwMMXS}&i%e7`1g3-sBL=d9?A@XFO9Qc;G|ji} zXLmUl?r?4d+Swtdi?*SQ5cSP4Vc9_4PzOX!|IP@Mq00B4^ zC|J!z&vT)^KU}hfhT=#92WMgI7u&m^5TD&AK&hmezr{jOr?}}pRYGp&echW;{Cppw zZ+lya)OgKEVDuR%*>pdn)>JBp`JTHJ9DvSiV#i~vU>;h7lhvRSqpkgM$Wifyrv)u{ z$=fV@t45XT5$(MQfa(&59@Y~5B8lTVG0vFb+$GkSp{dAabsoj zj%yLw;*y7}L(NS=hlD%YY-wX}#^pU2`(;Q_+@Dr9tuh+0vQx=WvpV)PdEW#^C87-H z8a>#C^MBNW+Oyf4g#-;GY*~Hzj!$>`Rf<-SGly-;tG+l)Co<;f5}uBN@Cp=JYqGPM zE|&zhw|mrJEv?jZa;TeqIAUrdons7hDQuKHd+}T7@#Dphasp2pTFVyHAD7n{)*Fkp zvaa|mzhd6Hs}|kz1cmg5u+bcfEb!V(ENrFGL`G+iUEd51lar_<9y)6JSjk3v!e5#6 zGq@n>lg3jiY*M}&!`Cm^EG9UU^rQxJstUfpRTjQy+y_$+v66gt58IF2v>4w?_5J!M zuuNUD29~MU`Z&k?NYfP13mosr*V)~csTntG!>0Eec}_9D?zVj1LYL47Dt>Q zXlq-POIR|CN-5IJO^JN~oa&H$e^sGrrUXgBaW`hvyYQxIu{|iFZ{av{Itk)6Kh`(O z70T9tNpEt|X5#lq9v9YbZS+=*%-B>=xvrd;Bs`tmf84#LOsq>Pj+c<0K-~I(F)N3L z%d#|EQvj?|tLU45>`U%&Pp@fDh%^(73ff9wtu`VN9U;F6llNDawj>^&X_q5jrCiv^ z&)|Q}m+djIe6mzBQ~ZezF+q?$ekofN?yiI|xW^@QE7!mjn=j`EY^thU}q zDxWeu9*w3^S8()XS7PQ$VaW`xFSy3**;48RpXh{0A!_nvAPv9MEl>1yzD5up zxTQf1P63}mdfoXcHw&ESKk%x#K@_t>B*6J@+R zgTA}W+3iCeV4ex#BO3*?j=Lob#y>#b@yeUPYeu&%uLqsop7Mtn@c9KK5Z+v&%ovh~2+s|$D?$2zC^Lu%ygATo21!Q{7Xz9+A;<8qYb(7V@8RJaYoGW)ND(o9 zQPs-l)||A!8x06$ElD@{+UNZ%-`wPaY85CPvcl+JT5RdJr}Dl=qo2RcR(9YC*2r504ihf$%4zlwbJCC~HL=Ae{)X|AB!tQs$4z zPP6x!@p<3ks*g$`EYCI4{pt4CCVj@cb}!BhGo*WpOoRhPC$cdn z6XHKB=o^%&V;{>REA9g}fe)7C>8}y{gzQ=NSrWRCVB^F*871EUbC%E9kE-r*C6j39 zs1?Zv>zr#bwJ>TcR$>bmeoQNY;a=pf5O?@zp&2O;YsZRxE?@RWb9|GHLtTn~L=*6^ zh>IGQ&&n(p<79?bT&t%Yn#(L8m}HG_3Adj0vPgx>a)Bt#r)`5MZTDWkq(@0fs0d4i z=-TJV#wE*%gJ<{b5oRdUsj2lu7@DOq-Zas^)CaU{#IU#1a@Lso_X+Kc`L)#fJd0j= zt}xuG>0{hGOvos`y@4t^?HE7FQ4QL!p|YASOtU8BDP4Nk@^oBdL}%wN(TF^tPXwWa zNy+J#kwhK1n7-|!@Fin@B=CiZV8q9&vpkB^-uGA6d_Af{J8kQ>Yu;&CZe0_Gy~|tx zcFkReAsX=|aW2jc8`jc9Y`xgyR(|49fhTHD0zO`{%{lDf-apMn&cC40GR`@^ z%jDzw$&Tp9YmscC4dCvy>#95Ui^XU7M%{RRcV5hIZn6WI;US#yAq7$VGh*-P$P zK}#F>qN`|v5ZlZ3MatMc))PZy`^pX-wEW_GTDP81*U9|aUDTcp`BYvYmKefCit`=S z$iy5vWP#L^ze$STNOdR9PnkQ(@7lPwEfSK8_`ghdOfvr5_+b&*;CpG?IH+~JQ*f9l zk38mZ@#DLd6u`1)UQm*z(VkUr&DXObBO4zpyo z&)`qiLpJu)!kz~lBKiouzF}&0PedErc>_LnZQmS;DYXXB_SCgzRVV6w9Ig)!WUO-FB7}VPj74f*G7#TJ#@oAF zJ_Q&MKxq+@#{gdfC=s4K3~A@KE^}#fA^EyBs0mBrK2S&iRYC9>sco%>$iYJ$NXTMX zuY1BXjINJ1)r@=wY9A6o#o<{zCspv|nnQUKHNV-2cx*ZNxpdytH#7(Z<(es`dtaTl zF!bHVE!M!Z2=IXzN{+e&T3L*4dVv{Ys1dLb3Sq(rPX@Pvi2W|`#IRGe03IA}(f~IS zC=WaU6p=umAs0?|zibD{NujxfDhGZxvBc9OfdgQLfZ_c;utLCHAplH}LN&l95epeq z5JseJJ}|enXjHHA>vDZ{jYlHm{QSF^;r;7hDgFj~Z5@r<6#pog;%B=}@ndbgn}Qoo zW5U^EE*wIB`6*yMR+oT-{!X=lim z=Nvo)eEM7-dMA7hr<u=1ACfvv z^>QgLMP6a>JD%Z<L`-(H)%4=M;%|4;WD9H22fPPPOKAcLw7qC^+Lqj5=$cFIM8o zVy!YiPrX-jU($jtvtD(dzOGNM36Ui^$*0Ojq)opehDbmX&to6%T_&xZs8+Uk{Pu&} zHG9vJAMrJ!NNeR6)YGu@^G!imInK6x9nV{R7Ler$_d!2kMB#gy%(UZ{{xU`zZ2(srqr|Ty(!Iwe?b|+%ED{^{K zUKJt6X+n;L4fbjI^yZn~2HC}0YQxg$v3AdT&W;4Q*XGuf(JqJeYq3Tr-VT1i0@1$s zLV7Z#()JRGIU%cyGWFB)$RlDp32MjTO5by_NX1%>=J-I}vQss6b;i zf0+)HQA4SynW^1@@yP;&_`Ns!FxB|EoG9^tl`aH^e9xoM+_6vdz&sg*klP?B&m{0o z>$eNIsH{}F)y(EI*UIN8IM(gOXQ9;`2ao3$DUDvg_{4ZPwDLu3c{t<>4;V&+(#TrS zAK0igv_AC%=~Y$PH0S$Ttdd9aW7~&BBTc*5kGrHejFwnm2@$rSni@I;Wu9p~*MB|~ zuqH-+QT+aFO-(tM>`;plpcDp!-_w1I-qK&W-0HNMT0WtVMrXP`j782_e81~`P^$8S zGG}SHXpB3_IYZN#d3MdZbyx(YHr7&P!@uvP4XU=@Ag=YIOlg@4x#V-~s?Z64UK5en zU=l52e)>qqf#?o=l)D%i&dURn41rd3*O;GWhF^cyd#g#rD@j?hVp_cFx`KrbB(lb1 z`VOCJs#+2NkXQ&0IoXPLVf$Wzeg#I%rh;^VJUUWlXM=6bi)c<|SHL(HqJrQa07w)< zOyGxZlN6Eg2mpH#Bn%&nct^G4j|qG=dr6%T6FVqepe7H9#6!ptxZ44}c!&_5({SyI z`HkZF_vnsI3q|3Ed8W|XoOm!N0pJ{iTxbH|ItJq%yDZ}x=k1s5pe(65{M2v`Ag6&4 z!&?A+G!SaGoWLDT&eZ0@yU6$?8`zjOe%eUy7?W{%HM6!RE^*qF`oV!FhX08Ri*)_9{yZDdL5ZZ8TV^9Y z5y6#$(wj#cd?yEMbZiFrwdpouA z>G@jrp)sw5u67ykzm9GEc*lw3(W%y9;N#mCZ|TVX6Bbw8Q9e9c)E_i+f%lo_PQUly z4`Y#7wnZX^@nJ?FX&hU4;Hc#XbUK64FyE&NM_9e2ac?j2j~_3CYm~?@GnW!ZRAtDE z-A1k_e!LYpTwHJeLGBH~#QnU%p zPG@9w2_1H2qiRGV(RBk=KO)O9=0-;h`bshf5W@xwsa4b`Vx6g2>zs~%Q zvmkFXdk2As^%IQLsgk)>>+*5f&$Nb{)?*5SC*ab1etpKM3Y&7dBkCl%`5fAnk?&x1NiT~^d!$QZm@?ZW|xJUoQWj5an$!ef852>iVD^p)0nu0q7& zSv@!!Y(91iIDUE&CThpvaLrcse!|$zO(1XBS-Ge3^^coV^JFz1^P4mwHHN>JFa%}5&j8bXjkW#~Hxs&TUEmZ94#OD$Iy{sYJ{FLGhdxEVE$KM` zrSQ-^LIrV76IQ?rWUcorQ>)>uc9s2A+yg#gKNn>yA}2d8gDH!xD=ihcq7^4 z50XRf5W|DQrB1p`*P@*W2F@>p9Nl+t_}kT+*)hj;K%yKmdrOo<1uDRj+NAKmmedHB zZc5PRlk&3Ky;MP_YBw>dAcjf$P2Oo%N`A zhZy{GPGI+P&B||k{7*vylG|jyo5?-A(bxQT43C})94w(&-{qh*;dSl^5eXZ6RY4Id zt+15HhF26kZW4mdr!COYnJY);zk&>-;AE$oz-e6QzMI~M7N`D&kFH7rmmcwrc^Tqm zOYL&w?boeokstqcuS#QKhtZfrb;wt{>W%SYlg8eMvZVkoQFZxW&Gb0Y$O>sa;r0BVtA%h`dc-oq-0}4wNh?r-KaA>qhIZ=1a*=k}a1HREPV80~fY{^sK&_R!_N}pjS4Xc^fZy2D=(^Vw&3sN590cLg~ zRMyByy9dG|+P=8Wnp;DmBMoDpt;((*Eg-qP7XKVSb!M>hO0sLfaRc8^b0V?^`zgo6w4c1Z*h z3_x%HlzrQCO8O{iz8GiUD0CUP7m=MolY(}^C5+*`>5tO=u39wW%gp;3ti_Sopjddw zg->r!F#^Cr0io0PzxZxYI;WIha_qJ)YUBQ{QO$)|TwBSNMnlYo@%Vusb(Om=n+7&+ zaL=IiENIaeagKE0aSv6(6m>L4^cape82_`Pj^%$|)Uo_s)XDf& z)Ug7KIx+vhEb6fT_li1zkvNnNM&+rsZ?YXNsvxSj7OJ^xbmzA?`33|0t(d_EPaWks&?* zS}EaHNjcS2zI{xeH(q?|JG&#j%ium=2Bk_MDgKNU_cNyI1rC%A`#LeFs+*kjS!L5k?mBAhOnZZREbOicXplq=4|2Txp z_g{r@15JJ$Z~fn~W7z)%JpRwvao&H#j$y%~ZCwQk>4u0X$n3igFpU9e0@W?az_$kD zP|PLpt=HR(a4%t*g-HQ$5KYW|IIhe5JYj6V%0TGT#YKXI-r^E+;`Fo=Z}VVN?qs6a z?B1SKZlVV5q)I0iDuH$Dl;v1#H?AF(j9cp6qQbz8<@j$Wy>jOIQnIsy?y0spMGGY1 z2K-H<>T(lHN|+rpFg5*npTaXF8cDZ{O!w0FP7PRU_cLqU;z;NJKY`1zf2GUUf6(PW z;4<3(C|tf!c>2BuhpzyA!)S~b2Vel4*r6owEI=eXR34#t0f@N5p$D$mp~W!WR~k(g z&txi&7&v@h9*-7Dc%1VwaHKeM>aVs7RYgj_P@}b=?b$yoyyA1V&Cv8;!n<$j*|>9#lsEO%B363c_{h6H)+#1W zdE>Ze?`w6^O6lHnIe%lzZ7Xg>VjXYZ((DhF&@D%Tu8RMbVyveZD23A zDP8JwA`_c52)%uJMKn=DCZe;tiQkfB9=mFrZwQL-Q~*KMAD9+)%V{lJKizWL1HBbl zO#1SdpG{Wm(0+2-Vgr!VR_*+!oOa3eH>YiJT>pd9S_s^7+QCP^IBg5^SAxr}ot;(u zlqe>Tll}Q0>8yt~!TlLL=Hf85XrUI-cO4j3MMj|%Z4_D3ZehKy&|SzD z{g>|8hwj_%m`&tucZ{{*S9dHm`geDXdjT8lj^$>&_@g`KmwDSAyK%n@L_ST_rz55v zti{xOR(a3{ioL7cs{a)f_ z0zIg?3QwLX;ql*g$LbQn?pROv93zR|pFA$5&*ZPxnQ1+c$C*~*P;)FF|0g_dbzI82omo#$unO-klbYU2a+pZTw^+egMmy=D~8Xr^p)oZ z|1Tt${A;YQJaxWvtn>zb*-m1oURzIr&C;k-4L1J1I=f^>mOuNoEuy4Tu4rpfzBti3 z2~L)hk#=Je-I)ECH~UDrQ%lG~i*1&Iz2iZPQ=4!z(d7*V&H0@BaysN&j0UJ@qpVn4 zS-v}r2A!}EQM;q}XIcmr!5c&8q#*^0j`EU#;OM(58O86WSJ14w739gLtkq9~Uo{Me za#{7qO=Rvxg}Ny>nk`Ypxh*IC4vG^tfkAOYxK_5`>X|sf5BG1?Gco_7o_Vmsb;b{> zXYT%1&%i+UjK_eX-}9Vb>Y2D(^^A?!t$N1JV8Q6`)H4Vf&ttINh;l-%Vth}v8uOOK z5>6A+4$ZqxF;=2<%h@Q;zRNhmKA_K7hL%7c>M7;F*KFL}uE5)s6rs8MHOZ$^X4}Mj-a5b_UZG)XtFI{fl;n zPTBmIc7}5Cmv*LYDg3Y6neU)>ral`>3e?URz5}&0`2VDxu?hLDoiX74shu&__$Td5 zV`tr^0;ru)QSA7KcBbdmKeRKQKeaQX8b7r&H=F;lcE;@w?TpMH+8JdJ@xRf|bYVsP zn|224&HsDtOgDE>JgA+K`>maEV@GoNC+&=B9`w_#b_OLB)Xq5lx3x1m|Eis__-E~m zf?6xEPX)az-fqW8nULzP9om#XZwoD%wjC`kH+JIKVfbEkUBw2MXD7IfGSe?sFIKzg zGpLj5{aWUOdLnHG>k^TbYW4MX0O&N zw@ahJ7dd%Vkpiz<|CzK9%A^YU5vz%h+Pjewd^#4f58Ax=cD2>6sbZ?7@x1UD$uIz# z523aWJDa^{?^+0V&nxe1240Tahs+_9^YYd^o0Q&JOx63fGdO-xsmmiw2yZGz1rsDA z-kGu{7%ma6G7+0HaDEW?eYZ{@8k)<|Jj z4gDLtoET0`3G& z!I!@HE0-3{uXTW~7&H(3SAK{=IRwM?lMW25)kSXfJ6637411>7zw|{r*eN@y-7&K2 zzI?~MlaHywlhcA`IqQ*i*FH#oe$&?Y{6{kY#*zeK*sLEwrXa#FC$v8p>ZUrE;PhlE z4KeO(S#8nyVr;?^L^j($WTAV(LV16xJzKAnGjxu7Q7#Qb4#g~GKJQWe0QCzZc(^2u zjU1YbKlnq^p7i55kU#i%w4W=@G(>p&OG+f17xb%H>^d_46Z{4ma!auwSZb3z!_*?B1X*i|0u%+>E%t%$XE39$Z*B*6>6$}zgX9{g< z=sp_Hlkl@tqpXDAm%oC&J7b_Lqv{tG8#6FO)9o)1gu&GbiL`vd?%TgVlA+;??-L_h+ zf3N%p=v<0w_e6RCAN1=jnMwiTGX`i?Tk-FWp~x-`&SAzPegiL;YFBHT6mARlkYj=x-j}*6kw8 zN>TkvK$-Ar3Y$7HT9ZTO<>smGJo)pSALHOo%dW z=Jqy0>E~^N!^l5w6WIQ8oA4i8CcxxjXs=M5`U9ff>>Hhy-;nLjki)K)bSI169pX0Q zz6l;xd05=VHHWpMwQ|9quOUU2vVMu;(ipUXDbia&9BpuQu^*Nsx4aP{b*%7lv|HVg z=&8CVR=~XnWsuXQ!ATtrn4XcOlAe)E20Me7G?ksEVOU4k@Ey~S;RPtCaCcbCi?*sOuI!$+g{H}*5sC)0Kc98r?2$v-yKj;yd z6neYL?B=`6cZx8-k3ug8_pFhz;rC5cfqT{<%Crk3pKWbiANgQ=j2Ah1Qh3=~8uH(7 z={&MEP;Q|RArrM;9|;b7Rv;gwq4G)H%Tj^&q5;~z?WMpK@*E9jn zs$HE+cb~AMI$Ot-a%o&A{adV_evyZ1uk{kj4NnL@lqMr5Nb@^o<}<&=Zj9S`g z$uQfd@MH3E8)#>ZzqPX#{>9Gfdh*-OdMju3;uO0&J2%el%8>BNro@v%0mn=TBmNKw>E;aDs9?W! zo!dnVLjd$MsOY(Q0Z|7MKSRinOH(3?1%R5*kUT;-Q$got$aZvnuWryp)XLtH4!`nG1~CS00Nxxvz(n*?R+b z*)tE&SM}lI`ytpC(e?S9D&R@I^jtfQ&XK9YQF+`9^FB{^K}*5L9Cc2GUfl!3{6{x; zzKn+OS~%g>7ie$f@^+|NYg})4q=Y5W>kKlR2~|d~l*Q++Zo(cgy)<0A;quAscIB3D z?kVMzuZcTu)gxC3Y+$`&yLQBjTGMa|f2kKN+xX3G@(G^gT3yiUlu}!uD_L(?2iCPc zzu{y3Y&`5i(?IXi;?=E`VbUu9I|(%FZy0LV$mAZ;wYicY`l76art~R0rezQ^E!e*z}9uE%Qtd8~m=aNsS;35=brKoL`DYInit2q~oV%=-N z-D=GpL(Qx~)$4j?2ktblQ6T1xxBP3!=0lTnYn_*gMD%nZIIy(AR=|nnK<(;5QsXl9 za@yn%3#Eg0UF5Z-pcFe~1|AB{nZHw#$a(x!lI)RUvbcJT=p~yIDES|Mc2!U?F-Hxr ze8;+LK}@0@sKLYwJs0a(9Mg>M!_NKjc1K_#=uwTFM*GQ&j}Z1H#m8ZTB;}njzc6Oe@^Bk4l?kMQC_HW2AH>^Q*TH;rK z9K$y%B`dnf%@ztJxTn+o72S_3KM7TZk)V1REx?EEE|1}2R;ADw27fV@=Ka|q9TgW! zI_eGuDc(a1O&EGuwHIina6zYQU)^$!cQ z<&Qj{EwFGiW%%6f;Wdx@g*6ehor8=RNCfeLb~gwM`;8u*fw#$l52?Ng^oYjZ3`0Ym zFE;I-V{GQ-7u9b}s8if)?@sxjTeIu2#_HK@zxD{E4j#k4%y2!!^U3 zrI>O2gyP;L+j;Ut|0HZ^nhdIdg0}MEhdx0m98KYa8vBx&guqhfxWHxhxINAutV{tw z+!R6t^ZBSctu~GDd@7j7zI9;c-Lw$eMA={^>TqXPOa==}reBH_uu;krDDEBBrSVmh~t+i;T>)B6qBIZc^RJF~yd| zrw?3+o)aN%X~8R=sg_7ED9-QQ4TMKQT>9@yrI(X_i_JC%OByjtfRCYkr0SM?rb z*_v3%0;mh}K$n}iqx>Fcfw5lU$dL(em4y8QP=Vo{s!EgXhx868u)=(Lh~5#!7J)ssoP=INybG0OXz! zYM}it)CVPFXvlTg3XrFT3L<2z0e-Yla`11{X`x(T?Q578Y6GtZ2-88S2`UdqU$+z9 zW|!)z6VlREB}<2tjRDSS2pNLWA)qo15hREh{gqxSD2W*Z(@U0H^Gq4eK*}`OUq1!z z&w$z%#e@l*%6n7$<9GRYr#BV9x)vA(dp$Kv@l@OsmY$5m@mY+4|q{mOTYxq~iKkIEJ%GnMT$ zYO&gwuTtO^+xkOb_+41z6fWTZC9g@r=D?Ltc+s-Px7CC>;-B>zu~idglC* zh3W+f?$mD7g`~PL@gTk|bB2^#0@YU-)D(eKvHG))X=ODHP6147YQQ{ z@BDeLrR_`ng$hGEs~ws0M^G#UDyVajJ8Wt=lqb-hA8loZi()nv z&NM6W2|?ft<|ys}A6$=LK@V!9CyBy60m&5{0+w)yh@*r?6-J0;9O2uQ3Q&n?JrPj= zRuFKVXsd_`@sU5MkKf(+(!CJ(sKD?F)3yu#4!>1(n6%s>;JTGXLQtdOnrX)0+9i6d zgway9cl&?|o?X+IX*a}cxuA>PIV`Ywa`nkXdA3HR=ed;IAm_#2pwGamXj57CLL55B zf!RpA$alQZJd>5*6U`6~_F=nL)Io-q>4}Sdi|`!ei*v>My?oIzSGe-Pw3jp^nk_9C ztG+DPEnwJ9Vd;;sTi_pIwJ54*QvQi&OnG?Pjz8PieQm z4ZDe4P?MAPa{*IHVA!q8U7$`gVQc!WBC?%z)-Esvfie+`SQ#i>TX?{;S$KT$u20*; z@~%>GVZx;XAW$e3!oVP4oeZG>RH0B**d(;+-4X@CZhoCGa|iavr_ZV$vYL%PiCmZB zjPzBKFUpxTJs0|BSUR}vvR9DoGKqFgI9g=Kb?y57+1}esB{JrU97+O3J`(x;v5G<*vut2rv-p*UW2-~98uFBgrcUWk!98=@6MgDliGmoGo=6 zhqP=0Dq0X$;%2F;9cSlyoiZe@?;k%h!Gb+32+FWa*nk)<2-nX|5*Xi-DHnz9{V1o( zOaPu@s$@Nw!_8s*SRH&b>>Cp^- z%F5~-DGyKU{0r7{+M6(k$|Z~7?raTj7sf9JpXBJ2Up=+ z$yMBOgHQZ)$8>3x3ByC3L|BptnUE3Nd2vy4ddwb4v;JCtW$ ztg9pR8QMl2zm_P>1)E$Yzv3IHzjqm{yftV-Iwtuo0^43bIcL?>!rCE-n3q%gPytTt zCBaiB`z~sJc7w{|eX>_z$q;snunvt}M+0LVmLgX0J*HIWE(}Zz%UgE-v?>0$-tFPe zuH`A5&N#r?Kt*is=U;`p>EuZjI@6T}_kM*PhM z%CguXd)Yv@tCz@?WTI0Wrn}R>Cc@Eu&eT4?!~H7e+dSbx;l@mag#t5yc#{DNJdkjITP|y ze189=0}kAX8dG1e{+xAQc6!~qET!3&zhZ8W(Gyv(6!TH0tF4d#BOL!QGK>u{JJkznn%E=ATUdneSaeeNIPrL;WX;+Uaa4Khd;zt8i55wE!+ zu$Lw2Df~ljX~B4@&8&~SBzlgGtGbS{9XZ{fxC~!&p$$;y-Q?za2E_MTF5Y#?d~(j9 zrA9jvKcKLltCN#D0ujknIIhKe%KRkdkx)^@O8@=Dc8!#jBHEmFmp7N-LS)$8=^pZP z`j(I6ld4}4tsLo~I~9AiM_np{=}KSNHZ4d9_haWR!d2kjEEA?Y* z!Y7h-2JC8|S;-_fEmz#OnSfnhsGX>E9+EJZWttssGj}_Ws`O_?K5E7MprG3C|Ki(<>n)%f~ucOf8b*^Y~hKR zwp}j>jcpaYeHn3)Byo|x9dn6P^)QLNfXi0V{EE-GNuHvSnSXz)&8sW9t@k9qkGH!| zMQ3Bt6k;zJfXs!rgIN4or|5=Fl>%3_-{y^$a*2JgH6PYyV`_{0Z^7cHTft(YG!nz- zHWdwuQLi0t)#3K|s796IUxLM~KLv|X(+@?N1@;SZJ=I&rfW6n?=~Pqb9vDyM`zcuT zeg2-!c>mVdUp_8TZv81z{Eo-3cq+xucxq!RYC?!FUA`+kMg`n^VfyH%iQpHQo0P(P zdPmDM10~d3+A#*Q(j%@0PirTaj}((7pV6>5sou)^y<@V{>k%B&9$aE>Kkj^*1j_pR za$PT~VW6zP!MB0|a|hVp4YO8|>qG8YAu8HZ?e=vtw3E`-%#B zGilCQ;Lau0M&DS!_S449jbwwg!MbxfL&y4N^Ph*ViIyRVS(qcYbz~Zv$VD#~exOud30OO0UIfctBgM@>p#hfY>+1QHolCWpJI>+K3 zrC)ZwZ3e0{V>c<<9emtzVvc)qD#Xlr6xCLejYr|yX3%*CHwCFZJ4gRYDsxwnd zhj!iGn?{tMeXH+}`K|9?_^Iz_`9t6D@Q1!Xu3J*~ z`9tS8G{#r)%PdEK5d+?S&6KNL&qL(`Boe2ad~k-an%-r;A&dzar!H* z5$f^MFSfmRjoeQ^HW0nqHNrg7A?rfcZ_cQ3c$=b-#o-hZ75A;C+!n7}<|4iFO>(N@ z%M3LJ(S*<=E!WQ7`-|2AGP6mH#ww|{kGfWr1!Z-m;74JW(sbcM-Y{_Sai@~ezV&LV z!Nmt-j@SY}_Oehd=%O++s^Sr_z?q z#<7N$i|rm^G1H%)?k8VT2uwD@Lz5@+;$~|Eo?7{wMYYXv7=2fC0ij{D3J8xJg%gUq_iOa1n+D=a+e&#k0 zqrLAz-Ws}I#_VT9xt7Ys|M`yn+MUrraS|5QfM-f(H;OqWT(?xN_iKxW*v6+H>ez&R z=^6*(7jRbh@x4H3lM>aBl^*V4>Jy3ZIa861xlcrI$eH?Vc16Vnnrb2l>ziQ5Gn!}7 zAJ0nTg5qsW&kx zK)*DtmiYx3jSYL|K)}d3KP5OIChPvjbdE~fQC{0RMS-nIYmoNm_->?oIr3xqt~X|^ zpzwRRmSRVu=f+Xv$(wUx9&-ozzBekn6_wxCC=I<}0F$a}gk<)6No0FC%)8ayrU&yJ zgV@D&8t0>bB1!RhrzgEasLUljbMK8_Dd{l(IleFB|Jo7|zW#el04KO5fLRI5Chy#Z zgHvK|;tg$9LidZeqatCazrr72b83+>(-}+8is;Rb}q5Dq2=cCBfWbRaq zK=NR4JEtr5m3+jeE^5+*u+dg4r0mm;h$KtkC8$05k~GKWEz3?st?~ueU&Q;~hWT$h@cfiFy3U-q`{lxRKrIgTiK#8=kwA0Yr7+Pm3XV+M zz+xp)m@Q5|rtIo9Ej`j#w zWMli_Rtxmrf~3D-Nxz?1G6uwwrk+@FAeMxlF6mF}SQ3F1x7>eJ+&$)*S#+pF332)FAQGXSy+&Yi-Fm7ck9e*ael$)>$FPL z&u!7)`S6B=i5{v-6S+Gp6)Pst8p6Hwq7thX+e43my%<@~K-rah5~(WF=p|~{Ns>0n zG=Y1}Ws2TIA$(<`h(d&m*54~5-9{+Vj%roq!J_|x(NQXUQRbm;`0>|u96POAM!1$c zy#t^5FS20XI`;naU>Mu`91LRv^Wy41y<2wH=R7oj2$4swZ@g*d<`TXZo8_Ci^y5+5 z`)kp?0j~_otwW4m*3nPDv0%l#w01r6p@3<*E6d+kFT3+_;9erU4lm+S>0-P@fFVo|xj0S;*zHtKg1gF`>~t8rreh!Yv0PEC9?Wo( z9b{u$j(t*^g~Ua2zE9uHgT-fJZV-zn93 zBD$Eg-hqJ1LqF(XGS(3*k z2014f5uIce2?VFgWOnY+kK=?RitM8iUR>5<;PWY;cF$z-b1I5h$YpBM@rh*^+Jt`C zmMbJ66gXfs>ic*cbtVWn2SNy8^OciNd=%f**t+SXw6RbO`p-)C6>#E}t~X{Kh7GdR zzmA7|huz%#b{&L(t^@4?-5jHYm)aLGT1;P?jKlROgGs$8u4@0qbzrpJ6$82stZc8^ z!gJUFTFU`ciStAavv&Nr`>gEhrH|fEo85DU&7!i1l(A6J_CY}fSpq^!U^=KE6E5%- zIp=qGrT&pl&&kn=HoJEhsQ}6E1585Mm&6oHgA?cWc2qr>;()mTp#b@#w+K&P zsi(>$5?@l+Pvh%p-@77LiJfL4i?zWb@D^FNvyFf6Z}rT6@S%FRDEKGD756ThLIp z&2H-t8p@I+t#=jh&%$UVm1id{ zrU2(*(|P6p!`WGdRpIXImX?-o5b2WcPU-IM?k;iC9intecS(15H`3i50#cqi!T(x& z?Y+;rI5(4Po`;Lc_Z#mR_7xi~!QQG!l%9LP6p7&36obK67i}uIhEOAh-=M-u>p0ne z7s$%V1Fy-$R^suMC|wIMaWyschxL!pcW#|bDT&X@S9$+IZ1mj0^Q$2du!;gFlGem% ztpHW;H}0dOz5s#u7Gv$a36S^{c?>aI_+jZPsEW9pb5sZqPyToh9-F-hcL_QeI%YGx zc5CYC5ZsI!+k{(16Wi1OH?3LbhJ9=zD43G`8cZpqTNSg$@B`oNidQn?j?>1^BU7X?vY?rUK+;04 zl)Iwndix33)C*+z$Ybfx%GjwwlnNcmV8;>%>wtnU%7fnBx=A{Y+qtA<@aF{M2*L~X zPpOy;ED{v8hp8eZt1Rp!n)lzZ?e$tce^D|3#s?$v2_o6AHqvUMy0;-XBV`_)JF zMcfnEVoUSe91`tfTFPvnH4{NBy>+&>a+Q|#A))aQy=^vwv5!R)r;;jE+$4##)VK`a z5jw!Qakm+7%y>haT>7N#4eyjk@n)=qI=S_o1#>zvV#&j~3mFimm(^O_bxd6pCVFFx z`&|lZdmz2(S&m~pvB5-=)cjNGb5}eV6mfiBGr66%5}y`1`4W_+ik<%(JBZ>Nnnnul zOmGyjoM046(^-^w)2;!VE?r+!2Vur#UQ@t(2ATjc7sX5zId>N&(q45zi{D=Lo2uDTcn~^s*Al-CSe`WK+v;FmP|p7arUw)-3p<+WZ<(Lp+u^qZuws__rk7&w+a!LP zwnWjoJrg()2{rFB+L%*Wq&(p~wlM@Sc(dH?3EY~VTk6An2mW|4fx+g8`GYr7Y1zX* zTJoM;#h>Tm7-r4s+T4@%&n%0;E%5hm9u-oGpj1w=nQuB=cPYJVqgePRw6u8ebLC+4 z)8cTi&Ef;g?d{lM=0Qrj0R(f)(dGeJcF6L;F@!z&KQS0*L6@XsQ&!JqgCDFtg_FCA zLpS5ZZWleU%pBO|`0Gmx-|zm%1L)MG0f)~tz{aF?OY!D^O5JI&lYvtAy3$yn)LorC zo_mx4%tkzAF6W%S!{wZ-D_KsU-(U;15c#x2(;J5yiu;^d9epbE!>49ECoSk@kn;Uf z8Kiu_W|beIU}Oa<-%H=g&r~^to9tcuMfP5@nQ}5vO)~6Ev@*b>5?nTpx+Ckm z)XM^E+IF0LHuH64mFaI;_U0Av$FkE`{r1ZD-+=R%MYalE!HnXw0ygIK8~8>L>Z?8l z_5m8GFkfC`D{H~1lHU^y3A!p8CP$WX>Rpv^N^UBtY$c8L;{=*zDg%^vR|WHmH5(LO z5TKRmFRZrCBtQh{C?ByW+Cu5i$v{eU(nqy1DXd(VBolmtb+10JKZr?n;O0#%*Pa<>rrRWMAI3@r3*5pAwq}4q@3WPlh3B~L zwc&1@k)R|<>xMN2B0yIujCia8aOv--c;tx^t&V_()58QPR9rylqR1mlMh_zl!~Ur6 zm_u#_f{1V`c*BM3vWEK{p4{u|0L(EiXLGs#*77~`RcOblCmr`(>b4M+3%3Jok(1On zPZzOh2lF%!5XLjII!O)wzR&8b{O0i#55?biTmDF6pdoB6_lD%k`Yi4ril;)XPW=SO z@$z^?qUB4cF#3Mm{H!kfRl2|16s>z=S#)Rp!tVXB^2beQoEK3}jrA#FAg${+%vr~& z9v3bpcDAG{FQtfCKZ=a5G2&F(w|tk9-8od|L!ya^I)tc%0ChO1MZyZBCE3nu^mxpl z@$2l;Hc`G~TEgz>Mrc%tID{dAJzbB>N_dE|9yseN^||0FhY5&`DNq0$CUI^VVQH5@pJDLQscXXZBjHN$kCCyF0s?x#Di7%0h`Na~_jYU_r zs2iHhpoZtIi_YAlgec1k(L=u`gb;q%L`fno4a12v0AH*viSnhR4%9!M2d&cye0lp$ z%ui{u{r;o$7exOsKo&VnBx2yCUr%PvR>sc|A}>lgF){SzC$fhsz9jVeu+8w}WMrC6 zxI|OQ$iHRV5utd`i9jVqo@mA|)~Lw`@Yr3u6AYY{>@sjZ*jik(o)|y9HDKZ3q*NmP z4SDfH?UEMvw6C1I!Pro2+gZUx3RqD@VpvhU-EpAQ0TzyVE=F0(*UH5KgjNz!ZpR9U zY>C0ykhFi<9!0*Wi1$ckxQ{$>83?H+&nhl-;($BvSKBsTF3p zSo4GxgXRK$N3#UPpC~3;eo0I%o$Br;UUq;%Frrv~qmfgl_N1N0O_ubp+7aH2CkNnS zz&cz?%~U4J9$8w5E(BICJ0KM^mplLWvT0go2sNQ+ss^n)`9=xwZ*y!8MHEorBvp=2 zX$7lkv4#b{p`+clNxjgQU{nDxnvBHvLA!iiAaK7d5Ii{E(x8G%Dx5%InSkp6tw-KJ zkalop_*~Yj_xl@DwT0$NNPv;t+*O%i>zE?Ew2Z{KOukRNpd>&_ZK3;sp`{u_p8aa8vK7#J@#M z{xuS!pptH}>EDvBWN8&Bq-%O<{{u5-dXGE|9ouy>YsQE^iL@DdA%fe*~ilhFN+8B zWzqiHm%cKVI?G&r9uZm0vi_9XseIi!G)@O`dyvOvd;4mi*jXu$ap~R=6;d3ar|ucYB24?Y`3Iuo8z29#4^VBtH(QRTK}A zOg1RlC;VUT)MqKE_W&rJ7*cC$4LzPtx6VK8+aFidE893}(^p%XSJ#70OmT9HPAOvj z%GWdZDNr|=2YtKuQ^^oW-Xyr5!frE1O`n0_D{KI1VdEUQb$gZ3ogN8UMh6184Pb>R z$$S#Zg_8Hz(!*-&`Du_l1M*rc&VCttG(ycM0oye}wr`^PyC{T|gSN)A6ko!w`OJA( zIO4DQzsq^hpdS<+hpz>7O~QmVF)6mCu+LUT4<|c>m-|EH{}~CEz;eES=0%D~Y}uR~ z;iv~(JGbkRDSux*73dI16QNWpj&N8i;V#_@Lr0Bnk5mdCF#6`?;~lbHac|{T3A3WUeTCsvR_o-3V-_9k%qv z%f^t@ijqfy(74mTK{0AzR!mMhN<$@xGKXfSyBx9T`+iD;z3%tV1a+BhKZpttlzI;i zAg=F+62TFH8Jjt_wG;Mo13GapEkl$2sY&LDP*!!H$dT^Zy81WSrUMw_ftQ@V=#z%3 z5YxP49L6@;=*wg1`EWkWYH2VF34M?8QrgB!C5hDWWq>@dsi;3W1at{}dD}kM;A4SQ zckJCYtc1zNZP?0`;(gde&TEp6(hjKZeM_ql5U zoWq)MTiK>$x}?Du5L%JTefIw1mawJJ8VbHCkt2dp;fIE9n^ zL>7I;z63}mkB@Tc9L>bnYJn+iri&2?sf;WMq9DsTJ^>4_0z*J-AeDY{>FiL#yy>zLvle$L(9B2c^;T|B}1O-rpPO`K*^&EvYY{3h>D|9`@E z1Qjf^t=^ZQrti~B(|4Q?&;*S7rlsNdN$C2)FN5KTTE%v6x9g`7YB=Uy7P!l`IB%w- zpQU}G+UtpPMpn`K_6pmnAcLB|u+hM#FSXu_Nd#;1uSvu}=ITKu!Hy+#Squy;LB-1w z%_k89f_jOcSx4rMx?FNj$6SAP@^hGX;tvLteSmB-hv{mZkEpU6CEL$>wE!+-Lsh6n zQ|Yt58_care&SkqCPj<65WKH-`^zpVTntvyhv{VJe~@7Re8PGe5M?Y1RD86540Nxl zmaQdy`8RiWHg*23u^u*><#3;!Y>8bvq{px+I|>B((Q1w35pYB#-EotJB>&-&P!`bj zTB*Z_w#R5uJpb6)NhO-jJms=)@>VD>6A#SBvk(Z}ac;tz!^;ABJHv4921s+;yG;}e zWK$q-hqONi3$}D#U;|4wQ&x5YCWe`{SHR*0 zR7&ZDF*ZLlT4AGrQ+^OkrLO=V(CIUi!Q8cpPkNKpTbW5U(At3|SpoP6^SwvvWYc_t z2U%i*t3;K6nOn@No*_lk&>GlfkmLLxE21VV^Egrn>a1ng=<9adqcfiztyXDOqOp= zVTSxH(gGKz)Pk{?LoJAin=l3f?hf$aa=)5-YRXssqnBej!%t$P5xS*5Z0su$61^4a zrOnF-<+M1{@oCH?Cq{&w@c|0rYD}q@3W@a`5W;e zliE8J6sI-##ltU7K;3Z^ZUMzN7;(x>@9Xb=ZDBG+^-beK9(@Zeh$Y>kpX<88qW}u& zNKbof>&iyx%{;+n|IO+}xl&uv2B7!@I)79HS45?t6%jgcMHIY9Jk=up3A6iQA|e-E z&|(8iG4XC^*rR`w@m6}q*x~{5PEpIrXqu4 zYOC;Zx>^}P?XokEzLE?{nlRp4a{!sQoiD0s&yE?s9pPn_oQ?)URbA4tNfn%hNb5B+ z#tBmia~M2i!b=E5|8D;c>DPY=Q^t+ZvD{R;huNtC=m zz)yl(q*>p15(xNBV4e=DWJd5ik?M%G!Usv6lt2BZnmLH_$C3!mEuqR9S1^Magd7Guj*m9WGVaVZ zGF#V7-F(k^VoFg(rQ!|I+L|%D8|f;-J+o`>(RKY%HOH-`UQM`d7%0r7aVyk!KV`-7s$Ks5nOm z={!4i8cRgX7I0Una3KdNI&5(y4Yy(vJv{K>s_me2w9^bL6=8P6<7gae48xYCWy;@S zy>Z(_rMteh$ELDMI*n}n_|k(JT!3q>OW;~d@R?86KrbA%X+sQF2@c|=6*4p7 zY}JLd_~y}x=tN6=X9j%JYZ+!uNe!~x`Ue^;r z(@>$rF6e}@xjHalf=lWhxlW(R#SSi``js#bP4XbrB?;x5YmG-L)_#A(rPniPY~>T* zIih15tvfyl4tZPk9G5a^M`y=bDF{7>oWmYQ$8;m)Qcqn~EOp0~LRPQNPBx84bMMx- zG()8eJ^pjKDppP$FDnATz=Yx~U^RJPw2dALwh}9Hp_lH^EGzGyrPd@FeU|heEfJqW z*Qpp#OGKs*8n0}21TA<`cLplUCxXduV)Yxn}PK}-D^QHLus*E?w$>_BokspE& z{%43ECN48PBj(Foq{{Cyy{^pH^twHfZj15cF2{~?crmQ95g}V@7xbLtNU;*%lAt6s zY_IYIgvF&HEud5nxH3H8EH7(paVs!DDZpVDU zTz1@%QsO@n*%u1G%j^xP|I zF^{f7hn;y@7%Q~OY)+&X1mbIk$8cGd%O!hBk?5{!+bSUEDQrog0Mg!i>K9%kP_{c< zzJ3%0@RxE!CpK;d`HULMO+}2_=4jfTmNBtFK7Q!O;@PaYW2e41N1F<}=Pw93Y432|eKaSn8KLyc(!wS+!yGt+E z<$BdfN!7tk6)r=)U4~LQ0jN63x(GrNhkrzRFE>>D9@HmU2y6x$UJo>A@Ej7>Q-J~B z&lZI2^^4X`^M^o%1Z#amYjN^s%Q8E z=Q8(!TDq!~2a=`GPa@(KC$==j0pi4njI%(T7_BwDmf8*gueY`Z8;z2p<&|l%4)^j{E z!uCuf!;Nf1zkmBO*^DXOkXv3nbgYPQWq?}sZ-31JMzEo+BGk_y2sj7uU8dsz z>+D98e|0!i|E{zD)!_^SbvQ;HY}W;FyNoT(Iy&8l)!_kd&vK@LnjTrBk3Nk4joJA);B**hE=S})8(zO1 zM5MO^5dC3GGMo;zO;Hz-Dui<1TtI5u*&n~OcrG#jd}xQCzOfDeDAcR=-bBF1?W{N)(u;CqvUq; zJ>PxCg<*@!hE5~PP{o|loVb(kLdTn7s3vywqB9?QqGROp!rg^6r5Nw=t-E2I+n@lf#re$_XOF0d}^ zrsWj5LfUt3Y}+;P4c+LAMLPuq#<2SbmKjO11{O)S^%?>hg{E6td06O?sKClQO&zH6 zZVCDCa>mcD8elm?eK>;Zn{>h~^e7h*u$-YvjR=^hV$pwltb6EZ8IH3w^dfi1ev!K~ zRkth$i*4g~GEawPv?d#VF zV=-uEnJsf_y=+Ud=3)tZyiKw0g^1eUNr!-K)(CTyp%)ns`G1k|Xm*b)pM%paw-r-Z z-{`%)ojQU1q=oB_wCECbYR_=L6rqfnHKsdtG}wIwD3JL)iRgYL`;=WjTC_!2uI|<_ zaEXeym927jibhk>F$a-p66`<)IV%=q%3QVSFf=fj5rjEFWfi!jY zB4Ciq4i=PLW}_G8E|a(zby>iPpv`Z^e+PTxMgAo7vTDT-SLXP?s#!PJ6=I^&Z+sJ_gSN0%Xi#%r99S1l#iAP!LEwFoI{F^ zr(3`sZ?dPT!7VQq;gRemXvfPLsKS*u$lF9B-oPTqyC^M>Wp=h7=Zj*@Hc08{c0dSR z@Ot$3@Bk>@^)WRf7uzd&$NsK$AF_34!@(ZL2F^Z~+#)$W-OR}J1`M*`T-J^b>47R? zA&^RVSgn73$;SCg%^jvIzG*Q0kkitriGVs4PezlksP|A1UEa|A z%V>NE(eK<1#W)tzY-ylL_S3RQVqT%|B!{%Q3;lNk>MD2pbuGwxdQ0mf%HnDAt|=lXaDb!I33L6BRoYS)d1K z18u^#s4%ip)$eI$Tvkx9Q(J1I8BW*^ zsem8*0nfG+o;Knl;|Lizn1*RVS3`A9ylLASWEk*Kr8)ePE?VMK!a5s{+VNp-HS-`% z0@P8?$=B=-12Qagan02dM&?7_bIph+3w!ITTyuHuvK+tGn(oz0cF2LL z3q&JfOQMcqH!^Q9F9L_F$UdsXX}s5_h1$&=;^8x4K&LhJMac)nT6c%fP1c%iL4i2k%S4NBZU zCaCYJXFHMEazFC8Q3a<+i%j~(Z$6)p)^{ZoX7u%b37$iICX^ZvlCAQGK50iZ)bXHb zDi$J%D})*UU{L&Bv!6^sR(;>~tDi_`w&~KI!H`yKIbjKE?fGZ1`Z9y4ZMk_uOG6l0 z6ZlW80O)}Z33;&oBACeE=1dERkl${n6_&y>-#X%JlVPf|3?`#RA%0Nj`C7mkb?$~i zN4xX?kLmw!ls=$@Isg9))90Ufv`1hC1f_)~QEVPc~I9Rx$uI z@wYY;|Y(H=FsVFAsuTV6|n zE$$L4{DAi>52rn@Y1f=8mhWp(0r+mBeh z+Gwqg<6pQA5V?*&wYIv;^HTDX9+-!|hv52X?pLlg2j*Fm5b`6XhlWQ-t4e|556pr* zm!^Wv03uep(1NqCAa@lMDeTJ`;S9nPdjNDPZ-|_cZIV^QP6nEL z(Sr1VY0jtTN1Hc3O#Ug>gq1h6w83ZO!kcg{C>=NRCw`t-vV!hi%I&RZD+nOMfAf4L z!f(}Tt3h!1cKQZMg+=n(6nWC|>oU8VEkv@!nsXhCv$Evb)j?nZb8N;?`JFBmf$f(< zeDs|XOJ$^^hBUZ>eHto*`*E946Q+W*@o7M%#~>}y=qG1sf!iZ7=3fUV&ybJZTrMPe zO|bQ?#ouVg0^B;3d>x<=!f7<;#FmfwhHB9%3Q=Z9*$Lj;X zbNd!WDhDwM`h!c=(v8{4$lEohq=#OFA77KF?}C-+{mj}t-mB|P7k&8d-SE3bs8-wORb8(TbBv-w`Y-&o{nwobY@~0 zsZb>5Rw)uQ^`tyXMuuu{ZYiQSLbpOR$6Ye*I`Zy?Cskq3lfUN+txk()q}Td5#b$)V zkl8z6`$*vt7u=!c3k_X3IDj})SV&|>DMz8gaxuCUj2sB9)OW-x=pMrbTQQ?hTB-_9 zM@U~-f<&RK5Efa}?73pL>6p}LF1Vo>m3YC2iVmo5)l^!Lz+Ogd%IdZDZ5qDhbb%di z(6SI_9$H1tq(Z3d@a3tRk;g`)Q#BMQO|atdDWS$>-7yK~QX#ie(J+DCjV2G2P4A-7u9^1mw?2*Hu z)Xu*QV`-bUA(GYMhN!KkT~VCak%)b)?eeAv>;VJ1P+$gxl?Wdcp(b~gG<$VZS$B`D}YWzF|Tl>n!*`1M3&VRcY8?-tKzy4C=bWW2i@G=mv0w*km0cM%=fmLRQxnKrhm095<(&CiwsSU8oJi>T`w^8C@ zXp|m>91E0;<;Xp37RHF>ZJo&Y6<^|pmONHIN5EoEnAqZ1m@lZZM1myc>UsVmlw&A_i^Orx z{VupWP_WjW7$wBpW=ZUcz$~*RI~#cj&@xs%i=^;dq<4r!^!@3Z9H3>)0caUJxWw}v zF}3MaF&tA1^F+}?Lie}-w@@`XyT*6MwqqnzvZke!TKr{{o4mnmK=+<$o<>hd^cdja(Dp-GlzM*=L^nlQr>ngbC%NVqCu)h-x#Wq&^=N6LuNe^yg1D~(wtWGA&y;?u@x=rBF zYFD(`Q})#j4i%*sP&|LxuJ>~sj>r(fo}og#lNV>%F=0FMb1 z6MW_>RSrxUHZj?Y-DM(rb72V9LUUN( z(q-7eZ3`1u{j&MYRQueZ^pug-eLMB?GsYx^O3L_J&oUB!d#a%>?Ew9MyVb7( zK^bjHbBkMRI=oGF!lo|1-%=vEL@9)=`u*=PiKb%}Fl-=HoWo3gF-O5#$!@!4$4G(- z@hJSf=rtHT1XFNE9>0|AL)&M7W-ym;{O0!)P({ z4ZBL>apXBExPNqXMuuJC)S(lr1Rc#z7wa81_^W%fLyp%!==u2sLJVn|kGZ}ODRN3KS#cjjQg+;2 zUCYR>Io2wuH;OlWzRCg6O3E)c?9n>eQn+G{TF~|^Is?)jV6`t?-rCe9eOD?dTTD+7 zI+qHmHsF|Wq8aI-<$fjnPf5w49=^8=Sd68bdjZ^tG?Oq#3#<^0kbzye zjczEOmz->a(1Wl3SWY{Dl%DsGB!2F@63apqP!f+-*s*9hLlH~f#~*siE~cgmCm{X}D2Wd?(Gn3`14`oY zK$7@WZT6`H2~w8}au}miali*Hf%s1lsF^%YRI4TEcJ&96j5AUkgBOI#$X9u5PM1ey z?Q)k#xo>Ob?qkW8Ojt|3}_cg=HupH-^RUkVFdcu6uN- zuUq~Zb~)7&g!uDMkUC`9cgqteL`Hjs{Ep-?H#vke;*$g6cv`TwdCf-?y*?vpoo!K_*5!x+T`s)l4GxU*DY9v9H;+GA*Q5 zm5^3s;nm47NdojM_}O%!6wr_0VRYKAJHMM(t@G`J?B!@VH5DLj7G$#;zWJ0z7fLJV z{3W;#{h_fdD9WzS&Cjqir@`o?!KK~HS91tD8Ci8sEW_YA9M|Gbdz(Chs=;&jNRe(2 znv^EOeG*U1z_-yMFD?mrYf*}}8_Q%f)QfYBHAM@-X&tL@^2967nzoxFAQ^LeSqgs` zd8kKuH<8`}h~Ce6X$G)JzGtJ~fUO^$Y8Zl#zc1Tl|D@LwlcXUaC7r*}OnjmH))uii zQIeqPD$apa`hrP(be39KUNU#sy98+{3&V;4&j0HF>Fkj7`q601Iy~CSW@hHwzVp*a z{1J1_taljkD?qaBes`kyHZn>g;d#3k^tA>U3|n))%%*;mGx~{>(sqlnv4F{xG(5uvO=Yy_5hYXDvLWbg?P&5SR(0kVxi18pNVmdfKa3`PoJvk@?~ z_9BeWBi$)uP2{GM39jY_Fl;E6lbt72)ibOa_fPjGtrY^@X6 zK5tD_*gOvPRoL(k*`+94%BKBbjV&m^=6ast_0tFk=9Q4m?Y*KS-_;b@So0r+{Kp1ShnRbZEe0&*B_@r9opx& z2QwTvXO3=uwqkW#!{3Zi+Qi$?MSkZ?(xnJK3{O8e;q9;iQvU4XAG~v(E(;~Lx94*6 zoOmaT*bw~8+DQ=Xo)}@R;iKj_F$P#Gid0Bjn7_kqXn9p5RH7XcX{kWW2TP!p`|6r%ka`Th7f%NZVE+d1EqB=f>@3cpQ;6Q53VU8#m*$=s8WHyl10%5H@I86=Q-9wnC_A$;F5uA^26ulY_5vlqF z>!=^S)<&mf#^}XqqVVc8u?1T)KVK|Frd=^c*G{TaRNJ@mL^X99tZK^S>Nh6;oJSM1 zafWBQd*s(D&BrKJ4y3qFD1vC3iNum7;2EIH2!o3wxWg+| zH6EwfDd1b!N5iOe`r`VK}+hhe>1W^zVftNd}C1;CRmvNofhB(hZGwJsA4)Ol*&ExlS*=KrfzrOOea zyB0eDZi_t^GYJ3Qh&^4$3aIm(;}Tw=E&1I-5eYMDAZ#9bJ@&2tijb7qJjmGAzx?;Sd+!ow_)A;!oy)i$2B+Sx) zmlO4Q>&W>FV_T`?`rXVEObg2JT+&QsYZ_xW zRr~D+7x}cY32-1PKu+EOq#+qyq#&8DB_MyehX^?YVW~?|VsVQJSShJinfa9XJ`!PERGm#C5N&q75nARK%TW?k z@d13R9J2$JMvct_fsAI!e62BCHr8szejR3M?D9bq>4%ZbFd4rXKt32Q&H>yy=d3T& zA3BOxL#WlOAv7X4+lqoqIXgCM$4dMXqX2a^+TS#5P*_V}Zyu8OF15kcN*Ju?xw(lGv=v$Cqu|1!z>?lfEzEHaR z6?RNZej&MuYTwM=ZY4&KQ|LMwcY|cHamu)EADmaxRBU}%t&=)hTd@pAVhkrLHl(fJ zZem0M3K?K0PKQHo2Bm7E?E^$tW8J4-<*KL;y?TFovT-@?$+mqg%9esHT@?0~VOB2e zh*U@*zGf~$(+xm093~0g7~u~w6?*S?m`}zybJY8ns*BlSB1taUmaUk@Ow*b|{0J%? z;o1pO2fq;u_d0~{aU?lmsd2`vFx2|EMW4EOFz*CFDgwTF85yK=3!<(S{n`^f1eVVk zI}L=>Ixmg=U=G`s#a6g~^?i2|fP&)a&r^ot&70t?6&wMT4AM8Tjxk0m(HUPXp^6|& z=&}=>!HKru?IzcE>Kx!8m&=Q&hw1i%D z04<@hm{8~;Zhp8z{sPuGhV_;@_NiZPk&Bl07;?SW(i@_`>9zDEBM+DSf$eHqg%`W1 zUAO<2CG;|RP^z0BAzQ#4_^AJ!w%{5@P*AuW#@`#Ys+xAr&Y+?n>pJsK2Ep|UH&rs& z4*<3H?8A1eTJyIO^p8cH*EF?*2+iX~GT|$Gg|FddIhUW%iNB_hi>uPe8N0$V47FJz zB{=5Hm|&-TPcExR2mH;YvpG(2nJLrXhoo23-=2o;y_A=kM2Y+N=_XW%@rYyQE*aIn zX_$scOJfafuMs~`QzC>TC3j}CKvQ`mqevvaT|mJHJT1)YwI(WPAHAFKoXU;-#XoC! zr(&DIqqw8`O*WMbRye|amSl&_P-8D?_bDl)Mr8huJ)mIUJN~;S)akUe^Wy0W{h6C* z{cyAHyMy5Fu+SRE1}0+F<#fIy(X>#JPY`S~iLy!ZaM>aucu`cj;ARWqgUR|t6M2tl z>Kk3|IG6u8e9nUftzlE{IS$X1R@q3e6TwMQDFBeVokEkcBt52I!9ylFB(X%1>5i6B z2Tbt_*1mr~$z=Gb;9Led_t~`fyj4_!*AE-w=W`Pu<9IgQzMRKl{cWrF2Iw81pv{|U zLfe)A+v4}<#Wp`HimojiO~j+Yy3tkkDL> zvjLyjY>N#E6InJebfJM;sbr*By4~w1PdqFJ&)%G5d%J_Z&#e;q{H-ehUjS!_T&@cC zMxDB=Qm?0iiqa>u&+Q3o%g+r^_6}nqy5CR+e6mewL8vlIrPbL zJSlZEuswo4(h~4~6vE4YR4okA#Z?lRWOH0=;(y|_5%MwSlf%vppPq)^{}q4mn*2;$ z+eE_#v@O}{bZSIj*K`d`>O<6T+W5M@Tr~z|8tp$)zjE>ah;wPsc}opG>_eu(DW2N~TUv56 zb9m722K{D(7Y(7QEu=d$;hXkbcTeP)6|?c*0MHpX%Xs)yXcz_#Z|wbK@=3<4{)x-Q&=vajyiyo^2h6 zG=K*Gz&}-pqs9YC!CjLm1lbT*9YI#& zh;GFUr7;2wjIQWjfc=tZsG!JS!{r&@`>I(kYtD&FB+T6a7tf&H%)(Z7zKDE|P(P;S%QgNZ>Re<>lLX!laVbtB)Q2Xzc1g%bw98^hJ% z&Di33@B0aYp+X^TyovPDm9-GuK0VS;m<%$d)sye5J`I@8Sn3n}`cdf8l1{Cl$`9%I z;@QoDNGY|=S((}e$096Mj;oE$c9Ew}9LC3F>Rn5)9h=ytqUXe47j?|Z zxK1>5M8yQ)2RfZ5(dVRr8GcB5HS6vI#ktI*`T5)Dr=})#P2eO~>)hs7`Uj%T_Pe93fHE8#S837@gk zXRYp<8=`kfb2w*`f12uI`0xn&K>pkg=K`25KU7WkCo>#mm&Mt@iJaYV3n2&QLYO39 zav`z6TnG)|>p!^=>sx9K&sQnWDnIAXkRr>8wL7`fBb`dumcU}vD*B5;zQ1POy(#lV zz^_s8d3eZ_52Pa^@`wV@;efbpKKaVl%oXKPbSJ{dw@NJl`~HZspOP~3G9v_!As*;x zc^=d?;>x}_%yjAaa2VE8Y-keX!6y=FL_)7_C+OPnBn!qtpXJPea1h zrT9=CCsrkIjsHZfj@XO0KRxV6I9OCh@}YR{_3?0k)I6h|44>oMxVafNXeTW>SD<>m z2tKZ^%c%mm93g2jYqH?Z?G^g98O^Dv3XFv9E{^(XjqsuhSYYNT;p9oh`*cf#PS|7; zh&w+nM_AixC+m(}LZl2`7C*RfZQ$Qq;2$Z?sKLC43NSWb5z*F&VBw^o2ql6-sujxh z{96l=r1S+Q>9hZ9EMx*03jw^=LfE(3qnb1^GmCw|KmPYxhzdzHs7X(jl&~e8*eG4y zeaZg2Q;*N*XQw(~4wLs=u4|Cc%0yT;&*7}TSG@h!!1^aeF4utiBZ*9?R_k_T|H7FV4QM71ewFF!d&h8b&WdKX0uNO9cN^p& zj$l%&u3L1YH6|wM2+$!P_mFDrpRLg=%rLHyI!7#aP@Tl#2FbfH5w?W+wg83OVzKnHiLVF8|7%;bz^Rq~Cr;$)eNJ;pFWdJv6Urm14Uvjr8`N$rCl(w-t?L2LnI& zQo@h6XqraH0sD5!CaUr0&a9Gl6*dz2Y%13$k@ZE2P4F2%8cj*lqgjQq^^J&kKhI?U zQXZs40dFD=*=*(Ba7)dA5-D@}MzF?|_~ipC79cqifmN#{nH;gUxe!kH0m~R7tCdo5 zowjXnT8|N&A-r1m(nZ%+M{?qE{zz6&y?Hj6)^=XN-TqKgH*Qw)3+&42q7+>{{U=f! zZSFrQ!4mhJ=!NvzJ-z^Wbb`;9=F6+d-aN-A=YAQE2tjx+Sic4c>&GK?#s^~kA%La- zh3ijPST%m-`lsR>dO=*jycDE`H7$ti=W2g5csTUR^%r{Oh^Yd({tqCoABgoAcKs*T zUvS@0UIqPv_5092y#EQp`nmsN{oj~huzow>?s?fBu9+BMZ@4n)zjOV|c7M74k>4P$ ze;4Y1;rdTM{x_~a?JWnPK$6eDsD2>d&%HlgsO*qTtM_xBV3)4t=Q6tvNVkmv(rw$k z>b3!!rZ9uKYCg^uv)&mkFTU+j;P)0_BF(~5PNh@2K|(;7(kY4vlkV>Bo`jTicXvsr`=4s95)&CAw|tQYZ@Kxi%rs;S6Lo)hFCwN=o_Xin?=e4zeq*a1Nvr(PmAGa zcuAZTzFOf{(9Ji)Z~I>T$BIG0h-z>UL9ObUJC1 zJgNK)<9O1~J@SVw^1@?!6cggl*&n6Rj-oDS6yT?o$>GK_*1RY|RDcVJ&!%6MFhTvq zh`_EyxH;KDLygMvXwaj?2Q==*EGQNGIpc6k$-kFf<_|>hb5q)QJ+pu@)v? zd9a$BYV#4*^EJjQdep|qdw|yO<~51fb;~j2gacf4`4h!Yz7oXhE*6So%)3xUUwXJ8 z2O&o`hEaYYppOo~<(TG|nYzPkXH3EsSzm8+e)^H`8sj(Ld=hR7Q#q-MIvP>I5FyFD&2n z^KRxq-O5cc$~G!FrXfp60)d!8V}G6u;+xvmZt--WwqEoE_*4Bxr<};`t+CtBbON`) zo|03Zv<7(l`VX+FazO&eiCW*L__DH{HBDw#29vOF_@9xqwC&|vmYE)$+B3}wwq!>+ zOr*$9Y~G!vH8*mB=F8Jxtj!r7NDfEFv|GfFK<~h zJd!bm3uIN&1*vH~C#MUaxS>_}R)e|5nRUzpn~JwNy70Z0ODWe8i%|`SHX0;)&i+b% zCLzeya;%Q#X(@T!D2T5ti##hLs(f1Gr?oMUb*4oPuNp0=sQhD?K6OuQU#cAfbzkb< zcMf~XF8bCv_G=rj6-vT^%pL60GQ`ji-3MhIl#iBb{MDDHLtFhE2!=y?5ItGq6&N{& z;h*mirtU_KebmE{^fhHpWfQ+!?_RkKN5hsb(Uk<`^Iv?rUfI0|PM#Sj?D{)u);p6= zmuzeKCCaTI<;F(|Rb(@(sDo_?(QrZHqr}U}N3Q}{K8V=CIt7q>>f)kLBer}lUg@kW zAGdEyHnq^ec@~sTh_xZur1&BtRtm;t;N4K^{3{f)lo4;S*JHAAed%5V7G zhG*dl@Ng{Aq5saR8{V_(l$AKK`X1S{F6zDxr5_`_7|K94T|rP+eHrSi3!gU@?U%(K zU{*xx)z(`(BR2JOPUt7Gq9;QpnIdauQ*_^(k?Q2e7vzLTQfBo=l+l!ZAB)r~KxRL} zbb+1Haodbg#3z>EQKhUKjntD}=%>)hfC%U_kde@@3SdF0_BAm#S~IG88PdW14_Gs{ z2uYyC9AIY)rdrd;3dU(1y>16HQnx?DdW4VS}J{$fN8!3Zy}`YU58sYGfj6 z8G_&UepN@kvYo;<9L!)RNE4NxKyoOx7z{9oosoSW*8BVn<9&Qd&<1PG$5Chb+u&sQ zNLNDR1h(sDYiX~GyhXxZx$?pv-Ev)+T*5J+K27gV(a*u z0k=(p`n&8gv#zCFGpi31jM=64#|vuOuOWA1Tv|THvu_a@SPYDJqmf_15>XMIw+o&O z@;T7b#x3qsO@a4X6Kdo!)r|+7l+YAw=w*$>C4#ZaD#2H=z{4Mz&HBNf+@I+!^AOS3 zua(k_FcDX#gq>qYJKH%rUMenhe+?#UQ*ehUQbZ_#U2c_L>OjO|R9;w!&6PC4iBx$OM|9AA^pSPUCQD5fpNS$o?5yGr;Nd@v5&UjEnY`TwZdQ;rMsU$f`GX3u}kp8uLX|22F5 zYxeyA&g@}Y8Z^N3ApP~=>jUH86CF&2_@+!jHhPK^a>t{XW`gYo}o`2{1pudBCJ=mAee2xDE z`@EEtUmt?~%ZFeeEKL>kPq5!HjwN0czR17{P-Z%$;Vn0 zj#vs|HYD$iS+sV+MQ8XuG7PF*Li%~lbZv?<0x1X*31O+8%K%N}y?@O=S*%jgB${TT z9rAJ4HH&grj>vwVyB~Xfal=A$W$|%TCz4my8*wat4u2(}wtolI_KR&d^h5Ccj-^(< z{Hg7q0ADtcJ;}dn`za5#{ZgQ|{~21_moQw_GY4k-B*q_V`{DJjvyChJAR^c2U7jRN zbKmQ51r^qQ;F6?7RjUG)kznqa9B(;{$E0W9c+0H3xMK}Ec8XP8|EiNhfzdE zI1fL`?*zqzd&wa8nSW7$OIs%y*?s0;_>lR}T{}0ZEO8ORgZ!bP|AhX1=&$IQJ-f;Z zg#HbBC^+4y%3UK4d-tJ#xWCmM;y5()|EUWN{ZWC?AJklG{C^MqcmE~ykF|aOkonjD zhGzbe24Cze-ZOvVq^Wxle;%P==z$8m0P;s7`E&Ol=Es{2iGxYrQlGCxfLxC9@07x+yt^byDltl`r2+)371bk>ze(?#jsa z*>I^8mefQ@9ce{3xVCp$;1zSl;Z)W$Eb~t$M_n=CG_NgJ>&(0K`rk$Ix^mc*A(CnG z%1OZ72$$x@U=+_Z*dEvQ?^L0X3|fYldhEanjU@iqe0Hz%7phn4jk&+M{tb%E6Y%Z0 z)52Wm#Jt&AY^IoEeT_{h$cqpH4rN~+I2#rX@6(PEU|2-~Cfb9^StNvNrmMfl5v-SE z8odv8?{cgr=`Gq3)R+p^EyUNnHh)8vw|_x#;)LHch=(}aUENy#^zxkD+l@|g6PV0; z%>dUUA5r*1xnv+0p37Y5uovWZqW-w&l>L+RGs!){&-r-#wr;5Xh7Jh2`gRLGNw4p6 zGn3|?!oo5hG_Tq8m;CYhe*`g-!~Ns)LwSB|D9=xq8D9CXJipOGQu;8I=chWq=lOU4 zo#!u&#s&S0&maB2`24N^i_hO@2j%&Diqmg+f#a@OOX~Iq`r+Y^K7*7at$qf>oLdQR z^yzb447feP;3xV=0?B7S@E??E_P=HCfGk&JeD*~i3jCj;1%B6m3jDV~fq(j-%@ru{ zN48o7WuUM>^!Lx%hnA>7*86)E)g$u?BtJ@Pl~R_dP{kyren4(I3Rzhlp5(ECH1;{- zCd`ZThF%>s2=<7jV)rn&Tqo}NzveM=xFq#4*&_JGunK}tq!P$tIQSZFg^&1H{MQ}v zt9-f_7~-fpH!3@c(OQKWV=%gQt2O*HB|Q;s&aj$H4&n3!r2X#~9q#-4mrukO4vAxL zVfLOl7cm^2__J~WK0gbAme%e*0+^$2YwnNF4;h(5A~J|}U{8ty517R#O18D8$KRqaE_ja=}FXl=Tu zL^|5^8Bg_aXPGbS(RT~Oa8dr3MsyD1t8ni!xg#7UxQeL#?dC?A>3H=6Ow7g?-BezG z{>|NHQ_fygCTbF!UxSp4b40#=@n!g%1;~Z*^~Z@s0^e;D^uXU=8mn!>XT~oBn+G`F zyG>_of%d`Si5W=_=o41eW<^|th3%)?8g#ktB`Y`^^$U-rElwW^T1-@W_QWbg7I;C| z^F&Z#X5D0JA~G*xBKH}ibF*I!uQm2#uPGsLgu}F6o?;_Ek|o_OYh$F_Ez|2_1X)#- zrdDax?Ws=c-;R7K``MCV`@v)(GUoW%yOC>+n0#%k_I?;pe`!bfMe#>B~?o$%#1T_`w&;qi9UhK1;tYD}w3AXYJ_M{zZm;Ia zC~He<$|}dTpL}6I17o7ldi@_vElO#W@T z&3CF(&bkfC6w3ph_UuQHLub@<Dz8Db4pYO4c^H|_oP@i2X zDB#PX@-$+HAD7%YB0f9HumMZ7`SqzlvIOZ+yjr}SE3(mXm2-UJqAlWeV#xyhb>eSq zk^~Kyx=E8-zogU9`n&b1ue;Up@%e1HT7VQ(54!D*U%!14r;k1O@i67m>2hd?D99DC z{%b9Y$B;_%S^LYLfL^u2-x7Q&Grd019&(_v4f$MCJvK*O08l~wo&fgG#|v{tv8KQz zl;m?LaM%b)L2jj+KIcpWwpKztb~g@}@x>XpeezrkX=TltJga}K|8hiChIyT$rdGX5 z>2$BVE2#CKJVIiCrRRF>Bf($9Cws`eJwy8ryai&knan0(*?_OGf`@no_+;^fwK4^= zUf47HCVTOIZ><-@YY_V0$~2G2SVZiV*vBkn6u&<96`i&<@q>eJG0${8zvkVxf3nBi zvgbCnRR>1${ab+WM7pK{%_H;sw*c>5Dih8eD`U>iW^Wrqd4K5N-zS{w?kbYGgYRU} z;C1KVxLUjupQb^KnO44aA<^AmCa?mR3D4RYqk+o=(>5eX!1KG%-|_WKl$*U|GNXG^ zfsmV*)6q|!*KdV(4xRcuUnF2wAx@`%k-gYThuI+7N_R4B5-lecRSb^%h^7Zhhk*59 zu7PHM#%F^2W`9F>-*4-@gM20gL|P|7rDgTJHoUu{A=}jODcLcW5gY@TJo_qY1zCMp zaM&oqn^C=-5Upx9UW?^#Hmtm@ZG`P*w69PB(DchV^FJ73}4_^rTk{_hVSXzdtFH5{bq8|u6fzB`WovI^`diJMDY-x)-wZN(mH zW~JO7Lf}GS8`)dx-077raG_A71;zsd*nH*_m*_8-FC^BYDNb|?gD5I|5s-hb#vFdo zP)<=CoAtk}b(+i5op6XMx|A=SmLw&dVAgrga)?_^Q%Eh!g3ShU%#9Fq)F{UI-dLyk zv-cff{SYU5sJsRgG5UEx zsKQJ@1&kcl{oENbx3rq_gY&?TXYR;vAry8kKIdfH?_htrMYnz6Ppy2)+Y!-Jh`8lS zx%d;?@tweADEHDp2)}JULi?NWkoP1D>rp?*Up?som*N)e16K)ON4>@5qQZZzvtaVH z%{nX(=~tC8dx)ez^TVYx6AZx^)-tGpfl%Nww%T77v*3ya?i zy?Os;7dDjNP1Nj_UUv=!O5K6YdsX_6*(s;)Yj^0AG?Rk$Dxlon*EjIS?-Dalu_puo z>u0o%HgBCB+z0~dr7=py=a|(pqCZqhjD09D=wpA=%C6t6G%+H4RIih^;UXLm$|L+y z1T!IF3S1Se|?_+94tmkEldsEt)jWs5)txt3alssM)}ttBbEw@-tJlT zl=ITzM@zU;)pJOAzf`7YPzZ5UvojgLSN_%b&;s?pDAPcde~4X6Xu~dYB*z&JO_n{{ z*R^5(J`h^`aIxIti`JMXDiXmUqrx=M>E~!tJb`FYSwvhsk*ue|B2o~+auk6Rg}Bfw z#!Uf=>oTDW46c;nfZf=~v`ctk39Yc4SLLEEZ{YytUwOz+Wy$tl`6t=_NBKwc#L?!d zG(n%bSN?m{5d94K`2gkr3beroW&WK3=HCfm{+$5k-|2z*hbsRnQ03q9QzBIPCsdLH zlz*c~`5m`Q&u#q+l?D1`#pKo5E1FCO914-+r4Pkdr2 zW~7X0H2Z~31hn|o$ZR7+jdP(b{$(<;-m#=rmVS%|$g>#*x9)!AJ;$}5h>vQsa>p>K zr_tkvQ-IN3!%Kx15L&*pqT`%`YKio~F6D+bM9x0B7?hI08S7Q2l9z@&Hst}ia|4)# zpezw>f~*Wv`PR{k=#n?>S6>ZY@x}lx{<;C(Y&@-);jci8pH-c;$wCe@T#wq& z@EdYEj+5$9#(Y-1&dTQ-dJIei zTtKIJf2{vm<{j7smU;I;Y-K(z@6FX?;3%#d{n1?FJNJr0he*EGdEUwF;{;$#I1Gn^ zxkn67uY}TSY+Qk9-lB_g9cpfaK&1+#--k)vqCZ~}8FNn}Kc87Lm~kFRT!%LQB?gWt z`?;f#UZ@QV&!rxyLO~xITn^!Gr?0x6#Y0p~GCEs2qb%JWxggEL{z>kS3KS89f>Qqe z|irh02*brq!MjA+ZVyZTHM@)ZV$`@Y=$hNqin%u}onO2Zcq4YvfvDgVHV!y=&M5W5Ze^?bBO z8YlX#26dY#8g@tt&>b{75*>;{QUQ(snkFa}?EB<;OsbFYwo0MoRse>;F~3MbL%-n3 zQ=6Jw`4?QT@>i$_oWXI3PFT++HYI{)=$|65xRjB}5NcFql7H{CZT zS>jqi0JuNz(vG3<&)vivT{(Z<Go?vTn+{YhPg`btib!My$G~eyv!_ww3$NklkNbu;R!VmQ}3$ zY}+t88R!$QMxEQ8+ZhNkreaL3Nst~)a9Rzs=Hb%_zJRU*SOBX4l{Kr7Cagt5eHdq$9>xCFX3)wukDdq$vkSr$Fj%W>E8NxJadc#+pw3BCpXz%-i-ql_- zaydSQaF2{2kdtRBj7zZo_>t+~U0|pdiG;OXSSm{$byibB>5G>fJ;TE}5`3@-Khmy) zN0;w*O!8T0;)@D9A%=s%6@Xm>(a1s8 z#B^awGo$oG=cEd*Zy`12c+v#HhKt_VY2$j~ov8Z>d$+4-5nGm7SAFewM=x=||_I}_~T{=F^8QxL_ zxiw20HgMe4`!Fc<3i>8e#D`am^@CFAv~DPK;?v~b1zv;~)5%*)2{>YfsKC*M?UMJB zAVEg~#M%)eU2eG0U@kn5-<&xX>ILwuuIJv;wAnq&B35}5q&Al4KU!9{!K#Ax2oeeW zGNHcxt+$Gz98H;xv^c>~_X1_@qEKnhgLJ?uNo}zCQr;oy)>#;50W%~L14NFRTbx2x z{RlQfD=LN1R(+$mU{UQ>omtQ42t5pJ&~T%U$COp^A>~(H*y%P$&06NKEHV`laZFQS zG|P&wZB+tNa=6I5BAM_)QqnVSA)7TaUL*tO$s-NZ?Oa(~Jyp1j-RmFrV#`bp_2p}I zryI{ExEyrZktDDnDmc+~C7{t;E=FfA6^Q2+M*j|NW+HMfP5x)9~8 zuAwq9;U@_dk8GA(kVzwX<5}c&%H&On{fHrHd1Q&f0^jC~|iddxRK5S*r(STz9U)lid9K4FD04C~}9n}u<+ zm8TC^(Ej2^c^xNOCJ3nVyUF1D6<^;Sy{mxVky`5%^Fk}yesFOLbolPKFLwU`mC$bx)o(>y4uf0+ zo@IkYn5R^@+^sDRbEG6Cc*OW@DzaE^XE1qJQY$5o-(GF6sv_wJS3#yY^Y+(EcZv4p zqI3bQCxRqS8>3J`(y&D_zmG9>2vM5G!r8V69v@2{Qn0)0Wp!pNXMN>m0XG7{; z`C{on{SPhwnU8x%Nbf2>J2O}+`J%S@yfYIJ1zP@M{C~ClSAQiP$|D?z(S7@AlVmXaq{*<+9cBSwKsTNHq>B*xvx9&2X0 zLyz42iNYQI!h}9vcae=x3%MWU!s#X($RdANciyrVn|N6~)8}7Fx=W0wevSZ-@Y!b_G&j;P>W z+wlj2HL_zQ8?Sx|kl0P07}sW`-TiZb!Rw95^fn`2v=ARRVGbNa%KPU4!z8w>*fji} z+eLw)4WT)6TW~H6hDgvY0P5e5cX}v|d{3HhNKK94TS$1Byt4NjYn*;7?9@r%ok6z% z%4FV89!pMn6LA^t@IXg;JqWb2Ebf$2zJP2Z)a2g@?&F0c2gM23TQ8ZYwZ5{wU+Hx* z;$Ml8?|2eu^4AzZ^glNPX{^qwc=gnQe{BKC_$6|b8g0x`jDyv}(O!aV@4Gh8@judkDw=)v*&_?R zY*+36PLVq7PWUYCbJGZ#r}-5FYb#EFnw) z;(yYOruQ%YP=n!?H0Sv2{wKr}{4&uc+`dJ2t^*>9uTDo*m>%8%=pQ$Y$0R?{J*=ts zbPsF{`yaYT4NCX08$8fGeV3p47UGvc+wfI0^@{g)&->ma8@G>4z(-f?Zs&5y(-&$6 zx6GDoL+I~FD7a?w%;Um9Z4}*mQAEM|fZf9gwR?((P^@j|r2pFHb;GSRZ)B={j+XNL zKj@xk$Joct_B{TcDw9*c$ij5-M>5xV0SefPldC^NWZGE3BiIs3|Rd8VSvoWi%OrGWp*l)nh!=oT%elw zL;aI4nTtMr<18QnFR3dsTh*=%r*2o#vdJlxK0*S8w7-LY#x?L!AS9~6Nc{HKORaP` zL}r|#@8~0jI@%T{lfH6<$|%|XlB!lB$b=kqx?db^OlC8w%Y72GE#C16$A0MXqo-ma z{#Ejsd(FYGREvS1!TxUGy`#h`m=M&86WK z3PE;>1Hzv}-4ov#mhwG>?m7vQ;ExkO6PT|vr{!xzd0`dK;L;9Ss|TgIYY8up>^(pHNSQtNPJVuB-yyjky4;(XBq=`oT5)c21nGjq7K|4OWP?fZpYj@y zW%N`ZDPvh8IHf1Uw`us_0vn>6#)L$WG2s_R{*{bj{xMM zj{u^o5IF_0tt`|_@(NUxg8L(3>5BQ7?|{|q#J93N-wMuu8UO>mt0BmyQo5___q=}$ zl=s(!L2m>}SMpeIkaF5-R~N#ELrTiw`Ql5;-RS1oQ&;PSjcUb#(7yUEZsM=d9?JXw zA4B`1?-mCoe?oicK<_`9eUZsSX5TsYC$rDt0W$ju1t!qHh4y4y{}$SN_Q_8W1EGB< z_dlV1B<6i+zhC}uq5Y|@tIKaP;)%peSKL#ZsM201Fz4>bmzZOi=}JFCAu*8=!p=po z7~V(jm{vt0qMpUMRK$6bo<$sx9W0JIO0$A#49VYsPeV=X1mT`$5xYbkitYRP$c?BC5x5UmzZ!Bdh#t{Km$&;(W`O>sWZ zMRd*BwsZb&`T2Orung?by%K;WD;9=tgO_Rj`-u^bY?u(~d$y&3$4yUvxBu>+!@xK( zL8I8FO@ox)pxX3u`Ock4to(3qP2WYrrTL;9?SH(xcnYtVym;!ykQpo&__Y{(Scs+v zlU@$i1FICF(SlyLGRa37X%m(BE5EtwsW3Kwlf!u?I@Vd|IVg<*wvHUCMO-Jve)HzU z*vGbPIie|%BLEeLv+L0>)_Gi3_{zAaJ=dLWM%X-Dfh}I~9G`LX+(V%h4_e|&%ZeF9 zLs&xy9%q6f*@r+I9*Zd@M)59|9j-&(X{fk!#AZ0y?O-4OoY78T$kJ-`2rClcl zh4DtN_%kCupq^IP68r0dxPqg`rg_=w^Fs?~UY)@k4)>ZyTwA6qTG7PXjETtNfh5)` zi5Go^W|g5yT-gfDHR0Cw5vMQNLqk=Tu4Qu?yeqLEaj^M`;pH&m7x*fxWxL*3#hF+z z^w?Y+6F>C(lSdr^i)W4Y-r{Ng_c;DF=sz>|oId8iGxo%P&)9!)-Dm6?4;lLi7Qb#Q z^su85=-=SPu_f{#o#g;$n`1x!TBms#c!nvt-Q!()krEEeaW)E5ynkIIJkUy8vx=m# zsV9E>@{VUf1=kluRdLVhS4RPyKFsVC!0A8t062Zkh%TEq-VdDqOauBor_YM*JN9Q! zHz?O#dY(UkOezN8^sk_tK9f0=)35y@<=}#c7-)yB71~a=d_nbZz?zMCDxVFy3 zEFPTdc3w{02>5dh8l{jSS>yci7%hCOXsZf*v`mTG{P#@9I|qGWMmNz`1(?x2{z6Mv zLf7gXF@^s)u`*zv7xGGpk%bo-KDgu8dwH;l85#$^!1W8DUhfA6>hlTj6b<`XD8Srcg9pseh{g7etFx$?af35Eq?N;I!}@qdOED9Iu85cIw^?X2KWzz_ zUm$&W89isH0=aW+!(+n z5v*T^<^@7DsH_29w-lCebU1lNt3{!)6&9 zur9gB(M#tD3R68BXpXKILoo=8_Q~YHrRaapu_A%)M zdnKUAXp5@iLlqhN1q(wB6RA;W;;7Rq^OHmFkm`iifEf7W$7km8{TJBT$nd=u@f>n{ zwpr#JNYjon%^yrTC^)PTvO25%3Q42IV91ABakxp=pDFh+Fz407-8xGc!`!c)PVTC~aii?)3I7b0RW+!b}Q}V4tsy zxG=if^`~c=kJO1Ue(3Fr@lZO02b9qeL9f+^zE`+f?Ij8*6n}?re_O_yJ@BGgauSDU zJGYoLJgGt`B{BX4Im?9gfOSFPH|6=)ZN^1G*zw$_m`9(dLGCL0N3;P@M4qsUgia^L zcE@wHP}S~+@fI-TDQpwb|1#v|p@#fKi9##lHC*V90B(rwcU%FlBc5B!HN>R$BkiN4 zMy4m{c7uUjJ)9O9m&d>Iiyb##--QVa4h}m}@fsLlJ#D^6d?8m#uu%1JlHxLg>I;24Qprr(!1h&BUrV|W~ap{g! zSC~YN@$4&}dO4+J1UY<8Z+ePL+t{7I!a_kAI&F@tRbQ9-`7!uN9YXgpV0ab+9iCkR zhG)%*d^LgLSwf#37n|oCAc<~P+$Fhzl49uc>`pnZxLf<#28%?fku#(*T zjdy4ZhFAmt0nWU7ikxouPhiZh@ONMgK=J4K(7^Zsioef`>FYl2hi$YrlJtcd=)oK> zpT^^0G>&ySct?|D@5Sese%pkgr;X6p@4w|hVU1|o_}JWc`E5S>&d==Mp?H%&P(0{G z`lgjy>xup(YPXT}0;p$YJJ}H7iMhIk>=IQ7Yj_?jG-5Is^Jkc-K7`wx8eClQ=fw5cJGWQ zZu_VGNt(<`PD0g>@PlV$r_+x?FeFNL*6`j-@6sDgoL2Ev;$Ya`J9BgJ<@rTDRX zDW3gaihs@Jg~Kl+X28^vhA?Vu1Z$}_3RjLpg^?G3vF;%DwCzdmNIk#k`#(~=?Y$Il z8PD(_#m_ewvK?{v&9bE&=17L@NpQEr@r9O@14lI$xr5f()I5DIu5|{yEv)X)GKa_< zrU^cupUFpE3sKhX2=MY-G%?UQ87QcXoyX=;v+dA}57b?D{@e3U-Smz#eD3<~LXLNf zpVnPuDcw)QdOpLdc?J+Md4AoXdR~x8N7Qz+j{|yGq(K7A%BnmbRaV0Ll;OJFy=~_j zlT61TXb5a?41~Z(y!Rn+(ELLP4EqiUfy=E>H(1Ck-L znVKxL7~6AwR9xE!E1F_F7cXcl(8Fp2Kgm+DlI!2R`0Y@sGrr&hVyLJFW?LF6_On2V zmw4YJvc#yQ;Ao$X!5H+4arnizp_y^3nlBStBdU(J5^-BWaI%HpQ>Vk)ShU!4qJWZ3 zarq=KX!T-h=u88D{CWvi&VJ`G+NGH`eB_cP{N@s|{f*b;g@hl%W?5B#L+0F5dfv%( zYAZI0tt6GA?|eof%?vXMsr}Mg4zzD$5HOs(iCh!J9mq^VB_@~*mylzj4?(exv;vUK7QDEP2;Cv zXqfP{I%k>oJAGMzV(1CC;|sZ3jEB9AJy<0M40jL|asP@GY_^v=`?wu@`245I4@QvF z26W@~b1&TSAO_@1^YU*?VB@s_uwUK-_6tcEierOaSAOE*t94f>{Spe$FKZuYoWxbV zq4Y~U9Olly&@b^@Sxc8N6J`MYvh#<2dE*C7Qy^ z&wB#G-vqc?gIJe`rvi$^^r~Z_ggZ{;Ddn*+!FDD}N)2&&mcjKCrr}~u@y}wdPOUk) zDJVV>#9=1}8PCb*T3>_qo!Sp0Xb(DSw#x8%g|rH)B|+xtbrO#+Y(Q#uiZ0#H_sZP~ zZmr!f_94YtT_j#!QvX7~oMmw|NFN71&@azbwaUMwhC}6-hR=?G{KDD1elNceoOE+R zCtj^LZ{P1K8?q$ANwo4qCtfiM%wabvwoth6LNSvBohKj?GGe3qPEK{vC9tfRAVb6N zzdt#fV3dli>v*BEmBK8dB;quyp6ltNlGkJF1(sx_J<4aBng$TGt z5)m0j*g@2TUCmYZf;%D?Ga$G#4!PjHVGbs^7u*wZ2kr%TLp+QPE@n$3nY7H6aZ+uR z9z0ucX^z~SS|?*qDth%{ys@fHe;B%Bjy?%MaC>#nQP?o=-(_?AZ+6b`E5 za8A9j9kvM+#C^*txV3%C*A5&Wn0772-d7(?S~N@I&3Uj)LFkyeN=_m}&m_*H(S2?Q z7Dy`0>N;ciA1g-`_|hWfvF8k@$Si!L?Wj9ao6dJ*oSe~ zE=4C0blp|=1Ok{ZNv%-xr6V5~YQE&r?$auZ0Yz{18o@>I@#+A=_YF;$NLcK`8Gak= z!>}Yof6kObzhUR=J6x~fKVVKnT&7fCntdAZ|H$A5Oyh2AK z1GeLj%2T4ELyD2v{xDrg^xkXb=eemujl0j@***rXzFF?pY?+xh@j~yFswHK8Y0YxW z6D$p(u<2K2?UPd7{Z+Jalq<>h(vBV`Qp*!cL)9l!6bzFw&!i2LPqNOWL6~?N_QtG?gXWE<(afX!X_Rm_+I{eTXJ=_G>K~bI^%lMF zhg`iTtaYXBFYOMhOlEdn35qJju4fx_NoMkF1tnwuGTAx*nCuy!S45m6jA3tN8C#F) z?K_Famr9TWoi9L9_u@s+3s-rj^1vFUdl6tXD}r^lNmQ z?S~rvJmxQ{Pp14{_UpztQ~S)c=Lp)w8$J8{JcQ{3D7n`Q&c)kuH2UYIXdx+3>6XT0 z1cqFZ_5tw41ul#(DFbPz%j9AVqfcue0AK0~dk`_y=!GH4WJemJ4@0gL#kk76AA|m5 z$o1@g$kihC-@q5wzrYt{=#J~lUTIJmAij{_i!azv@#SY-#$n?c9?sYz6nr7Vjl@)W zhYqkzWQy@=Dz$U?wh-`}t531VkqxH!8!*8nTITPS>VFPT{x#&f^%wXuW3Bu! zmtM|24%WPeDQCRY2c}%*sir5NA$5u$R6_weg3#(oj+pvRx)eTgd0e2;i~ ztjYWp1M?~c8p6Q2mj+hkmd zbdV2p?Z%&SlLpAXZp!EN8}dCbb(^WPk+&xdNR*$P@=NU3KFWfpSa^m`-AnPSK)>O1 zq9MSzd2UuGv2~C|VqpGuM}MCE0B7)~?9;mM^ZxAKFW{?4phLMY$+C}qW3zt^yCTv5 zvV^JD#r^UK)9=9hphKytJ5&Nk8sz4peXZ=Z@}+m-BgNi3+qyH@xVhRI&-2~>kc z6o}V=t-j6-+YBP?S%kDAdR=WP!5$!+9NsCxHh*BNsd2w>W`*4Rv%K1Y)U<9s@XPoz zAIEFoITQ>|FThg#7-v0Ex4r08bRlTgkuEYby*1fCHRd?oJ7zRJ^Zxvtahnv>ufY5m zZ{D?3=x>hk%6&jJdQCFUy7z&9E-@1-`m#zC#uFoKDVhvz~(B)Xuwv)fOK zNnr}5R=x*X0`GyAEGB%Z@fXA3oH?S>hZ0>P2CjO;yo! zno0O)j#bydTxZusgEWcy?TS_aHd_#Mj+M2t13$6x?UzMFvlt%BBNdq zn&T@w-Ve;Nl0fHJ5ukIdijC5Ge&q{)-L~13k3Hw1s3f}W7^QI z*3eBv<@7mII5s$fpCwC(1V5{Rt=58Zy$08)3g_MO}}ch{mFN zECEJ)s6dvP%^YU^$Ryyts3LQI0{PFFjTwJFI6c*?YYbG(A6fEQFCK#Ib=Z3hsiST8 z0r1O5&$I8{j9Lb^0{OZp4Lr_1tu|3ZzF4*_5DO5hpj_GICQx>GP6YDeN1ebh?olxru1WG{3sf} zx2~0gigvaYZ=zV-?uS%CI99(PTv!_#rg3}X3Z}eSHBZ}&8EJKZA=MJnVcmLPU`Uny z`r8rxefJs|Qr&xz`mf#V*4Gc+YeVCQ?)B(7YM|;r-Rl>nK=&FSc$NcnuMvRmwH!DO z^w7Q5xbI#gWc=w~S4Z70Y}H`l)!E z-gmEKxBk!F>oA``-RliL(Et1H^~|5{b?D3gse7FV8?2OuO<(=Lcdr3K9cdR3)B`~O zL-!ggr~}<=FZ_QO)c>V>P4sL=#?7-2=wA2yKkQz&L%Y{fGuEBe+|I8x6lMwxEnV3p z@-0Av(ZKsVwtSjgO;u)&CJO6krG#X-!N{iHwqy3+Pgn$CXR)u^7!~$Kh1ua__@{%V zHDWTvHlNKY@#j`=WuZ0Ypqk%RKZ_Ic&EA{Rd8A;=o&MA|^~=66*X(i4^sXSfiKJ%u z#}GgL1imO$N9Tl`m&T=YfVb{ub{W!T4b}pMG~R_vuoaz1|L7WgyAiPEG`Khm+ka&E z2V8&tH@HsH!;%XH*Ez!ffa`T3Ss9JmRtLKd?wN9=Ro|j`JoPR(+M0eSD|$Y2ILWwu zyf>TS%FGby2EKH;;;Ic)bA5cyQldbV5@a`eHxhXjqRt`*Vva%GD7n>Gdg82okZzmk zzT&!t^0<}3VdwiJMH+Sm2GnD7d|8w1ngC}6(@7}}or6{-r}XyCqtF9&I z_u#s(V1sg%^uO1xqqF{}+I8p#w08Zcbq$I^d-Zqi`i0v=?KB`)gha(Rnl-p zqC8v0mr5 zE6i{_u#GAgFSR*PdWPTV=UCV*vLYSH$~mc449VL5XBrh#yC9$VuW8gk)-0qt(9fz^ zeu#n;j7olLtYl1+6rz#zDljRB-vE1!cN~)ey{+FYqyiPeo zVWNyJ1(VD?$2;myG|ip5H6@9E0&hQmQhJza|CD@C`dz`AE}Q7@0iZ|yL+idr?RnUY zRQu)}tAL5oG8@EoP|Q{HQjveG<3y9|3_!d`+Bh^L(iPd_)+$6p`kcg3{LSvL(FEOVEBuQ z8*ZBgagIoFl4#UK(<$fbJh!jGCjuMSCO^R^RVP&Zk)YrcHJ6S9(Is`~GxZzL`C=(PA5gDhn=gf`J8rBg+FZ^~#24p#kpzF=H_S(?!oNQhv_Gq< z`BSCSjzUrqbCWmYY6f(Zy@;z)no1M1U#N6!Z9O@;>N&A_>N0r(PCiD(290wpco1+g zN3#hOGP62u8SB0hkIQF~TwmIr;d?T~Y8*l?>Xy(Fyjeo&Yms!{p@!cFI@ErGcytQB z*1a7!uQLl-a>pVSO?E&k0$V@tlwq;yh~NJbyn-gIUi@7y7zW-nScki{=?jCFR!5(9syeBnkjykG2=kwh6 zbOO=V2T6ztgczGGFuALLU{&6Ch?9?Ak@RigQQv*|k!pic%=g~XUE z)q|cZKW7uXD)j7luX-i4>Xv{E+iKlYJinjm`2CZ;P6B4HH%7d%*S9>E@MT}yvG2v= z^9C)T@0`Q+I>dN<=+tis2QE{nFt5J(sHK_#34jy5TtORKJ@3U2=n6X+z)saq6!I@i zGxv0KQ9za;QoCMjgkpBSmJ8- zBiF_kW>%c3C&7fgB_z_;_YfVivP!zyrzxVuCaY4x;qbsPt5}A)GA5=5pD<651@#9Y z&f8c$DDQ}Y(S!>uRo#D+s=9!ssxCELE~PjH*N{cJq2P425I9{evHN$ry6E;TT`h74 zs=oX5Wz*Sm^@Rtw^&FsQmv&rC5cKz09eMchr?#FZy2WsxtwM=yJG9%V3FikWio-uw z_J=Bo7IGa?Sp-T9Pbx5=z!26yUwe)J9;*jcQghQI3}!~K6Y%ngD$^8FLg)|{lPqII zad#(+0(K3Ild@4xI<)cHxM5PnK604LK?hg6-#xN-&$D!Co_F==f-A6(y_r)<;_d%w zPF4R&z4Mnj74C0y>g}63RY7^%yZeAvl7tX02L%%TZ*wZ|U*=SHd*C2vvik=Qr10YJ zS1>oy9$c*Vkc;9 zoC?*BuirGHi;FsZxdq4P@ldI$|NLHC^NhJ6DQXAQBnnQ(*~qYj*&$e1pF+kSHNs2A zqk+aaod_UQ^j;@%z${_A{qPwjwZuorN0d~6@&54la9sdr zA4T%Pv49L5rgmonhpA^K?tlM_AvMRtvr10TJY!~Q&upsOmB@!f;N|R+?|=nO9avO^ z%mAd!t>P+MS4fc(Z(40<>fuY8Oz}o?E{$^U+O&xe&t@>qT8XMMq%aBy;9kpJTGQ>ur0O$Y*&&w6d^Hur(GcyZ;W(ZNoXc`x*)Eu@{ufw1 z|6a^b@TFElHL|GGtiew^GsGpVZn)52X1S0V8K8IED};1eU~)eH@k$o5n!;HOOfandCA zO7oQ+i)!C~j_6nl`mxNzr4`2sz&&^Ebhu|nN5}TFu7Jm$s1PLS`xS91avBgM#Ka9U zvjx7sj7pQ&W|4XjueL>px@!NF?Qzm2o@*Od_YA(C+d7Tk>>pnP=H^nJR;bw(1v3$5>w*2j( z?|@1wjJl=VqDi%EI~8Y8m|z>biI|VSbGYV!@R(bv1U|TGl^${iI{eAv?ENGUIjRG* zfG*e^BIZj*io`Yb*l+67{aYy17V0sV!OLdTLs|b}pl3b9l4<*rT^_;W?uo+l{3qv2 zmZ3mfR~w2%9qc-^2!=GEf*83CK5B6|Ioq1P1ANqK5ZlSyke$1Uv?^yOJ^V63VaDo zjE9|=`!sM2LF)MOUbQAN2%hvkqoLZh{Lf;&;HJ-kH5ks_-PmQU8Q1Z z%aoGW7E2g(=KRWDosVB`#3~WhbLyPNuq|Qido2`)?9O|9Z0&ZlfBq6P_;L;;x6u+} z?5;>Rn04sS6PvNoFipxdg2a8n2ZgmF<*IA07Q-<+| zLRkIa-Y+K|Nx8rn+&H`7B~154jD(@%Sv$P8(n+|H)Ql~TDQ+t1rwP%Y0gKLweJA`B z%LA%jBQmaBL(^*L`xk#q!yTxDaHag$o;;?`yQ_#e6%98r{&7@1upc1F?*wb!2!!w; zGI7?UYBo02!uHCa&Ee}Dg}x5CN?h0Y_LOMo;{!im$5JsZ@TRr|zCD+${|i|CODxDf zmx9N8rPG;I{y_N{?QTI`#M;57)oCjYmyBbWZI81VCcV=03wkAz4Sh0NbONib$ zCvRZ&phgq1zrgBK?)26r)@9e89b}Ptw1i<^>Q&OwlnL-%l|V1laWjWSf!VFJW5U}; zx-EO=*?kM~p2(}|NP!h!{mn!QrPOn8A4E;4558Y!cM=d{KnegHl9O<29tz=RT56!JtAWc7_?Q@9>1X&)~c>2!%q9m*jP^KtT{kg190) z%B&@d7*{a`&;Y%7)$l?#W- z62;GZuy$%Vx`5aV)r%?kLP3wdN%~>9dTBBG0uT7*WrxlJ>^!XvDLkrRLHVcil)jrh zhznHmt@6=&vM{5)?M->Qdj+TEJ(sr99@_70wof4Gtz&Y;x{`rj$Zh-CU^yZo$}--k+VlGu;(&A9tjzr&@4TMJXBpOtxnnQl5!a z!}_gfjukpBE%+v7ZW~iyn`brP3LJZHdFTj{7iSgwZO6(Jr}WCPrv9Wix4Wvq-CMc% z!w;Obg+I%Pqc;9nfcYc4bzX<}YgDMxQP?Tz$VBzaMT24QOcJxBxOBbUCT;9LAtMtyOJ)tFsjN?t#`T5+u{pYCM zy!GV%f~l8)>=VF|>Aj;oY|vB!8V!(1^-NAJZ~haUwV`@K8!N-d&zQxLt;)5(Y>AvE zdnlH^IxzWv84#fX^0r@sXVWac=jvP(YI zj+qhPi0eJqQyublMVIPL_jwqS9a_*SbaP~?-aDpk8^4IEjD3ao))Y2`Kh7-mW8*P} zC(K_s1>e=y-57Q2E$5uS|86G7tdvyr8vWsB$?$@pRkHe};}+I?qI zVVih)frFglCuJ7;H2P=r-X9H1yGDmf<;)32N%QTP(~(uWY#a^J=_h>eI=W4h(hHeu z`{^Z1Am~Svg8{u@VU9?o07qxZqafpiVD7r(QQa@Dp&$UPpsC%0WH#@s6`X+>{V)zBQuP;F{9?17sQszEQDWELU{a z0NPFjAo^u8E@%M}mx8!Qi}6AwRTuUxaox!bA3XSzMgA|aN$bGVqUUy9J8s0!?SFtx zxZPb$!C(^ul7A02shXjg=LCaIfbK(JvPqxMUt|*wFxe#jFS5y@Q4>B*GpU@!;f#@U zW>`Tb;y~h1cj&T}8^*S1GLEX}U-r@@>55ygT3OLb<+sT@I(-6{Nl_|rSrf|7rQqkZ zi`v;!&JeU1@tNbI?C^rSU!{Q2OutE(Gq+MAV5f z|7k15_%~ZA?g?V@o33>7i#of=DQGPjEdVHJM`s;*V4;U((Uj7;YHZQST%l2!eGH2h1Grj|5=g|F; zzz)&d39e~9y?@5^_6IfFki(W5`P0U7QEF_-rZ_T5_^~b8hcUikO@7nnY1N}^SNatD zJS9=V;5uF|`GNr0T~6~T)XPkCw3v4@f(9a39UA@bs<0oGqhwaZ-~>zTfvL@nm|t6I zCpFk9j#oZ=n*Hq;O(-4NzwD|&yOD_UIG_v7p*lu2-=%B~ut*+h9;u&d9~8)KLTrfk zb3TBO@XEQ#NT1eh`EKan8OR-S+>d}=xa2|Pd^nBQE(d)7-Zo69;GLUnmc6B4lGKzI zEgx7EqQ=}U*tOw-8Vtfe+RsZ+{Pw+w8{(gD~56y1ait5RkKf?P;hO5vlSPmzN6nJb_eD>O{#&;16V zLMt>jO#buK%81-FlHm7SIFT?-mfCPzgK3~MEAV^Me#F5K$aj+}UvWe}{EzT<=Q{+- zm_P5jb`2K!MS)SZb9)r=R?o<|N-6QbI`cgUI5jeM71iBmzD`lXXU`kyUQ6@H;LP&m zy9>p$*i1Orjc(B_>Ro##`rcnnr`5r|Ww$$z5KQNEn%2)$#22}jabjps`qG_AM}a*g zf_^Cn!;B*Zu)nj!B26(IAWeIN!Jg3eY`J@mldhm+jJNRiU$bmOk_pCly3csmW(=n( zXb(WxmY-6ys+CpF{>K5YHUni%6$ak+DtxW(z}8OW!2|9g#}x%qXx(0s-|lD|oP)mI zdp}D<(cuzp_TO)@Mouva`OE`Fh$1piKEoY79|W&^hQ+u+F}<4`e`T z`{Sj1{V1L5gsKx+Im7z??X+98%+03d|EQ5gh+-oBEI!xcee!U1SqXC;dCU)nZYU~Y zXU=Kne|zJDd;>+MqvIg|S!(e6mAY>c^dn1-3bdVp#)QMTBSmWyDN~m21=fSc9mu%e zM6*_EohO0lGtrnyKK<%?pP;ZGXOFr;Z^jW3p7?`35~mN*oMkd{6$b45oCn!|Lc@ah ztrR}EVvL?x2E}{=-xtcbzRmxO)YG$b6RVoqdWmDH1DpX_pA?<93@q#WRfpSG_+nI@ z{I$SiKW*^$4e=Eg)yG`Rf}CwQ->f5KUyHHHe?(AROlP&H8YX?;MbagJQrauc*ZM3RWu-5Bl3 z|9;})=qbss%6ad^WcUX-UAx9&R*3ieT=G1k8k7g+oh*f!wP>y`-v=Xk{-I0MeSGX zWi{QgcM0<}bQQC+_Ue`=K<{FbbK*db|4DIPEspi1S6LE4VK)gI(E%Le+p7=h63V^Y zV=|;#5us{&o^y!mx7s9Ndic&poMtgKR2Kz2oFEv&sTn-y?gkFc3=;YzTkk(NMt&ME z9E+YRQ!BT=>t<_#no9RGS*c{?$}kOZnsz1FB+$hlh6?L@d`y#bjIne#=zp}+${h(t zVxLWplmJb8>AM@Q_kW0Rg58GtMB3cSjGBm)5VU?|y9?#hf9OMV)BiM!)^F@}v@Qos zOy0i;8V)=Cwd8q6x-;gpplZ6+ZYRQa!EdL1x#2yqvGbB`%wUiBr{PS2d-aFQD0cA` zWWd-?qNQV2kNG{rj5Aj7pW>)B*M?#?Hr?`r)H}lF){qij*PCJWv>&hM?{3YD$HH$( zipQQM`c<9(x{h8tOwH>yPu$KxBrv;cVv+jxr!px%S3<99ZnTQlp#f$Ns7$XzQpbHH z@`E1H3=T%p8E^UIq}2DTk*$mosi58@Rlap`9&TJl-A#JS)E4?P3%A_lBJ1N%H;5i$ z9#P+G3;*maGixN27Ah{oj1$m&QE5|HlvprUzqj$_!{rr;Plh$=f0PiMY6c38R;E3> z*+T?v*BI=X19heOoI{twyl{;wxc&uj}H79g`+!S%j8kpe#L8l z9lwV*9yBSiVK|~+7dUm^6ah47D6C%t+(!a9&=5aR+f!6`Y?E{krygmv9!YI-&#+9L07+_n88WusyPGTjffgV@o*f^ zGOuglg(9j%`T(I5?5u*{SG@6xCAAc;Q!96f>!T;X+CQH?FczEO!3IQIrw*w;*9P_T zZzWZBS-nodOnp`P*{^dOX7c{v*W|=+L6om2%@_)MF_^1omLbEwno{I8%jQE#cru(c zQ?OIQ(pzEoDrlM2un-@}p6{XO)+b>!6Xp<0ZEc z#WHgBibUJZa+wD87RFw7Aw+Srr3~cwWB6$6Ht*&C&?q#^ZYdo?t{{xbtljv~SUaA4*c0Gmf(mrvd^4)(T#_TvP~G&JU7G z4WsOxN!GRK1!_?|V7au<_gv|@vr`B{Ts4Ia_WxkyKNh@!F_tKog^+KRx}T@)Uavl$ zWGt3{XKY6Gs0q*LVdyCuJ9Z*3PpBGuruP_XNKX2#v{?vzDl*GbZle!QmseW+<0bCC zMmv@@I@MQ?XQB9vqP9!Sah|+faZQq@8|F+*$m8_fWRL!BTdK4a!t_R&C~TKRzsR`w zTtE9*>w>SxbA0q=Pv((~?XYFY(ulH=JN>{NqfyP%%v zlyf83`ZSn&z2}y4caORo@$=Mt4CfAYhn;k~0$A`XYq;?7c#ZX9Z1y~dQ!0vZtR$L+ zAEiV;y1O`>`pbX?j%`y!FY}_s#}I9ZJrQdZ{CtbAdm>+^Z!U=m5#ii$Oly6ePLui7 zyK(35>E>zJ^q+b2ZZ#{^P!0>AJ>B4;NxgO_467=ES46bmvrg?)_@6?oacgQyEBe>v z= z^#i%wL$ePJI(v*AlH6l%U?7kZT(<5j>T>yp#q{r07P~#7NUB9C`Q8Mk1+|~ruMhmC zB76+MbX4ASsV@Sp`WqF*D|+iC%qtBKbjkv&O}YU=o?o-{>Wrr^J*hXlbwY7P^QU`r zg2_BGo>v_*8}?W2V_NnX2&wG=eI^Mz_MaseSkwmsZzmm*07@#K*QFIOTcUa^ea6+- zaert&pV6?IxEbIT^e@2GD!Fp{FgNdNxt1;iQ70hSPkY%iOkF!7GWv<>@ktZ5{ll!( z;LdoYk19`e7U^p;Fr&9&8;m9h7?>#ZYw%CWrUdp;_{S!D(wM%oz9+xkV*Z|Zlapth zE(M7oW$1Ra34*CO*Zf+}bUtHV?)9wkGx$=l^o}~<9to=6dc!K|n(TP63~}X_Txa?U zxOqPqy-h0A!RHfW>@}zx^f7KdEhw)b^fGfAde2+_vANh>uFl8*#j4n8`1%P1H%*76r>Z1daf zL32q(3Et>Tw~F@;xJ|u;8LF?z;0APnw$akLJG7iZ&>!cBC?wVyKBF-OUXq^){?YoQd7jkmU<~_%Ll3gUm7>t1H#`4>^ujG#qF>rv z@JS}nFywF+g#D#Gh1Q>HltB8y_zL6iWjQ^N-sGDFP4f@jBe{ys)L)f!P{&m{RwmJy z#_crsp$IRe1ui6%2%|5`Vh)&DoVT8l+1eM`;0$RHV8a;p^^gA<(;JwK(I8|0-%4p^ zvDg2ulqO5cz<5MYTJ4Ss(mVWF-pJXRG?CugClp>KPYv{x?T`LzfBx6{ybpSzk~&a= zgdV|A#ZC+3Xq!qhG=-Xz8#3Y`O@)BhclBH}9`7q7H_j@CTy=wAFC?|xp?~pQUI3rn z$FtJk+dujn?LS z!3mJ@ZbWBMprhFb$L5B;B4|!zk~(@`uMJ+D#4>Cc^dsN`;fw&dZ&4XKP>}UY_$8Hho=RUHk*eYgJ(1%MET2UINy$kIvX~w^&&hy6h zD1hCspXXG7m))#L%;~r^)gi|aCHpG2q3ucS3h^tbrwU>vcn$3ie4`|uG>Rydq|02Z5+I&&`=tA^4w z0LH5QY3e}`24mIe%kYp@2QLz(Dmx~*-ocnyRnY{7ShMQL4b?b_u4TJ0u#TidYPyGfK zfdR<~-fLJYrw#}s0$3GO`q_kHOQ$S90>{8jIdxI!^GI+}j$`B@|`CtRtpz$RaGP3$zv2@>#*|HR0WRawiTF>R1aFtgY6 zEYLz6&O30cr5ld9Jugj+A5YRvAuUR9O!}!cs^06S_0C|*bPKT(Wcee@-vUp+-s-qI zpIRH%l5Q%-xQ%hbwQ#0k-WhF^1tK}a(r7(6wCPoqq2mH24U9K>*vtN_st5eHuHM;J z6rCAf6N>waDPt*&b^+t_Apb;nV@b${$4H9*pubV!N}hgos7HxUAM(w2mDc*{p9l}c zIQ##Av=KyHnF&5je_B(x$kqB5`7$Bt9Ii^TRQMC|m?3(jo;p%K9L|-9V z=;0|zUWB7$}MgOt$YA6;>18!$cmZ^oG3_u++f&AnMu)i{EagM zNP7A6ze*HT=2xAC{EU!5P|9dJT=%|5;N{ho(}Mo^y^?td*wIuKrZvr}Puu#x_4Q63aYJB>`nJ<2oyctsu=cWsR(ps3Un2!7 z|4)$u)hBMvlY!)*c)N#PCQk_n7ENmQW^$rIKSxlV8N{OBB zU$dy;(0u3bIYAh@Xk=u)X~BGLa_^Md{ENM0uty>9Vd71yU$iPAZ5674K z=-K2GRk3=Mqv8Gm2l1br&54SM{~8(qzNH5KV`w0xKQKz6;lGv{m}_C$-2N}L@cvQ4 zlluQl3y(fUIth`Bxz6c@1NlddJ%1r%?1(RLkb>I>d#vFvwpt|$uzixvHcNTal{hg1 z#VX`JqMU`b9cOj9skjLVEl!Wq>pOdhN&yVGjPUnl|ho5MuboT-t8#~j&ZTnFC?0e&C44)g2 z+CBWWhY3I^8uc20UJCd8(PCYmf_Wt>%`6nmTR0PPffnl`IjnqfhLd{AMcgxfr4i zishU(Zu4cl9huxY3)RXBwVIMl?y%=ihM_DBOMH0$%R_~J)M1}_?x0Aue;lm`Q-y5I z$#{ATGPi$=*9E_9AIyTq>z(?JZ{l^jRm_7B`Bz!!`L^wi5l096WDH|llW#gxn}^|O&}b!f9hMVZ!54tB{-9e#C8uw}47I}HBjYMp9!I&I&$WbzIJw=SQMS8aTc2y{o319C)kv7(< znHF)Jq&M`mXtwU+gB#Iz(SI?Q&l`zizrB)-b{_?Y=)UH? z-~32hsStcPvvvP#hHt_~vG(OW9_=2w^tpUsi7egf-m%Xx zBzKzA{vcMTgq0n;U;0e3Y)jphDPzGIBFmu$`X>4`!b$^U}3Tjl4mb4=L z(w4-l4PN{EpK*a_Gs#Z{i!^X;->7?8r?z?=SWAq*QxIG46nA!uBEsN``y41$T2F+X zd|^%BN=9#^J^P4cF%~o-qoYnh6WiTuQP9<4Kpv}!tszjvT$S`*BvwUr`qluX7A-Rh z{3tJ!d5&`?LeFEM+P!Yyg`XNE+USHjmA7+1$%aEhJ-ixEM5G0y%Gv&)=txXhpCG1$ z#LVv^2iJo|fO*^1cE!x+K1iFAd8@_)>h8t&RET#SO8zKfQj^(2ABILtS4vDp_x?!a zhx^1k3aC;1PTvaculaP`#+)JUok6voz#3-Pq6AfavoP=Ak8#v~2xvJ5T1xQQI{E95 zgHJ1!!sz0BOz0iVH0V9dWavGD1h9SJywdx$)Ip5rMBL6Xid;$FDCV75xd0X@tA)oU zI7^tNEVs{CVksG>XSeZIj6H`K*3%Ee_z|q5;21(^5c+jyBZc?~+eZTU;&Q}2NHLJ? zD1Zz-2$k4RY!RB9iQ{iEx(^u$I10exWE(QpGri+Q7?FMP8bP6T9Ad8!{;p?;=&b5u!D1cLnyOIVCj{-Qb@lP0;l)JaSw?vi&HK|T`n{|Py za4g6P1pr2%W&HL~!O&hm-QTdcUxDPc%@V#msEI24SOv@A001gD0FVO?0KgnO+v3m! zNZxW5Mnzv{(vlKmYVG>M=s{?H0i0>$i}IK{qY~^bD{L;0wkpq-s5X7yDGbm#JUX(s zjHUX}yb12R;XcK$eTkknqk$tu@#Dmn{N^-tUG&Z`b(aVo?gE35 z){yRNJnHYZNjL&8=fk6EY-jXQs|cq&kMwr0gx+p()^U=lKz-l^CJOrYD*PFoWy*=P zCLPwN4`(_$!u|;ihJdiXmCA`8M?EdrUz|Iac`Ta#q!@bPeF;{0CFIYkd81GzYcoq_6W7(li%eo`04jqqL-wu4<+XE-*cV$$Rxn@?(}r*$uEXMy<1kn z1jhk1G7F(3FsX}$Rbal;#^}Lxon|ibcX=u1&E=vcSUtn3r?b--=O|wDIu(#O z59R~Q#HCfkT{wg<6hte>ex=-qr4?iH7A=jmWuMHvh_fnZq;J`HsyAmZV$PHox;#rW z;s2=yx7)Cxzx1puRV!}6H1}us)f4^#RwcV1E_wQ}zNvBkAsQ!vPY+j&`ENFP^j2vCf{d!a&g`};S&Tn{veg(`rVtQ~KVDb2@iqme*3@VGP z%{WnBdY6Kd%MS{#Z8H%hRAkI@@~0OJCe=^<0H_%zqq}JGo**N$wM2o063sZ^U#fZv;N`K5dMl;(rq5(Nd+K= zyaJ_C0dR31MA@^H`o2$fEIl!=7S?c3)_S~w-Bv+k;7@^V)!v4-k`P5=39yC5geC%0 zke#QD4A%;_P~EzcW65XvpMUuplIl<><+Fu0r`A+5eir@0L5jna8MJQe^^w0A7E;HT z965Aw1gQ{B1(3wXmz=rP$5nwx`vEJ4Qz#z3*t5say)lr~h6&tMTZ?VuGn$0?F(7?7 zisuTb=pF&GK|?9c$e8L))b!IM^!rHN*!l06c-4GRh%~pfHnGIXc_?}INlZJ)V~88I z{!kkh7pYoXlCv!ZVf+X0RS=bwON;u`A@qZDA=VJ+F7$q$n@L`Q{TsA++1K-EgxMJT zTkSu}8mkP3k9B9R!ka_FJRg_N*h+{3ZB>xd{l2CFGac`;$EeOfc57abcTjkVm?)`B z`h}WkvPQmSb*O%}AS5kB3MVUng-H*i!3u=3STW+{`5g7w|_~TWq&Q(Rihj zC{@N1y6Iz%&BsUzo-_;A3@V@_j9{iwzClVzTSscg7f&tQ;(fDxh)Grsz`7p~a%cc+ z2`-{J=))8mfaolZ+*wieM$o7|q)eXeh8KgUa=VO@pi~e!Q*+m<3FKY{V3c8Wy3yqB zJ$`V@oKd!iZD2d~_%mlg&{P{Jl433O@dZ$>cyV?)l6zag$s-U~w`}@(SAFm<#LWCH z7ht-Ami$x6nAm1<7Rv^tYYQNSL;)>Nfh#3Z&Z73=o#jGRBjVktj8siJx3145JBorw z)NGTe{1XxEnuJz*HFNm3C&)I=Juo#m^XMn8JuAP3e+ZHiJKHjHLi0$&q&sT!_~eILhV4a z$uEsXmCQAqG|!wEi2bAPzc5aWzb^8c_wJckK@XVIMK_X&Udn`v_DjsV?=jcdz`FD5k@nA!NfUgc*!i^JYGNx(H3 z>Bf+lwI$oWetHPIbivwlW=`Y!{{Bj6yRVZKsDl6<3ybi;$s1Kg^en!~ZKg8ocA-5X z;Ru{i5_SR*;!bNwTG9C*D~V&28@kWTefz=Fnc$tOZ&q;ta&rRc!0LYuLC89d6Eo#8L)UiXYUu;|#Ky zrKdzV{w({4N6mC}iuVa%9n<5atJV4It}(o&N_uNtzjbp8aAQ|i{!})lp54m8XZZ1; z_|B>qV^z~X7C>T9q(lrA4S_`Otl7Qu>fxH#<&o7jBhPbBM@yx`6E-BHuINL(y%n8) zqn<p z7ERD*A5v~9@Eif+ND8@k*KRF+n;e7{=Wfr2 zQFDAK7WRhNVXQxI@AhizoaAcZ`;xBk$zM!VG34hnue1lcb+8z(ByAwNSl8nPq)&oQ3Mm2l{E9}4$3^+a9e1g?-8t7r_3MU( z!Y>wK*!UWVvw}u=P{u174vtuCp5$@$CImdIS^Kz}uI1eCFG#(n46PutPvGZ2V?O=F z2I1&(nfx^};An>PJxeurEly|jHJ^<@Gxh~jSj8(&Fi4UeKt!M6PFmP7G_bC}cwEL^^mIP4!1R@AN%mgx5$mZO27q2*F(3>#8Vx7BMsr`ww84Z)HO zlkMJSu|OFHGCRP#E^uiL9t{f1zOylhdZL(a2H=|wP=l<+(!cKS7fF-`&u&4*betl7 zHjN7Guf(d#2vMihU#RAkTv+tQ9iE(?bJ%4Grm2Z!zuAZ;O!~l9q9vo0$&l;5aw4x= zCkyqq(0VWQNBa+SVl5mS=7X<}mhKLQmIu9FLAyAPS8yA!TO6I&Srjry*1V&y;hV5} zTsChHsICn_gEOf4=})cpdvZu<7te*saNPs}3!NX#JL917Q~(WMKMZgKj$4#EWC~&x(&AMGOEA zvOdQzJL6CnoFc4_$zYHp2Edj4+cC>MXn*r(eS4B%`|}*$jG2To#U%?vJ@cz}XF`A_ zGJ}O6NLL#`fqiHG>FUMvN+q8~msv!FUzj6W%e1l-55$-bAi(EKrF#q{_jc_WFN$By z>X}FL6_RFp;ZFO-hItPv<^rg2%#ti2T@cvr{>mL&5$~g+F|4zbZz-v>rTjQmZTk7h zp=thpa`E2!-NAsk8PX#=JI0M-Q~+ps9gQ7X&@ZdKO`o{Xu-R;f5X6`P{s%<{DQ5sM zfbGS$I<@JE+Gj(dtYlnq4x}UG2u;*`*_q+~CsMNSZ=&0U%*U@HSUjO}X_q8aa3w4- z@>Jqqq_eLO=w0Q_etH*KY%0_2)n_kK^b!P#n8;jS{TkVGeJg2hKqm>PZD!OgEI9BO z&3aA5ebX?qPB)7E)muyNXz6B~afGk}dU%J9%&@JPXqB|j>a9wJX(uH_u}Uz}9uIRQ zS0~CrQ6VX2`L4t^aj_rUKj|5-0oRopngX>YsEScLO^)0LjM^1 zC4-qijI(O5Qn;CbqE2Bia6B7L(Yn9o325Bd|XhQ(Z+Bsw?Sh42sC_;m2f8;qZq zTT4zK^N;^f!NeVxx0W^q79rkN)*U=q;o*{(Z@L+Hk03xl$q{z$|8(mo7+-fo>36(K z0EKh|$bb@QtSrCt;RT2B|FB$O4ljM9pVT=2?tS+Xni3CdP*|qC2#Jw=Nky!&svSxk z=r7A&oIY5H>n1%*s_yvX3*k@&?T8h%uk}a_h_Qz}-hWZP$Y;)VhQNuC*{A#V%Z*%R zG_|D7eyY%SKo6#(qgrqX)tF;QVz_O86y#K}sXL5Ru=B@g@OJ@BP_-bCeh&Z>{)ROH zj3X2tYX$8A!M`vPDZCM1I9Xl9QoRdixrp|%9IVf*k6K(iqy%=1+-onOM>>ka3(Za> z3WH~8YOX2x%hIvPJECootfLqqP8Riiq(lz+eF@6SKCSzA>+{jUYV4`m>lnxd=G?6Z zONDaE$$X3RHYko*dPgT8${j9ez?+VM_PlvxsXL`Bbwmy&NNT;-htVueCeTnfnl7(-E4c8#1*Ff4FyOL-msqDR8)Ys=4xIQpUn0Y zv)Y9TiIcfi+sLzAq%mr)S+kWCuk9({rUJ;^t5~z@eJ2eep;5>a8dn)BZKLzSq-l-C z*Ti0xyTL+6b_%D65Ncr+?P!=m&74| z4d=K3>7#V^%BM!?tW^t;t^j~ec!A4eR=nS^#yZ;s!0?l(_h(;V3ljN`)Yi70+hK-# z%My$h}~U?)Otd0qViSGTF{w3029ck@crcO%9EmqF5N_- z@OIP?ebd(O_47lWfmb09EWT`cYqQTQO46xc`a(?omV~I}q`tn7%`>ymRR3Axw+0`1 zg>k}I54S$<{4By6qfU-H5DXXa;3X|A;zs&oze+; zuB91p_8H>4SO>YiM#?`$b@pwJdx{?Wh0Xjk;?daa6xsftt+X^-{a|6=FN?F~GjOg?5bnpg_vl6;b z+ZkEJsALBjUcA5&H=7$FuybMB;;->tC_SxC3a|vUmB-5SOE@(o5{ZH9h->W6`SxF1 z*EDVjIdA0`Dp@*n?_S1=gZm4G}nzGrh0dw z#+)7--zjnG`5kl+P+KvH?fRnBjBNX}Phd3}!|!WuxcG=2>gW%#1PiwcjN+-m2ItT0 z2f}P%_F8@!o-l%C>3vSjlDDZ9Gpl%jz;6?&*3NKg8V51AuEfy!9`G1Tv-7NcD_gP!>^3ySMUO&W&c&xw`Oq8zqSD8RoNfKAnT@Nud46%!GmbUCm^f#{!aK3w0C}O zUcayck>H8^{(3odEG+-jE=o*xfZV;{s%RfQG}86S{qy zL>NZ;xD)6!75?X*zUSkh)ytT<1L@PmVy0l7Uz+u9D?7v7d%3M~=bdPi0MIHDIzC9r z7$A#HmRE3J%ar_AQBdxl0bCR$*ZcHR1gbO!U;`WS3C#EOq`N6zFc}=Q0;r}}q79_0$UfW!$x?sSQiAKKn6a?RehJE^Gg-JK-Wo5?+GkVUHj*J-E#J(_z2AH{* z&tl3G#JeeO>~{5)v-0Q0=NQEWryNtSgw$Vj5HDyNJ2^V8){C(|s*YOiO z4pHQG^mc`UGcLi#P%|6Z1pzA7MF;rR;a0=oC(>NWAjsq^fCj3h9~AQyfXOmiyt+fH zo;&B+zW9|zi`tS_MJ+642sN+hOREsL<>#~exO}5}cF;P2aP-|y2eVEQH2W1m{SGNU z^%C^^7(hUPcMo>1#6-;UH+Zo)SH1M;!>oV9cS~ivSE^M*0r8sv2%$0opf4r>P8J{G zO_sF)Er*WW;O@;p9&W@Shke3)xzQN~Q)W@+#C94X!AgW&YoF`19btZ3x{!2`&j^4C zQV~=>0^oSpeH(WVYA*)AdFhz~kU^}~XvC1ZAhl{VE*?oRY9`)=elMW4&s0XDSJ9!b zM@({5(=5KfW#r5mBPrqOK8ZkmCtjBt;z=G*Kx1&l;gl!#Dd-QVyBbXfk_QAi2Ecvq zZ%dt0+wZjsa%Mv(1x`~BCnzQSj@DG%j{ibHWdtu{=^75B-axrl%^m14azMyC(fG5k@uz22sb-!N z=BNr>{p`ZR<}|qyu}eRl;{*F0O=lyuilR4^%T>=a%JcFr9B@8y!C}aY>Y1&cq*tfI z5vg?Q-TN(1L!gJz>I7vFGA!N(!bmh9e`Z_VZlO-W!d<|ln6JGRdm3xzU~*p(oHfxX zSWJRbZ>QLa;)xn^$fb<2!p!3Fv?Md0C#a)C0E`?c+5iw>WB zs2#9|I?cZF1Ne!)lz6Sa&i5UiP8TJ5WV2yb*ltTD(xREkNB`Z)KZcSqThWA{=56q9 zsXkr^iaO)H5NMwEpd(}O=70P=hZ8_h7q%D(nBmOw2 z$(sU>EoLqpKQ7UOnvE2H|85>f z@BdXz)ts7(Q!`bkikn?rbaC6ge`~GhY5HSZ+mF(_qLqx@yQ1co?S^WbFEF---*Dva zmQ`LX2hC`(i;T|QiM`ho%!DA9{MFgF&X4JH9hK)mvf6eY=VoQZ<&}}p8SzA9Lq4$yI!#%R~+e{5INjKv@3K7s^bWyKQ_K{jDc?>hp5)tlSxGHj! zs%0!TR6Dx+X2jQQ^^FIe6`>)tsopBR55+C4!Y^e&fna+A=AcL-3K#zYie@U~G<~Ht zM+Vp$1yO*7nBLfFnYf<7xuHMRi<5SH!P|9e9Za6zdISUT8b2DhLU)Wx_;0E^z1VU%o10o#c3 zPWswclQqW^b1Gt{!f0@F`gJe7x^GII6HQ8jtdj)z>oQJvnb4HbsP0`x$p!mP#9i%` zO!H>gA4#`vR>jq43|lCY;WLI!W-FXtDl-yg;v*YeOunYoT3zN{&cH$59^XA&w6OxKi%7XR5h}s#PVr(;A)d=yM66j6nWpk_ zCoq|O4rFKwT( zh?XedR!3$a2CAo-_sNG;(y>ytbQlx++_{T@1q!jCAgwS{W>tr~k6dT9Y z&Dq7R`oFFm)=vC-68t}L)U8=*iy|%M5DLNe3yANWN~No;a|T!JXZkDL1pLk@iiE)& zC^sj3l~20*&RM8onH>sIXG!tn9u_y2iSxu`iY0(dEasK{3Z<@VF^4t=_OG4zuy4_)a# znGEPF3F!I|id78HxF7;;3LvhxmuF%n+3Tnutd=jED<%Y7?2rSw=Atnrl~~T1K3p{H(~sQg{?qP3)WEu90e#j61EYWOz$-?R*#M3M8-Zd0>5KfHb{gCfvQGCC^w0~bc(+>x4HKgU;N9aK&)|?T_U__D z#8+DGc|!;;Vw_@7Yy@svwb7aqe>=J6=*)t!X?@!3rRTtRb!NO|lz-bTH*e6o7(U@AE9gFy zZMf!U{Dz&S)v7M$1!8AG!oZ;lhy-lhM^7II>rh99<`o%^h^+tZPrSe`!6M#N?n><{ zoZUwfmQ26)v6c$O6P1gqA&g#@R?(;vm5uv}o2Nen%bD{T;lVA4ONVQP>p1HM+wufq zR@4>FZJ`+)gdmg$58?#TD@yF&K-X;CUYKA}Odp137yloNK*rD(fQU1w znE9`mGmcX(kCWNv=t?BbzKmp7Ldfi-<#?MAhRs*yj(c$#=gx_VCQLB&-gFS~aSjs) zPk3_gjx;A|mEQHN*i_=A8qCNzr?k=oq|afJP!yF!PHV$0WQNiibeud(7*8ow_>u4(He8NhI zD@uD%{oPL{eDqyf4eFa4B$1DjlXTWq#XhS2Qu9=jAPoG#0O7(PjSY_*0fQJIGH~06 zU#>d?C>h3vaqYk{RN7OLPRm3N}R}K6Wm&J8$C%qcP%UmAEO<`N#_SyS5^X_|?0fvO4+D90NtHVN zH}pk$-{HX>Z`QJb^d=Ccju@l1*cCFxyU1+sm0&AWZd!v)F)`P6l}R(Rvj3R{T4 zJ1r0ymdJs;UKpZhoEERP;5Ra@raun=#u6qabOd0831Z-KRBXQBs?!1=$S&mdbxowa zH}gZKvw>b!aRxn{r4bY;*j2F(MzFPi&9jMbZHHEOh#CwARw=M>p*?|nPRK>R$E}s= zqd%!(oMMN}Q;O)pxtZlhTlN651NV7PH`YyKEaSiIr~oMzJSa=cht~SMFd+z}lv;KplqT*033>hBcARVK*5dod#kyPzHzHp!)m`4x@6} z4}y_S81;+#xZ+ntBjp-;f|#3wg_BTJ)Ii7Z3gZ`UbYiI!f`UE)op}_ux)TiVb$F0& z7h94rQ(Q%9vt9LTSr~-FtEzmwCI+wZI!e>QOyIpIh#8DwTSwqSK{zc=mi=jE4RLnG zU_{NENapjNdXF)r*z50xh<7O;E@%mb?8HR(?G=~wzXQ+ZH7w5&(jjq&;f<89;h z48t$+p_AJnn~MFa? z`hfyGG@94&N9Mwh^u$n@E~7WE1c{X{cs%`{yTp8SA8)cO(jS8+dc2hd92X&}@lrU=chiO#BJmZfGKF@S z`eG8emh!jmd^%Uia(Bm}nLyq;hy}>N0dc=Alc*!u6kHrOlS^+3i_}p6Wxtm6S;t{X zk)yzBsAhJ{<;O*S?Zq6@8I20rqEC~%1gAD9lOd6z?_trT49B&`NkHtgBKfFCZ12s#Ex!vztFev{n8 z(LGKY=DAm&=*du(-=pW>}5(m2VZy0@I_+0`^}Vt>a*HU^*AMrl2d3Nt!+c z?!ZO^q52?t#z%dD__K2}a`+sggG#C`At~wk;9Tzmj zRR@;j!&#F)B^~Ds(9g?_DTlj_V_48W>fvN{&_fW5l0;OTh!T6lwgE-15!5ho%SQOK zUBG+=G{$G`w4;>7kmKF(fL<_|Z`#Mbj>q65xcBa-m(I$y(n5>ME1CsEFFjXe4ZLGh zhpF2cE?I-#v-Z0r9E2M{C}4v3ELt$5^Ncup=ajK!!xDzu2i9J0()6ejqNp!`Fc#OD zjT~i=@u(LIu%ai*?;`{(-sdQRyc7AG%{Cbm>sNI1O4f1iPaiS4>CxI%^|NbW={R-( zK`@9NYgfqRA^7CyAz(tL76}>nL(Izn`jF$m}GMcC2M^h~yxt_)d@fZ-nd70qus6>pvl6=)mvC@jYO&C(WY1@RsZM%A<*^T*Q}t>< z7KeMykA;7B4oegUTiYevbe0HUg&)1qro6R-}u!g_VUO~QdPr+U~+q;%m*AW^>Q9ViRr0Q9M z`CI$Pq2or?8I>>Iz{~ydiG*zhRv27O;nW`y6q(o7`Y?ZI>RS-A#=P?3F)1ZOnCkL0 z@}r`JuyuEU-6<=IqWWjB&ox2m2#ZSaMNy$PX8pcF4_o3af>+aK2YGr)S%1z??Yxg+!g4 z5nAzEs)jd+?l*}!A_~=~1+XDr3mY3-dAoCXnJf$WuUd^G_Q%K_jy`WbozoCs z-?89dA0&7+0jDM)JfrF3A11CaygrXXABc);*IB#%u6!0$mgEIMNr&w?D0#zzDRyNfgb zZPu}kgYFy8F`d`@lhiF~-adEna;&dZ>oc@iJ(mH}K1@>RAHdps5T4+7fnzk?9D^?? z(=wO?C+xylQddLBdj)tc7kZ(bu`>_pW1EsU*|p+6_OOC;!(KM;$}toBG7kpH1`vRl zK1>qy%O)O&bCQ;d<7i~IUS@#cH;Ddi2T}wj|4|i{XJbww*3(rK|JtLOb%Cy>y`7J+s7zQNDPU;Bd+&~FB^1Ba+7iqI}O8F~W!m(=&ObRWY3Cs**NNNd)jkoc=byUk)sWuA zsJv>Tbc*?0{u5+UJgGG0a`K8`Vk?wBf=R1IC#L%g&GIjVtS{%Ca7%U`aF*mMkw02e zwAzNWiXiAb-`f87l>qM{CYmU?91iAj`1fL7B&g+xPqC5WV@U zUn_j4d{*a~wuQt%`ynPNj5sZ@dI)h;&~RI^J^J;SwIlx6^pisi=|y(_fC~}I2t$N2 zC8>iZL0L>-4PS2)9ND>teZe9B&x_jV!tCv*v&zextOJ%+whYkm zoDaFxmg%i5;S$CI&a0@Ti%Kg4(n`rI5v8`pLGegj&Tz1;mfw=gS0m?$x8d=~rx7N8 zE#_;>`=nD}5m+kbz%fWdlrqB9p^nMHC$tytz>gzLb{MiEfb|5#2x(NkKE~t)IxRt* z2)ptjrLS55zhg`}m`@D=dJQH462zs#WfybX3S??QF7ridiHw;Hxnvb-zv+JpD0gAS zP9EbzZwu*4pXsK3g1Ev(E3JE?Ag*xinwg)bd8mX-3t0jp!-2)2ewrrfu(+S04L&Nh zTYW^@N}3XO$#Uk6a^}5$t5+ev$B>eX?pRh`-TPfGL+mhGXZw%MsYZaaT29&>+~IE6 zJ;~kA5e(f*=IX8ZTje_|M~U!yza4ztLgd$d*T0_rbhTzHy&^*8>B31ObN?*n<1nID zuUvhGcpU<@F>NhiAr{9OrGYUklG3X_$L_e67C>@Eiaz6%Mb~Kh{?AP>U}_D*2m3ts z>+s3OgK68zifkI+lvpNBWu?MDNzx+cfJLUc$gB@jQr++8_93!j3kG=_LWvH z@EogfZ2AQ4^E?QaFURnfZxmQX@j;xUm!fesCn}1n5A&l|VI#)bqdGn^D^HT2^VgE# z*_Szcy|zD(9NJRuP``5TPRq%4m(Rp==|kbhF@N(hq+DKvkTIzMeHc5nc2M4JZ^||fFS@OSgFd<~7fRv?e^TBxr<47|!pWhSp;jD>cEczLh=u{-f;n>s z<*fQl@eYn!KCkl^5PTF4WX3#YXF%C6w!r#oiRepEB3Jq;m{C9Wd~>D!o>~hRI~4?* z%V|UV>h%X1EfY9#P5+!%*#GU9d*UFq1=?O9UGOIu#YtgWMs|YdeqOTCBaB=g4^<-l%gA>KF6zjIBRXI|{eedG42A zz5yO>K++V|TTVmR=V0j1y3*6d?fc8fhr|y~fkNTeucm`broV4p0Aynzn%57HO(eTz zn6e@VPzx1DNOeGpEyw~K{Q--@`ERyjYGGrpp2+~L@9wT1gwzHJukTEeNEN;h|8fw$ zlmcetCO%#v6SpNA?Rpyo^5An+j%fWvR$<)@LZ_v2$|14)Z;uk3H4^^Klp6W5+GZ9+#X$O?O;&y8fs=X$ns zf%I_kFUDMku3mPGu*^yBkC{y(j~w>mkw1(JP_Vl9rr>uk6ZY=W|5SP~0$CTYaUj+a zQ7@wF%0v`?W|PmmM-2csKyr?8)+fl`{AoE zKMA1o(6tD&iap~m6%paunrbF_!9S5v-3j=uex=%W!vu%fCkQ1ElOKN?|J7)X{BbJO zq}dNQxarK|w1^PS9y*qboQ9J#OIlLNWcbiLAeLyQ*|A7WS8V=4m8R$z6LEVBE4-#f z);~W`0rE~FhbKw-27-rMRBA@&96?1A(xOfF5T78erX#*5nd?MO0nWzW0$~%N*U$iv zG65n{*qzCKM`yhLX4`C|nT>m_8SQm#Y_}+bu0+q0m4}3u&%f|D=qN_mEpz+Mky78+ zjZ)m75n^2fhSwqlGP|r$ji*Fmfm3+M?PcH(CKccD0gU{QjE|QRacSi;BuVhLGIvl`^i+&<+`yw0 za=dnK_{m!{g^4%%-b4XloW!Ihdn(6sJ>Kk;O#k-e7TJ_sbdl2{Jqh_xLeal>@Q;(2 zjL<_s`XnZmyovSae7#Tz{_GsOxujL=a%fnc&w(9Txwnc#k7z4r`SBZT`dj^aqqi4!!33gRigsXChpt!)f@M zXlDv+alb8J6>7lL@v@!|D19uA|-FuT()9U`}}wwWyP`_k2yt4eAtZldNbUTW;Zh-IRfU# zoAlOk7H>iDcCfj8Ke#bXeIqk7LHHiEp5k(VC(m5clsx}qgAIPz z#~Ka%FJLLCT?P(Dz=o8dF+7}2RA&syVD)2?7S#S6=TGflgnhRtv;6GFw*tM_coojC znhFy*iQkH0wpP0(Gf_PP@=~MjKQ*}?0DICJY@V5k(|lDzio$)SVtP~$to0h4YU{Az z>VbH3x=zLKa6c3q=C%lS^Sd!NW^CAykp*G5DP)9NXG6#n-h(DQ^+E3tX4!fPlvci8 z9Ep7*eDdFBSeABJ?&-^JBT$-*2@Pe$`0;%x59~oYPM#ic9T>eGTv+J-<_TuJ3>i35 z0}+6PC6PNc_SdyKgO{!TYHL@ewnhO2>L3y#H64PoGNd|DOtpsKEiL0Vsckr&tB=0v zEyZ9!O&!t(Cjg6Y&xZna>X7})J}{#W;sB%kXcH$=-R|&W65vTpis`6i$LE>$d4QH5 zjFDe#E%8V;z3dFcT%{ffw?SxBtDZsKZ!Ny~Q(b#^yj0laH8jyF=d*42t-e>#L{yLY z^A(JPf&R_JlHrKAaD8Qt+sz0Q+CK0|E3!~#9chW@0DfnU@TzM>i#P52(R0aU0wi{5 z>>(dduIbh|eyFfg*8Mj#21wO_+(IgV7(+r2k>_WXu*wd<&`H0<3t9kos+^p^r~BYNn+!=%0}3t5w|&>iEKx<*)9HV zyB+k|xVaihX} z5Z{KfmRQQ3&GimaPct{*cZZ9kkh_Yhq{OK7jw8E^KwVKD$;?#-xl3O8crA!Mkh<}` zEml?$x}<*M*<#Y?9UJ?Sr|EBXa^J!Vxx0Iy2vo;m+B3IlZZ`Ni6|o^b8{;HAQ$Gs1 z2|6Et*t~hdWHjLG5+*KWF$G!U&@e_GdF!pi2shFs2gE?QN7GxqgX@#;;Y6oTYAz3r z`r4>kpUm*@L~$Y9qXcp+0(%IPvlXR9Lt?L<&&?3+?M6igW#`1Pt_1@UT3pmOyhpX4 zu-G(IiSS<$I^LWbq@;lnf1`v97bpkr5+^l8OkO%Tu;e1RCBDBs(|O38Rj<|{8a7h0 z;CaZY2|SbN=P*7aHc3)WIwIEYz}5%IJwOa#cI-35+$r*|&sn8%EVPn5fodgxF=~^+ zhRwHo>uCS)b?^Vpwzuy8Zr%H(?fugBerbEZw7p;2-Y;$Mm$vsy+xuAy^V0TyX?wr4 zyaX0CnnN1jibKDg!Bzw%#OI-L zf`=W_HTYqO!p4Z|p!4>`iI;`g=mRZIe{IqHJDJX7M5>%~vJXR2h~=s^C;;rZIs3on;5>S}Ei}A-W4ScrHo&WTNG$D<4FPml)MN zh8r-(`{h0r&=baD1@nm?OOW9IZLY1TF{Hgsk`ai!hhz)l=g}%y2a;FnQ5pC6ZZeQ; zfpJ0JZSKSOz%?EWcLJMs8u)W_Zwd!pTrfprw#hzote zvnao(3o!Cd2|^;$)4U1k%>cC7N`eAXHv}lnYN4B zQMO}KLHr&T2NJNTqx0sjXDLO`2cn{tI{#SAFaEL{A12sBpYxSplu#}>gTGBvWP;1z zVlIqm;rqi1p;x~$5%!{)vDJl5YYRvZyxpJSZ)@{Re{)ExbM*nqkJ8)fh)s|DF+?7I zSI~d~^)E##BJ-EaOD=DE>^J6G=~CQZ*j3)9)j`xB)(zkWMG6Uc%Wy0zj=Pa-6;%AI5lhTRiILksx)e|S43 z??Xcy&c6!R65Q1n`Xd}+3z4}b5tU~wN8K>W*3)?76c81+!Axz`J)$!$Mtu>m?=9+W zs+hQR3MB*w6h3=D&{{^G%1W_$eTYgnl`xvrS1sFJ;{Y2Y+HPD1^I#IsXwzTj`8YhD zTEVqACif_qU+i>^E-y9A(HqW5c6#SZmLb-UR>EWYX%fb}S7=#1=oz=R4LF>>1c9&l zBq;~rO=k+US4*)3OYali{jaLqk$BtT{e<43TYxd%MUQ;j%kXB5spk5)<4>L|_DLm3 zuBL{pLSWkiE2|QDb-I@odgz9cV@BGWJB6{l&31x3vooBRV3788LuFV6G?DZ?=(*cp z1>bV#=6hadu*ulGQ9`^y;f{k#z9EQ`T^Kr$HHq^eQt+7l{VwH@H2ZHO&C2C;=&ZlS z0~qngia3$(|0*W>{u~o^2V$;0$3!%Z+7UC6`{j_BC=L=69rZ2jMoEvDj<~tv4V4j+$wOYvf8OagX3xW!DSDw3 z{^g*5RdA>!;49C-Ub{KcK(#mnJPcsH1+0#-grGNoykjgsOg9L^2m2p{k2r$tJD8gp zfcpeX3f$a=>@u}l_47dCYuyFFhZ{OUyQQkOje`EPiH8c z*6s52e)NRAV+~KyMyDQ)eIblEsP%b+ruae>MiiytKN* zs;Vq=LC+h536dWv@8VFzu-cfdllfs{Y?v!EgCW$P*;<}pdk3*03!8m~pBFd5^tEV& zE9(_t(x7MTPd4o&uC-CUpaxJDE2&Gd`1Tjzo_OtNanzysMPw6K4d91QB#i*}STSSP zmfGG^BB%3bXQ@$hnXEvlKU&Y!pZmZu)v#cBE=>beoG*x`C^8Duyq(Jb*&?VsZxQnT zvqdO;-Xf^V1|VD=Stww#x@lb%IY^BskzH_JcFeF*0HxMggvhB)NsTbr+D2qRzBFX( zN4mG}b=J|!8joheTFWE>Ki2BKa8fhUSWE+7RQ9$r`nFMQC0je!ekLD32J_qPcN$zr z#W8f_V(QA8Y>+=@lt|;Qy+V~-kcO<8R}5W(FmG=5od2t5D}~Jh9?NK?Qn3P<2V?(i zaVl=zQ?W7p^w~=B)3{n5p~Tl8!Ar6`PgsB75Z32))F10SnK#0Od+5@4ATl3Y#?$RB zf3i?}?1Qo~viTxMZHCRHn%)SFt9SRM!Zf0(q^+Khse5M!na1A%n^7zxXcgegD3(2V z#be>B=ImGwWl=TV+@g2LM7Vb(*s?J$8-56aE;~@&7$u)-SS;a6k99Q1-Ie>&7BMLY z8`l6bC8Y8E0m_B%mZZh~q}wxlixx?k8f(4R(DJnm@fNjyKv#Xokzpe~epLTP=|Rh( zBH4U!I7RQr!14P71v{V`^Ly^=bpAu|(x_^ZAir-KVEPEv}$fffGI+2Lc zdbUMRqAMeNN;eJykyfPvef}#{hgr&rGu?xbZs=&?fT*XtYZxiC31QB*vDf(d=^PQG z^wjm9B2DKE+jT@G+PaIg)x_?E$A365o2#-rMt&*#Y=l`q4-+8kga^)H+zYVAlugO> z1P6){0R?A6aw5o-Mr}+=3J=Fn(?wMMZDr=uZI@ zjI%$@1QrgRm54&*#lhH9EcA}_-kOPAF((6&zV$lyAK}RQ4wDK077Pt14q#Sq2c~=H zs+(P4$0;(2^l=mhA6)g9j~aq)zaF&z^hRZssX2)tIyS$B5;iP|+0TPHJ}lg9g1z6V z^7H7I-c8}5m!(D;bk!g^O&UGJDgWrx&RRIvMx>enAS)8;*0jcZ;Q4)&h+~3V$7*a9 z6^3u4Br8l5Y(PYXVmVqF&5i^zq3H3KBtxj_cc7t8kG-Jwh*LE`HhP0Mh{|8NR*n0A zr;09IS~d&gJ@R&HUyzw~%v{bscTFVROKcGu|HD`zN^Mz1)Wr>tq-oO0W*gVX&?C}+ z9IZ6v3hxu55UU>-+kGOXw}MbZBfV#KPGVf2FuvE<>2ijM+GWr?w7d)~1tJ&8eCnH@ zLatx->On5>T6R^w}OJfP}z~842rT53p3m>*f7Iuy+?&_T8j~&$6mX7ZdwE#Bf zHS`|sbg)uqmjf|I`L&*D7I>JN&j)9uVMBm;W~~9eZ4}JuSfDzgL!Kx}GL3#gU}*Mx z5us>#ea&t1gIcFU@fx4olJO+H2FM|0wRUig^bOgM=EvWZhB)=JAv+k>ayCf8^RM#L z#lG=_->P4x!^6>I(|y#qluRua4>o6hTZ`SlmiD=trjD;?G^n!z4Bb>qK{ReBexH#M;ff zH$T_*zJP^ITndUC^0gLY!SLx~a7N=>3Xi0kfVX0q8XN)#o@N5p#8^XXKF$Yn4vHMo zVaBL}X)JznTbHJc-(pRy3~#Nix7JV9VHmmSMkTf?ID zCvYoSduVr{GHC!hQVu7-hst0yy_n;qSbEd#peU-<@!V@LEi-|6jE^?{j~R-C+~i5P zkZbSernKx8JKnit{P#k>e1)bZ%&o5|+|fZWkfHEKh=r(Q+IkQDe;!7EY$mCb21&pU zhhEP-ChzA(#$5ztks%G1IEy0L6CKx>5<;l_+%iRm?sS<(%i7J7(cHDg%~El;xs}Q9 zF*fNnR=|VWKfpJ#Y%|zjq`2N-6F}%{rN`NA`wA)MR-4L_1Z%Ky6U;r!+4^b$k~a&yy|= z)uWl^e=dm#09j(QP+}(?=-HhvZ6+SX8)pRwyJSacLO_KQ=y#Sp&pUGg72 z;X0bKscm37YdnHW6h}ig9_u)?E*TdpL)~DevxF_(zomo@Ti%%`u2Z0_^5*?n2APF4 zREG(sHdNoLHQOkH`v=6{w@MnJN7O&1%p@I+G&LP4;0sXR^q2g7Gy%*tL@GOUUKj2KTN^R)T~GZa(~y(6%KlD!$gAWVZ4Wc=vyp2@KVTvO6C3G zxp`7ss~Fwz=JkW1t`G0{F~+ZkZ;8tS$E-@?BAbQHZ%$eZ<1J5(DEvB6;gzbNj57&su z!ofI>qT-1`0{Rm z_c@-bE5j+VbS(DD$nn5g0adkX3AOlRZM7H^^WyLODV8%2=m{N{KUbTTM-7SF`#|pz>%LncUnLn` zIq0M>gY&LxR!`(Bp_#1PB6Oy2jEs--7b;F|97K#pAGkf6TkxG&?-<^u|IC|-V;#xh zn3ICuo{pQBQc2aIB{U!+GWdP>I;C5x==6eGbH3vp3LGC_CYQ}9%mozsU;dB=@v2D&v zC=<;7D@Rtji770je0MMW`EmDceBxml7%Vfx2x`iHz#dwM!s2E8JDu_CgCRc$?n(Dp zR!>ICSj4>uOP-Dij&~M`?yiwyC&e?v3O`V$#!}3R@BANzRiy5`fa7RxOEBp1ABL45 z-?`ey;|k_Q>9U;rryELl zQW4UOv4sWqW0)m*%QuQPT&Zu*h%nY)Oqnb)wXuSoiYKfwbu!WklASy%zap;ev^JH% zESNVNDP^$gw?Hp!YaXzw5G1d3%$|fd3$HhBqqi%5KPZM6WI4bE1K%`o^@=?!cySR^ zKEEPr$7R3(xmB!TrulQQZ(rGJ`|#?RQnoB!OwmMiyd6^yOO&tC^rchS+CTbW5-|N@OKh1xv0J zc`Dh2FbwLQ2Zu7ISVvxL)6qPxRE_+U^3;i~0`XMP#iEhGujWVjR#Qh%>{tpSz}l!h zoq3}T&^2NiLQ??2jaXE03}nmIKzSop5%}bLf_=!ojUK8^Yf1;WaPbp`QHe=zo$

I!T1*=@2jRNf>u-{9C`ypW*zJkH8lsRtdtGRCqKDbdO-I9 zWyx59uSa%+bM(9huSqVXy2UQQOu#}Ih>-SIWEJtPCV>xlOH;Xj>LX?F*F3j+B&3~= za~zCr`g&}yN0bOlg9E@n1&bcMV3XE#%N&1M9ABQpf3P|&An28rvWeW~=wYFpi6BZd zi$}fxJ%&6wqj_ab`1%&Qz@qMuV@3II*Y($RmS;c1cUZWK^jWayC*uj4FUSa>^;dOd z^$lV^HqQf_mNUHT5Wm&w2G`$EaVSv}M3o*~G5J-_i|qpNoQKRzoifH-_Y=~qz}9`iyE{BU%ma%6eC;6~(yXc>#iQ=NTfAv(Mm;epPN;SU z7g}XMwHc>#^e^a2@L$l?$TR3_M9n|j71if#2 z{2!ZxQkFH06o@WGYz!`(=Ib)tuN{+lAu+IW?SE_zT>sb{lrA~!|7&w7Gl$3=T)9=x z<(_2@g!iq=QwZrb4wfooSGHgZf+Urg^BUn4!!gdoa7!JoCf__FbSJ&MsLm+p^7Z3G zJ=*gCl6A(S?K}10+Zu9#ebroeL}Nd>T3YYzdRD+#7mEn&aBIl<<;nOp>9eewE6yZr1f;5ik%TK zIr$$R)^0M?GY>1t;(vHpT&y`Bm_reOlhNRxXCBr&-xP42Q$b3CVueJ~GIn>A!IaSK zKRhgsoq@ajE35zTutpTuo_SbeL1oY028o~VrN?^n{P)OiD2XZaPF50ZE_B_wQ0zTc zF&>}24S!qy!rik4{ma85yZ?uW)o=sn+lI?pBP!y@jel;MS^NoLpZOJ6O>N)Yo_2_4c%&^Yhp^r)P1)mLMzGabTx) z(cAEd6&Qkp^wl+hV>pmI#_oSeR5jorf2raSzy%)E0KEt>BY+yAeSlpAkSaJg>Z)=U zM|yFqkFGSWvQYbX10Hz{cFG7lE7BIzX061VtQU}5|o;#(WZW3Jzu=4T-IdkUvyGS69ADoE*k zVZ$SvT30JY#1Ty`mUH&h>S6m#rVDl*4YqnYg8Ox+YN!;=cy$kV-pgQk>`nb47AL;pySR7Erq0|e z?Maw(_m;75yRBv(2{YjL+45f{wrFf(NU#cPg@V@jCZWn?F{vD+Pr^=!>Wl8~Gb(Qpj9AC#7*b9TNexqr^&~wPGL?}JTRgrQx8k_p)zCLJ6=$58x+wlA-h$5F zkFJ@6LS%xa@?-8SFP;|X{vEqGI=?6L4`q~k#%k~#d4Qtvx25{ir-#zr-Z3j0mc z*WY%3-vru(=dn)Y-gj}pUFw28CdWk3?T?$Vm3F@-wB`;W1JM6pq;&tQkPiJNrF%)~ zUQ)W3l0VO0 zmz3@$rF%)~UQ)W3l|Jf8Ek~p0Qev`X#7C zX>d8_d;~?MS}!)=3{{Nk;GMj?k>?_0iIH>G4gRLkIMCW5ZyAF?hgp-2dd&K4!77D)SuBE~Aqw>`s<#2{0op@&=iU#rZRN6V9&dozimE)7Zr=2r24O=3v z)^204FcO8O_K&wJMa-kkj_w64`qW{SZyUY@v7RuUKo86ZCcpCOW6oi5e#In=%Q|69 zN!r;2?v}(7aDFSED{tN23i0|BKYM+y5p%P#&=RbR8u0(?^$AX|<52A*w9CtYb3De8 z`w?o&=A}!cqUSMVnf(F&$C6k*!|vs~n%(x)qyD zS1qMis`_7oNiJOdTP4b*=gJk>N#9UjXeco)CgqT{YATr6NYKK(A@p$>n@cp0Ln{2* zb49Ag;N>VSQ4NbT%;Q2bUdL*XMUbiqJlT^@Zu~5v?Y>NM!C8avR&8=_vrItMeuP20 zk_?ygs+(*=xFaXr8@wzP#g|*q9M*QwPM#v529$0K;-DJK$^-ix~ELY6f^chP41~1ssk+X!)X# z7vf$8c9C;$*tF(YipPuOa~YzF|H!E4>r^`Ty420>r0}381U%6d8>%m=-xM*~kgfm( zkB${r8%QEw=Qz2alv2}~fj5>zh=RA$`90h8G|9T&UoDi;W{%fWOmec(0vR{2n<&sE?#MS{5_c*hcN8X-}5mY{B4~AW3F0*REA@` zN`hL)*2b`S7jb~IEM*KZWd~sK;~3AX6oFKjv|3GHk=bc~BNlyo+H{x8A{MPN2V(BCkN`c**r zF8h7cRZynw{$ zPY7tu@}HYf&2`r#=+#mjhF70Dmw*PejMeg5gT#$*Z9i#Ykpw%KVYzZSn4M?4O(w*E z{JOnDnu&4k9y!Zd7t&o_XFx1Y;wQ0c&-ZQ10&TD-4}|UK^ZwgQ!S%W}uUcSQ8$RZ> zbaCail%8i5=wGB30H1TDCrHSiODMmuX->no*rCVbyP`aTe$>OQON_9tDte>WNN1kJOBih|2E%g0#IwUU)whA{wy_95t*X{yp=*M(6VbrJV zU(an0umHXN6jKI{Z(S?yY;%^#0vsrqTAUa4l0JL&E4WK81HBdKMt-%teGyE6oMcMU zUJhP|mBZi6v`s@dYoeSCY5MB5KrQR7JaZ)*_zZK66dR}%z`Abz!fVYmAN#@ByxTt3 zvU_^=>Ep#g$QZ*yZ5a=b4t?uN*j`75&7s%E(HURLb(amxF^J*X#h=*HgG3Sz6BLQiekgR^&oA2Icw-z81fH<&k7$!3_&E$}ZcNk&O>2~FN13Gc+vL7Sps9Fv59H)^zUDJ38n9&#BIrglTeR;*+l~a7zABj(?U8ofP*IxV z94Wgcq4(c+>~K%bXyWmWrs+nvRvH2vu(lj5l<~FTNFQ2stiwzlXfGgc;f+kgA(8HxPwP9&o`SKhMTwD#`F3CB|2g2 z(BDlp^NvTlf7oDRs9%jVLVe4A5&~2iYVni#R&2lO!EAUd_+7H9-__CZ`%%xrEoyfn zcnLXbT}AOQJD=fd4Wn0;+Lmk4@J{!ts2~fa^uscR}h`#M~^}#V-VUZAORa*=2i%(^IW->akU~QBBGZJ1Yg= ziJ|?PAYcSmU%Lqz1xQ4vxM%0b|K}S#G~M0qqZShs(WHZMTa%8Z>!q==wfR?q|M`1%JCBg~CVrez znQWmmmIYDdGgc{I>e?})bDUyx`7$Y!QXlAcQSiW+7!Ds!mE75ub&7j5ZWqhp0{sKC zasf0-gb-43~Gc$UR{gSl-ZmZZ}gl}ON38Lfv+ASU?LrEo~z)rj`DL5Y=Kda9mnTnFRb1-(!)#)~-((qlTvQG>Pn{_#fo~g|N%LezrsPad0)hIBKoy~8 zGaM<6=RLh7tkZ^4;^l6UE~9!UaqIC3d*%Z%jFwnXNfwfaaGWW_=Q!S?>|+=v=d_|BFHJf9v_ZI-AIx!{T{<^;JAZFtWG3{;tkS_zT=ZQ5F8E= zmsb9Q57*`P9$XgvQanZ)Ez%_Zu!Dkh~Lef4To290$KnBHSt ztcTQ=9yA{T=UuTd%UD>DAU&GW&|k2*H+&WaB3O?2Y(v#1WJ(jqYk~*=LT|F$5}DW= zt^7x3LFYo(S*lu)ic9BGyz~-jvAjYW^=>p^78A=S2V8VM= z$aeQMSeO!1ye^JPE`4bG5_8mllYul;$(HWw4i9&vVVZ_KJ?4s!JN&0;HqeoXqp#0h z5$9zTa+za0G_x;51dA zLTEm+70mB{Dv^m23%a*;c^;j^$PQW0nY5-pg&dRj=(IbcmM9@0Zt+(>Uu?AI$suE* zQg`E63)?#Q-Tg?*woUa|X9gZ&Ky{Ql?07_w#Fy# zG5v*|EMD!IU;6&38@uNi%{%7i0SDfD%Jt%sIY5mtLIZQ1*HOSMVtcquYol3wvusDn z>Eh`8GrD_bUZ{1>(YVS$Tkre4LVu2|H6%=vxuOA@^7+36TRXo6Tj>zNR(dwH*gpR7 zZ^4$s0`T}i9Aemd*Dwx)&e?^%+Z)6PFP#|W=u_v*=vGJRF_iXUD~ElfBJA=iP4JYs zI=msZBM5N=|0|sH6q~eEHH>ih6s0QfWE_*U`2mHW^Ba%Mx$PNrxu~{Su6~vWgSjEy=7xbC*8F0y8!xaa^Fil{asDBc5r z4qP~EGDUuDdnLd~VWnd1d@SyQ{#5^gw8tCHs!L`6=h>}?KM|G1WDcV#{+Pn9{+Pl}ksf@Qbj^WYFRWNLx`b3Vso7fEksg6j?N_`D!Ss)J zW!?RU)(k1*#|>qj@Bt=<*Je!ww$t!FHw3RP!tCbcsW&#MXjY)%xV(m3b)OdF$GjVF zzt8Id;(rL*a;~XTKptHd#nIJ8CxZpZr}m6uYc$Ssi}_^=ZKzt9E3?d#a3O0Kd(anm zgBRWiF0;)zN*BSLAaXAN7BIc#t0(?YU>YumfYYv_nn@^!ni64Ju$9{iQnY3e*cL_` z$^PlLEsO(f3yY~6M>^U;`eO_8w?6Or%N92Amo3cV84)H-86)>h=q`Lz{4ZM=8@K1^ z7T6Xh3bBP1{I-Qj{;`EMh5%8`e%rz{dp-vhTE__`g8xH%Qx5Vn2iR(hD+YX~(CTOk=Y*Z*=gKLr+ncWe<`!>^0}v527muwmp%~pR#QT zdI9qFoQc=5&n|GJ83uWnN%yVoDea3M>heXqMy4-*uyOjIw5P!T6irn58dzhguZF^B z9b=~~VO(*HJsmsFjdzkl=?s+r=pt;`7F;OH?!u2vRk2x0O%g7I)?R$hS?>QVNpxsX z$q?Q!6#YS+*Fd54n**~5DIG_;kuK(-#$F(cHAW&(YI_31Z~Z6(W$B55*rCZ)VBE5R z2j)kjs~~X3g5-N`dxl({SkN<)8cpM~b6xJWWO7NGw3h8;siQL6(<&5F{ijU;G!&E` z$axDO@H(c~4u;YFCsNk104@JA+O6#IDo2;g)q3Cy)AhI1m2=H2ZqRD@QB%N|P9KRBj`jK&i|AP>*(YhqyR2hiChwb|KT?7+|_wA?j z9jB;5#A@d(y|$*>u7iw7$)~qob-`~kiUY*_XrBC2V%T`cO=ZjzjFh#dW|4m=?Pr+T z>nUUS^nJ!E>v3pkhK828Ze?2%9vR{iCT?fM{}$%lqI0}a(f))zP<3(GRGje z&@n2>-t^kaTOCi$kR*WyU8l`9rAOk*uDT;u+r9z0vz?Ru9rBB;mhXTYc$8sp1{T8N^oJQ678W(@LVhd9dmCIhyGQ&2co zCbVDNU~CDz{#g#(uFN!8>~diV*O}+@S={QMxKtMlU*%G4vw@+aK!%C#UClGVTsO~W z34j>N65_fzB2je$U)QA=Tqg5KEO*p$yvd&gH_BI z5;vp3d4npEJB&Ewan}ZA{3kIk3{B+yeT$oqwD0mY^WGD$L$>w-v%KM zV^c{Pch>8q`RQstvACzg$3|6f>XUY^4|yZ9(Q(ab+BF5nLval|yqi?p@ZyU~2@g7v^O>$35_6s`&7_@mhpqtPR3%9ml3(=`sl&#ziy)3sf5U!}t z=AJ~ofe6KUHsV91t6u*83MMD4LSdLB8j(l(qm~Ap?H!luKr*RIZu^MuJ~i`XvwSF% zaz85n1#wrvz8N+tZN7dV6> zz^^0%=Tr6!rVniJl=eLoD7;A1Jtm`~{PAOu5)m|E@2c2}PW?c65#*#x#8#t9GDin-k$CjY* z%H9A=4~8qeh9(Jh>Dm~@x%nU;U!44km1H#_Fhcs zl5wf9WN|^i`48t~mu8Lv*Yjr1UMpiO^10xpelKUH&ZwX{^4cwUNMEQGp&nLKNSlC}^j^^p{$i zX1Q%!)GcgCE41fimv5C=rzE5SPVj{E4q%w1JWNfdS)#%zTHvYpO(ckO1j9)$ z*OZ)Z_0)UmILVy(hcRH$wDwgQwSVwK=pw<-$`x)e?FF~uBE;yBNlFqcJ0SU#)V6=-ZR%jj z+J1dWWFy#QcE%i%FN~J{G}-xh5p}SBhdC46Ak=-?Vc=~)HyB}Jj*=hr3DiZlX}J=( zT$p*GMch;dpL<%GPkU0subLS8mcrO*tLMI85h|34G9CyQMf4dVs*!{D8NL61Ytl^P z4R64jG-1|U(_*fYmZU-J8}UYrUIeNkuO3HV13m*TM|C(QYox^YnD6*jEl#GXR9_6@ zpP?Rlh_NeHYB~pqfEy9m6hiO1IY7TO=BK8eB!)n1(qAM15EKM5f6u ztk-;Zxn}nN?tcI8?)U$%yWhwEzWY6oE!SW5exF)s~P{p8@_W&}uzE+E-NYLtgKqk_->l70QDXmXmeV7aY2@1Cf%m)l=%bYco ze8BT4NXmZ!C|7+vsxOiSm_h-CkB-X540gU`&>TOVli4NdL7V%aWw;-Up6~8u&+ua& zxBrE%GqT%nrlrUCrnw;Fp!@zfNfx(J))3FRy3E}KM%TeTw_JGpgVA;PJm0kM?JrMZ z5LaLXL&<@$cqjzYKBZo$o->;&6c5(KyVqAh6?ZIJa`QHq?aPWCz z`+?>U!*1>OdE)0v@@MVM;AV<+pS*9T<7JpZzZrHB9pzR8&3Yrh(x0`5el2Ojx0RTj z6m$Cz?FX-zvJXej=DBm`AjkcZCtmzT6ne!t(y2#s)5tBTt1BN0&JrxDboN92Cv(^C zwUr}*@HSTY6t3Gdt2Ju%9W^V=iz`GwMW2#%I$(`&W_z9}OM(~s51{R+&fFGA7PiU{ zh%rezJqbVpmgnm&Fv4f+&LuBf1J-u=xl)54iY-_K2=l5mEtCP7rzq1A*| zNy}z@u2}a)u-VCci30zU5tdd$oyOEos52dCvJSusG}F##L=bTM1i+{svIMHas zsuzO+e5WOea*C6rE{BTF9L-nSW~?_n^A?r#s;T`i?Q3+8QmFQ^1#6bdo{ zZ}I`wFHq{ovIYoO_V-(yJTcOzx7OiC^s@UF!cMQU%3uFXl<^R}y*r?b)xp-c6)e`d zXy$d!>Tovnm(d`5Tit+& z$xr^FQ1b{)IZHbbWh(c}=JgJ#^y`H!pt#dg*fjWb5#3+>9AOMTUG&dqaMk&Jwcak} zK%4pUeq+ozK5`R9gEtn_Lqmi-z(skwJ(0K?HgfU+Lr+uJ?M>%-DCPtC`GmqkW+u!`T*k(&b`g$3QtiH)7Rni4(wvN(G`5e^hCqv?Kk) zxD$Y!E=-xtzxiSsHTFxoxDcSlnkR@uKzDZF%SDn?o8#}xg|clQIy|43_PNyYEjxJI{JK)3GhMcqgyc5mu)9!Z5_&n+v?yI1T_ zcq929s9{{V*P{8?>4Fh_y4V1pE@;803)#a<&C4b2z>o`%F|}kycoYd4Doy%{kM2tG zgFSslRG8+jts`K@9kURGaR&=#+*!doO~ZfRCyo_q?B3y_q%<8G`}*FW9Do6nvKKFv zQD{4Wnq4UVxj@#7mUqj}Dz0HfF@Rb$_J?%@(um zCNVQ`hb3HZsRVF`hN=W@r~qULL9q8(;)0iO-4n4_G&PRN$NHM4LvPLxFUmpEs(@GT zudnc(_kR)rKLHUDZNF;eqq=>{bg+aRj`{2+AU&dKanZ)70t= z4+(nR{tb2e@o>Kv2C7yCu&`hKLACXRQEi3)LbZ8@u#iH$@%Mff$ ze%>h%`-+S01w}m-53+~Bq6R`OGJ)gCitnzUN&KH}`db>x^}QXY_*!n=S~}3A=Q-$P zmgHW;=!l6K)i@1Ywv46>6Q^TINH#gq?Dn|TBWs7|pq;UqZ*gy0q#=DF1Ps^_`>@!rGU6Ye zd)&zL#<4YL#R}Nzm?ouQtoG209l<5_^J_@OR83)!v-X>W4;NGx`gaIi0o91R_X;NS z0#hU-&?^Gt!9IdAc}FWp!tFw+nMQO|8V!e_)}1px3%)l(ekneWUkNeIv3lEDH$jg=WKS^{N@Xg$#EcK~;pi-{bwG|K z1!%I7fMjQhgMz9wNAJycD4MdF6X-C(wwCv@!wrflsOi+?q=4{08Kq)&7Ii{4PomNvQKR)Zx4e%DRj|x0kgxZk`s$G1`~;{xuAoEb{fE>gLR%x<3)6$bUzaPVn*0 zpGQ}#`O>@1P!*hlK3lB zPfF{vTiwp)XLGGyqk;bsQ3n6dh?0HPj~A`LpRJe><)4TWj&0Tzd0%=bncYo3hL47> z2}oAC)Tx|D&_ognm_4ii9Z~*L+qO#bfBp@)i~IWTh%!jvqq$IDvpTI=AzrY7Xa9p3 zU!)Hr{}DRh zt3B_jptI);v*FP}S3DcVb35EfzvE`rRu2Sn_mri?1ayG1L-oQMb z#sx$5ZircVMg!lYm=CTEOtu^5(4PA9O2vGxR|Z9+{m)LHJ=s*Ydpy4uIRYmNm37*Q zU{*FZHAL>y)7dQ|7L}FpHIu*jV1)**Z#AnUU$e4Vk(3x-RMkRR*TnTLBCcLahl%1x@FXc6**9A|i>`DmC?ya-7xa9?XR#d(X^*^hmwHJDmR zA)+pdQ5i{W`qfC0$S_zh9h~DPOW1~1k@JD(3)^JIfm>U@nFmHbL0vT&GkQiv3N9+i zp`BliV{k+2tm_yPQgKpzfW-lP*kg*#&Kn?ei>~1ID|D}vUGMtwm{BLy_4fz-trS%& z4+HVr;$`1j&qVAa*p_tS2CK#O;KAg(>J0V4f>gwMK0}U#r4JXHz+LCHJ-P|3G`}B$ zs|Le*xShLBI(hoP(Rb3D;yuT(dNxK)dkbnIp~jz}H4-cN{*Ar^zJ>n7z8kkr)7Dd| z{&G<#ObnRyJb&Hh#c*_Cq4ddBMKHT-C&6$k83A3TK7R!1#@EF6#VnYuX-QHX^aLWY zL8#x0s%Ls2mKE-v&FX&>6X(Hhuu8i>cT+N?MCv6gwORWd-N7O81GKyBZAkFhql9D6 zoD6~OS|^m+3D_TcZ0^`@(q2qaC3MJPGW?ZtAq6*4QY1L%{J?Q5nEb({mFNntaXZ3G zo_UD|s>zU{7_6u|vEGG|zyvF*MsiCCXKx4F$5l!=Dt({A#hC-oL@zh215Ws=yN6UV zP``6!_;2oFpZTM=Gb(hiVyJEg<%;h(7|it(*^mp|0rTwbLR`Jnll5buX0j=9b3r$~ zHGy&kI9Rl9odNQg%ZJ@Y1#UYuqH6A1ndi zd)zca*U>I-(G(^0%t;=*1^YK%iK&mIgAsphRt=DV9{1Cn`arJ|$xcJV{tO(#>G9_n zKIvnuiw*oY;iYRb`}9lcG32VeYt~kr!T2#U1RLKFw zq0BKiqPsR`rcqB^fq)we<<6ZrPWbXQ_8_QdHg;Es$kO<3^=9-r}PyUWb`;< zE2|$*Pspm=$3Lp;DRhC}x(AdLRTt#3tVw^FEDVqs;?UO413Obp2dRMn$?5O@ozu&- zps>-&SJes~;%dUrvh)$itwgWyihRO<@>@_5_{w+7{|@~z_VholtHevYu`a?Ir4z65 zQ-RgJ-A4crZubgVFL1YaO3!caw(b$0aS`ixP(OB@DL+&HcTf+cxe&TsVx;D%Y4MCeKdcqQ0sA_c%J}E6l z-ruWFrw-DLmMTB#WkUUI_BU%yS_&m-3l~KsejUB}xxz|`;pQLR)h|d?4}WIP`%S={ zR|xnn&+|vA!03sz0SsZr=~wBzd6HMK2?c0jcP(hq5emBbpaM$m4Ss< z)@d0K;nf91c=hoia29x+fkt`$OAwcYNM^WCe- z)?gjUu&Q+%QFK*F&DSfPaW_hZeHD_wTJZdeg;Pph}=y<6i$;*d}^+5&3fY;df867E=6%5dapA=^X)98B*l+Ip)mW=@<$bHaHEeNX^ zW~a6Fa3+8jC{z^?D6yxo2VZxZtOhh{3gCtIxd5$*1JZ$y9#;_r9QwJ~BG{0Thxj@* zA$PgYIm5-&Tt03q;A_yi_m6{kgAIV|GPnA`!9e?aSQ~Tb2dcd;sCahlZ;o8#7*!V+ zPLd_>tUf_Wo%DT9ljeH~wNA}2-hN3` zDJh{bN2#YV2Y5kYE?cG7-f!sT1s^Xzn|eGv)mK{p2B63-=XsQo?^+7Dq#a~dv#WC4 zzcaGmP3j)@Mc=-tHnV&P1EpGl)BSqTycK{NdSwU%Z4Kas`UMiO2H-={fK;r(;oWM? z#?^c2wHd|fdMG=r>D|2O#E&&K5ftNXhugbN3z| zQZj~^Csy~?5ina3Jg~){sF`uWCF8vZ&wa_;IH91n|0)@i?&(CTqBaCQHMdg+x~kRd z8T{2UCdlN89lKTd(=zT}f2ZlOU(m)4*EopbE-CaVOE;3CLyr2VWbCgu!{*kO)FJ%b z7~j!Ui|V5>^h?bS9yEi|HUbif1u$YY7LcONPs>Xljh1&=l-v4SwCRC>u>cJytNOWE zfG8B|M^DWY1*+K>xVGsMAnG`PB5YTL&j83H4iE$t34)4;yvF}3f#!ll;sMf7EuheN zfS?@buFv+oOrjq6CK93M?@;Zf;bU9W^#|D>@*CN|R1ZP+uMC*C=(;ysUqV?Yix*oS?nc^4|aW=Gr$cR$`FL^29ObBM!J#+@z_K8l1+1{V7|?@(or)Uud}tVt9MKK zaS=|Sx1G<~_f;#_y@JA?)qD<1hyGjb_N#SVyn^FH*1hRM?xzh!3iQ+S{yH*kaC0EF%iAQ4xKxq9@Y3mrrAj{m#(_4t1; ze%bzy;ukW6`<@9}Ne0jmq1xVmCHbksNv9uxBG{E_n(%sQHmc_p9oDB|(EC;Z6}}(G z!fBVfoM9YAnYHv_EYSY|q^zN6JqoJ$1)v3jyJea{|K3XM~|1y#2nI^))<9x&~PaN`7WC5)9)tN4a zYDQxbSJ9!J<;X1w4rb8IDgYa}mDxn7t=9oqsrKdqKD94S~t*W$lEhw-x0o?tnzy6Qswe_G`x~fnxfWXJs&%-GyE# zbHza?5Djst`$)lseX#`X;e^6}oVnG6KQXFT=6x$1vezloiuqlT=TFoE4d*4TQGVdUEazc*+7N!xY zEz_~NW|p>hzCSbH!xR-sYK%F(x>?$k^Nvl{2l5Q{vtlj(q{qe2t5Uf$p7-Y&l15q2 zGU=A1_pB>=iVng@~M~X$H7c#UkmzmbuZ*9Z5upi7So?T5#C?@0GLi{qGYrxIrj_#=AW2shBXja*Az^qfss^NZHk z2H+IWlxi3Ll%7p}^?@>T3p?)|sd!7zz`Mfvsfja+cJ-^?wlV*HG=A*;BbfQxV%%Pk z+n3wf21eO>^JOB;+UOoKdU3JdB{O$16`T5i!-dWjzi=X$&5ebibdASXPGOcisEqrt zsaXo@t*m+MFX}G2weWX9UKt=FF|jVk+2g}XRedp;{>lxhuA zOAa|`;nDWE!P`;S$yM<)9uizh&2F5x1h_v>)P?uOq}p1s9n(A?A`6Ig$&zzmc>D4C zHC|SvC{OkczsNDMH0^|OBveE&QRT!npK33|b(*DIDM0?aQe_6IRLOq?f-6-`f&Zyg z*~#(YdlR;okIrx){8gzUasW|eSA6PB)1+J1MRm^^_lj_@R2==tjNWw>bsOwN`iSYW zNaB>Y01R{#&>?cIA*3Jmb=uMyTi`1dtB+?jkDYV~f)M!y9w0=1$KRc*v^=eC?SY$M zGoTw>o*>N7cM3M{bW?w)AFiouB>yn^|3dPkiw;^3ix{QOsrTn>^$nu2)v81v8nvd-6j` zirxl8`NOW0dPW{4@`0Lb(98HY)G5bOO__f5-rXYei`q8u@5AHu3d*WkE>xY7efCvS z6D=Bw9Dl!(nlm{0P)?10-i5t3E*cHH24nfbxkur5UvBu;fuU;OD`8=?AHXAEstrECpvfP6Fqi8D$j0hCag;=V!+FU&o{pUZLy8+z+ZWsrUg*tWI~#p zMZ>-4T^I-I=z6qxj6z8LlMqsWDumQO3nuj&x824VJV^2SY+vkXq+^U8d^G0XPF2 zuvKhE&YiYe6ihpV#;40=!1MsvX5E}>6^_g~fyUM%)0ew8Kpx79>n#bNTh+zg$-IrD zB9C{$6RbT&+!(|~whGBuCs0E#pen#!;3+;;v`1$Cd34(;ayzXX-UOd7l@if9lnj@q zot+=1t4}pR`2zn1>u>o3>$iZg`i&v1e&9|N&dS7=?~t#Wq_OwB#b5%FbR91fTcj_# z^!D8LFoxL85Jai{38K{2{iD=YHK1T!o%?|h`ij(`DM?0yv*J9?FSA(P!Vv0_AVe2= z(|>PZ4sq4lGz3&ELf~X0f-p2mw}C+7tC9Ali>zc2O(tY~y|XHsd;YDP%!S&pWSjZvS% zE7i)be(laRJCaDEOKnnp;7874&2?_?Z;S$*M=8PgpLz0$-{w0k*R5**R&9SH`BNUW zKV{9~WZbB#jQN_+H}2ptQ;veZwgN}x9J5TbGr+2iuhj#ZR{1VWr6TrMdr(#lDfn~x z4GJ%%Nmcd;okkaN_S)OdLUj*Ik_%MZu)T?6b^EuqJm?@b5&hj|)x7(B_qnYmZ@j#q@Zy|@9=In#`;9paV%&E5Z{v3UpSIx5@X^d&)SI$y zK1>DT?>b_%30$k;m}Z$OL-l~FufLY(JryhH!S@V+rr z^4E*Vt`cae$h3i4!s+%=y^hgDh;+LJEZugT6(|Ka2H`_bQfs@6fd;$6%Jf04UAb$k z!p7$rxfQKxLEv}{QA5S-gPcKkEM~qEQdqo2LxU`MUOxOyCaOQcu1Nr)Q0uOa# z;uEd=_$RM$+3OrF_mtcaehgzaWXkIemXP?XY?VF%1!!#f&Xb>D^>#U=H^_WCWnSj> zsFECX&RTLq>3@p~jmLG$IUE#ywLvX*EjaKw$%jw)7FhUi`L^so#lanLaZm?R925|R z6bE-9#lhSg6o`9U>VLYoyM+S+^uyWx{X#FCW+2io+f1;74a#wX%-(Z z`!u#pY73_PG+PEAVcXzNW2ZiwagX-`YXiX{#ntePBMgOQAJD`C+(&IYS+?yNGIyE2 z3Jx^Mc=e#^+?6!1JN`PD6)op!SSbrOx@s!Ubmh*L>G4@RULSXJ4xw?lu9(-SRQ$SZ z!(FTz{;s~c_)RDo!}psqKuQX}pOiNgP6GnVm!CFhvCsF1fuVbW$ZG8C8nr z&2;MKhA+^LoI4 zD&95K&E=VNft$UkAE({mUI_jK_XfjM14Rb^?hOV!wL{d~%zvr3Nu=(K&anTZ-nO#< z9R~s6u&+h^d5sLzVCOe8%Hjl7!n?o*YY<{EIMRrOd+@~QBpY3`s%H*{L>k3!nAyXW z!dRP2gv~)WU%-8w9T1WkAf4p?@&NBohwZ~Z?20=GyTUA86LcH`AQr$tfEb@g!N%wQ z-^ORc(gCL?54V)U`c2bx6d*4}O22~ZMa-bSuK+=)K@eO7fC}21 z8N?U?;3e`aew$k2q)#8RZc*>Tcq_-hlDv9|WnGVvt_bpt0MNV)kcnAfpbF6w1B+>! z!CV0ls38KtPg;ar@$1__gGe@7Qeu~4Q+3iS%LPN}_L_P;xYji-(91}`E4VAU1#ejp zS0p&a2nKKMGfzcM`Ri9AAt}a6sVFP^16mI*|61F)*pvWVlw0kdYyDFczzhoL;Ogp) zE+z>p=zg94>^AuT5IMJcG2)4lq@YIDvh3%E@U-?m@d|wb-&1Q_;zP#{f97+B^u%HM zQvs!GPi+a(b?cm*;Ud$`aqcluI38zTd*;S`aB(D=$PMYv2h`i-X7zrlyW;cXQnF38 zJN&0DD_b(9$=cu?(lXWv_X1&{ChIT4yL0GR>}8!LpTH$E5KY&^rAfe=tkAY_$6iyk z3lKAs$YQrN`)L__gI;)p)kkOO*P|u;^TW0#{P8p!Sg7f* z*FvDJEBpYNN_T^&(&Uh-^x7}@KSIr?y?;%m6@amS8#TAHJUGm?_(>Z1+tBk{zN6(m z`m8=JXP}?W93WG_>gs!QMPnei@y-;_jUl>k;b@i%XtM3QgSkA^u<@ZQG?)C{SKN04 z3uGb(h9PwQi?R(4zQ_H-r)@IV-KgFwREZ6tJNAsi?-tHR^tm6)9E@9jeYnC6{|4;K zpyGCynipEww&a!-;;> z4$*KT@SQ+3oEc1B{}&BsaTnD8ws89YW#OCwPpN_6E%j_?%}CKZwGx>R2x=PKcpTfG zN@mN8KI-2zy-V!*tjGNEL`ErhRuzGfrRcq0qAGzVPVv_k#ah-z48HvzN!BRNZ~Uo# zPplI&7P35)!FJBK*mzv|FE&k@>5OqLYhiz0rv~=C{$z{f_sF%&$EAEoN)t;MDB;vw zFre`7iM7^0cFwGS**PjrOJIf$I|ICsGl z6kiWcGO+$pZ?6AQZ~DgLcV?n0gGi=33X(AR@2HqVn@u*k9&Yjd$5EZu6sA7eWdJtm zwF}-zFt$lvO9AG%XtMToYevmpMTqM@x>ClHtV&M9*H)rg8}r*i_SDLM_SAa)gNXs- zL(s_NHQ810qZ*QxgRqq>zEi&(oI9p@$m5guFp236J*{CZxd;$apX zcHpP7XrYhlsqEic>QJ^fSqUxSNmDz{xIH7cQQoOz4;aK!{k5hBPpa+c1V^@8jcrLh zUoE0-=9}XpL^WvKg08TG_6MUYZ(c>fb6)*KWj?xZ5Mc(k(>G*6%$wq1^Cld`yh-!h zy!qp|c@veV%~gerk`xJ5Fx%T;JH4%t};k;SJ!vN4+EPwHz0fJUr|MSRPN{a zVJV#{4r{F19#t%!qS>$k_(KvxRnjKewN6t)c z8w=61CA8gLOetG8JKmByt=t`zA$!qeUwUkwR!t#P*r3-woqdbG!3uxO>t7HovpPae zpmWyYTnc{M>%{wU@U@J}@sy!MMo4}IlyT-63;8u6sVD(0mXT%oOwsWcy==~mXY0H% zt2!;Dk`xj@m|Ug&Mu?Qb&swDE+{U(v&h7MrF`NrkLm{#jMMgE(xXyM0>>$;CN{td)GF?_33`p1^v%>!xoG!0?;CEkdE#M5&s|@4 zPX!F&L=1! z_d}4Xf}DET%U5vTg}k4;*z0gh(3p?zynTA?jZ zArkCmm(uxz-^AXFiP&2$@|m=Q&74Xo zvjRzdALr<7^;16+T)o7d@npeXqGk1XI9s?ZWp~5vv+MD^5<*#Q6C+!uT*!&uT2a&U ziu0$ub%j3ji_hZ+PK5g5pg#2Ce$h9UNf2M#v{i2CaU@j_x+2hc_lvitKH(+hZFTTV zm*n0@(V*r?sU@N3_~h&LkbR!rIhmB*ism~#>G^AfJX#^{3yrmNHT(;em5J*%OkE2e zQ_=A4;nNh}H1;Oj=yO0^QJg1lA?aJ?M4kr;*HqMYgo^u=@uVt%vashnVU$-4W{G3T)}vy+ zrN8_To`d`#dRRg)0Gxe(iRHx+HNe*6odaiyQbor$d_cgKv<3YU>TM zq~nT9l33Pc{6b+VtP2=>xWdsHv~$24wa#zA>;|c=0`N3`*%D|Jf1YZ=I>3Lh6FUMA zaQDNCr*}vC_R(yme&k7O?AZbcb_kI}N5e4drQwPH3~(zBtR!Fk9^l?iqI=lE4p@;? zTwC#fK2{0nW;l_35v+#+a!Cag3K%lJX;z=nadSR{*Tx;ud#^HL!h}9%K zH)3DSbAv4`AF6~KAz1Q}pg3ayXOmcbgBNa#~4Sd;J0STXjW8Lg} z2Na{m@k!_|G0-TNN}iM>XU~a%wwNc)t6J2=wJ(aKX7+ziWgh`rJFu=70p@Sh!*TLO z>uwEwvVKe_{M;J=Pi3ETJ%0RndI^tPNGh}GeL*l9V7`;tS;Ik*m@H^^-uXZX^)Z+p zt)Ph1L~zpYmn(?-QqK1CDv*()Pu5MTSY1D1P<1!f0%MJlhABKO{w4QU#9kD0*2S;P z{*qIevnWwHP@IX0euOxj9mG8Y0e>%LU)i)WU~yc3@jv;5CNZy@)Ba;Mrgg#S2V8W& z)cyz&H&$fVupkVw!jx29ONK?H2KLoskhKBa$dH=_Ib>oCTvygYGg1cDE{#?xwOovD z7<*z~;?fZ1TB=D7MZPeaBYGCXc+GvFSki=HK2xTNueV0NWwc(!vXtd+C-UG|2E!{{8NJ)1Kn?}03JEa?>L%JoUTe>Bm?*{$F{hxbgp1EdD_T|w& z3Uy$Q!p}b4>V>4srhNfU=YTi!@;T1}|D|QZ-!}s!@GJ zH|kRsRd`#oqN=RmVse{ppV*4P%-ZJkqNh!!sGaoigM^D6(Y z60=UN(BSqySXYyrU{}Vq2*DH1jV?h>$*&ynb3z*gW6q~S)4-Z)0mK+s=uDmeH2Zlj$@@? zFhys-z(_F(fOFDYO0sGu-t&VgJbeZAXHwNYqhY9hL}QZj^2~# zHN25s$!b@SDoBwR;pAZbk4e>CC>L+n&_aZwg^hUz@TBSxFsX{yt0~_s%|+6sH+E_6 zK^np(5S;*H&~q)qH}1+YSeA0@Wc@g)`Vj<|4W3l(1W&4p|2?T{CgkY6eYV5-%z9~6 z>HsKv+T~Vazx%LwgcotUAzQ;kZj*Bw^UTXOdV9Z6DV6k!>3Mu$GIW=M=$>%hOwb+a3trkXROD3d)Qi6Ysxx69$J3rQHi)-|m2WRoHri*~T^ zM0-$+7I>`k8+grST7gy7r>(KNipoD#Sx;MlRn|57kgD`H3_h1KvRUe4AEh7kazZahUhJA9y#7FeB|}K%lUNcI9n^cgh%@6n zN<9mbnT@J%Jdj)@DMo3`{P4^4CqK&QzwtV**}81=!A_%TsQHF;`WQ(PP=*1ziC4uv-3K%AjcQ#65@w# z=!0W=>QU2>{=t$@U|$H2`Oeui$*w`>m@&+b2R|~?(I`$M8+fR-^fx)@>vO`L4D`Jn zd)8zceOqhE?Ql$VjFcRV$M31yg-C1*8`NUYV=-at>~SkTS!@!rcq(6UI8kSd4{mwe zJhr@Tm-}~jFXS9}1m`XY#XGus!oQb=_jgOMrS81x>C$SULxSU!fabp7%PSA!5PXD@S}BY*AjbXC2>w3Wk_@ zD6ZD9>1ReBgrY^64hd0I7#nQ=B)@V@F>YUL)u$dMA1ZC)HzG2M>OSvnQsH|-@gP>d zAmnu+n=(;_;s(0jMjJ)io2Pd>_CvZSRTch1m=x`f-w~sHbMEB|FaZrR(EmPs&^xyM z$^{$LjM_)6ubd*n>ibGoFj)pDd*?2%Fd1M`F(}dryhdr>JBB|U8}sk|$rA75^X19O zOMLAet#EPc$S-HcwIfWeew;%euR?KUpG9^YBF&eq7*F&r0&VZKVDecp;m#QU-Gael zkSqT8^c1g6@6b)ycd`d@m(*`--+|lSC3n&f?eE^>>HYW^NE}! zw0KN7GA?HBX{o!U??aW3bB!7mmJEY`_q`SK!?6xVY~fL4Rn(V-r45>7y2@^S<2>FV zZ-eB1x1pCfhXajaw2Hb+{ThmPcy3L;G`n7}pUc>uSt+DBE3WO`p?Auvz@`3pgENJG zXX84@tUZhnoR4=OlOu3jbKCCPh(@0^qc%r?9_#6KXgY~tYT_yogxk#$e#I;sfGpgn z@-ETsXJhs0y{(#;TC@?t8q-|K#wDm4`A1{qCc+^0*5YwV1BH9>)=HyB zmhf8%6>3?f?ha}(s0uNtGzWvD2!5xlGOdqugQNIeXB9&-AgK0=sTi=MK2PZi$j_J3 zR-J{Z)I2|sMeRiy434kZ`6jfmky(<6zUk$8F**D0JaLtyf@1Z85wz4R3e5q-l)a2J{n{qTVIIfx^u zbW$4nT59o*6YJ{{3h2F6%ARj=&tnxjr2l7<+IvgRv6Xf@WCON?qcKyrafC@SOubp# zk;_eSc?N^hu_ML&wF2LkrN~3MJSRdN4BtA6P7xxy7l=V#UvD~}j#3383_(P>7!@Mo zwK-OOSceIKL+obn8Kbe#ae$CGu2Go$IR^CI`YYU?dxH?88v6QWpw}e&tDzyyjpL*T zfXW(dZxj=e*e?}AlV)O-BO?uQPQ(`qLP_>H#huV!d-HLMQoi{Ys=0hJOiG8W-x5D+ zG#&~i%H8H_!!jy_G~UQdNh1z+Hlg#pVyE&GB_d8tR7tGTZ~x4k9UuK%&t44n11WiJ zS$n*0KuLV!Q`E`OkNr&e+GP9A*o(@Gj@jlQ1=JN|>2gLwC>eE#8)J9q79OK+0Q{@* zb$$s0FPj4L$z@}NPbD`uO*G^Ezba76M-d5GY<#}eXMo?Y# zXYhy9*&W%4vUmSR3B5q11-CioG7wK&bl{<}76=O!&pnK2*(hyj8laJ(?LMry1Eqg4 zx)8i0Jvt@m$h+5Dc6X7gv3C3XQ%I9w-n^5?2 zI6@0rz7bn5R{ACCk*3}x;fI@y-55>T&t@=LwRikghIjVo`%{(L2?9_m5>JFj>jJu^ z!H?-DJM1lj+9_@(%haPEITk_WgBDn#bk>`0-Z2BI@WsL-eq^oMnS8i9oI(PeMkvRG zlCrXnohDTP0{s+3^D%*w315%atOXH3pes$ygDcOVO{jn$h2n6+EaNlHi_6hK=Y&4- zYF&LUUNvPK_KnQ;GgPqcFP71tYcHrRK*d%+V@A7b{bN9vg1`v0(A)uIgwIg2oQ@JK z!Zf=Dj@)E+zQfU-4vSJIz(Av62#G8UaQJ4C{!G%%`vQ+z(T!a|?wRB&@*15H-VmvO zjgtCcmIgJlwYB-H**4JXNv*Psz&z1&&*i(sCL=tfsB6H8JrQ0PjBHtE8G(+jYuIA( zL>%q1v%vr2u#>=xIsXemQ}v5XEB;V~cyjBzms_b(Ik^A$zH^?45zj<^HW@ZqLE}nar8$E2Z8~QvH+zAeFc4I_e#uB$hBM z5k!WDEXv#BjQK)6`(pU;ea5Nc?>Fj!-Px(FHy4O*$0>eqd022uOJIwgx%f+Q7ISq*w$iUnOYHz5Jehbu-J|#=s;`Ig7 zKDqQhT?re<;; zN;9X-{3JXI3_p4mp_Mj9@S_(3*@>X3ey-juo6Elg-oYn7y8c4@j7IEd- zLqC+di6}E_50jh}%?G8J42=ehrwts-&vL5!XP)m+2#dXNWoJR%kO?K&1odg*GMx-z ziuGc?J%?@3d?}jXAjT!aIaYwIo^r+K|)#Q(Sa2&9Ej+6l@B+OPO~z_Wh(*yQlOGik!9deeva_Tln&!W|OXnSD?cRm` zTxf=(Y^;Y4Uz~pcpR}|%j=-eHEz}&DKzg! z#tp8rWvG^9+~2x$g@dT!;^WMGN{pktl)PFs*(VXhVDXZyLViNIa}M79@Hpm?)fsEe zJo`G(2!YSe(krN%EHriDznT7SZFNH7*@cIvXaBY3mRxtgtOu%(MP^52^a%vS$7}R> zyUV>#@@8=`Locafou(fliN(_MB9k~jZi<_IYWfORvT?di{KG^}iyXYT!H=@wqkcn5m zc@XK7@rC!Omw}emi*P)LfZmNp>-b|K=4sr$du{3Ue%+i^4&L16zVz)hyZHqpWxR!> zxxpmqfM%U{x$>s=_)BY?9`79{YWT}IO|NmsqhM|@-5vV#keYYZ@CB>evk&5+3Ee%0 zv{BaF0dtQXT6_yJ1Ps=BaaP<-tqUXjz6s$ZGACNwx}I-hG?oWy*+nbp*M~Q+XekkN z^1sNo*IdIGY3RX#2 zlLS{K4Zht_T?bBS{qD~l0sy-kH1tcMn6QLnP#lXcb$S?YU(=4+0bU9xaUBn<+u&xB zdBE?W&Mv>kat9Jc>1q11Y^)QFV%s3IcGz#b8}p0&Qf`zj;Xj7`n`M` zQVStWXQ*NgO|^4bxHcKx5pq^>(vyJEi%4cGhI5_Tk?f0+#O+h0395zZ8aQM})!6-f zFNmakg8F7moiArS8-WzXXJK)Kvy>C)HIt zQ!lXOt{D(AYQG-#@6rGbno6Db{P=Ok36J;cbnOS|ZdLk35@N9Q3CjWRM?NjLQKa19G z6`zrA{GIXAp4R)K2T>Y7$mGkZ4TwEIskcUqLGE#uaZMU|6!Kkj-X~B_tqUt>8dnGRfo#k^N=SGJt54F1$7k5pE?EmC#oHso(HA>ob zWWD{arxkm2TBaKAn-#-#?YK62WN~l}0-gcjoVBC&9ZSAO|Edn_+jC;YWbcn#-^}F- zMz>y{NrnsY@(wfdN?&sHwaEdvAYZf%T}DaAVi}K zIl93PyMp?w7_3i3nEe-h{z%1;ls~oIvN%8Yn6Hl@L;3YsY`^)Rs=`!R(CY@`!TH5y zf`}^52LvLVM|_Yy4MQ2iP0tGu}OhZVa_xA*lE{z*Z^bz6$XJ-;m;QF zew)uuY&#&tKi6oJw2n|Bf7p5jTkhyDV3mN5Awh1$CBmO0I$iHK@v-Msm!_>Tg=ksq zj~2Idm1&qiz;H|6ybaO&BAu)n?G1)L8WgQbLUf4<@AcT1qr>`DB>9PSBaNAm-d_4i z8N<4iIHwH`#pn|QpeutPHNL!&+&`SMXP7>|Mpe-nH2H$cS*|lHB5? z%W6QoP4&9F*6#~ptk6^9(Kab$JYs&wD2$J~HbM(z-`h1Qw`!Q>Ib0IreGBZKe@({; zG~DA`bQr)ugBrZAd2?cPSjC$J*V>Cw zci<=V6wMm_X!ovGClPu46{yJo20@h)nn46ydIH}#gGGxsFWl^pGJH#gvzCwJS^Nz! z>$4koaf|g1ktT(ctGT!|5UVJHn@=kj(6r2AON?Kj&rg8n z6E)C$3jczTUr!_LM(c>b$dFSbu&Qx0>izPAAsY3m&n)ENPmqJrPK9#hb7~)rx0lC5 z$M|K%yzvDi{`0SQnDSc3^p3c0Nmm$~uGytXGMLFxSqgn%c5yBc@=X+!{GC7y*i@r( z0e*o&8JUNKX3HOYuMDS+siAy}%SCs@mp0x@C9H^MveR`&EXn*n{kB%luCbT|rY`%z;^yv!hDTa3r^X7zvPydi!#Z!UZ* zp6uqt8srns##vsc{B_<;|LeSY&BQ<1*&YI-oL!czej3YW_nIMdR171V>h{ z!K<8#O+ywIZnvrhGa&i0Z;SB-a)J7Kt%`owIuineSS94#Os`Tni(vRqr z##b3hel<-;%8bB&yl{TBy#;M#$(lniH1QllMTC6#%6cV)GdU>XiyL+BWZk!50!pjy z0e8+U7w$f|+?;D$Dutm5#0>OQCAZ%g`6?mivQ}j~`%v3>jN(ae8zHQ#;1%f^c$|K& zH>}>6QeYuFd%Dr$xD|E4BDIn+Gje@UE|$<`*Mk*7~9@NNa|iWV?}=PbTLM5n4|Y;*Rj^<*Hrx5XJGL^W1sW z(Y`p`yj+UDLC>HLZ_luwVM9~~@GF@A&Yaxp2;pSid=X1Zq=i2EmbhN0B%M{MtA0u+{+??*o)D0Z^8!3#Tk&I=yD0UrIh&X(I?iNi?}JX6UNu!@v<Hh>=1!|4-u*S9wO50XUg;Y zdEQ$xqGb~Pv$g&cJiS=eL6FA2e!X8R-8i|u!V|}H#p55Iw~}hDP5Q)kLP@CE$WJ$N z3lN>8wk}_=*YPdIjqffZPz?7!B}1T5*Y0nEYpu%>M~AeA)mltT_12CEQ|!l^hk}8K zJGTU0R38qU;6DeB(*>`GU8r;+hgS0u-aB6|we40VJ-Is#Uhb`=yP$UC-YtFJ4H`eU*KYJEyf+v4d<#H{UT`cv5N{52_1UZ98M6hCijRf0}2x zg5{{`zsiL>wfxSddl1#+3Z^qMzhhRHFUwRaVGd$agJ(Vzo6e+8niaRFb)SKdgW? zu=UM`SE0fOF6^n=Do8|OGU161=bX_Ab54-Ez- z{&6@j_qsI+F)g=}O-}6hoIv+7p7BB~H!O5pP7lU{%!zm(xCTY#4Xw$~^A>p3qf^p% z9tkIv6{OgkK9S%PC*VpeB5yxFdHy+Y;s`#RIC*x)wcMGHCk|l?XuZEv5=Qq+)XJN z_LLNFO|Dth_j#`FWX)Nr_uY^qJ3C@pQTgb!27_Cz^A(IIF{Xk=zjzF5l*`Ajc$Xr& z6%4{u`KaD!i$(Q4?TvGb0Ir^q1FL=o!=Y2~)dTZ*_1NX9OlE0~M(QaT?lJxnmG)V2 z^VOv0dV@?+C^#sd937)?GUr7x4jl%J3`MoKOG`$MxB^UIS>kE1u>HFH0R;GNSWooW?Jags5ycpdk=q@u4 zWnOI(!qIEZqz(sh;n)MRTGml(Oz>P0uvx?($R0xJjP-UP?pwd^(Rb|=?8;kr5Xcr5 zNa6B3pS0Zn96V8k7#@DYW6A5pr`d900=12I*cHRHhgZY6r}cRE2!n39r33dbPhCkz z!FSJ=n{9k&oyJy6Y%?t;y-6r6aQ7UPEVe)acaIU{8m+Sc5X1f1U;2e$)94Cw;TWMd ztYCXqNC9aIvj=nMp-OyT0aS@ErX17$REfcZMWqjeMLFQXBI<|1B0vP(%xfYh05#`D z8y>zV@^~Nt5tlZrAuQiPfzO^N3&qfv#3wBGJ3+GPGoRlu-otrU#Lb#M9)K**$Oaex56M{)VA4F9!31|Yh|KE{-T)O{3 z0`C1L0Y}Wf=cVkI!^XXoL*@dB#C_M-&bP&)33xlk(i;_Er~N1aB6s-?QhFXUEkuJ8 zwIum1_UNBQ*5)Ihp3i0foR+H=OO`UBqRC{=P26SEix&Vd76G$GcNBk9fUIB&(C?7~ zOlAjDfS6zkkgb}g4S&49d9QH1aUvB3{YD6u%>#Px-BI5o1$d1RM;`;k#7y=6mj0R_ zq(9GeQa>vSsHq;rpE^o|jZnAI7$OT5HaK@2-GnSqX_t!C^Eh?F^)E0=!d}NNX1S6C zePSoiO?uyyGW;evq3P;ifQ-96>+%JtpKhsXq<4vyqo(ch#Arc>Lbh+ot zcrmP2hCMWGpjDP@A$L8j(9JP>$J-L=q)%c8MU8rp?bdJ|)h}B0<~N#(nL3mPZf5F5 zU1W9bhvd#@>2Uk?SSBF;m8mt3`$wjhU%@3&`}Z+j``0m@HmitPLM_(4;?03QF|Ek# zV!hbo3p#yK>}5LZ>AT;>g1e$U3N$gC1WjS={D?t|n8>pOpMl?*VR&avIYzZr{z3hz z|EB)DF~2NGz>B=egAyz(j9Uv~MCbJ7T=fBGYCXQD%R>qVufHaknK5`=C<3&<8wS7L z&Ft%thfHmy4L3*|oT=?Op33D4dA#F)g#vf{q1$%jHC35(_s_|-Ulo(wW#%#unc81a z!M7#f=7@nzEyO@{LqX!c7Li^9E~i06PT_@%-eacL49L{#0-4%2aHiIx)Ns<#7L9D| zC$F}71ttwDc%VpFa^1f|sbnFI8sypPx_LeCpm@0R_1lZxJ}V8hnmCW4Spi3_56Bd8 zn0Wp^oo2u4m5mv)J3Aoq8b~8Ylxp=w!PK8p!lj(e(BgNhZ3m%OFwzp0oXX%(t(FCL z6({5HUJmiVoaGw*zoXQZtyl(mDG2vFy_BFm)ZA?cJ=0~U9*wD`i zT-f`*Zd)0S$C1h`0ta~&^#0zQ4oMUT(Y(x=eIEs!)sTsmRaC`gRFLDnU!SB0NIXsC zjP%s3{3i9zhRh7{)(grs%Q)jefm%V^DB!DqLO4ahi&t4Xn6l!TIJwKedgH8!$xuNs zZ3gO^6e-EusJGGBqeHCOqTHbz8;Oz~jIT{+Zs(qvkj`besG|!dmKq*jL~GD>nxdIa zocAXOGxZC@lOoWG|!@~kmrFfuSOVQnBFC|JE@h$hTAVR?^YTIKks zo`b^QG3M6MsY5EfK&qxcPYCniCxr5y(>3Erd`eFQM%@jl-O=;wZCV*TQkp!s(O2b- z35s#r%E$ynjZJUhqHvDc%F#C@1TInnI!60DX{2(5wxEB=v6zPaYK}`&My3Q2lqUC4 z)^o{pzKopMM}M-+quRVu&aoc*p%kPu8jRzHd`xLvYTNM^kA0!0che>xf9oR&0oqP`G$DGxCWKBi24F($d zV=*M+UABm%JobYglqu`6O3~zBKyEn=$SsrSQn;IMRd#NcGHew!XIX+? zH;q{hcwr7FJj@I^{CK@dO64e$mYL<4hGF*&j#XKo*xtWH;*M2?Ng6Nv)f2Qh99Cp< z?0`9UBl4ZXL{x@$Uwo^4tlYQkZ2F9E`+Sn){N5pxVG1VVUFsH-mG>q5%bGxp+jj;U z8rbsn-$8Fy#iN+mW|c}ia9BqQbKPKFAJBMg~+OIbqF1=^)`k+18Su?*pjK5P;g`qPJ}>);0xoOFmMY?GMx@g7CD-tWpP8G_@hB zn*?_JohN-ek>J&xPy(B*y;x;y?6bR(Qls99+r?|gGN9+IDq)Xqaa};)&?J)>8YH`P zVR|HZ4O+!6ZVN}c){IH|b_xlODbH=1O(|dP34v3}DjWbkq4-Eo3_EZ?&=bsW0BN&4 zMe19>qzph$m|cbf(q{c{X_KGy|EIJG_ZPM4OdXeg@)8a7ot57e=Yk;?j+gc$Kx_i9 zRbXP11t2R9n^9i>2{*3=Zk3gI7^hD4keX+p%#WgE!n!f3B*V;X1OcnUUl1+?*1SnUVKmd@NYs;yif}&X(EhEnXpuobnmP&xFwD?vBO&BVXV3c--T#F6B#USU%5X6N}4kFxNpUl~#(^Tdel{j8|Q zt`U%uVsWQGUPaM;78X^vT)1RC;ux4`PCrzl|ATCnFGlb_BAcKGWz(#Bl0o$B-SsUE z_oU>36x*D4el5ogg>oa8y1Ot#?AN1%6GEE~#IA;Gj|(oP{~5CB_#3SV`4?Jo2_Ftd zHiQ0!Y+8cR3J_SW_y<~H-Fei~`cJgtsF5!JG2YDHyIl3}cylmm^8W&@fcYEQH2w>% z2>hnANLfstVM({d2@>B)&fazJbVpK5Fx+*ZkkIMZct9&W0A%z1AGG5C$_~(jS-}IC z6U4HKD7=C(`wOA5a__5BcK1W=y>~j0}-5g zK7ztvA>IJM3OF#ZxiF%lDyjJ<$dh*Ylh^_tg3>lI#GlM_lbn{(6R=m&1o)cp*d;s3 zR<-Vnz`ybMq$aVBYEk9~l~ORy0j>i0mO{GpuGZKl9=MP9C$?mR5lMk?aqqQ&pEDsu zHJk@RUM2o3^2~5Yek89;nL9C*pNX5C_#cty!zW+cc*Q0|l`U=E8NrcfIw10#5?P=5 zNqajQHB5Z9_DL+y&Qp0q{Aj!bzfZXrR*AaY*GGbnk!L3m>>4=oJOGY7_x>Gu{vd|r zyghk}3$`gvz&1r1*ru2PYzniM%Sy0K!TB$n0s^o!h2&@qCS-gx@EEb-9nrsj*LF#f z<0W_8U!5bgo6#Jvswf*93saAD?WD>J*PmqUgjUT!0C{H;5895B!tVmC zr~E+P`SOd5^IZFI+l^2#ZQ$-}wF36%K;9W?wUSPj@n0}S)+0;-at6y3W?-3OD?Fw- zYY;Z>NonY}tE%y6M)rzbTXlW>CwP&=mBR@Heuv#)n8E=JQ)oZJ6!`$8sZ(?6`T7+A zX@)4MAnblJ(AlD*kfurJ58uj>!&Qed(r9_GLWgMEqM21INO+cRI=z zsuGAk_!zMvO{3^uK-~E{DNcQP+D(ru~US;&SUIqHk`Ktfx>s3s9QJ>s6p72Q=9%HcP#=kwp+Z${z9Sl|G^K3BxVz)Mt+>rmjVuiwpZoDdCUAL*;mj z{JR%QVRPr)WmfDD5CuLM#ccTlQLq6fW^IMS{Hb|yBs=e}glE!|De3pQ&MBxGK$_WM zi_;Gla44p?l(D|6cAVu zlR3ippRQNE`}cZP7I?kN4Op)-0@kY4Mj*)UYS$ zuVw$sdR5Us*Q<{ItXIW7tXB~{fS4(d>s8bb>s7|!^{NYCy=p3uuDSGSB+ARr6XbH9 zVuUae4Mn=3W6;+|1?#VJ%O-}&H)tVIACrZ_8&>>)h$;44#MDv(iUwQvFY@e+qTIp+lohup_k3Q5{z9KhEU2fAuFi)IZ@Oij+U#pE zD)8f`eh*mj4;;JnP}0)vzLqyU!KeTFJ=UTCjjauHJk`6qMJmvX(lsVDEmA^?_E#K% z5Hcnog}O+28&+HPLPDXC*xEDoavSeX-`@f4&RvM;HS?UpsT^X*H?aoS;qZ6TJ5==C zXhiSSODqZVY3bv>`2zv%$TeWjwek}+1vsF+T=^v%_Zf82a>{=VXuAUeZ7-YAs1?WY zWW1>O+@C%}9ExbshCF*WxTEoT8J~-=97zDV?u0{FOI5mr{f8sNNAtj7+ZL0r!tQ}OtJ$B zZR|*vkTDDnxk5+cO4-O9(Y>#$Z(zBMT80(1Os3?u;kyiJEjh{J!VG~z%?0V(F|9lV zVohZ2w%QaVNzHt*9umc4AdfxVa1*bVtPX#ucPpbYyzhG>xw6ggCwt!mY;(o`Z*OzG zla*gGb}VK>^A-KpJrHyuUk`<<@sGp{+5<<_<3$12IK91!k0!!5X9B=iIEO zD8c|u*WqgE<^Q{FF7PxLIF1ctf3&d~q+RQGi0q3C%4;JbF++&=KfJUd@RACYuK7M^ zkzwG0V4FO8ioltMNRqcqP^Z;3oe)tXyGn)wi4F0-Ee9@qTwGt1A|UU?H;S$+s#hwr`=qq4i<6s<`kfxwlK zR{N+po z&hL2CS1%CKyAe}=nbiFk>SyV1cDVI9dn>dDk2<0Ol6vTH#CGZ@>aa={>rGF>tT#5Y zARqCnDuPn34QJ%^GT5c>0QEBnR)?jKnmJz^vJ-}52Q<>fHd4^6%o&5Ap%{jX#?|*;#U|Bbrx>UZD&QM$WCK; zZ^j6s^6H|ya%jLif!7hS6|N<1?l>&*%(T0KZyJ*)sw?sWt*4`##GvoXmG%Usa1(Dc z{MN|?%=f2)mtc*z3JXj&e4MmfTfzu$mS3h7f#zPECp6zyVznHh{MS|tQf1SEwL}nH zKu(iX@>5q&GaMss7#%{_c^P1*~p5LcV3e1LMbbrW}2ugnJ>ZB7!H~j z=f@~0fhzK5R-z0Aj=4J{uYP%|6web{XLuhCma_!mFmgkXI%^c*?AULA!wWZ<;Un<| zJ=9`EzQx4;#CdMg4;N=A1pL`0aaJH(qgi|rn0WA6`O=J;I}&cTx9<`-kxD5xiysLjX3_6`1MqHa7E z2}?W_{y{+jvxr;bwTg`m5_NC_%_y2;)Kd|A!r6-8&F)TKSv`%j+R!SHbf6&57fLp= zZxG^=5TL}QrMS%j7GPe=O&8zC(~m?t>l7L>`X9v@Ij^CagA=8=S^EhLp>nl;jZpDC zx1L%IgL(DNFCyTNuA&QePvFU&?ZOQ<(r(JQ<9S@?yF>HM4rGj-QO4frPiv*WD(UzQ z(eu!uZuC`K#=lp(65U5SU4<==-G`uE_CF6$ZrU3#NRX%lR?kce1(h@ zSwI?sxyU{dGEUe{_5o-fOrj!zO?xcSg0W%0t1hEN@Ick&S<)K3+^0aNl5&%9 zpz2aAUP3O+<}F`zkMt!0q}Al?dL;WFvxg646b6C%r34E$U6{D7s$Ya;Lw|FdgrO`9 z#jC0e*uyxb1CUHvaz?sl1*~&qPF^1O2i9t!>O$hKJ;G%B6n|V@haU;3x>T5&!_Ulm zB=(O@OxbK6At;*QurzlO@IEIpR4Esf&8Hn{vT)3$(;y8f6Rh*~p+BHGc+x-Xo$$i# z+h0`|aMPuu5!4}!%w;PmkR|c4wb^>nqY#L_+JC-ymIV}DVm{{AVN$(7YDW)^Ew=Pa zsbP})hHaXi`qW|{O}zZGE`zHonXH=glwn5rQ-s~Q{@C}sg}dT&f!U1w8%8_crMmxH zvxjRa1o>TtfF~gQ%+06IId1VIz~%CebzQ7@yJ=J4w7xe1c)CotUp0%yY4*y}FXS|Q z{qRogJ)4ETh|ZKqGU5}zK2emWnUBxJYgUrfF%}|+B*u2L8=Z;Ok9wXL-hGZQ50qO( zg({)YhS==z#%ky_)3K6(Zi^ZI#AcD=8w^6_wRBRljU40FmJ=+O;t?YX+`uDWOeRb{rP^$bdcaDf)Kvm ztnYC{=4ms*~eUNEcKD5Px;LV ztcVB-A^l$^#woW&4LwtVZVTwIa!V!#H>0|ol-&m+e}mwZ#n$|C%7EC=Ik*{@@L{XQ zU{d@2TqYTD*ss2eo!XPwkee(Stt8G4j9YMeOv5WquV@=h}5 zd}W9XuCIW5EEmM2Pp^9x395`5y5o7DD8}q%QiT+<6prOffJl^Gpt&8TjFQ|69;mh2 z%vsVdJm0Xs$c=5igwca@6aLU8s03cc)wHUa85_S0Yr3_~Y>9@4Rlz7H4^oSUdD}_-EMPUqW$8io^RvTfv_^Zk3}?Sx_SDx zZHtVHMw}A~!ozV9>h0!qcHsCr&Z707)kzS~-Z{Qx6EHgowZPlvaDDnDrnGY6ZSC%Q zMDC)~EhS^r4?+uyH|dZ#e)37eDvami4j{9_66&pInvwH~(KPP#eOGMhtc((Akq4Iz zU!rBi@NkJPaA&q%F1}&vPIbtY!*4SLMzqIbT%HA|=!2k66Gtglf`UT2T70}#fAvdUV z`oQm4XFEDL&8Ry&LUZtqfo`=lb#(VKR8nm6Tv|)VD-gouGKv(xUukV4p)~Jzi6ve= z>p8qWT|O0QZkDy1B=yo8eL-Q~MNxu+YaprF)S2-RC*F z{t9`0-5Jl9WJutioxZ@`plP~n5UNw{8+->$90cFRuHbNwfim+7onPo2xfCtpF6@xX zz7N#maSrG=)qKC&+rMagoLO*@DQ%7!8E2jPbv!;wKB3ck{2#@ZlfR2CnQ{DCD466X zqYB@H5eH~-n6>N4suG9w3^mZWzbr!G8`CJCe_qd85piKDkP45xqXPaE+#=S}7;H%K zuhm)^Ks=#vHn)&*G*RZAMWf{;Gx&}lWjP^CvGCYp@yw)}NbVF@6VI)o{mi6w7~jgo zK}j=TMM7!Lei4OfKi=15rIVhI$X_Z z7ALI#%fdzj1<(H>%w=tKlI1iW9~tM_`6-|Y7v1ufwUlx0;NpTkj=@g&FpB;Dx@Ccf zANueHxAo+^_h!eLYbjg!!js?2uHy@n&hknOS27czmhtSZP}!Du$lz@VuLX90VA|F9 z&UAau3z&9|2X8~{U)^$pw;|Al79ufxg0owiZ)UHo-E+g1X&0@o;}c7GNzSZ7tb-qG zESL1)8Vktn0_%5;1><>F!c8LRS$t%z%^ z;j;8I_kHuQxVWfHBiT>yXG-k5+O`#rZq=2-fPvRd;)^);<)$gewkGY;`8k9gLeO9d z#1kw&$8vtSpG53zjjbA>1RnK9qq&=y6sSxgC;HV$F$C&ZKP*;tOmfgYgdv8cRNIDO zdkEAgvAckKjRtbVi7DmCfTGWcJ;!<`j|;CXj|;Ef|6X|g9}c`i&PC*&QGAlp;kwiu z0i%kYCf&qxc=b>f=L~i-TOI~<7}*&$OQEdU+5vOFV82+pQTAX$o}IGDN?~Cps^p=d ze}0ErWKAm+gw=_|J&Bm|bqCtY31$#b6#-OHM|ajxIg9#xPQG_haS~jjEvL%v zJ7r3S8?CIkeO(kh(EKy4hu09UxVFegJ@M^@$XR}K3M;9+=5#VL1^ueDxM7Bhq}P>( zktcZeRa~bi(vsJy0r_BxAWQ4f244Op{Jl*C){Z!0S zT?1(;rr8&$Dx2^IrF-q=z^p66(kK=UsPe+8S;t2tBH2L=nOEyKp?F3Nth!eJ-Xf9w zMVZ+3gv3JSu7KBfxxq%ChVOHhKnO2u7RH5}=37uH04U~y0YxbQP(=G1P&|GB6oXY~ zxhzJ&fa0xza<1FB2gk9z_5Nz9K?l=GS?fN-X8=&_lzVE&MVMXaBEEq6xax}8kwXqQ z4Tnui*r`f)9Fd|W3LbPFWeD)=MbeA^B-5~1cdoE8#YbIx@?lbEo(4n%GA|r|+(Ah= za4HLbwiwskSPD6(-}GKOm0sg3)ZB*BPkLFb1pe0PgTN-vNs2j%B}wDp8CR5(`S)DyO}Ck^cNMi+M9k!3JDME+5)&(q6H>ZZKJiaC}Hml0Ky&!s@( zA2cr0<=OU@q?E4EML}18^c7?z5#^3+Sw}%n_6B6`efkmmlCP>wYqnpeqj|Vv+eT8DIDvMUyn>VyC7J3?o31h*#adhJ{aw!%@YC1-;bF?eZP#O^_LtEqJx3 zDP&T$`dP1}o&}e<;;|@JfmfJkz?l8Z1O_Bqzb@FM(k5!&GSEv=DP^bZtx6$}6ssX9 z%pWxxneJjQ;6_2kK=HN)=L$ErLZH;N$E0nrSo^!V>ojrwNr+e?tv4B)z^7#)Fjh%8 zB#FSd0RlJ07N57I`OStxyOqsN(-h>#iw`B&eam0p890uQ!&(USGAC`}GbE4UG{As? z&>rtJd4cPOP&$^8-#*uIobt|3*`fVMtoRT7A{p6Kvh4`u>6a*me69HAEoloY6Y_s? zmDTYuZoEU zl^SS|Lm)<>17R6(9v3iO9rYC?M;5IL!xM?`S-g5VQGoGdc+Le$_9T#j{lFcdy0vP)|D!uSH-y@S5j58wd#N&9t+p4`vO z8LzwnL*Umw28+qRybA1kxuaQCfYg{fx~tGFDfk|3TgKr>XEic0MrT!m3f&PbOL*t^GunT8 zdKA@G%7BvTpMm~oppxhRQ=pQ(7_c5hG-8WZm2*CkR?Pp(H5MR~3ORgYTz@XV5d{jd zpn{1bf}&7h4JLt3oh3XE5l#7R2V&sVc!OUQpxClnj0!ARLbK)*EC5uCn1F1N7JFAf zF&+}|VfnbhIMCXI>z_JQ_rU}Qbmb>+s^PEA#Jm^E-yxxm0%cmL()F~_C;=#hX^Abg zjh&vPe9(V3sS^%*f?M`0-ECj}y8Gk)8z$=c3lo_FVWJ?U?@rOQv!Mk~)UL6Ca$3^OfAz&qh}C7%P>nTotor(;%~45uDfP(~qj z1F~A3O0!bsod9APJD9^Y`pf)l+HZMP53Hw?Z!J$&KaQdv#XW|Zl&D+nx8}bUO4u=t!@iFZ||ZW-@>CzN3!INb6lKJ)R3#v~2rZw8RJetyu<#M=%;( zRmvxx*vbw*I3wQhk*H37qlt$(c9Hxys_d`7@V}8Fr~g5fohqpqeiE4&CtftD??~m( zXHw((RQ?ZA#6=eQ7b()vNNCJEj|Ao{)7~h#68GuJP67YQSf&HC zp!}1wv}wmPf=Z~AF=i4@f?6`Sq+BX5hn?2Rkyrn>sw|UD^uLs%uQIy?Ea$<}=Ec8G z;*9>?v;380?<=xM*hG#0POv@*mz93EAo|y&9?_)#r)Rl4`>&p*d6Ph-PfT*0YD?Ak zV=0LLN6*r$PAnaP2MyoJ$5U>thv7HDT04ufVvoa1<}$KqTY2~_hz`{meoy&>jNizu z`UjgdEbxIb%1VWxNDD2vxX+?KRXrO<(sE8LDf~b1`six(FpwLa!}hMt_`R3GvMhQ1 z*-`$<_=JAh_}LG6L`emyi|;FmpPF_4$Ksj}f4aDQSe5}|M(R~d=$ zlsn*q_I3i6ms~s}GjT0-^~{`VGvXLg1kw6qxj1CL4AjfL=fwRM&^%9w)in^=h5sci z75!;R_RBNaKix{m!kiLAnEy71xUZ2q=YU2sYMbvUcujaT8*#4p>VqfXFOm$8uwl+; z{-V^*J3ctu#Lz9YVg5^g!!_G6_j}SE^6VVMe~?4XHhOx^B!}8yr>O-<2FT=p%!DFE-J{#0sZ0!TNAyfcg|F-0sddyknvw08K>~Ic(|Z1w$&ziRZz7U`VfFdgqdb4`!kkyqQ7Fi!!CzB zH#r?r5HW!rKCxySj%W^V%T4{K_Aky;Y;=wB%98N-t})liTdVD|_a4q)_n{FZL0FpD}Al)%<|gQa_) zIb*Az=|Ac@^b{ksd7m?ux~N46Gow=4Ri)~kb_S2ajL8G>KMhM~t9iSRl2zEh*iZ%# zNA71nVS*RgsGY5tSg;(){Ii=H&%g8C3-RCgj6YlpND-XJ#zD* zNIK_y8#&HjZZ9IMmG~6CxRFf?mPwqT&XK(GzvsM~z&K5L4)z#7ZzayYmb{Z2YuSgv z;YGn(0t1$4cQBjF)c+1x1}_YOy@3Ozq2d1}BP&CjPcCBp-)UqVf3^1B|DQ5)9Qu*q zQqbM3-n;Ckds2dT@t~J<^bSFKz5p670D1Y!Kjn_Q5)=Nt1lenq`dw+)VFJmr@zh+3eZ4~-|r!w;fa{D$!T-ohBLCX>WvtB3{KE`|0SROQN7zUWfMVqA(;Vd2RA=hjA)_%Gnq+W?*3fVs z$>Ffj8sdKm$iUm=GoXOH|8D{LhVCB$d9dOCDj;)py;QV^aj$l$N*(BqUv4oKmBnU9 zLH^;7pUC$`g*%34c{2C8M>-*!0LOGe0{CZo_H36+;(BE8LRY|AdGxMCxVuoS1bH9K z{kj~{`H@Q0R1X%pF4m2Dl2x}9^j95%00PL4ixUe1Z7kQ?$qwKGUOImJ|DZ#tfBoZq zzvVu(ej~i8L)?!y?ocU@4z9zk$qo;G1+UM+4&euaX~@7o#{YyX0l;$Q$lr418t{pt z(ZA)&1dbsbNAO>hoXV_4%qTYaj<`@P@g8tuf5Vl*Iy~|ZV{;nRKynD~zx3m3tAFXo zfe%{sZp=m>yr<7vb#9^CixY%Mpvs{))dZCA#lUVQh<}7!*nfgUrvJi^0j10*K>b*A zpa>EXJDtY7yiZ;wSe(*t^Z3hI$uV;Bstq$NtRDCY34hO41aY!ya?P(+J?k&VgZNhL z{$ev_;Nvzg(2iPn?6wb_K>K)_d0vo|w3gpo$szpn*tErN=I^kdK4!z*;o@Rvrq)nEKJHm^vA9zLKdo=EMFuALSkS=?U4GI7s^vnZ@&Y;8zX=3XkX@_p+ zom9IMhx7_t-o#_n-?q?A&=`J>R>gbgK~UR+wg0-46K4C9-|cA^k2m@y{LiFshem=O z6Vb)4?|k2mI9Tpgl3Ry>*kd(XC3%0Eb)$J~MIqgz-OQti2+aDy99t?7W;Q z8OZ(hBsiQ){(s3LXbQ(!I!#OM&s$>Ds4l({3$w(!B(hHOU8k)qHy+MeLUZ`1 zZ4wH%8bZXJklJZ7YgVo{<9v89ldHUP@Q5KlKSU=&s>mx;+Mpv4`5;U^*Y2TK5) zln(dAfC^T8W82r1Z5G%kJ*NI@lYUyTbJvvB2}1ah9qQLWu+PeGIwZUZVgBX99Z@P- zUG9S}e!QL4lhM2+f=9Q{pc%XQL+SUe5PXa70h)uW0R!-PO$4XEoPUHLa^TnP0}pK3 zMlZufaP`-`>8DQw_s6f8^ST({D1m4KVOd?8hI@kAnNwaJKFU2lUSxIU1F`#vZ zpD3~?3hv)k(Xf=D12-3)^nk$MU3SsT9oc6=$TN(uLbU3r&bXs)aKhKB zmU^K%^;_+z&IdYuFmGJh7{V(Bn!BJ%QGKQft51=p&6kxHYeU0UT257}YW@z|v0iRj zRuunkpPsiNkC!4gW0~})cC$$gW!rIZL3SO zkmN$4m~5&lY+c0%N384W3QZMDNUw>hh7RK0k&t5XMJe~rGjF4(@}1N60wU8(U(Fuo z8yE!z$nUC~V1c~F!DboEpROOIkIX9itExuE$TV$|l=bk~|Ouvjl8R(Z;$Ei===Itp4V|EzoZo-M|(oU0^b24Qs43k{|4@M<;zl5TSl@ zY(Mm8mQd9JEeCfCb$```zRth4XFq-seE?ISCjmaOp8I|L#VuZSb z6(lXL+G>=~2IaZ9s=dR74s?*6=_W#w!*Khe@QnZzt1jf4kV_L%;w z1iH=B98B{RDhr@!e7g3pK0l4Ss|@AKysRpne@S`xUbvSY9-dP;V|)(@Y<^vSBG z1VldyT14!K_MO?mF~}_mEi;NHDnuH>=0ccTY~@oa?wM~YjA!Be(F==aG1^EqW01sw zLPy2Y46w*1h~~YIzHl|xEn12|7wVU^SH%0Ax693^0ZJ6ed>Sahn|lw2T~^P8o6 zmzwuFEodm_03z{~SD81m^$OvX`Wcv`v3sJL@pXe&?kCy~f?4mVI2x_HC>WWXwQ#SC zR!DjLy(`fUGL!@bHLZwBgNiyiVJHVagN@d6S}VKq7>*tJE`-N5CMZjc$(*mYWKHuA zI{|cQd?>)xQxS>PCh!m8CsO0b=_|$VXO7swqblP|!;BmBOn8~!;hVyk%BGh^Y7o2- z*ozm8rJT?~sTvVq0Hz^14p0no}^Zj(AA~$vxC^7-RvV_%iS2n zF2;0^z^0`+1k6O&TZJ}_))ouQW8zj)uvv|x|Op}F@er=63H`rYTHT=MB zI~j?IA$C6VJIi9r?iZV_G2O_tjGB{OMo2+1G=%{5xrj`g@DoI2;PY%K2^F-?j%AaC8zvoXagNOJ0o$)LRk<_J8_T7OiD_E_kN{+{3 z>jCt2v2&!#$EI-C$=c-xR$8=}X37g9 z@r5xHv?=Sq;%KX7z74uh6d@P}T-HL}OaipVzAvUmA{LOqtCjqQ&Y|n#j_!I2oR0do z+cR{A8Yl$A^vRstz=3(^xx!9Rk!!UeTwABu=zKtFPOv&FuJBALCc{ogIPu;yQW#!! z*PbrJOS2`+pd8`~&{7}fus=wPusPf7ppbM8j#5O}bB>*V$J6HMq)=IG!24zcwGKey zdeGLl@E|?J!Da@ga_q}XO-5*zn<#a!{5sEG7cyS$L2SpxsSqC6mmr=L!-=fqa*bG< z#&IOat(B2jI!$oGqXY#HNF-zv+{u_Lhbf@&Ql0f>I^ZxIm=njHYnCTXMdCSw3VZ$Z ziOWs8%HB|a1*uFhu)*ghnNB`8F#u}Koi+<;Gl!7`rso#wBe0|PN(g=hVEJ6)If{og zQE=-8Hyzixw4Ui%wAIKeO_FRm%?!|bZy?_Z z$z5fxNz!v4Sufh+3POACxUhf1L%E@F* zqViS+^?fw^JqY$;mpIr{O!rmn0-_xa=cJVJ*-OEiClrsL=yp=(tqwQzR01Iz3aQ3P zV#Q~!ox;SB^hffe1&_hmChPLSo#SUTr)=T04g^3F)iFl&{NkMf648-_~k9a}X zgJ!V#b;OMlPUFWyaOF^4+0PM{GOj#7tKe)Z=C%YPl^0#NIOj=2d}-I&3#GeUd#QtP z5LgW34_4abG1(PC#Tz8|^;VwONU0=)bg*HEg0GGOK8ID0JfA^>00#(9-2-JEzqp`` z$@=p%gL#5)AU=H&%|@7Rn+{5_A{3r-G=D=mjfjk8##E4eG;1($MfY3?&Bk!-qLj+ zmV$A3L)(8D2X=CVfSsJIO^{)|_AMkdM(K793jFT|?p7M2!{W(9FZ4}-(J@VWyK9@` zsv}I_-OtFZ6tIH28s!X7^2`S*VvAMWNaD~?S?0>T@$w6RxAYQeid&*K;Xp0zqup4L z{M0v0&LN1D&<*hl!J7?N@DS+O-CKe5SF|g*;c}YX2TUOm`+W>93oow&{x<85a*rz% z<_ejt7L{Jc!MeOY`^@2zVB5~l2^NtsX!hT7=m{mP&L1;cViK4YWHRTsB+a5I)_wNn z6QLP!BOWOL$zXwR@uU;`)#}o=6yG2v!tAxg*5g@GX(nQYSH80+;tQW!H-^$%!5ZF+ z^Z87g!D4Yds*YpnTBozV7(U2P_}p4(Pgx*O6eFk>qRs5ZTO_tvOuKcp3_%zzuY+68 zD8*2!a#I!GiXl26Ejc{UHK*Hq?1E=uWYIbly_Rby5=zjbLk!*v6ldI3SZf~TVov*C!+8+Iy8Gzjx(xEW zn<;ViInA5XsM@^<_J%QlF$?$Gy0NvJk!8;VIGu{b^oyrSdZ>7X1r29blVDLmk}8$e zQ0Po3zGYD+6rTr2fP@dr?CnuXq}M$lF`?ouCs5EiYfH5R zbn^_E2U)P?kM_-X$!89FAYn|8Qch*`pauG;*ffc;k?YUjZ-YF{yWl(xB$wk+p^?D7 z#mh>&NdQU0r@$`rN5)y6z>vnDSQlxr&-o-stv#cojN;pCp9je5S1Y(DY@^%&gV5GQp zqzTGTM|&C0>|355tV;&oF54&lfK!i>u9tcuyk!vaPb>a3@C6PoA`;RMe|%?P6yuaL z2yo%W_RGJ&S0Qtl_L|=wjuX26HG=oNS>oSoh;dFKRW0G(B}INglCt zU7p$N>>B7!$~ozEggPBnA}kpNIEfe^xe2oW9wjq(rQU85c+&?|EZv@mAl^D-)jl!i z4|D@y945Fz79X<*5`P72t@A0X5+3p+Kd<*+qW=)=zkJY@ML%aGF>=@@{mJl9j!=2U z=>}%pxxj81h79@@JD-hv`{yaXwl8EQSX)8$4}@GW-MNKycvWG%GbD;)fL_$*Ibw~S zKg}c#*z41hlRPR;R>~+DR%ALxRl~mq7v#@+S*$I`Sh?Nz;Pp-+j*E;o8q>Uu^$v@T znwXbKOZ}-U(~#plMs#mg)fhORwJ4T_d#f=Rzg5*~IF~^mVk=d(N>jr%!)(o%)E(s4 zM64WCCA#$UCXJCWhTQ=KLg&Js-mlbvTn?y2{xy7XX`;h85z0bMx4?@Yj&B(fGt(k{ zJMkN7j2doz)8rArA%<9aV#}8Sgy8-!2s6gcJ*mv#wJlGiitS`fmyMOuK7%{THv0K& zQ`tD%!-SFaB&}BYvKUSY=Mt;U$9McJz}%~LAd+#xQxvk!zAwPPJHhd0e=*D6tDr;f z@z#gshv8SuP+E5x1}dX`!IH%o{-qkL<(NFKGDYQfP0jY=UnCe2@YwrhQsu>AO;{jV z(&$Jf{hhWANRm4FH{+-DvrXY?o6cq55k(jG?f@2}-B2;p%&+g(34B!-_ev;|`I zJd4~d^K?M|u6F3*y8L$OCZ|lU!?-~Q&rlzJTfKe^40rV=M!KdYPE#fyZ?ZHIOwJ6= zz2V~9qN_F{4`{@A!E1Kz>H{Ph{ryY3!r|UITwd+p7eH-WO5TZ@mU3G>56X2~y&iiA zcw}$&Z#8fDLGxo_9lt%T5IBEZu-V=BwLrsQO=kt&xw+hLZ*sr?o;5%zl}`sw)eqg+ zDu`yo*3Y?LNh8}M(!InqN_Tcbd6-w33XJYXXIY*U25kqBLzT6qgp(I628)tbr60+g zjk%(^14g1H|D25rUqPm#8Jp5$ze?XQhM1yZBo|~r3?EHXQyLvSaZz>`zqTk1{Cs4` zi94=3P%|Kej%a_pmXG;i(l3hSWz_Xl`*@Xn!0YbqWABdCIo+Ttl(#?%2yNK~o}%=* zP3M7VlsHaw3d~B#r&E+tH>!ImlAT~@dBI->0Zt~7$-b5y?`P!kvkZA$Xnt~P6_IxD zyf5=2_KS+B!Dh+Msqdtey1wqK!$OSY{$yR0>z_pCr>kceaLCMt0!?lSJMZixSLS5l z#e$7GzjLEYHin5x2i0_!gD9wV9EXrpiGnCp{VbfP0qBv1Z9YlhV9-pLDo2@KlsacR z0_IEm=-blanC-5=-(+l(%gPJ~PgoKU6l%RFSuC>O*OP00FT|DAs)pP-Eu0YNgl z@xHoR5>wI=yV3`Ub{^sC?tO3dbjF*z;{R#ypFQA~WaucM()Ms9Thro!AiP448UX?zdm zgzotiLV;=$x@MX@DjeRt{_S@Q=NLEMwe^F2Im< zMb*L@|6qztu`o}9%3O6Bhzf(+ZopET9hP(;^{E7iHKjzLwWWAqMw!@PyLz-+A#e&= zw4(~XRuQT$JqkLa?n=W9WsK+#co&W}*27SGFqK|hMEK-0$&x$z3b*3=VF4#uZdp`` zD=rqrJGXTZIqSyGjb<)(I`{qq0uV+j+xC$&sIoHYeylrPU-2YY<^au^B(URLa?VmN zcGzdd7>J6$fYhf`2r}}!DZ~Dkpy|z`^2U4t@*8e8CFU{TI4(N!7apTrWx^)X;Z+r5 z&BjwROXWm0k5Z6&wz&M#z$KTOvkg%gR>20WOj-_*ccwd*90eA9tvf1SfWIa8Y8Nu2}s43#`98pTKFIx_2 z-^0f-ywUaC+$pHKG$TyTEsAhUmq;Fi9jTKzBkY04FzPVue={AmxN=rN zPtU*WorU`nYGtoW4J=a+rUH~Qld9yZTxDD1(R)HwOg&;i+^!Lg?lOqj#2QwG>a9oO zcwt|0n$0#l50!LYPJ^#c_8EE|xIGnNFJ3!1)+c3eu4)M!z- zV=Aclwylh>n=Mnw5x1J8@)+>`#y`}@pe_>x=i@#240O3}6tJKCDhRNsP5um9|Mr_< zj|OVR7L5CzpiPLN!AUx|4=M!F1@>eV3c1{An&x7~mh;p26UBH7PN59Lnzgh67j#={ zQJa=+gds<*eo(M)-v>Fmh=5Wu!N|XRT^n5K;3e)hzDWuE`DQMHYl5?4_;vM{mDWD7 z@+T%ZprF(yq1o7k2NclO0!gmD4#tUkvxNk&z<(K5GRH_Khl-!>5%NXkK!{h{q|0H8 zKw|72Wcm7mOTL@PQGZfFiLYT~@csfYBC|?RQShRkY!x+YR4|urAh+`ezd?481m3jW z3h8-jKW}|SdV|PrCLi0DehlgW$sqO0F4j1jR~i6Lod%+kQiJP%PinW? z!E2&BCs!w#`NMgQak7}(UJ5jPgQYz6UOYlA376R2lPWz04_ z;<}T%)%1!S%OtXLo~hS~m0dh+&C}LJ+i$3baT#BbH%K5=AsT)Q!=R;{r z5!$j38bdp)Uz4^zWNSTA_lnTvTqy1n!$6C0!wiU^Ab}l=5MS)x0`Q(zt83p`i2Jc=4i?Sjxe&=uq{g4$sptwx|eK$&|lW#%+-R7YQ_7y6}7U_n$ z7{1hEqI9iFI0T~+QrzT1omMS=7L-2q4xm%yfM(C?Ilccn)ln2swS~&0O)8LQa7Ty9 zJwdF(N2;%-R*I{s(orlsf7%}Y^M(gSa=_|Z2ulX=q25CN>#Ae)`NJnme%pVmHzeRJ zL`to4(Rp*$V8>EJzb)3Ezt>1+)>E)n1n=>+p2?yCPHFb+B_Pu34+5~m0lW%u7g8%R z`poAj+Y4Ekxwbv;_@3U9M-)K1_dbkgJN|-TXv~T})^v#2^kb_5G5_7?!JR{Bl)c24 znFA19fhr$oY^$A#`=thsDXwxaPK@wCXx#2V(9{3TdkyT*h+`gOBz9Rkc7c{w>5cB( zU}^VRkx;A&5!M}HxG=IqXarBQ7}27M&g$UdvpGf_Q~&1D-tr16_ThU@YE(5ct#Kj6C!vo? zsi@qq%BF{xtB9B|;L^!IV{n$c$AY~xL!-0e%lcINhYfuDisAVa6Bn|%@F@)=&aI#z z^6bAY{UDZ!(7{03=G^Fq&BEND7iH!Mu4qWBD2%&c^6ZlFs7!B_*K86wqEzISUS>>4 zBLYG2c6xbdkJL9S#Hm5XS?$T8G5P^OeQ01Y#L2dvfr`{0H;qGEL2-Gu(L`TgLo|6W zz4a6}n-FGsYyGs+6@u9=g5yUVr*Amz>grB!OhFUFQN{rNn=xv7WTQ_a{-;TgP55 zy!TidHYdkeP0o8OiZ})%>zV~Xg|=XDAzsLZTmg_io_{78-4d~)eV@!f@G;v;Zmi=5 z-^y$uz`JZm+EyJPR#^Ft@aM30=4?MbO6Eq<;j7PxLc>h6Vuj=&QC=auyf0LiJ6_b5 z9~`*Na?i?{*ieI)Gkec2HsiEN<#7<y1N$fXH=Vpl+i1Q2?2p zVLEIy3;icWM7F<_9f1p>fX`FtJAq5vkXkV^3`}lzl!8*c%ECjcJ5=yYk)o(mNBJW9 zFKl=kazM~=g|AYD#pp6VX9;L1xaWpm%+_VOBOSM3eRPc6^pSAj%^QaT~=cBzUhM)-4s zB0A87nlWh1LHG|^}CTa zf9$O0cA2sJE zh_P=IY3~$9+gmeBXLott9xyZ1Q+}E!x=twF4Ms4BfC2)L4|mXEB-2R#Ggswsqe9SB z8kFCC_l~1yzOK`#YDLP9Z^82=-OXD*q((-acU_1ygEFCulxNL}UO_nlRf_PZS&*eu z3AJcM>@7n@f)@g}g7^kSO;KzImPL9ZzdOtsidVdw;s-P8<~$_lkU&$&+4b zR50BdQ!JXFk1upeQ3V62MID!N5u4q-**-B2c;Wn|R+FIp>{33<>~wt|`X7+1CF8e+ z=}99JJ5b|#TYfmIt9gUG7guA)jX1nZ%W%tX(ICEqyF{-?C?57W{H~}s^SJL~;=wBX z=>teCE;uNXrjw2|Gb8yTHXR6|Ey9 zf>RuuB_fpYPr?}v_FdkRT~fG!dPm4 z`~-n77TmF{>Dl<#p`XjZF37+kekZA&L79qTMH{mQk}5&&_`5Fl(t5Hs{86IVssk?7 zou=cMK78aO;YF%7t0jFcH_1MKmNL{r#|OSR#9xEg z(;`A&3oqMEF3F_Q7ca~ZR!M$c@)nDW7gCj&v{w*CnKUO8h3SBtk+Q<4+u(lbjD+J7 z!k)j?-!sWbg}xYP>rfxC9qWK!qhSGPz48uwV%Mp`ZI*?xU5N>!^)!9WL?GWzmzA7z z?=WZIO1H;tKH^$EyrnS06)d|TuN+7A#yDukYNC#MYnsd`W*UsG@M?(dT|dS-D;at| zTy5!|@T;)r&Vm z@G06IJvOR8XG`D=Y3pF8lg?#@kQ?qN95)qlZJPglcl@E6c_-Pb4cCxde>%1zThvI0!gE&VhFA_bz8TYc52h3WMJ^Qe28u0v_ObQ;fC0$=EsOpn)1o$!TIVC8H9Te zL#t-evH5#9c*6l{9>_VLI6`6H>G3W0so|y8^>`<)Ga%k;(v4T@jWL71@=VxSBtV)u zrT7Vh0yM^|Q3%2Z1l0?+hN!2vJNLN-2@F;&Byv%RTwmTnrf!rD)S+Vi2g=Op`8Xo%Nv0v_fhyf>>!C<}&&9>ZP-J-A z+PesHO>3Zw@N?95vO3+2nC*}jDy_)8$!09&MID;#v z0$6FQ`o8bV#AiINTpRy$)OZ+g2ak#9I*Oxog~t+D}Jw;PXnx?tZXYE z9Oq*t2fWfZg+4A+3WK8t!)Cl4txSf6hPZi|01|-0z|#?eE{Tj)6h)v9e0O~ZDzU;lB~67f5JaQta}Cbk4KL$D31e2lT~4<7*fSmlm|+bU+C zOg2FCizGL6PpA{0LE4%ya;?nB9ynk+U&AF8H%B*RPs6>o`d{$u&RfFg;vW__A%T%D zXTi`1k{slHzj|&Wd--(| zNM}dL+@Pi9|Avkbf~EF4$OS);Qml{wxf;1p{XERB*yER*S^AP3SM=lez|axEPfkJ6 zf!h}|b-iA~7TQcqgw3b{-#9}t;~HPLAH!F)7%U?(*4ftYZ;V3~4)a)Nk(QW;iAWj& zy83q*ahMqEl}16<8nsp6k(yVRXq8Che#8P}X3pL^0#x@Wku950ZnrPsDIP$}UQlur zi1Bx50&z@9%~iMaa(sVrWd?2(B|A7wQv3YC>nOIJ?kmaDNGBX^vu# zKS)5zKw+!Gkx3{(EY{h+2B;gh%7U1LIfKLS?bz&qXZ?j|I|K2w4URA}eCZ9#dPBJe z*Z#V*vbo>-#?Wx*oVJ#UE5HBPig*qYQGtz?RaUphz>I=6L6nl)Sne)iK*V4j!5!xc z%Jr2Ho-)OGBurDGW4O_sg#e0fUES7W>#g$nDcvwQ{%l=pH~s)bGU8X-wNC7lckvTZ zwBCJAWyqAZ&NGZ4r2gUN&X|g65o3#Glac&2VykQsxng62M^xEo0?xiqOP}~+pjyn~ z&fCdNcK1xl^KJdvbg*`^gkX=JgI!Fb7~gNvA=SY_M}jA^Mn5S2wNrSfP@Qb)BB^>5 zM0&R}G7L|Y{R5Cr3yR=hu5AqRJ)V*GJn1X?K9=g)4!HFBl!CEzC)L(^c&*sN*A7IR zXv(1yzAW%Z=bK8AJO20$R#RY`qm!-I^2@XCM=b7Iw2Rxq(kAW+@!z2dvaFBt0z=B9 zRnMC`FwGGy(1oHyv!X{Ll%lfTtUgBKh-5YT*xgve0~iuI$KCDzqp|w?v&^&6Qbw8L z7t3@T^SjPKYPT(-08Q4d_>*#H2<=~Xw$bh{JB!b}TCMt#)ihF`*Z260<$qrT7R7ae z+1;BUD9cgGMoUc!tvpPY21`!>WM@l1opT$hL(+FUtNP#XG4Id5Qka5Uj}55P`~f|k zV2lSG)Cw58ksh@%vG@Sf90M^z@>cc=62Egf6r^lVGugjgRwdKtw8QF*{$f*E>>gJ} zn~sjS@2PVs-?!zzwn$Qh<5GrSD%je^)Nnz}Za+4`<@IumO3X1XLI>x@H+%eq(u{MI zS^9bfWu7I{IylXbrIndG#ytW#g%yB~S7`&taFP909fif0&*;;`ZYhWtsLMJJJIIg7 z5!9W$Kf11Znm%RE8m_{Mn<5tLh!bv7l#t*how#7O4HIkY64ftBfv=@n3nqalZ_cW3 z_p4F++jj-yGbSQz7~8e$iU4tc;}qA)DbcdxwfhhI7`pXMk8)Yd1~DbJX7;On2~sbB zjZ}Aj*v?xx-u#|D>`dC8{i|IL!<**1L)F3}E3Dxc<Ka&f+Xm3DYh*pp^WxH#yfsD@ix*Fyq~Pw3D!nkrnAZKIWX^f)J#QyDY0Br4X80 z4xo>EHa?M$10?y_O&mw+JOD(LdQzhrY@%f*uvUwvDo#55e@ts6;12OP(-I9%p#JRq zoyMb6Yf>6>B$KD!NBDvBr(XDv?omC{Io$R)UeH>I@Q#W}0Yh|Mq$+jA?p_8_n z-qif4HWS-Pgux)Sdt)ca8TF) z-0E0HX2d6~_Pjn?U!eiyfrPgtKedLpJT}!tmB+VLqnR>XGweeqfkTsiML3Uz?8f9z zdbhc~;_-IjqF+gwL4{w-I7E&*hw+1Cov0A54(yIsg24G1W;_(4{e9~t`VV_Ii7IOa zbnsf+#XhzI%85EVZG?t+Qh&C7r{Bz|g!im(z5i_oM_zi!ZEOH2>45sANZ30vXg@?c zb>@y3xTzKiGd~ zpG9HTQOSo6x&CPcT%Qay0MN#Ud{?#>3slBKZhJmZQ_&y;y;c=623O&vlVSrP(*8X! z;ot$zO90?T$T+?GRX7hC1DMxlYN}gwGmNdy(eF?gBJIjD3JcY7Z@+K@rXVaQmsBv- z7ne2S>z)M)_KmVqX;OpoOAV)d)DwA=)a409(+w`ckcQ3&Hj_BP$dIj$11A{*q3NCE zvci~vZ;3V`AXvfrxPK>bztjzuK>S6zDGFaf1qivJFjZagn^F&>(`|%ip$bvQ4+2gj zbj%%e9?TUPSo*cxp8_iy7mK1WRw6M1%D>J8^=VI_`DP*L%OwR&WqKhLX462~EIRoL zBbnty(vcMY_IYp`M8zHe31Pso?|1+8Y1m(t^z^#S=R$o6B5!K|(6%EXR}X%Ft#c7F z0tDi&C2dp_UM@NwIKRK2XFHAP-NOE6=ttEX08oxL2HXp~;4V91efN>kvg<*tUHR8? zxPAE(SF5V1FN8HcQ;D?Irc=-XjnihORfA1+jA}9iS5<}OYh)WSx>>%;0_Fa9q!CW{ z62^~WmdtQY*aTMhgw}(qA6qhdqm5z!IbHG&oUR z$^sJ&9*hon6ogCnZ>A$JW%ouNo?RB_!fa59Ul8JWP*Sa(}1% zLIbPO>NvqqX&4z3eL;wK0=Oj0FF{6WXkNV;e_I|YeO)CG0fw@B*j8X#T*$qO9vOIz zGWWE~6r}xx>%M($5WfIANpGG%Upv|edNgAn;#=Dh*6H0}htKtI{U;`+;+i=QB|NdY zKHFFEoVJ|OpFVsPzIBn2%@-75*8nWi5?anT7*Y6afV z;zn4;JNAKp%L=+q>GlnxZq}|sqNpp>uO&>jxozruXGG)X6l~zR?4lQ@AjF)3-^||E zwtP3^pP1!vTfvR@tY6`*MdXZ##6cYj_)@+(axj!}HP=E~(3`;=ZL0OMNElnI5+-P) z>Z;}rv|f{!A|!1AoNO*s)AYVRO(6I6Aa*Kr6>D%@jt#UbOzLXnN~yl6>QbYVpZe9D z)irJiy>y9Yguw|hsqRauq%EnxjIveA8bqt&>S9j7cPo37m_X;Y{2ijd9v<^3W30OW zE(YH|KK}mOeFaDS9>xWMS&jOHI9a)hN7#KAS9*%{^n@5->?GwNmtM)UXPG2svK&jY zG`4|Y0@c5V0Aj~#gO|g%K6efj);d!83+EDq z7b{H{60?A8Axdg}Iy(J@(A((2u$bFLGWCT49e5ChV%UfUV}q8Am!9g`=OeeYQysB~ z%dW+Fs6w0Dm)^!h!;s;J#Z6;_JMDmob5v?mdrfIB0;1eW(VTBNCpV##lmm!0cerMU zJY$x;vfHkR^? z0Xw5mk7&)ob_>Db*P%;B2S!Q!Ask+!4p8Rd6aiXxXdCi@VYOybKE`(1{YEJg3(Fk! zWO|sFJfE6N>}<%0S5IUt+}$PYHXuH9Lvi3t?7+0^DpkXxra(Tt#pqN;jvu%-Zxr2 zORVxSRx2hK&8pny9O6^o?ozN`$*Mm%XS2Zb?4BUXY2DRUetI*ScG9y*Xrwl};j;A3 z4e4nkvl|8A6!I}3k3Jqnk+iC{-M4k1VV?imsavsu!2;gjEO-nYWJ007*WHGwWx zT~m*$xA)+)aP~3IdMBkKedZ1(os7(|DGIUi5~4sfmD?%)*oCc& zyfMZy2MX;m5pM2%8;5GUgHfnR;(|R~Ds`zNT>3ed1KgCWZv{xxiQrp&heA<`I(@qz zr+d-o&@;cO6TWti+he{f9pK~EKmleYH7=f=s)@f;8)U$e(T<-!MY%x4eDoS-5-P-6 ziKFN{ed<6uk6=jDh1&69`S>K~#No%f3*BI!aWOUB?1Zg4mN_SC4tWWA#f=D48R20x zOU7GB_--Jw>30E2jw>Q6`FdX`fEd`H>g-o-ujUxmPu81-6 z{Zt4qHKDa7ER>%D8Jj~tO_R+%%hfrZ`;60}kZ04;;!e>#v_u z{#}+q5RtBi5P_De5P(QaNr*^qUiMhI5^ikXFR3&a3><;EveIE+@r~sv(!tC?R_31D zkcVJeCGOan!r29;_j=JwJH!>sj2TvqN{vHpDJv^Q*i*{Ery1g3_@zR~L^!`9bRoaMo{=+@V&T}H^Z?ftspVNAAuh^UoC7{ber0< z_9Tc{LV);IP}g9is?w8O&2slG@nISEn1xQ&j{wq=!dK7|3X{je3J!#C@x=xX#{g2y zCQ-xW(b>v_bP7n zIL8ckFFdD1bJ)>F5lw_ktns?Sx`;&p>*k?u08RMkN8z`(HSw-De0;^6$2vtWp6e@z zrl#}TS3c}y1Ikik8G`prd!eLOE(7ii*Ww|W1?Lzr@f(46 zlYZ^Y#o;<2-!_?0*a<}euv$7g1RdNlBbAbasRX*gY8ln*+;f1Y_X#GMsN7Bjj+x`{ zRuYBO8GN2mXBR(S(V?=4RR_`s%!jJ~blpF5iFQ%W$#{T2+6#Yt_x;=OO*O;xebP6D z2P|{Zi$?zZN?l zUBe&Q`XNEW_nPoe0cnK-Q-L8n;LCHEaYklv^J1+oeDv(+8Hc!VbhVqO zkgsTE_YpI0?j>c9lEG!sM6CLl=kx5d^BlczYr|6Hm*gNTw3wg(6O=F$F{qaVNpKx! zG{J~aS8xd;^0fYDxmc;2mbh|6r5gH5j zPua`>B1Y<8AU{)y56$POwjpMgj=M;fwbIsD$)arb=ICF?*(Qo#{{WWrLpV#@Dk} zm)3&uLA<6DBR#bRe%-41dT@W$+J(q!ozO(B#uUNs$pI>|8ys$)0QnXhxnNabkaGV_ zL2PW5;dg)D1Ak=zN1o;8fBd5k<%SL>0@$evc?1w>XB~YH?z)=~ee#@R@b>wSv>2<( zuq|bvLhut@{u8&|ni#um{OTid=I(t3_bmQ|{+miSHrt$6kpZbQeeFg8r~w^uFlYt`9=nc7{#wcA50R<~QHSHy=eNQCkw z3O#m09$x9{PAjZ8=TCkV0&DkxCP=%9-JbTOK3aZ(ysbx)tY@~mL)N!fG1_)-#w1uf zZK8R`3^xDZA=z?lIQP--F2es5%b}QJi_J4&P>y)~6W7Rvb3dog$>Hda*(dzzq?4{0 z=t7BK7{b`h+O&?gmAy2O3(+h5mAoqAart_G*BI^zuf?mG*dW8ez#m|spW1FCf|P!f z8}-5*>Z{f3jSVJHheG&s0?}74%uN3>vC#?2h9_|vKQx3f({5NT;iolx&xPal76Is> zmlT#{@Dn#EP%P}N6?j?BJ7VmDv4yBZD!!N4u*rVL$v2`&YZoJ3k)=ng`!x>|80_9|9EQr8G7x1c4yTPZB69CI~l8qQUv zZ2hV+Vq83sJeYV6zsVSjtA#~DQiv;#&6E>tZ101@PYVUAOB`u~oLEArM3O7POyxc$ z5)o5n$fZUMPb}ZS^g->G6z-=PDy=nd7MLsqmd7z@BIB8ugbcu8)iK4BpfDQ;*|SDO zlm!x;91FfbRZ0?%+_ zHhRRS7Yk2HN-bpAe7B&5Z7CM~LwK2*tkv(mm7i|=zX^(_Hz^3#Q(WChPAlQMIMYs> z@+zMEgk{h9Kxv#7#@L_HDd(NyQ0l~{4k8`D7g61rfeYvriBGNvtt;;;g}~t);-Y;w zwda9)95I~EW*NIl8-@BH_@ObVLQds@7oDftxa~Vbx!`$@rkQML(5s~Nj@efRoR?%W z3PM{zM@)do!x$&Uq4rI9M~gXk z+wv`5S6Ki|5W99P>r-qCZ(f)oC1o35{p3ClS0C>*Zvid>z%!JQ`54D?&W_yqk_J9s z{ZS_m38jCtYx2&|u!$Y2BpK>sD;xxqF(-M>#F!kpn98N<4#aqDJhBQ+5@EijyLTz! z9sTEk^&`6?sJ83E?61#hYrMHl-}@PbYOchdkr)AV%{H+f_ax?utEbe{Q@8vRb?jJ# zHVSn>eES=M3b$UbtGxxZ6OY~%RK<8fVq#Z&N=^YD3F&doIUH!-C|;Phom>UQ8N(Uv zNqz6uVew1>FCpckf)2v1O3H%_OC}Vzw^yM!;Qx4aG&or6{~*+2p`!O~u=*`@!nn+d zjsWN%)%uG5(^X>mo4~ zLeh^PeT zZy+TTsZLU6`(W?YTg>$h?U3VS*+zUeK2MTe;G4IYXnMy;*wjZ=N|HSe-Lv6RAJRNP zW4C7d0OP}rcsXf!c_$s33Z23ds{LE)B<8l^nOw~1nzW)m7iH{bu%RqcBA;vJ96RWE zH1dg6b@^cW``%6N$H1^jmiyc+Z&)*L;%it}VK!k9W}F7IZ_#S`}%KN6T;YMlvCz0Dm9bef+1SIgi>S7_%+CJw( z6R>tS<_m7Jth1w70qY`Jf9fRZOI*y5~ujB((d=Z=O+Xzt#SIekL1`5?z?jGGywS5A?fW8 zgp0`fz4)jfpM-Kv^m@Hjs-$smus4uU=ScUd-6q(YhKD5^ZMsnAj(GL>K?CxLy(J?Utf=EM8oPd&0tFnD=6BQFv>r#= z)Jb#^U#O;08a0XHi2%^CE_;#XZkZB11*_d^JW_71l&3cON*0PA7~&)m^&71+dUd~% zxG)e;c^7Nue%q!~7sF`pw;&ZfSE!sGUKVI%UHL+;8|Hdy=0w32ajDyUUJt%<`b1#E0o2u=!MNx9mb)egk&X!ZWQ{FhfXT^p__x|L=DjE6528Y z1cVuD5EfI7Z>zwRk?b-W74_=v9HOu3w<^%sW@C<3BY{fajZK-c#K7mU0sh`s$UNbH*DoYvQZkciK-mbrfD=S|K; z={kxJKXyqFrUu^#uVtm@M_!LjM&jdUM~oDAwH1isG{D=5he(fpYRNOb1V>vKt+wF% zBxL#mMgxxWJzw`zGm@5)N3C85>l!#5`}a+ywWNck+=imTa+Z&)CVQ4sQ?PUhpQm)9 zj4oYz;eJfC9t<}QB&~O|C{)#A#VERQwWln*WbjEGz>)iBG~A8>6LqV%c3GgaWP5A% z#I6=*zyQ2a^KT^-vx=gZ5vx18^$h7h6QT7XLJph+*VoJ4k!c$p6YRx?9@z`F zT&)1Mge;B~r$QVlx%uR@v-#p2o@89yzU zv-B}hWUq#>J4oyFJYjn5n7#ORp|5?;NWdU5Dj6pRLjr-PuP-sW1T5(dRT~sLa;Ph` zL+y}LQ~iP^gXt;?FMCpw=#gOIb+xShmVl9Pk1z=FNrQCh!_ydSl=kd_Evf`-@JFqjbs*25&?N9^1F9!lchFgnc)%(i~{wkoYY|%qvWspjTT|V&Bwff($`B_=c07RoJT^GdS z6XhCqR6^yMI+c8iEtw3;zI^`)4G(nTy6tU51#AJWa@s;lkhd@e%`j^g@75`Qy|4PM z-OLOO>v>b*JTftaj0^zePIC>yo4+W`Dv@?^=RthWIJc>?puLk $(P&x^hWBd~Y z`9Q`BqpVtqK9tKORys$tGc<1&pSb~gR~>ZWZ&`AF@GMVU_7OO$uL(kBr(=e_fq#eE ze(b9K;hjJeB~B3169+(}Pu<$lS~*a2_FGNX3fw)=^HAsk@HU?{@_dDT+I^2a7WPY) zbZz=nvzUeP*M+KzTJKaB%AK?*@p0t)MTstH5VN;?fa7G8bM`mpHEwpXgit+#iH9|kVC^nBpQX?Mk)csbvXC$H-){9GX2Gw%zzRf1 z9IVz1u>O#j0h*w=aSU4lNfJsV(_-ozXu*bk^#CXyeR91yd0rS-`vS^90hJ%%oX5S= z<5ZpSEk^}+cCHuDrg5(lxmBBLB|_$l7=s={0MrCn5aG?&7PIT&Z+;X)BExdT(vSH( zlEt3yIT1?QX(*gYw81U<)kEaR4YiD7EW-z$I#Miuke9eb(t2|KV2-%wsUp^UiR^mi zq3?*>TA`Kg7`kB&*rMrDThuRm!ucP}G065&>H^rymNJKiHDHL#k?lc@`}sz_g==q& z3g2S^9N(2iWq`TF_8ndU&&;tO1t=4g2)t3Twco#ch-ty?^-KajQc}~77Z*#}R&vNq z*OhrMiQ(!PM~}r3eRhW|@lRQKIIx>~GbZ8M<7$M6?~)ZJ<7(|v1!=rdm>9Xr(r4K@6OeodbulCalC&4u&mf_KYV^$hlf@fd;o1w~_bqG0ZAlethr?>Xe1Iev zAvElYHwewn84SGiZ7|=`gqu_vVJ4`Pw!b^@vXA8K|EJ%{_b%KnC0kr-Onu7 zM(vb12Hf9wf6b$ ze`Zbq6Er>%%Jtv?WP>MTUK1PI&C_x#UKPIa`~W?}Ow)~C`2pU_?1;1z`OpMQ4gREC z-xyH@%{*9IKHmbzx56pHP+Oxi#*gY(9m2vdLA%M=gD{l5EdD{(;-?NqvwO*6Z7cS| zg*c{s%OfUEpBEycP4qf#H@LojNejg(QoGFt%$r{B=kh9={Hz5nra;SN9+_4`o9Dyv z%V2Qxa~r2L!KTO);pyE|GsUKSxC;+Mr%~sK>9pMbjBTqH2ura;%Z#_-PtjAa!4w6- zvj`sga^Vz^6MCF=AUOjiLDM)w?YdglTLds5=X0Nez`TKpS zFp-s>kUj>@y>aD@iF7Lzn}zigAaO=ll~Hme4M}6I!nQ+RRZfM(gJCGcI%}zaN$pWaY3!YT^#Ad9zg3wlu`iWb8Q-+*Or0qMWeiUg!+WfYy3pdh_zuZ2bGgq*L352BB>paMn1ExaW(VEzgq`@m{o z4^J*qXF`ycp8-+OIqxByUw@<$YIPa2d$g@_E(1r!iIiH6*PpTKd65ZYpOu!3FSKcF zJIc|`;O#^_C{QNU=TSotfd@ved z)zt1C6k;RFvQ>nr**Qlj0E4NgFwaBWLl|rilxWINeZ;O&fCBvUGDE>#AWhgHXH!OC zCi+pn5mg%v-~Ko&6oNupG#t4OQz{O&jE4@ISf%a=O7WF@cPC@JhCKmy=k%uSkNo*Y zC|z{^mzL)*2aAdI#!-AT%y9@36- zoH2QUQ=N7b+yWK|JhS5gu+N)nw2?NM%8d5e?~xrCA?Pv^3r#C$z;PoN!8yn-LPzswe16B+2truh%3y`r zZu|DH(Tj)-ioMww_n8Wtw{*!&lr0=XeinQ?FkD*ul0`KHP;NO$*qZ^b;spL@yd;t5 zZ}F1CA%!T)DT1G>cVA$6pukLMWRI*^9T}t_SS&VKg6#{j^W{5^L3yH`NGpSbFAhgL z5G3^`k^&3SeQLU>9x;7uuyXL~^EnTrAM}z2+Mf%KN4d6U&%j@jiJ|_EO8|fBl2?;< zgqQvw#{jkM2u;eni$Mj>QRAXfIZAo62J0G#dsCcCinq-%#Ba3%O(ymLX$WaOA{^o{P_aG)q>t-jlt07VSZBPRLJAMmfK$? zRk87?x!M5D`~{*+X?Xn;8y0hBdTRutQ#@zbUDh7Rz306~vYbCi+>AtOpcX;fAG`$2 z{kJZ;p{L0Wo~Z~04OMc?GXJGZIwK^pK+KuOA}#>`#7ja9zNT7-=Gw}tTR3($D#B`E zUg5wOk5=!1IjMgH%Oc*H6E>*xfxY3%Lz3$vx#RG!HN5H-^j>v-gE_kQwnpLY95!jx+xP@bL*(6W(jh`BXy@F;&o3!2sU$lfQm^kQX~}$m=BVKmO%Z`+gEodF8CkEu zM_Nt*9EfK)N*c_WsmEW13W&@#30kCZu{1{sAZzPrjSGIJUL~B4sG3N_ z+l=rr8qo!oiBq`d4eB+aV8vi}z>Npb#N1>8M#2~u&RA_^m*Z-C#ifR?o{VZ39XTV= zrU;mtAMy_RSF409|E*QRBL4BuRtX^V?WdihyqJ-xU$GL49LOjO*2cG33FygR#7h3E zRWcL#yH#S|eA|Wft=`uW3a6@Kk|ki9`JGGlgGz7l|J*8}JSMD71^f{!!C(H@SV@V% zuUJVB;_p~V4g=J!qT?(0?YQpH!o?dZsp`Qea38i&$7>~h`nHih6u2U%ftb_>eD_XQdD@kOeQ_bScl|1PDo%_?M@h=GfIY(sURxn|Olxw_5DX{0Ek^}R zF8XsX;eLpLl3d^)wUSnxzHQm%m+$#NcB?b#rp(ph+^;_BKBdE3>&QR@YO8oI`qE+0 zQ=1>FpR;^b^okf2nc~Jo8UZ{S2Uy}d+p(RbOZ+y7o|Ow|Ii)l5+Ks#4pxbME(XY9N z#;kgul98$?1txs%je}3>`0=L`sY2%!R)&bmWz_P2c<*Z!ZFI9((*CNI3@y+Hp@JIi zU6$k#3oM*e?2D>>0a1GyOc!kaWIQEpGSnihFn8Jzu17d3EPMFTJc03o5%O_Knj;{o zK;@3L|5irXw=^D)!)rmpt5t~4-V8gXT4-pfwgwj?E=3-kN}5KRR%Bwhq`&C{eBn#Z z2G=^>q-AXC%Y!Dls-sR&x4CBu3Rj{>YByG3jSrKZPfp+d-cu>msK3^A^lw=r&ZZ{p zI;re5J}Qe;n}|_&1MyL)z-7S@FfwUjs7;rd3aTdK+zqQ``DJPu+L=ADlW=?g&Q*!O zX#y4gE-jR9F;LaKHU&#h3r+5w3lN*eO&vGgB84>qoqCrAHtianxYX=mDfYpA6buG= zrxhAxG#?syG#VQD($x|hDC5NF%1Wy`qiYSq_c;!BpSv?fh7saBNck5eKmk!Wifz=U zl>w*4$Fwd0m7GgNhC-K4WrtiB^sJoPwV5TgGE|xm{<+sDNXbCkJ^YW^z#Jv9{f2B8 z?xBz0D)q{6IO})z>W+n3>iY32*##ioEb;F~AeaM17eTq{&^uF-FxcW&C67o*WcYBe zM6ySx<CB7_Pxa)0dw^%H)Qm^-@XrFwS2T8?%b9_Ri_)4-Qt&8f$$7q!x$LxIwq&;6=Vg z(3a|FurT!AcTsF(ekyk(pm&#}zY-US?U0Ul^sR>YhHKVzL8I#IW~FX2Fz3__WR@AR zk1yQG$bs}4i7ni_6sl$%is5Cu{pVZ>Bh5P@)M=M;)lRUogTX48dHS0#_=&Jyn68{# z+#b&W>U{Bx{K{M!>(e=29`EvIQ|)@r^3XiluxyizD6pLw3nNL%Wg_M={f02R)Ul!w zx2XwzRZwhgNb)Sdg);oQ>%GT2h*gG$);=;38m&WfvS#`RxT7MyUIFq2k zuIGMjemSDW2OsMAu#PmtejJZUPfxYp(BKbFr`t)nnYm>ACBmYu8hz2sj3#hv%AVOx z_DK?o&bBe8B@fz*C}+|4CA8$WC&uR6z7^G+rxx48IQM=t83uZ`^#%R;JskQ&jm_XA zAe&4hkux9C$3Bmg&XG?l>Ah>raZSb*P3(7BAtPkhlj>ijWT*r_N6TJF`Pux9lpMX= zP4Kl6se-{ZGiZM!CDQBF1PFvPRO`gayJvV{Tq|?%Gszh9*GS}=Xh*V0(yUh3>VsQv zCw?XU{HU#|7d@jE5^47GiCGLYsosF|4C@ydF;RXAspe~3llM(oA~^8*tYcZNNk9yeZ)S`xN#+Ys>@3u&nD^4RPpV37x!S^J>_|3*s=%Y^3sHyNC4m}SPPtxJ36s!d>+;rM-oCgd)`E- zH}!#JVortGUN{fcHaM9N9rta!Z%)fLNt+T#!5z1Lb0zEFe!G%-y_dw+<+3?q&y(h( z%M?gK&=vkiSf(LHrq;^Jfz^7)a(VB`kWg%s_w<1x@XExCXGku~VS?*DHCeZVUbR7h z`iu(xFk>hAU%e7jgtuNvoy6aIB@j3ywQs$WFD7<~ti*rzO5SoMSOpbz@U5e!TQU@x zERqw6vf{fPvIILFnhfl!-)cMNppg_(cO8eASE6X7^xj1c^}l~G@&zjjDjxjW+sY9{ zlToKCU3D7zZqOw4V=ExYDmT0u9D1Dpd~@5lBs?xabyU;waN0qWKfNQ zB+|&(a`C?BCwdIM<$9=*p-wh})EjUD%2nW7#N?CX0&&SRKqLWinjXK|uI^nXGo8VM zdJyN)FKGe;Fj#ce9+iq;65c0%tmn^olO{=)J!?hEKXK{$ECV{5Zg%8Aw_;K@BlBJG z#ulLC>2%7KyKzaGg+{GO@mfeK*U*WOEaiMK^BfKVg%sKo)A^m#apfPb8Z*@w_J&#< zKEJ~2bz=h5qQ%Uy&x|~1ri%?xM`oe>WFbWyG>W8!PNgKOrczCNIdf^}fX1@IO!K?)6l$9d-TSDT| zM~W#1_wmjUBSzMhBjmjOAkHvQtqd!P6DKhWCvyR~Y>m~jyh%l9=r}2SUXU^B=@?nHknXHnG|8an3nWv=jsbHqP{Z z^OKif{DiZEuRgv8`(OBp6E41i9eK?o4ftWHZ^dL-c=W}(

CI>s^rP=)2n4kU$_a z9;y;H86_$y!$XOC&~CpJbjcAFk_x+!;B2UG@{q9O&D=uJ>c{EvdB0Hy0_C?!Rv?k~ z$J`evAO>KizQ5%Oxt8kGBgtyto6u4x4K9}BEk=UK_4sLyck>qwYDBr6TSl!8edv0eJPfr=fI%%T0y&;xx-nUml zb^BFD+1}O`e$M8pM)z=jOPY-RPMW;?2w>B&5BWCpyJ^Dv8SkxWvS{{4(?rYozcx+s zmuceBlM;h!({rfpD_ZH#tUPy9FMUoWE(mM8_$7Ce=K!^Y*i|+fa~3zz7D&?i%9WzL z-|tQIT5vkSB(s?1V}n|^mg9$SPMA*RG&2>@g^jcU1lY98h5}ASw?hBQPq1A7&QI1H zbpFOqIIRA`Pp~BanV)Fx{>e|URetdk@cO^vC*$M)g`YG6{wIFoyJ_?&9o|W+pkpIW zmT{bDr-|VkJn7nR0^h(zhc+VTRHlfRw-j{%L%5o{8};#oCh0g}hHe6M6a=)>bUt~9 zRfXdoscrFwaF)de_ih2N1F2g)Ig{eljq-h7RdS*e53rwoK1~czkoZjYq5q+F0cP+U~6oUPPdb()yk*pbkIwD0lC0|FG>PQy{|C&s>V_g5DYyqA$E}W>ngi<*Gq779*Q-mJMN$eUoQ4e$HsWpZT4{qH|eUDsY+oGU*VDRk-M%Dp36 z`8f|IDff+Sa|WT=Rlx0P8R#N0>c#=E0AI#(!DT(*?3i9x7CKrrxDv&ROv7sstaIh5 z5QKIjQ0b@?l?lfGsDk@F?;##L^lfcCMLe95wAL}T@Jn7)vEz~h3c@%9;df)NoGd+{ zEXCWslotO?RF}_Hsy-g)yam<1I@~>i;N<55vcN&%Dc=%PaDAYxM33)ap|U){&qd&q z!$rY{OQ}M4)>E7$i;@jXR6?;(OSJR@>qtr@*6>}r{-<~&86P1(0?BkSKZ{QG@BJ9w zrv)nIA9Sj0-bX>>A8?Zmw(MtG0 zMRod|llyIRe}6fm#lP;bTis|8pzMZ~W8Ey@2!Y^XR(Mm3J$pr1YI+Z?{JuKB)w8xC z_jaKT7;;p2VuI39GRSD!1oO6O7D-;V>4Sj6`sLU=_Di0$O?)}Knv4xY;OIC?Rg5TG zEz=sQY9L%ccblFryWp(+$_M9hrxWZFrZ^Di#Z^8-1^cc~*=yk+8Br9204S3l>TrAX zANc4Q-kNa_Y(*PY{w`po3EfyLhunf8m3*5Ftz#U*MQ?CM}RS4831*)_tOzww+LDwN< z(@UV5;}s{t4=T%RwxgUZ)5p{K`j&c?VfO5@IKmL1Rh8pBFU0J$0PS~|=F`fC;|v2- zY)@EeRM&?mY)kxq89P}={S`a0_95uehPTpE4+(YeuEbHK<|6bMsTo@K*cyQhF-U67K=#l7FYn{;pmcAY(o5emht!Ko(MUBz+WRIwEY*9HW0H=ZCc&=<<=S`38owxlC_O9%`dB`3!`pp-x9ZCtS zlR1R`^ZmUVM!JLGySSb;DCC_N^7f=giuu&a%Uay_8#IHnjN_&~*gtT}TlR#@rPY4E z8}HY`j{NQ0!p;ujE@&@_yR4ov2hvk%|YRr^)Zld&de)SS4*)95cJ;at9-QY>- z&c?J|xiB3O!Xwpz(USRXX=mq<5+n~+ht&`F*U}E$yf~+0=PC~7WA(d2F7sbYJFrT> zmv)fx|FN_)ZTCm}N*gXB91;mh#3Sg`~t$sAuDT$`KcWWcnTb_M= ziy2<=W16NW8nL!s?_@*=1u_QP7t^bfW0Ed820w4cow=&XQDvP3soB&{@w-O`$f>d!Z+0#)EY zkqkf=2GmjRAYM_tQI*n$Kd8zf=f6;up?s&wuOz~-Nl74QRqb#$o(f3QzmK84Wnj_z z+!(GQZsMG6OfRH!F-yGM>4`U>7mjPhK0mrKWBGFE^iYT8Y<)BNDgKr|K~6;`MeC+{ zfK-^w^;lSTgBbZZV?>m zKX!JUt$rgFtz>Milu-RW&DhSkKW2883ChxDx?BN-JgVE*V)BTeaT_vC@6R=#gxc3$ z8m#9JhlUB*zwS=-o~?)WXe%!v=;nvAa-y?yV9KI~zTMf?7PiURTouU&>!tfOx*ExD_{=}1*QxKyG56kkDsEGm zAQB4%?BEF+7B{jDuDL-{x%Hzh>+lzhK``*MunhDPiVc$TfFq#bk3p`7lNc3FcjA6l z*XxRTUY{Q9MKN5-bATiiDTZp*-+CxJr)mawZ#k40r{6i058!EYP^vh;b138lDJ|>< zMWP|Ub12in2lI)Y1FVFGNLu+{TGm%rVwxI@F+wq>)7KravSd%xe_13ABTWExk8V3Je#NfIlJ z{6(P*h$j7K2IXoJ@Mi`ECY1Mg28AZ>cLqi65%@cU0w@i~{MAAEM+QZ?CkW+|Gz254 z;uT-Bj7mR&5XO_3+VvDPKdFa`nS2H9#8&hNiBpy;(2q zr!SS=e>K3SqS43s#e@9dR|Hi18M*d+`{#QhWgTE8r*=rvy zK{J8nhzQ{O##1u?nx~9-yzvykn@^GXZ$5<)%Ji2{DRO@L#Zzh|<;woXQ(TmO@sxuc z>(#Bl^OOhHa)W>2DcVr~_dEsgKlqgHzxkBkJcZZrPoC2E|HM=1l>UXMjIjQLrvUzg zPx*H|g(u=Kc}m4UcnbS}=P3tv|H4xM|K6uiS^j_GDQdR=iKhU5`IPg3|Iw%X<|*1P z|8G1+YtU zt@9jv&v{2=*!Zffd@r23K1{{8z#f*#$(G9gd7*R=b34&&1XxVX&eN+KmsPD;Ynce4 z3}uo&t_)0^Ord%oU-jP5LoB;SLRVbPfIPp#B=v!ef&U=Y55SV|`E_)eb!A(m0PYsu z;gpti?H~=^Vc!aE6unnQotp593>)(+ai1J#q`5ew^5k;Ix;c|pVwvi@6z$L&TUqUbob_}n1O}uB ziYvYtT{mYOL7->7HL!vgixgPVgHDUF0(jXPy%Yr*j|JsF74Q_)_q+NC1*|s4K?g9g z52f`?Glht0>M3C7G|u`V?^}I&O@3_e^3*R;oW~%1aJ)Z%C)W=3F)j2--T;|3>+0f2 z_qg9noTz8bXY|;_8ule-=!8{~Nc4F!67mFb(P4^cD@em(T?U z6$YNVXz=6aS7gR6XX=Mt8mvNI`tf-H9DwnHM3@l$ODFT3z<6~+bjf2RBloYp=(hHh zdP2grjq)#R`;1;tX}^lL>8X8N7>587J;AG`972(W2lm6I!W7XWKu1chir zn!0U0o`M3@WWe=cOeRniAaV#M23SHJkcAW*3#`iq7&V1U0g46uI)&>5z_=!MSIG=d zJQ=twrIt<8yQCX{{IMH+$@|{J34}}$4)0EZLAJX8s=Ok7^Nyr}s{c7DNZ(rIkv`4G zi~;d{$Ue8bmvN(GA^8?UT_+7#;e2n_=cjt){$AhJz8Y)JKWd-1p4L|$*Ab^yhYVM= zcDFT2iev8thjE{|-v!|nFi>ptjj_&Pcb3x=ajA1uvGmfJ7rncIJA-f$p0ZSHb2U;TQc#&+v^34Eem-ynSC3f3*pI((an=o-jYDmiso~}(E-UM zquD}w1n)tIqUJ0DO66LxSmLuu_7xw>1$&;v#7Tz~!?X%K8A4q?phj$!QpT_UaTX?m z$od|O?t<#7Y5b8uxE}PiJ?9P(+#-V|yp?Ec%ne_qZ6tSwGgb{{#XD-3*?zPSLldQE zQ5MJVsZS~>1t;9DB`D@_1*xNytL#o6l~HONQ{c~`S&#oED&gnR6ims)Y1=}edR%NH zSb$ddJ-WYXlfUbGm`-}d9I^pnMt9)320AtX9m_z!)B=>Hg4Z)`iYI(iPs%$SEgV88 z#$h)(U^*o}!14m!MlgZ4UYI!PBA*_lY#J$m`RPt8?LmU%7<}7Qh=-)!jI~iZ$dDne z8v&My%eg!4SOGIM->i#ewtI!h5m?iaR)E)RV*F|)XsA^>!J&}H6PFOA`JoC^0!oBT zz7NqDaZ7rHEC$i0yhr190TEGUy1+iCUQX=Z`*S$szE2W0vjB zx0;t9IG8jpH?PyN$iB_?IRzvU6&~Y7m{UwYA{QcQyOY(YLE*`+x%jELw3n~R0KT(j zNhz9YJ`H`;#v?y~B(>$RD>Wt<;$e$y7sDtI=nQoXj{~&7CiTy%E=-W0jS>L%e$<*C zyd1wk9Q7azCaYwIEcsd0QugUk`8xSfKQ^4bbn&f< z%TV)Kv=^Y#T%{Xhv0`mB52P%8&wr%*ZL_FBL&v2Mp^LvP8xVa_{aHw*mpvTOvS>l` zE>ZgNe*D&|(od-lp}78BSMCeRTnciS5wa|LILlKH;jJ;^9XGrDxBX?5Iv(_hh(L_# zN=h;&OHaLNb6xVtauHG7thr*FQ-3LeFgXzkZf$_%cI3oY$f(Go9b=jFeM)cPWnSy~ck$KZ>ILllw`s!(Fx=!fcA-f+J$&-$YG0<|}ZaS5gj4T%Ux7nws z!qA^i#E8a9$e-PohM3cN-0a$SYZi^TaGNz9_aTrQ2gGl(Xc}k{O{P-Qexzr1kmo6{ zUGf$hBX7Is2$XtLm&zDsObltCp#40&RCNm|S!eLJlV}|*IpJ{4gNxa>tD%$~;&I7i zFvFSP0zn~ka8GvM9$~<7Axv_B*)ZRSN*C#sNPKNx-ty%rZ5**evZXYm(cVi|mvMhs zO^$?PA521kgJ zfp&f&5FRhzQ4IxWq;*!xFY6J7tcy6#+Hl=S!`J}kx;bE%oK_XJ77w$9 zz-TIXg-JX>_fi~_gZRi2#2|Id3h{-gqRyLD6Wa-o{L6%_c7?%`fj|G8Ww}Z#PzW9y z8@V#ZTgR2d#>l-;et3zu+!Uzyh)yQqgiBo&I&kEN+ts|+lI$549Sxf@nF1>O@!Web z&3j3MD45uI4r;;2UJu8&0^)X7BI+C3zqW}q3%Zos}r^kh_^?gpcq zc}0+Vw89QAh=gv-2+-~c9a}hw?@MH$v$eAys#xy#!C|oMP>Zb8fm{0!q&WT zmvomNG5y-y#U@3551F5l7j{!DLxg!l4)5r_W?-g)eNX6gK!>mB1VDsmbbPQ6QospF zTwE|8KVVfKHWRjHhHFD4B>xiC56#aItT?7% zW6~=+6BO9%heoj$bZ}5WS(GvD2Q_>0dpyQ>`U4?lNQ!8%)y=7x9&8*q(B*afazCjA zl@!xg(Q;FH_o&n=`FubQ(`_L8YW?76=Fj)G;(FJ#uboRht8LhJ;HrVv?)%x6c!rI- z$F+t2F>i+hay_5^I2_0udC-iOj2(DVLt~gLDsEw#Mb%pU0!RlFzzxD_xBp;}U%lD< z1Mn$tHj!aa4U85%=6EGfZR`vMLHpH%sIvH%snuSK@b_N{Gpx&AyD5|Tvaurb<}%?9Nei`C zLPgbxIQzHTByY5R!(Yrk-km%v7WSXMUMpN{p=^A=xttEz5~BO*Vv*F7&K|1-gi1Lq zLwPATo+=gflA9(ZVm>dLb4*u=5pljfKSg*D0>Y%A69An3-j{x>W6w2{eHX>Z251`8 zQkyJOT)E!X_l0x2YfkbRzl|*YvjR{PPNN4XO)yvVXW$^NMMwA zNCaD@>|ymOM4O|tebE}|s{63Z#cXXWox5@}M+|gA!$kv*r=XJ)O$wYw`z1vO>>z(p zjdz(pJ5NR$MKib7iEv8PG^$ok{)vN$>hP91)jEmzCa!OkPeNkR}2wTF7w|^+LyL%r0K#`-V0gu zaSqwjw30=X7De%YSv%hG$M53fWA&!(U$d;Qr||Brd#FBaQLbooLX@H0W;7#E>+yZE zOy6hZkP>h#W$HP^I9@yo<W!$kuD4? z(OA+`lL9nJL+3yNQ~yBGBBH12FAO?|kjFV(4lGGS7YEDe1)im$W0KB6pjIS~WWfI) z_Rgv+u10IKxLcqKcXxLuxCeK45+Ec<&_V(P2oh}L5Zv9}onXNUF2UWcNzQxD*WIH> z|AKR~Z>nxphT{e+AKjTxsJ4aO6leyrLpg#)!7HX+!eud6BtjY7PS;L_0ZvZPR1|DE6dJHP#Re*5qI_TTyKzw_Ha^BXr3WOdIxF$_PRNd75! zSRC)e+Ftk6XP6Slyxw0*$_Ow_ESRykp_o6X@~%JI=3(3+$M0j1b=++yOPrRF!Sc8X z-|_3aWO|02_LpoK{kErxe$g`BEVG+IL^WYWu zG$zwcO`5FSGaX~ZGXGxjN;$Epe2&x#cPf~HEh{QDBif#oCBk-ovLkDFgv^l>SLI~M_I2bJ9mzh{JJqfZxSDe%wO5ORx(h7JvE@W}6Y%F{bdKA?SWO-9bD|Iuf8&?a-uN{4?RXfOCr> ze-i|V-HsBEd2jV6hrY*+kLguLR2iTg%Vq8DQmX!T_YxqNJ&7DiA3EjJcW@XaGLnYuT8;wjzC+q|Zdp!j=N*jL?#j0~ad^LjhlG4(s6O{T#t3)90dw82LAoyIe&08S4bJoS!c z+?kcq1D_3q@;-I{xJGF4DI)TG_&hY{F(X%hFz?@Y-69^ZJLrft3nG8x=i2>}q{3N@ ze^1{iq$xdRd4WTy>sTJg?2B&YLv+H+pJQwf97MZdD-76h-zT^>Ir!?OWwI}SWwK9Almk-Y%xbfTR+gDfTFX{IiOT#&A`z&T6z33#hCnA_s?4`Vl@^=_O%2ju807{#@z<7&N4~)Z^a;%H>9OBXRK9_ftw} zL+DlaBwbXMKWDX?GcXB?W78Kseg&euURImf%%au_-pLj7yUN@?HuPDL65Y>x}15=MPvN=N3?7UYO~s09os@{{_a)x_QtQt!&0sol#v_t-x@j{*{l_xUSbtMI+{ zy|eK|{|O%eZT_-WwIRscYie$3&AQK$&vtyggIRN-&6qkiz5FHDEQYip^HNIL(5^+$ zs1#)G8En{rdWh_B3ZTa znY}KUvNKJfp_303&#&BNLUPl{$6~w|UX>tnYFA~n7q*&-U$}ao3XVdsd%HvBZZo^q z0@Qc5to-=30vt_I;+dY-3Du2e%nPu)A{|?4di>0+bw+KYl$2;BJLQN>OyGK7{)%}5P7?w$M5^) zaL`$7%M{Qb7Y(O1(F>PssY)qeuT;Eos@w9Bh)>wIDmL`ht6Tv!r@g^TBRUA;Sv7A` zDOE6uMKJ6unfcN;ejva`qmJI>6|5*Ya%$KO5#wakEkiAx^{7Qp@8*4f9=q3)iV;-7 zf{`D>8yL!%aN|NA95oNmm8=RHi!QR(W2qyrM!-YUl-g?}RJ)?xm9ue8wtg)P?Jw*ShH|zmfk`?_jP2 ziDZ?J2Kj7Wp09@}XXhEIF^z#Qn3FKkYzdeXM6Ld~akg4TuxKc4j zdY%hL7C+u3={lUbzxKvrqtz<6wIzA7aBp%{jsgo7Qm!xqYRBG%BsrRxXhL3_nw$`{ zz`Ux8oI}!x!{n+?c;5TKuHlH(3hUVfC=$*_>mfRck22lxGdSfzD!a1sY*}-2E0jS@upG;A8`z z%#3kpN27I@*)u&WI#t+yqVgWrshDfmY%#8BHOpq0*3anuPzae-vW+7`+8N&+%wr7_ zmN$B(0uy2?v;9Xm$a2mh@q6xNN~hGOUtKEZ{uI@Y*~ILmL;N)~iS`-|vdGr}xxx!C z#;8GpPUYzby>}oHJk2-#?Nd%v%Tcn|+5sc1 z|Hkx*=LzEZj{mwWO}%b%8-W)}OC3iNas~xED;-!H8@|__?kiu-T&fpp4I#D|LV(S< z(E$@%tYXtd8a1#=Z8Jq3ePgb2P*IvKwM`onPfcvOJMN(s>WV7Gu(u$Y8}M9Gn0kNN zAT`RfbIajF!Q@ZU#TI@Pd~&6*CRlA@)#z(CQ%0MvWV|-%T7QTe1=L@ZHHb(7huuV| z5J2mkM1>3D#`;ZE{ml~ckJcvS{xf`Z9zR)|ie$+0#%;j$x9Z;w%30I;#v5I;4JSOT z4=mu1H%r^hNDJw_>%sPtFn4Q{l$g6t3maIhOkREKfelNAmH9FkltSsKy8^oKKn*nN zukga=U>}ugP+l*NK3Bzi;@iccH&13#5M~DwzTeBn-Jwq<0~>Wk;tgkN&PN+g9?~9} zYV1;~UQ8UIT~%VNbqR^cH(#IPG!nT~@QuR6QRh$zY1l)rGlR(HmD{J;_0VJgKKLvW z4W&oN3_Tf&L(@MmGJIooOkg`3({eswaNbhpqB>{6L^xl)U*L6@UKJuJpM@}~79xxJ zIecWkEJTPH$uJFjR}C6N^?^!ca5d5#4Nn9!vbRx`#%>&~3lQuaCMxyR5Za)56d6 z_O?x&OQ59ER}~khw1Wf*O3skRiK91dv4t5#Mu}*o2&T0c2vJGAG^!2S{japgN#kf^ zKIeTnq9RoGcgs=e35n6D&DNK%7wK&&%x3M^tjyc*b1AeN@9SBhCzVN@x!%MqffL8p zKP#A(pB=>BhFE^KDcndZ8aVFNzFlh$Q^!sAwgf9p6MUkkD9Fp|0%t*TVNfYW>SXbG zZQ+_n7#T5gLu1+o*uPN}+5#`CwBAHC^MX^P0T@yHjMlD_VMxO2R$dlKE;xt&)fh%T zX?Bb%`y=9IJM>h4j7S31{^W4Ppq{fQux&QyT;yv7V}jIo)_S%k`K?xV=uT(FR;8!O zKK8XD8h1&jJ|*vO+Xfz+tM4Jp@*k^kmQ}4x+z>x9lUXj%d*#W-kALO;sSt0e9g`go zHEP#pYEZ#h0P!ziCr_?w2F(CsSVW{m&1R&=Bs2w6 zyl)5S%fIE|4rj95Pm9uNYpBNpDK@yw(C`39lRcYRR#f^m+Ygq| z`v+n=b0qn9?%^GqO9pN096}3OW02nA{MoyhR>?{2o#1br1@4Z4+n?I)Gbv%zJ6{?q z{8&tqk9#?wk9%3;s78sx@EU(PJBBzPZEG7s_Cp+yaC3`oM;01uReq4>>zsWMsvo&s zzwBZoeRU-r`C$)LN%ke{d;Et{Q;1cPQu9dtRQV05y5$exqy-;jm)d=`feZdwe+P2i z|4G#T0fMBogk7(KYDok5Y_7p<_Jo8y3@Th%#?P*?bx{) zL_Klf(u5w~mRNeZdNh%O+3tccpdOAo>Bbhw5;GWM;HU+JXbWoLoA1W7rn~RPZV$at zhQAerdtHX^yS=5e55vB?#N?iW)vn^L%<74RjC@L#@sLvC358)4n@5pV_L9*H8GKVe zm|LYz_Lilt=2K|5)D!gF??dG9x7*N1Tm*0k_o==Qe9`n>lh8yS(0 zPQH@r;p4uJ3qyOK5&t4`Ntme?Trt2*PmBkVnJF3=nh8AsJve0xf4N7Q!NaSaN>QC9 zTB4UHk@YBRmbY9jrY~`0lUbrA_|1Mt%aqjvUByCz%%Hk)v2lIumUS&d=}{Vp2i?{)8lrpoTIC=A^BE_-Mvhf-r$Ak=UqwW zgkN%{+ns%r*QpslQ`z?GCo@jJ(oN#bgWIc&XAnZ0{E-ZlQ|xs^KK%Ha1&m*V2q8%? z0a6g?d-l&!xtca>btVfX@|82l8KV9x<-MqfQHm7^lA;Gi19(YOIH}{9$lhW$&CKif zssb{Obc$=AefwQs@scy+G>a`NyI1p`bgM#rH}M{J0f6FDb zp0O(9j`p=T^y&%muX00+urTj|>{7f}kat^AAP)2_*af>Q@RQ}F@6)+Yaxodm0oLB( z0awHJ3lD7%1%3}UygAx)MZZrXtSE-EhNGZ6oCAimd6sE!P4VCWDk14?%{*=><=gS- z;C!CF1tD_vF$#_7S1L2F8Yx{$IcQ>>pgEbICjTMv$xbbGm9u&nt%KQ3b3RE&tRm3`M&{ z5O@g(NFEIcCZJ$M7dVjkX^?{;pAEl09AGN$pAdY1YgJMMJgehTL*~yS6ZZ|(>nUXu zA~Be*&9xD}?GDt@>T;d7j4W|wc4*9v&8ld-8yvQCzG!GuT zrNibapi5HvU8{EOkg02=JM7Zud;X!N3dPDJ@l2z8b92AYkeA#4v7j~5A6__FyfrtH zy+5PrjF2n$mB+2)YY~S8-srspaH@gF1i^F&w$pBO z7B$lB?pLy!6y^;)(G5ZAkw{lk=!=pMM{%no??zxC){;Wta^i`}*zxTdameuLzS>Ev z5i>wOz~fKUO4NDX>bNQpIuzG)5ZvpCn8Cv)<8Tu=qn(q2Oo^grmyf5zJ=pN8NhUUd8ce?Hz=m*?VEzL zH5xJeCT3VaT6~_B;Cxoqk-wH? zLwnY0umlsD z-){luM(G`S|scJ$vS=1^JB;xZbW?+KiC9l?2ZI81JHRU zN9o%efy8#yu3iQq`Q?28S_+pRMBzd;%$lpW{%V}!R`@>k)(i=f1epCG#RY^93CUsN z?SWH7LR{=Jz5;BD{vazVHs@f|8m;YRY@ofJP!QSyAcZET1Mcg|kQwYcZlKwyXxi&t zyH!M`5CVHwZ;*SK`O&24n3tAL8`PrCpzdR{lBWrQkw;QtV0D`e6GjUHoNkke5lQ1| zI=IVsvwmfDx$x|7!Ys zBQ$xTC~>FwOB!=u-xYnh4rcv`y}fc3l>7rnw#PcsQhsfRv1_ABTcwv1+WZ|153r@R za#q^UhgRq?J{M+UfCZq}5-=gCgoJ%Ua{wIo@bI8BfHq}ZE`)kH!gC8>z^n(%2ADqK zb0XuJvQ0D7Kuz!hKVA{iV|#=+qFmUb$=o&ddVH%2FQ!|4Q6>o$;eab1QDBdmfQ|Q#P_+}y{JFzhOcfh1B3Wkk0V1Un|L|L<8za6hoMQt2{1l~iwF2l z;Nt*aK7h~x%V<0k;Bf+<7a9R@wkE>?L_dP4fx!wQ9%SEU@i*NcR7Y3XBazn>G1^3abY#QbL|Xnfk0bIVQ(Vddrl$QBVzd%r-x|TC$w}eP0KALA zBS1nHN$XeLON9eGTtE`|KQx9(mS7Q}fa{gICb_WWs-yqVA2J|12|R@kpZ-> zAU+stX28T1gbQpp65yhkoYr1=`6G%H9|G~NAZF|f2SQrMjZg25sFVDkXtdrxI07mR zM0jkOgTDzitVP97>qs5Tg(7rXr@jokQSCQA>X68O>aJ|Y9td*PU#ZSilRgVPx}^dP z`SA#Gy=_z0aob4wefv`Mud+X*8ur(vHsJx#Sj1dFJ3pTI%g@94fly4NrCwkaZG-ET z>}&rA&nfr7Faws{X?1;{s$$hEmOIO_4qkg(*DZa>g#z7}YI<|^zSB(h+N($OUV;O; z=OEJXJqEwtVl6SDnmwAwsCl131+Z=>mE9gv?@gi<@=U z|1irs&#C1YtEr$VXRyZ%gVUo`i0C4lyZfvS`Ij%NbjMHUWKQX1FrR$URy~e8&v(zV zXN7>31U#_lceNSfbYBMQru7e9P_3m`fpV&-kM&E}=zaSNK3!$Z6CuM z>iXSU{shXoMV-7cdhu)O1};Rto8T<$eEFMVSh4H8UM6p~nJPL_N{~3e3I3WZkM-Jg3uSKE+8rK&y1dfr_ z+5*JN*q5wLm%mw?6Bl7761*>2o2fd;P2sTk9{O_~?)G{CB6)a5QwjO?LS7%1uHol$ zaceNM22DzODU9coH52E+4}6PfqS*?=VUQvX*7g?RcSDcH1>wu+S0jY)d5rS4bJ^r! z%Ph3tN?F)mrS4!CBK&IYpds1*L z6-FaU_T|*Vt@A4`S1(tdy{>jR%RtElJS_NIQ#oy1puFIOUhDRJhsm~jh|OdiZ!<)& zIA=1!NQ8F5hS`ftP4*FUcQ22o>oO(AvJOHV<4gBCefuZU!ZV(orGA)mj(>t?!oVW+ z?(wH~L7L`!ng1sN1^*$S1TO?s`(FgqI9WyUF9DSq!uf}Q&XMH8lbbM;WeM|n!m<>M z(+g=?Nodve>31X->qm}TNu#>$e*XFUdih-^BYmEMzc}-nH;Oo?p|~KGX#(B&D@$rT zFC<>znG+Wbxd=loXXOd^OVlP28U2kd<;%AOn_1Z>JK7EALsdp-fmy3b0@$%&2*>+;bW<&6rKHMsYqlU5esJrm!!+fKZr>ul?KL2$x zFY&Mi_fII&v`+gckEk84W!WFGQ@qMqwZI7%2n@+vi1ssUs2PyFOS$6zJUrxI`H79y z-Tt5uxpg3N=d~xYb|>9JK+sX|Pm}Jp91n!4^;e|?y8Mw3Mh^7P>=X%gkwh1!9YFjYzndYS-6oa&4&;wpVZ*IpicKbNiz@cAmYHA= z4VLFt$}&5%M~h{Xzefd(hwQU#*4$Kb!c(@QdPACo(c>D<@{+#Y1|tS~ocJ6rEOMTt zeVyHp-}(93sk2T%>rOLJX8W35y3QkbCrA`(ubzD?#`q6Z7++BRo_@JG-oa=$_mRe}? zCtx*v zA=BGou9u8sS^R~Cvj1;bXp<09BFFJ>Sg8Gn7IOVV3!6}qC)ZzSVc^{lg}?+7XFh3l z9$8&L|BU3ojKSZC!fd#jaPq8+7EOptMSz( zgwa#8X>n<|oPd4e3MhlN68essJ6UN|=vZ;mRG6TLt-O z7?>UazQTyxC&3SMOvM*@I^Ca+;5wy_Tv0flzh{2`jO+6$d*Pi-`m^`l0TVIxFa$f1 z%+{`niv?d7dX=xP1CGj|gA$v~eWQyd{k((IKI5AeTDqiHU?F^ri4eY7z132h<-on) z^x?TvgNK-5Lu7b*YfsX#!)!wPi+5ip#36C|Jx>)oqrD@OtvR9X_M7G}TsN6Y>p2Z4 z#;?2H9O%Kcz5S*EnIA(S5%C9^tg3vO>(cGx(0(f-cbn4p0K5r^7Sh@Fl)mlRp+7^b z9XI!lK(#tYZlIA?O?->aV6DJojDDY;V2`&^Q=8Dd*Icm}&j6*I8GnProF^T?$Duqx zrc(u=#x*&X+K9#()B(EXpro;>Adx zbC$k9h_)hL!B44*ckR<{ipzC^z+Sp6749^=|Eqh~aL|p?Bd6Mf2tf znm+3NvPca}BD1n-6(cC_7EeX7_0oZR_w-BUqEC*x-1UUg@5WeKt|cH{x#MYe3bmTq zQrsP)68?KRYFnC{Ez9HdY&1M{X>X%Jd?;$_N?EEpW>*<$YEig7L4PzbBKNpaxLCks z#wlKG170mQf49D-|AZXg%P556qMwh(Wax9ppL8*o2*2IJgO_#f}Q%NY9g z>mG)xeyaBU>-LQzG$O2o&|evcP3?L_H)}S2<7{naLP^nmiYjgJDBh>&D;~EW4MeZE zw)gFQm2?%Z8>T-^mLdfE*kv*HbbpU$^4%lM<*`}7Vy?cs?We~yxTTU-f&~8db4>RM z5=*Mhc=iUsdx%!E0s1Lzy&yvK2xMm@gi0xY{BE%WXR>X-D2qkylw}f$MT?|ldR>k~ zPu{bD;C>#5I;)}qLhigZyNJ81$S*%X4uC8_$GW~QLn3)wS@21lWT&RlaUCNaOW824 z?o&}A?Ox5#U0AtNqYu8cfsp&W_F{!td!|V9@)JYVl(;IAT5}k*FC(fv@p>VkirK>t zT>e`mP0sk^1;|gvwd3!$empHHe{vZT4$=r-G+q+N#>HnKL)i+tL{1CM%FD+-pV8b9 zY!2K}noKdF`tq|N!%-l6!Ujn95TK`cPdHZO&!lXCZF0$M<&~{ldMZknP2nS9O;7$W7zko<| zj|7#f-yhUjV)B}43tyKaSj<5hS5&c|gs*3;YL&x0G2<|*Op3dA5#c05c^`ZTtsLia zb=}Fw%OnN3I(j6PoO^e=K4I>(BC8SUKYTa0ALw}CE-oxO1m;9QOq2`wUrgP%awb-& z6H{I#r=S##_P*+e1gcwx{GpQe>=Jl@#5XX9(_bEGqPg*hN1EFptW{$0dM?hAG!wsdP zK9(CdRQXT>H{x^D%z{V~)7J)cVC@^21vQz6U8uTl!+}Jn3LuC9Q_1k7$LT0qx`{=Y z8eJN_ZIP6bfgkx35!(7EA~evU81r>BI}wa6FBLCR67Hj6GsTGoNWAG$0}3=8HCD0~ z{k;n6$B`fq5CcvC{H#Fmkm{LEMw$E%I8fQ8M%#Tz<*I~eOiFgu#nnSLxVxPYVZEC~gG2 zwV0z3BSu}jf}nd=fRmTx@&4#j`+$wdb%=Xiwh9{@maYnlWdHp~av(Jp{0e3(04R?I z^O5yNCr@l@%f3PEPRlpm5c5iVBVu!b#P!}Siv8>D!)pLO4$Owfzxxgx@u@DVth{KB z=4+l%8upymIcF!J7zd^Sugp)ly)RbLo9Yf6;<`8M_*XcbV9H z1GgIbOb+;xfGG9-_m+V?)FQnJ%Mc49wt}`y)S|lP95Xx_oo0ffhCKWiWVrO!ww&gE zfT=B*Hi({aDq*JRgmJ^sqE8IH=4>auSK;bZ)u))yvFoLp3kY_8t@Q zrq(VU)28otsBc7G`a3(jj6Bps4)HHPT~9lDpsKw-d5KP}`V*b_%z~Pq@ZYY@!n`;A6P{p>SKng`gvF|2m+s$kCI)~dRz*W({CTttF> z{NdhMAeMXcECqnY#9pBjQ+`7Ttnku8eUGdBH!#uvs=5P-uLIuiYYvhXrh5Ml!2Fej z5;A*($~g<%C~)f-LMHMgMEgm~ITKac*Sc`q5K74GRJjQjj|XvoUR*wGzHJ=9`_zvo z&?m{tH6k7i5WZIZ8;N-1qjWE6ef?bPT6d_w^PBmUtjAZr)Fuf5Qh743+xt|m z(<_=Ocxyj+E7DC0fP3Nw)4}LrYAp~|?B4rSwW2`ACMPE2L0um%Gx1NIQ`X6$Wj~F$ zzc;ZIzq{^Ts7V>)t50qY&Bh*osh)`BBUiGLSRVw}n%%CC@$r$IUm6B_S4~08Jk;Bd z#Lj!Cz5o+0Q!e>QR+**`>UFIu4y<)1X(E_Rny|QBGdwKsxNcY7ND#O#z!YZoo4On`94o(uUm!s&|5BSNm2~7);5q#gOW4a(ujdLThlX|smfnDksNLW%`jm^&sZw!Fx)emn z5*prMM#}eX!a_!!v`#r{`D^i4`+=lX@D|*Y*SRXN=?*p|{u}n@b{s)rV3N6A)v{+$ zd3h7eQHxG!aQYT7`~>ELcCTkm2h+h&wd^ZW6I$~mXEGiZ=MW_pd8)51(rBr7-@TQ_ z3JEnn=&@A+nvuZ-kOa-7lmUJk_zPTL9H*kvB>ACt&x7gjmW@WX?GDc0iSO};{vf_` zEMO=}LlgS}HX=Sa|AF5(j;|YuEC?0|K_@$gnxM4G%Ztb7^PmZ)j5mGFU;}8_EH?Tm7Z+yGep@A7-6nZ7%Vj&D{Bd>g&g)3r7=4m*abJ6xO*na z8sBCuk9Ga{yy3B{A!Lxys5GLgWmBmSkzeYPvUxBWCm547K-mAx5*ZqYBSEkBa@$L( zyKy-}4*-Xgt1Hhn}Eci7}CwE~;jPUQUisd8{B2@3jS z46sPu{{18p!d*xvhRg5|F^~OA%=iC8%xmpimH!a)Yk6&Xo~0Spy2hiSz@M-?dt5Ea z6K%ugjj>xe7cP}vnmg1l(l^Z?=^IzzkMylmv+VyhXx>E&Koo9rd)Ea<;e7az{FIM? z{NbA)3e@~<>A(Wi*SEW0U;8PMCPZ@X1&7= zdiy@}B8h&U?3nXjuCa>_9*j`6)drzAUkSo@d7Dz#MH!A_*F|@=4r6_pK31&8X*afr zXI;i5#eR3Op^^Ss*PH4u@5F}T-8(yU3{QGdQnyH_PrQ)Lgj)1`^uDC&s%7#07RkcS zk+RS1wDLXc;QSwvd!F`1&&fsse8l%m{)W0Xqa=V+Hkb}; zb>DvjucgpROyTCs{#=3vkcI>zBpp>F(VCjpicDgJDOfW}sAkammeFi{C0J;y41xy$ zHYN}y#KE#!vYd6EtGnj?AR)Sxo~^0x;?)AwZH8*ffZ4sZa%e)ewh<>J(;sY(aX>#h9%?6oA{HUi0D&u-0!eqWU7lY z(XW&uEEg*%D}4CnOz6n>RZ>o3tzM|H$LZ<$|7g^YE~llZ8xOC^x>me<|3*tG7d>%~ zVL|@MmNMCV$(FjB8pZRZUu52$EoZ}0u{oo-$IxD>t+@|mFU!rX|9Wqb7OOhX@KPLd zETmAWE{kN^{#s&^8TQ7Gp(CXi>iJrN(l60dec1;hSojQ>^6CBO2klP&7*ohw;ehKJu?!^6f4lk2r7NH| z?Bb@(ikQPDbe*~L&35HdR<_om&VEMc+bPG{J<=3Yv-v!$QYO9Z0;<9iA!JT>QSAdA zEeYZWBdQVe`4k%luk6AzyW(IR{HWaWg95anFdldF(KOwUbTdn42Got13pLGQ2j`7% z)N#J$l*P*8?259H{nP>8po5Sh--PIrdJujf7d6koaD>CA#di3n)Uc$SjlP0!Nk&nW zM=O+R9>urD>P9pFv+MZ8vL|tnZ$>E8u7yN+unb_asd} z!8B@DdbVb3_wYwL@wE@MTOs^mpzRsnTjwu$Za83CH~8n#x|Xqm$*L@oy|`gEHq4X{ z?Ra}x?tvoJ2!_hDg<89clYaY&(}WZF$s#+AQbiK(Z13em1k#CaWM$xoUB6!n$}X-l zyaSxsLBy6yr(X*R6Q<2kIp4Z;ic9Al6(et%#;CYxmwWJ@0F6J_lDKn6%YHBx)>!F8 zgL*v2epH{Pm;lXa2ac8%|PDNH(5LA0leXm z-x15=sEpi0Dq4DP;!7)WE4GUgs9f|W0*nMHc0}vbaNJ2 z^;}$}&+6%M@TQk{6j;GzWQrOq^f_sMsRwj)Ib{j}uiZtlv_^x(+LnyUT*a@!q39Y$ zfjs?&d)OncE1hOH$!q2VF{T7mMQ~G}T@9T2hZBW^%c0-oR0V}|{v}_A0RF*PS$&+| zytfQ(!>iNex$2}W;jYWWIEkwaK<79f8H8u+ym0;kS434!?gwe@=FeyU`st*L3I_$F z_Y>7tI329~(~qj0qg;G}KW>S9{C$n#k=lZFbK_xE(p})2#hfPHF!%|bzVWF{IhfH^ zc17#et6|_@PqY5V;4UZh4(p6I@~Sy7Uh2GgHpp#dGcEojbQ^NN2;C4P9Kq9_7o*!r z|BumKJcRIXqnpMxrS^}}{q`TDTjc+1bO$=Wt-{|ua}Ra#SljW29GMxT^?3OE^WRCD zSSgz+(+5Yt-H9u$X$?jfPvh;07VhY{tn6JFw1PZdiHq5Ir1O+WRf|P(SOxm4J`|%w za=Z`4?q@Y5ll~v0TPN+W(Vg^SbdUTsx{>WIaOMWA7ha5R^nZ+Q$p0AK82=dEW_B}e z{}|nTzy2ECbu9w4>;h$G4Y<&szCsq`{&?N0f4%NywKq!)KU(w9|4*;`>-D$u%^Kxc zTbBNY6MQ_`&93 zw`S`7OVgbOsVxYNV|-ZwP5KT8@$;_&a#{Mm_d^UL1ax0Tr8D6V2qLf(dl1LFFc0!f z{wzMQ(PM2BTL`;16(^s%a)GMk-+B#cIJ@iCw-%@0Syf?a%3AEKE!);QO-a2?ny>26 zyy-TKFFm&ec-9Om98}^(r!&9ZiYR?^NMG~#jtRw;TQ=0>lQLXF9GOZsmAc#o1*GYO z_g;#%RO5Hx3X;hj7~1Z~luUhE#b=4PEtFE+($WLSctBu0 zqwPAGj>-NMYCK)e-YuDC$y=2?-!fNVTpuI}`6&C;p#Vjl3y$(kb4_D5dy-Z8lpvU1 z81`W77*Ez#&S3R@kWRZ(GtFNXJHVdtts#XzV+DDYhI@cnpiISZN!I$C1jgNAVjO~) zd9?HS46`S%G>lZEy+RucgFd{T1Hu7`-7o!$w1ial98r z)S4M~J=7g-m^Y4eT_i=5bZ=Xe(p+`FajkCq46b4Z2RQ?5jyCYSDhxjqnXJGh zYC#!a)`P8yuFc>U2Yu9!H2L>4J!_EPR_3^QlN1+U9qE&K``@i_nrONpO9Rm+{8baK z6>}Vw<9L_cPqd>fv7Oi;>$t6fe5KufMa6YdvHno}*HzWc(xx9snN3ckGu}_)3q$J-Upj*D^Sv~{ zePk+YL+|E=3!l{DwmST!Z(|cR#pKbLMzrmH>bbT9cb_FLa7mDt{Zf!)yCW*pQKhtF zw7s}%^4HlG?(YzE^)qb)->a$~G3g(h`gaC2d_L?)XDo0U71*08X4F11UOEf?^n zeA^Mr5WPo196ZZ_+eXw+K2kzO(1yB+U}5hZzy;O{K_G~!z5nJchRmD;fjb?+nW(Aj z{R5HXGA3TxMwShm^S0Mw?UvJE*}jU>8}EYM*q$9W_TR&0xlX>+S}*HpwGx7>pD8F7 zf+k9V-{ns^63Krrt(jQR2o(%Zp%;9bU~_?5b&nGDn0V@V(ELVC&N9a#k@A^yYR@o8Nw! zYe-NjxJj8cK0a8ta&B_3H=&COweQnc-H08U|6A(LL;RQ2oySC2wUPV5gOdXO6b+3x zO`eO>k6l_m@)g_!To~;e2)F+XpZ|$KA}{86hQ&OGXXp^YElLEPa#GKqeG21(=0u+U zY~Eh+YqM6vtiq5IOF1{({i6KMsgzB@5qd-!|4Y(b^Iq;j|I}vvQMcb zPW(MY80EXc-9or_8}BXr!W#_U@^^$V+l1Vp6cx6_nTet!y>=~tOnePYiOpHUd1@R* zZHil2WlcSV`?F2?XRR{M2t&cZx4sg*!lN3uf!C@TZXFJ($t6J@hnFOGHILGh3YK98gvjA#vYx6!bEd!mM>p;x|2zY$bC zx(YJdAoVyZtsK~csMIY>PDFd$29HQN zUcRy*-|9z(q5GqJ(|+D{NH0%fAdJAsPZqG!_6EE?SEotyqzDH-g-9?Q5iI)`h|3z?SW-??R zFCfy5{21MF{jpAU>*&bGpJRPjpa1)cvsN%V((vuknA@+FHS~uQF7e-ZD-|LdavL;s zEAQajZj^$LPahgtGVVWc1@ef|GJAM0*$eM#!@`bmpAxOFjSqpvTq7ovxg3xZ^d289 z;`*B&zEOIbSPFnj?6r)R8j_&ymJ>J z@{s7JD&Sq@)Y_yYoH~J1@bQwB+7qxuvFREVq|kvYtkrE3E{^=TV94i;sQQH#M$sT| zTGPi>U-J?=XNFZkEY|Gv)QXn$o7!6CN}W&Ig~|%^k@_6a2vXbm$%GY>|BJo5imI|- z*hWu-lER!YnUr*QDUCD;NOwthNl8pf6eJ{XN=oUJmhSFu1PSSqQiMH0pY^P@-uL~! zZ|^a_eY8&I31fJm2>1Q}U)S%tKeOZhIjQ9sXYmo1)dY$jthB(ky3Gc*PbVZ`p4P_L zZqM%U@E&G(9PX=Qo2%d2~0V_Kmz!a*&WP1!BnqeK7&-ra|QVKGn|RU5hqhQ$YiI%3IrADOtLNQPuF zmhc4E$B?;Z;plyH>zuGYdk*VyS~O% zGnc*+du7p~pEuP|1~BlS6BTE#A}v8K==2YI>azo=d=VbnJFxK~TZR*|t54|w*U}_- zu=#rZiO=n?Lj|a>UlMrms%*Y$l$`k7Y{jZVblBCx@8v}}a=nSeGMJPah8g4<+vX_# z$$u%F$o+3UlMb$D(hf#EFihuxXu|szT9)y{EMq}Ou+S)sd6ORpaZK{l`MsBNcyhY* z?3g~#G_MV+iUzPq27m2lp5a2dyz3A)0eGVC z$(MyAzv$uPecS^(nfHbm56eQSWCxhFOXG!w7@rcA=OA_SN6tfelO3 zsNS3?TKX-s0%Rm0dYpbX-VeRSkr_B4g366uz_uHSn8^ItEEDv|j>5o5|(VIUp3-y#FS11*rdiPqlh>gm7FBpE`Kd#t{S4(d9+`&DIy^PY(CT(H$T$bFT(;J z2R8F0qM?iYICaK|+64wO$sZCevxj_AkQj`bC)KSZh2Kl+qi=7zWtai=VPsJ1jwQzj z(q9m8zm_3s50~_3<4+-MvK!|bHyyk69k3hbV$62~G!{@*7zP)k=B#dM{i}orj|QBj zJw)GC2y#6>g?(`cM-^(qy1%rT@;+HK)Aq@qwHQt@Mb4+j+mA(;pKG(!uZf6|njA-gEQ0_#C5pcSimj zm@i8UOW#LB0S2hDL=-bBw0$16jwSsnWOucA;5eDve6PfNTgk%(mt{`Szk_A9(2wHh}Hj{}z#= zNh1A-z9~5Vr3j02COK(rcrW^O@^Zndsg1J@XG_$io_%Y*u^ z>+=WNGf)DA$>G^h@|?qk6XsP*g?94co zXdzo&?Cf_#GRgiSsz#J%FEH9mvA0{L{8yeyjTzTh+~cUN`z&f)4#g@44`fZBCj3c;8wac5>$9o;-4u^BA4f z#@ri4pv@BC;YXmEoF{--F`Ti@%%qteZ677*C>F~RJ`7!6uaqSVcwI?2!|q!W>$tl_ zB2nEWHfZiOS@V47hzQ%%hJ>ejbs9&KDaY{Blc+q_k%nWB0$?{20>vCKfU=KgQjtr{ zAJn|_gx`E2c}>@lXn>gzVa&RM@MZ)pdySl*#0r_Us;D1}>W@W3mYxR<^cD0kuOg=O z^q6Fy*5TGS*-pMpvB)!fvL9O%V^dq4Zs)ofkDiY{G->I{`@t75a;5L5|F-q~Ja0(u z%aEUZlVBN))g=+dF1W<15t$gXVyl1+*Ym~ROfWOZ>|&kgmohf~8Wt5I7@_<`FS-g5 zG7UKRfQb-ofe;@s2gAlE>#Z$eCeuwF>cw&*nY#L~>xCWi?m@L#2mwe%6w>xMx}7uh zTYG?*7MKt_)u(%d&&6Hfm_z649*~{|W=GTnhO@w=_e>DYW#F?Gm>wI`v`}d| z$7Gc+5`DTGc%v=);`r$7)^8n376e9p!St|}Y28pdhEPkd#{ki_u87Y>=`GC7jfH!TI$$({=?55wmJkH+dMQ2BB<1LjF>0oT;VktiCAR?n39E&*H>8U$@REksmH@c( z2EGufTZjjI2k}7h&&)%Y{9c|D(k%-MD@$C{v11S`|JYj9``Uf^N+h`XGHkwk0(6z4 z{>wa#GUUexFmlOCa}TG+^j>ZX`}b$nI%B2qx(gM&?;>#q@4MLE_FeQ96dZ}qYXs=i z%hjf0&X+yno@Yk_AU4oL*gh<+h(pvOWo@#INitB-)hVcyk;yqZq*>t5wN$X74Ok=d zUL7~9p8&UtySAQFvQuD?fPUFR`~Eur#qV#sqEEwRX1zI7$zz0~02z0v8q8yTD;U)lyme&I|LFM;ey2`g=78yE zDVf5#(kaoP>72!qNnyU$wsOUOU9ECy6&Y0>4}7zIpQ4%4g1|=?_0ox*<^02{XVPlx zgEI@`4j$AgU4WDVzfjLx?*# zf*=-$x)VV&a;H>Eb=2%TI842|G`A+#;)6)n?Ef{8Zlq z0WlvC*y_HOPfRh^>lI$+@OvWd#O~~hx!J|zfUq$2dgzWFI0n5`VK?%hm>+ekxc3F+ z8F1!@^*8fVo`ni$er$d-KcMk{W_}+0R(@jM3jbDq!0^9fxbu@N1$TZT(=1-x`xocO z?Jws?H}apHpVR;1{20Wu*^hnu+xao6kBz6a)^Pdl{8;Xmy6=Sm&RQViThr&kt?5G_ zRY?aoeN=BvA94BYJJScC=V(>CGkst-aMPz^i}lX*5w_{gzxgkwPr=W0vpdu0bL2$Uua;Zz%iNQ6otQU#Crh>qO3o&nr*BNI=ZQm_cm(L zB(r*eRBIK<_ytx+_hNOpb>!z#rKZj{j#fOjMeV8X`jBgt{5GHM-VcSb>AD|rOwS*$ zdPCTr5}VRhv#Qb8r)`dK#I&62UPVvkFz}&ya(JSDoigM6ZTz(THhv&)PLPnDzrSwk zOKwYkhDA9&#HeTOjZNY&VE=~F%RgYp^lepaKkUa|fZx!ukgfKAXZ(nS4QP=sQtOz_ zrzVyNj0&U&JmU5`T~1PT52nx~nCPM_iyo|u&sl*wg(lk$otR!f(L@pqHX>ZaULlKX zbF=8~b7>zd@>LW{YG}*eaj0V@XLsDP_i}w|?4sZ9#ENtXfz>dw7j6iqSzPbxQ#F3b zs8vh#RwRjB=Y-lIL=749-ZXTd5Fb!)_FAXVjp{}^uW+&nb-ilNd5%L-7lbI`F5#^5&S{k`smFR z77MA&bqQY_43>zepx2H4vTWKZtC``gf!6dx{mZ;Z=SMYJIYJ{0kmnhV@sP0Z^f(yx zD!04N%`0JGdyE*S@g_9utSm)qz z_o{?J8k)Sm*Z4q>PkT_S&_$E`o;~q}QWwY0X`ic2TaEF2DwA)4IQ5BlBGtT5`^ggu z1PghCc(H9M?CNj(6sGjk{y_CtiLfrJNKxCQJJY~f5^L$kx}b{0c>GG;fPI92b`*U7yUZ-CKf?X>@%yL0^mp3K4ml7C zvuivDD)T+tsw@Cw)IAkzDmg2rO_9t|kd;hO7xS(IDFWLr@>Sz67USRx z4cK#W+9aLr7!@0lR{`+|vhvL2rvf_yI&D``sfR3XLTcd4#swx(A0xHCC$Y*!f%yW+ zQ8Xx%>Ql8(D%Fj}&2slq+R-A60UfE%OcsqX;4vK+4ey?-Ml2n>UJU)~LF>ZR7WpL_ zW`1+t0v6F748-1dAllX0l?e&eqkB0wu#6Rc;~&~CE%?U1FF!LrW>z{F6T%W4nkap` zg4wFwq$bk9ezGsAbF)n{7^^ajY^?cJj=pixeR{eM~55_pTW)$S)+x3 zXco_WaSDonow-lR&J~TMJJrIFkbR%_XbYQ>4!Sq|BEcwemFUizR&PG(QYX+gPz$v) zz~lu9zqdN@l;it6r+w_26{9j-$lWiY`7u!e?@aS*5Tf zJ56Z#-kDT@%Qp8POvu;W-#lsP787bd6#m$g>J=H_wvEv0!+e&W#8R7Ly3EiVzM-^o#?eS&bir0`<--gu`CO#8tyR zTxi3Yjja<%y`^N~W%FG7N?dEcE!$_8{0j{fZ2H|&!-lH^=he3T%P|Ji?-MgFo{iIo z4jUPd00s)n+E=m#4w!-;w7GZT&TrR?rbIM}*i};w@sZE%&0X^D&wyN#XGd8^-w;|3 z$bFBqeg$0SQ^|?xmYD`h>y_DF=xYeuU8F7#<(83#*40kGtKF)0&#EpmHUe0UK!S+w zfVC0)D8)`7*1`IH~oj?d4}lHC&zEce^Z88p^%7{Jj;@vGS{=4hJH>#eqK4U%93b!EvD0 zTO3GI3J)xBS_ZO*$J?zVQJa!n~sHzl*pFEEmIl?AP`rdqqy zCBVcOeka&r9}|G{!SR?&j_hIX$K7Ob)FhviTRinu;s|!?aj=T0?~McfOH-N{B3aMR z;&y>l7lz`)IWKQ^wqDJ0aJ>-9l@gMD6Y`YDEQ|8w7&{4G&7tmsS91tZl>Vuj^J6?H zg7$u$kgeQb)tp)S<43pE92m9?yqlw$$(R2L-pxre`k%Wwm3#1|GJfqWcsIvO5Oepg zo1>v|@pm<+p8LPA=9qT;Q#I%0uA0;Sk7|yVcg|fmXZEg}^YwQ(#{$h3-px6__}$Gx zOSE3)|8KfEQEu>V&iCNkYR=|=spbHgp2T3-zjSeC_wTwmGSBY1ILh!Y&b_$5x;R6> zyEv-0pM1Rjsf&Y>Q2n$p|HpP^-u9m^PCG_!b75G9jcp3Nic_Te&s7{=z^)B7 zrtMx${i*1;PH&(8>Ath7L1=wWb->a^tiQGIQxd4(#h2o*s# zi_d7bS2O>>J%645!!nWfG!LiR#`Iy^c6_Wf%+ka`+G<}ikB>-(^afi#noRQqK2_GL zZd?hec9YJA41dAyY*NC>{fq`PjtVvqSyWCuf2i2bvEfv=*ISu>Rl{PcVud($kRtK8J%@tJqaN5=ZzFr=E5w=CA;Govts1}42R(koG2+jFxLj@2bO`Apzg zy0N+u!K-LgJ=;^9AwGuaNi)ohZM0KD)c-5_NQ6TWVPvf#32xSnQhi3o5!K4!`I zHB6?R%>5WlgtkfdYB}&ZVk0s8ZkxgOfG&C=p7!GI{KcNt; zI7rjuN&vHB#Ln;%(#_dzQ8G6e3QOT_rVL#*=~?w!3M9WUKOrkYHdV9jiwsPKM=?_A=sT7btlSm4b=XH5EJuIFk2Y$QvIF zV&b0^*N*2#%q~iu2ICG7oJcwDKj=G?-2pqbaET$!aM|^{5UVS~EM?|fiv`RTkwwu@ z&c$mVnOj;1Hi~P1pLBsxGzxWnF?}Lm`YS4&tUtD7hHQ~2fih&U?*op5tFh~HwiVTS z(RbEj6V@JNEA zPQb%4)Wb(R);Jky`U4GNT(TWtD@Q`25G%6ud9-uH`zy+4TsPyZlLS8NMx|rUs27lP zxuwrRW~@duQ?GVup~B~!yZCDID~@!Zu6EHMm<;;8K&wn8oXUyRK7?APveR#FWBtUMaqjgo)kS^^5=+04W-wb2w8tCy1ejW zVA>V?xL4`s)wR!NK_TcrJ^AQI=( z{FM9Zvo$FS;A!s3E{m>SiqS`x{lxUG9$YM43Oq_#&c|Hgu||RbC>gHdCn%H|y}Y;a z6tkWxv6J4dYVVWrEL~%?a_~nlBO0%v;70i_Sd<)XPQn$jMw@R{JMwHED9wQJ>M_?c)408StI@_hCN!J@ zDs@?RuQe|)!A1nT2e;A;b@vS>+0z58x4yLxDhRk^c(V(T;vyFibqE6`xGqxE%{42T zo-8evu;NW5pkbXR=aUa}Dek`;x4}25ph*WqPU>CGCa-2$pfV{)z&aI(luVBSEHdxi zEd+t=K0#qhL`ksb#N-zqTG=wZoTYM7Qq+UDj9xAgS=Xp?UBK34bwPxRa94J?2v% z?bRp3kLZYFaj$rrH9ET|RwthOQxw+B1$qpx8R0A6jKY41TI}b(HlsLgC)h>@8W*0G zL)LepdVblXJrw5K?;HL4OBW_7=Bww7KRJhS#Z-55X{cDOjlJ`lBA>L-`PACRvpd%G z(jPuUFw~5E3>#Sdw4ET}@LpyJcB|D=uyM>_v$pXD1>87k zlNvRRSs-IXYLcS&`s$Y6KOPU3S6a{}|8fpzB*F4oHPUbj4^W7E zn_IV8c7NQ!roYhZNPJ@Cg?TL_mman8)>p+CSC*tzmk*1XFdup~QT{p(Vj-*+n=Nc| zZhQGOr{YNJq6}dMMVfnx>kBeG$w+&$@o#Wxb8Td*VjR4~ywqe2BJ-asPDgC1j%P%K zR;dVua}*!+QfS}vr>R_1DUB_Or5(8G!5CKU=GKT_ep`Ip?g7qb;koQ#N-W?$lzs9{ zQR)@5qyj3TBc9F>n()Hc zz1Q1cQ`ttvot8F@roM5Tq8VsX zdm6=*No=1N&(vE)BLm=;g2{kdLgJ@v;+Fxsz10k9R?pQw9xij%=)VC7izd$c6T`Xs zC5gxeo`mX_tx;3`NcyfGSg-}$xDa!S*hFY2AEq5*ePGzr9zm}k?U6qWjb9rGm6sMS zRbq*mM6P4|9&wrR1cwmw*O|j?5EzT{ARlJ z&I)~%igG^E0T|3s7DPR$QB-a4iAe*Lld*4}z{aBFY*{js+|xAqp#^4nW`%YZ>9ng2Jvg>y%5T~Fcu zrneHSTy5W{{-L*$?&vKj_3m5J^$E*A_E!B1+Wo(Q?)H>o!G zsOo;@;K<~&@N%5kOovzn^K6kRT|4We=L#$FsMDU|RnTGE@Ouy3(Nc^b#(z4W$aklq zga?;7G-IpRB!Ov~4R~_{FkFYyX|yV+5B2a{30e2il<-a3s1@ISu-dA*X=IievW-qi zXmUw@>a5#lxcpA1qid_WlHx*tER^1!YvnyD8iNvYBbQcPYBBvXwQBetgnSfV1LgXJD9?@1nnOCBTLW9NUP z_zY#4`P;1efuC>_7m0L8q$Q6LF21IO1+ST=#KtKJ7xm{!sqla}3OWqZPz&1edc2$p zmip*F$K8*tZ;!jPMZZ2){_D8=pHI63;iugn?*AoG!3Mr==iA|0;a_Y-{-Zg81PqT8 z69X66O|xqYa{rv^)hUrxNPmdpSHGSU8*Iw}UOo{j31b`vm~T zTu@r1+{eI>D+v)`5=caf#kX%gs?i-Vo5aWJ2t0gGNCi5?Ds2JTXEZ>mPB3gxcCrq1 zSIGcl0r(%hxCG#V2np{QRmO#3dYXPo0W#@{=nx$M4j*Fhz3Z%ONrM&=X`d@uAke_?QH@$iy(;Z=KOrZ0GNF7UkMzsc{LX%> z^8ER)9bC^i{1}s!a;J!R6igCOTwtq@)dIDX+_QV9tCRX~mVw8KQr0eXlXk)+M+%g6 z9&{VnicH^@uS#lrt`h-{V<;i=qG29D8v`n!$nb9-(D=u(QRF|4jk1{JH-azT0UV@+ zAi&Qa#D?fqQ)~}{A(FBiXQ$yP=;wKN(?}erHE+~#H9uuhVny@RNrMw0aiBHin#*W_ z-3df4`YGf#GMzQfqQQLELBW+w zAKBuoi@6H`;ZC4jz&Z<}egAGmG#lmNTo=%v1z~`H`zi*IN3_Zs)jVQXb$32R5$bN; z0ZeAe3E)}_gco_NsSD7=hdyL`f2QO6=Gy$_MSJ~uPWQp}Y0&m3s_Tfovs~nEnC8Id z5W{PJYw}DsT#jii>MJ0l6HEjU?h@gnI<~3%b^^a-AXWgDBNP|FAf&_w$i$(WQ4mTTT&WBjrQbvYVXT!a?mZW_Bs-{wBun`Y=a?6*EXxKGpL zg~Ehjwpk-&kHq0%6&Ea)DluKtz4=A!{z`nf-1%la?=%0i?K{s2(8gWBu$N1Nh| zBWGm(Jdvg9&UHRtiKiFpK9Bi#5mFL3>?N*Z3oer!p5;4yJECU7_#JNDLMwvGDrgu3nwO|;6Ihnn;d-2V5-(%6)#1=>AHf`rTM-| zvAx5d6t|=w&`SYX-?Ow=TWEtPS%-lV1qcjSYy}zfJf4xpE^exwqWF~+yGcL1czMdd zGkW;uI%E~g{o~EkD5+CW%j#r7I+^Zi%yqY2J)GvK0geud3=zG7XGcWZ@Sj2o`4BC@ z1(ldpw9?*1uj1vnrsLeUqF$r5V{iFZ+g5Fu&_P_yb-6_P9#CJuHBtGD7yL~1 z{X)K2r!vfF@U^=%lY)}^!g=<8X1~?`EBmc=%YJts!2Z?!<{|pB_{aUmbw%_`#XOAV zZ&^QW|M`FJe#6=C^1s;cD>(bTean8o`k&Zuq(AOAq9Y(!2%#hXU%K8Fh=#zCER+Z! zttG($&gscH0liuhaai#kuPvDh=e5^aRA)`y+?EBk=ySn3hCv*UC7>kx z%I{#1uqe={0gTasKa`6=(~kO)029f=3yDk|&E->&F_1n%0f8NEs|sVjv7T%lj~fyP zZ9bWkNEKrlvGEbC!Ak84$C8ZA)jo+<&qqbdjH5S4)PC=W5xmmfJvPCA-^%J zBW=LEmTwT(^m4^11?XnY<{pz|MU0fs~B{iZNL(gjKWyz z(x-s`z0|N8C?-~hRlptg#omoh*e*qtNdLRtEJ_)s(&b_7)02V047F=%qm1*n2(8n2 zg_SNXy;*#g=bMUiLx?h8S&zH&=UI1Y2q9cMe0_*tGs7kH0`vJ^dB-^coX_FoR$_1Q zT6A2WB2G_b62R_QnWoEzjd@FP>)dNGmi~=e0JSHi~H)o6J>z(Enh$)ybp} z!u`oUNnrL==ygamO4IaeR3)F(C(f3jR&Pj+fC06^HCr@W=~e2%u<(E$va_Md!^rCq zEgdy&f-uUpIYx74dk16WXSBSWH1xO}P6mA1f}it-&c3@Qn_Cac^Zfh@QR9PLbTk)y zfgl46&bw`HjDXlj_*--UQ1TJ}7M%;se}un9v$rtSW?^f8Gkm(pyNe0nWy9a1;mBMz zNLE#0;%eYdVUVkRkAJH$aNVebyVLNsmUy_imXD1&aGOf)UA0h}Vvk-n9>*mgV%epb z<}34BnO$S3nWbcV8h%4=d78hIWi!N;6yF|w!UbscgC3C+Q7E|$n}BobCla(yR)g{~ zxB8sa%>D=qn>EG#pavu)cq`C$2xLnlDl81@Z z&WFF}AOSD);qN(!aXZ4lv0%STpfn!@!6^ORYd-)ErHMhn*L?Vdlb~(NY7K+KJT(C* zovEgL7{rT+SO)MmLl^+OQBawprH(uGX)Zd60_cVFSWHvVvOKKIHLYBE&H1YDr4C8t zHX2pY6MI!tvOZMqW)T^1Q9w(G)0=lqH;LVoYO^CWhl6CdAnaY}1QlQ^CSpYT@)Ka& zgwod-je$Zi03&;d+(R*?{hn_#zXIkpgi3U;$QqHOIypu~sHhHw%#`gz{B8hFMEC<> z6cCRHe*jF2zw2NtGeuTS>ZU#aUm$eZBc%pa=;J0R{t!am||dMNT@^-U6d$ zYBk-VcZMF%d!=G_tAw^&L$BkHp%+_f&kfu(v%7M<9b0=^F#D2k6?pRE;OPKKvieB# zrGazwFU}8d5AFx7p`fU3a~IVh$g+Q7MhMfqO@kLCv@i``Rg+K>Vn?+`d08IsLxUH)N#Qzxt*-xl>@Mby`<2 z&HusB@v=ove@5ry)AL2GMw{2JQSg09?suG9vvOA_4E>2^TD=#P`5hB6%^C8Z45mWw z4C33~GQSd)*#HpJA(CiSsDX21{(xf+p%ixJVBM zsYYw9IDh5=-{FB!l8pCv2rGZB@B0}tp%Knyt^J}%`5i(`0>U+KGw=Wx${}7^t}L)C z*wolFUEB#xDwC!w(*2HYHQL}hyHNG`dzbwOIMj!4)FLlT28a62BjrNYgyB%1xnGiY zsxH=HxzIQu>j>I_(N}mHCt0>s>Wc2{UtHd`qg1)P7ZaKvn?GEe+%UzqB^>;6BB8#Q z>%0-O-%wmeI2Vg3FX?9GfFN5?L4Dhf8k&VqzaMR{{MC*UHRDkx4fuK6jxzYSc9hS~ z5w^tdaunfRISTli386zT{auIx?7iVjG*PdKxslFTfx2xXbL?Z(83kU2dt#LlrSrwW zia!aw5V}T;i@%haf+P$Lif(dnHvG7|x_!?Rz`%zpAZPnV0K}t^hirm-6+iHP^?yHn z?Qx(Owft)bebQ9wie!FI89nl*C~^3`3XbEL&=Ui4<^@Mq@4y2P6a+k6CLvG_H8v=a!0cX$sQVPJ;bvh%jAH4tjP&$zdOW!cQcR zVT%F3Y|~n4jHzEJ7DCKe26A=^X1l)w7ovWvUq zvzu!+Vg&0Gx`jE;P7?Pf{x5rKiz8oU)G@k-Dx~YohjD?@x5QNP-q~hHwhTM-{xzX0 zKS+JMH>Q5KzkFVqbe{Z$`qlCO8|oJbNB!L09vA=oc(=&DG$FE81K=4FlfblmSbrIQ z5g)dxHyHIjQEY88A68=}lRh^G)Yat=4H(n%Pa2Qn|Q%D-HE_A>oMGiwH(;iVROZ+?wh4 zU4={59p?4XrwiAGk<<+jb$$O( zdhlhQlYd#}N&0`a%p?3iE%Pk>(=yNI-7=5p)u!l@kSN;W6{zK8C}{KRBsyS&3w}ga zQHX2FaY_Eo8hXs{CEnvXR(RrAMX^cr_w0^_(CzGwR*liOCabYLz2+vdNAG)czYA*n z@{jG~w$(-_ED7y9YDkxina;h7S~mUd*ww%ty8*ak2cO%Sy>;yL{V6t(ZdZ8Vj$QxG z>vMn}56lWS@BAP>H+R{ycN~Da7yKSmsm8vLR)3z&SXW6ijc<0L zGFm=W0(Dam{J0cM3Ona;aI2H9yE33MFuZ)cobH`igSOhxCPw-zv$Q;?j1DBxQ>E6Y zIk(V)mLYHRT$bGUOPyVryNk;Ey{%22{;}kEtFvy-96OG~P?$z5CmNf|>ddPhRkNn! zZ{)pH^BWy67Q?14u{uI~3vZO{%Binrwlnyq0wRjKi+QlMqNo%m^j*^^#)-=DXDF}A zzd2wymV!#S1vL|P0E<1F)!sEQV7vq+hUxGwukf5$ZsKntqjtXkvQU`f#1b|74B7Jq zTH)oUa2mTO#pAb;^EA4}>%43}5tv3_+m=;1Un|=W-CjbShbSSFC_sSZ4iRkMNL`rhd8b;?g<;Slce+?eZ#;Ejf%uqp!^~BY^h+h1z z_h%t_lEaG|UY*FhOuDO1#5xJm-c~2fuk)EAh5uk$>vx#e{6+}|9Md{|NxRO-yFxs} z*R7gvGtzVQAg6~<;izE*-9JfnT52-YoQwH2^`<${l?{4C!6uTr4ev!f^~i_!B0ACU zdJ#E2cE5WOL!WBMazOR)Dy|7Imj|+gMV7I<#Hpp52)sP@d+okICd|@rHfP@S{`%Dc zrPRiN8di}SI>v_Jr;A}WtAGG#v|tQ*DW2a&O31kbm=@w ztj0T5qzdMnwTQx~%)7`8)7~7Q#Ydbkua0+4i@A>&{xKDS;T`KFtQ_L!r9vtUC#adLwuAkW2(y$ zSP3Kp14VX(lt?9wzzvLu0TBaW@F!v>Y>?o`5r*=%E*EYm7njYY*WZIzzlVYOSO^vV zGzOL1gu0AITqBB|0M*6fx*{+vOs)u^)7exH*aLqL@MdaK+aWBlA8P zsCWxv1}K7wFo2D>AWncmnOFlkUEc^$5rU8b;o%?#fK7`?5kQOpJpx)xq1XV)FY^1q zv?=rfU=jhcLn5REh9f|(0EG)F9UzuT2nCE>NQr8aB0*n~NQIfbXiZNCgUMGOE2mh~ z)oFT+zS%Be7{7os3xH!j3FAY*MPIm~K*;`~H^(80;LcF65_qp`G{W-g)=&rqMwZ}Z zdmP}WFk=6tC>L}*>cLd`y(@+JTjLcvWFYkLyL+o|KQj z+=}^*yX&;r(vWd&Q-G1if*gmX?hLq6%Mx@5xirjF=#_s^lN1jku#3mB3JRwdA26k>5eP8tMHUR-$o z{%BRfv_@mewwp$&qjcla@h!q#A)B;cUwVshlXqfIT0ArztBAdTUs`jTl*SxMsD|d# z!o=ebpLKaYtY>;fq;($_2^e@1N-5f6qEuxg`Zih=baN}m3a(W`rDg_tEm6CC^q)2* zi>63^wNf+g?QbVIPxkQ#+Bt-_taS|(V?L^oM~`1=K8y3g%x<&v#(j))UsEClXqA9) zDc(qTjxcPz$&nvRuHHK^X2hf(dKaXs3h5V>r_zjdK|hO0Vj0uWi$&4-L_b#-kqd-+ zr*(P6pJV42Ld?g?zGn3sn06|_zM@h=77e8oOlELN{KoUiD+;`(&!jGKGquzH?9 zxu!k(PO+GKW4h}1GTgn;&l9*Jgs{W^PqKs%a{%v>peSfshWnHF-hloVk-BzcjIBuY ze#ZIKjfCr_Q3}PiJJyYDN2OcWwwk~)3*<(WqQ5If(1*Z4+yIw zHow1)Sq9i7;QL#V047R=4EXS$UZ^j5(5QVER~uw!J0}Saf&LMQ0*b;g2N^~GPt%^M=-FcP9tdNPnp8Wtjw3AfU3WI*k)e9QPiw0H&Kw8`DUAY<$$?PW zoXPjDPCuKfL3AYe@cr?R$id?E-4|;nBK~I1h+O7?vh*?KSu*vceTvr!@%`I|g0}LiF5z@L?0wI1AOX#SVzw#4tU&Hu?X) zE_y$;O3@k92$xj!D{%A^3Pa=r3-I|=nn!#`KdRLD`35)%#42xjl>Kn{xJVJ~OwHQpwXj?euAkjqNlDS% zeM=zVwK%*A{FsD(IIi#SQGs}UIsAL?)0ypFi}DfzFpYa41B7jZSipT@GC`G9C(-bi zFsG%$dE+HVqWuG)go%a-Sn>j~1F$AyJb>&ah@wVp2ZW4>r~-(2gUASK+|)>ipTj3D zqaNQ*S}MaQEo+>-L8QpAS>wI6EP?s)Ve5o!Ugpu=DAT92#$O0-3Ia{B^s_oXVNPfF z_^gi#$4FHVhHlk?i%*E(5X5TTyq__Xx%f0GZeN5vEg3TETe=sqOtTNpO?JfgGV9mvS1+y}9VaY-YhGi}bz@@z#-@bmuyUKGcI%Dd zA=)wY`(c8upSAc`w8=kYq8)z2(mWaV7BV^%aUmqDk*n10x7ELZ5;eiw(Am#%(&tj| z+RzKn>}AD7|87H@4{Q72-L;|L{BA=d6n+WgyY+G1;65(=xUJIj$!{N5kGM}X{0;2Z z$6cI<`?%>uUJIIF3@s6+A>S+3QU+X}`yt<~4{nB+YIwWt*X(Y9b1sd82?x^6rG!06 zjq+l6sA8vnYxSKlclaZk_8>EZhMQl=KU!8Yhu0)k+X{-^cu>;lej;RyT8V{b%EDIt z@o?|E1V8_to7$G@-1bcsMYknwRD~fxt^u9(s>k6+aY(OCV$to#ow7S|^;_Bf-<g3meFORSW5rX&&5dI{2ZUmtvA=y}&R0$NYuLuc0hRWG|!kQ~L+H-x*OUr8w*mFTxfH7BM zHp`gW;bG_hhrRcX$NKO8{yVJ54#%`-Hp!l4mX(lfDmx_E;~=8UB3{TUD_a?d?2&}5 zkdTy_Y}xaAQ=iVy`906?_quM^@B00B{-gfsRyW-oujlLedOYrT){sYU+;PMjUA0rZ zjHMa;JA2|azTSm`L(=SyZca$05ferEg}s zg}#SZJaZm<^lG%J%eD~Z4qCfu@52Dl?4eZ!my4MQum=Bk*&k;$yyio8?Gb}g2iYz& zXNiJeZQ9Mh+O!@}n^xQI?NOQb#!;Ep{n4w<)3(I@-p~Q{G|&)#lNH z??WCxn?Q9A1_dAA2M3OEs%lPdM>y3`5csk`r};4s@A_g5UjB5y8bs;irw>nId*33llK-PV!ukG;1gD& zT306~t&m*xL(79o&w`1v_e;% zhqxG^TAtbD+{f$Ce9cC4m4D|{neCU?w-$%#y(cPqL#VYL%Kw)af~7w%1im@Yh^=un zVuvpFVG}CT7&Aumn7Y7ELOKDwwp~CSM=Jz_Tq*bn6mTS>Q_|slJxw!9;azyZlq7xl zrDl8ZH+l`$XTM)iJ@IS0etkS$yZvptM*KBhEC2I!y%Yt;#!++-;A(vw#RhZ6K|^#L z?6gzEy==fX$=iX>?b zzd;Ctm6vcjVnsRsXzrFv3}CZ>gOLy#rR1Z*GdDCh;PZo$Uw)wb6H*aYk6XNsa)J@x ze`wl-E#+SVEb9n%Y>0KYm%wBDo>38#50+6g=!3^Pjdx6KYrFCtZ&QpkbZY1Qydy>1 zR3VYfI84TwcWt~c5GiMkcyBAGBcqs?WL5s@-g~r(&}Hh}U3;aWr59wSGm?IwRb7fhXb(Ym-pnGOtVPSS1wiv(T5E332|*Flk;vxW(9~El+!;8 zkC~qTK$6?DR6B&er~fD#hZlIQX`43SW@W(L3k`hQ>1^*51l+;ORa&GPEyBz+&ju!3 zDCL>-LGr=4iJH#?ng@hNkJ6x!Rmmb9b7 zvOq9-Q(ls#-0JLR9FTcO%LuCn?ayf+V!QuOANa@q-|fMFt--%FJrTABRu*(rjDB=2 zZ%hmF{)`VA$ z4O|EMgssR*rH3~VMe2{Y+kpiR$w|y%UnJQbZ5IS!?X)s@-r7eoc{=Qo`FXMZ3-a^7*;Lrn^ zL{WUZeQv=q^GB{men2))NgUNDo8*;4>V?gew9|8y<^VulS`h{*+4;p8{1~v%g^2ovsvxuW9_uw zRN2QiJw@7nA_Xtr)7AmwYNQAtegO@BFeU^CM*Mwqeg=Wtur)bqN;IbbI;za7et71M z{U!SkplBRzWW(W-mNub8#`18%i8>+Kr^7(TTGe=M+u3t_&B*+fhuZLu&q7y-*1H^g z=$8!0^^_ENDz#vwB~$7@Yb7|p)_%HwC(}!Dg%u~=wII|rx(6Q|+p)ylgPu^)rS49J zv8AoK7tNez;z18DngzI`=@3XJi(QxSQ$LLT!m8YUM2=O;6L2~`G|nLabGZmcmU^=> zDVpflBBUqmtD#2S!R zFxVh4dd0*50;u69L1+LXj(l;K<}E2vi<9^z{Mu( ze-h~Ygmz(RpadYZfc6xV2I!GN@&Z{nGxI;MeVGBnG?NvK2~Z2sqj5$1^bRn*9WOw| zhmZ&UJ#ceC<_2ejayGDDI6Y3o4SpUPWbdJr@#+^r{}h7L_&B72{T0$k`8R7_#f_N= zfjVA-zdVN&N1nq90?2c?5fnC;Xn#XwVzPTcVteFwF}%Y*x!`SEhmaQZjgPtrhsz%p zOc6Bi(ipBO(XeTnottDS)YY-MtUhxAf1&s72ebdp7FQeG&Vv5^AAtBG9fw22R}#DL zipSv(xqlb_kjePx@Q1<4^dbl=ptUN<|vd6*{RqfLl6pfnce#J^}1$ zz!|{HGL#~yc10p!MmVx^R2+=*>TZFY(xI5_-pWFEcB?ZO^M(6^o9ZqL4{Znip<~TOcqw=pA+rHzBEx}R77VL3h=&9wQfI#@)0|KBChJpj(-Wy_c%EOp z!OI@BFz6ORk%4JT6b*!^-LXWSm2dn}{n#B#^)|9>ZQ2E!fA&rsV_%5x9;0qpoYaLA z)pVy~tQi}$U149kh_(jne?5wKngpcPzyyk!{29Tc9Xd3K>_xNV?S2K(a!mA~yBDpA zi<4s@g2l~ZJn#;$1MPK$C*GkEa419u!FF*=g~)Ok%N}2c&+V}_Zf6hX$w{u$pI1)Z z4V9S@c^tZ~W$n>QyCDeTNl}_Wp&2Cw&9ypAXfK#Jh;l}-o<6u1dn34ScuvD_II4O+ zVHNT&9WtR)@frO;fOKZGAh`Y>F^`As1=z311G0l*1XV&sWkzYuTXS%082uF7S7kr} z3JbV7LMvECpJ$xLYSTP;{X_qWo|x38##s4f5OoXn1{i%t*8_zN#1oQ1#_2+id2U8ZnsP7B0X$D4m)=e(xdNd^%c4xxz4P=DysC z_fM(>@}^BWMbahim~o^0WdBKTwAmK}NR5=pclzks zavz(33++B{8bCT2)T1T_4o;Z8%9aUe14;jK=v>U~KT9 zZ!yyZS{}9z%qP%XKv@Jy4eFrdg9Nuj>o(VqsdoW&6KHnSzitmELOlg!4qt z6~_ej*CE32KOQ1rnHgb-`zj4*hf(|v))ih{{V)Q$Wt)SvAn5pT?4vyeI+u_!K)Rjr6n=S+ zE4a0ctb$Pj20es0Yz`L{hlCD}19}i}1|f*&zX6Qu(3!ACFjT>$5$8;Q2@uE8kpo{G z6Dd%?h+&Fbrq>6%I3_AQY#DCVA9b|f5T;iE4M^r2KTG3 z6xrlOc1Fa?8vuoA1TCx(Jl29J)uo^ts+NH0AQU^E{7XdzwoH6xaDoDm~9%7_8Ja1=fGnuR=tH?|7qvyc(MhYo!T+{;D^K^31MJQT-KgTV>s z&yC@QfuUkJDXxqM!wCaRDYX1Rdy|0@!1*u?)Vt=+sp7vxoaVA~SluqAj_W5CVBZTJ3SIA>(l z`W$I+U!w1&`k(<1wuJ-c2#noq=fuHPt4SW&Z1U|b*=$-~x8M`*ytM3{G68ARcr_{H z%f;AE!YvnphNsYzfET`rnf#uNk){88F!2DxfzTuz%PH_Yr)Dh8^t!r|Vy3o=e0qPQ z5fpAgpTTN!3=G-_@;+l9>2WXfcg?$QFEJVY`4_%__wAOL>7xvb&U_<-@Vcx~iq2_|0rOtPXbug`N>bo$Waf!PuCNdV*zq06CkLxt0{=_-4Zoit>(Y~HE zlUI5Dc?;NP(0J?@KmOZt7oO*p(nfX$vfRZ)d}%y^C>+F?tG+n=fz#JHzVT334{97= zd4wl7>^DToe&8>Jg3Y)lC2!7fC7JzaKHr$EiPYn6os4>#^~#XvY1XQ#A&>KzFBQ{D zqh7iF8<&j$%2I~=v}bSoCvtV^ZFb;{;MR8RNwTgug+g^ieW^`UE=h1 z*+iPR?s?8AswrIbp~`t3f-J=}ZnkW)%Y9q0ed5mdJ!sVS4PceS(BX~I14%i|8S+11 zQJgd7Nnl2WVT7>(KPn6o`%KtH!aFhHe(qgj*$hk==Q_9Sx%Y_j*TG`{q{4GUVPmJ` z+bl>ZZ%`ioV0d&1NrbIaF7n~r?CkZ^@lq8y4>3)S~s@7 z_l$!U4&sgue9a-=WmT12Cpi-08F+RpdIwu2zCYrQ%Kwy|Bp-9x5H8VTU`|+ibI=#N zn{-u}Pv{zzv*q!%RDD$S=oy0PGt(Uo-8%fEl$dkF$6mQ}@$FqM_}-_ke!^TX+O#-R z<#K&(D|GDWb%N{fuM@}f1=eqGl9!&n!<_mzf)of#!?{U29&N&YJyH0BuZ|dm*|Fyi zdXbQ?XSJ#hO`xi#}1@mUYqw~c+z{KL~ku=B^&=v6OAdoaW4rm zr29Vno2&9+Wa{t2^zbg*c-80#7?y@(#Af#2OW>xI;<`n1*QGYRx?fz$c1K;c6xLF` zz`l3dP`#fr^jb{amvtsiE91jkdT2G_x_hf?z?>gVf0^8N%W34<#q%#b7!ph=+fDc3 z(Jrq&Bft|ag{66~L}8YuE(;p6%(EM*QUg)!nQf1we!R1rT}^sp81^cFi{=VdcY{SA zYJd%&Sog_IJm;FwH>frS{X_fR7^NAz{D8M#y_jAPi@Py z$#k(f=-;%OQ~G%FaO8~kc-_77Z_nNBU)KZSVFUw~!)ma=v!Eg{pP%7dYp~PTCtMLb zvvUU0z1=FTUV*^?^TyyG?d^J@U+wKNiqm3>)*?5>6sM;!XK8-7x4DRuA3*KxZWfK= z(mzQ($Ks=;-jjm}gI`HK={YM$i9F1Ml2hduBi+szIVWzfbLUx*6Vwrh57BW18b_u((O;%J z_gz+<-=@3K-KYosuJ367&`C>ty^K<)%MzW&DN?C4|3)WeQ!AACk=7>EG`p0?`eJxE z`xCEBe!sx8TdIW#C-7N+>S~gIVj-M&8+or`VFx7+@u9@wRrz0$L)>VvvsR+IgjMB2 z3pu-G;Nx*&1GC7qp2Rae-U333T9QTIr9HdYYhRu|JB@w zWa~t;v8$1t*5{iesNzECH^IvQ=-Q`xt`-82{^5^G$xZ{tCZwQ({pREeG0P=G0Y5mXEE)lvTEgYo$t6^ zKem{;fBkRh(4ZN5b{^f+rPcJI_!b|6k3@9FKb7I4$0E8!0T9@XM4A5KgyR0j2~9cX zgnp4`{8P!t4!U&KWHqGA3@U~kk_^gwZP~q=*;K`#!gW%L`wDgS&hCA~(>&&clKM?YTc(ui#@dwoUV5p>{2e(rgdB6o`)M>W(a48Yn$``Iprn`P19AZ)k>Dat6 zcOEa|`~h{w9!PD5d<2*0(AMyI!z{@e#BqCn=C`bEGp-8+q{2DR{*kdk4-$}!?G!1^ z!p2&{w3((h^_%T%k@_XL(Q0B8r)i>Jt4G5|xctZ-I3J8allD$tRlR(&d0n@71H4OR zd23wIc-xLXmXBD2din0?8eB*UqDhIr#k4YTlAn6%$;!l|LEHEBZELaUej9$eHKUEDkw>K|@ZD=x zxZBhOBGMU|+1(^g8I;D3DSq3!PcRn5P97G`QW*Hi{sv1#jzrJ1%8o(Qy)Dp_&d7pY zVVb0$>V16G;X*SyWBj1g=uzsGld?gf1)gitaC(={sOG6iuFIpLO?S_WcFwJN+E3;8kQwUEHx6@#c*`jFK636a44_|W4Q#yLtknpb*Il=W`YK4C z9T@HJN8iK-g2EU$Xg*y2IUyDrFVOnq9@Svrjupch6cBpNfQG#Ufj#srurlEI8j=g0 z#S4|}vfX2w9ev#UdKVv;?`cx*jS0e!9{5`u@L&qOd`^#{avEK1Y%=w_61sp~_oTF{ z0eecc(Eg#9o{H*bx!P54{g86F#eUd>VF^BHRYuQ4lG(^SZ#ICJtPC1VndpFJ2EEeB zvlU~p{ND$FrYjv2Hd?aprRpFd^9?FSt z(+Z2-cV{=WT*Y1V@VwKq)@R|txqNCeub+$YneWYRR9MxeienyWyYF=KY5!OX)%IQK ze=eLf|6@a@l#DhaEj+s~cilKCOGq8>_1Mp3?(+p2)gLA|D-7EY&4FAznjTuD8poqq z2$wn~wxdB{JenJ33Mf;N+@L=mO#>UleUC@qhv8xG;hYoDEHEhO@Hi1|jm6q7?m2A! zXdSIjXut*Cj>ZS0N9zmsCHv#`MauIZ64B85!r;HGFXV!b z))!%s3x?48!uhZDg{I2SH`JbL4uKG3Txz>%u~zt|1HQe0x~}iU-gtFYaaTE5c05Sv0G|tNwt``aygYC~!+1Pm{b(;C6r|Jc9DT%oCgugI}+d6So zeh?F8(@dP3Yy6?r^kIGJ@U-5_*B)!~cB0=gTJt)mP0&k?MqrN*X}+OH&ll_T)Q`?+ zLZYKw?Z~){`cO+J&FzOlgI_+}`0*vmndf^@XE4^ue1h=0UO{W#@Nh#( z%T&>993(e)%XwSnX@7O#8|^^OsN}XGwDea#JPR%TXUsLCu?K_Ed97i`FLD>%ALN{7aY$|4!pGC41Bx=@rp{%D7TpOl+X7Qe{kts78 zn?OEu{)}je_|4aa?Sm0ohkkN&o1QK9^^GG5bzkmjQMtLF0=&}C3`RO zV09DkJb8z#aJ>#fEX(w4DX4yoV8J@iWC8aIKG(#Aw7jnC$;ed_lWZKDN8gIs3e zS-JTgC%rkxq-QZCucKdG%KKK~U)FusfH9Ntdw%z_y-KK9^*62f=$<~Wz06~&UR0e_ z$ziIE5XmQE(>@-eBdJ~$PZT88+dB0dS%Ry$jh2L+Vsd|5n_IlVzAF!O)RDA+{0^E5 zmXBk+gD%6v{)CEs#dt@CvhAUunbB5pGsnLR%J}>EcrA_uWhxm3lCt|()$X=T1yg$) zGpIgJh3^Qyb|!s0cS*6Sh_81p+S#mm(kFfY+$8^T6)@Vs9LnZ)uL;*oIXE%t>MlF$ zxdX2dhC1CUv z;l)z2uQ^#K*8TOxL*ngH`Pb}sBvkd#sGVDLg zu>UN>{<94G&ob;k%dr0}!~VZ6!%qEKhDGC~ZlP)MNE4y@$4|lRR{6s@oS_ps6-E=- z<;ggF_8QkM7mdth;tN9rqw?U?ZFB)TACKe?UErw`L)#qMPftW(&>SpO20iNw+o!=} z9XOMK|A|L$UtXlk=@74*PBIoZK=*uNz1g%NJMB5qwMkUtmxuB84{iVC^-&EsKkyI) zdLmIm`pSJb*BH>(oHQ@N>k(Fdn4TnLmUgd!@2F9imMSA>xcv2ND`%ZHHtOaXH56nM z0BjdcLp5fiH6mv>!sWP|xdfFwY>rAEv?kMJ8s0uG7Buz1pWL&jbl8c>&i|HH5#Ni0 zk%`<}PyKP<+NI07N6ptYp$O*F|0aUT6ay8Elc9pKi}b_+rS!y?{z3Pc{WK7`grFr` zxa~7ySMxnZ#iT+SxKyFeU?bjr_)MsAg}a9{yKSz5+v(d};DkXo|m}nq8wYsGU`b#Z+)S3X8J``o>TtWW(_)6|FU4m(32PMc8fr*)+Hlq z<;E!%w_Y*1$rD{fU+9J}MYu}v6P11r^c0#hede|GinlB-$p$mj@_hiyadP^j8#|lm zPuA)y>bW`3m)NhH=#8f&o{tw_BfhSsoU0QkQsw$MM^opao;G=TFVNo!NUVsh;pDWE z%VJ7;OQ8eu3xQ}su^(IVJh99#`+E& zsA`%L0LBt}6d~EvBj@uVKpD+X!`~9_FdaY3I;K&zkUYLC9rkVmq7l;3+H7lxwYMgj zJYRM32ztsCX2BmGk|OQ8IUvzT-?P*^0l2!>M){o$h`#qE5Asgmok=83Sl7H7tNVm& zox3WB^TJBqb#7iMh0|y3VVW0{^@?xi%|)EiZJ;3G3!-UG%94C&H-O}9cm!A|py1`~ zJvah(3BZEj^w^sL`m$-tLK&2~VzCp+58jVyIys0r4^L~3)Yv^0U+{T#tLnB?5o@v3 zRAK$R(9PY2#l@Xd1k}`fldXr_OwOqW$KkHM`Np4%6PRMLM_*v(CIvlTCXpY$#M{Nw z39+QSz-H)tOiuOZWv?2)(?ncb7?q)>O}Y<0;|M3*uvsjY2Jzq5Tg8hlS7m$r(W~*t zaM;#-L5N3XvxEGy`ZqYN;$LvsxFa}hG%juSrR^U$)$SVa-{4ed7X|fIJ@kj5Zt1qb(@AOwvQ^@A9`b(rJR2b&%Li0t@=@f(Tb@-%`4*7E$Qxq8L$#ar;T7l%!t4X z^fOyM_$MAns?*w#gq)3TVFWG)a3<{EboY){&Z$}Rk=gAzg=j4cnfSU_8E4Np*-ISC;$GiJ-LfPyPH2Q%W0!0HKxyj=!(L^! ziPqn{b=$8?qL}S2;-t`OSxKOyz2QCCYy${NJ2QBM=&C+Obos2brxmuan0?ahzd?$5 zoN3i~zxxlBHmZ93Hq{Z8R<@MLMDvJBtNtNi?ubfTdB!J7@4iazcBGZlVaYxC%Zrg+ z=ObyTJ_`LDw)-qf^pmCX`T83`R)}PwAG!icvOe#%%N*E7+5bc%giK1D@?LQB6eclH zgO@QV7CmF^%WS`9*Z-^g$*)Swr@%`cbF*NRmiSs{vdyHz_sCQxo>-PhB1+z z$;n5y(|ogb3Kv`SjoKGu=Ug>zdX1bW@W^{v=#zKJfaSUxYYxQ2VF-mYVh<4Iv){-j zhsjTAS?k2n$!3~E(paR)^2y5R=44#9OL&EvfhgLQGw|_ky{q@#?)h3=v};2lylSO? zvKzR@vQc&K-C0ZAbB%;M}{MAGwp_v?*NG(tG=f5AmNCkSP@X zd{LmS>`HR$U}o{oJJI=%7n9D#PWbhQF(Xk3I-|}Uq;@ihV7tNt3oF#z>=-VTBm}vZ7suJ|=ERvflUqvPH+Egm8;x$X zy`?qy-n2Eo)2XGLtx-0t!%5(J!yuGc46nM(cS|{b^K0F#+)?s<{!j9q^l|ID7TlwieglJTA(Zb- zV)REXpL^`fY-Hmu;-HCitQO_Us=DvCo9VQ0QUr|1MS5$PJ-@5sFnxLngDF+~4hZT4e% z0NB*=Ib`X0{Y*B4N?*1HTAz|h@Ordx28lmWys4uZ1p6UHdKge4Nj){?L$0zPwyc1~ zhK?lFQ#)sHCbyVQp9c%tB>Hl%(^@iwJg) z=^1I`CTvih=aHRvlVVL+VXN#4>L-($)aYu*+x8;A1PT~x?U5_ zjg_Xq)+NSj-te(gAi=6?t$exO^2&&GGeygd&RwgFQ?i>xRtO3=$*S5%P<#b_>E@X^ zW`#bEGPm>ip^8aat5<_QCf#*r=J(kqkv>uVnK!-GA z>tkg0GJg^hu|%_e%#bp#ch2T-7(+O*7j}^1N}9xpPrrH_JTKz5#r&+==;|Dm{DS4_ zvE4Ru!mxVgs{u$JLt9HCOtu{&PKS_zTuiqX6!$Rju$sh_=~ta*6;J;*FgF$Z?(#Gj zfq=#a=7i<$%gw-;8M`1Uu-n660!4GL^)j4+Am4$#3{0f`*KRNq3V%7bW+Ddss~CAs zeiN^2NNS@5=ij0bSkcOj2=PVL!6o5Q|3saUz&aXQtYEyr@)JhkPU^>!m1?d{C4ny$ zO0cs=o#eWK{Br`)DlKVUXS>Ty6Gd6>>o+cGEG^&BtTprCF|rLK;;fsE-#-=k;6cIq z@ORbVw237z{~Xh?>8X+Hv#E)XZd1e5jWHTkNt&c^rPf1N+|?aDGH+4`g|V!$3y-fX zjMN1*l(jIJPKwq|^)rd?$;2+P#+VP@d76X8Js~sudREqSQ?s~$;A6=d6M;12z@6Lq zUx8iTnr9}RWTw}>iz+7dkyCiGncy}t2F}aIU^-yg?QUqa`-zJ2-K{{0XN&g2~@468$xm(?qyl?XGrK4Sb zbC_fZN5;pQr(g1b&NBoZc3UBW$zV-^H}RT*x_+y&vd3ys8w>Aq71hkee3Gm$jEm zG5QUkf6fq(_LAkziP*9e*+aCS992DoURi4mu^PmyUn9MCBTec8f}?Z0(c?ZHn}<)y zsnyvpB2?;6B8e5w63A>4Tc~^qiehGa{Ye@`6tg11auSO0j2Xe3vLD~=E&=8+pXqUdQ=>W$9b$I!a!h%_ZFXk86~j#FV! z*w29EQEPLFy0evIgkm5N)gN;=zsKVn3^m?(pG!V5y!Q(j&K{{`0sEK=E;nH~!0l*8 z0WfI9f;nTK5RO>%zHcL&88}O2uY-u)P_x4EHl0>)WV@x4xgY`1R;?32;;QlammML|JhQe z=N7;5XcFu6g(A0>H`uIB@>?f__I5jUgZv+aPJAYJ_`1_``KsCa`eXk~rF@0oHf2^? zw~0S+M5onkLsaiqt3*X3@lz{zzU^QiH6NVmjAk5VGn}lJ6gI_;FZdEYw^{vBpQ`B| z%w){47UlL;{bL{Q9Qk0t97Vb;m{>7#c~!Hex8T9-Dk0L+qypVO;%G45N`)zC%Vxee83=ZQv3tX zg3dSd7+LNXJ3W8@3slMKfVAndpCH7JIo;n7I~<|KR)H#wRQL;pZzNRBb9P2xEdDzm z0_LGso}zGwu9jt&gyrXW3u8JVX+Dc?+b0d|a`)i=5vgL$H$^m#ztnLxPrCN+wPy{U zjB74NIHjapKb@l7-p!Msd{TMo%+o|?vb*dpRzz2pI_Deq2KeG}o{@s2%; z?00g118CNC-6Wz_?V`M>vSbku{&6m{n5`eXK9Y9^|I>w;<_Dt=o&+{ulaY6PM0e3d z>wz219lMt-S!H9DSyK;sYL_WRg0e1E;J0>O8RCoUys}-y7l(6}dl0>4k!OSz9j_dB zD>6Yj^^1>$K6(|;c%xp|OENtvD`3|IG3A3+l++JO}Uc9%gsLV~ODc9$!BfGF+YxRTpyeJ)A5fwk( zHLBUyvNu3F1qO5ad!_V}K7BfdCI(*pyx`))^-?e@gJHnuspkggPr+&8DKTW?S;}_L zEd>iWt_OALwi$({a=nozUdnkTSREu;Gw-2=vFav!aXM^vtU&LgHHW0}MGNu|?K>(# zKD~J= zK)5c<+mO!ORyXH**($|kFlr#;>B7`C97BW9-5E^OIo%*mvGX-QS=iGvWgqmJC`JrL ze%&4SIh_U+#?kQ8sZ+w8vE$S^_8ra?Ll;F@B&>mjD+-Q^s+^PInWHIC=l3G>xpv9I zKrLarWCRzA529UBj4*0YLpBl#ZSegS~87BieuyeB9ZDPPBMkHKQK z(K+G}pB4Rw&r1FeK5O&RAg=38tb{*rt<6$t!@l&|w-rSh&?S#Ki_?FArX_%-;p`*O z7BJ<*U*)35rTgY}9eTC8)h^>cP`OCI4JsE66>esSD{j0O8h=Da8RNEcuu1tHKQvS> z_Qpk${ECmgRGvxm_yH;zfq>;I12=9-0nUks=Z87!;R(TZz{@iTXV@fQ;YOT;-Ne=T zq0Yi!@*sbo5e1T`neqs0v^Edw%M(NF|{S!vH1cgy# z_Kl9iC@^p1g_B2Nl;U4u6u+Y|N_GC`(r-}QuP{n}c<~XJ8dL?r8L0lN4F(ieU=Td5 z&i~?mnStQbJA)8>dIqm1@h|twNH3r>#&E-Vw&eZ*s9Syms0S$lKMtb^WVxVk&O;oA z9JqAS-3CkxP|uCG65~Qv{^u6#e@vu?^ZdH?B92rn9)ANsO$Q?y-JFg7^1DHw6eRqTB%gJ{=F}Ttu0{aDZq=Q^-7wgq*3DPmlf zc4Rsz+3Nm7V%Ni;Oe65E*jNS<{CUO*Wx^B2~ysgM8q~M)K#zz>X zIeQo8tvo+_eopH>{S^V@OXadEj^ibKDcopLKBZukeDUJ@(mR|>{Y+f{QRA)fI*^bUl%0I%)s*A207np28 zk~%{m_LtLx#7g96p&G+d*QW8vXSzVgvu4Gdf>i}3OP)nxq?|^+iSkXfL)P4>h@BHc zx<9I3BzYvh4;cT4F7wNl)P;Qm?2E9o0sMF6$UfDEsNN>(dMJl8C|$C+%=F#P)61M& zBh%)U+M7P6D#U^1^%A`{@2{0cRFFOsa%dK}U)f$hxZ?XJ3w(`%y8xkG)EQh*8cGzO zc_pRJiSK1wWf$SGIPs7+4oSm6}fVg zJGp16QlN<_c*=Lvrh0a9naF>Ogn2F8c_@{8a*Bg%>=vPzZ^x$R!RPpHzt@S4Kg7WU zEJ75Ny=3AA-?0e!U*Kjb*zW%^_kyHu?B5c^EMU-2A$c(LFGjXAmjy{8K7$rh80B^0K-Z4BKz@S#kiGD zbSWM_1Y5$TS)vwBL3EAp?o9e1mlu+kjYn`_Zmpfz-Ofw4t)G82Sfex5S!8r+vAzB}( z+rXRyHBxYt-fu2n`7bWt5>$v|`CB1Q;!hvW=O2BzDd(eOIpe<^%ZSuNlV8+y`6FsN zC-1A6m3o}e|3vM>D*dMR;k>2cVgGIEzC^R*6((0+_S3cJ>6BdjvmHC-Yc@4sxp$Qq zTgR>mIyCEyDg^7l(6ld5+-`VZ+^s|Cz`U$1p`vfZ8bqLw>!-cbyRG;>h2EwdU@ z?$$G<3)XC;(5stS>hnAdX&Ag|e&QUO{8PM4k2!iGa$$rhTfxxcO)E7chRVt zXVZ=FEcn4NZVy+f8kGNXZBc+KPbNkz;WzGwjvf7NMT6N%ix=;n48lJ(l5b1#i?EeX zeW;yFec05!UAJKQ$B zMoWl_D33l4%$a6$ApgX#kArAt)77oEr`mf4`d7a+xQ)D$F%vLh0)qF@kFnT57meE1 z*u>M(FY?RdN*_mLQSDjY;{Lj{p3k67_u^*)#ohOh7&@o;q?TfBOXCk&KE4X)pSPQL zn*P3N6(zNpwD$D*%&F_iYOgjOyPogM8*@8DG6@TX^+n#ukq}O-{Sl>$9tlypSPS2# zCiT=ePkmL{fmChLWiZmwaBQyAhveFxquK<2YEM$&{fT#DSI3L;@n4p?eNI2=L(a96 z&l)|Fhxe^rwdHkm{p4~vU(Xrj_4L{}9ZEQliaee0MzyC2;sWb?O)V(@sP*k<{QDZAnpyi@FNOlNh%_`5Ii zr4M=ZSF&UpMW^{cGh>gB_}|kHuxJZgiepp=Q$1&sU*0 zsOgI1ZI0Zr-le+I|DdWJ^n@dk*!lK^hbdA~XOkW+PJewQRAd_?mKhg*`vtW5*gX^e z#o5}uxJ-nBkAU8x(6uee`|g@saQugh*%XYren@p|>o70gl0 z^F{V!ZC*9db}(uk=+4J6`M)@0^{matTOcoIl(A5Qf#pT^^Cr6IS$L$ZvN)Ixuw_8d zpJVWtsSU%wd*i}~>jqCmxnKIjBjXrYm{Bq5i5CWs9IGuZRww|%`0D-WSiu-|2uF`o$2zaYH-^w_U$!%I?d z-pFvw_A(%2go^C90JS(&>m^Qk(nh-PR zl-APERp28-7JZu^Tif@%;e6mB7fkS^?4(PQ!vo=JYF~3-?QxnfQ7WL15pkMkpj0N? z>x#^{p5t~Wi?kglLF;?4XpV%Vs6A3tt^Dq}<#I$@QmT{8pCS=qa^Ky!{S`1+AQ|wa z@BlS0)J0)L(}ZS#hlUB4LVHB2p4nbW`=HqDtMgRd)|F)YJ{!jLWH{-#W(>b3Z`nhsy-eUUN6FUt%zO!#yCuzTBD z^YXHo}OcI zzZN#-O&RhW!=)09-P+&znCN-B)j4Z(-Va`h4V9Dee=yVZbFfvruIc=%J-Ws{1@*oZ zyG9V*gJQv|lCsTLM2wV@c`=n#`5o|!FNKm0y7ZQ+ByXGHG*@gOU3el%*d|@An(qN# zP@OGi=O^!#3ZG9X;lVcdF5gDY`@$*3EWC#n_tITMv5|4}#LdR&T!mW}^eT^O_7;1& z1c#Xt(s*JB*d?VoUwA#1ZK*-Z8LW+cm#k0Gwv?ngomDH(S~OCd@`C%)r$PB1pl}^Y zEBd87!qr$yZ`&l+sQ57nJ7iuG=ltU%fc z-ZRmFHy=SyHxLlARKbu$8|*z8IJBPrdBAxE34lpH0>ex{`ywhiUZD75a@HAA&$BFq zD`aG1DLS%e1B8?>hENj#YG;fBAgV`FGeo65U(l~-B_TVEm2n(>zrY?RqC=oO1*W!o#PJJi_Y)4x7Dq6GRsvZbGTAd&Wr0FfV zxg!}o>-Gm3T)R-7DL4l{q^*SI%+q+$V{K{+{$>`Zo#Ka_hRR1yL&UL0MgY>t04gj3 zeZJpXGfZE9YmH>jpWnqM@6Lz|l>G|6gw^o|MpC znhA9Qvd!c_;D{cpKqE%&Edmlb{S{^Cjb4xER9rQ3%_eU=o1cb_SiJ`1uPA9hps=0s zGTVwB+Wncf)Mv7vZi~6>&<741kPu~D^Yz?k>M}{XhY#mA*Bd-8Ze?T)@=u|CbujWo|6HhhS;6V*3Qf$RGbVoeeT=D4Ric2_U5Zo<5(2+obyM0I! z+}+(RcyNc{?(Sz~uDSMJXV>YQuCA`?>UqNjRa8;PfbV(V=l@GMD!{`r5i|EMDufcu z`PAx|mV(6Mu-j)UmQ8o7Wu;|Uji>!kmv%bB=!TS!THo66nTCZ!U1)o-_zdR_j+E3G zoaIl(emp;fv6LKse(I1ZH4RcNHFWHXy^!CYK+*yeZ*1lYg`av`aOb$ zpS1!*8z{86-|+<1shWibPVcKG_F$YLMQoX^Oa_^(Q_@YYyP38CMq-eI`TM$KEA2-( zVI?9F7;{i&yMs<%HuvIj;k{Kd?Q{Wpovj%~*M4HWG}y}2QQG=gvVadF$G?!u#}XFb zeFABjF>$0~th!6*5{~^w>&*;{+G&J0iT+|JvaFJPL*YKcvF+S+G*FZNSkH3$N-O34 zgisBL?!#8!ov&IXId`I*{>2<>S2hz9CW03iv$7~HE7RP304gzUxF!~8xMf7PZCEMd z>!Qd*(9z=e8sn0=Yi^QZreWqxBhS-sf6h@ofDPwYim4T8B@E7XZ9lW%zmTGJFi+B! z2fkzhSUTjm0Fg8?C9XS3@^_obb5GLQVSQxOK{sLZTbcSL6Cw~4aDGlm3q;BgdlNE8 zkNQDDCs74wyz?j|Q*v~Nb>}b;y|M+EMo5^zG(VBuETC)O*R!Uu?hcykkQj&}fj&AY zSQT6MRD)d|ip&9y{cGPSlamn??2FQd$^6LqWvQz#7-PfLQmmecQf^t($O0x1ddVJi zEmetHl=WgNv)Jk6u6#h`kG_2p;OsIuIsxkwSg~8Y#UbMD717!M1=r|-93+?|vV0N?V4%4S1a!*%(mtE^4ZN7xUtB4Z*}{)An` zfKwA59;)snLYSmbkrk)BktPt+gvS6pGZN53hL~cBc*KAx69Fcyg0W32(CiPQVMXxr z{HZ{Q5!g_PX!`gGh>d%xaqm_Zk%SMN{(XzoLnVMJNzbyhbk?92ef|paC{IcV)(_5h z<`ujX#*H$TJr$On$hak(AVMtU!|(bS216Rw?E9TEq@7!SkfAO5SG-w6d?g}~B;~7z zgL#00m41|ovYR!K*@5#SF{(yJYEw(cQ^Lt~yjlXc$LRix`{U0rnRc^Itl2{WgO!ia z(|!z!1e%jA%F+3j%^CLrYy}I)NIW7S- z@C#6p!leS-Q6Qh6TQ->l6dm9cLCOGjkh@m-1y)KtUhI4QM&S{o(pdfAU0$a#i?2uV z`4+iwaGuw8b_oh2K>2Du2LfwJQ^IwL~bDsTgdk9om ziLwXE9LKo-C{vApl&SXIf0gBg|6P{zcS_5Be7TW8w^U1QNwTdoinwjWTyDm^2%^Kg zbn@3}8F@DP)$93H%oRF-@d{~X5h=t}emN;)ux+VL%SBkj!QS%QV=IXM#l27N^gC+! z8C4aCKF#Hv3sRxe`&*sT`A>C9?w}ojo+D-g0~D;VlBHQC@A7{Q;GW2`z7- zUMT-}P-^zCjH$z48B@Bzc9lPdtq8&2hAl6|uocR-_|q|6m^#Qa;=gJtoIUwZTgs>4 zk1YlD-?o&_-?o(5U$&I=-?kLvS1TRlRq1VgizX$;+aX_{w}Dtvr3}XWl!RKp)JO86 z?qUIwbV7FgAny^)XsZ-D&!0BDp%uDuW5^MA4atD1EG|CJWJ^;jja;@6)zkkFrv6>N z&;C=skHOF?t^r%>X9T#;#IFNmt)!Hqv^ENh*D4hWU$LxyzGY;L*dnLJDwgwlRA?XcX}#_2LPIj8Nl8q*Y}Mi&_#g@%MJHi6v%Xs8lzp|e-6JXc!I4Gj*p z>b?hn_TRX);4{sStT=Xvv=L$EHp|uwUq6V9Bl0BNBU5He5c)f)V(`f`W!&PP8JJyD z^qxxS#v5FOLLSq#UkFCNgHMcF7h2!rW3XJHCi5LwEs`2LKG?ZsCKa(kmj6 zRzM?A`4eLI1ta$e41{fXbe_fqg>{8j1Xa`86g$?JqUKggZxm?driDwX4=dk|7$uEs zXscJJrU(VVUmtrZc|K5iP1I4@3`gH_TI@IxVin4~y~h+A5Ru0Fsma9yXF!VS29@K= zHL&U&y9>=_Ancne_IU)Uwh5z*BU5kLvs|^-VctC%I5GS{ zqt3~5lq2_~eIB(<)94M9NMj`KFe=iOf0gBT*R*U0#H>RE7Sxbo72Zm7iLj;zb=J?h zXpo5GFT#jRhwuv)3j%(X4q9|0ABFfrSWQHtAz!h=Z)-S2sU(HYy_sgQGY;F(BXc=6 zzsI)U3QtLTtJet2XQ6n?&26)hrTUSFMa1dBL7 zTJ`!KN4Q$cT_C!9eQIn2tr4JQX_L;IVc*<-v3Xk?wCHOaq28_ncKRi_V4d6}Q61W# zTa`vj>^R_0khhOgCzH}!V>TGRyRmPTlgg}wqgTfRXxtK!vXocop<{(EY=4P1v(fkx zz*!9ojuCk_d zrR4Ys0@sLq_d}~Fu)HicJ&)3ca|s>;!$8FZAr<&LV6-q_HEi+TzvxZ)^u0nI>+p8O z3;Tz@i(g5dZ%o6@sJ0|A2kCa7DX~fxuZES_*jr7`#m_^ZPLCw+73(SD=}nm8p6KNH z)tdfn<@>8-U9ui7aS}V8`^Yf|i%Yay_KFNTGST&U3)noSmVv!pH%ACf4-#R%LQ?3X%pP)K&pNJPk zw4g51#E_-y3%gyvU1Z>Xyn*?|6QxunVAyuXJG<1>IPs|upAyIMgtMR6^KTdVLQwNx zEONQ>9~K#eSjd!0mwoc916WQX2XQ@Ob%y~i)%7V#*#YI(rh@dY>?A)*CKCT+8s#L0i= z<5Yq?S^uSwwXZ9&KB#pe81&bDYa;LY;F3G}jXwji>vI@$Y7W|7pWQ7dPO31!jJu}0 zej>=S2r(n*rRtkfXjsdM_xwRl4xSpW0hv01!-fR2@8IIuYTRccy`~QsQ739P zb9JSrc}V`=f@-?YsJu7f=+*`5v!aUn0)4lYcLI-B4_OAtt+_MjPd~ibjc^d=wn#kO%TpDPqK(QD(T@`oh3+KOZE;<2@x_FGh$bRPoM|XZ>X>=9Z^-~H6S*gU z!(ArgOqKOqBe$n&juA1|{mhw_h&+@UQ z!aZS5s>*_)`J9FSE1^g3Nu(uh#%zuN;HTB ztO);Z`a&0$`##2&`}Jt(&&TD>I?IbZhn1R7~*^P<1VH;KAc2>Dhn zhKbdw;{TZba<=V-*KwioYHW;5=tQLL%ob*k^t87Z`A8{>^2i~@QWpwmBJ`f0$YNw~ zuUR^D83pM+ok}? z5JsVcEttQYYwXtJNU9oD)p24Ain8c&_9&Ujrgf6~Xu{IG%mPwk1?f|I;75@LANrs< z!(qP1clf9AprxH(A;GnzA}h$D7D_jdunwD`aL;w2)^P-$NC}60*Q8(15d@z@{^z4r zD!aoo4?J+|^CHb`7WfpK{}s(%V+i|@v(@$>PoO>OXuxH4%LLH-wGyuLY|n~**5#N* zrau=#!-~S@E1j6MZBcCCuj{ge7aXWc@SXTDh4;5@lX9uNaU8rsf5}WppVYit4ik_3 zh!cz3Loi;1lI;g{+i#yLf>LB>l{d;blQBB+O6jlbofGK&34*#>H+dgr`uK_>H=?%-_{v?Ny5SD;!cwy)isrEZj735sefG>xMs>z_ zi}&Gpo+$as#)hqKqN}!W+p&Z6lOUsQqAVD$Ez+dt*9AXdk_xvp{7II%GS=UGlH|6M zQ-P6ZDw|OENH<6~qZ(RFqG-^FbXeBVYC^`6z<#}T4@9RDkby7T3zRUdC}tg1ow>q` zN_Huqnowc7e+P(m_>pY4@J8y_NHrCWCvzi3e95k2D#6)=QIJ;{ZTNYxoI>B2nnv>Z z<1x9y4KG&9@@${lk3gQ}$6*z>pR^foMYL3C+cS5C=9kw_#uQ2B%q?EI{u%r-r7DUaL8t+odC;p)}WW}&=hW=6e4;HeI@11XDxX2kR*d$LmIHm}% zo`A_s5*~IVRQp<~B83CYfL@Ys#eSudi=w5M-gbzKj7zD-I!FGf(q?W=md9`E>^+#v zNRfc4I!M+mkEiv1y!zYE#`PRX(5tir*&}342oh=x5RJ9l4MpH2q<`eC$xmHDY*Jh@ zqBwqt2T9}CdihdKz}B!Vf|><*DU*qt-$+(q&E;-&vsbks+$i06HN#L^iN^kp(#a6q zd~F;eROVULAh=zzddtjqYcq3sI`k<&bQ5O$O?4W!u3eY)V(DwfY1WcOdiUmFV;$hr zAORtL)C)4XKFl_B<&jls!Mw0y;)6#t{o}{bW;e-e(aHm~>?eiRH}(gBXebE{*ol)E z|G~a1&1kz*w|F_+ooi7KrSwB=S<74+HODyIFV0x5LDIfIu3#~(EbK*uO=TS#i*W=!uOjmV`S;-OSw8iy z;Ie_&T{cJVc_L2zh91LS;WEH5Du~q}F!)chaKlgWZgH){wGQhJy3Wy~lVviu{Ob!w z{K5*zgMrL$g`HSyw~?Qr*|}h7{OGIZxZAiYm4q$=R4Q9$DGHGQ$pqv&B~i^xjt`8@ z{E*5V)ZCUdAx|_w*+@n%K7DuZ$L#?1+~!PeV`$Xy6|e1WObjobd3s?t0@Ctym0s|z z4MzO!ii#tH>LXkwbdTzQION5KL#eqSf@#;fB4r=g+#zA2UXRNuok+xNghDGfVo#S0 z;u58FHmzEHg}4~qijg3sLOi7laPE>AK=}YsyAazt8>rtUAw$jSBZ6TJIm^r3snP{v z49OT(klN4SW)%Gy3{;>w=O+WR4J{g9F%SH%?u2Dwn!PCRthH)!5pD91-n$-(SU|u0 zo^k6_`QdZ^Wr$5w$Z)4rDozku1YE$A!mO=hGP1oc|3N}89>N{doGl7Po91ds0d*jMotZic^n2}gXluwXJVZLe2B@#eX`c{>07Fa38g z_iRu2VF|XY*Kn|TtjD`lZFw*_rQkkp#% z-4gOtus&S7BDO|uKXvI($`KqzuJwBd7J^+$;4>5%J{#HIZV|dq-O$8Bf6%FzB}xy{ z)vHa1Ei7xwjV;7H#t-YKQClX#9tiUBez>dpK;}D20&K+%>lYxmq)fqb*(s&Eet3Qr z;Dp7;0c&e*NLd8Td{2IzV^Ei1>toHGT<|`04B`D_Ll%PGKu?oi(Hl0Vrg%>!bX_do zH&pJ%N(@)m&iP&+Kjkp?HPQ3ZTpfkxz~!x+qVE0L#g@X+g5Qj}WX3wzEDZ4(Jbpnu z$ZdqmpgrpDjDPt}TJWU@qxSJYab8JY8>&0s4*^*fQ^7s9{8iWs6`*E8d`}=cJ-ACz zPXi~^ zmhg|kI#NI+|JF0&ue}kvxVZns@$hSUEw*4A#`$Bmzq}=8* zZm+{fA7~azw!k5^hwo8*h?>)0-}|LxM>W$u=Q{*kN*Ra+nA zH|jD6(!mQGm~6}led~b@vc;A8beAX2uNz|9;EI1!J9LQOye~@Qv0}eWvSd^Yr?0Uz zSra&~Pi#2Y7h`cC<=^cz>JEJ_`nge8B-U`Q=5oBj{@Rxn1;VrvT07D9y}o}ly^4-_ zHVMF+*EjeQhjD&$MRw~$+NgtFEc!HW3gsi64GX3_!>T!jjG;huX{J?w-kb}A=+d*d zb=X=(3P}80oeyAn7g@kRA!9wSj2T;;cydTx z|EJjD{+HO{FU#eP0Ao;NB%?zT1PoZU7r@&%VSs|;YBA^?G# zxh&u3M`cIQoK2P}( zzHd`6!>l2LSX5Zx{MEX!BS3cS2nv*h45xNh71{9R zrvhlnvBt;DGq5$w*$Sd{q2S@4!G>?*-({OyEZ_<(U>oIj79u-g>Us1S?x^Xen;6;-n9X&oLpO_e4F@l` z36lU!ParaI)F))=tiTkSH`4xWhg;)an?WrOdMIwR*};81Yr7Wj@$)7qFC!coQm67S ze{mR3ZDT`jqx-M@l%DN;-`^u{JZ15yl&Vh`NXszHFchm2`wPQqgy%;TPRbs8U9*&l zD;cZtS@L&>@g4B*tw}po?$ifivkC2;pja+zXUD*8uz=Ye;(g}p!apdjUk9}P-NYk9 z6w*g_k4%!}Ml5#M=8dJOjinJMmnRFtI?8tmWm$}NJ2U&=g_V__|1|uTxpu;J0@JAu z!%4QL=#!&2}mW9(riS#X_jtt!6^-^B3y_Rsfsym9|z(uVV(qH=7f*IUtH^0wvc zQ9tWDrUG_%@;~$p*ctpYQSlBv*>^&q6-r-b@*R_4KiV$iJ5wjI#+AU#-M-NA4RZhX zHg~!oJ!krR!anJ6$E%qb(d6rmr;k@>@#W4jEMO@P(O(lEtn@g5_9T1;FpI@oUiF>Z*jd9= zamViGplCA1?$VmE8LeQ~X_7P(Bm6jA5r4%uN_F%CliP?UWu1QV!ar5TM%p{N#T3fpN3?Lha-61vn0dd-c) zfh<$BzshVXWDs;mN~Cg5n&J)pmlTD~%N&NdkEae2f9RI6Mv@?gOzO;5CDb1I+e7RHX7i0$O~l#O-g!ikhm-Mc*HK-15!K z7*=)O$N>8gJdZ1XN7Tb|Rk+@qMLrdWu9BHWv1W17EY*isSPF9|ZS=8C-+I96P3i{= z2w4lY$o_190bulcJ;5oqB zgE$Fjy(B~fP&|o|fk7Pt3V_#>SX27#3h6m^UpIv#i#Va^Z;PBwQHSMFy;@@07_~D$FX8=KGJQ{FB99P&0 z_2nkvu{ldut_4>53~bN6c#oCOE_9Q%E5m8eON?8BjEr6>5}I8^*aN@aTW@*NOH{I| z_3@K;&ON+>=m7r@F?Vw0Nw{gA^2v?DdA5SK43wg}<{VQ3X`N=1 zI9e=at{WjVxpm)mDM3R4Y`)YPFZb!)cVVAj2ek7f!;9QsxgbU#0>hbPG&l+pBhiZ_ zdQBw7DB=bP`w*ti9B2-Mq@R0$nJ`jHs7c^9j8va|2$5u4Ap0yj$5Tdn=NMzDY~5vg z-vJd}NV{9|AtVHl_&`R3;ogjZ;<+V9T4y%3A)Igqc#`9iQUF@1{Wc&AyO03S4?{e~qZNlz!Y3&ZV(N?n9kR)F}3g#33;CCduZM04067 zXzt}ks}iF?xlPa2f2^Y40*=$7%BmN|L9K-#blq>1VfroJ@+@t+c}ZIe2Sv-e4flxT z>^@tn>N1`M5xA~x;V6GmaAdhh4QbaeX(nGEGp~x`Y%^@3!uKqHaWM&e=j|vaGQTHU zEmYV}E^^kZ5#DEARlImH%%#fV&z7p3KjUPR)Ww3d=|AR{2V2Q?Bp<)JXvz5U@)Q%O zn?P5dn_5ah?awB8!`9Q1DF^qIwu7W=*d%Wo~H8=KKdb(&@jpJW&DK+8y(c~+c#KvS1xl@$A*T9(nuSKN9AJ}s=|i7I8|L0G&kOr4=LXyO1mS^->=&(^ z9uAcf{Zxt$qZBHP1(CKDQJSfed#&7Sk19R&C+-zeI(1JhOuIEYc0h`Nu*=Ql<>zTPk9-g+yq0ktY|wPF72v#;pzN}L{wnF z^yz5Ry6n32to2mn75ApZG}BS~JbppOx2v36ATy7QQdDkXqV5TY#lo})7=-H!BeNT!k<(2K0$6H%S<8wHl_yl6!>jRw1uuv zQV%WxU00pEIwj4~0%MPaG!imGct%4#MB+%xdpb_trzF65&9j)bFiDi@v<~e!OU} zr}#!x2?ZfVC%zLE6SXtNQ0QP4yo&j5d|rdp(U7Tz4ebJFxcY+~xX&e|03*DzAxYD8 zY4Y8$D{FLj%Y}+$6{lNTF^l3q_I2u5%x}uv@hph=ZWZ}q$mqMZ@7Rz|XyPHfixLzx z+&lh=1(KSu%ILUe4J{re>DA27TQfQ4XFh5(^-!guYWKK)y|blThaWagt8S@-@Ypvj zolb_1J7K2+y?!oCD>>G06#};L1jtwqBU?2`@pXO^bt?B|*K%Ndppp|07d+aLQ%``v zcjmJ<`w2m~_~<%zyMKFgFkrv^&!gdg8Brzy^6e_wh>=_py?n1O5DqA^ki>u1Or$l@`iJiw}{E+~gS_ z7t!nMzxRc&*z{O5$6qZy+y9?QOd?t$=#<<~uEFIvu~|HwAuJ-UT=DbWn1-Ja{2d;Sw~$66v9QQBQUy(ygLCD?GnhI# z>GV}n$3U4dvwqqIch4sCCGMflq@|39=5P?Z_4#(2SFsIYK}BLEj^IlK{nN**TnO-{ z_`d^hRv~`_Z{>f0w;Q#yYi?nDB_j8OSpvj-Zm)EIxZ)G(g{QZK{1X%UeNVZAKl?Ag z@og^8CaafBVL{K8s>bjPz4F&XKD~JV3H)To*b%J&Wdxb%4-o(EzUpR=2X0$IjJyV? ztz%&_fi<-kvCYK?&MVRNoh`;IP4&c6Z=d4~p`hIwPTqs@XCxf$uaTTA&aIE494-ie z6B`0jUSfD_^tyo;r#6Kjs$iBZNrRs*0!ifRi&bnU{7*$L=E56l*H94&{R~5O7l&ZS z&*+m#Tj7BF8i_Pi0w7yWLIo7g6XIcx_J=(cF@*%S+kKhWzTVaaqN_2j=q4nzg^J2qBIR)TFZy7)sXdjsLeakAB-}*8y~js@oK-$SQu2IT z2RO(ddGV6s2-PD!(*COSRQwg}Sq=Bb6f9Kkk@MVyEL$t28eA~{grD7sxOgM(>GFzN z1%-GnFNt=}%zJu9N!7)lbTNLTZK#v2HlvlG{Bd57Wc};1q;OpYmYg2G!EFQ+>&TFH z<0GWd&y0?c$@YeSj@zzd`onj<#5NkVhA7=qtjO@H9a$~wgw)k{+t&aqn2-Qn<xC{Yb>8Z!8YgYTtfde?`E2jIaE?t;u`Gzik?Mm^x7|)xO;s3yMPn%cQJ~2}tk?ZjsO4zf5BLO4gWTLhkw%ez$)tMLx6b)Qi%t1O zAMmJxXj})cfVNUXGVm@~EsbnctZX^sw>iF+?zqIgI|x3g6At|8L15U+j;P)`{DW3D zrxi9Kl8lAcJNlmpNeM~cTw-UNxm8?w`CmhyEr})_+fjXNE|1I>La^buOG)33Q4kCC zE&3tvFEQ>_)!e1>$BI+iFA-_#c3OM&4fEs5~9&iicoNc%! zFhdC&{#roiK`*opthaYHgITB1z^hZf@I)BVxBX#c$=!bbP}@Kdd&#VDiM^5yci3Oy zz(3Z@wO#dMm3`*%hS}O5u1^Bgysu>AeU)wXI@YaMF5B%!Ul;EXv)jv3AQKKuHTw$( z<2{G+t(~R>W>QfBsG#oXfwpo*@azu>F8%odH5#81$Key{IWLbQ6i0ytu7g8>4DoMs+P-$U|wefQ@rd+KvI`{ly`-8=E|+2y220{wHk?pqFVTi|L!txhr+BQ_aSHS`oULF4g5ABGl04VoIXI3H_|}z2U0R& zxkz4kb<7PVi7|`ns@UB?@`eVO)P~{+a((wk9V0e@+D&x*@9 z-FAe6sHnd*E@iZ#ul%IeJ;r^p*4%)sz{;a zws*5BRcQ$&&_OB>=ou7A`&7nIxGz!-v~|!#>E_JckQKfvS+ zn;)OwWdV0BWUNg37FSdhd0H|m8cncjOE{BBqG&zPrF|%rr7-!N)G*^b&r`2*+V%B> zOM&BHLQ>iL=`6;jjO6fCtQmXHDlW*8bW|b!@$;we8h%>@a2MF$i|<@b3&m#z8k5B2 zqudg@!9|JVZ&fv}9Bya}x@3~2RBEVFB~oaCN>h9;M9=S17-Ke%)PUL{2_C?{Nr(V# zto>)hmWCmS@h$~C{aXVy$UZIJ;$|Ja@5LeUy6sbBlcX2o@2uB(pX?5Pg^D5oHz9hy!?60#hy z*a^xoULQtJJnoJQ$4RxN;Y_+SuZ&tzc+-_XAIzJ}+*VG%J$Z-FW-jcfFzJleaLn;% zb9b0nsOIzI$=iQz?rQ$`<}UbOtGhlzi4GT#ixGdX?%sTCY03BOJz@+PaDnNrMeHzJ z%4<3K6+o!M4fcR6^s4^Ph2HiKfxMNC0mV?6sp*BmdD%X7#Al8=+|!%;>8O0G9-z4@qNW_cQ_EQ>Yqet{2xWsCksVMEPuDLo>`=Mxe$}D{PdfcnYZ!>DN%bGYw zh|d|=8iezt72EHi_1SqVdwr?j*!5Nq-x?Q{^VbR_D|+c()J}@Ip3jc<)6wOQ57$fp zP&LQL1yftE_3zsJ9mC;+U?^OQA~GZ82Ht+EuOGeFW{_;_bf06|%fl|jLW{ptrQB)f zM0xH!v^pGzb?|}8b>ejlwaaFObb9e{SlfnAOu`PUamP^nUL`ZS8)}XmC|ZiSY(B=A zU!ub|ShxPGA<$m>uZBPbq#*$QDGaI2PF#ayU(~IcqB>hw{z>7gjrzF zzc5}8Vu)%cRQ=lI7ABaUbd1){i^9~@P+LPDSN{wb`(u$CFft+};fZR#FzSVB;-s{x zWFAaScqba(HyDK(gDUq+F>}AaU=v62rzS-p(HO{GBaE45IopJ(jYGqBO~Yk;Y}fcY%9u{aJ(i$| zi#?rez>-h^ryxR=l|CRwTVQ0UN?r|(iX3;?EP|jlGvI#oZlqz}D9U{i3RS|hZB3S& z*ZMt9k07}?wERM#zzAOQKGv$|PS&wGkqv=bALO_YCjY6w+&3=M-Gb8hhy&%Ad`!DLN{p%D{uA8XdG4JW3C^j}Az1u1ha0ugrbmAxX@6td>iYcz;`O?HJ zG+^agZvwbd*ccjBSB1~F$Cmq*(j&&(H;Lr z8kaP&8LCMwDpw9K5($_J%YIHlrT+F@#uQLg>JZl2RV{ynJ?JqNhQvX^B|1IziB!GA zsD5M^Hi_@U21kY(&SP~^**tPFKrBg21s&D~h)NQh13g|KNQXv}m>i(A!^2IIBIbZ$ zehvWq)<_AU5C8=!Vq)lNU%*<5SQ#2GA83#wri3imE=UnGL4kqacVu`#z6lWznA+fF zb1i@1$11slIg7M=n{vIf+Q4Zr3eRW81u-vP$!)AD#2Kwcy=*iP2#+J1bN18aI>v-J zMqQ~0;@d8J#EkifISO;=>o$4G-~9}qK0M^VVn_;2*X^d1uz>ouT!h}CU;c1cV|<}6 z6JqCk=$dE&j|Le?G}yJDxYBN;lauESM%;cz9tmkwE%h>GS93f@E6rVp)_)R-lj9ftIGKEAz{#|WtR8YsHIr*QC!D)T$ z0TB;W{b3bB6ExH!@R^Vz3wXmtLJkRxpf5x6FJuM8I8cDx3Wx+yDkMgLN(8hDiS?~B z{`|FK#J+rn)CNsijub{*010qyIJ4C9i6?{O_r5(3Qulzo)w8_2ioW zp6ZtN4Xlm|AhpGtavEuGnDZ(d1px-QgjDq(wh0WOfkk{m6kutWU=ys82IdY&Nb-VL zEWWBfjvA|fsvUUPiJL#Ddz}8G2lA2I{iO$zWZ8;FLi9j_|Dgv82K><{ofFu^Bw~dB7a9nRui+8^Ojtx* zi2p_a0n;8lcEIGB&+Gbs2v(wH{vue+5d||I>Ft z%WfrqW}7Wl>s_E^PI{j8D_>lJchfM={fH6EPplT|YI^U-Ky7_}CRxQMjOI4tX>Vey z0(0?Wd4N+5AB2SL{U$nn>NV05uqi+)3Ow);paR5Sh_L|>KLHAq3!wCxlmOXZ(&A9a zE=T`*9YEa1C5P0`meEOG1Bhk#WPpA;5i(%J0YXHspD2gI@YY^D3Ij4M2na}>ikrO1 zE$nR@+bqT zlEcRreJR?4?S8<4R3dSxm5g{cDN8lftW*_t#9@xc`zDN}%#io{6mv?jQD86M1=L_- z)`mg9ZWiehubTAUi@Rh8oOAK1p(X(SV?0{*zZQxl{#qy!32evsvryEA`}aZ-=U)p& zfA)#=rVomYbgr6;W_7ZSobEdG4d!%n6mOPwT5W^fqSu3Lxnnr@=H(v48HSPp4-$Mj zV8#Jg;N3lZz`{ASU#n$NKetM};ARbx)ZFlZ6NM$b?wE=P?lcJlvXYbfx~))1fuOUEuQKapB@ly1U^LOmK2sIE>pBq~p(9q)>8 z9hbr~p`{-Wt6NFG&=i^9*CVWAroZJUvCkx(!o%`rhFP?hf(55hWgxtbE z<=rI)O`ebxN&oMWy$3K#MMglkS`V4fNB^HE^zJGDUT**- z6$t53#swoA?D?yHEWQ*25M_}DknhArLGpCaSn8UE>1PMZ6bQcoHs5e*fKyabH0XOr z;02YG0A_~#2>_vyvI4!!_~L*g7YGDUtU!Wny6AW+KywN?GO*7Dk_9S)A+PS)z#DFm zAOI^&O2Xg%a<%P+^Y2UZ{y{3~%zphiPF8PGCC;7w-2`Zdk+EI?< z0XXox4nPMzJ_$}t{U#jchFm#Y+l>D=<6X0lL$kp50}uh@ahYTLFTek$8CCZ9|AS`q zS~4zgz*z9i^pqxOX}0PYx4N;Tdt*eH{0 zXY?+k=nJLsS>0w?c&Sc253-ejhSxl4n`m&bKF_}v_%by3x$>5RZNm1j5a~(K0NpXi zsgvnembl_qYw|wb$UI7GF7PWBACJ?!V%9mUo$0)xlnJxUSM%G$tpd975Oib!CH#VZ zs7q9v@>M;I_~T_R)I2NOYS4RBV6BH37qa)y`Up9r3>x^m0OP9?G_X@}m#9#V!4z!F zzVznp2;UI-`Hhwf8G}orDj)Z1*wopvZ+rcSA=Vt-#+B`P(a_*k>P}I^`>bBzj#M$$ zFKOK?6XO+kZdrJd*Y^QbhNy4kaSuLw$KiH&6nUiRy?)Zi<=js{~j&nliGj&{7} z+`P8E=0)9yISK}D61yb5>B1$2o-%#b$SvU&673P9{%XIZ<(?ZtW`?W2nB-@jnzgn) zF1-f^ja*9wPIVZRQjrD4!1E6f2wWDCGFQ04kd3tGh>ni55k_Ytq1T8QEN>%T9bF~6 zr1edG;QhP6&79h}GIoSKMls&pFkVCcT<#gVG;F)?iRW?EmVz)8<8HKH(7Y~r^TrN-MD)3jqz=XV)Ml2%^$T9EV^lepF3bzXnD{Zl8!Ro zio)q+t^W39+p~A^@C44#R|k=Xo+4R2-K6#VC&Iib2c)9Ip(A~~S?=jROURTGQpz#5 z`Ubl?KwCk`p5_8+=dgDR+-2voP7@+iOn68IjVDVEld;H!J=CVuJU0VlkOl}49SFh# zyCF@8i%l^hZyw$wq6~~4nw0J$gDB`1Gu^P|R zyn%fnpZK;88 zm`+@`53pH6Blx~Bn*oPgsL?4j~=YZw>{6k_hE+beg zuCB)61y(_q&?Sf@A+GD)vl@0~Y63z9Fl-)MwvbBmGmLtC#^I0{=SC>fA@K&Su$a(d zqG5L~h60L)73$H>F~Il-_au*t9QwSk5~Gc*rk1?1iA>>2q@sx23{~w-6bx-aOgCku zd!sRe-?&zGZOc~7hb2#6pI9gTa8@vvX}IEC&8}yL)WxWU+wAr);`&Iw2xsL-d~I9s zyLEA40Xk4T#v?B{=`Ofued_%u^1<1K0MD^aV{8@huEDSGDNyauj=Q4%fR^_Yb%$`^Id5oU#?7wA2j+0S2A`9DLX z6@O@k|DUp>?Ehv*SN~#1vHp`C)g3!}nF2hTK-B-(qyN~W|6z|l8UKIS9vypO`G4LX zMf{gN`Z59-$`a8cjUD3_4j|ny%`k*?N+T^&Qc@xf2B88X0+K^0C`gI$ z5RwWK3P_ETA__`}NQa=5bT?;ot+n@hcb_-Tb@n;y3zr}81I#f0Cw}*RciNrG^m_@E zn=$J6PE8a&Im88gIfshiDE=eF_D6{Aj}Y4*A+|q4Y=4B<{s^%VLTsTV5NZ5M3`!gV zslszTL`jkm8dnwx1Xbn|@J~PqL975>8iEgeNk?<{$Xb_u( zvZusKcpaAeZuBfV;BVv5HN=q9c&QNd7K9R{y1C9>llyqM1lYfznep0p(eHlLfQrDU zTc}E+X&h+3hmPYtn);&}{zosH0Mp9@+SQ&hN`fk@u;=Jdbz{{G!_LL?{>RjozyL6}k z)$=UZh-$P7gyY8^5vI+MtTGGTSrT2v@Xw4dRi^VUzfkR9n!w!IG8zCQ^(@w#a?c`5 z97v5R-mkl!&p%Q6@bQZi#iUMG{GX@*QDTHJq!h4OGNW;Z+(zr#SC!@BV^Fg)~)umr%h{`n@jpRHPrWCf(9eT!d-K_7N3fUXy)tCKO z6z=QamP2J@0Erlap2?(RHE~L7<(^UbH|enXr%CiI;viZU219BLd$7h6Z28#<@}UZX zT*U$>TK)PLh8luEtt_E(_?;Y#$im<_A4eUQC~IzeJATaRj+xLbE&sE0G;3LZ(#&Ibp+SdtQyCjzP=)MA^7cs5|$liii73PI+L?9u}Oy)t1L*kr@L06(E|f8 z|3fls#Trt{C$GoExt%>+5PTt|(^8I6;tA0i*yK2VBE$M#GQl?qB5lzViGf=eq44IQ zB=iagUaozC5J}sI_1T2lp+S2xS^`Js-Qe}upZd8G8Tpjl%cJ$LwK*o#RMfC{7X1Ok zS;4!8TLyT&niaCGFw2jRmI6QWME0PIJtQKtOWcP8(}JO!q>sKUAi`Z9BNPt5Y<;(I zn9yRWiytlBG8;d{>@IJ!r%`p-V3l?#$v&={lB^L6>3ZcHCl)xi-v~>zz3h&=a3;%5 zT6lOumQL`=Ceo~NT(%7V{PI3l=t1$2m`jJ)SN}J2n>+a7YOJtjlUfJLZOV5<>V3Mw zaD@Xm@2KfI$I1>B^=_8)Oh=LCz@nYQJ4>D+*|p=+(8gP}q0je2D1zHDhmz+@IH_Ho zo)Wzbazm);EmvuzS3BZt1M)Soj4@y56EmjNHksEhZd-QYo=oq1D&GC3`DpX--Yb_a zkkJokk@8j&Z+Dh8_~x#AwI<4cR6PGto>i#Hg$F&c^b~bxJ~M7KuqQk%@;V698u+Y) zjwdyIP?RCx4Z<%XSfIqH+96LzL;5)@GW))eo2GT|FIftM$}S`dck}6!Q#Z{ktGV40 zvINIJ-eG+raoO)#LW`$F<6afnI={+IHD4@}er3RDFk@Z7=K-z-z!@dkL!f8>vzGb*xjCxNG?jBp=(+;pGC5j zCZYNRJgYK??LKDcs5w%O=ckCVsw61r(cE;5f|n-bUp+y#hRuhwX2NA9N1iKj$p0CvzzGh~wn>HHdhA zqp__7w)XpjvnSK)(c!94Oouzo8&--czshvcC6&2kyVftahT@!*c3jQIA^BqOpL#or z>&!GquI*%@l;Q@ZQQKnk1T@u2~$Hz2E%k-Mnzqmt%<%cG6}B@Ek4#lBv#LbeT9v<$9E^!IfQX~q zX*5L+*@V_@hvq`)Pqc;}OK!VIbDGnXV6@p%{6favH`2 zBwbmB!FL|G1QGsnxb24CyTd!3yMU-i#+2l`!T4xR(97%!j0OAebO?%Iu6 zPi5^GtKPmnQ>CDg^V+n>h{UaSwsooMZUVsEU`2rBm&~-Z1KBzZzoBy zOoq1?aF^#V{BR)O1a$*Q814ybdG6lRNVM)p56%|$Y_kc5PWB!7y~jItYpLjO!D!Tu(uB!f2yKynk*Uq1k)Cy)F5PjL?Dj1ME8#59z3s`_9o{Lj=cvx}re+DHImCd%-0C1QM_kQpm{n zsEdDr63|1;0BaKp_h+JDa;j~pt?n1101$`*GyF|m7=SRI-+QijMk$%~aD5ZrGl^F^ zd6CF^_`0T%$eo5^usl*Ynn7fUWshEdSiU&_Qq%d z%~P*8aJWF3wCrvf{z~$d<2sr=b7PK=B*UJ8B}c+OQQp4omwt4`Iko(Jp@&Zz2DsNqabzb9J4mYE-npj^tBBLj~aOhDr*Tz9{cJ>oD6~ zS|dxuWHr9%ciT&Ml43YbtGm@Lfkf(?Vugtzk44r<6vKl!r*3e+8;X{mRAxHP+B)3g z$^0N_rEe%Vr~a5n>Rp`j5X-&Q)f&<#0jjq%>gpO?o9DhQrj+p9f|r}AZoj_`NX}sR zPmV6;)|X8Nhz7_}($s}T<|yA_brj&L8f2CIsDPaA;2e@(j`@+2tB&Tw4J}+~mjX6t zFs#RgS>|ru0>Ni6$`A+q^)$FXG11X`u(XIa#w(X27$Jlx`M5X?PWJiAx%K0_S3tWt zyCQ%;M&1B|#wcXE zvEa!au-_3oGKMy#{q3x-2qCMxbh|K|>PJ>r=`Hhs{qM56UO%(C-bw!fvd88A0@+g& zAp4(;y&{3JU$Q-iopJgttIMYOt_NEQKeW3@$m;rxzcS}9$SyJGFKRa2Sw1xMdzTHy zAHv*#=pGUYIl@2v1a}|;r>J4nG(Xj@xn2adtIVa>p!opFMo#;SzqK6bIKo&|HGU$` z9Y2xhdf&xv1p@Ls_yc*q`xALyWBwcMQ^+sv)6dUxEuM{ThX8{^B$I%PvVJ|KFJ1En zE47-m-UHUU{hzf{=D(_)E){_2L!=;pI>Fcw*HR`rcwL4#nV8f0eG<0!k)-}zQtJz7 z;O_@F0}5Tp13*aoFmS0dA`W@H2Wyk9zPoMuG}zUASxzS8J{@AEXr)PC-K#1MCH6ZD z+%6$dM0FV;uz*=Iz7r)wdbru9xBeM))gh#be9*v`8I1vp0dP8ymW|{9SVB+}&oYhT zfZ+FYkV-@ld3?Ye$_)Zuw8H2CWgjyYuzin!flq0$Y+$p`0>IfrW?sO0z;YQV-^ccX z{0VpiQ0yc;eFRewp%5m(@DU)kFVa1{{Aw49bVrpy zt2O>xksgxVyL{(DL$aFq_5{7jp3~#kPpcdSp5NWP9LQ*ZNk$)gI5)yTEy3&yzkWTs zFoS=Yuw%efRaMmDo+g1r0B09CD=-uyELhWA;Br8z14|0VT;LLfm%#vw@+N#xM!CW{ z7!NPRUAogV_+7_;Fsf=kaTOK~j!T+ zca|T@3lq1C%3cT291F$O;jVVltrVwM+R<2oABFd^h1uyp72XAYbIbf*qkn~V?+LK- z#tMl4(8lPXhs%TZ)0KbG#t@c1lT87tPrjm{zgT0clpZ;+tyuhKjlly=Nf--^;D<5# zOFs-Q1VpNo*^KAaEY2wXOp zVVKYN#K)>C_zoXTR49n4tmI`m-0w)Y>x4V2j@7b*Wj44Oeq0WA0z&HxbDF$yDKO%d z+%=gu&wwun91VmNU@oN7u4D6OTmj`ngbW>?U1zCeUVToVPAY+SrU4jm!daOWMc2N& z8`q=A{TOH&y0@@vuYCAH2q&Bm0qsv^$8KhSfG71ZJ?^BVxSn2W1zkC40(BTDI}Cuw zex=amove@Zg0kA)Fwbz|IhUitr9f55Z!9a}P5mXj?)& z1ai%+l*Hwo?%?_|q7p&}Fvf6c@&KL%2Z4$MYCzx1%mqd>(WgL_F&s|R&;d?np+)dC zs|a=oD7t`^1iOAn45SVe^TKaHz5;eWxCGEJ!vH`Y52XQqcq|pr)7#s>{tKs%wSPU+N@9ZG_yo?q)oqe2MD?3nk4#GH}jDAPJ=TQaDnc&(|dyziDII&3-5z;_pL!!4&n^KM+|$05CzvyVK_l# zDVmnVYKR#R0$`|2pj?K&3hp*T4e|SBXgCD%qiH4bOVet%16S=mO0vAq@@DNba3vJ7 z$etK{W=RVW0Qw3T6nGv@__#=;TK1G81f(S4c#f;D-YxF3gxXZ`DyXkunj$XuO{YAIox}sQd=@> z0PC_$tREpL&CU;GSCB9QNPBJtDGNNR(JG*s@Gl4rAXz0mXj7pWinB*Y^ZsV;!|ElA zxYyB9uP_ePHQJA^3!HxF^l; z#i}b8)&d4{33+CffxD_!Q7$4+!_y){8IjGW$UARQI9qkT`4VHFSKXUY&OL(GY_Se_ zOZ!Gx`fY|c^_t83LemVJsgaY(=4h)LqJX8M6Ld;*enBc9p4{8WZSPycr8rS7Z{0;} zeP4Ym^n95n_|Ef_?0Y&GMa`MQgx*u{^nDZGZ3Wy^4Vn6t8gx>SuKH}+z8wp^8a8=tB#z+Tx-hP$6{(H-^7n%t$? zsOvbsbaTtnFxN5Vf_DDQ;tTYb{_k%NZS~=f$+92DfpGhE$=>m<;Z=x&)u+U<&Qp@* z4;RUu1bqnQzZOJ$+VY{lr9HtxP>G&BlyN@-sqH<$*Mf z0%!wd4_Nte+mRy0_N%I2d>HS2Ok-tP;BPs8L5nnB1uWQ3s2XABl z$unb#(hfK_ZO)r;>%~c>;nF=YQA*!3n6y_yJCRZkR zE_oiLMZ(Z@D2+XALP@1?l1JT@_E9ka>3~Ba|IPM2-0$prxG#TQ&iPX~N8{hxzW2|1 zKNyPTC&D3FBAp$-q<(n+M(W4)e@MHR{ukOk*Qmdx-TVF0=s#T;viWuW^gHd|rQd1y z4*!XEuj^0RJ;T3VR=MfaG{q$`M&}lk$Ct)F$fnX{47?%uRbCNeh4ztH1hbn23G3ExYp@Gyp)4TYVmY$0oE z0q;-WpMR&F7mWObb0~Sk+`_7N$p6nAcaVPr$sPXx56NB9zlr3I>|d4K1^;u&-By!+ z?OTN%RYhBmy?qOpQ95|xWR^pu%vz1p zFDFIfOw4u0f4&~pSBk+uxQF6}T(bEuU7iwa*>0zQb=tG{bZ#0Lq6s5hpI#%}ohJPL z?o=DV!%_E1w>Jt>XLvwPI7)`@8GVklnJ4GQGcvR`^Limz2uHEfd$sQGGMf~W64~5Q zy|aF>2hb6yGmt%C8-bEkRyrf-ybWhJU90`+r*_8R8D9h&E4 znN}X1-HA>e@ahmkMm(Ilqcu-S#k8=wo;YQ#3o7EECxFf!I2~2j*Yg_Z$Qm|`iZ;QA zG*-R@6=s-XU&XD8aCP}Tp1z#3o)k}9I;P1tN2}RRj)lwl4@J?Z3|(!?mT;!dhwOOJ3a?5qho!}n5ehC^Ix~l$po<1Z?S2GOkC2u#`bjZ0{J8# z?JeHLRgX}%!**W2C)OKaowofLj;eG3AZ*pgGW9}bZdD`77Pst3w7Cr=)-=L5{F_Q%byeSB$ z8dow|m?2caCzC}9Y$ZV1>0Ig%jlwjNN-pk>vp1g$10Dbs27FnpH%|(2-bkE$&^Q)1 zib1AUDcz_FZ!#&spOjg?K*O}a$wAbiy7|d|CS8P>rkn4!!i=aXh*4l?W?~f_j_2{{ zk1~kfI@j1TM$bi}57x3+d8yAwT+TMVa^V`}vl2ZZoW6Y~oYk$-Y{HJ?09LL+7< zx~nIrxx#<5qGQx};2LnFDNGRD$IHgJ|Z1k0L zncW@t39n+qy#_}3T>Z(9iGJfnJEg5kCt%ND#QW!JyI|G6+(!>@?^_GA=>;1*O$M!_KB`18rA z*AOQCL5B^#T`>D)OX=Xc&wfu`ttsGmj5-7Jhvv*tRcIu=FT2znF*7;m@HAO~@B^RQ zMzIMN6`RvC+#j5}6Mf0a=uYs-QW9K@;-Q_?We4URFY`X37uCMqM14?cvwk-w@OT@A zB0?vEm1dNcNr7t;V&^g!)r<5tlf=ouO~$o;hS^cs{hzsw*r~W4n5K z^}hesg6gggo-K~YmjB@a_gQI!%KP2Ak7~IMc47#*CgO+Ump>2H6@+t zeB386b!$3_Dse;ie4NoEo(;arXWXY(YA^B$oKj}wy$aFQdTd;DIsf|uUZXd(6oMg4 z4awQE_nmqX+;3t4J1qtcW`hZN;j;h|0%O5l4m43nR}+0gmnRiB`S@Pzn6Aq;Dc8X% z-Jxoy6zK&?Gbt+>jA^WC>gs13PejRqr?4BO;C@YCsVQXR!b^1VNcVGkUkJg!wr zJ>HakOi74zJN?Lva`}M9Fc6zSv_C_${AKscG+?$s3yKGP{OefK>;D&HNkwW3_fm~{ zCZ5WzTA4iJ(k8T~gdrPB@AiyD-1x~ST093l*Gt(xZ%a-K?pqE9*GUD}V zcG+2@+@+rfeOFaA^X`=fK@MnhoX9`S#UK5HTs)x`zxC%@Jl|i|;_K@FDxne}{WGBw zhS7)St|ijmYK_6*+P(>%T8eWlO*mrzToNHP?=uh0)3-szj7+RL^ETdS=4(arJQ!lUUO;3Yc6=Tg$(Z;~qw_6c!T+mM_j>5ZYkxDb za%2dd4*J{EUqzL;=a#O7@h^cN<6mP9%mWU;8~>92IsUc7{&5CFeWS~#X2s*qZc%_K z^vW@d89&5JUz+G~>c>o~E=BfZZ!#1+1AZI-B20fR5vIRf>T~NVRe!uQTBf_=z>Hr=q6oL) z_le!!KmK!;@fr3%12Fv^eu@151i)nZp9YwUI&VK*5-ksrO1WB^_w&p7@;q86HS80? zA(M>c*KdcA;N&F)45y?vRB#ydE3ouCUP*G~#_bjkXBHRg8w_3!G-TUc|0BE-F#%Wt zb^&mfzl|yF|G<>uVl}PVzI-EHfil-`QTj;rR@wXxQ?WqJB)SCdWak0e1|F3kbPD>413*DnU5nf1mzP{coT@2$R=@fi6i9dj`f2L4q_E zW)wI&%}P%qfka{v!2!qKSv6IN9SH*kG` z;l(*?ZR&U8bmJF?8f8yu?~}c>G5mfZr`|@;&$Hm-(U|Fb#f(!sS3mA3G_V5byGI|> zpdw{zE7m8%w`89flbPHadsO}K<*xnPz~%5~Z4yjY1yzoxJxm`t?GNl;#izS0Nq8}7 zaAj|JWZVIUc8fO^8Tol_Ri5#7)xuGgf}Nx(M2=yfrFZih$YIPuOuW! zb4<_iO!N(pDuq~EFX@fFuQ{0@Zl&>_~6c_nhf^#Kbf62*n)!);;d zy}cDp!7qm%RjWac*i9Es>#!srWQKk_b=qmM?`IK(u%~RLSdj{;)BjOKQH1|mM3MYc z5oPex_Z(~KAFXmze2No_3Ie|RqXTg^L9jMC&}NmQ>N+enDEd}*Meai0f!%$ojq$|G zI*QAE`({&E#t5SbNC5AcBh{!v98OFApm1+}$$s%!(@gPf7}XpZs2M(2g7`L%vIxlT z`hd-zORWiLDH`rgPtF;(d+8P~_E72>hk=3P*X|haO~w4Sl8YgCo%*x=H^}Lk#G-b` zAl_4p7d*6UoKrQx%Y6hht%CK~r_s1XngOKRVd`fOZGokvB%qQVhJuiS5q+4r z+%;QpWGQZj8hn>u1ah(8k!ym{N%>C!LsR+%lkZ)S*aar#WKIvj%e&e zT+jo7v2Zr@mkZy+-b11kf+G)Cw}@0|S`<#!8Nj8ot;9+}RVHUvoCKm|d(0R9F_m9s$-?@}m{@lx%>ogv@WmB!R1 zn%jHE((C)I@h{h&$GQv@FoBg;6p}PQJm=$#FOYXbX&(O*w8U&VMXlrG>-IZz3F{Pa zU9V6u_i$)3?|MoA{!6o5S;vUYhBJX>8u~jd6ZT=N^3h{{nZp3N$;1DI^f9G^&*jVa zph?r}yemp)w*$ZTCm3yoBnlVaN?s#nR*^a9rWRMmK60Bz$^LZd^i*zCzDt2vgANq( zX<4LY;8E^}y+Tl~?5G$Qx%!eDYRP9&$=z zdLvwR#CwX!-aoGQEAuxk|M11U`{$~QE;NVJ#*l=YD;qKL^a>=+o#Jd}E>lnU>jpGT*@ zx?oA2U}Eq)syq7Lwx)WlBbsnZ>b+cjwEg*auvzGTgw38k8>75m`0BCfY1e{D-tL~$ zM_gOZ^|!5@H2dSZeAZSL(20I@W$B^STq5L1{oR#0?S-bDB*jp?U)#c^tCWY4&5L3k z^r{D4;gG&%n=6U=jNcb07aV*9lO^Up7m3j8Ijm{}TMramV9Vyx*_VbIBqH)5Rh*V!5R^5$j*!wyk}i)X!HPj=DWBbvCuQKTm? z>$Oo4w8_kCY2K^Ckvd>R_iJb;o^!p+G z-_#Kj(SZFmD@RYa8BoB1Vc@6N8jxHIIi_6DbumG!H;&{~z47)kES>3I!g6eGPQ z=3(1TbaC6G`YycZ_K&|LdUx*QX)5u4QQfNC2mCXR#YuDE>of~L=fuOOFS_IDUqfh$ ztVPn#go-J#->@qgJ4QYfT|@UsULXC*44j-{u_VlQN6oPC5(-K985UORr;R9LzI!V< znbRd^AjXQ7PoJW0<@jfv0A5RdqLTwXAy2HXygnxIalEviM3BF4t*E}-q1sKUG9Y?( zv*p1c?Rsj)w(rYZLC@CjIYr%TtyfEC3Z;2)JorGn@2X28<#jUvA!cL3g@J2x8~ zr;Q{;S9J07rjBRMTz=7~uEep=g6mk5TiBHn8G~tWwcfcCL4ILy(6+nxx_L3%sl)WD z-e(s(EiMr63Ln72A6*^WJWi4$v^c|2v?BEEF!#%Jk{>*FzcOJ+{-7%R@-h*aovn2B zxx!T(s`lmP&M@VtFpJ}LI*dlyO`I=2u(vVkh)wJ|3&LmEK@fx$Cd@iJlTYhg(b7HG z6uPWzPxX#sFXjoaLX}sJ$no#aD^JE< zzw)a6lerZ4Hnl^4h(u}vfm9>aihd^;@N9rzf64ChWL(*?oB`&3XN}t-CH8s)9Ht4{ z7pN{=NE&BYxjH*4POtqal3ZDgM1G6hR(&*tG>VP$b-&#I9nMWs zHo~3#6Ikj;37%{Zqq*RSG@+DZp7ng#fKNZcM{g+TFlXoFy_)zieaDnW@xASb3RyEx zkwx46qZi$y@L~hNO9!!(XkxzMj5)P34U|Y&S#f6cX%G7=bW-PiobzYX&UlH+WE9tg zPuVWBHonlqqgIX{p;kopA1@8DPC0YU+t^b09%L>(y}d1DF_O$Nb-K{w{X1NC8_iEC z=Ymm4z`d}^VVY~>yPfCGTW_?*2AnMweDP&Vex+%LyqhaJy?Wg&)AhWAwZN=Ld5mj+?!imY^aXyWeUhs% z)l^-tivDm!1u~5Z*R(iLXN+RSDVWnwI!$%7b9Gx#hRfBz4h!dFZn-4!=@@J3imPZ; z-qvj~qX`C&@`{^M4_`6|k3|X{->*5eYce`MC!a%%5x=bAE*sIlcVh7QH{8AQ`HNJ( zsHzm%-O5&jCabsrqjgJ_2TWR<+9{=uM;+&z(fKqKh;ubZXD2H%Kc){((&K~$$Qma? zUTGG*e8#=L8*?TDH0AM>rwW6IuSf&_O@SSR`Kz#zRxKOI%A|~ z>a82@ALf6UtjJe>wQAtDI4L6QCqyMd8H#Xp#SdS1SdNu zD1EIne(#;}&gAq!tDk^jQ`OqRsFatQZOVhbf{z8l0)6PTf{F0^Fq^3@QMFC8@aemX z$66m%3g=Jha*Jok+zikZ^C2U)EVFj?!(<*7jG3q*-@r~`)#t4nIK^a$r{Bd46%0s= z=F*j6tw&8MnP!s&8CTY;7Vp-jAO%fIFfuL)&GvcM6PgQ3j7Mt@z=QKBPdR+q`v^O( zXrEM%k)YJ<*xe-^SmMQjhL1Myt#`hJg&V?>{c@(Wd9JIE8uA<$b5EUF z-ow_jH!B{#K|PJ%h$IC`-f&?8;0UQgu;U;L#;317oeaFh|5}2DxFne?%`fA8iOOl0 zIF7qVp81`!-+C@jB|W@biKZ>ET;zEDCe|CG)7KsG-8Lb zH@S>ziMi7y^jzP3?oyISXl{2S_MtrAZ*i`0%a*s&?c(}&*w_y~kLR!Xyudl)VRR+5SGIPM~}d z!7Mr2@xa|e&v?f&&b;VS`ql&fD_4OX6gGM5#F@7uvE^qDZrtOV{cd$+XIQb(p`IPY zJSo5%4Fn3{EYRM-(4`7YGV>juzMz4PjNx9_6$Aj51#mPQ%WQ7c;{@R%t;gBCRJX<0 zkFQWuOQjkphy{wOX@xS700vhyk^n+3TA<{)acmUSM{)AbW37b?GQL$`iU|jGy3#D8 zC7S3kG_mEo5wiwJfEI{!MY9lT?|=eVG$-tzRjTRV=3?st%9#!>pLht@y!~1Qn4L!R zJN%leW`4WQ{pVEmhWX!5RbL2OjY_gf&!YUSJRWi5UQ8`6y{Xq|pz}oWw(hj!b=WxpL-=gr-7 zXzIlZ(s2(~F90ROGy3;v9jCpmx8nx(*3y@HEDtgq(dVx9fTK5rV@^rk*WZU3%4DJU z?+3>(6xwr&INm1db+I`SzJKNtDor`hcZ?y{hc@YL(v1?m4^Wk>GzlX5Ej^E=dUS{D znX>M`=}vHxG_gsAnfR0BK{XD!V?~Qwbgh77E*vwHjf5Y0B1A>l;3|ZYVlfadZ zm6PFK4m^gNKd-rUGE}_#wBfTRu&4wRQPEpSV|l}^vo>9;WLIr_j)gYv69K>TFmsN} z8YSimksq3Sa{#G7mqmk1Z!AT7@_ojTSNFY4MA}ZUbN5WR+f@T=Wf&`Nw_?%Z{QhwT zU6dm6Wn^ZZvuVx~@u9`MU57-j-dx&>tC!f`&c(;6;~eZ<)EyVkA zfk=}}{G!QpV;<_+h>mfZ_nF~Q)2~TwqwiQLj_4vf1{#JoZYp>`pVDiQ>o#f(_=e#$r)qcn#y@R27BhbSI z3OmpUTyj3M2zj>Q>gk!y=vJ=E+cRW0hKVbCoIBq#^!YY%3RTX@h|2Zkd|NtIn1p9W zJev0Tu&nfDmxoSCZ*%|9k@M2Y{56kCkMOghN|qTEI$fmA1?*zc8S2G_gP&2(A3o#; zA|qduK853AU_Qmp8!F_C_NvF)?B9{HGZk-{Z~(&u1QW&ld5>eGJ|i8^z?2KCJdyGs z5V^vv0A>>qRxpJEiRt}|S;6K83&T8Va$N3eJGI@iV5}U=!E?y+K~CZ5rTE_BYpzQM z1O)HCm7QJINE&O;aKS8Ju*}%4sjZRI+MvFiAmFgCB^=2@2_F%*7d3|JT|M-^qXKBB zmV$4%HMe(@_=XhE6nqm^^znXB-*kuBdJl_~OHgxWO&^9Qu!puaKcRJTw{;)OcI5c> ze4XY+doF49DGsMeb)%ajA8u+oCEO;trK#AV=n#N-iw3ThP$;!o4_Wvb`Fw|yXRVDv zOeK^T9P+`r2=u>lJQNL-_~G;<+BQx#peg`)f|1PI>w`9eF67lqa=ZON5c{wWSY1Xn z(9|T%a~5r*l9{t|bg+8E0dKOAl(S3>dBd`!mQgzrCZKzZfMz|qijK~rds?JIfM9lM=sea0;Y{c0^L0pS_m5$5P(Y&q6YMWa3v7X39|u(f^bgA$e%P3 zOptgII46ku21mpz5#$tz5oRQ=u0%esZmD+py-`G?V@cl7CMVCBjz0t7;lCqYaS ziVR!|MP4R#Uz-}4q5-L#XjVub_~HY@5a@~{9~hKd>9T}AOVC~!tiQ;rFwS*;6s=kz zl`&N!u^}|(2Lvi?d#hMO1Setq#5M{Y$%}4 zU}PKBPqaP>mRnE=41?!lB8~J;&C__*%uJioi|8wO=0VM@xmhv&880xugHj{G^y4~! zODl?n%Ii4eR}LcRv63|lV7ZHu1^twSzXkLgW(rWTi(+HqktiNcek2$m(!48`A$jtw zP1X{iuZN!kmTf3j2*G^TMi5d(IAWMVVH=78Vh!H3p+sRe7>(NvFRK_o-1RUYE6p%a zTMb#<;RKd4a5RZ)$^;Df%D^*$FAbCvD9OU9Pu%SB3JJFm%I-BZ_b(~X-;~_FEb>O` zs^dm)`QeOdD&eqeQ5cBMFhgnayS-mtr1cynI-4F%wt!t$gf$_py&?-Y0kT}I)SwcJ z&;s5K%o3pE6ye=z#K^+HJTx-0ah#lkWBX&r(N45~0)?JFBDkY^;8+D%KN6-xyi8KIMih z5W5-A+7s%x%W4!Jf9mwHDk$Ycd)7B1?vT-T((NWC0=g~_A8)e^w5f&&7hy*uL8b?a z515w_TI^%}2rWoH=w)K*1lI!)=Lj|Ong9d`T{K}RPU+i^p*Y0|Q^F0?VgN!8f(81a zFmHkr{p1kh4x|IG7X~YbK;*z!5P}s5;0f1H^uY)ZLhVTFCRQ2W7>uBWK(g??AqX^t zD4-MI#u0}s0rOPkIu^rSX4aD$dIu^E9pXFf96KIDc<)^Ya554W0YE6?Hc%8mK*6*p z_B_ZFK=1v6L@KGnYn7LP^KGos ze{gFo{o>X*=>O+#4czU&bZaclf`8Gif%~0XL**a2HD-PP-rzhSKVJ|1-5xv^Fx^1%z+HdcV$V1c zw%8|k6+i#nV&j3q4WuZp=;yu}@Q00Q{jzTsS?e%yo9Fx6&Fm~fGdqpY%(nf}%x2Pw zb^d)bJN;)f8)&I7*#<^@{vKJx`3bktl+R1te|owhaOB$0ip7k(ujC#p=|)gm=#OMJ z+po>+Jl`+r+=OQKbF!$PVyA-a)qKJDXsj?`b3=MCcKqi0jVl~_`NQ>_gn#CSyg&r$ zO1MSPE{Fi^BuWXf(I7<<(QP7Ozc6gh^V?2~7T*f?R$#1ZW5LZMszBKlXLU$S!zf}zU6UZlmtE=_kW_`b6F{|L4etdB( zlP(%N@p^fGZw|n#D!r1PA}m5VE=!y_m*K*Z)@AP6A)BdU?wTu zT~aDi(g@Ne-2wtiO#?wC1#yT7NJy8UOr#Y70ZBom1qlIZ>3aX5%h-GEz3=;dpZ9s5 z5BHblIy^k|a0+9L^SaLScfN&_EuuV+_1mqz?4=>mL?@)z~1sR46>R^tF{v6=wL%D#3vv2{NpAj7w9w<46 zrpG1X(;C3`A%#R3{;RB3D=k6vBZoEP9oWh)_;lQ!&gXc)p0m;osGX@8rDe1=45kDgpTM9=UmTuKY^-KU-0ce3)CAk#(Ct`x&&i~C@p-Xo zfl#6cR|(Z}R*L5$+HgBB8n-5+duK|vyE*Zh3dE8e4T|jv&1q8{<-&!*WrWME7ww58 zS|_sQJ@HTJRLb4B9(-~BM)<5Yynx;{uDk1zH7t5vUUB&iWvQmq^_{-)lNO$4=ZBZ_8pKJmT-w+1;d_n%mIaRmmw0J3!R>bBvmfY|_um#Kar67=mSsDTReg2=2TjedF`l@Qw7s3QcV)Ta=%)?VYm<3IZ5cV_W-g4C_*JC_ z$(4;A8I`>6dAKdkoYdY^OwE;)-npQBxo$iN=4%WrhvBqjW4u>SzrE6#6Y2&z`1L{A zO*q}Toc@B#<{}PVdFJMfk6Xt)H|cV#Fb-=(mIKPFZuDz7E@u5HL6^4~^MX$evX}`9 zjguK2CScn_h)=W5*Rb1Gd^K&*CH?O3dL1~mPA3FdKEYYQG$D!@ghiobpace-5_f4F zLkI((?xBcb7r@thC?@i)kBPKv=gGXY4$l@}87}~|(GWuC6*m{28#i*#&CMDJO)1wT#e!05QzvzLw5>imVh9IL5Cod0s|AMc!u195dkeT_#R0^ z)wP=Eb#w{iqJd+eeijoC%$_5C!0}aR;gE!)(*v20P?sQr6)GN;f{ck#;yoGdu5oTA zz3VVS##jvY^~QPG?G%U!M1OW4FsOcnPju9LU2-@QI6p>VzT*b9YBAI>6<||~(T6-P z+mBJS_(@d_0FwZ*F6)KqX{p7L4PAcHah!{{%Z!XAF^vYtUL^tiC5-6t0M~sgVfSBD zLd{_Z;HFBagLqKeQ*1PLgc!k8aN@rPw*gm*V!QyQG1Sl<>XWuos=r` zN>Ut;KwVKt%mIv08xPs?yM=I$*L?9IolD2$-fKYGgOIf_mUEUbbnBR;v@J=DW$Nlr>7AJj|0z=jYp86R)Xnfx6FSWxxEI+hBH_1u(Aq$^i zIpHJL*TeihSMXs%;!$R2Ialq|0XdonlyiQd9*IPe;&b%)2~ZD82>Na>t$~gn1pH`q zLDl*`!h9YqD5BWlhK=jk7Xq(cn@eSyqSokh`X`4ymaD)ksAHAPq@(!FWShX3(2``g z;VAHG2D;BwqM-W>h7as%_ob#c%9W;hZQeTtr+DJ(^&o(Gqpw9U%>AVoC^f(##wA7i z+OMqmVj63JVRh_o7(&`6>FwursTms=iEPa6!ecK~!o4^c;x<-Tvn@yos*Z#lncC94 zY9bR$s*Yzow=Q3u_|#<$J3m}=oOHyhvER^Q9{fYG`?0UBQRG`jW1;V+j%s`fAt-6< z&A*GkzIz^b!Wn)P24R|bR8dIWSr>RZ3~#3te07BfLP%ZyO?rOZBR4p7tz8&{)W^aw zf)0d?K{pz`CdwQy$pm0EQNnoGUO=ah@CIBXhzeZH4lNfR1eDkZAA*5B2#hHD82J&l z0@@Vm(MM$M?mHITo!bHe2}tB&BlFqSW}puJuX*#VOS8X>IAhY+Z{~)HUBf=+>!Vo; zRwBJ!v+fsB9LQ?8ddB&gND)=b2LvA23CZ&}4C1_>HqN^UgFP&tr$A`uSfy_9iu0R- zTVICa9*T=(J;5%Qk6NuxhVfN#6U3GyP-x-LV{P3M8_jm!$L%x#|Er-|f{TKoNyd z0xBf5q#&^a5+z|#2yw8}ft&$PNNGutCyvx5p;;wj1In)ep7t!=&A0uE?4O zEI8s%(Jj=~9h+5;kezjjvo(ZKb>7(&N87ZFOySO?aPzT~wD&v8-TwBx9ormWEMTTT zP33KKXUII@3VF=@^~7{0w?^VK^)Y6q{y94m)twCs4+>resHwlI*6uZ(n6k>01N_s} zhe4h{@(97xtrQh7`3%m$EiW4o`78e>O#TT#kTyH~?avIJut132X3JN@KXeH6kk2au z%Q^%P)nl4SLIb}j))zx9# zv3djr4E79Q8W1PQ8&=0klROGldF_+xxUmohwgDnT;+zoPcxEMl-x=`~m-ZI%aQ_2? z=#kDpnUVSb0Tziz9|)2d(E;MxBptYRakVf8XZt;Hl_#BKxjH(kU=>5v~p+ z06bQ3T3ARdIg$Z(DwZG8?*yPK4chCeg4r|#iXw79ic)QG5Jh>Sv@!zbhtLR`8Yp?< zd-TF9_P%Sk=IV6C9a_!4MDOd#%Rs@3773CrK^MHQ6)g!mKQ#L)IFNq&e@Z_aaQYmA z8bpL5**V9zxECq))3f#PBZ$o=n_@>41BxrjIUUcMT5Fpcn~3C^fWeX4?zV7{#er6* z{f+LEHsk##-3KS#g3`dFE8zS4E4BLb_C`hR6GkBT)BZC*XSRv_u=kKa-?(=tx|Jg|$ z`MvM~)zWh_s5{D#G_E`9>PGN8WmhjsE5`AVqj*X`Iv~n_nybsC0kQ^3Pr)i&EvrP6 zd%XrRLctWU2k|l|&^$mAi$F;1F*P6;tvMgJ&zJJOCJY+)U$ZNpnp+?YTtE8niXg43hli>4sIP5%n7Y11xU_F=<``}7rhX9rDa!%=|ocpkkuAkQ2rApu5x;27MIAe0acb}*YwKH9X+ z^-SUg@{=A2c!KmH==pJ}SsmklB(>KIVT!Ld1M;_!C%Z@iNsT+QiXMTHFubp2zy><` zZZBg4aePha1Q<2>LDqa|KWomipEc+DvdapFo6#H?-=k7K?}FpEFLX8~x3}{fJ_|20 zKIX!ry>dAg$h}800T?Y3K`^56Koh9dK=5EY5c&>n0)v2|n`m}WuSH7<7+cW91lWH| zv{yPH+7m#w&{)7{hGGB)VJO;T`G46w-GQeWijA1xH-i$)Dt_?Xk^=={DA^KIIm6GktdQT4f(ye{*7#X^x~~mHl?K161C#oYe%Qf z?r=lT*9C~~*g*rR2*0?zU^we*^rd>DiWgbHy>hg?=wWFCiw=Vz5 zs8{=EM*VqTHO$foc=C>hhI((i&Ey&b1gM7yz%k-A-7B^I9e~Cd!wKhFm$j`+J>A#0 z@piDzOJY8w-(si$0A3tM9y-Xi(P$d5Q3u@$)%%wNISlWrAvonn4F`={NMe%teOn;; zfh{l+H(ZTkA_A%85MljN12ohPH$alI7O;7)da~A+Jk2BHo8HSCHR7xq{e# z5#gbs2g4EuMG@fq2Nj+ixTw-0Xz=$T@T!H!WPgLegMF@?7f55GMF5*b6g}u=q9s9@ z>b8`t*`9JAt2pAQ`Cnq>x=izUbe)F(Greun&=tH-=s!|3Q;uR_=i}hHu#X zPGqSN_yj|`qlbB27B3n!rkb&v;;if((srd{4yPNeURu(}6}Y1`@#wr9(ibm3eyfIk zHpq(?x8bXOsO%mcf0EfvK&gll1{#-924_LxPN~A-l^3!K`zDEb$Rxq^n@K|A zr$@r?mq()8tq0foCRHMkyV7pHxMoKRd{TrE$BbSmE?6#3)e8k+Ky?;LyRUP~_{UXL zH;V#!cToISnq==aEQ)_(VVXW&Nk7hlHLFY9N7LR4ed9rX5KIH30g z-baiK3GT6hwX#njx=y;@DMhn6~$`+CfIDbRigH2U9#WC#({X2D8 zb%zR?0DA-4d;d++fOaHm+b;*%YxtiN@_$aq|2ZN5=Y;(K?Sx!_sVqWX1Y5|9(1`wm zm5hv#pc8&D?l+%$Rz-}NBaV%;?akG!Q~2G3$P^fom{ay0wmR;`lV@FI&z1XbKSaib zzbm+ABvf2fByw+Bx6I;<816uWCS3Rmi7{u#AoCL_8(|iL1Qq| z7+S7=@n+EbFK$J7!L%h*w86_jdkV)$j3FSxRt3m6c@s-9Pn@WjsXeOy1qaNKfLH zIeC;)p05$T@hX2oC8}_AYm?~F6pZ_!fxzf}j%o46undR$N-S=X{de45o9}QXIqA%J zedTzcsQpxJRw(!NMcT+9<#pDg2bm13&sYK~B?BJbcge83*?H>jBF%k2U~i13rO8&R z_30;5KX#^arsk`!*4%W@m9S+HXN<-mS1)TRX{dr8mR6nnho$49Zd}15jBm}P2W<6l zxr@U3S1_qA-GU1g2*f$r%A@dCI#%%>>`T%~wHfw)-EPWwwR zte#)t{Z!W`ev8gS*6RaFS6c5gUPw1}STgQ^H@-LAyq~lLa-~pLKv53{1>8!ZQB+qC z=Js#bKC2`1l{4r~EgDwOGZk&0=J9VYUAoO*rw-dv8{Rbx8(u%!mT70qRCZydEW1aq zGJkrdJF~}Fb^(s?hI76TSko)$8yQF~P3|MHR`c~fzIUQYi0!MMP@poG;ES=g%;WS; zNOEiarwd=tjcfrk0vbh-V8K8HXk4k!k}kBCjVg~S_E>aIJ7P_^@;l}qjkKk4G z5`nM4H3`JyU!EPMf9ct&gFHKk@1C9fYNN5nVaN3W7>c1-NWGkwv8QdMfd2zTq zTF$s{w5~8(sZyiNwV}0BdB={8Snb)@kuf1C=r=E`r>yenwaKJ3J}pdfKpc^Lcd^K_Q8{qc_;4GfzrJTB#XetXA2+j|rWtdr6s zU<^28S@m3KJc4wZ>*NsR3&1fG`%-GyHW%nIZv-jJR_kFGrybuK5J$FpL$=}E&ieGs=)y{R0AT1ij4w@9IEz{ z9Llui`7e|m)7I&~(4mu#kGIFeVm?Ws;Gb~<3J>I?882Qj8cR&j2$;t zins-X#$m9tNKU|z0k;QRWzcLS5|ET5uE9z`csatBICP>_PTXxbsYUL4;Uf+zd|ZH0 z9&|nKiO6g(&bFmDxb1D=M*QK4Fu*vBp#lkaQ8{2}7(<7HdSGZ_05O8$#+}VT;_$%6 zXABuQ&4bCJyds79#IW~}c;U0jHF0R-zXX_;5x4R7(gFQL$h{hX>sUsx6M}>p%n2N{ z-iG6W?paJ4P)bIeSKP&}R^>^$TIsJ zAc+M{19@|xX-zd)Re_vn*N&qU6#bC6lcr8@_KY3hR4;f|&HFvXJt)LpXZ^YoQk6P7 zf^+tAy8Dp$_q1}N#G8SuPf!JQ_Q1hlZ{ z?nKbyRqTOJO^}7c4|FIaFu?XCh8plSL%a5`R8V7NKP?@(c>4rT-(GR-Qm~^up0DnF zbw{a-{ZhuNL{M{6;rUS+L+Ybihou#Egh_W@BgdSFZdgLxG2SMyIfiLA_NuxZ`C!4fTVdO zA+)Fa|Ipb4_){=~|GuyZW{ax|*dHKQgPa|D6nH$rkbU^TPYtxW5mg`o3Hdix?=sv1 z=!rmJHL@O zetcH+Ea*?>2wcnmO1aM^jO#WoZ@;k)0wrKV3qgw>rM6^VhlJwLdbdS6N6P z30*8gvqRo#p|BV^qduMRd75b;6q3nGfv|0ws$WrNW(gHmj$=(TN8?1K%xi|&qsH91Rp zVDc8q3)-BT2BU0=tL^8u?UpC@Tz6~tXHs-{6$O9~`Vq7%AQ@>r!OR$O`C5Hc9%<%F z9`%4m9R09BTFL3p#@ih@ja76!jPzi%zgzch9on4!(<_gf;Y-+LGH<2VYj}fl(;de9 zdhI)^prsnYX?y%%nWwolzli%iV^ms*c$fHPQPar9C5usTO7`oftL}`;%gU7Ntekeso+u96T_ldyvf@U+;I0o&{t+TUK2;J5Z% zsE5kN6eaMzFIVQzzFg*mzTCBc?8{a7)t9?_8+i_{wG)CX6 zzp%eme?cCw?`47K54E+?OV7(yE&q2G*p0s}umkPgg&0 zt1;9X|5>LivTI*=&1wChPj_u`Rd^7gj`o`AK^(~t-iQjs&zV>3+c}LC@9d0k*m>IY zw&B}Dv9TSHoQ;Hb6}$6Lb#Ck7E5e9R>~7a`W_kI&bm>%02tX-{3J1``(;qi-3*JveSj}VOWhw+LKhW@epDDNzq3crL(Mtg?a@Qp|7ee{2CDbq{IKIVzkBd`7;GLFNQTkG17)%B z<)heu?Xmq{L38j*7|Djyl!C(vV5a-ew_pN@_OMrl7KXuG_xtf~;{UZ^Y*2=Kz-GWn z75Hgb1I}Ls{`DUQ*-_sI*S4~IDKD3kTH^QqQw!-;^S|@00Df*1C+#F;N>16;#h8=q*QK@uHz#U#zZdvXnnQH! z(BJ9S;1vw=4Z4Lwi~nyhs1Ef>DC#iuQb`X*vC~6fY7Zx!qV-CSnf_}Z-f#rmts0s6 z;Ng98Nx*QM5?ucT_0B#?M;_<+4^4oZqMuH;IhF^cf!!huTzI}O+jU3*6>pU9W+*}_ zjF_`j`_p>EO4t^IcYS4c!3xV(63{L~vB0{3cNvQRX#Y>k zsks4U`CZkfqg(_^zJad3O7_J5$4mL6xRUbJ?}QZ#nh%R>G8er37^7Q+bTriuWpU zbe(8&7*x8;YK=NUj_Hs2T-El9@5Pe<3W%GGyI_r4z{4}Q#%X;(a}&UNKol*l+y3~H z77q&{Ih;|UkQ3}*3@>T$%#FcJ2(k(|Utu_PklwKU(TqC$-)Khl`<33%KWIjso67i^ z-iTy0U0QF9*WAwG;&%H~=3+?CkI2sf+pbXO;x!;UgrGCCILQZ@Uas%g zoAN>5Ae0ycN;+geRgv^ps={|K{2*2F;vZ5K!=Is4MJ2%>WP{5p0ILTrk8AECkAwA# zwB*2b0!aj!X{PQX1+bHu8?mYd+_AOuECVM`w}>_CZ-it^tllp@#}OarrZ9cQr)s!= zBL9eU%%ZR8)ef6+-)2ue6M>G==56})w_>V`741aV;&gfxx+_|&38|G@b68S+1Zos! zR_c2wr>i%Me$;YV{HW#H+^^-j1=Vt8jEo07g}g`081zvt)$ygl*!A1opzs~a9qsS( z58l+CAJl>2eeJD@hu8fSv{7K-P-Q6;qd?#>oCXmUNH+1Qknh3ucTjL$qm@2`Z6A_O z>l(LQm-9-Ka#bP1W131$Npr|;A+h{2d9zTQcbr=Wb^^>)AW;-1-*Xn=d(HxT2~>SX zqqtA~2aG&32;N<^{XW)Ti`;!?7K{89<_@9{-a4?v8`fD&_ z_{U)8rS(Kl25=i@K*37}_bRdYsv<#=tZsJKE0g+iRi0%Z1NE!)jCjM7IFmdCWYjIk zU4b$v_&_OyfeO@QLpP642*Yu}utRMLzSJRwA#Vk&m0k_B=b$EGgE*}Q#3^crT=A%>ked>+|j=CsX=oQQ0hNQv%9J9CWkJ&H(t1p_<+vgV|?5F~Qha0k0Olq>1V?10$ipX{W}u&VF(ab-PMLc`QZ z8@;4fA%4(VD=%`$im5Jitr{Em!Xl5({@!y+K|vu*oF?prwXKbf4Sauh(DG@XYJYdo z_Sfzp{O9gKY^BUBt4F=k^&gf8qAkp-Fq^}>t0&Tw1lE8HV1Oh8EUB8K1N_LE0ZF45p z)oS(C*>*K5mOuX9gRTRmpM9ei^vI~w_NHxnyu%TkeA=P|; zBjn9!*TriLP2znweA>p$k84)X$nKQKZA}TDblx1fvH8m0hF|$&FxBju(8{vt#It%I1*TI77A&RatsbFg!CJ2~ zl^=Wv57tqhqzXSJpH)C1bTVk9hj7IrH4X2sCS{wbEx8Vf+PV>H`yFr#LBVyUbs6hbF3{qLgMo-HwONqpV_p?w zuW}a~j&M=5QXbc!2~YGz?Mopsj8>`u^9CmiMB)hzA}CGU!HTnMsHC-bF@%{k6cGd<}m zzvzr)67^EuEahJGxzPWZi=MVmt@qHXPKyp6#cXrWtQlxcfer$zeU!!>R*X*9AaL9# zX{6U&tG7sVGk$ExSzdY-kI#Lf&-jrV>ytC>1{3(_#z~Ue+sBk|ag))7K6e#H*w?eE z<736hr<2(_V^U^S9^F{*wYG1(RA5KxCALRG>K&~;*uSWLIG`|Yp>5Ww;#An(6$3qE z46>wjK(tclKDd@da}@hHW%IcdyPQK(cgDVFe|Ya3v|7{L+csMLaDhX8d<6Ek~;DDPBy!rH?6XU{@o~79E&4Z*_k&VAJpBP={hI3;iSYH!abF zJiV7xSM?rd^M9nbfxnO748HUOP&jWpRwB zl8tz(PI;{U-SO?yo9iLHQ3={(!w#mn=Sy=c#3uR!)|L(G7BUTO!M0_c$%oaKLq@B( z@7X`>w!e}6ydc`u0$|xN!lIH*$+(61^_)I4;d2jX<$7aU%0qjlUj!tQD$}uRw^_~y z-+kSuviRAgqwbaLe3&Ik`1NsWu=9|bfu1hnMW6xgr;p4Zzwl%EDY^;=sFpEamgoCe zg^6=@z=ACU4Tw4c`LsR)vVK}5r1q;5&?m5S{UP7tTu-xU*66Zq{Q!=}a|EcTe53n1 zAc%2Y@>AgsIU`?fTPNG(%K7}>+3xot(#httbvI~VNeTI-G|1V%z&*Y3CT**5rd&G@ z=Ma33ZA`X_D=WBvvqSd1>D4ITCk3*#IVifmuYZb2$<67SU2(s}S1cCHm(_ES);#ah zXR;+mJ6?R|Hc4fy<ciTq&mDUuOObjX1= zUe~?M|1&24rI+VZSUB$)wt*q52=O_8x0?QpvgFCN%&-Kz@XO6+3HJVN&H8s@zY@Bu z!|)Cph==vjKEL}cGP?Y{o`|~QaO(B(4{6qme%c>!u)I6ko74eyJ$d6_FOOLktuqJH z@PD>-n{S?bMbLHg>f63cVDXZWQ^dIQVL%d7BCpCypn z*p-7uY#U71CL18hE4?pyXSxYHr9Op*()7jC%J=mPwG`p8rBSWyOW^nKe@NhDT(>** zF9|HdvM+%*)>la(3EZdobHujteZ=PS$BfPHcJlWTTY->Tx7YrNO$PpJ#KyXF?3XCU zg?$&rl8`7a_)Qc)fNhsjf6Aykw71@%b8Q~rZ5L91QgXXS-a{^@xo_3s5mvn*jZVu; zh#W9A4OtGXAf4D*YONf6Lbe3H9;0|z8-UmP}xKWD!ae6c(3a4Nj3KS{3X62i~hd4)>>X&l1zmOK1Spn zAq45?J5UKz_LnuBr5U>KNijNUp34X#Gnhz0p&g0m+9@aXPkH$I&lua(32vUMlx`tD zPxz<-Ubhi;*okIp(X?6OV(alb!yC!(tez=>ZCN@7ECcsyPBtUiZa$^0ac{gGr(bH; zl0!}~6*BT^!PiWZras3xXHlP$M^eTubR`PWTTe_6n(A&vKe~NZk47d=ncQ$Ov#Lmh zO?%)ShU#6|fMg?!*d+}uXk~QUkoL=Cg4O;shmZFQG&w$X>l&Q9s4Uv&;%Z4~{O}dr zw(u5;qyoOe=&h4*J7(^!4>0yYpU`A0VQ&aXx@qcodP|{V$PBb76-#i zBf{CwMfi=!mzwW>&X=GKD*G~E(UuF-fA8g}w;3(+>7?xoMG?NHL}tBYZO1^XxPCd1 z_#TabVmtvbh~DK^(#7h`DPAoUDfcL~ucH1i2_iS1%kl2H99tz&_#BP_q+Mtt-4Euu zrN$Coo72+?TN@X+1tN82<60MldMN0kIOhw$wVhs}EmY%8TKfFu0gR>x#_~u~)fcU$ z;~x8>RBc*G8pI>dDJVI&9_Q7b`OjldE>cf zP*!l~(`=Pk#1d`Vt1-L4NAi3y(xoh4t_@O!$;LS{EY^0khK(CPYDSuC=6r_T-CGC8T-2A zsXNRsKZ>|nD;K??eBF!bM#%N#`po$r)DoqRxbv%t$C_06!HI};+|e(QRTCdcYXGk- z-Sowqof*$;(rvG(I(aA55_Z$^UcdTq`JzP*ua2ov2nEl?CzDwx*1lbbr#;53L>TZ0tU(48{%VPhg);bw?(SpKYaK4{sfGv(YP*Cz*^J34(9m zF_G7lzWqvKq##+Q`a|OYIv%r26)(rje7${XTYvo{S^#m| zMb1f~WzI5t0Ouz?(x5t!z+AL<$J7luYd+m=X$+2d(6Lg7_7;A$qZ;}qMBZvNYnB_+ z`@zT_oc5rj(&cAycp#yQ7w^H)&y^J;)8X21q`pyPib*fM`cgw`+1pFzM@GlrcAiqv ztUJfhv-8RMtNW8UJaSulYpG-PHS040y6-Knm9@T>d*Y&T_UeY&P3^r?U?2kX9@d2` zjKn~#O>$u39wv_3QOHhC|Dv;T-*n-{2+PLIm5p>9U~)#mv9c7O8)#(O&#`^z*6DWF z?ntO`@_2hUvx72g%kfMWE<~!O7N133@PkYiQDbQQ2D5Dx-SFQ@4!j)1AzMp~DU(P4E4Xz3VKz*BrzSd-qcgJ;{wb zU-C9~{P+jF4<9ok+7(nh0~bs!>)sC1=icxyTO)aM92~Qt=f(DMFu0$pyRL!?>)pbcwvAh7-1%6VzffwQIzyJ zih2uc{-mP-u0BFoXVMi`Xj>i=%LJW6YA-IW5q*6;&0Wp$5PUId0mP~_W%Z3O2y{Fk zn*46o1x2FM>J;6$LGa`lgC$(1yufO{7L>9SdJQxg>LhfO6p06Et?qY3{ zKZIxzJZxedqOmOr1Tq*P+CoqUO9}6J_Hwg$$1?T~IubGt=YkYTWJQR3&ig#Y?ct}2 z+r)B{TO}b^jgM|23|^aIzesV?2R2{8rQd!T~6A)1=+b3*Jny>u2z_o%3{X~<<2dqDy=EQ zH(WK;dh)JFC0+j#SFu@O7ehDFaDk}Oif%o6~w+S`Np^4MDescEY7Sypwm> zEGv96vhC4ws~9wEPo{+yK|29c-#&qUAL~u^sPyunOL@cRahXbPS4~Q_2n;e`;Sl|2 zvGIUN_?s(_Hi|v(fQ!|%DD1oYSI(N|+U)V+Q(a_UqANpFWq zYs#|h9Wkd3w~M^xA73Zd&)G&)@p*Q+_oNL|%ji>lJ{!H$`I}*a5Hd`3?i(gT4h$35 z|1wM*{cf0;ui;u(#uT5Z#eiO2^e{Up~m_X@NOezT!I^a^l4SF)sA^~ zZ8tsbA&RXnK)5D6v5g-m-{9ACr|0;4-cB~e+X;qvI~VtPJ2Gnb0)FT1#2kb!8KT36 zUL8W@^hofsh>R3se69WRd7hLvWwp3_8JTb@_g-VA^u9b^ zau8ZpYdp)O9o|@X=8jR}81sqEI1=3()7^(x1i5RTFg8}rcxu@snDj(+hsDp18{p__ z1TIfvB1F#LWD`4GvCPEsBu(b_dlUJv-tbRbqkhMez^PF*{CMKHU`xy>Wrkz38(FW4 zFq4EWu<%5|Q4yv4?*Xb@Ro<&4eg@|(^pziO6!zmn@Ij;}WFMjg`JN~Q_FMZy3EE1v zcdvC%1|@coD#UEwr$0VIFE0R zB*fLfcRwM#Q|FC4qSl%^&P`uj%)7a5{@-HZVom=yvv8|R<;KpX`xB|jIy@e_mIwHa zpuQFykTOCuQ|>Ir9QX?(ECQcAooan<0W2#asImUPud~`mIsH$a)&JC4(P;LvFG=jS z`Wj*)rU_5vo^jFnUtMQ~gX*k~2q~fCH@2=voj&3%LU`&tdZMra}k4OOc5h%eplsxM-7Ik`uy#ZOUKrf#x%Uv^bBZXfGVR_ z$`~kN10eY!MC5y_KuvBq&_Gup^bqmzk|nV@{)h1A?2p1`*Q|+sS5~&ioL;^~Txmc^ z*30t=zdIES&}TF$C$)2k*8|kHtn{9<_R5{!6V)qo!%TkRS!8$cr%a)yeYy>O}MFrNJ8M)LqByBZ(qPQTrf)adB&?3K+m_L) zvp8m5U;BZeWkK|!mCl_kR;*&|f>!+%#&XVEcKXML6(@{s%G5d6oBjPx-=tK?<1iOz zLh7~av}C|G?g82)BtJaZw?#M7E{@ITt%K;DLc{2`V__Sm4}qmJHC*Im>+qYU@zYy2d%YV#|8C#dj%VXn7vtUO``4rN%h!ORGnx)L z^!U{&`DZ?L^{YIg`jNPIj*jX@hg7!3K!h`z`55*EqmJOpT^irBV2T3G#6H(~C60_{ z5jnI&FRcEhEAfV6?Bcb6&&ha#8bza}rUDgd$tepba)BTvni^YtKCl?re7hgpm21lu z`Q&<~pV|AtD&@rIdCKTzt3b8h4UFR1Y3(Rk0}Q3&+Cwu=`*JE7Wr<9>k2nB^^{g0zLAl&G}6i&5lcd+cFn&Z#(awqL$fWmJD+fU@YS|4 z*tn5F|U_m~%V+s?4-)U~H+An2nz$>7&oEY+Bo8 zVxg;e=_h*K_ItbHIR?*8IURpGZ!sCsdnso4FL2)KU*J61v7$$s`E}@e6F+*mwAK%PBHOHs_mRr)V^oSuohMPEhZ}kdSfBLXX=@Qwj=bC;%KSU`K z+ou#Es6$wU+vPHjMN|*BmhN4&8;IZR(*XCj&~R)&84j0FA3Egl#-==GWnlO3!$4?O zG+x}(YaSs5RQFOuUft$tF|A>V#dEp%sKVh#LZ~j@Xf-v6yfnf^(o634)abbkNw-s! zLHIQKA}W~9@SX)LHW5G9i0RDf5-#C)x|F9#_lh2?i{H6hG4IIK2gK+sQ zPxi_AlWB6^8;Owj7X_N>ZWEm!qInd;Uw+0o>uSk8(=anr4+~&HL5m>0Dj&%>p?e=q zBateF03DOmG}!Z-$wwvGZ?x#3%dI>-m|3l7*C%k zq`^T2VNaiLSc@lpb^6w5cHO0`eY)6br=#uU)giyR{QPQz$YAy#=_Phwz8~qO9{}Q6 zaR@-XD(5(T!k)_imNk3)M4_-P+j+`#A!E_r8)e10z0{&M93lS1fQ|vlOYX{PW+IGJ zLu}Y~x=d0R04YPvEVjqG_wvYP69qG`CSz=`<=fSLR58r~s(9@HRZI>QeGx8fkG)#n z{cKzy7BvJjH_2@u8bfvtJ#ctHBfyl9x$pFOoEXT>Qa0-G`bcG7M5?kT@eUZk9sca~ zl*v;6!Izc>oSVgxOnV@D=|Kgfwe(a&4nM?FwA;iYhn7Tfky)JU;#}p;(()uLO5B7d zwb)q8?ELabT+-At`_4?`>Z(%`361*pKK=Ng%fDW4KXi%Kug#`7I`{4szrVaT$OQ=Gzi0!)L2Y1eFv%C0M9*TT z&py7aRF!kLD6LVn`iAqRfL4hD=F12ofu-k#*IgV9Z^)$Uy9`oKia(Q)oZF)Pszcnz zk9(zpUdDqJ<6fwt8DUUpgVGWj$fe>CA{a3|STE2J!#o7<;~;P3ew`C!C*9CSzk$3a zRXXTofbOP49No@re)5I*+cFnOHiDpQDd*AA$NMt~cPPjkUSdAftR(M;L*jv=F4_o& z0Awd2xW^vgIfS%Yg?jfat<2rQb+UbS*lu9Y|`yo0Y*-J9_sTT=cGA8c!V^XfXF!H-g(! zlL)pCL3MrKyt1q5C`L2*N#DAS$CID-N^|mircu57U46wRp~N!w?+(ApdX`edLdt2TEC8l zinr?Byye}m#nf%Y0f!!PdO=W<_yZ`(c9iuuGQv{(%Axg>XLj_fbH0Ne!#-99W0fuu zw%%dF=@+|MXffE!Ra6vEvvmp^vW!mo3=(6-g$=T;r7jKd#J1@4^28!svuIxc8^YJ~ zgZ<>A{jv}58iq^cU)kW+55}zAT4PG%p!14V@N!ukDC9EpmZRu7CtmgiCCz-h`N8Bu zZ>(U9q8F`=2-D!L*G!fs9V{-&+}NH8Eq!(SRc-hk?y&P*hRjY;#m_HvuIRlM@ybfq zeU?6xez`u{=KMvMOXSRIGk!~Us>T)k7nUqO8urkAq{L+Hy|W(V6yt5ghE^`slG8lp zxwxSQZ3Cb8r!GQd(r`W9(o4^EEez5oSHoVsKK^>Hbcx!IMg9Iag$EX!*>}BBqqv=qn-Sn}@D`&@-e39Xgv*Xo15eri0FC{Ar zfhYQCYU4HmCpzCm_Ibv~DNR*hTW1!?K1sUVml1w)j>Gm=u?}lo?3gp_bx~#R84T&P z-^r*~6%m{dhx5mrizL4hljVk|2UmsWDNDDuDb}&wiRPe6CJtV_&r)VNotOj!Uz|V# zP6Oy2(yX*`D$n|+^dOtUvAtQ{QqQIgm5;)#R4WRiTk3Gjt{c}GC_CD$pB&dM;LD6O zgb^NASv5_%$u%=p=ACOh;2hdeHhX9_MQZp`S{z#B+0oGiawZt-?CHl7=!{z=dlYKlI63ZhHkN_u z!D-_ZaLR7lfM|q+G$mgMJ?$n&8s<1Ur(@<)kJ2$Vtws^TK5CJt6x` zk8e&$SZy5HOqR^TW2P|)pv8CI=-lSeAiu)zO-cW-opRo%{PRFW?Qn~m`;HB=g~{N4 zehR141wL$S2uUF;7d5-ZF{WXPu|AJ_=Z3l0B2?7dY~ zm3_azD~)tdU^3?f>28n)5d;O122oN#T0}&tDX1VV`J)7pk}l~+1?d)P0Rai=klr`w z^FGg8W39FS|FQPLeor{?NF6%nyubJLxvuLc9lI~ZJzIwTnY5aa52bwfd}1=B`hCGmGg^eak)G?M5BdpG? zC)8>@w9Z$lEMMKZFd)*#98o@h)N!#q{c3c#DBZ5)&g1U4LRk+3^vwjXU%B)RgR)g^ zfYje0qHbav#b#-AVy`2pB3S3Up+X24*csqAi0}S%98FPGc$lBw4ZK}84F(+ z+@Vz{1U~?h7PIaWFjIg_qwyjd*5q3IcRH6xLQBenNJl^V4?R%YIVLlFi9fK#lnOb0)yeGxO|`La zDlxLmUOzP2thOT9lVg_dVz$%0W4UzsGv3K4hsJcBZ|T&VhqjgV6JOEFt+v$jRSB1I z>jIl>cg;UIMEH=TIu&2I%D|YJwj56#HYj$lG@bb{wud-zLt0DD`^c7kzg2~W|K%Fj zv!4WkUp;VS5*Eh`=3!RvKlQ8!&y6ZHS$(qi>#+J%VY5ier}yV^yW3b3!U|=g}=R* zh3#>@A3X2-%BU-{lmWZh!hCwpy;rlnQfDTp(HpD=4K7R zNruZ~?gfA=$?!{9-CU(0I2qb+?1G$RI19~7?NGuak|beOCr4$ntkew2>^BT7reHQ1 zev4?h;=uz0N!m@h7l~Jape&Lan7@WoU}ilB4_`w9rwow%8qS813#8i^kdS`VsEvUh zo!zWsDuSw83cf0s)Cdn$q(*eR5H}#tS9?|^3#=+E#+!9aJs6F&k=t`J{ECq+^fB%6 zU17EFZ6TX`Z|LQ$xFY9@=$>8C)nO#rxT9C%ef6eJVF?bM*j1XW3qrAv6T&^?5@-p_ zy>^I4%cX4U4Tx8)FUIP|>R+l|`6?067De}AnXhH)T&#$hxS{6P&z|8*#Q0M5PxLdO z)`uLD4z0^+Om;Q>+w-0usJLqn)_X|5R^UCz9DV(qIe$0w%FPE#E~XDN)Y~UrZ(Vib z6yWIIemRA1+SWjNCob&!1bSfYw1LRZLB#=aqr(pS8LR0uJ>U79C4@-kc# zLzv!$ScU(Xk$1~i277JJ&6AtX4md@ytk7)wh~lM-(0{cZ86qaqmCJz5g8d{&U>>&vEZR$G!jk-4o^8%?>Li=cT@ro?TT{l?~1((i#2I246VKuZUHj-43CY(dP!& zGmr3(r2nEp{x3bkSf?Ig2FwZcFOe{m7ym61mii}=Fzla1!qQ%MPesDRe}r6iC-07l ziR@{6Ff>_Ob{lw-!E8i#23{P?{9zXE!{vFvpHZdivUBOoEX)CGow750ttoI>!-HEe zw70zI_@VrZhSV1db8X9j>xmBelad^Eck8;4i#4{TGHqb)jUtb1c&}Fb3x(wp{ zz6{#`^)fj6Z*|2;^zVT8zmOCYmh0?{vI~6z6X#4@?qWITJxC2oY83XZuzyUFtWGCvqtl|POxbsvW0|s&{2>?Ey=`sIVRHTcyAwU=LxTK0Nn&Q6X?%Fkpuq(sOox!?);>M>%pOsW9}|2 zf98#K$i>ZChlJ^F4#!buN-7kWdraXG9j;fe*w(ywntgd;x7kGC_RqcG1Okf~6UE}= z32cRVk`sFFVWeNVh?dWnhBcxuT{CW^vX4I>Hyr9fh zvd?E#qIQm-R5${2b0!KPkO(J0pJ^(uMMIiOp%vFEpEO+bfb|PEq zhqwu*jL}8A19Xp=S(wxzqowhmM$4AJ87*n$V=GzSD;@y8W*TwRznLxHQkdycEsuv(R7#tY?6f;>r)n|g5JkR=|CXddlw@jS? zTp8CFXtvPMqUVSi0<2j3|7vQI`~DYGQ)IHr>R%&0m7%U2|7dEG&QEIdWAov4J4`X@ zF0MSN-*qw#@LMZNT;VC))lLxQq%oT6XJ0!geUx&vPJR~Yx%E5Jqj*;7IWs#kSbT^~ zzjvvArV1ZU7DF(R{3D|}9R72P{Yejhoux;{O8^o*OQ^rB@lMX{xfsdr&ax5ZOkU>6 z1YIk%T<2q(lGP@XPdt+W#wsm0X}p^#-D8FK%x}d;FKDJ=13@hqOeg#CO=QNqILGOo zBr?eS`1iyNRmqF2cSl2+=`JYD@m;IMAa7 z)215V3XNU5rB!|bBPNvO8lJ^5UN{p_Sc8I_Qf){A63reLr`t56X>WJsRr!wq(*PAE zc%lu%$IL1M_u7zb<-{rQXiU&!fT98>ClKdT{}VVXAe{hZA6yip6AYK3)S{gj=Ko_p zQ3(Bth?D7^N&b)d1pLQ*@*nfb|3Azp%y?im|3mrhI8da9cy_@KdTUyvxAAGL_2SBx z$Ed7&t73c_Bj#_b<~a<{Z$nIZGDyybBIV(>a5&w&NrrMRlAg))szK_SpVL0jn~3N= z{J@-a3oK`&7<6l%S==WIxjv|J-jm5{R#%paPNNXLz1kFDpzqN4Mx?jUv5%riVSd3e zPq904=f^XDy5P#3((XFvKT^5sWwVq-FyyfmlG#{#r5YD$g4;PLT5#PC z!Z-tRP(t_-77$l%$ZrGQ=b%)$Y$DD`aMW77XdnxXOjEw{^pd`Lm6XdHwi~3!0l&!b zdF}QBMj)Dtk|y1FyTSa-btvY$eoq`7tqXXPixN?P6BUAdK71S)$CtfXks<;#+^^j* z;ERcTeIZ33SkY^=1gM>(9UZ?QAh8=$@TenH%(@5lh<%$r%5QF@`{ldAO0zVgMa2AT zoDKt7U!cLtfJ8g`Pp!_CR~+|+&5`k3)$ffhb+LPu_{Yn`vA?}M{Nvr>|$bNeH()rPea~+sR$CXX7!>9#P?IGJ56R z^|Q_H=qX7)_kS|a5LureO*ZR+IVeKvnR3Sq2q>KA$0Bg3v9ataTK#!ud3*Z3`}&mV z?OspNZcD=j0^8yDF^}v)01HB#`-q`wORU{7?Rd-7V(%&6S>gBEY2jCRFJSBM3cpJr zJdTEuI^k4SiyLznAJx9lh3O$zY8Yu=1e)V$1n{%I9t}HI!7BkdH5`H0RJgDH;eH!n z+C_4Ld`<>@kjIKh#&9cFXG6$f0?$QyK_<4jiLyaFCY9K243PwK__L13-q{r7KLrUG z$B#MB1+vzIu0{ISm|nr)-V(hEp0oHojI#6-s9%DrW_cYnWFYQONa&?E5>BG=^+DzF0X5zm9L!OqS+~6CG5(5h7k?=w8)3s%4T!?fIorTfjl+}&= z$OI(gRJ7>K(b1SacSm{I;RU%8>8$!y+4YawLCtrIvqon=2;C6y=8M0c`5F8UCw~3A zaAJM_StTX!tdi3G50wb)03i9qg?VJ#U9Z zqA3!cDLmQVo7X@oMcc$0qM2`DpivSUrP`gQq@*!Tia_a8x(nbwF+B}y&aF~HLFcn?!5bo;kdacGZqq*SGvv`q8l!$;j04Y*ZK6#G&THY&`(v(NqG^Z{!CS z3^LW@QeRePtDK`;AaTz-{?)76t4|Q`nD((u!sxd>%B`N+bU-_799Q1isp3Vuw#k3W z={%tS%oE=T^M5;{G1I|1u4H7!`;Hw9OhZCDIk(E|b%h>IM8hLb;@kTMfalUWv7#+p zr0yfCTxt;(gF#^kv6`1p1R)dfyop*E`nWp`Xvotmm2)h^3@|8tx*j1%`i$7^orBX7 z@h=(TjMqciWNJ>M#kG=Y7IRJT*HuyP)fFg3`eg3L)=|nRf zSKP}34qzVvqow!@Ga1$^e#%UO<%TbEyB%0KjO?PohTSg?zC%q2jFRaIfUy7_KEZBZ0S2kN-slfz@Opq2hBE}Ql6+^Z zBuqDg?t8K}PK#W=_1H<_@3iAd?pfLqtaZ{0QkVS^c2ws*&}^d4w=lXs&JCV0BZYy$ zA$>aYGE{mj`CWQ6`Ag}M^6yKJkg@L1#AD0J9?B_690LAu)()3Xfj=oAD1(5>o|?S= z;QP+i=IuQF3*RSu%J=u{@n2D`iSNE1+&8!_TlY+r6xuKlo`n`J7 zG|RoceC|m`k}in=IOrz_7u6oy(U;#1dhjt# zFq(q)yoY6x0sAMsn4A~}=kTEf=58-gWJp6pgxYxNBLCDgJL#&oGayQUX_9H!4U{ko zOvmE;V;WmgS0007K1O;HE&3g4LJB|9WbuuHuL-dGn5^Hy z)GiE06g51^2hFhApc!^}`AsSWBSv}aBAgHl*qG3S0J9Z%FeZ8in53iLV|qCNFM3o8 zAVV?GVEHFM023LgaFc5bKVjZoyI!Q5pWAl$3yW)yd)#!S4`cEi)yZ9$hN{e`>-*+# z#m>OT`zecG3|1?59N`XeGps1V{ zNpw0ky>~V?-3kRO(QsA}Ye56$#!sF7bmg5EG>RBxO}x>yJH=`mKX2DnQ%pXz1ZYv@ zGjstoSKPSS%Iv~EQ(-ahm3AE8dcnXx+Ld@eNi6G&cZ9EWEe?d z=h+jvTBi(pBSWn1qe!EmPsPFRoD%EQra9?Fsmy*b6jFeL%Z(71!{rw*?t;dSBt$){K zrP3ZS%!=r^djDNS!=<$7?GX2m%7{;<#w}Dkm=Lr_@^{eQ_Z|q^!#$<;oT-56YdU7M zVT6!oiiwuYNYS$al@?@+0i(@D_dBB3LQnC%+O#Q)s<${;au=riRWvH--#)+5{ym>* z>}K!7fUjSyabg)+h94rZ_A@B=R>thLKh-(l(PW@=a$Pj_NB zA3bZs3N3r4Z_|VMv>dN9i3V5q;@AAmx4EQ+kKTO~wD;rm`N3+I?NQ?3CgnIg%%L#9 z-j>=HM)vu((Hj#5Yb(=^-^kwQohJk_iBAJAK*-*TSZ5EB2oKwpc}n5MC~x!|>#gg( zX|ie6ewAe2Tw7zPE0PPiX`okgu;!;_WHOmw6HQi)H$raUycf zc=>{~KnnB3>cf^w1lq4YVRCx^nq2(94~Pez1;mrj0^(2q8W0zrEE``_pWqbv9T4Am z{I`HO1<$dO&JB}AZGn7kr^CkEWH2F0Y10kWnJrvyOdq*lpr zcHC%_qcf6^;7^jTobHU|Tbf}vnPN0N4urOs`4q9`ZkP4QK9_!M& zIY)VyU1H14WxQo)GMZv%hhFB^i!1b0zOQe-TIN5+8=}J~CLoPfw)u1XsYX(%oPeC} zHxiZmb8!Waf5?2S`7WowHThMd{+))I1VwtS9Ao}y-mABqS0ftnt=$_4*l2<;vIZ7k z7b3T%pCxY{oq1?3oH(kL-Zmc}?14CVXRQ;bQ~e>QkhX=HY2!)29kxY(FCJABr|S^v zH@YzV+We)tC(djVxR(fLpkC}<8!uCg^u4hvDNv1!s@@k>oACrGiEuch3?d5j_sxn1 zlu%h>bPJ|2COv7)5YEQKC9~pdUF-3V38$3@E$j?5tnf3SuViy@`DR$jP!Q?TFQ5-H zZ~Y1MDFU@0v~WPhf^bB8|52Zv82+k@zfMh+vPIx7Hdt+PR-g6x`tRzqkFox!&yN1C z&(4xoN!zHJeCAJ=o5AV+#@;9O*DYi|w1qsa(*6TbXY@ZO>Mppr`~D+Q_qUvF`WaB? z`0X@j3#yXf4A|o2?VKP84dcWV&H#BuC}H&6ZFObio;CdJ&N3A$P9HxJX&j@vzoy`v;RZJI$~lhm{IGBx~q=T@HI;i^8}^?9Ph)q0AUG=ob)Qy)|e6aD8{)c zbEEHCJ>V`u!7*)lfTj9aDTbVk%vBN0j+veDZ*vcOzPG8Q-ytem# zm3fVcxZ|-(gdJ`k=fBr-2iF3jK2feO40$0g)?-u;^^DQ%GhUCqvOSs5{9e}8%U@eK zo;*0nJjW4pm;{!6Vab@=f*|B6Oa<@bc%q5gzy**y2@?QB)X)>6)i(qa^c`&=6`qEP zE&(@YQP)6^G%YufpV#gbi6FUk((Z`A+sUFYj9g?`VwBh z)JJ+o#}CVlA<&yME~0d1H~APSC!X?*j)q6ATUveP<)SUsBVqPVYT8X_!9Ck!dy2Hw z&S2J6DvcV)4U7r8_ixiPZF)t41|9?5`8XCncVgvn13lo3$H1>Nt!gJ$j((cX6MRw8 z_NuB`E&*qNK~@{$%QdTF75!)G6n8!*-EEghqNf~^3vr0vCCG%mR*&p*LMI9HqOVSgdbfj`M}Ma+-N~^-^b*)>tM#_~Pd25nf;vBx-6#Y+z9O z-A-l}gZ%U3`zs?1k_$U0zY>G0qu)&=)^AJJm0L8&FwEb&ns!InH^Szhbf|l)>?JfJ zF(W=SoN#hV=92I|svFm=^z`)jtWt?36DdrZFlAq*K#%#?HK50Q@h+65x205s`4jzF zDTl{3u=`R0nQ{-3p;SfVbw*myg^eP`R@bSySkuuvw2Xk9`%pfT<@)Jwzfj%V@mtB(v#SqJcAqnGVaf zC1pjy9g78H@0%bdf)-f z;W^G=67h`-xR+f*Iz)_jTgH1!&gD`|rR@xfRTKfRPUKaf{w*!didv8wGg z@pTK{vBR?EyQXcjk=G(ll;zO#lcv6$5p5%g4x)CKckr2;eNXAS&7=D4c^fawt)-G> z0v>U)ImIoep;$#l_oRSF-xnUe@}@c6HxhzkOvx)8+v3^T3TdwK0I`2xtuZeDK$Js;| z`t*S&x|M&K=pH@FE-LS934$iNmH?0KST)+kMoRZ zihcWQ+OX44Cbo@S4NW(bY*y%lDFIW4{^^gp6;I=|hckg2l#PlTW~F9Da@0%`Cgl+#||R4W3c+LY4r1DZBEV=o`yxSWA+^PL-_& zI=wkzi`(CBpC@+Zr~xVKC=^?!&O_yJbf)WgUt2Xh@4eg4qv8^JpTBv0u$f+g^By! zO%l-VzZ#rSgUK8Pd|aTO_i-Vd052$`k1tNO1~fR)!|>^9i&MI~o4No7K9uEFDS}g= zzf>8|-J0DP^I$JvIru_)w)mA0dW;J#e)Hcvpia->xUICX%X0PfR8{E`IeGP_gbw#U zD>rnix{?yYlATllovKRp8O}~sHcTh4p;OgG3gKPoRHX-k)&WsSX*{ z8;sixSE@t4 z);NUK!v9FS-8<^u^QA8_w!2q>T_cqU=HMJyzea0_v;X3JMI`7YLO}nI^_+kL3zCNJ zVV>TpLsKKEIw*nvbLtfN5${L3WtEcvaE}FA%-lZ@dfjR1FnWPJ8x5S&oOLcrv^g+s zvF(C7byf$;lDr=n?;x1q!duM1&@lM`5h>iC} zrxsUt^taqVzcX(TJ%rI^ELPRm9jNUpMJkW)Z{svAsL5uSG%i+0KSYx?=e^sSb4F(g z-G7Db_w)QouN@dIdFfm=H9>?GvLT`JoRc-y;fy8I;ppBz``3;^cCUeDhPf zu_3jkY9!oSc=#*%t9uidzblcLej7H&8XYLcmeS%Msp1S>HTUQmgM1}9H1EQuqveds zb2yL^7}pCn1q3AdeqxQan6(-8S11{!akGVFMK!2=;STyJsUTZ?tMuE8pqdGW$16Em zt>iD}kBc4{Q8tcxIWWvhs66fMK78q)h(-TRd;8W#P!LGeVqyVdTC}*>D6Or_kVTFe zMcFJG@c3qG62gbP=}_GMJA~V?;4E)aRQR{9Lr?2#k9uGl^9a${5FpWm zQpZ>X>+LXkj5?6aNY4bPc=VGorTQk#I+>h<8HL=>R$`pMdPcn`v;?<6(mj|ehaXnOj7lGs#Pp*aF%M0_ zy?zuA6Mr=AXiS-8ZnK4fkgZqULg|<0oHpz{DM1&NO8cy@J72&{C73KY=tnU_u2Iwg ziWBm{HDEKUVeXv+0yDINKn{nI8b{9PrVKwY#9=hXum%c)P#rM%1uYH!dI;asH~c-_ zr_CifjQe2m1+5|)WjeO_fERJ%#)&v->)xyTVK#Ad_?TL+YzVa<8t6Y+G?>R}&iC!6 zzS<#dWUT2d&m<=f<(bC*%rmX-{3XvMssg0FcjhQhvfJ9=6)QJmTH2p4arqx<#;?j$ zT`B(L=3-uD^Ko>K=tDqj&IzE$W2CyeORMxlP%eXbWkmis>~-W_ie?W8q|8{is883t z|C9h%>6|**n{iZI+1{FHhDb`lwW0A+BWdG_zJuu%vc_)}&!^&Xz6v^8OppSCKw3C; zeZ$3!iJ4Zl0QP~wk+xx#W-a_WpBp(Xh&C2un9N8M12BeTX1#&g*z#L>K0stWU4iqFy$@; zj@@l`_^bhfw&2YWxu~@b*JSc$T*oLdOjR-OWnQ*rsq<#ds1|0o#oYdyY>?C^&6#u$ zeAtFwyc+j_i#u>`!GFdfGnel|IAo}smXo~A-TWgWRijsM<+j%o&LlS*f@kSLr3M0p zFHVFOum9Kyz*h|f4Mr$P@u#OmS6l~_Q6Kb^Y=4#{N&v_KhZhosv z(Ip}zqWQpTaOn2-b=^Rw>8;F(pRcMJ`R=eiYWNn}yg>X#lHT87Si(_3qmjUav~3%s zLstAc5m){GkGZb6M^qC|>ATBbG~MVhM`7=>`KHZ+C5^KsEH|`-eV7V*^Pn0A#9R`i zrJybBE{*aR2fFe<@Jp$`;+IfpH|#fl$^9pO`9tIX5`KyIo4*9c=1esI+w5h=8GE_( z_w1$2e}lao#J;Ki8u~GT-864HBCUWXv21xw9xc2f1&VTDuq&Ay?PAn#t@78zlt;5I zzG|}aMR~eY=7yv2#)TafeD=-tUiUpP;6QX(y7(wV<~(WCZfp|R)Br2M;e*5P6# z;^|c1uYW0{!R5h2(y4(4*`2{6;wij$&brUA(uD0a0@QID0q#ZuHRFVHF4zb zX(<*=gbk8vKZIho z|2>LX@NZE}XX1y}pZvY}Hk9VJu-Ug16){KW?T3^O*O*Qht!MW)&L-SvXZN=szwU30 zTS2Q|k~qK3va(Ow^?dki|O{NJ^y|&`9h2~FtVrNB(PGO(qLQdMtiG3t|S_6 zbZ2#ZaLwx}a-9T+a1Jd@Vw*>p=__7%mlq}O5Lh?0N?y>%&Jr~kl;$PX9#Io__Rx62 zhI!4Xc2FnE^_JcC`7}L-S4ph`P3x=KBX36{GQV(3hxfCk*k8$uJtuRjEwcF{i?i%H z+M#ypEh3Sj7j2x(p-sq}7%3lrR&YH|#O0!8#gC7~EM`98)13OoA*kLs4lZ{dfk|}< zo~==jE|%I#I)${*_{Fz@#h^{?3U+<9bETkix3zA*m(>0J-@`>w~G9dhu&CG$=`$E3cb@~}3jnS_Y|+iwU2ApQy?2j5cR zrWg-_QW`u5JdtEV0n&81BUBCcPKR^hlJhgOp4b4W!AA!PDZh@;DPSIw0dFN55ey9= zp8=-_Q72R|5Oo#8pThF!Ad4M;v=g-)q)X}MMLhW(TjqfN#u!s+B*3;3au{P9bSooS z(YIR(8FKh}PIJp*>cYJtRrAU^yGn7*$$75mRoU@zyL=uJE=8x3cd}zX!O^aPSHy?* zbwlLF$4fhK9uS(hUq6XU*En+64JgREDWV*yK8|F^ed@dJ()%F0tS-%vAd>y%0kcLr z#fP>iK6P)qgv!Gcm*}UZQEaPeJ9*a3yxx45ce_5+q^sf_B}~G=aI$dK&pI-d>+%BW zvW-I0=LFTVswrs3LG?B2AwrOc!vMq32On`5nDOJ-l;dmeezE{-I1IuJzP5Q;7asL3 zD%+dk)@1V-UM_136puKK`Un+K)ol$NFHmj#Sw!Uv+C43z zo<~7N)Cyix{l!tapmn(16waU%H_OQHJD=`Soq3+r2G6EX`NbN@F(+J8;6Avrfc(fi zm?3!Pn1lUx%qgBZ<`kmW44NNhS93jwL5?}ezewhEpJ6EFz4Z~lKpQm$N#>AyNi?|x zNavKN3$M&Sl8Ku?tW)l*x)B}T2XXrCw)a5~2OZ7z0qZ0-Hm{nX2JcN?=B~t+2}I&@?LZ7(OiAry@R~ZK$Yv~_F30}VyFo> z)sd$Oyn?KDN?GZmyQ7nhS~SXuOyTKi0-s+-UCu3>C0S+_HcaClW;|ran=f1s;5Wla?z(a7tw$!i;zkmD zK1`^-7@>MvoqbgnJ3(0a>O()OO5?ZeZvws*=)yNva_RtM#!{C)fa;ZY?SjtsJzBR76B zTHBOA!W8PT?0A5YQxIr}7k8hm;6a1-6gpZXS0hS*DyFp1gE z=*u!+7|nd9wLiFo3_qnhBDGY%-^s4UxpnjClqDKF+&XbMZsbXNtEOaso_wy?7XL_n zr+aC~jh9hKU%NgHw$D;k^=do;eR6=6a5wNZ9`)W(L1>iI(UVC@EISJks(1R26uqV<;ro8 zncHus_@xIU8-o;eeq_S7SWeld)?sU`s23iC_-NJb6$2gOtM3WLzFoQXzP}$!w3LlK zlEpi@SK1kSrT?a>oEztC9Z{h)=HKuqaFu{T62Gg2_3W$&f(aN@XiCqteaKIPh+3i- z1F4K*+VZ=yO2Fw3$`B|LGKgaZ>6C+BJd`LXCS;(8?zo+V4E#iBF&XcJZj^2qwKz7o z(MwAUtF_7qH2!c?VjZKTz>c_lVSrZW3*E^CV7ktL0FNvYTmZ`o1p}3q2qy3;hk*pB zTA`pzmnEVZIK@#B1E9e`gUR{~6lg&1hw=zLlIL)AYoJ5axaM8vfb994)6UCK{aNRQ zYZ>ail-_24Z>t1#UUc)yTXio|-5)BZtz~l7{9AT-b7qjq&EaADE1uNq=v1PsUCS-s zbFdDa9^*zn3F#ruGk;kmkl>hY9(H9YwBX)TU!wX%wv%7*75Z=VRm>msl{8-cB1L+r zR0STW*=-`Eu&FAqUr-noyX?iIBwBF5X-nfXRTavvR_7cVx!L&u}#`EvXB zeQ-j!B2W*ylY2ON$v*MmL`iwRdO`Iu0r!s03MN|?)!mtI&i{PH8eTcOVhMq7l8D<_ z=Dp!yJqpInI%L#}tutoJnHSTy7PcrsOE2h%>)PcQj4_dE3OekthCVqimDjuLCs zS9w_MOd@4rC1lA}q7=#dR;oQ-T~qsQHJGZVqi2;*kgyCXBB-v4zp1UnwRy#`LPp?d zI)3`2s7w2!@B+4R_v`CN;0-ZC2h;sE_(_b=g+7e0lOQhrpI@R_|67+RpveZ=KujjR zG7jFTY7F9^VP#=wlDPC!NgOwC?HN{fE3@St6RNH`$~--ktikcQZ(1DQniXHeDAYmy z*>dX%Y98|t%A$sdHw<>pbf;3!wb)12(Ca-{xo1t{J!KSlHIZ#f9nX8kAxQt{n_No` zPvc=eSEYMBI%{4Xf#8lj125pDr)S4~wGweoM9^bUfp#)#7jSzIaSMYTm{mY5 zS_AU<`{p;PCidtud!jhGdpH*DHdp#wo>j)61PUy_7(6-nl@ zaekyen(h7^PhPO>yIA-9NVTsx_C0LifsJuln{FKSfqK#CdEUOqEyf0dd>NR7^gE)Q z&6c?iAs-T>b-+D&6bjUmBW~j?JrqY90Tcz|DR`iOq96%WwcuhEpx9|MFS`CR43K|^ za}j{U={K8q-2BlOL3SjR#PtW=kx-KR<#)Isja-M~^zQTDF%Y(2F%VP?kdC4g0X38e z3XI24e;S1ZvD!>3K$Hr>jCsrhx~t(xP{oZ@2lsTCaDjXcToiO2ArdJ!?&Y=$Hrf1e z&5(6yx&2V>aS%IL=Rqbx-vnRsA_Xu=%Nu!-8W9vOq@#g}}o*D^TPD zCPP{d%pDHkyo6N4lzjqB1(C|ozt>DbWCgxw>MzY6aJ~XvazwA9lx*;5%O!7LYdN`n zwWWT;rOwGCwp_0a{XF`|wtrpf^pu;ut6g9$VdZCP%9H0}<%JjxYpc86#QRLhU2XAP zpQY?mF<-UJQIwV8&G)O1r^8%``&h%0Yxh3XXBTha=2yqeuHT#}nH9b1Q zY@Sw&y*y$5&JzD@eFByJ#^&&glTFmvYhML&dCF&Zcm0bUWIaPT)$dOCxw`$J2?OO@ zbrn*V1tc8JDy%Rb1&_w=V*PE3>+w%hTz-MjtldXK+SBJc4z~-gHBysK4lX9xWv!2D<7>Vb->;pi9H%eiiOd`|mLLi!`)?^q3L zSqX1!CoF}q0-5J^BYHh(zrNXapGm;qHt{k9_ioct5jDP+?dxCLsMCs7fg)-V(5vFg z^x`4on1%E8?YsKZqxotdb8#79HHXpM@ALMXJWyIup;e#WRFyq)G@$0MM!m30H@dw= zltli)vfbsUeOs(*s${58{L7U~X2}BicO%5oqU}lwa+F0zIf6b=Hw#ARh7YzI-sE1m zerEn_J~jU}pPK(HAoE{$EZH%7G>dH{RwI(oOpWboxs8rQD)gG<%m(<^T?=FbB+~T?<=@kXnGk)*{{IDi z2>U;y4>?ci!}^(51Mq)AA6DYpOfu;BgcIazGhi(j_j&UFgGP`TedZC|Oh^6l2ns?T zK}iXZ#Q4K#WkZ(=i!N9JuAI^rm_%Eah5$n5aeb4=N}mi*`<)TXx>v_>PNR-{Y^zlC zO9L3bd&c&A(v?nkso!Hh#c@7QbAo_0g4>+5Ls{b9^L#G||Dq9WKGg^s^=KD1O`xCN z_c~Y79YXoEt-!mw(uEEAeAj3}#v}RT=49$`P06P>pTBBkqgAn7mT|>Js;Wf(SA?Rdj~?Y+QJ)xbpEZeCF^!&N#bLp_muG_y zNkEY_4eT0cTd_J$b{uz2NN?F9?IWE4Le}I7Y&(mrB6Uvc$NSw=+V5%?lT|R^pYZ(M z*u5^3JATzLE#!R&2H*5b-qbl%KX@HWLyuMPJs$|zOgN5XRIZ+Leszt-*Bp-Ahy2Q8Y;@lR_Sv}Ke89M`*0!R({>ctY-$=5F^!#`O zXE*cq+>*XjuMu;2O-W-8*)%uDr3LCO`)s#*q)8kxGghN;d;#A19HtU_p&X{oed4(A zvBe9`@@=H(P2AASB@qh_`2E#9)zSO?Pec9%DcSsIHR4~8l1yPa^Zx)!a{pWP;H{_Q zbQ@;LL7w3fGL7et6kj&%NQ}CY%XxkhRF*a*VBeB*3@pSjJ6ncT!z+DI-kA7D(^6&D z1dkuLwu&415KpelB*~S}x|ldYgR#sPvrzy8lb(}+PWxwM>%nF+st@co&~lOKZsxNw z^WS}hJ!oab5*Q^91RJ3^te&Vw`}-)de)X{l$~OTGeR@u!)Ru^$n_ie%)K@aCg@W%L zR%eT4mwn^hA<+2tPL*R+lbcOG?9-u+Hhq}}hR3*=Fr~prPl#fevijOCSF=@4`HqA5 zRF3u>!*x1G4`(b@1JkreZPEHOS01nh1|kVN+_Xsuk9K~G5YPWIAugv2f$m0HZR&!A z3CQPpZBdVVPtya1T8qJ?437J+u?m+`*gb-bmg^Z-AaX!&u9It4_z0MmO~YL?D@K^x7+E}A=E z80As}Kbg+uDQ`S>H18PO85XynTuD2!7p(y6`&8_p(3)0)p1RX#I8KZgJ!HmNTiNhh z8YudmoF9^V>?sVq7wP%`hYLK|?*(3$%A zH@fxpQ*^(ZEZMD8wTH0Ee?QH;{ja8ZXuzNkbHfM+Nn5liaQqNX4BED62>`VloDnSQ z!^AKw0Fwa>L6Xn?aFsduKw-?_nSl2PfSyC0`X!U*PzsoGm%-E=N(3Vk$Q~o5ro=TUfp|Kg^SPvUKq z+3>K9tE=ih`@@RsKWbjzv^$NGc#zF&^loNPeZIX{#cd)wW+MN7+@*2n8vB<-8#7Xz z$b+|h!!l7|oMuj@?FbqwT0=v{hmrI#3HZ-z{v0Z{PkRxbE)|>n6+QVJ3BfTP^f-47 z@Y5sdFk(Qh3UUm?4aBP=IiY9a8*rqt_<@-J^(wn}MK83cuNgFC3RA%rCl*>?*336U zJ&pqVD_W;B#!TLf-Aj(_zh{h((v#kRB{LK=XvRh`U{Hb?Yy=CoLte=cAjCmfpo8YR zE`BMEX*<((Zg(fue$` z@EY|TEm}Zy{I(c&Fm9c&H=}95dgu>$N20u75YY;KRQsheN7(^^3wMit;fb%$@I=8hyRa>+NLLXo^eEz4c@Svy<>O`{KSy1pc)=Bb5r)rVYiyW#!o3 zUjH$nLCclrS-Z2Y``#Zc9_`|(Rip@eQHf-KAYFzlJWCt4)yUgH51jstdMe{;<&;r2 z20didG2h~tQ=QKpR1z<`-0A;T);_e==ts#u*-`)2T1&ZH0%(xbN zk{cV{cRq;M25H8{78167m~uS_OV8!q>y0Q2V|)kw_6k%4H!ScXxWV^}dyh1hq4$dIX*C}aP*9Lo5p7IlzG?i8hKjJH zSadEY#`wp>fk?O3r-NoPH=F6d+#{H|kKI})v2uZ;v=al>qUG)HD@grB?o+LTTwJ1X z;GtCBQjFe&jE&FIeZ}tO3i90fpTj+BjrKQtM9@6QDl~zxpJB+NG3!Fq1DO(e4X(t2 zv|uiS4pD4=8Q=%P0)>R&P6PcQ2(L1xXcNIHM1PI*)KQ0wrb{)4Hi=~umSYyyQ0ZwN93 z=L@GSwwOE7lo_A%KHQ~&JsQz^Ql-_!CGf7?z`suX^S+t$6N@kv?T$aA-0X@_lv_ed z>weBq33q|HLv@iYdl1|sV*2{~SH>ArI${HRhOzwT{WFYT@#d6Rx|Zd3#gs@H(YrEw zcbAUOSgSGHuqO88G~C4b%vGr8Q<_x9{|G(eD0@zNcRiJ}Li!hwXpW{n$oXRO@tA7| zP#s*VNa}Og-1<>1Ry{irVMm)N?X5SNeBWA5*#z+g-7XxvtpE5@{X`F!Uy7e>Wmcd} z(yl~Z6EVSU23Y)I4ragu@@9N8?9bp6;$XJxp`XXK2SU@bj!U?bORGHC>s2+D*~oNuRj!@ zU24&uwdE!Y4_#IBJR)74idWP>*S5yp(t;R8+SE2G0!A;XVTe)GEW+-#6}D+>pbGyB zquAiAzUk$1&r;!9#wpMu;gERi@qrOBlrNctCb_b0vB>*g?Qa5NXI)4wa=PME%%#tVm zHt}*zU3@s~*cKZQ06pvHnkG?ey3iNB^EPd)>{qMHoY%N}*9O1p-KWY|^5I(#<+a|0 z;9zr7aV#C*8%JHw<|$Wq#?zMV+^zo_E$p#A!%dY?mguQ}$)cjq2EC~Jy7)us@K$?Xc`A#-C%P-VkaJcnfVvZ}lO!9)>Fh3Le;~UIb6;eplrxO=nv4lSPa>WIaCgBLF z`ui-*qEdV=>FAixX@PYmA~SCmz3A8$C!VgqeKQdIgtE#aJX2jWAdQB&v=`{^zgWcG1&93iW|c@sCBkn{KL0d^X!y zwO_W0I$U!S8-Bh<%XlX;>Vu1Jw^p&yISP46duX=$<4|rD!#pmZEAg-JJU$eYt&K&+ z6XvS;8FJgmhCkmZVk^z_92+Pa=ECHxKM2rl20V?$-Q69EG)OlCh;-MDpp=v#DcvAQ zcPS}|fOJa3JMiT1AA9fjhS+~Xbj-bT=G55)F57S%30 z&YwQEx6l@GkXw|ez6MYD^%j){%ktgDrV@;Dd5)6a@yQ zWMltrl15tElU*Yz-@LcpaU|WM4{k(dDOACY!-v+1+vjeL562ac|FU!QU$=SH>L8JQ zu$g?Ba$;t+Q1#I;)qS8U(}Ni{+Y!x6?9;8h7&S~Z({pzEEuf{Xts$_SCOGTrY!Bvp zbVbm9L>stXiZT+mb!q}E216ggRI^*!M+;k+CYYJbG6mFc72tvZp<4qvH)*At`{8(z z*q>q;mUklNK>YfLOu#;aC71- zdUZw91bCiP6CkbCW&q~?MC34}siXX>y~z~L+*a0HDWk=r?J*61TSa2cY2`L+=tTKx zz3~05Ram!V-S)(&G_z#N)jgAcAmI6C6o z{Q;@DfoQxa2T}Bs>Q%y0T4TCB?%OxGYlisC=c}UKI_Jwxks3<<3bC+bJ*|;V#UF_{ zPxRGu3MMsz&XdXJsF`*{?KEihXl-)y*f^V+#fvp(%`~i}C9AC41RS-YAA8LV>?2)X z+WC*;A|_HY>_$_|UlXMG1^*H)y2bQj0k#ixbO~KWX|3v}j7_k=R4Pm<)9$~n(DYIh z@p~@6t9QF;nvQ=kcgA4R91#?1T0VnYDc)nO_=4QW1p1P$`77MQ;sOe$;wPJs`Nkz& z9P%RB)Sd6%!(t8hu+W#8yeaAmYM~|`+)C@D{habvnKvw;BdBI9%+1SfMz;fH@?bL>Jo2tQomvi5Gw#Ch2>ZuuR0Tu(+dQ)^bewZ&EEC+ zY!~)aL9NhX8mF=bq8Vj5ntJ_s9>0X)gZv*xl~I0nik4(Ch~xt{&BPo|fv5ho_VtO`GlVXHPJ4UcBLCQ``FmYr zmv+rk+DqsYjeQi{->Vd1F^}PE-Ff(0H@vu=a2bcv|MuTEDA>%cL`MAS4aoj0PAk*k zmO&Mk(v zG=T_d{m~=|a~xQ2UHhR_;pFwR)!ne#F>2ajtdXV4DGJ8EH!fp*s428PLV18+@JQF* z@I^}T_q~Dlqm#e7K$mnkF+1EZ0MW50I5RJpb?IpMXdcwPxbcuXU!WVKu+|Kka}CT$ zg0ZDZFS3}nNILqRK#S?0(k6AdCATg6L9G(AbVO`8_120naL&XQtoI_yTtX@{(FYyM z1__I6f)ijrN6u%A3WzP9@BGO~^E@18*FEF(|CG9z{27QJMN-Y9!QX-Sv!rg$oQ zMS=Hw;#Wt%X_25-kTHABAiQ-xU{8qN*= zyv-`P;^-e=HAXs~(@CP9eSF|b+2~2T#-hx)v2@j1KX~(Yto!t}m!!q};m1XKLS}ort%OUQp#Xp`fx~E`CyqQY)d4|FlK@S^2G~K2}WX zrq<6b?e1+Auf~FIN@gMH z{M=0*n2LbyR2H1r#G0^uiE$&+E`b?#W;743xV&xsJkGb zR?|R*e*0Wu2e8Ma3H4g5-W``tww%S-{G(adGP_e5?WuoIy;-N-R(jzu<%D&?@(X06 z7KV&XZ<|0<$c88TP`V}#=A!>naVkgHMYCupWSGE1kcKz(`(`g`d`(WnGYQwUve4N> z#OtZ~+ZN_fd0YT>=*xiEr3IcuJGlm#y71fB3w}Fy<_`?08KSR#^^4knjhA>BUfraL z^2sky-(e2AJ}afBkO)^7xuh?lM<(tyYoFPVF!zXe6nj}|hjZ}>!?+dIMYKvgC%EPi z36hgC@!B$`pJ#PdLs8tmq!eXy|FD@cjr-DkTo7^r21&k8LptoU1~FQUj|Jk(q*GSu zYoPv6CUs@a+x`D}iit4>>lJFm>*ZP#b9O%ZWKIRnJA znR%%NM{~9+^y1SL|M)w33}%J7u&L2B+i` z1zdq{%XLh|9xaqGXosmLXBhd#|BzNQAbkU2@3COVEFKUxXQ9-LtxG`>((8F`M%)sj zj{9ayOPpbivrXFI2whHnV$@G6jQz6MS`jIY0Ig9KcZ5d=Q{z}PnWyikl!UmC)pgu8 zn*rA?Y`*!tXN`O?JEC7pstU*a`gj`}lWWTJS)vL0?%I0pAp^65vRnEgjqBbV zWzr_L(ki^j@5y-_&z*`9ol=YO1B*qFn7pskVZ0()pS?u#-FLdX2Iej*!Xa;hgm<{M z37M&rv3tVcA2l&U7_3hVdC3Qisk=%j8Bu>|IPeu~UZ$+67PAEUJ{*61?lXGT(dlSL zUm7~R)HUjzl35Lmzb%RQZT!YsXasPvqVM{;CW)y?d`)+c8gs%?c$)c&KY&*(;;R-c zW*^Yni>>%1Yva`sdKGTx<-?y{@P!^9>G+?+8*wOg|2|D?#VUquCc@Y8{|Y4AW05n! z3G>)Ms6kHe#>3UeF_3)7W=p-C85^>zVU0~{yZOYyz-1_5CO+U&s0PJkeJsHXWA8=` zKX)n=hMs<4ccojLY>YhqZmPj#2jH4zLq9#jGx5>((P^XCta)@YU{pLHTkJfNMYr{9 zMP5Dsh}dmUQ!7Y`G_Tn0#HdM{s(o*nJySlhmtO5}po$85H8ruJ3)phdMo5gz>G|6U*pgZX z;8vQ&tXzhtMrqA_M3(Oo8fR@?Rk-uvNhW;P)C~f|1X2~Q#DS@ttn_w6{Fo39*oa`kD5M+GBaSU4$f&+5D1#DY?H zdftNtwt}9$oAdXZmE2wzQzS3zL`nG%K3Rx($_P~FdFRo`?q9QlN@eO_pyWlKbQUun zQ1*Mn*7$0cdEb#->5{s~ERGp`o)qEE2rr>&GN@Wk-OgawHmwxyXDPtcH3^-?#n%|p zUchBBB^hPvG<4(yYaeg!O9>08&c)P5Uc_dmCLll}wH=d1J8Zv6=jmPs4MK_KmtBAj^?R8+?9W9q@VBoHdUSX(+`;nw#*+^l3WW)Q^5u2l0kG23a0J|knDB%4CM8i*tp-xq{vE$vg5gou^8T1n; zM^pXf*Zl)Vt|5F!TZ0JaBwaHt4+Pp|7oCn;T!QWF>i7UX==U=~SQW~Ra0cYG5fZ`J zHlhi0SX$gW347%FOZmK}AwpZ2nJ14%3={0vvKw8)j^7*#KN)G)dNQXC*Yw>Fk^L2O zkEyrk4>I)+n{pyO;%;U>ewF#g@|riX$ftD>|KfSu&CfgU@PziQcuDEbQ{q(3;6J>> zWt}3$X-uU68Tda?o2D*996Ta~&;B)Kb)8E2ecRX+GN+ek*Iz9b9i< zg$aWRFwv%f!c>*(N(O8e=t?j1+_R1g{@Nx-liY2SnS0e5kI+5tx5@eU+hpJSZF2dn zuk?|>Km6`@vb2qDshQ;gDQot>oWIr<9lFj2wOL6%L5MBnxw4|5r=dfHuB5>MT{@pm?b-!EYtqR_~t@yL> zN%>LJW8{?#s1LhwJSV=P5ovPX-*z!GuT^1#$q4mV(f<>}Ax4!iV{aO(zIe zX=xGsc<8G$hDHC;Aaxp}^F^ptS7vG&vL4oon5Yx1Zn=3OOhPucr1rKW_SkfzvM3Wt zuX%A(H>}P_{`Og|@pWAJ+-(s<(fia`Vq!$yU7&IWLQGK2#LQq9UGr(GrqJtJ%9yl7 zyPp4j@>upUzr>s;oZOY!#iq#NZPI(xn{ghra_m#1e5K0cjdpMZ`! zjr{=VhL0CmoODC=CXL1W+V8j1dl}IQ@KfD3&VnYs`DN?QAKPhy1V|G92a~=oJ(*+% zv&)C69TDb3<8QmFi!t%DRgo{aW87ZaV3BagVLv!FNmk!M`QiHZQ$(8I(_#g~T{3dl z0k!EmrV;`Izw3`VAn~@4LnUIG&nT%Bdzdfi{cTpx@G zVrQ!Ak~aexbYKYgl_BLA2*7`|p5?q)jq>jOy+8;*+Ap@2VP$)3#YwKx&q_;^Oo zb!mUEwvUqC;V*^)0w(v62OdlWPlkj7v(^!tGcfn#V1vkK&aCaK!0r;b0Qigp@&%TL zK(xRq9T^!wJq*GJ=;_HIfch|q)|7Sr^s;6Q*7}6S^if;H3;5N-T$+p%KKMCwFcnOg^~fp4GbDNDRHwlAYY-t`ujDWS=HUk)*6wcU^}by!7%cS@4G3U2rN9Pa#Yw602j!T@ zNlvy=qxoq|B@x&@)&84+7(n;b;`AuK%YPY&x&cYyQ`=Wc7Z3c#3GOC+8|7arH7CLb ztlWU$pPxifbTS@qKZ@~()y#8fzP`2+?3NxiQD)Q?@&jR}&!@1LfiVeE7U112i1x{A z@&GCRD<(gC%rvg9+N_$~7pLsnyBRE*`#%a(TV9l(Dy5&1TD__NAbi(!K(r%Uup1K)QaROg%lQq9E`bzshg zlund$*i@?4={qG{)!5~wta(#AccA4c)f!luVaz_@wrjTx`A0B!DuR0=}|-PfiW%@;z`13UiCIi47m@klsWJ#l%1kzJ`CXm1UvZ zn|OM2&))oEJ~En1(Z|=&1FZ}nKVqAy_}QpACSg3uexO{pO=z7L(`!%`GZ7x{dR5xH zS1nNEeN*cNwq|`|B-K7Y?UNLHVAJtxqYLH;&WaRwGRNEyJT;`(DE40>wB~?0ILlgj z$LtB5pkTHQt_nu2&eY7W{>s9nX(8lSRsEzn@t7%yh8Z0gSl7wctk>QjnAC1unuy#U z7wULIUAFYaHE4G{vcw}@(C^`TFBSHq1a(!FC(W`cmcKHw$~O0{GMFtzctcP)O(|50 z1Sy;tW!wmRt8f zhss{Uge-ZO8r<7n44ZISwY?eq_J7;Gk3MHtpQ8~W4PX8dxob^>zh(PD&q&LSdM|yu zimKRMYO|F@eRF47*QUr%t?xyKy}ss+I90Y13>|c#mWo`UG;paNYo$`mTu) zYQOo)@^l4@_GXE3#~;DY{U<=aLqiX|93v!yG5@Rez4u>Q-*tX>t?xRQQYP9Prcx&} zq`>7R@=Uv9NuljRM?It&OJ#5GsZ-wznxU%Xj{DX(@*l15S(vuvPfVja%#j~IJKf)W zzM&sFC0n4@Uu_cLFy`C&Yk03>Uj_6;Q{pmVy)P18>#6QA#_zo)cEeNd^xDJHR-Xyj z=Hpf@1mMfDkH}3O2B8=lzd@X+jSsNYOR2WE;P*^K(uu z`X*U3jZ1~7j^?Wl@*vjZua8M+*dtD}Uz5LIpJLa?OuB#So~QZ6Y?{74Zq)iy*5voe z?+vW%Z&_2VGU?v%sjub|D9FLZq@0$m@uSh6bXnwMRs)#d8_^DeZ!Z`!2`?VJ)ZA<= z+B|(T7`W2w{pJskd-J`=y+=exnz$YOl>E`Q$>#|dxW-)su5sTpS0mrB@sc)WP|72$ zlADE-v)HaacbR=iJZX2X(b7@0tkE+0yUQI%&N}DR#C?w?2*1M;@WHVJF#q0Kw@GO* z$BTpc{X36){OI2vcbV1wZ^;~h4D-Ls+|zjpf0wyunWCS;HSQ(Ar(}lzwaoobmwP(Z zaiYjY@Ep`I|?Fu=ZWBwf-`S&bJ(4vz?6Emty@O`9UeQ70ozniBA9DerzP4l zp`&yw&ju%re*#UKVo9#C18-+lF0KB5xC=NnEMnM5m;_gFRm+S}=W4x^ScdAAe-oux z=x?+&-&X2ZT0Lxhr( z;jMI(=hbyS8O|gJU?orr;uHxLUxiOM+9@0}Z46>WHvswxlu+1F1jJoIbnLNDp>-$L zud+4P;wjB)pUA8K!FEtlW5i4+E-k?(`ahFbZ#xA)%w%(O&jf_##SCLoTdM8xqp+9_ zyC9FZiu{|r+A1uJ)ACi?%S=KR*1WV6>neDUhB&DU;FcYLf11VU3)W5defu%F>cri@ z`I*JD)r;qhrn9wIUBy4>*GAvv!@YlTBXlbrnsEQ*MpO@a?xc<+U8d`BFth97kaw)K zNh6=cybE@I=kvp~6WN)Ps{^SZja$X3eP)cmtA7~K?1SJL?akB;cfH>aU}~}2JMy{_ zbjyhNButnIGxa|JVI}@t!X3n}hAg~!fnopnZ}ovK#PdfdX2wywi)~iIPmD}S-vOq+ z+mfI=+Un3>v{fCVE#RsPOr&>TZsz9kKgDOrfRk41|2t`wy7m7^THSqPmHRu>!sIxM z>B4E>$Y{2(0va*C2)sO|0i%CRQVL0z@s>JV1LmnnNubr>*5OroUg+fu`I*x~W#&+Croxit2)sFglEOF`+Ei(%$}x?Uf1!##aYHJk ziklo!RrSdAl%evrlGOT3?sa}I_u{;hds%UtV&myZzTkPTBe`}0;iPVul8z2aCjV3S z)r3=Us_#L4QiuW>AwNFIqw&{oOSy?Aq)IZ)SUm7t9GHEn#TP%#IJx$8I)}?|b!`SH z3g*E%qe7(0+Y|lid}1`sjb`8Q1N+)1b7Fi zHH*$Eds6f5e^z~vW9m0>szk}gCeZzYsbbl%vgc^M)^B%9ndnPEq?gJ$kmF3jfcAyp z;Q8Ur%K9Z>Bu>FZJJnp$*IUO;6>R&71y5Qbn=(c&d$MIOP);~ZX<3P1Uv@Q;qJ{*x zr6Fa4Nk4I!eUiLa1j5h0tFAF%&J_l>I3~S8V|Lj1k|X<`_RJUb?9-ItWoyR%6oV^P zVRS`HNYJDKym~zN->b*2a0hz<&EFK)0_xx;V*}gbNvTkuS8o#!F^AStLm`xmm;&44 z0qN~xnPhIOW&Q{GRrj9!O7;JP{My#u@v*bnc53TUW>S%o z{NSF;wnv~men1iknH4{Zxmf(`*n?)ycSldpVAbQheMaW9zI14>P5RS(9DETX_1;&) z6b^#b7-`r-9B+G#b3cW(qRAJ z^7>fj61jsJvkbFofniTk-tA}N^mYP=>}Ff4BUIamTe%J_W1-Q}=xJkVc49sUzW)n^ zmgFxAZRS;`;b%%oON6)c#aQizWtZK+WiX*AqG327^omf}Zn=H@ZQqA_c7DG8YcK)! zhO+bt$Fc@|nWERdq4ffReU{P2F?!Umi~S>e4s+S~xE1(UM^{^yY)E(7jbKjXxVx>3 zGoDoLY~KK4R;X2`eun-cI{7H1(^bpf`>v2}XO{q)`r^ORpy>jbUqb0s*n*mW9FYrt z+RHTL1k((m0bfC>#IyFlM21?@$*8N>Gls8P4XyjEo~FB5{w7@_n`67NpLj*BtFm-1 z_AadpsJ(^%!CeFf8`Eq>E?lDi2*BY3Q$~~Tb7~weg-%_q zz8^BHAbQIml!hD@v=I^pTr3k(pzHHTs(pIDB)QxLB=C|DAxc~VA}fTHSUa%zXUVd@ z1}tcpcG0y!ARz@g^6>a|jtS7j4kgB1RQR31=ZC3`uC7(U1L&s{K~Wr#DAR>X{Q*BF zLNdg)X+TYg(iKkB4a6==F`9Y*jh14-Hh{% zdq`?#GZUh|0J0>3)l6TvT)X%dHdOH!VYCcsc+?{kGi?#XIhLK2kiZ&R9O@r$JnBk) zcf+Kbb#b{HrKkDPA(|F44ZR0}*r|IKr~3a10{J9&2LeffgFu`%;UJJbP8fCBV8a_LO}WzdIVW=J@_o*kTCvf(5TNDUqSj~c`01)) zmKi3HL336d+FhXUkUI6kdy03Ujbv6W=K4XRqvms>Ci&Ta3gMgrd;7K0VBv`_xg<@9R|-j z14FRG&J5-WDws}ovbxV=vi5^F>uhNLD^(=wzfwgo;Z%_y z|4>C_*9*4<@6`q9px4dB7wLx#++t*| z`3p0$pG(OGTzNuKF&lVRFd~>~URQ?ZJy`+Tw@C>oKDIF1+Ltt!qm@`B%YW{-^bdX* zU;S{uyaCM_X+%l02Urp!0Rd<`q$E-iJJPL=EYtjB`)tq0sOi#vqrc;2RldlTx zq{@kfHbghDem~K6-l5RMT1mn3Vr)K)IElbhk*-RfBI(z8N^bp-M8RJ;VS+NcKCuV| z@`PE4KzTS@OEiKChi1aOTI`91pMDsD)$p&LKN24W~-a0IjF3Av%YTz9{0 z0^__X`CvN!*dNb$VR(1__G%qJ>kszFL=yE+LDBD?!|k&~n8-VpCKE06mj1|bhiCdv zk(r|dCO7cw!Nfu~E4{7=RUtR2)9?(^yEQM`n*-#Hh2IsH-y%fxbwcEGKtg^tk{`c_ z@K`+uFIRnJ#_U@dd!0Lz2_~-W>!&oG6_l4db8N-RrM_+xkH1g^tqiuS8DPFU$^PzF zFlsk-mqFI@wqLvo)`@ly;n3^fz-{K2nhNj{R~;qJRV)Kf zAj9qxNT2M2>DA|nUF4kUbg}LJ29LLASo7!kGGzm)Z4Du6uKMX0sZPSJ=5h|NzSN!R zA|-;k=Jj(>Cc)NZDKdEO{_65~`6F&7RwgXcO0_F`Ok|aWa5Uaz(w1lzsr<Pfy0Eu?5>~N zxTFN4i$8mFN}s~zCncFA?4U|>5S>y*>l(CXKhC`m=zj%c8qr@yrbhEWV9gy~%gXLh z;k2L=Y%R;i*1^BYH;%XB|57cJRs+&0AjdQ`a#m;?73Ma6@NV}DFp zO37o@iO=Lq*A_lkyIG>eWK52z`wKU2-@5=#OHu}UnLX=Lb6fIs<*unjW0r3(6@M$I z6_;L@By~&uuG;_qp6cOA{O_rruRK#& zXH46RZr*-JhUx^VsUyqGQM$_$Hrf5y!A$f^Yy$^}nZ61G-0cfTtt|%^5Z3GY6lNJG zIU@oGu7wm7;twb)Q&&>%y~arksB{Axjz8&NC30PI__zRS)L;f|CvO83v-weaw4nOH zGN)MJB^H##vZOsco51UoG;lIjxtQO$^`K>RzOg~$)fY!e+WEz2k$l^JPVIA6Iuq1w z-djR;d4|7N#D4gyV^tgXIpWL^P^bmEe=cePJ`!EhHwbD;8(SUYlju1rD}dVwfBHj4 z4FnZTbLoKPQZVgPHm|I7M_pi|Q58;K*%JAsypwc8&sp(3nV3f`*F8}`KF4icdSQ@66bIB&%5UU={^uO)qfIMl#S;*;auVJKe)mXaIWyTU7%?m%#9@T3?Dd} z2aCc&`{>07KhX0qzLfA}KCEUf=AF`1b~v_75iuJ}cw*I+H`sIRkME-JFe9JaqlaKs zM(&0K;!WH+sTn+;zi<)Ar8Fo7MMFN^Dt(T~=vb4iqiA!|S0?hUZX>DX!CXqEM z1P}xA110g?0$@!-G|{|qh)eD&QqsHrE#=MA4;nqqPdAzXun1H4z1 zmKF{@EW@Q2K*<vBrdXaBKJGSS_VdbLkAO-kVO86$dSM@b4(AQ}Xam&4lkeqQy>F0`RHI1G+I$kQcUN+Vy_y+9xW*j__ z;^|B}?CTC0yxe*3+ayl9%JvOJ!5*e+ygkzC+Z!_^vRtY}R=RNDa5D((_Q9EY;50&P z+MUrEce>wyrZk^g-32K!5i%F)LLf&pAsT#;`I7yVcw3; zD&8Z zMTn*{v^UEzNHvq)l>WTAawbx{K6st{s=-$La=!IY7j9wGy|b{j!!2xHa0{EaF$EMp zxJ||-r6BTLvuWmkR6u6}_vZ~!P7Q~o&q8G&6G~4mTT}Oa- z*B~O8>c0rg1J?7|EaRZ0FIoy_PqtIKE#6U(dzBfubV(2M$|hXe+PXYkX@D^=aE>2( zm_lT|vBu4gKk=_pt_MCk*AfO+{@~}diMlwOC8Z$rGRG-+&~Lh$MTzpQOTMTuq_a`^ zJy&`A9PQW}$vZ2TZj)J44fvi(4#j=(1Z)%IrJAzzMeSGtMhT&WCDqTnf#|F_Lbtj}nn1?crvuRek0{3g)&(CaCn_>IP zS>xU)5-I^y9i-)Ao^mh|d~dx+mL8r;=50s1Zx1Fu>i<|rh&viU0U!w!j7Xi>qCk!n zF+R=^SoQ3{(Q`dq=(@{E7~?mvTulQ8M*9h$V7Jyd){N^n9@;y_wo4J#1Jwx>R45$t z2Su!$^T0v^1u<)UFbDgM4}^mRqg@YtgP`nB(Jy#Tg7F(4H|XXDtBs)qXmaY$95tSN z&VzgUGbI-;NJUugkWeEacImI@Zl1q`sc9WO?{lxr{<@*d@;h9^LQ02YIP z44NZ=DM{Ktqo6HJRfWr5PJn3-TC(QVvd=}hPu!IOEL1exHE)l_|h>y7eBP1|8qUj5OD1wp+Xg~scA}%QbdkAFIfc8VMh*)WU z5hulEo@!o7p@Otu?)FX8zDYXC1A}o*ey>B*W~7w(v!K4V*yN?WRS>)1tmgyd%C1O1 z1hp$sD&|V$(Jmk!k&IAa1>81apHg_rUUeXD@Zg6%`c*A;vv^;63^6mkC(!2Sp<4X0J#Mo~%<`4aJ^mgWDrWzGL# zdM>bZDm-Y&G}qSI4~#tmL#VMwc;Hl|-}h9cs)FX`%}e3y#25Pg-%o`OdKwUaCH9N} z*eGCm_>x;61q`KERprP>Q#NYct^KxgaG1IXstZG3VRw9c>$XQsq{SWbRm+ovpED(&pyXR{L={vO=Gr;U2$+$n>b z47~x?+KR%;ru6qt15o#Qo?m>@Y@jaw#OGNVZ{ZPWjmDyygPd60<^+CBMmjCbI!-d= z<2G>=_Kvhcj4)5`ZOA}J%rUhdvTpUG#|u#ruqm5i(+%n&jWqCx^-z1K^Qu$v@3Io4 z%4+xdY+qkYx{D~PxQt@NWk#9qhPbw$`!zzN^hCLZEh$7j8#W)?NO4xyop^e8e;+!~ z-_33YiRq%}@a#(vUxXoVBgf#Sb@`5V#*H1>rhN?UyMGKhm0D#^$|Zb^i=hE@fLc4) z1NK<|$qpPINqA#!QK8l6^S$1Hu_V9BfU$gDqtsvP%l z=}(b1c9zKaGj(C7T5Gf|RB?YWsLX-|q$lvJQosTj>wrRFvre&wAe4>0ki6~!dSZsk zFN85EqzB=2x~w4%bIpCJFXm}|qZKNdk4+bEzkdA6g}9(n!pgRs29Hff(uZ&S&-Qmn(Q!1WTDw7X4 zJ47pm3cNLhR{U(cKu-j1rptCC4ndKH+TQJB$@`2v24?%ev%gJrW}~Cb-~EOP?0!!Z zXU?UBX3vJEyO81VX%3BPLuux=&7Derl; z^Z~jSny&_b_{0J7A@0mr{5KESYn!CaTy|MZ57I~-hO=SI|F{ih)`C7XW{-?*# zV6DkxV7<>@xr7Kz#2g-HcCeHieDOu4qh6)ufNeRrKK{*j1WhH9LcZ@?)=&$}^?C$h zWTtH-`WavL%Xxl|qN~HxEkmmnb+5LR#ZRZ+Lbs%iLtWo8ACJJ=%3IISQTh(|P}fjq zV|JCe9@Qf6Lk!J=6Nb!jYyPr|3&5@7E_YV(pKz=AR6A-D%a1jB>Sf=Lj#)6K=#!gH zccbHGT&vboW#cQ{Ze`ci;1yTt5xiQ_&)ID0>8+O$$wT1Z0`rEIWTIKln&yLtc5>58 z85A4yaEfv~EtHJ#bdXEkSCxb9Vgz)}=f%ppqp24wWwQt1CcuA9XFn!GLvRJu`ynLI zSs^nAPW+S4BB^;+853dh-#mPHi-_`wmQr0*fr>IxD5?*)McvNmb45Uu4ob{c`mTfS zzhi%*yYwTg#8!zka8%pPCWtG85JKK4atc+O0w%U#BE+R^0C$m`6ks_9qr$=&opT5# zGRz#9d1@K*bLDOY{32@!FC*Z7^pXGcqq7)~UA0p?KpinqaXqatQO@4JxWX|N=Sc-P z2g8CWw8BV~`9lQcBS~?y2293`{X?5xw&Lr7I*L(sr0*j%Ymhh-1K&=Y(mao5?=9ML z00~_Q0TmO3u1d4HCFXF{1h<0Mh#fw_0(Q$u$zW;8ONDp|Gmpv&+(O9l8iO*3F@2EeN#eY$M{QmFMpFg2L#;6mQf9es}u`j&F6I(wnDZsuwPUtIF-a8ZAyT`N3 z*@0|bNw?HsA}&W;idr2csD8KzxZ|f;hxI#MR?g4#$M@jy>rkC)|1peDmY&3h*3S-d0bs_XwS5p2*)m<=C|m1K--37mcx&+q^mV@!`|FQ$S3{B06IzUCqS8Wz08=lR z5%F0hpxX=Pq_tg~dcJB%f-7G04IDv5Ga4`RL~V1?Q!Fo2vfw4{+mF;P((wi{fVeOj zlQ9*ZfCFB?=VT<>C^e_(RC4H!X1hsU-`z^e?Z@bQb^NQA$jWbI0J!w;f-j{Xl+YQ3v@S;66micH|atgW_QyoVfm{L6N5aSqbkW2fY@T z@r^xZr6JUzcc@cqD}g`S#2N6O-Er87Xn*GdUTKu9VmW>6JjLw8g;BO=X(dYOJuh%@ zwbg_8dz0k<&lI4&dkT>0cc7~uY=Uu*0Gf{RxEy1wB~Z;#FU1Y&KS?ptA59+(<#r54(zdwM9qyik|M5JqXjQcBD)>Ao!tzA^7z}Bo$t%nKA&y;qzom(*YMhbJ>S*?!+Vb}P4z;Fc$wm!)(-^@ z`2%VaWRJ*as-NbP>~DtWMc66#xl<3Y=IgKEj#8crUB10E54Q#mz7d09wC}MABBZoN z?30^|%+{HHWLt^bNSIy+&6=Qhiyy4ohlHcobq#1|V@z|Z!EXXIYuHa8Byrnf!z!%# ziV}5V>r!KyyNH9wwBB51c=d!;qD~OhlhGVxPg*~#pUhrGH&EjOtL+D)8B^rWMf9je z$XNxK9Y(ty3@Z^z?#1BKuZm0tMT}%zDh#+M#(C#`_6o21Li(h%o2ruaIosGqL)gDyjml_28I;MIXxF+HD=`V8a z+(%-Hb|X1s+6=aC76TeuCXDoU|r9U!E z^U5S)+Qs6(67M*xDH7Bk5P`!x`|x|O_472)EPg5gv~7GRMmM*fZ&2=W_xZnp*>Nxh zWMKb67kj>=qMqB5qiAuxNzrrOI{h0XhgA4a7~@C5kB|qbDp3f-o*g&a*1PMr?)K|q zo)V6}^pvQ$o<-xeGWaUlu_{um=z;yyvhMYHpvx_%?vB0^G<_j2^ygCv%Dow-0sQgN zo?`ljffdQWfI}>f=wDMVevepOeNpuiKbfn>bC_x@nKr(YSejN&lX|Ciw;Mti_45Xa z7j;`~Pu*Z~E1|X%Y0kgC$zMg$57bxa_MK6F=$cGy%U1BBeo_sFZV| zfZ)oqwS}=WFqpyidkpF$%X+P&53;R=$mPMZMjK{6g?b!aF=<)l3CW;hPK~E7D9`nk zvHHF{X@G4^N>HUen_9&c9lV2DO}IcOZwmWJ@t(y10DUhggtY57m1!N=4*D5RsJ9)f^XW&T`gpWD&m-VA z?obLCn3F3U+*!bm>&#Dclz7S7^4uH$qUPiBYqNxUsrxL_z zoP?V0p{Y6k#&$P$tcVwo9+TgaOemt~UMU_C@+O}mGpO9_B-k6@_6b2FmMvUD@LoaI zcPnh!EkY3iyO(NYWaS527XGo4Gj@U*Zf(OGn1NiRAXuh{;uDI`Mqi8w_b-a;J>nTq z4ir#?Kqlv17gA`2RQmn4n3hcMu(=U2^IJ1}f8od&$xpt*!~@fdpoqc zi{74h(ZSNGHpHcGj#uT*hq2GzaaHijNQ(QunQ>!N&^PUPFBFifg76r=g1dNFCjCe? zo&V4%kU6IHM3r^1GS+~t?DaEX~ z$<78n%TUEg<@9;ThNWJUWip!NMyULn#wrU_&0)So=1j5pv?sS%oy26HQgnqRGn1?c zPM&)6Go?!)eSq?)SgQQ$PPEPu)xf=5=Fu>fDdtV6yoMQpToQcpXu*av_DU z*0WZ=;d4Bz#%}n6%$-MALlXMCeM`vDmi%+m(lZIRcf4AoMR?iB8meZ!HDSlSiP;C4L?)y{= zl7AM!jM&il9C`-!1-lePcp9nb~ z9MwNXa!ySR>)Y-|*_5C1mEhJy!PZJC!6R?qB=nIy_((1(B9e0=(9pf4@0Xpl*NxId ztH~SK(&ZINlk4w2Z4Zong&Q+u?`VVg4oih*3xMri93Qh8y zwc7pz&E?saM%H$DkLH3P`rQxY04xkBJ$?C@pn+Z5Y}gBY=bGobioElQ{`du(OtrEN z-POzeQ5#NVDsntPt1R#|nUvfV7CcoIB{w;V;s;gCpdyHdw+UVyADl+1@W1bE)BHkW z;C-5hTvkHKcQpO~%Evo* zf=#Zz)Q@CPV5J01gNq`W9M0t9yU6zRJ-Ld#nSc}^_7O@B>{C&oAlv{!hvZB^ASM(A zApjU1CnC~*{Pc&kwW8Cz{ces#mp^uFKCi4=I*xRnWC#@P&Qtmqgy8gXv4i?N{xoVb zDl8?^U!w|oHe01$nT+@6y!=tFUl~(ni0<%2{lxDL-EkkF9smXLK&E^$j9yDpdeTIV zLGTEr=af8uif;yK@`$RFy39Q1>+IufG!*F1UL6dG&V+u2jc}zs^aK3RNr{L&k?~fk z5J3;Bjtn!W5s2V@YY7V0?5zyoBRVMwY@d;xiXQonW>xbi&5Dh?&arGVyK*ib?QfdZ z?>AG&{~v4b9gcTL&pWpHP@%zWoapdUek4t^d^L)QwuXcxtYkyRmhS4~7I>oT}g18sRjmLRx z)*0DbB^1`q65Z6tzId_vQIRd{GH#Q2rJuw4!NNr&&~c{TG~b}`qv)NPb6D?MYdk+t z=hluM9aOfjn0<3@pvRtZns6fPpGHo1&BJubpi3Mg=C_DmSS6Z4%vi?VJ_?rE@tS|_ z9}UJy*sI&NefKPhvZXF{zh0uUIOV`$$G`ZEY7LRjM7`JANe(JLXb_beqRKf`!LbyO zKz1H~vtgXwGK=H)dYxPyZKyzj>^H$ig; zg(TX9PvMFan?fkTt3E`qSblJh@((RdnAe>QV%q zBGDgi8T#@3h)#KAT_N%H5*a^1(y*g3#1f5VAv2xP*(&I0%LKAizJ-~ zkIiFzd~cAm+p5*}BKRp8DzXGoan#4a2U`tM?R zOAFS}px9a(GqJ_N7U8+J{TK<{qS5`I|TM6GnVm7g!{*$YLWWz)vHdDv&IE_eG(OgM}vC&(=m6|#)XR{ z<)KKYJ)d~4?yg%^Y$f*^SRdDD2S1v4OQ{_a{6?zG&r3PTk=jz zFNHu|DcT=Lo%~q1{z+{K1murLudS z#Lo=fwQk_Qu$ql|k^7KZ#um2_rl?x9j+F zlMgCv75u0roi~P*>Y|7FTV3XM{G{AixMM^~xB9pG_;~nJ*EN)4MM!Dw_)x2Q(lY_7 zV~)#i?N?K-OWf|wsH_B?>=5ly>^_#LQ-pI&GZlJ*dxk+a8 zmz=cnFFENO4u~blt$`5$C@18y@ZVO_@4djwPufOnOU zdoafD->=_rDdU*_cvAXY-gBK87N?G0}Ag zQq>SWY(g}6RShx3>Ba5_$JG!TlJ!Gu&P>j=1&+cE@vM`SDFC=?AZb9#oQ44_9;^w_ z$Y3C`#wUV1Z|EPX_Zz@Hb# p*bc`SySmN1sjVm43blP=3BE$}_4& zQU@ik2eQo|8n66&bjKk$$5``D76;$_L6H6>)jP z7>4JW=0BboT z48BmNT$AFnFPpKKq6*cIb6*$&HvdWaN@t&Vhgj~dUJOf()iFj*h<~#D&CK{dCQe#I zSESstJorrp#4Ojf-*#-23Fh8nen~gV(Xw>|bq;N>aF_D-u|yQL8vH7ERLDf*Im*x> zn2~Ju>6f;gz0(yheW$ToJv-=qF3le*tF4dM>^fAm%teFFKoJRCmxuYA1El-K{rO)Z_p+*AQkKfZL8Gw}>6#RCruj#`}p(=xN7d>e$ zW^YT7|0*Lj1?v7PBNbuFNN=ytpOuk%qjpw(|8eUH{r9csAEzF0Hy1?(RBSPR!N6P; z--XEEcN@^0i;`orj{JH!?LmtA9xoWg01xT@WL~qY zkOm0mp~Q$cvp4B|orhuHa#0=l~0-YFnVvIjYfdI-aY$ zv4yT5!h|gQP_E2BpwWJFBfT$52dhldFD)VFQ*b}%O85X(MmQ2}??1IZS5bM=A3k@5 zLje=d?l`;d~yqeUL50_57v2>Ot%sYpB-R+8J1K#`BmIy5gBXFx5_uEa{8gd zPS`Wbg&@><>0F~HbGc{I*idPZ$K~ayA(i9qNsUmpVEKKGjk_v+7{}vPe0i5rK;Btekd;X zx;FCf2X2Qolo)>YORIi*Ay+K{^Oui<&`>1QoO+z%#adlJbuIQ_dq|euiMsa|w8lYr zF8oCBSHr3R2?Y!RB&1>ZfOZ#iZ!chlU#Q4uL`-0V!RIKRiW(Ng4J;t*k1_gEb74yL zuKp-e@Zk_11>BM$0Lnf_%B}O1Pq#}7A(kBbQgY#(QokJhXVU-BhDsB7r9e=m|CRLD z0ccw)YOo$kjt7`I5b3xm%(9XgsK-;)f%}gj>7bZ{5(T)OA!bHC<;O&^?cl9r zU}0qWXyY#Ji&syK6})`RUC-TnsZqhmQO#We*a|G!;=1q07Up(uR)CmKNES3Yf3~)H z6mn-9Q?6Gw6!=D)uc;oRrZ|5CXZ2%izoCpNfnK{(dLAp``E6aFD6-7F7Gy&up4uigf}jW# zj1A!9c#K$n;VveB^n|$W(BUU@>G!(njJY(Ot(J9@O319i3-m^ykc8fOXImwyfVbU; zfYua~B%_GLe2Uae5$8$n-r9OkQmJbD^mr^I`mky90uYNtQB`=EBI2;XY7|P~vhD19 z{15d7f@7JQrfMdDI~qlSnm+jXapI+1ipGNV zTV)eWI#X)xUeQ3E0KtS2cG-V`!U zMjDeEA3LOfSJz{en-&2mkqg~EOzo|83k z+awEtnj00wNTx$GjFlgi;;K(vF_hREJYoIbye5Le;nWBr>)QObhP3^;v)*J$in`3^ zv$cJCC?ga*F5}5V|3b2eRM$^WIJ)n?V~D}FdnHz27o@-E{&kPS!Dcv|wBP|^lyCHI zAW)en=L6&u7(z#3G$kVrW-bQyNGb>pKF2j+EQ*4Ht5+#W5fA@k%$42lFnnS+(6>}# z`+NtSYC<>xrwu}1&bu}(;J&SUdX-`?@~zVK+W#Hs+&>F++I*?vclqx?r`uVeGXxlv z!C=^!?50~8ObABcoN*0cOIXCd&U4VwW@Xu%lb7y#=6%sz#s<8$MKJDH_FxsaWp2^!Vegunn)-9sZ=RRj-)}hmG3Q3{ZtL2U`B0E_8*)dc=0<>@8itR{ zwYAMVfXdG!%>Fh%cz#`C!uy|YKjKBeEVE21WN`N2eZ1u(jeSx0HqQ*)9^Le%NFzKOuQcHh|Dp)5-9 z9;`TMp`^f4L){SPak|CY)Pk2A<=L<3c89`TKFZdcfA}j&;sZn31)0mn--hquj1Cl^ z7uDb%sb&pxF!kse+r9cS7g9<*9V4l4d#kpHFy|1m!z|x*?=qm8K{8#?K)j(1ZQ2$E z^DIbbT<$+KlV@5E|A-&zf2x%EPhLsUPhLsw1l(;c_e}>$!2HSENBU%qqh5CK*{gET zKK35H@PCB^{igXtYcn{wCu$sVasnJRs2D*^BQ+E8?}6&32>Exu-1Z;fZ3v7EJRzXI zbW!x9x|bwzAVx>L*+_l!g6;3I3P?0jKg7BY-ZoKFiu`+!YV`Vl9HchEX%EUBYaOVg zpi-c^7j+e*GiK6<(~+L&Mw$A48d+BI8VRdedAW%(*y-uRld%n#fgKSw4S*TIFJrGC z19k)WGMH_lrUN2(;n#s&D>W2E-Gx5`vzT9Dd)onCU0Pazcn7lqU$KxxRFX<_EAt8= zc8dB4?HOJU>N1JRZN2+5GQf=osR3}>sUcW|z#bd<9?KStG{RDmQBks-*CHKN6qYjw za4E(0g|Jq9G$m?3o2zZ(9+-n3Jz5Fyr3t2t#R{03VRV2)3wlAQCJXQQ3i06^*ynf7 zgKFA_KUR~x6-qerr_O?G`xnkY54C^vexrZu{pJ)X^V#nQ z6J69C*xn47fAS##Am%O=8M^W>p`FWr2<<}ux6tlSg6#hvp`H2P5QM*kb{?B$8Jw7W zncL5N*-CBrfYDjLET3dk=k4vVrh?Sy=c=eh43$bqztq>+H$@_tK<8~NLEfwFFUYqK z?%eqDTtCTys9H(h$n4@=e~y(-0=U9O3qk*bf*>=RCx4yazQj93q5eB#ri1+=XK^54BS!~=<4yP-0q z!AKJw`i&p#yyJ=JtLkLg_^0nTU(U&I1Z=&T)p@a!9;Z7_HrquJu7*jN#eQca`e(w- z85#2f3lbhH=GV=`SX9TLe}>z~ZMEb! zs*>!;ggsm$Q<7DkaQL27^N6^MFYa-iLl$~&v>aC7A^N=an)4ImdNO?p)iqnamZEpY z*A0AH(7^;tie3b*&P$<^m4wqbEPU{lB&=UeJjqXU42Vgb!P_R!D{|pTF<5V0ahiFb zvY9(s=#UsFJ9Vt>-aBErapbZfG-K((C3d>M*P$aK7khdWK$+l-B3*19ryrZnQe``T zQe|DCzfxs+m{eJXo#qjBi=Bs=&$RTPRN07My_-yhJspAt3kwats#5+W9uSLSKnERJ ze}N8?eu54P4=Bz+2jBh$ItYIxvxNvQb*$ulCo`5P2>&V#lvb%=fSdtgk8g-Rv|x5O z1%V6*5#Ea??g{3?8ff>Tw@23jGw0%O3U%DkP4~9RJKVO->f=(rx3jyQ^Q5cH=7zF> z17`k${EZHnePsExE_ozR{_Ph6(7J=9!JeE4(u@c}EH+Rhh8zLj)lkelMT~rPxz`Kb zW%X8|Pm%{PkU(x+*cG*w)F)cA1XEX#F4%_Q6Er-z>z@ZhskP?e4|8S-l|wqR4hRE8>J`^8epZkbR`q*t9T^1tqk_y;QpjJuS8zp6MT#dwqLEMR z9Iw)wQBue_7*(Vg;*a@YA=EWAXt6(PIn2?hBgi4tZBvpb)D>KQ=fuidQE&%Gu39<5 zWQB<&ih%It^qM{0`-VSGs?=XjsuyQYs{dyt6$LQBM$n_n$nN))7Ww;hcxizZWM`K> z;nwBZliLL&B`-0gWqG15XWttWh189h42b#d=nv)_T+bSaX{MTKB`Ae)R}{PsEqT3X zn8nf#?4IA$KZ}3p9ucrma(_&EO4rH9 zv~ruzTaJv4x9nSQHYu``O4V5>H}g471&3nbg$2fLw{KZ(dp+RxR~}nzf20%Ot>&A4P^PQ?T=nC5TPDx3{5lB>8sY z?q-H)`F8vgWlgIs?HC-USA_HVL1 zH_SctpX+H5E7Cx?9T!d-J{?WTEXo6h>gvStWeh!7 zJmFVux56PT+TrNQqzI0!sQ`JYj+^vuZS)UWfW8Q)x=>NNu@7(EVg<<;;nY~ipz0zV zem{L=pjuW~-1HJDOV6cC8H0UyhzWWu3F@@EtKzLBKjZ15)o3vAUoQ;&SKQ|({Fi${ zzB;(PDY8TrkA-A6hvX!3Y4vS3W__HwWSovS+R;_joOBTWtuI*X7U+M&uPe%rO$ z&3#DMI7`K8-r7TPrtN-fX^g4;E%{;V8R*xn#oKw{)hBOtcs7UQT68J6q)tP{bZ2(c z=HA7N@zuWd=?QibV%GW*0&{I*FLFiQsjs||y^hR!vgQ>66x3;Gv2FQ)ojMIQxSj&81bXcx;^6|i%z^EU=w>U(8{RZzGB2uSv~TSuU@7}n^^Rit1`NTUmrS!gEyJF~D9 zg_zXp!_U2VI>yz`4>#4L|8VnHW&tE)u)cpH3qh8M)Ptg{Ob(^JOVZm8pPG{=k1*BS zxk<@fz+#S&;go)v!~F$mj;YtO{-a)7oPkx>R5#0HsxDJ_SrsGyl4%_nIxPkDAE}V? z4GX^il6={;cdz`Bd;!C<6zdbUF_)NZq7taGTFlPv{vT)T-S4ZBd^yI)f^ppc1k3ygBy1j7!s?{B?<3Cn5Oyp7=vZfuz$8r^DszW59If~KO*1jTn&Q+G8rE79> zyvgJm7lfR3DX4%KoQht-D+lIoChU-C8TzQp5N_q!+x0XkW(Cht84DX%7bDE_=r|K* z)%+A@O{P7a{hV&L;i3My0xLgI{eax7c_@E&<=1U9@G9S|aJkZ-%{TRj^=q>*o z=ym@-&@*EW^jYVA-sh+ClRllkw9`4A>DrOBQMhRxi=v_ePoBc1uq7veswP|uOxPge zl#bs{H{F2lpGs$L|_Fp`pWgi;gBw-M4B9zPcgaZM8m|KW=mR*&(g3 z)O}so@iD88^UPaxL$PpqvDcE0xGUwuS{Un!3t-TL zD+8%!YFvVe)iroTR`Qp8f1svC#SYw?sjq_-J@{437PyWB`3bww8EniWnJZT6V3)D6 z8_I!b9Q8}gkIAMi${I@;Bsx(-K{_?!9ab4AU5C8};k(q3izvfoK9&RQ<6_`gP9*_M zVTcE?jBcX)=Xj0|$2FgM2lyWk5ZQjMwqao}Jb0`Mlw)8h?7Oo-ogXQJg$0gYQNuC2 z1?og<6c!R(-lv9v6gYwmv_7U}mOas(%bqEaZ(wyVplOX@IP9C_7&$G8+4QrK#&*|Q zZ}?bgXSJENBjVfDne=v#hO6IZo%Ny4+`t^fcF741a!Ya z;o~T!TY{tmYAU|JYFo24>>GAEnfJ7D!UzpdI%B48c}>+3vnt5mHB-ND(r^M(D~FKn_VI_jNGS>WSE8fuVj z2Is}W^r--nfCdis%;05M#Gt?&u7Q;Vuq@zEaF>wg0-(2mKLCcKC=!rv0q4X=mZWu4 zZ{q_85hNvhIL&IpGd3QLM&}^YCwH~u*IO2`)?2umaLBGrAKSaU8a3Ig+2<^1*iO3& zC}JT3EOw(rliw0=m?mD6;+YKOOlIB{%)h5=Ttvh5i(i)^fje{UM=J_Qb-<{JMAZs* zjd!XX@2Tw%u7eF)1f{v>(KmKDLl>IvCCW;;n!lS$7wa!h9qFGk4K=1r!*^DuF~^i? ztW12zV;w!BBfg7kSM)Z_wz{LIu5r144&a|0EoVImnJyRSyT0){)$-zKvPmDMo%Cca zD7=dN0;)S<>e!M$izSoqKkPW6%xxNJ= zAHW2Fq68*6fV_;P#{&sGdEOLY?E~yn#XBv81U7b|EQlyYaaC~XU~WLzC!|2?I+7dP zdjoK@Auy34X$Sz5{jfx=L7>(~)r>3KA+d=A`Zy4E6($C#Q!LPP3kka*j9H``Xv?xW@^T6kvFW`mU$W1qNoC zmm0~&)W|1PnFDqggV(xNGlG`m6fF1?W|uMQ+f}xIxo>4gInbs5+kI&_rG_No1Zc=zbk# z53}Q#j@~1Md|$lO^1Rx`osVI?%JGC_i+wbL9H*9T(k6Hj93W`;z%_o%0cYrRq}Bwi z@FQrYf1pnflavKy`knu=9XktaFBWk-UiKKs``^mUX=jGst9jLx zf1tX`^f<{@|1qh~a2Q?3aK6*C=@&1l3q%;CUqm`P)*pT%y5iX)dNuY{k&P{as0K~5 z(LZh_Q0=g+T??fPBXCymb(G#2tw`1a2iZtC`f%jjGBJT3Z@EXWF>9La_a*Y%ZTq<5 z@-Bl~x(|0c&JDKK+4wf3yE}2^Kr^N&P@DV(Q~Qfgo+Dc0}q`SF$!K_{no@fbKQDobvJXLI(6v4t`$9i&EHFdVo=Cx#F^ zg^~9r1yHAXwF`2k@YZDy@|5En&JAlEQcWBqfmI}e3oWnlVVb5JUnMQ8_Mw|#iLV}1 z`-V~fc)eUwX}%nE%ao*j5K$KrFpx$Qt|_%Eaf_l|i?8&GLGQgeY&qu%CUmn*D&ZYx z@s$Bz4f}b=+~l@F>VT3`v2F`)2{qN6MzYknYpy9d1~Gf*v>WJUacefSAKALWEUALSzi>|5b}oCP8oMvKUJt|uxkGa;0{ z*JM^oMVSlBdcUw9fW;}|LNuSa_i-Ug3qW$=A|z$R-AvOK9rm&JD;W>(VqWOr(=eQu zgFP=+`etgT#MF%L2>EN{F^)!5dN^A5Q4_VyNh06pzRntE&Ifmis-7c+pMsoAa46~1 zH#y99UNvWWU9>Z-*Cy2g7>vM`Z~e4fn4DQI$bVZdell?W+j7By2rK((xuE~D!2P!t zm*g8piyI8oRpAgULx495r}=HZcy?yKxY=nZ>{<>J8zo9w#p~Ur8~$+J8C+iE$8=

h6v6W)k9V9OS3sPh#VKtkaLiPEXqct=8^2(Ce#Ol=QY z;dM)Qek#c88AR|&cl~WE=i~e#{#UpGwW#}pPL`7{RD9QlH3{e{Sdh#F9%lzo?MYfgOdS0ugU32 zF4@)Z^WuKL?n+p)>L4j+i!uiFh`M$6j0wdPjM1V1yRON_LDxpe8*(o0Fd~GwCd>b_ z5=vNrtb{;Dk=*68pkto@X(hD%XC-U|v3TcP^%o#3p(oJshP)l%(}A4wi7!SHzrUzo z46&zR8`To6FxnU!d4|)?4J~T*g{eD&aMOfP3+klLz4>#u-ex!SDJJ9R4&|qwz7tH7 zkNTQ$Gce98A%*ZEa6IA9{9Th<(A9odV-5&Lebck6#TDBr z9l>Sy=#Ehns0iK<}M?@z4A|z<`gaj!@EkI;jPLx1>V|`e>Q$D z2t!ciU_QAw-l`HT+wq98YzyZ%cn_l`lT6wU7lax?s&&@&*I{RWPBYw(IwC^$VTj%VFJV6HjC;T#T&0@&_!apOp^7peCQqix!U2{f5At_YUqRX zT)|dog!3^vd?HQXX6Pg>?e&vMJQ~-Aw!%0G?tN1QX^H%O1;D$2De8eb|kH}qTZxgBHcPY{qoU#ZO)Gt(E_1v zAks}hCyeGF>DE*D;`Sgv;Qsp`>E>D|AHe%xq}x(O(ir_yNo5kit-c5b0i1HJik_7} zc~CBtO5Wvz8)F8*&UJAqER`rYH7c*61z_?X)MY+F#y|42&KFwdU$(QB7n@j&tk*RA z7MN>?N{$|MM4M1|LBYrFsw z)!-U7eE#e!A-s^LuUh#po&9P%Z6sq+tL>z7e?cY)2L+LhpAzzMQS79zdpQBOKg(>- zJ-l?gHfRzquTU?_S3Y^96};8qciv%C{WKP!tK)8OIhs?dcJ#UPT`2c76$TZPqzaWD zg=U+5Hm(D=)9_srTnd(>pR>NxHl-}UKd_Z`b0!&S;t0;t5w|!lZeEaUv)}>moWP8r2u|@1%POZkN@Kx(uPOes6HTHxh8c#o`_HoeV zs6`3!CNwLem`|p*ss^REI`uAlCl}`LMWUn2rv~xZ;IO&t@e&Bx>v{Bf>)A>!_F0KF z`gTEACRI7U6CjErs2I$_naOARBc#6A@?}fOygZVJf;FV&tqo&rD^%pol~o&~-nHJv zdpfF~vIT_T;U`B$;B*KE{;>ohcvNecVroQ@zj$|x*}OAmm$m#i(C5F?Vh*H^g+bx{ zw|y`yH>X6&4x$}kF3d@3gI}5Vt8~`Mi#qT7r`#6b0gGUCx5cf5(h{h;;EqFub^i6Q zvi#=)zdGp}+sCk>e@Thi+rIkVxqX8>$&n&yMdv@N;_9a#k2LxN(UCpzsEVR&*}n^^ zvM6$L9edIg4cSpaG67AFk1}1=NpM6vP!1+^=cqvLFa+P z;DK|lC!d*^qNZ*)6ue2|0xX3uzxkq56oAl86mH;Tg7d6mEQWb!pP6UGfT6FP%D!xx zMhcf_w*&B^+*o#plGtKPit(c#La|^hWhwh@fy1LibFB%_WMct);q(+}YX6Y=M_oE^ zV~oxw?uNl9>b%6Rrs6aiT0U$5zqhr}$E7M0yLbzUj^$EcR9gR4y}{X8j#@) zfnq~cbMaE|lIK+g7I$hdIM+0e@qggh*Cz)bt>PSWO_`+nQkLmP--~ zt?h5AhutfVE|+WymC}@whu6FRwvf0-XGevuMsY5YJ6*fsEi5j1*UW3qcXZoAJsuxF zhpeY_dor+zM#_EFk7I$;n$wCFU`NPhVK9@&Wi64Oqc-W2dhFTtoz`+H^`4_-O2e?K zEh9rZDQs>M=+;yaNn6})iZc| zRA4`7!t_2qjgjNeBFyU++5mn^)qg{ewlh-a=;SxA#YHFj0}IAOQJAh`Ddt)z#8MFE z?*;=q(JkAjg(cY*5F6cyHuLfDeq#PIm4~p zX}r(WBR@w)@E>XvUntK#vgjjkVPVkQ>po?6egR3>s)h(%srR9Xfy zYXBY1c_`VBx*U1FMTC0ng5n0mCRI+-kD4siM-bS*M3sHIQ%D3tHvPjxPH1&R1qCEGX89`Z2V(hNLc(`D6_DbbTZ$2vN8u87@0LU>^HN$3a1i5O4}UHP z`^AXY(PTi$7;<1D)UtI5U<)-i5`NslBI1xSXB~80U!CS?{4-Oo*a;(` z(~MCB-8bus{FSxx(FK%_G)g+It$7LkB1Egz7P?7#oH69gh2XWCH<;i}7LfUD|)L$z^D?d-(V2^WEu4 zx$a6pMgP$DK<-}C%U!89mrp&?T>y5#acd6HaAm1>)WQ_-Qy`k_S)qYxbU)?;Jm-qs z%c4g4aXVeM`D_|6?qOrqT3=_d{De%kqS<{714Q9GZ6HKl!VuM33cx7NqFs|bqL%M; zP&-aVc)_wiyz1Azmr){!CkG8a=7j0aX*qMK#%8kEi}KcR{s{i@W%sl^158_9wCIGn z#~O2ZmFtJqDY($StpDu3O{0_=>R>g9RXyHPUsCxTCFlm|tGsMibktR@rSh)JOP(M; z1*AZaA_?l*M@!f^avIe@eeoBP6)AEGSOMh*=ejb!p?(Y0BttP2Z|6 z#uqjh3`#j&WF7*cyGq~mm$h|}vPAKvJIi{?haz;aydEF}>vNTkdHp-CLRAk-nx})v zfr*#_tQTwp1fBt`n`;<$M;RM`?sBIDHU_YVKc0HSLuB*<+_$T=b zrmBK`FjlG76x{SOi=_X9v%3t7s&CkTFWn^#k|Q8UcXx<%3DP0mA{|3Xhvd*H-O?@H z-7S*R-LYp-ulu^6=fC6FZ`KQs1LW1rnlj`39 z2YALBKko8ip`CJg=xx`f#kgL;D zez+7^Txt15nYl0M0Zgr*gb;QuIHfdOv$XtTkkoYMQ)9gZRFPOF$T3 zkY_>M)}Q64&Xm#UpAk*@$$QHu-T`K@42*&0XF+y6N1e?+WS%e6l}2B zr*Qvg&L*z|{4-}0Sp7R^<3Ne_e!gIpIfOUASd!d$j_|Q|*;{FHyc@h`t5gNA*)R-+ zJU)_M%KtI@oX@m56n>k1$zZc@rdnf zcoq<|FBxL?SvG>rzQq%W*_X(8G8DfMLEh4;5@2ZiUuGZhkJ&f;*X+CeYxZ43%)W4l z*+-h{YP>18q6aqn-bg?ylqm=Nr{FmoEddXeakqS*z`y5g({^v4=4?iAW19{n&$;1g zK6A*(M33iI%X(AbZcp&Dv~5tC@e4j1b(aGdG_?t$^m|&Xm0g?u zYppg=C&U5gnw)+b-}I2895Tgi`0N&vz$E<6BmdbBCl z(Q(>`jAG;@tqW5m`SOZQs`ZFLVoAR8Di8} z(VRv_a*_RXU0Iem^>PEXZ~$I_KlLwg0H}eFo5@>9=L>Xw>r}*%r&ko!uRlXOP1wRe zPCJg2j|^?@%^^R!*`9FOj%_mB-1KN5SxHYgD08vzG6$%?Z$o7wqMI;kvg9gX%a;fXIOrAGHr(D*)EM)Ln~AS5e1ABL80K*CfkI^vsCroweMXA zJa%3y_k+&NE{}~l#;C8CxxnMJ`zc_V^Fg`dpLH7J))*XR6I<4W`1LHsIv`e*7$U5!k#Xao5*J*=H_a=+>$K9Z zS|Q!cy2`)DY3Q|~kZ~IJDh}M>qXKCWr~w{qTspOW$bz|zc17Pq$#s1^h$15u>YH-! zVJgFutG#{Pl1G`GV17x_bjAb<1Oe~>@tUgDbsoGz!n^|If{U-A?3 z2QDFikw1#x$RFWzF!DDDLH;)Xh5XS1|55(<&YUA4%AfHYmgXnr@4t}0(oQ5ccZT1{ zpO)-n5g7SP9|0*;Z#^M@z$fHS?g{y;EM)nE`~^Ueztevqf4K1v-~wr0(a3+0KcHM+ zN#XgsDYqhvX0__y%3rm)9D0}bt6#xy#@YK~!q1-Fa(Mo@N)V4hvXo_J`?&Qo2Bp!# z_ol^Bc#zR_M0&W-biBr+zY-hSMF1Dil0-S&DOroV*XhzUbaVFL!DGuAxDHE` zR+-`$68w$)5pD&-8gT=32qac>dO5@C#|*-_NGyv^Lnpz?pCb}j`P)~&?mujme?tC@ z5cs|nuYr-jEXIL>hKbU~EZ&2{4w0SU<;U|lwH1pe8&% zO4r*mxtMRTAYxB?Mg4Ik*y!AKu9P6QsPCX3P$!p1DRc~ zDA$jzil-|~(|4Dz&AiaM#XzDc00!u{%OHCc06rI1!{(RolKP+-j1e^woz>(PoZe9X zlzZ_kK3%^9B}F@mle+Swp9cvYUaMtwKl6BYnHgcy-dTZy_yNKQmrJAyS1it;5q+R{`IttPTnl1gAT2NLN$Xf zgaNcKZCFi#C7rXSRa5qAFV>=!l27GqH`rSWWJhzc*&<^HB8aRpKw=^QNn+XOYQD?J z^N;we&Foyy!oGs+j`oCH5aP0l?Cb+ z1qhO*_jYB+r}VMYOuHU_QC3t!S79JyobMfb`D~{uh)GBRbhioTq)JnZr}Mg-E1fi)>e>A<5ntI-ckX} zTljsh=~T&ycldwdtxB<0roZr3$rHRaQ@Rd;w_Jsv;4PTKnRN5{YWCaT@Rm>975Njq zg>-KTfw#)Q@Rp3$6TFoSy8EmL-zk+zV1G zBujjI|MKY~B?}77 zphQ*u43J4t+?-){xR8iI2&8zn7;vM=u^%c58DMzC;GO|c?WW+sF*;aWGWRJ}M_8>r z4}uB=w8-_a6l}4B3=_TY8G@q&MV;uEE^MGNn-VAX zh7_}sZnFoVbw9ksW-4e+Qnlg4xNd62noP8xPKisRJ)wiP1I4LchhOw?F$vmu^e}xo z6^w8dsW66XB;l|F?w8sq4CY7aZKd<3Hx-HH%r2y(dKW@e=+w|Hzof;Q|6+t|L#4{k zRV~Qe&HXgJ^FhVX=*37Z<^yn{=x#1{fp%50Kll_Cku1FIJp zcc_u&LMUp7A!S%6=@w-qpT)#zBVz?89H#j9FU)q65Jf!Sp_Li}aA#Sr>-mhrzl9w& zR#R3JeM*dPp<|Uzo*HdIB{qGa zcA0beQegF8QAyi%NK_ICsY;>@80nf!0fzJBAyrAdkB%dMtCH#+MOA;IlCQy0N&8CH zf;l8`RFePm5HnSI^Gj{V!;7U=@?w5`s%?Iy5309V;|;qOXRi|mQNyw=UQ_ne1}x2E zDYiwQGAn)P$sbwTf=lv=?^^$*`%@Ae@A;$#e8e7_r4_1LM5?~_<7sS@M=>;cFmnV+gvw_zFS8bPOSA7)a^~4U7B_8unrU2v)-|(gU!Fq9t|#N#8CWibFv?MSUyg z%2j!M2aZS@WqN?BKK2oo${F4>y4D1_QAhBkHZ=6@Y_dF{X3J7Bag)g>WM6zYeJ zEfD6vmP57{&`(&!l0%BtpEk?AN^2 z6O8rK_TkEIOO8Ky%6S~&LJ(v4F$ly=2;ks>C}Bdp1O~0fi>YcFx875Sr-%M=g4%Uy zp=n${hc2@$i-6STGpY3%SJj#7!ELpgCu%d}rb02GG(x~M;)?Rq#(@~*K?D#5hyo*w zd-AbT8;|+e(B&UOe3g5R%9UbOeWobn0M)z>@wDbTUc zwE}HLq(AX28Ge@idoGkHhc`|J-!&8VOh3CXP|_tOuydz(XE=24x#nROf8WBh;egkh zQzsiIKyNatD7F1?y7A5#MNDXsusZ8+qXtcKN>qsm>#?zVsn12G@k&cC{K>Fyd{m;) zc0eQPOX4HN;yZ2u`3ym28No?2qo)PSk8Te?yF){E7|rTQNUZP%P1?X0XUjI(&i7=z z@IO6ME^H}ds%1wE6LfL9N|aNetoTtzi$dLisK)oIfo#h`;vTGgYh+EQ;Zb>B_O__VB2QoiZtz{3js^9u&qJZ$9i9$oxP{qF{3bjuYh1)`H zWBHN46NQ?$;9o+3o>uZ1`<8^P5Ij*JdDP=O$~14<4=P^ey=ro;&osP=%;5xRq^mhq5M4hpO^cpOoZ14jU^ zd0Rp@o1+4?hQ$_|&lxL-i#w|pCX969IRqrWY$Y$>Wonsqneru_8KaY|KrNiw)m*nl zF_~_Akk?7p@0Gqib*z8p9hCEm{MB@#VRm0hWJW|lqpSd)pnJ0-jOiI7+efEJ=3+tu zqc79DtZ4eGwrxyB!`LLt$a?#}I>592(A*H{_Xef18SnOLs4C%f67NF%4rwU-^6P$C zbyuG}xpu`7u(lnr6P(8zvs=`S*AO zJ+*-hq8l==Dw6wmTPZA8JV~t>?On8dGPN&I+q28!JN&mdSON&JmErb*s(V0Z|(@99dUgApW2aW{ba^Qh^8V6p5mErunu|F zg7kOA-}I61*?-eVS~qWZ|IkNoLWap++IIb$K4SfcJ`&6a(?`H|7XpZVG=TsvKHldU zF$h6|kMAJC$IyQVA7S<7FUTzUTmNF(6R|jrd zn{n+#-7w_$`B`)%E^=WQr0QT@>XW*9bTrsM|AO01KLl&&Y*6N3zy4Y-1Ac2g?mNxF zfTL#O?cuv_61oG&40kTsSBoz(?S8e_LI;#R@@VH1Bmn$n{LFtCX^{0C2+3PUImE+afLGi(%#FeQ$ z*d6mq%nC8=tr9$w^B5U7_$VBJ5r@wFsqPcOsu*XuMab^1y@v|DWZ1h@e}OI_OQd1O zbP~Pf=+!UQfUs0%qu6{}?ACqcFj%&eo}n50Dx}~Es0o5}#RH>Q>5Beow~He6&-L52mE7UEo->l) zCn4e{c;&A`PlgRN2x!#3R@kWnl4KJeX3B$FDc&MR#o{YWzdI8Qto>%!khq}1zA{*j zLbC{4_vgdAn7?ef(H|1&Eto`_hW;Rg{r*0{)I_gEJl7j##on#1X8T^2#xZoYG}Ad{ z8|9@pDWBWM?kZmK)pfAhI%Xd`f&WU8rgx>;yn%5`Q+QQ6kV>)%3XH_Rl%RKy1;T%9y%y2;p9;vc5-wj^s6XUAsj^&m!yGi#|^%^LFd2qY4tQYTmXZN~q=3^AoQ3TV+upVub1Rqo;j?Og7;p}(#M}Y|! zJ-Is;-+;akK+9y0mFnfO_a{O@x6zs-tY{BES1UK(X`VFXP_>HA8i@~GPDP(01PCy` z4l0Niu+%jR{n`8$=TJRVS%4^p1a0T4C11kR%oJ;tI7)6p{!C=W0lP3#Ej8~jbt>p^ zdC8Mq`~3@WnHrymZ^YQ_CCT^Tk|aITt#z+V?4Ir0e>^3@m#?}z zlA`!o(3&j@lNw2M@s2K$UV89%-tN@+rW%_)7I)j;`xnv8%J&yTHY1J`MajDN%jY|( z2^i?Mj!|aVUKoz0%eDL&bvfNHK4|A(WIa&RA~SA)n_H6l{~4YTf-|lw$x%vUO>XctO`Mx2A&WmX`G>G2*Q*%wFk~mzWP!JL=N|87>2e*fF7%mC&`K%$l7zoV5cwn&!BvC?bp zhGM>`U&3II%9@evMTX@kayfW#PC0UND5NLMmOKPY$J zV^mgFjn|c}-I~L7cwW75t+Fu9SNu|5iF^D))tDFAPnd{xWLc_KW_qufxu=1(nAAWt zw{OE)IPIF}-I9#0`(_lrgdY9mhO{|Qf6hFB4A}J;v%Ak^3G~#GuI0ksBcdjtvr!xl zXt%x+x1?J2i{5H}PWYWUk$DEL={s#H$p<=-rg1CcJ2Tqqpz|BhFj`mZu z(mG&N4;-zuwyQ-ZmEky_Ib+ikS8uJn-2g``hyFw>uPbRbDw%(n{)tv5f6I|llDT2v zr<claf*+odSG6xc^RJ%!mU3-dF{(6d5szaic8s4;3iLA+$k8a(=wS~l7fW6y4 z(aL>Ywx?(%57m&p7dTqE^a%|dt^D>kTFEr5Hj%~Nv?}J+&A~79w^<2-V_;MGK>==7 zdZq)b_p$#Kt)#mIM=NumqLtY&(xKApDWd=j1olXJKw^u39;Gk7V-%tuyuxuOHjbh4 zCgw-K7*koMeu^-Thgj$$aT0SsbDag-ZEk770QKgcmzvb)`I%#ctaq=`(SqESReOfG z9OV2Y9Rj{}E2&I#+`sqZ1p3Yr`WLGgcp=D!7~(CO2^kRyY)rK$Cz`)B*Ff`>cD|)^ zXRXOH+l!R=^bR=BN;w|s%PRt9e3!sZ{-JO5!;yejqRh)BtmGRs{9s!2sY{OuOtN~C zwh}Mc89egglNL0(gZWgPk9Qg-&WeVKnXyAB$W$QBl)L`+)&3rhgvN3yjTy zqm^RnX8(y+?p}18TC2rC`)eBfj#du6f{8d7u!^PlLSZZ|Z0_nrqUj6=YW$WWt_hO{mt>oM5@4@LD zr}bR@nN%Hs$qlT{8xw!M^MeFNeXQMyuQY=$HtdVQO%)^6DU%!b(1Y>m?=Q*bB^aDcB1J(U-g%y?yz^0;D3+KWx`33sJLmC_GFK^QpXir(iPW=)yJgtsqmT`US~ z7`82|8t;-+=?$3rZ#lC#c-|gHk6bm#4#_K!GKQ`gRvok2JX~b%LCFdWBm_3;OsrpM zr4b3Q?M+kao||wi*|y|b`&C(gsX-f$EEl;kRrCIp3zRE_@-4;h^F{6AWlGBBqT58( zwnDJi#|BOspuvuweyg@McePSzq0hf;Tq`)3AK>f&Ih!Tiw(bm+8te~z{lPYT$xy_( z>eMbppyk=12@}I?16{ZL;q&K*h6b*CbH1sEHu-9<=IT_PM-9^%@*MqWtb6b$)pcC9 zklKB2aBJMqV?rye>cFYcaR1TJ+}D}tR>oUYV{0!hFxX<8yc;zX?|L>SJ>d zJ4b@#2iIRPx%up76R7q&T1#y+Fg>;|TmznOkKku2UVAPP^XPc|LX|>#7*6+U+4fQtGGoz{QW%?#FW*~#UXtXOWN#KlmtNgkkFZ+em5?GuA566o+`{A-}ZxFq1`P2v4^ig-*RDa zd~%CdV}D04k-^bR-j{Z$^2nC)@h@}aEEAuJ(T(Q08u|{%jJkL{%eaj8B@!Y?UrQP4 zTxV0_=+?ZvO3(@@6x3N-&-k%G15<)HMHP#mn3-r_YT^px;ODJmN{)3wOE6YU2iza% zXI+jqWc}Wd#`HX4EO0R)-d#B{wclxiGK?4_hiVzx7BO$?zq(5D9 zIRrrTr}*26lTb<@vX$lLyq>}#CJA^kA3NR{z0(nW)aAl`VVv#~)@LAlpat>?r_dII z>pf2nPLX}*vkQp+#OkdV56!QI3Iy{{)i^)$a-In>!Cg@i{1^%h+={`)>)wlQf`1qO z=EyX{YgH?xA=TtqPRi@RI`Hy1I%`cqRCkWS(U^Nw`{-U%H4@K!cN0KnE7*D3(j2;Z zf7ai+l#h-K+9SeD=m0UIo30A1_iUye$>(}c3!W@Jwh#Lhh>0_0_h;jU1C8}1gYkN3 zmxX-idY(^|Unkmid>L#zxPBbs8o}PFRg3PE;UwKU7PC-ChTF?sL47FMO*2SO9-6Df zeK=oUw_VN}(mFejtav^foxAnb#%$UEwd|WOp)R{>ZjZ~1jefmSc=M|(9+up#sd@_S zJ<8{_@mjgn8l4`Y(;}m_t-yRsCzaG)-vBSpk0E;`ZB~z|_$*c|0{$MgI`6xWmK@z@ zV*?ce16mO7@y;7;+m5{8H2q-`7Fpq!oonw5OZCyr&z4HcuZ*}?eC>i(Z&lO$4D$;Wom?z@S4>)y-0Nq&WnX%HfT2qcKkiy?6A$%| z9-L(c2;Mc>l6GF+7U>->8f0=FTsdV6UFZyFqv-m+tv7XJ`u5(JU1v$s?jw}9dqg?c zhJ9_y<ShR@>TW!L^KlIR^B7Wdm*gqGmg(*!n5)4UfonEndJ0n>g* z+++06t5ZHh6NVB$@`2jYwK(AhOGkTE&T^~spdHnoSD!e-1=Z<`S$x^khb4dz zzgKk8WrUtCLz2zqOA3rEmO9g(rz;jBm zJ@~?P#zGsiAKj-{3tPHB|D8*VY{tzTjB~p`>Wltp@c+>?$NI8dM=fD&?%?%ca0v)c zcAd1hdlyAT6ocOVy(UaGjPv&43$)Y=#{MscZh4ed5fxi;>mq4=}hSsBbTb0kEV~PNpNs8Nu&$<26HBAMs&z%A>M>(Xn{mx z1zSd4z^S;D?iI9ltJn1RYREDQ>gnL81idoR-Nc}qdeEK7-}jW=cuDBQgBSaeJc7&bVd9wG1lRnX9(}u z@fzEH(Q@&0&;-<;eK9ro<^FSN4fR234t^4uYh9D|W&*=i#5vDD)oCyG4t(4FPoR@f zN&Ro2^TiZ!gRxW}Tu^pSTgCd zaLZE0>N=j<(x}*jD~tC$1i&iy!oG``;L(lzdRS=6 z{xD_o-Qs#s=jo$HgQ@t*g_vG4wK3AT{z)ZwH^q!M{PiUN6s2Cm<%i3_Rv`!bAJK7G zy~VN?PKEQ9`k_M3Gh!y?S~RZG5w`__AJEQ>VO-O*%Rqhfw4~_pti~^KeZpaWn_Tfy zV0ZL4!W9ZZxQz9tg1`tD^_~}D^qYx42p7t4gsV}{v{&lQ{r^O`l8m^X>D7P{u22ZV z6%RqUO8y{RsGA0Tmzlc^$|}*n4X%B#!S!ICGovLoE5ADZ$KV3~MYu|SBV6@*hQAT6 zd&<*wuguL>z2fUbbqK;0$a_AO+<(>(mbNB7j8CI5d~fThax8{=n7H~G?><;mOo2aW zjQhCEfPV^Ak~yvk1^Rd;eULfi>+1>Zr?TkqpR(u>1-LBASVops#M{vRip!Js3qBIh zZLqj=6Z}$k#t+eTdxO=kC6>VZc0Kzp1&3(^ZFv5YSx_qqI4ye6D3Eq!bkGSxKn1Wu zw{(K|P{CuP_og5ZQ~)WFbayrj^MhMDGZET%4Xj5f9e2uktxI^+3pP*{DtO7Xm`=!Z zdIyP(o-s09pY5Ae0{n4htZQ z*n~hLBKh(7Cn(|_6#>W|3-B6B0hEdbo->Jq?y&%ZWI|D)V9O@P{J$+5p*zDT%fjJ2J19kQ7r?Zl%_}SiJ#Y+;4)Qm71}&b^mGJVQD$^{ zCfu*>nrRIdVnIEBaT>u-C;OuCKY{HylR$jVDJ%mk`W=$@>oVVdY0U>%em}?ZD}veV zX=)S0?|XcmPnXnn?8VQawh&OUGXC<`+YLeD*$`$HU)oNoC-`oPJv&ih27HIW@3=e> zIkiOV(`S#;QH@BhznI%pHdaocP-*8x5v8jA`CCqX zO~f~vW1(IqCuKT)*^g)eC*CLVL}IY;s%1hGRhH%#3Twwfn3*uIk41EgIS7=oZ)WP= z-o4TD;W>)0(N98Pso-R~2BJXDd{%BC4H0N4q}}NN4qMzXUjuqD+{*iovRVuJt1OBB z)CyIQe%A`&A+`VAoQLaE)Y)0-^@l;EmroOIom5s`P54H6H_U^ro4Bda5q=%XuyeMLHIKsIF~9;PGArSvBa}w#NooCt7BXcP2*8Z=?;!5w|#v*=v zPt#zbREk0>q_N1bzLQ4#x3O3npl&|)yRoPaZY=&ZF;=d`1~(R6k&_MH>bpzV?JVy% zc8F-WGQJ&k&Fam+0DN_vnc7xoP9!9dntCT5VT;yS4ao4N+A_%MjZjK&96@1+VF>M; zXzmQ>ElJ-le4t6HQ1LRW$F?|yvu?>K|6)`$qF*6p$dZY@!y7@pB=?+YD~SF5i$H!g z$(5#We;SLE`xrhv?w{&JNkc1l#U8d;S5bcjPW4wR=9{)+3 znfPj^@LQW{1Zy+m$LHt}ZN}7PM9j;7DrpF!&8&nzX)`)MpR^fZtb4QY0Y;Uyflr&S z3ta94$xeyF-t+gnQ^b#$ErG;w`y|X=Uyt2jS|V}{RBR%&6!pr1?Yh3h%?R!zk=TIF zmAm8B;bfQRMTcK8_B=^b9Eb%V0MVh{7IZQQ+S}`-d|yxAn%C z2Yp!c(ymiECDo88Vf~guVP|&eQhf#d^n}mw6_sB={l;fJ>;B?15;N}}WyeeT97K*S zfnsG(`b<%2&WIPaV{ISrt$$s?z0=~&Kd5$2jnBNL7GqeQ0-XOCWn7a6V7ra~C%WQsR(I?#nTu z7lyQMHH{t#(Yheh>;|Evc zDXp|e1QBoc!Q#!x{}yi|AmWV|H6iL_3@_fwVCnt~_r{6xCG#t&1NNr%3Jy|dSpW6g zd=L#WfE>DI8zfB(u+n8p7itVndmlV`j;f@EsV9QXQI@%-()@US*An% zSh;jjYXcCvgT}n=a`vdiIXwwc+51LG+=89lXlK*2h0eKN@ZVGndQc#QiZS?yiZK`d zO~qvYHx*+ErecI>_~RaGd>VJ)(P7R}f%eQNt9FOvz@3C?$r|g*`2C#D9<#`vE`S_P z$ey=NnyMs!Vsq=&wII_uMqw#jk^X!LLqZQ>*BVyKTF^oT{9YZvagTyGucpMgnK-Z} zkFHYbXnu3ZYMm-PNPJ!jSShEPDD@sozx^zc4W@^BTOLC#l2IS^p!iMiL!_Jw< zgHEwLsC}_hCAbCkI6pzH{IIvtugU1Uhm)}HW z8#ACV9*m`kc~d_P3zXv@tGYzZw_B1qxkr%Wll27J?_8`u<22Cq+IN379ZEE{%G{T8 zR$a?jWUYMWo?-RHPa6njD9jvd*0GXz2~FRKvxN@3ysI&U%6yGk85ms8yxak2D|!|X z?~^Brsly^7Yl*J5nd4GLuy9jNA<1j%7cf32h#+q zp?nQsosAKB8I2iD`1L{0Vi@xx!KY_4$y)6fWEKnGDUzrb?pI}@Z;HZd72B>X^?~J-6L8H7 zJI&r2fM1MiiGlysWz!u(W@Bh zX3#NnJ|`Bz{dH!T#YHvMlEie&^oEi~!|)qjWG{)N}nmfp7v#Jx%o z@<^ep{3%7p{(4ii8qdF3y#AW2Dn2CCjO81Z_F->hUKFM0vkWT`x)?1naK*Vk|1>ZX z+wtAqIrV`>79*m2aQ>;S8G{o3nBfN*k+jbuUo#(M<$FF?3`rB#WVrBuVnnV&0`b;P zx6w)Fv4(oH;6f%lpz23#SL{k@V=sEK$8*DL9eR*fmh^_-}BWok&yo z+R#4JA3hunJ5Cb%KZ72SF-QO>#8QtanSooYR;PXdz2VVoVY~2;b2@RGyC0#RVaX^7 zD;BeLNyccAiIAW(zMGO^9-|`%b|9I5 zsESj(4G)38lpaGM(%66zDhu^j@L8Mu*$T>E{b%c~<@798@}!=2$q31hj9r+tTVHL> z9V9t0C$ZjxY61$+-o=Z_htiX0h#dprE_g0GFvm2u13bG)>j3E|uP>!LOJ|XAxt;@L zCCOer56(~PdSyKIeOSFqgvpoHza;>sPdB7XT;8+^7U@*@{g1cnikiR+QT+n*u@eZwCMLQZ)ryOb)!5C3E-*Z)_RQUmdCmNJ0+k?~bQ%$cBwLd1rAH>I|w`Y&@i z;o=E#(V9TPj8N)8c!dW99vb71Ux$)L%e(WNfR%V3GA2bveq`p8c0|BQX;-eFU+Yh%P1e|Lr#vn`uu+`g=w(~Yp z9<=eFTm?9;y(E7f_C5)z^PpW9$)Qg@Nf>Ro5BS+8LdK)h%e!0s=@7?qIEp!=1Q3boe) zE&-CsdSr6hni=-;S22chCFj5fEi+u74iZ!L`(W+GsJ{9~nA##2?P@n- zKbXiV<}pD^)+2rs1?xaBFA}pa@?*Pg{`FZGs5URPg>N{p=$P*nJK*vOL5}X_cIs)9 z_I#3T%VMdFK(Sa%N?NA0;*xDobX()qPi(anW-W;Z`0{l~c7L9q1|TNt_oM-hW|>_X zqT_Vqj7s2oy{Nz4pp6W+cm&Hr;kT@v*;$X>Cd%*Nb?As4a*yG^c_!d=)<4t1pmBVP zJ=RMRZO)9?s$TufbgZhQ-@}#ITu3I&1x6b>|4oR-#Vbb-Bpr-(EteEyMA=AKLh&R7 z%CPo=4wrM0v22$VwP!PeUcqKSYV9xAoX_dTJnTCplA*4jJ2&;~>l(CoF?hge2#x!g z(bWijVc40PIgKgXpw#<8qPI>ESwF}OL#S&JBp{I@Rl@iKgJnNbZffeoBkcVQ=XHx^ zb9UuA5c86%I?b5quB*dzprmTuQAWn=b9qlt(qR$R76z)j_B%`!D);Fo;3!^~d)%w# zGQ1o&c4|JN$zxBY(3{a=%62ZwU+`lx@7u_~Zuxh4h=A)l>}?Sx(7HlHFl8Kaq~B77KT^0m!kq zKJ32xqBl9uyZYl8haR?p^Er2qw{l3+%4yAt^B@LE552wvogi14O8A@FJB?<#2kp@= zve&`uaIh*nB=jBFm>sbVMFwM@4emK>4Vp?;HgR|L@2P}R)Si11b{JG!z3VfH^O$(o zC&W9i^pvku$Ng8nGWeI!Q@%3mO`4fW4sB69kbj*X`hwH+!m!(f zfsi-)?JL*?+vdNi%Sv$SQbYG*;S1>1+)8YNXJB|oIe@*~q2$YUQc1?~`?x&USLuxted9cc=JR$X+b(P>xaG zk?v?W+qw$d%Y^gv)+z2w+{-EBX!q~>-zKOU5cQQ6qLA+3VCZmJA5B%afv_&*4GzXZ z2A;H3z{u7&!*n`vG}!eB-{>v^J{)ls6g62n`e!wIt_Umh>FVc?T5&kX7uZEMsl~iX zqT(s~F0W8D2aaG?{*7R6{u99*fhf+Luk|2u+d$-Xm9M7Wb_6Q`S2kC*>7 zTgq>$yfxU zOJ2*tn@8>G4?GD)Nb@}Nb^PWMn$LCUkS)WdB|1^`NWbe>#!%%(+k|95Mwu^8z@toA z3+tk%Q6^5vTEEG^Mww#35y&djXIY4qj3}Bte0pS7WrvGDMnM@)VX1jd1c`Ugu2)6H zcTPm_jLMe8mggnOW$Nro?8351sPAkRIVZ%$Lns##V)9oNv5!_i_*=xXjtH`(19($OBIM3*=L}Fs;-JE*w~x- zrUH4EBLz*v14l&=n-XhA8-f)KHhQ|rvsC`kx8z%M$%$O+P%|V zVTjj+*sE;&<4GmLcWaOGWz%E1zPAxbh7WsVP*&3n@w?gxcaE-{a;`gYk2I!KkmnZC z8!Y>m_iBBP5+GsS;{rc4=I~!TH%)SyHj#Axu!!K%kuVPzZhIUFYQ3f8K@`iAJz;6u5s1H|l){Ut zz?Cop()-rjh$Ub}dErd9A-`Jd0qNXPMnSy=9o|tYLd}4L?DW3mz6>h5NEV+cBMaqJ(v^#^Ad5 z-;$|_ZTr0Nb9cC`B0q+j_r&3|tgxm;5!oatm|c&1>tY=^Bv<5T&mhnx_1&8L8r>9m zNlL<7y?R%#^g#G-fPzALCJkJzw+hi<`UU)S;>tUF1*9?0x2EDE&ZLvKf z`8#|>I?9k!+Z19F2xH1qFK(W-Xbg7BT#sStyDCS_+ZD!w82D+u*8nZ+vyU{AD4@MB z0Ak?(uhm{Tc(wO;vy5? zo^XJ9$D=V5&Cikq^V)lzh3KUclD?9t^|a+?k@7dHxKi}da$lkyD<1C$U=hK7R?LP9 zo1x(%orxg1J@C!T=dKz?uG1Q69PwLxu~w$`1G{i!uV&>6D5CMb>7)1Q-l{7#gp8}j zdX*VO2_U&3A-IKc%Xqyu-%teCWQu1c=LA0I#^nEBES*(YlwI3EN$Kv+p%GBJyF`7!i=}c#!Vy?i5hEySuydAK&jk*#~p{T-WTq@3q(RZXU#WTp&l>MO=+t!1?l~ zTw2arg*rsmZE~($k4i5FQC?M8w0ldO=2)j5h|_G}Ix*eTBg^ufrW`BJ8%e7s<khO9%n5#O-5q}eJM4K=2?uYbPB&j>rA72s}QX+kgNjEimC9xn!Nc@ z0!;|0Q14IHCMwQL*5K6GTa?I*%%$&3x?0bm^4#s!`VKB59s7P(q%w2aZ#_CT=4cwNmDaOkL+A9v#gkY{Jbve_01X4L!xOQHXwf$>^S3vf>5xD7O!e%m zom$O(JHy%1_t`}V3@N;I^Z}VqfXu6jr9;|r3kY2VkqDV{tyDA=+OwopMMgya2Y-WoQfKURW2BQyEjBDA(8k^(fb|)P- z_07gcuz#U+&recQky?}c-Bh&bv5QP(nFhyEm@{qfkJDlnTj-`*zmQ>To6A;ujieAp z%STf%@=b9~o2pRKiB#UqLs9HY;5J2V>;^_b26n>xlUal`6H~fPS%#QS%XIAd-&%&& zGeKG|N48&H{K3QJ1X;K05?@{Z{?&o9;BFD}{~|2j>VI8FLOw~a9`p$sF06*LrS}$62(mCz^}QUSQ?ty! z2!Xs1N<8pq5hWTjgOuK=0R$*-w!xy?fD69S1xZC=GQ88o!{3Pa$#y?$>NYTi}Y5Fam%03^sAhushe0Zif@B41^E{?QQ_F6%;)O?idDf% z7*9X+b+41|tJlYLZ4%kD?`zU>*1aDd>+UR4EZ~RL=?{%<5@vz{W0cT}5Kh7@o*BRO zcAM@^ zFt(Fpwg0?GQ}?ZJq3&;!R3ZRJl* zD(vN70mk=Ho2$z4=LN7LcNN{9Z47qzIGNfc4GJr>WY$dg!sdOoVvCCpe|q~Ic+YNp z+0P0A=ypaD7@u{3yq%E>v(@}odF)LbaPdd)wO(ME^vERmB5NKO?{bfmIPXz(-Jd`qm&sTW#c@v&gg2Vg*Us(6u zD#b230u2LU_rb#-h*whu$dj3Me2Lqeafrc)dt8XYm>nt)V%9cP!vN>|sDXq~MG7iJ z4_wY9{*cDMhu3uC9*RVYG%yel&%B@+N>AcXZ&%;Jf{Wi;=O#U2#9M_8c~98IuFytBfj9Kc!S>$9jCoo|6C)!5NYuw({z8r;G8;XZMT8azLpP61g|%@VLJ$QFZfq zrWb*JLgI;N_sg28zOm>ubP!_Qp9OU^48$=a<)E3eX?0+n_6W&>XhHpzj4zIs0epfg$ zLuMZNqT9|lJD+(bcv~p+*)6WJ^?h+zP2S(~KXBIPGHFh$()+zcT@1)<@D0TlNbY8B z);flyYyG#E>Sr$CPui^36pPxg_inZXDcC(HB)tB#Xc#vyVLrMkK;+jIi#|W~WA_u` ziG|LN%h|?xy24e6?nXrx7@62+B1$RHJN1`#eh3OWIWU1YizhDsL3~8<2jxq})VvL< zcfgEV#mAq~xM#EC8Ta{TNIcOW?`14WVwer$?d0rK*7AwKE2Px!^HmbpQ%5`{17WM% zoeBZNC6ej7pS+-8>ft~${<}de`$P&CF874EuLeIaE2I(pJG6lm7 zF5c++W9X9h;8b$&{l%GFY#*plI;}VyG-6LQ`~a0x;1eW*E3mlYB48%E!lm^z_$efao%G&VyRUVB6jW zcVWAbNrp1xX<(9-hSl+|-Z^295=~kp+zto~prXevbc@?H?8bgTGhumCOFua1Fqm3oe|5m*7b+w82+*|0W5u!K?|SUAg#77}3ASxwXsR zVb6_HL52ie*FrWN@-s)A-bo~U+G(8p?wyI6-E16bRzGp{&gsL*yv@Z>`;owCC*=h^ zKPtA<2|}J8%zwm6DUnlzXh5?Lx%aHDreLy&YoAc_BHB-09z>SqGTToT!g%?|#AnJn z4KR5LX|1yr-*;{h>V)VRRz7!4MfqI}8lfW^?Ofk)||o##zUdCk&5O9H&bJ z$X}^B+99#ZT%m4&h|w-$v&U8|LgqS3o0f*+nlHJqO&)vCt_+(dYpePFC>{1HCh z#YG^PWxd^Sn{pCG`Y| zJ2m4q&)VX_94#XqB`A_Pm;P8s=CQ!B!u+sL9c^ka{;^7(*b!yMY=b0J@x-0Us0^au4G`w}w~29MojXb(UMXeA+c20uDAbv%9DliGz%9HemGjJLo21@HNTTjJ?m9d&C0 zu_z5I(Gx^AA|?yLju0`l<=xFUMI zfr$I)O)a!P$+A~ctCj7Bf_2C6lzv6LSieOVmRW-4PUnUf>~@dO=v;2+6qy|Nm?%U8~;L;V0mqQR@MA}Rm6DNq%5BQuOi|> zu^#*-6MVqv7X{J!nO;`X?8GLt!TeNtLeHX1(urjQuWcm4dEI26|<)-B?Pm~i@DU;~MS0BfaRDuv0c_WOMWzh}xMUx))hI><-}T?0#u*Z?ayfLHbOPc6nfB_)f|=iw9Uc23Z4ZpXf-y(d=JX48wch zG{btqTX)}#Z$CJe8@{2Srw2+Y7K{OFSHCGBul1G5J3X)J-%1Yuk~E!?WULMa9We!)si&L? zwaC=`@o+J1aae4;A_~C)92W2hz_9$X;f&rQoLGFS^{l-g6QpC`Y-Qj`Z@LtXOuboY3UCcy627(@Q~ynxbk0e(7aSa zh%Y>9iB@lByE7!^I0w$hwz-u2(f1%bY5??Nvv23c)>8bJA|=h|%?=lm93-1*`Ij67 z7dWd=ZF`*DK;TUw){A1avKa<7n#a2)`DIx)F|wutuA*Hd#WH1=S8;$-!K9%rix~Fk zZ)|7r;=DG3Y4LWG82ApINcoyTikwFieo8bV%!L9xxMA14rOGbpxTIxDnme`?xdct+ z_n;9V>lolH!SSfBoISv6vJ7Nt;IRv^e72f_81GI^o_wQ>v?9%CWdB?Ipdz=;G~TEK z7ZbxSX|MQ^MxqC_AA(DGZ`~aeIk`WsHS%q*Jowoi27{@qltzzcwxxiKqjFh2=Wb9G z+m%l;-x5n-xC8}Mg~STJ<_mXx@h4Kg%D4#OE+~S?Ig&N$Cdfd(gaLM5e6RQWik+w4 zXcyna-mUE|E9xPR5L)FvbI=!8Zp}Q!Oc>(T3xS4PNS?5X=#CYjs z*!DFd6T1Fc=XQFz{{fV*{{fUrdI@w8fKu;&0HxbMfYQ(o@b3gk!OlKP18>8)lt8!u zB?&dgE>3;i&1FFJLC!ne=a9NgY44sH(G}$Sh*MkYIy?uU4xsA-QHir&^asauDIbcZ z?Gl>~hrq27h{WB0$C_b?Ymz~X{_%URa`E7FI8?yj`&@-(%q9bOj5m`Q%fXy}WN}7l z;agw-6reoL$jw`~XsDiJC{}2hMWJaJFKAcqCvf+r8do^tpg4;b_HAVIsjcUMn zA?QzE?fH_8bV3xz&HogRtJI!Ktl`Ty#1-=Jn05J8!zuk6&bnvf?$fQQ=(Xuyy}uj@ z$Im6QJ-_{-FMi=mD!v$zNm4d6#I^3XW$}pv#ee@hiu-(VyRbc{>*)Yux*;2_x?zkH z-Ld$mBrOgWb{$M0>u_zW<0dp+&@SD3%ed#(iK@08wjh~P*|BSGV%}kJ)EQw362kMS z+7tfKvDY6;zNy{0vMPWR{q3gwI-`9o{fc7Th_2$q!1LADcZ->ncBqpknWBij<>Lt9 zJbss>y+4vPcd*nn_i29+J=dPN|IV~9%@C1b@NI^6_?tE?&2d9SYObr@S#^u=Yy0@* z6Uv$7F#Ncc3`M5G}h(3be1# z5P?IvQ?*m$BwwncK?e)F*CuM-=^1E;uMGW-`O8y32qviUu`z`icctqlFHE&)ErM)y za1$&A9cD_%BY7|;XCoDV#H!GrPNfGl_>Txe1tIGd4{U7OZ_0~|ZIS-M!iYF5dCW~bPTfjM;^ z^)$=-8xisEU6wNE!Wc`e<@2qP7#Du-B!Kc8#K=63Jg)S_hGSxZ3@O_!s~DPUnpQiR3%@uhO+C0cd>oI6f7bJEmA8C13?o6HPtyLi{%N<2Er zJDV=40nZ#pD)13zL8GoaJ&!WRzb@TnozP>AAJYpFnQxn?n%UdS-Q!)v#Ta=M!OWahUJT3KcTUn)3?>mAIQW#11{Ar6sxIprRrtr z)CDT*cXk)zPg}&eqcIpyI@{sH2T02M!Eg<1^A+J@_ZPlVr|W;!c(d1>^#jomRW?q? z+~=fL-uc}lQC^3iJ(w_V?|=$thkp0=>HV4^$v`&sba{zenK>B77sxA_H#x?rul8&d=jLz7hu8*_-cok{!}{v}VSU#(RWLD-t}L408r;M^KZ|X>Q#U3}VO{W7PTn;ZK<^_gQayIhHIO%c z+OL_XlJb2g?+uh2&=G(+RJ#^~lZ6zAgEojppD=T@>V8Y~O~+*8%IT@jwCYoH*kk=i z@d@8Ioc^Qu(A7C%BLzL_kYro+$UKj|6hBZY6xN~En#6*Pjw zVWZyO<;zBZqC_K2lb<4XUp&%3G4_AF7p*SMd2w!mJ(np5>bG;qETMvYH%@xQBqIrK8<)i1C81UJ>z>Q|r zO-I)0J-dCz5LNG+-js;fqnGRMoeT*>IMxtwFw4Po@aFWBj{O&zy%AR|;1@~FiCu}& zRlgCFT?3_@GX;B|bmYeY{Emc-p+EmWuHuoTyp%HHTIA&SDOoe;nuZ6Py-SRt}lleS; zpI}kgYcPO01OkC4Jy^n11cjT}SOPFo6J<`8ce{4|uzq0Q#}Yir7f9+SP$QI37gyr#zsHnKhUmg*asn#ghJEhs^EqOYLD3`v=yyy zGrwe6iP;z!zxXd2A^&5;$^z>y>WvCu99XJ;@_P!ia^Qf+p_21deI6iim~v`0@z-=!HR%hpz$8)$#eNn8J^Tw3xqleex2WLvS+#V*FqJPDUn4H9RZ2nG zCXo}|ua=CmD#Zaw-G*9%PlhPyO>}b`A2yL1P7O_vKPkB+onqV&LkxNFMT@3#y)e=Q z;i#H{j1?xZs-7#$eS9_3(N&^5+1<}GSmmvKHE@G*pkmP-C zQ-iR0yL-$ZI5#wt{29S%#Uta6 zqX1SkJqe!02tMa>5WU-csA}|`M*r0sCMZxA5R0ZK1jdA@P&Mxe=@gB^&9k+4bQGX# zwDZdSdOy~V8B?2e{W|0AFi5@eYe{WcaN3*qDBJ%?`<+<8bEkB}vh4mK(s~`U9zqyJ zm!|lCwEJg&t3#j8)Q@n2Z-WQ04r#t(YEC4WKf%0cYacWer?=NG0tgu(8n8N@k5=3G zVV@5^+iK-*e#;!4z~Rh=uYTC$_$+k~0R-#$wXe0}LQ@i)qqr44Yy10-=MEz!rccb| z#38AsSLlz9?yeVZ^DG;(uM2q131^%vgjL{029oM)T#3|CFLQ{XBbgA-FyN?DFTtxOEtbQA>RS0tbkM- zWl_2{AOz3NKZ0jg1^7qs9GRw%wm8pd!UY(eK?oihwj=U}jIz1-o0i}gD4+QNO#4pP zA0xl;N5$BiqYrDAB)k^LBv!M{I|nuQ&~buyC5ud&BR@qvaZOzYa=Pl`fp`SkhStwu zW$&FrqWcV?=@r&qbtBg9k*roeW29>P&X_{Gu1AW`2eLzm!$HQ zzL;v*R4j5P1@ks9gAUqR8T0pPX$Lgv6&)JD{0xsxoQbOZpTi7qp=eVHk+b4UC3g-V z>b<%Mf*Y5(kjw!vXB+!d5{T>3F;m07=m7*i%@3Q$R^+A9{s|MBz=wFrW&z4<&mEghadq z{mPu4aUbIah-H21B?86m%+gYJwKnj@Xji-8=smipX2%Tvl0d3O>AwS%GvolZ)qhTU zG8?%OK@u>;Si`0k0ppHj7NDk&%NDIxuO#MZ|7j5i-OcbzRRW*XhU}3 zzHf!9eN4_zTS7 z8edw(mh;_m*mMS`^L8^7mIPSIE^}-HEXc!XW~3;U(c5-mVv~yu>$7Mz&sKwLS&A|6 zG{*TQVg%LHRXz1)r{hb0MR#iPr#*Q>ZgY&GcGYyZ6`{h>!!^1zq718YhLZK5?fx#Z`;P;m{>FDKjA+ayPd+U=1$$ zUKHVN8H3)baA>Z2I?d)$X`C^zFH&Z&-2sg+oYP0@8ouxH#?+tK@YUopFfP5`#L@K^32pg2xZT!6a8 z-a1GMx!uvNoe?e#k29y7{(vU1n}@q-FaAIz&Ot6jeWf002hRNAW?TZQs>@D=5h4!w z&`BQDA)kLVW9o$Nco|>tw-Ig`6UyP?WoUa_kqBAlui>C%#CsQ zs+>nJwGuxKj|KXy8jq#jEj4}cjKj&RCw-hZFo$>DT>|lirEU|w=Pd8Abf`}}kl7+i zV$2MLZ$B_NaNTfdiR07Gi;*Y`IferiHmlCbB!a4)XwzX9K2 zYGUvvtflE3)0e4Yj-rN-ukF$`NWkt?D$|SJ*$(UQ1dS-GM*ndq#`6Kj9r>2DZ46tX4;91?4_#k znkOCdEg2;x^bQWKc@a!HV7H?M+Z;y~Q_kGv*imux61>h+f7LAowSLScW8j$zp9pMl zN0I)wV5QHE+%nTjNNqsQb+gJtLdxVMOB>r+%8?98((0Nl9E~LyF*58&@6Twg2~L%! z5*tvzgpvR20({Y@L0$L(>G{t#;IfIfIei1e;Q)@ zs%_f2`GJ9ZTriFK7ey5RuRC6TDTATZ0h4^^T-BcpxVAu8A?Y+wXJXygqLX_CE&JT# z4Dl&Bjdp__q!)V(I2X9HKgURo;KG?%e4U>=QS0oUg?c~Zvv?DH=W2}FsXSEcMqIP8 zzWVUuJ>$UBdMLTm+q2~|45?y+tiZQs*9-nHje-Hq-7@=-+l1kF$=HpW)dM6B1KLee z4?m5S4UjFvzJmg8&#bjQXB=S| z30Dfx**?&G(_CNifKn6SF5Yx~=x;QYm>WqX=DwVb?>P}F@a!GEd)Edw;Q|X?5*qC3 z(v;T|AP|d$g=L?}y9YGoL;1s$kw`lP)|ejWZf|_Tb4#DNEAnXOV$^*$O1N_nwL5`i z05dP#ex;>H2^!!V=QdslLeyX#$K;BlE2$7Q*vhuMeg?AW$*~r723JkW7j6A1Z&5uA z*(2x!8D7d4BlD~l#(3NBS>Pkd8cK=k(eUQt#4tu!f+Zu;`QMKD#<1kqZE2@mBX>95 ziSTzXmSBd|N7rGeofGEW)5^z+Vx5=wgZB|GzC$@tO&RA*7Y#;Ml`;{IkIErfz=*Wg_V z4B^x~JT$UNdX3B}U5Tv6xDZ&nUP6NM3j34EkQ=qy^iSfL{AQHoJhiOIkH5LxoH2|s zNIO5{y(!B%mUU<++) z=6|xU(236q?#re}veJY+n5}9G#f3R%w5A3cCju@(s2`PoB&)01HgqAaRR5W3DO$8w z;i{hiG#>*&QgLZmQA+N6{+JB`Xjfqkk_cq-|l&x*#kM=NS`mfON}8! za$7;4eQOGSr^8fE!6l$VOhpX633T{Sk$_KA_}(I_{aRaO^$ew$+GTVvh1h}3l*&FX zv?0&f%9dqs_=}g759az)G)kWZ!M~?oL(~jY_95afY9r3fKhh66@q`+}r#;n>%W|!w zl85~2Dn+z^p*#FYFRx9-wIKV}55IH1Aj`i~_DIw5@LDsEAk7gp3Eq!QL0r0XzyoS> zU}^nx7B`ZA+Z-h-Mp#Jx8mk8)PZ-~WP2s)`b4lnnRFtXBuOAVhl{@`U$rb8eL1zOG zQF5sjQeizZGE9{H85tU6UuEsH{;nyMDaD@aQOwP{l@Ox1rbKQB;dgAM^+&8riB1G~ za-A3047Y!edQF@hJpKt1UaG{vXe6M_lpTT?xwbGIGqj-vMG(&0Zr8maBc;(&v^j{m8@hF z<`5Z;zUFJ&sp!b=7UE%Q{gWpA^D#GZ=QZIuM|QpU=0&E3?eJQ|e4GHW@Z&>_-#d$Q zWpacc?5BA!ywOkUiLpo5$+O!pd&z2L{a7&b<)30Wub})gP|m%%yVl->3Dygnp(=M_ zo{!PMPHs=vmUTVP$qsSay(O4Pr^DTB-(;K}3*|hg{4;&#J_{Npa6N~PF)!tRIYQ^e z`$kc-xj^Y~@@;!#lRNG1Q8@W-D&MD7jBJ~20gsYBSjF&otjFh1koLN2|J}vxVjPv%a1;2b8 z5uX?LMtnF;5yaSNb!>3by30hzdqG?>8b2}$5cWe#ML`(Xwc~8#@enl9u6pG3cA-ay zp-P*h{3w1eyn~S47Q}8m*~Ck(PKW(HkaAh|lldX#DqZPRDq=gQMMPxCnOI)TuU#1H zNEQrOf?(UR2j90a3VU{zwgN9iX7JB!pNkjohmF-!R@+TjC0(vS&PobdLi5OvyHTHL>X0s`KU1;79L6c-sWJG2JFONS|s52H%Xt501=+9+& zy{_Iy4d(+E`i>fb>kdYG=uu!?pOO$fb8?aS{P~!EnVt5@Uu$5t?lPBdBbviiIv+_I;p&gOreNyDmWFGXhqLQa$n3)H zX3zc@#Gx1(S&hp76~Wv=qc?dRddQ$$OTwZ1BvlMSq7YT}Ks`c&_1h4MfHX3=7%22I z8T^J}ZD;*8jXi!Yj+WTN_Mxf2tP8nw?exL*0axFzKrKb8)oPr@-l_hy8VNtiK~1AY zZ=wo|eWdpFQ*Q8$YuSBeiTw0^t8{YtO+lx8`@zMb3yTC9p+GU(Zw-V`6@3+RrgL`H zNA>euBA~x6;{{O)HA4mBa!QimoRTmj#XJGt%Hm4GVA?P^U5Ou|aRMNsz6)if!GT2> zj?jgSILMqUuL5GxLcl$@Wh&cPEF@0j)@F<4qP2Fr)RFknaTSww`+Y{P)Nm{)<4(hL&rlxsgymXM#8gk3TBUo79+BPE) z_w5kiHxvfrMJUein`{_DfU@ByE_kN{@2 z!|Z;xop!YRF*I$8j+`=Qm0X{u-r#Bck&CRk*Ah0IN6AEnibi6^y=|tXGM~{YZX$i$ zr+M>_v#)`jI;;I~YFakr;6jUp5$FjeXcai6Sw?vALTgv3LgVR@;EyqOJPf?e(wbVX zfL}(izgTfM#kw%Mx{>tOJ2$K!(VsW3(sr_FkLe4^tp3m&-G-7n$JUOh(*DXUA@%n> zrBG;$sB2r9>sQSP;3Rxusc`xOqMU}2FG@w#aoN)Ieqc@sEs6pcH1j6 zc4CO)D)s2TW`U*2owjK}%_}X}kRkacX?Ba{X4`pp^o`eN4{Y#xPy4fAV)ao6qh{sQ zzV4T81Lw*8`4=rM_|D%>8AQs~-I)yT`?2sGg!Io`b&V;jh%NHko<@|Xd+|up_*`D! zDAnNWSeB4{eC))lxDD&W*D0&yh6;IV+A6A)G7op*#g+Z2yU8j=J&Hc^;&|yedb)ck znslCPr(H~y?GWujN2Bn)%W<>inVZ!ElIuXiF!FuCd>u#%`U^mM$H+=Um+Ll=%fIGm zjJRp>XHry7p--G*?q$8~7%A)TJM!V>At7?$OFal5ni&YH2ML37nv4P;E{iB4)8-^9@ho4-r8*6!8O`(g_&**U6kAY13=ak9x-wlIt4AK z_E22Q3BUqFONbzi=gPUSXb(^X5;CC%(%O``Qb}fu_LkNH{xGy4XiK0FhE@sT{;2EW zvw{`y1Vby13PKG>$)oH)N+BQe2IOFA8S!YTH&N<-eba7Qg)^-wq?c(Q#D-!9)*cw? z!5MqX*$hjX{g|q}R(2+=p9*V-T^zJ6m1IpcLy`~B-py6*w5U&rM_PQ3 zP`yRrob)zlo$I%e{4MmVwe7K(wkQbJ7aaRYfc>8O^B22zxqX&XlhHX0xb=O<$vXioiFxy)MXgJ}Px?Mj9~k$Vko; zbPdoX7mSDYE&&0?izf_94XV%98<^Bt0_%rygzkavj{W@QtQ3|)+ME_2ZgXEmGHOy1 z4O)S^P%3KZeqb(?ib5fRYr#TF<0xd>mn&!bsCQ+QhLl!Gc$QvGLTwEvcDidCAw!sq z$*8?q9#;b9=*r;wg@3?V$6N$U!b}f#DE`HGPT?|B@>et z)6{>)slRg~6k-1@2FN@DG2=Qcgh0^-^j;xBPydmbr}-oLJ_8kSs)xiUNeFC8B1T{~ zTMyT5F+XyAJtmjw^(S0{`8iah$M7X~Gt1K{q2Uum3gU~YOsddNh=)6A#9gTPk zP(6)AXU!5|e{y?dkmVm1ZtvY{1}Je5))ZqTO@#|2-vbsejO+mWcWP2_PgAukEBc!@ zBl=t9+LiCZP+PtG3y)5#5%|E40e!91*l&!Wy};Xx`LqSnjvRkPABEq?dp*sUzWP1o zXPeIDWH^(cZRp!t$YYa~kLovu15UHUTVHEabl< zBxH{~8A$iu&|}U1V%AH6BJ4>5E`AIBryc(Hfu=~WwOmt; z|3+@aC?-$U4t-qeWRH`QUBzR~XQIF?(zy0c0Qi@-z zpQ8~Eysi6P$X%tCD;v4Lwgr&2gDBtGni-RY-VP!L+wj5eNoFpUE;O6fpp26^o9oA7;vloeVia;4r8bzqNq}G{2*k3qO*h~9=z%5KR?2OonquwAV-tFx6+YZB zn@#ZW;9h>AxgfO?MA=VHKBWf)zo()gYdDi1-HVavT<==6CcHMZm%@Gx;${+-OOVt( zA_1H%NU6a2p3Dkr@0qR@N@N6*Vu%msw+K;a(PW|{E(DWRrsZdcFoX-ji9emwO!^TY zAZf$8F;9PJDGeRhsxzGYdRz;mff;At8s+~|fb(#={QT)prvn0U0T`kubFTbQUH_Ye zLL5e*7{NKkE`);y`?W+VMy~88Ih7zXws9xewy^ah{VCjGw@9^Mp_iKA);C+p zy4ZA1JMBC3D?AdF)*WaW^`6q{BLD8C-q8&FpXE+nBbPnXMi4+sI9!jC^@aZZ3ej09Kix;dLbqxp_EIpK!))K7mEyYhywWZ6X{J$#W`;}f>r2@mqrF(3=DT){`BTtR9tmu2N?NBti4 z2ZMN?O0&${2qp?!Ko}2y%aeA|-pD~7`=(boDbFf(Dp>Bo&6~UEDVK09>8lEgkz}}z ztmu7SGRcJeK)7yf0$z!U>Zg>8I?YmV&dubLadU;DMxtZ~^uev?Lw{#sj0i_Y?eD9D zS7_e;S*J9p*QmnXqD*FI#aH{X0QLREVZRfnB+xt1o zIM75y6?+9v^|vr-C~4OM_$SOoY9&)HmVDr6bRy&j$lqP6o)~a$VCvB^x=UWeJmmnV z*^KziqRgT^C!LCciHvY>fleZBp_;LYkvI!~>sO_{taG8u&?|0N$^yq`A*!>9ktA?qGMQVJ7S>_&%}vKLBlVN?>pk_aN=%kyYWfg9DM zEfJ*#S&EMo2xRdg$>Jm~4-Rkr{5UDzGwDmdp~jO|&Tm@1hdo=z*W>D{BTMwrq7Lv& z1bxD_qcFW?=OFlL#d{_ZqBnt!fu}A3#2_(o!ibRo9uFW6{(A3+dqET70QP>40;iU( zzfGCX(JbdsjUW2*ylg)VlQSn=9pn%T@9NWyn0*X6mo641-Ii0;l?_J*7IA24nM+oT zf}q6@YGBmbM4vv?fmL}trA<50iW+4Y&X}Sg-7gB?~Wi8Oj6GGEFG&bG`hyc z0Di(#&YNU_!%)kP&=+5eJ=s6!{R_FSx{LU5{h{vnvl#5>IO&rej9ISW^1Q^Ya!Z;3 zUJ3RTCKoUm$MKCF-y{iPu9WsPf!G063{Acw3!cji8lEkA9G4ji5&yNFD7LdFM`UR%Gb2}^bzRORIlqQgHVWL$ezM#w5jZWvUYgc(b8 z9k&|4C17S?dqiw>P(|^z%0e47vXDyI*XFKCY)AqIdo+Y#@h1;yIikL3EWNL&97MHF zHoCuqLD1F8I2U~6E#F5|NRiuaMgDLM<_eW31^(ocUb;`srxeOZ*L&xodvWZ+%DbLo z5Iht@Ki}dJ#3;%&qT3=eZTJ0<2RF+$9E65KXvp$G1FN9vXSQ!Egbz} zRpU5*G{nIAkfJOH*xY z#yFytT=w_+d~tKsA1jeW;ZjP62{iOjM?;?gJZT_b20ia}r(U8+Fg3l4x$E(3*A|nJ zHtVYNS&tcq;&im^ktg}r0&a;;KEV2bhLo5~f7}W3r)xqlEwrjmH1_`{qSZ21Yv9#^ zkQ{5(Ecu^sC6x#rZrGr=qrwh6%1uJadjh5L2Cq7K_e*%Bu=)pV32Yk)x zzLIN8smGn5TpJtaFBQ1oj@rHj%m+;KCskh&cw~-1927nD_yB(&H7a)saA=fzT%030$vgkX0b zQ>E$#jud+xmox@c6^HucI7>#w42V#bI#C{zdCk@4QeS;+=MAjQXRTm!sdWl@ zO13$WbF%s?*@Lq<3w#y4`Qgb$nm`1XH4X<;v6w{XCj#Y9MmOW0oF`Xs@g~2%s(l5- z*kcPZ_Gn>~Mwm?KX_cGLKw^sJEZfFt4n@)uP;!loAFfAfPx5-O^F94iLm&B)r3|&C24HO*M1sW%r>;tAH7BE^?r@89oX#l@;Y^NOXeKNlpT7_2#Gu^h zr4q*XfKOxbeX`>4+oDf%3vkf;RexG~)Y0;9d2Bx`y)zZoDVx##Kla|TsjjwNv_ygj zcXxLucmf1>hu{$0E$9jo+->3R?gS6P-QC?GxWifGdEUKu_vz}7r@E{7GXKGxHShZx z*BH4nx67-J)Aid#-GtLSB%7b=(66u+6M!GGNfDq9b^oaJ0QCqdaDd(Gv@`&Q&{k61 zN7(_gVN1-cJ)2o>vm!?3vDGmdPS+jlbtJcv&$=9r4r)H>MA)$vSff-#+zTA)Y{K6R z*E>fjQApx#qkb5+g%YEc6Q}d^E{)pE)aPueDF;)+uj9mVHVS`#r%)#) zKWc?go0ocN{LpMZd@U(6=qwBr;Ud5W6#3WYe|=b2HO>j)CLR0P1UiQ9u&l{H5ll_P zUJ>N!>6VD$q3KA$8-+_sg3LN6!UpWIVofnNF(mZYqS^%KQyTa(7FH#mrEn#N7$Kbl zU%hdv*7K!jng%i;I-umtM~FLK*E*jEQ3L60%F|52O_^OLhKzOKJD`{G=Ha zTCQskcacIX7k34Ag$mJt=Oc-`1?1a0_R5(Tk&hnnvrfzwU-UY2_`RcNzyJt2#GH7L zHewd?$vo#@z6WKs=huzy+NGz&u`=hAjT)@nR@N&1@DVs>Kf>08ubB?qd@{x3?)eJM z+Eg@r@1WP9G`lveQs_we9=|$pd!=xs=_Fm*^vc$kkR1}yeA;e?@B78R@ajQA;{nKh z)308!UTbJ|k=~*7S$VCSv>0$b*(V_BIgzBt$oleod@E^oUxL)*~%f~8$5V~m9_A&iTQzY+tqCVX&oZo>V_VogqDnr z=?@|W?aanre95UiF-p{y!f??%!^OpKkd(3IY+43 z7TMg$#TaflnYX#)@o%dRl>}Q%O;n=Y$Jo@1oo8E%O(YT{6qKEyeHG3nf^w^ZNI7#< z@rk1Jito5m`$`wB!fgvU=l(*$`=T*xDIdPND)mHJM)OB*a8!*q_2tS;T$O&1tNiVW~qNrrRj)FHg4mN%f#pSiD*(IKY{Y zxY`mVIAHgwIGBZa{5%i5m27C2%0yAD!bN2&))lIED$837@QD5xiM5d@r{KuZb zIYfb_9Aqh)*jr^5UJoOCk;An#+g^^v`dOa7G!%i~;U1BJIE=AY3?+L}uu)YaWt})( z=v(ZfN2w#PIvrbIucP!Cv$VbG%8GNmftod0aY(|H6lOX^?{9FB)+p$h+4%5d)$e0R z20CE=JQfO|{2_A0c=BX}7rAD%hNx(hg4ceoIV-!;WsE-fXLbV;ST_58L^pJTi2rA? z4uj6#AhTrZFVnSXo1_)OFGmn6G~1=VM&wqNwL&xZ2KL`KBiAy8URs3}IvwPPY^UyG zEP+E^i(f!(n$hx>khWIf~o0xL))R(eq%V}g$&hBL2W%g_D2>tTF9__`Wj`!538 zCoL=y7&;xq?QmL@89OBv2nO0LH7i!4nrRlkHjTkH3Z%k62Sda(Q#GU40~O=8X@Xyswywc@#5VMx=+p2t-4QgR%F_iK_cv(6>XCi^u>I3gzwN)lF#FMcBea05K_T#%_U zPliQS%55B)8ReleU0mo%H1UIJlwAh_&#{o2*t^I@qYbzevRpPqwY1UQtFLu z;@Q*KW}+zmMgH6ODpk`ez%&coc8}j7UH|*b-DQu>j2Z1?;v+SW<%XH&L*l~|yj%LFVkllQ*h;w5SAu6LW;h zQTU{Hy;jDzenkcE@}!%uz)ceqgL%;4w<l_Vrw~PO)oViYXe9e520wpILnR( zvOh>ujvSnjU0;KUZdXx&xV<6Y#Oj!lV(YugZ>`hJptv=S?xbP8j%?^^y}6?Don%TG zJ;n4K4`~|fa3UM?e0CE0RGNuwcp>c>5Lp_;Fu4w=0(vysb#y4o%E{taav1K25~b~j zXE%}qOj`QXb!=LFZ=Y>&tIPJIsaXDr4;C@WItj)YpfV@R8|QeIO1`Hfc3q#_XoDan%HjUR=JCZk}V zFyhSAwsuTRa845pIerzVkCG*hH>&_r66~c!^G~TFIZJS@IdjTh%|+K~DWLoykjcSt zw`K3z$!qIV#_?=m;37hleC{^2(9>BU_h<=NdIsb-U5`I4?cTf7&=Y)X4T@+Bm0^O% zUP)gy!7rwQ@73{4uGY6_KV{RCAwuuT))9ZR)!GxzzotmDf%bzr z0ff?>VQ7qD$}Iq}noz2IeMjZ>d#0q;$%_{`eT6a-)|!4eP-hyveaPO;%gbc zy<+`(tg1_(CT|4(+Kl7H+**37SVBjR@d;UAEDrJR4| zMiu|cjbMCGMl7RnNj)>p{S;O{B{G|TA&8_!hZFvUazaDH=8R$+JH0RKuba#U==t1r zL!#6t;|N~+IU&#|RHSbAu?^6T%!PxcJIU{l**VsF>)rZjXM2OiX&=~t|5(LM>&p8L zMtgu<86S9smTNJ<`#lx`j6dYImDaU)yM_A{f@ix8yK9MPfbF3FNyzq8FaqVbdhoC4 z=Jwr`S_dL!xQ!#Lz+sqm<@C&JK9cu}9B{%vm#WO`OTh?|KJ7{dV6(Hqk;_3 zXiO{U-zZXB?f|Cpa}KU=<-J+1(QR;Io`g$`4mZ5J7tHXNea6SJW^0b0T&u+RYS?)AhKw7e z>F)_l=J7nvXUoDYL#S@Q4((bzbxf|!b{qoEUdQea6O8*~spDL;`*s|GxrW*kc*a1 zr_5{)HgQK2P&nS{&a3vQu1aYEswxf5xKHZktz3S)`jC)?6qYsxZCDIR1Hzl$|K*#m zw2qQ9Vzz)Cm6Z6v#zAsKz_yXKPhyvqykx|n-79b?o02r;OmOln2p{mcNZxHu1ED zAFCFv>}Hm0jS1FPJf0oKad2!0FLK*KNa7KJKVsfgb1>s?Hw}h7q36#XFL-6w0KB%# zY^!ADT0zYzpgt1?CQzjVq`oiv!GAV*fNn!%`X^H66N&myDyZ0*^fqbsrVpY=l^_hX zVAfV860@}*0EA9b4d$&u+y1J6HU3>$C8hD__jO-qWie+(bM6UnR0bh~ab?Zuc>j>d zgVNtDcRP4ti>qVrw+#rnwBpWQ77+Iqxo7~IB2{GIb8`zNY{&Qbs`N?4ZUZT$Yz(btU4I*I;O}r4-b7bGaLIj3zhzS05;vz)n&I4Gc9$4*ADZ=o|kh(`SEo8O^{0YU2#!u&Up zdD@?~R!%H8X+}Tdg?VGm@@x@|kz^DDm2y!X(~nO6M2a&ZSyi)vC2cGABZ+w-S)F0- z?s)dSmph~w?)T=ak7DoNF>nUT=IX@_RakX8ebsE(2m z5If$qshD=!!2Irv&DcCMH_tFD^3dB(?fTuAF(mTWlWii9kLBgiy333O%t-SVhU3bI zCg+3`=Li$E{P7vOowfwnXgiQTrZZ*CiHdsW-%(3eP;ybJ?R2U}6d6X~<}FykcV*6Z zQf)M#%}+1TpLW;Xp8#9HtoVibx2M~bF>=qTXx948*f<942&8r17VB|z>{6`v^Y0oj zNMuQse2N}nnY%@sUV0joJBWH4mkx%>#)=;=h_MSRxGps7mfl)ibhD1O3Pk3G^trn~ zRK|@ImC1B8J&=-_%FEdC=8h*A;(_$_l(Yh)yxRIG=f8{u4DZgp*loa{1s%z0=|`7- zL#&R)L{U<0(TW8kqa~M^NG@L&Fy_Bp#^S?c06vz2vBsrL10!!~KQkK_b`wHiQ#~Ml zw|kts7w&(k)n&c>vn+}{^B{)(9ych=frecwJa6HbS<@sO&NC4Hj@Al%4>UueHQY=a0uf6iwuXPw^8n7*5Y0Edmr z(onaOYvieAN6mYdkkv z`(;~@cSGgKL^HyJI4{BKW$iF zvV2;&0fVaQ8ZZP`cqB$mn1e7gjA48~o1}FC=y{j1{@z0+A4E{GuabNqw+~<S_GQ zz?olG)CAkKf`6xdwYOV?|(`ttdbCi03&`y&G-21|~gCI@V)X~ogqhy~N1Mysl{VFs9t;_CaN)a2R z^G_z@Ac2HN5ASsmmFR}ia5cV*?HV|T0GB?I6Vo>5wC*#wf0J_+im3rbDx>ZHuaQcD zXXC$-$_p}}HX1oOy0Z|a&`pJwXUKSzwWHIK?qf$6uveXu9f0OvKoJk*r!Dy%09;jUl4s??NQX-n=Ydgn0)L8+2Er@^ z<#=7AZg^3iPf9uY-f3Bd_o41AMo$160T+b;P>4MOl`vag`L z{Yh3^NH;tVqJXfl=_3>uJ0g+1jRAiaJomo>q`)k2pY|GT06wT*nGLE}j>JxK$*Qs6 z5&x%NX%XnH{hxZJ(%*U|vvtR7z0x7_Z@to8#a3usXL0QEpL(SL{h8w5dL{XN!)v{A z_4|iE5nO-kl~nY%2(4Le&^6n*|HLb;8UGWnYyvdA)+^~kb+l($5W5P$-JJD8v?ah0 ziHTfJ)njeOdE(LAAcKa8z0jgfEn)bf;~5Tkd_4%8ny-&LB!(Dd$%_&ci&@@*npak9l}Hb}eQLX?;D5#|SGaCWfF&ek@bvW2wHqPQ zsR}y{EROYV0Wg82U`qi_w1+#Y_hMa{&Gh$8DV3&klb_S8)~6x^ zbc*V3zY{xYI}uzOb@)G>E+s>ljGeZZXn_iq%Ev!B44WwmX!lQ$uHjrcWorUzEv&EW zKsuz9t>6}r4oL~5Ljr(&NC_ujP=*vhKBPK!r{%;Etu!kctFTR6^xvzkuRf&ruRf$| zsg#eJjt5}^QSI6b8v=Dw@7Cpd>_ZRu(7|4GQ1v4YonR)6W zM}exhm%R}yDjhdC2c-W3Vw9DrHJOEO6Pe6Ae#r+ta!jC?V_DEnIW*Y@RjP&QkbMBn zVyR#y8+3ZVx9y9z330DtoZBw?{lHzJJN+`H%Ecww0!K=bDG3==^IJF!H+t>C1=-lO z>wn}S^#=cwhcrznD3utbPL(fv%|i}vAEeX#Cl6Wgt8PB_PaZNJl!sjVDyCFL4$4E` zA#s85tLqrM>DKxBht|sTFL9X{qS1=S;u44DWn&fkZ0sx%#k9c$tMD$CFv3vMBb}nr zggJt)DcfeyT3E3K9>Ms|T0-MuPx2fly;iGs)KdotT3#OwNPE>XI;kiF;M(!mr%$Z-I-%yEZt3Hh|ES$R}9D{_HE% za7{kI%>3Zy^p-6Lpg(1k@TTb<=dEBz8;yczYv4Xk-viu=V+NsqUH&8!!to`tVY>^x zi|a0rdIeI{(2YX{cAuBXA>pgA$@bS&yGZL*bQ-y3D=6@~?(tJ;eg#}v2Css9?a+*X zYkTJ>)D;x{5$E0#Oy$iZ59_DL`txpM^)l!8LcgV;dfQu0|~`92vQFhiQ0nIb(? zD6raSENEo;77z;O zo8d!T?MMrl<*)DAjQAeqc?0Y(BPRv9_zug+@xhIOFy-V5fTzp-*p$7zcnO_Rlsc$0 zOb*2hJa@tAW8~iiFhfPA9 zR952aEC#HkN%Yh?V(7MjrS(_$eZV%|`ee{Ec1x;>nElR$vCWVf$@_ zZGxe$u6>A(nsKMAp(FOl@$J$|fG2fDDFvHffY$?n37=#~Do|kKxxWp)Q4c~FpC~Jf zJHhr~JXki8cDsKKB5_Y5ve|GWhK&_N?LOwi^jxTa!Gs>S9rp4sgUobNq|bs!r-WPb zjFSs}_0}^jt#P+F$7eskCLEKC9SEY1y}=d|GXC-Wah^*bGfcY*>VhZd8~<-t z0(-t0z;{B|+z0{D-8qiwe8m1OZhn5z2^#t46zs@ZoB zoFJyEBtm&%iQ|>2B8?f=7@Sf2%T&ST&M5&42ROMQWq^Rk(Fx9_{0wG zE_z)M@Tt)YzJ9);G3^({cz`*9JBPb3K+T+2{i<>Fa6v;y2WaOEcPND;F~G!-0biB} zjHD&Q1}tgD6qmZsugHl0X_l9^PMhyju#IvA8I{UKChW*X3rGV6`s598B=E?iG_c+o z350QMc#4WO97^g}h{fPhC|OW*&@6)wYYHzE#?jS8;*Utczzrga`ARQWHyi~07@;hU z|L|MpAFis8LaCgyLl0e^<5&Qa?#oS#=L_JYD`S2ePrY_EObQEq+ob@;p;)*>JMp&C z{e(8Kn~U~dKw)9XSp4vC;6+wOxypS1C)ly?RjYZWRnyxo0FYJJ! z7ip@SP-2@LQbEx_p~RJc zLy5Gnp~RE_4kbofNBj*X>Zo+Sh7t`;VNl0uID`Di7%gGUH9JSJjOR#x=$}5!A*0coG!7;RL7k^<70gg(4UA~{Ra+{#sk4&5ETPE zAUF&tQB5uh^BOtq&G_7qSWS)!4lW5St|8}z$cO>%)Q}Sco(cN-1Yhjg15X+;jWox7 z?SgfTDD#ICh^om7_gQ`US1)&vmp{=9E{^9iJMMu9FK;B%6e5Bm5Cq@cTL{Vo=@J=_($Y^p50CK)oIviw6K8f|Z$Ne+{JkAAK5$qQA-nE^uw19F?VBtH%3yap4eSz|WV zR2URStG*$2(4Gq#iwfC9Qf3K1wN48=d-oX3rf4IwENG`~r)|O^4a1NqiG?V()bb`UOFwLK}bgsRBK{2>_0MY#` zDTc>?hwUI0vL$@@YLQZOd-+P+CtT#0-r=Py_=E7(BGtQo(1Tuh;$_~PnT*N6N04&m zd!X+0aoQQkaq@f5kXwXv7Gu`ZOz#xb^P_y|I<4~iJ3ELi`MIr~As+T93ajDN zaG(b*|7bmu*)*k z4?$rWl}V8Tf6fiDWs=iUvM2Gap2cq&pn+;1;Xq?=TROw_bvh#=p7Z;t_^@do6-`ta+C zrxbRk<`9@_@TvuQ^Mv}WF3=}L5><-Pr2-6Fhg=8PSCmwB(h*nrFVq;BS^GUeS*p- zw)hFgxmoRkfOYaame;1&tjD9&)xnSSdv{m^5? z#4aOz55zN+M=ek+VZRlTc@WX5$D9`wdEs=fx5fuKs_(Ej+Hz;A!u;C5-C9*8B(zwW z_cNnh<0xKuRc$@`7(`yc8x|XnCIhgwa=tO6bw6}xtALI>;;p=G6?BTk3!0+0QpS_D z=*xQ^HlogYYV#+4HF#&s56vE(@qa~L=~bJAeHyAeZcdJ6dKmXl%Q}NP!VM(#OP9po z?x$97PP>y0t67t6G(3`V-sANkn@kpIT?g#o%A`x2=!w$B)2Nj@ncsT=7KgT9^k$(n zq&4rQ%=NhN&qQcnMP7`umV2ukZJx0&0y&|l(*NZ71Q}51s`XpMdrqtM6Ej*Db$ohd{T#zaC>)dwf|ZuqWxFm{Wrq1$u zHDmi8&&pN0P5u^yrMi*SbMc^IZno~Tj60hBVY6zm$#MjX$iNL3a#s13LS9D1_Mm#h zCUEw{;{z<3Akl`1oAz(b5w=}S>2~rc&Lxk;?yJ(=)%;~?1e3=!mMZTTCMZO%GS*8;Za%5DH{ICy{9;BiHoX8rN1ap(J_&2rA1^vI}_D(wfliMR=X{MDE=!CqJgBPTGu!D&D6&#VtmOtM zrwJXSFx6DFb{{BD!Hl!4leD4t{T}I+LM0muuerU767?QK59|voNnhfo$OnU8ks<4} z^A#cMz9Ai^*z?%5YT(WOH6JY*L&TF-3iMsL%%0$S^NYAN22ugpcDch481?L;(9H9F zQ?+*m)f}Y^i^@`FDq=dkXLeo8pN}2rw!s+2iNlG95V{7Kvq)^1B)a?G3woq8G_q*6 zRVYR^j56aU?f??#V+!{OA*o0PU3sGHb0j7{JIY&*eg=LRPsrP{@Wa%xw3k{>#2l{A zb$9!_!!Lu3>A3^O#_-WQ;})<_A})Q0(5{T6Z0gE@AADOiqK90bLQfB?ws(({?^O2s zguKpkJ#nEQC-CQRUb3=Uneg0EILlW%atv=uTfmWeSO6AI&`UueRoT^6BLqlQHkceW zy3T*f-s77%kp0~a{WqB{=I3jtzDm7q+@Tqih=z>4@;WZ|pE)UwEzGXraZL$k`AQk| z26IslS|=XMy0bzK2ia$`nXHbLQECXL0+2sb5ijeCho-q6>RsBtB8Z1n4QoS7~bTZr&di9PZbh#kN! z6*&L$-mC8S+M<2OQ(Xft0L&?h?B-g-513*y^9&Wz`fDnK6UcNCz6j!uIgk#e1DVRO zgYEt`m65u1N!a}P$5fWpLkvO^0mYDItjksxm}zYNy?=_46PE^ai8wiUMFIfbZP51e z=jWA8R!rt&W)W%$JU&v3O?n0OEQ`F zziQ`?_NZZmKUKjl93UA$i{2|Lz|d!gWyIk5Gwi3lZ!2I^4$kFsQ*K`;1F&}Y-V=G? zZE(%THg?PJBolOLsu5DxU=#0AtDeHK$`JBvO_xh~f|ckU0XRqR!4EfU7NXd{JfaXrBKvx2BogWh3UFLTeHi2imfWB|bPuIBh`5b#v!QQC<3 zi~DBM2VKZ=$I&!SL^?pcaFBfHY8tkEFO5rwfP7|no{$y2dE72VF8pI%+Sw^$lQceL ztfv__s=BmGo$)5)yzOt5r;uYs8&+$OXL(0E09~mQ@dA}m4{wbAx0ek&mhUEVW>(I&tm4jz4$0`J?voCS-;v zj~FmKXdSbvXvQmhuzN_Bm$7uy#oxil<|=q1WZvq$%-3llL2_v8JZR@&ie$3Nr#i9% zh*_YS-^ouwml8-l1P{57dEjctEKeGz98!#+w7ph7@ArGUAq#xfh6T*<{S5^koPUQ| zNw2W;dkqEV1Extd%F)JN@jWa}bRT=^SPtk7_@*`i9bY}y#fdJ$Wk@WrjB8tSbs(n| zggMSrK2pU;@=uy;%Qs*X-?#upo0oSz>YuVwcBCLfzCdf;w)SG!&fRr z^_ZbCJ(-R^Ark$l*ckIfVnZXG33eDT{>?{|{aVr;P&%03zpq`}{Fto5VDO6XWpjRz zI*pYF;d{e!@*sR~)qv&vRU4Ld1pco!Y;x;bI~`AW^Js<)pnJIistJ}CI{VeyM9m;h z+*E$NuNmran%r3e`#AegO>owI68~>a(C@V-SW*cMvFBE|>{`piA+Cot_3(ET;g+&K zxX3;9q<7`4U9;mHbAh}2kYEyP$G1+@qn5EX^NS)Z1+4s#qhU->?dHV$3vz3FjmW7g zz_v_$admc_>#sKqaFdN@-W#@IEpV*cfTMSXWu#t*uWEMlV$l4qg5SmU-H*zVImk$| zX=4!(zn3*{K%!udQ21xt9o1Y)9I>zZH;jy;`B)F!)J88xoK(#Ip| zvfT8Dw%DNN>V(rFL^c@-I72yca|KX%P+8MhR&&r;0nvF}-T68QQ+xv8i<-g);`d}h z{GL@{b(&Bc2I>W;3NMJ>wIluE3Ev~LWeqCf4ERg)gv7OK z2o54*u)S7_f*$0aT^>_q);k%MLi#H=^gpZ(?^RWsi${bzxJRM2P(j_nijN}7n_pyW z@Ic+coDpHNBW0FsP0cxAyh#fs$XDhpkU`CobCbks`PWwlkhQi{<6b!Uti5bjf`5$f z3KEu8eA@EgX*qCey4wLUd<_o|DfChDqUW*1FHfiX>DZ|JLSlbf-mkemoH#3hx`RH< zwvsp%CYR=?#SEj;i3Pe-?c)@-5u@$#@H&o@`rlV(0zY2n`#l?>F8E%ZC}vdBt6m-~ zAF8w55$(GH@In%NNmRo2noA-X!Y&}aLTnr90cLQcvc)G~K@i`|_=3fEEpJ7UKhMj{ zFzz%dM_>Fv`Vx@BjPl`K&sy06lBmHF9V93`*vm_OTCF@2)sW#5XIK@1^ULOkZ*CII zE4c@(0e?Ph2g%ELu-Cf3e9!O&FSjKE5S3N3eB}pjaaLN0`U*K-BCIM+9dm@+@}4`| zYPUoJw-^Cv=L0rH^qoHWzNf$z&uR&6ZsNxFrr=#KSM1@3vv6Rf6BPkq`9HR@oPivy za1;H{!C1YtD?+~Wy=aq_cS&|nQ9~;ycQ10>AcoJ?BxXRGi)a@lD^vd~D?@xP8%#II zIGCQVnSr`q*{WE{p4Psc=Ji0ED>{*rRGqBt9@8};U~d5wGQ_NZUHRpZx3aD}5*f)_ zR58N0Zio#Ikg8f@TkK}o(dNMOZF^ExttvTJ+2**ciB_h#g8lk%$`EM~x=*^*Y#mA# za9Y0nTUWr7cj^+du(fd33+DP3UxA6>*H#(ppSJex8)qm>iJVj0?$0Cv7leIbIBk*L zia55cL$-V6{Ap|;TUi&$k`jw?GR+DoCUOJ!*}Rw!z_sCxOx8WbK`gvGe9mK6RfLqf z>dJiE16}chyEe$6+j8%tXM5}2_6Q-P#b$&p_r1}oDgWLYXJH&nzAIA-rNpwD>^qRI z>?bCihcXdJSGL+7v8LkA9HMD6;DFcn1khdf#v$zj>B@3y0c$A|A0mt1*}DuFAbh;l z$TbrHz=~tYlB28~&2wn0y^D~_a*`hZ+|wLt@Gr%O#nkai@%i4pY>^&~gDAc{3goIh zcV^0khs&`5oAob?*1i?>#pPE_k}p};TEBySIdgZot>?+>H-j8!H9AI#XxgW2iG2c5 z;SG2_{zMwrhV{@EFgB}*yg0nanDK($x5Z*+S4N{LpYFHK^%Ch;A@A`PAONprLyTb3 zR4oA;7Wzu6lZMx_;da7lQLWARYuOOKoK>K{<9D^};DU-29tJo&{~TqnErgWQm?=TC$s@Yz(SlEs z@}eO$FIz#`_GOE{|au2^9je=VvZR;>X`k=bl%$*$Voz`y*>QrvH0GH1!A?`BK z)_9uPIrtS?GjRp#e6Fg+4N!?CNVR%f^Z>gVho>XA4J5`Rfbc}ZD%i7c69av*TJs6$ zznu2QqllXKWfoh_E0p#_E7DUv1cg^z4x=v{mq*=%kDC2m(vRai14N@(%~oINQ&8FP zq@4ZMoWaF!QrX5KAo9KKKB;_X^?g@!FYaSj3`!xUjYNm>Wx;7ps!aqOpUoWW-P!hN zQ*SaTY)Bsn7_t!6nF~61qzPRFQG~$epZ>2DA+@X~KIY%D;h(+zmOiad!{W}muVq8R zo^x&|5vXs0Wke>A87jhh4I+0Jydj)$zj{`5(=54{inRRPavgh|0)R?e_hF0zY}VOH z7mf-79w=38mX|EGAcoKhOp;1Bh8>ZnNGA=TTKq5t3LAb{sfXxD!!6xqSGA^VTcB1{ zjsWtBZ3gFJ#957O$=`-=Vz~nk>h$NN-`O1V=TIKL0kTUOWr%+%n1NgTwx?m@0}J zb63=l8oc{b9x#DJ3U8z0@k0nTBPkzqA960rF#^Y+6#%tZ)LNN0}X_XWQ9 z0tU-dlD{LXtTF{Q&Vv-XGk604_R|sz)F`QBe}N$pwE2e(p%{;kKF(C1zWZeL>LU-n zzXL16uQzjK%7xPtVTNU&d-q;k&*8{@?E)(U&bj_0?!+9wGJ9JdW%G!U-$7);Z+?bb zL8nGBi-A@=ziz_RP_MF2i-OFT?$WS}tV=N^>ZjgepEn(o?Oh4=09+|hvk?%;8g$5x zr3i?Qa}(}~Ch7b`Q;*0soG+aa$$EZg8pobj`E0EtIlDa37v23a$~W4oz(?VV86zCWh=2M7g$w>YWEB0F10Q zy|6v~9P@&cR5@3@Ir(#^3b1HfeQd(C^8Yy3tU=DTV2H?9bTP8$*X^P8Z!-=sBezGG z+Tmz3+hu%~IRvs#cb$aZ$}=Rct8oH(54pqmWHw#s(32slkt3UO<9^z1Jgg2IcXz%c zQw7JjgAug0ce&vdH#^vTBHCoWZKC$A?=H5-SrRJ=fA|Rf`aDVU4Y@WpX4PE2Wh*`8 z0z3K`|C>Y%9XVf1P?7iIsT&kjw(hU#VZlUIuA90)r@+Y!a#g9@*nVuBAN)ZY@)}j1 zt6|#T0eU~9!&I?f1BOu)#=&rIa^tAJ{wEfyO6t$G-Io~#4kCVNOhKF^2@W-%6ITMv zm&8<+M8y4ufybsa>;Pzv7Ty%0V1~M%Mr#|!?NBK7#EU32&gnDs0YnwDL;9_HGC)%D zXho!LwW2B&{BJ2IEsz0#cL?);u$qR;W<}XInR8El@q$!bS*^dE^KHcINYJx3F}(vs z6sJteW$Fgm&?$_IHPl?*d{HXINzsrhPCO~oUI+Q!o}g@KTG3b^JLK2dYztMxO!QKrTn8I}#%SWcW#BV~BlKG87qgR%Cjkdeb zrl0jZt=$Xk%wwC-l)>EVDr~fVv-oY~@{2=UbbF0#7_}2R0HWh5PnvU99*V1?83Hf< z_?N9T&+1?kp3w#w<;cii*-C!04N!h*eS-=Y@P~x=Y<74< zne~7%72FHxjUX#kH~Ij9Hi_x#6g_*Jstg$W15EP7j(*HfSR{LB&da@l0PdT+*ti=| zR{D#rJKin9IUzNKcqiqLAi-$Gdi6*>tO-%fvNm4Rj+Yy-5!-8lE*?^o*3}+%cCe^p z)^@Uz@A*Etau~&OMj$($&@a#t_KrUzgRo6HoBv>&GCN1iAZ#L<6mr3 zJsxhs$#5syVO}xkxN6uSd*Gk6WAZ<=C9uMR1{&~xl(zieVN1aOQQGo+VYLIe4{PjXv;U+@{P89qb>hG zKwI{{(Uxzt8*TYUTfWhjZ?xqbZRzqxTfWhjZ?xqbZTUu9zR{L% zwB;LZ`9@p*tdjq}pgQi)HG#6gVL%@FocaHL&d7h;A`Ev3ra_ypL z;{N2K+Q#9w+{MvNL5Wz-#-@`pm@0!viJuF?lB}Lb#k~6ru`rr@vdQkfcXi18i@JJoejuhje`jo zJz7Tr`vDkTGN=~5M~;UdbN#7;^DM%3Z2^CHm<3R#`P^5|>)-)zM06|6$f;SIxjtzE zi_2>eK=VTzy+A1;3zIi*6xHkQT;8Ry~l*5TAoB}6P@W{@Z=4+e=nHF|4z&p0A1 za+&zsm+r&j?!`TwZwvv!_lgt*qaq{kroQfR17A?+7^G~2(0r-4yHo0*%0{2dhEi?r zxxNl_3mgr>aYK|JluA_7jQ~+d$&bc7-lJ2Mh*gi3u$AV4?UzWXv>PPN?=nZTt_`^o z=#>w<1CO2Q@V?pwiQwcEr9eR`ER&-L=AK~uoxvJJ8SX&qL2Wm9moT^FjW+~{Pt+aY8rw$|= zyjpIhGPYOH@JKPew1Z(&OK>9+E58c;q_?WETsQR23Bhns?j<@;{;9Tk$1)_ON1`d~ z*gl(u21h7CwqbfgI>wa64WbdSU8LfxF`q9zA#cqNd}%L-A4{mdEL-y0x9W<_+XID# z8z{=M0HF`(Y%i8Tdk890V7MzC6>K)fs4Y6{6E^S{1QkEH9`Ff*iW}S&xW++62=Dsg z(F+WY80oC4;R_@c2ROI|F!~);C4yRa{Bct#xUQ;g9Z&{}$_3~nL8lD-#Z83)4>O$x zu<^cIO#uKi`^j(t?Z42^C9|Dj+Vq~EPH(K9X$k05w)EO~l-jN#y^r6QUcD%c>0%bF&>E*4$jSAM=eR{#w6SowOZ4&>xeVz{J98QSrdcB)>A`N#Xw*F z;r)YHdWY53`nQ)K6lGOOAH!_E*0e2gemcNwNs@9d_csu^1|GGM0^ z;YFYrrQBd7uq8tK9;gt(+PbpO^GF7L2p*G|Hsn>6vCs!Ve7c3nM~xex(K;c1X;Oc z{qKSj7!mg{Z3MY#L+RY>ak>dK|QYaL6 zx8m;Z#VPJCKWnXT?|tx}=W}0W^C*05!rYIjY5)JW*6F`(Et-s5b_(Wa zwYa6+t1Snwrl?DP7==QoXJ7UF?Fd1|5v*3Kn!T-;gc%*36+#U$7%fPNc1S`BU!otm zDW8uR@Tr@M94-R(u@ErprZU8D@D-aMO+w&t-mv_CNTuL3u+mKhCKo)=vsaMC>%cej zBc4bj_<4AT($11pGaVN?xQVeJ2`GsX5kV}_T4|SO-`A1F&cRN3i#%YVOGA?Re%TLY z5L4`bj2jtLF0Ijau>NU0^t-1XACc$0=)&fAaF+V=v&eTp7e}*Bzm8S%;(9((PF=6Z z?@f;-?KU<`tr0FfTe|Djw#Ef?E8Ppl2`knqjm}%0Zb`cc50@uxgX4!kZ!z5eww*w9 z4rgy--0IL&kZHB@quYLYF8yOoI<&l5lMzD3)aos9-`rpE6^v26j*Q`&D#!L=FG1@6 zwW|KHCaqAA8vd~+|7%tKXHEX!R@FM2>;JJPS5IW+@ijk=s>6JzAo-O~Yc(hSFEt4f zui5#>nyhzAGCBCynly8hRsYwTBva3irk9a_YgOI7wW^3cH7yzc*Q!E%YgKuC+kF`+ zpU|+*@;6P$>Eu~rk0_(k5>E|WNYa)S#Py@YN~p#=9eMv>t4gA15r)pSzj`388gDR% z$T+X!;0TK`Iv*YqC7*tu(q8dNG5pVmM4FS7j1{CoA#Y|F);g|1o_Wf<&`#a+9i z&I>9-Xh`!&!05Qq!( z1q1fev?b`ms zA@TnY4q5c0fqV_p_HFQ1T5&qIVH=*(Ph42nx4=Jxd{EVMSnpme*vDSiEsoC*^;(Lt z1R8wrh1U6q;XyvwZdVaJIAX-fkfaM>t4?{!7VZ?16lBKHXi z@9_WXkR2oc>X78GDJW-`|LKtDZ#twGj4vl(IzYwrzQXI?^v!*2-+$Sp&A9E>V>{iG z1Ds+BiGhv*DthMit22QgFUoyINYze_F{i4_D)ffD&jnQunYZYVUn=^t>fWp~N=O}E z+1w9&fP|5n4B8IhXQU>A*r`uOTzuK-xvhyypu0Z%C-H<~gz~?{)7O6zPg<*xk2Bj; zwmza2kI+}=atpcy0b|;E8*S}o=gk?jg_DOm{+LJ`Pf#3GUr$|}{tW3LUDC)5ZL#MG zKuaTaF+)ofyxX+9q-}|wlvC|nIJ+YgM^3e3378wWU~^>f|8?_Lc&b?FMCk4!R{2_K zOwf$KehPG~Ew)K0tZW=3K#tt{GSJsLf# z%W3=M^q%(9mo6e4L`?~;1lTcA%YJ+{M>G-M2%%iO z%@;z(zhwmfuyaL}l+w{1ufK&1F)yVibuJpww&-aj6n+?=Ur6Y1*w9tw>WnBW25KLv zz_=-8AxlBayus)piiAI=3JF5B?=*yg%SS4H`JeelR5@uD&$*Hqhkw6R8K{3NKKF=X z(;5B@NpPOon%(>I^CO$P3UOEwdXBD*QAJ(lzf~k#ciH&89EAk6NtSG68t%{U=iQ!c z0q-X&5CjsQ7NX$gEdpIp(1l&$SKMjka*eGe7NkKJ!%e-g5NxKOr2{{_{?@gTgyHANe6z=2gUHmn&(60Wp%n8-dT-) zD0H#4W>~-19a)FJ7ps@Iw5~V|ttuYjWIi7fI{;0Rv{*2UB>*KZEtsN2snIK=OPJ$b zpzcQ6dwFf22bST%UCin35VFl|gO1OD=QEWQycuy~M>){*Ocete7C=RnMSFp|ee3?H z#Ml0c5dWw9GpvO!+vV@PDr}tI*d=r-QzBl3I~x#i!eYwqVY#)H6J3+tBZ?}DRSX8J>!pOcUwv= z7{4_UAyZ46kHY|`9X_e7yk(+ee_s|^;JIKN8@-`5-)FV%n=~-f9+?`OkGuywueItO z?A4UjeC$oSmw~!V=*+M1zuf}VS#7LORH?Y{zgU1g=?Sb+A1VRS9U3+chLP@|Off(w zzj>vE^2^BYriFRg+T+Vl6%Ai2NxPYwyk~d&4Y_y<893*w%xbh8kEMZPZ7@hlwOGG! zvSwwVY18z)>ana?&OLlXfHPwvNI33vf(pf$P4Ujg(t*1T%Qfk&Rb*xSpV*Im#5Sf3 z?nL!l>}PY1x@*bxnk6LoH*E>o`alxu+gCU#iIF-KIx4A#+6x*CFhf&M!*uL7z`#(G zKtoRf*g1k5*LTs_7O)Fzy~<$NSZH0*4pgH{-YUf z=3_7R92St0o`w3_StE6l?)cA#mkJd-T>5IjUpVT|5dUyvt)MlerDx3^Z>wS`OBtn; zKYt-?2;iuADe&t@Y&@Aku;E?pDHO7CcycdH&K(46z6VcaE5X*NQE@hnm-Y_TVj)j0 zbGJQHC}{g@50`)8BG}>7$TT5%2C8rI{g>J|kWC`>b3Ie-KOo!Oeqr<*$cF5H{vXIj zTpMKUdxP48ZAJwXi;6x@2d7L$ZWt4W;CyZhI7;FZ@GUp~s2}^wL{VRYo@H)|{v!-$ zdQK3nCrB>}Ur!rBF;5cVht*LLv^1nH-(Md=R!f%$O3vfG$G44SA3A(Sb{uZ1{3F+D zHtHhT=pww6mw?RAejE7k*Vs`dy}m|8pXLdgc12{PO>}<)!mMCItj-cq*`HcWBq){p z0;P&Cbo{{ICk7hW`0P9&juniDC;^C0;_r_F<*Z<8-~oZ!0t47QV|~gxJ=EVVt2;C> z1RN2m@gY>B%o!*Xj8CgB!Mox8&oduw{xn-7l{7!NE0xy>jMG2q=f8X)7ukP5Si_rr zr>U;A_SItv3*3}W% zN06eOa_{}ypP?VgfUCk>hn=?l0@~LlypczPJo;ODhwwRx9I5LU6q%)ve28_0R3p-{ zRd@`jQX@|~YJYtT>_pWD=k^EIN`(8?_=kc$yKcprsQ$B4Tlv+IVPMjBJ`-Qe(IVYy9xYGK5e&Uv8a($6~mk)u+f?{Ico0?0aK zR?>Frq>g62^hx1c7U+%;BZn#wTTOJkHWwn1xS! z-2tmMo^Td_GWK13xF7KluH!O7fZL=`ywo4l!5}361O2~+(8AVWx8^nGa_~^`k5ceZ zOwJG8_7?1QcQYWT22=vraDqu2ENelSFoc?bIgwICxcmjMa7@W&af_!qpz2@iw@(hB zuTbGblLJNdAUe@oK`yw6DM>E#<0CCP#u(Lvj)V^m=pG{no3nr1BK%-5-2} zUvmMDjs7vLE|0Hbo?6|9l|1N#H4D)Jb{;S>Y}+{^z}f(!rkpKI=eO95t7uPJtGP{e zc@bP1zN^bb8SfC%eMCkayr=+N8$b*&!rDM~1BeW1E8i|gUinEI=xqRP1BljO9N;z- zBnq7i@P&ayF_PyuOP1=^Oe)yXY~;H!fbcL73v@Bi7zVPV+!@B_pR}QhLmmI~45thK^I0bPU_M&!fBaeRWE@1A3S-|#Jma(H^5s!-yx9~-WkFwp1EP@mW48AZ!xpS%WU%M zPtQ5F#DHTX9T6nWdOFof+J#;f2foBkUrADb!cnPqv|b)pD$MF@WNXlX^>&`OLKU66>oa~)E`m09+%GS6*ST2Sti(%k6Yi%VUE zpRDvvWtwC%mEPK!iJeB7o5^RzXN1>F2HsVNP0WkQb)QP*d$gp%jcI?@4HlOj{hFrWA>x7^OABs- zB&GJFS>%8FYW@i7`)U6{$F0YAJj#;M`Rm{P%2*EbAxxQkTbrOZ+BM5GAB1|xS-I*< zL>X;)KPStENp#n)(z`h)`aY2;=LX_8BWg|x=tXBZ;QZH!LJ!!-x}wp3y>-$J*hn-M z4E*hLJRA-~OJ;n-CWIei@!?b~Oq+Fb69ZROEJP(=OF`|_KD?(=f(wcmKfCwOa&xwp z1PRxS)g5ZAdgShqLK50Za|_^M4<^<5*MfqRBMBsuV810~csTu-s}gB(7HF*5|G4Ff zXc+TVUr0zPWt<|BBa$KG#FOKM?v)Bf;CGokyA|0oNlm}=j&Jj?keJ0}neRQQU2UJO zF%c!S=kTVgLjc$U25JcQG9zz}rdDEQO3Erao6Ha>=<^?y_JK`=ucYsOmsImr1iwmI zAE%DsO7@)Q!+A3l9@HJf5BSyg>3qlk>a2S4X@4wcg!-e;zK`PyO!Fk^L>Cs|(=W)- zG9=2zUsJGi`jLtH13m%I_)hEwr0a@Y@P*^!Md2poCOUTym+c4;D2} zH1M%J;k~~M9rFz2u~)HJ`e@l}sa62Zw)Dx_K61iWelnPyhO4M%$O7+g=Uqo!43dd{ zA;V|2Th)Zi^c;Hoj8djEE6=^u2$Cm_yMVPn$$8Gh2kU$tDfIIibHumddy0edpW7>3 zBQFaZZ}_3)$lSj3b7BClDKxko>u?v*r;wwOb_@H#FB9*xh^kt!&dmkOhWEX^5dSfQAwV8(=<~4x3&MgT(v;)!_K#APFIPi||?F z_xXRgotA&No$Ea54_ToZMWYiAV*pkR9Wn0DV?3^vZ**=8;h$q}ztH>x>%b`iqA_&z z5RC}aTurkta?n$nalib#IcmlYKqkLaPd~K(!|61qzi~Qy3m&EWoYVnC{GK}{8|I~V zf1@n_V1{!MU`3Rq1#;Rf8JV@0zMIL0mu!S#fy$?op!b<@_jT60-A?z){OKf*0r%G{ z%?E_KQuOROt2hY@$&i2o+Wp^I_8G(iO737xh+&pd*EeQgv@g6j}*Jvp`J( zs~ITUh&0=b0OOr`O2Abx(I*G2Lj5;G$4~9iPp@9R)-UA6=D>EDXKYPtQyAnEtKHAx z{$hMm)2pq0(fX67BXHS7Wc0Q-{?eyeaEvjGAwiH)-|~7>FarOS_flomCV}+&;I6$4 z;^}8;gSCN@r7$h;ns?HKHS4EkHYjDoz1ecu;-fIInNxYgGrqrpZd%H8DeztQ5dT|y zdy7r#yM4T#!wSm^~3Q2KflZGP1GY+I1@ zRA)^ioS}hD5@|H4tx;w=E303taUlgLCxOVJIRVEckQ8{&4MRt1?r_k1wc9^H@F)wV ze*I(Tt~|;fMaqhl+v0I<>rpi2sdBXeF0hdV!Xeh1GwU5eKXtx)gu)gg*)(}mZ3d?r z-cTD}f571rBLN^J2}Y1PeaR}RXTGJk59dK7#3|1F)e&}?A>)ywt%RdBr2& zB_#%0maoy^>UQ8Ch|`L8$6A?JC>>@8BFq)Xz!TF6&KI*!i#=PCZ*Bkrl9Ign1vElH zF3QwpZBQEZ;3gxnbKro8=Uss+k zI(T1AiIjBBx;SaD4%_?ny31}3WB<1QEeod@zto`XWkBj+Z9wfD4EivM__8xTg>VG%XH$Ch;% zslr-NO>ek%R~h!J>vz@-3gJzJK=9&0_xTG7pq&chfXJG+4L5UT1jxlw~LxJ&qh=3veBSgqnTYc(c+~?V_k?PcS2KQMVOgMbCr+3(^LFD zgVm^H6ZpJfmhd>Dg2ZNO18dD9rIo-W$6{{kyWz~=Gb0M&e@THU(L9!k`fHw!?>bCP)?FfG=*+r$ z^DE~w1IH1gJ9pS4J?m}B;BE$T)TXsrIPtIAvKB_9pB6QHsIy8l5&)4FM7}VF=h-T3M4%+TR!5lENi7mr zS#2F$cZ}PAGSRCLVSd74!NhrRho{}eR)mH!4ZpqGu;Eq3_ zA8xg1XY;?=EwqRn_xiq-HZEqc3v!7+b-vfKDlM1YyxA?E(LXWISDGlwmX8*E&7^z} z*_x!{5T0$kxn;1t{izKjN8HRXk;hJddH8uhU9DN48DZ~?R@f@dR_-^NXkPIxeG;dy zxY(2+)@_34vaDr#iwGxA5z$?Zm-4L#NRZ(m>$9q4D;$$G#}l|Ql0Op?gdjDXl67@g z5F+$N{m#KIL7@9v!R)-enog=eSC&x`&4tXDiS)4~Mf|lsWGhl*?*)?S`6Y`h%-89w zv%Pr-`51%OOACOmlS&fqTk%5>;M7UQ1~D+KJKChTPlpv!%vZ!h?wi4W5+!- z;>M8cd8Ba-oVE|)aT$h^A5r*zX&f~pN=7lu5Q^DCD0MI{aP6~AoRXTtBTaNg93UIK z=bCkG<{2ET5LeoCcl>FuUw&EF(xh~g;oWO!+<|q$`Z95h&5lriGABKlcq&PZxxmio z#6ptd2_UoLf+PYAFPaAnAms;`99}d=OExkF|f^7@*r? zO1rizYk%$SzN21h$E$H{>SUtCsU+~+JUu)mI27`cAEo75?^JHw&NkJ8gI!pCwb%NX z<`B!AyYDri&-0{pN{7zYDKdYBXt<{DqO?lDhH2b`Y?yOervl&E(BJxokjpGu8W2Kx zYv+n+KNNxL#QyfLUpN!*dBCM9Zav%=OAq4vWTa4eN|}%MKhqU8)HiaLhQL+7Xw;$7 zvAfVe3Jo~lgv>~u^UO;q4jgZ&VZ_b@D|PqGyrYppY*Kv58H+LJ_=q=366h|$Q4?rI zIREi5&N29F(f{LN@?VQZD|I0~m7D?6&$^}xP<_nd)0kl>`wuss=>F=pKco2@5mBL7 zj@RSMSxVO7RM?soNHu~(TB?7yoI>S0*{byZy@+zS4=GP)M6=!Qn(R6jEb#0eyG3aA zDL~_^#?;%>qKaz5M~oLZ3;JP9(;~Wp86W~ZhnB|^pv8XU zvkpD*VYi^sW1|H$tMWCfDTUrLjG|gPlfst25UizGQ|ArfGaAJ*cT=j z<<&$!UXckmP-;T%7mK>J8QI>%z;HWOblXkUo%sMn!IJvNK;StG1cuNx&9XV|^aUS+ zN71hKR(%q(=jBexkEVQ98|F%m$q%iG^WV!?OOyJ1KCd;=KCfSMuaJtw_v?`^cBeu) zeql}PA-GuRMRGREoJ8D}C>{uz5QKcH6BDDD#>2E9b_1y-Mia%FeM3pfSILRO8K_h6 zLNvf2=`h+)eop>_JP%*R+_IVklw^Y_kY;e9XU8w4%Xw zwI+BvQq^G`uvLt8iQeD`MG&nS^I9r{X-X`1PsVqZ8hFM1XtOwOGv;_v?jA{l*+nW1 z5i=^BxvK|ercCU&Wu zDJ|j4X6Xrwv4fCKg^$!#0~}pF)iXC=^0f<8#JtY)?wQ6OH}mfDZ0%jOLPT1Z@{*}O zW$HlR{XwMGK%&(!o_@8aZu$XbE4LVDyO7uW2%wNgztYNU-;?hfmKjrqYj6nKjP~1)4cxf2qk2 z!&c!9c{foQ^vo6E=BNeDPe%O4w0xjj`j2T5x_4D;)GWTF{bN!yre85GmD-5qila~C=ON+2iM>!JV%j~5WDyKJKRl}ng{^M`U zpvkDUq|T^i385W#p5LB17wzNE2$FR^)@DIH@}>!k$LE)qU6^fE>btz`*JlTZEKO*E z4!E<{n?GK!8^HP08#QxEJ(k{mdHPdaQ=ABOV%b~xY^`xK0{m4DkmD448&JSDxU(vK3f(KFl=d$DHLE|XxL zTfpg-;pXd8SD3=n^ZDs4&;FupP2Jty8nW}Ly?Z%BkK9DXAjz$(Z;UkYQ&sqc`hXWLv}EUYMNhNe+^14+yv?0 z!tQSYl}&6=nRSxgK7PZSZhR$5dGifV6qsH2(58||>wBBOlNvC0|REDSvZX3BW(?4-U%#@8uost(x8s>dk_waOyX%Rv1yBA?a%`{!+9OW z7%#Ls!_)b7y`h0z3OIhCqJRMWA4ijM1E^H#SFvZ}*xe^9SQn^`i&ho8dVOGGz9#U# zW{-RmOv&tMkKGn(Ry*AhYg#NpWXqdk&s*ltq{$F$omM&}yW8m0TWj+eaO}M@8WTsn z;kzVRu#mqzS%noA@Qok7MK{n#E4IgY9Yyc+??Mx+K9%u%&vK%vCQiS+j~*Fa-~j0Ex7BHx3-p%0B=Jd$T(N+l9A$pq;f=P#ZC; z_EKVhLwFl__7P@A9c8IvGf7z6rpf4+Bc z<3E;|-VR>#QCGLx!3XhATaMEeYis(}DS-+}7(KoZsU~7Cn7V-dy9}5dOkg@y)@3w$ z?@2IM-=B$3m}aU_xB~2Wv;>RmR`t}fd$yM+L`G%Y!7A(jguDov{cKjZx4R|t?RO-lpuF}RcBV5F}c6F*aCn<2O| zN~I*HaO=h^9lPh+DBkxn@-7K@*_Vsf!|+|(oX#E7p!Xw6FSHJ6s5PDEBT-(RR7nYi z=MQCRkala*6st@Lbg8OHvRvN#rtk31h(AQf`MP*Crqj|^QPsTMWZ1ms&r;kUGPxb2 zX!l&h8y#(+yPE+ALR0=&pw_0CXVDbr(mS|m@{jFtgx&3B{vj700$R_N!s{{2IGdkX zv-YOi2XA-)Q;?5U2Om_7-o(k`0~nbw|o zitjxhqhNUvR&yy&sZ>q$y9s|_^dYgV4n*X0wemQtu1YU7J5*v`F0A?`%ltQ4NppxfKf8_3OFI zdkxe5q-)|77G9KG`5S>hAHi-wb{>4r|Jm|R(3J~5=u$+7K}+7}i261^Tlm&?{dYHg zc{P2fi2VJseLt99`~uzqEVoRz#9PCKq9XV-d*?*_o41)16SxZc~W|E!}qU@a_;qv6P^GRqx& z&#q5-nO3r=SAK%8g6UDV*Fc%(XNzk2_1$LQaw2sfsKO&>R-Ie?6s8*(qFH!J7nh6Y zfux&q#0%ARZgL1qb2{zaJJIcdBlzVMUysd{f@3Img`PXv8aD5*BAww~x6Z&r!vv{) zCT$uSB=>o&B=Gk!OMaA#Kd`O`CN^7lQOx~eXUtIaBSMF_t7<;*vNL&P!K#3w&ETVO zO>aFy%5tL#zSyO$LKbH#P)pM3f`gtbGSFF zV^&r{VFCUcT=E3HZqRs{2pzF0`sVOlSeq3j{DHb)kXH)X)m#q~{*WUZa#Xv$tn zx;ZKV5d{$+dKFp|=&7Wt_2J~vGP!3vZ2D0)RYiXMTA4UoYrOQF#s~2k&3Ill9edFT zud=f$=`Q{dLX$VQm##l-)%r_*qM4X8G;uhY$S%eX9Y>w%{I3Wq`Mjx=b?O&QIf;a7 zT4F+*>fzzWNvxtrYw@D_(3Z?le(5ydQl8X7M`lB$!3IXYAf; zxHhcX$BMA)DK+Sc_$><|FqfCrxKUWYzg0ccSIOQGb9N|K}eFNgp`9UDfF8R3vGLIkPXP1 zA;*8)K!r8}<1qLTg~7KFu{PJDW=KY%icc@7!p6Q>%RINDCRR7vLM5NjpCETLvJeLW zop<2(O0?FJ(u;phjignQNK~0uo}u~k9=ceO4`_%qBksFYzLm2(j|L`^^fv}T4!%u_ zD&x4-K9Z;zQH^X_s7R&BrSjde1ZxH-%GP}OfM+=A1(>peK^!cSKGRlLXBpJOQgjj8 zzL9-=3}vAz_`0>Wi*S`Fir04$EWtlmC(0k1<0L@+bY0H!gR5Sj-7 z8-wX!jQIflVFpr!w6flfR~8^}n1KjVzt258{H^iOI`UOAP3HrCj^OS2%wv(; z+;6v8Obxf|<1AeZudL5^ZPL$9LID#D@fHq3=M}|St$~N-W`Ems8_SVD@R;?k<@r!Y z`0~;fq-(Thj*DcZv_72n(DHZ1L?N_Mq4~;u^p~4T2N$LJiC4|-+LX??rU7aucCkZXKk)@ zKZD;7n{drQk!7BQ*JvXKc9SF!!C;ui8*-2kFQ0O zd7aUZal~4h#wM3AER&2Qn(XLT-<0%zckml=D!}@rS3JGckkwV@0@Zw&vzWayi{yS; zyQlplrW{Q_TJzg6_eTePM1Gk~3WBd%#^ap}w81b*Oc15_ay|AI0ff+D1s!Sdat{F_ z-i*|T*1NC7_l<1ptCMD+ih9>kWk9AnaiCRm=xt*#8pOXBl)O*G4SdYEO8J=4+!}Q4clEDZT!Fipm+RY#t5`*1a zHkW#@5d2UfDEZK4hQnPu7S-Gj&N%u%`IY_j|apqPQ_AbLlJ z*=$8JY22R~=glF!M3c5#0(g_(O~6{{B|ugp_^%>-Cl}4HKDF?I!#>x(15*>@GV<{h z%$Mb&r^OVdgd0P7+TvO(9vjKb$?Y?@|Na$%wAuU^ILAJniDuHAPq{~!u^m0^qI>V|Zq5#9+VS(OSE$+WV zZzELJbo!Xv^ev5E=tmDCvz>xcOEn`t)_8jU&36uYx=0esr81(N_6b70xCVF+tfvrL z{Szy=RmB4q_>B~jwj54w6=Z|3cb-WY63#eB2G1>ypgHyQ(o%V@()3z!R@(_LbDhJ9 z%O_ucBVTp*&mNRvRiXW*pQEK>z%(gQW3oxR8u58aaCo4iGKZNGVB;A~gaXNp`mTUY z^O?n$3Wzbsqk>dZoBa6Hk?&n=@~$W@S}?jwWXkbsfPOgmUb@t@?dgw6b0a*waCA?h zgy4pC4&Enbx)$2arSJ7}aQ#B8qVVBUcJu6&>#m^n%yd%Z#fD>%?kk5RH)sO>x()r>WYwwOhm*R^TD2@@ICjEZ5L@_U`8XlWc5;Q_j-p^W9$P!RXpnDtusV}-F#JU* zAjJV4%qj&xKgbImt*KRo|281O=dVDMUkYPiIr#wb5HoPU)LHR8@v%h0`x#|9vb0#E zs6kdp3!!sbBRNT#?Jem%BzXKGa_)vUJ(+Ne(z?g8+-O{`T}pF?Wdy6lG=1!Ws<$V!&? z)}5H!Ivh#y1#Nm#PwkcyA$>B-WT`oKb+oD$=bgOP7iP<`^A$geSG%x62tjk{JDgdx zkxkxcZ~mn!)G^PKO{u95!P<~Cd=RuBXA;x`%U5VGG zAFl}GUi*MHCnJd&{TTIhs<{)El!VWU;*5h%m+HN40&j&$_Dv+1+!_$V#oO|v7UyA& zix+>cjG_7aclXLj#XB<#?cjyJPgD6sX7IbE1Rge~5aF(5?NpVq#%D>n*-Co)QO~7f zbwMKk5qC=!OaLX9ff!A9+z=K85MQWooZH<($-N*K?;xB9%D`in zdJHqzi?ep1xcTj3VKRW*0$PKv0Ipg zI4u78X6UlN(7OSz&7*;q@704?A^NhWN2cl()wt$ zP8{_5;IXbb0D*}h1>5P9vb|@-gGF?PrW%}Yf7W0LC;#xVFkXwV4S8Wc86JMBAk_0UK&GanNKu)uM8yz6 zRXr#VlDNG;QR#K7|FIy?cy9wZmNVc&l555DC=pZ9Ck8MpN|t#ny67JHTpt=s2Of;=hcV!aqkoa#MMJB5E!LZjwNZ(2s!W5fwL3>W`=lp!Wd0V=Aq;oj?`9Dv|+EC5~yA(}RyeMe2`G z8T^e2pm4$|NBJATvZ2M{pA5?H-FDa5hpvN9^J0Y{)|j8 zMt^Y{Ih8!KCTJCSh`cm<)QDBOcegkpk5#WdQR>M=-dw#9q80VA()v+z>e|&zu!xOC zN?o`6!TzgFS-3t4yo@3nP1ZLOSAO?(xV*mPeBIp}{OW58gN++LJk8Yffe(G~S9pN! zCSm?G~;9QxE2#7(Y#es}-AkHeJUctiY z(Z%x-es|NbRV-7JCrnwm+5Al_r0$RAIZ@->K`ve8fL_kjc-rtNHp^4^W{x`;uzNse zJ?s?HJ)FkOGY)l<6-KVU`Vi>2CF`N#Xxa-jmQSsSK-SuL@4ectUOHLY=KXBimR_pL z>qTWdsUv1O$#KVh3Lv-+hjzE#J)V~%SJc%@ zIyHVSI1UGxje1==ki>B@w3bF=fD9OZ=|iyIa-zrC_3v}yzUW1Vcjb5sIm*WH-;JXv4vJd%keg7#Wns{$$d{xox4J)ifs-9Zx` z-fT-u?hIuCdx~sF)5n*Q)TVVJvXXvLKCzO$h`S^^dYNsD&9xxOZ(ij_9YN2D*`gv> zRQThR+E`_7Gc)y52qC-ZND)1^&Y!O*U+}b4=Rm~jVzyW6nS#cH3AH(KR-EM1x9S57 zSR|pet8=@1q+b+DjY9iYIJxC*-o~Gx+Tos7<F-aO(cHanFN`$7r?*BRY+RTZG^WbrDU@*bkv*y_& z4f3t>+ZE=;YMmEZm&dxjQN@WcDfr>tjQ+&oT7aNG{LnY({Z?+GwHS}1b{30ktE(;2 zb)>J3YXKuj8;=>}jpuk>z7kuTp7J(XP}Fc6(Lt2caOd?}3I366vZ`xU8@E1~45kH5 zP}&a3p@EkQb$d_kkZv9xPv+KKFC<2NG05%a6uQR;R`sP&B&nbNM*oP4^uT|92vPtgFCA0sw(`=Q zNq_LVd>#9=5WIMQh$3@hB6qDXl$hS;4aG@B%Gumjqt&(8&HsFL5=c(Ava{+FimIt5 zJO)hYP~byEr;pD&7W)>I8aI-T5Vc7q!XDk2?U(m?BBR?Ivm8!e@pP^@8Cfktn~vPA zB(n3EbWXFL+!$}u>~UI`s@wZosGmcJY~E49EU&^HeglL8{~~mM9dnH`lC^Ce&Y|)U znOn0a!1-vHTJqQW7jvT@@4n%FqNduz`>hhZ_8kC1>VRAX6nYsA`C{zbSh{4eCCtZD zr#V{RH+Gi({@%ELa_@ToUZ=iLrCFlIVuFdjQSx>H4rQ2!0j$StqYPKKs|ESR-sSyK z<49Ber|pv-)ySOp!g@a0jpsFA@*sLEe^FalQM*VJ-j;rZQ$=s%yzz=HKz;i*fMpqE zNk@jzaASoRgT2|~P7FH=gp5hz>9I}G-qA{)B$~R$c*rUX@!*9GW*##PvOj!!yDNGB z@c*W>tGh%r)%x$Wg9YXoMc40>D5^RSs0}=HRdCH@5_GaCCNK*=Y_vwP)p7>J&6^iaDLA!;9jh0u?HQJ9Lneg6G+#{1b{=LgdyaJ$0;!o>pr6p(w9`oJozM=MClPK>Hw3*A#(5!19Gxedc|VMjU#W;k{E#)=)$#wVJQm9&X4W z@4OL{zZh>~sK>(o=e}1QWVh1kjX^>9TOa!xkf%VR3 zg~BtOOIH|(l&EuaOl!2CzIJ?B>w^pW*}hd9S!Q;O|eYs{Gq`zB#EnsXb6@liawao}(?jxIGjjU>?Xgj}wH8>@A7 zzVCBZFc-n|NQ~0}Uyi7dIxCG5)vmze>IOM*I738+f-#7_e~ECxE@3bYu)pAvqv7!dRCIM40-G8Se~>EWwGn z$Jl!Amu<*2KE+b^;AaH7hPYjU;AY0>;LncfEKSRiI0Tfz1 zIM6FSHF><^DFgpzGqld$1Gw$x{HZga zCF{4)djU;qbppq639AXt&w_P+P^hvRNJUhGktr9=YcZNCWWb9PE(uIgZWZ|N8Dla6 zVW=$sIUt9OfQ(Sh^_DERT`zeKTf~9=sW^L8CFd5=4CYJjY6Vb|g)4*E*dqS3_d^#1 zS`(>0DV8w7-!?sLnHy=*|=nok%-`RHe3-1W#BLy7aw(ZdC!6_8tz_6 z<*`G@wioaT!Q&?B;dno&e~rjRK~a}%x6MWINCX-$m(KF-UB8>@F@N&v-+$5 ze`WUaPb~12h=?3VO)GD9S_LhHfet{3;Iq?KzA`Pnf7Dm= zSM~MrRefz}@CFMYf7RD!Y_R%@4RkGH;{flO@C2|}8z|Dm|6x-BiE=YC&|o$N#4_PA zK|lejOW4>5v$1VR5uNWvm;qK&B4GfLlm-ECCnXXD1v{6|Hoki_E`0aMD6;p^7UpGl ze6Ow3ZUox5qeIy!H};>z=_vAUMe{I>KF_vsfqQ_AdJDRl$?@5;5xJTmXsIF`DXTI% z`aQ%oIz!+;i3!ReMC12*+#08S)|^k^{kYc5)Bzwax}mHTac%gx#(s!9-R*Z>iD;qqBt!A1-d zsA_j=_B{Ajh&u2@9ysg_2ROlzQG)`<6*`6zbnzxjdK+OH5@v~h z%sZG;n#kMc3D@GhV>P2`$Lq<`I04B7#jA?~z z`bJYx0arWUH?+1+%AsnxKCR~Xq$APZk5a_0lm*&!OAoZhitL>=GM&-kNpFK^|NLZqW#|DaHNw0jnE(A(MCOBM3q5WhQS#yXk9;OVYe@CL>yWzt0dXdSJ{Ht#UrE4WJj{VyQvG zUWI49O0B&-{OR-*@Xre!GaImv)}=f1%wGpT6{XL)6u- zzeYY5cdo35VQJ>E)R$B-E8%O^jGk<5dhaO#M$F_Ugfh?8Hjy`TawNe5_(Q}3eUw+E zsTCdr3-EUyz%nzrIx4>Me@IWge+(eNLOuZgNM(m5)V6iq9EY{+#JpC1GwZFT#gT-1W z&(l9R4I#U>ukhjS6+UFn<@_GiaRl~F$VovreLAm*!T&`16*0tu5yM@*lF=(-$W>h+ zI!RpwBZgS?Ysr|cLrMi{<#pDxtaew_a_&_3RHtIl)|W& zy@8r;6H$YJQc$e-p^INch1)^&M$74@nxzk%g0M}-`sd1g=cUBVZIn6O3Q&zljtgne zy32My{Q04=(`jb7bnU&C_vE@&&mHPM>-La4i{Q(*yM0C?s!3tL!(e2KgO5Gg_IbbJqJFMonKz63VYst<&iKfRwTFsMPds^P0O@0>d zg)f{Nk}FtU($0SogUU2weg98F=DR$H{S{s?t0rI6_*P^9;mtb97zHW161IYG9~hu9 zxURl89T&{CJS!Uaj@i&C;hnrH&Y6Pf+bskK?!UyFut!U(=wf3&yIh4l)z(uvFT>Mt7=}jV7NyLkzJtq>D zTq*Y#$H05W^b5+$aP>7FOs`w|G7`Zsxh$-nn{pN5_9DyVk=l-7cqthhUXj<-y-)Tc=^n>xcNH zFjA#-PWDO(`2SJ@dN3u}ex(G>QWRc7L5n#3+A0#`jQh(Pr~X3zZrhSlZdP2zu_#)I zmW?JLEyUgSMiZ&63PfV4b76%C-uPj;qGoahTwQls>|!{=QAk%ewb;&zY{kC%dYtBH|Fh= z-nXge77#?xD?Pxz`!9NsPT}vHZT`-)?ynJz^DiOVt=SPuomE7X=q z8-!@`jgt5z;#_`20;I0A5XH;1CuC>Wa&mZOasNO6G5CR~T*o!*YB@ z{ybKdB=%A|f(~mM;+U%x3B=(AdcHJID<{QrfYRz|!B%IB<&GF4_Z`A$Hb+{jl|D!j zcSTWDcjV_qaX^tY%QI;lFCYGnNI(+aw2Tu@VK?(NbT8##9pv%8AWOWchApFl@{?qZ zaS-?V>;+rlxGQG!O|Uh^azmrNBDL*Ml2x{-?ZEW!RHPxIm#Q+Xa^^RY9lb7w4j3bk zSP=+QuR0Fa$g%odx?y@M0+Yl3V6JpN&8=NhQN3pNLt9n!{Ja~AHg0oOO90hz?-rl7 zUK%Aorle%70!$G!LzqRZ&tz%=FE8bnFN2xXB@uPNv7$6|S9`;pR%tlW6)fK`W}*{* zXk<Tue$-7E;~DsS1QmmKHFQdX4XRS3(1092<%+4fdVP+4-e^v8XKCA~t{`x8{bBsnxj^){}%Mu**t z7x3k00i>2@AakrgDfOuFuQOFH50Jue8nr6^+QdM-}>HRH31oL{ho=Nq#WwHs=t zw#gf9hN^n(0ZXl6(sIp<;(ED2R&$+- z15Yaw3NNaoUST)%b^9SSQfc3;zpLvN=bhvvPk=&Tf8<9Oc0>$f{fSDI(dEX0->-!x zry#S%hWX^~7aU?yd^Jn`n{;WjtzF4V(?AisCx_PuZE13Pw5)F-^Qx`h$ZaY6eVEY4 zo@*D{r3@QWQs{(-5|(zML|~0)hgk0V(4g^@&Dq*Lm>_utexSveGmy3*x4eulb!F2K z76c-F-y0_G%W(2`N%#JG((G|i`CWOSL&%uk)j^rIc1PR6{HbB}`sJO;xt3KN$EJtz zUYXyhP=r9)xaeT8E$snoK9jkc5%p?V0fxG~zn0;d#-QhZn{AL&6>?`xP4ioqbe=QZ z>+3uis0cmPJVyz(lK8?jWuXfpW}P_xEiqiUS%HB-6370d+sFd9+_H-T@CYS&U>(Q} z#>Z5}ew9xJu}{7>+hR#_(pq6J{dQ)*vwgP5aL!kBp=O0wHUP_~MsNDi3IH1zZrOM# zFNweM>BSmYK6Usn`P9(?S!zv(5^#niVg<>`*x5FTbcEY;ozp<4sWkHvt`iyEs*Aw6 zaEl2@;{&u6GU9pivZfX6^x-<2qr`ajmUS}PGm01=2C}Rp#j^-70oiDWq*&zAa=ehO znmXNVG6*VWh(|lez>O)+SuSVUoSU0QMC9-?x!+btbn}E+)3n2Z#naXOuwisP%ZjWq>5F~gMaQXW5;7(tS&t)&m}AvDAZ-N zjuz!1_Zk9s@mY3@%bjjClh!;XHMxC9Ep=Qkjej)y#V4~Z%Q^|TT%29Y1jncdIQzI- zpJ4tXF_o|`@vgSk0%@}OyocqnG75^%zsqvMybqx9lS6W#Iv_cW%gi_=$iN#-(6&Sy zGckD(jN=sF=04%o+2IrU-4FwT`SZiK7!}=Xu7Zzb6>=A>TjEBB-Q`W$?SNm1@J`lJ z0?Rb%%T@Jjfm94d^Pd9g6_o!WQbqJvjVYr&f|pX*Y77B#oD=`?1}xJrDiZXPgjs6QR$t!VxWTdPg! zw@pFIzsSq3XWNhCPwFabNFE{~2E3P{_iO1-M^!x8+u>Yd*uFC19Jd))<`Oc{N zjM>44h>I}khb*7#)e^!=gzaO7^^fcC(VqJLoPolcMN&z+o`z7%h9bVhHMM4=5WVQK zXA9&L>CFhL1)KSHto$rTuUdvErFg2XGw|)!qt@$l;OB|(AWEPLu02YS^aD)X zQ2`1-{>8t7?Hll`EmCHV2hNvBKA#3FYFY9&NYHIx+KWH`d)I86qs_0i1e}(tox`yh z!XEFKY~=C8ATh+WU1b;&QF~_2q~&ggtLlQoZ+{B?aP?21z<17Y^*$V#$tI-2Ol zuR#t&6X_;%OYw=LtIuLhBpP8$4C^@xYZ9PA_L1D?v-I2YA4Z&VOS|R`^cn8BoNcxb zf`@VZN_m)J9fS;T?cnc$bEfkAkLoW)0WA9&BpV z0l??=#${rU@hHcDm>DwudeVGWl%uX){4r!6vF3&dQ=aa`mdXgBtQLXJUgi|wt^qms zpq9cn0gx4hQpd=)1547weYp&2H2J5~C!g%p>TWye4p%-e^war8b^bhD_~Z`Hf5E2f z8#Fxy^z7l|gFF|~H(cA>@)nS1+C=quWk8|GGpCZUMd=*B;o#eps9ZR(4l9Vtf0U$f zu+<(91Smf0-E;pGeIZ=1>N53OHPBUg-4R&kDRuzw2yC$Z-4W2_J1wfah;*yw9dWe~jv@tGuo4gnsxBNUx9;O6e;5KvRQP1i%{t zHaBepp7Z)qE%si_mcBYe=h+ue`C21zrl}^gN8^5(3+N*783Hk%80ziw`*-sQLer+m$oV z>DSV?ZVb`#I6QEC!fe%N?V+=^w&2AX*X07|cHwH9vnz+dxm|&X*W50p5YD{(UkUjL zEFrrwTdvGE-nJP=ru~TiVQ)rWIyH!J8D%q-=rxNoe)K9KA4mz~F_GJWh#q`FoE+5d z_@ssy9BI}D>hftb;(7^c*74>kjKyh}+tw@_=_46Dngw+}?-0k~fDT9(p{lzN2DAN9 zxOcXrmC|S%8}#B$+(I*}=~l5idK5MmZS!!<~><4Kx>XSKP51i~kdc9)kZ70t^v z;^rr*1VxSD>MsA~MSp5%`}8r($W*!W;C>9|Da&Dc1x*;8@`3mt8O7i&zX3HZ*UwZc zbBrVj?@En^H5TzzchiCCCjv%7m475-OZ<`EdW)pMKqn)v20;x#MGHC%AiyA^1~tT~ zQ*ik4wpQxCQg{cq{7T1$)79v~4_!!c+i90|v%l}t5&fEsNk|-7MTOCOl>KiPyS{m? zL!Uk3bzd$7?LCbPRP%gYhcI4^pE4TVpIrxRlCjy8GfVzX!;JjtsoJ)Rdfs$YUI*Nj>#tSJ@hO31HuT#I zhI+)jnAn?k?6>ijB;Bzt5bG1Lw+|b8kdJJ*KgSI|lXgH&E@Sf=mH*Dy!~ z3b>phZm7;3b0IkKpShgseT&7lVD{O%9C0sY>V)dRp-yS4KktWUdW?`zG0D3#D6_x53q*}^)C)}g@*6RiJH}~uRa}b>S#g2~LX0P;u{E8MV@HSKdvwy`>@t(bxPSI;9 zbmLUC;A`qGq;-cb3G4*#eAeZ|GxEyP&&IRRUGfS~EYSlL;ApO zAqsc;zEE(%cCXGTP{Uyv`XdL#XMOZ8UW?6^sGDtY1Gw}iFlC^KDL-rV<#g+07M|QU z=_66;lhB65cP|C%FZJq3>8QPXf})230(sULpFcL17cbXAe*EyZP#}VbW8Lu2AtFz> zj%{tHM z$DMl>jO633drN<9!`4GGZuz(G&HhriU(S;IjdPqOTA%ZiV9gwpiD{*v#I>~O z){`4M+4EQ(**)DZ@w+#*HS&c{HMHNJc3?kjd4lhnv#e$!wW6a};Cu0ut>8T< zQbw`#HHysgA6>UC^mzx)DVnqky|aT_ZAHZ%$c*k18j}yTCo!9yOyS}ij$qGt=PYcD znnv6J><7i#6$GK_yROdK1AT?zQn&pZY_i{ZM2hH%xy$8+C|nVv)j&8IIThDD?W&Mb z-+$u9pnI0_{av*AFh##F{+gdoz|E{k*N4i0PLxfQ_~M=E*F|zx4zvwe>*Dh#?FJv^~qKlaDps5cwZJ$*T(cPrB*D5 zWlJ4RmxW7Lm>=8r^&p?HW3(F-!v|Gc>ZUVj1?n#ug^s>_yw$#4B4D%n;vixtIeubV zCfKAexH*&i0-}2OlJ+ zq4kNcr-$M;!fKZ6%$RdBG|w;LCQUV3{k*jp^r!@z8N)IKslym)x7v+PwEoe!!hra! zh!Ekbho0r7?e~~4Bx9?iLL^ZE=Zh;P;NNa;nIWL}D@0!|7CK<_{lz`$y1MN9oJJ0Q zout>%y5ctKir+?is`WKc6z5;osJotOk;HQI)jj$eSsl!}uUZTxHhXGG#S2_sW-@Pz z8h>js3ckB2A&uII5$iiO&8J7pfcqgge9|DT^htT}?(+LJvLKaeYCImR*~o^wfR<*({O6jUPlR@gMt-}D+JmKO%NCR;)#2mCIHe@)~+(xc8 z`0t|e@xK(E7sHZ0P0t)y;L}++FTY`0(^|z2)iwago^e&MJEkJ6Q7m?Uwj&wAs4>V= zqU(H?+yj(li5Y=v9x@yRWsw68x_ii{2Ee%qPZ-iJ0jO=l69=IWRw^xSoq>|J&Z-|X zP7g``=AuoHy`OTcbKm(^``-!a|4BReCAR9uJqRiqCq6=CV|ZMX4>}1iewq^i_oE%@ z%Gl?iUw^booidAm&w9d zH(~HJL&X2dMfd$X7cH7i`|d`?IK<2=DwLo*pYs`khx3X=+0s-n|Lr2qoD@g0?wOM~ z6eOq`YQx?W(2XXi1nEn%wxte}{>YGgu|xVr@{4#r6#h@i>u_mhYRBXF93D4Ui1A$3 zpkf|Rjq?7cMQ&B5x|^sa7dd6uNWm>(_b8;wI=R>0OOz9KAp!i)g|}Cu^v`^E4mxq* z$k=C%6m%?qTLeLhy(j#f(YILFop16b>xY&ZQ9i5r!0~4^P?xXc`+~^PmR!6i`r;b% z47L+_wz9V=#5gtedX#L6H#z=bQDvS&mpT6LArc^YL2v87D|W0W=@svl8Em<-efTJ@ zN#yfGpE`Pc?1m!jo4`i3!=(yz)39ep+P9+_7sImxY(Qb_mZK{ywSHVp@ZBE>6P`H- zRc_o=1+0**?_QZ7{y@OCSa+=7@`w#+8*2iht$3IqM7%j#Zvvxr?YArY_C;UFZuM{E zK!j)cg=*A?%Uia26*MEZd5`!CiRB)PTPszHZso8QdcBuZ{I zZKcS8lKTz{X)BXlivvy4Ff`1|bY|Vm`OV$x*lT%WtQ6p1jy0a`$BJcr*k~{{e{hYY zsTN;R-sKlEud6e9p`Cmn@;E|@odbQSTgTR?+}Rk=;(Oa3p@u{6S1^?4y=*_dFpnO1 z&%|IbpvO>SK4b3FPhf#y>S5<)%e~J*?H5N4O5rKbGsNdnvyv3Av+m+^)FjI3!i>jB z&#RCP|Mktf;^>Q&VDu+)EQfj;nDLhJdp?G{x+##?i+R17G3LIzo*O;<&<-9^FC0&26M3CbUM!s}$l&3%_yZqAJQ!_@4Sk?yBTG>3R5efTXAfTL-AO6BbSd~$iRRriO zCzWBqkNf$sC5=IPCdC~=g@fMfD7tm1ZPq5>l1HP0`W*g?Z#-cOe@}hXi4fqfAQeRY z>r=WdChu!crQ+jB1D`8Mi9j9wQT&D3`xVc$X>(z&i)^%W2Z(xpqWW$9E(6X>ROIw)Qd!A8cZHiAMl9K*);H(}iwYx)M{lgrcBxm}wbv-(pwY2`xV zGg^C~xV%yiwV)za^HvD<4I&NIn738x_K^0~Grp`Su%4{$s)Q*G=%CY&?c1xU=F8(w z&JV4mx#T*D!g=g=dz1WLUKweRAyT?7EmlUj)vzK`OSpUy)v;{ELS9|nJ|{Cm6$>AJ zSafDSho3H<+@73Z?H$ZP1m1}rT?w{2*+aR8C&e*DaLt`fqoJ$)_F@ zv)vUqdqXwF44SID$AAP>jB9$=119{SeI}zZDf_EI9UUGtBm)QfzlD6VVfI9Fx}r!| zTF)LYck`=1er0-zGV#yp*`MGtH-Y)Qu>^@3Wsedm!*wzkBEY>DU@<35If^G3cAcde z`BE8z?yf(0tQy*Qqq8RblBNIqDdezaUzc*i7uP}kkz~NZ=Yvt;mbm03Mvzm(PGnQA z)5h1jwO*W1K8l5eUz{iZ5htJiB~H$~ij(GyCdL1VlZ5|>lT=npH)+~a>SK}5E|M?E zS(oKESU5zg1or@&Dlrc7t3FwzN)q=?$dPsz5O1NNkiYt0ilj|Xgf%)M0(>@>3#Hy~ z9d^d}g%DdEtVByehxsxRX)xfD4xfl}X zpFI_KBm&h|uqO#@D&yip!~mM+hnb;QN`2WsmHGs5^tV4s zf0plr1JcaN$-#GkZ|3BVAmh%Z@O6Ulohu|GeKccHbnfaLEA@_ttK0c#T>SaWXpVUIrbB$hL}*`X{&IU0D{UH=tAF zZfN99^VTI@q|+fDJGF|;-eTpSH+JV@58JRv6JJpuGejj%O{7L>kDzDTz`qut73vlEje-G=Fs$S`j z2{dq#bAfLozq!b5Az%RwZgNiiYR$9>Ex(h)HXbeQMLq+=)wV6z_y)wtJs^jhya?2F zC4{vt8Ey7YCR`sF;GsVdQkfYQt?GO;O}Q`M@O--M0}*N%;RXkJ+Q>=+o8tLpx$o8h z?*zQxPi`w7DWai(?3F|z%UI^^F{+5P5)Eszy~RoDtAE2;{v{}eA2}PME^5lKm43EI z*W*UxiE}L8R)xu+ksWOjGckcs3Up&`D`kC>T*8A3_ctGo2hNA%Ynq>M0-f)1ST!5* zEn|NT-nptGlX51>UM?Z^=BqNG!Fj1^;LPL&W-@=T5q&F<9oI9aAH8$AYMt78T<^5h zY4rGy@;S=Ea4A=!ee#}F9iv`=y`9)(CU^~A3aEu9z(aXf63YeZ^g5b4-greV05#QE zgrutiCpOcXD1pnVJj|d)Q}UkH?i@itJoE)&QN-)s89;|2z>?w+P%%P|!^h93{zD5<4 zNkhoaDqikg$sqh-@PczvvT(f&>fj5tFh!JPCXI&bnzG`Aa-huIJ1^azvu9(Rn0&XD zXAm7dLec}t^Ib0f?5b6jB|ImXlbP|YdA`QK@hm1)e>FoS3m#y3SdwG_2~I@V*l%}; zvtO1{{ccv{Yw2v1z`gGpj9I|+g^-X$o*BfXiNfgoA z2@RlonveiceFQ&qpoB?+gNx0ZS(yhhc|Fir8gJNJva-z{*ul%100iig(qN?%JHU0# zvsc>P@}+bk_72bs$TlZS;P63edILX~@#!G4f$kYX680|-jYd_F$A%`zZfCxFX3sfL zY_gQjw?S^>qDk<4EKG!6;hfO{(qF`qO zKxZQ&fan3LpNK>;NGbp9;GKLJ>n*fECryU#=T`(kY(!LmWhOZ$z>)q=L6e~v5w>`a2sSt?BEwA0hM)pY*4!7zn+j}l`|s! zp(k-0Z#Bz>xmM=mC~>8dX!AI%7k&G@{S>r2^0&1uf7mDVT}OA<%hjdQ80&uf$#2x) zy$4y-(VuLc`#EC|(z~=WNpr5{xnpOu*C!;g6^m^TU$-#5AX`PwG#ErH6n@X_EH44;IK9M&%2@#&Flec-$>=G+7>~B2gwv0TdOb?)jy#E9lNPmT%yb1BeRBjEZ z*%#h0E^V36!b;br232ScXHPI7bVixh>S>jKXp}Q*)V$D_*DtF@dq3k4ft1e~o}!_X zhjsJ%{-iYX9`Snd_dMJ*Je!L=a%G#$h*yIc2>wV;Yibg9c*38l>CCMO{f{6l&03D4 z@3C+=;XQ8(f+W7~hFO`+G;t{k@k3KM$!|NlRxxs4`RYNpTkwr=m~;<>5(L^L)Je@tXy zkX1v09L_==Qae~cWfsEfVN#PiOkpU?EBh7OCyyD$%T~dFhPz2qn5Ur13@f5<#L_Pi z`fCI9S#>LdzxbrWY(I6t`o1|B+%J4yx1{L081+NO%gKEAc*%B3~TOpI#M} zM@Bd27VF%=e2Gl*MO-(*;4=Kf+YYUlpxp@(9w%Oq6)bAS1(K)t;A9=Gx>Y6aPkpp* z`e#vxhf1?w%G6p~>i*=Uv6`)R2nD?2q9&YY*t>WjHtsb;9_T38PELO+lkoGHW5ThF z_w12KDENt^Ah9OL^+h%c>sn)yJX;au8o(8B2$9@0LQCad6arayEs^g z^>y64<;h0J?sEwqzk}uj1oQ?8mOj4S{scYT$#+75(Krr4I;7?g3JYY%{w(snLsTR) zgEQh$pz<(T>#yWpCqDUa$$QgQZ;A`VK+;aY36{JMjHrJnx(e05S7ykVD*&&8_D7$o zr|%zPC}7E1OP%|dh7ir+tzh?-)Kb$^LLRezI27&dJ$7MYQ0I;7kq_Gbr;DA)CSdnr z0Ho9&`5X8lJn3B!ld#`!dKwzh`$P78+h986Fv3IXC8fLj(-(%6!HmAp*z;&E@OYfRr)?Dk2%d{BG~|AJ4Z6Zl}3|Q z-y#~12g@><9FJrp1du(vQ@^M$tL#~scD|z`O7nJWs+dTgU#{cVpE$9%najNvT6B-i zW{)mN`Y2WnX@{*--mM3-;QgcXr%n6an=^e_fR+_F=O+TQ5r?d9zeP)rRsBy;K?y^w z2ZU-TM??GIms+d6U=yDBmG=SgDmL5P6m7F+?a-z0kamk?ZsfLD0!WK2j)gKMJO@E| z&j$0evvfWc^cKdhg^wUy7e!@U^1ou%(^Y2y{}Z!L-igcJ>HDvkHLiha=l-r7)OFZ9 zD|eq*`t_R24v16ZgHV!cPKfgbU?uZ7az2U4-rm?)n;g@ zcDVjwExp1g!OiIt4KN1=%Y!8xvXC+xN<1zc8X8PO4L=mpIM^h2{tcEV-@2|&`EC#y z=uXAk+=SIRC=t?XuRm+`J!x(q+;j-R4!YahE*L=x6fqyJH%{SIfn3w_a7&n+9e7&erYom}O%0~0 z9KKXAbA6nTv2OB(D#|ZgDI5Ed7W@jMx5e@(c&lB7u<30ivF52B=F&o($XrA<5txai z5B2pR1Sl{mM%EgpWGtEEpz@@W4@(U;IFeiOD6fjYCUYZcGHr=(uTKE%hB6bq$JANpXii7D>XUfwNTA;e*<_ z1*iHS)G3(eNZQRmeWIj#NKv}{cW#^HLN*$l+x8#u&#`a64_GjqX_MD`dcSex4ZGW> zsbu0i)kPwr^tD_*Lx80;uxma?3pDAQUZTl@2of^Wh4*xn8;8-N>Z?fN z%Kk2Pr<3qQ3rw4tKE)Cg727YR!t(luro-iIW@85nyR1}AtFJz{5ZZ|zc$ct`LTMdHNa3EL&rXb9qhFrdIn|VB%_t|eP zKM?%>IU~ptWB(@S#>A=Q$;3Ctg=aHCSz6P^uJflk&6^KdT5R_w+`Oy=dL)F>`?v(n z2Or-0vYhwoK;txq21k;AO=@&!kFc=7a}s4IFwvYePa1IrveXK7!oOUs-50JTZmFn0 zRZQ}_xwV267DZ_;9pb(%eT?F2vOkE=%M-vW9iCzPV9;!(Si2*|p;fJ3{ACCsW`&Gr z+RbK9I^^_^MR(_AgQzht`IM*I$kT{-O}(S;0`q8_g|4zdvdFQCR60_}7R{-JRn(#R zPtOTAXD`nTn z5BWJ?oJTw_Hq}?Ai@2NRMCoKZi0x!&!hz&wkAaf+H@n04zk}Ux+5qw$ zC5hzK@vL$__U@2WRsT`bp^pAvYC3d4>#-$p zYJ*Dx8hU@_OaH>@Rv7h?!bKb|9>aP9zbN1-f>@EcegO-}0-cf>;$d08zn@i5odUk3g zvQ&WLTONK&`8*=c+MBywuvQfsMMgzvi`sB?R!#C!#U5bQh{+JAoB*|&- zj&tTNLN`rpi#PiFzIZi0$gw|>GBEu>j@6d)dtPttPOk{GHR}cqDz)ZqHUA!&!)0yW z9&Jc5Nx$7okEwPJ)+`nlkdK!8@SkrCr>-=9>9!_EB0Y#Yr)EF9C$B|10d2L5`iCk#ELawWEYJ zT3+ny2g#5$HF=m_b#MFFiWb5u*;JF%g7Emx?`L(;rAjtIvYFV(!+B4;Et<|X6hSt% z^dmi$SF+OZGNA=6oH0~aE+CBygrb+6XWpNU26aRFhK6HLDH&^89$rFtLkya{sol7} zN}H;8XW`VX=1=7y8>N1y?cy^USOWhJBk6uvVh`q2zkM&~?#weY#)rC5P56kP;OVW! z5BI+I4UqFi|SvqepId~Dxgsm?Y~W~K^>f7Frng4kjvlVpeeczEaf4 zrp?i2r$AJ_IH1)F9NM^!0jrT7n7Biz*HiUe=1Lqe z^B|ojd1|#jF73lo1h`4!_YuUKYPP-S4jRed_iGr+HFYaTY&EsY>+aR*%GI+-R8M1$ zOR)HD!G$zOV$Ba0hZ61=j>~kYz2sI7EhU+H!gr^ubh5NGMGJv&UmD$oPfRL2Ug2 zx5iZbwu-&lZkYeucv?eLS*UV$_vzwR$n_AiP6avXb?JB9)LG1oDO3de?D{pV^X&&B z@tpX=k78ZhP4I+YS9rc0R|%}6{A|%`-Q!mEUKFYr3ZJJFne3nRf zZ;)PVkeRre_+~ZjZiW1pN47*zjv|cXB!r{VbB76zSF`UGO6&Q&OG(~-iURDc>T~F& zbB3(H-d({kI0|tf{u9bAzk{}I1bxt(fvvff!?{_qtOHvS`Li$#T_g`D zrp}L&<3{*DZpH;qlt@f!g5`D%QTqy5*g`mXg#2Zn7JMcaLR#^4&!`m@G$fbXy>lo7 zHw^V`%jYCQ%cC-?@{uadMEfL~sxXF1;dFbu({`hAzNAY*Z?iOTJ(fUdW@bTOLsFH! zSD>*Ji~a&4n93+h2$y5=y==*aFeNXY^&`n`l_sKL1yl+gX9t(AR9A@DQZywn?K-@k z7W*j$TqaG32?pfrjt9Jd)}1gdWDc~|>!2D;XkFYVE-$B^fi}vl9=~kIJF$&PII5sZ zrVgS6u#=v0i?UyJcMZ=}t(xl;aWEQW8iRcrjt*Igxznhq>*mG-6|GyJyjSJ zNYj|=x)XO!dScIyBz+sO0}ZWyKnZ^fh1QqY#wyz2*V%R7d2u!msz_e8O|AUr04=97 zacULInqPjtO=@N7kIZutb=$_Ehe3#Jh&C$1HG|{wnnqI~ZXYj+n+OS&zD`@gSuBrO&OCEfjBL04rO8;W=QTgFH$Q@E z@Z)(^R^Li*sXUNMuuS<)sF-gCHb}dXmkTWE91|q7%$JEM%ZM9NEWeJ9K8FyXoP$S4 zCO0pB$C(x=ZJNr}-rn=GBxQO7^6+wz)sD)-mFS}EHg`lCO?IFo~dNTM=FA+Kai6$2k(OA7i`_cOUn+-Ijq zWd$LV{>WX<9;s(OPJql#++`?um(39Q^)0ya))yaLqy!2U^t5Oo;Cg^6__IiXV4n9o z;w$Hc106MWG#(J_Y!YaxhCBow&Bmh`#q#b={f{QTiN^4pL@Jv^=^d^vY%J;xuky3y zEZvx(K+W@sGBhhkZ;*9zo^Od>NU>ED3>_V<5Vb#V<*;zL4Ij#W6r-xB&ERZR7fH0& zZ$*SFW`HMo27(IKlwr~Xf3Ps;+rfIt?+J0nQ z6%V!)S~-^c+RGRYybBKtnEUt4E4*#3cZB0r*Kr4>dZF{C`Hy_k#0+ns{^WgutF^lXU+2U56Or2xnPD3lxX|fAeS>Ix9tE-nt?~OpP zMst)kCy#KQBv(&P>0QNvNria+kJvBOT1M|-*UITN!;}-#4Sc_DORDG*rxLOanXw_4 zjS889b?lhtBsf8xp%4@Nj$l>v)I$wX`dyALNxjRrGODvvz7k<<4`tT!P$^glZOZ7A z+*-(Le?$_whkr?kiF#W-#Xh0xalU|-zO6k5EpzH@LwjniST;KRJr?}#10P(;^?6V2 z@X#BaSWs0Pv!!n3`Lih5{Mp}!FQJdGA%dk5=<&#e`*?&{%9uIV%c`P5buy?w?NPho zlpnJfARiEL+!HtDeJugnSV8gZLI`f4uypdj#StC093s&16qGF@m%t%qok@NuywRLg zFLPY*iJCPkvXL7GHgl^*naln0=v?aszoEbu`?m+m6kokrX;Du9=ogtDSPH6fEg##) z;=c#cQK<{<+kT8f4fI&Zt+Z2k+z5^7@2Cz6BP=0`FXUyY>E;(&4;8`^FKj}Oo5#vU zLryQC^Pq!TSBfi6sJz`Y7Src?Gc7p)yQ#pdK&JoZ3Q|YQBWZB4?1Iq@R@o>=J3Y~f zpL?mA{{WWxNve;EByINPiMkFei>c`U(DhE?b@qL`b({u`oyN9p+qT)TQNtNENyEmr zZ5xek+ji1$&Gf#X=X<|ny=&*coxL2_nCEYd&!}j90jj9}964r{-C^GX;>(!~>Tj(Z zb2HNNcZ7~ABHO2!=evSbuo6im@5dZ5qxI!^xZ%o50m^g_P|B;G+5hA6p+@?KlP=fB zd?3P*Z(t(GJd|_Bzu=FGA5U<(SpiP0to)&exnG8AK^JWY%cdu&#j|wF>-9f)mba% zWR`ufe164J5M75Nf2d|y{x4KgSeb}5+Ojuzf1E<&$!G&niMG+G?hJiZJFPSZpg+rm zdK2j?aE-dlzv$7NkZ*Kt0!KPe9&tR+Oi$ZgZ(lRIO*_X?pY{^enc&%OhiuhOY19k) zkI(^jN{8D`le?Mdl6fPa%!w`iC)}4I3|FTpVf>l`-Iwqux+@29^7atULBV}xo@;h# zoU{J}nPUGh$n^hUOkz{c16m}nrHRlu0@uW!^p^B6Lv&z~{&aAJGc2oWgjPqzd<=r* z#5Z!&-2S)21@3EJ!>t2cMdPK!t6LImK*#z>Iq-5JZ@zt~g+uFs{A7JsmcDo+3_e`R zEC}LPN4m|vX;G18gH3%htC?ZwU>JDnWBu*du7C`+PtDnXI=Gr@vdCu65zSW8*yStQ zUdw}?OFO=nwzy-O$s#s)kYQMund66-b5jKc{Y?Feue%^+o(1?lFZ$B!LED*v_77w- zIMC!joWuvl)nsxa`-1OAVFgR+-Lt>zOk8QeG)gy#k$oAUUy;LRVNx1U5=X5W2`%D^ z(9{;F*<7{qnV-3_V69_?&|_X%mCuqi<0hn9?g#TngN<_mG@T<-u$8S8GzC*-?muT< z4JWtf+_Htr=?u4j&1TX)Vg;~~DQaym+c=Qq>STNOH04M=y)Svz?l(o4Dm_+uO`twF zk7_1tkSW)=Ba+RK?p^UQpj&3O;EJ$<7!myrzS-y;)t=O}hStt86_pJi6*r&HNRE$} z5i#Y<_A7RUsNKV4#8X{U2Yv#QLg2iaVPm48H~q;w$(EF&$)U7Z3I@!7@d8hRQ$wGb z?ryrDmaYP4Rub(<#lRUagZ!3Nw6*6!xuDc9VttK*UTCfMxq0f#Mgvt4IRGWI6>}pbCgAGyM*yFisd^x11n9C zwht7cfsc6ae0mk$QBRlkyT~UkH?&9MoW(&J5AxNRU+$%hj5lhB?6dS!V~G+YoYC`; zjyHxR9`3j+HKJO|F33_Pu(v+`wp0<&HnBqN-Y~_~v-nLxCM5LSFrQqa_gCg}2HWo# z+#yXQ*>pu*4o>}mMezl)Bm6m(84dlX@fj#@z*?Z-&J5KB%}MXLhnZF-?Mb|u_nGEf zeE^m1^j&Ca8)iCl#lzJ_?yD;R-~^gW2A279yI`=+SqbLggV5!E=67@cRIY*h=|a$; z57iPJ>#54^!=ZS}LUFk9;ZQu-fR)nQiWSHLf+|0aEXX$%AgE%JE<{|+-|=yJ1>AqO z>5%YP{y5w~nSQu@+EzIW{u9mrqtUDPqIGtc5+_~{UM4fhV=@$SVbj1g$@=*1>72x} zO%BK9U?CC7&f=Q?6|AvI$2|%$$C1X~?xspW4ZB%B%1UJ2`zMuLmH`n&D=KW7Ilf=! z0m^s2)GmQ{uEZ_{Cz!SrnN16O0GI|xRA;z+5vK>ev3s5C#HcF^1#|<#R&6+O6b@+u6gHPO7WoALq$Z5KK+p-Gvh~ET$fq;> zE-Obxa(F^4EqW<#_KjyBoEgFPb|avH8Pj4DvQce2C2!N86pqMIkVe z72KuXqdyO~Yvaq+%J44$vMB^@tzJ`fhkvxFoKpJ~WK86ykXfV_OhZs*=*<_vuu)yr zkHyc_;i3%nfiXeCPT#VSN^6wA&m7uw{pddw&8?-^4r$kYg}r~o*Su7@Z9CR1jjaFo zIhd;E7ayxko1yMakPm;nO$#YVD}C_>&K{parrV4}J9Yr;MEKu38^^qn7s-3?tglV8 zyuq!Pt7ma_BL*)FUmLWv2^2+JQ4O`XZ%PLJJnmOm8$=JT*%9hug|Ekz5uPi$}2L1dn;jO z<+x3N+F+8G%oXBV7aN}6Pw(q{o}3u2G%IAMadfBgaJT-ANy}fPzAbr{8gG1p$r+}@ z&<9H~-jZNUIdlz_?h_oM^37N8v2E?rmy;d9qMnys!=h(9^Jij2gq{Q~xC8$aK5j^w zO@>&PBAXs=^_GTgu7i61XIB6?YrNDGqars0kV$yZmRPtrBH5#!3U5@x=7>79+z24Vw`adl*0y~W6OrgDIw&{Q=k$_GE0XhIYJa? z<^aD`UwxlUx~hOstf*rAzz2RjXHKsL`b0DTm>d<0XcY}Vj(|WbhKIfLN#2PNKO)mc zSOK1qw@n|q4+GC02*r**pjeeL&A|s0^Z$Tid!x5mKq!WPY!@iaOfxtI3ud7hsGpqG z7tl_Eb$XK2L)MF)X3HMz-u)$%Pd z>yZ@r!*F`s720d`ad#wFUJ%bcV}F`Vz!Z3?R^J9my}xZVpB$=9cs}-v+o%iLHW?&M z{WS|zt}M%xS&rag5#%cav2li!0%=hTeb$2(C@iE@!&+JZ<;i10jA+}MBM4(4i|!e86}6nISV{${x`S*rpt=s0@+X3IOcE9sVAVDy zJ7@^qeWd~8SX$gI0%m6~W${>p6f}Nc3jt8ySbpCyx8AV4qVBokerjuvP2k4J;ppmR z@5U#?Vos_e7~$TEM$Bg8RG*e&c)1Fiw}?ERPmZ-AZu&DEp|nc-#~gK;x=}rBDS@zN z`t@yyhuf)m{x2oeuGib+A}|^q07X@-%LtS^5){|hUa_;;>mi>5D5+!4VW;%sRbLGy z!(si9q{}goL^K6=bQ2Mh+Mf|U`1({{}=r7c8@6+Qd8z81Juz&W3A z9f4Kxpk>F?KpFL930V2ZLstwI@!e)1LI~xvNtXDw$j@7Dh$FcK7c~HYZ!!t|YEKI7 zImd_k6`A3?YRo6K=X9n4A!1+%PdM|-Zk1#9w;{AfL?y^F>MD{n(ZSWuk)7ja8%vbM zZ@~oIPX<<~(-#|p!JoTZd)g|}32AKLIZFH!v_kvFPW)Fltd$U6%l*}Vqr zgWnbtwmNnXWGC&v?{(a1*Xf7Nf1UE6t1$>;yqFf(yH@c!y&$?mEr8O{)iIAR*?is8 zw>);<4t+)?FyXmd+B0B<>8r;cnUfllgXt@# zt`l)|cp$2weU2S6fUuLy#3F9~y zlC|*zBS?TPt7s;mOV3vny=tfrzQ{-kJZZ+2S!gK0UY|pike1M;Wr9TYA*6SI?@Q>c z?J`y&zjZ1&cP*^FaXDM%hMZRo%LM#Y9z;+;95dYyJY_4m`}w}zO7!qM?@ z-}eLY_8kc<%ol$nsBa`L260xWn^-qn@;hiMh^MKvXTx|cX4JJkcYc1mdLs~Xbn{{L zJpfbuw9X6u%lL9J6Rc?_Ig%XV7fn_@ylQRI8@N8734ga<#pDAdIUoDf=ErxJcmZ*( zlr}36pA~DsH&IWe7tN5Pbg7#Ja`aJq9|K+UObgj7Zz4)AWPiFlP^=eFUn7~d_^xIC zH9a2#_s8RjQu79D^M4;#^0DwatLa1DE+4ZBxGAMNx*{M=Qubw3SUGgZLE`Zp3JWqk zUbGdDaG+;gtzB5n7_>5kQcm#%0ja&<8v)dPs)q$*YUN@U-S#r)V%07|jc3q6t4;cg z*`)W>s4JD-BBnS|*eNZ-QVb4u+ zjTM-*p)*%l8|QA|&_r>*Wj_*h%&rB;QU>~|@IRDoD1o?TNhXQ2hsnQaM1a@#p_UDG2MGc}ccO*FHj+Clk%8}KC0b;+`ZGrC- z2D(h{BKY;lAsV&Uw2~jHbV_%vmN4Mcp4^!owV&Z*-LfA9QvekS-4jTXnnr5v+bq_? z?Wk=$;)fH5<7zUx1@RXM8661FiIZd3=uk7tD5o2vXRaTJ5G1OWUq|KoD;Iq9?#yeh zUPI6G?^91kXDI{L;ZgE^b-(K50;e4M5DiOaJ566zH_OwWO5`$wZr^x-VC8;bT4ChL&O3B!+`vHg^63ccIas^_O0mrDfBtp zp7AmV!|!fipz5w@r_=U616Dr4_|KKbOQ$xrFMN%LN(n+IWul)cDGmVqOWBTaRk(gn zR>-JJi7%RGvPATJ8<_GeD=R@aQL;C%p6-`q3e%Du0{lavh@QaBPv73#7)&Z`h^ z9Y&Cjag)bhK9v`YEfw%-qB`TY&aZ_4@>Mm#i}!zlT;afHXy@# zOMAhW$svc?#CTsH_b)31Ge1{6M_TMe+Bsj$2Pc?B1j=(#rs z=(}$ToCmz#MXr<<;(JqHG8lXzGI&PzIg`~q@h$RgAI5DtfXS~A6M`0FR)NeRU|k-z zF9B0wE@H7L4e}#n1jyiKZZW1ITIqQbIcgmS5G!LtjMq)n7*wf-@?%|eOg6ExvkW4| zEaOw0<8-@xJ_pnlK`kjq=iTcP5;&)1q@J8F;Y%qlb*B^p#Wrkdoj-$W^_eu*PCe(w z;Bg`iO;X+1zLY<>55dt4Hf4z#sgYz_2q0$OdFw;*+{Niw#MTAOij z@EAYmZS?T*Ig+jh*Z+F`G=gll_)~$_ekz(`ppiAJzXrg1N44P*ZuH5PB%=K>7g8SX zbW+{}#Fl7m)kX@1t-vKXa#`?^L{Qj`sxH`G&N?6zLwDyhbKnNQ0@)juF*xZ%9d)TH z_NAvC1$=tyk4Jbt?<|<9PzlIz>1dJQgoQC9FIMd#-01+}&lL$u z-qSm&u=|E;Tb=cC*YJob_rem4e8fsS4wK)5%i|4th;7+qrEpbR15}!Urfnl9S^ck_ zbHRrO1yKU+Z@+K<+;#dWd#iuvuNrxE-g=w}eO;y6n~d3y?Lpr;f!wT+ZrX>+yAJDz zHN6554QnN+)^D?~;hbvVIS1@diwBVMr>OO*#pD_o zFh%5*{ht!jhYuGkk(k1 zp@(3%RAgghCiy=jJ{BvYUHWeHgx+zuw?In!y*QMhAVMo-a zjEXYo`15u%)$TubqL)8m^mQSv#F++4A%U%y`*n!Y{>VJu{dGVLA)yB}{w=@!jlkTdL!*v4W3m>S9(%L#(4~CiAe)%1CSIyY zbKR?>Db(XSdlZe4rrXA;}{Fi5tQIU zN}r0F!i2uvxPiZi(#ggJidu0EWmZ*x;~T8vwK@d6e3p=p1!#0>(i8uJ?@|`nvqBZz zNf4L%^b;=W>Ha%{ms(RH0?&6ScnIC)&U`&BkIv6|g3c@4WhJ-|`FTZfZ@xOIo?c9?a(1)y;T%jiIlB%&D;NNz8gkGDx%qnok?!LT(O z!Zqj&){&g4A0#Esbsel?Eg7d5DAtzS)#K55Zp^#J685oa8>Fc)P^woXp(A`7A@xvkiMJ zgHyT#)>-I0bqrb;X!^rCjQh++Wbk$dxFZ?&Yv7c3N4d)hk}!*j@kAb8VdfA%`;Mjx zHq$M@NGd7XgCy+J_mRf=|E<)ZxiNZlJ))ZooK`|;e2=s}x~u4Ob^I~IOGXIS^COfd zCGYdme5pVZ@@N808h24k`7peb1%x1Q5eO((%>fgTYfp1go(`R5Wf#J<-2q4FTk2_z zX#m^7mk(Q~cLO=Mb=Q~%R%+tw&{GZsmijEK$UZ7H5F~8CN{z5gMWO!%r?IYT&V(#c zZ+KGIzUnU=WKKUG4EJTU_(AbGMO-hf{3uOi+M%z;DElUl9k5)G{wIn!tuwours6R+ zjCxCKGqR47iLR;O=Zqbwj$~+YooYce6>xK<^mWI=rOhsEjcUn=Xz zEB8TVp??lwfS5B37rAyl;yu{(aAYFDn&orbgZY@JWYhBMs8fA<+}8ph(Q|<@6LYZ4 zSu2&&?p`O%nza&a@`06h*4y1TG1IgMWzsgB8?`__J=7}!$l-E963=uDeI2tF*BP@c z#kOV3^*%6X?SIY>`;wT3nJ&8^L4P~t)7shD4Du!l!T;x|va`)mA9C~Mi|@@c_`%wp zP9;0ix?e{~%w&++tj>;(q5Nd$6y;ZhiB9yG7UF3`L7@8v{6Y@yr4Z=8F*#Kt zs49)W-G4d*;4XSa-PV0}m(eH9i#ojfUAT;RL*fl<-(1>h=`ay7OwU}XAi`&9#wAR~ z&tUu=;QbJN9!AcGE_6#4xRTta(CN$kou(38h}AA1j1%!$B|iG(Hi>s0FRf9 zQo{^s+fmondIQ#n{N{Ok#*AkH{ajF`|AC(-1AcWrQsSJ!uE(+R!rxIquca}ux`z@A zQ19vboXN#is^zf8ikUI#s|GlE>#*XH-p)0DqJ{e58d zwq6FMXiAo->(16)xwox1v2WdLAT}EYVC$A}iTyWm)AfT@YZeQg{^F+yYAMv7@cout zf0_s5T+6VzjmUvrZuTNE^c3x`PTR11#H*avJmz18P8D)&q4u@-^93uM5L_}*U#sm6 zFT_Q~8vaZ_fJgO~B&0p-T)!~t79|jlB&#<2tAoI54K3`Kxxy*L##IVlRDbu+yd)48 zDn6SU$4I*}IG6(_+BbEwL}+$Yl+1EScByPf!JiTh4uBlZtum<@Cf3Dw9LGO&NT}`7 zr_~E!@vy~V6x@i*yNF2T1nCJ!yqB#m@aKq2axOs*gxmzglJNS33NFU5iC`VdP`Vj2 zkXF_V`>yW|U~eZ7Ng0@lA}=8gn8^6V9|fcD=oV^rlYL30py;_d0nQ4O<6$1eP6sV;mV*zu9r zGwVmRTZdb*KF6M$T>*t{CvJn^#O`|2A`lLp?zyri7Wefwz@hOwhRiy9qcj3aR(b)o zVbugqy`tC;b=;v{xux2Dg2(jXkqo5mn2A7x&Q&5mJOvyA)o{%n+unta!W!DnopGWD zJO#hOPPSm|%m6?gn|E!SV{Tx^i_r`NzmBbr%PvW(ku-#SP|U}UQKOX@C-<43kN&G#$YZMV2~{yyyTRpZaV`h<2VKT6#cfN*cG*Sf9lV%XCf+0$lgc{$P05|byp1HmXpD@G)*)}UdrHCuVM!j zPf-_Dzkzld?sG?^_h)fv((Q4ZJW5_+U|jbxENC~mw*>)At+CvD*nVEs-QVh^OpSeP z7k~=K+b7I9i{Cai8~H-!YB}R&qRrTG?&0@wC1bj}UEjK!i*pK!>inHSAO@mzZdKJy z$+C)v8A1!5OOS_Y1MbH30hq5vYOxtr~0J7`GXRnYgkbgDr8I${mO47V?0;Q z<;%>X){{Er4_Wu4shU?T|*D9Mn?SeSkdu5nQj8*zt1AH-kL^NUzUdjqL;j=`DsVX;?5cl&Gl z8O`l;DhWc2(Gr?7+TlmzMT2LHcrr>RBTzg}pwmphvFcHqx&h=Im4iL07<@bP=sUpU z$D3P%%~vqFQ60NXNJ!%jhAZKzhqyNyKhGY)Q`QqdMbaMaYF@M?t3SIDUeobkiX5VI z_n6xsFtoN&SQynEh#WKTt|j^D`6WJ>YxxJ*(uF18sImgSx%6A`Qp~#%=ul)~{2m?tue)F5ty3)*LhQfzu6I-&EvFbTnP%k6qz9={*tzeSXZ) zEEkCGQR*&QuE(ZNxl1B?ek6N38lX~G78^1fa>O4L)$o_;IxbCeR>qOspML&kgFk1u z+cwo%fV|B9ndpg3K?q=T?X^jj`#y6+%PCXu*&t=E@s%ikoH^d&gbRh7dtvp@?iyJH z#n!!Snt5b3X%*E&eR&M`63UrNcvhxt?76a8sDqn_>cR7wjQ@A+8rHnLeBU<>rB7tGU76J#~)wJWtwIdNVDr%usd;oKy8Rf zs3JYPl}ZkE8aW#gWdV`8pvq^Sj{s z&&DT`G4CV}IQe$}C-)X=@wom zIJj^j-(O_xyHsMqh-9o9Bf(h)w>tn_Sn9WMO`$$T2wj;1HzOPcC2TdusVtT` zIAq-rj;DI0LE-=$t`o@~>;erIBCnZJKdw_Jb&-rOlx=hh<~Zwvp&)fCXUY(mrBa*xA^XNSECjzG;As7zVH7N$L zGp3w7g9iz;C6@u<*7oMDa*vJ}NH5xOKB2i0*`_&t+3FcDj7QQs5CKFMrOrea>VC2t zR+)rstiAm{KBQVFNBdjN+3`gDTN#goz~VG^jJb5)gUo?NLz3mCrQMtVxb>*LReFlH zq-$UUI;FTd`$N1qCcQ2gE_^hLpWGM#nG25XXsA5Va!v(_ZYuA9vNW%M8;q*zsvvuy zMoUxbHk;sk6L<>e4rLEwwFC(f^g_T(S}%8Q@{R2pS1@xO_QX_EXAT)m)FYTJ`38Cg zgJ06=(UekU4MdkTBNls+uh`zx+Z>!{f5@}YBi}z&Cd4QCyziaBDw9YHV1QLZbbph0 z40H`D2)>(tIzQ#45G<8L4?iMQAl*IVYb*0tVc0_d0a<&-rUHFCZge_UO{hUEvra*h z9+I!k?D8}{8&{3IoiqEh`+ru9-7~Ob9gIMobWUtrQf%S&MF-xUY9H0%kAKW%U#zw( z=BYln;32Wv`bbzD^)IYG0Rn@sVmTg)2y|4{N;p3vR1NlC zF||6&75T1c4&C?j7@=!rxOYnUX#`nT?W5a56@spsG#1QQ?OQ~^DY9EialF-0i7HXo&Z0+4~RG-!# zHVjej$>b#2Y*RdSzi3{i^cy*ozVFgW%&jiwr%Sz}i>|6OiHV%67BU+*;hk;-;oXx1 zg?m##-q64kgtg?cCjcx4C+VqYCRik2MpZ_Y>X-K<18EG|VT5SwJF!hd0jw{^?Jh#b z3$#fV3W~t|btQ>ebX*x&kis*9s2|;&SOH{TtUiTn)CLzuW;+41ApJ{dnsp?%S!Kye4TJTNu7Cu>vMB{TDNM4lKfP{0 z@`*WgCSk9y)>wWeP~svB4sBj~<$zf4f)9RT-VCGYWu@o;ro+?dK)72?r&qKTl>v^P zm~Klx14BQpuEiII6k8HdNtG_5)c4csBm-(1thhgno=!wQR~$-tW>E#4(%a7Jt__~* zL)E3-Qrbj=4bXR7LaIBK8k7Qj%gJkce@4N1v5rQw%S-y10y=-{TEi%%jgeN6()^5i z8h#AthBhn1TCsnVoFCfKKgbrG*9TlEzNpa2;$g9=NwiL6Q`-b;-OAGBxW^@nY?xh9 zZz@aSzzl%Vaw8VTz7L%<`!z*^4GMS5ooa?~!r;Pv2AsguZmvLv{qPOoJTk81NEb)k zuzEq|(wfa7!9K{V)0fse%rP73_tiU$ixM~i>cUW-%#ekX@Vkf0zZ_oL#9~+-2oC%@ z7z>M}0?)uCI$<033u1T6NSB^d7@9aOg-SJM9BSawv|~8$dwkbvZfEEg*GuIM+$`fO zAY7QwCcp(qhc6gcT`RkNGgB(`-EkRCe<&%|PK4FhX_SGaO{BvDp0@b9{Ox;f0Q+8W z0ASxM>Z9+43G92l|EKRYfbh}xGW_U!8CW^NJ%HW90-jg1+_xPC>c?@aDsX^(ua2b| zM5}~+wwDZwH|Gk!qur}oj*LeQHHCFwmxT`_nWhGp?uU_#i4R5WehlWQ0KNT2D+DzL zu<(*TxhwjZJtyQ{2F{}uJkZWfjoMj`YqKLY)%0wN6k1?3_*7Tg9zr ztqNfXqLNO1>;>DNQB+bU`^=8df&Y!U?T@@2-9ikVR(rmU5pP!8nXI}MX~H)q3veGu z+EWeQKs?|Nmnv%Gmu8c1GGV_%r6&VCDk)|dGZX{A!da7GjnFyDf25gGX zW@n^{4cMZTTVHR8%DF1}^VP4aA-;CpDh`~)ys_Vww_&c$?mpO#x4pB4enY%Yu-1d{ zQ2h8A!PfG+@ZLSJb}}R3krM1HTj=bkH@plKj!79s=n5Wf(PfUR0L`)27j??C1^EIKD%Sn?^<6=|H0AeaM> zVo0U{Ti3K0qa9_$TY}0VlRWFWv|bcMhzt}{nc#Spb-$%e#{F=$y zXHWJ_8q$5+9WU5?VF&Qfl4n}ycf{DB+lRnx{leDC04OkX01C_wr=8ljq-f}|2Cl?> zpm{7(^B)}!MSPDGImG7LhD@o^Bt}a~b04a@#7^dRQa?c&cxwTV+_VpUu(CYqqPpN$ zQN3*{%{RJo_@`&CubY(*#Vu6CAi4xv=wD5Iqf(^f%K-LarJ*$?l%=89Bt?{o_LY5$ z6|z8^85ZV;&8(-KyP;j-!)7)Jw3%W3wVC}49!b|p&xK$9ug$FKADbB_&mwgA2g|eC zTRN4=MIL1zCPpsj42s#S@;H+EO14@|m{b5U_s_s*Tr=GUzU*!XfDPUQ;E5N&-Laa+ z5APO@XOE~dpR{@vDAvn4<8IIw;x`N|c0SFwmq^iI_C{G1i(#B^*7>-OSWN1#X4YciE)Shq_AjrKv>}V&G18Jmh_LzZ1WH(GovD7{E(Tw z0A*&IFUQY4ev7KM(>bi&RaVnr)nW(9w&gMtH#cX2S87~hYXOA)`1mv8&G>vpfyV6I zG^)TafJk*D&XBsA`yvgESy1?U7g-^|iW{Vb=b(|kgOM#G+o+yRe%~vct)fjVr62Pa zu92n!OpZ>$`SaAvT9qJ*C=UZl7b6u)A0r7$A3t7D#7I-qCK;6p`V+}q0G^ZNXSY+M zaO@bUTxj)L-lV8m*!dAe{-7{z#Y+<6AaRe;IS{%eZE?5HTg#!Y(h&XpG=h)-qM?RV ztX~{>BW?rciNfp+c$P_TbC|lJ|9t zAw8h3=@Mq%zP-7SQCrNiFuDwqFsN&(wyi6UbQ4f8%u$%wY6!xXZni&NA=6X*d{luK zc25ZoIxFC6le=G3(U_RNHLb9UuuVE7eHoLHEmm3nIc^Qek@A*wOSGA%Bmt1#9#6yX zSTRLQy&1RiLEN9N8^gK}M>hDq`8gJH5Yn+`^NCEVTL7ZViXW5%N*F|%q1b^YHvLH0 zvRHdC-47ERKGY+vtNw?H&7^7VX!W!A(pY=bpV@~=BuZ)ADXjWhi}W&HdAT?7+%m3J zrqVEt00QE)urEss(2J2O8BGRRnZUkWAzQM1@R;2q{it3JevlIOW>1XOUfR=Z?0=`zAO3 zM=WkVwSnp_e7k{;HBwih1xWaJv#9<^V$Jt*$EozB-4 zmp{?)j2sVO?p)~($@jbC5TG%-vB`tjUg)qHqC7-SWayD1}qu6>|?0_{uLsaAbGmi8)%3B+yV?7Ou zym{ehCF?xO*c);;1EVYiquLkbMv93e2R#zKme>kMuP8wb)T*GcTzf8HYr!U%95QR& z+^~U*vNCa#oE!tt(CtgJb6R|JC@Gk7dXy!ZhCyE`m6ksU_q~7+@-h%h7nrrn`kS@e z*wH|@RP$3uw{%DU)EQuX198K(`;oQV@4rxVkMYJj5h|6hKUV$wgdMB4*5xQDCD>9U zjp=UMhPS8%cj1Za68^a-*W8kp`?qxG0}xv)^$|nSe6#pN+fkx-!gG%^Q`OJ<0>bp! zKG{A(Bpl?x>)}{5_H`7+s$c&CUD1S{8qd>uGs^lP2L@_^S*n`E3*)#F=exnqU8)|a zI!u+cuNqhxieWrR2Z|u$WW;0RzL6PhzX0f}f}XLOq1g$9>$mboA$(ERzo9#T^&d3e zO(-c*HP7;p*)27+BwtKo{Zx2|L;F~CrES4)@WaA|O|kW$rF3{hh@fjBDjA=T|1&;g z=KUz$(NnhVqhH#Tx^?1rwp+&Uj{!qzXibzbxawwP>ZwFY{Ai zf-pA&(;qsTsx2O$=9_^A_(nIPD6v6lQfAAf%8MM(oJ!|K@bk`79jXVJE}AtGw9Dmd zIX+IGqp5seYzW`0pUxrZJ3_;v|90*S#DJYU4`AmG5&`dy)rWE0@+aQ)Rn8F&k#Z}PqhTuEvIk<}vlQ+er1Yq^M8ry=QZwI z!&wkOrNy*!!?BaWLS1!A%ec|;_AEk1(jn5q2o}HEduF?=>H;6D2@g-Q ze{5ZlOeYGcQJ@3J#FE|D93->_kDW6mzR!MkD@8~e(N%6FmPkTCfTJ=gfR7d(b|u&3 zxDuP;Wg+ZQOE-N$#A!@=+Mcu=*ox#7`sfH$BxckK%{K55e~k^p;Ee z{lQV!cPqiT-A}Od{kqA{xT~0}d4l$Dr@@L=v zB@2G64~bvml^O*;Xip-NIt7mST+(y+{%ePP7TO86SN5XX)Ej3!$Z724$iM^44PIUa zb_5mI+MOw{!kY%hqi>FEwH5vfeC@!uJui=gKJa-%Np7z8#QVJ5l1YpYseW=r? zDqOl9Wjh{sawM*gmfXA%JcZQ=xqHyztIuE#R1)6jER6!EmVkE&nzQuL`0$VoDaui0 z_0ow3Ori5!HVi6#(m3IvFkv@wi^# zfkNNuC9vNpWZ!qM4oIicH!_z6wZf0RlCAJm$X*G?Cn3md!MEm+k{y+LH8E|!{$x+A z10^E{R1A~-a>ued(B)VW!!97$wnSVU zqL%z6QvpobF1q>o6ZF%lJMSn282xSXs3k?`g-{0!LZsGdWweZ}UN@tn2tG7_e3v#8 za*aohH@MtnG;((08FEUfz=9>KK4I4qOPhnr`qkiqcA_ zp!QeOl=amuO?#(!vH?H2);ZFzyelVBCT>}eLQh*e`05N^rV0=xDv~;${Wh`9+FA$i zw!Yy*fJG8hd}#jo7FVqij}5;SmTNpGn%|LA14yGG?}tNX{b$%M8ndWke{eP-z#xDB zEoV_~>09gVYFlC|gyrJNEAH^HZx-`MZPm(B#Mw=qucw#e#zuVv??(>Tq%|ma7B(S> zE_Q<$Q362j!|3#XE`WNxIo$`_@nZOEWlzdlJKhj`wN7Q|qpuX^PZ+|nxJENB3PjT3~A z2tB{43yXS{Cl(9h!j<_UtSiWz60m}hTLDP%0aX=TAt>DgKg>x2I7KY$)b`g=?cb}o zduS0W6r@I}*p{*UapE+Epso8sVfh)ep#v3ot~9C7k7OrRGor^gn&U~Em_KxnG7^%7`O%3za6NjG&1v93oG)IYDHCn3Z2b|BfDA?XVUJa$LS-|eUKPRgqIwp#2#|bN1iM&!QyJ(ld{WWvoz%C(T7HP} z-sM3Mi3N(Ltwd-NHzCPzp=MkLj0pofKsC@5xX^J;` zV=$oazrVDGKaE{1y0gN!wlV}|%ZQC3uAFLfXR03rHo+GgBoLA5A%Iiey(;xe-mYc$ zP|EU(T0|!|%bF}qX{q+D*<(a>L7qPwL1tyhCOUDI`K1X2;Gy2^RhoDK?zs!9yfe6Z zi6GG4_yA6cL&DR5VpRz5L>aMOz)-)woRJgXtvzf$GO?P3or2LII6+Z9dsu?yqbqg{ z{2HSOwU7?^%kth4Ou=u&l}ZtNR1|XXet!Or#b?5J5jD=x_$~*u0yn287(mA!S(q2Zy|_|n^Z@e(*9YLCn(;2gQ_MH^kiVKOgu>b}$;!GpFOfxJ*81p2gBWSk34r2Lsb&JjC zqWh0??Hcc(KVM6nSJ=nbwYCL9_$13kuz3JX4@+KjbnffZF&kZHANEe;p+9_U_y_2H zaYGsCc-rmXC$@h-kF}{jESpNSb9dPPEA#XR$~?i>iY)9PJ{ICHQ`&%t$MfE`c5+ik zMNQAt{JSlL?`5<%yrF-ast#@o%&3!eRdhTr62PYF!y2^Df19e5@UVSRVlzLNpJL3Z zY%&B-A3mC@)TqFwYP;?J_WObw!m@HoTl92ehTN42QGpxzm`;i+W9J`l$7Jserr!@g zvUWv3H2`LzIfI}CKxI*sWm!;v8&VHq$*&B?9d|3L9c8^3sOTxtm<$KAL|}?fHhoo zXWqVErh$DAK3L^BzUXs?mC8c98er%|FlW{n{8G~z)Fw9W6JL6cM-D$0p&0NDl?eCY ztN3OhtFsn584FL_*yaVe!=nQVLD&kIT|&oAEmnu)Ckynd@=dK$UA?_yY7LF%r*^=| z98U)U?ffyVGWpB-h;F@YGqj^jJ=Y+X%9-XXa9SQdQkwLPq&hw8pQ(nyo4~~1QZc=m zDicuIds;raO8)sJxxL-88ze_Pt_T+tzQnZnUIo!h0Zu(HvZ<^4UcNdj7?;uWjo3=B zsD$^Z3y*Td*!~j~Aht&GMjUdma0NJI2V0)@>kwp_TTQ0u!Mj$EXtUhkEd%4@qbJYZ z-yp~5SZ38=7W{6^9816m0X>Hc zV_~17^h4!03<~61r}_id7qjXpzN8ea8d5ohjz+Tw6DtW>Vkr~2PZP|s={eT-l3plR zd-#9GmMGltyY8E;IW+TWuR|Q=JhskfSCNMtkgtAuqZ?^b6&X@C z32}a5BU|650v;7J#X^?#P-ozY4*RuFgUbI9%G3m8QyM9f%AAOUQ#IZA zi4$hef`-B)3|(f4@>L5BgZ)gn-T67J z`n}*+*t^iPP@^k!qZ&U-tdYDwyX+o|UAUNA6R5!cbv zp$Hga#WR9H`=`VT46%YhaRWoFzknfDgG9%7Ac7#a2(d)+Fw=*80Hz85N@wd8)a$^X=W_O=&nz1;Gz8F!m}Zq});XxW zSpNTQ(~YB-*ZQXW!G?|*F57x#2t`(jQRhv%VYH4_T>_jIC|;InP>sxbj|T~yHnhXyIXNBEc$=nIoHg}%uaT)_gp8Oj3atRGHCAW`Fs_UsWIV; z%zEf@9YdlG&8zae0%8BenlGC&=i+JKG#p0lK!BHl_nwN=f-kQR^(l$C@SbY)-=~cV zXTfL;7YOa2$w50+6#ZUZp!Nucl`H0{E0E$Q;#~P;wGC8M*r!!DGQUavo-FYHR=-OG zmj6q?U-pBC9M2%EzMEs$@6Up!a|oVSG8=0qNW-E{u^ncNHRQN;h%n0bfV{$~kVhHz>S?@}E#I$ND*+_>3s;rrA-0DhGr|Cp`&W5cP@d);#{8HSL9pY5i-+(Rd{oN4c8F4WS; zS*}I6q&A2WTaEiNY8DnCS1Sz3e&6fNu%*5|COd8JqC0Z znbt3Ha)d(?{SbAQ6qYm~90!ka{35XaVr!1wZR^M6pn~n??cjFQg?!FK$S3!t2VvA0 zD#HHemf?R)b7!II!|UD-QI1m z>U&46j9*k}o%&1&#=L2&N7ZU>8aZ|qzag0NTEMo9miA`xPnLDc z6jwKPeR*QD+m(&Z%*Z0G5&vi{Ac4syxK2E)o))4X*z=tLwWOGmqa#D(x=*+?dd2E` zM$NWVVUgw5f}mlV_Rs<~6TIayR&!+IbF5zuV!01T2bjuxBS{WC%u&xb#D4CO4zSDI!>IBDubVaXa@QHZ>xNs@pMi*ZJyx z%r#>y_F~Il#QQPA;nJ6xf8);8DStAQWYsCNKgc|&qv!aUhW-Zm8C+GP9ER}7dF41O zBg62rvA@-;i9+Q?GebQ6uz(Qh#mnT`yadruzpW?Z1UA)}R5wq5Hpa~9OgKvHokfqF z{wZ>Vz|@$I(6$-spcE#=@db(FGh~X2sO9^$xBqV65~zvW{C;WQepae@Y2V5uMz256 zZ(+feiCY}W#~B0?$W(P&8^44p^LTSVHjhBKfmXvBFc5}Tt0qBkm1?-!E?F~6P02c7 zQl~>`S_$ORqoHiR20Pzk2sq@BZrDU%mUQcYpQnuipLDyT5w(SMUDn-Cw=?t9O6( z?yuhc)w{oX_gC-!>fK+x`>S_<_3p3U{nfj_diPiF{_5Rdz5AkhKh1XeJ{ROP z&~TiFDS2XN2e&{hhqw{f36JI$A9%l}48my5*!!!Z<~3z5E9pzM-R`rvzFbFfO@0K~Cx0hX^Z<$vJXU8zg1VpKcy!Q05o8b3FjkTcG2wHAh% zLVd^0ncLR~%PlrSogf&4pAxu*x}jImL8~T5Ey(Z;io;3n<$6z>6;a@Xntq?wguiHxaY$>#Eo@INE z6Jr_MKgJthAkn>?ZA)^}NBj5LwwyQ0-ign?99E)6g+%6I-_Y6E*a?yhAZm?GOtzJ0 zkw0`Ja&JlLc25;Man(|P%A)jz-MySfZ%_bR`Tv=Iq4YmrD7~>2lqK^=m5hkeejcPk zoAFzm_IlF4lpfnt#KzxLXkDp@xs54oO~Quq5#xVT`ohR7+>IfGZ=vG`fG>xBkyzcvcz$%b z_!)y0SMj#msc+3f&h>XA=8W{X{l%fFPTtspI%U)yTYZbGEdmtz6|M9f)UU{l4g4VM z>3>;zjDJ~riT~5m^MzKIypuI$5mHnrT8We9a2daoZlphhDDm}uQWH1~agGAFCV97{ z{&q_y9N6+Y>nt1jj%>)Hln}!@*(P99zhEY(CBX+*tK0omE2WV;1;aI1F;Xge;87Lx zaW+458L)(BwAsrOiSEn%SuT}zrF8zbkZgb-9f0G`+D`w>(Fi>fT9gn-Izgxh2U9DPMWC_I%tSDOZig zPDeem7bfC;Io2uU_JObF~)h1UB+OrD%`~7439H)RJX#J1<>5hE{(uQj3J=X zNc!_4>w8D&t68Me=DhGT>2ME2@ zzehL`Zl)bzZ~P!Se*Dpy{4Rf!B7z`UU)Vj=<6waAenaHP`BkonSFi1iX?5Ji>4$%m zuDfSLYd@CVue%jLw~u2rWKuX3M*>#4Y&RPs-(dAGbV`hQLJ1(zXgiudO-m{=^a;tI zqPom;^4K62jrRCSBcngyIG65|8WNYt1R(ZHP@ zH6gWc@gx54%x9t(m0tOx(it00>mS5txbuyI8SD($+`uz#HgYL$K#UMIE+q35P$)!g zfr9%2#8)wNH{SgP;#dHwF!c?DK|M%>+5rMI_wbN{7^4uo7Ons1VRc2I9Ln7nVa;O` zIG!XYg}4A>Zz%|%?aEhLzW|lD6oOD}50JpwEd>s38)cATZ46q6?U#VuB-r0mx_&&> z5Km7xjc>|#AY0NAf5-83Y>#Y?0W5bEjMzRuhiL+9YA+;iaCz2SG~7B{GFF>`tX^Dv zphb+D76J^gPLmUZPb=nrC(eje1^2foUZ6~i#shSOKLcrfMiCueAk zA1a3TWx_pe;?^K|YLaNx#PpU;VdU#mlbghWV$K~5_^jF>K!YMzf}enRhhpcnGaXns ztHy0a!0$$Yyp6*bYRa~{p)`89xT=obN*k>v?=4Kg=TSrjwyOi1dcf&Oqmr%K=wOj~ zyB%LAay?CDQD+z~B6=lWSE9#LMI2IeOYW z_j4&|@STVm82MB07OB2>d)u@7-%zx}ODOuWat`k$6b-901f^zhw@)R#tS$y z+Diq8veUhM721Bthb2@iamaCF@K3v)op2Odmj--)Y;*f=3LM|xP_%3Krwh?r-P{7f z--i(2U`Sh5CoE99-w-DKI!Va<8i~H`>(fb%{t?{Zfx*0j=}wv2a`$ZLFVT7Qc=d(y zX5xn@3(3%kzM$XVQ1tTOQ1sDyny=?g2P*2x`AMsIFhd@y6ZN}_v83G&A){osQ{vn8 z^*G%&x7%||MHjDI8h+3NJdbR=gTg@$oIq19IgGNKp>qq_{&K^kLSyfu@XHaIiimhU zuzFlR@7Ua8e7mini%R5N1XG=D9%Jn2iq3#Bg1_Q9FN%|7i!qyh-vqO3sI4InR&`dNEI~tP?Wy%|1bv+2zO68euxKFYwcGXuQ+lDQ1!>iuWjMS@t&IOtoXL&9Qo;GU+^*${ zscx|FX8d$mbkfA>U&-lV!EsvV_Nod&!IDqb>^T67D>(sYS*`sA@0Y)E>Bj$vODDvQ zkmZFS3--Kxzm|BG?7duA;T$OWFrDxoyAGj0A_C}uyt zCs4Cej8^SSlt24M@HZD7{WllwiJ~)x^1ftXTNpU`LqP=&Tc(Ls`HGz-xlQ*0-nxnp zTX>x%p`OiO)kU3B3wzf|#95^SQ#1}y(SMu{pQvLWxAtHiX=?!)K|W7OjceY-VCU1{ zIy9<1NeCSal}tpFbWpV6M)e1bOv)pgd?K@fmpU}dyAAUE|ENQsEeR)BTTr?;m&HDaB#Vz8(`!(_tAHbqE{134)55ewR_ z1#&s-{!n)76ZY-=GTWCwLk13g3e`9xX|Mv!(8R2W1LvKg|ne9pm`w zIWu)WVSm-AllwBHbZeT^sNib4OD1>}ZhxzB`wO4dEYwEWMq=b7t4N?mr)9nWeLZm+ z+4&`AgcT^&U~i+M^zhBC;Reac$Dznb1~QgSXW;UhjtYEa&gA-|+If3^h0vcO&FaM4 z{U)ssvq3N}H_3<*-g?N#`Y=9kQQC_zVq76_&^3u&qJf`y;?DO$?7e<4BXWF=D&wWY zGV16MF>JE+TIbK!aI{X)9=J7%4jv|x6ZP4zj_>_Yffq8250Qh0FF0^Der9-y$3$U} z+4h2Z108&Z{>1`2t!%X0cA{0sgLiUo;QYd4xlm!z0U%OYIhWa&Ir%xJP>1ezpG;Zf z8hpmDWPU5?%n2QEA)-U4CF^xWd6SzVd}F=Z(M?-cMcXMNd$(xYf3WcW9NK#MC_u}^ z$pG=0fV#Go<4AF7?y<&NwQP4KlW|f}V`Un#keao>iY(UIS#*K=5gNDa51NaE@Vo?BWFID4@X>V`EAsc{eUn5mXzsFugL4Zb ziowK2ra<@3J7!#$2{A1qqb~7jO2L*^@e#Tb@^9i8af+Wcs<|NCYR`N;X%DExAz>1k zofiw$^$*s_zo0>PyW8WGt!*yg*G)X)dDC@fbO=RtI`ys0cPDcBJ?iX(1TGR@Xrv=8 z&xfcV3mxW7Q}CcC0O5{K4CcsX&AWmMP`;xRM^Xvzg=RAiW31?b7B|=zqEjFO_JX&p2`p% zv#V!MY3Y1!6mioUsdH84^?tkAaql*YB#@JyDh-nQzB`|eBnR&7E zk<^1hLRGT5Y_kCe*z6?-+@A8%1Ey!IW3qA4#O|*!p1${%T6YBWvwlc+%FgIrSPh@=zaSQK=vnp2lgM8ZRwA*04X$l`5SA+dx^Ey|Bbay z%@L%F+E>lI#9I6NZSc!2&kg>MSnKAuC(eJzTBB_`|B1CmpC_2V#9CEJ+G28Tr0+wn zJ%b|tcdRw^391Z(XYwW!MK=~k)rp0A!5CW1E9-`G%&<-%2OsKiFt)u^;;0y^Qq^%O z(<=mt=02iIdZ8)UqC={;Fk#4u+H=E0w^-W0%@ z2sfhFLMaB)CvP=ZB{#Cr%8>pNrLR)a z^i+vaqaVKSsDI1({uYP4u+(n47+C*9kBiVBy*pi*M?rU0T%aVWr5lt$TN?YW*c zM(~BPUj@HbicH#H4$uw<-bt4jw?3{JH8ns(3xDm&mk?aH%)}96qG_hySO~BC__kk& zMHD)0(q@jWV%3>^H7$h*VZQ!Yr2EqDy9@J)8a20Q%NbduAHC1wkHpzq zFa1>7fA>@8%6px`ZaY0`B7(Ox3Hc?`!!)T1Owrs`aXX(~6u1rA&O(_`c^44$e~2O@ ztq{9jmvCBtfwI-^!4~Y;nD|Cx528jVWTB{Yv8y|_?XMLepgQts87MfX2y&fMH`f?1 z#M_gaiH`-XBFI~Li9pMZib|jpQ3$)GY!|@b9mgMk)@dSK$0tx#-P~@Rn%ex1WZ0KuclZCFj2D)8how~=}2AHktI{O zo4C$uH(J_9KEg>JPbae|u5Oo}m~Ji{9)cdSMb2E1 zrzYZV5Lm9)hRg8Cf;aPDN+hyL}Eh z1U+WoUG<$VUE7mYw?a{8aLU_t%uf8W85(s!T*NH_SGZN|3i-9|_Jt8|0PV|5e3;SR zSEZNftz)SdrxW^p<;S}2PcAOU41|=!?Vl6>)>k=3K$;M1Jarv!DRer>F`}9s)@4RK z4Do8m2H0W7vRaL1Ho$hDf|e5;yy9(-1=Z`v{w7($>+hKVCRtY(>*$_C<6e@iqGy%V zD*tM-nk>ffl;;#JccBO4k13t|RG5ECC^GoK1Ji_uMS8-`@YJh^E@#-?{vx?3wn`34NmN(@;E-84Nd< zz`;Nh!rPIonXLS*t|a+!rh=As#C@SiO%UJrr>nU#8i1HZM}Vw5W{8QD%YL2yF8V7a zKx#?P2Aqn~!oVpd5wweM%d`RLh;$%??%AI_Em2DK2Oz-Tk{(~M`O3ggfwrR=%Umi6n*X6seYPyRfZP%@ceOWfF+~k46{WP5ui4th8AQy`U> zo|xKTsCx)204&y!(bQ8kP&6BMw54sABM@r-#;Tjj<)22XBwiS>SVx1;`977=H8w`JYsF&77|Jg%zQZ4~}vgt^W>OFiJc;r#J z6QKA00AMsqVyqT3&p8*}?nyXrbQJW-8!BKA}@C zLd*ez7?cgjI{jH7D6XMp+xURoV2NElHrk6-gDfv_SohVm9I_r1QEv3fu@ z3ZJXei!J0wiwkPFlkcttBdx)X#T|zCYS)%hK0p9redNNB8AHHOA2}h!DX{zUZ=iWrk=wokWc}oBkm>nAazD8y z;O9Y43SbP7dq8*rkpnM3W4GM@#|9`fr?!Ns0>5Bq{FU+#})I5iy5^D|y(?{oLx?yK`N?P_lN@sIgtv^utJH7V0+K`-;$p zhmQ1Xyz2;o!1;sjvvounZ6l6AMx3N$-;FYKui4d` zU?Pr}BdJB}CG}h2R*IdX6d!}SPp!ceJ->FKzWj&;OmIUQRuqgDsg@;lj0CUEpyERr zCPLk0uC6uzAEuE1ZV3VZ4^AQf-4X)+ADlw|yCnqtKRAW_cT0%+>lE@jg}hE7uT#kD z6!JQSyiOsnQ^@NS@;ZgQP9d*T$mlE@jg}hE7uT#kD6!JQS{C_=# zJoW%#7SvP#Dk-HWya<7#!jVkeo&vyTNsUj=5)pi4WqQ^aASH3mc)X1xDQw9Jtp47b zqjcG7e1k6TI|6j^QY%1s0vLSMj1b3wFdsEG1PY+WM@<3gYgg~dN1X!!7M4XdXuX@i zyd4qNFC=CVAo;cK`_BH+tk?S_-qBp?*rcgG$#4QrY9)$fR-0ul7St_@c8V z(!oR&*lt{R!91}?ygIzWvZ|Pxplr|=x9H%2ve5aPK%sS4v3v%cp;(a&BuBQ16=v|4 z#Z$S3qHz5`GoI)FB=EtC!_xl9+wb_Xz5TbFB61pD8u+}iFAaRqRK#yskHhhsb7#re zmm5)axz{H$h`Ji*E~foahJyWL!KOo^SU;{J`BOQI8UaPT@dG(|Df0YA-xLJp@8$?;~>`;#syL-$K|yHQdPB zrB(E@eRH&8oxqo^fx#^8e81|!Iw9-UssA(Zu5jLBB7TX^Cm5Gu>gAfiCc{#ucQ*^oe!C?aBQDz!5~;EYF`+cG%R1co z07cOF`_kSknr@}yq7~va-9r2;qvS7-S!tt_UVlo|mYsUdL0dGQx1@@GF5LxDnd*@~ zss9Kn$8(4)=6Y(Xh}DRyHe_?T$Vrz+Xaitqet)3b_zc_gWg_+@C&m}hqG%s<<&r3c z&AsxgA&&74f|?{TK`BaM--m^3lBaZH$2u$_EY>beWM{2B?)8^@RKMd|6Mg2NHEaJ2 zkl9n?5G^EgpKhd%@XpmUrX=pe->}vl2wdV*mo2&5>*WDYNH5O{SU~)y?NkjtF4iB* z-ROW}d+J*V-g;XUYI_K9`OOUvE@=jNCrRu5O?#_{KJ4#Dtd5Jmz}@Z{{&Mb^6$pd( zGUnav_cd;63A-~`k^s?1;iRJS_x{_j08%C$U^FZ%@C~j6T zHsGEwgv(|@li%Glx`vML)bSvM>uUIpuqJRa=0dDz(q9rL<-T{JJ zX5rdHBA@_cVYM4^!eZOyQGOEOA>0l)kbww*@H+}x@N-_sF8Y-kUOxFi-?~tng3ZS) zzvat_zBZQ?{v)H-l~3jCY{mY@$k85IJ47+^1nO(YKejjLzHDC-qqn5*+>BU4N~k;1 zeb>Nz)Mj3Bu_@zzbcyh+q`pn$)^dz2PR?b5(Up#a?k%wQkS9#mYO zwQ+AD;HhR)+w}E2Eb8A%2v4e1pQWpE-ow z;APK)JWx3<;J!{JM8BCO5;xNiR>u=q-r$)To@!w=!6B~Us)3eI9JG?bkc)}%UNS6m zmEe>F6qzXTfLnEXBqS|x0o#emJM|-tUMm1igISzeY0%?C(N5w3Up45-!C&ehR0F4W4ydYNEX(AHtulAqhzsaYG}E>Y z%RU}d6-j$`Pu1b4_S2;Du)SM?Wj&|&@VBwl3h)_a(O!t}uMcZgUkibpRzqBnIvdI; z!LDofydL#Iq=~69@xW_a*H6G!E7o<}3(-Dt{hYCPWU%UfsAC?|n9*}g%>53n?Vpto07`aZ-tD`xf(ynW@zT<%K zJTT4b_{9oi)8cr)nUN+%To#qUGxX&vUF%A7BIU@E3b;|z(;E~ES=C|#9l$?jK1Nfdt%1?3K%P&?AQm;G5|8oA*ooe^%Yf0&2(s{? zM7oN8bQe(QqQmEu%_*|18gBd9-JuH6NwOw{qN4xd8;(mX97$)7*>_42nO_R>{G&0^ zB_IRm9tn9KDgApRpp}J^_-&cHqZF{pLa7UVOZS0j9uQ%rq(pKm3IFvaL&W6ok$B;==NX|2pz{M~_CyX!Gc;F_4yzeI zS*r>LH!&^bM24%uC!;P2vdRw(YkiTaa!Y(O@i{AvlK|lq1IW ztF7U>^%Gtrf_tHbN3=QJ@P5~{*aFoKMD&mvp1`UD5gvS)Ex(lUGiLi70O3f)2oVM_ zI}#B=a00T9L}W%PLCu>=dPnsvZ_gZ!Ei$zgdOwiN{aLd(x$ijPG<|XXK_2 zi|ZYS3o+OK(*AiLU$j4R+`_GLp0}g($c#A&7B*U_^fT9{FT0 zT+}oaXEcfc2tN4Q5RZU~4?Zo#7vQT8J~0?0xEER(ZPP_=%%rs{b}x{mp#dtnVND~5 z<#V*87)}}Nj)V^Q^KlMX zZ6YLp8}&l+f$i`1w_CVT|Etqf zJis8A$QZaeqeMex$Unvp?)wj6ZrjD3~%lV4Ic(%TM0!HjtD6rCp-YEBSHoU3P9u1Wq{FFT9) zrOXvkbP>!T^RM|;g{wYa>Ez5eCSBY{h!xUqF54RTC0O}vKQ-V$xJNF=-w@&BY+CG$ zF;h+wAlwUdHiq2OV+|W|PQM{eJ7cLxD!g%bMBIc|YpBcQ{&w~=KsXW^?lJ984Hy&e ztyvMu@fPE|(>QaExMwocstEKWi)~xiy?T?7cecP~b5=Qa>z*m~^TL+Ey@3%eDy>~1 z_j^N;s}qi>lw@kKMYL299Fb;N^!ew~zL@0k_HMNe$$Oli{x>x+Q%ezHGZv!;drTwB ziA-bWeI1^TTXyswH#7bXTrbid7M$`z?Tg8yQ;GsCNG1PL`|aPg0>5cNpEK*egLd~W zR2}$9d&V*>(e}^TZE5@Lhv<$#G?C31kwuWEA<#$Jvv9Ig6a}mKdmh!&+!4lqKeqTQ zq=h7}?8FN6ifO%)=48y<1lvZzrQsJMUd6eUNq6!)F>bpLIfbVY9X#B85hb3}fHU>P>j4z2{8q8Z(ZmGq3`+=1XVh}jG zhD3it17UIRb6zOrZI;&$63IvNLe)Xnx`rg$l(4EK+SS0Y^Xrk?$2u#OmApgdVol9~;$02d zGTL!@dMV;IoLTcyT9kGS@`VeInt|4rxw0~IxNoQ8Gn18jlgm;j@rvW*!fG7^RK#xU zRqm?kGN_L`<7L$?rf99?)2d+4-NXr6^3}shm*#niZ}Esffz51M8QLTVz~QZqSSZ*( z1eEV($0V*=7IR9ADc)XbsWybysv7p^?(ReaG0|iMKu{bp8oZ-Er@CtoX1XMx?M*}o zhF*^+%*j;YQil8&t~dD?u7@LEQERTDmE&xA!S&wb5`S%d#G^Ot{y(;!G}H}s%%YSq z8bVEsjUeqi{a^{D83R1ydu^>%b4875f2183+0F$ws$HjnECYK(8&0Hq<~s7QTQLIc z49XALvVD@EzG|uoWEBAGjF1!V!ca(=VV+bNP&^})rpJq2d)R=*$oMVE6;4Tv-eo7c zaj4Etqi7iip7Q97MSO!?Oe(iB+9>r?z1vN$H$hgGy4Dyl7;S7^0#Eu`< zo8l`(%cN|v)IEqBjuJDK#pEAZKa2~Xt?VP4BaY0ZvsvU^wAW-?*eeI-v6y+Fer^*g z%qGOv^|6MuE}wj)MTL3K;;KZDSc48ewQt^BiZYrXv2(bv0A-PB#S3NAS?!J;vk2rWC5M`#3+kRL@5_Rhg3eob%5SQkXyM_0FEKV@H)f2O^*s{iaZ*WdWg#m~46 z@DfxwA<*uv=r9y*fmV4&xtgV!mHNxsGrDfKtY-X1+VRBMEIT0mvp!M=!@b?5 zu5N37#aig(I1tlIhy&(TNg3sgIuG3%@et-{w}Dq!+)ZxrAbMyqQ@vAczAUT&Aw!Pjqc^Cw&L$!IpMT+ z!*2`ZN49gfj_M|YAiF!638M~4qMD4%SYas0`&@&3^of*Yrc;6g<&(*`4UzXO6)c`- z>Fd`ib`adi6&8MSP}cZ{Q*YYvMG(f*9$7Hw{*rk~_tX&ZiW2NX{U;IBcbjH+)pv8u{;IYW<7ph}QdqY}Ztc z1MlxH%=jl5D3rVe#iwz4G!);DFznr_p85)c9X5YN9gLc{5fNGA{50)+`QWkYlN zeFwAQlM24JBaizoTP~KUZ#HjJ%q#fI9VfHC)$`KikLo>#e%O0&cK%J0mW$fhd|T2< z!s#8_*{qgr*SU~_fFJ0$olzSGu#D@Yao+sDC`uzbrquf?+W^gQ9mo@3OU! zB$vonx`rnT`LCAuA|6NI7}^JW|LP|4VT)NnSdI}-de*4ufK}^4G8>_jbBlxsuXEbB+yfF~jgR#8iJ$qoV#{)9~ z>HUWgsEzf(Hf#?~NPRrwtjxItJN)r5xoGC?!9B>tJ?W6<&l}&^C$QA-llf+TDWEI- zXt!AdGdKBniwMdQMtbuu@egF+=hei@EtZ&g(VejkZ91Guqkkdi&rG8Ej;>&O%Hr!Q z?Q|8GUD!#VSoaxWr&98aH|SJz!!;6u|5}>JDRi{3Y*=r%FYBsMS{AFN&V!4!ySQ*?kxVW;M8CM9)D2HO(C za9Rd{)h*uXTs5*BF8tEf1MFSk4?lpUOZ7Abwm*Dy5;My#*lX;F7ujw&I$PrdE_X~R zKci1HR8y)cp;Wc*hpxE+3CZ+au~{pmJ}X^kW#W_e6z_kK^$QLtd;&@1GsS4)yfqT6 z;oR`fjk48<>(GyQk1d_sBU_-Cy*X05jZl2ZD<11EOVZ zZ`epdA8OW5r@SD7^}=0XAx~WxO<@wfL+87DbU`m&6dp25@s9$kvQgLc65rHSuTBzD zKy?Jj9n?K$LicqiX8P!`L@xM3P{w#!9LR52w?JL8#44$eYhg!ZJsPT>u$M-zS z|6G5Q$hpoFptQzbIgpJXM1`Y(%24q9V$0KPj z^cmEdsEDIsvCk24X}HneBNcR3Fcm~!1b!$S?3F-u3ED0A zb@B32nT2||7JFvYXQNTYQ6v78AuZ>KuIQ1wgDLu5Z(0)U?pHT)q2Xr!mTDpwPcpv_ zM`h5v6$40*{9R#J(^WyYVa<3>8r{ztnqe08`Td+XmY(6HV?1ehKK0{F8T;mw-+?nJ z0!%a$x7fq-VUIU&86_Y@D@U<_;&eiM2t%OdGd@1BmQIL++bd^QY~E81cC{(m0$4Sj zgrq8Na7imc7VVMS z?H*axM?_iLOJ2!r%rddp7`@I1Bw`?dox--wc-DG^YTQCvg3ee&35L1)qTTW6?i9K$ zeb31_KqW9V@}xMOpGe=WukU>AkMfL{0))TegQRqDzLHNLZQUsHI*@hVkjeyZ7)e`^ zYS&hx^{EiyR%O_`R>AMss3IoGCSg@3G1d-HR z8uH>*U_F9}8?xjlfEP&=g%|jXrO<_OYK?_hD8=pv6^oAcIYW>j%(OSa+DwG~>5rvS zk(5nUjwsRU+>ZiO8zypZsw#`*FxzQCo~$O8A;7D8tv+b_y~VtEYb=;s)rib5cM%&;(hP&Iu;M-4$*Sq+ zd%M|D{uYH;i7`&L$t?*vVwHp;a8sc6J6wG8=-Gs8dVG~}4pVZI8BNm6U5ud6AVYeD zt)qK5#NpAy{Q6w5QOM!RJ3Up08MU{8`Xr);!V+UCD2uMMi=&=XpH}@*nsEb;>*Xu> zrn-dSsBg6NT)h}snr#LM;*aJUEmuEnj32>qG4h~?JG7fpDoBgl6=!eRfjkbubEJ3 zZ40?!@o4IjI}es+PD|>&Gvm!rymw*+j6=#p`J<&@o%3r4t1NRuINOXDbm47~bOJ z$n|o{fF!1!WG1}Jg9S};HzN38*RV{|e3y3fJQv$S+Ie0XWF=eozUB8e1QIugRxZQ- zEQWD!ta*g^b=2T+ZeQI{NOA?eWEO9kH8-X78<~%9p1F9)Z1<8Z4jL%OAEb7~#IuW( z@A3FQTm_q*%h+_Pc%AYp2B7d0f+sZrL)UR!y+NH}9Tb^>Si2?p;sx7gmc7xUenE238TrdOxeF z;C=UmPD0Ry>4Wq4D(Hd{>0to9EyY|A^b!6j%#T`H;vbe70W0&Fmo%vd;HITdbWY)2 zv9tN)N=oK$Cu2OWg^FyNK3j#ztmt$fz*8F&UbRD=|D32gF!f!miC*G8u>8TTArCz) z&-QrB@RXrz_pJGFXkzkbMYiH&qG3UUD4&%8_U(HMs`bEBniUMX0oD|@Ip~%y`Z6Np zA<>pebcHW~P^FksSD|!56$lm;cUHonsx?qx_ z6s%+gY86n;eY^R|oi5i(&_%1P~9>+gs)b}n~SKAHql+@ejf)-niD&o&7j=%?4YW;W1*9j*@g%!jP z)es+6US3V!Bph5d7FfmyYj_WgH3aWU?OIyOb#*1&A|Fj*O0AKVLSGvJc2}4RRo$_r z$OVmzay~;h#H*}%b)uU(kMn-Hy_e$$^Aib@AbT!sRD3oV?)K?q^HK_ z)@&tD#j>^18iP4!Z&eUVPTg~{sg27G6bXa9k;?D=_E}sGUILQr#Gz@M}0uZQHhOJ1cpf_xp~uv-a1< zyEFcVd(3%_^M}KXBc<#dcr(;2ICm^!8GnS4G^sRFMxN-$DlSj!@oPLSNjyfpLErV6 z#C@)AYATTsZrlnppNT{%@*A!P$j}3IkwS?zA~Y1{LK?S}!Hf zv!0ioIg1JS!uK#rGO{J0*{I%g34?UZZ-rsDlf+t0jcS-(&o8}h@IfQ;?7;N^w325f z`rmm7t7upgSYeL<8`>ItX#i*7RBPU#s_zk&z1-i_O;ns@yuV=^oo-}9$s>@-)y{#< zYt{raBC@%ZV#~2JkjP?FlQGB=$6_;!FRW|}TH+=3+sCj^2CSRyb@EqW(8+V=)|!#l zZ<7syCPS2l^IguJdrfc~Ei*gRMg^nF4aG}=@)IgR91b-;)P>c2PtxnZh}EfbCb!KP_^1P3^n}U*M5{19n9*NQl4A- z7WsXt4TE0*D3o36cA9CF1qO-AdUy5PTg~|U+Bbgzn9Jh_D5j55ovu?GBb2syPJzwG zd+9FNqiT#_R%azSD3}XRzf^XR2DO^xJK$>My~R6$Yir6c1>7enLLN6K0Oe(F9B3t3 zLq1_jgXPQX516uzZ23PWipXb)lK&B+0PuD{OO&n85{2CBnt2gztT_}{cSK+u>Z3#{ z-2Z?n#SBjkG|=qDfXH96Sp!@@V9J6ot;xRsz?A0ccG@2>W%CGFxdOVuXNhv6E!;i5 z`7cZtGNPLh()VkKfAGU<~I>Z z%LydpwS}%*Ule0&?KWK&u_*vu-?aD@l#X43+Qvnp^s`x}MweoV0o4W=+;%xE3fBz@ z?Mg5rKPnuWzauxu+M*GC!YS1(wInU=T&7uKmH0h6bSIn); zMr8!MVc~A8gW`?q^;5Y-J+5xwcVE%bR5<7CS6-ZX<>-!gHBW4AKT63rx=o?lW*xhw z59Qf%>EaJ7p^%BI@)nCOIVkO3h7!3R7RD zTl6lwEVbG&>)l|GGT8$397JYVa$Ej#$4qOMH#nz?rY4Z(XZRWhiq>&VfJ^=2Ea1i>;wp zbwdy|{Z@^F2~`jg!mgTRcoqg?`M@Yo8xQpA!>0tenW~%9)(!xwLMIKsBd!=9ONwK; zer;B&SCSW7m+EOK+~IZfgJ(7JO;lF2RM`kS)7i1mRbjzZm9@Dsi5DpZoYHz|62f&_r3WR#w;;0m3TGv`4%=TJ6X-ecrsNC)y&!TtLOEg#|m#&dmdLM{-NN6qar_agaEuyWn=Dbne zx=twLa&6(?)xuE%DA^=Vo7oY>qp_;|pJ;xas8xvl_5<}q%0|G;Npj+x z;6C=+Tx$MYcIrPA+yRXaMcjfBdsnT0M=W#!Vl>SX6%$@gi?mGh+X?c0?6MxvaaYUW{cy}u&-kv-uG$8%xW(MN zmb$Hz2{RE*vUQO(z)r=QqZ^fyDPCd%4FK8>qvHa;>HZx{`4!n{vVf6JUyO$4^;(jJ zp4H@kMZ(24IW|jHYVh+b(-9k4mjEPbGJ2!CCU&2;k_?o_?6oEY>r<5FwD?%?z{~2A z&FG%^@``y1u8m`k_x4XVhUew4+*#b^JZWX^jZ8nDU*F#LV0TcXUv~Nd@5?Fs1t94e z;BI;V_lp+K_r79;T-Od@Jz32>OF)gQNwNv#XDzjE5jR_~zaEOAYd>w^zoyc!c$5F< zP5Eru_wsBqs-igl=IJ$Mp6QXmLJ&dhyWUruu!HAf`H{$LQg2w>#^QGKFXQ1uXQpFc zMP4U|9Q>ty6nie-URNbN=#FX_eGlOLr;`9L$v#lV7j>(M5QZytP#Y{~@~Yx%1^YD= z=K}q4M*oAqYC>IHEB#Ur1${eiPXK#qK-(zD0}=ED*IDO#W6?D98Q~Z#HdGCQaNXO$ zY|ATLwm?~P+Sp&?a3f?K!g=f2k3UsX4*(y9TrbzW{1H{>BH#dUMjd;8V}MA!pVkJB z58~s2t-b?K2k{93Q6rsakMEyDWjXIjChEc)SET5G&snyk3}B+w!Ydfls&g`(qI;)hb;d}u!rSx&;Y{A|4v zH~}MPoQ#~RY$-oX1}z|DxAx|#fc=TlY=utk`329mFh3yCQg@fNt}?V@QsHNkpE>e1 z{m#selvWX?&)^lIgWDvJ{ z@1K|T&rg_ND9$ci`~>erhD18oeo4C<9FYpPLi|mxLfqH^1Hl*du^nQRvRgy41>@3g z#q6QeHNn2!d227X6_op6WP>{_YCjlR$$uDGfXmRQBO6C)&L6Z5nhZhI!e8P3;mD?P ze3VpTxY)LF&$o~nqI{dCjGrZy=x0gQ%ZLG49Xbz;S?N!}Y4M`s1l)p{vhiRzd74%G zR|mR!yr2ChBv{#9{gBqwdk7L_oDB3?#(#TvvYoH-UvzgFjd1>qs$(gWoLpg=Bf1{2~J6-0kfo znOi|9%fLp}G9EMmyBAK)?SJ*s_x>!JZVKy*#BTd1wW@v3Zrqs?C}UP{-r^9y_iFPB z;a^v#Ud>)*HOD~HDg9THMVs!``F$j+4TcUn&4-J~zUG+}iT1&g9r=-n2@C zzfM!jdFcJBVxOn(ILp5y-hAiL@}%`a$?AHAC`2Bf0rJNw3Ex#E=zsECB<_e@(?6gy zOj*^OMERZ~%9>JC)O4QIPa>EJEyFCC`0}*{Q$+yX`x{oFPd~29fz}LhGooZgMF)$b z9=~3bpMvaVvL&^-C=#(79b=?i{%{LFDrgg#Cb8|2?H{oIwG!A}gn?{HhJ~|5`YYZ% zN-zDR8Bo{=>28h5-hLUH?BF*m)ppj9OEVNh!AW9MOzh^>=Z=h30Rt8I)$Al>zjU>MzRohEeJ|;IYE1UIKrGY7PGxt z*A5&p71dn`a&V*yO>xgc|y=FunX4o;;rV_|7!hq&voc?3Q#W|n02p#`Y}|@ z_Ufp>5B;^01^CWYVHs62E7!B@S3b`MQdBAv&=Grb6TtAPzn8p3T9Z`dg=2 zxO0%cs46?~=9&dw2L0;`=-D>Yz6smU2@K+gFBAghWT4_*_I1nl0bV=34+Gek+{hS7{nYT_6N@p-|hB3KFMgoqci~o z@h2)Xzzz(+8AITRLA~5mD&D;^(jd;kFw_;XnEtd_ekP7bEp=glzA;a6bn_{723GwquX}(7VbU_}Zm!-}$NL>O%3+ zm*WEM>IrDb;t702x!!2KtPv97dg?N2vrX@rR0)##(=Uv(m&cG7-+Rv4fo=5!bf8AS z<9Y&o&{1G#CO+{Ow9PX&70l;TAW;Jz766^tmzn9!gOC{qzC#1!4OG^fWJvoS2mTHf zIqT&Ov7NgZ*latNJ|QymgB_W33&zhv>?!BELfPqDjbJP+)!j#+ob}e7_pHizOq-9I zbTI9)cPt?&vt09=l^Iq${-1#LZgFKIE~J|Hn01TD)EzzCeMXXH*NZ4o6KSKCAlk(@ z7p{vYj$Ch0ZO&$cgu|)%E zbKB@}eeX4&Bk?8)SVA2~qEnbW9Dyk1Tcfr&4OHtN_RRAs+bqeycP9EmMoU`}3|Bb% z4o8tVZ#=Q*Br*E)4zUFQPGIU3J`tvpUiS2&)>fksl0~m7?=+K@#{q0B@RDr;ceZ~~4^B#^d+KoHL|mo;dy}C_^}Xm=rEMQVck|4Q}z~cTnPsQm^p(_3&e`VBL#H=@hh+iCrQCv%>8NJ}qFwGV+nx_F@9!>K(Qygu<}pzM!bk zO7Kn_hn%y}RRLlGf;f5mul12@hOsnia)Z;VZgs!%K7T9YnH;iAgf>>07zn{O$F6r^ zK(AZ!V>MjxO@Oa}yxmz=8*J|t76SV(39}bCYttkC^p!5RZ|G(8h2cN=syC2~!NCA# zf~NpcsLrG!5nk@lv1hWSksUx#(uom-r&ePM{*%pOR>U&->(2u#F~+8(!FCSr$hUc{ zA@CvXA_QbCh1O@8?fm>f{iSVW;&0GuTRANn#mu=BH|KWo4bg3ojvM@?oox3;M$XCC zm>%D&(M*R~lbI{h@g7s8*SwvHeum?59&`dIx`W?}2DbBy3~+)J?a#L5xxMI-_+SID z3T?>yxS#k`R}jBkUKikqHnoJ|hA^i(!1DINY?ndg6#ZH>1Z^&42b;e6a&%Aau|^j& zO0xKQJR;J?L@K_fe6^gX8PeNxMoG4fEWg$--r}2Bqp`3yZHwjJS$%vnKYAvq0LYFV z&+e!K(~oN}SSe?5Ip|Shw+4bT;FNQ=1uI-u z)~hN)Rs0zXL~fqHkR0paX5P88ykmzyB0UXMzlrbSXiB6e`S^WX@9^XIZ7mwrsxwer;M zKa^~~N@f0W{wF1?Y-EEs9{2U_ROQWjs6fh-i9A+yiESuZx!~lt;>+p;)cN0dk}s|t z5zsyX5)12^+UFtV$X6Lg<#>NY#Hb_V1g1akt><^<$46g;y)n?sjOfu9m=7Ddjl-+_ zFPdvfYH^&BV%i2!WKvWo%iw_(MfeynshHvM_?P|#ioo$Ad|beHVJ`B1ssokqxDHGs zFuh%oq!ox~^>+r}AlF$2dTCUIa|(K7LZ|4(Ii4F5!F6FC{dnCO{4ZOp-Huwc{l-G^ z3M1lXdD1MjgNxE&aM5aWoH#S+&P0Ch_{tS`x`U5+4hNWc8n_64ZK0)-ByAJoy_CT* zRI!!F0hiWNPTjx`69V=xe2I}W(i{Uwz*iFjNg8pohqi~`J(Mkq;UvKl{ukO&4^Q!_ zXJe^_Ff)GZ)qHvGN_?AMmOVD4KwDD+-mhZf@r1;s&H1A3zGEXDTt&bp(~p1WR==+l zDnA7?909Unc=H02d9yh5C-&g3;J7)S;4wVOFnF>Uw#}7R$?P2>Bx8FW29(Keo=TJY zrj4g49z##xz9v>ngwpO%^DYbA$hWw9fG>S>tTmHaI(T6$HOEPv$vhm^T=PpTmoK7{ zfK(?;0a-3)6CCmboeb5Tf%+g2dw4%wR@ZHfe^^!=adSzGyh!t*rN?Ry#z^JZ_GzkO zdDoTWt=WyhFV7?rm$#t#Ih5ySZsQ^z{M~cFwemwB82aM%T)(nl;fhx=36mV`Fo8xep>;oDgZy{+<5Dr$LEACgg zn7_R|MW*nYZAq21#jjQ0yW73-KMnU(rooN3uK_O55$T89NfHUoKUh|JEDe}{S=N+p zl9*4HRqlgj<^Et<9X?ss?b)q&YlBag)$wQd5_HMW3;<=x&1RRg&P@xlS=+pX9vRfS`5>mOtp2O$kSUTj)>+VkTmoZ53e(;Zd+rLM4Cu{rP+99vajhQXVLuJ2HCz*>)mJostzYjK`g^INyp z;jAF;?5ko}c`o0SFXkl4C(cU!iL+iBsgardvD83|Gv%|HEdmW+Fy&>VhPf30uO1g} zOj{>mV!-@;8RGzX(8|Zi1Pft9$Y5x80RyFk?J1uoQ9zzM7#$JPV{zypzC|adNyGw4 z9b{%uQ5v=|0MhkBik;pMRP4jU1X~FQTK3^l0hqSFQRj1Z!m3+ZD;tSM_c*?w*)ZOr zN*O$4EE`{ro-B=3*7G7Prv;pE$aUiqXm8s|2uZeiI%f|Wng+9N7u>@Z{l&5Y_rw~I zaJHKa6VXV@<@!1acM_`CV%G4wr~N<0S_;$x+plt{C@?3=_u-yemOmRA$OQYufJ&OG zDtnS+kz<=UN_X6jCA-d4tuscX21OLjS-oNsXD@U};*H**WeRZozU3ccaa=-jQjfFL z$Ukg0ETttLn6q%X&=)g(-d+~vZiXah^v1u|LSCYyDPF^R2+TI?kL$0vS>!aaCfiCt zr$AO~GNnLXk7_ZY+Ry!o`0Ykm0C-Iq_(48h{55}G(`A|F1BOk9Jg_Mz@YWQJe+yG5 zLCzQ%dw@Rovf25I8^i`(%N^oOW!t!VOI&1N0nrxp>&xM@tGfAUk z9&o@fQU(w3A z73j(x;74h->F?7oi_Ag9_orEK*~aylx$&-e<#2931NNDw9t=$63fv5y zd~Rdpt&P}H0-|hZbW*Bue%7`;BoC{3dHK?^KMFY|GwSVHj-%LCz9?D@*dtvjV?o7; z!;vLGc4{EehjS5H!z5)g-6jC*LF8&QY#zcffNVt5LL`5 z1pg%f#pdDpM(>v)&}j8{hbMk$5-0_s(H#>rW}he5xoptV1PT(ma!#vsbS}DTt6cLg zMZl>zcm>R5Qe<1{bCPvxruP}GQb#5~C`@`#Qwqr~ShV8bRpGvH3cFm)Vr_JLVFi7j%Jhy*7O%sz@z z%!HVpW?|769yhN-1sQv!WmK|lBs}5IvcPk|>2NQjP6^2)u$?Z4r99UI9r1>RoVgv< zkqd-E_95H=twDyasu0Rh0{mjgY4CXCeNwua((zC9y(a9w=az2&9|$0r-<1v$_8X<{`_AS5VEQ_t%?~F$X1>g+E^Fn4bF9%Bh#QXu%!LX{s_`$>JrO~`R1^O)Wi|3MpYFQ=1hRsIh)n~xapK|uvgWbMnE#r*&hrg;{FA^102Li@#LA71*~cN#xbC}k zIq{cjfuH39Kkb@UBfu;@X{6Kk57Gg`CO6Gp%UjxY=%9m*Sgm7*+gaQS`tGyzK9y$(O*?|! zaE_e4*?Wx*gHg#j+0s~Ihw9x{)%Ca04OT+5pItkXLU zoAD$&ncU&8gDx|^Szr5+s>`iE3fYA_Eb8t&9Xk+!fPPmLQYc~V6_3@%7siL5m*?LT z^h{IWH@o@5YUdKk6o!o@5;b?s0%@RN+sRlwhKjxht8e3{3%EHA&6kF&>e5LPDqXPo zZVK1L@`w&SFaHfn(SCZ72Iul5LpO!yksN+5bsYJmRV?X8CA#ZV4RdpIVfw{pl6zg@ zE@D=pe2o?;G#xnEFZ%8_ssv%x8^ITI-iOjLYU2w>CIF^?sIp7K&qZ8+34Qv&%gJG5 zcxH;+i>3FPN+@H^nVrkQ5B47o6`((T6lU2`Od3N`#;$r8P8S$w8Z03sF}%OHzk(zp zYTSl?#5!Dt^~z^1zQ_Jv~Y(vYr; z4ha}uyY~fibOSqs`G4i^1L-V|jCLa3Sni)0k>hCa{VLthv zWeB0)01eGn4R8k-Jqc-Vr1BY0{hI(k4P_Y)@mPGTF;+j}&WFlEUe)2XDY`#{r~|LX zl6fdSL-7o<9~Z2=m-l@hXe(-2z4|2}z4(j9z?p84`}bJbC(d@pHB$iN!PfIP5^m7W zxF?X|3y2=3yfbMHr;M|;q6P*vv=r@+0XelnSF?Bs{k{qf`V`eFO>)L1nnyr&7Q(E? z7otNKv4F`WQ8^kq#gOOvq{O$B+H1sfNul!X3k4|U67x=&hM^E zyREBUb6RlC>^}Qr@LY;&Jyrv#K=K{*Rs*gQ3=jXry@Dctb}n0TP2^(Z{f00s>u

IxL`qWcNAp!sw+Zu!zD-%#jllRL8XS*~%mHXY8|>Xxqs zKN?)BnMJc~-Ye`Ec@Kk!XcvtN_x-V?JSxwo+g8#eU+K@K&rf*CZUSsnhFwlLPebYJ z;(B2l+M@4q*laMKoQlDTqsb^{|NO>O6qA=M4}L{T?-tFo^$mKOx7U~8XV1$+Xl{vu zs{2$lFHwE(S`_>ng-P^YZHR(X{V}ejHFw2S}|-xq*LRzkYdy>5;R_IrRM#@otAE9x}aq4 zR#t3BeK^>_*n9#;z_%r(YVUiBs>z-dWb<#UK1;!S7hM@o+=<1=OWZ>Zd=_FjD7tlM zeK@i7$c$d@Abz7V7>CkLwGf*2WJ_C7-o{rfe=AF`vM5SI6saO;QxITKgr-nB0Hd-& zxE`j-JPa^5Z_$ktQH4cuK7A2Nt(!?+O4=7QYrKeYncawiANdY>BL0n-`qkW3g2u`|Utc6?5MdCuw)o>KUd-53xh53dj5;gv8JRc zX`SPglry49>+fj1a%Yt?yx?2NJLUYc;M|*sre-@Q>In)37R^tEF&ueF0YxpT2crGp zdQn)G5z`T8(DI59E9fMLujNiX%A0xeB?@tNG%$obROX{n}z6#-x&A=;)KYOu*Xi%kZjLE$3t)92~&H4?!sPTWpWQaBGR~TS)reL*9 z8xk{qwyk2Sx@<$L&R)=`7*3A9o6oy2(i>LAcDm%>Um!~6Mkw&wLpzzDq3#kGelsuh zC^uJA1u%JvLUEXl2@OuZP}RY73&j$X2XLS`M^DJC_Fe77V?(fFEeOc(jZC5hjKLwtBkpD>TM0Z-igYoybdtQNe zG~z&-tMLqcYW+vhb_b|AaY-8U^6O**+Otb{08-@DL*p$_8|$@jQrCwxMt`~|dLLF4 z{*}MfTOjb-OA`Cq2&HKvP;9Lk>BJ(#uzg4=u~Y!>TwuC^nS*u6D0*p(^30Oj8R4?+ z4^PTO1F`2;2olftar(N4Y~+qi=4v*vwVIw7HbRPS=<rboA-ErzkSkCVVCZv71%M;>AueSXaCsn`wP_FVKC`M z)EwAz<#7E|Fy-Rrz#POhs&# z7g|L0pyyMa?J216trNp=tnl2wO(GtHxo!B`AAA>ggV=|;t zq$}mk-qCzk+7=cgk$?7U;gqqE|4L*b@PnAVps5o57@YWF7p|T7olMnQ8t{zEfU=5! zGT%WoIvPOlVsg6>&jW6skWjFA(hGeg#qRcvO&QuRGOiefu;U2xS--b>Grr7%Eml4b z^=)hmHO-q*fQv1u3iO1$4;2OFbhz5I+*=Kkd{C&+1jl7$iLPYP|BBz=i0_~0F2lAW zuyfvj6Fy(Nz`~ou_q_n>(3cSN+EYXh*QR!8gq_2<3RK1}U=U;@RKza~_)tt__rOLM zo4R#vIgpOBD5hewPo<80gGdg|2ZM5MNsg@FuyL&EN#~X?oguv|k}mX@DcygA%UZG3 zl}K>Bo3C`U?8a7DZ8jM=u0q=BSze)4PM@W=ObHkl9JI?K0lWaWp@)~n?{A8?8pw|w zocGtiQ3YxD9L?fHz9&nBD1hq4Ax%|DiHu+q(oh-T*tY;HHOTYl?o(DfIrDM0L|k~fRHJCCajP+Q}- z_8+jF?k_f~g!n3BSy z5j_{XH@6bQq2lzx9W@L`Kj!p5yUN5LyUJ9`AG^wc2#1ehWs1wsU1gNE$3$z`{ng%Z z2Ga~P@Q+>P8OMd@tn3OGCc2P@?BOpEli1zOf=~&{{(7>VhTZ+Sv9x~9L? z3t=lhca`r-GdB7)zn>60^hzboGDfc*!Zqi)_6WNT%OZCRfT0&}1`-;-& zegaOULY8e^pX!>@tFp!>yCc);!I#fZNRrnKt537)rhlDZunCEd!_UF!_kUskGn6E*!2TyxmFaV!fXL)>A zJ0vU+ou&3X-9x8#m|O#=6rL8D)S$fIu7V(vrwh3u)4RC(aDU2DXxXV8un#xy2pn7N z_dUVa_^XrCAMp+MHK%zT%jMX7zOuLPO1tB$kQjXZOLN4Nb3SqA zU{z&u>8ZF@4_Z2?`1IAgZysQB`mw>hS@pm#F2cCIXL~+;)(J7==RUAJEBmv4_bp7&<0s{E&i74MQyr^GT*9)+enG(_HjXFj^^vc-K}uiK<{ScA1F zy{Xs0)|Yb~7a-c73b{q_ND|dt#1^J@x)&0%K}B^6h^=)6WajqiCvDW(-x zM_Y((1YABG-Oa{#%Dz@Q{dG4U^A1f7Qx*{@3J{w@z38%2$xhqsFNrXtdRVDEG;=B@ z0gbF+g`4esr7A%Fay&}FR+4U3=?uyHAcJ@yJ-1zCDJiz$itvf_sx&{kHzo3RcFg$* z0?SAcjFFt!U&Y_7O^(q8&WeN9D(tnBK-H%pvCf!O{#SeH`iAtmm`yU2-^5G$d(i zEV}rNao9}OYE)Ty3wei=n-t-pL2#o87fmXUkvU5BDhWh2?{_Z~^p6C}}=XLQyiSm?T?98Kbxy{ro>10tK3 zm$q8Kk8S2&CN$jg`z%g>`9zMj@Y&~||8#0*fwxSxZ@M079)6}U-a*@i;T1!g5v5vJ zXD|_it|5X5@#s}Xp`2Z2VNO6cXlap5z;C;rf~-M7qk`Uwe`?_}}Jgh97ZuTkb{^J}<4P!-!f zBYir#`I+e*JOJ}R~o1Uv8Rhv6TvRvoS%?4}owyVJCDm+|p*LOIeT?i3A z06~NWx_SSdbDdAVa2->TgmIB8wIAuP4K-RtiqG^zJ%eX}cUc|l$*IT49?@di$Kd(> z$KW|WzKLrrxET=4a%SP2fEihq z)B^r@nTaPo3SLgBF)n!OQ#kEa59KesNbsf$3N7UHE*~hVjJDWh@!Qt8M?IiBK0ZVOw zWz+WF0+_{jPoKW!d$=cKnx_1L_Wt;GL^ZwBq7UAS`TpF{r*j&zjJ10Gctw5ZC7N1|GsbE)oRtbZVV5201=?GbbY6GJJA#-ibHRE<}BB1v2p^;s$vv-Z`W*@o~J9!n) ztmWR{D)+|gjjG;9;hruXUmjVVGAX-WQh(#m2Q;S$WO%)(*9df-bZKa za`XoVXvbOKyJD~1$j?D^KF|Hi-}sVK7cKDmioiVgMXGuHzATJDzZulD_hZ`Pw%NE; ztw0}b&=`iHNi<<>9JbXXp&UTNOIKGNK%;XZSG+v4@A-p1Yd&W4!SP!)xQ#phc#6`k z?JELAGsY!~aRM54D20&MYFQjnbuNry(W z=+4Z?6>ZM8zyjdrWYK5E@>Fw4Ni=-Aatf|UXkpL^XWjo8UeP;a0fyHn5Oz25IXvPn z-*dq{77=$DkEzshO;SBPRm*e%1(uL|(L>nN*m|WT>id&8QPkyAH{-&$ctSlxI&a$( zWuWmBpk&GJQXV)8O7`&yHuts1jxs;omr)>Giz?GSi=@?2JSC^(xb^&T!YN}E6soXe z|1-HBr<&Yv0l+r-{(o(*W8>fpy@xK{*g-j*LP1j27Y>CGOpOmSF{uh&KsQ8orvfJ% zgth%QNE07gVj!?!`WJupV_!vMZj+kn>{z>E~%%qiH ztnn6*-P!{s1HmX>;y%{dQ+M!iw2Gu5K2$g(q~R!0x!H@z9X*BHT6;nWByf@NPJ%h? zD`X{3>(0GYdDOCibjy!Kys?Z5Eaf8n+N!fXHE!)t*52fX(9zW7{4(P;By^_>;DU@Oe#QP*;??kxI8 zqxRKEE8`c8;G!+I&|H`*?N__E=h2?7E#EXc8`GYi0o{=oAtNa=l*U}Kh$^8Uuv1^h zJ2o_uDx$&sA0=R0BG*+iWg(YTGH+Fhyby~3qog z{~TJX1w1W?B~_$^13}O7mMOOSP-U zw#*3HGTp9Ur!Rb;=iGX}d>OnK&Mh) z`0YK{;Th0x>jSai^2-MLe~tBTr-tC3r@$PU2lt4 z8wAqBXD7GTAeQ`q1N)6A2su&~gXgB6x`^!hS8B}F1oh?*o6RFj`HxPH@SjfZ>1I&& z1~4L>+r=tsBkTnkKHn0ME`R$re{H6&7pLwjJbZd&Fm1qrU^;EkrioxmGUhSQ{PleM z11n7`G4a6YzGYS_u-rK0xaL>sh zPg7n!hr3n2UP7UbB_esM#}|(rV#}QbiqQ)^3;zb(Q${$Bw0arUBd6NNY5?1qt$nz>tqcSHh01?63 z32$^D`9|#-GLDDwV?Jma*G-~QdKg%TsDwvPNHCF!5mm_zxnof!A!@obfVV^U79=pj z14vRPRvD!Q=W!2ePm7l#VZ5&1g$#ntHxy0 zyEn3Zvvp~=ZvSwqf$y@C&f|h(gRCoN>RYdMHpny0P4k{Z_Gz)K*;WYlF4n%Ia zw2jG~J+MxQniLozPK5}t2>htpR@3o>C`X1F@dJ$zW(pAlr5N%Uy`3~qqp}6TP5kh7 zo?I~B4K02zId8gkTQs9###M{iA6Euzo~syjTMl5U07!{XQeJ zUqq~f&+P2GF4wcrq$+!m3l-rVGbSA#%2;Ve-NXs05M>?s#$7?)B#(Bdul--)yRiBb zyOSa)r+r`rt2)3}hS*~FvS^t+OBBZTLoHttZIfzbPKmm3^FZwtOjWmuN^!XU?cZjQ zHD_960a9&pqQhOr8P6Sek1v>IYSAy((8C8aw2iH>;2vqQas54bh`*#*36R6UfWcx3 zHAE-o5PE5h?)Wc)OIYJS+L%~;D03#hLr#~U5(#bQu&*ll64j(AefVYbz3$~f{!NZ1$dT#1&47B^eF)<*nDLFPE zhtB4T=LbeoXHPqssK0&rbeLt)^Wk8x>{lr*M%oWfZOt9ygHuBl$maClEnNEG)Yd*Z zHPz8Ez}BO(gR;s2ZCdOWvqcwTM~Fnm*4UVzBV|KY)b6VOT4NcH-&Y|6cN;8VD0Y6asQZ+)mn;eMUbE)p8xzFO0B(HK`Z|hOOk_QPJ*O@k2AR{{bO;zD@kPr&#y^s6 zshs$S;07a8MAiq0EGeUewxpQj*t!pMCa7AO+K<`*(edRykP3NEs|7smVvbol*_5 zu|IfZIN;;Vd_mMX7o0#1Ll1Dd6Tc9ASd=~y%Aa)ei2?>pN_QC%wJ&=jrc4?La)1>f zI$se9r>@me{&L(=DkM9BzsX{@sC8a7Uw@;xhHSPI%W*$Tg6h=M5r|n=$F3W1iVA%@ z5Q_mN7mel+Dzq^smdWH|%6b@{$M$_`&dimYdWN9qPDuPz;L4`{Rp9*bki0(?IE3^U zBnP>n9my2-EW>a`Y(O;z$B)bz;o*&}LW1rxNC}|Rq2<`i29!h^yQu)7S>;AEzxPiEU<#zN)=W&Mg8C!v&6u#2 z01C!(>{njhnIm+mEe%&(=BIWwT2Z%n6a+tPbsa>~=zzCE`>!Idg(ra>@Io476j=}HnBj$0f6x-LkFP% zqh#* z3xHOkYvWGJ^;l;(&k?BJzab`!CCa_{SA5Y0+mXZZNRpuZE*gp;xkB^t)%J#$C0{j- zdT2LLgxr;Ssw8asG3RfE+WyRILiOKBM*S{uC+ZqV;|WtgN8`Wh*Mzh?Jq89*nsz}Z z*^*|VjAC-?)L=(3`t%pW@1axZtaNeyx+TRA%J+H(U(D76(nwKLfZhNVrKs@%U_T>~ z|4AX82q!qBVcGYH0{Pe13$+qz z3f!E<2R2XZ7yvXSaK$e&^ck1s&Q) zt7+*r-cm9itnRE@Ypucjc&}NlK|=h~LSYdQsrq8rn=vv6CBtAP0AKrP&yBv!C~sH+ zRSadaro~VZITH7<$*M4E8WKW{gtmkyf-Ln3s|$(EKXM?>ryR)hAqPJHD+kg}wO4e@ zR?4ZbHY`#67PgHfsvwLlut8dun_C|ASnh7~<3I8HYTbV4JDP$qCd|}0{#3PW?7m1S zqL=vtpbIz}!{Crpbg|HB}uO1$uIW+w(UF=^2b{Nv`TpQf`#Jf4+cv%~*?S%kJB# zN@f4UTC$6>qj$7lQ%io%%qUQ_dD{w@33F0f;g@Ap6;6|QQfK8OWH$Nq1*2bAb^~O} zity&JeiNV;x0bChuFD>OeAVqO(nkE%Bz^vu$?kj5vk9g}W zvLPYVkcyXx!e|W4ZrRMa;lTRpi|}ACHK%=&M}N$FX#k>colHFyke7NLdty3wFu|~; z78tgy5-S12mW`_gM%>(%NAN&lUDG53$EY(v;90J3Z z95tohDQn0_6dbW_AB%>*PIdg8`aiJcn%2vG(@%c~`gtx5*5w9c7j7N;(+Dm3E?6q% z7Amzb#@wcDIHw3D4enoxpw8rE1d(9;OhR&_)#Cwji?Tp9xg88eqp(R>T4(;xXkroO zudcumuqzOz=RdAMfh>grR?90ub>(j7ctOPDWrQm;fAqTr0$uS2Hl?E?lV$236QF6q zy}kG+fuX8q%=k~d*w#A-yT!Km@+pUAj^7$}JYgxF= zJ=a(WoZn_mv5wV*hhHWGD(w;g41#m>x2x_C-z^p@#zO^BeFiD-r`lhhBF98xhH_#b zr)ZQ1EsQ(HS^{H;6Yv-3KFP-cNcFcZfij=&^AER>ds)Hd!FHU13ajk_7fABZ=j3{_ ztZuK>?PzGWh*s9mQoSoO*RK7QYnXh)v#7D!S(b|*((yi3_3MN0v&+6VVFPP&S&Ej+ zUj&?bbQ249c65C;QH-)V~O2p!{aCIg#*J=M;iBQuQ*Mq8EG{m$&9pjh_F(Liqm z`6!f`Y+1$d29WA0OaX7ze#@2(WxC3?jd<>qFRf3JkF1-fo-;lQfYl-~7bm||DA1Dw z;ncojqoR%&9N1aZjb1S|`jj0U4*ouPl?4L)YnWGH+EN`VqQdkG*-zsO z{SPZ1-L?cwyPudLwX2zx~hNZcywPt|MN8JBX_>h69^xk z&@QE*BcK<^9d?k(Ia0fC22Va&ruoW`>r;%<)pGcXOH@-N5ex3dNq*426?Lh5cIHW8 z3h-{gNR?H+p|q2djCY+j`!(a8bjknn4kf$!rs-#@M&r$_EaX9RQYQ_!w-;tUG#Iu-b{;>v z_4^B3TBkM}_Rj=+G2ly*W4Z4Z7+s)M5lz-lNhW7ly-A zSKireCuwPTdk1w&WJ|{C{CfXbihfNnO?nY=z4hSPUjt9Kv6M z^I3}-*cM75lV=#8?609%v_3t&ssi0#fy*Z?sv}X{w$B&B(!V~n&()m$7=5%+Jxcr& zD?asMQV?im=C~gq`mqhan%F3B{wSN?%5eG*YdOQz{b8JVu#IQFFZM7P-WH|+C3&g) zyIBP-gx_wYu5ntbWT4U{sdsf&qB8MeI|zChNm%^EDzVEpfbOiVDAsf1_zvMjwQU_V zb!dnLmz)me4ue`mGSm{&(ePas8`23e9~P6DWRl`;!C#| zbr1c5H^le6fefh0RNUwFYddS4A6Inw9ulMH?S1=?FR(MfL%H<31u?~;kj+=Nn{CM{ zAJq%pax;5 zc_9r7sK;TPz#EST0I`J9Q3FDRU!F@5R90$aMMTH1$Ul6^(b?J3xsvPo78rFzifsGm zhQBoM&Amva@B=|+-v|i$=IPk8xcS<7_;ibie*3xNKG#O)ft>C(`oeFhSg|4V6rxuv zD{Qrc@@x8=^0^PjIqk=*>Cct=-VO`e^?o+Zi_ei2bz*XgKQocxtmA>3VcONYrQ@UU zGffh<$tH~2lru7UjOfP0U@%NMx*&8zJ_Cj+vqW+ijY(C!Fn&~Sd81hs3&i%HPr@pw zTD>X)o9dcg6@i9q?!$iar(i`OL+h#ypT6(jJ8gK{Ajj;z>I?ren55;2>8{VTu(tULZCVA;{ zfgOVK`j>8rB1Wo}rDnhCQkD0@=r_N?#Y%YX$I$gGxDJ(&q~h?V85T?N^4u62ZnRn6J6X-1eU)GG85n0NTTI-bIs#I3Vw2;xpO) zeW%zf(g@zW#87B;zp0?dq&*e8-F_-J$32fNT}RK$j4vqd}4!2Z`E$n)1B z*tF~peRj0Mj_I>RA+an7{F*|KFi8*n?MK5T&FX(5Efl7vw*X@^3mos_4Cy(PT&Z88}kV7t>Mq zJZYFmdwW2=T#gMnlJu^=3!#?-|E@@K4wH^)T64m9 z9JbZLHU)|OYTrd$W7PK3?PUAP4`c+;AwFtKH;5V8VqIvnZ#(l;sUToh_;l(8q6<{+ z3MPG#^x0tx!4#*+E5)fHOC4-0c)SrdU5<$`uh@=%s5{r%EzGk-bd611jrYFpG^Jv? z1A z{BlY0X?7%t*-GXM$7WmmqsqLylr_iITr}z? zCLuz=Csq92sP1JT3b!uhwcJ|HXnK3x^u*`TT__>3)>(&h)#PvvdymeIgKYFOhrn}f z^_&qQh%0}hzP?Kkqx%lVO#0ng-#KOMG}|zX)yIr6J`Af=6I6RTT6Q~3z(Kp_ZVAe7 zM{_eTyh$=YC3PEeclZVkmRTVq@Z#ZE#@@cmj3~Rhx6;J<3u)V$!L#$u^?JQiUp>K7 zm4nMM!u8v_uRaCs=N$513QCsXl$gQkR?O=H!S_KIZGLE-Mc1vg=2r9!mZUc?e*O>k zL8$F=P_c_okZY2IUJ9p?nAPgYx^P{6>=H*}dMM+JZ`Zd1M?f75)L1~2Bm671i8=g2 zgTfeTj#I%xP^Ka^I*^kHSIFT#3=i{5;o`RAVXCu_IVBLDhKW*y(?c^IW&K4K$W(4CZGi}eHgze6 z6*h_cdv(BqLD=Nh-p0ViKmpEI!5{%IZ+;3)M}$iD!ajz`!MjZVv-JBdE5j6eM3hDR zCUlzN!&=M;vVJKcd$3-R8b1#ZHWZ%8%qjwE%qO1lI1vf-Y`krQLq4TzPW3Ez%tkap z*+UJVf|*U+8+Hr2SwedrykBPZ;B4ALwrmz_j!gvmc-DK) z+e1IZ4rofd-YU$^WVFV_GcX)_wN-i#@^%+hz;rELnk8th=PrhN*iTGTPn!?h2 zDcu0qYJVFfgWL-BUu(5Q$j({2M}~&rTCH8;6u4HK9GpM4ZF!L$?UttHldY-eZ*J`4 zHQzD6sa2BQ`5LQDKX~VkAGP|s=4*QNI!2G~$NuU{J)5&_FtG{zm}a#OAwb{2JK76t z$!=EfQW9{N^Y^^2KCUX@xjPvot)^4e*2;Z+H%Kn+6T8ojqs^*UX`hx~hQA@rPad>I z!|2V=@H1KELbX*BmwHVtxatvUL}&yZ)8%FPs}e>Hgf@ThY*yhA7q(1D`mec8k8KXgOSZm z&n0{)5Bu><7LAx9%IhzZim%9K5>0~Yycr@j&}B&IU9u-0LGoJ!Kz1>ZodVEzySCqsth`IC>L^;gqS zOK}$o(Rtwx&+peQG%xk$3s`2%6)4CoMB;a2=dyh?0R3>m^0(~`0^5~YcMRpXR-?I% zLji?bZWI&VwdpoCYF0~Sd~{b#rAsuWOWhSEribY zJ}k~!PtD9u@1!6_*>RsKvQ+;rojIQ2PbDeaDtApPZ&^&IU}bCEW)8bqvw9oY%pjXa z)tk^?@Yq*3pi@WFyMZevlFBWz34$P{!qD5>xF=~z5`y4d>c~rl#UjgP8-MZ6V#P=5 z&_R2F(Dxx<{NV!$^AHcG{p=XL_KmB5na5&mmuxRGIXv96%jjeL(2UnIleZ(ojfM26 zpormk#(fJBu)wxcMqCThXQ9IbU>9WvOcya&8VesELo6PUi4*ciWg`Pq_UpR?=W5CJ zq4ib{gFo!N_JIkgYnwTiRl4RLf7-g1?{sDhPL6A=a>5nm>=b{OZ2XB#$myr2i^J*2 zyD3$kiyyt14?ueP#b-IbbsUP}wOsFR(XBe*+MVecL-qbY_y)&>|0)3ob8`+0lf`#x$nRJ9Wia-V zHk^33Ns7Id4Wh^2xSbCyJ!hKHjI(C4>-_k?(}T z9X2|A`7;ASu5~&QlQfE4XUF*K&-Rd}fxn+8Ytsk{-s;ZkL&OYKjhvi5CRJwelT1uqSb0DM zJ?Pe#v^S2xJ3B_M)F$7=YGynml8X;hb22Ub(hr2jK}SVE9zieW0Dbflb!w2t@J4zv zO2G4)Bsy^L{XKX~&p}5)Wg0Z*7%D_NW3{)GO7Wigz23%6TG{?Ju{5_39g$RtB@ILJVpdH`U?o(Qa?NOZm z_T_A9VDL*#IaGl`Lm1?>^i`4}NRg9{2_|?h;OpQy2tA0JmQGmOXU^vG^jm?*mnbPF zzC zBQtrvR-yIM+q8HOF=EfeQFPrKtGnm7P&C01*sKYF{+t@#39aq44lh~H0U@;qBcQfq zaQ+$i+kYnb+kc+JeMzdTcVrf=IK@$BN~0l;bvY;vIdGHrnwi;=x#wny{MLE$2|M-z z=Ce|&F!aR$;C8jiq~}2d?mu^5HGMW!Hz0;=lBxRPabe=UHc*d<7mlc|@}fVlA@jKk z{Hs|!%RqsH6+t<~9IR_Oatg@>42p_ALC-BlM)Ql7XH=SkI~#_2zA_-QWWPR@50Mq6H569(2f)U^fWj z0~HxyS}OYcOWGw|ba0eH~G`^S#cfG_^N+G>=) z^*M|FKW$}WcYYs@+~Q(4N~Ov=Vz>PbdgE$_+(2C z(~oU2h0+oEXK@y*_-geOe_k6jl17ICL`Qm%0F3K4jT@?*zl@e4jQ!s(US?OJ4aGD=-@VzKYH^aSL9)Z3hRy@?puHhaDh5xihnr*Z0vc^|MsRfO% zCt^}wcYnY==()NkO^R3o)xAN`x)#Y2@HYr;ANiRrOcfl2c24*F)#d_@Ylt-iA3ezR z$I6u&IZdq8#-lH*z(MGmoDZuBN@XMK_TV5ijTCtvR-s1mU$f@aq&`9ro}7weks3H2 zwpThcQ1DAyB$JNpv0nSN2Tk@*51PYv_8Y&&&1OZcJ8q#CBF!@J8iXbS2cfZwSFsE! zHbrI(1Q5bP)sE@>3c#m1i$|(+Txea_AGjJKV>Gh+Hg}Grxdz$0Ol_pBxpvu^{4~u{ zxJz>U@VL7oi>aiXmoskok>}ev611C(&GUP~!RQ(HUlgm-cc_DPUWp0ji_|^})>Vwd zhQg2Yx%}*JSKyS=gjIJ(IAxSUo{ZwsiCWMZWvojHNbf5#FxMjFx1q15#lvMRpMNPEKxrtZG*C z7@`IwQ`Epz%daHX$ z#o$CWq)D65UJD_Y9?lvRuff)qs=>Q(gTq#CRx65L#|Lns+Hc{=;S4-KCL!_D(oRx+ zb~V$j>fDp-jzBT;+O@BYSq!O7v64j&)6l_~ALiUY=tgi;MyG6{Wk_7$DTB9SC30$| zXKbbflJWx9YZh_SUl~Zp#KvU|2W9WCt+!pp>kHbndT*c@`!uNjz$UAQMKfB!5rRmm$YB6v>3Ih{4~wl?VWX>u zM}eI0C^+RixjQkQ7eXhC`(u(v#RLTz1=hRNC$f>#+B0Sy+t+Ji}{6Fhz4Y2p9d>iN8mDnC)Z zveo_dvPlqZ^_=)?^^62tJ(0myPrhww*S}UzizIs;&adu*rmt2{UUMI?)pLX!vUxz#4E#5Q^ZycX{+Dq6mvH`HY{+Dq6 zmvH`HY{+Dq6mvH`m0yY!jK|F4w+GH zRyi5_7ky`@<0^l6F<7*DxxDuR0FCA1{cIE$14!z+6 zvio~0(RuEH_6Q^|4hV`144CuS3C09{nW0VVNG$l(uUTeHs?4mHX9+(B!Ho%FJtS14lcbxDZdPG zyT~_=DSY_N<{csl&28ZNN|ZT|N=Kr9>TH%jL^Ny3=|{CYd>^CcwC~So_){i3b#cMe zRt(E}m?C9B%!6dnO!e|W#KyC7xbzb#or{pJ*S!Ll5%|=?*vv;Y;zYbuzH8qEb5JGn zA=^wZLac?McxR{BN)>v}z0NUYo3X-CP;dQh9;9s4o?*r~g*7ba4LnV1+ie|r5RO}XxcomkbncYw=*`fj zcs2msL+4yQE5y`UJ9|%{(7)<0<&S&L*0L{D(9UTWhmW5@-rfFZJfLCin5(>O-13-s z_H?4Zsh~Z7uJ@U@JM2=oILjh5HzkB>J_DRXCwR@F7lCu=Dc~GBy$^d`uH|7|$X2Zf z*eAOuBi2aVVg8uH3HHgVd^){)^~nMm4w3grI1zL~zvkHbQ5P!j%1e)%C$ULK&+j?Y zTW>{0ieQw(jrX%J;@vg>KGXG_i2=Cs;z;lAy!DM39V( ztxfRYy4S)^Gx6=`kH$uQr6c0$BeWtCmc6E;W`H%EKY?21vwRFxEVqKXk*F!4x?P_) z?oRi#q9L)0zbxjUd7BcCpU|OTdAIo481338y{H%l`nAfY-iTbf^jzx-slT95yzFz3A9%Gg_#13Z99h{D42=?CS?(I8A8&Z|+*1jacrU{Dd|a zm7X1EGWli6?Kp7OI>)I`G53CB4Q93i8zH*wnSNeeHcN3cyugRY`D((rwdc#?rp&sW z)$#6%jC#bS6Gqe#+scJel_k3l4^INp77Lhz&n&SKUzdU+>Wp%kQY;av?|XwIu$vH( zO^6SbkCdY7HkB4IT6B_*{=YGF^w9@gG|-d5RBs;tMTJzYa-;x)qJ`|mWz+C34d9WT zM&qfx&768hV|QKN!NaHn_w!k+{+)%G5ADOM5sAQ06zYdA%%+^WF!=!k)wlQKSoK|; z91(9b^2ILAMQE}F=K&VP6awGRt5eh=3vbl__^A_}^{!lCt>*c5vlK40lW16F@xk0B5PlppGASTcyY139Dp)x$s$7;T)V$FOg# zgwm&-?tM30s&dk|@!O;(Bi z0oeyqKS?F3Mu)2QlOp*bahAjg=YO5J=|DnU0!Dt7)jr2k#j<_lB7kIV zw`le`wTki375U_=Np|ZyN=oizwj#&8o1Gi1Aqru;$zclcko=pg+*I4U6>O5doy05u zYm)trG;*GN`5%)k?Kf)rSuVH0Mh@~H>xP+H^i%PMO$Jx|MOG5HigweQbD>`#c}YCM zq%+&-dJF!rGs>UNuQwss&%e2mY^6Mv= z9k+i}v)B26{FvqiW+y-TrB=Il%Z!_1RF6LglmAMAl*Ey=DR)(hhUL^}uUSsZ#TKg) zbN6wNWDd7H+;^E@+<0Rp+MrX>A3)YJV6Mq7arY8znjKQD)HW;cW6FwlNK4rxUvq6d zLin@P{E7CuPA0VB|8&xkIv?JLe&V$%Dq|0gW8#`Ubs{NaIu@v0H6LP$3HfCGZ5Da= z#&Vc}!{J^ycL`*yvJpL%VKJ+}$^%VNm_IyE*I39ce%IzqXTvXwX1R~0EQ{PyXVCLY zN37<~JPazf6U3@bhYbk78TXMDiy?^~a~d@_IZyrJSTVh$*wLrQp%G$nKplqE=Epvc zpsg?Ng+`c$w_}~m!^#6k>js0KlNE$MQassK%DBNqM-5qea7P}9=hq)&MX@7k_H4he zQ=K}&&9P`My) zkvbJb{OxtMEu}*6{v?nkk22aAPhzo|pCuAuy9npXfs<}=YRVx=d`=QSdc1j?_k7iL z9AK2tt?VU6f`9lZJGR#1iJW*6Xi$)2Ne3r>7v9!**WbmvHqm#R{BR$IeY2c@OyLrW zdmlHOOfh{PMGl0LtS-0a^%ak>NTEsuI`StPo-1d+TP@xY#q2FpdjoO;Y!S|>MRu6H zuIRpFmW2FzbIpKBIl}&Gmlf1~ce?h{iupSX97<<~zNN$cef1EQMZ>@ty+GxKREi(} zdyMd@s~+>lJ*|g_=&rGzsCR=(sxRwv%TL{XIgjkd-<%KMe-JZG&W^|kFSo?)__^SW zJe++8npKG~nHRW7S;JWL2}iqp`r}4~)-x0!%KUy8zJ!2AQOSt_f+jO$rLh+Wf6q*n z_M!v@m<7*eu$Wf=ub7r=zP{Wi%+J0~;E+ksoa2k_I-6mU7i|7iERN^H;`v#6morQp zt$}jXgSk*3HA7>wuK)SufqQbWGe_9YRA z&6Z8*vv0lrhu+f_w+ENiQ01`DwqQG!eYdquluIgGX2K3L37*ro)~yeiP&V)L92`Qt zs6#K1`lE5%;p;yZ-FX}-mcvN_5D{;%qp9lCw zEnN+gl&EMvuB3Hewxk?oHRWm$43^ZRu_lfGvw;Qbp~0v~PNEvIA)k6}`Sd z?f5;A2dN+Vs18qRXpM^=zdSr%uRwv&{HU;ixKE*r!41UOAE3I1Ak%kPqdQb1j_m37 z`*Br?XaAAT;;f?!2GVrVrMxH;>tK$&N@vee^}*8FDzJ2xB1Lr%ES+r~MIR$x+XH#T zJ)Z6|pR5U(H=w(>o8>}2BzPeoA{KbP9LJLoiww;8^s!W6Yt}!!tix`wu7`3(unUiG zGeX80aNt2&@w0k^(<%0P&&suZOColI(G5{wC057#@@eaqzP39Ex#>pFY3tgqfQ)tN z==fq>AZsB#EMbU{GPoVV@pGgAj2zMG85;jtJi(_wJXb?gZLFHu#5G*5R7xoeHgxC` zU!uI1P0HOt-Qd6DIR0Qe{_Bbz0lQ+6x`t`SU8CrUWI#$q)Hp!%<=5ZB=8=k7%EHej z5g#Rm@W2ssAIwLDz{^m5_xGLdVda$=yo*N1maaoY@T~Qkc(QH~f+4||T zn<~R037O%Piiv^??@=5LrVQC)WjU=7`=B_eJe1f6%2{cCoan;-VodD)w)xGM+-|5) zP#`B@PThF@h-?Pft!ea%unkO0Pwd0~aTfz?JqW4Aa(91_P*7}>){0}L%QU*dF?s{f zzbwNVN$(YJhyNkhZ`6T*R%>Ucs9EcG3Hr1q>>|r~(i$IwEpUC9(TA)=`l0WF-M6!q zk>xbrmm4)0t#Hcfa`nczNs-2O znK9*T=XsZ~DztrvF})*5%XwSctrf-ooV6U#W*>aM!-Z)x$*xq^%0Fe_pjr!Y_1+?S z4~wNX{@}tAslO(N6SPzLAIYof99Z%S%tO9suTIdjG)k09Z_!#QoZU(3Kda+{J6_Hf zGW>zBE_+B8k>=b2$3?G9nO8Z0t?>N0op-etMvccSb=ysi5rR!IP!vjnSrkdU!t(MB z$ndf_jOU93k0o!Tv?kBx7vN)PVA0!Lkq&@xyCu4SXrCO4r1RHK5~Zjt@2HZ1{^}Q$ z7F-g(4RVX-YT73@Z9ej|N0H=Xy!e)W(FdOn`y{D#Ua{6r>wS zMG7o%eSI=t(B|qQOR51+0)$dJ7xw~`^+EgHy%MNzG2aQnG#gs<%e;T8lqzu{Q@o}3 z7E9@*H{!idGv#?>Sa+-NBMNKqOK);f+8I;Xf*Ucc22k^E+jw9s=YUB~UHTB0(f+sI zkqy@3v(@)GU5R<6^;x}E?+a5-{H&?y^aJ4b=R#S7JEmucTBBjEzGX^x^6V4&)u#XY zDA4W+hJ=lG=8OcVi%!~#G%AL6`Rq4+oz6FxU$l6z+JBv9;u%;@WYN0sMnJRS(>!xU z*Qa&D72M~Gkv{Jv;z`H5e)1-lgLY+H!fS5fBGX~3;iGg!o!`3Z9xL8$tW-2CP6edJ zNBzksh$_Txempm!dg(#?J9!Kni(F{yolSj{asfdo4;@J7URm?Z&E`+m>AI-x>*~}i z>(qxCYU|5a0zDg=`nq|}nC%O=$BC^AQtwgP$q8SuMC!1Ip-lu7bSJ7|f6(8o5Ifwm zP1revw>nzeeE}Y#wRjuYqz5FwkcC2Le~VBTF*fG`v3$e51DUVG|o*#h96`txf~UC3H!p!Ke2 zAQ`UkwWscoQi%}~C?YB|Me2zH@?fDOMw>=#Xj*`+9tE{wKl3P9dsu+t6X}EjlR2C5 zii_i2MZ3##1Be%s3Q81_RNFw+eu}uO&q)V2BQ?;s4}&qArESiL48FmXWHt)@@{zHq zl$_cn;ydSsLIp4H5()6XI*OG-RAEB!biG4Xm|`wYgyF|`rLIH&E%%eHG~_)R-b}w{ zJEegU3>O9kPcXg?xiAhFCT-v!UjBCFAehb*!gX!NKlBaC*srk ztW9p}nfBsI5PtabvB_e?w#P3Ace1iyhi+uI@^wvAM^MLz6N=FGt`kS4pPq!~FzI`# zXA|fP8r&EN0U}8K}b~bR9_ICly){M56t!W>vPQvXNoC!Y6FI(I< z-HuTG>`d{a{#it&J1VCLBX_{{5otMm){^~{AwAmIDUk4&=hCFhN_i=044DF)P@DLv zAn6;(txin8mM*GrefhgcoA0d=7M?Hnj{waLpBFATpWg5X)mx$M1)NW`WjOZ+Dt}r% zt-I9ye{sr4Zv7@df?t8@ecSo;-G+-t0lKcV`7M4D;5{U`=B_#WnNTYvJayIB5lOc~ zfQzX{2c{qYQ@c3DB!x{YH!}tKF>rQ6-ad6axqY?t$1Ah(%PAU!ye@$Pe{UhQM=r+8 zYjR$?HDoI1WYHlamoSbiZj4eOM&vJQ9&a)?;&?l@-J8N$PZeQOS{N@)LVOFeY zfiKNby@kpW2xLCinqZmYz5|~`Irn=-C^^_g?7S7)L|R+4+B-x026>>j=EV^n?QKnN zOsJ{4DZ`I2vp(i7H7f2J{>H3Lv_%C)bd?Jt7JJYz)+kM!CDzCg+26_|n{$a~uQgaA zJm5LNM$Tj&qp1~dsm0AV_W??$+8t@vl)^a%l;fhg^0|Xp#Ux#Ax?NIa~Ff^IZ z?nI+WcrHZ=l62V&2w;K7d5ZJ7(Dojz#jR$;9x`Nj-!J->vg9Y{x8aa~58Oi$ zl;GEBGOLx$c*{rmB#EvWw2H9!g0tSrsr@E8AIIbLPy`n;DgH9BsD1RSjM_N@F4>V! zK#-1!X5(AhXB!f7Hv_C+WdQ2chd7`Gy{#qzCC-A|{vz3-K zteE1}#Id}}_n6A}nU)goK~5yedckm5vrbf%vA_H|UE2!;7$o!;Ad*h2r? zfv;k0n7ccmaZWl*fa?zjjUZE%O{(|aRj`pVa!9@)rb~xpWpkrk-`!tD%$ITpkS;(4X=Owr2)AhjqOGgLRh7kDSVaggdhz z5a$k(&x=dO;x6qBF!_Slh8PKVkl-@d{SdYjU-tJ0bQ_NOfy~vRFt9$Sub@Q`#x>4F z^<=x}vMtd8haDBCAp5zwvM3hL)KvAPpWHA(acz=Y53(F(SC5EQWE+XN>HV{zQAzFx z!jmv{^;$dJ2PVazHw`D*aM^g`u6^n&wH3nOznXJi>@_vp$JLMe+~+h2P_gpa8#iD> zKt(Toy}_c#ez#$TJ<3cuiHPvv6$&biq#}du(+TWYTZjW`rqNLW-&=5=rZ)|n5`10= zFt;GKn7EqY-u*D}%e9)DJXGGe3P;U>WI7XrnZ?H}f`4Mrqw>#Z5hL=H&{Y`;PSHsR zJ%+q0gBH#|TfZx%QGPCuuc{#aB{y&uOiak$vg=UHev}4N5QvL)BK)k=HRs%yXBpmE zSJuNzlT|=a4=WD3OQRzJh>aio6f(JE%%o8NGqVYwa%VXguV zLbWfGqvpKku=*v#YRkE0HGT$(>AM z=`Itl^Mj)+kzB!qH$~2S$1=ageHQMwGrLI}?EX@7EZLN)pW$rvYcf9@Z_gAq?6Z|b zbqiI-$Mo(MOI`75m{1&Fv(wbRhnA;Leke&)jEM0UR2RQ> zs5rM!7nWEIrb{iIG@mc!a~nM#FeEx+RVu?)YN&P+JQWb^dZyQCWoVP`2Z~$WF+sl8 zbTlA`Epl8?vo#$u^-;J?OUyahSGx;ps*xJS>y&Ae4=L@ww^dSZW>8HT+vV(72bT*8 zvX?qY%arx9^UkppU1sLfME{VE|0N{uiAmY!Pf^&+ zLvsvu-`QR%xcx~>=#THdWKDc}&6g6Nx;yR27#Vx7j)|F5dM0b5)9cFWoup3;gih7$ zMGNrQaq)s7-KdOfWHJexrFDPvlIxyKfvp)Yj=N+r7AB69lZe;kCwr#b`^&PPJ1a;!oA6NOY+6xro zelOr;(2P~s9FL0u>)J8zXDehu z3a5cX$K1rU-Qb85;u212B~IneYH-_5Uj*@=3IG6h6a~*_JSJhUg*`@J0~^{@ zDtH_uLV`{1w9(&QKw?P)1<;TT5M904DMn`UApHpNry~hbbmbcR@#tWgU&sENBXSr)VjxO?LsxX7P8#J@9{l`u#Y;rJT_0X~#zkVa zCDU(}qsjM&-@S%T^i=$pg%&e8^rvpJX3v z;h5e0jh@o?qx374mb6Eny~Uc4_)f#umTKr}cH}Vb>A}~$?OsNDV~`s*gIGp&=e{A} zhTH?3P_Q!Vm%(`-(7in!Cm^#sR&|KWmCM27A3T`o9acnKv!{`+RQq=+R&whnxKF|C zDGx0BVCyMRVn4$H7luY6$JPq3)i7zggiaAjnYmH;!>5Ww7N+|pzr2U1)~2~{)dasT zCG>=}U>*9V>?|A&HQ^*!cw&>aTGHTj$p>jhBbvUC80K8{L=WKHK>bKvge-aa_MtTJ z=3U&{BV6UtnJ-I!#)bJ=6qSNFozZpIL0v<38-kB&D@VO+V6kgvCiB!(T*Q(7r`Xfw zUSj%gDvH_MwUL*G6Wc{Y{`-X1!JpX&ln4TwALzQ?~sGY7vUNt%yWlB|7#{H3?& zC~7R&vfx3EBHv-NLcw|2d#(t{@3hPIT@VjCAR_iM91BBi@Ry3tp8U3ksR*@T(zAO& z^F9PJ(bYSD*7Nn#LsDQrMN6iRs5&|0`>#IBioPC-7@Ww%0Q*c0X~ERi_S-vQP?QrL zGluOZRm`d6(ou;*BA1l{g|oud324}fjuwa`t)1LFS7z+=SIawz!zs%!dQ5^F)}*P0^mB+b>w}99tn) znJ6KYfvkzhc{%tIJ2Wt#?QO&-vGKX?_Y}u6Up<;Lp+-MaT8WZ>au@F|5XfzWdry$G zIC!`b$}uU{b#9vaTdn?EnYT&R4*Ki>=tC?uk=Ycoy5YAbA-({m6p$f5au5CwRU+g> z@J;Id?$1RsDF9{=hOhq$0u?eSN0Q)KI0muuo7y)TRL=@iF7=L0iD6>u?XKH*IKFTb z3?KjGm|Oo)iDY#6alAqlk6RuNV}$Xin$Qm<>O#i>Y_vRV`} zoka_)5TqMPY&r5z6m_KxMR^PBfr~0 zNuDUuW^wkxg1O|Up^J;)BYcx+E=Z0G&5RMnXeBm30oTHBc+P(d)Uag^_!^r%DoN*n zKxD3TxImcy8yd!Jfhh>5UQHPLEx->Lp(@6(D*_R1@DT=FxA2GAZ8uh0hnah&SFPkHJx;h;&83fdNLvorYe>Mw46bK^+ZunR+aI_IjZP&gc8%xwc=k`eP1QUIgLUU~0)J<3Q6^a& z#l1dl%W7D$gr=fWl#gU$bxV(^r6(zmoZ z<2De~5m}eEhN|>dmP1a9EHc2ML-7UnIk&?Q(OBq#ea0SmBA@ar^GU?1*a;Ok5+h7T zA1D$Dub#yyW!1pRSNTCNmp@-39DmlBKWG5V@AicjcGx^X5<3yPc zO<>~lmcG(@ofM)TnJ^xbqVosITd_!-3pq$M2A*Sh5K~6sZ!WRI^ah;R2Qd{p6eNs? zPTW|oF@3;br0hQ(Yx&KG%wVt@oVbBl1c#33gu9!2UN@Ri9^iaZHH+St21Y470r!_f zMkzFZJ%(Kij<{ym;VR+@w(dh^3sB8VmLE^;7NGhS1*p1WN#g=WSBnhQgeh)eXkTv_ z+P9K@dFpn(0Vcj@!$O>bBmTCgAo3K~HT=JDBP=j&uO5hXoB9J^A~!np0OrOUB;C&YE2eqIMkxg16!4gFDn z;~<9aP;m$|579+13x{dyI=To&p8XbKL=N!K4=aN8V!B)^VJ&ds0(J@(DqpAk;o^0Q zuzymH$%2M#x!(ewv$ zF-Ion{trB^;&s*PZ453vR>MU7h)Botm@~B<`seFFgLH~s4<^hNchBHP!Ud#X6QKgr z4>eqXnsHgT2Mu@SNga1$G~+$g>GC(1Tu3P|f9X{@)>?q>85Tm+%@(cC;9>jpvR70`FgkoD}H_>8aYHV4F=(HRSR$yO*^d2m$#Anv&4v3 zz$Jk4q=;pY+Kw-->w$a=ud@t}>5(7>z504~^0iFl3#{Xd4C67u3^R~n zP($o3;@oR>0e^^Ue{8C*Ci^GozqZNuUF+?gCI5rCgVcJKsq+_ipDnl2lGiOQ`32k_ zBWk{{mYhG(?QvN_OqJ|e^Fo^!?^V2bf4`WQ>d~0&Xi&%Zc`fQgJBtY4h-{j6qWAiq zn^1kI>O6httVVqI_U?lrWN}njdtc=2bO$n4m3f{-t__PqzrDNbxC!VM#Fm@>9Z#S7 z`{AuvQ%p8SvmNWsGlfCJ_^xXEt(Lu{MGliElKU5tN+pVwZ@M)5y=#~9|JUmhQ?#W# zd#-k0wixkUCA)Va<}J+{=-=`~^|JVDK^K3hB$5{pOsTi93{OA|Q|hjUMfdUUrH<=r zMX|Y7^4F%7e0N$&bTEcPYuU7tO)L4TwUR$Nmr#5u77@Rgns*paQ6x_^v(l7ROCEBU zcYG-$fAzw(_Rnhk)=#+V2HQ!Qwe73hf4;iytJ}W%t?#RMVm>&m)kUIB_&wZn z^|s{!#Vs}FAmc){7xgzuQE(}*6YgVDg=r+e>R#|rr+DeQ?FL_bH~2il-YLvoyFs|H zcNZ-fQ7}!3x(UIkN|tUu4akqQ;zjC+4;@VJ91D8*5%cRWlCw%z<;g_ufvk$XAsPHl zCh96LTOFb3Zr?YM)Q%SzZfLfeJIl6kkGxeAFPbGet3XdrtJznVzI`bw3USb|THe`I z07*udf+-_9fA3yJwyJnD0)wmDk2}#E2K?!tgSwiao}=~4lUk%D(WRoW)|ga8yzu1# z6gE3qVk+sT2#V@RjKv`@jmcnAYg_ewOIVYlP#jk_8xmxIWF&xp?M;XXJv&XC)&zS0 z$b4u>(llB-V^66+@Jv2Q6+CtKjt3>|VTVJWni9+ofBK>?dFyz~A?dj9#QCP&&NiDD z#O4LDZR6jnr3*w@Z!G%ImC#9dt4*0r$ zZY;KUHOrPH_(%V7{}}P(#_*UNwvFM68-vd&awt-)0(K2!gH~Gp|rNZV7D=_m{WX~;Z#AKfusbF{-G?@Fe3F4KGcp41)#0o_jry@npS_7q&f6gbGzz(GkP~>z7BZ3mmV55`;nop6> z4T{bGXYb3J<2I6n|Ib8x9W#>UcZrg0?vgT1QXcQVAkaW{H-=~cMggSwu>bwbtOJds zZlEPfM#RL(?8?k4)RCE$l?OufKa_RJC7(#9(ChX8P~G|0=FO|kKbgi8SDElkiSly4 ze+CJhQwy4>xR_g4+wO}hyYYgmYWSATu*l}WwQ2jrEn%}qz3a@$!rKE8GD2;{?ZKhC zA1Ut$BS1sddquaZg4qKw&^ZeVLXH%Beog2*n)D&jwJ}o9SP$%ET-VS^usnHfCW09Z zY@a7`W@xO&{SM2b;4hulHDC-p8lNK+f0jK7DGUg!ko=q2kXIA%D(&aqWnZ8TxySaT zN%W^b|NOxApTgx(1^(rWBjg)D!f%`jYds_tu$M(c_BFHkTtQQjJWG4I1d z`87!$aV~(xkYBUL=W`g&bw;Td5|@QOC?f7YaHf5h{UXm`xB6gw_(GD_*v%k|e??|{ zpSWuT*ERV2mg;Om!;b8UE3S2#o||v+Sv`P3V&++~Up1WdmHh8_#awl>@5?r<*Kh7ZMyJ%~y$Np>}CE`jn>|H{=J(hKY-0*@e`4P|X^yyp;tw~rY zf#1PBJ#{49hqaLX)a6_K%#!Rdf6CSl)L53TJ{Mb$Zx}+`NaHAeZ-LWd`d2II0knlQ z^9heqb@6Qp1Ov5!@J9faoROs#)|jBQ;F{NwAv`Z+G?e&b2(0h8Cp9KyZ(fiehG>SN zK4AJwop@Bhs1zCY6}uYP{rawPZiPni_OOJHM%vchBfT>A#~MDQ7O8HYe;E>D5|&_g z&KR`TWCx!+QH=x)H@|MSW%{h`MZ%byx#hKUQy2iLS3$ZSfG~cFYhbcbUuAIhTbObr zm2Zmt4G)Pfg2dG^NE6wx`mQYQyVB&q&a&z-*}d4H-c-GoNV9d&`AB&xu>np$zyB)Q z`XOCoZzdlvC;Xiz2Qv9ye{9&bxv~SCCCU;KM%uyCcB^e`$|}l%spT4U%-YPg*_5z5 zgkn8*i>dxPfEMuQ|8f6Xf5s>!aJY`7--U8t(7lcdr~@}#l}uR47qfC;E33CswVolRI4 zZofBat15W)SL?yMnxJYYLMn@JswmD#PB9)p@VoWc>ALOe;-^?i>+b=Rp!Prj&T9Ah2O-7 zY8z&pvdhQlQaGJ1rgTyJKI?%xZlV*0eHv;4X9wM)B3J6d1A$LQKlaCfa){BY$uVs7 zF=+`YQl{%#e}VCqSz-uP2|Ao|SHZm%Bs}S_wSHL~$g!rVDd&$17&RRC)I6e2?rD#V zNiv?W)#uq2S8=x8P_>)I4L!~9`t1%ctLrH{>I^;X*?E1i{lNm!^ah*t4z<1p{D7|k z+gNfE)qVGJIXr{YhFXqAAV`_Fs^mDBc^;d{96V?de378*GJcNS(lL zfGu%TmwSA1cO1eE@;Cf)lK#5}#&QvZWB``>xyYIT8n+})Lr7e})VIfT;H$ztb=bi( zU?AYq|1IfCr~7Rn1)|&5VP)dDFAa=+2SggjE>)N=-}sgbblqNQK#&Vh54Ukl=?y2} zo8a9uZAZwF#Rxm^8fnbEIFRIl*ZdYI*^R^v0TRf-x@FWxP%G9xPVWzO*)%!%fO?l( zmlDNqplogfdK0U39e=^$Qn@=FaTqVYLYGYwB`XCV;ezx>mwgi@9e-7R9eBY1j`i8E zSROZ56qNhz{!q2e>6+n++gHrphx)FqY4a}5*^YA^W!c0`Pq>G*Rp+7CAaUi!1M4!) z4e;lcy~(Tf(R3bnQ>5c4z=(-UPyJxlTZe>W%}jtZ*SFp%m1{8SL7oyo0X? zj9)Nz%>GJniRajsUhh(D7gspVQv$LeT&ScbY1TyDdi6hM1heG|rw)p?b(Lf8i~wl( zm!*|TRp6(om$M#Kq>d;_OweW9_<#d(w(zc`t-!d4v$D6#9e;p(Ti%s4_h)t`ZH4Cf zPc{h}Y@;2s*gAqmlo^O!p(WQ-!FL=nDQhuirjTJqOki^=NR0@bz#YpXYsy+=qiTo^ zzN)iFEDDwuG%^YEF??TzoC3jhC`;UFa&RL__Awh79buX&4(ZZwbHE+OcOtHYg7UYl zGzLO!)rD4FXn!@guIAPs$lQ7XN>M{!QT?x*pBemX=QSPEg8EFo)u z9s77QG9`8yA6*hMnqXX0OPbO{T9Z;}l4F=Fr<(KQXn%t5O=V7-I#%gD9EB8vV6VVj zk83^|*EBKXL%!;A>l4KH_sWoOO--7(dDg_z67gc2n&5o|!!n$tP*xekWI~mSbh{$-YMe2+fd` zWyJ(Y0Dncj;xUMm=#@y6=8-brY#+d~I0>9tQbY-<8^Z?ZLxDWaVja1x0Ex#I0A?@F ziS~oB9rtX?H=hm)Wu-cA0yZI?*Y^Q?j8uDTInMQ})}-K%Ltb z(|-U1Uz5hWewGpZ&3j#(3Z_>vHU)j~oDb|(}#%{&4>%_Z<= zHi3Wsb1s2ba|yhjOW-GO0+%9iyw0b-X7wIm*Y=FF)FQ?09P#x`{B zHX4d8auCfzzQwDY*SEi|Dtb{KtDN|LHe&KrOWtVzo#i2DAv1({w{1~`;N7*`W7ha@ zhnjo>u@^MltL%}y2jRj9=xpd3-0NGGMS-LGbb5Wu%`+jGSHLqu@IDs@ex(jUeovC} zc+4nI%M?Q4mVhFE(*)tRd6Qko=sPbXA9>UzQVQ8=E(ERlKEjA|Q>W+tzI)BgO_;0$ zbk-15Ob+6O_v`zQcXl6s6LxsN!5@2_F;}p6AW|Nv`pHkvLF%?@0x%f^Km(EANLi2s z!@YhNfGOo(5VA0p<-`;Ff8O4H8c_&8C7h0w{+=Tdd>#{jyyET@%jQGjbCIIe6pYS?FF3i6F4Y@+ zC^j2<05U2aGp4=MS;Eo7C;c?`zz+|e@^0KA%N5gyIU60&=j?MppRvumu?K#5_$HU* z4nJNEs%{TC|IIGOe#{LMW!#hcC<2czsfdBpT^Jo-NO~_W|5a}B^-q~HBkUn%m(}Dc z&hzy(O*YUFnbO-k}^%LU| zM3J^|2ryA{ry!&33R8gUp|OydWYU;|9OEyS3%Dd58RvnT;)2z2zV5lCE~|>9H#}{t z!Fhawc@vjGxFi%yo7igweked)wNU#ghWyD|Vf(9R@7%X=14&z!m*E@AvaG0D<+(#Y z)N;2Ia-y?;ePhwLn2=M;(C^DZ(nUC$JSan*rlkxtvdgcRPU<8;f7P3xRn3aoWWP&; z%&J74S&4EpDDxQYDOH=fxP;|`b5qAnS!)I900@pBx9F*?$Vx!PM|DO5LKFl8vssU1Ym z4p^+nOpZCe-OnJE6E84gj7;zm7G3#K8HY-(N@5?GmZ9qf~s{TvHKu$%dsNV zs60g}0U?`H@e}@H8I6fZRcA$#RdGIth;9pbQqbfAR8Z&?jgG+S7q#l)OvrT_6qrn- zs%o;!zRaV6sRDvOzLL*~!NzBmBtS{nPi{NTe^>f9OJ34Q6ck&NM#tv+}GJrBI;))*1 z<{Y&7pPTbhrf^%2vLf1V#}<+$sLxx-hYW2^XW4>k(u-|DHTfmBpqlbBTTo4Vi7jZP zJbMcose3GBe?p^#J2v+82#oKEgh2rleu`2@wqdGhInSU1*<-sauu+@BA7GYFQbXEr z=6zMo9a5tvrVsNd@tmsRAIYqs>acMi3LXlEng)GXX2}PXx@8Mi=X|S@7&g;vPrkVUBj8K=wOY53|&hhnbT9VYcLd zSU~bCXgpSltK5{T*J<@EFLJJQviR8jR@EhY#BkmjPSk=wkxS^21u>XT_%O7un%)$2 z^+~;mf4JXICN%Q6Es{edRY1$JouG?XlL#w@*1H%k0-LOQ{8<(~=eFrnHPb+nlb@pC ziC0i}sQx;W@~{g0?CF@2{mNf)#!s^r&7DVhTwXVjTBmk1ZA~a`n_G6XEc$fAF<6(44`x{j?P|x`(Rr&~EXC9~0en zhRD-TEUsa2f1!($ZCw|@hbI2vex%Hl@g(GBoGxf>3GZ;3$ujofZHbxN*J9h%)YaG6 z4YO@F;a$(O;4Ibe*(RA?t%X!N%T%6iNg z8&eWYfYLnt1KQ>gDWmQ+H0bMyyYl-R{HCa0=DsOrH*yk2~*};+9WJPjY8`e}1!#xYO4pp|vv^zZ-=H-$O@JP;g#oD9)Hr=0)r?IJl11cEI&8n9^mgYcaqWS%snjd4FV)u zVnd!%bofw0bG0mVE`Hi#`cFT;p`hZ=h!sQ(MZmRWdKaeg6jgBz6Ad~OU5Ma9ywR_R zKo%L)$yvW7oMC!(6T&yWI+(*ge`j^%$$`TA@?@sr9WD7qoRhS5wh%?GK*P}K{7uAN zJ~|Ck?Jnw0E{yjZ2*UMa>qAPurzKte%o)-|PptQgE*LV9GV-C^$TgPg1Ec9qH(>a~ zo5}k3&|PkwHkzLPLh{b5gFtZ?(#JW!BV5?|^b#WLeCW>+b#wahlncRKe|ZYJ;C`0= zo^vu4Z5K;%6HX6AnJp$7Ji42|ptCyjTUw{C7LpyIeFch< zncaP*uL~D0fgOg(nZT~*h@6GG^yJn{^y(>ymgv&+E9;bEae)ljc+-$$)hw(e`p^$N z+yPyj@hid)u}3E%2iJrAf1JZQqnq<>-8qLcv>VT_aeqZiQy%dJ+Dx%4U0(t*+0&z= zUS$b@m0-$$P>=`5O2jTaaXP=j$G(PA%k>cZGsR<9+9@88}G6z@G9MElG z$Pnybx>R@lRABR_%cE2Ar!&uU?N??^$lz4)nCT4$*U;srQ_(|%e`SD-QT7XTB0RE| z>*KT{{2hPG^E+)$eV)HBmgku<2^SVHx3}J=qikC+Cp!M0o5i>CfZ5i@DU6H>)$ye@QiwLBVim>o@aY92-RV2n>?dF zI)n#hc0in{?f|^4Jsd5hzg&cA3Y{>#eL2{p-HwoS8z&DI49)_&3$8ASVFzgUW^A&? z@?q9{MO&p~KidCeDXVG4wEH!4_L@2SyUCpWtrBC~(pHC6e{l>;My<~`y_VB>QJJ81 zFJ=xYmn}8g9@`u?syO1)g%~#1WJhY5SXT>0ld>io8Edl3%ec`2spo10sn>@)$-^Ba zO+MBqP(xDR6Oh!v)EAyU94cL+TB1sU?1O%ZVp)RTNVNN}h|SVe0nmb;+`-fTU<_0m zC6848btEj3I+9hu@af-yD6l1377Gx?|BJXLwg5H0$rdKpsao^a1lw?jJxbMS?&$Op zBqvHt<9FJv^7S58HaSR_UI8gr0iBn&0Vya1ua?x$m*N2_H-BeTUwELPUZQcen9nR# z)HOz~IV2^@E|C>nMOM6x_s)g@}`|vCy!dFblq2uviEtlY|h4$n4ek#-Jr40+zX=$JC#c@eT+qa0{x zbLZKq)cutF%)V-{DF%~ln}g-{;!ceJzm?nj5^U79$wLUv+G7fGEe+lHQ)0XpgO!)M zldDRa0gl%xciyX}YF#RLZQU*vuw3zp6P^;-c1)f0dVg)I=@W?VVXy~b8;a&(@B!A1 zW@~Zyze{oW7yi!obszKA+VwB6cD?@5*H9e3SHJv@9ePdma>4Gp8soo^<`(V+=oS9% zxk2;9<9=$LHDFyfgjHRAyC>IKo@W$(FH(OxSHN_NjXmTR_&}h&YY2YB~c$B8)>S5iZbG66*n0B~p z1MxqCs3K_??){-Io5m0Qmc;1|${l0@Bt;VK{!q2ehc5{sDM?+X?ylY9tMiuJmv@I4 zHpeY2*DL}a>o&&yfQrR%oB5-2j`WUzJWp}&p?|yzrRA|2Y62dU@o&(XiT8Rk4dV$# zxVE4+g0akk{}?I|_&a^Q;TZ%cq7L=sJU(vIcvX}CCTg;a66~qvu6pSArH49Rm-M%x zZ{@w{rY3)E3+DZ=QIva-w?ykA(1ZH$g(Pi5(m%A%BbPu z2Y+?oiZq~_dm+&#E7*YElRSgn@{DQ>oF_;8widCk4!}~$aUvHF!$Rz= z+6ZjZJ&50@_<7YxR*huUNLG#H2hd19#edB&oT*)^AWuB6#_O9oya~m&?;A zCx2oG`+!MJ(yWPEc{cmfXauv3^H@YHj-g~ZtX_Ijs)Rcg1k;qD8bc+TsT;!?tCNj^ zwSGKfK=^N`@@Hc_P1=Jon5fdG5!MVkqYu$vEom`Mt>R9&lXcv&H@t}cmCJfp?2JVJ zDYwd1*wutEPw68$mi6;yi@L535X5I$<9{jELV+HW9or+;C`%(2Tgy|c!IUZC%RI%j zSvBd(uthX4n<$U>o8wl60rESIvT{>aG^((i7fF;8@r18YE`XwM)}??M_er1PiXRL8 zm-jz5FZVQpX(x4;f^ZCuUeKAEQVL&)33!!_BDo39uYN2Xh)vZdD=QNWnxg=FMIFFkUnc~# zeOGX{haBbw7uE(tVeS$uCGKBngJPRR36u-p2*Y|x5Zy9$?MHLFVSyxwc3vcaVNxWB zVMZi~eL4&qmvM2yOEShP^hc@(JAdYo8t&M`7&9adMh}d#JeZHf3f9XHK8A~1Q1IhO zd|K3Ft_Enq)N-^4Qpmn-2O6e-uWWKrR+-QQ z@Wux)0!iutoD~{i%!mZvmpnwt0VArBB{7c>76pmJuf=wE#zaY=Ui=fvQ-4;ZJ;347f+uhpCJ|gOBPO~x z+jh6(TAmFOWF9Xvs{9C{-L)0k6?AF_`cXAyB-Xcr+u9zef+pvnqKJu+pS#U+R09o% z$@Siv^s40l#lrxf#m;L3lQv=u zw>zD?p)b366gQvy9vT8gX(Jk=cJ{23mB*>eUrC%dhdX9<@#^q8#bjo}u{S&{h-SXSr$=?HozTkwt1DX2(`kosmdWc{Cc5~+pJo44I!h6m> zbI!jCYXt&{CV+Gs8@>YLFC}0feTLCw9 z{O-Xg&$<|xTNN1q(t;V?DX*ZX*cbhF#rzH0dFVZX0~aY3{Q)p-w|1bWtfCxNIM)-b zVPnCHlSomVNv1Q+;v$ZU_PCv>-?oIOvR#umuS1{Cj4B^$mp&B^<9H=RHZPHqMBUh@ zCE@Aj^kI^Fo!SOTL#Qn}hN?mq7(86AfI?U>gj$GR~el zkB$VF(h4a%1ViOXj+Z=$A{c)`G;@KsG3r(w0(Tg3f#lme!U|Vv+NQ*aJc;M96?HHA zI!a;rpXIaos&=jK*lSF~8q@Ft#5BBPzBLXp0-W>Rs}oK3GfQMSd%agcjoGMl?4iIP z)y_o|46bEHJ;m!cy8^5dV3h!?1Xv}&Dgk^YfMB2-@h^YnVPy)&KLOlN zU1C*WRqF(Ha;>*P9z-;Nwd0aH^?V8*aD$9QReP<7)Zx_xn1B}|UYiVX=x>vkaq2*F z49Y^MxRbR3tF0W#4*}hX6P^v~r!QaZKyQpdGCYIV7Q`Vayyg|~Y^!&_9>2QsBE7nE zQmju0s|K@bFslah-D-a@BX-ugjsbfgru`f7WF^v@5Tv(xek%p12O7%)^!_9seNjJG z{)iVm5ueD;_#2yit>>v55upxha}?{Syk~mXbzH;I2pk9}5i<85illz78j=R~+~J3Q zJa1r5Ptx!9Qx?{%9u8P-nW+b8h*we&*g;|dhckPmemw;EgM=0R6<(qnN{L-UKc`^t9;}hu+ zE5?JABTZqYZ<&8njlPaqD*g2Wch(CWI_hcsU_@j8?jU|@sZvKaU9;xhrTE7vpT~KV z!V5)AKs!w;!&@ff=RZGWg}R|^8_){Iy_lSNtX@10?mHI09izjJ-BZWxqH}1PYSWo< zNOLGt69lVmUQbqDz;I8r&9+PxS(An^JjYZw-T{z$51D`5!f>;Wz!lDZ4c2(is>2jE z*KOQhOQi8+)7G*zm8cz8o_zwYmBgnu>5e)6T~#SoTL2bkh3C53q=eZi6dRxiWNy_I z%I!nY&92SO0G2*<>(GNy1N^;8)7h%eeO=SWYU(o`aw&D{u~NMp_tP-WH2_ND`Z-(7lY>&yg(aw9tBEgarD1PoI`R1$JH zgX|TC0;kau;>RLFUk@z|e;<+F?P?IXYejJl94R#eYJ~0p=ENXPP*Rkc*9~{11%zh% zBF3X`xLb9=T;@i!6*A2A!oj@tpGx$QWtK(yj4j)PejYiYoGnX_VxUK7tU6Z{ObqHsMISVUbz9i%A$nD z#O!uJlcX#n7#S|*hb(S@*^vNxRW@fh_KjZQR9J zofqvntj@iorC41+kAXdTSr&SphUzyt6&Ct7$A#a4V*bz>FVMzK>P%Y)tr(5UG=Pj@ zwve0~B6J^9^k7U0P3o-j*+qI{{NKojg)y(wlqjnEsloY6P!u;#Ru=d)eDlmj4t^{7 zfZ5=dqjJmY-#HIVlxr*Njr+!Phh(NG-yt32{3)*eF2E8;o#M`ngL}ujBbWO0CL2+= zL@X;(M2utCScz$~CHt)K>UvB;yl*<=`(B|Xp6O}Q71?)vduTuVqfH-Aa9BT@@a z+nn8krc4&%;QC33z$iOEV@4_b9E{&N;o_E^q+9kT!o08Mlkt(u zLmGTdqJPrs{v&XrGxCrSqTyGwO*zIZ7i?`I)8XSEwO*l0GMX6c>KY-<{(N09~YX9 z4B`x-(bl>9NWA^SXpC7NT%VGdQ);|11T`qJf)3P-0~CB z-1+N-g7`ZpQ57c-F9gqhWU%zP_Ib``E z3pF7!o3Iz6Ip-^NL^a0AGZ7z|FPG_MYQI~UZeMUOL%K7=_>vnr0?s}7MuPt5e@f1m z4NNKce{+MeLFcZgiJt#*PN?~==7fO%Vvb!#{pNSThk=y({-|Lj`tDF+6eb>`v&hU`rm^ejEGpveH;YE# z0{8u}0#Hw;%efrZK+d1Rj*0p5*D=07dmU5Qe?HHg;Sd4}|DL(aWFhIlR4RhL%cY{> zzhq;trm(pl`ZtBr2$8BIx2G`Vfe+MDn?*}Be7g)uhHjW4m7pyXe(mz~1k>V&?bo5V zNfagn#y&p2*!v)rVv(!$vR7#7fx`@EBzYB`%#rc2`vb45_*}JkAH4^U#b}~_6bZ-k ze~>%1ne@-+Ar0Iq_&n%nE+{>{JMm|bZe92?OgF0j3{+2-wp-9}7v9uiH%2|Z$10gW zLgWxUDKEaPEogoA?`7t8)AuoJzv;=&+;AhpRh<<{R>k=eEM!DG^c}-Qlhqt6>vd7dQya<2Z`g8>$)f2%;zkPV|pNwo~OAdg@HS@ zAFkRddf<<<2*IVFUjn-EXJoFO_;NH?y8f(9L;2))yvSmnVZ((Td=0T~r9G)hX5W5K zw4k9cXD46EL_WhhKFcs363j3m(hq6~eMOvltcx8&FWzsLfs`T@ ze;MdTJ#!995vnhTm#q`dkc}vn7=C`;nTi@q@&6wi*Qc!Xt1Y7DFj^P1-VN2araOghY zy;otKttd9rO8#24k{?bh2@b}vXf3N&vT7wSS}XazB`wit2*Bw!WscsNk=RsNq7?6M z6E^)9mHQ6kDf0N4mteFgDq(hWgoS0N_0uKjUpV2qSf{fJuBMJ*(VIOm?5Fs7m0|16 zdc9e%GVBMCVfUP|{n9ZuXIQug!R9`y%We<(Wp@pEhn)SgP~AIB7@8ZQ2IVG3HtyGr zzzON-eO*?}?C>s^>$E5&fA3wc-tqllu~z4?GU0b$=BjPWJ&0SP%|XVPYRBp?;yh=REsD?4?3LuH7t--1rYh=hq)hRu-*$$|HoXn*7-E?OAAg1FwfHR&{ z1*Dmt_I&nW%tvzyf2i+Ku{4T3qN#+mre^!$Rb-=zHv!PNy1m};?l9m_-45z%jCzjJ zFHdNZhD4VV!dPQc0Gn*_+qeWWc8dFo6AlN$S~9-4^O2{OfDWwSm& z3Y4?}@UOWG9-(K3X_6{}+22zam?*AmrJb>ZR9|>TpCk*Of7)lq0TN``ZkHvx1hc)l z=t|yNM%f1)&K}ZF`?i2dx@)w)ic{eCaDY$mGcM4* zmzg1W&l2`WRb1MhyBNXC>aDie-q|c$0^lFr$Ngh~kAmST-mQY+jDo@C7TIShMh3ft zu|cUV@}^8}e^byK8#-qBXE3S5!iN+$0zsg(R)9n?V+f%=SKU*9fj_@b@j%*@T82*%Mb> z>z9GtBoheV?~1wVX5W{WoZKWFM%h40#Fc2+yM%gsEb9ij;RRdrBc9>u)43X2ldw<% zzk_>v>PWZ`Ya#oo%eVTOCD~z=tsSVbEM0vrwjSRwgtn2!QT*PQ{@f%v2p~TU(F{X< zz?VPWBtsTi+lz!TH*?Et=cX_KQm=w^Jpf_+6qlIYB$5I@%$F?QBuN2Vmv-JHBq~PR zMi247OpUMJ{A_A|^RHK`W`*YiyWCF~j{mIK&z({ZJ!zU0t{7i0mvRs#Edjfipb#ZB z0SlMb5G6MO$CnNfCDaXr1)}Kr<)2^I$<+R@`r|mJr_i*3Gh`98(iqsC(nSaU4ZJgf`=sJz-=gT4`U+jTu zj>J1Kd&!JHNWHZMzG1;a;PtnvV>k)gL*93Vb8N{z7;kf3=!O&zr;@$A1oW=WZ@Fn^ z6a_j;gMa9ZevH33p#N6nus7HW-HdLm0W@w&oQ9CNfT?ef=fGEmd+M-*XTU(frT<&fl}`8DKng^+t;5R1abFr3`woaS zj$NuSUB2-x7wEdZ(tscro*r)Fn9>_gzBj?UXI0veBa0Ds-Zj#gdvPGi1F!ilPO=+` z8v-PdfpyEMji6SneVpDO>auBa@&WZOw=N}$-$2>i2J|LY={o*`!=-X}I^r;1e1+c7 z^RU_IebGIT0J^uA9KI+Xe?P(n>5no8)lHf70~lS$k~tW%bykj5tyD}A7~A&3z%G8P z{5tS}{~hbIU$H!Ht|%z?+x?+xo6|MJ6}PXLyASnUThr!UoU!bIYeRY*v>(llNe%b~uHOhM01E_f33NtNxTVK1^E5?hL z0Td+^3Ip>ZRitC++MiID9~31W5(i%o7{6fbnEjRD63?+Mz22plP821N0gsp76eTW3 zZ&_&!gxIPJt-8=^Ze7i-Kajcg0+gbL)OKajoJA9Nb@vc^^V#~`JA%I@xUn7KugS5j zp94_5M)ixssLpFz%(ts)@nx4%6(wZ>@0Yk0B~k$pmkSmpRRLL-VHPDqf1R7r81I)Z za$Is=bTVBZxzI=Z_5S|m0{BxT@S|6M{^^bLIsoUV0Gu}-I3KRwdG&$t4)jHogf=Xr z4|`W-d0xUkb%Oqt#Cdag{TSIrcyC(ZKNr3|7-Nt6fL*Pmw^#4p!sdG< zr)|i4@**L9M6WJBQ$Ng4f8;5==dS*u!96#wy2zY94fRJW%MmK^c@e|=tGiERUpCpP z2%;|`+|JR*>`o|fnt23%noHo# zYy$uM=Uf7><`Q^4m%vZn1TJqLe;%DMKV%!{)u1X^f;)2XfNu%PEq0QIcOCe-w=Krw z#d*tGe1>f2y22f3%J@F!<&%Ni+VP_Mi<@xVtGi&_&+nI~^e8-A*LTV6-Jbtju9pne?4(%V%4Br$T7UlnNts@T36YO zZRp%>G!$FpAex1Ii&r_XZ+}}=^rAdgIr05$#N?@#ywUzU%R|sYW(e_a+oA};yKA?{ ztnuFtHTeW$FKD<|*&}%m!i5pg+0Zq(*S9Q-0!Q`f^!k>YXF@QqfM)_nMiT zFj)uatRbkF9K;Ln*Y_Xq>^}S^?C^erKlVCfu3+y#mm&5j7=L^HE&x-?y&z;^D$9u{ z_W!)S{WPKweo8nUDg8Z1BKSNec*Wf*md%I4=ORVzfj zkujp&Z!Xv-VhJ}-%*A^HkC>A;{vRx`C>Wg&UvP3CU8*fgc_`Q3M`cQV|2GyD&Pwkn~<${;S;L>z^`ZM%Y8jF008?oagIn%HOx1x+%u%#THvP zM)>s`mtG7fH&ElDK$FwQe^wbh-QqXZ$J2Z;WfmT^HM9k8n8~mth$hHIHaD27T@j7Z zwNH;vxn*}MrCGFVgKj~9tl zyf|KFjIq22ZJMNtcKMVksez)nuH$EyUkxW1f7L@{Au-9MF$FosU!taATb>?}!K
    q4rS>`IEK6_E*o|xo_bHlC~@_!#9*=Sy8phbBBJY zBjs)<FGgc~FKrO-mVQWS3u=m!Y^MKLV>amyqftNd#Lic>nU`+sBp?B@myhctDGTR{CwFw-?C#_rj+evhBqRY3m+0#xSOMmjLF^?B74^Ov6NBp(~Y9PL7Z?02*tW~nC+GbR7SY{~zyfaF)uc&wM$>?BYD_?Ic| zBp?BmmrCs#91b ztBz{bdcWtrpT25{wrGocebkh^BCt$Ifu_KMw=SGQ4r!vIM2{;9TF|(}oU8XQojyTB zoQQl)K?|wRSd@{NC~!@o4?2;Uc1X!Nv#Vd zt}i0QECMq_uF(_^PMB^pO?FD~3+JlUV~W+Z^P0@0P2$7kOU zPR&nQdHR$0@OD{sh8kt9#{jvT3uCNj6TB3EZ2m7b&dk5l&W{E6%j%Bx4Ng5@aw@WT zyeoVk3Hff4kM;uATsZpy(lN$W_(}TTYfgdtp#v|oyjGpf)-WZ_Pp%5(HT)Aazx8ro zoy+|WF@|cm(;q&oDXjasECAIvdQ2LLkUA;VM(3;oXyV_;U=Q;#bFMW*&|?;Ur%mpP zJ!DN~vQBpjPhZl=jm-5lOCDH8y|A9zFF}`Z?AdHhB-&j>iF5I3xd)Q&*#R!jvJiJ%) zFN>+(_X?oGof#{;6E(~ z5pytsSm}%!fiIoYv4`Oqfgafc7gvnt8vJchvkrAJ z-wUNf;qtmTx)g8d&kJ&9w0BsFK95R^s&Kly-ayvU?L+m0M&dyFjk<#|`&HT?>G}72 z?UmI;e;+oT3MS^}8y!23=`i?y2f#a8sB?U2A6Jmz3B`bSR!)=K&M6755A~XDY)F8? ze#tZPfl8uFa$~_1(+{he80wea2ssP*y%_OI$x1_IVbpGIt9Lm@^VE_mD(FR&t<)RN zW=_6x!STv=ads))aB=o;7`owSx5VugCOMZ9C>-q8>3I6?GT!<&1!dLHW?;}*no$B* zy>i5Md&}`a{ooI>E!WbcIbANE#a1kqhx*HGAJQFYY;vw9dfk=vUEUOo8U8_4h&qAj zkfTQ1O|B}e8y!qOtuSYhG=~az5W6}xKDgD3d%xeshWy?{zk6~mv@wfPo*a28uCoMj zc8AuqQL0v7nmzS#qp_Vkfciq8cw4@R8~UnZ8(&gc0&AE)E$PT`d@zRPqDx2;GEv>H zQu+-{fQqkPvQ#NSf}uX4Ks}IFr906h>`RU1bi84>g&vm@(K+`(865bo8=mQ2{`=#- z;Rogz8tQFW{Tv+-@r_a$Q1-J}!9GkOtS9Dkz*_I@3&f245fkJVfJ4xh$O=D@NduOOndKY_)=V=ylpySa- zCCtA`JJAnL!GS?X&(5RX9)74C-E`RF_`un1t%%3Pq#A zZbuEejU#C`Jz9=RtT;u*1h|-XwgVDPBGi6GsUo|Ml5(zA1+$t-;YASPn0l}fhhml{ z5_=|2SwZ5E zebZao%`Rojg58WnHh_qk1?QpX==_Na+s^C}5(6%wN-kqWM9Kh%1_bMepPog8#(Zph zppGjjl^UU5RbY(bst(-Wc2@YxjLk2y3o4=ArHD7%X>dcbR5MKi2fbJuLhtFaPZcQgf~^-=$Y(9#wQPianFb_Mx~#){Wyxnf5af!b z(5QDp6g3&5_)VpmHc|}v8L8NY^o<&VJJZ*+Wl0qtr|z;kj8_j4rQqc(CQxeUmh>sC zj@o83k46;B{l>VV;}dhhj(1Z)7D`GN!-GKu!_yX^sBC(109!X+H&K1pYZ_a@djSrJ zuxSYniPIBJYWgUZ#EuvqJ0!Q!qwTpZmk1{%lIP~2(_f*_ko`>~clKH{hjEYcPt?Bp zEqe_uu^A;Z5HP!54hz@4?W8VX&ekuxxh zAMje_mRN0t0q-tYFKD)V&>I16*&CFO->3WIxbC|pcHiz(efCpw|#n^Aaol zeG;Wt!k*WU-=+w^^moI7`C7qCRaQe1kWDq=W3A7oVkZbcmokW6=q&T8GrrzqsV|=5 zG)NxKuZz08H$<1`-6NOpWSOV&?6ldWTt)GGSs^#Z0En#|v538MsPyX*J+66+ml<^o zf07#cXbSGwbpI?__~F>m06A&f)6oxCAG}u z=BWdp5_N|Stb%C^m7QL&U>dHP;4G659YO!4bcnSc8D(g5m4Zz7%-CTMMPk4r4GoJY z%kSjV$vlwR6@*bP=sg$T+fJSg=zf`D%*=+X){lR*LN}&&apBmTrV6+a5yB=eFVgTq z1P{j&B%;EqNu-6aauSPj?PHLux_upzwcb9 zSJ;A`E99Ta40YH_X+Jfv2WgP5kKEh(!#%?o5dc^tkkQ;*+*v#id$Ox#7swxC0b(^k z>2mal!M_QG8(Ms)g<8~80?Pu*EY`|}yE(Z*#k@1?zl#(1P2Pdp3S3?LLkuxkGb%Md z{;Yz2`=b9kj=zaJR0U&*sG|EA{pOPTxvzk)%bvKW%R#P229i3W*_?qo;(p7Vfy7Cv z6CwB=ASnCHy*(tI%S|d}cl}!(P9B*f0rJ<&C;q2w-}2w6%ADDq?`XF?dCUUWDq5Ko$VkY79#zO4bP9RYB70RxUz?8NKG zTy|`wY26J9oA*|S-^K?pX;Mjv?}`|(mS)g-fh=OQMIp%+y4YZ3$mYNTnJL(p?w$W2+jEihkRS0HCX+1s8{*K> z?bC+Hjc?UMV(6o}t-O?Lu1$aJ$HL6d? zh>&Nc*gVd&GY?%M{jZ6@;Z%}Nohg-7~P*rnK@jXcq#`C(a~}tj*Kv0)vzP)v%Ca*B)w#9syE5hq5*Tc=qA8cmBD4%kz%>xk8^*P4a z!O3(urCi?B(Gj;mnJQ@WGgv`pOn0<p*+dDgi?^S2({=67(8q%~Q}OlOv5Ui?`r z8~M-uy4(7KVWhA?TQy(*iOA5lRINBDKw~tm%3Rd%1yAuiJG|oDB>n@r7^sUmwDMq zBh5=vrmESG2;A$cn&Bo91C^E&=!iy!H`XhlRZ_iI3A|3sq_IscWw`kAu%8r8@LT-~ zw5E$uaxY=7!-?o8&4T(o{(a;D(vYlDyC`q}ql(V6t{>%h-o7+k==<+(l7a&*Uad6( zE}lvtL3vN4hz$SC zOfG%(`P1E`@110dAVHJS(^)Xg1kKKxX%=$gH3^D6#s}B{m;7G_P9*|`fkSEaM7JAl z@~Q%EH-2WDXGD`MW(EjZwX1QoFi>MyzpH-`#hJHk%cl;ewN6^O0ECU z0x6fo(A#wzi{k%z)peaa4j{rD|GUO&s}vOLiynXPKQ%>A0ywVh7-B39{OX{JLHMM z91qE2c?&O+Pv7?(v?-wP15GasYqks1RtP3n?P&27KG1u=AC`oHRtSblt>jLr=5c4A zu*DP*ArYcYIE^O}Qf;R_>Mc_LO6R^}ZRf~*rg`Z6N`xYK8a<%w zpl|>qx92hY$fuHq+{T?oa-H=Z=dHC#RLeHTdzPFqa)8HfEz|^2h+;nQqz_NvoRuMj zmhysoN5j_>-1a0bg7C_y--p_kVc{pg5sUIuMgqWfvL|Z7q7gv=`2Q3~BAg=Mw>^7U zEiAZ#xsR<*=fvyS$)VU9av0!Ph1|xe3CHMklIbb3XXSemh$BFjy6};jR=iZo<)p}6 z{Q0Rrmhe|$HURVSMa_K#$z33r{01FkpJ_WkC;qniyJw4M_ z8`+D2@9M9M==!w!Xg(?h)V2lsWY6T?sM(Cw{cd=3an1CF;{lf0>|xyZ!f9Va_(+f$ z+I?qu90#vNu`ESQxD1)aoW?&Ng;++!nv)5#=`+oYB)-s6(*n^dXOTQyf#bRg=mKwh zsfyRSW3ZraeFQBLPh;nc9vlcQEzCh#GU8*%D<@jK8R`dL8xh`T8KjiDNZ_=$FG@X9 zH)~nlG_w3+=Fv$_vc?NjnyS5Pc36>}kY~?^keTVSiB2C%{ZoYk3E!=}3S)2JjyJ#3 zC;dYYDFnu=0N|83Br**YsY3W9%82&>L;ZSkhE4)Ec5r#9WNMPO3WkH=#D#fW;RzNG zuDCG>Yb>I4!rD~7m-h}~^ZSrjDn#vKX=I@ye7wD@?uF_4$UYyNR!mNV2jh-QUD5F- zk?$DaL+gFMY_hx*^h72KpAvhaLHm9{>SoD)m@y%W2Q;c&cuY>|D0+IjZBLM_HD8$i zv{ikv?NxPd=S&jEtV;&OLn~&`W&0$uwB5M?Jq+yZ6L-_ZV8p9xq?K0Z7P@f%3$%8elx)DCKpB= z8Et@i!9}4pX+jfk;N~NlfP#|(9JrgMkWQV-O((HAYJiMT2ZZy^#Gnq}<(@^k^NVIm z(AChndvqUvPY^uc1D?^Ew3l*h`%Aiou&DmHJkTB&>K)|bonXjM@zYQwmv|QCDU9b< zE6x8rXZd~qqAdHAeNXHH1n zm^pRO6P8Un(PYh>3%_U3Yuy-?ajB4Voh{jUuHU}RDii<8?9L^}J{jq`FQIsE8c&%~ znz(mFjtXp6RgYfNIF{*SJUyM2n^I+J8)&;eC@}aO*|k{t<`@2o$i-hKqJ|3uyHr_n z&Q555AFHHLqdb!<t+wo^W7F>Q_EEK!1TU0^L|ZsY zTm<9z&75O8#P%kR2j0Y3I7&BAk3@KQN=<~Gl0gYfJFrX#7q7NNdw5DNP>#d`cuFUjW!7_vvDRU5Jg7cy{!v3f!|0>Ks5I8a%8S1xHeKa-n_<`gzKzlcj?IF-bS zVk}Em4FxY~Rx&+8(napG&MC`Ki)ty5ZXil^dFYnO&sxjinWWEr3eNt$S*vI)PNksZ=x;-`YGHM+;1j$3Oc6U?3BYJFL)I8@{AVg+eWs!HZ9D>C;jln#ar53 zJ!C0w^NA}(6#9Tvj{nW(rchZek3uAemoty?b11sJ0vUW@A6?uV71#0HZmT7>)A=~_ zq}kez`!vM!Oa|a<@T{=4T?qDe)rWc&Nxa29{k7t)l&j*}#xM8g;Iya%*@ow6N2gV#_`5;a)eJvB@L%==iSmw&Hqc<8EWx*;kQi_& zWK2t0J-&2t*8h0d(o+ATrBOG%YiWM(TG~eNpITb8+}~?y-yQ$Z(&mAxuL@Gj^Jyx6 zZ1aP7<$rQ%B=1@pl%XpW?!VE}?*EOJme=4E{ueEc_up!1v43c3%n^TTX-0i>sGrb3 zRXq(eoYBwxqn5Vx>91NE@F$mMVth_ZTtW9&F702nG?IVN($L2KPD`uQ{byR*1@S)W z??1FO1NZt9;eXN6f+pYoMN2dJtCj}*jZ3TkgG;;mlS}*OS{e}kWd1K&TGnyuiVNsL zY3<&BtfkEa{Ch2JA*uq~=Pz0sT{Q^((z})hME;dad;3=|?cZr>D*4m2*Y8>yv!Ktm z|GSoU_)oMnyj)93(f>+IE1CU!EzRs*O9TGKrRn`Em-hEs8v5tIXlYD;)zT>H{!vTI zk+B2*|7mH!{NTTGX`kT!ztqw!C;uZY zO>E$=TG~glf2XDK{Z&f~RtYuGbM#!;2O3s6*u%gG^K_m6XYI7Qf3edJ|1&#H>0j}* ze`lxRVE;GlG~iD=Eh+FQU-k(!qTG0h0AY!j{;gP@E*~bs#>>zEyW?-9+Gd5uI?w-0 zQmyTuk!p8;N2+Q5NvZ+=-c-x@2UG1INj1xu|1nYx_^(a1{~=OMom7+K{u`-w|Bs{^@E239 z_&+h##C>-E+oW3ae?+PQ|Fx<1ze=hB|Fx<1ze=j%|0kweq7D@;@&93J|A(plAEx%d zf~mc|EqTolH35+(x(^jPt;Em=81HeeXQdPYFcZz0wJU;EW{B|7;_MW0Wu4}^#*6on zG5iokk_?3=W8w)2)Q1sfgNV&E?`A4XYg6_Ou;l-Qa6Jq8vC z2>tq_`OwLz_4o*J-Py&Ku7iShJ6$S}rM4ix1PQf>GQ76oV!zR4y)R=Ra9{_%H3XVH zk`V2Lk9$XRx72t)8Gmss-3_*5SmBP&Ce%vl6$hO*xU1ps4^0o`94vS$iWwrDiY1(Q zePsZ8{T0;9H&-zn=2D06KDdtnXX#N+;Om}om{Sfy8>CGT_cq`j8JBJO=1Bo&^Vlf? zW_O7{1I)$~-`}pkzmgwMDaefV>ikG07dO}`G4_4)-ixd*s}tR~xZu0@9LJ@|eWpK; zK{I|~6K5abr-xT3(E-$ysnsD!MJ_is0UQ0F_EmK^q^jU8+qsCkNjp1Pt}V`(*>}<9 zdn(Jg4n)E_@jQk31LZpH&k_mvA|LDf%y*iXG7)I4Q;M3}b7fo!yM_ClWDJS0x{=#f z$?8md^?GEi?e$9Q1R7puz7@N{8uFRD4b54t`|6CzjUGx^FNB)bv}`UPCP6dA1J8`} z-~4&3zpUA@DV%XzzCMp7zrBJbZ*=ZtNmqK-aJThOU8fEjKAK#5Jd_p7IE478oc zq|k8QSVKE-X57wIrdvWeRkkVM^+KFyFu3nJe5NQUxp{FIdHV|^d57j9O+Y-I{MCS4@kDYHb-CIU_OkkRhc}0)4q(5yB17tiM;&nu@=7y zRimw8HEgk>>!_S8(`cQ+u}0+E_Dc)wr7m56sScC-`#e4VhzDD;j@}`vg(cFnE3O#s?Hs6lH4dV*3O;dUroGqI_jz#!^DkK+O(Z>6hA$(M#uOit^*rmN z5uUUtY9(r5uW1-=K)I6r!96qEq#OzaB!=1q$Mq%Z&o_-RK5NEZgabcc?1BT`7pRWt zH;>H_Cg@hQ82@N22FxEchcvDomVSy%1SW;01l1qN1@g?D=+rYDiE7q?$jMq92Z134 zGfX^bBdS}W>3>v@yh7&(=~&em(CTM7XIi|4I-5{&Ba*X;EN=&SbLe36d|0o?ZVbDo zFcPp08@V5Ag?PAU2e4x}=hzeN{kdqQoI_zhTM`_4j!LV@JfGWm$k)d{0eUb zjy^!Xsm_($!*QNXSDuyAWoF6Ldm-{(clIT|NDfD4*3sDACkjzPDEJuyrZDpcdEkx@C*ZjX*>EnSfU@T~ z3BNWpE$J@&lxmgF3+CoI3fPsr%`k^A9tC0 zs!?$wBCVNo{N8z~5(f;SgcR%VG~x{$6_)tAOwnixCi7rGqBj|_t?{7Q-!w^90lO~B zzcIU3O|yW7zKHjmRx5cJU*BL1BN)vKZ7^0qfaH{J0)Sj3f*ONDuPm)P&|j`I_ucVz zd`Ul8N}N#SMZQrgHE9!juS9m;{qj9q@ZD)kcVFyOC3(>HEZV+NHCSn;&s4lss2%M| zSTUCyG*BDln|VL^&u`Lk!;`jnWdAs>eTPjWCT^lz9^oLi`{7k@-)%Y4R1nZ4o2WrS z!$GaA12}A^IgPYJNO&I)&bCz?)EHYqeI|6_MWySQwL$x4u-$GL<{n~H0OgAe_Q!Pb zs}F;GYzOu`$?+I>>3qqWs?fRs+M67avIZTL&)>}DOlxtMKJ<++2B=Xyh^pvcH+ z>iE&Vbx3I$VQ*4VFMV4=%%87k-P(9S0K9(56_nN0Y>?o7fDI?+)PA1v!dcp#)dsn? zhTEOFb?+#GtpHq{QDvU@7a338tHO%x*EaWzI&(yZ?@KaOywwE5)>~1yt$4Yr$$fN{enPy+B`U8f4{Y>b zqTvR6Knq;?Wfh0}dwN>B`EPvtwhjFhse1@d*9@k5+!DO;Bl#>ZKO`UI-tgw(w0oP6 zQ2ViZ7YCo);9`j4zPO`G@CyWd)*^ivw2mdR3EtcpyvFJshzDg3iC%~lxd1Bn$FH4= zZsUF%0drLajmf49>HO>P=}EtVidtmT#pDet{T}-n0`|(|tCl&^xiG&zQC_zcLF`Hj^FAGo+HP5(yNGe5pSc*_!sc*st+Rt33l)G z(TOcJNW~3|=oRJdJk|Qu{1bQ&ZBjjtt>9TI6bfC=M;-b1yM(F@X;SCkvOKl@R^l)R z{LT(PJvC>A2s#(Ll7h3MLEdgi&AW-=Xx0>e9~+kDy4GqAlF4b_=>q0JuZ=Y~v$Q|G zp%>C6l;^bZ&6%zQMQ>E{yma0oVS_U4F*NTK9W8Tbp!X{$7&V{OuUxAf2(-}KDX_|Z z$Hys`Ljdcyk$(=t$C~+qCC@}TEd%w$zvmQnTvFExCebrWlF9xG&czN-q+n>s?}%yZ zqnOeoX4VDBBEr0ST?1?KW+*y^ytdQ_mmV4YChsBUQIiN%0*k#E!Y7xdEGf64GsG9o zsc;_l$AWT{sW&W9P0@80s}R2+&+8;g-I3{y(gAYiua@fDfz29Lthr_n+}`nJUU_W?4lxYIVV)|{jwc|yJ z6z;7S*5m0%Fo0TN@pimvr?wxT==ESj(WQSwnT-ohJaietfE$YX&>Y{1uNR02E4Rxz zxk7`#w+(Q?E~l^r!f;Y`@I`<&5QIxJ>v)D zc9!B$kzF4f+;i8Psvw6ieBN@8Ox`Q0<6*wcQaFrHTQu?&g2yK3Y2v%QEYH?WA=E@& zYpkiK<~$u#*52esqH+tun0W+PewSv@H(dT7` zVXe%XeL>)9w(9$aN{I=|nGpf$qP`YNli5|ll=L5!AH)sa^ZjeO^F7?~Y2 zH1uw!b7GjlcsOPMclX@_C7et;ZHyw8Yqpeu#u#9vd)=|E%EQB&?3b%LGA+!3JrQJD z(ucfBk#xU>2PI1Gtrx3`aEQ?IWmD6=?hxDRfZoiJ(fakQ#K%V@%j>yC@g9GY4lnm{ ztsQrZ!njLoXFb(-%Fvt{0*kDqjdOY(Q@qnaj~b!Whe2nQRIKB||JD%iS4;26r+(}w zMI#^vN4P00(mui*xe9US;^pM^3@4Mw=roaN^H&_v_OEE7?Q^7oUQA`3p%~c^xaXMZ zN+;Ma(ckg%|7=5hF zT@azuFO#g9c2Ln#1z7S~7Av3(qZi8J2abU59+}FfE({Bp93IFx9Q;pnv4A_udnLzh z?&2mXG*r@UEQ$)>vV6Ye7%Q;r%_xc}&FF+EZ$X!<`e@?hlDRg;cI8W&cxVh=NVP9b zkWh8dW9jioYCKuCVU3pZmF}e%5UGY({$9ASb8Rbb!GX0`-cpkuSJ6tw`iDGASyq7JXD0 zr;t;6iW-AeP7?;#-+TMz3J;bn*w!e7ZNAgQ_Bjoz4qZ{-@+h@8?BNj$09vz?l2)24+2#@b_xwf3zUVO`bO*6 zkl6Yioz4ikF9^5%CXyOuht(q@d@pS`3%0p#-2F}2ydP0FX!V(YJb{;>YZw5PBzl2G zz{u_VfLTPT_-%j3-g-}o;0oVGTr89tc-8lPLlxgJd`11rZoPoP^zY((%9oUf6LC|!eCl_9EI zJalJ8SGd66Cv4Det@7PKQd@r78^RTmBBlcgMGbIp;KEE%UBwBV@%HLC7>1vZ>0gMO$8%JSzS z9rmXCr_vELvF`F6jw>aPOwxuA8BfLzY%RYCQqDLg(}FrW(}EJo>Y*GYKT5arIc0wm zs1ZvDpYZ~>WRiI9Oo!Ud`Os(~OjtiZug!&iK~ooYq?2x7?W(be zjp1Jy6(e_~cQjs3OS&ACX6Arb8w>`J!ta;V8JKNb12BZ(mx6N7+_6Iv*~IfGZG+b- zdJa%OLK!|*NZ#T|KUKj|dsCuc7M(BFi#{v;icSi;aodMajG$%Nqe*U?l zDuSzeWNdj~W~d)0YG99A6eH}&&o)U_!dG)v|J6GKb067sAwZ3Vxes%6Cvsc(>$&^3 zYbq$;s}!MI$as-W$y#M(&$3EVGs?EjwI}Np969-v>oXgtiCnUg$@ikHcJv<}NKM_{ zz=KIz7h;z$Bd{Y-A}?cYo6@+PIEXf6<})&XD|Y&OZ%Oip)+c`7;~v(7jugGHIzf;T zFY*26QMNT>SDj&M7d0v08O~hrzNIlMfEu<2f0-Wy= z3hh-WzrA(Ed@pF{ae4j)!eyxbd+A;=6`OOo$1p+WaKcrWX+QU;Pp0aKux&d?7N~P* z{+nP2_U46hD-q1>u?7I8Gr(bb@!XeT3}$2v zE!N3ld#7VZnPN+Uz#n(+V%5BK^0@gUZogBVs6*k-jzG2gotT1nFD+D6b)xcAQ__-a&2i>4e(wm{>ktQ z*oRSmwwR0qi4lp0iStUIriX9lUeUit^b=TPtU~&gEb=vHb zg=?d@T0?fwttb<|0;Tm&CK_Bvukyp0iC6ut^?^9UIAu-JuttWe(!vB#Z%WpownUzh zX{(@XO9ZvI1k9fY$mxR<0|5h9GaKq-ULPrYdSk`(#2th;745gFo_qETq12ULjfj+O zwl&@Zyh9;=QB?jULYfM$BX%Y&h-2}QW-(l!)}=7qF(? zdJb6+dd=-C@i^%(ylVTq9m-iBJZx31gj*YExV?oFl^y7%bu`iR&r@9|)We)3h3%YV zs+t`8H6F|2U5J9Zvd25^S_+-mb(xP8y_t14PP36FeA5b@t~yqG+kO_pZ?}ohZoxOl z6>2MO561+!V%18CUIR&~p<(aIeDTEqw9CmP?@T${B6uspQls{w)lvgvA1NeBn7#qT zC<9r|*jY_Xw(yhDT_6Vql`30a#ms$e0wIxFSZOueRWtL;?@{*8A0FCHKHmhbexSSG ze&KWOn{~1=ZR=6s=U28C|E7LOa1iA{xDRsAv5(%Eofoo)fWt7v zbyrTkHpaO6zV1*X-8Ol3R~v~_P`Hli8!ewMvC;>Gr8_Aeq*y#DVmB8!5y}~biVl1x ze`Za!_OSn&hmeMhs-Gj`n)vOdSqCH#Q%0%U;N5jIV`~~ioh@04RH=Z?Xrn3jXZP%O z+B-?Vus1W%=>ZNMb9M~O@@eAjyf ze*rq;2i|GAn7GHK&iSlMU{g^(_rVJ9!GrS!Bj}^Lsbnrqij8b_#+)mSH-;$(|e46PCW5qPzCnVgF89%@8 z=}eUqeS)$S@bE5+*t`BjkE!h&f|^^HUYce2p|BG{0xU=|N&+cO7^aBncEr$aq4AVA zoT<@Ad3Atyqq_(`>5;F^q`LntQzc}Zr=YIU>jh#bNBG(Wqew1(dxDn?Avveik)l0~^pOA#My@(8lV)ql`73M@!kf>+YJgg+|C{h%L9 zlz7y9?k+1b$$EXBPPaT(WRx5~DwyZ|Lbh6+2@Nqi_-2e zpS72ZF3-|E=d7)ud>;JljaY`At&>z=%JmKS{Glxp@`ZnrF4Ys29&=b^;|L*_@I;2` z^(WldUty()rxNT1U66IBnavNQXDPuyn94)QL#X-wXj6wDgdxL ziO#rruxxqbJ0H6@KYT+z2+)4#=y1Lw@AI2*lmZ7`Imd<2fCHh2UEw#S7EzgoYrFsy z=ANU0k;)@cq|c7iJ4y>xlRa7U4jN)1wnjA$Klih8QW|MC?9ij)!Al1W%SZ?tm>Q%t zpj+%g`OM!N)emmo8`Z}R-)gIZ7gzw6-g|38D&&!iEH+jILMHU63(^!x&a&g zKJO+jlWkP;wSO`89y1MsM1N6!|Nqu&I(r25gfjE0k*JG#nvwao%)8>o$jdA9g8Il@ zgh+9{$&4zfJvkFI@m#x`fpXWlJ$4^Xd4P=IwR%TlmT|JANE){7lR&dB#3+4hA?KR= z9;?odIT!UJM)jqv`O+*55RVFQi>}41CA8kROL#wzoTlv!Z|@qO`lNFfX#c2sVV|f; zv3kmx>{wlQHG=;I)tf;4rkAVma(fZ3qY_CMk=K&X$BY04zV%#9sA_YayoW2B9zQEI zq)JyJ^=;bputK*b{TTy@T@OIhX;fm3ef`!3@%1t)saNiR4V64S`Ih}aRXWk9-J~b zzi_z+AKpXli%nnvX|@Ij6+{8SQ-}~li?>i)u>a~C znq*GMw(=2aYrfXetqtlQ7sr~d%y!Zj45H5mMmOVB{3QXvY1}ATo3v;A4c*~fg>J?A z@Z;vvd+gn~+fMf&`96WO7qMoa1YN`h<+fs*A6t2yVzpp0y#VvIw0Sd2`XP({OQ4W0 zzBjJnIp)5g4GPoAOB9wYO5|2(Gp@mvbix9EksJT!OeIjNUzXo29= zdxeIUXZAdjGANI32U_{H*{314?-Cx^KQ}1vUma)d-=n3Uj{a3G$+PkEM0k5^1RTfO zR>RtBx(s@EkF{D5=>t|iQ!MXD@!3jY5jqn_0dvZs9|n&m=!L!;>QzuW{tT5GL>pku z@-F-VRy%?_ejI%KHB`6A=}%tJ{t$$&JSL%xU8VEbJ+TexT1S&#Ha@-OlWYWKlhD8g z%swnM&p?t{FETVA!~M!#na3+>gy;x@DJL6TClsRy<4v=+rZ+>9SxPR!H(t=xSdwSXJPuv#Hxr zNMdIq(Db5HLGLE};k+&GBWv5-Rk!nL-K*yamC6JysssF>Phvzo&BJk-dWC0yLE1%sHLxR z3#KhATdL?$l?}3NR;aP*dhBdqjk|l(Uo9Ox((Jd+oyn2r20V-p3JB(#LH&zV>F>N= zxTGuW<(*49H~P$tF%}SSsP-;`SmK0yfUlnv1;@hNk=UP-icg*UCuJu~H~~JJ4io)S zv)4>#h<*6W9Bp~j2*@+heR0WSj=chsI$dL*<878?8&4qP5cMrRDgXEj{kqEAT135x z+^;TXC-q#Ze%|?>yO$p~dpV7V)I47BEGiyhPZ}rS%Piv08rNFCTLK|_oF?5h0fkAT z`779)+23Fq$lFn6UL@0KsJLWezT_jQQJ7~*M?QDo_U=ZV&d)5g<)9o_)}x*fTsjVD zxvle~K#k!t&}<-3WA;oGq6Nh7FqTwcypEFG*vpV#{TmaAw!U>2Tc_03gV046KVonf ztbKUtdMf+Sx6vr*``i;%J|X0N4U`?$Y_)1yl<%P>2;rNVcEFCvRC{j^{bcYeogkJI z$FEGtft->5Ffp2(>R!&AGl;Q)tzsNA;qvM=!uT>Tk}IfXLGJOC$d=-j>%Xecc&sMr z=XmJI-Ki2J=lKQ4i)7M*_4I3I2v}x<`xLIapc8zUxW*FJ^;{UY9pCbnDDY(9wD~>0 z5|mBw+oL1IP&*&-HqF^G`djMFl@}v>7T5!Fn_Xr>tfw7wS&{Q63ryDK2Z;$R@R-Lb2@7&6ltghNsz9E%emi+8-v7Gi+wDy+lxBI3{gjL zJM@qI1M$%HNF$OpVtm9hI{=Y(qB#0hp@D6>o=}8G4j#MM(&CC_2fCBeB+Ql*rYwED zH~yK-!A~5@4=q_{m9A{-JPdAiE|h$tLR9uYQn&H)t8yqvq zSOgx)4hrD!`_m41@OXEcy?SWG$w6G&7B%1gxa=))Yil_bw$;~_O~Gd;)heej3WoZiJyYC$I?-1?q2J=AT1|jmMb`BtcavG~ z+Qb-&eGI}#|4je@5>q|#_bv{K29Y20=ILal=p1L z9a=*?Sj0cwtF`bYteBX376%U3ikMco%Z9KXPK1(HlL#HMA~5=sdiKN zXA)-ZOp*G5Le@`UQX9ftGB}@A$pmVbWVO&>#4*IW!XN73=t)4BiGH~cgc*Bv$Joo{ z^Q9M;6B1H0l$}{_mONFLq}-XN!V7#YGhOQMzG@1r;ymc9MET^z=yzn3%y;qGT8?64 zx{5yu!$kSVr%TiCd!GrH1LFd|;3kn@8VX#?ecYjB2AI}=5oAyhd}<7r<{4@^a#bVi z6^rft0QB%P@3<0Fl{R5_y%W`4JNJ^d7MdWU`+MEUEW2}QABW3tS+-!nv9FMagmhYK zR_pc{WgkmmX4L3HO46fhLQz)G~3DpRa4D?`4)*NS2;#@d7h(HGrteI4$1mv)^yi z*62Sc^;IhAbRD41f9S$9kve53TI!dj|2oEAnieH2-f$E+%EwZ0CydUlb;c>(n&tOghIbsmT`yg zu|3=r&tqW8?$y>PrQPx)L+@J=<)~PKA?anCa!OrZ9uNy~IPi%-`?x6Kk;r)BKK2q+ zgYSIC!C}tcbU!=Zf=O^iFiY{P%>Ib#cDUZ8gqKV+aC2zo){mFnHmL5IX~nRlGwzgt zWsYtM^Hh|Qm(=Lu@PJFX!Wis-g*6Z$wX>UdNatw9)PmO*)GKk)V4n4?yffZ(m{K#I zJPNHxHf0LHb?W$fWzYAlJ(R$@&ke1mzbp-`EtbHxE)J|cXhVMEVt-^-)6wbT>^H?{ z2moh4+kdx8W072L>o!i2>@sEv8}T(Sq#CwY8PSw{X9g`TA*RCR>{{ zBp%KfT9*`Xkg4Y3#I@nWHLxWKoS}ra(@!-sJtlzTuG;0E5zhjoe$8$2a2EPF-vqI0 zyO_#nihwV137)Wq9eZD-7c>W6R4j6a#!d#972=spfa;jAYj%0^#y!Kqp35uTy5Hr6 zY8wGIrN4e$v0F8A+4<5$JYnt#Zhf=QTFL*^zgqnEQMNREMBpq#Qk3%RGHe+mFheso zODVZpQEOoLe%zA(Hfc+{bViDO53-Mm&`pVr)@$g8TP+OsLETtX{pSO;+Td(D_JpB8 zN3W9DzxoQOxe=!sGZka9V(3ojlqBH(T`{o)3I3d0u&AGcddr)3b?jTNQHIVw1+4Yn z2AWY;R`m4{U zP-A*B5Nq&mA%mb7ZUId@HRmL>l^boePe2_;urgBBFUG`1ap{!eEAyh~59g+#mIoPfr zVu0D!cEb4qIh6FUiv%D*2Foh;2P+1b9-Pnv1D`7Dayu@vRtH-u*8P*dq{T3>R@ta< zB~pjpa7XAH3^U}QKy1s|ACGKUF|`sufDg*VVV)U`P>b#c~Q_sH#cDK$N5f((5s2&s)-Ork9kbV&f$pF-S!&!T( z{OA0PZ{6(y2Uux@ifb_hOIuL{t4m>oGY5aYjdx_FK9a=xL2e?(a}7S#!a||CR1K8K zn8k=p&$tO_wL2TeiQ0Ol!)qt}3#2j;sKvuQqu4z@2D*d%?c-K&ueGoX+{5T&wF?`0 z@h(2V29Yi!xWN~iMI6jjr~=Y3lUlZmZ?O5 zu-dhd_lU>MFo$nYGC!H1G)ZoLVO=C8McEeAMIixUEdv*R($t@kFdvwt`u1sSVR+mG z!#394(?y3NM`9{25_9$4qxN(4JM=&(I+4H12rzP(=dH#iL$N71s%YI;78MMu0%QsF zQf?Q*s+tQ65@<DrOf8t2`0KOef?CwK$NllY57$f`p6Bj)NDmBAYEOpW{oJ z@QtWh&S!|?-kezW<%?`&mYc`2?V3RHvIInsxZ12uoL9WIsRhap$q6I+9WPE^|GW2g zxAeMq8{|`DGVdB>IJ`qY)dhubODpTT-*X_hR+I)@VH3Ik8eJ1fWF&^*WPdTr+{4LF zyr=o_RPMJckcLq9{5p>X*_h2DhbMYc_C;!qs*9RZsL}GZOd*toGR!>e7lFruji2qX zd>|_2kuNC@(67inS$)0oO1_3tL*<;it@etm%3h-71%mMqv$2l7%#?_=d2q2f=s*#W zOpiUPJ6Bu8JNcojF2_ZV;&`JbG^$R)=5lW z@n6Fm@-@*iqkh#1InRdAv3I^Js_T(kQjnTjYb_{)SRkyRF#_>TZ_;QnU(~>XYX>do z2O$h)nL8u*ECW9qd=q;rC$rtdSh}MoWwc}6`?p$^Q@-RBNBf>|;B9)M`};!>n?;nE zWm)1Sy1s}6i`O4|=e!AYv^#@l285FY5yP8aC!;c8N_O^8x1ciW-U;H%+`$1!+C6(e zd9PqrIV_euPPvl~mAjUfg5O62N}~DsdzCZuS5~uWjxL+qU8xXG;SI)72bbnAsE6jBL)^58Q^$CR^;9uyG8ic7p5|^n( zl)`BmO+@l<@9Wcaa3at1#L{0negiVvdNY+LU?dJD$#NOFNjyRl$(NK+8M3yyB3dh88* zQ7MDrlX61!<&uHIjrr6Rbb8k$w+T)JCuUMa8p zQ4yub%;MfJR{OTrS%-eL)a7LN3ugq?Ck?^I5L*o1c%4UiH+YTf!UtGM6t$=PL6X%u4gV zTKq*nGpzGT>fO9Qz6JzXK5YL6HmDa|5*u*hU%Y1DWqp(Ri`QQ7p}&uPk88*&E4H&7 zvYp2bKl3kLrIJcB@Z*$v^Oamm1~1r+8!Oic&r~xQa46U2X1Q1S1#BC| z)cbg5)gBp{oB`GRvi5x$>=vg<(fP{jKw1IS*+bse_JEzmQU0j(jSJ0P@hh#-mG$7Y zXoLL+TWdgqI42QJ#K(o`s=0)sMlR5e#G6To;e(WXA+wNdvbp!ZQnLwavvPa9_Q%sm z2X433CU@MCL`Grz7-p@Z2h-uIDpxBvh*UT+KAgEVfS@h_rIm*@N!KV&kWzQtWejAi z)+Pa3=DTrf_a(lI^dJ6KZH5s7)wSY<5~4hez9U zthZ(AT~UU{`nV~VKrIw;*mQv(R-IyRhE%m4yT8J;+wJx~{&`hp(zY1>SOlS|a3qMZ zXv0;ncX$pG2ulx7rq~!7pr^nUJ!U!NpqozAxAvSI0%fa~@>J<&pxjVAl50Ap{bb%{ z-Baf6yq3}9qXd;j97kAZYl(7xm7%`=%z~=QQE9935BTnic{>#wPfU0h51D?f&nO%r+an%9|qYui! zA4AKWyx!?AKMkh_9(RLqq|!a|#czJ$S@ax9g_Q0~l&%)^>=*xrp+I2w-XVJRkDxjK z7PS8w&}KFgG3Eakf(E=2nrXz}gm#kd>PrQi%nixAG=<25u_eMe^#mfWsvk)#DvqTk ze5adC@p%q!KLtZ6oT$xs=Pg~cn~AEuVtDQ+Ly5Mw`~9vcmpiDA(?cr1?zfPXL0OC; zGxAD)72%UjavHVfBP*6H;S`l5&_(&Xizqn-GWSH!z);cRWfhW$O)s9i`&&`URl(0D zc%r!6;6~=SLDuHcSas}huq9QCeP_pyhwz`xl_8)&3_y(}Z&R9{>&bBWOfG zib8@DP3?9zIx2y2DTH*3gw5OMppw9!YOHZ2(O%;3XvtcKDjo~@Tq0y?K7X+!Y}&s84ftEo zbe8`qXj(D91#RmuK}-Jdp9PKMFG2gC0Bz*|5zv7DENCjZ|C6B2SN{h=`xl@s{}a%r zjxH$MFJdf7#KseNF6x~{3BGLAl5iqyWp97dS##}v;J!<{_Ur@12&eAO9Kc~nORGdN#GJTIWJT~;wXvxe9=}~z{1gY0tI^J%AJdf@??-f! z+#D!r70H-)o7Mn$6t;?1Vz6esMUVPEf=@0~Y8F8|@At5F;gw7r9#zb$^41TG-8ArP1e^C^Oa#J6biKlf}s0--#||z`gA2=9a6_T1UWZ#@rc-W7!g_^ z+nmv-%=E-SnZ;bqPMS0Mxvr6B(k|-8Nh?>1lT$K;`o=aqfBuc2Nd-OjUBQ!z9D74# z3W8T6lF0@1$nwW8xc6yec@T}} z4tI_j&On5R@_w$IwJKMQP{)OTiH&@e5~tfAg3u}Cr4-5g(Y zC^wsTxub+9uh=XKK2?llIn1+|X8qpD$)Cma>wE_xQWe^M zqlWQVp4iUy(h%ETr-tEL7u$Z*4!h#+cxzSL(GlPlHOp)A9@=qZ8l_cdiBV_oK2r%` zyvf~Un%!td(&8;VjBnfraUr{P9~cz!ufCcTc>TD=d2S9(N!OdEt_?-3r0SJe2|uuL zo0wDhFW-j^ajm!TzsXq+G;az`1(PF*Y8g_%wK1ZE`4Vq*Kx*)$^j?qh3mC?T&!k>P zbxX`k)skr9_tjXdLaJ|5&qic8M@~6_yzS&@TGBGn z7rSPg@{)UZ+%Tgph?YegV{Iw+W_J2pPUV!K1U9(@nq|J7JIO~iemzf~283d*-C)tl zaHo0#xANWnl-i@vcTG|APLvlbSp$sbHe83TY2NOWqzPmE#ENPy!cj>xT;ufq5_Y9# zB(fBD1*2yD1LLm^s)@+IL^AG#F}Fy?XwNH@9X4+r3Ox1NmniDxP_utD? zue(!WJayDR#MzXtKdO?PVWGFZ)>cSLGtXds6mGv4FQPdCj{ez)lSuIz(xKB9h^qst zJhk?m;(gwJLNcW(NUU~%bj3CsCZy?!b7&E3jvW3UjSMO-G^{MtY{N!!<;64fA3|Gx zzTYZpHdQ^HpGA6{l}LObuho)$qIQzsTs3fkqccFT*+LmL^I~~AtNNElQneW)*lsbU z>QG{c{n5y5{$Cmy#h`kA`Ikllzd15-qx%m>wyk016i4C9ziQ-#y!*f>jDC_Vr_8@K z@_9_r_UlfiJFU>j<-gZR8Z+rYdslku0ohNjLr&#}^5IhL0uq|FGPrmSJ1v1;d8Q$i z)=G-e;@QDr(v%P+e7Mr^#<-iJk^qg1_a)=0Dc*Rb;XWqs>9%F0C$by|dM_&-S|Tq@ zyIeh!yX$*|_<-jcB~>qdziC*LjURn61&k5sw#PL;pTGOB^uLR|i#gH7da!l`1iOa5 zmQ)zh%MVx+PsX##7$5tlw7ggLCQprn$&uWSq)C|FD8_?9i-sGgcGY%EfCTQT&aC$f z>923f69@&ROJzZs|6gllo%r7xN$>PuX(ZLqf7VFg-*e>utdSxpzcrH7jOs{KC+Un$ zh(In)Rm4cNRDbBggwSayD5e+0Tk5lS_R|=r%ti-D1gnIxT*fYWzUW{c`4sMygCcA7 zp-&^(Mj=aV2~Jv9f1m(BQm*8C2LivpPSaAP&F95>bj~PSx{O^C$D_0-!h)tKx4>_X zQE*oB17UmAz&kR4CR)Dta(LO0rH&>C|0H>4K)rwdyPb^s8LHZR&7uDZL1KD}#q&fQ zmU+W?9G3myXNvkevt2ohYn&f)c*ndF5OKr^4eJDIo4zWtPbQ>*(_Y=^5WDetyc-_X zXCIg)W$MHIRf#(Ps}pq(D+;9Qs5|R2c#Fmsys0>p-Qu@#ix}|66>u&|opN8S5QR2V zyHJ?8+|Y#LIrN(S_v-5c8&vLQ2Yp=>;y?Qi6CS~S;in02sL+-iS_V^bj!~nF19?VN zqF?h1bY-TwfvN2S1{RZ4?^ zD;eRce87*Gw#8ALw3L%&SJ3T8)FTW)3V)*ixJ3|ntH<$m1wlcVao&0H>vim+=CFgz zyX{H2wkE-^Xo(v7_L1`f>*}LOBUiH6NFOs3vzc2jR?UV0Yea7Y?qLHLKydsAJrkZc zC24lW`&fTr(E^C>bW4JX(^OEM)yPT$1A&2{SEns%^Qpv4zeaj7*Do&R5&G=WYoPB1 zt!PI&ht9smmnPpFU$<7t6U*-BzaAkI-6fzC++{m94eMk59^Zitr@q>i@|;!@k+SI> zv_5TW`%OB)^}xf$%;TnveLEq6b!H8RF96w`;L%yOLs8*=&z+EhVk^!|{Qi&8+KM0< z5$nA*hD|a`(lyNG4B_W0#&?d~VQSfi`-pTisTE$x9CN9MB6%xH+#-`0;f~T_b$%_& zjAS4snby*2>GT=4PHO{`e|jKD7}fOtSt4=@kWv_&h$TX}G*x?{Go77!(9-TK{q8cD z?p4O`@8FcIV6{B3S5^6>=x+M3iKAR>ih12iNkyB7<~qZuZ*UiNsFAqTMs^F=bSdjP zQ@hF6V8P94ThwRaw}?c6#YwBYxS_UgUQ*yHMYdcW3$ZGCLX)yExpWX3_pKG|K@c|p zh*smbKx`2BiF&u3Dc=0eAS7D`?}{bcown`xY>C<&($HIw7oukUYU3BodM{(8* zhw*jmn_=}3A*~FzJIN| z==R>arnJK$dYZ!zvj5q30e-K$9B;d_z1^;r-$rxJ_9vloeCL$4b8<;5`R#=ijDj2w zW;1jLW5hRqzTu}*cnu5F1J#Ug6FLN~e;!RwhkUA{is?gP)LwJCCIjU zcyPTz&z&-d$UNFSIw(6x^xsDMg|feN7I@{^QT@cHWJC9w-#RN__*-XV#)4mU_BYPD zn*PRFAkiqDjs)I2GP33PTz){Dsjq$+4CJ}KQ!d@E>I**e)|gOOGIM$t&UVW zu9YEcmQuVhMYJMuiMZ;WQ_Xp5Of46}1ZpUR77F3|yelXT$_8*D6ffTTJ-B0|Mori+ z-nGMc2ARHD?vmCYNZ0;eYIxS#yl#xuO10VmYgYiT0?W>>-|!9PCh<1SXi#67Ijj^sm@vjV#| zSd`bP0er88NufBjhqm`yTUdh{nHgJR8N{Pm^JK@i8=;~QkW!w#Wm;nCD_I`0#R6hDQjI{+#5NMjJsmaE@+$1;sz!c z4{;bXrw>+?LkSu-et*i8oPl|sQ>-5$Bo#dvS_}~)=BJncH_G}8S?9Lu58fqQ)s--S z+CpzrQ-za|qgUGlakRdsE??Rde7__ox9Sj~x0Yz457!;6usMeyWDg3*N4`?4-4Y2gVE%7? zbu*mHnFC%6!Mf=D0M@B}Un;evz_i-8Jy2Wds42_&TV=d8TPnuGRHFo+H5-q0KPKKFralx59fqwTWm) z|HzFb@RYdNGkrhzvGO0k4?r;Dl|EREB1jti+8(bs2Jz3Q2DU!(gHB`xjd@F(VLi zW)tu@;eVnV)8A->mvRm?*&)=<1*UXnJ>9j-O@dLEQk-D*(9;FD4bfRjkC4v4^iJmr z8kv2a4fi(k#vJ3CDzAYM<9s8b{GkjT96Qi?0U!)9!f6C_&?XUWlI(~I&~=8&Sy15% z`%Y2xGSy|)`CFOL7WhCwTa@*?5k>kJ2o=gOKay=w4KHZC1i__cernIwA-5rb1j3jyOJA><2=VCe>8= z39$2H>YQw_$5liSEEj|_eI%|f!d4r$$9CPYuWYoEFa9A?Qbe~4I?}iG$j+DTjh>uO zGEMWoUc$|%7#9gzHYwQ|8WeM?kig7<;3zqW@zZ&AB3(Bok(4TW)}IDT1i}}Gu&nGp zjMU*0Ww|!nw&P#Yzs<@pI@hq*PhecZ`1so2VX5s7-cZxZCAzbr@F=P?4afLY|oPpb@ zeNRRW_GBs~lr1i7t*ClE)HuggoyPC7Bb}E-D_rh!%{-l~XLEcmYzBSnE%7kh?^j2_ z?GnC`^kVO03EEDsyMu7e;sYSb<*oC!yWxh0T>jk`%G2es?I3R+73n`yGXI$5)5(6* z4l1VG%0QCNv}sAzHhpI^7lb))+YR7TOf}U~sCWdKC^CV`+qkGoXk296uC*h@iFW`S zs6AnxF$Y)azn7f5uIRd$XGuESGtaca9*w_!%5_&+Hk8G#km|tC@vk*jqy%r9_5CB9z zo%h_0LZx|D2u-8Z}v3}Hd)AaZeU$1$1_JR{!a|5J@uzTl~ zU!{e(OSxx$Kr6-|Bl0|b$%EZZVJY~Y$L}6ROC%Q~E<-EOkNkQ7O4;2sh$+$oHG>s~ z98>1$y;(!Ca27Y_YoTf#gPr_(mU9w6=#-6Fl2_-nfV`DApN7B-eQ)^57<`~P-1WLe zaN`1(p0w`ZQ=U$lr!UF-L}7WVhEXZ~lE@mt8O$xbCRCImgD9?Dg^nf9(hr+3777ro zqZfpbSo*92{@`(#0NI!JY&l+eki8giB>F;U6S<6he}4+*DZc%02e}`mnP6OOvyL%Ip6~SY3hh0BV$oFAK22$;eoCIYBDVDmSt~JLg;3Z0)8k^=0zYAyM=p+e)N9 z$&YNFhv2}kQ$0M}nzGh}5{TH%6mhW=Q>Qd~!U)m0 z#2n(z370f`>lEXiden+m>G>Up;HJ{ix(w+M2?4~7AEX%ND&P1hERakc1PX46H|_pv z2K*I4O{yz_x2d1BaT!g@Uf&yq&j;HDJ{P^PWh7CFpo^t)N3Qm#X4?D2?vNW=WOM|u z?AuQYFl@4p*u)tQV|Y^GJym_}YKU$Mt1k}hxqPw!MR^&!0ei;|ADh;yfJqV46P?RLAKd34hDJs@clZ>Mmd?~es`s_hZi!QgNWS`?FC)sc5!6wB@EA7 z{;E_1GCY#~O=LBymB>x(KJF4YvfEeto(mdVnjHxUnF>!EGz%9@e_Z~|0#0rz0#1%D zh|k(|5sxYI1rnsCoo7F7ile|q_C~4jxB~w?hP9np?v6c(a#EpX-BUO|1D`_(3$wDV z(~zYbj|9b7d*Vm7rwCXyB(eVkE4D>R(>U6(IQ{V&JCg6gKq|D>vC~@s0tG*}MDTl& z{@vPr9(?ZSzsnrIzB1R(sw#3)`IPi>L7F8x<;Rk#x^Su5-PbR)4_$?7B3DuSMAKr0 z@$%FKD-=!)f++iYyuPxO<_{wrA#RY;h&za32O#lg%WKUclSX(u>Lt^p@9I!bWK^tv z>UnL<={><1?gI7mp}fPi=!PUJZ}o8^?6_y%{5q%y+GW^<<#vdFJ24VI#I23&X{oXx zv@$O_02flsN88{v$(0#C$ThV>jGTF!9f?W8AZd~^#av(|yQ%cON9gG1kq{jD6zI3i zi!UmvnQ@2|(S(@O8d9C_ z@%HzFr54$a{#5&5gK(3rJIZ!VrR!cvBvSJzGdEp3maAglg18N&BI!ro4wBqrUee*h zEn6ZCq>o~=%Rn%&c4@3^tnJ+1R5FfP7J1TEMoe=nf~mmiGek^VN+^PnBLsuuV5)=0 zA#(b(0-w&cUw2BoShyvE(vi8y zp4%!nUJA3HKgRd;wq1yGmiy+?KoC9{C0VouQIZvX1if{^n{wWXD~HxPO~H?3yEGMv zpOKPTM!_dMuHMfrOr;pZ)X{S)9xQ!#sNE^<07Rv15ZHZn)rv}a-L~>p9Tj*Bi69ze z=#Q9;QtARC7PRhr2N|Qcz9LaB%cXC(*zNT34Bywws)<|*^Pe?=UA(lrFuJl~CZv~LQVkqQg_~E`p=-6C7V{sv`G+0tlUisXL7g4$g zKuj5^1PdC*U-+Fn)6R&-;nrp@KP+Lgn8J9K=w{7Z*KfGOQd+>T3>|4J=-r@Fk9RL9 zcLrK;F*5;~N^&-v3JIaWQjSWK9>VQ{NKn!lFSq*$JI8Xx$D6QUdDKWN{@Si>t(A(g z9qs64J0aIG+*^qBntzUeoei0BB7g*-`KkHsb>Bhk)1)aL@dP`YH$1}k;lWS#o6dqh z3)t!7jt=)ejOEg=ERm}3E|*RrevPWzMSWEetX^_)UQo zy!{mnNq3Kv7&VB=2LR?)LaSa%%Cpu^TfUqW|2?s0;4#qqbWr`_eH@EW%#J!a7`SltPx2nA{ywMSN_~4z2LLCb4H=wsAMykq|9(n#9 z!eCwyab2!}Df})gF?@Q%qvFo%tEMLUlPLbheMxesnb`j>6IRuZc)gWsEgSxCGofWy zJT;4lU8?nFcHqbtrZ=`($qzXM=N^AY!Wh@_wi@btfffm%FPR_quS^L1yHMznE5k8c zIa-1UHdt=eoltb1`sMb+r!s79-Axk5I`ZowV>e`#GwE#v%24@cLv@3>pka~aIfN8Ix&f@(RIB^>lla1&WL8pD%aI_uj6W8brF6 zK<~x&!?(vY_#T1Beug1c&18+Ic`X#U!F|jbOvoij8jCL>72g9nn6=lwcm{Bc;k{$y zYiusYm_m%8h}a)DBqQ*;*OSB;W3iFt1Ej3fsz1C9)DMax6U`+}%+wE>h|MeO)8C>S zH?0W52&YT_DxGJQrKiTeh}w?&?aSy`eG|PL!66E!q;G9C+L}jUN#j};;)WSvD0kvb z6gEq`>m&{qqYX71Q6T@UFL10Kz8mCxUY2j$hW;+6XHcH=mL>)w@j&?2eZjLl^H7z zOe!rUsX=US!?g+AlbOVz?hIqghj`TVL;%w}Se$Y|q&`kFKNrZo*;X3Of z_#ym6z`X!RBgm*21{L!bAJdQMi~^RYrOJw;a-E$a_DYLxuy`pik^arKC1L12jETs-SAWVAg%D=Ol zS$4VHHh-H+2n;7ZLgq+fLPnSgzKU|C-S91CjI(~Z}AUx*`@ zQaBL1HtgUa%ljnMV)~XwZFwK0vnJI3E5RpLpVt@}NN{|w91|yVuJLPcWU~umu=PS& zd>K4MDzf-H4r(p;1);`VlD+!ue9^Npq0#WOR=c| z6thT|RGWnix+BA(gY?3$s8hager0;cFsPl9`j0>uVP{D+<2l2U^p38jB@4g8Wlj+D zW~4E)tEQ$D30vj6W&lh6@#A3*4P0kOO_Ze+NQ44hnKOB563^U3tiK)=z?yKN;h?jVlBMAYnkm*Fzo8`a zL)*rZ4)b+kY8QQqm^Me-@$B-io^R(RO`*P^>hIzV-)Zd>wli5YNhwPW65r)7OaaGC z@%*xL3ijxlbljYSSzjyFhc(7kS;WKu@aknPlo!6^fiogc>(F(9iE{-_Dks$Z0>%8H zzz;NV=6n0n`lwD8tFB~KX|`MZk~cyS24imr4+=)Bu6PUuIi(f`0xk@QrzU0PMnJZ{ zdDO9fY6P-X{MVx}jx|#fGLs&dH+L)-m;VNoS#BB&vrk?RjdS2y)h|G@UeX2!Jnr{7 zBpoE*6X`kOPia3QTv{YP>`;b^m$@bU3lQf*4=@l-Y+MC5m(SAHLz_m>-}R=|CjO|< z;rwt}mIH2&cHg(k`+*&wcxv4S6vMjwBex(9b}cC? zJsL_$#pSGY0Y@R%o~S=a_$wMdIn=efEPup{=jau1&Hk4YW@I#(F4!jKlfJCqMs?v- zm3KYBPr}7o)0qkrKER<=zg?=Tl03_5}U8b>4`z!Cf`veDts{G-igeBu3f!THYTrHK$ zza&3WLJ7N)z*Mq5*joP$d7;WOtn~1aF@xRk0xJwI`&}#JOQ0G$8)Tt8<+6l&<3`s; zGY5ycUR9v-%nwAZ)}J6Vb_1c&#H_tb;A5c{$MHdZV1JD8Hx>dfGp)O5SBy{i-#&a1 z-&w{lN@gTS!WfF50|njIcM8b^O%l9PALOhPgr)54LD4H6aOhbR3u(6Y2n zjbPl?fEg zLZS4W0I22&Ug3fPRgv_d1}j3G51OCOoDeW$7Ox^F%V&Rd zAO(mMb|@AN{$fJlf9Zt(-Q{4^$ zL7$CX9X9mC=%NRuR8vanaAdzQ@uycOgv3i_&>DteYB4$gpQMobiU~5rPCpJAeh=B&g{5xzbW) zy1d?;B^_moFWu{sBADLssa|=VFfq83*0j`hJjHtFw-ElKLfMb~Rrgt{vLYBuw+mN6;88{8b2klNTbg1?n zC#(!9*Y9xq;z+(VIMCrmTYqivSGnvz}WBFttP%A45fAm@l+9;H0J6GG)55Rs`eEDcgL_2?3cRaT z8<~E6-JsZ~U7X|>5&mt3J_qGU8g-P zz#-82z3SlaI4JVUg{>br*spa_ZUV`NB+DTg$P_PBJOYg}DbDoih_JYobKC&lmNX;z zk?LSc)n9q=_a;%9AjN~j7z^mOPS$nf=hA%-R*#j+`!=w`y(piGDQM)o)Fm<#A!Vmh z>upH#kc2D?CJlMI(oJ?lrb6wo&w^$5}yjE@T>?328H^BJvLxUT>0Z zX2#};&6y)`B*mYjF#z@QA_=h;{0xuGcQ0v6rB(uE2CCv3CT+FFPx0M1Hu(Vx@>=fF zXhq(&r_+^U!JqbIQD++G1@ z>`?rb2Y<)GUtXx0*NS37F1;s;dFN2=C$G^H9HR<1u^h#h0UFPr;iZF|S;YnvL?Y{f zjA3E_ii6ROBz8c~J}wr4Q~^>5UF>L9AFakT7H)to^y_u&)!*?S*j(e}9sw)aNJ!#e zd61sQSlhb3taE*)5zB3Tgntu$gifZubSd$4E6qV#8c}z_1i4W(4xtp-*ItPF-6{C% z8=K9HWw`Pg;HAsioyLSbIG!S#8G}|dd!eq9DsGH@)xqC!@D~@hL@DXXe@~;5C+(i7 zJz46UGXy|TtZ>)s;Vt`T;6?_SL$9qyrd2~TEltmGV^M@SiAlpaX4)+M!jhLsrzpLx z?4$k`!e3O_9;^ITb;pQ&=<+(uuj^O`%Xo?HK=8xtOrxZwzOOSrRrXiR>1K;YR5V0m zH*U;dI`}INM!#~QJBo?xl;rFC15+8ipHGQd@uH{6OfbIVC=i95AVmpxm!4D+K#VRR zA##4FZ=9AI!?&Fcj`N8}Vmy?ctZzs~mSm)bi`!Gtk>(5=3{rbubXD<cB|o1PNb{(=WTDsK_ev zfS=xQ=3k9)06IvmYa)CE4u`W*R3+(|jTF4XOHR`g3T#Rl3>`h^zwTX|Yxhe$CS>Ur z*cZQRC1k0(mWQlK3xGuZ_=0gDr#Iy?IA8KqlqOomj@zNTVUzXNGlF2X zz7P+fpu~-aybXu&;HE}ZvErAlWE63zloSrC7pt=G#XYTwMrPRb^>|EaaONfgKx8y= z$w&uxRwI)IEM|z7D3#5c&Ml>VF9+jaoY%-Jf)Ov+gu9db>&G^uOtzRe4 z+M)@Euj13NTuL5;1-<|e3va!FNKRTj;l1E+rf+V-;crQ4aQd9~?xC=j7K}lAUq)Lb z3cah4eZ4;%%;ji7(6e2z#~QTjMRF1xG-tHW03y5J2E8C>sTvSZuf5xDw6K@qOF#yq zEau)+F?`A5#?DI+J~iT}4%1f7;c{U=CxWonpmrfkcwZNsg<5QjYw?f=EXnpBR0)1a zM5ZdomLON%iH#y^8@SsO6x}Ax*LMEZwJyILu@TG<>@ww4f?0bqP7ZyH-~L5*62{_-6@9jWhh1L6&B$DBZ2W916>7KHC-#d$%+cmo%x zwCf;p+X2!_kE={l@kyr*jB!nl2BDw0w6d{RX_}FuP99S<-u7M zc#>!BAvj~wH5RHl%{L-UM>GVhaYn}Q>Xos zS>V^S{$Divl0)-<*n7+GD)($n8we2MM2Ne)ySux4h!f(T5P1kO;>6wEmAJdRySuxm z7qBD3QEW4KKht;Ej+ zUQ^iXh;1qs2))%gkNx)vTu+H4w)fj0=TJj`&X*Q!F}n0^uw{ZHscW=Ug_wa7TxeLi zq<2@`{sm5?XW&u7yTS&VhQQCY?3MffwwC>8TUpRo^Xk4pS0;J5SxN$YdG+Dd~=F6x?wl~ zqy)1%cqoq0%L~4|=t`hZvE9t@Nm{M^Km?2M^FaUOQon;vtkssWyxip5Fce)nHIK6T z!q|2&MY>P6tJ0~G>I>E4LQJal)m4_@bi7pp-=CEbGf`@nkb{k>omy;`pUnS#T)>BzDs@eNooQ9qUeC0%2) zo>IygrIKFB^F{?bQQ6{91jKF*BEeTj(qgpF>+-UhU+sKys(xY1mGM|<0oiO{ULulJ zyE7cAji$M`;!)tB`nE8&!`+Fuq=4{4lD~n9BimK8taDtVL4Mzvk;!CEWCsA(gt>R^ zx;awcqI7l4TiMpuF-&@LOWl21(YMo!|MOtKNuGE%#`ZM9**up|+_Xi@zp&W$_00LL z`ieA-Uc0mKr)It@2R46#m^*nuzgbnpNDO|pUp1Ewb|4IOW1O;wHaLj+b9@5EOPpv= zPu#BWZsF-`#`-LZ4;6ecfa=aU?)6JXy#AZg^Jl??%@F8*nkaQMlUbPmrfEm$+&GepP}elH2Rnu?1Jxmu%a{3t;@SkBBOWTd%u1dJ+@#Lzu=`ewQl zz7WT}>|H!Fy);etZl#`|eV~GRP26W22l#k763QFiP2U>Ub=9$)J1+bgbg0*N1Rd(P zHD-cs_2Ej2tt%@#+genDdABVMSkqlcj3 zl<)@LYRAf(JjxE_7BJWrA2P(ZNSv9`43*X?*T8hyl0|_=uEZEuqToUTN7bR0(hJ0hKR)?F1ZD97^R1 zuUL5Kd0rK9Pppm8cC%Dvya`#2-d0t`zuTw!%>mm%A+tiL@RU{mP!D__S6Q@bIl5t;6aW$W zdj4AmM3f9(ZY!BygJSTr=64LVS3l^M_Si?-8eyFu1M8MPkt$A+qtPupE1IMDh>Avr zNqC~w%_rSO=*W+|*#mL&;wN7gAorCM^s8FYEG}b(aY!&{w)MTFnQo5<0?<=($j>Y6 zQH#V5<4gP60TDKH-AG*^67=(vA-zbfvv%?Gasx@DAWs;$U4%U}FRlG^z&&{ymO_%| zCr4Lw4LYVM*cz*}Gx05@kq81GBXPsdpo3Egj|%q(0M+t@0DgiXKC9BX@@=KG7{t)2H4-YLo#q{kl0{iJ6X$c$a zt%X;H4qYXRm1V!y_GgbyVuBB7djDx**O3jE)exKj`VU-@2?`E?(T;{n*1++rm&6K+ zwZ^kDM3rlX`xE?yqm!Du4GOjxtoDe>MAP+5K8Wm5Rqc+W+-D;;sN523#YV8nhpieP`x7OMzG0T%p9%SC%P9_{gKyz%M;3^?5|^VpG1a%N^X zqRwGMtSpdIW8q}5g6wkOwX7Fih2}2D{1n|s^R%?_^dUaE()$s2nD03+i2H8HWw`J6 zJd>F>QI}=3EUBevjU`6@V<9xYAJoQ#;n#;~;Vb(>EKLJu^f4yYJr7Zut`g2S?(Kv}qY?yD(osug!dGgu9&qdz zp#EFGEa48SdM}o}C7UVkWP(0ZL*R_@PM{68#&U{fu7bl z3$X&Unme7j9{ngCjZc8nM%5rKdn$S8-d68KI3nttensK1;RP90b%3)HyTMgPZr_!`Tgy+S413<1(FO`pj=EyO z0Nm((%UMM~4)fT=y?TYCoS!t7$_d!L+ncIIt;useVw5T%d{m17qDeqsoQ<96)##J^ zHN~rNnOkDgZ{Jax+-`aCAmC*6g=+>erbJAS7x>0lFJzqR#$TbZL6Mm5kA8ET7zWbh zWBKFNI|v^-&CYz<%%7q}uMFE(F8a(~x?YQhJSJP}`YMA-NhP;OmNS*=(Q@Zsle#kM zBN>;tN<0ZWt!unKYgi1HXAG?h(AQC29+~JV9j4WtS>X|;pxAJ zCXia8%%MIH?-o2EKLy~IAQLk~z=4Ik<;#wRO&`>buGcy5y)bZDXl=lNIaDZ%P905( zheGaMxm=$HEg}J4V^S8#@vf8?d<~dxE4XM&E9p@}MDOIGRSxFqJe8CQm3jO91%zt~ zju+n`!VT}@sO1a4#LGkHG#T$Ekq8t> z&k#~#3$rB1fGw0NoZNnzHQ6p$pFWWY#}rfRm9zFY9dZP%J5>hX8K|7ohgW7kK2*Zb zT3e25_N(dy)NUV*&}?XWG0HuxScr~s&cl^+(Af!{w~dJtD>TVNuHge2WD~`Q3Ymcy zS{WNw08kW@-JSJnYzk5tLSAc2JmFj{k{n{$|Bxme1x^R4kv4NmOA*&9VSHKFvGOD;J)Ak$N35FP0Hc3Ge+;HT#uSYfv@A%W`-W0@K{h zdsRY7E(Hx{k>`C1b60G6++mFirV^%~Yo4jB<(%uAU%KGp;Qhe~+1krhd6{SQtF!w> zw4Q}3@5u+%+tOPdwO(V@?4{*atD*Ek$J&z_bmu{Bz5;6E995z7n4%AZEc`tuO35gX z-^v{~lf{6Zwe%ps<|MgvcrgmUPGQj9r_Kjvy^n5^ZrG0i&xCDi)V^Ghn-nUqUNM1# zfG6||YiPtST6oNR+ikZC^l%#;8WhffnlG;-Qvk*9hI4J2XQ3oqkqX1>HV?4G(S9&9 zGNjis5hnDV>FU@eu^R&GXY^>1i#YZx1>~?f_{E?f&_RA?_ZKNb=P}YM(gKv&W;iZQq zA+h#n*QS#r4pEx?S$%z!AdOwY?6ijxUqrNi;K0jMMoERcRq7k$R8uqvaS&%4FSSEe zWCNcLp^MDdQP>(elF1=m6h|fpbX~GTCRrhDa@&Tyk|B5y`8eOK^1U5WOT0OXWworz zXJc5at&PrV=tD#Fh~86wY%I>=ayl@*ymQ>Y&U=H6r)8whVoemXjl<4#w=Y^kmK9vR zexktS8ny6-Hd4rNKWTUNwVTGl2W@gvkzcr`Hlz556DqCeas|Wz%(5RcF!AF@Ruf-m z&&byMTOE=?QQcE&p&V4QgdW22=oZ)*wtlsad~xRy@BJNoD*gi> zOU`VJtj&K3!XbsbZTAUznSjcSD7lip48EN?nVwHNV}?~91xp$2CpQJkXwLkw8jeh) zHkFqSBCcJjZYf2hwFjSi;1qd`V&6Ky%^8dKW}qD^$@(Y(|5`mTsYlmXn}y+Ev<%5` zL*?J?JR&s_&Fzp_{%wPnmLnLkck}n%_ej;ZiXjSZxJ&b4_?-SaX~xcDc>o&CmIhZn^M)$lF7Iy= zh-&6~`Q;cKV2stKVFFmMOIxnWc*ymQl(YJD=UBcYs4JFK{f(`Ps#!@Pbgecz9ukq9 z%WiGGfsYXf%tV6dRsvzfs@&cgkl9}^Zv#QV@v2NAL1fJekb%SH=wNC1 zBHZBBGgxO)oTF=yVfC%u5f7XVD|{ZpBZh=z9qJbj6eSwg!3&Va)icKEZV6Tf=^^m! z6WeVpG#@{wQ)oiSawn)K4EQCcq{q*hC4vXp&yZAWGIX-mI;=bGe@Gp_^m_f z*wc+0pvO@_+whB}u5G7HKL zuPwzL&=UQEWM+lAmmG<>SpaqsJF)ccf>CNT8l>4LNoU|)J^wGeaRIAGIRXE+wGKRK+3a} zXYK~Cj(yc1arQ=CC0x{E;)kc9byOKTcDkYkDhf=}-<)nm=PZI>`M6!HXPS$((!JNv zUTh#)Q04}2*+Eln1lLw2FugS$ERECd+%LBiW(%P@UMdCRnTt>$?T;Q%t8c=^13Mqxsb=eP1ha$lub)41dubd|n|`7T514Bb+bIh5T1utM z#7qo(u>Fp4?xX%1wBJ%MG3 zf>vFmz0`}k`k*xiJ+*COsaC4cIf}oC(swMi~%efUvU)&#IDOuMPzR0RY+S-)B50l!Eg1U8_ZsDomGP+HIqcb z;%?0JO24ggBA=fh%XwdYgDk_-M6{@{>*-{nddJN`T%SnkjkwvU^M+#HEqM^a<%)A8 zyLE}67s|Uu1PMT7VV3dkI188yQQVBS&d~>N+aT!W82(;;?5yXtnghRbu2D7{8&xm2 zeQfsKeeTUcHOoh8qk>`~t@EqxXd7z&xSU5TmJAc@L*JQ1)LQ)86%(THTpcoRYxvQK zU6rd``OaJFQJd-}9+iFtgRw6=rmyl}<`&r!N#ACON4^BCgs!4{0(@y8|4i3BAW2!P zLF!gEhL1DrY(w4d;TvNt+hNo}$4G&RVXv{behiFoqmLV@&D5Hz(BMS&)Ck(kG?dJ8w?k(XSg8 zrg*SA1XYaC8~J@j4`E`^vzk;K5+$RW-G%e}mi7x)A3yz=H?WUv=Z&9&#A=G8p^`Q= z`8<1vJ7Dkiz=ca)9re986PGl?s!3Lm0uHjwn&G7Y4!fLTywjIi0ws-d{A?l|5nxgo zoGjpZu6cypifr!>yotE|CwsKcE@3mFK?Lq^8<#GBlu82&hM~kXFr!s`Us_0eO*Qep z`gx;-ouq7WbPvS37J^z!odhJw`>Eh@1wPPYhpEk)U&OC2a-Ypx!QX}E>SEW8fP0$y z(Z>J-!BA-z=P^DaFZpR|pmEhrYV1vvaz89?XCWHW z-tk4O?nE?ts}ybAsIGS76A};-Fsqy-;w;_B*uozf#C;gj_3>%&MH6v;E4{%-qt^*9 zbL$b_#t~J3kU7tC84tF}POl*x$WY$5$;t?5(D&uejIss?ojpsou|VDM!o+-?ICYhc ziB%ipmMU(W&TcilqZ@%Z;?25cZ2ZzG;tk0MVsBW71M7Vm@v8tGp#*_8a&Lyl=j_E> z($B?pD-z!-YsOcMTR{=p4;TC83GUaeg2DSM$%Lx8iG)~dtp$m(#f?C}=01BWU`b^RyZ(~t z?t#O>Rq18OH)@8$`06l`bGXDfHwVILBn1)8)9YMx?mml`F}-Q@4l?%Uo{fbLj5O~e z2!7EhyA0JK7Dj$Lo+KoNLCOfo!-fugIFa@oGb7a&V!ev+Ms^zwaiiFEEswfZ*R>J% zQV38h7;K}n|JISyp+QIxJzJ=_Ir&9}d4jqY2!=;X(ac!7eR>fq&p zoxWDI7-Ln1@0oAFsDy{sOBjmdV;xM?{L8i}Uf13vCLuCVC)7E0zH_5rl7=S+rb+!w zFjbdt&n&r zW@#Y?kKI8tQeJN|5f}}6LkC+s-lhQ8{%;J1&6^vh=AhO2lvD2e2w~n&FT2d(MA9)( zjBS)0#H&M4kxy&muEuNgrE9kuY-v@gjMLJ~vx=_Pee+BR7CZFf z?GHyhef5jFchiNeT^8O9^ZN`z+|sONBVBJ2Kc26|qcHKxDQ%nV(Q1azv*<_rJq6p$ zwvxB~Cb@&0W798k+qfsD9~~S6dz@&J;Z5E2&eJ`2DV8!2qy3Y`BmGZJlhmA*?Yd!c zNv~q>+v)aq_UBjU{Yi7auOO?Rpw;UxI^D*AOiV&Yu=zd+%RU#fR5#~nE5z>&kF;5a z0IcZ(^OXOdYBL$qTO-Wh+#?yeR!Xn4vdfx-!ht6XQC;9*dnbuGLGlqtxPc5zJ(4{& zmnl9n&~jcoab&}5)e9?(`UlsP!m4wb0WRj&sJTZFl36)+Llw#5W?g;L`QGZ8g*D?Y z*_+H(yTsfQCC-2;G>ILhrQcD8+h+O(t!q@L&HyHNZX{K0mOk6@veIpG)|pkrM_y{o zoY#Ng!;t%0`86g~?PdKq3&TA;%TRkh2CQC+dDhYfw}eC}N#nc=L#nLp!f|&i)g|xA zl=K^mlRl`oO{B5MeH+nFE;mAbUKLd5EMBl_&w;e(X)7YgFaT-5iE8v_z(QZEW>Tlo zHGV3YG*2UDnxPbi&^MkY!3*x{#QnA@@-YbnSd6*T(?hPEPIeyzX`drg^$GEO_$x|F zEr!Zau>IH_zFw}vv-e4lRGA2E4Su@~>g=peCK-y-I1MB4?4L^vB{@*iqB~1rj|BJ2 zbbtU0(1jq(b>J?*6@GWQuumgykpLf7y}#g&w&Khc%UrQ72NBb-tj!zg%X6GB)Y&-s z#&IoscV8AI?(}_bbER23rnxac@+*ShDsL=1HG$UQY+0aSr)cv@l1K=+d_C2^-?%r{Z7YV0g8=Qn3S4!G7;OOxx^Xx&=@^1EeWWc znT{+95wY91cEBB9;mvYT2rg0wyXgj<9S`k1HgH;%mPG4?jR;My75LYk^%fC5(Vj5`GJ2P%)DFwwBX;C> zKMA>N+eL9>+Z|ynpg6{3=po@?qNZEjkOa7Nhy*pY zQs$NG@Jzc6Kz~yT)cpgm+>Jlg%*OrLSOBIpH{ewqwK(8J$pL)q|WoGQhVgw z)=%hLn?)(4l4<{`&4&&N9toZ~&^iM~WOmSoS64r6`}l;42y>#TLt$kzN%&RUK$X+& z4b=%Y6h^yk+w4^=-O7OhSpx0V1HbCZ;hmlIblsL8_q#`IIc-vC?z9-7y40DRGD&CN zJ%hd}PymYql^REG(W9utdkB#LNhIh^_EOlyV8wb6zprur#hmbmt_C?hDNnLJk;nV;m0FO z>QJZ>iP|SpSdWq@`cC~BJ|wK;#SrdI-5Q66&LMvivPM}1qNSLqUIrqcF&GkW^1 ztITMEjie|PxG6B(%xF)U_60)cDj%1PsXXac<`c%&pj@Y)C$ZCKe4MfB)J+U$5-snU zcxA27@Ba>lSlR!bKICVa?(ky@Ju5m5-3>h}sou0lNjm@A@7!cMLP^tzp(Ywu7?oK* zLl4(%38mV$df-+AIzj29A>U_?JY2p0pglVf@v8*a^X{*v<#nylmD(QB*q5LTO_wvN zS<6yO2CLkaRnjaV*aDXQ-h%P)Ww6t6!t@-3sK~eCZ+JAOuVC6sO*4X`=p+QkoeE;% zJ|kC;h^>3sKcOO zJi1>DYv+Q`yP-hDm)-l^l!o#| zu0r}SuF8?r@CODWJOQs%OcAiG%-*ly>U*ZX2r&0<0o85WV2-uY^uK&+kd($f3hRbk z)RJd?UgwaJ1UX97`{vaqf?{p4%&TRefawrPn6v31Zd6T)h!!)zLGx{4b{8WjzUt)L z+bi}uJN;ZvTIHlo+yg5&gD4|k^LI`61BDX#;zDP_EQzF^GjM50GTG-H4K`FmT?it` zcxZTNr8WLX_t%3!T%8Nan4k+R1LHndKWne26*=4|c!pr7QMd%m#ZrSv(v8N_B~03> z&>4EYgjg-+uGASIOig+qs?*vm0sK0`7PM?$U#8uzZ{*q79`4wOQi{Wv@bHv|O9$Nz z+u3+H2%6IcS@{^q>`F{S^a1%=oqO_COmtDvmP) zxlpcIvJKg;QC-;$%=bK7mQWV~9xP_)?}xVNhvcS&t5`BJ;c^yaQH?sEBi@yyXu=~_O%lb2nr$wGT1XBx0Q zzF$tzk`=?g8rCH5As1vB+0C*Ch~NTtIRL$fa_KhE-| zh5|NU&4dFS(G!dWPRLtpvMDRJ!`=5a>Sn!mhYuUt@vK$9ubf1LyRH+I$w&k4)S0#XIoqzl@RI&x=+Nu ziOviC6%u{&5kfk2!vja>2{G0y^BoLD+u=73{*!)rGd>QQu4p2^dj;<`Ft0U^Sc}NO(uN>?bQe#T$MCBP^#cZV%?K$~1*5}C; zn^VVWrHD}=BS$Gv=dRy#mW`DuFmWhZoe`WVEbl6CNyB)$+DiBzle+sQZAj%C)hAd2 z7ss;^`mb`qeq$T8Zb1PhG%(GSV5rMNxw_o-da3U*CoonmmfF{RXCv4iQlPryu_C2;X$%9pF0i+F3&3?mlz{st+GJOO`FV&ly-O*$}JI1nNGNZr!b z*g-2F7b!igcbcgiQ)|KBuNh@&P`V)7YvAgdME2TuR;SFe*8f0`{$c6zGcN4k= zPT}3`REXLmaID$;WnyRRL{yPd>)(kfpA##}EscBXMzZRfwA`UKOsGkVDEBKMjlTGW zHWy*57~vNN)?kP;Ey@kt8jNLaX(x?E35bKfISx-u zzmZM5R&I~qHRACR6b?}9$z}}gh?%)fFm7CzVhLS7E@$T0?x-P_UPEO~6}m@*eNk|r zZT%Bty4G20t$EXcHc>a3_w+)UE?EzXdK}uF+EnA@<^!3F986Un3M?mTUj{S)eb!Wc zX9-u50|p!_-<5L4$B&!GVufZSOjvy$;Kid)jETPKieNS?yi9+RAjVWezpOg^eJisu zb|s|RnOJ+l>MfW#!vpn|nz}#d$;M(lgm>JYj|j3wDY$==1HV;(j`rtkp&qXvYv?A> z8d_2mw1yVg#zn^k&~ee-4MvWA%TPn?O&X^gDEl`|%zS7N;#SYs`tZ~zE973@oJlAi zdCv84yB5+n5U!MzQqdeOhFcWqldc$CH)bgnR-juColY|8W3V+R#bRg7kFmpT?kvfZ z)6K`{Eaqo=dPWP2Z=8={V5Ne+(dewO#rtG}xpyqxPJQaPg5MR$J#{E}!1doPB;q!#Qm)qm7Va=iv4GNZ1)J zligD;wDx%I{r*pQQ$#Zn8y9L}YfF`kz%eJ)neTudz|@3%prx3mK%#m748UnEbc|+d zi0SD#Sjw=Q5^X&ij*$S9@kC7`n>%162cXb?Q zlzu>5)U|IB8f@)BuVXaOVXDYcv>C}#)|G6co2y^3nrk8&b(^trdZ5R6j>A2g{Z9@(Ov4n*06RA$!%VyG7&QEn<|l>b`uTckjjfdC(}U z0~Up2+{qV#3lDk!nym%ee(`P0$ROV0N@p0~7)Gb|{5f`^Y1|4r*8vrUL$9iO`<)&d z(701?^}XZ<4uE<@Ze%xWWJj{+fE85F#p$-cBXcX_u@ih4+N*uIPJU?Iiew7M+>I+k z(u$nif#DdI6_gd6_UJ@oO9t-t6->SC&1`R%*VI%j!?_KO-iGYB)*x%~5K0*h4jH;wGn%T$ zo~o^+eDDk{*2RH*RdoT*V~Q5&2e*YOqO;rvdpsVBr_|@e0J}$6%ojH>N&Pk7Sh?T> zZK-?#s)C>!KX#!Gyl21+BtU`UX)2F=VeBtAUMzJ(e%g**DmnLMu7run^;`GQO5jBt zBFAUb$B&qi?gazxaO(tr!flwqtGNroE36s6@Xn~@0#dR=&D2Tpx~MOOz)_3w9m}3x zEM7UaH?*34OFgd28EgRG_s!9U5h?2uc4qHa*!Ymxtgmc=bZZi;cF(Q$MQL94FRtFu z&T14NaD%l7%qs%b@Y6c=2Le$Om?jwH#RDpD1@JRSe=%sks!8(26Y#f94F8IF%e_;W zG>v~SF~+x(I{A9kci8l;Om|TVU(JplxO*vBx@sd_IsX~#D{8U%HGBV#OE>1_uUS~^ zx!Z36=e!9#RbPr!&LXT{4`PQv=Ywhov0(+<=GpHc{e!CUhyHPj@dLJbnKGE1DMEJt znda8ezSjam6myWCI3HkqFqrBEy96O!ViUHPi9+AO*JoIzeLfK7dUqoc0q=iFlw+rp z?7s_xQi^kkzFCUlMynSM3ex-4-I_8$h>4Tn%Obq*qFU;Gc>xve(LzOVY42}Y$FL^jg@&2 z%(b@$w5GPPLbcOgO181v*1Pm39|+oQ=F9e#1DzFD6Ot3*m*wyiQeu(VsVcildB_%M z+}~Nl!sH_jUccV1PvUq*>OJDXuUJUUpNw4)mFQfS(~W%)VUwf3Lz`m*TY{rcuF{k> zn7))OD_0*$sn~kCiC1WiVBiY){*XW1iSa$(qIq?vl(U~LF<>lNsMx~x&VRQxIkM># zT;8aSYC6g{fz!T=dw7)MZ6yD)B_F*rC#Bg#aO*pG#m#|W=ATPIP4J)ylWfTHLefyq zq&d5`GIU*;BQ6@U7ycJIq{rT?gt6$(ABWPiV35$se7m!HoPg{W6K14h{Dk3N{s8Ws zuEuxvjcO9Eg|vR;tv9`t$|P4Y?A?0ft5jj35(moUwx%r2wF0tlJbzA;V-Ds>T52n`nUzrqxU88fg+l_hKVQW^x;Nw7i1@$|#2 z-l69y{?E*6;BR8}H}?M?wfY~J)eTJl$gDnKjCKVECM06^>-R4G(S?N}!NpurY`%@r z^(4Oi>TJW`$orG`RWIt^ZA}+i`NX?rjdVeXFyEr4Dg<%6o~6Ae&4c7J$MP`^yEEFS zKUtEK*7##s`Y|$Xl&czcah4)HP@;vat-WvatZo1FS{H@mA$f_UvJG+!Y77bh{oJ`p z9!<@9cSW&EUK&}MWwyUnkDwYoRPilcmBQbvkaQB_SxzYHBOVBku25tSor)`Y86$hS z==4w2>i?2i4gB}3)&C{48u;&5tN%2sQ?5-(URGUiy!xsWA$h%V+V@m9Z1{MkLl$eI4-~W{QPa0!`4wfX2-Sp~g4%$CDdWQb+Lc;8aGF zZm6@)jls-$y5kVR^fN2`kS(9#_@c)`CKv{mFWmT!G9Ty!9u!Fu^vrNzneg(!-12R# zIF~%l+2FON!{9hyVt2%(ijLA%L~!ip*-r8nuyuX>gjPN@3T$vzHV3rj(LV;A(7`cI z&*S1e0F;EHvmLcLmXcYhW%qis?FJe8+R!K`y_Si(cKk~CQ$vyYBx>m2A_ibiG$R0T z7AT9!DXa4JJ_nN`6^)+r+q@<1NHMdqmBGbcL@g35Vl^>KmS_2P-G^cd(MLVFi|2aA zlTbC(Jz12+Lt&Utm6I!x`B&jW)h%@Vi z5!`({BW&!%Av2yHj#VIulh37OaZPF5@6J8=5wKG_18ovnib5ur>pZipcax7{^P#A1 zkfkT5Gx6^7QiU?Z0+_!;>fZ*ymN>^h^r}Ooe-IF$Uwd%A4UC%cD zp0#qvg0taN7!Y%VCLGtQCabkg66&|AwEl$8O~WpM16O+$bQn-K07K^=0wdeN&Py$o>(0NU+tfmS@D7>pjVm(u-&^w1My(D(=wT`6DWK(6%; z9@@**AFef#3bcy(D|#>^kZUbF2y(4wL9X?;cOcjL?Hb9;7k11HR1VeCshxkbL2}MO zHi*M78zc^7gREx#V;dyj8yEntHIA!}Cv?vyQh(SWqv8*|MRPJcwhyTUyMXr8LD$nh z$Ob9+s}17u(*}WM9PC~RoL7_P{9%KHfNYQu2(uH#`&y7`eSPuUv_6?lW+n-<#IXAk(_ife-YC z!=Iux{x0I_hljt2*1%s)>#v4?nAV?H^$3}1;^ zUbG{d6eq!o!+mG|#_gr;>BR5w3Z_>Ih2uB?3$^3aE#_UEBdL|xDt55~W#v)%a}maa zVKE`!ZiPbF7Ir`rV#E4C7M8J8zu&a$yTq5IIIzhgt=04oCksrLN8gry(7oawX3pC{ zJR;Zs8aY^#8I@dpMj7><*OYcXXN8EJSbn;1T@akcui)!4kvHNiGm+igZk@D1*$NuI z%)47fMa$~14^~sOAq(4{@O6S{{YG6vo1Z>Owh`c40WhgRak&IbRBxfaVL0q4?3Bo6 zn8UR4N#D|ZZAG5qS1Y?QkZSUPD}G`pu0umPb?QoK4T}&49|q3>`c4?{akGg9YLX=4 z0bBoY$rbGyDO_tV=eAHk>#7)!m5ozZm{MBAU8lQkv!;kq-&boRhZ#&?BMBomCJpqi zQfusGKw%IjJ>i>YTgut(V???DN;!?9iG?CKEIU^q=owZ7*SqQ?)%YlqxlTxnW z2eBRZll-r?A5=4~I$3zPF6PO2$pR}8(>~h6-=4q!zTY1%By{;9J3;_U!j~`7_VWX( zLd`9cJ@&(+m;Y*^K`KHe3!F(%IPMz9z2tT5F~9&1%H6nvuM;O?pOR*-9qQt2WjBiw zC0wEzh+oi5eZP0pk#aeno!Y;$d~vD-&lz1Sxn!{_jy=L-*LXD(`d&d2%NlJb`{Olb z9sGOp0C6zxiSI##RkI`Yin77KxaRkuK_clH?^bX@W-?D17G)D;mg?kykuFbl0^Y57 zDI=?&i}73*=9~?vubO&`DZ&q`7?rZubdB>Nrz2a225Nq+l8@DZ($4kro%fag{2NwZ z>E%Pgf$E*-16!I7l6Age0gc-ZAsH@jLZslaT??v$Z2FJ&JDXwKev{k|JCr`1r7(-! zgt*V^<^xPTQ8kOGPm6P#8yXONHRsNZP7p1(?xbcfp#RCKS|NQ{2xjHsN7;3=gM;Af zV1YYctxWs5i!huV_kMc3Q(W0CL8xr|BweYAD17J&RIc#0!Fmg$*-S&S-n3%W?M=r| z(*4y|{Of2c=RK|)LNV{t3A3!>}(&t#u_3aC!{99q0=lS2JOMBPfq5&rC-K9Kmb2}JjU51 zY^ox?(~S1f2g^z@kgbpPJ&z1Q9rgYK$>_F9%a24AIqxlXe=}ra`90R3vDQc5T{>9y zAhe-9Zh~~qT>LBOg(E_#5?4sEchc~CnKmz<9Ts}j_<|5|fHcTv4e4A-!sd1Gx6H0t zH!b=hjsX87=E&c~5#YaWj+9+>mWwBpR4ls%F78rh6HsiDL7F`OMKLzQ3L!!Z8fKT* z4Rw^ww|N*V8j^adqfD>M4XswG@ypw`m?*Xa`#DXDBK_ytvb;cy^>0oTVoqk*L)W%> zzk@Ob^kT$5Jv$;saz&79Xxi$=c~`D0||ru;Q3tZE|_fYphbx|70)&T@}rWa(nhneyRUhWS$eT*n;(| zM`f&g^c^LYP|~%{(SR5KfPEVQRMj+ChYkl`bq5U%?|qst@9<<6Eqh6-|iA zT)DBa;4&Iy4^5N+y);#k7pY8esJ2*ZWJUl!%`oN};iA6P!ug;fPUPc)IN|c$&gytn zG&h0!Q#yg&Gu^%z2Wml@AbqSwziGoJr)rjJIe+S1~q-2x3;ms9ouP z*t%h#&GC^VVFi8D9*XQG823vpX&&VvM$f6MR}ImZUC8Ik4x2y)7rM zaFrW^cDfSW$8VjG^nLKfx`yQsbMgn(z)CkU^LGsUxh0+=&!%6{z~=W}vvhWG4!^hc zbUiQshHHYd2c$L9#p-pR2ACj*hXy;-X|_`|+53z@DEVpfs1zj`nDELov$WgFJz~vM zR;%f>4TRCmW!7k$6OHZVySpe6mrD6^xKPO0CECRp5H&13D;UMABazZ-B=K|_3rJL> zS+6CGFRSO4u(_X$+JsBWHhe6JE!vz)YX}gx+w}^-0hW&hsxJ=9vQQXmsvqJb4$;M~ zvCtKIN65&&Jzllxkj1!;vhaBnG+ZByfkTQpeMV>KwO_2}R`)!DjqA(>S~&`+tGm@$ z)%2r%_Vay^BgLs_$H@bCSd8LXFfHz?1Z!z9V2gE(2$tJKKAk_gLUB}}fB1MySd>uc z_s;W#2a(_1w_7Woac?qK`ScaEM6rtJlK3YenB$NgjJ}abDKbrRg9{4=CtT zd*`?nsU`8K%V@CVAISQuT0+6+{76rB1>&xXj{P_{;m^(Se6@^BwPVJ|Ls|F<>^`1tUY7N;{LW+WT;UTfV5) ze&;GgVdW{Eo7SXjXKxa}A+1710{3CIy2C-=ggNSCx(5GI|4QzDcKK#ma&KI}#%}0L zJyj;+r}TXS_{e&lX2df#)oBJq_Ppga2KKzTuVf9RSIr5B2I-L5+}rj`sq`lRXmt1qvXf*P&3vYVd6x@+gRTo%Tg(pgTWq zr47TFo^ODgxWVuBJZEMZ9xYs+my<7sM3UnS?PYNN{y%JEsz5E7uUNJ$wSun=fUl)l zba`AOAA{9c@MI2M_;N#EoYh+JxVLv+)tj4z31|TdQEB<3>Bi~-*61GE(Wd* z7_${r(#f66rBM;NwweZH2V*;cOk!&~itv3-M z;l&<_Jgt5>H0P_{YUgGyfjnqGFH?Bj$2wl>DUyx<(-}`!{5d5AE1UNKAC1*dg;PUz zb1vqRCjDH}H}yJi)yIW^5O=aI{0zTcI7flF%@y~U1;12^G@K-5`q>{M#J zkQW7Gj5&Ezt3uTQ-8A<-k^|MXw( zXhHsqEU*j`V6;I3%#!gB0VXxvA2u{w9qWsIHA3&&5C284D`qO#H2NhM6L^7EUAxH0 zYMtrgB3{!EtRFhXDxY7(35w8xI+!*y?{hvFf;yOBg)LU;KA;Y!s4l33iB(TnhW`cB z!9*$nbujS(PzQ6Q@n;89u3-fqxNOt;GW~5B$d^ z{D0iRW7kTYj6jCx;3pJ=^cS0u|8M#Ww%9+=Uw}Uin4kU&NPnrI`p5clLr=pZ-g40By@}{YA#4|GX^zm`e=8@i2i*}9_GTo?8D(a*?hYhDJTe)JVQ%oAyN%@j%*dYCHt}f9QYn?Z^?Y1OFuZ4 za(PtQ*?gR-Jms`(%s!4eM>h82se#1NH@~mNJ>g~r-0=9+WvwdUG;j`fc5 z?s0wOGxs>p|M~kJhdfDK#qx=xd8C&7bUwugPs{Imb){?sQkBE>Y46q!-kgrA+E2+D z%B<1<=(d=P9YJc4KaC8OoMT)F`bkK)6OTmn_TUhY=&ek%7%OOY}*Sw zy!e8ofhg)NE+*bmt`e~WWBpRdrQf4V#BR;kbOWQj5D9VI_QZSI6u99?86s9oZ5Z(&bw}nv*)>%Ap6Vp2Vha8!F zzx}F%>ILgXpTjjDTL_}j9r@f#qdIkD{X&Su|H4JHnuK3(*=>%413)x_elr?jP$7&) zA`?RE&cn5GLZz9w=NHe1V;}J?R(2?gMev3_Bz`%)w7Fj0?nY;UG5B(+Vlb3@OE|Wb z`=~-2aeHHwFWDZp_gFZU=OMPd)`s{SVP;$X<1tKXPut5JrSrSceug6ED$$18cX^sS zkc?Pz9U(kSLQc3~;E-Tr^K2K&!iun4}Wzgw^%pawg<{znbgJ*7iu#e6bA_HgpT zC$$o#lW=#@;F0Rz#P+Yg3nVm{2w_zF7pe^F=w+!eXScmZipMtmJCw{lNrs2-o+M*4 zS)ba5x6MxF^kCxZ8yC&BO5!y!s9Ws!=ibZZRWtVZeP|6w9c{nPHg;Ta`S?NZfhJf$ zY_HaY#%jESMaW3=Azs;*w~Ij08WG33HsdV8EEYn(zM{&)v-AZoMJ7)CchF+I&aykZ zu$g4t%H1EpmEQ16lk6j+eQ^||X1wG5fi0?vFUhhhO!E231%p9?!H^Hg?0b}fI0I8V9r#O0n8b%ah)3Z zHh?*kSpx0}LeqMrirE4%XC6)h%$dk0fH`BLeaD>1odcLNi$!!R>qVyF-#LlJ<*>J=0Ts$Iyd>} z$sy3cBRcdiB!@u%j_A<8kQ@U2JEBAXLUIW7?}!fl3&|nS|2^o;pV6UzAvpy41)cf7 z8Xfv0H)I?4pCyMt|BmR;zmOaP{r96os~|PXOv|*UXAT&skdMF2!ORqou1*3s2 z+|ijz4}7iW0Hn7fSIp+df7fenh zB=seuh{qVUJ;A;p8_ax3cdh(YAGw~ZfM$9A3CZy*p8?dP;Xy&~OwEFji%x^!XMK#> zGSZ?vYaKS2#aH8aqEv4v?5;JwxJG3`Nlbmm7!>*W&Zd092;_mvDb;8JUURLCkuEO2 z*nJz{&Ox-dQ^-5)IHDUBbK(S3A{nrg!shrh1!YNw(aEUc!*-NK@6iQa&!M$?0>5)g z?9Vo%+63*8QwEyhyvGcl@0-vU$LsnMwE9<;POTMc&B+(vnMhNM+8sJO`04LYehHpKw{eFhOm6VS=A?gS1~#yFhBZXb`4}UsjB-_J-z*iDEue z_I#Y>oK4N{{G-iA3$A+4_^|irB%8yx$MicxW}oslqigJ{D3wq;!B0s1B8)nZF@BI>2%cqt z_4IL*Bo`RSOap(QoknjdD57(Sm%iu9anvn-3Tj-5Poyy2_@IR zuA@6By^-r3F}RUyMw)$+{vF1?HabiRCxpys7y0BjYqA?dtn%oS+ak91cgByCV$JXL zEOegMpu{gkBHhf0j@cg99h2>Qo=YESa}$GnBuY2Vz|Ij%1)Xjtk-bi# zx)_ts1-ias>7>Cy1c^D};)fwK{FSYDYFJ<3wKI1>izQ=U%WZG?f4#8db0LnEJbgJm?zo{Io zucM9Zh!A+!uv>Hl!#}3&2xcbom+S@=JpX%q&K*5x^zauwr)}+;@T*EOcPUKGT5+fR zX4mx2*(*N5U*D2qCsKP>$^(P;$|+4^=n%>1(|x(tLC>Mp)vs`-ns&WWUJ8E#S%@_&R?OP))&)0hpZ*0JGC= z=#!Qn17LR0E8yG0@U_zQN&NuKj>ADzcQB%s0+)O3$q86s&2$Hd!&0%|EFd%%d>=gSr7jKsCK#(89e=bAbD~z07ph-;>^z&j8YUij-!y^)J%<{BP2G z=*b_X_bjN?t!dGye?WRSFuNnYLqP8!fb>qe{G0SHNc)@g?y|wqAx0~m9&FRd67sF* zWj0#blS=0hgB69knBMPd2a*)LD|`;ne|)Xn4$$wY%sOSzP59Q!^rv5b)Ho5Tb|aq^ za<&LQSkP~<{HX6w!V2&7{D+XoEGE)@rNmL$ht$~I`d#}w!fAvpn!=eP@YSmy`mson2wpr?YFvfK zDCVE5uyj9lY{U~ftvRxeGSExO<9Kwu;%pkV*X#6qOgdPTF1JR@*a{0GpkNMzLFVPB z;an|^WD|Esk%77Ue3Jc-DfqP72}g!XtF+sxn&z9h7Zr}uZ<8uM&(C~w4A5)cBb6B7 zA|GIv|8|II8EK#Y8Y)1cjV)f|`5Vb%9gAh3LvfeBueUpIT4ZYb2lMmgesHm)91YM@ zw`QDExW;l8CLG!|g1)txD~4ldqW$rGRgJ1Eq{Cv@pRkGbn=J|SAt7*Qyv$%RGBT_s ztnyH#O%s80L;mA)lXc4|4(stKqdE-oz|284rk|M182(HCEqN# zef<+9V{Rfx}1C`8vOX z9qhV4_8ne!w%r(s!x|K}=o`LDf0$e`=w3nSKR9xpAKyk*Stc^!K!-qFFL^uaKpd`s z+U*DP?ZL0lhVol;?|XfLi4^dKkw5>^TD-Gkn*d71z)9VAV^iv*cCec@C6-wc0kLXL z2l4ZpX`~i2;SLOb)H-P@SIGohL&Eif-|INw(p9;qr0ASu%0nEF= zUoh`^_n3E>(4fUAt6z}H>U&7#`1K!p01#z)&}3Oq~Vu^?|A|zmh@5Sxr3y zr2 zghk0rUMt&c4YYZyqiGBqqy7#>*-6fQBg6C?Mfu0|K&$mXk|@Q($O}N#|C=&z;9Z$_ zMBTjkmno^~>t9Vt=?Zx?iE3~iSN}nj#FhRBMrY*J9Yv?6lNMfId;V_<1>f%q1)#e| z0W8och`b)$egWXH^oy!lpN3hhEq_(_C&AeA&q12F;w)SykC+NZb}S?kSq~0+$2tIuBcU;Bv4@ zNt$c)2rpvK6dp5bPye<2Ccvb>{ul~>3}Mno(fa2%E-{g<107_CxnLpx?}Z0*lk7kT z8E>5mmh{Jc2iX|S=?~izD>?!6@uUz0r?~>!3_{i4f6(#w{GU7g&%rFt4bBz4JJXyy z6T_AhVW2e>|A*~U#S0D4Mg}{7@%HJmn1%abT|OoE7`q{LEluGlfzzk7z)yiCFkx+F zTy$=+8FB=Vv60ccpsfxUN5$279i@%>5J{q^mNtzW+TB0}w!kqVyc{?t#0mk&gp_jN zm=Gr$r} zMAN+O?22*Iro6?}!l-}hEO6kx0Czp6HT3R>{YFL}{9)Wzu=(&0p%H_%AQrn#3Eew#=DL{0bqhKTygpitjoov)1KoFKTiqW%8@AyEIHoK<9ngC6G;k*3H|b}T zImx#lp_Eh>9=9A@i2;5hlWuDeD_PqJ{H&01 z49h)b_yPM=-(z6!A#49TI4}bx^i$A4Pv0;2d@kZ2@OhYf`1}uUsLjdMU+{TEv#<(V z{J(?G4=VftpO+7O?1w0IO)ZNhODelTJ5cSa7gAB3ijWncMj%ciSS-N%tj-&LHT$>C ziLd|R0O&<{6}c_C6QFZCo4T_(g(eBDo57r~MHX9joWo3V4pc-e{qXS^gIV0}~Ye#7uSMMj>lK@w< zaq@29N1BMkY`*IioE!cL)$~IY`wLVPb>a@HNpS0boR+y{D7td$AxJZzF|`ib>+Gn@oqM^SABXYy}Ej%LJc}UH7m)VTsNl$ye4Q zdbpOTIj!}ile$$X_JY#F^MDe=KSa|PNkho=oxjNRkb3bmmJJA*z8?lcruSjNb9A?R@XPcHD>VXx>dB2e@0xV1=LR8|C?$ju@OM+1p23Lr(bF(%aDJpb{diTd$m)K z*#BPbWS{Og%Ja8sC(z%!ot_=txt)&ws&-N&2GmaNU4Kuh~SQWyv z|4{+(?BC;H&!|^bTUbxcl{FZ;LDqzRU`_Z&c)h-Y_$_mXq7$+v%mQn|1UXa70WJC4 z8sP%4B<2HmYt%$Hjx&qBFFbI{kYaM05xR|I@VuOTi#dZfglNyHJcdDopr9hYQuo0R ztnLU6I195AlSVg|eaQ$sLSHKZ@J-%cq+nNHwJMx8jvfzIr}*=I#J<=<7Inj_UW=G1 zn)0`R0jjG1ao*5i0$_l8$ibUuUSRy_-T=qbyBuzcn1JdPi{Sq%RY?306k=PI-rOAb=4B+A+G^F zAbwDXHgkj34`gXX*ZY<1^5ozzW}IDbZ+tJU7LXtj+y_9py2dz0)f%tWj1x8~1YZ(%_B z@JgtF0V?w$7reu+X_ht4IU%Q9d*404e(o2*e%cK=?Sr}I@lYq~>8oP^U~hK34FK#V z;txhw*Han!spCIX`Ca%Am73@bH>WSY41o}U;?A;u;y7q)uy$^Cb=}LK4%WM#xa05= z0_-2vY6>I-uP-3LtSWJ5R+XB$tW~PifvE^eyI%_)@2LJ-3%+@P@8~~aT2`=Fym5r8 zX<|g`z9UE)oepTvT$vml&oy+x*Khu~BrJ&J`n-Ey$L6@?lPN=2Pz-S28JCbc;onRK zI8y1(3^cy~h{gqD^7vXM4U{~$JmO!kH#(ox7~@Eb7CtVP6FSzF5ynD`>=845(y1uk zHT2WO`;F+V^>NPo_il90d7b=jOwf zAJD-8`qa*0fw=1C^kk7s^*|@*JGLe{Laz2nZzPUm zfOA0<%95(3lWWs^52V_%#!w`#8zH7^^b~EWTc2``ANS{i9(N@EW`2L0{as5LOQVu6 z*90-)4}(;!{it=FBvCSNE)R>Jpm=U3Hoxiw@bo{){DpZj{P1*BCq~pwn`b2yxqhY| zxFn-8fb1TjrQ8vIK8a9Bz2&Gx3H}*2X&fN5+a%TAwPa(mJQBXqh2Vb5|GgD026~Ii z14lX7yj~aM>kkhso&=^4W^%)1-0@uC!~0DbjI^ph1(*WPuVv-eH};7&K-+el`Q%0usPoAqXn zSH__9$%S*7EZ^Gzqq8uVTOK-sJY#^Bz*4&zSP3vDnz~uj*P%|#4q+juf{vf!bw_Ba z#psI5py*WEkIN@ja!|lRu!)UxMB$W6y#$pd%qsDu zp_vhXcrtMfuT`4j6V_lPAjai;ap36)a|RtxtmhQa`%;)~_8; z<#P=D?4`=>z|CC8I^xy0NOUHyH$mIM_L_(DoO~f_^hw2;w+)SZ`i8w=P^u4PBS7v) z+Y}|u#d(Auv9}5T2-pa8K#-N7_8KefZY6;3!ETGuwhfH5CwN57W8Eeow8!CWy@T(E z85nx}7&_ARt7J$rgWcB_GzwRNg2_X3@3`Xyj6hR#00{aued;lqKBJdj#5ntaO_jn zoPL;(vl-7W>5~A3F|T;-4-_Z|RmT)s;5oLQ+H56GE{vBA~OlTL&1QWaOqM97(JM z_4LWkcu$wovlEu=uD@P$?F&k7rU$V`DDaP8oV;Hp>jR0!M$nO{@*O?90FD7_4@?S* z`81#T|FmjW@h$cigA1QV;WZi))yGWah<#FEsyL)0K_HD>Jhor*wZ7hA&{>(TAUOD` zS3saYf@Iqm*ANonVVhz)AJtRhx_SZN7J$lzAyD{%QdY{dK=o{0Jn z)!?k>Qu5&CBIrk;*UAZXuB{>oGlM=OLVKvW=xL`<6F$to^06E3L_0A;5G;2fG4jdI z$|#f=YiH;oz2rmVN(UbNSLjG(D%D_@Z7AZpDuuX*I>Jke=qDJET+MJ)zBmO%q_@AD z;B6|oGWt1ilvs?()x-R0I{HB203RpZ=i3vy({H>$Y)DBTl*^oJezzV-0PDeHiNh@O zhZHnp{lC`(Je1dKbbBGLnW&GOT~-dyRg~Z4XI~75NB4dSa9NS9i&SQr6t4cxX9|BnQ!r4 zTqCiI%=8G-*G$AvgRfPA^x+_nO`XsH^>Yt_iL8dU;GpKV#@MDE2+{K=K=jOFZWMz( zR+#W>bJXY|y!KJX*Cs?_5#c8*!nrtk!qZ0xyAdFQ{V647RWyoVH&>fRDZGGCmAlMt zg%RrtKzg!6o0<)N%7(!rL{c>9HK<>Jq=Tq18B7d6-KT?|0`Z_F&ND&W&xjMWtSWE6 z>*GHSk`GxI7e$*c{J1v$9xM76(IFK#CoMID*~1dfKzujHg!dV#hZTI&tL0~!DJvYMs)_3<#? zds*>A)gWG0$KPI7SchY5?Z?Or8W=7u*dApXE|`>YfK`fEd|@@GOp4fCqRlTtb+jZ~ zSEen&Uk?AP^0_m%eINklbiV_0F8ay7*esC=%UlAC;k4*^8P9G@eoL{ry)~_8=NIT6r+KZs3k^1=wHzKQorOKi4LFTnR z+`lbShU^yy0~tx5a>a5D&6zEJTck=XAj7v&e!o&YFpWbnoPE5J53dUV3}=Q;TXb!w zE9EZ?C&y@SHdux+QH!Gi(6Basqvjb{%O+ZfML=eiybZ;t$=7@0dOvs9K@{6Uze|2HaaC0W@Z3#j=47 z2MhNRj)Tia3<*l}h053TVem@ca&R#?SqQF}pC7jt)n)A(?I({t!f?IJ>+ zJU?R1(NaQ_1Db0%xltD`1u%&gG&bnfM2gadk=LN@v2cC;;#2r(qb<$7@(L`MrTm6! zjE7&w+0iY(>!7oNc6~o_G&MdrO#Fz%ujzTi59X)+Z;#l2PS~LTkrDgP2^;k99kJb# zOeU;pM$)yX+6Y_#lxADvobAu*iF7P5kjqJI!Epq=a5Z+Gm%z|OSRzW9OKi)P#Ba*X z>jN8L47RbrPk#Fpv7Mjvewklz^mbu0=mx>Kbo-uUA3cTR`5uI_I5(4+KK)SF{ECx? z7yD7^^+UzhosUn%ug{jXnV-;kL8k5L`)T_M*AK5n(qyp+Yh^E!I_XO8ykZa@gv*VD zAh$E}!BJ@_J<5+EQO$qsN_3~ZE$wukVoBeYtHRcl^K==8?~=qy_nkDOL^^5-^I3-CVy2{5^@ABx3Z8k-)glddov8 zV;K14inM?CiH6y_#&tpb!P`yhL*n|ycF{a~eEjOPQA9sA;lh3t1%c9hJm&hSh5mrg z_uO?36k}e=&$h0lJ|kbHc?kP?4}?>jbqS2=;n}~&^o)=CS5QvJF4hI_`(;_2YB+J2`(D*Cuua{yh-V)C#Ym1USGjj6Rmo*0K% zb&Pn%630QXCE4Vp`Ds|Le}pxmd_>SBx6&@L$|#Y8nj~kivN15bgMJO~zS}B$1gN#R z$43J<7X4keSBEKsP~1xqeaH4LH}jnRk!lX9#ArYF`i`4yKcFb>f_|QHi?!lv)im$) zBa&m-K1(wtO0jwxPs9fw`+adWSIT$zlO#zc9nA*~W{scBAD_IheHQ7h!AZzw=je0h z4=_Z$9w-9k0MNl!LB-@IY0lox>vY`qV4^0-c| zRZ68ghXBcJ+X4N0On%2A`i^yJ(~rIDLQa%C=hUJZbO=zCb<9&^V)r_L!DEni;V*Cb zsjtdO^+ejKhLY^Ra<3crJav$M1ES+4#M)kJlki|5?&Gk>TeM)sjkp~*ukXS~I2G`Yf9;6{^&Mr~E;LsgFtAgTWb8MrkX#yt%pKr^hwv2|)zOypR1jMAPgF zSH9|w6fPM#oBsC5l9-x8b961YJ^1q_-=nrHE&htu6g0yC&0+h)y#8~{J+z;(*nI7+ z!K}|_QqmaoMy*Cd2f*w%b+`C(W_d(1g{;RI*zok!dlLB~t>M%D*7^e896mGSdSB(n z#WPcud&+XLKAFALg_0{j5@zeT$#6EuErG8^XoaI^YV-u?H*U(<(z9Mu27_cfI45?^) z)C!^;&%Q4O{#PR&5?10l_veOnl5$wmF{_Mbe`<;1h{FLQ)APE?E-srXheawX*w_Nl z=$NSJAN})eKLHt@fE-~D*;l+yEy?m^fmpy(6}V}Z>)+6Ayr%D zSW@z_=>UN|*iQ7BF_xXm7J8&S7ZClACbIkC8v={86JT`;KNj%X4MV2e3gGpd>La+8 z!=$O!qJzo>Mn{In$<6e@29X{l2!zAH&~AqlnXN|eZCmrGAA$ zs33U&6_lc_;#m%v;;U_wR-U}xl{gQ3_#bBY|H=pt`r8?P+sr$Ih-x+%V=eNf&&@=a?sai{hscqNI45`=l4Dcvi8bX1_?HUx?X^K7B0XAW4z5ri?iKZ$a519 zVf008CXT?~J9}yk6lq5TjXU{lHWwR1{K{AjTd=Ddd${}|Tmk-L4-GwG9HzSq;WJxJUOfA(#GY1$kpDwRYwFEPppzOm8S;unvh3QwUNTwU}cH2%J;X<0gH|CGNmOf?WW(g$o;ktjyFMz3jF_z>#!ud^e z`b9w;BJYm*&pwDCE2ek~w6Bf7>?X{_=%~r1(G}A_%sI5&^EAlVH;TKtYtKGekF=Vu2H-asIB1?hnL-r|(8PBVhNG6eN=}u%c2rcx{ zqPG(KZ&>IMy{A2+Lt3y+1B=hwj+fa`Q9yPl++gL?tR%?P3e`E|kEx9p3dgm?Yuk?<{D^Bf0_R@t`xJX=$ zVXD3uTwU*=sJJyRSS?SQx|PycHjVQ*c2slxakc`}^UOtezX)aK04|4ufjdVQiR>ic z$ZC=yFC?t~e=qU>?b@%5RT^DqJ>x+2r^}@T zW?6nd;yZ`zdw%}Th4O{P5_IjpT6zgC#C{L}1C_difoe?8O;mn{BlskP65{{~^(W~J z)}r2p`t$edK1!mTQJS6Dk$qZdS?PZGa%+voTW650O)Jr8otGs2vBnfFt3zMoVB_TPOy0t;B(|?$odZMa99sa{# z;GAY5V`$h{RipVJ_J-(?N)!ID!O569LHvae6JtT_2B5q0?t=k;ccrdnQd_Yv(6oK0 zY581d#MS*#KM4K=onHM?$v_-`hG8H{z+*`5_^~dt3;w3Boear`+(yktER59lr~F6z z^8!G+-~AlGf(p#|if7+E8QR7PeOTlDlt7rCbd5NP@b!LEw@~i701n>OP+u6bc49@< zTJ;${{^i(MYN8PrlWKX<4jA3a>+D(k#PLnOM*ejgH>i4gI=pN*nCi7-^$`86*mTT0 zHV=VMpJ}OG>HUYrMpriJrFb?}5+*y>dCdQw#<$F2obA zoUs?~CF9V121sc8p`JXZ<|m30ZW&T9%eZR`h4Hbgy_78oS~|7Lt%ZRn{^dYd>GrRs zW@pU_d!SFF3bpd}Jjc);IPuR@gl`zhHM;EPO@Z9x z8lEccoU;o^6WJlQ@1$Yu+ZYd%lLwT711j#@0E}*J!I~`oKpEhPzcqKU20a=`2NZH$ z_-^02L07!v(qYz9JarpAIqh`0)@q;MVbe_uiW8_0|7s7P!zN&3(vtFdt$`qm0>2b| zntr<8;^HS2ToTzW`$Ltg_&!AA#4pZQ)mqCh$GHM?j4F3o^~+|4l%A_vU50%qn{7Rz z@!;#uUg>vHB7Dh=Od+-^AW~VC+J*g1`uoO8{PPOthcV_9@6e*HusPeLSbw>4Z^fk^ zmv9r4z(4W32Zw@ag?C0{PzP4DC1#v3OM>#Xm){nK{?N=^wE?+kvKEtW6HBkJWa7M< zSRJ7|m57mC*6(Yuj=t@_f8B>X^ADl#!g(n3BMcsl2fA?Ip+hC2H^2X|VD#3PqE+Of zO;X5YRzZt&@jUPe?%dd+k))2o=G&2#fx%M%?n)}hCG-BWi$kOHmox`x~w&nhVr16CnDElALU5pq+NU}=yQo?6xyI>Jkbn`s*@&>z8`TO zKmVa$D2J}XSLSZ;v->D=m5d}k^_9kFxc8kGTcg-|ar^M0BIh*DZx(U~n)O93*>Flt z^`8W_Byhl?##Xdc97tZHZTAC7pwM?6t)IdB%FuX32HkzruV6689-1z(o#0@ylc*cD zuUO=z#7C)Byan&r0FQV(AM&X*$i;!`Z#m~DKHq5{6G0~!z#2gCVknUaabUzF4mBY* zyoyr(aUFTc&L!7EAmHbUEDvP+W`-Hs7NbKvfwuYz_eE=Ml|~);MxLt9>NEvk@S}On z&CEU@~-!0a;?^HhDvM*3p#a5i`Tq>3_re5m;gvKLw`xOL0Yn4GeJC< zQB(1`e40_Vf7%aGnX2?Yo%bxpw%TK4mT?chl0|fN)uyW{KPKGe+Ensoiui7NCg^vr z)upla9)paEAV91g*Ie*c!MJt-pBb7<{KXY7o9C1sK?gd>etYC|)U(!MO|j{x;V`Bh ztj`_gd3RQSs@TD+5=)83hPvzZwZISp=+L?)s!?AzG-SY=OUKpkQ$kF9LW)CpBsItt zH&;qtiD=i9D7C1k^Oj`rjW5lKvyMNa|!hLuHbbj%@*eZ=*k3u~R_oZerWYMyLWOZ<45X02xaX9L<;-X)e~xJaLo0U)7kLYVmO1+%iMM$THy_mltqlmCIl&H+n^B~Ogy;fofW zF=LhMd1&{{n8M6a4p9#8$u&ino}h{+#(W~if4nuT88YyJ>?UjbB)q;&Cq4!wxlW>* zEw#I@J*=Ne%B2H&5#O*6w;Cqnswh@wA;O@F7Os@A7T3l*nW_etZO}s3{tPY-g2QD9 ztX~M`Q!N5aUDAN53!VJnNO6iHqB3)_wX48X<^CidW!R@Xq#9p-h}jqKrq`F|@?v>MwcO!Ta&hgyOo-f=JLB0}i``0UK^n4q(HD zuE?Fdi{9M7{ms~cvMh83*=qF%9FN<&6wBlcdWZ5&e68cHuDf9+>^trU6+b`+QwOuLJw+N|GoE72(u|zHb@6$N8GP?CUYIv9ii1 zRT6uNrG4!nF_o&{D;MOE|46l<%rHgV&vQJqr$D}BQ9@JyWpqhM^3CA><3v-#(Z0J! z{<(d9*ZD21l!*2zgBQ{I#KF>O0`ZgsE{;!VQ=n9H3+1 zi+o=hkiTa%|LUdBd5Gtor=G!`R#DI12y-bd*2d-zwaloDmOLgHQM9Ro#^xMzle5W7 zn1^43g9ZuM6yU3X*h|c~qRpPZZD#&tE=TK8-n?GpLaH@)XSx0H%X0f|P94!tV>=;$ z!>R-!0kGV@PSnvK!2VA{zt9=pg+$5|07ob(4S|3 z|B)*I=+862|Hu^p^yeAiZ>|7lUG8l% z@AC6q3v;gZ$_zh$qH-Dt&ak2eiDqzk0M6f6!5ucM6H0o%+y27A>9aONLzAd;1p1P? zu%s&2zORG}%SZHbLXrq7go3m%Xq~PSo~}`H!|J&z0HObKli29CNhycv3`ZGOjSO&u zZU+ONP>8cON?Uc3auH6Ka!FIi&3N5e^&FGYvIpQ0$OLo(vR;?An$>V;Bm_TRg4sVp zlYp4zOAlP0}$dT`=mR(xqAj^prr z1}HNNX_7Dk9VWEZhQEKWeF&TMbhFpr=m=DtX<3Ij+5WBg@Uv3q1;dD4O;deQymF)? zdbYit0`jMAJ5!v?Ov$Xn($%@@9+1KBGk_lBM!>0eV}7bn&Ij}M`Xt7Q^zDGm9tS&j zNTxq4hB_JhtLn%TI*A@${&N8leTNI2tnr?QBu+WmUMP9rISO1R$6?S%K>Z!W&|k7F z+JfQ9UUc{~Q`A$K%*LWJ*Th?vl;CMZm*qC;gr<9%^-@JrWqSg0!?AG7yv0Bp{s5K< zb=e(QtDlK3A1_MBa}XfOonJFPIwa8l4f>V7$B)g2%>D0RI!WEJd1-9Mj24(PIPgOz zD@xmSWD>pMrKUkTYR*}n0gh(tS#F(mdb)4lz#{Pqv+=&h&+hb+T?iyec?4wr4<}bq zSyl`!KY1aV`LWsJyM_cNM9{P9*;Tz6l$M~M{yeAvIRcbn0ZJr1za;r?-8_C_(M9s5 zb{VJcZ;u%sk(ZFvP7%B&5!@AEdsgQKME%2vHU`jqjX;}x{qQnUV(QVkL7Gt_ryhhh z!ocX?tty;gR*BfTD9LnJ<_#gz)l|PL^U{^rLCU;AK$+K57ZT-J<PunAtW*i;`m8L592oTtxjb_cg0x+mLGprTVZT(<@Ls zB zL6qY1$n)^9A25x*U!GL}8ec?*=}GO?jfH_7LO83)nl%;!*Z#mlcz1Q{+CAIzD zneLb9ksg#3uQEci{>qT7KW*4PW=s8;C8Gctl<4p z?|x1&SuFdCe6QYx&rkx?yUMe_)w@u$?i~~D-pIJZS~eo7bjn)3NR*O#2?&pzf9CB( zb*X{n9H5_Qaom+}L0r0uK>0SR!tVRtUaiou?z_lLBf_Y)gzm0kpnR)H@(cz|pp6aB z0;?=jnW@UwsGq{R=SOOx*y|96(e16z1;pD(F!f(3MB@^*GjLr-d$G~C3yD(_z&Gl^ z^j`9z9UWo5&Do#>(0Wab0$ML9wKu<`^N{&{mwUI6MKMxT*&Z;Ck-dp713xLpH>`6+ zj)d2UZia0u{_tk;QK=R<%nLX%!4-dTM~Y5)8plnZPIk^6!;c9PNGk-SuJsQPeY z8R@iD8V^k2Qk9aHD_Rq*>|`?{9*0|;Fbk?e)Va^8o^N5AO{t;Gke>}q8ZI@F(W(DV z%|n7aKk1aFSmZJV`OP~G#-C3fWEPdCNKAIf-maeo4OEnEg6@a<{WInUYsZI!VoMff z$vw>IBH2Tqq@&mBc|x%V-xrLsq_MwjqqYRgBv3_|Qd^Q1a_S;6rS&%)X5vuMF*vVJ z&8*m|mFcOb-=*duGriVJDc@*uSaUnN$7^*ey@Cqp%?(KhrS;%PJm6|1PWi-bbbVK& z(khTgd0|a3T#_Kv@7O$KsE2@fI(X8KO$1_8KL`N|FAG*4B0%AVdez7%9MyyGOt(eI zYfg>>>Nu(W#>n(6$*}7#HGenL59;~GXx2_n-~>c&r8FA^OPe-Vd*gw!LJQ=FYiD^__u>a1B$!LA2@N)g7@G{${_Z2L191tSloP-$w6kfRl#el+# z(y&zyoO(Ooml`82J|pNMw4uUQVgk|`K1dO1Bk9%azZ`K#u4OF3TRvG{ex^2FArE_g ztdGKnOpJDUP+2e&?y0)s^lOKLWAuGaitRwY>PK znZR=>FhYqlJ^@%~aSvhjVQ6;RYNJbbjkI4$A|ydo1bG$=$?n^l3Tc&YTFcJ&)?y=w zZD%NoZY>Xs#>eqz3V!$g62x(euVg&}&} z^h@D8J+7;zC^LxX842|Mey8n&SZH!X`{j+N{pvcyU(;X8R%~-(n+_N6EQZyyP2?}i z?AKh)n9B!CC8C`T=m5x*2G;t0^1vdPLo~Vl0o^wgVcH{Ot5Ph1>$-R_J7z;&Kin4ZHa)0< z74f*$Ea+x%lc9#!rl$~`j+`OF*ENm(ZsMCiG-Y8IRg1-|+o7^bYZ3p<(%q4MyfK7A zc79Bp=$uH|=MyJTL0dDcQc#ByC`V+sH$=h$r(FTsXe=ZZGJytL5l{_QExGS$5z7R| zNcHwwdZ2#Xgz);hf`|gaf{uJv#vxaht12L$X(AMot*Er0cnub?f+hg%ZQnN8Vxc)D zHy`cWKk{evwDp?G!xhh578E=d<(++{Am)xj=hogQUyYR^pU7vX`sQheUd@p?Epw}* z5UI$p6_<(04*Y%?a~2acW&t1sOCMJ?Egcp4iaMPp%ovFM!czvrKAI4k`6YGxi|?vz zeLcE66g<24KCr$yrV>4HXqrepqyM7%S6bzeW!lMkJ<#^-rMmT#@lgk7Y7wZ8zfdt9!HGuPI5M?g8eCU5N5HI~**3kKrb!U^XHcC@8DQ~S&QxD)OQ zY)SlCPqIvhTBZicRP-`x36~UXvB4|B9{C_8`NCbQU=jAmoIEa+4=qClDeQZa+g9v5 z1`bC0RkTBDH};45M@C>R!n*>XM0IOOjNa*OJjA?oFcf0_2~r-Z(uB2G+L~~FORMjJ zYs&pyTWg{}zq=M;l$$#bZpiTqTZo53*2wv!-Tur9f7$Q!eJSpVkek5#x4{<0ZgxGb z-+f#jZoZk2g~^fLk6$0I)0v{gW*VfBTzyJs=J5zo*f#J(uTva-<^RTtV4T-t+Y7-I zw5Esd^z8c__yjIyBg}Kk&-%alU8&nuzGpJ9cjTa7nPuA+7^f4PB5@U0j zu^z<96NHIaOsnXXWXlNnP*{pG(bp?9weeIQkGx#gEG?m-@rETP#V3A_s<`}$%BCG% zF6biZz4OiyJl;_m$IvU-O2Gs!)CLjZfv#9QW^VP*#@U%Tmfygy>VRY_<%^XqBwVCN zljyTM|E|#e<*(2^Edd))$<1e0*~xd&0pwntuk}H%CpO}06d9u*nb%TAElEvaNxsRA z&(k$&kdH3hV0rSXU-dig4{-v@_s8AKhowciZEC`4<1;`9lFK1v0@)kJ?cW4biG_^geI8twblqvdDW*2YF;k`GRZm@KGC@x`=k_t~Y`21iuX&7>5vqQq3Zh^X(k?;86Sr9OV|1$R~0=?RwuYKW3%&Qe+ z!BWP+6n-UJ0`~(?>9+a-3E0LM$l2Q|=v1Dr3A=ZtCCe+9Sk-AAg>H4xJtjr}U+lew zSC;+0uPZGeCDJ7zB_SZ)NT&kQ9ZGiy5;r9woezRYmq>S)(j_3>-5?zT=YGI9<~(zq zHP^eHXY6zK`yV)lV=$iY{kyK~1FI}oYNNh_F#Oz-u35-Ofu4J_JJ%{xTLT2p&fa=j z)z6z7G`&HkcmzgqVxdtSY$}!>ION(N&z(998BHs9S#F>jwZUDfmQxh60t0m0Rkegi z^HDQ9g6|9IT)qNQ8r*=@t5;JgtA#a^ijUEy?By00Onl4RbHc)5{FC+L?{J`~576UJ za6Mj*tXMqj8>Y+_gRD6^DyxJY`oc_4-lgpBDfk*xYr6E-|4;?vsT{WogQMDd;gJ3{ zZQrZ@w#Jg-Ub#VqP2?L#HOYB@pB;U^VuP0|nH#1PoMpEd9|C{Ku3bk*?~hd83eN8^yL6f z?yRqE$Pyf9_$i;n$?9FAvF{z;F0)|tvy41{xykx{1}m2F5C0VeqHuF9-q9$gB(WQ^ zn%}c%Jl!SiN?(w1YacQMYNLdoP=rj)%7N$Xo< zp<&Z^{qY~>qRYFedx)aiN~1XI%KC&VDKw5nr`DsSBwZvS$~>2 zPb?goP6lvg%7Y>C5i$Qw3si5t`JE09?MmX<+*utTl%8SO<+l0|0O2J5EHoio*X14? zOYzjL>=^e6`AGG0N(j-W*K$E3=Fsv8-hGcK*14>%zN?v~K51w#v!2|6fe`vT-MKGy z4&w#Ovb$+LGaW^cY z(jYrsb0pYu5#Dv!GTiRz2A`VaOvZDAN=}6|2oVed2DOCBszMuXiUTZ!B~c`RR92fr zKy~zmAkOa_yUtkavm~8Na)~GRO|elo%z2ECgPgsKU~rBA{VAzYr;#t2gjmM`MsLC~ypCTjaNUxDi7c+Nb--L^EHp9xN=h?+ znD7=TT~$5W71xR1__mw*O6zi~jP^^0od5aDLb0jPX@cojcST3Moc*(omzh6Cwmvdl z-=iYQ$5a=2?N5D_+d1QTZFPSu&BzMt*#*(u)V4ZK;WM8}rJW(S?x6~RBxj6CcyY$x_B~cQ( zNbj4Mw*AC;r&$$->`f?j_dKj$#lcR1;2LYdP8qMvSJ80-Ul;u{(W?~)JT217#bKGR zZ-B29Nrqc*Yc|Y8V4{W>qVzbD0h6)u3JQ^dQ76;oJL^8f@kzIXItC?aqRr1dMGv?3 zGCWTnAf845SLmtt&lg%AA-%&Grxs;BZ1dEq(0ks913z}(42$J>cG2_ol^E$0evIPw zS$`cXt&{QeGWLc#>#w6(nU|AnEnXe*jxT@)HyhMi4D$L9$GS@zTNpi6--ex{Emirv zKGwXkS`!$^uT5LqXc;=0SzMuA!f)78(kXE+d>NKc`Duz%U2(f_)Tlw8)M-)to{5SF zk8-aQIZ^w5<#0{W(27qP?k>5EjkEE=pp<4>lJq!{_IgCmS4*ma>`Js+gNfT5NAd2` zlpp67h$My#DV#!;YmkN=kP>4DLgv4{!&@zB7ybTV4+PZxaSgL9tA#Ix*Z>0&2XV0)yV6C6h3kbUIR$s51~F7 z04aPIN|3_Op#&*>{`sYB&9`5(<*q4w1CYWmi@~1*Dg0Cukiutk@;Ppe11bF5Djast3V2Wuj=2V@c%~;KJYIne7eOyQ~1P5zf<`3 zv22Jkioa3#^k-v}?-R}@SvNf_s#eV_e=Ol%f12+^t#bntfOY64Q3qB)l~yYC)&W5t}Lx9Fjq$95K6#*xHimgNW|Ur!I3C^ za*zi@W$M*+Lw{&>NnEJOry~OA^-z%*ZDQjK*%i!GBqdeO zXH8SRVt&@d-Jw&`oo}4Bq_|(zRL+|3jl-S9Flxyc>FAwHB!IzCfu3L1Hf0z|CVW%9 z7T#e<`#q6ZU5BKAV2AD?;esAoahgSu*^4PI^hQO`bPFqD5?>cohH>@Mwm_$gObW)c z82;J_u$IqWyG8;5TmeRDThqb0dIAfDinLdL$BFP?9q&)it<`Y{e@y=_6JPBnh4`J1 z!O&A1?X0rC6O7c$9+57k$Tb6!aHSbrAaB{sX#rVzmO7a@W;843!_mR!x@I0COeFgU#H@f=*fx;e( zGYvkp?UyIJUBb&g<;W4T7c9vmjQBV<2*Mlz8lv6&T-?diK!pFZJ|70wlN1OMUOk7Y zWsmiaCfiX?jv!}`jb8Cf?XgE>ldwA?0R<};s#PlIBKCk)SsBTT37n_N>tIi_I;@m_ z$K>pcnf;RUlv|p+)%rYogn{(aSlY&I^JBT#=<~-MV+B$EBvn`l@i9sAF(umVh-Gy~ZlTEP{Ja(IJ9otXf$lap4g!?=J% z!*APO>{EbnR)#~Gv*R+t83U^VU*Hd2$;!~B`mf1O-7-Ar$C>n(S>Qiq4a2AO>qG6|$zVM_mdb{9bY)zx{cf@1F3-~!`}`^6P!Xme9Ow%Vn; zeDm&?M@-DThp>STT9PKy0a-+n>j7b2FT$L;*JA+#HnTwq#vqh*wL7XFmQ>=ER+8zo z<7h}|Aycz;ESdMj?|XlHdRugehn~@?y1h!6H+mJJ$e^tN*}y7NEsvL}y0$OOK}FYBGQavxmzMkC*M}d=E<}s6U(Sou^ogc~C}bNkRoTb6 z-UUbfSdWK>rtDTV6Xa#l(~r*y$uzg!6MjfQo!p;tu7}B^)tWPIXOt@O z?ygfi#%d4Acv+e@V^=IT~a@LYg9@yZ3#_p0kN(Su2<&eu5S@3ERUvEnDLK zE%|rB?4{NwdAMdL$0rl!VkHZFrDjdx}Y=ER@(KfOt-r(2J1BG zmcm=3v4o+wkL_vg>y|#t&&D>qlgJ@6cYoaoh3#+j+*8a8_<2RfTWrIsN%@#9Zk&1y z&8kgluo9Mtq>s(giUQ<_WbO=?(wP*dOQ2=GQC)wfmgS^VZCp!_t0E>A-Y6p40+*q0 zM!X6idNN0+kc5pHragUML}wV0Fd$h)5<4rUA|U&8l$Da&Smv-hdMGvT4D!q!{Hkx{ zuf;z{Aq=+k6Y5|N$%jZqv5Seomj3vt*Yu{4N$hruMSrP7DSKf2D3!X=OdE`Z!`8FV z_hRWeDnWY0`SAPD&Sv!})^Hif--De^SbAt@GaBq{uHePaFf^!p>^qXta3eln{`ybYT5#CL+ZjOFpTr9`h3=;O=^V67n;)Houq)F8Gdm(q1iDe@DMbpVaqoHyN*JHeC00Ytum}RgPHr`IMG99-I;h0R(FSY+ur$ zhsaQKvonRvkE#jI=DsI-!VAv!f~}kjWk_Ky$VfaHGjJu|r^z}0(nryoLSFXd-OQ~- z4!c~K9OiNPfRD;@*_%yf{Bf!rINYg;D(Gmku^#?T=!GlXZ>9=z_E(Q-hVEI?pq9<* z&}XyBHJ<(CzdbexG>sXEqOHBj}>Od;1JpfWA>>a*P+Q`#_jG{W_n6-0UQ( zb~c4pLARc=ZJ4R&198R=lmy%+6^d~2nsAWU_TUHp<7akX@usY#tNoeD-uBNLZaH0lR!pR>4 zahW!18{WKQ8wn z7V9h~n`~5*IJwMg1VbX@R;|5Qt*f!u@MWv4b@}<7>qQ@!8xu4Qe5+2`Uq^7}X?-u8 zUZ2aMYkT`!F$ellpIgSZBIHf8$|kOSaUnXY)DN3ofInD5rMtV+f#32x6E|7x%WuUT zD2DT4aQfk698(8&i7RgIC+u{tfh@TS<(d_krj6{#vdlkFq;Qz9HZm09Z_Q}7EPv?X zPjJnbZ~8{pn`WCm2B(!ce>|wQ8{Y+C9&;J#!D07(dk^>SDU%U-7F$OmX21*EVmEzA zbptFq@M(>Dh3$-Mu3emrGWy$U3ul;}cPeR0Y~GhbIlGx)ZR$(j=HeGWjfU%%WuHL| z$&`Uk>j(Go>5eix- zn`v)ui`w@)?L3Uw8iSAD4>*mfq`U0J#STypyvB~bh21$x^wi9@dEWcghdMc?EGqg~ zs!nJ<2imgS{8l2$6)0Lr-Nve4AC$rH;PBRD7cyCwD_x4cOM(q{S=A+TrZKMh1n0!t zT*xPH@Glzf^LGf`pJ(MdIMN1-zDrFs?wmh)@a~gWTWW7piMYXcRoMc~3s~%Cb*Gzp z4zyc&!XU0TmJ#G`X^Wq;jVzm)?a)`8q+!w4HQE)T5t~;v1ba}E_BsIps4$9?S}*JhX8lzRXO%B{>verqhVQ3D}*z3Xsg%e&`rIk2HH z+O8UF2?zphJ=ov({Cx0D5^`Qu^$jR41{NGmKcQXJ7~w0m_2KXTQHJe3{^Jbxv$Z1i z4~Ns!D;*C-R`7NB5G}tM!#Hg9pRH{7uvc#j$4lfH0O5 z24}9#mXTsBnY-w)_AV~Rkq(9=BFK>PW5+zRCPWi#5vr-`mll*Xqa{{8(XJXRO&`yh zGVZq21rpXx-llbC<}Q8`##4Sf1G_SKjrhrd-un7(RWs9h&Z-{^BW1@(Z9^ltezo(= z$#nfQl2n44n(lST9y=H=JF-8f!m#aLxq?) zFHD{wCrpCqg$nN3!@RYStnkp3{jcyj!9&7TwF^&!&v3eThujy7TB7fdLN-$CvECW9 z?*(mRM?{3Wu&kC5d|CB%yItEr)CQx55+2zB*2Sg%~yuDJ96Gj{6_{U)(9o6($=|<%Vek zd^4|_2C*+NdJRSZ#_^hLQJNCQAGfaXo9ik##maD+hfl1ZJ3oA2aE_DdJ4VM6ezw!r zV8E;f%jxA6Ty_dZO1uQaUF$E-&=p><%>$Hil=%>X2RNI`_%3Z~TGQV;ar??%m~Iup#QncZuo zs?d4M6b#^=5}T_|YO4~V#FdgJ!I!{Xh;$7@GnTF8GLMa)k(Cbr5LJ`?AkLGbHHh@! zqc!9a!e<(m_OKu4uP_nD$jCgn+uiy($Rl$E5f7>n(qQxNw<9V91ymu?APt>A+QVFT z2^T{YJg{469-+?5JKb^*Y87BVT*)LrmmU5@e-149XwJId{(e|{^>D-tFzL-JFHf_m znMZy;#pob&9O1M?BBx81*?L7SC_&eDVwtoT|HX&h)qzBRtG*-B4rrx5cibzadlC(+*#*hOVe} zF9&GE_OrB%5X2%<(HP_9)$6Q}UYQE)EUexVFj)+Ll7H2Acm>RGNt-DHuWOfT3a+kN z6}UznVL^*l3cvp33&P7Ro%<1?sK`JM(RT+pDU$Cjg_~H9B&HOD#VxNj+IvBBodtQH zZ;yZ)tys-ma!L_VEoUoe(TWy=7HxpWjYZ38^1DUbEeBe(2kF-qEdvc`(XRei7Hw$3 z9~Lc6ckAyOE$s2NM$5783PH67ahz*eHd_;qte4Q?yBbeI*X^v5KgqJ0J)kT*umZ}m zrVgMiJFxasmVK}Um1XxqS(ZuzD$CO1{z;bYhRU*i|BtflZ>}uxzb?x@B_H{dEW3E} zhb&tH%CeD>KV{hiM(Mn$-(^{-E1QQznhv}R;)l1B8T(C^m3EftuV(x&WZ4TaO>iyC zV$J=p%Cf(?vY0<**`eP54Q1KwpR#O$#V?R$Uy(s&+3`2mvTUm#D9cXbdi|p;n@aTG z%d*(~|5BFiTK#WjS@W&`tSmdQ^DkvtbA*`xPL@U4`B$>63gLfTmd!_g|F#lz>{(e2%jQ4hsc`Mh&iE}_KyX8HY%OChY zect{p0&a{ORh0y8RVBT(!XIRXPF11S-gewYe*wvq zcMC5Kd~?W7QhYAP*EH&ha$dOoz@lahFMI&T_?BfV8GR`*=&Cgyu4-|XFj!G+^`+_S z*=lsenRBVa%NHpH1M$<&C~NpUWOCu1k|fbxyqBM|b(`)yosuBsl|}Y;uVPv!ilFmj zXjm1%B3O&V^U+CA2$pa6Z#=KDCHBm?1&-Kq@!a0WRVytq3B%qxlM~Z8pm%kqeAIJj z<~+#DbakWwTn|>cKORlBlGwSk!;1_i>T6pDUG4Fer4}GJiFy~c)>}1%2e$4p*fu{T zOwP#o_`hDwGB{m~q}ByVJFrfGt5sp-ldi5x&o#*{LaxN$WIdrM*VUJfOS}u0bLH`a z9?^%&1{=R!En!9g_#7T^mC8)1hRiq_<2?x^vb~AALQXmwo28(cn+*i#Y&EOg)LY&L>40|Gh{n8eu zMf2>{=OhP$&&T7587354cbaPpHBztat5KOSwCpxAR+~*C`ih*sOgWaNcuH-2mtrOY z`UOiZwlpKiO)YBJ>=6%z&3m5uepxh4$L?fz7fL;II#m>MyX*6#y#YW{2*3C~2M*mL zSz=SXJ2Mn2&}4o%i{fp8Sr!oIYGWrC?@kEz>tUSOAZplBu zyWp84x&n1RwGxRDtl{kh2D)Qoi(*|G3|>1*6gGOn#D~T;;b@C4S{q>Ve!ocr^(35% ztM>8PT6*5sr&L=ZOo#2utL1l1pHG6ddrNpC*PeQ;Z@b?^DA!rAc-uZs!I@Y4aLdcA ziGN@3Mmx59^H6<>RR-- z^OpeRwK53p)SsVSSrfnU(WWWg869lmRzylZK`sh{~lF$?FXQ7S_dteqhJli2;vZ}TT8 zM-`(pua7T>iCQgcpN`x_@9Au=qxXhs^(&AcpTN)XJlApiYRB($pM=4mu3w0n|pE{mGN1MR0Xv zUi}PH{$t6eYbNG**^6X~+v~&NLRZ23C3lddQXXy-mlpD}?bb7Nha$>P=3Qkn-XG!- zRPwdw(`dg>vG+ZKeuOXivAiK5Z+9pA=)sRpL^Ra4CbK)Z=Vqk%KZJ5whVX$Qb{^{O zp|14L@%e%2Cj;zn?&6reG{e`h9x|e@zJo|>k9#b}Kj4Qv%eUw3_KE(Z<8c#Mw9nVR zz2BbbWNi_!+}R2 z-AkV6JeQcH_MLmmTl+LboBlP>jb-uWS}`_8G>N`VV?zF>_{$O3@>9iQASg-fy@-g} z8`cIG9?L})I7R)^L`>z}_-A82-(E8pSUj{7<;^1|jAOV!-vU?T?NMrUl~%s)Jk6#X zm&Y}0s#AGp`rg+(q$H`sgZlj4bs~qDz(K|M(skHtg2YT-crACAX^TWf7M}E|?8ggT zIoI9Jk40UB6WZTLogR0&>ZuF#yJKe(z-VreJ5&D4<%M zdByTUNCvl47E>QpPenUm=nLFSX=)qaihkj@g41%{!~faIO!|!esAM!#X$-dk+d|mg z@7on)qlCtoG>@gB5oLg-Kn&!)WRUH$lEZI;r$Daq@;s$~Ud{V^YI$|s0M?AHiSZE5 zCvfAIFYSz_%eUP}NEw?^YuLq$U0L%jbHCn@G&=A8#{^SIYzA#mJwyLC#VMskxlYM+oNu?Hxv9KFF+i;Pv5 zC5N}ozP@;^tsV2tkYC@Ev*Pn@`+f5R3Tut3dHuR?ElLo56Ify?65Pm>xmj2IuupOC zV%A=dAIUKa1--oq?+p~v7s#6(d~5$+ zMQu>7*Yv=)IU+3#k*W)U%;P-yxl_saa^;V?ms8sB5k{L1 zyjS%vnkNW%)SxcSH0H|KDwf(`WMRyZOFyJ$fT51A;`}f)@B0N|htD-ZOI}8WK_>d< zyFLTsXs&Uf&D}sfxzHEQZg?{4lIt*)5Nv_iW5p*cdmMArX7(5QvV9E0<$!fLj%tyo z6779xG3U3DDi4&$^=dQ@q>S0DsCEHO36YlKS%wQy<5GBKAE zb`p79HG4dOE#0NLz+2eoz$V**$9!qG)Gx(&uo@q_B;=#I2E_NaM11rzpZo1wKU}Wg z;~Ydq1Y)@AqtXFRRJYIsn)xL(B$j>-r5(GZjEr_{-L1Me&)UoKT}&1bU6W7EY2eFF z4-o=p(q&K9_V#s|{&ArS_#aJF{n5|=Rr!2iTK9i2QT0bZ|5xSnfqy+w^2Ag|8Y3y5;&^Qkg}RwJtB)~Ah33WK)3h4v;!o?ZJLM)qRL-;Ag3mdyicw!=Ed$l zXzYg1l~5Q=B+{fzjDml5fA2vYvKx-EwBGf5fiLvE;2vI~o6J?{=O_W66P@$4dvfVp z!lQV@k_UkNtEMIJy+HUaH$LMYckjna-U5z$YhYOua})LegYr78NdSg5w}stV0gZiB zeO82EhbR7-7?LV8OuEPcj|`rXogVMphaF40elK7aAdfT^Ks;#mR)#UAyM8Yyf(VB` z-)YE}%Z3P(u%6_oqT&f~nqHSRgWXNn3*;UX<9||DJ?cW@oOSm+c{vFv+k*lA<wRtk>W6F3ktW`-f}SpD0I;3=lws|L({R#7T5lC zOPGP2&-jM>E0FW?ATvhV6{pO)w|9Ewc6qgvAR)#7E$M^x>2@C&-eLF|-k}J7b~z7g zFY_o|77XtUhrq{sMTh$0s~t*)r&-g9mvD%H-JNvsvEU>4Sa1h?EC8aRuLU_pL~hJ& z(apD5)mq^1rwu2V7PW}wL*?D4P#g~wuldTp2UhlV`-7)2<65KSXni-RxeU& z9RSn(UAN^{l(WB_;t*Tg)*fyzEL=*r69N$3K|BEa_VpM zr8f?md4c{<0cu#^(b@3I>=n-IqG?|&EHzHjll7NUvDj2c8}H!E`gJ??EM?1(+KeiXd0+@_URvvEL{h zU-!q^kpZ3^-WBltpc4R(SAqua>#l(Nx-{U~(I1#fGk43uttQ8#8 zB7qKSg-Qz!zdVKxYW;S0P@jVp}{9g$3Nu{x&H`by(2>pHucTxyBeVSYcPxB6zJH}sD>NdNSK^iK+{IUE9OHv7P` zX&e=W8DDvKK+~8a9A!qSNv@zw5j4f47@a|@de2UbJS)Q^;BB+i=fEJd@B$jQ^yo(Y z)t8n+hPUewfv>)sh$x+Mc)a~R=

    6_~5oy40Kzondu8fn*b?Ss;R%(A~CqF#RE@d zL#6f^x~=s&l(`_Wp9zMN9qE%u%>&V|V3%J<2YQEqUH%dG$qtTWov2-UqC0nbec16C zj=u?D{tz-}9wLSwB0FsD>5I@qiEPP@=29(tT|LcmKT z2E0TZJ|h;91;hwt9mpL(mvszC4$H*KuH}3ULvrBNwO$rZiG~YwjPZM-bCIcw2k1lmU{zT zf74Bk=bM+0Fh-NSDBiqxQX&@U{dy6Z5 zBl^t@yBb{HeYGsE6v01UWS4EYzWT}(jPZ~vRh?beI)yS#=n0IP8dRQ{zxVAUT;YmZ zkPUsz{W##U57*;W9iLM&7xYOhReO|9tv9dC3hY`%XP2sD8@6-TZt1jv6I^+0DH5KJ zIU7DLaylLFFMN{N>f!Giy>$_vR0pm(p&BebQd~#qAtD$xX(qA%Plw1WJE#b(K2+-E zO}T_QX2_~z3(a+wcw&_PKD`UA@#HZhDL1afsDBcGPVa&nTo6fdrZUZ($vgz>=gkbq z>NGc{PUtb>d)|*cl$Z@5a9#+>BzA?GW85%AQm;Lkt*;p(&Q9Bw{a}5;ZjZPN=5zg{ zmQDYi&lr!=Ml%PC80YSfdifEXpJ)mNl zs#C{GCSW&OlPeriQdYq`&kM5^%pOjf+h!8Y+!rIrXs|@`6Y-S?G=)u z(*4-ot=kOax!%q#+^W$)W_);5v1vUvQ{34wICG>ai>6@*JQ zA#Ws+tRx2zy1;bjETw_Z^S8HVUCl?QN@|Q>^<^pTuH8EZ@uP2WZaiOhvZ@x%^L3!( zxfQBI0H%Dp4OAya;*OEpP8VW``due>uJC?Ezin92OkiavXBYry%;AUsOxf`E4Btl> za8LI`IeLrZ&pln*EJoKCN1dB7H~(R7k95XtpQigjJD+(9g}cf5MP9m6oVwfnc!dyO#0tp2K+_JR4~QBhFsH>irZ~jjhwdX6sIK$fIdw5(%V_Q{L+o z;JR1Ws;m{b?zMO9P8DhKt4uO z`R%eV%!)JMwW7Y}Wh$s{(Ka}m`$mIA)BfY}$7Md~wL&#&Z+-{qA@o>T1NU^ffjdtJ zPIKRZ!f~#Te`^(llU6`DY5f{bTDyUhq*gb< zb0xdV$~oIMh+pq=5?PoXy7pBQi7c4taoM$I%m_YR^#9}2#UB2CH2}U{kaqs*?Lznx z>Kl6{w2-^y^;$~JK44CQyefb`UEDh{Ie#|zQRVE`0_YpdKz-v|NXv|pRhgiNUA?39 zkVPvYdph@xr#FO2BC$WMf-%_+Hi>0RBtWOSns6HG8{^&h#_x}5PAP^!-&jBn*g3iX z0u+uld5lJ)oMYXio>!qKhj2FS0O21smx zaMJQ0a1u2LC&{1Qz)2Rz2Oyj@_56Mn(}^HGsKa&EtrBkOqB5T>L925&w0aqqzTeHEr>NU_SFtqVK_5r;D z#oDf{W2eU-6?>t=F+0KMuEGQ1e6!*ZaPI2?P3@bPm*o9-_c5l8I6*ooH(NC8BV)6t z4cY8)O;D;1%F+OoPBMEif6fkMMyDwm+`ni@0z>|b_bPASF{$u1pm=&^Vshw9Vc+4s_P#L(kKt4!-!| z8Frb4N*rpM>@uKgn+bpYcp(%3K3<61!gPVgu_WKxW6(Gjl>Q2cj+6Sj>xbMZ$LLyi zMCoxppmDtL>21xvnMedvUK>&qlh76Obr&ca>;i3)4$-8sH(*jLHA>Prn4EbUfyQx+ z=LrSkA=Egg2){VJe!N%!A1{^-g{&FWaBO0)A20A-2^J;6F3`B|Yl0zipQP7iHgkY| z)Jtd=sCg8Uc{vU$$4#Je3>wF9(?|iZj)mH^V8-9Lj!33NP>l!% z!^OLW-Y`yHgRtfK!1yYl6vhx*A0wGHPgJQtb}MA6*h-W@px#ClT^?d{dtmF$N*|>B!^gTlze9wpn-!qWxW$EtR_hFa4#cEdf4wqMJ zaXgts`oLGMXki7uh@*oNvnvX8U|Lg^?Ge0S0q6!+Bx;xrpw3D!t2(XYDx1pc`Lq zjYQx)?-=-kk?DqB_Jl5Ng7eA4ET1*yGrMp(x=z$?uGdR=(xDGa-xina(&E0L&VOb0 z^f_4eWLj3F_s?5-OEmYTTP+E!0~LUEAcH4Np=~wfiOn|rzm+}5{a>yZL|X&A$W;Lw zx(n1`9SFyiTT9pau|4)!soppZje2-Bld2WeBj6@e-F8o!m$*41uCECJhkFMi3&gd) zllPa`+<5S`1s}-0e7jImcPErFPj-!=@@0o!AqCaB8<_5IirZuCRHvcmBbJvVAy6!{ z;94l;#~@B017RfKCyk^6ru!d)G?Kk0ho}w9gx->YjeKXSM>Cl2pN#IKc)EECnp@9^ z$}^e?=Je5Dd;-(`FkrfWA^X74(&^9Xe(Tg3ugW3pTRn&DHT0j^X3+4vcE9are^!8a ztprz_Fc=Pgxf{i8&0IT=55`6lcc2@QKr zE}`9hTg>t7zK;f_FT73_7_bGm405k{W0G67_kMtmjEQSXI< zT~AzLE)1kJFdzhg1tEEKug1CxctrFraz#PU2=JEJW{NaW#_D;hsLt-I{D_O8};$%vyPv} zc4nlpU&E_Gss*?v7h}4|1W%+EWbO-R#ucPqyBu-;D#CpDE7|~+;rZ3S#RObM28N41sW|X z*2Hv9Y3zzqb=xKVvHDdgUx|?@G!>{}Gl)?-RJB=obn80#8Jmv8b$dS(+WhoLBj)7m z!-pOaV;Ci5FTsoAME=Jv>sw16l8L+M-XtdNMScwkzLNC1QdySoE#M)2ov`cxlGm9m zxD$Mn9MVhvvij~0(th>3Ki(*;Pu{E9?0Wrtqd<+*D|wJz3Xv0mOhQm`*9x#jw=WD?UuCw+gb4z1{* zznXBSwP>}Pdw{V~6yA)1G1GOKjSb!Q#h9qijpN_=W`i>#b1Yr+*tS#zj-l04M zga6Snq;W@4z!xXJkUEX*Z$<1`uM5n2eZb0zqvil&hA)ebo zkzUh5{zg*}l*5~){nlvw=XVQNMYMEm8-~@%!BA))bea#V!0NgW>T%Nt_3ecg|Km6O z{0S>Y;g%2>}1jDexb>1b~0% z6!;Hb0>Hm>3j7Bz0pQ;`1^$DV0Pyde0{_8F0Qh%Kf&btoK=I$70uUB>IPAX9%V7p{nEq?c8uz|x9e$o1dght_F zw)=DmsK!Y8UtxosaJOtzr)qNoAdLsGEa-BG-&q;l!*k;;pkYzS)d4IHU>3xDe-f$k za62^{@}!Cln)@dVJn;yjTUw3Am%Q3p0kvap1SVKGb?g0!kv{ypfx2ujqjj2ZzskG+ z3Q2BZ=&G^Coe8?nd-|E_O>K!EZVV3?3{sW`gFzgw#AfI2AQTcNvH?Lh6cn6IyIOC=4tHl_Tlvs!`q)gTR4aM7m`? zuo%RZJHK5!{w!T)z0fRy6U@(a4etm$j zJ2V({+X(Q0?(;UCfcw0s`29qvDhThvjbZ3OZ>tU>w_@E@Do2VAqGS7PmJXxV$z=K% z)JkAJ%E)Qp0El@QsWRZtoTHv;1~9YSRpJ>ja$VDqkB!BLqm#F z`nj=gasfEsRnmU-CVhizjtFgi89Lu(3C?$&2}Wi8DfXWYW<*U3j;Ah|dd}V7lQa^A zyjN@oR<8C>!Tl~$s>A2N>-wb{!K|PMoMq@U>}F-K)1V4 z@=`x-;k^}m7r2o)jvd1xo)T0w)TzHwH81YW@_2Y9mFdj*xk&%h+Nl^~QxT6j!-1Pje7|qS7hswQe zF|IRNClSAaLIG*X7$gW6{ai?o$TMlhtJ-pzx)vCs85FKWIzEB+_R4goO# zZ@`@C7GwubcVYM|DM|P}XC&(7vgm_DGCeZD;QcNC9|Pw9QKs)6Ova*NX@U9wD*X50 zbXO8I|IfKp(vIzVJ>BJJnPVgF94A5m&HqCfW?@P6gzVjWwozDmz>O|eH+H^5O&4-W9IV_G!E=wU$zc(Hk#Yn`6dzy}Wz7ou-PVu}TUvs*4N zexKcxEgZHB%p*8A!gSVW&a?yJBi4sd?$D&r%Q$!|35Xpf9|Wx?&@ z8HKbBEVG_}_eHy)h1=T6kk01SxL6+E)hy|Ag%)!Et(E;2+t< zjg>C@yJ>V|>nV&iiq&nW8fw#SJ z?>+}tw~7G8>(wn-!bqIX6Ich0J`w;<`bIdATU~E5n|eniCw64g)|nETlQxr)2)F4X zyR<$s-HRLpaa&u7LUbYs#m0vHO1So%!x$SF~kdk=v$5yN8a}9%nkI zu9E=U3$mecSzV9`=S*UL1m=KzNnwUF@-fgkU8wAjFgylM?t;DnuuNcUobog*rDRjw z(?x9v1`PiHkhRMt>G`MN|6~UNbe30P5D_IbTEr-g z=-Sv^70txYVUko|7MARP*Vsv)Zky9(SJy8yc-mqlSYFR;5Rn?lR*@(335YKM#t9bj<$;;2yz~pknGR5B6Z3M|Yu1y^q0JFX$csI0x`tAYzzM4OW)c z)tay4MmKn!pdl}z!l3lKZou^s)D39vHW3iFy?MhF3)qDZq3zyBnvTU#Om=sH*kF~_ zfhD0A=;jj~BS9NljdVESzrj1uZ}$zTob}E$4#XtcPN*M)z_<`o+T$uPF4R7A93xq* z4Al*~+6gJ$cXh^m8r|xeeMqxQFeu==nvt73=l(|f$o?yup@w*5p9>KA=n2|%%I4q!5Q?G5QB+u; zA>zazXgtO#6|+%jny%$kLPM9~rFV-R41tcX@-yXi-E=@5LDzWNZ#DXZpL40s%NP3j zzq`hkk)4uT(S0|rvD4ET3DOBUgvbqWAOP=rAb{2KW+31(CpZxB3?pJ^huS8b0S#NS zbGdm;Sgo`%HBk)o3plMG8bHR-;8@_Jglq3Wg8N_}05Dc{HMHv)&zPIZ%m)&Ccve&AP8{eKba z2YwaR{}-Wt;8#)oe-Y{jeihaK7omROS5f_c5$Xqi71jS2p?=_3QT=}r>IZ%m)&Ccv zegHb!`zxsazX0`Dymq#Nd~txq_#5p1KO5{f{eJ=Mzx)AYT@C(y7W{n{{5!7i-)F%u zl70U^3;vSp`}bM!i)7!w&w{_?`u-ns7A#;WhFTZIpCljw`;A7Ja)KH|rBptk@XI*n z!}*)>8`l1Z@r#E68ov^{jWo%i@ylfN)A)sG^}`VYJIXH4UUgl6^e^M$H6XwF=>K9L z{OE5ha`Vx@2>j^J&+F=Rw7EGpR#IXNRD5tJ_`;Eho{NmMj?T9Du|-$tNqWq2#vq3k zulMNkU`jl;sqOKPEzb+SbC;w2%@x7Wq!ke@^bG`dTD!~RBi=^&e*U!H0o`qJVDIrq zvJ%+aqfAHmIHdub>Dqf;lPZGjNKGy8>`fi}s~zX|bo{2AhhCA^0Cqa+}kxNs!TD5fgs;sj|VvdiOG zi$Zy%(eP0tA{)cgl^_jI6r22y5p(WIHF2U8dFsJ5!FuJrVo}gW^5T{QU@s&?T6Y?kGzEKkmB|7zlk!`T21l>-9L#oso{?p3xWc4QcPo zH&@2`N|KBP`&RMM1Jwc1xx<% z|Ha;2MpfCbYr~g$5z^h=AdS)~NVg~=NQZ!uBGOX?X=%7nKtf6cX^;l#k`|B_kOpb# z=bE72_qtc?^{l<$cZ~NP`y*fcz+gE4^E{99cjWEuxq#2@@be<-~HWN}l*(@L{uAEOmBKx>R4&0C{87g*>T! zO5=IE>d9a@L4*(3UOnO7 zzpEE4j-Dj^0S`l97#ml>t`My&S&TmW+c0S0eFrM`9Y}_Yo+N`34T$wBXBPiNIIqNfYPGX^Bv<-^yP*2x; zwOboQGSUqy;2U-P{xK3wpJzSsd-OMW3=FV05Ef|2g$4TQDB2U>=6mhKQRZ>DelTKpCE^}J`^Q6Q|IyYL+JAfn zLi=|Q^n?rf_?lZw-xMVMgoFJt4TWTl^ULgwDmQI>(1HS*&%eU@Y5~5Y0GQzpD-&{B zJkOo15o(VB!R85tc1ItC^q)@kz?+SoFzz9v7EOLD&rjxKBB-0}-CKd%}ZzM>nc@XaYX-5Vm-G*DIV2py0G# z>lI&mC#(%Suh*ixk@^OX{^rBedC2f&dcA`%JZT}r(-!w*ZGk+(@I>N4v0?qbZkSi9gZNB6xlx*W}JoK7fu%}crnB0QC)J@I`H zA;NQ;pzZYdyk2V)s@K})OA#W;#Sm6Guh$B#fnzzPL&dwcGBsGsbWIvHdLO=5C>0}$ zcTHARwBfdp;c0wfcp_~8O+vG$?_Rw-N#%R;(AHzrrMdXlW75U4ZAO=&?psqdEVFR! z(y(Za&V_!b+*O+Rfux5eQFbxe zpK7IzAff+0B=jo{JAQVR*x*#Fdx3fgR7zCvb%Z%KJ0McW5}zBuP#Dwn$0i_1%5UMY)+u z?3jA7(w&)_>T?vHQF#eneN{@H7AMD?0hMcc*)m%q%C$J5axFEeT+3G^lL$4Ufr8}{ zdFiBT2sO8pZ7&Y9yG-uL=A&o233K>?^GcA=Z`OB(HN5c7qR2VXFRY;9(HWe?A4jrT zt1E9MnlHokDSz5EWH#>!t$mHjrZgz#4Qih$(wi|gX0520c$ZOH(=)R?|CO8VG=hMg;3B5j#O^C*^7 zHCqtRPpl_*cZ`Q9gr9I&td#YNZKw?Cqqnh*pC2{9_-<;M+aqVNGrUM^%|}n#Iy(`e zZt{V~@`>pp2L6%rn(WoxJ00clB)@x2yZMgMv4yq4B~RaU^Qe!c(|TD~fTL>WE_~V~4lxESVJYo;Hf*YV+o(A!=)! zPNp--y<&4--N+~}$sgC7ja3gw=5wQoX>hVK!?51!2_`y@yhg+6Uu~v=!7KJ3HU^_I zay0w%5mz%WR&Y@=e2BL#aN-kYwa}6>2~G31>$o4ux_6Aw`LV}t&V+vF4dDN*ufBT8 z?jXVO)?uMw6&fe)UCAO(^MkgnNTI$B>3hrQPrn_$njkiPwSgLH@x#XT*4OOL`bY8x z*WwD7OoQ5AaigfkIX9H-D8sjL68b-B?>`f2ZdlH}OyC;GE3S#9y)Dh^(1feeewg^w zb$tsJUG6R=Tg3IeNI{K8PJFG|LJN7UPjM7v>=|nSnAn1PHVEA#-MkX;l&5TBZwc9kPOb}n@B8LhmO*Wh_nwrXi4F6<;C zdzgn)>$tDt)wd4Fu_FUHCPv;(3iSG`r0ABayh!DwuY7& z{DWry-n!2(MfzUEBVqO9Na1!Hxs2#+cGgumTiVGmor^4*VV?#*aFdL? z=hGS$$;`Mh;xz1znp$M9p-82Grd_R&(FfGFRAW3CAPo3 zo=D#G^7=kS*IC=6X_u;3+M3_4RBL<0US)yt43{21Hc~_TF8UcEe44_ObSACU+vZVxOeAIQ!?ZE31YEptFDNNIb5G<&!n|JdUA(RD_k4PtBym)= zyV}WCw&bj!s#@VxzK3CYY;VDC|D(A645i* zXcJw3)Nl!Ts&fkeFkU*Z;d*>owP2KGKschlQ)8Zn+V%zkEnWAOpxXrRnBF7J*MuC2 zNxR2Z1

    OGyyYf93a=o+JvAw@NSgs=MgXDz9vvvgYg%rGL=DUavL{L}N03-xEQ*CD^rrFhSU%IlQ zD*<$U-3Z>@cuJaj;0q0~IP7JAQ7vYw1M?V$ke+Dl|CA*Cxi*-jP#zJz0mqYJIcXw?Rc>N4gq;GAJa z!bfNf_wdP@vf|bR2Wbxr*%uM7ggSY9<*m2jg{YMTJ7jcuvaMs`n6Udf6F4~&m^c%t zeMzF=2`2O=RW)WObY??7BYAB9hW0|u{(K^J^^N<-sa4#=$?(B9{!AynnCjq;+0mtR z$@%pDpLR6+%fXqmibLsujvsb38wzG?3I!_-ZYL+AjdoV^3OTb47Y7UQ9>?-usSymA zysE-Dv^tW9rnV67T(*0fWhM0yv8y5=XT|-?E!vW%mI-_uk)fJ&E%o3FE5n8~#Z8C4 z%wp6xa2Qomo8)p;XH$FR2qEUt8|2VmleG2eRs# zy*h>(s{uEROQ!9WMk6iSnN%+HJyJEAohebmHs;k?v2P^jWxp2hpE)1LK;WY?xRmOI zEQe3dv!p2JnHaKru-kV%pY2ugmNH=CsP~b=Sfs7jD93tQRzr~Pv;3N*saJeEv}hkE zmqi%v@VqX{K9bJ-mU9dHf-l0$h&C*noB-+g@U9}_+k?YVyQc0NVKv>RDzR&^M%CgA zCZ}3(*6n2As50m?yHY8Z=x%1R${Xmz9^bt?l2l^6qCen<;=wfBb}yTD=M1isN2xXW z7}baYOq0ksmzCUzVuiL5gc`+*0}6@kL~+wYSVh_PGxYJB$%{N94dYiAa*U?@Oq@aX z=+mQ1WiM)Av1*-Ey$mkHEf`JVb=gr&yHjv}Hc$29?vXPC$h>i%r%JS;in^nW3a5-` zlhjs|m~$1Ec7wx9fTglTmX^o;B9|2~4F&q%3ywqwKIsZhMFl=y^TJ^B^3(UlHV?qt z-JY>vG_>zTe!*RHYq$S^>HW|U^h8kPk1o+3n{FgESZ%r4G;v0AcB&V4qlR}At^Q#9 z`H92TkH7poAWqS!GryXAe3oT*i1xy#$`@Vcdj_$QbR_e3HxO;z$voxfqHM&e?oT0z z0x^E7`LyVrYuxzz$oa=!j%PvgcBL%JGS!6N3St zLL9$$E=6<$%3?)n?OOae z%$`P6M~K*2tt?Ck{TOK2%tvdiDxk^H7n9Kh52>d50C%GmuaJn%I6zO-wmrn6j)Z4RdE_{gzoidw%${L^%OwO+` z7+AwT*TZJZzT>s7I@wbTzvONm zy)=JjFyon#f1AOWz<5>%hY9u=hc6Keu^>08KWenEp5Qg=7ZQf*VRjSMO4&_2>@0Bh z2KvZDKP3WbPw6)4a{{Ls>I+W>{H6gvZ#E0Q&vCKqIx{~z5{@OnPi+B>G(k6vOKCqT z4_4D!=@9imcX_Y@?P#==``|tbLuu2END_|f2-qLxl3f*sJ|p>KtCcMpMu@J;D<_K^ zBFg2`z6NPYC(~NLI23o(zXoYpL7GkZ0$YJztb#PG{qCkY@v@^Qt~l)59m49eZ0EBj zAcVmXY|)Cf?ZR8T$PM!6?*Q5*m}==jjXd62FvjjEa{z zmU0BjkY6#@wb}%7j~@5gEc4_~HD?Cr=ru6ByZ^94xvOYUST+$R*8fZKu_UN;f{S5+ zrYERnoC}$HETC~<%n2!MSJ3JuU){07q(e;7CVWPHQ-jJ_DH#0NUJzij+9hGqkf+A7 zZ}SNqW4+mV_ z=Fe5UYuvuIjgK=u(SJGMDrn1HEp@2A37NI9QMOa(HxuN4MWJkkF#C2L@A>o1F-QWZ zrHfHrLuFu~VyIPPpu%b(r(y&u(jL-e`)+T!Riz$zHJHa7QhhKW2h5)?^ebvf49|+i zR|gdsLCSo;uUYhnA+Gj5@~hmet8zW^1$p2Y2>JD=q}$WtoQcIgKzF+zcX|Kp@@(t! zEbQ`*?(+2LayOt@j|jTb4SJ#vI=}z)Yf$Wf6ZY;W%(e&219nKg9pZI4Lg_3fMimv6 zz8H& zZj$57HonQAppx-rhn@e&jgt{@v%9<&crQM)5CN!tHT&LR?$F4Kjot|CiF|CYc3tBFtuqznJ$z2dCgX#8lLI@Qp9E zpAD8Wogn4>Z8aCT%X*-K2{C zMc-r#Y(lZF)GAw^3>+qPy7GkYs!9IUoU$O7dJOVUQWvo+Lw6tHM`Ql77jOOh&LfE*1V-dzhH>!nC}m{=DBOOxNq(;dS`xTW1x~w6JGF}MF7g%7Fh~?1NLk5R zt+l+wd_&%S7ixb$Q+4S08;#R~=DAL+Ccbww~Xsq*p36htqO@$U9j_Gi}0U zS~5^Lyh_@T%~97wEy8%LR$LH5ajbK2V-2YDx0JK4hz{@3E#O48?pMzDzu>Adp&%^1 zlC~x2iO*F8?}}d#h)pH7O_-K$W)&MDk=VuD`fstMUg!T2OCnVJ@sC(i9NoXgl0v>V z^xkc2)s;E`pcm%zg=8Egv^NhunNLh2gW#HB$@d5CDUVMx{MJ5LMa`Io_qB>u@KsGI z_g?EQV&7D>zPn(*(d@p1ZOTg5n)zo47yZGFtSkaH=Zt3I&TaX($_}~H$W@F5su@;( zmDIU2l~xNwIdBBD!0Ney7FfWa3APIR(RLOA$5als>9I{ob}kpvV(3>3<0cP3uokI! zXB+%>>}<2tUlgCLZ}Lvwy)2)>B|$CH|ILu=^_%1_yy!hy>9evr`=bfp7B_5 zXT1OXO5DP`x&F7RREjQLo53b zVd5z5apLm@mpTb*q2Su!JG?wBl;$6zv@=;l%`E)Vl8{u7DEB`g_wMr{3_kU^QiD=U zt83b|2=JiuQ+*cvo)kEskSU53I4m&46otwRsl&p6H~5f2YlfOG+t>CA)Iyp7@X!?b zTE{Cedt48_wvbZgz1~L+CYgYaiS?dUPzH#<{(o9Yfyibkih$HVy;&vO`?>$>&8C+_ z+81d#0qX6hg4E?yBGn!r}V`w)wdpr$`bQ$x>xl zps1W|Ks9yd=~MFF0dw!By80+OSo+(bEwHh8y-{mr z3pB5FpYs)?dg5^-c~oTCscn4@j}^9tc)G*M&cd{w!h`dUyY9QoUn<(2HBV{P2MN`x zPj~}yrS+C7I@ne|8h)WK-WUUz0fk%YVa!&QUF)G*ll>S0zh6@p06o!09+H41ot)g2~5Fe`RfT`Ys#E#=4eyv z0L+F^ll-mK@)t4gNq}p)k)hlKZkgd3Q08$u=FMVel2C0-t4*Ax$@2YdZRE*bRIuMJ z+|GzJN;bDvUZ9WLn=#($29}!x2AiF3X!G#T`Z5>n3$psQI4*q*_~Gn*SOr&TJZ9pC z_fVLF84IPQ=$22iu6nu=$YpCFA&RTMuj+0 zh9@mv&lFR0s29#dJVD#}jqrea4Gkqv&(p2Ne9?oPY2IC|cmEB0m1I>2Jg2`2sO&pr zs2`&XB(($`Z&L_pORs$tdEJ;j$DmX&k#H`ARU8V)_~JhnlBx%y$v1nF^frI7i>HJb zBkPu5W1#zvsh&$!AO@hWwc&?j$Lv*&NMYtOy{)f7@3D#@>sO)>iFNYe*fd}a-TfYE z5zgpc!;*o@oNUIv*-P*IxwUeMpVxKI<*Fd^4XZyRV6Z)%tSaX9@uY(&HVKqh)y4^N z(=#(`p}wSczfBA9Mfwuep*`#AcMGhjyU7yIMlIT|8<6vwlUqic6LwLfNn z2=B0k<89=XMoNOHf1kgT{^<BGei zqi|t>w-8k4pBLZ|O=Y)b1~fAWQ3-vj2+3@G7=Cq5N{Tq@;=S+I?T1A`EcOUHIFl`i zRQwj!sIIU6CY--hV{4hgnX4q^k*@Y>N?K;4-I-Y73Tg#eLq$M}M_e5|Q&`JTjAJcg z+x#PLaVWGgp`gYp?FR`0ul2U#gSQ4RvFO~S09!Ryu7%l+QS2LP5~(TTp)0Cc4_KPT zIN#eG;fGNyYqPxMPc+ZXb)HK){3jK}UNa~~C+}d@ZmN5}3XE>F{YXuX`)|AZ7a;VX z*}ZX0{W?yodgCu9^31Fft&dRopNso%hVoYCqLwK45?z)w_tFdg&+`6qa|slRB@vCX z-smsah|<%<*Fp#!NaCc;IxSWv{~wY;VNa#Q;iB!opbW>ZA!tdV|5r~|02*Rq^n zlTI}`UcxwR&=`S|$8PkW|AHrb2QS?&KY4usP4j-;UUxgM)BMGsY2KBnYTX%`Zx##? zO3>C_5>b@@*!wP^mC^mh*Oaf8GITbs`*3$?{R&^F*^})1OEr&(=<8HZW~sO4ZMJV0 z2l=2{vjmnq%GU(Ehz>tdJ_wp>c3HZ7eJHyPO|M(-KC^I|Koaa6Ttk7 z;8ypu^-kcN=|5mgDXcBptZ}!F>9G|$qXQrSL<-MVd4q|CX|&=RfWDbkzM_`GvW0k6 z4D+vJJxcn&kM&u^{}}55By6&M3MH6CqM*5c@6TK>^zU>1oqo}522}v$Zi}-^40PF> zX7(7}k30X)Q&#@wDd8^8zeZ6>kV}~8BI!aSN#kK>tOjZZwa{A=hm})IHotpfnms47 zA_DcbVsq*FwOSApt3IB80J!@z&A*9q>@aGpn%#4rHr-Rb)%q1Ri->WU)i?7OPAP`N z=W(@jyI6q2Lz9{pgTAOI$b(e*>+p{A&~1Rd8&)OM&$3|XS3)-dE$5x6{+)~5og*A} zA8yKHK-gwT?5=Ofs1X?ygC2Z zXc4=XG{CH$ssu5fM?vjC0$Y>T{DiEcq3a6Ug6`73N6D<69@P~!FX-*yNZqiN6kF=b zUh!rqNLfQrh@EU-z|#27@% zOZx~;l?nEWUhd$;hN0UMk^{O!@?0ng=b(qs#L&xte11)}dahkXsxI%6NIm>W`4hv>Zcsqj)#1FjU<83m6W5m! z(PBVEm(lU4B*=_&C8BmS9(5j+>H1tx+VW9SoW?1j=ot)!nf7DB0E7|9KxOg8Hgg7PxRN*G=7LC!ryA+(>gwrQe-PH3!86(B^yf0ezK?fHHFaBq{Ep|vunDyDp}q`tazG@&*3^cyZ^0K^+#iIr+rom~LAW6`MAI*#UKbg&zaZRD!bwXW zEISKr=diNk#S(Y^krB%l)_kZhX*>Nr=6IWer)(KoJed^D^qd8{9->tk)n^LOzOK) zDy+fMvm^r(p~j#MhhfS47`)d>N*@*q(cjt0DKEge55@V7ZR$uw#%w!pB4K=P&Z?rG zo%%aIw5n9ZkGMQXjyVFlK*`Vq^n8<^6kPJ!;Erl#T5JM9q$s5#nm&9W2{|hTBSz4V z53waEbe^BYt@TNc_nUy(5=(QTiNI|%8jewe=9Yk>u}I%wBJ0-OzhI+HBkEpUnxsmJ1# z=s?%5cwwNF^guh!r0)~^3KV_|qBI$W22c~VhjE(K?+dCi$hXz*J4K``{Vod`h zAX)cSv9Kg5xh(3bb)y60z2#}5cLOYX&K^7|OJA;3!HT2B;A_+b=auvoU;ypZq}6yZ2V`J$eujTMw=zSV>swpKZW<+8v?$VZkw1^rcg% z+1!fFk*rd%IPAAn30#?8nv=bk`gp2}2((b5p?HC-4oo0FsjqJ@`+i5v@%W}Slx zWxAM-)^K#48AzLh;g$fSV2*juTrU2E{ojKbS5@CT@m4owjO%r5G3A`$xOtUJfAg?k zHcfLxeAkqcvN+t|hKhZ2LbUWD&Z+o|x)c563pzR#MO2dlenJN7x|(ni?{v`JzYo;`$aw zjoJ`h8ZvA6K9((vs$@zkX7e`@Z*9SU1wu6x(S6&N<5A(y)hzF=Q=2NBXF&+&VF~VHiz8YoXHYRAwu06Oh8%Bn z9(sB$TbX(U{U}At?$w2+%!DY66T=Wq#y#qi{+mG{96n_0NRB75EWTSZA0))?(3J!28{EyFgn#K)8fA#8U(%`8vMWB8F-5S zeP>X%gJbhjLFlF@J{l@wn09hCGtKj&xXKj#N@y6!DHi84A-^V(51+VQ`twK1#b z*s7$}D)HPZsHnAMhRXo8a(qeC0`xZU>PV?-ld45jTe33J@$o6dZ^)TsU4;@8#cApA zm5)l5+t6|B7zuFf@q4Oq zC2p~E@iA29#5DzkG6U?U@+^6yjPc2;Jy~)+DdOUBg5n8W;t2p|@nqVdF*FKUWYd0l zQ+XKEeh5>=7n6Yp6PerGvCCZPbMoP1a)kr(ft{K-lSWQWRbS>3t~oN|_b{;zmgDfU zL8&r5bTU0H(p-U$lLTX$6bfp214?VoBPFCH?%}pkix)yMWViNBadF@5x$Dz)bL}I2-LJ zvr|dL25%R6Uc?^M*IxvA=vs_4k*z#}j1Y@^rT3Ea43iy*r-B+@`}eRzImObMz%+KJ zP;;LL^8q=4LX6c&WU)e+)kqL95yEL~$tyeV@`Sy1+0QWTo6>;O4Se|VB>TcKaL_T7 z$djL{y3V{(t+-rnK&?qCkk7@EPeztc?d{jh`0>=*vBH8(xlwK_Iga8XmSROFt06jI zto&%a#M?K18LUnjd?xz3MLZuOc+4DmBvg46xOfx*1UxFw+-&EB+5Zn^?-*R^+NfK{ zwrxA251!=AHL_ zR1r9O+71-8}K4F=9n1>(ba_px)Y((vb6`I;-BX*Ry?@`WmBi~bav>bpvU ziXRHYIDrsGsxfMDymSMM+%i|9q;J|TQ=^XoR=P$-GkB%On->V2**o@TyBryw<@;L5 z^Wc-07+Uw0*&2`D=!n*FHDT&zi1z%lF8^7LZ_=^7H{K=p_*7qbymN;DA9^(~(S5`` zSlp9{ML!QfcI=0Y6l!0Bs>QC!1spqY(puE3PTQga3$3v(bviWDX_8d(xWw>!z`P1{ zQ=PVI*BKuz^Jy^ff7-<-CI0`5t5_xf;wr=sRr;*;zPO4``7f>ldjD^(;z#PgautE_ ze{&TIsRCPoFD9Z^*W2g6aus`JcFoKE3}FSJB*X)8%8OW6;dmyVbwK z9-K2D<6$g|!3UTq@oJBtlYNeM!KT;HJJo5|BRsDO>CBf5K=&%#`T{Wqr~WsH0mS+R zVp#C}Cx}sl{RLuVhW-O$@GJZ$h{3M(1!B0+{5uc>Te>JBH#2fE99Eme=fyHr0+8JO zK;8hN2f45Eh>DO?sG4W>+P8=+BeQN|qrfw?jTtPrgHF8|AhiBujj~JhtCa^=RJbl9 zrF3@;S~Yn@Nn(jUS*#ATh#-1Q9je2n!ZB_8o&e3|jAp5dE2qosYql>*&nO*Cu(%VMhhH&t;+_!v5jehH(pyGOzu{iDZo9Yk8GJ^>d?(dx0 z!i%bsH}4-Bo5r7X)mipl!m%BbcUGL3$fAgeYg!KY$eM=T$LG~Fv+0$FDQedlAx)>_FQLlxDlSIfr+)@QOMId&Oc;4%9sp!?!!PXLf{dla%(ieI+|$@>_}^>PreN zAu8V+Su?yC?c|(tZL%h%EWdAsjm~l%zd1arqxB$M^lZ{;wym@>`5+L004PQ>4{opu z?x}lc%!`GYbq|U9l!vM(>|*C-{$+lxW}9tRH(Z*gL9x$rDbZCtt?O2e$m_j=s^+N! ztIU)UXy&(%BqCK1jQ2;1!4pIr`3H^?_7jU0@If-WkhAE`vT$8dB+C>_-6_aIeIV-v zpzW{qHKo0Lz@PWlKMz(4$4*zXhf}Ai{I(uDx_4WQ!2^8n?Y^9I;;HlmO=y=!)n*7)ZW^mvNc0sv>*P^g| z!}N0o=uERC^2)tj9MFR%V=&%S*09Gg0f<fC&J}tru!n=&f>lN6U%-~Ilkn1Cq4jYkLOs~mK3yO0!+z;A;nTWgw7UL=?DBAw+ zc_exAJydY_d3RYje5gQRhYLdJ$Ne}TG7(Tg<2)cZ7(2lMS}ay@&>Vq!M6yL-VfH=& z2)I_i0W>CM5O}JcTTqZTplAdDQXue2BjBbi_xtK7!d<+RmocgTn($5w;!8HD;R4Vq zqd+T+Ekj*NABE5Nm!h7bKmHogG|V3zoMl&lwqr91ghtI)2P;MxSwat`qdDkpDu?N7 zlSg=3I7(lExzqv=G<9NyC5LNN>X6>(9yF|g&ujMvURKH$yOa&lcAHRuspp~X?4F~u ztI;XEhE&e16kQLvG?n~nPuq`BTXXnMW!0>S({TpG`k>zga;rea^vID{%|4WfF7 z-HTIX?eOc;D_MRR&~1PmX5$+hQIW*9zBVSoI5J@IAZ%1{IQJ;eP#_e*?V1*g zf23y@`ub&NKYy9oM(mpE5HWH{8cbV##<%XEbAG~5B3LlQVt);~l_xgtk=prlQ~$@H z8+3$g(cgn^4tQjd&E++`qV>3BVeB1s{qfz2KV)0iA-Nc_(w0NIXW4o7f&FubS7W%RcGAsWZvvBssEL7fnF$?yw|1b;W z?O)8oU&w;x|7I5CXZ{ z_6Aobdl{$^IkvXssWpLLbx1G5*>mlQC)j1OZn&sv5#v!!V_p{2OqX9=%O&bQS6}va z6u!t4-+-YtHpuScrD+w>U*0^{*XZlH&`coYj6%gJmVMXvWE??}E z&(?5IgkAAGevvhdTsRw~j=b4}=o|MUMR~lvQAh@F#LV%zqz&cR6hgD4CFMq1zG*Y; z@m&QA$4@E#!&gZe5OwB7a%$(LiE>HNDb62h5cQh%H$N4kbl9sSVi7XGFmIG z!!$LD`y{MI0P04TFLgHtZK09v5ryWHSH;%!0zUd$=dh}WQKCIU)m^kp^CK=>TWGH| zJOD>#SJfefNVdEjj13z3DozC|a1FvTsR_L(oKMFcccbmOW&XmOR%Jm6X(lgYKEqj=--m*CRbC{VT`O>X^HzQXBz6o z?+<5G7MDUR=Npz0=w4$1T^>M+u}Bx(po(@n$EY#S3`Y;DdOgGO0(5(3hd>qTcZs#& z$lop(0N>4aAVig;y0@ibs%{lSYVN2cadD1fEEouag^+NqV!?C3R#87d>LwJ7^G3tB zzqa`bzqa|j#G&;~|LZni`qwre!P$g-0WaZ^&}WSfe1TvV6b3x1X_ zqVr>HL=6JUqyXgy80Sm9aUWw>w*UmOHHtKGmtbbXAdu_jR`QO2t4bT1uP%#Vk{yzg1 z`8WR#s9+)lQu+(1s7i2=s7)utngeCM<-H0b{29=l4*&;DiR*;hPw$;B1asJqh-Hm1 z%4#?OQT{RZ0E*Sv_gnjv&U0n3A1rAF4Suc_-{t+wvuV6jpiB@uI%c#L;-0fFA|t|J zZcsI>y*g4`4^$f6WrJ*q1fhgBKUXV|M*$M(^9h+P)oYy5FAO`*k;io^uIKtONqli3 z9shU)pd(rA0Q^MJ`7CzNikN67u5%_QgY1gja1;|J3T%tCj(GkZa{*Lpux25jakW%n zft4Cw7FIwizCmiiIJG3-XWMQ8#9kua;1SZ(AGr8oH*B=rLW%TH1R-OFZt2L%Ixg z#c!`*zi0%JzW!USk+Of`aT?P?0B_`(HdXahP+)@a)O7ECM@87g!bHcNVHNBr5#b!UF+pN50o3R0wu$ z`_j~X5;CgIu-c?4A^lV+@8G!$4Mr?HYt<@)#MZCRjEJ_R3sXRft^OuR9^M~Rd8`lxi0q{JPVxZ9 zG6mO@u;(R+E-l3M;6{?!8p!lbiLN*d+K4n{78h60`wc4KgAN4@{QFM*hD$wO&M-p? z`Q7U9fW2v_dd#!~W@X>%Rg2^G!C3z2QX)eN*lRu2AKQRFzJ!D72ok4%gcA+C8Jn2s z!;F>8pSxBdx{jeHV1SW{nERjR-u$VPBwjxVB2NQ(a{BGi;+$LRGK-1%u4hDie;oCx z&lWpqRMie-q1}CZ^4j-o^^G?({Srai2O7m` zP=O~mSjU!kuA0#{fCv4xiW43e*;bkpw-}HFBnBvI@Y1iF92DFPpNEG9iN3ezxH}US zJ-;EBzXAr{+tpdMBtKp|lGJ@`=3h#NhJyQmV|b!$P6_LaD> z;#yGzYtIqK!R)vyr^ubm`}wNPma-a+*O%iT)dCTS>*%*GW$Jg2Q~)n@-@OUGmejUC zUh($>%Z^<+3P@UXK?ob{NkSUvnT&ynIRSXXsGho&Z>!vg(w}$NWb*owOK;4{X|r<chcf?tv#f)80vVB zC^I@tX?InP*1f75r%0G$Gff3bD z+|@;+1*F@%HD*(9U4Hio5|9JwmH^ZRVfj8+ z-fEo6)B)W0(xFQ#;y?Ve_@?%td=u09lJ~Ujn_ZIzkM>~5ROH#&^f^o-*N(GE1mBa5 z-Qx~a^F;0O@)V`=4g_8S!t9s-B|U^_m528M>u@+q&#ObBjHRc42U=ic3J}V<$L0d~ z%Ny8`1L4pKkm>4y3Ne2!35D5m>5J*47#=WLVP_GV(u>OvRe>9%q&34yqcviLwi^b( zMHqxnGE>2lh3{t&Sy14^Z4a2bptl=#Lbn7fKKz9>HEBoZ)f%lC2K_U!5)~3V#fm_}l zuW*$O*eQ)x&i=&8siItU6(kS+aDXyH;;AqO&Vj11Lh>m;a_<4_@qOwQ0axmeAhHaN zWekv@{;k$T|D>MmD6+>(WcWQ|4tjTdu;h`uo4*U##;e`@o2BafHzI(Zwlgk4MtcM+ zsk6xQ4*Q4Kht_WGZwP`ZMLHXFpSygw&-A7ud3jFm@vgTw5~-0r1(Y(4O$qX*NK0^V zMEpoZlhVLJ2Yw<^UF%TT>}b)r;UVxM_apfxgFhP-%C?D$ptd;*RxanOu|hs04*ckZ zaIsfgitRfUyXKMXS zns;H@LaR#&0*-!}#+2wZf=_Wb^};ztUp-ClDDiusfri&g0!GcsVAA3Z88MwCl=zfE zm|?1)q*sUp>@xta3~Z>bjK+Q*{KuMrBrZ`nWFkus^AKB#yBPN9%08yaMuSXBxI}o6 zh$8YO2pt4Vd3?bhMnHl_e**Iaq_v;c^=m&O_LK@O zB%v(X=wlS35s^d-#MT4kRV+QSz?}KunaLvl{0pZML>i&2!@6^Zx53@22LHur43z=C zKn>OoCiFO>FHpm5T~OJH%$6!U$uL| zmHNXIs$p7%2p?&~_o{%6$Pt-52}hg*vmN{&< z@qR9>ad_}IVu-a0{^n@%*a%2Qh9FXy3my&hhI+5IxdH=i;&?~cI`9+ZGEu^&d}qh84aHaGBr<{OCGIW zM;$q|EHHniBmn=eCGkI{B=o-jlah#s`?o0xvv21AP#-_>{+0UB?~I4HTG~QR#BW4H zbCszYa6>2?bVV#1cKuoR0{H*ybqhnbz`_q(id2Zwi91uYJ%-KTG!X4Z<^uJER!B&r@h#?e%f60z|QW;2H%|k$RW>JW|`3{KdJ`c-CG>o znW}n_W_N{%Z%Gi@8GPM{jA*s*(UaY}y1Jv%cZDNv34k#g`=u)OPJZ7$G`y{#%m zuF^_hQleUV-c{sCETe2Jy%q#y_Q2|SvM9Xy!kv046#_6Q-)4+YIvev!7jm`SXD@?} zEq)w_qaC~2-s?zAUs@kQvmUwrzGL0H6B%*jR(WN>J9Krt151>Nr)t;fOAwy|p3acy|l*!uFY_R_>-4;)<(Fa>Y4wm{g&k;%0C%Ul> zcgoTKB(vac_0ruuw1p#P$D7<5F{mZFRjq%S^3%nMXEX9{1Yq=9Y+e=G(ubrot9aJWlaD&&n}g&q|Lmn1f052az4RbAwDg%^AChbj)a{wwxiBC$r5 z4UddWj$_KM#4$*5ff!58i7TO#UYE!6JC11qE;cxz>6;h&OIhq!2_oOcQDe(AU!DbJ z{bLZ^EHzsmfgBKKT`YU7wPg%CHbX!ETZ7}`XLQp8_bj?qk;U$ZmBE&K@!$N3 zL^re3$rL{O{rk?xF3YuTSnA09^T}6p7xfA2+as3J1KHtGJ;hC*$*Yk~E9Z*K6^={m$x9^1B#b0Q z6B7bQ(!9m8T`1@`qj+bdnERth8lxzRqbO3N=)&Q0dBu|0N8%Vq(x^t_h)1$;MiNj* z65zyg!NuZ#i>5t`X55G-oSKjhT3b~Wz32kuZR!NM9^i=9r}7e)p&EaMEi8rIFIt1W z7PIAyi)9RmC3cD>H;H9bkHnRTW#ooP{tz}RGEkhejv(jG{rePQb4DVem1eC5%(ys3 z6g|a8){!#AsNGaJ;jd$ad8WvFNN5yD8__zM*>>%g&G2y}+-&oaf@;5_#^6mlz~=M8 z|L9(zNHir78xAN$MN^Z>${&4#*~%SUi^RyD?2^^U94)Z_gf55#lI$vEA4tek3@2KR zZ~`?XoqYr)qqh^|(_Et(lYup|Q-^&OGT3cGQ1JH@={V_%G?yM0RY`b3)fV0A2C)MK zT8`zCaI3~7ks-h>&ne68Y{{b!I|T`gpwB@&AF_#%)~L&3csO{fgSE^lJw`XE75QUs zc~xA^KO&~+D8#EWv*qsjhNHPn+cnje%Kb4|-RvhV!};U;6>AT9*tlPBkMg&IiR4e&N#L@c07-JxZmpj{=U|4d3? zBF8jvL=n<@64Y4}bmK+?2g6XUP5Vh~0QBm&75FCh$j-4znFdJ!R2pt6 z3#L?8OSAb$&{_HA83c`B!^l@{9&-*;9De?fW;?rYlRmv4`x(G4!fGz6UG1;hd{$@) zqi6RHO`q1uE(r1P_fE8Ybu+=Q*8DgRti=42{L^YMoDHy9o(|L;UQ<2Mr$kUFM%&sd zH+=8-YSMA0UZx$Mr}kAzW+Z@;4=3dHf{|(*HLF^@NT{ZX4rAvrc^sv!qCsO|S&_o) z24=z-Mw4S4E;xMWa!F`6abl#{_RfeXJFq25V;4OoFBXA zP>yS5^P$rB_G%-OOrbWcC^b&E@kTFU?^D3CbL?2Vjjo5zH#{@iS_troDYqLHC&u%Y zloP-nOQ-_r0!Tg~iS?0XQmN@DsBmV?r~k;Hz%Jlg#|&ZqRjjEczg*l)DPYu^JD2?~ zB9zoxYvbPO*lUJW%1D}?v*do>^|;@#9w+^_b}qiT6nlqf`rBMf-V|bHy?6n9{?i;D zDBM4Z!mo-)3iilBhysA3lmX<5mxQ4^GNXT=SU#P$9Xx4G(I`~Ho0tydR8X#*9%Ru) zPnDS=04v=*QhC)VpRxrrr`15;`mAjkS(A7&jiq+pS+(e&|8RCe&?f7f`S%De&`(lh|+VV$#RHuTJQ-f@!u(t&pqP6VTU66s9H%>siGR%@ zsFEEkn@wu7=q(aJ56wGBtw?|z#%8@y5-37_`_3AzYQR!6Cj?YWT?OZgM5R?3$A2Ww zlU3i8_~cjlgn{p@*VI~hrE=q$`(4gq_KSk=Cb=u^jGIr=gbys7?g$mVpob-=AJjr= zUEX6z;uAe!LqLU=3p_FB*J|R9sA41UF(PKeL%Z$)Y(rX05zZ~%tJ3=is{t3{tJ9W=9dBXPMHM@9t z^`N^w-dO7WQ=regwRs~rugc!)`F+Xw$3bnPa>nWn_EtYea7$>lrM8buKh0>F;!S>} z!q!ztn{r4LkwiB8sPilHhe%N<6JVwYvTK^Z<8y}pVErbR+ z@L!aEr>H;=ra!x|s2IUUX@PFJkh*YQY(YA4fvzm&JAualHITKGK)+;&Tws|tp~U1s z^VS89G4k4xwQC@gtOO4rcG}?SY{A0T1$M^;ZqRO8;cv1b?qq>nt@<}yfm-34Y#=Nv z`&YRHTF`>%A$2SJesTFVV<=aHD_Zq0IQBImkkLbk!S??&1Zu*2po8Gj>YJ7lXapXz z24>iFuv!DdSoQaF3Dlv1Re}A+>Fbg5 ztA$vU2JtZ2(E-<2gPAw+Z&zfh!Sb^L+FbK%@wBgok*@@vtMF^&s;j~yq6Hn6@~d;a zsf4+y0B(=)ucl$Dgy^GzsE+WfFto3Lj-!Fhukb4cVAPdE=v#s&hg9R^-{lYbGw+$t_N?!pccb)(8`4|v#quj={L6@xZzm1Ifhh$(RgY7l zyTj12dOT!mfGn*8{o&x~*sCOAkAV;pG6zAbsO9^7B0gGt7z{f?YT#^UG?8v(U*9fF z`WLiTkx-Ss3l?F8&$A6OxKv`=oBTTZELtc&eK^_?l;snH675v$%|=2=--SplVc4(J zh(8m5OO^)af7)~-`QXpeEKy`gVI&Nxb&M2txFZ0;?BRSm#rb@Az7R*{`9K6U+wa01 zXnf8%by15ohGgP4RC@y?lLzc16byAywgk4|;4L@wgVki+T455fmVOt=jycR3pC!3E zO6)QUGBQJ9`mz`H-P@~=5VN??O*fiBHyA+|^MNlhfk#q-4-lX}27-!!A|^ z85m;&BZ1A)*0;Kn9p_6Cj`}L|8D!N}+4ByDg3{I(UYl zkgJ`7tu|k*i6AiG&GAOkC;Sg+BaVvUiwiK$$$!I<+9Nj#7Je!0Wo%EL;i_WE>iHKi zir!Pz2^CcA^RX(zMK#t#{kDEn`~f=)hSR)Ku#?mo)_eJrb#Vi*>7X4W+s)8TC_8>n zy)f+72MtcM)P7IOC;VjPW6PdmxhCv+36@y8CcAB0FiDoiwAvRjGW@i$lFe=iuvt@a z+O5(<99#v|=jIwW?6~a4w?B$cZ+K==ep<{VLLmL&xEJiJU-!Le`BT?uuEYouO16VMgq@28oG*CX|JZjcCk0;1*OraM*UAOq%7z&b|JN4Y)sNhgA zt@?R~jVtRr9OP=9pQj6|^D%UMehhDg4xB+fGY&hSWD66R2qd!u5b3D0FtWXrN$NCW z`NjMzb~24<2M{OK9KVs7hz_x@$RaQvr3gLy{}lAvGuQ5?~XC`uyZB&?}*%^zvZtU^;5hSggp}vHMkLVoCeBn4&6p^ z^415^qVXmu9czkfAYSq(8aGiDQ>izKLWQ@$4W0r3N8N$I#2CCF;FuA>RoUxtBd06? zMn6P*T@s+`-m!J?QHzKO@c2vijz?76R-K`&t7R{Q!OZ;LOVctfy)*0Op?B%Ww`*nO zB9Tr-^yc~4IE))#s40mc+p9y0!j4L%&BW3_w-e*PQ?ILn=Rernrz?|gnuN*$y;FQv zJ+B=A5hMLOx`0cqc=I#57NTeqTPx;yFsv%z5rhDG&$~pzHP!0+y_-?B&cc|LR37Em zdZZrN%svha21|S@dDqDu1wr3632(8pf=EI{AIo5H8%`CJxdfk-t>k1)&BS1xfW;=+ zObnN##-6mNWSN5HUhr(Tazg{!6c>xFaxdz218ncyo-+&5@e749p=vul0lVsN8d7jv-y!elVW5zR-yp*sO=h6h} zQ8?vkm}-qhL3a~m`t!nb`b(<19JaN_vP!&W(WYwT&cd~OhD+Lip4H+tzpj@6Ocqt_ zDoLI*kcTncA9jDnU7CP!n0dMO*1p`M7qys zvSqx z!+bI75LZTLVkD`dNn%IV$i8o&tD?zrMph%98V{?2EwUb30%zt5V~d6c;KzeHS4+aF zV5%)F`suB))bUxWgzWA$(sL*AonO-vgofh_5WwlM} zpGBe|z4+HeADUIJdvw0CzlwLtT+s=*c4W6XYC`{F3i_xCjNRTz;DA^m?((^+Y!oKz zM9R{?Ap3B0LTS-&!D#{jmRC=-ob!G-`K*}qe4Xk1O4KmY1JP`GcTmF5TLk!=T2!($ zDWr^%R|%Sh>sztA_1#jbTusZEk;+THOLW6?-p)kSKjZEKvgliwuPB}++(b<^ zuv1P67FS!HPJ0B3a}~-}fS$7n39k!cg zgU{GIlM~=?r@dZAZrb;XsumF!Wt|t17R75k`@-lBGIsDo^|YtUe%f9fnL1O-9`1M8 zt4bR~o_P***y$goZznRH9@|4+adqkH}Vuz8A;q~$ziXwl(vR>+2F zRx-nQADaJ?A4I%=#L)Sl1xJ(fAC0_f+#(h}mkp zknxH+ShHILEO*XiTEeujg=6;IH+4L2`#uG!ya{H@s17%JGgh9dWLVbx!IT@y&sfrX zQFhvR&(XF9-M%4v;gQZO{atKVY0KLjo^>?4Wc>miiQAJ=0eYsr)%NI;(D>AhvvDzR zW>Hb&=0LivoMzuFC<6!L)#7&xoDN5Rag=uWt`H&!uvDg?7-OM7z#~pdHP!&o=QB@$;gSTD;n=f&r0x5WL=)o_U?=g1u(ltrLub5? zyG(2VNH#QRj;vK3gdx2}6jyL`YR8xKvDpRTRvTkU%uTV;52>vK1)cbxUg0)`)ehr1 zPlY2};{kyj1~OyM4VRD>$>Iv@oGt*7B?!R_q|hUWl_-MN)i_%M;YpXX2MD#l0QoKE zhX!)xeMbf}vz1Iu@0&B-o>CJjYXiN5 zKK`Ixkm^JMJMoTv#cycY>XbGJL6)&SAVKaWyvOuinms~3*wUS(Vt?pp1+NV0cy=|Co@F{E$fWvH}nBL0glB=?Ebe8l|QGe zsR$E7n{4B3Zz~>0tFk?)o`Q4cF7P{W1k~NlIK6lA1*u`LCHhL^NA>l#qkks#07w|a zNt*zYc>U!|Bx~M5`Q}bP{MHZx*u`%aDStM-iUj3ND}24)#~L0g5kKg{k&$v3`?Hkd zdWhvcbwtVZreYd9p(MC>WL~Yn(vgJkt^#wMp}QuZ+jttuQFw?~kltpSw@x%~IDtv_ z1T|#?Muy``#K2~zgZ5PWtZUdSpmn3I&PzCYvi<2-O42jW3m2-D8n3YQMYs@Z5CEz4s+-$=ErxG&QH- zGP>HDfuz4tIQm{&7iWO(a5NJ_W?iU<4NL?|kp+Li8tEx_LIJ5IXM|Ljjt-MS6P>1GP(WqhY);7k?sVkFv(pJ{y z`1kP%ZAkZm4V5#V`On{Kau8z zWVZHO|N-r zhtp&o-d#Td?h6*KYywJ(N^t1Qn3O`HmU_c=K%M)ZjR%cCW$ zeD%p$EUU?&s4wu=ghX+AsFv`*|M`7}vz@FOumQF$O@CS4iu`Jmko?Cd0)00qb3dXT zu#D$H*T^3$M6W$QxJdh{r^-OGG?CLxjVDfrfZb-N4Whw7@og}aAS%m`@3k^3e(wz;yX@ElYR zckj`vPLL#j9ms)TP9Imz0x2`P3RETvaGDaId|YnoL6u;Ab4b5$n1&9v%iSQ!%RfZ! zzfRc*xT%iUg6QDMkVJz-*EfK=+M1q(u9{3qzqnJz@oUu~iO?pKvE9}cdl~N@G;IVNWxz?8TxY7E%cDd5vX)B@)~?H-zTUBxyUh{sO-nD0q;rs>!bhODXMyY*vkaQ6cX3 z1M0{?o%be|@J`Mp=B4HHd#?HI7qyK76qKb3>{qG@~I4Foq2N$2%*0)#1UO=L8H*zTtYyr#FdH|)R@AZJ0u?Q;(u$G#J$rDRt*@zMl2^Y zUJ{`NuG#J0TLWfw9*3;tY%c8RzN8|qPtG>g*?3oPRQ;qi{eIK+_+WI^q*{WX-2`nj z-&K*fdR~4mZzihA|C&q*sLqKtRj;~D@Ch!}djlVD2M()DvE~U<%e~AkR9%BPujEh! zcP-(Xp7$38{Xtk2K%@m#NjAkfU`ebctq#t7gsO_UnG--O@gzhqQIzbWEi7&j_NPS{ zT)O8{e!RerdlBW`CKN{XrA1h$e!HcX=xyDVf$$bXPED|@c|ipUV0Zd}{@|8EjM!SB z-Zm_>Rg2sVL$N9!2XBLvnbeoZ4HYpmPxuZVhGCSt(Z)GeuAc1v+gRH<3lqC7Gq zYEsJS!Crn#w*fagUi1{RU5bB<+Lz-n3JGigZR>|-Qp9NkqTLBakrqw_wNV~1D5!)x znEodf(EyiU+P7;8KwcQ=@L1qb80gSR;9wf)U|Qh74XBVB*gG`ZJwx^Y)73H@WRYlw zzWHd%(7x22Y@j#K>7N_*obPBD_Q_&XT;j zRdwaikqez}$BO8K;^F{0B1K)3WF*HrY?O}uxr=}sHgqC_@TuXk_keb)&le*GX|9K~ z$Y27ODJvp;d-;Z@J(Bw}INOUPjHtrX&g*m}2h^BJ6>0yA$D_JkNz|VDWGZbSiT)P&!Z)$tfNySIw zAdSZU-%)Hrz_L)>@7jpX_tO1o3t8acS+WM;O5}y97X?TVO9b9225Q3V%|I^G+~3K6 z+NPWS5s@cDf@Xv51RCsn?poPp6N$n1uyO% zW4m1`y4Bl-xqyzi>AM8jxJED)4weK-OYAqqPbP%-6dJ+3M8URYT%pvR^4xX)X`WI0 zRbIz$rJ;`N!Wg7n5_pFalBu-O%N8}H#!*Bb|6Qoswv`&b2rB7B z=gCDPsjLawFrDrBoUJ14D2Zj1qzoR-YN@isEI1ZhQriN7<4Eo|KEmugx0W}>EZ8uA zXEk4 z#Ma+fUBTVP#obxkb`iIaG8Z6?dd3-R8sD4*E6CfzWajH1rg82c`34%Yk#8EX${qk3 znuALJ=nR3i2Lw?8Y8}p3M9M!J-(F+k8=Xr0SP5V>D1#DEg}R_im%-xALCRS8gnlTK zmzyxsM*JA|Y`b z>qm0D_1mx}8K3Q!3X|uBV{-HYUO&U7F6q2wWWxaR|9LJ z+l4974?@VKTVDeCiFg00qlH)hj!)`KADg;AGL+`m+_E=At?O+`qfqLl+xeHdxNtfv znkc}X$Q4OO+$gHScKj%+xDCXBTa|z-3GaZulp)H13rTOolae7ys7&=hWjj!kL4Bwy zAC5*%ps0!MBT@92IbJ{QdlMj)ZRwB5cA8G9lh;f&MySX+Re3IXu0W8j8h6x*PBVWG4*FX z&oy)#QRaw)FC-RO2hrq!UHRGlcoZKiF>=y3zi-QGF ziusj>_?C`(mqL00C`CLdgWM=bT@YbT2r$O8@dkJ)T)DrSd;Nd3on=s7>$at_Ai>=U z4grD$ch}(V?(PnY;O_4365JhvySqbzyGxUO&b_z0>UP)e>fV3es`XZVwd(sd<}>D4 zb2`@DI`!055oCE)bRB;qt{Di>kBaKQb7ppa7Vk|+nO-g&K!W^(!u!csTX{8zqnrp zKrlx|8FvtdyLmoe8hszZ6rqViRO*ljzr5evh0To}2qKA!5+wNK!$o!JYC32qUv4K5 zZ3j5o>8skgb6s@tZ8ISE`3VGx_QN5AntIBJW2ftb~AX*)dK<^QwzThD*`5SwK@h?$T6BHOWb;y{bQu$bjElv#Q} zTk{uwo8(v+SC?--&v4VarjbE{v>zWd-d=Fb<3PmCSC%o@kyCP6TA%8q;fAEGr(au3 z+XY?76A~awd~A@f(LKkXDRP2#i7H~itvl6&h`-$iJnkT2jAJ9{u!+hJ_pqa!o6RyT z-kp-vne2n94kY2_ya3;pp`|M@rhbyZ3F8`o%{n91G58kod@qckAcn9Cmzc!eU-+2} z@_?PpLXam=SFIAe%%X@ZBgbTQoY+%$Ax5>S0pazbl;u{Fsy!#4IwyXvm4U=8)!F zQ7vKAxGw|;EaL%0w_iH6B} zX8q~nCFxMZ4^$2OFM)t;a2Bzj?O>A#jH^Qy!D<$Rzs(2T%*pxQ=5Zzr1*P;*V_V57 z&ET0eq=Zs&%)N1B^l@B7aAc@b#TnkWlOWu5;%?PB1YQFR5*(EfKW0bg_)>UkL@avp+*{UUMbPL~=54IZuWd)1-n?eoDJfDLKgWb`qI3VEV8> zr%6OLQdUM!7VsSYqCHZjfuA9ii~Lg$^_IR$ieJu`=|oi4gVak@-cbl%RL+VigC$3r zjR)DMk9QV;kYu0&$0k*1vf-0F?>Ga=`Mvh5F_9eXx-_JLl_p?R7OU;p4NJcIu94 zVv-C(Z5O#c{|5PanJhfr^U(*d${%NbMk;V(Wlc;#*0y^Hn#y}VPx`QLF+HSu2t}}# z^k<={W;~|dn1Ap@49o?)JRy(HX|IX6`#szeLQ)aCCSB*&#}IgxK~t=_VS2Wpt=QcF z3&Ss@Mb!DbpTi|&o8*mqisSvi*(1|R3t%OA(bJsh+IDm|3HiZ(h5MP0p&6?{|20L| z7Ngq;_zk{u1t~%f2RDd@6-!J{%1Ze8b2cMxHZOcO_1lJQ;0Z8@OK^z*1@PV(4>Y!3 zSeeA5)`aSs^en4(4Biqgfq>2b%#ln*88D+Zug@->bXI~-AXGDO#O5J!yeJpEu4+Es zsR7jhy^eWp$7swwb*LKsxCiXJnL18gK(m4ZJOXEU&{_;8R>9PVG{IMM2jN_>gljiB zQzl=+TOql?Dn8f`WM_b{MG0+Bf>mayn-vR=bF8eDwLb{uOpNT=*Q$Jv8l~s`4U1_H zZgNBv!sepRz})pzR-D?UrKBl!uT53T;|hhYgkEQpt2Fxsf^`7$YnJcfqKcH~hNDwF zaI#I+V$t@nS&Qaan|=cy>5!;_M*Wu#F|YSUj3HZ%zhF!uYJ}^-?A|cuf`lM66)AA2ZRIL{ zFrzE)>LDK`&Kn0*YP@Fh0a&d!R9X*dvS51^8myk0&FhTBNmYZo?$rsb z@)}7`bAhY5OWFxa8VO648V@D|zIEoCZCZLYd@Wg%AAS1xzAJ&Kxq(>(6Htr`>Aycv zAbe-WBjF8XXeoO~5UMhkxpg{d9tg==PD0C0- zUqEYI({?D6vZsKlBDZhs7?#Et`z(r-`iS==+-2wp!LZAeL>N+3eFYo#Jdf_>qx^k& zja;7i@}aet;dE07mO7e)YSjgqDYC^qj;uN`QYm7c z^2_@SZPMU`g#rBi-G!EV=+d5YfXL!nWRA2(CutUmyO867j4lTK+fStdtB>nBOEtLc zB^&<00RJinOISI7$Gz67D?w?ndYcF{-f0$&TC&EqFFIA4u`66Tg}WgFGnb*0M?8G> zAZCo!Z;Mc`g4V91_~v8NCQ(Omm2aL!>m%G{mt;*PGaRUPW2Som2mv%dfHm~>C@Fj? z?x&R?vW|Q%;ik4kQaF1|cZO_9&6sxZx%GQy@3G*AWE;d#@jyUYot!$`X+EL(Cl90% zOV!z(NYc<59I~5|_{R zQ=-qlwDRIUj;pm95NI`?z-X;pO{mJ(eKWS|e(J-*R@r_7oCsNibbITb@DK4%vt4@H z`Kh%HW>?ut^_^}q(}~ZN^=HIo=q0TLHC+y{;oAGiHR5jFjvy#SblHKjR%~J$E(FEh zzVd_;w2DidLt)ZG#z~3OhEvVjzi>;*TU%|Os`z7}Po4}idY^5o0L9sP0hsmql6A!o zBTf&~LwWKrOLq?ZzCm?njx%5yONb>uf&z-s$<7bt{PFjxh#1`imLq?9T^hU4g>G)m z;n{2xEGP#>Mtq{EY8uZOS=m|1ddreZZIqB_@AG4ad|@_}ayTZ25h}0Vp{o0gO5Ks9 zqe&HQFuyu7(UDIy4A2hOvb2yXc_k$-y-5o;epSUEhA$gkUMzK-uE;M%ZI^(eZEDG_ zF^{`$XvHK_L-bpWXga}GH*D^`AfIp!vDA;lJ@V;SV5GT}9bYO&AtfQ#67Rj<1Gs=<8nrofvKz0uo0y8Zd+a97I0@jBaKcb0& z>drDkT8GYxrO1Xwj+P{zdmS%|cj&nEQrS-K+3GxVB_ms4ndJd8(v2RRGlOp%k2jIs zgT~=pwYS6o$RQaZK8R2aicqD95E}@0H3=6+z?zcA{2qy6H;yicfZi>QHnGKaF*=Si zu|rs$snCZLiDbdfTYhl*+Eftie1kt$p64zKy~Rt*U7{W z9S<&%6P?DE6xxX(*d8m`5hd6GF4zGw*byX{p@?_?K?;y zt*yhS8bw?(fHXrg^lJqAmtFo9R<0XqGgrDSfdp|BVdOweKMBmXUH*B$&^g)e8C%cY z*VsESK;MNjg)_4YUvxQ=+#D*dwikLy5rrkg6Re)bE1-4*Aik{V2Qi6nhW(y;i-coCp_;e@3_+E@|Mk_aM}%nbgQRP4`ksKv8c9 zxgo?YwW<&_4@^Q_op6PwaE7<9CLa4)vz9NLNw45fO8e{M!P7&fuD6Q$N1(hh3kLL4 zFWP8_$en{51(*wbje2!{K+(QuaM(w>jJza$+=n_ z@x#dxhCrIjz(RmbDTSAe8~&vCq+-%c_DM0$6h{suq`)yl@VgrmloX2Bu!!Ks`HmYnY@obd>Bb)H{j5KDPO0eZ%9X?3()Op1kIHBEzLS! z)&)^Z<%rBAPm*pkh8#%dF~_NnqD|MNb>fOG2ro5Tf29>U@lQ!-vzr;3xt{u(@r>gy z?N?)>X^2h1`cp9Af?h{FtALEjkUMI0}*CL(LS-{`I_Dl1=R zU{K=sYI>yU5B48-IRKE$jFDe@`iQC|ny1`3|@*l00A3{4qTF_K;@=9L1ng8VdI-oOI zTF~Np6oSUxN2wO`?ZYPPOxMk`YS|+l4$O-<;#<#O@s13O0J|U`YSxxn5~_k*JI|^4 zq`+&aIhhZ=t&g;A8)EAeSc^;Dpc!HK({54wcu@Ae4CzcJbC5XFnBgy;w#JwQnD(U$ z3#o?*blKj?u#~-zKxha1=8hXrCQv_c^~9Am@pdX&GzMv)`vlSLdkY!Ze*!NA#zKTd zZzym*+1{iCglwW-M6>u*O~LGQ^krs8Gakc~TEY-sLwNW);Ooj{FFxF$?Q?dVUbrQk z#u2SA9^+L7rKF`p=`|esX&l;$FyMLif|Zs@DrQj#1#&2tI5YY8|8!h*C0`mxLc+i9 z1C7G7fEVs6Nz`KDovrzHV4_}%_8V+dSNJVFF#TUwzsXG{L$)hEH`1wXY@Da7AW zi6$pp0LwT`-ge#wzJ<>OtO1KXW!7S6Vhhe@5Y>dUjF?uTZ5#oD8|K~;Z0a2Xq`&DS zG@2$Q?9#`REmu*W)bIG1) z+5u|n`Z{vhR)`X_43;m4lqOybC)8;|RRAo9g?xXHGR+aekKAC4-!mHl_>5%+W}FyK z@bU^mX&fBW)2HA6isW(p70D|wRg$kMc!5x=6|lg#LDg0h8lf^9FK{DR<0p9_o6wmh zEK>S)`Ob$>~f`d1>5ZGVF#o3@WEp z*eDAtd$9XL24@De>Gk2c!uv`9v^ALcvSu8iwQ1?eVf=eg-qdR`H4i}JnS?O+1rih8 zGBZ^fO^J*Q;E`wxQ64vNKI9V?Kg3yKynuz%9*vsUwkR#sMRB$CH$7<6ix#j5OtP!JB1v4 z%^#koXOxXh^Jrqesrrqhw5~p(uwacSe+5IP}OXtFzd z>K`57aPX`(o&fxj#1&pFtaGns)}*6E=G~{Xa>ug@288lb4$>8E^ zt5T;ir=g=YUukBzi)(ETroFxo+vM3df}C=4_d!ggcUtMtLRo$s2>ONGmCKDbr=)RG ziWg&fRA>1pj8Bz?Nba0u;KJ^ll-D}atQbGNDr7{942Gqj;*pm!Pz0L|M?l%ssLnP!*Rr;3l~V;1qz+#ftk}$=gTon*|i@>T6w6+gSPTq8PlBR z8(n6w;QKdW=Oz11cihd3kR4m%=WdC7GB4jYl-JzNQQ60`%9hSiF<3pBm7r#u+w6{x zNKJqf3+AS!f{AHGt+Q>B$`bl5bH7w9h+9k09q_N%5{qLDBX@b>{%$gX{v7 z3~t*WhERbF+A9ourT#5#wBaF2{_7z|C}3r8P7a^^=&1IgSJJNV<|hK2h!s)|<1A7a z6`yg)XC@cjncPy#nR0(xvhrMkj#QZJjBx;R6b-W83(RbW6AhFBlsy8G(R#sf^-_Nn zZ%n0oD*l$+|N@CDdOKScuh_Gi$7UuBu^+zmmg97TI_{NT?W8=7$}N4nnX7w$uRK zpkkyXcs?{5#7JXsP`X-6TOe$SL#FXuK#nXR0V~g(%N0EFf5E&kQhfh*=k2jAy>phgyc&5+5Wk6c<2=UzIV%@GC+15$_z{*jNu4}KeTaFG$0s0tbJje> z0*Ta*1_7x~VN5OyyOQ{Is}>qrS`8<86081`j6h%z8Q)8?Iz*w4$9pJ_$(&g_ZP!u% z1V2Qo^!YtTznYlMDmetv)=I|b4QWPS?32_i%fRq-wji4ZAtt{v-yriNf=k%S`Oa(& zdt>_X<*f7;VJ$^b86_XALl~G;kzM~jOin)@hTcMiu_t&LJr6(qMZ5krxt_6Tq+^mX zwOvpJ92)ivE{Lv;gwkjWALgFv66^S=6*+ZUWtYs(|Moq>$5yW{lomygW)%q|yTU)Y z51si4k;;-4j8w-?^=|6xq#3+N3w4)0!#_^#Yrk9hvQ|98Q+3T6AAy;Dl7G4P#mji& zDO^;LHRLiQ2ioKceOxZ~QRij2Nl%s46jOQS3haAm3jzuVrgBXljFDmNcS{HiZ;7~= z&Njt%>YeMyMi5&V77eq`?15cpGs zU*o@{^AuCEVA%n8QruVgwg@xzy{^jV$ir{wzLw%*Ke=U0kDQ@y%h6bdt92!H?^_r^ zw?{;wuB(V&Yad@hL}IMM1l4)m><%3p#}T}5oPT{q?Y`@CuvNwbK^eeXxYCgcden|N zZ5Z}zb%?~fYvO1M`z-Q`cL=ch>hZp}Mak6mK@!y&OS%Cj&Q+JD`J|x5_4k3U-?}KN z=mTZd<{z1u%r~-z%@Vl-2P_{EcqyzTLF1#Oo<|i?H>$?P+`|jI+ES^7jNF{i3-hD1 zsy8eioXYa9sI2|%7X7(LEfi$q38kKpX9>hNV$ksAdgT;xrHZ7ivGKB?`L;iqgB4;W zd{6rFZh8a%C)axoh%uaU!i*{G5tqvSg{tZQ>ISn6nUKvJ;OxtRnoCKqNuKWpaT6E{ z!4ned@O8_BC;Ir8|OgKe5-6(Ymj|PTh79=MM2MBdD z5qzFbi!rIwKL+CA{O=$e=jKe-q_%OTvje|0~M3v$m?{ z>;RO!th$(iDsM>Pt(1*Tq-EXc*n_@g&U;kYydr*)uzV!!lz;#F#r!LHo;k`l7LNIH zChgNbxS+({U#7M3gbm~(<Ep7{;wG|Lq0y6k)ROUD<7Z{(%z6zYF?NT>}t3YKr0jSdYT3Iid|1dO2Vo! z`%Gh7WToZgz!+y9#t?ey32u=VbxP>^GZNhWdlgE8x~wI;@0D*?Pey?})$TBvT^%dS2M!&=c{)C?0@H-lIg$Blh=?Kr z{n>L*?%yLyO~vLadt!EFUome{v8kZQe<1_wn@loNIpYWtq;rlcmGEBezj#I)oLNXM zVylHsw>nG;)_0X%&hM}iCR(f&-P4Slm-&aaycv&#kYGCS!nxK-&#lx83fI~PzbiPG z9Y^E)*Hocm7V{)Nat*`yjw6ayUYz%j0C<*G(R--;@yGC0iJF*D&bF zC9HSum{{?3gX0E1x>xvZc@<4)#H~Yes@c|VkF{pt2z3q@pr2G?KkDQb6PTJheRVi- zy9RyrsF8PczROI$PxvDHS;*F zgxt#-sq2z(jM5+Vzv{)10x`IkOWIhz^%77akBB9vfC46~4x_}0(%dT#>nA-z9uLdx zmfHW3F=G9*O$|H(-5E6infYi*=3KEn1+y zD+&Bjbctuh7y+1MMs{?^7|f$M&L_qr3{=976kq47qdOi?Q6I5SgS}s3nS;2za@#Ak z8N8A2N|*-B4@X($K@oo_-DFbMjzJHqpJJMw$PRKKN#KLNe`GE*X`uvMpUv{B@>0gG zJ-rt8!z%%)3E|m~OsRDUp01Wh@%cBeGsouQ_!fF0+$-YGBh~PYQ`5yo2wQK8qI((x zg=;;pr3hALlyj}d$sQM<_C7`{@T`cM`RI@w9MV62llZl=F*_5+^9xygg$lV{eo~~U zT+2IRn4XDeD-BK~Uxo@0_5V~1`(P79cXd_Hehh>>ip(k*P}BHMqS|o*5^2iV2A#@t znGoyipH{qX+Vf%1h#G!VI8ogk#bg^XU*^qzg@=E{tsdT}G;2bNlY@_!T`0%%}`)>_MowIc4#D79atAO-3Ks4l70vkYV86%i;w1lTA8d6ZYa~xgjOg z)C($*SMW$4ZaONLSrCz7f2|zL9Y4X)HeYCP{;v5?*Jiu2nxOy`uJUwPF%?wBj77!0S;jbOxBfGm%pqjaVQHBct)Kv+M1DF)Dyh`gD|TOKEpY{qbsZV_LtEnB4-dh`H(%lR zk*(|*F3rh`^J4fcgb(G1?b!sBlZ%1)1|XKN7Ln+Bj@M>LLucFCJq?41;!S<0XqLtD z2If;qYlE)7BS_MXyU+c#&TPul!s+tF48&Mh?skiHUe8czU2l-?=R|KrrEu|B+TRcY zKX&c(cvwyV^w#!j_U^*^Lewb=y|d4_LE63?W;N~4=@qgxjfe#;ROHv4C(F`;D2SD4 znbROId!J#!Pf~rBIpAU0Pc|CnzR!>Ez(1T0_QW15g=~D-2CpnCUp6x}>Vrxja6y@M zNJWrlVgK@+IM3SGed+Ygw4yo++`Sh%8leR~-rLj|*c$r6%Gv0XXfp&)1azaOD?W7K z{KAL-a6;rB-c6eEsx<4qv-Sl)etg_{L+B}IbxsEAavBsS;1?~)o0?x5z2l@osZH*4 zbXZXQt8wUwnxPf-?V9uabkNFvH@Lc^JUcCpSi0>K}-}8nup0s zO>b4DKqs@Y$G*+SIoE0``0iNk(`@(CP)H9!zn2ZBMPO3b#_Y%Y`Q``tltqihg4UuF zeb&(`GlIfdnbh*_)n|T{k+(g+?eK?S#6%{1@@mcq+;%Zz1&B#Sz1h{67Bg0HVJ{^I zrL-Ha1Z!u0tIYs-#}FscMk~h)1W76$+Jg(3n<0N%VCM~P{^W{RY)I@2h5_%aG!VDUEA&jzFnb~MGy;K#&>t#O> zz|<1nL?82;h{B^I36`c#89K-$LhU>@r(c^~1jOS*tqT30<2=mc1C(n+4Y2!lqMc2L z>$cQGuBv5W%lsBk+OVpB>8Siv;~3#4&z(hXEg^FR{_|i#u$TW}#!acGw`u0*i9G?7 z!)Sg7TxgdM*+23o`125Rf4-e--T|;%Ria4KexJ99G%f8Fw8^R-ME59Xum>>5`i#6! zzSS7_elDXEJ<4zEa-b(p*&2i!7|~R=bxl`<(j)#}AQ`MD0EeodjMVFoMczkG z6bQrc_pgBe=9i-dDEg^H){Kn0$)LS(SdrSo5!!QR2=u(?&>+-x$c8qT4CD}|dEt-m zbJ#$lW%F9x$a$J?^!g0u$BU23Nits zcay(ie9V-_=;F+yq2VftHemQ@qxssY`QsEtGOI%PjO9T2koL z$@45WJH0_ux!X9Yh;cerYyDF{asMPj7nSu2vYwYB)0=+jy>|Yg>jO*HN_(m6DJ>yT zjxeeBohn8|E3XseHWeJiEhb0vq@=)0Da;ED5geCBij@~AP8gdXVagH6uQi`ieDJfJ zHr-6|^;^}4F4ysSl$fFtE?CGnfT?8WHjK(wJ{&37wkTVpQIOGDEj_C4O^0BOpTIS7 z@ARJTl}nwZI?`g)Vi+J)`Es`eu1*g0hJw`EQ+j~JF3*cDwlGu3;@%K-t?{W;R&cd1 z@{At4^wymkJwV5e5qva;XFBXRLaa6{S+%sn>-ayQ?NB{4( zWzF^_O*4Wbroqml8*RGI(L+OJidv48Ik&0uaT7p~u+6ZJXP<~3@%y;o=C3kdnm4x0 z^QYnD5nh%zSKS4H_Q`mS?K6vn2Ef~^B??n@%<93Ei3 zPo7|Xt(nqZgA?hNAd3H?=?fL}=DV!RwrpccKTci=k*_-Uz zlb--pQp=sPB8Oo}6LRZE*ly1gI8U!Cknf5f-JlV&+rP!SvttD*WlVq&9FTQOu z)YxgJNkTq_Z;G~U1gtCp9ThO?S zlh=;sf%mgC3Wb%ku#diBdzT%~qwUqG;lye|MlF+vuYbbJcFbsTEzb09kfM0)Vwsuerb8s*U zh@~p_jW|&^e?+D=(uY`<2&%cnDAS?)D0|v6r$l4_snuX+BH}^u2R!f9L(^EM070*g zusZK)PMlb3*4E&KgckW+?pJ};p&8=cUEZHh>9bmfXXoV$;1hdK()~_rA^~wqX8!Ms zvZl{+mSfU)6>T5@fgj&Bi__@M?}L@^Q# zt0bOjkv`dS8_h{adD&KXqm!nysj|U=Q}S64I()EPQ~__#%gN>ziegB{7$@Q~7HW7R zUq;-k^yZk%69Ew*Y8e>><~PaV@UN4TMwpgT*w4ypD$3FU(o5kFMo1OKW-`&ZVfIP* z)9Fn1B?ih{<&!vLYTHh#s?#HOo`{iWcI+4294vAzPtIJMX>F*N?PW7E^tsK9sJ4|o zjCCF*5L?B|>^YypxGo@=+ydCe5pz4fT-)G52J~jzVxf(TON@yxn?*{oMsDGya~Efw z5hOF=A6YH{mfp+HhEg$|B9`vTO68@hN_KsP#lccPBs8Q9e!gFxZc5!?F)ODEct#Ov#E%slBw_TRr_(H?1N9^&!fY}^d#WMCxsa*|| zbKDgDM&O zAP%rmAU_0f`ESXS325f9@+Z z{n_$Z^0_qDETX(Y&5E(Yj-lcrWg$dWJuhj>G|KVmPSAyOj(W~($#U2E)&n!}iOH_Q zcZ^oXL`BEh&1RCMf0C^x6j)&qRfo9srRhj|f^Cj!8arq&3Ox{#elT$INyJmSJdnGI zI>tR_h61@H7Hpm#m7+Fpj`HJu-+UX%>Mcv1R)HPi|1oB~R9ImTu|_FNIx&lPnxw?o+TD3W1*mS=RWJTAH< z7JWc8%lzKtdRs+YY90EbQCHq9Q>7VTv;Nwv^n80bCNN$7zPa)^nV<$dfcWA_@QmQ7Yf@o%_5(bG>%l?qB2GMTU z*VCIr*&3NlDtVw(xrWd%3|CU-HDgq&jHUXd!HADwfJ6_pLUnoF`Xml*{2s7V zV;S8}iQK2H{&72+IZRNmSvTt@O`c;UQQH^SOw78M$XKo z3lpP(GG0LZD%9k{gqCU4(<|t z@;%1SS>g|v;=?ME6J=v_X=8w?^M5J(jbSB)19!^NkmdyT!qtZz{jXK=ZUtrM5-B*t zv$BPOucot;P9)D?t>Vq{F!^zBu4^Iyd&gUdz`F;CU>EL;If=X~gm<}i>OvkY2T$xV z!|x(6Kk~_A)PzDtoSKsYXDL|bUSJU>-=kHhVGKzTfA(Vxp(93kiIP?rpBqcsIbMi2 z5Ircop0|D2ok#72ARxgVsQ(S&)+Wx!M1iyk0hZ3^g9_c|3iciEV7bRc?&S-hryShJ z@c@Q&$aSDa4WE`q@{@b&-F`~5G&twHf5qoL>Lowu--I|ksz+!D-58dJ&(+xr>>!(T zhx@nbR1eke+;)%mvUNe|(Vo*I?il6bMmuoxYT@+7-i`w5rwVWP-kM!jeIV=IE05Aa z0WvX>H<7w~Sp~!Lx9R}^`BzKaesl5f@CoG1S+BFLT30+Vvw+*U+!lC$S0yvbllIZa zm(SGw0qhn-Up5ZpCqC_+UfSro4AN?wxLka-TQjvOQwi7U^P(DKsLA68nVRCWQfj9d zmQ8l7>PtIOMUy$Wa$}^%=D*R(4oZ(9w6C5xk|~labs3|-+vXhx&<%fC_|98>gL z8LA90YvBVE1pVuaF!}hCW%d!PC~^zGY2Q*1+H>ENSJ@iw;0@Q1mL>4ej?6@y8KGxD zn}>|OiQ**SD7v!Gl}1;_qd8fH*myiZ@IE+fN=odemR{Y~>5Ga2gW$btrwopDzR^R z{KVEkMI^bn0^96CtJo1mdmd4F37Z9;ra_!eQpo%>v~ z<4jR=!Ag-$EkUGdQ-S7%pcH>dT>3_Y5CRwLqt9(<)mOYOZSQeqO7evuc`fuac7GpK z4EyCzD2_g!E{1yIx21h&U>BeZ3d$$fi%^)jn*2Q>egVDoK480nTq<3GUd)r6I3Je< zudx6>vn{+H0};bko7@-K)59WgZgU7iwA|M4XA^kqo=N^Fx8~=#|8f#^6lEc&LQ`)c znyV>YmWam0Ns>5>(Z@elOr?`)2L+I|;|<(x-V-FDZsZxD7W_BB|G)A+Dj>rbr;=Q9 zO?bE>@b*(rmJRM>5dW5B!K`FK#{Qz?4%YbSlHcRQ>38v&>T&0>{h~3Md9(+MzCshF z{y$JJY8e{32vJry$7F2TS9pL>*|%kHx@Es@FaiPL76L17k1fZm`FiJg_n2hI*9mQ6 z^KYp(&f3Df!`}AhNb0FmP%)FOfP0tHHjPog#|rCy5JdY zzI+b8DY~P}Fl`l4UM6np=h6Gv!C@wERJn(Ri=DzFsZZC#O85IGyqf(sRqHgQ_-XIs zf+PPJ0Zp^-MgXzgA0t4s=`SN-W#!!n7}E!GEd+Grks))a%Q%JaeHI85m}c7cO*Z-M z6i?*qQ0}D|zebU{O3n-3irL3>Xm;pnoESG#J#H)GUlQyqM&{sUmuW*p;ibst>FY{M zjU3FFhbB+Zd`!?PQg?L93Fz{u0hi;b^Lu=(4|-^6?0wKdCOTXlraG^*bR@JpN!f>%C*gzcIX? zzIG=CA5eDw7l!{&8vUQL4Hy%&>n(iU$b7gRZ8Yh4vDjUC$8dR`xXYAyASU0l|N0%n zUk3I~#!llQAMWbbkM@$9Ge_U`8u&}F*>~JKbTuXS6TVhCqHBLv5d0(9lb<4RTCDwb z3M0N+T@#z;WokFbMUH27o%3XYTvQg-s+(QUfgbBsBd~#`ICaUhRe&!FTH)I|1|AV^ z6ScIMbrmYM9xN9Q=C2Be8IdzEh5)wY7s7oxZ&PN&%`Ff1=`X4F$H1@E_;noGtX22z zq%H%)ohFtH!YEdl;QfDVwJq3pOc}!H9ZijUn$k|P(T_2z6gnUR83%0^1$qt+eN7ZN z4iT1dR&d@>8}Gd$uf^RqtaLuF_W5q*3yq}`{_C>U$wmnEDE_x^XmjB36}Q<7k(gO| zyj%o^Rji6^A;9Sc?ZjTwI#5w5OnbW9b$>|F)W&&QJAb~vzEO18#w0-6M5KaZjvnLNCIaWD3|toSC2rIRKpEiqbnF?2mD$39hyHVcWkw zd2EcyNQygPucH}JglKQwUVbx4+*D%kYd?!NgYCvo+{)o>E)2pDhm*5Q{CNBH>rG`N zxW(KupkLbWc=h8})nQ;S{UyIC;`p$sux#gS zDQ^*%^E*%n?ygiBqw&9KWqhwBH!M=Pc!_d36F&|A_*WCdJ#5dCkZc0z%Pom+a3?b5o>dAA=q}G0k4`U6@E!teugosGSOg zJe~uZ;);X^hk)=q_LA1Y^)0n3sLYYOjL@T&h>sLy)6kfnp#>X)^(5>=CF{`sy5NGK zliC+bf#8cH6H6cacOPX-%eJ|LkZgMdq@M(R5u(q4NE(_U?Sy+RLY__c;nEC(r%io7 zYB4suAGTPKvOcTP2Ok%IR6)9n3i5jd6By8cNf&e-4Ys_Ks{1so_2QT<8Uf-j;FuKi zR^Baz#qo=QE(xe%bXZq0(okU+-wpdXOsFn5lS#;mu}909&u+FWKTzKDKF2Y&w(sc2 zkNl(^;GO_)W5<5m!_hL=@$SU6i`9){*F&W!OIOIjgnUyoz{K=U9;QdG-a&vD!)+VJ z^ztKP0>Qsr_`jr@o-(~8KDDH71~1JTuQ!F=LzZ`go8F9LeyMWlx$a>ol^BRvy#52$ z)ur3PQgX;?x(N-bKf~WISGyC~08NB1n$n(@DL#aBc0}T|B!@vGZ<(jsZ(k99VQw9d z@$?=uj{Z5Gw|RQgtE@`yNSCUj-lp0QBrU7e3<`u|I+-x)jQJe}sG?fvTCQk@QQ z!j&&GZu9e5be~sS)4O(R%T6BOKLj=L>mQ~D{(nIAe*iil(;~^(=V|N>_m^JBR29cm zag2fPV-SGq2C(=ZOVJMagILAOWpzm)fS{NwvQG2?6pcLLuA|Ek+WkK#(!UVp={wac z1WQeYJKZQKD3Z{c=tM4#Yp;p(4(B(}L{JuR4I(05pDSfJ08az3^qlLRO z+gAUOrjQZio-G=hV`qroXcbupef&YqlkN`F{*ztWgoh0JL`eGOz#+&N_R`&n zyu(jR0PCU!0?4j#pnX9~n)0muCn(^3od}-IbG9;z1|tp(I&p?lSmE#|!#EMa9yGjN zK6KSikQ?^JN++#3LJK9#ChTO%g!+(*L$BCE-V>#HdC|c-MK%b_>^K!9Q)znCa5c{F zjW^Y2G%~OR(_G+o7soonifd?3jizc2S=!AXfsMA8ptAduxwL?MgR55CB?fLoD3qkf zX>JM9L*zppf7k`Vnr#qUkEiL{mlX4Y>~zh|^9djj&q2d(|q!?_RawdT;tLLp-?ST-as|397jw+-Ql}gQvO_ zfP9rAoKth87*A< z`k-y@{XIRUWIahabP88;mA_yb2C>S@y{C;!HOZ8C8jLyceiG_BBl%W86z(2^=e+R9B ze~_*J4q5~MAY1<(v&L2KY2Wb40!*1$i= z)_(`Bf&V{j-M;o*zLYUd`1YO#Zh!u|5ce;-eurxl%?Zr#u%R~j{e;RMY9n*XKXCn+ zCnvZNaXwP_K7S!X8^UUKW`t#UY6%r<{Q#A4{l-z5I--Nahnr>|RFtq5LG@#i6NpD~ z1$gARExr(!kP0jOV!ZjC<_cO$e5+~oD5){|1>!hqM=;wpFNYMn3ad_Jt&Tz@en#4~ zM(BZd2bZ>hamx49v^#FUpqZ_!ng_{zci5s*0WdNR40qP&NY+k5Pf@6z*to zpLIj3*@cAX;I8zwLy1YoWzPfa4>O~Q+FFmy6kCV7#xH46N`kmY#!`=eI@-CUPZAKe z%MDxiKzIocqT{0EAeHf{D}Br<;G3xGc#sg?cksE;dNpEX;Q(n z%J`B@Xy(v*s)f77YbJMSdo`+2bV!%rc|g`)vDez~e&c)3 zcg9)c9$aInfA}Bso^$@L>qfFH55O(PFa>-Tu7l>KPJWFF(*e~Zkm>rVB>YWf;+ss& z(9ZKLl~?Otk!i~TZx^TnM6`(kOO~1%vGKG=%>v#Z>XKBsdAB}xi^WGftQxFbqGvv7 zA{oIfGSWwENeJ{mXVmF2(83Sh^II5CkN(IE0HGIetNWEa zhJgn6t%azpS7+ab=8J>iPE97!18H&MM9pQthCzWsAVUE8c0!k#bBW z)=JI11Y~l7joPjnRq2Q|qN^{1dFuEj9<{W?FuZb0Ff+HjAKO^35;jC!rCYiB?*dch zBTxF%m@@FqLyWO#htYa9S2?6Xe^{e){FJdt=eRk9);qhzaf4?LSlhF|&&iEm{>;hI znjdp=^6KB@~6$HH8;sAG^ zzL7bF6>`4*W}ZZJ^B;AfF9|gQ$qq|01WyhcN3?`Lc>ywtA!cD>GTT(gv~3SY^+I)% z1(q^dM?_@{;vyfmBZ$t|K-&?uWX~oUNV;sLg#ng_rU(J@n$&8iP%Jc6DP?9_Eoel{ zP3X5eJDLS84tIz)TC*p6d+Fws3;6rCgB!+^pL^bG0`C_bYM=MFp@HehLeycs;Z+P2 zg7T(7^61TW=gOE**QA9VI0H}n9u65J=c|_}5TVp6t#Uy06&HBFpwJZ5D25~ms=KEF zZ*;K*v3ef+?sKolzWcqzec!DvHS~0!t{OmCg41eQbz@5XBi9 z+3!J)5$>vbys`@^+;vI(Arth+}#9B+0qIz!; z=^j9wvu0ThD_QskY#AqkpzqYCgQ$8?MlLn}PQ7048E|nlx@B~Bu(f=m4150wYZW!) z8ObYnCZyBc15)lrfO#vSJN<)|Qa58OHAdToO(W%0|pnNE$ z0f^Z5V?wbYIH6f1-up^y@iw~>1ga5Sr5jU$K(z~4lF?^G}{Bp9Ur;=@h&t!xGMYH@O#3VU=R36?{B z1!t~R#os|?KlO8zXu3OTQ%fgC8MNZkvunW1$RC|Y`W$!g1r~Yv7W)qvyMxpi;l#)* zWSQhh&>4Alep}z_{62lMm*9_tT48aag6dB~EwI@0pil{)D)<@IbG|}30hg3U4LZ=_ zq%KVN*M#cJraXrXor7saLpUwWd4Z?B;qsOp*3BO z2^_yD`pG7z^nwTIug+f%-}T%p`n-okM(Rw&Rn#XyOJkQ^&d0S}E*SI>I@A9alLq(` zn(Z##CCMxpW9U2fMlU0OAep`*nZ9c>giJ9HIOv=&E{i6NPr^ zA@X)U*hlZ`U|T{XGB~w`#JYE^3Q$tAadvkK@(ZQ%*{bKv>V|52x@&vP^{9+2BlN^_ zc*pjakiP)-RVq|2OlxB1XAgC;55~Ld;Mkja(sX@hzqSfSVF<7Ff%s~COVkPx)? zhIPJG_Kb^knsju|uThg=T23nc8RC=t)%KOs_)q%65WY&WyeupH%7=6(z~0EYcqv$B zQ*XwKMkB&i@=P|KzmGB^Fo2q)&yS|k7i`D5Qg;{dzF2UonBIYfF^R?+U3>B#f1fKU z&5Mk-EOG$h?^G4UpHmGev1{CZhrh4RwuctJr#`nIt=`~kb;4}(xItDwnlE_?FWI~C zYNguPvk!@!{w&WcPGW*=q8$dSJjkRQZ29~=PxV#JyRGEUi7EktTLU|C093x^x?YSS z)`}|}cLjXaW{fgO-|_HI#;}CIvuNH}om_@Q`x&)n&GOK;M%AE}AkKK>=g?clSRG{I zloN&6@07=nuWFM?H(0`iOs8RSb#*OBzNPO8#3Aixw)yTGwjJy{+^LI5+}MeNl5<@n zFb7v7KYZM7p$@5TaQ8FN_YdEyN(V3q>*sIe=!~M<#4xF8-sTReG)WbE+YGsIgbRMy zBYg4;PW~G7pM!An+P3flF`ob|?%paDeaKVA&88KntIGMwTh=eJrC*l~k*?2fS9+?P zh77-r3OF6^Z&Ap8v4so8h}x{*Fw5B=v!oF;(|G8N>%~ z4q&y~dXMUx#6D0v8kQO1`Fpy2*eY*S9YmLRb1lP|Oo2&*KHP19T<7{>6sH_Smv8Ol zgMsMs^ar{e>qSCR*C+D3j-)Ou)Sx@@0_x43jX}qA>w&5qXJt?8MsKIx5Pfh!R7}L$ zoQpqbk&`$X9p=H7e}IM5 zy=gi!J?*~!UN^TbbU@1htm~!^hSdDf(hbvD=#ROW9Le-}wP0RGveDWuKj~)^Afd2C zvt7o1VZqQ%FPmwvki40luPi0*u5{5FgnZ*joQFAw8n%;&vRa>)ReQk<)mc!ALF@Sj zCw^u~jpc=22y)Uwh%fzFsj?o&4=DDsJr6fG(D_-r$n$#BlPW6b_`5xu<&T;S zU#y+Et&aOKzXzU&$m}5sfuSrK7|B-X$y9+LXCayKbC(twrR;k0 zM+Pnx#bkQVTb}SMsvTg#1-LFf$6BnS&6iEF#y`+hI;EM6Ds~bul^RLRzw6wXUGh7_TRWf!B6)rqq*&au|L_2vgP3#C zoCoF{8!*dL(oLYqL7Ok(oFG8)EaB7%elHD0U?nv7Y7XE~QB^6V(a0;yXEGL6<$a|>9f>XyhK@m` zLPh*uR);QO5a!h?9FIU0?KkH13#^r|!^2~HbVK*!c6E3xwa~6eooaR|`lR2HuZd*? z2r}Y(M%}-<@>Gh*tCLiUgBH+VJ-YJL+xtpfZtuPl2Y@k#|f6|HnWhD+;7Ma?Uvy2AF@3!js-gD;ikBZJxz6sycZK6kgBBj0(&&(EAlqG|B zJ6f2vD|Tr*_k3K8!JmC++Z6BX)*dXv;R!6tp(j^KyqG=#-~-{a-PdH%n$UD_$3c<% z1SoPhZ$u&`%q~fRvXQFuDz^=l8PKiOFhgSjUP7Cr>5JfB6Q$*+mZUKB&Q?(OMh?qv zm#rN4mr?n`@`$lVT93mXy8~Za$Pt5NoWt)46^i>2Bsk}A-P@7uYwgZbln~eBr^FK; z!_8{A>@URu;a=HH(|zo-J24@ zgF$qRWK{ZrCVD1d9XYqI$L;ABdH2mdI-?Fmo_oiF$aAXUNAg^JQJw$I#shi&?w&k{ zu0|yl^eM@0m|Fm?i8ZtOwF!dO!~n^1)C52G#P%Nc#Kh@}^@W1x6YlrKuwg)ZVx?P% zW-3N6wTEimDfmpBsIHqPYUDgtzT?f*R&UPE@{Y(fa?Z^s4D}XgMYz^b-jW_DTPnu- zP=GfkLs>CE-S3SdTuR{|KkSV)@YblI#qB=jx&rNurG0Oq2l#;&#}W${_y^c1??H4Y zWXA}6|4xh83g~7=fBNvVh{BQ{HI2QC!f2wr1j{McnD6`7E#+~^@N=3b_aM6GxY5Pn zPY_*n#KeAxt(EN;5S@3bLZtqT9Cq1kpWm05yqTx<%Sdb88G; zWPC4#4xSm|Z-GE`H-`rh{ov*wAi4-@v~tb;^0>MXqH1V0|5n!An{*7>5BHdxG4W@v z4b>jOnL)wNaH57c3dP*VyuETD%;vW&s!~+}r6&!-+_33Em|LW%du8~qm|M``A2B!gns%^?f%`Qkq&8s$3Lu&8K5KCIC1*PawRA~td41a{Qc?};P<;@B2FG}skI(=$9}wB zYj^mLB{wQ1JNmdg7MJ^*-LZeHj@dyz@@)#Lidn@!`8Gt=vjxRG4mp$;athuGX|K1~ z9ji3x$reIrzdhkC|1jvjs2`BX%?*&QsbS>?jngo0Y3J^L1_uoHv$^KLM`*+@L<{=d7bEFvdlMRd$GmP&K#(pV%~Lo;v$6ve?Ah8v?n1 z{lk6KaN9fCxh+rZI2_+FYR}TE9@0Nn^qn;F)9TuHKYVwDva*Z(A?qe0u61Weuf`B5 zXm-y{%oMqbRDpLZy0Ez4zk)TMeEE6?JITOWKW9eN?#@Ip--=*$<`}_GbSrvr##G$a;kNME`JXb zxiFr^WhS06SAWqwS)aXB^Za=;&1YcODjR^AETLn@1b{*2xr}FWT3YI@GOofTHQ;IE zedD?nir?Cdxj=EDmvZ^Z+$kKtY=2QP_so@)ZD5Xf2GK?u2bdF)+!v7*jeOIV995r4 z-VFEcGv4jacLz2`r!&(7{VfSG-{DCcD}5^ps;S`+En{_v%Ht;&t<;GxB;7xsi6#J$ zP;StO&skA_P^B%8dt7{Hzfw%BH8%Wwl(}{x)jRkj_8ODJ)8TY^t7G&{4zxIOBq2U8 z$2G6>X>$2fd*nsJ7GC!o;q`qfvVh0?OfCpGn2aN~2K;-9C~#Hn=VrNsoM4G}c7Ro%;ZF=wlh z4XcPl1ks2%C0l}dPJ1J%3y#;V4Gz`keY7{{JWDkBs!mUdz+c6CFVDD0Yc4^`0odSR zGG9NrA0JAvP$X_k%e)u{Qqd@J;7ijOf`kq>Q`L=(oRx28(DRy3>43HoKM)pq*6QYL zaCxv7Vk7Ic$mS&%q{#KN`MdqwNDX+kZfCuacH`t=BR{L(4ppzFyKy_kcyWHN_Bjg* ziny$CDo*VJrWO=!aU3KbKKf8;co>OrP+^IvDb8k9NYMK?%c6WTdc>mb4tnqk_qZP2Fe2m1*wEZ`iSO zBxW)(qVP;B(WA<7xO1e_LiMP>=wnF(S@2rUb{dX--D%^o!##Qo7Ab&JX&0oLvh;oj zF{Pfc9~d$@am8?T@9o?D?W)*i9W3nif(qi*^&3Q36`I-iBAdPxJ@4X<&70AzgQZ6( z3$LRjx0%Iu-6f8JxIZ2!vA*|@D7%RsU@R&2%x`WWbLg@}H_8l5eg zSXh9XOm8m7u1`Sr;E=o$RyuBd`rEHLTBFg~qo`l?o*k=%pP#^o1S8i_o5MSUZ%Gb` zB00#16S)_C^C>R3WG_zLlQK6!MbTx6ij{pg5XNyvGjRPuLKTviI^}hnL8zM%5~S8g zd=tU|jTT5uAk2J_4j?_Iw=a$Hd5TjyBgH)UmCWE+tXY!~k?e##2YXFhTKcJBl_o_% z>SZ@X2^sR`qO5GcTGdIDyK-S1Ap4)^_8ok*3&tU{)8zX$yD-x<`BP^H-44 zWE!{~V=xK6X9kuS#a?zQRGf<_XX^^`c2S^7fkdKKh!#ZS_&A__2~}6mwJDG$mlSRh z?}sh_XDYa6KLF&9#>P&&w4t@k8OAj55IUe^fh3qMu(^O85Ut|pg|T~QW)HLd?(3*r zj~dS5^^SNtCTFEsqiv(DLBvQ8uD*NfyD+v$w21Q*J3yPITtT>UgmW9(;H@#`uTSL{eaz~rJ56Nfv@j=W8v4PmUAA-fyp{)VQdd73t>HT5eqGY4 zkFvm9GOh<70Xh^C!+J8<6`e>~d=vxDxwB9;tgC9K^x!tVxnYz|eSdXY0ja94>Ag{R z)cnn)&)xHUKKg2J{WJ;4z(5T^CaPU|WHpCP&_O{^pC7Hn7r(7>jeKNOYs z8zQr(ni^lRWid8|DKC55EtiXE)NPO-=-x5MXS*Id9CYgmAJ=~&&T z?pqPQuD*@9*iF~W7Yr`sWc-^}>~#!vvFO&DB4t%2U>Y8;Zx-VQ6UceCu1Te#gMDC8 zyx!$64MZydPDy3Een^_%x-j##%lb}G>_5S|*PB+S)8qDB!prlJ8%8X$D-R4s4VQ0M z%O@S1Z$_Xqkokzb`7Xb|*#w-h)xk#+;s1zn{I2P|UPZpq4tn49{o&5J4<~}TM^pUz zv>S$3U<*tL`5BHUvBwl}vj2y6t2#o72H|(OK@C|bfm(lyr=xJ$m?G9u7Czm38JXsS zBL@NLPoKa)dG=(l3aqku$QXg+nZq9G@=T0cy(&aRE5%8}Rl?_`Qx`WtBGh*MDymw; zBx>{*HEEJp+D9-S=6AO6?Y;V8hPe^AtxMp9>I+D<&q*$^T3Fq;$u{#qU#|HvW4Nc1 zUWT}LYt?MOtD|kt7W6zJ{f=zAJQf*$)sA{Mot`0jcrnxx!G zZtQ2gIr#3Y*{}zN85=OU1PkzDTLZ{eoffe1JhH`aKzyXU?z-jzWr{itZ8EFkI>oe` zci(Lt?!qb4^kxSc8Slvas|qJ9C8xadsP(FSH-+>p@=?7H9<Vh>k29^IGYjOmg)j6cp3!a-D~ropwZUJ=wd+eX!D9-FA;!Ezv(E?Q)^3i~ypfk2 zcEj$;*EJf~c5UE@UVd4H&^oMI0bCLO!J$?PlQi$umpWW1?lqUHkC}R2zRR@z$_*=Y zo1D|e7@WO0@7w?dy&^06H8h%}hWYH;-74alhNMF|e7M|%I!gcfts1h@@AU{Cq(?{~ zJ%R&p3$o_1Bv(HQ5{k^DAZY<#ueDpK6o3n+;LJ|H->Q-wiG&>LZqFX^jkTc!7k`Dr zan0#rP?b&J}0C}sa7Yy|%J6zM(d z4c=lRoIX;=6ze)#lb?cAO>X122Axv#WIHVcXW_QqVH~$c6}mTFN$zwilWo;hdaKal zDjD#A9}Ef+hK&09l5|`dvVXNPl%wM>YU-;JJr6m8V2GD|U2L5kK||F%h69TzGW{vX z1U>(lRIW9&nvYQl^OL-kO(w&;?6h~0ep8IlNwFl)7zDe?+s{c7q1TzlI1qq$b$BQm zHvaG=RBd$6Ew@`m)xn7j%fF=exvfJxvD}g5Kk=*+9fEa_ zQ8$f=rN1Ht%BK?n5`dGrS*e{{=B-Bzh#7HM!V!1mWOA=Ou@E9VdC$HnY{z+h83taH zNWY0;rH9sd>-KSAUdAVIok8Nxf1ROFNV-gD-aS(Fgs{1!95-hBkc^qhl@1tOu~@dK zsk`1ThXAI7dH)=%3=JrMb+hC?dFOnh(&{2bO%9t)0SidZP&5~^O7RHMNQl`rdA|FE zx9G!ez!wJ6E`pe`;5e~dR?<9uUM1YR%XGX+$;g)?Bs>_M^Ts4CFZCCZp6)7C{$U(^ zfS<}jA%GigEfR7G%d?LvJH;!0{~#%S#lJ{O2puFngbq|Af&k}lbJ6YOi=jn9B!x%dlIzs z#eO}Du~+ln(p&bPT+IOKH!dJCDVg7a>9Z@zi*7D+hg`OGb%|_fHG$kD2u!O}eM&N~ z9P{D^yD>fE>POM`29SwpfghP3>T7#H<^Xe7smxHH*h zl^hxH0rJfI(c+mDFd={U{v!JmwP9@4hpH3PPfjeGEoe2#fRwqQj^{&p<`Fj5-=V*4 zfK^P&jV~81C%BaM8*dF{3$o|Z? zML=-f+n;3A7Lfh1`-lD6@C4bPi3A3#uy_|hbWsi!+tORFf+dFBg}0%^Ie`)~AupAc z=A5@@I||6nxe<)V>8rNO-fQDad`r;?)Y~kc?*Enrz^7FU__WV!B4<94!)rTS0Vn4* zefI8@yBWUQB^JM)2@G#i$%`>KWLiPu14IaUY0aJ^;3&|ul$>MwsTkD`ZLrCWZwWLt zAl^nd+qoUhSVroqMmOYXSDrcaL>cAVG~(nj99hl9%If9%k3ul{DtfRCA79~>Nq#ue zXDwFt%Nz>dv(`PG$u}4G-&oZjHRqRPNB7HVM!>&K<*C#dL6@*DeFMj;i>{hz7}r)H zEx$FUoa`do?#FfuH8p|v4x2_8X~nd?4JkuE+Fv-2HQYiv8!HR}$XJI77-KbbqB}`0 z%ytb{^At)(VcAfLvgbZAi={9;mw=9sreXy`fkQtL%YVpeL$Hgk1!;K}Es-8B1nVPNrAD z`rR9uew47pOru!+o9ID^V{A)&C{yKO^n7w(;tWeotuZ?Ft(=f+*j}@#hVc`5I`)pY z(dhcm;%Z&=1lnQ}fh6V6sH%5_3FD*iJj)S!MU}l1+wQbNu2|1W6BFrS!-8 zRDn;*;qD)gVzaMBPR+Gx9-o>#iuJhiFk&G`V<7=UBZVv^bwe#8bc21a%yF)-(^ZyT zI}fl>S0g1XMWo1-aAU?Q2&p5qyhkE-$b0d!Q3&By_N!19QyA=n{9T`G{9(LW2I){R z(%Y>?6_WSeV-3A(*NCcLKJfbkbWBtmhBq7)Y~BrvJOfVzdk`I9Z~+tW5P%FgVRyt? zGz*0yg5ZPlMqt)gWYK3!|EQ_bMCQO<8%aJjNebZ~Hz?_|?B;|-vV!-upXDgAgbC40 zqWA-Es4Jl6Wq`}4V+$(dlJHkPXJjLx_!?vj>FQ5Z)obojiZl>6d+t?pl3LdSP9 zcd6^nY{J8PW83HL=5#Hyr2!ZY++Y$z;Ra2~NjMBExz&_7d9ec<9|$tp#ml&2g3ld@CSj-d$*tH6yPoXbi3jqbdz8R4?ho ze@ENY-@KiJU-reXgx;U*!lf{BcC?^=|JJUq3}{}&%lawUl#zXws5_YO5(Ie zRW&@enhQ@QE`A-v za2=nd8!WEam<(sOl(|H${*XH7?5UZ_C#5_eeC!8IrO^mod}8t-y4oOvd1c1!O(hEX zJ!2?Wf8^Hqa^YkwQS$G^y1hmKC33fVoSs+uO2{e$?R&hfWYDJ{br8O9DvAhB`<*~+ zLJtE1IQU}*`H2A=`lw<=QS5vlQflw}{3De5G zohp~Zz@?jFZtrAPb4GjJ`Q$Aa90Uf`^96{v`b>Z#noJXcer~_m4$L>SQ0m?`I!AWn z!k~{vI=8@VxaY>(P6`;?_kXu-qd0xZOAwM@H3HH(KRZ`QwD*%ruea2AIz=0}xCp=K zF$+l|v#ie*8#V72^(FWO7eNIgA>8&cor+>Gak%yH#+zG1c(u~4RDnzfE?T^xiiyr zly4?z>TJcgm~FfM_)+Y;Ca0>LzvS?^3g9&PQrod#>0G$QcBuy}?SxB?29Z^7;jPn4 zw;l@MoSI&%nlta5FbVcB7DBHSSKq`aF!`{vb^H)Z=|Je|h9XWkwV}6^lovfO_hsC= zP0*;{90hx;>Z>q_5NeFU&$~KjTsUTDQO4b&5?!t0q&p&SYYT?1R68sW-xC6T%>l2n z-pR#&)TT7Z(Xv8@VmiWwgLNkcOLk4*Jzxk|j*5rev!xZ`8+b)_ECsj{B z+N2-CM49(}w!8~`b*u(rM-6CXg5tUp&h^4xL(^g2kVHk5rXnD5r8&ZiV)>E*_qJHz zvzgd=9lfW`cnz7E^HIfCO$K>N$P>W4F4T;#9HB<(CTuR-lwkK_vERDt&)5$L?@JCw1Z4Cjlj){xL~&Xj^q0yShVOfMtYk^En*CLaLzGvj z(WSeV{Mk5*Dfy_pnonQOv7_)v{7R!m=;7G3J}py5e)=g(g?ja5>T4_y)o0Y(u?)Zr zUt%UsOTusFydPuVBt4iWw&a;tT?$@xEI(gRMn;a8YntBYDI%(7#g<%idfn~w z68Oy*6To&@)%>muHR+Cz6kWNOIplKZ%TC&)=-qA?$_LdB&_g0WS<0homsrmd#raZx zQo0~cD3(|&HuDO{l`^+JDKXd-r%5ib8tF3-u0?L!i!>sUcxr9*k@+ z<+oeUq?ZV_w_mEbLi~WabBqBRWGI8l0tXw|#bRk3qKv*Q?IDs7)bPyp&(N&t>fiR& zkU~$vG$1x0mLAP&tiea2J6H86W{>)g?~lA3+KzK9b{tkW;=C!5{CGRz_~IiCkR%!# z6@3@JDzZ`bri^OHCtBHC!v^Tk$cTN|{lZlb)^;WsEB`vf9#9L|^O>9~ zp@qhJT!ZYD15tj6^2?07_{<%eu#pyaU#xTl9QhGnJm!qFR6cYd>L{*}V`XcP7AsYl z-!HOkIED?ro&W`lilM{&}97lhJ-^A)6c9 z6Ix`4r4*;x*Z^o_?55>(|t5vDnCf+e|_bzS3sJ>)i zF2!3V)|`%vC4N1*X7CQ&X1FP0A0|>Rlu^InNKr8t37Jb1*W>mQ<+o5_b)W9*q*TaE zMgha0+HxVVqApVm_Z){(;aD!y#G!jRv;&g}PrYUS^s_-^2R?&8C!wXOHrwYJZDv4< zJuDD8hYrz{$f(#a3qqLR3Bd;yD3L>qno!*an`)(!A#etJKSI=j9yv_fv5{<=pnj(d zxVn#b>3h1TRl@IuY?wAi-NAfa+^(s%Fm5Ma?!W-8RbO%Utr8WWCKnGhh&^G&Y^A(Y z)2WWTMX{f6a1_{Vi3CbPL}0zjT8Kz`rQXL|zgXh-xc&Y6Lc7r5!#2u2uXdCfF#p zq{S>L6#?$00DMe3ZgwkWu?0bPJSgb`9c}(i)Kw)M{bp(W-S>nM7(ju%WLp5R)Q1WX zWhE*cx+?DWx;k3is5V1iLbmg#N632u3ZO`SJmgQGf6bpfFdy?Lnm1UFjR+$@b-VvV zBccX#--wt6KQtoW=Yn(yqk9XTIDZx*M-cy9hyVaaRj~B;jYy_a;m<}S`FD*-NcXAC zZyFKje`-YHZPCC`8oIP1rQ$)c#nA0RE~G8EeEha9sM? zh{U!NU%|(=XErj_HQGNmB4*Zq(ugoUHX?n>Y_#(CjR>d^8B#tQqt1&a4^AMr@D)pg zEwbI902LzTz^qb;(_AZ1BjVN`jPmNyO$5jJo=I57adHJW@qOn`6ctTUL(g*>kw&1(Nu4|!EGP`l# zT}fx6bqu0sc+=5jFMdo_`-se664qe46Xw=Qk9?w43w2GsK{g5V@L{1Z?y{xLj`{XB zy@v*eVa&@>I!#>&j~$p<$x2C4F)+tE)km-pWVt#qQ~;nTd_SS%vDi`MD%K+Pd>!OM1)C8M9oskYurJZ5Sd*b##*uNS*V^Fi4DwB+RDxT&lnbP+!cKrCG3>(rC42u@>ZatZ87zn=NXdaD)~aGir? zNqQ&GwOar@y0Sga0qW1O0*)-!AU@5qlft4%Iz-1n>RXFxG`3#3L&%bl(HpwyfV(E= zcL63i%aR+F0CrKQsDwvqAIYjW$SozaForC?ZC*qrj+YBm_LTdxN$7_MBZ;^WXB)?$ z5}={;X{MFSVdBswJeUJzG>6XRfDYI<=ulJ(YXSO91vKwW82bU-hOvH_5VTNg-ZmOX zb~VBfoKQ|JFzbIb2Wi3iSs-%|@ET+eP(bFu9b^vt@67=L$Q*!6B9np4fzVHL08<3@ z776aQkNQ+}f|0|mi#J}}8bbTt9B_inLBxYOFlZ@RhcE|u1Hgkh@CNUuQn(*_t(PJ@ z&=2My8e|R(_PseVocKYJ7B9;V7#KgaC;8aYSjW0LdCt{PJM9e51!*OZ( zBBub9h`k&P^-9(%7i54YY%QB3MC2MR<#-?kR#9L;<9{n1XvG_Ky+AO&`V><3i%Rf}?k0NH= z`ygV$gbyN?DqWI%RT)~^j^?8oSyL;C{o;u>7%H%{`2rP;0nk7xsq1c4>-{X@UgzNa z#T|S!`^YHfMi_E)_20?PUS*)i$Xn4nb$J_o{~-MpB6BC%EN7s<+(k?ad_ZPNLRE#E zdh}=8?+H0aMraZmpz)oPmQu1Dxrv7+Qt`l1f!(wLAO!_^JR6foF{J*MFS#(ofydN` zn-}$?5rBmkhV#f&uwQ2L={lZAkvF2_=qf>KHX#`Adm}COplxch*e$9OzIDZ`#w@A` z2OZY#SKGT4@$cl7<*$>bOLXUCoasYbXu{%L`mvILeyXLpxBeO$>-Q1eSc2u=MT1m^bqhbeMP^y(`!|`m!&O36Xp_c{8^ua22H~R zO+&<{#=XxdF8LFm@%i*;>EAcQN^1;!l(?DGvHtjI`k(}Qb6>k8SV=u^RL#M@T_ymA zp*(UXAPwb2G{BjR23xTs7*0&(TZ#D7oa80vHM0H~ujhF|N}gVHc^4bBi&=pLRx??F zUq&Y@xeJe7>?_yt;rg?p7r;(-!(N~UjoBAAo#$JXzeuRyt*0@6ZUEJZ8n8wR|IU>? z>P=_d8ziu&IFVsJy~=T{8wkCtyBs9;)%u#^LB~Z%EVf>hl_l_U-e{lns{wj!BM9+N#vs$=osD zokoZRLrfrlB{piv*;@_qh5Xwo;09kYH6I;2(4vx(>l5h;Ja2?5vtI7SY64e90J}|B z*ns!`>SY^PdL3QZSbrYP8}~DhLg`F1L(DHvMbr79pzgpBtaD0$+`Bk5+|9oiyG^e@ z7rU-dpzkiW>3=A9ebC0p+@YzeLYK;@Nv;PAlq|6`%EVnW-RNqf6D2PVKgBPse>qi* zoI3cRiq#S0#ii1_x1~IP?%Ob@cIx%)sj2!`G+^{B8^ElK89QY!%18v+`%QRye0-Eu zGL4v|rgDURJCbfp&Z`Fh=JiEu^o%Q+$e5hEFWgf3ZF0F{n$6J7ezw%cPPK~YO-vZa zhD+)vqvx?E>R^PPIr?ct`myO$CF2(*7oi6j=*RkoI3+7szwmG!p641P>Yuz} z%Q1Ae^s8z4uL_q(6Pf!8dP{d)E)`7&wov*WihX3J`!s9zYuB~ zKM6I!i^+~ZB5LBue~qX${zTM_euJp}mQaI#qbAUsOT6pTmGwxd)jSevLZhgwAVN*z zo=}4g`bnr|Z%P7&L?i7U5Ve_K5w%>De?rtQd8p%miWc|-qK5VpQF}CG5~+`b+T@=Q zYM>CG`X`}w^+>4w#*YC&h}wT>$W*`l22uOZ8?t}p#{fQ$h}tiPjE}aC?-5Ze7ymOv z?LTkG{?w1D6g?1XB8w>9>k2YX-Z=C})HXchpZuf26_CWQ{XGFc|ok z9T;+#lDsFQpd2jB&eetIeXB`8ETLInooct+PZ&%Y5rF{vI>vY_?75M{UbxrqVX*0Y z7_8s@CkzJoNrPQO7RzVej~36fkO_H-=0Bmq{xu9nnvP+=^x@(+Fc@sY=s%WW{t^Zw zjLrKk4Tfv+dm0RgSV|2>4SZS3f-A(7Mjq54^Fgd`f)K%Il??;!n*ccLE}ho`FrZXQ zgY{bVx7^jIe{fe|_00&Czu~Sz>;4sY6)9uZ-Uh<1NHrg^D^a~b)WzVhhKPI1gO+pqUC0V8a5k>yEhqI;3DD-q)x&Ff0F;XExQzbHHA0_pH;7q;yH+U*->pyctslSU5sM!b zoQ*pPpbjDGGuKK;U>(G~w#fGFtV%lDKmCpl2$OXnS?@}G8ZVTF6>YzsH>T1hI#}lr z>KWj$9cn2_mv25Gk)2U`9WDNKEij$-qvI&XQeH*7nh~EY@3y&Kg-Hn~7{hTfozfVE zz6lMST2<^hd>ZG-aBQSRTD(HQA%%2E9tAIcbuw{Dzf*NGYn(FnZRyLqycOWFQQ>F? zz@%$i?$EzOv9W-VkS5KkV%|fE-^7wJw&&}Uup2uKkCdX3=NTpZ=}j< z(fAdUHW~A+j|gRcq$%3bWb-6h`YpL& zExF(c%Z`kMEeiwcAhS~%f+;~J6{eMYTIG#sK;r{*bx-@AmWWH`bgek&aP=Pr7BU21 z`+Jo#Ty6|L$*v@VyUD6t8pS;4E==~ZuS6m$-pzWy2*z?0R+bXv>Hb{gA|Gz_MM4{I zJt$Jzfx1KezD8Q|{vk!0=tJ@YW))zAuq$*>QGyTfNNGf{XAyl91$GZ#B~=tARp5@S z&=oJBHWFxwqwQM7fC&zK&E<38<_wDd7ID0ubU8TrE|8a8b(ygHefun)5SN)pEwD

    vkZQvyB1a_WHh(_DK6#vaO=T^$qRZ)A9T<31w5AoP z8V3k$&0(0gqdX<7+2yVNq#Eye&^HU$=}k3-WkleZa;`0(d_!DtSvk`fh;Mn-kg!iS z*K_f%?86ChnXadqUX@bm+5&)B`_pcUqauZ!Hflrw!zrs;zkAGLnD$N!+FT_n1I3MLN)6;L+P58JueJFuQ{kTSJ23`?$7IM!Z&SV#Z;yz^V_U!~g@+}xgv7hl& z+|3*bpD67AAy(4)C00`XH)5ryxc@3viu$WqDYW)~G*-fUh?NNQw;PzrCx}`l(2oFP zn*3?uBlbWdAaIQp5G9UBWH4NhD*0N%|4lggr4~zP=l)PHo&_9^BW%qYTH!b=#a+&@ zJ2fdKb?|vNZ0ArdN0or3#l-4HP zA?`{oJ`hV$>AKcu=7%Ju%3Ks0V)|$I9mw2%ALhYVfx+`hB0~1nkpWN%BIA^vpFQ2R z6e^uiO|)uz!;Z9-I_;=rnR&EIAJ<&PLZ38If4ozdygNz=*Wu7+z@auKnE!JR@-by% zj2d_@2fL;W_!R{XN1FHr1(wNrM1dJg?onV7(gR*JMJk%ye@1~9nSX}@!+w51felk1 zP+(ZWj3Bh`q6%X0^P3j~xhmDJA;Y&);Y`$DN8Bi$p(LggC;%FgG05H&Dw|JOdVC!4 zpGShvDpvBKXhB%ARiOpz1&nT~KlNv4sjhGxHBLzo1lPS2YqEpIt?j{<|%A(ib7j0zDrnUij>eSHN(P2$HGvtNYh z(JgD*hQ(+J0Hj?R(G+Ez;-~3=K*1F#3z9Kq;o4~t%rfEHG4%JRag@6E3zZHb*p?Hq%(i`rSRS_tJTomZ_wv$Ok)oOviJouf7NH#Gde*);=p@I-H$kZ*pnOKKZKT(K(_wzo%Q- zWJYUHrQCL$0glh)5*_VrTq#Y_9R1&NI$btDPf39|9fRhUal8RM*yd(ug zi6@{$SFJ@FmHOlE^$ba0$DyT+@1S`=`*;DlKF}!dIY7KFn?&@8j9UN%g)-ekp_GR2 zWI46p0hL~Z7Nnzp+%HH=Sv)LAKkP@hz&-9q$9IHzVw(CGgrbq5GR%ybIljW3u7klaFoo{L>S)-E`MY%(TpQ5=WH^L97nt{X; zlJnM7pq}smyAso*krmac)qyW46o*MHf0xi@Fz4IR5zjS!Ts~@sK-^n^q*&^~DLpp+TQ5*pF-CpyK8@;3I01^xQU|HB@h~vH zA?X_7A<^&GS6E2YT4*@JFWKOA!>VB;9bXbRG1}3fMAdKAZmoIW2S~#PZ=|_@){Bzk z3kLSb+%}jtH;O#BmP7e>R0Oh*!b|Qy;mHK=%+ZOSm*5D-(KZ&rZLO04PQyonFH7?8#B1dO*KS; zdNWvPuZ(<1rcfI!+s|^Fkex!2!yT zJcgrd&fJ*cI~<6T6--AjQQ|BF~xD0^|#?vY@T3MXA0Q#1aOy|?Aqm; z2sP@xlCqUe3N7?uW_V8NQQUd+?DOUIg`;(1m^_M5P<fiPM>~otv7LJ6 z{pkKBG&ZH_`c#q4%}~uPG)Wp!Ta?eqEEl8a3x*m?8{IRF1Hpb*ak-Nt4I?ik^5T)o zKNWy$EZ^U8lBQM;*-P5=rNqWNA?DrEjB%w9;J+U9{ThRKJluJ97lRn8GQ@fiUt_Spe17hv}Ew6DO0@*GyO=| zWSyI8HM~tscy>gqQjkx+Hl6Unc+y+LXm9=VaA2IIx}c4RmiN50!y0oDS>AR7myJpN zC|;&Q=tW>p?F(-6npz+|&+I`ah7Orj#Dlw+FQeVB(_F2m>QQw9;6wc$1;o>6MZ~hL zhDVLgjBs;5H=yP+(pFyNiDrSf&$o>M4}`8v(-I%+utkJQ=e_dk!Ud%*Z}iU%D`r~1 zK=yCgFpEGrEt?LenCW(l*v{qQG;T`_mtH37TH+KJD)ebY0ls=8rcX@bWYC4#jkNx9AD$8kW%>I ziR+}*`G|H;mGecjwKoytFT>HaUUwyKzo5hexwMl^naJ$H7qa@yM-IHgA5~&MeWQ?m z@WLLwVcJ~&LFR3WX7L9E6J2ff%@hbOE{-r})Y}i-m!kZ!@9RK8`rE+jlG{he1YRXA zY#D@|n5-I@)FUp{KZJdtVOVz1Umjmyxg&oePuCPwMyyvLDw}#rSpGI*;~8;E)Dn52 zA_=KS3+%v~%*;=wf2}{wI{O-t_~pyDh(xu!jKqHupi;?$1gK5NE^Q~@1gJ3(c+lN< zi{iUeLX+PXMTPH+qS4)=sB-VCBXIp6jzCD%Z;rswwNaw`-l4E#gb2maG+#Y^p5Hxv zp}b=#q(4#(L-l`7H5|44orf>fc?=g&l&JaHsrOgH(1ThmjnVH$y^WOGDQMi3K>WOO{4^?Lbajiv90v;=wQ_(?(x@uk#Iz)WvFNAsfnfKWD z&wSsz2tQ`x&w9e|kFX&RpZxq)+p3pS2-uTX!3ZdjrwYM)y{K@4WV~Sy1j(9GDIVEN z$==LqEOU=63UD=mc`c(V8^EI+N!9F#hZiVQMmQON{2~Pbr$N-zAvET;X^aE$E;|R? zJvB6CoI5n>@G)SejRk9FB?cCEpB2m;yt*W-y5x?1ZvDYNUxfS*+2^^h>~q~>sYCl6 z`+N|Pn)N5_bJhQVefIp{V4qhsivDcT1O5+Iz5mIg$8fjmEsK0#^){aV!m2m)H>)1X z%wMf~dH*}B-p8T;k5v!&cUHZAxm}dMObD623kU%^X`qS0Si#L6s6pQ8ZO$lWT%Z=@P z5q!Arn`LUgwdX_*KMT(M4it-(35vzSSVA^>eH-imQbI}CReo1OQ9kN=opkq7=cxE$ zBv9f`3AO)IE>`SRd;5=AEYid8u~-%hKVq?xk>Aftou_(F-Nj_a!*pe zB~T@0>Uj@+S3>C{1y|Pk)%{Kh1=aG`N+sKWVG z3H7e`8IUE%n6~Gd2Kx-!f#~_=`8#9^n6DYSmasuFzH!iaceF7*_CILjg>STRi%j}S z%C}Uh4+o^gYTr_&Q2FjsrO==JK2>U&2I6a~l(y#|Q>Bok0ZQh>Z?RGc-$>^!^(UxQ z<1J(xPg>F`GIT1V68H&yTz}+DA;SKgGo@7UI~JOaT;b!3DH`h)PLA&91U7ORPZ}bR zh$AA7%th?ntx3B@?S4+6`pXC^S5O4i#dm^Q4o&+VpB$RZb-LX3j|eK$zayw2^K^-e zzDH0&=BcrdBbPvMF*pre$#5W9&h>N;l=u-n6Ig$|Hfad1Mv4PGDc*gY{QTQmbiIK; z^6bOejJc#G9sxOG3c&&n1!BW_i`%nD?_a-t_Q>8k{T_Ty*F0w4jJKn6R=ZtO(bXG@ z?PPbH7vuHWLpHu2Ed%ovur`|R`#nUf?qD~+%hRQmEf!|A(IOW{x}0xQCrH^X^yA_?!i@%^yAEh<4vS z|9Hl~2k*gDc=`?fj1mlp9TM4NwdQ8 z`JQGq+d}krX;y2elu%s-FW5uPvYCLtNVRhRt5mBn8<%(y{}Nkx+uOu?tIdFE)~RD) zGO{6xm^|@{IP$}ipjvmu)<7TCQ`UQ;#+q;G;L@V%59aM~-=g;>fmH#A0cU=$O7tcZNyKy&NtUJCK6JdAi23-#XgX$HZ(kztE(;Vq2ie zP&M)bH!mKdykOS2N%v6|I(D@ei6S<3fe;vn$W|uro4~`XQ}UsrUKO zP?zRbgggpb7;H@iUgOl?Wa@)sbgO$s%~6o9wZEGJ&gKip5jWVaUDvJ#&eieb)jPU@ z=W#$Q?Zy7+3dB*d2|Z*7k$pt;!^ZOLCJU$ibMT0FFV$MU)ID6M>qWawrP97w{B*IZ zDw25gJ~9TUc%48rGwj9SHu&w;Vtb$_m&llXmNx9*yUsPdR1d#^(4Msc#)Z<+>0Nm< z7$${tfWFcqJc49?=sXw4pR>A7)C>j% z;}a%6M0d~)^Oi&MaM51DJtP#k9q6teqJMqVXYYksUy3A^W>u^@Oa1>B{$RqFO0uR*i4#!_{@0PC91}xzD!VJIrKtc z#XI6y(E7Bar2c)}SjTHTF*nLbCCKwC5d^2wnX?KqxZFL=21~pR7rL-3b!H>kD=EkO zT7JF4fq|T5`@$=is8_~88J*?}!Rs?YHoEX3P&)6=uqgoMER%fT!G6b^a1eCYaOUo{Kr*wW~m}0_UE;%`+Jm#SG3zRHq84t%51$!2XN*~5Ycsod%be0REMPmpU8vXNE4+goZp#eC zKfMSnFt@l(JBd;`D0O)a*Cq`AV58zGaeq+2#!KOR>YVDrcyg9YY+a@dwi!MvY%l1q76l8f5j6xmi!Bic7Oof+>55`7x z$sqlO#FkgBQ{g=f(Sw#HyjM&U0qA^fq&IqwBrGlz3|x^sO?OvIheu$=Z&TcNAh_v5 zUHaG^NYwbrCSSR?lhmZ`1QZE5cA2+@Kq5xP;u(mb?(WcrhEF$* zF;_FnBFiG%c-F+lBO0^z+_w?lU@B1aGt>5$XbYxryOWGwmE%HT<4FcJ#xX+skb25^ zBD9x*SENW6l&C{YL3s9p%SWPSuugWNcBz~d1&(8Kk*}91w#k4|c!W@w6n(l-^0xV*9vBvpu$pu|vi4682*5rTq-L zP1MXg;jv-m^x>J>t*!h<(*ymChHeI#>)DLatUO|L(KO6Y#B(4)K=u_=%IC^2XSF57&v9EjOc z$AN>_9QT>bB4qX1{0W{(FF#%y1#b}Nz7bt&2;~=tVj>$!lL8Kr4F#X<#_o_w2nq%x z2(^&P5IOI+xQW~c2p+vh{+t{7z*&wQppmME=i)v(OQ2J{(GEY68W5=25fUAbr=&V9 z_xYF%20@4TW=V9T3HxpPtI1r$_C5X2gH5S!!eD{mIIx@;_Kg4Y0pRO7b@Vvm^|@5A z7T{lC+RzPkM2&Q8D7>Y;&YPO*ldz+R5# zaJW~?EAv9D+Qx*fX1QN3Fc1TC-e?DglcvOIoWg20E&O0{hG$@)%9LisALDq!Yw%fB zl3r0x8TBFNu?R$>r^!SPJkzni@1moaeo=;Ij2on^t%xx&x{EZ*HI*wVhK+AkSSoTvwqtj0>&x zrxO{2T}HRSR@ESVj%_e=*PgGYcEvj+l1*{MKrGSug1I8HaY7s4hU!7QUE7z-6XhIh zIi$^mr!TWSblcrf2wS4z`LZl}B(-ub%;3%&MC(%X0%NXJ@$LEYq?Kx`C<&T0+ zGEqa^!kwtl(as`6-3Hq}&=*3m6wxe<-_vkqt?T;k8QpazRdwI3a zyAg(+mLFbMNnzez9xL&ydiTM{x&9*VR7dYF(|l?X(Ekk!n7P6V#b z=<*;sG2p}V@M~z%v9+y(1}#F+v13S_D;zHyb6LDFu*@o%U6TmOg9A`W-@^)Ecrn5l zL=j{oi>8Z^3%yo136{ws8WHepzaQw~_#SisiUxS_;L$Ncw)bOSx4V%v9D@7620noJ zCKHEX&?;qhF=A%-h1i2lb}wYM2k2j_E^)T@a6iLsbALQOo`XGobRmChct}|F(dZ(O zxnCfGcN&uV(k4`R*wgJgG=Wr<+i8=B<^vn1Q_Gc*{kZyr1PS_pjr(BU%4Y%>ClAMc zp{c9q6IZAyCgcPC;p?z&@vPMk9x5&Y=woQI4QnPU#JUBooNf*e4j-;SE^jY?w_Q`2x2(<6rGbiE6+Htv)9ZesHu(nj9Inl7TSoG!O(KZd-==1igjsc#dgAXnx zL(UwF(NHcN9DK3WALj?1sPCApmDNffnO*KrH9{6A5zAu?9foK~}KcB*}N$f2IUQWj#B2froM zdfM!NbO}o=sk!l749SKc$a#q=J?S(#+$^aW%&mcus)|@UX_)zufy^O)W}yFFv<*Ae z_Bzf`|ryNn?@iNiZ6PLQoRtRC3Vs_UEY z5bs~gFw@CcJ%C`n16D`(9}M@j`7Et(gje;rnCP!~}R2nI$ZnrhGuK30&9?I2}* zN)?_s?9UC8qr)rL%)^*^qoPk7i@@P{}syZ6#QJlgo0*u?eO*yyaBn%<{DGVSe> zYaYx+_8#^%=J^753EcZMz8U0JuOiiL@*~ScDJHSu`Z(d`Mun$g$xlWkUxVvwP&l%6 zfxlv2vlg@i?MYa7Gh|Bq(T@8!c!m(+@C4g7ZUvarAx+aCu*!oj70>PVKgX2S%z_e- zjY5?|Sqb(n%lb$}W@hs=S&>a{){axj0?zN^oLeg+AV9XFKz=^I0rO?>EzS}`kxVhD zUNu3jGo}p(NeHlShrh@S{(-(yGv6l=th=s}rQ97jepn+53G)1QkOKS|`u-ULA^vk$ zq&G{YOK00ni&--n6@rQ||319>Cq&juu{bzVJ2ix$hu6m&mn;`iCMO3}TC(ay!Nbfz zPq~S{IVL7_GsuTO4t5H*LW3&EBJ6MBV6kFeAJ6ldshwEh5?1cuD}~!O9vaQyR>|Gn z5Laxn)1K6w^xCyIYgi=QMG`v?D3xhnh~&PytnigM_BDJxLb2R8XZx=96v=L&NNIKd z*%6cRF8on~?zkPJzG)0Fb12yNN~(9ft5M3eO@|wYYnD^jK8Ghlc|0Oj`NsJ8EUS3G zex=l4yW*=RB=ai_*hB6XOa8~8O z?XmfSW2kYdjk(k1Scxy?^OYBKkt3db@*Nv5kho`@0!=XT>rVOuFsV`vQ4LaI8quEX zDzj>q%n|K(1Rre!8?dpKT(2wFVliP4OxtAwRBJs791%G!`#st9ZF{m8Pxi~$E71BW zA;V`y*d<^Wnp${5;)At$Ifkn(wtH8+DobMlA$SA85g%QldOXC<4PZk@6VH1FMsb=# zPaCBw4_>j8uER$yFrTrSIyFc*PogEMGaAp9k)!&WqG}XqPi##N*0SA&DJaD>i@k^~ z>@2q0nli;IDVQgbPBom3oqb3-%EI<3t9vHu#W@KZ5pTJwd5cSV?-kiUA?@-Kp=GaexrIJ@rcb`cP9C; zk)ORWDDu{i_0~)CXfd}Jeobpy8!)kxZH@#M=PEG2Ywo##gf$RVv5x*O0> z>`}Y_aer+P_xckWCayQbLLm}l;VILwH|OnvxUGO=P~N^&Cq@c%=pf&72y|@H=)q)z z7QNg`K((H3kyHjwc-m?ZE7*hWG6~ zJN;9#g2GeNDw=`D3;9^wW-7H|pv(d1;Ng^n`D9@%XAB9l;Qp#pVXkW|E(m&mfX7Lr6Oa`inkg9SE5% zlG9mXuR!)7MUm1H@JqZbQylqT;d|~^ELFdxe_F%)MmYPB6 zDnkrwN{*0=mh%Hvxn%fN>I(u{M0JPow$P-&#uG%p>gScDZ#AZOe8qvuF|lqlS?=sa zUJHFiNh!Dh%4y#YgL*2a4)gex^RsnulWF7FjZi^G9hvfX&3PpLDmPz}s>xzmPs?nC zF~+ABiY%#WwJ63FZH>#7gKZV*wPN$C$V?je!_X>f(Ko7czHnH;FD$aMpJztno9{ zlki*@+YCQx#ad*xHB6a2-Eza|Ox-m}Bth3F(BJu#qCIE{_M;0HT=Am|R{G}RTNe!B zw=S5FP8XkTIlf*e{@8^cO?R^afDrpG@nNKNpj zzTb+;C}h4n&>%rAyKwu|VPo==xf26Z;?^A7h|!iWGO2j9zQ0#d^5iwq#JM3;W_X;I ziv|rw1H5V4yxB7cC}|d@m@K5%I#a)IgQ5M_1_L^cmc3l5d-8@23~p`h^N19<9o*AL z2mhoE7V7;#r0+)?EN7dclf&e$4VFu9ditXI3x-taRke2g6iy4LUuJJGlboaVJKsyv z^7f^W#O+W^JZ?t>smk(a=RR?2dJ<+f!E!oWDn%j>fich?BjnON#(hOeN=vCLPcgmp z?FcUOsf5!qomL4^HyRE5Zqh_!(`b0KFAn-A#~F)P9|i{==MBa8zmvmVw7Ge1`iJIK zlrD(`k)+wJ{ViWuN}l*)c@ME;*_Abzug~+Qm?=T-tOV*N8U1*b zpJLK;B08Z{e7@^t|6Mx`cx$x|_E6%nMZP=d6JQy71Eb^5`(PBX8jrF0-a#a!FnfUW z2uZV+1+2lK1mYdgs)|y+r41MtrhQLR3+dmg1>j)%F2du@R0_jte>)P-QWG zZMFZpCMnM=Cgvmi^rz}4QK2UxXAt$-WL)^1*HpCX8k2oI#iG@b|~ zgDpV{36u2le}Tl;dC^9f@0Pz7mb*3Xc5+{{w0U%S^tD6t~ghq?MP{gtwBlI%|AZ8-RO>m`j5W`O?TGD{#gaL^Md53t>Av zovV&66>ZcNUz+;}x63xg4;N#juNPXte7vCKB5&69pnK$|O>7zwGF{8pTZEuq&IR{b2#;MN+&h}_# zdO#4HLW`Q&f7lhAA6{p+MbX#pw9{q|D;9 z-Ml1IBZrfdZ0f3yfPuN{?rhS3BLo6nsNrtSTQ&4WHZ)YwmgpDET)3kFIOojh zPUN{eJ#@0$Axh2p+&5To{#d0>dgk%7_R}Nt&f)>_TI05hL4eIQb2NtR=G+#EMs`Cd z-E-BIPcmKYd(|~O*tJCP;h#0#T#5T=9IpD`tf49=j;o8ts#ZtJ#-u{&I{7z z!A;>NgbpEdHO0Vsl1tt|&-Ncm_cbX*h z?MrvPXwg08SSYMY)I>84#f~Ln%096moMFFxo+lfL` zv!;9fJg!%0V;=wRHOXh=-E5gSUdgT#F4m_>w)XdjUFkF#qF_A@YaIFL;GJI z7K0#GkQY9zG*S4shSo+dRR~nLr{nuQ*3TAF@WGDn5uV{m@g^nV5F8_D(tRBn5g__3 z$tB3Y1v+q)IC7o|xl}a})lh8@A`r$Cz_Oe7z`g;SNuJHDYM85CXyCow06o^jN_#;3 zc5ua^14*BwS?8`vA46LN3>^}6>X}`y3eo9lNk%n3-n|fO8W#QZic90OIW!&;^FrhqZC|gxE8ra+bxQZ4oluM&Y7gc&n)uOUlKV z>2XRYo9U508>uV}AK3(kq0w|13p1>~#fO%{)u3Qg&B`k9n` z$tXLAdi7>vM>lIR=fiFrmuKMO+JyHjj!>cTApfY;#iKpscT?UYspsPujps*%=^w-4 zg0*r>yXSD7)sW5QGP%(z_K2Lqq_Kdh_omGZ@q2zUx-SP6_pbBR0+ zCxe(A^@=0*R@h9er-aBf5P=KYJ}$JDp6kF7cB;Z9eQs-f-8!Cs0Vo<}SHFLM%-uhl zC+bSWli}c)-cT{Wnyt4xO=M)udfjT1H#qS~)%}y)DL0EA*Q8jm#%k_poSbFAv0J_V z8Fy8%Yh&^f*~?jdgA@soa04xJCmJXAGct-Hh?iPrVsBWKx6AB73G?BY7uB?-5}E1O z(+kBR8s|%p5pu%PCqRYJb#|W4e9dg=O@dnc1}m8a4ip}n^6-Lg(Bn&ytcrf3-LhHZ zorHp}s#%IhzDB&_2dg2+hE9(UX%m=*#}w8FQK)wkM{q*LTq`8I+|JhccxT5_mPjof zbvN>$6o^fdvF7?8FDEWZmYlU51jF zgfv_Qt#|Y2sSmd$API7hmAW;K48~B?-oTBSWNf&rd1o2UazM-hAaS9pq=;x+95yU>kwo=*DuW z1Hr3snk*wco{%ey@p4lp(!{bS)4*#h#of{pfv7yjxA@i%QE==(Ou=AWA&V~zu*1bx z)iB`rXK{k*;N~1y((CL!6ccQV4Vq{P`GAFMg_z8)E<))ISF1T2V+6`u$U^$i{Km9i_>VO;(_NcAtnBadR4Z=v zv{bwmA!b*AY1x5w!p}N`GCI^72e}2uAY;HTwLM9cYo1dJ5zIhOn$>5cz}7mo{_=guCe2d+EF_XvV(aKtOpU~ zcLk;J9b}1Q*1uk7{06dOkPYu3711pG50C|dREQx1Ahh)}$O4VLA!_R|S zPs-^%?A=~F=OvdnWb+mg8?0AD-oU)=V7BWk@ehvaGn3N==BKV-;4tJiIdR@Kcx_+1 z%?)o|1c3L7hdL#6utDXVE1jcu1y=R6r)I{s!$=;tTW(HST6ZVrLB9bH08JSp(G-mW^OIZpi5(SzN;nOw{({hye}p zRz@(SoUNdVoO#k5r!x7(2zLGz4M;omG3upJ1N|pG9qoBs^kz8~xOvf}RX&G329aR3xqeGx>%+1&22|@6&u+N$V$2k??g*M^ailm%y1{jwLe{qCQdHF6m8GO z$5H^!gi9DgVD$CaSqkbWXZCDu4-41uw zvHCK~4xP2>BWD>7$E9iQt?axShIW~9F~did7iU(ijFvq+@y#~2izd>box#~`15~H| z1;&o2wGCzRol0ZhreBb>quE4bN|WKXu5JJ~)>|Q*GVb1wF2t|QnToCaduQxeX``#- zjV55I%ZDJ0R{8RcSTKte@0&gsE=U%Y6ZSS5Y=T3)Bnz5Yap@BJnd$yC5$tl9_K#H_JV1;6RiikM)hb$SNvu zaFF<9b)MGG)w%rqzKe0}%Lnw32|6UrW+vq3GiuHaZaVm(kwvUDe2y;}KHcg=N8eNx z-#DNSk#c=W&k#1Q5dm!)^V+($ndkOwUrPZ#gb9aSQNUXB4rJk_E)p@YGm4)XAD@{0 z1!)L;V-2}{2(lTB+aFm!zdyd0V9Y;!aXcH_c+D&)yow!Wg^pSwq74R!NP(P<$vpTPXJ#OO0?xGo9D?Nf*j&`!*@3V z@^@uCd`GlEA|--2b-&ERLTtwlNGJAti0$l)^#qSjQxo3y4Bp(^Hu1}a?*!w()Pp1>zd9~gN%NaWaOOm1sAHQ{L zrMkj*adO}M_$YE_SJEmHWh=M+6NFj-fKWr@;I4BB<6BCue#BgW$S|I~1@KO~m4NAZ zvjeH@zRpqLSSa#I%Udq9cfLKU0pcy-Q-eK$PQ< z7l?9v*9xK>2Npn-ay&5yQH~c2)+Qp;hK!isC`Toqu*kH!B?=lEhp&tyP)q-x zrX2r?aRmMa<><(!kk>xhd*6x>j=mP&T3?NjHsAUpA^rnR>v@P?k=}8N*0ccpImYtZ@I*3`@?1e zRRK&GwMk+F6B~1@D|w_&WQbeNLIuMw`ii-WP+{jGScZ04!Z_cNRZ)qLK$7*Fywus% zk%ZvU5xM~08u;0YZt3R6KkZMGtNN-58(S|cyOV?=QYLaX4?zWW%~fRagqLqAS2_*N z4{s`9lYZu>(D7J%g+82Q8olzuE$x^N?})m5`_RmW@U{?ZV3*x0?`AbZb`%NY+PnN1u5Ob zS605T0%aV**JBZcL&Nol!O+L*OnSgjn)py8F1^e7>XuQ=gq3?oyQAEC-ztA@;66J* z$ifvG+Yla|(2e`~4yO%4JbuZ5L>iJ=3Dn)P>2v97Kl8Uo7&;otE!)IprLh^l=`2-w(g_|KwiJL>jBSFODCyd!Eh1XJR_Z;{KgGEb&?D<8a5iMRC zX;82)lV92-x$sUHo7*^)hlNtLr}VtTg?^_ThusE$pg^n^V%ct#O+3Z`14IgFDc+CT zBWIYr5SzM^%FC_Iuj}(mmF}3*xdfO$*+kh4m^7$9isycy_EcPUC55_iLy5*9RIY>r zE6xEYFDI}9Q)VkWF%4#*N$$up3^v7hU_A@PhBDLsI(_!Vhh66=jHCMKy()$cJjz1? z_AS=l`fdr4!K76MRNYv)NC5MYC8tFS#Vd!FCW*X<5Y^z7ujuQ!4NCq}%expI%~P=NhXPHYmHWL=oI_b>M4czX4UsTa*|p{l56OD=NIbn0MSG(&|5CUw=nD ze&-#5AEe}ent1%qI|BbL;_*B02>iE*$M3u&@ZTaHzw?g3e~Wnh&N~ACE#mPz?+EID z{C9}Q@4O@M2ja1@PVw)E#|=?r(RfV`>LdoJDz8&*q?ob7-MOoL(zJpe?oHQAFphH7 zcE{RyCd%C0s*W3^OV)6RPb4;E0n2=U&jf>-mGfcBPz50E z**jTtAYiae7XbM6X(SaI>Z&DIAf`4?L!FD6d(ZO9W5A^oi85ACAO44I^`Zw*@dm*^h%UG=>@arW7x5qn=t=%8 zCn+!&3d#uPqa-qqdhC}>Gr?D2La;}Va^3p;4h9V06b1HNX}M~z;W}0;WWNlz*5f3U zs3}F#58E*&ex1&-i2iXXK3=8DdR*suqqWlPXvG-&0P|NaG&`OE!IyW70`)x?;j@Jg3z=LG*M(pBQeYSC8BY+_ znh19@FlgSC2sv`-8AL!h6}+cr95y-_##Ls)rt6_I)ygD^ap}j&3g*0+J241xBXM6b zrF`*}ibbRE@_D==wGysD_k{D&S%&~74@Cyh+|P_+MlNWt&Ca47Kk1?U3Y~aH;wfMk zf%OLD2q?jd%fM&j1vvu#!Vo|(_Ol@%Gok*@5U_CcM?-*nykrJ<{u0*a?+pP<(HE7B zuiBM-(Za@LPSj4U_oU_00Qjg+`jKs>6;lTIYqB6MLcSD(twB!OAAul!Zl!}Wsnc}I zjm%hy+3b!eAX%to6NgL+|0pOff8Crx#M6aHW?C=AZpxI|PBJt;=honk7&Xij;^-~y zbS&rcbU>4gB{a%AT7yD8l{5_OB<7h0NSAq?kMNRAjb0rfvDNp*&213mcR5yR1V7HB z;>niHaGi+Lbd%cozhXv#zotgPQndKZ|F6*?@Xv6tfEr#!iXvGZ0w*`&-ADl@b9S{o znW~hWfOzklc#}mHyPWi&@ZguiPFI3|9}xn7goOVGh_Lb*CQ&vl5!KD%=})i__zPV4 zpMr(J&w{l7upSNgS&;T0)}sMG3)23>dNkl?LE3* z(UkU$Qc-w}ZS0aUdKQ}%3YYR9WffX4KrlmykoIlsWK-y0MHHc&sTqy|HvAZ0b>;qCiiP)0YRB)4eM@>m_*G z5+n*24=hO%#SqiB@j>$Z{EXn@p;RNDL&Zx;Lx>L0l22-L?{_D^LT-bf6wd;(G&V=J|m%EuqjdLD)ZhR}+t5e_K1*ci^&{*L8;}^TGA7JcZ#Xn@2>sMTT(?Y#)C#`NEw-FJw zy+jH=@@2vAxDD}h9t6yN7*VTG{ot z<_~Q(bYNa)<%`T}yU9sqV0LNnC0D3kmL*X8O?Iv$^~{4G9a+XSoxF1PP6ee^nPX)3 zCn~77;{D(3fFCo2P-4H^0V$ZdY%PepmOHwZDGRBPq?U9PMMH+OF6hDm8p*<2X2>ocAOSQup$gRW4%?Eg>G2FVuR8QA;j=(eGBewIIKnzKPq76e-KfD- z!E0cw(bwn)bdtJxe_;UllXDK~*XfT7Rv50(&gk~EvYd(Yok#PrBuo~-z)sz5H9{1q z+C?;!HU(Uk)RwTk+$lCXO85GDqB8t75f$+3DyqQ0R#7Sc+afC9Z&Xxw z;whoMW#`jx;wc3*Th6UBQk`~?cxnaZ&K9`0b{8w)Ees!s^Ho>1GN^1zU(iH7i9O@zvEvv)IdnN1XoIkaUdEG0+gUp~Fp@Y%W~8?L0-% z4J}8cJj_Sxy?h4IG{zgsOFfDzE`*NRk}k+`Zi9ez?&>18(uh^$Uhj+m<~6q~*eMED zCp^PUqBR4_V@kY7;;^og3(?C^4vFbTkuyt}!yzPvpVxA+^JF<}m3!y&rFRsTU*=w- zvWS;&WD9&MsNin5D0+<(+ZMA}X~`36a>x~G;(z!&esc5yrnssW!Q_wv8ystEBYeX( zd4oT2a%=ZR2?FVbuHCEf%0=-v`dfPj-o3W|(T;qpXf~G#N|@M5m%&1_EA3`nHCcS7^kW%9vupGV|ouX#LVCh2^sk2O=K0S~9F2_Kf*@PpY0V4R zmnf@ZJ6vnqs=PB?T$}HwS@)*c*)oQDHm3NuUJdjfHOWR6J9&+-*NkrNxgL3Eb}iD` zDfY)R%wmsjp-i$>3e6KA)7%{IJU*fQG~4z{%%-eC4i&3#lF-+u*GSt4-iAQhCZ;Y2 z__AGo5q@y3w>k-_Q?I&ya(}imy@q#({hoK78&@$+S*U zLhxP?>0dJr+~AqtcwR!I!GP+Dz4_$d6N^A}>HdE_%)dICc=O3DTl~H*0HgbBRoCiw zH~-fr!{{2*EjBhWfd7kfZ2+Q**L55HF^bT?);XI;?=9E_%rBR-deJ$y2E*UhVW)d< zi^4owAI}IL=L$ui;y%a~yCPTOU0_gZPsIUNxPm-~aUMrH%y9-mtv2_~qIk zf8-}kjHU6bb#;7i(G1_u!}nXICP41N?!h*|Hu#H>++zk6aQAXz1yLjk>3_mo$6L-@ zPWpKC`KFN#ACGQrDZ<-Ij%f#EJH496eepY7zMB$us1NEG%xD9TB-AyY9=L$5K>sLI z3=uRDG-^f#It4lv{Uq&gRW)Fqyuc4u1Xk4g&Q)Axjp3i475L}3Z}&sNKh@GSdc22K zlKF@|!|@!($p}^><4(MX5!V$cf_d1vW4O<| z(i!g8JN~fmS7$(eVAI5kHnE z>thRqFL-Ty?+Iz!_A5uxpTH4d39`O7M_8~=egemj=1Kcl6QKpqlh4l`?GYW+8{|yH z)O(nKdVqf-mOgd>Cm5b|8$<_M$Cg7uq5sJ*81VPM zVQ>f6(CMXa&c9aba7$vEkMY!hspe51oZr9$l)pAx9dADJ!FdDN!J~gFp&M9Av_Gvg z6pdy*jplzf(uIM5jvGzzr8RC{9W?v0txAO6y0T7^B|cK2JA{j6&Yr60A+?9yuEz%TBP&$RD&SG;zp86+G*i%zLyAi8_!WMV`ZuUVwbiwsL6(59Y->*nb8rhjrHZ#djH)c@S3Iry${?+GV7 zRBC^_0qq@sifflH7j6s#e}2Ez$xTyKd0Vc{HOoXyiSwag1sddGo^r)2SoKjqvz4&UuS5@(!61Tgo4Aw?q6(y$(;d9&IWhspi!|8GOW$}lG}@xNh^*GW0PC)!KUu^ z(%gsDbo!HxNdaAh3J*)n(mWZo74gyp7W^5h2%CiM*x?R!zC`ZRU% zF_uQxYPUAWg$u1uQIpCg!8*9DijL1-HqvLF$=1!T#P3$W2<<7hf?}txQ+=YoM2IXj z@amdSHh~vAo7w%-J>viYxqXPDuK~f|QC5{)Qe^R0!SO^^|}Z!_qpaDxdprLyumY6pJFy)$azU z9oKYK9878f2`1s$D2<&%N@LyB)VZwvUy5)JST@*4vf1s4iZ7!+uh;lMAHO5P(5~t! z0QWX%ZqJl}h&0HHm%V0?!9Xb(5ppar&OR($7Hl1i>?B{b@V^0aLv`>lxV>1Pr)>#}@ z=b_P6Zs&$GwO2BgNjS5iWIW<78yit!%K{pH9&=02*|g*h2D)U=0fK^t zU1{tQ{)Ft8Q#PeZ!q@5HHdXqEG_PuVyIB=gbJY3E0C)~29j(AA2A8cj*sBf>xe=Kv z*r7V``eV>Gp969ySS{`wWpC%q7$2(|J)?O&S8=1jv8v<@v!~jg1RiXjyst_G@_M;O zW)0a?FbxjAZS_1&9|6n0)%tqY zTC@1VmXQ`9Rw&sPCMY~FiChnwR8~l20@4;4G@nDlWWw6Rz?YCx&%9ydz&`%bYN;fs zvOD_F7>zM~(QGveH09b6cO>8NOu zGQkm>m}tNnT$n~c<8w&*rqDbcaG0Wcyuk-C^XJB*Qh0lf)mvRh16LYRnN-r`yhu^N z9ky=%CP=#f@{msk;}u=v@@+i~`C(c8vu&ijh1`Z=;)-y9beH^|tlry_ZDOD11&jaf z;D+fd99Jc`A_8fTx5e-hA)*8{g?pL%K9Llb!h`4F#mvhK`v%^)Ucj&M&7=?&uL^cumxb6xP zQ$DYfOjO-z4@VE!4=;EKfRfB=!}E$N}5t>ao8?&dYFb=LF_2lmev_t!!mA$ z-=C;wnPRo3zGt`pMwrFJKBD%OlX*lf;LmEkOEvdyQChWQ_XvGIVw#G23fA?xXIWz- z_B1W{qkQ_}S6PG+_C`J0`m;r-sxyCpSE)uVvB8K+kZ)K$MZsW@og!45V;+xSF9O zTv)=EWw+Ba!FOGQ{NJi|65!vrDtq z0sLz*az)gQ<#H*#o$M)h(@o160@1nDSzHmIIkglYx)!-HtMya_x8j$nrVW=T`FuwF zyL|qJBL~!Gb;^s|iI*F9T=xz?Hoo7Y4>jwR$e?tN-);5xCnP}b$M5nE1f1^+ZWR`Q z-5)BKX@3*}|EBEEqRes8f9Btw=8+-5j3@cuLH0NTO;8wy5&ka#zeQ`nQr!n{OqCkwEw=dfd57R{pEQ-zx=oj z@uLW#*q=T0yQ^R*{zNw|JRZyg{_4XPjkdo*_|Gr5$h7_=fQJL2KR&Y~|2xnK-oG31 zZ6@Y!Y5nqn`49JdL9qOXMgQKO|Ajf9QP3WSk=!5dCyGEEj{Y=&SDF)h1o-81|6)=4 z5ZrT^U-<3eSJMBA-x}y4{T;st1g-DivE5=Ggz_CV6YdYM+kD#(wBnAy4)*^a8uLr3 zKgQ9|2}0Zn=7h@Et~=|a(To2YNDoH6ee@@8c!y#Bz;ESBKmG#n$G_iy{}{{5Ie*9R zMyN&qJ3gZ%j~7f&Y%IsjPv9v@#5}CdJ0(ssCG?jKJFz@@NFgKC>667SVI4M$U&Uqd z+NgyZ|0SF;as;zrC(JJa_)Gdv0`Z?+mpR^zD=0yZhC&c)N5}G{8<*I~Cj|DV03-V+ z1k(_HdE$w$4`ALLt2+2n3wYhl#>21s~gu2N#eIH z|H*O?=aaT9m?5{h5nyL9l`Xqu91HN?<$TShNGKAYL@%Yh&peL<05}lr> z{4n!N0iPbil|K^eLR{OLUgF;6dg(p2s9ocng+DCq!2gEetawks>?B~#6n`BDa<9z!!rb}}oTrIb0U&4p<_^G!_*7RsrJ_8H zuDoo!XTx_?NyBZ}X`GGBkZsrM13Rt3@MgZpa7+zUx`n>nu%v<5E1pIV7%3Z1$LZhg z7PW^|w38i`9hww=J)?!ph6fnGBT|Gyt?%`_ajjS9)x86`H5zpqGFv(__U*LFkrxn=L=y)kgM;pNGHZ>_X^s)Yl+SNVv~fS&KNBVp3@I5Gl{iSX5&8o$<;pEXubj*glbN>ZnH{n zH$-gP*Yo``L+vdm&f%rmeaF7Hp1|z62oXQpA=)l1GB;4^eps^=%YP_r-R3-dCXq;v zF`}zhf_y`jeXq^9Z8?rzACcE!+gPPV!&A!Eq-dMINCoa&_14%8Giw!CNzs1Ao>DA= z`E;H2IKI*<35~xs{j}L^Cu>wGR=f<%cVbvbxXe*6SOs_)nut7ZoX#@KQHuN)YipvFb;?}Q zF)Xd>;OmmihDKg2G2g(1%(}^3Si7{T@1>K|^V%{k@tm3yhJBk;n`TSo&WZ(bp&DkL zFytt_^IqA(mW3quOF6;iGljmKWUm?Y-%?$S=jrAGdgC4Q#DbTCY32?xnJ_d+AGDno-+84 zpG^}g`R$A<54k}pwlnr?8$MyaEDCzY1p6C8irE9zj&cveX#lsg!N)W!L@V#VP4+1Oi z#T(OSShVt6OiAkL#J6=FW%^TJx2>Ws8KeDplGUA2unUI5~JRiC% z((xPFfa31Ne&a{_^MTy?3B_1Gq+QaR2X7Z}ri_oKbrjlrqv4&r5edKfsx$qaaz7l4 z)@JSnrUijODDpiZdR1r9x=>n`AT!{L>}DZS2I{P>hFKBErjIoelKuGR@B8b%2T@i0 zPGCdaoA;6I?nI8Dm^H4h)2;Wsr4B>(8f;fcW!u$#G)=Q1P#`H+p3gf!Gy9%jmo#kd zCMrCv@4UipJf|4tg5-`v)opY_N^a6R+mEvck5)Msdb{UgTbwdbR9y?vlp0zF06%Z(8@4XoQ2hmv+APC z3o@1d0bZ*=!&+0%GNo^4ZK(ts)xpF@X};8;{zBvf0Z-vK|=gJ^6*+LU#C)ItL+eMji0IXPi#C%jj-G5+43? z!Oz`EA@@7$c>$&2G2d-RY@O%R5c}bzc`CC#n&;Ye{bbLyXeNZ{*Aryn58(NB8B2=W z#gc%)S!=z{zzna?7l#IUxmJ5h9=YM5;x%4I+liByA|nSM!a8odE;XyC39djppu1%iszt$=^IHMqBhmTcd&$Tp=W5IZhXiWL86 zbSjipdVDwRw$Et*VpOAv*Y5pc!~aQw2Yi}X<9eF$lx;~a1Vk>JYqwN4Z?(3{FiK8$ zjyS>zu=u?e&qTpea~W}I`5c*x%=v}ez3=s6-T>~tv)NO90ktc4mhTc)Nz)fuoz)8@ z=1QzOnAn#Ac>`qtajoU+Om+52$wO|Qd~0qMoQB}}A!{p?#s&k`uIhRKeXr*)!-$_{ecOD0*yZV!cc1V!4}gBZ^>Gra!%n;_$-xtEl~z%ow4itW zj^ZA>g6`^71s8mgv`9kZx|wEJX*+CNFSo{9K5P2#*iyu92Gm{sn0KAVfXII*DnHOg zsW8@ZLS3t+1Y6RWA?EFK?4oLd@wSHBy{x8n&!Z|~0i%jNV1fXNz+53qncuABHHGhJ zG=jz`Wp9ZEM90%NJrI~yi~pg+`y`|7BWSC*_;s)qox6iuy3@ECAuECN^FYl|?z!{< zY1~S#T|(B4eF(Z;aIq#WqvTS~!y|}JbZp!372GUJ$p?E(rSRtN2`6+sWy4lH#!^F2 zDB(r*J)?05z;16N(dCP4BV0SXE0EU7ydu;w)~C4We{21Es9MA3BrN zsJw=BGU!%hJG$!kDaKx+CWHJT?v;WsYj{9=hJ4z9Z#GT|3ctN9$V#VxPi;t@mWjZf zGXdhnSk-veOTmC&e%4LA@bh(~{$+jQX49M;>Hf9n`A z-N4PXUZPh2{Ay9R?Goh& z>R=eSfZ>=cu|IEQ97jx^S*q5pc|~dL*bF_;<5SIn3~f+BLQ+D3pVFM z)N-F-^KXBcHadC0JePB6RkSr;)xPDJ1SY2FtUmRN=sNTei$Ak_j3CNkt{2~X&-nak zjwD+tjmSx<+TUTovT^)n@G#u<(JIL9(w+fWJRJHFJa^aNT?q}~_at6?LCR{&^WTsn zW8D9q6fOSmks{#VvZDWAr05yie@}{>Egndb)B`Ds#mvt>5~igFa7#PmZ>;eM1eWw> z=O>n_vX`+e^5XD1@TevQ>8ot@SXwN`i!dy~r_r0d!j=oZZSlP;^0Y#WiAC|92UQ7s7ZiWG0Yt zy<~>LqDW03T6AD?R_A)|hI`IM0lP=w=7Vh}ZKYy>ey%jfhTO2ooW0xgx;N?)INu)q zhTm-X+b4ejHQ?p+n_TVQ(|1YgKvFRn9=;JGPnuU%Q3dXdVn82ChmO>dJOq>5XJ&%= z27d>WpLQrAq-3Z#SFMY6Oy6Wgi6!g%;Fz!o+GYML2nPdMB>F)F!BkY_Qx_opF1OU( z;lSd9jD4)kTn|s81h}^z1bab?%H}D+Pg-;~YO$k-cWA(XUH6L?)${hbd&B++9*iY< zDhkh*{3jP*h@3o)Xf225r%G=!bG^0)(o#N`o$P z&gm_}SGnC4C5{dSaVZq^qXnr`_KidADclH$1NAJUk-iMZ3)v4U7O3|&H3`#ug*F*Q z+nkY*mb4#G4&w6dnnnxyr^w!IgAJX??&%=jw~3~!rNaD4t`C{e>puf?>3GNzAY=_S z^@5H3yoUTwHAbp7<+;p2xrFtI>`ke}6k23(`0Zzb5O)F`*riC;(#i_<`?w#~7fY~1 zzOw+ov(-R&ig;&4c%b*h7Cu*`VeepH$ zG5E}kVMNi1oCu#N7IM8}*nji!r6&qUig4z)Ums!(D1 zfqvSm+xCy>fF!lvStkmE^c=Ad`j_;tdPt7&H@?({F}`Dsx?75gFLD{>Jj}kEEQpH; zDqj}@&tT;=ZEdjIXI#i<^?#+0mGQ3G(@xZKED6Ji#A}yT)R?l5EP|*VNMfpP&Dkg1 z&rPNjSATrD4)MFeB$cWK9OqT!8iUWc2N@@r=yn+?acdz6$CSD_@5;~PD_>BIp<7eT zdfF;Emw2``Rah-CBWZq6u!^Nf_*lewK&8#tSwrjO+)37ubrY~DIT^W|Imwfun|;rs zQ?*TvFvuSikHyyXYw1;68QXqd;qJOm&%&drl#jA+Qgcj*0SB{+GYT?-HU-4Qr$K@AGg{l>; zDgIhv1qwIa^-RaSMGCLg9~g5Ff%;}hiFr(JQ>g54r#EigQyX&k50koeHz&ioKa4G~ z3+Pn=Hs$jxuV1UHC4Hec;}~V5kh|4hUH-?NoZE6X;{}(0QPm>e?Szn5)qh)6WzGPN z{NURgj|qjZ0nBcuJGci=Pt@rZ+|)VB5m=!e(gew|;n^#rKgsGus&UG$picHY-d))R zP4y^ak1GMK)N9>$o;V|<(w7b2!qS?MIA!1KOY=o&(kfnQjv;wOb-mEd(1{=Lt(**G zBB5Mc8(eUu;Wh5CcD!?GwHS8Rb-;IVYMk=g;PICS2(~i_47_{~$ZQ_RuPf}xc%2cR zRZMUXW#hIr{kfv5lxlxXPQSj%t|DPtdd~E)oQe%B#_al(cG$3?y|ioK-m{)&f@F$R zG`K2v#9wZwV(qFD=htpE3(v4?m@H#Oxl~Nl498TXtWhTUGKn#7~wcmfHZon3)F zY$)-p?J!yB{<=2Kc@z)@YOYG$b%}kN(B`$}P!SqjFZsGmDxO^9Sr~30x2o!l*c|L@ zxyg^oP*CGWYtfjg|G9aZ0xGO~FOsC70HXU9E?WA`B;B!Sp#p9(sX00A)QQ)Rbd8q` z`g8F_<;!6^1etFwjjWZoY<{xISisE6Sw`fBO|GG7@l3zR0<<(;d{EdhAtA(8@c}aw zG*vHe>rep;tcUB za#3@fOJJ-gH=}&?flzv1sIx85Hwg}Z6WA*ZK4T#Kpg6JuKIPwdc>gB4&;D3RgG-!$ z7w?f`7`IM{4f(h2FbIO2TRr&kyfA@!#kct!DF}^k)g_)(LL~!FxrcJ&3*xIW z9^rIQHa70xKYN)ampq4Ot>nrA#V%DOKN)c*+;R|NyUhi=7Q_`%UBM~I6o0CTd1G#> z_eHoGigfvXmAj>c(5eU!x7^#WKYWd_qvBNH*5Cgt*!F(qpM!1f_I$O=jSQ+a>?v=+{Ko4+U{+x7fBjL|jTQ5`$0a&E;IsdhoO9BcHOHeB=O(KQ2#`_6Sgs)7ija@ zhx-TCu>e!X@yMG!TOIIR=o^`J@2Tgs*sQKQ?1w~`E8dNFVnioqv+*!^tD(T<-2mi7 zkfa!H2418wGSG5=N%LM!zvAn)7^-~_`3GG3mKXSegwdPMFV8W@7(leU6-5la)rw#@ z&;{A}FCIw{cmHpKYtlE!+<(wW>xb90!e>81D|f(~R5dQ!{Fj zxxNd2aK!bgCnVF(k#Rh{2iRX99dHBwULa?P&3SYI!FTbzFwoz^Y8!Njzr$)-7C##1 z?p*>`X9vO`^4N!3@gvtg4So~}&e(esLdVyJ=Dn#UcZyRu;i|3A-<>nNnu-%W72tA# z(`A(F-iM-LY!z8{PVDsjcA`v{L7SqUdXC(_Z?y%e=a0ibQ?s7igvJoOK=Bv?G6F85 zq{c3%y%7Tst^PapaD5 zRGC;7VFoc(7YrZ{5?LxO@YplZAJ89WlsY$aH^Q+@u$@1zoOyyxqd4f51wH2&V-+~o zTX+S0!t6yg&~U2eW}Q`%`8I{4Lc;CAe4kNMnnRs`i=xcl*A!6i5?%8_zM!;}UYP3Z zl3rJ2UVn5=a6u9=cQF1%{$Ws+c*R_U)-dy1dlYc znkrAdhsJVAFRvzXGd8~-d8gP;tGk-HoH;)yHj*j!o~n-*lh36nm~P1V$sGP?tCD)o zlN@e_?98#StoWy8H3R|v;NR4Ig_MN}n|`pffp%j0%li?RSMUp+$@a!FTlpG*I?+3? z9`EB+k%ufxD-!4wRHi%&#?GeC?tAw(5OjIAS5K`kk<1HqW393{w)00xCf`Y%evWb= zu$yYZnVWMh18H&SFe^wp*MP=pO1vpjS{N#pvTt;=QKuK8#ZJP1EGKOb$~s?}6h7pB zeau%$5I+?Ga;{n|$6%O6oalxJlD}{@I=FkKzbpz?6U|l5o;9^ZDSwuCIKl*u;yI6- z;Vyqp+Izf>*Hk!BK_KVQh=zshT&=SgHRr-d{wk}q)L7f&CQ(G_#yM#w@GH!6 z^LFPd+;V>26&>ep-D~Buj&GvVm)}j|_(DTSdTlyv&h6^4iW5BcloF$(fM1c(Dl+hh zGrHX3V6{#!j?;@n{Bs&(*CIHaU2Z!!um(vr2w4l#dcd>&9yFn*i!;Hs7a-kv-~oG( z*HdlctXawZrECtX{j=YRyYoU|7sU z1=OMM2cBcNFhhS)TaTiQ((hZRd(s5w*G>vwZCS|SS&!vvthI2+GBuw{nzHLgFm;QZ zQefW9aY$3L-y?nci@7II6!BA5#Wjg9DXAn>qNowL2-wE~146eASo-is00NRZ_a%@$gKyof!p?&9V2T*>LY zHvFnRf6D&F5rNc9Vv6&YcYr1WZy&=UC!Q5qRA5tI)$?DRU0iOwaBSQOf})A8Ir<@4 zs!EVWViXXQP-d;tFUWP#M@y8#;5YA|-eH-~oEg=zg)6R4Ts|$j^sQSzEhC^S#yAob zs~>TGQEf4;!UiNI%yw2sQ!CqeSBYR9OF6D8CKEKR%&Z9FKV;m^h@j4_vl*FxBkK5K zK#UbPRHbdP)BeIwU*)aVGH4GXHv= z|9d4p)55IrCg?vqImiF7C;YP&KW&IA1OAh9{6Fvw;FohqvR+!3Ce*9Y z>Ta1Now+5iy_{rQ%CGMrus#(qiR3O}ISsDY9msO&YN)|ZdheBjC4V@E_pWu?O1E>2 zeb+ecMRzSUZ_52J+B#Y3O=wtwerMGQa-yvM6z#t3_;60O&!u-?9Rt)fhfSO1d3b>% zRLOSi;5&#Ul zgR9Y8ao_Q>lbTWrZHhJPxml;e%4`bq&`@Lhdn%vJp)evfU~`jf*A77FfmXAdXsx>{ z>0kbQdOEz0!Tsxtu+$uBXBc8Fu9G8Ixs6(G^CfoOlbhxp>$C28eI2u5P1K+-m-@p^ z`^#+jrNE4qUe3nueZ{5CKdpHE1Z{C+Gqp>jrA^J5vz+3hTl^$Sj?a(DD+PTJ z5wexT&Hq5;@ei zxz#B?S0*2p77y{JT-R_9oe_=8WmqP=Ly}^D@0hOrxNC%rN2I z%~d{Qf#8xC)oGV=S@cp|=ho*J)I@j22ZEPOFUKdl6gv{F3=hTEO=VGidpwAmcT`;G zybgexf&OGl)-SvuPX0HIVM!f~$C*8C=YtntM{n@*tdpzlXFJVb{WpRDc#Qq*{7^)H zXcVxUvzuG0Xud<{+aLYm3tMC++8CNY_OON9mnkO$ZcmkCsEaj&(qhEKan~9{&JRFS zN8xMyp=e%S#3nS~o~zyK%?CQ;K#;ot=rpDG2Tu2(=8sovuQkdI9c<}<(wtQGoak-Kq)Pe;V|linb@Wo>c?kZ z@gj;{V?`>wAx#5aUP)EwgWsN3qSdWc-FP;m=DRJJ(U0>6Gp~llxZFab-Ll^SV)w?C z_Zq#nPTkUsJsFQwQKK~qJvQ>wE_WEDGEKnEjR|1Y6BuTdJ)^IZ)e3rvMTW%zuOxK4 z2hN#J6^@?swvFOM?>bh16SK78Pj%CqM zd>c;Xq(~2&;ygi{v%O;$JjSI?>aVsXJu0rnnV@?N7?))cBdr}; zH}0d9?>9)@?YSalGNc_nVEDrdzL^any6Q?sfMQ`l^a)gByK? z{xBb}XHy>sXu?u?a%u0Za_j_tgi7lg)src{XG32JWUU04K&iCA1#Mg9xmEw^x39*J z)-kE?5#>pg>uR81KfXM|jA4h!E8mNq8^S*&yt{2+GZK##JE!Au>%~~ZDMMmZ_+c#P zX)OaN*rGO8ZW~b}Nh1}r3rWF}`zsV=FDnj=PujXNIou9j#FW9kAn})~7zj^a^U;Je zd`_fP4BO-58iU*dNW3I6@r*fE>Xf*SzM@L=I>^^lEK4^O>hKGKpA8>J&VQ-+Cf(F7 zJ`vWXWg7OL%B97JN)VG62@U@9BT?8)7^R29agbn)46_0^HjTLqIDCQM#3VsyS2WjS zJ4@MNY6&NGEcR?rX-9edqL}01a63AVTi7meHgX8k(>?!=cobYA@uWFD z{YfqC{5;Y8yq`iYaW_XBCdQi(CirH)As3z3U6fzqabD9>(%zeDT~jUD^@zUDt*W(O zpo&CNc*+?J^bNixkUHs1ynBire~l*aA&C98KTHAkq?n^rBF>}l-1(LM4*aY&qP~nP zJdtLlj^!LzP-5p_UiaSEE%o~-98zk);wwo4qfoU?* zDf2CiL)=EB(pfSLg0xn}eO}6s!0ib12PUE~n{F6l$qf zEPnwGyO`&Y-*BP23Q^OQJ)M?}jk#_TO zd8p-{dw&#$>LCRs?ptK0C%AASu$?eQKFlq+uHSH%JRtbb>Lk-X=!Erv^eQ?7*-+K| z4IvrqaQBdF$n`3VEhU#6iu_*yet@~&$JSi%VMAlilFz=s&fSvZiabb!QweIgm~QGJ zL^TTFbj_#jvrMzTy|xRg<)2LQ6NNz2+LR<0bQ=Qp%$T!SZtEH)Oobg~`0|=c7Wp^U ztQzePmZOENy^zHYdMGYzWLIE(Mm%6&nT?KVX&|Fh@~2g%`HDb61MKt1>OMD`}P6BdNF;ucn0mZng}^~3j} zA~$<{yLG1=sB`GMFmSw%O~~uc?s6G_%7Og6EsC@)_GPl^ryFn$@ERkm77}y+7;Hbv z;l})Sk69tHZeApgMJ-X3ej_niVlL?E-F(j@Ldc1hb65GGiw)oB?K?hX3+QCt>@#NX z^1LXd6g5H-1(YU@kfjS zRmw@X{Z0n?ByDy?py%6qJPQsPJ1&;qWCMNPy2Im#Jdrcx*|P_!GCd)sAKE#wD73Vu z_`N{PuRgZ0?bwl><(~E~VY)PrH0fJXV2~pw)H<3+>u-#E@AQZ^Ph0f~Lk2eRvunjdoS*3ghN0+0}w33yt#F>v@I+suzo zN0}^IzJj@qkN}7!5%e3O%fiY#1&|9*eYlEgq8q`|>%OnS?APDR{6>vu>Dd*|jfVGG z`P_I*gQ8G-&}!JiA!+2wge&~D{P-2Sax-@s^LhdeZs@bN_b48s*WCu{ z2+V0BgKU5;jrRh0fV}rrIrop+gYWG)(B=}#=|0!YF%`*E=keO)m8JwC`4>`&;A@6_ za=FNqvhSB+eehyCAKSTp=*fV<(T&}W$Jgp8-x)H$tpZOz!C7PY(Evl}1Q{|R%p z;q8)gSF}~#29@CRN@CSRzAwM&6ysVp-RL{yhuyHrAD%&Is-^^zln4hhY9)!Wg4&nKi{jOBC-y>UxB zh>A(ux|vJbktPRF(cW~-%GSl-PMkGNEHcLI5N=XxP@{3H+$od{=>UKsRWG4Ea%d)!3~vKN+%Oxkf`n=xsSJ(RfU%{p2gAbqs}`tZBlCk1{!bBq!ps-pmqqxZQ0NG zuHjb>6y7Y}IBPW4n(n@-vilTV1V zk&8~&-Gu|7Q3N=fKpS_uLTizs->T+ZaoxErdKt+&gxa=^VvL@mRdZsWTz&q`TWo5 zuCbdE>Q>NL9n}m;@&-~*A(kqW7|4D(qqFT_zQt<_G*VE?1qysa5?tvUk;ZA3QXtdS zSjC$o_iZbRl)TT)xcjhkqFbi_BG>s?bHmM0lLgix=wa5&1JDZIT{vsDA-_kGeg)!Q za=Ga3fAzfs361yW(#^6ngeG`b%jG17vXjveOE2|%PvX^V+>g{nLW}rJ&fv#!nd#Xr z78o&@ipp0F(nu&1vetJl2(N2~ybe4?3=v3$kq#Uy$I&bWi(%=jP)S}cqtA!-Xv)+J zm?OTpnarSS;CM(P9nUG&ktupKhk#Nwgg*2VQI4~081La{s-L9i=~0s<=y>bBs#KnR zDZW;T1*Y2evs;cCf-2bG974XH*=qJHnM<`DllFiMW35{e8~w(c0?tpgDknk! zGlk!$idHtyD7n(6 z^VpGdxkTZkvya@$mnXVg+~`mnN`q;hZe)oNq{@f2f#EoWv9W2TR6$#RWe^njQv8eG zQmPqHUlO^7(cc#w85N99&9ofJ$SZ@N=Sz#`sM4il*_@k8WiYcy{B=fw1B2R`B>anebTt~N~ zI=6^Ob+8l3vuJPBshk9A4=;H7J3OzqNkmovdL*>+G|)9f&;MF3y^T1JhyXJy)>HFi zZAEUvd)4l=&FFFw_s>_06y{92{q z^Qvz~jaDpESoW>7h~;I?+2Tzz26!VoBjX7pdd~;%(NIYgO#S({uK6ss9sA!W#~wEV z%I01z9D7w*k3GUV$dP(njMH#s2$kIkvZkNw?__G361PxaA<9BKKyA5l8d%LPbvIRg zy@vX9L-Uz28}ed!DFo6Mtakk|22|}W%;<5v4j+8_`lsDx#` zLbgJ zEskwyc8lHM&pXH-oFuZz7rW)tV2(YndU-V!dL7=^kh0Fo#rYSm>Nl6w7H2Oti&aJ) zM^D4Qq;hPCLM%~asZVB&ZYex?LkL#qGr)AEfLHbYRy+0TjixOU`VJUCk|1$*JSHqp z>j>%H+qxi3KpdbyPrj*kzl{m6IPa|cpzx&XoEfu@GHJS=*&hx@{184Q*?Q5(Yi7M( zxV*&;zxKo_Hr8n&2O&{lug#)F_A{)oaQMuQO_-@PQz;fe9W6uMMSw{Q<{Lw&pRi8` zuCHd?^`wpNaHHtqoM0Wo4W@JtX!nvh!h1)}5k)pIM-}4wNQ7u9SIBTE+;>*IzQyjx zpIzW5we??>eA8JFyY4ZGjunf;Cb<_UX^D>3dR=+uoDopmOSn+DZlTYMQf}3{TyfJy zp?`?y`Ur%OR?bmMB(ix_ zH2#I@eKz|Oqx@NLqf4eH3l5zC)AxfHhtL$(tzP=MfPoDS(^S%E!a1ea^GvKyWrCh+ znA#=2+^t^>ljU69RsMld+bOlQ-r-Z$#cRIlfU4E2YK~qNW9dL>O-p*_NcrsjHqdJ} zLD0uNS9eaFd3ni{U!s#{!T9Z}hnu$VW1HJoB(*?NBWDdXE$ZNa_9@Q)G(cOGt)Ud0$5)6M}|e9klbd;EZWg88Pi zXE8q}#{a-Yy;8CcgU2D~pm_B4y)t|A`a`Qm5 zX;md|qx1t=e6KC8r7X$L&f@_AQMi6f2oph5!Ig78dpwnG_wLmiAn`fqZkrMt;DWa|PI*2Twh*0CqKWUNIHufo=B=sfT0_ zB1dIr)9pxjPSg3uO*dzq<4_=_|8=;xjFZIm3%zG@ zR`RZmKvo~C8b#J!v$A)Vh`M`@K32N>mj>0Rl;AGykpoqqnu3>Ix@KLS z4J!L%yC{X@>&9Tq`zqHW50?hJ-tpJ8QfYH(yQ3~)Oy>0ij3=X}Vm%r>yV9hk?7t&- zz)_j}uGCac(NoG$jsVbrAQhj~Cb*p-0x_E5Y#rxgy}-bG=oILDHL+l5yzM2!q)WzM26hOgyjF;Z7hx0ppwqsh74w8Zk z?n8dv#=R`8S^)*`jB`s*IjYlU`DvR0kxfDn`1-{}5Vvr)D94=cRAGDvGM4hhA*y?R zeXpP+=&~)L0P*_kso+7A!q(lb8^rORf9h}&*zKU4DH@h^st_Z(IBP9 zOS)oH$f+?gp*2_dLZy*(^5BrK$0*q7eB@A>D`Rr6)f4VClm(Dr2(pJgKH-&VCW-~o1skqI+XSMfkCzO_}mO3{c?jHG|pjA3_%^<(1M@4dq%7RiW zr!>@@s&A^!=LkaP`7i5Ep9d0reo9?CG@>k03|sc3a-9F8v5$-$2Za&+{*P>O(QTc8 z%%eq^1Km|jtYGw3TO!VJei>dfGS-!E!j{QGMu?=x1MRn9=Z>^BCGwO`pwYp&s!&Na zgK=-k*tJ0)Z9^}uO(<%UdFz8766pOInI)rMErz$#j$z6V+I6=gHT$obw1s8o%Fe4+ znp(I)$-bzbMYd8@c!*&c+ujxSGzpK&)P zQ3#APO5yAS@k9oPAs&|LK(qYMNF&xW8tiuh$`6r7!2zGdRszc>{9UXnZUtd(j#QP{ zPu=~AU%Y#6%{Q)zK`QiwgtP_Cz>;|xdB5ZHn@R=qSEi;y{;M=C2gBxmaSf6oCHDo! zA*YmrN;U{j|2a_klUX_oplvAkM~C@K&qhIwfEooYt<5;@$Q{C)e9WW;=xH~MPdMZ~ zt-N%OfAy+m*)_L5g(7S} zQd5}X8X$Rlr0!RXhbb^IGK#CqtN$1%KT&F0i3&WDwX|P@D3M~NqS;~J$ECD#N38>) zY_~7y7*0vNpI}*wBf%=u7YA=fu`)isa#l2dw&D5CCh(Ddn=9#%-j=a#ZVG$pNnLlI zY?^D*;704#rjWRH-KamE>bBC|WzCWkN5hh%Rj z#SrxqgBPoV503>akpPJby(l{*s~$-}cB>uM>SSSWj5e5bBNH#$w~!yx8fp~|DNN}o z)$sa^jicZ78R65SsahLn)B)}Dl7*#F59qyoZCv!HPk0TIWT-b%9Hd-|p7tLWGI|@Z zYEE?&FwUfN&S96nPN}2qabd?(ks00EzByPGLYfAkRKq+7Holye|pDhnq)w+wZcH< zPwoOMrdH`6{n6t+2K*Pw8Ev7WZdq*9qjkqUgD>w6-3$*^($K!YywcAD;laT3GW|oK z@)xsQ3&UOW02JblNN{!>?fRJO`Yb0o%QiC#6=gZbO_%jK^f?6T`{$(Oqd)u?nk`ZE zHcGt0JGjaDDEaO`@3^VRXV-7G#E_QqRoj+#wNH}_672S#%$m)4^Cy#n!_RYxBM)x! z>@bx%a1Kdswfgh>y=@L76NcxNhYDZXS(0v;0L7%~vTJD>o4+`*#eBremB1z}qmSd>UAQ+=A`QOi zSR?MkM&>U9tWM6s_B9!0w4?j-vn)%!JTo|M)SleR#U%=BWE6GkKDikkJI)@Ba82%&;NgYngl|r-zK|(I0Kfa2b&!8%v=iQ%A8iQcWr> z;9Bkz0QOX0C@Zc=(Lp732T(uELe2{=ghSGbE6R)Y2hLOzS+!hzZJL-60oO@mlyBty zIsD@-R&T)8CW4y(|F76-C zX4^+yhcAR`pyz^EP+h;J%(4buW|H@pQlG3+(AVgHLSiS!jgQ#4({RG!zhGN=IF;BV zDkV&DpgX&+!BwU2&N9Nt4$PHD*f??_>{xrnP=p68wD!LrawE4rsJZN!)xlW!=+qXi z9xzLGHA%uVRU$1}%8&(eZtZQUgl4(QRX39~9wX4`& z#Rb@Auqv7G!!$CB3d()IEo_iYKO57)k4jh zcWmxHn{%f%mq@uV$~*feGcK)CTv#8t7GZ5^$bB}pk`$z0W9b-p@~JpX0L*iL)Nx}A zMZ7pk**?P@^(0^e7|d#IO(Rr9qjD{qo>@q#7@N`EH?BDdDRHmZg*8tp$3u-79c(?D zV&R&Dsmf|wiD^D--dHpTPg1X3DExoCy#-j7%ho?kqqLHOlqlWZNOyO4H%JQHNQg>z z3Mk#(CEeXENOyO94;b6M&)(-f=YPHLcm1wQ*UUY0&#aioan@RM+m>0QIB~A1W@+^% z7ih~bO38n?JymLOwoFd_1nxVuO=`q%OtAkxFcxzyr=%Cc7BsUQ#)H%*3Jn-wS>GO{nRbRG7Gywn(~Dr zc(z}s_zNkm6py)#n&-=_RW~O_)pDJXEfPh{sQD*luMe(5Q|atRn*)icmsVV3&MA_1 zb3}~DHq2rL-b3ZpY~ZPJj?}QEJgHU3ASw-UOs*GjK)$a!mTVN|M`I#>cWkC-bNi9{$^_8E6wT;Hbc(#6Qc+| zL*WKH>@(o8wCjA*9=w&8!vPf@vx+o8e(Z$=Rlwg9>dQ`qN{hhZtQlQPWwL29WsCPeeMS}l6Ok^P9mL>KinbagOJe$ zJD`7=wOw++VX!l}9EUHPmq{cb_Nt`UAPS?xUc4R_+IiAp2M2X&LN4)oUuz>PR;XT$NRcjEK$~H&Qs6F%3I1l zrkb2eE{RxC5}paqmU$Y<1jysuaieG<6TOCnqWda7*3lor07Vc`!8h)6adatNpIxIq zaxTB$_gC?aCIO0x>&w#`GAjJ0(n$NBy-6b_B`chQdI24Q#$6ER#m^+K4m8X*c5K@x zampcTN%e;HA(YlNXdnh&vs^pV)4)4yfnB1x=`6@WlncJu`M?)mGNBOBHer8MsfgbIY^xtO_?5&C;7W|9l2DjYv8$A;Tfbx zQfPKGrOr1ym>P9yY4eIV2;onxz{U$Kv2VLA;-)C;dZ1>~cB~7-wwk=a#~|FvH6_MF zKgc*w-3q~bR$n2Cji5|um6t7%wM;HYolW;7bAx}dyzeA4XG-=7<7LCOzT&rpxp6o=Tp@{e;pjBAv$3-Q?*0H_&#AXDr?zaj zNF^h6HFXuAj?231{j2e(F>*^~?I)5a&R85RRs5Q&T9+2n-y^@~(4PM(^6N?DWdAl7 zJ!+i##*f%9Pnz_hH9}X5QU=ALOZMqixvbfX9*Wk?|z-qI+PEN62 zEso3xO!$tf#iBs^_~4Zc&pz#q(9xo}kt2?l3*sPE(s-TzLM{6n>*0RMacxA~1>JLX zm^FwcyypC>8RZEUYrM#`;m2>g$WoIiqxrp*q?$yjC60!gFW*s2gB)RO%)YVv>hCM6 z{SU&si7EUksrYUJ`8-KTfD$2-^-Vrx)kv;t#m>=s=cfjfUX8}b!IJfJOgqesj)K** zqUtN^E+m)FXnduGKa?GtCZuvo-UP~9Bn`h^T=`@&m0@VD#q+jjK{<;~cTdC;p-rYt z^YykskpZ=ehtAn7(cCzPX&oW+dMAp!AGqUj|PS9-+YpYTidjpaE*&I<0<@TGr0=v7q zGU^rFqgwCw!yS~Oj&ouY#lnfZsRw#7i5L3fdfrs}RE_vy$5^(Nc2=ZNoOzWGY424ZKpFb_rM60nUmmlOKDOt(Fu!3RNRu%HKjb}>W8W7al)^K zMh?QqMAkNGfOmfrN$9YOU$1g&$$k3}^CtfPk4_g7t z4Ne-=q+%pb`}R-OHtarb3GM{;0~K~(ogTfwV8IfAek88F?KH^#V&;Y{{{(R{sGXBy zH0R0DvANicso4JQ+y-U=;>burIkS#joyPpcynJHp3{hHiDenTG;|lNV%-)`|^|)sX z3d+(-4X+HCQwLU{FQeEK4Z5j>!OfDPKe_HUF4fEV6~&*pJ|Qs-71F28hy*B$YT6IV zxF!P*OpxmGcJ4zA%ao9F0LUkHPoR^0{gpJU5=e1Ub<-+TAK1J%=^6k*7pRo$Fjm~-qMVn?z2wehcS3-WdM`8`+ zFOO+mvRXRLNBS>cMWt;GWTkBQKXS0 z4Ul%LCLgZBe&8Z%?bJanr4d~Ac{U5oTAm@OsxK(eC1WaM6jvb&=D6yI%ys_0df0d1vMM3O!7%tz6=_<+w33pU&yIA`-_z`sTu&d!4}NHN+sQs&d_`0^&b z&tX<@46F04Hpx{Uk z!IFaJ$3|b|Wv14K&dW=bjpn}6D0zMzZ0J{KFj7!e=r0b>;H2|-l(ToRBt6zLUVe0X zbRtuO)~fov5DoeTv{HO>s%Kc!s-m1trjglZ1qW7@`;Pr8&SMUgM{+hvDQR!-A`eZn z+#hs;MSr!DXj7ZI78M8H4OAcrF4Td~RJD+iW4!R1=eEgok8*WqJ#gt4w?TLoY9p?sut~zdC@8`YxeXwl!coH^^>3w-J<^RaoBx#7br^gGf zRnc?y(=Zf32SxbTssFUH%gl8TFas2rXR za~;W&G1rW*hJu6PJM1eZM2Nv#wvOvfidz@gIIZcv_vaLLxL7--rpb4`fjVp5iF^aa z$BSqKS?L06V-L?A>qRjCKwbjqp>0CDI^mqQ41AiTqoox9`ViMuyy0?+Tk{Llh1jvh zHir}ea!$gpls8ly-VV<@am-JMR5VujuMo(m0?;5*)l@KhUzln=*xO7V!st35n0X9c z@3SkASl8D%C&6Kaq*G&)cn*pj{@Mi>C{)z-L649T>Uy(%Y@g36W2@CPq@9l4ezc(?K}2M7 z4i&*W3bzulOFmnKso{@w0Vu3iD-wyc#>vaqA2qx?)sbxjVi7s1I4nn#%v0AOp z#4vm5A;F~@rFGP3b{;cZR%f4;b&nQkDq&pexvXHMQ96+it!>H3rM%HkN8o<~6Z8ax zSTl@KO4gN2+aBg-iN0n{894DRh!5E&@FWjU_lV(WrHjkFltNG|_wO(7y8w3M>Mf?dI zBazEx{pHtgtb!W&o07cGW{;&8NK>t-=lD-bVq{~lXXc0)K2@b9%FioVCmq<9&#^k~ zbtac{zkLS!0{d&0bQ`cQYjvKXCA~O>H1TfAA{eZ}kjjbq#bNn1M=uZkG*$84@ZE$7rb=X{@zI@D+hDhg}8d9Dri{j#rp=V3; zq)^Uw^yWTM_0&fpijyhoks90n?YvP`SZ<)NkSuL#ezW4&S5BS&SZY`w2{;wg9LSx$ zN>x!$Y7^}mUYciZJz=vXwZi+5?yh#Sa;)F+)FTob6()G3O$R}7x@=quO?<^`8TRcw z*P?q}_=-lA;bmdfRacL^!H_ZneIuF-HZSz|jpJOqs)`{I)L^kE*eu zYD3(57NcqL7R0QZ?&F=@&ZqChW5nGv-%J{5Om`*In@l5(&0VOmhoxWab1OByH_Arc ztaa4K%#fst_c72r5RZj_j1vGyV?GxpZ^!0^*HpXpSkBU^Kh2>#c1T0h7o?JS z$Ti-v`-z8Qb2HYv;bj%X)eqNwNb-=%MECOe9rM*AL$ox7YBszg-H!8fQ^xGKm85eYGj&X^c ziOPbVeg^NR!;A`LqsUD|q-3(|>sO3PDwe>wmm)sxlZ4yy0C3A77RO@pF z=EX%X>lO#bMIJU<-a5~m_&|jC^kNJy4j+|@UzU_JNmr-2lo|s9R6M4EKJ_;TekPtS zl9=huEa(kZ<13Gs5mj*k4X2w0|Ks^F)U9QX!F96Kb9OV0KAZU-f{b_1CCA+`N5azY z5>#HdFMEA{)wJ*wl%PUA-l?@Tcjk7VprU8%&8vV?bTsOLnJ3@0owR5+Pq5?MQzBOv z$E)3t4oXr1zGtaSy_CE*GlwJ|?LH2?=30*Jso0i(XM{`>+RlGX<@MMV)ZPEHMY%9m(Gbq^_Q}LC9f!R&nt)a0CFRv^zR=(RC5~T zDs|3uvKCYJ?UbETyx#KImoc7Lki>1}4a^Ki)hr=qO;A35=G%1El95ASm-8kh`pD65 zYq8~6g<|R>+#WO2x0ubXi5RDBcePpG$hd?ahwX+FD~J9dOsQB`gBR=em-3oZeUFGO zE6xSArgBNo&4e{Ymw-{?rt3?!(bwqQW1?K^)vwSOQukL1bDlg%Bk7!RsDz}~9r8`Q z`XiG?gW<24EOId#piCAPJ5VA^-uita%V1cq<#oEK6!o7IS>Q#H?h{#1VkK1H5^vI? z2ljyCPj1>y8s!E*-!o(LAg+qMC}h~E-(|LpZ1W*Z zqnzosuEe5vZjx4bczO%I9(3~FvPqi%d@9M~d>dzpeYCYkJQ~mXk$3~KE&TnsQih>YzxT^(j1f7_D4jKu z?-&Gc0m^fTyia+4*yeoCI|u}zu%1~^!6baD!?JyQLT1_ALzyX~0X>1sE;$f}`M&6w zCo;hH28y(68w~tsuFfAPmOHSYH9i0?Lq#&8>UQp1Cu9`eGjb&Kv;6pxdL^&j@t%O~ z$zoc!ie{A#D7jHZ)g2Mny!OM3s_d{=$O!h>Jy^^JZCSOqw4R6%ppAgBc*Z+{u~d8w zCwp)ZNZZgv6sJOa53dy$#ncQ{O)w{Qp*G+hzP z=!OgjBYhYY19U!K3jg= zmQ^k*IXliq9$Z}9#M=KdFr6!gB|PMw_NnYr-PQVf{^7XY(146L=KCdHo^_$;upelw z3ON*FD;6C+Hch>>vP!wX;+%kP$Kq;VeC%t$Q7j$s0y(QTNOtRO!K*<^1_0$N+7(p# z@glYEaC*)M?HY~iDMP~|nkZu{*)F?`XMuf4FPN}djk;(fbic+dfRJS*+v}xYkKb;= z(6huj1D#gbLY8j&5DH9i}`I>Q7OST8qegWQ2corJ)u!OYPF!0lRaa2Vxu+aP!m%y z@cvK}NPm(2?(S6caMJWO+gL_tG20k)$1I$bE#~~R`r|~)D859XtBzfxJ+_~XZ9*`0+q#%)uFp<+h5tvlc^S>f6$z?zhm@uz@ zi@-!C{w)F%xIFr61m;IbcT-_f8Weil)r#j0U0EN4!{2)pO-A{azP0(e@8s|f*j%j* zV>!ifFxbw+HR5Am=CYCr>UxIv;^nE@;igpTiBBhS*j$kv1<0YZfr2gn)}?dbS@XCJ za`(aT*2!N^Y``#cbWQUbC)E|n@9SaEAt<4_z(1I8ndv~*MC^?n+Lrk%9Noa3Uv6xP zVzsRqRqSxbsUes9q#MDSLSoy=l}SOis?u=e%6CZ#0VlU&=YdG7>o2AhI(nLxBFzN2 z@1rBbw&H(_j_g*4k*FpCXnF}a#_pWhXfsD&%QkY`KwEKGbk#$UBfH87<8EK*UbpvY zu8vF-omkjZ`MBh=mCCkm4dlswwd#bLyY@}tqx!us+u_MiS2o=6B`CL9?DZJGMFzxM zkzUpnb`Iv1k7h|qPBLl4B=(w@1$FAPB`M%?>3D!D^y18o!rMZ7AJJ(`kI-ml3bFbr zS>>=au|IpV9p^f@b!)5m(m*@Ig7?*+%p19_ZIagqIqS1YMzzO`uM0jz+tc4idn*H(It>4yVNV{rzacu?#f2@e0$sm%5j!~6;pK}_`Ws# zxihT5oc*;k+&YZ0%r_sUp+l@GQ)sB#__RX~+3PS%!zU@(;rG!`?dES>*=uVIKU~@E z66QGiphL&s&K!XsY0eCCI}V7gMHey3RxZ-PY9+9Th&?P_uQX@J%*+mS$ z+}UUsCMcAn0#Era`^WkB<*KzNv0_}H8cxxG|F-Ty&by8Y>B(K%1JD)6 zUP;S}lHItb3{uB8)S3>Xfgd}UKc(#JaT`&qMQIf2`{SxRspc;T;|?!no6-ZE#k$B9 z0kGVyXRW*dQ-LK5yCGSV;nBf^Itv;XlZ$uX?BVk4K8UG$U_Znb0iFvnpBFJtdh2|S zM~X6X8s-uZPJGU7xW#EuJ;Ad=^BirL zy@KChds!W~{Pa<@RUAU0`o?j10Sep{eiA*?rvt_(i?2`xsyYmPJaWp*<7OkbKYa1& zWZM@muV$}4Hcz{1dv2TTJSvVaYjQY8OUoUObcI*(c9gnR>R=+#D<}xk4p?tEb9;!h zB1QM?^n@2?-qg@gy$33Z;!+Rg_UXfvueAwsSRn^nm+X;BjwX0w%dlqEUtWN6zwHY>n%@R40mQCtHsC{;}eg`&XG&^8JL+0UuO&l2Bg# z!KJM@*tE8>eZl*)+-_R~Kz@}pdjL~OyO?9H;FF`iGHB0z)pEb*F1VyHr;)a~4yNw2 zZdUHFhgAIF?arIiCYQTW+Qa`xjKEh%LtQOe>B^B=zZlgiP>jGE&AS+Z+79B0pCJMv z4C_Z$aaS@8&oxVLH9dT06@#aVteX_A`GCXj7Y02B1qKC9u6lVYzII}vD@-|}2Fl#^ z$~@nUPL1jfixh7>O*;28gUJRrT3=RFX{n%NL0>9w#SOm|>GZcHS2|FUZmCWsxZNz; zYdBhhWP@wK3KAv3An{BQv887Hz)6+52D$>PY>fqeEz) zF6hWu>C_$KY~691o+CF7cgEW3akGr*rR$HKJchi1nkpz$%3%9~vp94+h1#QC6oRG{ zUE4p;*ww$R?lompcKB*007{jDS!+!jPWsyT3ga7ROb(uebwBr>J0?>(Jn!@Ost-bF zsE)yvN?9t%Z^AaJk@qV^OFcQDM8>~pFh+CC`SICc%YWs!zic`!SS(Z-YugsDDbMIy zeU?P;KKF^?bRsDpHm&SXFKwB2{nSQtrAD%WMDZ?|z$BVp6^HyI;K;pC9iKznU@L^R z^nC0>QT#4SHB3q2T;!p_Ays%T1NGghuj%}TqKFqmhhnN5(ZP?@C&N8Z>XY_3C`NT+ z^tY|~Xxt|U&v~*uP~ubRt_q^o^Dx-!(sAbd2vuCBY=+5^D@R;2(UGv7uy8d1FpwKk zBqNKO;>k>NqzZWCE$;-8sv7fX;>D8Qg-;#0^}0JY3xQp3l|vn9{WF=yJ2cKKi?RO3)QMHj zD`6X7f094zfIpu8toq-tDb|PY*GL!TwBPS(Wx(v$_>BPGfNpd6t^BJ+r`9j>j)<;6 zzvJM4p5sW^-p@f?Ozz0&8Ss9Pzkt(zcO~```nSR5a6#h&KO6sPv_H@BfBBK4#X@X1 zoWh_g(FV&upjub7^D4Q?%vUf3mTleh2c~xu?qO{t8uT9 z|0`(#|HDlGuch(Z_;=#?H`4I?Kd}wqzp}0WeQEsT`2R*4pnprWnYEdDUiZ(0t1p!2 z)@U{a+h6(kHq)$FsH&8ot7|R~D*4uYqsw%0;5?YQ#PGAYR8WvTTE|gop3tNGwvIg2 z%boJ<8(Cl9F%Yio_^#NfoZV&mG9@R7O&Pm#At0|!a8EO?c=3nI| zrea0S^xIRK+i;6+8AdnP;?JaEi{*D9?Md{u(_Qn*L>rI=&zWua*sQY$xzldGN@SFS znZTUuF50+3e&oP@!nbocysLG^92T`+T3iJ_rz|X0?5Mxg>w#V#8vjL?+ar zRR6Ks=_XYcX$n7XVi1ekQRjI4cH~B6XLU)O!e_8#VAF@o^}15_<;1j%Q1eFq?AW&g zY(}Y+!ziA$5rZ}o|2p%T?7Fi{Jw4u}OICWF?aEg!hEP37<)2@tbykzlD-`G{gEBZM zTG{KI^8$hVv`$MlpyK^jHV_(=}jo5zt(N z%55j-Fxbd$fzm9|{4GV7krS&bQN+XK8X^T4*F}zz-S%C6_C3lkhogqS5$pT_u0*~5nZ}L*&duXiB!S8`(c{M8m%hzT%}#(o zJp;;$V1WmK34sxLKKk+iRP=hw zioG~IRYd@U0{ITS1xyc&&J*h;0;t$*Ea6dCdpq7M-EkRy8}U!(le%}-VR>ijSI`7Uek?>hNIMIon2(WkdAhXCsT zE*MRXS4sP~l_hu=f1^=+J zd-Y`T$NRE))3#%&al5PoI8Uf*bN5my8X-IS-Os1 zx^4iil^byoE}tCE=bfJnwnVmI%>s5tc1Evm2d{-s@n?bml<-S?`vYw#o~4vgYWz{nK!|~-dCI*cOGc}O-oyB!4n_(d0VW3a!t?RV zhsjVf5TN3jKsqFkKKn~Oi60192V(;m(jjAzbl5%D!TxgsOdRnC0@uO(g$bKfIpJ{q z|MZ5Rtnli3EgyboC7JQZAfCT50)RNVW9-Kq{=~^0W5eJQu(Y^;;RH-fhkcJL4(Y0Q zg+u~YBtY~B=x_;)+g^cv@AKt9B7pnWI$63uK!>ZdPb$FbFZ@ZL4)?cLcs4=#KK!ns zLbt>rur%;H4bgsY@=GUwsOZPMf9T|wihcjU>WmF3+v-a{VOQhug)-BQWe0Bxe#rGDtq zQxvqRp3}X2ly%n~O$eb!HpASLVeM_HFQpat%`u<&m((Lsd#^Wjrrnv_e9mbpULH#{uP4{a39w zhuU>mEe$J{C(^`E=C8D)J8TAy@W1VD>%vE`Q@a84Ytp0jH{#O)EbjudOp|X%Iib(yRR;HvBrLGYD^^;if=pU~QhN@^ZYV+VZ-t!1P8C`-Rn+HgHoB z`&NtHWWx{xsefh-$a89~uXKYjj_VJ84>%FpI~~jiyNpO0O&EAa8`WT!s#oTg&`xMS z{Q$&UU99HPX_g%}OeUE#@YY@rPcl9~8NL*<*Z#_Lkauq5(QzZ3UsHT7ZlT_oJgRMh z-b@VRSj{xPT<3U`dbj& zYdqlUmb&XIiR1&vVA~;NN5v&_G-fTO#yl{Tw-JPqb7NfO-e;T?ar^44P)OM2TSv9a zQ=z>L9Hu0E&)ZmIcp8XlJ&)oe)LLA#m4^wJHmbv*Ybc(IobuLcg5{O9_U7EGS77H zzu=H@mS!vBueJY4`ErbL7C(9Y-vjvj$MsB-r@|)e{|~6PmK?sOV#NIq0sP)@wjzD~ z1}W~Ju%l_h-u}8b%%L7SVm79j!PL;a_>CK^PT%hUelPqp&1v73$Pn}YfbIl$UpDW52JnxMrmt|# z0%?u^djzrZ=RI0M_|E|R)~tu#IFqR~Q5UTnc- z52JZvxn2y_0I%2I!=3r@*5-<_2<`6>KwD`3+KeLW z1E6^S8(jAIVAV7cwEVZ=rXxIIFw#ZQ`yT=PrAbme$|W2j%zup&mxo0Sx_($b|0MvQ ziB;m3`j_u`|7*A#@gZ~yJfQn8Q6w$-?i%4IgTPPXKluBON9_;^pMRq;Zw8N-U^PV z$(S{6PoZa!m$xXp1e|K^ZeF88;$^P1XUw=Y<|?G<(!H-(CD?J_*kAZo#W!8psqtz1 z^Q^@usv*1jhE6`v2dCZ0EN5)Oz%`%gH7~56A-9b5(dAz+bfV@Ox>_naf39WZUq$Nt z==?&h30E_C_XQtmU-i3=dDRc6aXpeGD*6Eq*C^yWsH@z#NgM!%zSxESeo}S@Uyr(+ z^i%eW%gNiVj9?OOmVw$HA_Fg6W|w0*Mh6G1h65v*vGov_qt&4H2A#}+b~Yr?=MXKc zII=!p=TTG^y?}l%IJeg2-NL@t!fzL?w{L%{Q&8A@yj2d@_BzMP6qR^a1(MG(j;(s(bOE@pVkDa5szBy1Irk7kPv@7|9mVP zAU(ySqkZ9a=$%d!biYwHhzhO3B z)>tPK*I5nkz}#4hFbE4Vb3NUNw)7hP;p7?UYpcCFVp?-{gdJ@X`8)VtAr2kR=`Vr(H_bdZMN;Qpq=k_nw>~ zxWRB=a-MAgS(d>o%8oPHvA0tht}NqCRNZDmEEJ`K!VEOaJCdX8!-s>nBKfjc${#+p zoI~5|bOZ+w_WF|-D-~H5Pe>SW=a*^^VQa^r!=?mEQk1lJ1b;(2{kdz{GR+ z2=wYTHtGmgl9=c}9;?^aH^H2^nr$?Sp0+I4bg}pVFuPLjDsu{qOKUT^bY*L@eO}I2 zM+9AW!iU4emiHxzP2B+EP*TH7Qz4j{H^Ca^eBT|urlp>-puq0J%I>?&UQX+fUk4fA^|9v#LCVmCUBV91xLX?H zh)Y${=9!yYwl`^zz2CE>nx|aWTSNQYov~zd+W>n5nA@SkTDb?K_ZMdF+i%$}OG=2y zELQGE8s61b#vvW_O0nm3-+J2`)*m0yAxF=WBOQRBd%AJM9mK*g52HZEfcL0?Gw2k2 z;pc(EyYLAiS+a`HWwdr&&d}hJLZ^wZ;-J+s8DlA?n8;oW<#q|e^{2z(?dS*ySr$L+ z#Q>;#SGyVNV(?8aw-hQC+4-A=G||H|t1TGM^R5<(GY=*VOOI{WpJ{}jix)}~(|o~8 zV870(>L35IA+N6wuMZI=X9e9ZEJQb4ZHVeGO>7i@yH4b3@sgPU#{ivzdmd;dQHf&u zn5-wW-hF!$=XUi zfyd3S3enEdb$;9TYcOKBq zDV%lYCn?`x7P)=8@~G44Ss&L4$Gkc27qngvy-uQe8cN^!iCesMJjRD- zH2^g2@fbd%Hck0CW*rlnCl+WGVfq0iesZ~^OYf>zy$~BeATX3i^mjW-x^rrAx0U!) zS+w??#aQuDh=7Q(!jsU%s?q9A^uW*Rd!hrz0J50ZsOT9QWp|vk3|%JHT@RJF?^iJ5 z)J?2DRr!7=@&;xuT!&`#_*s@Yx|||*ca-W6+e^e)Q!9u^IBH326L+;^VDb@kRWuBdAAH;~jx;&nK@D;ZuYt!(NiiAHx|v zA^!gSM?*kq;VX}o2On$90qz~AcU>jYLc|Co`N(}Az?N)-E$G-Fe4jrZ$KCu@iGpls zJ1Ks>1^E6;{PwIT>v@n9L5b^AE?q1lETREM*QT|HDI`67jz>O&s4(i@d5vQ_=9SW5 z~*ZL&Ve(xD@N8GK$5JY--F5N;(b8g<& zWWBpyAU1xs0e-aR%pPwZa4 zyKZ~o8VY9Q^8E1^5ila~0H{3)|Dj!{e9*P}z0ElR2QQYzyP_j#$h76^Q{4d3 z^RPeH{Hnk&a$A?|sn^jHQVlM~Gvt!!p`}al5`hkddxkC`(S!1$u?69WNJ2^o@`P=X zBOgfgh-lH#HMbz3GD!5?iJ}mP*eE6joI^KUC;a79OpLBx8@*FhmA>BF_fHC+svrTB zuu=S3UY4H}z+JuEYdY0!_XWLMTQL!}8QliIdvohelJVRIzb<$hpM75Ne@la1Z*une zjnzvK|0cvyE)bV09S=RBUOuA?D5RyJeuN>Uf~BkLt?TS~Qv!=rviDDgcB$ZwvuUs!dXrc#TX zKRV;*h3IDtQ|27rlW1l@>}M>*nLylnYmA*}`b8>+IEGk;)x+#8tB5mkdH*bHAp^z$ zwit5q&DKEPSFJTAPdwo6=|aZaBRMa&5 zA1d&N0l)3d6%w}z(sS8^lqEl89BvB*OdxpU^X&wuYth(={zm8sk*!s872*P_+vFEc z9Xwj(?x!I=XP*ec*l4EE=PSZ-Iw`p=&q^1D-%8`CAc6GRoPn6ctV1e+CV`gu)R-k< zR>h{@>+(!vGXWT`C2T9Vi_|iG1)m^~Z2mPs%jY^{~H0%`k_7{y$(E(cYv>^_uo|0dP;ktLz z3TwSM4FgHd1)M~viK^VLtI&DM!zCI0uu9*p;$52%yiG-kl29)4( z(NxF^<#f`%h~3xxOU0P9f&VE(xicCb8K<0c3kI?}r&+=XYnH9txBG&{{&%s&z~TxK zfUyTG)lMvavN_`oSG8#DFzf_j*93lr+wp?a}_aNcWOGYrY%IAP$dlY6tz!rN|N|v{TX4Teqs!5HU{6nRA>bLZoW>`1%39K2|m^Jj6 z4rU&!(VbBjk`?E=H;?(_FB;R%YkZA@meoy$my8V7*YhbWE0j}%VqHYF*^&fsg4z}p zbI5PabMSg&$dOt#YPO5yjp%tSUsTWGUCh(?_1^yv0C_#XzV+A^QUK_AIDIap+psyZ zkm7=ZDZPaKzHdcMDyf*B)pb4R;}qq`y%Acw`jf2Al38brqINySq`h;8Q4+VUw^xEq zx{p8Ij=jNo#|86=m(;1h6!b+f)p6lN81j+|$&&-DlS{4OAQalGGU@)K30{(+shbsX z#9k3c=-M<#)nNnc+ktK1bY+{zYWfwj^8aJsC!nKy>MCJ*G}y&` zrmuAWTZz4K3~w%B7>ChY75j;&6@$GqpKNcvu_lrtQ&6>;ye$GpxdS4v{~^|;|d3&Yb@Uj05|}RU_n=yCL$gh^^8hT?L#S=DcO)*>OWL$BU^i2G7wjy(U57$ z)wV!kqH1iUj)-Q3%aOF+6(npL?|&m=V3(~3z=$iCYGb~J_2_wtQ{Tb=A+>)LUE>Ss z3dyt~!_U8CV7=zTF?^}Ik&mtnh*Bk+@lJlA5rLderKg5HUQa@X#j{5v9hM`4z( zF|9@NJr1e{+^&UrI+nK z0!TJtsuDJLKL?$LAf^ZDLBd&&05-@*_3t<*uB3e3_H*iKS1<3@xdJu{E~!Qfy@$>gGxR;6vlnIoEdloP$U(!B`N&Lp0z4Bu5`x}#SL2~dDl*ba%!2(Ax_$dY2 z0G(B|w~y{>-{?a9Ans=HZx_sOa=5TaNCHo|~(ft^&ALZ<7jPj^Bt$ zx-&}zc)kkckGzhk8Kq^p9nhGgMgEB+a3^Dz?wQ-C z{fE1fk6PZtYk%exCk3P#$l%BA@MZ{WP^t; z@p@*KU%`kNwDYw#bP1MNPR8a0MU(1pSEolXq9(Y&)oC$i$G7K_dvs6v_Fec`@4rs? z|A>1FpgOj-T{n>64#5d7!QI`1y9EjE?%u&6A-FpPg1fuByCt}5f_v^H$+ErI`u9HP zuT!_Ws+-w8dKleRZ$01pjmGJTST0+IcMT@9YEjZ;-$6urXwgO|9xh+4P24pK^T%OJ zB*~-$7KWqbBjZl*WuoN$*iK2O>Q>LNgKXYXf_3F9l6H4DVq(e+)YwV9J^pPieP`KxJyuym;!_vUHR)409mGWsYPtP*eT7 zPIh^!sc4}|!;*Y&|LhA{aq*m(@tXtOr_GYgd_hVb_7-2QC>(9+d*A6{k6#n-zH6A;HfIjhrdm);w^|xk+&D zY5vW#2oPSwo$DbpaQ90VWGlTTcB!0qotcFP&`DYeWz6)eb1u8#m>RM9r)A+)2^y9w z!Ql_NA6^iQD#_?@*-hq3^UJ(oQp!lD!u(wA$y#fD44}o- zYlUo$3ECBS%Gd6HsFGNcg?z7{TEH{f5 zFBWe6#Uh&Q$;cd8qR}w=!X^*YBg6z9sTrlpw50PXwR#6UE?bNdXlJ_j#7;; ze7D+1b@;cwgT}0En+eMy%}anv5;*)2>oj%&^JVGCXTn*HT^ZHg*~qThl{RAw)KrBa zzx9hfW5nK9GwrK2&0lR=Iapd+FUkgmKD|6$wc{3^p9qkUSv$KfD^F~T$E`kBs3#7~ z=nN^W4UxLmr`x^ZOJQoq(s}(d)9W*rMioYl$g-sRM1agZ9ecS!zb*@~38hS`R!bW= z$Xt4A_V|TF-!z<*rXmugK&cY>Wj1Bo3W3W{IUJxAtgXOn(91@-Z zp5aeruD_ccYsZuH+F6fZa`H2MYPek5PRRxIUXp!MGRVmu>!yVM8qV;g02iDS#vaX-#*edz!?vb@!pu`S$9AR< zxY$XV?1DDFOV5Ig|9llMX>|<#*C`AH(3L1KDM%XZGQe;J5{td94h&SopUeEGrW{Nk zz=Di-WX6&+*xNI)fA!(dHT*aw`V?`v%&_feV|8FX2n_#H1TYQcg9|dwtCTnSePn;G z%xTvHFX=lbXx#sCR3E;Vz^w?;zQSVE?RtyyR4kO9O&{5z-q7j0Y`RJPo(V*Du*o9# zvIb`@%1h@jY$NZ2GG9vrS52n3v32VG#x0HOZrAu}*T~6OuQD8#nMXrHWRB4gWT>f< zt_R)_!4Xd5vewrbPeZ((aW<{@=*cF*AjwrRJq~2tA|7=CnvQwPK4wto`^-X_*$UC4 z2IciXcUbPM4j$b+3Gg5`oaL-_}$uzL_3H;sYTuJc?d0v>(wk6umO9whORDDB=!e zl)zvH5r3k`Ysf)_h@h^(z0lfO5eoYKbTG8A2o}vPs3XMif9{B=2-ffS3u;TghX!t! z;{i}j?r3M^J2F3R`@O)A27aB=g%%XSvLyJMKCB^k5d{k)2dxM}VRF@t{kX~21JwLu zJ&=QZ#2p!ber103TmAzI3Z&C+D?mzo02)%pkEhH3ul@gXM*@*W{M#Rg|Ja9Lv+|>j zAH#qAPtZBqX8OUs_|a-D`>$sHX#yapu~78n;~%I2;*JNT|Nq*TdThUSuoW4_8MYaw z07d!ZckBWM+g-p-L|yiy3v6$)N-Kp7w`a?TghNCr!Oz%hBgig+bFY*n+ z8UGFtOnCPIEu_-cVirszVn{>`rjsWA9 zPlg24ma6mpN~$?j#sK(PE1@w9gWh*1u;lh~PrcyPHA#H1z_K2~He|3sXa;{L$j1X{ zSyFHS9z{3!i7>Qw-TC8`!0Lp5b$>kn^E7CEsh@XreSrjr&omeQV-9{?D&To62wjZ? z78p+es`mlv9_fbQUvK_%eH}P{PlTUgb#Oi1hkq;wfExeR3UY((KBxz^I$z!WXG#9G z5>OA0*pPLhfBO%}S7(}&{OsJ1`ZF)?-M|6?qPAbN{&RT$GK^n6fwuV3HuOGx5y1S{ zf)FjW z|J`%|IHw+TtEEONk@nyu@V@YRnb$aQ!`~gF2YsbDdI%T_MPALSemjRY4}3HJdD5p< zSZT%vfglg*X5{jTcEoB)2oK(D6vA*uY^CP3VQ0hCUG;-qA;x!wrj_xi3|MdYADgGU zx8>FJByHVJQcZ04MI65f?GQrsn4jxl0ibYGhE_PR7+Fn=s6Y$->ihLGjA7SeLu9U# z3V2NBxtV~;}MTXx5^iHG$3USF||rBeN!-X%a(AbH63Pjt`9gt5 z?GT0_{@UH8k#gOSIhN@Q?)gqZP|sW!tE2U1v8IP39TuucOt_@FSNdtqyXl8i=Nk)q zF;!#NkF8`Ni6NY0fh|Cf0b+D48$!Z=-TC3N*=PRceeVkh)H3~JCx5GGpLs7p$Fc*A zeb4w#go$IH`H#DH96v47;MYP^s9ABy)&5$hE4@Fr$NGRj)f$mYDA)cJtbQy44&jfT zB4#$7dbw`5&|@F{{P?g~rwpE%k_g~}E&SFY0kdC2_%Ax%LV~%_8Uc?0OZZ&i<=a<4 zV4$JttAE-t^b%s@bi^Uo_?MCS(-L9hTrvLKqB220e(lJ}g+Cfg4D=Bx3+DOCLuBrq z3B?+zJF26c38A&a-{%hXX72Jdd3MZMeDkoIte-Hy@s%Ky{nB2ckT#A95F+lN6?W{{ z5nh-brAJd??Kch;tUeHxs6@B+INvW1$AUgk+)oTP_Q9!m7^XbfyNPc=FWB11IXrrz zo`RfI!B=&=%Cz1NDc3?1m8);)SW5Q~z`Q_vM;aoiD~5P+nMF zXb9)okq!q0L!+Ri6}(D%pI!ed>2{lJ_`Dv!SA5%zY4sE25Ru0*L2|Rp;&I#1f*}nx ztl^VDXc!b!RWZXSVvxGFb|N`Kv*OBB6R1SAC`?aCo-+K}0YCq|KrRo0i{2fi4$WbR z6M_mVKfCKuTvHi6{v;$g=O=Xl5oxKXa{V&Mw(cDg%VnNpV1}g+8>^7M2S(gnmgVsY z5%&mVR;qwg@0Un85BbR;16_1wR38>WqVX>&ler^d?KMsM*7NEJpyl$=Vi>Tcy4q!X zMhG;oD*-xl(!seXD}p&PC0f39za)k0hX$vttR5bskL)M@@`Ch{UW+Be8glna2kmhK ziJG6ec0=kGdiR1;mCM9(oY|W~pZC$!T}jM?qqfw7^@ft0Q@oV4NF_2-i92A;?z{KU z2iu#+M|o;GC}hfq{@^UV9iCrlnAK2w2G)&}J5nkDNqbK6bv(CQ7;e!?MWgmVz9 zUsjRAdM!)QSXz`+RA-F7%W@E>!%A#+mHfrJ^(3q4x<=gl1*g60{#UKdhXMmLHj?vu^#@pu1H<<90uOkGhmx|A zMyCMounXwZbQd(0n9=*ovD+mdOZZIM=M~C!57{@OzDPZ9Ooq77^_@+?J@NV;tPKR7 zKOY_339mJy(=-r{FDQ|kdqMAvA*0cP_PUKEb8TQAZ%^nT`<<4rJ!)%qU3^JO2AyQ? z;j*YY>+t^E(TpU;J+~EjoZNJ*f^seb3F|B%)wr>B6GDEnEw1&ns=15AA{7%&DsusP zC8Cf>O}L~-rF*xO3gh#B$B7yL3p_z?d-yT4kFZa@d~1;sKlg656M}0w?&|+bgWsgCMb>QAPf+M^?UB@PAOekDD}p~3b27B zLn;rL?BC_>y3vVvKu?nC@-d^c-h7XxnWix6R@d|OJ%MpuS|zD}!Z`!%BFKVND%?H~ zyCKP0AD&c=+cufrM6GGXF!06-Vl^ZY@XO-+0xsb1%N)}ytjM>3r)JwSCy7W3pMw<2 zmbikwDoM3Q|3=L(Avc2SwVHg1%XFJX1vb>yGjb`lp?5m73^M^m1MIO;q|K0(lHB4$M214-`9dJ9l1W!wzENIQ|1Vg}q<4nn;?Jl@UQ1h|4t zXbR7x9kYh^cXN0cItLob5(`bid|ke(6(NaR?XIiOd~<5PmV|6jJ2w&MO_a%^F4H15 znnsY(+=>*>`y|7`&Du7?m}`@=yEK>*2-l^?xGrkd>y}rtg{G;gHdg6FXVpIZmT|B@ zfKR{ZUtUW3+KAlYCNQyzBWp~-*b>hW()Ve54<<0yBGBF+Wh;a(YT3+ zXGQ2I)k@qH*!Mss+Qc(h1Ar;5u?ST;K(-#N0 z2oMtf5hB4}=NiYi`zPzYn{Ol!2YZA>IR(J{!J#3LVOMNapYW4xrC(Sj7!rNP?7_tt z!Ck{<$)dwe3X^H?;EjZ10&eG0)|EJSdrICBy*G6$m-Z5IxMme$PvpMrVMO6_-uE3- zu>SBBOyNa)|1w6(K}2+{llFulc5utR6=Pco8WW@RoLdCB7^(;2G(8OaNMRIQ^CTbr zGLw-L!j?N4&6;=UrZ!pqjdh1L4uZ$SO-xufbFUUB?oA%NU%cL#6j73-+|;B^zaI(Q_4u$qqe#Zx94dYE+u z@w>Mx6dr$-=KH&z>&i(@Q`un84d@!54;3HWv~y1*3dBO}I1M16q;Ommq~ha~4C@w- zEy4h*v#mZbm57{^yas71=!XaA%!c@TbRKVrd6wtDyyCB+wF8UQ8Dxkad#%uk5Z28X zgHgS6Fz(dfTe2QK`7ma~#AC4`8}&pud+mT?rrLeSN|1S7zi$`bA(T7!w7Q5&QC8RA z=MtNSE!uI;PiD;^HHZ<7$WeXWoNwBCzCb#U;l+ol)bf7W_c91LV zV!LHY`0`kTdVtG*h|ZQ7F>s_&epPohcU*eLBO%>pPv#?&pQ>Vx$m;Yr!HQ z!SPFPTo=MipogAo1IE*~-;rkv`rjBdJ{)gJg4XLbjC``w(=fB;uP(x`L$JvpQp?oX zE3x|-EpDcpg0A`_fri?m+H2(q?)Or@1%qa-41?kK!3|k8he|kUbIPa#j`oyqdmO_r zyGRPn)XflTCX5R>=e}yrBdnicDcn^UTo*>|ajAuvruDf})BsqG(`=u?hLzy(EFOi% zx61wy)+jMy5&vLlx#>5A3ZF!A>4>NI9-^l2xxMB#y%W)q*N1D+M+WL$eDve}`Kj>( z&A;Vui7p-wb`OwrVnTA#n;>?JLx$iTMf7np_OslI2v5Rpj^QX|=3aVwD_g2+0YUxL zJ)7Kd4>cnafM;N;ce_WXB_oQ#>8`_-^o>^d`o~iqdb@1MAxi8(%yW*<0Xp-DP*k51 zT1k%!+OwxrB{QTdNut{JiHxnBm)IH8p7BjbV&)rE${G1USenI1G&4)Y@ZnjDy?f=s zS-;iRAhBz+VYYEdRP=TI+qnh`gt32LhqZ80U`~}hEAVOACy{kDu830Ib%Po~)yvKa z4h5B%v?z4DmPr=x{fs9cpW|C_%G)#^0MXv59$TvDn1X$Zq7rN_+3ZnP`6>v{ioYh# zCc811L`@}pI({s}diDi7AcC!L@!7=F`-(FGJBhdC=`!api`;f%J0(@*3#7p26uCKL z(m&VE0(a2o_;p1N*dG|g2o_xFzh%^;Ga#5*NzY5Mbm63;5*kro6&Ca@%T(!=8L&Z* zzvRtN{TxK{sMmT7Z%$whC_{6`+VyC7Tgziyr%xO6<&iH|P(1`mHPu!428i%V)}9XY zQl%2T)Xb3i5HXh)Kvwf|vC*?H%po*E`K(|aIO+@FHT|lw%UcFZ6(W$75wT-Eva4j$ ztE;KQSZi6tQ~HEM5GJ}@1n+>9~7J>?^hCBKV;+8l$2W=kLT$ zQ?aDdcn1%-X~tM>TAnpIf@$BGemRqIMq{`|u{LuxLhE>7u7R%Auyndp}`z>w=;x zbIMiISUn-}T{ijcrjnD<^J%lrSHtHMboKS#Ss{1VD6>zj=)d*7-tO*F%wq%R*f8&# zjwrNKvAZdJ2XWa@=D8pTB|a90_tbGAuR|bxRbN-!UXcN15?}He zGvoDmyFZ}RSk|S=IYRA~O+7WvHYwHsdM&s%ig#`$-@{=p6gLkLs?9De=D8%x3OjX; z&Z5RMY>}149jEWxO%8Brb@tPw9=aa(QfD)~(t8wZsXDNe2YVB<8jH)xg8jmltB&^W zNaZb<*+76Xnw@Uad(CU&o;Z^!2mBJoyR{%}pk$i{hRB#Vw1Z70b9rChwg$XjQTFJg z@gd~bGm7H@Rou`MHBCWR{jH2Vx!NblnJe&{-y&kd*?Q4a=xd^$!U*p^{U}53DpnWu z?rLy$nsAFUJ8T9$W?!52Ym#M;52sK61bSuGENiF}QQ?V94yi$fW}?$Gx;6*O-+;+#CSZCavyj#TdF737SgcVKDaUuifAPsX`z zpcI&)jmRRDISlRMnlxN8<*tH%QyFqqSOo0w3kt8hW@gaOEHk7uZJBk4?3p&8W+KJ# zH3V>djI|D%|IJ_@(#PY??DZkAr?J> z9?gdw8!@!Ikz>16?}ZY`Z&bH7i-#a)zhVWo*_nN_TN<@6Z@sL{sREovJG=n(tFMJ0 zl_M%(t6WL7?B-csIY!7W^`-;{g+%J*J z;R2m?#!A-*!}KbS2CN?>$&={4!CHW8%>lI&Gv z?#?}@`HWUiSQ$Rd$rl@KeNcc^5gdm(I3>;!|3=s`y57MC4=vN6mJa&G<_t6e@-#}y zomG23BBzGNEZK_~pPj{JjHd@&L};DFK?HMwN0bq!$wv=D4){Qri^O(kRi`AIBq%_@)LHRL^0qybs<4}SLFJ8 zevIYrdtCy9qZ8Rxoi@TQ3*_`m{UE3nQth7yN(h>i4xcD%yw%D5jNBe#P`a?Y$~XaE z1KXUc>vWHsz_1^|{DpZ-LuGtKhhKOr^QhvItm8EG%ZD?AMN~}r-D-Gdm|}F+&nxN& z!e$EZNAR`dJrB6}I1iET$vZ2>j!0n`M5so*^|cFwmM~bD=>k)L5r*D62d+1R1;m@r z#IRh`+l8JUS5A7QV|zR4sX3JYE$^dTrlu8PnJ=Sb1r8nH{sH%$#wKQ2EX-`P?|-c6 z7x2gTXO8L7r%=s7TQ2M^eQ#@TL*Yp8QvnccjA%4x(hoeS@Ymy{yr<>OKQUv@jJRo@ z@&ELku%0$r{AS>~iBpTwBd@Gz-4r<5=XLy^R-IKu(t7~TzK$G{h8HLVqwB2Dp2DtE z#WRu3GqJ|B4Lr;5mu&@48JbKUI!F*uoL%xCFL1VGTI z)2}Bm2BqD{-NkCH1tubj0_0(@Hn6?G*52}!Q-!9r4n!!ot1la=B3vTb6(`-X*6e?` zE~%mzl*E8}Yh7evB^xYywtlXFDC|gG>5&pM!mDSd?YXANeG}hc>9;;C*cH%@2u$Kg*-Q718D5fKRv{;GTrfok-+YL!^A_=sNPOY3Bi z_EEeB7~_(q=4w%j2j)v>iL1&ry*!L`bDgUD7Of&4CQrSHQ~ND>PrxvuZxt~l1ua^- zQjUeCSRSz$1>N0!bX&aJxcl5Cp-Eq>#bDQFKc&lLZWpr&a{vR4ku9AsXf%8DoP&>R z^b}Rxye%b4&s8D3Q+p@&&^AN=-L=$7368X+RnD^p7H(pgCVc%F<83drb%_TPjiiBsIsBEW9vs&RI3ReZDsVo`F;gV>LFA1puqn{;#qU9n)A1Ga24bxAlC zgPRu#8mE^1NxlK%EfcyRV_7XS5s^^GfU7t4dRMvW@biRguXFAjYq6c1DBPxPe>aUJTgps#37oZ?D_sPVQY z!$RmG(UoHYA{7BDn;-EyR;l>LK7X9R_N{}%9 zz_WEezXz)_B4SC01-L(*_D*RqDHyV}aCtpd*PS}6l0mu78c16Bp7k!r)1u&8c_V{K z%&m5{f99rR#qB_M^tUW?os|v%J{Fb=y@VC;f!tz%C-~|nBP-%T5I95sgkI9go|}EC zNe{b3U_QJN^vU!OCK`0+v-z{+B=;9JPboE9DUAxZD+~^(*atVkuN@+)sW~ZQhizDv zL&`ViD~EKXO8~XB#;}H)6bKXX_D{9T5mL_d3J2C0bAB*72G)I-_ax51J@$+e5B*2} zrBC&i9}u()8tC*~n&vcEjIL!(!NUFDQJXmA!Iei-*~1J-+(oVFG}!w#yiBbDF!iQc zN(~w{sZ-C6t61aH(#*-)T9)z`(+>sz{s@oul;bkch#th$dxA?wd{zO+@N0PWUbX%fWmi8OtC7>nHXfsl~Yj>(+R)AJXl#DvV8KOGOUYj!)8Fjyi zb5|5CZyZtBRR?M`!*IgRa$gim4zX=UIx$a2Ht9S+siY+^t!~Zz7`IQDR$eqCHxa^A znj3%822Xt)XIPR20ln1zrkoG2Iw#yfqj&aviyC`JXFB}_aBj#JQqpE05~IS-VwEV4 zpP9tAdNB2byEmo9?vn?-0}dVXo9KEIY4M}pAR@#E2kPTH3>`!}WD1^OrUzlw~ zLR6t#ITC-g_kPFCUmY(MWWkY`+I6MV@e`*p#H1|AGu3z38eNf_5aR{i0(p(Gb;g!; zvx{NEvcP;4K1`}?<4b?DEE^-8r2#Elgm61(ym$?2d@+(8AbUIY{i#P}%RxLy`@>Ml5Bi)EyVcj%7}& zPz*<+?)zQK>KX#OyR8j%7A1&q+~)P>C+4 zO`4BO2g3>C3BD`3zhT3m8Un*1WDziZJN5*qguKG${9YB_Nh-D4!m(85xP&~Kf#Nhj z=4c6raTKBzF+aP7mp&lD?yLf@Au{;hXpbZbu8gRmf2p25EM%-)6VpG;-XZ|0Z!cK( zp$6D749X}P+K)mU5V$(Dfdh9=jR>*p81Z9ajG1%D^Ok6`(}~sENxg8pj-xE}V3_@= zi-KuL^OdT9+C}se+%?rZcloWY^Zc6`+nX<3^ovEPC3HdMcgX`^sNFRp%eFkrs6LrR zjm2JV3)fb7#CRR6(zEnSiEn=uD{za`9N7kn+faiou^LXeDo7&q+$6BV`PQJG@y{y> zwTutEFr=M*hEV!y?X}!7Ztl!R4mm;wmcx9GuC>uD(o(+jlL8unQU~kcm9BEl!?P1C zGf2%3OR{AR-w~t}&ifMSa88Q~OifCciB9ER=5J9~uSbr=Zpy7f;PUQX2PXQ@yu+~u zY-uiXs`5ll!b_z1oL{7;Tm*SXuW69DRDhz==%)PTCDT$ia7oyh!ipwy2A?HTe}rn8 zm^%&@#aG%OaG~((S_XUuO%Bd(UA%Hw&oJk>fc)D>%y#i7%%-6LhAX#H2p2J{=ei~$2-Hfi_YFZ^~BLY+X8S9qRApC4Y$Y2(oFoap6z%9BelPV7QZkaUQ~FD!6Z%KY=FRl4 zm<{R=%$D$)tv+f z86g#VFTA7I2APl!NWRgJ!zhB}n-)mEDMGtFsyF^I`azI-gLqVLr5#D}f2ZD%eE&|p z0spOh6M7#|{`@!jrk46kzWq1qt^arRw*2qv4fsvI!T+DhH~OFQ?H|;e_&=&Q0)+9= zpXx2`hk6742l$go6@>g{3YZ`B)*{(n$!!2eFZ{jb#<@L$Wf zb@Yj}#vj@rkd>KJkc zk$~{qKwEbNLE!hOs*`c~`4`Fn*WmM1)_ZEl@9S-6WHygcRUIUJ4XY2Uv!+9~yo!?0 zjQe`eYw}_5<3fEa114e-od{Sh*x%;zyQ$SIBqX*jz;>W9Ly3AdK)i*9Fc}RG%J!_{ zELqX&iNymgz(asl4&Bb&5vyEP-%=yXU8Zsjey^@BkPe5-j(JO+} zh_#{8mUTxkj&)W{W&hu5z|lgG2J9yIcMS+UiokQjiT8i60be^BW4;B`tjotXKk6dL%zWUW{&_?32Dgah&N``4mo7nvY<<8|kr5P6olJl= zTmr>Y(IS4tQ^}c^R6y}mv&0|qRHn)|sY8~acOTUiQ1@?k zz2?>PkntXcUnZE))4O4u6_bs-Nj|L@nt)sVq0R|6VIDuRDI?*@a$5B|3VT80H$sk{ zR1{z4R2U6WXzAnf!%gYh0(ZzgwwE}_g?g>Ek+}wn(fJ4qN$ejMiML+>z7e zX0Eo<3Vd-ABJU~VMw;kia2d_KAuIptredGzvar3W`KjorT?=VOR4byqt&mi089kA1 zqwwXPU}AFo_?~8Ge&&9YWu;_Y176RG4OMB?j*)0b(kWwg!Y2tKwY7AlF9Syk7tNZ@ zW2E#iQaf?;w=}Fd(`&({0Ky8roq_$nFoD2LGCiJ~U;^YjLphjhF>05HYArODCgKna z-e#MW*U|AwEN}IPjN*OkW3~BRa~Ht!DxNftK#};O^;%a?7P@9*Te7-yx9>f$Gw98b zm^7FURTgBWHhYtd3V$&=mh#``Zp7W~ts$e!uy4gSMtx0fUe{he2dLd;VWjdl&|S|t zdD<@!+{oP6efZq3s~4<{8XV$OtV5(VHdKd&8rF%wF3aIfTlg*ptuDR22ker$Ex?<+LJYWy&447!^$LQc-#h{fNGN9J(Zt(Vl%W!nv2k7g$GFK z`S1MDlt-;Vwv`b(lcKE*LW&O=%t#1gkImqZ}C)u>|lV9RgR+Q z355gewsDBn*3WRNue_6c<^U57R}r*(=4ju)dbswdOZPq`KaYSRMRgO~4_EE zD8FtJjb_pG{23S~I314);KP%GVOXj>&P~F!YNf}d4u^k(x6zcs`J4co)V|Juc)N>q^5D^xA0uob5|FlZdaY2dVR!$6 zyc8?`SpB9`j^Z1(^9{stcSW~<=y2}nD)X)bZy3_(DGypS4r8t%md@0=EvCB>H(p+X zevL!`DE}(@Sew#^ZaC}}xZGkw^}HK_r5oy%vbaum*f3u#1V&ko0{Qufp~8)A9X2KL z;pRrt(|z)s*2vt*+Mu$I@ZMRIpT_(~1T&DyM`$|18_Ia5DZlcQ?rLNyi#jL=l-8d? z9b3>t$`sLK_7tDgOvxf{ zQd}Og@(b~*((h}Dk%W#1u`NmQm|8v$yOn9X~2-1d4%IG(4TNJYMq#1Z5#NgI+KZl>lL z=i=0cXmP1WnV-nYcNo&3KyhPpgZwX>qYZhHGzL;NUb^wp)mNcN=3<+-`!gZ$a8CV0 zm-^6zT8EHlYY!Jv&Zqdh@h$UH>br}h(}D}Vio)h3AUyD6=L7@dBf%3PF!?Dp1v)O- zRuaZV4xfqEd$Wk}1Dnfea1rkI^pIn50b`z2cZUfh1WG3TB9Y@)duIr`K7hjHB%A0) zG?j(<_h_oPlj8iI-lL8bg(H_~)WEpO{v&G4(w_GPZa#3#&xKz4*Uj8P+avDSCh?lTjuQ#`*_sw`&mM_ES&P~+izBPqDxF&B^u(CPk?=|>;`KE6&9<#}v3BiL(RgyBCN!KM?&`0)? z;+xbvkKF;7y)4It2W@|q$)>PF>te@=)=6^RYh`V0QKtn4MTh1pDeDp--IN&c?qU^K zl;WwFabqlh4l-1S6~eyyR9DdU|HAv0{)hMN(fS7btM_dRCyraQ7b@nP5jSB-Oa4yrzo2JV|@l(4IFpFn%znhL#(`dw#x) z@r3w!3NJr?)XDf(ov#D7nmu7Vp_gtK@v~8AHO29*n+BXNp62=S24Ak+LP(wHVGafo zM(hoJ)w2d5u$<0Nr6u2ybC)$iWkJGeDG!Bre_nG>0=@f)OFYNme%_kXoMR&0xrmB! zF-Cl5SXunUU7>HZ#xrC3Aua56iJxmv#cO^Eih-syoq?y!Ajd*f{W}c66$8!wq;X3N2{ zd?NBU);ZvZcWw*holCp^%{zzkChJe$xy$drd*|x5Nb<1|ja`>Php2b=(kE>| z72)+#379y`v zwyz7z8Q2y~!rD6GRBk23;477+JCnU_@*Iqr=1tgdZwQ8C!f=h<*lQ%74Ddu3<$dXJ z%JkaHf`ipDHQq`UMlHTm{Xu3k7Nfc7mAV7pCyYrJi5L%oR1E! zB-1>DwA-hux-cSa@Y-%K=27~}nn**%3BEn`O$QDriIz<_5i8;>d;`@;?TT|RKPXw8 zC`Lodht?k`GSpV=Lmew~KT*NRn7!5&v0a-hc6LV(XYnf*v!PJ`@*R?V$bCZ^^MjkJ zN>$~o&4ycEF*;#b?O~8pGsdZ-rYW z_)CCDZfqL(NJ(%;5b2}#|3UgX>_DUsruS!3#wGI{$BH-PW#we!kC^P6KVq`4bN-Zr zLAm`$OjeWdF(#XG@NX#?r!d(+VzL~dm~5iCf0}^_K=YwnmO1Z@kvx4R=IYR??2eAJ z4S!#%yqEBsnEOI+Bn}QtO?So3Nn;_RbAt{T8A<_rP4fQh*yv%0CjAR}JB{A)hpq#U zod;eEQ4R61c?jzsB2->C_<#zu!z^Ez#HL?~7Mp(0QL?vo{n1wpOSV4Kln>*9;;~fF z0LVcnORuaEC>n$=NPmW%nE5^Cnu8@ZC|(ZBgVvkgy7@+>*)AHK$w!2E)bxI=>$aSkGnf~uqee&dgx9V5rnO- z;nPo|U|9;G?Xj*#a1l8D4BngMHG^z^XKAnhA>Nm8MW`(xcaJ_IXtDzVGt=A&=-+!t z6)D+a#vy*u8KP^o3mQ*@;vwtU-Z-IHc&vay_b6p0lx+)6g?V?Tga4m^FY z@BLKyd~QV>cn!-y_EI8^Bmp8jiD-6nik5@!m+Uk46PA+;WYw#0S2sn$;LJjXdbLC{ zor^r~!vVrde zm56?vAUS^L8D+4yO-bglETw;w;1YQR!A|@p)Vo1&mTSub%=g38U3jVmzKYtgZE*|z znRgp4&0FGmy?aKfgQotBH)A~>AyC7`Z_Qp=7!2rS5zXwxJfYNVf1@J$V4a2F_o7lT zSZr6~aDxx8JSdo#g?utz4ND5h>;?%wgWc;7IbDTmg|Y#@Wl-^RaK!T+1t$uKtG4I_ zrbi09@PhN;R_6X)7c?~GqVr3e!pdw4g~#d(vE#pJPQzUaga^t z;)Yy2c~@^_u;~Wb1|yjeO17p;VXz%ue5ZlQ8f9eJUxRcIm5-7BO>h{<^8~(dDJU4E zMU3OR3GKvVuieyWCs(H3eT+^nUqd@vf(m2D5s9$|5?_+hfrurg%A~V%lMz(K$AG)86Nfvu`0bC1zlYJ?Xeh z{p3Kyn4WyLm3mZLT-$5JxALPdFu7>cN7fks(wQCZp#51XBm2hf14`oq{61w`{5XNl zq*hH&Af1YKd>OaS0ZmecCq>m;aiQ+mO3tZ(ISKUoXPczn5_a_3oPydhvWuAITEz+@NHMZO5O< z62_$Dep-J@mY}2fnJh7a%bEr9A9zUd=4Z`mZ|6A{@h{SfBZ%KjhN+MlC!h2+B<{V^ zp@+Smk3*_jSe{fEbV43gSKX)B6-k_(lycJzjNMjYQX5}GI$kMNCkR`Z=q)c=-*-Qa zg?B978x3=3+7(sPtrr<6z)h+dA_uXY?4M2V!)yr@r4RJVLBTtkId>Z-0dM(PD&O}i@h!-CMeV?hl zvhB7bExNpSy8gC)60dk$Q7(_d0dn2}PlQ0p5?9ISZKJ{0xn8v|HJ~p+i+%;12D(Ci z$Qum&WS~@LE4Sf0#OJ?rr7YV}UZ~$k{91=biC|pI8(~~#Yoysu+CS_|1EFJ#CW)tj zviJ%}+>LN=7#eBEJIX^6cLJK84g3Dm@Om!z*&zx?X~O4HLaV0*8$!obql2}8w1&1{ z{ZirkIsyYXHHnfITqf;4c7-WFCU&Hc)3t%j!n1Dk#<8|eoS~b`%CF7F2jBU#Zflw| z%0#~{>Eb77i2d^Mz@yeVQ$mM}D~Mfjxbm|-pAAHufMMrY>}=%yTlhh#4%aCZe!{E% zG}Mz1sz-zt_2j0mqNua(T+1A>069IY*^};sK{^Nr>PGLcvei%JjlkSf5yhTSgf*Mz zihp~>JV$lr>^psKquWs=JmNT-V4@<*?Qt)X7Su4f6c0V>;>f{1~0H9~ef!rAj(s(BQ?wV|xAelC-8zcvtQ3d(ES<1JmE?W_oXm_>ig zaV!RLlBIflQtJg}gv$HxFLl0}O2|X-L;l$Kc=_4x_O8Jd$62lRPm|9T7DZTvkUFp> z4a(69C&HQXg67}buDJmq7hZiW$b^^M^3#L|h4&{D9_{Kc6W;pWK>gMqCOn;szcJzU zhk#6Yp3=XW@J@K&K`Wlxcfi^*$vIfZWrzM0e1Fk~o-G?xV| z2L83ApUNApFGBwQ&@j~N*Ttc~(w<*r2n@7PjHZK9{H%LW_iy_V&igH&To~hM;VI8R-`L)rH5KrG0Qb;;hkGag2=}P}4EO#s+v5lRN4U2X^N(#bgnNI-_7LlF>{&O=wNz3b z3iR8X0XmxWi^+DBDw5tOscZ!dV-&8p5&d4$N1Br91+B4IbCD^}rMs$vP}`-Yy&V}= zr|4+PRl-gs33g$fs)nl~OY|s<5#6Y7S|-*y0-P;Mnfj)yFWC0Je43Ph@$Iy_i!9U) zrfBna+x>G@#bant%7k0z_8Tn7frs^&GLZ|!cd#@zoH@;0TpG)tAZv1@rYs2;9YgHC z$($F#OW0adZ3!;l#6C|6vVd>B(hJ<@loAToK>AoFqq1|!^*p6mpd=>xHcz7wjOV_; zv0@tXa#{lC%e_h3Cn7I7gxz>ZH$M*BL2SP--Vo@JziBg#hDk#y$tHd{abgVy z++g!RIzeo@t06RzC)?@D>Q*>*7wtG97-;tucq&m!Ojs}!Rz<%vDEwbyxhBm=EJygS zSPuA&%gvMih0FbpI6K|nRTX|Q-b!)`Tjrl-a4uZeEtm z-5^Le(w%~&5ZnnQO>mw;@*p=>%jeRQ{Zx@NJ zmZp31$wA`W-jx;AuI`6QTOv&U%PmTb>>W18(eCQy7v=o3bthA6ZwpjFAtIOmp@ zLpx+7=MTFno<|*VRdN;RjarK|bM%gjM{r3WKVE75xP^-<;*vDuF8e6-d=dc6s@Z0x zi;Y2FhhhCIDofGNBsqk!b1qB{uhaMvaT z@)p9=zk~3i?jXF{pF?<-jMGVaC?|%rd$$mt2pGbnxP$P%-a>fCKZo$7et_^w!4Mwm z&mg=h`X3-X;2nkc6NE?f4Z`F8O$cutFK_I(Av~o!2v2SI@XIZP=XVR?U4tP!$DV}G zINu<=v|mGbhhPW~ct_!ZA-s%VLU_wy2rudu!ZW>v@I<~rc(SJPhVxwCAUyD1O2e>T zhWE+r<{wvTb$>^)q?gWSEj`{>)xW(g9K-h?AD7GMzD-; z3e&V64t2(*DxXy)$V*=7SPCn_Ma;+bl6kDUFW{HN^C_!Oy{Hm6IU=kF4r?k*MH)JJ zC%p(1l|vNCxX1V|UvCJHL6guNs7Pr3BH=*5XTm5?7gBc3d}uH#CQ{^XNCQrIa?_8x zzigw7bii@g`Siz=k5g}SCs|0Th|we-?T0o&ybw%N#}FUZHI^*Y zE81gz<9`uQt15Gi`~C>Xp*9z7OdfJikYlQv{c#8B`PXyG0FwIHSw2~y)Ou=J6+Qop z0)nfa`njgDOrLoTEmUP~*$Y1n&mD;gjB4w&u`eCDQS!Ob(vYmVZVitKHDubQEX!iq zl?Ge=7yF)L=XD2u1QGP>#wt(ONr@hacJY*V&J@=yBbudZE~!@z;|hnR$;cK(vf`4G zii*B0yoL&5rkk@xDNsEDf{H#bZno2(^cQ(y+td`>stz^6qrZD}sqvLjIYf?)Va`*R zUX>81iLu9p%bt>-S@M%@fap-rlibz z{m8O&2)_Vt91?_`B$w81I=1eLPn5Fm5=6$PC)>-|kl(#bf7s{536y8*yd-x~dq|N} zqX?y)NDz5X2Z_nD@}Mc`>!U9PuNx!@l02y4Y4xPDo^GW)$vj-PWl+fZQosy9P zlF5_=7RGDDx+bx$GZ}xnZf_HRfQx8FRqjb>@Cy z%mw^gV=n1;jX4|tjp=X39K&xJbHJZFa|*Z4oWgf!?ia>f?{{PF-w%-3ER_8@V-EPc z&fNcvF$erzXRhUTe#BoZ>`m~vt_p4KwBPEuCpV{$(#Z<$am3m+swu~hJM&(SO{D{iw1o%{9 z^u*fP{S1}Ui@8JPfIqQvls~X??&V-s4qJ){+nV`~mFv*GW93L3!Kj?p-gi_E@HDRE zXQ&+clW(Zp3oEwFKVzu@f92hO-Z^bwDz1&5~N{VG>JgjYu5c9sJRF3+>r`g0-Y&obHM(b+j5GmfjfgfrS~^x zPS%DpVgBQLX7^|ol-KQ70uvvkv{=~Zx2?NL@~obO`^x5Nqqnh+zGY^xF{ZEe@8-Ps zS~?{Bz*9%*qA`sw=jx3c=I8dd09}F{pP0s6`tw?LUizuWJSPitm#S=goF@^r00}(a z2sPjzR%(Bb zPy_y9rS|s-HQ;T8`iGR--y_t3-y_ujtknJjw$p$7cx zEww)-)PR4zrS_+U8t|{T)c%xE1O74A?ax?he@dtUf0uRpuPwDdCDefbantutTWWvG zQ3L)TvTna6)PR4zrS_Xbt$>Zzx#l$z?Yc8@e-SeMmny;P)7ISgrNCm@#Xf`xsp&^KdErU zrk9cv_>59}Q~pGu(h2(Id9<_fo3MnlH^s!fO!o2~eM60{P(3L}D9mE4c*sr40K@OLB`*M2N=dHf~pagvwd&*lPB) zo~rp{jBZsj*Qv_46VcSc9~@sxb)Q#$u$!>W769(5s~FT!g%>3iy#92Q8IfjvCiv!x zkDyu$_G_qdwP%!Uj0<0546KQ|iw?Ox2A$v+#OvUr<$O91{C@7H5)R#7!IQ%4o&3kq zIu0;#(%D7z8Rq@G`wu3o0H%5OXSmiTGFje@D0=7+HwEJ`Snv#qII^Y9%+>p((m|NR zKfezQ)sXeSY~dd3A%iy~`?9MkbzJ*>X-=2%=Sy=+J>uY{Ih@BoEzNMXFdEcE3E&f!P>ogLs@;>YVd{z&jH^p&Npj7UWUd4=bS^L{A_i>`L{af zkF^H&@3jVzU)35`r@^&`&p)d*u(iR8I^F}<8kQPFWL2l`Y7NYnZ#(mDYYoUwx2=ZN zyH*4G&sz;_@!O5{ffr11&bO@w5^$>lh;~8E%kn_FP(3AtNH2{8AYq0#i zS_9IzS_8ptt>IU#hJ!FA^WSPU0Mn;8?`jQioLtdwYYoEST7&j&t%3W~)05C|wFbFg z*BZ8dR%;0SMXjNiza)|e0B$w(LEg3+$iB52nqGjT)3dH0PECA|PJw?SJN@q|x8H}{ zfZ(aQzn^mZeaH>?e?qzaKI8`cqm-Mtuzg@4GRktnIsBu(DzkR6Y|Rh474^V8q<8ZS zl~4u^vo&oRTqpGMJ5gUuJKN>y_$R@ar9A4?U5rlKh}TyKGERGlBijj3xgJv_n53DR zX=dPSl2HQ>4^xN3g9n4R_ZVF|Yu&rY7CpFwhRenoUNXecQ5ab9dmyGg0k4g^JEX41 z#!q;0k+*-zBn)^rLi2uEuoJyfhFXg)-eFG);9%|~iu!W4t7vfOLZ?5vC69Zb)Y0m= zfVRwwE{wUrnIdQ`pnXsh#hl^sG`>0q)m0d8SOXu>7sHdciJvC3B@|g>##(Z`EC#c% z>yU@Ba_vb98w`B7droU1L&njo{z(NpShLtGK7vN#wBHGls7M7NDTMuPp1pG^cU-V@iGIxWHE_p(z42`=;6xl5yqa z@A=E5b2Z(&VA-K#ce(TGKfq9x8FNi54moo86edt56yp^dLq{`$*(H0 z1I+f}vys|KZ|j%z9`FfCi=iW4cEhtBFw1oE$<%7b$<%G$-wT3~Y^=rly%P?%7aU0U z#bVj2Z^SU9&!&`D44w6dC{Ny507UvXjZR`iBv!;G8(REus4rCKy#05X}+DFEwnFO?>lR5K&whR`n zp=&;3??PhdoTVu5rH(kTLB@U-7q4E~QM>Ik@MU?WS>Jxj2oxazLv3hH9?Rgd$|uyA z=u`5}Mu*jVjtbn?H}q|V<~rR@Z&kTB7tPVi+zU%WGr6s?3+i;{$T_CvSR(}lKH{eD zk`rodH^i&MO^QPV+%C=8v6WEE0#(YFbg<&&E;g4Q%tab{$>OPCZ=f}J^nBu{IHAh{ z%1tgxA?!%X!ciE^i3I6UPzZ3x+gf17%}{r{aTq=#{u91i#}IgnJ#cA%A;s z(U-er;ain=+iOVH5gGY$SvW<*>b4P1Xy9Qga|1U>@v(&!>#o%>oG+pJ%B35dN zy)CS|nj{5^)_J9olcJ3OENnw#ctKIFkkV za_A3l&MUK0pSq4>sMAMQZ29NX9rTbXk5eS4;Oec%D}@a02umNic%M?6H01AcB27-Z z8(40`xz<2r)79cInsDLlLvKrxh0~^owY;^Ynq2|kegNJcfADPmm*Wp4c;Mp?#>qb& zf6%4gwC-LWaqma_y{Wo{X7E(q+7DB8V(vjdo2r|?`T0~`0XBH5?xzAP@PBTw{!n1O zQ7gC|D|vwbZBbYl@^TPv$+Y8gyy;mCt?z~KKzrLyVv66(J#!7(TwUXlRYbA8IYbAm|TPu0@%e9j4V4Otj0w0*uxfDvBo99^qD#qEg}|*D?q{w>QmjT| zg7y?dBN9Pqs$S79iT0I`j6eOxSV@qc|FzQE%7_D@4!{0R^=V`6(U#g#hYVa#2TBlc z7K0%E$lX{8)(>MPz+c{)`nPK(Ka7=N`TkeuALLbkdHw+#_#5XRP!s=e&Odw}f8q}O z?eh<%9lt*RV6C_eKL6mR_Wk@rKl|HI@3@b>(J+}0mI|8NPMbwkshwpQ0Z z4f7d4P7S%?4_o4t`uMyP)5y(u7s}%#ZDQ%=$Oan@rFW(!+1le?W-$eHSo_3%Tz`O$g%Qg{uNm$Aog1 z(cL7=1E!2zFT}bOnd8QAl0$R4IpTbZTs=5Iiw*!57_+KRE^welK7cS#I2AdUQDkAJ zrhyC3{ADooj5v>d<(rS*fp1u+M0a9*pxMY#^EvU%BaCY=!N<1Xn%=^!H^@v$jl^sx zlH{JNyp*98tpBKkD9Daw@=5vfJ&87F?oed8G|b*~90LUGKqBF+HZu+Qazi_Y3jXS| z$6XRpOr|lL8Qg8yJOn#UN_GmYsX?E`=?5ILGs!TtEj?QS1BTcO%LkfZmBx?2Tm-?8 zn)u1dv!PfY$42md_@s$hB1KDF$dt_Y6IGK8Uf+-B7GSpeol&}e8IAeV=j)Pz5 ztlHEI@9tLa$V`_-=>%w2G+~KrbGBN52(19vz{{CHp5FIkm~k}kJ7C$rErJleG?35o zOy4}VPhxRqd58OsdS=&_l2b{&rv!qhd?i4~)M6FdrW~Fdi{Q%|&(ipaa|OmpoQ?*Sg1q5tdy3|RqL$ZGYy{l9-)Nd~^x=))y}-c~w#zgerbt--y4w5f z9PCobqo4$7@c$pkl9(TCicNt{F|P>y<4bqRUa%=fAK$P31rq($KGrL-E?e<36v+M6 z15G`!DdzS*IF-wTj#$oV#Ve}CB%*(L!x7%lZ8_6reABM)S(#R0ZQRUxn9gptdSiaZ zyvn+{gOva`tsJ~t7nuafjFrOY<)nfz1JBW(@Z*N8X^_ZM04^5#1FhDyR-)9YzD2{? zuJy1r@UL*;W;jTe2Ji@>()Vj-^%e63>w$L;$dd*@3f#te>W|7C6OrMIKpp_TYDI!q z5wyrG>$_rm1M5#SQ`aUt<8Y6#V(g1tB>`R&iLv9#sK0ImX2> z1;)xQ6ObirQ*g~%Vlm0fDys*doF(C?WdC7UR2D6?HNpi| z8ytyHR&FCp8M73Os-=$)NWHk`z53d{c{ASKWYMtk0G}IT3^D@I%K_qY4SGpp;<9~; zj#{-%gk}qo z690hjjibp)uDg{;Sx+uQ+R%&0im)?YW92r3wTKfH^?6t9D2pOgdm zm5RMWdNs}uY{KX}#~n~BrC;$xIMObz^MBqmAkq-zgTh)(7doZGGl1}6Dy-<ge|w^!X)KtpoiKMQVb%oNVU!j#~Tt-X3~ z>CR|Hr9d*YHGI2Vx2}3rDAnV7Q5`Q$m0@zyFDX|khgmViFb-QBG*1m0GIcr5=}Q82 zF~{qQx0S=CmWMVyH#layA2LU_w4rX|BS&v&V%&GxcP>7FN$ezye z3tvAoS|PqECLG>hgu~%!|E!&6{_qOw**eHIO~b`eSj|2z-F)sXDDnk>0EpgG*bS_H zi87a&L_LASKofq>&`fDiTH{m85IaX&zF3?qA~+Ff4IFP%9$jrnMB{ zP6qM$eNKxtl1Vxn;p zm~)=e?hGYJ4SxOk>eDN`-J{a_4jDjC7fN|O)U|gIQh~~g!v+IM1!zOJ^;qoB&9fQ~ zN2T)_Hy=`jGFhRjg514u-%rJ(*`Zv$^ki+1_|U&Ym}g|mpgxPNTRY}`U81~A{a};W zSs8@Qs@87N{gCE_EYUxEN18j;*GdPa57Dl`YYhQux+BYCxw?-#X5P4PcJ}MDEdLkO zF|or=`9MHPseN@YW?<-v0YjE1UHd&S&abEYwiMGKg-AxuiYkMPsy2HmDsKyGquuzf zcUdE#VtwO_^iB(;9|OSP{-`ua1YS|&pCZJ`VC*@wkCCr6_UcPKP5r0 zQy4cXq({F6weSLPq2nerK*T@*_H&vVLLv%5NW=?oULc{JM_q!n)o1W^DcDNL+9Y%4 zd-BTE)-2zJ!e6Bmfd4@!aCb(P$NZoZUZfzx2qDqO!GZTML=VjTU)D-J0H6OnygmO( z&nB!7L{yz2136zW!P$q-C?C2mUHAB*vuf`1!b}N~<4EG6NAV4Cd2H^e7m2>EQ_Xsy z4Ecr12adupXojn2{!D}hm{YM}g!8O|0J`4DVy%)tAA?u!pcpImXb6qj4J2y;U<59{ z_px7~up~F@a~wogx}t8Nz$Dgw!2nB~1kYkeeZ3n&kFT`eGn3%H7ZqUak0CYqmsaf3G9qiaIAzJP&iy%c1fD{r5bWI76 z1NUbuRAx5Q${xrIOsa`%ysGh;&|x6&-918k`sre?0a4GTT!Oq2d{Z-Lj(W*KMJSO< zTV+J0a~XV8b8Or9++4sKUxCLCal|q!7+NIQ`GE#+*T?eM&?lEUlY%g=imWI~aGjY6 z@ogJsZ3T~t%G5#+sDa}c7B*?dHue6ohtIhuqK+CFx7q+x=A|q>)x}@gx2|%>)$z{2 zZo{ACGuw#;b@+AG|;z})x4)Vx*eQw zd_TQPvAO`8T=w8IF*1QUkUsc3F>PUh_kk}pX@KFzcxfDo!|3S+xdP`PFEs!e!Z2!A z$kcJa{P+ND9H>+ctO<&A8F8d~k7hRABsE&52sLC$V4FWaDsDf)yDtPQdaZf3I$z<#qyE)zjd!|ulIG%I>SmJvne zf=W|{!dQhKR?_g3-hn3WgxNT`{;^~Y6#{Mv2sNfCNcQ7FfFG)sf)7n7S*!hGTAsi) z=aqoR&YP}~*DV>)!~_tV5R$MhHvABtqJsifA2JQddC?6B)rNQ?aKJnFxZHlZdTVJt zFbOoi8^AMVoqB~J{EE<2EGt~n#O+cha49gsH9TmfQWMKJb$#dok-{XE?R7WQI-hGr zO^N*sC0XS1B4*m>_ayKlGmUuW`Y~>LN>?%Rr<$y%jGVg%>(4TZN?YBJwwOP6%P&qQ zT5k9c@OC6oVhbs~Z!_DiZXX!2{?H@ExEQgbehHMxi#6fHN-uJ;ELe4T2v@IqBW%_? znYHP5v)L9gkG|86SG;yK|D;I|`n8uzdwSwQpr@efCk%b4?np-B^Ijd?eGE?LB|2R+ zhn`5{YMmjD1renPTv-TE`C8#UduwHZdwFxv$SS@I*{}3RgG5T_3MdJa5o%yvIa<%p zIhcX^L$_{65e zJPjuav1*SU*h~S5xgOiLA|4Q+1u_Q(Z{Rx$I7uyuT#wRF)KQi8^Mb2wDeofJOEu|= zfO}%GpO|_Lqq-l3BQb;*H@K<@*5}LiMJ!qc&XE`Do4jt!U`6B^OsDEghp*KA7_{Cv zqHMRv*pnvbAp$f%*UiPZb)c^~w2fg%0)(+v`@+|cd3|iMdVRpMme_6Exs}mgaZI1p z?lP;iajo%Wsw!b`2ikch;`V})L2po0z8QZmapK-))ZXR`jd0Re6RNW6AbfEEzStKW zh4khFSA1@ah*h*M?T|%=X`P!w>G>EhD}0nUG)qMBrxBVM62mn9=xmHN&N@NM*GVa2 zYBzlZ=Zhb39!Zf2CiTFA`l7+IV^6BO#3usLPQo!r$eyjpX}-)(Ak$p3uPJ-wNe^bm z4lxMMZ0L)v3~wQ(&YL2UUhUk(6oO_p3+y~$jWer&bI{T`x7r&s@1BMFDyu=&PESA;^1H+eWc;&T?#$D`L!^uYXg-nFO(*aAMxwyIN*0g+_&vLykAHo8ymEupJToKuDNmIND>gRY zXCkQYG1aMici%QY0r(`+HdZp6asOS%uiKRQlWQ_j3RXU<5-ww&Bev1ji&~cUSwdLq z?07oGHOtmqw`q<5!Np!gNzzzrTAM<>#yBjYjg7#kTN*p#l@FkKaIF>9*n`Gw!jmE? zm~~{ExNM&*uHnIOySRY{BmlU;+eC^w{AG@}gl>I3IeBPNsF5*mQ|yZ<^)iF)uli8v zOJzho2kRu$prpEvwcGPYjCfw}5-3C<#B#>iMNB=Uq(#BY3zg9HaiD-gU&HZW~ktM!2%&0qAaKGP!ScL3^

    RvpP5{*{+1&!akRfq>X_js+ChtVUUN8pHCGj*f}ft zine_fe1J&)OCufUx^;!BPp;N90@Gw^o23Ed7{-YmL`5AVS>DG*#LYG)$Je3S)GwQB z+#xyjrVe{PM`?fybp$2(A1N2PnfRkZxw4)jO`>$oZ0en$#D-*ked@qrr=JT=LhxWy z^8mEx2*81Q*bgEO1>i7c#1wn?zg7S=_jJNudMp()a8dDs(;j}IvWdyH{m)iBri{g%u|WW~(RDJzqH4xN`}4#OSViI70_ctPQjWP_ zX}!kJ~0 z@L`~&s|4=Y0v~P&9kYU_MRw;jV>&_etmWB`&yW~w!x`c!>mk7xa?>?;P^dG233wVc zz1Afjbcs9yhGmMx4Rtxvb2^YKQB3rCUNBV~vEtLkG&$s(PZTXaAiSO^jO>cnxUqZK z0Y3TDcYE>&nRy^J4T%bT@@F2#9tWP^%Rv6xfS43}=m9&a-U|;Mc&pR}E1PGdEP16c zpL(C;%SX&0*m2=EKG(Nm&|>qDS z{o14Ofc;sF+o_2~R=h6jeiq-}Ms+hNE6zQFL0$DysVZyW{U+BUQ~TUOp?V?q5v`fmHnvOBI}TA0Bf%R<}QhXM=4Or0`T zzk&l4TKxty>t+PDL3cg#r2DQ_5HU>i2=VQ*aqh50IG+gb&r!NRk$xg2)%}b!KBeOv zCi>Q4Frp+8>0N$EuGHgi_3`@xsP`=Tj@EKc6bddjV%S^Wgc0+%{lYW!uD#o9a}x;9 zz@tz`?;K8f!J|-)GeDL_h5BX_qpwV~AEggf`Gv^igqwTWirG5o-GC$j-KISvOHxg26=58Co1pBmCO0c@Hp4ahM_K-j>A2~Z-PRQ z8^ZGd@(Y>8wf;6H2F-E?@7oQIxHe;V7Gn#APJu}51q7?=i4@&*&5Jlo+hve zXYBEC?Ts4fg@FHg$&{7|htV3zf@tf5#5qiH%TfXp|L5D{sy=7__}w3ExQki0>mZB= zpGni@S;~)8pJNG2mk`Pw5)9c1>Ri6MZIZp=v|f)X3v4v(8C4CkegsNe?Lq5JF_} zT_$nhVF+&b9JTJT+Tm$ z3_#oGC&PnvNsBz0U2YsMYT(Xz!zDe!y8A2uZwtEikT4?zZk|m+@FO?#uA6a8UgsabRAk zIszsNIbC&_vh%&m8xN!qP8N4)>(A9bkKBA7B38hKoD<~-rI-Q;fog@07`_e>JcZH- ziEs3)SNvlyP-H|DkI4z-glirc!`3Ma+WQAsepIObqG?PZ^_h8cXXmt7p`8<>ug{cc zqWRwRbe*Ocyl9tOIY^;6P9KU@j;^fqy&8P^P<&Ymcw}seI3!*^L*$0DJ>Gyk-$ZF9Dze-W|AJ=TX%;*(By~ z*J)l-rhF!QJJ`g_A5Aj7a=FnU7#lz4#Z}x+tQ6j!f-`i?DNoXA70Ij%&;H>Z|Gjfr zCqdK#D?=A0nC8){j`Y5N z#kKl)X}gj%cmVhyqVt14!b1!5a+94}G8Ri|aK0h$(n0f(_k3)Uj!NIi_z}&@*W%FV z4j+tX;Yeud5CK<$sRBrKP4fff>?hH9Td!sz<_B4EpeU(hYjC)?l{87Eqz}_%q#e8v zL>H4RHu6~D6z0%$ypMV3A#rO{*n<6Jy5a6%V*EJ zmCGi&8kKdm-XyTV6GI0)eO^)vf{qyU!{NfXagxM(U0`ptqu6>;y$as~S(z*01R4mY zw%oE6!;mRljO z5C9tyDaY!emQ$$IsTe)~(jMqNCHQp-YuB5L+DTE_^7-kPM0=6c<8aA4>f;*W`rf-P zQ%kEI#YtyC(ia1XN%SKg6LemA>Y@0-jK(ri@NRkj{iBddx0QatR@UL%wTEx!wr3dg zEcMQzocg`|v@M#fBB5tO7Nwx5Psir~iv25R9oVvlnXIUVkf0nzYYf}^LQUeqm=fxZ z!jE6nFyJ>Gg|Dj8*k9)paKUa=D|C93bn^Jp5*mJ;k?MMMJ!X*(#YdGGNabfR`t+&3 z1M9Lfs_G0)mrHE(CS3K~;R+7zb}3f^i{5h`Y{%t$+n}!k033iJ+2=<#($CaOK>A?- zG{|+3t}_4w2dQyrq7Qb#0Ly`%duhfvl(j%>OY#fJSM( zOAtb~f1M!sbo^$5uwZkD*Esj2+*LuO?#Qs7l1e)XqU?yVIc(=rK+7i5ReUgJ!qs&y)M<_pyN2)q*DEskyOt_T~(8#IL* zQ64Aq*zU~+eejA#CD-C`s3>50D=+e_%o*1!$?)mjfMhuME{rK)Ma=TTINy8?TKYZf zNES?b=(0%*zEi~~9x(5A!Z;$nEUhV}sK~tlY-` zk$5TR=<$7XH^cS_iIAJXhb}@rse`trm)h**GV>7Ro&$u=te%RXgH8ACHylHWm<+Jb z<%ec1S8a^agQfMQbzb3*n)kRtE)m{a9(4A7+8X+*6exhCk8|D87vZ0%ow&`0mC4%3c)6 zm>-D1^Nj@pR(nq~l@O2$QBj88E3Q|47QTU1(JnonLEmjDtUqdm5=X;fc@Bx%@A!rt zI=y!2Ipg}LtjCY4G8`PqFj!r4SG{-j-2t6KZq&eit3{vZ=K1Ev9w7EVuNG7i-n}3 z(oDCg^1%HsV_i=n-^2uf_P<=4f}YU$I++Lv$U>5g}TJ zX*K-=zTp%U{>(z9k^&+S3KxJFQVQhd4|oB*GGcgmMm@5cy=v)$$c6ghB?ZuNFM~?* z;bX6Ub$b<`I`%>$AEjN$Kx$zdX3C0<4t?S|WeHr_`|qI}lk_~U@Ddo;+xb7RWLAT<~m4Pzk|pSoNyLcf1s9etxK}^k8w8-{xIKsL-ekC%qlg6F_c?->^{ZGFy}h!s!h&PRHxxbukFHAl zFn*jHf%%AYK4IA^92!G$024GC1Rx-$J>Jyt^(F}GWi&Z>ef`_f0GrTHiNM6nkBLBd zYS=Is93b(^R5VY@sN~Nf&#V%?nXM9q?GZc#qotnQS;#pL;hcmvy_-NXN&q4xOS(|` z%RY=L%pP&|EF@Zxtt0>g*j)Jf_CB#V?3xeqZbqI%ggIv?q2f*kTf%~8WOz_2T<7~ctOAu3W z6rfmhpPomY{E`%l=*x-s+on(1U#vW{&hE7;s+F34Hn6*TcRYVoH94Kn=|*TJegO?a zVFgH&{`0W^f9zp@Zz9g0Ua|M7un8)2H2&h#%$&(y^r-s_ZAOO~R$J1FZpBf=p9zsT z;g9Pzt<%KJpI*#K0C&);h|eqs7KX}Pnx&hCTBI%SQ~HIw|Dg|R5St7@QsKPcm;W7k zsy1d~en^jV6*3pSk3DITF~r71;3TZ#rEx)IPDKHM+{cT!2ty`^RLC+Ertqx~SKG-# z&nIZqNU=Uy2dp9Ruo+qiBejn)YGNmD0uQi|!DYfr-Ew z#WY~2)JsYlB`vN!L6a7|0*ejwM4tp8DV9-*Q|-Ev%ceNFT@SOXPMLY2SxIvjn8Y;Q z;-e5Aw$Mg)P30kT7gfpAQWA)>?E8UNhQC}#!?FkPeat&2b4 zOpZ9gndJn3nl}K45y2eh>LehGMZ+i8e35%zo~R|~U5;}B2AX4!(^GK z#ZCQ|%NxR*$*3I?Aq8?Uzz`2kCsx|~4QWbs#6%bhqnST(;AJ}15hNrS+8oxk%d(hl z#c$f?OE;)SV_pxr-{Mz-EykO}wfP%-!(OaK94?$i-^Jw#FKXc^46NlcDLu^E9gorrmt;$7OnzP#XY#GPpx$op6yns0#PCTFb8&t8?4Bjw(H<5n(_w z14o!kXfz_lHy<}#)L;GxHzW-8MDQFozhjY%5%-N^ehFz|^~_MVN9=IrY!pGniJ{Uh zIjXf$&sfBLSqk?2onkRfeZhh7ro6pbiT~tlJk`$rK1bW4k|I$hTy?Fw_ zx^)j&|5wvMc^Zx#j*t?=bYN{nN1YVh6k(n8It;Qzf#bPC!-U+* zJMW{k98ry!+s=7Z*XZdJWCY+X`@lh%^AgY+_(o|_wW8Vi)k5XS`R7StsE)NE-0R_i(}R{T zq___%rv_j^e>`sh@g)EVnHL=DllL)cLDVHDcvs@3PKrf3 z6Y`%64_LWthzR2H{Pj90VF!>@+S$$yg|X+_le+3S{^!mXJwF7 z3n_IO&-dBvGMj#V{A^0iCYg;+2XQ{Ra=LG^M-T(l7T0iJb^P1YzT@=2e%hOnfV_nP zhGj+lOv}CM|uaLRLjfEdW zD_{cKoJOT}ILcUy0zhxOpANmTzp>&uUr27m6I-L~b+;Duu`!ET=a}hS zvsb)cEFHRew>n-i(4wj$0nG+c%kU$Si56$qX0XBbjmQMb-eiS)Ouify+IE1*{>ERN z4#KvCgBD}~BtZUH&~s(d0NSi|m?ZzewR6kR=giKz3x=eJMN=>t>vb$`63UK!Y)6K5 zxx7CR7QHb|bUD#B0ki|>pTH3bng|RSyX+-2)+(3%DI%fyn*7U%q(~&ZWWu{sd9FS( zR+eFB+%`W!m!MH&fD}S(V+l1u zy6U8T&;xf6iabCEvKVA55B|65()ALeqO05@3b$Aze*5zY5T{jbLkHzc&k*M1-xd-9-MG{^2jhgZHs z>ZyR0iNb&(qcS1_dgGX1hYno*>j|P_O7Zu@`sM1LOGbV9GV36~(^A z4g@*{c2Mx_G+wDoESZ8puu*9WpfgU|3`M9Dxp~L)O4MAGlIj&!dRGnGny;3qKq}E7 zqtOZTyKX9+d3aU!4y+P~^k$mL`phJ5h8RS)fHe#C-CF%sPtoy+7>_62(GhgQvqJP3 zBgxCli7%Du8dNm`qTYRa&BNnq2^tXxFroeqlgRjInMBZYZ2&v)jym*v^aFK>Fb1X$ z<2c>_l{#d?>9SfFT_ofnlQC*YcDG-e&mQ1_bJ#!DlRX36p6()LfiimWmPF*0re+Zi z&*z?jIqDcoIAy}GQqbW|4vx}N*cv#!eJ|Zbxy6c-=l2N7l^=p4|*sGAjJHg zrb2iufCzZ&^9SqJwar1zKCnFW_H*vPJ;h}#X=+&bd=}Z%f!d2TYFTYEvN_4DeWOJS zIg{@&29fz;-i$~vUlqmpdj@bnfhsOE$B34%sT|#CGGyC<@`0;uxia|dDn+6MOGmqk z@NH?816*2lC_sU`urF&PtZO)cRf{+5$jt;!L!U^{XQ!9cw9uC!QuhkZrAO@O4{b`D zb{mk}4OHWbrNen)DKp|ocMJ)w4H0Rc(Zn86^v^`?Vvmq3v7{Xd6)(9Y+BD`DIj2U< z!n+8^w;{L~zTaQ7%3h{I)Wh2y7%T~fB`q0KM=Mu?L!5|_O#f(=EflxB55B`idAh)d znS8*mK_jG8V(B06Q@+er4zWo($pta16(6be)h57UIi6dhiyosv_gNDJKBJ|pk#lcR zenl>#n(~Vn8&Cv4;IS~wx9+j6G#g4KFRC-k*J~*>P)tv=&fJ$}mra zct)?uQ7}zGc6D6yO0nizzHh3y~(*g6p3e;QA+ou>b7A0SP$~sFe+X4x}v^w)7qx zPujJnaa}vC_TrrlgN8#*5~2^tnx+fg^$S^($?K=GX|*f(=-NDLb7=9nb4%>uY6-Vo zmf^*yzKiAz3n3R=t4W9*(&AHV^n(y_&#HBT#^V#ai72FfnEqg3uv3f+58pbEiMpE( zhBQVNn4txSL|>{@uL=9vf&4bCX;gwrGQh)P@Un*!w5(K&?T3-x+@X2lht{nN<`B;+MC@< z$}n@?i;Zv(AIwLn^!1JN^_KkE1S)@sF!5gIsRKmthFXFQ}|~E%n$^{2Q&7e;eLIRgdD zfF0t-cfb^uo-o%{I5>wdyH#m(G3)|WBV=Lm@~NQ=+?`+2Nzs=Z=p1FY=?{VOlSdZe zGNXt^h0hjg^jIUARxpXnwcc8=Km>2^+_#tIcNG@KlajaVhRPHU%*e*lBvx3BpB$li(AqHxSCAEC3HTY}9c2g*O&nuB zm*Qx+BZNd)S$i0yt2yQ$njWD9#`DcIoltDQ*+@knlyZ4#ZkX$(0(N3tUfxuKB8|Z5 z1OMaIn=4SO4LE%m9w)kS1C?YDKl~Fv{KFOgHdpvh{P5qz z4~yeO|HKdf#1H?(5C6mu|HKd9NXCEShhI-9{1ZR?6F>a_G=6B#6F4d_#bw|&OS#>G zxC_Dx zsb;f6X{M-tYIBmOvizdW>Fu~N8p~Z4FZGP00(F4n6DKBcJXT$O7>3evVZWVA`;|}0 zWHYj+ogX37^|&7yNgdTp0Egz_c3rf4>wSF4H~vCw>nPgm#XU4__g<6f3m!&;t|I|Y z9+p*1tK>jW6uQ!*c<+IfqX61aO^%?-C~(^FhJ04UCsXPUJOI}s13=xXI*q~pI?9iY zdu-T6ckOtXS-KZC>;qCvMkbiXm*qh(izygbRgfMd?1PBsMsyPiuL9q6fCr$KDRtS= zaL<&9<)purA|pm{`dRdoHIGIT5RS9jb3zq=-HGHp{9i5 z<&tRlmYCgAu~4#rG$%Nwu$@LlRgK3P&CNt`!;&ZZHRVGqcS zzd%jQ)O00Bglu#lWa0Sl=$M>vlD~3m?ejlvi$y$i&e2qJP+IpJ%UB!HdiaKbqi8AS5O|cw70hpr;hUqchkP;gSJ6} z_5ch<_rkNR-ILDlIWjWz`&_`+sBmu)LH55Xnan z2>}6#my{BakOl>5q>)BS!Jt9u7Wh5S3o7n$?>%RqGw1xiYt28d87G{X<;eZs_w~6h z@rNQh6KW0kfh>N#eR%PMr6buEc&K+c>6+r+@b8U(Hh&r%3X5{UNlJ{~mGo7dpz2}} zLNrVvQZ|*m$Mluk)KW<DA$+Hs+e$jwrx(EUn{Omx#7Vr=*FQCfbdW@(=MQUFFH1;AOFB&0H5*#a^H3q z`QCh}Xf!wd2ukMJJ(#@<$Vft)#?`BuTDlj0T9p2JJHp@)@yK6gM_}cK+Yz4f{ik+> z;PR>N7zB09_x%!o#*q*UdnbcV{?F|QjAA(jM7F<<94vDYzudOkR`#$v5)|!ot&@zm zCAzbBg$Zf!=4OoY+tlY5%7^7-oIDTC5bPfE7b0uH8t$O;AOTjeb7A2BRIX!-SWb2} z)nOiW^PF!b551UgqbygSsra^AjOX_FMJ6+oW<@Zr?F?KqF1YeKRq|T;X;)I-?f;f5 ziS&=Mr1;fY-;Z*z4{_-1S39}RrGV+>MKHZA+{WtZBlvU*OfQpknKA7kJQUdt@eMM% zPBRj8uX)oQwk!vt1l98{ywl8D*VOfvdH$RX2__^Dq6Gg14H7M^T^?QHir`upwip%j zAr1Ew%0*A^rsP$((bwF!k)wCmJm2;0$mn-xuRkxGfC+1%%V@9=>@CIKy`ycJe(lm^ zpXk&}wC>=dSj1FS8VzdcRamBEY)96e8^O!EqK}$;-BIf$U*E`e+b(oQtyC`56Y<5V zP2N&X?4JoF_IQd%&=IvNkxfda<_{}n0)-yZR&<&1(dH@%xP_cImAgxV`DYa1MkaIB zBIgG_T9TGVs25#AJNy+<(@*RRMi#e58coh$>d0xDMJX-FX==!S)PKN56B2HW_xSnq zn^+sUI5CI$f=GC!XUDfEOudQTN2O~s;Ii0t5f*{h>j+LwJ0WCagCRo$So) z({FXKFNx?hg5dP==*giJ^?vSZ`u(?%NC6Hlt|a2#qgGzW)m+6~`(T4Ja)p?_e1s~2Nb5VjEbLCq5({b6q+)B%9qIMglqxj5YB`*m^XCxEII-?nQW>@rpc zP7W9Dut1YT*^LO^7Q^(}-%bvVUFiP(40Z|jLa$U&<*CJ48GrhGd>9( zR|9%VYn(SjMPs*{Iu3%eE;8&testxcu7AmWJ;qetrY5e{XF7MEm*CL4wNtv?`S$ji zagufCOey7pq2J=7-t%;n$1?84s=2;;y*DU^YwZo0U-JniJQ-23Q&4dPFWGMnvGfLZ zrel*tTH67+V~6O}cPb6cafMejh{jPZdTzT!w$`qBX(? z`{^rrq{2j`(Ju&tHbBBUrw8RICI9(0Kjgo;$VV}0f)@D_xz7LLBA+BiOYW;4x>9*B zv;IHs@;U#rJ-*x}o9K28<7}YulJJ3=A(0^xP4wj#!#7zYm+RK~?oGoS7{IMP z4E9DA{n~Y{?3(Ti!xb&#&$bg4P3)$6hVeC5y5)>IQ>ZC!UvbwRYjiS8+^IMBIa|_& z@e%nZmi5%71bd+uFyA5F{@Npodh*O<*ix98ER@#dT#Gz@fkNfhPua}h*6AUy z2FKqo5qyt?;Ez>0J1ZtDICkExL9fLRH!E2(pJi_l)-5)zRA6Xu+psNPTxf5EuCEovS*)EMjj8>Tk~PNvmm^?Pg)0KXF|WK ze8`^GV;^h*dqB5vX^oOu{87k1p>hU0AImf;a<;S^WT05W9)#PCV1f?l(ufMM+uG=ah<{je zorRn^%k#K@Z@K=Dwp>KOA+R;!+OABAPU20|n$Lx2k#fL^5o(rbg@u7Qof{nICKO*~ zgjl5lGf(ao(x;>ol985SjOpmSZod8L-REemuP9e3K4EI|^@hvdshG>^z|0hVlU7My z3mIfclzA?{R_b46G7V8OkB~#*w79zi8f0)FgG_^+Q!8kY0l1u!X2wb&g^XtBkZXZT zA5#0%>Ji={;cIPgTFQSczwfB&Mx89bDZVeid6IJN?>07Gt0S33M4PZ4PhCGRMdH51 zpK?9CwOF4iX5aEv?GD&E@Nc~EewIGXu@fPti5h<%AMTj*Y>0*&a{wfn>r2gp%VnC-cA-k;1E=Wm%YwI9sbTkdf4 z(7-%@;eumk3@C%3u~G;cd%1oV20~+C((0HQtALm>43HU1fS9qWjm%P$A|&1!9R<5T zFk|sQnK8DM)lirL(>z4f0*y97hu@7hw-_e(?s!}#8%P6< zHu!L(4gAYzd8&1quE+Rf+kAJ^?_Ll|$rgX;Rnp!)DnP~CWZyN)gr{=v@+oVMpe({>6G>jH4vJ_Db&(-b1_ zfYWyT<7qn~IBoyOWxGop&&jf#@YiYk;Gu4gFFuSa4xI+bN1+JN$iuv{qj)w(q+qe^ zMc)UW{nVrT%!p_RSl z!`7z_@D$4Zj-ll*=YKTJYE3yC5K|2rcG0H-?-f+E7;%xWS0OUf1~^K_J@_&nQUE3k zEYmhJ#S}7D$rfB!Nx@%+w-m^Z?sAJS>Yd6jmQU z?^O}U0g0!CJ3i#f5pgHNorP=Fb`xq4#f}A&E!d*i{6Vp6f*#%lLH=V8Z&rm_w-o5x zn}K|L7lp>x9~lIC@>;i_-SsnT7Lwq9INn_kj_5U@5xqp7&<+ZK@?FGd$dgb=2tX#j z{kNquEUyr+(#pQHUy@L@uun^Rg;{=ldRpCrr_Q{L@G+Vp~=>rfH(X4dt68cI&AbzYhhs~;Ai41$DfHmgP)1}z|X|k zgfHWeLB{?v3&_}WtAUI?CCJ$4LyWz&7%ja8=CO`i@n>uwKxT?pGkYznz~Z#tUmy>tcq^Fl&|uUD;B=NF~!CxSx0BJjcci zE&DPNzc2fqLCZeopUXa0__FVCIZ32o=&G(#YGAplkG1pIx86W1EAhZJ)BL&fP4^!v z`L9OBlOI89C>%=(9sp>DUSg+ zdD-=kF*Cd!+MM9PKHiah`RKu@?I;A{Gk=HhEkFpr(S;4|JA)qvGWegqGx%~=M+?Uc zz6PAZ4?o4=r`J{-M5P12eg>xoA$&Io!gqoo{L$|azQPX(-yB*Qx_w_6W*n~!Tcjob zab=itxCbZ#d7!OGU#*w#hpp&v1#yJ~v=zyD6N9#*eEHkJboE(Ki+nk+7s#F5n+QYoI(UGRILb3hr zFT{w=z1QrYJ_t@jN?d@MhW8g}Wq&Ap)$>ABTmSy9>HbU3pdQ`%D zbB@nJ{JRuc4iXqKS0%Z4DfH4vrBn1Q6@C@qM9KMh#xdUdnjGt}B#wz=uE4#DhrNqf z4}s(BgyG}s1bEmByiV9F>VaP;7;aVNy4=&z06ob?pus3W1}y@KQMUvS6c{N(0wZ1M zI$;SE7+qnwJzFM(mFOox4&5dMsg0FsAKxaNXON`zXgmLzrO(-Zj2Pz%s0!f50WC($ zrA?kGWbS}#s;!y$8b|}+|=sF>EcMu!t^wfQB1tGL~P~pcaP+Iih1_l-I^sEbnQ~RK1gej*N&+$ z)P#Qj8*LEx2FzSo=o2FwiLS@>4%i!iQ9;_a0s6-UgsCrC2rj#{tjUvRYY3>(-9MOf zWXK@&xU1pEr9Z>JUw^=9o^AnSaY82sKRqaWgL-Kqts-s2jWeBaSJA*oC+I3-+k#w0 zI18HUL?vfTKb>+FjbTGq8w+2nty}lcs=}`}QVy~3Gp)pA$f^-|U6Z-5OkE0?|7O|3 z_KIZov>(|=t)x_fN8Ny)2)g@NffPosf~qcF1OgsEvH&kX*iSA$96l+#LJlJg`zZde zpu;HgGv{#Z8^~d#Q&8X>^N<+Q8+1c@1AFcQ@AtJjL9RZW0>v3)37{LZB21SUjaW%h@Ayf{`uEt|kQq4-uqF`K&MeSmsM2+_# zUzT^SX!XTlND7bM)nO%iJb1C!tpxe8G@Eo&BD>b76^V0ve3zm;1h;mzx&3{a!@60` z*B<%YeHTg?xdlm%T%-DJplg$c{567=O>I00^D}Lq?8OpL%geMl%-==EbHP?YV>6}p ztp*a^o4Ay4qmi{OZeiTP1huIP)8X0~n-e>PImureXXcwE*A-%X8BL|HQStY4=R_u2#41)rrGPuB~ z7%ng(Ey#U%ELJeTf9}mGu>#v~#0n^S*`gx7FcEYNVjxukGATR&O$yDRN#XT*8akpH za=1yM95N}WLnehYph;mMlO>t*K2aOnu(dTZXj1q^q|p9Tr0{Sz^pr>;wCga!!vET_ zL5YtB`{r$gae52;J25xT-HvHl2ucQ298<*&IN6_bD?Stw;l;pC~f>uD1qs%7XzSe83$A-#ljUz zg|Bs-W^+-X_k{67DD80JDe^@y?a;K_2c;c==2OHkVZ3~>2WGwf422#kDnh;9oD*GNrX=-c@l1(V{+Z}FlV6~uDjZ!e^Xa1 z>|yC_gLxSk;QH+h;=RSnl@TsMT@w?SZEmgHh(8H`ZdR^Fk;X|J;_Go7q7t>NHS@jH zeEGpX+IZ~|S1`N`@sS3+NYaNclF(F~!HXm?z6D++QG;cO*=DMk6$5#u80(CC1L`PN zS)l4!lPIt*S4+B(U?IDy8WzrgPK27ZH7Sc74O_JV52q%~BdldQVC}(;?-`bpes)b5 z>Mw5^cfRdb;%)o6fo~dhwv^N(FHhbyx>9wZHw~M_0eJsGcI4-qM(O8l0}K0U0#DyGdl}*2zYV4Q0`*E*d2Z1w!!zVQ&~>1jfCmy zA;XyRyE~}eZe2xd)r_%>Id(*IDz7@SO;U$ijnoPt5cv&Le zxJO#I`v{0&h`Y10xjcK3sVPN^OhvU+&bekr)O6BGC`NIDEN9B3tp$T@s49T1oITBq z=XJMP+M}wV{0!e9E4(BEV`gmOY{`7Vh)*nHVN5X!cJBC-FZ|Dkq^)D!3l4HuTiya@ zv7DY8jQSx75`P9f>4%ECEYsw2Cv8O|gaAOT2MlnAo* z=6R^?mF}U5cTs`LZGz46FDd^xsu;OZUCnRqWDv7&G2YiRv-F;xT}o!g1_|FwEaOI9 z!!_5c=2-M_aN7lN%ea5*mbZLxWJd z4KMh^k}d^)5asG~Z%4mz7aew|S$oLp`&pXwoPG%`z{{?0`srsI zKPpI2Wey6efD=QNnzJ@&sB$8`4;re<)cp-CPP`VCCteFEFvi1f{5H_L7V=u`9Fra; z5b5E%<;E^AdXG?P^l=#EweSGF79)_?!r}$!wU7zs&pt37AzbQ%ycS|l`?KC0do4ao zLxL*c*ibc4;duSxGDpd6&~D+LLOHSD)s{yfX;E@UVW4L7Wt!kUxn;bnXZ897D3=Rp zRckeMg6HyX9}IpgA6nNCIJ_xS5{U4NaXYNqg9y8(%^(PF+@85(>hY+iZspu4oNLgAPC-NSiW^m<5f0J^pEgj(+gUFLumrR6a@AwO89I+OS z*UJ~u*vXcp0_Dgudz(t}^XJ(oN6&uEW+M>bhbc#)69W&!o+F%H=WMkXv3(1vGU4OZ zK+W9zdcQXqsaLchn56niivg@EmEw3bT66t0bOLN-JWgh=%2^Z5 zfqN_pA?ie85F4E>+T{i&=&>L>_E`9U)X9B_I&n-qrcTahR~}O*Lr$*Ad1__C>nCb>L}mivjC&Z$h7u(Z)-l%u++IuxW|t^E%~KmKcw7 zDaM6{j*QXFS8jDB3x@ZYwryS);$uKBGL<-rGjB_Cmc|cD}a$Y=}0rOn;E(3xnwoRf=awA5e(oTkwmWBP!PeH4bIXYuW+!3R8Ym zmv*%-3ooUscc0AYvM??tTbOPI-k@9e5=gHz)ldVp zRRgc)YIVG*O{S7*aiJd&EB9x+!#Cnh`}Q%vCi63$x!8%VQ;u+o?r^H66`YjePvT|U zw+W3=?yjm`d9nUkVRZX0a)%ESkC-YaVufBA*o}Py@5W}@9w;#ABEu-7Y!Bcvu}C*a zCe~Hc=jCUVlZQRb;mKBcsPF#OV~pGyCVvOKOkEPZFVs-53I<|dscq^v(p8TrbE%j6 zm7i$EU5>TlZ@5wgu6+@dE&MVmHL`V3D03O^6sHEQ9}AH6Loy-(vVK&;tsiZR2!f#X z!yj(_pg6I9{389JocUfZ1Aa}Hl^*VivK;_r;EL=a<3n z=boOhmn79!?TmNL7I*4fYK{lL7N|qe;MZ_GsTMx?Z3KQUe&Z>HHu;>drhtoIB~5sS zq~|0(a$aN+w8#RK|aTr zw(w1u0@4o;NHyF8k_4K~_qWn*+UZX`AoSUj0HiiA!5ahB<|UxoyamOK`RC&+@tbC_ zSaQ2lN(rmO5KH__6Ip|#&d$r)0+g97p7C*wjjnkcME8;uNy5u?_w{h33U%YEFdY(k zVyB~zd%p>87-UrR*$yGhaX7ivNyZCjecvcC3$us4)9w>SC(cqEJ znnb_#x+IOOdtVxSC|+ zbsv~d*gcpA7DkAd$>%swNE&=BB)tm?NjZxZ^pH`m&D`TB7i#a^b*aT3qOed1gdy`R zE|stG^eeSX*vJ|n=jCutiD7;~giA{R`G&GnLehj|A?c<4*!>)rwQgxzYB6q&wr6j- zLUUr!nO|MJa}CpVP{NcFTU;Lgnr!v`HJJ?ln%w#GHCY~dO@4924{p*oJBSJAjK4&u zj3sdkZGf-Iec)^IRlZheG7KDVhPgL@XmB(92;2;Z!Z*WZ+$Js9!bX+$qh<(~HAk`a z;G1EBUpK>#oQR>#FkMp1K48qP3mHr0Fuxm1M}?ywuj$cNiv84|v;8xll(pdg>##lBOl ztq9sn-|qr1z^)wG$g>5@R8#~Q+haUnV+iDZAf)$%C&`mqB_+D_}`U+4H=n=@2=CS1+XDA3N>Wnd)MKv)8{9y z(@D6f?J7Jh2a4KS{~&66yret^iQ4XL?`qKJ*{~W0&xY=^4Z6k5kXKzCz+I)okTg2) zp_Ylml+`~J_Dl!zv;iS?IkHT)ADDk~$Achu>=+E^j_E38PO#$`5Ibf<%xh8Ro<-N6 z4f~EAyFdwa30^YM$4&#y7#yX}g-Y==Z$~HFS4B@7!JHpea-&O>W2MRM>v|IbaXrT8-3PI)LP+Kp62dR({vO ziZ;ElWm9#1SffXGb4Q4_oeJp}Hw!o1&2q`}qA28MNgR)yhukc>OE>OUJ&MQpqnicm zw3|h#E&B}QWZWg2C zunf5;S;RC)ivbjt5jn`s6^*?oe>yDl%J`!Mw*32K%`bP4i~vR&G0+D;kOD^N>>!8B zh3tX>(Bbl$HJSR&{}3(kuV4Y-e}NYGSFix^zd#H8D_8*dU!Vp46)XV!FVF)23KjtV z7ifWh1q%TG3$(z$f(3a0rUm|{1x}oIf71eg(*pl5&;ml)bwkC43D+1;P3C|dgdH-j zqoPc~keC%EjjWe|)5Lu+ZuEF)MD8SRWc$UjN5y@fZgeKXY@^y};9O)L=p;6WoW$m$ zJ;PA%=morY1TO4!3mC$mjLHy zRlrHQ*_41xg!lQcT@!Cj-*DDuDB%g{Ky^AdRny&6YDGT)zZyH()5K{ zY-w(v97SLDMEkX@+?J==*Bi3*01YZD+u2KH&5lrb+ZV56E%2E$o?pN(9GZHN zweZnjdq_Q@sl?gMyj*Z9!G1E80N`7RF98ooxL94?49Y(r+|PmQ3U30a!Tn`v zPq7T{B~>XVg2Ck`7az{gaqmN%!&TW|lH}V4vFObU3o(w4rYAD8L}Ng@!X0Q#p)dYE z;+&XFYbmHJj6cy8@~l4NgT@pnFOJ6)ZMPF_;A09YCoyI_$%;OEZnWv;rKPr$h-QKx`MoAedBS5|Xjj6FdR?>o$!(B?~hP~uN zX-{Z)Q6)3a1$QB8{Nh4XfV&VmKo?@di3<__D6!Lk)d!sIdqiYLxzA zs6m|=JBL6PI z;#&tT)N7C=&A{~nJ4q2XC`@8H6soSB0a_WVh)?mbG}R>z?bER{kV{2^W_nfm+BlPL z;WBLX#>qR>wQ0#_Yq7^ZF5cK_QHfAzDS#QgK&Jq*B0u#d z{{xc+CbCy*D?a+WXN`QpsKefms6(dL;`n@|seB;2fSMesN%sBsnzxuMornB#AK1^^ z0jHwQA5WsrYVfMF6dqJ{c7>|W(ca-asY|U+9GnsaMx7Fie4AsoPbVktfF8xk=n^i+ zQMUHCEKaM40JZz9oFYcgJBl|~&|<4R1WHMw7AIq73$mZ5!Kh_H;pJD39fBqDl;_38 za_W<`wv8c_>ZC9Z8dyc*}j`mJ!;yDW6EvgOM4$2!H_)VzmHhU!dDhtW3&j3=(A z-FNa*EvpfQ!xVAI^h^GRmNHx~R-i=(2 zphl`1Bfmdn*|msT7ERhn28N{_SgK+}{W2c(!*IC5oc6*1uq@3?kroD)rN_atw4T!2 z{vVr5(>^_@K>5P!OmphDW?^yGBs|-v55gB0b&TviN^9&SdXj31Bd+XQiHqD~Z<}`9 zsCtm|YNf(mb>68%msO9ka?D}yM^?%Z3{dCnFC7P{DZiF)W*a8$h~YQWh8>ce`z$- ztz}YzVEi?g(uZ3(FEdu7s*`Tcjw{vNe(M73%0$NovZlC-5@f{$%Mhr9k6n)P{6Afe zIXRHa(fMMDLuHEWmE};iH8xX|2cg#bO>sK$y(JX4W=oW$^u^!y3BN9b4@^1N`MhxLh>|(4ws<2bc`}%1pHN~0ca@s~cOK;H!+NjMNt*Vbm%uCH?F%F8# zdh4-7=SXAFld;9M(FU3?+Lb?G(~E zbpgf$ZSOOe%yBE0Yl8R2wr)N&2Q}1XY^wE)(;va#0&J-aCMY?03p)-~^b&L;u6wjr>=S_(B-Inrirpn#n2NkFcS8PcI?eAl6c|3QaFJDO1j z*P(p{19BQa19FUSxLm}tsNwy%>l@GD{kS{|<#I@e1`q?PFLWhHdtca=vrktSK=rar&4!FT@>*rrEKf8+Y}Bh;oJ zN7opx10vB&1(((ZX!x!+!r=XuSg7BUUs@MsjF0s6UPr90zf7p+;G*PY^V^#4TYRrv zlNV%U-|>FIZOSqVm!xy5CA$>EZAYx1SM?r~Tkt_CeUBF%^bg0(=RJ-7`B)_Q~3PJi-lF- zj=}VxvWg0R*X1}F)+3WM>pG6S57Lwta@Ym8lH<8rSWM(DDO^WM?M=rkxD{pD6s*1` z{$8qn-N{|Rjiz2|v)e#ojL)0&wdL3JuQ0C2B|^fQ+OV&q{K)Q4`pB^TlQVffJOkW; zpgkg1U`}bb3J9`#`jUF=gVp_P>_h6J1{?QHMqHoBnsW`_7liFfuX6~rPTb%i-XC*T zZ&o4N@e0;7+YnWaS#G=l6gOZWWRf`==HojTXIj+IC!#;_l7(`03}CKK()fBtzc1eW zkk~ZSSU3&|vwT{h1+B1W7aW2BAPR!~eCNAlafzsyv)>Cf8;FQ1sv0gR*W(l)y!RW) zmw_AO7*%p{3e~iIQ4)!SZx)5p_fEPCgwtZIz!8#KB__f&dBzNX}LU8H4JZ+g)FqS4Zf7mTahFmhu^7%w=uChp2*$NzWrCr3xA2%W2>CKbV>+$dfBj*Wqg3ysgUoUd0hwKh@-3{t zL{~$hsLpf4*cdh$vW{@Zq1>+5{ZU59jjiOHNv)qpuElnEm+2dN<$u)^MaO;j-I$Q_ zt)3P&nNERo%P*%lCKMGpqxB#|qV$sorTLL&3hb`C^2UAfv+gwaR74hei$8wda8IWZ z6_MP%z2l4Dk(ss%$OejJJ!#<|NcwU+MiOI|#;lfDo>|-#Z6kT<-er}o(UmMLVh*2^ zWKOuZ59sHS%Ww`(z#PC07c0Khf7k^Y6L9*DjR^)MM?QrUCt|t_`Brc-T?;6tQ+4q8 zy_gQ5CH5-b+~`dUavZ_E%i;cm^7WX|heN&{LL%c>$(sy_7ilkiGa)!fbz%5J4;|6B z_m#*DB1T1+vS)Vef)UpH58enSwqY*$Jvh|iH0NSG@LxtK%G{ED#_E0|ObC7YVHC|| z!xwis7S{=i?ASn&9gcH0P-VyOV{Yzw>cncKKHpIn78N)*F7I+#_MqweF*w-jPPj;tKly}Eq1^p$iP8PSC&sWLJpRlN!kf>|Faq6@ z7-gZxJ#oL@4?pr9&ivRk`5MXp_OdoYpI%(7>T0=Im7{zztqBZcqVVbw0uvb05eM44 z&J|_hWFr?vJ9zU8JPw^#$_lhbH(7Ei+Lz5I_bkwXoI*8U9HtuO&x-P$>o1?-Num}A z_(&;O*vv4y{28Ec#8~;1qiC|&YE#!L{tL((mER2qd1)<<6xv6B1$jBAet^8caJ*_s z0=V262iV%5RT(};?M}F5IrUUtytyxR`GD-L>L2-DK$%P8;E@#yu5*?#cObYwlSzZ6 zk`JYKh5w32;XUuK9tHC3f8$XA&avl5Md3313z5QK>QMmxy-49N^(X+RMGCIt^*4|m zjM?{;xHoBYDm7%zZHJ#tLOH7r^Jz;T%<`Vj5W+^+iTK84?qD%eJ(+1p^C6Sye&eOd zk?S*kpMVoV)C3to0t%vrg?&SKKY%HqH7Ernwi&>6Y4!B3jpBmxhS8`88)4* z?|HTx$h@hY?;lvg-W;<|Wr|uIncrfN&JeeI#Yx26CeSmsLyo7N`+Mn7?|@5^Cy`%u znT^1s7G65!Iw>8FJ1Mwtn40O&7AZ?UW;oE2y)ucT9k<#3Dw3Ek00XeiHGC`}`|4J* z-@sSFNenYr?3wSW!+t$69@D*x6XFeMp<>~=Q0lO%3QxV$OYD)!Dvx^b1MF%Pvp2dv z*RySudSmuTL@}@R(X;?ny_b2=_g5tI+y!1dW*NChYczDdW9CNMVl|$-L|pyt%UD6z zATMLZoKycQz$FrXKG^<7X1*<>|j zju0uTV>JucK0xAzcW03XxkESxoR{8km=qTZXsR=*`}V-@s!M{B=G|*pYa|r!dJTaD z#O-Fdx#4X{N&IQ-m@t5Yk&-mhKtQcK9rQNzHA3D7q_S2h54~^ICEioeP~7z%%tLFt zf6qfJQlGoPWhS9{@BX~n2y@VzglO=n4OyBOR%By-XLfjt2z)(OI~-M>F})O^t&ezA z|2l9m_xhLug6d%X;CuI>N87krPAt5Zp_?{(rQZ9y*ts274=#2#0a)TN^xKck&N`e|3xR_Cv`YjJ z5IFes{a5|K7b z!FK2{V*7j&k=`Ad1x3&moP4lnm8=IV*9os)`qHzMh`f02`S1n$-uCg&uB*%23;M@m z2b{)JVu#Hv*r7hSmHe)Dc!(BwaE~V{Q13g1G5fw8PGNi_D0|bZoq~T(1*uVp8}TEe z6ZWC4O2cF_e+2#+)K{tE_a@KTF0$Q08iQHrAlY*=0x&giG` zD?zEfB_Fc)Q%9!IMVPF7tRv&@a3;}0i7~yPpd`J;s=wDi%BJOe-WhnF#eJ@R;SU?S zlL?&*O_jRs-N(lT%VQfEZQNQ*#q@7&WEePV;j&P{Qn-_JD^z9_3FFj)j`XfRx!^Yi zCSlU;Cn!I}4*+KC;2+EnScoa8~$KZ+Xgd{=#Ln zFC23jPFs`FNdh330h|Ie#BhEKW=J-Vt{ZWTO-67D#^4LaFMC@sZYNQ!l>y@YDaHcL zzausVm*X^6SS`rSo#(DGMG|_T=ZYMBTAJ7?0gj8>KSgE0l|NxBQ{d&1;mCxhbvxO5 ze_%HLTgV1r)YAL!r*%E(>SEd#y*|W?lQ7>UN*nObtk4s^Rtp;R*|V4;vMtW zn>F31&IG8sAjQGG2bcN?MLHo^}VnGL`M!H(b$N3Cu2E z+t#XBbONY-*IC$$#wqNU`$}IVKW|Y9<!3|a;*dUZU!0Z6U6_n z!wgcGDW?S&1Dy!c1tk$%Op%u2r5^ zgA}K$EZ63^ih}!~shJ*h?sfvt-IDNg_Xc$Co_T-)9lLMHdj33iW6tEQB;6JWSSSFG z-6Y_#+W?8>4ng_JG~##`qy)}>8W$~ z=s%ph7dF9j_cVC!)&|er<&4M2ZuPl~HlcN*C&zBQ0KM5ZQLzH&<^ty@+eaF+@DW~8 zJMevlch9vJT;Y8m;Z^<|;SnE?@GyTf!sFP0MtJtn2yZNM9=3uCj_{arUC20yuw8>; z)@!1w(~jWnGfFyi``jD$Qnsr(mg>=(8An>gO?3R6r&m$vfv=sf(UOb#2m*4{abwzy zg!uH@=^s!%i7`@u?RE<~3WdebjT+L&c5?(jG-t(5-+gjz_X$-K+XL|W*~S*Ue$Lp< z%y=yG^k$@>1Qpt3s!t4WB+L1T(?>@|S6w>_mnWa+E`@t96s_MqKi;fT8D6m%5+0K& z08G9A3OT`s*HaUB1>Wm_GUm&M3mKk8oCq17T?3DfwO>}=qsMC2^98X44NuZcrzL$x zTT(QvH&a{f=bVT)r|q`pABZ*ji>aI@t?Q9Ao7Re0V3GrAiy@JV5zdbtUp+CVC>6a&=$avQ6b z=Gj$}5XKrncWegp(+uEz-*DbSOdf9zUz!FqgJJlMTsM$9Ykp9CVg{=;j-sewi&weE z$!9&FocL(WWiTs)ds;L@&oUY_%qgu8F9rOjc=_n4viC4u&+_CK2Y{Z0{O6yfe2uf? zfn;Uxsqf5Z1OM{$Sn%hrvK(Q#cxA6NRn)Of&nfMfKb^+=;ReH+aO%mA_x+E7|J9y{ z_3mf{3%i${vy(mQ)(KUG8ZKx*JVkDdcwY+fctqsODnqg$>5B3VnSfd)?~`Tg zQ>C}xKYZS?-`@i?zrXh|*AXI24Z7}qy71HLLPc>ZB?L-cxM+PvpAXTZo)!!KGq2!; z{z|U78`u&$pPkD!8{<_Wc91vC!ZG`9zF%dw*?_Kc4~rm`1R(hG1*!=-%ZA@HzVh^g ziabVUYxc%YG}Td$TsSobdq;Q^?o>4kc3Ad}1Hksl;g^>*95w?5&*?=g58FGWWl6Qk z+B@#bU!|Ge%ho%J2K*|>_!d=>L}i7g(a{)&g^s^_F~#XXwE*bYys3>^E6`d0g@jCQ zo=~nuD~hoT`uOD0V~_*g(5 zR_k&HOXEVTUS1CNnIaDnl&E6yrSqm=zoo_0J=S(831uFAgs9K{KFFSk;>px0^@v)p z+{{Qt^?WGjjb=pKjHJp@^)=zw>g0JecVrvL)%o6C2PhbN*#iVjR4VTIZE}A|deOdz zPdLqo`h;O^g{K(7_?;)QFegdYw3^qKh->FnE!syi{k9i7gb*;h5~%tN**VVS=QPbD zFiq=DDu!P+;ftP6(`h8-r(CKn`I6UJX)Q7&`eLJ^E)tW25^Y{sdN^Uy(Px7+z-_0R zI6J8>JOe41mU0$1*j%3h?XDERc>pzOf^2+RJTqwK){2+RKOQ1&4^5pz5f9l$=jgUV70;( zs#aJ%n@YDUTfX>bp?2UurP>cI1AHwI{-loNpW8?PP)DL>d25Ls;c?y)>a{D>0vFTJ zGii?dN-|c0)%`c5cthyE#_3A8iE++7u@3Ln2Vkl6uLrQ#cv}5nJaN&aTe9r>SIX2HC?`4I-;R-;7 z^C|%1>|yap8enQ^`s0Dg`pVkZxOR8-uPJs?LW!kr8Exlj;|tNHSFpp@zM;MvVY)JX zbnx|Covt8rCzh?6E2k3jy-w10G>ZKhe^FjzhAT_~2A?aJmj@<~`2N(J1n`$VO8mJu z3E(e#l=yRR62M>fDDmgsB!CPKZNIF);!)zyy-5In*`vgtdy@eEvPX$O_a*`SWseen z?o9%mj2@@9{>L9B{@j}c@RvPG{JS@aVZvuOKE=S!7@(i~`(@(qmx=F_(Z63NvWvOb zW^ID6-kqf_IxYSC`(@(qmx(Wc&jzHG)va z40XkzMKL~AM+c#1w`T;|iew47xMy&d(M(DkO8j%muiA_(?=O#^FA04@VoQF>X>*wL zz3o@|npXL_T^$ntC$n$SsFjBph6f!wxu*M~VqBA(B*|p5HcVg_ctQ2Umxrzxim&#) zu0{`W#TCAGZaE-bcqQwM{XSwo@Gb!g4J(d7uF6?r)%gWUHRg3}-bc-oYP7`ME5y-U z4!a+d3PeOS7YxyuUy6s59?gqJy}P{BMDcuP^POz15pwK3_0RN)>;47nl2b&+NUf2q z7phEIuy@DOJ7rpj&j>hOt^!uO4i_fGR3pe05nwqpC1;%NrdUz4$B-@a&}zC<+tLXF zeJ!0St*(>V;%?mW8`^X*ZOq5r_v#7iez;;*m?wMonc1e^C8WirWz#r+1cuZSS_)(Q z&qSM5eQw3Bg{5)b_WIc#kMZ3U_nV3sMlvFUlN)oa=_%exA48eXd-oHwC%1H=0GR-HPiDH$PwMdHV*pEb6vj4EE}StCVw6wEQ-*Dr6VbRmdz00{(ZWCUS?$Du5^4MiYlfuC6f0Q{tLm;-rUs;_nSiv&!lD0 zu;Lh1{Z6G4^uSPP3E~t5XR$O2;oPwAs_6& z1#*{C=5GfR4PX}lbRxha7{$<5K){9m()lgq33)0f*UEUg{N*d*Puzwl%y|;eLa?jgv2?n-ZFMjqNlDH2SRpp_FX2`3z@ZH!K z{wxezf77#YvMAV!{?xNj4`}IPDTaBl3zAK>+HOi1ck04e_W~7h)6XIDa1@#GB-;7~ z*ZN7+FX{d^N;ndk{;QoOTDSX8?JV4~e6-)?EDQ#dY?OwG)W1v;8Z6kEUVyvo zTVSVtvvirepYpv}Fp!k%v>soL?@ixR$!jQHu$u4;Yv}wAQu8$f>BH`RNkc3*+e8aQ z)R&(y;XPHE_Yz@DdIDIjX`eZ~To1{ydA$|Zd_A^F;tpNvon^_`3pyV%19&0CE{7DC z$!nO6BMu9BTL!Jc0&e9XK4UDffLoh`>z!T{bSfeIs`@bimq7CHyMcQp;`m(8YA->QQf1p&;ic4IXiv0GhQaG&aK5bBoyW9!-67^s}}w=inU1~iN5-w*fKXF@w~${~g z)wvg1g|yhi+aIq?1uO{#pR&TeoX&1}o(wGQ3R9l5RKKNh&Al5n(}i=EXGT*%%J7Vh zx!KTd$)Tn%Q3^bM1&m;sy^S}0TjQNk&bv~ub={qf7{gLNfw!_X?MQH1zRBM9K|otV zv*jt1huz_&dPsa_wgL}*;|@(~E)(4Ym?Z4%PXQ)1u1rsDxXJ>iDn8WX*LsqBQJ4c5 z#Us}5H|;1Hnd;gZH#EOnxn;EGA$1BR``JNO?)l(#w`V;M1*PGwg+eh}7G>Z?H50FR z&97b9Ho*IbpRt$7I330hbPTTspj#!id*bmmG*OAQEQ6YBY|iZX)L+4~Y?C2=Q^Zl= zkZv6k63-A0N;letJvgA+?;ghm*pA-@3p(nqk&cgobT8S((kLWhtfn?#-HS>)gumcb zfQPRv_v5dhJwvu#2}hsRPibp6vr)A}PP}GAp?+xr%hT_#ZG*clAs0!)3lgKj)xN3~ z+UL3oN_wv^!RLo|o<|-Ne401=n0sea=BaXIoNI*3cwZa2Q@zPb9>YFhQqh=|9<}Wb zIv?7mG8KzG-VD(1gf}0^d!3^{N^;{lU&0UnW^=z}<*;F{PQkrHwee~^Ts)+&N!%|& ziHqGbmhFqIaD1@?zB_?|Bm-~RkNLyekB6S$-0;jM>kdo_VENP`hOuXmzN$$_z3=2@ z{mO@El71kBic%y{)o;5i!Y zycfRl;5nN5LW%h@>L62{>x~fCkJwLu;Hhs|rCC~6$e{g0CfS&kczjsU{vrA3DopAX zy-zJ|!xuvn46Y_@D$uTT0k>WB@#g#OGSqxDKaj6`eWwCA;$j^vG|3yjAa0Q#G5vat z(8T9^NMQFdusQGpQ+@JvF#;fO`ck-narLy@%T`KhP?6HfI3+BEf`C;syPrdHGxkub zmLf?DJ1#q*>6!Y=r;MI9P!c^5gE?qt(K z9(}n#%M$jWk%@jjo_pco6zH%VJb`FQok-o6#vU+C|9t|Hrn{PuUE0uiRGv0Vm2CJLuBI{5c#)r8sI=l# z+(UaTWq81>72|tHp59labWAgpALgUNY4lJv@>yM&&pBuU@k@3{Y=X-A-4y4E&2Q$H z3do0w6Hf+;zWDXozPg(S-2yq(N{_HYYkXg%p{{w<1p)5J9|Jsk6hBMykP#9f;VvV@ zb;@x_aN8Op0y>2dVin>d9M!$(`{90U{>ST5RWXLY7z$OU z|7U_)f8h=jrxHom7dE#XFSuf#8tk*6q3djWhC1#A9zZH-fhG`3H5EQ43{&ZWbmLu5caFhU!=mPF^nvdJ?~1jpS~51Uz}s1u z$k`Sw@RnaUj92pCvc?T)+T_*m_$REHxZh zmp*dB#h8=zaQ=sZ!unLK7MvA z$u%5ei75ZvSfaA!NxAaLHtc-+SiKPg?-#qoqmpf_bz1@81T=yOi`R8&t zn?<*)#j;Qy_j2#p42)q(*ex7W0Gg4XK6cQ~UkciOe<{23PN(;=K}m*+R6Hj-{^gX% zGbz(o&|%+75nAygQ378M5c3)jxs^AX=poGlMhqq)y$+d8eca4L;pSG~>Fu@f$weVD%KSD`qB4Wojo=_h^(d1a-p?I9xRJeyovbN|s#%Z;fFq);ql zXq~dz(OO`!}l`wE1~wD)HKS zH4l!s%m~nePWRXKj)081wvm7|k|(^rfe`*M1vdJv>#brh#4bDoFWy}wp?Bw`9;*8^ zi}0a17%Fov(gtCcg(%7qS}?qDh5syV{~VqA+G4_Jox$kl$pI13yHDsO*C+JF?nFUd z6lP3-WFx$fzSQfR*c=uslp&+wXF>0uCE?tctL*zzGe3TgZU2Z9w1?w0Iq3!`IzAq+ zt&no$tAg)%5}BtV*V5Kat=zG!fky=n@%;Rf;1JI@C;6bdVP*wA9^_M8pS9x}(T5Mc z!6@zfs-}bf=oM58U;)(vy@G#J4GQsgz}|E5M;n$x=#Y2CFWf;XK74?(5XP=q2*AQG zdzI+s$qU-U5r4Q!b?$2J_CiGyG4M0>B)mEJscZ*aUxB;nOJjrXHx|BZycEy7l^653 zzQ2@h4z9L^J{t_5?&8)gMS2+pY0g^jieZqGpx>@a`}3u2fv4!u2MM6v^JQgm?)wN~ zZq0VMI2Xk*GHQ(lwhs0jJ~#=B5|jP*^bO|t7zW<-r_y4KZ7Gc4TYk7m=1@-RkF$L| zu3H<4u1O z6K;x|PDW{xb7LR7@MY}9Gpx%CW-d=avDfiaG8j;U$;Gb8Pyza+G-FnuQ^N^WkKaJ9 zi?uMD|AzOuucQ7K1a(ic49m_1LEzM$97-n%BNqxgj8 z1U=%zl~T5gxZ!;!wfHvy5mk=9FC{_NUWs=Y{7|DZr;%uRBg&!E+Zoi=^=_UXH+Svk zpq-r4uj)to`ZK1hrF1*z1ntrfTPN?IY=+}b?ntSBM`F_f;FabK{rweC82A%SMS*|7- z0LO68ghwkMtu8P;(NwY;`ls*akeopaIZt!E9DVx|Ic`*9?~a?8!zYe1JFq7{h^c58 z6z?UtYK26h3-vmGZQ&eiR}31lDwmbtlm(Wv)oLN1-E`HKa&+|G#2Y*!j^Xj;utS7+ zM4KPp>hoE0nh-ojuEgT5A9|-x`WQ19o;7D-*_i~6L*{K|w8}xR_`4>KsX%B1^mxJG zva|`pjw^Y^RUhf-@c!n);ljb|Ah&d?|PLN*P8Zt3Z++ z+u=)XCj3jYo~P=&`Iv8!>Cuc06OHy=VW?6 z?JXFB?OqPU1#KM_PBC8+j09K@KuuG>my-~eeC5OQtdAOjj~!i`;9+G}`Thd-OOW zCgo+Ow+CoC2j0#}Fq^+;vCx0t5^uT+4YGo>(fg4%e#X&Wlv|IPL$HT~LE|}1!>katW^G&0C8vft@5D=TX5-q< zrO1E?R~=>u&d0#oCs&7iUbe46&Z`Ir?92|+GM2C6_pb+`B_*j*4MelR>yS`%ZzcK` z_k`|!7;Ck6OK2wDmF$jPU=a)S1FK-l@#1jJVN>XA?Lm9l{LVr`1h1%GmHkNLU`vg^ z^_!kzgSi*nDCdp3>~wbhgQz|5Kh|?3H(mpz`eYUut{N*8JCX=I&pOCb5_q36#n?&h zq8iyn>=kXQRiOriT3EWur>JmbpOj4>d>@CrHaRvQd;f|(Z)GtuNDWGv0<~ym@wRhq zkzosT%0C7=0ap2c5{ug9%;MXwz7i4kZ*D(GUWO3lvF#Z>0ap2c5{ug9%;MXwz7i4kZ z*D(GUWO3lvF#Z>0ap2c5{ug9%;MXwzr&&BX3)nQ!;ncPrtN~Zz)Ns#vAnsP67wF9H z^dwv<=@uLECG}S8AY&oljv5M&q|&GkfyPd3Dq8(=9&dIOE`_qFYtt)`3~2($LsDz~ zlP;1U+dyMKPm-Pj~D93a(x3Dw%j&n&TV7+KGa@Nef8#RFLNI5(nN~yCvGleE zJzy&UA%dgyhB?brcCg}VUHFTL4>8NhW=rS{FKE{iQ13gg4u7u=8~og`bue-rO>4d2 zt3-=qFuB`vtL`Mwu%%FRc#SFsd(~sm+Ru>+6{?grSRmO^w;|6wQMwJcFN@($i#QmM zv0IWu0W;uQn|Qe0j&d*iIKIW|B0`l zH{&q46c46a0w|SH4h1mo%UZ9K!KL`cpOxb0k#gieOYz&^OYzS?N^#)#RvaJPim!lM zahn^~8gMBNg0M}L;$ zufCV!Mjj%He_o0M|I~^ffm-pOL45ORye=fg;<@teSIysE@1F5S3%3FtMZIzp)# z7KcBhCM~u|sh84fI$_HpE&t$5Mpz(dBtBU%Q+$_4RX;$)g^5_i=V80WEZ*!pURyF) zJH4dZCf?kS9_4amJ8$|o6~sFAH8fc!Eb^bBjiMuQdKBeqg2(u&^ zq_QC%F8Bbnrf)~RD4BB-Div6HsF%xpcvYztUzT*`Gx>p`g6m6-y%*IAZ7>Jf(;QtH z$Q*dux zsyBPH)JhL0#Pg`Tehrmd06l7vNV=#?ZGFFW@Cs|8T_L~`5vd%2z!!Y z^}?Idd}-yYT|1u@<9m_IDZVd61}a0Kjd;v?pR`QYPpxH_k!zsop=U1qHe8_Tp^9zB z=DYzw?j0quh4VEcdS_>8itqPX4(qZjyh8wqOZcqEyD52$Y zULO4I-+UzZ46NtnuM}@{#+p!0KI>9u;=Y1WV7VM>4pfj+)z8D-h`h_B8=d1EnX^Tf zFtz)tF$VhR<1ibV6e)Zit9Zw?WjbQ&3kTFiRec0)5^XOXR}gbq%4J!r0&Y_ZqDngI z@CeTsWXZvcMB4UiZ;Wut%;8)(>|w+Z^2RB3vsN#Lwm1GkP*KRR(zs*fPEWMCEVsonV5xzV5tw)(s{Lz}S0UjAZZ_enCGcWhl0 z7e{3k@iXusQN}v3v+Z0S@koDM7`rluG1Dr+JKZa++Xr8)ZyFi&igPZqfW>HSp76s# zQ?Fotjs}FgtX?W1{}aREwJJnPwnBeM%nv6Z!%eEyi%@YGl8I~XY$vy}`Z`ZzX@BU# zE+azO&`C_|1g!cs=JDt>S^?XJ1X~pQNPDljwLJV~WXzCByu0;bWx z_0i1myg}EpYrRtzL{N#_X#rI@alA)3I!)dilWA7tH>uv7di(4UTpckQwnjMW#K}0m z4iA@MzTC0`qs2~(Bb-RiH1&Jl=mHi%ZfyI(8T5%1=a`+<+XG0{{@C+~S z2uHrqy_TsxA$U+%uARc%#l?a2O#MbIy9ZI|R1H9JPnJkaET$-^Yy1!T4_imIA2%ECYr|#vn|KlOFXNkXP3kAa4HYA*L<-4ASwzHG))vm z0{9j%Nd!swOYM$>3^xdu={wh+ki}>$Av?9#6S0DCM(I@KQaq|h+{_f_-p~6G>*@J~1-`wlbF&KO0ikmMjbsyfH6g-SX<^#ym-uz}@+#&edde5Drl}BRGY3 zL&~DK3tU26_=8;T>d9TNs+i~$RC(S$2f5tsrUq?I5R^}zGk(=Pw9?OgSyPh7{W>rT zr)N}*eL_drHoTe*I3va&I|Oaa`>prGlgN%yOpG%1aENSlP1k5QiQ>J?JQZwW#E@KTn4f$>Ia>@;K7POV zBstoHTy~1tcGc;{gcIFS7<1CHFUg~X(k$=y1%s=f8OI+W7lJqDZ^pWW!=u4xRY_euvSTG$2v zTk_kUix%GY#~LgpfkZw|CH7tP1hY&0flNNQ0Wq|b%-+eJ$o)E*~tTcT^{4bLLR z#S(@;=F<;N4LC{Y$@N_JyGZtn6uuc~yWcsuGgbzf-1!wmOuDbqn?WY`yc6OSM1&cR zPhv~Fth=s;qrQ{`<1)KCDgtlEmVjBH%HDv%R9u8PKo`6D<{SK4#X?-9w@^+N;$@YC zaz9~XAmhX0m`Hb_c<;twsgIrX>VCepsP0*tk6j(0o5aqv_xcPnJ;sA;Mg#P1ncGiIx64L+e>%z1|5~FYCAOE%VZGi9Oz7~8zx7)YM)&K^Pn5z zwkTp#q@AIORT3{&#^|b{7*zZ-en-KXTk*p_J$6%M`z8$4AmQ{vh?Xi1ta(Xl>_RCR zlD)Qo0M2%0yWX>Q?1%()D$X~kKB~J7q@2o6hu|6_>g^ho?z){NnT-a9<^>9Kh!XDD zT5_D>3R{u9q`qZIReLvZzDXtmEbKNJWax+(E_RgOVAT?RU}uWXfzn$-yFvU~pRPG> zXTy_s>{#CtJ=>C*rJjg_+17Co$-70YU4yjkq6&jf`@(T^e{C8Vb81AKKT+j8!a`X? zKG1N64AyyIvT90LoT99D(v`yhh<5A4yWHBVl7Ueo$J^X)(Pm{0u39`&pzjR|r>0^e z;vhX^w;|uu8iF26o~>t;XtQ`8Czpt3BxxI^RGTFa+0avG_T}*L3{^cHl0Ccz^q2C@ zdI#N}tIAYH1uCJ8S61h8Cb#hY4*PoJAs)EzP}m&yH@i^V^z`oejGMouVAC;}YVqi= zg>hm{b0=&j2#Qtsms<(710QAe@zF+nV?^87kDkVgCY5dzouOfWc|iWK>#a}5$CYp+ z##Ggv;@FGHVq_|9*qvjVcCx;YEeoOgVuz*6lMm~3Gez11fL3>FOFB&GOb;(lN>w!| ztA-qkrWK_N37b$iw}axxcrx#w%P<3_LgQ*!SAsI@f3#W5A?i$ zeaX$Q=@)gGH$}c#C@%eFAk%6E&(wghI!b-dGdSMdAYm94Uapk^fI(1wYkD-_^%3!& zZF8&LlMY+6WWgWi{JdmAI>>RuiS{!8Jqs8=uQ4{cxjt3ho`|Ip?Zk%P;)TG_aoF zepY+4j3kfrh5rpI4g|oa5-vw4Y8tVFp$bEgmCP!^OiB+*MPyP+t-Z<54)E%jAYZ8y(A!*PKD3(HT|q$lS)b8 z8McPAVsE(UQqD*gI|mU|*mSA-0iHp!99B26D8W?FI8}|-#vPlvk{a85EELyr(+e36 z1T!scJF0F*n~=R#;h&dhMFv}B6`$BU$8(C+>fq5cUj4W{DPu_B0%Vz&y%*qw^TrfU3HnSH3gz?+(tiLNM|D$C zi#t4Lj0Z8i$-Ts=!WA*Om+8AVO9s(r&7DrpKXtJiwD~srgMjJM3*ix3En%NuZ_Zw| z$wcP)Dl+rFiG5s(DVOg|ne}q@{e>?pLxY*vjb}=+AF|Y(BGdTBC@&J@*1IaYvQob| zoMXSj@Yvt*4T!jy%rf?X*)i#D&*}SiAu`G_ z_yWi*hT?!NWc?6JE<;WdVtgl8Q`Pk2@~lun*F;tVv83b{C2%Ly?u&l>27aVi-EdQS zk>;#FI;FB`2`lk@H@7(bh5qrOo>`h+Af06t>DODdng=D-$snt8FYLmb%=Sm5URH+j zpUUnAm_EiEQIjHu6vFF|iLI}kd~yXY zd^UzMyE#-9(eJ7hpGKNxjT<>%Q;y5?bof^&=4W(%iSo=>$0`!WVZ;h}Jk^qWB!{x- zh($t;?_3ANZ$3*=v99aKfW2Gqh)LAp3*a-!j{NwMcfzpuxOIYxdP#uQvbUDNZ)Z!7 zO=p#D&Z(Rf@#s(gg;IU&5^CE1W^dW=yhWmqS~)s5lZlOj z$Bxw*7n-P8ESO=>1^$m$lL%*_)_C3$9rGOF5ugWEzAA#pgO&93^D*2Q5360*!tK@x zY7?Yd>j)=~QN}PwMI(Jq`i)8MA(~bUTeqVMk)8<;(M}7x4NpQDf+E9-L{VJ)1#^#w zEXqggqD$!hkdKCrJ|lVO!5!-;&LrOBMG#C$p80iLIQVY~Nyw4PA*;XHN{u*1t$IGq zECKMYyIwWc?>V+AeVt#ZS@zL3dGI!U{I|b&-R|_b7@PN;jl;j4wi$s=+w5omcG@O* z*>uu6ts)Um=ldxZ%`4gYjo~_GF=U`p4C%1941ceQ2~Pd-)|rdC z$`|&}&X?7GJUjtiyn&X6nU}UkC)B>p#|!SOnYdC_JVGt0F6)rT&%A%e+`Cdyms8Sy zx-c|0j+`c*K&Kla@8?RmNS5bdP5prv7I zLNu)b9R9-dce2MfMlMb;0|}ULn&ExiDWoMdE8KL>eR}y!B1&!>?|C)}cW8GJ>gPAO zoR9n%PM?U*6b0+@ju+VnEEH!6?5Zl6oyqN~abbk4oThy$s;o;NyGsgIFNAK;RVzsT zOavJAXEFH`k>~Rjg=P550SAa~omZq)8I7G`o!8FC(vbKDw_6%Alzg1fR21^cvxDV^ z{WC(ymMwFp5N`rmzHIdV7#iM3??8NWZJ4ch+>&L9dtw6lQp1Xk)R;%@h-mvO={bE$ zPzz2)MB8WEnAYZ`6OXj?~~vaV6B zT3GYnSj+tgbOXYtmV=cOYI-hh8&0RhQoHeg{MZM?M=QO5&HK;lcmr6&gk|syr2rgY`h6;2yFyTTFpd5c~s09-7Rz$y8uRbWQ zE3=o64_mu#ID){y=xmJ{as)UuNk9)y0@(PwqLe(U^lM-^Lbs>% zA|zgZG$=`wgws`%c_voM`|5n+gnq_H1b9}-$wxDohd+9uX6e{s2$~vpEx)WVSBINoX#_~z~QrsKP?Rb#2|e+;k6o2oapec)H-N;U{GIPd>I+fwqQk-(4*O()Yui4Hk79zIMRRpLuJD zn=ZH}mC>74>?=v-7FU|smTo6#R_M9x9`8(Hh2k_gYr!>I9}ESN;UKMcGK2Cu)lB}h z>O1_j_};{l^B8!)B0IsC&m2TA+;bWIGTqeDXoO_O$4{X+yPs2LBu5SSO_O0L@P8sO z)mNq-$h?XgmFqy=ULgX`E(8aiL2Y3&W6TPjumq+Mk>1!N)s!QG=hPZd})9P7wjY#cpQzHA_x;*!SBV6$Iv8;=Z;=lQwfxL+?Ts z9Nwpgq0tyzk~`x~|(fE*-chzP@=< zdGgXgH>82_o;u=Pbz4x!`@!P#X2hjE8UME^>Eh^FN}mrtSo6S ztf&BO&GMY`T!Tuc%D9zL-ja7N+-(TwFeN1|e*6a+I|auDN6}*jo-B63cX#ikb{9^P z(WJ+oS`lSZSxoa=c5|Fmyu04f&69ZRq`qm=Y+PiWH@S=Z*{MJh3mzk6LFf4%(Q0X7 ze2-dU=QdWu4mKy>*p_ArDW`YQsNDI%Fo!BI-%1-QOV%O*a82Ch^pnk>Xm#`WIi1Y1`&fB*nhflzhpZe)pu+T6h->Cv)3%BdCqm_P%~T(Rsl83{V%nCb zyU{y2#_cXn75D(PjIuIz1Znk(YMQ0o2V|V4kKgn>^qU(>$4f3}Y|p*AvKlyud>)1X zpnOolrvJjuVqWiQJLFRvBD5`L)!>3!=7!YfYZFuLA|vBQih_8(&x1GzTcK(yzTJ(+ z7F|v=(6K1Fj>Ma*^w|r8*60KJkAL~cnV;sn*pDK#_KQP`t0-{AU%EY|r+AXgZu78R z->0vw)7z5!kX1KXh6cry5);-3^C{pTP1Gs90K>*Wt9?TN8)2@Iipz{lkICNLjqZLd z#Q;fJ)S?sj;pAAtS7Mlqvdz~uEH!4Mt%x22u9}vmm5+H6(hh41Q{7nCE=t(+9`$8| zmsU_ZH6R?LYZG>Mc`E$S^zZF4%od+tH$Pay&38!AHHP+H9_HV0J}v*FB; zjo?VSYff9%QWR!mWH*TtV^aYoC#P5sXQ>K2(aCpqYEgWAf>t3sz3*HxU9{K8dpZvn zx5|2T`iR9Hq^xUPIlagSUJ@*Str)e&v7ON*SdMUe?u-A1Mz+aWBK%&OQu88NT!rb! zzq|^4RbvQ@1G?5e^MZ8@#pGKW`=`BMFyq;`8JhKc4#!))ENf2}fvH^5X3{=u0^?Bq zs?&GNs>H6UnN#C%fGd5qs0P$P`4sxs2jK-IeP1T8oa%ht3{OV-Dj+Gv$EP7kDodgk z4yT7GJ;?T7W9WV5n|v{OFu;K(+BF~APdyYb{O$;_-CG-C+!wijGerQnMwK3&x?sk zYot<}XjZtuLfOKwBPQQ|w|HQ1es|Fbs<6@k0iSQkQINRet&~8{)nduyaJqgHJGx9F ze@4#cqtMZ)G0y?q>%d&uGv?{9Z_4?Hc7@K9)$+RIF8eWoDm*w!=Uh42?YQixa`v$< zwoD{7lOwN7vP1wP1=O6N&pegVUVTdAy;ro{Gv8jehvy<&NTP z0-`fxT74fs&qsWLxFpqc`Fl}JO*yL!fV=*ND_|+c4(Q&x!=SXktnVduU+Aku zG9D;#@aP=9e0}DKo7=9~M`F2-LsDCg%HKa?6Cqn==-w@;qL+yAK^lV!KTdfQpBKqH zX>R#WE>-OvAF9G*w_Ht;&z?i?dN4m_`09_b@rclZXnBO`q0-YOoCjV~7A8lTfHP5(w1`_OlgH4l&oG@*(_F(c)f&9_?M2)jzfmqVU%BZph1>eB|-^*P*?X2+I7%< z?UP@N_3gz3ShxmD?7F(89Kl=yu=+o?=XhoCB8ARB0!mOT*M3mK&F?Ymv^ zzS8A{aA0HbhM@UK_bo8t6mTP(VHbu}bF>wCl*i9Yl@-#<<|!LAjI5O{yBWo;S}-cs zzpzuFQA7Fq0AYgbR95VQF%YS2em3=+)HWSOn4aH!+}<`9t7MEZ@ux6NK$Rz-hHv(W zB&4Kctlr5^Oke+F<#O*AwMThmM&_|eZ^aB)?OxyBiqQF9BP*41@c6dLUM`2CZSYlm z5^p{^&xt2oI}pyJEow*7%eJAdKbvZ+NMTG#iv~Yr(}Iis$A@h68}h|y;~UT%2CDa!d8w9v4-!=yLdh{xXf^%w$1qKJ2uf#M~}GRkyJ#M z?4I~y#GL_*;uq7|kLV3`$fzgtf{_jy``R6@2&sq*mT};&3zAn{1cQr3M>q zaqZ3@d)ytydo1#IFWIo6e!OJ+aXfpr##v$YH6@38{Nv7NPh{GP+C{_9g3;G+5%2(v z6b7d5uQ>-ZWQhXV{hx9qVE0wB00@+?_(_%3%yf~3Ik$%5M5|&7K_MG03345^Tkyg? zo4PnrF+Gb3N-1WkI?iJ=Z9ZzCzkAXMmp&3JwV{Hk` ze+cP+FnYvpxJ;7q2K8x8!NA@?>YGs;x~Ez0$h!G04?c0eKhhHw#;_{n!-Z%u6F{E12pQ>HCKykXu<--M(X{bT4;Lq z!~FXAMzn?o$Ff< zo#WbP?u9su4oDb3DY8zrA#)T1SDM@-;q@NzbzK!xm5p1`#-VT-iySJJB{#bVBPDJX z8V`K2Wny+pA_K)y{}j$DmXj09knJpfax*2eX>gp*zmi`?cnO|Iz`ee z1%jt(o{qycGu-k;J)4_|cR(1#-By`*X5B2ocN$$0oH$cb}A$2GZCw zU3b$3&d@-UkUW`hRlX+KZ*svqn$|zp3wvvZ>sWpfA{&kKajT4QFZW_DDphI*LL;G< z*r9xBRI5MhxL|-EL22BP$I7N(TVtj!e~ElV93+(pz3ox}c35E9=IT$3_FA{(eQA+R zv&S;(w5vl4r^d-S6)V?L8-u@FB{KS%BsWbD`>H9DW-;SJ1Dc+ItrCxIptidq2Gh~Z zQQNRVR*BQLOnby%tP)ngTP12D>8RXS6Dz`}BiQH9BjI9VxQROgJMw_Vt8AVbt(p5l z!-+gTHW-3p=QnNxx~WQmXkXkpg|GGdAZ)#)Eg$9AyD+;>bqx7+(Bqex^ro?pXd5I6 zC46JuiR3~HZoOr~?R%vcv=+cB1U&-h6yW+cHQeqOqr`Wigb_$6@e(YQ2>V?qu>_P< zY<@RNbbyT#j9}~X52HkCKIq4u)5uRblD;m?3uKh=0vjdbRH(iiCD_j1V8*6@KB^dk z2N@-Lei$XrKt_pMuuK}~~5A`U>=sUDP)@6`T;@;-!C$2AH1pbNF3w`JH6o16) zSO0|9|0Av+8fB7T{~gzV{d_WV!~@3l-C$hbi|`%S^LAh8fp9(W8?UE5_#<9FvDqa5 zE3YqX{lV+$`G4j0{{q)H{wrLcFxCb98LxK*^Lo)#DW$*X^(bIo?@SAxUZ?q;*Z+p= zbAQ40WB-Kf<-xd~1B~lI!|PyNj{w5;Kq}pz@p|t60k41do!5hLJN~H0{2$`v21U|I+&Zf6@B;-}I1Z+rU5jAy2@5NclhVLn{3b{gCJ&Kje$Q`5`4i ze#m679y0SiSPz;1T@RU)9!LVxLju41A))@z51EKUpYf|7lJ}<{a_N8Qhdhb@;fMTV zC5>7l@MnI=VJfg65_4Kn1Ya8V8+83|e#j=UA2JI(FdH}gkABFkSAX+ED*e45@ z$!a{su-XXa;`arm*e;fwL2_6CuLiU)n@`J~ z@IeQN#jo}uYf_rDFr1zgl8?-(hz6OI>fMgs*|i@lGu%xCnRAVYg)4$sy%Ab(W00;k zVxgKANaj8StV~qH zGWY{-Z{p}p>60)5&(9MMhkPz#?&}17x(g1`bM7CA*Z8-L>uyrXSMAQP?-jQWVeTVA zhxbn43;cV&vrBP{%}*Uo#I9O*a@5P#egr|6DSG=KaN1^*G3NS?Y3FT%s3T;Xcg)D|&%tT?J*QblI@tbP- zE1jM$CN0u=Ji!78VTiQYR2 z=CIHkd(~Gj`Ayf*{o7IE{X&qxSuGhh@h8g@4ogxaq0ra^m`qQD6Ppl?)D`P4xR9tP zDuq~d@l~l!JR>O}*5lQoB(=R7+2J(x?#Q0xO2Phv7}teWO5$S@ zoQc6AE4uhEK(U(Ubwe9Ga4$wm{-K!nf z=GUW-vTrEB{)N$H$M9_Wne=<@gbu%fTH|-_1D8@ZzWLgTf-8ramm~SwNqj3uS2JYM z4!wllW0S+FMJ;luqxiij{1JBBUVVaDH7u#aPkGsdfxM$5R_N0>Gq%9u<*ibB7iZ4} zVw;%dE9$elUa_c<<<>Fd*v2@%u)Vky+iMF1v7}F&9iPl|Rv9;{syRDoZrvYo%*dy> zpGHyMCrVZw2!t1E(^u&?V<8r*S^*@8drxZS^qN+gC5q?eckE-{(r}uNYk0PzEEo77 zezV_h1faU|1trqFfr6&(aEvMY9#_ zo3to9sD^T*FGSh8-kuSeY&&Fq*;yB}OyR|8@L<_{>XG|6)SpAq$AlTJZ|M_p)A z!6w!(u91UHM78y_^OrCXb+l_TE$ew}eAK7%C%Xe#)OM%!l2aSMwe~&GwCu!WcTPL> zd}cNu=O%yJ3bMY6wLdd`lEmx!N@0YIG>0J%CYj|7Pbqarul&=jiEG+7uRVb> zL>j<~4Mp-qF+F9RL(U;>hxL3zo8Pu1t4m)d;Ep$wSe`)K#v&0RzCD2Shw}ARL~bjc zlJt+M21#-R+g(%LP9dlJcoK&Mmb`>w51lKWH9ZPgz_q8}u$FwSH zL&UoWukCN=`z}8!Q_X7$JS;9T0v`IhJriKI5Bt_lZ)fppJ*l{yk^fx|(QS9lv|%}< z*R=8%SbLuLyH$GcsD_x$zVT-)ihrd{wV;Ydpw4o+ka|{%uT59bT$#;;8(&qs7*a~m zk*}`P@gh3$R3NdGK`Mw51NPHoP7M#viRKHJcvow94mWnblD&+(AnK~Lg;&74g!AoI zQy6KSc9!kCh_PEL$(3$}DdsCA430dpZ zsa8D@ksk_Mc&T6$DW%!j3x+vtagq4yJ8#p4%9fmoGhf^&R{Ot%Nnehlc`Sj}o@;FF zuh{PsLOrsSXWzyIj}SjOxFQ9d>IX>|v@WC(`_!`1#b-~s|FFIWPDyPFliHO+qst`E z8W1HcNTmy)T?7YLz4Qxlb;ee03hvNMn63-bd7%X@^%{Xr)?k5_Er#ca{piqfjU*!g zG2a)89P0HVFN`;AMfoFwZ~IMOQPdphD*X!OoZ9G+pIvp26;SKx1BRG%%ZCMl;ccEw zoFpWfl=vN0!$uE1XGl^d9)ZlS$fwN~5PL@INRaaIDwTLV+xIs@Ri@rhr3V}Sq{^Me6|3ijBs5QHe6f}Kx`0*qb}KdbKnoYosIgY~OZ>RXt0%4K zjU2NRZ(qkS4?KHJQ4JJZt139xtO^ht1m(FLZw0rt!CQ95zAYnF7VaHq<(m)gc)j)Y z>N-IA(K$ixYjf*IeyK;DWaNV`X5`_XoBIk}JiUuP%1YV+crCK)iq5-be&&K&&qbK% z*o`7-YQndW}x~5-6VwcTk;#V(1^#HCRrpeBh3{_-$M|Fay+xN(Nm_?Qn>C3j^o7I1bBfssn;yi?mcv)@lKZ{s0quYS8lCI0$Lcex@n*|$U0;pV%tcwg&xbhC zsIr1Zo|P4~zIgHXluq;4)ScwP30gD*;K{5{m)k>LP|fQ^z9*u{KtcXS1@WB;LM{85 z0r|6S;5!urtaN}Jw}5WBi|m(gR1iWN_dO;bN{<{XpsULr3@pzh{9gmmYD4Q3(};be zgW$SUgMJ9|*5@9N!eCT9$Yr{3tr^1*Jbz^m zZ&Ga7?tBaZ*?k<|fpBF(ava)$-;|3hI$O|G5|ZHCBki7Cw;PZ6hHc`xOLq7cMzfJ@ zEYjxU0l&>ig?MA!sB)X^Sh$Bdt%z(+fXy;z!W#fd+dl3PW7HCs2gV6m;vK;Ye!iTQ ztJv|Rn#KiSN6(NM*MNzIu{2(91Dc~RW-z|WZ-%4dE(R^e>!^q%|78k?)2N7_F=%bt zwPBR|zM>`8yVBh={1YDpkzHtOg6}OKgu)#kgyq(x7T06L{Du;{k3}ww>K=!_IZQb@_j~!5MTc_2JQE- zSHXV@K?`*KQw-Yvx;+_!W>5@Twr??L?_ZJ^7Nm%q%U<)~7;KYQ+&{CIRVj(!C#rjb z_GQG)r;TFnBhweNuO#UVjBsP7+|z1b8|g(8Yrw0x;`w*YI`iw36xOs;J+TUkzCNE{ zO`5E#aXssn$ccIjoM7L-h|0}-ie%F8W@BJFaEy{f?Pu`W^0)O?c~;gEKqJ}hI(zBl zo5YdP#YB71I(t{PbV?to+jaJ0_n|+>X$| zIKcZfElnHpxxDviK|~P1SLu*@p&D05O7=DNmoTDnx+TZ`SXM2YwP*Z(0qV?;rXePg zc7oX3T2LV)8>5{TGuBoNq=eqBK#+k*Ag){;xG{?GRDL0Wc+UEb1OmSgL;@lBodklX<3r&8B7yk+ zksta82L%5Q4hTjdrAH%~kM*BPAl`}He&nM~s?rgFKJpJ5Kp*)Rw`H_!(@+T6A_16A6hKt8!eNmz0~M(97U;< z&BY?~1)Vn*T3^hBm9Smu_BEHwx|iDfjA%b4!_NtzX{hLecJX-$66?;1s#Z$wb@>GP@}2>XXGm1T6P zhjYbJF;M+U(!8>{BLPOjh+ly%*NR%zQ!e+gMnt}xj|&q^26;Ft>_A1bzDE)Lj=lg!K>XA@!nK(>ycd8nh-u#OMj=&f$uZ@Qn=EYU9-zXZoe zBCyCXy{6peTz8BGEq&zo2^YL3@BKnC(BDhN&=p~L97*%aZ=k6}LH46HWCRq#y@|>R z*S-Tjc)m5d#-E^;BCNDFt0`!UT+aAe31|xHxc)aPgJ=~mK4&i4jFuoUty7-v4{5PD zhDH}ecv{-R=5jv0@Uvc~hEaqi1#E zfLpSqGL_jNC z-J@J6$qAYyHKJjl>?;|nQ$Kgyl&FHmgC*Oq4{=kUTe8G-JbV5zHnWPbawU&m!dhyZ z>g5bYSt5l~6nPU!8O_b{mrdQof^vO(bbQ;_@$B_yIgENKL(X3c+-)pk2JOj+rLd5? zQyBFx`Ec$oP@oJ{-Ji;xN3W|a`rQA~-p_qXq~ZZsQAt1Y|1v;2pi#OzxSyFp2OzKl zYBOx|fAr%nYnUfcLg{ot0?NH6$bHjurtptP|8rvpJ~`;XzV`yum9oTcqsaGU;o`(H zf9Z6F!b<^4Vz|E#2qw0&sw8vI_dxVCvST(sq?d~A7i?xa-HefTS!$8 zT76pgqABcHhXK}xIkh)mr$0B4GnFB0d_w?Nz3{mo zlQK7lFp+pYBDAm%je^rvKSU0MqnvMv8@zlAEIL}8Cl)KZPszHEveRXck=m%uX}EA+ zTx~(=Tb2;nZcS1j@$U@WTWlpMp=4M{j%%qq^?3VUPWz()3T!=Cq*eX%8`6Z>X`uTm za2k-T((S3Dop7R@DxR(f{V40anJM47CIM~yKEUsGq<`iyo&sX5>R(%H{M_1!Pd?$) ziL2~EdZ$1Y{V~G7mID?0F~Yx=24y#%!u~$OKl1;1fPXf1n;Dn_)dU)0`|_Q(D*Ev~ zL*5wjTEZTnB{E6T!fAS(3iiFxq!yqz)v1DME3xFMWr>Sau{&yAmt)S?_q=t+-%k!< zRb3^HX-X;ll(DV3qqnS}P+WVR91R5b-nw5P zE>0P>0$an~hsnZggj@2{Rk)R%Zv$Pfk*-}5yG$*uy6+3!Ln9-`V?ZopK_I5aW?*!o z@Nk6h6~3bR*qF5#{ZLxjCi`|SFGrP9ap@?~CgFXaFR)vByHuAS9~6dbSjyCN_1i?= zx6!3&jgJp4zDh-4;3&6=NNY;MBR(`B1t{snkTG+~%AUMZiR8k5sS+7o`sW-d49z+I zoi`6C>6R}a+@3_KyMmN-S^fck&3m^|(+ITZROA(7)|~=1{QXsA1ZwY3#SR}11GycL z!aok?=gw~rO70&8#0Y}YV#}Mv5@jlCLF(@Z;L)4yAMjbe(}_mn`CTE35S>5Ox;~bn z5v<^QO7X4R-&+cD1+dd;qa$Btym*OEW$`A@;Jtc#QA3-5vH|i_GQz+M{SPw;DET#{ z@k1yj;C6veL~{F$>HMuTY=RpaVrxZE!tF|HD@0sO>(*a2Pz!o6uUl>so6<{eT;IaF z`RmOZ%>XMk{T7j$!v+pnzMU7U(wsd_4+blq+k@1iEbSmrpBtFJ2A^4 zip%NxdiMHBa=j*FQIwbxCee*$H5-vEC_AJ$EmD&~xdp#nx3o z_YAD>ucd)+?TQ6pVT0aJKMK6$Koh1n^?b<@XJ!vlKim3okf+f%W~uvAoXoMW%2WsE z4e9us%0LSQ>}M;2N!&0B-q_E7TOv?TdM>mCHZnxhn`OCxvo11=F=b!cffJ0=cj|!0 z3$m&Ln_;8G=FDbHh+arV$E zNEMi&rC+1_?eFaW65a3XiJoqK+maN)dwhj{)zSxQwour5kMNCg2?50_Z@~Yo>dD|# zX%m!OtvvKwR_2py8$1=@Yg4=)*=$O}^5 zVj#6&{iDcT2}-VAt`(b`R8a13(EY*BCjON1N4tihk^9w)9#n&-cM6mT1P+ZN0np3q zN0z&CRI$wgCc=H);vfR8yLcujC92#$(23YW3QTC!ADVH`xY&{AjkD$*JYAM<%u6bMWrU1b+xlpYle|QaLt5dJ*+0ng6Lchi}vFr(;pvlM! zTFgI(Wb3T}K%SX2{7*LH*;5*GecRx0vsQh!$4Plf0)VXfY5DthMfx0zYct;Fs#y2E zP~Rj$3HShQm^?xUvE?K@hXk(S4;9k96)bpeZs8Xa0VbVCeEtRfdy@Cu(NYaY7`bqI zy5R8=QArk9H|+UWVb@$SWOKUu%!y!dkGQ5|v?lxkNNnYP#4HexRu1(YkCr2e^eb}^ zkCxog>0fxXIP#ql0`mu(;W$C)vmptDKA$Q7M4wFp-_Yl0>u>0DN&54d#3!{PZKay? z$vUQ*yokGJs(M%Z9go&6_@oj7M*%LNZ-bc}tx&~%o>l;@{565J1LnXA4 z#+2vpO(=PUATm-D&DS*^V7)F9o~5GT1@Wt(bo7C|75VlU zvG_7BKIi?@fEjaVzzm@WzDAe5?=FNPFWvCyO&!voESUXoi**-X z*1R&3>yW46QVyN`Vlf5vD6$1&`zel8iUBL(}HB1Lw|}OBBQp6!Liu6OEW{0 zIq##qV4)zPEY2Xzou?mA7pE$(`091Vm5RUGs0YCm_5TPRq6_|J9Lz&+GqQ5IvqL$* z3IV9Odo$lY5(AqHG;t&(t}0SF!qSN1A&s%p^&vf9RinmFzh7?3KFmK?DfA&)mueN0 zWsXKLG2GAegU`(UMZb$VpM|yIhrTCPl(3qA|i$u4WyXNNV^+()?;t|49>@(FS z224A9WaNwSx}7ZU{GS#J2Bn(=Z0JU~SFz?_v?BWvz;JFSI=8Pn*d$-@ zM{AYt>0M_hXj4ZN;ASn9kE%*HiomI@`8kW>FVRo()B~$0mkDNw;Z2Ey*I(EB-nm(t z3lwrn$=?t?UbXRyO61`Fm^JWGsHXCrJ5zqUjnxbRVxi$o`wKBT>+Wd-Q8EsS>-Wzj z`+IHd<1$EvpV=Jl%{0{588^k~hKilJTDc(QoN<<55|GZhlP^0Zby-Ie>N+~wzZFt< zO%ms+EVTj95I`%H?2`tCEvHX5_BZyO{my08B<2M>_`y-YQRXlSM^5*=3^9n+Iu8NijFxwaSt&mVn^tFdDX>eo!dlsG0GO| z<(3N8^b)P#(Rs=s?Lu$@9EY00wdEIy{1~d&hSCgxWF(!ci5*WsL0$ChactZ;H||r4 z=CJp$aVOHLsmgi>JoFfwo@b6nHmhG^vIY=V+*CcZ&Uh?|UAL^y%Y7GTOkyYz5_5IO zmlYak%Q(C)7Yx^9!;0MMvgdb3ovBR)KiG+?&B7{GY7TP^VPj6b{uGxRJX3;dcq~)x zsf+6hm^dMX8BLwY!&F7*=|7s-(0Q|#gHPSYVn@cd78zzKor)-n+F(>(e>ir-%(dSe zX~{qL>9NP^;~ybgvJ(-A*vb?8E!3 zc{5!x7PKBAilr@amWZB5R2PS`$DC+OZC@+7fF_*x7E0d_Mc`3V_vT&)Cb$JsF5Fy~D8w~SQLH7NZH+r^$=lDH-Ppco zPB)UmJ;G5uXls&Yt!0Ac7jRE3{cg_dmQFw zyG}m#V$8Mv%JQ{LqUp0*@>q_cM;<1DZ|pQ-UhYq3wLRwUX<;Jn<^g>l;w9 zm5)C2?9=7mxa{LXB0Ulm)qAtivtxPB%OuYO_fbz>m-z@!l7mz8)+3+?uW^OP)F6n8 zWpksSQM z(YYxXFTe2=$_Lfm4R9q6EpCaMOPmc&knxG#!vx*2F$FESE_E`W?oY-AEuc;o&f z^sEORpg1WN_rxDMjcK26T24myVm>LZx>}0dBqN!W`XI$~#rSgF_F6{Kg-^HZz_>Uq z4?44`6rPdFzNJxNB-<7$`ed=b2tVqJkz?cn>?YX~L3XgJSr9&H(|d{dlti}|TXOSd zM;=%W@5^t96G(UKui=1(dtUNv`h@q~%b|%kXE^mBHRf>NHgXNESn4$!3xF5f_lvK{ zan=%amN8-;TCY7%yy+Wf-$7933Ln$a_fVMO)8`(OIIpi3b)+7)kM~s^bZo3PtViy` zVRol2$TMdntapls^ z(u71aeR-h!5${dC(}|-q`sv`~Io%R-{#74-oL+cn6`Ts2q!>5ja{;b{6ETubZPg*s zBkCKpLpeh8#%fW=%!P>S=#x))7T--(@PeYme*gB*M z~oEVkR2O#n=_tw)HjkIHif|X%!!;LDXD2^Cd;w>(7KNLyxhgy zQbpxna0z6I_~dz=VxCIpOCD;>{S0d_wNKd1(6Typ^qszFSVr1K(w9WA$-UEo50pUUCl{v_II@&NmCAgtATY23{blrGHJNJ|}; ztnmpOUYj+&RT@OH+c!*O$9hUKk}e8PJy~UGwPYUq@3R%}5u#0kLcDsA$b4 zaMO=Sz{Q7#rFM}zM3KUj_%{|dOr|07R%^tpyR>_OaT?>rUl?cJ&PB;vuH^GKC~?|6 z*q~%_&AMj3IcfGhZp!C4OxSNR-EyYyW+friXS1nqkwKypQt(_if@iSv(IC>CJ*Pq) zwV!4+x0<`y|B02Iav;08&C(mzLTLd2WyHmgh})}adz zk+OA>jNuYbRL4-^>3P6;VVR3Aj0nq8VTXt->`cBhuWBEUv;X2e*qC3yfEBFjHydo) z2sz_Cd}81>{zB1Vcz{yHG}1Q*Hi6j8Ep5Z+e1&2RYR!lwMs z#EH$~hMfX(0dbyN+NMtd>^~%cf80lsTo6cpBs2!8hN{Z1_*)Zuy7_K%et#Sb@JH&m zB=#i7AXQLh`I(MdKK@JMf|L2EJ3;_-YX0N+d)g+<0{{DL{_ivPzpeq`*Xv_XeDuQR z!=cb9q#P<6|L;xgHJZ8Ifc>pr;P*5&8=P|@_`mx2YZw2T2l)5f<8DA_FNO~Ve&?Y7 zazKFFp6KYs9M|6l<~NN?cuwHxznxIv+sSSO5aq(%E&d;u?ccBHi+S0`8$ZZ@zuNy^ z?B^EX-|m(@qIkC()HiNVHhuD8bBKR$;zU4}Uv3PLxnV!WzBvIr>n=UXcFa+vXB+bw z>)8c$f(x2AkkrOh8VbMeNbaVBvK)r9P9>*M^PU;=v?B6%|W%gTGDY<5R%dfS!V$n;SL zm@iy|^4$immdsC|OVJp)=O?UH^xv>wCTy3dQp+F?02>|tNJ-5BzX9#n z)oLRCDBN~FPggi{RO&RZc=HPzwyA}E-Wn7{aXgPk`5dDx?z(v(d4Hr?z=8Tpa$Y+66)@_Vfx&5*j8g)!tW3kLARB7#_(Qp&~zV@Su{?9%y%255LhY)G4pt zes-<}Bvsp6rQEcbR>+#J6uTzlJkZWmmeh9N3}EjPBfG$X0b^hjK-k(PbCuFY4g)?k z#jrI=lf`L#(BQY=d@iKhTO0Z8BKLT5xzeUvx3J5Fni%~l`-;Si%}BdSIGqPQ+{JL1 zP?}QQ5j~8nakelzBZs>uhd1(ecw(w(O2T5$=-38g&uVm zx#)wO4JTPu)^&y@)6=2+L_rC5N26yRi+<`KZ-A!cQ^oqwcuKh&yGJ)jw3`bk8F3R_ zJLj-NCokcqhT#&0@ffc#A*|p^Nn4!cz3CaZQW_qT*#tF^?!V|J_?DmwYPhm~uD}?Z zx*1up>%53m9h1F3B(Q}Ibfg_~)Mq#rJb4MrMfci`dz(Znsub@@q&4dp*vdIo-wFH^ zd!Ewx2Juo@uxDV;T8P13fd3(9&IWjf_H*;^CkONW>E^ow;YOoN1?%_BTrfMrvb>pg zy0@Yd&ecEoT3$^cVi9hTR2mWBT;yNA=8PeoK=eO~x&jKQy7lW`aPfqgi9NzDdWf7ntmK=?8FI*eF!k71p1=Pr~iX z4->gA?49zYl6L%z@z#~1L};FPI>fZ+0|Xs5VAoDr6CZtCwoMN$_^Av^9L=2;DEagX zJ`$c?v%}`48z-#hbG?txdIBakD!$b0QndHByP|YgnerGPznM^dMm!Cl5B%?M%&;)zyA1JD=Ny`D=%l8Nujf zG#iiZtdreL>=r9K&rxS$Zv<__BA~KeAjr~aQPJpD8A-IeE-j!g<4ku_K-*>^`I@gw zQa;9sbd1X8MzQ>*uc>$ka%ij_+DEa=BAnJ9xsdVZBOb|Eq~~Q+-AhxR(nj4Tdm7A0 z9WtNT)XMWuw^Rr}O_ycn0^-Qh<83wfH^Nx;*Pe+g$Q?~S=fmj9+}@HLmjuQSt#NtR z$37}Aw}0K(I?E`2b;;AkI+`Oj2UR{3talF6Y-jc9nd6py1)Y+Q+Dmr+fEBr}t`wtC zu14~ToFUrri-}!}&zzfM$nTF4OgrPGMY;1ujUR@UGQ?k=t)H*}yGqr`mB$qmvNEF2 zM8nsPy)E`vF5cvue@1lpK=Kl}gsJ8XJv^W}ssuefz3LrCj#?Y(7bSqBOwsmuZk$6oe$CU`S;9cDj*;LQo#>R6h__~{uanp;cLtvmsTK!F5F zW*4d=hs9-D7wS*7NSpW7F9?B*CMeHa&ie~|+XJ{%P=X8gXOFP&P%rh3-@f1+2G|YE)+L2$ zOr5aS{b*0CaY#F9qQw_Y&rv;p~P!xlh$|n{-tBn_cStA9+ zpxqbqMhl23bww}`@rOsJ5_^MYAQG+filKJ7l)Y)kO{Va`3(QH;3f>#m8#V-P9{)~& zgmOFNd6apSUZ!-UQNZOMm4z(S5I8K4_y*Mzm0Kx20@t{e$QO_d;z|#&97X=Ba&5Bm zqAW!`%X=?Mg87Ibn%WqhjFux~dn<$T5&agGA7I5{a3ZW^E9z|uHa0|mnL637%OFWp zWzG9aY8XO`adzq%Ppe`1k;uD)Km4&~Rf*yPn33d_+QgGNY77nP>VR$RcN*P#r0%~Y z#v}~XGT?Au*{0vBtBY5*p5gd9LLEOOPYQWDSX$eA^aegI%>xDtxV_}=XZU`*_U>mu zP=Sk(knkM(fMW2P1pJd)zn|d;+9f)NPA(RL#w^kS2TJtNL>ED13HQ*n;J4sM5PR$W zlqQ2i-!@fh*&}PL9EcRL$cJfCx1zWX&IA&eTg9XlC+G=77ANNk0|#)^EaydJLM)-f zKcvWth!7D$xJ@XsA&6(*six2jr5nEtrEfRYyeR}qW(bQnORrRV5>~I2b>9eushXc#k)!-@Jx?0jj#_%25*miku!klq{6R!VC8h4TMrB6P?0O>Eh-+ zVeSDP$mpD6PwBQRL=Mr0Ma59j`NeJ%ANwIb3lGqN5rYwec6h%42v5Fsx3-ea| zJ%ki~%Et+jWcvT7T10THif9x$1`sA_ODQ4?L<$h{X|f6;3Phk8ROj#1xk5?HQL~Z{ zVjkYDB*}w4y_N5Kf9AVOLD)fH*Zl0?w;q>Lqjd`ZQQx0RK%sytwiE48M+W_OFGc&- z>$~oMFL2xSpPj!}`F4{a*rzk$BG@ajdEVY70IZofGoz6Dt=L}p7~V=`GNg`poPswD zah#qv3=&{ma@$V?f0?`9{n1TkMyvyoTXlY8&0KQhXQ(ICc`Ne{5Y&($$$W$R$~FCO zDhQK$HDDgiR}>C~l*|8H!bjYP8s(odzj7tDRSPoI3nCzU2Kx8eFJPTCBQS`V%q?i0 z^m_sDFJK_?rUuu61PSOcym`HOL2Vf7eOJ)k2)FV~P?7Fd-r0K>dKbni05DWQ2R5jM zZ};SV9Wu25RcvK7Ni|ZnpM{T7wfeU%`W|2%K+wS4N-n0*y<6#QQ0(8D3v5=ZL{zI+ z{ImM`G`xF2f*y-PaY8jPE47L#h`%b}$8T^EC^)4Q#QFlXZ_m8jhhIlAP4t?GYjITT zAivGKaaH8c@fcq#`QMFtFiuutg7d7hd+OSRCGpJfHWt>O9DYL9q1(KY@)W*EI7cna zEwOg!JKletZ9zwM-cmH+q7pYy8}#_*an@T6Z#T^go`50gs2w2hmf~*)L2&%|@j->` z+s;=JPYj($SBj=*pSc6?O9ws7QL!0Wp_M4#={#s$Zz3aiW=HqHS28= z-7qNBQ&%$1Np&%Pm$y7F;dw8dq6ux!m7aLol{Hv;umNmSSjjNUHDVPUm2iTv#ogFG zVgR&-!c_n%PR198@Tsr>6odGYfhx(P|C9QD(NEC+l4vOqTQN{2esrs@Pt=L8iDLqN zf_{}aMn9N)xadF5`XARpOEBp4$I*j!;@zHV^!uQSlGMVPNZb73Fv(48FbBwv}LXpl{_2tp@A1ddlw= z+}^K$I`oJ}h(e5*z`N>|Tu%uK_%8MH_>jbYmAG&}7vvRD?C4=B;_*v>wR!F)MoA{Ptw6xR~ikEkI${) zz>?=$=tl)js%I3K@t9QiJ-D<|GWjlcwk;a_!m9f0U=JskW3lf!y8()4fEM|sXMs#> z7}5E0KQ_NQgyU<7ULSlBh@I@u9Vm$61&?RPs}H+1iKH=-O0DWu6^o0)nx)DVnlQ09@`9#IRRFR%m6y z9WcVDkM5)S2th%JF0g%RK?l0sZ-j^=eepdWPg%!6tr4DmsC5N>s=in=bIEiL%bK6& zlbBVBX}4~zyxtCg3Ofv+TtN=LQuXRdEHIYIuWLK+@lwNFX4GYU^a3JOGT7ILJ8YV9 zyrSDn1=CCu^r4z^2KrF-eSo2CM5Z}JY<6(pr;|2#(f(IHTAa545J+wFWt@LAq z&4zdDl+Da~U+e|3tc~!pupl61wk=s|3j~$GFMu^wv0u7O#2%(>uS-tm8@K``-K?*h zDpa@UqKM8Rnox4xJf+6oVO)faS6iaLWutfL$wUt6XL5dlU5(1jn?Xx3msDldqCMHH zp-?s>MR@#PoDQI9e-=c2uP&Ce4$G3(GNFJO7z;3v$aQyoH0?fPekv{?Ls*Ac{b19d z*CkAszq9Um``vy{*T`^>%vr7@!Od4R4iVByIF-cIRcI*=Sahm5M&oLD%WVmdauwbA z_&rSCK5JyL=C_egSmS11TDMAH`Co)5PG#iIRAwjd8J7YhP5HPNpC<@1_h*~%#&TIX zN9!1J+F4O6O<8L0v9G;pwC;z|awsb2APlT`RxBPldWtv~g7j7Jtn7H>>3 zIDM$6`p8+>a8uVk`Y!m?kn<6-dA?4twm&@PqFOLEvrWAH!}o-alWZG_Pd-&zdTS|t z;otmJF&~~AT(ptTX2aqHD^`S_>)a7KvKG0?67PHj&at`jv;@6Gx^y^2oeUosR=cRk%gD{H?aBFstl2%*XkTaXytaYRG>+{UB z)HGQyWVFo4pLEUc`y4_>Tfndj_}ht-ku)>fuULfEK}OW9DIxY9W77~mLCSBYA>jJ7 z*vNrjS=W~;*9P;K*V*?MT+?pO{Z+tKVs7q8N8CI)=9OT483s<0R+;)&=n{>L&2Z!S zJekh=LoJFrX@nr&_dbDsaZNI=wi+3gkHl)W!ZI0P@jb2ON`MX;kR{OGEN*;LPqkW% zGeTljs7)fG^hH}L!;R;eG1!-iR-_=jKTEC+m>DoX$_ZFiYbcJq#u^tdI0!URqF;lg z(7AA$a2*`8vX3pRvKeH_)}JyTsB1C~XPX>Z;T`upHs|t|oGC3Zdc14lUNtQ9ku_AE zZP`3JDn9G&AUZ)pcbR&viOs~!A#1p2ruCh@l}^&{vw0{oKiBakIFv**cg6e2$g+}q z*c0P;0GX6Zo7Z4f<^nPv&ud?>OmY%FIB4ed% zCm~w0z9Dc1jQa^IjRcaoWncnHE5<^WIH~WCE!L*U7Ixn%Rzc$Q96S=`P2sDS;mgH; zZ2@8YX!9PAFFa)^9~{VT3Jkik$$|{03brn^Geqy0oA`GveBJ+MFXdf%?VK3-%qVt} z9K~F%Id;NwpOXIkq||egAbUWglfG(Wu&2gcSHU3*ke|8aF32aaU&17*$hf{a*y#wI zwC<;KI}c|)H`TO9bw+DMdv882*x{8r<>w19_POGsn;1Izk&3u5iI@ou$=vvZkwW;x zp`~En@9(R7VDoCS?G9*tLtKkrnnj1(o8`i`I`^OOE00|X6zia9x3j2RPnb4}2&u>h zR;%SAq<%O60oDvV@HJ47^*3yLeTWOI&81voyt}7_{YK6q^%vhIeofOu{&%qMO$N0 zVS^)jZ60zHO-CB)F=i(oa{R#Ow-$I3+C~@0iOy{jJp;IXH5Q-e%Nk@VN1ipK9?;s6 z9MoSM>9~!@y+OrwSwf>vf0$%cr+={MBnN5b+f#iId1iVKbnnM1_X#KJViIAoZK1nT z%s#4Xo*O%_d~t4RV7a+Uz{FIrhUw$p^&oX+pe))aaHL(mu_&WkR`4s(ZLHK&5`NA? zEa72*_<&)tHJP(KZ@C{aEyXX-)QiN8doZU2@)ndt?0^#yI@p2%%dQb?t?6KrB%Wfi zXUkU%gC!C8yK2T)&qZX!pdTDI+>eQPAlVD6%73})?Gpf#*Y}Cl-TjIK%6rgeK6Zno zd}=or4+)RPRUnCONC`-}a&oGieJX*fA1PTP_e?9&F82gBCY8NyF1HSA`*XU@kj}6X zrQ(B!X@q&C6d&|n$!(V^W)-Y>ddh@{jHOcyyT%4#D;D*~v13s0ZFd+9Or%rO>a0|g z(#}zpmRVj(a|*!~ZF^kj?UQ?{_~LV>=L@Mjz>s#T1=%80&F2Ad9WdwwVpeGWHc$}g zaANnFu;d|834Iz)P?ymk=C$Tl&ZtY-4o0FTCrZFy7`cSK;B;G)L>L^fU*=cip2pGH z8q$-Tm%Pc-oh|*WuoBmhFI^Q~KwFf$t-&sQJ;H8eO#LCKf*SA5Quoz!x!`S1cAppG z0Nzr(AR;k?3mGZEPUU;F?ZbhJp(*QEQNkQTnx^tim^8pN!9mih13rHh)Q>&2gIseH zMs3f~NKT&F!bHQ@RJG!Fnt+BfZ>ilL9%n7J*Ao_&m5d*Ia`K9gd_zX2^O}DmopFB4 zwqQI?m7cb2$i=fBXIOgFH;!+zr5nlKRMYMP4JaqCd-rv~ybq=!`^xRnDg{(*)ro|8kJhG|FRc=8MV0Fva%*k=5tKVx57Z=456K5pp zW#><4_@RsY7&;=qAQBKX0jgluddS}H9}Pw6(kN5w>(`$rZBj2cTcj#?N>;2!HbD5e z+uEm7iXxWAXLkzYCbx)5U5q@66?sDbiHuqr%zDLdxjqyIv4>vCrmOq)!J|0(T3dNP z9Ab?uik&JcqQ|0D1d+Accv)`GXg>R|4~Nz1KOX;zz{^XyQ(sU-tOm@5r9)i1nAE9+ zYA62iP;jqFcX`I7Oe0wv3GgtKN+sMYX}Vd%E)M2gO1=L!F3 z@?VLgLJMEJRalsj*GTkn!C8=bsRz$53w3SLJ{Vnw4bdrr_Znx4srI@i>-I}&u&(GJ>rlO*9i}obiz~4w{+A)M}{KK?LUmx_t zvRWhlhKW?KQWO0kmOJiwzf!JTR1>_3ZavH!Z0NbnXL5+wE_K}rDbfd2M$SSV_;zj* z)6|~C`3zC68YE9L_4JPMzZO6d?3i}~=ufCH-vxQG9&}(jYHu`odHL#~Y?z_uQRz2@ z$5U|D`tzqKEnD3m47MdU?J!3v8fV%p9RI|ARvDb|=y3phd2@6C2ZYHsJ&B~CP`-)c zk|>@A#s1d|7LDRhdAwjR-H9tpt@P8|z`G*O3*Y$|(a&0DDizjWPEc6gS;m0BVUx|R zX9$KV&WBgJLu%2VwDM1*?$H{w#$$ur6<^#a3$7($!s=8TWKzX53bVXx>X zVVx--TZ;MD?{aNEPa7Wpba*aN^!ogSHPFfR?XI|^j02>rF$#qT6uc$%<;H$^-yAYn z3db98bN~|lS6Mnl2HQdPIDfHoj3E8^^md%emu@-3uU_zlK4*!l7~?h+#pM1(GrmnYb6Kyn%q z3vG_Z3xEhPVc(|+dd~;31Ris-upF~zl3n17QkYAB9-44sYXBFOP)2*=up;gi_-_~Af@UlT_JKk~bgAWf`YLp^oEMar3b+VdN4`ySsbb=#<$bT+41yXyXE z**uJ4{g&q;0ptlm!XA`7-it8@*U{BYslcqUx?%v!=E{+1F_jV1{)2~He2*~2NJS?lF?o9o67{; zYRkIIXEvDSB^z3?+L#0EUhYw~4WTgW`bQ*7bk$8_3UKLpaOHiW$PQ5L99ADYnrCgs zNg@G2H1EvALBvD;%r1p6eU#mN0_EhTk`ct$2492la*0_NHa-`!H2-qN+2Ni|8`nTp z0%dE-O46|xKN2we51$*(iOE|%mxmOx#))cS75Pjso3hfF>p*AdbN`a=L9oft;=yM< zBF0k58UoFj9dGe{#gh+J&xdv}hJfMWtOT(5NVgXU=KGH16RO2^4fX;nLU)i%MBp1F zQ*rnQNCt9YM|Z|YreKp-N+kK0c+r=SFUveW+%veS;FL}*d8KVNn!FDQ!emK%|ANVY zzk@Ohq_`EuGB{Rd?Ok+IK0H#kw6$zN#2f9_`ZWZPw)%7?it}ndQuGfil0Up%+rGO5 z>J0~XF>asVk)+zmMa^^WXw5#^Gt<-~1aLWKqFME1nykfE%-}3N%8S4@Av!iqW9@-- zR)Dv)mfQf`3B@T`~%yS?x+&2;1FOe1ocLpY!2nX()hWvRrW6(JK^ z<;dzXM}o^A-|IRFTX6t%AMgo5>jRpf#R1xM9u?UeFzAFcTOUr8VGKSB=U6$WGbaI# zW4a}|u0drBZnJXB3_o8JezGB=S;>==`p38tmwLU^AA>rR84rm}7a||Yc=9BS{G^Ya{@vV1 zD14kNgAmheI+vRHvZ0S}<`u@ECiwze4Dqu(Lk*C?lOgWJw-%xW;Z{}=!1g4Ji$4R; zY+A0I#o`wQ!$LwJ+Vj4gPR61xT8eOamsleU>QzxTKH%kf?PQ@jJ4d@8lEp}meQ{zO z*yLT(p0B5`Tv^m1uynNZSd3N36 z_T^|@=#2{;L3+ev|NH@k17C_nKe(tq+;>y{?8oFy6JPs#1AevjjB|wi-PZFrQ_qeY zFAzA%dT%-;!M=Z%!^Dq{=aUveSo;hw_4ww4X<#o+M|+Z!T7vchCcChqnsJaIx}vom z1gq+e6v>*)2gl8@;^O8p$h7^ekl(R)f4cuI!KHv>9#aCOY%52KoSjdOt*J_o-l*lo zmeCI6_p_;*I)Zi5{sIT`p@aZV3#TxIC z%M23eRxP)2BR_W0iF{o#MdfIQJn>9y^_fA$W^Mix%nS+MO)qoZ_q5yF(G`0I@7z>9 zd0!x$F2!%ivp=)W&`u*}+g#CDNus@XqUQFTwIcLvy{3iA+@xr;LO8d{B^fa6@AjOj z$S5!2c-Q{a{ki$fQ_MQW+tuR46&E-A?RKJC@n!MzY-fJUrT*0h4WMpcCQnKEA}hIz2bX%{utI!t2=SPnR~xEZt}Z5<_Od(JebRi0m>CU9;+BS9LwTL)}~_EISG@tSWM`CA{Nh zyUET6`Y{zgT4!IJpTR%p&dTIZOYk@oFnK+_jB)JpD6-s#i?Pi$2|X9!F4b$#E78*) zUmj<$z&FSK)PFmz1MW>(wa5J{up=`0a@5zX2-Xwc0Uh;NK9{^)s|D741k7cz>4nHelw!{1WG_>ueO{I#UC=&T^FK zVWIvHuCt&&TxZ93t~1~d-Z57U2%3#ed8%N^lm!AtoZ8%kl4Rs%_ekHaD!)Bdqn9b z0w*s1#`>968aZB-K_=Dpkyrh7&?SM$z*;8eqWxg_!7^O(?G&#Xg%EtqpfzkH&m{hX zuFQp2OmIrV7yDuI>OdcF)?|c*XaRCQ#~+DOg-FZ`s^^AL_V{2HJ-4}2E(Yvpt?govSuknl@Lti zJRe(0K6nT#&6wlrOTNFc8xi_-Cp`mm+LCcj_qb80O|c&nbJK1{W~NzwJ)3SYt_~^5&AcHiw)RtLeTuIKPGCC$IgKaBGo;1jhe(o5(Ra0?_>JXfsV%}y@D4-8gOQ> zHojDCs*+-(rf5?OM1PW)(!s$$ zm5BIGV_`RWch@>7+uh?ICh$p)+)m&_9@5;>53V>uP(-!V&;6n`F(~%5Kzm_r640|u ziOmNY(lNkUs!7@9jf5l{y*Qhk>2fc&cox8EPS4xh7#_oq#T%Z(Qh)e9FK?c-w*1cd zS623S=iiqve|7#@X(w(m9EKFqBc8URQ`!(Sfl5lXc#bc8kJ9>-7JEuDeCT{_eE zed&x^4^EMD0BG&Z-O?G85F}{)NE~QLd%{}%V)MwW9I6kc>!?P22d1s<0r9k9E?=U} zEC9H#fwmAy{~vpA85CE(e*cCf(6~Fn-66OKC%9|y;O@>QxLXK~TM{5h(BKZiU4jR< z;1XPJlaVuX&dmAGPtLu!?w$HpQC+<0F1mZ~#q(KfJsIt8tVp9DdstQZK-Go@y_|}o^k%Q`BZv(D^oB!jBB_}(W_nAHkoHW^4c|9z2t8!4 z%_f_72{}VWTcPZuKz&iehcaj9BjsC*`A&d8FiKI1v2A=k&qFwVKsc~x4Pn}*4gU&l zVaL5=O#~%8eXR;6XW>hCS27?&+F51r-nZ?h3)b$Wvc9VFI2}=ahU>c#F`t*Q>epGE zx0lXhdAb=Jze9h{_vmk{_P>Pw#zlXR{;FWQhR6U2`isfbh1dKC`s+;)tfJIDmePCG zB2ZI19G?w6)jztN6@hG>^UlYDT!ysN&I%2a(y!`B_-I}tAZRr)pUe1VkH_1-#24Io z!U!?+%JHtV?~sd0XB)cb7!j2PxUhD#PRu3enTxmGgVNLEPj%JQV+!oL6rlhhg>C*r zXR(|!!gzp0<8?ur6Xgo0tb%QD6>BCt&XmePq*^-X<~UA?N+ez_QkuGR)slp3jWq&u zas7@KSBP&+Pp2BRpf*RP-P~J~CyzPMgbKy&9Z6Qczj52h#LVm!<*w%Mb5Xer%kmmd3lM8g_E-+9D?Y(} z06~9)Cx3?imQel-{S|ZmCG@Al@=xgR2l)ejYq$Ml^oNG?zl;9z6kwnf`1&7&K|v01 z|Kq3Qa19fC3KH~fclCk>!9mzxK7{?T7p(dH750brEBh1tJ^OoZ)czax*ZM2_^FZY* zE-M285ccN}VSjn|?C|bSncfVzS z~HX2**2-|3&Qzpj5`f9dz^kMAe;r+PNr^n?9PL(m`agZ-V{v%lHju|Kh&*`Mma zVShx}5cc;Z=#Sao{iF)`y&=mH!v0k6*`L>6XMY|4UG}HbTFVCfH`yQY z^Zz;fyPs46f0g~A5dG1lYX0A|zrJ7D-^)K>fA^Cr;8#c0{|fuN`6KpM_z(7n{VV(9 z==F2VQhp0O^P=7Q9s6thmHqMmhW+v1vp=cdv%m0r_DA=F{aO5X*x&u63iuuS8~+pb z=l@sPAB)pxG?WZy~C!r@KL;Sv~rO$hLh!KyDEYDoZ#_J=tpaBr9>PSV@7Up|?E-*9mx zM$7B<3Kh?u$Apxk!G91>nz?3YmMZ57WvTTht(Vg@7FtdvjH!9CDg2A8>Vn&ew&Q10 z74A}0hU;XaYt!pi>8o759b+@Q$X>52Bh}34&C0%G;ECnXOM5oUK~}HXB&7H~O*0#A z0XGQvE6lXNYYcF-u~^7@QoKWu@Dbt<=eAQEg+W1)p4o{O4!a)Y)qkt>LeJkb^mp{H z`^)0F);qPP+rtVOD1^0bD~(JQ!k}x7=MsIkqvOe)V|+5TkeXD~QpXa}HwkwpoH0y#=<{hwqKv1uYPx z_i5Ch8NInIAV%+|nZIiE{u7@!@JB{(V}^eiy=8*`)#%;+i_yCa{H-A6w?=Q~%zrX^ z6Fq8Ci0w-z+J%}}?K@+Ay-Ecx?P3d0L+bEA8(fLx2CiRy$Cvmy*sU}sRak0z3N9a( zXo+l`fY}1kOdwi%!>)vj3Hs`<_fFuufJhvM-eM>2(yMZ};3@-Zoc8dYUN-EOE?}Y5 zK%{@k$^J;r`pnA-_a8?$HE-93kMh!E0Z)x78Mv2?ikA`ebS6tz{cAB-}au9|Ry40^fmrpu4FPRVD@f^mP>> zl3mAe9Htm9;l<)}8d!M3_mWeoH5_B#Iegd-vr3R&Dg+dD7Ha)lKOIgr0t%v8xo*DU|Q+?7j)!;CqD;Y{a4awX)W8l-1(XNBYk?fNt0M zMqkGhc6}AQV|9)>HNdD;Ay%sEr8ZPx{31nbM(*K;9PtC(j)wsOSqb*XH`yUgw7Bls zO!*3C6;xXb+m&7;Le1-+cT<>}XRkVTtUMFfzKA(REiAlbvU>}4sd3ZA-B-*!f+0df z*JkZx{D`o%6p4W2u;gs^yX5Kus-+-tI%=kqZyL4arn8)ORXgBgG@kT~zrQlAv>`EJfPg-rWE zngWlaC+h&llQ;#p5bH=g6s+_`J+F(s@_lIZV55vA#h7iqZ?`TY%q9+|??OIH?V?F8 z73%lxa9qS=-*`<4?naHS7cOJZI_KR!)1JiGy2@1H0-`Oybygqg{4KvTfS=B-W@7|ft%%sL_&Z`+w#XYJnkyKHH% zD;1r}?{cNEv9(Aa9Pl5BeEVL1*l5f%uRjTgqS!h~jO{uioj-^q&d={=<|GOk^Ld{On4{iNXAbD;?z<#FZXT|2tPYnH|KHF71Es zN}oab)s_BNP3eU4vcEBHRMpIs)>R z#Jb7_lY&?femXe_2aNXzqNTcs<2H@z8==k?&`d0$d7eJ)M0^Xh1<>jU!gfIdb5E){ zt`BAsPlz6GNzEj`gaqblIR6ot^F;ZRz}y5RFgL{iFM+uFu=cR|D0e z;v$QJ&g)Me{qkquq-xLV#ttI96S)Cr99x75IJbkeQO|If-D#6Gxv2MVUxSYnwmENC zNUZ}!EYWf~g$5Aft&z!One@ADF}_U2oSSx$GvRnD?l4qypx#tT2oAo0XRU&!|BkUI zB;o${m%Q9Rd8o*FcaQjgNBrLL0T2(B{Lp{NLzPAJFCHr2A0Ddf9p#qadZ2#{@Fv-_22+w)iGDn>lw$zkxxHGZ4c$nVI-N^BL}^}V{UR}z@RZ$ zNx!k`V^4|hIQu9-SCoA7o}m(r#n|qX@FkQqM*u!?TMb!U%mTR9@sq?nl+@gDevru( zJQgxb@VNdPq%{9SJ%T9h`L!V`!+<|ZQI~7zyQ!caH@w~7_xzYsIVk-(vtJVqA-YDh z@Z5irUg^8!Q~UAv%et2g=(?1G&>iV3E$yu`3-9@B=ts24$>ve zH)rxx_F1_w7wF^=bdx)gERjoTiY_UDffs@|;J-E0-x}&~4fVH%`iq4Fe`}~eO!ob) zq5jrT_dfK$HPp{O^#4C;sOrBp)ZZHFZw>XghWcAW{Xsjz-*c$H=TN`N^8G!B`Z>$@ z|G7C7@IRSDwUaDbgy4~|{{BQSJQ%%g>9U)$Emo<3y4Y63wQnFZGQ> zDdpgib9|uK`lJCgPrEFcMG$p$a1Cuc2dBW=WXc29?{e9u0 z4e$7j5%?QjwCEqHGwW(xG0Ckp6DND_a%txjt5KU6ullwhr?6gYWI@-$PShxGe$mih(~DfHMw&g731uZAgiS;Nrnc? ziNk3>K};}6;cz=)b233L5m0Z14iiX60lzFvlR_z zNzvjAsDYVlFGqH?yoqKDkD;;Q+(3opgr!m$--u>3_G)#PdH7OPF-X{yhhhcgnrvUD z_Nsy12J@cKG$yUXMR(`bi*j~WhlI=9mo$32O`ko46J=G9&F^wycDdut2EgUqY@_W) z?@mMC9!!*&oThj`|55FK-|VmE5MfiN0+1AMhn?K~NwL4U!jEEqt361uKh83w*gs@y z-$^HWsXUDi+mOn1NPsL5L>>rp(r}{iQ@iF84^&%2k=Ic!F~4Id3-C)rC<|${rtkjd z(gIc2cO#Edq7UDEi8Yu)(5;eb?{+HmNV8~j+h+?@f>in4jpD`&U*0L=h6cezSQqj* zo6>W;Q8Ba(3YR(!rS5R3J#x(z^Rw|ppFOd*W9rrms&}iauO?00JA~e~`X*GA(Ns0U zINK+aSWuR<36MYMT9MP`(&WgiDlB=!l1Y5Vh8rzfj-%5gtKLDwAEu}U#AM1zN1TPqbh6`?< zdQKI9)i9@9s5WlSwJ4hf6Bz}qJ-&(a*ED)yze!_&8Fxbc-oG!(+%`3EReX?>i?$#f8s%1&V(5^$K(p ziaEYGHe*{z!M)KPf=rzoc*Dvs*-p^tL;)Rw!FQA~V`hu+@w*u_h5b8VoXJjeC+|q+ zt16{V=~t{T3a5oBB*0b*>r+g~(gpw%vH$0-4XG*5+H-^=5BoErQE*H@axb^4wZ}e6g8u119Ou~gM+|3iB}U5mmp;r-{!j4mjDwYyS`!$F16Km= zA4JdM`?}l6c%t|_Q|!u?H#BR!Ab75?O?SHAgX{wZG=``&Hoddd3iIjQp8XW6o`T)5 zIszkMnq=7?K5LdiIPxaSPF{y|k#TpSFmGy)Vi0DP3_ISCEAe1thslnG?u$BPUxM-N z48JL)4)fh_>o9}v>oDal{(T)L@K1f1D`;Q@0UFoDS^Q969dcqbrXbu||2LO#XT;A+VdVcP^?b(WHE(6G^)ZgKr{dSp;hF zW;(q`Ul=HGu&KMuWU1&k$g`TRa@uQ;Oa~K8FO@SkRPL3V%|E#mpd!$~IyavfZgPnE z$L@<)k&_zoxjiVjwVD9NHI7_|cK@UrY4;8t4Q5pd;b7>wm7R{;I43{zJOzugWUmKcuVvs;mP3L%Qm( z$|~SLq^tg_tOEW+y6UgWD&Rk)tNyC20{%m~>aWTw;6J3R{;I43?#n#?1G?(3$|~SL zq^tg_tkV1wU3GeAyl>@6QEkY1H}rtk+H_%O&jodr1uX3Md@#6f=bPhlIUyjMcXuOQ zZY{$}t5i-v$nM_#GPge@(L`%mR2dU|FajeAwyFhDfdNVoQFTczNdF=D%Q%b%SkwY! z2KFWf!GkL;K&YUmYsZU=J4>)zKMXCDC^)+x2GYW}ObTXr3~~lrRf4E!uFu}amI#DU zUaGq)8}gsk^DiW)ktyQjjuOxe7$~$mpUNTm%E6dw3oTjw1u%fa|J2OikUbPJxTOg492uWs=)n(* zL44rHoiH@uK1mQlwS6%N=OLIA9fS_02Y!wYqBhk$#ly#NSCcbM-JmGlgrU_j#ux3E zPfmZzXX4tMOfRdMT>8{-tsjf3ftc0lGpE<1^=9($C$}rz!^#Gzu!AKw7bMLvfsd|d zB+f6&8Mlh>3+l5CJpsFTGa4TY;hlww$NZ%FiT)rQDJL^Uhx*WIGzJ@QWAhom>S2Hb z(nb%5dDYI3onUA-xT>_Jt+%gS^f6~UMgH!S7lXuEuEd)LgsS?)gX!*-ogRe2F^_ zdr?AWhBu4e==)=B+|o|cE^FD*ERpJOGFSm;l6KZLZzgLmLT)RtUij@2yBzt1I< z!i@w(*JYZ|x<50@3w1F6wmuTs=zz7jmb@fCVQQ1BO+pN*2IKmUPS1KpCs2l`*`<8n zwTh2dNN3H`&8!!Mi(s$Mh3I@bA>qnxqreoY%ay%N_myg@hDRAC7}5X__CWyQ!st%I znt!DMry_vJz^3LPRweLgN51%Em_}QXRVI|FN2|&rq@?{U?{(#e50yLc&XAIJ^gOrj zDCO@`6RgQx7f`N8Ygo)^CE=wbL@@aN$pih6?k^lkLk1KO3s=A`H3Gq3%eM_Z_v8i*q^)sL4*#ZwA!!UvgjX}I% zt`iuVYQPvo{t$ct3(5mOHw95aO;p>Pg1jGsuc<-mU_VEY`TyxzwZJnpAX>;bVfYeq z;c3J{0b3w}oF7HFPkoo`v8nS6c-o) z7nB9_Qb>%WDG2O@0#brH1J8ekA&0U9Z=rzb@k3Uh(Qs&*c)bzLtM)hMFihTgLcv#E zPOldTW51~LYP$%G54?)CuN2s6J8INGG zWMUmHDQp8)OJpHrv&e^fEb|A!T78oSFoZOdOv_ALYwbXDGhzJTAH!cc+X6F>=I@GJ~rHKc#m;Nc_UOk=Q>7l;Dt4LH^dlnAb) z0l{OtO+%W}I+A(VmdIr_m6kG@n_mdt*;T_j-G3bHuOTlW{swj892+dQ1bG34E|3?{ zxCD9guUzim{N5RuJn(0C$em_l74kf=9+2k&V}6BE2XB7>nL~AfZ45xTpdqk6Q|6uI z-|zN6zuWrYG-41PR5lp-F^B-1qya(%e>DKbLEVDw4MFSwH-8(2{$KIY)Bj)n=smvw z=z$qGVHh3?s)7j@VDQ17*&rnF`6Y}c_%Itp^|%WVf(L_;K}KMo9EdC`!vSf57jr=P z;B{nB2uzP}sHHaon1LRo1fF^e(Fl}@3t-zD7NCcr>n2+G2To5I=fe9kSIP&hl9QL2StFJH)Sh}u|=4S`f zLD_Ry40TmVPKOzMSNykB_**LcKPMH4{;gEF2D4{_$UtpziCHzg@4zHUpt^@K$Kbgn z$mQxC9S8$FkqolO`EkdnQ}B9QdYRj6oVxc!h-Aif@B*y91Q8HnDG&ki;~uh|0=b7^ zc+f(cd<&mKntYolgnB=I7&-n1o}Yni@M|p}8cu2{w0t_tPyI@qOKKW_4A;oDcPC+* zwnAm_g<)H7;2Su4vyUuGH=)V&Rnr74cZ5o-2gH)Wi4Oyw+56h`fi5^mo-9sswhck{ zAJ~~lN{%8Uja_-Y<`>xX4l{tDce)8F>P_R52ne4Q z?~gXHSRoJ{gJ}r5E%XTAmCu?YUN6f+ms=(8ZYSG%9eRa?tOO6sWxA0#?LKNpqaG``OFsg;3uTr;(I2}~~nVxS+ST>ZT) ze#`MfA+eoqUthshAWmfFvUj{IOQIXV;^_mo$bhgA3R)gNziN}fCMiV&FUo+Z5$n<7 z>Vuv`)*%JTg@TpTKv>V2hY;NgIIY+w9$sWAF*knzYlcm0Y=sT9@FtErypkL3)>JbL z5cWN!>(KPOsx!>`QHpEfFkcHg#_v<8{9ZO7uV`V|g z%5@1;5{z~74d|x2SBNZq2pJC{RUpkm>F?y^-kWG-@sSw4;cgVQO(>8oi0*0VK`DLB zT;d+)t`-<|$})`FZ*7V_VrQD{o?|OBKN+JCYZVs__Q8Vu|8x`u!hqBNkR6kS_n`{} zF2#aeY}ukg7Et@(^k@(s^u57mTdn`wuUsvn^BrHZQ8>U3A`=qM4%Pk#v@ z_Ds~#f2sg0sNPZDHz4ioZb3kAwXC;ay^Ye_#2Q*_?fl3a@nV{RCqQs=qOY|J#&pPXohB7BAXNblTv<^hz+LYTSWrOOl8@fh|n;k z&JSHm1ctb0{SRD6XUV^6y*KvvkUB>LLX0aU&$+8K)}X0693K@9?~a%=eA}B<->cDG zrXjS!6m>V1;7LBFU2)-^#$@Jgbn@zMrN9~G7Yp)sa$D>?ugcwA-1}6&@9MxjoJF%5 zhO}%rZ&e4RCxOdZIHt5&HGP7m&zC3T7pUEeHi<>gK7Y;E@=<%4EvNrPsO6g{(0$>{ z<$Ro)m1{e`MJ=cjaemjgEX(A15F>LEqwO@bM{+Fkgi2Qk=|-?Rk98+E#|X+& zq-qXB)SXI{COyL#5PeLF7AS_Q7kt0`hwJMJy%};C6-7#{xkwIN7}Y!YzL)``+aZIR zJyYzWM{2ugo@?6gItIrRfYSy5hiJHEYszIp)}0O+FcN8_o6ZbGdFg^gWsSh&>_}Zx zOu@jzXU5BS)v$CXi#Wwf>0d6#oM7W=VKtcAD82sm^FX7VkwqjUcQe(k$(sNxg6Z;k zLLLlb)>q;0QV*$^`uL4w6%fAgLgj{}>vLT|P%0H&YTcWix!Q@8iueHloBmPT>wd=9 z_#v!*vW>o#-uuI8dqY-%Uds1j$=#gK?|4(6-U!eRC!&C_qbf$xpFH3DV(s5rP9Hb*%|j85xcS;$p+~{S7U>z za0pC&Ve)!*_gslWL17HQCf?o}$C#^c^awP9kBFOe%AI6uLeY%AIB-#{49O9|+|72j zmj+RHWiIn$Ze;h$U;^1heXl{4dNv#oGyuz<8_IkvMa% zV(}X14~TrzHl69T1FyZ;;fd%o+GzyZG6L|?M#sYR(D31@AiD+e_{@q5oQRq8dP*PW z1nrthk_D3UDHZde`PYmI&-2=wt&%y5Md|Orzy>CEZ=mq53>3pV#AeyiwWRMzCM<`O zJ?X}#!xEk&aR}%Dkd)iF&|Zl>Mn~IxJ4S<&7TVB7eS}C#V=^{4ppM8>-EtL@mO-R z#565O)1Kt_VmL>3J$V@>t4Bj5%I-k>gdZ3n? z*$EBD1;SI6*O#gcpPoWFH+2c?qZOcWPMoEK_0{1e2F&>3Su3IG4-w|{*&15M_Ow-2 z`INM0K!-*OagEtQ##bT{D3rV#UB_t?8Ny4Z<1Zv^s+6|n>MHQ93OsFhvR*{!FW!~~ zI2O~|Dq1o+1US+@nZ*GUB$x)7p-5NEgbF`DOm}I3X{c#4KSlEI=bi^k_TzR>JZENq~^oamS{%{W{_)NNXh$c5LMOM2eUpZihJMlOcKlb zX|}H6+hjkpg)fiAp#7@c?I3MlZQtUDvIav(5I0_e&A0*CcEm6A%58Nvid_t^W*f|F zQx~4Q%wd+9jgS&L3#m^oJ&a3lyZlI3s4`KVLI;#;IB~iauv=l6zj7bWg6tPGE)uhA zckVFl=k1hs$`F`HEQ2=;koP`BHCpYoSu}0^%sJPB+-0-G(I@Zq#bm^e(E3Gsiy8L! zT>>|$=Z}PCJ3wWy$S^N!8d#p1ct2YfQJdnj&scX!UV#bE(-M zW=$Cg(2LDlS)Ify-pu{5r-MKp?3qv#{etd(kBDwD9`!v7da#-P?`X#w+NCppR9^f8MS1zuPDa{zr4G`GQv!E5c9O2uP z5WZ06R&!#80M!P5U*dxT)T^Tb|Cv@|4-Vc4e3Z8%%_q3ASR)1KP2%I8c*>N`fxoZ;3Pap z1G6z_6YKtW-#xgXwK6njZ)N(hu)b)8)db+tv*dJq*6tA3E6G|W4(nCwYU6W#CafV0 z<-EZ#Cu;Iu5{}-9Qd8P1P|0n)oHK7^LOtN00{-T-_tL;e~en1A1bF!sJf|D+d)~#W^NG zQr5c>qfXtQt(|C1Y!+TfV>MJoaL@}JVIX{|yt1_rtf#<6j;k?L3#s&`-JOz%LEBg? z_UjviC1*2a>GmkrE*Lo1JFS>ML;B)z0csNKYp_6#n<)au+eI={pJ_g06!*f$ zeR29p{P7vbW&Ari1Gm9bk+$c!OtG;34zJFzMM&j0=XOFbh-{^t8_iJSQ7-4AcRs&R zuaJz)sb^rO?_c3aVRLF35be@QGj`djn{lz=zPal7Y&Fy$T7{k7!Qs&S{FpEeLne5_ z{(hAY42?zEM}$_ONMRE5&V8B%6gAl~+h5S>I>9mp0>g4AV=svqUQ=`=Qr$qjYTc}` zE{KE9(nzLFsh*puZOeM02+L#BMb8hs2I|PKy)$vNdUF>xW;@m=4H7>UhaIK(c)f0D zFnP47aUPNZv8wfB_{U(C?KoDT6Y9-$_NLU_Th#)}?Epk0CW83~#G<~OGJ_;z97Wa> zJ|Z0qVhy^_Ok;FpzH(DMxeb&Iwan(viJLI*6`XRV_@-Q*3$c&5v9KJb>OW<}2 zu=%B*oQAroZzUNJq5F0$P3@owM(?V5yn-v6YoT-YV#klDyQ+G_XA9<*1|$hSqh=&4 z$*+6&x~I!?evXjepCfW)=?P*-Q6gQKBdlR zUVqOZi&UkKsGgaP-gN$H^{j`G{<3S>r;N)|T^~!!d<>@xrL>O7v1tKm{+cTP1A)tB z*w8rH?cLM*MNx73*AYb5D**b<+b?q!eBBMGAU+d=JWcOMV-xy)ABn;46Tbz-ovUZak?9i0WBHJ=;2mXgoS_S1UN%Zksveg_mzeeXIA5lK`^h#437*z>NA z@s~1G559*0;`QdN9|m(}0R{NVwRTEirKs|;WPCkGszK@Qi|HxyPP|A$B_kelkCX?r zG?V1U^Gir|3;UlhKe>LNT$~=avGbd$;v}jc*0DZ9D;X`A$HlE$Ho=0{m|k_|^Tq5L z8>{@><;nZ~@tLh1QFc^J=l(q2ls4ZcDR-NNT zMNZcd?p%`05ElwkCQ<2ea`BE~T$?VYF8JQJWBwg0dv%6l1-hCrZWT+=FNBzyH$5Di zR4B97ALt6-V3Cd~-N=#%JaNv^2n_ZQOFVPw9K@wCX#-0*5T4tA+qUe!uI zkYvwUu^M>}uNIb2X$7Yq>R~qJ(M7n98se6%? za3Ci}a<8#2H`#k1QIqW-hVhHSN>5ihRbT<4gNz4F%Nw z=-pkutw{ZtBEfK{ra^GJU>gW1uTOian$Pr=U5)(CTK?@wBOUFTrkir}qFGqQp3$s` z%PT(af=WFxK26t#{tiuEwjgO!7jWQ5k$yhpX-NblZbW)mGxgRFXR&vPlX$%R9@Nv=1Wse!^@&! zgBOSVW}nOyAq$+rN~t#Ep0D?cI#UWV2q1fXmT_tTh|;nOCrHqinag?s-*x(V4d%Vp z(saOR5vP%&vbPyw2^2FEGwt`-->Rz-e2Cz>(1I`YzCEfKgTik60#aF^DiGc)One)& z5vnd2j{z*!hS)Hr8TLQ0dTH@=SP42+)?8!CoN95pngdD+DvR-Js&{o3AaaNf{PG;@BbvI=~F7X{LXDQHp%!EtLvzK|L_Zys5zZd7i z?@Xi(q|*(|Jk};5V&8-;_Q9nenPnj?!>foc8wJwL6h4_0iA-f-=<^5S);bW>XxWz` zah0|^=(rD*k7c-Mo#=oFG^h`f#eJ?i36)2mp<)~gGx!HU;W05s%Hk2n)+l0~%FSSB z8|vGvYGgx9YnMS6PsURUA;r-pS;DpBSvVA%+!rnq^mP^mS6|w~vWX}^l7pq|a_#De zg@I;O(k3lKNMGt;FVkYgJPl8oauT+dAN=#f@Xx(0c0ErMc_ju?f(1xS=P%+6*|7N~ zyg3b+}{$>9kIe>y#9mFy$xaB2Y@vm}3?|4Rjq%-W6G{EU#NDV13zE zIxw7dtnnUPJ?5D>F&{#e+sg=)jZf7Si3ChAxe2mX$T%a|vd#l0EQgPlKe@X&lP19pWbG^Uo!7 z9LLKJq6rm;)f6Ah^B|llYHcaC^}c{h93?UwC;U`2VB!4f&HL(Xk>zF-PP<8_2}1Ge z$6UjE$*-xsqp1-;9!%_o%nQAH#Ba?)9+SjxbQIb{PW8)!+;0S{=D_C(u60x9oaihx zWHUe;veY^!<=Z2Qs#EbTo>il&+Jy2dJEr&Wdb6KX-Vj}cL0irERI_L5q9cSz&6O62 zYBwdgTEFcIbvjUQS+fX?OD@GW>Ub)*+Mv!jVd~9%HNAHQv)yq0NI%EqD|@Jvjrupk z>>)W4hOERK0myabYKF}J3g74XC{-z+nHMRrM1hDS^|-aB#S0-DmD<_XwZj{Qi=ysp z1*iw)V=H-T#8fyTDCD&Gp@J9-3gF+oF*G#pUndJ zq8rJ)zV#Rbt>Omq!kF>ChhbZg6F8AGbYSj)KD=+DKW{XhNAqnOieNAq+dsB3I<{iz zoB1Nc+)B*jq=#b;K%sO0aSGcBYtyUN^vyHKd+}!q!>y7X<7Yr*n%GNK2 zR4A3wEOrZDz3Q7FsS!5WS0<8*u3~`F?g=_F&_*uyNs(xz`&&f=WN7s-bF5XB@Gu`V z*0NUa@7$K;h$|U*E%KgT9ejn(vMeZYLd*8nr?A9brv(iyftt1kSakyUQR4GHv%Q4X zGEd&WjWU8A>ZhT05;SR$r%qiK&vUay;YnH*NeRi11?={a=WrLkU=q$Xx}ME5?Lp&X z2Jx2(^A~x^os~d1Dt0c64n0iakRqJ^wf51~YBbi3@n+K$0Y_m;I78)D#0p4L7lmhG zKiJk6V|+Y{_olH9SIb}K$nwZhdfXNBToWkcN1z9Og%B$B0uZljl2HKE@$nQO_ zeiKM(wjpa~mdSOU5eCJVE2dbr6$F`M*$e<46&gKr^)dDQF7^oEEoY}s1m?WDa9$B<%Q@5Oy9&c0K6uS?4YjgPu?@1BF8f2`Vp|+ zL0duWjHW4jQpqpphncV)SGIQmGrxakbfaB=X?0-zt%~cJjSfMK?j|GWMW}|wge@YX z&S81Df1$NwJ)uze>XyaKvavwAr@vPpA?uOn;E8AF8B`xDaT9X*>5nm10IiV~*DRQy-FYzN&pd+SqfBMWpAwW}&=CsRHo1 zkV5)7jl_p^wuG=DgT*8(2joLJnIg2YA69F5o4OK@cD`UtT$;F6UWO|=+Qc9F&qhlf z!4tQ%$6%z(i$}y}4!vkK{_KPc>F{$>Bp31I9ibNyZ58Xg;x*ogRCC!|0oK^@)Sp$B z-t0&P+P|bO;Gh;kb>q#~0qsS;2#n4@jF^A$Y8d_ETG*_iR*e)H{X`DB=Jide@(ZQF zN7Ewj$wCPzY-4MLrO&CzVnd&iJ@j$LUwefScXlq8LHhW;^-S$_IOztqyS{@F#?-(P zBSqTI{KGIB`Gyw0XhEGSl44+iTh|}@5-+L2cPiqD$*y43Q||^HQQ=fiHg;0?Z8E6> zxu%llTpIKquL<;>oNSiwrpka>lNf)Rkdq12nR*x}5~&xOyrVqx>wPkU$GKtnj;sCg zY%+rkJQWF>BDahe)vF82IS3bB`o=kZb35OY?hx|Vin5?#z^uk-Wqg2&Q^O=7m!H7i z`HQw)y`i{4kywOP{`koKeYKBBxy)u{#|y7vJ;Xd?{1Hi0LVY+ zn|f~&yo&ff=pR&cXt@DpHraJ8giqA8nR5sk`1DMT7}EJX;I1ld+l7b%kcr=8XIUPP z)sQT$lLYi`A%v;35?nzo6frsQyaxphI_f~T+R1FJL`sqdR~bv9 zmX^69(c7Ud=c=@~);B-Q7TdUX�JTqk(Kr?8_hEv}}Ctrfv+#sSQOzasiO}myoOC zM~=@((#4dvicFBf*Rmr-T^;NQTc{JT($F?lL{IwRfWZl#Qa@zXZ{}F}*9<{wg22V} z)&m5??SKz<7!xFCYJDSJPGa=LJ#Yte?VLD+ET(=O(R#Elq>q*hOHY0YY+Z%LH)sW^;o$9x~6Q^`&lc;5x= zb$#P~K~k=wxu9m^QgErR0)1*ZxGw+3)aD^0DhmDyBo`3*X457qdMZ+@OVeVoB5&rY zI;r(=7&DPbW2u%k;siik$RC2e??^zFS z_6Z-Wr4Gdy^vO6GO5L$)-OVih0@Q_~(%Wq^GZUPH&$bC^nzXVJ49|kzxqmh?0g|d; z;>i%cHI-{8Lao@l?k>ecAR-q`#h&x#l_rpV@6ldNKqc~q!4ou3L!%F$XSw$oG!+W& z+JB^nWu)JvrO21mv#9mBIoV+uu8y$^(a*;}&C;{dER@PkL4>MDj)AoEDSR5zumf7^ zXFSF0R!a_ZkHeWdDuwzii+5N}RKOhxdnJ^u#EwP4I*8^oBApGaMfl_U=G3t=dKXB9~g7eJ}iR^V^ZIXeCX=4bsq7=m3GFdFBUXYG5LqfkVgNpZiKUi~!2Qu&VL zSlPV%jlih_M@e!RHiWJC7~`dq+;=E+ovWOaCyuPMFQm0*xxmWMCA&rgfOO1thd;+| zlTOMIQ&^BFg{|fUDWkqLU)6|l2ah}b;t_jWx2z@tt5GtQqh4X6C0i5t#`?@Bz(w!& z74yhbJAAQsob=yIhc~EDu@z-TG9VWg9~-n*pQt7Z3yi7sipE%b^k4)Ee}fl`jX{c` z7`$A3Mol3E=(_vU0jmLmKsC7+D|liD?d>L0UmyIjd(?XW6Z_-gL+lMr$Q{*H7hnEP z(BW`~jV-5GoZ3Nd&TiBjw9yf7$ngSFs9FaltzEP&!m>Ta@mWZZvtM|HW#@I_u&p?EM zs}z2oD5^7OugPXDdX_SJbVPzR(9AU9HBaVKy}Z|QhdE<>)ge!09Z3g7RlB*|K(>)~ zR^iBddi7VfIA;%$!bLKsNQk~P=3Y$#VIH&yDgnh<0TX8Vfy};)7e0<%;kT^L`a4l6 z6B^>!Gbf)99~FHJN!xc50EK7cQpreS0i?p&vCYc{FJ%F zaP<4w@V=85e!DFl9d;Jg%RT|fOM4nPy2W$KC5DO)8DlM(z}_b=SLB)<*JFX77~zjO zRzd0Y)Xvf!V(_-DX)CYdgl~z)M{(&LS-A_dA+IGUq_k*Vje)?tbHP>X4bz1$_jKpxW+@Uor~Hqt zmi5(nYO3NGXXoSCSOIK|{QH&E%jNxSFc*~u#TW*jQx`6;0re{5obnGkJ%i~w#XR)W z)@4sg_{FKuyxxYQA3U8ePcMnq%B)eK|8ka`k~E*ea`|nJ!5O! zs_g(3t~H+q=V_<|jIm^bCbD)0)ie0s@7QZ!hk%)1J6_WciaHP#G>9#|En)5RF7>5e!AZv7!>pWHgP~QWs}UaDdWU}y zOtHo$MtCtm1VF3c8|dxP%RpgOBL|9ZsK+{-$C-^NWMg)#9=#x3FqZLf-43(7dCI5l zBTiGx+2h`7BT3;AgtEBQ6(*mTBi=n^_HnUnnI{sGqvpv+BNa&B#LCV#$XWAAFLUZF z;5|EZOhKe4(Vp^kr4ZpR$CyaLAPwas94~(4Ccz{k35=hAw)J~v9_D?U#rAcs02Ksx znfq|A$5)K@BTd^Y>uhDT4kYyZIToci2Ab6U97~Wl>Zm2G+sm752-RPib9c`AbF33W zLkV{o+|K#|HoE+&?JF@%YQ055$xKF_*e`ZzOsx-Z5M}j*cEmlvTxu2qCBAUM)LzU~ z-P<35k^a~`v?3Y?+rfu!>E-@+R8)#WCm+_?^vQ?@Gi%HJyb8rqgJTe+t>J?^MJ{4k&|sVsCV{R7X}?P!7) zA~$cQCD)P-DKpY;Xh)*woo8oslQ6&-m@V#N|9K!kSz{Mf3Q@AAx=1Fgk5q&~wqdJ` ze6iWfOBI`<1CN0UrZvs6(82W(qH1*yY(?Bg(%tk_A0c`*mCc9^K~unHo$ zQpe1lOQd@RzNC*cpKC1_)lXF^>MkNj(-q^4ASV(sv#}-)rZ)uoXjd;0#|Q%3a_06i4`VA-T2w5gKN@814PVfi~Sd?-yb`4zC{()DMfE?x#4Ih;NSho zA>M@X{=E+>^C{*ufi`y)bLF{WjuT|Rlh!UCCM0=jGHy!n>FYbb!m`|gjZWm=Pv_8k z#E@B5$}-IRFX&t};I=X!hgxC4Lf!o|i@h)kHvw}&tIMh-qEALz;N8!7@K>d!>YLa` zm)U&16gc-& z8@Xqy56mOZs1|G}ikL1CzeVB>*vq?m1Rr;?_Zu{lQ36G?FfRS*H3Jce^%v=?U2ylOs$A0B#fm^tN1S8%?<4h123Ua0YON}q7bN?Lao85gl{ zOsm-76{2!(cHp3pO4!c9*kZr1Zb#a&pTpLx*r_zr#lHE{+BpH|ZK|};}BHsxE>CwrrO$*}G2_wgUMW|^Fanbkt=)HUy1;ws7!Am#MZ@I-#Y|uhQsFpT zeq`Ozw{iwm0$;|wz>rVa|MGyrf1#iI@bNsh4or)nusnyr44c^NdTLTgIej9kF&^|F z%w|pKz%nAut-&Y!$_95E-Pd`#!|bE*`mX_0{Fw(_VBT;BvWq_?Zf15e zw6xFy)}(fhv+j#kgNRA6!i0j53;Yi?A;qejM*)aaiocOnzYxRwUuC+f#IAXK+HJ1< zzgTsPX87dl?z&UGdS+_s z)}Nz&;$%eTk4UX}pLq8UEqVR)_z<3?N>EY>trB6att%Ls=g$RrPIS$NP-u?mXaX)H zoxDma?r{|?s(!gOqF7F%^cD^{+E&IttqNjpffN7X#ac-x(Q*0?_!^I$E$GZmXn$JI z+6Vm`AotHwtiKMifWL)e{dI^1{4EsguR|>0Z=qO!9by503&r~D5DWNQDAr$xSis*x zvHm*50{#|?_17U5@V8K`zYej0zlCD`b%+K0EfnjoLoDELp;&(%VgY{(#ro?I3;0_o z)?bHM!0-Eo|9>dfUx!%0-$JqeI>ZA07K-)PAr|nrP^`ZWv4FpYV*Q^X*7Ms|+k2uJ zp&4LlM(VCZwdurVb+An>^9MKm%Ly#oerbMfm%Ax<5R&&Q0VVCYUj9@G4-Q#cZ;xTh z^)rw6d{iOJQvg2DDVYm;L}E6=7tD{(5WNj4@t&jx4n`q>g||7qBy$Gzd)qLTo1 zn^u#h^*n~!4c$nYZZ&q$R!^{T6DQG)(a!*0xrQ3)AxMHrBGW`pL%;qPnYKOJQv?Dw zkKyZ|xO6T&#Cn>#mRi|bE(994iA>=|SNY7YW7W&-312j-o7eN^g@PrdZwMHs2Uf5} z)2kSzSK}wQ~GA>sYWORf(2kjyKhV(Yqz{h?jdaDX7ISF8KaK zH;l0CxmEj$)tPqcu8n-Ya>2~-A;L#Z%Z_V8JM>UFke%U8&bzoBp0b{}A@Equ0-Hc1=~abl)T%rIV8MHz zN)0jVIYERKa*32n_*QZEFeq@}qi3FZ)Bkv_Haru07$hgaQpD3tvr^Y?t8+~(=toG%#uL7h8YnqoZ8FS zgcG{lJ_hMv=sOlxin-pw1f$nuS@*+9%UjZtlha8@QaNolnn%}~yWFfu%0rte&Qtm= z{+Ga8>HPl3v5k-p@bUZ}_%gZp8d;w&4A{Gw9?AC0iXIL+DjZ~{&pdCu?UtRT(4n$R(dKNUQr64wBa z8;Z4mw!`nEYoaW~Wl0CHBQFSgz%(pH)J;8pe(+*%io9i}2jh24@Cj(uc=%=mla^8>s>;U}9uGjU$hWy0;_VWDU zmHFd)^^czp858=Raku}62L%4(Z%@J(bHKKzCHLv)|Lfd*c}|oW`g2qH*USWdoA?j7 zBsJ86zt7Y^7aX;{$$A1a{{QCkf1bgAobRYvPl2cl?WXmJR(-Ou{jI=)7k|tmY}n4r z6QNnq(WPVaVicv*olFFbGpXgqF){P06imD%D9-!6A+P02bcycJ+`i^_vBWS$kQdq+ zRvzj)N*OKE$B30W8k){1gkRPTl*2}|(4v|SV&m9&C*C4!_f3l`FAK0HsKRH*1{p@~ zMaZ;2^tvvaZVl2VB+CFgi|<44oqFB+3A=>s`o`7GE>NE zzH>lG3lD{;zu08Q@f<#9Ec62Ncgaj_=d0$f*Fu^(#g~#z1t|kS^eAuA=RZs!xjE<& z&7Es5Ypw7e1tKdtyOVhJO=zCs*&v0v@Q1FJVq8$?ny2INmXZS)IcfZ3iHa8mF|4r8-oGidhs4RZ`=YEqPgc8 z^jkUR6$|a{prZEam)p=RK2)U7gtTRufzD@+@i35WD436c&6)B18Q9#ZnCsIN);SaL zs#WL!{h{t7$lbY4Wu3p-Wn$5Q+}eTRs`0c}C@N=Q2~D|A>|O3CE8aOd%8kr8#Vy6x z1T-#v{op5yYhwPZe3xbr9;79xvrhxa{wHj~->Hg@VB913_?R7f*+s=$`Pr3c(TNRi zN8Gzku4n~;=5^?ZeNvD%nP`JD0eDtlky0a@BGe%ZevUBhn^XjwUekKi>$-kW4cf7S znbzqUx}n7a8IL|B)E|~i5HfuyIF&`JUbyDi@b+RAOeL`1Yvt#4f?q2)8I4ZO=*oE5 z*hSeo+9R=TdAsOcL2qS(#*s!}PI%pqUZSZfO<}(Pq#640I+B~Wl(wuZ{x{n_#Zu@~ z4-;yRikAZg%^*`GEFsN4nHl<886Q9wlkYyv(Q6*}_zG!!^4WbpBd%fNEJxhs)7P9; zW;-rxag527#DU?Ui36VjAGbaA5u5@esE%uE6RBBmF>(gWkca;22@BDaYR&q-aeJ1f zf&S|@u(y)2Rxq*?skK+G904==yq}QB2;<#1=Fs^N6n{j0!kzIGx}Sfk6457p;JM!1 zT661MyE-Vn%(jA(b8gkPqHR-;e@%~nL+_=%k z#bUxeXPYIQ#t=yQYvR`Dr>Y~Q4TF|b}M_32;?y|(q~ltKo+s}3N2iZ!cTl>g?< zZl&gyMo)>1%=Qq4+Lwni7{F>tE1w)0WJSI>j@e4Q;c&uyd)NdO1U{c7cxixBW#@Bp z1H>G=^rb7R>Xz(MY!MW%7r$LTQn1ML2u~|JI%D?%UjW*e=lc%kwx2q!N}IGg@y@ZAeC0^U!TDvK zc8N4=z%y=^D9ZE`I6=Bfbpg;2 z^%QWp>f<+XwFPg+`1`sP*Hpj+40han4~h^16&V_CvroMug$5Bs4UEeTD~k>)O~;Gp z`X(7cU=wXXp;gMkpq(|XCc|w%EMd%yZOi!d;Y_3-Smuw~V>j7ZL>swzq^cUl#)!X~ zF(9N-ZcCh5gxoL23VU35QKi2>hycx6Jg2Gk`crtd)swY2L^~I0=;CGr2U;ZCso3?A z<$02k@-{tS8m$J2B#2@(`;Jv{lF_)N&%0m(5}}RhLvewOX&g{16l^xJ3Hj!I$My|c zFvUUL5{%aPZle{cW|x;RNGxzF#+KEfHeUl`T(Ag|m+@m&hLpUaeNWup5CHQ?+B$UD zy@|M9ll6$G`#B6~9E+k-Gmz@IMpj7SC)VK^nt2U|NhmOrI2`^zKbkqG>Ibo*OD*}x zRN1D4-9A*D%ep*V!|!?v`Hhiz>2L_SHagQ9N3wE_*gsqA8{{{n?pUWZnH{%=80P1p z6-VbX4nmLcp^kjeJJraafd`QCc+hOQdc5P5Bh*C{iKPSIp-(8eelA3!h+B>)H6RAz zzkQ>s695;bl_e*ptux2+d@G+PpQ+@>D*g4H?*zC6>fRk{L5f1jN=578WdK{R0sjcw zcmF}09|}}~5skS)jVJGCgUtmzM$L7D#o+QnQTD9A1}J&e7xzSLDaHedR9G=*hg9m1 zM2<8j_Bl>%Zq`bwox{e)YRu$#;5Aa#AN=c;HMyKD#bfX;-RB~S<_M=hQe!O%k;j}q z@yR+Aw4f{%7L|73L_PTqn%oE7fp6Wxh2aF#QxPZX zx{iipeZ@F;wK!zgB~*a5ntM~l&&!7QMpK{VMMah&6vcxs%DVl2j*usV1m-#q^6;ba znWQPO$*a|RZ}03v)ICjD&&oD0I*H{>gUv;&dBPRfj$I;a5EV1_l)Z(B)#UZ6zwiqn zX}O!qF^jzCgqPKrGtnls(`WCogZKwduRGhp8LWzN_~#-Wq(8Vl>V3p6)tj?h_kG@siLuV~4i~lDQuBm4e!|gw!uodipaBA<@Z-?ETrTo<(nJXB>-Swk4O^qgV(14; z)#+wO(y&J|#JYLF1uN~l;m*Ebc$Q@lHUbJe*z^j{yLVzXjW)!&9OYk?LSM!qKl6Jq z7xfcWvG$U9 zG2Y0O1OFaK!}kJmj;0HOqO5DaYh=+M1;J<&pQEYC{0T4Fua#FaE*NYKb$6_$7QqX@NgnJ$r9=1emM9@T zv@3AlW=(66!p58j#4BUF?gqa9wk7;ya7`<2i#eF|ARwQ%BuhwJ+`xUTq_l-!P+ccu zu{0-WFN&909nhoG&=J`(!lHg00hFXs7#T^W#C1eMmAx>jf-5`d?V-WDvjdDD=|n0R z^*IEgng}Y+IRcj=0yR(3v07GWzgI>3rQ`^m7qOj%i!Wx%L{xQ#d?L&ET-8ZMcjFYi zEuy0+eLwS<&Q|twkOlKCKMGAbk)BnDTjb=Na~;wG4sf@+@A$>=IKwVzd^WM(*r|<9 zZS}lnmQrcbUHpK&G;wvv9lKG=`LLp_FujYbJ#S^Z@W@MU*_|GgG6XG%RCwLxryDL_ zq5j8D!#m1DjO3}MF*$^}=9ZL#0Vg^UM{)FQ?a4HGipISMgx#^@@E*He5ky%H0ytuu zqb0rsm%xhhrX|EdB&w0n`h!dcORZwUSM8smCaqnd8x85}RXGq@GsR^;HX4m+tiK*| z8p58Mtg2OI*7o_BKl?&~?V)KU3Ic zjdEJ9IIW>=klllvt1QrsD1K3qvj|V9K(XsiJp;%J=FPNa6_cR7&AK}SIY;EOUb^t=N+l({vO}Y7VUPyPz_bu_#hwW#4Iw{_5UV~y@TYW&h_E`AjmOldGMFH6f zGWji1tpDeg!o7y~+4tc6Cejj~0ZMo-)BF5pqhT=6nU03+X5Y;#9lv=$ZUvO6N$*Im zK~%t}fD{A(bwKfOUS(B5YwpO@YiiGFJV~Bkr~+dyrLsTcxW;k}>}69?XDqM#DK26; zEYa)K(2VeWX1bJ|JQ32s1vuEq+A*OljGYk(p*H*a4NFb#mk=`Du10~h@ zqZ_%8XVtt}^ZD(S05WI55@T$A=O@p0-clfK4%iTNPTU;jK;#To{;oG2e?T_jiR^dE)cbKQJwp3~xQ)^cn06MFauN!t7jP64N`Q~(lNIKB? zjB-ri?9Lm~e@Do%6X1NtUZg++7~5{clXSB1zF7_nn4MF;G=7rdQIVNzb9LxSElQUa ze47Qe8L}5UAg(}^hb0J_Fl#7GJW!-6v z?=IBdau~&v7(KU_dzJS!i#pwItYHX~pb0Kb;atMe8J@k#Q_IbV|?6xEO_ zhvj2WoEpu1)C5*{2wn43fVhXVpw-QmfY+6?;%_Tw9APghACc^g>Y7^u#FkFM%(btx zw~$(!xVDj20&92IM4vZp+jzaMX>54V;&M56x22sxQ#W=+J}&{!@%NF1KKB@Tw}eWF zRC{c3yzTqK((yKT&=DV);lB#;SYh0UlwmJ}BLU6Gy zPCWOxHmh@gyq(S&5jK);GPk}3j53MAU>DQJ@(s-(CyY-4StXk;EE*_Pa6>8s0@e50 zq*^ycHiAD9i224jpViQH+qD8N^fm;jtJcnqmD1jw0tzFq zFn6jD@eS)$*0dKgp8>=Vm(y)Grn8torFE+n-ySi1@(i--s@*!0TPBZCe)1x%eFhi0 z_7GFL*ib%22%lW`4a~_Gi$v@&pt}Wu;h~jx2*7yTkqxZY->!fo+=MLbDtoe)v1tfZ zX^k==bP)MIVVz4gk3?~}xw*=JjKd#)Nw^rm7b7EvaFqhvO6`-naDGA`v7HRq85iwb81G!N3_E_871g%N6?;O0ZsRky>6;#AJo?S>J6=Eew70%^DQ7P zS>STub%5W-j|yypW&7>V5H*iD%Se~FX=_y5>Q^-fDUW$4NR_s}D&TB8hM0O&Y0nuP z6InBoPEsjY6A9onYUsU`SnH}xuH#(rM=#Bf zYzQL|t#;lQzm^e#i3>SR=*B`DBt1sx)Tf$!^&dl+ZyEH_t^Fn~ww>=%{n&I&Bm^r8 zf{U|u|67p}7qOg5y6V4J^%)~-wX+AWpsskX@o&_}Od-D8?RhDYbRLuBghkM> z6t#Ni3^)+>jePQ_N4Li1+CQ0~Fnyrdi{1pLWG>zfPrj2?JcC|ElQAX@^7#3#=SrBf z!|;>Z0(xgLf2tan0T37i+#J7H1>AUY$WkrLkVOQMW#e)qL(av4De?eov`LT1EMtit{{jaR7?o?c7Z z_WZa$`0dC$6uUrxWZ*&mG}6xo%`<06QCHKEBq4>vS$(xX-rXf7y&L>uVEWknMo5OX zq%7Q1YU!I1%;eQmGjZlQ&T1P#R zx|$aB6r3E(!5}r%Aj@axH^EAH&$n+MsE+)DCa{0}LuN9Gq#06ADk4ZxEq1WAQDF{g zRNh++z%aYKR^)XO(Mrq*>W>VpQiv~C-)i66W%|VQVA2^M(zD zo(C^9z9p)ssH`trxZHqHwhf$4s}-6|tp$N>&Z<_Lu@k~hQ%x|D2ZX>v%%!Y4oo~?i zu(y;qcKgUm=ku$^gia>Id?&tEz3>C+=deFtp!Gjg=Io zPk`0X>TcSxka@qkSFa#=}S;aSuDXN{E!ZdLOOx7a5dH(gWjRWKfBT2&OE+8!X0@E0nZY@ zZ?+CObv#lT!1-jKw*9!=*)8M1F}(cFWpc?2xlcx#T7^(jHvu)xiz3axeXUle6qiWK zg=)<{EbxciP#E?<8h0i!J)@#m?Xa%_(#2MtH2KzE&G&y*nE#EyM74$Ojm8NI(;QOB2jaj|A zJV6b5?_o+)H@X`6qo64xi033S^((Aar-Y-;&3kW37#o@QHkBhEHQ-S^RM0r?Yfi`W zXx%9DwlrDx`wK{Oj{OSB?wkA|CetMW7BCpeqXZXkD$gO#T=VP-^QVE~QCQ1|+~u-N z*ZPAPkz%L{!pd7L6^pE&q%{I6x?$SLFl6=a_tv`*(8BH)g`$%rOI=o*5zQ!LcO`ZDR;x*n5(M5rS! z8w;1Y87ltLZ5(P^G53M6=1U(}xB4{o83|8Z(j9@?<&7wGUQyy@z9)?6x&F#qw512O zx_f4^iim>sUN zdgR!<_N~-aSmlmNKM49?<~?8l3hoy$67jc$R!Dc%nEo_kA6x0kT7Q0ABqPJo&+Rbd zQ~Ntq=6^3Tfxky(?nYiZ2C~H!(27eTrqtHne4-j0bZBy#LRzk*q=1bO9vlowgCh-G zy^Agq-`F+|p#CvPRatZbx(zU~e-~!(^-+tfh{)`Ddrf|5vZpr-rt+K@lUivD+X|X9 z>j9y9EidN~C#F+N;mvIJFc~VZf^`a(pKHe=B2&^x-R;0 z8y&oap0nHzXK@7MqbBK#X1cZg&@$@?)BXK0$5t10k^VA^YaHf?BxmUe^B>;D|lV+Gx_jU z=KJIf;8ETe9Mpk*o>G=h=%fHSDD;vvI^f*34m`9$!Mu;?+R=uRA(qJ|B(ljJ-gwVu z22opQ3QdbF+Keshmy$kn^)4`ZEm4F{D`XQ6{ht3(X?cB&sgMtFd4G%Xv>}+z5yHCq z4$o<5c{01;*zLO2eFWAU3GBJ$MXxR2E5T(SZ|su+5gwEDLP$WG4r6ZlHfFR(K`T#Z zV~*!UjDH?5AUX4%NDn`ab^w=C=Y%|ozJQc`o%3imsro%g2sg?pB@<=kryE{F;SStK z=sMWms803idyd zxY2s{LM=@Wgg#Mv8@X^jdtUfBsG&RZ<(Pbvm$0v;#u)&ZKfuR&amlJ;Q{0Nv3~xne@NPkouP~=rcDk_ z?zt+Y>IxAFKsO0CRx0KisV%HKb5dit9q<&+!O>i}aQ7|%$z337SGDA*9pyf^hy~4+ z6BM7)7KRz_tWQmHtK8t&)NU+MES@oQ)0X%;1x)}ur5xR>OgkJ9RH6R3gZQ{`qv5#* z*E+A-Zc4gFc&-Sz_u;PD`rcy#d3a~(Ejx0d*wefKOqe=TAO!Lv9{HV4ekx=L#HH1< z?7iz8R2m)ieSj1poS(Y6*(@WBKVACFkC+abG2@AuiJG2OpuRt}M~JMGF3YeFjS_ zCDM;lu`VT6>qRx5uED)8G_A&JpX@}i2DrT`bI6GY+bwh9-W9L1bvl*bv&TIn*|)=H z^R2HFi1l!735rESR_egqreh&MMWra70SC5nC$x0O%jT9*<{xMB3xfTU$d0dhyY6H` z3m%b#be}w;oxMJ5jvd?gewt&~l3YQU*6viBUgc0YkQFd$3l?Hy)PXpu;9SO6 z<8%+3x<#Vv^&|XRQH{bTYU+zbckdN`BE4oCUErnD!?CH6BTP1U1-FR=hcXvU42*Uk z9J+o<48|lEnn!-J;VNJ96+%()>3b*8>NXS*O?p*X`lSNN`nj>#T#M%c*HOSENO(RA zG!t?I%z%&ei1QuRF34d+Li;%*P82)&r&|lHRU)Xt2MZyK_+{KNT!}ZrdbCs-aH;F# z^r{5v0)yq_@E_VbpraHrlx3UBegHQ22*|LQrowWDe9j;u!#_{lNb${E9QC+)f+hGF z2Ws33#wCNrsf>;l&TYuQ!wW(!=QVC`hx@HEKYn?w7A5O8dnQ#r^L*WLJ7zLcU38dI zBoO-6Mm*v}<@=3eBD^4$VGEV7A`H$$pvOS*PMxxKVjH#Erg7do@NoCs<&LzNQ7s@DK!r1lwE|B|=!87d8Huz#nBvUhPlM^}9}{nl(Wx7? z>aL{Ub@85$zbuG#DlPX;faO1G_VuiZx-Oo0#$5meAC%47_UkKjm51*(gQQf@CM%7( zwje|2r$QO*?TqId_v3vw7&eKyI60TTnVajs0}oxxG>CZ%pv3r%?gJtr`-<47N3=x= zlwHU@rp#tMkdn2C#uMi(T4HL6E+0NVG{+4$g~hs~Tz9H1k~eAra&3mIc9{^7Dn7Wu zE288ihYT!5{RJdB`v)9F?{Dl5J=y0J*6Tj!JTqAN)!FzxbIKgOlbw7oeen)G^Hh3W ziQV9PqKu-JZUE|g=OBRX=<#XunSKN0p~kHKWOuGgB2||E=guUfq3Dj`VeO-Wv#j^b zQ%p_Uspc|G$nwjL+QYry_1<_MkK-pV`P4mI%@zU+S(QBm$|b(E(-yX*BgjlcU5PQB zFE-v6{kleiV%-SQYb{vBsYGMacO)EWp2ewPr-jeJPc&Bv%NHQ-=l*)bMkYfh&c&PP z&tX!9J(*OsbLu?j2cv|oQVYk4Nxm>-+0BFyt5mll9UKGiuWE%U4GP^16R#q*3SIK& z#if|awT{ZloL2|k0;iomM<=Jg8y$NucmX%ex?=jm9pz=9?JiYRXuR@D z?rFXCMx5q9`3_vwT#wo7=}{amTvN4P9)BlZo&7qqaaV4qt~gy=0f#wS+u0xeBR7Av zC_OFE^J|&M>4*J?At+|}TQ&;iz87x2*W{hk1}+azpIXr<>bZ0I1yp!)iP#UKkoe?G z`VoB7PEL$@I94(>)U@4c&5SfN(t<2DHZBu4EpB5_$aH|Y#E*lUNUUiL9}E1Z*6h>#=1$geA7@omM0z`emsdrp!Z|`?$O5w%AxbSJj`{!@9BP7gXwRgLCSe%=VdZ0d7U?B z0)nP#%KO78Xj4k|U^T`eNyn|F$|8hWnxuJ!Ran)BGl$GoinB>Mi$Oa5`g>BTr5|__ z#JDgc^2d{G@^?TG`+-BZ6f`#hh0hOn@dO+c<;`!z=#}fg@R;aHuMhjyiw~!M+qQR8 z$2FDIpN>)c*;7h-g6+&2nV|#nF$i8%Tt5Zf6^uNfx$Ct5@HnQ%!0J-+t>-A%X@5`+ z4I%gM+o~{@i(Wdm+=2mznpHN`+=LpvrYSr@)LBfWfE}wEML0UyZ`-QPRrGt{7jf+9 zUTSywO?R9whE9=m`G5DQc$(F9?`_{ed%J3(v=$b$=Bef{=0h@&i5vJBN8#7 z9g(j+9+UVBL75!YHwH$_WYtS~>(B2Cd2?%aCR1cB_)7171uw&;cjo9d6I=IHUr1)L z!V~#s*G3$s#3(2{RK8jlW*zg4US;8otyC|}5~KK=WrH{3QV}b!hN^m>7QNQ&h1(%? zj$40v-D8bFBn__m#~v#xk#0BO%JcVHD*wINFzXsHv}6Bq-LRKh z88uM(K=qipp;)f4QKgrWvIqsE!DK7N3%zV!&OeeZct#-uo`F1->A)7 z*g}OgKN`a2uVRVzJW7Dd8_6)O$TN@1-dxLh8J$CIlRiAiE_UQL8_P;AF{$WKeK-c9 z`y_v|$*YmsClI1%kg$QDLe?`*c;=<$Oly)b77}WOq4RW1KCdMRO9|QI#+-6Ehk^{b zH|`&jK;n@@Y>cNVHVPj(Wo0emUh3|CtS-_g*0PcpDCN@Ahol2oGP0JuEPh`vitanY zQQ^72ugtx5^lXIH^71rwsI;Yg%|aiBsp($;ShIO;jJub&;bTOgQ%Csh_wi4UMex?v zkasl|LV93p*_92wq8*LkgF|=n^rc6%X?V_}NiCw;#geh}!S#ES!knXL`A=(3g5r!w zi8ASOo%%j_IOhY0P~j!bbOdJu4o^Q2`Q4HDwRr7F79uVd{A}ap(OVFEtd3~!;PiFJ z*r=?vIbeAbU8+M|;_E{iFg(ITfME{U#zgP%h(XYb5KefI>WD!CEb>Pa-yo7wf9wSd zvY`qBP5r3LWH{E6QTwD1rU+AA%$8JkhTl?|2y@g7aOt=!E#OAw6eZ-4;wk}X;Nkh`oLzC7;eh~_53AotV3 z;7Bn&p3e@}e($E`5Y`K7XnF4q{ai8={2L4eI5~9A<&3w?opxRQJl=9(P#gx$g5*XK zu28{NN=ZOn6xi;Y(>AwR+WIz&RY`)85GDdi&+#sRyl&n4s)^YM*@GzXBq@~fW(}qu z(xZ7zex%h_2>vkN&=Rcp-p_Vk%JtUGE4$Zrte2fakIPT+1x}W1h_XUYYg62{vusdX znGynT>qyCfAKMaPZNq*2J3=LVA8rhmsFV%tV#3;r!25buse+5a5nNX#4&_Q_>TL+l z0~rb+Dv7|}m&s`lRPSIMqJKOWGVN|FfxOp6RIr?(tm$NZ()vj4fm8-+MvrO6I+JK5 zDpRkuOqX;Rzgpz(#KHpvwbO<2g}0=|zdP@#-tBgkb&}hAntM#V?F0XkvuxN8Y(FLJaifN2@zYq1^TM-YM;PBrV&OBZ~{h z1h17xekejy*@dDc{>hJ5|H-ebTZg;J2ME3%g8cJ?$%!)F_A3g4uC^1e>YN*dxa@p; z#{7p@>qQ=QN&IaTOa|CANcU?+doGxt4D@w9q*3fT-P6mISTZ#3jWKp@e^FUzZ^T%rg4lNI#dJ;&cH-4e9u1qobLlkr(qfQ zI?AVA0Q%;${alAq*91e3ZTwz*@d+4YkHTf2>v)?NA)^KDYmIYo3-WXM+`Z_t?9b6O z#%Iw33W_=fxCAUuk|0(UHMbZL$wIxU5Ne{5cc-~}^v>5-qm~|XB$epR?WH-H0z*C< zvi0a?WHs`^cuj_Ox?5w@w_n~Tp}@gp%A0@T0V)xZs|MWR5?@bu-%A}!RlY&4=iUi6 z3{cYo`XA>oG;l~Er6WJ1T16rk7b$*IvrokojyTl0&{b===5tnyj+JLr5EDhPiiyC^ z|Hxqd4W?sGG~x~>P;H4Q6I?L(jtrY~jIyIWs}%{3;P8v%m~C5RdbiDJa*vH+{@G%I z8-VvMmZ3C<(2)Y~rb6MvA(-U)TCfUxp9{#0UqX@w7FnN>BZa=PG9=&TM}m#-^5^Hb zAyhvMM{u$4gM>(($V1&!O{|Wdum{f1m#p#Ggj^0oI~Y1#-P}w9-tQ6p%TqEcAa>3o zQL^78zy-%^@mX@MKZr`-ty3^U570etdLKWpqIQ?M!Cqb=69}5)1p}e_Z1x-QBL+W> zL^Nw?ha9R!<;IK7OvY4bv_WF|JT)S6-e)TQzOouw_?+9JfvL)x^vwbuNq)V7Cz?ia-|?eYyvbcW z(t7Kv@lC5lp6j`nx00GZb#jWd|3)7Ng*&weCtH!($&44|fjoTU1uw~D=PYRF<%ENg z*Yg{$8DySoYnmiyj6n|)&k^2)0;&2)DvkeGbX)mk;x)tX*pC3b6AmYNXx#(dBj@e53* zOgC(UHXCm`W`T@xXjU71S4;1f=t=EfaRA#Ytr-{sZ2IATfy(MtjWXmPG5Ac$fvJN{ z`P5Q;ZSM@sc9Lb2McM`y8Q$D4;RIHQx0oDRy?OTt`LdqBk8smmLBQ+M+(>`l6U=Sn z8Xnm8p}FS|_!9N*VSsV+liN)h&H3ee^8FC0kl#JVxAN`x|6rG~rTxIY3tbEPHJHTt zt4jvge+2v>j0SzB!^WV@13GW}0WYVesBu=aX$;QOCLMcMfawn4NGaDm{biML%OCPf zRL3Hi_8J|+sKgI36aF0DmWi{e!TzqSa^TdXwzR{n8;2yDLTmEUUXDNByQ?+}uHZuv zvdP>({4(bk4{|`(Bx$bwkoSSY)E?~JM#hEp;6bvUUU!zehhOW)w!Y!x;y+yB*v&yl z2fie3p~ycp*Jt_HGE`&^`Oiq328$sdd}#`OaECrk!BIP;lg30=DB2ypF+zRY6Xo;l zcn;W)u1}l{@vG?y_}t8|K{jTc=KpS;(E$=XUIy-}tLWvI*}6y`BqbmF^x;OwJK=w^ zO=6JEh1YKtZ9bE}f*mONkmZ;!#Yu&*LxZ=q+-JK9c+jl(_=1;5lHVT+892XfFi+vZ zkk~)>MRH|nH%Au54d`OKBKe0@lp+d*lCHBkqkE~hO&-^vUNf#No#vVEP9l8-_CUBY zbSvw?B=`Q!XpR+B-p=uuD>{^pa#x(hqk(rxuCP70%c&L8LIEKcv}1w3F;>>omi3O| z53m!-NuZs7EC2a2ile<+&{gCy*}mK5IzG5_kGQ!hrnl$aHpu(FeUW%Fkh1{+02Oz0r1>)LPka=dhhn!MyhuLhf?8;_7Sk29Kq z@SdN??VaP*MZLj#%pxyu0=-BI%!FYB^u|v#J+ncBJ%o-ZXv1)3ap*}xD?eco8pH^A z^Jlm99031>pWi+Z-2-z%QKBSVbnS*XM62&jBHMdFDt^IF?w5bTPqi zU+{D80wka*piF&5BFbsqE>`%qtK?RJ;F<^uO(1W&uDxZ?DF zvbeU*i;1r$`J%)R1pz`rh*Qk~E^Hgw1!~00rj!BxG7W3eR0+q%HboQLoSaD(>L)tWLpgw+!_xqfTOciaWmlAmIjYh zkP=T&WPz{VZn*Ao^Uhc`FJIzEZR`D2L$SRe`nL)vrS`NszzrluYUsUS~;Z=mfz+zp_v< z)6B#wH&uBB*-jlSe^&{2+@+H_mnGoShaB{^-mDw>P_${^31({iFB8md&yG@~URt@Q zh4wAw_AR7dh^op2>Q+yioUi5Vr6<{?7aci64MkonYR)(0XSQ{Mm*wDO+Bv)2tlt^m zKgHjI4Xi7QpO4C`rqUPz6EO3-BJ+EFRBxYh<6NIhgi{OOp4V%PVrhQ6tqcPYq0mwC z2HN*V?z3s0HulH)RMzLlSW3PdWUWI8FtZ`^i=GXA^-Egy3><6|nI1?=iS3vs6dYj4 zPCXY+V0u&;MBWI8ea;O(mZxr!RVQL>=3dS(UJG*b>7()%=^5gaXJ*|+PS*u`ss_pY~3;!&bi7yA}xqT&vahpnPrjBDLYsl9~hiFxsiV0n0x0*Zm8~gjL zFn*`0iITA2ja*kzdj82y|05^;?`W!5NXc)Gos(==%$}wK(+{rWe&t5Gz#--QJ&se% z3?)?nk@rk^O&ZG#d%LX_9~WF(N9;wCGQU5qtG8P`7o)1mq#U?|_9%+F8-jM3H06X( za)m|KDceaD?ztDdIeo?pP9mGKHteA7nHFutW0IEpeaXTP^?s=Re>rw0eRK^ke;^}Z znd)PET8|JA>K%OsY)syCc|QI-H4P5Uq9jR@gRAxUgt@&SUrg10|7{e$Y;bbXSbqom z<4fdN?u)ZIt%DlTQzO|(A@wLs97U*uMbTFT5{bl*jkRn*wi0ww(`vC-@D!WC@;&zm zOdLD3)_!cU+VUic$gi}JMD^}o)MS7@lZ@Uz+eYsr%ZTYYnZ*kVrQY`|$v4cBUwrgu z@O`o{(BItey1K$FnZFSmde3O9J)LDc0E@1R)>{7Abbei|L?ct#WMZ>-D<1RpbclUt zmTHVv+Z8<5)Tw51jf|okwZy?~1vNG@6?eOXevhDKshoUOpBVivdGsU`h!p{7;uC=B zJxdc$1XO+_Ie6(9ktXov(zJPtA8A3qj|Ed13T$LygdmzbrX z1I;2+J6IYDnJX7x$;x`X)d$L?{Ma)kXG)dlpVq6b>r2sMNGab&4}#vx&i)22`_%sk zE-~#6r{WB*DuGL5u8#Rnom_9>bPlE(K{_3SK^gMZlHhtulE#(9{*e%(V?+}GZS1lg zq9*oFT7J z$QB#Q7>r(^XUJvt8EU9nS?A5*=$4G`;~R zH*P6{r3q^?%2x0*wugvX?2{Zrltd;aex*0qkc-#S+Lr}+CZ53P zeKxK?pU!lD`7}}GCt^538rsW1Q)~^*))^5AO zoqZ9CMHDc_Gv!Ngc3g`7<=N?-1aM?69*t*if0=gT7hX*}@C>h}9pm-h#}a*HJS6|gD{1Sv|66r?{@pY*uii7N+J;?JtWdup{H!AMOg)|Be~?PU>XdCN9DyhE-HFR>r&}j6>iF6 zOTFPH9)FhmfL$3=yj3X>c{HoGfsYWbwFDRqo2Ew1GQ_tlxt0#!#)!72eTJcz&rtxLtYw%F`Lj3;oUP+Y1J@!c<>fL3jE1j5jiQ+ z+y2m9W6PA}zwmuY7~8YF!ui!5gfe*nV~)M90Zjs28%#jQ#^|!5tU6{{p`b+CGOg7V z^A%K2d-(}*Yy0x@$bOHG>q5xGkzw02{sB5ptGWsW7xo*r03P^sW_qWaz&nV-Je8>L z4Vz83awOCrb6`Xp0obJb*Nm0>M9>92vom@ame2?e*ovrx^L5D%jl;vmjQQ&dVFOxM zUrkYd-y{&_Qk3A|Va6dMmm}LV+2mx$*Hi3V_6F1kB;w+dKHG*C?la0$lWDK+(x|(2 zEMkmV!ih!etXyV;u_-LB@fobjB5vU@@_IMU>Sxs#&$Q;R@YrW!x_7|S=UG5Wb<5i8!a!Hx+N=6Tzu_3 zc@&){J3D6)rumn7iRrTB)w>i?Mx~$p27`1iu>xPU7voocObLaL0}UG1ks{Uib6Nji z`7toWJ~p0WgINR6-eu`y>#mPO%`p>R{xLx4H)r-(ei6xy(DX>E*xBU4z|T&&KL~Tk zHwh-&r-oSsV(a+Rv8>j!q>u){v*_Q)3EmBF$weg-m_Oez1c3dXR%1f)ds>ZWAKQ7` z^iPV{gpp0SoN`8+!F_KxCiTHd0vYD~+%E|-8r*HUxvY*ohjSD_CL`m)%3M>F|Il7c zRRg{LqqSfuBB!H*y%J;}ei?c;vK>?^mp$jYLRDcrYTP=tCC(&s?h2e-L~ZW5ehbaJ zk@7+Wi9U41x`u7nOI(ZSI!R1UbeT_mDV7wX8zoggB62>DBx@Qh;qbK#TY8%5&s^@m z<7w)JHk>))M=t*Y0w9fuYxY@0$$KSzdHyf@%o&TyW(^t0&KUwpry-ZiB zU1xkU7;dn!ll!!G0*YYhlBQl#wixB9qUwZ)Fo08Y`~W9LWblCTn;q&Gb?`f>vDp2* zV33T05phwo|C)QFaWLYLrTWj@n~;{Xl7o3SU`tj}&Dq;5;79M1XgBR;aq|)A*HO1r zcDG1wMji2%x{M2}fS}bi{wQD5H=p^?R6v`&yy}%%>b7s;wRxXw$r- zE2^Vz9f$@kfbQ!uknUtfSvZ65z2XJxYr4aPNMW~3XQMvC2azc!(tz) z0mgZgebx@{$`Dx03l3(%Ht?4%uc&by<>iATcPq%&dYK#tqT9$eT(7V6x7f5WE6s{C zn}c+4(fh5ROzH;^x@)rgdsbzuOXQnunSVK`ZcfdcSO-H&)k9s&ip<=(3Nj^jFBU4e zhKOF5%uiO-!FQturT1QQ_1m8}>^)zAncRYL%<~@J-SiRr^Y-=`(W`54ub#oK-s=iz zqD;82_pGk);_&|f4~va@h~M+$Q6FR<`;X6yI=sJ1(5yjTV6zDhXzji=A}z7d;(7BQ z+*E7-kG;2ysN>VS&TkklVhQ z5L7o3%3R)Nt8WdpM=S0+s^{FSML4#rg%HhR5BWykA{jGKpr;G+`MkR@>s2u^H|?vQ zj*)1(;IusviQHTOo}K?5Y+qN$O+J=z{)D#s%}M)}_T8Xl38`#2ZBTGCI=-ou-Z*e7 z@)%yw;^((vESGXGaV*+!s-)FRLI;r=Xn4@;a!jNS@iP|^ zDk{v+%%Zk-dJfZ)c9%%K=wnW}&Jvd+EX(th8vbP3McL;E#$E|@W6=Mq)d~7zr`#cg z=WuDDGuOnOp)}w1WxdnKm5wPerqh;jF1BRyJ?36 zyRkbW(!8Kg2QblLBZjt`H@?n?)<)dU-&(9U``>Cr^Bso0)uhDB@#z5#J+*kNe7$^U zZ8I&I-n_pGzrz*yhL8Dq3V(_eRTxOa`*GVO3U<5#hGM*l*KX+C>`CzSr#a17=vxKG zy^fKuHN7PjJ0huKM^l8QEm0wi^U<)hPW+g&r*pWG+$vRI+c1=pM<&Wq%i{}oeUASE zU2{~P32ixR*}U*czW~AzrWAUqgH>$crw8%Ap1pW+n-a_9YqjqiXi}8io z;pU!&$0`9^^}Fu~JXRL=#B4ED(_VNo>_pMvw-buV`6x%n>dvLnOydN9yIHg8NhME@ z;9?p6XkNZvrAP)`U_prC%_0FjYzQoFx(ikls~RHvwus)*Mo6)*YjI8$EWbXRQ=Dii z61&UXxOyst9iysNF!JTwh63)gu=A0~BX4i&uRpute&)b|VlKIsF8%3u`%V@V9(M+k z3B6vTTR3_BJuzrDek{Y{(m0i29P^_~+C0gNS0t0zD7H` z^>Inzar?=c4_-JO?@ZbS#lOg4nP=+qrK3e7;{>a5Gp)3&6EDxhO8_BzU~14MP_PH) z1nMLpPvDoC0Fiw#7bp>M+6Q-ou$njzzylz(!JQ8)wMoHdflUZUU^EcudlS|%*b)R< z0-l|KML8k5%_TqHV4T7Di>f<&?I1c0p^4vjaAiE zi3q(m8yepDl0;#fUmo%H?p4y{P0pAO^vu_Yij{rioO%~NE07kv7vCg2IDqibh?E7GB6-*1A)JxC`a4W<4RskBC0!bN1Ff|kY=<`lJ1!SlCU!On?CNra>RsxEB{ajL z2uW{is<^~a4N#=VNynU;?ijqG@_BdGcLP`Hjkcw?2BGASpsW!Hie*hrPQ&6v%AM;0 zrI;FJZOHmHoxDg-YT6$liwScrp}ox*rA$ADyUuNVL=vl=oz-r7gF^e--I`PUg;9|0 zd{4$WG3Mq%qV{#;;HB=(2O82x^qO~8?y4`?<%=NJD;tqLya+LzAN0QKK|w2o<#H0b z#8^W<=ao*etx2RzV6cf&~)&dWU&XIR}qa5{9Vf+0@d`q8h35F0ne4=KyDP z2m^Num6PJQYp|n3$o1+ei$}bSdgFV3j{h9%|2fwGbFBY==~xGi0QC|OyZ;>Q|2f$I zbFlwsUjNU${{NSGokGB$b`8CvTy#M$KwjvWFZ%6xm(yGeP_Lr97Ci ze2J2e(qx;VBkeSna9)Cyy~o{d_PqJ7LZNlYKMM#yTuWiceaBy3q%<3yoXP2s^;Umt z*U#f32=ggKwP%o&tyLd!zIDfhXpRcw`gaO-r~3mM20gm~7FC`SDD%2SrnqX-Dw9 z80i=>9iNnE$XuNo=Xg;VyWk3bA`ebLMU=tZnn`zc^dknE>FerB_#5od*Tw$01$6`y zCWf~H+Ar?2?Z%Df24Yhtrb7nUX^bIJHcD)|o*FT73`A*jJUeojG*4nUTnIa7- zL)JxP8LUC=1c0L}S9*{8PKHzQHSQS4>TALbej0kZ4WueIBh*r_0!z7-K&(QWs4)Hc zAIz{tSuD}JSbjAecyuW65EMH7EZDqhx{(@{_=A(hsmUIqPbKYQi>i2F`cM^l|CwSI z-^EL^&>(G(w6ZvJ0a)ziwy*I)Yx*Us{G6Z`o?LjfKu;| z;uW`A>WU#5%ifRL+hOHQGo-qi^7~P6`4+cYgs4U#gv@j`ksYu)t2AC|%}W-~Dn<*=_Vi9m{i!$U*zLjsAD*06Uwn{v|56RrsQtf^!V+J-sb zlSMjWeoo1raDGM&g{{igT@2j!6zCM?!s>{3Dt{0K27ih`PCf>0H6j!wSr!X%{Vd5E;@Ff_x2V@K>{7)?~{?tRJHzIlp4< z7HG~Jb@JS`Zu;0dFr_~$YE250SD^9;wke~5Jj#D5g~rn6rHdBx9n1=*A))N6e=7=G zlyQX9!xm*lUNR<1X-o}lxO5f_`Eqpy`0d6CTN9Oxa=6k8@2GU~gsz!fnbE=wv=PzF z*z4uwq26y1z01GxHHUjPeM@<~#Jhx$+!7Q%Q+ZLd*IV0e(2`eRycP}4y*`V5Q8aA5*=vE{8 z%XV)0rN?kb51LSJ8^^JJz5VpmH!AWHtTbM!zxC$i0vY#ZiCeb&d^PJ9*ygmnc95AqJiUNE}BR*@obdzelxDwRUd9y zigcC1S69?6abJ?v5RcR_o$V1;QXr9LSotUF9CctO4(fCDx3IFcC6avoYk%ySO0U`) z6+4?=3<0{)Mgy?B8Sa-X#sD~vC z^|cAvOiLvOrG85~nf914GgT>ln={>pIzW>(r>%7LRCwz{$s@z|*Om_#k)wmqaPWSn zNRmUaMl_O?tSce!g@uc8^pN_k&#TUI+oM=wxK%IBdV6hxMK76bRoaKT zrDJHOrAcXPUUUX^14jYqyPBPZkrR9ZTBWDY-6kZ_w_~(kGM9eRk`iz#LGOP3IJ*uV z30T^KP(#Hv19)`eT^I*k3m<)!<7+8E_-3DwhNR+DLyzs;P$zUpXwLQ|RxC=&{GJ!`X?4ySJ_(0&o321gU^eDB7(qa9J@5A`b`kQdthe za`0Gus(6YqL@LQOIxWd(r2xaq@z|#trr4OIH`OAKAP}`_2TG@mOO*jU$ks?-OBNNKMh~4&Oz1^KeXh$zC zvU<#)`tX_Vymj9^$x^1shh}A;fS2=vPhjh?aR;w6{Bsib`8(o6!%MRBPqepvobDzl zxN4rcqo(4YD8?LyU&J^vo5Wfz>?3orLG{uY8b=#911~jDolWPc??$$`y!v1EZny0Y zKgh%xn+pFPl+LtZw7vu@IQP(2!;bL8w7u}kI&fnF6{~vL zyI+cQTK8#n7K6M!su($Zghf4!3N<9+`R9-2_2?*O4m8$>xUurYTEtZ~YO3 z9skd)7R;KiPmlZ#sl$s$lDjU{oi8(OaIECbIP+a3GwHf7+Lc7FN<_Wr0Njin9V#LgbwsI(uz_cKdp zLCmdg<7ab0k2fc`B*~qWKMF+os2X!aW33P-B@rqYB-(S|F+d-TIjlCQR?leo);Tq`k!1(lIVc0wOuZg&9!BLC zxl27kJNFDmvLm>l2e7Zf)KG7H-N62u+f=ynK-4k4PPUad9L+E9a=`mrKN{cES5zU5 ze1J0j^z#}{%MR^x8fm1By4I}bYpWN4g0p33-L>!ViQ$1?m)MjDI7`|lcPLJ zKL(YQ!p+u^C~~P8n%eblJ4v~Uy?<|85lZ@vky7zMG~oah!R-<475cGK{ud?vXa|e0 z>4bfD-bmM}$oe1Si7w=5#NXTSF;mJ+ex+MJFw@HKS0KYS>PEPs_(A@x&UggmoFiXm^L$Lz`>U)-xGgg zp45c;wo!k|o3K(?MV7Wsc^sO&%!o;;{kUbNcOl!1r`?7RoaHprC^~H$oF|b5`wI%Q z#Wk|KN6R{%eV`!N#;cIp@s5?#t)<9n+0176@^jE{vdp9?k8ldgN=85y8bPL~F`8pu z1CZSS<%rJg&Z9C{_f8dP@5R?gp0Xa_uuvcs5!39u zVb`f?ItT{eIubEz`cK}@8N}1(u znkuvTTG+pb=q0qOZeQi>qn2LwIu&x3^+Wj5SDeyq(=B+;gbDs9yZqjtFe&REkGl?i z^4fEXTc!%~iYP13xBW3jy@UzjL1f9UN?m#_%u>AQ+b0_U$X)UQeqqFzHQ>Dio{y|e{qpNtP%Bb-Ulbmy=Ats2FyKHHkYi}Zd{?W75 zsq1pZa5SRbiYI1r*V`LS)uN}(><-c1;EO%oXYEE2i~ewAnP%Q8;`fWJqPgd@8-n!0 zViCgbad}W`so)>Y1N+R2i-A5rF%WLN;SuTA`vW%ilN-nj-Wk#Lb8O0V!N2b`B!!EC(!7(=q?qwLc7>>UcWs_Koy z^=f&ST$+|8)_I58Np*boW?$jJt9jtzOpGJLjhYZPau zRF(Zn^=@fLc92k4$G0)=BHoR0Fq7G?Fx$7eCOFDt-w2>3WD|nEv&-?Epozb$+T4%5 ztMajzx_E^op=7#KRNN71nsusAOdFl|HYJ^Ibq;y66DvaIC;4lN;{;t5?M{)W!mU%v z0pK5m;5w+bapcBG)xPVkUZMwZ&dY(eI>cZ?#o1KfxY69ek2NXSGfCQ?|0Tx<)O?M(&Fk1UoUB^(2tlvHI>e3q-|J=+ZwK1%9ug! z=l(5@U3GqCZSCpx6s(WoafVV1E4K^r;~qg+YojzQ%XiA_*#^qK%Pu8JazEld#L{qu zkKEz_$!ezt)A~i3Cu!2=oAqgdIh`aGWk)cKjT&)Pccpt{yRXS$P2(uFb+a0k+kONv zr_?Ez3XuTHt^ki%u>yDRluF>kN9R}jEN;Q4McuLHjU>Eo0qDYB{GL67kb zb$PZl-?dJveWz3|6x%By3Ufda_a~PhVD6`_LPqt?trcZaam|lX6yk1M*h~EIs;^Ar zFc>>(PA3V49%G_qdBp7t$>AtUJ}!X{G$+3D72(JaLYI`-S*4yeO9@>d>O*Yu>nRi+ zwMw2!?u4&6AjzJqQdZnXc(A&xIaXlm{3)w_c=3@IYCu220nNjN*q4v4F4yGEJck#l zrQal<&E-Sa>2PZE0@tJWkoKZk!cs6y_;yyk9J8cu9QhQ;i|`L8S~$haX`_ zi=yH7c~j_#NbiaQ!jXfZ$l*NBX^DsU#kr7k!Lb5?TcJt`km&uD6wZCND?CBB6FJu?PRlh)sgE1;X$(y>=_{@dxy@btO54fH|f7?WZ#KTvidRQWk8d zOac;%O0Ns%t5=jNmqhGN>}{c8k?VeE?(>O)`os!P#~Y~Fl8WT4I8fmSjMdFNO_P`v z?MnR~3CjmAs*RSd7ClcCzO(QM;5a1jdF*s6pb$EQJ2Ce5S=&XWDcV_d(BvuPfemh2 zoA6W%kxu({=JXLZ*0Eknp+W70(bgdr4gcdc!HqgIoe90cZ5^wZQmn2}i2)vlP?ry) zCN(mcoojJbyD|=ugBo&oLf@>7Q!h~K=1RmKc;RwX;Y56OrR_LLpjBsxFs^T3#hnN| z;_O4%VnnH!%F*FwrTCt^~H59W8*ypJUMqXgLgVM5XUJ&?iW*6s^q2sygS=%dyl)YTNlyS?x+ zw8Eqc(hsvv%xa;9MC6!$yX6?$jyh_%N);~VYWoUb9v90nX~|WSK|PKJVMZwv2Rvgh z?N-HBac6sms)I;{H(rVqZ|&=p``71~$7u~dTD|hESh%?<-uuD9muNa~>ZkqS=Ns;l+IAxabEM@fRSO=ptI~ppc4h0V zQ`asDKEDbAW4>~5E>ZnKxmFxPF!i96UqdysG}QUC3Sqd`OF0q^!!OHN-u2lYydqm?Q&ZWPCPPqWJQ} z#{CBT-f)b-A3JRGd&0G-g`5Fm<6&^F+at#Dq0Ks_7eC@>CnO%m*UAPemBgpDG_0>v zMcDKPwt4Dxe}BHn?d!5cnqPjJDhJm6J^iD zDf3u@<9(3mCI6zDQR^Fu$V1HoV>?A+FMWZ+0KQB&Lmn(9&oI=a;;lv_A}t?Fdc}Ce z7}(o%G^*uVV7dPju-Bfzsa>;1n)Jg)j@HLDZ?cI-{j)q3)(&@F2z6&1N2FGi3^nOAt za-A0cs{}p==t3!q5232UFR66-UMj8U>frH?b_EVD`0HKAx+}MeW_NZN_PEyTZaKca zJ>uKTl(|ZaUfBiDu*j$eMtwoB*PJtl_}TOBSOVcmS^ zBX>G*HPVDfX46kdSb!us8Xz}fUP2>yH^xe|h z4t@lVH+9@Ho*2&`#A!Lz@-4C-DYv z{ROG*Y)NYg!LSl8C6jlE)5a)e+pVd}D{sHljbO3ZAeS4?U6`S_2!2JwI=9P%?yePl zbJMvQXU`WRuTvfMsjw;%<@`)5Y1I&wdu+*9r|*bpK7?9MJj#R~fl5Ds9!~F2p1o-C zhAj)n(mm4R)wWO1?2a(lK^u{|JQzKaTLj5|oiw;I;`aHW)JI|5*pYPSwo{I6o~sk4 zW3`>8hD(uMHSibpE3MbOlE@wJpiT~Fwfa|{$09b{(u;iWLvLTPNTzP)%yH*GIL=XT zzx-nH5~pV0o+q+EF(y>{B5Vvvh?|6ZkWHd~C*{*72J#84Zz<4dEdU&3nbgjJ{~BB) z#Po=`NQ0>Ez`e&cCqx$ZvUv0*_yB!+lDYyT@Y8bmEp>IZj|smF7b5Or2q4P};TQM) z*06R${>mDj7rN5ApQ^tcKeHnw)DL&z)VSM7+|KBY>xRKS+J*}E^C4A zV8tpDd!)Hx3^cPs1i9Q4jZ8f#Xhe*c?|cH$DGBgiu+=1tY`7`&_qG{c4&7v3)o)?F z<5Hn4lM>6%cW=D}+_%9x05JxH8oodW*xClu0QwjZY@!AHuUDaMTT3lRqaDr*!fo4z z%Tu@BKmZ0r{sH(c&E+dJ>6!xwUY+D}&GQ0(A7B~-!UY-yP%t6Epf^A?Cd3jN+I5%E z71V29%{d2!{g`krXpeQyb>r=t^16!$-!XrHm8u!OemJMn+Eeep`)s9&^yCSR)|T_Zg1 z%h++!1n0xDN!Pk4GES1s%JSpU9F7#d57;mEARU+RO$}J8oSL!sa%cz|$s_>5u+q#* z?$RDMN#<=wWx|hK_rx9N2Gjd9rIwjSVv#s}mhIFho!Z|d@wOjxWN3EX4%DIVMvObt zX{as?JUw2}%k?t`6hDYi2Y8DMex2;zvw}5J-Wallvs6rFS%u z=Dlabn)i#nJ@NLRa>#ekHgtG)%xK@ab7jWdbRvoe0n~h5=l0fhL2(q*r750QCdZ0a zrt9vHYh{laJ9WgZ)t#+WbnoA@7^p2-+?H4YHeMdgAv5$*CFu#?4h3;F_2(n?YOR-C z`1U2=D-mJam}1YrzGrEiaPi-9J^b3!Gfd3^tYJg&K)+tOm@vtc{(Rkf1+d~k0C=c2 z(1Qc%0xdN~;6lbhpy?((dmmpqT`k?DUT1Ubnm!3OYR)~%v~_GP@by8?l{P<>IF1KAUp_XT&cj=6<8GH4Pae^ zIY|D5LO*wYheE20P$rxp08F`}JQp~bw5HUvaX)zG7e~`2m1LfCXF8Hoo zVDTCZh4(hSw{IEn_?#pD%v{t^(sHNHf!MgSM6b!VFJ05P z3aDg*K%TzHE<8)m+->+mWFUUCgPx<)H8WEn(J`W5!l#*GM!t^}J&?fF!u1sccOS{e z_8gx1uv0m}&R2XP2icB*oB^@oL5|%wWvE;*5bFGTL5wb;>vc+9RroEgY-m$qDXI&a z#yEN#e(}|`CXloXW`%c82b|eq25o2H+UtJLo)0*Iv>%GTTrT@KVzecKc)2_G=mYN` z2!&e8{To+B55G>&bs~vFd1~3#w(EmCV$zF!R@7!rnstjMj!Yjz!)Gc7fm4V}rO5+V zY;M|lk7l;KhaV>RW{&dp;t#*P(Y;KPYDwTSz}u^2N(+d7^)ax*xN+&1fcCn zj>VuQx-21iCJ9ZCx?}vwJPE{03p!|?B`%nf4i>fs*!{L(AIQ~LKI0(cN6w!ns&obR zT+VT1gBV)exJ53Z^=1I<(i>Z#g&M*QDgt(>A>E+JrfM3<7zk9|6if#}2Z7w0;vT~O z&0!D79zE>w8ERr>fIU9&orA#Q8ce@s0VtUuv(ULb%+W1U?|z4V7`U%}a;hV;wK?(| zx7Ygo7jB=r8xVib?Y{~xwcK-imi+*Y-?+VPwck(emcz82F6H%V;$p9_v)#F?cl~RG zSE3G|;WkNKh&*+rIEKOHYBR*$31bK7LEb8|2tG!pRyk0a@^7EGMyyU27FZ|u91!nF zNsi`!h;q32_!;CLW><%IbV6=cKMY~Ja$OK>zm1DDY7s% zgWTgQX@f))>Pb$~sld{8F@Q4qS+d=?{aJg%3IY?v1g;7%oQ>56wug%%QWu5Qwe;{)n=eh;V#*}rBSjpb6kxdhAqg`8AXW%1bX6E; z0-x%ApSc%-OYcSCjIMtr0>AwS5jZ1vqd_O|Ux>hR%xE-PXQ^(J_Cs3&gR_WF?z%mf zm}=jXzL|GF$_5=QI4(GG_&n~QbK{DYAcj)t+vN%7m`lShe~IoUnCa8@B3OH+`Vo@` zV{>6Az4Xzw40-nG4f0adPM3Nf`b9u3ktKnlN;tBHonvz6`vNAx69(j*Rm@MW$m`4q zz|r@l#`aA?Nw4Pjw})2*!pwBcM&{%>qigAovEFZwfJ?qpyGaCps|;cFFh5DD4G$o`8rJY%mQ;vxz+q3OE5#NJ)hpO)cyw2{8SgzEH@4Cm*N7j_+c$vHD zXEYHZr&yF9%`~lJh^y%c)U)@n39vCNVYk7=MwmeAV%KD+^0hzi6-GfP0*#VxesTPC zR0Eo4`u$@JVjF9rYjc%!g8DU|H!Bc)D>JiXsdjVd+VXSZU%*+?^zJ-u$v~=TLh2<4 zA-sHpZi{;6LDQur*!>XmBTK{+p-(?T+?XtAN8)^qbV>3S33oQg%xPDRmWe}PH_Ls_ z_rQECk^%>Wlt|*_@IomX^H45?W(1b4Te1U_J~002YqopPwVlOQ*GHktG;JOw6rx)_>->d zF^OPmrx&kk1xQf~^S3TXAqTnSIVpdtImbOm*p|LimGw5-u1*^waG>1?{hgq?|k zzXdGF8G|-4XsOmlQ2MQm<^nPElP^7)wqQv5K4jsuktkC*dHsf`=^{qpie_SQG3vY% z*b|2sLM7zshF@f-E$^fxHDG6?F=eJ67$0LCIEGLQ$BOs$N!Why_i4Udjj(=*bwM=# ziA(r0xiB>c$hfnJ$M))v4D@@tf&5;J?XQdSVOgKrtY`yoh za%3nMFaGqip7gjE!2B%o%3pq#Ks3zHawdMqzg@269iNQF1@p6T5nz56Hx%Y)^~3)L zoih?pcAHycc7Z|X{f++uI!hJ)g3c8O{{)?5zWo86F9>vUpqOp{9q8;0`S;Knz5FlG zSqzQZ1@b3!HbMP6=xi(ckI=ai`u`Mkwq?Tpx6GNk>UZW`1PA>eWzO;JP`CdDb6#8f zub6Y<%l}KvIV=+Tzsa2Wod00XIj;Xb=6w1)b6&Fg8*`Qzfc}p%XR;-z?C;F^?EgvT zj9&2vbFQ}g8*^5pf)$tjk22@y#e@qc&#Wihq4vh*&RWkW z(7R(5`@zVGSAvbV&bX6D-Z}=B*Nzyw0CmLjdc^5~Mye*#SGs96+Km(B_SM(cr;BG3 z4Oiu20Uj38R{qe68(bxYb`ylZqtDh0mnltSuHF1@;wdot{4p^2SZMoUSz3`y#=GrX zk&Qm4MwHR~PSd0jKQj!gq-(Phz0KoFdxU(uc7rJcBr&b(GI4`EVgczM@Wmn*9@esx zZ-OWGRwhrsVB)xoONGjH2i}F9`A56z<9689>{~XzeeNCjecd)&r7)NF9rLlHt9Lp5 z0%A&j2+ekjwv&EQtJh=sqKR>0$6CBXjKYA2@wdrec)JWOK+(fLsHNMX#W|yYVC-K2$LudYE;YC$27H)da!c7k>`MACRVBvP?b$?^wRxlQ> zW@#67&%*m>cNqVfg&!vVBMTRSvGDT-chTKM;Xhe;r-Or+Dde^ldKt#;`KKACbRxAQ zFcxzeqB_5hy$}$5t0*FbDfftgpgS*|{Ugi^)4un@;%wy2xbs~`U!OUp9lyDVkvd9O zEUtRLp3Q6$FK_U%n*-A>5EvCSJ& zLx;E{-XD9;maI92;5o{ujADE)588p7XGzWr-+98hDWw1Xk~9*d7L@^HJs6}bE)D~E z(gV40!_+X42l)l^q?`rdf&duEW2hb&m%UT^4dn5ZuB!b7jL~ezvmNOPo*+hb^yRx}hX{?lr?6RmL?!Yk`dj*% z`zQK)b&viEbVvAM=+DwG=Wpn5Z%TG3LUv8BgTYEY8uU@+BC8aH5jsYLZiFkciH04R zAhjWgaR2p#l7PPm1PxN*rJni*iwn;(#kj7dpnBqHg)ROk{S5b(!6($P%2nkp6Rbb{ zvl*a91VRBK2Zlu;Ok|MX46`)w#@+(VF#A!31cQkT=TNU609zD7fmnoa2?p3jA$%Z> zbP5Oq$P9=Tg)o77096VIBd7wH7lm-LRQs^0;WemA3yTzC)GraoU3G-&M8z=6da+zp z<9`V+2rFk1X!prGCI?0+AkxrTk{u?@GY-r%9%O%*RF%+mxB9zR_58_sVP-1Y$sb-- zhW9rtt>3&V9-@?cuPSu@-m4;OoG}-Bq@{$MN&b&sRoo}D$yAejuc~a8imL_YRrM3S z{6nj{*@S6TfXFQvS9kH3OckZ7;SZCk44pBQsbMnJNV%fZy-XDWai?SXRGk2zfB5t< zgOrqmFd9H_uTe&Naj|4Gd~Z{!hVjHE{9#jdn!Q(+()+S&nh)gPf(fA*nz!FsM$An4 zMO$nPNKz-_F-xBA#TBo}2_|#$x`alj8_>>+WXhfjJHFSSWV~Yglpmzf->e*F3+_tL z+J8xh$Ebgg^$B+?pdG(BrdaRN6@Ls<3upJCCb3s0!V~MD1*NNB_LQZFDarSw&G!uO zhr%?ntun-1qR?eJgr6ozAY$YXqB~Ix57d+~o}+cBWi4NeavO9iJl}R75WX$&E#~4l zepRAh=$pC(rsigD;$j4M=bToi;M5Yd?57P8Wsyd%aYSs;)7q0s(B&~PD{S;KE#8Rz z73vRVhXcRKQ*VkktsHN(4%v%dfbteZx15#EgB*Yn&WFpn-59y~EL5ECGaQAe0~_K#vBZ2MPyZ7?c)70gTf? zLP*Bx3vBpO?`D4Z-v)iHrT@I@?7-FRwHyaLrG-2tU#v`#S7eolc<(I=hr>NlmS0|+ z2fLlobM_0&6rqI}z|g7^9R$oqprHtFJ|E;?igL*zsvC{?QC zYGsgFvIs8WUXzIe3g}>uQ99612YEr@aNB%2QUdk?%N{Y3dEO^979RpG4tiXTW{bLgG2VDGMQoH?;YI#G z46o=FZ=n1bOolyNFebwO0qEdDEH6$X2Wn*@Ik3HknjC}%(i7blQ#-|77CS{>lUkO+g&w^jvX0HonBy|x`%&wd0oX!@7?LI)SZ8DB z@R4diFEg~MA+@s#2;ak9Wnb9>j8P!+&_K7TV(pM7#Z#@1LhnHPKCA|TP49T$bUekO zHpv*9`^qXIJAvmiEBSFx*tNhQ%|QHuYTm2kJDW##O+t2}^?6dY8})L)^S|Nkk(R@l z-7cO@7vkc2@tJOt?{~l!;T7HA@b>5wxO{YGqxToyhI;4t(lp- zVNXJ}-Jx|HIgBma{E_GIe1Z3kP7p_EUxtoRVw~#;fM-)`Ogm!wKq=SDB`iUSO9qZF(J?H_;qg}0afhPS8EP~;adp2VMxVZa3S_2<6{>fbI^ zq{xZ>G}Qeo-^v{;?d)(?YE$lCWGz|)2`rF@&>*|JnA=>h=cTtAQTOc{X~-YnpL;tE zkHoz)6M(9huuqvFK<3P{;CW-jqi>Ogxg^F|7JlvCsqLAfe%rmL{@T6g-S6HVYd>u& z!*=gN(;aWzItV4W6u;ufOcBmyKX?^4&WvGj5wTJ^DoLkuOL!SB=@YRH-8$aZ%+r8X zF|D2QRS(%RN5U2QKNB~rDPb`BVP#N)>(jCKxuKnnGt?=1%U8;1I+2n_gyASPi4qH0 z3?)uf0_LF;70?H(%#RNCm$H?bG0#89zeJb~%Yp~_`xQqOLzs{-Y-FH5rtd9~b zcgD}ma{|{rZqPgvL+Q}9p!(!m^BOPogkSOmL-JkfMRHkpah#rY92f;q*P+M+vMwL@ z8b)h8;ld-6&8d~ULyyW`9-Afcc+SHK#sgLgpN|Sx;pSK1&leW7HuIzN9YdTv zI$jvnv4~F%&acl-nWgImJxQ%o$?ItiH@Ood&FVh2SY}& zI8uuw&j6Np6|_&y^Y3e)hYTH$hpN!TSn)hOj!@ZFI4}x$ zCYuIg;A#QeYd-OpQI6rFZmV+bhQmIw4Wk*Pj^z>SM z`~LNH_4m6`=jIfxvF71<{ttmPr|2?9!T?juSUzg1zA|3Tl(z>BRPIiZ!!$x5A9nX0 zGX>EHGU`x5j5d91!l9Tlsno4X zdJs^U2=NyWV&UF{SRMPrgRt28&4YM-??JRB*{IUPJcvWh5ZG|U^KkVQJnUCuuh+pa z5u(!fpG1gr444QJ+qQ@?^{+$-2dVNrQRux15y{l_rw9@FhY0cbZz4q0Zz4p*UquM5 zzY`%wf7#|$r58p^jED5Z@`9$@-R$l#6~g6jDg;It1wLi7ER88jxT5zaT_lRJ^>Qb) zf@ZlpI3wz|#`>GReHT~PxzdAxJO#!d=N~l!*$ql1coTWoZ91k1lzCl_{MTfV*ZBLa z<(lhrb&hD$>CWG|%}ew2)ZDx}$fl=%ysGg17;$a0{i66~r@~)W1$MAif#$DOL8m7{ zV0;2}F#7!9*>Ncb>3}@hfmmUtmB-NoIVKSfuG@_$8VS|!`|d!D1cZ*kg!AoORR-FHd7c_P4}#A~DfH#$I3?u>@d&10he}hYbVBk`NLUO;g9s1Vc4|K@v77 zDI+=gu%BGvd54`Udi#zZBXe~aPwW;70M?SQLCK%Gxb-oRB?%jpQh{bk*r0?4z*?JV zL4tth0XT%DP)T~|DdX*%+4HO0b}OZZ{>2%~XS?r-fgve~1DOFsLXvh6ddR*H9F=vk zhLnzyMCX^yA5|?&fVwnnPEr5{55ZtI=E5Yz-%FtK0)roLNDC{d(h%sU6MJn!Zy3V@ zPJ7Zcf`1R*;s6hizziTZKP{-x+D0Eb6la=e~l zHE+$QPtF{C@P8zZkOt-giU<&9%%!tQp6!c!)fP$t1R%g>rFS2JOaurorxBML@eXd! z{zaj~^;lMcn|3nvxghB*y?7|3(S9_X@(F%oQcS^#{IAj0s+xIhCEga%6d zX9!X_=)VzyybgwiAPfFw2vXx;gdqP_2Gad68OZ-e2vXpmLXesNRS44Z??RCOE(598 z@^0i;1`_%!1lbf-oqivJe6aC*2vYeULXf6HaU2<492um%(GnEZcPj+113YOn2?2+mYGZDh7IDHehRqU|r+$|1FZjS*)=j0K>Kyne#1SD_7z}r?F+FOeh;o7p@g?rxN39t=0nb_6Wus{#Vt1ayH$bp@^`DE z31(H?nBH3zja0;|*&O#)g`?O%XccKMS6XNdh9!04u)1fZ*`MP`_uPKnNQMO?jR`y7 zVmuj%tek`eBg?=z@r}e|B)bK~?fMCyD9J%{+@agO$C;rJc%?dc+JP)qyK{Yqxb@Vz zc?RG8^KIN!y!h?N&4X*PT?)19B5Z*dciOC2Ng@0Duxuo; za;NiMzKY48^=|lqxYt-7mO=SijlaANi3wHg-@FZ`-@J{q`*JtS%y9r#?&kjQk!q)U9h2lS3M>d2cOQf_ zO#CTvdWf8MZmpNs54+G}bm9h1Vl&qZzqu)uPW0cC0R!_}`lGfX#NxyTT*U%5yT zzHv8NjmtEb0TKdBIPM1>>-O(MX?UZ%i9TTah02&&joqU&*vQF^+e{Np*YoTE^0SJi{6b)@_t+7n0Pi9M76x3zZ9Ih_7wYB#fvABF3j+oQ>Idf58i{Q){UKH5Crpj;@>}Pj*^Ke zwF$0$IJT`#Wv~N}IdB4onht3pzDZ3Q8QJXKIqxm(s5YOrphHhKiM^{p{6E;c%c!c> zwr}`!BS@EYvlb9vqa9=VpJMx;hBr)` z7Q!qF&nryJU>8y-!$ht1m%B*6q|h&*6iRd{g@y-SNTH_tpcGp4G@oBDazHCu;>**& zN}=>Sqq}!UK`9h#wN&mlTna7vLkbnE`X^Foc@GGM!rESG4o!nnX#A(f0ZH%Y%~^bxyN zlV<;E3-iYk<|w#?>G5L;Q~&1@<}rK;69(VHO!{LB^UCEGCie9|ZDGFtZ3{Ei-o#_| zk&)_Fd7bi{0%y2G%}}7x7jO@A#`V`8CMnuYMj?j~@tP|bQ5$_SICvH9A7Hu?9|941 z@Q%$ong<8`Ec`ZOn7@m{B5#juMr9n`DOQ15Q{V6I^2}k2x1L@&=nTT?v`>|RO$GVH*2wlH%+7v~Ed@bXq;w+NO^$|fCc69AxH)=3Pc-Yo z6NRm@9+6R=$6nq1{P~M2Y4kI`*(cK1+m;ttLRDOi&5wHVB)m~xw$Cg9XW*_Ths)`w z)3xXsd2mJ3xIQsi{{Pt9F(>?X99q-U^#wFi|GpmoeLeo?M9AOQv~)p?-;19o${4lG~;E+rC~zN1)1fUIws-r2I$T?cmeKn4pcz% zoP!i2vu3Q1vNUBCa6IQ=CI_%4zTH{gW7t4ji`v*uS;95F_opW$A9Ei%h zBpuPd#)O6IXX_?i<7N-cdO!J6WV$JlpGE<}zwnGX4h5Vl6UN;EzrH_;^9Db@OUDGn z58pmAEZE#T_GpW?j;zjanVsSf^fThhTq$0Z|}e6(WvEw047IcVW#|SLO0nQOG#aRm>T!bTceDBU9ZA+hG8vo{E|CC;zfi)0eq#`6Kn78`MB+bG z5WoIX5N}*6h!o{N6~vFfDTq=3MnQax54&U#H+gt8B}g1;+>5B2^Z zDu}Ru!XVnG|4*qf!GE#IOI6f+)raDv0I(m4e6t`=|0D z*Dtf-Kg!SUBZ6jw)IT*FGX4v*LGJ=>0L_M_|EAes{|{!v^*@;nKw$@j81^rah95>l zf#Z|p-;4&lzvN|szZebw{k$yfUj}AH8vl7-_RarjUKaK*1G9hRW!HXc4S&hYcK(aJ ztkLt2M|wZ=vSEM8%NqX3%MM@WWnuom0<)W&Z!ZF~q+npyey65paYg$_URL`uFAD+l zvao-emj!<0Wm$gD%i2rUqz-;uV!u!ick~()eRVI?!-!qC`3;*(^-u|B`8ef`nS1uJ zN)M&LE&R{)z0EWBgYR_?YcVJ+bnHYpTW^}kK4=Mjf+44&%O$}-iue}P4>jC51e=_s ziW5QokTRek@D3GCz|-T}UWOgDN0sc}wxoS8arNI=)eNiaQj^(nrSVKiak&>!B-|1} zDzroy4qLj8s*e(V7gaJE#;^TxqiBSrhoz{bsZhhEX5Q8{CXSySi3qMBCM5guT_A|x z+kPO3N+5zrx(6bN$%icaPbO}r?8{w)BZyiQw8%3vrTn+J;=QL%BoeCB+;9s`VfV56 z7>{W8DVLj1#NRw{3bGUZ;GLOF^^~3o3+uD0B91NB(x)Y&m&=@lNbqIO-drUw+0Ox|!02cVXVNP&q~MK)L(hi9_y_rsmI;!x zhgG(N+hrdx%IID%q1tJSx%#ZfwyR3I@{#RQLAFnDngaC#q7isumSP+5U?Wq)EVZ8;@EeOKAke)Q;qHT`+!cc%tlm;HpnEtVk>tWeh5W_GtN<pmh~TMJnVS=U5&#k$wU*zQ~OcyX$~@fHad~BiknUPqGb9u z$4oR2Ycs-KX3w5MA5;lz{6J{%wLj-*X&of+WuAVX)j!j|mEAG&^aTcw0;m39pYHv` zZzQcS0^5XL$h`oGk*%!Vch*m{eSKf!@a1yZ7WHsdGw)_g_w{!$ybm}Q`rvmRYa;p< zg}4dU_h&Dza9ruox`T(lSJ!B6ky}LGEI9#9lZ`6J&aJZ;J5xXy7DZXkHHrT=LOQ8@ z-Wlg~VE1Wc++`H$%|?Cnu~_wI;4LMD3fAv?LVUrOoFGw1A<=Aegf>xrQQS%(*2 zv81DANxG7X#B#3rEdb0I4UHwz?MS{&LQfxluVf{KwA~|aXz&}BHM!Pq(KE!jZM{h} zj=D#bhJugGc2Bpf1)^8W#j1x%HugZ9TPiaf88fBvDz%xo3Y&D7nK54MElli3Fyrn| z#f{(B-D*U0hs1A{(YnW?wnuBN%xv!i9UJ#aQ7lMUc+Hj6=@fa#u^onjx{2L4d7P{o* z{=o6gFc~kChPO@9MD*1}r@ELA8}<7nhGQv>YkCiHn+$bI(#P-Fb!pn6eLu`N?7!9b zqYunb`mzt~2KQ@Pth*lxHei;u_lJxJd$DYYaj|e4B%kGGFR5^k+2ZUIq8*c>9h3Xl zHUPdN;Fh`t;ByT^gZL0Y5ryy|8IJ*iq7XqCYL53d(GnLIWy)kRBwXRXESe_&fy}@+ z`j_%#iGmW+U3t&flW(U#z9wLrcc1W-QxvSHOwK(_xzoo z4>qzn^?p-y$eS$GHk26_&iC8%d37j_04XlGn&>Ph8fq`d#(AoyNHe}^hj@_J44ZYqu6$&IM`UOrM6#BINqzh3m=t97R7)l0v{PsUv88u&ECY?XcZXrqCGn&sIj0{zq3v|JWE+{YRz{_7|tH?SI@U{P#>D>>r)NtCvopeQn+7 zkCo9fxKmi?{uih4KV2F9w;Q9dUrynlRz`dN>=gc78FlM9g*%1+y_L~_yDQ(V?ltS1aOrie&Crn{D=fB+;H36Bzf4ed|@{cQ{ z=Kq>0qBJBrpp6oW z3nr@}M2Pi(o&cCD|AbByPmK3<#0WFymTT8SZDq`grF=rTKUTqEB#U1q1w9ArynD+82nZnE$NX!tK9Mxo(+POX<$|m;($m9sNaB) zz}OEEKQ3iQrs+gnG24H8u=$cQb&Oir|IAfFXw3o|F0lbiFn+~V{0CZoyEgskftT?l z94*(qM9XnOwA|_vEw9hz{dz1rYvKc%G@5?z3qSywa(h3yRV{Un?+)B;GVXK9F z>b1bMMKjiKS;m*YH8At6I+y2r?BdM=uDBJClpku_uXQ)&L4(DE%Wby`vLD-SbbnUc z@+Wb6VYnSOAlvo;zmCN5ktaUI#(`*Lw^YmG+wb{C;!Xm0lT)^IKYWI!CeIFc8*yzZ5 z4P0$Q|C8G0KV}cAZOF;RJ=e+(5ssr=9mzstSy=0h=`8S6YE8pO zexC4+AEt^-g7Qj&sEpRNkC5t!!v7dA;%KgN3gMmfc=rx zT4}=?!HaEH&|E0*2BYR95vrkMtgvVKt@rS;?`xI&P{>Sk<{d?t9kU>69pk4Jcd}8V>T>AYx(kuJbK366 zfY&hxB~jjAS*_1Y=|J8w2NOy|+Z z{bf-u>AiX`l07ff+$)6Y!Rs2kCQKEWQs~;658by!mjr>wCmfQv1w3P_Wa}nm>sC1X zXn-0NVonzU6)>`#Nm!41^X_}U2o7I|EQ*SfS%7P<6T>7s#ldnlFbD-<6Egsf6TBId zWFB>BzO1i#;O^K}%*~udPJVlMl2oB7%z@s_dK%>_v_!JljW=Y~Wz47Oweqgv3yIT+ zh(`cgkB%SZn`uEA`rCzYyqkSO_uTWiQ!{eyacKRX9f7K&S-^Z2=Q=NXU;9Z}%oCcU&Db1sLDlB4KIPJoYaLXr*x^x z>HeY0>0hdH9Dh>fyrnNxxiC z)?Luis=9Er7%m(w^$SM}=8dsEFMTH3Myn$v9lIyPWwbj0{@@tzZKWeu#7@4*GRl9q zHnU*@oX9#Z-rYYMUN_NrSNOKG#HiT{UW^6LTX)X~q6)u$GBei#G%!JVfj%ZEDr{3^ zEiVSm?4luS*R4efyO9eT>`@dMOG^1TV?=W*n$~-S;!bCb1@fzNfmo_j`^?DhQ6nDp z(+#TC$VbZ22qTux3Lh+BqLOkV7G4Q>QEJ^QZJUdYw=wL(2u0u3EN^9VH zBRH-$!d!ba!@57$dS{n5%>j0kfEKiXFkB7oj(r^@CP{Q=7FB%OC<*Q*{q zh|JV4>F9*3-;9Zjk=D_D#fb{AwY^$zu}wXKuaC-0$?n|x*7Av4QTFDQNBrXLJK>88 zW>^Fw(w$M`Mu9L!PJY>Eq3F&xn&0^e)9OE0A##hKZw-ctBDB28UWMHqgXTLJ7r4i0 z)u>Q#k{%aT2{Y=1-_8=ver%p>7I%Nw8v}u2q~5}}kXX-`9?5n&sr#Xh0s~`Qs^sh~ zY9Dm+`&w$+1HD{=M^&~P2du?>%L?D!Ej-=}q?cY*-ICgr9P5fOW?W#tCg_vJJI_<} z2?sgPti3f2+QIe}?Z6DSnELQ6o`1<(8Y!0Xpypxl*vdqHti{Xw^N>Y1DL)Z-Jr=wt z>sVdDRWVcVK<}u8$iY?N21-(Yyn{QAv=4ZAc? zXm=&$9Wz|SYy^kmv^*p~A<+@&AQ>=HvNv=Mzu@e#(LkYd9$GUajw*o>1VwYdkdb-* zZIRdTt}`r3$>9yVvA>d@8wcn3uJVoue!`lZbx$bXnlaUrm)uWTxx{1&m34JJ(2Ekc znbx*lmv*;EaNp@5w?r=TmS`8A{5Yu}Q!qIP;jE$>O3cFSGfh!SAF{onvXJ^WK*pKtbt?(2s2Lk>2A1?D16_5Mh@s@fKVcG z0c#8per}!aLDXB#-)_|{Pl&$1mrbR;kjkLa${!L*8)i3g-3)ze?u**;HPShy88Reo zjdol>jS;+1_rhI1T8LTml(djDulDYO1WN$~zt(Y^-Bg1LT*_2A8q8gJUsm#%l#X1Q zFo|6OT$B`I0x#4J!=ld*xS4pEJp+ITOb|x=4dy=fHJ+Cbb5fA8^73kufixy?*}xU( zVghf}P;BrCHwnKkdm zh!($o&b7ofao%nA&`O3U`46LkWI6CkE$7aw67(?oS;=?mEs&(Wz--2E9rq;n*k!*#n9pj^0? zz1RJtZlhiW`-LV5z%@bDxVuR|G(p%~+zU?7T1)6C8Y&>^ED^gIP$U+e#H_~wK`8P# zRSrIInmD{;DZgSl?oF+vcl}!@yKIp7MAX^CNuy^CZy>!MUOBgWcldDdTxN1Sn(m>~ z-&siber%UG!d_1*VbT3IzpdrQQde-k-Xpxv@~f*%*JI6&vCejZXU0um^-bT22_B<>umX+~I$I3QkEzx{_F9osPfb5)% zCLj;_)$#)n-#$+l%}}ksehzE)R=w3Wc$VFSnFPT~ zl65X+#6)SDW^d%=7c|SUb{mB~=wp%ZW17@5r6uT26qfy{$ir0^<5Ts^^zQ94As_9( zw3*SlITM;n#%LcRy^8hVW5_^@b!;Hyq|sr-iuUU3vrtb-+8W8dT@M#nPA}`r!t?E; z#8J!ZL{bR-A~#aG^ai8z_lh8z7{VrQb_UZVWDNq%yESR~t8G`FCleehv`3)%r})dH zq?%RWhp7>Wzh1XmoF9xIUuAF&Pf+sk!RiDJ?GnrRLTpfV2uR4=iEu? zETHP5<~;9N4h-x$=Sc3k>^Z*%?>QH^Ve%bXhd1v3N|gB9p*ggf_5BMB-1LuQ^sqoF zP$0DZLm+&&P{d&80oI_eJNO=d{mSO7CJnDa7c%LDjuX+?EI!z=UFCW`df3YCl7_bD zUlb|}qs<9AhaXiQ2=ICr~HUF`HQK0kL~tna-&OK91lDgQNFIACe?7qt*qjPyTJ3lC6HIWE=0U?P`)q87q_ zvW5KrjxGF6Elm9Hs)eC{sD<3eUZ7gY@k=daZ%~H)U<(g!)|>rnw(vhy3qcIK(e%90 zRLr7KkZgShgbO)e*s(90Jop^!%9VICK^#V8u6$yeuNCCMGR@smY@jFdbwJdDPG6t@ zIn#^N3WO(lX12H^8GLbfpI4fR4;c+^?D`_l_ahNl07ljAC;TGg{MXB3{T_e48dF_R z;s)s8g6n2>PHo+NkCur_%ex=ESu88u{cNSXoEJJ&cI9--sGXN3y76SfJx9DdJUk%^ z-1c`n9$_t7`2ATxn*ht)doi;F4l!^Op0~CS*?DZ!_BX4rb!rP2PIETkqe`zL9D$5(N)yx9R*HDJ_cWC-r;T5Al_vj*TlHyh z7d9mIg$)^UVMAh`?MOYRVc9;o31n|@P_Y}GyPj7q2u5?Tl#H^J=>Gj8^7o6#-!CG6 zzli+(BJ!WUh>+L4AnP>B42nKCmKmF0eaFh{`;B3x^)|vjkX#92f^j8xz+goPtm^a# zqG`#^&v;@I+?%a@TkPC?r%+eJcL+F&9^ToCXlt(z`}$1WM)jstr|pii@#M8S1Dzci zCDoU5U?;1URx+1@%Tt@~r?_*6(#B;Y(|bR&N+myRKP_~4F^g}HXUfOH?g;ZnG$~eRf&LqC!uyOuE5%ZaA39)GJ|*wsCGf<5%B=W zF31B|?Op}h7f<~nrY;(IX-Wyo9$1?4_N}(k=Vuc*z0eLDlDCQv@j0DJZ%ixU9>@W5 z0+KDmZ@<^-|CqkFN*g`7Pq4V1#6Mg^QTx z_pC)af=*oAs(aVyx(*RBI}#t5o$-Rf!!u5Zv>f+OEIjdxu>!!Y*{O$Z7vUNIXR7ON za40T9=macH$%U7uRNJ$=rf{{n>^!jpJ5z?6{7x-d!OoQ0N%-_#1f0H$lzHGC`~I4~ zD;hng^WQ2O+rHjL(iKr>emQ;Toi{ur^arQ!tT6caUB8Oz8NF_xiQdN}2;;!z_#FVp z?_34l6V8p*TLU@nHbo`0%<$ z;1Y`C*zkB;3J=e8Z+`P?2RzRq%(s3za6rY(%*$U6T;&+(z|{?WEPJGUI=(M7gZ~;2 zoUZr%nyxFs9XMd>9Kr_sMXqq@jP7ddi`MvV(JcNVSF&nAawY8zoLtFOe7F-XKY}ccsu&Lc-7ne#^(Kj~g^=p-Tu|`oa+~2(W_maQL%ZQ}{%rDmF5dRn;9T*dfYb#(IOhv_1}`90Lf;-;h@@&+ z`-VnjRRu2~9h;RZbTnJSRxb_@wu!|WH*!|1f=|<*UX)a@VKc%@D!^&FULj7BHVQiS z2&I=7Z6yET^X!aT&AX&S>OKVGS2AB3!Ek{R(>=~N@M(JsyH&irIv#;=AcJtDPohR} zd{YfIs~Z-{T+ItXnUJmV=?~uTs7ZM1n7pqB<2hvQDYo^!XTWqIC&Sw9>-b=HTp5&V z;f1UczjpIOzD_z~?JLYQ%_q1mst8ZqUpUp`;?88JGwcK7FxxVFYK?E3WWhKL-)R=oD0~4n6t{QA@+2NyfYmd$ml^yv z^a61nz5q+LEHkYogBH~eO@HaH@uvmY^ogOz1vfu}X&At33w%If$vHpiU++Nql0js< zjc%32+wW@bN;!dz?T?B0W6PqeA1(&0rvIHVGDT zB-FoVslGQ7uc20O%iQt6Wj`J&V7D?2|Bz63`5^%f#aPMAXFu18W0DR0kZ^4GC4rpz zN^&}EKfck$U;|5O6Sg1taaG=K2@d1sIl^JQkbi*j-e16YkR%YsLv4{&Xjql8lJs8L zASKI6fHx(s{YLF`2i#9ov+!@vDpYBl+N zsnz38ORbR=?WQL`Lp$?7Lp%0AY&_XZ8}HpO8;{r{#^fJxyaM2y6HK_mHN5NpO2f;z z(D2GHIz7%^>Bi-e>ty+y!d1>>`#YwUZo^LS7v6-NctuF$IR|I2h8b5aXMsOtHA1an zn6m?*1YZ_c_YRccjkdAj5`3<1NowpJGs}dKU*95dz>g7w;KzupCo`Xa`xpUyK!K7X zssh-|P*=vpARc)SAVT5+;Tc&;UxC0AQ!Ol|`;{I~YW#<7MV}*(n4QW1xq}doTYQSQ z0i&{aOyqGd*C`3)bwZfy>DW~oxlfsVgKeU@r8n_$G}uw7fUO~{+m!eOQ9A^qM7RNi z)oPXLz}^D*`e^eBF92_@ys(P%07*8FZm`l=v<=?5dF5-A))1xo#o)c4(L?eg^nYk* zPu=|^^q;#hTjk3&{j{IA(<#^%K_dk_o~aTlzl)zEd(VydEUJQ!OoW{wt%+`*m=8$< zH9`83{Y~%i6G61J??gt)SaAJ3m$-m7CR$gaXZW&nGx3kkP5+C|%_=ttP`3!7wA6}o z-sy_0yT2AB5(>e6OdvX~N1gx7+OApiq^}x(zc_;sGeNm+&ormg{r04Q6rL@4F`c!N zV`oJ}Tj8pz7_2LF=Mgw%&)l!^4xU`8f=}7)=JOWZlz*GDD*)(ZP*xZ?Ll3!_p>MfE zh-Lwv4;`$MH!r}O5mxwef(+_m;_u4|T;iqjk2aq6SZ%6|nNsar)T7ipjngLFxe4)q z%clnGIo+m3TfL-7l|W^ixTm8S!lx74PDggFwWL(21y7PIld;_3z~5C0 zW~30u@*et}-i+y$NAW8H*-DCmtaN%Ad`Y=lYMrY$k69jNWBBV2pNt*c6EKfF5g zm0mHVn&%>u@={RakLpaA8Ec3>*qwP=#3+*X9_-E}4;nCU#Txc&)L+GW=za7vlv3{o zhElrGaC`RFzii)_Gc}^hk@@u4Sv-Q|Sv4(2rlUmLTT0XpzuT^>@(OL)Tz~L~&muM% zz3nPn^N+tMIIKw7R9$~anmWwZaHZd_%J^>jEu3^m-5{aSSD|iVC5lt8%+3`xv=%r@ z;;4=B<_5G8Z%T@fd_1iH-+g8Hb31D=GKJA?&#C=9e(L!h{Q- zq3_0O0?FeLa(p===Iu7uwRZs>*Qza7rze5daR>+FN=0Y6&%n&x)r-!=2Cy@+X%F6+ zs7#OLgJ2~Z;8eAU0uWC?_!+?RLjp!wzh3O&qk#NUH<5yuEu`JEq}_R8LPLD7me_|8<1KYnXLviB-|O}Y zBc|-Kk>ANABsycmrT&EcCgTFj@wb!<?o87&8ZVTHt9JXWSL^Ea*pFrY_HtfN z+P3ttjen02|k1>ap*OiW9-pvCkHu34|aW+8^|%%Q@}Y!wdx-nqoGv$KJ(Tq zeKsnZR_gJ6kYjXt`Tki=zUzC5t1&wsk2v^h{APrK;ZI-zSskE24W$QV+XvLp2QYgP&Zjp` zbRKkUqk{?cQHX>Hm{5OfGpymBA<*QcRGb+2HkvY^>kc&HK%?oje=+Kr+M`l-Z+ns- z33VQIU4~y6vnM~d+Z}i@p$!RGObBAkS8qzvuku>p>DlfaWlVw$O_tE~Hh(p-OkgO2 zGO?P33GCh*+MYWI?TQo^^LQk19)G|5)0T{vZ0ecmJmK**kfy25xFQyNHgrMLY$Syy zFLgbdIx$WH6Y6_lLY*8;s6Xa902At-s$fDr(r&uRJMCveJyL`8E*MaUl$~@JwG?L* zkX;7UyT9w4HPeCtbwwCFp&rjEm(i~MnKZsc6gz|utQ!Io>P%oly^F(1_H*DVpetCz zzFG$+)Tuv!3H8;d5AyM3qTmU2yMZ~*wqFVL_de@d?U5R;L%$`|LlJl_#qQIj7QOV& zf(O)9!GL=79|3hzflsbaS~xCjnzPE;4?@Sy7c>p74AJZNaGHj#K>3oU34M}c1Gf=H zcW!|;BJjQk!gTAGMZ>glAozzx!&!D$v!>vEiQOGdSQ(f=4_JXG(D{BP(4#?%1|a$f zVTbuA{%8sc9p?Aa2AhIRPvk0pH3hM4+5}T9--kB^y^a2KlAbRWsmOTQ6qJh$(NpV- zpXf(8(rC0_bk=($|9bB6jqC${5=ujVVlbUj{Ue+b4~A1Phc3b?Mwj6f%F&Ngg36j9 zNo6oZ&|qdbsIOQwP?4Ayu=<35;5)#9W4CfAnNiZ8UfG;M=7Yw}fbR+aA%onOPz_>B z!iMfwKLjnSd)t>4iv4yLJa6nNRmh-^{K5;j1+HoVVw{-7fj~_Mc=M(0? z_u&Ru6eNWHI7(1EN`lcbjCCnZ>rXvF*#f20wh<+M1~RphQiW>simR1`IQv*|Uj~jZ zHkg9h8-NQ5iVbVLI%UlFgxB|wwI%VSK|cp`M@6=YD9rKmd!=g7msuPVkAV9!lSNOT zUBB>UjK4fZRWEfZ8APY<4kl3}D_@_G`BJdb@h+h>i)d&q;>Dy_a;;^UvSF1Q^OJ=f zE^lW%WaVN+-%$;+wA0l|EVs~Bkt6RUk9$u;q~2sJ*Je2+$5%HF9H)A{DiPB7bQA8& z>?t=Sw~raKtl>Y5?9t}^r3o1yL95^A-h;4{R0nEcp;FNCk* zLZr4fIsLvrEH6^G#&*_UuHYGi%^>`9<_`QmbEp2(%$TQ3+WJdo1ld%Q3#lU+vsK=a#{|i0leEC9;fnHQg)?Xmh1s4c)J(vMHAQ+?p z5$gLt5$dkzK5N`O=EIQ0B#bt!upZlmfy`JN!dM*p~GeFW@Gse;xhFhz?W(bCW zU;-3(I^ZFo;}L*r3Jd|QgCQXOA0eQ_{A?WvDQqq6Srm3{UE7rDwE>eqLO}W2KSMx9 z1zBX)BmVFZ(AOLA5RkTd`~VmNx(SWgi!lF;_Zf2A`P4?8RBMxHP{4 zS-Kkr8XGZEM3=h_>T6t#kamv{+fcN|6{GAs>h31~*2AA^b@qfphm9iBEeq0nuKW8m z4$J$Picryx*_VDrZ$#fR)H4E}ATo?RU%A7TY7yV{jxuOpo_+NhYq|n~ax~03TKE;5 zmwbJaFNpW$2QR7Z=rHwx)V|4@eDP*8KLT4XYFG3m3FG5nEryb6taJH06yelySNlHW zA7fD<=J?%CuPCPylRcwER`U#frxG|dfVDInI;zl-oB742h$gp7%DkstYt{cP%Lutn zg2ZMJLYmpsEfNevUt(5k`ogF0I@Vp|hBP#uY07(cA%CM~D82GlvFdP9Zsz@7(~pEZ zP~8mCL}Uc;S|IG4snSHz;t9#_!X#MVy2xhl61{qPfqvT(!7yLPw~60@Z|$Ixz`u<9 z(^fm6&k59KwC9Q%`2%@YKU7xlocd~x&X%(aC*y?jWDLoaTOJTvm+q0Nln?bH0!EZj zcBJQIKnNvN6l_^-2mcXwbZaMIQHFY~75Q-|8*okuCC6jHB0RMCx!>wy53o={Az03L z77fK$?0H?103#|W8KNWLN(B{Q0B^^b1Pl`9SgPT#Jb8FxtL5>a=W@hmLAevcqy#(> znUvRoUMeUxOt;IX&U)n!G(6{{+B5KKE1cTiH8N41qWf_U``$O~dm}Q}Y!dsN;#Lv5 zigVxCC)_ok$hAsAP(6yp;T*ukI*&z*{OUW{|4pr#Xt1F;Lxyb9UBMD;XL&G|cG1pa zTrDcn5c7!HdE}m&N4iaE!@cB-au)9J`T%=-HA8f0_mJr0)sIGV)D~P%PAY3;Yv)CF z6WjYkphW>!V@W_XU>Omj;CUS5Mz!bES{XukbmnE8cmA$;2BKsYY1zS=l(#N=5} zBI0mkB-E8Wyf{9z!|z?Y6kc?z%m|NL*JPL!mlGZd!ncrN12XbXAocSQ>9(Uu#^Nugifwl~jx)>10NWRyUb7;?&* zD3mSjNeq|G&nOrJ?=7U#hdLC;$d&i~`3I1mCymZzxr@C??kyEpD5#cTNFbdRkDA4;9>dv_AF>iHng(r-MjOz~$`NuGHt;gfH_6qM4COwjoYb#x`|GDPG?qBRXMM zi}o83cTG4TqQcClpPKD5aKBSrd@84uVR^FIc)BI^Je3*1n};wnUchgs!nf2N1LG{2 ze`k?ZK^8f7!z<`F78zE%lUJfc9?(BSd};*#a6vKZ-_w3+5mmpCl4n-qQ4UM`XBAVZ zC^4qW>lT*18NBY+Z-jQNx-F^633_+f%aoc|em6w73kNL>5zxYTe)gM%kzZvqaLwYb zRQKv*Xp49W^~-J=f19?V4?LXtp~bQH<|Sa&5!^OBhn@Ea&0k9ok!6$D2nhMax~-5k z3&5kgr!UIUFQdBUZMXDlzaV3pUL7%sEmCj!J*wN*%ngs~Iyml$u}`VnkV@2=Cd4jx z<(WPs9u01JEy|7g7-L6JE&lM6p#i77L}t-$Egs|IUojET$YIh9@bUOXm%dATr-GP@93zb^Sv8qy-k@u z$A~j%LJ*wIj48EyrGYj}^1~x?)%*|d5$Uep^7?e`w{@L_5d6qxvVLC7e_`DLf#-)X(EbJrZXOq(fqlh+oVx*f+|=KH7>WNNR< z@F`qe4p{gUto3_h>-WAi2p79SLiQ`F6|cOb{61$#2F(x-sz9S%tTfe+{^Tc(7iDwT zRrfPZh?0MQ1}~BjmAQ!o7(#rmKy(m4-_{PZKnPWZ^$+J18XA1AG1wAf^N1U|1Kqc9 z@sQ6WPf+wy+iMnTV!yt8ijTmT_oNNUjH3`q8D*r8KVj-!w1MK=M_3{D9&p}z1mvv+ z>ra-G%Dl%i+6VMP!`mpkGD@%JKXVVIc}&`9?CMNUSF%z;4bdi#4Ec0#*$gTrfMTbh zLM{mVPNs9ZvShFSNHjv;CweGl6ff$QQF)wWc!}N1xRZAZzwN$tw5o&=Em3!Q>L7iD zVjk1-x+kZ*ATT~cN5qqXU`nwO53*uqu!g5|hc>dnci)EWj5#9%kxqEgZjj5cF12F@ zAazk(gmtrNO?EEBx-dAdy*!VaO~UqZs_<}q3X?Lt$$K4`b>pODjNu5fREtAfEvPgB z!@6E=okdsF$pU0hcduvD%6#fpWQ%GICAf)_(d1sH^X9w6a$xL&&YE}M!)%V6?SL{= z4aPi1K2-s&Mpj*^DlM%{49Vr}(I$3!t8>OH#Ae)KiL{@)(6aO}s@j==88YZK3mkQ0 z?@-gVGWHS@bN)r8k$XKKSFRiIRTw~tl;SM~zre9?U`ICe7xvA9!^E=|O7vPRJ`+7Q ze&VU%yqZC`-YWyO8%n1QJ*u#u0{8)303T0#Rha^qkVA=KoXdJH8DMC;L**LV3fZ2e zm`FxMBs{76rhhBBxd1v^;W8tP$>}Ap?AH2qu0)7wjIK&~H0*Y)gx1EY+LDmg)`pc% z&Mm%m6NS)FPs_4_rZtH>iJeX#7wg(Gb7Qr0C;0uH=e(map?;eS!bXKsIQ2_mWh;`l zN1f_&XCAP*yPh%MF^b1tUn6{o-)oN-IQ@vuVujKxO$7_A2kN5BJYO&iMjueVqLU+* zdsk1??>*NkgQ?rDr5NoEN$qV_z{|qd{Ojfoy^_whM&4v%rry)w+Ye+i98K^i6Pc^u z;9V1_xu$c)KD`uq59Z?N`6MApJPXInGDgFPyx%Dk_KFZ{=`uvd0_IKoV2NEr?M3pt6+=HvI zXbHZeoX}nH&q9>7-@9ur%2r|GpJGwdpAq}==-Ir?pp9ua(D!k1mZy1#712R$^p(K_ zPm@5ZktO@FBX%arkXxL4o`bSkxRArfh9_)xi2r*&mMV+Cc{i&|zuovLih&(`UvLk; zFG%c0_|_n7_%YJ>`!lubuZcI3C4rn32oaJnBT&Br5d&*v&Q~Dp{BT^wBMQB2%O}NA zk-0y2xmY3Awt-_YHL6uFy`E9CwbR(Z>mayM`fTiHY0Xp;V7v-}FkI6;BvCs`x;@40 zW5>=%Hmzx0F`bH5l%XJvh(FsME!=Pw!wfv>9&Ql!?~0NNUa zT6wrQk;~xmoG^T|Fk{tI;q7%T3xNmty)4_srTg!e;!3{zk)QY_xTpsuGVk8W68ccQ zzPe(_obY0QHG$})Z{rx`{0I0EOJ#uz?L12tI@F=bH)QR`P6bM_IZ;j57<;A-Rsd^OTA zb!( zR8>vkr>Y;nwW^r(vo+`VX%8;gniFtx3{y_j5xU56vs;V1E$4T(aLaXvLiNuOKFcd6 zG3Ab;iEC@;8wlACeermx@UTR^gMt%yL#%rLQQ>XH+}HVz;&+mD9Jw45a$UX~vk!_@ z#g<-We@8OA*@I+2O-KJZT#)&LEsE?da%-XWSERxwxDXCfxN4s0auhOm6G=f`I^ub7 zRreV3$VAN7!A?IqZqh{MbWTQ6!(?PAJP<>I$T+r_*&$y-d=)78n;;( zyHTui12RKC!*NpR9lXB3te7AAFHL z8VDM9J(pi0g@-bA&l68G7qB?GZm<8wsikm2X4$5WuW)(q=E?Ow{`muNo^vo=+G@|| zA*6`uK=wQ&5s?*;T7bACrN{!c3y`N*Qd%|o8R&uG+m&YE=TSg?5fTOdH=bVvwXLG3o)^IdJYQPkrpwr|mE-Oo84z;D^3No7i0Sci#Mf zDH*f}kpA_!z)UD}1 z4ykI){HlXrhZGEcBKM)gSw_L8j-dB66&8n!1)eD94VC*kl2MJfKUBTyAThs zoKbrZ5`_DvNNYE^-I8DP;aCznu(Ah<1{ah)_aS;nsds^qeF!_ZiKb-qOLaF`CDpZ` zb5u`uczGgxj#_q-F6q~E9Z-MwEN`ISxJYOUb5~x$N_43!rS?`2_FtY1iYGr^(j5{ZN0z5o1NngKW-sANEN)+Fhh=bin&0pb5fpNPJC381Ko`Xw)n(*>Qn3qWM?o#UO z!K#m|UY89-^xz*kn`;t7r?o1h9wJHC`vnEVWK415DVA8<8H;sDOs`!V2+H-dD3;Sb zmWNjqJ^zOJHf0it4RJ4!g_`4zCRxUnm({msXl}URdguC$cchVBS2S`qbQSZ}F^v4| ztaSPslo4B|KpD{-;5!1JXyE{G1W`jx=Z+F9D_=i?KhX#QmJ`S(;sNlX3PO)WtpY4m zK|GMe!~v6P$OEK(AE2iiB9G_=WOaj=4rBn@15pM4W#Vb@Hu0#pJe?K_UOMQ?*Xf|( zrQ;QFKo8A=tuP_z<7*oV-pcyi5T1<{_^9iZkzZS)v3HWbp<>bJjSruuM#l}y#@=T= zc~c^na?}X!MD{gP;=4m55hn_E@*Un-PiAbECs^Hk;f#iLM-K~FYmA%fJ6{j`FoJmg z@s(JehGEu-#(QhR&DX)0WjqZ6)5=#jU%Q*RX~2bQKw=np3G4BYck1bD<0DYqu9&HU7aRKPbYR|Q0VEZyaCf!-&u$V;bx8lSMs&R z78H7R9O&;`PorIh%DfwccfzuRov>4kUlfKfI$@RJov`_un_nix*PJZzpJNa&%4E?^%BH$W8?$^Zf`ubH79h=Twv3p5CKP>=nw^g?kWo8WqnKj4c7jY2vt z1mswuw*gahC=PhG+Mz=^5DNgr1IRU)I$gt;gf3Ryj62U9`8$UTm~~4tA8jOq5v;m# zQ>u}BU<5070*qj({o4pur-IOB1ZxV6VC}#oSU%+&sAylGRz6+O;9bwWnZN+N8D@&**Qw_o@x0$i%+LVJqt*P+up zonqMOkvAQYwo$X#F)D7TUVSj7V>u$3_u8{#B5%AhST+nzH#g9{qj;B-3V zP4D$AK0dSeNnP{7{w|L)N$l485pNpsZTQhXS7g1G`;dqco0sh!1JkvPy7gbkEuT%&TjlmYDYU_6@n6AMO2Q9gl&~;~nJB_Zb-U(u#KJ8|Axf*oJp`adB z(5>^>y)9Tt^P0!U%1Pjrb6l~FcJ;mIAJ0^IU&(w+etA)0djM2?2SZplfYd`Ugq4x& z#RxB-mH&%Z*)PwB&i5ZV)wLMIK%K5G$~@d_(+RZS(2b7b2lKdR9Zz z(MIA(jxbTNXsy@)XOe4c(>5m1Bgb{cO($Ky3{#P2m)#-l+nB>h<* zNUW#9{`{BwV*9b8z`2yHNBJ=;S1!uEi>h81bZ&pf4L@fcy)5_cUglUNy`qjRqD*eB zW1@ZMVL#YJvmi6jpTPD$pc=#uQ3I25^6}ERm`-$5f{26ezFir7S41n7y>W$t=UK}a z{|2n!!1qSt*Cgs-B6&ygW=}XVhn|pvXo^u|wSDC)Rj$Q{SCaZ>_s<1Go$$-=gz;Oq zd(ThkUO~Q0grj|PU3MDQY<~Hfm6_P!KaPKN-ltkd4(iTRpGq}s_kn!^|rjRL_wl7hZuNvrRhE* zm|T&?y-co%kAcY*Y0OA&cyc9*XNkBo8BDH3|4gntDG3U6+gfHaO>mpR_!ce4c-jI=p z1k#-H+>B@Ne7J4+kz}h(U)<_tKHQ)c%!hyZ*ZFWg90V9lzJV{Ksv?x${w=+~{DQZU zidN45V(+cOs_xr%U0Oi8r9tWLE&=K8?(S{}A)Qi#mhKKgDW#-4q!H;x8U*Hl;PX81 z`^`Cz`K`4v*UozPJjRwA91QN?bzbM?Xos@GGYSY3O|g$al1*h7eV{Dd>A^i*!r)Ls zE!DAX<65mJQ4FxB{v5#%7*mJrsfTe<) zM4Hsx>G13FtY7tk@aEeXRlzmGCZgGVC!5S=(N=4|Or;S69~bQer)3;uvYcJ4&cC+? zj6caJM)s&{a{7a9ca_?a$l=S}lNoUp7$Enf7lMAh7T$Km8t&! z`b+2HalZBA)<>7ZJJ6*Vu9au~s-5Zfx-QLSjNrT!9^-4QH#h?T++8*ZdK`ahDv^$R zCdw$Ml(+P_1yUor^8`AQ@6A|ERp?IfZjWx&d9B#9qB%7f1%n{pTg3nNy#)if1wv9@8w>1zZOORsQ4}5W5 zQoNI@0?^@5H2Fkj%n-@xckfuhrW8AzX=`t0>Jh-Tj#~PWe6u50qJ=eNd9k!++K+4B ze-_3|4BXQNS1pzg>q<{2vw(Cmxmua>0d{!8)`U?fbvcb_(yQ8Vl&CC`XJRh8!|?nf zhxMc@nwC2fpXkep|>_!okz- zCriv36&%4N`I+wXLpNVhc})R$n0wCT2_7ctF#*Zy0`M?L3TY18dcAs%2lJH)?H_oU zw6Nh3fQNDYY3}~O!$yq?_z_b)ar}zo*cw0gd!!P2xewnthj_pBD?N{UPV+(zVHegT zYJh1-7mebc0bN`$q0N<5_MVTv`xjf7t6A6eu3E^v1S%crg_>b;I zlg$%eJptuMEt+pqxu1~ep^+FeV_+B~j$WcxS<}@N^qKFv4bymDI!GzBPhg5tT@cXz z6lP)vxDPB(G`ED9aK3ba`xt<5AAQWo{1`|{iL{_5)m=EYX=}(6KYfz9x@)l5l}(da zY}GzeKIaxF1~@i0JSou+<*Al4$IIQ&%`39n5O;9Gr?sZaI@{7lJ*sBzA~rA-{52#4 zxU%_AHE{7k8hpU1p$?oHr65UGG`UzgoDD1;hUX`7Xg5EK*U~NlqMFVx?L7e&gc@-o z=gJj6>G>II7v{3}rK5H64z{)WtCI$+03VJSNU&`yBw0~WgfMZ>n%22e-4dUClK|niz(Ge ze%9}Npl%OQb_~ROIM}ER< zQ@!Jud?9z9WIotj57t~2db)>nyr|?IzcZTBOI}2^j5#ip8h7aTt>m_fOFZQVh2l}tFVwh%C}VV-`eRBVJrg)8P;mO! z7z4ZVIQnx(6FbK=3P9NQXDvIWNyEv?0fJ2Kn+#FF)CNt^Vy|Wfb``f^G6<-GNDZrI&gv! z@Wc2gqWD<7UEb)8O6ZT8;h`M81b#WriL-`wiq@-i=^xGV={Uoa+l6a|im23QFwgaJ8y=YUN;IxVr7ZMiZ79ZaY`Prq~YC=vZ|FjI&tx z%V)k*2zG_f$Z2Xo(id+PIX>70B^%<5e9H@Kg00E61vR1kqbSNSMu*143k4xB`Fb9MY%4QyJ5w^*;3+?rP<%fgLAFC?Njn# z03;90K=R;ntw=aEW-z#b7+nE0&UT=gy5`CPzfnnR>rPR zWzlv>S@h!T3!&TLK7mWU3;=_vc*0<+XmU4KR(Nm)#=t)vzX%*^h=WFew&5b~5k_!cP z{{#ikp!!4}M^lD=IrCU7>@|qP{79jA2Cq=R+8ju)*^jP@JM$0IeqA30#rK2k;;8WS z$J+uPU6MZp_Lpk<}>W zQ85FCb#A9yb^8HHAFW-7E*IF}1D?-+U=)L4^6-EbX*NPs>hrQephdc>S`OW>&@wz3 z2n{i;qy90h_vE_i2l6q0A;u+l7R3-Z=4}BRWmI{%E>lpv)=z{KP1Sv#il!Ud)B@3b zAd>{5fTGJ#@nO+1RfNwoTDV}f^N(l-KJNu}IYPsnwVr9$<~nn5T|gfcy;~hTs$EY| zodLoY7GDC^#XHlSZ@2%&EW>z9B%lzRd4mW8l3nbH-|mi{`lJY zqu0~TQNgv7bU%7w$cN&;%$Wjeu^}>U7O$zup*-3E)QunQlDW*u4-BZhb1c!JsS1o- zs_|^|(0I0SYI(u2CE}*{#uH`6%I|m@(cKgl$A7w(mg3=9bpTgK73AtD(tJ8P-rFXJ z%8&5VW=|l{fy4n~-awXKGP0X649)X1EkMkFCI=+#7xa-UTA;6nQ_9oq4BT6&u}-$}tK8z9&9f8WBT2d)nLS0kDEJsb8;YlkDG zcp0Che^X+R)rKrEkcdyYGaKLav5w;kz=qS13H>IvBdTrCAA`1OlEWM)%z!$~wWjUx zU+C^meAZuCatES-)3&@eJN}{k!v=FLRi<%;TI@U+PJHh%L(8_QFO6lR6_H={-l3zE zRQCJecWDY+#WNP%7Bq-u(%$=l`)4x>s3B_eLX#6!DfSywe>jeOc4>44?XO~b_6W-D z{rUn~H$AhH4mSk0ggAwkN8Fj>S?os_6=jwREo($PU(lyS-6Ob=_8#NTr$tsHw(krm zmt-iHAmOwMhBPC6m8v5q1wX|oA6kzO5ORJ1Px?)P0YJ{5yS4U!%{LpZh5owli8B5+#3@wZVx2Ugb3|~tYlB^Rx=Xd?l1aY|_5NGOi5tAu$TDdLf`anYXgl8JDk8LZd3g0JwNS^K;uAB1~fLAKgS2)yR?0Izux zi8Zb}5!)Ym4n#4=2Y%O2ovS!VHIdAC3c3##Oaz6{uD@4}@C1dU0nd3R1V6V8;E4G# z-GJvjV_`ZCK}$!_^6=sDOUWC)#Q09I`?{4ZMxQFkEbL$`;~>hiR#?l@Ryoy1o+y-P zzf~4+-{F2>s9@!kLLYkdd<;!I(WpbxQbYNpy7%oAdg|c$;Z#y?+Ha(J_OE616nvDm zw5t}u-D4S*fuIu7-v#2oKvAN1YdbgFQIY8A(vSRNi#yK+rD)wy6dq*r23A6VK=t}3 zP;tE{4bis2RGGo|+FfThSSpJCT47e72E|;(V`)>NwiJFTK<%KgZ{DZD7gLir2yVx9p3S22!utpK_zVOFHoa`z}^ON0tA4`hWUx zd6eHSMV#QOb^Wc@(s5Kc-a9f~j5E^@w1AJ@2md{?{ob5)sMtv+W1$>RB^9- zSt*+`M~kgH6y5P8TSQeinHki*jl1;YvMASbPOzXj21Y4*Uurvg7Y3jek%e?(UwL>wyDyp;P_vij36c9P0_AJLWv55XLaQ>DwU4DI81uD0YYb($}P8m zU=xIfao{z3Nd^G@0-6R%0MM_PV547?Wrj9X{o)y7RpO?bp4sk| zNh2v&ba+(Za6K)M_83!EdKn3B_7Z#p0 z8)Ri_ArnRxaPHTU0r0Vb>SENOCA~PZmyfZ~wDyu(CHXEk@6K#{_X{^PRNc6~$B*n% z=sagn`4_-P1I1g}x&ng<0r&vdrr{I7XIt(P*3&Eqg^sMcuU%2NZ}j$DK~LmBWy6M1 zvhSzZ)&yuVV&#qg61otjNsR!1O2WLoK6+}oM1RjA$9Zk45`^GWN?$%@tGu0JS*>69 zCw>n_RmN9GMrqaM$g)YWok7QJr+T2`CACcA;WfRi#9lW=-^=%nJw7Ga&8|y0g4nRc zmIO*>S?r5AuH2xqZ7*keS1ED#;fQaXU&qs9cOs{IA< zm8y#y($m+YQwZ8#)JD;|8z;VtB4Es?{_{#*@)eG!JoV2jwd`=6Bk)Qc0K8I50I$@~ zfLH2(e|x3Q|MN=ifEkO28mIZ(4Dw37l+fV@d8JNii-er|`87|k)cWtgg8n>Ht35qa zhXA%shNoxhyWO$BU#Vv!OIEF9ZLGVj=fK}EpZ#3#XI$tjfOX}xUV;}RPf_OAT&9)A zGgsA@lI4FBFz+>H{j(r8p8LVZ-oND3Zb-*@nM14P3bU{{WZQE>KO6G^W4Un1a1`C~ z3!p*c2Q_{|Q)|0R*VrRRyHlIYr!-10J3ooR1Q-3Pbo+!ZzDsX0Q|@^|o_+tp{B^~e zz`PRv0Y>-ViKEM(#LDHnC08N23w}r7QKve3f)gL`Q|}<*6_9k~tn~D@!V0A6;4M#*xhI0C=f<$bT&q@`jwvhHm5t~(8N&L%ZY#(bY z`rVaxn%REjdYc=Pq9weA9T|%Eo4xMUc2z4H?xrD*ho45!E5RlQR4D6Z9QQt5zbMiDzrhMyp`C3=Fw4zo1+Go#rv~NE% zZUQY95Z2`N7hbR$DOj#Q7l5U2sh-*nWtv4ztD)v7X)m@Ys>X*-oIdm%GPP8Sfs1@k z&W7wG*r)u!32DuMM-`dy!81U!2FMAS@Iimt;~qj*jmFsT-r zN@MJFJ&hGpkoGw33*uHtdz^%Hk*N&Q9%m^2_xAXWX$ZX+c&N_z(DxkfYBYUZCsTYg zvU~0-iokFFrx()^*B<*xy3`%2$>nD>@|QEQ zf}|%Irb;7%nbaum<&oiFbeJbv6zB&LE}f|y8A zeFCo(_g|K(<%_4a?ty;>F;Rgk<3|MstHw`|-(I;(JonaHGL04Y+!{X14&Q0MDq{6p zMf{C@GGJBH@Gr7(6d(&nZPX_8anrR0vusDWgRssiB80SxQT@t3>Lg8-I-KL`*%$5w zr#Tfih>T})YrhnN;`6x|FTZljxY2)Jc%E-9jK)<-;(e$NDhMDSkrvUj(h@(R8)7#! zu$em(MC}$I@v{9;`za^_Cp`hwsW>IO4U8_xYr~^jqX}tzBG`)f%lu?x!(o2$9ZFkc zrabRVS0QIRb%UEoZr1seV3oIQNQi~19+yK3?A~5uqTBl+{n&1=$+WjeK+Q#4AN7k! z20W)A=(T#+3n%%&Im8%Cc4e>cz?51Cp|>V8%(W#P*U$5py>4)-5^>5B29^iVev54n zKqWyH4jJgda_2P%{-TeC%9^Di2NGN*jn zick*|ozK5pB&(4-Yb#ZCX|U6bBu#v7S$z##X9l6175xE_1lE<(!Shn@Gn8RvC)1fK`Sf!cc@is|@BWPpb@(V%sfH zki(q*OOq~Z(E$G~33;>O`h#}>GLs8tGE=S3REen^^I)s26LuWYn$kx-AZBdGL2QD= zjGT~|Q3Hq>Z&FoJMI9kABg#|ED0+|!q>NNRgb9N=>;k=23Kaw!OaRmUwf*;`J@|(i z6AtJb`@GIDQpnN{LlXAHc}rG)v&YV0^u|O69p^v6Vi~$IBv|wWf<^ao zo2erUu^{C|lJj0pynS>826D_vPiQWvRu)G;lQisXfqa<}mY=Fq$L2(k>zYKS zdRZMd1?8Km7DISq0ufI^nV@6oV^RrH2JWdwNcM5pDDUDhn!mJJ!J(qI@`H79x~v@^ zmR!dVx(+0nHryr1D0YKhhq^ql^lP+=X3^9PigkO zK~{0g__tPkGti2^&eUM6Y0kItwiQGW6)rU1lQ7VieCoyH@EL(gG%^+mL$0zpB7)rQ zyY6d%UVP4Vd~~p{4icmoKR%Q)?Fu&107~NqUw^Mh*?KrV1&QKi|5K3o;ZKk#`Co#> z!(?r&z|Y?xcuw>W+F;g~p07=oWUax=b;Wk8ma}t(U!1+B507>aP$5a8& zjb0ov-vk`>r1F^P#n%I9#p8P*uU{}j_4AH4I?Blz>XnA>)Eh}hF;OZABuOo;OMd}6 zj}#HXos!=WLD;4fh^_C{-5i*ijWnkPKbcX=OK*xJG(cojynu}=F>cEN!-me43Mk0W z4%MPV3i4NF2u%XFv5TCg%~(qd7ai77?q8qo`5mAj{{R%^!F~};e4wFVnX+{@ zx4V7dLMNje9DDEoyS)%wL@k&#^_Gak95idL#Tjz(iCrzEUfyhhc1e3xgOE10@>*Xf zG>^|$n_9=)lOXZ;FDCYi;QFGjsSj^!)r*}zQMp?QC*-0qfoNt(|%2&vyX>)sT@DjcmMX_mX21uU zh||qPMG$^_(?Yq7Rm^*Iwu=2Gb=VQ#T6PdhImr;rx0XiwLDkQ(&yGFbse}w@DQ4nv z6y^7cj;xhWK>w-Eqd}_knQc$idCsLarl;z>HB@x{Lw;5){Tr1xPAtBDY@d-%5dm9_ zibSDuSa!vu@_d}C6Xx{uRGHY0VX&k$6FSHuy|cY&GZcRM9=Zul28*d%?BQOgP}+ zO`ws236XOBadH`paF>LeGxe)qip^l}qf`v%UVVUCt3C34E>ZafnG>lp&(FfMRo1qw ztnUTZ>MtlkTInjYs>Ev0%><9beXZ2{k~*9h@z2twoL>48xwwd&N4#r4+EIUP+2A6i zU5-V8-8?qltt&i_(MTm^;rR_B>gr_h|J&5H)$=wY3#qjoFm>4#w^Yj1{dJ(Lc!>=3 zC|2NX6N5uzm?%Mx$3i7xuY?LlA6y*(y1wR#u3u2&3sN@LDX8ss7-FG+^Z`|?{*M)@gbcKtMM*c0H?`vKNz8tHBA^y%Dfy$l@hyJ& zr+Qro?}3s`G*GWAp6up$qn|q1FuEy>QuI`>n+b8h1SKL>1s|J>{8O(3iVJ;z6&JFf z+I86&Pwl!CNW1ReiwmGlpj`(P7vB6`TtElfb%I?|TO8hV;Zg}^odZjJ9a~-K z2DK1j`dN;5oAU^(BFT3zFF%m+9Hc{MNfT~545ITm{dn*eM$0e$M_W;c8f|U;y5nmN zyE(nTz?wQ+tu};wzOyXHS`~Z~?NnTT zIs$qnq*z&~lbmGKD3xPktPac?Q8Ie|WK=sLLBCE8VvnrJ zAEIWP3)Zp)z2P^De48kLqj@>G*ZL$`$?||du4?gmZkOFdLuul!KQ3iT zgg;i5b*3n3z2N>D70v`#WF^cOwPK9LtVFMw6_~-!f$4eJ?}e{Je(;5c?cdlW@MZue zw!r6PlziEd!TSqB{KWBgTd=7%M1dSGHdbH!xzZz94p2(hJ}Z8}|ESGl+>tSyb(xWx z0v1~UMoXr8l#eKd8Xw5G-jP(>p6N^X@FtF~!Wnz?`9!8@^Hh6(Guv40y?jI7RFXxp z*>pqAa)eeRTyc|MxA5$RehOZVSV)an1KOVQ+`FST_2=5D zIzmE2g&0%SiV(MOfw}X6qVjc#ySF{4xiBs)oU%F%EtQ0+YpqX?KE%{xGa9vg$$r_L6|rYbyt|6q<5P0sGk%0;hU`o@=@5TePN&g3wP3QdgUwc{jh$9~h&~^UGTutrgB)hqH)IPgZO1`$emyLdB|wMdW@RL!*&Ua#ZFvm{El3 z1x{26>!%9IL-z5L$pLe(oMtM^whbWYY|R%Je>SeKb`xaXu(oJvEbu` zmVMp(^5>=6+1$r4!=-YDpQ|RNJek%0EUIuZ#ytmIbKm~SLhP*wB z44!sbxK_&oy0#D~Rn1>N-193iWUof&vYFs==JK7ZZ49_e+@4jj&I zL$Uz5ghkQH3FyfWXG=7KT$<}ds+#cB=Q~4@M}zeF8k-?~K4IPhsSoqs-`>h4O;0&$ z^r9DuG+n?oE-l^_n{MB@E}?ptwA+?`^3|?wM}a->SQ#ioU0_?C2wqv@K;1EG_#wNE zagkG;N)T1aU%DwGZI(pw;Xu4@(<+Yd14#g=H;~0SXD^foinezt^~LJo2ZF+m$oxvY z*-(q!UqA6a(f{tMm$k|3ml=%mY!LO1^d;EdOwlno?RprhATq@DFsgtqeCF(}U;CMY zpe$EG7!=JF0txfl6HtURCapWzlGO-yo{-vuk#oWh_br{rQ} z=Z7AJU8yo80@S1D3#@Q!SEh@OHQthX=8X;XkNVEWSpgf3&d<5x!zeGc_*v9?Cx-2k z!U;v6TkE-usU6CTsx>J6M*F~i@Krfe_S(NL)fR_P{vCpfmHqqnFA%u*=`#Lv7|+>$ zO{U)8@d{k>jlBDL0itW{kpz}owiG@@F@2&vrf*l^bqo}lccdWhI#(s1h9TrHnG&6F zrO@yhXx`A1<%0Tz1lA#BeHw0oej0886S&7cXZ;4BRsaKshG>e2^6cuDTtky$wZJQh z2szi@y^I|Cv2Y&NhY;c+b1OC)6xV{9=?>?J7dtwGqM+v6@^#m!mDxN7mP9GL;&F_l zJ*ek+IF7}|!h!9{CwlWFn#7Z3#R{!pc=*>2UgP*v+La;%m4On{i}2GJjm_a2tL*lp zR6)K+FpV=#a^9CrH0QfTStBMSgjo-diY{n?)VT>Epnmn!3PX5MO=d9`j|1$1=Z*(J z_hx4`fE@ZgW9!3E-nCc2jZGa;Nyf;JixPDbc4<;= zL*%QEhC36yKCC77qZXF~aMMjkJ-O*rW9t*jbe=L6Ob&OE_*tmJZB2A!%pH zxew6^>GX(G5 zfZ)9ju%3YanY_xA4n|iTJC_8&d%*zStNjZq{lXosuVBKh^!kqQi5qzCknT0p< z9@|AfP{6#&rO#jWqnfD<)E=pp!}0-RSOH>J%y*-R`G%tz2wIxxgZ{L?`2RN^n%j~P@FM*D$bPXrRgI?>1rd-b%ZiBpZ($CTF@ayOD->8K`@OHh}jPoyjdj$)7EJO(q30QE)P6s1T1w$7Gf&4s&x=c zoziCx`Zq7!<=2l~-GH$e91XhraB}1aJd&5c6@bI%;En1?)29}H9hEmv#Tg1{sEI53dY=MzdI9QGbdzO_DZCw=h9PX3tUy;q=iCkKiHe^Y)O(!~Rlq(Z}d;5sBV#_z*V9QmCb9 z$pXr5SNHu}eKRH@gnc1D&GDqZS-gug`28m_|6dMsK}e4NzkK>%K5Spqv8r-K{P~oa z-x-{a2cL*PH#I!K-UO3sGm#QkzHLVHa9;=eYpOG(Mt6FQ_w@%EuCCkHqV2MPJEWM1 zEK(qfI_O8K^hF`C490sY-F&6#U zayUiPtho_|)lR;^-?Ud}i(>cn0|N31g$St~7q%Em%24(L{rm7i&t%_du!{{7o-FOq z??Wagd~@<|L#n(^GL$2^i8!N1s$$`o}+E0ZGq7K2nQAJF{ejv3a^G&!frnHH7JFvw{#Vr$ z#PpVcFw)sy17W#LyL1f#!eJVq+f6;qtoWB$xv#irF2y(GzaJJ6|J3K`wNQu>+B+(3 zEdaorI~i(E-6Gy??X5ah@Ub6oP`UUW^Kre}O`ngnDiDW$O9Gn}Lphx@_?M8zQSU9J zc9k(ys#RbZ>&x~35?}xC>2=WmReb%wr`JLMSMl}#o?Zw2U&Yt|dwL!IKlu88@b&-T z>;J*m|AVjp2VegWz7AAo|AVjp2VegWzW)CMd>y|?OIyd%6#w)EK&-eGgvF)wdfLT7A^~kIDzPe=<7o7=Fbe0({_wu_guTmlti!SI?NPu^!10Q&0Oe~2U!Yfr;8xW#90KH>FeTJ z&@K0cT=936e%)XwQHV}gRWZx8be`FPQe7!B!_W&C>0>-sSRo}y=~5+hT){gwzQ{o5 z43yLXsf@nC1r^X1G~>6o6D+^;en*PmO-rdt+dVo1Dz%p?Yew9IA1ZufWC?Fq+46>w z`yxngTs*BasD5~LWztm)!L^Ms^epw&BnrLEkKa_d?$VU%sc&xODjtHP5?Mj5_(KSc z6(P4ncDzHmlQ<`}j269v+=O-3J^7e^gfFS@0v)a;7D1XHWzltT)BVG=xskeuQ{gD_ zWV$fi#98}OF`V_Aru2;81SUlIf?JBM$+L3&2ZP=)9QYtzxCaE znd^K(C0hFcXzPzF4@H12E3eAW)WDWi7Wq_*A>TLRR09q)3|*?B?T=fOJXE+BZ*V5m zB6DQV)j>IZY7<5hXcg%TVeLMw_{Su6dtcxpe`BQ7N7u($p+)4nJ%>agg&;iZI@Rdq8Jkr;iq zY&gg^%B7}1TlgJv_X|KC06v(TmT166xy6C^Xn_p9`6@?EJTV8*;&b!ktj#@5ULF1| zsQdA86CW4LzWP%PuA9qI69=Gs*-K?%FXon5 z(6Mqm%r><{Xi+HhVQ%5o6Y?D_iw+9SBqND~CnkmTD!3lW&tKDf@9P_%tbml&R5y_n zC<}|VWvp}TOW&!Kg|(@xo0Glvp58OTRoVIS3JI4@TS7tl+LaD3STO|2QJu-o8EN0M zHzmz%*&kiv_7-y?f<5d4Jx)mRRyuj<1LgP6RfCnG5(+noO*##Wl!Q!##8r5Gi5By* zpC|&h_cq(!)B9itwD0Uo8Xbd>V3mejC_{GR1$Uu~NQMBD z)3KjYMC6IsZVs0{Zb_&!PY_lvNn5I~+{Bpd{KeV>JHYU)VERJ=J0qFcLiht_t=?@t z3kGo>{Y}YGXPs!>)$uDpPfG*nX~EMwp<`BdR={-#!|p3~DrB+%-r@j>i=99fhm+pNz9{y4JIvi@>p!M+lYNcTBQj1FHnqR6Uf|K_}+x=M$mt>eOzSKg#uMKfO96rSNQ_i7i1Fp@u%#v=PQL)4*! zZat4BW@O_6*>A7ob=bLb=0j9dn3lN)Wa{gqG-xBM)P zrB<A|KNJmQ6F&cKz=VPAsngMs6dXcljCuM6}6Kgp$TmaQj2g< z9B8$5g5Ct?%?_aLRr9`{WC8PLzd5Ce6)@pNzl5T{&l;8Z>TyU)68DYk40@;$^-Fq7 zBL^fy@4@#(PXA!BG@R%d{7IrXPx(X-q4t(J|R%l$f+tMkmG)b6#HVL3eGP-RYzg=&P2 zR*4Uc;I0ZguO|)dZ#90wk9w+7-Qt*9^3R6i@JyV4Ql*I1eg4&ppmD?uhRpQtART2x zW_rURGrc6-c1|%o^CYIfsr&=N7j7rI^bZT}el1ZQv0c`GJ7!w4o3>cvh`%K2I`AM7 zeN#^4BS;@^0P~qKV=|ekh{5CFb~(Rz=J<1c&&79Ka7+*YuOFOD1R*u;cb$p9Vgjp( z0Gat2)N%H#lyZqgIIGtT*k1(5%yr1Jy^{6ve&GH-+Ks?F`PkA+7=AFEzAb=0;dCr# zatZz_0%Yd@lHg`Iz)p9i*Gk&2m&L;4&14g zKU{ruPm>Xz4HbU0U7&w9J!3<)O$q))7=B#HcE40q8C%;z7zpBgZteZ9^zTK65%b)m zKZ^_}z#_xR2%>G@t`soHP#8g+_oTqR{OEHprbx+FS+DAJ&6cqomH)aa))H{w@}Sf8 zr$2|%8Sp`%enwFtO1q%9aOkN|mNii@X5VJkStPS((_9V~G6jBU^o1C|8-_vq8Xa#; zBOIn3TZ=gzr6Ziz%{v#lMffVI$)QMUl1%?1E36wxP`b>6Y!zpX0b9ji@OhOkx`?2X zO&y0~oHmtER97WbG@tKx)w|!gMC;?eHPI<*RNi=HA=#=!-X zChBv|4AdknuOKr>dpQAo-9f90C}`BIpu4n5U_!LcX*B-oF5r2oY3Ofq4V752v9FY4 zW32iSEER|e*bgeliiBiGJhE!=yrA{s^MYx(7=$Z$2LhNAzdDCzt+sq7_64035Hm09 zsIaSUOK66aIOZKgHn?ovdaG$b95oldu?o;%c~a+=&C_7K4OfEruN0pAS6s-bVAd2S zLXfd+lE=A#s3YLII=#iweR5r$6)W|o>L+`ptWXp4eEDGCjDcq2ONU_#jha1WlWYAc zp}cKF?-x@MVc^ocAx2aJ3?OX(9{62M$$3W(g&&B*f5Hr_K*KzPV*^xIem6z)x-@en zSd=|fpG-Xzlv1|4i3lFW;wwxA-0FTqCLw zb9fY(Tpi%+%iiepPgjOazHmtR#q$n>ajB?KHJP{4WXHH9+Vm@X<#Q}zM(vu!odDbe zE>uaT22-;YR?$srk-`H5)Dq}(?h*p7weBd5QAX%4(pN2%vfdIJ8g=;&?lB!t?k1u{TPfzx3B>z;4C#M{h;z z+QBSP&e_a`a4cYj0lWMC-JOw&gRRgh89w|)y>DokaUPhVY!l2F4*VMX{6}WBGTFFY zm=>;jH9(e?l3^cY&biP;i?1lsEaxwysTjT0AIZ!7g`|Fg7tk9n($&3!@`$ha=;(>p ztpaEA=HOjdOUgKNtC_-F$4F(3Owf;`(#7Sed7>vtWClbMX$p}Bn z#RAx@7KcGoO!CaIl1z-DcB@?}3*(@J=bf_?52H#T|D2D56-CMu)BtolMk!BKf51hHP7sOeNTaEM`W* z^hgcW*6W<8*+$uks-=BxBL9@cpPbvxS0t_1 z|NBNb=>JJiyt!dicN3%U>A(hh;(72t!v9`x6H?i?%Z9AC;py)tnLW$%o1FvJ+sxw+ zzCqU897*8qnPfWd`k=M7+8cYP}P?09$8!`sWdzbLa3$P zXBnI?HN~+wzszsOFUZ7*AOC4eASr=t@%_^+ddeZ~1s-GzX8PZ@V4VNif_Vds!Ssv% z`xp$c1%viqwqTt8*DaVzU<>9Y9;7d>WY%L&R*MR@@de`XBqhFtlaB}!9-1}4S1fO&6{ANu2EAe>g@B49zROZ}7b0J0a znCvchC_=R?hvykt_ZL}hFh55oJ?YZvAC`aW4k4Q1f?O)vlH zfdi|;2aU2Wqu_UZz;*oda>dP7dXl37d+bd(%x`|kP)n&$3N|8qDi^ZA(jVI~7g(j{ zud4T0u~t*D%V_q9*>M}7BV7S>q>q|SV(fgm+6Wppxepn4n_@82UX{dl7@=Yk>Y|;2 z$f}JamC4!em9+20S#>{K*)?sEy)%@CcglW_vSLGID_agM?Y*1EVL%#5LQP?%pGg2m zMIDGE#_K-$NYh^BQ6fZ_BK=u}wqgAmTW;}Z5gN;_GV?e{+6Y*LRsj~FzXFTUWRZz? ze=R~Ml>S+S){`iZ3@MoD0>|0*NQ_G8C59nQl^mzRgPaJTjx+Z@F;2zk za+zb{8q(_q5fZK1{9bUy)4v+VJqmy;+ggCm_MITMs@90k_Km{|R~_L9-r< zGQoZQqi*HTvN}!W213$Sk2LAy^w)})Q}6;kCw?8)namg^PQ)HrxisZ{bCL1n(GCkp zKM+oTUn=jC;IpTqOg`JgNzzMgB7S|VMH=Q!?z3r}eCwtjw)s-}Zd?S$Q_koTKKP|N z)ua0j4<7C1LpGe9=8c4QaRVrS;}hBY$SP}fYSdsoHLI(}yzcPk?!g}}A3bv)Y82z* zMcuH~VX!p0U%+c)EK3pUPN*76#STnvrzssAEXHN{7Q76U-D6Yk3(z$;7E*h4K)gl% z0^N;0WFI-nt*(+T#sJ5i9E+Mt<-xXS63Mi50%g5|TAg~JbOSErXv!88LI~Mvu^E1G zy!*5NP=a(JUG_6ip2jw5zb2m#<~SW%8Gw|7eAu%0b%Cjt0g8<4@+g2i_W+vQ%n#+R zl*@3XZ{g8Z9;1wjQwhPe{ZxQ5dX0qSSGU4fw!?`TVbx34mu# zpF{aM9TeczeD%!J02H!XZtUqw+n1$^?=*Bo7VZpxuzXYdv`d$QK5!r`pIRv|jwJa#KLTgkcFK<2C( zmCGK3;)~Ek?y98Y$h>9$F_eQHKT~5Z5po2tOCf>MR;Ob6Q_zT6%-h1+(oZ7a2*wxcOr5ChG*Yuz5vD}!v zi!QASIZ}6M29ljDSgJbwBupql_6LTO!f)>7!Z{s*(LP z6Hy7neA>qh8&v<{hae`m^P3k50w%P~2?a!k$#gvbKAd?>`0 z6N<#CblR5c<$~_h7E58{^pDWI*kDhDVXdU}>#os2B+;@DQmPOGWa0a-cRbgeXOB^CPG?gp$JZau9Wc3U3Co>I4p10#nu z$I5ylx@i>w?nXI(O@U`K`Ne)l@!y*G*A{rZ)Ml-mC|FW0qrS+!D9)f$Z@Tf;Kr6L{ zwDmQZCXtDpn?#tOHP6$)`)x!a)yl`PghPdO@dj01(wODx!*(?N1>RjEAE$*Qa&Z#9yjfY;M+n|sO7l3FwmSWRwSne>p!D&kr(2GY@ z_L+Q(X!ij9ycl&>8eLS;@G)WUKFd;g4u-CsHX~jf)$W<0zzoQmOqyeIY<7MI!+)?o zMoVkqLQtvuMENXxfyUmEoKli{W3^_gaq^}ekq}!`3^qetNds6OH~njQTz3IQM~E9r z6WB7`Y12%4+A{1*c&cZ(XO{>5&4~AX;}D2 z+P~4fAw-e#deyWPwg3Lv+p|xR?g#Z;FND8qsNX7GtLiF>4Yah_GrOg+_bvIl&ld-Q zlZt~87Y3e+9qp&4%x6%ZQi67dgeQDOc*x6Ku#}H1twJ-u6usBEf6v83dh%6-K-Xt0 z@pNuX6XOzYyU@S`-dAPN_S13cZK(KOGGo7$k-k;}o2XrEaVI-#@kgStl$;U^Ui1J+ zL9nBN!KW!g_Jg+O#x-^2pS5ISZ()M_z=*}X6WQ0FigaqRGGeY+wJLO(Vogmvl^-CKIG(RC+nSp>7KxcJfMW0LRKYHJ3jB+MTv zV~v!wVDZTaB69DXi~@SS(y0ZbF*x^>Q=MX{na8sLw#K)P@Tbt!Faj6%4Q}_*52h|E zjM~D05n}5?>C6tutuydSOC)Dm73G8cr4-U2YLG7RN)N#l-Ddf$aP~v^N!j>9zy{J~ z+;^f*S~+$^2~b9+vj8Rmh*%{a;{B>MR}DTU+2K><7 z1hqRju(xsP?tg2Pln7{`*DNX9Ej;n|fZq`PQYq&~?_o^_$8wr+ElCg8ZT`nnn^e0cK|s08URPj z1_0n_OmQzSt#eS(M7SsrxNX zB$thr%wWd}o_4!n15IJ6#jpGeK{hjt)?dVCn_m798lr-GDc!cN2bz?iv>RqJbYvq} z4DP<}$WradK(V)=-b$*=?A!cBj`k)bz|!S-kKOUIG?D%JSI$RMjOd>LDy2X+rpkQ~ zj(=d&N3}4#U~UY`0~cjhtsqx%|M!Ud>Ub^XVE>l9%mPyln?Z7u;g`gLx(eIZ$xmCHHyQi?{z5V=-U zASiEFul*v@D1*ff2}@Dr?Ir&-kD>YJH285V$fFEyF4%eTF(vP-n&9Ba*fH9QKLNsA z#o&*=<*v-miAU|AIExl}{~bispvedB@=2>mj@Mt@ab0q*7k*jK<11q&CR4UvGdoZQ zVHM@g{iDM(~N?^T!-(v4Jzc<(eKt~1m;(+cB4loG(2kwnCH9S zGa0+t4wgkCs{;S)Q}v#y=6WTyxxLD!PFIJBAeVu#m^c;nDn~He_@j6q{UIA~->TXR z<@j+hO4h3V7)R%dT7VW;ryc#2UUK*VgpgbDFcAe`6cFz4(%E5B;Eq<^OLFn9*^x`-?4@NP}=_W zxBvRfzj=CS?FWBdOfkL~#3;GM4X z0^j(>!yLML%G}pO_fM71MKhtobR!3k!-;57>A+#%eynz>ZMK0eU_LV91|!#`dQhn4 zGP51;O5-CmlJD4MSnP8K%XYuj$51n}BgYVNf$E|R0bP`7i{)hJ3OleT$4rFY(~AqX z6`syoV_e`P-S8sakiKsL!awkzYln@b_=E9)Rc$cW5I56x=IFb1Wb5ok9hzgaCdq`U z&b{r6Kp^y6jj?j$_F)__6_;{v#}%dGNx~{UG#n)-G^ zYh`#Gv`}s5u4vwtQ{VC#GzW`r@L+!NaxcE7$f*^gT*;~c7XF?iNwT5Ou}rw}*TPu; zfNrWMD6QbURN)1Vs5Ls<`Pa(#qoU+iQTM!6GFuyEDr2{H)X1$WygcY3-UDJ z=Gr%BC_FxNmZPB32AyJ~sfq^)kjm2C=>PqbUPSF@{PUDa_&V(<}cb=4A#v*Zi@hr)1nCi%AC@GT5S6mw$ z4`EeirNw!_kI9el~*`!F?RY#u$ltiZ!*FzyXKF zi?XMvOlB-gb8KdU8a8l%9oBzp8>Yj~-1dQ152xN_%KbC`s-wTlw!r2Y!0NK2p#Aug zXhePqV0HB-gE85&|G>JU^0Qh)5;dNY2DP-#{AniF5mC=z-LAc($jzqkY9gaK6IMLU zdAb=z^=K0^ml^}kQQ($-M~DqHlbc99#XiKAQM;cwnskd&`;KdZ~WnZ(Y>7i(7n_p?5Z5$wHVN8@ta1Twv&m>kpOhB-0TgJ zlG_Q;N|o7Qv@DE*ll(zYNPNW-aCx262pb6cb9n^=2=1TRtOp-oR+d$snG~)bBsriw z3Z5y_kr7jI$N8bu^MR84Jlk|h>*Vdh~%@GZpr7}$b~@0s+V zqe$!i+|@a}Le34hRYmt!?8aoZc$P+w$ z14EEDA5`nZC~p=~s6wDo#=dyxqFEP|FdC%U>2uUMv8}B_rt@?@+EjGi&;W32O?cOc zMKMIC;v#%N%x&Fjrs7hBrIamZB|Heqj%AzbS*vcc4}5S zrs!VLsZ8xhDM^0#8BW*XY?k%S^OQ_SHBbMj60#W@C~RAsJ%F-1ELk$weXv^-gA<_$ zFD{wuh$KM6M(N@gf1I+7^WU8n@7j zK{L}HG~P$sy3749p?=?v!yUdAwKG?bczFy;1@nU zGCG2`leOYV7d4>mWJ$||=A2*cG(WWulMUWxQngO6dBC%Tf?rq6t?5M(Us86e`BFiwI6=4M{x0_?69XSPKOqw?pQM|n z%H>0tR8ZL&V&nD6WrJ--bawFifm$ysetRB{8zSLR|18`~aOyxca)neNT$eQ(qUQbt zjUxdnJ1m?Y(r+CVWZ#{Y3p}AUhyP66m_e46Dw_YJs2tWN+l1sUxSaOD(N&W`kLFfZ z0F3X;&2K{3TWM)~71j5pZQwh%jLwKw*pK}%dF5p)gLl&vQZhetWF|=E&AC!VKkQ=E zCfW-0Z*NFVk$TNIs_Qf(VYVU-@fAwy<2RnF*cp;)oS(50OUN||41r@;UqpWxs}vO9 zP48UeSo*Lhk1eIg5zo4Bn(64HpsrL_=258}*EFy>Zf5IshVpZGcTzh}a`Q`(I##kH z*DoTq9oEWnCXY|eQ_Y*5Rw2PY;oiXo@U{U9JA68S%?gQ`-9F5^LMp84mvlgwkZgUe_4RW2LC zOYfT|SJ=Loy(}-{!sdvnnY~l2AnyEdsghLOEk`ZojE1o8zn*N!+qSw(l+r#KXIaJYSOB# z>|oSfm%bLBYOtkk2d(qq$6FY$8GGtfM=;1Fq1#TmxxxZeEu9i6HZ*?h6?Btpnb%cY znZ{0V_seV07R|5DAl_4~o~=BZin>f>^a>!Y3zuGM#x8bS4D3oq-sxlo1K}W zdHX3s_AWte+J%jiO)Ltt50%$RQ>M=*tzgE4`Gkij@*cAvOKO_|9IV6nl4j6Tf7_4= zZ-wv!Y|4zV$0ylJQkY102vxT(L2DA;+AjdRRJyv0%8f&t$|q*AUv?>Uh~pKAoOaM+ zgJ_QmQR<-F!5}Xzo3Y%5(h5dfY~@5Sfyo?BC+QtTxep|c@#^zq;>~xZodG`Zw~+63 zAaywE9!O>$=o6gRYsgAHhz5+_V^qe7@f{**2Edc=e!-Ku0C;kZapkId629_#71~$T zR4>hI#QR_42NfP%Ojo#-#Zitt2xwUi%Cgb~I}FP?W)(>eR({D@k>1}SzrUM7tj0vV3kMZX zQH^uWrVczqalu7oW4K|cv*|3swbaQJgdkrshdtwEOL8^fhcyj z(P%xN+EYd-GcQ z*?({|OdZp9Nf`*-FG~Q-DqlgdNX1Agm zO+@^CFWMY+?JQxb;k%;#$qeQREgm%Y>1t;9o-o4nqN1lY(%8lH=;c_FVXs?dOx2ZY z)jX~y&{<5c?>Ap4DclEGeOgtCk0Ha=`e?4b`Xif&Wi=Q1Vdvv5^`l2)B79!=g-+{T z_<-GfoaY)&F}9yVHLgwBs_K+x5t0sukX5o$v1#Wk{1F&Eh6;@C(&s`aSuE8zy&?a! z0QInhjV4{Le|`)(_GKl9_*#G{5N^J_orkPCu#$mwfo7@CG?CsOv{?$~nWVS_nx%t% z`ng$GOCpnFp|97qwadr-A4)&)2qC|H7hT=)HYa)IR7gAm1aWEHi5%0A7chzN4$+<{ z2_&`HChF7JwTU5G6NL zK3)G{#PPEzUrPCqEH2-9H}I90AV~(!@aK4I?IL3)&ZeD0#U%?L4=Ng zkP~gv-A(dTKHXxWNMVmQ`w{*K&H#g9;vAk>_ajsiV>=Y2IXt*)b-@-yGX#{-0(U>_ z0iw>rp8P~vkJs-l=GJI5E(F5V^`o<-%CpMzMd8pOui+4iM_~PzhUf1k8))qMijJI~ zv~M8n4!id6I%~Nt@kubov!*3ChA)1M;02Q#NJAY%W2&AMic;@zIZDkqF}&WDvo8xy zt9dQjf<($FFS~B|Udr%axN(c^c%^NZ3Mc=OCGo=ZaYiV30B1lB_-MtW1{@!cf=@N3%giGHML^3|CLn=^V@`iy6N z%V!4{)oW?2IAHP322zC_kpzQVx{)upcNK@ltG6#@`rc_>Tsg+aDrRfo8f~ zIkUWpzTke}uxoX%R`U=ovU`CJohnD>IE9sp*-E6Q<1!H#ib9 zEmYGuxlpAr9?(5S!K>3dLCl{p^cPhBN;YV;RGLUI!8`a<>`e)EW-X&giI>xXW2a2k z`aKwD71S&@ELHlN3>{{&U%!n`^vK#K zB$adD`U=A+REueSr<62EqMFNCqW8MtX1B}+6O@Tr9&ooDm_JgT!&PHgLp|Wr-O&uR zQS+`W{3ztf1nE%d(Oqvje-*dN^R~kap+jH+JFv4Focj7SZgMR zmXo|eQG3k5Yq`vUvb*d_vf;NL|6Y5qOc~PK4q~B-huVYQFO3BgQ7>Z@_x8;t`R%na zK@gxJV2Ls1sxfFEo)3`P2#GfD1l?40eK8=$V(}D-l25 z3qZ`V4a3n8gJuZO%BJ(h*BS8);1K@wBq8KoAQ7+-l`|tak)mHeFL?aHKyr3tuZ*!l z?DCh$*4n9;Il^RO{)93*77SUij;cwkBv_jvOwMW+ZoV!t3XeK`5e;SRS_pvYCrGV0 z7F<4#^o18ayC~cE%Wvzb^4o8_*v?r3_-)w&pnhAr4#01l4ft)xkwpW$Od20gK~_Ro ziC#ela);(Gc5n|g8O6Diz#?EEPibR7b#j>ByDg1h;7`Wydpl;KMc2M7$Au_ zTeNWuE>6RCPo!*DYGPGGp}LTAEml%6+I~weLpGY8MbVM!@a`kezIOwApT9R+ovX<} z?KZt`P`gc?M-!5S+e|2Ws>b3;ySr-rsepsgMu7ddX3M5vy)Ul5r%>ySI$*tN*}XH} z?e%Izb}wwxj~TjFLN|}ODzDevabB*09ep;Z(A|bF5UCO@~)zZkOr_jbQfJGBA&I_MFt1k;+5RE%lCg`3&PN~#*;^Apn^T98ui|Xxg*wmNmDqLTCX(eGrQB@Hc z8dP>1yk#}dx6v)OW8MVevKTC-lk7IB%Rj25Ya_GJEDSBEIAhF)Vc&qJNfRjoO5ihh zEOzU3+n{(|aL&EoT@+Da{#{uZ`AaaEc^}o{v%9-(stXNI$odJSNxOC3iVLi5XHnvMh*D%9XG;R9(S^?wTnT4<_f_ z#RFyqQ!rUx4sTQPI}lXJ1=lgp{@y9KR05+%{(eto9^3sfHa>X$A)Oc6ZF{!(=5+~Mna z@oB6VG%1W0Hv4+5S&o2EM%iFjU=pUvw{_EK)Q$ z_%2Z=hny{%=xEXF03B@sR7d-z+7}h7qm}=yqwW1C9jycoVxPkg#j6+)Vuk%zjU;n#v9@${PYsjpp2-DS*mGoh_N*rteQ1(M!AoE zXR&={#t2)t6&CsE>d6Cdzw;`uTp?6P+pAVWfz)cdko4Leg!5hLrYJu|kYBN$c8$yu zQx)f;m3FJ-%gGJQ@Q!B6K%|aE`w;14)?umb!jD?Ki9eZ12-b)pm0v)Q@rNzme{5p_ ze6x}-8KwNX1OVSGWEc1YSV9Q)S5PA=cUf~rs?lD4atraALjxihs=cT&Qi+>sI* zp#7eqLGBG$Nx)E*=|IrqdM0dqmFt)ewV`*hTqP(^@S?WlamGFns{o@jwel_zt@)bJ zRz>cDl`;E8Q}OKh)!xjX>ai%qtkB6>*!|SN&vK#f4N-hoGU>7>@>rCPix)wZC~yLw zUb`oW6n!tK%bt%4R^aCnaKMogQb8L#95tfC=ELX$gO{b+Gw~}E9*hvT;$HTcY+lrt zF8WYC?pIXyzSZjwO)n55VY!PWtP-`VWYOukR*NqbSI?`oAvi2CS4RpXWD!wUH?oMN z(s)5+Kp8~P<{jN%lwno)<0PM0qyOw~ATA^27IliVBbS+$8&H{!RJE_kfHc})Vc(B2 zU5P$_l=aTx;#PIDJNQWsI624m3^DCdJbxYoID7KVws-@(=))z1*^reIRHcymry}y@B#Pa ztGN$uPAq(+vZCyv&Q9yvSdJg~c=JDCy@05dfEwkV9-OzddK_t~es`>|y=-t>#Xj0# zq}-fcn1abX@=SUX$mD*8!_@Yha9YH%SL`7coIcz01^z>X%UwfUG&$Y<70k!FtfaWP z28d26h#u~o2;y4`B4@FVKie3HY&}f65e^fId_1E47p*k;53RHu&nYgFyq!}U1=3pz z@<+fcDgO+SD+2|?DZGbFm4T?iVK>hZ7F=B8-D3(!b@TL>4<()(Ot0E-E3r-pwN3Np z9O;_MD?UJ0kiVFSF zVDwcUxAfX$n0K6y*z5utj37XRVd{J?T_JN8&h{*w__uqq<}(qXp5!mx6sOqA&yn)1 z9DlWYOiIV|YIAnG3V?XE{HKxb+d~FFaYth|KQCcX>0_ zfOL%erV>2#miB-~W08Wn#e|{NIEGd!K5;R}vyUdnYuhLSIZPAFtguPibdXv+DIcJC ztXy;20~8OdLT>h044GpLr1Jg~0TF2YtSqT}nxiwPJ zLlV@EA?U{{*69%k*fEq%a&jp_yRKY`tdJvDR(voK>Fh88s#h?-Y;RZ6;A&mxH$7JJ zmnPefDMJEYyr2iWO6(#if0@Hr-{(W|W!`L#O?SvJp838o z%L`w?^U!Z6K28(%{d&yVkjr?wfqZ`L_o*h7Ut6UQ(62(vnJtes3DI|X#Liy<@D7L( z!n~2C15}A&VgglSylY_MWAJjQ#{MWgC>w!Fow@tfo`x$!;79jbAPd^}Nk0>J;v4wj zvR->rPCw{SIuFfWBBkqny)w${%$N2~$4*_1fGh$M$27!OUADCr0;AR4*UAFpZ*% zo3d8n)?~)7l3_}|k`_OWlD8gk7m~i$w=3r#f7`1P@LJO*?BwFdUUd*ipz(3~YP=hFF0R{|xHVBXPLbgnUyF&hO5(Tr2Mybi8=m54zuNZ!Jj&wq?d!4cfC)Yb&+utozwaZ_y_SuO~=&oY*yK(D!;qGPfBPj z?!{X$(Y0#xW+dQcDfyX@6v6C}S=g$`pCA5>@+YWxyKcW|N|n+O>YgB5fVwB<*T0jY z%;`U2bJ1}efM1bc8s2XYjKpt^JR%UH*ubQ zNl=RTR@<^c=7{G6lGun=b%7`1l52T^i0%<1By|cztiPnL*Vl@BNxT|2vb^Q#IZ#!6 z60vFXI3=)nToDMlEv(M14WjA*f8zzoud{`9VFZFZ4I&d&B?<~|Jeq7atOj5kPHgu+$)>eMzhE19 zWTTW;g-#-6xX+A>YZ`(9KgIb+b!YgDqJ0I0)Ox35Azp%d2-`M@5^O*+A$t9R8=Ei= z|Hn@^Sovt^G)O0Pb<=O`B@!8y*A7362Hi-%G;|ttE_5e%Md3%^EGFxry16TSQ73h( z%nDF7YE;@PT;FyLkWKM~F=zN?dVUd0;zy3D)iO79!l}Xv$jZ)Lu)Dinji9=Vy+*ze z)X7P^XkxZwyekBkJjvKxUaEDyF4VeS^8MLg9Mov-i+J-&)pvQutFlHMdCO~lG+8hK zR?pOPdM^DX^uq9_|z=s@m z>^i3LfILH~`#ImYpSsSNZQAm!KpTXW{pBF8G&(7 zATSQXr;zf@-B*JD0(YITQYpueKRSK@S=a%IlfUkV`XsCg8P3R8+4FQ!`kvMjqMZBs z0~$vN>NQ9PmJyd6N|oq4vLrH&jIifh=Agdo|QfZ%w<1-7FXRA)Rhd+ zTH}NZ-N4ZJ3#>+ETJjU)w2l$%M5P9Gg-65sM4e;uX_amH*7WD1>|jd4NGTBztcXyq z8hwR-qcL!Y1E*znX>zoNb6SGoFo2*F_yVVerak7m&A4{4bZiU#iY+Bd4Xnw!cY{{P z$&iJ^oxj6Q-+&61MCMkt(>i7|=ViJ#bJgL}U9MxDpn|8N?o32dPS;c>venU}ypa-bDS@2;HZV?v=gV3{`JraO>QH5p*+n&r%vc4n^T!L*auy|lSSl0wF`|MC)B zoc>bxj9|@PLXE4d46(44hZw@nPM)xsCnP7kD~Y7a{ZneZ;!%n$UlOnQ^H&D4#|jL} zEm${(mJP#??nD~ZbOi7<1qe^GAdK)Qhz)5K49MSrK0Cu#!-kfMOekoGL00k~l5S}j<1 zU;vZ{fE#}_#19blqrnZ%sbQ`G>mx{dBdV9Ok_x1K&)QgguP{sxN zaOFmlT;LW5x!uWrGpT{}${4Vhyl!gDpeI5?Z|GLjJRtQ7tZ`;_|FDN@10h(a5cc*>CZtYM< z24+mKOnbdwJmp?y(4mw0fp=^syw%|BoQmW4`3MVV;^AN%tdfTn`Sf)r*C&p=m&#h7 zTLI>vJ|4M_7rBANO$)kWy7>!Biw+CXgu9UUo{n#b;KYq;X`4K3*rC`XkWk zukWn^$iYVHzmS6)vzG=Nyg`!Rz}Mz=E&y{-^2zk~s?TrfX6de_AfHCic~?We>Qm0^ zg)=SRrA(h7V4tdvXEkf>=AKSsFkq&P7DX_egw_8%G7!i$8GZaNwz%f1^m2f6NCYL}PdEY%+x&#K8u>9PK!lQ7V2 zuf4J<{LW8ObEBT~Qz`{ox~f(7LY_OmMf^_^g?cpzE+UV{vVw)xkR~Llo|Oz0bL5n% z=GD7MQb>vhkUh|T5OMVwbkYcTlES2DSh>Lh)6wVQ%ebPsIxGZdD>CQO~>EId-4ULNK;T||`n z6;#kl(3s1;Y~Hg;8rhmx2Zh$>!XQ>tLf-%&+=_uoYo!j)mK?%z=* z?C^I~8L0S2RH-i^XTPM<>-CI@j=(rWma*Lv#96jU4d4#%c)nI zOmyYuhp5Lb9Auwg1jogma#$zTj#7VrTaydMuwuPI?Q1AuD}H&I47IPvR*&}N5A=VU zv=vbjY|M5+D71S9rtaoajp9IeMQnhV*6SX`JDr@{5H8WKj@^4|aaBJ4s?g-x)CE5~ znPeghM{|5F*#Zi}6KV*;&i!7XW|OI%^LcbxWv z{r0dEMb36bB$C`Q^o;Fi6vaX8k3ivY<(rUOpb=GYT_D;E5|^Y^_&7{d1h z^bF3G6k_`W1i~T_7NB)(qPK&z9|kONKqy8)AK+f`Kq^K+y>Lh75RXxiC79aQyXH9B zWWy_Rg+w81KYh-rH<|{M(yM;pZZFa>dWTrwOoV;WmyW^R)xsH+=ke27XTU^k5U^*T z80SL9H}Dl~68bCeOhvB)^zJ?q?yeB5+nE;;HMgKp*T|%s z>*WrC0?($=jgTwXx0H4%D4!jxf5h-BQrKh|5=5e162vwUQi64U`f4eV4dR*(6iO(N zJ4!7p1g}TeyONEjE}!Z@Q@Wd>??bMbLw!St55W!s3MKRX?QVIpvx0--oK!?^NcDsa z+s1QBAgbf8eeQ_faUtu81|Un*iG;zi=f8;eCLN0^#1^|cEh@-zb|loT>y zvFj;YYrQke-Nh7(7Glr*qDgWP3;(7-HS##oyJ zBbhFmufOAoeboLj-$$kCF4ck98J$xt467CQOv8vGc{%~fGvc;s(ZD(9JR%pRt!$QH z^ZVL68%$jn7f-L6g0U>=@M}8lNhQhoylgH}1GUsjcgmmjJxz0~O>+@(0+S}0;e4B| z2}YHQBTls4H8+bCp6O?dq^aOu{Evjpw=@$|rOPGC-IA*OH3mdv+uLf0xj({)$+n9z_XmDlFeS7N+cs^?XHO=^90E0|U~_hn?SY@%(!qz@;VN{b~G z26kr#0cJ=OhaHVMrhoc&buB*|*$`&^D71WO`x9hEG-ngeWj9T`9u)Sx3 z1&uJxLH7)E5WXHK+@i7!TRTC zbkiRwwrc6ZrNsH(tg>rNr$+qzD%{~h=IsQ6bs#bgQF$Bs`F*H{h$h9F zLBjX#${=p|@)9c-lpMlc>fWg-67Qrf{$lp{{VOK)F3BZ#D}#zTzYqd`VsIO`!Mu&6 zN#{!oG53Pp{;LL;!I0ANb*j$TglSccAxz(*GC_XV<^G=2MWs`-EIg1NtD&NG!q_)i z=giXiGBy}jSDo8==mdDjUUo(4+l7O`*VkBS;H z&+@C%d=tFfXQp@ajd$JQms!fm_R3(14%p?P#Oj`LB+A4iOG*1fEhLP}E028Vh-Of?|i~|^OBQyHR@%4z(6_}1m zBbKpuneb|r&wU7r3OX{<#S+qoq10&>R6xvJ9j0JKeW+PvfM@~rGMhu%bAcILIw|C0 z21HHFen9jZYFbW515C?ARs>1EOv}5F%o0`t&LAex^w<&1=X1E9Hw&s3;o%v(aJszj znCib}HJ7U=j@tXSC6;kgbWLi|Ov0lHoefk0*RZ!NN2883{*JylKcE`kEPljIk0Kbe z8pXJV3;Qibf|Zj9Pz}db#E5~%n?Wpc!-r&8_E;68{ZgyMewV%|d%l7}d7FA-m(r>k zf^KA3>>@}25Q=xz@N*LUI5Pl*;w6A35LZ_6zH#yW1%v|qlteN7v=-eGEIC-s*$%?D zAY>3f^M{e#dkC9ys+Ue?|JLLnV0ousS#ZQM+n*Q$@Sw8VVpbU-Z4eMLY!jpp0xGn! zd!J1DIu5VvyEatf`+B@5ulQgfMfhYg{(W<>-~CcZ`>tEWsNH+}0NwL-s(1B6lwA@t zoJ!N39~Rb$>c)fCOf;`+`!DK!t~X5TO!YyzVRgsNVL*Sp*!s1G>-X$bIU}}-$ZhrJ zRS4}Jh?YDss-rNrsw_Yk_ql(Ylp??|elB&osS~sJ$_=7_2UPs*UqeFgK&)`Q6p;Em z&YzeS!AfocwX6H(GW$(v7 zq73+-vJ3^wKV_M&u7AohBP+kM41)HrEQ1^mWEm_DXqKtS9&~w&#ZO(Gr;UC$RyHsQ z|6hlhv0q{4uPkHK0B`)Cgc%L9e;a0clIobKUoI#Y&Pr4Rzb(cfo}cQZ^#+KOx7zhd zXwFt(*zfA&bUVI^U3tIq2_bET6XDZmFgr7VB zI~FWp$ASUuSnYr8Sfl0hyP&6ZVzSR$(Diida1=lyJ0MR(y|@yEZ;lry^}pr4X`cJR`D=iImDVrXOR2oXwlyq=WLbW6{@AB) z&my|1w1>C`9<2A!yO!IiPo3LHq1#GEGYIo*Zk`34r|K6eyTLi8z}#F0d&fbk;n&=p zO%*s#fq(DK4T1Yq6NEwJAA56w)!F`kw>O8*&87bBd1~RG=H~VPbe@8*0_Nu1xiU|H z6xRLygN#6^QMt-n`PgK+6_|vtZwI;$Ut&}Qf!Xc)oFZ z;!U*1OE&HXQI2)4n^m;$sMX)9?JDQW#NU4uTzxsArTON%a?;BUksl$}%Vw&9j>b|P z#iPLUg$$bMCn-!)?l+5`;Z{GGc>85XzQpy}jNzeP&LQ(1KYC-hg&^VA++5K$yRG>t zrUZPn{7aLy<0&0~^Cm5SoNM}Vt-9UlTVcAwKg^CIk26(n$<8y_j>d zMk`h<$@Ax^F6fN3rZdCL$A#V{97qAo_2N2;(sFonq z$ntb|uuLVgZE(*8;|T1XR|GLW7=8%&0Dh|VTq>qw^8-6ysuccW;mc`5tbMzloWxe6 zR^&$}cPOP&$3{zWCeipJc$AAw z&JEH?y)c=J=1U}&F&pEe2E}B*Ffm8)d!t@d&JWlq#$BtZ6#5FvZ`Md{Z>#H$-N^0g zCKTVayw#s38P)>gb5$lZKJU~GSnW-DMejiHq4AlEw)c&zg*>aY88kk_vjOp0^oMaS zap*?1pp5{@30Q=BkE79BEuD9F_8XWeD({Xl;eH|qm}d+|4AF2^}r`qF(dPCl=i6EA7tpA77i^A2Q?%wT@~`Ne6Jxa`lMZW3&QUWx)f_q%~a zQGc%eAv(i0Iq!ApwK*C zz+>EK{l;05%7k~};}R1Qe4f@}8~F9J7SBiYkyiq_sBs@;@Am@6QL|#INxNrk3tq|j zXA$jVHGV5b-?N!gzZhjur4H%GK3Nx^!d z(;fH21kbVhW9V0aQ)_&^oOyZ%;_1f9u9g_qg|103UkKlK$VQKXr60M{Kk4qo=&eu~ zX_ve#pP{~N!ndTN??N!EktFvXe|M64Oj?Oh2c}CfInS zDQ4>Lv5Z4}DnV9c;YeB^h)i(-k=2=6B4?-pL#lk1p0mclkR#-ECWwsBaOLY6=Y(9I zOkn-3x%QKZUDGYK&hQs+OlOeBX&0)A8UyfJ7;p!gE0_ZG#dBLZzx{eEfPw%0R-pCk zt$+>O9h0+Lx4=bo+f6^3h(Lz!V{ElKpje84|8JfQ=tTeJ$$;`dcrxI&g+3YN|Jx^n z1K`O(-;m9yxeBwb3c6<(CTdJqJ+vkzy7{$d2RCgE#bUh#_UyF6;$O2mu{oD^_T(9) zgt+2;5B}`g@2h|9*~5SQ-m|-Z+kLJZ_h2^Cfmqh!l@fk#(7x#j9kh=?2kqFmJ7FS! z2JJ(yS=ibBgF*XjQdrWTK|2__XrIzD_OfAt#9#-m1GDxhb?B`9^_08lw##nIhMfg4 zYp<<)TLcewX$EHPDR($81l#`AtX+N4)AjT3Sv%VD?^*l9#Xn~4#_k)b>+ii*{xNIk zJOUk~y&F#EfqB~tPLdj8c`sv;eQndCxP*dfzslPu#^qbTi8;;x#(bD!#WTXkUDJ^g zPiFPCucFA!!-2lF^FrPDz336Ld`j9@N_l8%_%>gq?q^|Y{u-1QB}^YSd!hv69_|m} zGM7?lJ3ft55MHltU$1LwKZFD3>J5ZnO&uR`Rz5OW16PscTgKIVW~_2?bT6S_ zK)@^aGu->EW~-GwZ#E>IJw8T!yq@$Nc!h|Hxbs`&>L9Cvu{ga(4*jXRe5IH7OQuEj zQtR1|ab`fKwH$kIxu}oX(dU>Dx+n1|EkBf+YOmGgG-wFxdBYc#>zmSJkU2S-iH3x5 zqol3+a8M!GMB0XQ+Z`t=x5l8#$`(dVeX2kARKpIK%BS$+6HYm_3Y9(Y45u5G)#0{{ zhhN`o$ZGlG$u_fwtda+I`(#6>Cc)M&nuJ&*CDfD^y;ATk!WU89>Zx^Nh^VXxDqRu$Eg) zz9kmve#aeO`tiet6WppvA;?c|cSk(DjoY^6_Z;1e)`L#cUwXl*9Nx|3g(;qHHjw@h z*9Hdl=f4N_*VkgYOT+YQ6Nc&)4-T2yeOf=SZ|59!m^sAtC@_dR(zSj$JjQ3mi|y4N}9oO^FcR})j<4d11Jff=*0)aZz3pzU~a7&EqRHv zjEPCTG}zz zD)PGIMTA6n=orl&y}_GuhaFt3cah@TeDKaGe*FFIxk67jhXe$$0AO?jSag|6QbrFW zl6bat_f@44{-$K^V!#F(Fs%vfqLrikJ*{aK1SsKn@!Q5-b&o?~zsT{8;6)>L0Mi;! z2U4}JxEHXl3A$l8*;ufSGkKA~?q zWhABS`7Bfr$grsA(7v7`pcvTQ*kSp^Uz}*Ul6vdI(&&cwmjd8TNCq*mOGj?wT?IYi zsgzDHDgG2AVHNj&hPNv@{Vlg2Hc^@iJppR4E5^!C7Y){RjAVZdWOR*u`u=i%Zq>Li zCK@(F)@VxLhB2}611kjfjGz2{1+ehRWhb*ZGzVh-PqHFpNMcmc#=az;qHQX4dQ-eO z&12*cSzwuMnd_1eB<^GvI;NtUG}t9cs&}S3B$xL~o3-R?zS>#a)>`q6+jPQmD3(Ku zURFYgL6#Cf-k6}G+FE>XUc2;@*4Hx#*$X)sO%W&tS4WKY%lm&pgp*um9d-txj;P9o^Kw^k@cS@EhWOW|mH@jTqnI*7Ot8!7l_ z(hcD+HdwFWgJXw{D!>K{ zx2kR88scZVru!;#-Jw%BOcWxWtsm}WRO{T-4Y4qtvPeh?>H5F8d#j+j<9*K(0>Rya zyF;+x?(S~E-6cTKKklvx?oQC)!QI{6-CbwroIBm;_RPICx2L+gs$YJOylvRE_e#G|nO=;^OjH4+EP$~EYI){fBv(cjWRVaWBv$R($JTly zj_d2}om~fvH4v_lpqAVqJ`^o73$|dkq1q)y@Z8MH?ft;wPVvjbN-i0-H=98aWyJ(kF%(tGH+MxL5aWu{v4j!L><{0l^0XYhEs&$n^He?OWt>k99rE3g>Mb z4O-2J|03qdF9X*?YO;;6j6^W%CeA6NJ}w3 z8bM-gh7O{REZ)5#jr3%5MTOBfI?rQa%h?eKCm~ zk*1I#Js_7jG?tu=cX^;%<<4}h++PF25K^xbHWA(81cwW<4AZp&u85OSn?zTV1{#nA zsL#L;J3PH<$tV`T1(M^QBVc9Cp#DfQ|9O8=yT`PF11sA6A|qvtvA_kJ`SL`Fw>!8g`>b{tvKQRH0cR5m?_PE8BaUi15!kHwpjC z&l=atwmNQL=Q`%gSI~3Da?w6aoIlL3*j#@8s-xiI{^7Nptuc`*1WNe6f|09v9nd8D z$=DwrWj?klv1RKi>Ehsy?M+vzmR|H;9E$Y(sv}~t z?40%sL1uSffBCO@a)DHrxJX~CVfQW)hLZ3aa!=>Vuh7^{a9?-pq?i+GY(Xh6JyuZ4 zYuN3vl-xx@_Kvm>WU)Ev-(u6eS5~q{o0VxQeBk>`UJmNh2P%|>@!g`oc3vz#wqhP~W2E&a;i+yziY2Uce?^L=ftSIuf z{FWq}-iW!TApx3;$JFXBeBp(9VrfOtAUj@IVAZnbGGZY77JGR!gWCu3NaEEd zdH#NcWLpj-6lwBlHx;*P;AedPt&29K4234`c&GBC;Rx#NX`QRtl$57S5z!?Nh6K-w ztr(dF^jqs)RJXKC8o%^6u4ped-x)z%b0xcQu~mto>J_~nfEWY~qPAfy0OdwFT<}5v zZ>i0-_#DA+QQ({i;%ZcRp6;6wRuo6Y7;38UG!RI?Pxz~iOlWTby;=0*n=;uvHxaOj zo>e+r7@bT^YSOCUUxSyUw53w@Q7R~Hn1tVBd!D=CDL zu@1Uu(K3Vwl))L2hvZ^r%HDjMq}QLxT4*M_amAfrmZ~16+HROZlDg6L8Z;w(RB(zx zf;v3mXS0?|r_fs9lrDvB_?dVrKoXghFZ8CL7hEI0ubFH*t6-%Tet@Hgw07g`DlULC?H~T7SQ^pgZ(G|ayDe(C z8Uzgj#bCdEp(YVq9+Ac^twmLF0S#ZoG>ALr%!NgK8vv(I+UhCmur4=bA$td6Wbkrr5PW4m>l zjFoIds$YZuee2J6PkPz}UAr<8oWn!rqI^_lI=z{-`t-+HILo}ADt-8{zW+D3gD9j6 z%p5g)(2C)JHhuuLT74tds3a&OR_OaTBbMtAd{aJ>l!8h`ON+ic2anA7t{IrK8z79t zyzY8TReWb&vE;3GPexNGzc3eEHrs4pPkaC&IeOn{8}O4mX^N!zYhY9QCm(r#i>0|63-5(Boy+uP6wAe{^eX=PR1THfJ?yp zz@^X*DYQm4Y(qzTG~zoESz9=$#BIps%~s(LD<|8e)-Lk_Ul1!Te|r=O?Qyh?o|oQ) zzC9mVRf~?paSjgVkUs=_%g^fvAL_omCr&bG1M74Rwm=a0GX@?>5%bmZO9z5t`6~hR zaiddpm8_WiP6sB9;$oVK zj>ZL#H{>%b8@JwA-k|90*B2D79bFKcu5Jx(GfYp_X42rhV*U9P^K6;9=JI&iq&bKG zAq&fk3%!pb;bk>`;xae345vpUicvvSX|gR~{m$wSx6bUg*wn%EUcxhK1NtE_F{paw ztzFS7?dP$3kkp^QK;``<<0eI8+R~QloiIQC{zU`+xcXdfTmObrhB_8r5<0k)> zKAJ^9K_Ax@OIT!*yQakR&0Fb4?8(~fT7sJZ1v9yqZz)xSFL`#eNUtI2q|bK7&)Mx5 z7P1I*(r41cgNI=(4x$X`K!&PNn}MzcONw_kIdP2Rp3vlQ=$tKYPx;_vuAg0x>jMV~ zTEcd{+Y$~ZgS%^~4W&R+Y z0wE0~4SK>?$$?~jo*-G@vkIdthLkoKB%>t&Fxv#FbnYSov5Wbv4>?A6Aij=u6RpZh_=!SZLhU(hE1E z-MzkfS#R!c(Mo_gA}*W7OqNvM6YUfwq3C;o`=Uo5T5!tJMaoiS#L~Rcra9McQ?g+# zh|L=rEgjoMJ1D+kAfD}A!eLSH4BW&5#}-U9MmZ&5JCmfWphnpg-P=!G_F|{!x39XD zwpoN5mb?TO)-~%V%#9t^Zphb}Yw+K{jDPK#US8}Ix~}a&*4wL1Y3%+nObD!2#+@gP z<4@Vce3}0ZjZNOgZt24iwU zG}-dNBldS_u9Ro6{n}+{MLLORCePWH`;{n#u=`9;pv55L7Q`SF$@5~m>29>NIS41v zl^9FwSTzILLAnm}nJC3~I3K`G7NqM?Sux1y_SoxT9uv8Ft~4$E`gcIVv{T!lrM?or zQ^Se+Q!}pGK`U~)PHIUPL#w%wM?K#5L)g3^)2(hPd%2Qrty!MZ;X%ZAN4Z@1TrY{f zH$l5p14J#bI``Lro@bhKF9wzTn_LTiWQuZ}@0OT(-o)pU@2qFPf`N@~&S6oP9NF>d z9%N*f^=kKSGiXv>6Pnl8xre}7#3*LE9KzL{dRp`D8D_Hj$ZH;$er0V&t>5fmrKMK8 zQ|@#ehrK zf@DRIoFQ!nRKtMjrg^Z6Gz6@zviiyBhfNAA!}R1&Pv3fBpDT-hiK@+bmq4Mc`VDW> z|H7+B6TlMt;0OHen}sjqlPx@8kD9j*zAb#n)g%>&qXzZOXf$^YVS}%$O)0=l0s-|k zDckPXzQr=IQT;~RSJ`;ty*MG~6{N9hlWPwb#X+B#JBeuQZ9w2*nkj+=vKZ&c#dCUlEKpp~7;7{*|2=Tn zP$v9wWkx^%Jy1@yLS!G4L&gx?2XC`}Q?O7Kc9o-S*X8)}rT3<46QwZvLk^+h1eZQe zcrtw0kaM-+a(oY%31zx@SiipkYiJi%50*!uh`#Z}Uy@;N5Y4jDMErvk=ykZD7nuL$ z!oEsE=_MN<(fI4Jtj4zhjyHms2 z2Il&G((I)cFz?%Cv^DQ(Aef)4XceD5r}Omv9DhG{4TfSao8u0Uyg$&~`OCQ%j_FnCa^G*gjIPSP)yfviX0ScuqH-@%59_aJPX$ zaV73VSL!1}7yz00Oh(*;oTv=>qx0QW60x&RF;D)+#53SGKV^PLMz*T_hA_I!g?t}X zD5!A4iofP{bKwk>+jk5)aX~k#Q3graQ-2r;$jyGZv_wXBKI^PqI(tUx;O!3h6Ce^q z6%?W+Zm~-#wDZA_GK{4?sgPgvk6=w*lj{&dn0k7emYX((-an*aHL48R!P%ZX*>1*mu|9 z3DK)Tg{nEcXx`*6v8Jk}rmtHvbv0J3GV(o!;CHdJeYn?yi}Go5&Ny#!Ckl+Lp78N(e)@WV5E4OIo~Hv%nPm1=eEE(ge!i^=Z4@oAR=pJ|0%Z3liK zp8xP}a2x6J#vDItgDb$S|HRUx#lD=$S%lvTh+oZxjVV7(ef`QT-I+pbM> znW%q{+o(98e$nYtZPoh~sw&VFah-zsJJfD_CPvCq+e2m6&0RHOB`fq~9FH;AG*#v< z8gwXnhga2TNBW9YrqP~fyh5p0o3z~>tD-Kqkiu2BOp@!4d_ot^?ne$eus9@Y_21Y$DSG7q-DIuiC}hOH zVB;_0aBsBm3%PmHNq_#IK^q_#lF`j)S0IG_547>}b&~<&y#+zI`2?b1_-U>ERyBoc zVq7~w#@)$+_}ltZd>-%|bsP8SRKDQC{V68=plZF{6eD8& z8LkHDkm1~2Pn9xRrmg3uuXyL>7t8b}myOrRk%!z>p4O*9nBw|$D*UbZQfiqRj{7AS z-?*{~HTg7*FEq=2f}wNlu|!#n9aZObkKlSQUVZd5l|?$7iVAZsOf` zDY^nUrJtR$2xdkw5yG-kA-1_6QQ;_r{Ghg+{ zwh(CLKHLw-YnKBy0U)qJ|Cex_74@uWL6e*1WeJq5;4hwbbViSYdoY_mjLR*_B)^_C#P5KjUq&A;taimt~?t!A%h!2ZW9t;85 z67_pk5M-t7ESc@m0&W53zc1K!VAw{K@sJ+ST$S{a}5Nioaf-n`*Mm`EgTc(+~88R_#Q6 zW|WcRskGwUm6}~J*^;u$`>+!Rwx43NamUZjXdx_7UfG0lc0PcDWu2ua4UMndkUS(C zF@o__hNyc;VD;rQ9Z4T5s$%>KXc19oUysKa0&p(3Ice3l{sV0MB^n4IVKAv9&W{EWdc5y_{^0YFgr!*U8o@$+WDwwgXYxVt?*MW*S z=Fi2P0i`pFZlkYP#85}ejrf1Hl-4f!a?byQPTcQCkc{TCH0ck$9ea zd8XQ1<_3H0Nmj^pu>#ziw(zbyOHXA%^W78yx>p)L~q3W}M3OWEvi|!EXMdOjXdP%}(&PSh3DS zb>nX4+0~S8=c!u;At9<5Vi0AdGC&Yq-pd@SY#L!b8HoW}Lckqpy5tc9w31W>(TOI4 zG}VU|?}Qx-VIgAJ+WgczDA%?PKK@p~TGW(Ab z6&ixvWw9T_?wkAMq4heaWjqmBD{uH3S9B$&2>+1Ai|=B+Z#I=N5D(;CyXKPGw-b#7b8 zJHSntf31e1O{p_^Cu#-2Hck`NArETTJ})uk9d!c5U~Ap5Qg z{djEL08^XHVuu(3>s?xRtcs@l1V3z|o=ECOR`V@^orMc@kKm37a6V1cFfxPU>a)#e z*-!ce1bY1-Wj~jk=3=>$q4*5G<%5?DE*V>&OqMuuwTqpO)lmf!vhv*LOx`n=&wR%} zy9~`IJue%x_7112!v1DZcWT4{neYtMcbZ+3Xxn%A$>`f z%QO>hweF{Mph_C2DJI%tU5Z}^h;CFC!Cf9dOI{wA7`=GJ&k%B+lhzbQ)(rn{?(MBKN?tW)E}92$v>|PGH6=VVq2? zW=T2tE(QePRF$V-<;DUsay zNye#qf`WO8sC{+~w}nMc_JP{)*A*yV>fcPIL_E5)d+ySqj^yh%upLLTp=fl~b~cWw zAp=18s9N|;W+*mIEukCz)RYQydc*G} zh(O6`W3l&VET3eROlutW=a4!87}&{pu;7M+pPqTV3y&&JX|ia$K)a@czlL#b*_O zf7vkQ_YC8SY&yA|f5m;&dmJHo4Q6uw>KPk%B+egmWw__NUc0AjCUU5ZzwE;iYWdhw zN?+q$Um!COL*6K6=M8Aj=BxT~Xxt`@y)$2^4kmBQ+DOii0hEECMrF~&n?!u3E6?a#T)FmQyp@x#vjk|)rZ9I=S}ww z@N-&3bSzL}EKi)R!dV3_Aa@q(ZLYLTfY{%$hqw4D%x&d{8_+Mx>dVm!T6>h6%j0kJ zinhON7cNmmceI0v@O!42_EtzTM4-ooVdB82^m59j<&TQR6-2ZcQ!G-(en*5<885Kv z204qY*>RJi+d@ChlQ$C&xtW|G?|`&Ru^$D~<^?2Mv#!SWS;V9n!}qQgyHfp9)R~u{ zucB`hw$H3!0RHG&S=CQNH@tE$psWEw8V4wA&?S~UwQe7!z_~nuU5j=!Nnlmx#4bzl z#b}tbJ-~s!;5J^(8f0QBRc8R1n67y_c3OWH7YASOI#QtN;X8^?m0FhJqiFPFo{Eh* zHz5hcvb@#~o8aZ3If1`T(r52(lA+0q=54o$8?+_>eudpg9+X$J9W@}A>1X3&y`n6x zk?sWYQPlW4hS~=tYg;`aR}K_4&_2r0?B}pl%9#>Za#x+uK!%n4q5y6p_KXmTEUuoZ z_^rM!ZM2b>b5jB6+eUxpvsaF3QNiR$d{{gg5|&U_DoQ{oygrfEJw2}K=}=wCJh0nMxj?cUGomqJ`h8Q?6Ay5 zS_31lZld{8os(rG>GdUSMtcFHaLUplLKn-&j1weinxHi8U86_Q%f;%mbk9-vYcdT# zl2#R4O#vkm2pW0Ewwev;E{&DQQN9Chc4_&Iqs;zMF_T`PG)K&5Vo)OiJuDYDAk$wg zGt+>RNJkw_Q2fDsH)Do<#XkKH+{6pWz%@<|Yoxbge!>K~p+7Cx(u9K9GO$o94KP4f zjq$_tHwHCJ2%)~p^bM=JV(b>kE8G%aA1vRLNhUIb+m5z{>Ua%TL5O%uUjUCraz+^1 zvXM|qRF|ZlK_W2@2i6GO{Ww3i5k{1t7~Jb>Cp$R?%f!HDC9GG~MIvdABOmy!C;2aXuPPVyj{NO%Aw+Y=^E5-XnWiL$hluG z>UExt5@Ibiq4;cu-CtziN%v2*W?Vb0Tfp7)$aim!N+1jL15Z%t^eN81I;P6sZ-PmE zd8y&TiL&l4nDz;I%TC*n!AHLEF7R-wepmkf!!%Ic4o#E+1sm->B{#l^P1~DfJO0Xa z|NL6aMWai*PjrV2RGesnocFP)vB_`w zcSP~A43M>K%bBy%Pcd-Ne4EGBbU1XP3~BtC$vi+VD`5*DZMAx@VbiS7%*mjU@5uGp z<&Hs5x1qp0tyYAv#VFQ|X`&4eg>y6-e5v9h%ArhmC8ynvrN3^X2?76im8`7~ypEN~ zdoA6Iw%D^y$lFD#?N5#2oLsraN>Y>g;FG0`=tVcre)<)S%kr}_MQuY*5|MP%+S4%S zp-yXZ`-}sCzJPIc7BdgSt7PlW@EgKd5{8L0fTKD)CN&ItQ-ta!qw|>8&A|Kg^C-juKzWb{x zQW(;T0;*lAa6Zqs{(io*0ql0D?rnzf*e#&F^;!yNha~6O61_P~V(-d$hg=|qep_M) zuaCuFWb0%+6(WMNo?pGIRO8BWfHH{ZSj#lTh$}KC$>t!fIfUZJBUKa$7xOyV<`7-j zkN_QU6lBWj{a#K%tqKUEMY%ymC>+6z4AqW!K4>{(Uql8HaVx(Ug|^=#l>+68?(dwp zMPa+*co*2HVRHm zAwO(g$J2d`9i3U9clB$@XzaFXMy6~5FAEd_p%=(Y^q%o zj(_GzhuF1o4)^v8^tj^$a$Vi!C$p6j~M|{ zjC=dO?4OZc*7N0aH}XcdVb0QyO#`Z;A+K+r^E6-9G-6#O-Q35ob6Ki&uP6#R#3}aO zl71qM8*Uq`&s)b6jW$b)3;y2a-9$-I71N6U(=`7JB2qW#m(x=I52;0VC@Uz&R3zeE zTNWthibRnSVLt3LUq_m{8jB2W&(;87)|wfG0E*^aPMbz8bjWMXY)d57j|AI7nhC|E zLZCj#mI*pD>GBk5!Gvr3jap5*L>K8V=a~2x&Y>>)FPvj8?SJ4LZp{A~=Kw&UW2nL= zzz$x5coT-)!d-PZ4f8bAj!uUrB+@^!jU+Y7;Kvdvac&$;a4}x6P;;Q)c5a4_9}T!T z=~jk=+@v7qZ>oZzzfGX8s!)e8m5vS-;8&2vWz%g5;UKX43I<^OmUeNd_gn&@#Ir%o3^%(@Q_4)=y_M ze3s7@@lPEZFr%^w9?D9en>fbkn#H}!=FkP-ePGPI#7J_iZ zSku%nhbRvw;VwrhP6qdEcwAS~f&`48Qn$ATVY1zkCxxQO*4Tq27TsGiEerisR|*`! zFzB1UC}bkJ+k_nebDDPAH%u~CU#UAsfBtVH4&o`IYe-!w+~a7F{?%!mf%uu2J*EQ9 z4a|fF2K=6aaaa;9St>SGNH{p5ff$PDIy-VVvNd*O?{l25em|H*9?annE`LP>t-LDl z^?eSUqVlXA1ShtESp#>dxMz#xqIlN1&%fVJR^+XL$lj%sl#M$#YZF;`+Ocd}wi!@D zkvG)uiJhUJThs^zi(+ClI}pS63!PjXU7Mc{Ue#r(INg zQc2}i<9AaAW@u_{QLW=NrNQ;2R*k0mxG5*Z%L~8z8))_D{ZH9`pa5Zv~=5UZI6YFNcG3r?s$>42BZ&r`(Cr1 zK@=zDdH?uxwEE?|?^B;=Wk>ths<9`{IA-ejNsevIC;AFJ2;oEmcbG7?ISj*(nwEdC+4J;9x7WtpxH>@XSqaf z%Mecgb%lU#klnAxn)rtYgBspkalKaUWbwBfvDQY)$&X5HWX1q7hg?-KJ=jv~o6y#4 zq8mRb?dhS!niYaJhtOIVKFJ^JmJi^%X@~$9j_Ibk&5DKlmRlhp*YrZGA;>k&P?PxP zW9_xL7~JEB`Pu8HX?^{KZVNI{&nTbwaJNZCz$LMV z59Rr{c}NPTy2BCEEtwm5G1XiJ=GGRh+Vt&q!U9iU2(uQ>-4i@kGCe>MQi8-i@A4Cs=_Gb%FH`R+5`OcwF13EGYz1jqc zS6PyaCIhkFwCr0wHTxg~wUGg&Ji5yT6j<1(+|Mw?R}7J@G^zZ#u0p0H`2d}rnu{;p zGzETv>@;+DW_}lFznSER;k}!;0$(*$HF9Z>+EhXQ>5g4Tta(J8Fro-jzYgHqWtqI! zHX7B&D{}A4nh9V7u0$V~C5bVMeS<-NbpzS`xByDEuyhH~o#)qY`fQ(oQZ07|kM=Jin_$O<$ya^*C)==)SPm6T;|9)ZNK!YsnUKqTPY(j7WA>& z9%CUUTv0=KBY3{9oJ!_{ztfE`OcFR3x+t=7fDz~SjH3PKg%fCJM_};sTr0A6-eBHR z7kH^ibl`)kt3_Xpg@P4VPuYy%B1WO3zSP@SC!?Y&mml=1qA zPehW!c?ZvUrNt#28IY}VU^zbFS8*1NsgP9LIV^=4#0I&Ygfy9O+;9@Hl!9E{NB;Jx5{RArI$|H%F_L&I zCXe88QW6U=`qJwdY#yb&DH5J{67jH^CqgGS3^!c-3Al0O_Opz76kfgj_*N_U$(f)%o8`4>7g=+FE~vy{iQ1N2f;3)dFTfYk=R~s&9v-E5d|b5J;l3yM^@XlE76MG-kR{ z9As*Bt+Swv_muT@bDnl-o%<$a-e$N}8wt}EG}j<$VFwWow~@AG9<$B1aB~;^peeXz zc$_WzG+Tvq6(l`?%>7u@oW}d`*DvgX4H?V^M?4F zmS(N=J`RU#i#9kO_2;vG{!?<)!dohKrXYH^AN6UHWt75GBB5CC8BtT0BhDvcwrqWp z*$%yOamZnN=DAREfCc_9-0)w#y<%j;Dd~5)9z^z58cYCI#J0Y-BehUL*73F5Qh5J8 zOo6T@ILmdC{I=l}?l6r(x|+kof95FB_rQit=%y5i@&3G@47;k3Hu1{Kl0rmA z_1I*BBcQy-l#GgxW)95ZYqD0~R->u^iB}L|r&-Y&r{%#IHuNet5m}$%qwgFMutXRP zdnAO_&;z7Y-?Wq%>AMe~%|8p}JfX*1w0_a_QkF1K&oo`@9#8G|H79?Whz0 z_-Y(9^xR(}AV<%!?G}&%jB;cQiDa1a64B8tcf8Mb6 zeHEUM%LsSU!|~-iHlo%%>fSKNjjvR8Jf zo>}qB_sMTyH1-M1p_T>sMp#Fk4$zS@IZ0y207$P#P_7r@cfch1Xg?)gBCNW1&5lkq zg@Dj0sN(NOZ2emO*(QMNqCC>xt%GtH=U$>jS$fy0_>-f!zt2xhN8=v0!>#7ET2c>~ zR}RJGw`DEu%$hZPMwzX2iUKL9Byz{Ic(}F*R9YF5)dDp@L=1Ig^}M$ReE2B)>$6za%DS$}FyLh_fBI(1F<&7N-SZbrEE`;H5?FTW)xd}F|HZ3u>!Foryu7)lMWESPJ z*k8qI`gS*JI_sy3Hoo-JvVqn!0jQuGl`h9Yh_4e>=rkGm1G1%+&@v{tW+ogI9-7^f zNJ4m6`b)k1!AU^#qmH_8BpGQoK;8t}L0GKYaOfd9)_d>Pn7I>)dY~K%C{D3y4H#d_&vJZoN z;fCVG6_e~AK@I#cj2m?N%-=r9Y5GcT9$O~#3u^dF=!!%wZ&H4>UCFIEuHJ4IpH`_vf{?YUY>8ZGdnCx`sTObJ!g zs7dw{jlRU-*a=I&uq9XJ(3UtcTBozbNUoE$DA>Tu)nzWyFR$ z+&G$AA!1o);qV)mI@vM#>*4%LL!ll6F52LH=bUFwyJP8`JvF? zHry`>dhKqd2iLM6f>d}{?;6#iqeHWiI&pgoV|fs?B8*WAhOp*y0UR2b4}&8U)koq& zsmzF1` zaaw;2{FWtxa4E-KaItF&UEV9fqThWWNFuw7(x6TqLve_>EY04Vgv3eaYRE?B3Uz z!Y*Ofdt&tnt#DpeRa9$RB~x#O5(d8jpxfy5KB7SaF8s&L-?@}Ns^jpU~Q-&PB| z9WV7}Cw1^$XlFz8 zak?2YRz67p9ilu9mmSvCCwP7$!LvnAqm^2hrOH@Pm5Sgr~#x zcmFBcH^f_>=j{QgIY_#mTb&QKWW{5n@e9r-=m?@IuI6l2frRhuM;%Qqw~+oS8rvK! zTN#Mq%z2>PRG4PFe74$Lp1`UypXZL2mLpG2sY|oA0&&_L(N%G-nS4_M(2M6x1>N6RJC9x_~(#9*xEc6*@p zh7X@wsQ$V{xV{4B_I$z)r;6BUZu-gu;bmRl(1${HO*Bsq?M3|eeM3;miXcSq+tngC zYOi~oXT4)g=Cu;YCa+m5m3XYGdgYKFSuN=uRv4MoRQGg87*z1+-QuFtwG+MCbCvp6 zw9z3eF7`P8qM;-P5^Z#-ChjE+gx3R?`6AKgpTD8@yUCFzZyKn;ET@0*Di{VYXdl}7 z^Kqe2*l&|B$iM8hFz{hkNlXrb7vE8-*s8el@8m$Ehq_35&n)fdXQbA z@;92~v&PP=>;xapSa$2oaOICY{795m?bsa$u3TMKtBLbAi_YNm0gwV%HV`;d2jb~*+k$|wuqcza9r z{R`hMl$Q0w)z@v2ZObZ`F8dp3XX=ZV?&G|!mgi7v{)FouG|GM^>RZEh<2RA#j>(LIAmuXH35tiV6*K2bZ*bmwSeTJ!w)cIxjk*B>4!6c^csQ#oO7x%ypDLG(}Y z)RY105~z`-ufZYwO7{S)GNU4H$TCTk z5;ZXr>+3RQmY=4ybXGDs+&a^gs)r@lgXo-bE?KG)|2>)-C0>xnxYf%R2C8Ne;5iPn#@D}b5 zp@Ha=2aT1e*yn&r_F+{(W|$XSRk;nM!7z5|{GmD0^#!?z^z|B`$5l32egNCKYMn}XfRcV z$c)6Awh{H*QFh|H=n$ny@QF$_DpfLH7LGS61err>aR3LHq>bH>tj$3YHrl!@>2ECd zpptL6E2JqwSvc~b5^bH7Ry7BFU`lb2qqg3`G$z$adu}tDn$mp%uHZLlhM3w$y9MbN zO$=B_AhU9rlE%(C(qP+|HS3b{*%&_5DC|Wvx4196$RMtW3VWNny& zo_Xa5R$#OA=8Kg7k5BhFJfOVR{I_X42GL#ymb>z)EO_wp+HrqmyPPv6MbY>8OO_-8 zG53;b6}|!9C-zrbG*ekYom$2%taX-?4#g}qz^hF&0Xql_Jx^#xs&znbbAk;22{&L2 zw66fkHWK}0+zp1(T)yEG*Je5Zt$e}Jjo7%1Ro>GnM%|P{A<|8-{g@Y@rn`ehesIGD zdI$>bdzn&eGmz7c_XgX_ph3j`bjYM2g!i8$hSNdO`S%tN-+h0BZ~&vbv-U-|Wp43X z$d3zVDTb})y~?R8RK&=4QR|<#^k#uVW;a1M@Xy75nT0p3WsI~!Iyd!qeC{ON{9l5S z9WQU-d?6K-B6G;|%U_&@(Gxs(j#h$zV*k2ZO(MA9 z2dN;66T?JYgpnJ^ypK7Q5%|a%zbB_;aggZurJ31)OfX=t5&bMv<#X|qLUaVOwH_KFK zZLi)@AVliNXM+6eRKZwwF;pXpW7*1M9ICf-lr+SMoD=5hpD&2;u=or*2c&&psH ze}e!=tMT3H8Z-R88gJP%ZKC>u-T;dEqK)TPy3+-KJE%j&EpsU2=F&_3QNOg&8=D}& znL~yP)==qSLw48Kw2YU-x`{1 z$*{)!?(qbEQT28W}T*&(|L>pzcEV7K-+b3YPJ z9osve{ZHWyhekJ~`^F?F!++q73%8(S#Ft7An8O<6M22Heih1<4qU`^!-T*-E4Ul@{ zeE4708(IIV-bm8@tKP7u_@{bf^{;xvQ|=$?4cGsYdV`Sb->El5{;A#oK<nD$8&)1 z=r*edM>Q4lEQKOTXAx=@D_XD%RdV90IGKZP33XMyUKt7JBaXKSD_$qlZ!tkpGE@X5 z4upVjun_%XJPjXIK17Q4@NA~$`Z-uBNW;UPTcdpD!S5N;lc+8|R${%SUE<|~q1KIt zgi-GX_h0Q>vLn_-X)v61X+mc*f;=2^xdOP%s%%;ueHBT6wxu;kj3$y-R8Es>(snAl zBP9s@QFwfFbU@A&@sM-G2@=osU^?)y5=g;cKTB`XF( zVcx@y3TtB3+?i8_w4V3a`S2MJhPgsMCAY=<-IT`78kmTX;B$OmcYv> zn@C=(esOAz_HF1zE)T(J52~IrgMxS_kdvkV&XM_%l9GU3*$3NodZN#2JAhu?fcN9i*dw%4IV?qlPQyf{SUJ#3Gc2!Fis z^<9a!(LNT!XWM-xMMK9Dv%S-d9q&&tB@;wC{ybV_(7z4pP!gfPmSS}q7mKwL2q4o+ z?thuXn&zAdgNh_s>eb|H%p*mS{*iD9uA@|gM;0XUw~T9_b%f4@El9Pf_u)Dfu@Ls9 zb>pI_7-Ptv`uL*JSPP>GtP2zL#7{-FYEi&9g~Nx7JsN&tdoT4{shIv%;#rY7U9N2)-G6!y^YLdsFgj7s1H}4&ccYeZCP7+oD%fss)&RB>)EVaY! z1HY3qN_|NbMxmQFRvnfP!;M|X3dOu!sW`=QO2wyI40H7ou1hUk?WUZ66`7&_h%KV9 z##f=x-%e7q#N#k^MfW@}a0T<(ds>tR4dr`L>W~r9ZnaS-5W+TA=L^`^VMq6sm^C6& z*xtYuXb`m4;&)((b6_uUMUqd}7If$Psmpw4u_`m(ktbv#)Gl}sY?NfAcIkCq@D&>3 z|LWMj_=j#z0sd|czS#i(r!`{^w7H<%7#0JjM2x$PiGyVNOTHMPB^-8F z?u)(MdS?0d1BSO2a6)KvnrftH;2+yc3cm@FI>) z%sdn-5JqaSGg~=2szpMYk*~$)JZq%sGS2GP+Mjm5{9dqcqz)n|fZvlKvN+;>V9`?j zHo8d*n@1Pt1G~@9+@rN1TKZ|n!x+5+HIqD-dI>^z5V9r+EIUw;@We|s8t28T(a9GP zHynS$xyrE4in%>D=PB4*ofqvCoB5t41uLx3aDd=Wnamsem8X}~v*Op%2$sd8T;jUV zqDojWcT7{}^>B%!=jx_ikN2~w{CzRyf2`s~-cxqW;mWrWO%3C**|*~NS{xnw85Zhf z;$zTDTQLM!E*F7DyC0i!RmuaT&Z?@jvN`6-g@5?8`EqmON9f-6ZsYJQ+dtG$uy__N zI$;(k10p_=M&xTR9k$Eo6=ew}(mr!l#DD1Kqpme$jYZDpc;8J=RcaRFCceqr=lJpS zV|VdQ?y+;^2AZqz>36kY(y=^o9<@B7)b{fSK*im!tWZWv!&xrQS5Q*w`4v6x`+S%x zN5`GBI%4 z_02pMtmfjL*BEk^)UP|TG@w0?QBb&Lzf(~jvU4GLj+=QwRSIfdw<1?GP<6f^>BIyY z0bG+fEgTzYdRrfawu)Gst>G)b%D-`vOIXd`#qn7#5Eb27 zK>oVBwcXEua=--lss6R7h<<~8)gE_F!&d6-+a3l$m0j8d zm0BODSfzl#w~DmJ;WG8W``PT{eunM% z#CB>W;+FlG;3Qt;5?z12_KcizEX<8`t+f|k(6+Cp*MB&ZtMbMQ3#5~(XuQ3$kcLK* zN!o`xrWyV-x> zI85flm_yHXz5X4J!@B)n;5a76e&INNqj3O#KaS%!8VB%CIF8c)_i-G*(Kvv=AII?< zjRW}maU8$VIDo$&$MGAD1Ni%K9KX>xfWIHd@f(c;`1^4jztK2=zaPi(8;t|_`*9q< z(Kvv=AII?SlHuBi>R0Gt!yhZsiKwRP+mnsu zg{gD(KH?o~yLJ0v^=FE=Hw(Wj*&qqJ7!dR>M>safKPHM0Av1+?&WdA$}Sm$%ee<~3~OUbO1ca)nd=0D8PSD74x5gIfHYXovE|U8Cfvx8@3vsJF!Y zin0GV-CDFF_~eufcSye}x`!68>Ac`A$*|7+NqyaGMyOlSR+vK9#hg`EtL@~^Ph&q4 zR>jL8(U0UUx#hUNQ>!S%y|v!2*ny)|OU+B-pfgsi4D(88rp!i^a83*re$B9kRVHs8 z$ooe7VF9CNc0cLCn;)8JuL6X-0U$JT|J`l|({VioD3A`OA8*rz@Dfkc#rlK2xpKI0CFY&Ln7o-XtcAAkI@?xcae!AK{= zl0y|_3spY+5h}0oa0^m!Nkkv~X5WK34qaUp$sRfp$mJsy^X;ZI;{(IY7hnd=JHVq3 zP13PrV^Q9;nQqnpHh6ST^8X$@3Y7e3;88~qJeqR#ufe0T-hY8dA1eF-9-aD+;L)>x zfJb>i@TiZ+zXXp0KYj;~x)S~8;88!je+G|gr~eyx)cfCqM@OFj1|Ef+{b%4&pzQw^ zJW9z-Rp$J!$)oLbJ8C@tHF*@6BmBF_qrv}*JPLea|2Og|5z>E29zFao$fFAOiemXN z^62ShgOX^92{vug@_$VpHTH**M}ahNyTbp9JW9sKe=4aY#H+7GWTm~+IOY8Xlbl`e zpc379TUjb#)8Wzj2i>3CC~14DSKIw*_p1auV(a%?u4C6k5{gdeZJc5PWF+|{+w*sx z9E%TRRp|8&qswR)n9uMi;Xiz(kqf*!WGYw}t&e!5*Oq2kTb$IGpxW$vOV}>~%lrD$#|xN_M4ti$6H60EGlOw`$@6 zRpp=}RQ9nd$2;XukJ!Zt1s0;)CBlw|vxh`1l4s%)T=H6dKH7)SMAW^O9&pLBnbbJd z<=fA8c9~e~*f7wrMRwCXOqO{9eSPdG{jwwEWuY;a9(yC-BT>;S43FcyAKMlx5%`kn zMX7T8;ppDbqyomgCZxXA6uz zH0!^XH(7yT0pF`YK=KQE9N|W14;72*x<1L?$W@-VNU5uutK9s}$M2Dc@VTF75u!b} zF>nKL3u((0koxBeXt0uM37euG9azYR5`czMnQME5f>P3(t+?$efO4Qacm_qKU}Ve% zVXFK#QXH4vmd7ttBl)Fxz3fwl;J#O-n>>A`bmh`FZwRH-7G#shwYnt{B}X4;b12Ei zXTRdK%)(w8eI~2n_lmC@ z1X*UptTeWiSE}VsX0)j*vP>7h*j!HGv&Tc; zWV4UhC{CcF1#LT&1&Mr?0}nmkr#>A(3f6O;tRBR=y2v*Wtb!+(VhY{vz)-7j{tN<` zyExquig|#?Y2T&tiL{c|pB|?e*v3*+&`^kVzdPBfubuD62GZR=aW9$_ zazm%&YjI!-R|8PtN*`j8V!4HVOo?I@rKP9MPN%X+r+S0Ub|W4#eXCf0Y2|9F^(rjSpmtZedq&=4+;8 z#zijYy>&-^NAnDa*7*5l0;+G(g5RF@Ir#}l@3bSjP;86F#ytob6#FrCSzG&PTd(;b zJjfKzI+!TmR(&9etKB)! z3jU~z)3=f8%Z|ugU{H>^O0t#GJ~xKtMr;zF1Npe+obYogb)T2RdU99DH-s^>30NT1 zbEr&xVN5-m&O55QX7P!~_H+~kGf4AUV=8y`qK$c-*dpj{jwJq!@fDuAj$-g zoW5So^D;7`gwtx5Z;%zV{S-hWnE+5yndulGk&J^qoL7kwXbcsjyd~k*!)Y%w!_tm( zz7&ySM;d=d=nOt1ctRGM&zHJsVaA#G-r1%l0W1!EaKHLUiaEa znUSZ;bO$$Rkk`Lr3LQCqnNrB5e}_93n-g5iJO-D>YvY{MX5Xs1+>s_he&{yGA^ASh z@E#Fa`b8+`6q%L~j`S)GwkSLBfd767AAhrrKxICaXXxQTH}6-=>IE)W+%FfXYMCjL z*x&1`2PXBAzcpngI@ms?cZe!6iM`cEev|Bu=VpUyAK^`L2@QpQ-KFi8PX4?tygpR5 zr4~hNh%lYt{;29_oIaBO<;TU7wuJAr<)5CQr^zmho;?g8T^gKtVh5H?0Fcv>j;7s> zs5GCSz5*Bj!}n@s?}gp>wm~Pay~IWwA`S%s(3 zGlauJEBc9NukQ)tkvbNL0GafjeEB;7gb)9oQpOXE&ubgg75!Pf-+dz_KRlXX2V&zQ zOy67sG@3p6CNC(_Skjp@^d`m8PuViFHQW_Yrqik_4!Tf>j^gRced~C>c`IRX#%PfV z>0w{{XSGTRv8bGzO{hmcRd#d@`_y7^B5bG>=$D}*MAF>IpMS~Gex`j-*%kjwk%v}G zo%Qq}%|>}*>od0Mo4e!{;$foH?}Th`n^4ynfB-M+#4M?z=?8}nIksbl-;!>(uYi;^Y;gYnhU>o zQI_Y*Z)2NBl2&}7mtmCjLLp4?sa6?Aw_25Oi{9g(Z9}e>$Bkeh|sC}3dIf)TvBX937;2l(MO=ew_s2?QFJ@`!gFV0 zg@tk#$?sG3c0{pR2V<|4HF(b@@-vp(KD};ve6S?E7aN}H%)7DFIE1qqlngF?B1k>L zf1q<|KsMm2x-$+p(M92$<#BKX1@@No`vHC@)fsm(gij_;#f~;PhZ%>@dyoresRFgh zpHtm3i&D$IE5Cf%PQBLCzpxRqUFcg88q_J?OLu9DQg}0{JBBks0i*;aKC#xo-T3j$ zk}%3N1bz{d?h}myzM8_SjLKUql)VYFwCLJ`7fuUYKD3cRebwOq68i#<+m-w;s;WSd zJQ?F?b+qd~vQI<%nC48NBH_msIZN3~9RBq=6MFnTwgEI)SJ z!poFxx`Gy8mA6XTEl5>0%(yFvi}4$2>9o3`0QU?X3l*GwN?xT^C1I=LJwvfm-|v%t zgB*2+eb%jgp?$00Y+Oh8&USWn>Z<`O=_?MC06vE{@`E>D+&Rf@5=aoswU&sMRBNh5 zfVsEfW~sIWT;}@m)7N;FqyD!hYCkK2&#EwPme^-lisD2>6K(WFLH_7e#S%%`!CANl z=vUF0`wxDVf6}Y8ZvLrP0sh&qLi0cHt1KA&xBV)A>Q$O82U;178!i2S$W`HJBuP@B zF#7|t^I~_f%>@p{Vd^`<{r8sbKl`4LPAK{2-(6*<$w|>;a?i^puH5iN$CFXYT+~pJ z3M$gSh@&F@UqgOBjO)}-lJk(qI8>xza&cc8 z6qIp-^;nQyFob*MaK7)>vz)Jq(+j>1J+wu0{H@1gG6nWnIwb$-u^7R6EEj+FSgehU zGOL4nSfs0-rvJg{07DNf{x5Y_w@d;F1lKnT-;zhaMV{ieKMv4_3UAF;z*3JE_LM5%SL_jpoq$dKTkJu}{eK#JG=%*(Vvm2M z9>D)MvBy7B58$7DE3nvO0iN$)`d0o!>@mOgA7c;Ay1#rY|3&QakJJPB!?z+r{6C33 zW{dtU_E`Tviaq|3dI0}V_*Rzhrs{^*t1UBbfHNQZ4;=G1=F*MkM$$*L&Vr>mPmTQv zFuD#0qv-F>@zFh5lb(hn4eD!%sgw?3q!2zxARj~;oWnw5?ZA3y(StH0cy;}3`QzA+ zWN6X~gapC43R<@UAqE~wj5&(4-zgVn9buPJeJ4!%{raPhzi`xxn!;2lQtSoYDtv2!DE_P5 z(u)N9aDVd1PBeS_jeAG_%7wY<)aX*dGCfxZ@Z~;ElfLVHG-1RBjeFyAfbyQ8smo?e zmM2C_<(RTI(dT$r62cVgIP-uNo!&?YP1mjTnT)~!CYeOrFNF_+w(M3(Spt~VZ_vajbznx^;7{d*I+ zJoGRGLV*DFtilO}D8pm(e8OIsjF0rb;xXiD>Z?Ur+kv`-L2LnVt?%ST8g?*pIfdg~|0<-Fd}AEmd>_*6`sv-7?l%>eGrZ69{o@|LFqACF)wibjnEuN_8^cJWe%=-8 zOGay6%uTv?8#21@7+*dfGg;Z&*31Er^q3wiAkHgKOfE)#=B{wtpu3#2OwOZ(VH$p} zidzRm%_1PIK;SVG=NZihCD6lj|6B5eV71fTtIq>Q;pMt2a~ofM#}Jvr4D8UTB2MKB z9NF)uWQaB=pqjaObYCA19wu*+aIj)6rFC8`SeJA1CW2&1gzXo^!z$c~S>a|S_L}p; zT+zekUELM%^6WCqas5O~d;@IU);#p{tryD~`UFhjK>6Zu?oJ{$mKqKExoE$13C4o0 z(d9;D*ZLO&0}w6Qm--7Wsgb?hNc{Zxk7`262kw&m*Y_3^A1N1%4B)IUNk&7FCFjRQ zT>=^`r#x0=sr+#@x0$puC!EK=42vl`+dWssB#>b3fq&b21Ck|Qa=^%vr-@-&q)EVV zx}ehecMoyd?XKcHgMi@_MVJJ1&T=9nrQ2@?&560d+_YLu-KHJ~^ky_{6oT4}g%SVx z-sK0OC2e-uw!xP|h1C8O1sGBn5!zEYoitbKmXlwbH%8K#6&F$6x>wtY;8rcHw!JNX z%F$6Z2E8(6vUqqhe$i1NHS{yy7=S8@v?PC|P6p8ngcZ*P#_-J@+a6w#y(?5#sxbUZ zoMFjZiY=(D^1#a^udydL5&I8s#_C&O6C^K0lGV_fzu2TH?vl%fbrW!ZbrU|z(i81F zcI)0Zy=_t1GJ&8dYR;P2y+QtFeInCT^9G$HYN(6;&KBqg*$eSQ?M!TZ*uk56R`tH6 zlyuB0F!n;nSIJo?%lO1Dp(1+vg9QEG z&`jR=v)IsayzbHvZvxQ^wxBpe_6rllJIl5gL@!u&zH(mZG<;cwaGO>)Y4b2f%L}~1 z+zbVz{L}VcrX43)c2=(bVlRaB8VY0m$zEtrEqcBQ`;%Fpi@?|muc8cL=!Lv=dzL@N z8ReE+UyI$;kyZqcD_;Ml0ZoFH6QX{V6A0UNP8)yBIWO6jn>=J%O2sT*N^0rzg_RR9 zn$}13fi4g(*>2~g@oR2%e-YHS?$ff4g{mPK@W8wOta$$l=cI;9{u1&{{ie~g!Fqqt zWMdXKw{G47nOp(a36dob+)ImIe+Jo-oH`S$YVJr$4xR2}kHN7ulPG0{Fcn=1>#VU$ zBOce0lqp^B{WA_2d%+N=m}|v{M#KQvTXe$$)fv`X#Ou-FsdH|DFb`mm47z(&U>CW0+Q zLyH}3of7_wE-CG}5CFGMa0}8UN1ariKN%4-MMz@Rd}{{j3va_F3lz3dFCg5wyntGN zVjbZ)3l9ZA_JU?>;C}TF5m$Sq0*#BpHxqQX#xk0fiS;|`S&T6Jf_}m)5p7Ww2N@M1 zs#(2_$FX@ccs>zfzvQ64S53JZRl`S)F#1Ben0xVH&luZ>jwidgFfHf}kQsNsnr>hOF?S8;455Jq1@uoM zs=S81G)BDC3HQD%y&tKXQ#E{&KprY0ha9SbY+1&uYR5Snb;eHje3sb0&fVpdBf02m zdKc^`&{Y1>Pk44uwan1FlEIB>mKN+M%*g1+6m2uPQpT6G;F*x27hLv=?ChK{`a;zc+Uo`19McBv_lovwU_U{jg0V)@R`8i0*iRUn zkCp6^0w}BiUDroU$BM;{#K5Z`-3LCIme8C!^@etmn|Akgb}f{`WS0dhl&apeDcrt7 zQ&0_>_AK1PA{Hztyrh;>4Eg>6AW@~cSH+Jh-Rm~<@Q$`Cohl-lFD|9jfVTm0^F2VUL-9d+HA-GVcuMlD= z*;fcM;K3Cn=c z;#%xdLQkJzY@ZtwliPYmCfDcT+iQ(6#u1h~aetRjAx>r>T%pjAgM4p~f56-b zS#djwSJ_VNq}pD^A04wAdXp+oSHbtebi=Iq{!LoWux!ZA@kQ-i8HE_~56;0jmCKoF z&G?vkyDDm%@wnrBPfcttS7}^aJKyPO3DS~iJ6yv-<>qzbTY%8DayZ{pGHRYVDuskK(Fps8zzh zM;e??vY)l2H;8uayhjugYtHGOv01u%j{!~%(OHu!69PjzHm+56f=EY|Cl@3nAktC) zT_-#?`qy%Ycf1a0cOCb?Y(AMvM!wAS8%Usj7n8s)+2f1G1tU5}N6BwD6e3=o?z~O~ z98=)FNCpt`U{&(*M!tH3*~*YT(UY-O+9%U|#D4;I0?Ju37zoy(B<^EXU?+fpJf!|j z$)O9|%Vh`2SrF;ijm{gzA`$#D`%kV0+vsBu1o6y6Hzmk-gzLJ}r^_|h7WTDS!- z#Os#VP=QrUlAe03pIrM(++}=OVe4ELz}IIdy*K)k60fstf)AAHnu^ zKgu%tS8Ww>X~K^P(Cg!c^Xuoq)Az9IW9fFG_=*q7c>F$*XYPS?e~1~*%Apxa5GDZZ?2Eqp#^V2= z=@n*PHm>6jp^Fp_?)+inXIP+cVI~6LR&L7g`Z6K{Gv z>Lqwo{Fwym$ljAl1juG3bX)vL`-ngmyQ0VUtW98R$7Wa$K*?s`o1H=KGDUS$5x(Ss zBD+F35#Wuggk2#@@YwdxsT)gJpWZ*WZ@2SEw13<^QI+KeVStBch7P+!WJpyH;psY|>= z0I!8HNS}{7X<9I~cHjUPTlYr|xiUcdybQ^R!A^O-j}2AkSad8%pEpm?WlZL5asF)f zVct%;KH#KHvXw=X*sM8IWrCBMyik^KKO_liK+?F;eLC z=YF%=B{ZUs#BaFv!9XJ(`5Px?4xpKxLI@YDGp@q2i=4xjmGG!wP9omX2R;r zbu)#Mg0ZMo1c$nsV}mwf#fwgK4+k$@26Tw*3>vf18{*s0pBRR00kRu7KfJW1(L`Zz zHnN&hx=6XRlIdb4pMh-fFZdh&&yQVUoN%2}v!nNC4pS5*+#UxFg7o?If|CfX*t8?o zK1im&FE5=m59rooH`jN|WgguR#yt}p*DlF2?@&Z1uSJA*XiPi2rS{0lMMD@+b%&~O zQi~NIy+|17?79U85!2Mk1wSZ^8Vt(4iAj-tkrctifJ{z#UB;KJ%rSfL@h|+mHg-mN z^}yygEYF4YL=W3$LLQ3r7?s0_O*7PtfQzt4=t~cw1VkEApoBKdw_Di zjcUR9Bq1&BdomlJK)K#@WYBSAREMwC{cBOjk|msHRS2n%A_oa#(L`rJJRA2+q-9qd zOse1yXdt+l>_3@hnh6l1gltMB4Z|12$ zfD85*1N6(cdhvV=;A*S3u&d}2gKIDHDwigZn_HSwpo9G-Q5N~GdrTP%!#3s1!@4vC)(zY5IN@~d1HZ-AWn5e;@ZREvk$#1`uN(Ve!qyX?3@ld#=Z8o1lK zi*$3a55*g-i#8bb#7t!FQGQHrA?(eY<}3aLOX=ZI=j0MtVfMTrrs}KBZU4Djw7Amu z2=7>%%VR(2oJ*LbB0RM#`Gl)c0cSHj*}JvB16i=O9R{Fh_0%#`bP5IhsXS%nsc;qq zNWkqDzf;`)F9Q8_3Ao%k%0GVI!=*_IBeeNEJp#H2OSIBQ@sD*r&^z1~CUH8l=Ns9< z{CZ%E-exD@Y&%P{>{zF{Q0claq1=Mgd7|XC2F$P5$`<5b9h|$Hkn1T?-PBJ*uU5tM zfb5S7Gk|gqsFYb{t{fPHem$`;(60y0Gg}RRG06aHFJEy!xI%|5y6&3a+*LHcRuaB3 z2sURYGuyUR92J3F{lsjSRjCwO4s|Hlt{Lhl!Pbk;R7fZIK!HK@JRskp{gYg`gA^Nz zQ0q#TbzMRGb2i~80iUs+l>MqOZ(3DT0( zr0eL24Yc<#N9$1!{4BFLKkW?PGeFSt`23{vgGcD~+D3HLwFGy&`kBq^(i@Evqamuv z4k@c2Qp#cR*@tiV^Ij`5E*zC$KXxCvE`G~)caN0{Sa+o|ai-S3Fp+O41}t(8QkL%d z{Xn9cbuy{@nGp|@>=6g0urI(5=>AMizXXES-4EcdJ09kpN0jyeW~rl@Le zfy*C);vFw%GwgL%XVixu(|V-+3|giMPN6}jbn3K$YyAp9$-hGAVB-N6Aei($yWu(V zim*B#atM-s3Ar~Qd~fwF&p#}Tqj--MV_5~HmP8(RF|h7eOC~Dk{6J*?9lm> z%X|hGN;a341FZ5~p9YkBhYErfhxjP$ zyMAEp(%@3yZ&R(S5-Y*krjR3t&JEJTLirKjsz&;1t-w)4*O6Ab09-yxWjSn$w;8ii&{QHiY3ga>#7@0Q^4_)+SYvD4=Mk;oyzyndimF6s?G# zRvUq{@Ih3!uM4PJ3&|xfRSebD$~99D6&!BC9=`?1}0IG z>{+82X0$mGjO55!B+dAL7K7b2+WmRg=<$+^n9+rq^n8S`;p*X1*?PNftn>S+uLiqQ zH-T3|Ja!TrAxnFUg@LfIU=`+vPYZNC^+qrbTR$8*uRwZlx8bzADl!1CV=GhBn=tOj z#c@;kXk^)OO2fd#LJEq7S+i)IdDO0wta!iBK!sEI1h`1!SioUQNrX(t$&EFWsi>IB zs8t+Lnr&2BKYa_tP7azS6OmT$KdI6M-uBxQSB2#}`eH`fE+MH~uLyV&a!&`u*Ujsk z6gKF)*`Z!1a&P5hqH{jbSg&W*O&d6_Jn{To>M*}r(N4jp;Lb5$Sm<}@csR!Lh<#DU zJ`5dWD_*I`@pIb3+;|NSw)mo+r<})W7Huw3oQ`UC{u^m4Mr~EA1c9EqklfA>imbpv|=4X#}ap=E^11LlA1XA zHIZ2x*}a&U=nFyf`m7+!IXLO=M$EOW3-fBJ0&LO{A7Jw0NfkFQa zZ;@<{_?L?Nqdon84?LyZg9HrTO#%k!~ynVJv6opvYBAoeamxnYcai zebB_6nmJ#p;*zX}PH#ySD~@FNBhrhlj97?c7Bq2_zg>ZuxSOV`*O~!3{!3PSxn0NA zjL&Fw^bWK)bQQ2WxH$)z%dgtieV*sTx&Hp|eD8NiD}b^p*L|3)ir;dxkJ0Me6Rp>d zJlQ#zt03%X7zR7)jFs_nD~%ZQPbPE|;J>7}-}o*2wH0^<*T0?xne@N=_;NW>!WYJJ zwoV3Sb8*5_%m4>EcB)xPjbSr9ZKW$aRm6QxeA}U5$ zPLaFEGA% z2xawx(85zfwY?x-@FUQ9FUS*wgGA_0*l)%`3A`aX@Uc)wZ%8!WW#>F^cZ^FGT|r%L_x?h@=Uj`cTLUc16x(3HO*9 z@>)~2bF=83wzM$`yeR z(l|YDJslMY&Zf_#nzTeYkb2QBPbC|P${IKG~roUVXe%2KE z7nA!YEeC1UPY+X;UtKA>+U~$bc{Pp5HOMea^eF3%+Y8y*{eZqNfiM8qe=Km-ZoVSx zCoh>{kUp?FaQ$=zulJ3_6Slw=9t0P-6HAL(!hbGsE&YPsNeGANV zHt&J^Tb-wW?r-@pk0Re;suC6jkC{0vVrba=vH#lN;!c43TYsAiWguBykvnkQuH#xD zx-$Q_1?~sC9rRsrft%j%QgZ<=a4|xE5FY(wfqQd0oi`*tG4X4E`%MPks7r&n4!T)Z zzsL6_J3pDzxu8VlwQ@?>M9aI>TN1a5*RRl>lynSzL|oQKkCU@E9jojM`;Q+X{ls64 zA#0$6zV!eXxX-(5A;-z)RR#+m4&G82!k)UQvm$psdERoX^E&HrG}d{!SA4PUE{mB8 ztKnX&4tHPek+K(K%4yYYpZ1N)#gmZ|Za;1aFnd6ujl+F+6?S%M{+Q5ERfyj|-I`ER zNNNHdsyjHvmMj}mFmjC15``c?ECk{8%r$ck@n-$p!b;0W!}g4 z)mixHNyTSYooK5YOnv)#XG<_(R{#n3amZr|4$R5RKvV;LqsB2uS~x-TeGByK$BO_t^~> z&tKWi>_LovQztCD(Shq+b*$2f@u0`ILfmLL#s9KIsNZ~~i1S6~;`0usoxul2jcbDy zoO?jSwcSIZp7Ku`#Mv(@KUtZ}DUfv%bjZJ*@$B9)q(?gpPo94d05mCga^4F1w^4bE z2=S6+dFZ_CTvINmq7Pq(%Eixa*&)^-jx#C>?DT}rA?zJjP5(-Hp3lTd_-=RLQCKI- z4M~xTB$-u~{x~SkFjT~v|E!|Ik5gDC^6u0J$bC9@^JmawKnw;wYt0%iNWtq&!yQSF zUJbGcO3wh{^+A{_vBHZ}xd)}&S>KU41i~l5r?1;4JT)!28pbw-t%fDvenZ|^IYCC~ z)VN}d*p5BA<;~O-QvduYgjKAF_u?lgx8QVR9Lyz#K zh{NP05}Atn2&I>v^XWCTIMIreWX1Tf)C6A)MQ?}TbD(1I|F*5I#z{OZ|LOzAJgLjS zVxE~SSj^LU4aPi=&KsjP7OaR?LZC*`;4@MU8Wjy;g71VjMT6g}iO|y71W)hsO=-)CR=-^}&Ud$AB*cuS~Z zEcj$*s3MGm@WCU3Pv$BOD8vc@sD{Hqr>uJ{+{pGwqwKAvV%amZ_)jqbn)WH`EZ9;F z6ZUUXJd){7_aDQtZP`#FwZxeqMI-O(JFT6%#FuO5*U@n`nvgn0MydMSP`6%}rWakF zSp`t|7)IeU;%P?AP`-DivWno7&jc^S2&hC;mE0-SpAADEm(jgwF>hSOc~SoKC^LLi zNBt-}xk0^Q5Q`+Hli3p0D7moGNhfWYmf>qnd zNCh+j*B7P=#ttZwAHsL;lC(xN&4i&)A}5HQ z9aQJ;*;RBy^WaL0kFd0Gncfq=6wCJ?e6K6gnQQ)7A};?V4LMaO2X$D!_UxG*=;`$l zpvuNbntnyVBFC*W`FhPawdhIdLvD>ps)a|FvL_^&8?S(cM=r8I_+K7$HKv~>?C;1w zZETFd(F+JZvX3OD$<0WdXlCZ2z;M+V652#XH8_CAadb3+=3dcX=3Z^qZ_(xXQUi{& z>Dg`{$z2}3!+TZJtwG7rQS&0MlSZ<$YPf2Aem1?Nz8>VSY9W(O%FuUTJ{SpsV||3X zws4}S0>t=^gm`|XV)p6GZ9K^ksWd^iLuqro|0u+!7^|f*15NM!s^_pCZkiSRy0XOc zT_uU?Q?L^hMdf_|S0_mJhq8@EoygV7`>uNN%=QOgP-ds&!MP;sJEz05jK#+OPyN z32u1a_W+)sf$Omcek;1y9S+SjbUINJDG=>C*<;(%MOZWIva}E}Ej`aaU~3J(Ln^MA*MBt2#Wz@IFhwsKG$uL`~3|)jzeYv!>bo?!F_A_lVDL>uTDEtJap! z;W%}}bAKg^%0dQO*aC8X+4E(~5FOid8S*Zg+!PXv%HsxPIK6wax4%bs3zui{uAN7f z8_iW=l{QIPY?k+9xZzdGn&k#OztLWO*SoL+gS1PF`UkqGKMod|^Nc9Wza?%H5)lux zX2%`yi8j?0*xJWMfSTTv>rEL2WlqMrd|8d=xLNh;{8=`rO)G>}{y@17_bSen<}pE@ zkNvFXBIzZWHm)1R`92F0m$Me^WQuJZJei_!M5C&@k}Kfl`s-vW>(|MYe99*O>wla~ zO{gS7*IFTTRANq{tTLou!h_Fk8oA8W#daV})#SUES@)=xBwOc_P81oB&Y>*dA$)|d zqd5P0HX$`sPX!iAp@HAQPb0@wj}){kQP|Y6hamK>i0dG;2@ZV%Jc@>< z!R>XQYXe^%#~5}k;}d0*|J+&2R)W*aYU^F*3ImUtlw851rhYDeikSz>x@1cFo{qbx z;a9vD*8q0t!;=W@`}m!&FMnM*b&Z2pPHzmrD<|1(qE3=xV<<}->}Qr3^@Y zjtJXYlrFKRx5B};7A0=gQ%}0XGwPK!wn^WT8YV83zD{@_iF)TZw^+D_ffhy=FtE-5 zxlC<)Wr}5=&>x~_v-twU-A~wr3lX-r=>C>D>60*)aVxPOcx9Ms?#Lc9)+A)(da z7;@(@^F+_CqgmoKo)cPL3BJ`bp<|Wc zTTKeeS_O$CVA$x>LC<3*iHf-Xc)Ecwdzso$`*l3uO%1wS1-|C)a*gM@(ec3v0R&c2U-8j>c(%T(C2vEwih{N(BAf)Jp!ZT;?@k*v$eT--Met?n`ebIHYB zCKctuN9NKLdj;%(h|K#>?z4HKNR{kDdwcebOkc+D*)%bw&Tb2AS61K0t`bU%6R)V( z9pbUmnnUHzzx>C=ZN(h> z`9`nfEQa2@&*{F58q}Y>udfim!>uC#~}L1bopAIP?9VRv{3JMG|T= zq(FR(ctaoi;&fftSXFnv?mBizRvS{h5NBmv*(&NwA-$lm-aXaUzoCi@;rjEMmAf0VZ#J@ZcfES9v z;QRo}E*;2&zLEN?$reE+d)jIfy;oedYO4IbFB{?Xj!=MoSO|&e^m2h z16AV7XPt;D=957mg%xpl#yGu=DE3%hfJcw{>(a8qMA&-U5_5jI!1RR{TWHNAl)>o3 zPkUJVG>I@;VpoKAIn@E|D~TWWxkP5$p(RC_E}lh-T4RD2X^0iyAr{07AC2Sdc@+(P zONAe&@i9{2r2rBNLEB;(z7L)ec#s)MWfC6Flue0nn22h#`zp}qlOgi`$~E7;6nl@y z@4L212WZvOwZq~}aB3oqouwoV?Y@o~=J6IhfAG$B*89dy>#0)Xmtll$Md3aEh#8+J zrq;vL?Bocb62jBr!TpTwy7UBqUQNjvrP(xHP$%dy0`qASs#5{;b7yN)+ONQgZxS+u zE{<69**o**uCb4h9-?7P0Xw#B4-$oXVXOe}!9-EX$l^ANlnv$Rc2{}oqIstLOX|lK zwSOrg4BGrEn8QiJXC##M$wi7S7ycJ(cO4X0*C%)!cXzh{!QBb&5ZoO?aJS%Gg1fs0 zcY=!G6h&{r z&dVLhqR=NR;j7&^aU|xoZ$}?XZgGMS)y(`Vt=Tc>0!<5k?14+l>@2_E55i9x7sU@d zJE_)<0gdVs>#>lW_|l=+v)g^oInhsoOgW zsp{Z(pAC>=Tm7ArH8^4Z&ujoxb^bvdsv4Dw=^Rs(sWxQhUhoG-53;e$-6S@5208#2 zy0hF2QKN5SJ!#+Yrnaksi0bW69RK|u$AkVmaePF2{9ofZ&%cY~n@9iGI8LoTxnlCC zj@P*>@_heC9sdvGc*A=f4+s5^%6G$i`PTj;K^%WD$P)jNAm7u#hGJ{16Eu8D#%az+E{hyPAQIU}tquwC~V>umP(v=oMNW zGHalaA!EW|0->rNq!In$DdE)(^ZH?;t-acxWSNDel44*`E<{BLI+Da#$3RR1yyIxgrhmcF z-v2v}PO_QMY@%9ytKI|3y^LOTu^cQoO9sehDP#y0D z$wMCh??~umREJb1N(|6u#XX}gojhw9`GEW$9-OzBpI%eL$u}@=SlH$@OKm_;@|wAt z{QO3a;X8_NXw!B|kGws}rVzLWOkt^EFD4D{-)6cn}e;GJ1HQJ4#;O))zZTDdfyH~Z;yP(KFXmSc_!L; z%Bcj{$M{y>$&L+`HC~zFX2h^EV@+(PFvA6AUWAZzpS*MF357pg`u-}GOl;XRxP$d? zE*$~($3o;Q{)>f>ckxlul$7M8`C}n~{6?R>cMMT9x2Va!SC7f|7ntVE*nS}Y1E$ll z4gP>>-&8=dDPs)#-9mIpe*eot#CaMB`D&m4Z6TO7Dn$(9c|osYW@{=+nE9V*xk?QD z0|U^_93;rh1?#fsW5=Au zP9q|o4Y@h0cOS|~Y=01-cxeJ@@HYEtQ^HQWhI!1>yB0nr&GCmsq>%lCM06CE9OHE` zQ^tk?wHxROM;GsIx|}~4EM?(uH|@~fI|^sf7J+xuDa@!oJwRwwsg853{?|cYd?=6i zq3-Xa-7Wo63Va`XF(z&J8RkFs76<9vUJ!?8lzh(a!9CEMb<73j`?^XYlPk`;Ekej) zfTVsFez6*#lVZk#64Wod_Dws&(99QLLgFK3G9j%UJ=U5GNR(Kd&&xw`?0LC8m|Svd zJGHENs};#yxJ3TOG+~#HqA?l?yI65vXP2w9oNdb)V60X2i4yLI=61mqg|gQ4eHHzU zu*oBiz{|!8NDdB2fVWH4fE*nxiVRrKFn0UWPFU5zSPf0}hq|u%(9c>J5=-U4aXQ$C zreAeAVd(<6hbLUrMQCMZn=swQaV5n~f9ATk_X=*jQHqKk?S#gacy!snhL#u)%BDUs zQ-7ARExE1utflsdZvS+(7-klezn23brcM~zh{xSh1#AfE< z#O_SVwv->*dJxU^KK`qTC@VI7HxW&Ej^$|@Sjg`tg8qlc%#?l7@I{d(x(?j7anhYn zm?T7kpXycJQLwviQ{yezIRPs@*3`0R4XFV= z*j{E49HKJQgo`j>C!b#ptk{-^GLdaR4JMcZ*DETI>!&E^+X(w7_>&+>+^1J_1BEt0 zLCPo>ya@SMxIdHL+wL{dsn2VJiFtI_3xj9xkUD^}O82+q+rp41as74XoNObfD|9hV z?IW}HXO!I_*!Oeo_La3ERF8inYNEAX8A{z>3*c0Y`CQyX?wWR6W;HGS5BMQzTe$%7 z3t66Qv-%{TbQYCY&UMJto=^@9(euQbT|IG<-7o_K;QmQ5>f_;s=!+?j;$Mauz1%ei zQ@-|#A^2Mt)H$j;o%gz~?GbDk1r-IoXkRuW(Mt6R7yV8nPJ8}ABV_MI5U?rIYHQiW%JXpPIsb7Xf+qMOsvXuN zCj>Nh@<$kyE`p+PI6t?O^SD?9%g04GExVLoR3)`bvV*^LiDB374&`*?nat8xuF?X> zExm0Lmly`dBJh5HFBEhe zzr=1P%LH#so66xuk0Xjm!11~CcS@4vnMMay_1k4lib25kp!J|-FbVjuyc>Yq?J zf>*Ne0+-?J?)fe3$~~K(<4>66T9K8m-7pEG_kBd6w?PR}BD}2YyOEEN_pA2BX?O@G zH-eG+uUxqDgbYIp6hKx#k9~A5mKj)-fMafMO+D?Vw$@P;?R*yTq?3ev|l3I3BUZA-CKYvcyHS#5Lu^bXru@-<8h1 z#Ak%k)F3Wm0Y<(B1$K(B^7YZqEkUgNBOd?cc}So3=t;i?R z919m+TnI@z71E+cZ3SdHw#c?Pa{hH8bmd?F z+(@P2V3tx=4Ea%AxtY#(;P@&#SMlyB_{*^$7l!{TowTn%J=Vjg!ppr?KN`0i8^c+~ z6oYB@Q5V6l6~sRop372Llj#7-F zw;PcYdG~-nt4w2ouAVtu&9e*0O0F_OnWqaec{mlCA^a>=z+l8pfDBfpUE*3At2R|( zxS%;8u%)AB-L*Cp;TT>k z+|)A4c{*v6LUl|pm|xanEl6;2a6QCErj3HAr@F>%pPrq65@!89F~23KRNcjT%sMkq zi!NRaDvqGJO{;dR)XIL|P2|a1s<|b3a`Dusfwd}6d$LSlitLuZC`L8Fxpj)h8V5GD zl+xP4#IkzpEq4;I*Op8%7XxbmapnxQ%37;-TSGj+))H)EWkH6Hyyss0+Ky}1YxEl0 zAG!C_+v7y=`P=hQs2OXY1$dX*Rz?)R>MEz@C2CjM1SZwzpGP6(hr05cGnY^-Y1N$3 zjm~YE6BUo|{|Vtc1i!FDT(fa_7|3jJz++(4B8i(7#xQjOJXQhBQ^qXel?=m%5CMq6 z)DfeR$vO19Js4IEGzG2$jT6zot-`4Zo)n^cnY&sLqEKhv$MgG$vx)}QX?);m9HpAv zSRteA5Uo;54Tm5^y|wl_#=^(#Nf`~D1kvpakA(2F9I3@sHj5QG%CdLuyNk&IWT&$Zn!<7KMVe3Hcym14q!Z7D zY-FO=7aL@PS40Ucd(=&bM>!kLv2_T(R;=V8wSFCTcAmRx4If_heemB^JiV$;pH8-Y zP9-ufg0qqU#i1-LjL^4HgOqAnWCi|}7;D;~=y$MY zi@do%#^!KXRR=CHorrTv%HOF2NZ~g+p)?f1C$k75<)n@v3X#~q<(Kk)4Cc(U*>N=8Qa=XP-BH98M@NX=pvbsb((N)BSULcx4f*2Biw%J}k2Iou^Q zDQV{Y%9wd|@WU!K6k*Q~KO83%Kcp`c-)*>z$|E!^Kg=x#*Kq_c;4KNg{W9QxJHTQU zuc@g|8^wS>%zFTjam=&K@8hS@4o_l^c@6`;HP&ET9{o%%v2JU6hTjHgs#pp+h~O_R_%A)Ac)ctlI=r+)9rK;5G@Q;dgn^6{cc|9;x#_^sy7TGnAna_-IagUZHSc5&*x%-1nE7UQtt~ksQniNx$w>qW-ex^ zkA3SsIO#Zk=tg$`$tLj6FV%;5f9ZvopeHKIUk~l&h{guHx!t%vj(6)ouvJMD{=g1b zA+SGD_^zDlLwBi!VxUWnsHqj9d)8cQ8u2Xe)l5TGz86b?ZXn{UJKHcz)>DQ4dqNs% zuquLJX`m`1in^YeBd@AKcUx>0VShh#RB;ocl`;d(=6vMI1P9#9X>3kfvw^7lYJFN zB@hRK(+p3TVKgM{Memms6!Y%ui)Mt2keve}R&tgPJ9B0{8Q?l+GV;3=$nl1JJ_MEa z1j(g!DS~{%YMwy=LHOb^O$dJ!H?x%^yZnJuc$Iq0w_S$d@OTn!*G9{H;_D{|fjG)i z*E=%5fG0;VZ>zi}3-d81*qD_@L|jDW=*WyvGk#Sc|C7{G$~VQIt}z8Y;zN zSWFuFb17dl0ZFk7D6`=pUnLLSyY|I&aA1vDhRX99Z4EGyeq%(*f+U&iPDD+v4Wy81m1 zpHf~C6`9ya>pqXgX`0^GT&@C6u@xl%yC^Z#%%DQiF=xbBNU**a@uCi_I>KMcw8M@k zAZeMF>X8*ues12*_1=L^@LAzr*_I0e@#e9@cA9gR|Ci%yUJ9;xqlw0*D{jadpNd0d zA|;XYmsg0O*CZku?(SEFywpHndO7)3l2`2FVws`gd$GmEp9FhnT#sJTI7^(s#A7iv zq-an+IUyXG^xO1qdYNupM6*&tyO@=gs3^-cc%yd6d0=x`oB1lf$Qb;S{-j<={pqen zFo~0V`nc_M1vKTgqwXI0`Hubm)nk1QZ2Fhr4eiP@Zz7mxWl|ufIX72m4W-ocDl{-` z!&2Hulnt0Ybu`j?hDTdL`}zvVu044tz<&y0f5Q5-2yw4#k0*B~2G6f!_cAQNDx_iB z{{HC)DPmNh()*+WlKO8FGTuxnRv&uE`sy3en^s?>cKdBN6KyEcJM)+m&WDewW~t1X zK~sa>6HIoHo%SIKALF4~^IX+zD>Zq22X|CE11n6(5DB!%coY zt7Z8pKhIcvba5?wwT275>Z*MUVgti-r(VQ&XeC#DkW2SLkY*Rmfjt}g^hF3HH8_Vp z7}i}Vh(BM5@qn=L&yQIAJ^%@d28k$ z=py`M7A`!TY0zpAN4^aKl3Fiq2?ZW}PF1JK)X?5SQ)om>Bx*W>pZu%MV4m{**9H#k zP{=c+*Mf4z^^MHW<_zGKu%n}GF`%KtYj=akqhC>jM3zo(P|cUc;4(g?bLN2MNB;%BN~LU zPEDv_o0)TNF6U)&hC$cI3H+W%EYIr3d=NAVq_|KB87I3yHRZ2aG&dvJLtS3BKCY{tROy+CzG!a(DP~9d%Y9l8)$(25yM&17!IAWZtM3`Q$6km@Zpf|v67(aFGaD5A?8VmChisE^lc{rR`&naQFB_S%` zTi$$rK?H#Are5v_u05>x=jqz%j$w{A_G9#8@0-AXxcfieL{8Dx>EDwbteLJ}mOVWO zyKIzH+Z9WyWQ;WL^F#BRJC@u0>PiNS6fsl&^*}Wq=7m~3MD1 zK9?bBGfh?zM>EE$Rnqb^R!-$YICf@D6!s)c+WG8D+{|<%c48Ov=Wm33r!y{}wiRnI z*Y{_h^2CN7J3uQ5K!!mpfj5u^LEbjHn{*Zac$HOjrh_QF0#T%qWz#H5*>Q`sS&mZc zHqM^h$)$Q57w?-Zbp>F3w{{EP;%>Yhk|cd!fNY6>&*}{;q@O$BUR{>-)oXk96%Dth zJ&9mpjjfd3G{n0MHmg`OyS8%$H9xN@R;C)VcUuI`j&x@{32Z;KZY8g-Ats^nF|q-` zXXvAYA26g@E*EatSuXZ!zV~GiKpe7u`%pu9+9~A|Tnf_mxJjHEjnOD*Uv-lM4&X<> zCsS|}E;sq`lE3QN_$x&+aoD*_`ilj(13w441UQ@FypXWfBr*No6W$Cr-5WcD?NLF@ zh~0$_ZMfFwHuu0^tJL%uU^g#bFjK(tE-4Jh#ypN=u0J$XT^=_b=UH%6CPhhNePC!l>++`1^W{L2*N2~^xY0DABv3r-q1-tj;3(|aJ;l^3 zkO@FPWC1)ZOW}TWZ!}|!X)DJh<)vbb=_@0e%St($=e5`0eki7ay^8W^Jp)3VBNPCy zR!JEpYq-WT8T&aCgQ21L1nQ%1g}IPv?nH8Bt%BOm<|$MBSkknrpcBaP?Nscjl(lH$ zMx|(yq&aBfhAAK)6eU3daS1;`Mm&MWb{&#e{PaMRYZqw(rutKZ)xhO?N)!vf+)OA> zI;a#!nd*UIR;)sxmgz&I9s>=NV~kzU7fZ@p(H@|nOZ^BH4OyhT#(3gOk3JD?MZZA| z!Tk}Vq1gmcyiayFXfsE#;5n46>?%7uq5AJ^?aYKXLJF8bG-XLYItO?~*NM`w^Q_R; zZE`^6s+xiLKk-(Ef|00Bx*rI9A?L{8O#+k|3cOdTOAGj5ZXQx03!;meV0g>h)BsTS1MIpV10dA}3>SDL%QT5@*tAFqjfH!(aDD+RJL3XA@c;Hh*VbQ_wgdTg^Fwf3m$MKQ;ukB52Rs^ z^a)JUmla6TtmQhti7dr~7ne3I6pH+o-_Y(X2`R;lStvAiqj2d7fHbZD%(1cHZ-jmd z+P==EJlXM)fOS2*!ach(**w8QY@_VP*2e1b>XSRyO@R&&XEj@`I;?iGRd3M`QDyFN zj!B`W)1v{0&Y7a*BOL+q+cmEC(~J^5fqW#7y3%F^Q;3-FxGM+ zc)ac8eux(X3*o2Ec_);9JkfdANBP6_fWdC`qKy_H-;+9gS!H6W9$358+A zf=lu(cRJkn9O|c)(2Q_=3JvCv4dZJ12lUyim z1ZNJwHR)BG$Hy$vW&CDP>!o>n!}qbbVGu5ELCLl?F2VkHo;nllH@sgx5jsdWDZm=T zqmVzN8EP5)5dFp^0xi{rfWHps_%)biq>^-($uAbxpMGl#m19xlqg7>=>Vhj;lVFc0 zL3iM^9!7}$$T{gIv)|(bG?>#A3c``$2b^UIK$^)@qu1&Om7Wx~RENLW8Ao8leUBvH zRTT~d4jF4Q%tf*Jj0q*G0oMn#k37o7S!dyuC?_d)M7KsvplECoZjBRgy9J`OKhkjN zefWL9`fTLS1qaKPf7ih;q%1%6Yt(T%ELixl8>ev}?O#w$pQeyXq!+My6W`T`WUH~I~0^U;E~h9dX-6KgP(Oej@(h0}uEbAHb{{9yjXQ3@-U zX54uoma1M0iVQ%5Hf1qNl!H~2>+1^q5$inQz< z89x_|bq2k-82xB2_!RooEG2FKLE4t$bUKY2gtt8~ipaa`WsvmlFGH=lMoig4S{>(m+Ja!CP2yu1?{|JtISJVy+CpD`NSf%#S6wE< zV%qU3%Sm0vj1fG19aeA@iY^;i9sqEQ%p)G1Ou7jC2ZfRe{2!Qvl3A4-T%fWVe?Fv$ z#Mgbw@6t&dF;aQX{lyTxmBFPef*IAv4G&qjn#EFad6E;?JeRM0hXT7 zFSL^1h9rP|eDabsV}pTaw0w6#3C!Q@Sg35!CC}g1;FX&uoRl?}yIpc4ijgUJqw~Ae|&JM*@yhSzB;mn=qo-%!Tef5`F11lEH zFy``JVjyPToE#m;)<9j8dgO{a09*%&Yk~vbR-?0$$hoAZaJSyErV}&sdLA-SAzZOr z#ZW6tQyJv`A6-TKkvsTHp+~0m&`WLfhn}1$9%gq_~`?zL$To|$7_~vc7gB2*vQKGG#+bJc2 z#f84ZB}7@mux@+5h58Ex0CkY?+9?dj$vG_j_z0`2nco^irXs9*nXHAA2&_cMrNvoG zJ~mA+FMgG)PRL>SQ-Z^iNeRaCW3aYbHpUXi;J9zq^fMhU_vE;5jItLg4&U$bDaGj* z_foX>R|0zPR@Df7+o>&*glo;32O-n0B_cJ|%A4;AcGn`7V;B0UfK{htx(5zLQi)$V zdHEsDB`)@*9b21}o^DLF)TKtSni#sESrUU({V&>I^{2P2G_)n-gmcA#qu?IW8!aOz zmxp>7&M6X}!*3N!Ut4}P?|q;yk$r!wB{8J9T!YjEQ9<#Wyv&CAHyM}8X2F1pC%)=y z$u9Fb$}P%EFrzp3946>9Tscx3-H`<3ueIHHhAu4R9$XPaj1 z=|Yugh<8SlPI}GQpACm4BeKlq-|ClAoau7ZYdpjH!&mc{o=0@=!SJv4*eUg15C8AY zQ4aV&^5lEK{AYOlyFu=4Z=`=pj|+0V{4^pah+aAa>fR~Yi#m^l$(0W~K*k6OI+rjN zoj<#9Qz7FqH}E!7Sn50F&M?Rf%Aqo^>ZMIDOu!q1SiT+oS9>H_x=;RsZzO`}u_UIa zG79)aRt)HziEt*Ew3bRP`feI%Zx&2&EPn<~rwUp2UIlX{(IP{9BPcH=dMxALIN@@N zWH|2W7gG5xY;=V7HJFGAss}|Z$xH9M?^(w9NrA$7d`b|7r4eXzwIq+RL^N>{epu)g<@ViKGBfFqcQWFLeP`N zC)N0z7VxwordCqHh{=glyWl%9Px$htNHCq2V^a*TA|uAeG+)H6xLZv^qCI$N_5$)1 zA2xr?XTu4Ou}NLw+7vId?B|B-^^Te7L-u*$svQj8;f?NEfo+MG>)x{zE9;cqXl2g@ z3tGEJ(KZ2ngvMddGi(%^fZi`pZ6`k1R1>zXorXt<^vy!GmWyuQ8(Zat zEbM|8fjrcS37N^&=p%~aA(u^vuL>ogXtJ*AyQuJB6QUT_LZ2t#d9JAu-KEYtC|bdj zW{^Y~V4|taxGw1cQ!?N0mT^3&B2ue`y3qMR=tFR3_?uXT@q(#2d3aCcT4`KHvb90I zviQ{DT{+vzQFfR!Ajy3WADei-09CaKM#dj6CbGat@hmPEBznZIO7K58n$bD1Xs$7Y) z_H3-rS?i6Yz73v&o7f{l!5`Kmk^TUTSQKV|PnU2VkARqc`?CJ^y_D-u^#yWi^6Q|v zm%7>Zn3;jbf@_N$j8)=hE<0Msh+RL&E~8%Jf9jS>*t-d9vkfcF{+J#hQ~OOp8LI^% z&gl_)lE!b*iZH&DVZFOxUUhDjbGsZIJ#s8m!%a%w`f?ZiZ?9iFoM(GiVt23X? z2yMe|`d!}r;`d-^Ha3hGOA=3xYED1MP1PWw1wUm_RGlLwGc}SwrrGhLzoO@|cns$f zAgyPT&}SfpJl`>(J7FMiUI|PXyybOfP8y8Ar^tfN*M4Y6S;(s}+UOClAN~@@slvr` z+sI?$vU$d62u!7EBZD&imFvLv`to;zi@YPaWyLREi@Lnh17}k={J<8OW(u}$R~r|l60-EQCQ!p0 z61NdT&c&wG5Sy>ANOoO_L$R3!k=GIAMIjco$S8ZJujxY8BpcQ!SHiVsR(#qf&7;^0 zFQo*aQ`9oj%(jNfD#>r@X~6X}{dT@?R9?G?mKas@$yGj!!=gR{hwg9yp@Z&teE~NB zKe@j=cU*i{SoD1 z?j@7s7voCAq9)9mx}YXB#fHD>g|IVktr`we19TmD0JL-1>!IG$hf`wd@;q5( ztZ8+uG82u_KS}b+P7xXu*{%7Et0#$>j}a@0n2(VZAV!{>7D5%~Kij-wcwf>XFSy}f zDYJUL6BzY5S9ESMFG&WnMk&ix`clEejU9KGUZJ$dl0HA;W^`OV$&5VMX|l%^LYZ|{_&NQ~5zrdDV=r>lc(v47os<2Lva#8uhEtd9d4u5As;or?arpFv zlGg-`ilA6^{bb&4gGENLkaEJB z*cn!QaF~ht2I3`%<~$CkiWtFvrF{ekKac(Uh6Vl!!SI!G#`yJiP7PBqsN0!3y`g}N zQHq^9y}bZ0HZ%5cN)oU>kx)`a+aEUxjZP~pnMOMj*@7*Qo1yQI zyxCCLM|uYaRv(3{V=Ex?ZHO(r{st7^OR)yD3kn9G1li1oMCf zr8%yV;rweC=+KP6b7Wb|!*cQp*KwaAr<^~&1UgKiL@x#{&(SeFNi|dzV+?*YPv?gAhX|X-He_e=9yLjcz(#yrzlF+F;NG3~1v%g4xlB56b#H_XnWt%HL%TGO)|MBp_uQ`S4rQAtf!`&@rHSQ>{noRQ zuwSNc*J-888iT7aC~a8sK@#vlt1l?c-HP(HxH1WxEAo1D4bdjYIM|@EUSrXR$7s*G zjP6_;D<7r9d*Y;AC`b`g(3@!YcQ?A~yOU?RK2dU-Yc^)n@R=)NY4I&fyGQ2_dxtul z8Cf~vl--NI+DtBR1Cpn7u+^T}D2~v|v1!8^b6cP!_RzStqY|{{Yw(RQCIO(VI&wBr z=jiE*r0Zp$TNn`Vub!S1!8l^6uiabuO$0}?4qD4vMEO;5uyM@&;5fC@yK+}x6Be|; z(`2|TeP0+nxSnArLx+L-X>;nw^*h_|EJ9Xrd`fpcb<0a#5*Uk{d1^KM`ZcERAS?&m z*0^g0gZ_Rg_S%yo?bvk!>udfmzKi!^dNfiKqo-0E6AA;g9~y?j3eW^#rCd-l-y12}RSxX1Ak z>5+l3!zCt8Chw~45DYms2tx@hz>S%;lCxtvphlE50SA?YIP#;43IhlH4byKhQB>M+TyQ~S%n5SQ#_Sk?^{PyEqD`gUTJ_KZepSH00jL0?e zh6MAWDOvAtRF1$lx6t~%QDFa;nG3i6s)t$P$F~jk9dRFQ9d8nHfHe;WsXf9b1hy_X{4i&EO}yya zUPm)PeBlX847o*c%i6KKtu{ilmAqIdK4eQdm9%>FJ@ z+9*b6Fa)Y8#@<9r_I>6hDSOwKL^Gx-h80kl#=AKf@#lt#^JC(Mxia)+GA*ze0vXQLoaRk}90T9nsDd(lD@EAp04-7Y> zjXgqq*Rl3gp?LIc+3%B3t-h9!Wu-%#M~+f_lkPxCj9ks7lJ@7o>WoahywL8{I<853 z8ENacMyp>3XKQ_c&4Y>u9yJ>inermJTnZuPdWtR2KRRo(poF4OI}c_|wIEif^7Rd$ zN0kORM2UyJehgjUd=jp#Vdo5BW>R=l;iG8#E1fkM& z`t7JTlbo|vlDgI2!f!j#jb^8QRE4_n2DPC~n7ZCNHVe|I@IjNsAtwv+L*b(^lY4bm zes00jjT(jb3%Ay@dnsP~YF@t(%|VUHmEV|u17BH*!4Wv^#(vOT`c^yH0^s`&8JVOR zRH3z{v}RSeSsAuB%sk_MHIo^~ZC9a`hf?}XFzCiwxv9Haubh~wsHtS}mMJ5qLEpxA zxuh)Z%(hY;vP9h{zUej$esgmkmrznk>p9GhiqCB{C3Jw*k*Su_Sou;dW>?fB8&iDG zQSz+nraPmOE9^JO5fEtk1hAFxYULHdf?bdGU+aAN;BizsA4&1x zSwp^3WfX$;!sFP)Wt#D4W4pdz^pkVV&+RxHt_-C%=fw8Jy`MV|bDC{1!G3XETp@mO z_hcmh6psH@m<0Y0A{plM{?hmF!w9zd*Ta8cNaVe3x8yJ%O0{C}Yu}jA4;6$ocGBqY zb1UJ%%4qXRWlF1#bdzq&V&017)gkk5bYhLbtcog1AM3UJxxSI%YYmce*T)#)bJt%m z_j2?Fvfb8){VGZY1qgLxnpT5sXhz-DV`?FLJL`L7v#lFbz_=9AnqGcEo(tBB;=OWf zsq;700H<)1uKEwG*RpFHvebr46zt{_0|;#3TP z8rs`avl%5rRyCQh4XcRqX>-VwYs~YOZ8?H5^8{}XQ}z<^&|8SobJNTCH<8lT{w{~^ zNIM27(hpH0$Rm4G2r>@*wZArR9JA6sGwkUnIkVvV4koYu29v)RHQ)Y#Nr2>UFuDI1 zn5;#51)`fz5fz4!A@gsWPk}l&Ql#hgnQ%uEg;xQ^M+-mw0%PjMyHu=S?_%-~m}LF( zuVAw7FEDxGVQI=IRy80+{SPoXWYZ{$_LEGhJkRiqhJ6%>T^i3alAG~~N0NQY9ha$midHM_ZG}^MD6VQ~%o56PnC2cdc#<1Yb?c#oZ6; z%5v`}H7lBT@k(nezTL>U`Z!82)y>|G);}!yd`jBwSj*O3j1F9Vgc)hPj^4n%HD%&4 zqgvR!-bUO6Vp5y)eue8F#<}hU$8=1dDR(WjeV>z;r6%!Zq&QGOQGCqe*!y~NX+4ur z@=U)8EhI|b!0#iI4r5!?vY)ow%3Ro5`G$FtV0L6v5eOrE*YohqapG>`pC!Nd{Rc1RC3Z0{58gFm)ez@Tvqqe@0tiXbD|N3P!_Q%W5X%?e zk@f?RwVw{(3oA|5x{AR;z17nLr#&Wpvj`(ix3f}6%4+l>MFnF5B}Az43%;Ugx8za? zBwKZ(enBBzdOXWMLy)ABpME?SlI@evb&|&}2 zU=ny2lb>1tYca`z`Ingd&%oqJ=zj$!D?KrwgF5~rFxd|8h4cXY0~qpO3}0hx6|1L- zN}t^3JKV&GYg}sQq6NSE$+k0OyH}!~BV|3BF$8E#xw#T3V!!<8S5&yQkm#9E)Zot8 zwFaFWGzkw;BT7qb_Hs^fQSLrHC97aX-$w6k*Wvl!Vf95wKWSn7NW$OlPq+!Ct_?vm zr$BFZsXYLQ69S(_UdS-}J^fo}k)u63G5+opL#Y|n%^FG19_GoiZ+Lk3p8nk{k_x&U zP;w?&tj`qIR>5&Q-4xjksWcMdfmkFDzu4nX1=2PK`R2uSM8_Ei2}#>KS<_YA^duA@ zL+1FchrT2k#LB&qXc_yZmHV+QKzfeeG!HF41^xn@4TPDSWro`=E2ECV_lrypEfrfC zdS#`7YL4<|<;goT&KBoJfJp#h)J;=lHz<~z43Ul-dgoTsQfLuJRgKMDDz#~b8@}S=+hU_aVQ{!?3Wx4s0}rPO9`BeM@fI2HIE!t874MiE@pg@E;qBg_qS(OOUTnN+ z{0DH(WUNdzoBG`Oy9kz1)>qNlIgZ=y00%yUAe}e*L-04<@4RdkE`5nY;U4dGMI0sC z)_f89Q*sBx4aeUhj(%-+65 zc4d@Ygtze~WTqH`MUs+P>oyCHVrNk9DSdrVG@faEO$)X;NAj3VYR#KCg3nUTT zfE(oY3?K%D`_=MMLee`WlT>yZD zw2|X&%l>v3wXvrkj?(r-vIzzz2lhtKlHw?L`7<@{`AKr-g+j>=V3ewBH&3;a<9*R! zl~kS<28x}=6^qljv02?J+e(**Y7sj0X;f{kfK6>J_qqG{(s;V~H8Ndu6}TyhEamH; zF&~{|u*Ua2)0jgT26Z18;>7vqAfm6GB7p<8p!8qomIdVDoR$1Ti5pb z)L!X#N;B<1WMh!j=q;ZKZrbMbLwuzC!F_yWO<2I=7qG_K)rB3A(sl;!3<21C2=|>Y zz@6uve7@RL0d?2`Exa1*-?7rIvB)Rr(~1kh=2a&TaoPWTiTd})BYADv31W%p>z5Y_?KrH(){n9W#IqlSxU7Ki4dQzs0lsbIlU?TRh7@*DQg*#k2f#%@X)q zJj*}VEP=npv;1?-68Kv@%RkpFfxpGG{Bz9`_**>7Ki4dQzs0lsbIlU?TRh7@*DQg* z#k2f#%@X)qJj*}VEP=npv;1?-68Kv@%RkpFfxpGG{Bz9`_**>7|E5_sew-H<)aR0? z&{66rSaktsZTJ1F2+qfFEM5ulR*s8xv|D{sb5^;x3utWmZ%y#G?ahB_f*+c;3z1q{ z3q2|wd|47fctL5fJ}Cn-&E{hSqW&^3iJkv4FSVcm3Eex$qMd*Cz*~{udf=A*T*#Ea z-cGQp|3?p87H)0Z0r<L%ArFXqW;zcpRW3= z2R?MNH^D?B9n~=AeVi>YzO6q+VwaKNGvN;p-fCg@+<34x}|HOig&x&sC;C=~t z(IFwLtEAV@a3k63*ekKIe@A6#4Xg_u6&9c)cO}L+Q+}m_g}bK0d-@kj74`I;#%6zA`9j&O<5xPsW124k8>TAz*j?y6sH; zd#AESt=;B~@4F5fxt@czPhAs;11y&lGRSj_m7v5~5KIA!i`I--4`2SwiMjFP4f~30Pi)yOx zeYyBa1`M%)O|s_VFm%jPY@iF&KN1nQD*s}Kpm#T1^8ffA1fdQ61mU}0Oo=CjoFHWW zd!nfTH&cRYqPK0+Da>B*wk(m%>8#&U=kI;f6Txl2cOia3Bomiz4fSHpn#e zL}ni~Sp!~_y6v`|IiX|Z^3Qq{b1SRs+^nh~is2+Q_`ms!7-(IINY!SNDlC5psD7N! zuzo}>KUfds5B8k8vvFX%2G6`Vb^mrTQz}cG@A{zn}xpL?tZypnDC5&a~+jLvs0Ym}2WgQ|53(cQTX&9*KWeK4&tn7#A@>8%w`mcik5%vF4}9FO;`sbr5d}}u{rcYG->2s68>c4X z%+1j%(nIPCO;Y}!NuShs5D+~1yEknC(jt0XFpAm^YoDj}2X#1|a zuIY)F$Qn0eHuh@%&N|zI_$`RD3d>D>kzV3Y@_Yf!RJGOOeUIqWRqhpmB*GwIx3%oU zm53y2G-N`WzoSQ9J&{cqHBCw#>6p%88pO)4*%OySx_W!{qHR+(3;2X z$R{X-Tlx3LI0(0CkWY5+j{#4{c@@TvrkuSMbA``IHB@nyvacJ~GXaU@T}92!Luswf zVS#dpDFB0g%M%EK30vQ7=1?`)Q&PDgikOW_iB+ity^kT2nSfE;R{%8%l<+nlozJp^wGA*` z4cTU=`^jDW(=#`}`HA{K6oY|O@w?Ub%mCvf%7W{G3a$KWCsus3g2It$)j8p59(u*uU@2wuc%Z_9f^5M z>#VZuh3Vd9IC;eu*&Qm)dqp#2X`z4B!EH^oAU7D|OE}ms=;-*YJcm`KFo*4;D_E%^ z4ss``9_I(qn#n@Vo!iHfL=%74!6iumLMu=SckY1>=M)h+y?Zug)c!rNXLqiv-*xcm zF^9*uIynEh2i4)afcQ#Jp4k&YZJ6xEfv40!q4V3a*!NZk2hsVDI=Fsf+IS|o=Og&H zzC1grNA}gTP#KG)(ABEV1TbNTKy(w86UH8^e= zS;ZKjl8rUOoB|Vin|}Hj^qX@O(aFu(%kwuFpa+kzo5zo^Sci|Wr-#iqY`G6!6~_G~ zYMEs_jy0H%Wn&d)dYnL|)$3DpHv>itr*^Yz@?y+MRJ3Y_kDy>ETl;uZER%9Bn~5<< zUI-5L%r)+Z?<6j_8uaz&HcPwHVQG;s8q|BD`sQj4uhmUZjbg@xdU89rEI7F?4=#Cn zJhyu_k8a?H_vF(zU38aJyUmb9axoUHJ1?;=s6m>Fb}hN8#ZmyFeHC!cciLc zT~_%m;d5e|I(Nrn9ieuHM{5eiyUCZWr3P81iycvGuVV*H(ZXd}*{2pnjo*ekam$=) z{C-z#qhMKdNylrG0#S3=LwKeg5-gWd4h{lolmoFN1Yh_{T;{s8pYA7y*wqViOyUP^ zWJZ)~pxM1sg6)@6 zDLO+D4FV|ZA!HP6f$732#0!H#c_v(GCHof^(_q$y_^6jVn2`iCavxF2mjr4=bSYIf zC#-o+^XW~)nQH0{zuGNPhE>1Mp%imV%L%WW`9O1Y9o)u-8jyb}-SBpq`?sb$(~$u> zF>QWF#U+eh2D!Wlx=?2|*?G^`C+wqzXW@QW_6{Jr+V7;&q-?WxZAe9OM*1KKQX-Z; z8w=+p`Uo4BZES;j@?xZ!+qm-VEp5yOe>8kAD&58}G| zaM=|CH>4Fc=wPKrl>)UVMy7Wnf!`s!S@QXc+@{JWa4wDKR-R*#aPFgg|CgnpxZpn8 zn;4(^Q)F?MvvA24&?=J0bmmVr{R3bcECB!6uz{;xCL=(v2DTnziB(^~Ge| zR?0MX{)hj%|Lr^(O+)khicKkcORmyua}SL^kxVk`i`w=VnOhPk0lt8P?*lrjXrCiW z?1Yh_sPz2CmC2%I^3XyoR(?EaUN%Nkl~Wjz+5U)8P^GEZ<_BT;5EidfJiu_T2$|vT zYrR_SGBAg)4Y>WD?%e85x9J;W;a}!pSu!!Q#I>#*xAoS)Fclz}^?B)Yy9XRlQqBp{ z!dT*~46cfw=lTbZpyq?v&I3c5))0H%`e_;-3PTglx`|LD0r!Mj9jw`C{f~l1c40qEEA<`2H_eXdwhO?!uuM7&VjtyW`KlP8Tw6-e!*z3-! zQ^uJfLj1@a%;^@u%dlbb1NCU{`{dLFOXuPQPVejlPQawR^RHwK9(E235pI=DjgM{aqB z);<2~vwK2E(dt9(WCKq6&rKSbwWKPc44adZt9Z+GXlob&b5Q8*gK{#P$=xi0=CBj! z8C1L;oQpj}1miF;$Airfrq3_d+cLg0wc=WW{o-Of^Xws1tfOPvEnS=?9QmQZqX3nz z*Dz_9(lP;>0J*o!bJ9K2h4Ie;ENV~vv?>Dkp&jt6z7BYOyyV&I!3C@wv`?fyriu_u z=P^oF8KVYhi*OqW0W;cIFnP?4q^|A6rIOb*VlC~+)_QMObtm`>>UWm#GdPwpzhGC4 z`cKWS=pZcC@4wt|x+>wB;cICCHo^oS-sRb(u5GD45N*N7KI=y+@1601So9nDeRki4 z;*v`~w)8~Sef#3US2-3%SAxT|H~`3}^k!ENW1!$>3mRc+7_>Rd#bc<9mVP``P;_q8 z#43BC=?MH#=RF0v5ppK`Y1;}n6Mi7|A;ko`4nr?pwcK`4BU%*h)`3zKAOtnFNE}39 zXj&@f)F|lEv~@x@{WcMZormSA^Mcv-a1EDiHkD=U^y06u0ZRyk4p0p&#=Z=-4!%6vxuu~@AGYzcS>4JL2=VH+8E{$RV>UQO@Fv+71DZI(MKmK@HEYsx-s9k)nX zt7w*sHU#EgCw=F^r4{9C;(c|{?8LF-2} z#)?TZbl5w;DlQ@|c0#{B04atEFZKmh$!(NvXsLAv@8I5y%131OU(;BVpd8y!>&(_@ zk}h0FI$h_fGg#UxLlq&YZv8pt`;sE#mVC;*YT7*FocNM*Ja5vm3tzlHH5|{WZUR-w z;SjjLO=BbLQwBhEt!D1k1U_BGzOQLD5GP~dFtZ(9N&3#@w1tH6Ao7viGgJB=y_C5t zXwPm76CcV4!v!X+jE2(~`-*ATcyu5sl8Mlm{}%s}iMQudQki7<6c<4WSfGMw_o+5- zk92AQZB5-Tg4k0`i+J)!7Np?kM){F9_04>sDdxUlTM59oFixrcRAyp+j@yhT2-0jP z2vX1lr%r56iL=yQPu*|CYICLm9l8CPm@)`!kFq96{gs}p_7kIT-3(TQW-dA0F-+w^ z?ct84w3H(LH3661Ct8;R)kJA3yH*8*v+z(h`jMcfGGFVElp@}}bZMTGm{9?86OTms6o$i#>J0FIpsFRKV4W{k1WK3$T#wQ<1z{wq~mwm>tKaJ-bBQie{T?`8($ zD>*L-XS{LG{7$+Sc~q^n^ur}9468Vj@oR0Q+`Id^DkJf3r3Z&(Np8Vk9Z%;>$DyqPV4wtG8vRu(sE znTRnqWkgjXDE}-|=T#j{q9g=Lwm9WogmazbI}Bkvj3b$R7DzZ1-1d318Rg={(L) zZu`O&WP{J$!)Dw|O9jmnL1X;2oBKh=;U+DEv-cw|h4#baToMv)=W!98R|%#|?vY&M z9fcxry&9g=Ocv(t&&6_>M>f6d9m7TI#Ld(3NEU6{sqJKT0oOP2d!4A}M z_#tAs#rOaWg!<%oy;{k4r3SXy`slwK}hOIV_cnLw#cfB0q1u(9#fz{c(fNL8zVSaFSm|z zYGhWJuw@hHbS=dIUoY=RSg+Skb_Bj_yPPT&1|`RD4fnlU;fV%`YE0zHsB6mtt-uKJ zk%U8yzA6(3$JdAefw{931*ZyipvQE7@I5h&Ahu;dM48WV>(pHi1&gp@aQgJgL(@QV zc|_Q+u5AM~ZV0cw&EV~|%B<)K6W77u*S3xB_$|ZPLQhC}wn)%F)=}n{?*bL3ent4= z5BX>_zIE@8@R^g(82T#%Pc>t8(p_Yk-P|DFbAGESqiWON$d^r>r(j;edG`~AOPl7V z*g_VhHS_X^%#&)-=sQ z77L>^C;XL|@n%-q_zhYsDv`ioOaXmKyMNNS@{-+ASi9q>ll)48L^BS_UBV$uCnF_=->;V`)VRoOhZn z3o3QY5fo|WRi$Sv9b6$&cilN0YClP zGZ=Mv?W&4?eO&Q(=m&@F0VSsMOK(z6bQ917)Ocu=&{0rS)H4J$ccIlGQrL~ie#*UX zngux-(6|L(WI)e~9>d_Ug44t3s<3YGcZn`*z|(QGrvRQ}b>ecwLrWjuT&`;kl*#K& z(j|&p^WtXloH(0?JL3mSAC;VO3QJ~$_b;-%iQXHO=TANf3%a|o0xEA-q-KLzXL%F}{! z=m)X2Tc+gn@p^}b1kJZpQI`u3Fm?^pL_AIxXvX{KQ~w85nnt2~ zAUAD9Ye`=?>9wVB<*8mii2j~V9%`>XI}`@6jNdQdFhkm7|5&bWYrc45u7?RlD}P|X z(c>^FN{5*2H|qTyF|ES=zXME>DvOXBG!AUrVj;UD#IF(~#PP0MFDAE>+R8bUn`DE( z*%InPFTp>Gc%f+Ux*1PS_4=Om00cS$R-gQi%Uwa09cW^mI^DoOWGa9K%$6M(T&T2- z38N-)ZIO&htJHTMKQbMSQ!UjAr<@RHzE;tJ_*JQR4>k0etE1etTR$}QeHsy`mum65 z?+cl!HjN%HIY^lR2#xVm^#?V&b~%{Us$Sy5*gWTWlBq-7sY2m99HAfeRJtL8@RDL^ zQj!e309q_t;rDCt$0#5N&M2JKD)Hr05|;85b2SROoi-lONyM!Js4qF3wlKsIA=T9-La z;Pf<}L@b$BGz=Bm{AfJue#PBm3Q^6ZjrKJ$@CKQO;2`|p7}puOkGWLXjpFIHi;k>5 z%-j@a^r|Kp9s0>U%o|WBAr7Ag!(IghnM-*H{(R{|aT-lY1um1RGmHO+<&cC&d3HBT zZR4?p!vl^fNp7%OV~yHOiqX83ig~?+f!zks1yy_qwya;5kuA3S8I7tiai`&HG03i$ zpxPXqWjo1M02k@v&v&nQn&dbyx=Ns2Z|Rlt^^j2^+HPv3A|iy5=zEa5$#6Ky09mr` zS}iuAKfX9S)Wli)~Q%LDo2YbkKF?i#xN&`(VE1$)?j2zs=~V<}zRLEtp@r6IA-}MNdg=F>>_f`Wz+5 zV^o#RcdzJ?9NgjlT|(BCie%pAY)CKb=|St4E~g%QJ`@^<)P#T%EeD7%U$>>9jq@!Q zD4ufA=Xe!f%f8vM8JJ`8)Gj3VjRUlCZ0uO%!}j^uqg^1NT&MwZ@x6&vRC!lN z3ftGrRRLQkl!j}ni5b=O^<|N!fX~uXfo+0yMhr`HOQ8t;o`=UL1Hjh{tW>MDxkYev zXu!pq6Y%Q6xg8i^g31ZEbT$NJ{XITOx1uR9u3~?UI|){5JJlY-uepAHYC6*FAVDz3 zWqPh~v@g@g&$Eyxy(`;D`T3L4HV2U>BOU6P*I*BX2Z?~_y>S<)*_|nEjYhV|XD90) za-U(qvIq~ z4_;xew%;_p)}|r7{9RG*<@B zY;Sp>E1f&Qhu8xWtcmhjE!DmU?%i~Q?Ab+$XOu(GP+;Cb@zq_1534bg5HH`AKi-E} zS2q5y6#yw#z8v(1D0<8_#y_|=ea2Z&C3TG)db7q}tCUo^0Ze|cCF7lRa6A7jN7oGt z8J-hT5mF8fiW|bhf}V^z>=da;R{8m1*`XTiQZjRG2;IU!HnJCVT)r;xgO`21vO|@O zf9(qU_qaVpHLX4MV>goyk|+Gdvq5k1TY$&W6JcP!3M?A`>#?8-6fqAnVJev7vj0-) zE~P)xn%T63>knE1w{^btD5Q#9Ab@3u#c@&$A zi(QC6qNRExA4qw1suX8wXD`SDTug4?zML6NQns=ySW6 zdqW?hDZpo~UaLFi%C9Y6|Z%WMI%^zn_cW3xojEe51y$iz&_^4yP^5u)o=0_Rj9u239 z&3npL{PkuYX}=$u9i@~X4VdfFSlPQM98>lK$`s=$=__4YR}L)@T}X`+rlCD2@=|Df z5QHMN*~3B9xFyy_HQB>l7+i(K%Z=9SHC`jPbiap~V{KE>6r{iji)UJ&n?6?TEZr{k z`Ra$EU5eC9Yww!3VbAT8_fL*b!8XdpOxyz^E?LMWG7Daz9G`x?>E0|84;3_|;Y*$8_A|$4yfpsF}_v(7wRI;ILq@LtBn1C+S5#e3BYK6Jk1siXfJ@8d?8Ai-tfRl@Jqe z{2P{EbR*4YdjhCFx=fOHwPsfXGfaAg*Yr%Oz<<)RAuFmyNlP+DR!T!tbc_C{<2}Yb zo+N+XGb2Q&)>tlZ502z*mwj4Qi1A`~<-GRbW2>QVZVSJWkJ=|zcqrJE{`L{kRCn-^ zLY!j#aYp{cp~n-XSqAHKg_E&VG8>EJVOIy_0ecVRVOubTj=(XF>WA03;i>4GY$$v~ zU-R^yv`8MPFBzW^op`VD{Nz3>pXMAm!8-4eY}s|Q_$hO-d+MGpyJgk2L(J#xk!1*_*KyC#r+OI1-C|y^$0Z%QWq1!_sahC2 z>?Q5csHE&&#shAM8*d-axeQRxyD!yrw|p(*i!S38POj;-M`^ly&mky)QSS#0JioqE zLsz6)kNfEF!S!5CJj(nn@R0R`czzihbpFV08*cGqZV6Ocmsq0K!8Q29u9VB!*1@l{ z#|kQU)o*X3Lk?DzLWSZwp8i1oO-YK5950%oth}wUDS%k5M6h!9FOp8;`zJ}G2U)xo z=OK_+ncAR5GWb1CAu)70?lX?p4+K^MRaYqv+UGB~j`ZX8VZPG`fMw~wm-=O%C4?q| z)Co>O`rj~`)9WY{H#-G!^9Gv=W3x(C2Xr_i$M*^p{lbv4IoA^za3?W{hocdi=~iYq)HM)a*4lR&(Csp-d@Ebe@5 zO#l({<4b_}sJRRfz@9BWw18vN6uYO(ZT23U#<9C|p}a^SPHlQu0?!$AI6sgnO+m6& z{LzgDcYCEAex_D?3?*XK5~9nk)S<`iM6E#QR4u(_rr6MIr^%7&-JP7tyX`kTrm$fs z^0E3zY%uL7y3KopA_SFSEZE)l9z|%_C@nNl&)dKwIrl5D94gXVzmIP}fBVzNczFcx z{gNK0#`JAX6p;->6Syg}xD7)RkpnkcV`3DvjqrdqgVXnoTfgPgTGV;^ZgF?dyn)}# z-K4m?($#j3e5lek!49hsdbBEqGt8lszR!)8+-}|M=X*tJ-l18|c~YkVAj>zGawKK? z38G!L6lmp--W(s)j~rZtQOZo2Q^^`ACz&Ufg;Vr3;kX+k{TRPRnD@riUK1&CZ(2&B z7e#Sz_G#!CTjbUZ*4s`l$1Ed4>X-c0z1f^ou_d+Ou?F^866Q8Gv@PczwdHFig~ute~O zSefXGBv>PN)(iGX2GLU>C~M94pJp~)rNj&IW3K<3jC7lQ);#ctIP0KCvQGZklk{JZ zcIJgge#WFqst_o-_}M_Pk#-Yejbf#7%QaSkFP|HsRb6BB%cLl1oH?am*unA||iK5kWBs~=HHmMI_$qO zt(}Ti+o{?V;&-u3Km**i9p1`wmi1%kmuE~ggi1F zHTn;>y&hbVi~ZPCdT7#*WA1qjj|0XTc5t$ww|eiDycEzEGWVSLJ2#z?`(zI78ZFgw;mz#vJ28zr zN8SE<)*IvhnPEgo0>yd;ioxZdfhjWHjVk!}i7Ee*>34-8u25$RkxZ)hEXxrd#nOxK zpXkHa>^+dR1KX(Q8NO+{$xRhtOj~0;0N24bFv$N;k?FrBrkXk@M8R2SAIWqKB)sXr z=Y+t_4LEL+=WXf^5uilLVfms-t1i9|-*$F0qJx|L_tX^lx7gJ7Q$78;J*fPuuNH+v z1a(*H>dKmcsiE8yI ztp0^+{~T(8|0~t5E;aohsn!zvFRCpp*Z%KR`@cf%+Z8VT50*_qG((2lWrr2I7)V|T zJ`f2rz*AdZSPfzF)4?VQ{9RJ1CFq3WjV$!fa}Zjgz2X>&p3=Vp)h}0mdqJD-#A-j; z>0ngrf5KiO4<#b^OZ}*lzx_y6_9g3C6J!0Xd;E=Nt64(RHIGLhTexc-B{o!D8t23V zYC*5T0X;;xDdjK=e@%z=#0UaIZrE=wqk4d!7F5kb153$xU$<$<^t%edK#0x@B4w`Q z${2c)4HWN=aXeZa1MHa*+r+oyPXb`^{UMqQS~XKengyx2=bMObs{e_z6fOLVzX^9w zs$?_~ff^MxhPKFqUk&^G=p_#lB|KlMC{^NLE|lGEl0+t;lqN=PhW9@bT}{I>Xr1l zYMpfBG)*Q51!@sdNats{8*uGsh;!y0x z+tpD10edco#AN2Y=y_?&8a6!puzb}3Z#H%M<4Yzw8=vWPh6-)wf6(qfu$M45J=I8U z-OUJeUW7qbz3V?{_aE51p7@3LeN1f7z@?>J*3=pu5K8^kmyfExp%2Hp#s;h@|K+4S z6kKWEgY-6^T`ktdKdeMoADX?A_PgYWq2YeZ;T7=!^^eHSVP0(Av9Z~AglG>(4%mpC zqu)AfmjXu2-bFRoxJRn*_=mB`(3A4XrFYzc=i!9H{5(h|+=foBE4_FNWWQ6o*n(2z zMCDaV0Mfr$LT*b=^9rtVmaf@_pc4asXptqOGJNJ4LhpEV|U?ecDdLP(E*D z%`|t1(SH#yPtAJtmKA4v&|km{{3hN--}?o;uS*0odTio2p69nU^wMp>^KM1ndpY%- z7X^Jit3Y916`GKUcE!-2(W`w-pLQ~Q%f&Ba(h2kyGHXYGFtz<)k^SqQVMf^<9ZW~e9CQC3{1 zk1SWMu3HmbUiJv3kB4-sQJ*WLgE9S_UKCg+HP{MzY~!C|#`Z)&N?x zmU1-4q3<75RHlPm{v+~z5d?=-09|HZJRMhZJ}*T>Te{@l)>!~vA>NtmlC;52S9r_dC_a**#b%_oDBEaDF~|UDvJuHBJl{Sn(u zPYEa54R(JGChOEB)1H)`a$DvgWef#f?@nObn;`XdOa4)~Qne z8U?osrM_JbllEoY&Ghnj6wLiGROIynrw^#|*A(*l+Qs_{={wnU`B>0U_iX|ZyWiTl zHhheoeR%=Nz*w4RvDpR5TO{Ny#bCvOWz5iGMRW%x6VYyx=+sy-758<;ffZ8b&Vc@A zC}5BNc5cdRhFS9OggCAY50_2T;Oxwux0HZfhN{G$9cC9HJU`-sJKrs2@wuh`6Trbb z>Eg= zyb~OTc=B(#?nDvnMWISWL>Uqvun!H#dxW>^xxzJg)%*6(viFdkyHg#pWHXJUcuaQt zepW<>HD3|&8%f#iN1pmB}>8psr*$Y`fC_@?gxw$ZAnNne7gwDY9$Ewaq7z5aeskBI$*|uXJ*^8U#pu?29CjQt^e}^lXAJ)-vcw&OL?(S$*;;kdFPtt` zD8TVc>^09&=M&_{`*8SQV3XURKo5AQogAeO4-UcO<7OhjTVmEb+gR;AcRS_rSzX-q zn?Vz7p}~U+K~sqXF~5BMcR`^`LO8~JBy$o%X8aDCV3PQVqIqu z!!MHBr}5^MEOc2Wku^o$?v{tBBAvo)8`*~!j;mkXvy|i}sjfC3F^t5J0Z}JN1P)~F z!YoEo%OZ2fP@91AiOFzZP*bcQk@;X=4+YUblFhF-*LZ2nT=#Iivjmi>zu>#i@h;_h z9mjo=E-3t<>5J&^(g^dSxCFXKnPd;T)5%ysQ+(iMvZUQdG^hRLQ@3^?bicL@QC(vS zKL1{MD_(2-X8tie+Tg)Z9{~1Qej8-*l&shMJC>3!ZZtTjl_08n$c03fThLYnq`-Ta zzO*jvk`uPq2oD&=jV!?3zP3yS|o)mgpLexMrLl~ z&I}%JFZ1!M2h5G@D%{vA7|h;B6G{1m>%W%v>llJj-gpAl)qQ}PiHi;ycW?=#*-s|F zveT9p%W&b4<=KR?b>AibAe8Z<zqv; zY5<)PZY;9sUXf93#CQ?1OvvBxn9EVLbJuv5n>uvjm~+$4II<`kiF9ur=~l97mmJ&E ztac+=H7AK^I0b5Qr8&G2yhoi>x4amP=WBOSL`^f#n6`p6A@H**U^f~!gQa%;zRb5E zEdL6{{n;c5J?qYf{i#Pq@}+1n148ZoMbiL+quHU+ub<@Y4yCkYll;q%;`HWRz;+EL zVz|!uaQ0MpJM8ROI>+V;qWPf$1E~|MCH9PVgvZL10s^qc6-olM2|#iTK0n^mJlA@d z%-qDLxsj%tn$(6_Cq$1i*Jz53^TgON*T{;s??r7_k^*E8G(+nU0lX-^URSqOeDY+- zi^$Omw790DJ&y&-H1>uhWK)%b_RA~}1hvP$=UAANJzIx+bpDOR*TZZ0)*lTTk~#U< z!dFG|aRI)VpA8ZDyX}TG`nh!TW@JIHxMcZy9_bk({t3)e94am`(P_CD*Oxwv); zRHu{mO_s$V~ zyD-qJ1Fzem+r%!E3jpkAiik#69z_Z!Y-~;fRdcSD%KOjnUAYK?R@%1 zrHf&Msmm(HBC@XxKhs$9kK7|z$xO)A^Fsr3u=CrgvtJa-TJE-VB%$HCi|yEPTrU0-A9O63 zhQFy<2MBY1Njr?_>+Hmb_O0L53?J))^ z&pU@v7OkF-n?%(t?-~^iAq-$^2B$iNo5FA-_n%yZ8AW}bvQYF|rY4$)7zb4_$JxfN z5)iq3)AyU)KO9RQDl28iJjTrw=JAu=P!-F&lGeYDK(?TvB579Lz1>6(dXEch_G1XY z{_F>|EFz}6C4Q!9wRgj6pyuc%4h#)L^L1@=7sVCifT877mpX)#>jCxqDPv^}FP3ED z@gVRIdaW39uwHGmDc_{*x^->XZ{dk#R?vkP-Zhn2x&?#XWN>`A%HVkSlmQapG4U?u zBEzH!|7)^F`;j>LWoo`EAnpu>z9B0LhGv}OS@P&&d50u#LiR#_z#-Wo`6xSW7vudT zG;P;Q?UaW)hsI81*0J|=hcM6k%Xw&Q)dnNhWKz^M2j2~crWsecv9yk-<_ zUod`FpC7tQVzQ|2aIp2L@`ad^rAQ@ie>+v{*C%2D`=sDluqSQXf~24zZy0piL@d;r zA2SQP-o6XjDvj&rl~^xwyh)C|_bq&gCdb%$Vw^ut2;K;?hmwo}Fdz z>?~oSK)+XObo3#Eee%77{#S2lLxw#jYgO|>-k#XU<*-^T_nefvQ>L&l47!WIdV&h( zQSbA@F9Y{rConQ-c-22woUdd??@@odX+wiuktI=3r@PkJuLdTKvj>DD0|`19+( z7GO;69g{`ZO5RwkYk+Qz@(Re_Gbt`1ir{_Hr~_kgC)Z>5f5!%Y7|tH=H_8VO8B-_|uR~ZTs^BJgR{kq7ElPW2c7A?hbY7L61C^D&DO0G-J$Lj)V)=X-tzyN__|B;iU z6n&%%E+mn|7*a;o*zF|4ZD7Lj7Dqpu>MKi*zQ^{0WSB+WX{g1X=2LF%3FK;viBx9@ z$wFcA+!jHRN`cS4w_DxbPy3|P+sh=!#ZeOMlM;#{9w}f=@iHRDEv_|p8{ZTNKdy`h z&ml!7^QD9ll_Yw#h7lcr(p3wO-h{IIb)3@w5cz8>yza-1B+{<~?_c}mb%9;B+rQ=n zt+fa?w~ty<%mdP^49$Mo>{pChDKMST;+7q(Tdu0?x~*!gcM8gC@!qIZ^)&td9bPVuOuQb|2P-+XFq}9xyNIwzdE3!7uA=+{KMt?sS8MUMuS6#G9IW3^0!$ zJ=jl}6cF7yX|$=~Y>Hybq&PM4O{;8EkWqqSo{0XV4SYj4x!qQQ^RSf|dNi%K+UHu1 z?J-EY?acW6NUJjfH8ScNmq^1g2UqWbD|u~JlNpj$t0*Sb-t&88%V{ya6I4pRF0Fs^G^9ir4q9zaed`YTz5sFE?mp&!$SSrS#*I$fS3$n zIyN!<=c+DXg+OS(?@LRuLnIT2%FGNm?<(yTFQ#ztnHfiy^hx>bOksgQZ`c>~#|Oj%3NQa#evUw#9>zds z&JT6@5$h+M*{WXaGjBKD>ME{j0re&J;&qIV0)$jzNSHQ7yB?C zCljI&_UeQ3v6lV0Vp!=e&d-vFy3i5}Slm1qoF4xP%C z0`YjhcEc;!W7nM&=c4dn?4VfVfBBN*&g)lQZTfS*zRt(UV{+ zL^|APkc3L_SQ4ftkvL7x4GcR}X0ccomVF4LvxSz5;|yR5MEqb9eCJ3ngT&N}&z!B% zaf_^&3jPy~?Lc-buo9XE;{BWs*QT5cL((+~DqGWF@ga-q@L5)!N7sx=4vHNSSXqzz zA~np&mo@6=J5;+@rVD~eg>sV6NEwFpEEQFuSX{{aw~t?wErT`BRsjCSB5vk;-Z+^H zeX)~dy7ZwAKU0i+mep}Vmk`nC3Y*#8B7woMNH1%jDY@=o-rhBj6sWVNrE$!O#@d>S1Y}qIchBuRoXb9}|s!d}&5{7zysU%34aIQmy$_(s9|{ zfD7mHKK*s&8TTPJ$RQiY$BLEt8A&h}4j%1Y2UoWJiOJ{vqhS5li=q@1_4WQo&1Lbk zOKOA@{tqyPyz50Q7VqQguop#oA2rwZR2%5F?_>0j|Xqpx5I;_kEQqesc#j zuRcZIRx9VwC1(IZCJ@~4bF1Xn;udgexdz=ZabP`36?p}B(H3?X{u*{W*)Vn(#MpNA zzLRT~uJ>t;myYLZL5VdiGDL+GSV$Xu(NHEWiO88ddJ+(}qNp2XAd>rJ{Up9?I1xPW zpFfeJJ3$&3HO$}hoRW!}He-ne;$Fk2IWfSeIWl~3o@fKgsx(hc^P_k4K82@^dk(fK zd`n*C`q6g$`*o6>lFcl;FtEBIk)~lqlksUz$NpZPrls8(uTTg2Ls;#o&j-Niu7Olh(t=1E^ zf~ea8A9oMOYxCqd|N)<{P?}TyBxab`k*8@_?{Q_PORD29MP`UQ(5TtH63ahhxouK1rupC z;HV7gT=cN(e7xj&Fs`4zUJ0mqyk@MA4UzakJ2SsVH)(6yNl#v&{Xm^%qgQBF=FvRV zc_Z?$>>yH-o?+Rg>5)j#wtrJnsx=jUAg^WAGEX~C7Y0#e0P8eWa_ND?aaLb<$3_tP z|M7N~L0K*Q-d0MayHgrLNKYZY3W`dt(0`9(v5U?mvpyucfa?ITX#Iqe&Ri6 z&X@ZGGtBUTVYt?H{eP?A49SjtKI`k--6mf`Mq%Q#2hRw63As%!ol}_IbAyGaHHy1M zI~CEB!hq%p1-FJz+L}4uI`Bbk)Lo)t!oO4O3J$6mr`VL(FN$?9`8wPTOFUfwtJ_XO zRKx!rks!&LWjC@T84vRj9oCDJ71p|X#}Bi=CFW%bno*VAHQjV=2Thqo8VME#eV zt1A)l%3mf3bElB;jB5&_cy%d5QxU?o-pwz3lp-)Ke0?{e9e9F_)D28D9yEzfR2qfC z7)st<>@ZDN*6#J(<2gs`2X~nwwWw(T z3S|##jvBHn1NODqZp6-DYwRu^n{F1tJ`b_L#&={$aZZ~DvN=^q-tJ~ecPX|WcN-+X$lkSnz|Xl>)Yp$KWn5`+gJ@Qj10pq)KktY zQ5IBw_r4+H941I(c6dZScJL;NIU(TYHpagy;^t^xUrK3A(LgGik_84MI)xkt8aSa+ zQ?Roglv>!WshIF_3>=ch-rCZy^A<06{&c78w)!;@%3(EmI;cUF$em}jn6(7Fq7OJKl4=g0|xM&WY(K25h zMpJ%J?&ZNmmEqIg>m(DAOqzw^K_ELvasQg|qvI&!t$gpR86vd`-|6Q^-!II%2nM9s z;#$fwtSI!f&~#U`E&n(}Sk-iO3z?BC`co+TQr%CX|P}Uc!z$ z!n|9QEhGx6FUFq_sJ&bPpzPC@H+_nzvSq~F#Q%V;lb=Q|8SuBIMY;5w=8lRVFIZB? zNKrYA)XR`P=XkxIZRZ-*b~$N}ZOG(jM4nf>{%v3rCb<`%z%TpNBQ4C{$uGIaLLpL0 z$9?)AUf`p7J02*%etLYOY)VU8_t>Fqa)QN!@tp#!4gk53lQT<*G~zPn-Rm;e~+ZqomB%|OpT zIx^q~t@^~kG2P684%31b)<8N};qwk@k-b@A{nK}U1ynxdW33VQKZ(7Jx| zv+l`tn#Y_6+TEzjd#5i#&4J;?fCK2(BznzO&154gT8DUvL%y&_VO;0V_=3uEd{%ZH zn|$=&{LZ5JaT5`6L|tNvvwCv%>B#j+e^IM7-N!s%c*JN+bno|Y(3o(SrE;?5Ua9d3 znfO;%^geY79Ysosq(=xco0cs7n(F~3->N$pzt`Cs+#%xwahehf;cVU5ztO7tVpX#Z zAe@v-J$5EdZN(nMr&0D3R^hp^oUiNG4ag$!E*gWiWt;n9%K)58wtZI8uZZ%Cf z69-V48+dM?5WRBEmOAb%pfX`CuXqF>ggKBCt1OgU8ZFdMIhyIF_c)N{==%9$hY;|V z6X9Ko&Ja@VdaUCl0>lVo7WN66bVY2@mY zLDKK1uW;>0^sd^>mM3 zw*gCt_Sf7b@;z!N5fHZiMy)rjB@M!8{$YF(KdAM*lmdm2*jANQ*q6BWrqmQ~jrTT$ z{hRbS758=K)lGW*AQnu`r#m&s;b3BT92T8`Yd$Dw{Rf=KtIMX(hZYOz2rMmHdzzBd%M2r;ASF)}>fRt|x$_=1;L8_z zAAf4KG1x>30B-3(bb3##*!B$Dn#%bGqi@bD^WMPMVA<1eU#{tmM4m6IPooedY}h)FhtV_%&DP zT|ePFZhMXZwUu^f6@Lnar{*J{Hday?@6;)vWs?r53Kw3k7Bh0j5g;QW&FeYQKh7Vpahz z$1^J-hZUvuc6QW=Q`hgUt&4pGiR&Pp!RA(uCj8!YpYo_AcYSpR(T6g*2TE&XPlZkd zZxH4z3wH%^reR2_hpr{w@3E6JP$rIPy-fng!q=oTSe_Xyysa1^ zQe?NX8nAf)n_*ZBMC4$gv?YtBEIhXzuM1P{m7c^xP^*UiL_PmrM;wHi%x_3F#N*eg zJL=x|7bTYXGL~18Qp+u&v}3&V4keuHsbb`AMRDl#*1ee$6f#Himl^rY9)w;0BoD** zwauzG=V+bww-C{hg(sOg1Bx^aUf*`16~Y6AYdsN)khTnR0dl%Er`-K{iQ0>fRu?|O zvS2zM<~mm|c_nBm3!DYepWjbGUQR~`%p;j{@@ru)qkmEBMXM-?S?OPwKudgU2_uR+ z-j|6YvbWtoz&dPW&Ks%L$3Ty-;1X!iox>!ud_p_bi7oU4RxycaxsF|yQ&(oFgp>gP z&16x<=zRHZ^^>)vhc;!LSpxej&u`YbvOJiBXeS)&d*bWX(FwNJQvSLDb;u2vNhg#MiV7htz zaxmHwk0a4Zn0U9Z6y!0J79U-*d zj8@%s-hS59EIFT#Y zGd8T}+$Aw;gxihf%MKHG9fOZ~HNhvbPVzPHl+zv!NtQ94ISO+_xKUlBup3fZ*FW$##_%gt8JIZ7dp69Sm(}| z?YT{f_!Unth*&IQ0Hwi)n>i2M@!hlZpT#)TO&8rXRFVeAd&}mlczLo(MvjDh*jCl{ znNNmRwo1o$cxud*hCI<3E2d1VWxHY>btLl4baAkAHID#~emhrocE$<4f5$2V=|q58 zB;A+4Znd(55OH)NvGm2^_?4cOS8riR!|lldc8!Rz25*;>2mtb|_pmxiM;33eQcE^T zNj9y&;({c0D}JZ~##Rl!PIUemc1z^xBSnZ$h^UX-O61zP@+@DLL144VquszkRd9#z zG4&9^0y+=5xeDCpm>r)A6mHKpDMJ~?2Mj9=PjD+%50TMW)c9eqj=@ztK^V@=B_din z5}m={0AP|hYWohQpeL^!h|G-qKYx7thRYVcpp>T(J^N7$XYL`H0$$CCc-Q7|%ZN1P z6RA>JEtd+un#hMWF)3x;ky=O2}JN|8M+>x$&juRM}bxr@4QS}Jlz7faGAEMF<$No5L zW6QJqJpU!0xkDQ*8L5Jlqd1(N%*l=Ld#7wPU;5`$DfgoFcWTuW0*h9vU(|Zp^-UU{ z%+;*si9fEF<2FnzyOrZ+U!@8WV4_G+RAh{OXV_B1gO5ji2N39GH@*<6lD*_pGQ&9C z)P4vF|1?RXtE#PvPY^c=b!7j*9D)oeW zW)G7B)&|4ns!3v8a{Scl=6EykVek#@ldD8zl^kxE*O<=;uSE?5Z6bM(COh!#@~7qI zzpU~)zSwe!3fBty6u5S|ia5yS#Wj?t zm)uPjsup*se6?zh=?LWUPqd4x6v_qBjjBs0{8OzPuUrAxFY&wx)H}To`Le&iM7b<> zy7l_jXG0uem~>Xe{#6*;v8XYZV{NK;I~{B5RB<`_0*?KtB7=>wv%6yXGC5<4!Fo5! zKv_OWE3|(M$2OaPZ9*@}W6+JOYRjrLQq$LYq>WqYtqRJ1I_%xs=PhfZvykZ^kmamb z7B{R72HkLXzd=-Odwd(Wg#X;$PDVk(K;X=!+lun^O7F>c`O^U){9pRkNY>G0GpW%b zes<5Ay*XX%B_?4(jl9C}6Exb%%~!W-Cy~SUXfu(31^ca`Q^XBrQs~0*weaI>FWtiu zwk{R^aUfi;_c4Qp4CXZi5qd3U?CI;?se=s%#XU&#{d^I}(F+m;E_Jf(l7t}06M3i# zwt~$Ly|uV}#v_*;!o&;@8NtjP`KBWWx+SHSa|tHwcP?hLcoxIG@oS|NHeBqJ#z^CF z&5?m_QvUfl7BuJh?J%=D?V<8xFP zt+laUX^yGldC=1Ma)hSE>TeM1KBBMe^T@I6JH@3xBTDGg^HhRIx&o4YFrJPC_}_t` zEDpFfivdmk5=fK|u5?y)3?wv8NGp6y-rdiPWw_}6PuK?y=tBI7NV;os!N zBX~&~EUFK4S#E@)PXq+#VmBxKCR%?%tiFi+R)bj)C+R^bw97yTrAI@mHe2G1+!asI z;EHx?=GcKM)|SyUpb^tXko2kOFinCt7vGiH(uyDhi_lex(I~ng4V9ZsX^1_XX30zx zWvNX~Cx38UEk8T!m~v*+P;cNtbE_1oH=;*wj=jSR**zz8<~=9KqCH%`$}*xg)3uUa=>yxTjdxt{Eh>;hq=WN|XYUV0OjS zrENWSA;L1ntcEB#tH3T;t>k1!O zD}RLl8fDhDgl1{l#{4*h@(|L`=>Zwjx5n$yd`;F)q@Y6R(S7O?;#cdQ*383T?yW^=j!!RC~&kGiqz`^!u+2Qd@Zb#EVlP5 zFix$BT9oa4ds(=$8~R?jq*CRGZ4tG^oPCSD;WaaMruUSYqSgYL)_ZmZtJfP`r-HQC z^PH)Tv(F*yM!}*L%&v4G^?GoX*1_^g-OzDUy$|~N(JYW*;lQ*WuDF5)IniwHU}bun z_%#x`WZVVg;0xOjSxr*b=)@cm-E(EGT*Ei0ZvC2Q9Px_Dr$H2q{k=!S-o)r%b{Jbd zeP40zrx`67u)xZ;q|6yB&~(nUXp>YqGjCK3@Lg8FCJA7d@QR@iFOJ1%#m%-|?x)m7 zWrcDpGx-J>d}~oK($0`bgE^5$d8p!TQz~9eP#fy##A4V8de%F>>*R1vXOw(^8TbAL z*=3nXaAIqW@K$|{eNq|k%V~?jI*AOZgctAK;!L=AJ;e>+{P!G0T%IBMZCEgb&_wrf zy&o!Y4g-5uieC_WI^KDUCq^O;A&2Gkkl1+gn|uU^jvgzG;c^5hIZHWaJPNOMtT zP*YfkPB^?OqsLZV`XKHMIR4k;WG@@puus;xq0cmxEG#mT)vVjPt@F=2AOxaqyK z5N$&HCW1B)naxRlSqf&=dv=|uD{@gSi&8ROTrM%8-+nVuRzDxPzG%x|gR^}MszVXii!>fRzPgZyA2N1)8O)D5)!Rj@>&5}Og zm>6z8_~7G%A?#sMJ}G*Y@y8(33TD?#uzKAKb^pe0yl0~j!-Swf?S(F&ws}4qjQ(cy zOv>$}%^c=xzEUongAjcB-O(rAW9^{~p7)Fc4U59Y&cNZNLeLl_p*FvPhUU@S>?MZmVLBjdr7vJ#IB~qa&o>I=S)2&{7^A5 zBoAd2Kt5q{Y^bY7)-l8PP7zY`X3UThfE{I{XtmR4D1#`^MZu6?tK95$3LC) z60cZ6j;LwuQ#4gh2U$$qfqafU9|l0_`F?m%<4oL;iPJ!h(QE@tD9sh#muB%vX1B4A zEsc3vI>8y-%NF}?yyl4|-xQ$$K^%p36ajljfMKoq7)5Y~6#c`ADKcuA7zvMD_}p{N z^AAPxDLQ?T=(~z%@5OkZ$a#HC$l+1=a*ZTjgDojViFW|Q-1sstIzOx^VJ*KIU^w_r zjK22}ar9-$dFSyVqPP;~^C}$=(4SvnHl*);9X+zi!uOu_7sRfjlYtNxDA(@7q7y@w zaDM%*g;&*iVyLM@trNSaNPa6!PSR}d5ccK+=q;$V0a?amS}2c^!SJf+n6*E+7vvXa zlMMc?0iMWdl#A2YaFm|}@Yo*WAF9E^kP_@M$Y~ouTjWJK<7}btP7bT4q}8_iz@@yF z3K`#QL26bXDZC18a0Sjek#mA#-B|gC^Xr_716ZxpXB*A|`!TgzQ z=(QgSq3O~vI*u)Sf|A-@$dp=KYARlBynC-gYp5vptn6#eZ&5D5>g1LrJoRKcT~2aR zTy-l-ku0KPmUFGTLlRL|1iEdvYo)tS3@X%60)Go)>lh6+LIB=o?2InH&K8TUUJBo2 z+p*pTpH}_b72EH)Zk6laLICf-w2Re!Ng`O^rjGD0VX3xUlW(0hGk6w#S9l6#Y+Bx zMvk-QMw&A;fwP$&xcF5~WjxS#k9BVJ`pv+90jXh@*&ZMX^mFnoX$sV7oC(;R@ijZ4 z{^nc5De4&NK0jiS`68mkUM(&u4c`h=V((KxqOkF_2*2kQPWdGQFD@K|v&P%YCz98D zTnlOO89h!{nC`OXqZ*})+x_$2-Sm&YXt6uw^01f9%AtvTau9i|iQl@uw)Tgo3fDR0k;o=y6v=htkne+$y`B0f?d zb)4^+ILUK@lABy}>8;dJ=6{rx3vq6Ko*GuAJ$GW!a(cJq`@#ZEpiC1HW{Ocso|m=+ zBwO79tk+FJ7Bl%N2mU*NT4G<0 zz;_V@;lZ3lEfYCBSM+k|U+UD_3u!`RZs57Stmx3%Cc?G5AzvfxGQ_<{*B{;RQLuh| zpjr5*Jq~hEEvyBGSciwCGEnd4Yq`w^6dnt)36W#;2;&|V)o+ZzsZWRkV#iNWW=}7_bV@*dKU6w>q;CRsiDT0Q%cK7>7B`L2#0*G+#%A8PUHYtNn_qjtWiVpr(}G@RexxbkqP1MS?z|`Ka1m=i!?NW+@ojskH3Er$0;8)_WD%|12p#(8;tttXD)nCu^Utp zob-YF#XBEJ3=x)!@%85#7qi)yHJz@r<=!fM zL;~Uj?;sbLx7zK;$@4^|K{fdLY*r4y$6lCS%dp92qp~jD71{K>0(%cy9FbWQq(Hx9 z!Myb|s2YQ+8<7VG7K=g5p=KXE+P+IqB1t7|^y`xOc0b%ZB8{-PWlZ_X^60^rxGlc* zj_()9;_L%%vT;sxEpvl-8VgMjh2IlQSxQ6R(>otG)kyMmK6nd=(=lo2 ztWt|o6=QYhf2pQ7_ys0WFT@E#;Otr(~it}xjN*pO%+6oN^4$>`&L1pyRF%f zMkG*YrYduYLlRBPn|t@N?QP>A03O7|9C7G@`C@++#ASvy_12wYJJU)j7R#i8sNRDa z{d5j>Q#cjoQ&!UQoa!$NmN@vf75IV{E3OI}!|1JygSovT{rk_OpqY!(I1@?qz0asG zzAcO3xF)KxaIPA6xFa{OJQzz+Q=##2#ML_d;~{^*LA zTx!9Lz#QpgBXv{@d=Zq^rg~YR3G4F5EEr6y;e=xOcO^}`-mQXI+uX$Q4{m+mPug0G z>|8w;2>0?ydedQ~nwMpV58{S|MP~f{{v#HpJWbk$!~@I9=$haTe>e;}Y- z!$`6jz>5qr1~l1xjq$`rT+4){xFll``mb$fUV^LOdssc9u;BzmB^j2fRbpZ9Ar;&Q z5AOxVe4B=K-z`iT{K6oj$!#~PrtV`ZDld+-jj20G#f|WZ;S}d?)b5bmQ1Z>TWx_O( znKr-ea94)E zkuwOGZY@Fp$VoQBBpfZi?a8HA+b2%;Y1S20H4c}OEq+#CVi zh@mbI&#!*CAFFG{e^tTvwAxY9X;L|8b-~6@oh2)qn!<|@{fZf-4!fYfA+y=Mk`exblvv6AsmKb zN0fd-YBAWj?tLU05VDS4%(h|09_)39ubyp7k&*wThM)~!G24`X;qXlvt5b7Nt~Gi} zC}i6?O6yZd2@0jW1XRWY7V3$%yh6lt*}2JB=Tc0;2m! z_z=CE)1|(U*dTj(u55OFp67ww*wXbRpQA(6EthOJlt(f8{4Izx-s9B>%JFE9ShN_j zOrmG(vjDsi34SPb)c!u&HtT(XrPaQehoDEi8Z~RP2c-#a?JCA_OM&a-L>%^LdU*L) zx>HVLx9es=4gcA*STw68*weQ;CzX$ABWXzL=LvVJUJzu|)Ny5~vmL<-*KCUYs)Fxn zbyAD$%9Q*^6?{*tylN0b2mH}Wdiv*0)4Vkq?{1gx9LaWUL0%rHp69K8Y_3y;f6>5- z5+5b<;^MO4JFX6uSuDXpj9U8}-jM@SpNvUi=GTw(~4$su+rcxDUGqb!O&mjdRD0?e%S9o{ZR3J%)Nx z5kqWZzGf5_4pLtql82%uw~&;Y12Wb(SwA2Z+y~!a)kY;0t_VgKO8N~5vY&*|4P!=K zdzI*4*0x^{VqC&q3TaY1?R!$SPf<5-vDY?&UOX}AuUO=hpc7l8dUd;3jEdw*9%^X&8O52 zNa?gQN~R)6!Hb26@Lla%ys9BpSsbt zCA0d?9ymo}0yC-_C=cFdXe{=m5~H- zq?|tsg~Ag6Bb`@UXebY{A-80N`%4O*e|Pp9NdE144YzVK`xxO0Baz3=kNV^@>I*i@ z_WS3}l=?=Nb4@o>U*ki|+VPYKDDsXBEZm%K@^}}Uqr68mM{SN_drYc09f30bscr;r zqTo_JSCO;>DUA^lg8;_dWz)D-`jr!unuumn7Ey>cVA3v;E&fpMIu;5}TF_zkX>8ke zgn3iZ7d4cCLwcMH?~e(z>6qWXd<_V;o_V^CFim3$tM?KAJsJg)j%2DJ?Brry0{pNb z!aF}n>ajv@p%F^Yb0I0`VaLU%&ElTEtSZu#3bXK(H~vD1pvw4CGV+jUlTE&-P%9$mrrXc~W%&9VIwFsVElIWLTEz1ugqez+ddQBSe%Dw$piD~( za^)w#XVm*VxPhHWyx$D~Kiaqr5VD)3{nEQSF-CPc*k##iNs8lbRofus8Hrh0{AN=p zPo~mH#>n%-AsRNVhb}9(W-c-(tc_g5uHfzA;vQEPo1u8*cEi8CZ2g+p%hta+Yz6+WE?fWRuod{fx@`TM!&cz`>az7uhpk(FKRFfnXQ0}9HAOkh-S<@T zD~sC7;ualm`>rV}#p$f;9u;Pn14Wp36!};3RG^jo>xb`JpNmq4z!ElH6XH{l=5G>~ zK?fvZhrkkcrY7iFn`##ktcu|e2}_Bc2MYx08*g_cRq8qZG5DRtvM~J0m{0XrG_YgaEpbXP$^v$;7P>FB4R=V%? znQb`#=LcX5JMRFpu=BfQ9_z0PRWwFFSOAg$EXH)5VU>jr9Urtp%tz(OdBZBF!Y_4& z2m7{l4p}u9C7Dt-$ZTkyI#(!dQHzY*>vF^6kdcAvcF(7FKkN$&WW?=1z-~|4yb6L+ zFr+|GGycjiRw5Z@5JnfSA4}dtu1ZOjASx`$tQ&?J9vGwFN=`U!E3nG*HCG!WuE-X^@QVh&qv*F>?-I=!%VKc#@D0$}C6HpY3Lg*Hn5Yhn*vL;0fK zX3|M3y+4jI&smb|68DBytY%)pm*pT5>bv2O)7Ra|RZZ1@^)Yu=GP4zvb40%@*gjF? z1WJjyx2`S{S^WEj7e6#s^7n|eA?sUESi!$|WUXk&$_M`UapEZsnP6H9RW55;+(_aLMfTRhyAz zypY~~^C)@I*t%%YY3tl7?4)#OZd5mzK2 zfiv=0J`zJ?;qeej*_RTz!RtuWjcSE3l-I8=6i>GDj);@=Bn)Mly~1!KdQSn4j8)^343L{LubJNeIZ;^d*D^p>!T*Frmoe-h}X+SoYTz6HJFAgI)tHp*J^CGg|#;6FL2%lNX_v)9SU@&Pa*B z-@gj?jiY51P>={T`MigR#)f-_p-z21Alifpyb_&%%(<6=`nnA3`?Fq+m>Nb0o!#ac zpDH8fv)JWl{eCY6>>u_i)`ENDY6(oI?FZ$9yM!|@Swq1(HhLT5U{wBI$FBdbV^>LD z`~`E}F`~*_tnl!#%;N)-0#tZNe^M?0!rbE3zhLfZ)i2E5dJn?fkg=bb+r@B?xvfU1 z{Zh}{tV2cqjJX6y9X~O51NbB6f+=?ZeemRW%Jp#G4n9>U0FZ`fHHk|3<1wJqHBQKB z*HrK(sQ0Ic69Eiw*&T4%j(m2 zZT3dmzbn~bwayc;l1<3HSF*is!V?#S1WlHL4hEWDa1}!qBLXn zk^$3fk8|<-2hZ1=I)SrE;SkXb(ox18an$MNVJoxZGfAI~rzJ_q>MaGn%_gn5>!!{K zRQXuLuVQuI&{G5K99mt`5?Zm@$$l1_#Hwh|pfq8xRVen4i@#j>1>-SaqIEMwXi+!F z-WEz4SnxpE`%ntT)`Un*6)_i^d`(PwAG882p~To33#Ns6!_Y9}n2OoI0W;l+3p@n;nNb^3?wlO__4#P-&pzPJ_}iJsuii?3G3i-Xo* zvk2&EN7S+^WI-Dk0(Cylz~0F8q1v6?<<9dS&_!%w$jrou_1+goJ)QREKp$Lq7A(VS zBp~)cHhJySJAby8K%E!?+ys;<`HnsN1k>Dl%T2ZQqk;*?{5MLK%N{sxi(7l1g&;Y* zYv-JHt&m+itJu)eTSxo?XBP+a^_o^KQnv@zHWj*E#+Kyh&(`LDQ`*d-=EC)U~3 zPKq1DG+lO0NZT*VJuA71ba&JZR&SaFiel=CHoX&$*tHfE8=NtJT8KrkVc zXNDz4;PUCnkbmNbL)h}*S}r+mqNb6+X!%HpwDV~!j09g`w_1hy<0Q@WdmV`i60}t{ zM#;z697@7ZKTEtlqFb$08N@AD7(;2tVuzv-Cuoil@IxtSapCAd6F_(ut^h_}sL4Me zFErcVATLYYJ@TR!2Upw^uP&74QXelsIR}ZCW2b)dX=4>XB8S%4y5&J~^=6P6f#h^Z zbSh6!SXFdyo&GL`4MVI;*G!Lt&Y?z(nRIyH+Y$~b=JBwqsNNHoE_Kd~OUIAGdbndY zgwXMtF%x6oQ7?00KU^%1=5BzO}Gzze1} zpwwjysNDFD;J=sGhP$DF+s|w4!@ci|YiR9$^~GENzAql1=uCbdDAV^qJ^fQJIjAq@ zlX`G{8}#SCIE4V*7yrnMX#rp1cW_ag;J%o!*(s+F8ZPV(MgN18>oJViu5YQy)}34p z!17#CVL?4H(?2!#S#@gBbr$_ucjt=*Hk?%ivrTKZg7-&{2YvlAU*rb&e{;Py5yoX zIp!jIpDLHOtkp(FdsQ&kMkMM$aBx>SKG+N3BAKr9KBqeqptT|kdtihpD!{-*^!T{n zYG!Cb1RzU|VZjkBt81Ts$3RLuT*pW|lVY@x;G(k-;qo}uW!J!`&zj+B5a`=YK_*#n z*GIm0yFYfRf?Kstv5C_tBG*DeByy`;U3;GE~ZR@sJz~+sK$gEdL<$ zoh2Q9!wVH{_S%n(VJ9Dv^=*IbIavWxx@!-yXP;~IPZ#ccndI)qAsU@YP$^nCecGKu zp7Y3M4>yON@U@T|_TGp~vv_*>bcs%)Nu={t`rL6*Wm?+knnm7TIoJ5`>uBN=$7r7~ zQ?B801Eso_)HMUb1Rk>nBGDG2_}5UIIqg@PpbO7FGJo+v(1{XaDcnmw4NN}3sb!$1 z7h0j%0l)kXo4xg2I7;1#3FDw|cG#udCvNz>{j1VOI1Ah5-S0sn#}Dy2Sh~blKL)G! zTi&NgU+r`G z*MsZv6@EJpIXpXs3%zwGsr87)&Jfi+KN`~nxI^#G3P;oB>mz$VE%hKGQsK1>hgbG~ z=ygW)PYvzl%!g2ZNfmCc)Q#j@`nC->-k%QIBI z-y7qXAOF%A*Z$TRJAxWxP+|-?O@JHYfW{&>f8Cy+jj_0J0k|=K<#^v1ZzKL_jA=@L zYm8MXyO_nIenPH|4wz_}y8Oj{Lhgi1mp{G!30Tr5APTgBB<<-^DMaAf+Ce7e3542L z_`cFbjby~25WEneSh1HVO+5lgp=E<}u`Bl6Q*MVz&I>|h(;y@YRI|lrwpwa(gm!hs zzOIK0C4!DPHP_LW!(I-27{-HmmYX@;pwrMt6TyJM%jX4p-? z-_ubdj(oW2Yam?HBa@kWYS z?L3c7HITq0VwClXEc9}gTA$}ZiW@BPjkHOHZsnanHtW}YVO&u*mnL1COfx^qU1aTI z)VHf1XBVK?)3F0MvQx2;9`b#5B*%J3*N?u$ukld#aqa0akOe>csN<<((_a=lDMCNC zBh*2Lgy9Y`^t+`sX}GQaA!+luewVbtAW3WC-v7I#ooSR2yJr9XPb4ky%hH-o-dozw z_m=it9Kwbrx&*k5r#tJmF8r4tdoHTGc9NqPSZAbq+p}El##u=x`Q4fVtDbe8#5_eG zs1l$W3|>^=t5kAz6It_#TD7~UL*4Qh54?&03E+#)8J3O5BMr zc?J(5Kw(@zRs6zR8nMXLBC@RLCzZ9fO1wmz<7Pf$8wxuyJkYLqFO?$Uk{a|-Eoa)b zK2-Tnr#~LIihnrIl}sO-zR)FXQ#poFpucS@Fri{6(KOE(v2IZ@JaY&WzZsWA0@S|O zG~luJ%`B!1CBT~9fEuE!73qp5;?-E(nu(jF5#c;_L7|*byB~LwHvTp4WHkGSaVKpW z@VHaa*l*)bQe|b<(V;7oN&06`lAr(~ zdM&l6tRkrs=2Uc|_79d~jK2DQZ06TBdSHRv2G@w8|0x~tvBEtQ8gk(9(e{6E#!psj zpPp3tfsc z43hw@J2CufLNW^z>;?K=aYd?zL|&BsmxR-V=O zN5v|kpv}mazDx;1AieBK36ySs`k7lYW@J?fjWUe!lXn0)@B?x=zKfhb7RBOYgY0}n z(H!gp;#+t2Z5$_)^`epyk&{K>V1d3CP)a7)_54w&W-FmgPHyE zfy@4Zn(-NuMIxT)R5!$=g#CwelkD|R8ZwHuW|qiUcu$j*Sn{n=66(mU*|K?d@Flbp zV%IVs^TJ6?>%2fj{8%m}Jka_y86^dD;4_pVA6n(tG+}+B|IISl^VqJK56vV{S}4T&93+`D}_y^xETfXQ->^qs}vsk=+=4-1fg> zwBk5OLie1FP8ge0!&odCeD|eI$0TbL$MfwLcUIxgU5zFqacu9v-m9UG1x2 z1*_CxWeRhPJUynSe-v|*>0IWc{abe2%=RQ8^I#gU{i`4l1!7q)(ItK~B)IILZSw_e8OP%*mlrMmGoV zhxLD+V_|O6|IW7!4x8o|`FGSe_HhPK{`LJL7G@?@XYw({zw@oTU$0}I2p58ewZk7@jBePa>a|)yJ7)LRm*eMnIgm44Be>k1ZvUyS@crSEO&i;we zRSx^3(0$K0%nsN7?yo}kr_VKq|JOd(DeB(m0{=|t>OCg)t?Z(~*cvB#Zx+tynnqdo zwss#==Sw3*{8Or#>|N+^ccC;G5GT83h+hy!*fYf7N>!eR$k814w+=WIp>1a#w2@FP=%VWp;gkKAAunYucqQ@%^$+zkpD|t@c%V zF~U|=@Ovo+Ni)+UP<%|I<4A^HydunVh4z8&C*RKFzoJ~@SsZLm1@w{fdwo&|wfr@Q z*K*wjHxc=17=1uC+T#h#-`eBzpY1Ue;g9xM_djTlTYj|1aln0iObsip zw!j08K9)id({D?`S{EYel8e*ooXdf&7!_6peY9H^ zO~HoC{fLiyRp49O%k2+}NJ_6k@$uX%oUY5ZN6arZkE_2OzpA7x{)e^Vt1qCn;@V$p z#XvcPnIL$s*j5TWSB&`%G*?Wvaz9tBF88-{#q1HFxniWoU9i;sjOY$wcfVE~Jq21T zrfC0ttvIE2aZTg<`|OEdYsLO^e_1OAe#{j+9R0_0#lvjB&lS&I2ZGj$?H--&g4T++ z=81vgX$R0=F#)KWchn~i*K53a!2g%-cCGnu-R-|qx2#0}Uflv9cMErZ{_OnUx!cu0x!YQ>y9KFR z>o@U?~zjwDgcoJUUHDQ)}MkB?dNkDP3 zo+tUd1#Jf3m$@+x@9Qmgq+?0E+CSX*$zAF*pyx)T&-vjMIQN6-92JJz8K@ZzKC1=M3 z3tRdKHR=l4T}%Ed&>U2~&Skgc&HWrym=)>1z(ND9XC^XZAFumJ=uot*d+N2oh0h^i z*Nyx<_GLB{co1sPR2Vh`R$`@smzqRxE0uv*3rMd*1`HM*yG-AijM#h?2>E91F$v_T zsKG}4HeqZ=7Uqc8kgp@jd29sov|wp_?`*}mI^Q(pok-;H$wQZnF|=y=H=x`(2wl_5 z&C(UJ=w8wdq3ASLA>C5@zzSGCuIy4)gSagUw^8a@sssC4uz`d3ivk3NS3~7~2wV6Q zED+&dxn#~o&0mImvs`;4?6JP(y3(Ezh0pjy*wXdB1`+PELua7hC09tG;8)x~4MVA` zfrp_4k{#OG?}wotwXVZ!0m!ayw}=jf!|1EY;;TCumxP+nFtn)aWnELxwE({*NU4x# z>#g&hmH5#55y23&k_9f5F9o`ukEkOsf0S|>Qt5+zclbGH^yAPg#x&z6e)CGIn@RGr zh@lYRlUhIQ0-kBqE7|nvQa$oTFGCsyEtQiu=Myb|D3yI)QbBOuPeLKR`^zL00N#Ys zq4?7#6zp@ibZvr)f82z+pM;t(|2LCRMl^pn3B?hGqU+C@C{XOaL)yvqxRnZY<{sY; zuZ5}%M^{v3-JH0o$+#gxZesOGVbmxmVxIr)+56ZbA+k9>7=M4eS|zloqgqU|{a+)- z%Q^ozVm#$u3*IpPgR=z@ZasYXUbDVU+`YI3JKHk-f_aJWQ%s{khuU+zo}#2J>WSm# z)^axRkTIGsJ2R?;#Y!mySlIeJfq#Yd;kr&v-+C7v^gQHJ?ow4{7m0P66=v2bRIQILp$>~^!?!%L*ZvIMdE zn%DGdox3)dj8lo}|FL#fL2)SRmd4$k;1B`?_u%gC?wX*%y>a*8F2UX1-QAtw?htgE zoxRUF_s*S}mwD;_t6#c`qM%o=Z>_}=s#K{=kE}g+fHMA1s#eKzJD2@msoIy+?Ccb< z{UczF@z`HA#$x|_jj;$kV9vXs^uP5O>-^ng9G>}ikFm_;pC04S3IFdNV@B=w9^=5D zu#YoVkU-fN-sP|Y;pcm?VHs)fSD{C6!B;J@`k2`vG8p+HXF zd!dAuH!0-*^gE!`c2o#u1L&XXSa0`xa`y6kzJ23)HEg&jJf`3%l)Sqd)FoURA#-;%rjNo`CU0>u z#*XrUCDZE`x7M_qiA{Yaw3`t(5XiMzC#(fBzS5HbB)7iYg1-Lgus z`8=r0eyjf^_EATAW;;98*5m;+L!1X^T_c_-d3v$WKvFf6FyDy@H8VBfak+(jw+tb8 z;^*Oi)C%Zqf+O5OCVzrQl@3GpCU_Eyv zp|m~!#A->J{)*LZMZCvqr`Z3*YV$|`j@AB6BLD5%jt9p4O(FySW!#>VlhsGhy^rzO zvcX{5M7th`O#sK;G6ynKX5lTT=vXEKojuuDc&)kn6&c-w?G#>piWezQ=K7%8wQ%t~ zs@d2U9UNU4tY@qSJ42v8fxUikS z|Ez?noc~#bTVu{^vh9OI-81TsI0TcV=g=o8J^ zgVE!JP1I8V8X|Cpr$xjR{GNTta;s+9n9;5fprEQ2!jBoAYt0JX5B!08+_V&}g>Jo) z>CR4e3D0>R3hH7{%cT`N35{9Fx=k|f$RO+O z36b~b&t90=;gqwYvk(GhFc@$epH^gGd3~na?m%kTS2zGg0-01VA5{Zq12`~VdLbd zaqIQ!K{yjM7+r4eyj}n_@gI> zFOwuS;ED3EU?H=7($RYLV@7UjAcnvAU45385|ualXN|@%G3)g<{mhy(JVOdS;U8Py z;wajhFk1ZqELiHt%4x@ZRs@+8y_|T*mZddSKlfh9}R67XpA5zaC z6?{K)I8(sv)on@@mXMWEK^Q9yl`p)kp0EY2Vr+IRAx~h~2p^g@);tjijvEh(ZgN$b z1Ki=Dp77d;Zu8oJT=DY2IA#)l{Kc#AX)_r%WeOQRCXQ~tSS-bl?VzVpl=NlpuIWR4 z@iq29l?JY{Np!q`D%AUN0j&TP18c3vj`64sIZZ_mgq8hCcjhVsZ+a}m4P?-_r?2c6 zCDok_mqJV^64KkNPkwS-JElAc6YT*;N0XD8naxbcpWD8hdR+GDJ=L%gOfT?^%6i^n zscvDR)#VVl`{C?rL>i%l5%hbC617D^qO-U3VBd48;Gn!7xlqB5fZ#HLa0Yvfn0&fk z++@#2JWkFIKILZ5|Juf%p%}VyF6EEtB}Nwx>G{&KBxU+`bRz)+xzogObz=nZ)Bs~6 zA**!iT86a1E(OBMoPpqiB#6s<0(;{qz}xH8rBJr-{!f z373dVt+MTq7yoC@n?&E=-(f{+JWk3aG`Bd2ZTq zIl@HnRhXsJh5IN6Z|l@aHIK+c%3hI=kd#!=ewz8?#eD57s(ccsmouiqF99?MXHJ|0 z!+u-yPp4aTo&<=Zf4lb8f$J|Q0wGi?q+?3EKOwfm*H*7 zu-w0n;~y@bXeDW-cGZC4q0bcWmlsa_jG_wl3o6@->o2~i{HpBJH^C10%G8w~_-`|B zuS=2NsoU0<-e`U79a*}U8wQ%`VVK*6h##y@w6@tQ9o(xT`fqLOEI;42SV~ipWPP^I zfJQg4&0RliAbL}Q9PUhY`=*YqujB0qIuH5p1Mr_OZT1|1r4;gpUgJWkcv?!oRi~e^ zn-VA3rFB=Dm38ih)sQS3NLclF=IpGgpB(+v2aPZjYIm6a*}`=#(I?%MY{$H7Iy@Hl zq$O|d(7J7t)Xt>T5&pu>9s4m2mK*({LUQvGQTn=pNX7iFFD{dcPsuAE@T`}91uoO? z^m&S}!4din#yd9%su)2sAz@&kZ) z+a~zP+AW>omwU(~3}lz1n1dD-1d4}5=UBZ4+C?A2xXRd%`_b%VA?6@cq%r&ycHCVV z(PTH~ThpVl+0-I-rStQ2H$1OnUdfJA3tSN2ifdMORn|=JL>OL3e1hyaLX>93zO7Xr54xsGg#YEbR1?_F7$uW6)4_ zSEW9d;iwC}MAdAb#FqgQoa32pSP@AbbP9y3^BW?9ft$f`O{xRlH)H3j@ZOF|L-L~% z%!+^!p4s-o6ll+5w3fp12tjSqkaST*qZb5FMwNTsa1Ur+$}2h#oJ&~`m^*7pfH?J( z>Nf;qCC_q^6OsbLSbkO(u*dJtXWxZ$a`1gi$;_gZql8dcf0e4|c~d>ti{OnLZRBT+ z>Z4868x9s|p~mcMG4`UDJDuQ0paLXwYvPoS1hCb&H9T>CHv-?Omp9zSoXD5W#jHTx zH%egK;cD#4(fgy82#VZd7Q37ppqVrrQ(b>Xv0vD+BI$vgl(liW>PSh2=FHsUEhm0z zP^#4j0|gb`rG%1Z-wjW6lV<$IXoq)G#4(|S7p=@A2u%gDLL0SHNv|!NUToxU#<6q) zo%+6XwZ?8@nCJbtb~bp{!J(J^)%UgaOGLbdYPm+!E9G#VNpVzzB@3YT(5>9hcm|hj zWEo$u{hI{NnK&d()7C_L5-GEYY3L|MGS$_+Xv|bq6bFm_0a3CLydyc~4Uurg<%>!O z$!*|IjHGT`L^N)rN+VIKfg;{xm3St2<+z25Z0^GH`GNY!IR3(t2M)yFyEA;|@@2F5 z?$vLh9aH_~nQ-4TEPn&?zMh;=z`iJ@H)6ap2PxR(nI%dP!9f zWC3L@*K2 z>5(`?3Ne^&+Cp-8A;9SXD~d(21)vun!Nzb3)$fd&+a0oKHzaph_8>hQS?M8}Q?J4J zCNru?T@l@=Tx&&I@aeATLK5;N&{=SFoVnm~$_Q*TeZ?(m36jQFbI5hV!^KKaghflp zk#ln6qlk0nkO017CFGk*Q^QLnnpDe@kqj9GMB4b?k-|vP1iBs`sxAWX@;qpuW{%=N zwSV%F9tb;2$7Q*bDKZo=KlUlo^P%c`D4V*FgvzI9cq?rMcpGi?1?6{-K&4{pvXNJJ z!|Re3FcQJht9Om=rQzx-id=oTiMiNLlnTVw7P_EO#sF+BiDp>sygxic)kHAhsMw)7 zl9dd))Co#kTYN%>SKi(5wz{W#mY$d4&04zDET^B7f3Qajf!8*fx#4i`=!(iId1S+r zEl-TZXgVbIUXMv z`|u7CyS_}c%&JILIdieSVF4N9#OO9eL*)x3Be^3tkvq!Dt^zS1MD3yej4`~s18`nD z(O8)nzS@1ojB9tg!!7xVyjJ`p+MP1}u~mR5`sWk*a-_O${H0G=#6L`gbL9Z@ZGaXJ zv5Jk~zc2US?jL?=bdxPptQUqZTwQ1q>W=hSxVq3H+bH*yxVT^<17Lgfx+~enmRT%j zHvHJisA%GFQW}C@K5=9W8CQsRRijD*3!m`Wpi-v{v3|pyw7?^2E-w;B%bS9LYnKDO z*5MKQf1*QS^W1&1T^Uv8V3d0iBFE#%-YW;VpgK9(+e{-ETJJufSTh-&i?i8|T>=NA zKM&#q)#$RAzK+hXy{gRH(F<^G)E0)-8cIHNIipWOj9Q*vNi78VA87iv(+VB7%q(+5C1Ed^)rDIGYBb*+_&3jDK4^J&fCUfrSzv?u6i zoF47G!quaZHP5p17Q~hUt2U!Gdg$O&-FtH;)Ps6t0qaBO9>Q~0As$2Do&4-AFLr-+ z2DG`K4ecb)AqI;YwZ^J~4FQR4a9AViG)7h7eN6AiuQmg9R3njaOh(mSz@MusDkr!M z2oN8`)2H7m0s&%;$8BX$(yN&Vd-N6`p5^?#r3w|B*bG0RdQ3oKElX{lqh1H_EZU^0`YEm-EXy z2P)CMgW^QQhxIpJEF$NQ=)SHs8{_Y`Z`2yxt;gx5vPf-!xG@DFLOk=4OTy>Y^eLLR zd2ZIJpTRQ(o6*Tu3|CySjku~ws9uE33?_QfyH>ID$q+`BtpiU#kC_WZm4)4VGjS}8 zNPVgG!Y6(-jBt;Cd$SVIph!#$iRlWTQk5(19n9`T{;PY&YCv2`pgIQ}XI$=8wknQCQxf1fIzewq3iY zh5YE0Wh!d5C9Ij!Z3MvBRtW7-^?p;2@UnvxF8!bynr3QKLeKR^qP_|wF(9$Pop0Eo z!lan3ei0eB=U|UPQt;MNPSpuZ8rtbo!%OF<%u1{m+Mc|XfbLsG(_HZ09I+Gj(M>vx z{?an3(jHBIzO1$J4;3%oJP(+@91sr5F&b+rbjS1A1wMh;gRs_)OKZaCNocgy)-DjY ziZ0Me)<**di792Zl%D0ZGk^i_f+}nks?A5(sK;5W7pW@lZ7=t3+EvQUmg66Crc^FB zc^cXUa8JfNR)WiFx5s`Rhsrq}>GJk7h)#2?nZ#|rs(HLhk^4n7EF3hC*SOUhjZv{) zZZC&$I{W=H+Z@eb#RY<8umEt&MO~*;rMjfV zjeP24`ez#bKTqKQ{J*(;6z7sU^$B=*%pN zvwwubvSlJV79|&m{U9@^h{={dBN<3tpdmOhp>f^u1KeS?E_y)b{*E6BxU}D=##2$= zkxxA&3L0*ufUg<%4uc;?`Nihox1;{8DgP3eFN7*fq`1!IdUqmK1*Rk#I-Y>+J4xV-6vELIEinOh})S}?wcGf zh6(sU|Ac^zf|py;plJwuJ(ffxlix=O@E1SyfJshOQ?ZId?K-aN*;^VZQRc47n2`At?e(FD(@-J}-Krul{-n?@Z z%AQamPQSWp}Kjoo#A^8 zm&f-Gr2x>aipa#+N`z<<@GQT<25nQOC`2#x<;o1)(8Y0kqm+609jd&>mv-UBP3N6% z^~r^f)HdV03Rys=zdU~iJeeHdd?L9%IuqEtrhFHdeG3{)H4=iYO5fP!Aij{3_)JA{FfMOj7$fJ0tqZKj>IlZAecHfdS4s? zQJzzf)euCr&$?mGq668v>jZ(e=cRaWIC|3as|oy$h@b{=;}~gFUzBX~H>JDYLKEK# zAV~lpJSu68)g}e|Qk$g=9U3tNdhhh9Ph~gjr}<~qum2r`Tp3WI*pJe^o-XxNvJhH}3IhMD#(bBUfdBFm zZ#Z36$WiW>OauA3f&Lr%l|wHhC_}0NDg^g=IPLZ?csT?KvuvvrlIszD<+5;ClP+vK zQWP@HEzFt9qj9NJ>`K=8tI|y!kh`J-)USbu)XcXdixWL$65Yw2%sy|$5QH0@EPyA4 z08>5b-^o|ZyJmplw>c`lNn^_bv=@6VXZ{LUvPMDf?2T7*@D!~mA>h($xaXr9S~;>S z?RbO>lIcNR9lpU$=J6Ps@9jPOON$^P^$HA4WdFH^`Up}_!2YAgAC37gHi7ao_Y693`jMV@2ce$# z2I-&Y1N>{ztn&K#+2-~&dkO81NMMzP$g+r>_X)*5ejX+n)Sxa6wYM<3#SxE9-)H|dB$8&Ow_R-soY6V zaL^rzxu3IBDER}42rL z@6oQ-l22#gk-O?2jro_@1Yq}X1YB;j=%)3D&8Rn-?xw^aN9Aa10h6l0o>QUJ@_kNm zwsgko(lL^qk_7*)NafC0yw{UN9tPl_qYb@VJVhIENgpbN1>!DdC@#}DyR@SkT@|W# zV-t~R*zf3@r)7y8tbcQ8=1jC6?~5PQoa9&)#Z$!tp4G`?5z78hf?i7hxL52XA310x zJ)+4cLi2jqZxEaFHW+t2R39E64-52&M3@g@hl{)t_NJ*?%gC6OQCUJi>lf+*2pfwX z`5Q;;n!EjW^n{uFKCQa>@!$Uvakzb}oa?|P7gjo`;;hJ$9W$Pa3fL0UNp{OnHqsQB z!ZMNX@%VP6SdbH7POLaTQzxUnMy)tLNqN0>g=we80AU1$q!#^aAZwERTcMc)s)KhK z{baaLs0m;Gu@v<3Rhh7?k?v#=K zlw(6K@$xe0Jyme6=!(zbD6Qsn-=Iq^oPcqy<`prg=5H8M%~N8RT1_xs%(66socNrw z9hhHBmtB3J2jV**OIv*dW&zl>Aai7>wyHtG!y=DlzOoJj!m!Qkq>%QUBDs1rw^!&} zePSko*f}tBhp=BTbz#0>>3W!dZndn`*fLQfrEc9MxBGCNec_8aYB`>~MXvI(LVyUC z-mA&jrHd6}LQo`;fC&;0uv2e(RmrdNin!=>-aTQwwga9*P_g@{h#0^}5!2YI!X}ex ze~v$f-PC?1naH{H;4fWPRbw5028H7J{?+^(%Os}leaN!uNIf@w1EO~qf3 zS9Z9Xmb+ccNOVg%x~fS#yQ)-8byd( zPT+T;ORWY`yqjcZAD1wG3%S$na&+v+5+dDd503!Bjdi&BQ7e}0Zlv8KdFs&^D??Bw z4N;cI8?&{ih7so*z+-wQ5dgSsLs8=|Rx8)4fLXD-Rma_$5cHRP1jWbC+q4C%)Bnvli0EoN|7BCzH5(OdydOl`@S?Mxcj@jT0_Gfk5YWBC}baTx4gM@fak@W+ynN19-b2JvrH1|B2hXI($j8YTOST zgWXK|wPLuT63tSWMprr`A{qhA`ysQ&Sp!MO(RVbw71 zRKFnZo{gBdrZ+Xd1Z>rei(QFlvjTw$(&g29`O;HM)&XTj2MT4?d}X*8>tV!U#Vlsb zqG|-`5dfyl5ZENC&@`9W@}#-pjOQe`;x^E%hlH}yb~a^9I%!4ZyE=Uy$g^${=++A{ zBqP-GVhv-X|FKxY##874y{EFqe5lml8lK(?gC?O$z26Ww%;c}by{D42KNN@Bur#>p z&p{-Dsx@?Ew1BP4d7KCARI0w|D*}KC?-X3_e{uqMuayDjPG6!C5gYK3tJKHOaxD{p zu~R2VMaL>X3TmUEsQG>*yb2`f`4I;^mhU-Tk2nt(+z$?@#5`cYQl;U+s|wT5oF*61 zrcr0KxEbnQuv4ajP5pMlqtvETq=gA$I!+>{%p~KD>n%yv71^-v&vQ|QNq}^%hx7&B zJH-YQ_Y<;?XZR>=R~rKwzhRnCRJrN{hGBv5YRxwo2}w}{9H5EGsduow_yjjXbR2H* z+b^BT!M4?&l=tlLX9gZ?>zgMH@0k}#m|x4r;P&RLTD6PI0+&WQz8h6)E)dPlmvD*& zJ080u@pLFDIt@2?M58x60c=JxMgMdYFtiV{3=_S?#(7PMwU+GwRdZ<-_=~QYBG4GudiZ|5VbUZOmsfQ^28Eb#e%}Z?l`Z zw>;MIDbs}N;|F%N3?0L`Jb$JEI(x9l``?ywfN{DTruiQ@3P^m6xJafiAi%2t+DL`;EGV+L{lM@t!{Cp1Y&C(_nWJ~F%pw2xYWQVs9{$9bco z(7_^6i#ADJI+WoWT8ZjGb>3e5E$OVfPoVA>)DZSC2Zf|H&8#}}WkPb`i1g9ut4Gx> zA?u9fn#OAvFh_Y8NDOPUQ9X35T3;0&wEyux9EhoMJtbqhOWIYcm7(9 z3Z2di6q%!n7Y9-`jk1_`LxU^+wG~GT(14jDVE|Y5UOwJQu?4Sy8)TWJXFmRfl7_jR z`prJGag8kz`OD4Y3}*9qL~5_S!%Va<%FsHNgT-e^TS0Po=gYyd7VH!Ic~7B}9YB~l zlXk?_PxeIL#OQu7i}Xz!`)qmq9ET8`=I!_2fr;`Vosa1 zeS+hg7=jjpN`jKHU5W5WkO>sZsRrDr&v2g~MzbdQL>6QB5|vb!4p)C3DW>^zJn2Ui@drGOrqN zo#l1=3mdgxDMB^V;4ty~@k%^Q%+z&y94MGs!q2(8>ki0}_iz0$AMNFWNLBh(P+QXr zNegyFmWHe9q_=toRxKf&#jITxJu^}MGb9E8FrP2<*c`M}RI%Ruc~vk+wbsZ6C6{~T zJAz?VPvgWv?tPX1wyE>OwpRfhc()z_J-Gocu@DqLbc{{Ys4*el^QT$^9%hWH^! zF<$cYJ^?9ezgLrE$-Yb=S$kv@Abd^-NjBdS7-@)d{4+LU?b=s(HX4vPpA*8Dh%eXX zE5H!?p-;+Z=PT$q(wDyGY_Xlaxj0bt>)D1E`)Z=Hm6s{Z4?sin%5jp3A0zhzRgj^q zHuaiRi&vcAoICe2VQ0pkrYw~_l`<&C$E9QY@69cywKvh&A6zk3@8&}K6tKiJ@J+tQ zy&tZgXccmX@jp~#0jeAtyT-t4968rcv-n#cUw1yA&9m7C3tR1r-hnfylf8TFFTmpl z-wLC3-U8QC2f1x|q^SDSo%%hbLBBH$L`Q_D)GAbhHGTb5<7-)hOrBR_1S~m(a^Kjs zJ}H9rEZ583ua07VTo)xd#AC2h_)5CYW{`g!fPY=@hX;-hKl+^5cix_?;;4v2z51D# zejrpEsf2S^iV1{j*@U@himV#t;#%>-bkZ?svMwzL6J=8zoXvQPlK#<($#wwv;fP4J zXT%vb)1$=rT5)&+5cgK1(9J( z(M4?oTm(B_rl43F2!nueQJklnijUevSDI;fm-wTT78V@c2Yd^u5@M=K@^U4P1L9isfVRx~|&X;ZT4u~`#4 zZ1AK7=f7}l-|H{lLuW|FWo9-t9UV_UJ=Jy>OjY)>p-P`9QzDL)|wDne1_H-Ep8oFMHA(5F`PRZFM;tS}5X#E+OUtTeDQyvu?Z2wkc>CTje?nV54J*Jy)j?EcLN! zrqG}?lY}_`Xgw(Ayc1evJph?(Jp{RHT?Y0m`Lbk$k0o$wHJE2-RtT*yP?VqVY@8=j zTsclC+HvP3=IA?2j%gZZ2?j&JM!k8D>&eRO4_xW(B~^sq4%DPq9@K#@-E)yVxs2O# zUmX(cBzX?Nq_|6v0c1oA&>|U&L8!>5LX%MECm2!}jDyLt?HcV!(Z(e(+pu^ydxw&0 z{#9V`mYTy!g=d)P9l}4M)VNeVi$nVetWNc6nLfCNut$TD8iLti2JC9v^uVO`H37m` zp<4^b?dHUC;?L!CiZ|n_!Ca0?*l%{tm%N%IZ(R*{GveJ9j115pCmQnT_C2c!oeT6$Ty;Fu#`(hG@5wYyp&Y5lEP$bg2uJbhDp-A(9a zW>uhaqbHB5H&5&lStp;GX8Gz1m3wS0CQw@kex`)-HKHDTCRwZYXIRXoIi~NRdEJhH zL+ur+aP6|dg?Sx>$7f9rE@5gBts&I@nqPil;FB?fpw&HLQ4?_V=Agx5q?@HkA#q_h zVi4&Eks)XfHo|aw4kDr*>PNd2-C5kmyeSibVl79Cou}tCJKVyGTa8TJW?HRhAjv-~&`Dqh0#Zh^iU)=_>5}i(0 z6mqx!rTgllwW|U&`5V=p^}yZ+aDL_t zt-3)V9B$pWm0 zpcS(;dBt2XfM9qoTQ!Mnr5DV&I^6u`aH9F%Ch`0LaLdKV_xgPNYr+&Z$~@C0_wzrd zlD`utLUhZ4uc*`CClor72mdN7L zSepcMa8vv*p~j)`HnOEo)`5n;_7YC|9~)qFKhlI0M zcp;kdHW1xg7Z7fPVPjJR1E1DV);qr%8F9|d#?*k3~ z_>%uJD0xFk>tp8z%IRAj=B0p?tjS@R5&$xIQ0~`+%n8(;c`C5C_lX4WgEc#$VO83i z*b)t}xAz3@=aC__oN7N3QCS25n=S!TY2qQ9`L?j%E#t+O>%}1{zZ(P)lZ}tr)f>YQ zvA+zrOFsWdS)euyxojfa)#br6%Wl6yP@XBE?Z9iy%Q)1&-xL3>J{>DSrI<*85x~`O z!BydTl4m_~wDqaJFEW>!pAkGiRr0x|pHZHuI;Q{mBv3;_y>K-$J zZyvYj3YyF0VAEw^*kg4@f`|Q^%iEK>$Lfn97PNCmOkdYah4JM@xpOrq$BiPJ7?6{d z{&DgVaz6D`=3q>kO?)E3ux0xz(N~(ga{X zk>|$P{IhSHW>U`8g+{KwrF_xGY-l!0$HIVD?ZZ6+}!OEt*TUf-;~!=n_*j z&Y3u)w;4&+4mNM0&Pr_&=rUtPyc-KBc=iNtKM7%@@u|Q$g7j!m<;=(%7TaQ4V-5DqclfG zLG|QL<-vs6py?K`+5-GyURz=~Lk1 z5CD71xbefTgbf`eJxK)QJSXOUbBq8NgQC{JKI}X0`ZxD_mwRLxzaC$vMBi1Am;tJz zy}9Bj7M@f!)yXWUB(#dkCi=BTM^-)S1Z0$C;s7H)z^^YHWcEWSqPI)*T=_5RpCfKE z7+x7akOL7I5K}hm@qW{!A_NJW01m72UDszwEEvEEROo~G{=r@U=3ejIl})(rd4e_g zik-(8#Kuk<`w$`h&MoEKZQ;a#Lp1$bL8(71E3D?rv848byN63?bWr3UhiiMjrg5da zD??VPoqbY>RRXp#Fqe>Gd}}>n*5D}WvXesqR)G4(aQ=@I^z7gl!^vzLYV$WR(14yf}i4=g)+?)z@} z2Y3COdwmv&6EOB&SwIZnRr7He9=U(z&W3SiEhTxm_@Jmht7Yq$@zBF+jM?d|;he)HUH3POo9m z_sl7=bEB@_v9pW57g0jV24ri5I5U{jCqfnDWxITM8sE3`sjkV z?Yk#51HX+Jcq0M5H|x9DB|rzKCz>FrD_uDEi@IKdx6B~SA8QiGz3Q0_jedf?lr37a zoD9rI>2bu66urir&BT&Esy6w9yZ+6+uI~jcz*fR_hJil#p}ot^WC8$=Q>kk)QCA}B z;IkL{{lW{+oe1_In#bgoJMB6yK~SWdGfsC~4Z!*tz^Gxb1vbYD;s1{@ne599`9`g1 z>w`Lt+&%u}3Z_b%+{A2ewl_YSp3KGUYbccuanV&Dts?-BX>&vuGPR`$fx6;X zR?FqHA_=abr$KB#D2qx+i>X~r6dj86lBeHZv#r5$E$Wx`ED{qYbs6V`)uql3m?+Qy zU|`(~*?z#s0{%*t7e#qUa)$XOs6xGr%*TiF2|!KH4Zwx0>%fVYIwKPF5zkAIN~pj;?G@QP?HluHHaz80vp`kJ z?i^>CcvFh9DkAlzHL5lzI=xT=piAyuYI(eQ#_G}(vlI)#D8;K6_O~6J5fd3n?Ld1#khwElVD~9v3?^ffl|MDXE zRxaNI7-j;Z-Qa*g%zr;SakRDPdVQRZ_1=ja+=xTzK48t`oJ1~%M8)0y!OO!MevX{*m7ae z%XLYz*g{28CahJ&7%g+#gjE%k<|Ym{Hwkkvu+}ty8WL&;QyrPcqsW6KFdJTD7!Q_z zv4UmwCCW3^jmb}fdnJ@46JRYOoMF?4A_wGN%~(XAsUpS|Ws9J7^h3;U4R(G#W(}f0 zF>Ggh!Yps5ryIiZLUGIuv5zc(##&+ua2xoobL$+2GN|hN$VlO$&$StDCkD@Mej6y3 zQ>kjqEqe)56(ys;gi_=emfkGOsZ2Yz!tts3avv4*J;ryhF+;(Me$m^KKHs-?_ab3BNk0uhk|hf|yg0Pdg?pwQWu zm0uA5#-5U{f^AqQo_ujZ)d4P6-`a@6PGPu}j#C#ZF>Bly89XSc0Py;?mJ4PL_TS#70~Sr~ z%0gQc5+CVo0r4_3`>QWde4*t>E0$lHbU77w^22UU891Tq*OlwB_3^4_$m8jOnN77V zU}n?x>OHf0`DuU^12et#M#-~bKQAM{`I)Amg}ZcaPq)Y|6Wd;J$&iT? zP%cZ8am|_8wAkuUAc?^%3U6iXvpI;P3drs)-?<_{jka(7bn#hh6=gt2@Qy85p^Gb= zr|1}SDYp|U6R1aR$?@FTY!-8o9|mzH*hF3@Go)O{&zpV*3GpOe*%dZKH~6yJ-g!r2?As(VW(phob%XxzV^UJDSKlSf!@hJ@!gX3iMq0eQCu z2~BHdi7ZaZ>&4V2ejh7%f1ChF{!ZYey-zkSX>hUeuv!@qpaKgXh& zLa%D|f1VZ`<<42OFN$~$APS3W(E~c2XYAEq8sFk+2-k0ARVjjWhxaH^3w^)FrvL18 ztML>kTKo2m%P6V6Hw=fXF&E)uk#6+jD#=Pt3^RndCBG)srY9o=b?OFU<#aND0E9XP zkN;w1uMfG@Qum=#a!&-=p7^`1J_4-e9QlHoDITkO3!09NJ@JhhN_sJ-L-p0E%kP3F zr|XI#V1zoPe=OcC5yylod$ejK&HI-p@5)SO4SZYp?Z+_p;%RB?g9(XM=RJr_p%KCZ zlT^E=7YikEnbWxV63ei!s^0@YbnIR9CKxYWuNshAHRpw6?@+^*jcJc;{XS3RgM-9N zl!t?a0T7uqFEFX#X`KXx8#vhGkY~HqQ&4lk=Ywnn5}=2e)<(z_OG=Vmt$M|*webPpwbHQd~a}tbgyyjCSt| z9t~t<3!iR?aqmNzKqsUp!@ZJ%e>zmD@=W8`3J?Xdq8(P$Ps~-Sq<4IY9Q$K){_S`2 z1v3Rp+degCPwsz?mUaETo=Jg0QW41dlSo$x&LRaRF(I=@wYwVqkKcI{Z$dGa45*mt zrFdijCNKYxvU}$d%)i3uUzaoM4x`)844jTi8Y&;3 zX_6Y32-+Jrin_fo)CQy^)S(8WK_>-vwCI?V2cSA&t<)zFL@f847-fzjui_L}z4S;e zFSzUsXbz4y#&nsU)C%MTDFMV20Wk$c$0KN!u(&>T@PF*j?PHqcrH>@*RII6p%aa&} zjgf*w=Iy?ZGrkf!^?#e5f4iS6&ljAas-P~6AOQL9lO!N1`wO`zl2z`O?12d^dBbM= zwYg)U{QykE7g^J*qK_;0*QCNZl2D`be8e05CyT@wd`LC`BJUzrHMM#6w#*tiBd2yK zv7viqyc313)>q;qYItL$C93Y+JYT6haK)+Y4vbM}Rqim;b#s)s4obW4R2kFbq&UZW zzgdo>y0^VxWc_-4O@4H--p0sDn0=p|9?k+RH7j0H4DvTWs*_B$NOc9@mS^Vz^OHr! zM)$46sH{7HygKvk3GxA@3VoFD9MMZfVpmP?8gSVv>jTs#S5}iw;P2ji7{aeDQdg#i6rUWH8WjGZONQt{g?X#~H<;Ad z&dW^CnZ?OFK=uaY;@GJ~=@|f%sejyBv3g@>gQE$ayCYv%mtp9h9vy$$@zyVZ7nW*nK zf?qN3mwdpI>;oP%iWG;e!D5Z-=2hPk%4y}#`Ym3CD{C4jPsK|A{u+`E&acyJ>Ay=2 z-)Y!C@k`+33p=OorJ6Kw@kOuSi;z$PZ5$#4_I>f?0W1GEUi4>{C&S^1xJ&>rfB9$f z#mGJWAakV|+)W0j3v(OxQB~ktFEM9s&noc-$Ks)na9%ncB#O<{&NW`w$G~z+d;447vK1?x^2CW> z*fmjr7s$k-ra!W?oXJ zf`?!sSa1mr!QsPQ1Hql(5}X8g*AU#@-Mv4OIoF(PueHzVQ`Oz8x@zD2>vuP921PyN zHI~9-It?k@v&A5lLe?F0;dpN^LJu56TDT%l6Hn~-Rj~fd4W(yOaTInX(>-gkiCd%m(TJq^YHhKFK{K1XoMoccE$k{k<qYSsg77>^>>RT}DvjJrC^+6wDq`@1;FUM`AcC0#lxv;3w&kNbpsn2@}*; zC^58jk>>JT8C~%ReJUmoq&6Q;%B2UiFgn2=AX8fX%vv?sTg)hY&Aqp0`E<`5E31H! zUX#`5^FoM$fe7^~*s*pEC=}MuHttz$Ne(l4`cz1QR2xNu3cS@y;1@w>$Z%Yi;msD$ z_(l+@R{kkgs_tLaF@uWbFKPr`v5#V9ktTq>HvMv}OM?R+ciNtRLb!Y@G|JEdl}x9K z64~(!WbEvrahx|9NRIaf3z06OZxCg5zriA;vP`mM#jGf&ofSwYz|i%6xO`2lthS@C z;Vw=3Q{^_<|Mqx`ge_0iES!G|=vXk(pHT4QQmDTD!RBxt?R!s);OTBk!+IoCA@`c% zNsUKV>4DV9@PvZk-8D_3l)`KIvkJC2`6UaYgpA;HMP&%lvtyuHr5LK!uw?8hG35h! zA}z<#I01Am2~%d_LqPHU01a89NW_>k%tte-5Dx}q!R_9kCtvVK5reB~eDK$ml;U`v zGKxV(m8X_iEN^Q^+4@T)pv8TStn((rWwrk1O(+QK_d-#WKPx01%G}+{2w9oohDA$< zXE@gC(PZi^FbgEcc_$1wdy$w7y^X4eZHVEU&eTH1agGy{8U2EQA6imJ1T!*@`b|Oj z3;Q&xtg+?Drxy~PSt{`4S!18zMn-xi(MQbSTC&D45A#jdcF~KmEuKr_4uzw=KoycC zhwDaV5)h!TPlw4P4)Uzvp?ve=2MLCKCNGura03Qy{3sr9r2G1lw$6Ajro+q!+ zoPQ|NTz0rDs+d(Twt<4|$vUDWAcSD~n@smSEDN1eKpFMN269*I z$;DBS9!m`Lht^SCPa#OSDSC3cNv7>+hpzbJPObAc-e{wqJv&w{HL}b?cc-5_nY0=y$cT{Yvv9D5uW|F*|@z7t&ZltMOsZC@8~JP-^Ujgw8?W=9f5q4E{YT?(J+%LW0vb z^R}J!F%h$52Z3p!7);=FX0y!q9$+6!N>b9luCiiwB>dE#In(&^dy~Zi&PeqB{8(*- z#Hncb{AeSZ#Oar`i<-kaau@#^$C@L1v504KV)o^`BY~+aH25Q1wQdh}{Le1slg&(gvBOJ3Z2RDbZ4OT9t@aPJ}g9itYt zD4n!$zV0l4)LLk(eIcit(LP+yzsnhaCQIciju;#Edb`EHO^)Svy40W^36*yKAL&w$ zd4)lOf3M+!67Jj2=Klzn4x9ZwTsn69ej4~QU0Nk^^+c`x1@Z+$?@;?Ft}tfB*hawj zB$eikXIbWO^!oe%ClYQd)o%&+PX$-!#s2;W_XUedev2KV9S?3d*Na-o=pdmQcL3g2 zritL(=_}qg#;89h3d%(tS-n?O9#w+{!;%7W+hFGN3d~x@`bx#pzj=i9@D2)l|H&g< z6zGmEZvMP5LQBVKt0<0cp0v-HLjEZ!xnP(eXBoj{mW5d=%0Ym+iIcKgV27;(iDAVp zlu8*r5LpmH#HWtO>sHC(FzNJ>tMtCTN*Ie8pYNP060P4N>XoY5y(UDa`_?{-Df$5S>^40ZYhhzBU5>cxy*OTK#Z60vPjZFb^H1gC3W z?d|I**l46a2HLVI@;>yd$w1HWu^$* z5LB4u%A>L0k|@J%W!+#-4dUi79g%mU?$ba?72r^EICfW?tlsit5=5#ZI_V&{^sYNX z0Y&ykaLvK%u;{nt&PP!6NjL(fpPWZT!}SGW1ByR2t7_T08&xa%RMC%|J@XQ=A{)+s zCrnMh5FQ64e&Bpabc@Z7G?~?Ob_i08#q1@l>qp?4->?%Tru)k(oKd4^?OKWP@14R# zzpTQe^3nh2R^j|=TA!--Jf*DP=ioW6e5*FC@LtTlz%Ge^{%0|Qrk_7h2#rG+I|&|6O{>CO^t`4kK@dUQw9h9U=A-D6HicNEk% zc{nXGheqT?5k)9nHHM4xv6~S-Gt72Sa2{xv4yj+DltnWEnLXC*z0vdWc-kWPNJSs% z20v2xIK2N-9X_;d_@_@;KV?sHY>KWS%Q;uuTY-rms`guR%}zKji++}uacYkLHwyF6 zA4YY_r9x8>@uI0Cv~);tA$SmZ?AQcPjz|l&y3}69oh8!TG8m8`?=*ykd=ZcQMhvg~IMhE`MC)`)Cdy&`cuFBySzQZeZb(eBy$0<$_Ic84@h3Y#>}C(dcazO@QypKQ`- zunzm72Q~wOUP3aQVwi9~z%-=$fwti0)Km zTQPCq7L5qTvDsVE>m~Ltr8x*TrdQnN&wu-bL4ei))E#~#U-8JfWuiT%OMllFJua;_ zUM_#VQ%^$O+95W|ZFE5@v_=YgHxk|;9D2;q#S++ox+0JjG2i7Kl(hFvY1grUne=w- z=nZBp#7l!G_UKo!eX{FiEmk4~q}#oyrnA!ysRW~y+N27!9eWqgTVb0ha5}vk@8@=b z=M})mYf4|p<5_us2wv2H#!!jII>)Mg zS;kcX$ph1ckfsZcLlwZ;5lJv}mGJ0%pF=)4%~{+=icO0{iH3g_9*c{0`}ppFLk3yy zMykMp<=RD3jJkm^WYd(hN0Di5c``ljIF@xi+iexqS@PB()QQ$H0ZO}94sb|&#l!P* zHalf4+~G^E4+ekR(4ECiV_>R1_httL8T(AmESh44hKtUH9Uo)2B)(C{S^@r^)h&JBubM`(4w}xNm4V{* z+x_|);cqD;HSE%VGg6B|JZ5zb6F?*Ndw3gBb?Yn(`oedMOrv{_(i~qqUhr-ry>7u> zrxRZjh?|<5xNe+@^qCpw9lx_(-r4^cVdUnyv`vOPa%(xc(qNPaNXkY|va!t`Pz@l4 zim`7sAR+*IxDL+-Mx{5a4}VCsV29D-E3xI6$d1Hk9vOM`x5Wn(Gdf5`kxDYv3;!fY zw~RFOOYRd7I+p;g)87h`C1yM$e}gxja9{_yUqpG?+P}3XMTvH>JEvnNk0v;kB*Jb z29g$`s}7)hrJusW0F)~EqlP=mw|DWU{ItvRzi5i+=$c~!Tb(WlK=^);euj47LR}aw z%4BG_jIP|m)+7Jsy*m}0LDha1QlU~V6GVauoMVg^rJWIG60d;wShc*P(?Hu4QGaTl|h;du-0-$GLOkh^l%OS_sjZl;OD@8?f>_3ypa@kURLFF&B7IY`Iy4-rwJe9`E25`N}u zsM?YrYFo_u#&TP#!K z3IS$yje$V%iIrdKb=KAR^Jl{hpn8px^hbSg27)lFh;uUt;A%DNR48mCuO0z>oWO-Q z!UTx=$Vr@s^Y9`54+4)B8LS#$Vp%lZ6^C)Yh&j%S@crE$EGRbB8n$2l*dEMr6w=5R zvZJh<7FsWdYhK{te#psxeNnTbWI456QoD|2Z}yM&;9N>^K%fm5@j~&3!q>R1k-xPE z2iK%)07|r^Sc>J=I1#h;t}Pxpl~#c%ZWwa@g^H=CgOZ1sKi+nK&iSog`!9ZUn?$ML zHFE6VkDp_yyHT9d%C12MOP)&mXIayg-Zg4Dwg=)7pzxirv9}ZH>c?=*h%>$K&?x$YP8JoJ}dtqWW~3f6G?Xd=jz0=}W}Dk?Kt5~VlwctJPy5Z$0w{nOng zGW14lCBm4>o51>&9*t&^N(396#qfqtXnT6$o*lb+RXEd&3VnfIx0oxM6UFtceo4?) zg$K(T%FbUak7d={v4xQ(8@?@CeC{f%hFpx z*hTt`H&la&_;&$tmgG6f`^N%ck5$=YNp63SKT@}hu#c%*WxyZWYRSMD7p3%uo*lH0{euLz+P^_dx-vM_JYi&Q{U(LRuV-^Squ?Viomp02? zK_t{3zYaJ$x1!|IH0tg(%8if(xyEk>syh_=I)NqW&mqhoP0dVF(0lDZ#XZ`PlElg+ z*S(MlDH_4nKvU-8r#sK0M&v(j%@txg&4W7F-@joim>Oe*emrqYjEkN&6%?cF&~5o5 zZY|dk5eXY;gKhP#5ZAy|H}YY|<;_vukWg*yTe2wL5T8KxoMAa+y%gp0vXEdYF_f(L zjER@5Jx4za=g80?%&?hYFyo+-i6nzRcG$1317OT{G$5rCjM+XE=^PFJ8MBo#{wrq7 zTQ{E^Stf%CH94x;M+-ye_oK^(%GLFSyyK_=J(?Z5Xh(~wPD*?rD~2)opjdJc7nV(` z*AgDC(a#UnhFFv`tQQoi6A z=O7$!1nqwD8-QW2{%&P%Nc&}FF0h{2>&O#a*y{pd;J`nM?ffP4mF>*Z|eDU&;8v-(DiTTlHq#?0l4SOY1ErZ%g01;TT}#?e47%v-sjv-2`(Jp#zg453@ZNIvg60U8gF9$0z9^hX-U`hBH;zTCv z?hKv{SOs2o?8QeHZ`lW*$6)pURIEMF%ZMSVLL8bI+bvb5(Yi(*@2<>)?`pqoGh$#TG1s%7__(dGR$#?%dd<_YUEl?W#PzRW z>{i>nmepSd<*k8Gb~D@^W0Rcx+6&!P-b3Li$ECJF$7Rt{N2OMwfa*8;q)FR$jCyF? zXUq(=-BP-<+y6}_mR{z+uU!Iu^)4j{S~s`*yeMt2xMn`KaeuuU+uAHgGGb=dRr+JO1#f3Z#_z@L&VKd#8gyMN ztJvo?wSdh_L8E^)FID9JEfx!y$XhmRhd=w2v-38Mdi>K{89m0JD$2)WSw+2`E`)k( zoUCJ2GNOiMxX##kbfUzEY!HuP)b&wXMu)Hxf%&f97E;2+veF)k#VX$q9?|^Vb~nN= zYXtB5rMruW`&_=kst2=7`s?)C6b!ipEB~2`Z9x3!ZVvqK%9rp@AIq1zDZ%okVj&4} z61EuzdPr*}oqsYZzne+i zGl7wt4+@~(4A!A|Fvxyd_?JFk0hK^l{~MRu>Yzeb@m^=Q*emNRLh-N+)q-u-WS^JgE4%-?ms|1Y-r0{`ne-(+~#*tgjE ztCZWY-|+Vg{o(`l?YAJGMsmC-AVU&tAIp2A^FVRgEyFUF+A75g_!W^w`SQ1jY@e=10RNx1z? zAMJXx!~%9cyWHr_ozzscy1cvG=+g0Ux$Wsk4ml5Mf?A{1OC?|bwM4puAf}T%hj=EKLLbJ z%wFX8o_%9Ot~M?4_N|MVUGvbENeOhh5g|aH0R{EX*)uez%v9!RBlJh+JPc9)8*>_= zjlhixK<;egb4J`1ZI}@+22c7erHWrAIN<}VT0T?TCvCF>bc=Q&iq&nW{!^Zp{g_s& zC5YB(d$Y1iu@|rEOuH^DxJQJ|9r1+zLQWW=e@4!6(Y?P5zf(^g{uF-yru$-1 z{H6N>RCh#7|104a*!_h$+q8x0qye#c{+;tJ<>W>RI zPhX97pr#gu5(&H`;5D!3A$-d;Vlmtv1iU+>L+LL%D7S{jP`ldplG`(!Xhk+GJIX`*(h6;Qz=l zZKPxHr(t^IHE5WY{`ZDy6h*23VwnE7e(8CI(i?#NpA6H06T>O>|2@NW+voDX8>SVc zX5-TStzkMrUwr8+_pAqx`Z=Ft{Hr8O+7*~9X^{`C6ShwG5WI24)L^afvHgK$!hV(P zSm(1FGJV`RLJ6t7)IAoPLGP{R!Bq~D$yKcJ%qGKc_I0nnY4@7jdcHjkyz|GK^=pl< z`WW=_Ez%}j<&64D6-g;vlL&KwXE@!$C9KCKgiDMRUaKG#GT^0ZgfG><@z_wQb)N5gbAiHdRIX}Ecc z3xYtyDe~qrs57%gdV-HhuVYL&PW2^rYtd1jLhTrDabs@}eo#8%Zd-17GPp_W4=zcRZu zn?)DsZp#_;DLJtKH&Oj*#_JWsv?WMAefu+283x@(yy)zn%1Ivpoi+uH%ze=ED|bmTCG3uvuiX|?D`jes%$WY>sS2Q3-xH2 zUPQ}8CdZm>w4^yrK>VVl-FUHqAl_Z5i?S6k5!sqZ)t}9tRy~+PG>H_ZP3x?GOHn?;)+J^%E17uhl;+^| zGLdxh#ws861~>OmkF)%sokt>HE|QAYaYSSS8sWqISe2c{gJS63V6%f+>e}JK{=`?y za1F@auv;BWy^>f7uB&Uk3q0KoM{DRNWG&HpScw|rsrPaZnFd;0I))Zn2oPg8%lS3L zusDeo9(7A3DlvFY6HM%JWqe?3m*)v&8Wq!f$gya!S@;b*PM7`H9TRk=7KvUY<|dr;Pdb`y@&XMZ>U3fY}Y+RCKzzr`x0!@_L{~ytPQLRoA9& zzckGx6Y;Sly46L*fCd&Yt>cQTq1`H??XsPYQuR&3Gr0ZNaTE1T1dL)L@YaTtM6FO8 zxKG!?jjagejDOw|pJO0ts>&(5GfiskVDTDzTI$2l7iA|~l} z4vS?}CZJEh={#`Y8-M1mQ^n4tZj?qvahgiil z2gw8iE(w?I0v~34FVS-()$9`&Ue8-V)5vf_hEf%#zL%7Ei4wd_TJbhcZR(YX2^E;# zZJ7K9FM=)iE4w?TkC^G74rX`J+fQ4^jCm6Ul>5$?$v+(mSH$Ffm8gH3>bhB6km_=> zjp+*H<%9D#4uL7cXFj!FqOxP|@Dwwo(0i5Q@D$UOzV9uRAdAIZ^Pfg)o#nJ^lXaoK zO5gtgvGR@I@zH=y3>vWG4wNG#!SS1HaQuemzPbZ`P;}ypv=K{CIU{blJ(6Co8<(dZ;p8KPP!9Z2WRcpQ&}&Pf$tmr z{J&d?*V*QiJCjDa>;@7(3~B=49&3oQf+GihpDcf2pt;M^AUMPtX+`xM+3HIc&G+@8 zMlP{+^aN1@)F^JT`*{%q`~4O0YqLqh?f>jr+IRRN>kwa1=gbkg!7E1O%difG_pd3| zHRghfso#yoVc--iAXk-|xGe*j@%1s;tDti)?GrOTs@-!>aW9KBW699&Y=3PxG1;B= zJQPg!YG!3bNj*s<6rO{)yd&`YKrJV_(0F@V6P+hnA;evfR2d<^q(wB99}J&G1497L z-_RQpwi>>Z9!1bF2&pL0?M9`iM8{P!xN0yPEIsz`S zs%oVZh|>JI#9AjIZ=5<3;CfONKb2y9>2)8Pzxr`g{lp~VoX|3tF(}o@n`)CeXP<*C z5QwTqzrltsX0Z*l&w(8~6|h~<=pg-}F~Apiu1e;8s7e68Uu+bh;7rd1XO(SA%iRWT z>t=iOWE#s^sM;0bNPQnhC0&9Nau7cq2CT!92i>|G-UlblagR29Q9kB5#kj!Sem;kk z3Qn=c;4Fol?>J%_WD zD7FltraqxHIP>+;$E2{N$3OZe+fjMnIjUp}&Z>DVX|Nh{#NRwD2Nf7)_cNn^G-u1S zfaYw*`L)t-nVFyCES1qTQg=+1*VMQL40Q837QS5TtL~y0Moa}FOo}=fZ24DmqzSR> zx$PS6zM0|kE^WW0Fq&m9Ooz%V@QmcVt(Vb}qdV7aJGZitB;-WcEynTj=a{9>CwV$m z(Ttdu3ZrVx_`#9W3i!to>%(Z2jQSwS_b+~;6mjLYCY6z2y+7J*$kEh@Ch+`3%Bqx8 zy#;D9P3W9KXwt!7kTJQDXkK>3|!j>8yhSDn6ck*PmG%xYK8w_F5kG77@<&Kja%F zaoA~Qu!6_a8sn{WJOu8xHbxcBPjE)+56OmZiI4%fwuP2MM`rLOIquhKKEz>m3x-Z3 zZ@H;;(!n{{xh4kAKPI3*W4pe-Gj(k?CoSK7s>tvm<1E@PfS$d}geAz$=Y4(H3tH`- zRCF~X2!1~Kx$2M;RRegR3t|n7_+n~l1zG(I<(_xpdEfR@wf*`&S%_14$K!MJb--2D za(-gxvvW#YOF}GHV;7vd$B@Dq{pPeu6`kegO|6IK@AzyDP|IZFAPegGd1Y!wP1Ipm z@tUJSM&Hs9{Zbb5K(!IkI%z;TqM$1YIUX{miHP&4aTJU3(qZUHCXNNZI;|IHj-X58 zu6BiHHS@D{ZsS-`&*j;iHnqLbWaV`4dn&9{NH;Oie>5^-sNatk(e-w)p1z!+{K2Y|ApX6Nuwy>8 zeq>B(lo%*U)7C^LDc5*Xu>kJ%Ow%WcExjD0W=lvZylpWi`S7#KGJq&D`eAX2oJ6G) z7aWg$=JcuHj?|T<+w6)O_07u|-D7%U0=Kdt{k^9Kbk}L z1?Pz?!U6~kI1a5t`eBK!K25a-{2Gr{RGqLEVFbrx&7Z??;EX}IpX!j;J#9Os(C+v( z9^11E6ZAM9i~k*nXqOPChjHtV+l~ecr;z8+wW_5d3EX?C5~d^>$M?iIC7}`Re1!@> z`wOc!l1u;zG2kyev4*OcRXX%T4Ub-_On0EzVfzSX zg#~WBo`cFV&yM45RF!ry?_?+`S7lWM9n(q6GxE{38~GidDz{Q!YJ%m;vX<-bpwDZX z4#6%!82mWmN-%Hi5xb_1lh3oTEMO4Ykkn;@Fs4*Y>l6Ln`90HdE=JL%Z*)9pncnMs z`XZt{7n2N=Rli9e@*#cFxL8gPY8;}Ln8-oiY0sr-QO$aNad;%OUvC^$y$OvUrP9WW za7kq&T6n-TtB$Tux8*g{k}gr<_0i;aBl_qV0eT!TZ@d9yV5!ia#+Oe9*0kQf=@*|( zjV|+_LB3qSGU(BSZ=5kfo!D;u9O@>Q?ygdUeLMF$Xy2o5hu^9+zhnz<^XVzw-RGBl zVTQWiZJE4jUIVSJG4@*nkIh#atUQ4C4pZVTPzXDVX2K_X z)fA26@mGNg?sz2Z2BjPk>ZxO z^uvY~)QC+;+|W?qE{}xM-n)5&6kRZH%sTP2#sc74g?7jU^TuUe>gt2NwyLoe<;kDd ziWrOyo4Sh3cbeeJZX^ft@y@Z&V4V~tRDU8Sq`N{{6Xs%4yh0*c;PKT z1iojWQ2P5yUfD%GQqV;`RQClk=}%YK$j}Qh3NIm9Upy^A%rEw_szg7CLYp-y`O!}& zx^oM3j8mGfaFbYllJQpiNsVE-S-TTjNGMqY8LR`GMRoTnDZ`G>8w6h{`m&*HM0#8j zzR?^Nvo*cv-hZC#uw03io5HnsN|2iZ$o9JtNj8oI=o^J6a2u`1C+M#qFdB7o>fA2e z7Y%$nT|=(eC~=7>v__fwoC)RXhr6ndD!LlN-w8-G-4L@H>Flnj=()b}gISX6(vadp ziHw33qK;ayOX^|!c`1Vn;iNT1o-)%74%OF<(;tGdV<3&+{FL|jeg9U{!k#+tawdnB zlMK7rPQ$LMq_!V5=@o_bzPBAta^2!=hgF54k+_JrhM6i{Wd?R;6RJp`R-^YcD*~1Z zM>6x0F9NkJmu@QpmVEpni(tKiXT_6xJWoNIrOo&({qS%>IeYWvpTj;wtdVzjsk1tR z7n22pkyBUc*E5>+IM=u?6SZ9c`g()C;X{()fE+?b35pOG^agses5NQ}H+bAW=)u1z z^*oIh+n8e$QD)?}-RMrCa15XQeO&Z+yNBE0Z1@n7)p@SJu2;3d)St}`T_dow~&N1VSosg3vypWZSvRh1jQcm9Pf2Q8reqtk(Tuz%0_C5hkO z44EESgJqEvnrd3&CXGJ>H_(9G8COW(pyQ4F^?7IUZ$^I;7)93$(Ci0O(o%lq}nENJ6@Dk zgA~-Ro;{YMrA^VDUrF)p_ zRg1M++)rm13ez;Ip)C=WxLXQ?b*Qc;$B%oOGlKectfeW5#@x4cH)n-OE3r>pDIVf{ z;|sGfwzwZ3P4L zK?pv$!zR-w5hS{az>|E5DV%`Y-{|~cMSLt8ADW^9=y_NwBQ3F$K`RA5Kiwgr5c+;L z9G6>Tvd;K>`GMma!8EEFOs_fy0ZMa6r5WbW061Fl$)I z2(hrcs!6L|zwt=Sf1oo+&H56*iTMw7zHvosuyETElx|8h$AifHdLn0D^mM_i=QlC` zfzD~nFNuE|65|E58pX4)DbiR_`Bujq)e%Khi7!lS%exDxu$73>BRUeIXAB)(8wUat z8w>sWAKfx;i{=qw@m?nSk%s$kUW{&KO4mh~6JzPqKOns3)VMWPLKZ zx*5jTR5(7NC-#7|u}mB9%+M^zIo6q(a zGe07;@jf?T_ebXycNk~x(K_3prrmlX>qOdfyFK!;(Uh>xmr6r)!Aw4|Hy-LB~tE;R1hgxt0vi@N2{*JAI(3?;KLQBNDYD%|@p^od{f1 z_ex@w<__I9clh0iwITxZTB#Vw&AI+0wE1f|b~LW(2Wj?MrCRwzpx|h0H35J7HpCfaysk`P%V`$AiSuwAAQu4U^#A9_983!|U*Es=X{FCpAfj0`gWG z=@x$%=S69}0PBR9MiJp-51dl)M$e7>C!wOy^+HPo=3W%KAkg>%Q)Y37JtBusZ3^W zLOKFZXnvg>yxtc^pj`k)_(Lcmc}l)8dqc$Rg(^$nsVXa4W`jx~Y5f?iw`<|llG1!{ zUyFw6JLy4YFTylUKF@P8;>bO15w}=Z;iq{RV5}LIGP8!27{gwVi;8V?B#>qux$`yS z*d@XRX6DN|qzn-huny}xScmmJ4n5J9iQYWcRo&F!JB}s=kjqM9%M`C?5ewYf#a{umQFZi z(PtrOG`!lUwQnxOzfnawHLHw&j5|4}za^b6_)xyI>aj)i*;V_?hwBys>$9ASVxdYh zjja4OdpRIu`d2mcn?np+#SlkshLSv!wQPd1w%839e3dJea5VL|1p}P<_wi3%MW^&R z^dQe8iPUS!iU+7)hvAaA;?@1+h#+NPxevtS?5Ep&Qb0$#iXwRMLoGVkeX{gUV-}-J z4$^g}BRvD8NC@8@Qnv3mDj=b)ao(pW@)4u7T5BmIVuSybG0imF_s+57{qjc#?ASm|XX5s!C2 z$AsfB&WF%SqLjFRPSnbFn@UCAy zqyl^Hl|D>YacCEZ6bZ=`;{vl?J*&p4bg7tfJ4RH}Xn3ud$#@^Hj;aTw{d4vxD;!*x zcA$t;DsB6-atA1l8)Aa=qqTeA4JOBxNAa!^l|{3xWcM4&JJGUE>64pocH75s#PZHW z#iF{LBJ)OE>~-mMhf2?v1X9m8>k1Ge zHo5&B_<6MANUUb`!B31n7!gP5J@?H#%Vk;zZPW^Yz@2%M2gU$W+EIU6%b_vzEgmue z+XkL^L$?t98`n?PD~Lb655!^)YxDr7Q_XM#cay)ri2NK|HGJK}-YPvXkQEPzH9|m{ zXC<+yl~aF#WK0j}%Aau%?+ym5inmuQFtf`PnW>aEa`RK{ z+sTbG%w2GJtqd0}sVl2sw+ewLHB+)@c`o%m%}7F5Gd686Q<I5s#GAPc!8x=${{U zo^GUkn)?vj_pI}ey`!rkLym*0N=K}&#gYruf+Q=qIkt=U8*uR@shN0;g#JVVW-jdS z5rR}C+xALKR3G^|S>@GlzUC_S)kO;9fJYtS5?etJ6J-N_U2V5qs4HCNTV<@`km1_U z(I(8ob7Uu|+(Y6)_n?XTV|`(=1aAOnqP{jaaibRw?cfs+v~2`U)aKaW#E};`apbd5 z9ERf1#KSkayZ&`#N!ll1|LOW!K5f6C^La7iw|5X?+wMycR|*vcd2rpsedf`xhRpNA z$kzc7w>=CdA94GUwnLFB3R9*Iz~ZmHtUteEF?w$8{I1ei2~(x)U}WO}@R8!iSAH z>n5V6%Y0=CHUWiimb}8NE6JexFazLF4<$5<84DAA4YNX{A>}oYLfC9}CyDbyA;kll zdF0tVm|V7fbWj`eve}M-4(j|>*vojd7WTQ8y8fMRhRnd0r*jAK#|KJ z@N^NMXgaP4`Mbc5|n z+VNqyp%A-Stdilj%~5-v)4DsRnyBpa*UUj?_HJXlV+=MhzN~5b2a7{!_r(Eo*7jW^ zM3Rn#b2j!DSrU$)xnCBIeI4OA5%PRt>SxP}?$|zQjvm-mMl}zglodK@p+`Hs`J~+@ zdBiN(&!>Ix$`>CS#l{gf?_wPY58~&@7D4&KgE+t)GKl_;l0V=mw z%A=OOYxBa>4kBU|@?F!#Knd_U>EO-o5*I;)gQRe={C<-AP~i?CgRC9h{jKqxd7ZpY z|H)HC`mg1u74;knIVj<6KNE>{p0*!(6)w?s)zV$N{17K3hPKnLS8qjhZ=em58+Fuu zlaw3^1J-$YDp5L z?rA256-2{;CSMGOnhw(P6Xh8*cNh|_;G2UA#~=?$;!tkBle#-T6OEJgSJ{wU+8O#@+mpx940TVB2yc4;e64R z)NN9~^FXtW4f`n^r5gFYJMW%@>PTd0)}h!HS$AFrP&;p$`d&-x^WrEIw4Yz&+Wx6>(^8=)d+CN?Y6add2I01RohcP%n(NV7Nvaxm+55XFj!Zydq?GgLcX%lhIhl}F4nDdJr zPSyw78$D@0dVZdn!THECvLK9I!#B2ote14gz{ljCk<<{@HnyogeN;VB8|G=1A;LgA z(m^jSxaD65J##%|8^&2{HKDMr?z%(g$;*m_jRP&MI>b9;K6&Hxy3p%|xvx5N(KToZ zYY(3mw>0pVR(I@7jeYkdm>mGTT7M@L^G|7pKJ0fPpFU;-pR0)Opp_3ofZWF5h`Ch1 z^^-Y}j_so~PD*sljI#PA62e{*7;^NQ$4t>wC>muU^{}39f{>iYXb0J|Ud>1i%R>RT zn&(bkwXvn)g7ZO-(}^2F8n3v$xJgU~+6#F~*dR~abv^4@!Y0dzerA_gM9}SvP8#Ev_B*;pny*W?(6$hw}z~$d+9oYq>U{5 zXXC%K*y*o#lF%Io1j}9uNMAA(9w(t3EOZuY&pyf2it~>$?V$E&A<-A;bPK)0Jz-hb zPm7FLq7KdJ!SBaSq>16c64B_roC{~=8@Z^W>$t>2n^Vbr>UY!cGyJd;v6cd`e(1WS zJPPm^%1CX7f8C@DJ=tEI=aU>}fRD{iXT;)Se!##cPA+ZGp0fn6 zs0_NMt&JX)VF#RW@hVvFZ*6tg=90J;;*2vPCs9j2Mzo4L>*bDu_@}BW3JuO5gZSCp z}U{^f(uP6nl7P(vbXwu_YcOvlw(HROy3Yf`mCqR*_Hhydd*`0jJJQ%ZOj59 zOShDG#@oiTMb|UbWtgPXoFi~X=raJxlusZH?g+tDJOrlTYp%XM+cFzEz%{)v(>qI% zsP|zj)we68;~87fKpEpXwnG;qwc84^HY8O6)J2U&P#*Gsggi9XLO)v z>@Wsrq4VfdELJKb+5Y%=7M7JH{)F%DO#K$>vRKzH<~F-%O@o-PCi0c<*vXky7dyph z0~AvRw)6WTpRTdLP=3NbW^Y!&gy7rwI9e;{enpS+=ADA;^P7lERz~x>GW3m+ts!@J z3Ltj)ffB+xOqCSN2tJVzVg`V?R4Hq%iq6RZ<*Vx%sh?R=H-Diljf2Iq;RK@4P?l-n z6SZDhr#PuCdTh!EvX5%PJolylz*#!L-#>3)WJW(VGlRH%)4%oj;a_E7RZs?o{!<2K zn>7&7Y=qzhpoH0s7p+kU9ncU(MTGgYl8DHQYK1ucUsKe@doU1f_Bn#uDqj}b#kx96 z1@F)y)E%Bu&(3hg`UvqJcdxt#CjS65%&_h$d$2=jC5)vGy5&r_SC0Zp!It}KV@Tv7cCFNxP^49JF-)C^&<Z;=ZoNon>LJ={+l}z7x^kO#Hld3oQ*}i(MpB`tu;|h+!N(|I zAQ>yZknix*sLq(8vrD^k4v?s}^PByL>idKo-_meQEt=H%Pk3!jo(>TfCD{M`Ga`6b z{k@;U5G4IK-cu5y5jgYJeoFe!4_n>Y3>y)eKUy?zLZ(nEHhbbrH zC%dP&2601sI|kGbMFbcq8N5?Bj%n38oiOCQabIQ3vd_ntbI(|sR2SDBWyu#j1FJ`9 z?dYelew02NZd>_j(N|gAjZCs&`CBI)(k#4H7T#pfT&{L?d1}@!)|nmGzD6)%HY~~LyqYc@ssM>4YqIDs-nXu2N+`H z1RM2VrbA#&zwe@AY1NI*=P9iNcf#Xk%i@N%ylb$kRVvZR!I#TQg zH7>l8y?xtS>L)<}9S}~)W4qa%LGgGT!|4)|*t%U#t+e^o3h%y#j&^0XnI}654&3N& z=Sn{U_rO_^f*iu>2-$-_V8OOD~v+=~<^YKf{TSRY#2#03gM%Zg=HLj8d#P%!n< z=>r8*hbg>X=BuX>D2dg;*RwJ9wRf!Fui1$F!vMACo9rew#Upgv^J(Z3<^?Jt) z`hrQDM8uiL443(b3@2XtnBn;6<`KghDmJAZrH2@%`F_uEFVP<|9A^XY7~;$`{}AGK zeulX4pCOK?mdn-1=3hv);t~uKL{uRW*f5M0`*I1VS}N8ucsRCKb0ag}gudq3zLCoq z?DePv0aX)qFCxC!8G$d@0i1dktk4}RDyY`J19Bp}tdnRa4o{ZZ2Tg!ioo)Pj#!t+I zZ6S$Z%ezAW$T|xr=oBYhLaYIwAVFRD9$@ody0`ohA z2Fh(raK}0qm)$3B_0REIU z2BD@Y{TsUb`SUo&Ydyf=$C)6`^R~oL?EQlwn-E}(u$lh?vDv~3$LxkYSck(CCn7m# zhV`7<#{U6{HflX0QDhJj-7p3bQPDv37H)O>wGVauz?&$X;?^be0(#n!)(P!rX>0r4 zB75<}0@3jP7iijm(~HK+wl^=ELP= z1b9d)=xB@3e~yoPOm!Q`a`*5$&tas$cLxdRtE&>Zf09Q|CB)z^--(!SENeugVNseB z;uf!b%6jG$Q6YZ#iM86t*2rpT)I)*7(*MT~b{aL0k13{ur)ru=*gqrPGK#W{+x;GM zcoQ8)_h90lPr!KFR6ht+<{9h(tVNN~kQEgur(W@^KjyXu3>lEkkV+t#m_^vx!qECc zZ<1pt^`ZJTK8`umtX`-#X=PA5fYM-h%|iH+W^i%VZV=UB;mM{2r+eg}UxP?#tauM2 zs1M7ESwSi4PB#cQYCs?MB|;kc-AJ+9I>b{-Xmzv?khiZ+CbvR!Q*Q0Q46j%7Q9>nX5qO3aiR++&D6zAkRPnajoKrXa@age>#j4`Biu8-??91>Axbx*rr_)0lOG74@jbSKq$P zRlm+tbaTCYxZxw$y6jFGNLe-22z~qExJ9Zx-j5mH7-x_r>9{57nbGnM{;D^vPst=>ka7XzO5%lLn;_H{oE9ix%1m6D z6}-5|evAgPfaQZz4~K2Y)#Pf20-!y4l#=wSkFAXmpYXWere#iANw*j|jEnk{fV5vk zLx@~nX0ZOW7u)YVNaLY|Lnc&%2{?J4OGf|!DA;AD>;hrA#U z4Ax$j5}(s}B8vM5JkB_}S2l)mGPCynq$ucX$OibXmv2s8AmjjMt&fVZ0n7LTA~pnd z6pBni;!&2Z;aTcPoNMX~LNJ&dN+Q%9lBT360n(^{bbkM!{NAy25K;Pn(7T-Q*%{>w zz_j?5*hQ_0tOVQG1e*j~sf4zDIW znZdO!?P7!}ew2P=_opB+fN9KE_|}~B8|$ALw2V@U((@*tJI4re3pB+;z?>lA+jb?e z4KeB(v~~MNz>uPfH1)(|lQZ{*G4>iB%5CnHb$0OHTI$#ZZ@De$2bQ{a~=ON%|(X&4kkZt&UEw@qZ3&KbiqF@j*1VUkNl?mLhMd( zyBN*!W(moA-!I5y94MQ|!Ny5vRel!i`q2-iCmk0SH@4C+pDS;$@|}}=lCO}V zEk5lg^Hqm+Y|mP@A&@KU>PNUa6epqOpYkf~%w#CpY39?WDTRtRLPm)kno%Zg2OcCp zC5TN1|B+1+)U5zT0uW0@tVna}0|=={N?HgD5~K2VelV*StIJO-DUaS+oTDsP%stQN z3jrPLc}0ZWn0yF2*3-_I#vdjk#AwXmXO`C`QyYsEy`=?>ZZ?c+)7yw-)8FVj9ObU6 zTQS!sLE6{&9fu?NGTgltjk(@F+gL32naf^z8FAeqiI9`i?uSJ#j3@LfUS4&BC{vI}(kqr~fO>hyMhL}K#9hwb~e zw6XeA1fmBPNt7>Z`Qe~*upG@|jn3?l&Ogfst*F5v!)@wFLnb5P0GZ3;H-#724RirH zyg8lzyWQoRoa3Q07Gahh7gK$;vuMu6Egl`gxJKv>PZZJlgxZUmugp-$5OJ%4AkO7l z@i+x{MiZ0v#!pvr5!}xUe{8AhKsv|zd?vkm7m^fjkafh1|0QbeCPGq;oyCrd+F#`P z_gOVV^OL*v$T0E%xQk2aAeNx5rz3Ta@)Nvh3Ce7G_}QZbHRZagjz? zUw7J&y9?kL<$&?6$#C2bcK5)1j z@{~VvxR{m5wV~fQTwoui3(1*|i?N&+xrDxbY@AebYPQoi_RcP1CFdI!qyCq;67;o9S49*kQ%0HBW?(hH)hj_f~Th<$6&a9U8 zxik;(-?F6+elgu|9YkaZ;SpxGWQXJQ7&|d*Avu1;aGTl>7|w(67lyki`-S1~IUH7p zBLqbe9v+CB>^!R%KPtZZKX>$*N`t02*I8~5Tt`P9iU_pjTLB&0HpW2N!&77h8g?qu z4q=2DF^+YJdoLS6E5dT1GAR_OObYK+!^%2!yZu9_!aYMI2N}o03Xjh^Upn^*B+-tjvG5+Uxk7FDQk0|#=c?e^yi{*98w6%qWQ*cSWASvDb=(Ip#~COV|7L# z(SRSzUyZeIY#Ii}D`$_eYpOte%}USnm3OR;Dl+|%wrQbAEC{bzf$$n*jOcU;KT=>G z=r7=RLbQtDD)Ii2*L;)uv8e7#RXb(xwbRT6&qY=uI}4LVZV0kihTX(D+6o3!-^CC0 zIw{7K2&8F!{0{NsH@-Fk;%kkdy66L7J8X$7Hz_V+Xzq7r6V+BKSz;xubmdWH5*2gC z9avJ+to;;G0u!k-P74XJ`P9}Enz_9mdB2=88aTz5b;sE2PA*}e=o+Ud z#3sMIihLo;c}4}zKQZ~)U76|~v8n2X|3QO?4aa%^_g{bwcpz-YkaQ1(4bSQqVe>Zb z6AiZ;>ye`rO~!My8@tR9NshjBXaoVa>KhPXtNJs*R{ZaP?c?&l0NXB7OV~U3)|Mxu zpOLld{n+aV8N}Yk#G7vev#fY_V4Ndzr|+j$@E|u{cxB=V@0`QVG(xUlleinrb&W2_ z$?o>x&#qpAqS1#f<<3;wqEyTCS7^svA0KYJdY+me8_axXmny;zROH7iDNA5oRZ$k! zmZ=M9kI|tEWs6lwD`6vNJh#Q9s1m0{<_mzK^9@hQ&yV6ngmVXm>cd@zINx~;JrQU$ ze$wM2Ge!@k*R~~KAt^OdQMnzyuLH6Ew$IxJN`y!8_Vu&l0p>TMksNQ<+2dCX9v|bX zp&slY=2QyRL#nQ9e$ka!+g=$ce?-_t*9$l1fQz6% z!)gZlfOBr6{-!BH?1tO$uJ=E(_5H4|L53rtjhp`Or*G^1@oKnnY z=So`eC2a3K&)h~1x_uZ$Exc+{Q!Nt*@yL~)oLdY;V{S8X%9+(d`Ii(mRSG>*2k?Dk z>Pc~{j0K)6vi>oenY3c-4g%23+IJ`Jx^U*tuaCFS-DPVn#t?h!-uFv;Z(HlL)1L&} zfrQjwKI$p4G)%`(o&Imh%ut}$H;P{CQbVIEQRI8vCs&%|Da50x_(NK0Z%^#TcSd?@ z1+0OL$)ZBHZ0~5vSiDK;VM8npy?4bWggv}ePP&Ul0jKk>Gx^eC60FWfT6((#q}ZS5JYIPpK47E?cdMKE&ZZ-Z#HHyGTlB4S(IQ&$BWnH6WM&}J z6a0yHcn#4ZKHx4_Xsn#OIsWucdef|p^__`wiS9?W!=CrQ1+#9h2-juG)xZn!4pS5u zWgZTJ^7< zCXOf);(s*p66B6T{(RRD&ETJ&3x4zn-qeg4-F7ej9lW{z1aDFzAn@iwR0jfYagZO? zsxdd}+n)`{1L;jThe{W6`8D}&+XDrXyJ=hPQ}FqOWAJsR`TK%c(@>zIB&`6}2n8{O zc_IphPGzjx(`iL(iCuKNU7fnImS|lb%fIkSouRQ?T{jcn_RvtsRYMBKSn=;hS+^pQ zgJ>Cc5fXh?h!_zoAdTkWN8XFm*1hcaIT^*DA$^z_V(*96o6AuopCmktk8A3P#WDv( zTBYLFI3*6kDpWtR{;H7aU;0qUgmTld8WG94;-uMdrRLrHy^{HL`;8F&;%6a6{z!8$ z6YGvvoUdfHUBJ%gLDG#{_OG2Bbc43Gp+WW<4fUbUlZWZ+#@b^J4SNo$i9T&E@vhY$ zv$g2wR1r?0FO5*hh6Nouu+0~^zWz*V6v0whmlVbiVV$?@MQo>NTFF-o)cYShLEdmF z664yWdWMizg)w$mCsf#}20JW@rs8vTw}{pN;h^PLE!7R}L3yX~`aJitv@lpl8D=-QeZ(k^w_@^toWK zNRVwN-U*#Jb&*HGpQ9TKMRLjG6<;x0Ex{}w zkT@I4X-@GfH=j;-U848=S5^bPnori&EVKsiQrN_B1f0vy{dp~$$>4;X=(J+=Dg=It=Om708>7F;$Pi=4qO*CSg#QiAwo`ahLag*j%X7 z^8DoGSU_MfZ}LMeQG5BzA8Lul96YLbc)!&WYk#jLKC}{@e`_U{C91wi^z!&>zz0t8 zXifeuP3i;-JV=vX$pnD!xE_J~NDymCVN?t5D4;LpRH90!j`iE}EZZ}S1#{B_3ZAaf z(*=IV+Kw!9`ycOw1=17x&%J%QN6v8r0|_Ou zs)tQ{zW<)o9v*k^LRSPs5qaG`YGv61@PUsyc8C;%oCaFRhj{T=&sgp>f?SMz3b^o_KYvA z?31Su2cAomkH(~N?@wcr=CeqIN2s24jho}?Sf&3?4kjiu>hvw&gD?rm?}@)kw{cBG zO_=$EG3jKm&g)X!EgH>O9i8`agh9TFknD%KD(!s-9j72RMe}l5D`q15gjU&ISu55K zAzoCO_lgf{*gJi-h8nma#<7Js~_Mj3L>)L&f@f&Xw@LZfQ`{-O zadT3pHlS`qFpKIWRWw!bG>T2TfAQ|mii#Dn$*q8bN4LKGIaifRFUh=u-}7?s!PTH* z2t(ldd92n5BqngyiTHI^L%NDu3_GJPCjMBXP4`=3p`s=h9XN<;&h9U*-rs5T~p$kr5 zn`{=Sp{Q%+fBs_YTcTyi9~+9Ej}1kvPca{Wi^0BUvGzl7R%NCZ=k1;;NTeGah9sg z11fgle1r_+zhpOAwi5%CrKtFd^a0$1ayFsMqP=pJUL~LB)peTa%ZJd>S(REaJpm9qUAZ#Is z=)9@IgErP#RTwX^XISJ~S^Yh)Jv_9M*Sh^lQ)Tckv1Xh=Vq|crDefq1w&ep=JA^l1 zP}A7>pR2sZ99Epq8|W?NFy zq4ac;-{cEtxtu#irL1B5FO>F^sU;z=2QwV60W!^)U8U8fyd_?sDTY3g+s}p6-E(Ll zP15gJVCaSOPfZeJNvaZli{iT}__RtQ%V@!DVc9OHvEOdcHIn|tt|k0$mb#GY;rOv zmhVCuHCHX<8!|)obdus{k69L@#Ak`QxDbLcQqzqS>>HIZg}SoOi0l!4YCFaw7l3O} zZ7>M3{MhK4NUw^4wc=-OPyNOIC ze4w~6+{9Ua#jwHL2W5VRNxma-|I&Om;K7u95G6NKKde`rK8TXYhL57;BSrfUSS>Y$ z9CyYEWrG>*YZ7$j7uw-KZ=;^4UtV^I?|Bl%ICUjV!TY{>FRw~%yQ4VrNrDIvbb5~s zJCkxLrbO{siti^@yK+a8b!b}V)@o+7ZiJg3OBIvobvS#LRdMmP`7(9iEco<^X-AVe z120=XWVtxBs4YJYNG1q=a?0{Jy2Hlw&>c+3;+Vd`FtiS-WT`27V-~HY<<&ggZ2q?N zVnJ+KoYsk609fK;07h-HmwsZk4K9Wa?|63LnX8WEENk9mDOc?L?haI1S^>NlxD!O{ zXs7e^OU;`BCDknUvcBL?Ag1z&)j&M$jxRQFGfYB=cJ???^t4bZU6kGFjBrRZ_ZA=jR>Gn|Y6Z;n*UlT2gW%J8rIAUac4IL6t zAWIh#vA_vM5*~lv3?3WHolRus+-mUFoG9Q~dclyBuj=PqLwDOI&R=~%!1@DW*6)SD z1fJme&sY5OpA)mUd3+-*k={GakoY27q6m~$Q|W?<{BcAlTM}Ladwuk5ZYe-W*cC!m zRI5pWn}B~TI94wjEZxOF968CqSUkF455-WO!C(ucj=l_K*X$Q?2;_}S&^RsmfONadCcDt0CqfxEp zfmEjjaGZR{!hNBWBY26o=qz6--kpiy71~O@H-BgY0(K8kEoo&L5A!j-)$h1ClBl+#C`bH{Dk79kn6Fa$n{N zI_#(W@H%Q?e1Ki(bNv#D+NrihjmU#AIsQ~X1xQa5dN3xt$Svbv%H%WCex4^Vl)F9A zDEKDZA~5znZOp|IMF#P0uW4nu zfGrq3Ax zQT|~VQh#WDGg;{a((^_|IFiO_|9zJNBz~6yc!+bQiuRm_=vbecZWw3&-B{K4yG3~Qc-%-EDb9Kh-)41^Gk z-rlqkfhO3Afn>I{IRwLPS$aUoCvQ!!Gs;~G6y=jxtVHhIh-V88?mez{wv7J`M4M0)~a@`fCpJ6GN2eX#C4`G~cH2PwpOT!1LA6I}Dy@*%(IQDsgB{S*% zYEuf@b7== zk3Z?!CHU)5L=K*t-NPk;c_Js^#rq!aIQD~ZSK$tO13kRq3wzq-_zyyyqR~IsNCf0S zYa}WGc031vzDBZ;J7Ve!m5BRnIMEFCCErsBq=xeksjIvL`ROTCg7g*AB-|D6aDtq(l2Fj4sO_dyaY&8QH}?+ty#V?F{4zz^cmur$Tgown2m`4HTyZGl>Jhq zU2NPdyrsnOVTfe+zcxhjYlmdZ=eHe_OO2N5TM9zlSY8=kFf6<0)}T|4U$}m*esVYk zcYJ$m2mW*Q6Ay5o0UWx>U@T6^Cyk5F}OThYyU!x zYO4&pqPACUK+6g0Uiy$YOnm-$OphwaK?a+y8|rl=eH{>UyGP$}(HcbfpMD%pWAfrz z+rQeY_UN+QV^n*esG=?Xom@q!Bj`pMr(k4_%qVp>Yu+JvP43JbNl0(|5Fhp8StpIY zC5n9|!tm+TT8Gxp0np8v;l_~*14i>43N}`rbX`Ty4f86)*`+~oaktu0i{py>e z)c{%VNT?_1u+HhLO<+M0R!2+?<8FzQo={_uo4M9f)MBk5mstw_XxhX3c}RE{m_Ke% zMZVz}qQ&>=Bjn5n8SnaU2|CJjE3fJ_m$PPNqa*_ z_e$~5SOc{A=?UM-6_#Fl^iop$_P5PX5j{nuujYl>@EjA0Ba@MI%cbOTK`R5~N}Hf7 zMdJOQb05SlzllR2>AinWoSBpVa%~X2ec_mnY~dJzXp#AyENFRzX#w>#$UDxa4rvxe z;e@8>btWg4H^;agQIhxL=t!%_ad6}>8S*D(b9Ia%B@Ff8aa`3mnRUdwWO)4(tvwdj z*a|)G8wNoeo~XdipO1JR94&f=VOP+fi9%WPW|k2(Y{f0z-N8*>h~i&*x9^_+ml|t- zQdk52&c@oG6xM*hv$6Ikg*D*sY^?oBVGZ~@8*6`3SOfmf#@e40)_}jWvGym0HQ?`T zto=!04fs17YkyK$1OCp&+Mg8G@Ny^qX{`OzSo^23_J7n^yHED2{(tL0{Nqmt@Y7A)s{>4WCUHIMCsIA-g=(nvQSML44(H6l zpT7WjQ|88DrvtV8+@d%CFY+oW~BX#kXI3jDEVqTa=7ie#?3)F`j6%X6H;+DAE8K@R% z>bGPKJTUpn1F4&IO1nAn7Iu%A3RH*_)$(%WINxpE!_}kK7K)4*CrS+lQ&twhDe$Z< zV;_GwpGclU8%hMZ1M&C)5IZ+=s>X(yJ4J3V)oUeitMaomR`IY@fFsGSUoS1<<_$=PX@CP*av~DleAQ)=Q z{tSPipGuENB(-mPx#EW&#!5~)@^wNdr{HkyEb`N>DHMGx4PRmSgSJXWV%2H$wpNU! zvW+MM(S5PMParvE=jYEPKND%(80c=;fNyEqfNg8sfc_gL*p+cTEmJx9i(NWA?qR50*#G(pDs*^scottBGg{3W;@M*1&#~58+RT2hZnbQO zHwV0$2c@=xIvH6<=%KLS_YP@m1*0jDhYk;DkZX9Kcqy zr@`R4%bCO}KgyN98~%_Wxl+&BI!+t5da%$1V}Ps&c4`e%cu@7D%vL`MR_ws>D9a)c z)w9vw|AU1_#RK+Xuw+I93EK$Wr=M2p7)ANb%e#jSN{r`ZM@F_t6>3;Us6Mq)FQ;pz zcWBZlGVEy+F4%gO@)YX(bihDY8DRAc;B2h$sABLhBVv^w_evc0QX+4S4nHE`LoU_7o|Gq>f}a1+<2n_s#HdS_MsBj3#!EJf+}&N(vd}6Cm|LAe8w}1 zGSEmweD9t-1%r5epi>vBcy9scQi~i`p?CYDde+Q|<###eILagUaFR|?)uX542>1J5 z*PAH~K)1zx>==PqA8C@OyVq%ODS1J`_sO(+rV@T>o(juS)q6m#FI&F3r%QredV~VX&lCIBJsZG|xL0jviZ!slmXd=f|fd@^(qT*qeFxo-Rvww4BJhhryEl zYChu$s~EfhP$zC2)QOuPWFU70Ppb$oF086O&DRk(G$aM-m6(;>OJYjwpKbV--nBjb z0DeV_Cu`RLv=NjnPFr&$&X4hy(^1V$6OJWkbv9pq(-d~)o-xgIfM4G*pEom(WDH%F zS``9KmO$BMV_zK|zH$MT;-3F3#ijae7L~=USC8i{_{PRA4&5AlWTCOQ);WAb>j)Ao zMewk!*yn6&mu%XX{74ak*%|OQc=_?B>MZMrft@S&!I8}!gfs^Q+#9IfCj$OK*45Ir z7ZtSS`64=)1ms*2E>S;TEXfIce(p_&H$pg$T(yw0*zY##YXxNi4h`}vW#q=$Rgt_% zZiFrZf1oZ=w#nQe+zMThfo`zmiNbYyL@|Mb#wdTxhq|YvA0*bHt(?1K<=n{4TUVJ+x)YK&5~~HUaaoReym)WtaXHLwiwggFAJ{|d-T5= zXIzr42L(^R#nXrVsC-}S={l_dBeX&n2PYwo+ZMXnTY-Q2LYAeRyZ(#&?dR#*M67!za4CP~(WF6;?oYUb%Mr)N2(V62~$>M#pkLSx1HKr*Rfp6D_Rc zptUp}yWJC;yvmZoucK#UBLPDEt`O=X3j|aIVLB3B>Ujbq**5;+j7fg`30I)m5|7#U zy3JPnLQU4K4BE9*dDfL8SJbqmBXcZ=Y0NZ-Mdn!7U(97!gC-f)GbWMBTipRpw$x(A zjvig}3Xi?hu^f^BnX%7oA(%}>g^Jgb1JTSBAKhC!2$88;JKvzE=Ib4YmO0T=_#x$W z;EI`^x6GwWBb>6S3?8!{SJqtY5|SRIQRh2q&6AGyI)j!=>Uz<^E7_K1qxHcwRt$4x zNcA)VY>B%*U|~Kybe-{?fJt4sV|P$D&TDqX(n8BKxF+6svUPYTB;vudETP~_R}X;o z=z>bz_|DL#>)Q_PkBmTSW#=af6L!?c^)O|U+xKhAWDkxf#u0$Qqc*qktcq$^N$vkB zT9V)7qK~1Cu2fx-d&^=T62o6!#x@^*R?DM0GrR|ofu#^jHjHJKx)b};gIyW<^XENJ zG_ufzo@@C~Y+#8znwF=TE}J``D+{-BEEzD7VW$<3=LxZ=i6856(w|KQhpn+}6cfEK zxW>2Bc|qHh(#jtx&=43mt=NOA@93-4Nl8DL^n+AOErFHCHIqKc8KzV2ye^>fT{>-V z`qfrmp5zJ`M*0ZzTW+o5z?_m#QKLU-KyxOF*TFML!PqPsri-tk#x>I?)}*Y|U`kI_ z+4QBo%Xvr7v%oDcV@Prshc?@bT;Ie^CxOlso=K7Sm=D|cX3)-Dzlo?bP)i`Du4~Pe zY-tOw8c)j5nS;@vgwwD4M0E?`VW$=eAaSa@niy28k;YA%Jxen#aBbT#qPCu_h+Zz* zg{~+c^$B|RgBdhXDMN4WF>xY5@!gH=>EL#_P@Nb+HXOJgC)Ro{LZbV|Sc6hh(M!)w zHG?S!lLBUP3!9y-k-^5yO;u1~v=1urRilNxfi%6t$D}R~6Sp)JBi0R|e~Ubttc0I1 zUTb3O)9CYodF7ZX8u=c%v5;&F54z_agY2wPTH%Z(@KXcfoo-%-Y3z1`YTq2Qwu2mf zL9-@7773tP6E+v=_JaKcc;oYLLZ9ZQB%Jr2rFv7dMJETHJvA_w&wmy8a=SYHT+eu| za;8_4Wmy_Q5}ZoSb-(Kh*iYK9!`ZncXl>`9>0B>(>#0h2Ce(0!1nu8he-vRj;_S%z zvV!~UW!E)ms4^Q1RFzAy&|oWY0M9KD;7s2sYTniZBXc&kxYwRT`dTrjZ$=N5wZm|h z)ue0?28Qe5hBnm#axe|Tc)~>o#mdEx6y51!?Y)K!?b*ldzi1!;rx<67xkmd&s8%ye z<*&zJ#hI!!3gZ$8P^pCU-{7!u1NGsSO69yq=+Es4B~a z&!Ug1C`-CEULe|XA5(P-%gQtH`d*5}{XAhM=PTJ@*V0Ed$FVd&2&R-&nA(95sr%W> zADqGVD@+7i-eVRG01k>CIm&mvPL%fh{2fXKI_KqDsn}{W%4uM(;u&Bi<87697bbY&BygYR07y{d%-*uqE%Z#lzxw=n1k5Z=C zAwhxZ6M1o3%Kd5)Cuvqpb+urG80% z5%(%TZ-iT^7ieF_ps9;4P`3K&grO=DR&3NFYI1=#bJsFKQ%b7hNSJTKH94Vdf9vI_ zLi637(_DmEEbyk%t^7>E?MM1#L7^GHayD<>J4>w!&FVV(O|WbROsbd78z$#klAhY_ zO`B>5vd+h8&Gp*^g|lhbn}Xk4it2Sm&l8#ma^Edxr;S`%sTk@QeC+8CjlU6EJfNYV zQQWpFpteK`5F;k}5P(J^|L}m+q-%Qv%}KoLTZ-BSfL@IirK4@ogtNsem%-G)E>!%v zwafN^R0-GJSirEZ?#ST%fSDzN=Bc5P*2#AFx=xDY zi}!$~qpi+qc6O(8yE9Hgy0`AdDK9kGFCv1mHYo1ej0p?IEN4Q$g{|_su=ly6iu%vF z$bXzK6Tjv+o1rUM3k!!aAe->fw$E3BIC*-=ftQe9-U_194#!K}GE{w9Va!sOUyJDPa54kUqzua_GtzLCa^f2ke}gW^~AZZ#s>Bf zi`-Gw;=uSARCEU_1~XT)9Mt{i@CJ*D)u7KiJv{5d zvBfz&H|fSw+~%Kj!^qWVd2d6vS%zOP+KrXGPW90poCu&$4ec6PlP@ghpNRrh`^eSf zyASf591_5I;DO{^iL}(z?vc59V=t<8nK?rGst>aa$NQJNu^cJ5MJ)d2ic3wwp3-~j zit|TH)?I9yR+QI^-Iv9+*_34qrK#RF3M18Ns(xO4cjX!`V?ZZjZUW*v(}6UMYK+fUy%9~Zk49Cygf z77_ftDzp)C+y@R34NL<7?dSmD%STI ztsr|McHtCqgXrT}$$Yo*w1Gi4S`4;%0OV{=kP7WdauWFSQO=!r z+6z^W`VFsKXJ}=S;|E(5fi$HvSv4Xl3x~?Q{LT-WpuLJcx_&*UAu$!#h%CbKXji7x zCD1xc{P%+Q9CZ#WA>CzpADiOeB8vzr(P`D9PvCfd8UJ)7Vclh5HgT@Oj|DWF!t3IH z&(EJ%-5GOV2<~@Zc(UtWOf(1jjeQ_qH%raD(&u~&`mbn3)po$T4%~WIxc4Drh-dzl zrO9~(WjS;+@r~aP+&1gSN239BF45=r?_j}RK0J<6z+U>nYjq)?`@e&K|LeP(o+4^= zx^LP_kN*}6*k`BIZPU`U(UO^wbDlvlc1Pm*>Cl~F(L07VeGLvwyrs3i9)+L@D1ME! zVJ(w1aFhGq^*ciz1?O1}+1%*xFug8Z-v@8sJ(gG1b=s8&vL9y;jtenw-f+bw1PmOU z!G(H`$Lr5L-*c~Ck6FIrl1YaP6aDd|6&wN)iR%Kk9$;kEYT0fI9-vZM#aqyZN;4SK zB|2tC4ytP)(en;~B*6$!A$oXBl$3eF3} z8+UWHMQ)uV8(W_Uy-KM6$}sJ|LvcSe@v1Q9?i`w zfZ&Gu{kv=0Jd`4fMNWC$Z})V-qb6^btgBy~Bo0Hl^usKLjrtw_0QGZ&gRvKFi3aaQ zow()lb-k#jURNxuf=b$(_LssD_A$!}uPdOt43BSEq6ycqhWv>USZJoaF}X(Pe&{{X z!|K3IR)k}!VVI8qG&u4uW{rtFRcXSz6Fd3)V|o}8u{sRpd%EzUTS(0IPR7#%fk?cR z*IA->k~lVm@jmUKDv@p1cV zO55iN30MF$5y`uNC(G{7iC*(;rke#1KrcMRSvKG%aws#oSmt4Tb5@k?GcBBxF(}P; zWUnC)HZ>BticCFK58G`@eAkT;*6mP)om-ir;`VGp=jEE!)kXsgs|TfeA!L{HYzgtJws`d1-c;v@`i_nK9YD-~90!h-v_qtS2o2Lm1Joz&EL*fp~ zK*-!st6D`_j1R$fj#~v*(~Z|Upq!~|y9FM!(L08Za*JIsp>zJ*r&86G|LTHWsi?L1 z;Uirntgp7PsgdoE+sZ(lgw8T9Z4H_QhiF zd}Rr};jEmpXM!U|I$MzevGZ&|DZ8O~x#~w`^9-e;g0+^WJmRY?Ig|WBccsU$n{q2} z*z8y4SPCV)tp~5aZ2+IPojvA-KP^$@ZJ7^%rsX_Wr%dUkOks;TE#0?Ggwj8Ay{9F$ z4nqqQWguTEdYfjV@FJ4IZ**8wLEDHi&{~~gcak=s`%9n{g`zpbd9H9!h$9`yKc`hQg8KFxgCV7LTPxIiah*L6tfC67+Z3R-AJjwb_{&& zlT8)z9YlUDx`~%&|M2kdfJPy;Xl=uw@%2Y05OKLk{@{;~@6qtZBW(c9Op^(QG_eNY z5@<@OE%0i9%{2jsM0R=c>)T8X@&BYx81OP+n^5d+Y>~WxW~ilSI%4vT-;ENd&kX(n zy|=z0d~peA5N0QGx`MKTPuLZP*9`Ji=ZQ;^mpIXwu!oqS*WH>mSFV!TN6%@XL)%4v zHsk|)2;Hs5E$4OQ*sTE56J@|O^ST*KdXO>r$<4ZN+j!)1T1oTG$+_rAu+gbyVQQAA z1MER>Hv%%8@)C*)PxP~5GiIdJ95u}o|5e_O;W7#?Zf}0)cGb#LAg?hC8x&vmvk8w; zaAL(kmjzX{Kx;4u;;*tH(JUXMU5ACG6Jfky{0EZ0F9*puHvzZ`+ z(XdUH=ML6e=Rmbs<}aPBEfdD`!LJ~D@1zz%cb(VNK>-qUjiF|pL)XY2R4$xheu$7m zRAJR72b{v&pG-~t3OAwjd#yIEaLo%iL|bc7yNa>99LN=}IGA|UKM*-p9}Ra~REaQD zj3WpPDINO`4JZK%#m3Z~>eI+ZhB?nL5x*OgAal;Tll8!I>6?_($Be%aZv@T}%;)0y1~TAOGb zA(z7^0_6P`gYl!1FU7Tdc$gXsN6B+A6Y5K7=4jrNbJJ`Ay5fkEZrbkRGGScNc*67D zFPYeBk#@Rg(CgmAWm&fr(_@;~jEi1~E4zqKM(5K{c;9z`)0LanCDkl`e>S2t{|a|- z|0aa&3nYJ?IqwCW#+STZ4VJ3#BJsS5viNi>YPIl$=uwFwwTJlI*Pu{&G#7F@&oQ*d zGO;Ggu@DWk%Ud)_jK{9&9f;J?hYioxQ4^}x-4z7KZ9InGV&ehsfR8+jks&)q(N<3! z6-~VAF<#~c1=cSlm)!!kf_Ovn^=6G&QN`_3u~%9V+^`luw&ZlcmCJ2w-urQ1@ey#4 z_E7XF?|so2yyT7@SdtxDv*Q?3pHfas_>w4H3z+)%ZOc-V>9c_T_o+U35+_ECW4}?j zbvb*>XynuH|FxO-&Y-3{V22XV*|(8tirVMb5B7cNdV^9)C_97>FXU_CUCgpYNCTI2 z*7Jec_B;0I=$^U&p|)~l32qDe*Hus(tnwI_`InaN6pQ-R+(^eCAWyDrPmfbt0QJcD z=v#+Uwk?aqKuOB%GWT2qQqga7PKfkvwCMZNUDBz=b}rCiq_);%xVQaFmemKa-CE7Z zI=F&5n&sI8f^6}I6VGmiwp*`~g)bv6aq7QGOmC02kG*+GBwZn=P_Ud}pRy1GpH88T>Gb6Lr8l+WHo)4)RfA^WZ+I7Hbdb{cK^SCyR z%-kELu6cLbQ&0Hobn`~R`2ozAd-?9AR{r}Lh~D5e`+oTI=2vc?!MqavL^kSmqrD@j zDD1^xBU3l8lRJI0B<3w0v*5vysf03-A_RnBA09Rzq5q3X^p@j)D~USG_{YlT{4bJd z(L$Dawz)e{>)~e0iV%t}YyeVT1*&qM1hsweA?yjTwOXe4I4hHw&)$2Xs&?n&U(vv3 z>(CuSnKgx zE93;1nyV0|aEpLe8y-yDk1#>Ge=if;rPe0Ag{DKO7JJoRMBaz7F zDNA*1gy_z1ZUa1f-jHu^l@f0Wngoq8BkjjDq6Z4hvN%;Qow#mu^3H;idaUD71H0(O zjB~J*45%CvKsxL<-~E-IdB4QuO~YJK)j5SIC&*S4k_M)PC3}Mz@J5SBx*EU|CGYUH z(dElo13$&26Kw?-ZxNNtM8m{Lr@(Zpb>SmG=c1{VdHT$);O* z7{~u;@2$hC+Pd&jkr1VoMnXVBkPZ>)mJSK&PU)^C-5>(eUDDmLC8WDMrMso?-dN`x z&-w1}-gEDNhw(h?8O%A?tUXt}>m6f`#q^CV6woS;Y;TOtn0EWfu_P$dQc&tl{MON+dWcyCp`0*KUB>_J2Y?;*+a!V#wByiZh(+4M+ zBX8zex@w&`&vk=Wz&z*=8uVQLh6de3s-E>pZ`w_Mpjy&txgUfT0+`{SwCJEexSS zv*s1!)&=3VKDCs*R@rffz|U_ubR-0~E4%Ad70iS3ds0DHxr54MgR$vlQyV&71S1^? z4q@wdnf9vj6hps3b`Z>YMysN{3IFMh+}N!s6s1i)*WvBraeIFCf)Y4m6!0E1N5-uC zN-Q`y3|_h|F~G8eq)%J}vb9PT>gl5&@bfzkHIX!`D{k2KWb&aNGv>5KzCcPB8f=d* z-D!dsN0zS`dj6tQ>)fOUp(JXW@xHv8&YF;oZbFy-Gh|s~vaeuDlxEtV)#uNdlE{i_`n< zI?F39}}7&r{g2J*s>SG@Qk>!4VwrCN4MqsK3L{Z#Yzw7UvuM{EkCwGvE4a zdPG_@Up~_C_#prbi*Ug-$gJ8R;}BSi%L2b0Aq1Es_`PlquH!-6C-r$01rBj98vmUk z?VP+~fse4x+Bm90VWOf0)S`10x96DFoZQS2s5O(IQp@u0kItS$ENh2!%V z8?c}UC>dm02Q?fX+F*(_>iC8ty{Lsyq}va^qfl4SG&X=ot6`(wvW!k;iM#`0OxNk& zoksf#sH&kAaW~&aL*S=Ig(w@NiXb?o)-z@b$lt0{YLYi%erCHvWf5qWcdYXf{COIq z4#9l;;kj=Kt78go_q2A@W}Qvgwf;tonrJt9UL;Ba!cRFTaL7+moVDY118NM1hF-Z7 zc>EMV{m`E5eJ8vmzFyT^z4}QAk-AKZCKf<7*7)W@<bxSIt$x6q*Y zVNlVy`ETvj!J^_5T1zvx=)ss>4>AYEa$U9S4@iuXLxSFKrQ-Er!qt>qiyCPS?!)WP zs=a$bviUYo=vdunyQ3CvX|SifLGRM|Y3$2OGCX!xIw=fRNf(TnYfe0%TO@UQH{?mu ztl7FO^ghx*$mL91g{DWyg7rXZS`}W3(>RT?a*3XqC3aKQXC-D$8i^0x-jqQ>Jz+X+ zBMY{pFnHYZEWF6tQE!|Y;}hq~e#or*==((sPZ|&-KIaXuDh6OtpWe}JKXeE>&3yV~ zU<0ZE?nbVvYhPPQuXn*89F&>bnvD?OPS#Wzr zBX3->lLzHUwoVCA-IePAL^V)YdFb}pN_QRE?<(+>aiP->$$hOojO+Xm3`<8LvIB&u zDzj87Q|NUa_WK!o4ls_*ecpodRGX?FX9<{0+!9t9R`iCGhW##|qy3-BqFrGA6qbP5 z*Z0@F8Y{FfZgVF^vB1a;S5_k*KKLmI>}iRINE3#p*?%HjAH42A5qCMT0_v$clmoy! z+W2CUU7nMC)`LS}IYRSvxav0X%(zp)6)rk?Ieu3QF&ODaE-{{!FSj@3IW4me>@mX) zh_k?TNai`UaL|J(ST=GEmYjX!b_EteMi~Zmoi0624Y7ugc>tC!rPC8PgHi>Fh!_^n zgBq${TPCE8(5-Q4ci_lFk4jceVej?VcJ-~W>@3y-nk=7~0Scy9D;!iF>po{ny{>;l z#2SHu|477^Vr4MFj>eaB*f0@GOA$1D2(1wEZzYL(zbBt9RZ1Byg56}enx92m64hMs z6#IAslmE*(CgOot01$sBXq*NbfP3CSfAsf6Ec;4E0ev$*1B8by6UzG|4?9@6+=27p zbDhRQh;R6uR;It?t0IS1#Tu*!F@bUmNNG$Pg(W5!UP~{`7O$KFdavmB393_G3tc{2e9X473xAGv=^3dXjtAA_;?cQ;665p!lwn}hgPnkiGbPI1dl@U;-aUq zDHxe^My0+_?_L>Av}b6yGQlHt@u^o_YOr#pZtn0e(7(%JZwp_05eh#B{}BplcBedL zGEHkaXTOhxE1zplJkM6}N#v)ZVz^O2L6j}Z=7JHYyMUIrO3MLBb>K6OaqtdZr|uwE8h8ak-ffA zaHPQVR0F}1GnSFw0nX=McDgz~@ZLG*cc~LQpcTq+e0yc{XwLY+QSVn3fd>f*pTOJR zP*0qJhGqr=(NpN{216X~28lwpDy611>>N5t!yUZsUrrIQo|&0J6NI4XE7&V_WM4&= zQ2$a!qFQ>nX({Izr|c0nqe10By$xb^4S!x|^pqB!#zu*0OU!LuAY(`L&cyyx0SWDd zejnw7IJy!xaHPPk=$G$DfuxmiA?4DOcw(FOQYJomYY%$e3aiVYzmT#2zj3j^{}~zk zI~R*-irMg<;KN~In$P39g1WR!p@f&gDW*CYIB}T1Hac7PRC&AyST#l?1Ii}XNiNc; zYST7e4r6V60v4dK#+g)mCe3y|3~~SnH*0q#_cgE5O-dH^^z}~5B0G}lNTJm?(-9%ms@Jas zyR0x4U1+sOOO^@v1rm4KTWm^Rvc9c;!UR%9h#30Zth&=Pb_J>g9tG=Xsg|iBz8uxu z6m=*W!1y=r<*xa-BaCU zQ>9J1HXkwG)8m34t55YE#nMoNs;ov1FSf3*OL&%>7H0{$#-1`PoZW53*DOFh?$G#t z2xf1j!P$HdxWz#isegl~c2GD8AG=)+jtjXYbajhqh(ilaJY`TO10?bqs)E7=>Wy3{ z6WULr-k>x)YeLnzs$ABR?~dr`>2l$N_wSz6TNv;&+$4B1-WJMKG2IkkF6!kJW-*wV z^N^r%Q5YOV@Fz(+y7S@(NeX~j(&(c;!h;0 z*ULYVq`=>?qz~UWejz_|)u-3YlCe`(HT2;AhDyJ~(>P*xFhBZ}D3#cu-YlhSY%Qmf z=UnU{tl?R{#7l5w9Ha{2VkWj$R4hFJO6FA)k&q+-sc4^|MPnZP$XLi`QC+O$*&+g9MJAd9Brb zhp9mkh4GJ9og3Oci`)0WxU@zPOqCYAXY--W4tpHN7g1a_&VvQn=+sif>bU9{ z1$CsWC)rG%Ybqis9VOgn)o`P|;JVqTBj5ocW*^8`Izm4_|{z93NV>%-_{ZraJT&Moy= zexur8rTPw*XiW_A%TaW-q);(*rCz$Mq&!$CjZIGMr<@;) z9;(uOULR-?KLy8xFOKlLNH79~GH4TT1hJf93!$@h6 zP&-hErn#$YS|Z|n6Sd+2^q9M;czR#6XnP~qi~aq2_t9qaSyW}M4iavLU~#XJNr zCxV6eu-649h3t>IA0Zsagv3Jwd~5yI zmgHOKbi836!%xeQdyB_7C$}4^^-cmkBe0atq*bHI4{#tc;_uc!iAoh^o$-Abo4pz< zf}zQzv$Wu)teFR~*rhBu1Y7I^dM>>fo_nz)s3TDM*%PYs+`pUbrq$FjFxESdh6Jv# zf=zZI7P~aWxY&e)5Q|-JTP`Q!fS>#*L>UwH{=tvl0Ms4IB(1SIu<U3fLNLsN*6Z$^}jdZm04MJ>WZoypWQF#6944BnhkAnb=*AO74jtN4sw`Lu{I#u z$bp1(dB3Gl1zUJbLRLHHT;Lozz4DT?*Rf%z*(1wu?83BnZcHJbEu*flUf-C8tDyIQ z)c?F0?FBcOCIviZ%~)Gn5EQ2)i`YK<$2FaI5`_moN7Qj8(~^!<_>N1z0n|@t%p(On zO<Bgt20Jr4n#JV zJXYL)O1)456$LPI5-&Apipy*hk<|K2X0bRD{JtECHm2bfSm(w^jrrwAi+Y_VofU$|1QhV9Mk_c3Fo zFB-=yutCh?Lk76``j(74tSk_dIhZp3|KEx@2#H1o(;Wq z_V@<@vF^Van@fEbe@J1t?Y*j2-Z?UoJ0AP6#oW|FUOXxwOt(byrFQB8DNb=&CFOQdl(V+-H0UF~cg)ktCl6`NbBrc{NVvnd+0 zj9B*ZUCNnZHvO;xrg72OQ;DwTOW^|J(M^IMk~5-M21nSM%{<0TKE^zDbgn)60cji4 zABWM!dI2~25Rt{+!s%8rR)tx4_rkG0`+WuGNbxKfe4u-w;sd{9^6nNk=oTtP1`^aO z=KOrfxJfU;$a&TyNG9wDrew58F!d7@;RItRc9 zp*DpFcEceGP#ABLh;F06ewWLVJt@mgXz=HYOK89K;#V)hM!|WKhsj~H?`DnkrD_&0 zADidqHXIGhAZxoYI34R?ex#tC7s^Y@h$1K$21l%~_C+yl>jhl|-5GuXXgH=S8w1J4&-tIuHIevU_T%6%p|A#VG>-y1ThJoKK#uj_@6C;fiTnXQ}feo z7r{61Er_`JrDpgZ>on3EmSh!UaARk=u|*l&a#109n`Ch7K6?2WmbhjR;17h+$a#s@ob6PfGY-K``Ld0XAkJvJOhjUo+Q`SQH7}7y8%MYvaazQ<7`2f;Fi+Z`Cr%rS zt~7`c54KijgXa_2v?Poj3j&iH+NcXQe6bt09q>zW@F<^szE;CD2EaZm73Fb-XUb1Y<_Z12ewvp(Q zj+35db3}HsfmVvy9HcP;fD*Yb(5_RCaNUnh=3aGi2#7-Wkz9Vd+UdRg;%r%0u+aR2OWsD}lx{c2|?!Gal8J7XWLSc9^!WvFEiXF{lzPmO`e94z7?S z>!Q~pS`%^6o>Nm#oPx%8^LxF$Gr4>eJLuI? za1zHGV4rVT-d@|izixfMo7!_Z$P8f%9NJ#|u&2e z07|4JZBI)>QHt-T9jD62V{{GaO7mS39Qq#d3$I>I`K-xO{Kul5z^?g+6S83Bs=YMy z8tt%SkD*dk`A)(|588xt?|>HSd$9B@a_bupTc2x3U1?+@GCrGO^Lw$qmX>28cfE8( zzhYtM)rB*qN@4|fqR<}Kgf-m$zCHQnI54%D6rk}?mx`^B?Of&D-&M3w`GY7I?}HtA zu+i#!B(%b@sYjE^ek9XMCZD9(=3K1cBUnIqQdx}bw<4JAZYLAQvI0_u2N@_&bZ0g- zX$_FJcQo7-Y>A2=`qYZJ|10d;Cc2Ub zb-IMrCcR`#pUaD?N%N8ib%;k40Z#q{`9#>_o(h7Df9p0{=pS}ve2=zIIDtCk2IKWxYh#Wq?HFV`*otLa{D@9hPmQ!qQg;ayQ*}lwCciI-U zp2AhtbT?~fYA$I)VbuKTjkD+%-Pp(KFshQr^!l~d97pq59NOzjVTev(SJA6AJGo4^ zk<$;UuEVDf5v|Gvnc6Lxf+4=5hKt{QMfqJN%Tfo?cMXA6{#W-dFZhF(Gc*rG>4Al- zq3Wko-qCiw`k=18DT8!2m7IGgx|_yEv)St(Pyohy9=jU4FM>UGpP4xf2?Z;j9EEm5 z;&9Lvrm)ACc7B{q{Q{ctrTfZIF-}^aihqvo=?7)PQ;{KKu#m1ZPe|b4px$7tRcYp% z=Zq#UC=YlzGqj?vy%g4FW_}nTJKdIqKV~l0KKn+uZ+I1%Fp%lRe%6UcW z=4-A?q_8_`JBUW2XT+o!-CCqMMsZii5z5owaw2V{XAzSj1eOoM>nKs}GVT zzbRo`B6$idWAX2n-@!U{xAwS!k`E1@SA`wBU?+q9MnAmv(N{7_d}F7HS>hzv*bzW| z`7ysM>=dz8)2JIp9iyv19nXwESp3ytcbY#PZn5QFV_xCNYG>Yua0N$3GT9P{gDCJ- z+!%i2mcpy8eDkE413jIY12~OYE7Du+WeK zLku@%ht2qE5;;Nzz9P-Ddd{M{@tiu&f8IXw>t)eL4!m?INMR~+ttc3FTYAhLfu*RWH8rwuH^=7PU+#Ayli%wOuF zz7)iVW8ivF1okWaX`~BLG%j&BMw8~jOerkn&&3RV=v~7R6B`Qa@rg3L6B~?XqP2Gy z$%|-LLW^TTNx9T2C&aM23e){-6V*ZEtkblk{RXRFGE35nfxdArL17NC2E|mr?9=`! zi#q`Xz5JFq^I1*QSbbe~vDM;QU2&xDh8D2Om2YlWEY0@U7IPm<1QFMYklE{uK1j!1 zj&#psq)Gq>zxCyeR7Ypir{qj$4A4+v>6Mf{l@8u>#$MoVa>uuCVC+Vsg(LFjsqI(# zOk{;Hh~FLog!zM9;07W;-}b9jdf03djacHxqe2#8GUav)>~AWe{=?tYF)bhkZchdk zS>df!>dT@yTT}-JX1!0~=i%r!+c@w6y7lYrAn=*{Wvma`{iTD#UFaVtL~O^uVQrg% zm6eZs_SPlFh%JLVUCQftC#;SGOTXH%IKl@A?-V4k$xuD={Ar{MQNU)pm(1UcbZ@M6 z>nm=hEPBvnw~PhOZ2{F876+|dr(zRpXQV!W9mvHRdZJOo?idgeH+fAkzd4EUUf&bH z@Tl!-qfa$@G|72loMkK*$kUb0n$^)>frHClSk5YFJfGE11=tKr@vfv{56{J2jJWH0 z{y}E(PFYNLrQ;+V!

    (tZ658jg3b(#gVn2RXocf>-yYYJWiKh)bH>fas2hvc8mse zTZdqqCSu7O$;yKVwV2=KSb6ugWvzSPl3hmAN^Ap*b4UNmP5>7(lC#i0Uu^nOe`1jlk}b-233+9l``RM}f=nTDb_o<2cf#2r zd=8A}d~OjWPU@>| zp!zL%^g-{p*|-X$Zm#Y>#ntC9te%IxTl~m3IVwa(kJ~^Lr+(6cm+GuO%gnV0uoG}F z?)PuR?{7>4fV8nLjfMn+>wu^VGS2MPhdmQHv!#l9eKf4Y14Zl_`JS_ zySlxF`!vg@x01Yt0f~79rc3XY8tG|Ai-F)vh^uPXoj^+LvZI|8YF)|4s6odaSu%s( z=B{>2CBjG$(lzT6rO%^SiU%Q#aB7!wMPKW+@qn5!Nv&kPnMz1Kl9#;|`Zyk`$1 z%P{j2!=J^A;jZ>Gq-o|OUCgkr<*-ez)9${`v+kPp=0$+)tU=JB!UVSvTLvdMj$^$I zk~WtelE3pFZj19FE-#C{*~-)*vv(z*-kT2vb;loH!R-0r9%k${VtJMs;f|=VX{S_T ziCv(D-dEX_+sk^wvV(1WqQx5)`m)w7To2#&LtaW@+{&9Nz-(`vOK^ryL2jdM;g_o_ z0PVb<&01_JHsxH4cx1@`!+Q6|j8{02h#qXeYtq1Lk3FyH=`*WjKi1#S8rz9AA(lMy zIE=2?p_AlGj$h4sYtCDL7AaIWANTKaHEvJAcI@`i{o|Dzzs>lQ$3shFBjjg&?PhIe zWsD!E_pa_glOLHo1Hj=yia4V=oEQ+~!XtN6<)viBLPpmkVR%)WeVD$is9&{s7^P>7 zMP3SBc(ImGEBX$u4)hL#O1MO(X-T2YBLu6jsrtS=Y=Zw}CPAUXK}m3S)+q@9=-meL zvn^*z6GEB0`GK3L4dxg$ZcDNbbJ;A=dk)#d0)X%pA0oan&^Y)2+nO~_K>0dyLOCXs zmucDbjGi{x!cV6k$!iH58{{lOPWv@?KPDtL$k0%_1r$R6Do!>5?P&9$f=Gu5YX>+u z$S`Lr3yd}#lEOqqFpo{-M;o>{H% z*CY;Ek$qg?FmB%<;J98kjVAhoUYoxuUB;$uKB%ZX#tJ=c*($quCR%$%TB~NAY2kmBd@)BHn*k0Wg5-+&W*AT{ zncwW06@IUbnpSh{(fcVPwxdTt7GXRl+z3CG670bWo2A5-cbF?cGV`Udi(P=KcUo~a z{y;@STh%puQT3Mtt7#h8fwe9V?7*770qXE|$k(df(cN?$nezC!dcZMWX)3=4C#B%E zTw$F2zB;OMV;X1j8jBTZ-lHzd842K7dmiYLwSzI9`Ux%(%#@lx#3{I_KY02dJpB)z{s&KO|AVLh!PEcX>3{I_KY058KRi7c-+afmF>mNt z9IM0m;_C2g*rll0t1Xy^W2tT&xUI(ql@XK1fP%RA?J)Z%b>pd~=Z0w&5=;AoZAO)B zaGMr3ePskf9ishZ-OBW4sHerU(ngM#HKx4*z`0YR3vamUMF2^rsyVrMWx(UR9^!QV z^VBx4mflhvKXNZKXZ4SMhx7*9W-$G!$0qv(?{F$UL-(^&s72Bik-#u)a(W5D*7iht z2|z2Z`PperP*^$*zvYYOTW2JQNrc>O^l!CpeZJ)nb=U)i{zyD937d!BT?>Zeh5PGE z)5i#}{L6>Sy!#)dt|S^9Uf^mkxIh!q2P2&=Ho=(!d1+64s>$KhjeGFW7YG?o_HE2u zYqwbPlrJOBB$3y+N>TA_i0;OpJ;8g<)TIHGx~aAp%j#%twM;&oa~AgK=suMLExWvW zm1CUOReU{&$EHmBK!n4V#YdKTnho1xFiRysZ1|c?M9=Nbz{9L2ao!Z=%mn2%0IfL!@#aZH%ixfKRiqX zC{&qKVLA&TW4|;siqT>X6!0O4T_=v^^m}NtrE5omkm2J@03^6;M#HEdQRn2OGJ)+y z8P(t%s@e1Ukhfy9Bcd0!d-%(HkNV20y8XL6qQC4jwh`E_wQi_Mhj>-{)|5n5aB$uC zF`Ehvz-YueNN&sOr%#A9$tegAbIOqcQ0|N#Z`6)rE!*hGWg6F`y{r;9Y0l?Llyqha zVB%=9J(NqrV`1;kBf7vYxjpVigRmBonn|97L8InPrQvL^3eskE7UN`D@!PIl^HoRF zVDuj+jETSey18#*KBEqwR2sQE{zS)dn!Q=p$NmvEEw&l*qHfR5BNV8GUPNMh;NW0r zb$K3TX;K_pnxZ$m;#rnq;lqK`;XT&D;G~B-6h~7jo7M&>XJ$F3!rV1HoSb(nPA`V6 zwZ3p$N9?>ir0(#+GV{=gyDBiR;6lKHGap@_=)CRAMn#f-Y1V+Uj-wQKG&U7h%_@7D z3tb6X5Zgo0f*B^9s0W9q-Sb}vwfs}nK%{tEu>R=|!>2a`MR83s@8u6|E zC?5D;N`;WXYC}@a%tDDH<83OTMr|rNJr3G=cxjH&4ttY+3oa@TeccQ}tF!3n&(m5h z^I~c`4WI9&+&!(LAZPAnO=<7Jdc5s4ox8^(CWzk`8`kr5dpfi*vgwrpV0yWiP#VVd zfqdMcsnkLcSMs@PfmS8CE>j_a_-P9LFp=8CMXB=ayc|kQ?MaJvt>IxQUz#e*G`WY( zz@~ESX|vg61nYRdLnxW~K-?hU9&!X59s+8`GB$XvQ5zZE1nW=B+fCc_aXyT)`5wZ0L)J?|G>FWAq9Mv0Q=7pv zEmkrCV^&&oezy`M2OumZTQXCdl6v?hN`2_FIYhtDPgi>INH`~j1nih#`>ZSKGzTw_ zy~VAk@aRfzg`J1pwlCh9Nvevs!=;^;TIHOIu&ExcgeGHr?xFjlpIpJC(C%m-e(@+8 zAF=&*%n9{)fqpsFQr@V3Q9%L7`U=*0yM#kX>ZAf~GM#6XdlcAT#RXkdZiq@}0wF;? zj!x#*X9%CBZWY~WY0cnpoC#0g593dLqrCbCVGZiS$~2UE^`jN4D8}9ct#)D>K5Cp5 z4t@}oV7>O;k{qk}RmDlA%rBSk6|=(wiX~&~nAr?Uwr5Yxs$NRTl?}+YDTmIsOo0vx zFVn#L0rK0?hSLBa)F^E8I9ZR1IMF(nxC#Aqt&)11i`%#O`YqW8GPQ7YPr?<+TF+Fd zGcQK)JC_U+bq-QmcMA&T4s28pY4>Wel39CnJa&+hSv_Y^9r;#+`X7WMz}G!G^zOss zHTyfI!M?%%XEyLt`?Jyy&rd@1&vihi?)Pj^QQx^feBHbg-|F}NXdm)_x&8Ou_|_g^ zMyE!n_UCRo;;p~=Sdl#A{X-G-g?a?{r<9*rV8t2+wnYLc#@C+aCgM3XC0c9 zGUKa5I${x&G>lN;Morerx0M)zBm% zxQ{ykcv8LY>do#L_QzQ+r>7u<{(_^JI#;YEa}=l+#)xivgV&LI|59APplfdy(^ zTCd`GLAi1K>|;&xws$q&y6MLno)vDeB>njJXF909`uv)E8q!B_shi}RKHBk3BiXP5 zL(@{oA0&$EDrpo=8sGtnf_e6;=xr|zQZ-F@r*h1uU1pZ zeV_le++R8-hbxEsz2%=Juh~YyyR&=E>@pXv1__u^I|76%hxJNMY*B?A8@RJ=KtE&` zt!+xKksf+@k6rDp3&~>Jgt}uZ`%rx26-D;z55_BcAE{dMD`6`TqZue;C3>3`EnDBS zf0!!za)tb1YB5zQZA~|~M?bH1rQp*_ewBVfv3^00eqNf7@k&2AnL=mDXzPJOGfKW2 zq2du|A<(1Ru6BaFH}q%|z6GHrw#j~L3jK;&`L?pSN0d*|c(ks=4MKU8ur4SGRdbi* z-jdQ0COI?G2fpW^=T~|YXyG0vqBsKMYf>Q`XU0E3%G!vgMrOtXk~=9m&OT}S(wr|H z@L(1X0k4`%rAoR_sm8XFsz-udN;m-J7C=H(^aq$i#3e4{B68QH#PGRo(Xj!I`Wa1i zeuR;n=8_!-r7vRk1+=qy zYD-TIE07zq2$)EAg77}7f2u*9=^>4->tR|+4w zpqU+!u*&z2k(_je0BhWl{-s?sR!TBrJSpqgdyJ}67haMY74aw@$>xbQ@N*Y(L)cc9 zTVXjKn>D`AvDz^kViTIjcamRPQ{N58U&mHmHKaWT%(qP{DBH{Q3BG6-e5~mj!SD^K z@Kyc+sr0diXz-$efePMdFi;6~{RLE7%5Q*5)i^5!gKfr2LiOQ& zc+Y~OIr%S2A6p;WZ>f8Bd8pS2rf5DJNN&$y7EpZ&(S7;G!A}}D1d5t#{*LV?_bn4~ z;_zue$`%mSWhI?>XTX<&Om&Kf=~m&LxjQq^Z_}Nr zm$WIbQItDQjAww)F{~=$zwW`ScY&1P|8;8z?ZmK32;T{S3uw8!_UsWpdD^03MTw~0RKJdSh5YdVnxwf< zFGL{BC$pW`#^SUEAVF2;o|JyRnzEg)sJ{$l>O2?K53V zNZ7q^O1+p-l`5L%S9eiWa{`PS4}9e~1)aY(6Qn0U9wD3(2Q;o<*mgl)A+%b-iuV6H z09_>1ZiO(vN^R%2$~&2qfe%xv*YkU3QmCJfyxnizyG;R~MDz*ra7KrbLgnVU1q=0e zibkzQ?f=MzWW6nfX}tfV4DhS69d4doP%_cm4Wu7czr9&6;CA2s=)hly z_(@QMxS1B}kL*kjf-mdH`aSY5E)}uH39NTgYBwfLHiu$UC$%`d0sP?FOO^q2N&}Jv zoz(YqprmNH2}hBph5nf;3S#O;K4Pm-A^xZYAv)=Rs@$q>jYm(46F}Yq8NSTa{Sp}z zRmvX49TQs;+NYmzBVOB_DDr*j$qQd=RDQR1TP10YS0%~MUBx_$`1M;Q*y^M(uWBL` z%v^lWW;$Qil#R5G7r@%v?rEQC?Pno;#U74si4 zRh#p@tv|d^Ch#gzqE$vQJA%NO#Nrdq{Q%{jcveB@@(}-RgL_G9rcO;6=UYgztCg%8 zdQfC1^n?q)yaJ>l~fzn1w{wS68eRK%0q@rHNQNe;d5 zFC8V$Bg)jSZ3IZiMOV~QSloJU;Qe#6)!O6(?;gA#%DM7-Ef@C+(&*0=JjjpN=fJmu z6whis^LNV4JM~|)fxnyq`M?IQ_aE!XcgyGbEgO)HKk4mr0Kdil=;6&cRZSprD?~uQT0c#aG8Zt%mA0$xo->u7plUldGigyva9=usmvidsW0TtC-5 zlMEreBHdY|dAYN(A`$X=Wc}jnb%^eL6>GVQKAD=(kn7$J1Ihv=9@~7$XXpkaEF*c7 zx%Fhs*|FX-roe#1jBQ)&sp0ghzVW!~xgfCaT6X8zZ1FBFIkWD_^?ugK;6z-%BlKc1 zz1gN>L$4M#_V2Wx@;y#5i8m3ZE9;H;YA_HXUGN)$T6=nIbN&B6O9x`BZ~9P}u`C zhh?<<zntNG>azq^9S-T2_TjSK?sqd?iEm|XiTRHd3%WOOe z6K@gaQnF+osTx1OZL^j3@tl`+R13U`lGa^?KDMJgkf%U#*2eYu_+83{u;PKOtNFDz z;YNdOy~R!x-I#cjRv&mC-`=*qHVi7I;QGA%EC|}rGGTtv42^#_&-)o1V_OO3Mckbj zmi^iM2#cNDuvhGuUwbKb&6MW=HpRI+qF+wVd3_xFUx-SIqiE}2mM0I>NIy`g$bmFqY(=}`lvKLz$}ZNPAbt>c-fI5dsnGQt f%1)j)S1kzl>U7$9ccu55OI66L<_cO%_V)h;?rQFu diff --git a/detection_rules/etc/packages.yml b/detection_rules/etc/packages.yml index 13d839034..199a93a8e 100644 --- a/detection_rules/etc/packages.yml +++ b/detection_rules/etc/packages.yml @@ -4,12 +4,12 @@ package: maturity: - production log_deprecated: true - name: '8.11' + name: '8.12' registry_data: categories: - security conditions: - kibana.version: ^8.11.0 + kibana.version: ^8.12.0 description: Prebuilt detection rules for Elastic Security format_version: 1.0.0 icons: @@ -23,5 +23,5 @@ package: release: ga title: Prebuilt Security Detection Rules type: integration - version: 8.11.0-beta.0 + version: 8.12.0-beta.0 release: true diff --git a/detection_rules/etc/stack-schema-map.yaml b/detection_rules/etc/stack-schema-map.yaml index b9b1674a8..a7247936a 100644 --- a/detection_rules/etc/stack-schema-map.yaml +++ b/detection_rules/etc/stack-schema-map.yaml @@ -81,11 +81,16 @@ endgame: "8.4.0" "8.10.0": - beats: "8.9.0" - ecs: "8.9.0" + beats: "8.10.3" + ecs: "8.10.0" endgame: "8.4.0" "8.11.0": - beats: "8.9.0" - ecs: "8.9.0" + beats: "8.10.3" + ecs: "8.10.0" + endgame: "8.4.0" + +"8.12.0": + beats: "8.10.3" + ecs: "8.10.0" endgame: "8.4.0" \ No newline at end of file diff --git a/detection_rules/schemas/__init__.py b/detection_rules/schemas/__init__.py index 05fdefcc4..6ac9afc80 100644 --- a/detection_rules/schemas/__init__.py +++ b/detection_rules/schemas/__init__.py @@ -262,6 +262,12 @@ def migrate_to_8_10(version: Version, api_contents: dict) -> dict: return strip_additional_properties(version, api_contents) +@migrate("8.11") +def migrate_to_8_11(version: Version, api_contents: dict) -> dict: + """Default migration for 8.11.""" + return strip_additional_properties(version, api_contents) + + def downgrade(api_contents: dict, target_version: str, current_version: Optional[str] = None) -> dict: """Downgrade a rule to a target stack version.""" from ..packaging import current_stack_version From 2b0735024ea40ec2d20be0dda1d6f3cdfa23f60a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 13 Oct 2023 15:10:49 -0400 Subject: [PATCH 30/86] Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 (#3183) * Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 * Update detection_rules/etc/version.lock.json --------- Co-authored-by: terrancedejesus Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- detection_rules/etc/version.lock.json | 917 ++++++++++++++++---------- 1 file changed, 575 insertions(+), 342 deletions(-) diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index 4c3f0d389..5f60b8849 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -2,9 +2,9 @@ "000047bb-b27a-47ec-8b62-ef1a5d2c9e19": { "min_stack_version": "8.3", "rule_name": "Attempt to Modify an Okta Policy Rule", - "sha256": "ab816235d1086e87acda877a4f3bc72e72af952ecf7a40b59d2d45991812ef73", + "sha256": "8e250a9c8ff04c25044e7bd0932764e6d21ad669c07dcbd9589c825b771b13f2", "type": "query", - "version": 105 + "version": 106 }, "00140285-b827-4aee-aa09-8113f58a08f3": { "min_stack_version": "8.3", @@ -37,16 +37,16 @@ "015cca13-8832-49ac-a01b-a396114809f6": { "min_stack_version": "8.3", "rule_name": "AWS Redshift Cluster Creation", - "sha256": "7a1faa4c3dfde300711d7bb69b6a93b8e64a3d33cc83a37a3d5cfcf6d9b09b2d", + "sha256": "b1c8e121fb4363f74d0c8928f3335aa2f374919f5257a9f4b17483773c49f348", "type": "query", - "version": 103 + "version": 104 }, "0171f283-ade7-4f87-9521-ac346c68cc9b": { "min_stack_version": "8.3", "rule_name": "Potential Network Scan Detected", - "sha256": "22c367ac24c7772c54e861eaef3c3cc0d8677b1dbecc70626f38c6ba482f1eb2", + "sha256": "a149d3ca79d319960c0d9e727ba65ff5e3350567e7f234907d03d7927621b13d", "type": "threshold", - "version": 2 + "version": 3 }, "027ff9ea-85e7-42e3-99d2-bbb7069e02eb": { "min_stack_version": "8.3", @@ -130,9 +130,9 @@ "053a0387-f3b5-4ba5-8245-8002cca2bd08": { "min_stack_version": "8.3", "rule_name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable", - "sha256": "242d70865b8ccc44b23dc4c85ec781e9f6de7966acae6376216fe6157df81b72", + "sha256": "900e474f07b795dfe109f252a2d4a9069cdb9a8471cde0a8e19a36b84f3797ba", "type": "eql", - "version": 106 + "version": 107 }, "0564fb9d-90b9-4234-a411-82a546dc1343": { "min_stack_version": "8.3", @@ -158,16 +158,23 @@ "0635c542-1b96-4335-9b47-126582d2c19a": { "min_stack_version": "8.3", "rule_name": "Remote System Discovery Commands", - "sha256": "21369e608f88a1ea5dcd90d5365bba2e9a909fabf973ed66e37e9136f5f0699a", + "sha256": "43d5cfda7bb1c28139045da08dfbda821d56fd45af89f05a4cf932a0b7eee839", "type": "eql", - "version": 108 + "version": 109 }, "06568a02-af29-4f20-929c-f3af281e41aa": { "min_stack_version": "8.3", "rule_name": "System Time Discovery", - "sha256": "8534280f701e221bc1312804c5bf3de446a2ef36dd62d6e9bc6e3bb765c9cf76", + "sha256": "79c7e1897310a5fff8e9aa62c967679ae8fb0f6681b13c0fd66289142de0e1d6", "type": "eql", - "version": 4 + "version": 5 + }, + "0678bc9c-b71a-433b-87e6-2f664b6b3131": { + "min_stack_version": "8.9", + "rule_name": "Unusual Remote File Size", + "sha256": "ad214cde675085b61786dcd969409c869ca6ea48663d0b5227356ec6b1bd906e", + "type": "machine_learning", + "version": 1 }, "06a7a03c-c735-47a6-a313-51c354aef6c3": { "min_stack_version": "8.3", @@ -258,9 +265,9 @@ "089db1af-740d-4d84-9a5b-babd6de143b0": { "min_stack_version": "8.3", "rule_name": "Windows Account or Group Discovery", - "sha256": "9c4c3dc22f5ae081c7fce7c1cb6523dabdd5affb3e5b4ffce5fe00ec5dd65815", + "sha256": "bb76e59c53a0b50ac513121a9591fecea2eac83851584542c8860bb511c0785f", "type": "eql", - "version": 2 + "version": 3 }, "08d5d7e2-740f-44d8-aeda-e41f4263efaf": { "rule_name": "TCP Port 8000 Activity to the Internet", @@ -312,9 +319,9 @@ "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Remote Execution Capabilities via WinRM", - "sha256": "6292561dbd089951c5f89ea4611e1d54d55397b493aa93f8cdba5c3e5f7e09fa", + "sha256": "c33b0262570792c916921cd4645eb950802579016d010a5a0c5672fa4007efc8", "type": "query", - "version": 1 + "version": 2 }, "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5": { "min_stack_version": "8.3", @@ -398,9 +405,9 @@ "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5": { "min_stack_version": "8.3", "rule_name": "Execution of File Written or Modified by Microsoft Office", - "sha256": "b2d0f5656de26bb1163ed5edbb9bf90bde8a599b310b94c0eb3e629ddc0b93a3", + "sha256": "a66ec71c96a9c0d09c09ad1d94067327b19e7db5411461bda17ce482fff03de5", "type": "eql", - "version": 106 + "version": 107 }, "0e52157a-8e96-4a95-a6e3-5faae5081a74": { "min_stack_version": "8.3", @@ -484,16 +491,16 @@ "11013227-0301-4a8c-b150-4db924484475": { "min_stack_version": "8.3", "rule_name": "Abnormally Large DNS Response", - "sha256": "7ae8452448297fae3af27315e9a0cd50e7419f0dec791237656f8859df113c3f", + "sha256": "a8cf0f414de9d2716b4dbf0198d541bf88a0777aefe1be83c09fc6f472d86721", "type": "query", - "version": 104 + "version": 105 }, "1160dcdb-0a0a-4a79-91d8-9b84616edebd": { "min_stack_version": "8.3", "rule_name": "Potential DLL SideLoading via Trusted Microsoft Programs", - "sha256": "6ed2244e093a1870d45df1482662e4f762ce4734090878e0a1d1a06e9675b775", + "sha256": "ab39fe136a7992f299f43bce78b299f1c1491092730e5d6a4c4bf4d3f9231935", "type": "eql", - "version": 105 + "version": 106 }, "1178ae09-5aff-460a-9f2f-455cd0ac4d8e": { "min_stack_version": "8.3", @@ -505,9 +512,9 @@ "119c8877-8613-416d-a98a-96b6664ee73a": { "min_stack_version": "8.3", "rule_name": "AWS RDS Snapshot Export", - "sha256": "d7c79adde1bf89e2a7544eec2729c0b5c45c62fdcdd5f00090d28e5cb73f6da7", + "sha256": "8ad9d6381bc6ad8046516f5f50cdc304ccb0958161af21a171928b95088b6b17", "type": "query", - "version": 103 + "version": 104 }, "119c8877-8613-416d-a98a-96b6664ee73a5": { "rule_name": "AWS RDS Snapshot Export", @@ -518,9 +525,9 @@ "11dd9713-0ec6-4110-9707-32daae1ee68c": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Token Impersonation Capabilities", - "sha256": "f455fef003011587f2e1a56fce94b03276f7155952af5cd091a8eadf88a62e68", + "sha256": "d41a56fd39249f9a8ecaea4b7739a996efe8bbd66aa4165345951de99ac2d102", "type": "query", - "version": 7 + "version": 8 }, "11ea6bec-ebde-4d71-a8e9-784948f8e3e9": { "min_stack_version": "8.3", @@ -532,9 +539,9 @@ "12051077-0124-4394-9522-8f4f4db1d674": { "min_stack_version": "8.3", "rule_name": "AWS Route 53 Domain Transfer Lock Disabled", - "sha256": "845e16fdf9dd59a0ee37658ad41a83a6149e5487422dac763de90cde6aad227f", + "sha256": "ee7d0fde7179ecae486163263d6baf71e90dd5e6048b4db1674a4d4eff6f2975", "type": "query", - "version": 103 + "version": 104 }, "120559c6-5e24-49f4-9e30-8ffe697df6b9": { "rule_name": "User Discovery via Whoami", @@ -640,9 +647,9 @@ "143cb236-0956-4f42-a706-814bcaa0cf5a": { "min_stack_version": "8.3", "rule_name": "RPC (Remote Procedure Call) from the Internet", - "sha256": "54422260766b12b7477aec8acb27085b1eae0a36285553d26e5730bce422e7a9", + "sha256": "9b392ee77e47d008944419960e03112af84f3ccc7b043af0c2d16d636e610214", "type": "query", - "version": 102 + "version": 103 }, "14dab405-5dd9-450c-8106-72951af2391f": { "min_stack_version": "8.3", @@ -719,9 +726,9 @@ "169f3a93-efc7-4df2-94d6-0d9438c310d1": { "min_stack_version": "8.3", "rule_name": "AWS IAM Group Creation", - "sha256": "b742e26488a024ca917c76ed8b6d78e38bceaf88b12ac5a184cba21816858e5c", + "sha256": "b97182b40fec27cf6728746f838be74ee2cf5ebee183fc5d0f6eaf338b7d90a3", "type": "query", - "version": 103 + "version": 104 }, "16a52c14-7883-47af-8745-9357803f0d4c": { "min_stack_version": "8.3", @@ -806,6 +813,13 @@ "type": "eql", "version": 100 }, + "18a5dd9a-e3fa-4996-99b1-ae533b8f27fc": { + "min_stack_version": "8.9", + "rule_name": "Spike in Number of Connections Made to a Destination IP", + "sha256": "92faf5914bec5a5a185f949112f5ff576d15fd69a5f405d73697602768830d77", + "type": "machine_learning", + "version": 1 + }, "193549e8-bb9e-466a-a7f9-7e783f5cb5a6": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via Recently Compiled Executable", @@ -816,9 +830,16 @@ "19de8096-e2b0-4bd8-80c9-34a820813fff": { "min_stack_version": "8.3", "rule_name": "Rare AWS Error Code", - "sha256": "36fb7f357ab4c1d87f38a2a9f453fb1093c959582b23dda8d3071db185b7d65d", + "sha256": "45da42408e9e47f7550b2ff787fd33fe211dc4d0c4ccbfd9342ae768d88384ec", "type": "machine_learning", - "version": 106 + "version": 107 + }, + "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03": { + "min_stack_version": "8.9", + "rule_name": "Spike in Number of Processes in an RDP Session", + "sha256": "c3869d7536ca507bf986047bad80507a729751302776f5a258810c9a9814c2de", + "type": "machine_learning", + "version": 1 }, "1a289854-5b78-49fe-9440-8a8096b1ab50": { "min_stack_version": "8.8", @@ -844,9 +865,9 @@ "1aa8fa52-44a7-4dae-b058-f3333b91c8d7": { "min_stack_version": "8.3", "rule_name": "AWS CloudTrail Log Suspended", - "sha256": "e728282d89ab6116e74d508a075da4f9a1388ba2da235fd87605b4ad580312f0", + "sha256": "dd01a147a8898a4f6c696c83a4c436bf0325ab7552a03039d7cd71ff0b6c00dc", "type": "query", - "version": 106 + "version": 107 }, "1aa9181a-492b-4c01-8b16-fa0735786b2b": { "min_stack_version": "8.3", @@ -865,9 +886,9 @@ "1ba5160d-f5a2-4624-b0ff-6a1dc55d2516": { "min_stack_version": "8.3", "rule_name": "AWS ElastiCache Security Group Modified or Deleted", - "sha256": "bcef75f6d49bb03184f9398613ed080bc7bd2279da99afaa50ba68d3a99f3b4c", + "sha256": "95e2cb6322ef7b2d7bc2fc96460cbfcb4c76f0eb17351a134c783936996adab0", "type": "query", - "version": 103 + "version": 104 }, "1c27fa22-7727-4dd3-81c0-de6da5555feb": { "min_stack_version": "8.3", @@ -897,6 +918,13 @@ "type": "query", "version": 102 }, + "1ca62f14-4787-4913-b7af-df11745a49da": { + "min_stack_version": "8.3", + "rule_name": "New GitHub App Installed", + "sha256": "02e98cecd6d72a19ba1f1961d35d14774632ecb42f89c7fc7f1e162b60bc89fe", + "type": "eql", + "version": 1 + }, "1cd01db9-be24-4bef-8e7c-e923f0ff78ab": { "min_stack_version": "8.3", "rule_name": "Incoming Execution via WinRM Remote Shell", @@ -914,9 +942,9 @@ "1d72d014-e2ab-4707-b056-9b96abe7b511": { "min_stack_version": "8.3", "rule_name": "External IP Lookup from Non-Browser Process", - "sha256": "b1a5f097c5ad6885bbd55d4375fd72cfc09507c502321b80aec6edfe33bc3a75", + "sha256": "d08e975b8630d786933967d9de847dfbdd6fc6a5447715691a1a27ee3b22198a", "type": "eql", - "version": 106 + "version": 107 }, "1d9aeb0b-9549-46f6-a32d-05e2a001b7fd": { "min_stack_version": "8.3", @@ -949,9 +977,9 @@ "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Discovery Capabilities", - "sha256": "3dccbfd612147d0714339a1a2d6ad16efe695f6d5d9ea764a595cec716beff1b", + "sha256": "e1abdaaaa56dcd60699f61e183b6ee3d637065363a4aef48e49785d0f3d52a12", "type": "query", - "version": 2 + "version": 3 }, "1e0b832e-957e-43ae-b319-db82d228c908": { "min_stack_version": "8.3", @@ -1026,9 +1054,9 @@ "2045567e-b0af-444a-8c0b-0b6e2dae9e13": { "min_stack_version": "8.3", "rule_name": "AWS Route 53 Domain Transferred to Another Account", - "sha256": "cd100d12464b46b1f170d8e6b26ed144023ba52b4077a97354a6a9fcbabf7465", + "sha256": "7512cf97f8885a42febe293ecc8c04d77f6369d4ba87372fcd3ef38a204f9af3", "type": "query", - "version": 103 + "version": 104 }, "20457e4f-d1de-4b92-ae69-142e27a4342a": { "min_stack_version": "8.3", @@ -1095,9 +1123,9 @@ "227dc608-e558-43d9-b521-150772250bae": { "min_stack_version": "8.3", "rule_name": "AWS S3 Bucket Configuration Deletion", - "sha256": "ad8600664f0e0704b136c9959aec90beb90d433fd1457d49adc4e920ad882f17", + "sha256": "7804226b0da1b8d6dde3bbfed024feab1da6c23e091dfa55852b50309f4dd9fe", "type": "query", - "version": 104 + "version": 105 }, "231876e7-4d1f-4d63-a47c-47dd1acdc1cb": { "min_stack_version": "8.3", @@ -1120,6 +1148,20 @@ "type": "eql", "version": 105 }, + "2377946d-0f01-4957-8812-6878985f515d": { + "min_stack_version": "8.9", + "rule_name": "Remote File Creation on a Sensitive Directory", + "sha256": "d175835a59f26f5a7a7607eec8ec9be98bff92a092fcb817859b99170ad0ddd6", + "type": "eql", + "version": 1 + }, + "24401eca-ad0b-4ff9-9431-487a8e183af9": { + "min_stack_version": "8.3", + "rule_name": "New GitHub Owner Added", + "sha256": "360c844a728a8074f32947d9ad6d1b26d414b7aafe87847d5b92dc546b8931f5", + "type": "eql", + "version": 1 + }, "25224a80-5a4a-4b8a-991e-6ab390465c4f": { "min_stack_version": "8.3", "rule_name": "Lateral Movement via Startup Folder", @@ -1127,6 +1169,13 @@ "type": "eql", "version": 104 }, + "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39": { + "min_stack_version": "8.3", + "rule_name": "Potential Reverse Shell via Background Process", + "sha256": "e46a905a4613f54e71ebce5fcab1853140ae284c3d0ecc23ad4afa82c5ca69e3", + "type": "eql", + "version": 1 + }, "2605aa59-29ac-4662-afad-8d86257c7c91": { "min_stack_version": "8.3", "rule_name": "Potential Suspicious DebugFS Root Device Access", @@ -1172,9 +1221,9 @@ "27071ea3-e806-4697-8abc-e22c92aa4293": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Archive Compression Capabilities", - "sha256": "2173b0cc2bec6028b91c5b9a051908ca9d6ea87cae8c881a23622b6239e85eee", + "sha256": "2a8ff80cbf124d75571a8831f389c7e67129f89c0f2d1b512133a48bbf0d3478", "type": "query", - "version": 2 + "version": 3 }, "272a6484-2663-46db-a532-ef734bf9a796": { "min_stack_version": "8.3", @@ -1248,9 +1297,9 @@ "29052c19-ff3e-42fd-8363-7be14d7c5469": { "min_stack_version": "8.3", "rule_name": "AWS Security Group Configuration Change Detection", - "sha256": "6eafdfc2847d0f8150d36752200d76b3777de7dd46ac7d6c1dab97c2b6afaa67", + "sha256": "f057a319aa5b049290fa8416727ae3ef64bb9ac7779901a61713efe9acef57da", "type": "query", - "version": 103 + "version": 104 }, "290aca65-e94d-403b-ba0f-62f320e63f51": { "min_stack_version": "8.3", @@ -1267,11 +1316,27 @@ "version": 106 }, "291a0de9-937a-4189-94c0-3e847c8b13e4": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Enumeration of Privileged Local Groups Membership", + "sha256": "f1ce7be911b34a06915e3f07c41e6e91d314bf37dfb168fb109057d04b56b5c3", + "type": "eql", + "version": 108 + } + }, "rule_name": "Enumeration of Privileged Local Groups Membership", - "sha256": "f1ce7be911b34a06915e3f07c41e6e91d314bf37dfb168fb109057d04b56b5c3", - "type": "eql", - "version": 108 + "sha256": "6f6f6175fa206cf7e0c3a47488388561ee39b49bc0b1f18f6baede4fe3ded355", + "type": "new_terms", + "version": 208 + }, + "29ef5686-9b93-433e-91b5-683911094698": { + "min_stack_version": "8.6", + "rule_name": "Unusual Discovery Signal Alert with Unusual Process Command Line", + "sha256": "18bae187efca3e9942f377e9508ca6f0266f122ab379929ab8d6a0d22dc4a342", + "type": "new_terms", + "version": 1 }, "29f0cf93-d17c-4b12-b4f3-a433800539fa": { "min_stack_version": "8.3", @@ -1401,9 +1466,9 @@ "2e580225-2a58-48ef-938b-572933be06fe": { "min_stack_version": "8.3", "rule_name": "Halfbaked Command and Control Beacon", - "sha256": "09e550845fb86206a91ec5d634e2a5427e344a491c0c76e59a66b6f4a4d4f99e", + "sha256": "e19b7c3823c6e134dd116b5b1562e846ca9d4d847a6e25da14c421165a39d028", "type": "query", - "version": 102 + "version": 103 }, "2edc8076-291e-41e9-81e4-e3fcbc97ae5e": { "min_stack_version": "8.3", @@ -1447,6 +1512,13 @@ "type": "eql", "version": 106 }, + "301571f3-b316-4969-8dd0-7917410030d3": { + "min_stack_version": "8.9", + "rule_name": "Malicious Remote File Creation", + "sha256": "3b64dae20a1caf09073534a22a7e22eb31c7ac6212a08748110048e1e2f0f2f0", + "type": "eql", + "version": 1 + }, "30562697-9859-4ae0-a8c5-dab45d664170": { "min_stack_version": "8.3", "rule_name": "GCP Firewall Rule Creation", @@ -1471,9 +1543,9 @@ "31295df3-277b-4c56-a1fb-84e31b4222a9": { "min_stack_version": "8.3", "rule_name": "Inbound Connection to an Unsecure Elasticsearch Node", - "sha256": "394278b77c3a54380ee197c9763706f2e530452d5b564a4c0d6b14137d57f87e", + "sha256": "d7b2ec2f04b54fbd827d684086503c9240c5b500bb50c7ba12525842e88890d1", "type": "query", - "version": 102 + "version": 103 }, "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62": { "min_stack_version": "8.3", @@ -1499,9 +1571,9 @@ "32923416-763a-4531-bb35-f33b9232ecdb": { "min_stack_version": "8.3", "rule_name": "RPC (Remote Procedure Call) to the Internet", - "sha256": "f989ae55a6fdc1e9c9a11c92fd231aa626b1bb662b0a119d8f5cae8d3c0f3577", + "sha256": "7ca9c8daa861f8675fc6d90454ceb1fbbeb55621db753f0ffa615be1509581ea", "type": "query", - "version": 102 + "version": 103 }, "32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14": { "min_stack_version": "8.3", @@ -1520,9 +1592,9 @@ "333de828-8190-4cf5-8d7c-7575846f6fe0": { "min_stack_version": "8.3", "rule_name": "AWS IAM User Addition to Group", - "sha256": "02db7a25c54c4fbd473ce6ca4a124bfeaba29b63ff68e2d89d4cd27167d6ae7d", + "sha256": "e6dc79527703135b1ce027a5d88baa39dd4c3512d0a5f56a036b8a27eab4ee81", "type": "query", - "version": 106 + "version": 107 }, "33a6752b-da5e-45f8-b13a-5f094c09522f": { "min_stack_version": "8.5", @@ -1555,9 +1627,9 @@ "34fde489-94b0-4500-a76f-b8a157cf9269": { "min_stack_version": "8.3", "rule_name": "Accepted Default Telnet Port Connection", - "sha256": "6fde829b7083578ace3bcf3cb7d8c73a7cc94241c0a398fbc0d6b2ccf1f46505", + "sha256": "5a1c81a6f5119308ed2c419c07cd7d61610c4bf863351341f4f1c5c3d54644b1", "type": "query", - "version": 103 + "version": 104 }, "35330ba2-c859-4c98-8b7f-c19159ea0e58": { "min_stack_version": "8.3", @@ -1607,6 +1679,13 @@ "type": "eql", "version": 104 }, + "36c48a0c-c63a-4cbc-aee1-8cac87db31a9": { + "min_stack_version": "8.9", + "rule_name": "High Mean of Process Arguments in an RDP Session", + "sha256": "43e809e5064a205d0a1e107068d372415cecef22a677dc5acb3bd91b754772b5", + "type": "machine_learning", + "version": 1 + }, "3728c08d-9b70-456b-b6b8-007c7d246128": { "min_stack_version": "8.3", "rule_name": "Potential Suspicious File Edit", @@ -1617,9 +1696,9 @@ "378f9024-8a0c-46a5-aa08-ce147ac73a4e": { "min_stack_version": "8.3", "rule_name": "AWS RDS Security Group Creation", - "sha256": "5b75c7ff3b23af486b2a98aa509dba99b6e5935a1884bcf20ce26298c87a413a", + "sha256": "6ed9dc7097e846293dbf822a322406b46fcbd9d6642245a4dfbc73aabd62537b", "type": "query", - "version": 103 + "version": 104 }, "37994bca-0611-4500-ab67-5588afe73b77": { "min_stack_version": "8.3", @@ -1637,9 +1716,9 @@ "37b211e8-4e2f-440f-86d8-06cc8f158cfa": { "min_stack_version": "8.3", "rule_name": "AWS Execution via System Manager", - "sha256": "2cbc10f8cfc4b487c2e60d03f65c07f3edfffcc2aff4715f233e6dc5d5164c60", + "sha256": "f01c87073629652bd0f1abe3f300881145bb533a262308717ffcc0bab17a3dd0", "type": "query", - "version": 106 + "version": 107 }, "37f638ea-909d-4f94-9248-edd21e4a9906": { "min_stack_version": "8.3", @@ -1651,9 +1730,9 @@ "3805c3dc-f82c-4f8d-891e-63c24d3102b0": { "min_stack_version": "8.3", "rule_name": "Attempted Bypass of Okta MFA", - "sha256": "f4d46f02451d1b387f81c66eaf2bac499ae2b55dab8b5ff072060d572c17bae2", + "sha256": "6873fd08617e0efde5dccf424aacbfe7057877288810c2ed68293f795964241b", "type": "query", - "version": 105 + "version": 106 }, "3838e0e3-1850-4850-a411-2e8c5ba40ba8": { "min_stack_version": "8.3", @@ -1686,9 +1765,9 @@ "39144f38-5284-4f8e-a2ae-e3fd628d90b0": { "min_stack_version": "8.3", "rule_name": "AWS EC2 Network Access Control List Creation", - "sha256": "dea5a5643f79a683de4d055fc1e7c3f2444af041cad46e962eea1d3f5f8310d4", + "sha256": "ad7864116d4d41fba90af76f8325d2a86358ed55b0b9be7204d8983cc62b2614", "type": "query", - "version": 103 + "version": 104 }, "39157d52-4035-44a8-9d1a-6f8c5f580a07": { "min_stack_version": "8.3", @@ -1727,9 +1806,9 @@ "3ad49c61-7adc-42c1-b788-732eda2f5abf": { "min_stack_version": "8.3", "rule_name": "VNC (Virtual Network Computing) to the Internet", - "sha256": "f452215a79041dee079474e59d224d2fb4c3c03ed44830b5e5d36e4d1ab89007", + "sha256": "75c83bc25b63f6d009bfaa4c5ad8ac726f34d8463a71addc994107e75c6f41e3", "type": "query", - "version": 103 + "version": 104 }, "3ad77ed4-4dcf-4c51-8bfc-e3f7ce316b2f": { "min_stack_version": "8.3", @@ -1769,16 +1848,23 @@ "3d3aa8f9-12af-441f-9344-9f31053e316d": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Log Clear Capabilities", - "sha256": "26c1661135e8af69b7d550fd193137f635de465260e8fd9c383708024444180c", + "sha256": "ad925532e35677e84cb73970b142002377617338f4574eb6ca4dbd7bfcdb37a7", "type": "query", - "version": 1 + "version": 2 }, "3e002465-876f-4f04-b016-84ef48ce7e5d": { "min_stack_version": "8.3", "rule_name": "AWS CloudTrail Log Updated", - "sha256": "c544d2bed3c1f0c3eb62422883fdd5c1a029d8a1e4ade88af0b3aaaa0955dc99", + "sha256": "889bfc3e221a4919949c2b2fab1b12ee9a96a75c27e1e249c243318f7bd81063", "type": "query", - "version": 106 + "version": 107 + }, + "3e0561b5-3fac-4461-84cc-19163b9aaa61": { + "min_stack_version": "8.9", + "rule_name": "Spike in Number of Connections Made from a Source IP", + "sha256": "d02ca6fa6392da7a7d8757ae5757e04feb7e340f9b58af698935f60f077e5b80", + "type": "machine_learning", + "version": 1 }, "3e0eeb75-16e8-4f2f-9826-62461ca128b7": { "min_stack_version": "8.3", @@ -1852,6 +1938,13 @@ "type": "eql", "version": 2 }, + "3f4e2dba-828a-452a-af35-fe29c5e78969": { + "min_stack_version": "8.9", + "rule_name": "Unusual Time or Day for an RDP Session", + "sha256": "649d4962dc3c27de65026dd648d4e7b0e8285a58920fe69e4994449af66eac61", + "type": "machine_learning", + "version": 1 + }, "403ef0d3-8259-40c9-a5b6-d48354712e49": { "min_stack_version": "8.3", "rule_name": "Unusual Persistence via Services Registry", @@ -1869,9 +1962,9 @@ "416697ae-e468-4093-a93d-59661fa619ec": { "min_stack_version": "8.3", "rule_name": "Control Panel Process with Unusual Arguments", - "sha256": "adeea0cfa04ee8759f832217f19f0ce3d6952e72c717c271909ab099034c8659", + "sha256": "1de1e9aa9030d56c6c6629cd92e3ba65d61bfc9063b76ea2abe412899a224d3f", "type": "eql", - "version": 106 + "version": 107 }, "41824afb-d68c-4d0e-bfee-474dac1fa56e": { "min_stack_version": "8.3", @@ -1897,9 +1990,9 @@ "42bf698b-4738-445b-8231-c834ddefd8a0": { "min_stack_version": "8.3", "rule_name": "Okta Brute Force or Password Spraying Attack", - "sha256": "9ecdb590d2df1959b2b11908911f24308925c345cce10b0370721afd09a2196e", + "sha256": "60954a70897438ce1627fe0aab388688a6c189b04e7eca5543e0c450283c029b", "type": "threshold", - "version": 105 + "version": 106 }, "42eeee3d-947f-46d3-a14d-7036b962c266": { "min_stack_version": "8.3", @@ -2108,23 +2201,23 @@ "4973e46b-a663-41b8-a875-ced16dda2bb0": { "min_stack_version": "8.6", "rule_name": "Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable", - "sha256": "b29c0c0615f8cdfe01647648349a42a142712d082bff8d986549ed7b4956c0d7", + "sha256": "9fa82ebadcb5c5f29578c49072ea5d921ce9a8af05291cd755e5c6aefcc422d7", "type": "eql", - "version": 2 + "version": 3 }, "4982ac3e-d0ee-4818-b95d-d9522d689259": { "min_stack_version": "8.3", "rule_name": "Process Discovery Using Built-in Tools", - "sha256": "0f03ec3cf254ddaf2fb897452085888fda783e6d3394923b04505ac968500d17", + "sha256": "37099aca1b1bdce63f77e75103ff60a0d61898af8036c43eaa2f4d672bd326dd", "type": "eql", - "version": 2 + "version": 3 }, "4a4e23cf-78a2-449c-bac3-701924c269d3": { "min_stack_version": "8.3", "rule_name": "Possible FIN7 DGA Command and Control Behavior", - "sha256": "4fbdf3bd4ba58ab5558059d13784148c40f700fc0726f9df2b88d02dcd301625", + "sha256": "fb2b93218641d75dfdcf31527ed8c4baa8ab8d79de140128a054b9a7eb67aac0", "type": "query", - "version": 102 + "version": 103 }, "4a99ac6f-9a54-4ba5-a64f-6eb65695841b": { "min_stack_version": "8.3", @@ -2192,9 +2285,9 @@ "4d50a94f-2844-43fa-8395-6afbd5e1c5ef": { "min_stack_version": "8.3", "rule_name": "AWS Management Console Brute Force of Root User Identity", - "sha256": "32d9ab18831ca9798b2304547daeb8258a6f8905a01a54c468b20409eee885f6", + "sha256": "c7f85d799207c359e3f84f41c0473858bad893198ffa7f3d8327d153eb0b422c", "type": "threshold", - "version": 103 + "version": 104 }, "4da13d6e-904f-4636-81d8-6ab14b4e6ae9": { "min_stack_version": "8.3", @@ -2241,9 +2334,9 @@ "4edd3e1a-3aa0-499b-8147-4d2ea43b1613": { "min_stack_version": "8.3", "rule_name": "Unauthorized Access to an Okta Application", - "sha256": "8e3e57e9dbe9ec6a8cc4673f80020513ca5a4c120e4a9efb9f8acc7a646de4c8", + "sha256": "6cf84f243e86183b9bc2efdc39aa92f7573c421593ce71f1ce90dd87daf5b2dd", "type": "query", - "version": 104 + "version": 105 }, "4fe9d835-40e1-452d-8230-17c147cafad8": { "min_stack_version": "8.3", @@ -2255,9 +2348,9 @@ "51176ed2-2d90-49f2-9f3d-17196428b169": { "min_stack_version": "8.3", "rule_name": "Windows System Information Discovery", - "sha256": "97b96679737e68fddbc04eaf2cdb22e954524acf822f15557c9d8e5de258496c", + "sha256": "2c0c54011671e9e99d2654529520c137188a4bbcf8feb0beb28c196f0525d88e", "type": "eql", - "version": 2 + "version": 3 }, "5124e65f-df97-4471-8dcb-8e3953b3ea97": { "min_stack_version": "8.3", @@ -2297,23 +2390,23 @@ "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0": { "min_stack_version": "8.3", "rule_name": "Potential Successful Linux RDP Brute Force Attack Detected", - "sha256": "c3228a5cb84c6e646834e1f6a578e0b7c642d97082d1faf6cb28e94b94553d66", + "sha256": "da0f4a98171700a7be9bdcc51c7e387d476f86016c7d95dd1313f5d899c34fe3", "type": "eql", - "version": 1 + "version": 2 }, "523116c0-d89d-4d7c-82c2-39e6845a78ef": { "min_stack_version": "8.3", "rule_name": "AWS GuardDuty Detector Deletion", - "sha256": "875d325d03aab871f3af655b2a4f09f60421b1863ada9a2e59e415560be70fa6", + "sha256": "238e31f86ad8ffd8ec077358374a122a8c7bbee39ce994f761ad3441be820a9c", "type": "query", - "version": 103 + "version": 104 }, "52376a86-ee86-4967-97ae-1a05f55816f0": { "min_stack_version": "8.3", "rule_name": "Linux Restricted Shell Breakout via Linux Binary(s)", - "sha256": "6290c2857ed36cf95047595761ef26fcbd7d025b31e56eb92016113c70d70c5a", + "sha256": "b6f2ca3d5270df9abe50800ebae493a3d6b715de6b3caea02f86fcd29c4f3c7e", "type": "eql", - "version": 108 + "version": 109 }, "52aaab7b-b51c-441a-89ce-4387b3aea886": { "min_stack_version": "8.3", @@ -2358,9 +2451,9 @@ "536997f7-ae73-447d-a12d-bff1e8f5f0a0": { "min_stack_version": "8.3", "rule_name": "AWS EFS File System or Mount Deleted", - "sha256": "dea68832916d128880a091971ddca7401be50c5a91b85315b44276c17c34b3a2", + "sha256": "28f9744c81cfffbf8417f66ee1911ac9da89e9e352c5db4f0af9d725cd73c907", "type": "query", - "version": 103 + "version": 104 }, "5370d4cd-2bb3-4d71-abf5-1e1d0ff5a2de": { "min_stack_version": "8.3", @@ -2393,9 +2486,9 @@ "54a81f68-5f2a-421e-8eed-f888278bb712": { "min_stack_version": "8.3", "rule_name": "Exchange Mailbox Export via PowerShell", - "sha256": "7abb75759648c733f8e4b39c60bd36ccf8b431e1fd27097e698724bc33d34e4b", + "sha256": "4258789d2232d8488f2dfcc621c1793b94aa3eb5e24ddc697886a3854fa2e0cc", "type": "query", - "version": 4 + "version": 5 }, "54c3d186-0461-4dc3-9b33-2dc5c7473936": { "min_stack_version": "8.3", @@ -2449,23 +2542,32 @@ "56f2e9b5-4803-4e44-a0a4-a52dc79d57fe": { "min_stack_version": "8.3", "rule_name": "PowerShell PSReflect Script", - "sha256": "443cf0180678565fae6aab3fde53464a3fc6f6161ae2be250b2f29d08e3b1071", + "sha256": "8d62732e2d51a8e4d9e1d8705b48e82534ff622c316a9d2a217a2765ae84e988", "type": "query", - "version": 107 + "version": 108 }, "56fdfcf1-ca7c-4fd9-951d-e215ee26e404": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 101, + "rule_name": "Execution of an Unsigned Service", + "sha256": "d6a1937f8097432a0d45cff0e4c52746877e8dfc576edec64a5e6235c80ca1bc", + "type": "eql", + "version": 2 + } + }, "rule_name": "Execution of an Unsigned Service", - "sha256": "d6a1937f8097432a0d45cff0e4c52746877e8dfc576edec64a5e6235c80ca1bc", - "type": "eql", - "version": 2 + "sha256": "de385d99890c067206d3515ec1c99db389d34cf974afb8ad6478deaf0e14f592", + "type": "new_terms", + "version": 102 }, "5700cb81-df44-46aa-a5d7-337798f53eb8": { "min_stack_version": "8.3", "rule_name": "VNC (Virtual Network Computing) from the Internet", - "sha256": "57330331ceebc76d136b11b9a4aad37660028ce464cffd529f0023ad0a5399b2", + "sha256": "08484b01efb6cd6e700e6ac39d1766a24491ac8d9aee3de5719c03ee0e204a06", "type": "query", - "version": 103 + "version": 104 }, "571afc56-5ed9-465d-a2a9-045f099f6e7e": { "min_stack_version": "8.3", @@ -2547,9 +2649,9 @@ "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed": { "min_stack_version": "8.3", "rule_name": "AWS CloudTrail Log Created", - "sha256": "0ebf115d87113f0fb8cfb856cf09dd40a7bc00703443d8f5dc149be5cf2d7a26", + "sha256": "84221ea6d1d7084ea241331b852a80ca276abc757430ea68253a3add4daca7a4", "type": "query", - "version": 104 + "version": 105 }, "59756272-1998-4b8c-be14-e287035c4d10": { "min_stack_version": "8.3", @@ -2624,9 +2726,9 @@ "5beaebc1-cc13-4bfc-9949-776f9e0dc318": { "min_stack_version": "8.3", "rule_name": "AWS WAF Rule or Rule Group Deletion", - "sha256": "353bb55da009500a46a3701adb0b1bb680c718959d2e5969960085c211562f98", + "sha256": "333f27913815c1e4ec223cb266bc34cfadb31ac1a598d1fac7a8de01ac3abd9b", "type": "query", - "version": 103 + "version": 104 }, "5c6f4c58-b381-452a-8976-f1b1c6aa0def": { "min_stack_version": "8.4", @@ -2891,9 +2993,9 @@ "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d": { "min_stack_version": "8.3", "rule_name": "Potential Successful Linux FTP Brute Force Attack Detected", - "sha256": "5011350beae3fbee34961ee280dce76139c391e32caf77391b710c0998735d95", + "sha256": "5ee22642a55e0ff14c438cbc0f77b7746f9fe23b533621103b27df8a9b808d40", "type": "eql", - "version": 1 + "version": 2 }, "66883649-f908-4a5b-a1e0-54090a1d3a32": { "min_stack_version": "8.3", @@ -2926,9 +3028,9 @@ "6731fbf2-8f28-49ed-9ab9-9a918ceb5a45": { "min_stack_version": "8.3", "rule_name": "Attempt to Modify an Okta Policy", - "sha256": "bcc00051e5ab5b70c88a4b1559e4edcff319d79f2bbe5bfcab404a3d63457d63", + "sha256": "0f0e1ba88bbda85d60bb8fc96bda554db238881ea16937d0f0fa5414a15e6ede", "type": "query", - "version": 104 + "version": 105 }, "675239ea-c1bc-4467-a6d3-b9e2cc7f676d": { "min_stack_version": "8.3", @@ -2940,9 +3042,9 @@ "676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7": { "min_stack_version": "8.3", "rule_name": "Attempt to Revoke Okta API Token", - "sha256": "f58a59fe0d9f317a1998e97634f691d5f4b4b0dc6b79fc874df5f7b9185a9f93", + "sha256": "e8e7b2e174c70d5a4a851a47b90138516f2a3c440e275c037a6f1334759c87de", "type": "query", - "version": 104 + "version": 105 }, "67a9beba-830d-4035-bfe8-40b7e28f8ac4": { "rule_name": "SMTP to the Internet", @@ -2980,9 +3082,9 @@ "6885d2ae-e008-4762-b98a-e8e1cd3a81e9": { "min_stack_version": "8.3", "rule_name": "Okta ThreatInsight Threat Suspected Promotion", - "sha256": "44208f997fe40e0ec5625789243073bee7f66e3d2be2ed117e69e6f9b6907a21", + "sha256": "8d04de56ef8b8f97264ebf4f9614963e43b9106d543823fdccbce9b59a0011d8", "type": "query", - "version": 103 + "version": 104 }, "68921d85-d0dc-48b3-865f-43291ca2c4f2": { "min_stack_version": "8.3", @@ -3017,9 +3119,9 @@ "68a7a5a5-a2fc-4a76-ba9f-26849de881b4": { "min_stack_version": "8.3", "rule_name": "AWS CloudWatch Log Group Deletion", - "sha256": "2e8fdc6b595399328a680fc066469a0edae5a41684f4190a837deaa8adf32ae4", + "sha256": "6c4325ced0b53d29535ee5afd746cd09fd120823f660b5bd3518ca50fadca146", "type": "query", - "version": 106 + "version": 107 }, "68d56fdc-7ffa-4419-8e95-81641bd6f845": { "min_stack_version": "8.3", @@ -3031,9 +3133,9 @@ "6951f15e-533c-4a60-8014-a3c3ab851a1b": { "min_stack_version": "8.3", "rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion", - "sha256": "1bcb655a06d0561e1f4f6e9466d148178ddf1edc310aa5b738f246db479c1afd", + "sha256": "62a819dfff5aff4d9a71c1af4dbee137aa6d96683a906088769effac0fdbd8b1", "type": "query", - "version": 3 + "version": 4 }, "699e9fdb-b77c-4c01-995c-1c15019b9c43": { "min_stack_version": "8.5", @@ -3061,9 +3163,9 @@ "69c420e8-6c9e-4d28-86c0-8a2be2d1e78c": { "min_stack_version": "8.3", "rule_name": "AWS IAM Password Recovery Requested", - "sha256": "d16a1105cf83086a436f452d32fd1564076c4a7425498c922ca33cdcd2246c17", + "sha256": "31f084b4192870ca6c93d341a1f9e6d9eecaaefe046fcf6687209ec23866edf3", "type": "query", - "version": 103 + "version": 104 }, "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7": { "min_stack_version": "8.3", @@ -3121,6 +3223,13 @@ "type": "machine_learning", "version": 107 }, + "6d8685a1-94fa-4ef7-83de-59302e7c4ca8": { + "min_stack_version": "8.6", + "rule_name": "Potential Privilege Escalation via CVE-2023-4911", + "sha256": "cc466d496fd9e306e2a0e4ea3c56d690ff0737b1e3c1506daef475f41db91d6d", + "type": "eql", + "version": 1 + }, "6e1a2cc4-d260-11ed-8829-f661ea17fbcc": { "min_stack_version": "8.4", "rule_name": "First Time Seen Commonly Abused Remote Access Tool Execution", @@ -3159,9 +3268,9 @@ "6ea55c81-e2ba-42f2-a134-bccf857ba922": { "min_stack_version": "8.3", "rule_name": "Security Software Discovery using WMIC", - "sha256": "a1ae41d886802078065a49f39d3cccfc069db47d2052a9950cf0421e0187f9c5", + "sha256": "b04895b23aa183e955eac132fe6354b74ae1aea8ce27da447add04c52d265774", "type": "eql", - "version": 106 + "version": 107 }, "6ea71ff0-9e95-475b-9506-2580d1ce6154": { "rule_name": "DNS Activity to the Internet", @@ -3207,16 +3316,16 @@ "7024e2a0-315d-4334-bb1a-441c593e16ab": { "min_stack_version": "8.3", "rule_name": "AWS CloudTrail Log Deleted", - "sha256": "e4aa3aadf0d7e757977d5c02a31cae6d4ece731bc3478fec172e92a10c8f3ee1", + "sha256": "6eb194ad10e7ea8d3c8547593a150c60eda885a07be0a3dc57dab3dc0d993314", "type": "query", - "version": 106 + "version": 107 }, "7024e2a0-315d-4334-bb1a-552d604f27bc": { "min_stack_version": "8.3", "rule_name": "AWS Config Resource Deletion", - "sha256": "e3f3358d38d5992c002d140012811e59a1ff80898107891dfbb67758d36adfc0", + "sha256": "16521ebadcb6ecd1ffe3b12756c604b96cf8b5daedd95eeec1e1fd2eef096dd9", "type": "query", - "version": 106 + "version": 107 }, "70d12c9c-0dbd-4a1a-bc44-1467502c9cf6": { "min_stack_version": "8.3", @@ -3270,9 +3379,9 @@ "729aa18d-06a6-41c7-b175-b65b739b1181": { "min_stack_version": "8.3", "rule_name": "Attempt to Reset MFA Factors for an Okta User Account", - "sha256": "c60bc906d469f3485ac3f4e2694f2ad9335dd69d76776d4a7604221cdc4bd77c", + "sha256": "a26dbdf7534708e6c75311dac75a165cbb21ce2fedc44bffa5ebd8437ffe6354", "type": "query", - "version": 104 + "version": 105 }, "72d33577-f155-457d-aad3-379f9b750c97": { "rule_name": "Linux Restricted Shell Breakout via env Shell Evasion", @@ -3280,6 +3389,13 @@ "type": "eql", "version": 100 }, + "72ed9140-fe9d-4a34-a026-75b50e484b17": { + "min_stack_version": "8.6", + "rule_name": "Unusual Discovery Signal Alert with Unusual Process Executable", + "sha256": "76e9e3a24fb77bafe1b7f5cf3730c4024c32f045d85de9b0857bae7a8716b2df", + "type": "new_terms", + "version": 1 + }, "7405ddf1-6c8e-41ce-818f-48bea6bcaed8": { "min_stack_version": "8.3", "rule_name": "Potential Modification of Accessibility Binaries", @@ -3362,9 +3478,9 @@ "766d3f91-3f12-448c-b65f-20123e9e9e8c": { "min_stack_version": "8.3", "rule_name": "Creation of Hidden Shared Object File", - "sha256": "1d6f35d59421b7701973891ca9762db50f5dd087b3feb9e9e384ee927cdf1d36", + "sha256": "33f5cbe72ef839be364b1ccf59d5c1a66fbc6991676d75779148d8b4bc812310", "type": "eql", - "version": 105 + "version": 106 }, "76ddb638-abf7-42d5-be22-4a70b0bf7241": { "min_stack_version": "8.3", @@ -3390,9 +3506,9 @@ "770e0c4d-b998-41e5-a62e-c7901fd7f470": { "min_stack_version": "8.3", "rule_name": "Enumeration Command Spawned via WMIPrvSE", - "sha256": "3efbbd83a3795ef381af8172fedb8209e077505df6097622483b3275060f8be7", + "sha256": "863f7c79c8a07dbe9f74d5dd1ecb111219e82a3039c95ed6d56de800b2e13c69", "type": "eql", - "version": 106 + "version": 107 }, "774f5e28-7b75-4a58-b94e-41bf060fdd86": { "min_stack_version": "8.3", @@ -3411,9 +3527,9 @@ "781f8746-2180-4691-890c-4c96d11ca91d": { "min_stack_version": "8.3", "rule_name": "Potential Network Sweep Detected", - "sha256": "dac06daad2d64130cbe33805c45aa9bdba206772051f496081644a309db32cd2", + "sha256": "806ccc4e0580c650a06132653d58575846b22fd3cc308288981b794a63972905", "type": "threshold", - "version": 2 + "version": 3 }, "785a404b-75aa-4ffd-8be5-3334a5a544dd": { "min_stack_version": "8.4", @@ -3441,9 +3557,9 @@ "78d3d8d9-b476-451d-a9e0-7a5addd70670": { "min_stack_version": "8.3", "rule_name": "Spike in AWS Error Messages", - "sha256": "333cdaf4a1706f9d4a7935d233bb7a28147712b8edf36e3500c61433a2cbee57", + "sha256": "b9c3990fedf14024b1c9c83464350edfd9ebd517c53d2aacebbb3a848d9740f2", "type": "machine_learning", - "version": 106 + "version": 107 }, "78ef0c95-9dc2-40ac-a8da-5deb6293a14e": { "min_stack_version": "8.4", @@ -3452,6 +3568,13 @@ "type": "eql", "version": 4 }, + "79124edf-30a8-4d48-95c4-11522cad94b1": { + "min_stack_version": "8.3", + "rule_name": "File Compressed or Archived into Common Format", + "sha256": "ffc63f1281c5daf184121bec10deda5e91670f64baeaf47d2ee5336649bf2c78", + "type": "eql", + "version": 1 + }, "792dd7a6-7e00-4a0a-8a9a-a7c24720b5ec": { "min_stack_version": "8.3", "rule_name": "Azure Key Vault Modified", @@ -3502,16 +3625,16 @@ "7b3da11a-60a2-412e-8aa7-011e1eb9ed47": { "min_stack_version": "8.3", "rule_name": "AWS ElastiCache Security Group Created", - "sha256": "388613f453ad59a0b5a1346925a88c2ea72963b1a7a4ba77f510bdb527a655a4", + "sha256": "05d7545eb5be8c088900939645d5a75858e48029b72b2926c878627697576a85", "type": "query", - "version": 103 + "version": 104 }, "7b8bfc26-81d2-435e-965c-d722ee397ef1": { "min_stack_version": "8.3", "rule_name": "Windows Network Enumeration", - "sha256": "ef35c00c8f160878d607315e984c5aecf6fdca5f36d9db988c29e88f76d00270", + "sha256": "1a74ce8fd55ca323682377fbd4e17aa7c7cbe45b23fc743465ff882304fff104", "type": "eql", - "version": 106 + "version": 107 }, "7ba58110-ae13-439b-8192-357b0fcfa9d7": { "min_stack_version": "8.8", @@ -3573,11 +3696,20 @@ "version": 105 }, "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 100, + "rule_name": "Discovery of Internet Capabilities via Built-in Tools", + "sha256": "a411322e3fd22e1fe67ca9c54dd4c5ecb965751365aebb4c0c9d7b4e3aa67a66", + "type": "eql", + "version": 1 + } + }, "rule_name": "Discovery of Internet Capabilities via Built-in Tools", - "sha256": "a411322e3fd22e1fe67ca9c54dd4c5ecb965751365aebb4c0c9d7b4e3aa67a66", - "type": "eql", - "version": 1 + "sha256": "bc8f0cbcbf93a3e84a7433c81cb3997b0f23a2d6b1a1df28e3828f0fe7f1ac50", + "type": "new_terms", + "version": 101 }, "7fb500fa-8e24-4bd1-9480-2a819352602c": { "min_stack_version": "8.6", @@ -3603,9 +3735,9 @@ "809b70d3-e2c3-455e-af1b-2626a5a1a276": { "min_stack_version": "8.3", "rule_name": "Unusual City For an AWS Command", - "sha256": "51f5b37af37f1f4ec180b1de7aac38ca7d77afc0e1f44dfe6122eb8605e3adab", + "sha256": "d6cbad92730cf10d62df532e09bfef35bca6439b7ff5b0f34337bdda6ab38199", "type": "machine_learning", - "version": 106 + "version": 107 }, "80c52164-c82a-402c-9964-852533d58be1": { "min_stack_version": "8.3", @@ -3614,6 +3746,13 @@ "type": "query", "version": 101 }, + "814d96c7-2068-42aa-ba8e-fe0ddd565e2e": { + "min_stack_version": "8.9", + "rule_name": "Unusual Remote File Extension", + "sha256": "1eaf7e432793ec71e4a6924b5d8e2f95b30b4b8042f8aaeee43aed4a24050610", + "type": "machine_learning", + "version": 1 + }, "818e23e6-2094-4f0e-8c01-22d30f3506c6": { "min_stack_version": "8.3", "rule_name": "PowerShell Script Block Logging Disabled", @@ -3630,9 +3769,9 @@ "81fe9dc6-a2d7-4192-a2d8-eed98afc766a": { "min_stack_version": "8.3", "rule_name": "PowerShell Suspicious Payload Encoded and Compressed", - "sha256": "663ce5702cc916692b79094fb7c51dcad29f2f3687f8085ce74b1f699219eb1e", + "sha256": "2a512f65b3d174a8cea1e7d419378e4fb46c850bc7e3a514409f3093ae43dc92", "type": "query", - "version": 108 + "version": 109 }, "81ff45f8-f8c2-4e28-992e-5a0e8d98e0fe": { "min_stack_version": "8.3", @@ -3685,9 +3824,9 @@ "84da2554-e12a-11ec-b896-f661ea17fbcd": { "min_stack_version": "8.3", "rule_name": "Enumerating Domain Trusts via NLTEST.EXE", - "sha256": "5a3c03a8465e2bd10bcaa699af57945cf361af5ca71be2662c20a6746a5b4960", + "sha256": "ff711eea051615cadd16874b875330acd62c7aaf5fb10e2db0d36c1f15799712", "type": "eql", - "version": 107 + "version": 108 }, "850d901a-2a3c-46c6-8b22-55398a01aad8": { "min_stack_version": "8.3", @@ -3697,32 +3836,41 @@ "version": 108 }, "852c1f19-68e8-43a6-9dce-340771fe1be3": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Suspicious PowerShell Engine ImageLoad", + "sha256": "765d2c6702b22d625ca9fac30e74684428f6d6a852dd200dff84851fe76dda47", + "type": "eql", + "version": 108 + } + }, "rule_name": "Suspicious PowerShell Engine ImageLoad", - "sha256": "765d2c6702b22d625ca9fac30e74684428f6d6a852dd200dff84851fe76dda47", - "type": "eql", - "version": 108 + "sha256": "4c25f7bb1a234052d7a5d22439a6b2ceaf128a052fa764bb1d97b0d2b5928eee", + "type": "new_terms", + "version": 208 }, "8623535c-1e17-44e1-aa97-7a0699c3037d": { "min_stack_version": "8.3", "rule_name": "AWS EC2 Network Access Control List Deletion", - "sha256": "196c1626443f797df1670e37fe56629d8da2a1b61087cac2f3fab49bd64b5113", + "sha256": "f9a3ba3b45d5b33b1e73c806495b984233a6b2bc200082fc945fa31d8fea41be", "type": "query", - "version": 103 + "version": 104 }, "863cdf31-7fd3-41cf-a185-681237ea277b": { "min_stack_version": "8.3", "rule_name": "AWS RDS Security Group Deletion", - "sha256": "f46878044473b51688032f8944026be841032d83fbab53ebccb6f3bd1056f1a7", + "sha256": "0c9d4de210e608efca7e588b59eeb71ca5f96b5b20c083daee0e8d4035f0cd32", "type": "query", - "version": 103 + "version": 104 }, "867616ec-41e5-4edc-ada2-ab13ab45de8a": { "min_stack_version": "8.3", "rule_name": "AWS IAM Group Deletion", - "sha256": "950ae30d904242ba798eb1658f1e238720d404743585e155f030dda45d0e05f6", + "sha256": "f4898405685170f2b55f69bcde2b41a0cb8b861ef6040f86e3257bf0abf93383", "type": "query", - "version": 103 + "version": 104 }, "870aecc0-cea4-4110-af3f-e02e9b373655": { "min_stack_version": "8.3", @@ -3734,16 +3882,16 @@ "871ea072-1b71-4def-b016-6278b505138d": { "min_stack_version": "8.3", "rule_name": "Enumeration of Administrator Accounts", - "sha256": "70ad3fa6e2da2dbfbb0211d6835e6657b3c156417e77b4b8bc33b86c2b69167d", + "sha256": "16de3139ef7299ea2fe5dc3a874629d2079e250e032b7f33ce0250a0b0e931e6", "type": "eql", - "version": 107 + "version": 108 }, "87594192-4539-4bc4-8543-23bc3d5bd2b4": { "min_stack_version": "8.3", "rule_name": "AWS EventBridge Rule Disabled or Deleted", - "sha256": "81d56536a960fa83385df001b8186c6a129128d000278be5586476a6d4b9e19b", + "sha256": "bf5d21e0ace96205fd8f8db491ac9d75625ef089e4f5b3499d4a4209268f9719", "type": "query", - "version": 103 + "version": 104 }, "87ec6396-9ac4-4706-bcf0-2ebb22002f43": { "rule_name": "FTP (File Transfer Protocol) Activity to the Internet", @@ -3837,9 +3985,9 @@ "8a5c1e5f-ad63-481e-b53a-ef959230f7f1": { "min_stack_version": "8.3", "rule_name": "Attempt to Deactivate an Okta Network Zone", - "sha256": "f01b127b08601cf43cda877946ee97bf4bc51e4cff8f27b3e3dc4a809a3bf009", + "sha256": "42864ccbb8e48936452a309318951454ac5820199a0b5e62be20a53c6846eb2b", "type": "query", - "version": 104 + "version": 105 }, "8acb7614-1d92-4359-bfcf-478b6d9de150": { "min_stack_version": "8.3", @@ -3879,9 +4027,9 @@ "8c1bdde8-4204-45c0-9e0c-c85ca3902488": { "min_stack_version": "8.3", "rule_name": "RDP (Remote Desktop Protocol) from the Internet", - "sha256": "02d2aa1ce970af5dbef685da0cfc51fc7c9d7c82932b13d1b19d8f212a1ba2de", + "sha256": "97a0561922556e3ced27828faed777dc5a0ab1da7843bfef7c19929702a26f4b", "type": "query", - "version": 102 + "version": 103 }, "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45": { "min_stack_version": "8.3", @@ -3990,9 +4138,9 @@ "9055ece6-2689-4224-a0e0-b04881e1f8ad": { "min_stack_version": "8.3", "rule_name": "AWS Deletion of RDS Instance or Cluster", - "sha256": "637b97f8e4d2c60b80d6427cd89d111d077543e2103cb3a96f9e35e577bd9caa", + "sha256": "52ad2c61bc4217845afa6a13fe3e23cd405324f6bc6779b2ed3a21ecda615e14", "type": "query", - "version": 103 + "version": 104 }, "9092cd6c-650f-4fa3-8a8a-28256c7489c9": { "min_stack_version": "8.3", @@ -4024,9 +4172,9 @@ "91d04cd4-47a9-4334-ab14-084abe274d49": { "min_stack_version": "8.3", "rule_name": "AWS WAF Access Control List Deletion", - "sha256": "4d59ddb17973a139d9be0a601ce33dda6071ea802724f0bd0333d7db8722280c", + "sha256": "ecd61bd19c50c09347fdf33fed3a2f8ec9fc77dec053398a5b62f534e297ebdb", "type": "query", - "version": 103 + "version": 104 }, "91f02f01-969f-4167-8d77-07827ac4cee0": { "min_stack_version": "8.3", @@ -4052,9 +4200,9 @@ "92984446-aefb-4d5e-ad12-598042ca80ba": { "min_stack_version": "8.3", "rule_name": "PowerShell Suspicious Script with Clipboard Retrieval Capabilities", - "sha256": "50456decf4f398de8c09653fee24f7eb07663c151fc638cfd1cf7c9584cb733b", + "sha256": "7fe6f04aad78c1165b56664a6e2b192a15c39a1166c3b1e24906d7ff5b91b1f0", "type": "query", - "version": 5 + "version": 6 }, "92a6faf5-78ec-4e25-bea1-73bacc9b59d9": { "min_stack_version": "8.3", @@ -4066,9 +4214,9 @@ "93075852-b0f5-4b8b-89c3-a226efae5726": { "min_stack_version": "8.3", "rule_name": "AWS Security Token Service (STS) AssumeRole Usage", - "sha256": "2e6053408cd8709eca1ec8f67f1435cba0deae2486a175e0943f710e9ee4e2b3", + "sha256": "b0edd6d0742b92fa2ebe2c3d5ea02c63f8a1edffe0b0f53320b86ed419ab8fb8", "type": "query", - "version": 103 + "version": 104 }, "931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4": { "min_stack_version": "8.3", @@ -4080,9 +4228,9 @@ "9395fd2c-9947-4472-86ef-4aceb2f7e872": { "min_stack_version": "8.3", "rule_name": "AWS VPC Flow Logs Deletion", - "sha256": "f3c39ae72c93e6c08f938d780fc70f56119ce17eb3ef31cf7645331efed700c3", + "sha256": "408b41a86252884a996ece1031334c7b73d4870202ad4a65c1a74d5392ad3454", "type": "query", - "version": 106 + "version": 107 }, "93b22c0a-06a0-4131-b830-b10d5e166ff4": { "min_stack_version": "8.3", @@ -4175,16 +4323,16 @@ "968ccab9-da51-4a87-9ce2-d3c9782fd759": { "min_stack_version": "8.3", "rule_name": "File made Immutable by Chattr", - "sha256": "8de6fbce3edd5e6599051a15eae6429056bb4fae367b3cd3572ece577dc22e1b", + "sha256": "bc300bb67a2279504fbe3225243633c892bbc5b8e695a109b127b1edf673cb5b", "type": "eql", - "version": 106 + "version": 107 }, "96b9f4ea-0e8c-435b-8d53-2096e75fcac5": { "min_stack_version": "8.3", "rule_name": "Attempt to Create Okta API Token", - "sha256": "14b3f9e9b5e605ca66fa3d7115e312ba72ced80772e0d51928496be9202b6353", + "sha256": "00e7844e7b50556df54dd1a80585ef3b0d6e18949813883d66e9467cd40a90f9", "type": "query", - "version": 103 + "version": 104 }, "96d11d31-9a79-480f-8401-da28b194608f": { "min_stack_version": "8.6", @@ -4224,16 +4372,16 @@ "979729e7-0c52-4c4c-b71e-88103304a79f": { "min_stack_version": "8.3", "rule_name": "AWS SAML Activity", - "sha256": "5ccb2e9205c690a15eeb580f91fbced1746f6a12cd487ec983e1bdb8b5f7b33d", + "sha256": "6205667e0b3ffc035feaf7ed17e089eb50ab5ff04926b74e65bb83f73d79af8d", "type": "query", - "version": 103 + "version": 104 }, "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7": { "min_stack_version": "8.3", "rule_name": "Potential Abuse of Repeated MFA Push Notifications", - "sha256": "c65175629b87978771837a807d4ff8b51d3ae081548603d49475754979b246b4", + "sha256": "77d0337a5eb54baa93eb1e573ddab7f5e356ad4892d6cf02c74ce6562afd8d2d", "type": "eql", - "version": 105 + "version": 106 }, "97aba1ef-6034-4bd3-8c1a-1e0996b27afa": { "min_stack_version": "8.3", @@ -4299,9 +4447,9 @@ "98fd7407-0bd5-5817-cda0-3fcc33113a56": { "min_stack_version": "8.3", "rule_name": "AWS EC2 Snapshot Activity", - "sha256": "ed1f4e4296f79824714df9f3010887d3ecd69c44ffbf728bed8d47197ea5e08e", + "sha256": "3c5613df7cc89e9a173b0632a5db11d02b917f05f3c24cb3d44c416a679a4056", "type": "query", - "version": 106 + "version": 107 }, "990838aa-a953-4f3e-b3cb-6ddf7584de9e": { "min_stack_version": "8.3", @@ -4377,6 +4525,13 @@ "type": "eql", "version": 105 }, + "9b343b62-d173-4cfd-bd8b-e6379f964ca4": { + "min_stack_version": "8.3", + "rule_name": "GitHub Owner Role Granted To User", + "sha256": "152428a8434461254fd0550779e5f2ff7b906cf27f44936e520219c6c117b748", + "type": "eql", + "version": 1 + }, "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c": { "min_stack_version": "8.3", "rule_name": "Persistence via WMI Event Subscription", @@ -4428,25 +4583,34 @@ "version": 100 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Microsoft Build Engine Started by a Script Process", + "sha256": "a7dda34610cf31fe8bd552ca7b1be438b979f718bba2f25c1bfbe2dcf6e399c2", + "type": "eql", + "version": 105 + } + }, "rule_name": "Microsoft Build Engine Started by a Script Process", - "sha256": "a7dda34610cf31fe8bd552ca7b1be438b979f718bba2f25c1bfbe2dcf6e399c2", - "type": "eql", - "version": 105 + "sha256": "b98418a78935c61df5f27bc19586a7013ca07b3044d1a233a8bb38e0258feeff", + "type": "new_terms", + "version": 205 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3": { "min_stack_version": "8.3", "rule_name": "Microsoft Build Engine Started by a System Process", - "sha256": "69d5523e4e8bd2c582f84b522bfeae185f56d87fb6f698ba3afd72a1722cfc9b", + "sha256": "dbebd3797fdae528a8f432c6944ceb33a92b55466eaf7317a77173ea58b80423", "type": "eql", - "version": 106 + "version": 107 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4": { "min_stack_version": "8.3", "rule_name": "Microsoft Build Engine Using an Alternate Name", - "sha256": "b2885bccbc5942ef0b109aafd8cc5f741f11e702109bfce0e316e37c66a45f02", + "sha256": "4487327fd533126e8f007f9eb063741a10c3cf9a07a48399c391f9713e58420c", "type": "eql", - "version": 107 + "version": 108 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5": { "min_stack_version": "8.3", @@ -4456,11 +4620,20 @@ "version": 107 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Microsoft Build Engine Started an Unusual Process", + "sha256": "a31248c2a77ee248c66bc397338932837d26cb27e8d0fe2ecc59cb2fd6705d5d", + "type": "eql", + "version": 106 + } + }, "rule_name": "Microsoft Build Engine Started an Unusual Process", - "sha256": "a31248c2a77ee248c66bc397338932837d26cb27e8d0fe2ecc59cb2fd6705d5d", - "type": "eql", - "version": 106 + "sha256": "1e8c98c86268cb9bdde8af04c845776ed081dd6a07dbfa4b6873755f5d5670dc", + "type": "new_terms", + "version": 206 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9": { "min_stack_version": "8.3", @@ -4486,9 +4659,9 @@ "9f1c4ca3-44b5-481d-ba42-32dc215a2769": { "min_stack_version": "8.3", "rule_name": "Potential Protocol Tunneling via EarthWorm", - "sha256": "18494ff65fcc575a4fe46296da4e82fca3ba729b57b21a1c55c64d81a92924ed", + "sha256": "7bb8484c63f6e1ceb591dc3b6a6aa1e5e3dc34ccfd3d932e3e9c8e1b8e3162be", "type": "eql", - "version": 105 + "version": 106 }, "9f962927-1a4f-45f3-a57b-287f2c7029c1": { "min_stack_version": "8.3", @@ -4516,9 +4689,9 @@ } }, "rule_name": "First Time Seen AWS Secret Value Accessed in Secrets Manager", - "sha256": "a470900ff108beb4fc2bd4b7b585eab94d9c4069ec2fdc41e3d7b241c6fd4263", + "sha256": "7cd0da2ff3ffb5eb309da5e40ce09ddc719465d69413af21aaa59db60bf569ea", "type": "new_terms", - "version": 206 + "version": 207 }, "a02cb68e-7c93-48d1-93b2-2c39023308eb": { "min_stack_version": "8.3", @@ -4616,9 +4789,9 @@ "a2d04374-187c-4fd9-b513-3ad4e7fdd67a": { "min_stack_version": "8.3", "rule_name": "PowerShell Mailbox Collection Script", - "sha256": "c26cd675ef7730a95a52e92c7f5bc7144cda7fb9f14144470c96dfe93b036da2", + "sha256": "af441eec9facc8c5fa2be399c6d3a1a2383c4e937ccfca40f8455f599c5d8a24", "type": "query", - "version": 4 + "version": 5 }, "a3ea12f3-0d4e-4667-8b44-4230c63f3c75": { "min_stack_version": "8.3", @@ -4664,9 +4837,9 @@ "a60326d7-dca7-4fb7-93eb-1ca03a1febbd": { "min_stack_version": "8.3", "rule_name": "AWS IAM Assume Role Policy Update", - "sha256": "76387a6bb7b623af513d1e3379567e01c3efd70a0fbf651fb1361a6a3fb63075", + "sha256": "10f0e0afc0e8f51f1c37dc1a9885a33dd37e56c43f029b3c5865e4983baefb3a", "type": "query", - "version": 106 + "version": 107 }, "a605c51a-73ad-406d-bf3a-f24cc41d5c97": { "min_stack_version": "8.3", @@ -4696,6 +4869,13 @@ "type": "eql", "version": 104 }, + "a74c60cb-70ee-4629-a127-608ead14ebf1": { + "min_stack_version": "8.9", + "rule_name": "High Mean of RDP Session Duration", + "sha256": "da4ddd46272515e372d09fc4efb2d394cba8e054b0ce9bd555adef5a46d91034", + "type": "machine_learning", + "version": 1 + }, "a7ccae7b-9d2c-44b2-a061-98e5946971fa": { "min_stack_version": "8.3", "rule_name": "Suspicious Print Spooler SPL File Created", @@ -4724,6 +4904,13 @@ "type": "eql", "version": 1 }, + "a8d35ca0-ad8d-48a9-9f6c-553622dca61a": { + "min_stack_version": "8.9", + "rule_name": "High Variance in RDP Session Duration", + "sha256": "c0f263fa0ff7d4e7f059e58dd7c707af412cdea311f76703517ce73844a1267a", + "type": "machine_learning", + "version": 1 + }, "a9198571-b135-4a76-b055-e3e5a476fd83": { "rule_name": "Hex Encoding/Decoding Activity", "sha256": "b6cfa5bf24a78049ee0f873fe01bcc14ef5116a6adf59b8721abeb11ceca01cf", @@ -4763,9 +4950,9 @@ "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7": { "min_stack_version": "8.3", "rule_name": "IPSEC NAT Traversal Port Activity", - "sha256": "c71a73ed18eadca2c2c082ca0d511745ce0960e56167e3ed59116b93c8b2720c", + "sha256": "8dcd8a517f60e962d4ebf18984358abb4a22823f7b32a4e918d1aa3645fa0fee", "type": "query", - "version": 103 + "version": 104 }, "aa8007f0-d1df-49ef-8520-407857594827": { "min_stack_version": "8.3", @@ -4777,9 +4964,9 @@ "aa895aea-b69c-4411-b110-8d7599634b30": { "min_stack_version": "8.3", "rule_name": "System Log File Deletion", - "sha256": "6fee4b495f1438946191a9f0a5d18e790c19b3546166fa5dc0126a090844c515", + "sha256": "ac41e7af0740df6857011b45aeafd5c04aa1172edb2ee9469e0294726e78cea9", "type": "eql", - "version": 106 + "version": 107 }, "aa9a274d-6b53-424d-ac5e-cb8ca4251650": { "min_stack_version": "8.3", @@ -4826,9 +5013,9 @@ "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1": { "min_stack_version": "8.3", "rule_name": "Unusual AWS Command for a User", - "sha256": "9f57306030e5ba60d653be67aa9384950045aa7df06b096ce123ae72771cd11a", + "sha256": "17d74013b573ef431a61391d055df4a9ab5851741a17e466a651c3a1f13efb49", "type": "machine_learning", - "version": 106 + "version": 107 }, "ac8805f6-1e08-406c-962e-3937057fa86f": { "min_stack_version": "8.3", @@ -5073,9 +5260,9 @@ "b45ab1d2-712f-4f01-a751-df3826969807": { "min_stack_version": "8.3", "rule_name": "AWS STS GetSessionToken Abuse", - "sha256": "270622c32893a7ed8bb7c39017bb09133147e3b8af1c8844d93f0150447134ba", + "sha256": "1382976ef19290c1857b535d15facff537acd5d5a33e5575372bef70ba4c9090", "type": "query", - "version": 103 + "version": 104 }, "b483365c-98a8-40c0-92d8-0458ca25058a": { "min_stack_version": "8.3", @@ -5087,9 +5274,9 @@ "b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9": { "min_stack_version": "8.3", "rule_name": "Attempt to Delete an Okta Policy", - "sha256": "c3fda77e2d67870f675065527fb363156e723e6bc1090d9bdda28d930d7f3d04", + "sha256": "614c1c668c20b47ea3131ada30c8e3553492804e1a59c5580715f70c757d07b6", "type": "query", - "version": 104 + "version": 105 }, "b51dbc92-84e2-4af1-ba47-65183fcd0c57": { "min_stack_version": "8.3", @@ -5136,16 +5323,16 @@ "b719a170-3bdb-4141-b0e3-13e3cf627bfe": { "min_stack_version": "8.3", "rule_name": "Attempt to Deactivate an Okta Policy", - "sha256": "48e769c5aedb715bdbc0f990b68ced02323c1eef17b02595550b368f66a3c9c8", + "sha256": "6a65ec96ad5423adc711dfec4c404f2e552f894f68eaa80a1f242d64218bbdc6", "type": "query", - "version": 104 + "version": 105 }, "b8075894-0b62-46e5-977c-31275da34419": { "min_stack_version": "8.3", "rule_name": "Administrator Privileges Assigned to an Okta Group", - "sha256": "8d9fe19feb7f250c14755465615f7a3fb4f831e20ba19b6ba0eeec6637d056e3", + "sha256": "1177bae4785512b7c84e85287f4a1e6555c016a06a1a91407ee74cee2c622ae3", "type": "query", - "version": 103 + "version": 104 }, "b81bd314-db5b-4d97-82e8-88e3e5fc9de5": { "min_stack_version": "8.3", @@ -5220,9 +5407,9 @@ "b9666521-4742-49ce-9ddc-b8e84c35acae": { "min_stack_version": "8.3", "rule_name": "Creation of Hidden Files and Directories via CommandLine", - "sha256": "e1cb2516563dc7520157b944c165c5b231a99942cdfcd049f1ef1d3213bf29d1", + "sha256": "b52f9a9d5f0c729e51501205cbd24a63482072973a089b57d59e07a4fab75df7", "type": "eql", - "version": 104 + "version": 105 }, "b9960fef-82c6-4816-befa-44745030e917": { "min_stack_version": "8.3", @@ -5255,9 +5442,9 @@ "bb9b13b2-1700-48a8-a750-b43b0a72ab69": { "min_stack_version": "8.3", "rule_name": "AWS EC2 Encryption Disabled", - "sha256": "2e9848fe420de87afde4a086d63bb5d02bb91f3da348bd0eed54b6f7993a85cd", + "sha256": "60c1a7d5d2cd24c909689b37015df4508b993bdd925b050e1b45df21a23479ba", "type": "query", - "version": 103 + "version": 104 }, "bba1b212-b85c-41c6-9b28-be0e5cdfc9b1": { "min_stack_version": "8.3", @@ -5269,9 +5456,9 @@ "bbaa96b9-f36c-4898-ace2-581acb00a409": { "min_stack_version": "8.3", "rule_name": "Potential SYN-Based Network Scan Detected", - "sha256": "a2fa63d2505d8c71652f2a4e23c141d1682d9ff045c088e18b89c6e85508516d", + "sha256": "2b1e4aa7d79164849563312bd9d49b860b58f5f0b4df254ce84a7a65e6a10dfa", "type": "threshold", - "version": 2 + "version": 3 }, "bbd1a775-8267-41fa-9232-20e5582596ac": { "min_stack_version": "8.3", @@ -5283,9 +5470,9 @@ "bc0c6f0d-dab0-47a3-b135-0925f0a333bc": { "min_stack_version": "8.3", "rule_name": "AWS Root Login Without MFA", - "sha256": "40f1b53ce3bb3464e8d8bbad167820d4d5b70e24358eef7c18c72fcdaf161f26", + "sha256": "8f967af66ccd21f236403f460e274db15d0dab8e769626d091f26ddba123de07", "type": "query", - "version": 106 + "version": 107 }, "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331": { "min_stack_version": "8.3", @@ -5353,9 +5540,9 @@ "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc": { "min_stack_version": "8.3", "rule_name": "Potential Pspy Process Monitoring Detected", - "sha256": "3e3047dea72b0e200ecac521c558ec5c07205beb177d77602fbbc760d41b3735", + "sha256": "b1a7f950e8830388985011f13f94ef09e66a8e19ff09652206c060af47049380", "type": "eql", - "version": 1 + "version": 2 }, "bdcf646b-08d4-492c-870a-6c04e3700034": { "min_stack_version": "8.3", @@ -5364,6 +5551,13 @@ "type": "eql", "version": 105 }, + "be4c5aed-90f5-4221-8bd5-7ab3a4334751": { + "min_stack_version": "8.9", + "rule_name": "Unusual Remote File Directory", + "sha256": "4ed65ee17e5e6a2e754823609612583d0e717cead35636b67da9903546d4f880", + "type": "machine_learning", + "version": 1 + }, "be8afaed-4bcd-4e0a-b5f9-5562003dde81": { "min_stack_version": "8.3", "rule_name": "Searching for Saved Credentials via VaultCmd", @@ -5374,9 +5568,9 @@ "bf1073bf-ce26-4607-b405-ba1ed8e9e204": { "min_stack_version": "8.3", "rule_name": "AWS RDS Snapshot Restored", - "sha256": "aa3da4102533524658662c93b127d4c25ca56ed19c01be2a8904cd695347b3d6", + "sha256": "31690f503f33025d8d634b7c33d01adff504c8c0cdfbeab6519116149937669e", "type": "query", - "version": 103 + "version": 104 }, "bf8c007c-7dee-4842-8e9a-ee534c09d205": { "min_stack_version": "8.3", @@ -5423,9 +5617,9 @@ "c1812764-0788-470f-8e74-eb4a14d47573": { "min_stack_version": "8.3", "rule_name": "AWS EC2 Full Network Packet Capture Detected", - "sha256": "c8fb1a9316a7bc5541a685e19440d21f4c158350903c4e21b6225360fee8258d", + "sha256": "53d6e6b5dc3942bb911622ffd2582ed4e8a3bff445df0e269aba07ed320f34e8", "type": "query", - "version": 103 + "version": 104 }, "c20cd758-07b1-46a1-b03f-fa66158258b8": { "min_stack_version": "8.3", @@ -5500,9 +5694,9 @@ "c4e9ed3e-55a2-4309-a012-bc3c78dad10a": { "min_stack_version": "8.3", "rule_name": "Windows System Network Connections Discovery", - "sha256": "56bf9828457985099728e90f9046ec5d50ba668e7b911712abec96eaa3d6d665", + "sha256": "16cd4b39c59281f69407d88a2f0bbadab7ac9d1408c9e0c6e5400a92f25898d9", "type": "eql", - "version": 2 + "version": 3 }, "c55badd3-3e61-4292-836f-56209dc8a601": { "min_stack_version": "8.3", @@ -5549,9 +5743,9 @@ "c5dc3223-13a2-44a2-946c-e9dc0aa0449c": { "min_stack_version": "8.3", "rule_name": "Microsoft Build Engine Started by an Office Application", - "sha256": "8cf1d0abaed488b33ec708608f9a5ba1ec08a67e664df9145ebf1800d2701adb", + "sha256": "a6a7a57d9d9f53170aaca5b52e31fa5987b52d03287d461f35903e7a94f3c49e", "type": "eql", - "version": 106 + "version": 107 }, "c5f81243-56e0-47f9-b5bb-55a5ed89ba57": { "min_stack_version": "8.3", @@ -5576,16 +5770,16 @@ "c749e367-a069-4a73-b1f2-43a3798153ad": { "min_stack_version": "8.3", "rule_name": "Attempt to Delete an Okta Network Zone", - "sha256": "fdb6f5c18f3893647e63e19723c1ad7c3f352be39e233b1273d08b6cd09edd5a", + "sha256": "32aa247af72d8bfb3ed85d34d5c359b595a21f5b5ef6703aec68875147b2110f", "type": "query", - "version": 104 + "version": 105 }, "c74fd275-ab2c-4d49-8890-e2943fa65c09": { "min_stack_version": "8.3", "rule_name": "Attempt to Modify an Okta Application", - "sha256": "d467d49b83c884e4c1d43dc2f0e1dc879ceda77762f45968124a97e4fbacd2b0", + "sha256": "d9ce411d12a9dcd03a68e93eedabd0fc200c743908746faf634ade8744ff7f32", "type": "query", - "version": 103 + "version": 104 }, "c7894234-7814-44c2-92a9-f7d851ea246a": { "min_stack_version": "8.3", @@ -5634,9 +5828,9 @@ "c82b2bd8-d701-420c-ba43-f11a155b681a": { "min_stack_version": "8.3", "rule_name": "SMB (Windows File Sharing) Activity to the Internet", - "sha256": "128d5682da221aeffcdc38868dcaa75f484b8b2411f3c7a2eae8881f6e41e861", + "sha256": "6420c0fe2bee67b51779e539f2cfe3b480539c36abf148d1d69db79d6f2e8f67", "type": "query", - "version": 102 + "version": 103 }, "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1": { "min_stack_version": "8.3", @@ -5798,9 +5992,9 @@ "cc92c835-da92-45c9-9f29-b4992ad621a0": { "min_stack_version": "8.3", "rule_name": "Attempt to Deactivate an Okta Policy Rule", - "sha256": "ed2062f991db0a0dce267846fe8363883628421221166f8246b4924828f02999", + "sha256": "b478201ba15dcd2c82b79fa58c4c175e917d642653a86009ecf389042156d85c", "type": "query", - "version": 105 + "version": 106 }, "ccc55af4-9882-4c67-87b4-449a7ae8079c": { "min_stack_version": "8.3", @@ -5812,9 +6006,9 @@ "cd16fb10-0261-46e8-9932-a0336278cdbe": { "min_stack_version": "8.3", "rule_name": "Modification or Removal of an Okta Application Sign-On Policy", - "sha256": "32c09cb649d10eb0d58645624f6534db9c40073e42552b0381f5b414e9c58bb6", + "sha256": "06745b57fd263169ae59b2d860b840a6deb4a911da424fa9267827a54e77c61f", "type": "query", - "version": 104 + "version": 105 }, "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126": { "rule_name": "Socat Process Activity", @@ -5846,23 +6040,23 @@ "cd89602e-9db0-48e3-9391-ae3bf241acd8": { "min_stack_version": "8.3", "rule_name": "Attempt to Deactivate MFA for an Okta User Account", - "sha256": "173487533fb84ffd2bbd8598bf0ac4f518f295cc6715c381743a3fe6d0f14ec7", + "sha256": "21e5d78749220436e967eeeb044dd1f1f605e2586c03e609b54561405c40cccf", "type": "query", - "version": 104 + "version": 105 }, "cdbebdc1-dc97-43c6-a538-f26a20c0a911": { "min_stack_version": "8.3", "rule_name": "Okta User Session Impersonation", - "sha256": "36a5fb5b929045a84f302c057459e3b5e6eb50cb409fc5a9edf6cdcd47f30ee5", + "sha256": "0a3253294eddbc09d843b81fe8f461f26e5b01e8456dc88dbce7c79923ff93b7", "type": "query", - "version": 105 + "version": 106 }, "cde1bafa-9f01-4f43-a872-605b678968b0": { "min_stack_version": "8.3", "rule_name": "Potential PowerShell HackTool Script by Function Names", - "sha256": "8dd2c1c84b0fc1c9b380b49e3924012569cff3b126def7c497f092a63a057eff", + "sha256": "cb505702842c62bf14d57f592e2da9b793b4232bb14db1dc07ce3ee3dca88d72", "type": "query", - "version": 5 + "version": 6 }, "ce64d965-6cb0-466d-b74f-8d2c76f47f05": { "min_stack_version": "8.3", @@ -5874,9 +6068,9 @@ "cf53f532-9cc9-445a-9ae7-fced307ec53c": { "min_stack_version": "8.3", "rule_name": "Cobalt Strike Command and Control Beacon", - "sha256": "d72e36349524c074ac047562258cfce46273ee90ce47cd6b4d7bf6583558e37b", + "sha256": "ae06529dfc51404f2a14651c780e0d62070bf088490bbb3215fdefb56904c4f2", "type": "query", - "version": 103 + "version": 104 }, "cf549724-c577-4fd6-8f9b-d1b8ec519ec0": { "min_stack_version": "8.4", @@ -5894,6 +6088,13 @@ "type": "query", "version": 205 }, + "cf575427-0839-4c69-a9e6-99fde02606f3": { + "min_stack_version": "8.6", + "rule_name": "Unusual Discovery Activity by User", + "sha256": "2dec950ffa14b4863a879f391b045196709a774f032c8bc35d8f61ba20e2bfff", + "type": "new_terms", + "version": 1 + }, "cf6995ec-32a9-4b2d-9340-f8e61acf3f4e": { "min_stack_version": "8.3", "rule_name": "Trap Signals Execution", @@ -6001,9 +6202,9 @@ "d48e1c13-4aca-4d1f-a7b1-a9161c0ad86f": { "min_stack_version": "8.3", "rule_name": "Attempt to Delete an Okta Application", - "sha256": "ec2d2014d13ce312c51e80554c30af695049e703918b7f1b19da53f58154d6f7", + "sha256": "ed729064054fe9156b2909c7970d2e38aa98c9ee0337d7f86e1ad0d8f28300c6", "type": "query", - "version": 103 + "version": 104 }, "d49cc73f-7a16-4def-89ce-9fc7127d7820": { "min_stack_version": "8.3", @@ -6050,9 +6251,9 @@ "d5d86bf5-cf0c-4c06-b688-53fdc072fdfd": { "min_stack_version": "8.3", "rule_name": "Attempt to Delete an Okta Policy Rule", - "sha256": "ef00abb177343a787a119303eaa0cb71aef503d40d309b2699d05fe0178157a6", + "sha256": "537f87bddcb81e9ba189e215fbb67e630dc5362f718cb3d8e57f843bd129033a", "type": "query", - "version": 104 + "version": 105 }, "d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc": { "min_stack_version": "8.3", @@ -6064,9 +6265,9 @@ "d624f0ae-3dd1-4856-9aad-ccfe4d4bfa17": { "min_stack_version": "8.3", "rule_name": "AWS CloudWatch Log Stream Deletion", - "sha256": "e7f7445facc4da1f84ee331f6dbbf22337e319df0727349ff958c0f62154fd1f", + "sha256": "5bc55e01a217a6d8069b08e636d1e12080f2a96b645cc68f8f33806d04a820ee", "type": "query", - "version": 106 + "version": 107 }, "d62b64a8-a7c9-43e5-aee3-15a725a794e7": { "min_stack_version": "8.3", @@ -6084,9 +6285,9 @@ "d68e95ad-1c82-4074-a12a-125fe10ac8ba": { "min_stack_version": "8.3", "rule_name": "System Information Discovery via Windows Command Shell", - "sha256": "123d0512c4355047e5fc67352b4ba9a65b7bd2515f7513409a0276a2414ce054", + "sha256": "e19053836a709b816dc84ce8ced0ba8168ccd803d9c077141d35d3a0679f082f", "type": "eql", - "version": 6 + "version": 7 }, "d68eb1b5-5f1c-4b6d-9e63-5b6b145cd4aa": { "min_stack_version": "8.3", @@ -6147,9 +6348,9 @@ "d7e62693-aab9-4f66-a21a-3d79ecdd603d": { "min_stack_version": "8.3", "rule_name": "SMTP on Port 26/TCP", - "sha256": "a83fb857076a042c492fa2affcd6539e499ab52f67b336d1e47854a3e23a13d3", + "sha256": "3816b9a7c573ec98806b9cc52fc8e281cd0559c43a7c7fce52c60f63c8a8eb2f", "type": "query", - "version": 102 + "version": 103 }, "d8ab1ec1-feeb-48b9-89e7-c12e189448aa": { "min_stack_version": "8.3", @@ -6161,9 +6362,9 @@ "d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958": { "min_stack_version": "8.3", "rule_name": "AWS IAM Deactivation of MFA Device", - "sha256": "3c501df177ec97cc6f46663425f4c04cb979694688cd3bfad27f03a0d8a2ac53", + "sha256": "7e7bcfe14adab55f0ac9ab6478a826ff0dff7b31efe686b94a1bbf30d730bdd6", "type": "query", - "version": 106 + "version": 107 }, "d99a037b-c8e2-47a5-97b9-170d076827c4": { "min_stack_version": "8.3", @@ -6257,9 +6458,9 @@ "dca28dee-c999-400f-b640-50a081cc0fd1": { "min_stack_version": "8.3", "rule_name": "Unusual Country For an AWS Command", - "sha256": "09aabd7cf1fd572c2266143f903d21cbaedb757f619cc17b5f2c78b74e046946", + "sha256": "e6e99ee2cb2084337de3331bcf945c7714a1fc79df6bc880c40dcb399e87a561", "type": "machine_learning", - "version": 106 + "version": 107 }, "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e": { "min_stack_version": "8.3", @@ -6297,11 +6498,20 @@ "version": 105 }, "ded09d02-0137-4ccc-8005-c45e617e8d4c": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 101, + "rule_name": "Query Registry using Built-in Tools", + "sha256": "b2ee224e76ea602717f6188bd78728ea09a54c1c694fb5041f9d7f0197db8ebd", + "type": "eql", + "version": 2 + } + }, "rule_name": "Query Registry using Built-in Tools", - "sha256": "b2ee224e76ea602717f6188bd78728ea09a54c1c694fb5041f9d7f0197db8ebd", - "type": "eql", - "version": 2 + "sha256": "1ce3bd6bd9c91187b6ee6941b8adf51a9bc72c81dd5bcc25fe03bd480f1122eb", + "type": "new_terms", + "version": 102 }, "df0fd41e-5590-4965-ad5e-cd079ec22fa9": { "min_stack_version": "8.6", @@ -6370,16 +6580,16 @@ "e0881d20-54ac-457f-8733-fe0bc5d44c55": { "min_stack_version": "8.3", "rule_name": "System Service Discovery through built-in Windows Utilities", - "sha256": "ff2526e88d22d00ba16eca2c07ec3bec5e06c7785739a7ab842edd79c975943f", + "sha256": "5b07769d45f5a33fcbe539609647986809d75daea1b8aa5874d0ae7f0e6a8892", "type": "eql", - "version": 4 + "version": 5 }, "e08ccd49-0380-4b2b-8d71-8000377d6e49": { "min_stack_version": "8.3", "rule_name": "Attempts to Brute Force an Okta User Account", - "sha256": "71bc21a2e39ae429903f27a300a650a34aed1adfba8e5ce63f527c8362e23d02", + "sha256": "10ee903471646d3de3429f99b45cf5e5d7fadc3fda75e3d87f0d1f495d30f511", "type": "threshold", - "version": 105 + "version": 106 }, "e0cc3807-e108-483c-bf66-5a4fbe0d7e89": { "min_stack_version": "8.3", @@ -6405,16 +6615,16 @@ "e12c0318-99b1-44f2-830c-3a38a43207ca": { "min_stack_version": "8.3", "rule_name": "AWS Route Table Created", - "sha256": "7bc47ab3f6abaaa3ab9719f0b5584578bde76d5e46e45c4f5930b55727fde835", + "sha256": "4081dda0ac65323a45109124e0222f68584e912ecdc216ad1e2f5b8f9f431afc", "type": "query", - "version": 103 + "version": 104 }, "e14c5fd7-fdd7-49c2-9e5b-ec49d817bc8d": { "min_stack_version": "8.3", "rule_name": "AWS RDS Cluster Creation", - "sha256": "1028d9d315c9b25af760a4d81b28115f4bc2ea1653f08740433bc44c0c49ecbf", + "sha256": "064737df50105c6e8c5336eb8537b218f80ef6e29e079214fe8dca37dc5bda32", "type": "query", - "version": 103 + "version": 104 }, "e19e64ee-130e-4c07-961f-8a339f0b8362": { "min_stack_version": "8.3", @@ -6447,9 +6657,9 @@ "e2a67480-3b79-403d-96e3-fdd2992c50ef": { "min_stack_version": "8.3", "rule_name": "AWS Management Console Root Login", - "sha256": "b9dd3e3ff50478a62eb78a03bd6f15b075d2c8b5205f36afb4bb4c84ec2aea89", + "sha256": "c4f8568aee037cc76372958fdfc1556649341e70f4d8ffc9a8a3f8c1e5fbe0e6", "type": "query", - "version": 106 + "version": 107 }, "e2dc8f8c-5f16-42fa-b49e-0eb8057f7444": { "min_stack_version": "8.3", @@ -6468,9 +6678,9 @@ "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2": { "min_stack_version": "8.3", "rule_name": "Suspicious Process Execution via Renamed PsExec Executable", - "sha256": "b8ef093aa90790193389f0a3b2eb27568f9516fec3932bce89da7213cabf2393", + "sha256": "7326c0fdf7b88869ad1306d85488813f482b3ac72e2d30e276978b2d064c29b5", "type": "eql", - "version": 106 + "version": 107 }, "e2fb5b18-e33c-4270-851e-c3d675c9afcd": { "min_stack_version": "8.3", @@ -6489,9 +6699,9 @@ "e3c27562-709a-42bd-82f2-3ed926cced19": { "min_stack_version": "8.3", "rule_name": "AWS Route53 private hosted zone associated with a VPC", - "sha256": "dd9a314d7acf050b51fec079eb2ff4d0667d2954a8fe4eee7a86081d7971db12", + "sha256": "58bf1f2fc9acd22be3c161424a77c2a213cf1401372313a2272d73d6af866d41", "type": "query", - "version": 103 + "version": 104 }, "e3c5d5cb-41d5-4206-805c-f30561eae3ac": { "min_stack_version": "8.3", @@ -6510,16 +6720,16 @@ "e3e904b3-0a8e-4e68-86a8-977a163e21d3": { "min_stack_version": "8.3", "rule_name": "Persistence via KDE AutoStart Script or Desktop File Modification", - "sha256": "1b8c0a0d497da1a7aa237cea422221680d66e067bd3cb56754342e2426b8456e", + "sha256": "ac660618b2f53220fa549edf8c4bf12df44b42b26daed8102d9f6cd69d0340f7", "type": "eql", - "version": 105 + "version": 106 }, "e48236ca-b67a-4b4e-840c-fdc7782bc0c3": { "min_stack_version": "8.3", "rule_name": "Attempt to Modify an Okta Network Zone", - "sha256": "5f65ddaac1e8431e60917074c8cb8ead43d51ca2475c63ef74c89e0b558c3456", + "sha256": "6d57260382880fab2e20021bd0235b13974bf1bde3fcdb2fe4b85484ea80f4c6", "type": "query", - "version": 104 + "version": 105 }, "e4e31051-ee01-4307-a6ee-b21b186958f4": { "min_stack_version": "8.3", @@ -6574,9 +6784,9 @@ "e6e3ecff-03dd-48ec-acbd-54a04de10c68": { "min_stack_version": "8.3", "rule_name": "Possible Okta DoS Attack", - "sha256": "0068f7eda335ee0ee3e6452f9a91166dd50e098862de1791f4e6b6bd0ff4a391", + "sha256": "065c5e51d3541a24ee401d4b9da8787e8fb858c1e89938d7f7fa8daf46e7199e", "type": "query", - "version": 103 + "version": 104 }, "e6e8912f-283f-4d0d-8442-e0dcaf49944b": { "min_stack_version": "8.3", @@ -6588,9 +6798,9 @@ "e7075e8d-a966-458e-a183-85cd331af255": { "min_stack_version": "8.3", "rule_name": "Default Cobalt Strike Team Server Certificate", - "sha256": "c0e04ce1aa8f8652c9593631d1a9692ea6c265ee388e504ccc1d3c225ad62272", + "sha256": "6bbe76d52fd258b99c66bbf69e3f64060fa0a3112a36cd1c55f44d03d2da9d9e", "type": "query", - "version": 103 + "version": 104 }, "e7125cea-9fe1-42a5-9a05-b0792cf86f5a": { "min_stack_version": "8.3", @@ -6632,9 +6842,9 @@ "e7cd5982-17c8-4959-874c-633acde7d426": { "min_stack_version": "8.3", "rule_name": "AWS Route Table Modified or Deleted", - "sha256": "aac5e30f0f52cc491d255e93c3f1f83cdb0547f9f20b8fe3376704aee6c6f730", + "sha256": "2199bfaa82c73c0e3d8e7c4dd8d7df67b438163716298173157240784ea80fdc", "type": "query", - "version": 103 + "version": 104 }, "e8571d5f-bea1-46c2-9f56-998de2d3ed95": { "min_stack_version": "8.3", @@ -6667,16 +6877,16 @@ "e90ee3af-45fc-432e-a850-4a58cf14a457": { "min_stack_version": "8.3", "rule_name": "High Number of Okta User Password Reset or Unlock Attempts", - "sha256": "94f8f87bf5279e92dae5e3f1a86adcc88c5e03a1ddc2d3ee3878b1ef488abd08", + "sha256": "bb06cc2e64669d793dd0ab51b8f596cf9ed9f9454f861ae51504837bb3552d10", "type": "threshold", - "version": 105 + "version": 106 }, "e919611d-6b6f-493b-8314-7ed6ac2e413b": { "min_stack_version": "8.3", "rule_name": "AWS EC2 VM Export Failure", - "sha256": "f5fbdb6dd8db185f84352432e56a887048b7d1bac9936d1c3a3944b9f5ed4d31", + "sha256": "3d6439c0aa3958b93a6dddcf1bd5a4bd85a8a42ea1de077784cbcddffa9842dd", "type": "query", - "version": 103 + "version": 104 }, "e94262f2-c1e9-4d3f-a907-aeab16712e1a": { "min_stack_version": "8.3", @@ -6692,6 +6902,13 @@ "type": "eql", "version": 104 }, + "e9b0902b-c515-413b-b80b-a8dcebc81a66": { + "min_stack_version": "8.9", + "rule_name": "Spike in Remote File Transfers", + "sha256": "5a680fcc21fa3a04e8559fed157bb4ad2d12ae704220ebfb794b987dd5e7f9ab", + "type": "machine_learning", + "version": 1 + }, "e9b4a3c7-24fc-49fd-a00f-9c938031eef1": { "rule_name": "Linux Restricted Shell Breakout via busybox Shell Evasion", "sha256": "f5726e1a8ce8508e84699dd4648108f26b624ea175aeb4a0cdace248925f0d8a", @@ -6714,9 +6931,9 @@ "ea248a02-bc47-4043-8e94-2885b19b2636": { "min_stack_version": "8.3", "rule_name": "AWS IAM Brute Force of Assume Role Policy", - "sha256": "d8fbba1e46a7add1e78c5e5e8efbbd07526667d98224a35765adf2574e4c6e80", + "sha256": "c03ce8fcb77809e7578333b7e52f0fe9d851c9f6687eb1a7d20a33e2b642ed3f", "type": "threshold", - "version": 106 + "version": 107 }, "eaa77d63-9679-4ce3-be25-3ba8b795e5fa": { "min_stack_version": "8.3", @@ -6742,9 +6959,9 @@ "eb610e70-f9e6-4949-82b9-f1c5bcd37c39": { "min_stack_version": "8.3", "rule_name": "PowerShell Kerberos Ticket Request", - "sha256": "a05367ae65e4b39de37332b4894eb8085397b7fbf86eb16ab1899b6d60beac4d", + "sha256": "19a8d98813f7227deaf511c0d633facc03ce98eca134cbf0ad8d95277312d2bd", "type": "query", - "version": 107 + "version": 108 }, "eb6a3790-d52d-11ec-8ce9-f661ea17fbce": { "min_stack_version": "8.3", @@ -6798,9 +7015,9 @@ "ecf2b32c-e221-4bd4-aa3b-c7d59b3bc01d": { "min_stack_version": "8.3", "rule_name": "AWS RDS Instance/Cluster Stoppage", - "sha256": "507678779aec70fd7d8e6f87c97bad4456c69b88fbf5e1ef2ede267b6c6d356b", + "sha256": "ac0a0d9ae3dd952d42b9953594ccbb2e820c3b3754a613810c6568a3fb3205bc", "type": "query", - "version": 103 + "version": 104 }, "ed9ecd27-e3e6-4fd9-8586-7754803f7fc8": { "min_stack_version": "8.3", @@ -6819,16 +7036,16 @@ "edb91186-1c7e-4db8-b53e-bfa33a1a0a8a": { "min_stack_version": "8.3", "rule_name": "Attempt to Deactivate an Okta Application", - "sha256": "561500f4153a16fe94b06be9237be4ba8933a3192116af5ef57bdb83da24f973", + "sha256": "6015ee3b4d4c29fbd1e06ca5bb2947716089acffc92c07d1e1ef36a3aace0a7c", "type": "query", - "version": 104 + "version": 105 }, "edf8ee23-5ea7-4123-ba19-56b41e424ae3": { "min_stack_version": "8.3", "rule_name": "ImageLoad via Windows Update Auto Update Client", - "sha256": "3482abb380dae16ed856b1c92ebf753d98d655730383b3e1e6329221b64d7f96", + "sha256": "2879ba6dedb4672f2a2edf42d9b51a445ad7e87deafca2d3e115c225361d1e52", "type": "eql", - "version": 106 + "version": 107 }, "edfd5ca9-9d6c-44d9-b615-1e56b920219c": { "min_stack_version": "8.3", @@ -6902,9 +7119,9 @@ "f06414a6-f2a4-466d-8eba-10f85e8abf71": { "min_stack_version": "8.3", "rule_name": "Administrator Role Assigned to an Okta User", - "sha256": "333aec880e8bd1653cea01f896e3df2e136839275bf1cffd71197ec4068129ba", + "sha256": "129a8d5f0cd2075e7fe6a38059a5ddcd26d18f1d6b9d8b93950bf60863671395", "type": "query", - "version": 103 + "version": 104 }, "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7": { "min_stack_version": "8.3", @@ -6958,9 +7175,9 @@ "f28e2be4-6eca-4349-bdd9-381573730c22": { "min_stack_version": "8.3", "rule_name": "Potential OpenSSH Backdoor Logging Activity", - "sha256": "181e254a121f95897919759791f5af14565c11aa4ed7bab144e1e9c27400ac8b", + "sha256": "c0d41a9640582655c35bbdf6fd4057c405ea4a82195c458393a2820c413ea5df", "type": "eql", - "version": 105 + "version": 106 }, "f2c7b914-eda3-40c2-96ac-d23ef91776ca": { "min_stack_version": "8.3", @@ -6979,9 +7196,9 @@ "f30f3443-4fbb-4c27-ab89-c3ad49d62315": { "min_stack_version": "8.3", "rule_name": "AWS RDS Instance Creation", - "sha256": "1b57c3c8d9066a43e2cf1493eb351327278a05bf30471e51460fc99b3134a1c5", + "sha256": "25aeaebf372fd4e468e990590efe81685706f45ab5eb44bb246d187a16a8b6e0", "type": "query", - "version": 103 + "version": 104 }, "f33e68a4-bd19-11ed-b02f-f661ea17fbcc": { "min_stack_version": "8.4", @@ -7011,6 +7228,13 @@ "type": "threat_match", "version": 3 }, + "f41296b4-9975-44d6-9486-514c6f635b2d": { + "min_stack_version": "8.6", + "rule_name": "Potential curl CVE-2023-38545 Exploitation", + "sha256": "9efdc32da856ea0ecfb495756ffd87148d34f4be5d42e19e9839782860cef853", + "type": "eql", + "version": 1 + }, "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c": { "min_stack_version": "8.3", "rule_name": "Persistence via Microsoft Office AddIns", @@ -7118,9 +7342,9 @@ "f772ec8a-e182-483c-91d2-72058f76a44c": { "min_stack_version": "8.3", "rule_name": "AWS CloudWatch Alarm Deletion", - "sha256": "c61b6a72d80df0fd58791ed1d3826f037ed108533807e6817a707d013f73e4bd", + "sha256": "c58352df4a9adcf9259a2e3656fddae07215b10995a31acba7684366f084e0a9", "type": "query", - "version": 106 + "version": 107 }, "f7769104-e8f9-4931-94a2-68fc04eadec3": { "min_stack_version": "8.8", @@ -7188,9 +7412,9 @@ "f994964f-6fce-4d75-8e79-e16ccc412588": { "min_stack_version": "8.3", "rule_name": "Suspicious Activity Reported by Okta User", - "sha256": "f35146f9e2f6aef85cb21013ab2bc3039a0a449e1bf4ed3322496b0dbc449e06", + "sha256": "248121396e46c80ff9a64d88848fd372e40eef61b3d43d31e6ef56a70477f392", "type": "query", - "version": 103 + "version": 104 }, "fa01341d-6662-426b-9d0c-6d81e33c8a9d": { "min_stack_version": "8.3", @@ -7250,9 +7474,9 @@ "fbd44836-0d69-4004-a0b4-03c20370c435": { "min_stack_version": "8.3", "rule_name": "AWS Configuration Recorder Stopped", - "sha256": "624fbf2987e46d010e6f19338b9a13acbd0fc5afb7c2704f7f5d076d82b9ced4", + "sha256": "e2cf9c3a12bd9ec52910d1a412e540d1f76113ddae474ae4fe22f81ed3aafb15", "type": "query", - "version": 103 + "version": 104 }, "fc7c0fa4-8f03-4b3e-8336-c5feab0be022": { "min_stack_version": "8.3", @@ -7282,11 +7506,20 @@ "version": 106 }, "fd7a6052-58fa-4397-93c3-4795249ccfa2": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Svchost spawning Cmd", + "sha256": "2be5bf0d0a6fe7332e43fa29c1f0701bd1ddd82b98458eb81fbd031b4190ff04", + "type": "eql", + "version": 107 + } + }, "rule_name": "Svchost spawning Cmd", - "sha256": "2be5bf0d0a6fe7332e43fa29c1f0701bd1ddd82b98458eb81fbd031b4190ff04", - "type": "eql", - "version": 107 + "sha256": "2cf4b3a4a92c5be889a51b4f1d51c3eab77327b7bf883a2a045d1571d8779e4b", + "type": "new_terms", + "version": 207 }, "fda1d332-5e08-4f27-8a9b-8c802e3292a6": { "min_stack_version": "8.3", @@ -7333,9 +7566,9 @@ "ff013cb4-274d-434a-96bb-fe15ddd3ae92": { "min_stack_version": "8.3", "rule_name": "Roshal Archive (RAR) or PowerShell File Downloaded from the Internet", - "sha256": "93c635e72bde1b37f08db8fbaab71b57c830ec8a6d88f9d868cad5cae1d4c602", + "sha256": "be298496f5dc80a824431ca74dd636b027fd4a95e5b4cae739b13de1c3dfe055", "type": "query", - "version": 102 + "version": 103 }, "ff10d4d8-fea7-422d-afb1-e5a2702369a9": { "min_stack_version": "8.6", From 97ff7fb26e9145b439b24da3073d21547c6816fe Mon Sep 17 00:00:00 2001 From: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com> Date: Sat, 14 Oct 2023 10:23:48 -0700 Subject: [PATCH 31/86] [New Rule] Adding Data Exfiltration Rules from Advanced Analytic DED Package (#3126) * Adding DED rules * adding integration manifests and schemas for DED * Updating min stack version * updating manifests and schemas to match main * added setup note; updated references --------- Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: terrancedejesus --- ...ytes_destination_geo_country_iso_code.toml | 52 ++++++++++++++++++ ...ltration_ml_high_bytes_destination_ip.toml | 52 ++++++++++++++++++ ...ration_ml_high_bytes_destination_port.toml | 51 ++++++++++++++++++ ...ml_high_bytes_destination_region_name.toml | 52 ++++++++++++++++++ ...high_bytes_written_to_external_device.toml | 52 ++++++++++++++++++ ...es_written_to_external_device_airdrop.toml | 53 +++++++++++++++++++ ...re_process_writing_to_external_device.toml | 52 ++++++++++++++++++ 7 files changed, 364 insertions(+) create mode 100644 rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml create mode 100644 rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml create mode 100644 rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml create mode 100644 rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml create mode 100644 rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml create mode 100644 rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml create mode 100644 rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml diff --git a/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml new file mode 100644 index 000000000..4e9710e76 --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to +geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command +and control channels. +""" +from = "now-6h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_high_sent_bytes_destination_geo_country_iso_code" +name = "Potential Data Exfiltration Activity to an Unusual ISO Code" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "e1db8899-97c1-4851-8993-3a3265353601" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1041" +name = "Exfiltration Over C2 Channel" +reference = "https://attack.mitre.org/techniques/T1041/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml new file mode 100644 index 000000000..1bba24f12 --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to +geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command +and control channels. +""" +from = "now-6h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_high_sent_bytes_destination_ip" +name = "Potential Data Exfiltration Activity to an Unusual IP Address" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "cc653d77-ddd2-45b1-9197-c75ad19df66c" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1041" +name = "Exfiltration Over C2 Channel" +reference = "https://attack.mitre.org/techniques/T1041/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml new file mode 100644 index 000000000..b1af3e632 --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml @@ -0,0 +1,51 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected data exfiltration to a particular destination port. Data transfer patterns that are +outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. +""" +from = "now-6h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_high_sent_bytes_destination_port" +name = "Potential Data Exfiltration Activity to an Unusual Destination Port" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "ef8cc01c-fc49-4954-a175-98569c646740" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1041" +name = "Exfiltration Over C2 Channel" +reference = "https://attack.mitre.org/techniques/T1041/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml new file mode 100644 index 000000000..8692fed9a --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to +geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command +and control channels. +""" +from = "now-6h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_high_sent_bytes_destination_region_name" +name = "Potential Data Exfiltration Activity to an Unusual Region" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "bfba5158-1fd6-4937-a205-77d96213b341" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1041" +name = "Exfiltration Over C2 Channel" +reference = "https://attack.mitre.org/techniques/T1041/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml b/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml new file mode 100644 index 000000000..36e40ec6a --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected high bytes of data written to an external device. In a typical operational setting, +there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually +large amount of data being written is anomalous and can signal illicit data copying or transfer activities. +""" +from = "now-2h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_high_bytes_written_to_external_device" +name = "Spike in Bytes Sent to an External Device" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "35a3b253-eea8-46f0-abd3-68bdd47e6e3d" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1052" +name = "Exfiltration Over Physical Medium" +reference = "https://attack.mitre.org/techniques/T1052/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml b/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml new file mode 100644 index 000000000..aafcbc007 --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml @@ -0,0 +1,53 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected high bytes of data written to an external device via Airdrop. In a typical +operational setting, there is usually a predictable pattern or a certain range of data that is written to external +devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer +activities. +""" +from = "now-2h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_high_bytes_written_to_external_device_airdrop" +name = "Spike in Bytes Sent to an External Device via Airdrop" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "e92c99b6-c547-4bb6-b244-2f27394bc849" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1011" +name = "Exfiltration Over Other Network Medium" +reference = "https://attack.mitre.org/techniques/T1011/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml b/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml new file mode 100644 index 000000000..10a537763 --- /dev/null +++ b/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["ded"] +maturity = "production" +min_stack_comments = "New rule" +min_stack_version = "8.9.0" +updated_date = "2023/10/14" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected a rare process writing data to an external device. Malicious actors often use +benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no +legitimate reason to write data to external devices can indicate exfiltration. +""" +from = "now-2h" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "ded_rare_process_writing_to_external_device" +name = "Unusual Process Writing Data to an External Device" +note = """## Setup + +The Data Exfiltration Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/ded" +] +risk_score = 21 +rule_id = "4b95ecea-7225-4690-9938-2a2c0bad9c99" +severity = "low" +tags = [ + "Use Case: Data Exfiltration Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Exfiltration", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1052" +name = "Exfiltration Over Physical Medium" +reference = "https://attack.mitre.org/techniques/T1052/" + + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + From f584fb6e31fa6a052a316fa108adf83e9a0d5e82 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Sun, 15 Oct 2023 18:12:20 -0300 Subject: [PATCH 32/86] [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules (#3165) * [Security Content] Adjust Mitre Att&ck Mappings - Windows Rules * Fix dates * Fix unit test errors * updated tags and fixed branch conflicts updated tags and fixed branch conflicts * description nit * Reverting unintended changes * Update initial_access_suspicious_ms_office_child_process.toml --------- Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com> --- ...ion_email_powershell_exchange_mailbox.toml | 22 ++++++- .../collection_mailbox_export_winlog.toml | 7 ++- .../collection_posh_audio_capture.toml | 7 ++- rules/windows/collection_posh_keylogger.toml | 7 ++- .../windows/collection_winrar_encryption.toml | 7 ++- .../command_and_control_certreq_postdata.toml | 21 +++++-- ...ommand_and_control_common_webservices.toml | 11 +++- ...nd_and_control_dns_tunneling_nslookup.toml | 7 ++- ...ontrol_port_forwarding_added_registry.toml | 15 ++++- .../command_and_control_rdp_tunnel_plink.toml | 20 ++++++- ..._and_control_remote_file_copy_scripts.toml | 22 ++++++- .../credential_access_cmdline_dump_tool.toml | 21 ++++++- ...ess_copy_ntds_sam_volshadowcp_cmdline.toml | 7 ++- ...ial_access_credential_dumping_msbuild.toml | 36 ++++++++++- ...ial_access_dcsync_newterm_subjectuser.toml | 22 ++++++- ...tial_access_dcsync_replication_rights.toml | 23 ++++++- ...ntial_access_disable_kerberos_preauth.toml | 39 +++++++++++- .../credential_access_ldap_attributes.toml | 30 +++++++++- ...edential_access_lsass_openprocess_api.toml | 18 +++++- ...cess_relay_ntlm_auth_via_http_spoolss.toml | 20 ++++++- ...edelegationprivilege_assigned_to_user.toml | 13 +++- ...l_access_suspicious_comsvcs_imageload.toml | 22 ++++++- ...ccess_suspicious_lsass_access_memdump.toml | 18 +++++- ...cious_winreg_access_via_sebackup_priv.toml | 6 +- ..._symbolic_link_to_shadow_copy_created.toml | 11 +++- ...den_file_attribute_with_via_attribexe.toml | 13 +++- .../defense_evasion_amsienable_key_mod.toml | 6 +- ...sion_clearing_windows_console_history.toml | 22 ++++++- ...e_evasion_clearing_windows_event_logs.toml | 6 +- ..._signing_policy_modification_registry.toml | 7 ++- ...vasion_defender_disabled_via_registry.toml | 6 +- ...asion_disable_posh_scriptblocklogging.toml | 6 +- ...disabling_windows_defender_powershell.toml | 21 ++++++- ...efense_evasion_disabling_windows_logs.toml | 8 ++- ...efense_evasion_dns_over_https_enabled.toml | 7 ++- ...vasion_dotnet_compiler_parent_process.toml | 28 ++++++++- ...n_execution_msbuild_started_by_script.toml | 21 ++++++- ...ion_execution_msbuild_started_renamed.toml | 11 +++- ...cution_msbuild_started_unusal_process.toml | 13 +++- ...execution_suspicious_explorer_winword.toml | 14 ++++- .../defense_evasion_injection_msbuild.toml | 13 +++- ...querading_as_elastic_endpoint_process.toml | 7 ++- ...erading_suspicious_werfault_childproc.toml | 43 ++++++++++++- ...defense_evasion_masquerading_werfault.toml | 7 ++- ..._evasion_microsoft_defender_tampering.toml | 6 +- ...isc_lolbin_connecting_to_the_internet.toml | 9 +-- ...etwork_connection_from_windows_binary.toml | 20 ++++++- ...e_evasion_parent_process_pid_spoofing.toml | 23 ++++++- ...persistence_account_tokenfilterpolicy.toml | 29 +++++---- .../defense_evasion_posh_assembly_load.toml | 10 +++- ...efense_evasion_posh_process_injection.toml | 27 ++++++++- ..._powershell_windows_firewall_disabled.toml | 21 ++++++- ...cess_termination_followed_by_deletion.toml | 12 +++- ...ion_scheduledjobs_at_protocol_enabled.toml | 23 ++++++- ..._evasion_sdelete_like_filename_rename.toml | 18 +++++- ...ackdoor_service_disabled_via_registry.toml | 8 ++- ...picious_execution_from_mounted_device.toml | 10 +++- ...n_suspicious_managedcode_host_process.toml | 4 +- ...picious_process_access_direct_syscall.toml | 18 +++++- ...efense_evasion_suspicious_scrobj_load.toml | 7 ++- ...defense_evasion_suspicious_wmi_script.toml | 17 +++++- ...evasion_suspicious_zoom_child_process.toml | 16 ++++- ..._critical_proc_abnormal_file_activity.toml | 16 ++++- ...sion_unsigned_dll_loaded_from_suspdir.toml | 12 +++- ...fense_evasion_untrusted_driver_loaded.toml | 18 +++--- .../discovery_adfind_command_activity.toml | 6 +- .../discovery_command_system_account.toml | 22 ++++++- .../discovery_posh_invoke_sharefinder.toml | 17 +++++- ...scovery_posh_suspicious_api_functions.toml | 18 +++++- ...arwinds_backdoor_child_cmd_powershell.toml | 14 ++++- .../execution_command_shell_via_rundll32.toml | 23 ++++++- .../execution_posh_portable_executable.toml | 17 +++++- ...ution_psexec_lateral_movement_command.toml | 19 +++++- ...er_program_connecting_to_the_internet.toml | 10 +++- ...tion_scheduled_task_powershell_source.toml | 10 +++- .../windows/execution_suspicious_cmd_wmi.toml | 12 +++- .../execution_suspicious_pdf_reader.toml | 26 ++++++-- .../execution_suspicious_psexesvc.toml | 22 ++++++- .../execution_via_hidden_shell_conhost.toml | 30 +++++++++- .../windows/impact_backup_file_deletion.toml | 6 +- ...deleting_backup_catalogs_with_wbadmin.toml | 7 ++- ...e_shadow_copy_deletion_via_powershell.toml | 22 ++++++- ..._volume_shadow_copy_deletion_via_wmic.toml | 18 +++++- ...al_access_script_executing_powershell.toml | 27 ++++++++- ...ccess_scripts_process_started_via_wmi.toml | 13 +++- ...l_access_suspicious_ms_exchange_files.toml | 18 +++++- ...access_suspicious_ms_exchange_process.toml | 17 +++++- ...ious_ms_exchange_worker_child_process.toml | 25 +++++++- ...ss_suspicious_ms_office_child_process.toml | 23 ++++++- ...s_suspicious_ms_outlook_child_process.toml | 41 ++++++++++++- ...explorer_suspicious_child_parent_args.toml | 45 +++++++++++++- .../windows/lateral_movement_dcom_mmc20.toml | 22 ++++++- ...n_lanman_nullsessionpipe_modification.toml | 16 ++++- ...ateral_movement_evasion_rdp_shadowing.toml | 6 +- ..._movement_execution_from_tsclient_mup.toml | 7 ++- .../lateral_movement_incoming_wmi.toml | 7 ++- ...l_movement_powershell_remoting_target.toml | 21 ++++++- ...lateral_movement_rdp_enabled_registry.toml | 18 +++++- ...ement_suspicious_rdp_client_imageload.toml | 6 +- ...ovement_unusual_dns_service_children.toml} | 16 ++--- ...ment_unusual_dns_service_file_writes.toml} | 16 ++--- ...l_movement_via_startup_folder_rdp_smb.toml | 7 ++- .../windows/persistence_ad_adminsdholder.toml | 16 ++++- .../persistence_adobe_hijack_persistence.toml | 7 ++- .../persistence_appcertdlls_registry.toml | 22 ++++++- .../persistence_appinitdlls_registry.toml | 18 +++++- ...tence_evasion_registry_ifeo_injection.toml | 18 +++++- ...egistry_startup_shell_folder_modified.toml | 18 +++++- ...stence_local_scheduled_task_scripting.toml | 27 ++++++++- .../persistence_ms_office_addins_file.toml | 6 +- ...ll_exch_mailbox_activesync_add_device.toml | 22 ++++++- .../persistence_powershell_profiles.toml | 22 ++++++- .../persistence_remote_password_reset.toml | 17 +++++- ...istence_sdprop_exclusion_dsheuristics.toml | 17 +++++- .../persistence_service_dll_unsigned.toml | 40 ++++++++++++- .../persistence_services_registry.toml | 18 +++++- ...lder_file_written_by_unsigned_process.toml | 21 ++++++- ...stence_suspicious_com_hijack_registry.toml | 36 ++++++++++- ...s_image_load_scheduled_task_ms_office.toml | 27 ++++++++- ...nce_suspicious_scheduled_task_runtime.toml | 21 ++++++- ...e_suspicious_service_created_registry.toml | 18 +++++- ...ersistence_system_shells_via_services.toml | 26 +++++++- .../persistence_temp_scheduled_task.toml | 23 ++++++- .../persistence_time_provider_mod.toml | 22 ++++++- ...sistence_via_hidden_run_key_valuename.toml | 31 +++++++++- ...sa_security_support_provider_registry.toml | 18 +++++- ...emetrycontroller_scheduledtask_hijack.toml | 32 +++++++++- ...ia_update_orchestrator_service_hijack.toml | 22 ++++++- ...nt_instrumentation_event_subscription.toml | 17 +++++- ...ia_xp_cmdshell_mssql_stored_procedure.toml | 8 ++- .../persistence_webshell_detection.toml | 36 ++++++++++- ...privilege_escalation_credroaming_ldap.toml | 9 +-- ...ilege_escalation_disable_uac_registry.toml | 17 +++++- ...ge_escalation_driver_newterm_imphash.toml} | 17 +++++- ...alation_gpo_schtask_service_creation.toml} | 22 ++++++- ...scalation_group_policy_scheduled_task.toml | 16 ++++- ...ge_escalation_persistence_phantom_dll.toml | 20 ++++++- ...ion_port_monitor_print_pocessor_abuse.toml | 10 +++- ...lation_samaccountname_spoofing_attack.toml | 8 ++- ...on_service_control_spawned_script_int.toml | 60 ++++++++++++++++++- ...lege_escalation_uac_bypass_com_clipup.toml | 40 ++++++++++++- ...ge_escalation_uac_bypass_com_ieinstal.toml | 39 +++++++++++- ...n_uac_bypass_com_interface_icmluautil.toml | 40 ++++++++++++- ...alation_uac_bypass_diskcleanup_hijack.toml | 40 ++++++++++++- ...escalation_uac_bypass_dll_sideloading.toml | 31 +++++++++- ...ge_escalation_uac_bypass_event_viewer.toml | 22 ++++++- ...ege_escalation_uac_bypass_mock_windir.toml | 31 +++++++++- ...scalation_uac_bypass_winfw_mmc_hijack.toml | 31 +++++++++- .../privilege_escalation_uac_sdclt.toml | 22 ++++++- ...n_unusual_svchost_childproc_childless.toml | 6 +- ...tion_files_staged_in_recycle_bin_root.toml | 7 ++- .../credential_access_kirbi_file.toml | 19 +----- ...ense_evasion_cmd_copy_binary_contents.toml | 22 ++++++- ...ication_apps_suspicious_child_process.toml | 27 ++++++++- .../defense_evasion_disable_nla.toml | 8 ++- ...defense_evasion_masquerading_browsers.toml | 26 +++++++- ..._masquerading_business_apps_installer.toml | 33 +++++++++- ...asion_masquerading_communication_apps.toml | 27 ++++++++- .../defense_evasion_masquerading_vlc_dll.toml | 27 ++++++++- ...ense_evasion_masquerading_windows_dll.toml | 42 ++++++++++++- ...ion_masquerading_windows_system32_exe.toml | 26 +++++++- ...nse_evasion_unusual_process_extension.toml | 7 ++- .../defense_evasion_write_dac_access.toml | 7 ++- .../discovery_net_share_discovery_winlog.toml | 18 +++++- rules_building_block/discovery_net_view.toml | 18 +++++- .../discovery_posh_password_policy.toml | 24 +++++++- .../discovery_security_software_wmic.toml | 16 ++++- ...execution_unsigned_service_executable.toml | 20 ++++++- rules_building_block/lateral_movement_at.toml | 7 ++- .../lateral_movement_posh_winrm_activity.toml | 24 +++++++- ...ovement_unusual_process_sql_accounts.toml} | 20 ++++--- .../lateral_movement_wmic_remote.toml | 7 ++- ...persistence_msoffice_startup_registry.toml | 17 +++++- ...lege_escalation_expired_driver_loaded.toml | 23 ++++++- 174 files changed, 2893 insertions(+), 351 deletions(-) mode change 100755 => 100644 rules/windows/defense_evasion_execution_msbuild_started_by_script.toml rename rules/windows/{initial_access_unusual_dns_service_children.toml => lateral_movement_unusual_dns_service_children.toml} (93%) rename rules/windows/{initial_access_unusual_dns_service_file_writes.toml => lateral_movement_unusual_dns_service_file_writes.toml} (87%) rename rules/windows/{persistence_driver_newterm_imphash.toml => privilege_escalation_driver_newterm_imphash.toml} (94%) rename rules/windows/{persistence_gpo_schtask_service_creation.toml => privilege_escalation_gpo_schtask_service_creation.toml} (77%) rename rules_building_block/{initial_access_unusual_process_sql_accounts.toml => lateral_movement_unusual_process_sql_accounts.toml} (82%) diff --git a/rules/windows/collection_email_powershell_exchange_mailbox.toml b/rules/windows/collection_email_powershell_exchange_mailbox.toml index cb08ce0d6..c0015c63e 100644 --- a/rules/windows/collection_email_powershell_exchange_mailbox.toml +++ b/rules/windows/collection_email_powershell_exchange_mailbox.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -70,7 +70,7 @@ references = [ risk_score = 47 rule_id = "6aace640-e631-4870-ba8e-5fdda09325db" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -104,3 +104,21 @@ id = "TA0009" name = "Collection" reference = "https://attack.mitre.org/tactics/TA0009/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/collection_mailbox_export_winlog.toml b/rules/windows/collection_mailbox_export_winlog.toml index 7c12a1ffc..96c0e3b3d 100644 --- a/rules/windows/collection_mailbox_export_winlog.toml +++ b/rules/windows/collection_mailbox_export_winlog.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -80,6 +80,11 @@ event.category:process and host.os.type:windows and [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1005" +name = "Data from Local System" +reference = "https://attack.mitre.org/techniques/T1005/" + [[rule.threat.technique]] id = "T1114" name = "Email Collection" diff --git a/rules/windows/collection_posh_audio_capture.toml b/rules/windows/collection_posh_audio_capture.toml index c2c92900e..35f7a19ba 100644 --- a/rules/windows/collection_posh_audio_capture.toml +++ b/rules/windows/collection_posh_audio_capture.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/17" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -117,6 +117,11 @@ name = "PowerShell" reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + [rule.threat.tactic] id = "TA0002" diff --git a/rules/windows/collection_posh_keylogger.toml b/rules/windows/collection_posh_keylogger.toml index 4bac504b5..a625a73fd 100644 --- a/rules/windows/collection_posh_keylogger.toml +++ b/rules/windows/collection_posh_keylogger.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/21" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -128,6 +128,11 @@ name = "PowerShell" reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + [rule.threat.tactic] id = "TA0002" diff --git a/rules/windows/collection_winrar_encryption.toml b/rules/windows/collection_winrar_encryption.toml index 7f933702c..641d08ab0 100644 --- a/rules/windows/collection_winrar_encryption.toml +++ b/rules/windows/collection_winrar_encryption.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -90,6 +90,11 @@ id = "T1560.001" name = "Archive via Utility" reference = "https://attack.mitre.org/techniques/T1560/001/" +[[rule.threat.technique]] +id = "T1005" +name = "Data from Local System" +reference = "https://attack.mitre.org/techniques/T1005/" + [rule.threat.tactic] diff --git a/rules/windows/command_and_control_certreq_postdata.toml b/rules/windows/command_and_control_certreq_postdata.toml index a30c10442..dc470f2b7 100644 --- a/rules/windows/command_and_control_certreq_postdata.toml +++ b/rules/windows/command_and_control_certreq_postdata.toml @@ -4,23 +4,23 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] description = """ -Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to exfiltrate data to a remote URL. +Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL. """ from = "now-9m" index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] language = "eql" license = "Elastic License v2" -name = "Potential Exfiltration via Certreq" +name = "Potential File Transfer via Certreq" references = ["https://lolbas-project.github.io/lolbas/Binaries/Certreq/"] risk_score = 47 rule_id = "79f0a1f7-ed6b-471c-8eb1-23abd6470b1c" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Command and Control", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Command and Control", "Tactic: Exfiltration", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -56,3 +56,16 @@ reference = "https://attack.mitre.org/techniques/T1218/" id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1567" +name = "Exfiltration Over Web Service" +reference = "https://attack.mitre.org/techniques/T1567/" + +[rule.threat.tactic] +id = "TA0010" +name = "Exfiltration" +reference = "https://attack.mitre.org/tactics/TA0010/" + diff --git a/rules/windows/command_and_control_common_webservices.toml b/rules/windows/command_and_control_common_webservices.toml index 5ab6009b7..274cbb41b 100644 --- a/rules/windows/command_and_control_common_webservices.toml +++ b/rules/windows/command_and_control_common_webservices.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -180,6 +180,15 @@ id = "T1102" name = "Web Service" reference = "https://attack.mitre.org/techniques/T1102/" +[[rule.threat.technique]] +id = "T1568" +name = "Dynamic Resolution" +reference = "https://attack.mitre.org/techniques/T1568/" + + [[rule.threat.technique.subtechnique]] + id = "T1568.002" + name = "Domain Generation Algorithms" + reference = "https://attack.mitre.org/techniques/T1568/002/" [rule.threat.tactic] id = "TA0011" diff --git a/rules/windows/command_and_control_dns_tunneling_nslookup.toml b/rules/windows/command_and_control_dns_tunneling_nslookup.toml index efecb7c2e..2fd96ee97 100644 --- a/rules/windows/command_and_control_dns_tunneling_nslookup.toml +++ b/rules/windows/command_and_control_dns_tunneling_nslookup.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -82,7 +82,10 @@ id = "T1071.004" name = "DNS" reference = "https://attack.mitre.org/techniques/T1071/004/" - +[[rule.threat.technique]] +id = "T1572" +name = "Protocol Tunneling" +reference = "https://attack.mitre.org/techniques/T1572/" [rule.threat.tactic] id = "TA0011" diff --git a/rules/windows/command_and_control_port_forwarding_added_registry.toml b/rules/windows/command_and_control_port_forwarding_added_registry.toml index 223fcd12c..d1b13d314 100644 --- a/rules/windows/command_and_control_port_forwarding_added_registry.toml +++ b/rules/windows/command_and_control_port_forwarding_added_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -74,6 +74,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", + "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -102,3 +103,15 @@ id = "TA0011" name = "Command and Control" reference = "https://attack.mitre.org/tactics/TA0011/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/command_and_control_rdp_tunnel_plink.toml b/rules/windows/command_and_control_rdp_tunnel_plink.toml index 51f99d833..6ccc79126 100644 --- a/rules/windows/command_and_control_rdp_tunnel_plink.toml +++ b/rules/windows/command_and_control_rdp_tunnel_plink.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -65,6 +65,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", + "Tactic: Lateral Movement", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -93,3 +94,20 @@ id = "TA0011" name = "Command and Control" reference = "https://attack.mitre.org/tactics/TA0011/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1021" +name = "Remote Services" +reference = "https://attack.mitre.org/techniques/T1021/" +[[rule.threat.technique.subtechnique]] +id = "T1021.004" +name = "SSH" +reference = "https://attack.mitre.org/techniques/T1021/004/" + + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" diff --git a/rules/windows/command_and_control_remote_file_copy_scripts.toml b/rules/windows/command_and_control_remote_file_copy_scripts.toml index e929bb25b..5c1845af6 100644 --- a/rules/windows/command_and_control_remote_file_copy_scripts.toml +++ b/rules/windows/command_and_control_remote_file_copy_scripts.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/29" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -96,7 +96,7 @@ This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscr risk_score = 47 rule_id = "1d276579-3380-4095-ad38-e596a01bc64f" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -121,3 +121,21 @@ id = "TA0011" name = "Command and Control" reference = "https://attack.mitre.org/tactics/TA0011/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/credential_access_cmdline_dump_tool.toml b/rules/windows/credential_access_cmdline_dump_tool.toml index c128f9b2c..c6917a922 100644 --- a/rules/windows/credential_access_cmdline_dump_tool.toml +++ b/rules/windows/credential_access_cmdline_dump_tool.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -64,6 +64,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", + "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -130,3 +131,21 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.011" +name = "Rundll32" +reference = "https://attack.mitre.org/techniques/T1218/011/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml b/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml index 53332e46e..024a9e604 100644 --- a/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml +++ b/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic", "Austin Songer"] @@ -57,6 +57,11 @@ id = "T1003.002" name = "Security Account Manager" reference = "https://attack.mitre.org/techniques/T1003/002/" +[[rule.threat.technique.subtechnique]] +id = "T1003.003" +name = "NTDS" +reference = "https://attack.mitre.org/techniques/T1003/003/" + [rule.threat.tactic] diff --git a/rules/windows/credential_access_credential_dumping_msbuild.toml b/rules/windows/credential_access_credential_dumping_msbuild.toml index 0d482c031..dcbb47c46 100644 --- a/rules/windows/credential_access_credential_dumping_msbuild.toml +++ b/rules/windows/credential_access_credential_dumping_msbuild.toml @@ -2,7 +2,7 @@ creation_date = "2020/03/25" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -100,7 +100,7 @@ This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, risk_score = 73 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -118,9 +118,41 @@ id = "T1003" name = "OS Credential Dumping" reference = "https://attack.mitre.org/techniques/T1003/" +[[rule.threat.technique.subtechnique]] +id = "T1003.002" +name = "Security Account Manager" +reference = "https://attack.mitre.org/techniques/T1003/002/" + + +[[rule.threat.technique]] +id = "T1555" +name = "Credentials from Password Stores" +reference = "https://attack.mitre.org/techniques/T1555/" +[[rule.threat.technique.subtechnique]] +id = "T1555.004" +name = "Windows Credential Manager" +reference = "https://attack.mitre.org/techniques/T1555/004/" [rule.threat.tactic] id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1127" +name = "Trusted Developer Utilities Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1127/" +[[rule.threat.technique.subtechnique]] +id = "T1127.001" +name = "MSBuild" +reference = "https://attack.mitre.org/techniques/T1127/001/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/credential_access_dcsync_newterm_subjectuser.toml b/rules/windows/credential_access_dcsync_newterm_subjectuser.toml index 66e6a0f60..5b77051ea 100644 --- a/rules/windows/credential_access_dcsync_newterm_subjectuser.toml +++ b/rules/windows/credential_access_dcsync_newterm_subjectuser.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "The New Term rule type used in this rule was added in Elastic 8.4" min_stack_version = "8.4.0" -updated_date = "2023/06/27" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -82,7 +82,7 @@ references = [ risk_score = 73 rule_id = "5c6f4c58-b381-452a-8976-f1b1c6aa0def" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Use Case: Active Directory Monitoring", "Data Source: Active Directory", "Resources: Investigation Guide"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring", "Data Source: Active Directory", "Resources: Investigation Guide"] timestamp_override = "event.ingested" type = "new_terms" @@ -114,6 +114,24 @@ id = "TA0006" reference = "https://attack.mitre.org/tactics/TA0006/" name = "Credential Access" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" +[[rule.threat.technique.subtechnique]] +id = "T1078.002" +name = "Domain Accounts" +reference = "https://attack.mitre.org/techniques/T1078/002/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" [rule.new_terms] field = "new_terms_fields" diff --git a/rules/windows/credential_access_dcsync_replication_rights.toml b/rules/windows/credential_access_dcsync_replication_rights.toml index 20bf29c1e..e2766b03a 100644 --- a/rules/windows/credential_access_dcsync_replication_rights.toml +++ b/rules/windows/credential_access_dcsync_replication_rights.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -87,6 +87,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", + "Tactic: Privilege Escalation", "Data Source: Active Directory", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring" @@ -137,3 +138,23 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" +[[rule.threat.technique.subtechnique]] +id = "T1078.002" +name = "Domain Accounts" +reference = "https://attack.mitre.org/techniques/T1078/002/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/credential_access_disable_kerberos_preauth.toml b/rules/windows/credential_access_disable_kerberos_preauth.toml index 0af7561c7..eac4ef041 100644 --- a/rules/windows/credential_access_disable_kerberos_preauth.toml +++ b/rules/windows/credential_access_disable_kerberos_preauth.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -70,7 +70,7 @@ references = [ risk_score = 47 rule_id = "e514d8cd-ed15-4011-84e2-d15147e059f1" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] timestamp_override = "event.ingested" type = "query" @@ -97,3 +97,38 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1562" +name = "Impair Defenses" +reference = "https://attack.mitre.org/techniques/T1562/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" +[[rule.threat.technique.subtechnique]] +id = "T1078.002" +name = "Domain Accounts" +reference = "https://attack.mitre.org/techniques/T1078/002/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/credential_access_ldap_attributes.toml b/rules/windows/credential_access_ldap_attributes.toml index 775a8278d..c00a777ca 100644 --- a/rules/windows/credential_access_ldap_attributes.toml +++ b/rules/windows/credential_access_ldap_attributes.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -43,7 +43,7 @@ references = [ risk_score = 47 rule_id = "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] timestamp_override = "event.ingested" type = "eql" @@ -82,9 +82,35 @@ id = "T1003" name = "OS Credential Dumping" reference = "https://attack.mitre.org/techniques/T1003/" +[[rule.threat.technique]] +id = "T1552" +name = "Unsecured Credentials" +reference = "https://attack.mitre.org/techniques/T1552/" +[[rule.threat.technique.subtechnique]] +id = "T1552.004" +name = "Private Keys" +reference = "https://attack.mitre.org/techniques/T1552/004/" [rule.threat.tactic] id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" +[[rule.threat.technique.subtechnique]] +id = "T1078.002" +name = "Domain Accounts" +reference = "https://attack.mitre.org/techniques/T1078/002/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/credential_access_lsass_openprocess_api.toml b/rules/windows/credential_access_lsass_openprocess_api.toml index 218eba17e..f73b01caa 100644 --- a/rules/windows/credential_access_lsass_openprocess_api.toml +++ b/rules/windows/credential_access_lsass_openprocess_api.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: Lsass access events added in Elastic Endpoint 8.7." min_stack_version = "8.7.0" -updated_date = "2023/08/28" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ references = ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomic risk_score = 47 rule_id = "ff4599cb-409f-4910-a239-52e4e6f532ff" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -72,3 +72,17 @@ reference = "https://attack.mitre.org/techniques/T1003/001/" id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" diff --git a/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml b/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml index 8ed4a77c0..48f80ec0c 100644 --- a/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml +++ b/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ references = [ risk_score = 73 rule_id = "4682fd2c-cfae-47ed-a543-9bed37657aa6" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion","Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -54,3 +54,19 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.011" +name = "Rundll32" +reference = "https://attack.mitre.org/techniques/T1218/011/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml b/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml index 6681183be..15c7ca4dc 100644 --- a/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml +++ b/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -82,6 +82,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", + "Tactic: Persistence", "Data Source: Active Directory", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring" @@ -98,6 +99,11 @@ event.action:"Authorization Policy Change" and event.code:4704 and [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1558" +name = "Steal or Forge Kerberos Tickets" +reference = "https://attack.mitre.org/techniques/T1558/" + [rule.threat.tactic] id = "TA0006" name = "Credential Access" @@ -105,6 +111,11 @@ reference = "https://attack.mitre.org/tactics/TA0006/" [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + [rule.threat.tactic] id = "TA0003" name = "Persistence" diff --git a/rules/windows/credential_access_suspicious_comsvcs_imageload.toml b/rules/windows/credential_access_suspicious_comsvcs_imageload.toml index 13e9e04c1..17ed18478 100644 --- a/rules/windows/credential_access_suspicious_comsvcs_imageload.toml +++ b/rules/windows/credential_access_suspicious_comsvcs_imageload.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -26,7 +26,7 @@ references = ["https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com risk_score = 73 rule_id = "c5c9f591-d111-4cf8-baec-c26a39bc31ef" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion", "Data Source: Sysmon Only"] type = "eql" query = ''' @@ -58,3 +58,21 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.011" +name = "Rundll32" +reference = "https://attack.mitre.org/techniques/T1218/011/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/credential_access_suspicious_lsass_access_memdump.toml b/rules/windows/credential_access_suspicious_lsass_access_memdump.toml index ad11964ba..889e8fedf 100644 --- a/rules/windows/credential_access_suspicious_lsass_access_memdump.toml +++ b/rules/windows/credential_access_suspicious_lsass_access_memdump.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/06/29" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -28,7 +28,7 @@ references = [ risk_score = 73 rule_id = "9960432d-9b26-409f-972b-839a959e79e2" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic:Execution", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" type = "eql" @@ -62,3 +62,17 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml b/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml index 8e7754b7c..467843760 100644 --- a/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml +++ b/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -109,6 +109,10 @@ id = "T1003.002" name = "Security Account Manager" reference = "https://attack.mitre.org/techniques/T1003/002/" +[[rule.threat.technique.subtechnique]] +id = "T1003.004" +name = "LSA Secrets" +reference = "https://attack.mitre.org/techniques/T1003/004/" [rule.threat.tactic] diff --git a/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml b/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml index 27144441b..6dc31fb5b 100644 --- a/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml +++ b/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic", "Austin Songer"] @@ -114,6 +114,15 @@ framework = "MITRE ATT&CK" id = "T1003" name = "OS Credential Dumping" reference = "https://attack.mitre.org/techniques/T1003/" +[[rule.threat.technique.subtechnique]] +id = "T1003.002" +name = "Security Account Manager" +reference = "https://attack.mitre.org/techniques/T1003/002/" + +[[rule.threat.technique.subtechnique]] +id = "T1003.003" +name = "NTDS" +reference = "https://attack.mitre.org/techniques/T1003/003/" [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml b/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml index 2e3f8f645..2a405d0cf 100644 --- a/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml +++ b/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -95,7 +95,7 @@ This rule looks for the execution of the `attrib.exe` utility with a command lin risk_score = 21 rule_id = "4630d948-40d4-4cef-ac69-4002e29bc3db" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db" timeline_title = "Comprehensive Process Timeline" timestamp_override = "event.ingested" @@ -122,6 +122,15 @@ id = "T1564.001" name = "Hidden Files and Directories" reference = "https://attack.mitre.org/techniques/T1564/001/" +[[rule.threat.technique]] +id = "T1222" +name = "File and Directory Permissions Modification" +reference = "https://attack.mitre.org/techniques/T1222/" + +[[rule.threat.technique.subtechnique]] +id = "T1222.001" +name = "Windows File and Directory Permissions Modification" +reference = "https://attack.mitre.org/techniques/T1222/001/" [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_amsienable_key_mod.toml b/rules/windows/defense_evasion_amsienable_key_mod.toml index 5866c90e3..553158a11 100644 --- a/rules/windows/defense_evasion_amsienable_key_mod.toml +++ b/rules/windows/defense_evasion_amsienable_key_mod.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -112,6 +112,10 @@ id = "T1562.001" name = "Disable or Modify Tools" reference = "https://attack.mitre.org/techniques/T1562/001/" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_clearing_windows_console_history.toml b/rules/windows/defense_evasion_clearing_windows_console_history.toml index 6bcb26103..ff83e5d8a 100644 --- a/rules/windows/defense_evasion_clearing_windows_console_history.toml +++ b/rules/windows/defense_evasion_clearing_windows_console_history.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Austin Songer"] @@ -65,6 +65,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -99,3 +100,22 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_clearing_windows_event_logs.toml b/rules/windows/defense_evasion_clearing_windows_event_logs.toml index 18023638b..9cffe7d9c 100644 --- a/rules/windows/defense_evasion_clearing_windows_event_logs.toml +++ b/rules/windows/defense_evasion_clearing_windows_event_logs.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -94,6 +94,10 @@ id = "T1070.001" name = "Clear Windows Event Logs" reference = "https://attack.mitre.org/techniques/T1070/001/" +[[rule.threat.technique.subtechnique]] +id = "T1562.002" +name = "Disable Windows Event Logging" +reference = "https://attack.mitre.org/techniques/T1562/002/" [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml b/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml index 0e1bb8b63..e53afbb08 100644 --- a/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml +++ b/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -114,7 +114,10 @@ id = "T1553.006" name = "Code Signing Policy Modification" reference = "https://attack.mitre.org/techniques/T1553/006/" - +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_defender_disabled_via_registry.toml b/rules/windows/defense_evasion_defender_disabled_via_registry.toml index 1e35df61a..99a492b96 100644 --- a/rules/windows/defense_evasion_defender_disabled_via_registry.toml +++ b/rules/windows/defense_evasion_defender_disabled_via_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -116,6 +116,10 @@ id = "T1562.006" name = "Indicator Blocking" reference = "https://attack.mitre.org/techniques/T1562/006/" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml b/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml index 8aa170a3d..b3d7e1c4b 100644 --- a/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml +++ b/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -95,6 +95,10 @@ id = "T1562.002" name = "Disable Windows Event Logging" reference = "https://attack.mitre.org/techniques/T1562/002/" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml b/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml index c7f57e82e..7fd311f3c 100644 --- a/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml +++ b/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -67,6 +67,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -99,3 +100,21 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_disabling_windows_logs.toml b/rules/windows/defense_evasion_disabling_windows_logs.toml index f7c000537..b355b53a1 100644 --- a/rules/windows/defense_evasion_disabling_windows_logs.toml +++ b/rules/windows/defense_evasion_disabling_windows_logs.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic", "Ivan Ninichuck", "Austin Songer"] @@ -102,6 +102,12 @@ reference = "https://attack.mitre.org/techniques/T1070/001/" id = "T1562" name = "Impair Defenses" reference = "https://attack.mitre.org/techniques/T1562/" + +[[rule.threat.technique.subtechnique]] +id = "T1562.002" +name = "Disable Windows Event Logging" +reference = "https://attack.mitre.org/techniques/T1562/002/" + [[rule.threat.technique.subtechnique]] id = "T1562.006" name = "Indicator Blocking" diff --git a/rules/windows/defense_evasion_dns_over_https_enabled.toml b/rules/windows/defense_evasion_dns_over_https_enabled.toml index cdd2c77a2..335032239 100644 --- a/rules/windows/defense_evasion_dns_over_https_enabled.toml +++ b/rules/windows/defense_evasion_dns_over_https_enabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Austin Songer"] @@ -51,6 +51,11 @@ id = "T1562" name = "Impair Defenses" reference = "https://attack.mitre.org/techniques/T1562/" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml b/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml index 8a41f8898..c6f8b87cd 100644 --- a/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml +++ b/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml @@ -4,11 +4,14 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] -description = "Identifies suspicious .NET code execution. connections." +description = """ +Identifies executions of .NET compilers with suspicious parent processes, which can indicate an attacker's attempt +to compile code after delivery in order to bypass security mechanisms. +""" from = "now-9m" index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] language = "eql" @@ -21,7 +24,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "201200f1-a99b-43fb-88ed-f65a45c4972c" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -50,3 +53,22 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml old mode 100755 new mode 100644 index a07905101..9c190c368 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/19" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -58,6 +58,25 @@ reference = "https://attack.mitre.org/tactics/TA0005/" [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + + [rule.threat.tactic] id = "TA0002" name = "Execution" diff --git a/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml b/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml index 16df4b7d7..ab658982d 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/18" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -132,6 +132,15 @@ id = "T1036.003" name = "Rename System Utilities" reference = "https://attack.mitre.org/techniques/T1036/003/" +[[rule.threat.technique]] +id = "T1127" +name = "Trusted Developer Utilities Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1127/" +[[rule.threat.technique.subtechnique]] +id = "T1127.001" +name = "MSBuild" +reference = "https://attack.mitre.org/techniques/T1127/001/" + [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml b/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml index ddaafe8f9..f0f2e0ec0 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/19" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -60,6 +60,17 @@ id = "T1027.004" name = "Compile After Delivery" reference = "https://attack.mitre.org/techniques/T1027/004/" +[[rule.threat.technique]] +id = "T1127" +name = "Trusted Developer Utilities Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1127/" +[[rule.threat.technique.subtechnique]] +id = "T1127.001" +name = "MSBuild" +reference = "https://attack.mitre.org/techniques/T1127/001/" + + + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" diff --git a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml index 4b52077cc..1333b53ac 100644 --- a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml +++ b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -17,7 +17,7 @@ from = "now-9m" index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] language = "eql" license = "Elastic License v2" -name = "Potential DLL SideLoading via Trusted Microsoft Programs" +name = "Potential DLL Side-Loading via Trusted Microsoft Programs" note = """## Setup If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. @@ -57,6 +57,16 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique]] +id = "T1574" +name = "Hijack Execution Flow" +reference = "https://attack.mitre.org/techniques/T1574/" +[[rule.threat.technique.subtechnique]] +id = "T1574.002" +name = "DLL Side-Loading" +reference = "https://attack.mitre.org/techniques/T1574/002/" + + [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_injection_msbuild.toml b/rules/windows/defense_evasion_injection_msbuild.toml index 3211a75db..23b432f69 100755 --- a/rules/windows/defense_evasion_injection_msbuild.toml +++ b/rules/windows/defense_evasion_injection_msbuild.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ name = "Process Injection by the Microsoft Build Engine" risk_score = 21 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Sysmon Only"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" type = "query" @@ -36,6 +36,15 @@ id = "T1055" name = "Process Injection" reference = "https://attack.mitre.org/techniques/T1055/" +[[rule.threat.technique]] +id = "T1127" +name = "Trusted Developer Utilities Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1127/" +[[rule.threat.technique.subtechnique]] +id = "T1127.001" +name = "MSBuild" +reference = "https://attack.mitre.org/techniques/T1127/001/" + [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml b/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml index f574bbc77..169eb6327 100644 --- a/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml +++ b/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -47,6 +47,11 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml b/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml index e890786bb..15b1f18bd 100644 --- a/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml +++ b/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -31,7 +31,7 @@ references = [ risk_score = 47 rule_id = "ac5012b8-8da8-440b-aaaf-aedafdea2dff" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -60,3 +60,42 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.012" +name = "Image File Execution Options Injection" +reference = "https://attack.mitre.org/techniques/T1546/012/" + + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.012" +name = "Image File Execution Options Injection" +reference = "https://attack.mitre.org/techniques/T1546/012/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/defense_evasion_masquerading_werfault.toml b/rules/windows/defense_evasion_masquerading_werfault.toml index 37bc0e9d8..fb1853613 100644 --- a/rules/windows/defense_evasion_masquerading_werfault.toml +++ b/rules/windows/defense_evasion_masquerading_werfault.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -122,6 +122,11 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_microsoft_defender_tampering.toml b/rules/windows/defense_evasion_microsoft_defender_tampering.toml index a2abaed01..ba1f9f237 100644 --- a/rules/windows/defense_evasion_microsoft_defender_tampering.toml +++ b/rules/windows/defense_evasion_microsoft_defender_tampering.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Austin Songer"] @@ -116,6 +116,10 @@ id = "T1562" name = "Impair Defenses" reference = "https://attack.mitre.org/techniques/T1562/" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml b/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml index d0b6fe2f8..b25ab856f 100644 --- a/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml +++ b/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -130,11 +130,4 @@ reference = "https://attack.mitre.org/techniques/T1218/" id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" -[[rule.threat]] -framework = "MITRE ATT&CK" - -[rule.threat.tactic] -id = "TA0002" -name = "Execution" -reference = "https://attack.mitre.org/tactics/TA0002/" diff --git a/rules/windows/defense_evasion_network_connection_from_windows_binary.toml b/rules/windows/defense_evasion_network_connection_from_windows_binary.toml index 1cdc5e564..8ab001370 100644 --- a/rules/windows/defense_evasion_network_connection_from_windows_binary.toml +++ b/rules/windows/defense_evasion_network_connection_from_windows_binary.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -164,7 +164,25 @@ framework = "MITRE ATT&CK" id = "T1127" name = "Trusted Developer Utilities Proxy Execution" reference = "https://attack.mitre.org/techniques/T1127/" +[[rule.threat.technique.subtechnique]] +id = "T1127.001" +name = "MSBuild" +reference = "https://attack.mitre.org/techniques/T1127/001/" +[[rule.threat.technique.subtechnique]] +id = "T1218.005" +name = "Mshta" +reference = "https://attack.mitre.org/techniques/T1218/005/" + +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_parent_process_pid_spoofing.toml b/rules/windows/defense_evasion_parent_process_pid_spoofing.toml index 3174bda50..c7390f8df 100644 --- a/rules/windows/defense_evasion_parent_process_pid_spoofing.toml +++ b/rules/windows/defense_evasion_parent_process_pid_spoofing.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -21,7 +21,7 @@ references = ["https://blog.didierstevens.com/2017/03/20/"] risk_score = 73 rule_id = "c88d4bd0-5649-4c52-87ea-9be59dbfbcf2" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -85,3 +85,22 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1134" +name = "Access Token Manipulation" +reference = "https://attack.mitre.org/techniques/T1134/" +[[rule.threat.technique.subtechnique]] +id = "T1134.004" +name = "Parent PID Spoofing" +reference = "https://attack.mitre.org/techniques/T1134/004/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml b/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml index b42d3a944..4fc06cc17 100644 --- a/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml +++ b/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -31,7 +31,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", - "Tactic: Privilege Escalation", + "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" ] @@ -53,26 +53,33 @@ id = "T1112" name = "Modify Registry" reference = "https://attack.mitre.org/techniques/T1112/" +[[rule.threat.technique]] +id = "T1562" +name = "Impair Defenses" +reference = "https://attack.mitre.org/techniques/T1562/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + + [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1078" -name = "Valid Accounts" -reference = "https://attack.mitre.org/techniques/T1078/" +id = "T1550" +name = "Use Alternate Authentication Material" +reference = "https://attack.mitre.org/techniques/T1550/" [[rule.threat.technique.subtechnique]] -id = "T1078.003" -name = "Local Accounts" -reference = "https://attack.mitre.org/techniques/T1078/003/" +id = "T1550.002" +name = "Pass the Hash" +reference = "https://attack.mitre.org/techniques/T1550/002/" [rule.threat.tactic] -id = "TA0004" -name = "Privilege Escalation" -reference = "https://attack.mitre.org/tactics/TA0004/" +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" diff --git a/rules/windows/defense_evasion_posh_assembly_load.toml b/rules/windows/defense_evasion_posh_assembly_load.toml index d64c30893..ae4556e74 100644 --- a/rules/windows/defense_evasion_posh_assembly_load.toml +++ b/rules/windows/defense_evasion_posh_assembly_load.toml @@ -2,7 +2,7 @@ creation_date = "2021/10/15" integration = ["windows"] maturity = "production" -updated_date = "2023/07/05" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -124,7 +124,7 @@ references = ["https://docs.microsoft.com/en-us/dotnet/api/system.reflection.ass risk_score = 47 rule_id = "e26f042e-c590-4e82-8e05-41e81bd822ad" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" type = "query" @@ -148,6 +148,12 @@ event.category:process and host.os.type:windows and [[rule.threat]] framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1620" +name = "Reflective Code Loading" +reference = "https://attack.mitre.org/techniques/T1620/" + [[rule.threat.technique]] id = "T1055" name = "Process Injection" diff --git a/rules/windows/defense_evasion_posh_process_injection.toml b/rules/windows/defense_evasion_posh_process_injection.toml index 94323cd13..24a3654f9 100644 --- a/rules/windows/defense_evasion_posh_process_injection.toml +++ b/rules/windows/defense_evasion_posh_process_injection.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -83,7 +83,7 @@ references = [ risk_score = 47 rule_id = "2e29e96a-b67c-455a-afe4-de6183431d0d" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" type = "query" @@ -123,3 +123,26 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml b/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml index 311ae1508..dbb452e5e 100644 --- a/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml +++ b/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Austin Songer"] @@ -75,6 +75,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -109,3 +110,21 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_process_termination_followed_by_deletion.toml b/rules/windows/defense_evasion_process_termination_followed_by_deletion.toml index 92101aef0..3c844a402 100644 --- a/rules/windows/defense_evasion_process_termination_followed_by_deletion.toml +++ b/rules/windows/defense_evasion_process_termination_followed_by_deletion.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/27" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -117,6 +117,16 @@ sequence by host.id with maxspan=5s [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + [[rule.threat.technique]] id = "T1070" name = "Indicator Removal" diff --git a/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml b/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml index 153c1472b..994fba84b 100644 --- a/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml +++ b/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -26,7 +26,7 @@ references = ["https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32 risk_score = 47 rule_id = "9aa0e1f6-52ce-42e1-abb3-09657cee2698" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -57,3 +57,22 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" + +[[rule.threat.technique.subtechnique]] +id = "T1053.002" +name = "At" +reference = "https://attack.mitre.org/techniques/T1053/002/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_sdelete_like_filename_rename.toml b/rules/windows/defense_evasion_sdelete_like_filename_rename.toml index 771bce007..9c5d38800 100644 --- a/rules/windows/defense_evasion_sdelete_like_filename_rename.toml +++ b/rules/windows/defense_evasion_sdelete_like_filename_rename.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/27" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -52,7 +52,7 @@ This rule identifies file name patterns generated by the use of SDelete utility risk_score = 21 rule_id = "5aee924b-6ceb-4633-980e-1bde8cdb40c5" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Impact", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -79,3 +79,17 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1485" +name = "Data Destruction" +reference = "https://attack.mitre.org/techniques/T1485/" + + +[rule.threat.tactic] +id = "TA0040" +name = "Impact" +reference = "https://attack.mitre.org/tactics/TA0040/" + diff --git a/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml b/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml index 3c6640ade..4c11f503d 100644 --- a/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml +++ b/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -27,7 +27,7 @@ references = [ risk_score = 47 rule_id = "b9960fef-82c6-4816-befa-44745030e917" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -60,6 +60,10 @@ name = "Disable or Modify Tools" reference = "https://attack.mitre.org/techniques/T1562/001/" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml b/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml index d847c63aa..067980346 100644 --- a/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml +++ b/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -28,7 +28,7 @@ references = [ risk_score = 47 rule_id = "8a1d4831-3ce6-4859-9891-28931fa6101d" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -74,11 +74,17 @@ framework = "MITRE ATT&CK" id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" + [[rule.threat.technique.subtechnique]] id = "T1059.001" name = "PowerShell" reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + [rule.threat.tactic] diff --git a/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml b/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml index 312e75f48..faba440c8 100644 --- a/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml +++ b/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -30,7 +30,7 @@ sequence by process.entity_id with maxspan=5m process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe", "dllhost.exe", "cmstp.exe")] [file where host.os.type == "windows" and event.type != "deletion" and file.name : ("wscript.exe.log", - "cscript.exe", + "cscript.exe.log", "mshta.exe.log", "wmic.exe.log", "svchost.exe.log", diff --git a/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml b/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml index 35c16deba..eb411b70d 100644 --- a/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml +++ b/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/06/29" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -109,7 +109,7 @@ references = [ risk_score = 73 rule_id = "2dd480be-1263-4d9c-8672-172928f6789a" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Sysmon Only"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" type = "eql" @@ -150,3 +150,17 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_suspicious_scrobj_load.toml b/rules/windows/defense_evasion_suspicious_scrobj_load.toml index ed257d4d9..492c42905 100644 --- a/rules/windows/defense_evasion_suspicious_scrobj_load.toml +++ b/rules/windows/defense_evasion_suspicious_scrobj_load.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -57,6 +57,11 @@ id = "T1218" name = "System Binary Proxy Execution" reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.010" +name = "Regsvr32" +reference = "https://attack.mitre.org/techniques/T1218/010/" + [rule.threat.tactic] id = "TA0005" diff --git a/rules/windows/defense_evasion_suspicious_wmi_script.toml b/rules/windows/defense_evasion_suspicious_wmi_script.toml index 5fdac9e42..a705510e2 100644 --- a/rules/windows/defense_evasion_suspicious_wmi_script.toml +++ b/rules/windows/defense_evasion_suspicious_wmi_script.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ name = "Suspicious WMIC XSL Script Execution" risk_score = 47 rule_id = "7f370d54-c0eb-4270-ac5a-9a6020585dc6" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -47,3 +47,16 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_suspicious_zoom_child_process.toml b/rules/windows/defense_evasion_suspicious_zoom_child_process.toml index 2406aaa28..df0074f11 100644 --- a/rules/windows/defense_evasion_suspicious_zoom_child_process.toml +++ b/rules/windows/defense_evasion_suspicious_zoom_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/27" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -97,7 +97,7 @@ This rule identifies a potential malicious process masquerading as `Zoom.exe` or risk_score = 47 rule_id = "97aba1ef-6034-4bd3-8c1a-1e0996b27afa" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -125,3 +125,15 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1203" +name = "Exploitation for Client Execution" +reference = "https://attack.mitre.org/techniques/T1203/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" diff --git a/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml b/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml index f9fa390e8..3799568ad 100644 --- a/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml +++ b/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -105,6 +105,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -140,3 +141,16 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1203" +name = "Exploitation for Client Execution" +reference = "https://attack.mitre.org/techniques/T1203/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml b/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml index 4409d1b61..038fbd69b 100644 --- a/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml +++ b/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml @@ -4,7 +4,7 @@ maturity = "production" integration = ["endpoint"] min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.4.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -118,6 +118,16 @@ library where host.os.type == "windows" and [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + [[rule.threat.technique]] id = "T1574" name = "Hijack Execution Flow" diff --git a/rules/windows/defense_evasion_untrusted_driver_loaded.toml b/rules/windows/defense_evasion_untrusted_driver_loaded.toml index 8bc2df3e6..14d4c7a5a 100644 --- a/rules/windows/defense_evasion_untrusted_driver_loaded.toml +++ b/rules/windows/defense_evasion_untrusted_driver_loaded.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [transform] [[transform.osquery]] @@ -109,17 +109,17 @@ driver where host.os.type == "windows" and process.pid == 4 and [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1553" -name = "Subvert Trust Controls" -reference = "https://attack.mitre.org/techniques/T1553/" +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + [[rule.threat.technique.subtechnique]] -id = "T1553.006" -name = "Code Signing Policy Modification" -reference = "https://attack.mitre.org/techniques/T1553/006/" - - +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/discovery_adfind_command_activity.toml b/rules/windows/discovery_adfind_command_activity.toml index 94fc037d5..a777bad7d 100644 --- a/rules/windows/discovery_adfind_command_activity.toml +++ b/rules/windows/discovery_adfind_command_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -117,6 +117,10 @@ id = "T1482" name = "Domain Trust Discovery" reference = "https://attack.mitre.org/techniques/T1482/" +[[rule.threat.technique]] +id = "T1016" +name = "System Network Configuration Discovery" +reference = "https://attack.mitre.org/techniques/T1016/" [rule.threat.tactic] id = "TA0007" diff --git a/rules/windows/discovery_command_system_account.toml b/rules/windows/discovery_command_system_account.toml index 276c86291..ae778005c 100644 --- a/rules/windows/discovery_command_system_account.toml +++ b/rules/windows/discovery_command_system_account.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -53,7 +53,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "2856446a-34e6-435b-9fb5-f8f040bfa7ed" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -79,3 +79,21 @@ id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" +[[rule.threat.technique.subtechnique]] +id = "T1078.003" +name = "Local Accounts" +reference = "https://attack.mitre.org/techniques/T1078/003/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/discovery_posh_invoke_sharefinder.toml b/rules/windows/discovery_posh_invoke_sharefinder.toml index 3a9dfda52..48a0bfc64 100644 --- a/rules/windows/discovery_posh_invoke_sharefinder.toml +++ b/rules/windows/discovery_posh_invoke_sharefinder.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -77,7 +77,7 @@ references = [ risk_score = 47 rule_id = "4c59cff1-b78a-41b8-a9f1-4231984d1fb6" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" type = "query" @@ -133,3 +133,16 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1039" +name = "Data from Network Shared Drive" +reference = "https://attack.mitre.org/techniques/T1039/" + +[rule.threat.tactic] +id = "TA0009" +name = "Collection" +reference = "https://attack.mitre.org/tactics/TA0009/" + diff --git a/rules/windows/discovery_posh_suspicious_api_functions.toml b/rules/windows/discovery_posh_suspicious_api_functions.toml index fc16b4a71..f401869f5 100644 --- a/rules/windows/discovery_posh_suspicious_api_functions.toml +++ b/rules/windows/discovery_posh_suspicious_api_functions.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/05" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -78,7 +78,7 @@ references = [ risk_score = 47 rule_id = "61ac3638-40a3-44b2-855a-985636ca985e" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" type = "query" @@ -172,3 +172,17 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1039" +name = "Data from Network Shared Drive" +reference = "https://attack.mitre.org/techniques/T1039/" + +[rule.threat.tactic] +id = "TA0009" +name = "Collection" +reference = "https://attack.mitre.org/tactics/TA0009/" + diff --git a/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml b/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml index 7f0913897..f30c90402 100644 --- a/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml +++ b/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -28,7 +28,7 @@ references = [ risk_score = 47 rule_id = "d72e33fc-6e91-42ff-ac8b-e573268c5a87" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -52,6 +52,16 @@ id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + [rule.threat.tactic] id = "TA0002" diff --git a/rules/windows/execution_command_shell_via_rundll32.toml b/rules/windows/execution_command_shell_via_rundll32.toml index 8f63f159e..d8b003529 100644 --- a/rules/windows/execution_command_shell_via_rundll32.toml +++ b/rules/windows/execution_command_shell_via_rundll32.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -22,7 +22,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "9ccf3ce0-0057-440a-91f5-870c6ad39093" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Credential Access", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -70,3 +70,22 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.011" +name = "Rundll32" +reference = "https://attack.mitre.org/techniques/T1218/011/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/execution_posh_portable_executable.toml b/rules/windows/execution_posh_portable_executable.toml index aaf299a29..41224433b 100644 --- a/rules/windows/execution_posh_portable_executable.toml +++ b/rules/windows/execution_posh_portable_executable.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -125,7 +125,7 @@ references = [ risk_score = 47 rule_id = "ad84d445-b1ce-4377-82d9-7c633f28bf9a" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" type = "query" @@ -155,3 +155,16 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1055" +name = "Process Injection" +reference = "https://attack.mitre.org/techniques/T1055/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/execution_psexec_lateral_movement_command.toml b/rules/windows/execution_psexec_lateral_movement_command.toml index f1ff0df28..b927a906c 100644 --- a/rules/windows/execution_psexec_lateral_movement_command.toml +++ b/rules/windows/execution_psexec_lateral_movement_command.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -58,7 +58,7 @@ This rule identifies PsExec execution by looking for the creation of `PsExec.exe risk_score = 21 rule_id = "55d551c6-333b-4665-ab7e-5d14a59715ce" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Lateral Movement", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -98,6 +98,21 @@ reference = "https://attack.mitre.org/tactics/TA0002/" [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1021" +name = "Remote Services" +reference = "https://attack.mitre.org/techniques/T1021/" + +[[rule.threat.technique.subtechnique]] +id = "T1021.002" +name = "SMB/Windows Admin Shares" +reference = "https://attack.mitre.org/techniques/T1021/002/" + +[[rule.threat.technique]] +id = "T1570" +name = "Lateral Tool Transfer" +reference = "https://attack.mitre.org/techniques/T1570/" + [rule.threat.tactic] id = "TA0008" name = "Lateral Movement" diff --git a/rules/windows/execution_register_server_program_connecting_to_the_internet.toml b/rules/windows/execution_register_server_program_connecting_to_the_internet.toml index 7859246f9..467b9abed 100644 --- a/rules/windows/execution_register_server_program_connecting_to_the_internet.toml +++ b/rules/windows/execution_register_server_program_connecting_to_the_internet.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -105,7 +105,7 @@ references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana- risk_score = 21 rule_id = "fb02b8d3-71ee-4af1-bacd-215d23f17efa" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -139,6 +139,12 @@ framework = "MITRE ATT&CK" id = "T1218" name = "System Binary Proxy Execution" reference = "https://attack.mitre.org/techniques/T1218/" + +[[rule.threat.technique.subtechnique]] +id = "T1218.009" +name = "Regsvcs/Regasm" +reference = "https://attack.mitre.org/techniques/T1218/009/" + [[rule.threat.technique.subtechnique]] id = "T1218.010" name = "Regsvr32" diff --git a/rules/windows/execution_scheduled_task_powershell_source.toml b/rules/windows/execution_scheduled_task_powershell_source.toml index e0354c190..c70c0b9d0 100644 --- a/rules/windows/execution_scheduled_task_powershell_source.toml +++ b/rules/windows/execution_scheduled_task_powershell_source.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -45,6 +45,14 @@ reference = "https://attack.mitre.org/techniques/T1053/" id = "T1053.005" name = "Scheduled Task" reference = "https://attack.mitre.org/techniques/T1053/005/" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" diff --git a/rules/windows/execution_suspicious_cmd_wmi.toml b/rules/windows/execution_suspicious_cmd_wmi.toml index 200bd74c1..c95d8173d 100644 --- a/rules/windows/execution_suspicious_cmd_wmi.toml +++ b/rules/windows/execution_suspicious_cmd_wmi.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -43,6 +43,16 @@ name = "Windows Management Instrumentation" reference = "https://attack.mitre.org/techniques/T1047/" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + [rule.threat.tactic] id = "TA0002" name = "Execution" diff --git a/rules/windows/execution_suspicious_pdf_reader.toml b/rules/windows/execution_suspicious_pdf_reader.toml index 6513bafd4..df22eab39 100644 --- a/rules/windows/execution_suspicious_pdf_reader.toml +++ b/rules/windows/execution_suspicious_pdf_reader.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -72,7 +72,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "53a26770-9cbd-40c5-8b57-61d01a325e14" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Initial Access", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -96,9 +96,9 @@ process where host.os.type == "windows" and event.type == "start" and [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1204" -name = "User Execution" -reference = "https://attack.mitre.org/techniques/T1204/" +id = "T1203" +name = "Exploitation for Client Execution" +reference = "https://attack.mitre.org/techniques/T1203/" [rule.threat.tactic] @@ -106,3 +106,19 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" +[[rule.threat.technique.subtechnique]] +id = "T1566.001" +name = "Spearphishing Attachment" +reference = "https://attack.mitre.org/techniques/T1566/001/" + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" + diff --git a/rules/windows/execution_suspicious_psexesvc.toml b/rules/windows/execution_suspicious_psexesvc.toml index 6af5bd359..b492e40cd 100644 --- a/rules/windows/execution_suspicious_psexesvc.toml +++ b/rules/windows/execution_suspicious_psexesvc.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/19" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -59,6 +59,7 @@ tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", + "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend" @@ -88,3 +89,22 @@ reference = "https://attack.mitre.org/techniques/T1569/002/" id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.003" +name = "Rename System Utilities" +reference = "https://attack.mitre.org/techniques/T1036/003/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/execution_via_hidden_shell_conhost.toml b/rules/windows/execution_via_hidden_shell_conhost.toml index 73662fe38..edd366feb 100644 --- a/rules/windows/execution_via_hidden_shell_conhost.toml +++ b/rules/windows/execution_via_hidden_shell_conhost.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -75,7 +75,7 @@ references = [ risk_score = 73 rule_id = "05b358de-aa6d-4f6c-89e6-78f74018b43b" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -104,3 +104,29 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1055" +name = "Process Injection" +reference = "https://attack.mitre.org/techniques/T1055/" + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/impact_backup_file_deletion.toml b/rules/windows/impact_backup_file_deletion.toml index a337f558c..1e76aa2a2 100644 --- a/rules/windows/impact_backup_file_deletion.toml +++ b/rules/windows/impact_backup_file_deletion.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -99,6 +99,10 @@ id = "T1490" name = "Inhibit System Recovery" reference = "https://attack.mitre.org/techniques/T1490/" +[[rule.threat.technique]] +id = "T1485" +name = "Data Destruction" +reference = "https://attack.mitre.org/techniques/T1485/" [rule.threat.tactic] id = "TA0040" diff --git a/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml b/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml index 2891f1b5f..4ebd2c224 100644 --- a/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml +++ b/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -81,6 +81,11 @@ id = "T1490" name = "Inhibit System Recovery" reference = "https://attack.mitre.org/techniques/T1490/" +[[rule.threat.technique]] +id = "T1485" +name = "Data Destruction" +reference = "https://attack.mitre.org/techniques/T1485/" + [rule.threat.tactic] id = "TA0040" diff --git a/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml b/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml index 8f26fbd35..a867567c5 100644 --- a/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml +++ b/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic", "Austin Songer"] @@ -86,7 +86,7 @@ references = [ risk_score = 73 rule_id = "d99a037b-c8e2-47a5-97b9-170d076827c4" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -112,3 +112,21 @@ id = "TA0040" name = "Impact" reference = "https://attack.mitre.org/tactics/TA0040/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml b/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml index 2c2d66f71..2bb2c0773 100644 --- a/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml +++ b/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -82,7 +82,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 73 rule_id = "dc9c1f74-dac3-48e3-b47f-eb79db358f57" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -106,3 +106,17 @@ id = "TA0040" name = "Impact" reference = "https://attack.mitre.org/tactics/TA0040/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/initial_access_script_executing_powershell.toml b/rules/windows/initial_access_script_executing_powershell.toml index 2d99fa24f..234b8fa92 100644 --- a/rules/windows/initial_access_script_executing_powershell.toml +++ b/rules/windows/initial_access_script_executing_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -74,7 +74,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -102,3 +102,26 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/initial_access_scripts_process_started_via_wmi.toml b/rules/windows/initial_access_scripts_process_started_via_wmi.toml index d4ae9b815..81d724353 100644 --- a/rules/windows/initial_access_scripts_process_started_via_wmi.toml +++ b/rules/windows/initial_access_scripts_process_started_via_wmi.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -73,8 +73,19 @@ reference = "https://attack.mitre.org/techniques/T1566/001/" id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" + + [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + [[rule.threat.technique]] id = "T1047" name = "Windows Management Instrumentation" diff --git a/rules/windows/initial_access_suspicious_ms_exchange_files.toml b/rules/windows/initial_access_suspicious_ms_exchange_files.toml index b182c3798..f6a39b5da 100644 --- a/rules/windows/initial_access_suspicious_ms_exchange_files.toml +++ b/rules/windows/initial_access_suspicious_ms_exchange_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic", "Austin Songer"] @@ -48,7 +48,7 @@ references = [ risk_score = 47 rule_id = "6cd1779c-560f-4b68-a8f1-11009b27fe63" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -83,3 +83,17 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/windows/initial_access_suspicious_ms_exchange_process.toml b/rules/windows/initial_access_suspicious_ms_exchange_process.toml index 55f3ebb97..bc7dc8ea9 100644 --- a/rules/windows/initial_access_suspicious_ms_exchange_process.toml +++ b/rules/windows/initial_access_suspicious_ms_exchange_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic", "Austin Songer"] @@ -34,7 +34,7 @@ references = [ risk_score = 47 rule_id = "483c4daf-b0c6-49e0-adf3-0bfa93231d6b" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -63,3 +63,16 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + diff --git a/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml b/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml index d82babd8e..12c152718 100644 --- a/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml +++ b/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -29,7 +29,7 @@ references = [ risk_score = 73 rule_id = "f81ee52c-297e-46d9-9205-07e66931df26" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -54,3 +54,24 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/initial_access_suspicious_ms_office_child_process.toml b/rules/windows/initial_access_suspicious_ms_office_child_process.toml index c3fe64e47..02111c6c4 100644 --- a/rules/windows/initial_access_suspicious_ms_office_child_process.toml +++ b/rules/windows/initial_access_suspicious_ms_office_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -73,7 +73,7 @@ references = ["https://www.elastic.co/blog/vulnerability-summary-follina"] risk_score = 47 rule_id = "a624863f-a70d-417f-a7d2-7a404638d47f" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Resources: Investigation Guide", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -113,6 +113,11 @@ framework = "MITRE ATT&CK" id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + [[rule.threat.technique.subtechnique]] id = "T1059.003" name = "Windows Command Shell" @@ -125,3 +130,17 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml b/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml index 74eecceb3..ef12fc96a 100644 --- a/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml +++ b/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -71,7 +71,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "32f4675e-6c49-4ace-80f9-97c9259dca2e" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -107,3 +107,40 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml b/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml index 5480ac86f..ea425854c 100644 --- a/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml +++ b/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -68,3 +68,44 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/lateral_movement_dcom_mmc20.toml b/rules/windows/lateral_movement_dcom_mmc20.toml index fb5bcd72d..5f3769ce7 100644 --- a/rules/windows/lateral_movement_dcom_mmc20.toml +++ b/rules/windows/lateral_movement_dcom_mmc20.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -22,7 +22,7 @@ references = ["https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20 risk_score = 73 rule_id = "51ce96fb-9e52-4dad-b0ba-99b54440fc9a" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -54,3 +54,21 @@ id = "TA0008" name = "Lateral Movement" reference = "https://attack.mitre.org/tactics/TA0008/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + +[[rule.threat.technique.subtechnique]] +id = "T1218.014" +name = "MMC" +reference = "https://attack.mitre.org/techniques/T1218/014/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml b/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml index cc750c16e..b21e1579f 100644 --- a/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml +++ b/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ references = [ risk_score = 47 rule_id = "ddab1f5f-7089-44f5-9fda-de5b11322e77" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -55,3 +55,15 @@ id = "TA0008" name = "Lateral Movement" reference = "https://attack.mitre.org/tactics/TA0008/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/lateral_movement_evasion_rdp_shadowing.toml b/rules/windows/lateral_movement_evasion_rdp_shadowing.toml index de21c911e..780ae50e0 100644 --- a/rules/windows/lateral_movement_evasion_rdp_shadowing.toml +++ b/rules/windows/lateral_movement_evasion_rdp_shadowing.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -60,6 +60,10 @@ id = "T1021" name = "Remote Services" reference = "https://attack.mitre.org/techniques/T1021/" +[[rule.threat.technique.subtechnique]] +id = "T1021.001" +name = "Remote Desktop Protocol" +reference = "https://attack.mitre.org/techniques/T1021/001/" [rule.threat.tactic] id = "TA0008" diff --git a/rules/windows/lateral_movement_execution_from_tsclient_mup.toml b/rules/windows/lateral_movement_execution_from_tsclient_mup.toml index c3a97f752..994c3847c 100644 --- a/rules/windows/lateral_movement_execution_from_tsclient_mup.toml +++ b/rules/windows/lateral_movement_execution_from_tsclient_mup.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -41,6 +41,11 @@ id = "T1021" name = "Remote Services" reference = "https://attack.mitre.org/techniques/T1021/" +[[rule.threat.technique.subtechnique]] +id = "T1021.001" +name = "Remote Desktop Protocol" +reference = "https://attack.mitre.org/techniques/T1021/001/" + [rule.threat.tactic] id = "TA0008" diff --git a/rules/windows/lateral_movement_incoming_wmi.toml b/rules/windows/lateral_movement_incoming_wmi.toml index d501b1180..51261d09f 100644 --- a/rules/windows/lateral_movement_incoming_wmi.toml +++ b/rules/windows/lateral_movement_incoming_wmi.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/30" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -48,6 +48,11 @@ sequence by host.id with maxspan = 2s [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1021" +name = "Remote Services" +reference = "https://attack.mitre.org/techniques/T1021/" + [rule.threat.tactic] id = "TA0008" name = "Lateral Movement" diff --git a/rules/windows/lateral_movement_powershell_remoting_target.toml b/rules/windows/lateral_movement_powershell_remoting_target.toml index 7cb9e6151..0797360cb 100644 --- a/rules/windows/lateral_movement_powershell_remoting_target.toml +++ b/rules/windows/lateral_movement_powershell_remoting_target.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -29,7 +29,7 @@ references = [ risk_score = 47 rule_id = "2772264c-6fb9-4d9d-9014-b416eed21254" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -57,3 +57,20 @@ id = "TA0008" name = "Lateral Movement" reference = "https://attack.mitre.org/tactics/TA0008/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/lateral_movement_rdp_enabled_registry.toml b/rules/windows/lateral_movement_rdp_enabled_registry.toml index 0dc72a734..faa5a3c01 100644 --- a/rules/windows/lateral_movement_rdp_enabled_registry.toml +++ b/rules/windows/lateral_movement_rdp_enabled_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -60,7 +60,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "58aa72ca-d968-4f34-b9f7-bea51d75eb50" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -96,3 +96,17 @@ id = "TA0008" name = "Lateral Movement" reference = "https://attack.mitre.org/tactics/TA0008/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml b/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml index 07464fa4d..c53b798a8 100644 --- a/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml +++ b/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -57,6 +57,10 @@ id = "T1021" name = "Remote Services" reference = "https://attack.mitre.org/techniques/T1021/" +[[rule.threat.technique.subtechnique]] +id = "T1021.001" +name = "Remote Desktop Protocol" +reference = "https://attack.mitre.org/techniques/T1021/001/" [rule.threat.tactic] id = "TA0008" diff --git a/rules/windows/initial_access_unusual_dns_service_children.toml b/rules/windows/lateral_movement_unusual_dns_service_children.toml similarity index 93% rename from rules/windows/initial_access_unusual_dns_service_children.toml rename to rules/windows/lateral_movement_unusual_dns_service_children.toml index 4318c3153..9b28a2b7b 100644 --- a/rules/windows/initial_access_unusual_dns_service_children.toml +++ b/rules/windows/lateral_movement_unusual_dns_service_children.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -73,7 +73,7 @@ references = [ risk_score = 73 rule_id = "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -86,13 +86,13 @@ process where host.os.type == "windows" and event.type == "start" and process.pa [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1133" -name = "External Remote Services" -reference = "https://attack.mitre.org/techniques/T1133/" +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" [rule.threat.tactic] -id = "TA0001" -name = "Initial Access" -reference = "https://attack.mitre.org/tactics/TA0001/" +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" diff --git a/rules/windows/initial_access_unusual_dns_service_file_writes.toml b/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml similarity index 87% rename from rules/windows/initial_access_unusual_dns_service_file_writes.toml rename to rules/windows/lateral_movement_unusual_dns_service_file_writes.toml index 6d3ec3940..412613f76 100644 --- a/rules/windows/initial_access_unusual_dns_service_file_writes.toml +++ b/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -36,7 +36,7 @@ references = [ risk_score = 73 rule_id = "c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -50,13 +50,13 @@ file where host.os.type == "windows" and process.name : "dns.exe" and event.type [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1133" -name = "External Remote Services" -reference = "https://attack.mitre.org/techniques/T1133/" +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" [rule.threat.tactic] -id = "TA0001" -name = "Initial Access" -reference = "https://attack.mitre.org/tactics/TA0001/" +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" diff --git a/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml b/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml index 7f65fc181..37302511f 100644 --- a/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml +++ b/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -47,6 +47,11 @@ id = "T1021" name = "Remote Services" reference = "https://attack.mitre.org/techniques/T1021/" +[[rule.threat.technique.subtechnique]] +id = "T1021.001" +name = "Remote Desktop Protocol" +reference = "https://attack.mitre.org/techniques/T1021/001/" + [rule.threat.tactic] id = "TA0008" diff --git a/rules/windows/persistence_ad_adminsdholder.toml b/rules/windows/persistence_ad_adminsdholder.toml index 84d4d80bf..222a1d54e 100644 --- a/rules/windows/persistence_ad_adminsdholder.toml +++ b/rules/windows/persistence_ad_adminsdholder.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -39,6 +39,20 @@ event.action:"Directory Service Changes" and event.code:5136 and [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[[rule.threat.technique.subtechnique]] +id = "T1078.002" +name = "Domain Accounts" +reference = "https://attack.mitre.org/techniques/T1078/002/" + +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" [rule.threat.tactic] id = "TA0003" diff --git a/rules/windows/persistence_adobe_hijack_persistence.toml b/rules/windows/persistence_adobe_hijack_persistence.toml index 828e74cc4..1f3ed20a2 100644 --- a/rules/windows/persistence_adobe_hijack_persistence.toml +++ b/rules/windows/persistence_adobe_hijack_persistence.toml @@ -2,7 +2,7 @@ creation_date = "2020/02/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/09" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -121,6 +121,11 @@ id = "T1574.010" name = "Services File Permissions Weakness" reference = "https://attack.mitre.org/techniques/T1574/010/" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + [rule.threat.tactic] diff --git a/rules/windows/persistence_appcertdlls_registry.toml b/rules/windows/persistence_appcertdlls_registry.toml index 63831c0c0..72dec2b5b 100644 --- a/rules/windows/persistence_appcertdlls_registry.toml +++ b/rules/windows/persistence_appcertdlls_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "513f0ffd-b317-4b9c-9494-92ce861f22c7" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -56,3 +56,21 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.009" +name = "AppCert DLLs" +reference = "https://attack.mitre.org/techniques/T1546/009/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/persistence_appinitdlls_registry.toml b/rules/windows/persistence_appinitdlls_registry.toml index 3ced40804..960587be9 100644 --- a/rules/windows/persistence_appinitdlls_registry.toml +++ b/rules/windows/persistence_appinitdlls_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -114,7 +114,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "d0e159cf-73e9-40d1-a9ed-077e3158a855" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -151,3 +151,17 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_evasion_registry_ifeo_injection.toml b/rules/windows/persistence_evasion_registry_ifeo_injection.toml index 69d549c7f..29056cb51 100644 --- a/rules/windows/persistence_evasion_registry_ifeo_injection.toml +++ b/rules/windows/persistence_evasion_registry_ifeo_injection.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -23,7 +23,7 @@ references = [ risk_score = 47 rule_id = "6839c821-011d-43bd-bd5b-acff00257226" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -62,3 +62,17 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml b/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml index 38c69281e..cebf81aa7 100644 --- a/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml +++ b/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml @@ -2,7 +2,7 @@ creation_date = "2021/03/15" integration = ["endpoint"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -98,7 +98,7 @@ Techniques used within malware and by adversaries often leverage the Windows reg risk_score = 73 rule_id = "c8b150f0-0164-475b-a75e-74b47800a9ff" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -143,3 +143,17 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_local_scheduled_task_scripting.toml b/rules/windows/persistence_local_scheduled_task_scripting.toml index 500eedba5..a03739238 100644 --- a/rules/windows/persistence_local_scheduled_task_scripting.toml +++ b/rules/windows/persistence_local_scheduled_task_scripting.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ Decode the base64 encoded Tasks Actions registry value to investigate the task's risk_score = 47 rule_id = "689b9d57-e4d5-4357-ad17-9c334609d79a" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -57,3 +57,26 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_ms_office_addins_file.toml b/rules/windows/persistence_ms_office_addins_file.toml index 913adf420..609749d0a 100644 --- a/rules/windows/persistence_ms_office_addins_file.toml +++ b/rules/windows/persistence_ms_office_addins_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -45,6 +45,10 @@ id = "T1137" name = "Office Application Startup" reference = "https://attack.mitre.org/techniques/T1137/" +[[rule.threat.technique.subtechnique]] +id = "T1137.006" +name = "Add-ins" +reference = "https://attack.mitre.org/techniques/T1137/006/" [rule.threat.tactic] id = "TA0003" diff --git a/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml b/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml index fb9abc810..545227894 100644 --- a/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml +++ b/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -29,7 +29,7 @@ references = [ risk_score = 47 rule_id = "ce64d965-6cb0-466d-b74f-8d2c76f47f05" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -57,3 +57,21 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_powershell_profiles.toml b/rules/windows/persistence_powershell_profiles.toml index cd0b863d9..70e0c45d6 100644 --- a/rules/windows/persistence_powershell_profiles.toml +++ b/rules/windows/persistence_powershell_profiles.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ references = [ risk_score = 47 rule_id = "5cf6397e-eb91-4f31-8951-9f0eaa755a31" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -56,3 +56,21 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.013" +name = "PowerShell Profile" +reference = "https://attack.mitre.org/techniques/T1546/013/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/persistence_remote_password_reset.toml b/rules/windows/persistence_remote_password_reset.toml index 38f591fcb..9d20a013b 100644 --- a/rules/windows/persistence_remote_password_reset.toml +++ b/rules/windows/persistence_remote_password_reset.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -27,7 +27,7 @@ references = [ risk_score = 47 rule_id = "2820c9c2-bcd7-4d6e-9eba-faf3891ba450" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Impact"] type = "eql" query = ''' @@ -63,3 +63,16 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1531" +name = "Account Access Removal" +reference = "https://attack.mitre.org/techniques/T1531/" + +[rule.threat.tactic] +id = "TA0040" +name = "Impact" +reference = "https://attack.mitre.org/tactics/TA0040/" + diff --git a/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml b/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml index c4c678d43..3f953637e 100644 --- a/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml +++ b/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -107,6 +107,21 @@ any where event.action == "Directory Service Changes" and [[rule.threat]] framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1078" +name = "Valid Accounts" +reference = "https://attack.mitre.org/techniques/T1078/" + +[[rule.threat.technique.subtechnique]] +id = "T1078.002" +name = "Domain Accounts" +reference = "https://attack.mitre.org/techniques/T1078/002/" + +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + [rule.threat.tactic] id = "TA0003" name = "Persistence" diff --git a/rules/windows/persistence_service_dll_unsigned.toml b/rules/windows/persistence_service_dll_unsigned.toml index b804a3f1d..a8fc49975 100644 --- a/rules/windows/persistence_service_dll_unsigned.toml +++ b/rules/windows/persistence_service_dll_unsigned.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: dll.Ext.relative_file_creation_time is populated in Elastic Endpoint 8.4 and above." min_stack_version = "8.4.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ name = "Unsigned DLL Loaded by Svchost" risk_score = 47 rule_id = "78ef0c95-9dc2-40ac-a8da-5deb6293a14e" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -136,3 +136,39 @@ reference = "https://attack.mitre.org/techniques/T1543/003/" id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1569" +name = "System Services" +reference = "https://attack.mitre.org/techniques/T1569/" +[[rule.threat.technique.subtechnique]] +id = "T1569.002" +name = "Service Execution" +reference = "https://attack.mitre.org/techniques/T1569/002/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_services_registry.toml b/rules/windows/persistence_services_registry.toml index 944b61097..d8ea0fead 100644 --- a/rules/windows/persistence_services_registry.toml +++ b/rules/windows/persistence_services_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -21,7 +21,7 @@ name = "Unusual Persistence via Services Registry" risk_score = 21 rule_id = "403ef0d3-8259-40c9-a5b6-d48354712e49" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -68,3 +68,17 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml b/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml index 6f17aeffa..49de81629 100644 --- a/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml +++ b/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/29" integration = ["endpoint"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -102,7 +102,7 @@ This rule looks for unsigned processes writing to the Startup folder locations. risk_score = 47 rule_id = "2fba96c0-ade5-4bce-b92f-a5df2509da3f" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -141,3 +141,20 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_suspicious_com_hijack_registry.toml b/rules/windows/persistence_suspicious_com_hijack_registry.toml index 7c674e40b..dce2120fe 100644 --- a/rules/windows/persistence_suspicious_com_hijack_registry.toml +++ b/rules/windows/persistence_suspicious_com_hijack_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -69,7 +69,7 @@ references = [ risk_score = 47 rule_id = "16a52c14-7883-47af-8745-9357803f0d4c" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Tactic: Privilege Escalation","Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -136,3 +136,35 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.015" +name = "Component Object Model Hijacking" +reference = "https://attack.mitre.org/techniques/T1546/015/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml b/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml index 2fc8a1533..8cd918bf0 100644 --- a/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml +++ b/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -30,7 +30,7 @@ references = [ risk_score = 21 rule_id = "baa5d22c-5e1c-4f33-bfc9-efa73bb53022" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -49,9 +49,32 @@ id = "T1053" name = "Scheduled Task/Job" reference = "https://attack.mitre.org/techniques/T1053/" +[[rule.threat.technique.subtechnique]] +id = "T1053.005" +name = "Scheduled Task" +reference = "https://attack.mitre.org/techniques/T1053/005/" + [rule.threat.tactic] id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" + +[[rule.threat.technique.subtechnique]] +id = "T1053.005" +name = "Scheduled Task" +reference = "https://attack.mitre.org/techniques/T1053/005/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_suspicious_scheduled_task_runtime.toml b/rules/windows/persistence_suspicious_scheduled_task_runtime.toml index 254b888a7..2a096d963 100644 --- a/rules/windows/persistence_suspicious_scheduled_task_runtime.toml +++ b/rules/windows/persistence_suspicious_scheduled_task_runtime.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -22,7 +22,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "5d1d6907-0747-4d5d-9b24-e4a18853dc0a" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -86,3 +86,20 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" +[[rule.threat.technique.subtechnique]] +id = "T1053.005" +name = "Scheduled Task" +reference = "https://attack.mitre.org/techniques/T1053/005/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_suspicious_service_created_registry.toml b/rules/windows/persistence_suspicious_service_created_registry.toml index 3974595f2..6e3985eeb 100644 --- a/rules/windows/persistence_suspicious_service_created_registry.toml +++ b/rules/windows/persistence_suspicious_service_created_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ name = "Suspicious ImagePath Service Creation" risk_score = 73 rule_id = "36a8e048-d888-4f61-a8b9-0f9e2e40f317" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -52,3 +52,17 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_system_shells_via_services.toml b/rules/windows/persistence_system_shells_via_services.toml index 2efaab779..c348ba669 100644 --- a/rules/windows/persistence_system_shells_via_services.toml +++ b/rules/windows/persistence_system_shells_via_services.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -81,7 +81,7 @@ This rule looks for system shells being spawned by `services.exe`, which is comp risk_score = 47 rule_id = "0022d47d-39c7-4f69-a232-4fe9dc7a3acd" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -113,3 +113,25 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_temp_scheduled_task.toml b/rules/windows/persistence_temp_scheduled_task.toml index 518de3a8f..233359c3c 100644 --- a/rules/windows/persistence_temp_scheduled_task.toml +++ b/rules/windows/persistence_temp_scheduled_task.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -22,7 +22,7 @@ references = ["https://docs.microsoft.com/en-us/windows/security/threat-protecti risk_score = 47 rule_id = "81ff45f8-f8c2-4e28-992e-5a0e8d98e0fe" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution"] type = "eql" query = ''' @@ -48,3 +48,22 @@ reference = "https://attack.mitre.org/techniques/T1053/005/" id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" + +[[rule.threat.technique.subtechnique]] +id = "T1053.005" +name = "Scheduled Task" +reference = "https://attack.mitre.org/techniques/T1053/005/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_time_provider_mod.toml b/rules/windows/persistence_time_provider_mod.toml index d49142aa7..80c4a7584 100644 --- a/rules/windows/persistence_time_provider_mod.toml +++ b/rules/windows/persistence_time_provider_mod.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -23,7 +23,7 @@ references = ["https://pentestlab.blog/2019/10/22/persistence-time-providers/"] risk_score = 47 rule_id = "14ed1aa9-ebfd-4cf9-a463-0ac59ec55204" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -55,3 +55,21 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1547" +name = "Boot or Logon Autostart Execution" +reference = "https://attack.mitre.org/techniques/T1547/" +[[rule.threat.technique.subtechnique]] +id = "T1547.003" +name = "Time Providers" +reference = "https://attack.mitre.org/techniques/T1547/003/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/persistence_via_hidden_run_key_valuename.toml b/rules/windows/persistence_via_hidden_run_key_valuename.toml index b446c1dcc..fa2729dfe 100644 --- a/rules/windows/persistence_via_hidden_run_key_valuename.toml +++ b/rules/windows/persistence_via_hidden_run_key_valuename.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -28,7 +28,7 @@ references = [ risk_score = 73 rule_id = "a9b05c3b-b304-4bf9-970d-acdfaef2944c" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -68,3 +68,30 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1106" +name = "Native API" +reference = "https://attack.mitre.org/techniques/T1106/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_via_lsa_security_support_provider_registry.toml b/rules/windows/persistence_via_lsa_security_support_provider_registry.toml index 298e218f7..82aab40b7 100644 --- a/rules/windows/persistence_via_lsa_security_support_provider_registry.toml +++ b/rules/windows/persistence_via_lsa_security_support_provider_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "e86da94d-e54b-4fb5-b96c-cecff87e8787" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -58,3 +58,17 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml b/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml index d52f34326..f7969871c 100644 --- a/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml +++ b/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -27,7 +27,7 @@ references = [ risk_score = 73 rule_id = "68921d85-d0dc-48b3-865f-43291ca2c4f2" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -55,9 +55,37 @@ name = "Scheduled Task" reference = "https://attack.mitre.org/techniques/T1053/005/" +[[rule.threat.technique]] +id = "T1574" +name = "Hijack Execution Flow" +reference = "https://attack.mitre.org/techniques/T1574/" [rule.threat.tactic] id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" +[[rule.threat.technique.subtechnique]] +id = "T1053.005" +name = "Scheduled Task" +reference = "https://attack.mitre.org/techniques/T1053/005/" + +[[rule.threat.technique]] +id = "T1574" +name = "Hijack Execution Flow" +reference = "https://attack.mitre.org/techniques/T1574/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/persistence_via_update_orchestrator_service_hijack.toml b/rules/windows/persistence_via_update_orchestrator_service_hijack.toml index 4be06e372..61e2631be 100644 --- a/rules/windows/persistence_via_update_orchestrator_service_hijack.toml +++ b/rules/windows/persistence_via_update_orchestrator_service_hijack.toml @@ -2,7 +2,7 @@ creation_date = "2020/08/17" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -103,7 +103,7 @@ references = ["https://github.com/irsl/CVE-2020-1313"] risk_score = 73 rule_id = "265db8f5-fc73-4d0d-b434-6483b56372e2" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Use Case: Vulnerability", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Use Case: Vulnerability", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -146,3 +146,21 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1574" +name = "Hijack Execution Flow" +reference = "https://attack.mitre.org/techniques/T1574/" + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml b/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml index 6421c8075..bfe458eb4 100644 --- a/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml +++ b/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -26,7 +26,7 @@ references = ["https://www.elastic.co/security-labs/hunting-for-persistence-usin risk_score = 21 rule_id = "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -56,3 +56,16 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml b/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml index bf7945e96..e8ad07ec0 100644 --- a/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml +++ b/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -97,11 +97,17 @@ reference = "https://attack.mitre.org/tactics/TA0003/" [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + [rule.threat.tactic] id = "TA0002" diff --git a/rules/windows/persistence_webshell_detection.toml b/rules/windows/persistence_webshell_detection.toml index f4b4e59f2..5979782ad 100644 --- a/rules/windows/persistence_webshell_detection.toml +++ b/rules/windows/persistence_webshell_detection.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -75,7 +75,7 @@ references = [ risk_score = 73 rule_id = "2917d495-59bd-4250-b395-c29409b76086" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Initial Access", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -116,3 +116,35 @@ id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/privilege_escalation_credroaming_ldap.toml b/rules/windows/privilege_escalation_credroaming_ldap.toml index ce02a86d7..843b87bf5 100644 --- a/rules/windows/privilege_escalation_credroaming_ldap.toml +++ b/rules/windows/privilege_escalation_credroaming_ldap.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -34,13 +34,6 @@ Audit Policies > DS Access > Audit Directory Service Changes (Success,Failure) ``` - -The above policy does not cover User objects, so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule. -As this specifies the msDS-KeyCredentialLink Attribute GUID, it is expected to be low noise. - -``` -Set-AuditRule -AdObjectPath 'AD:\\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID 5b47d60f-6090-40b2-9f37-2a4de88f3063 -AuditFlags Success -``` """ references = [ "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming", diff --git a/rules/windows/privilege_escalation_disable_uac_registry.toml b/rules/windows/privilege_escalation_disable_uac_registry.toml index 0c2443a2f..b76c05f25 100644 --- a/rules/windows/privilege_escalation_disable_uac_registry.toml +++ b/rules/windows/privilege_escalation_disable_uac_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -125,6 +125,20 @@ id = "T1548.002" name = "Bypass User Account Control" reference = "https://attack.mitre.org/techniques/T1548/002/" +[[rule.threat.technique]] +id = "T1562" +name = "Impair Defenses" +reference = "https://attack.mitre.org/techniques/T1562/" +[[rule.threat.technique.subtechnique]] +id = "T1562.001" +name = "Disable or Modify Tools" +reference = "https://attack.mitre.org/techniques/T1562/001/" + +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + [rule.threat.tactic] @@ -132,3 +146,4 @@ id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/persistence_driver_newterm_imphash.toml b/rules/windows/privilege_escalation_driver_newterm_imphash.toml similarity index 94% rename from rules/windows/persistence_driver_newterm_imphash.toml rename to rules/windows/privilege_escalation_driver_newterm_imphash.toml index e054c70ba..2790a783b 100644 --- a/rules/windows/persistence_driver_newterm_imphash.toml +++ b/rules/windows/privilege_escalation_driver_newterm_imphash.toml @@ -4,7 +4,7 @@ maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" integration = ["endpoint"] -updated_date = "2023/06/22" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -97,7 +97,7 @@ references = ["https://www.elastic.co/kr/security-labs/stopping-vulnerable-drive risk_score = 47 rule_id = "df0fd41e-5590-4965-ad5e-cd079ec22fa9" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "new_terms" @@ -105,6 +105,19 @@ query = ''' event.category:"driver" and host.os.type:windows and event.action:"load" ''' +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + [[rule.threat]] framework = "MITRE ATT&CK" diff --git a/rules/windows/persistence_gpo_schtask_service_creation.toml b/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml similarity index 77% rename from rules/windows/persistence_gpo_schtask_service_creation.toml rename to rules/windows/privilege_escalation_gpo_schtask_service_creation.toml index 43f70f536..6e62e5ee1 100644 --- a/rules/windows/persistence_gpo_schtask_service_creation.toml +++ b/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 21 rule_id = "c0429aa8-9974-42da-bfb6-53a0a515a145" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -37,6 +37,24 @@ file where host.os.type == "windows" and event.type != "deletion" and ''' +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1484" +name = "Domain Policy Modification" +reference = "https://attack.mitre.org/techniques/T1484/" +[[rule.threat.technique.subtechnique]] +id = "T1484.001" +name = "Group Policy Modification" +reference = "https://attack.mitre.org/techniques/T1484/001/" + + + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] diff --git a/rules/windows/privilege_escalation_group_policy_scheduled_task.toml b/rules/windows/privilege_escalation_group_policy_scheduled_task.toml index 65122c94e..93ef369f0 100644 --- a/rules/windows/privilege_escalation_group_policy_scheduled_task.toml +++ b/rules/windows/privilege_escalation_group_policy_scheduled_task.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -92,6 +92,7 @@ tags = [ "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", + "Tactic: Lateral Movement", "Data Source: Active Directory", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring" @@ -136,3 +137,16 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1570" +name = "Lateral Tool Transfer" +reference = "https://attack.mitre.org/techniques/T1570/" + + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" diff --git a/rules/windows/privilege_escalation_persistence_phantom_dll.toml b/rules/windows/privilege_escalation_persistence_phantom_dll.toml index 8584c18b3..0ab4f2557 100644 --- a/rules/windows/privilege_escalation_persistence_phantom_dll.toml +++ b/rules/windows/privilege_escalation_persistence_phantom_dll.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -79,6 +79,7 @@ tags = [ "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", + "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend" @@ -147,3 +148,20 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/privilege_escalation_port_monitor_print_pocessor_abuse.toml b/rules/windows/privilege_escalation_port_monitor_print_pocessor_abuse.toml index 3eec687db..34eefb678 100644 --- a/rules/windows/privilege_escalation_port_monitor_print_pocessor_abuse.toml +++ b/rules/windows/privilege_escalation_port_monitor_print_pocessor_abuse.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -49,6 +49,10 @@ reference = "https://attack.mitre.org/techniques/T1547/" id = "T1547.010" name = "Port Monitors" reference = "https://attack.mitre.org/techniques/T1547/010/" +[[rule.threat.technique.subtechnique]] +id = "T1547.012" +name = "Print Processors" +reference = "https://attack.mitre.org/techniques/T1547/012/" @@ -66,6 +70,10 @@ reference = "https://attack.mitre.org/techniques/T1547/" id = "T1547.010" name = "Port Monitors" reference = "https://attack.mitre.org/techniques/T1547/010/" +[[rule.threat.technique.subtechnique]] +id = "T1547.012" +name = "Print Processors" +reference = "https://attack.mitre.org/techniques/T1547/012/" diff --git a/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml b/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml index d0c82fae2..74b137c45 100644 --- a/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml +++ b/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -45,6 +45,12 @@ iam where event.action == "renamed-user-account" and [[rule.threat]] framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + [[rule.threat.technique]] id = "T1078" name = "Valid Accounts" diff --git a/rules/windows/privilege_escalation_service_control_spawned_script_int.toml b/rules/windows/privilege_escalation_service_control_spawned_script_int.toml index 401d9f403..f4c96fc02 100644 --- a/rules/windows/privilege_escalation_service_control_spawned_script_int.toml +++ b/rules/windows/privilege_escalation_service_control_spawned_script_int.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/03/30" +updated_date = "2023/10/13" [transform] [[transform.osquery]] @@ -80,7 +80,7 @@ The `sc.exe` command line utility is used to manage and control Windows services risk_score = 21 rule_id = "e8571d5f-bea1-46c2-9f56-998de2d3ed95" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -112,3 +112,59 @@ reference = "https://attack.mitre.org/techniques/T1543/003/" id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" +[[rule.threat.technique.subtechnique]] +id = "T1059.005" +name = "Visual Basic" +reference = "https://attack.mitre.org/techniques/T1059/005/" + + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + +[[rule.threat.technique.subtechnique]] +id = "T1218.010" +name = "Regsvr32" +reference = "https://attack.mitre.org/techniques/T1218/010/" + +[[rule.threat.technique.subtechnique]] +id = "T1218.011" +name = "Rundll32" +reference = "https://attack.mitre.org/techniques/T1218/011/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml b/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml index c96350245..bd0c2d26d 100644 --- a/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml +++ b/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ references = ["https://github.com/hfiref0x/UACME"] risk_score = 73 rule_id = "b90cdde7-7e0d-4359-8bf0-2c112ce2008a" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -55,3 +55,39 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1559" +name = "Inter-Process Communication" +reference = "https://attack.mitre.org/techniques/T1559/" +[[rule.threat.technique.subtechnique]] +id = "T1559.001" +name = "Component Object Model" +reference = "https://attack.mitre.org/techniques/T1559/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml b/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml index 1461ff449..3624ac9cd 100644 --- a/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml +++ b/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ references = ["https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comaut risk_score = 47 rule_id = "fc7c0fa4-8f03-4b3e-8336-c5feab0be022" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -57,3 +57,38 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1559" +name = "Inter-Process Communication" +reference = "https://attack.mitre.org/techniques/T1559/" +[[rule.threat.technique.subtechnique]] +id = "T1559.001" +name = "Component Object Model" +reference = "https://attack.mitre.org/techniques/T1559/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" diff --git a/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml b/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml index 30d80950e..8822c6948 100644 --- a/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml +++ b/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 73 rule_id = "68d56fdc-7ffa-4419-8e95-81641bd6f845" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -54,3 +54,39 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1559" +name = "Inter-Process Communication" +reference = "https://attack.mitre.org/techniques/T1559/" +[[rule.threat.technique.subtechnique]] +id = "T1559.001" +name = "Component Object Model" +reference = "https://attack.mitre.org/techniques/T1559/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml b/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml index 8905231cf..17570ad8f 100644 --- a/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml +++ b/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,7 +24,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "1dcc51f6-ba26-49e7-9ef4-2655abb2361e" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -55,3 +55,39 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1053" +name = "Scheduled Task/Job" +reference = "https://attack.mitre.org/techniques/T1053/" +[[rule.threat.technique.subtechnique]] +id = "T1053.005" +name = "Scheduled Task" +reference = "https://attack.mitre.org/techniques/T1053/005/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml b/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml index 62990a8da..6fd7e060d 100644 --- a/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml +++ b/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -28,7 +28,7 @@ references = [ risk_score = 73 rule_id = "5a14d01d-7ac8-4545-914c-b687c2cf66b3" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -59,3 +59,30 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" +[[rule.threat.technique]] +id = "T1574" +name = "Hijack Execution Flow" +reference = "https://attack.mitre.org/techniques/T1574/" +[[rule.threat.technique.subtechnique]] +id = "T1574.002" +name = "DLL Side-Loading" +reference = "https://attack.mitre.org/techniques/T1574/002/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + + diff --git a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml b/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml index a2bd79e87..b4e1ddff8 100644 --- a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml +++ b/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml @@ -2,7 +2,7 @@ creation_date = "2020/03/17" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -104,7 +104,7 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 73 rule_id = "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -137,3 +137,21 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml b/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml index 373f0afff..17a963c3e 100644 --- a/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml +++ b/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml @@ -2,7 +2,7 @@ creation_date = "2020/10/26" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -104,7 +104,7 @@ references = ["https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted risk_score = 73 rule_id = "290aca65-e94d-403b-ba0f-62f320e63f51" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -132,3 +132,30 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" + +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml b/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml index 1e27cd45f..ece0b2861 100644 --- a/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml +++ b/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml @@ -2,7 +2,7 @@ creation_date = "2020/10/14" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/13" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -104,7 +104,7 @@ references = ["https://github.com/AzAgarampur/byeintegrity-uac"] risk_score = 47 rule_id = "1178ae09-5aff-460a-9f2f-455cd0ac4d8e" severity = "medium" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" @@ -135,3 +135,30 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" +[[rule.threat.technique.subtechnique]] +id = "T1548.002" +name = "Bypass User Account Control" +reference = "https://attack.mitre.org/techniques/T1548/002/" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + +[[rule.threat.technique.subtechnique]] +id = "T1218.014" +name = "MMC" +reference = "https://attack.mitre.org/techniques/T1218/014/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/privilege_escalation_uac_sdclt.toml b/rules/windows/privilege_escalation_uac_sdclt.toml index 98ad29923..afae84230 100644 --- a/rules/windows/privilege_escalation_uac_sdclt.toml +++ b/rules/windows/privilege_escalation_uac_sdclt.toml @@ -2,7 +2,7 @@ creation_date = "2020/09/02" integration = ["endpoint", "windows"] maturity = "development" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,7 +18,7 @@ name = "Bypass UAC via Sdclt" risk_score = 73 rule_id = "9b54e002-034a-47ac-9307-ad12c03fa900" severity = "high" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] type = "eql" query = ''' @@ -58,3 +58,21 @@ id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + +[[rule.threat.technique.subtechnique]] +id = "T1218.014" +name = "MMC" +reference = "https://attack.mitre.org/techniques/T1218/014/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml b/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml index 35b082e58..13c2b0948 100644 --- a/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml +++ b/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -76,6 +76,10 @@ framework = "MITRE ATT&CK" id = "T1055" name = "Process Injection" reference = "https://attack.mitre.org/techniques/T1055/" +[[rule.threat.technique.subtechnique]] +id = "T1055.012" +name = "Process Hollowing" +reference = "https://attack.mitre.org/techniques/T1055/012/" [rule.threat.tactic] diff --git a/rules_building_block/collection_files_staged_in_recycle_bin_root.toml b/rules_building_block/collection_files_staged_in_recycle_bin_root.toml index ebecc4599..8a810b550 100644 --- a/rules_building_block/collection_files_staged_in_recycle_bin_root.toml +++ b/rules_building_block/collection_files_staged_in_recycle_bin_root.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -40,6 +40,11 @@ id = "T1074" name = "Data Staged" reference = "https://attack.mitre.org/techniques/T1074/" + [[rule.threat.technique.subtechnique]] + id = "T1074.001" + name = "Local Data Staging" + reference = "https://attack.mitre.org/techniques/T1074/001/" + [rule.threat.tactic] id = "TA0009" diff --git a/rules_building_block/credential_access_kirbi_file.toml b/rules_building_block/credential_access_kirbi_file.toml index f8dbf8449..38e0ade1d 100644 --- a/rules_building_block/credential_access_kirbi_file.toml +++ b/rules_building_block/credential_access_kirbi_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -50,21 +50,4 @@ reference = "https://attack.mitre.org/techniques/T1558/" id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" -[[rule.threat]] -framework = "MITRE ATT&CK" -[[rule.threat.technique]] -id = "T1059" -name = "Command and Scripting Interpreter" -reference = "https://attack.mitre.org/techniques/T1059/" -[[rule.threat.technique.subtechnique]] -id = "T1059.001" -name = "PowerShell" -reference = "https://attack.mitre.org/techniques/T1059/001/" - - - -[rule.threat.tactic] -id = "TA0002" -name = "Execution" -reference = "https://attack.mitre.org/tactics/TA0002/" diff --git a/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml b/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml index d7f1350a8..fa20d4a8d 100644 --- a/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml +++ b/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ name = "Binary Content Copy via Cmd.exe" risk_score = 21 rule_id = "53dedd83-1be7-430f-8026-363256395c8b" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend", "Rule Type: BBR"] timestamp_override = "event.ingested" type = "eql" building_block_type = "default" @@ -46,3 +46,21 @@ reference = "https://attack.mitre.org/techniques/T1140/" id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.003" +name = "Windows Command Shell" +reference = "https://attack.mitre.org/techniques/T1059/003/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules_building_block/defense_evasion_communication_apps_suspicious_child_process.toml b/rules_building_block/defense_evasion_communication_apps_suspicious_child_process.toml index bc2845463..5d4f85d2a 100644 --- a/rules_building_block/defense_evasion_communication_apps_suspicious_child_process.toml +++ b/rules_building_block/defense_evasion_communication_apps_suspicious_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/04" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -21,7 +21,7 @@ name = "Suspicious Communication App Child Process" risk_score = 21 rule_id = "adbfa3ee-777e-4747-b6b0-7bd645f30880" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -220,6 +220,16 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [[rule.threat.technique]] id = "T1055" name = "Process Injection" @@ -229,3 +239,16 @@ reference = "https://attack.mitre.org/techniques/T1055/" id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + diff --git a/rules_building_block/defense_evasion_disable_nla.toml b/rules_building_block/defense_evasion_disable_nla.toml index 2ac70df49..c70eaeb8a 100644 --- a/rules_building_block/defense_evasion_disable_nla.toml +++ b/rules_building_block/defense_evasion_disable_nla.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/25" +updated_date = "2023/10/09" bypass_bbr_timing = true [rule] @@ -47,8 +47,14 @@ id = "T1112" name = "Modify Registry" reference = "https://attack.mitre.org/techniques/T1112/" +[[rule.threat.technique]] +id = "T1562" +name = "Impair Defenses" +reference = "https://attack.mitre.org/techniques/T1562/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules_building_block/defense_evasion_masquerading_browsers.toml b/rules_building_block/defense_evasion_masquerading_browsers.toml index 3d8ea3259..70ea4e1dd 100644 --- a/rules_building_block/defense_evasion_masquerading_browsers.toml +++ b/rules_building_block/defense_evasion_masquerading_browsers.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/02" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -22,7 +22,7 @@ name = "Potential Masquerading as Browser Process" risk_score = 21 rule_id = "5b9eb30f-87d6-45f4-9289-2bf2024f0376" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -123,9 +123,31 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + diff --git a/rules_building_block/defense_evasion_masquerading_business_apps_installer.toml b/rules_building_block/defense_evasion_masquerading_business_apps_installer.toml index 4670f9e3a..212f64ad0 100644 --- a/rules_building_block/defense_evasion_masquerading_business_apps_installer.toml +++ b/rules_building_block/defense_evasion_masquerading_business_apps_installer.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/01" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -25,7 +25,7 @@ references = [ risk_score = 21 rule_id = "feafdc51-c575-4ed2-89dd-8e20badc2d6c" severity = "low" -tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Initial Access", "Tactic: Execution", "Rule Type: BBR"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -168,6 +168,16 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [rule.threat.tactic] id = "TA0005" @@ -186,3 +196,22 @@ reference = "https://attack.mitre.org/techniques/T1189/" id = "TA0001" name = "Initial Access" reference = "https://attack.mitre.org/tactics/TA0001/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1204" +name = "User Execution" +reference = "https://attack.mitre.org/techniques/T1204/" +[[rule.threat.technique.subtechnique]] +id = "T1204.002" +name = "Malicious File" +reference = "https://attack.mitre.org/techniques/T1204/002/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules_building_block/defense_evasion_masquerading_communication_apps.toml b/rules_building_block/defense_evasion_masquerading_communication_apps.toml index 12910048e..fe0a3313f 100644 --- a/rules_building_block/defense_evasion_masquerading_communication_apps.toml +++ b/rules_building_block/defense_evasion_masquerading_communication_apps.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/15" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -21,7 +21,7 @@ name = "Potential Masquerading as Communication Apps" risk_score = 21 rule_id = "c9482bfa-a553-4226-8ea2-4959bd4f7923" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -97,9 +97,32 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + diff --git a/rules_building_block/defense_evasion_masquerading_vlc_dll.toml b/rules_building_block/defense_evasion_masquerading_vlc_dll.toml index 7901bbafb..8205d9879 100644 --- a/rules_building_block/defense_evasion_masquerading_vlc_dll.toml +++ b/rules_building_block/defense_evasion_masquerading_vlc_dll.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/09" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -22,7 +22,7 @@ name = "Potential Masquerading as VLC DLL" risk_score = 21 rule_id = "4494c14f-5ff8-4ed2-8e99-bf816a1642fc" severity = "low" -tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -44,9 +44,32 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + diff --git a/rules_building_block/defense_evasion_masquerading_windows_dll.toml b/rules_building_block/defense_evasion_masquerading_windows_dll.toml index fa38a07f8..92f6b61c7 100644 --- a/rules_building_block/defense_evasion_masquerading_windows_dll.toml +++ b/rules_building_block/defense_evasion_masquerading_windows_dll.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/21" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -22,7 +22,7 @@ name = "Potential Masquerading as System32 DLL" risk_score = 21 rule_id = "fb01d790-9f74-4e76-97dd-b4b0f7bf6435" severity = "low" -tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -76,9 +76,47 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + +[[rule.threat.technique]] +id = "T1574" +name = "Hijack Execution Flow" +reference = "https://attack.mitre.org/techniques/T1574/" + +[[rule.threat.technique.subtechnique]] +id = "T1574.001" +name = "DLL Search Order Hijacking" +reference = "https://attack.mitre.org/techniques/T1574/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1574.002" +name = "DLL Side-Loading" +reference = "https://attack.mitre.org/techniques/T1574/002/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + diff --git a/rules_building_block/defense_evasion_masquerading_windows_system32_exe.toml b/rules_building_block/defense_evasion_masquerading_windows_system32_exe.toml index 835f72aef..b844f7db2 100644 --- a/rules_building_block/defense_evasion_masquerading_windows_system32_exe.toml +++ b/rules_building_block/defense_evasion_masquerading_windows_system32_exe.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/20" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -21,7 +21,7 @@ name = "Potential Masquerading as System32 Executable" risk_score = 21 rule_id = "79ce2c96-72f7-44f9-88ef-60fa1ac2ce47" severity = "low" -tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "Data Source: Elastic Defend", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR"] timestamp_override = "event.ingested" building_block_type = "default" type = "eql" @@ -63,9 +63,31 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1554" +name = "Compromise Client Software Binary" +reference = "https://attack.mitre.org/techniques/T1554/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + diff --git a/rules_building_block/defense_evasion_unusual_process_extension.toml b/rules_building_block/defense_evasion_unusual_process_extension.toml index 74f784b76..c02f7114e 100644 --- a/rules_building_block/defense_evasion_unusual_process_extension.toml +++ b/rules_building_block/defense_evasion_unusual_process_extension.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -54,6 +54,11 @@ id = "T1036" name = "Masquerading" reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.008" +name = "Masquerade File Type" +reference = "https://attack.mitre.org/techniques/T1036/008/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" diff --git a/rules_building_block/defense_evasion_write_dac_access.toml b/rules_building_block/defense_evasion_write_dac_access.toml index fb30a9900..771e1703d 100644 --- a/rules_building_block/defense_evasion_write_dac_access.toml +++ b/rules_building_block/defense_evasion_write_dac_access.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/15" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -60,6 +60,11 @@ id = "T1222" reference = "https://attack.mitre.org/techniques/T1222/" name = "File and Directory Permissions Modification" +[[rule.threat.technique.subtechnique]] +id = "T1222.001" +name = "Windows File and Directory Permissions Modification" +reference = "https://attack.mitre.org/techniques/T1222/001/" + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" diff --git a/rules_building_block/discovery_net_share_discovery_winlog.toml b/rules_building_block/discovery_net_share_discovery_winlog.toml index 5e8ec5b6b..027d71212 100644 --- a/rules_building_block/discovery_net_share_discovery_winlog.toml +++ b/rules_building_block/discovery_net_share_discovery_winlog.toml @@ -4,7 +4,7 @@ integration = ["windows", "system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/14" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -21,7 +21,7 @@ name = "Potential Network Share Discovery" risk_score = 21 rule_id = "b2318c71-5959-469a-a3ce-3a0768e63b9c" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Collection", "Rule Type: BBR"] type = "eql" building_block_type = "default" @@ -46,3 +46,17 @@ reference = "https://attack.mitre.org/techniques/T1135/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1039" +name = "Data from Network Shared Drive" +reference = "https://attack.mitre.org/techniques/T1039/" + +[rule.threat.tactic] +id = "TA0009" +name = "Collection" +reference = "https://attack.mitre.org/tactics/TA0009/" + diff --git a/rules_building_block/discovery_net_view.toml b/rules_building_block/discovery_net_view.toml index a4342f266..72f084236 100644 --- a/rules_building_block/discovery_net_view.toml +++ b/rules_building_block/discovery_net_view.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/21" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -55,6 +55,7 @@ tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", + "Tactic: Collection", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", @@ -97,3 +98,18 @@ reference = "https://attack.mitre.org/techniques/T1135/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1039" +name = "Data from Network Shared Drive" +reference = "https://attack.mitre.org/techniques/T1039/" + +[rule.threat.tactic] +id = "TA0009" +name = "Collection" +reference = "https://attack.mitre.org/tactics/TA0009/" + diff --git a/rules_building_block/discovery_posh_password_policy.toml b/rules_building_block/discovery_posh_password_policy.toml index e71108428..0697c6f9e 100644 --- a/rules_building_block/discovery_posh_password_policy.toml +++ b/rules_building_block/discovery_posh_password_policy.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/12" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -39,7 +39,7 @@ reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLo risk_score = 21 rule_id = "fe25d5bc-01fa-494a-95ff-535c29cc4c96" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: PowerShell Logs", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Execution", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" type = "query" building_block_type = "default" @@ -92,3 +92,23 @@ reference = "https://attack.mitre.org/techniques/T1201/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules_building_block/discovery_security_software_wmic.toml b/rules_building_block/discovery_security_software_wmic.toml index 12707e0d3..a94809255 100644 --- a/rules_building_block/discovery_security_software_wmic.toml +++ b/rules_building_block/discovery_security_software_wmic.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/21" +updated_date = "2023/10/09" bypass_bbr_timing = true [rule] @@ -89,3 +89,17 @@ reference = "https://attack.mitre.org/techniques/T1518/001/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules_building_block/execution_unsigned_service_executable.toml b/rules_building_block/execution_unsigned_service_executable.toml index e82422e85..dccb42a8f 100644 --- a/rules_building_block/execution_unsigned_service_executable.toml +++ b/rules_building_block/execution_unsigned_service_executable.toml @@ -26,6 +26,7 @@ tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", + "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend" ] @@ -56,10 +57,27 @@ id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + [rule.new_terms] field = "new_terms_fields" value = ["host.id", "process.executable", "user.id"] [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-14d" +value = "now-14d" \ No newline at end of file diff --git a/rules_building_block/lateral_movement_at.toml b/rules_building_block/lateral_movement_at.toml index d1d595fc4..404196f88 100644 --- a/rules_building_block/lateral_movement_at.toml +++ b/rules_building_block/lateral_movement_at.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/21" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -52,6 +52,11 @@ id = "T1053" name = "Scheduled Task/Job" reference = "https://attack.mitre.org/techniques/T1053/" +[[rule.threat.technique.subtechnique]] +id = "T1053.002" +name = "At" +reference = "https://attack.mitre.org/techniques/T1053/002/" + [[rule.threat.technique.subtechnique]] id = "T1053.005" name = "Scheduled Task" diff --git a/rules_building_block/lateral_movement_posh_winrm_activity.toml b/rules_building_block/lateral_movement_posh_winrm_activity.toml index 8c7359e9f..8f048d831 100644 --- a/rules_building_block/lateral_movement_posh_winrm_activity.toml +++ b/rules_building_block/lateral_movement_posh_winrm_activity.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -44,7 +44,7 @@ references = [ risk_score = 21 rule_id = "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: PowerShell Logs", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Execution", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" type = "query" building_block_type = "default" @@ -82,3 +82,23 @@ reference = "https://attack.mitre.org/techniques/T1021/006/" id = "TA0008" name = "Lateral Movement" reference = "https://attack.mitre.org/tactics/TA0008/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.001" +name = "PowerShell" +reference = "https://attack.mitre.org/techniques/T1059/001/" + + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + diff --git a/rules_building_block/initial_access_unusual_process_sql_accounts.toml b/rules_building_block/lateral_movement_unusual_process_sql_accounts.toml similarity index 82% rename from rules_building_block/initial_access_unusual_process_sql_accounts.toml rename to rules_building_block/lateral_movement_unusual_process_sql_accounts.toml index 80d8aa5b7..b103390f2 100644 --- a/rules_building_block/initial_access_unusual_process_sql_accounts.toml +++ b/rules_building_block/lateral_movement_unusual_process_sql_accounts.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/25" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -25,7 +25,7 @@ references = [ risk_score = 21 rule_id = "e74d645b-fec6-431e-bf93-ca64a538e0de" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Defend", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Persistence", "Data Source: Elastic Defend", "Rule Type: BBR"] timestamp_override = "event.ingested" type = "eql" building_block_type = "default" @@ -54,15 +54,15 @@ process where event.type == "start" and host.os.type == "windows" and [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1190" -name = "Exploit Public-Facing Application" -reference = "https://attack.mitre.org/techniques/T1190/" +id = "T1210" +name = "Exploitation of Remote Services" +reference = "https://attack.mitre.org/techniques/T1210/" [rule.threat.tactic] -id = "TA0001" -name = "Initial Access" -reference = "https://attack.mitre.org/tactics/TA0001/" +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" [[rule.threat]] framework = "MITRE ATT&CK" @@ -72,6 +72,10 @@ id = "T1505" name = "Server Software Component" reference = "https://attack.mitre.org/techniques/T1505/" +[[rule.threat.technique.subtechnique]] +id = "T1505.001" +name = "SQL Stored Procedures" +reference = "https://attack.mitre.org/techniques/T1505/001/" [rule.threat.tactic] id = "TA0003" diff --git a/rules_building_block/lateral_movement_wmic_remote.toml b/rules_building_block/lateral_movement_wmic_remote.toml index fcdef0622..31c7f006a 100644 --- a/rules_building_block/lateral_movement_wmic_remote.toml +++ b/rules_building_block/lateral_movement_wmic_remote.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -42,6 +42,11 @@ id = "T1021" name = "Remote Services" reference = "https://attack.mitre.org/techniques/T1021/" +[[rule.threat.technique.subtechnique]] +id = "T1021.006" +name = "Windows Remote Management" +reference = "https://attack.mitre.org/techniques/T1021/006/" + [rule.threat.tactic] id = "TA0008" name = "Lateral Movement" diff --git a/rules_building_block/persistence_msoffice_startup_registry.toml b/rules_building_block/persistence_msoffice_startup_registry.toml index 456d3ffdf..74eb9aab8 100644 --- a/rules_building_block/persistence_msoffice_startup_registry.toml +++ b/rules_building_block/persistence_msoffice_startup_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ references = [ risk_score = 21 rule_id = "14dab405-5dd9-450c-8106-72951af2391f" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] timestamp_override = "event.ingested" type = "eql" building_block_type = "default" @@ -50,3 +50,16 @@ reference = "https://attack.mitre.org/techniques/T1137/002/" id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1112" +name = "Modify Registry" +reference = "https://attack.mitre.org/techniques/T1112/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules_building_block/privilege_escalation_expired_driver_loaded.toml b/rules_building_block/privilege_escalation_expired_driver_loaded.toml index 43dbc5668..1290427c7 100644 --- a/rules_building_block/privilege_escalation_expired_driver_loaded.toml +++ b/rules_building_block/privilege_escalation_expired_driver_loaded.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/26" +updated_date = "2023/10/13" bypass_bbr_timing = true [rule] @@ -24,7 +24,7 @@ references = [ risk_score = 21 rule_id = "d12bac54-ab2a-4159-933f-d7bcefa7b61d" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" building_block_type = "default" @@ -46,3 +46,22 @@ reference = "https://attack.mitre.org/techniques/T1068/" id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + From 24b0aa5c63f25bbcd1b65ae7f9fc561f119dbad9 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Mon, 16 Oct 2023 17:56:09 +0100 Subject: [PATCH 33/86] [Tuning] Adjusted Rules for Anti-Evasion (#3163) * Update lateral_movement_executable_tool_transfer_smb.toml * Update lateral_movement_incoming_wmi.toml * Update lateral_movement_execution_via_file_shares_sequence.toml * Update lateral_movement_executable_tool_transfer_smb.toml * Update lateral_movement_execution_via_file_shares_sequence.toml * Update lateral_movement_executable_tool_transfer_smb.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- ...l_movement_executable_tool_transfer_smb.toml | 9 +++++---- ...ment_execution_via_file_shares_sequence.toml | 9 +++++---- .../windows/lateral_movement_incoming_wmi.toml | 17 ++++++++++------- 3 files changed, 20 insertions(+), 15 deletions(-) diff --git a/rules/windows/lateral_movement_executable_tool_transfer_smb.toml b/rules/windows/lateral_movement_executable_tool_transfer_smb.toml index 30457f6d7..d245bb01e 100644 --- a/rules/windows/lateral_movement_executable_tool_transfer_smb.toml +++ b/rules/windows/lateral_movement_executable_tool_transfer_smb.toml @@ -1,10 +1,10 @@ [metadata] creation_date = "2020/11/10" -integration = ["endpoint", "windows"] +integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/09" [rule] author = ["Elastic"] @@ -13,7 +13,7 @@ Identifies the creation or change of a Windows executable file over network shar other files between systems in a compromised environment. """ from = "now-9m" -index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"] +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Lateral Tool Transfer via SMB Share" @@ -71,7 +71,8 @@ sequence by host.id with maxspan=30s network.transport == "tcp" and source.ip != "127.0.0.1" and source.ip != "::1" ] by process.entity_id /* add more executable extensions here if they are not noisy in your environment */ - [file where host.os.type == "windows" and event.type in ("creation", "change") and process.pid == 4 and file.extension : ("exe", "dll", "bat", "cmd")] by process.entity_id + [file where host.os.type == "windows" and event.type in ("creation", "change") and process.pid == 4 and + (file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com", "dll"))] by process.entity_id ''' diff --git a/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml b/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml index d5b91b1fd..d610946c8 100644 --- a/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml +++ b/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2020/11/03" -integration = ["endpoint", "windows"] +integration = ["endpoint"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/09" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -39,7 +39,7 @@ Identifies the execution of a file that was created by the virtual system proces via network file shares. """ from = "now-9m" -index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*"] +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Remote Execution via File Shares" @@ -100,7 +100,8 @@ type = "eql" query = ''' sequence with maxspan=1m - [file where host.os.type == "windows" and event.type in ("creation", "change") and process.pid == 4 and file.extension : "exe"] by host.id, file.path + [file where host.os.type == "windows" and event.type in ("creation", "change") and + process.pid == 4 and (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by host.id, file.path [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable ''' diff --git a/rules/windows/lateral_movement_incoming_wmi.toml b/rules/windows/lateral_movement_incoming_wmi.toml index 51261d09f..4be4ea1b6 100644 --- a/rules/windows/lateral_movement_incoming_wmi.toml +++ b/rules/windows/lateral_movement_incoming_wmi.toml @@ -34,13 +34,16 @@ sequence by host.id with maxspan = 2s /* Excluding Common FPs Nessus and SCCM */ - [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "WmiPrvSE.exe" and - not process.args : ("C:\\windows\\temp\\nessus_*.txt", - "*C:\\windows\\TEMP\\nessus_*.TMP*", - "*C:\\Windows\\CCM\\SystemTemp\\*", - "C:\\Windows\\CCM\\ccmrepair.exe", - "C:\\Windows\\CCMCache\\*", - "C:\\CCM\\Cache\\*") + [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "WmiPrvSE.exe" and + not process.Ext.token.integrity_level_name : "system" and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and + not process.executable : + ("?:\\Program Files\\HPWBEM\\Tools\\hpsum_swdiscovery.exe", + "?:\\Windows\\CCM\\Ccm32BitLauncher.exe", + "?:\\Windows\\System32\\wbem\\mofcomp.exe", + "?:\\Windows\\Microsoft.NET\\Framework*\\csc.exe", + "?:\\Windows\\System32\\powercfg.exe") and + not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.args : "REBOOT=ReallySuppress") and + not (process.executable : "?:\\Windows\\System32\\inetsrv\\appcmd.exe" and process.args : "uninstall") ] ''' From a5a606e80486aac9397730e857ca6dd29d5609e6 Mon Sep 17 00:00:00 2001 From: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com> Date: Mon, 16 Oct 2023 12:48:54 -0700 Subject: [PATCH 34/86] [New Rule] Adding DGA Rules from Advanced Analytic DGA Package (#3102) * Adding DGA rules * Adding references * updated rule tags and queries * Updating min stack version * added logic to handle ml jobs * added code comments for clarity * removing subbed security docs folder * added event dataset to queries for endpoint; updated note * removed event dataset --------- Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: terrancedejesus --- detection_rules/integrations.py | 4 +- detection_rules/rule.py | 22 ++++--- ...ml_dga_activity_using_sunburst_domain.toml | 65 +++++++++++++++++++ ...d_control_ml_dga_high_sum_probability.toml | 52 +++++++++++++++ ...l_ml_dns_request_high_dga_probability.toml | 65 +++++++++++++++++++ ..._request_predicted_to_be_a_dga_domain.toml | 65 +++++++++++++++++++ 6 files changed, 262 insertions(+), 11 deletions(-) create mode 100644 rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml create mode 100644 rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml create mode 100644 rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml create mode 100644 rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml diff --git a/detection_rules/integrations.py b/detection_rules/integrations.py index 2c264d051..3c5ae4859 100644 --- a/detection_rules/integrations.py +++ b/detection_rules/integrations.py @@ -335,7 +335,9 @@ def get_integration_schema_data(data, meta, package_integrations: dict) -> Gener if integration is None: # Use all fields from each dataset for dataset in integrations_schemas[package][package_version]: - schema.update(integrations_schemas[package][package_version][dataset]) + # ignore jobs from machine learning packages + if dataset != "jobs": + schema.update(integrations_schemas[package][package_version][dataset]) else: if integration not in integrations_schemas[package][package_version]: raise ValueError(f"Integration {integration} not found in package {package} " diff --git a/detection_rules/rule.py b/detection_rules/rule.py index b7679b9ad..e27b004c8 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -1127,16 +1127,18 @@ class TOMLRuleContents(BaseRuleContents, MarshmallowDataclassMixin): elif isinstance(node, FieldComparison) and str(node.field) == 'event.dataset': datasets.update(set(str(n) for n in node if isinstance(n, kql.ast.Value))) - if not datasets: - # windows and endpoint integration do not have event.dataset fields in queries - # integration is None to remove duplicate references upstream in Kibana - rule_integrations = meta.get("integration", []) - if rule_integrations: - for integration in rule_integrations: - ineligible_integrations = definitions.NON_DATASET_PACKAGES + \ - [*map(str.lower, definitions.MACHINE_LEARNING_PACKAGES)] - if integration in ineligible_integrations or isinstance(data, MachineLearningRuleData): - packaged_integrations.append({"package": integration, "integration": None}) + # integration is None to remove duplicate references upstream in Kibana + # chronologically, event.dataset is checked for package:integration, then rule tags + # if both exist, rule tags are only used if defined in definitions for non-dataset packages + # of machine learning analytic packages + + rule_integrations = meta.get("integration", []) + if rule_integrations: + for integration in rule_integrations: + ineligible_integrations = definitions.NON_DATASET_PACKAGES + \ + [*map(str.lower, definitions.MACHINE_LEARNING_PACKAGES)] + if integration in ineligible_integrations or isinstance(data, MachineLearningRuleData): + packaged_integrations.append({"package": integration, "integration": None}) for value in sorted(datasets): integration = 'Unknown' diff --git a/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml b/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml new file mode 100644 index 000000000..beb987af0 --- /dev/null +++ b/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml @@ -0,0 +1,65 @@ +[metadata] +creation_date = "2023/09/14" +integration = ["dga","endpoint","network_traffic"] +maturity = "production" +min_stack_comments = "DGA package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +author = ["Elastic"] +description = """ +A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is +predicted to be the result of a Domain Generation Algorithm. +""" +from = "now-10m" +index = ["logs-endpoint.events.*", "logs-network_traffic.*"] +language = "kuery" +license = "Elastic License v2" +name = "Machine Learning Detected DGA activity using a known SUNBURST DNS domain" +note = """## Setup + +The Domain Generation Algorithm (DGA) integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/dga" +] +risk_score = 99 +rule_id = "bcaa15ce-2d41-44d7-a322-918f9db77766" +severity = "critical" +tags = [ + "Domain: Network", + "Domain: Endpoint", + "Data Source: Elastic Defend", + "Use Case: Domain Generation Algorithm Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control", +] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +ml_is_dga.malicious_prediction:1 and dns.question.registered_domain:avsvmcloud.com +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1568" +name = "Dynamic Resolution" +reference = "https://attack.mitre.org/techniques/T1568/" +[[rule.threat.technique.subtechnique]] +id = "T1568.002" +name = "Domain Generation Algorithms" +reference = "https://attack.mitre.org/techniques/T1568/002/" + + + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + diff --git a/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml b/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml new file mode 100644 index 000000000..7da14e887 --- /dev/null +++ b/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/09/14" +integration = ["dga","endpoint","network_traffic"] +maturity = "production" +min_stack_comments = "DGA package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +anomaly_threshold = 70 +author = ["Elastic"] +description = """ +A population analysis machine learning job detected potential DGA (domain generation algorithm) activity. Such activity +is often used by malware command and control (C2) channels. This machine learning job looks for a source IP address +making DNS requests that have an aggregate high probability of being DGA activity. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "dga_high_sum_probability" +name = "Potential DGA Activity" +note = """## Setup + +The Domain Generation Algorithm (DGA) integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/dga" +] +risk_score = 21 +rule_id = "ff0d807d-869b-4a0d-a493-52bc46d2f1b1" +severity = "low" +tags = [ + "Use Case: Domain Generation Algorithm Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1568" +name = "Dynamic Resolution" +reference = "https://attack.mitre.org/techniques/T1568/" + + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + diff --git a/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml b/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml new file mode 100644 index 000000000..cc4594266 --- /dev/null +++ b/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml @@ -0,0 +1,65 @@ +[metadata] +creation_date = "2023/09/14" +integration = ["dga","endpoint","network_traffic"] +maturity = "production" +min_stack_comments = "DGA package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +author = ["Elastic"] +description = """ +A supervised machine learning model has identified a DNS question name with a high probability of sourcing from a Domain +Generation Algorithm (DGA), which could indicate command and control network activity. +""" +from = "now-10m" +index = ["logs-endpoint.events.*", "logs-network_traffic.*"] +language = "kuery" +license = "Elastic License v2" +name = "Machine Learning Detected a DNS Request With a High DGA Probability Score" +note = """## Setup + +The Domain Generation Algorithm (DGA) integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/dga" +] +risk_score = 21 +rule_id = "da7f5803-1cd4-42fd-a890-0173ae80ac69" +severity = "low" +tags = [ + "Domain: Network", + "Domain: Endpoint", + "Data Source: Elastic Defend", + "Use Case: Domain Generation Algorithm Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control", +] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +ml_is_dga.malicious_probability > 0.98 +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1568" +name = "Dynamic Resolution" +reference = "https://attack.mitre.org/techniques/T1568/" +[[rule.threat.technique.subtechnique]] +id = "T1568.002" +name = "Domain Generation Algorithms" +reference = "https://attack.mitre.org/techniques/T1568/002/" + + + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + diff --git a/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml b/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml new file mode 100644 index 000000000..680850d32 --- /dev/null +++ b/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml @@ -0,0 +1,65 @@ +[metadata] +creation_date = "2023/09/14" +integration = ["dga","endpoint","network_traffic"] +maturity = "production" +min_stack_comments = "DGA package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +author = ["Elastic"] +description = """ +A supervised machine learning model has identified a DNS question name that is predicted to be the result of a Domain +Generation Algorithm (DGA), which could indicate command and control network activity. +""" +from = "now-10m" +index = ["logs-endpoint.events.*", "logs-network_traffic.*"] +language = "kuery" +license = "Elastic License v2" +name = "Machine Learning Detected a DNS Request Predicted to be a DGA Domain" +note = """## Setup + +The Domain Generation Algorithm (DGA) integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/dga" +] +risk_score = 21 +rule_id = "f3403393-1fd9-4686-8f6e-596c58bc00b4" +severity = "low" +tags = [ + "Domain: Network", + "Domain: Endpoint", + "Data Source: Elastic Defend", + "Use Case: Domain Generation Algorithm Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control", +] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +ml_is_dga.malicious_prediction:1 and not dns.question.registered_domain:avsvmcloud.com +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1568" +name = "Dynamic Resolution" +reference = "https://attack.mitre.org/techniques/T1568/" +[[rule.threat.technique.subtechnique]] +id = "T1568.002" +name = "Domain Generation Algorithms" +reference = "https://attack.mitre.org/techniques/T1568/002/" + + + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + From 82685e36ce5aced311eb54608e93b1d1c7f1f048 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Mon, 16 Oct 2023 17:07:53 -0300 Subject: [PATCH 35/86] [Rule Tuning] Adjust Lucene queries to use Uppercase operators (#3196) --- .../command_and_control_cobalt_strike_beacon.toml | 8 ++++---- .../network/command_and_control_fin7_c2_behavior.toml | 6 +++--- .../network/command_and_control_halfbaked_beacon.toml | 10 +++++----- .../initial_access_unsecure_elasticsearch_node.toml | 6 +++--- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/rules/network/command_and_control_cobalt_strike_beacon.toml b/rules/network/command_and_control_cobalt_strike_beacon.toml index 65f957277..de5520737 100644 --- a/rules/network/command_and_control_cobalt_strike_beacon.toml +++ b/rules/network/command_and_control_cobalt_strike_beacon.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/01" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -40,9 +40,9 @@ timestamp_override = "event.ingested" type = "query" query = ''' -((event.category: (network or network_traffic) and type: (tls or http)) - or event.dataset: (network_traffic.tls or network_traffic.http) -) and destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/ +((event.category: (network OR network_traffic) AND type: (tls OR http)) + OR event.dataset: (network_traffic.tls OR network_traffic.http) +) AND destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/ ''' diff --git a/rules/network/command_and_control_fin7_c2_behavior.toml b/rules/network/command_and_control_fin7_c2_behavior.toml index cda4259e3..0d35fd4ba 100644 --- a/rules/network/command_and_control_fin7_c2_behavior.toml +++ b/rules/network/command_and_control_fin7_c2_behavior.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/01" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -37,8 +37,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -(event.dataset: (network_traffic.tls or network_traffic.http) or - (event.category: (network or network_traffic) and type: (tls or http) and network.transport: tcp)) and +(event.dataset: (network_traffic.tls OR network_traffic.http) or + (event.category: (network OR network_traffic) AND type: (tls OR http) AND network.transport: tcp)) AND destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us ''' diff --git a/rules/network/command_and_control_halfbaked_beacon.toml b/rules/network/command_and_control_halfbaked_beacon.toml index fe46b4b90..3cbbd7070 100644 --- a/rules/network/command_and_control_halfbaked_beacon.toml +++ b/rules/network/command_and_control_halfbaked_beacon.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/01" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -38,10 +38,10 @@ timestamp_override = "event.ingested" type = "query" query = ''' -(event.dataset: (network_traffic.tls or network_traffic.http) or - (event.category: (network or network_traffic) and network.protocol: http)) and - network.transport:tcp and url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ and - destination.port:(53 or 80 or 8080 or 443) +(event.dataset: (network_traffic.tls OR network_traffic.http) OR + (event.category: (network OR network_traffic) AND network.protocol: http)) AND + network.transport:tcp AND url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ AND + destination.port:(53 OR 80 OR 8080 OR 443) ''' diff --git a/rules/network/initial_access_unsecure_elasticsearch_node.toml b/rules/network/initial_access_unsecure_elasticsearch_node.toml index 7c166db1d..fa1a06c6a 100644 --- a/rules/network/initial_access_unsecure_elasticsearch_node.toml +++ b/rules/network/initial_access_unsecure_elasticsearch_node.toml @@ -4,7 +4,7 @@ integration = ["network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/01" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -38,8 +38,8 @@ timestamp_override = "event.ingested" type = "query" query = ''' -(event.dataset: network_traffic.http or (event.category: network_traffic and network.protocol: http)) and - status:OK and destination.port:9200 and network.direction:inbound and NOT http.response.headers.content-type:"image/x-icon" and not +(event.dataset: network_traffic.http OR (event.category: network_traffic AND network.protocol: http)) AND + status:OK AND destination.port:9200 AND network.direction:inbound AND NOT http.response.headers.content-type:"image/x-icon" AND NOT _exists_:http.request.headers.authorization ''' From e4e68c2dd860a0ad95aab3ab86e546ab7d83b24f Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 17 Oct 2023 08:29:08 -0300 Subject: [PATCH 36/86] [Rule Tuning] Potential Masquerading as System32 DLL (#3184) Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --- ...sion_unsigned_dll_loaded_from_suspdir.toml | 2 +- .../defense_evasion_dll_hijack.toml | 6 ++-- ...ense_evasion_masquerading_windows_dll.toml | 33 ++++++++++++++++--- 3 files changed, 32 insertions(+), 9 deletions(-) diff --git a/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml b/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml index 038fbd69b..d82cde4b5 100644 --- a/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml +++ b/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml @@ -2,7 +2,7 @@ creation_date = "2022/11/22" maturity = "production" integration = ["endpoint"] -min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_comments = "New fields added: dll.Ext.relative_file_creation_time is populated in Elastic Endpoint 8.4 and above." min_stack_version = "8.4.0" updated_date = "2023/10/09" diff --git a/rules_building_block/defense_evasion_dll_hijack.toml b/rules_building_block/defense_evasion_dll_hijack.toml index f7910eb50..5958bbf6b 100644 --- a/rules_building_block/defense_evasion_dll_hijack.toml +++ b/rules_building_block/defense_evasion_dll_hijack.toml @@ -2,9 +2,9 @@ creation_date = "2023/07/12" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/07/12" +min_stack_comments = "New fields added: dll.Ext.relative_file_creation_time is populated in Elastic Endpoint 8.4 and above." +min_stack_version = "8.4.0" +updated_date = "2023/10/13" [rule] author = ["Elastic"] diff --git a/rules_building_block/defense_evasion_masquerading_windows_dll.toml b/rules_building_block/defense_evasion_masquerading_windows_dll.toml index 92f6b61c7..ca2816fd1 100644 --- a/rules_building_block/defense_evasion_masquerading_windows_dll.toml +++ b/rules_building_block/defense_evasion_masquerading_windows_dll.toml @@ -2,8 +2,8 @@ creation_date = "2023/08/18" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" +min_stack_comments = "New fields added: dll.Ext.relative_file_creation_time is populated in Elastic Endpoint 8.4 and above." +min_stack_version = "8.4.0" updated_date = "2023/10/13" bypass_bbr_timing = true @@ -28,7 +28,7 @@ building_block_type = "default" type = "eql" query = ''' -library where event.action == "load" and +library where event.action == "load" and dll.Ext.relative_file_creation_time <= 3600 and not ( dll.path : ( "?:\\Windows\\System32\\*", @@ -36,6 +36,8 @@ library where event.action == "load" and "?:\\Windows\\SystemTemp\\*", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\System32\\*", + "?:\\$WINDOWS.~BT\\Sources\\*", + "?:\\$WINDOWS.~BT\\Work\\*", "?:\\Windows\\WinSxS\\*", "?:\\Windows\\SoftwareDistribution\\Download\\*", "?:\\Windows\\assembly\\NativeImages_v*" @@ -55,8 +57,29 @@ library where event.action == "load" and "aadauthhelper.dll", "aadcloudap.dll", "aadjcsp.dll", "aadtb.dll", "aadwamextension.dll", "aarsvc.dll", "abovelockapphost.dll", "accessibilitycpl.dll", "accountaccessor.dll", "accountsrt.dll", "acgenral.dll", "aclayers.dll", "acledit.dll", "aclui.dll", "acmigration.dll", "acppage.dll", "acproxy.dll", "acspecfc.dll", "actioncenter.dll", "actioncentercpl.dll", "actionqueue.dll", "activationclient.dll", "activeds.dll", "activesynccsp.dll", "actxprxy.dll", "acwinrt.dll", "acxtrnal.dll", "adaptivecards.dll", "addressparser.dll", "adhapi.dll", "adhsvc.dll", "admtmpl.dll", "adprovider.dll", "adrclient.dll", "adsldp.dll", "adsldpc.dll", "adsmsext.dll", "adsnt.dll", "adtschema.dll", "advancedemojids.dll", "advapi32.dll", "advapi32res.dll", "advpack.dll", "aeevts.dll", "aeinv.dll", "aepic.dll", "ajrouter.dll", "altspace.dll", "amsi.dll", "amsiproxy.dll", "amstream.dll", "apds.dll", "aphostclient.dll", "aphostres.dll", "aphostservice.dll", "apisampling.dll", "apisetschema.dll", "apmon.dll", "apmonui.dll", "appcontracts.dll", "appextension.dll", "apphelp.dll", "apphlpdm.dll", "appidapi.dll", "appidsvc.dll", "appinfo.dll", "appinfoext.dll", "applicationframe.dll", "applockercsp.dll", "appmgmts.dll", "appmgr.dll", "appmon.dll", "appointmentapis.dll", "appraiser.dll", "appreadiness.dll", "apprepapi.dll", "appresolver.dll", "appsruprov.dll", "appvcatalog.dll", "appvclientps.dll", "appvetwclientres.dll", "appvintegration.dll", "appvmanifest.dll", "appvpolicy.dll", "appvpublishing.dll", "appvreporting.dll", "appvscripting.dll", "appvsentinel.dll", "appvstreamingux.dll", "appvstreammap.dll", "appvterminator.dll", "appxalluserstore.dll", "appxpackaging.dll", "appxsip.dll", "appxsysprep.dll", "archiveint.dll", "asferror.dll", "aspnet_counters.dll", "asycfilt.dll", "atl.dll", "atlthunk.dll", "atmlib.dll", "audioeng.dll", "audiohandlers.dll", "audiokse.dll", "audioses.dll", "audiosrv.dll", "auditcse.dll", "auditpolcore.dll", "auditpolmsg.dll", "authbroker.dll", "authbrokerui.dll", "authentication.dll", "authext.dll", "authfwcfg.dll", "authfwgp.dll", "authfwsnapin.dll", "authfwwizfwk.dll", "authhostproxy.dll", "authui.dll", "authz.dll", "autopilot.dll", "autopilotdiag.dll", "autoplay.dll", "autotimesvc.dll", "avicap32.dll", "avifil32.dll", "avrt.dll", "axinstsv.dll", "azroles.dll", "azroleui.dll", "azsqlext.dll", "basecsp.dll", "basesrv.dll", "batmeter.dll", "bcastdvrbroker.dll", "bcastdvrclient.dll", "bcastdvrcommon.dll", "bcd.dll", "bcdprov.dll", "bcdsrv.dll", "bcp47langs.dll", "bcp47mrm.dll", "bcrypt.dll", "bcryptprimitives.dll", "bdehdcfglib.dll", "bderepair.dll", "bdesvc.dll", "bdesysprep.dll", "bdeui.dll", "bfe.dll", "bi.dll", "bidispl.dll", "bindfltapi.dll", "bingasds.dll", "bingfilterds.dll", "bingmaps.dll", "biocredprov.dll", "bisrv.dll", "bitlockercsp.dll", "bitsigd.dll", "bitsperf.dll", "bitsproxy.dll", "biwinrt.dll", "blbevents.dll", "blbres.dll", "blb_ps.dll", "bluetoothapis.dll", "bnmanager.dll", "bootmenuux.dll", "bootstr.dll", "bootux.dll", "bootvid.dll", "bridgeres.dll", "brokerlib.dll", "browcli.dll", "browserbroker.dll", "browseui.dll", "btagservice.dll", "bthavctpsvc.dll", "bthavrcp.dll", "bthavrcpappsvc.dll", "bthci.dll", "bthpanapi.dll", "bthradiomedia.dll", "bthserv.dll", "bthtelemetry.dll", "btpanui.dll", "bwcontexthandler.dll", "cabapi.dll", "cabinet.dll", "cabview.dll", "callbuttons.dll", "cameracaptureui.dll", "capauthz.dll", "capiprovider.dll", "capisp.dll", "captureservice.dll", "castingshellext.dll", "castlaunch.dll", "catsrv.dll", "catsrvps.dll", "catsrvut.dll", "cbdhsvc.dll", "cca.dll", "cdd.dll", "cdosys.dll", "cdp.dll", "cdprt.dll", "cdpsvc.dll", "cdpusersvc.dll", "cemapi.dll", "certca.dll", "certcli.dll", "certcredprovider.dll", "certenc.dll", "certenroll.dll", "certenrollui.dll", "certmgr.dll", "certpkicmdlet.dll", "certpoleng.dll", "certprop.dll", "cewmdm.dll", "cfgbkend.dll", "cfgmgr32.dll", "cfgspcellular.dll", "cfgsppolicy.dll", "cflapi.dll", "cfmifs.dll", "cfmifsproxy.dll", "chakra.dll", "chakradiag.dll", "chakrathunk.dll", "chartv.dll", "chatapis.dll", "chkwudrv.dll", "chsstrokeds.dll", "chtbopomofods.dll", "chtcangjieds.dll", "chthkstrokeds.dll", "chtquickds.dll", "chxapds.dll", "chxdecoder.dll", "chxhapds.dll", "chxinputrouter.dll", "chxranker.dll", "ci.dll", "cic.dll", "cimfs.dll", "circoinst.dll", "ciwmi.dll", "clb.dll", "clbcatq.dll", "cldapi.dll", "cleanpccsp.dll", "clfsw32.dll", "cliconfg.dll", "clipboardserver.dll", "clipc.dll", "clipsvc.dll", "clipwinrt.dll", "cloudap.dll", "cloudidsvc.dll", "clrhost.dll", "clusapi.dll", "cmcfg32.dll", "cmdext.dll", "cmdial32.dll", "cmgrcspps.dll", "cmifw.dll", "cmintegrator.dll", "cmlua.dll", "cmpbk32.dll", "cmstplua.dll", "cmutil.dll", "cngcredui.dll", "cngprovider.dll", "cnvfat.dll", "cofiredm.dll", "colbact.dll", "colorcnv.dll", "colorui.dll", "combase.dll", "comcat.dll", "comctl32.dll", "comdlg32.dll", "coml2.dll", "comppkgsup.dll", "compstui.dll", "computecore.dll", "computenetwork.dll", "computestorage.dll", "comrepl.dll", "comres.dll", "comsnap.dll", "comsvcs.dll", "comuid.dll", "configmanager2.dll", "conhostv1.dll", "connect.dll", "consentux.dll", "consentuxclient.dll", "console.dll", "consolelogon.dll", "contactapis.dll", "container.dll", "coredpus.dll", "coreglobconfig.dll", "coremas.dll", "coremessaging.dll", "coremmres.dll", "coreshell.dll", "coreshellapi.dll", "coreuicomponents.dll", "correngine.dll", "courtesyengine.dll", "cpfilters.dll", "creddialogbroker.dll", "credprovhelper.dll", "credprovhost.dll", "credprovs.dll", "credprovslegacy.dll", "credssp.dll", "credui.dll", "crypt32.dll", "cryptbase.dll", "cryptcatsvc.dll", "cryptdlg.dll", "cryptdll.dll", "cryptext.dll", "cryptnet.dll", "cryptngc.dll", "cryptowinrt.dll", "cryptsp.dll", "cryptsvc.dll", "crypttpmeksvc.dll", "cryptui.dll", "cryptuiwizard.dll", "cryptxml.dll", "cscapi.dll", "cscdll.dll", "cscmig.dll", "cscobj.dll", "cscsvc.dll", "cscui.dll", "csplte.dll", "cspproxy.dll", "csrsrv.dll", "cxcredprov.dll", "c_g18030.dll", "c_gsm7.dll", "c_is2022.dll", "c_iscii.dll", "d2d1.dll", "d3d10.dll", "d3d10core.dll", "d3d10level9.dll", "d3d10warp.dll", "d3d10_1.dll", "d3d10_1core.dll", "d3d11.dll", "d3d11on12.dll", "d3d12.dll", "d3d12core.dll", "d3d8thk.dll", "d3d9.dll", "d3d9on12.dll", "d3dscache.dll", "dab.dll", "dabapi.dll", "daconn.dll", "dafbth.dll", "dafdnssd.dll", "dafescl.dll", "dafgip.dll", "dafiot.dll", "dafipp.dll", "dafmcp.dll", "dafpos.dll", "dafprintprovider.dll", "dafupnp.dll", "dafwcn.dll", "dafwfdprovider.dll", "dafwiprov.dll", "dafwsd.dll", "damediamanager.dll", "damm.dll", "das.dll", "dataclen.dll", "datusage.dll", "davclnt.dll", "davhlpr.dll", "davsyncprovider.dll", "daxexec.dll", "dbgcore.dll", "dbgeng.dll", "dbghelp.dll", "dbgmodel.dll", "dbnetlib.dll", "dbnmpntw.dll", "dciman32.dll", "dcntel.dll", "dcomp.dll", "ddaclsys.dll", "ddcclaimsapi.dll", "ddds.dll", "ddisplay.dll", "ddoiproxy.dll", "ddores.dll", "ddpchunk.dll", "ddptrace.dll", "ddputils.dll", "ddp_ps.dll", "ddraw.dll", "ddrawex.dll", "defragproxy.dll", "defragres.dll", "defragsvc.dll", "deploymentcsps.dll", "deskadp.dll", "deskmon.dll", "desktopshellext.dll", "devenum.dll", "deviceaccess.dll", "devicecenter.dll", "devicecredential.dll", "devicepairing.dll", "deviceuxres.dll", "devinv.dll", "devmgr.dll", "devobj.dll", "devpropmgr.dll", "devquerybroker.dll", "devrtl.dll", "dfdts.dll", "dfscli.dll", "dfshim.dll", "dfsshlex.dll", "dggpext.dll", "dhcpcmonitor.dll", "dhcpcore.dll", "dhcpcore6.dll", "dhcpcsvc.dll", "dhcpcsvc6.dll", "dhcpsapi.dll", "diagcpl.dll", "diagnosticlogcsp.dll", "diagperf.dll", "diagsvc.dll", "diagtrack.dll", "dialclient.dll", "dialserver.dll", "dictationmanager.dll", "difxapi.dll", "dimsjob.dll", "dimsroam.dll", "dinput.dll", "dinput8.dll", "direct2ddesktop.dll", "directml.dll", "discan.dll", "dismapi.dll", "dispbroker.dll", "dispex.dll", "display.dll", "displaymanager.dll", "dlnashext.dll", "dmappsres.dll", "dmcfgutils.dll", "dmcmnutils.dll", "dmcsps.dll", "dmdlgs.dll", "dmdskmgr.dll", "dmdskres.dll", "dmdskres2.dll", "dmenrollengine.dll", "dmintf.dll", "dmiso8601utils.dll", "dmloader.dll", "dmocx.dll", "dmoleaututils.dll", "dmpushproxy.dll", "dmpushroutercore.dll", "dmrcdecoder.dll", "dmrserver.dll", "dmsynth.dll", "dmusic.dll", "dmutil.dll", "dmvdsitf.dll", "dmwappushsvc.dll", "dmwmicsp.dll", "dmxmlhelputils.dll", "dnsapi.dll", "dnscmmc.dll", "dnsext.dll", "dnshc.dll", "dnsrslvr.dll", "docprop.dll", "dolbydecmft.dll", "domgmt.dll", "dosettings.dll", "dosvc.dll", "dot3api.dll", "dot3cfg.dll", "dot3conn.dll", "dot3dlg.dll", "dot3gpclnt.dll", "dot3gpui.dll", "dot3hc.dll", "dot3mm.dll", "dot3msm.dll", "dot3svc.dll", "dot3ui.dll", "dpapi.dll", "dpapiprovider.dll", "dpapisrv.dll", "dpnaddr.dll", "dpnathlp.dll", "dpnet.dll", "dpnhpast.dll", "dpnhupnp.dll", "dpnlobby.dll", "dps.dll", "dpx.dll", "drprov.dll", "drt.dll", "drtprov.dll", "drttransport.dll", "drvsetup.dll", "drvstore.dll", "dsauth.dll", "dsccore.dll", "dsccoreconfprov.dll", "dsclient.dll", "dscproxy.dll", "dsctimer.dll", "dsdmo.dll", "dskquota.dll", "dskquoui.dll", "dsound.dll", "dsparse.dll", "dsprop.dll", "dsquery.dll", "dsreg.dll", "dsregtask.dll", "dsrole.dll", "dssec.dll", "dssenh.dll", "dssvc.dll", "dsui.dll", "dsuiext.dll", "dswave.dll", "dtsh.dll", "ducsps.dll", "dui70.dll", "duser.dll", "dusmapi.dll", "dusmsvc.dll", "dwmapi.dll", "dwmcore.dll", "dwmghost.dll", "dwminit.dll", "dwmredir.dll", "dwmscene.dll", "dwrite.dll", "dxcore.dll", "dxdiagn.dll", "dxgi.dll", "dxgwdi.dll", "dxilconv.dll", "dxmasf.dll", "dxp.dll", "dxpps.dll", "dxptasksync.dll", "dxtmsft.dll", "dxtrans.dll", "dxva2.dll", "dynamoapi.dll", "eapp3hst.dll", "eappcfg.dll", "eappcfgui.dll", "eappgnui.dll", "eapphost.dll", "eappprxy.dll", "eapprovp.dll", "eapputil.dll", "eapsimextdesktop.dll", "eapsvc.dll", "eapteapauth.dll", "eapteapconfig.dll", "eapteapext.dll", "easconsent.dll", "easwrt.dll", "edgeangle.dll", "edgecontent.dll", "edgehtml.dll", "edgeiso.dll", "edgemanager.dll", "edpauditapi.dll", "edpcsp.dll", "edptask.dll", "edputil.dll", "eeprov.dll", "eeutil.dll", "efsadu.dll", "efscore.dll", "efsext.dll", "efslsaext.dll", "efssvc.dll", "efsutil.dll", "efswrt.dll", "ehstorapi.dll", "ehstorpwdmgr.dll", "ehstorshell.dll", "els.dll", "elscore.dll", "elshyph.dll", "elslad.dll", "elstrans.dll", "emailapis.dll", "embeddedmodesvc.dll", "emojids.dll", "encapi.dll", "energy.dll", "energyprov.dll", "energytask.dll", "enrollmentapi.dll", "enterpriseapncsp.dll", "enterprisecsps.dll", "enterpriseetw.dll", "eqossnap.dll", "errordetails.dll", "errordetailscore.dll", "es.dll", "esclprotocol.dll", "esclscan.dll", "esclwiadriver.dll", "esdsip.dll", "esent.dll", "esentprf.dll", "esevss.dll", "eshims.dll", "etwrundown.dll", "euiccscsp.dll", "eventaggregation.dll", "eventcls.dll", "evr.dll", "execmodelclient.dll", "execmodelproxy.dll", "explorerframe.dll", "exsmime.dll", "extrasxmlparser.dll", "f3ahvoas.dll", "facilitator.dll", "familysafetyext.dll", "faultrep.dll", "fcon.dll", "fdbth.dll", "fdbthproxy.dll", "fddevquery.dll", "fde.dll", "fdeploy.dll", "fdphost.dll", "fdpnp.dll", "fdprint.dll", "fdproxy.dll", "fdrespub.dll", "fdssdp.dll", "fdwcn.dll", "fdwnet.dll", "fdwsd.dll", "feclient.dll", "ffbroker.dll", "fhcat.dll", "fhcfg.dll", "fhcleanup.dll", "fhcpl.dll", "fhengine.dll", "fhevents.dll", "fhshl.dll", "fhsrchapi.dll", "fhsrchph.dll", "fhsvc.dll", "fhsvcctl.dll", "fhtask.dll", "fhuxadapter.dll", "fhuxapi.dll", "fhuxcommon.dll", "fhuxgraphics.dll", "fhuxpresentation.dll", "fidocredprov.dll", "filemgmt.dll", "filterds.dll", "findnetprinters.dll", "firewallapi.dll", "flightsettings.dll", "fltlib.dll", "fluencyds.dll", "fmapi.dll", "fmifs.dll", "fms.dll", "fntcache.dll", "fontext.dll", "fontprovider.dll", "fontsub.dll", "fphc.dll", "framedyn.dll", "framedynos.dll", "frameserver.dll", "frprov.dll", "fsutilext.dll", "fthsvc.dll", "fundisc.dll", "fveapi.dll", "fveapibase.dll", "fvecerts.dll", "fvecpl.dll", "fveskybackup.dll", "fveui.dll", "fvewiz.dll", "fwbase.dll", "fwcfg.dll", "fwmdmcsp.dll", "fwpolicyiomgr.dll", "fwpuclnt.dll", "fwremotesvr.dll", "gameinput.dll", "gamemode.dll", "gamestreamingext.dll", "gameux.dll", "gamingtcui.dll", "gcdef.dll", "gdi32.dll", "gdi32full.dll", "gdiplus.dll", "generaltel.dll", "geocommon.dll", "geolocation.dll", "getuname.dll", "glmf32.dll", "globinputhost.dll", "glu32.dll", "gmsaclient.dll", "gpapi.dll", "gpcsewrappercsp.dll", "gpedit.dll", "gpprefcl.dll", "gpprnext.dll", "gpscript.dll", "gpsvc.dll", "gptext.dll", "graphicscapture.dll", "graphicsperfsvc.dll", "groupinghc.dll", "hal.dll", "halextpl080.dll", "hascsp.dll", "hashtagds.dll", "hbaapi.dll", "hcproviders.dll", "hdcphandler.dll", "heatcore.dll", "helppaneproxy.dll", "hgcpl.dll", "hhsetup.dll", "hid.dll", "hidcfu.dll", "hidserv.dll", "hlink.dll", "hmkd.dll", "hnetcfg.dll", "hnetcfgclient.dll", "hnetmon.dll", "hologramworld.dll", "holoshellruntime.dll", "holoshextensions.dll", "hotplug.dll", "hrtfapo.dll", "httpapi.dll", "httpprxc.dll", "httpprxm.dll", "httpprxp.dll", "httpsdatasource.dll", "htui.dll", "hvhostsvc.dll", "hvloader.dll", "hvsigpext.dll", "hvsocket.dll", "hydrogen.dll", "ia2comproxy.dll", "ias.dll", "iasacct.dll", "iasads.dll", "iasdatastore.dll", "iashlpr.dll", "iasmigplugin.dll", "iasnap.dll", "iaspolcy.dll", "iasrad.dll", "iasrecst.dll", "iassam.dll", "iassdo.dll", "iassvcs.dll", "icfupgd.dll", "icm32.dll", "icmp.dll", "icmui.dll", "iconcodecservice.dll", "icsigd.dll", "icsvc.dll", "icsvcext.dll", "icu.dll", "icuin.dll", "icuuc.dll", "idctrls.dll", "idlisten.dll", "idndl.dll", "idstore.dll", "ieadvpack.dll", "ieapfltr.dll", "iedkcs32.dll", "ieframe.dll", "iemigplugin.dll", "iepeers.dll", "ieproxy.dll", "iernonce.dll", "iertutil.dll", "iesetup.dll", "iesysprep.dll", "ieui.dll", "ifmon.dll", "ifsutil.dll", "ifsutilx.dll", "igddiag.dll", "ihds.dll", "ikeext.dll", "imagehlp.dll", "imageres.dll", "imagesp1.dll", "imapi.dll", "imapi2.dll", "imapi2fs.dll", "imgutil.dll", "imm32.dll", "implatsetup.dll", "indexeddblegacy.dll", "inetcomm.dll", "inetmib1.dll", "inetpp.dll", "inetppui.dll", "inetres.dll", "inked.dll", "inkobjcore.dll", "inproclogger.dll", "input.dll", "inputcloudstore.dll", "inputcontroller.dll", "inputhost.dll", "inputservice.dll", "inputswitch.dll", "inseng.dll", "installservice.dll", "internetmail.dll", "internetmailcsp.dll", "invagent.dll", "iologmsg.dll", "iphlpapi.dll", "iphlpsvc.dll", "ipnathlp.dll", "ipnathlpclient.dll", "ippcommon.dll", "ippcommonproxy.dll", "iprtprio.dll", "iprtrmgr.dll", "ipsecsnp.dll", "ipsecsvc.dll", "ipsmsnap.dll", "ipxlatcfg.dll", "iri.dll", "iscsicpl.dll", "iscsidsc.dll", "iscsied.dll", "iscsiexe.dll", "iscsilog.dll", "iscsium.dll", "iscsiwmi.dll", "iscsiwmiv2.dll", "ism.dll", "itircl.dll", "itss.dll", "iuilp.dll", "iumbase.dll", "iumcrypt.dll", "iumdll.dll", "iumsdk.dll", "iyuv_32.dll", "joinproviderol.dll", "joinutil.dll", "jpmapcontrol.dll", "jpndecoder.dll", "jpninputrouter.dll", "jpnranker.dll", "jpnserviceds.dll", "jscript.dll", "jscript9.dll", "jscript9diag.dll", "jsproxy.dll", "kbd101.dll", "kbd101a.dll", "kbd101b.dll", "kbd101c.dll", "kbd103.dll", "kbd106.dll", "kbd106n.dll", "kbda1.dll", "kbda2.dll", "kbda3.dll", "kbdadlm.dll", "kbdal.dll", "kbdarme.dll", "kbdarmph.dll", "kbdarmty.dll", "kbdarmw.dll", "kbdax2.dll", "kbdaze.dll", "kbdazel.dll", "kbdazst.dll", "kbdbash.dll", "kbdbe.dll", "kbdbene.dll", "kbdbgph.dll", "kbdbgph1.dll", "kbdbhc.dll", "kbdblr.dll", "kbdbr.dll", "kbdbu.dll", "kbdbug.dll", "kbdbulg.dll", "kbdca.dll", "kbdcan.dll", "kbdcher.dll", "kbdcherp.dll", "kbdcr.dll", "kbdcz.dll", "kbdcz1.dll", "kbdcz2.dll", "kbdda.dll", "kbddiv1.dll", "kbddiv2.dll", "kbddv.dll", "kbddzo.dll", "kbdes.dll", "kbdest.dll", "kbdfa.dll", "kbdfar.dll", "kbdfc.dll", "kbdfi.dll", "kbdfi1.dll", "kbdfo.dll", "kbdfr.dll", "kbdfthrk.dll", "kbdgae.dll", "kbdgeo.dll", "kbdgeoer.dll", "kbdgeome.dll", "kbdgeooa.dll", "kbdgeoqw.dll", "kbdgkl.dll", "kbdgn.dll", "kbdgr.dll", "kbdgr1.dll", "kbdgrlnd.dll", "kbdgthc.dll", "kbdhau.dll", "kbdhaw.dll", "kbdhe.dll", "kbdhe220.dll", "kbdhe319.dll", "kbdheb.dll", "kbdhebl3.dll", "kbdhela2.dll", "kbdhela3.dll", "kbdhept.dll", "kbdhu.dll", "kbdhu1.dll", "kbdibm02.dll", "kbdibo.dll", "kbdic.dll", "kbdinasa.dll", "kbdinbe1.dll", "kbdinbe2.dll", "kbdinben.dll", "kbdindev.dll", "kbdinen.dll", "kbdinguj.dll", "kbdinhin.dll", "kbdinkan.dll", "kbdinmal.dll", "kbdinmar.dll", "kbdinori.dll", "kbdinpun.dll", "kbdintam.dll", "kbdintel.dll", "kbdinuk2.dll", "kbdir.dll", "kbdit.dll", "kbdit142.dll", "kbdiulat.dll", "kbdjav.dll", "kbdjpn.dll", "kbdkaz.dll", "kbdkhmr.dll", "kbdkni.dll", "kbdkor.dll", "kbdkurd.dll", "kbdkyr.dll", "kbdla.dll", "kbdlao.dll", "kbdlisub.dll", "kbdlisus.dll", "kbdlk41a.dll", "kbdlt.dll", "kbdlt1.dll", "kbdlt2.dll", "kbdlv.dll", "kbdlv1.dll", "kbdlvst.dll", "kbdmac.dll", "kbdmacst.dll", "kbdmaori.dll", "kbdmlt47.dll", "kbdmlt48.dll", "kbdmon.dll", "kbdmonmo.dll", "kbdmonst.dll", "kbdmyan.dll", "kbdne.dll", "kbdnec.dll", "kbdnec95.dll", "kbdnecat.dll", "kbdnecnt.dll", "kbdnepr.dll", "kbdnko.dll", "kbdno.dll", "kbdno1.dll", "kbdnso.dll", "kbdntl.dll", "kbdogham.dll", "kbdolch.dll", "kbdoldit.dll", "kbdosa.dll", "kbdosm.dll", "kbdpash.dll", "kbdphags.dll", "kbdpl.dll", "kbdpl1.dll", "kbdpo.dll", "kbdro.dll", "kbdropr.dll", "kbdrost.dll", "kbdru.dll", "kbdru1.dll", "kbdrum.dll", "kbdsf.dll", "kbdsg.dll", "kbdsl.dll", "kbdsl1.dll", "kbdsmsfi.dll", "kbdsmsno.dll", "kbdsn1.dll", "kbdsora.dll", "kbdsorex.dll", "kbdsors1.dll", "kbdsorst.dll", "kbdsp.dll", "kbdsw.dll", "kbdsw09.dll", "kbdsyr1.dll", "kbdsyr2.dll", "kbdtaile.dll", "kbdtajik.dll", "kbdtam99.dll", "kbdtat.dll", "kbdth0.dll", "kbdth1.dll", "kbdth2.dll", "kbdth3.dll", "kbdtifi.dll", "kbdtifi2.dll", "kbdtiprc.dll", "kbdtiprd.dll", "kbdtt102.dll", "kbdtuf.dll", "kbdtuq.dll", "kbdturme.dll", "kbdtzm.dll", "kbdughr.dll", "kbdughr1.dll", "kbduk.dll", "kbdukx.dll", "kbdur.dll", "kbdur1.dll", "kbdurdu.dll", "kbdus.dll", "kbdusa.dll", "kbdusl.dll", "kbdusr.dll", "kbdusx.dll", "kbduzb.dll", "kbdvntc.dll", "kbdwol.dll", "kbdyak.dll", "kbdyba.dll", "kbdycc.dll", "kbdycl.dll", "kd.dll", "kdcom.dll", "kdcpw.dll", "kdhvcom.dll", "kdnet.dll", "kdnet_uart16550.dll", "kdscli.dll", "kdstub.dll", "kdusb.dll", "kd_02_10df.dll", "kd_02_10ec.dll", "kd_02_1137.dll", "kd_02_14e4.dll", "kd_02_15b3.dll", "kd_02_1969.dll", "kd_02_19a2.dll", "kd_02_1af4.dll", "kd_02_8086.dll", "kd_07_1415.dll", "kd_0c_8086.dll", "kerbclientshared.dll", "kerberos.dll", "kernel32.dll", "kernelbase.dll", "keycredmgr.dll", "keyiso.dll", "keymgr.dll", "knobscore.dll", "knobscsp.dll", "ksuser.dll", "ktmw32.dll", "l2gpstore.dll", "l2nacp.dll", "l2sechc.dll", "laprxy.dll", "legacynetux.dll", "lfsvc.dll", "libcrypto.dll", "licensemanager.dll", "licensingcsp.dll", "licensingdiagspp.dll", "licensingwinrt.dll", "licmgr10.dll", "linkinfo.dll", "lltdapi.dll", "lltdres.dll", "lltdsvc.dll", "lmhsvc.dll", "loadperf.dll", "localsec.dll", "localspl.dll", "localui.dll", "locationapi.dll", "lockappbroker.dll", "lockcontroller.dll", "lockscreendata.dll", "loghours.dll", "logoncli.dll", "logoncontroller.dll", "lpasvc.dll", "lpk.dll", "lsasrv.dll", "lscshostpolicy.dll", "lsm.dll", "lsmproxy.dll", "lstelemetry.dll", "luainstall.dll", "luiapi.dll", "lz32.dll", "magnification.dll", "maintenanceui.dll", "manageci.dll", "mapconfiguration.dll", "mapcontrolcore.dll", "mapgeocoder.dll", "mapi32.dll", "mapistub.dll", "maprouter.dll", "mapsbtsvc.dll", "mapsbtsvcproxy.dll", "mapscsp.dll", "mapsstore.dll", "mapstoasttask.dll", "mapsupdatetask.dll", "mbaeapi.dll", "mbaeapipublic.dll", "mbaexmlparser.dll", "mbmediamanager.dll", "mbsmsapi.dll", "mbussdapi.dll", "mccsengineshared.dll", "mccspal.dll", "mciavi32.dll", "mcicda.dll", "mciqtz32.dll", "mciseq.dll", "mciwave.dll", "mcrecvsrc.dll", "mdmcommon.dll", "mdmdiagnostics.dll", "mdminst.dll", "mdmmigrator.dll", "mdmregistration.dll", "memorydiagnostic.dll", "messagingservice.dll", "mf.dll", "mf3216.dll", "mfaacenc.dll", "mfasfsrcsnk.dll", "mfaudiocnv.dll", "mfc42.dll", "mfc42u.dll", "mfcaptureengine.dll", "mfcore.dll", "mfcsubs.dll", "mfds.dll", "mfdvdec.dll", "mferror.dll", "mfh263enc.dll", "mfh264enc.dll", "mfksproxy.dll", "mfmediaengine.dll", "mfmjpegdec.dll", "mfmkvsrcsnk.dll", "mfmp4srcsnk.dll", "mfmpeg2srcsnk.dll", "mfnetcore.dll", "mfnetsrc.dll", "mfperfhelper.dll", "mfplat.dll", "mfplay.dll", "mfps.dll", "mfreadwrite.dll", "mfsensorgroup.dll", "mfsrcsnk.dll", "mfsvr.dll", "mftranscode.dll", "mfvdsp.dll", "mfvfw.dll", "mfwmaaec.dll", "mgmtapi.dll", "mi.dll", "mibincodec.dll", "midimap.dll", "migisol.dll", "miguiresource.dll", "mimefilt.dll", "mimofcodec.dll", "minstoreevents.dll", "miracastinputmgr.dll", "miracastreceiver.dll", "mirrordrvcompat.dll", "mispace.dll", "mitigationclient.dll", "miutils.dll", "mlang.dll", "mmcbase.dll", "mmcndmgr.dll", "mmcshext.dll", "mmdevapi.dll", "mmgaclient.dll", "mmgaproxystub.dll", "mmres.dll", "mobilenetworking.dll", "modemui.dll", "modernexecserver.dll", "moricons.dll", "moshost.dll", "moshostclient.dll", "moshostcore.dll", "mosstorage.dll", "mp3dmod.dll", "mp43decd.dll", "mp4sdecd.dll", "mpeval.dll", "mpg4decd.dll", "mpr.dll", "mprapi.dll", "mprddm.dll", "mprdim.dll", "mprext.dll", "mprmsg.dll", "mpssvc.dll", "mpunits.dll", "mrmcorer.dll", "mrmdeploy.dll", "mrmindexer.dll", "mrt100.dll", "mrt_map.dll", "msaatext.dll", "msac3enc.dll", "msacm32.dll", "msafd.dll", "msajapi.dll", "msalacdecoder.dll", "msalacencoder.dll", "msamrnbdecoder.dll", "msamrnbencoder.dll", "msamrnbsink.dll", "msamrnbsource.dll", "msasn1.dll", "msauddecmft.dll", "msaudite.dll", "msauserext.dll", "mscandui.dll", "mscat32.dll", "msclmd.dll", "mscms.dll", "mscoree.dll", "mscorier.dll", "mscories.dll", "msctf.dll", "msctfmonitor.dll", "msctfp.dll", "msctfui.dll", "msctfuimanager.dll", "msdadiag.dll", "msdart.dll", "msdelta.dll", "msdmo.dll", "msdrm.dll", "msdtckrm.dll", "msdtclog.dll", "msdtcprx.dll", "msdtcspoffln.dll", "msdtctm.dll", "msdtcuiu.dll", "msdtcvsp1res.dll", "msfeeds.dll", "msfeedsbs.dll", "msflacdecoder.dll", "msflacencoder.dll", "msftedit.dll", "msheif.dll", "mshtml.dll", "mshtmldac.dll", "mshtmled.dll", "mshtmler.dll", "msi.dll", "msicofire.dll", "msidcrl40.dll", "msident.dll", "msidle.dll", "msidntld.dll", "msieftp.dll", "msihnd.dll", "msiltcfg.dll", "msimg32.dll", "msimsg.dll", "msimtf.dll", "msisip.dll", "msiso.dll", "msiwer.dll", "mskeyprotcli.dll", "mskeyprotect.dll", "msls31.dll", "msmpeg2adec.dll", "msmpeg2enc.dll", "msmpeg2vdec.dll", "msobjs.dll", "msoert2.dll", "msopusdecoder.dll", "mspatcha.dll", "mspatchc.dll", "msphotography.dll", "msports.dll", "msprivs.dll", "msrahc.dll", "msrating.dll", "msrawimage.dll", "msrdc.dll", "msrdpwebaccess.dll", "msrle32.dll", "msscntrs.dll", "mssecuser.dll", "mssign32.dll", "mssip32.dll", "mssitlb.dll", "mssph.dll", "mssprxy.dll", "mssrch.dll", "mssvp.dll", "mstask.dll", "mstextprediction.dll", "mstscax.dll", "msutb.dll", "msv1_0.dll", "msvcirt.dll", "msvcp110_win.dll", "msvcp120_clr0400.dll", "msvcp140_clr0400.dll", "msvcp60.dll", "msvcp_win.dll", "msvcr100_clr0400.dll", "msvcr120_clr0400.dll", "msvcrt.dll", "msvfw32.dll", "msvidc32.dll", "msvidctl.dll", "msvideodsp.dll", "msvp9dec.dll", "msvproc.dll", "msvpxenc.dll", "mswb7.dll", "mswebp.dll", "mswmdm.dll", "mswsock.dll", "msxml3.dll", "msxml3r.dll", "msxml6.dll", "msxml6r.dll", "msyuv.dll", "mtcmodel.dll", "mtf.dll", "mtfappserviceds.dll", "mtfdecoder.dll", "mtffuzzyds.dll", "mtfserver.dll", "mtfspellcheckds.dll", "mtxclu.dll", "mtxdm.dll", "mtxex.dll", "mtxoci.dll", "muifontsetup.dll", "mycomput.dll", "mydocs.dll", "napcrypt.dll", "napinsp.dll", "naturalauth.dll", "naturallanguage6.dll", "navshutdown.dll", "ncaapi.dll", "ncasvc.dll", "ncbservice.dll", "ncdautosetup.dll", "ncdprop.dll", "nci.dll", "ncobjapi.dll", "ncrypt.dll", "ncryptprov.dll", "ncryptsslp.dll", "ncsi.dll", "ncuprov.dll", "nddeapi.dll", "ndfapi.dll", "ndfetw.dll", "ndfhcdiscovery.dll", "ndishc.dll", "ndproxystub.dll", "nduprov.dll", "negoexts.dll", "netapi32.dll", "netbios.dll", "netcenter.dll", "netcfgx.dll", "netcorehc.dll", "netdiagfx.dll", "netdriverinstall.dll", "netevent.dll", "netfxperf.dll", "neth.dll", "netid.dll", "netiohlp.dll", "netjoin.dll", "netlogon.dll", "netman.dll", "netmsg.dll", "netplwiz.dll", "netprofm.dll", "netprofmsvc.dll", "netprovfw.dll", "netprovisionsp.dll", "netsetupapi.dll", "netsetupengine.dll", "netsetupshim.dll", "netsetupsvc.dll", "netshell.dll", "nettrace.dll", "netutils.dll", "networkexplorer.dll", "networkhelper.dll", "networkicon.dll", "networkproxycsp.dll", "networkstatus.dll", "networkuxbroker.dll", "newdev.dll", "nfcradiomedia.dll", "ngccredprov.dll", "ngcctnr.dll", "ngcctnrsvc.dll", "ngcisoctnr.dll", "ngckeyenum.dll", "ngcksp.dll", "ngclocal.dll", "ngcpopkeysrv.dll", "ngcprocsp.dll", "ngcrecovery.dll", "ngcsvc.dll", "ngctasks.dll", "ninput.dll", "nlaapi.dll", "nlahc.dll", "nlasvc.dll", "nlhtml.dll", "nlmgp.dll", "nlmproxy.dll", "nlmsprep.dll", "nlsbres.dll", "nlsdata0000.dll", "nlsdata0009.dll", "nlsdl.dll", "nlslexicons0009.dll", "nmadirect.dll", "normaliz.dll", "npmproxy.dll", "npsm.dll", "nrpsrv.dll", "nshhttp.dll", "nshipsec.dll", "nshwfp.dll", "nsi.dll", "nsisvc.dll", "ntasn1.dll", "ntdll.dll", "ntdsapi.dll", "ntlanman.dll", "ntlanui2.dll", "ntlmshared.dll", "ntmarta.dll", "ntprint.dll", "ntshrui.dll", "ntvdm64.dll", "objsel.dll", "occache.dll", "ocsetapi.dll", "odbc32.dll", "odbcbcp.dll", "odbcconf.dll", "odbccp32.dll", "odbccr32.dll", "odbccu32.dll", "odbcint.dll", "odbctrac.dll", "oemlicense.dll", "offfilt.dll", "officecsp.dll", "offlinelsa.dll", "offlinesam.dll", "offreg.dll", "ole32.dll", "oleacc.dll", "oleacchooks.dll", "oleaccrc.dll", "oleaut32.dll", "oledlg.dll", "oleprn.dll", "omadmagent.dll", "omadmapi.dll", "onebackuphandler.dll", "onex.dll", "onexui.dll", "opcservices.dll", "opengl32.dll", "ortcengine.dll", "osbaseln.dll", "osksupport.dll", "osuninst.dll", "p2p.dll", "p2pgraph.dll", "p2pnetsh.dll", "p2psvc.dll", "packager.dll", "panmap.dll", "pautoenr.dll", "pcacli.dll", "pcadm.dll", "pcaevts.dll", "pcasvc.dll", "pcaui.dll", "pcpksp.dll", "pcsvdevice.dll", "pcwum.dll", "pcwutl.dll", "pdh.dll", "pdhui.dll", "peerdist.dll", "peerdistad.dll", "peerdistcleaner.dll", "peerdistsh.dll", "peerdistsvc.dll", "peopleapis.dll", "peopleband.dll", "perceptiondevice.dll", "perfctrs.dll", "perfdisk.dll", "perfnet.dll", "perfos.dll", "perfproc.dll", "perfts.dll", "phoneom.dll", "phoneproviders.dll", "phoneservice.dll", "phoneserviceres.dll", "phoneutil.dll", "phoneutilres.dll", "photowiz.dll", "pickerplatform.dll", "pid.dll", "pidgenx.dll", "pifmgr.dll", "pimstore.dll", "pkeyhelper.dll", "pktmonapi.dll", "pku2u.dll", "pla.dll", "playlistfolder.dll", "playsndsrv.dll", "playtodevice.dll", "playtomanager.dll", "playtomenu.dll", "playtoreceiver.dll", "ploptin.dll", "pmcsnap.dll", "pngfilt.dll", "pnidui.dll", "pnpclean.dll", "pnppolicy.dll", "pnpts.dll", "pnpui.dll", "pnpxassoc.dll", "pnpxassocprx.dll", "pnrpauto.dll", "pnrphc.dll", "pnrpnsp.dll", "pnrpsvc.dll", "policymanager.dll", "polstore.dll", "posetup.dll", "posyncservices.dll", "pots.dll", "powercpl.dll", "powrprof.dll", "ppcsnap.dll", "prauthproviders.dll", "prflbmsg.dll", "printui.dll", "printwsdahost.dll", "prm0009.dll", "prncache.dll", "prnfldr.dll", "prnntfy.dll", "prntvpt.dll", "profapi.dll", "profext.dll", "profprov.dll", "profsvc.dll", "profsvcext.dll", "propsys.dll", "provcore.dll", "provdatastore.dll", "provdiagnostics.dll", "provengine.dll", "provhandlers.dll", "provisioningcsp.dll", "provmigrate.dll", "provops.dll", "provplugineng.dll", "provsysprep.dll", "provthrd.dll", "proximitycommon.dll", "proximityservice.dll", "prvdmofcomp.dll", "psapi.dll", "pshed.dll", "psisdecd.dll", "psmsrv.dll", "pstask.dll", "pstorec.dll", "ptpprov.dll", "puiapi.dll", "puiobj.dll", "pushtoinstall.dll", "pwlauncher.dll", "pwrshplugin.dll", "pwsso.dll", "qasf.dll", "qcap.dll", "qdv.dll", "qdvd.dll", "qedit.dll", "qedwipes.dll", "qmgr.dll", "query.dll", "quiethours.dll", "qwave.dll", "racengn.dll", "racpldlg.dll", "radardt.dll", "radarrs.dll", "radcui.dll", "rasadhlp.dll", "rasapi32.dll", "rasauto.dll", "raschap.dll", "raschapext.dll", "rasctrs.dll", "rascustom.dll", "rasdiag.dll", "rasdlg.dll", "rasgcw.dll", "rasman.dll", "rasmans.dll", "rasmbmgr.dll", "rasmediamanager.dll", "rasmm.dll", "rasmontr.dll", "rasplap.dll", "rasppp.dll", "rastapi.dll", "rastls.dll", "rastlsext.dll", "rdbui.dll", "rdpbase.dll", "rdpcfgex.dll", "rdpcore.dll", "rdpcorets.dll", "rdpencom.dll", "rdpendp.dll", "rdpnano.dll", "rdpsaps.dll", "rdpserverbase.dll", "rdpsharercom.dll", "rdpudd.dll", "rdpviewerax.dll", "rdsappxhelper.dll", "rdsdwmdr.dll", "rdvvmtransport.dll", "rdxservice.dll", "rdxtaskfactory.dll", "reagent.dll", "reagenttask.dll", "recovery.dll", "regapi.dll", "regctrl.dll", "regidle.dll", "regsvc.dll", "reguwpapi.dll", "reinfo.dll", "remotepg.dll", "remotewipecsp.dll", "reportingcsp.dll", "resampledmo.dll", "resbparser.dll", "reseteng.dll", "resetengine.dll", "resetengonline.dll", "resourcemapper.dll", "resutils.dll", "rgb9rast.dll", "riched20.dll", "riched32.dll", "rjvmdmconfig.dll", "rmapi.dll", "rmclient.dll", "rnr20.dll", "roamingsecurity.dll", "rometadata.dll", "rotmgr.dll", "rpcepmap.dll", "rpchttp.dll", "rpcns4.dll", "rpcnsh.dll", "rpcrt4.dll", "rpcrtremote.dll", "rpcss.dll", "rsaenh.dll", "rshx32.dll", "rstrtmgr.dll", "rtffilt.dll", "rtm.dll", "rtmediaframe.dll", "rtmmvrortc.dll", "rtutils.dll", "rtworkq.dll", "rulebasedds.dll", "samcli.dll", "samlib.dll", "samsrv.dll", "sas.dll", "sbe.dll", "sbeio.dll", "sberes.dll", "sbservicetrigger.dll", "scansetting.dll", "scardbi.dll", "scarddlg.dll", "scardsvr.dll", "scavengeui.dll", "scdeviceenum.dll", "scecli.dll", "scesrv.dll", "schannel.dll", "schedcli.dll", "schedsvc.dll", "scksp.dll", "scripto.dll", "scrobj.dll", "scrptadm.dll", "scrrun.dll", "sdcpl.dll", "sdds.dll", "sdengin2.dll", "sdfhost.dll", "sdhcinst.dll", "sdiageng.dll", "sdiagprv.dll", "sdiagschd.dll", "sdohlp.dll", "sdrsvc.dll", "sdshext.dll", "searchfolder.dll", "sechost.dll", "seclogon.dll", "secproc.dll", "secproc_isv.dll", "secproc_ssp.dll", "secproc_ssp_isv.dll", "secur32.dll", "security.dll", "semgrps.dll", "semgrsvc.dll", "sendmail.dll", "sens.dll", "sensapi.dll", "sensorsapi.dll", "sensorscpl.dll", "sensorservice.dll", "sensorsnativeapi.dll", "sensorsutilsv2.dll", "sensrsvc.dll", "serialui.dll", "servicinguapi.dll", "serwvdrv.dll", "sessenv.dll", "setbcdlocale.dll", "settingmonitor.dll", "settingsync.dll", "settingsynccore.dll", "setupapi.dll", "setupcl.dll", "setupcln.dll", "setupetw.dll", "sfc.dll", "sfc_os.dll", "sgrmenclave.dll", "shacct.dll", "shacctprofile.dll", "sharedpccsp.dll", "sharedrealitysvc.dll", "sharehost.dll", "sharemediacpl.dll", "shcore.dll", "shdocvw.dll", "shell32.dll", "shellstyle.dll", "shfolder.dll", "shgina.dll", "shimeng.dll", "shimgvw.dll", "shlwapi.dll", "shpafact.dll", "shsetup.dll", "shsvcs.dll", "shunimpl.dll", "shutdownext.dll", "shutdownux.dll", "shwebsvc.dll", "signdrv.dll", "simauth.dll", "simcfg.dll", "skci.dll", "slc.dll", "slcext.dll", "slwga.dll", "smartscreenps.dll", "smbhelperclass.dll", "smbwmiv2.dll", "smiengine.dll", "smphost.dll", "smsroutersvc.dll", "sndvolsso.dll", "snmpapi.dll", "socialapis.dll", "softkbd.dll", "softpub.dll", "sortwindows61.dll", "sortwindows62.dll", "spacebridge.dll", "spacecontrol.dll", "spatializerapo.dll", "spatialstore.dll", "spbcd.dll", "speechpal.dll", "spfileq.dll", "spinf.dll", "spmpm.dll", "spnet.dll", "spoolss.dll", "spopk.dll", "spp.dll", "sppc.dll", "sppcext.dll", "sppcomapi.dll", "sppcommdlg.dll", "sppinst.dll", "sppnp.dll", "sppobjs.dll", "sppwinob.dll", "sppwmi.dll", "spwinsat.dll", "spwizeng.dll", "spwizimg.dll", "spwizres.dll", "spwmp.dll", "sqlsrv32.dll", "sqmapi.dll", "srchadmin.dll", "srclient.dll", "srcore.dll", "srevents.dll", "srh.dll", "srhelper.dll", "srm.dll", "srmclient.dll", "srmlib.dll", "srmscan.dll", "srmshell.dll", "srmstormod.dll", "srmtrace.dll", "srm_ps.dll", "srpapi.dll", "srrstr.dll", "srumapi.dll", "srumsvc.dll", "srvcli.dll", "srvsvc.dll", "srwmi.dll", "sscore.dll", "sscoreext.dll", "ssdm.dll", "ssdpapi.dll", "ssdpsrv.dll", "sspicli.dll", "sspisrv.dll", "ssshim.dll", "sstpsvc.dll", "starttiledata.dll", "startupscan.dll", "stclient.dll", "sti.dll", "sti_ci.dll", "stobject.dll", "storageusage.dll", "storagewmi.dll", "storewuauth.dll", "storprop.dll", "storsvc.dll", "streamci.dll", "structuredquery.dll", "sud.dll", "svf.dll", "svsvc.dll", "swprv.dll", "sxproxy.dll", "sxs.dll", "sxshared.dll", "sxssrv.dll", "sxsstore.dll", "synccenter.dll", "synccontroller.dll", "synchostps.dll", "syncproxy.dll", "syncreg.dll", "syncres.dll", "syncsettings.dll", "syncutil.dll", "sysclass.dll", "sysfxui.dll", "sysmain.dll", "sysntfy.dll", "syssetup.dll", "systemcpl.dll", "t2embed.dll", "tabbtn.dll", "tabbtnex.dll", "tabsvc.dll", "tapi3.dll", "tapi32.dll", "tapilua.dll", "tapimigplugin.dll", "tapiperf.dll", "tapisrv.dll", "tapisysprep.dll", "tapiui.dll", "taskapis.dll", "taskbarcpl.dll", "taskcomp.dll", "taskschd.dll", "taskschdps.dll", "tbauth.dll", "tbs.dll", "tcbloader.dll", "tcpipcfg.dll", "tcpmib.dll", "tcpmon.dll", "tcpmonui.dll", "tdh.dll", "tdlmigration.dll", "tellib.dll", "termmgr.dll", "termsrv.dll", "tetheringclient.dll", "tetheringmgr.dll", "tetheringservice.dll", "tetheringstation.dll", "textshaping.dll", "themecpl.dll", "themeservice.dll", "themeui.dll", "threadpoolwinrt.dll", "thumbcache.dll", "timebrokerclient.dll", "timebrokerserver.dll", "timesync.dll", "timesynctask.dll", "tlscsp.dll", "tokenbinding.dll", "tokenbroker.dll", "tokenbrokerui.dll", "tpmcertresources.dll", "tpmcompc.dll", "tpmtasks.dll", "tpmvsc.dll", "tquery.dll", "traffic.dll", "transportdsa.dll", "trie.dll", "trkwks.dll", "tsbyuv.dll", "tscfgwmi.dll", "tserrredir.dll", "tsf3gip.dll", "tsgqec.dll", "tsmf.dll", "tspkg.dll", "tspubwmi.dll", "tssessionux.dll", "tssrvlic.dll", "tsworkspace.dll", "ttdloader.dll", "ttdplm.dll", "ttdrecord.dll", "ttdrecordcpu.dll", "ttlsauth.dll", "ttlscfg.dll", "ttlsext.dll", "tvratings.dll", "twext.dll", "twinapi.dll", "twinui.dll", "txflog.dll", "txfw32.dll", "tzautoupdate.dll", "tzres.dll", "tzsyncres.dll", "ubpm.dll", "ucmhc.dll", "ucrtbase.dll", "ucrtbase_clr0400.dll", "ucrtbase_enclave.dll", "udhisapi.dll", "udwm.dll", "ueficsp.dll", "uexfat.dll", "ufat.dll", "uiamanager.dll", "uianimation.dll", "uiautomationcore.dll", "uicom.dll", "uireng.dll", "uiribbon.dll", "uiribbonres.dll", "ulib.dll", "umb.dll", "umdmxfrm.dll", "umpdc.dll", "umpnpmgr.dll", "umpo-overrides.dll", "umpo.dll", "umpoext.dll", "umpowmi.dll", "umrdp.dll", "unattend.dll", "unenrollhook.dll", "unimdmat.dll", "uniplat.dll", "unistore.dll", "untfs.dll", "updateagent.dll", "updatecsp.dll", "updatepolicy.dll", "upnp.dll", "upnphost.dll", "upshared.dll", "urefs.dll", "urefsv1.dll", "ureg.dll", "url.dll", "urlmon.dll", "usbcapi.dll", "usbceip.dll", "usbmon.dll", "usbperf.dll", "usbpmapi.dll", "usbtask.dll", "usbui.dll", "user32.dll", "usercpl.dll", "userdataservice.dll", "userdatatimeutil.dll", "userenv.dll", "userinitext.dll", "usermgr.dll", "usermgrcli.dll", "usermgrproxy.dll", "usoapi.dll", "usocoreps.dll", "usosvc.dll", "usp10.dll", "ustprov.dll", "utcutil.dll", "utildll.dll", "uudf.dll", "uvcmodel.dll", "uwfcfgmgmt.dll", "uwfcsp.dll", "uwfservicingapi.dll", "uxinit.dll", "uxlib.dll", "uxlibres.dll", "uxtheme.dll", "vac.dll", "van.dll", "vault.dll", "vaultcds.dll", "vaultcli.dll", "vaultroaming.dll", "vaultsvc.dll", "vbsapi.dll", "vbscript.dll", "vbssysprep.dll", "vcardparser.dll", "vdsbas.dll", "vdsdyn.dll", "vdsutil.dll", "vdsvd.dll", "vds_ps.dll", "verifier.dll", "version.dll", "vertdll.dll", "vfuprov.dll", "vfwwdm32.dll", "vhfum.dll", "vid.dll", "videohandlers.dll", "vidreszr.dll", "virtdisk.dll", "vmbuspipe.dll", "vmdevicehost.dll", "vmictimeprovider.dll", "vmrdvcore.dll", "voiprt.dll", "vpnike.dll", "vpnikeapi.dll", "vpnsohdesktop.dll", "vpnv2csp.dll", "vscmgrps.dll", "vssapi.dll", "vsstrace.dll", "vss_ps.dll", "w32time.dll", "w32topl.dll", "waasassessment.dll", "waasmediccapsule.dll", "waasmedicps.dll", "waasmedicsvc.dll", "wabsyncprovider.dll", "walletproxy.dll", "walletservice.dll", "wavemsp.dll", "wbemcomn.dll", "wbiosrvc.dll", "wci.dll", "wcimage.dll", "wcmapi.dll", "wcmcsp.dll", "wcmsvc.dll", "wcnapi.dll", "wcncsvc.dll", "wcneapauthproxy.dll", "wcneappeerproxy.dll", "wcnnetsh.dll", "wcnwiz.dll", "wc_storage.dll", "wdc.dll", "wdi.dll", "wdigest.dll", "wdscore.dll", "webauthn.dll", "webcamui.dll", "webcheck.dll", "webclnt.dll", "webio.dll", "webservices.dll", "websocket.dll", "wecapi.dll", "wecsvc.dll", "wephostsvc.dll", "wer.dll", "werconcpl.dll", "wercplsupport.dll", "werenc.dll", "weretw.dll", "wersvc.dll", "werui.dll", "wevtapi.dll", "wevtfwd.dll", "wevtsvc.dll", "wfapigp.dll", "wfdprov.dll", "wfdsconmgr.dll", "wfdsconmgrsvc.dll", "wfhc.dll", "whealogr.dll", "whhelper.dll", "wiaaut.dll", "wiadefui.dll", "wiadss.dll", "wiarpc.dll", "wiascanprofiles.dll", "wiaservc.dll", "wiashext.dll", "wiatrace.dll", "wificloudstore.dll", "wificonfigsp.dll", "wifidisplay.dll", "wimgapi.dll", "win32spl.dll", "win32u.dll", "winbio.dll", "winbiodatamodel.dll", "winbioext.dll", "winbrand.dll", "wincorlib.dll", "wincredprovider.dll", "wincredui.dll", "windowmanagement.dll", "windowscodecs.dll", "windowscodecsext.dll", "windowscodecsraw.dll", "windowsiotcsp.dll", "windowslivelogin.dll", "winethc.dll", "winhttp.dll", "winhttpcom.dll", "winhvemulation.dll", "winhvplatform.dll", "wininet.dll", "wininetlui.dll", "wininitext.dll", "winipcfile.dll", "winipcsecproc.dll", "winipsec.dll", "winlangdb.dll", "winlogonext.dll", "winmde.dll", "winml.dll", "winmm.dll", "winmmbase.dll", "winmsipc.dll", "winnlsres.dll", "winnsi.dll", "winreagent.dll", "winrnr.dll", "winrscmd.dll", "winrsmgr.dll", "winrssrv.dll", "winrttracing.dll", "winsatapi.dll", "winscard.dll", "winsetupui.dll", "winshfhc.dll", "winsku.dll", "winsockhc.dll", "winsqlite3.dll", "winsrpc.dll", "winsrv.dll", "winsrvext.dll", "winsta.dll", "winsync.dll", "winsyncmetastore.dll", "winsyncproviders.dll", "wintrust.dll", "wintypes.dll", "winusb.dll", "wirednetworkcsp.dll", "wisp.dll", "wkscli.dll", "wkspbrokerax.dll", "wksprtps.dll", "wkssvc.dll", "wlanapi.dll", "wlancfg.dll", "wlanconn.dll", "wlandlg.dll", "wlangpui.dll", "wlanhc.dll", "wlanhlp.dll", "wlanmediamanager.dll", "wlanmm.dll", "wlanmsm.dll", "wlanpref.dll", "wlanradiomanager.dll", "wlansec.dll", "wlansvc.dll", "wlansvcpal.dll", "wlanui.dll", "wlanutil.dll", "wldap32.dll", "wldp.dll", "wlgpclnt.dll", "wlidcli.dll", "wlidcredprov.dll", "wlidfdp.dll", "wlidnsp.dll", "wlidprov.dll", "wlidres.dll", "wlidsvc.dll", "wmadmod.dll", "wmadmoe.dll", "wmalfxgfxdsp.dll", "wmasf.dll", "wmcodecdspps.dll", "wmdmlog.dll", "wmdmps.dll", "wmdrmsdk.dll", "wmerror.dll", "wmi.dll", "wmiclnt.dll", "wmicmiplugin.dll", "wmidcom.dll", "wmidx.dll", "wmiprop.dll", "wmitomi.dll", "wmnetmgr.dll", "wmp.dll", "wmpdui.dll", "wmpdxm.dll", "wmpeffects.dll", "wmphoto.dll", "wmploc.dll", "wmpps.dll", "wmpshell.dll", "wmsgapi.dll", "wmspdmod.dll", "wmspdmoe.dll", "wmvcore.dll", "wmvdecod.dll", "wmvdspa.dll", "wmvencod.dll", "wmvsdecd.dll", "wmvsencd.dll", "wmvxencd.dll", "woftasks.dll", "wofutil.dll", "wordbreakers.dll", "workfoldersgpext.dll", "workfoldersres.dll", "workfoldersshell.dll", "workfolderssvc.dll", "wosc.dll", "wow64.dll", "wow64cpu.dll", "wow64win.dll", "wpbcreds.dll", "wpc.dll", "wpcapi.dll", "wpcdesktopmonsvc.dll", "wpcproxystubs.dll", "wpcrefreshtask.dll", "wpcwebfilter.dll", "wpdbusenum.dll", "wpdshext.dll", "wpdshserviceobj.dll", "wpdsp.dll", "wpd_ci.dll", "wpnapps.dll", "wpnclient.dll", "wpncore.dll", "wpninprc.dll", "wpnprv.dll", "wpnservice.dll", "wpnsruprov.dll", "wpnuserservice.dll", "wpportinglibrary.dll", "wpprecorderum.dll", "wptaskscheduler.dll", "wpx.dll", "ws2help.dll", "ws2_32.dll", "wscapi.dll", "wscinterop.dll", "wscisvif.dll", "wsclient.dll", "wscproxystub.dll", "wscsvc.dll", "wsdapi.dll", "wsdchngr.dll", "wsdprintproxy.dll", "wsdproviderutil.dll", "wsdscanproxy.dll", "wsecedit.dll", "wsepno.dll", "wshbth.dll", "wshcon.dll", "wshelper.dll", "wshext.dll", "wshhyperv.dll", "wship6.dll", "wshqos.dll", "wshrm.dll", "wshtcpip.dll", "wshunix.dll", "wslapi.dll", "wsmagent.dll", "wsmauto.dll", "wsmplpxy.dll", "wsmres.dll", "wsmsvc.dll", "wsmwmipl.dll", "wsnmp32.dll", "wsock32.dll", "wsplib.dll", "wsp_fs.dll", "wsp_health.dll", "wsp_sr.dll", "wtsapi32.dll", "wuapi.dll", "wuaueng.dll", "wuceffects.dll", "wudfcoinstaller.dll", "wudfplatform.dll", "wudfsmcclassext.dll", "wudfx.dll", "wudfx02000.dll", "wudriver.dll", "wups.dll", "wups2.dll", "wuuhext.dll", "wuuhosdeployment.dll", "wvc.dll", "wwaapi.dll", "wwaext.dll", "wwanapi.dll", "wwancfg.dll", "wwanhc.dll", "wwanprotdim.dll", "wwanradiomanager.dll", "wwansvc.dll", "wwapi.dll", "xamltilerender.dll", "xaudio2_8.dll", "xaudio2_9.dll", "xblauthmanager.dll", "xblgamesave.dll", "xblgamesaveext.dll", "xblgamesaveproxy.dll", "xboxgipsvc.dll", "xboxgipsynthetic.dll", "xboxnetapisvc.dll", "xinput1_4.dll", "xinput9_1_0.dll", "xinputuap.dll", "xmlfilter.dll", "xmllite.dll", "xmlprovi.dll", "xolehlp.dll", "xpsgdiconverter.dll", "xpsprint.dll", "xpspushlayer.dll", "xpsrasterservice.dll", "xpsservices.dll", "xwizards.dll", "xwreg.dll", "xwtpdui.dll", "xwtpw32.dll", "zipcontainer.dll", "zipfldr.dll", "bootsvc.dll", "halextintcpsedma.dll", "icsvcvss.dll", "ieproxydesktop.dll", "lsaadt.dll", "nlansp_c.dll", "nrtapi.dll", "opencl.dll", "pfclient.dll", "pnpdiag.dll", "prxyqry.dll", "rdpnanotransport.dll", "servicingcommon.dll", "sortwindows63.dll", "sstpcfg.dll", "tdhres.dll", "umpodev.dll", "utcapi.dll", "windlp.dll", "wow64base.dll", "wow64con.dll", "blbuires.dll", "bpainst.dll", "cbclient.dll", "certadm.dll", "certocm.dll", "certpick.dll", "csdeployres.dll", "dsdeployres.dll", "eapa3hst.dll", "eapacfg.dll", "eapahost.dll", "elsext.dll", "encdump.dll", "escmigplugin.dll", "fsclient.dll", "fsdeployres.dll", "fssminst.dll", "fssmres.dll", "fssprov.dll", "ipamapi.dll", "kpssvc.dll", "lbfoadminlib.dll", "mintdh.dll", "mmci.dll", "mmcico.dll", "mprsnap.dll", "mstsmhst.dll", "mstsmmc.dll", "muxinst.dll", "personax.dll", "rassfm.dll", "rasuser.dll", "rdmsinst.dll", "rdmsres.dll", "rtrfiltr.dll", "sacsvr.dll", "scrdenrl.dll", "sdclient.dll", "sharedstartmodel.dll", "smsrouter.dll", "spwizimg_svr.dll", "sqlcecompact40.dll", "sqlceoledb40.dll", "sqlceqp40.dll", "sqlcese40.dll", "srvmgrinst.dll", "svrmgrnc.dll", "tapisnap.dll", "tlsbrand.dll", "tsec.dll", "tsprop.dll", "tspubiconhelper.dll", "tssdjet.dll", "tsuserex.dll", "ualapi.dll", "ualsvc.dll", "umcres.dll", "updatehandlers.dll", "usocore.dll", "vssui.dll", "wsbappres.dll", "wsbonline.dll", "wsmselpl.dll", "wsmselrr.dll", "xpsfilt.dll", "xpsshhdr.dll" ) and not ( - (dll.name : "icuuc.dll" and dll.code_signature.subject_name == "Valve" and dll.code_signature.trusted == true) or - (dll.name : "dbghelp.dll" and dll.code_signature.trusted == true) or + ( + dll.name : "icuuc.dll" and dll.code_signature.subject_name in ( + "Valve", "Valve Corp.", "Avanquest Software (7270356 Canada Inc)", "Adobe Inc." + ) and dll.code_signature.trusted == true + ) or + ( + dll.name : ("timeSync.dll", "appInfo.dll") and dll.code_signature.subject_name in ( + "VMware Inc.", "VMware, Inc." + ) and dll.code_signature.trusted == true + ) or + ( + dll.name : "libcrypto.dll" and dll.code_signature.subject_name in ( + "NoMachine S.a.r.l.", "Bitdefender SRL", "Oculus VR, LLC" + ) and dll.code_signature.trusted == true + ) or + ( + dll.name : "ucrtbase.dll" and dll.code_signature.subject_name in ( + "Proofpoint, Inc.", "Rapid7 LLC", "Eclipse.org Foundation, Inc.", "Amazon.com Services LLC", "Windows Phone" + ) and dll.code_signature.trusted == true + ) or + (dll.name : "ICMP.dll" and dll.code_signature.subject_name == "Paessler AG" and dll.code_signature.trusted == true) or + (dll.name : "kerberos.dll" and dll.code_signature.subject_name == "Bitdefender SRL" and dll.code_signature.trusted == true) or + (dll.name : "dbghelp.dll" and dll.code_signature.trusted == true) or (dll.name : "DirectML.dll" and dll.code_signature.subject_name == "Adobe Inc." and dll.code_signature.trusted == true) or ( dll.path : ( From 8035516e8e497fccd069e8e51c3241c75f98db49 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 17 Oct 2023 08:53:37 -0300 Subject: [PATCH 37/86] [Rule Tuning] Potential Masquerading as Browser Process (#3180) * [Rule Tuning] Potential Masquerading as Browser Process * Update defense_evasion_masquerading_browsers.toml * Update defense_evasion_masquerading_browsers.toml --- ...defense_evasion_masquerading_browsers.toml | 38 ++++++++++++++++--- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/rules_building_block/defense_evasion_masquerading_browsers.toml b/rules_building_block/defense_evasion_masquerading_browsers.toml index 70ea4e1dd..86d610a64 100644 --- a/rules_building_block/defense_evasion_masquerading_browsers.toml +++ b/rules_building_block/defense_evasion_masquerading_browsers.toml @@ -40,10 +40,26 @@ process where host.os.type == "windows" and event.type == "start" and (process.code_signature.subject_name : ("Google LLC", "Google Inc") and process.code_signature.trusted == true) and not ( - process.executable : "?:\\Program Files\\HP\\Sure Click\\servers\\chrome.exe" and + process.executable : ( + "?:\\Program Files\\HP\\Sure Click\\servers\\chrome.exe", + "?:\\Program Files\\HP\\Sure Click\\*\\servers\\chrome.exe" + ) and process.code_signature.subject_name : ("Bromium, Inc.") and process.code_signature.trusted == true - ) - and not process.hash.sha256 : "6538d54a236349f880d6793d219f558764629efc85d4d08b56b94717c01fb25a" + ) and + not ( + process.executable : ( + "?:\\Users\\*\\AppData\\Local\\ms-playwright\\chromium-*\\chrome-win\\chrome.exe", + "?:\\Users\\*\\AppData\\Local\\Programs\\synthetics-recorder\\resources\\local-browsers\\chromium-*\\chrome-win\\chrome.exe", + "*\\node_modules\\puppeteer\\.local-chromium\\win64-*\\chrome-win\\chrome.exe", + "?:\\Program Files (x86)\\Invicti Professional Edition\\chromium\\chrome.exe", + "?:\\Program Files\\End2End, Inc\\ARMS Html Engine\\chrome.exe", + "?:\\Users\\*\\AppData\\Local\\*BurpSuitePro\\burpbrowser\\*\\chrome.exe", + "?:\\Users\\*\\AppData\\Roaming\\*BurpSuite\\burpbrowser\\*\\chrome.exe" + ) and process.args: ( + "--enable-features=NetworkService,NetworkServiceInProcess", + "--type=crashpad-handler", "--enable-automation", "--disable-xss-auditor" + ) + ) ) or /* MS Edge Related Processes */ @@ -54,6 +70,11 @@ process where host.os.type == "windows" and event.type == "start" and "MicrosoftEdgeUpdateComRegisterShell64.exe", "msedgerecovery.exe", "MicrosoftEdgeUpdateSetup.exe" ) and not (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) + and not + ( + process.name : "msedgewebview2.exe" and + process.code_signature.subject_name : ("Bromium, Inc.") and process.code_signature.trusted == true + ) ) or /* Brave Related Processes */ @@ -69,9 +90,14 @@ process where host.os.type == "windows" and event.type == "start" and (process.name : ( "firefox.exe", "pingsender.exe", "default-browser-agent.exe", "maintenanceservice.exe", "plugin-container.exe", "maintenanceservice_tmp.exe", "maintenanceservice_installer.exe", - "minidump-analyzer.exe", "crashreporter.exe" + "minidump-analyzer.exe" ) and not (process.code_signature.subject_name : "Mozilla Corporation" and process.code_signature.trusted == true) + and not + ( + process.name : "default-browser-agent.exe" and + process.code_signature.subject_name : ("WATERFOX LIMITED") and process.code_signature.trusted == true + ) ) or /* Island Related Processes */ @@ -108,7 +134,9 @@ process where host.os.type == "windows" and event.type == "start" and "Google LLC", "Google Inc", "Microsoft Corporation", - "NAVER Corp." + "NAVER Corp.", + "AVG Technologies USA, LLC", + "Avast Software s.r.o." ) and process.code_signature.trusted == true ) ) From a33a124eab4e5ca95e099480058c6c59d520ea2d Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 17 Oct 2023 09:35:38 -0300 Subject: [PATCH 38/86] [New Rule] [BBR] Memory Dump File Rules (#3122) * [New Rule] Memory Dump File Rules * . * . * . --- .../credential_access_mdmp_file_creation.toml | 88 +++++++++++++++++++ ...al_access_mdmp_file_unusual_extension.toml | 77 ++++++++++++++++ 2 files changed, 165 insertions(+) create mode 100644 rules_building_block/credential_access_mdmp_file_creation.toml create mode 100644 rules_building_block/credential_access_mdmp_file_unusual_extension.toml diff --git a/rules_building_block/credential_access_mdmp_file_creation.toml b/rules_building_block/credential_access_mdmp_file_creation.toml new file mode 100644 index 000000000..fd56e0601 --- /dev/null +++ b/rules_building_block/credential_access_mdmp_file_creation.toml @@ -0,0 +1,88 @@ +[metadata] +creation_date = "2023/09/21" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies the creation or modification of a medium size memory dump file which can indicate an attempt to access +credentials from a process memory. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Credential Access via Memory Dump File Creation" +risk_score = 21 +rule_id = "e707a7be-cc52-41ac-8ab3-d34b38c20005" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +file where host.os.type == "windows" and event.type == "creation" and + + /* MDMP header */ + file.Ext.header_bytes : "4d444d50*" and file.size >= 30000 and + not + + ( + ( + process.executable : ( + "?:\\Windows\\System32\\WerFault.exe", + "?:\\Windows\\SysWOW64\\WerFault.exe", + "?:\\Windows\\System32\\Wermgr.exe", + "?:\\Windows\\SysWOW64\\Wermgr.exe", + "?:\\Windows\\System32\\WerFaultSecure.exe", + "?:\\Windows\\System32\\WUDFHost.exe", + "?:\\Windows\\System32\\Taskmgr.exe", + "?:\\Windows\\SysWOW64\\Taskmgr.exe", + "?:\\Program Files\\*.exe", + "?:\\Program Files (x86)\\*.exe", + "?:\\Windows\\SystemApps\\*.exe", + "?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin\\zCrashReport64.exe" + ) and process.code_signature.trusted == true + ) or + ( + file.path : ( + "?:\\ProgramData\\Microsoft\\Windows\\WER\\*", + "?:\\ProgramData\\Microsoft\\WDF\\*", + "?:\\ProgramData\\Alteryx\\ErrorLogs\\*", + "?:\\ProgramData\\Goodix\\*", + "?:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\*", + "?:\\Users\\*\\AppData\\Roaming\\Zoom\\logs\\zoomcrash*", + "?:\\Users\\*\\AppData\\*\\Crashpad\\*", + "?:\\Users\\*\\AppData\\*\\crashpaddb\\*", + "?:\\Users\\*\\AppData\\*\\HungReports\\*", + "?:\\Users\\*\\AppData\\*\\CrashDumps\\*", + "?:\\Users\\*\\AppData\\*\\NativeCrashReporting\\*" + ) and (process.code_signature.trusted == true or process.executable == null) + ) + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1003" +name = "OS Credential Dumping" +reference = "https://attack.mitre.org/techniques/T1003/" +[[rule.threat.technique.subtechnique]] +id = "T1003.001" +name = "LSASS Memory" +reference = "https://attack.mitre.org/techniques/T1003/001/" + + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/" diff --git a/rules_building_block/credential_access_mdmp_file_unusual_extension.toml b/rules_building_block/credential_access_mdmp_file_unusual_extension.toml new file mode 100644 index 000000000..e142da657 --- /dev/null +++ b/rules_building_block/credential_access_mdmp_file_unusual_extension.toml @@ -0,0 +1,77 @@ +[metadata] +creation_date = "2023/09/21" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies the creation of a memory dump file with an unusual extension, which can indicate an attempt to disguise a +memory dump as another file type to bypass security defenses. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Memory Dump File with Unusual Extension" +risk_score = 21 +rule_id = "c0b9dc99-c696-4779-b086-0d37dc2b3778" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +file where host.os.type == "windows" and event.type == "creation" and + + /* MDMP header */ + file.Ext.header_bytes : "4d444d50*" and + not file.extension : ("dmp", "mdmp", "hdmp", "edmp", "full", "tdref", "cg", "tmp", "dat") and + not + ( + process.executable : "?:\\Program Files\\Endgame\\esensor.exe" and + process.code_signature.trusted == true and length(file.extension) == 0 + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1003" +name = "OS Credential Dumping" +reference = "https://attack.mitre.org/techniques/T1003/" +[[rule.threat.technique.subtechnique]] +id = "T1003.001" +name = "LSASS Memory" +reference = "https://attack.mitre.org/techniques/T1003/001/" + + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.008" +name = "Masquerade File Type" +reference = "https://attack.mitre.org/techniques/T1036/008/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" From 1801a4ee7ee7258e333d1bd7f21e999717d175a6 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Tue, 17 Oct 2023 18:25:55 +0530 Subject: [PATCH 39/86] Setup information for Linux Rules - Set2 (#3177) --- ...mand_and_control_cat_network_activity.toml | 29 +++++++++++++- ..._control_linux_chisel_client_activity.toml | 29 +++++++++++++- ..._control_linux_chisel_server_activity.toml | 29 +++++++++++++- ...linux_suspicious_proxychains_activity.toml | 29 +++++++++++++- ...l_linux_tunneling_and_port_forwarding.toml | 29 +++++++++++++- ...ial_access_collection_sensitive_files.toml | 39 ++++++++++++++++++- .../credential_access_credential_dumping.toml | 29 +++++++++++++- ...redential_access_gdb_init_memory_dump.toml | 29 +++++++++++++- ...ential_linux_local_account_bruteforce.toml | 29 +++++++++++++- ...ential_access_proc_credential_dumping.toml | 29 +++++++++++++- 10 files changed, 290 insertions(+), 10 deletions(-) diff --git a/rules/linux/command_and_control_cat_network_activity.toml b/rules/linux/command_and_control_cat_network_activity.toml index 39cb4ed43..2946f3415 100644 --- a/rules/linux/command_and_control_cat_network_activity.toml +++ b/rules/linux/command_and_control_cat_network_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/04" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Network Activity Detected via cat" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "afd04601-12fc-4149-9b78-9c3f8fe45d39" severity = "medium" diff --git a/rules/linux/command_and_control_linux_chisel_client_activity.toml b/rules/linux/command_and_control_linux_chisel_client_activity.toml index d1738432e..53218eab2 100644 --- a/rules/linux/command_and_control_linux_chisel_client_activity.toml +++ b/rules/linux/command_and_control_linux_chisel_client_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Protocol Tunneling via Chisel Client" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" diff --git a/rules/linux/command_and_control_linux_chisel_server_activity.toml b/rules/linux/command_and_control_linux_chisel_server_activity.toml index 4d75f2134..9b992c98d 100644 --- a/rules/linux/command_and_control_linux_chisel_server_activity.toml +++ b/rules/linux/command_and_control_linux_chisel_server_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Protocol Tunneling via Chisel Server" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" diff --git a/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml b/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml index 5efa70cd1..2d9e257c8 100644 --- a/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml +++ b/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Utility Launched via ProxyChains" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform"] risk_score = 21 rule_id = "6ace94ba-f02c-4d55-9f53-87d99b6f9af4" diff --git a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml index 35bbfce1f..631ded63f 100644 --- a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml +++ b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/23" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Tunneling and/or Port Forwarding" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" diff --git a/rules/linux/credential_access_collection_sensitive_files.toml b/rules/linux/credential_access_collection_sensitive_files.toml index 3a443d1c5..1f19abe17 100644 --- a/rules/linux/credential_access_collection_sensitive_files.toml +++ b/rules/linux/credential_access_collection_sensitive_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -17,6 +17,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Sensitive Files Compression" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = [ "https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html", ] diff --git a/rules/linux/credential_access_credential_dumping.toml b/rules/linux/credential_access_credential_dumping.toml index 61cd91c34..8a71f7297 100644 --- a/rules/linux/credential_access_credential_dumping.toml +++ b/rules/linux/credential_access_credential_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -21,6 +21,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Credential Dumping via Unshadow" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/", ] diff --git a/rules/linux/credential_access_gdb_init_memory_dump.toml b/rules/linux/credential_access_gdb_init_memory_dump.toml index c1d71fc94..d7c8f8555 100644 --- a/rules/linux/credential_access_gdb_init_memory_dump.toml +++ b/rules/linux/credential_access_gdb_init_memory_dump.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/30" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Linux init (PID 1) Secret Dump via GDB" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/controlplaneio/truffleproc", "https://github.com/hajzer/bash-memory-dump" diff --git a/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml b/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml index 1f1ecf4d2..ce1771e1a 100644 --- a/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml +++ b/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Local Account Brute Force Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "835c0622-114e-40b5-a346-f843ea5d01f1" severity = "medium" diff --git a/rules/linux/credential_access_proc_credential_dumping.toml b/rules/linux/credential_access_proc_credential_dumping.toml index 6cea68f70..e5884bc18 100644 --- a/rules/linux/credential_access_proc_credential_dumping.toml +++ b/rules/linux/credential_access_proc_credential_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/04/26" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Credential Dumping via Proc Filesystem" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/huntergregal/mimipenguin", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781" From d2c2987d726e6a5aeef4138416a18fd88dfda077 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Tue, 17 Oct 2023 18:37:20 +0530 Subject: [PATCH 40/86] Setup information for Linux Rules - Set3 (#3178) --- ...tempt_to_disable_iptables_or_firewall.toml | 29 +++++++++++++- ...ion_attempt_to_disable_syslog_service.toml | 39 ++++++++++++++++++- ..._base32_encoding_or_decoding_activity.toml | 39 ++++++++++++++++++- ...binary_copied_to_suspicious_directory.toml | 29 +++++++++++++- ...ense_evasion_disable_apparmor_attempt.toml | 29 +++++++++++++- ...fense_evasion_disable_selinux_attempt.toml | 39 ++++++++++++++++++- ...asion_esxi_suspicious_timestomp_touch.toml | 29 +++++++++++++- ...fense_evasion_file_deletion_via_shred.toml | 29 +++++++++++++- ...defense_evasion_file_mod_writable_dir.toml | 39 ++++++++++++++++++- ...defense_evasion_kernel_module_removal.toml | 29 +++++++++++++- 10 files changed, 320 insertions(+), 10 deletions(-) diff --git a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml index b63cb750d..e224747dc 100644 --- a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml +++ b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -17,6 +17,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Attempt to Disable IPTables or Firewall" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f" severity = "low" diff --git a/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml b/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml index 38099dc7d..d28cfd3b7 100644 --- a/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml +++ b/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/28" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -17,6 +17,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Attempt to Disable Syslog Service" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" risk_score = 47 rule_id = "2f8a1226-5720-437d-9c20-e0029deb6194" severity = "medium" diff --git a/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml b/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml index b2c598330..951e72697 100644 --- a/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml +++ b/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,6 +20,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Base16 or Base32 Encoding/Decoding Activity" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" risk_score = 21 rule_id = "debff20a-46bc-4a4d-bae5-5cdd14222795" severity = "low" diff --git a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml index 593d8d909..6bb693d13 100644 --- a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml +++ b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/29" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "System Binary Copied and/or Moved to Suspicious Directory" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "fda1d332-5e08-4f27-8a9b-8c802e3292a6" severity = "low" diff --git a/rules/linux/defense_evasion_disable_apparmor_attempt.toml b/rules/linux/defense_evasion_disable_apparmor_attempt.toml index cce4ddafc..bf2d524e5 100644 --- a/rules/linux/defense_evasion_disable_apparmor_attempt.toml +++ b/rules/linux/defense_evasion_disable_apparmor_attempt.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/28" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Disabling of AppArmor" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "fac52c69-2646-4e79-89c0-fd7653461010" severity = "low" diff --git a/rules/linux/defense_evasion_disable_selinux_attempt.toml b/rules/linux/defense_evasion_disable_selinux_attempt.toml index 2e63d67c3..40837200a 100644 --- a/rules/linux/defense_evasion_disable_selinux_attempt.toml +++ b/rules/linux/defense_evasion_disable_selinux_attempt.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Potential Disabling of SELinux" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" risk_score = 47 rule_id = "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e" severity = "medium" diff --git a/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml b/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml index fb836c5a3..df389e59c 100644 --- a/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml +++ b/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/04/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "ESXI Timestomping using Touch Command" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", ] diff --git a/rules/linux/defense_evasion_file_deletion_via_shred.toml b/rules/linux/defense_evasion_file_deletion_via_shred.toml index 58e8df6f5..a1ff0b905 100644 --- a/rules/linux/defense_evasion_file_deletion_via_shred.toml +++ b/rules/linux/defense_evasion_file_deletion_via_shred.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "kuery" license = "Elastic License v2" name = "File Deletion via Shred" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "a1329140-8de3-4445-9f87-908fb6d824f4" severity = "low" diff --git a/rules/linux/defense_evasion_file_mod_writable_dir.toml b/rules/linux/defense_evasion_file_mod_writable_dir.toml index 92f58b926..da7b76f20 100644 --- a/rules/linux/defense_evasion_file_mod_writable_dir.toml +++ b/rules/linux/defense_evasion_file_mod_writable_dir.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/25" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -23,6 +23,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "File Permission Modification in Writable Directory" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" risk_score = 21 rule_id = "9f9a2a82-93a8-4b1a-8778-1780895626d4" severity = "low" diff --git a/rules/linux/defense_evasion_kernel_module_removal.toml b/rules/linux/defense_evasion_kernel_module_removal.toml index bb6b41ce3..cf28e0f4d 100644 --- a/rules/linux/defense_evasion_kernel_module_removal.toml +++ b/rules/linux/defense_evasion_kernel_module_removal.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,6 +24,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Kernel Module Removal" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["http://man7.org/linux/man-pages/man8/modprobe.8.html"] risk_score = 47 rule_id = "cd66a5af-e34b-4bb0-8931-57d0a043f2ef" From 25b527c14978707720a9624b3e50b90e8e1b1dd5 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Tue, 17 Oct 2023 18:59:31 +0530 Subject: [PATCH 41/86] Setup information for Linux Rules - Set4 (#3179) --- .../defense_evasion_mount_execution.toml | 29 +++++++++++++- ...ense_evasion_potential_proot_exploits.toml | 29 +++++++++++++- .../defense_evasion_rename_esxi_files.toml | 29 +++++++++++++- ...efense_evasion_rename_esxi_index_file.toml | 29 +++++++++++++- .../discovery_esxi_software_via_find.toml | 29 +++++++++++++- .../discovery_esxi_software_via_grep.toml | 29 +++++++++++++- .../discovery_kernel_module_enumeration.toml | 29 +++++++++++++- .../linux/discovery_linux_hping_activity.toml | 39 ++++++++++++++++++- .../linux/discovery_linux_nping_activity.toml | 39 ++++++++++++++++++- ...very_sudo_allowed_command_enumeration.toml | 29 +++++++++++++- .../discovery_suid_sguid_enumeration.toml | 29 +++++++++++++- ...overy_unusual_user_enumeration_via_id.toml | 29 +++++++++++++- ...covery_virtual_machine_fingerprinting.toml | 39 ++++++++++++++++++- 13 files changed, 394 insertions(+), 13 deletions(-) diff --git a/rules/linux/defense_evasion_mount_execution.toml b/rules/linux/defense_evasion_mount_execution.toml index 18d005f07..5f9dc8eba 100644 --- a/rules/linux/defense_evasion_mount_execution.toml +++ b/rules/linux/defense_evasion_mount_execution.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -22,6 +22,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Hidden Process via Mount Hidepid" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/", ] diff --git a/rules/linux/defense_evasion_potential_proot_exploits.toml b/rules/linux/defense_evasion_potential_proot_exploits.toml index ed827eebb..650131797 100644 --- a/rules/linux/defense_evasion_potential_proot_exploits.toml +++ b/rules/linux/defense_evasion_potential_proot_exploits.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/03/07" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -25,6 +25,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Defense Evasion via PRoot" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://proot-me.github.io/", ] diff --git a/rules/linux/defense_evasion_rename_esxi_files.toml b/rules/linux/defense_evasion_rename_esxi_files.toml index 03fd982a3..eb5d40724 100644 --- a/rules/linux/defense_evasion_rename_esxi_files.toml +++ b/rules/linux/defense_evasion_rename_esxi_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/04/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Renaming of ESXI Files" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", ] diff --git a/rules/linux/defense_evasion_rename_esxi_index_file.toml b/rules/linux/defense_evasion_rename_esxi_index_file.toml index d71c8b051..cb4c0ac9b 100644 --- a/rules/linux/defense_evasion_rename_esxi_index_file.toml +++ b/rules/linux/defense_evasion_rename_esxi_index_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/04/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Renaming of ESXI index.html File" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", ] diff --git a/rules/linux/discovery_esxi_software_via_find.toml b/rules/linux/discovery_esxi_software_via_find.toml index 64ebdb855..f33e3aaee 100644 --- a/rules/linux/discovery_esxi_software_via_find.toml +++ b/rules/linux/discovery_esxi_software_via_find.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/04/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "ESXI Discovery via Find" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", ] diff --git a/rules/linux/discovery_esxi_software_via_grep.toml b/rules/linux/discovery_esxi_software_via_grep.toml index 309468451..494b5eb31 100644 --- a/rules/linux/discovery_esxi_software_via_grep.toml +++ b/rules/linux/discovery_esxi_software_via_grep.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "ESXI Discovery via Grep" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", ] diff --git a/rules/linux/discovery_kernel_module_enumeration.toml b/rules/linux/discovery_kernel_module_enumeration.toml index 863c343d2..2418d442b 100644 --- a/rules/linux/discovery_kernel_module_enumeration.toml +++ b/rules/linux/discovery_kernel_module_enumeration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,6 +24,33 @@ index = ["logs-endpoint.events.*"] language = "kuery" license = "Elastic License v2" name = "Enumeration of Kernel Modules" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "2d8043ed-5bda-4caf-801c-c1feb7410504" severity = "medium" diff --git a/rules/linux/discovery_linux_hping_activity.toml b/rules/linux/discovery_linux_hping_activity.toml index c28247d52..632a78e93 100644 --- a/rules/linux/discovery_linux_hping_activity.toml +++ b/rules/linux/discovery_linux_hping_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -23,6 +23,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Hping Process Activity" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = ["https://en.wikipedia.org/wiki/Hping"] risk_score = 47 rule_id = "90169566-2260-4824-b8e4-8615c3b4ed52" diff --git a/rules/linux/discovery_linux_nping_activity.toml b/rules/linux/discovery_linux_nping_activity.toml index 4b58715db..774cf5de7 100644 --- a/rules/linux/discovery_linux_nping_activity.toml +++ b/rules/linux/discovery_linux_nping_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -23,6 +23,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Nping Process Activity" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = ["https://en.wikipedia.org/wiki/Nmap"] risk_score = 47 rule_id = "0d69150b-96f8-467c-a86d-a67a3378ce77" diff --git a/rules/linux/discovery_sudo_allowed_command_enumeration.toml b/rules/linux/discovery_sudo_allowed_command_enumeration.toml index f3f6dbc7a..7bfb7ed0c 100644 --- a/rules/linux/discovery_sudo_allowed_command_enumeration.toml +++ b/rules/linux/discovery_sudo_allowed_command_enumeration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/30" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Sudo Command Enumeration Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "28d39238-0c01-420a-b77a-24e5a7378663" severity = "low" diff --git a/rules/linux/discovery_suid_sguid_enumeration.toml b/rules/linux/discovery_suid_sguid_enumeration.toml index 3603a08b8..2c61a6d78 100644 --- a/rules/linux/discovery_suid_sguid_enumeration.toml +++ b/rules/linux/discovery_suid_sguid_enumeration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/24" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "SUID/SGUID Enumeration Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "5b06a27f-ad72-4499-91db-0c69667bffa5" severity = "low" diff --git a/rules/linux/discovery_unusual_user_enumeration_via_id.toml b/rules/linux/discovery_unusual_user_enumeration_via_id.toml index f7c1fcf9f..d7be298e9 100644 --- a/rules/linux/discovery_unusual_user_enumeration_via_id.toml +++ b/rules/linux/discovery_unusual_user_enumeration_via_id.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/29" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Unusual User Privilege Enumeration via id" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "afa135c0-a365-43ab-aa35-fd86df314a47" severity = "low" diff --git a/rules/linux/discovery_virtual_machine_fingerprinting.toml b/rules/linux/discovery_virtual_machine_fingerprinting.toml index 6933b4667..9ddf29a70 100644 --- a/rules/linux/discovery_virtual_machine_fingerprinting.toml +++ b/rules/linux/discovery_virtual_machine_fingerprinting.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -24,6 +24,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Virtual Machine Fingerprinting" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" risk_score = 73 rule_id = "5b03c9fb-9945-4d2f-9568-fd690fee3fba" severity = "high" From 2a48db0598fbefb3d3ce6235fcb6f3d6cb7001d8 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Tue, 17 Oct 2023 19:11:20 +0530 Subject: [PATCH 42/86] Setup information for Linux Rules - Set5 (#3188) --- ...tion_abnormal_process_id_file_created.toml | 29 ++++++++++- ...n_file_execution_followed_by_deletion.toml | 29 ++++++++++- ...er_or_listener_established_via_netcat.toml | 39 ++++++++++++++- ...cution_network_event_post_compilation.toml | 29 ++++++++++- rules/linux/execution_perl_tty_shell.toml | 39 ++++++++++++++- ..._process_started_from_process_id_file.toml | 32 +++++++++++- ...ss_started_in_shared_memory_directory.toml | 29 ++++++++++- rules/linux/execution_python_tty_shell.toml | 29 ++++++++++- ..._remote_code_execution_via_postgresql.toml | 29 ++++++++++- ...uspicious_parent_child_revshell_linux.toml | 29 ++++++++++- ...xecution_shell_via_background_process.toml | 29 ++++++++++- ...ecution_shell_via_java_revshell_linux.toml | 29 ++++++++++- ...on_shell_via_lolbin_interpreter_linux.toml | 29 ++++++++++- ...execution_shell_via_meterpreter_linux.toml | 49 ++++++++++++------- ...execution_shell_via_suspicious_binary.toml | 29 ++++++++++- ...ution_shell_via_tcp_cli_utility_linux.toml | 29 ++++++++++- ...ution_shell_via_udp_cli_utility_linux.toml | 47 ++++++++++++------ ...traction_or_decrompression_via_funzip.toml | 29 ++++++++++- ...us_executable_running_system_commands.toml | 29 ++++++++++- ...icious_mining_process_creation_events.toml | 29 ++++++++++- rules/linux/execution_tc_bpf_filter.toml | 29 ++++++++++- 21 files changed, 619 insertions(+), 51 deletions(-) diff --git a/rules/linux/execution_abnormal_process_id_file_created.toml b/rules/linux/execution_abnormal_process_id_file_created.toml index 0530134d6..03d163914 100644 --- a/rules/linux/execution_abnormal_process_id_file_created.toml +++ b/rules/linux/execution_abnormal_process_id_file_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/08/31" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -64,6 +64,33 @@ This rule identifies the creation of PID, lock, or reboot files in the /var/run/ - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", diff --git a/rules/linux/execution_file_execution_followed_by_deletion.toml b/rules/linux/execution_file_execution_followed_by_deletion.toml index 64b8c70bb..69a60e738 100644 --- a/rules/linux/execution_file_execution_followed_by_deletion.toml +++ b/rules/linux/execution_file_execution_followed_by_deletion.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/28" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "File Creation, Execution and Self-Deletion in Suspicious Directory" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "09bc6c90-7501-494d-b015-5d988dc3f233" severity = "medium" diff --git a/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml b/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml index a42656946..7ca4d1300 100644 --- a/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml +++ b/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -62,6 +62,43 @@ This rule identifies potential reverse shell or bind shell activity using Netcat - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + """ references = [ "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", diff --git a/rules/linux/execution_network_event_post_compilation.toml b/rules/linux/execution_network_event_post_compilation.toml index 4e006cd92..682715c08 100644 --- a/rules/linux/execution_network_event_post_compilation.toml +++ b/rules/linux/execution_network_event_post_compilation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/28" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Network Connection via Recently Compiled Executable" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "64cfca9e-0f6f-4048-8251-9ec56a055e9e" severity = "medium" diff --git a/rules/linux/execution_perl_tty_shell.toml b/rules/linux/execution_perl_tty_shell.toml index 5ba37257c..44fc9377a 100644 --- a/rules/linux/execution_perl_tty_shell.toml +++ b/rules/linux/execution_perl_tty_shell.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -17,6 +17,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Interactive Terminal Spawned via Perl" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" risk_score = 73 rule_id = "05e5a668-7b51-4a67-93ab-e9af405c9ef3" severity = "high" diff --git a/rules/linux/execution_process_started_from_process_id_file.toml b/rules/linux/execution_process_started_from_process_id_file.toml index d5c18644d..c3bb4ef24 100644 --- a/rules/linux/execution_process_started_from_process_id_file.toml +++ b/rules/linux/execution_process_started_from_process_id_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -31,7 +31,35 @@ note = """## Triage and analysis Detection alerts from this rule indicate a process spawned from an executable masqueraded as a legitimate PID file which is very unusual and should not occur. Here are some possible avenues of investigation: - Examine parent and child process relationships of the new process to determine if other processes are running. - Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: "SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';" -- Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation.""" +- Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation. + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", "https://twitter.com/GossiTheDog/status/1522964028284411907", diff --git a/rules/linux/execution_process_started_in_shared_memory_directory.toml b/rules/linux/execution_process_started_in_shared_memory_directory.toml index 097216c02..e5cf38c38 100644 --- a/rules/linux/execution_process_started_in_shared_memory_directory.toml +++ b/rules/linux/execution_process_started_in_shared_memory_directory.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -25,6 +25,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Binary Executed from Shared Memory Directory" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://linuxsecurity.com/features/fileless-malware-on-linux", "https://twitter.com/GossiTheDog/status/1522964028284411907", diff --git a/rules/linux/execution_python_tty_shell.toml b/rules/linux/execution_python_tty_shell.toml index 9e121608a..d07a62e87 100644 --- a/rules/linux/execution_python_tty_shell.toml +++ b/rules/linux/execution_python_tty_shell.toml @@ -2,7 +2,7 @@ creation_date = "2020/04/15" integration = ["endpoint"] maturity = "production" -updated_date = "2023/06/29" +updated_date = "2023/10/16" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -17,6 +17,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Interactive Terminal Spawned via Python" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 73 rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f" severity = "high" diff --git a/rules/linux/execution_remote_code_execution_via_postgresql.toml b/rules/linux/execution_remote_code_execution_via_postgresql.toml index 53c2fbe20..797349051 100644 --- a/rules/linux/execution_remote_code_execution_via_postgresql.toml +++ b/rules/linux/execution_remote_code_execution_via_postgresql.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Code Execution via Postgresql" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "2a692072-d78d-42f3-a48a-775677d79c4e" severity = "medium" diff --git a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml index 7bc39e984..56ba42a8d 100644 --- a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml +++ b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/10" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Suspicious Parent Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" ] diff --git a/rules/linux/execution_shell_via_background_process.toml b/rules/linux/execution_shell_via_background_process.toml index e997bf007..d07cc37b0 100644 --- a/rules/linux/execution_shell_via_background_process.toml +++ b/rules/linux/execution_shell_via_background_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/20" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -17,6 +17,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Background Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39" severity = "medium" diff --git a/rules/linux/execution_shell_via_java_revshell_linux.toml b/rules/linux/execution_shell_via_java_revshell_linux.toml index e2b712f00..592cd40df 100644 --- a/rules/linux/execution_shell_via_java_revshell_linux.toml +++ b/rules/linux/execution_shell_via_java_revshell_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/25" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -17,6 +17,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Java" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" ] diff --git a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml index a865fa968..d87055208 100644 --- a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml +++ b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/10" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Suspicious Child Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" ] diff --git a/rules/linux/execution_shell_via_meterpreter_linux.toml b/rules/linux/execution_shell_via_meterpreter_linux.toml index 9488c98c5..d9b08d448 100644 --- a/rules/linux/execution_shell_via_meterpreter_linux.toml +++ b/rules/linux/execution_shell_via_meterpreter_linux.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "The sampling feature within EQL was introduced in 8.6.0" min_stack_version = "8.6.0" -updated_date = "2023/08/10" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,27 +19,42 @@ language = "eql" license = "Elastic License v2" name = "Potential Meterpreter Reverse Shell" note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. +## Setup -``` -Kibana --> -Management --> -Integrations --> -Auditd Manager --> -Add Auditd Manager -``` +This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -For this detection rule to trigger, the following additional audit rules are required to be added to the integration: +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). -``` --w /proc/net/ -p r -k audit_proc --w /etc/machine-id -p wa -k machineid --w /etc/passwd -p wa -k passwd -``` +### Auditd Manager Integration Setup +The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. +Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. + +#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Auditd Manager and select the integration to see more details about it. +- Click Add Auditd Manager. +- Configure the integration name and optionally add a description. +- Review optional and advanced settings accordingly. +- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click Save and Continue. +- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). + +#### Rule Specific Setup Note +Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. +However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +- For this detection rule the following additional audit rules are required to be added to the integration: + -w /proc/net/ -p r -k audit_proc + -w /etc/machine-id -p wa -k machineid + -w /etc/passwd -p wa -k passwd -Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. """ risk_score = 47 rule_id = "5c895b4f-9133-4e68-9e23-59902175355c" diff --git a/rules/linux/execution_shell_via_suspicious_binary.toml b/rules/linux/execution_shell_via_suspicious_binary.toml index 1c7eb1c65..6e7a7ea43 100644 --- a/rules/linux/execution_shell_via_suspicious_binary.toml +++ b/rules/linux/execution_shell_via_suspicious_binary.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/10" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Suspicious Binary" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" ] diff --git a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml index eab506658..6ec8c3330 100644 --- a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/10" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" ] diff --git a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml index e8043f85c..103a84f7e 100644 --- a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "The sampling feature within EQL was introduced in 8.6.0" min_stack_version = "8.6.0" -updated_date = "2023/07/04" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,19 +20,38 @@ language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via UDP" note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. -``` -Kibana --> -Management --> -Integrations --> -Auditd Manager --> -Add Auditd Manager -``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. -``` -For this detection rule no additional audit rules are required to be added to the integration. -``` -Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. + +This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +### Auditd Manager Integration Setup +The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. +Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. + +#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Auditd Manager and select the integration to see more details about it. +- Click Add Auditd Manager. +- Configure the integration name and optionally add a description. +- Review optional and advanced settings accordingly. +- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click Save and Continue. +- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). + +#### Rule Specific Setup Note +Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. +However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +- For this detection rule no additional audit rules are required to be added to the integration. + """ references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" diff --git a/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml b/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml index ad404d299..7e07c79a9 100644 --- a/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml +++ b/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/26" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious Content Extracted or Decompressed via Funzip" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://attack.mitre.org/software/S0482/" ] diff --git a/rules/linux/execution_suspicious_executable_running_system_commands.toml b/rules/linux/execution_suspicious_executable_running_system_commands.toml index 4d11a35ee..c922a56ba 100644 --- a/rules/linux/execution_suspicious_executable_running_system_commands.toml +++ b/rules/linux/execution_suspicious_executable_running_system_commands.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "The single field New Term rule type used in this rule was added in Elastic 8.4" min_stack_version = "8.4.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Suspicious System Commands Executed by Previously Unknown Executable" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "e9001ee6-2d00-4d2f-849e-b8b1fb05234c" severity = "low" diff --git a/rules/linux/execution_suspicious_mining_process_creation_events.toml b/rules/linux/execution_suspicious_mining_process_creation_events.toml index a651d2da4..ac82791ee 100644 --- a/rules/linux/execution_suspicious_mining_process_creation_events.toml +++ b/rules/linux/execution_suspicious_mining_process_creation_events.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -17,6 +17,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious Mining Process Creation Event" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "e2258f48-ba75-4248-951b-7c885edf18c2" severity = "medium" diff --git a/rules/linux/execution_tc_bpf_filter.toml b/rules/linux/execution_tc_bpf_filter.toml index d46111522..cc89f4b77 100644 --- a/rules/linux/execution_tc_bpf_filter.toml +++ b/rules/linux/execution_tc_bpf_filter.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/11" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" integration = ["endpoint"] [rule] @@ -16,6 +16,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "BPF filter applied using TC" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://github.com/h3xduck/TripleCross/blob/master/src/helpers/deployer.sh", "https://man7.org/linux/man-pages/man8/tc.8.html", From 5a98208b530d7f13719dbdf4b9ed0acd2bcad045 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Tue, 17 Oct 2023 19:33:07 +0530 Subject: [PATCH 43/86] Setup information for Linux Rules - Set6 (#3189) --- .../impact_data_encrypted_via_openssl.toml | 29 +++++++++++++- rules/linux/impact_esxi_process_kill.toml | 29 +++++++++++++- ...tial_linux_ransomware_file_encryption.toml | 29 +++++++++++++- ...ential_linux_ransomware_note_detected.toml | 29 +++++++++++++- .../linux/impact_process_kill_threshold.toml | 29 +++++++++++++- ...ment_telnet_network_activity_external.toml | 39 ++++++++++++++++++- ...ment_telnet_network_activity_internal.toml | 39 ++++++++++++++++++- .../persistence_chkconfig_service_add.toml | 29 +++++++++++++- ...credential_access_modify_ssh_binaries.toml | 39 ++++++++++++++++++- .../linux/persistence_cron_job_creation.toml | 29 +++++++++++++- .../persistence_dynamic_linker_backup.toml | 29 +++++++++++++- .../linux/persistence_etc_file_creation.toml | 29 +++++++++++++- .../persistence_init_d_file_creation.toml | 29 +++++++++++++- ...persistence_insmod_kernel_module_load.toml | 29 +++++++++++++- ...sistence_linux_backdoor_user_creation.toml | 29 +++++++++++++- ...e_linux_shell_activity_via_web_server.toml | 29 +++++++++++++- ..._linux_user_added_to_privileged_group.toml | 29 +++++++++++++- ...rsistence_message_of_the_day_creation.toml | 29 +++++++++++++- ...sistence_message_of_the_day_execution.toml | 29 +++++++++++++- .../linux/persistence_rc_script_creation.toml | 29 +++++++++++++- .../persistence_shared_object_creation.toml | 29 +++++++++++++- ...tence_systemd_scheduled_timer_created.toml | 29 +++++++++++++- .../persistence_systemd_service_creation.toml | 29 +++++++++++++- 23 files changed, 674 insertions(+), 23 deletions(-) diff --git a/rules/linux/impact_data_encrypted_via_openssl.toml b/rules/linux/impact_data_encrypted_via_openssl.toml index a6641e809..2d4036dbe 100644 --- a/rules/linux/impact_data_encrypted_via_openssl.toml +++ b/rules/linux/impact_data_encrypted_via_openssl.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/26" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Data Encryption via OpenSSL Utility" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/", "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html", diff --git a/rules/linux/impact_esxi_process_kill.toml b/rules/linux/impact_esxi_process_kill.toml index 325a72c3b..63ae7a1b3 100644 --- a/rules/linux/impact_esxi_process_kill.toml +++ b/rules/linux/impact_esxi_process_kill.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/04/11" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Termination of ESXI Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", ] diff --git a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml index 09410f397..93fe0e47f 100644 --- a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml +++ b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious File Changes Activity Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "28738f9f-7427-4d23-bc69-756708b5f624" severity = "medium" diff --git a/rules/linux/impact_potential_linux_ransomware_note_detected.toml b/rules/linux/impact_potential_linux_ransomware_note_detected.toml index 41b96c8ba..73c2bd27f 100644 --- a/rules/linux/impact_potential_linux_ransomware_note_detected.toml +++ b/rules/linux/impact_potential_linux_ransomware_note_detected.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Ransomware Note Creation Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "c8935a8b-634a-4449-98f7-bb24d3b2c0af" severity = "medium" diff --git a/rules/linux/impact_process_kill_threshold.toml b/rules/linux/impact_process_kill_threshold.toml index b701c3811..837e48844 100644 --- a/rules/linux/impact_process_kill_threshold.toml +++ b/rules/linux/impact_process_kill_threshold.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -46,6 +46,33 @@ This rule identifies a high number (10) of process terminations via pkill from t - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ risk_score = 47 rule_id = "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b" diff --git a/rules/linux/lateral_movement_telnet_network_activity_external.toml b/rules/linux/lateral_movement_telnet_network_activity_external.toml index a6782b38d..a76ae89b6 100644 --- a/rules/linux/lateral_movement_telnet_network_activity_external.toml +++ b/rules/linux/lateral_movement_telnet_network_activity_external.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -25,6 +25,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Connection to External Network via Telnet" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"] risk_score = 47 rule_id = "e19e64ee-130e-4c07-961f-8a339f0b8362" diff --git a/rules/linux/lateral_movement_telnet_network_activity_internal.toml b/rules/linux/lateral_movement_telnet_network_activity_internal.toml index 7a0013db0..a63763a96 100644 --- a/rules/linux/lateral_movement_telnet_network_activity_internal.toml +++ b/rules/linux/lateral_movement_telnet_network_activity_internal.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -25,6 +25,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Connection to Internal Network via Telnet" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"] risk_score = 47 rule_id = "1b21abcc-4d9f-4b08-a7f5-316f5f94b973" diff --git a/rules/linux/persistence_chkconfig_service_add.toml b/rules/linux/persistence_chkconfig_service_add.toml index 089047488..053e792f6 100644 --- a/rules/linux/persistence_chkconfig_service_add.toml +++ b/rules/linux/persistence_chkconfig_service_add.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/22" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" integration = ["endpoint"] [rule] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Chkconfig Service Add" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" ] diff --git a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml index 8bde827f9..be7fb39ac 100644 --- a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml +++ b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Modification of OpenSSH Binaries" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = ["https://blog.angelalonso.es/2016/09/anatomy-of-real-linux-intrusion-part-ii.html"] risk_score = 47 rule_id = "0415f22a-2336-45fa-ba07-618a5942e22c" diff --git a/rules/linux/persistence_cron_job_creation.toml b/rules/linux/persistence_cron_job_creation.toml index 9469bb82f..3432dade7 100644 --- a/rules/linux/persistence_cron_job_creation.toml +++ b/rules/linux/persistence_cron_job_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Cron Job Created or Changed by Previously Unknown Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" ] diff --git a/rules/linux/persistence_dynamic_linker_backup.toml b/rules/linux/persistence_dynamic_linker_backup.toml index b93d744a2..97ba64992 100644 --- a/rules/linux/persistence_dynamic_linker_backup.toml +++ b/rules/linux/persistence_dynamic_linker_backup.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/12" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" integration = ["endpoint"] [rule] @@ -16,6 +16,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Dynamic Linker Copy" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/" ] diff --git a/rules/linux/persistence_etc_file_creation.toml b/rules/linux/persistence_etc_file_creation.toml index abf97ec46..a9626a5dd 100644 --- a/rules/linux/persistence_etc_file_creation.toml +++ b/rules/linux/persistence_etc_file_creation.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/22" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" integration = ["endpoint"] [rule] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious File Creation in /etc for Persistence" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/", "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" diff --git a/rules/linux/persistence_init_d_file_creation.toml b/rules/linux/persistence_init_d_file_creation.toml index 8e093be8f..cb4afdaf8 100644 --- a/rules/linux/persistence_init_d_file_creation.toml +++ b/rules/linux/persistence_init_d_file_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/08/21" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -117,6 +117,33 @@ This rule looks for the creation of new files within the `/etc/init.d/` director - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", diff --git a/rules/linux/persistence_insmod_kernel_module_load.toml b/rules/linux/persistence_insmod_kernel_module_load.toml index e6a6886b1..9287a2a02 100644 --- a/rules/linux/persistence_insmod_kernel_module_load.toml +++ b/rules/linux/persistence_insmod_kernel_module_load.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/11" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" integration = ["endpoint"] [rule] @@ -16,6 +16,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Kernel module load via insmod" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/" ] diff --git a/rules/linux/persistence_linux_backdoor_user_creation.toml b/rules/linux/persistence_linux_backdoor_user_creation.toml index a635f2355..5a0083f81 100644 --- a/rules/linux/persistence_linux_backdoor_user_creation.toml +++ b/rules/linux/persistence_linux_backdoor_user_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/20" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -84,6 +84,33 @@ This rule identifies the usage of the `usermod` command to set a user's UID to 0 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ risk_score = 47 rule_id = "494ebba4-ecb7-4be4-8c6f-654c686549ad" diff --git a/rules/linux/persistence_linux_shell_activity_via_web_server.toml b/rules/linux/persistence_linux_shell_activity_via_web_server.toml index 7c3f8b18a..3b46623a7 100644 --- a/rules/linux/persistence_linux_shell_activity_via_web_server.toml +++ b/rules/linux/persistence_linux_shell_activity_via_web_server.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -97,6 +97,33 @@ This rule detects a web server process spawning script and command line interfac - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://pentestlab.blog/tag/web-shell/", diff --git a/rules/linux/persistence_linux_user_added_to_privileged_group.toml b/rules/linux/persistence_linux_user_added_to_privileged_group.toml index 69f741e83..af3fa56e8 100644 --- a/rules/linux/persistence_linux_user_added_to_privileged_group.toml +++ b/rules/linux/persistence_linux_user_added_to_privileged_group.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/20" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -79,6 +79,33 @@ This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ risk_score = 47 rule_id = "43d6ec12-2b1c-47b5-8f35-e9de65551d3b" diff --git a/rules/linux/persistence_message_of_the_day_creation.toml b/rules/linux/persistence_message_of_the_day_creation.toml index 8b737aaab..137030323 100644 --- a/rules/linux/persistence_message_of_the_day_creation.toml +++ b/rules/linux/persistence_message_of_the_day_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -114,6 +114,33 @@ This rule identifies the creation of new files within the `/etc/update-motd.d/` - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" diff --git a/rules/linux/persistence_message_of_the_day_execution.toml b/rules/linux/persistence_message_of_the_day_execution.toml index 34185a085..da45d8cad 100644 --- a/rules/linux/persistence_message_of_the_day_execution.toml +++ b/rules/linux/persistence_message_of_the_day_execution.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/21" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -113,6 +113,33 @@ This rule identifies the execution of potentially malicious processes from a MOT - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" diff --git a/rules/linux/persistence_rc_script_creation.toml b/rules/linux/persistence_rc_script_creation.toml index 8ef5e71f9..254409cfc 100644 --- a/rules/linux/persistence_rc_script_creation.toml +++ b/rules/linux/persistence_rc_script_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/08/21" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -96,6 +96,33 @@ Detection alerts from this rule indicate the creation of a new `/etc/rc.local` f - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", diff --git a/rules/linux/persistence_shared_object_creation.toml b/rules/linux/persistence_shared_object_creation.toml index d2534e2c2..7b744dc5a 100644 --- a/rules/linux/persistence_shared_object_creation.toml +++ b/rules/linux/persistence_shared_object_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -21,6 +21,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Shared Object Created or Changed by Previously Unknown Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://threatpost.com/sneaky-malware-backdoors-linux/180158/"] risk_score = 47 rule_id = "aebaa51f-2a91-4f6a-850b-b601db2293f4" diff --git a/rules/linux/persistence_systemd_scheduled_timer_created.toml b/rules/linux/persistence_systemd_scheduled_timer_created.toml index c60d89c5e..27eba833f 100644 --- a/rules/linux/persistence_systemd_scheduled_timer_created.toml +++ b/rules/linux/persistence_systemd_scheduled_timer_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/08/21" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -127,6 +127,33 @@ This rule monitors the creation of new systemd timer files, potentially indicati - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + +## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ references = [ "https://opensource.com/article/20/7/systemd-timers", diff --git a/rules/linux/persistence_systemd_service_creation.toml b/rules/linux/persistence_systemd_service_creation.toml index 577ac3ae4..346b1ece8 100644 --- a/rules/linux/persistence_systemd_service_creation.toml +++ b/rules/linux/persistence_systemd_service_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "New Systemd Service Created by Previously Unknown Process" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://opensource.com/article/20/7/systemd-timers", "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" From 276c0f9cd3879411e77d631793e7b7aeb52c3181 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Tue, 17 Oct 2023 19:45:01 +0530 Subject: [PATCH 44/86] Setup information for Linux Rules - Set7 (#3190) --- ...ion_curl_cve_2023_38545_heap_overflow.toml | 35 ++++++++++++-- ...on_chown_chmod_unauthorized_file_read.toml | 29 +++++++++++- ...ation_container_util_misconfiguration.toml | 47 ++++++++++++++----- ...lation_ld_preload_shared_object_modif.toml | 39 ++++++++++++++- ...lation_linux_suspicious_symbolic_link.toml | 29 +++++++++++- ...lege_escalation_linux_uid_int_max_bug.toml | 29 +++++++++++- ...n_load_and_unload_of_kernel_via_kexec.toml | 29 +++++++++++- ...alation_looney_tunables_cve_2023_4911.toml | 35 ++++++++++++-- ...ge_escalation_overlayfs_local_privesc.toml | 29 +++++++++++- ...vilege_escalation_pkexec_envar_hijack.toml | 29 +++++++++++- ...lation_potential_wildcard_shell_spawn.toml | 29 +++++++++++- ...ge_escalation_sda_disk_mount_non_root.toml | 29 +++++++++++- ...privilege_escalation_shadow_file_read.toml | 29 +++++++++++- ...vilege_escalation_sudo_cve_2019_14287.toml | 29 +++++++++++- .../privilege_escalation_sudo_hijacking.toml | 29 +++++++++++- ...tion_sudo_token_via_process_injection.toml | 29 +++++++++++- ...scalation_uid_change_post_compilation.toml | 29 +++++++++++- ...lation_unshare_namespace_manipulation.toml | 39 ++++++++++++++- ...ege_escalation_writable_docker_socket.toml | 29 +++++++++++- 19 files changed, 564 insertions(+), 37 deletions(-) diff --git a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml index c050cef54..c3141de18 100644 --- a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml +++ b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml @@ -21,10 +21,35 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential curl CVE-2023-38545 Exploitation" -setup = """ +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + Elastic Defend integration does not collect environment variable logging by default. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration. -To set up environment variable capture for an Elastic Agent policy: + #### To set up environment variable capture for an Elastic Agent policy: - Go to Security → Manage → Policies. - Select an Elastic Agent policy. - Click Show advanced settings. @@ -32,8 +57,10 @@ To set up environment variable capture for an Elastic Agent policy: - Enter the names of env vars you want to capture, separated by commas. - For this rule the linux.advanced.capture_env_vars variable should be set to "http_proxy,HTTPS_PROXY,ALL_PROXY". - Click Save. -After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly. -For more information on capturing environment variables refer to https://www.elastic.co/guide/en/security/current/environment-variable-capture.html +After saving the integration change, the Elastic Agents running this policy will be updated and +the rule will function properly. +For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). + """ references = [ "https://curl.se/docs/CVE-2023-38545.html", diff --git a/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml b/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml index 343599b13..4bb1c86e1 100644 --- a/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml +++ b/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/28" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Unauthorized Access via Wildcard Injection Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://www.exploit-db.com/papers/33930"] risk_score = 21 rule_id = "4a99ac6f-9a54-4ba5-a64f-6eb65695841b" diff --git a/rules/linux/privilege_escalation_container_util_misconfiguration.toml b/rules/linux/privilege_escalation_container_util_misconfiguration.toml index 2a8d2eeeb..3b89cb067 100644 --- a/rules/linux/privilege_escalation_container_util_misconfiguration.toml +++ b/rules/linux/privilege_escalation_container_util_misconfiguration.toml @@ -20,19 +20,42 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via Container Misconfiguration" -setup = """This rule leverages `session` fields, which requires that the collection of session data is enabled for Linux operating systems. +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above. +#### To confirm that Session View data is enabled: +- Go to Manage → Policies, and edit one or more of your Elastic Defend integration policies. +- Select the Policy settings tab, then scroll down to the Linux event collection section near the bottom. +- Check the box for Process events, and turn on the Include session data toggle. +- If you want to include file and network alerts in Session View, check the boxes for Network and File events. +- If you want to enable terminal output capture, turn on the Capture terminal output toggle. +For more information about the additional fields collected when this setting is enabled and +the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). -The following steps should be performed in order to enable session data event collection on a Linux system. -``` -Kibana --> -Management --> -Fleet --> -Agent Policies --> -Agent Policy with Elastic Defend installed --> -Elastic Defend integration --> -Enable the "Collect session data" box under "Event Collection" for "Linux" -``` -More information on this topic and how to enable session data collection can be found at https://www.elastic.co/blog/secure-your-cloud-with-cloud-workload-protection-in-elastic-security. """ references = [ "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation", diff --git a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml index cf2dbe27f..5b7cdee9c 100644 --- a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml +++ b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -17,6 +17,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Modification of Dynamic Linker Preload Shared Object" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = [ "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang", ] diff --git a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml index f4eede9ed..1afa6a674 100644 --- a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml +++ b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious Symbolic Link Created" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 21 rule_id = "8a024633-c444-45c0-a4fe-78128d8c1ab6" severity = "low" diff --git a/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml b/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml index 660e305cf..0f4bf5a56 100644 --- a/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml +++ b/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/27" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via UID INT_MAX Bug Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://twitter.com/paragonsec/status/1071152249529884674", "https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh", diff --git a/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml b/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml index 61ebdd432..1650e7588 100644 --- a/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml +++ b/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml @@ -3,7 +3,7 @@ creation_date = "2023/06/09" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" integration = ["endpoint"] [rule] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Kernel Load or Unload via Kexec Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.crowdstrike.com/blog/venom-vulnerability-details/", "https://www.makeuseof.com/what-is-venom-vulnerability/", diff --git a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml index d92d5bb99..cb6397acd 100644 --- a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml +++ b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Linux environment variable capture feature via the Elastic Defend Integration was added in 8.6." min_stack_version = "8.6.0" -updated_date = "2023/10/06" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,10 +18,34 @@ language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via CVE-2023-4911" note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + Elastic Defend integration does not collect environment variable logging by default. -In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings -of the Elastic Defend integration. -To set up environment variable capture for an Elastic Agent policy: +In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration. + #### To set up environment variable capture for an Elastic Agent policy: - Go to Security → Manage → Policies. - Select an Elastic Agent policy. - Click Show advanced settings. @@ -31,7 +55,8 @@ To set up environment variable capture for an Elastic Agent policy: - Click Save. After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly. -For more information on capturing environment variables refer - https://www.elastic.co/guide/en/security/current/environment-variable-capture.html +For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). + """ references = ["https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so"] risk_score = 73 diff --git a/rules/linux/privilege_escalation_overlayfs_local_privesc.toml b/rules/linux/privilege_escalation_overlayfs_local_privesc.toml index e485a0017..9c21014ea 100644 --- a/rules/linux/privilege_escalation_overlayfs_local_privesc.toml +++ b/rules/linux/privilege_escalation_overlayfs_local_privesc.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/28" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via OverlayFS" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = [ "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", "https://twitter.com/liadeliyahu/status/1684841527959273472"] diff --git a/rules/linux/privilege_escalation_pkexec_envar_hijack.toml b/rules/linux/privilege_escalation_pkexec_envar_hijack.toml index 07df799c0..72b261bf6 100644 --- a/rules/linux/privilege_escalation_pkexec_envar_hijack.toml +++ b/rules/linux/privilege_escalation_pkexec_envar_hijack.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -17,6 +17,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via PKEXEC" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://seclists.org/oss-sec/2022/q1/80", "https://haxx.in/files/blasty-vs-pkexec.c"] risk_score = 73 rule_id = "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9" diff --git a/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml b/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml index beb058f25..d758d5950 100644 --- a/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml +++ b/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/28" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Shell via Wildcard Injection Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://www.exploit-db.com/papers/33930"] risk_score = 47 rule_id = "0b803267-74c5-444d-ae29-32b5db2d562a" diff --git a/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml b/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml index 8d867536e..d29462493 100644 --- a/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml +++ b/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/30" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Suspicious DebugFS Root Device Access" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#disk-group"] risk_score = 21 rule_id = "2605aa59-29ac-4662-afad-8d86257c7c91" diff --git a/rules/linux/privilege_escalation_shadow_file_read.toml b/rules/linux/privilege_escalation_shadow_file_read.toml index 2e54f5531..956ba1fd2 100644 --- a/rules/linux/privilege_escalation_shadow_file_read.toml +++ b/rules/linux/privilege_escalation_shadow_file_read.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "The single field New Term rule type used in this rule was added in Elastic 8.4" min_stack_version = "8.4.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Potential Shadow File Read via Command Line Utilities" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/"] risk_score = 47 rule_id = "9a3a3689-8ed1-4cdb-83fb-9506db54c61f" diff --git a/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml b/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml index 2a013a725..baa49acaf 100644 --- a/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml +++ b/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/30" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Sudo Privilege Escalation via CVE-2019-14287" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://www.exploit-db.com/exploits/47502"] risk_score = 47 rule_id = "8af5b42f-8d74-48c8-a8d0-6d14b4197288" diff --git a/rules/linux/privilege_escalation_sudo_hijacking.toml b/rules/linux/privilege_escalation_sudo_hijacking.toml index 859e2eff2..2ba4a6d0a 100644 --- a/rules/linux/privilege_escalation_sudo_hijacking.toml +++ b/rules/linux/privilege_escalation_sudo_hijacking.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/26" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Sudo Hijacking Detected" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://eapolsniper.github.io/2020/08/17/Sudo-Hijacking/"] risk_score = 47 rule_id = "88fdcb8c-60e5-46ee-9206-2663adf1b1ce" diff --git a/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml b/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml index 9257e3e25..87b4880b1 100644 --- a/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml +++ b/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -20,6 +20,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Sudo Token Manipulation via Process Injection" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://github.com/nongiach/sudo_inject"] risk_score = 47 rule_id = "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b" diff --git a/rules/linux/privilege_escalation_uid_change_post_compilation.toml b/rules/linux/privilege_escalation_uid_change_post_compilation.toml index ab8ad758c..c5e973630 100644 --- a/rules/linux/privilege_escalation_uid_change_post_compilation.toml +++ b/rules/linux/privilege_escalation_uid_change_post_compilation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/28" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via Recently Compiled Executable" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" risk_score = 47 rule_id = "193549e8-bb9e-466a-a7f9-7e783f5cb5a6" severity = "medium" diff --git a/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml b/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml index 57caf1af5..3be3707ba 100644 --- a/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml +++ b/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -18,6 +18,43 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Namespace Manipulation Using Unshare" +note = """## Setup + +This rule requires data coming in either from Elastic Defend, or Auditbeat integration. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +""" references = [ "https://man7.org/linux/man-pages/man1/unshare.1.html", "https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/", diff --git a/rules/linux/privilege_escalation_writable_docker_socket.toml b/rules/linux/privilege_escalation_writable_docker_socket.toml index 9200aa588..c72918266 100644 --- a/rules/linux/privilege_escalation_writable_docker_socket.toml +++ b/rules/linux/privilege_escalation_writable_docker_socket.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/25" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -19,6 +19,33 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation through Writable Docker Socket" +note = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" references = ["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#automatic-enumeration-and-escape"] risk_score = 47 rule_id = "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8" From 32002fd89bdb792258a3a5a3a8c3e8afa5ab1f3f Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:36:53 -0300 Subject: [PATCH 45/86] [New Rules] [BBR] Windows Deprecated ERs Conversion - 1 (#3131) * [New Rules] [BBR] Windows Deprecated ERs Conversion - 1 * . * . * Update defense_evasion_dotnet_clickonce_dfsvc_netcon.toml * . --- ...rading_unusual_archive_file_extension.toml | 67 ++++++++ ...evasion_dotnet_clickonce_dfsvc_netcon.toml | 57 +++++++ ...fense_evasion_injection_from_msoffice.toml | 85 ++++++++++ ...squerading_unusual_exe_file_extension.toml | 65 ++++++++ ...tion_delayed_via_ping_lolbas_unsigned.toml | 151 ++++++++++++++++++ 5 files changed, 425 insertions(+) create mode 100644 rules_building_block/defense_evasion_collection_masquerading_unusual_archive_file_extension.toml create mode 100644 rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon.toml create mode 100644 rules_building_block/defense_evasion_injection_from_msoffice.toml create mode 100644 rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension.toml create mode 100644 rules_building_block/execution_delayed_via_ping_lolbas_unsigned.toml diff --git a/rules_building_block/defense_evasion_collection_masquerading_unusual_archive_file_extension.toml b/rules_building_block/defense_evasion_collection_masquerading_unusual_archive_file_extension.toml new file mode 100644 index 000000000..23ab605f3 --- /dev/null +++ b/rules_building_block/defense_evasion_collection_masquerading_unusual_archive_file_extension.toml @@ -0,0 +1,67 @@ +[metadata] +creation_date = "2023/09/25" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/25" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies the creation of an archive file with an unusual extension. Attackers may attempt to evade detection by +masquerading files using the file extension values used by image, audio, or document file types. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Archive File with Unusual Extension" +risk_score = 21 +rule_id = "cffbaf47-9391-4e09-a83c-1f27d7474826" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +file where host.os.type == "windows" and event.action != "deletion" and + + /* common archive file headers - Rar, 7z, GZIP, MSCF, XZ, ZIP */ + file.Ext.header_bytes : ("52617221*", "377ABCAF271C*", "1F8B*", "4d534346*", "FD377A585A00*", "504B0304*", "504B0708*") and + + ( + /* common image file extensions */ + file.extension : ("jpg", "jpeg", "emf", "tiff", "gif", "png", "bmp", "ico", "fpx", "eps", "inf") or + + /* common audio and video file extensions */ + file.extension : ("mp3", "wav", "avi", "mpeg", "flv", "wma", "wmv", "mov", "mp4", "3gp") or + + /* common document file extensions */ + (file.extension : ("doc", "docx", "rtf", "ppt", "pptx", "xls", "xlsx") and + + /* exclude ZIP file header values for OPENXML documents */ + not file.Ext.header_bytes : ("504B0304*", "504B0708*")) + ) and + + not (process.executable : "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and file.path : "?:\\inetpub\\temp\\IIS Temporary Compressed Files\\*") +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.008" +name = "Masquerade File Type" +reference = "https://attack.mitre.org/techniques/T1036/008/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon.toml b/rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon.toml new file mode 100644 index 000000000..11d2c4033 --- /dev/null +++ b/rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon.toml @@ -0,0 +1,57 @@ +[metadata] +creation_date = "2023/09/25" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/25" + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of DotNet ClickOnce installer via Dfsvc.exe trampoline. Adversaries may take advantage of +ClickOnce to proxy execution of malicious payloads via trusted Microsoft processes. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Execution via Microsoft DotNet ClickOnce Host" +risk_score = 21 +rule_id = "5297b7f1-bccd-4611-93fa-ea342a01ff84" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +building_block_type = "default" +type = "eql" + +query = ''' +sequence by user.id with maxspan=5s + [process where host.os.type == "windows" and event.action == "start" and + process.name : "rundll32.exe" and process.command_line : ("*dfshim*ShOpenVerbApplication*", "*dfshim*#*")] + [network where host.os.type == "windows" and process.name : "dfsvc.exe"] +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1127" +name = "Trusted Developer Utilities Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1127/" + +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + + [[rule.threat.technique.subtechnique]] + id = "T1218.011" + name = "Rundll32" + reference = "https://attack.mitre.org/techniques/T1218/011/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/defense_evasion_injection_from_msoffice.toml b/rules_building_block/defense_evasion_injection_from_msoffice.toml new file mode 100644 index 000000000..75c4d039f --- /dev/null +++ b/rules_building_block/defense_evasion_injection_from_msoffice.toml @@ -0,0 +1,85 @@ +[metadata] +creation_date = "2023/09/25" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/25" + +[rule] +author = ["Elastic"] +description = """ +Identifies child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel) with unusual +process arguments and path. This behavior is often observed during exploitation of Office applications or from documents +with malicious macros. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Process Injection from Malicious Document" +risk_score = 21 +rule_id = "1c5a04ae-d034-41bf-b0d8-96439b5cc774" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Tactic: Initial Access", "Rule Type: BBR", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +process where host.os.type == "windows" and event.action == "start" and + process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and + process.args_count == 1 and + process.executable : ( + "?:\\Windows\\SysWOW64\\*.exe", "?:\\Windows\\system32\\*.exe" + ) and + not (process.executable : "?:\\Windows\\System32\\spool\\drivers\\x64\\*" and + process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft *") and + not process.executable : ( + "?:\\Windows\\Sys*\\Taskmgr.exe", + "?:\\Windows\\Sys*\\ctfmon.exe", + "?:\\Windows\\System32\\notepad.exe") +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1055" +name = "Process Injection" +reference = "https://attack.mitre.org/techniques/T1055/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1055" +name = "Process Injection" +reference = "https://attack.mitre.org/techniques/T1055/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" +[[rule.threat.technique.subtechnique]] +id = "T1566.001" +name = "Spearphishing Attachment" +reference = "https://attack.mitre.org/techniques/T1566/001/" + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" diff --git a/rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension.toml b/rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension.toml new file mode 100644 index 000000000..34c52ba7c --- /dev/null +++ b/rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension.toml @@ -0,0 +1,65 @@ +[metadata] +creation_date = "2023/09/25" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/25" + +[rule] +author = ["Elastic"] +description = """ +Identifies the creation or modification of an executable file with an unexpected file extension. Attackers may attempt +to evade detection by masquerading files using the file extension values used by image, audio, or document file types. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Executable File with Unusual Extension" +risk_score = 21 +rule_id = "ecd4857b-5bac-455e-a7c9-a88b66e56a9e" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +file where host.os.type == "windows" and event.action != "deletion" and + + /* MZ header or its common base64 equivalent TVqQ */ + file.Ext.header_bytes : ("4d5a*", "54567151*") and + + ( + /* common image file extensions */ + file.extension : ("jpg", "jpeg", "emf", "tiff", "gif", "png", "bmp", "fpx", "eps", "svg", "inf") or + + /* common audio and video file extensions */ + file.extension : ("mp3", "wav", "avi", "mpeg", "flv", "wma", "wmv", "mov", "mp4", "3gp") or + + /* common document file extensions */ + file.extension : ("txt", "pdf", "doc", "docx", "rtf", "ppt", "pptx", "xls", "xlsx", "hwp", "html") + ) and + not process.pid == 4 and + not process.executable : "?:\\Program Files (x86)\\Trend Micro\\Client Server Security Agent\\Ntrtscan.exe" +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.008" +name = "Masquerade File Type" +reference = "https://attack.mitre.org/techniques/T1036/008/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/execution_delayed_via_ping_lolbas_unsigned.toml b/rules_building_block/execution_delayed_via_ping_lolbas_unsigned.toml new file mode 100644 index 000000000..f07cff9f8 --- /dev/null +++ b/rules_building_block/execution_delayed_via_ping_lolbas_unsigned.toml @@ -0,0 +1,151 @@ +[metadata] +creation_date = "2023/09/25" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/25" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of commonly abused Windows utilities via a delayed Ping execution. This behavior is often +observed during malware installation and is consistent with an attacker attempting to evade detection. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Delayed Execution via Ping" +risk_score = 21 +rule_id = "e00b8d49-632f-4dc6-94a5-76153a481915" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +type = "eql" +building_block_type = "default" + +query = ''' +sequence by process.parent.entity_id with maxspan=1m + [process where host.os.type == "windows" and event.action == "start" and process.name : "ping.exe" and + process.args : "-n" and process.parent.name : "cmd.exe" and not user.id : "S-1-5-18"] + [process where host.os.type == "windows" and event.action == "start" and + process.parent.name : "cmd.exe" and + ( + process.name : ( + "rundll32.exe", "powershell.exe", + "mshta.exe", "msbuild.exe", + "certutil.exe", "regsvr32.exe", + "powershell.exe", "cscript.exe", + "wscript.exe", "wmic.exe", + "installutil.exe", "msxsl.exe", + "Microsoft.Workflow.Compiler.exe", + "ieexec.exe", "iexpress.exe", + "RegAsm.exe", "installutil.exe", + "RegSvcs.exe", "RegAsm.exe" + ) or + (process.executable : "?:\\Users\\*\\AppData\\*.exe" and not process.code_signature.trusted == true) + ) and + + not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and + not (process.name : ("openssl.exe", "httpcfg.exe", "certutil.exe") and process.parent.command_line : "*ScreenConnectConfigurator.cmd*") and + not (process.pe.original_file_name : "DPInst.exe" and process.command_line : "driver\\DPInst_x64 /f ") and + not (process.name : "powershell.exe" and process.args : "Write-Host ======*") and + not (process.name : "wscript.exe" and process.args : "launchquiet_args.vbs" and process.parent.args : "?:\\Windows\\TempInst\\7z*") and + not (process.name : "regsvr32.exe" and process.args : ("?:\\windows\\syswow64\\msxml?.dll", "msxml?.dll", "?:\\Windows\\SysWOW64\\mschrt20.ocx")) and + not (process.name : "wscript.exe" and + process.working_directory : + ("?:\\Windows\\TempInst\\*", + "?:\\Users\\*\\AppData\\Local\\Temp\\BackupBootstrapper\\Logs\\", + "?:\\Users\\*\\AppData\\Local\\Temp\\QBTools\\")) + ] +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +name = "Command and Scripting Interpreter" +id = "T1059" +reference = "https://attack.mitre.org/techniques/T1059/" + + [[rule.threat.technique.subtechnique]] + name = "Visual Basic" + id = "T1059.005" + reference = "https://attack.mitre.org/techniques/T1059/005/" + + [[rule.threat.technique.subtechnique]] + name = "PowerShell" + id = "T1059.001" + reference = "https://attack.mitre.org/techniques/T1059/001/" + + [rule.threat.tactic] + name = "Execution" + id = "TA0002" + reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1497" +name = "Virtualization/Sandbox Evasion" +reference = "https://attack.mitre.org/techniques/T1497/" + + [[rule.threat.technique.subtechnique]] + name = "Time Based Evasion" + id = "T1497.003" + reference = "https://attack.mitre.org/techniques/T1497/003/" + +[[rule.threat.technique]] +name = "System Binary Proxy Execution" +id = "T1218" +reference = "https://attack.mitre.org/techniques/T1218/" + + [[rule.threat.technique.subtechnique]] + name = "CMSTP" + id = "T1218.003" + reference = "https://attack.mitre.org/techniques/T1218/003/" + + [[rule.threat.technique.subtechnique]] + name = "InstallUtil" + id = "T1218.004" + reference = "https://attack.mitre.org/techniques/T1218/004/" + + [[rule.threat.technique.subtechnique]] + name = "Mshta" + id = "T1218.005" + reference = "https://attack.mitre.org/techniques/T1218/005/" + + [[rule.threat.technique.subtechnique]] + name = "Regsvcs/Regasm" + id = "T1218.009" + reference = "https://attack.mitre.org/techniques/T1218/009/" + + [[rule.threat.technique.subtechnique]] + name = "Regsvr32" + id = "T1218.010" + reference = "https://attack.mitre.org/techniques/T1218/010/" + + [[rule.threat.technique.subtechnique]] + name = "Rundll32" + id = "T1218.011" + reference = "https://attack.mitre.org/techniques/T1218/011/" + + [[rule.threat.technique]] + name = "System Script Proxy Execution" + id = "T1216" + reference = "https://attack.mitre.org/techniques/T1216/" + + [[rule.threat.technique]] + name = "XSL Script Processing" + id = "T1220" + reference = "https://attack.mitre.org/techniques/T1220/" + + +[rule.threat.tactic] +name = "Defense Evasion" +id = "TA0005" +reference = "https://attack.mitre.org/tactics/TA0005/" + From 3ea3e5a9fd4d7249c20047b517b9207ac8a7f017 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 17 Oct 2023 13:49:49 -0300 Subject: [PATCH 46/86] [New Rules] [BBR] Windows Deprecated ERs Conversion - 2 (#3138) * [New Rules] [BBR] Windows Deprecated ERs Conversion - 2 * Update defense_evasion_unsigned_bits_client.toml * Update rules_building_block/defense_evasion_suspicious_msiexec_execution.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * . --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --- ...cution_via_visualstudio_prebuildevent.toml | 96 +++++++++++++++++++ ...fense_evasion_msdt_suspicious_diagcab.toml | 60 ++++++++++++ ...on_msiexec_installsource_archive_file.toml | 65 +++++++++++++ ..._evasion_suspicious_msiexec_execution.toml | 81 ++++++++++++++++ .../defense_evasion_unsigned_bits_client.toml | 60 ++++++++++++ 5 files changed, 362 insertions(+) create mode 100644 rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent.toml create mode 100644 rules_building_block/defense_evasion_msdt_suspicious_diagcab.toml create mode 100644 rules_building_block/defense_evasion_msiexec_installsource_archive_file.toml create mode 100644 rules_building_block/defense_evasion_suspicious_msiexec_execution.toml create mode 100644 rules_building_block/defense_evasion_unsigned_bits_client.toml diff --git a/rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent.toml b/rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent.toml new file mode 100644 index 000000000..6805bb71a --- /dev/null +++ b/rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent.toml @@ -0,0 +1,96 @@ +[metadata] +creation_date = "2023/09/26" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/26" + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of a command via Microsoft Visual Studio Pre or Post build events. Adversaries may backdoor a +trusted visual studio project to execute a malicious command during the project build process. +""" +references = [ + "https://docs.microsoft.com/en-us/visualstudio/ide/reference/pre-build-event-post-build-event-command-line-dialog-box?view=vs-2022", + "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html", + "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/", + "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Execution/execution_evasion_visual_studio_prebuild_event.evtx" +] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Execution via MS VisualStudio Pre/Post Build Events" +risk_score = 21 +rule_id = "fec7ccb7-6ed9-4f98-93ab-d6b366b063a0" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Rule Type: BBR", "Data Source: Elastic Defend"] +building_block_type = "default" +type = "eql" + +query = ''' +sequence with maxspan=1m + [process where host.os.type == "windows" and event.action == "start" and + process.name : "cmd.exe" and process.parent.name : "MSBuild.exe" and + process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\tmp*.exec.cmd"] by process.entity_id + [process where host.os.type == "windows" and event.action == "start" and + process.name : ( + "cmd.exe", "powershell.exe", + "MSHTA.EXE", "CertUtil.exe", + "CertReq.exe", "rundll32.exe", + "regsvr32.exe", "MSbuild.exe", + "cscript.exe", "wscript.exe", + "installutil.exe" + ) and + not + ( + process.name : ("cmd.exe", "powershell.exe") and + process.args : ( + "*\\vcpkg\\scripts\\buildsystems\\msbuild\\applocal.ps1", + "HKLM\\SOFTWARE\\Microsoft\\VisualStudio\\SxS\\VS?", + "process.versions.node*", + "?:\\Program Files\\nodejs\\node.exe", + "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MSBuild\\ToolsVersions\\*", + "*Get-ChildItem*Tipasplus.css*", + "Build\\GenerateResourceScripts.ps1", + "Shared\\Common\\..\\..\\BuildTools\\ConfigBuilder.ps1\"", + "?:\\Projets\\*\\PostBuild\\MediaCache.ps1" + ) + ) and + not process.executable : "?:\\Program Files*\\Microsoft Visual Studio\\*\\MSBuild.exe" and + not (process.name : "cmd.exe" and + process.command_line : + ("*vswhere.exe -property catalog_productSemanticVersion*", + "*git log --pretty=format*", "*\\.nuget\\packages\\vswhere\\*", + "*Common\\..\\..\\BuildTools\\*")) + ] by process.parent.entity_id +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1127" +name = "Trusted Developer Utilities Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1127/" +[[rule.threat.technique.subtechnique]] +id = "T1127.001" +name = "MSBuild" +reference = "https://attack.mitre.org/techniques/T1127/001/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" diff --git a/rules_building_block/defense_evasion_msdt_suspicious_diagcab.toml b/rules_building_block/defense_evasion_msdt_suspicious_diagcab.toml new file mode 100644 index 000000000..f273286ee --- /dev/null +++ b/rules_building_block/defense_evasion_msdt_suspicious_diagcab.toml @@ -0,0 +1,60 @@ +[metadata] +creation_date = "2023/09/26" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/26" + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of the Microsoft Diagnostic Wizard to open a diagcab file from a suspicious path and with an unusual +parent process. This may indicate an attempt to execute malicious Troubleshooting Pack Cabinet files. +""" +references = [ + "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd" +] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Suspicious Troubleshooting Pack Cabinet Execution" +risk_score = 21 +rule_id = "808291d3-e918-4a3a-86cd-73052a0c9bdc" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +process where host.os.type == "windows" and event.action == "start" and + (process.name : "msdt.exe" or process.pe.original_file_name == "msdt.exe") and process.args : "/cab" and + process.parent.name : ( + "firefox.exe", "chrome.exe", "msedge.exe", "explorer.exe", "brave.exe", "whale.exe", "browser.exe", + "dragon.exe", "vivaldi.exe", "opera.exe", "iexplore", "firefox.exe", "waterfox.exe", "iexplore.exe", + "winrar.exe", "winrar.exe", "7zFM.exe", "outlook.exe", "winword.exe", "excel.exe" + ) and + process.args : ( + "?:\\Users\\*", + "\\\\*", + "http*", + "ftp://*" + ) +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + + [[rule.threat.technique]] + name = "System Binary Proxy Execution" + id = "T1218" + reference = "https://attack.mitre.org/techniques/T1218/" + + [rule.threat.tactic] + name = "Defense Evasion" + id = "TA0005" + reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/defense_evasion_msiexec_installsource_archive_file.toml b/rules_building_block/defense_evasion_msiexec_installsource_archive_file.toml new file mode 100644 index 000000000..8ee273efc --- /dev/null +++ b/rules_building_block/defense_evasion_msiexec_installsource_archive_file.toml @@ -0,0 +1,65 @@ +[metadata] +creation_date = "2023/09/26" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/26" + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of an installer from an archive or with suspicious properties. Adversaries may abuse +msiexec.exe to launch local or network accessible MSI files in an attempt to bypass application whitelisting. +""" +references = [ + "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/" +] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Windows Installer with Suspicious Properties" +risk_score = 21 +rule_id = "55f07d1b-25bc-4a0f-aa0c-05323c1319d0" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +building_block_type = "default" +type = "eql" + +query = ''' +sequence with maxspan=1m + [registry where host.os.type == "windows" and process.name : "msiexec.exe" and + ( + (registry.value : "InstallSource" and + registry.data.strings : ("?:\\Users\\*\\Temp\\Temp?_*.zip\\*", + "?:\\Users\\*\\*.7z\\*", + "?:\\Users\\*\\*.rar\\*")) or + + (registry.value : ("DisplayName", "ProductName") and registry.data.strings : "SetupTest") + )] + [process where host.os.type == "windows" and event.action == "start" and + process.parent.name : "msiexec.exe" and + not process.name : "msiexec.exe" and + not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true)] +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.007" +name = "Msiexec" +reference = "https://attack.mitre.org/techniques/T1218/007/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/defense_evasion_suspicious_msiexec_execution.toml b/rules_building_block/defense_evasion_suspicious_msiexec_execution.toml new file mode 100644 index 000000000..a0e071a57 --- /dev/null +++ b/rules_building_block/defense_evasion_suspicious_msiexec_execution.toml @@ -0,0 +1,81 @@ +[metadata] +creation_date = "2023/09/26" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/26" + +[rule] +author = ["Elastic"] +description = """ +Identifies suspicious execution of the built-in Windows Installer, msiexec.exe, to install a package from usual paths or +parent process. Adversaries may abuse msiexec.exe to launch malicious local MSI files. +""" +references = [ + "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/", + "https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/" +] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Suspicious Execution via MSIEXEC" +risk_score = 21 +rule_id = "708c9d92-22a3-4fe0-b6b9-1f861c55502d" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +process where host.os.type == "windows" and event.action == "start" and + process.name : "msiexec.exe" and user.id : ("S-1-5-21*", "S-1-12-*") and process.parent.executable != null and + ( + (process.args : "/i" and process.args : ("/q", "/quiet") and process.args_count == 4 and + process.args : ("?:\\Users\\*", "?:\\ProgramData\\*") and + not process.parent.executable : ("?:\\Program Files (x86)\\*.exe", + "?:\\Program Files\\*.exe", + "?:\\Windows\\explorer.exe", + "?:\\Users\\*\\Desktop\\*", + "?:\\Users\\*\\Downloads\\*", + "?:\\programdata\\*")) or + + (process.args_count == 1 and not process.parent.executable : ("?:\\Windows\\explorer.exe", "?:\\Windows\\SysWOW64\\explorer.exe")) or + + (process.args : "/i" and process.args : ("/q", "/quiet") and process.args_count == 4 and + (process.parent.args : "Schedule" or process.parent.name : "wmiprvse.exe" or + process.parent.executable : "?:\\Users\\*\\AppData\\*" or + (process.parent.name : ("powershell.exe", "cmd.exe") and length(process.parent.command_line) >= 200))) or + + (process.args : "/i" and process.args : ("/q", "/quiet") and process.args_count == 4 and + process.working_directory : "?:\\" and process.parent.name : ("cmd.exe", "powershell.exe")) + ) and + + /* noisy pattern */ + not (process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*" and process.parent.args_count >= 2 and + process.args : "?:\\Users\\*\\AppData\\Local\\Temp\\*\\*.msi") and + + not process.args : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.007" +name = "Msiexec" +reference = "https://attack.mitre.org/techniques/T1218/007/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/defense_evasion_unsigned_bits_client.toml b/rules_building_block/defense_evasion_unsigned_bits_client.toml new file mode 100644 index 000000000..7b778e154 --- /dev/null +++ b/rules_building_block/defense_evasion_unsigned_bits_client.toml @@ -0,0 +1,60 @@ +[metadata] +creation_date = "2023/09/27" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/27" + +[rule] +author = ["Elastic"] +description = """ +Identifies an unsigned Windows Background Intelligent Transfer Service (BITS) client process. Attackers may abuse BITS +functionality to download or upload data using the BITS service. +""" +references = [ + "https://web.archive.org/web/20230531215706/https://blog.menasec.net/2021/05/hunting-for-suspicious-usage-of.html", + "https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2" +] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Unsigned BITS Service Client Process" +risk_score = 21 +rule_id = "9a3884d0-282d-45ea-86ce-b9c81100f026" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +library where dll.name : "Bitsproxy.dll" and process.executable != null and +not process.code_signature.trusted == true +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1197" +name = "BITS Jobs" +reference = "https://attack.mitre.org/techniques/T1197/" + +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" From 74222f86ebed1ad6efae97b50fdff568c2c09295 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 17 Oct 2023 14:16:28 -0300 Subject: [PATCH 47/86] [New Rules] [BBR] Windows Deprecated ERs Conversion - 3 (#3143) * [New Rules] [BBR] Windows Deprecated ERs Conversion - 3 * Update defense_evasion_invalid_codesign_imageload.toml * Update defense_evasion_invalid_codesign_imageload.toml * Update rules_building_block/initial_access_execution_remote_via_msiexec.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * Update rules_building_block/initial_access_xsl_script_execution_via_com.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules_building_block/initial_access_execution_remote_via_msiexec.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --- ...se_evasion_invalid_codesign_imageload.toml | 55 +++++++++++ ...access_execution_from_removable_media.toml | 51 ++++++++++ ...l_access_execution_remote_via_msiexec.toml | 94 +++++++++++++++++++ ...l_access_xsl_script_execution_via_com.toml | 72 ++++++++++++++ 4 files changed, 272 insertions(+) create mode 100644 rules_building_block/defense_evasion_invalid_codesign_imageload.toml create mode 100644 rules_building_block/initial_access_execution_from_removable_media.toml create mode 100644 rules_building_block/initial_access_execution_remote_via_msiexec.toml create mode 100644 rules_building_block/initial_access_xsl_script_execution_via_com.toml diff --git a/rules_building_block/defense_evasion_invalid_codesign_imageload.toml b/rules_building_block/defense_evasion_invalid_codesign_imageload.toml new file mode 100644 index 000000000..b80aa386a --- /dev/null +++ b/rules_building_block/defense_evasion_invalid_codesign_imageload.toml @@ -0,0 +1,55 @@ +[metadata] +creation_date = "2023/09/27" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/27" + +[rule] +author = ["Elastic"] +description = """ +Identifies binaries that are loaded and with an invalid code signature. This may indicate an attempt to masquerade as a +signed binary. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Image Loaded with Invalid Signature" +risk_score = 21 +rule_id = "fd9484f2-1c56-44ae-8b28-dc1354e3a0e8" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" + +query = ''' +library where host.os.type == "windows" and event.action == "load" and + dll.code_signature.status : ("errorUntrustedRoot", "errorBadDigest", "errorUntrustedRoot") and + (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and + not startswith~(dll.name, process.name) and + not dll.path : ( + "?:\\Windows\\System32\\DriverStore\\FileRepository\\*" + ) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.001" +name = "Invalid Code Signature" +reference = "https://attack.mitre.org/techniques/T1036/001/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/initial_access_execution_from_removable_media.toml b/rules_building_block/initial_access_execution_from_removable_media.toml new file mode 100644 index 000000000..c24c3e353 --- /dev/null +++ b/rules_building_block/initial_access_execution_from_removable_media.toml @@ -0,0 +1,51 @@ +[metadata] +creation_date = "2023/09/27" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/27" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, +possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of +Autorun features when the media is inserted into a system and executes. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Execution from a Removable Media with Network Connection" +risk_score = 21 +rule_id = "1542fa53-955e-4330-8e4d-b2d812adeb5f" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Rule Type: BBR", "Data Source: Elastic Defend"] +building_block_type = "default" +type = "eql" + +query = ''' +sequence by process.entity_id with maxspan=5m + [process where host.os.type == "windows" and event.action == "start" and + + /* Direct Exec from USB */ + (process.Ext.device.bus_type : "usb" or process.Ext.device.product_id : "USB *") and + (process.code_signature.trusted == false or process.code_signature.exists == false) and + + not process.code_signature.status : ("errorExpired", "errorCode_endpoint*")] + [network where host.os.type == "windows" and event.action == "connection_attempted"] +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1091" +name = "Replication Through Removable Media" +reference = "https://attack.mitre.org/techniques/T1091/" + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" diff --git a/rules_building_block/initial_access_execution_remote_via_msiexec.toml b/rules_building_block/initial_access_execution_remote_via_msiexec.toml new file mode 100644 index 000000000..b923ea62e --- /dev/null +++ b/rules_building_block/initial_access_execution_remote_via_msiexec.toml @@ -0,0 +1,94 @@ +[metadata] +creation_date = "2023/09/28" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/28" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse +msiexec.exe to launch local or network accessible MSI files. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Remote File Execution via MSIEXEC" +risk_score = 21 +rule_id = "3e441bdb-596c-44fd-8628-2cfdf4516ada" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +building_block_type = "default" +type = "eql" + +query = ''' +sequence with maxspan=1m + [process where host.os.type == "windows" and event.action == "start" and + process.name : "msiexec.exe" and process.args : "/V"] by process.entity_id + [network where host.os.type == "windows" and process.name : "msiexec.exe" and + event.action == "connection_attempted"] by process.entity_id + [process where host.os.type == "windows" and event.action == "start" and + process.parent.name : "msiexec.exe" and user.id : ("S-1-5-21-*", "S-1-5-12-1-*") and + not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", + "?:\\Windows\\System32\\msiexec.exe", + "?:\\Windows\\System32\\srtasks.exe", + "?:\\Windows\\SysWOW64\\srtasks.exe", + "?:\\Windows\\System32\\taskkill.exe", + "?:\\Windows\\Installer\\MSI*.tmp", + "?:\\Program Files\\*.exe", + "?:\\Program Files (x86)\\*.exe", + "?:\\Windows\\System32\\ie4uinit.exe", + "?:\\Windows\\SysWOW64\\ie4uinit.exe", + "?:\\Windows\\System32\\sc.exe", + "?:\\Windows\\system32\\Wbem\\mofcomp.exe", + "?:\\Windows\\twain_32\\fjscan32\\SOP\\crtdmprc.exe", + "?:\\Windows\\SysWOW64\\taskkill.exe", + "?:\\Windows\\SysWOW64\\schtasks.exe", + "?:\\Windows\\system32\\schtasks.exe", + "?:\\Windows\\System32\\sdbinst.exe") and + not (process.code_signature.subject_name == "Citrix Systems, Inc." and process.code_signature.trusted == true) and + not (process.name : ("regsvr32.exe", "powershell.exe", "rundll32.exe", "wscript.exe") and + process.Ext.token.integrity_level_name == "high" and + process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and + not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and process.code_signature.trusted == true) and + not (process.name : "rundll32.exe" and process.args : "printui.dll,PrintUIEntry") + ] by process.parent.entity_id +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" +[[rule.threat.technique.subtechnique]] +id = "T1566.002" +name = "Spearphishing Link" +reference = "https://attack.mitre.org/techniques/T1566/002/" + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" +[[rule.threat.technique.subtechnique]] +id = "T1218.007" +name = "Msiexec" +reference = "https://attack.mitre.org/techniques/T1218/007/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/initial_access_xsl_script_execution_via_com.toml b/rules_building_block/initial_access_xsl_script_execution_via_com.toml new file mode 100644 index 000000000..f0892a1b1 --- /dev/null +++ b/rules_building_block/initial_access_xsl_script_execution_via_com.toml @@ -0,0 +1,72 @@ +[metadata] +creation_date = "2023/09/27" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/27" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. +This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Remote XSL Script Execution via COM" +risk_score = 21 +rule_id = "48f657ee-de4f-477c-aa99-ed88ee7af97a" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +building_block_type = "default" +type = "eql" + +query = ''' +sequence with maxspan=1m + [library where host.os.type == "windows" and dll.name : "msxml3.dll" and + process.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe")] by process.entity_id + [process where host.os.type == "windows" and event.action == "start" and + process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe") and + not process.executable : + ("?:\\Windows\\System32\\WerFault.exe", + "?:\\Windows\\SysWoW64\\WerFault.exe", + "?:\\windows\\splwow64.exe", + "?:\\Windows\\System32\\conhost.exe", + "?:\\Program Files\\*.exe", + "?:\\Program Files (x86)\\*exe")] by process.parent.entity_id +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" +[[rule.threat.technique.subtechnique]] +id = "T1566.002" +name = "Spearphishing Link" +reference = "https://attack.mitre.org/techniques/T1566/002/" + + + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1220" +name = "XSL Script Processing" +reference = "https://attack.mitre.org/techniques/T1220/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" From 7d674db11e4d8070895dba3915cc19f24d910936 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 18 Oct 2023 15:46:31 +0200 Subject: [PATCH 48/86] [New Rule] Pot. Network Scan Executed from Host (#3070) --- .../linux/discovery_ping_sweep_detected.toml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 rules/linux/discovery_ping_sweep_detected.toml diff --git a/rules/linux/discovery_ping_sweep_detected.toml b/rules/linux/discovery_ping_sweep_detected.toml new file mode 100644 index 000000000..10131fed3 --- /dev/null +++ b/rules/linux/discovery_ping_sweep_detected.toml @@ -0,0 +1,51 @@ +[metadata] +creation_date = "2023/09/04" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/04" + +[rule] +author = ["Elastic"] +description = """ +This threshold rule monitors for the rapid execution of unix utilities that are capable of conducting network scans. +Adversaries may leverage built-in tools such as ping, netcat or socat to execute ping sweeps across the network while +attempting to evade detection or due to the lack of network mapping tools available on the compromised host. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "kuery" +license = "Elastic License v2" +name = "Potential Network Scan Executed From Host" +risk_score = 47 +rule_id = "03c23d45-d3cb-4ad4-ab5d-b361ffe8724a" +severity = "medium" +tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +type = "threshold" +query = ''' +host.os.type:linux and event.action:exec and event.type:start and +process.name:(ping or nping or hping or hping2 or hping3 or nc or ncat or netcat or socat) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1046" +name = "Network Service Discovery" +reference = "https://attack.mitre.org/techniques/T1046/" + +[rule.threat.tactic] +id = "TA0007" +name = "Discovery" +reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.threshold] +field = ["host.id", "process.parent.entity_id", "process.executable"] +value = 1 + +[[rule.threshold.cardinality]] +field = "process.args" +value = 100 From 4190c3a6a7ff6b354c5107c8309c5caea6feda67 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 18 Oct 2023 16:08:25 +0200 Subject: [PATCH 49/86] [New Rule] Potential SSH-IT SSH Worm Downloaded (#3121) * [New Rule] * Fixed grammar mistake * Update rules/linux/lateral_movement_ssh_it_worm_download.toml * Update rules/linux/lateral_movement_ssh_it_worm_download.toml --- ...lateral_movement_ssh_it_worm_download.toml | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 rules/linux/lateral_movement_ssh_it_worm_download.toml diff --git a/rules/linux/lateral_movement_ssh_it_worm_download.toml b/rules/linux/lateral_movement_ssh_it_worm_download.toml new file mode 100644 index 000000000..066a9ad71 --- /dev/null +++ b/rules/linux/lateral_movement_ssh_it_worm_download.toml @@ -0,0 +1,68 @@ +[metadata] +creation_date = "2023/09/21" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/21" + +[rule] +author = ["Elastic"] +description = """ +Identifies processes that are capable of downloading files with command line arguments containing URLs to SSH-IT's +autonomous SSH worm. This worm intercepts outgoing SSH connections every time a user uses ssh. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential SSH-IT SSH Worm Downloaded" +references = ["https://www.thc.org/ssh-it/"] +risk_score = 47 +rule_id = "2ddc468e-b39b-4f5b-9825-f3dcb0e998ea" +severity = "medium" +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame"] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and +process.name in ("curl", "wget") and process.args : ( + "https://thc.org/ssh-it/x", "http://nossl.segfault.net/ssh-it-deploy.sh", "https://gsocket.io/x", + "https://thc.org/ssh-it/bs", "http://nossl.segfault.net/bs" +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1021" +name = "Remote Services" +reference = "https://attack.mitre.org/techniques/T1021/" + +[[rule.threat.technique.subtechnique]] +id = "T1021.004" +name = "SSH" +reference = "https://attack.mitre.org/techniques/T1021/004/" + +[[rule.threat.technique]] +id = "T1563" +name = "Remote Service Session Hijacking" +reference = "https://attack.mitre.org/techniques/T1563/" + +[[rule.threat.technique.subtechnique]] +id = "T1563.001" +name = "SSH Hijacking" +reference = "https://attack.mitre.org/techniques/T1563/001/" + +[rule.threat.tactic] +id = "TA0008" +name = "Lateral Movement" +reference = "https://attack.mitre.org/tactics/TA0008/" + From 6ea11cd9adbe9800e33df74840e44c31393a2d52 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 18 Oct 2023 16:24:01 +0200 Subject: [PATCH 50/86] [New Rules] cap_setuid/cap_setgid privesc (#3075) * [New Rules] cap_setuid/cap_setgid privesc * Update persistence_setuid_setgid_capability_set.toml * Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update privilege_escalation_suspicious_cap_setuid_python_execution.toml * Update rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml * Update privilege_escalation_suspicious_cap_setuid_python_execution.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- ...sistence_setuid_setgid_capability_set.toml | 58 +++++++++++++++++++ ...uspicious_cap_setuid_python_execution.toml | 58 +++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 rules/linux/persistence_setuid_setgid_capability_set.toml create mode 100644 rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml diff --git a/rules/linux/persistence_setuid_setgid_capability_set.toml b/rules/linux/persistence_setuid_setgid_capability_set.toml new file mode 100644 index 000000000..2ad182e1f --- /dev/null +++ b/rules/linux/persistence_setuid_setgid_capability_set.toml @@ -0,0 +1,58 @@ +[metadata] +creation_date = "2023/09/05" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/05" + +[rule] +author = ["Elastic"] +description = """ +This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabilities via setcap. Setuid (Set User ID) +and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated privileges, based on the +file owner or group. Threat actors can exploit these attributes to achieve persistence by creating malicious binaries, +allowing them to maintain control over a compromised system with elevated permissions. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Setcap setuid/setgid Capability Set" +risk_score = 47 +rule_id = "f5c005d3-4e17-48b0-9cd7-444d48857f97" +severity = "medium" +tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and +process.name == "setcap" and process.args : "cap_set?id+ep" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" + +[[rule.threat.technique.subtechnique]] +id = "T1548.001" +name = "Setuid and Setgid" +reference = "https://attack.mitre.org/techniques/T1548/001/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml b/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml new file mode 100644 index 000000000..269e058a4 --- /dev/null +++ b/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml @@ -0,0 +1,58 @@ +[metadata] +creation_date = "2023/09/05" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/05" + +[rule] +author = ["Elastic"] +description = """ +This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python, +followed by a uid or gid change to the root user. This sequence of events may indicate successful privilege escalation. +Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated +privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the +privileges that are set on the binary that is being executed. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Privilege Escalation via Python cap_setuid" +risk_score = 47 +rule_id = "a0ddb77b-0318-41f0-91e4-8c1b5528834f" +severity = "medium" +tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] +type = "eql" +query = ''' +sequence by host.id, process.entity_id with maxspan=1s + [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and + process.args : "import os;os.set?id(0);os.system(*)" and process.args : "*python*" and user.id != "0"] + [process where host.os.type == "linux" and event.action in ("uid_change", "gid_change") and event.type == "change" and + (user.id == "0" or group.id == "0")] +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1068" +name = "Exploitation for Privilege Escalation" +reference = "https://attack.mitre.org/techniques/T1068/" + +[[rule.threat.technique]] +id = "T1548" +name = "Abuse Elevation Control Mechanism" +reference = "https://attack.mitre.org/techniques/T1548/" + +[[rule.threat.technique.subtechnique]] +id = "T1548.001" +name = "Setuid and Setgid" +reference = "https://attack.mitre.org/techniques/T1548/001/" + +[rule.threat.tactic] +id = "TA0004" +name = "Privilege Escalation" +reference = "https://attack.mitre.org/tactics/TA0004/" + From 9f41c9f35cd568c397c1f81bafc997e92bbf2df0 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 18 Oct 2023 16:47:07 +0200 Subject: [PATCH 51/86] [New Rule] Upgrade of Non-interactive Shell (#3113) * [New Rule] Upgrade of Non-interactive Shell * Changed numbers to int * Changed severity * [New Rule] Pot. Rev Shell via Background Process * Revert "[New Rule] Pot. Rev Shell via Background Process" This reverts commit bbb36eae26561dbef4bf57f6c1388cebe7a8b88d. * Update rules/linux/execution_interpreter_tty_upgrade.toml --- .../execution_interpreter_tty_upgrade.toml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 rules/linux/execution_interpreter_tty_upgrade.toml diff --git a/rules/linux/execution_interpreter_tty_upgrade.toml b/rules/linux/execution_interpreter_tty_upgrade.toml new file mode 100644 index 000000000..bcee93b37 --- /dev/null +++ b/rules/linux/execution_interpreter_tty_upgrade.toml @@ -0,0 +1,57 @@ +[metadata] +creation_date = "2023/09/20" +integration = ["endpoint"] +maturity = "production" +updated_date = "2023/09/20" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" + +[rule] +author = ["Elastic"] +description = """ +Identifies when a non-interactive terminal (tty) is being upgraded to a fully interactive shell. Attackers may upgrade +a simple reverse shell to a fully interactive tty after obtaining initial access to a host, in order to obtain a more +stable connection. +""" +from = "now-9m" +index = ["logs-endpoint.events.*", "endgame-*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Upgrade of Non-interactive Shell" +risk_score = 47 +rule_id = "84d1f8db-207f-45ab-a578-921d91c23eb2" +severity = "medium" +timestamp_override = "event.ingested" +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action in ("exec", "exec_event") and event.type == "start" and ( + (process.name == "stty" and process.args == "raw" and process.args == "-echo" and process.args_count >= 3) or + (process.name == "script" and process.args in ("-qc", "-c") and process.args == "/dev/null" and + process.args_count == 4) +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.004" +name = "Unix Shell" +reference = "https://attack.mitre.org/techniques/T1059/004/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" From 3ab57fb8a7ff8885bca46cab3c7d7e3d13dcb852 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Thu, 19 Oct 2023 18:16:54 -0400 Subject: [PATCH 52/86] [FR] Adding Support for `missing_field_strategy` Field in Alert Suppression (#3201) * adding missing field strategy option to alert suppression * fixed linting errors * added validate methods for alertsuppression dataclass * fixed linting errors * replaced old variable with new variable * removing test rule * adding post_load to queryruledata * changed post_load to validates_schema * updated unit testing for alert suppression * fixed linting errors * changed validates method name to validates_exceptions * removed min compat for fields --- detection_rules/rule.py | 13 +++++++-- detection_rules/schemas/definitions.py | 2 ++ tests/test_all_rules.py | 40 ++++---------------------- 3 files changed, 18 insertions(+), 37 deletions(-) diff --git a/detection_rules/rule.py b/detection_rules/rule.py index e27b004c8..a24945d12 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -229,7 +229,8 @@ class AlertSuppressionMapping(MarshmallowDataclassMixin, StackCompatMixin): value: int group_by: List[definitions.NonEmptyStr] - duration: Optional[AlertSuppressionDuration] = field(metadata=dict(metadata=dict(min_compat="8.7"))) + duration: Optional[AlertSuppressionDuration] + missing_fields_strategy: definitions.AlertSuppressionMissing @dataclass(frozen=True) @@ -247,7 +248,6 @@ class BaseRuleData(MarshmallowDataclassMixin, StackCompatMixin): integration: Optional[definitions.NonEmptyStr] actions: Optional[list] - alert_suppression: Optional[AlertSuppressionMapping] = field(metadata=dict(metadata=dict(min_compat="8.6"))) author: List[str] building_block_type: Optional[definitions.BuildingBlockType] description: str @@ -561,6 +561,7 @@ class QueryRuleData(BaseRuleData): index: Optional[List[str]] query: str language: definitions.FilterLanguages + alert_suppression: Optional[AlertSuppressionMapping] = field(metadata=dict(metadata=dict(min_compat="8.8"))) @cached_property def validator(self) -> Optional[QueryValidator]: @@ -592,6 +593,14 @@ class QueryRuleData(BaseRuleData): if validator is not None: return validator.get_required_fields(index or []) + @validates_schema + def validate_exceptions(self, data, **kwargs): + """Custom validation for query rule type and subclasses.""" + + # alert suppression is only valid for query rule type and not any of its subclasses + if data.get('alert_suppression') and data['type'] != 'query': + raise ValidationError("Alert suppression is only valid for query rule type.") + @dataclass(frozen=True) class MachineLearningRuleData(BaseRuleData): diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py index 264b4b960..5f53e08fd 100644 --- a/detection_rules/schemas/definitions.py +++ b/detection_rules/schemas/definitions.py @@ -128,6 +128,8 @@ EXPECTED_RULE_TAGS = [ MACHINE_LEARNING_PACKAGES = ['LMD', 'DGA', 'DED', 'ProblemChild', 'Beaconing'] +AlertSuppressionMissing = NewType('AlertSuppressionMissing', str, + validate=validate.OneOf(['suppress', 'doNotSuppress'])) NonEmptyStr = NewType('NonEmptyStr', str, validate=validate.Length(min=1)) TimeUnits = Literal['s', 'm', 'h'] BranchVer = NewType('BranchVer', str, validate=validate.Regexp(BRANCH_PATTERN)) diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index ec0a2c79e..0c4e3c6ca 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -1276,22 +1276,22 @@ class TestNoteMarkdownPlugins(BaseRuleTest): class TestAlertSuppression(BaseRuleTest): """Test rule alert suppression.""" - @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.6.0"), + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.8.0"), "Test only applicable to 8.6+ stacks for rule alert suppression feature.") def test_group_length(self): """Test to ensure the rule alert suppression group_by does not exceed 3 elements.""" for rule in self.production_rules: - if rule.contents.data.alert_suppression: + if rule.contents.data.get('alert_suppression'): group_length = len(rule.contents.data.alert_suppression.group_by) if group_length > 3: self.fail(f'{self.rule_str(rule)} has rule alert suppression with more than 3 elements.') - @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.6.0"), - "Test only applicable to 8.6+ stacks for rule alert suppression feature.") + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.8.0"), + "Test only applicable to 8.8+ stacks for rule alert suppression feature.") def test_group_field_in_schemas(self): """Test to ensure the fields are defined is in ECS/Beats/Integrations schema.""" for rule in self.production_rules: - if rule.contents.data.alert_suppression: + if rule.contents.data.get('alert_suppression'): group_by_fields = rule.contents.data.alert_suppression.group_by min_stack_version = rule.contents.metadata.get("min_stack_version") if min_stack_version is None: @@ -1316,33 +1316,3 @@ class TestAlertSuppression(BaseRuleTest): if fld not in schema.keys(): self.fail(f"{self.rule_str(rule)} alert suppression field {fld} not \ found in ECS, Beats, or non-ecs schemas") - - @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.6.0"), - "Test only applicable to 8.6+ stacks for rule alert suppression feature.") - def test_stack_version(self): - """Test to ensure the stack version is 8.6+""" - for rule in self.production_rules: - if rule.contents.data.alert_suppression: - per_time = rule.contents.data.alert_suppression.get("duration", None) - min_stack_version = rule.contents.metadata.get("min_stack_version") - if min_stack_version is None: - min_stack_version = Version.parse(load_current_package_version(), optional_minor_and_patch=True) - else: - min_stack_version = Version.parse(min_stack_version) - if not per_time and min_stack_version < Version.parse("8.6.0"): - self.fail(f'{self.rule_str(rule)} has rule alert suppression but \ - min_stack is not 8.6+') - elif per_time and min_stack_version < Version.parse("8.7.0"): - self.fail(f'{self.rule_str(rule)} has rule alert suppression with \ - per time but min_stack is not 8.7+') - - @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.6.0"), - "Test only applicable to 8.6+ stacks for rule alert suppression feature.") - def test_query_type(self): - """Test to ensure the query type is KQL only.""" - for rule in self.production_rules: - if rule.contents.data.alert_suppression: - rule_type = rule.contents.data.language - if rule_type != 'kuery': - self.fail(f'{self.rule_str(rule)} has rule alert suppression with \ - but query language is not KQL') From 7254c582c55eac2ee3ce7dfcc6a61dd888ca546f Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Mon, 23 Oct 2023 19:28:18 +0530 Subject: [PATCH 53/86] Move Setup information into setup filed (#3206) --- detection_rules/rule.py | 2 +- ...mand_and_control_cat_network_activity.toml | 8 +-- ..._control_linux_chisel_client_activity.toml | 16 ++--- ..._control_linux_chisel_server_activity.toml | 16 ++--- ...linux_suspicious_proxychains_activity.toml | 10 +-- ...l_linux_tunneling_and_port_forwarding.toml | 16 ++--- ...d_and_control_tunneling_via_earthworm.toml | 16 ++--- ...ial_access_collection_sensitive_files.toml | 14 ++--- .../credential_access_credential_dumping.toml | 14 ++--- ...redential_access_gdb_init_memory_dump.toml | 16 ++--- ...ential_linux_local_account_bruteforce.toml | 8 +-- ...ntial_successful_linux_ftp_bruteforce.toml | 8 +-- ...ntial_successful_linux_rdp_bruteforce.toml | 8 +-- ...ential_access_proc_credential_dumping.toml | 16 ++--- .../credential_access_ssh_backdoor_log.toml | 16 ++--- ...tempt_to_disable_iptables_or_firewall.toml | 6 +- ...ion_attempt_to_disable_syslog_service.toml | 6 +- ..._base32_encoding_or_decoding_activity.toml | 6 +- ...binary_copied_to_suspicious_directory.toml | 6 +- ...defense_evasion_chattr_immutable_file.toml | 6 +- ...ense_evasion_disable_apparmor_attempt.toml | 6 +- ...fense_evasion_disable_selinux_attempt.toml | 6 +- ...asion_esxi_suspicious_timestomp_touch.toml | 12 ++-- ...fense_evasion_file_deletion_via_shred.toml | 6 +- ...defense_evasion_file_mod_writable_dir.toml | 6 +- .../defense_evasion_hidden_file_dir_tmp.toml | 6 +- .../defense_evasion_hidden_shared_object.toml | 6 +- ...defense_evasion_kernel_module_removal.toml | 8 +-- .../defense_evasion_log_files_deleted.toml | 12 ++-- .../defense_evasion_mount_execution.toml | 12 ++-- ...ense_evasion_potential_proot_exploits.toml | 12 ++-- .../defense_evasion_rename_esxi_files.toml | 12 ++-- ...efense_evasion_rename_esxi_index_file.toml | 12 ++-- .../discovery_esxi_software_via_find.toml | 12 ++-- .../discovery_esxi_software_via_grep.toml | 12 ++-- .../discovery_kernel_module_enumeration.toml | 6 +- .../linux/discovery_linux_hping_activity.toml | 8 +-- .../linux/discovery_linux_nping_activity.toml | 8 +-- ...very_pspy_process_monitoring_detected.toml | 8 +-- ...very_sudo_allowed_command_enumeration.toml | 6 +- .../discovery_suid_sguid_enumeration.toml | 6 +- ...overy_unusual_user_enumeration_via_id.toml | 6 +- ...covery_virtual_machine_fingerprinting.toml | 6 +- ...tion_abnormal_process_id_file_created.toml | 19 +++--- ...ion_curl_cve_2023_38545_heap_overflow.toml | 16 ++--- ...n_file_execution_followed_by_deletion.toml | 6 +- ...er_or_listener_established_via_netcat.toml | 23 +++---- ...cution_network_event_post_compilation.toml | 6 +- rules/linux/execution_perl_tty_shell.toml | 6 +- ..._process_started_from_process_id_file.toml | 19 +++--- ...ss_started_in_shared_memory_directory.toml | 16 ++--- rules/linux/execution_python_tty_shell.toml | 6 +- ..._remote_code_execution_via_postgresql.toml | 6 +- .../execution_shell_evasion_linux_binary.toml | 61 ++++++++++--------- ...uspicious_parent_child_revshell_linux.toml | 12 ++-- ...xecution_shell_via_background_process.toml | 6 +- ...ecution_shell_via_java_revshell_linux.toml | 12 ++-- ...on_shell_via_lolbin_interpreter_linux.toml | 12 ++-- ...execution_shell_via_meterpreter_linux.toml | 7 +-- ...execution_shell_via_suspicious_binary.toml | 12 ++-- ...ution_shell_via_tcp_cli_utility_linux.toml | 12 ++-- ...ution_shell_via_udp_cli_utility_linux.toml | 12 ++-- ...traction_or_decrompression_via_funzip.toml | 12 ++-- ...us_executable_running_system_commands.toml | 6 +- ...icious_mining_process_creation_events.toml | 6 +- rules/linux/execution_tc_bpf_filter.toml | 14 ++--- .../impact_data_encrypted_via_openssl.toml | 14 ++--- rules/linux/impact_esxi_process_kill.toml | 12 ++-- ...tial_linux_ransomware_file_encryption.toml | 6 +- ...ential_linux_ransomware_note_detected.toml | 6 +- .../linux/impact_process_kill_threshold.toml | 7 ++- ...ment_telnet_network_activity_external.toml | 8 +-- ...ment_telnet_network_activity_internal.toml | 8 +-- .../persistence_chkconfig_service_add.toml | 12 ++-- ...credential_access_modify_ssh_binaries.toml | 8 +-- .../linux/persistence_cron_job_creation.toml | 12 ++-- .../persistence_dynamic_linker_backup.toml | 12 ++-- .../linux/persistence_etc_file_creation.toml | 14 ++--- .../persistence_init_d_file_creation.toml | 19 +++--- ...persistence_insmod_kernel_module_load.toml | 12 ++-- ...ersistence_kde_autostart_modification.toml | 16 ++--- ...sistence_linux_backdoor_user_creation.toml | 7 ++- ...e_linux_shell_activity_via_web_server.toml | 15 ++--- ..._linux_user_added_to_privileged_group.toml | 7 ++- ...rsistence_message_of_the_day_creation.toml | 13 ++-- ...sistence_message_of_the_day_execution.toml | 13 ++-- .../linux/persistence_rc_script_creation.toml | 19 +++--- .../persistence_shared_object_creation.toml | 8 +-- ...tence_systemd_scheduled_timer_created.toml | 15 ++--- .../persistence_systemd_service_creation.toml | 14 ++--- ...on_chown_chmod_unauthorized_file_read.toml | 8 +-- ...ation_container_util_misconfiguration.toml | 14 ++--- ...lation_ld_preload_shared_object_modif.toml | 12 ++-- ...lation_linux_suspicious_symbolic_link.toml | 6 +- ...lege_escalation_linux_uid_int_max_bug.toml | 14 ++--- ...n_load_and_unload_of_kernel_via_kexec.toml | 16 ++--- ...alation_looney_tunables_cve_2023_4911.toml | 8 +-- ...ge_escalation_overlayfs_local_privesc.toml | 12 ++-- ...vilege_escalation_pkexec_envar_hijack.toml | 8 +-- ...lation_potential_wildcard_shell_spawn.toml | 8 +-- ...ge_escalation_sda_disk_mount_non_root.toml | 8 +-- ...privilege_escalation_shadow_file_read.toml | 8 +-- ...vilege_escalation_sudo_cve_2019_14287.toml | 8 +-- .../privilege_escalation_sudo_hijacking.toml | 8 +-- ...tion_sudo_token_via_process_injection.toml | 8 +-- ...scalation_uid_change_post_compilation.toml | 6 +- ...lation_unshare_namespace_manipulation.toml | 14 ++--- ...ege_escalation_writable_docker_socket.toml | 8 +-- 108 files changed, 589 insertions(+), 577 deletions(-) diff --git a/detection_rules/rule.py b/detection_rules/rule.py index a24945d12..6a8beae0d 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -273,7 +273,7 @@ class BaseRuleData(MarshmallowDataclassMixin, StackCompatMixin): risk_score_mapping: Optional[List[RiskScoreMapping]] rule_id: definitions.UUIDString rule_name_override: Optional[str] - setup: Optional[str] = field(metadata=dict(metadata=dict(min_compat="8.3"))) + setup: Optional[definitions.Markdown] = field(metadata=dict(metadata=dict(min_compat="8.3"))) severity_mapping: Optional[List[SeverityMapping]] severity: definitions.Severity tags: Optional[List[str]] diff --git a/rules/linux/command_and_control_cat_network_activity.toml b/rules/linux/command_and_control_cat_network_activity.toml index 2946f3415..7e05fe4d8 100644 --- a/rules/linux/command_and_control_cat_network_activity.toml +++ b/rules/linux/command_and_control_cat_network_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,7 +19,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Network Activity Detected via cat" -note = """## Setup +risk_score = 47 +rule_id = "afd04601-12fc-4149-9b78-9c3f8fe45d39" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,8 +48,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "afd04601-12fc-4149-9b78-9c3f8fe45d39" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/command_and_control_linux_chisel_client_activity.toml b/rules/linux/command_and_control_linux_chisel_client_activity.toml index 53218eab2..504dcfd26 100644 --- a/rules/linux/command_and_control_linux_chisel_client_activity.toml +++ b/rules/linux/command_and_control_linux_chisel_client_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,7 +20,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Protocol Tunneling via Chisel Client" -note = """## Setup +references = [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ] +risk_score = 47 +rule_id = "3f12325a-4cc6-410b-8d4c-9fbbeb744cfd" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,12 +53,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", - "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" - ] -risk_score = 47 -rule_id = "3f12325a-4cc6-410b-8d4c-9fbbeb744cfd" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/command_and_control_linux_chisel_server_activity.toml b/rules/linux/command_and_control_linux_chisel_server_activity.toml index 9b992c98d..4f35798d8 100644 --- a/rules/linux/command_and_control_linux_chisel_server_activity.toml +++ b/rules/linux/command_and_control_linux_chisel_server_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,7 +20,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Protocol Tunneling via Chisel Server" -note = """## Setup +references = [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ] +risk_score = 47 +rule_id = "ac8805f6-1e08-406c-962e-3937057fa86f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,12 +53,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", - "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" - ] -risk_score = 47 -rule_id = "ac8805f6-1e08-406c-962e-3937057fa86f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml b/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml index 2d9e257c8..f7686c53c 100644 --- a/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml +++ b/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,7 +19,10 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Utility Launched via ProxyChains" -note = """## Setup +references = ["https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform"] +risk_score = 21 +rule_id = "6ace94ba-f02c-4d55-9f53-87d99b6f9af4" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,9 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform"] -risk_score = 21 -rule_id = "6ace94ba-f02c-4d55-9f53-87d99b6f9af4" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml index 631ded63f..eedd58e85 100644 --- a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml +++ b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,7 +18,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Tunneling and/or Port Forwarding" -note = """## Setup +references = [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ] +risk_score = 47 +rule_id = "6ee947e9-de7e-4281-a55d-09289bdf947e" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,12 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", - "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" - ] -risk_score = 47 -rule_id = "6ee947e9-de7e-4281-a55d-09289bdf947e" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/command_and_control_tunneling_via_earthworm.toml b/rules/linux/command_and_control_tunneling_via_earthworm.toml index 27a4f4f8e..5d905a853 100644 --- a/rules/linux/command_and_control_tunneling_via_earthworm.toml +++ b/rules/linux/command_and_control_tunneling_via_earthworm.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,7 +18,13 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Protocol Tunneling via EarthWorm" -note = """## Setup +references = [ + "http://rootkiter.com/EarthWorm/", + "https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/", +] +risk_score = 47 +rule_id = "9f1c4ca3-44b5-481d-ba42-32dc215a2769" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -58,12 +64,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -references = [ - "http://rootkiter.com/EarthWorm/", - "https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/", -] -risk_score = 47 -rule_id = "9f1c4ca3-44b5-481d-ba42-32dc215a2769" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/credential_access_collection_sensitive_files.toml b/rules/linux/credential_access_collection_sensitive_files.toml index 1f19abe17..1f242cfb8 100644 --- a/rules/linux/credential_access_collection_sensitive_files.toml +++ b/rules/linux/credential_access_collection_sensitive_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -17,7 +17,12 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Sensitive Files Compression" -note = """## Setup +references = [ + "https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html", +] +risk_score = 47 +rule_id = "6b84d470-9036-4cc0-a27c-6d90bbfe81ab" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -54,11 +59,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = [ - "https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html", -] -risk_score = 47 -rule_id = "6b84d470-9036-4cc0-a27c-6d90bbfe81ab" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/credential_access_credential_dumping.toml b/rules/linux/credential_access_credential_dumping.toml index 8a71f7297..074fac608 100644 --- a/rules/linux/credential_access_credential_dumping.toml +++ b/rules/linux/credential_access_credential_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -21,7 +21,12 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Credential Dumping via Unshadow" -note = """## Setup +references = [ + "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/", +] +risk_score = 47 +rule_id = "e7cb3cfd-aaa3-4d7b-af18-23b89955062c" +setup = """ This rule requires data coming in from Elastic Defend. @@ -48,11 +53,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/", -] -risk_score = 47 -rule_id = "e7cb3cfd-aaa3-4d7b-af18-23b89955062c" severity = "medium" tags = ["Data Source: Elastic Endgame", "Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/credential_access_gdb_init_memory_dump.toml b/rules/linux/credential_access_gdb_init_memory_dump.toml index d7c8f8555..b912d96d8 100644 --- a/rules/linux/credential_access_gdb_init_memory_dump.toml +++ b/rules/linux/credential_access_gdb_init_memory_dump.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,7 +18,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Linux init (PID 1) Secret Dump via GDB" -note = """## Setup +references = [ + "https://github.com/controlplaneio/truffleproc", + "https://github.com/hajzer/bash-memory-dump" +] +risk_score = 47 +rule_id = "d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,12 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/controlplaneio/truffleproc", - "https://github.com/hajzer/bash-memory-dump" -] -risk_score = 47 -rule_id = "d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml b/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml index ce1771e1a..1c5d941ef 100644 --- a/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml +++ b/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Local Account Brute Force Detected" -note = """## Setup +risk_score = 47 +rule_id = "835c0622-114e-40b5-a346-f843ea5d01f1" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "835c0622-114e-40b5-a346-f843ea5d01f1" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml index 60dccf0ca..c9593d0bd 100644 --- a/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -21,7 +21,9 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "eql" license = "Elastic License v2" name = "Potential Successful Linux FTP Brute Force Attack Detected" -note = """## Setup +risk_score = 47 +rule_id = "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d" +setup = """ This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. @@ -55,8 +57,6 @@ However, if more advanced configuration is required to detect specific behavior, - For this detection rule no additional audit rules are required to be added to the integration. """ -risk_score = 47 -rule_id = "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access"] type = "eql" diff --git a/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml index 9e21f2815..7b22d29c1 100644 --- a/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -21,7 +21,9 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "eql" license = "Elastic License v2" name = "Potential Successful Linux RDP Brute Force Attack Detected" -note = """## Setup +risk_score = 47 +rule_id = "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0" +setup = """ This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. @@ -55,8 +57,6 @@ However, if more advanced configuration is required to detect specific behavior, - For this detection rule no additional audit rules are required to be added to the integration. """ -risk_score = 47 -rule_id = "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access"] type = "eql" diff --git a/rules/linux/credential_access_proc_credential_dumping.toml b/rules/linux/credential_access_proc_credential_dumping.toml index e5884bc18..33c1f08b7 100644 --- a/rules/linux/credential_access_proc_credential_dumping.toml +++ b/rules/linux/credential_access_proc_credential_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,7 +19,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Credential Dumping via Proc Filesystem" -note = """## Setup +references = [ + "https://github.com/huntergregal/mimipenguin", + "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781" +] +risk_score = 47 +rule_id = "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,12 +52,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/huntergregal/mimipenguin", - "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781" -] -risk_score = 47 -rule_id = "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access", "Use Case: Vulnerability", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/credential_access_ssh_backdoor_log.toml b/rules/linux/credential_access_ssh_backdoor_log.toml index 1bbb00593..c54c4dadc 100644 --- a/rules/linux/credential_access_ssh_backdoor_log.toml +++ b/rules/linux/credential_access_ssh_backdoor_log.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,7 +19,13 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential OpenSSH Backdoor Logging Activity" -note = """## Setup +references = [ + "https://github.com/eset/malware-ioc/tree/master/sshdoor", + "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf", +] +risk_score = 73 +rule_id = "f28e2be4-6eca-4349-bdd9-381573730c22" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -59,12 +65,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -references = [ - "https://github.com/eset/malware-ioc/tree/master/sshdoor", - "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf", -] -risk_score = 73 -rule_id = "f28e2be4-6eca-4349-bdd9-381573730c22" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml index e224747dc..a12712aae 100644 --- a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml +++ b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml @@ -17,7 +17,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Attempt to Disable IPTables or Firewall" -note = """## Setup +risk_score = 21 +rule_id = "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -44,8 +46,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml b/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml index d28cfd3b7..5e04ea59b 100644 --- a/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml +++ b/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml @@ -17,7 +17,9 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Attempt to Disable Syslog Service" -note = """## Setup +risk_score = 47 +rule_id = "2f8a1226-5720-437d-9c20-e0029deb6194" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -54,8 +56,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -risk_score = 47 -rule_id = "2f8a1226-5720-437d-9c20-e0029deb6194" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml b/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml index 951e72697..36665e37c 100644 --- a/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml +++ b/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml @@ -20,7 +20,9 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Base16 or Base32 Encoding/Decoding Activity" -note = """## Setup +risk_score = 21 +rule_id = "debff20a-46bc-4a4d-bae5-5cdd14222795" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -57,8 +59,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -risk_score = 21 -rule_id = "debff20a-46bc-4a4d-bae5-5cdd14222795" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml index 6bb693d13..3d6d9fa3a 100644 --- a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml +++ b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "System Binary Copied and/or Moved to Suspicious Directory" -note = """## Setup +risk_score = 21 +rule_id = "fda1d332-5e08-4f27-8a9b-8c802e3292a6" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "fda1d332-5e08-4f27-8a9b-8c802e3292a6" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/defense_evasion_chattr_immutable_file.toml b/rules/linux/defense_evasion_chattr_immutable_file.toml index f8e439d7f..566cd4acc 100644 --- a/rules/linux/defense_evasion_chattr_immutable_file.toml +++ b/rules/linux/defense_evasion_chattr_immutable_file.toml @@ -20,7 +20,9 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "File made Immutable by Chattr" -note = """## Setup +risk_score = 47 +rule_id = "968ccab9-da51-4a87-9ce2-d3c9782fd759" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -60,8 +62,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -risk_score = 47 -rule_id = "968ccab9-da51-4a87-9ce2-d3c9782fd759" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_disable_apparmor_attempt.toml b/rules/linux/defense_evasion_disable_apparmor_attempt.toml index bf2d524e5..6b060383b 100644 --- a/rules/linux/defense_evasion_disable_apparmor_attempt.toml +++ b/rules/linux/defense_evasion_disable_apparmor_attempt.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Disabling of AppArmor" -note = """## Setup +risk_score = 21 +rule_id = "fac52c69-2646-4e79-89c0-fd7653461010" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "fac52c69-2646-4e79-89c0-fd7653461010" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_disable_selinux_attempt.toml b/rules/linux/defense_evasion_disable_selinux_attempt.toml index 40837200a..841ca4f4a 100644 --- a/rules/linux/defense_evasion_disable_selinux_attempt.toml +++ b/rules/linux/defense_evasion_disable_selinux_attempt.toml @@ -18,7 +18,9 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Potential Disabling of SELinux" -note = """## Setup +risk_score = 47 +rule_id = "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -55,8 +57,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -risk_score = 47 -rule_id = "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml b/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml index df389e59c..f155f0983 100644 --- a/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml +++ b/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml @@ -20,7 +20,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "ESXI Timestomping using Touch Command" -note = """## Setup +references = [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", +] +risk_score = 47 +rule_id = "30bfddd7-2954-4c9d-bbc6-19a99ca47e23" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,11 +52,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", -] -risk_score = 47 -rule_id = "30bfddd7-2954-4c9d-bbc6-19a99ca47e23" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_file_deletion_via_shred.toml b/rules/linux/defense_evasion_file_deletion_via_shred.toml index a1ff0b905..828fc9709 100644 --- a/rules/linux/defense_evasion_file_deletion_via_shred.toml +++ b/rules/linux/defense_evasion_file_deletion_via_shred.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "kuery" license = "Elastic License v2" name = "File Deletion via Shred" -note = """## Setup +risk_score = 21 +rule_id = "a1329140-8de3-4445-9f87-908fb6d824f4" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "a1329140-8de3-4445-9f87-908fb6d824f4" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_file_mod_writable_dir.toml b/rules/linux/defense_evasion_file_mod_writable_dir.toml index da7b76f20..db94ce007 100644 --- a/rules/linux/defense_evasion_file_mod_writable_dir.toml +++ b/rules/linux/defense_evasion_file_mod_writable_dir.toml @@ -23,7 +23,9 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "File Permission Modification in Writable Directory" -note = """## Setup +risk_score = 21 +rule_id = "9f9a2a82-93a8-4b1a-8778-1780895626d4" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -60,8 +62,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -risk_score = 21 -rule_id = "9f9a2a82-93a8-4b1a-8778-1780895626d4" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml index 2299892f5..4bc87d73a 100644 --- a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml +++ b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml @@ -25,7 +25,9 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "Creation of Hidden Files and Directories via CommandLine" -note = """## Setup +risk_score = 47 +rule_id = "b9666521-4742-49ce-9ddc-b8e84c35acae" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -65,8 +67,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -risk_score = 47 -rule_id = "b9666521-4742-49ce-9ddc-b8e84c35acae" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_hidden_shared_object.toml b/rules/linux/defense_evasion_hidden_shared_object.toml index 4a650968b..9f0fdc4ce 100644 --- a/rules/linux/defense_evasion_hidden_shared_object.toml +++ b/rules/linux/defense_evasion_hidden_shared_object.toml @@ -19,7 +19,9 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "Creation of Hidden Shared Object File" -note = """## Setup +risk_score = 47 +rule_id = "766d3f91-3f12-448c-b65f-20123e9e9e8c" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -59,8 +61,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -risk_score = 47 -rule_id = "766d3f91-3f12-448c-b65f-20123e9e9e8c" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_kernel_module_removal.toml b/rules/linux/defense_evasion_kernel_module_removal.toml index cf28e0f4d..249580820 100644 --- a/rules/linux/defense_evasion_kernel_module_removal.toml +++ b/rules/linux/defense_evasion_kernel_module_removal.toml @@ -24,7 +24,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Kernel Module Removal" -note = """## Setup +references = ["http://man7.org/linux/man-pages/man8/modprobe.8.html"] +risk_score = 47 +rule_id = "cd66a5af-e34b-4bb0-8931-57d0a043f2ef" +setup = """ This rule requires data coming in from Elastic Defend. @@ -51,9 +54,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["http://man7.org/linux/man-pages/man8/modprobe.8.html"] -risk_score = 47 -rule_id = "cd66a5af-e34b-4bb0-8931-57d0a043f2ef" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_log_files_deleted.toml b/rules/linux/defense_evasion_log_files_deleted.toml index 2dc632a5e..f4a3a4375 100644 --- a/rules/linux/defense_evasion_log_files_deleted.toml +++ b/rules/linux/defense_evasion_log_files_deleted.toml @@ -17,7 +17,12 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "System Log File Deletion" -note = """## Setup +references = [ + "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html", +] +risk_score = 47 +rule_id = "aa895aea-b69c-4411-b110-8d7599634b30" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -57,11 +62,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -references = [ - "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html", -] -risk_score = 47 -rule_id = "aa895aea-b69c-4411-b110-8d7599634b30" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_mount_execution.toml b/rules/linux/defense_evasion_mount_execution.toml index 5f9dc8eba..31af2971b 100644 --- a/rules/linux/defense_evasion_mount_execution.toml +++ b/rules/linux/defense_evasion_mount_execution.toml @@ -22,7 +22,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Hidden Process via Mount Hidepid" -note = """## Setup +references = [ + "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/", +] +risk_score = 47 +rule_id = "dc71c186-9fe4-4437-a4d0-85ebb32b8204" +setup = """ This rule requires data coming in from Elastic Defend. @@ -49,11 +54,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/", -] -risk_score = 47 -rule_id = "dc71c186-9fe4-4437-a4d0-85ebb32b8204" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_potential_proot_exploits.toml b/rules/linux/defense_evasion_potential_proot_exploits.toml index 650131797..a9f3c1055 100644 --- a/rules/linux/defense_evasion_potential_proot_exploits.toml +++ b/rules/linux/defense_evasion_potential_proot_exploits.toml @@ -25,7 +25,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Defense Evasion via PRoot" -note = """## Setup +references = [ + "https://proot-me.github.io/", +] +risk_score = 47 +rule_id = "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0" +setup = """ This rule requires data coming in from Elastic Defend. @@ -52,11 +57,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://proot-me.github.io/", -] -risk_score = 47 -rule_id = "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_rename_esxi_files.toml b/rules/linux/defense_evasion_rename_esxi_files.toml index eb5d40724..4929de649 100644 --- a/rules/linux/defense_evasion_rename_esxi_files.toml +++ b/rules/linux/defense_evasion_rename_esxi_files.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Renaming of ESXI Files" -note = """## Setup +references = [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", +] +risk_score = 47 +rule_id = "97db8b42-69d8-4bf3-9fd4-c69a1d895d68" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", -] -risk_score = 47 -rule_id = "97db8b42-69d8-4bf3-9fd4-c69a1d895d68" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/defense_evasion_rename_esxi_index_file.toml b/rules/linux/defense_evasion_rename_esxi_index_file.toml index cb4c0ac9b..a010bad46 100644 --- a/rules/linux/defense_evasion_rename_esxi_index_file.toml +++ b/rules/linux/defense_evasion_rename_esxi_index_file.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Renaming of ESXI index.html File" -note = """## Setup +references = [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", +] +risk_score = 47 +rule_id = "c125e48f-6783-41f0-b100-c3bf1b114d16" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", -] -risk_score = 47 -rule_id = "c125e48f-6783-41f0-b100-c3bf1b114d16" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_esxi_software_via_find.toml b/rules/linux/discovery_esxi_software_via_find.toml index f33e3aaee..8e1676fe5 100644 --- a/rules/linux/discovery_esxi_software_via_find.toml +++ b/rules/linux/discovery_esxi_software_via_find.toml @@ -20,7 +20,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "ESXI Discovery via Find" -note = """## Setup +references = [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", +] +risk_score = 47 +rule_id = "33a6752b-da5e-45f8-b13a-5f094c09522f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,11 +52,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", -] -risk_score = 47 -rule_id = "33a6752b-da5e-45f8-b13a-5f094c09522f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_esxi_software_via_grep.toml b/rules/linux/discovery_esxi_software_via_grep.toml index 494b5eb31..3cbc07a56 100644 --- a/rules/linux/discovery_esxi_software_via_grep.toml +++ b/rules/linux/discovery_esxi_software_via_grep.toml @@ -19,7 +19,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "ESXI Discovery via Grep" -note = """## Setup +references = [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", +] +risk_score = 47 +rule_id = "2b662e21-dc6e-461e-b5cf-a6eb9b235ec4" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,11 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", -] -risk_score = 47 -rule_id = "2b662e21-dc6e-461e-b5cf-a6eb9b235ec4" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_kernel_module_enumeration.toml b/rules/linux/discovery_kernel_module_enumeration.toml index 2418d442b..8788f5d17 100644 --- a/rules/linux/discovery_kernel_module_enumeration.toml +++ b/rules/linux/discovery_kernel_module_enumeration.toml @@ -24,7 +24,9 @@ index = ["logs-endpoint.events.*"] language = "kuery" license = "Elastic License v2" name = "Enumeration of Kernel Modules" -note = """## Setup +risk_score = 47 +rule_id = "2d8043ed-5bda-4caf-801c-c1feb7410504" +setup = """ This rule requires data coming in from Elastic Defend. @@ -51,8 +53,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "2d8043ed-5bda-4caf-801c-c1feb7410504" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_linux_hping_activity.toml b/rules/linux/discovery_linux_hping_activity.toml index 632a78e93..fa4fa6f15 100644 --- a/rules/linux/discovery_linux_hping_activity.toml +++ b/rules/linux/discovery_linux_hping_activity.toml @@ -23,7 +23,10 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Hping Process Activity" -note = """## Setup +references = ["https://en.wikipedia.org/wiki/Hping"] +risk_score = 47 +rule_id = "90169566-2260-4824-b8e4-8615c3b4ed52" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -60,9 +63,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = ["https://en.wikipedia.org/wiki/Hping"] -risk_score = 47 -rule_id = "90169566-2260-4824-b8e4-8615c3b4ed52" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_linux_nping_activity.toml b/rules/linux/discovery_linux_nping_activity.toml index 774cf5de7..b006ad4ee 100644 --- a/rules/linux/discovery_linux_nping_activity.toml +++ b/rules/linux/discovery_linux_nping_activity.toml @@ -23,7 +23,10 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Nping Process Activity" -note = """## Setup +references = ["https://en.wikipedia.org/wiki/Nmap"] +risk_score = 47 +rule_id = "0d69150b-96f8-467c-a86d-a67a3378ce77" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -60,9 +63,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = ["https://en.wikipedia.org/wiki/Nmap"] -risk_score = 47 -rule_id = "0d69150b-96f8-467c-a86d-a67a3378ce77" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_pspy_process_monitoring_detected.toml b/rules/linux/discovery_pspy_process_monitoring_detected.toml index 81fe33eb3..834343f22 100644 --- a/rules/linux/discovery_pspy_process_monitoring_detected.toml +++ b/rules/linux/discovery_pspy_process_monitoring_detected.toml @@ -19,7 +19,10 @@ index = ["logs-auditd_manager.auditd-*"] language = "eql" license = "Elastic License v2" name = "Potential Pspy Process Monitoring Detected" -note = """## Setup +references = ["https://github.com/DominicBreuker/pspy"] +risk_score = 21 +rule_id = "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc" +setup = """ This rule requires data coming in from Auditd Manager integration. @@ -44,9 +47,6 @@ However, if more advanced configuration is required to detect specific behavior, -- "-w /proc/ -p r -k audit_proc" """ -references = ["https://github.com/DominicBreuker/pspy"] -risk_score = 21 -rule_id = "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery"] type = "eql" diff --git a/rules/linux/discovery_sudo_allowed_command_enumeration.toml b/rules/linux/discovery_sudo_allowed_command_enumeration.toml index 7bfb7ed0c..54946d26d 100644 --- a/rules/linux/discovery_sudo_allowed_command_enumeration.toml +++ b/rules/linux/discovery_sudo_allowed_command_enumeration.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Sudo Command Enumeration Detected" -note = """## Setup +risk_score = 21 +rule_id = "28d39238-0c01-420a-b77a-24e5a7378663" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "28d39238-0c01-420a-b77a-24e5a7378663" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_suid_sguid_enumeration.toml b/rules/linux/discovery_suid_sguid_enumeration.toml index 2c61a6d78..17df0d288 100644 --- a/rules/linux/discovery_suid_sguid_enumeration.toml +++ b/rules/linux/discovery_suid_sguid_enumeration.toml @@ -20,7 +20,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "SUID/SGUID Enumeration Detected" -note = """## Setup +risk_score = 21 +rule_id = "5b06a27f-ad72-4499-91db-0c69667bffa5" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,8 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "5b06a27f-ad72-4499-91db-0c69667bffa5" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/discovery_unusual_user_enumeration_via_id.toml b/rules/linux/discovery_unusual_user_enumeration_via_id.toml index d7be298e9..2b41f1238 100644 --- a/rules/linux/discovery_unusual_user_enumeration_via_id.toml +++ b/rules/linux/discovery_unusual_user_enumeration_via_id.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Unusual User Privilege Enumeration via id" -note = """## Setup +risk_score = 21 +rule_id = "afa135c0-a365-43ab-aa35-fd86df314a47" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "afa135c0-a365-43ab-aa35-fd86df314a47" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/discovery_virtual_machine_fingerprinting.toml b/rules/linux/discovery_virtual_machine_fingerprinting.toml index 9ddf29a70..eb0b20e16 100644 --- a/rules/linux/discovery_virtual_machine_fingerprinting.toml +++ b/rules/linux/discovery_virtual_machine_fingerprinting.toml @@ -24,7 +24,9 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Virtual Machine Fingerprinting" -note = """## Setup +risk_score = 73 +rule_id = "5b03c9fb-9945-4d2f-9568-fd690fee3fba" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -61,8 +63,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -risk_score = 73 -rule_id = "5b03c9fb-9945-4d2f-9568-fd690fee3fba" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_abnormal_process_id_file_created.toml b/rules/linux/execution_abnormal_process_id_file_created.toml index 03d163914..d8f7e5f4c 100644 --- a/rules/linux/execution_abnormal_process_id_file_created.toml +++ b/rules/linux/execution_abnormal_process_id_file_created.toml @@ -65,7 +65,16 @@ This rule identifies the creation of PID, lock, or reboot files in the /var/run/ - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", +] +risk_score = 47 +rule_id = "cac91072-d165-11ec-a764-f661ea17fbce" +setup = """ This rule requires data coming in from Elastic Defend. @@ -92,14 +101,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", - "https://twitter.com/GossiTheDog/status/1522964028284411907", - "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", - "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", -] -risk_score = 47 -rule_id = "cac91072-d165-11ec-a764-f661ea17fbce" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: BPFDoor", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml index c3141de18..ad1f06075 100644 --- a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml +++ b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml @@ -21,7 +21,14 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential curl CVE-2023-38545 Exploitation" -note = """## Setup +references = [ + "https://curl.se/docs/CVE-2023-38545.html", + "https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/", + "https://twitter.com/_JohnHammond/status/1711986412554531015" +] +risk_score = 47 +rule_id = "f41296b4-9975-44d6-9486-514c6f635b2d" +setup = """ This rule requires data coming in from Elastic Defend. @@ -62,13 +69,6 @@ the rule will function properly. For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). """ -references = [ - "https://curl.se/docs/CVE-2023-38545.html", - "https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/", - "https://twitter.com/_JohnHammond/status/1711986412554531015" -] -risk_score = 47 -rule_id = "f41296b4-9975-44d6-9486-514c6f635b2d" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/linux/execution_file_execution_followed_by_deletion.toml b/rules/linux/execution_file_execution_followed_by_deletion.toml index 69a60e738..ecec2d920 100644 --- a/rules/linux/execution_file_execution_followed_by_deletion.toml +++ b/rules/linux/execution_file_execution_followed_by_deletion.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "File Creation, Execution and Self-Deletion in Suspicious Directory" -note = """## Setup +risk_score = 47 +rule_id = "09bc6c90-7501-494d-b015-5d988dc3f233" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "09bc6c90-7501-494d-b015-5d988dc3f233" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml b/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml index 7ca4d1300..c91af8b5a 100644 --- a/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml +++ b/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml @@ -63,7 +63,18 @@ This rule identifies potential reverse shell or bind shell activity using Netcat - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", + "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", + "https://en.wikipedia.org/wiki/Netcat", + "https://www.hackers-arise.com/hacking-fundamentals", + "https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/", + "https://levelup.gitconnected.com/ethical-hacking-part-15-netcat-nc-and-netcat-f6a8f7df43fd", +] +risk_score = 47 +rule_id = "adb961e0-cb74-42a0-af9e-29fc41f88f5f" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -100,16 +111,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = [ - "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", - "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", - "https://en.wikipedia.org/wiki/Netcat", - "https://www.hackers-arise.com/hacking-fundamentals", - "https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/", - "https://levelup.gitconnected.com/ethical-hacking-part-15-netcat-nc-and-netcat-f6a8f7df43fd", -] -risk_score = 47 -rule_id = "adb961e0-cb74-42a0-af9e-29fc41f88f5f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_network_event_post_compilation.toml b/rules/linux/execution_network_event_post_compilation.toml index 682715c08..748785e0a 100644 --- a/rules/linux/execution_network_event_post_compilation.toml +++ b/rules/linux/execution_network_event_post_compilation.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Network Connection via Recently Compiled Executable" -note = """## Setup +risk_score = 47 +rule_id = "64cfca9e-0f6f-4048-8251-9ec56a055e9e" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "64cfca9e-0f6f-4048-8251-9ec56a055e9e" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_perl_tty_shell.toml b/rules/linux/execution_perl_tty_shell.toml index 44fc9377a..a091c5a58 100644 --- a/rules/linux/execution_perl_tty_shell.toml +++ b/rules/linux/execution_perl_tty_shell.toml @@ -17,7 +17,9 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Interactive Terminal Spawned via Perl" -note = """## Setup +risk_score = 73 +rule_id = "05e5a668-7b51-4a67-93ab-e9af405c9ef3" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -54,8 +56,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -risk_score = 73 -rule_id = "05e5a668-7b51-4a67-93ab-e9af405c9ef3" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_process_started_from_process_id_file.toml b/rules/linux/execution_process_started_from_process_id_file.toml index c3bb4ef24..fde6c8d2a 100644 --- a/rules/linux/execution_process_started_from_process_id_file.toml +++ b/rules/linux/execution_process_started_from_process_id_file.toml @@ -33,7 +33,16 @@ Detection alerts from this rule indicate a process spawned from an executable ma - Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: "SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';" - Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation. -## Setup +""" +references = [ + "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", +] +risk_score = 73 +rule_id = "3688577a-d196-11ec-90b0-f661ea17fbce" +setup = """ This rule requires data coming in from Elastic Defend. @@ -60,14 +69,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", - "https://twitter.com/GossiTheDog/status/1522964028284411907", - "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", - "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", -] -risk_score = 73 -rule_id = "3688577a-d196-11ec-90b0-f661ea17fbce" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: BPFDoor", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_process_started_in_shared_memory_directory.toml b/rules/linux/execution_process_started_in_shared_memory_directory.toml index e5cf38c38..cd552764c 100644 --- a/rules/linux/execution_process_started_in_shared_memory_directory.toml +++ b/rules/linux/execution_process_started_in_shared_memory_directory.toml @@ -25,7 +25,14 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Binary Executed from Shared Memory Directory" -note = """## Setup +references = [ + "https://linuxsecurity.com/features/fileless-malware-on-linux", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", +] +risk_score = 73 +rule_id = "3f3f9fe2-d095-11ec-95dc-f661ea17fbce" +setup = """ This rule requires data coming in from Elastic Defend. @@ -52,13 +59,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://linuxsecurity.com/features/fileless-malware-on-linux", - "https://twitter.com/GossiTheDog/status/1522964028284411907", - "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", -] -risk_score = 73 -rule_id = "3f3f9fe2-d095-11ec-95dc-f661ea17fbce" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: BPFDoor", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_python_tty_shell.toml b/rules/linux/execution_python_tty_shell.toml index d07a62e87..97d813820 100644 --- a/rules/linux/execution_python_tty_shell.toml +++ b/rules/linux/execution_python_tty_shell.toml @@ -17,7 +17,9 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Interactive Terminal Spawned via Python" -note = """## Setup +risk_score = 73 +rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -44,8 +46,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 73 -rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f" severity = "high" timestamp_override = "event.ingested" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] diff --git a/rules/linux/execution_remote_code_execution_via_postgresql.toml b/rules/linux/execution_remote_code_execution_via_postgresql.toml index 797349051..6f6c86241 100644 --- a/rules/linux/execution_remote_code_execution_via_postgresql.toml +++ b/rules/linux/execution_remote_code_execution_via_postgresql.toml @@ -20,7 +20,9 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Code Execution via Postgresql" -note = """## Setup +risk_score = 47 +rule_id = "2a692072-d78d-42f3-a48a-775677d79c4e" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,8 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "2a692072-d78d-42f3-a48a-775677d79c4e" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_shell_evasion_linux_binary.toml b/rules/linux/execution_shell_evasion_linux_binary.toml index 09e519242..451fd92b1 100644 --- a/rules/linux/execution_shell_evasion_linux_binary.toml +++ b/rules/linux/execution_shell_evasion_linux_binary.toml @@ -63,7 +63,37 @@ Initiate the incident response process based on the outcome of the triage. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://gtfobins.github.io/gtfobins/apt/", + "https://gtfobins.github.io/gtfobins/apt-get/", + "https://gtfobins.github.io/gtfobins/nawk/", + "https://gtfobins.github.io/gtfobins/mawk/", + "https://gtfobins.github.io/gtfobins/awk/", + "https://gtfobins.github.io/gtfobins/gawk/", + "https://gtfobins.github.io/gtfobins/busybox/", + "https://gtfobins.github.io/gtfobins/c89/", + "https://gtfobins.github.io/gtfobins/c99/", + "https://gtfobins.github.io/gtfobins/cpulimit/", + "https://gtfobins.github.io/gtfobins/crash/", + "https://gtfobins.github.io/gtfobins/env/", + "https://gtfobins.github.io/gtfobins/expect/", + "https://gtfobins.github.io/gtfobins/find/", + "https://gtfobins.github.io/gtfobins/flock/", + "https://gtfobins.github.io/gtfobins/gcc/", + "https://gtfobins.github.io/gtfobins/mysql/", + "https://gtfobins.github.io/gtfobins/nice/", + "https://gtfobins.github.io/gtfobins/ssh/", + "https://gtfobins.github.io/gtfobins/vi/", + "https://gtfobins.github.io/gtfobins/vim/", + "https://gtfobins.github.io/gtfobins/capsh/", + "https://gtfobins.github.io/gtfobins/byebug/", + "https://gtfobins.github.io/gtfobins/git/", + "https://gtfobins.github.io/gtfobins/ftp/", +] +risk_score = 47 +rule_id = "52376a86-ee86-4967-97ae-1a05f55816f0" +setup = """ This rule requires data coming in from Elastic Defend. @@ -100,35 +130,6 @@ For more information about the additional fields collected when this setting is the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). """ -references = [ - "https://gtfobins.github.io/gtfobins/apt/", - "https://gtfobins.github.io/gtfobins/apt-get/", - "https://gtfobins.github.io/gtfobins/nawk/", - "https://gtfobins.github.io/gtfobins/mawk/", - "https://gtfobins.github.io/gtfobins/awk/", - "https://gtfobins.github.io/gtfobins/gawk/", - "https://gtfobins.github.io/gtfobins/busybox/", - "https://gtfobins.github.io/gtfobins/c89/", - "https://gtfobins.github.io/gtfobins/c99/", - "https://gtfobins.github.io/gtfobins/cpulimit/", - "https://gtfobins.github.io/gtfobins/crash/", - "https://gtfobins.github.io/gtfobins/env/", - "https://gtfobins.github.io/gtfobins/expect/", - "https://gtfobins.github.io/gtfobins/find/", - "https://gtfobins.github.io/gtfobins/flock/", - "https://gtfobins.github.io/gtfobins/gcc/", - "https://gtfobins.github.io/gtfobins/mysql/", - "https://gtfobins.github.io/gtfobins/nice/", - "https://gtfobins.github.io/gtfobins/ssh/", - "https://gtfobins.github.io/gtfobins/vi/", - "https://gtfobins.github.io/gtfobins/vim/", - "https://gtfobins.github.io/gtfobins/capsh/", - "https://gtfobins.github.io/gtfobins/byebug/", - "https://gtfobins.github.io/gtfobins/git/", - "https://gtfobins.github.io/gtfobins/ftp/", -] -risk_score = 47 -rule_id = "52376a86-ee86-4967-97ae-1a05f55816f0" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml index 56ba42a8d..44cc4040c 100644 --- a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml +++ b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Suspicious Parent Process" -note = """## Setup +references = [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" +] +risk_score = 47 +rule_id = "4b1a807a-4e7b-414e-8cea-24bf580f6fc5" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" -] -risk_score = 47 -rule_id = "4b1a807a-4e7b-414e-8cea-24bf580f6fc5" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_shell_via_background_process.toml b/rules/linux/execution_shell_via_background_process.toml index d07cc37b0..7730650b5 100644 --- a/rules/linux/execution_shell_via_background_process.toml +++ b/rules/linux/execution_shell_via_background_process.toml @@ -17,7 +17,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Background Process" -note = """## Setup +risk_score = 47 +rule_id = "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39" +setup = """ This rule requires data coming in from Elastic Defend. @@ -44,8 +46,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39" severity = "medium" timestamp_override = "event.ingested" tags = ["Domain: Endpoint", diff --git a/rules/linux/execution_shell_via_java_revshell_linux.toml b/rules/linux/execution_shell_via_java_revshell_linux.toml index 592cd40df..36a76f1f2 100644 --- a/rules/linux/execution_shell_via_java_revshell_linux.toml +++ b/rules/linux/execution_shell_via_java_revshell_linux.toml @@ -17,7 +17,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Java" -note = """## Setup +references = [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" +] +risk_score = 47 +rule_id = "5a3d5447-31c9-409a-aed1-72f9921594fd" +setup = """ This rule requires data coming in from Elastic Defend. @@ -44,11 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" -] -risk_score = 47 -rule_id = "5a3d5447-31c9-409a-aed1-72f9921594fd" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml index d87055208..443509f2f 100644 --- a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml +++ b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Suspicious Child Process" -note = """## Setup +references = [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" +] +risk_score = 47 +rule_id = "76e4d92b-61c1-4a95-ab61-5fd94179a1ee" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" -] -risk_score = 47 -rule_id = "76e4d92b-61c1-4a95-ab61-5fd94179a1ee" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_shell_via_meterpreter_linux.toml b/rules/linux/execution_shell_via_meterpreter_linux.toml index d9b08d448..6e2491a2d 100644 --- a/rules/linux/execution_shell_via_meterpreter_linux.toml +++ b/rules/linux/execution_shell_via_meterpreter_linux.toml @@ -18,8 +18,9 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "eql" license = "Elastic License v2" name = "Potential Meterpreter Reverse Shell" -note = """## Setup -## Setup +risk_score = 47 +rule_id = "5c895b4f-9133-4e68-9e23-59902175355c" +setup = """ This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. @@ -56,8 +57,6 @@ However, if more advanced configuration is required to detect specific behavior, -w /etc/passwd -p wa -k passwd """ -risk_score = 47 -rule_id = "5c895b4f-9133-4e68-9e23-59902175355c" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_shell_via_suspicious_binary.toml b/rules/linux/execution_shell_via_suspicious_binary.toml index 6e7a7ea43..2b7101c6c 100644 --- a/rules/linux/execution_shell_via_suspicious_binary.toml +++ b/rules/linux/execution_shell_via_suspicious_binary.toml @@ -19,7 +19,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via Suspicious Binary" -note = """## Setup +references = [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" +] +risk_score = 47 +rule_id = "fa3a59dc-33c3-43bf-80a9-e8437a922c7f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,11 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" -] -risk_score = 47 -rule_id = "fa3a59dc-33c3-43bf-80a9-e8437a922c7f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml index 6ec8c3330..a743d7bfe 100644 --- a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell" -note = """## Setup +references = [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" +] +risk_score = 47 +rule_id = "48b3d2e3-f4e8-41e6-95e6-9b2091228db3" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" -] -risk_score = 47 -rule_id = "48b3d2e3-f4e8-41e6-95e6-9b2091228db3" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml index 103a84f7e..49c9fbd28 100644 --- a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml @@ -19,7 +19,12 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "eql" license = "Elastic License v2" name = "Potential Reverse Shell via UDP" -note = """## Setup +references = [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" +] +risk_score = 47 +rule_id = "a5eb21b7-13cc-4b94-9fe2-29bb2914e037" +setup = """ This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. @@ -53,11 +58,6 @@ However, if more advanced configuration is required to detect specific behavior, - For this detection rule no additional audit rules are required to be added to the integration. """ -references = [ - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" -] -risk_score = 47 -rule_id = "a5eb21b7-13cc-4b94-9fe2-29bb2914e037" severity = "medium" tags = ["OS: Linux", "Use Case: Threat Detection", "Tactic: Execution"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml b/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml index 7e07c79a9..3cef618ea 100644 --- a/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml +++ b/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml @@ -19,7 +19,12 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious Content Extracted or Decompressed via Funzip" -note = """## Setup +references = [ + "https://attack.mitre.org/software/S0482/" +] +risk_score = 47 +rule_id = "dc0b7782-0df0-47ff-8337-db0d678bdb66" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,11 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://attack.mitre.org/software/S0482/" -] -risk_score = 47 -rule_id = "dc0b7782-0df0-47ff-8337-db0d678bdb66" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_suspicious_executable_running_system_commands.toml b/rules/linux/execution_suspicious_executable_running_system_commands.toml index c922a56ba..0b079f747 100644 --- a/rules/linux/execution_suspicious_executable_running_system_commands.toml +++ b/rules/linux/execution_suspicious_executable_running_system_commands.toml @@ -20,7 +20,9 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Suspicious System Commands Executed by Previously Unknown Executable" -note = """## Setup +risk_score = 21 +rule_id = "e9001ee6-2d00-4d2f-849e-b8b1fb05234c" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,8 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "e9001ee6-2d00-4d2f-849e-b8b1fb05234c" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_suspicious_mining_process_creation_events.toml b/rules/linux/execution_suspicious_mining_process_creation_events.toml index ac82791ee..e0f79506e 100644 --- a/rules/linux/execution_suspicious_mining_process_creation_events.toml +++ b/rules/linux/execution_suspicious_mining_process_creation_events.toml @@ -17,7 +17,9 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious Mining Process Creation Event" -note = """## Setup +risk_score = 47 +rule_id = "e2258f48-ba75-4248-951b-7c885edf18c2" +setup = """ This rule requires data coming in from Elastic Defend. @@ -44,8 +46,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "e2258f48-ba75-4248-951b-7c885edf18c2" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_tc_bpf_filter.toml b/rules/linux/execution_tc_bpf_filter.toml index cc89f4b77..56d562e00 100644 --- a/rules/linux/execution_tc_bpf_filter.toml +++ b/rules/linux/execution_tc_bpf_filter.toml @@ -16,7 +16,13 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "BPF filter applied using TC" -note = """## Setup +references = [ + "https://github.com/h3xduck/TripleCross/blob/master/src/helpers/deployer.sh", + "https://man7.org/linux/man-pages/man8/tc.8.html", +] +risk_score = 73 +rule_id = "ef04a476-07ec-48fc-8f3d-5e1742de76d3" +setup = """ This rule requires data coming in from Elastic Defend. @@ -43,12 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://github.com/h3xduck/TripleCross/blob/master/src/helpers/deployer.sh", - "https://man7.org/linux/man-pages/man8/tc.8.html", -] -risk_score = 73 -rule_id = "ef04a476-07ec-48fc-8f3d-5e1742de76d3" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: TripleCross", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/impact_data_encrypted_via_openssl.toml b/rules/linux/impact_data_encrypted_via_openssl.toml index 2d4036dbe..03a5a410e 100644 --- a/rules/linux/impact_data_encrypted_via_openssl.toml +++ b/rules/linux/impact_data_encrypted_via_openssl.toml @@ -18,7 +18,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Data Encryption via OpenSSL Utility" -note = """## Setup +references = [ + "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/", + "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html", +] +risk_score = 47 +rule_id = "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,12 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/", - "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html", -] -risk_score = 47 -rule_id = "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/impact_esxi_process_kill.toml b/rules/linux/impact_esxi_process_kill.toml index 63ae7a1b3..97212297a 100644 --- a/rules/linux/impact_esxi_process_kill.toml +++ b/rules/linux/impact_esxi_process_kill.toml @@ -19,7 +19,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Termination of ESXI Process" -note = """## Setup +references = [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", +] +risk_score = 47 +rule_id = "6641a5af-fb7e-487a-adc4-9e6503365318" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,11 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", -] -risk_score = 47 -rule_id = "6641a5af-fb7e-487a-adc4-9e6503365318" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml index 93fe0e47f..65b44554c 100644 --- a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml +++ b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml @@ -19,7 +19,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious File Changes Activity Detected" -note = """## Setup +risk_score = 47 +rule_id = "28738f9f-7427-4d23-bc69-756708b5f624" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,8 +48,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "28738f9f-7427-4d23-bc69-756708b5f624" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/impact_potential_linux_ransomware_note_detected.toml b/rules/linux/impact_potential_linux_ransomware_note_detected.toml index 73c2bd27f..97e871911 100644 --- a/rules/linux/impact_potential_linux_ransomware_note_detected.toml +++ b/rules/linux/impact_potential_linux_ransomware_note_detected.toml @@ -20,7 +20,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Linux Ransomware Note Creation Detected" -note = """## Setup +risk_score = 47 +rule_id = "c8935a8b-634a-4449-98f7-bb24d3b2c0af" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,8 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "c8935a8b-634a-4449-98f7-bb24d3b2c0af" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/impact_process_kill_threshold.toml b/rules/linux/impact_process_kill_threshold.toml index 837e48844..d89857749 100644 --- a/rules/linux/impact_process_kill_threshold.toml +++ b/rules/linux/impact_process_kill_threshold.toml @@ -47,7 +47,10 @@ This rule identifies a high number (10) of process terminations via pkill from t - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +risk_score = 47 +rule_id = "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b" +setup = """ This rule requires data coming in from Elastic Defend. @@ -74,8 +77,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] type = "threshold" diff --git a/rules/linux/lateral_movement_telnet_network_activity_external.toml b/rules/linux/lateral_movement_telnet_network_activity_external.toml index a76ae89b6..e48026c94 100644 --- a/rules/linux/lateral_movement_telnet_network_activity_external.toml +++ b/rules/linux/lateral_movement_telnet_network_activity_external.toml @@ -25,7 +25,10 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Connection to External Network via Telnet" -note = """## Setup +references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"] +risk_score = 47 +rule_id = "e19e64ee-130e-4c07-961f-8a339f0b8362" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -62,9 +65,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"] -risk_score = 47 -rule_id = "e19e64ee-130e-4c07-961f-8a339f0b8362" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/lateral_movement_telnet_network_activity_internal.toml b/rules/linux/lateral_movement_telnet_network_activity_internal.toml index a63763a96..3e7f21eff 100644 --- a/rules/linux/lateral_movement_telnet_network_activity_internal.toml +++ b/rules/linux/lateral_movement_telnet_network_activity_internal.toml @@ -25,7 +25,10 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Connection to Internal Network via Telnet" -note = """## Setup +references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"] +risk_score = 47 +rule_id = "1b21abcc-4d9f-4b08-a7f5-316f5f94b973" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -62,9 +65,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"] -risk_score = 47 -rule_id = "1b21abcc-4d9f-4b08-a7f5-316f5f94b973" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/persistence_chkconfig_service_add.toml b/rules/linux/persistence_chkconfig_service_add.toml index 053e792f6..2f05217ce 100644 --- a/rules/linux/persistence_chkconfig_service_add.toml +++ b/rules/linux/persistence_chkconfig_service_add.toml @@ -19,7 +19,12 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Chkconfig Service Add" -note = """## Setup +references = [ + "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" +] +risk_score = 47 +rule_id = "b910f25a-2d44-47f2-a873-aabdc0d355e6" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,11 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" -] -risk_score = 47 -rule_id = "b910f25a-2d44-47f2-a873-aabdc0d355e6" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Threat: Lightning Framework", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml index be7fb39ac..81f127c75 100644 --- a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml +++ b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml @@ -20,7 +20,10 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Modification of OpenSSH Binaries" -note = """## Setup +references = ["https://blog.angelalonso.es/2016/09/anatomy-of-real-linux-intrusion-part-ii.html"] +risk_score = 47 +rule_id = "0415f22a-2336-45fa-ba07-618a5942e22c" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -57,9 +60,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = ["https://blog.angelalonso.es/2016/09/anatomy-of-real-linux-intrusion-part-ii.html"] -risk_score = 47 -rule_id = "0415f22a-2336-45fa-ba07-618a5942e22c" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Persistence", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_cron_job_creation.toml b/rules/linux/persistence_cron_job_creation.toml index 3432dade7..2d87b99bf 100644 --- a/rules/linux/persistence_cron_job_creation.toml +++ b/rules/linux/persistence_cron_job_creation.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Cron Job Created or Changed by Previously Unknown Process" -note = """## Setup +references = [ + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" +] +risk_score = 47 +rule_id = "ff10d4d8-fea7-422d-afb1-e5a2702369a9" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" -] -risk_score = 47 -rule_id = "ff10d4d8-fea7-422d-afb1-e5a2702369a9" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_dynamic_linker_backup.toml b/rules/linux/persistence_dynamic_linker_backup.toml index 97ba64992..c1face66f 100644 --- a/rules/linux/persistence_dynamic_linker_backup.toml +++ b/rules/linux/persistence_dynamic_linker_backup.toml @@ -16,7 +16,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Dynamic Linker Copy" -note = """## Setup +references = [ + "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/" +] +risk_score = 73 +rule_id = "df6f62d9-caab-4b88-affa-044f4395a1e0" +setup = """ This rule requires data coming in from Elastic Defend. @@ -43,11 +48,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/" -] -risk_score = 73 -rule_id = "df6f62d9-caab-4b88-affa-044f4395a1e0" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Threat: Orbit", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/persistence_etc_file_creation.toml b/rules/linux/persistence_etc_file_creation.toml index a9626a5dd..3c6a89a9e 100644 --- a/rules/linux/persistence_etc_file_creation.toml +++ b/rules/linux/persistence_etc_file_creation.toml @@ -18,7 +18,13 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious File Creation in /etc for Persistence" -note = """## Setup +references = [ + "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/", + "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" +] +risk_score = 47 +rule_id = "1c84dd64-7e6c-4bad-ac73-a5014ee37042" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,12 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/", - "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" -] -risk_score = 47 -rule_id = "1c84dd64-7e6c-4bad-ac73-a5014ee37042" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Threat: Orbit", "Threat: Lightning Framework", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_init_d_file_creation.toml b/rules/linux/persistence_init_d_file_creation.toml index cb4afdaf8..18ae474cd 100644 --- a/rules/linux/persistence_init_d_file_creation.toml +++ b/rules/linux/persistence_init_d_file_creation.toml @@ -118,7 +118,16 @@ This rule looks for the creation of new files within the `/etc/init.d/` director - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + +] +risk_score = 47 +rule_id = "474fd20e-14cc-49c5-8160-d9ab4ba16c8b" +setup = """ This rule requires data coming in from Elastic Defend. @@ -145,14 +154,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", - "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", - "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" - -] -risk_score = 47 -rule_id = "474fd20e-14cc-49c5-8160-d9ab4ba16c8b" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_insmod_kernel_module_load.toml b/rules/linux/persistence_insmod_kernel_module_load.toml index 9287a2a02..a69b50ca5 100644 --- a/rules/linux/persistence_insmod_kernel_module_load.toml +++ b/rules/linux/persistence_insmod_kernel_module_load.toml @@ -16,7 +16,12 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Kernel module load via insmod" -note = """## Setup +references = [ + "https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/" +] +risk_score = 47 +rule_id = "2339f03c-f53f-40fa-834b-40c5983fc41f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -43,11 +48,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/" -] -risk_score = 47 -rule_id = "2339f03c-f53f-40fa-834b-40c5983fc41f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Threat: Rootkit", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_kde_autostart_modification.toml b/rules/linux/persistence_kde_autostart_modification.toml index 41c72b639..4e40e7a1f 100644 --- a/rules/linux/persistence_kde_autostart_modification.toml +++ b/rules/linux/persistence_kde_autostart_modification.toml @@ -17,7 +17,14 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Persistence via KDE AutoStart Script or Desktop File Modification" -note = """## Setup +references = [ + "https://userbase.kde.org/System_Settings/Autostart", + "https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/", + "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/", +] +risk_score = 47 +rule_id = "e3e904b3-0a8e-4e68-86a8-977a163e21d3" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -57,13 +64,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). """ -references = [ - "https://userbase.kde.org/System_Settings/Autostart", - "https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/", - "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/", -] -risk_score = 47 -rule_id = "e3e904b3-0a8e-4e68-86a8-977a163e21d3" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_linux_backdoor_user_creation.toml b/rules/linux/persistence_linux_backdoor_user_creation.toml index 5a0083f81..cbe874f66 100644 --- a/rules/linux/persistence_linux_backdoor_user_creation.toml +++ b/rules/linux/persistence_linux_backdoor_user_creation.toml @@ -85,7 +85,10 @@ This rule identifies the usage of the `usermod` command to set a user's UID to 0 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +risk_score = 47 +rule_id = "494ebba4-ecb7-4be4-8c6f-654c686549ad" +setup = """ This rule requires data coming in from Elastic Defend. @@ -112,8 +115,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "494ebba4-ecb7-4be4-8c6f-654c686549ad" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_linux_shell_activity_via_web_server.toml b/rules/linux/persistence_linux_shell_activity_via_web_server.toml index 3b46623a7..043072fe1 100644 --- a/rules/linux/persistence_linux_shell_activity_via_web_server.toml +++ b/rules/linux/persistence_linux_shell_activity_via_web_server.toml @@ -98,7 +98,14 @@ This rule detects a web server process spawning script and command line interfac - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://pentestlab.blog/tag/web-shell/", + "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965", +] +risk_score = 73 +rule_id = "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb" +setup = """ This rule requires data coming in from Elastic Defend. @@ -125,12 +132,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://pentestlab.blog/tag/web-shell/", - "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965", -] -risk_score = 73 -rule_id = "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_linux_user_added_to_privileged_group.toml b/rules/linux/persistence_linux_user_added_to_privileged_group.toml index af3fa56e8..ad80c897f 100644 --- a/rules/linux/persistence_linux_user_added_to_privileged_group.toml +++ b/rules/linux/persistence_linux_user_added_to_privileged_group.toml @@ -80,7 +80,10 @@ This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +risk_score = 47 +rule_id = "43d6ec12-2b1c-47b5-8f35-e9de65551d3b" +setup = """ This rule requires data coming in from Elastic Defend. @@ -107,8 +110,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "43d6ec12-2b1c-47b5-8f35-e9de65551d3b" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_message_of_the_day_creation.toml b/rules/linux/persistence_message_of_the_day_creation.toml index 137030323..170d7f94e 100644 --- a/rules/linux/persistence_message_of_the_day_creation.toml +++ b/rules/linux/persistence_message_of_the_day_creation.toml @@ -115,7 +115,13 @@ This rule identifies the creation of new files within the `/etc/update-motd.d/` - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" +] +risk_score = 47 +rule_id = "96d11d31-9a79-480f-8401-da28b194608f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -142,11 +148,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" -] -risk_score = 47 -rule_id = "96d11d31-9a79-480f-8401-da28b194608f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "new_terms" diff --git a/rules/linux/persistence_message_of_the_day_execution.toml b/rules/linux/persistence_message_of_the_day_execution.toml index da45d8cad..7f2672014 100644 --- a/rules/linux/persistence_message_of_the_day_execution.toml +++ b/rules/linux/persistence_message_of_the_day_execution.toml @@ -114,7 +114,13 @@ This rule identifies the execution of potentially malicious processes from a MOT - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" +] +risk_score = 73 +rule_id = "4ec47004-b34a-42e6-8003-376a123ea447" +setup = """ This rule requires data coming in from Elastic Defend. @@ -141,11 +147,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" -] -risk_score = 73 -rule_id = "4ec47004-b34a-42e6-8003-376a123ea447" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_rc_script_creation.toml b/rules/linux/persistence_rc_script_creation.toml index 254409cfc..7ce4e1616 100644 --- a/rules/linux/persistence_rc_script_creation.toml +++ b/rules/linux/persistence_rc_script_creation.toml @@ -97,7 +97,16 @@ Detection alerts from this rule indicate the creation of a new `/etc/rc.local` f - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + +] +risk_score = 47 +rule_id = "0f4d35e4-925e-4959-ab24-911be207ee6f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -124,14 +133,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", - "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", - "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" - -] -risk_score = 47 -rule_id = "0f4d35e4-925e-4959-ab24-911be207ee6f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] type = "new_terms" diff --git a/rules/linux/persistence_shared_object_creation.toml b/rules/linux/persistence_shared_object_creation.toml index 7b744dc5a..1f05b3741 100644 --- a/rules/linux/persistence_shared_object_creation.toml +++ b/rules/linux/persistence_shared_object_creation.toml @@ -21,7 +21,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Shared Object Created or Changed by Previously Unknown Process" -note = """## Setup +references = ["https://threatpost.com/sneaky-malware-backdoors-linux/180158/"] +risk_score = 47 +rule_id = "aebaa51f-2a91-4f6a-850b-b601db2293f4" +setup = """ This rule requires data coming in from Elastic Defend. @@ -48,9 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://threatpost.com/sneaky-malware-backdoors-linux/180158/"] -risk_score = 47 -rule_id = "aebaa51f-2a91-4f6a-850b-b601db2293f4" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_systemd_scheduled_timer_created.toml b/rules/linux/persistence_systemd_scheduled_timer_created.toml index 27eba833f..1c5be6028 100644 --- a/rules/linux/persistence_systemd_scheduled_timer_created.toml +++ b/rules/linux/persistence_systemd_scheduled_timer_created.toml @@ -128,7 +128,14 @@ This rule monitors the creation of new systemd timer files, potentially indicati - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" +] +risk_score = 21 +rule_id = "7fb500fa-8e24-4bd1-9480-2a819352602c" +setup = """ This rule requires data coming in from Elastic Defend. @@ -155,12 +162,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://opensource.com/article/20/7/systemd-timers", - "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" -] -risk_score = 21 -rule_id = "7fb500fa-8e24-4bd1-9480-2a819352602c" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_systemd_service_creation.toml b/rules/linux/persistence_systemd_service_creation.toml index 346b1ece8..31f6d7d6a 100644 --- a/rules/linux/persistence_systemd_service_creation.toml +++ b/rules/linux/persistence_systemd_service_creation.toml @@ -19,7 +19,13 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "New Systemd Service Created by Previously Unknown Process" -note = """## Setup +references = [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" +] +risk_score = 47 +rule_id = "17b0a495-4d9f-414c-8ad0-92f018b8e001" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,12 +52,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://opensource.com/article/20/7/systemd-timers", - "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" -] -risk_score = 47 -rule_id = "17b0a495-4d9f-414c-8ad0-92f018b8e001" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml b/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml index 4bb1c86e1..37e274ca2 100644 --- a/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml +++ b/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml @@ -19,7 +19,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Unauthorized Access via Wildcard Injection Detected" -note = """## Setup +references = ["https://www.exploit-db.com/papers/33930"] +risk_score = 21 +rule_id = "4a99ac6f-9a54-4ba5-a64f-6eb65695841b" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,9 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://www.exploit-db.com/papers/33930"] -risk_score = 21 -rule_id = "4a99ac6f-9a54-4ba5-a64f-6eb65695841b" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_container_util_misconfiguration.toml b/rules/linux/privilege_escalation_container_util_misconfiguration.toml index 3b89cb067..1f523a382 100644 --- a/rules/linux/privilege_escalation_container_util_misconfiguration.toml +++ b/rules/linux/privilege_escalation_container_util_misconfiguration.toml @@ -20,7 +20,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via Container Misconfiguration" -note = """## Setup +references = [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation", + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation" + ] +risk_score = 47 +rule_id = "afe6b0eb-dd9d-4922-b08a-1910124d524d" +setup = """ This rule requires data coming in from Elastic Defend. @@ -57,12 +63,6 @@ For more information about the additional fields collected when this setting is the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). """ -references = [ - "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation", - "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation" - ] -risk_score = 47 -rule_id = "afe6b0eb-dd9d-4922-b08a-1910124d524d" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Domain: Container", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml index 5b7cdee9c..b25c6ff05 100644 --- a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml +++ b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml @@ -17,7 +17,12 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Modification of Dynamic Linker Preload Shared Object" -note = """## Setup +references = [ + "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang", +] +risk_score = 47 +rule_id = "717f82c2-7741-4f9b-85b8-d06aeb853f4f" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -54,11 +59,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = [ - "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang", -] -risk_score = 47 -rule_id = "717f82c2-7741-4f9b-85b8-d06aeb853f4f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml index 1afa6a674..6a0b2c81d 100644 --- a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml +++ b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml @@ -20,7 +20,9 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Suspicious Symbolic Link Created" -note = """## Setup +risk_score = 21 +rule_id = "8a024633-c444-45c0-a4fe-78128d8c1ab6" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,8 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 21 -rule_id = "8a024633-c444-45c0-a4fe-78128d8c1ab6" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml b/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml index 0f4bf5a56..d75535a50 100644 --- a/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml +++ b/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml @@ -18,7 +18,13 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via UID INT_MAX Bug Detected" -note = """## Setup +references = [ + "https://twitter.com/paragonsec/status/1071152249529884674", + "https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh", + "https://gitlab.freedesktop.org/polkit/polkit/-/issues/74"] +risk_score = 47 +rule_id = "d55436a8-719c-445f-92c4-c113ff2f9ba5" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,12 +51,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://twitter.com/paragonsec/status/1071152249529884674", - "https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh", - "https://gitlab.freedesktop.org/polkit/polkit/-/issues/74"] -risk_score = 47 -rule_id = "d55436a8-719c-445f-92c4-c113ff2f9ba5" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml b/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml index 1650e7588..42bae30dd 100644 --- a/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml +++ b/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml @@ -20,7 +20,14 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Kernel Load or Unload via Kexec Detected" -note = """## Setup +references = [ + "https://www.crowdstrike.com/blog/venom-vulnerability-details/", + "https://www.makeuseof.com/what-is-venom-vulnerability/", + "https://madaidans-insecurities.github.io/guides/linux-hardening.html" +] +risk_score = 47 +rule_id = "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,13 +54,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.crowdstrike.com/blog/venom-vulnerability-details/", - "https://www.makeuseof.com/what-is-venom-vulnerability/", - "https://madaidans-insecurities.github.io/guides/linux-hardening.html" -] -risk_score = 47 -rule_id = "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml index cb6397acd..4bc6f8901 100644 --- a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml +++ b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml @@ -17,7 +17,10 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via CVE-2023-4911" -note = """## Setup +references = ["https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so"] +risk_score = 73 +rule_id = "6d8685a1-94fa-4ef7-83de-59302e7c4ca8" +setup = """ This rule requires data coming in from Elastic Defend. @@ -58,9 +61,6 @@ the rule will function properly. For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). """ -references = ["https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so"] -risk_score = 73 -rule_id = "6d8685a1-94fa-4ef7-83de-59302e7c4ca8" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/linux/privilege_escalation_overlayfs_local_privesc.toml b/rules/linux/privilege_escalation_overlayfs_local_privesc.toml index 9c21014ea..90c623e53 100644 --- a/rules/linux/privilege_escalation_overlayfs_local_privesc.toml +++ b/rules/linux/privilege_escalation_overlayfs_local_privesc.toml @@ -18,7 +18,12 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via OverlayFS" -note = """## Setup +references = [ + "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", + "https://twitter.com/liadeliyahu/status/1684841527959273472"] +risk_score = 73 +rule_id = "b51dbc92-84e2-4af1-ba47-65183fcd0c57" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,11 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = [ - "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", - "https://twitter.com/liadeliyahu/status/1684841527959273472"] -risk_score = 73 -rule_id = "b51dbc92-84e2-4af1-ba47-65183fcd0c57" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Use Case: Vulnerability", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/privilege_escalation_pkexec_envar_hijack.toml b/rules/linux/privilege_escalation_pkexec_envar_hijack.toml index 72b261bf6..a07265022 100644 --- a/rules/linux/privilege_escalation_pkexec_envar_hijack.toml +++ b/rules/linux/privilege_escalation_pkexec_envar_hijack.toml @@ -17,7 +17,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via PKEXEC" -note = """## Setup +references = ["https://seclists.org/oss-sec/2022/q1/80", "https://haxx.in/files/blasty-vs-pkexec.c"] +risk_score = 73 +rule_id = "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9" +setup = """ This rule requires data coming in from Elastic Defend. @@ -44,9 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://seclists.org/oss-sec/2022/q1/80", "https://haxx.in/files/blasty-vs-pkexec.c"] -risk_score = 73 -rule_id = "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml b/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml index d758d5950..d450ee6fb 100644 --- a/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml +++ b/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml @@ -19,7 +19,10 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Shell via Wildcard Injection Detected" -note = """## Setup +references = ["https://www.exploit-db.com/papers/33930"] +risk_score = 47 +rule_id = "0b803267-74c5-444d-ae29-32b5db2d562a" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,9 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://www.exploit-db.com/papers/33930"] -risk_score = 47 -rule_id = "0b803267-74c5-444d-ae29-32b5db2d562a" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Execution", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml b/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml index d29462493..d5573c48b 100644 --- a/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml +++ b/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml @@ -20,7 +20,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Suspicious DebugFS Root Device Access" -note = """## Setup +references = ["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#disk-group"] +risk_score = 21 +rule_id = "2605aa59-29ac-4662-afad-8d86257c7c91" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,9 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#disk-group"] -risk_score = 21 -rule_id = "2605aa59-29ac-4662-afad-8d86257c7c91" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_shadow_file_read.toml b/rules/linux/privilege_escalation_shadow_file_read.toml index 956ba1fd2..d4a4ee038 100644 --- a/rules/linux/privilege_escalation_shadow_file_read.toml +++ b/rules/linux/privilege_escalation_shadow_file_read.toml @@ -18,7 +18,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Potential Shadow File Read via Command Line Utilities" -note = """## Setup +references = ["https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/"] +risk_score = 47 +rule_id = "9a3a3689-8ed1-4cdb-83fb-9506db54c61f" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,9 +48,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/"] -risk_score = 47 -rule_id = "9a3a3689-8ed1-4cdb-83fb-9506db54c61f" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml b/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml index baa49acaf..5fc7846be 100644 --- a/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml +++ b/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml @@ -19,7 +19,10 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Sudo Privilege Escalation via CVE-2019-14287" -note = """## Setup +references = ["https://www.exploit-db.com/exploits/47502"] +risk_score = 47 +rule_id = "8af5b42f-8d74-48c8-a8d0-6d14b4197288" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,9 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://www.exploit-db.com/exploits/47502"] -risk_score = 47 -rule_id = "8af5b42f-8d74-48c8-a8d0-6d14b4197288" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend", "Use Case: Vulnerability"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_sudo_hijacking.toml b/rules/linux/privilege_escalation_sudo_hijacking.toml index 2ba4a6d0a..6926f3b31 100644 --- a/rules/linux/privilege_escalation_sudo_hijacking.toml +++ b/rules/linux/privilege_escalation_sudo_hijacking.toml @@ -18,7 +18,10 @@ index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Potential Sudo Hijacking Detected" -note = """## Setup +references = ["https://eapolsniper.github.io/2020/08/17/Sudo-Hijacking/"] +risk_score = 47 +rule_id = "88fdcb8c-60e5-46ee-9206-2663adf1b1ce" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,9 +48,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://eapolsniper.github.io/2020/08/17/Sudo-Hijacking/"] -risk_score = 47 -rule_id = "88fdcb8c-60e5-46ee-9206-2663adf1b1ce" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml b/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml index 87b4880b1..eb18f91c2 100644 --- a/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml +++ b/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml @@ -20,7 +20,10 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Sudo Token Manipulation via Process Injection" -note = """## Setup +references = ["https://github.com/nongiach/sudo_inject"] +risk_score = 47 +rule_id = "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b" +setup = """ This rule requires data coming in from Elastic Defend. @@ -47,9 +50,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://github.com/nongiach/sudo_inject"] -risk_score = 47 -rule_id = "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/privilege_escalation_uid_change_post_compilation.toml b/rules/linux/privilege_escalation_uid_change_post_compilation.toml index c5e973630..ff74083a3 100644 --- a/rules/linux/privilege_escalation_uid_change_post_compilation.toml +++ b/rules/linux/privilege_escalation_uid_change_post_compilation.toml @@ -18,7 +18,9 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via Recently Compiled Executable" -note = """## Setup +risk_score = 47 +rule_id = "193549e8-bb9e-466a-a7f9-7e783f5cb5a6" +setup = """ This rule requires data coming in from Elastic Defend. @@ -45,8 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -risk_score = 47 -rule_id = "193549e8-bb9e-466a-a7f9-7e783f5cb5a6" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Use Case: Vulnerability", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml b/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml index 3be3707ba..0633c05a4 100644 --- a/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml +++ b/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml @@ -18,7 +18,13 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" name = "Namespace Manipulation Using Unshare" -note = """## Setup +references = [ + "https://man7.org/linux/man-pages/man1/unshare.1.html", + "https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/", +] +risk_score = 47 +rule_id = "d00f33e7-b57d-4023-9952-2db91b1767c4" +setup = """ This rule requires data coming in either from Elastic Defend, or Auditbeat integration. @@ -55,12 +61,6 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ -references = [ - "https://man7.org/linux/man-pages/man1/unshare.1.html", - "https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/", -] -risk_score = 47 -rule_id = "d00f33e7-b57d-4023-9952-2db91b1767c4" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_writable_docker_socket.toml b/rules/linux/privilege_escalation_writable_docker_socket.toml index c72918266..e24fad689 100644 --- a/rules/linux/privilege_escalation_writable_docker_socket.toml +++ b/rules/linux/privilege_escalation_writable_docker_socket.toml @@ -19,7 +19,10 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation through Writable Docker Socket" -note = """## Setup +references = ["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#automatic-enumeration-and-escape"] +risk_score = 47 +rule_id = "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8" +setup = """ This rule requires data coming in from Elastic Defend. @@ -46,9 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ -references = ["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#automatic-enumeration-and-escape"] -risk_score = 47 -rule_id = "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Domain: Container", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" From 020fff3aea3e7dbb971b4bffb85bbd0e5d994d25 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 23 Oct 2023 16:28:58 +0200 Subject: [PATCH 54/86] [Rule Tuning] Linux Rules (#3092) * [Rule Tuning] [WIP] Linux DR * Update defense_evasion_binary_copied_to_suspicious_directory.toml * Fixed tag * Added additional tuning * unit test fix * Additional tuning * tuning * added max signals * Added max_signals=1 to brute force rules * Cross-Platform Tuning * Small fix * new_terms conversion * typo * new_terms conversion * Ransomware rule tuning * performance tuning * new_terms conversion for auditd_manager * tune * Need coffee * kql/eql stuff * formatting improvement * new_terms sudo hijacking conversion * exclusion * Deprecations that were added last tuning * Deprecations that were added last tuning * Increased max timespan for brute force rules * version bump * added domain tag * Two tunings * More tuning * Additional tuning * updated_date bump * query optimization * Tuning * Readded the exclusions for this one * Changed int comparison * Some tunings * Update persistence_systemd_scheduled_timer_created.toml * Update rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * [New Rule] Potential curl CVE-2023-38545 Exploitation * Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation" This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0. * Update rules/cross-platform/command_and_control_non_standard_ssh_port.toml * Update rules/linux/command_and_control_cat_network_activity.toml * Update persistence_message_of_the_day_execution.toml * Changed max_signals * Revert "Merge branch 'main' into rule-tuning-ongoing-dr" This reverts commit 1106b5d2eba1a3529eff325226d6baabfd4b0bf3, reversing changes made to 5ff510757f25b0cb32e1ef18e9e2c34c8ec325a8. * Revertable merge * Update defense_evasion_ld_preload_env_variable_process_injection.toml * File name change --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- ...and_and_control_linux_iodine_activity.toml | 21 +++-- ...reload_env_variable_process_injection.toml | 32 ++++--- ...and_and_control_non_standard_ssh_port.toml | 29 +++--- .../discovery_security_software_grep.toml | 28 ++++-- .../execution_revershell_via_shell_cmd.toml | 19 ++-- ...xecution_suspicious_jar_child_process.toml | 38 +++++--- .../impact_hosts_file_modified.toml | 14 +-- ...l_access_modify_auth_module_or_config.toml | 44 +++++---- ...ersistence_shell_profile_modification.toml | 34 +++---- ...ence_ssh_authorized_keys_modification.toml | 33 +++++-- ...privilege_escalation_sudoers_file_mod.toml | 20 +++-- ...mand_and_control_cat_network_activity.toml | 8 +- ...l_linux_tunneling_and_port_forwarding.toml | 28 +++--- ...work_activity_from_unknown_executable.toml | 90 ++++++------------- ...ial_access_collection_sensitive_files.toml | 35 +++++--- ...tential_linux_ssh_bruteforce_external.toml | 11 ++- ...tential_linux_ssh_bruteforce_internal.toml | 11 ++- ...tial_successful_linux_ssh_bruteforce.toml} | 11 ++- .../credential_access_ssh_backdoor_log.toml | 3 +- ...binary_copied_to_suspicious_directory.toml | 19 ++-- ...defense_evasion_file_mod_writable_dir.toml | 28 +++--- .../defense_evasion_log_files_deleted.toml | 17 ++-- .../discovery_kernel_module_enumeration.toml | 5 +- .../discovery_suid_sguid_enumeration.toml | 6 +- ...overy_unusual_user_enumeration_via_id.toml | 3 +- ...tion_abnormal_process_id_file_created.toml | 14 ++- rules/linux/execution_python_tty_shell.toml | 8 +- ..._remote_code_execution_via_postgresql.toml | 9 +- .../execution_shell_evasion_linux_binary.toml | 2 +- ...uspicious_parent_child_revshell_linux.toml | 16 ++-- ...ecution_shell_via_java_revshell_linux.toml | 14 +-- ...on_shell_via_lolbin_interpreter_linux.toml | 46 ++++++---- ...ution_shell_via_tcp_cli_utility_linux.toml | 13 +-- ...ution_shell_via_udp_cli_utility_linux.toml | 7 +- ...us_executable_running_system_commands.toml | 9 +- ...tial_linux_ransomware_file_encryption.toml | 19 ++-- ...ential_linux_ransomware_note_detected.toml | 19 ++-- ...credential_access_modify_ssh_binaries.toml | 3 +- .../linux/persistence_cron_job_creation.toml | 17 +++- ...persistence_insmod_kernel_module_load.toml | 15 +++- ...e_linux_shell_activity_via_web_server.toml | 2 +- ...rsistence_message_of_the_day_creation.toml | 20 +++-- ...sistence_message_of_the_day_execution.toml | 38 ++++++-- .../linux/persistence_rc_script_creation.toml | 16 +++- .../persistence_shared_object_creation.toml | 24 +++-- ...tence_systemd_scheduled_timer_created.toml | 18 +++- .../persistence_systemd_service_creation.toml | 34 +++++-- ...lation_ld_preload_shared_object_modif.toml | 33 ++++--- ...lation_linux_suspicious_symbolic_link.toml | 4 +- .../privilege_escalation_sudo_hijacking.toml | 31 +++++-- ...very_potential_network_sweep_detected.toml | 9 +- ...iscovery_potential_port_scan_detected.toml | 9 +- ...very_potential_syn_port_scan_detected.toml | 9 +- ...n_execution_msbuild_started_by_script.toml | 0 ...ry_kernel_module_enumeration_via_proc.toml | 32 ++++--- .../discovery_linux_modprobe_enumeration.toml | 33 ++++--- .../discovery_linux_sysctl_enumeration.toml | 30 +++++-- ...discovery_suspicious_proc_enumeration.toml | 18 ++-- ...ry_suspicious_which_command_execution.toml | 4 +- ...suspicious_file_opened_through_editor.toml | 9 +- 60 files changed, 749 insertions(+), 422 deletions(-) rename rules/{linux => _deprecated}/command_and_control_linux_iodine_activity.toml (75%) rename rules/{linux => _deprecated}/defense_evasion_ld_preload_env_variable_process_injection.toml (95%) rename rules/linux/{credential_access_bruteforce_password_guessing.toml => credential_access_potential_successful_linux_ssh_bruteforce.toml} (93%) mode change 100644 => 100755 rules/windows/defense_evasion_execution_msbuild_started_by_script.toml diff --git a/rules/linux/command_and_control_linux_iodine_activity.toml b/rules/_deprecated/command_and_control_linux_iodine_activity.toml similarity index 75% rename from rules/linux/command_and_control_linux_iodine_activity.toml rename to rules/_deprecated/command_and_control_linux_iodine_activity.toml index 871926ebc..175ce0171 100644 --- a/rules/linux/command_and_control_linux_iodine_activity.toml +++ b/rules/_deprecated/command_and_control_linux_iodine_activity.toml @@ -1,10 +1,11 @@ [metadata] creation_date = "2020/02/18" +deprecation_date = "2023/09/25" integration = ["endpoint"] -maturity = "production" +maturity = "deprecated" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/25" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -23,27 +24,37 @@ index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"] language = "kuery" license = "Elastic License v2" name = "Deprecated - Potential DNS Tunneling via Iodine" -note = """This rule was deprecated due to its addition to the umbrella `Potential Linux Tunneling and/or Port Forwarding` (6ee947e9-de7e-4281-a55d-09289bdf947e) rule.""" +note = "This rule was deprecated due to its addition to the umbrella `Potential Linux Tunneling and/or Port Forwarding` (6ee947e9-de7e-4281-a55d-09289bdf947e) rule." references = ["https://code.kryo.se/iodine/"] risk_score = 73 rule_id = "041d4d41-9589-43e2-ba13-5680af75ebc2" severity = "high" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", +] timestamp_override = "event.ingested" type = "query" + query = ''' event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(iodine or iodined) ''' + [[rule.threat]] framework = "MITRE ATT&CK" - [[rule.threat.technique]] id = "T1572" name = "Protocol Tunneling" reference = "https://attack.mitre.org/techniques/T1572/" + [rule.threat.tactic] id = "TA0011" name = "Command and Control" reference = "https://attack.mitre.org/tactics/TA0011/" + diff --git a/rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml b/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml similarity index 95% rename from rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml rename to rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml index 70a2ac9c5..9a4eec122 100644 --- a/rules/linux/defense_evasion_ld_preload_env_variable_process_injection.toml +++ b/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml @@ -1,10 +1,11 @@ [metadata] creation_date = "2023/06/26" +deprecation_date = "2023/09/25" integration = ["endpoint"] -maturity = "production" +maturity = "deprecated" min_stack_comments = "The linux.advanced.capture_env_vars option for Elastic Defend has been introduced in 8.6.0" min_stack_version = "8.6.0" -updated_date = "2023/10/12" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -65,63 +66,72 @@ references = ["https://www.getambassador.io/resources/code-injection-on-linux-an risk_score = 21 rule_id = "4973e46b-a663-41b8-a875-ced16dda2bb0" severity = "low" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend", +] timestamp_override = "event.ingested" type = "eql" + query = ''' process where host.os.type == "linux" and event.action == "exec" and process.env_vars : ("LD_PRELOAD=?*", "LD_LIBRARY_PATH=?*") ''' + [[rule.threat]] framework = "MITRE ATT&CK" - [[rule.threat.technique]] id = "T1574" name = "Hijack Execution Flow" reference = "https://attack.mitre.org/techniques/T1574/" - [[rule.threat.technique.subtechnique]] id = "T1574.006" name = "Dynamic Linker Hijacking" reference = "https://attack.mitre.org/techniques/T1574/006/" + + [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" - [[rule.threat]] framework = "MITRE ATT&CK" - [[rule.threat.technique]] id = "T1574" name = "Hijack Execution Flow" reference = "https://attack.mitre.org/techniques/T1574/" - [[rule.threat.technique.subtechnique]] id = "T1574.006" name = "Dynamic Linker Hijacking" reference = "https://attack.mitre.org/techniques/T1574/006/" + + [rule.threat.tactic] id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" - [[rule.threat]] framework = "MITRE ATT&CK" - [[rule.threat.technique]] id = "T1574" name = "Hijack Execution Flow" reference = "https://attack.mitre.org/techniques/T1574/" - [[rule.threat.technique.subtechnique]] id = "T1574.006" name = "Dynamic Linker Hijacking" reference = "https://attack.mitre.org/techniques/T1574/006/" + + [rule.threat.tactic] id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" + diff --git a/rules/cross-platform/command_and_control_non_standard_ssh_port.toml b/rules/cross-platform/command_and_control_non_standard_ssh_port.toml index 9ab2adb5f..b863a6bf6 100644 --- a/rules/cross-platform/command_and_control_non_standard_ssh_port.toml +++ b/rules/cross-platform/command_and_control_non_standard_ssh_port.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -30,31 +30,36 @@ references = ["https://attack.mitre.org/techniques/T1571/"] risk_score = 21 rule_id = "bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9" severity = "low" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "OS: macOS", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "OS: macOS", + "Data Source: Elastic Defend" + ] type = "eql" query = ''' sequence by process.entity_id with maxspan=1m -[process where event.action == "exec" and process.name:"ssh"] -[network where process.name:"ssh" - and event.action in ("connection_attempted", "connection_accepted") - and destination.port != 22 - and destination.ip != "127.0.0.1" - and network.transport: "tcp" -] + [process where event.action == "exec" and process.name:"ssh" and not process.parent.name in ( + "rsync", "pyznap", "git", "ansible-playbook", "scp", "pgbackrest", "git-lfs", "expect", "Sourcetree", "ssh-copy-id", + "run" + ) + ] + [network where process.name:"ssh" and event.action in ("connection_attempted", "connection_accepted") and + destination.port != 22 and destination.ip != "127.0.0.1" and network.transport: "tcp" + ] ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1571" name = "Non-Standard Port" reference = "https://attack.mitre.org/techniques/T1571/" - [rule.threat.tactic] id = "TA0011" name = "Command and Control" reference = "https://attack.mitre.org/tactics/TA0011/" - diff --git a/rules/cross-platform/discovery_security_software_grep.toml b/rules/cross-platform/discovery_security_software_grep.toml index 902e64eb4..f9d9756c7 100644 --- a/rules/cross-platform/discovery_security_software_grep.toml +++ b/rules/cross-platform/discovery_security_software_grep.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -55,7 +55,14 @@ If enabling an EQL rule on a non-elastic-agent index (such as beats) for version risk_score = 47 rule_id = "870aecc0-cea4-4110-af3f-e02e9b373655" severity = "medium" -tags = ["Domain: Endpoint", "OS: macOS", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -94,25 +101,32 @@ process.name : "grep" and user.id != "0" and "osquery*", "elastic-endpoint*" ) and - not (process.args : "Avast" and process.args : "Passwords") + not ( + (process.args : "Avast" and process.args : "Passwords") or + (process.parent.args : "/opt/McAfee/agent/scripts/ma" and process.parent.args : "checkhealth") or + (process.command_line : ( + "grep ESET Command-line scanner, version %s -A2", + "grep -i McAfee Web Gateway Core version:", + "grep --color=auto ESET Command-line scanner, version %s -A2" + ) + ) + ) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1518" name = "Software Discovery" reference = "https://attack.mitre.org/techniques/T1518/" + [[rule.threat.technique.subtechnique]] id = "T1518.001" name = "Security Software Discovery" reference = "https://attack.mitre.org/techniques/T1518/001/" - - [rule.threat.tactic] id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" - diff --git a/rules/cross-platform/execution_revershell_via_shell_cmd.toml b/rules/cross-platform/execution_revershell_via_shell_cmd.toml index 191145340..4e8ddc53c 100644 --- a/rules/cross-platform/execution_revershell_via_shell_cmd.toml +++ b/rules/cross-platform/execution_revershell_via_shell_cmd.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -58,7 +58,14 @@ references = [ risk_score = 73 rule_id = "a1a0375f-22c2-48c0-81a4-7c2d11cc6856" severity = "high" -tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -69,21 +76,21 @@ process where event.type in ("start", "process_started") and /* noisy FPs */ not (process.parent.name : "timeout" and process.executable : "/var/lib/docker/overlay*") and - not process.command_line : ("*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*") and + not process.command_line : ( + "*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*", + "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*", "*/dev/tcp/itom-vault/*") and not process.parent.command_line : "runc init" ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" - diff --git a/rules/cross-platform/execution_suspicious_jar_child_process.toml b/rules/cross-platform/execution_suspicious_jar_child_process.toml index e0cdafbb3..9cf5d2259 100644 --- a/rules/cross-platform/execution_suspicious_jar_child_process.toml +++ b/rules/cross-platform/execution_suspicious_jar_child_process.toml @@ -2,9 +2,9 @@ creation_date = "2021/01/19" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -14,7 +14,7 @@ malicious JAR file or an exploitation attempt via a JAVA specific vulnerability. """ from = "now-9m" index = ["auditbeat-*", "logs-endpoint.events.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Suspicious JAVA Child Process" note = """## Triage and analysis @@ -60,32 +60,46 @@ references = [ risk_score = 47 rule_id = "8acb7614-1d92-4359-bfcf-478b6d9de150" severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Use Case: Vulnerability", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -process where event.type in ("start", "process_started") and - process.parent.name : "java" and - process.name : ("sh", "bash", "dash", "ksh", "tcsh", "zsh", "curl", "wget") +event.category:process and event.type:("start" or "process_started") and process.parent.name:"java" and process.name:( + "sh" or "bash" or "dash" or "ksh" or "tcsh" or "zsh" or "curl" or "wget" +) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1059" name = "Command and Scripting Interpreter" reference = "https://attack.mitre.org/techniques/T1059/" + [[rule.threat.technique.subtechnique]] id = "T1059.007" name = "JavaScript" reference = "https://attack.mitre.org/techniques/T1059/007/" - - [rule.threat.tactic] id = "TA0002" name = "Execution" reference = "https://attack.mitre.org/tactics/TA0002/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.command_line"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules/cross-platform/impact_hosts_file_modified.toml b/rules/cross-platform/impact_hosts_file_modified.toml index 033920b2e..99fc5e61d 100644 --- a/rules/cross-platform/impact_hosts_file_modified.toml +++ b/rules/cross-platform/impact_hosts_file_modified.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -73,7 +73,8 @@ any where miss this, which is the purpose of the process + command line args logic below */ ( event.category == "file" and event.type in ("change", "creation") and - file.path : ("/private/etc/hosts", "/etc/hosts", "?:\\Windows\\System32\\drivers\\etc\\hosts") + file.path : ("/private/etc/hosts", "/etc/hosts", "?:\\Windows\\System32\\drivers\\etc\\hosts") and + not process.name in ("dockerd", "rootlesskit", "podman", "crio") ) or @@ -81,26 +82,25 @@ any where ( event.category == "process" and event.type in ("start") and process.name in ("nano", "vim", "vi", "emacs", "echo", "sed") and - process.args : ("/etc/hosts") + process.args : ("/etc/hosts") and + not process.parent.name in ("dhclient-script", "google_set_hostname") ) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1565" name = "Data Manipulation" reference = "https://attack.mitre.org/techniques/T1565/" + [[rule.threat.technique.subtechnique]] id = "T1565.001" name = "Stored Data Manipulation" reference = "https://attack.mitre.org/techniques/T1565/001/" - - [rule.threat.tactic] id = "TA0040" name = "Impact" reference = "https://attack.mitre.org/tactics/TA0040/" - diff --git a/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml b/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml index 31f1f7479..b81101419 100644 --- a/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml +++ b/rules/cross-platform/persistence_credential_access_modify_auth_module_or_config.toml @@ -2,9 +2,9 @@ creation_date = "2020/12/21" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -29,9 +29,16 @@ references = [ risk_score = 47 rule_id = "93f47b6f-5728-4004-ba00-625083b3dcb0" severity = "medium" -tags = ["Domain: Endpoint", "OS: macOS", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Persistence", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "query" +type = "new_terms" query = ''' event.category:file and event.type:change and @@ -40,19 +47,11 @@ event.category:file and event.type:change and (* and not ( - /bin/yum or - "/usr/sbin/pam-auth-update" or /usr/libexec/packagekitd or - /usr/bin/dpkg or /usr/bin/vim or /usr/libexec/xpcproxy or /usr/bin/bsdtar or /usr/local/bin/brew or - /usr/bin/rsync or - /usr/bin/yum or - /var/lib/docker/*/bin/yum or - /var/lib/docker/*/bin/dpkg or - ./merged/var/lib/docker/*/bin/dpkg or "/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service" ) ) and @@ -62,32 +61,45 @@ event.category:file and event.type:change and /tmp/newroot/lib/*/pam_*.so or /private/var/folders/*/T/com.apple.fileprovider.ArchiveService/TemporaryItems/*/lib/security/pam_*.so or /tmp/newroot/usr/lib64/security/pam_*.so + ) and + not process.name: + ( + yum or dnf or rsync or platform-python or authconfig or rpm or pdkg or apk or dnf-automatic or btrfs or + dpkg or pam-auth-update or steam or platform-python3.6 or pam-config or microdnf or yum_install or yum-cron or + systemd or containerd or pacman ) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1543" name = "Create or Modify System Process" reference = "https://attack.mitre.org/techniques/T1543/" - [rule.threat.tactic] id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1556" name = "Modify Authentication Process" reference = "https://attack.mitre.org/techniques/T1556/" - [rule.threat.tactic] id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "file.path"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules/cross-platform/persistence_shell_profile_modification.toml b/rules/cross-platform/persistence_shell_profile_modification.toml index 0cb0b70d9..da32aff27 100644 --- a/rules/cross-platform/persistence_shell_profile_modification.toml +++ b/rules/cross-platform/persistence_shell_profile_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -24,26 +24,22 @@ references = ["https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware- risk_score = 47 rule_id = "e6c1a552-7776-44ad-ae0f-8746cc07773c" severity = "medium" -tags = ["Domain: Endpoint", "OS: macOS", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "query" query = ''' event.category:file and event.type:change and - process.name:(* and not (sudo or - vim or - zsh or - env or - nano or - bash or - Terminal or - xpcproxy or - login or - cat or - cp or - launchctl or - java)) and - not process.executable:(/Applications/* or /private/var/folders/* or /usr/local/*) and + process.name:(* and not (sudo or vim or zsh or env or nano or bash or Terminal or xpcproxy or login or cat or cp or + launchctl or java or dnf or tailwatchd or ldconfig or yum or semodule or cpanellogd or dockerd or authselect or chmod or + dnf-automatic or git or dpkg or platform-python)) and + not process.executable:(/Applications/* or /private/var/folders/* or /usr/local/* or /opt/saltstack/salt/bin/*) and file.path:(/private/etc/rc.local or /etc/rc.local or /home/*/.profile or @@ -55,22 +51,20 @@ event.category:file and event.type:change and /Users/*/.zshenv) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1546" name = "Event Triggered Execution" reference = "https://attack.mitre.org/techniques/T1546/" + [[rule.threat.technique.subtechnique]] id = "T1546.004" name = "Unix Shell Configuration Modification" reference = "https://attack.mitre.org/techniques/T1546/004/" - - [rule.threat.tactic] id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" - diff --git a/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml b/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml index b6e6fbf20..3ad311540 100644 --- a/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml +++ b/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml @@ -2,9 +2,9 @@ creation_date = "2020/12/22" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -20,9 +20,16 @@ name = "SSH Authorized Keys File Modification" risk_score = 47 rule_id = "2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f" severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Persistence", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "query" +type = "new_terms" query = ''' event.category:file and event.type:(change or creation) and @@ -42,13 +49,14 @@ event.category:file and event.type:(change or creation) and /opt/jc/bin/jumpcloud-agent) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1098" name = "Account Manipulation" reference = "https://attack.mitre.org/techniques/T1098/" + [[rule.threat.technique.subtechnique]] id = "T1098.004" name = "SSH Authorized Keys" @@ -59,14 +67,14 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" - - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1563" name = "Remote Service Session Hijacking" reference = "https://attack.mitre.org/techniques/T1563/" + [[rule.threat.technique.subtechnique]] id = "T1563.001" name = "SSH Hijacking" @@ -76,6 +84,7 @@ reference = "https://attack.mitre.org/techniques/T1563/001/" id = "T1021" name = "Remote Services" reference = "https://attack.mitre.org/techniques/T1021/" + [[rule.threat.technique.subtechnique]] id = "T1021.004" name = "SSH" @@ -85,3 +94,11 @@ reference = "https://attack.mitre.org/techniques/T1021/004/" id = "TA0008" name = "Lateral Movement" reference = "https://attack.mitre.org/tactics/TA0008/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "file.path"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml b/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml index 36967a399..7320c3562 100644 --- a/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml +++ b/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml @@ -2,9 +2,9 @@ creation_date = "2020/04/13" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -22,28 +22,34 @@ rule_id = "931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" -type = "query" +type = "new_terms" query = ''' event.category:file and event.type:change and file.path:(/etc/sudoers* or /private/etc/sudoers*) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1548" name = "Abuse Elevation Control Mechanism" reference = "https://attack.mitre.org/techniques/T1548/" + [[rule.threat.technique.subtechnique]] id = "T1548.003" name = "Sudo and Sudo Caching" reference = "https://attack.mitre.org/techniques/T1548/003/" - - [rule.threat.tactic] id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "file.path"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules/linux/command_and_control_cat_network_activity.toml b/rules/linux/command_and_control_cat_network_activity.toml index 7e05fe4d8..dae299664 100644 --- a/rules/linux/command_and_control_cat_network_activity.toml +++ b/rules/linux/command_and_control_cat_network_activity.toml @@ -53,10 +53,10 @@ tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: type = "eql" query = ''' sequence by host.id, process.entity_id with maxspan=1s - [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and - process.name == "cat"] - [network where host.os.type == "linux" and event.action in ("connection_attempted", "disconnect_received") and - process.name == "cat"] + [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and process.name == "cat" and + process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")] + [network where host.os.type == "linux" and event.action in ("connection_attempted", "disconnect_received") and process.name == "cat" and + destination.ip != null and not cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")] ''' [[rule.threat]] diff --git a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml index eedd58e85..b70caa291 100644 --- a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml +++ b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml @@ -57,19 +57,21 @@ timestamp_override = "event.ingested" type = "eql" query = ''' process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and (( -// gost & pivotnacci - spawned without process.parent.name -(process.name == "gost" and process.args : ("-L*", "-C*", "-R*")) or (process.name == "pivotnacci")) or ( -// ssh -(process.name in ("ssh", "sshd") and (process.args in ("-R", "-L", "D", "-w") and process.args_count >= 4)) or -// sshuttle -(process.name == "sshuttle" and process.args in ("-r", "--remote", "-l", "--listen") and process.args_count >= 4) or -// socat -(process.name == "socat" and process.args : ("TCP4-LISTEN:*", "SOCKS*") and process.args_count >= 3) or -// chisel -(process.name : "chisel*" and process.args in ("client", "server")) or -// iodine(d), dnscat, hans, ptunnel-ng, ssf, 3proxy & ngrok -(process.name in ("iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng", "ssf", "3proxy", "ngrok")) -) and process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) + // gost & pivotnacci - spawned without process.parent.name + (process.name == "gost" and process.args : ("-L*", "-C*", "-R*")) or (process.name == "pivotnacci")) or ( + // ssh + (process.name in ("ssh", "sshd") and (process.args in ("-R", "-L", "D", "-w") and process.args_count >= 4 and + not process.args : "chmod")) or + // sshuttle + (process.name == "sshuttle" and process.args in ("-r", "--remote", "-l", "--listen") and process.args_count >= 4) or + // socat + (process.name == "socat" and process.args : ("TCP4-LISTEN:*", "SOCKS*") and process.args_count >= 3) or + // chisel + (process.name : "chisel*" and process.args in ("client", "server")) or + // iodine(d), dnscat, hans, ptunnel-ng, ssf, 3proxy & ngrok + (process.name in ("iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng", "ssf", "3proxy", "ngrok")) + ) and process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") +) ''' [[rule.threat]] diff --git a/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml b/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml index 1cce40900..03d592c7c 100644 --- a/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml +++ b/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/07/31" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -23,69 +23,35 @@ name = "Suspicious Network Activity to the Internet by Previously Unknown Execut risk_score = 21 rule_id = "53617418-17b4-4e9c-8a2c-8deb8086ca4b" severity = "low" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "new_terms" query = ''' -host.os.type:linux and event.category:network and -event.action:(connection_attempted or ipv4_connection_attempt_event) and -process.executable : ( - (/etc/crontab or - /etc/rc.local or - /boot/* or - /dev/shm/* or - /etc/cron.*/* or - /etc/init.d/* or - /etc/rc*.d/* or - /etc/update-motd.d/* or - /home/*/.* or - /run/* or - /srv/* or - /tmp/* or - /usr/lib/update-notifier/* or - /var/tmp/*) and - not (/usr/bin/apt or - /usr/bin/curl or - /usr/bin/dnf or - /usr/bin/dockerd or - /usr/bin/dpkg or - /usr/bin/rpm or - /usr/bin/wget or - /usr/bin/yum) - ) -and source.ip : ( - 10.0.0.0/8 or - 127.0.0.0/8 or - 172.16.0.0/12 or - 192.168.0.0/16) and - not destination.ip : ( - 10.0.0.0/8 or - 100.64.0.0/10 or - 127.0.0.0/8 or - 169.254.0.0/16 or - 172.16.0.0/12 or - 192.0.0.0/24 or - 192.0.0.0/29 or - 192.0.0.10/32 or - 192.0.0.170/32 or - 192.0.0.171/32 or - 192.0.0.8/32 or - 192.0.0.9/32 or - 192.0.2.0/24 or - 192.168.0.0/16 or - 192.175.48.0/24 or - 192.31.196.0/24 or - 192.52.193.0/24 or - 192.88.99.0/24 or - 198.18.0.0/15 or - 198.51.100.0/24 or - 203.0.113.0/24 or - 224.0.0.0/4 or - 240.0.0.0/4 or - "::1" or - "FE80::/10" or - "FF00::/8") +host.os.type:linux and event.category:network and event.action:(connection_attempted or ipv4_connection_attempt_event) and +process.executable:( + (/etc/crontab or /etc/rc.local or ./* or /boot/* or /dev/shm/* or /etc/cron.*/* or /etc/init.d/* or /etc/rc*.d/* or + /etc/update-motd.d/* or /home/*/.* or /run/* or /srv/* or /tmp/* or /usr/lib/update-notifier/* or /var/tmp/* + ) and not (/tmp/newroot/* or /tmp/snap.rootfs*) + ) and +source.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and +not process.name:( + apt or chrome or curl or dnf or dockerd or dpkg or firefox-bin or java or kite-update or kited or node or rpm or + saml2aws or wget or yum or ansible* or aws* or php* or pip* or python* or steam* or terraform* +) and +not destination.ip:( + 10.0.0.0/8 or 100.64.0.0/10 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.0.0.0/24 or 192.0.0.0/29 or + 192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or 192.0.0.8/32 or 192.0.0.9/32 or 192.0.2.0/24 or + 192.168.0.0/16 or 192.175.48.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or 192.88.99.0/24 or 198.18.0.0/15 or + 198.51.100.0/24 or 203.0.113.0/24 or 224.0.0.0/4 or 240.0.0.0/4 or "::1" or "FE80::/10" or "FF00::/8" +) ''' [[rule.threat]] @@ -103,8 +69,8 @@ reference = "https://attack.mitre.org/tactics/TA0011/" [rule.new_terms] field = "new_terms_fields" -value = ["destination.ip", "process.executable"] +value = ["host.id", "destination.ip", "process.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-7d" +value = "now-14d" diff --git a/rules/linux/credential_access_collection_sensitive_files.toml b/rules/linux/credential_access_collection_sensitive_files.toml index 1f242cfb8..9a30bc6cd 100644 --- a/rules/linux/credential_access_collection_sensitive_files.toml +++ b/rules/linux/credential_access_collection_sensitive_files.toml @@ -2,9 +2,9 @@ creation_date = "2020/12/22" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/10/19" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -60,9 +60,17 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Collection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "query" +type = "new_terms" query = ''' event.category:process and host.os.type:linux and event.type:start and @@ -99,39 +107,46 @@ event.category:process and host.os.type:linux and event.type:start and ) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1552" name = "Unsecured Credentials" reference = "https://attack.mitre.org/techniques/T1552/" + [[rule.threat.technique.subtechnique]] id = "T1552.001" name = "Credentials In Files" reference = "https://attack.mitre.org/techniques/T1552/001/" - - [rule.threat.tactic] id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" + [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1560" name = "Archive Collected Data" reference = "https://attack.mitre.org/techniques/T1560/" + [[rule.threat.technique.subtechnique]] id = "T1560.001" name = "Archive via Utility" reference = "https://attack.mitre.org/techniques/T1560/001/" - - [rule.threat.tactic] id = "TA0009" name = "Collection" reference = "https://attack.mitre.org/tactics/TA0009/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.command_line", "process.parent.executable"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-10d" diff --git a/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml b/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml index a5c038256..5dda1e40a 100644 --- a/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml +++ b/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/28" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -17,6 +17,7 @@ from = "now-9m" index = ["logs-system.auth-*"] language = "eql" license = "Elastic License v2" +max_signals = 5 name = "Potential External Linux SSH Brute Force Detected" note = """## Triage and analysis @@ -59,10 +60,14 @@ In case this rule generates too much noise and external brute forcing is of not risk_score = 21 rule_id = "fa210b61-b627-4e5e-86f4-17e8270656ab" severity = "low" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access"] +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ] type = "eql" query = ''' -sequence by host.id, source.ip, user.name with maxspan=5s +sequence by host.id, source.ip, user.name with maxspan=15s [ authentication where host.os.type == "linux" and event.action in ("ssh_login", "user_login") and event.outcome == "failure" and not cidrmatch(source.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", diff --git a/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml b/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml index fae0e736c..22d42490d 100644 --- a/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml +++ b/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/28" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -17,6 +17,7 @@ from = "now-9m" index = ["logs-system.auth-*"] language = "eql" license = "Elastic License v2" +max_signals = 5 name = "Potential Internal Linux SSH Brute Force Detected" note = """## Triage and analysis @@ -55,10 +56,14 @@ The rule identifies consecutive internal SSH login failures targeting a user acc risk_score = 47 rule_id = "1c27fa22-7727-4dd3-81c0-de6da5555feb" severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access"] +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ] type = "eql" query = ''' -sequence by host.id, source.ip, user.name with maxspan=5s +sequence by host.id, source.ip, user.name with maxspan=15s [ authentication where host.os.type == "linux" and event.action in ("ssh_login", "user_login") and event.outcome == "failure" and cidrmatch(source.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", diff --git a/rules/linux/credential_access_bruteforce_password_guessing.toml b/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml similarity index 93% rename from rules/linux/credential_access_bruteforce_password_guessing.toml rename to rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml index 691f6575b..aba73a13e 100644 --- a/rules/linux/credential_access_bruteforce_password_guessing.toml +++ b/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/05" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -50,10 +50,15 @@ The rule identifies consecutive SSH login failures followed by a successful logi risk_score = 73 rule_id = "8cb84371-d053-4f4f-bce0-c74990e28f28" severity = "high" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Credential Access"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ] type = "eql" query = ''' -sequence by host.id, source.ip, user.name with maxspan=3s +sequence by host.id, source.ip, user.name with maxspan=15s [authentication where host.os.type == "linux" and event.action in ("ssh_login", "user_login") and event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ] with runs=10 diff --git a/rules/linux/credential_access_ssh_backdoor_log.toml b/rules/linux/credential_access_ssh_backdoor_log.toml index c54c4dadc..a853ae8fc 100644 --- a/rules/linux/credential_access_ssh_backdoor_log.toml +++ b/rules/linux/credential_access_ssh_backdoor_log.toml @@ -73,7 +73,8 @@ type = "eql" query = ''' file where host.os.type == "linux" and event.type == "change" and process.executable : ("/usr/sbin/sshd", "/usr/bin/ssh") and ( - (file.name : (".*", "~*", "*~") and not file.name : (".cache", ".viminfo", ".bash_history")) or + (file.name : (".*", "~*", "*~") and not file.name : (".cache", ".viminfo", ".bash_history", ".google_authenticator", + ".jelenv", ".csvignore", ".rtreport")) or file.extension : ("in", "out", "ini", "h", "gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or file.path : ( diff --git a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml index 3d6d9fa3a..a092ad3ad 100644 --- a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml +++ b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml @@ -53,7 +53,7 @@ type = "eql" query = ''' sequence by host.id, process.entity_id with maxspan=1s [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and - process.name in ("cp", "mv", "cat") and process.args : ( + process.name in ("cp", "mv") and process.args : ( // Shells "/bin/*sh", "/usr/bin/*sh", @@ -71,10 +71,10 @@ sequence by host.id, process.entity_id with maxspan=1s "/usr/bin/mknod", "/bin/ping*", "/usr/bin/ping*", "/bin/nmap", "/usr/bin/nmap", // System utilities - "/bin/ls", "/usr/bin/ls", "/bin/cat", "/usr/bin/cat", "/bin/mv", "/usr/bin/mv", "/bin/cp", "/usr/bin/cp", - "/bin/sudo", "/usr/bin/sudo", "/bin/curl", "/usr/bin/curl", "/bin/wget", "/usr/bin/wget", "/bin/tmux", - "/usr/bin/tmux", "/bin/screen", "/usr/bin/screen", "/bin/ssh", "/usr/bin/ssh", "/bin/ftp", "/usr/bin/ftp" - )] + "/bin/ls", "/usr/bin/ls", "/bin/cat", "/usr/bin/cat", "/bin/sudo", "/usr/bin/sudo", "/bin/curl", "/usr/bin/curl", + "/bin/wget", "/usr/bin/wget", "/bin/tmux", "/usr/bin/tmux", "/bin/screen", "/usr/bin/screen", "/bin/ssh", + "/usr/bin/ssh", "/bin/ftp", "/usr/bin/ftp" + ) and not process.parent.name in ("dracut-install", "apticron", "generate-from-dir", "platform-python")] [file where host.os.type == "linux" and event.action == "creation" and file.path : ( "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*" )] @@ -88,6 +88,15 @@ id = "T1564" name = "Hide Artifacts" reference = "https://attack.mitre.org/techniques/T1564/" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.003" +name = "Rename System Utilities" +reference = "https://attack.mitre.org/techniques/T1036/003/" [rule.threat.tactic] id = "TA0005" diff --git a/rules/linux/defense_evasion_file_mod_writable_dir.toml b/rules/linux/defense_evasion_file_mod_writable_dir.toml index db94ce007..1f7d0900f 100644 --- a/rules/linux/defense_evasion_file_mod_writable_dir.toml +++ b/rules/linux/defense_evasion_file_mod_writable_dir.toml @@ -2,9 +2,9 @@ creation_date = "2020/04/21" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/10/13" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -20,7 +20,7 @@ false_positives = [ ] from = "now-9m" index = ["auditbeat-*", "logs-endpoint.events.*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "File Permission Modification in Writable Directory" risk_score = 21 @@ -65,27 +65,31 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -process where host.os.type == "linux" and event.type == "start"and - process.name in ("chmod", "chown", "chattr", "chgrp") and - process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and - not process.parent.name in ("update-motd-updates-available") and - not user.name == "root" +host.os.type:linux and event.category:process and event.type:start and +process.name:(chmod or chown or chattr or chgrp) and +process.working_directory:("/tmp" or "/var/tmp" or "/dev/shm") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1222" name = "File and Directory Permissions Modification" reference = "https://attack.mitre.org/techniques/T1222/" - [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.parent.executable", "process.command_line"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" diff --git a/rules/linux/defense_evasion_log_files_deleted.toml b/rules/linux/defense_evasion_log_files_deleted.toml index f4a3a4375..e8bd27f95 100644 --- a/rules/linux/defense_evasion_log_files_deleted.toml +++ b/rules/linux/defense_evasion_log_files_deleted.toml @@ -63,7 +63,14 @@ For versions <8.2, you need to add a custom ingest pipeline to populate `event.i """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" @@ -83,25 +90,23 @@ file where host.os.type == "linux" and event.type == "deletion" and "/var/log/boot.log", "/var/log/kern.log" ) and - not process.name : ("gzip") + not process.name in ("gzip", "executor", "dockerd") ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1070" name = "Indicator Removal" reference = "https://attack.mitre.org/techniques/T1070/" + [[rule.threat.technique.subtechnique]] id = "T1070.002" name = "Clear Linux or Mac System Logs" reference = "https://attack.mitre.org/techniques/T1070/002/" - - [rule.threat.tactic] id = "TA0005" name = "Defense Evasion" reference = "https://attack.mitre.org/tactics/TA0005/" - diff --git a/rules/linux/discovery_kernel_module_enumeration.toml b/rules/linux/discovery_kernel_module_enumeration.toml index 8788f5d17..0dbf80516 100644 --- a/rules/linux/discovery_kernel_module_enumeration.toml +++ b/rules/linux/discovery_kernel_module_enumeration.toml @@ -62,8 +62,7 @@ event.category:process and host.os.type:linux and event.type:start and ( (process.name:(lsmod or modinfo)) or (process.name:kmod and process.args:list) or (process.name:depmod and process.args:(--all or -a)) -) and process.parent.name:(sudo or bash or dash or ash or sh or tcsh or csh or zsh or ksh or fish) and -not process.parent.user.id:0 +) ''' [[rule.threat]] @@ -81,7 +80,7 @@ reference = "https://attack.mitre.org/tactics/TA0007/" [rule.new_terms] field = "new_terms_fields" -value = ["process.parent.name", "host.id"] +value = ["host.id", "process.command_line", "process.parent.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" diff --git a/rules/linux/discovery_suid_sguid_enumeration.toml b/rules/linux/discovery_suid_sguid_enumeration.toml index 17df0d288..aa1a36374 100644 --- a/rules/linux/discovery_suid_sguid_enumeration.toml +++ b/rules/linux/discovery_suid_sguid_enumeration.toml @@ -57,8 +57,10 @@ query = ''' process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "find" and process.args : "-perm" and process.args : ( "/6000", "-6000", "/4000", "-4000", "/2000", "-2000", "/u=s", "-u=s", "/g=s", "-g=s", "/u=s,g=s", "/g=s,u=s" -) and -not user.Ext.real.id == "0" and not group.Ext.real.id == "0" +) and not ( + user.Ext.real.id == "0" or group.Ext.real.id == "0" or process.args_count >= 12 or + (process.args : "/usr/bin/pkexec" and process.args : "-xdev" and process.args_count == 7) +) ''' [[rule.threat]] diff --git a/rules/linux/discovery_unusual_user_enumeration_via_id.toml b/rules/linux/discovery_unusual_user_enumeration_via_id.toml index 2b41f1238..3137222fe 100644 --- a/rules/linux/discovery_unusual_user_enumeration_via_id.toml +++ b/rules/linux/discovery_unusual_user_enumeration_via_id.toml @@ -53,7 +53,8 @@ type = "eql" query = ''' sequence by host.id, process.parent.entity_id with maxspan=1s [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and - process.name == "id" and process.args_count == 2] with runs=20 + process.name == "id" and process.args_count == 2 and + not (process.parent.name == "rpm" or process.parent.args : "/var/tmp/rpm-tmp*")] with runs=20 ''' [[rule.threat]] diff --git a/rules/linux/execution_abnormal_process_id_file_created.toml b/rules/linux/execution_abnormal_process_id_file_created.toml index d8f7e5f4c..0a9a75116 100644 --- a/rules/linux/execution_abnormal_process_id_file_created.toml +++ b/rules/linux/execution_abnormal_process_id_file_created.toml @@ -102,7 +102,15 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Threat: BPFDoor", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: BPFDoor", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "new_terms" @@ -115,7 +123,7 @@ user.id:0 and file.extension:(pid or lock or reboot) and file.path:(/var/run/* o process.executable : ( ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /var/run/* or /boot/* or /srv/* or /run/* )) -) and not process.name : (go or git) +) and not process.name : (go or git or containerd* or snap-confine) ''' [[rule.threat]] @@ -133,7 +141,7 @@ reference = "https://attack.mitre.org/tactics/TA0002/" [rule.new_terms] field = "new_terms_fields" -value = ["process.executable", "file.path"] +value = ["host.id", "process.executable", "file.path"] [[rule.new_terms.history_window_start]] field = "history_window_start" diff --git a/rules/linux/execution_python_tty_shell.toml b/rules/linux/execution_python_tty_shell.toml index 97d813820..0f6f35c31 100644 --- a/rules/linux/execution_python_tty_shell.toml +++ b/rules/linux/execution_python_tty_shell.toml @@ -54,10 +54,10 @@ type = "eql" query = ''' process where host.os.type == "linux" and event.action in ("exec", "exec_event") and ( - (process.parent.name : "python*" and process.name : "*sh" and process.parent.args_count >= 3 and - process.parent.args : "*pty.spawn*" and process.parent.args : "-c") or - (process.parent.name : "python*" and process.name : "*sh" and process.args : "*sh" and process.args_count == 1 - and process.parent.args_count == 1) + (process.parent.name : "python*" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", + "fish") and process.parent.args_count >= 3 and process.parent.args : "*pty.spawn*" and process.parent.args : "-c") or + (process.parent.name : "python*" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", + "fish") and process.args : "*sh" and process.args_count == 1 and process.parent.args_count == 1) ) ''' diff --git a/rules/linux/execution_remote_code_execution_via_postgresql.toml b/rules/linux/execution_remote_code_execution_via_postgresql.toml index 6f6c86241..44daa3eed 100644 --- a/rules/linux/execution_remote_code_execution_via_postgresql.toml +++ b/rules/linux/execution_remote_code_execution_via_postgresql.toml @@ -50,7 +50,14 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] +timestamp_override = "event.ingested" type = "eql" query = ''' diff --git a/rules/linux/execution_shell_evasion_linux_binary.toml b/rules/linux/execution_shell_evasion_linux_binary.toml index 451fd92b1..65cae9af9 100644 --- a/rules/linux/execution_shell_evasion_linux_binary.toml +++ b/rules/linux/execution_shell_evasion_linux_binary.toml @@ -141,7 +141,7 @@ process where host.os.type == "linux" and event.type == "start" and (process.name == "capsh" and process.args == "--") or /* launching shells from unusual parents or parent+arg combos */ - (process.name : "*sh" and ( + (process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and ( (process.parent.name : "*awk" and process.parent.args : "BEGIN {system(*)}") or (process.parent.name == "git" and process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or process.args : ("*PAGER*", "!*sh", "exec *sh") and not process.name == "ssh" ) or diff --git a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml index 44cc4040c..edaab1cf7 100644 --- a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml +++ b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml @@ -17,7 +17,8 @@ from = "now-9m" index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" -name = "Potential Reverse Shell via Suspicious Parent Process" +name = "Deprecated - Potential Reverse Shell via Suspicious Parent Process" +note = "This rule was deprecated due to its addition to the umbrella `Potential Reverse Shell via Suspicious Child Process` (76e4d92b-61c1-4a95-ab61-5fd94179a1ee) rule." references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" ] @@ -48,7 +49,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g - Click Save and Continue. - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). - """ severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] @@ -56,13 +56,13 @@ type = "eql" query = ''' sequence by host.id, process.parent.entity_id with maxspan=1s [ process where host.os.type == "linux" and event.type == "start" and event.action == "fork" and ( - (process.name : "python*" and process.args : "-c") or - (process.name : "php*" and process.args : "-r") or - (process.name : "perl" and process.args : "-e") or - (process.name : "ruby" and process.args : ("-e", "-rsocket")) or - (process.name : "lua*" and process.args : "-e") or + (process.name : "python*" and process.args == "-c" and not process.args == "/usr/bin/supervisord") or + (process.name : "php*" and process.args == "-r") or + (process.name : "perl" and process.args == "-e") or + (process.name : "ruby" and process.args in ("-e", "-rsocket")) or + (process.name : "lua*" and process.args == "-e") or (process.name : "openssl" and process.args : "-connect") or - (process.name : ("nc", "ncat", "netcat") and process.args_count >= 3) or + (process.name : ("nc", "ncat", "netcat") and process.args_count >= 3 and not process.args == "-z") or (process.name : "telnet" and process.args_count >= 3) or (process.name : "awk")) and process.parent.name : ("python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk") ] diff --git a/rules/linux/execution_shell_via_java_revshell_linux.toml b/rules/linux/execution_shell_via_java_revshell_linux.toml index 36a76f1f2..d06677ec9 100644 --- a/rules/linux/execution_shell_via_java_revshell_linux.toml +++ b/rules/linux/execution_shell_via_java_revshell_linux.toml @@ -54,12 +54,14 @@ tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: type = "eql" query = ''' sequence by host.id with maxspan=5s -[ network where host.os.type == "linux" and event.action in ("connection_accepted", "connection_attempted") and - process.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and - destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ] by process.entity_id -[ process where host.os.type == "linux" and event.action == "exec" and - process.parent.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and - process.parent.args : "-jar" and process.executable : "*sh" ] by process.parent.entity_id + [network where host.os.type == "linux" and event.action in ("connection_accepted", "connection_attempted") and + process.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and + destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" + ] by process.entity_id + [process where host.os.type == "linux" and event.action == "exec" and + process.parent.executable : ("/usr/bin/java", "/bin/java", "/usr/lib/jvm/*", "/usr/java/*") and + process.parent.args : "-jar" and process.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") + ] by process.parent.entity_id ''' [[rule.threat]] diff --git a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml index 443509f2f..2f3f8d0a6 100644 --- a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml +++ b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml @@ -51,24 +51,40 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] type = "eql" query = ''' sequence by host.id, process.entity_id with maxspan=1s -[ process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and ( - (process.name : "python*" and process.args : "-c") or - (process.name : "php*" and process.args : "-r") or - (process.name : "perl" and process.args : "-e") or - (process.name : "ruby" and process.args : ("-e", "-rsocket")) or - (process.name : "lua*" and process.args : "-e") or - (process.name : "openssl" and process.args : "-connect") or - (process.name : ("nc", "ncat", "netcat") and process.args_count >= 3) or - (process.name : "telnet" and process.args_count >= 3) or - (process.name : "awk")) and - process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") ] -[ network where host.os.type == "linux" and event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and - process.name : ("python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk") and - destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ] + [process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "fork") and ( + (process.name : "python*" and process.args : "-c" and process.args : ( + "*import*pty*spawn*", "*import*subprocess*call*" + )) or + (process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : ( + "*exec*", "*system*" + )) or + (process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : ( + "*TCPSocket.new*", "*TCPSocket.open*" + )) or + (process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : ( + "*io.popen*", "*os.execute*" + )) or + (process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or + (process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or + (process.name : "openssl" and process.args : "-connect") or + (process.name : ("nc", "ncat", "netcat") and process.args_count >= 3 and not process.args == "-z") or + (process.name : "telnet" and process.args_count >= 3) + ) and process.parent.name : ( + "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "php*", "perl", "ruby", "lua*", + "openssl", "nc", "netcat", "ncat", "telnet", "awk")] + [network where host.os.type == "linux" and event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and + process.name : ("python*", "php*", "perl", "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk") and + destination.ip != null and not cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")] ''' [[rule.threat]] diff --git a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml index a743d7bfe..5f5dba990 100644 --- a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml @@ -55,12 +55,13 @@ tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: type = "eql" query = ''' sequence by host.id with maxspan=1s -[ network where host.os.type == "linux" and event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and - process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and - destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1" ] by process.entity_id -[ process where host.os.type == "linux" and event.type == "start" and event.action : ("exec", "fork") and - process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and - process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") ] by process.parent.entity_id + [network where host.os.type == "linux" and event.type == "start" and event.action in ("connection_attempted", "connection_accepted") and + process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and + destination.ip != null and destination.ip != "127.0.0.1" and destination.ip != "::1"] by process.entity_id + [process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "fork") and + process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and + process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat") and not + process.args : "*imunify360-agent*"] by process.parent.entity_id ''' [[rule.threat]] diff --git a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml index 49c9fbd28..79d260c9a 100644 --- a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml @@ -59,7 +59,12 @@ However, if more advanced configuration is required to detect specific behavior, """ severity = "medium" -tags = ["OS: Linux", "Use Case: Threat Detection", "Tactic: Execution"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ] timestamp_override = "event.ingested" type = "eql" query = ''' diff --git a/rules/linux/execution_suspicious_executable_running_system_commands.toml b/rules/linux/execution_suspicious_executable_running_system_commands.toml index 0b079f747..1e92d95cc 100644 --- a/rules/linux/execution_suspicious_executable_running_system_commands.toml +++ b/rules/linux/execution_suspicious_executable_running_system_commands.toml @@ -2,9 +2,9 @@ creation_date = "2023/06/14" integration = ["endpoint"] maturity = "production" -min_stack_comments = "The single field New Term rule type used in this rule was added in Elastic 8.4" -min_stack_version = "8.4.0" -updated_date = "2023/10/16" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -47,7 +47,6 @@ For more details on Elastic Agent configuration settings, refer to the [helper g - Click Save and Continue. - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). - """ severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] @@ -86,7 +85,7 @@ reference = "https://attack.mitre.org/techniques/T1059/004/" [rule.new_terms] field = "new_terms_fields" -value = ["process.executable"] +value = ["host.id", "user.id", "process.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" diff --git a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml index 65b44554c..1fb436411 100644 --- a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml +++ b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml @@ -49,21 +49,20 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Elastic Defend" + ] type = "eql" query = ''' -sequence by host.id, process.entity_id with maxspan=1s +sequence by process.entity_id, host.id with maxspan=1s [file where host.os.type == "linux" and event.type == "change" and event.action == "rename" and file.extension : "?*" - and ((process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "ash", "openssl")) or - (process.executable : ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/run/*", "/boot/*", "/srv/*", "/run/*"))) and + and process.executable : ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/run/*", "/boot/*", "/srv/*", "/run/*") and file.path : ( "/home/*/Downloads/*", "/home/*/Documents/*", "/root/*", "/bin/*", "/usr/bin/*", - "/opt/*", "/etc/*", "/var/log/*", "/var/lib/log/*", "/var/backup/*", "/var/www/*") and not (( - process.name : ( - "dpkg", "yum", "dnf", "rpm", "dockerd", "go", "java", "pip*", "python*", "node", "containerd", "php", "p4d", - "conda", "chrome", "imap", "cmake", "firefox", "semanage", "semodule", "ansible-galaxy", "fc-cache", "jammy", "git", - "systemsettings", "vmis-launcher")) or file.path : "/etc/selinux/*" or (file.extension in ("qmlc", "txt") - ))] with runs=25 + "/opt/*", "/etc/*", "/var/log/*", "/var/lib/log/*", "/var/backup/*", "/var/www/*")] with runs=25 ''' [[rule.threat]] diff --git a/rules/linux/impact_potential_linux_ransomware_note_detected.toml b/rules/linux/impact_potential_linux_ransomware_note_detected.toml index 97e871911..cdcdefb45 100644 --- a/rules/linux/impact_potential_linux_ransomware_note_detected.toml +++ b/rules/linux/impact_potential_linux_ransomware_note_detected.toml @@ -50,21 +50,20 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Elastic Defend" + ] type = "eql" query = ''' -sequence by host.id, process.entity_id with maxspan=1s +sequence by process.entity_id, host.id with maxspan=1s [file where host.os.type == "linux" and event.type == "change" and event.action == "rename" and file.extension : "?*" - and ((process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "ash", "openssl")) or - (process.executable : ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/run/*", "/boot/*", "/srv/*", "/run/*"))) and + and process.executable : ("./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/var/run/*", "/boot/*", "/srv/*", "/run/*") and file.path : ( "/home/*/Downloads/*", "/home/*/Documents/*", "/root/*", "/bin/*", "/usr/bin/*", - "/opt/*", "/etc/*", "/var/log/*", "/var/lib/log/*", "/var/backup/*", "/var/www/*") and not (( - process.name : ( - "dpkg", "yum", "dnf", "rpm", "dockerd", "go", "java", "pip*", "python*", "node", "containerd", "php", "p4d", - "conda", "chrome", "imap", "cmake", "firefox", "semanage", "semodule", "ansible-galaxy", "fc-cache", "jammy", "git", - "systemsettings", "vmis-launcher")) or (file.path : "/etc/selinux/*") or (file.extension in ("qmlc", "txt") - ))] with runs=25 + "/opt/*", "/etc/*", "/var/log/*", "/var/lib/log/*", "/var/backup/*", "/var/www/*")] with runs=25 [file where host.os.type == "linux" and event.action == "creation" and file.name : ( "*crypt*", "*restore*", "*lock*", "*recovery*", "*data*", "*read*", "*instruction*", "*how_to*", "*ransom*" )] diff --git a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml index 81f127c75..415811d27 100644 --- a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml +++ b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml @@ -72,7 +72,8 @@ event.category:file and host.os.type:linux and event.type:change and /usr/bin/sftp or /usr/bin/ssh or /usr/sbin/sshd) or - file.name:libkeyutils.so) + file.name:libkeyutils.so) and + not process.executable:/usr/share/elasticsearch/* ''' diff --git a/rules/linux/persistence_cron_job_creation.toml b/rules/linux/persistence_cron_job_creation.toml index 2d87b99bf..602b15e17 100644 --- a/rules/linux/persistence_cron_job_creation.toml +++ b/rules/linux/persistence_cron_job_creation.toml @@ -51,7 +51,16 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "new_terms" @@ -60,7 +69,7 @@ host.os.type : "linux" and event.action : ("change" or "file_modify_event" or "c file.path : (/etc/cron.allow or /etc/cron.deny or /etc/cron.d/* or /etc/cron.hourly/* or /etc/cron.daily/* or /etc/cron.weekly/* or /etc/cron.monthly/* or /etc/crontab or /usr/sbin/cron or /usr/sbin/anacron) and not (process.name : ("dpkg" or "dockerd" or "rpm" or "snapd" or "yum" or "exe" or "dnf" or "5") or -file.extension : ("swp" or "swx")) +file.extension : ("swp" or "swpx")) ''' [[rule.threat]] @@ -119,8 +128,8 @@ reference = "https://attack.mitre.org/tactics/TA0002/" [rule.new_terms] field = "new_terms_fields" -value = ["file.path", "process.name"] +value = ["host.id", "file.path", "process.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-7d" +value = "now-10d" diff --git a/rules/linux/persistence_insmod_kernel_module_load.toml b/rules/linux/persistence_insmod_kernel_module_load.toml index a69b50ca5..fe1533de0 100644 --- a/rules/linux/persistence_insmod_kernel_module_load.toml +++ b/rules/linux/persistence_insmod_kernel_module_load.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/11" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/10/23" integration = ["endpoint"] [rule] @@ -15,7 +15,7 @@ from = "now-9m" index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" -name = "Kernel module load via insmod" +name = "Kernel Module Load via insmod" references = [ "https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/" ] @@ -49,12 +49,21 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Threat: Rootkit", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Rootkit", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" query = ''' process where host.os.type == "linux" and event.type == "start" and process.name == "insmod" and process.args : "*.ko" +and not process.parent.name in ("cisco-amp-helper", "ksplice-apply") ''' [[rule.threat]] diff --git a/rules/linux/persistence_linux_shell_activity_via_web_server.toml b/rules/linux/persistence_linux_shell_activity_via_web_server.toml index 043072fe1..6ef216a42 100644 --- a/rules/linux/persistence_linux_shell_activity_via_web_server.toml +++ b/rules/linux/persistence_linux_shell_activity_via_web_server.toml @@ -149,7 +149,7 @@ event.action in ("exec", "exec_event") and process.parent.executable : ( "/usr/local/lsws/bin/lswsctrl", "*/bin/catalina.sh" ) and -process.name : ("*sh", "python*", "perl", "php*", "tmux") and +process.name : ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "perl", "php*", "tmux") and process.args : ("whoami", "id", "uname", "cat", "hostname", "ip", "curl", "wget", "pwd") and not process.name == "phpquery" ''' diff --git a/rules/linux/persistence_message_of_the_day_creation.toml b/rules/linux/persistence_message_of_the_day_creation.toml index 170d7f94e..c55357c72 100644 --- a/rules/linux/persistence_message_of_the_day_creation.toml +++ b/rules/linux/persistence_message_of_the_day_creation.toml @@ -149,13 +149,21 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] type = "new_terms" query = ''' host.os.type :"linux" and event.action:("creation" or "file_create_event" or "rename" or "file_rename_event") and -file.path : (/etc/update-motd.d/* or /usr/lib/update-notifier/*) and not -process.executable : ("/usr/bin/dpkg" or "/usr/bin/dockerd" or "/bin/rpm" or "/kaniko/executor") and not -file.extension : ("swp" or "swx") +file.path : (/etc/update-motd.d/* or /usr/lib/update-notifier/*) and not process.name : ( + dpkg or dockerd or rpm or executor or dnf +) and not file.extension : ("swp" or "swpx") ''' [[rule.threat]] @@ -173,8 +181,8 @@ reference = "https://attack.mitre.org/tactics/TA0003/" [rule.new_terms] field = "new_terms_fields" -value = ["file.path", "process.name"] +value = ["host.id", "file.path", "process.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-7d" +value = "now-10d" diff --git a/rules/linux/persistence_message_of_the_day_execution.toml b/rules/linux/persistence_message_of_the_day_execution.toml index 7f2672014..2ef391fcd 100644 --- a/rules/linux/persistence_message_of_the_day_execution.toml +++ b/rules/linux/persistence_message_of_the_day_execution.toml @@ -148,15 +148,41 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "high" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "eql" query = ''' -process where host.os.type == "linux" and -event.type == "start" and event.action : ("exec", "exec_event") and -process.parent.executable : ("/etc/update-motd.d/*", "/usr/lib/update-notifier/*") and -process.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "perl", "php*", "nc", "ncat", -"netcat", "socat", "lua", "java", "openssl", "ruby", "telnet") +process where event.type == "start" and event.action : ("exec", "exec_event") and +process.parent.executable : ("/etc/update-motd.d/*", "/usr/lib/update-notifier/*") and ( + (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and ( + (process.args : ("-i", "-l")) or (process.parent.name == "socat" and process.parent.args : "*exec*"))) or + (process.name : ("nc", "ncat", "netcat", "nc.openbsd") and process.args_count >= 3 and + not process.args : ("-*z*", "-*l*")) or + (process.name : "python*" and process.args : "-c" and process.args : ( + "*import*pty*spawn*", "*import*subprocess*call*" + )) or + (process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : ( + "*exec*", "*system*" + )) or + (process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : ( + "*TCPSocket.new*", "*TCPSocket.open*" + )) or + (process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : ( + "*io.popen*", "*os.execute*" + )) or + (process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or + (process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or + (process.name in ("openssl", "telnet")) +) and +not (process.parent.args : "--force" or process.args : ("/usr/games/lolcat", "/usr/bin/screenfetch")) ''' [[rule.threat]] diff --git a/rules/linux/persistence_rc_script_creation.toml b/rules/linux/persistence_rc_script_creation.toml index 7ce4e1616..4f6508d26 100644 --- a/rules/linux/persistence_rc_script_creation.toml +++ b/rules/linux/persistence_rc_script_creation.toml @@ -134,12 +134,22 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] type = "new_terms" query = ''' host.os.type : "linux" and event.category : "file" and event.type : ("change" or "file_modify_event" or "creation" or "file_create_event") and -file.path : "/etc/rc.local" and not process.name : ("dockerd" or "docker" or "dnf" or "yum" or "rpm" or "dpkg") and not file.extension : ("swp" or "swx") +file.path : "/etc/rc.local" and not process.name : ( + "dockerd" or "docker" or "dnf" or "dnf-automatic" or "yum" or "rpm" or "dpkg" +) and not file.extension : ("swp" or "swpx") ''' [[rule.threat]] @@ -162,7 +172,7 @@ reference = "https://attack.mitre.org/tactics/TA0003/" [rule.new_terms] field = "new_terms_fields" -value = ["host.id", "process.executable"] +value = ["host.id", "process.executable", "user.id"] [[rule.new_terms.history_window_start]] field = "history_window_start" diff --git a/rules/linux/persistence_shared_object_creation.toml b/rules/linux/persistence_shared_object_creation.toml index 1f05b3741..02892b697 100644 --- a/rules/linux/persistence_shared_object_creation.toml +++ b/rules/linux/persistence_shared_object_creation.toml @@ -52,30 +52,37 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "new_terms" query = ''' host.os.type:linux and event.action:(creation or file_create_event or file_rename_event or rename) and file.path:(/dev/shm/* or /usr/lib/*) and file.extension:so and -process.name: ( * and not ("5" or "dockerd" or "dpkg" or "rpm" or "snapd" or "exe" or "yum" or "vmis-launcher")) +process.name: ( * and not ("5" or "dockerd" or "dpkg" or "rpm" or "snapd" or "exe" or "yum" or "vmis-launcher" + or "pacman" or "apt-get" or "dnf")) ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1574" name = "Hijack Execution Flow" reference = "https://attack.mitre.org/techniques/T1574/" + [[rule.threat.technique.subtechnique]] id = "T1574.006" name = "Dynamic Linker Hijacking" reference = "https://attack.mitre.org/techniques/T1574/006/" - - [rule.threat.tactic] id = "TA0003" name = "Persistence" @@ -83,9 +90,8 @@ reference = "https://attack.mitre.org/tactics/TA0003/" [rule.new_terms] field = "new_terms_fields" -value = ["file.path", "process.name"] +value = ["host.id", "file.path", "process.executable"] + [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-7d" - - +value = "now-10d" diff --git a/rules/linux/persistence_systemd_scheduled_timer_created.toml b/rules/linux/persistence_systemd_scheduled_timer_created.toml index 1c5be6028..3f36b04e2 100644 --- a/rules/linux/persistence_systemd_scheduled_timer_created.toml +++ b/rules/linux/persistence_systemd_scheduled_timer_created.toml @@ -163,13 +163,23 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "low" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "new_terms" query = ''' host.os.type : "linux" and event.action : ("creation" or "file_create_event") and file.extension : "timer" and file.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or -/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not process.name : ("docker" or "dockerd" or "dnf" or "yum" or "rpm" or "dpkg" or "executor") +/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not process.name : ( + "docker" or "dockerd" or "dnf" or "yum" or "rpm" or "dpkg" or "executor" or "cloudflared" +) ''' [[rule.threat]] @@ -192,8 +202,8 @@ reference = "https://attack.mitre.org/tactics/TA0003/" [rule.new_terms] field = "new_terms_fields" -value = ["file.path", "process.name"] +value = ["host.id", "file.path", "process.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-7d" +value = "now-10d" diff --git a/rules/linux/persistence_systemd_service_creation.toml b/rules/linux/persistence_systemd_service_creation.toml index 31f6d7d6a..e79968b90 100644 --- a/rules/linux/persistence_systemd_service_creation.toml +++ b/rules/linux/persistence_systemd_service_creation.toml @@ -53,20 +53,38 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" type = "new_terms" query = ''' -host.os.type : "linux" and event.action : ("creation" or "file_create_event") and -file.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or -/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not -(process.name : ("dpkg" or "dockerd" or "rpm" or "snapd" or "yum" or "exe" or "dnf" or "dnf-automatic" or python* or - "elastic-agent" or "cinc-client") or file.extension : ("swp" or "swx")) +host.os.type:linux and event.category:file and event.action:("creation" or "file_create_event") and file.path:( + /etc/systemd/system/* or + /usr/local/lib/systemd/system/* or + /lib/systemd/system/* or + /usr/lib/systemd/system/* or + /home/*/.config/systemd/user/* +) and +not ( + process.name:( + "dpkg" or "dockerd" or "rpm" or "snapd" or "yum" or "exe" or "dnf" or "dnf-automatic" or python* or "puppetd" or + "elastic-agent" or "cinc-client" or "chef-client" or "pacman" or "puppet" or "cloudflared" + ) or + file.extension:("swp" or "swpx") +) ''' [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1543" name = "Create or Modify System Process" @@ -102,8 +120,8 @@ reference = "https://attack.mitre.org/tactics/TA0004/" [rule.new_terms] field = "new_terms_fields" -value = ["file.path", "process.name"] +value = ["host.id", "file.path", "process.executable"] [[rule.new_terms.history_window_start]] field = "history_window_start" -value = "now-7d" +value = "now-10d" diff --git a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml index b25c6ff05..25cce2de2 100644 --- a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml +++ b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml @@ -2,9 +2,9 @@ creation_date = "2021/01/27" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/10/16" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -60,31 +60,44 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "query" +type = "new_terms" query = ''' -event.category:file and host.os.type:linux and not event.type:deletion and file.path:/etc/ld.so.preload and -event.action:(updated or renamed or rename) +host.os.type:linux and event.category:file and event.action:(updated or renamed or rename) and +not event.type:deletion and file.path:/etc/ld.so.preload ''' - [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1574" name = "Hijack Execution Flow" reference = "https://attack.mitre.org/techniques/T1574/" + [[rule.threat.technique.subtechnique]] id = "T1574.006" name = "Dynamic Linker Hijacking" reference = "https://attack.mitre.org/techniques/T1574/006/" - - [rule.threat.tactic] id = "TA0004" name = "Privilege Escalation" reference = "https://attack.mitre.org/tactics/TA0004/" +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id", "process.executable"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-10d" diff --git a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml index 6a0b2c81d..55ff7e0e1 100644 --- a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml +++ b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml @@ -54,8 +54,8 @@ tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: timestamp_override = "event.ingested" type = "eql" query = ''' -process where host.os.type == "linux" and event.action in ("exec", "exec_event") and -event.type == "start" and process.name == "ln" and +process where host.os.type == "linux" and event.action in ("exec", "exec_event") and +event.type == "start" and process.name == "ln" and process.args in ("-s", "-sf") and ( /* suspicious files */ (process.args in ("/etc/shadow", "/etc/shadow-", "/etc/shadow~", "/etc/gshadow", "/etc/gshadow-") or diff --git a/rules/linux/privilege_escalation_sudo_hijacking.toml b/rules/linux/privilege_escalation_sudo_hijacking.toml index 6926f3b31..a76882c66 100644 --- a/rules/linux/privilege_escalation_sudo_hijacking.toml +++ b/rules/linux/privilege_escalation_sudo_hijacking.toml @@ -2,9 +2,9 @@ creation_date = "2023/07/26" integration = ["endpoint"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/10/16" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -15,7 +15,7 @@ enable persistence onto the system every time the sudo binary is executed. """ from = "now-9m" index = ["logs-endpoint.events.*", "endgame-*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Potential Sudo Hijacking Detected" references = ["https://eapolsniper.github.io/2020/08/17/Sudo-Hijacking/"] @@ -49,11 +49,20 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast """ severity = "medium" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" query = ''' -file where event.type in ("creation", "file_create_event") and file.path == "/usr/bin/sudo" +host.os.type:linux and event.category:file and event.type:("creation" or "file_create_event") and +file.path:("/usr/bin/sudo" or "/bin/sudo") and not process.name:(docker or dockerd) ''' [[rule.threat]] @@ -86,3 +95,11 @@ reference = "https://attack.mitre.org/techniques/T1574/" id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "user.id", "process.executable"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules/network/discovery_potential_network_sweep_detected.toml b/rules/network/discovery_potential_network_sweep_detected.toml index 0c8bd9280..13acbd2c1 100644 --- a/rules/network/discovery_potential_network_sweep_detected.toml +++ b/rules/network/discovery_potential_network_sweep_detected.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -19,11 +19,16 @@ from = "now-9m" index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*", "logs-endpoint.events.network-*",] language = "kuery" license = "Elastic License v2" +max_signals = 5 name = "Potential Network Sweep Detected" risk_score = 21 rule_id = "781f8746-2180-4691-890c-4c96d11ca91d" severity = "low" -tags = ["Domain: Network", "Tactic: Discovery", "Tactic: Reconnaissance", "Use Case: Network Security Monitoring"] +tags = ["Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ] type = "threshold" query = ''' destination.port : (21 or 22 or 23 or 25 or 139 or 445 or 3389 or 5985 or 5986) and diff --git a/rules/network/discovery_potential_port_scan_detected.toml b/rules/network/discovery_potential_port_scan_detected.toml index 24c72c77c..9cea2f75d 100644 --- a/rules/network/discovery_potential_port_scan_detected.toml +++ b/rules/network/discovery_potential_port_scan_detected.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -20,11 +20,16 @@ from = "now-9m" index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*", "filebeat-*", "auditbeat-*"] language = "kuery" license = "Elastic License v2" +max_signals = 5 name = "Potential Network Scan Detected" risk_score = 21 rule_id = "0171f283-ade7-4f87-9521-ac346c68cc9b" severity = "low" -tags = ["Domain: Network", "Tactic: Discovery", "Tactic: Reconnaissance", "Use Case: Network Security Monitoring"] +tags = ["Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ] type = "threshold" query = ''' destination.port : * and event.action : "network_flow" and source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) diff --git a/rules/network/discovery_potential_syn_port_scan_detected.toml b/rules/network/discovery_potential_syn_port_scan_detected.toml index f294ca144..32c1b0ec8 100644 --- a/rules/network/discovery_potential_syn_port_scan_detected.toml +++ b/rules/network/discovery_potential_syn_port_scan_detected.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "network_traffic"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/09/22" [rule] author = ["Elastic"] @@ -20,11 +20,16 @@ from = "now-9m" index = ["logs-endpoint.events.network-*", "logs-network_traffic.*", "packetbeat-*", "auditbeat-*", "filebeat-*"] language = "kuery" license = "Elastic License v2" +max_signals = 5 name = "Potential SYN-Based Network Scan Detected" risk_score = 21 rule_id = "bbaa96b9-f36c-4898-ace2-581acb00a409" severity = "low" -tags = ["Domain: Network", "Tactic: Discovery", "Tactic: Reconnaissance", "Use Case: Network Security Monitoring"] +tags = ["Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ] type = "threshold" query = ''' destination.port : * and network.packets <= 2 and source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml old mode 100644 new mode 100755 diff --git a/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml b/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml index 22574493f..966145820 100644 --- a/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml +++ b/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml @@ -2,9 +2,9 @@ creation_date = "2020/04/12" integration = ["auditd_manager"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/24" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -23,7 +23,7 @@ false_positives = [ from = "now-119m" interval = "60m" index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Enumeration of Kernel Modules via Proc" note = """## Setup @@ -45,16 +45,17 @@ Add the newly installed `auditd manager` to an agent policy, and deploy the agen risk_score = 21 rule_id = "80084fa9-8677-4453-8680-b891d3c0c778" severity = "low" -tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR"] +tags = [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" building_block_type = "default" query = ''' -file where host.os.type == "linux" and event.action == "opened-file" and file.path == "/proc/modules" and not -( - process.name in ("auditbeat", "kmod", "modprobe", "lsmod", "insmod", "modinfo", "rmmod", "SchedulerRunner", "grep") or - process.parent.pid == 1 or process.title : "*grep*" -) +host.os.type:linux and event.category:file and event.action:"opened-file" and file.path:"/proc/modules" ''' [[rule.threat]] @@ -69,3 +70,12 @@ reference = "https://attack.mitre.org/techniques/T1082/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules_building_block/discovery_linux_modprobe_enumeration.toml b/rules_building_block/discovery_linux_modprobe_enumeration.toml index 5e2688a6b..6bd380bd5 100644 --- a/rules_building_block/discovery_linux_modprobe_enumeration.toml +++ b/rules_building_block/discovery_linux_modprobe_enumeration.toml @@ -2,9 +2,9 @@ creation_date = "2023/06/08" integration = ["auditd_manager"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/24" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -17,7 +17,7 @@ system. from = "now-119m" interval = "60m" index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Suspicious Modprobe File Event" note = """## Setup @@ -44,17 +44,18 @@ Add the newly installed `auditd manager` to an agent policy, and deploy the agen risk_score = 21 rule_id = "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd" severity = "low" -tags = ["OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR"] +tags = [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" building_block_type = "default" query = ''' -file where host.os.type == "linux" and event.action == "opened-file" and -file.path : ("/etc/modprobe.conf", "/etc/modprobe.d", "/etc/modprobe.d/*") and not -( - process.name in ("auditbeat", "kmod", "modprobe", "lsmod", "insmod", "modinfo", "rmmod", "dpkg", "cp", "mkinitramfs", - "readlink") or process.title : "*grep*" or process.parent.pid == 1 -) +host.os.type:linux and event.category:file and event.action:"opened-file" and +file.path : ("/etc/modprobe.conf" or "/etc/modprobe.d" or /etc/modprobe.d/*) ''' [[rule.threat]] @@ -69,3 +70,11 @@ reference = "https://attack.mitre.org/techniques/T1082/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "file.path"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules_building_block/discovery_linux_sysctl_enumeration.toml b/rules_building_block/discovery_linux_sysctl_enumeration.toml index 24fc90046..b929a3a02 100644 --- a/rules_building_block/discovery_linux_sysctl_enumeration.toml +++ b/rules_building_block/discovery_linux_sysctl_enumeration.toml @@ -2,9 +2,9 @@ creation_date = "2023/06/08" integration = ["auditd_manager"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/24" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -16,7 +16,7 @@ configuration files to modify kernel parameters, potentially compromising system from = "now-119m" interval = "60m" index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] -language = "eql" +language = "kuery" license = "Elastic License v2" name = "Suspicious Sysctl File Event" note = """## Setup @@ -44,14 +44,18 @@ Add the newly installed `auditd manager` to an agent policy, and deploy the agen risk_score = 21 rule_id = "7592c127-89fb-4209-a8f6-f9944dfd7e02" severity = "low" -tags = ["OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR"] +tags = [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" -type = "eql" +type = "new_terms" building_block_type = "default" query = ''' -file where host.os.type == "linux" and event.action in ("opened-file", "read-file", "wrote-to-file") and -file.path : ("/etc/sysctl.conf", "/etc/sysctl.d", "/etc/sysctl.d/*") and -not process.name in ("auditbeat", "systemd-sysctl", "dpkg", "dnf", "yum", "rpm", "apt") +host.os.type:linux and event.category:file and event.action:("opened-file" or "read-file" or "wrote-to-file") and +file.path : ("/etc/sysctl.conf" or "/etc/sysctl.d" or /etc/sysctl.d/*) ''' [[rule.threat]] @@ -66,3 +70,11 @@ reference = "https://attack.mitre.org/techniques/T1082/" id = "TA0007" name = "Discovery" reference = "https://attack.mitre.org/tactics/TA0007/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["host.id", "process.executable", "file.path"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-7d" diff --git a/rules_building_block/discovery_suspicious_proc_enumeration.toml b/rules_building_block/discovery_suspicious_proc_enumeration.toml index 9a8342266..61ccf6620 100644 --- a/rules_building_block/discovery_suspicious_proc_enumeration.toml +++ b/rules_building_block/discovery_suspicious_proc_enumeration.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/24" +updated_date = "2023/09/25" [rule] author = ["Elastic"] @@ -42,18 +42,25 @@ Add the newly installed `auditd manager` to an agent policy, and deploy the agen risk_score = 21 rule_id = "0787daa6-f8c5-453b-a4ec-048037f6c1cd" severity = "low" -tags = ["OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Rule Type: BBR"] +tags = [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ] timestamp_override = "event.ingested" type = "threshold" building_block_type = "default" query = ''' -host.os.type : "linux" and event.category : "file" and event.action : "opened-file" and -file.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.name : "pidof" and -not process.parent.pid : 1 +host.os.type:linux and event.category:file and event.action:"opened-file" and +file.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.name : ( + ps or netstat or landscape-sysin or w or pgrep or pidof or needrestart or apparmor_status +) and not process.parent.pid : 1 ''' [[rule.threat]] framework = "MITRE ATT&CK" + [[rule.threat.technique]] id = "T1057" name = "Process Discovery" @@ -72,6 +79,7 @@ reference = "https://attack.mitre.org/tactics/TA0007/" [rule.threshold] field = ["host.id", "process.pid", "process.name"] value = 1 + [[rule.threshold.cardinality]] field = "file.path" value = 100 diff --git a/rules_building_block/discovery_suspicious_which_command_execution.toml b/rules_building_block/discovery_suspicious_which_command_execution.toml index b6cdb9dc9..11a5daab6 100644 --- a/rules_building_block/discovery_suspicious_which_command_execution.toml +++ b/rules_building_block/discovery_suspicious_which_command_execution.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/30" +updated_date = "2023/09/13" [rule] author = ["Elastic"] @@ -22,7 +22,7 @@ name = "Suspicious which Enumeration" risk_score = 21 rule_id = "5b18eef4-842c-4b47-970f-f08d24004bde" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend", "Rule Type: BBR"] +tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend", "Rule Type: BBR"] timestamp_override = "event.ingested" type = "eql" building_block_type = "default" diff --git a/rules_building_block/persistence_suspicious_file_opened_through_editor.toml b/rules_building_block/persistence_suspicious_file_opened_through_editor.toml index c34019245..3ba36c01c 100644 --- a/rules_building_block/persistence_suspicious_file_opened_through_editor.toml +++ b/rules_building_block/persistence_suspicious_file_opened_through_editor.toml @@ -3,7 +3,7 @@ creation_date = "2023/07/25" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/25" +updated_date = "2023/09/26" integration = ["endpoint"] [rule] @@ -20,6 +20,7 @@ interval = "60m" index = ["logs-endpoint.events.*", "endgame-*"] language = "eql" license = "Elastic License v2" +max_signals = 1 name = "Potential Suspicious File Edit" risk_score = 21 rule_id = "3728c08d-9b70-456b-b6b8-007c7d246128" @@ -35,9 +36,9 @@ file.path : ( /* common interesting files and locations */ "/etc/.shadow.swp", "/etc/.shadow-.swp", "/etc/.shadow~.swp", "/etc/.gshadow.swp", "/etc/.gshadow-.swp", "/etc/.passwd.swp", "/etc/.pwd.db.swp", "/etc/.master.passwd.swp", "/etc/.spwd.db.swp", "/etc/security/.opasswd.swp", - "/etc/.hosts.swp", "/etc/.environment.swp", "/etc/.profile.swp", "/etc/sudoers.d/.*.swp", - "/etc/ld.so.conf.d/.*.swp", "/etc/init.d/.*.swp", "/etc/.rc.local.swp", "/etc/rc*.d/.*.swp", - "/dev/shm/.*.swp", "/etc/update-motd.d/.*.swp", "/usr/lib/update-notifier/.*.swp", + "/etc/.environment.swp", "/etc/.profile.swp", "/etc/sudoers.d/.*.swp", "/etc/ld.so.conf.d/.*.swp", + "/etc/init.d/.*.swp", "/etc/.rc.local.swp", "/etc/rc*.d/.*.swp", "/dev/shm/.*.swp", "/etc/update-motd.d/.*.swp", + "/usr/lib/update-notifier/.*.swp", /* service, timer, want, socket and lock files */ "/etc/systemd/system/.*.swp", "/usr/local/lib/systemd/system/.*.swp", "/lib/systemd/system/.*.swp", From 18ff85ce84a98a274bf15cbd984e4326be64a56d Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Mon, 23 Oct 2023 11:44:37 -0300 Subject: [PATCH 55/86] [Promote] Expired or Revoked Driver Loaded (#3185) * [Promote] Expired or Revoked Driver Loaded * Update privilege_escalation_expired_driver_loaded.toml --- .../privilege_escalation_expired_driver_loaded.toml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) rename {rules_building_block => rules/windows}/privilege_escalation_expired_driver_loaded.toml (93%) diff --git a/rules_building_block/privilege_escalation_expired_driver_loaded.toml b/rules/windows/privilege_escalation_expired_driver_loaded.toml similarity index 93% rename from rules_building_block/privilege_escalation_expired_driver_loaded.toml rename to rules/windows/privilege_escalation_expired_driver_loaded.toml index 1290427c7..72245f0e4 100644 --- a/rules_building_block/privilege_escalation_expired_driver_loaded.toml +++ b/rules/windows/privilege_escalation_expired_driver_loaded.toml @@ -4,8 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" -bypass_bbr_timing = true +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -24,10 +23,9 @@ references = [ risk_score = 21 rule_id = "d12bac54-ab2a-4159-933f-d7bcefa7b61d" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Rule Type: BBR", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" type = "eql" -building_block_type = "default" query = ''' driver where host.os.type == "windows" and process.pid == 4 and From 024d45bd56ca4957c3b54f37ea8e06d1aa79e082 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 23 Oct 2023 17:06:16 +0200 Subject: [PATCH 56/86] [New BBR] Tainted Kernel Module Load (#3211) * [New Rule] Tainted Kernel Module Load * added setup note * Fixed tag * added type change * timestamp override --------- Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- ...ersistence_tainted_kernel_module_load.toml | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 rules_building_block/persistence_tainted_kernel_module_load.toml diff --git a/rules_building_block/persistence_tainted_kernel_module_load.toml b/rules_building_block/persistence_tainted_kernel_module_load.toml new file mode 100644 index 000000000..6f474429b --- /dev/null +++ b/rules_building_block/persistence_tainted_kernel_module_load.toml @@ -0,0 +1,90 @@ +[metadata] +bypass_bbr_timing = true +creation_date = "2023/10/23" +integration = ["system"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/23" + +[rule] +author = ["Elastic"] +building_block_type = "default" +description = """ +This rule monitors the syslog log file for messages related to instances of a tainted kernel module load. Rootkits often +leverage kernel modules as their main defense evasion technique. Detecting tainted kernel module loads is crucial for +ensuring system security and integrity, as malicious or unauthorized modules can compromise the kernel and lead to +system vulnerabilities or unauthorized access. +""" +from = "now-9m" +index = ["logs-system.auth-*"] +language = "kuery" +license = "Elastic License v2" +name = "Tainted Kernel Module Load" +risk_score = 21 +rule_id = "05cad2fb-200c-407f-b472-02ea8c9e5e4a" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Auditbeat +- Filebeat + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat for Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat for the Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). + +""" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence" + ] +timestamp_override = "event.ingested" +type = "query" +query = ''' +host.os.type:linux and event.dataset:"system.syslog" and process.name:kernel and +message:"module verification failed: signature and/or required key missing - tainting kernel" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1547" +name = "Boot or Logon Autostart Execution" +reference = "https://attack.mitre.org/techniques/T1547/" + +[[rule.threat.technique.subtechnique]] +id = "T1547.006" +name = "Kernel Modules and Extensions" +reference = "https://attack.mitre.org/techniques/T1547/006/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + From 9807bebd8e2f89413146c60a591be9a103fe398b Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 23 Oct 2023 17:18:48 +0200 Subject: [PATCH 57/86] [New BBR] Unix Socket Communication (#3072) * [New Rule] Unix Socket Communication * Update rules_building_block/execution_unix_socket_communication.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules_building_block/execution_unix_socket_communication.toml --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> --- .../execution_unix_socket_communication.toml | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 rules_building_block/execution_unix_socket_communication.toml diff --git a/rules_building_block/execution_unix_socket_communication.toml b/rules_building_block/execution_unix_socket_communication.toml new file mode 100644 index 000000000..6e33fe6a8 --- /dev/null +++ b/rules_building_block/execution_unix_socket_communication.toml @@ -0,0 +1,50 @@ +[metadata] +creation_date = "2023/09/04" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/04" +bypass_bbr_timing = true + +[rule] +author = ["Elastic"] +description = """ +This rule monitors for inter-process communication via Unix sockets. Adversaries may attempt to communicate with local +Unix sockets to enumerate application details, find vulnerabilities/configuration mistakes and potentially escalate +privileges or set up malicious communication channels via Unix sockets for inter-process communication to attempt to +evade detection. +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Unix Socket Connection" +risk_score = 21 +rule_id = "41284ba3-ed1a-4598-bfba-a97f75d9aba2" +severity = "low" +tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and ( + (process.name in ("nc", "ncat", "netcat", "nc.openbsd") and + process.args == "-U" and process.args : ("/usr/local/*", "/run/*", "/var/run/*")) or + (process.name == "socat" and + process.args == "-" and process.args : ("UNIX-CLIENT:/usr/local/*", "UNIX-CLIENT:/run/*", "UNIX-CLIENT:/var/run/*")) +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1559" +name = "Inter-Process Communication" +reference = "https://attack.mitre.org/techniques/T1559/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" From ff268cc6a0786135b73f1e0cd01c3d66a7988008 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 23 Oct 2023 17:31:26 +0200 Subject: [PATCH 58/86] [New Rule] Netcat Listener Established via rlwrap (#3124) * [New Rule] Netcat Listener Established via rlwrap * Update rules/linux/execution_nc_listener_via_rlwrap.toml --- .../execution_nc_listener_via_rlwrap.toml | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 rules/linux/execution_nc_listener_via_rlwrap.toml diff --git a/rules/linux/execution_nc_listener_via_rlwrap.toml b/rules/linux/execution_nc_listener_via_rlwrap.toml new file mode 100644 index 000000000..b4ac27cb4 --- /dev/null +++ b/rules/linux/execution_nc_listener_via_rlwrap.toml @@ -0,0 +1,62 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/22" + +[rule] +author = ["Elastic"] +description = """ +Monitors for the execution of a netcat listener via rlwrap. rlwrap is a 'readline wrapper', a small utility that uses +the GNU Readline library to allow the editing of keyboard input for any command. This utility can be used in conjunction +with netcat to gain a more stable reverse shell. +""" +false_positives = [ + """ + Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux + distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may + originate from scripts, automation tools, and frameworks. + """, +] +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Netcat Listener Established via rlwrap" +risk_score = 21 +rule_id = "0f56369f-eb3d-459c-a00b-87c2bf7bdfc5" +severity = "low" +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and +process.name == "rlwrap" and process.args in ( + "nc", "ncat", "netcat", "nc.openbsd", "socat" +) and process.args : "*l*" and process.args_count >= 4 +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1059" +name = "Command and Scripting Interpreter" +reference = "https://attack.mitre.org/techniques/T1059/" + +[[rule.threat.technique.subtechnique]] +id = "T1059.004" +name = "Unix Shell" +reference = "https://attack.mitre.org/techniques/T1059/004/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" From 835be9b2451c6568ad8d60fed43fa02b0df9e025 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Mon, 23 Oct 2023 12:23:56 -0400 Subject: [PATCH 59/86] [New Rule] Add Living-off-the-Land (LotL) ProblemChild Rules (#3193) * adding new LotL rules * added endpoint tags; updated technique mapping * added missing data source tag * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * updated note, references and date * changed ATT&CK technique to binary proxy execution --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- ...se_evasion_ml_rare_process_for_a_host.toml | 54 +++++++++++++++ ..._ml_rare_process_for_a_parent_process.toml | 56 ++++++++++++++++ ...se_evasion_ml_rare_process_for_a_user.toml | 57 ++++++++++++++++ ...e_evasion_ml_suspicious_windows_event.toml | 66 ++++++++++++++++++ ...icious_windows_event_high_probability.toml | 67 +++++++++++++++++++ ...ous_windows_process_cluster_from_host.toml | 56 ++++++++++++++++ ...s_process_cluster_from_parent_process.toml | 58 ++++++++++++++++ ...ous_windows_process_cluster_from_user.toml | 58 ++++++++++++++++ 8 files changed, 472 insertions(+) create mode 100644 rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml create mode 100644 rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml diff --git a/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml b/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml new file mode 100644 index 000000000..7701a2a8b --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml @@ -0,0 +1,54 @@ +[metadata] +creation_date = "2023/09/19" +integration = ["problemchild"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/23" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected a suspicious Windows process. This process has been classified as suspicious in two +ways. It was predicted to be suspicious by the ProblemChild supervised ML model, and it was found to be an unusual +process, on a host that does not commonly manifest malicious activity. Such a process may be an instance of suspicious +or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "problem_child_rare_process_by_host" +name = "Unusual Process Spawned by a Host" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "56004189-4e69-4a39-b4a9-195329d226e9" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1218" +name = "System Binary Proxy Execution" +reference = "https://attack.mitre.org/techniques/T1218/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml b/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml new file mode 100644 index 000000000..7a6af8781 --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml @@ -0,0 +1,56 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/23" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two +ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be an unusual child +process name, for the parent process, by an unsupervised ML model. Such a process may be an instance of suspicious or +malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "problem_child_rare_process_by_parent" +name = "Unusual Process Spawned by a Parent Process" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "ea09ff26-3902-4c53-bb8e-24b7a5d029dd" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml b/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml new file mode 100644 index 000000000..fc3085911 --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml @@ -0,0 +1,57 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/23" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two +ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be suspicious given +that its user context is unusual and does not commonly manifest malicious activity,by an unsupervised ML model. Such a +process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to +detection using conventional search rules. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "problem_child_rare_process_by_user" +name = "Unusual Process Spawned by a User" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "40155ee4-1e6a-4e4d-a63b-e8ba16980cfb" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml new file mode 100644 index 000000000..801f18442 --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event.toml @@ -0,0 +1,66 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild","endpoint"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +author = ["Elastic"] +description = """ +A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high +probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being +malicious. +""" +from = "now-10m" +index = ["endgame-*", "logs-endpoint.events.process-*", "winlogbeat-*"] +language = "eql" +license = "Elastic License v2" +name = "Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "13e908b9-7bf0-4235-abc9-b5deb500d0ad" +severity = "low" +tags = [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +process where (problemchild.prediction == 1 or blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*") +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.004" +name = "Masquerade Task or Service" +reference = "https://attack.mitre.org/techniques/T1036/004/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml new file mode 100644 index 000000000..4adb1946e --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml @@ -0,0 +1,67 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild","endpoint"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/23" + +[rule] +author = ["Elastic"] +description = """ +A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high +probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being +malicious. +""" +from = "now-10m" +index = ["endgame-*", "logs-endpoint.events.process-*", "winlogbeat-*"] +language = "eql" +license = "Elastic License v2" +name = "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "994e40aa-8c85-43de-825e-15f665375ee8" +severity = "low" +tags = [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +process where ((problemchild.prediction == 1 and problemchild.prediction_probability > 0.98) or +blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*") +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" +[[rule.threat.technique.subtechnique]] +id = "T1036.004" +name = "Masquerade Task or Service" +reference = "https://attack.mitre.org/techniques/T1036/004/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml new file mode 100644 index 000000000..38ec615d9 --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml @@ -0,0 +1,56 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high +scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) +were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious +processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be +unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly +involving LOLbins, that may be resistant to detection using conventional search rules. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "problem_child_high_sum_by_host" +name = "Suspicious Windows Process Cluster Spawned by a Host" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "bdfebe11-e169-42e3-b344-c5d2015533d3" +severity = "low" +tags = [ + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml new file mode 100644 index 000000000..2e4c7417e --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml @@ -0,0 +1,58 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high +scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) +were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious +processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to +be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly +involving LOLbins, that may be resistant to detection using conventional search rules. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "problem_child_high_sum_by_parent" +name = "Suspicious Windows Process Cluster Spawned by a Parent Process" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "f5d9d36d-7c30-4cdb-a856-9f653c13d4e0" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + diff --git a/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml new file mode 100644 index 000000000..1bc663132 --- /dev/null +++ b/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml @@ -0,0 +1,58 @@ +[metadata] +creation_date = "2023/10/16" +integration = ["problemchild"] +maturity = "production" +min_stack_comments = "LotL package job ID and rule removal updates" +min_stack_version = "8.9.0" +updated_date = "2023/10/16" + +[rule] +anomaly_threshold = 75 +author = ["Elastic"] +description = """ +A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high +scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) +were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious +processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be +unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly +involving LOLbins, that may be resistant to detection using conventional search rules. +""" +from = "now-45m" +interval = "15m" +license = "Elastic License v2" +machine_learning_job_id = "problem_child_high_sum_by_user" +name = "Suspicious Windows Process Cluster Spawned by a User" +note = """## Setup + +The Living-off-the-Land (LotL) Detection integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/problemchild", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" +] +risk_score = 21 +rule_id = "1224da6c-0326-4b4f-8454-68cdc5ae542b" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Living off the Land Attack Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Defense Evasion", +] +type = "machine_learning" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + From a471f6fc6096d873814cf06c9a7694f95365301f Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Mon, 23 Oct 2023 14:34:36 -0300 Subject: [PATCH 60/86] [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver (#3215) * [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver * Update privilege_escalation_installertakeover.toml --- ...rivilege_escalation_installertakeover.toml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/rules/windows/privilege_escalation_installertakeover.toml b/rules/windows/privilege_escalation_installertakeover.toml index a19faf24b..9c932e66b 100644 --- a/rules/windows/privilege_escalation_installertakeover.toml +++ b/rules/windows/privilege_escalation_installertakeover.toml @@ -1,10 +1,10 @@ [metadata] creation_date = "2021/11/25" -integration = ["endpoint", "windows"] +integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -39,7 +39,7 @@ Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) defaul allows an unprivileged user to escalate privileges to SYSTEM. """ from = "now-9m" -index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privilege Escalation via InstallerFileTakeOver" @@ -111,17 +111,22 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -/* This rule is compatible with both Sysmon and Elastic Endpoint */ - process where host.os.type == "windows" and event.type == "start" and - (?process.Ext.token.integrity_level_name : "System" or - ?winlog.event_data.IntegrityLevel : "System") and + process.Ext.token.integrity_level_name : "System" and ( (process.name : "elevation_service.exe" and not process.pe.original_file_name == "elevation_service.exe") or + + (process.name : "elevation_service.exe" and + not process.code_signature.trusted == true) or (process.parent.name : "elevation_service.exe" and process.name : ("rundll32.exe", "cmd.exe", "powershell.exe")) + ) and + not + ( + process.name : "elevation_service.exe" and process.code_signature.trusted == true and + process.pe.original_file_name == null ) ''' From 6fcf26b20e927678be1545818cb54d7bff032abf Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Mon, 23 Oct 2023 14:56:03 -0300 Subject: [PATCH 61/86] [Promote] Potential Masquerading as Communication Apps (#3181) * [Promote] Potential Masquerading as Communication Apps * Update defense_evasion_masquerading_communication_apps.toml * Update defense_evasion_masquerading_communication_apps.toml * Update rules/windows/defense_evasion_masquerading_communication_apps.toml * Update defense_evasion_masquerading_communication_apps.toml --------- Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- .../defense_evasion_masquerading_communication_apps.toml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) rename {rules_building_block => rules/windows}/defense_evasion_masquerading_communication_apps.toml (95%) diff --git a/rules_building_block/defense_evasion_masquerading_communication_apps.toml b/rules/windows/defense_evasion_masquerading_communication_apps.toml similarity index 95% rename from rules_building_block/defense_evasion_masquerading_communication_apps.toml rename to rules/windows/defense_evasion_masquerading_communication_apps.toml index fe0a3313f..aac5dce5c 100644 --- a/rules_building_block/defense_evasion_masquerading_communication_apps.toml +++ b/rules/windows/defense_evasion_masquerading_communication_apps.toml @@ -5,7 +5,6 @@ maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" updated_date = "2023/10/13" -bypass_bbr_timing = true [rule] author = ["Elastic"] @@ -18,12 +17,11 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Masquerading as Communication Apps" -risk_score = 21 +risk_score = 47 rule_id = "c9482bfa-a553-4226-8ea2-4959bd4f7923" -severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Rule Type: BBR", "Data Source: Elastic Defend"] +severity = "medium" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" -building_block_type = "default" type = "eql" query = ''' From 3855dd06d84a5b928c3053b0f12b9c86d832f3cc Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 23 Oct 2023 21:35:43 +0200 Subject: [PATCH 62/86] [New Rule] Potential Linux Hack Tool Launched (#3125) * [New Rule] Potential Linux Hack Tool Launched * changed description slightly * Updated description * Update rules/linux/execution_potential_hack_tool_executed.toml * Update rules/linux/execution_potential_hack_tool_executed.toml --- ...xecution_potential_hack_tool_executed.toml | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 rules/linux/execution_potential_hack_tool_executed.toml diff --git a/rules/linux/execution_potential_hack_tool_executed.toml b/rules/linux/execution_potential_hack_tool_executed.toml new file mode 100644 index 000000000..d608ce135 --- /dev/null +++ b/rules/linux/execution_potential_hack_tool_executed.toml @@ -0,0 +1,60 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["endpoint"] +maturity = "production" +updated_date = "2023/09/22" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" + +[rule] +author = ["Elastic"] +description = """ +Monitors for the execution of different processes that might be used by attackers for malicious intent. An alert from +this rule should be investigated further, as hack tools are commonly used by blue teamers and system administrators as +well. +""" +from = "now-9m" +index = ["logs-endpoint.events.*", "endgame-*"] +language = "eql" +license = "Elastic License v2" +name = "Potential Linux Hack Tool Launched" +risk_score = 47 +rule_id = "1df1152b-610a-4f48-9d7a-504f6ee5d9da" +severity = "medium" +timestamp_override = "event.ingested" +tags = ["Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ] +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action in ("exec", "exec_event") and event.type == "start" and +process.name in ( + // exploitation frameworks + "crackmapexec", "msfconsole", "msfvenom", "sliver-client", "sliver-server", "havoc", + // network scanners (nmap left out to reduce noise) + "zenmap", "nuclei", "netdiscover", "legion", + // web enumeration + "gobuster", "dirbuster", "dirb", "wfuzz", "ffuf", "whatweb", "eyewitness", + // web vulnerability scanning + "wpscan", "joomscan", "droopescan", "nikto", + // exploitation tools + "sqlmap", "commix", "yersinia", + // cracking and brute forcing + "john", "hashcat", "hydra", "ncrack", "cewl", "fcrackzip", "rainbowcrack", + // host and network + "linenum.sh", "linpeas.sh", "pspy32", "pspy32s", "pspy64", "pspy64s", "binwalk", "evil-winrm" +) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + From 3d5720970516e3167f5326de8cab447d16494788 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Tue, 24 Oct 2023 12:51:59 -0400 Subject: [PATCH 63/86] [Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221) * adding adjusted Okta rules * adding adjusted AWS rules * adding adjusted AWS rules --- .../aws/collection_cloudtrail_logging_created.toml | 6 +++--- .../credential_access_aws_iam_assume_role_brute_force.toml | 6 +++--- .../aws/credential_access_iam_user_addition_to_group.toml | 6 +++--- ...ial_access_new_terms_secretsmanager_getsecretvalue.toml | 6 +++--- ...credential_access_root_console_failure_brute_force.toml | 6 +++--- .../aws/defense_evasion_cloudtrail_logging_deleted.toml | 6 +++--- .../aws/defense_evasion_cloudtrail_logging_suspended.toml | 6 +++--- .../aws/defense_evasion_cloudwatch_alarm_deletion.toml | 6 +++--- .../aws/defense_evasion_config_service_rule_deletion.toml | 6 +++--- .../defense_evasion_configuration_recorder_stopped.toml | 6 +++--- .../aws/defense_evasion_ec2_flow_log_deletion.toml | 6 +++--- .../aws/defense_evasion_ec2_network_acl_deletion.toml | 6 +++--- ...efense_evasion_elasticache_security_group_creation.toml | 6 +++--- ...ion_elasticache_security_group_modified_or_deleted.toml | 6 +++--- ...se_evasion_escalation_aws_suspicious_saml_activity.toml | 6 +++--- .../aws/defense_evasion_guardduty_detector_deletion.toml | 6 +++--- .../defense_evasion_s3_bucket_configuration_deletion.toml | 6 +++--- .../integrations/aws/defense_evasion_waf_acl_deletion.toml | 6 +++--- .../defense_evasion_waf_rule_or_rule_group_deletion.toml | 6 +++--- ...iltration_ec2_full_network_packet_capture_detected.toml | 6 +++--- .../aws/exfiltration_ec2_snapshot_change_activity.toml | 6 +++--- .../aws/exfiltration_ec2_vm_export_failure.toml | 7 +++---- .../integrations/aws/exfiltration_rds_snapshot_export.toml | 6 +++--- .../aws/exfiltration_rds_snapshot_restored.toml | 6 +++--- .../impact_aws_eventbridge_rule_disabled_or_deleted.toml | 6 +++--- .../aws/impact_cloudtrail_logging_updated.toml | 6 +++--- .../aws/impact_cloudwatch_log_group_deletion.toml | 6 +++--- .../aws/impact_cloudwatch_log_stream_deletion.toml | 6 +++--- .../aws/impact_ec2_disable_ebs_encryption.toml | 6 +++--- .../aws/impact_efs_filesystem_or_mount_deleted.toml | 6 +++--- .../integrations/aws/impact_iam_deactivate_mfa_device.toml | 6 +++--- rules/integrations/aws/impact_iam_group_deletion.toml | 6 +++--- .../impact_kms_cmk_disabled_or_scheduled_for_deletion.toml | 6 +++--- rules/integrations/aws/impact_rds_group_deletion.toml | 6 +++--- .../aws/impact_rds_instance_cluster_deletion.toml | 6 +++--- .../aws/impact_rds_instance_cluster_stoppage.toml | 6 +++--- .../aws/initial_access_console_login_root.toml | 6 +++--- .../integrations/aws/initial_access_password_recovery.toml | 6 +++--- .../aws/initial_access_via_system_manager.toml | 6 +++--- .../aws/ml_cloudtrail_error_message_spike.toml | 6 +++--- rules/integrations/aws/ml_cloudtrail_rare_error_code.toml | 6 +++--- .../aws/ml_cloudtrail_rare_method_by_city.toml | 6 +++--- .../aws/ml_cloudtrail_rare_method_by_country.toml | 6 +++--- .../aws/ml_cloudtrail_rare_method_by_user.toml | 6 +++--- .../aws/persistence_ec2_network_acl_creation.toml | 6 +++--- ..._ec2_security_group_configuration_change_detection.toml | 6 +++--- rules/integrations/aws/persistence_iam_group_creation.toml | 6 +++--- .../integrations/aws/persistence_rds_cluster_creation.toml | 6 +++--- rules/integrations/aws/persistence_rds_group_creation.toml | 6 +++--- .../aws/persistence_rds_instance_creation.toml | 6 +++--- .../aws/persistence_redshift_instance_creation.toml | 6 +++--- ...persistence_route_53_domain_transfer_lock_disabled.toml | 6 +++--- ...nce_route_53_domain_transferred_to_another_account.toml | 6 +++--- ...istence_route_53_hosted_zone_associated_with_a_vpc.toml | 6 +++--- .../integrations/aws/persistence_route_table_created.toml | 6 +++--- .../aws/persistence_route_table_modified_or_deleted.toml | 6 +++--- .../aws/privilege_escalation_root_login_without_mfa.toml | 6 +++--- .../aws/privilege_escalation_sts_assumerole_usage.toml | 6 +++--- .../privilege_escalation_sts_getsessiontoken_abuse.toml | 6 +++--- .../aws/privilege_escalation_updateassumerolepolicy.toml | 6 +++--- .../credential_access_attempted_bypass_of_okta_mfa.toml | 6 +++--- ...l_access_attempts_to_brute_force_okta_user_account.toml | 6 +++--- .../okta/credential_access_mfa_push_brute_force.toml | 6 +++--- ...ntial_access_okta_brute_force_or_password_spraying.toml | 6 +++--- .../okta/credential_access_user_impersonation_access.toml | 6 +++--- ...se_evasion_attempt_to_deactivate_okta_network_zone.toml | 6 +++--- ...efense_evasion_attempt_to_delete_okta_network_zone.toml | 6 +++--- ...nse_evasion_okta_attempt_to_deactivate_okta_policy.toml | 6 +++--- ...vasion_okta_attempt_to_deactivate_okta_policy_rule.toml | 6 +++--- ...defense_evasion_okta_attempt_to_delete_okta_policy.toml | 6 +++--- ...se_evasion_okta_attempt_to_delete_okta_policy_rule.toml | 6 +++--- ...e_evasion_okta_attempt_to_modify_okta_network_zone.toml | 6 +++--- ...defense_evasion_okta_attempt_to_modify_okta_policy.toml | 6 +++--- ...se_evasion_okta_attempt_to_modify_okta_policy_rule.toml | 6 +++--- ...icious_okta_user_password_reset_or_unlock_attempts.toml | 6 +++--- .../okta/impact_attempt_to_revoke_okta_api_token.toml | 6 +++--- ...impact_okta_attempt_to_deactivate_okta_application.toml | 6 +++--- .../impact_okta_attempt_to_delete_okta_application.toml | 6 +++--- .../impact_okta_attempt_to_modify_okta_application.toml | 6 +++--- .../integrations/okta/impact_possible_okta_dos_attack.toml | 6 +++--- ...ial_access_okta_user_attempted_unauthorized_access.toml | 6 +++--- ...l_access_suspicious_activity_reported_by_okta_user.toml | 6 +++--- .../okta_threatinsight_threat_suspected_promotion.toml | 6 +++--- ...ce_administrator_privileges_assigned_to_okta_group.toml | 6 +++--- ...rsistence_administrator_role_assigned_to_okta_user.toml | 6 +++--- .../okta/persistence_attempt_to_create_okta_api_token.toml | 6 +++--- ...ce_attempt_to_deactivate_mfa_for_okta_user_account.toml | 6 +++--- ...attempt_to_reset_mfa_factors_for_okta_user_account.toml | 6 +++--- ...mpt_to_modify_or_delete_application_sign_on_policy.toml | 6 +++--- 89 files changed, 267 insertions(+), 268 deletions(-) diff --git a/rules/integrations/aws/collection_cloudtrail_logging_created.toml b/rules/integrations/aws/collection_cloudtrail_logging_created.toml index 080344a3d..7c98b094c 100644 --- a/rules/integrations/aws/collection_cloudtrail_logging_created.toml +++ b/rules/integrations/aws/collection_cloudtrail_logging_created.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/10" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml b/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml index a0013bba4..10f3690f1 100644 --- a/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml +++ b/rules/integrations/aws/credential_access_aws_iam_assume_role_brute_force.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/16" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml b/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml index 32deee2fc..57f07beba 100644 --- a/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml +++ b/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/04" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml b/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml index ccc5f89fe..e4b4ae529 100644 --- a/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml +++ b/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/06" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.6.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Nick Jones", "Elastic"] diff --git a/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml b/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml index 9b6bb94e8..7b542798a 100644 --- a/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml +++ b/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/21" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml b/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml index 008d61b51..3b713f994 100644 --- a/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml +++ b/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/26" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml b/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml index 552181c21..4e64f98ed 100644 --- a/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml +++ b/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/10" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml b/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml index 4e78d4238..e2421b561 100644 --- a/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml +++ b/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/15" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml b/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml index 29d5757d4..ee935f6b6 100644 --- a/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml +++ b/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/26" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml b/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml index 6551ae4ea..4aa177260 100644 --- a/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml +++ b/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/16" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml b/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml index 94d833e85..c269e47f0 100644 --- a/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml +++ b/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/15" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml b/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml index a0995f265..666c41e15 100644 --- a/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml +++ b/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/26" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml b/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml index 63df8627e..7a2f09090 100644 --- a/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml +++ b/rules/integrations/aws/defense_evasion_elasticache_security_group_creation.toml @@ -2,9 +2,9 @@ creation_date = "2021/07/19" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml b/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml index 6602ce057..95da9223e 100644 --- a/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml +++ b/rules/integrations/aws/defense_evasion_elasticache_security_group_modified_or_deleted.toml @@ -2,9 +2,9 @@ creation_date = "2021/07/19" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/defense_evasion_escalation_aws_suspicious_saml_activity.toml b/rules/integrations/aws/defense_evasion_escalation_aws_suspicious_saml_activity.toml index 26ddc3cac..69f5076ed 100644 --- a/rules/integrations/aws/defense_evasion_escalation_aws_suspicious_saml_activity.toml +++ b/rules/integrations/aws/defense_evasion_escalation_aws_suspicious_saml_activity.toml @@ -2,9 +2,9 @@ creation_date = "2021/09/22" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml b/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml index ff9618dab..8b68bb624 100644 --- a/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml +++ b/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/28" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml b/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml index b43499b90..8183f3ce9 100644 --- a/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml +++ b/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/27" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml b/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml index 603dcc022..6e6392a63 100644 --- a/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml +++ b/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml b/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml index bc2241fe4..5c4d59871 100644 --- a/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml +++ b/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/09" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml index 28ae27071..057ad33b4 100644 --- a/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml +++ b/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml b/rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml index 928f1b162..2446da3f1 100644 --- a/rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml +++ b/rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/24" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml b/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml index cc2c30690..e086940ed 100644 --- a/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml +++ b/rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml @@ -2,10 +2,9 @@ creation_date = "2021/04/22" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" - +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] description = """ diff --git a/rules/integrations/aws/exfiltration_rds_snapshot_export.toml b/rules/integrations/aws/exfiltration_rds_snapshot_export.toml index b35bb5787..02a64984f 100644 --- a/rules/integrations/aws/exfiltration_rds_snapshot_export.toml +++ b/rules/integrations/aws/exfiltration_rds_snapshot_export.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/06" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/exfiltration_rds_snapshot_restored.toml b/rules/integrations/aws/exfiltration_rds_snapshot_restored.toml index 502f53adc..19f25b6d0 100644 --- a/rules/integrations/aws/exfiltration_rds_snapshot_restored.toml +++ b/rules/integrations/aws/exfiltration_rds_snapshot_restored.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/29" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml b/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml index 1280fe920..91440dc7b 100644 --- a/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml +++ b/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml @@ -2,9 +2,9 @@ creation_date = "2021/10/17" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/impact_cloudtrail_logging_updated.toml b/rules/integrations/aws/impact_cloudtrail_logging_updated.toml index fce9a66a9..eb570fcfa 100644 --- a/rules/integrations/aws/impact_cloudtrail_logging_updated.toml +++ b/rules/integrations/aws/impact_cloudtrail_logging_updated.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/10" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml b/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml index bb2e94eed..064094c8e 100644 --- a/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml +++ b/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/18" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml b/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml index bb5149224..83490a20d 100644 --- a/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml +++ b/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/20" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml b/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml index 1236984cc..4ddc1121c 100644 --- a/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml +++ b/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml b/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml index 2bb04050d..5894cecae 100644 --- a/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml +++ b/rules/integrations/aws/impact_efs_filesystem_or_mount_deleted.toml @@ -2,9 +2,9 @@ creation_date = "2021/08/27" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml b/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml index 1f38decb2..9fab36a07 100644 --- a/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml +++ b/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/26" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/impact_iam_group_deletion.toml b/rules/integrations/aws/impact_iam_group_deletion.toml index 32c36862d..4ab1bb5aa 100644 --- a/rules/integrations/aws/impact_iam_group_deletion.toml +++ b/rules/integrations/aws/impact_iam_group_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml b/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml index 04a0ce323..e96b2938d 100644 --- a/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml +++ b/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2022/09/21" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Xavier Pich"] diff --git a/rules/integrations/aws/impact_rds_group_deletion.toml b/rules/integrations/aws/impact_rds_group_deletion.toml index eb4a0c013..0b27d82f7 100644 --- a/rules/integrations/aws/impact_rds_group_deletion.toml +++ b/rules/integrations/aws/impact_rds_group_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml b/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml index d4ef16cde..811f4578e 100644 --- a/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml +++ b/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml b/rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml index cf2a46a33..77d9869c7 100644 --- a/rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml +++ b/rules/integrations/aws/impact_rds_instance_cluster_stoppage.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/20" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/initial_access_console_login_root.toml b/rules/integrations/aws/initial_access_console_login_root.toml index 4ffe7f51e..bd6a4d98d 100644 --- a/rules/integrations/aws/initial_access_console_login_root.toml +++ b/rules/integrations/aws/initial_access_console_login_root.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/11" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/initial_access_password_recovery.toml b/rules/integrations/aws/initial_access_password_recovery.toml index 167e309f5..766eefcbe 100644 --- a/rules/integrations/aws/initial_access_password_recovery.toml +++ b/rules/integrations/aws/initial_access_password_recovery.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/02" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/initial_access_via_system_manager.toml b/rules/integrations/aws/initial_access_via_system_manager.toml index d54ecc791..f3e72f174 100644 --- a/rules/integrations/aws/initial_access_via_system_manager.toml +++ b/rules/integrations/aws/initial_access_via_system_manager.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/06" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml b/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml index 98b5bd2cd..2e7f5fb50 100644 --- a/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml +++ b/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml @@ -1,9 +1,9 @@ [metadata] creation_date = "2020/07/13" maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" integration = ["aws"] [rule] diff --git a/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml b/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml index e9cf7f940..f0622af6c 100644 --- a/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml +++ b/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml @@ -1,9 +1,9 @@ [metadata] creation_date = "2020/07/13" maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" integration = ["aws"] [rule] diff --git a/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml b/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml index b48411c34..ae2cf411b 100644 --- a/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml +++ b/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml @@ -1,9 +1,9 @@ [metadata] creation_date = "2020/07/13" maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" integration = ["aws"] [rule] diff --git a/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml b/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml index 47d143110..dae363dc1 100644 --- a/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml +++ b/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml @@ -1,9 +1,9 @@ [metadata] creation_date = "2020/07/13" maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" integration = ["aws"] [rule] diff --git a/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml b/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml index 97cc7c73e..b2e817bfc 100644 --- a/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml +++ b/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml @@ -1,9 +1,9 @@ [metadata] creation_date = "2020/07/13" maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" integration = ["aws"] [rule] diff --git a/rules/integrations/aws/persistence_ec2_network_acl_creation.toml b/rules/integrations/aws/persistence_ec2_network_acl_creation.toml index c88b09e02..4ad3b0a44 100644 --- a/rules/integrations/aws/persistence_ec2_network_acl_creation.toml +++ b/rules/integrations/aws/persistence_ec2_network_acl_creation.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/04" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml b/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml index 0b93db1a5..93a6aea90 100644 --- a/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml +++ b/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_iam_group_creation.toml b/rules/integrations/aws/persistence_iam_group_creation.toml index 9be4b0e8e..b0c544fe5 100644 --- a/rules/integrations/aws/persistence_iam_group_creation.toml +++ b/rules/integrations/aws/persistence_iam_group_creation.toml @@ -2,9 +2,9 @@ creation_date = "2020/06/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/persistence_rds_cluster_creation.toml b/rules/integrations/aws/persistence_rds_cluster_creation.toml index 1477799cd..cbdb569d2 100644 --- a/rules/integrations/aws/persistence_rds_cluster_creation.toml +++ b/rules/integrations/aws/persistence_rds_cluster_creation.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/20" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/persistence_rds_group_creation.toml b/rules/integrations/aws/persistence_rds_group_creation.toml index 84363d703..52c0669cf 100644 --- a/rules/integrations/aws/persistence_rds_group_creation.toml +++ b/rules/integrations/aws/persistence_rds_group_creation.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_rds_instance_creation.toml b/rules/integrations/aws/persistence_rds_instance_creation.toml index 2b06cc806..cec6b592e 100644 --- a/rules/integrations/aws/persistence_rds_instance_creation.toml +++ b/rules/integrations/aws/persistence_rds_instance_creation.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/06" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_redshift_instance_creation.toml b/rules/integrations/aws/persistence_redshift_instance_creation.toml index 77e34b3a2..b08243647 100644 --- a/rules/integrations/aws/persistence_redshift_instance_creation.toml +++ b/rules/integrations/aws/persistence_redshift_instance_creation.toml @@ -2,9 +2,9 @@ creation_date = "2022/04/12" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml b/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml index 2af669a16..1e690fa56 100644 --- a/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml +++ b/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/10" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml b/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml index 428c05327..61fffb6b3 100644 --- a/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml +++ b/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/10" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml b/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml index 4b7c2c295..b00cafb0a 100644 --- a/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml +++ b/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml @@ -2,9 +2,9 @@ creation_date = "2021/07/19" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/persistence_route_table_created.toml b/rules/integrations/aws/persistence_route_table_created.toml index 2009f4a47..a1957e6b9 100644 --- a/rules/integrations/aws/persistence_route_table_created.toml +++ b/rules/integrations/aws/persistence_route_table_created.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/persistence_route_table_modified_or_deleted.toml b/rules/integrations/aws/persistence_route_table_modified_or_deleted.toml index c431b3707..fbfda67e6 100644 --- a/rules/integrations/aws/persistence_route_table_modified_or_deleted.toml +++ b/rules/integrations/aws/persistence_route_table_modified_or_deleted.toml @@ -2,9 +2,9 @@ creation_date = "2021/06/05" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/aws/privilege_escalation_root_login_without_mfa.toml b/rules/integrations/aws/privilege_escalation_root_login_without_mfa.toml index ff82788f4..67c7d630b 100644 --- a/rules/integrations/aws/privilege_escalation_root_login_without_mfa.toml +++ b/rules/integrations/aws/privilege_escalation_root_login_without_mfa.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/06" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/aws/privilege_escalation_sts_assumerole_usage.toml b/rules/integrations/aws/privilege_escalation_sts_assumerole_usage.toml index f8f83f9fb..1a0318d5f 100644 --- a/rules/integrations/aws/privilege_escalation_sts_assumerole_usage.toml +++ b/rules/integrations/aws/privilege_escalation_sts_assumerole_usage.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/17" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse.toml b/rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse.toml index 5739a3aae..21023d227 100644 --- a/rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse.toml +++ b/rules/integrations/aws/privilege_escalation_sts_getsessiontoken_abuse.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/17" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Austin Songer"] diff --git a/rules/integrations/aws/privilege_escalation_updateassumerolepolicy.toml b/rules/integrations/aws/privilege_escalation_updateassumerolepolicy.toml index e3c6d08ae..dbc55b859 100644 --- a/rules/integrations/aws/privilege_escalation_updateassumerolepolicy.toml +++ b/rules/integrations/aws/privilege_escalation_updateassumerolepolicy.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/06" integration = ["aws"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0" +min_stack_version = "8.9.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml b/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml index 76e9531a4..ea7727195 100644 --- a/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml +++ b/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml b/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml index 122c6d031..0b0642aec 100644 --- a/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml +++ b/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml @@ -2,9 +2,9 @@ creation_date = "2020/08/19" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "@BenB196", "Austin Songer"] diff --git a/rules/integrations/okta/credential_access_mfa_push_brute_force.toml b/rules/integrations/okta/credential_access_mfa_push_brute_force.toml index 9311bb1be..5b532e0f0 100644 --- a/rules/integrations/okta/credential_access_mfa_push_brute_force.toml +++ b/rules/integrations/okta/credential_access_mfa_push_brute_force.toml @@ -2,9 +2,9 @@ creation_date = "2022/01/05" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml b/rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml index 920423823..ea496f4e9 100644 --- a/rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml +++ b/rules/integrations/okta/credential_access_okta_brute_force_or_password_spraying.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/16" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/credential_access_user_impersonation_access.toml b/rules/integrations/okta/credential_access_user_impersonation_access.toml index 8a06da032..2fd57af1d 100644 --- a/rules/integrations/okta/credential_access_user_impersonation_access.toml +++ b/rules/integrations/okta/credential_access_user_impersonation_access.toml @@ -2,9 +2,9 @@ creation_date = "2022/03/22" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml b/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml index 82aa64827..856ad4b93 100644 --- a/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml +++ b/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml b/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml index 3c39f5e83..81e9923cb 100644 --- a/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml +++ b/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml index 4e3d4479b..299402106 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml index 58860e787..b8808bd73 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml index f1ca3dd89..3eacae43c 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/28" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml index d03380c64..a4d1686a6 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml index 1cac48ec5..46d6272fc 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml index 03a4d292a..396b1a511 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml b/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml index 10553afe9..ed6f28598 100644 --- a/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml +++ b/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml b/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml index 4d461de63..7d6940bf1 100644 --- a/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml +++ b/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml @@ -2,9 +2,9 @@ creation_date = "2020/08/19" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "@BenB196", "Austin Songer"] diff --git a/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml b/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml index a2267b536..d8a9dbacb 100644 --- a/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml +++ b/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml b/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml index 7887f83d5..e50772963 100644 --- a/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml +++ b/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/30" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml b/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml index 7178d23a5..f7a58cf61 100644 --- a/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml +++ b/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml b/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml index 04cc2f0fa..c1d8d4462 100644 --- a/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml +++ b/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/impact_possible_okta_dos_attack.toml b/rules/integrations/okta/impact_possible_okta_dos_attack.toml index b3073630c..50fbb993e 100644 --- a/rules/integrations/okta/impact_possible_okta_dos_attack.toml +++ b/rules/integrations/okta/impact_possible_okta_dos_attack.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml b/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml index 344e04661..1065307a1 100644 --- a/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml +++ b/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml @@ -2,9 +2,9 @@ creation_date = "2021/05/14" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic", "Austin Songer"] diff --git a/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml b/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml index 6f41ce6d5..0edfa5597 100644 --- a/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml +++ b/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml b/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml index 4dfba7b0c..007370eca 100644 --- a/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml +++ b/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" promotion = true [rule] diff --git a/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml b/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml index c6b80a4df..3d6cc61ca 100644 --- a/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml +++ b/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml b/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml index 377b354b4..e43376c7a 100644 --- a/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml +++ b/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml @@ -2,9 +2,9 @@ creation_date = "2020/11/06" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml b/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml index abf0487d8..e4747856d 100644 --- a/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml +++ b/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/06/22" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml b/rules/integrations/okta/persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml index 23b2763a4..d128c950c 100644 --- a/rules/integrations/okta/persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml +++ b/rules/integrations/okta/persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/20" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml b/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml index cb4fb8ff1..e80120621 100644 --- a/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml +++ b/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml @@ -2,9 +2,9 @@ creation_date = "2020/05/21" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] diff --git a/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml b/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml index a79da174c..393117f63 100644 --- a/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml +++ b/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml @@ -2,9 +2,9 @@ creation_date = "2020/07/01" integration = ["okta"] maturity = "production" -min_stack_comments = "New fields added: required_fields, related_integrations, setup" -min_stack_version = "8.3.0" -updated_date = "2023/08/17" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/10/24" [rule] author = ["Elastic"] From ab6f28a38053a5f28b50477e591e35cd78e454a8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 24 Oct 2023 14:01:11 -0400 Subject: [PATCH 64/86] Lock versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 (#3223) * Locked versions for releases: 8.3,8.4,8.5,8.6,8.7,8.8,8.9,8.10,8.11 * Update detection_rules/etc/deprecated_rules.json --------- Co-authored-by: terrancedejesus Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- detection_rules/etc/deprecated_rules.json | 10 + detection_rules/etc/version.lock.json | 2879 +++++++++++++++------ 2 files changed, 2066 insertions(+), 823 deletions(-) diff --git a/detection_rules/etc/deprecated_rules.json b/detection_rules/etc/deprecated_rules.json index a878ce1ae..7b6d7e5cc 100644 --- a/detection_rules/etc/deprecated_rules.json +++ b/detection_rules/etc/deprecated_rules.json @@ -1,4 +1,9 @@ { + "041d4d41-9589-43e2-ba13-5680af75ebc2": { + "deprecation_date": "2023/09/25", + "rule_name": "Deprecated - Potential DNS Tunneling via Iodine", + "stack_version": "8.3" + }, "08d5d7e2-740f-44d8-aeda-e41f4263efaf": { "deprecation_date": "2021/04/15", "rule_name": "TCP Port 8000 Activity to the Internet", @@ -89,6 +94,11 @@ "rule_name": "Execution via Regsvcs/Regasm", "stack_version": "7.14.0" }, + "4973e46b-a663-41b8-a875-ced16dda2bb0": { + "deprecation_date": "2023/09/25", + "rule_name": "Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable", + "stack_version": "8.6" + }, "5e87f165-45c2-4b80-bfa5-52822552c997": { "deprecation_date": "2022/03/16", "rule_name": "Potential PrintNightmare File Modification", diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index 5f60b8849..7444b4537 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -1,24 +1,33 @@ { "000047bb-b27a-47ec-8b62-ef1a5d2c9e19": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Attempt to Modify an Okta Policy Rule", + "sha256": "ab816235d1086e87acda877a4f3bc72e72af952ecf7a40b59d2d45991812ef73", + "type": "query", + "version": 107 + } + }, "rule_name": "Attempt to Modify an Okta Policy Rule", - "sha256": "8e250a9c8ff04c25044e7bd0932764e6d21ad669c07dcbd9589c825b771b13f2", + "sha256": "8e250a9c8ff04c25044e7bd0932764e6d21ad669c07dcbd9589c825b771b13f2", "type": "query", - "version": 106 + "version": 207 }, "00140285-b827-4aee-aa09-8113f58a08f3": { "min_stack_version": "8.3", "rule_name": "Potential Credential Access via Windows Utilities", - "sha256": "d30c57775c5b17bd01a68c5752337e391ce2d7db5cb8aa6eccbc9a54c200c86c", + "sha256": "c12251f0ebf415936a88178bbe670516848a774c5cf3e9bc888a6a8824a0e13a", "type": "eql", - "version": 108 + "version": 109 }, "0022d47d-39c7-4f69-a232-4fe9dc7a3acd": { "min_stack_version": "8.3", "rule_name": "System Shells via Services", - "sha256": "8f7269ea080f0c8f9d2257a9ed2e32139f4c2c1cd0dbc9ebf61ee83987b10d83", + "sha256": "629ee62bf64e9993225823b0969be69d7b4494d53adc0ffbcdc501745be3ab8f", "type": "eql", - "version": 107 + "version": 108 }, "00678712-b2df-11ed-afe9-f661ea17fbcc": { "min_stack_version": "8.4", @@ -35,18 +44,27 @@ "version": 102 }, "015cca13-8832-49ac-a01b-a396114809f6": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Redshift Cluster Creation", + "sha256": "7a1faa4c3dfde300711d7bb69b6a93b8e64a3d33cc83a37a3d5cfcf6d9b09b2d", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Redshift Cluster Creation", "sha256": "b1c8e121fb4363f74d0c8928f3335aa2f374919f5257a9f4b17483773c49f348", "type": "query", - "version": 104 + "version": 205 }, "0171f283-ade7-4f87-9521-ac346c68cc9b": { "min_stack_version": "8.3", "rule_name": "Potential Network Scan Detected", - "sha256": "a149d3ca79d319960c0d9e727ba65ff5e3350567e7f234907d03d7927621b13d", + "sha256": "6f969409e34ce2e04899c197404f8717d28ae3866797966be0653c4a3867fdc6", "type": "threshold", - "version": 3 + "version": 4 }, "027ff9ea-85e7-42e3-99d2-bbb7069e02eb": { "min_stack_version": "8.3", @@ -106,12 +124,19 @@ "type": "eql", "version": 2 }, + "03c23d45-d3cb-4ad4-ab5d-b361ffe8724a": { + "min_stack_version": "8.3", + "rule_name": "Potential Network Scan Executed From Host", + "sha256": "247079101b736a6f3dfb963c2106e2d5dfaf9523a631e74b57ca03fa12e6c429", + "type": "threshold", + "version": 1 + }, "0415f22a-2336-45fa-ba07-618a5942e22c": { "min_stack_version": "8.3", "rule_name": "Modification of OpenSSH Binaries", - "sha256": "4cb2b6b77c91784f961b4347413643db618e2f27805ae42c5d6087ba7e5a9794", + "sha256": "77e56ceb38921c2a4b69d7e793e5cebe8412e613b9f767bf3e7d272f297aa00d", "type": "query", - "version": 105 + "version": 106 }, "041d4d41-9589-43e2-ba13-5680af75ebc2": { "min_stack_version": "8.3", @@ -144,16 +169,23 @@ "05b358de-aa6d-4f6c-89e6-78f74018b43b": { "min_stack_version": "8.3", "rule_name": "Conhost Spawned By Suspicious Parent Process", - "sha256": "7f1bba1cf96766fe9d2d0d21e7e7d03114483ebf1d91a52bdc7a370c5751699b", + "sha256": "6df780c2019fb6ff0102a70515a5233d958c58be4522ce64b31da80680965b27", "type": "eql", - "version": 106 + "version": 107 + }, + "05cad2fb-200c-407f-b472-02ea8c9e5e4a": { + "min_stack_version": "8.3", + "rule_name": "Tainted Kernel Module Load", + "sha256": "a546a22d29ab39e34b84e1d2bb96312c59c8c0072948b715eea31b3cae42f3fb", + "type": "query", + "version": 1 }, "05e5a668-7b51-4a67-93ab-e9af405c9ef3": { "min_stack_version": "8.3", "rule_name": "Interactive Terminal Spawned via Perl", - "sha256": "f31c9a7ea34568a5374ff1710793245daeb9aeb25b3a9a24e97f06a5888a0ca2", + "sha256": "e707dd532d4c099c31f5b95bdc9d237af995a146109cd6caf07576bac95509f4", "type": "query", - "version": 105 + "version": 106 }, "0635c542-1b96-4335-9b47-126582d2c19a": { "min_stack_version": "8.3", @@ -207,16 +239,16 @@ "0787daa6-f8c5-453b-a4ec-048037f6c1cd": { "min_stack_version": "8.3", "rule_name": "Suspicious Proc Pseudo File System Enumeration", - "sha256": "5839a3666d7e0133ba8b7e42ac89b59b39e750d0b97a3b3583b69c13de90129a", + "sha256": "8822c17823d2a397a734dabe9b76dc5786f7ea603e234dc22bac765c440f88ad", "type": "threshold", - "version": 3 + "version": 4 }, "07b1ef73-1fde-4a49-a34a-5dd40011b076": { "min_stack_version": "8.3", "rule_name": "Local Account TokenFilter Policy Disabled", - "sha256": "a31f827db85593474e5766adaf71c535a3a5d7ce628347b6b7e606bdb261bd04", + "sha256": "89428d0f0fc36a5b1ff0704bcfaf222c5592e066c0a1179e4d851b02b8384d67", "type": "eql", - "version": 5 + "version": 6 }, "07b5f85a-240f-11ed-b3d9-f661ea17fbce": { "min_stack_version": "8.4", @@ -285,9 +317,9 @@ "09443c92-46b3-45a4-8f25-383b028b258d": { "min_stack_version": "8.3", "rule_name": "Process Termination followed by Deletion", - "sha256": "b47a3759b8145c73009358643478d070d44505235b1c16c6282bf2925986ffaa", + "sha256": "3eef996ce0b596a8c36e90f7b072702cf85d200f1a9683ab6d81d18bf69ed5d1", "type": "eql", - "version": 106 + "version": 107 }, "0968cfbd-40f0-4b1c-b7b1-a60736c7b241": { "rule_name": "Linux Restricted Shell Breakout via cpulimit Shell Evasion", @@ -298,9 +330,9 @@ "09bc6c90-7501-494d-b015-5d988dc3f233": { "min_stack_version": "8.3", "rule_name": "File Creation, Execution and Self-Deletion in Suspicious Directory", - "sha256": "094055b11724accc14288884bea8d069e3e5c1c1d32159a9b78fc9d7808cdc3a", + "sha256": "86eaafcb32b1483e8453f37ecd655c5e8c33aceb5c823ab84d86ff4a4759ca09", "type": "eql", - "version": 1 + "version": 2 }, "09d028a5-dcde-409f-8ae0-557cef1b7082": { "min_stack_version": "8.3", @@ -319,9 +351,9 @@ "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Remote Execution Capabilities via WinRM", - "sha256": "c33b0262570792c916921cd4645eb950802579016d010a5a0c5672fa4007efc8", + "sha256": "010e64048d380d35b40f806816a62483d54ed2f3cdafafd01f6d92feb6df8f79", "type": "query", - "version": 2 + "version": 3 }, "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5": { "min_stack_version": "8.3", @@ -340,9 +372,9 @@ "0b803267-74c5-444d-ae29-32b5db2d562a": { "min_stack_version": "8.3", "rule_name": "Potential Shell via Wildcard Injection Detected", - "sha256": "cd1a313ebc7c4d9e532bb43100c4d5c06d27676750ffde616f9aec4fcb71d086", + "sha256": "c545678521c2df966a1a7b9a11ac1e9e2bb8d0acad65746d1bb12f47607f2149", "type": "eql", - "version": 2 + "version": 3 }, "0c093569-dff9-42b6-87b1-0242d9f7d9b4": { "min_stack_version": "8.3", @@ -398,9 +430,9 @@ "0d69150b-96f8-467c-a86d-a67a3378ce77": { "min_stack_version": "8.3", "rule_name": "Nping Process Activity", - "sha256": "b526d1555e13cf130c9d0129928555065e1f976d20616cd8863f9e2f7c8720e6", + "sha256": "a268355fc0423778888b7e0b1d9b8e7e5dd149344e2b5baa79b585c6189698e4", "type": "eql", - "version": 105 + "version": 106 }, "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5": { "min_stack_version": "8.3", @@ -442,9 +474,16 @@ } }, "rule_name": "Potential Persistence Through Run Control Detected", - "sha256": "cd15e73bb94658d23cc9c074c1ace32b319514089fac6deb29e145d0179bb131", + "sha256": "514ea9a49add087a7f2f10f48d370ebfea15dc09db5bb9d5a908453ced80567e", "type": "new_terms", - "version": 106 + "version": 107 + }, + "0f56369f-eb3d-459c-a00b-87c2bf7bdfc5": { + "min_stack_version": "8.3", + "rule_name": "Netcat Listener Established via rlwrap", + "sha256": "ff53f0363d8f483a8cedf49e6a907968b544472e09fd83e82d1eb9b2f3b16af0", + "type": "eql", + "version": 1 }, "0f616aee-8161-4120-857e-742366f5eeb3": { "rule_name": "PowerShell spawning Cmd", @@ -497,24 +536,33 @@ }, "1160dcdb-0a0a-4a79-91d8-9b84616edebd": { "min_stack_version": "8.3", - "rule_name": "Potential DLL SideLoading via Trusted Microsoft Programs", - "sha256": "ab39fe136a7992f299f43bce78b299f1c1491092730e5d6a4c4bf4d3f9231935", + "rule_name": "Potential DLL Side-Loading via Trusted Microsoft Programs", + "sha256": "73bcd7b6468b86456d40fae00cecf6d091d5f5b42458d68c4ba96cb0f0304967", "type": "eql", - "version": 106 + "version": 107 }, "1178ae09-5aff-460a-9f2f-455cd0ac4d8e": { "min_stack_version": "8.3", "rule_name": "UAC Bypass via Windows Firewall Snap-In Hijack", - "sha256": "faeaccab4b1a4766cc93a7b427cb7250df74ac218438d547281678e44d7a3cd9", + "sha256": "b0824ce814b7fa05a5a6e8d9f8f54849dd033892fd3ad5d850a4a5e2df77645b", "type": "eql", - "version": 107 + "version": 108 }, "119c8877-8613-416d-a98a-96b6664ee73a": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Snapshot Export", + "sha256": "d7c79adde1bf89e2a7544eec2729c0b5c45c62fdcdd5f00090d28e5cb73f6da7", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Snapshot Export", "sha256": "8ad9d6381bc6ad8046516f5f50cdc304ccb0958161af21a171928b95088b6b17", "type": "query", - "version": 104 + "version": 205 }, "119c8877-8613-416d-a98a-96b6664ee73a5": { "rule_name": "AWS RDS Snapshot Export", @@ -532,16 +580,25 @@ "11ea6bec-ebde-4d71-a8e9-784948f8e3e9": { "min_stack_version": "8.3", "rule_name": "Third-party Backup Files Deleted via Unexpected Process", - "sha256": "8614adabfa74ea56500abff063edfd0fab24a93e560df2fdfd68d3a60b78fa10", + "sha256": "f48869c0c1a7667d8c8a24d78167a2e33fa2e5db8b4d71bbab951f29a6571875", "type": "eql", - "version": 107 + "version": 108 }, "12051077-0124-4394-9522-8f4f4db1d674": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Route 53 Domain Transfer Lock Disabled", + "sha256": "845e16fdf9dd59a0ee37658ad41a83a6149e5487422dac763de90cde6aad227f", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Route 53 Domain Transfer Lock Disabled", "sha256": "ee7d0fde7179ecae486163263d6baf71e90dd5e6048b4db1674a4d4eff6f2975", "type": "query", - "version": 104 + "version": 205 }, "120559c6-5e24-49f4-9e30-8ffe697df6b9": { "rule_name": "User Discovery via Whoami", @@ -549,6 +606,13 @@ "type": "query", "version": 100 }, + "1224da6c-0326-4b4f-8454-68cdc5ae542b": { + "min_stack_version": "8.9", + "rule_name": "Suspicious Windows Process Cluster Spawned by a User", + "sha256": "dce0a6166ccdba29ec3a03d3fbd91c615057e7615daa7020e5a488304719aa3d", + "type": "machine_learning", + "version": 1 + }, "125417b8-d3df-479f-8418-12d7e034fee3": { "rule_name": "Attempt to Disable IPTables or Firewall", "sha256": "7852c6d19ed6216fb60c46fdeffb6d109d509b83ed076aab9240c57540fc2960", @@ -613,9 +677,9 @@ "12f07955-1674-44f7-86b5-c35da0a6f41a": { "min_stack_version": "8.3", "rule_name": "Suspicious Cmd Execution via WMI", - "sha256": "fcf12be61708b748f14f6ae118e930f2c5ebf65992bc3df225f66c5dad6ed0b6", + "sha256": "91ce748803215def5fc3e0a13c3061c7a533494b7bfd86f66b778586a56f4ee9", "type": "eql", - "version": 106 + "version": 107 }, "1327384f-00f3-44d5-9a8c-2373ba071e92": { "min_stack_version": "8.3", @@ -637,6 +701,13 @@ "type": "query", "version": 100 }, + "13e908b9-7bf0-4235-abc9-b5deb500d0ad": { + "min_stack_version": "8.9", + "rule_name": "Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity", + "sha256": "2841e9117fd834df97cee4f6d7220cf2c5296a604b9e73f4477e8206eb7f78b3", + "type": "eql", + "version": 1 + }, "141e9b3a-ff37-4756-989d-05d7cbf35b0e": { "min_stack_version": "8.3", "rule_name": "Azure External Guest User Invitation", @@ -654,9 +725,9 @@ "14dab405-5dd9-450c-8106-72951af2391f": { "min_stack_version": "8.3", "rule_name": "Office Test Registry Persistence", - "sha256": "2a26bc9292902c92d9bc73a14ff7e20ffa9c0904b209692b1e8e23bd32c88fb3", + "sha256": "dfc7bc44c6f6d34fee6331a065d25992ba9f2cb18ddddf1d91a9c581eb4f15b8", "type": "eql", - "version": 1 + "version": 2 }, "14de811c-d60f-11ec-9fd7-f661ea17fbce": { "min_stack_version": "8.4", @@ -677,16 +748,23 @@ "14ed1aa9-ebfd-4cf9-a463-0ac59ec55204": { "min_stack_version": "8.3", "rule_name": "Potential Persistence via Time Provider Modification", - "sha256": "afca97139ffb2af012ea212958cd4118f14e183943e7c030e5ac45d06a430450", + "sha256": "02cd614602c0740f432c413ad474d41900748740202d7ffd5f6103b3096ff544", "type": "eql", - "version": 104 + "version": 105 + }, + "1542fa53-955e-4330-8e4d-b2d812adeb5f": { + "min_stack_version": "8.3", + "rule_name": "Execution from a Removable Media with Network Connection", + "sha256": "395e463813d0cad1e718f84d5a13a564016c82b69dcfd8027af981c0ec07cc2f", + "type": "eql", + "version": 1 }, "15a8ba77-1c13-4274-88fe-6bd14133861e": { "min_stack_version": "8.3", "rule_name": "Scheduled Task Execution at Scale via GPO", - "sha256": "17c01410a2573124cf140a518366b8a585209a201bfee33b5f7d855fa9b07e2c", + "sha256": "2f29328dabd08f923a8df391ea35c8ea653ed3968d056d71b05ae11f402b17c9", "type": "query", - "version": 107 + "version": 108 }, "15c0b7a7-9c34-4869-b25b-fa6518414899": { "min_stack_version": "8.3", @@ -724,18 +802,27 @@ "version": 104 }, "169f3a93-efc7-4df2-94d6-0d9438c310d1": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS IAM Group Creation", + "sha256": "b742e26488a024ca917c76ed8b6d78e38bceaf88b12ac5a184cba21816858e5c", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS IAM Group Creation", "sha256": "b97182b40fec27cf6728746f838be74ee2cf5ebee183fc5d0f6eaf338b7d90a3", "type": "query", - "version": 104 + "version": 205 }, "16a52c14-7883-47af-8745-9357803f0d4c": { "min_stack_version": "8.3", "rule_name": "Component Object Model Hijacking", - "sha256": "436bc1aff82273c9504f7df46a2ce3c1653d4dd9864c1580f5ecb99a74c6e3cf", + "sha256": "6f7e78b34dbd113748d1850790a473327c1ae2f910eaed28ea59e14871d611f2", "type": "eql", - "version": 107 + "version": 108 }, "16fac1a1-21ee-4ca6-b720-458e3855d046": { "min_stack_version": "8.3", @@ -782,9 +869,9 @@ "17b0a495-4d9f-414c-8ad0-92f018b8e001": { "min_stack_version": "8.6", "rule_name": "New Systemd Service Created by Previously Unknown Process", - "sha256": "bd8754496ad2a53571780aab55b02d8dbe4aa20329da96a586b6f81cb7fecdf8", + "sha256": "4ee6af63081a009901c6f3b4f3f314e8c3dbe15dd4d5751b7c5536708cc01fed", "type": "new_terms", - "version": 4 + "version": 5 }, "17c7f6a5-5bc9-4e1f-92bf-13632d24384d": { "min_stack_version": "8.3", @@ -823,16 +910,25 @@ "193549e8-bb9e-466a-a7f9-7e783f5cb5a6": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via Recently Compiled Executable", - "sha256": "1169776f997d618e40607bc71cdd85c338f7c14f158c845f3ab3ab48922d23f4", + "sha256": "f58eb1cacf84d92e06f41776bcc67711b803714568ae64ad82e907c980a3c4d5", "type": "eql", - "version": 1 + "version": 2 }, "19de8096-e2b0-4bd8-80c9-34a820813fff": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Rare AWS Error Code", + "sha256": "36fb7f357ab4c1d87f38a2a9f453fb1093c959582b23dda8d3071db185b7d65d", + "type": "machine_learning", + "version": 108 + } + }, "rule_name": "Rare AWS Error Code", "sha256": "45da42408e9e47f7550b2ff787fd33fe211dc4d0c4ccbfd9342ae768d88384ec", "type": "machine_learning", - "version": 107 + "version": 208 }, "19e9daf3-f5c5-4bc2-a9af-6b1e97098f03": { "min_stack_version": "8.9", @@ -863,11 +959,20 @@ "version": 106 }, "1aa8fa52-44a7-4dae-b058-f3333b91c8d7": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS CloudTrail Log Suspended", + "sha256": "e728282d89ab6116e74d508a075da4f9a1388ba2da235fd87605b4ad580312f0", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS CloudTrail Log Suspended", "sha256": "dd01a147a8898a4f6c696c83a4c436bf0325ab7552a03039d7cd71ff0b6c00dc", "type": "query", - "version": 107 + "version": 208 }, "1aa9181a-492b-4c01-8b16-fa0735786b2b": { "min_stack_version": "8.3", @@ -879,23 +984,39 @@ "1b21abcc-4d9f-4b08-a7f5-316f5f94b973": { "min_stack_version": "8.3", "rule_name": "Connection to Internal Network via Telnet", - "sha256": "68f0d73167458fd1589c365cfb07d8bdf9d49e3368435dd8ad08d5eda2d180a4", + "sha256": "aae5d1cb44fafff6fe643a706d5eef8d83794dfae46ea638507259cb2c9bb041", "type": "eql", - "version": 104 + "version": 105 }, "1ba5160d-f5a2-4624-b0ff-6a1dc55d2516": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS ElastiCache Security Group Modified or Deleted", + "sha256": "bcef75f6d49bb03184f9398613ed080bc7bd2279da99afaa50ba68d3a99f3b4c", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS ElastiCache Security Group Modified or Deleted", "sha256": "95e2cb6322ef7b2d7bc2fc96460cbfcb4c76f0eb17351a134c783936996adab0", "type": "query", - "version": 104 + "version": 205 }, "1c27fa22-7727-4dd3-81c0-de6da5555feb": { "min_stack_version": "8.3", "rule_name": "Potential Internal Linux SSH Brute Force Detected", - "sha256": "8b67ccd035342354a2698b9006811320c186cc7a6caebc0aaff26698e08a45bd", + "sha256": "0b4cbcadf42c525059f293cf8894de62f587e228878dfc70d1d6aafdfebaa221", "type": "eql", - "version": 7 + "version": 8 + }, + "1c5a04ae-d034-41bf-b0d8-96439b5cc774": { + "min_stack_version": "8.3", + "rule_name": "Potential Process Injection from Malicious Document", + "sha256": "585cc415f1c54e220db615a5f052321909100ebc7b9e63b944e6b19a6a4e6404", + "type": "eql", + "version": 1 }, "1c6a8c7a-5cb6-4a82-ba27-d5a5b8a40a38": { "min_stack_version": "8.3", @@ -907,9 +1028,9 @@ "1c84dd64-7e6c-4bad-ac73-a5014ee37042": { "min_stack_version": "8.3", "rule_name": "Suspicious File Creation in /etc for Persistence", - "sha256": "3113571e7885f573582d119f9e0905d33369509446e7a2729497380f27d3d077", + "sha256": "d5fac2c07f8912a7aeb5987420d21df972ba3bcfda92b5c66438a6f37625e973", "type": "eql", - "version": 108 + "version": 109 }, "1c966416-60c1-436b-bfd0-e002fddbfd89": { "min_stack_version": "8.3", @@ -935,9 +1056,9 @@ "1d276579-3380-4095-ad38-e596a01bc64f": { "min_stack_version": "8.3", "rule_name": "Remote File Download via Script Interpreter", - "sha256": "6e10cd53c6b8fef5635f3e97892648c45c1ef8219958c3ad9af076a08f6788b7", + "sha256": "9b721a8bd708e3ba1c854f032771bd1fa175535e5dc546a07be290e5c156c6d3", "type": "eql", - "version": 107 + "version": 108 }, "1d72d014-e2ab-4707-b056-9b96abe7b511": { "min_stack_version": "8.3", @@ -956,9 +1077,9 @@ "1dcc51f6-ba26-49e7-9ef4-2655abb2361e": { "min_stack_version": "8.3", "rule_name": "UAC Bypass via DiskCleanup Scheduled Task Hijack", - "sha256": "cbdda8fa4a7ee1ebd5708a3bcc4aaf50947d560339f8f8c45effe6f0e8309a64", + "sha256": "09504eee0ca293aed720134b083bcf30791788c02f630b563bfb73e34fe17918", "type": "eql", - "version": 104 + "version": 105 }, "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1": { "min_stack_version": "8.4", @@ -974,6 +1095,13 @@ "type": "eql", "version": 106 }, + "1df1152b-610a-4f48-9d7a-504f6ee5d9da": { + "min_stack_version": "8.3", + "rule_name": "Potential Linux Hack Tool Launched", + "sha256": "1d7ffe0b0cb484baa86ed92a884c1b7c1ed28b7a8d3591393beaf14d5ffe7fc4", + "type": "eql", + "version": 1 + }, "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Discovery Capabilities", @@ -1026,9 +1154,9 @@ "1fe3b299-fbb5-4657-a937-1d746f2c711a": { "min_stack_version": "8.3", "rule_name": "Unusual Network Activity from a Windows System Binary", - "sha256": "f14eab4a7143c53fcd49fb00bb945fe9f86c0db1e63ad3b4fd1ceced47e484f1", + "sha256": "6005266947232b8c8285b53252c0a3aceb08713658436d0aa268fd92aaa462f0", "type": "eql", - "version": 107 + "version": 108 }, "2003cdc8-8d83-4aa5-b132-1f9a8eb48514": { "min_stack_version": "8.3", @@ -1040,9 +1168,9 @@ "201200f1-a99b-43fb-88ed-f65a45c4972c": { "min_stack_version": "8.3", "rule_name": "Suspicious .NET Code Compilation", - "sha256": "838a9d840a2c93100aa9faf4b4291f9c968db9e541f1cf59807bd041b0d88a94", + "sha256": "94fec9b0c4fecdb1ba512be811459a1cae6d7efcac880fc5d63a308a8f87be8b", "type": "eql", - "version": 106 + "version": 107 }, "203ab79b-239b-4aa5-8e54-fc50623ee8e4": { "min_stack_version": "8.3", @@ -1052,11 +1180,20 @@ "version": 106 }, "2045567e-b0af-444a-8c0b-0b6e2dae9e13": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Route 53 Domain Transferred to Another Account", + "sha256": "cd100d12464b46b1f170d8e6b26ed144023ba52b4077a97354a6a9fcbabf7465", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Route 53 Domain Transferred to Another Account", "sha256": "7512cf97f8885a42febe293ecc8c04d77f6369d4ba87372fcd3ef38a204f9af3", "type": "query", - "version": 104 + "version": 205 }, "20457e4f-d1de-4b92-ae69-142e27a4342a": { "min_stack_version": "8.3", @@ -1107,11 +1244,20 @@ "version": 5 }, "2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 203, + "rule_name": "SSH Authorized Keys File Modification", + "sha256": "8e07f35dbd0f747e519638ad9464ab2502ac2d84b6db85f092155081cf57f23c", + "type": "query", + "version": 104 + } + }, "rule_name": "SSH Authorized Keys File Modification", - "sha256": "8e07f35dbd0f747e519638ad9464ab2502ac2d84b6db85f092155081cf57f23c", - "type": "query", - "version": 104 + "sha256": "005f7835fa070f7f885e2383bf737e042e166aa86438d213922d52e82ff0cd91", + "type": "new_terms", + "version": 204 }, "22599847-5d13-48cb-8872-5796fee8692b": { "min_stack_version": "8.3", @@ -1121,11 +1267,20 @@ "version": 107 }, "227dc608-e558-43d9-b521-150772250bae": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "AWS S3 Bucket Configuration Deletion", + "sha256": "ad8600664f0e0704b136c9959aec90beb90d433fd1457d49adc4e920ad882f17", + "type": "query", + "version": 106 + } + }, "rule_name": "AWS S3 Bucket Configuration Deletion", "sha256": "7804226b0da1b8d6dde3bbfed024feab1da6c23e091dfa55852b50309f4dd9fe", "type": "query", - "version": 105 + "version": 206 }, "231876e7-4d1f-4d63-a47c-47dd1acdc1cb": { "min_stack_version": "8.3", @@ -1143,10 +1298,10 @@ }, "2339f03c-f53f-40fa-834b-40c5983fc41f": { "min_stack_version": "8.3", - "rule_name": "Kernel module load via insmod", - "sha256": "716b6003b6a1bbcec145bd5ccdfc5283a40c843dc12fc82ff75fd26cc67b5b7c", + "rule_name": "Kernel Module Load via insmod", + "sha256": "4c816b9ebae8561e4197ef52689ef05de8036037dc74de66afdae2a9aa6a2845", "type": "eql", - "version": 105 + "version": 106 }, "2377946d-0f01-4957-8812-6878985f515d": { "min_stack_version": "8.9", @@ -1165,23 +1320,23 @@ "25224a80-5a4a-4b8a-991e-6ab390465c4f": { "min_stack_version": "8.3", "rule_name": "Lateral Movement via Startup Folder", - "sha256": "9567e972186b39d9f4d1a378dfb482b40eae9cc129ee8c83562223fb8f1a9a3a", + "sha256": "7eb4bab3a9d22066a5b70d36c5d06224bd14bf207e4152a20a04bd323f5fc06a", "type": "eql", - "version": 104 + "version": 105 }, "259be2d8-3b1a-4c2c-a0eb-0c8e77f35e39": { "min_stack_version": "8.3", "rule_name": "Potential Reverse Shell via Background Process", - "sha256": "e46a905a4613f54e71ebce5fcab1853140ae284c3d0ecc23ad4afa82c5ca69e3", + "sha256": "98913787308b752f32b96a1d2e394c59c7a0c880b2caa632f30c81842f2cb0c9", "type": "eql", - "version": 1 + "version": 2 }, "2605aa59-29ac-4662-afad-8d86257c7c91": { "min_stack_version": "8.3", "rule_name": "Potential Suspicious DebugFS Root Device Access", - "sha256": "8bd9e051e381430287850aac140060e1c4eb55636e83ae0d010d241069f208cb", + "sha256": "15d66149f0f83ab636bbca6591b3cda98a98989d4e8cbca69c06725499d7fd2e", "type": "eql", - "version": 2 + "version": 3 }, "2636aa6c-88b5-4337-9c31-8d0192a8ef45": { "min_stack_version": "8.3", @@ -1193,9 +1348,9 @@ "265db8f5-fc73-4d0d-b434-6483b56372e2": { "min_stack_version": "8.3", "rule_name": "Persistence via Update Orchestrator Service Hijack", - "sha256": "158c5a76f4a4ff8441aa5189db7ca3f8677a210f01a9023decd1732862ef8f46", + "sha256": "0f3875681feabc9889f6f06cf0687e0b3f367b347f46f58fe88448b97c69821c", "type": "eql", - "version": 107 + "version": 108 }, "26b01043-4f04-4d2f-882a-5a1d2e95751b": { "min_stack_version": "8.3", @@ -1235,9 +1390,9 @@ "2772264c-6fb9-4d9d-9014-b416eed21254": { "min_stack_version": "8.3", "rule_name": "Incoming Execution via PowerShell Remoting", - "sha256": "ed68bcf2e292ec89f9e8f578e9e4847812fd4177fa242725286c16db53ff03e0", + "sha256": "06a344a111e75594161e3a08c78be77d29fd146dec8b6ce48d5cc9330a9166f1", "type": "eql", - "version": 106 + "version": 107 }, "2783d84f-5091-4d7d-9319-9fceda8fa71b": { "min_stack_version": "8.3", @@ -1256,16 +1411,16 @@ "2820c9c2-bcd7-4d6e-9eba-faf3891ba450": { "min_stack_version": "8.3", "rule_name": "Account Password Reset Remotely", - "sha256": "4e81da588d72ce375e5c9d046ebc2d09776070111a26ad970d2a12b048741c4d", + "sha256": "f21f7b41b32d1c07a79ab7a9be75729b18a0dff1cf744238f305d04f3a862ea6", "type": "eql", - "version": 106 + "version": 107 }, "2856446a-34e6-435b-9fb5-f8f040bfa7ed": { "min_stack_version": "8.3", "rule_name": "Account Discovery Command via SYSTEM Account", - "sha256": "8ba669048ae42b7afd8f153bbae5a1b181f3d070db1241c38c847c1fe4dae0e1", + "sha256": "900b6c0dcc73edd29b7f8b445d08d37da743dcd1e18c5a8cc4a545be1c9e4c72", "type": "eql", - "version": 106 + "version": 107 }, "2863ffeb-bf77-44dd-b7a5-93ef94b72036": { "min_stack_version": "8.3", @@ -1277,9 +1432,9 @@ "28738f9f-7427-4d23-bc69-756708b5f624": { "min_stack_version": "8.3", "rule_name": "Suspicious File Changes Activity Detected", - "sha256": "6d8b1a876a2e1ce2967be858e2e4cfecd82d84c47b08d8e33c72e22725073eb2", + "sha256": "29566bc20e44999833de4b93b85e993bbca41d4c16ca41f5fe01ea80ad52937a", "type": "eql", - "version": 5 + "version": 6 }, "28896382-7d4f-4d50-9b72-67091901fd26": { "rule_name": "Suspicious Process from Conhost", @@ -1290,30 +1445,39 @@ "28d39238-0c01-420a-b77a-24e5a7378663": { "min_stack_version": "8.3", "rule_name": "Sudo Command Enumeration Detected", - "sha256": "ea5c6d696a82dd4d7d63fb04dd726e8b1fb33ac4622151663d19d31ef7a99a67", + "sha256": "765e6c39bbdfecbbfd3ffa1a44b4838d06c295b53d4b73143316ec99c8b3550b", "type": "eql", - "version": 2 + "version": 3 }, "29052c19-ff3e-42fd-8363-7be14d7c5469": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Security Group Configuration Change Detection", + "sha256": "6eafdfc2847d0f8150d36752200d76b3777de7dd46ac7d6c1dab97c2b6afaa67", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Security Group Configuration Change Detection", "sha256": "f057a319aa5b049290fa8416727ae3ef64bb9ac7779901a61713efe9acef57da", "type": "query", - "version": 104 + "version": 205 }, "290aca65-e94d-403b-ba0f-62f320e63f51": { "min_stack_version": "8.3", "rule_name": "UAC Bypass Attempt via Windows Directory Masquerading", - "sha256": "47309853f13ad591cfcbb60814b5c1a7c731abfc3f5349fbb5e9acb25b347134", + "sha256": "a6231a8bcd050f72676f997117e09ea1f8873a178971237eb2b54404906f0c95", "type": "eql", - "version": 107 + "version": 108 }, "2917d495-59bd-4250-b395-c29409b76086": { "min_stack_version": "8.3", "rule_name": "Web Shell Detection: Script Process Child of Common Web Processes", - "sha256": "e1d3e0942816bd8564b7abde73127790f145ce3332346d041fbc1e0421600524", + "sha256": "13c2fcb9dbaf1339d3e3b7e5fa159bc1a2875aee235776f1bb13518d49a8d738", "type": "eql", - "version": 106 + "version": 107 }, "291a0de9-937a-4189-94c0-3e847c8b13e4": { "min_stack_version": "8.6", @@ -1348,9 +1512,9 @@ "2a692072-d78d-42f3-a48a-775677d79c4e": { "min_stack_version": "8.3", "rule_name": "Potential Code Execution via Postgresql", - "sha256": "2f246e33c5b5318512de95d017377941e955a43a607619340a1ee900353ca612", + "sha256": "8dd9f5b2abfa297105040ebfc4e441af646a5bec20f8ee97a6856351c8e1f99b", "type": "eql", - "version": 3 + "version": 4 }, "2abda169-416b-4bb3-9a6b-f8d239fd78ba": { "min_stack_version": "8.4", @@ -1371,16 +1535,16 @@ "2b662e21-dc6e-461e-b5cf-a6eb9b235ec4": { "min_stack_version": "8.5", "rule_name": "ESXI Discovery via Grep", - "sha256": "8193724c74f8c3bda981c1ea69c1775177c530e3a5d30e2387577bd4abaa66f2", + "sha256": "01993ae1314c912204f7b87a0999c27cd2861f56a7a0b766dd0bbe4119dc0c9f", "type": "eql", - "version": 3 + "version": 4 }, "2bf78aa2-9c56-48de-b139-f169bf99cf86": { "min_stack_version": "8.3", "rule_name": "Adobe Hijack Persistence", - "sha256": "9aeae912e062be1da7e7f26a9a5cb726d945ce4bba3c5b040a131c5636920a59", + "sha256": "6c4da0a89fa984f5f93fd0fa33b26bc6bee17987271ce73792eb19e342bd9289", "type": "eql", - "version": 107 + "version": 108 }, "2c17e5d7-08b9-43b2-b58a-0270d65ac85b": { "min_stack_version": "8.3", @@ -1408,9 +1572,9 @@ } }, "rule_name": "Enumeration of Kernel Modules", - "sha256": "e66fa90d3d617373ae52b10b1487f5d53b35fea7e11bf4371ccaf37fe0782482", + "sha256": "2fa255256633606f39637f99e60437fd03db8f4721370c5cefa5c65857661e01", "type": "new_terms", - "version": 205 + "version": 206 }, "2dd480be-1263-4d9c-8672-172928f6789a": { "min_stack_version": "8.8", @@ -1424,9 +1588,16 @@ } }, "rule_name": "Suspicious Process Access via Direct System Call", - "sha256": "df14ef4e07fceb0c56c6aa4890c718fa6bd9c54adc900f5bf264727e7a7c0d37", + "sha256": "2c9cb831e23495341a51736efbfd144c71ae76cd1e9219fdc2078d70cdbc0407", "type": "eql", - "version": 208 + "version": 209 + }, + "2ddc468e-b39b-4f5b-9825-f3dcb0e998ea": { + "min_stack_version": "8.3", + "rule_name": "Potential SSH-IT SSH Worm Downloaded", + "sha256": "2235a3c31df521f4cbbff7cf12df793eb343d389777cc8851c382a1434bef647", + "type": "eql", + "version": 1 }, "2de10e77-c144-4e69-afb7-344e7127abd0": { "min_stack_version": "8.3", @@ -1452,9 +1623,9 @@ "2e29e96a-b67c-455a-afe4-de6183431d0d": { "min_stack_version": "8.3", "rule_name": "Potential Process Injection via PowerShell", - "sha256": "58530124be115763c6110e3c32f34e5fc8c70fa063e74e97252e3dcccc45a1f0", + "sha256": "3921a45db23fa07aa23f52a05c6cc6645307b5795c62c52f1ab0e7119b93182b", "type": "query", - "version": 107 + "version": 108 }, "2e311539-cd88-4a85-a301-04f38795007c": { "min_stack_version": "8.3", @@ -1466,9 +1637,9 @@ "2e580225-2a58-48ef-938b-572933be06fe": { "min_stack_version": "8.3", "rule_name": "Halfbaked Command and Control Beacon", - "sha256": "e19b7c3823c6e134dd116b5b1562e846ca9d4d847a6e25da14c421165a39d028", + "sha256": "67f17bb4543d663bbd223adf3ed78c7e8f5018d561d5600b0b835ed24d9a6174", "type": "query", - "version": 103 + "version": 104 }, "2edc8076-291e-41e9-81e4-e3fcbc97ae5e": { "min_stack_version": "8.3", @@ -1487,30 +1658,30 @@ "2f2f4939-0b34-40c2-a0a3-844eb7889f43": { "min_stack_version": "8.3", "rule_name": "PowerShell Suspicious Script with Audio Capture Capabilities", - "sha256": "ec46e116c1fd77711b1cc1c49189cb9495b50a6d18e577cd1d5214de5233c641", + "sha256": "65b15ece2e91066379c4bf4c8646bde0a3f995c713d228332c5ef3af665e3c0d", "type": "query", - "version": 107 + "version": 108 }, "2f8a1226-5720-437d-9c20-e0029deb6194": { "min_stack_version": "8.3", "rule_name": "Attempt to Disable Syslog Service", - "sha256": "2a77643c47329e2c910e5c86d8c3b2f0cf2b93527ad5bc129d7e614c07ba6369", + "sha256": "bdea522d5730e3c4d4239717173a709ebc5ff118296edbcb70faeb3e62cdcc0d", "type": "eql", - "version": 106 + "version": 107 }, "2fba96c0-ade5-4bce-b92f-a5df2509da3f": { "min_stack_version": "8.3", "rule_name": "Startup Folder Persistence via Unsigned Process", - "sha256": "2164ee6d1c3cd39e214f6c965e6cbd0a1dd158e51dd0d883fe83d6915d5f4621", + "sha256": "c77de421e7a60ec97356465d4a834fc49fed6b0b7ae28debbac3786b07459d62", "type": "eql", - "version": 107 + "version": 108 }, "2ffa1f1e-b6db-47fa-994b-1512743847eb": { "min_stack_version": "8.3", "rule_name": "Windows Defender Disabled via Registry Modification", - "sha256": "414eb4b19b8f79b0c86119bc090d5a342e45837af770df8d3365d3ab81bf5036", + "sha256": "1e95c5544b74d84ae96e15fafa7f0ffb9e564fa1552c02adbdf2d0bb9e68e7a3", "type": "eql", - "version": 106 + "version": 107 }, "301571f3-b316-4969-8dd0-7917410030d3": { "min_stack_version": "8.9", @@ -1529,9 +1700,9 @@ "30bfddd7-2954-4c9d-bbc6-19a99ca47e23": { "min_stack_version": "8.5", "rule_name": "ESXI Timestomping using Touch Command", - "sha256": "9375d07c27d373fae95ace527be0d4a8117abd263b43adfb31536459bda562a9", + "sha256": "7f96205f8ffdfb7be7c57a34dbdf149f99a13961e1477d17815ad48f85b7bdc0", "type": "eql", - "version": 3 + "version": 4 }, "3115bd2c-0baa-4df0-80ea-45e474b5ef93": { "min_stack_version": "8.3", @@ -1543,16 +1714,16 @@ "31295df3-277b-4c56-a1fb-84e31b4222a9": { "min_stack_version": "8.3", "rule_name": "Inbound Connection to an Unsecure Elasticsearch Node", - "sha256": "d7b2ec2f04b54fbd827d684086503c9240c5b500bb50c7ba12525842e88890d1", + "sha256": "7aca9860d8b4e2d6a3c826f3c89aad15a3ccef60bdb18f3a6c0e5d9d5eb96446", "type": "query", - "version": 103 + "version": 104 }, "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62": { "min_stack_version": "8.3", "rule_name": "Bypass UAC via Event Viewer", - "sha256": "c52ce2472b85ca6486fe8ffef36ba98c35db8cd02a58a3e00cbdfbe6448fa7e7", + "sha256": "2ca2ed5d2836beb7bbbfd48b039b171774baba1b8995a88ab16943fbbb170fa9", "type": "eql", - "version": 107 + "version": 108 }, "3202e172-01b1-4738-a932-d024c514ba72": { "min_stack_version": "8.3", @@ -1585,23 +1756,32 @@ "32f4675e-6c49-4ace-80f9-97c9259dca2e": { "min_stack_version": "8.3", "rule_name": "Suspicious MS Outlook Child Process", - "sha256": "bfcb1a92ded4fab88e6d4e463b78405b82e80e00b2b0e1260ba1ff8164ac01dd", + "sha256": "dfea65085c4b690895eb691760b4a9025da59cecbf5c4ff242c26713ede0bb2c", "type": "eql", - "version": 106 + "version": 107 }, "333de828-8190-4cf5-8d7c-7575846f6fe0": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS IAM User Addition to Group", + "sha256": "02db7a25c54c4fbd473ce6ca4a124bfeaba29b63ff68e2d89d4cd27167d6ae7d", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS IAM User Addition to Group", "sha256": "e6dc79527703135b1ce027a5d88baa39dd4c3512d0a5f56a036b8a27eab4ee81", "type": "query", - "version": 107 + "version": 208 }, "33a6752b-da5e-45f8-b13a-5f094c09522f": { "min_stack_version": "8.5", "rule_name": "ESXI Discovery via Find", - "sha256": "9d95402d5a02b1571ef1d3e5ad966c19fd3cbeff7b5fa58198ac9151e1923ba0", + "sha256": "f71d1a0fc2a3a9498c1c07bb8d19631c82ed04d6216b650b39cf5c767ccd0ea4", "type": "eql", - "version": 3 + "version": 4 }, "33f306e8-417c-411b-965c-c2812d6d3f4d": { "min_stack_version": "8.3", @@ -1641,9 +1821,16 @@ "3535c8bb-3bd5-40f4-ae32-b7cd589d5372": { "min_stack_version": "8.3", "rule_name": "Port Forwarding Rule Addition", - "sha256": "83831c2c3a4be02d59440da6f570b9d7e7064ecf5fa6df5565f36e68b68cd2ce", + "sha256": "2ec830c30a80eba9d2bfb5dc78d0ce64e7eb8f66ea2f8266e666d077fa916852", "type": "eql", - "version": 106 + "version": 107 + }, + "35a3b253-eea8-46f0-abd3-68bdd47e6e3d": { + "min_stack_version": "8.9", + "rule_name": "Spike in Bytes Sent to an External Device", + "sha256": "a8debadb004c9ca04fb7f3321cd45dc0ad8f93d6437be72cbbc5d09b84382fd1", + "type": "machine_learning", + "version": 1 }, "35df0dd8-092d-4a83-88c1-5151a804f31b": { "min_stack_version": "8.3", @@ -1668,16 +1855,16 @@ "3688577a-d196-11ec-90b0-f661ea17fbce": { "min_stack_version": "8.3", "rule_name": "Process Started from Process ID (PID) File", - "sha256": "b4e738c5be1bba9711b183dd54a22a8c10aec54e4a5310352cc7ac4ad24b9af1", + "sha256": "cafe78e9310f27ba8cdcfb8fbc318a1a2f55223679ea3d91c3a0877dd578b7d3", "type": "eql", - "version": 106 + "version": 107 }, "36a8e048-d888-4f61-a8b9-0f9e2e40f317": { "min_stack_version": "8.3", "rule_name": "Suspicious ImagePath Service Creation", - "sha256": "2684dc4258fdff2568772c371afcba2729e543adeac05d5e8fbad36f45417fec", + "sha256": "dabff5221c0b2f406165374af490dcdb04a568295196b805962ea4b2e88e734e", "type": "eql", - "version": 104 + "version": 105 }, "36c48a0c-c63a-4cbc-aee1-8cac87db31a9": { "min_stack_version": "8.9", @@ -1689,16 +1876,25 @@ "3728c08d-9b70-456b-b6b8-007c7d246128": { "min_stack_version": "8.3", "rule_name": "Potential Suspicious File Edit", - "sha256": "46076a578186ec461ee06fdb94def49ec0f94300cea3bd8364ebfc75895b65ae", + "sha256": "0f9b9c003bc39253a948a9da6d7c5b5263d9d1dc3c73abf730550e6c0c3ff687", "type": "eql", - "version": 2 + "version": 3 }, "378f9024-8a0c-46a5-aa08-ce147ac73a4e": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Security Group Creation", + "sha256": "5b75c7ff3b23af486b2a98aa509dba99b6e5935a1884bcf20ce26298c87a413a", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Security Group Creation", "sha256": "6ed9dc7097e846293dbf822a322406b46fcbd9d6642245a4dfbc73aabd62537b", "type": "query", - "version": 104 + "version": 205 }, "37994bca-0611-4500-ab67-5588afe73b77": { "min_stack_version": "8.3", @@ -1714,11 +1910,20 @@ "version": 100 }, "37b211e8-4e2f-440f-86d8-06cc8f158cfa": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS Execution via System Manager", + "sha256": "2cbc10f8cfc4b487c2e60d03f65c07f3edfffcc2aff4715f233e6dc5d5164c60", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS Execution via System Manager", "sha256": "f01c87073629652bd0f1abe3f300881145bb533a262308717ffcc0bab17a3dd0", "type": "query", - "version": 107 + "version": 208 }, "37f638ea-909d-4f94-9248-edd21e4a9906": { "min_stack_version": "8.3", @@ -1728,11 +1933,20 @@ "version": 104 }, "3805c3dc-f82c-4f8d-891e-63c24d3102b0": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Attempted Bypass of Okta MFA", + "sha256": "f4d46f02451d1b387f81c66eaf2bac499ae2b55dab8b5ff072060d572c17bae2", + "type": "query", + "version": 107 + } + }, "rule_name": "Attempted Bypass of Okta MFA", "sha256": "6873fd08617e0efde5dccf424aacbfe7057877288810c2ed68293f795964241b", "type": "query", - "version": 106 + "version": 207 }, "3838e0e3-1850-4850-a411-2e8c5ba40ba8": { "min_stack_version": "8.3", @@ -1763,11 +1977,20 @@ "version": 2 }, "39144f38-5284-4f8e-a2ae-e3fd628d90b0": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EC2 Network Access Control List Creation", + "sha256": "dea5a5643f79a683de4d055fc1e7c3f2444af041cad46e962eea1d3f5f8310d4", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EC2 Network Access Control List Creation", "sha256": "ad7864116d4d41fba90af76f8325d2a86358ed55b0b9be7204d8983cc62b2614", "type": "query", - "version": 104 + "version": 205 }, "39157d52-4035-44a8-9d1a-6f8c5f580a07": { "min_stack_version": "8.3", @@ -1786,9 +2009,9 @@ "3a59fc81-99d3-47ea-8cd6-d48d561fca20": { "min_stack_version": "8.3", "rule_name": "Potential DNS Tunneling via NsLookup", - "sha256": "fd0213ea9905c71a65f94da36a92164a378cd8232856a0ac441ae9f7d49fb108", + "sha256": "fb96d295d12b3d405dc93ad509f792885c4e32bb760c7518b005755a6ad6acb4", "type": "threshold", - "version": 106 + "version": 107 }, "3a6001a0-0939-4bbe-86f4-47d8faeb7b97": { "min_stack_version": "8.3", @@ -1834,9 +2057,9 @@ "3bc6deaa-fbd4-433a-ae21-3e892f95624f": { "min_stack_version": "8.3", "rule_name": "NTDS or SAM Database File Copied", - "sha256": "cd3c9afd05e54eb93da83e2d90065582aaad08ee77a94fae48f952f89c46e626", + "sha256": "691edf20cc218616ece6013dbbfe102d01c87c91cfd3bd49ea126eb3830c5982", "type": "eql", - "version": 106 + "version": 107 }, "3c7e32e6-6104-46d9-a06e-da0f8b5795a0": { "min_stack_version": "8.3", @@ -1853,11 +2076,20 @@ "version": 2 }, "3e002465-876f-4f04-b016-84ef48ce7e5d": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS CloudTrail Log Updated", + "sha256": "c544d2bed3c1f0c3eb62422883fdd5c1a029d8a1e4ade88af0b3aaaa0955dc99", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS CloudTrail Log Updated", "sha256": "889bfc3e221a4919949c2b2fab1b12ee9a96a75c27e1e249c243318f7bd81063", "type": "query", - "version": 107 + "version": 208 }, "3e0561b5-3fac-4461-84cc-19163b9aaa61": { "min_stack_version": "8.9", @@ -1880,6 +2112,13 @@ "type": "eql", "version": 104 }, + "3e441bdb-596c-44fd-8628-2cfdf4516ada": { + "min_stack_version": "8.3", + "rule_name": "Potential Remote File Execution via MSIEXEC", + "sha256": "1d20b245f40477327dbf43e563d8a93eca7531b9c1fa4649a0e9692d0eb33b01", + "type": "eql", + "version": 1 + }, "3ecbdc9e-e4f2-43fa-8cca-63802125e582": { "min_stack_version": "8.3", "rule_name": "Privilege Escalation via Named Pipe Impersonation", @@ -1920,16 +2159,16 @@ "3f12325a-4cc6-410b-8d4c-9fbbeb744cfd": { "min_stack_version": "8.3", "rule_name": "Potential Protocol Tunneling via Chisel Client", - "sha256": "337011e93c02efa090b9a19745d82c3d58fd18bee555ff69edaff5e9ff1466b7", + "sha256": "2bc6f32144a2b110dfc14493dc5930b3aa2c23ca7d00b46924c2643ac2d73c45", "type": "eql", - "version": 1 + "version": 2 }, "3f3f9fe2-d095-11ec-95dc-f661ea17fbce": { "min_stack_version": "8.3", "rule_name": "Binary Executed from Shared Memory Directory", - "sha256": "b3aad2bca92e5e1acd788cfd14d9606aa4b803a48bf303ad37e210739fec9d24", + "sha256": "511ca509d7faf58b68373d12932edd1aef607c53de1314647b3764b976fb35fe", "type": "eql", - "version": 106 + "version": 107 }, "3f4d7734-2151-4481-b394-09d7c6c91f75": { "min_stack_version": "8.3", @@ -1945,19 +2184,42 @@ "type": "machine_learning", "version": 1 }, + "40155ee4-1e6a-4e4d-a63b-e8ba16980cfb": { + "min_stack_version": "8.9", + "rule_name": "Unusual Process Spawned by a User", + "sha256": "76ae6142111e83c98205115ae9df5b7be5f1c79187429dbf5dba2f51c0cdb4d6", + "type": "machine_learning", + "version": 1 + }, "403ef0d3-8259-40c9-a5b6-d48354712e49": { "min_stack_version": "8.3", "rule_name": "Unusual Persistence via Services Registry", - "sha256": "5bb822cc67b9581124c21c5f4abb213946ce935b1c3f3ca248d1c2fcd9ce54e6", + "sha256": "0f9c30762b9d866395af98426eb9a784abbf168110167161bb7302fc4402a8dc", "type": "eql", - "version": 104 + "version": 105 }, "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 102, + "rule_name": "Suspicious Modprobe File Event", + "sha256": "db18497df8258d667278d17da2d21dadbc1c81dedbd75ddcbb22e91e172a8c1c", + "type": "eql", + "version": 3 + } + }, "rule_name": "Suspicious Modprobe File Event", - "sha256": "db18497df8258d667278d17da2d21dadbc1c81dedbd75ddcbb22e91e172a8c1c", + "sha256": "c6ccd9c0ba411da8142f15ca71dd04dca27e1ec82b527324439621b449f4812d", + "type": "new_terms", + "version": 103 + }, + "41284ba3-ed1a-4598-bfba-a97f75d9aba2": { + "min_stack_version": "8.3", + "rule_name": "Unix Socket Connection", + "sha256": "38561d8ce173227b49b1459ae11d38bfba76385fa68298e1ddb7b8603d57a8b6", "type": "eql", - "version": 3 + "version": 1 }, "416697ae-e468-4093-a93d-59661fa619ec": { "min_stack_version": "8.3", @@ -1988,11 +2250,20 @@ "version": 2 }, "42bf698b-4738-445b-8231-c834ddefd8a0": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Okta Brute Force or Password Spraying Attack", + "sha256": "9ecdb590d2df1959b2b11908911f24308925c345cce10b0370721afd09a2196e", + "type": "threshold", + "version": 107 + } + }, "rule_name": "Okta Brute Force or Password Spraying Attack", "sha256": "60954a70897438ce1627fe0aab388688a6c189b04e7eca5543e0c450283c029b", "type": "threshold", - "version": 106 + "version": 207 }, "42eeee3d-947f-46d3-a14d-7036b962c266": { "min_stack_version": "8.3", @@ -2018,9 +2289,9 @@ "43d6ec12-2b1c-47b5-8f35-e9de65551d3b": { "min_stack_version": "8.3", "rule_name": "Linux User Added to Privileged Group", - "sha256": "a48dc7ec63791f8c62b58bfbca37d6765b39621454d2720ac839e13758d02adb", + "sha256": "3730f04f7a829d9ca0f149c00ebd1c6cd07226bad5915f6295d82656e40bf5f8", "type": "eql", - "version": 3 + "version": 4 }, "440e2db4-bc7f-4c96-a068-65b78da59bde": { "min_stack_version": "8.3", @@ -2039,9 +2310,9 @@ "4494c14f-5ff8-4ed2-8e99-bf816a1642fc": { "min_stack_version": "8.3", "rule_name": "Potential Masquerading as VLC DLL", - "sha256": "d3d1985a8512a777f4738794f03380c077f3c84594acd1aefdf22211a59bfba8", + "sha256": "ed65c5d1379b83e560f4fa24ff1f51887de783c7e8f3fc329b717a14700a859c", "type": "eql", - "version": 1 + "version": 2 }, "44fc462c-1159-4fa8-b1b7-9b6296ab4f96": { "min_stack_version": "8.3", @@ -2067,23 +2338,23 @@ "45d273fb-1dca-457d-9855-bcb302180c21": { "min_stack_version": "8.3", "rule_name": "Encrypting Files with WinRar or 7z", - "sha256": "a8e0ecc0284175dcd1f57756fc03477d87d4fecfee80397c01f1490f52ed9b66", + "sha256": "576f44e57f57bcc5a260380c704c2c253b9f8fcefa472e5b4339b0e138c9112b", "type": "eql", - "version": 107 + "version": 108 }, "4630d948-40d4-4cef-ac69-4002e29bc3db": { "min_stack_version": "8.3", "rule_name": "Adding Hidden File Attribute via Attrib", - "sha256": "99fb4c9799becbcb9eaf99a6b9a8c21d74415d2a27790c5e52798590df285c07", + "sha256": "5b1155c651c8cba197b8525501a76da112e7941889fa0a8b5b0e27caf1105deb", "type": "eql", - "version": 108 + "version": 109 }, "4682fd2c-cfae-47ed-a543-9bed37657aa6": { "min_stack_version": "8.3", "rule_name": "Potential Local NTLM Relay via HTTP", - "sha256": "3df00646c1daf36bfe94ebc4e75150121576981877aeb3d5d6c17fc11bb6fb2b", + "sha256": "990b886b92cb87798246a158ca46bf1b61eb1ac09d2e34d3744dee85300efb72", "type": "eql", - "version": 106 + "version": 107 }, "46f804f5-b289-43d6-a881-9387cf594f75": { "min_stack_version": "8.3", @@ -2095,9 +2366,9 @@ "474fd20e-14cc-49c5-8160-d9ab4ba16c8b": { "min_stack_version": "8.6", "rule_name": "Potential Persistence Through init.d Detected", - "sha256": "ec686d5f69b96d1fefa61938439b2be36a7d62b6ec9a5277294454b9d21f090c", + "sha256": "c231805a854c98302dcc5c774688217904e4960a000e193bb04158fac9a0b743", "type": "new_terms", - "version": 5 + "version": 6 }, "475b42f0-61fb-4ef0-8a85-597458bfb0a1": { "min_stack_version": "8.8", @@ -2109,9 +2380,9 @@ "47e22836-4a16-4b35-beee-98f6c4ee9bf2": { "min_stack_version": "8.3", "rule_name": "Suspicious Remote Registry Access via SeBackupPrivilege", - "sha256": "5c400174c733b48a59cb568595f1b992705473fc85698c48a5006a770c99ddb6", + "sha256": "264b7c418b25b248ad38bc172ac651d639a720a652fba044e02596419b889ef5", "type": "eql", - "version": 107 + "version": 108 }, "47f09343-8d1f-4bb5-8bb0-00c9d18f5010": { "rule_name": "Execution via Regsvcs/Regasm", @@ -2129,9 +2400,9 @@ "483c4daf-b0c6-49e0-adf3-0bfa93231d6b": { "min_stack_version": "8.3", "rule_name": "Microsoft Exchange Server UM Spawning Suspicious Processes", - "sha256": "bbe5ae3b8a285ccb4c26e9a210d268966a5996803f54073b159507458f48ee7b", + "sha256": "99db297efd0e9e1c456c8eaddae105366196554aa82301813ee7a4aba19911cd", "type": "eql", - "version": 104 + "version": 105 }, "48819484-9826-4083-9eba-1da74cd0eaf2": { "min_stack_version": "8.6", @@ -2143,9 +2414,9 @@ "48b3d2e3-f4e8-41e6-95e6-9b2091228db3": { "min_stack_version": "8.3", "rule_name": "Potential Reverse Shell", - "sha256": "f29f06799ee7b6289d2ba8ffcd4908551efa144016a33e8eaa47b94f2370da97", + "sha256": "b10222772b435ef7d9cf4dfa4b50a492a7900cc176fdf11e901159c69d62d2b8", "type": "eql", - "version": 4 + "version": 5 }, "48b6edfc-079d-4907-b43c-baffa243270d": { "min_stack_version": "8.3", @@ -2168,6 +2439,13 @@ "type": "query", "version": 104 }, + "48f657ee-de4f-477c-aa99-ed88ee7af97a": { + "min_stack_version": "8.3", + "rule_name": "Remote XSL Script Execution via COM", + "sha256": "19961cd9171e3ef5204e98314fdf573ac68e28c6ab1c5e91b5f1d71c919ea7db", + "type": "eql", + "version": 1 + }, "493834ca-f861-414c-8602-150d5505b777": { "min_stack_version": "8.3", "rule_name": "Agent Spoofing - Multiple Hosts Using Same Agent", @@ -2178,9 +2456,9 @@ "494ebba4-ecb7-4be4-8c6f-654c686549ad": { "min_stack_version": "8.3", "rule_name": "Potential Linux Backdoor User Account Creation", - "sha256": "eb9cf2a2df73743755d82c3d776ba2ffd7f17ef1773d32e3def0fb2fd6c50988", + "sha256": "333fc1776029a4e23f0c6df62d3370c335760abb4aa501be982831e2e71341d7", "type": "eql", - "version": 3 + "version": 4 }, "495e5f2e-2480-11ed-bea8-f661ea17fbce": { "min_stack_version": "8.4", @@ -2215,16 +2493,16 @@ "4a4e23cf-78a2-449c-bac3-701924c269d3": { "min_stack_version": "8.3", "rule_name": "Possible FIN7 DGA Command and Control Behavior", - "sha256": "fb2b93218641d75dfdcf31527ed8c4baa8ab8d79de140128a054b9a7eb67aac0", + "sha256": "599489e4a0c4b02a7717d928a5881b6281d1362970adb1074d5362a33c45444b", "type": "query", - "version": 103 + "version": 104 }, "4a99ac6f-9a54-4ba5-a64f-6eb65695841b": { "min_stack_version": "8.3", "rule_name": "Potential Unauthorized Access via Wildcard Injection Detected", - "sha256": "8a3258a1db6d86b53f94205b24cc30b455508da7981acdcec7d44df34131b612", + "sha256": "42573412f6b2d0083dfd8c9fc5945f654cc818d4cea60939076a6cf5967a2b7d", "type": "eql", - "version": 2 + "version": 3 }, "4aa58ac6-4dc0-4d18-b713-f58bf8bd015c": { "min_stack_version": "8.3", @@ -2235,10 +2513,10 @@ }, "4b1a807a-4e7b-414e-8cea-24bf580f6fc5": { "min_stack_version": "8.3", - "rule_name": "Potential Reverse Shell via Suspicious Parent Process", - "sha256": "92665fcb5d7f54bd4531c913e33b9cd692aa92cf5ee65941d69c6c2a0aa5c260", + "rule_name": "Deprecated - Potential Reverse Shell via Suspicious Parent Process", + "sha256": "c71a551642317ffccfbd85c414cc689e14d3a2deea09251aa8ac9895963bb204", "type": "eql", - "version": 4 + "version": 5 }, "4b438734-3793-4fda-bd42-ceeada0be8f9": { "min_stack_version": "8.3", @@ -2261,6 +2539,13 @@ "type": "eql", "version": 1 }, + "4b95ecea-7225-4690-9938-2a2c0bad9c99": { + "min_stack_version": "8.9", + "rule_name": "Unusual Process Writing Data to an External Device", + "sha256": "89378fe5870a5d6d2e956d464c722bdba8845495639f22082cb218dfe9c4fbf0", + "type": "machine_learning", + "version": 1 + }, "4bd1c1af-79d4-4d37-9efa-6e0240640242": { "min_stack_version": "8.3", "rule_name": "Unusual Process Execution Path - Alternate Data Stream", @@ -2271,23 +2556,32 @@ "4c59cff1-b78a-41b8-a9f1-4231984d1fb6": { "min_stack_version": "8.3", "rule_name": "PowerShell Share Enumeration Script", - "sha256": "c39e8202c6aa104cacdbd7f152f22e19bf2a5e6da299ab44464663d93c2175e1", + "sha256": "0ad222085b8d696dd4df1055275c7fc6989064286734182865e772fbd8aac3c9", "type": "query", - "version": 6 + "version": 7 }, "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957": { "min_stack_version": "8.3", "rule_name": "Kernel Load or Unload via Kexec Detected", - "sha256": "06f6564ca643c6532abb1cdaa5f7b63ff7967e301d6d4c7fb188471da4c03140", + "sha256": "d4da085e36a4b1a471325f7c34f050486db0b5900302611bfda3c2d85305028b", "type": "eql", - "version": 3 + "version": 4 }, "4d50a94f-2844-43fa-8395-6afbd5e1c5ef": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Management Console Brute Force of Root User Identity", + "sha256": "32d9ab18831ca9798b2304547daeb8258a6f8905a01a54c468b20409eee885f6", + "type": "threshold", + "version": 105 + } + }, "rule_name": "AWS Management Console Brute Force of Root User Identity", "sha256": "c7f85d799207c359e3f84f41c0473858bad893198ffa7f3d8327d153eb0b422c", "type": "threshold", - "version": 104 + "version": 205 }, "4da13d6e-904f-4636-81d8-6ab14b4e6ae9": { "min_stack_version": "8.3", @@ -2299,9 +2593,9 @@ "4de76544-f0e5-486a-8f84-eae0b6063cdc": { "min_stack_version": "8.3", "rule_name": "Disable Windows Event and Security Logs Using Built-in Tools", - "sha256": "2f90c20e27fe53e8d19581d66c3700d0e607aeca622f713dffbee083470bdbf7", + "sha256": "cdad95a52719987cf204d9063951cbe05b1e08a28f4d91b3cf8f5d5aa48800d2", "type": "eql", - "version": 107 + "version": 108 }, "4e85dc8a-3e41-40d8-bc28-91af7ac6cf60": { "min_stack_version": "8.3", @@ -2313,37 +2607,46 @@ "4ec47004-b34a-42e6-8003-376a123ea447": { "min_stack_version": "8.3", "rule_name": "Suspicious Process Spawned from MOTD Detected", - "sha256": "d6507cd42eb759b19bc5d612350f5fee646f38be4fe487ebc7121f70ac057de9", + "sha256": "ed16c35ba79c045b3ae6cd2406ac39e5ee143767a2f8ae4a0a8ac6fb738b16c3", "type": "eql", - "version": 5 + "version": 6 }, "4ed493fc-d637-4a36-80ff-ac84937e5461": { "min_stack_version": "8.3", "rule_name": "Execution via MSSQL xp_cmdshell Stored Procedure", - "sha256": "93581d9de1f2ecba9d10b0b90fc4802c633fdc525cef6b539c20da833098dbfc", + "sha256": "05f50e5500930fb6e8ed1646e88db67b24a1430eb1fb589bb9976dd052f0f44d", "type": "eql", - "version": 106 + "version": 107 }, "4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff": { "min_stack_version": "8.3", "rule_name": "Suspicious Script Object Execution", - "sha256": "3b2f5bb731e55d25192b6e44e2f8e2453784591f0b9be178867e26489f73a694", + "sha256": "41b132e87127770048e08a8d65fb63fd3180ee0d52ad69f666c0abe1ab20afd2", "type": "eql", - "version": 104 + "version": 105 }, "4edd3e1a-3aa0-499b-8147-4d2ea43b1613": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Unauthorized Access to an Okta Application", + "sha256": "8e3e57e9dbe9ec6a8cc4673f80020513ca5a4c120e4a9efb9f8acc7a646de4c8", + "type": "query", + "version": 106 + } + }, "rule_name": "Unauthorized Access to an Okta Application", "sha256": "6cf84f243e86183b9bc2efdc39aa92f7573c421593ce71f1ce90dd87daf5b2dd", "type": "query", - "version": 105 + "version": 206 }, "4fe9d835-40e1-452d-8230-17c147cafad8": { "min_stack_version": "8.3", "rule_name": "Execution via TSClient Mountpoint", - "sha256": "d133f690998687a3f65041994c005ecd901bab7ac5c3504f34a8f2ca04cadbf5", + "sha256": "1717dbef17fd0507846473218f580ffdf11e5ba35497e2beb391d506d75289dd", "type": "eql", - "version": 105 + "version": 106 }, "51176ed2-2d90-49f2-9f3d-17196428b169": { "min_stack_version": "8.3", @@ -2362,9 +2665,9 @@ "513f0ffd-b317-4b9c-9494-92ce861f22c7": { "min_stack_version": "8.3", "rule_name": "Registry Persistence via AppCert DLL", - "sha256": "b62558c73fd30587a1edeb6e1a36b61cf60b19070b994e570a3f4bd023f546cd", + "sha256": "d098bba4900b382c6cd742182baba85a01b2337fbd4ff36da2bc9fdf6b408b7c", "type": "eql", - "version": 104 + "version": 105 }, "514121ce-c7b6-474a-8237-68ff71672379": { "min_stack_version": "8.3", @@ -2383,30 +2686,46 @@ "51ce96fb-9e52-4dad-b0ba-99b54440fc9a": { "min_stack_version": "8.3", "rule_name": "Incoming DCOM Lateral Movement with MMC", - "sha256": "f944e30753df250f1d624c4c46ee0f5a60767d7d8ebc3d60af90ca77daab281d", + "sha256": "298d203a01db67a0653310a2665d704f81a97db74789cbe2fdf632ebe7574155", "type": "eql", - "version": 105 + "version": 106 }, "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0": { "min_stack_version": "8.3", "rule_name": "Potential Successful Linux RDP Brute Force Attack Detected", - "sha256": "da0f4a98171700a7be9bdcc51c7e387d476f86016c7d95dd1313f5d899c34fe3", + "sha256": "4111de70c21f8c5461da2f1b30720b9621c857bc8526b1d4e71bcc108b95c928", "type": "eql", - "version": 2 + "version": 3 }, "523116c0-d89d-4d7c-82c2-39e6845a78ef": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS GuardDuty Detector Deletion", + "sha256": "875d325d03aab871f3af655b2a4f09f60421b1863ada9a2e59e415560be70fa6", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS GuardDuty Detector Deletion", "sha256": "238e31f86ad8ffd8ec077358374a122a8c7bbee39ce994f761ad3441be820a9c", "type": "query", - "version": 104 + "version": 205 }, "52376a86-ee86-4967-97ae-1a05f55816f0": { "min_stack_version": "8.3", "rule_name": "Linux Restricted Shell Breakout via Linux Binary(s)", - "sha256": "b6f2ca3d5270df9abe50800ebae493a3d6b715de6b3caea02f86fcd29c4f3c7e", + "sha256": "0076c9eafb579f6fb93d35d66309a205f3d0912a8b7a302ea2e917e5e04dd2f8", "type": "eql", - "version": 109 + "version": 110 + }, + "5297b7f1-bccd-4611-93fa-ea342a01ff84": { + "min_stack_version": "8.3", + "rule_name": "Execution via Microsoft DotNet ClickOnce Host", + "sha256": "71ef45621a5ba89795ad23007d4a9f50038ad681e75b73c50d4f275e0cd848b7", + "type": "eql", + "version": 1 }, "52aaab7b-b51c-441a-89ce-4387b3aea886": { "min_stack_version": "8.3", @@ -2444,16 +2763,25 @@ "53617418-17b4-4e9c-8a2c-8deb8086ca4b": { "min_stack_version": "8.6", "rule_name": "Suspicious Network Activity to the Internet by Previously Unknown Executable", - "sha256": "7602af82bdc7fc4962b73c42451d8500e779a3338601f49ea49ea9398fa49613", + "sha256": "1fcaecb0c8b60fb9a393726f18411473957d935a9676d2e345121e3f07f5c200", "type": "new_terms", - "version": 3 + "version": 4 }, "536997f7-ae73-447d-a12d-bff1e8f5f0a0": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EFS File System or Mount Deleted", + "sha256": "dea68832916d128880a091971ddca7401be50c5a91b85315b44276c17c34b3a2", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EFS File System or Mount Deleted", "sha256": "28f9744c81cfffbf8417f66ee1911ac9da89e9e352c5db4f0af9d725cd73c907", "type": "query", - "version": 104 + "version": 205 }, "5370d4cd-2bb3-4d71-abf5-1e1d0ff5a2de": { "min_stack_version": "8.3", @@ -2465,16 +2793,16 @@ "53a26770-9cbd-40c5-8b57-61d01a325e14": { "min_stack_version": "8.3", "rule_name": "Suspicious PDF Reader Child Process", - "sha256": "0b1c1a7d64bb481a68482e3f0954ce0e55df7b26264d3e358b230b5670c80094", + "sha256": "ddf1b60a6118bc0c50833a0f13cf88f3838ebcc8f0f60d42ad91bad81b07634d", "type": "eql", - "version": 106 + "version": 107 }, "53dedd83-1be7-430f-8026-363256395c8b": { "min_stack_version": "8.3", "rule_name": "Binary Content Copy via Cmd.exe", - "sha256": "3ab2b049abaa1462ebed7b019dcd5da6957b5328c2ce7d2eb86b87e74a4ec28d", + "sha256": "8ece78d3d804106f87c006fdd8a027648880338a3a56c52e28a393d8f18aff40", "type": "eql", - "version": 1 + "version": 2 }, "54902e45-3467-49a4-8abc-529f2c8cfb80": { "min_stack_version": "8.3", @@ -2486,9 +2814,9 @@ "54a81f68-5f2a-421e-8eed-f888278bb712": { "min_stack_version": "8.3", "rule_name": "Exchange Mailbox Export via PowerShell", - "sha256": "4258789d2232d8488f2dfcc621c1793b94aa3eb5e24ddc697886a3854fa2e0cc", + "sha256": "b7e3322f384197eb6eef899fcd0dab3032f80e4707f62046e423fe51756f2e9a", "type": "query", - "version": 5 + "version": 6 }, "54c3d186-0461-4dc3-9b33-2dc5c7473936": { "min_stack_version": "8.3", @@ -2507,9 +2835,23 @@ "55d551c6-333b-4665-ab7e-5d14a59715ce": { "min_stack_version": "8.3", "rule_name": "PsExec Network Connection", - "sha256": "9dac69f62fd68c1763945debf1417db0fdb9384fc3200ddb80fad443bd7ed6fa", + "sha256": "ea9ce524558142eeb928e1288478f70877cf06e9b9344009845c85f0257329e7", "type": "eql", - "version": 106 + "version": 107 + }, + "55f07d1b-25bc-4a0f-aa0c-05323c1319d0": { + "min_stack_version": "8.3", + "rule_name": "Windows Installer with Suspicious Properties", + "sha256": "ef9f5b3f0202dcd4e752c19f9ee8c807b55c72c653b8e1fa0399b2a0408c8753", + "type": "eql", + "version": 1 + }, + "56004189-4e69-4a39-b4a9-195329d226e9": { + "min_stack_version": "8.9", + "rule_name": "Unusual Process Spawned by a Host", + "sha256": "79250afad59e7a34a28a1fc9474da4c16612e73c23032855389f019fa153add8", + "type": "machine_learning", + "version": 1 }, "56557cde-d923-4b88-adee-c61b3f3b5dc3": { "min_stack_version": "8.3", @@ -2558,9 +2900,9 @@ } }, "rule_name": "Execution of an Unsigned Service", - "sha256": "de385d99890c067206d3515ec1c99db389d34cf974afb8ad6478deaf0e14f592", + "sha256": "296152e8a3e1843df21e40fa6f6a05608b99b61ab06971ab80e9a3a35910b4fb", "type": "new_terms", - "version": 102 + "version": 103 }, "5700cb81-df44-46aa-a5d7-337798f53eb8": { "min_stack_version": "8.3", @@ -2593,23 +2935,23 @@ "57bccf1d-daf5-4e1a-9049-ff79b5254704": { "min_stack_version": "8.3", "rule_name": "File Staged in Root Folder of Recycle Bin", - "sha256": "a7e0bdbc40a12b3b58f7280e709f99363b6d9362d4c0c91bcd926dddeeb4f466", + "sha256": "88ae25fb6df6c66c976902e4f17c39a5af63c217bb4aa298e7f898b003fa484d", "type": "eql", - "version": 1 + "version": 2 }, "581add16-df76-42bb-af8e-c979bfb39a59": { "min_stack_version": "8.3", "rule_name": "Deleting Backup Catalogs with Wbadmin", - "sha256": "2d5a85f9eb6c5a5b43149530f52a4cdbf41fb37009ec5f4ea1d572b4a127ba99", + "sha256": "f0914d5ae89b3f5372c087cd0c5983df509da91941322047aaad22d445cfb577", "type": "eql", - "version": 106 + "version": 107 }, "58aa72ca-d968-4f34-b9f7-bea51d75eb50": { "min_stack_version": "8.3", "rule_name": "RDP Enabled via Registry", - "sha256": "52fb0f6d5a15c031eb4ebdbb0bf86a16bd94e0aa3d3d4b9c9adb3a7019c79cc8", + "sha256": "a599e437dfc14b51f8ce6559e5595673b50429581388655e03d7999961ec6cf6", "type": "eql", - "version": 107 + "version": 108 }, "58ac2aa5-6718-427c-a845-5f3ac5af00ba": { "min_stack_version": "8.3", @@ -2621,16 +2963,16 @@ "58bc134c-e8d2-4291-a552-b4b3e537c60b": { "min_stack_version": "8.3", "rule_name": "Potential Lateral Tool Transfer via SMB Share", - "sha256": "f0754341d4737d98a3c079a807fdf62a876b2b9e37eddce760a538f8e135a3fb", + "sha256": "a9ada00d22041e1fc97021dfb923cb62dfcafe5849324b04534f7c53a65903d4", "type": "eql", - "version": 106 + "version": 107 }, "58c6d58b-a0d3-412d-b3b8-0981a9400607": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via InstallerFileTakeOver", - "sha256": "1bba6c4e3e7130c507b6c959c9bf912171eb7a1f1cdcb69a6cf8bfd62e4ebdae", + "sha256": "04c918e4a5b742f9df828e957a708565731d36df760ffbf94a8dc6f331539f7b", "type": "eql", - "version": 107 + "version": 108 }, "5919988c-29e1-4908-83aa-1f087a838f63": { "min_stack_version": "8.3", @@ -2647,11 +2989,20 @@ "version": 102 }, "594e0cbf-86cc-45aa-9ff7-ff27db27d3ed": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "AWS CloudTrail Log Created", + "sha256": "0ebf115d87113f0fb8cfb856cf09dd40a7bc00703443d8f5dc149be5cf2d7a26", + "type": "query", + "version": 106 + } + }, "rule_name": "AWS CloudTrail Log Created", "sha256": "84221ea6d1d7084ea241331b852a80ca276abc757430ea68253a3add4daca7a4", "type": "query", - "version": 105 + "version": 206 }, "59756272-1998-4b8c-be14-e287035c4d10": { "min_stack_version": "8.3", @@ -2663,16 +3014,16 @@ "5a14d01d-7ac8-4545-914c-b687c2cf66b3": { "min_stack_version": "8.3", "rule_name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface", - "sha256": "8438243430e0b6983e01c039dfab3f7c01111a8f9939c207ef853108907a977a", + "sha256": "21be01742858a1db7d297c338482f5a580a441699ca10d99874c0c9e24f50499", "type": "eql", - "version": 105 + "version": 106 }, "5a3d5447-31c9-409a-aed1-72f9921594fd": { "min_stack_version": "8.3", "rule_name": "Potential Reverse Shell via Java", - "sha256": "64625792213f211d0d8a873101fb7b1569da37e5179bd5f201b2c1f3101de821", + "sha256": "78ec1a1157f2afe9c030908365e734669d12f566fd1992245244eb8def7d4314", "type": "eql", - "version": 3 + "version": 4 }, "5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc": { "min_stack_version": "8.3", @@ -2684,37 +3035,37 @@ "5aee924b-6ceb-4633-980e-1bde8cdb40c5": { "min_stack_version": "8.3", "rule_name": "Potential Secure File Deletion via SDelete Utility", - "sha256": "b13fb00b87c825ce3f05d65295a6b1a47fec6d46d5fe22058d8b8b164a678d0b", + "sha256": "b57b1fa14361058e949c21cc407ad8e502c41b901b2f7b5a575ffb1d9fb460bd", "type": "eql", - "version": 106 + "version": 107 }, "5b03c9fb-9945-4d2f-9568-fd690fee3fba": { "min_stack_version": "8.3", "rule_name": "Virtual Machine Fingerprinting", - "sha256": "2b30d95ee6d6e8bd0ff888cc6609d826560591c7ef3681b5ff74f49f7cc3c888", + "sha256": "cca11b1e320068fb951e6be8baba9a7f49cfef803b613bda1ccaea95922f3a00", "type": "query", - "version": 105 + "version": 106 }, "5b06a27f-ad72-4499-91db-0c69667bffa5": { "min_stack_version": "8.3", "rule_name": "SUID/SGUID Enumeration Detected", - "sha256": "1e8068d0ce5b93ac8598cc1cc3ce47385a0c99bb43ce15b27a514542fe4adb39", + "sha256": "484f49639b052fc38d358f83984230e1a524fdb9d60f221668f8fe55b7485c50", "type": "eql", - "version": 2 + "version": 3 }, "5b18eef4-842c-4b47-970f-f08d24004bde": { "min_stack_version": "8.3", "rule_name": "Suspicious which Enumeration", - "sha256": "918d3ee72f0aba9e0a382045c846e04f7dc5e1f942954c077aa639794e809917", + "sha256": "fc50e7f8c6f1d7485f6a164637556906c3e3711d037759cf0c017826a110f6f3", "type": "eql", - "version": 1 + "version": 2 }, "5b9eb30f-87d6-45f4-9289-2bf2024f0376": { "min_stack_version": "8.3", "rule_name": "Potential Masquerading as Browser Process", - "sha256": "2869df554ce679e32f42029716b74524aa21ea7af2872e5a42c55de5ceb7835c", + "sha256": "10846cbf0f6d148b7fc84a14a62f5bc1b44382eda5971d84a0747c8788c93721", "type": "eql", - "version": 1 + "version": 2 }, "5bb4a95d-5a08-48eb-80db-4c3a63ec78a8": { "min_stack_version": "8.3", @@ -2724,25 +3075,34 @@ "version": 104 }, "5beaebc1-cc13-4bfc-9949-776f9e0dc318": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS WAF Rule or Rule Group Deletion", + "sha256": "353bb55da009500a46a3701adb0b1bb680c718959d2e5969960085c211562f98", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS WAF Rule or Rule Group Deletion", "sha256": "333f27913815c1e4ec223cb266bc34cfadb31ac1a598d1fac7a8de01ac3abd9b", "type": "query", - "version": 104 + "version": 205 }, "5c6f4c58-b381-452a-8976-f1b1c6aa0def": { "min_stack_version": "8.4", "rule_name": "FirstTime Seen Account Performing DCSync", - "sha256": "3a1daa97831ddf8f5bfcf84698ec8b3deff467d7f1b8770467a760ef355c1a5b", + "sha256": "1021f7351d5cc378ded4585010e7ba4b057a05fab6f8e42157c6facf422bf6ec", "type": "new_terms", - "version": 6 + "version": 7 }, "5c895b4f-9133-4e68-9e23-59902175355c": { "min_stack_version": "8.6", "rule_name": "Potential Meterpreter Reverse Shell", - "sha256": "5941e6650b12bc02b03d289fa389b9f2347c53636e6368753bd5917b5a776cd5", + "sha256": "c29613a13876b018582e791f2843e3b12181e06c36266665efe4711c52945024", "type": "eql", - "version": 1 + "version": 2 }, "5c983105-4681-46c3-9890-0c66d05e776b": { "min_stack_version": "8.3", @@ -2754,16 +3114,16 @@ "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0": { "min_stack_version": "8.3", "rule_name": "Potential Defense Evasion via PRoot", - "sha256": "361a074bbb3fe56ec08c1430d5b5afc021f8502cb133c1066dd514bdacb37f06", + "sha256": "a4e1f03bf2a4863f8922d20b5ab31fc5fffea4c27e35c47e61634b492dba558e", "type": "eql", - "version": 3 + "version": 4 }, "5cd55388-a19c-47c7-8ec4-f41656c2fded": { "min_stack_version": "8.3", "rule_name": "Outbound Scheduled Task Activity via PowerShell", - "sha256": "e4796e4f5ba9178180960e592aae8dc79ef969e7b951f2c2fd73dae57d29406f", + "sha256": "c0fd1feebe4607a5b3db25454a63e6c46b64c43070cd6c6487fac57bfd65b53c", "type": "eql", - "version": 104 + "version": 105 }, "5cd8e1f7-0050-4afc-b2df-904e40b2f5ae": { "min_stack_version": "8.3", @@ -2775,9 +3135,9 @@ "5cf6397e-eb91-4f31-8951-9f0eaa755a31": { "min_stack_version": "8.3", "rule_name": "Persistence via PowerShell profile", - "sha256": "5ce8477d708b49d1d38136f4638bc5596e3190949b3e561ff84d56566ca96f61", + "sha256": "421c30d4787b7da4cf4496d67084325210732a4aa854db2cac54429840f044c7", "type": "eql", - "version": 5 + "version": 6 }, "5d0265bf-dea9-41a9-92ad-48a8dcd05080": { "min_stack_version": "8.3", @@ -2789,9 +3149,9 @@ "5d1d6907-0747-4d5d-9b24-e4a18853dc0a": { "min_stack_version": "8.3", "rule_name": "Suspicious Execution via Scheduled Task", - "sha256": "865a5c61d5bdf21e24120d3b8eb35f82a23286c618fc795dce353491987d04fa", + "sha256": "f99460b7128f713e96cead9f3d34cf8f19a3561e1e51d86f60ca99f765d7d93e", "type": "eql", - "version": 104 + "version": 105 }, "5d9f8cfc-0d03-443e-a167-2b0597ce0965": { "min_stack_version": "8.3", @@ -2860,9 +3220,9 @@ "61ac3638-40a3-44b2-855a-985636ca985e": { "min_stack_version": "8.3", "rule_name": "PowerShell Suspicious Discovery Related Windows API Functions", - "sha256": "a5b4ed432583abe86a630527b3026ee3a58f9813bb11868c628754ff414a3c7f", + "sha256": "123e32643dd7c3052f52ade724c9c93759749d28fdb592ffbdccec9ea688d1a2", "type": "query", - "version": 109 + "version": 110 }, "61c31c14-507f-4627-8c31-072556b89a9c": { "rule_name": "Mknod Process Activity", @@ -2873,9 +3233,9 @@ "61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7": { "min_stack_version": "8.3", "rule_name": "AdminSDHolder SDProp Exclusion Added", - "sha256": "71e064cd3cf1b8dec498d3e054d70ef2121113be1ed24c7e7df6af3b4324f27e", + "sha256": "ac85da0bd50146a9acd21f199d77bcce98ff857d768071bb894e26118b26a239", "type": "eql", - "version": 107 + "version": 108 }, "622ecb68-fa81-4601-90b5-f8cd661e4520": { "min_stack_version": "8.3", @@ -2922,9 +3282,9 @@ "63e65ec3-43b1-45b0-8f2d-45b34291dc44": { "min_stack_version": "8.3", "rule_name": "Network Connection via Signed Binary", - "sha256": "f383ad8f33cab31ab158968663de5ed3d540de9a4d8d0fa4a578e19a35ed061c", + "sha256": "e3f5d9f1f0b68b258714156bb2d6558011e846b2fad3ad178aae26c7c0f6c81e", "type": "eql", - "version": 105 + "version": 106 }, "647fc812-7996-4795-8869-9c4ea595fe88": { "min_stack_version": "8.3", @@ -2943,9 +3303,9 @@ "64cfca9e-0f6f-4048-8251-9ec56a055e9e": { "min_stack_version": "8.3", "rule_name": "Network Connection via Recently Compiled Executable", - "sha256": "60780f0b220f4de4cccb01815d9585964f3d68bd515b23972bc9b881a36a70ea", + "sha256": "b277d6162b8343013d1498f692467e7cec38348da2ba5058ed1fd1aebcc40eaf", "type": "eql", - "version": 1 + "version": 2 }, "6506c9fd-229e-4722-8f0f-69be759afd2a": { "rule_name": "Potential PrintNightmare Exploit Registry Modification", @@ -2979,9 +3339,9 @@ "6641a5af-fb7e-487a-adc4-9e6503365318": { "min_stack_version": "8.5", "rule_name": "Suspicious Termination of ESXI Process", - "sha256": "0711743a3e6d25d5ac8089b3f5e996420a92bc7890f358cb4e23c6d88ba9a615", + "sha256": "2d5c0856617f70f9ed2e5835c40dec8304a2290370c5414745c806fde457e583", "type": "eql", - "version": 3 + "version": 4 }, "665e7a4f-c58e-4fc6-bc83-87a7572670ac": { "min_stack_version": "8.3", @@ -2993,16 +3353,16 @@ "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d": { "min_stack_version": "8.3", "rule_name": "Potential Successful Linux FTP Brute Force Attack Detected", - "sha256": "5ee22642a55e0ff14c438cbc0f77b7746f9fe23b533621103b27df8a9b808d40", + "sha256": "de1f883c87b1b49ce0932b95dd0ebaabede9c5334b6f18e2222c3fc3a5628bec", "type": "eql", - "version": 2 + "version": 3 }, "66883649-f908-4a5b-a1e0-54090a1d3a32": { "min_stack_version": "8.3", "rule_name": "Connection to Commonly Abused Web Services", - "sha256": "5c79e5fd80163228473cfe5b3b9f61d769a063b5c1372c30928ab2ac59cf0525", + "sha256": "4c82661472cef610b0a6a24cb6654b4f11869bf4401d656eaa68c78289f66302", "type": "eql", - "version": 107 + "version": 108 }, "66c058f3-99f4-4d18-952b-43348f2577a0": { "min_stack_version": "8.3", @@ -3021,16 +3381,25 @@ "670b3b5a-35e5-42db-bd36-6c5b9b4b7313": { "min_stack_version": "8.3", "rule_name": "Modification of the msPKIAccountCredentials", - "sha256": "9546181bdfa5b6f04cab84f0ff7afdbbb59ef9ddeaf7ec7bd070a1808324473d", + "sha256": "086eafbc984aa6480575297071ab4771019ea9eda87148c85e6f2eb40f7674f0", "type": "query", - "version": 6 + "version": 7 }, "6731fbf2-8f28-49ed-9ab9-9a918ceb5a45": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Modify an Okta Policy", + "sha256": "bcc00051e5ab5b70c88a4b1559e4edcff319d79f2bbe5bfcab404a3d63457d63", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Modify an Okta Policy", "sha256": "0f0e1ba88bbda85d60bb8fc96bda554db238881ea16937d0f0fa5414a15e6ede", "type": "query", - "version": 105 + "version": 206 }, "675239ea-c1bc-4467-a6d3-b9e2cc7f676d": { "min_stack_version": "8.3", @@ -3040,11 +3409,20 @@ "version": 102 }, "676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Revoke Okta API Token", + "sha256": "f58a59fe0d9f317a1998e97634f691d5f4b4b0dc6b79fc874df5f7b9185a9f93", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Revoke Okta API Token", "sha256": "e8e7b2e174c70d5a4a851a47b90138516f2a3c440e275c037a6f1334759c87de", "type": "query", - "version": 105 + "version": 206 }, "67a9beba-830d-4035-bfe8-40b7e28f8ac4": { "rule_name": "SMTP to the Internet", @@ -3055,9 +3433,9 @@ "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b": { "min_stack_version": "8.3", "rule_name": "High Number of Process Terminations", - "sha256": "9654e394fb859d2bbad76596b99237d6f8d15e70526ea0e27711c4c3a680ae77", + "sha256": "21d744da94221fcbec162dddffe8794cefc8fd26321d770c472b47093b28a95a", "type": "threshold", - "version": 108 + "version": 109 }, "68113fdc-3105-4cdd-85bb-e643c416ef0b": { "rule_name": "Query Registry via reg.exe", @@ -3068,9 +3446,9 @@ "6839c821-011d-43bd-bd5b-acff00257226": { "min_stack_version": "8.3", "rule_name": "Image File Execution Options Injection", - "sha256": "97b4abe585f163bcdacc300075bf109cb501bbb7d1de90a2cdbbbdfbbd9aef97", + "sha256": "ad88e3a9101259f72a383196f9f474fb828e8dd2b844ef2d61caf9fb986c1028", "type": "eql", - "version": 104 + "version": 105 }, "684554fc-0777-47ce-8c9b-3d01f198d7f8": { "min_stack_version": "8.3", @@ -3080,18 +3458,27 @@ "version": 102 }, "6885d2ae-e008-4762-b98a-e8e1cd3a81e9": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Okta ThreatInsight Threat Suspected Promotion", + "sha256": "44208f997fe40e0ec5625789243073bee7f66e3d2be2ed117e69e6f9b6907a21", + "type": "query", + "version": 105 + } + }, "rule_name": "Okta ThreatInsight Threat Suspected Promotion", "sha256": "8d04de56ef8b8f97264ebf4f9614963e43b9106d543823fdccbce9b59a0011d8", "type": "query", - "version": 104 + "version": 205 }, "68921d85-d0dc-48b3-865f-43291ca2c4f2": { "min_stack_version": "8.3", "rule_name": "Persistence via TelemetryController Scheduled Task Hijack", - "sha256": "e56e2b209388ed0f70bed3114edcf6d49e83959d733faa801e3d40209152e327", + "sha256": "6223d04f4e618351c760d259ecbc3d42c8da22daf8a9bd58497228d13304bab4", "type": "eql", - "version": 105 + "version": 106 }, "68994a6c-c7ba-4e82-b476-26a26877adf6": { "min_stack_version": "8.4", @@ -3112,30 +3499,48 @@ "689b9d57-e4d5-4357-ad17-9c334609d79a": { "min_stack_version": "8.3", "rule_name": "Scheduled Task Created by a Windows Script", - "sha256": "46775980c978cd2264682497c62b9788b6645243da6b72ddaea5bbff0388df3e", + "sha256": "ebde0ba43ed054967c01f489cd5f2e45b9dddf79b90351dea7e78c5a5c2edfe6", "type": "eql", - "version": 104 + "version": 105 }, "68a7a5a5-a2fc-4a76-ba9f-26849de881b4": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS CloudWatch Log Group Deletion", + "sha256": "2e8fdc6b595399328a680fc066469a0edae5a41684f4190a837deaa8adf32ae4", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS CloudWatch Log Group Deletion", "sha256": "6c4325ced0b53d29535ee5afd746cd09fd120823f660b5bd3518ca50fadca146", "type": "query", - "version": 107 + "version": 208 }, "68d56fdc-7ffa-4419-8e95-81641bd6f845": { "min_stack_version": "8.3", "rule_name": "UAC Bypass via ICMLuaUtil Elevated COM Interface", - "sha256": "53f09e4c88d11c0ee66a186321981f9eb31165d73f02b874ca0edbed0844c6da", + "sha256": "0feac3bd75fcc2317ee0e9e91a7f2f35063c0c5a62b5c47076545998d3ac12ae", "type": "eql", - "version": 105 + "version": 106 }, "6951f15e-533c-4a60-8014-a3c3ab851a1b": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 104, + "rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion", + "sha256": "1bcb655a06d0561e1f4f6e9466d148178ddf1edc310aa5b738f246db479c1afd", + "type": "query", + "version": 5 + } + }, "rule_name": "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion", "sha256": "62a819dfff5aff4d9a71c1af4dbee137aa6d96683a906088769effac0fdbd8b1", "type": "query", - "version": 4 + "version": 105 }, "699e9fdb-b77c-4c01-995c-1c15019b9c43": { "min_stack_version": "8.5", @@ -3161,39 +3566,57 @@ "version": 106 }, "69c420e8-6c9e-4d28-86c0-8a2be2d1e78c": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS IAM Password Recovery Requested", + "sha256": "d16a1105cf83086a436f452d32fd1564076c4a7425498c922ca33cdcd2246c17", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS IAM Password Recovery Requested", "sha256": "31f084b4192870ca6c93d341a1f9e6d9eecaaefe046fcf6687209ec23866edf3", "type": "query", - "version": 104 + "version": 205 }, "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7": { "min_stack_version": "8.3", "rule_name": "Unusual Service Host Child Process - Childless Service", - "sha256": "f3cb8da67a3f69a296b53078b37707f55d6852f4c55b7bc074af6e3ab2a01d20", + "sha256": "d6efd876704aecbc61e32f00bc3fc87660de3486490102dee717f3cafeef34ee", "type": "eql", - "version": 105 + "version": 106 }, "6aace640-e631-4870-ba8e-5fdda09325db": { "min_stack_version": "8.3", "rule_name": "Exporting Exchange Mailbox via PowerShell", - "sha256": "a9f9aa8f746871dce91e94cba6697e908e9901be0135860b93572a5904b48b04", + "sha256": "2094e45cb6acf5514345f45de5980fa93856dbe2564c14cda824cfb92609fe9b", "type": "eql", - "version": 107 + "version": 108 }, "6ace94ba-f02c-4d55-9f53-87d99b6f9af4": { "min_stack_version": "8.3", "rule_name": "Suspicious Utility Launched via ProxyChains", - "sha256": "7541e1a6c4200e3961759f0cdadba8eaf793f6e3e9e28dbb34af84aeac5f6fce", + "sha256": "36f237a42a890a47fd41636119b3f4f6cb483699638fa0570dee4cc7ba1bdd6e", "type": "eql", - "version": 1 + "version": 2 }, "6b84d470-9036-4cc0-a27c-6d90bbfe81ab": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Sensitive Files Compression", + "sha256": "271c0de47099ee8a5e049d68bf4d49801b884b81f673df03edceab970daebe19", + "type": "query", + "version": 106 + } + }, "rule_name": "Sensitive Files Compression", - "sha256": "24dee3257162b876da6487b55368acb5b38040fd13ce5d0bc7511b0644e2ae48", - "type": "query", - "version": 105 + "sha256": "2665a4bfaf61af8a5033e6aff2ce6950c77fc795eb6bba42b6b5064e84fa8841", + "type": "new_terms", + "version": 206 }, "6bed021a-0afb-461c-acbe-ffdb9574d3f3": { "min_stack_version": "8.3", @@ -3212,9 +3635,9 @@ "6cd1779c-560f-4b68-a8f1-11009b27fe63": { "min_stack_version": "8.3", "rule_name": "Microsoft Exchange Server UM Writing Suspicious Files", - "sha256": "dfc2fbc0fab4f84b16f206bb71d59399a3450f5cec21c03daa1fd20d529ccdc9", + "sha256": "6c77473acf3dec0fc8fd9d0d2f4a0de620f5007008bf85e61fc224fa1087b63a", "type": "eql", - "version": 104 + "version": 105 }, "6d448b96-c922-4adb-b51c-b767f1ea5b76": { "min_stack_version": "8.3", @@ -3226,9 +3649,9 @@ "6d8685a1-94fa-4ef7-83de-59302e7c4ca8": { "min_stack_version": "8.6", "rule_name": "Potential Privilege Escalation via CVE-2023-4911", - "sha256": "cc466d496fd9e306e2a0e4ea3c56d690ff0737b1e3c1506daef475f41db91d6d", + "sha256": "0a052fad94510f59c9efd5ffec0901831516c7ea937d86e3532157035d86466a", "type": "eql", - "version": 1 + "version": 2 }, "6e1a2cc4-d260-11ed-8829-f661ea17fbcc": { "min_stack_version": "8.4", @@ -3247,9 +3670,9 @@ "6e9130a5-9be6-48e5-943a-9628bfc74b18": { "min_stack_version": "8.3", "rule_name": "AdminSDHolder Backdoor", - "sha256": "c6d5f04ccbfb426d106eb3b03f1f20727722e4632689aec4bc9fc11edb28bc83", + "sha256": "53f33d98ecca40d46328a7ff7593743ac0f62aefad6854a203355d59f240ece1", "type": "query", - "version": 105 + "version": 106 }, "6e9b351e-a531-4bdc-b73e-7034d6eed7ff": { "min_stack_version": "8.3", @@ -3261,16 +3684,16 @@ "6ea41894-66c3-4df7-ad6b-2c5074eb3df8": { "min_stack_version": "8.3", "rule_name": "Potential Windows Error Manager Masquerading", - "sha256": "b93d5773dd0b96dd6d8e331197414f59005cceea42ac2b114e9ace428ca9f578", + "sha256": "bd57722ccc74983106255532898917957a55fafd6c760af95a0650a7a93e5ef4", "type": "eql", - "version": 105 + "version": 106 }, "6ea55c81-e2ba-42f2-a134-bccf857ba922": { "min_stack_version": "8.3", "rule_name": "Security Software Discovery using WMIC", - "sha256": "b04895b23aa183e955eac132fe6354b74ae1aea8ce27da447add04c52d265774", + "sha256": "7400438cd326b5fa5137479c92eb2898c709c3338757a1f631cb718de551a551", "type": "eql", - "version": 107 + "version": 108 }, "6ea71ff0-9e95-475b-9506-2580d1ce6154": { "rule_name": "DNS Activity to the Internet", @@ -3281,9 +3704,9 @@ "6ee947e9-de7e-4281-a55d-09289bdf947e": { "min_stack_version": "8.3", "rule_name": "Potential Linux Tunneling and/or Port Forwarding", - "sha256": "9b7a1e7596fff4b6d70a4064cf79f606a74f214ef8aeb4234c08842d2c1b910f", + "sha256": "9a958c72f2b71c12da6147cd83e0d798c1e114b362bd577b27f0f921b0a13465", "type": "eql", - "version": 1 + "version": 2 }, "6f1500bc-62d7-4eb9-8601-7485e87da2f4": { "rule_name": "SSH (Secure Shell) to the Internet", @@ -3314,18 +3737,43 @@ "version": 100 }, "7024e2a0-315d-4334-bb1a-441c593e16ab": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS CloudTrail Log Deleted", + "sha256": "e4aa3aadf0d7e757977d5c02a31cae6d4ece731bc3478fec172e92a10c8f3ee1", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS CloudTrail Log Deleted", "sha256": "6eb194ad10e7ea8d3c8547593a150c60eda885a07be0a3dc57dab3dc0d993314", "type": "query", - "version": 107 + "version": 208 }, "7024e2a0-315d-4334-bb1a-552d604f27bc": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS Config Resource Deletion", + "sha256": "e3f3358d38d5992c002d140012811e59a1ff80898107891dfbb67758d36adfc0", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS Config Resource Deletion", "sha256": "16521ebadcb6ecd1ffe3b12756c604b96cf8b5daedd95eeec1e1fd2eef096dd9", "type": "query", - "version": 107 + "version": 208 + }, + "708c9d92-22a3-4fe0-b6b9-1f861c55502d": { + "min_stack_version": "8.3", + "rule_name": "Suspicious Execution via MSIEXEC", + "sha256": "934721c56a14fb6b1ea672f4cedb14eae9cdafb81a8e9bf35230f542a602740f", + "type": "eql", + "version": 1 }, "70d12c9c-0dbd-4a1a-bc44-1467502c9cf6": { "min_stack_version": "8.3", @@ -3349,11 +3797,20 @@ "version": 3 }, "717f82c2-7741-4f9b-85b8-d06aeb853f4f": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Modification of Dynamic Linker Preload Shared Object", + "sha256": "dc67793718c16d2d90d8be38bf310b0ce87c25f4e9c56a66f7a231b80d9922f0", + "type": "query", + "version": 107 + } + }, "rule_name": "Modification of Dynamic Linker Preload Shared Object", - "sha256": "565a3a934715161cb1c0bd792b9694d865ccf9df21072f0e5bd381c947ec3b65", - "type": "query", - "version": 106 + "sha256": "72fea82152115abc97ea9e34b7e9bf40be8d5af11313625404f62dfcf5ca61e1", + "type": "new_terms", + "version": 207 }, "71bccb61-e19b-452f-b104-79a60e546a95": { "min_stack_version": "8.3", @@ -3365,9 +3822,9 @@ "71c5cb27-eca5-4151-bb47-64bc3f883270": { "min_stack_version": "8.3", "rule_name": "Suspicious RDP ActiveX Client Loaded", - "sha256": "44d4d66dea85165137a0d3f86d314a56a2d3de07baedee209e53118864691402", + "sha256": "d442a3b1c1b313c54f0bad14de16f98cd68ae8ada5e87c99e8c29aabe78f2d7f", "type": "eql", - "version": 104 + "version": 105 }, "721999d0-7ab2-44bf-b328-6e63367b9b29": { "min_stack_version": "8.3", @@ -3377,11 +3834,20 @@ "version": 102 }, "729aa18d-06a6-41c7-b175-b65b739b1181": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Reset MFA Factors for an Okta User Account", + "sha256": "c60bc906d469f3485ac3f4e2694f2ad9335dd69d76776d4a7604221cdc4bd77c", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Reset MFA Factors for an Okta User Account", "sha256": "a26dbdf7534708e6c75311dac75a165cbb21ce2fedc44bffa5ebd8437ffe6354", "type": "query", - "version": 105 + "version": 206 }, "72d33577-f155-457d-aad3-379f9b750c97": { "rule_name": "Linux Restricted Shell Breakout via env Shell Evasion", @@ -3425,11 +3891,20 @@ "version": 103 }, "7592c127-89fb-4209-a8f6-f9944dfd7e02": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 102, + "rule_name": "Suspicious Sysctl File Event", + "sha256": "677db0e224b9e590ddaf2525bccc03fcd4c576f741537f13434eb9cecdd77bdc", + "type": "eql", + "version": 3 + } + }, "rule_name": "Suspicious Sysctl File Event", - "sha256": "677db0e224b9e590ddaf2525bccc03fcd4c576f741537f13434eb9cecdd77bdc", - "type": "eql", - "version": 3 + "sha256": "cdae4cce31893b3eb3b3a3472011e11708a7c9e1fcf4410bb88e18a099a94361", + "type": "new_terms", + "version": 103 }, "75dcb176-a575-4e33-a020-4a52aaa1b593": { "min_stack_version": "8.3", @@ -3471,16 +3946,16 @@ "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66": { "min_stack_version": "8.3", "rule_name": "Access to a Sensitive LDAP Attribute", - "sha256": "d9c6faf2209cb103e1548a470602851ee01bf04f32853d0ed66169fff27e6847", + "sha256": "d2e53030dc005a302f0b5bb530360d58ce429809a0ed1827bc6d5b89de8b351e", "type": "eql", - "version": 7 + "version": 8 }, "766d3f91-3f12-448c-b65f-20123e9e9e8c": { "min_stack_version": "8.3", "rule_name": "Creation of Hidden Shared Object File", - "sha256": "33f5cbe72ef839be364b1ccf59d5c1a66fbc6991676d75779148d8b4bc812310", + "sha256": "a3536eb13408e7fc538952bee75a1362e3be277b14f1edc18c2f63fda3f5f08c", "type": "eql", - "version": 106 + "version": 107 }, "76ddb638-abf7-42d5-be22-4a70b0bf7241": { "min_stack_version": "8.3", @@ -3492,16 +3967,16 @@ "76e4d92b-61c1-4a95-ab61-5fd94179a1ee": { "min_stack_version": "8.3", "rule_name": "Potential Reverse Shell via Suspicious Child Process", - "sha256": "22a26a54eac8e02ec72df44fdc261481315acec5885269f591cb5fd1c46d1825", + "sha256": "ee743b928b61e259c3e46fce5b16400121f6ef6affdc122ea1f47e9a199900ea", "type": "eql", - "version": 4 + "version": 5 }, "76fd43b7-3480-4dd9-8ad7-8bd36bfad92f": { "min_stack_version": "8.3", "rule_name": "Potential Remote Desktop Tunneling Detected", - "sha256": "9f85a8053c83ad71c8540a2261dbbc4708549c0de62c0edd99395ef16629cc9f", + "sha256": "df53ce37b5877a6a26f2e5b7d78d60000048e5eaaa3d152f9ead7ef84d700a19", "type": "eql", - "version": 106 + "version": 107 }, "770e0c4d-b998-41e5-a62e-c7901fd7f470": { "min_stack_version": "8.3", @@ -3527,9 +4002,9 @@ "781f8746-2180-4691-890c-4c96d11ca91d": { "min_stack_version": "8.3", "rule_name": "Potential Network Sweep Detected", - "sha256": "806ccc4e0580c650a06132653d58575846b22fd3cc308288981b794a63972905", + "sha256": "e8646ede4715b107643a3098b6e032965f664c38e7341d9d0519b3a8510d2fab", "type": "threshold", - "version": 3 + "version": 4 }, "785a404b-75aa-4ffd-8be5-3334a5a544dd": { "min_stack_version": "8.4", @@ -3555,18 +4030,27 @@ "version": 105 }, "78d3d8d9-b476-451d-a9e0-7a5addd70670": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Spike in AWS Error Messages", + "sha256": "333cdaf4a1706f9d4a7935d233bb7a28147712b8edf36e3500c61433a2cbee57", + "type": "machine_learning", + "version": 108 + } + }, "rule_name": "Spike in AWS Error Messages", "sha256": "b9c3990fedf14024b1c9c83464350edfd9ebd517c53d2aacebbb3a848d9740f2", "type": "machine_learning", - "version": 107 + "version": 208 }, "78ef0c95-9dc2-40ac-a8da-5deb6293a14e": { "min_stack_version": "8.4", "rule_name": "Unsigned DLL Loaded by Svchost", - "sha256": "7b5df51876d17dc0c0978937514b88e32fbb68a471fdbfb5063af60dff04d178", + "sha256": "11fb3b45a1ccc2f104c91997fb4d7093f0efd5534a8f2048aa90ef37cc11f6cd", "type": "eql", - "version": 4 + "version": 5 }, "79124edf-30a8-4d48-95c4-11522cad94b1": { "min_stack_version": "8.3", @@ -3585,16 +4069,16 @@ "79ce2c96-72f7-44f9-88ef-60fa1ac2ce47": { "min_stack_version": "8.3", "rule_name": "Potential Masquerading as System32 Executable", - "sha256": "3b177629deb6dd64f254d75b8a4f6b71879b7ff33a70d98c184560b82d67277a", + "sha256": "51fa21c1094b9e214686668956d499fc25f19607d7b1a93fc094aa557eda00d7", "type": "eql", - "version": 1 + "version": 2 }, "79f0a1f7-ed6b-471c-8eb1-23abd6470b1c": { "min_stack_version": "8.3", - "rule_name": "Potential Exfiltration via Certreq", - "sha256": "4ef6fb0e47ac848843d2ae9b37eacc7369390ef5ff45ecf6b0a374512ad4b979", + "rule_name": "Potential File Transfer via Certreq", + "sha256": "a74b9849420ed6b7c23bfb51caa8aad585cf535af48bfd4c11d1d7a16c8560f8", "type": "eql", - "version": 4 + "version": 5 }, "79f97b31-480e-4e63-a7f4-ede42bf2c6de": { "min_stack_version": "8.3", @@ -3612,9 +4096,9 @@ "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation through Writable Docker Socket", - "sha256": "1dd7950a241f5882d741236f88f61e5ed12437aa16756ce984ee04379e2dcdf9", + "sha256": "d77a6da669fbbb4406a59bd7061baf788f0f9fef20b43321c6fcfbb00a24690b", "type": "eql", - "version": 2 + "version": 3 }, "7b08314d-47a0-4b71-ae4e-16544176924f": { "rule_name": "File and Directory Discovery", @@ -3623,18 +4107,27 @@ "version": 100 }, "7b3da11a-60a2-412e-8aa7-011e1eb9ed47": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS ElastiCache Security Group Created", + "sha256": "388613f453ad59a0b5a1346925a88c2ea72963b1a7a4ba77f510bdb527a655a4", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS ElastiCache Security Group Created", "sha256": "05d7545eb5be8c088900939645d5a75858e48029b72b2926c878627697576a85", "type": "query", - "version": 104 + "version": 205 }, "7b8bfc26-81d2-435e-965c-d722ee397ef1": { "min_stack_version": "8.3", "rule_name": "Windows Network Enumeration", - "sha256": "1a74ce8fd55ca323682377fbd4e17aa7c7cbe45b23fc743465ff882304fff104", + "sha256": "a02a471585a3b5aafa89be56f312db81bad278d8eafbf7463f73cfdebf9c80bb", "type": "eql", - "version": 107 + "version": 108 }, "7ba58110-ae13-439b-8192-357b0fcfa9d7": { "min_stack_version": "8.8", @@ -3691,9 +4184,9 @@ "7f370d54-c0eb-4270-ac5a-9a6020585dc6": { "min_stack_version": "8.3", "rule_name": "Suspicious WMIC XSL Script Execution", - "sha256": "0d2e9303095644cff713d6cc47bcea144b0fb7d1c8c7026f50ac5fe60e57228b", + "sha256": "c2521f557370eeadd9f5ab09fd706593451e0f0d44ffcb8ee63fd21ec3433862", "type": "eql", - "version": 105 + "version": 106 }, "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db": { "min_stack_version": "8.6", @@ -3714,30 +4207,55 @@ "7fb500fa-8e24-4bd1-9480-2a819352602c": { "min_stack_version": "8.6", "rule_name": "New Systemd Timer Created", - "sha256": "27bee4413c109d7597639a0a60acd77d395ddd1b5f6f4fb09c88c026a699a4fa", + "sha256": "94cbc646d3a0879e403b786c2c25535db4aebbd67a3f041a8bf43b206462b8f2", "type": "new_terms", - "version": 5 + "version": 6 }, "80084fa9-8677-4453-8680-b891d3c0c778": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 102, + "rule_name": "Enumeration of Kernel Modules via Proc", + "sha256": "2dcd549142325271b0cc47d8d2a3b32dc6f1187d7ed0a0a2ad21238ba64e8ff0", + "type": "eql", + "version": 3 + } + }, "rule_name": "Enumeration of Kernel Modules via Proc", - "sha256": "2dcd549142325271b0cc47d8d2a3b32dc6f1187d7ed0a0a2ad21238ba64e8ff0", - "type": "eql", - "version": 3 + "sha256": "bcfbab89662a36049bb509952b29602fc3e552bc91c4f6851b183c3881604f7b", + "type": "new_terms", + "version": 103 }, "800e01be-a7a4-46d0-8de9-69f3c9582b44": { "min_stack_version": "8.3", "rule_name": "Unusual Process Extension", - "sha256": "15e1dd225bae684eac522b61872faae250a8aac0c4cb71b4e6d68986665587ed", + "sha256": "892abe65dfb4e821b001077e250ac7619928c9a8ba796ec314d9abce74c74ba8", + "type": "eql", + "version": 2 + }, + "808291d3-e918-4a3a-86cd-73052a0c9bdc": { + "min_stack_version": "8.3", + "rule_name": "Suspicious Troubleshooting Pack Cabinet Execution", + "sha256": "e07fdca00c03cede7dcd07d161752b6a5fa31a5987779dde490803e67071a0f7", "type": "eql", "version": 1 }, "809b70d3-e2c3-455e-af1b-2626a5a1a276": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Unusual City For an AWS Command", + "sha256": "51f5b37af37f1f4ec180b1de7aac38ca7d77afc0e1f44dfe6122eb8605e3adab", + "type": "machine_learning", + "version": 108 + } + }, "rule_name": "Unusual City For an AWS Command", "sha256": "d6cbad92730cf10d62df532e09bfef35bca6439b7ff5b0f34337bdda6ab38199", "type": "machine_learning", - "version": 107 + "version": 208 }, "80c52164-c82a-402c-9964-852533d58be1": { "min_stack_version": "8.3", @@ -3756,9 +4274,9 @@ "818e23e6-2094-4f0e-8c01-22d30f3506c6": { "min_stack_version": "8.3", "rule_name": "PowerShell Script Block Logging Disabled", - "sha256": "9c2f8341e807bf0b4ffeb0c40e797f72dbdd69d65b6db7a2a6c7f8ee10708d7a", + "sha256": "cd1b53b5cd9aacd751ae8801be77543c716fd21c184f54a776380edd185e8275", "type": "eql", - "version": 106 + "version": 107 }, "81cc58f5-8062-49a2-ba84-5cc4b4d31c40": { "rule_name": "Persistence via Kernel Module Modification", @@ -3776,9 +4294,9 @@ "81ff45f8-f8c2-4e28-992e-5a0e8d98e0fe": { "min_stack_version": "8.3", "rule_name": "Temporarily Scheduled Task Creation", - "sha256": "82f8ec9cc22e111eb627de7426fd99dd540938ed1e0d05473496ea18b54c3cea", + "sha256": "b9eb095355ecc02a827ca56e41a3ccd5fd5fff3c57c2f1a1e16e0f32082bcd46", "type": "eql", - "version": 6 + "version": 7 }, "827f8d8f-4117-4ae4-b551-f56d54b9da6b": { "min_stack_version": "8.3", @@ -3790,9 +4308,9 @@ "835c0622-114e-40b5-a346-f843ea5d01f1": { "min_stack_version": "8.3", "rule_name": "Potential Linux Local Account Brute Force Detected", - "sha256": "fe6cc04fb2e612cab72a6d221db5f03f75c1706355d5c212987ec5de3a2bd3a6", + "sha256": "1dd8817884ca577039baba5ede3be91c85119efdb77f580810c95c223816ebcc", "type": "eql", - "version": 2 + "version": 3 }, "83a1931d-8136-46fc-b7b9-2db4f639e014": { "min_stack_version": "8.3", @@ -3810,9 +4328,9 @@ "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f": { "min_stack_version": "8.3", "rule_name": "Attempt to Disable IPTables or Firewall", - "sha256": "7bd7ca6309b09a6218ebe05322f1477ad28327ac05cab27ae9eb18267b43563c", + "sha256": "73d35f95e41d651a5e75315cd4b570345c8cc6334b9dec7db8adf08b57f52e30", "type": "eql", - "version": 3 + "version": 4 }, "846fe13f-6772-4c83-bd39-9d16d4ad1a81": { "min_stack_version": "8.3", @@ -3821,6 +4339,13 @@ "type": "query", "version": 1 }, + "84d1f8db-207f-45ab-a578-921d91c23eb2": { + "min_stack_version": "8.3", + "rule_name": "Potential Upgrade of Non-interactive Shell", + "sha256": "3ab2c7dffde8d59a7f0d31f4f475c98f5325a94adb789cc4096286ae73e70e36", + "type": "eql", + "version": 1 + }, "84da2554-e12a-11ec-b896-f661ea17fbcd": { "min_stack_version": "8.3", "rule_name": "Enumerating Domain Trusts via NLTEST.EXE", @@ -3852,32 +4377,59 @@ "version": 208 }, "8623535c-1e17-44e1-aa97-7a0699c3037d": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EC2 Network Access Control List Deletion", + "sha256": "196c1626443f797df1670e37fe56629d8da2a1b61087cac2f3fab49bd64b5113", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EC2 Network Access Control List Deletion", "sha256": "f9a3ba3b45d5b33b1e73c806495b984233a6b2bc200082fc945fa31d8fea41be", "type": "query", - "version": 104 + "version": 205 }, "863cdf31-7fd3-41cf-a185-681237ea277b": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Security Group Deletion", + "sha256": "f46878044473b51688032f8944026be841032d83fbab53ebccb6f3bd1056f1a7", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Security Group Deletion", "sha256": "0c9d4de210e608efca7e588b59eeb71ca5f96b5b20c083daee0e8d4035f0cd32", "type": "query", - "version": 104 + "version": 205 }, "867616ec-41e5-4edc-ada2-ab13ab45de8a": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS IAM Group Deletion", + "sha256": "950ae30d904242ba798eb1658f1e238720d404743585e155f030dda45d0e05f6", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS IAM Group Deletion", "sha256": "f4898405685170f2b55f69bcde2b41a0cb8b861ef6040f86e3257bf0abf93383", "type": "query", - "version": 104 + "version": 205 }, "870aecc0-cea4-4110-af3f-e02e9b373655": { "min_stack_version": "8.3", "rule_name": "Security Software Discovery via Grep", - "sha256": "d5d6fbfe8a86e827bb1f10589d9e8427ba7b59bea1a9707d4359dce6fee0929f", + "sha256": "39e477f562630dea0f3f3b68106d7c699a87d2ab0764247fc8bd0de442981f4f", "type": "eql", - "version": 105 + "version": 106 }, "871ea072-1b71-4def-b016-6278b505138d": { "min_stack_version": "8.3", @@ -3887,11 +4439,20 @@ "version": 108 }, "87594192-4539-4bc4-8543-23bc3d5bd2b4": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EventBridge Rule Disabled or Deleted", + "sha256": "81d56536a960fa83385df001b8186c6a129128d000278be5586476a6d4b9e19b", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EventBridge Rule Disabled or Deleted", "sha256": "bf5d21e0ace96205fd8f8db491ac9d75625ef089e4f5b3499d4a4209268f9719", "type": "query", - "version": 104 + "version": 205 }, "87ec6396-9ac4-4706-bcf0-2ebb22002f43": { "rule_name": "FTP (File Transfer Protocol) Activity to the Internet", @@ -3921,11 +4482,20 @@ "version": 104 }, "88fdcb8c-60e5-46ee-9206-2663adf1b1ce": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 102, + "rule_name": "Potential Sudo Hijacking Detected", + "sha256": "28eba13edb2d9454c08d86938d6bf41ed614c2c32879ec8719cd571c0c9cbef5", + "type": "eql", + "version": 3 + } + }, "rule_name": "Potential Sudo Hijacking Detected", - "sha256": "a4206f33521819d8d7d53c211f4469b0f4d29f90aa303e728ed6c22f0acd0ec3", - "type": "eql", - "version": 2 + "sha256": "90ab70272d3bdc85151e9bc2add9998f4819f17d13c282ae54e1b047602630e4", + "type": "new_terms", + "version": 103 }, "891cb88e-441a-4c3e-be2d-120d99fe7b0d": { "min_stack_version": "8.3", @@ -3964,9 +4534,9 @@ "8a024633-c444-45c0-a4fe-78128d8c1ab6": { "min_stack_version": "8.3", "rule_name": "Suspicious Symbolic Link Created", - "sha256": "ffb3cada9e61abf88edfa4d4994b68df4a1c86040ef6344d2d5d2f2fb67e0bb2", + "sha256": "bd4e75d4bef5c733959b047c5466da2d7768bfe892c50c383b7d1d46240bcaf9", "type": "eql", - "version": 2 + "version": 3 }, "8a1b0278-0f9a-487d-96bd-d4833298e87a": { "min_stack_version": "8.3", @@ -3978,30 +4548,48 @@ "8a1d4831-3ce6-4859-9891-28931fa6101d": { "min_stack_version": "8.3", "rule_name": "Suspicious Execution from a Mounted Device", - "sha256": "a577ac9fcb46e067f2d9a3dfa1c37db43cf2b744e0701387877da0d9321a209f", + "sha256": "7b1e58c15587d23240b63b8dfd696aa8de530ddbf9be2c384db2620e9c9bd4ad", "type": "eql", - "version": 104 + "version": 105 }, "8a5c1e5f-ad63-481e-b53a-ef959230f7f1": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Deactivate an Okta Network Zone", + "sha256": "f01b127b08601cf43cda877946ee97bf4bc51e4cff8f27b3e3dc4a809a3bf009", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Deactivate an Okta Network Zone", "sha256": "42864ccbb8e48936452a309318951454ac5820199a0b5e62be20a53c6846eb2b", "type": "query", - "version": 105 + "version": 206 }, "8acb7614-1d92-4359-bfcf-478b6d9de150": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Suspicious JAVA Child Process", + "sha256": "c0f26a306606e4329dc19352d7f927e70467ccc86747f18345aefcf194110e16", + "type": "eql", + "version": 105 + } + }, "rule_name": "Suspicious JAVA Child Process", - "sha256": "c0f26a306606e4329dc19352d7f927e70467ccc86747f18345aefcf194110e16", - "type": "eql", - "version": 105 + "sha256": "9bcba792d96bb90055853bbc119cff04fa2f40b46cd77ea9bab938ab61056074", + "type": "new_terms", + "version": 205 }, "8af5b42f-8d74-48c8-a8d0-6d14b4197288": { "min_stack_version": "8.3", "rule_name": "Potential Sudo Privilege Escalation via CVE-2019-14287", - "sha256": "577175231e8722658399f535dfe19fa278f3082f7848da4f3c65e77ee2a4118c", + "sha256": "e79736c160e70b66e87aa690264e4ebe08b958d00a2d8178556525a57dae4323", "type": "eql", - "version": 1 + "version": 2 }, "8b2b3a62-a598-4293-bc14-3d5fa22bb98f": { "min_stack_version": "8.3", @@ -4034,9 +4622,9 @@ "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45": { "min_stack_version": "8.3", "rule_name": "Unusual Child Process of dns.exe", - "sha256": "ab6f219326b46640112b041c6a7ccdf841ac3d4aa2e364b34b83a7869e301b70", + "sha256": "32ad67514f438b6e30f64bc4b7b4eb626be6582afadb55c240c2e4efe9b7cfcb", "type": "eql", - "version": 106 + "version": 107 }, "8c81e506-6e82-4884-9b9a-75d3d252f967": { "min_stack_version": "8.3", @@ -4055,9 +4643,9 @@ "8cb84371-d053-4f4f-bce0-c74990e28f28": { "min_stack_version": "8.3", "rule_name": "Potential Successful SSH Brute Force Attack", - "sha256": "930f4fe60fcf470067a75a7d6d9b93d3c80d639fcc0cf248c30c9f41cb98f70d", + "sha256": "65f9ce05fea76a9a8692e1eab5ad90ab0904e79b28d0c1f077f5d0422c5a2098", "type": "eql", - "version": 7 + "version": 8 }, "8d366588-cbd6-43ba-95b4-0971c3f906e5": { "min_stack_version": "8.3", @@ -4076,9 +4664,9 @@ "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via PKEXEC", - "sha256": "9037dac927b76a260a11026c3e893f9f85b2d876004b652c74c012bb7fd93f5f", + "sha256": "bb4dbd0f9903378286cb13efb8f0898a00bf9c3255d58d6a58bd21da8997c9b5", "type": "eql", - "version": 105 + "version": 106 }, "8ddab73b-3d15-4e5d-9413-47f05553c1d7": { "min_stack_version": "8.3", @@ -4104,9 +4692,9 @@ "8f3e91c7-d791-4704-80a1-42c160d7aa27": { "min_stack_version": "8.3", "rule_name": "Potential Port Monitor or Print Processor Registration Abuse", - "sha256": "818146f18a2aefd065739007ec4aecb61ec4257169528b7a6605b7ff0cc0758c", + "sha256": "d3f17c275351dce43dbed1904257d053abe2a6e174ec12f91eabbc40236f918e", "type": "eql", - "version": 104 + "version": 105 }, "8f919d4b-a5af-47ca-a594-6be59cd924a4": { "min_stack_version": "8.3", @@ -4131,16 +4719,25 @@ "90169566-2260-4824-b8e4-8615c3b4ed52": { "min_stack_version": "8.3", "rule_name": "Hping Process Activity", - "sha256": "63e23dabfb3a8535a41b473614245b4df52a35760e0485a6e9f51e55d61615f5", + "sha256": "bca55701a9d9f3c48b1f6d8df6d0672f880ea5e8f7b5252ada7c42af6458802c", "type": "eql", - "version": 105 + "version": 106 }, "9055ece6-2689-4224-a0e0-b04881e1f8ad": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Deletion of RDS Instance or Cluster", + "sha256": "637b97f8e4d2c60b80d6427cd89d111d077543e2103cb3a96f9e35e577bd9caa", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Deletion of RDS Instance or Cluster", "sha256": "52ad2c61bc4217845afa6a13fe3e23cd405324f6bc6779b2ed3a21ecda615e14", "type": "query", - "version": 104 + "version": 205 }, "9092cd6c-650f-4fa3-8a8a-28256c7489c9": { "min_stack_version": "8.3", @@ -4170,11 +4767,20 @@ "version": 104 }, "91d04cd4-47a9-4334-ab14-084abe274d49": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS WAF Access Control List Deletion", + "sha256": "4d59ddb17973a139d9be0a601ce33dda6071ea802724f0bd0333d7db8722280c", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS WAF Access Control List Deletion", "sha256": "ecd61bd19c50c09347fdf33fed3a2f8ec9fc77dec053398a5b62f534e297ebdb", "type": "query", - "version": 104 + "version": 205 }, "91f02f01-969f-4167-8d77-07827ac4cee0": { "min_stack_version": "8.3", @@ -4212,25 +4818,52 @@ "version": 7 }, "93075852-b0f5-4b8b-89c3-a226efae5726": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Security Token Service (STS) AssumeRole Usage", + "sha256": "2e6053408cd8709eca1ec8f67f1435cba0deae2486a175e0943f710e9ee4e2b3", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Security Token Service (STS) AssumeRole Usage", "sha256": "b0edd6d0742b92fa2ebe2c3d5ea02c63f8a1edffe0b0f53320b86ed419ab8fb8", "type": "query", - "version": 104 + "version": 205 }, "931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 202, + "rule_name": "Sudoers File Modification", + "sha256": "61b18d5eee007e352b11ee5d0b8cd560ef127b7ca4a6704381e1b1f0bfe6e1ef", + "type": "query", + "version": 103 + } + }, "rule_name": "Sudoers File Modification", - "sha256": "61b18d5eee007e352b11ee5d0b8cd560ef127b7ca4a6704381e1b1f0bfe6e1ef", - "type": "query", - "version": 103 + "sha256": "6a1a6b3462c4ea5f0ea3cf546684745e51efb7a52a094227c5b2f06e6fa90bc3", + "type": "new_terms", + "version": 203 }, "9395fd2c-9947-4472-86ef-4aceb2f7e872": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS VPC Flow Logs Deletion", + "sha256": "f3c39ae72c93e6c08f938d780fc70f56119ce17eb3ef31cf7645331efed700c3", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS VPC Flow Logs Deletion", "sha256": "408b41a86252884a996ece1031334c7b73d4870202ad4a65c1a74d5392ad3454", "type": "query", - "version": 107 + "version": 208 }, "93b22c0a-06a0-4131-b830-b10d5e166ff4": { "min_stack_version": "8.3", @@ -4263,11 +4896,20 @@ "version": 205 }, "93f47b6f-5728-4004-ba00-625083b3dcb0": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 203, + "rule_name": "Modification of Standard Authentication Module or Configuration", + "sha256": "db86c17797a8d52db5ea04999393ce5c37395cc6a46b34ec1cd0da3f02d0435f", + "type": "query", + "version": 104 + } + }, "rule_name": "Modification of Standard Authentication Module or Configuration", - "sha256": "db86c17797a8d52db5ea04999393ce5c37395cc6a46b34ec1cd0da3f02d0435f", - "type": "query", - "version": 104 + "sha256": "1e01d9186d48db4667fa030761b3f63e12f70737f7fb423eb05d385ad1e6db30", + "type": "new_terms", + "version": 204 }, "947827c6-9ed6-4dec-903e-c856c86e72f3": { "min_stack_version": "8.3", @@ -4323,23 +4965,32 @@ "968ccab9-da51-4a87-9ce2-d3c9782fd759": { "min_stack_version": "8.3", "rule_name": "File made Immutable by Chattr", - "sha256": "bc300bb67a2279504fbe3225243633c892bbc5b8e695a109b127b1edf673cb5b", + "sha256": "951d63b6557d5c3fb3f155e45999afcdd86791f7d830c26ba0ff9811f2ae0367", "type": "eql", - "version": 107 + "version": 108 }, "96b9f4ea-0e8c-435b-8d53-2096e75fcac5": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Attempt to Create Okta API Token", + "sha256": "14b3f9e9b5e605ca66fa3d7115e312ba72ced80772e0d51928496be9202b6353", + "type": "query", + "version": 105 + } + }, "rule_name": "Attempt to Create Okta API Token", "sha256": "00e7844e7b50556df54dd1a80585ef3b0d6e18949813883d66e9467cd40a90f9", "type": "query", - "version": 104 + "version": 205 }, "96d11d31-9a79-480f-8401-da28b194608f": { "min_stack_version": "8.6", "rule_name": "Potential Persistence Through MOTD File Creation Detected", - "sha256": "ac2aae146b439c128acf93b6d08c60c1297ef5ce278baed0d2463fed3d109553", + "sha256": "6adb4dbd03b3b5ad0d5318c1e811e89f0c4c560f2c2cac1830b06b007134962c", "type": "new_terms", - "version": 5 + "version": 6 }, "96e90768-c3b7-4df6-b5d9-6237f8bc36a8": { "min_stack_version": "8.3", @@ -4370,25 +5021,43 @@ "version": 104 }, "979729e7-0c52-4c4c-b71e-88103304a79f": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS SAML Activity", + "sha256": "5ccb2e9205c690a15eeb580f91fbced1746f6a12cd487ec983e1bdb8b5f7b33d", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS SAML Activity", "sha256": "6205667e0b3ffc035feaf7ed17e089eb50ab5ff04926b74e65bb83f73d79af8d", "type": "query", - "version": 104 + "version": 205 }, "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Potential Abuse of Repeated MFA Push Notifications", + "sha256": "c65175629b87978771837a807d4ff8b51d3ae081548603d49475754979b246b4", + "type": "eql", + "version": 107 + } + }, "rule_name": "Potential Abuse of Repeated MFA Push Notifications", "sha256": "77d0337a5eb54baa93eb1e573ddab7f5e356ad4892d6cf02c74ce6562afd8d2d", "type": "eql", - "version": 106 + "version": 207 }, "97aba1ef-6034-4bd3-8c1a-1e0996b27afa": { "min_stack_version": "8.3", "rule_name": "Suspicious Zoom Child Process", - "sha256": "b15108fed1be29ce5b03c10684a269ab6930c9843c4bae00bf62059a1151250f", + "sha256": "f82a785c120d52dcd2123f3f9d2f8b7503d520c6ea8e46fd74f310e8a53dd233", "type": "eql", - "version": 107 + "version": 108 }, "97da359b-2b61-4a40-b2e4-8fc48cf7a294": { "rule_name": "Linux Restricted Shell Breakout via the ssh command", @@ -4399,9 +5068,9 @@ "97db8b42-69d8-4bf3-9fd4-c69a1d895d68": { "min_stack_version": "8.5", "rule_name": "Suspicious Renaming of ESXI Files", - "sha256": "23394ff5cf8c8530a51e90c2408d609e7000dfbc5dff8724cb29cb88e63a6d09", + "sha256": "cd7035a0017aa4b845f94e3aa665721e72fe1dc535c9cfb0867b4657d8a94ef3", "type": "eql", - "version": 3 + "version": 4 }, "97f22dab-84e8-409d-955e-dacd1d31670b": { "rule_name": "Base64 Encoding/Decoding Activity", @@ -4445,11 +5114,20 @@ "version": 102 }, "98fd7407-0bd5-5817-cda0-3fcc33113a56": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS EC2 Snapshot Activity", + "sha256": "ed1f4e4296f79824714df9f3010887d3ecd69c44ffbf728bed8d47197ea5e08e", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS EC2 Snapshot Activity", "sha256": "3c5613df7cc89e9a173b0632a5db11d02b917f05f3c24cb3d44c416a679a4056", "type": "query", - "version": 107 + "version": 208 }, "990838aa-a953-4f3e-b3cb-6ddf7584de9e": { "min_stack_version": "8.3", @@ -4465,6 +5143,13 @@ "type": "eql", "version": 104 }, + "994e40aa-8c85-43de-825e-15f665375ee8": { + "min_stack_version": "8.9", + "rule_name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score", + "sha256": "58480532047dc1a5936dce3ece1b30e3643a68fe8d7e2343553008f2a0deab18", + "type": "eql", + "version": 1 + }, "9960432d-9b26-409f-972b-839a959e79e2": { "min_stack_version": "8.8", "previous": { @@ -4477,9 +5162,9 @@ } }, "rule_name": "Potential Credential Access via LSASS Memory Dump", - "sha256": "2afc41e645fc2f007dfe22ec27e0c211672070aacd5d5a0a8281a8e68a24639f", + "sha256": "7fa3b7d91df0f6450cc6e044925c196edd851d9521299f034167bb892f7b39dc", "type": "eql", - "version": 206 + "version": 207 }, "99dcf974-6587-4f65-9252-d866a3fdfd9c": { "min_stack_version": "8.3", @@ -4495,6 +5180,13 @@ "type": "query", "version": 102 }, + "9a3884d0-282d-45ea-86ce-b9c81100f026": { + "min_stack_version": "8.3", + "rule_name": "Unsigned BITS Service Client Process", + "sha256": "095fc86e65f65030c66df81f286788b89fcf9160e7970ddbb409cc824fc40fd2", + "type": "eql", + "version": 1 + }, "9a3a3689-8ed1-4cdb-83fb-9506db54c61f": { "min_stack_version": "8.4", "previous": { @@ -4507,23 +5199,23 @@ } }, "rule_name": "Potential Shadow File Read via Command Line Utilities", - "sha256": "3d1c09ba378537737bdaa3bc2bbd9e9934d0e9cb7d50f63d33192377614d85f2", + "sha256": "353e07144858914694113a7e9d29ad53687500c1f60ed7c8b02d9c7cd634bad3", "type": "new_terms", - "version": 106 + "version": 107 }, "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b": { "min_stack_version": "8.3", "rule_name": "Suspicious Explorer Child Process", - "sha256": "e8cc9a60bbe510d51bd3ad134669feb9e5cb0fa08160bf27530801138c60e882", + "sha256": "51c78c6f9a1af947f778a0b2a2529d21600647e60786daa70a728174bf87c995", "type": "eql", - "version": 105 + "version": 106 }, "9aa0e1f6-52ce-42e1-abb3-09657cee2698": { "min_stack_version": "8.3", "rule_name": "Scheduled Tasks AT Command Enabled", - "sha256": "b2540b2ad922ec95cfd386da0ca9a614f308ef3262066028d23296d5db87509f", + "sha256": "26cb627c3803eec6cbcf9455a27b56c29ea1f604049232bf2d38813ad0a4d87c", "type": "eql", - "version": 105 + "version": 106 }, "9b343b62-d173-4cfd-bd8b-e6379f964ca4": { "min_stack_version": "8.3", @@ -4535,16 +5227,16 @@ "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c": { "min_stack_version": "8.3", "rule_name": "Persistence via WMI Event Subscription", - "sha256": "9a25dad4f89fd07ae509d365c90397c70feb22604338c0b57ed2c43b1498c278", + "sha256": "cb0771065ca25ee179d357d9e53676141cadf572ac31da5e1f00739f85cf36aa", "type": "eql", - "version": 106 + "version": 107 }, "9c260313-c811-4ec8-ab89-8f6530e0246c": { "min_stack_version": "8.3", "rule_name": "Hosts File Modified", - "sha256": "acfc1d0db0cb1de8a27ec3ec15a3eea599e9644d56ab8bdd06c8678cf1bcee3f", + "sha256": "8f40a74de7484c5086f69c398cea506911f52935e23a27e3a229439cd5c239ce", "type": "eql", - "version": 105 + "version": 106 }, "9c865691-5599-447a-bac9-b3f2df5f9a9d": { "min_stack_version": "8.3", @@ -4556,9 +5248,9 @@ "9ccf3ce0-0057-440a-91f5-870c6ad39093": { "min_stack_version": "8.3", "rule_name": "Command Shell Activity Started via RunDLL32", - "sha256": "33745d6764626a4ad4ef565c71d285cde7a74a318e9622b428483457e45f612a", + "sha256": "594410ed9a140c2439264f3ef7b7bdefa77862b3865a95a2287437856a533db7", "type": "eql", - "version": 106 + "version": 107 }, "9cf7a0ae-2404-11ed-ae7d-f661ea17fbce": { "min_stack_version": "8.4", @@ -4594,9 +5286,9 @@ } }, "rule_name": "Microsoft Build Engine Started by a Script Process", - "sha256": "b98418a78935c61df5f27bc19586a7013ca07b3044d1a233a8bb38e0258feeff", + "sha256": "fb85a79f99efb89bc92c481ec8e21aae037df490635821d5df16cac9b83057fa", "type": "new_terms", - "version": 205 + "version": 206 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3": { "min_stack_version": "8.3", @@ -4608,16 +5300,16 @@ "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4": { "min_stack_version": "8.3", "rule_name": "Microsoft Build Engine Using an Alternate Name", - "sha256": "4487327fd533126e8f007f9eb063741a10c3cf9a07a48399c391f9713e58420c", + "sha256": "8cbc8f08a554be1ad891d12df42a2e456602b21ce9cd4062d2c6428a80073296", "type": "eql", - "version": 108 + "version": 109 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5": { "min_stack_version": "8.3", "rule_name": "Potential Credential Access via Trusted Developer Utility", - "sha256": "0cc7ec48190d68c5dc8c36a1df944b214f34c599d8425caea77fbf4875d98ff1", + "sha256": "4cf250c89befd6b335e6331fbef794c1a969a7f19e203c159d5a84ff3c54f944", "type": "eql", - "version": 107 + "version": 108 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6": { "min_stack_version": "8.6", @@ -4631,16 +5323,16 @@ } }, "rule_name": "Microsoft Build Engine Started an Unusual Process", - "sha256": "1e8c98c86268cb9bdde8af04c845776ed081dd6a07dbfa4b6873755f5d5670dc", + "sha256": "1f08334b425a0821c64aa8990f322f468a74567993e56ff39c7f39cfafb44380", "type": "new_terms", - "version": 206 + "version": 207 }, "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae9": { "min_stack_version": "8.3", "rule_name": "Process Injection by the Microsoft Build Engine", - "sha256": "776c171ad88eb90cf08b8fe5b55c1f9f0303df9c61b6c977aa899c710d7f8348", + "sha256": "b8d4e0bd773e95d96983fb5724ac1405de2f5d491182e453c4dad3af9efe10cd", "type": "query", - "version": 104 + "version": 105 }, "9d19ece6-c20e-481a-90c5-ccca596537de": { "min_stack_version": "8.3", @@ -4659,26 +5351,35 @@ "9f1c4ca3-44b5-481d-ba42-32dc215a2769": { "min_stack_version": "8.3", "rule_name": "Potential Protocol Tunneling via EarthWorm", - "sha256": "7bb8484c63f6e1ceb591dc3b6a6aa1e5e3dc34ccfd3d932e3e9c8e1b8e3162be", + "sha256": "e2394c0d8724d9f2e57e47f5a50cbfa2d1645b0cf50c8bfce9ce10a202bcd28f", "type": "eql", - "version": 106 + "version": 107 }, "9f962927-1a4f-45f3-a57b-287f2c7029c1": { "min_stack_version": "8.3", "rule_name": "Potential Credential Access via DCSync", - "sha256": "183d1fd02dc0fd574742ae54310b3f93b10da3165738e77fcdf8b460f5f7cdac", + "sha256": "dfd7fcad40d953ee8a27b0f8510db3d0cddfa4002ded1a896dbc248170dfb00a", "type": "eql", - "version": 109 + "version": 110 }, "9f9a2a82-93a8-4b1a-8778-1780895626d4": { - "min_stack_version": "8.3", + "min_stack_version": "8.6", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "File Permission Modification in Writable Directory", + "sha256": "6c93604ac3f7c4e56ba67f913a4b594887a31706b87f87c25ce6fe48e9608fc3", + "type": "eql", + "version": 106 + } + }, "rule_name": "File Permission Modification in Writable Directory", - "sha256": "479f3fc53ac311718ff6affc4889eeca57ac3a34bf6f10026bf60b6b8e915eb8", - "type": "eql", - "version": 105 + "sha256": "ed6e7a8e67076b9fae1eb03416f9d82c7915364a8c9a99c7e4c881a6ce932693", + "type": "new_terms", + "version": 206 }, "a00681e3-9ed6-447c-ab2c-be648821c622": { - "min_stack_version": "8.6", + "min_stack_version": "8.9", "previous": { "8.3": { "max_allowable_version": 204, @@ -4686,12 +5387,19 @@ "sha256": "8a809b35c09aae82a1f066892fa5746325703203ff96d57019f0c0566dc602fe", "type": "query", "version": 106 + }, + "8.6": { + "max_allowable_version": 307, + "rule_name": "First Time Seen AWS Secret Value Accessed in Secrets Manager", + "sha256": "a470900ff108beb4fc2bd4b7b585eab94d9c4069ec2fdc41e3d7b241c6fd4263", + "type": "new_terms", + "version": 208 } }, "rule_name": "First Time Seen AWS Secret Value Accessed in Secrets Manager", "sha256": "7cd0da2ff3ffb5eb309da5e40ce09ddc719465d69413af21aaa59db60bf569ea", "type": "new_terms", - "version": 207 + "version": 308 }, "a02cb68e-7c93-48d1-93b2-2c39023308eb": { "min_stack_version": "8.3", @@ -4700,6 +5408,13 @@ "type": "eql", "version": 8 }, + "a0ddb77b-0318-41f0-91e4-8c1b5528834f": { + "min_stack_version": "8.3", + "rule_name": "Potential Privilege Escalation via Python cap_setuid", + "sha256": "410784f14d7bf622572e26d5b794f3a0c338a4e24485cc977afa183933cd6ba1", + "type": "eql", + "version": 1 + }, "a10d3d9d-0f65-48f1-8b25-af175e2594f5": { "min_stack_version": "8.3", "rule_name": "GCP Pub/Sub Topic Creation", @@ -4717,9 +5432,9 @@ "a1329140-8de3-4445-9f87-908fb6d824f4": { "min_stack_version": "8.3", "rule_name": "File Deletion via Shred", - "sha256": "9bb73e05248278c13545b111daf70f5b5b00005f472f1ad9a8ad6dc03a7e4bb8", + "sha256": "6a172e2439d747140f251d1d0e83f556e72ae03725f37bc760d2d4d7649fdd03", "type": "query", - "version": 105 + "version": 106 }, "a16612dd-b30e-4d41-86a0-ebe70974ec00": { "min_stack_version": "8.3", @@ -4752,9 +5467,9 @@ "a1a0375f-22c2-48c0-81a4-7c2d11cc6856": { "min_stack_version": "8.3", "rule_name": "Potential Reverse Shell Activity via Terminal", - "sha256": "189260746002bccbe31e9ddb6ba7e60d701a6e651c5d2c19efe56cd242c954af", + "sha256": "cf164c11d3db4e9e02e907d5c0aef8c3c4aadaf05536b522bb73c9ab3bdb9560", "type": "eql", - "version": 105 + "version": 106 }, "a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f": { "min_stack_version": "8.3", @@ -4766,9 +5481,9 @@ "a22a09c2-2162-4df0-a356-9aacbeb56a04": { "min_stack_version": "8.3", "rule_name": "DNS-over-HTTPS Enabled via Registry", - "sha256": "7e9cfb7b511344e897eac5189a53654f476437241ee0c37b7600d2e033787ca7", + "sha256": "914a39f1d00e560fa0f28e8f67e57de3b2185f0ca422a7b395f419f567383cbe", "type": "eql", - "version": 105 + "version": 106 }, "a2795334-2499-11ed-9e1a-f661ea17fbce": { "min_stack_version": "8.4", @@ -4823,9 +5538,9 @@ "a5eb21b7-13cc-4b94-9fe2-29bb2914e037": { "min_stack_version": "8.6", "rule_name": "Potential Reverse Shell via UDP", - "sha256": "2bb373420b8f04de56b4e10442d426787ff255a9ed14d92c64f05a0c3334871f", + "sha256": "e730ecd8da8e472be98472039b0fe0d3367e75d284b97851b915bac433ec17c2", "type": "eql", - "version": 1 + "version": 2 }, "a5f0d057-d540-44f5-924d-c6a2ae92f045": { "min_stack_version": "8.3", @@ -4835,11 +5550,20 @@ "version": 5 }, "a60326d7-dca7-4fb7-93eb-1ca03a1febbd": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS IAM Assume Role Policy Update", + "sha256": "76387a6bb7b623af513d1e3379567e01c3efd70a0fbf651fb1361a6a3fb63075", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS IAM Assume Role Policy Update", "sha256": "10f0e0afc0e8f51f1c37dc1a9885a33dd37e56c43f029b3c5865e4983baefb3a", "type": "query", - "version": 107 + "version": 208 }, "a605c51a-73ad-406d-bf3a-f24cc41d5c97": { "min_stack_version": "8.3", @@ -4858,9 +5582,9 @@ "a624863f-a70d-417f-a7d2-7a404638d47f": { "min_stack_version": "8.3", "rule_name": "Suspicious MS Office Child Process", - "sha256": "e666ba885bd91e597b94e0359330e1a02c9c59b43b48de599aeb78a26c32aaa9", + "sha256": "1b6c475dbb4e03fa67ed24f68234e633e098831572aef47077e72f8dfe6957cb", "type": "eql", - "version": 107 + "version": 108 }, "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90": { "min_stack_version": "8.3", @@ -4943,9 +5667,9 @@ "a9b05c3b-b304-4bf9-970d-acdfaef2944c": { "min_stack_version": "8.3", "rule_name": "Persistence via Hidden Run Key Detected", - "sha256": "a73b1eb6b898a6e001202a04fdd4d7fb4c5b701bd88b68a6840f1260506c2e68", + "sha256": "7844ec8c0187f632d87cd6160ec6fbfa6968c5922e6a07bb3372475a6a1b5f31", "type": "eql", - "version": 104 + "version": 105 }, "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7": { "min_stack_version": "8.3", @@ -4964,9 +5688,9 @@ "aa895aea-b69c-4411-b110-8d7599634b30": { "min_stack_version": "8.3", "rule_name": "System Log File Deletion", - "sha256": "ac41e7af0740df6857011b45aeafd5c04aa1172edb2ee9469e0294726e78cea9", + "sha256": "14e5354aa44af54186285133c4a176bf18dd8b2c1dc22c1555bd658ca8aed767", "type": "eql", - "version": 107 + "version": 108 }, "aa9a274d-6b53-424d-ac5e-cb8ca4251650": { "min_stack_version": "8.3", @@ -4985,9 +5709,9 @@ "ab75c24b-2502-43a0-bf7c-e60e662c811e": { "min_stack_version": "8.3", "rule_name": "Remote Execution via File Shares", - "sha256": "9a5ead5bb94a1738ef4a8c11bf9f462123e5bd0feb2519f360526765f6f33939", + "sha256": "9960496bb3be4ae85c905a65d9967cce3c87c957c5b9c0a36e7940676dc24fac", "type": "eql", - "version": 107 + "version": 108 }, "abae61a8-c560-4dbd-acca-1e1438bff36b": { "min_stack_version": "8.3", @@ -5006,23 +5730,32 @@ "ac5012b8-8da8-440b-aaaf-aedafdea2dff": { "min_stack_version": "8.3", "rule_name": "Suspicious WerFault Child Process", - "sha256": "afa61dc2050d9a7e20f967d9211dda8036fdb4e3a725c969403a31ceb567ba33", + "sha256": "0f822c4116038c91a881a8b8eda9017407457ea3498167dea425f66a161a9067", "type": "eql", - "version": 107 + "version": 108 }, "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Unusual AWS Command for a User", + "sha256": "9f57306030e5ba60d653be67aa9384950045aa7df06b096ce123ae72771cd11a", + "type": "machine_learning", + "version": 108 + } + }, "rule_name": "Unusual AWS Command for a User", "sha256": "17d74013b573ef431a61391d055df4a9ab5851741a17e466a651c3a1f13efb49", "type": "machine_learning", - "version": 107 + "version": 208 }, "ac8805f6-1e08-406c-962e-3937057fa86f": { "min_stack_version": "8.3", "rule_name": "Potential Protocol Tunneling via Chisel Server", - "sha256": "85b49fc5764428ee7a05cbde9d031b14b82f8f03824c859dd58ec45f25c8a091", + "sha256": "48bea2e83f12194db4f91544236e97199adeadca828f332acc5c23da9f9d9206", "type": "eql", - "version": 1 + "version": 2 }, "ac96ceb8-4399-4191-af1d-4feeac1f1f46": { "min_stack_version": "8.3", @@ -5064,9 +5797,9 @@ "acf738b5-b5b2-4acc-bad9-1e18ee234f40": { "min_stack_version": "8.3", "rule_name": "Suspicious Managed Code Hosting Process", - "sha256": "bedefb3843c8bab1185b36e6c8ced6d50cf2e073be5c0270dbbb3b1b27cb89f9", + "sha256": "f9f3abc0bcdf5a397a26aac862f259f0a5b8a25feded07e85dcb9a308c799f23", "type": "eql", - "version": 104 + "version": 105 }, "ad0d2742-9a49-11ec-8d6b-acde48001122": { "min_stack_version": "8.3", @@ -5100,9 +5833,9 @@ "ad84d445-b1ce-4377-82d9-7c633f28bf9a": { "min_stack_version": "8.3", "rule_name": "Suspicious Portable Executable Encoded in Powershell Script", - "sha256": "908f3060b0c4846a176cfe5ad9f2187c6bf23b09a3fe9833680c524f1b6ff701", + "sha256": "8f2f24455938fb5ea09e3ec7060090a25a269b6678183d00e54a6414e2df8ebf", "type": "query", - "version": 107 + "version": 108 }, "ad88231f-e2ab-491c-8fc6-64746da26cfe": { "min_stack_version": "8.3", @@ -5114,16 +5847,16 @@ "adb961e0-cb74-42a0-af9e-29fc41f88f5f": { "min_stack_version": "8.3", "rule_name": "File Transfer or Listener Established via Netcat", - "sha256": "bb502a72d7b3be033796d389420de72438dbe7d44096a7b8203caa4e7676c5aa", + "sha256": "8cd17e47485c9d7340c14995dfe14cbab3158f5de2a29a64a2e8281e1236dc66", "type": "eql", - "version": 107 + "version": 108 }, "adbfa3ee-777e-4747-b6b0-7bd645f30880": { "min_stack_version": "8.3", "rule_name": "Suspicious Communication App Child Process", - "sha256": "d195fb652753fee06135cdc5beb9fb65b68e7895f9d0fc199416d9269c88cfd6", + "sha256": "0e8ff7a50a23c7b9726e3fce8b74834754c75e9cc4bee21fddbb73b9acde9c43", "type": "eql", - "version": 1 + "version": 2 }, "ae8a142c-6a1d-4918-bea7-0b617e99ecfa": { "min_stack_version": "8.3", @@ -5135,16 +5868,16 @@ "aebaa51f-2a91-4f6a-850b-b601db2293f4": { "min_stack_version": "8.6", "rule_name": "Shared Object Created or Changed by Previously Unknown Process", - "sha256": "26c12224f8502e7fc4d3293edee86f433e5a9232a94ff1ed704587a9c019e640", + "sha256": "aad1b5a33619e6512fe65f763c3bf7efc9340426847e9521aef7529ed7b820a1", "type": "new_terms", - "version": 3 + "version": 4 }, "afa135c0-a365-43ab-aa35-fd86df314a47": { "min_stack_version": "8.3", "rule_name": "Unusual User Privilege Enumeration via id", - "sha256": "e5a5fa72494c859d18b55169da07fe4402091b7b621b55c497592cfe489f3912", + "sha256": "c98963d7bd8d88e43392beedefd94e993beba6832757358cbd30700b542c64d8", "type": "eql", - "version": 1 + "version": 2 }, "afcce5ad-65de-4ed2-8516-5e093d3ac99a": { "min_stack_version": "8.3", @@ -5156,16 +5889,16 @@ "afd04601-12fc-4149-9b78-9c3f8fe45d39": { "min_stack_version": "8.3", "rule_name": "Network Activity Detected via cat", - "sha256": "842200b53b379cfcfe0e98cce8c0775e7120c7312edc3aecaa2cae7783559566", + "sha256": "3efeb12f45b961fb82eedcf17858c557c07e762e46a219c0988da6b4f07502f2", "type": "eql", - "version": 1 + "version": 2 }, "afe6b0eb-dd9d-4922-b08a-1910124d524d": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via Container Misconfiguration", - "sha256": "c8effdbedbafb2183ae0ebbed62b0c5290d8157f7c6cf64bd0f9df02ee6c44d7", + "sha256": "0bf1a7ca2b5b8e549eb4f67bc0935b74f3f25e139397f7b67fa4657d5d14de9f", "type": "eql", - "version": 2 + "version": 3 }, "b0046934-486e-462f-9487-0d4cf9e429c6": { "min_stack_version": "8.3", @@ -5197,9 +5930,9 @@ "b2318c71-5959-469a-a3ce-3a0768e63b9c": { "min_stack_version": "8.3", "rule_name": "Potential Network Share Discovery", - "sha256": "6b2beff828f6dbc7e7b0afe03808d0497daf94d97c99afb60f9b17cf65c76cb9", + "sha256": "eb213dc86c103363dad386e08221252c0d865f53b002b17fe09c36adb6631ec5", "type": "eql", - "version": 1 + "version": 2 }, "b240bfb8-26b7-4e5e-924e-218144a3fa71": { "min_stack_version": "8.3", @@ -5239,9 +5972,9 @@ "b41a13c6-ba45-4bab-a534-df53d0cfed6a": { "min_stack_version": "8.3", "rule_name": "Suspicious Endpoint Security Parent Process", - "sha256": "850a993dfb6eda757d5c928ddadb446f3ff907e01cc16c715a8274d56c405fa0", + "sha256": "aa283cd7566eebaa3e98d93024a7710926f4bb3dac4a46d97159d6377f7ee8ca", "type": "eql", - "version": 106 + "version": 107 }, "b43570de-a908-4f7f-8bdb-b2df6ffd8c80": { "min_stack_version": "8.3", @@ -5258,39 +5991,57 @@ "version": 104 }, "b45ab1d2-712f-4f01-a751-df3826969807": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS STS GetSessionToken Abuse", + "sha256": "270622c32893a7ed8bb7c39017bb09133147e3b8af1c8844d93f0150447134ba", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS STS GetSessionToken Abuse", "sha256": "1382976ef19290c1857b535d15facff537acd5d5a33e5575372bef70ba4c9090", "type": "query", - "version": 104 + "version": 205 }, "b483365c-98a8-40c0-92d8-0458ca25058a": { "min_stack_version": "8.3", "rule_name": "At.exe Command Lateral Movement", - "sha256": "893d370046656c516a3d5b747ce8da0049fd49f11a14f685446dca5ada7bcbcf", + "sha256": "dd7f70787fff06dbfcdc2556f504ad62feda00ed2e1fa5d7effab3a1be31482f", "type": "eql", - "version": 1 + "version": 2 }, "b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Delete an Okta Policy", + "sha256": "c3fda77e2d67870f675065527fb363156e723e6bc1090d9bdda28d930d7f3d04", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Delete an Okta Policy", "sha256": "614c1c668c20b47ea3131ada30c8e3553492804e1a59c5580715f70c757d07b6", "type": "query", - "version": 105 + "version": 206 }, "b51dbc92-84e2-4af1-ba47-65183fcd0c57": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via OverlayFS", - "sha256": "933503a94667894209a5220b062fe18f2b075d5c0c0608171a3843cb264a4429", + "sha256": "c7deb10ffa59d05fbac1583edf15b565628cec521edbceb803f9b15c91400b85", "type": "eql", - "version": 2 + "version": 3 }, "b5877334-677f-4fb9-86d5-a9721274223b": { "min_stack_version": "8.3", "rule_name": "Clearing Windows Console History", - "sha256": "7cf6587d86fbdfeb3c6513bb3c44adaeeff97831c1afb84ac5aa64fb8ed82298", + "sha256": "9f885fb22e236780df0b7209ca3b783bbbe19b69cd285ad32c8a24005ef089e7", "type": "eql", - "version": 106 + "version": 107 }, "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921": { "min_stack_version": "8.3", @@ -5309,9 +6060,9 @@ "b64b183e-1a76-422d-9179-7b389513e74d": { "min_stack_version": "8.3", "rule_name": "Windows Script Interpreter Executing Process via WMI", - "sha256": "e83adb7abd38295e3992be00556c51a2381e38d400259af3c0d3ba9e3abe6d2d", + "sha256": "9fbd1c201afd94da2c21d31f6797a87f96380d6cb42df20af7ad7205ffcd05ac", "type": "eql", - "version": 106 + "version": 107 }, "b6dce542-2b75-4ffb-b7d6-38787298ba9d": { "min_stack_version": "8.3", @@ -5321,18 +6072,36 @@ "version": 103 }, "b719a170-3bdb-4141-b0e3-13e3cf627bfe": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Deactivate an Okta Policy", + "sha256": "48e769c5aedb715bdbc0f990b68ced02323c1eef17b02595550b368f66a3c9c8", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Deactivate an Okta Policy", "sha256": "6a65ec96ad5423adc711dfec4c404f2e552f894f68eaa80a1f242d64218bbdc6", "type": "query", - "version": 105 + "version": 206 }, "b8075894-0b62-46e5-977c-31275da34419": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Administrator Privileges Assigned to an Okta Group", + "sha256": "8d9fe19feb7f250c14755465615f7a3fb4f831e20ba19b6ba0eeec6637d056e3", + "type": "query", + "version": 105 + } + }, "rule_name": "Administrator Privileges Assigned to an Okta Group", "sha256": "1177bae4785512b7c84e85287f4a1e6555c016a06a1a91407ee74cee2c622ae3", "type": "query", - "version": 104 + "version": 205 }, "b81bd314-db5b-4d97-82e8-88e3e5fc9de5": { "min_stack_version": "8.3", @@ -5365,23 +6134,23 @@ "b8f8da2d-a9dc-48c0-90e4-955c0aa1259a": { "min_stack_version": "8.3", "rule_name": "Kirbi File Creation", - "sha256": "5cc88228ed8f2119aba7d21bef4e172fec1499a3b3b8168eb439cb581d94c2ac", + "sha256": "34a4c6af4a0abec4b49761fd3410e7ce843a7cd917929009de084283086d34f2", "type": "eql", - "version": 1 + "version": 2 }, "b90cdde7-7e0d-4359-8bf0-2c112ce2008a": { "min_stack_version": "8.3", "rule_name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface", - "sha256": "26cd2a27b9188a119adafb00b69b4b1d5bbcbc60cfd384696c76c50e54bcff5d", + "sha256": "c5173c7852d544188783ae8ad6360a27c4dc99276c45cd65516112c2f3a24d88", "type": "eql", - "version": 105 + "version": 106 }, "b910f25a-2d44-47f2-a873-aabdc0d355e6": { "min_stack_version": "8.3", "rule_name": "Chkconfig Service Add", - "sha256": "ed8d32c408ebce2c38e498744b7f617e2d9a2b9a38139ad447c1c100b5844299", + "sha256": "975875643c470662591b7f92890f341af3ec06aaec4d7462d89b555ab08b31ea", "type": "eql", - "version": 106 + "version": 107 }, "b92d5eae-70bb-4b66-be27-f98ba9d0ccdc": { "min_stack_version": "8.3", @@ -5407,16 +6176,16 @@ "b9666521-4742-49ce-9ddc-b8e84c35acae": { "min_stack_version": "8.3", "rule_name": "Creation of Hidden Files and Directories via CommandLine", - "sha256": "b52f9a9d5f0c729e51501205cbd24a63482072973a089b57d59e07a4fab75df7", + "sha256": "24e7bf23a9b423f0ee788a5d588692dbf4cb7d5a9de672b20db27deb8f3d05fb", "type": "eql", - "version": 105 + "version": 106 }, "b9960fef-82c6-4816-befa-44745030e917": { "min_stack_version": "8.3", "rule_name": "SolarWinds Process Disabling Services via Registry", - "sha256": "6babe233910e674621a9caa5ef06d385da6c55f240c6169e50263b3ee15edba5", + "sha256": "c475fe418c9dd5c5b6a357004cecb0f77ec12520167b225d77dcb436eb1094fd", "type": "eql", - "version": 105 + "version": 106 }, "ba342eb2-583c-439f-b04d-1fdd7c1417cc": { "min_stack_version": "8.3", @@ -5428,9 +6197,9 @@ "baa5d22c-5e1c-4f33-bfc9-efa73bb53022": { "min_stack_version": "8.3", "rule_name": "Suspicious Image Load (taskschd.dll) from MS Office", - "sha256": "2a8f252310526865a66c043e6fce6a09a1f3bb3a23422aefd2e8782f9f25e414", + "sha256": "4e20d0099e197e490805cd6edaf652e4b192b1c67cd120c9583905ac929dd623", "type": "eql", - "version": 104 + "version": 105 }, "bb4fe8d2-7ae2-475c-8b5d-55b449e4264f": { "min_stack_version": "8.3", @@ -5440,11 +6209,20 @@ "version": 102 }, "bb9b13b2-1700-48a8-a750-b43b0a72ab69": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EC2 Encryption Disabled", + "sha256": "2e9848fe420de87afde4a086d63bb5d02bb91f3da348bd0eed54b6f7993a85cd", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EC2 Encryption Disabled", "sha256": "60c1a7d5d2cd24c909689b37015df4508b993bdd925b050e1b45df21a23479ba", "type": "query", - "version": 104 + "version": 205 }, "bba1b212-b85c-41c6-9b28-be0e5cdfc9b1": { "min_stack_version": "8.3", @@ -5456,9 +6234,9 @@ "bbaa96b9-f36c-4898-ace2-581acb00a409": { "min_stack_version": "8.3", "rule_name": "Potential SYN-Based Network Scan Detected", - "sha256": "2b1e4aa7d79164849563312bd9d49b860b58f5f0b4df254ce84a7a65e6a10dfa", + "sha256": "2425bfd3bc54bb802d2646cf30575b92b6de9f1768145e593f3640a9ed1ba450", "type": "threshold", - "version": 3 + "version": 4 }, "bbd1a775-8267-41fa-9232-20e5582596ac": { "min_stack_version": "8.3", @@ -5468,11 +6246,20 @@ "version": 102 }, "bc0c6f0d-dab0-47a3-b135-0925f0a333bc": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS Root Login Without MFA", + "sha256": "40f1b53ce3bb3464e8d8bbad167820d4d5b70e24358eef7c18c72fcdaf161f26", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS Root Login Without MFA", "sha256": "8f967af66ccd21f236403f460e274db15d0dab8e769626d091f26ddba123de07", "type": "query", - "version": 107 + "version": 208 }, "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331": { "min_stack_version": "8.3", @@ -5498,9 +6285,9 @@ "bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9": { "min_stack_version": "8.3", "rule_name": "Potential Non-Standard Port SSH connection", - "sha256": "92fe0317a5bf0deb57dbfeb4dcf96a13fa08ceb7e7a1e13f9f597eb9c94cda33", + "sha256": "68365d0090a647d05f3396ace9d86f2c79f607bef610741ce9c4240ccfa0de26", "type": "eql", - "version": 4 + "version": 5 }, "bc9e4f5a-e263-4213-a2ac-1edf9b417ada": { "min_stack_version": "8.3", @@ -5516,12 +6303,19 @@ "type": "query", "version": 104 }, + "bcaa15ce-2d41-44d7-a322-918f9db77766": { + "min_stack_version": "8.9", + "rule_name": "Machine Learning Detected DGA activity using a known SUNBURST DNS domain", + "sha256": "d63cfc91fa9b1bb91389ee64591686beafffd9f84982f78f22bcb437826e0180", + "type": "query", + "version": 1 + }, "bd2c86a0-8b61-4457-ab38-96943984e889": { "min_stack_version": "8.3", "rule_name": "PowerShell Keylogging Script", - "sha256": "3d79fb63abbf974eea35cef0856ce1d799ebbf00d6ca813fc02212c88846a9b9", + "sha256": "e5e42d67e73c95c6558439ae96e3515ae045a15b9cf9349190ccb7ce1a5c3258", "type": "query", - "version": 109 + "version": 110 }, "bd3d058d-5405-4cee-b890-337f09366ba2": { "min_stack_version": "8.3", @@ -5540,16 +6334,23 @@ "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc": { "min_stack_version": "8.3", "rule_name": "Potential Pspy Process Monitoring Detected", - "sha256": "b1a7f950e8830388985011f13f94ef09e66a8e19ff09652206c060af47049380", + "sha256": "95a277633a730cc76f1f3dd56678af752c6c0b11bd0eca7bf678452efce66786", "type": "eql", - "version": 2 + "version": 3 }, "bdcf646b-08d4-492c-870a-6c04e3700034": { "min_stack_version": "8.3", "rule_name": "Potential Privileged Escalation via SamAccountName Spoofing", - "sha256": "9788f2c111d4f8b2f3e0fe64bf7ae3413c3de45f8b030b8611720aac8b263436", + "sha256": "49544ad4d81ab915c9fd10546c551f9f16cd314bd11afeb39e1d8c2f92d61242", "type": "eql", - "version": 105 + "version": 106 + }, + "bdfebe11-e169-42e3-b344-c5d2015533d3": { + "min_stack_version": "8.9", + "rule_name": "Suspicious Windows Process Cluster Spawned by a Host", + "sha256": "5ae04a57c1b38d7e0492041cf77dd21a4f39bbab4665de39b2fa755166cf1faa", + "type": "machine_learning", + "version": 1 }, "be4c5aed-90f5-4221-8bd5-7ab3a4334751": { "min_stack_version": "8.9", @@ -5566,11 +6367,20 @@ "version": 106 }, "bf1073bf-ce26-4607-b405-ba1ed8e9e204": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Snapshot Restored", + "sha256": "aa3da4102533524658662c93b127d4c25ca56ed19c01be2a8904cd695347b3d6", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Snapshot Restored", "sha256": "31690f503f33025d8d634b7c33d01adff504c8c0cdfbeab6519116149937669e", "type": "query", - "version": 104 + "version": 205 }, "bf8c007c-7dee-4842-8e9a-ee534c09d205": { "min_stack_version": "8.3", @@ -5579,12 +6389,19 @@ "type": "eql", "version": 2 }, + "bfba5158-1fd6-4937-a205-77d96213b341": { + "min_stack_version": "8.9", + "rule_name": "Potential Data Exfiltration Activity to an Unusual Region", + "sha256": "5b26c01b0dbc43669ecd86f7d517896559de73bb5322add585302163804f23fc", + "type": "machine_learning", + "version": 1 + }, "bfeaf89b-a2a7-48a3-817f-e41829dc61ee": { "min_stack_version": "8.3", "rule_name": "Suspicious DLL Loaded for Persistence or Privilege Escalation", - "sha256": "7571708ba81c1f4c57ec35169932645127841b408009313e8f8135ce0047e56f", + "sha256": "48070e6a13563fdaf1cc968863fd1afaf4838e89682767a13af387858571ec00", "type": "eql", - "version": 107 + "version": 108 }, "c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d": { "min_stack_version": "8.3", @@ -5596,9 +6413,16 @@ "c0429aa8-9974-42da-bfb6-53a0a515a145": { "min_stack_version": "8.3", "rule_name": "Creation or Modification of a new GPO Scheduled Task or Service", - "sha256": "1d3f46774fa553848617bda8c90e9702f60b946e32a622488929bf506f40dae3", + "sha256": "b703ff542262a1b01cce71377aa6ca313a15387e5c2b986a98d27924ecb2782f", "type": "eql", - "version": 105 + "version": 106 + }, + "c0b9dc99-c696-4779-b086-0d37dc2b3778": { + "min_stack_version": "8.3", + "rule_name": "Memory Dump File with Unusual Extension", + "sha256": "d6064fcc8c3a68d8ecb16d376fef04353be367b0f897433bc82b46a6569f0eb5", + "type": "eql", + "version": 1 }, "c0be5f31-e180-48ed-aa08-96b36899d48f": { "min_stack_version": "8.3", @@ -5610,23 +6434,41 @@ "c125e48f-6783-41f0-b100-c3bf1b114d16": { "min_stack_version": "8.5", "rule_name": "Suspicious Renaming of ESXI index.html File", - "sha256": "2195aa627b79e9257bce750418e362ba1b3e8afcb6b58e9fb9d1e7cb145e171d", + "sha256": "6ce01312cbd857003098b2b0753a1ec8356a09b109b020cdc2ab369082ffbf8c", "type": "eql", - "version": 3 + "version": 4 }, "c1812764-0788-470f-8e74-eb4a14d47573": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EC2 Full Network Packet Capture Detected", + "sha256": "c8fb1a9316a7bc5541a685e19440d21f4c158350903c4e21b6225360fee8258d", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EC2 Full Network Packet Capture Detected", "sha256": "53d6e6b5dc3942bb911622ffd2582ed4e8a3bff445df0e269aba07ed320f34e8", "type": "query", - "version": 104 + "version": 205 }, "c20cd758-07b1-46a1-b03f-fa66158258b8": { - "min_stack_version": "8.3", + "min_stack_version": "8.4", + "previous": { + "8.3": { + "max_allowable_version": 100, + "rule_name": "Unsigned DLL Loaded by a Trusted Process", + "sha256": "bb5c65b28dc087548516c6b186539ffc5f02db3440942a539777c49bd9e1e878", + "type": "eql", + "version": 1 + } + }, "rule_name": "Unsigned DLL Loaded by a Trusted Process", "sha256": "bb5c65b28dc087548516c6b186539ffc5f02db3440942a539777c49bd9e1e878", "type": "eql", - "version": 1 + "version": 101 }, "c25e9c87-95e1-4368-bfab-9fd34cf867ec": { "min_stack_version": "8.3", @@ -5715,9 +6557,9 @@ "c57f8579-e2a5-4804-847f-f2732edc5156": { "min_stack_version": "8.3", "rule_name": "Potential Remote Desktop Shadowing Activity", - "sha256": "0754db6d4f87bf3dbed35d286a6313e4dd925ac4336f36dfb27b7f5fdb03719d", + "sha256": "0710403c8d618e71c165c7b8eb160bed4e6e439b9d9c904d9b5af9aa9be9588e", "type": "eql", - "version": 105 + "version": 106 }, "c58c3081-2e1d-4497-8491-e73a45d1a6d6": { "min_stack_version": "8.3", @@ -5729,9 +6571,9 @@ "c5c9f591-d111-4cf8-baec-c26a39bc31ef": { "min_stack_version": "8.3", "rule_name": "Potential Credential Access via Renamed COM+ Services DLL", - "sha256": "cb3a027cc825279d6ff1f31d31e63c3ce7ddce596ef2f0427bba0b3ffeb643f6", + "sha256": "9703a3f1e0ab87710ef683407452f9491a296fbb9fb21c1270d48f28039443a0", "type": "eql", - "version": 104 + "version": 105 }, "c5ce48a6-7f57-4ee8-9313-3d0024caee10": { "min_stack_version": "8.3", @@ -5768,18 +6610,36 @@ "version": 100 }, "c749e367-a069-4a73-b1f2-43a3798153ad": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Delete an Okta Network Zone", + "sha256": "fdb6f5c18f3893647e63e19723c1ad7c3f352be39e233b1273d08b6cd09edd5a", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Delete an Okta Network Zone", "sha256": "32aa247af72d8bfb3ed85d34d5c359b595a21f5b5ef6703aec68875147b2110f", "type": "query", - "version": 105 + "version": 206 }, "c74fd275-ab2c-4d49-8890-e2943fa65c09": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Attempt to Modify an Okta Application", + "sha256": "d467d49b83c884e4c1d43dc2f0e1dc879ceda77762f45968124a97e4fbacd2b0", + "type": "query", + "version": 105 + } + }, "rule_name": "Attempt to Modify an Okta Application", "sha256": "d9ce411d12a9dcd03a68e93eedabd0fc200c743908746faf634ade8744ff7f32", "type": "query", - "version": 104 + "version": 205 }, "c7894234-7814-44c2-92a9-f7d851ea246a": { "min_stack_version": "8.3", @@ -5807,9 +6667,9 @@ "c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9": { "min_stack_version": "8.3", "rule_name": "Unusual File Modification by dns.exe", - "sha256": "26595f8f9541a3d4b1ce33b50669bb5f8e620a68f9063c6c07ef0eef97271b42", + "sha256": "462a72ca87888591497bad05c41909f4b20b28e8be26d594546e563f178bd706", "type": "eql", - "version": 106 + "version": 107 }, "c7db5533-ca2a-41f6-a8b0-ee98abe0f573": { "min_stack_version": "8.3", @@ -5855,37 +6715,37 @@ "c88d4bd0-5649-4c52-87ea-9be59dbfbcf2": { "min_stack_version": "8.3", "rule_name": "Parent Process PID Spoofing", - "sha256": "c3dac03f556b89e88f147aed56f297767b5d0a9110cdf317ef621032e9aae739", + "sha256": "e1789b1189d98d1c0dd3e14aef3df67f994982f60001aab44c9785a8bab9bb3a", "type": "eql", - "version": 104 + "version": 105 }, "c8935a8b-634a-4449-98f7-bb24d3b2c0af": { "min_stack_version": "8.3", "rule_name": "Potential Linux Ransomware Note Creation Detected", - "sha256": "6c899bbc998ab3b8926434c8838a0567b3e9daab6ac42337689be77fa96f4c6b", + "sha256": "d16c1571f4991e8257fc206ff4e66afbab3d14994c0b00534ab992bd948529be", "type": "eql", - "version": 5 + "version": 6 }, "c8b150f0-0164-475b-a75e-74b47800a9ff": { "min_stack_version": "8.3", "rule_name": "Suspicious Startup Shell Folder Modification", - "sha256": "d820917b8b190283034007d7db8ba4ac8ef6bd82e9d9d8a9f256976c0fa2623d", + "sha256": "1d46ce00fb8fa393c7b0122644b3e0a367bb2ce96e5767209a2e3f101b552c52", "type": "eql", - "version": 107 + "version": 108 }, "c8cccb06-faf2-4cd5-886e-2c9636cfcb87": { "min_stack_version": "8.3", "rule_name": "Disabling Windows Defender Security Settings via PowerShell", - "sha256": "dfa996d0665851351caf73bca44bb19208342678d818aff4cc77005b0092ca67", + "sha256": "a2dad54c59a4df7c89caa5e11af6d9425532fe82b26ef1c0588f4d7b835f71ec", "type": "eql", - "version": 106 + "version": 107 }, "c9482bfa-a553-4226-8ea2-4959bd4f7923": { "min_stack_version": "8.3", "rule_name": "Potential Masquerading as Communication Apps", - "sha256": "1d87bf52f955049b3e1220e65c69464b5d6c21362b8762df0b397d412b1537ee", + "sha256": "a5e68609def010ae4cea5c31b29ec9740ce793360ee2d0c8995ce5c93286ed58", "type": "eql", - "version": 3 + "version": 4 }, "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa": { "min_stack_version": "8.3", @@ -5904,9 +6764,9 @@ "ca98c7cf-a56e-4057-a4e8-39603f7f0389": { "min_stack_version": "8.4", "rule_name": "Unsigned DLL Side-Loading from a Suspicious Folder", - "sha256": "94fbed29b0713d997d61575509179ec8a3aaf3580b4c2661a2a42ef4e7e50aef", + "sha256": "cbc3f42a7bcbc551c94f4915bbf898b210a4747c014608e39f4a2a12501d1682", "type": "eql", - "version": 4 + "version": 5 }, "cab4f01c-793f-4a54-a03e-e5d85b96d7af": { "rule_name": "Auditd Login from Forbidden Location", @@ -5926,9 +6786,9 @@ } }, "rule_name": "Abnormal Process ID or Lock File Created", - "sha256": "16d0a37c5a0c0c7de7d31afcbfae78cadf1e1c87ed0eb87f347d3c6a44b1ae00", + "sha256": "5f9d6f9747305b2a9d59f1c2bb89ec12610c7490a57f1ccb24de236f42839d9b", "type": "new_terms", - "version": 209 + "version": 210 }, "cad4500a-abd7-4ef3-b5d3-95524de7cfe1": { "min_stack_version": "8.4", @@ -5966,6 +6826,13 @@ "type": "query", "version": 104 }, + "cc653d77-ddd2-45b1-9197-c75ad19df66c": { + "min_stack_version": "8.9", + "rule_name": "Potential Data Exfiltration Activity to an Unusual IP Address", + "sha256": "6be5434c46b81e00bf29a5b3c08506bb5fefe291cfffe9666594851bd81d5007", + "type": "machine_learning", + "version": 1 + }, "cc6a8a20-2df2-11ed-8378-f661ea17fbce": { "min_stack_version": "8.4", "previous": { @@ -5990,11 +6857,20 @@ "version": 104 }, "cc92c835-da92-45c9-9f29-b4992ad621a0": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Attempt to Deactivate an Okta Policy Rule", + "sha256": "ed2062f991db0a0dce267846fe8363883628421221166f8246b4924828f02999", + "type": "query", + "version": 107 + } + }, "rule_name": "Attempt to Deactivate an Okta Policy Rule", "sha256": "b478201ba15dcd2c82b79fa58c4c175e917d642653a86009ecf389042156d85c", "type": "query", - "version": 106 + "version": 207 }, "ccc55af4-9882-4c67-87b4-449a7ae8079c": { "min_stack_version": "8.3", @@ -6004,11 +6880,20 @@ "version": 105 }, "cd16fb10-0261-46e8-9932-a0336278cdbe": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Modification or Removal of an Okta Application Sign-On Policy", + "sha256": "32c09cb649d10eb0d58645624f6534db9c40073e42552b0381f5b414e9c58bb6", + "type": "query", + "version": 106 + } + }, "rule_name": "Modification or Removal of an Okta Application Sign-On Policy", "sha256": "06745b57fd263169ae59b2d860b840a6deb4a911da424fa9267827a54e77c61f", "type": "query", - "version": 105 + "version": 206 }, "cd4d5754-07e1-41d4-b9a5-ef4ea6a0a126": { "rule_name": "Socat Process Activity", @@ -6026,9 +6911,9 @@ "cd66a5af-e34b-4bb0-8931-57d0a043f2ef": { "min_stack_version": "8.3", "rule_name": "Kernel Module Removal", - "sha256": "06acdf4e4f36bf4d2e6e3f0d424b81264fc5262e89ef2db45dae483404ffce09", + "sha256": "7b92ec2e6a2290e49b0168c42351731b5a03508b59cbed4d0dd0127f6ab8ded1", "type": "eql", - "version": 105 + "version": 106 }, "cd82e3d6-1346-4afd-8f22-38388bbf34cb": { "min_stack_version": "8.3", @@ -6038,18 +6923,36 @@ "version": 1 }, "cd89602e-9db0-48e3-9391-ae3bf241acd8": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Deactivate MFA for an Okta User Account", + "sha256": "173487533fb84ffd2bbd8598bf0ac4f518f295cc6715c381743a3fe6d0f14ec7", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Deactivate MFA for an Okta User Account", "sha256": "21e5d78749220436e967eeeb044dd1f1f605e2586c03e609b54561405c40cccf", "type": "query", - "version": 105 + "version": 206 }, "cdbebdc1-dc97-43c6-a538-f26a20c0a911": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Okta User Session Impersonation", + "sha256": "36a5fb5b929045a84f302c057459e3b5e6eb50cb409fc5a9edf6cdcd47f30ee5", + "type": "query", + "version": 107 + } + }, "rule_name": "Okta User Session Impersonation", "sha256": "0a3253294eddbc09d843b81fe8f461f26e5b01e8456dc88dbce7c79923ff93b7", "type": "query", - "version": 106 + "version": 207 }, "cde1bafa-9f01-4f43-a872-605b678968b0": { "min_stack_version": "8.3", @@ -6061,16 +6964,16 @@ "ce64d965-6cb0-466d-b74f-8d2c76f47f05": { "min_stack_version": "8.3", "rule_name": "New ActiveSyncAllowedDeviceID Added via PowerShell", - "sha256": "e749e4d6a22d62d8564e36ff162cddb0342351273f7ae3f914f1781e4a6757e0", + "sha256": "2abbf97e21f0197022ef274f0c7aaf1326d6645628f586e1bbc7e75dd4bf6dac", "type": "eql", - "version": 105 + "version": 106 }, "cf53f532-9cc9-445a-9ae7-fced307ec53c": { "min_stack_version": "8.3", "rule_name": "Cobalt Strike Command and Control Beacon", - "sha256": "ae06529dfc51404f2a14651c780e0d62070bf088490bbb3215fdefb56904c4f2", + "sha256": "ddb4b9d7e2f95d26c85ab37fb9696c58aa1f937e5f4788214b8711b988206967", "type": "query", - "version": 104 + "version": 105 }, "cf549724-c577-4fd6-8f9b-d1b8ec519ec0": { "min_stack_version": "8.4", @@ -6109,12 +7012,19 @@ "type": "eql", "version": 108 }, + "cffbaf47-9391-4e09-a83c-1f27d7474826": { + "min_stack_version": "8.3", + "rule_name": "Archive File with Unusual Extension", + "sha256": "6fc1f60a466fb9cafbd52086ffba78f59d5ba996e6301563a12e09205b193e84", + "type": "eql", + "version": 1 + }, "d00f33e7-b57d-4023-9952-2db91b1767c4": { "min_stack_version": "8.3", "rule_name": "Namespace Manipulation Using Unshare", - "sha256": "62f6fba73304cb10595e4f538a276512b741e0029111d72087049753411361eb", + "sha256": "400a4ff29714ab2561d2a413f2f404116f8fe1067cb678f32d05daa204ee8316", "type": "eql", - "version": 6 + "version": 7 }, "d0b0f3ed-0b37-44bf-adee-e8cb7de92767": { "min_stack_version": "8.8", @@ -6126,23 +7036,23 @@ "d0e159cf-73e9-40d1-a9ed-077e3158a855": { "min_stack_version": "8.3", "rule_name": "Registry Persistence via AppInit DLL", - "sha256": "ec194a453dd3acbf1dffd2e109f77cbbc7051fdfa80409701304809ce5654c43", + "sha256": "c206dc61a4c2ae0d1f412a63bcffc413ce72bb6de4d4c86c670d3c066dd1662e", "type": "eql", - "version": 105 + "version": 106 }, "d117cbb4-7d56-41b4-b999-bdf8c25648a0": { "min_stack_version": "8.3", "rule_name": "Symbolic Link to Shadow Copy Created", - "sha256": "da76314ab374a374b6612165cb783f7d25612235f241744919149cb6d00af975", + "sha256": "077587010e7e194ab3d20e99f290d4a9813931fa3a4c1f4bd01f8a875b0a274a", "type": "eql", - "version": 106 + "version": 107 }, "d12bac54-ab2a-4159-933f-d7bcefa7b61d": { "min_stack_version": "8.3", "rule_name": "Expired or Revoked Driver Loaded", - "sha256": "58dd943fa10c8dc106e4f561c6a5755a555d7dd1116a6e82a02678f77be051f4", + "sha256": "bcc8530ce8aa18d4efbc4c6c3709e6308cacb5408758aa722e8a7c30dca27138", "type": "eql", - "version": 2 + "version": 3 }, "d197478e-39f0-4347-a22f-ba654718b148": { "min_stack_version": "8.3", @@ -6167,16 +7077,16 @@ "d31f183a-e5b1-451b-8534-ba62bca0b404": { "min_stack_version": "8.3", "rule_name": "Disabling User Account Control via Registry Modification", - "sha256": "73e5e14af530fc3c0ff1a000b5b32bc30097045766025d6a7240dc31794faa7e", + "sha256": "52bed23a3a6e8d13a93def9f01fc3f4de6094c7cbd2b55eb10637d659a556dd1", "type": "eql", - "version": 106 + "version": 107 }, "d331bbe2-6db4-4941-80a5-8270db72eb61": { "min_stack_version": "8.3", "rule_name": "Clearing Windows Event Logs", - "sha256": "14a1097b7ee5b1d73b9dd86e6c7326ea224be99416f6f947d03c968723badf8c", + "sha256": "8ab63a4886ad2a72cbb3c1b616a3f462298f7cc74de154654064c96b035d343e", "type": "eql", - "version": 107 + "version": 108 }, "d33ea3bf-9a11-463e-bd46-f648f2a0f4b1": { "min_stack_version": "8.3", @@ -6200,11 +7110,20 @@ "version": 104 }, "d48e1c13-4aca-4d1f-a7b1-a9161c0ad86f": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Attempt to Delete an Okta Application", + "sha256": "ec2d2014d13ce312c51e80554c30af695049e703918b7f1b19da53f58154d6f7", + "type": "query", + "version": 105 + } + }, "rule_name": "Attempt to Delete an Okta Application", "sha256": "ed729064054fe9156b2909c7970d2e38aa98c9ee0337d7f86e1ad0d8f28300c6", "type": "query", - "version": 104 + "version": 205 }, "d49cc73f-7a16-4def-89ce-9fc7127d7820": { "min_stack_version": "8.3", @@ -6230,16 +7149,16 @@ "d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f": { "min_stack_version": "8.3", "rule_name": "Linux init (PID 1) Secret Dump via GDB", - "sha256": "a386bc0314dc614dce09c10f76f04e239c85cffb8e305a1a37dc816fe8d0e466", + "sha256": "f5c2c64714e19cc3d5437f0039d3baa83ae9aa8fd5af5dcbd5b6655156c6e9af", "type": "eql", - "version": 1 + "version": 2 }, "d55436a8-719c-445f-92c4-c113ff2f9ba5": { "min_stack_version": "8.3", "rule_name": "Potential Privilege Escalation via UID INT_MAX Bug Detected", - "sha256": "351666156e6d77e8c9c195311cd45ba8c31b9e97ea0fd1503c48c15a776c1918", + "sha256": "3c95ccf8f67a50f03ac411052a8a2da81d0483634ff43782835b20a2eee49275", "type": "eql", - "version": 2 + "version": 3 }, "d563aaba-2e72-462b-8658-3e5ea22db3a6": { "min_stack_version": "8.3", @@ -6249,11 +7168,20 @@ "version": 104 }, "d5d86bf5-cf0c-4c06-b688-53fdc072fdfd": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Delete an Okta Policy Rule", + "sha256": "ef00abb177343a787a119303eaa0cb71aef503d40d309b2699d05fe0178157a6", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Delete an Okta Policy Rule", "sha256": "537f87bddcb81e9ba189e215fbb67e630dc5362f718cb3d8e57f843bd129033a", "type": "query", - "version": 105 + "version": 206 }, "d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc": { "min_stack_version": "8.3", @@ -6263,11 +7191,20 @@ "version": 105 }, "d624f0ae-3dd1-4856-9aad-ccfe4d4bfa17": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS CloudWatch Log Stream Deletion", + "sha256": "e7f7445facc4da1f84ee331f6dbbf22337e319df0727349ff958c0f62154fd1f", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS CloudWatch Log Stream Deletion", "sha256": "5bc55e01a217a6d8069b08e636d1e12080f2a96b645cc68f8f33806d04a820ee", "type": "query", - "version": 107 + "version": 208 }, "d62b64a8-a7c9-43e5-aee3-15a725a794e7": { "min_stack_version": "8.3", @@ -6306,9 +7243,9 @@ "d72e33fc-6e91-42ff-ac8b-e573268c5a87": { "min_stack_version": "8.3", "rule_name": "Command Execution via SolarWinds Process", - "sha256": "e5a39260fe132207d539ea518652001adadec98c3bbe9ddaff7d7e7b0e673a57", + "sha256": "be781bb6c568f6e3338fe8a85423ad7b2bed67673e71befc92524a519bf29602", "type": "eql", - "version": 106 + "version": 107 }, "d743ff2a-203e-4a46-a3e3-40512cfe8fbb": { "min_stack_version": "8.3", @@ -6327,9 +7264,9 @@ "d76b02ef-fc95-4001-9297-01cb7412232f": { "min_stack_version": "8.3", "rule_name": "Interactive Terminal Spawned via Python", - "sha256": "23765713e12113ddb20663a6b929ed119d23f9106635fe4998ce6990dd394d97", + "sha256": "c44526d9a91a1fd72764e5afb5ad5c6a99415825884efde1516a72afc827756a", "type": "eql", - "version": 107 + "version": 108 }, "d79c4b2a-6134-4edd-86e6-564a92a933f9": { "min_stack_version": "8.3", @@ -6355,30 +7292,46 @@ "d8ab1ec1-feeb-48b9-89e7-c12e189448aa": { "min_stack_version": "8.3", "rule_name": "Untrusted Driver Loaded", - "sha256": "c5ce1faffd687af5423c4bad755a8d5d182a6c74fde100b49092067a43111e70", + "sha256": "aa9adda1ac8dfe9c91e83c7741e046bb1553fda39b7e023d70c58e86fa012e11", "type": "eql", - "version": 5 + "version": 6 }, "d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS IAM Deactivation of MFA Device", + "sha256": "3c501df177ec97cc6f46663425f4c04cb979694688cd3bfad27f03a0d8a2ac53", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS IAM Deactivation of MFA Device", "sha256": "7e7bcfe14adab55f0ac9ab6478a826ff0dff7b31efe686b94a1bbf30d730bdd6", "type": "query", - "version": 107 + "version": 208 }, "d99a037b-c8e2-47a5-97b9-170d076827c4": { "min_stack_version": "8.3", "rule_name": "Volume Shadow Copy Deletion via PowerShell", - "sha256": "638b38528aaa1d362737de0ee6c2c010913f44c8179a2ac928dbedc9473049f6", + "sha256": "8442e8cbb922de0f547562302bde985f3e343662547902ae1b3ad81817991b14", "type": "eql", - "version": 106 + "version": 107 }, "da7733b1-fe08-487e-b536-0a04c6d8b0cd": { "min_stack_version": "8.3", "rule_name": "Code Signing Policy Modification Through Registry", - "sha256": "8376f30e9c1abd833e2b39242f04ba3f296fe0f2c153e3feda039d77b73ffd6f", + "sha256": "2102e91dda480a20979378bce1f9ce3243b54439c2ac1961ad795862fe956692", "type": "eql", - "version": 5 + "version": 6 + }, + "da7f5803-1cd4-42fd-a890-0173ae80ac69": { + "min_stack_version": "8.9", + "rule_name": "Machine Learning Detected a DNS Request With a High DGA Probability Score", + "sha256": "fd0e143d1c3b97e0d0f5faf7c2574e3a80509905c6d6564cc15eadb49661058d", + "type": "query", + "version": 1 }, "da87eee1-129c-4661-a7aa-57d0b9645fad": { "min_stack_version": "8.3", @@ -6410,9 +7363,9 @@ "db65f5ba-d1ef-4944-b9e8-7e51060c2b42": { "min_stack_version": "8.3", "rule_name": "Network-Level Authentication (NLA) Disabled", - "sha256": "b778970c6f8ec04e3dbcf851f3553e72e19420cdbf1181efb2a8d360ec4f49a2", + "sha256": "f4edf52a98e83ab010153cdffb7067610814b7fcc0414bb5e8dcee5bf8d0d3ff", "type": "eql", - "version": 1 + "version": 2 }, "db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd": { "min_stack_version": "8.3", @@ -6431,9 +7384,9 @@ "dc0b7782-0df0-47ff-8337-db0d678bdb66": { "min_stack_version": "8.3", "rule_name": "Suspicious Content Extracted or Decompressed via Funzip", - "sha256": "f64d050e90fd179771887f3ae5d3ecdd6d9c638572d6ecb8cb513fddcd5496df", + "sha256": "e4df76ec7b5df39c1969e559f1a6da83fa65a42ce5b7d0309e543137738e41d0", "type": "eql", - "version": 2 + "version": 3 }, "dc672cb7-d5df-4d1f-a6d7-0841b1caafb9": { "rule_name": "Threat Intel Filebeat Module (v7.x) Indicator Match", @@ -6444,23 +7397,32 @@ "dc71c186-9fe4-4437-a4d0-85ebb32b8204": { "min_stack_version": "8.3", "rule_name": "Potential Hidden Process via Mount Hidepid", - "sha256": "df8a6dcbb0d179f109c810c8d819c0e48c62c8280a2c6196d00ba951b1486594", + "sha256": "d42dea9b11a475bd84ac3a3f2a7556720a15eec56ff92168c87ed712e91e8908", "type": "eql", - "version": 3 + "version": 4 }, "dc9c1f74-dac3-48e3-b47f-eb79db358f57": { "min_stack_version": "8.3", "rule_name": "Volume Shadow Copy Deletion via WMIC", - "sha256": "2ec7ebca77b749a6e4385185ffcbdbc71c0c3a9600b7599bb7b6462c6d84a28a", + "sha256": "068a220aff143f426d32e403fb68a377e120e375f657e84217c3eb4f399e543f", "type": "eql", - "version": 106 + "version": 107 }, "dca28dee-c999-400f-b640-50a081cc0fd1": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "Unusual Country For an AWS Command", + "sha256": "09aabd7cf1fd572c2266143f903d21cbaedb757f619cc17b5f2c78b74e046946", + "type": "machine_learning", + "version": 108 + } + }, "rule_name": "Unusual Country For an AWS Command", "sha256": "e6e99ee2cb2084337de3331bcf945c7714a1fc79df6bc880c40dcb399e87a561", "type": "machine_learning", - "version": 107 + "version": 208 }, "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e": { "min_stack_version": "8.3", @@ -6479,9 +7441,9 @@ "ddab1f5f-7089-44f5-9fda-de5b11322e77": { "min_stack_version": "8.3", "rule_name": "NullSessionPipe Registry Modification", - "sha256": "cdf948e2a073cb6319fa302acc7b0fc8a11477746659be69cff0c9b7860403b8", + "sha256": "6ff22a837ebb0aeecf0c358977ae439d6e5c872e7d002a5a13622b00638fa02a", "type": "eql", - "version": 105 + "version": 106 }, "de9bd7e0-49e9-4e92-a64d-53ade2e66af1": { "min_stack_version": "8.3", @@ -6493,9 +7455,9 @@ "debff20a-46bc-4a4d-bae5-5cdd14222795": { "min_stack_version": "8.3", "rule_name": "Base16 or Base32 Encoding/Decoding Activity", - "sha256": "0ec40a6ffaf45b8d92ca2b163b9aabf5bde1a0fbb801e77ab931a36571295fb1", + "sha256": "e1754aece5bca9de7f3a297a9ebcfde160a4c48fdba1042e55a503c43af3a487", "type": "query", - "version": 105 + "version": 106 }, "ded09d02-0137-4ccc-8005-c45e617e8d4c": { "min_stack_version": "8.6", @@ -6516,9 +7478,9 @@ "df0fd41e-5590-4965-ad5e-cd079ec22fa9": { "min_stack_version": "8.6", "rule_name": "First Time Seen Driver Loaded", - "sha256": "e35873c4c836a040e5f558474966d7bd8b224776bcebab71cd3db0279a1068d2", + "sha256": "ad243a0040fbf3b300d379e356e6d3eb10209a2132942ac2f4e08962b1e8bd79", "type": "new_terms", - "version": 5 + "version": 6 }, "df197323-72a8-46a9-a08e-3f5b04a4a97a": { "min_stack_version": "8.3", @@ -6537,9 +7499,9 @@ "df6f62d9-caab-4b88-affa-044f4395a1e0": { "min_stack_version": "8.3", "rule_name": "Dynamic Linker Copy", - "sha256": "3e2bd8f151616982adae6eeff5311584831c41100d151b5327e9a39e41354ef4", + "sha256": "4c3f4b8b94c3abf50fada6c7104d6fcffb6126ad61920c98219b8ca2d1f7af00", "type": "eql", - "version": 104 + "version": 105 }, "df7fda76-c92b-4943-bc68-04460a5ea5ba": { "min_stack_version": "8.4", @@ -6563,6 +7525,13 @@ "type": "query", "version": 100 }, + "e00b8d49-632f-4dc6-94a5-76153a481915": { + "min_stack_version": "8.3", + "rule_name": "Delayed Execution via Ping", + "sha256": "dea7cf4add6220cd27ddb9f1a641b95436204b87ca0fca1c18dc903d50ce57a4", + "type": "eql", + "version": 1 + }, "e02bd3ea-72c6-4181-ac2b-0f83d17ad969": { "min_stack_version": "8.3", "rule_name": "Azure Firewall Policy Deletion", @@ -6585,11 +7554,20 @@ "version": 5 }, "e08ccd49-0380-4b2b-8d71-8000377d6e49": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "Attempts to Brute Force an Okta User Account", + "sha256": "71bc21a2e39ae429903f27a300a650a34aed1adfba8e5ce63f527c8362e23d02", + "type": "threshold", + "version": 107 + } + }, "rule_name": "Attempts to Brute Force an Okta User Account", "sha256": "10ee903471646d3de3429f99b45cf5e5d7fadc3fda75e3d87f0d1f495d30f511", "type": "threshold", - "version": 106 + "version": 207 }, "e0cc3807-e108-483c-bf66-5a4fbe0d7e89": { "min_stack_version": "8.3", @@ -6613,32 +7591,57 @@ "version": 102 }, "e12c0318-99b1-44f2-830c-3a38a43207ca": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Route Table Created", + "sha256": "7bc47ab3f6abaaa3ab9719f0b5584578bde76d5e46e45c4f5930b55727fde835", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Route Table Created", "sha256": "4081dda0ac65323a45109124e0222f68584e912ecdc216ad1e2f5b8f9f431afc", "type": "query", - "version": 104 + "version": 205 }, "e14c5fd7-fdd7-49c2-9e5b-ec49d817bc8d": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Cluster Creation", + "sha256": "1028d9d315c9b25af760a4d81b28115f4bc2ea1653f08740433bc44c0c49ecbf", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Cluster Creation", "sha256": "064737df50105c6e8c5336eb8537b218f80ef6e29e079214fe8dca37dc5bda32", "type": "query", - "version": 104 + "version": 205 }, "e19e64ee-130e-4c07-961f-8a339f0b8362": { "min_stack_version": "8.3", "rule_name": "Connection to External Network via Telnet", - "sha256": "812d614780faf4725c6f1f5361fd6e47e40c2ea93429a55d3e577c3517074577", + "sha256": "ecd74e5b4a0d9320b567ccff15b0551b10812d52a6a99e120eb4e09dc3c70a70", "type": "eql", - "version": 104 + "version": 105 + }, + "e1db8899-97c1-4851-8993-3a3265353601": { + "min_stack_version": "8.9", + "rule_name": "Potential Data Exfiltration Activity to an Unusual ISO Code", + "sha256": "1ce0e6ef09a67c9f0018cebdedc41c09e0f2d980c0892d2c58f1e17af536bd70", + "type": "machine_learning", + "version": 1 }, "e2258f48-ba75-4248-951b-7c885edf18c2": { "min_stack_version": "8.3", "rule_name": "Suspicious Mining Process Creation Event", - "sha256": "d5d199aba7de4375e54e1a420264755c1e6c6e2326dabf9ca76f2cd5285ebe46", + "sha256": "c283a96f0e6778b4047079842cb8724e31caef3444301c6475256a53b012ee57", "type": "eql", - "version": 3 + "version": 4 }, "e26aed74-c816-40d3-a810-48d6fbd8b2fd": { "min_stack_version": "8.3", @@ -6650,16 +7653,25 @@ "e26f042e-c590-4e82-8e05-41e81bd822ad": { "min_stack_version": "8.3", "rule_name": "Suspicious .NET Reflection via PowerShell", - "sha256": "619ca917a538026a7832ad49ce85327632de2c6218731727c03f1492ef67e712", + "sha256": "8c840abd0eed39efbf4517ceb247d5a1e29c14df891f7fc68b9c8ca19af732fa", "type": "query", - "version": 108 + "version": 109 }, "e2a67480-3b79-403d-96e3-fdd2992c50ef": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS Management Console Root Login", + "sha256": "b9dd3e3ff50478a62eb78a03bd6f15b075d2c8b5205f36afb4bb4c84ec2aea89", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS Management Console Root Login", "sha256": "c4f8568aee037cc76372958fdfc1556649341e70f4d8ffc9a8a3f8c1e5fbe0e6", "type": "query", - "version": 107 + "version": 208 }, "e2dc8f8c-5f16-42fa-b49e-0eb8057f7444": { "min_stack_version": "8.3", @@ -6678,9 +7690,9 @@ "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2": { "min_stack_version": "8.3", "rule_name": "Suspicious Process Execution via Renamed PsExec Executable", - "sha256": "7326c0fdf7b88869ad1306d85488813f482b3ac72e2d30e276978b2d064c29b5", + "sha256": "f4aa9648ae148430d56ec66b1b05383eff95f446f9d746fa618a5fd5d74b932d", "type": "eql", - "version": 107 + "version": 108 }, "e2fb5b18-e33c-4270-851e-c3d675c9afcd": { "min_stack_version": "8.3", @@ -6697,11 +7709,20 @@ "version": 107 }, "e3c27562-709a-42bd-82f2-3ed926cced19": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Route53 private hosted zone associated with a VPC", + "sha256": "dd9a314d7acf050b51fec079eb2ff4d0667d2954a8fe4eee7a86081d7971db12", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Route53 private hosted zone associated with a VPC", "sha256": "58bf1f2fc9acd22be3c161424a77c2a213cf1401372313a2272d73d6af866d41", "type": "query", - "version": 104 + "version": 205 }, "e3c5d5cb-41d5-4206-805c-f30561eae3ac": { "min_stack_version": "8.3", @@ -6720,16 +7741,25 @@ "e3e904b3-0a8e-4e68-86a8-977a163e21d3": { "min_stack_version": "8.3", "rule_name": "Persistence via KDE AutoStart Script or Desktop File Modification", - "sha256": "ac660618b2f53220fa549edf8c4bf12df44b42b26daed8102d9f6cd69d0340f7", + "sha256": "47990704fcf218a068f07339d376b36fe1ff72c831754b08f0dffed5768cc04d", "type": "eql", - "version": 106 + "version": 107 }, "e48236ca-b67a-4b4e-840c-fdc7782bc0c3": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Modify an Okta Network Zone", + "sha256": "5f65ddaac1e8431e60917074c8cb8ead43d51ca2475c63ef74c89e0b558c3456", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Modify an Okta Network Zone", "sha256": "6d57260382880fab2e20021bd0235b13974bf1bde3fcdb2fe4b85484ea80f4c6", "type": "query", - "version": 105 + "version": 206 }, "e4e31051-ee01-4307-a6ee-b21b186958f4": { "min_stack_version": "8.3", @@ -6741,9 +7771,9 @@ "e514d8cd-ed15-4011-84e2-d15147e059f1": { "min_stack_version": "8.3", "rule_name": "Kerberos Pre-authentication Disabled for User", - "sha256": "f58e148fb90ab12de044fc7afa0a2778b71ecd8643082310872048c0960b54d4", + "sha256": "ff07330e7b280ebe26aff63e3c933ca68bc9e57095f06822a1ce1a766f8aa2d4", "type": "query", - "version": 107 + "version": 108 }, "e555105c-ba6d-481f-82bb-9b633e7b4827": { "min_stack_version": "8.4", @@ -6770,9 +7800,9 @@ "e6c1a552-7776-44ad-ae0f-8746cc07773c": { "min_stack_version": "8.3", "rule_name": "Bash Shell Profile Modification", - "sha256": "89a6e5c6d2b9b24839bad3982fe4350838838f91a099081af2d9e17bbd48eb02", + "sha256": "bc03a7affdb0db7aca8cb74b550750403c0cc22f1f31640dabbcf506dd04b2b3", "type": "query", - "version": 103 + "version": 104 }, "e6c98d38-633d-4b3e-9387-42112cd5ac10": { "min_stack_version": "8.3", @@ -6782,11 +7812,20 @@ "version": 104 }, "e6e3ecff-03dd-48ec-acbd-54a04de10c68": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Possible Okta DoS Attack", + "sha256": "0068f7eda335ee0ee3e6452f9a91166dd50e098862de1791f4e6b6bd0ff4a391", + "type": "query", + "version": 105 + } + }, "rule_name": "Possible Okta DoS Attack", "sha256": "065c5e51d3541a24ee401d4b9da8787e8fb858c1e89938d7f7fa8daf46e7199e", "type": "query", - "version": 104 + "version": 205 }, "e6e8912f-283f-4d0d-8442-e0dcaf49944b": { "min_stack_version": "8.3", @@ -6802,6 +7841,13 @@ "type": "query", "version": 104 }, + "e707a7be-cc52-41ac-8ab3-d34b38c20005": { + "min_stack_version": "8.3", + "rule_name": "Potential Credential Access via Memory Dump File Creation", + "sha256": "49debe62710e167c237de800f3dd2ce6ad4a3f4a6effd957439d576770b4e7c9", + "type": "eql", + "version": 1 + }, "e7125cea-9fe1-42a5-9a05-b0792cf86f5a": { "min_stack_version": "8.3", "rule_name": "Execution of Persistent Suspicious Program", @@ -6828,37 +7874,46 @@ "e74d645b-fec6-431e-bf93-ca64a538e0de": { "min_stack_version": "8.3", "rule_name": "Unusual Process For MSSQL Service Accounts", - "sha256": "3b88ce7678e0afd9133e4614123484e05b3c652f2ee1b555271860a540e9e01a", + "sha256": "b79eae658a0dc89978d022131f60766565b9d713cf71cfa900e632da05719fe3", "type": "eql", - "version": 1 + "version": 2 }, "e7cb3cfd-aaa3-4d7b-af18-23b89955062c": { "min_stack_version": "8.3", "rule_name": "Potential Linux Credential Dumping via Unshadow", - "sha256": "6b4158b68c196337a5ca798c23c4e99e1f5b63dcc09404ce703310ffa3115658", + "sha256": "9dabc489226c779aadc8aebd27fd06248863464f8c3eb77f8e3e65ea9de31581", "type": "eql", - "version": 4 + "version": 5 }, "e7cd5982-17c8-4959-874c-633acde7d426": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Route Table Modified or Deleted", + "sha256": "aac5e30f0f52cc491d255e93c3f1f83cdb0547f9f20b8fe3376704aee6c6f730", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Route Table Modified or Deleted", "sha256": "2199bfaa82c73c0e3d8e7c4dd8d7df67b438163716298173157240784ea80fdc", "type": "query", - "version": 104 + "version": 205 }, "e8571d5f-bea1-46c2-9f56-998de2d3ed95": { "min_stack_version": "8.3", "rule_name": "Service Control Spawned via Script Interpreter", - "sha256": "9d7d295720f93607b0c637e791d1135a828f9a60edfd04a13aea1c2f444cddfb", + "sha256": "2894b45c8036eb38c332ca6f58cdcc5e872a80caa4e846636d051be8a166fcfe", "type": "eql", - "version": 106 + "version": 107 }, "e86da94d-e54b-4fb5-b96c-cecff87e8787": { "min_stack_version": "8.3", "rule_name": "Installation of Security Support Provider", - "sha256": "07f742804dcc4362c3a6df0146ffd869e3e92a5e39ed19fbc676e1a205762fca", + "sha256": "05e809fb643c5c0b932f08cf325d5b980c1be26c2322a33497bf7931a54612bb", "type": "eql", - "version": 104 + "version": 105 }, "e88d1fe9-b2f4-48d4-bace-a026dc745d4b": { "min_stack_version": "8.3", @@ -6868,32 +7923,66 @@ "version": 4 }, "e9001ee6-2d00-4d2f-849e-b8b1fb05234c": { - "min_stack_version": "8.4", + "min_stack_version": "8.6", + "previous": { + "8.4": { + "max_allowable_version": 102, + "rule_name": "Suspicious System Commands Executed by Previously Unknown Executable", + "sha256": "3a05a24c654cdb42c8718f7cf97e55b13d9be01f97cfd17a78db8f616168fa80", + "type": "new_terms", + "version": 3 + } + }, "rule_name": "Suspicious System Commands Executed by Previously Unknown Executable", - "sha256": "386862fe4e944388b9eada8008e45520c98413131236b3c1dbdffd72bd7b2db3", + "sha256": "b2bf47b2d754b97d1201f5d927c49421ceb71609ac667f07c240495f839cd6be", "type": "new_terms", - "version": 2 + "version": 103 }, "e90ee3af-45fc-432e-a850-4a58cf14a457": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 206, + "rule_name": "High Number of Okta User Password Reset or Unlock Attempts", + "sha256": "94f8f87bf5279e92dae5e3f1a86adcc88c5e03a1ddc2d3ee3878b1ef488abd08", + "type": "threshold", + "version": 107 + } + }, "rule_name": "High Number of Okta User Password Reset or Unlock Attempts", "sha256": "bb06cc2e64669d793dd0ab51b8f596cf9ed9f9454f861ae51504837bb3552d10", "type": "threshold", - "version": 106 + "version": 207 }, "e919611d-6b6f-493b-8314-7ed6ac2e413b": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS EC2 VM Export Failure", + "sha256": "f5fbdb6dd8db185f84352432e56a887048b7d1bac9936d1c3a3944b9f5ed4d31", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS EC2 VM Export Failure", "sha256": "3d6439c0aa3958b93a6dddcf1bd5a4bd85a8a42ea1de077784cbcddffa9842dd", "type": "query", - "version": 104 + "version": 205 + }, + "e92c99b6-c547-4bb6-b244-2f27394bc849": { + "min_stack_version": "8.9", + "rule_name": "Spike in Bytes Sent to an External Device via Airdrop", + "sha256": "f4946a910d3c5cf165420c1f5768200c1484fdc853e0a53756994d7993255dd4", + "type": "machine_learning", + "version": 1 }, "e94262f2-c1e9-4d3f-a907-aeab16712e1a": { "min_stack_version": "8.3", "rule_name": "Unusual Executable File Creation by a System Critical Process", - "sha256": "2691fb427b7fddacc7927bc417d5dab77367c0f14203e072f86d3aefe7a62802", + "sha256": "0932a11d1af761dc69c880afac16d9f8543316e5b003ac9c7f31d6a1b903eb5b", "type": "eql", - "version": 107 + "version": 108 }, "e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb": { "min_stack_version": "8.3", @@ -6928,12 +8017,28 @@ "type": "query", "version": 100 }, + "ea09ff26-3902-4c53-bb8e-24b7a5d029dd": { + "min_stack_version": "8.9", + "rule_name": "Unusual Process Spawned by a Parent Process", + "sha256": "e0eb8a5cb723b6d21c3bd60ed9f2fbaa258b957aaf1c3ccb239075cb1bd9e3a2", + "type": "machine_learning", + "version": 1 + }, "ea248a02-bc47-4043-8e94-2885b19b2636": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS IAM Brute Force of Assume Role Policy", + "sha256": "d8fbba1e46a7add1e78c5e5e8efbbd07526667d98224a35765adf2574e4c6e80", + "type": "threshold", + "version": 108 + } + }, "rule_name": "AWS IAM Brute Force of Assume Role Policy", "sha256": "c03ce8fcb77809e7578333b7e52f0fe9d851c9f6687eb1a7d20a33e2b642ed3f", "type": "threshold", - "version": 107 + "version": 208 }, "eaa77d63-9679-4ce3-be25-3ba8b795e5fa": { "min_stack_version": "8.3", @@ -6973,9 +8078,9 @@ "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e": { "min_stack_version": "8.3", "rule_name": "Potential Disabling of SELinux", - "sha256": "b8f1ac64b7c560cb7647ffb41b0bcbedc7b257a7f316fcbeb491b84b7b09c94c", + "sha256": "039692bcb30d46067fc586c4ebcd04997a968d5c426694130fea5aeb0a48d46b", "type": "query", - "version": 105 + "version": 106 }, "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6": { "min_stack_version": "8.3", @@ -7012,12 +8117,28 @@ "type": "query", "version": 102 }, - "ecf2b32c-e221-4bd4-aa3b-c7d59b3bc01d": { + "ecd4857b-5bac-455e-a7c9-a88b66e56a9e": { "min_stack_version": "8.3", + "rule_name": "Executable File with Unusual Extension", + "sha256": "d740eda69b10b688372f488feab1a6e9af2a26122ee1f6af6de7612aa33706e8", + "type": "eql", + "version": 1 + }, + "ecf2b32c-e221-4bd4-aa3b-c7d59b3bc01d": { + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Instance/Cluster Stoppage", + "sha256": "507678779aec70fd7d8e6f87c97bad4456c69b88fbf5e1ef2ede267b6c6d356b", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Instance/Cluster Stoppage", "sha256": "ac0a0d9ae3dd952d42b9953594ccbb2e820c3b3754a613810c6568a3fb3205bc", "type": "query", - "version": 104 + "version": 205 }, "ed9ecd27-e3e6-4fd9-8586-7754803f7fc8": { "min_stack_version": "8.3", @@ -7029,16 +8150,25 @@ "eda499b8-a073-4e35-9733-22ec71f57f3a": { "min_stack_version": "8.3", "rule_name": "AdFind Command Activity", - "sha256": "84fe4ed20d10995793ab80c3edcadea3a2e6590b1c71d8b0f7ae5f3400276e36", + "sha256": "b3773d30c5a81754f182b5e16112b660ce51afc7217b471c07c135c92343561e", "type": "eql", - "version": 106 + "version": 107 }, "edb91186-1c7e-4db8-b53e-bfa33a1a0a8a": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 205, + "rule_name": "Attempt to Deactivate an Okta Application", + "sha256": "561500f4153a16fe94b06be9237be4ba8933a3192116af5ef57bdb83da24f973", + "type": "query", + "version": 106 + } + }, "rule_name": "Attempt to Deactivate an Okta Application", "sha256": "6015ee3b4d4c29fbd1e06ca5bb2947716089acffc92c07d1e1ef36a3aace0a7c", "type": "query", - "version": 105 + "version": 206 }, "edf8ee23-5ea7-4123-ba19-56b41e424ae3": { "min_stack_version": "8.3", @@ -7084,16 +8214,16 @@ "ef04a476-07ec-48fc-8f3d-5e1742de76d3": { "min_stack_version": "8.3", "rule_name": "BPF filter applied using TC", - "sha256": "dfcaee87ab5815bd4120fc20f1cfd41d481913aa1b077dd7e28539febe9bd5d9", + "sha256": "d3b6a041bc5f899f14ba0e350fbb36350e02d5800b1751b2bff3950a02bab9e4", "type": "eql", - "version": 105 + "version": 106 }, "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311": { "min_stack_version": "8.3", "rule_name": "Potential Linux Credential Dumping via Proc Filesystem", - "sha256": "421ac0a4b80d62b16f199e6f04b38b5b8c1c8dbed801722495c596321864b0fb", + "sha256": "fa04606235d591a3a18f27ac11497e0b0b3c0db64ac9d3cdae52dac5bebb9ca1", "type": "eql", - "version": 3 + "version": 4 }, "ef862985-3f13-4262-a686-5f357bbb9bc2": { "min_stack_version": "8.3", @@ -7102,6 +8232,13 @@ "type": "eql", "version": 107 }, + "ef8cc01c-fc49-4954-a175-98569c646740": { + "min_stack_version": "8.9", + "rule_name": "Potential Data Exfiltration Activity to an Unusual Destination Port", + "sha256": "ae2f3e60d6bf07e3ace4c7be1a9a199dc8b181ae4c472baa2f02f91eb86e6801", + "type": "machine_learning", + "version": 1 + }, "f036953a-4615-4707-a1ca-dc53bf69dcd5": { "min_stack_version": "8.3", "rule_name": "Unusual Child Processes of RunDLL32", @@ -7117,11 +8254,20 @@ "version": 104 }, "f06414a6-f2a4-466d-8eba-10f85e8abf71": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Administrator Role Assigned to an Okta User", + "sha256": "333aec880e8bd1653cea01f896e3df2e136839275bf1cffd71197ec4068129ba", + "type": "query", + "version": 105 + } + }, "rule_name": "Administrator Role Assigned to an Okta User", "sha256": "129a8d5f0cd2075e7fe6a38059a5ddcd26d18f1d6b9d8b93950bf60863671395", "type": "query", - "version": 104 + "version": 205 }, "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7": { "min_stack_version": "8.3", @@ -7147,9 +8293,9 @@ "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb": { "min_stack_version": "8.3", "rule_name": "Potential Remote Code Execution via Web Server", - "sha256": "acc6575e3fa6df0eabd86bf1fa2a16fdcf95a33f0b3c99ef35f473bee3cbea26", + "sha256": "9472c913dfa8869854d45e63066366097bc76d22561deba5f0332c0e764850d5", "type": "eql", - "version": 4 + "version": 5 }, "f1a6d0f4-95b8-11ed-9517-f661ea17fbcc": { "min_stack_version": "8.4", @@ -7175,9 +8321,9 @@ "f28e2be4-6eca-4349-bdd9-381573730c22": { "min_stack_version": "8.3", "rule_name": "Potential OpenSSH Backdoor Logging Activity", - "sha256": "c0d41a9640582655c35bbdf6fd4057c405ea4a82195c458393a2820c413ea5df", + "sha256": "5b99a39e1fe7e357d865152fc9bddaf95dbcdef3438bbdd9a2de4b9ef6351120", "type": "eql", - "version": 106 + "version": 107 }, "f2c7b914-eda3-40c2-96ac-d23ef91776ca": { "min_stack_version": "8.3", @@ -7194,11 +8340,20 @@ "version": 106 }, "f30f3443-4fbb-4c27-ab89-c3ad49d62315": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS RDS Instance Creation", + "sha256": "1b57c3c8d9066a43e2cf1493eb351327278a05bf30471e51460fc99b3134a1c5", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS RDS Instance Creation", "sha256": "25aeaebf372fd4e468e990590efe81685706f45ab5eb44bb246d187a16a8b6e0", "type": "query", - "version": 104 + "version": 205 }, "f33e68a4-bd19-11ed-b02f-f661ea17fbcc": { "min_stack_version": "8.4", @@ -7207,12 +8362,19 @@ "type": "eql", "version": 3 }, + "f3403393-1fd9-4686-8f6e-596c58bc00b4": { + "min_stack_version": "8.9", + "rule_name": "Machine Learning Detected a DNS Request Predicted to be a DGA Domain", + "sha256": "109d0c7e3887d7f898702bb931801365f78166bc37b58aa04f66b0e30101f41b", + "type": "query", + "version": 1 + }, "f3475224-b179-4f78-8877-c2bd64c26b88": { "min_stack_version": "8.3", "rule_name": "WMI Incoming Lateral Movement", - "sha256": "881b9fd8fe67814ac0e2fd46633b3d14bec837de65f947f3196690da517ec326", + "sha256": "05dfb891d848215da2bda7c42b5229022f92e80d8ee4f97ea007d57196cfd637", "type": "eql", - "version": 107 + "version": 108 }, "f37f3054-d40b-49ac-aa9b-a786c74c58b8": { "min_stack_version": "8.3", @@ -7231,23 +8393,23 @@ "f41296b4-9975-44d6-9486-514c6f635b2d": { "min_stack_version": "8.6", "rule_name": "Potential curl CVE-2023-38545 Exploitation", - "sha256": "9efdc32da856ea0ecfb495756ffd87148d34f4be5d42e19e9839782860cef853", + "sha256": "397ef632c840d0922b83d252b5b41db9cbaa48dbded3e4274d7b714ea636231b", "type": "eql", - "version": 1 + "version": 2 }, "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c": { "min_stack_version": "8.3", "rule_name": "Persistence via Microsoft Office AddIns", - "sha256": "6529bb3e9f2e7ba6334ccf83e73cb084a6d4a6b4754c82131a2b29b573db94fc", + "sha256": "292a400f924bdf495a355385c16ff53e68f9f3339a16f03722da0a67d20439f9", "type": "eql", - "version": 104 + "version": 105 }, "f494c678-3c33-43aa-b169-bb3d5198c41d": { "min_stack_version": "8.3", "rule_name": "Sensitive Privilege SeEnableDelegationPrivilege assigned to a User", - "sha256": "58fd8199f7eaa97b77809fbe7b9b19e44632eef4618a3a85d269f4c10fc65dda", + "sha256": "26b40ddcaa37e8f078da5fbfc2a20a67103717af9bed0188b9002a14836ffe5a", "type": "query", - "version": 107 + "version": 108 }, "f52362cd-baf1-4b6d-84be-064efc826461": { "rule_name": "Linux Restricted Shell Breakout via flock Shell evasion", @@ -7258,16 +8420,16 @@ "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73": { "min_stack_version": "8.3", "rule_name": "Suspicious Data Encryption via OpenSSL Utility", - "sha256": "4a1c0d919c79748efefe5321d5e6652f4806a90a6748a5fbb97472ba5c7b6479", + "sha256": "7c8538ccb98edd565c3e77089791a93f35d6fe22c6f6622b1b5830797dfce87b", "type": "eql", - "version": 2 + "version": 3 }, "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc": { "min_stack_version": "8.3", "rule_name": "Windows Script Executing PowerShell", - "sha256": "9c28b36b93bb14bdf7618dda4125499529113bf5a991135211322b859581d528", + "sha256": "137fe700650e80f99c3e810ffa7887f243a69e3fd36267afd3685955e5b3a7e4", "type": "eql", - "version": 106 + "version": 107 }, "f5488ac1-099e-4008-a6cb-fb638a0f0828": { "min_stack_version": "8.8", @@ -7279,15 +8441,29 @@ "f5861570-e39a-4b8a-9259-abd39f84cb97": { "min_stack_version": "8.3", "rule_name": "WRITEDAC Access on Active Directory Object", - "sha256": "1985348b300faecebbaac140fff23f888d5eac725cc209b01811dc5cc860b8b1", + "sha256": "9d093df26320c45b314e47dc2317d5b84a706d33b570f9b302014671f4b684de", "type": "query", - "version": 1 + "version": 2 }, "f59668de-caa0-4b84-94c1-3a1549e1e798": { "min_stack_version": "8.3", "rule_name": "WMIC Remote Command", - "sha256": "dc6e94a20b8f1618cea407e2ac25227adc96daf497e2c1b5b034408f0e1aa3c9", + "sha256": "e1ef94a11c4732f762e8f4e61014834b56c85ac0b9238a537e111d942fb12601", "type": "eql", + "version": 2 + }, + "f5c005d3-4e17-48b0-9cd7-444d48857f97": { + "min_stack_version": "8.3", + "rule_name": "Setcap setuid/setgid Capability Set", + "sha256": "05f3189fe09c5f5c72a44871e7af8a36a085d5f5642ee65deed333c490888820", + "type": "eql", + "version": 1 + }, + "f5d9d36d-7c30-4cdb-a856-9f653c13d4e0": { + "min_stack_version": "8.9", + "rule_name": "Suspicious Windows Process Cluster Spawned by a Parent Process", + "sha256": "d95530ac48c152547acc046bef874063d532e0a9f5f639803e3b525025209f22", + "type": "machine_learning", "version": 1 }, "f5fb4598-4f10-11ed-bdc3-0242ac120002": { @@ -7307,9 +8483,9 @@ "f63c8e3c-d396-404f-b2ea-0379d3942d73": { "min_stack_version": "8.3", "rule_name": "Windows Firewall Disabled via PowerShell", - "sha256": "0e7d1a785743f7bd0167dacf31665648afe6cc0921d859d611decdcf3ca2bf89", + "sha256": "23aef572b50810af907ee7bd6ef6657623f6592f933f9406a58dda38ccecb9d2", "type": "eql", - "version": 106 + "version": 107 }, "f675872f-6d85-40a3-b502-c0d2ef101e92": { "min_stack_version": "8.3", @@ -7340,11 +8516,20 @@ "version": 102 }, "f772ec8a-e182-483c-91d2-72058f76a44c": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 207, + "rule_name": "AWS CloudWatch Alarm Deletion", + "sha256": "c61b6a72d80df0fd58791ed1d3826f037ed108533807e6817a707d013f73e4bd", + "type": "query", + "version": 108 + } + }, "rule_name": "AWS CloudWatch Alarm Deletion", "sha256": "c58352df4a9adcf9259a2e3656fddae07215b10995a31acba7684366f084e0a9", "type": "query", - "version": 107 + "version": 208 }, "f7769104-e8f9-4931-94a2-68fc04eadec3": { "min_stack_version": "8.8", @@ -7363,9 +8548,9 @@ "f81ee52c-297e-46d9-9205-07e66931df26": { "min_stack_version": "8.3", "rule_name": "Microsoft Exchange Worker Spawning Suspicious Processes", - "sha256": "84af71d36b636e2785c85ee6e6b0dcfc90b6df18c844ba0627a5605b8aa892d5", + "sha256": "0e07c2995af6088f4c7f371ce44780cab7ffe75d215408752857ac720cea0465", "type": "eql", - "version": 104 + "version": 105 }, "f85ce03f-d8a8-4c83-acdc-5c8cd0592be7": { "min_stack_version": "8.3", @@ -7377,9 +8562,9 @@ "f874315d-5188-4b4a-8521-d1c73093a7e4": { "min_stack_version": "8.3", "rule_name": "Modification of AmsiEnable Registry Key", - "sha256": "9c50c505cf44d6eec05e8c2cc96a6569c7c14b193943425c21de51abbea9e5ca", + "sha256": "11ff5b48af4c6fe451b2ce1623b1cb2cb5bb35007bef94018597f897219a10af", "type": "eql", - "version": 106 + "version": 107 }, "f9590f47-6bd5-4a49-bd49-a2f886476fb9": { "min_stack_version": "8.3", @@ -7410,11 +8595,20 @@ "version": 7 }, "f994964f-6fce-4d75-8e79-e16ccc412588": { - "min_stack_version": "8.3", + "min_stack_version": "8.10", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "Suspicious Activity Reported by Okta User", + "sha256": "f35146f9e2f6aef85cb21013ab2bc3039a0a449e1bf4ed3322496b0dbc449e06", + "type": "query", + "version": 105 + } + }, "rule_name": "Suspicious Activity Reported by Okta User", "sha256": "248121396e46c80ff9a64d88848fd372e40eef61b3d43d31e6ef56a70477f392", "type": "query", - "version": 104 + "version": 205 }, "fa01341d-6662-426b-9d0c-6d81e33c8a9d": { "min_stack_version": "8.3", @@ -7426,16 +8620,16 @@ "fa210b61-b627-4e5e-86f4-17e8270656ab": { "min_stack_version": "8.3", "rule_name": "Potential External Linux SSH Brute Force Detected", - "sha256": "983e0ddc1783910db137adf087a0cb74b34fbf20bf1569b9024cd5578ab1b84a", + "sha256": "fac6f9cee3f43e0193ffc987c11e25fd31bc52cf43af80e9cfabc8dc453c1812", "type": "eql", - "version": 3 + "version": 4 }, "fa3a59dc-33c3-43bf-80a9-e8437a922c7f": { "min_stack_version": "8.3", "rule_name": "Potential Reverse Shell via Suspicious Binary", - "sha256": "df52af5aacf36ea1a7ad6a44b6238bfd08e8feb288d0bb5d1b604d6f8cd513b2", + "sha256": "91a2395bf7620588ccb74be3c35e5550521b5efb2e5268f5e5f700def971d705", "type": "eql", - "version": 4 + "version": 5 }, "fa488440-04cc-41d7-9279-539387bf2a17": { "min_stack_version": "8.3", @@ -7447,23 +8641,32 @@ "fac52c69-2646-4e79-89c0-fd7653461010": { "min_stack_version": "8.3", "rule_name": "Potential Disabling of AppArmor", - "sha256": "84c459fa919be715728e6f1c0a8c4ec19b8480510bb411c3b81bb72ced32586f", + "sha256": "af928c417577e8cc0260d0553a69112ffe4cce0432ff7dd3e11a6bf0e6c446d1", "type": "eql", - "version": 1 + "version": 2 }, "fb01d790-9f74-4e76-97dd-b4b0f7bf6435": { - "min_stack_version": "8.3", + "min_stack_version": "8.4", + "previous": { + "8.3": { + "max_allowable_version": 101, + "rule_name": "Potential Masquerading as System32 DLL", + "sha256": "44de9f686412f5ba599fbbf3c20d3d9a0e941c644469a473712133ff1293bf6d", + "type": "eql", + "version": 2 + } + }, "rule_name": "Potential Masquerading as System32 DLL", - "sha256": "6dabae4a91d13a982c01d893b7091d39599ab9bbc1e7e88117adcf8ae0a70a40", + "sha256": "83d55181cc10cf106c86f733adfc8bcd7100be39580cbdaf2784a6237cd2f61b", "type": "eql", - "version": 1 + "version": 102 }, "fb02b8d3-71ee-4af1-bacd-215d23f17efa": { "min_stack_version": "8.3", "rule_name": "Network Connection via Registration Utility", - "sha256": "cca4c8c4fe974be12e9a9717eb82caa9cbb509858bba01b5872ad90988772dce", + "sha256": "43bf761ed99e39883a71417804e95161874113a3d08e64e551fe474bb054586c", "type": "eql", - "version": 105 + "version": 106 }, "fb9937ce-7e21-46bf-831d-1ad96eac674d": { "rule_name": "Auditd Max Failed Login Attempts", @@ -7472,18 +8675,27 @@ "version": 100 }, "fbd44836-0d69-4004-a0b4-03c20370c435": { - "min_stack_version": "8.3", + "min_stack_version": "8.9", + "previous": { + "8.3": { + "max_allowable_version": 204, + "rule_name": "AWS Configuration Recorder Stopped", + "sha256": "624fbf2987e46d010e6f19338b9a13acbd0fc5afb7c2704f7f5d076d82b9ced4", + "type": "query", + "version": 105 + } + }, "rule_name": "AWS Configuration Recorder Stopped", "sha256": "e2cf9c3a12bd9ec52910d1a412e540d1f76113ddae474ae4fe22f81ed3aafb15", "type": "query", - "version": 104 + "version": 205 }, "fc7c0fa4-8f03-4b3e-8336-c5feab0be022": { "min_stack_version": "8.3", "rule_name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer", - "sha256": "8975d3c8774ec9437e4cd11148a51508e2c6d7f7d78d7201c4be6cfbaf0004ab", + "sha256": "d82de3a511d6f9d1fdacc568ea1f4f13dcb5c7b1923e37472627edad3bc0e244", "type": "eql", - "version": 105 + "version": 106 }, "fd3fc25e-7c7c-4613-8209-97942ac609f6": { "rule_name": "Linux Restricted Shell Breakout via the expect command", @@ -7521,12 +8733,19 @@ "type": "new_terms", "version": 207 }, + "fd9484f2-1c56-44ae-8b28-dc1354e3a0e8": { + "min_stack_version": "8.3", + "rule_name": "Image Loaded with Invalid Signature", + "sha256": "cc47fed45ee058e096104f4c1d2e2068a516895cf8a9e85ab1511686b49de1ee", + "type": "eql", + "version": 1 + }, "fda1d332-5e08-4f27-8a9b-8c802e3292a6": { "min_stack_version": "8.3", "rule_name": "System Binary Copied and/or Moved to Suspicious Directory", - "sha256": "62b9374ecd5f2c092b1940f6dd1481f37a42f04bdda1015b7cb512ba22db08ca", + "sha256": "590ac86e1af3b8706e4cb2a69e8fdd314724e77dbb5799e8fb98370ce40c9e58", "type": "eql", - "version": 1 + "version": 2 }, "fddff193-48a3-484d-8d35-90bb3d323a56": { "min_stack_version": "8.3", @@ -7538,21 +8757,28 @@ "fe25d5bc-01fa-494a-95ff-535c29cc4c96": { "min_stack_version": "8.3", "rule_name": "PowerShell Script with Password Policy Discovery Capabilities", - "sha256": "a8ea104f14627b5bef865394a5a80d56b351edaa5b4beea10407d3950c42f419", + "sha256": "7e932f33b6e1585cd992ffb8d0c475283c7c7d9e5f8480d9858165a716090f61", "type": "query", - "version": 1 + "version": 2 }, "fe794edd-487f-4a90-b285-3ee54f2af2d3": { "min_stack_version": "8.3", "rule_name": "Microsoft Windows Defender Tampering", - "sha256": "da773bcc4a79e9c08e47654c4abaef1190bd351feb40255c17932f918361f591", + "sha256": "a8eff42378039fb19f5db47284f5c0fc7ac55a01a9ec1c5d9b1a664f91fff887", "type": "eql", - "version": 106 + "version": 107 }, "feafdc51-c575-4ed2-89dd-8e20badc2d6c": { "min_stack_version": "8.3", "rule_name": "Potential Masquerading as Business App Installer", - "sha256": "60ec14b09417f0cb76b839ac47aa592120fc5692e363f35cb28840dcb84414be", + "sha256": "f8fb3a902d4649dae09ebfd3622387f97612d9ce93d0c82dc28badc57bf61ae1", + "type": "eql", + "version": 2 + }, + "fec7ccb7-6ed9-4f98-93ab-d6b366b063a0": { + "min_stack_version": "8.3", + "rule_name": "Execution via MS VisualStudio Pre/Post Build Events", + "sha256": "2d4dac5ee69aa01095329c1850ad5569f1d4d34fe06d5a73ef0f4fb93b1d98b7", "type": "eql", "version": 1 }, @@ -7570,19 +8796,26 @@ "type": "query", "version": 103 }, + "ff0d807d-869b-4a0d-a493-52bc46d2f1b1": { + "min_stack_version": "8.9", + "rule_name": "Potential DGA Activity", + "sha256": "83e50c945d95a5c87970b0f27356a28d98589040cb7698c584b7b41c832a8c24", + "type": "machine_learning", + "version": 1 + }, "ff10d4d8-fea7-422d-afb1-e5a2702369a9": { "min_stack_version": "8.6", "rule_name": "Cron Job Created or Changed by Previously Unknown Process", - "sha256": "3f05ca34ca031232a58c6bdd28c52d7ebc9751646383323594d0514a33322443", + "sha256": "b1a94af889b3bd5f19d461f40cf67ebb70a8c9c19383c1c6b821e829e49477e8", "type": "new_terms", - "version": 4 + "version": 5 }, "ff4599cb-409f-4910-a239-52e4e6f532ff": { "min_stack_version": "8.7", "rule_name": "LSASS Process Access via Windows API", - "sha256": "89aab4dd5ac4c53bd4096c632d79151c726d6991f64ad42938fde25eed6a3c8b", + "sha256": "592b792af644dd525e7bb61b8ba69a59219b797775997301b8ca62e5e71e03bd", "type": "eql", - "version": 3 + "version": 4 }, "ff4dd44a-0ac6-44c4-8609-3f81bc820f02": { "min_stack_version": "8.3", @@ -7601,8 +8834,8 @@ "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b": { "min_stack_version": "8.3", "rule_name": "Potential Sudo Token Manipulation via Process Injection", - "sha256": "16c98c01aec6efd485063babc9daf4aef11f4c6de3c2834b877688f6326a8cb6", + "sha256": "7f5618048d9c9a947da0f5e7789a02590652382297e9fc2355be088f7eb8a2bf", "type": "eql", - "version": 2 + "version": 3 } } \ No newline at end of file From 1ac37757436583776242159495a336584df7ffcc Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Wed, 25 Oct 2023 15:24:55 +0200 Subject: [PATCH 65/86] [New Rule] Network Activity Detected via kworker (#3202) * [New Rule] Potential curl CVE-2023-38545 Exploitation * Revert "[New Rule] Potential curl CVE-2023-38545 Exploitation" This reverts commit 9c04d1b53d3d63678289f43ec0c7b617d26f1ce0. * [New Rule] Network Activity Detected via kworker * White space * Update rules/linux/command_and_control_linux_kworker_netcon.toml * Update rules/linux/command_and_control_linux_kworker_netcon.toml * Update rules/linux/command_and_control_linux_kworker_netcon.toml * Update command_and_control_linux_kworker_netcon.toml * Update rules/linux/command_and_control_linux_kworker_netcon.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/linux/command_and_control_linux_kworker_netcon.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update command_and_control_linux_kworker_netcon.toml --------- Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- ...mand_and_control_linux_kworker_netcon.toml | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 rules/linux/command_and_control_linux_kworker_netcon.toml diff --git a/rules/linux/command_and_control_linux_kworker_netcon.toml b/rules/linux/command_and_control_linux_kworker_netcon.toml new file mode 100644 index 000000000..75b821757 --- /dev/null +++ b/rules/linux/command_and_control_linux_kworker_netcon.toml @@ -0,0 +1,86 @@ +[metadata] +creation_date = "2023/10/18" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" +min_stack_version = "8.6.0" +updated_date = "2023/10/18" + +[rule] +author = ["Elastic"] +description = """ +This rule monitors for network connections from a kworker process. kworker, or kernel worker, processes are part of the +kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel +space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks. +Attackers may attempt to evade detection by masquerading as a kernel worker process. +""" +from = "now-60m" +index = ["logs-endpoint.events.*"] +language = "kuery" +license = "Elastic License v2" +name = "Network Activity Detected via Kworker" +risk_score = 21 +rule_id = "25d917c4-aa3c-4111-974c-286c0312ff95" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ] +timestamp_override = "event.ingested" +type = "new_terms" + +query = ''' +host.os.type:linux and event.category:network and event.action:(connection_attempted or connection_accepted) and +process.name:kworker* +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + + [rule.threat.tactic] + id = "TA0011" + name = "Command and Control" + reference = "https://attack.mitre.org/tactics/TA0011/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + + [rule.threat.tactic] + id = "TA0005" + name = "Defense Evasion" + reference = "https://attack.mitre.org/tactics/TA0005/" + + [[rule.threat.technique]] + name = "Masquerading" + id = "T1036" + reference = "https://attack.mitre.org/techniques/T1036/" + + [[rule.threat.technique]] + name = "Rootkit" + id = "T1014" + reference = "https://attack.mitre.org/techniques/T1014/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + + [rule.threat.tactic] + id = "TA0010" + name = "Exfiltration" + reference = "https://attack.mitre.org/tactics/TA0010/" + + [[rule.threat.technique]] + name = "Exfiltration Over C2 Channel" + id = "T1041" + reference = "https://attack.mitre.org/techniques/T1041/" + +[rule.new_terms] +field = "new_terms_fields" +value = ["destination.ip", "process.name", "host.id"] + +[[rule.new_terms.history_window_start]] +field = "history_window_start" +value = "now-14d" + From e6ead7b5f7135cf0c349446ef215ba841391868a Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Wed, 25 Oct 2023 10:25:46 -0400 Subject: [PATCH 66/86] [FR] Adjust Risk Severity Unit Test to Match UI (#3218) * adjusted risk score to include ranges allowed upstream * Update tests/test_all_rules.py Co-authored-by: Mika Ayenson --------- Co-authored-by: Mika Ayenson --- tests/test_all_rules.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index 0c4e3c6ca..7a13f4cb8 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -1156,15 +1156,18 @@ class TestRiskScoreMismatch(BaseRuleTest): def test_rule_risk_score_severity_mismatch(self): invalid_list = [] risk_severity = { - "critical": 99, - "high": 73, - "medium": 47, - "low": 21, + "critical": (74, 100), # updated range for critical + "high": (48, 73), # updated range for high + "medium": (22, 47), # updated range for medium + "low": (0, 21), # updated range for low } for rule in self.all_rules: severity = rule.contents.data.severity risk_score = rule.contents.data.risk_score - if risk_severity[severity] != risk_score: + + # Check if the risk_score falls within the range for the severity level + min_score, max_score = risk_severity[severity] + if not min_score <= risk_score <= max_score: invalid_list.append(f'{self.rule_str(rule)} Severity: {severity}, Risk Score: {risk_score}') if invalid_list: From 36b0a49e7db84ce777b46b9af04543f234827ef3 Mon Sep 17 00:00:00 2001 From: eric-forte-elastic <119343520+eric-forte-elastic@users.noreply.github.com> Date: Thu, 26 Oct 2023 12:13:37 -0400 Subject: [PATCH 67/86] [FR] Updated typing-extensions dependency (#3204) * Updated typing-extensions * Added entries for <=3.11 and >=3.12 --------- Co-authored-by: Mika Ayenson --- pyproject.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index e565763da..99ac81fac 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -39,7 +39,8 @@ dependencies = [ "requests~=2.27", "toml==0.10.0", "typing-inspect==0.8.0", - "typing-extensions==4.5.0", + "typing-extensions==4.5.0 ; python_version<='3.11'", + "typing-extensions==4.8.0 ; python_version>='3.12'", "XlsxWriter~=1.3.6", "semver==3.0.0-dev.4" ] From a5240e406328cd4b1d5dac4078dcefc188141caf Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Thu, 26 Oct 2023 17:20:32 -0300 Subject: [PATCH 68/86] [Rule Tuning] Windows DR Tuning - 1 (#3198) * [Rule Tuning] Windows DR Tuning - 1 * Update collection_winrar_encryption.toml --- ...lection_email_outlook_mailbox_via_com.toml | 21 ++++++-- .../windows/collection_winrar_encryption.toml | 31 +++++++----- ...ommand_and_control_common_webservices.toml | 48 +++++++++++++------ ...nd_and_control_dns_tunneling_nslookup.toml | 14 +++--- ...d_control_certutil_network_connection.toml | 21 ++++---- 5 files changed, 86 insertions(+), 49 deletions(-) rename {rules/windows => rules_building_block}/command_and_control_certutil_network_connection.toml (88%) diff --git a/rules/windows/collection_email_outlook_mailbox_via_com.toml b/rules/windows/collection_email_outlook_mailbox_via_com.toml index 0f0e3021d..7aab9f82d 100644 --- a/rules/windows/collection_email_outlook_mailbox_via_com.toml +++ b/rules/windows/collection_email_outlook_mailbox_via_com.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.4.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -24,13 +24,24 @@ risk_score = 47 rule_id = "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Data Source: Elastic Defend"] -timestamp_override = "event.ingested" type = "eql" query = ''' -process where host.os.type == "windows" and event.action == "start" and process.name : "OUTLOOK.EXE" and - process.Ext.effective_parent.name != null and - not process.Ext.effective_parent.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") +sequence with maxspan=1m +[process where host.os.type == "windows" and event.action == "start" and + ( + process.name : ( + "rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", + "cmd.exe", "regsvr32.exe", "cscript.exe", "wscript.exe" + ) or + ( + (process.code_signature.trusted == false or process.code_signature.exists == false) and + (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) + ) + ) +] by process.executable +[process where host.os.type == "windows" and event.action == "start" and process.name : "OUTLOOK.EXE" and + process.Ext.effective_parent.name != null] by process.Ext.effective_parent.executable ''' diff --git a/rules/windows/collection_winrar_encryption.toml b/rules/windows/collection_winrar_encryption.toml index 641d08ab0..a0d2d78b9 100644 --- a/rules/windows/collection_winrar_encryption.toml +++ b/rules/windows/collection_winrar_encryption.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -65,17 +65,24 @@ type = "eql" query = ''' process where host.os.type == "windows" and event.type == "start" and ( - ((process.name:"rar.exe" or process.code_signature.subject_name == "win.rar GmbH" or - process.pe.original_file_name == "Command line RAR") and - process.args == "a" and process.args : ("-hp*", "-p*", "-dw", "-tb", "-ta", "/hp*", "/p*", "/dw", "/tb", "/ta")) - - or - (process.pe.original_file_name in ("7z.exe", "7za.exe") and - process.args == "a" and process.args : ("-p*", "-sdel")) - - /* uncomment if noisy for backup software related FPs */ - /* not process.parent.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") */ -) + ( + ( + process.name:"rar.exe" or process.code_signature.subject_name == "win.rar GmbH" or + process.pe.original_file_name == "Command line RAR" + ) and + process.args == "a" and process.args : ("-hp*", "-p*", "/hp*", "/p*") + ) or + ( + process.pe.original_file_name in ("7z.exe", "7za.exe") and + process.args == "a" and process.args : "-p*" + ) +) and + not process.parent.executable : ( + "C:\\Program Files\\*.exe", + "C:\\Program Files (x86)\\*.exe", + "?:\\ManageEngine\\*\\jre\\bin\\java.exe", + "?:\\Nox\\bin\\Nox.exe" + ) ''' diff --git a/rules/windows/command_and_control_common_webservices.toml b/rules/windows/command_and_control_common_webservices.toml index 274cbb41b..2e6a01b59 100644 --- a/rules/windows/command_and_control_common_webservices.toml +++ b/rules/windows/command_and_control_common_webservices.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/16" [transform] [[transform.osquery]] @@ -140,19 +140,24 @@ network where host.os.type == "windows" and network.protocol == "dns" and ) and /* Insert noisy false positives here */ not ( - process.executable : ( - "?:\\Program Files\\*.exe", - "?:\\Program Files (x86)\\*.exe", - "?:\\Windows\\System32\\WWAHost.exe", - "?:\\Windows\\System32\\smartscreen.exe", - "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", - "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", - "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe", - "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe", - "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", - "?:\\Windows\\system32\\mobsync.exe", - "?:\\Windows\\SysWOW64\\mobsync.exe" + ( + process.executable : ( + "?:\\Program Files\\*.exe", + "?:\\Program Files (x86)\\*.exe", + "?:\\Windows\\System32\\WWAHost.exe", + "?:\\Windows\\System32\\smartscreen.exe", + "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", + "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", + "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", + "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe", + "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe", + "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe", + "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe", + "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe", + "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", + "?:\\Windows\\system32\\mobsync.exe", + "?:\\Windows\\SysWOW64\\mobsync.exe" + ) and process.code_signature.trusted == true ) or /* Discord App */ @@ -168,6 +173,21 @@ network where host.os.type == "windows" and network.protocol == "dns" and /* Firefox */ (process.name : "firefox.exe" and (process.code_signature.subject_name : "Mozilla Corporation" and process.code_signature.trusted == true) + ) or + + /* Dropbox */ + (process.name : "Dropbox.exe" and (process.code_signature.subject_name : "Dropbox, Inc" and + process.code_signature.trusted == true) and dns.question.name : ("api.dropboxapi.com", "*.dropboxusercontent.com") + ) or + + /* Obsidian - Plugins are stored on raw.githubusercontent.com */ + (process.name : "Obsidian.exe" and (process.code_signature.subject_name : "Dynalist Inc" and + process.code_signature.trusted == true) and dns.question.name : "raw.githubusercontent.com" + ) or + + /* WebExperienceHostApp */ + (process.name : "WebExperienceHostApp.exe" and (process.code_signature.subject_name : "Microsoft Windows" and + process.code_signature.trusted == true) and dns.question.name : ("onedrive.live.com", "skyapi.onedrive.live.com") ) ) ''' diff --git a/rules/windows/command_and_control_dns_tunneling_nslookup.toml b/rules/windows/command_and_control_dns_tunneling_nslookup.toml index 2fd96ee97..cb20e2c2f 100644 --- a/rules/windows/command_and_control_dns_tunneling_nslookup.toml +++ b/rules/windows/command_and_control_dns_tunneling_nslookup.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -14,7 +14,7 @@ may indicate command and control activity utilizing the DNS protocol. """ from = "now-9m" index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*"] -language = "kuery" +language = "eql" license = "Elastic License v2" name = "Potential DNS Tunneling via NsLookup" note = """## Triage and analysis @@ -64,10 +64,12 @@ tags = [ "Data Source: Elastic Endgame", "Data Source: Elastic Defend" ] -type = "threshold" +type = "eql" query = ''' -event.category:process and host.os.type:windows and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*) +sequence by host.id with maxspan=5m +[process where host.os.type == "windows" and event.type == "start" and + process.name : "nslookup.exe" and process.args:("-querytype=*", "-qt=*", "-q=*", "-type=*")] with runs = 10 ''' @@ -92,7 +94,3 @@ id = "TA0011" name = "Command and Control" reference = "https://attack.mitre.org/tactics/TA0011/" -[rule.threshold] -field = ["host.id"] -value = 15 - diff --git a/rules/windows/command_and_control_certutil_network_connection.toml b/rules_building_block/command_and_control_certutil_network_connection.toml similarity index 88% rename from rules/windows/command_and_control_certutil_network_connection.toml rename to rules_building_block/command_and_control_certutil_network_connection.toml index 6645af86b..35d06368a 100644 --- a/rules/windows/command_and_control_certutil_network_connection.toml +++ b/rules_building_block/command_and_control_certutil_network_connection.toml @@ -4,7 +4,8 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/16" +bypass_bbr_timing = true [transform] [[transform.osquery]] @@ -34,6 +35,7 @@ authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.resu [rule] author = ["Elastic"] +building_block_type = "default" description = """ Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL. @@ -102,18 +104,17 @@ risk_score = 21 rule_id = "3838e0e3-1850-4850-a411-2e8c5ba40ba8" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", "Resources: Investigation Guide", "Data Source: Elastic Defend"] +timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by process.entity_id - [process where host.os.type == "windows" and process.name : "certutil.exe" and event.type == "start"] - [network where host.os.type == "windows" and process.name : "certutil.exe" and - not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", - "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", - "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", - "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", - "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", - "FE80::/10", "FF00::/8")] +network where host.os.type == "windows" and process.name : "certutil.exe" and + not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", + "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", + "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", + "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", + "FE80::/10", "FF00::/8") ''' From efa7c428ea6609faab2be4488372f253d5536ffa Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Thu, 26 Oct 2023 18:10:31 -0300 Subject: [PATCH 69/86] [Rule Tuning] Windows DR Tuning - 2 (#3209) * [Rule Tuning] Windows DR Tuning - 2 * Update rules/windows/credential_access_kerberoasting_unusual_process.toml * Update credential_access_kerberoasting_unusual_process.toml * Update command_and_control_teamviewer_remote_file_copy.toml --- ...and_and_control_ingress_transfer_bits.toml | 21 +++-- ...d_control_remote_file_copy_powershell.toml | 25 ++++-- ...d_control_teamviewer_remote_file_copy.toml | 12 ++- ...tial_access_dcsync_replication_rights.toml | 7 +- ..._access_kerberoasting_unusual_process.toml | 89 +++++++++++-------- 5 files changed, 94 insertions(+), 60 deletions(-) diff --git a/rules/windows/command_and_control_ingress_transfer_bits.toml b/rules/windows/command_and_control_ingress_transfer_bits.toml index f71f36778..3af1b9268 100644 --- a/rules/windows/command_and_control_ingress_transfer_bits.toml +++ b/rules/windows/command_and_control_ingress_transfer_bits.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/22" [rule] author = ["Elastic"] @@ -27,15 +27,20 @@ type = "eql" query = ''' file where host.os.type == "windows" and event.action == "rename" and - -process.name : "svchost.exe" and file.Ext.original.name : "BIT*.tmp" and - (file.extension :("exe", "zip", "rar", "bat", "dll", "ps1", "vbs", "wsh", "js", "vbe", "pif", "scr", "cmd", "cpl") or file.Ext.header_bytes : "4d5a*") and + process.name : "svchost.exe" and file.Ext.original.name : "BIT*.tmp" and + (file.extension : ("exe", "zip", "rar", "bat", "dll", "ps1", "vbs", "wsh", "js", "vbe", "pif", "scr", "cmd", "cpl") or + file.Ext.header_bytes : "4d5a*") and - /* noisy paths, for hunting purposes you can use the same query without the following exclusions */ - not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\*", "?:\\ProgramData\\*\\*") and + /* noisy paths, for hunting purposes you can use the same query without the following exclusions */ + not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\*", "?:\\ProgramData\\*\\*") and - /* lot of third party SW use BITS to download executables with a long file name */ - not length(file.name) > 30 + /* lot of third party SW use BITS to download executables with a long file name */ + not length(file.name) > 30 and + not file.path : ( + "?:\\Users\\*\\AppData\\Local\\Temp*\\wct*.tmp", + "?:\\Users\\*\\AppData\\Local\\Adobe\\ARM\\*\\RdrServicesUpdater*.exe", + "?:\\Users\\*\\AppData\\Local\\Docker Desktop Installer\\update-*.exe" + ) ''' diff --git a/rules/windows/command_and_control_remote_file_copy_powershell.toml b/rules/windows/command_and_control_remote_file_copy_powershell.toml index 6301f3c8a..19b82fd07 100644 --- a/rules/windows/command_and_control_remote_file_copy_powershell.toml +++ b/rules/windows/command_and_control_remote_file_copy_powershell.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2020/11/30" -integration = ["endpoint", "windows"] +integration = ["endpoint"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/22" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -36,7 +36,7 @@ authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.resu author = ["Elastic"] description = "Identifies powershell.exe being used to download an executable file from an untrusted remote destination." from = "now-9m" -index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Remote File Download via PowerShell" @@ -99,12 +99,19 @@ tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic type = "eql" query = ''' -sequence by host.id, process.entity_id with maxspan=30s - [network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and network.protocol == "dns" and - not dns.question.name : ("localhost", "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com", "metadata.google.internal") and - not user.domain : "NT AUTHORITY"] - [file where host.os.type == "windows" and process.name : "powershell.exe" and event.type == "creation" and file.extension : ("exe", "dll", "ps1", "bat") and - not file.name : "__PSScriptPolicy*.ps1"] +sequence by process.entity_id with maxspan=30s + +[network where host.os.type == "windows" and + process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and network.protocol == "dns" and + not dns.question.name : ( + "localhost", "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com", + "*.windowsupdate.com", "metadata.google.internal", "dist.nuget.org", + "artifacts.elastic.co", "*.digicert.com", "packages.chocolatey.org", + "outlook.office365.com" + ) and not user.id : "S-1-5-18"] +[file where host.os.type == "windows" and event.type == "creation" and + process.name : "powershell.exe" and file.extension : ("exe", "dll", "ps1", "bat") and + not file.name : "__PSScriptPolicy*.ps1"] ''' diff --git a/rules/windows/command_and_control_teamviewer_remote_file_copy.toml b/rules/windows/command_and_control_teamviewer_remote_file_copy.toml index 19b665790..2909cf10a 100644 --- a/rules/windows/command_and_control_teamviewer_remote_file_copy.toml +++ b/rules/windows/command_and_control_teamviewer_remote_file_copy.toml @@ -2,7 +2,7 @@ creation_date = "2020/09/02" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/22" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -113,7 +113,15 @@ type = "eql" query = ''' file where host.os.type == "windows" and event.type == "creation" and process.name : "TeamViewer.exe" and - file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta") + file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta") and + not + ( + file.path : ( + "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.js", + "?:\\Users\\*\\AppData\\Local\\Temp\\TeamViewer\\update.exe", + "?:\\Users\\*\\AppData\\Local\\Temp\\?\\TeamViewer\\update.exe" + ) and process.code_signature.trusted == true + ) ''' diff --git a/rules/windows/credential_access_dcsync_replication_rights.toml b/rules/windows/credential_access_dcsync_replication_rights.toml index e2766b03a..4dd1adef6 100644 --- a/rules/windows/credential_access_dcsync_replication_rights.toml +++ b/rules/windows/credential_access_dcsync_replication_rights.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/22" [rule] author = ["Elastic"] @@ -114,7 +114,10 @@ any where event.action == "Directory Service Access" and /* The right to perform an operation controlled by an extended access right. */ and winlog.event_data.AccessMask : "0x100" and - not winlog.event_data.SubjectUserName : ("*$", "MSOL_*", "OpenDNS_Connector") + not winlog.event_data.SubjectUserName : ( + "*$", "MSOL_*", "OpenDNS_Connector", "adconnect", "SyncADConnect", + "SyncADConnectCM", "aadsync", "svcAzureADSync", "-" + ) /* The Umbrella AD Connector uses the OpenDNS_Connector account to perform replication */ ''' diff --git a/rules/windows/credential_access_kerberoasting_unusual_process.toml b/rules/windows/credential_access_kerberoasting_unusual_process.toml index 8ab21f984..0dbf2b623 100644 --- a/rules/windows/credential_access_kerberoasting_unusual_process.toml +++ b/rules/windows/credential_access_kerberoasting_unusual_process.toml @@ -1,8 +1,8 @@ [metadata] creation_date = "2020/11/02" -integration = ["endpoint", "windows"] +integration = ["endpoint"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/22" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -44,7 +44,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"] +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Kerberos Traffic from Unusual Process" @@ -113,42 +113,53 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -network where host.os.type == "windows" and event.type == "start" and network.direction : ("outgoing", "egress") and - destination.port == 88 and source.port >= 49152 and process.pid != 4 and - not process.executable : - ("?:\\Windows\\System32\\lsass.exe", - "System", - "?:\\Windows\\System32\\svchost.exe", - "?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe", - "\\device\\harddiskvolume?\\windows\\system32\\lsass.exe", - "?:\\Program Files\\rapid7\\nexpose\\nse\\.DLLCACHE\\nseserv.exe", - "?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe", - "?:\\Program Files (x86)\\SuperScan\\scanner.exe", - "?:\\Program Files (x86)\\Nmap\\nmap.exe", - "?:\\Program Files\\Tenable\\Nessus\\nessusd.exe", - "\\device\\harddiskvolume?\\program files (x86)\\nmap\\nmap.exe", - "?:\\Program Files\\Docker\\Docker\\resources\\vpnkit.exe", - "?:\\Program Files\\Docker\\Docker\\resources\\com.docker.vpnkit.exe", - "?:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe", - "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcpatchscan.exe", - "\\device\\harddiskvolume?\\program files (x86)\\nmap oem\\nmap.exe", - "?:\\Program Files (x86)\\Nmap OEM\\nmap.exe", - "?:\\Program Files (x86)\\Zscaler\\ZSATunnel\\ZSATunnel.exe", - "?:\\Program Files\\JetBrains\\PyCharm Community Edition*\\bin\\pycharm64.exe", - "?:\\Program Files (x86)\\Advanced Port Scanner\\advanced_port_scanner.exe", - "?:\\Program Files (x86)\\nwps\\NetScanTools Pro\\NSTPRO.exe", - "?:\\Program Files\\BlackBerry\\UEM\\Proxy Server\\bin\\prunsrv.exe", - "?:\\Program Files (x86)\\Microsoft Silverlight\\sllauncher.exe", - "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", - "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe", - "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", - "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", - "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", - "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", - "?:\\Program Files\\Mozilla Firefox\\firefox.exe", - "?:\\Program Files\\Internet Explorer\\iexplore.exe", - "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" - ) and +network where host.os.type == "windows" and event.type == "start" and network.direction == "egress" and + destination.port == 88 and source.port >= 49152 and process.pid != 4 and destination.address : "*" and + not + ( + process.executable : ( + "\\device\\harddiskvolume?\\program files (x86)\\nmap\\nmap.exe", + "\\device\\harddiskvolume?\\program files (x86)\\nmap oem\\nmap.exe", + "\\device\\harddiskvolume?\\windows\\system32\\lsass.exe", + "?:\\Program Files\\Amazon Corretto\\jdk1*\\bin\\java.exe", + "?:\\Program Files\\BlackBerry\\UEM\\Proxy Server\\bin\\prunsrv.exe", + "?:\\Program Files\\BlackBerry\\UEM\\Core\\tomcat-core\\bin\\tomcat9.exe", + "?:\\Program Files\\DBeaver\\dbeaver.exe", + "?:\\Program Files\\Docker\\Docker\\resources\\com.docker.backend.exe", + "?:\\Program Files\\Docker\\Docker\\resources\\com.docker.vpnkit.exe", + "?:\\Program Files\\Docker\\Docker\\resources\\vpnkit.exe", + "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", + "?:\\Program Files\\Internet Explorer\\iexplore.exe", + "?:\\Program Files\\JetBrains\\PyCharm Community Edition*\\bin\\pycharm64.exe", + "?:\\Program Files\\Mozilla Firefox\\firefox.exe", + "?:\\Program Files\\Oracle\\VirtualBox\\VirtualBoxVM.exe", + "?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe", + "?:\\Program Files\\rapid7\\nexpose\\nse\\.DLLCACHE\\nseserv.exe", + "?:\\Program Files\\Silverfort\\Silverfort AD Adapter\\SilverfortServer.exe", + "?:\\Program Files\\Tenable\\Nessus\\nessusd.exe", + "?:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe", + "?:\\Program Files (x86)\\Advanced Port Scanner\\advanced_port_scanner.exe", + "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcpatchscan.exe", + "?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe", + "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", + "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", + "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", + "?:\\Program Files (x86)\\Microsoft Silverlight\\sllauncher.exe", + "?:\\Program Files (x86)\\Nmap\\nmap.exe", + "?:\\Program Files (x86)\\Nmap OEM\\nmap.exe", + "?:\\Program Files (x86)\\nwps\\NetScanTools Pro\\NSTPRO.exe", + "?:\\Program Files (x86)\\SAP BusinessObjects\\tomcat\\bin\\tomcat9.exe", + "?:\\Program Files (x86)\\SuperScan\\scanner.exe", + "?:\\Program Files (x86)\\Zscaler\\ZSATunnel\\ZSATunnel.exe", + "?:\\Windows\\System32\\lsass.exe", + "?:\\Windows\\System32\\MicrosoftEdgeCP.exe", + "?:\\Windows\\System32\\svchost.exe", + "?:\\Windows\\SysWOW64\\vmnat.exe", + "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe", + "System" + ) and process.code_signature.trusted == true + ) and destination.address != "127.0.0.1" and destination.address != "::1" ''' From 3d73427e29bb6547f66a20eec5a6791dee326e57 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Thu, 26 Oct 2023 18:58:59 -0300 Subject: [PATCH 70/86] [Rule Tuning] Windows DR Tuning - 3 (#3212) * [Rule Tuning] Windows DR Tuning - 3 * Update credential_access_lsass_openprocess_api.toml * Update credential_access_moving_registry_hive_via_smb.toml --- ...ial_access_lsass_memdump_file_created.toml | 28 ++++++-- ...al_access_lsass_memdump_handle_access.toml | 5 +- ...edential_access_lsass_openprocess_api.toml | 70 ++++++++++++------- ...l_access_moving_registry_hive_via_smb.toml | 10 ++- ...e_network_logon_provider_modification.toml | 28 +++++--- 5 files changed, 92 insertions(+), 49 deletions(-) diff --git a/rules/windows/credential_access_lsass_memdump_file_created.toml b/rules/windows/credential_access_lsass_memdump_file_created.toml index c59aea7fa..880cd68d1 100644 --- a/rules/windows/credential_access_lsass_memdump_file_created.toml +++ b/rules/windows/credential_access_lsass_memdump_file_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -118,14 +118,28 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -file where host.os.type == "windows" and file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") and +file where host.os.type == "windows" and event.action != "deletion" and + file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") and - not (process.executable : ("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe", "?:\\Windows\\System32\\dllhost.exe") and - file.path : ("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp", - "?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp")) and + not ( + process.executable : ( + "?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe", + "?:\\Windows\\System32\\dllhost.exe" + ) and + file.path : ( + "?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp", + "?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp", + "?:\\Program Files\\Microsoft SQL Server\\*\\MSSQL\\LOG\\SQLDmpr*.mdmp" + ) + ) and - not (process.executable : "?:\\WINDOWS\\system32\\WerFault.exe" and - file.path : "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\lsass.exe.*.dmp") + not ( + process.executable : "?:\\Windows\\system32\\WerFault.exe" and + file.path : ( + "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\lsass.exe.*.dmp", + "?:\\Windows\\System32\\%LOCALAPPDATA%\\CrashDumps\\lsass.exe.*.dmp" + ) + ) ''' diff --git a/rules/windows/credential_access_lsass_memdump_handle_access.toml b/rules/windows/credential_access_lsass_memdump_handle_access.toml index 82a20bdce..0c8e2e94c 100644 --- a/rules/windows/credential_access_lsass_memdump_handle_access.toml +++ b/rules/windows/credential_access_lsass_memdump_handle_access.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -156,7 +156,8 @@ any where event.action == "File System" and event.code == "4656" and "?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe", "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe", - "?:\\Windows\\explorer.exe") + "?:\\Windows\\explorer.exe", + "?:\\Windows\\System32\\poqexec.exe") ''' diff --git a/rules/windows/credential_access_lsass_openprocess_api.toml b/rules/windows/credential_access_lsass_openprocess_api.toml index f73b01caa..3e1398669 100644 --- a/rules/windows/credential_access_lsass_openprocess_api.toml +++ b/rules/windows/credential_access_lsass_openprocess_api.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: Lsass access events added in Elastic Endpoint 8.7." min_stack_version = "8.7.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -26,32 +26,48 @@ type = "eql" query = ''' api where host.os.type == "windows" and - process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe" and - not process.executable : - ("?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", - "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe", - "?:\\Program Files*\\Windows Defender\\MsMpEng.exe", - "?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe", - "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", - "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe", - "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe", - "?:\\Program Files (x86)\\N-able Technologies\\Reactive\\bin\\NableReactiveManagement.exe", - "?:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.exe", - "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe", - "?:\\Program Files\\TDAgent\\ossec-agent\\ossec-agent.exe", - "?:\\Windows\\System32\\MRT.exe", - "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\metricbeat.exe", - "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe", - "?:\\Windows\\System32\\msiexec.exe", - "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe", - "?:\\Program Files\\Fortinet\\FortiClient\\FortiProxy.exe", - "?:\\Program Files\\LogicMonitor\\Agent\\bin\\sbshutdown.exe", - "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe", - "?:\\Program Files (x86)\\Blackpoint\\SnapAgent\\SnapAgent.exe", - "?:\\Program Files\\ESET\\ESET Security\\ekrn.exe", - "?:\\Program Files\\Huntress\\HuntressAgent.exe", - "?:\\Program Files (x86)\\eScan\\reload.exe", - "?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe") + process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe" and + not + ( + process.executable : ( + "?:\\ProgramData\\GetSupportService*\\Updates\\Update_*.exe", + "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", + "?:\\Program Files (x86)\\Asiainfo Security\\OfficeScan Client\\NTRTScan.exe", + "?:\\Program Files (x86)\\Blackpoint\\SnapAgent\\SnapAgent.exe", + "?:\\Program Files (x86)\\eScan\\reload.exe", + "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe", + "?:\\Program Files (x86)\\Kaspersky Lab\\*\\avp.exe", + "?:\\Program Files (x86)\\N-able Technologies\\Reactive\\bin\\NableReactiveManagement.exe", + "?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe", + "?:\\Program Files (x86)\\Trend Micro\\*\\CCSF\\TmCCSF.exe", + "?:\\Program Files*\\Windows Defender\\MsMpEng.exe", + "?:\\Program Files\\Bitdefender\\Endpoint Security\\EPSecurityService.exe", + "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe", + "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe", + "?:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.exe", + "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\metricbeat.exe", + "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe", + "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\packetbeat.exe", + "?:\\Program Files\\ESET\\ESET Security\\ekrn.exe", + "?:\\Program Files\\Fortinet\\FortiClient\\FortiProxy.exe", + "?:\\Program Files\\Huntress\\HuntressAgent.exe", + "?:\\Program Files\\LogicMonitor\\Agent\\bin\\sbshutdown.exe", + "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe", + "?:\\Program Files\\Qualys\\QualysAgent\\QualysAgent.exe", + "?:\\Program Files\\TDAgent\\ossec-agent\\ossec-agent.exe", + "?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe", + "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe", + "?:\\Windows\\AdminArsenal\\PDQDeployRunner\\*\\exec\\Sysmon64.exe", + "?:\\Windows\\Sysmon.exe", + "?:\\Windows\\Sysmon64.exe", + "?:\\Windows\\System32\\csrss.exe", + "?:\\Windows\\System32\\MRT.exe", + "?:\\Windows\\System32\\msiexec.exe", + "?:\\Windows\\System32\\RtkAudUService64.exe", + "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", + "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe" + ) and process.code_signature.trusted == true + ) ''' diff --git a/rules/windows/credential_access_moving_registry_hive_via_smb.toml b/rules/windows/credential_access_moving_registry_hive_via_smb.toml index 7f7e06ef9..7c2c43dc8 100644 --- a/rules/windows/credential_access_moving_registry_hive_via_smb.toml +++ b/rules/windows/credential_access_moving_registry_hive_via_smb.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -72,7 +72,13 @@ query = ''' file where host.os.type == "windows" and event.type == "creation" and /* regf file header */ file.Ext.header_bytes : "72656766*" and file.size >= 30000 and - process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*") + process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*") and + not file.path : ( + "?:\\*\\UPM_Profile\\NTUSER.DAT", + "?:\\*\\UPM_Profile\\NTUSER.DAT.LASTGOOD.LOAD", + "?:\\Windows\\Netwrix\\Temp\\????????.???.offreg", + "?:\\*\\AppData\\Local\\Packages\\Microsoft.*\\Settings\\settings.dat*" + ) ''' diff --git a/rules/windows/credential_access_persistence_network_logon_provider_modification.toml b/rules/windows/credential_access_persistence_network_logon_provider_modification.toml index 5e7a9982d..9a8c4ebe6 100644 --- a/rules/windows/credential_access_persistence_network_logon_provider_modification.toml +++ b/rules/windows/credential_access_persistence_network_logon_provider_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -31,18 +31,24 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -registry where host.os.type == "windows" and registry.data.strings != null and - registry.path : ( +registry where host.os.type == "windows" and registry.data.strings : "?*" and + registry.path : ( "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath", "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath" - ) and - /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */ - not ( user.id : "S-1-5-18" and - registry.data.strings in - ("%SystemRoot%\\System32\\ntlanman.dll", - "%SystemRoot%\\System32\\drprov.dll", - "%SystemRoot%\\System32\\davclnt.dll") - ) + ) and + /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */ + not ( + user.id : "S-1-5-18" and + registry.data.strings : ( + "%SystemRoot%\\System32\\ntlanman.dll", + "%SystemRoot%\\System32\\drprov.dll", + "%SystemRoot%\\System32\\davclnt.dll", + "%SystemRoot%\\System32\\vmhgfs.dll", + "?:\\Program Files (x86)\\Citrix\\ICA Client\\x64\\pnsson.dll", + "?:\\Program Files\\Dell\\SARemediation\\agent\\DellMgmtNP.dll", + "?:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\\\epcgina.dll" + ) + ) ''' From a8081303908a2c1826c39d2f612c54e3a83bd538 Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Thu, 26 Oct 2023 18:07:33 -0500 Subject: [PATCH 71/86] Cleanup saved_query references (#3205) --- CLI.md | 4 ++-- detection_rules/schemas/definitions.py | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/CLI.md b/CLI.md index 37a253f1a..6e84e3f45 100644 --- a/CLI.md +++ b/CLI.md @@ -64,7 +64,7 @@ Usage: detection_rules create-rule [OPTIONS] PATH Options: -c, --config FILE Rule or config file --required-only Only prompt for required fields - -t, --rule-type [machine_learning|saved_query|query|threshold] + -t, --rule-type [machine_learning|query|threshold] Type of rule to create -h, --help Show this message and exit. ``` @@ -325,7 +325,7 @@ Precedence goes to the flag over the config file, so if debug is enabled in your ## Using `transform` in rule toml -A transform is any data that will be incorporated into _existing_ rule fields at build time, from within the +A transform is any data that will be incorporated into _existing_ rule fields at build time, from within the `TOMLRuleContents.to_dict` method. _How_ to process each transform should be defined within the `Transform` class as a method specific to the transform type. diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py index 5f53e08fd..78a46053a 100644 --- a/detection_rules/schemas/definitions.py +++ b/detection_rules/schemas/definitions.py @@ -43,7 +43,6 @@ TACTIC_URL = r'^https://attack.mitre.org/tactics/TA[0-9]+/$' TECHNIQUE_URL = r'^https://attack.mitre.org/techniques/T[0-9]+/$' SUBTECHNIQUE_URL = r'^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$' MACHINE_LEARNING = 'machine_learning' -SAVED_QUERY = 'saved_query' QUERY = 'query' QUERY_FIELD_OP_EXCEPTIONS = ["powershell.file.script_block_text"] @@ -148,7 +147,7 @@ OSType = Literal['windows', 'linux', 'macos'] PositiveInteger = NewType('PositiveInteger', int, validate=validate.Range(min=1)) RiskScore = NewType("MaxSignals", int, validate=validate.Range(min=1, max=100)) RuleName = NewType('RuleName', str, validate=validate.Regexp(NAME_PATTERN)) -RuleType = Literal['query', 'saved_query', 'machine_learning', 'eql', 'threshold', 'threat_match', 'new_terms'] +RuleType = Literal['query', 'machine_learning', 'eql', 'threshold', 'threat_match', 'new_terms'] SemVer = NewType('SemVer', str, validate=validate.Regexp(VERSION_PATTERN)) SemVerMinorOnly = NewType('SemVerFullStrict', str, validate=validate.Regexp(MINOR_SEMVER)) Severity = Literal['low', 'medium', 'high', 'critical'] From 1133b3a8a9ba17a0fa86006628ce41ec84286aa8 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Thu, 26 Oct 2023 20:58:49 -0300 Subject: [PATCH 72/86] [Rule Tuning] Windows DR Tuning - 4 (#3214) * [Rule Tuning] Windows DR Tuning - 4 * Update credential_access_remote_sam_secretsdump.toml --- ...credential_access_posh_request_ticket.toml | 4 +-- ...dential_access_remote_sam_secretsdump.toml | 6 ++-- ...dential_access_spn_attribute_modified.toml | 3 +- ...ccess_suspicious_lsass_access_generic.toml | 35 +++++++++++-------- ...ccess_suspicious_lsass_access_memdump.toml | 8 +++-- 5 files changed, 33 insertions(+), 23 deletions(-) diff --git a/rules/windows/credential_access_posh_request_ticket.toml b/rules/windows/credential_access_posh_request_ticket.toml index 60304a4f6..45c53eeb1 100644 --- a/rules/windows/credential_access_posh_request_ticket.toml +++ b/rules/windows/credential_access_posh_request_ticket.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -86,7 +86,7 @@ event.category:process and host.os.type:windows and KerberosRequestorSecurityToken ) and not user.id : ("S-1-5-18" or "S-1-5-20") and not powershell.file.script_block_text : ( - "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators" + "sentinelbreakpoints" and ("Set-PSBreakpoint" or "Set-HookFunctionTabs") ) ''' diff --git a/rules/windows/credential_access_remote_sam_secretsdump.toml b/rules/windows/credential_access_remote_sam_secretsdump.toml index 3383e7334..f9718868c 100644 --- a/rules/windows/credential_access_remote_sam_secretsdump.toml +++ b/rules/windows/credential_access_remote_sam_secretsdump.toml @@ -1,10 +1,10 @@ [metadata] creation_date = "2022/03/01" -integration = ["endpoint", "system", "windows"] +integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/21" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -13,7 +13,7 @@ Identifies remote access to the registry to potentially dump credential data fro registry hive in preparation for credential access and privileges elevation. """ from = "now-9m" -index = ["winlogbeat-*", "logs-system.*", "logs-endpoint.events.*"] +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Remote Credential Access via Registry" diff --git a/rules/windows/credential_access_spn_attribute_modified.toml b/rules/windows/credential_access_spn_attribute_modified.toml index d4d7e09e8..ef03fbdc3 100644 --- a/rules/windows/credential_access_spn_attribute_modified.toml +++ b/rules/windows/credential_access_spn_attribute_modified.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -100,6 +100,7 @@ type = "query" query = ''' event.action:"Directory Service Changes" and event.code:5136 and + winlog.event_data.OperationType:"%%14674" and winlog.event_data.ObjectClass:"user" and winlog.event_data.AttributeLDAPDisplayName:"servicePrincipalName" ''' diff --git a/rules/windows/credential_access_suspicious_lsass_access_generic.toml b/rules/windows/credential_access_suspicious_lsass_access_generic.toml index 1ceea773f..9f0cec5e3 100644 --- a/rules/windows/credential_access_suspicious_lsass_access_generic.toml +++ b/rules/windows/credential_access_suspicious_lsass_access_generic.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/06/29" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -33,20 +33,25 @@ process where host.os.type == "windows" and event.code == "10" and not winlog.event_data.GrantedAccess : ("0x1000", "0x1400", "0x101400", "0x101000", "0x101001", "0x100000", "0x100040", "0x3200", "0x40", "0x3200") and not process.name : ("procexp64.exe", "procmon.exe", "procexp.exe", "Microsoft.Identity.AadConnect.Health.AadSync.Host.ex") and - not process.executable : - ("?:\\Windows\\System32\\lsm.exe", - "?:\\Program Files\\*", - "?:\\Program Files (x86)\\*", - "?:\\Windows\\System32\\msiexec.exe", - "?:\\Windows\\CCM\\CcmExec.exe", - "?:\\Windows\\system32\\csrss.exe", - "?:\\Windows\\system32\\wininit.exe", - "?:\\Windows\\system32\\wbem\\wmiprvse.exe", - "?:\\Windows\\system32\\MRT.exe", - "?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\*", - "?:\\ProgramData\\WebEx\\webex\\*", - "?:\\Windows\\LTSvc\\LTSVC.exe") and - not winlog.event_data.CallTrace : ("*mpengine.dll*", "*appresolver.dll*", "*sysmain.dll*") + not process.executable : ( + "?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\*", + "?:\\ProgramData\\WebEx\\webex\\*", + "?:\\Program Files (x86)\\*", + "?:\\Program Files\\*", + "?:\\Windows\\CCM\\CcmExec.exe", + "?:\\Windows\\LTSvc\\LTSVC.exe", + "?:\\Windows\\Sysmon.exe", + "?:\\Windows\\Sysmon64.exe", + "?:\\Windows\\system32\\csrss.exe", + "?:\\Windows\\System32\\lsm.exe", + "?:\\Windows\\system32\\MRT.exe", + "?:\\Windows\\System32\\msiexec.exe", + "?:\\Windows\\system32\\wbem\\wmiprvse.exe", + "?:\\Windows\\system32\\wininit.exe", + "?:\\Windows\\SystemTemp\\GUM*.tmp\\GoogleUpdate.exe", + "?:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe" + ) and + not winlog.event_data.CallTrace : ("*mpengine.dll*", "*appresolver.dll*", "*sysmain.dll*") ''' diff --git a/rules/windows/credential_access_suspicious_lsass_access_memdump.toml b/rules/windows/credential_access_suspicious_lsass_access_memdump.toml index 889e8fedf..261319a36 100644 --- a/rules/windows/credential_access_suspicious_lsass_access_memdump.toml +++ b/rules/windows/credential_access_suspicious_lsass_access_memdump.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -40,7 +40,11 @@ process where host.os.type == "windows" and event.code == "10" and winlog.event_data.CallTrace : ("*dbghelp*", "*dbgcore*") and /* case of lsass crashing */ - not process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\System32\\WerFaultSecure.exe") + not process.executable : ( + "?:\\Windows\\System32\\WerFault.exe", + "?:\\Windows\\SysWOW64\\WerFault.exe", + "?:\\Windows\\System32\\WerFaultSecure.exe" + ) ''' From e7db39a4928bb1043bdaf89569c764102f530b26 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Fri, 27 Oct 2023 14:12:55 -0400 Subject: [PATCH 73/86] [Rule Tuning] Review and Tune `Potential Malicious File Downloaded from Google Drive` (#3197) * added tuning to remove signed binaries and benign processes * Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- ..._google_drive_malicious_file_download.toml | 50 +++++++++++++------ 1 file changed, 36 insertions(+), 14 deletions(-) diff --git a/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml b/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml index 5ff9158c8..628f73226 100644 --- a/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml +++ b/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/20" +updated_date = "2023/10/16" [rule] author = ["Elastic"] @@ -38,27 +38,49 @@ sequence by host.id, process.entity_id with maxspan=30s /* Look for Google Drive download URL with AV flag skipping */ (process.args : "*drive.google.com*" and process.args : "*export=download*" and process.args : "*confirm=no_antivirus*") -] + + /* ignore trusted processes */ + and not ( + process.code_signature.trusted == true and + process.code_signature.subject_name: + ("Mozilla Corporation", + "Google LLC", + "Google Inc", + "Bitdefender SRL", + "Microsoft Corporation", + "Netskope, Inc.", + "Avast Software s.r.o.", + "Microsoft Windows", + "AVG Technologies USA, LLC", + "Symantec Corporation", + "Trend Micro, Inc.", + "Palo Alto Networks (Netherlands) B.V.", + "Docker Inc")) + + /* ignore common benign processes */ + and not process.executable: + ("/bin/terraform", + "*/bin/dockerd", + "/usr/local/bin/docker-init", + "*/bin/go", + "?:\\Program Files*\\Mozilla Firefox\firefox.exe", + "?:\\Program Files*\\Google\\Chrome\\Application\\chrome.exe") + + /* ignore shellscripts + go install from legitimate repository*/ + and not (process.executable == "/bin/sh" and process.args : "go install google.golang.org*")] [network where /* Look for DNS requests for Google Drive */ (dns.question.name : "drive.google.com" and dns.question.type : "A") or /* Look for connection attempts to address that resolves to Google */ - (destination.as.organization.name : "GOOGLE" and event.action == "connection_attempted") - - /* NOTE: Add LoLBins if tuning is required - process.name : ( - "cmd.exe", "bitsadmin.exe", "certutil.exe", "esentutl.exe", "wmic.exe", "PowerShell.exe", - "homedrive.exe","regsvr32.exe", "mshta.exe", "rundll32.exe", "cscript.exe", "wscript.exe", - "curl", "wget", "scp", "ftp", "python", "perl", "ruby"))] */ -] + (destination.as.organization.name : "GOOGLE" and event.action == "connection_attempted")] /* Identify the creation of files following Google Drive connection with extensions commonly used for executables or libraries */ -[file where event.action == "creation" and file.extension : ( - "exe", "dll", "scr", "jar", "pif", "app", "dmg", "pkg", "elf", "so", "bin", "deb", "rpm","sh","hta","lnk" - ) -] +[file where event.action == "creation" and + file.extension : + ("exe", "dll", "scr", "jar", "pif", "app", "dmg", + "pkg", "elf", "so", "bin", "deb", "rpm","sh","hta","lnk")] ''' From 6400bb3237b5c1c82852517c4a1c29b64531b93c Mon Sep 17 00:00:00 2001 From: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Date: Fri, 27 Oct 2023 15:10:09 -0500 Subject: [PATCH 74/86] [Tuning] Access to Stored Browser Credentials (#3066) * Exclude FPs * Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --- ...ential_access_access_to_browser_credentials_procargs.toml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/macos/credential_access_access_to_browser_credentials_procargs.toml b/rules/macos/credential_access_access_to_browser_credentials_procargs.toml index 2a0210272..07c41358e 100644 --- a/rules/macos/credential_access_access_to_browser_credentials_procargs.toml +++ b/rules/macos/credential_access_access_to_browser_credentials_procargs.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/08/31" [rule] author = ["Elastic"] @@ -46,7 +46,8 @@ process where host.os.type == "macos" and event.type in ("start", "process_start "key3.db", "logins.json", "cookies.sqlite" - ) + ) and + not (process.name : "wordexp-helper" and process.parent.name : ("elastic-agent", "elastic-endpoint")) ''' From 618a1dbe068aba66ec6403f6d1ee767234c85068 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 30 Oct 2023 09:37:11 +0100 Subject: [PATCH 75/86] [New Rule] Attempt to Clear Kernel Ring Buffer (#3217) * [New Rule] Attempt to Clear Kernel Ring Buffer * Update defense_evasion_clear_kernel_ring_buffer.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> --- ...ense_evasion_clear_kernel_ring_buffer.toml | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 rules/linux/defense_evasion_clear_kernel_ring_buffer.toml diff --git a/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml b/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml new file mode 100644 index 000000000..c6c03b022 --- /dev/null +++ b/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml @@ -0,0 +1,91 @@ +[metadata] +creation_date = "2023/10/24" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/24" + +[rule] +author = ["Elastic"] +description = """ +Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events +to evade detection after installing a Linux kernel module (LKM). +""" +from = "now-9m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Attempt to Clear Kernel Ring Buffer" +risk_score = 21 +rule_id = "2724808c-ba5d-48b2-86d2-0002103df753" +setup = """ + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click Add integrations. +- In the query bar, search for Elastic Defend and select the integration to see more details about it. +- Click Add Elastic Defend. +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click Save and Continue. +- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and +process.name == "dmesg" and process.args : "-c" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +name = "Impair Defenses" +id = "T1562" +reference = "https://attack.mitre.org/techniques/T1562/" + +[[rule.threat.technique.subtechnique]] +name = "Disable or Modify Tools" +id = "T1562.001" +reference = "https://attack.mitre.org/techniques/T1562/001/" + +[[rule.threat.technique]] +name = "Indicator Removal" +id = "T1070" +reference = "https://attack.mitre.org/techniques/T1070/" + +[[rule.threat.technique.subtechnique]] +name = "Clear Linux or Mac System Logs" +id = "T1070.002" +reference = "https://attack.mitre.org/techniques/T1070/002/" + +[rule.threat.tactic] +name = "Defense Evasion" +id = "TA0005" +reference = "https://attack.mitre.org/tactics/TA0005/" + From ad25c922fddb904997e3376b3da4e71c90774d4e Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 30 Oct 2023 09:49:20 +0100 Subject: [PATCH 76/86] [Rule Tuning] Tainted Kernel Module Load (#3234) * [Rule Tuning] Tainted kernel module load * Update persistence_tainted_kernel_module_load.toml * Update rules_building_block/persistence_tainted_kernel_module_load.toml --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> --- ...ersistence_tainted_kernel_module_load.toml | 32 +++++++++++-------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/rules_building_block/persistence_tainted_kernel_module_load.toml b/rules_building_block/persistence_tainted_kernel_module_load.toml index 6f474429b..2a9802ebe 100644 --- a/rules_building_block/persistence_tainted_kernel_module_load.toml +++ b/rules_building_block/persistence_tainted_kernel_module_load.toml @@ -5,7 +5,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/23" +updated_date = "2023/10/26" [rule] author = ["Elastic"] @@ -17,7 +17,7 @@ ensuring system security and integrity, as malicious or unauthorized modules can system vulnerabilities or unauthorized access. """ from = "now-9m" -index = ["logs-system.auth-*"] +index = ["logs-system.syslog-*"] language = "kuery" license = "Elastic License v2" name = "Tainted Kernel Module Load" @@ -26,19 +26,8 @@ rule_id = "05cad2fb-200c-407f-b472-02ea8c9e5e4a" setup = """ This rule requires data coming in from one of the following integrations: -- Auditbeat - Filebeat -### Auditbeat Setup -Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. - -#### The following steps should be executed in order to add the Auditbeat for Linux System: -- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. -- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). -- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). -- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). - ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -61,7 +50,9 @@ tags = [ "Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", - "Tactic: Persistence" + "Tactic: Persistence", + "Tactic: Defense Evasion", + "Rule Type: BBR" ] timestamp_override = "event.ingested" type = "query" @@ -88,3 +79,16 @@ id = "TA0003" name = "Persistence" reference = "https://attack.mitre.org/tactics/TA0003/" +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat.technique]] +name = "Rootkit" +id = "T1014" +reference = "https://attack.mitre.org/techniques/T1014/" + From a568c56bc1b2b79400393d9001a1639d3cb23993 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Mon, 30 Oct 2023 16:53:04 +0530 Subject: [PATCH 77/86] Move Config Guides for Pre-Built Detection Rules to Setup Field - Windows, MacOS, BBR and Cross Platform (#3157) --- ...s_cookies_chromium_browsers_debugging.toml | 14 +++++---- ...e_evasion_deleting_websvr_access_logs.toml | 14 +++++---- ...deletion_of_bash_command_line_history.toml | 14 +++++---- ...sion_elastic_agent_service_terminated.toml | 14 +++++---- ...ion_masquerading_space_after_filename.toml | 14 +++++---- .../defense_evasion_timestomp_touch.toml | 14 +++++---- .../discovery_security_software_grep.toml | 14 ++++++--- ...y_virtual_machine_fingerprinting_grep.toml | 14 +++++---- .../execution_python_script_in_cmdline.toml | 16 ++++++---- .../execution_revershell_via_shell_cmd.toml | 14 ++++++--- ...xecution_suspicious_jar_child_process.toml | 14 ++++++--- .../impact_hosts_file_modified.toml | 18 +++++++---- ..._access_zoom_meeting_with_no_passcode.toml | 8 ++--- .../threat_intel_indicator_match_address.toml | 16 ++++++---- .../threat_intel_indicator_match_hash.toml | 16 ++++++---- ...threat_intel_indicator_match_registry.toml | 16 ++++++---- .../threat_intel_indicator_match_url.toml | 16 ++++++---- ...ccess_to_browser_credentials_procargs.toml | 14 +++++---- ...edential_access_credentials_keychains.toml | 14 +++++---- ...tial_access_dumping_keychain_security.toml | 8 +++-- ...s_keychain_pwd_retrieval_security_cmd.toml | 14 +++++---- ...al_access_promt_for_pwd_via_osascript.toml | 14 +++++---- ...evasion_attempt_del_quarantine_attrib.toml | 14 +++++---- ...cy_controls_tcc_database_modification.toml | 14 +++++---- ...tion_privacy_pref_sshd_fulldiskaccess.toml | 14 +++++---- ...covery_users_domain_built_in_commands.toml | 14 +++++---- .../lateral_movement_mounting_smb_share.toml | 14 +++++---- ...teral_movement_vpn_connection_attempt.toml | 14 +++++---- ..._creation_hidden_login_item_osascript.toml | 14 +++++---- ...persistence_emond_rules_file_creation.toml | 14 +++++---- ...n_hidden_launch_agent_deamon_creation.toml | 14 +++++---- ...rsistence_login_logout_hooks_defaults.toml | 14 +++++---- ...fication_sublime_app_plugin_or_script.toml | 14 +++++---- ...saver_engine_unexpected_child_process.toml | 15 ++++++---- ...e_screensaver_plist_file_modification.toml | 14 ++++++--- ...calation_applescript_with_admin_privs.toml | 14 +++++---- ...ion_email_powershell_exchange_mailbox.toml | 13 +++++--- .../collection_posh_audio_capture.toml | 11 +++---- .../collection_posh_clipboard_capture.toml | 17 ++++++----- rules/windows/collection_posh_keylogger.toml | 17 ++++++----- rules/windows/collection_posh_mailbox.toml | 17 ++++++----- .../collection_posh_screen_grabber.toml | 11 +++---- .../windows/collection_winrar_encryption.toml | 13 +++++--- ...control_encrypted_channel_freesslcert.toml | 14 +++++---- ...ontrol_port_forwarding_added_registry.toml | 13 +++++--- .../command_and_control_rdp_tunnel_plink.toml | 13 +++++--- ...ol_remote_file_copy_desktopimgdownldr.toml | 13 +++++--- ...and_control_remote_file_copy_mpcmdrun.toml | 13 +++++--- ...d_control_teamviewer_remote_file_copy.toml | 13 +++++--- ...ntial_access_bruteforce_admin_account.toml | 13 +++++--- ...ple_logon_failure_followed_by_success.toml | 13 +++++--- ...rce_multiple_logon_failure_same_srcip.toml | 9 +++--- .../credential_access_cmdline_dump_tool.toml | 13 +++++--- ...ess_copy_ntds_sam_volshadowcp_cmdline.toml | 14 +++++---- ...ial_access_dcsync_newterm_subjectuser.toml | 25 ++++++++-------- ...tial_access_dcsync_replication_rights.toml | 25 ++++++++-------- ...ntial_access_disable_kerberos_preauth.toml | 19 ++++++------ ...cess_domain_backup_dpapi_private_keys.toml | 13 +++++--- ...credential_access_dump_registry_hives.toml | 13 +++++--- ...ntial_access_iis_apppoolsa_pwd_appcmd.toml | 14 +++++---- ..._access_iis_connectionstrings_dumping.toml | 14 +++++---- ..._access_kerberoasting_unusual_process.toml | 13 +++++--- .../credential_access_ldap_attributes.toml | 20 ++++++------- ...l_access_lsass_handle_via_malseclogon.toml | 14 +++++---- ...edential_access_lsass_loaded_susp_dll.toml | 14 +++++---- ...ial_access_lsass_memdump_file_created.toml | 11 +++++-- ...al_access_lsass_memdump_handle_access.toml | 30 +++++++++++-------- ...l_access_mimikatz_memssp_default_logs.toml | 13 +++++--- ...ial_access_mimikatz_powershell_module.toml | 19 ++++++------ ..._access_mod_wdigest_security_provider.toml | 13 +++++--- ...edential_access_posh_kerb_ticket_dump.toml | 14 ++++----- .../credential_access_posh_minidump.toml | 19 ++++++------ ...credential_access_posh_request_ticket.toml | 15 +++++----- ..._potential_lsa_memdump_via_mirrordump.toml | 14 +++++---- ...dential_access_remote_sam_secretsdump.toml | 15 ++++++---- ...ntial_access_saved_creds_vault_winlog.toml | 14 +++++---- ...redential_access_saved_creds_vaultcmd.toml | 14 +++++---- ...edelegationprivilege_assigned_to_user.toml | 23 +++++++------- .../credential_access_shadow_credentials.toml | 21 ++++++------- ...dential_access_spn_attribute_modified.toml | 23 +++++++------- ...l_access_suspicious_comsvcs_imageload.toml | 11 +++---- ...ccess_suspicious_lsass_access_generic.toml | 10 +++++-- ...ccess_suspicious_lsass_access_memdump.toml | 12 +++++--- ..._suspicious_lsass_access_via_snapshot.toml | 11 +++---- ...cious_winreg_access_via_sebackup_priv.toml | 19 ++++++------ ..._symbolic_link_to_shadow_copy_created.toml | 27 ++++++++++------- ...ess_via_snapshot_lsass_clone_creation.toml | 18 ++++++----- .../defense_evasion_amsienable_key_mod.toml | 13 +++++--- ...sion_clearing_windows_console_history.toml | 13 +++++--- ...e_evasion_clearing_windows_event_logs.toml | 13 +++++--- ...e_evasion_create_mod_root_certificate.toml | 13 +++++--- ...vasion_defender_disabled_via_registry.toml | 13 +++++--- ...ion_defender_exclusion_via_powershell.toml | 13 +++++--- ...ble_windows_firewall_rules_with_netsh.toml | 13 +++++--- ...disabling_windows_defender_powershell.toml | 13 +++++--- ...efense_evasion_disabling_windows_logs.toml | 13 +++++--- ...efense_evasion_dns_over_https_enabled.toml | 14 +++++---- ...vasion_dotnet_compiler_parent_process.toml | 14 +++++---- ...evasion_enable_inbound_rdp_with_netsh.toml | 13 +++++--- ...n_enable_network_discovery_with_netsh.toml | 13 +++++--- ...ecution_control_panel_suspicious_args.toml | 14 +++++---- ...ense_evasion_execution_lolbas_wuauclt.toml | 14 +++++---- ...ecution_msbuild_started_by_office_app.toml | 13 +++++--- ...n_execution_msbuild_started_by_script.toml | 10 ++++++- ...ion_msbuild_started_by_system_process.toml | 14 +++++---- ...ion_execution_msbuild_started_renamed.toml | 13 +++++--- ...cution_msbuild_started_unusal_process.toml | 14 +++++---- ...execution_suspicious_explorer_winword.toml | 14 +++++---- ...sion_execution_windefend_unusual_path.toml | 14 +++++---- ..._evasion_file_creation_mult_extension.toml | 14 +++++---- ...efense_evasion_from_unusual_directory.toml | 14 +++++---- ...ense_evasion_iis_httplogging_disabled.toml | 13 +++++--- ...querading_as_elastic_endpoint_process.toml | 14 +++++---- ...e_evasion_masquerading_renamed_autoit.toml | 13 +++++--- ...erading_suspicious_werfault_childproc.toml | 14 +++++---- ...vasion_masquerading_trusted_directory.toml | 14 +++++---- ..._evasion_microsoft_defender_tampering.toml | 13 +++++--- ...e_evasion_ms_office_suspicious_regmod.toml | 13 +++++--- .../defense_evasion_posh_assembly_load.toml | 11 +++---- .../defense_evasion_posh_compressed.toml | 9 +++--- ...efense_evasion_posh_process_injection.toml | 21 ++++++------- ..._powershell_windows_firewall_disabled.toml | 13 +++++--- ...ense_evasion_proxy_execution_via_msdt.toml | 14 +++++---- ...ion_scheduledjobs_at_protocol_enabled.toml | 14 +++++---- ...ackdoor_service_disabled_via_registry.toml | 14 +++++---- ...picious_execution_from_mounted_device.toml | 14 +++++---- ...picious_process_access_direct_syscall.toml | 13 +++++--- ..._critical_proc_abnormal_file_activity.toml | 13 +++++--- ...sion_unsigned_dll_loaded_from_suspdir.toml | 14 +++++---- ...nse_evasion_unusual_ads_file_creation.toml | 13 +++++--- .../defense_evasion_unusual_dir_ads.toml | 14 +++++---- ...asion_unusual_system_vp_child_program.toml | 14 +++++---- ...evasion_workfolders_control_execution.toml | 13 +++++--- .../discovery_adfind_command_activity.toml | 13 +++++--- rules/windows/discovery_admin_recon.toml | 13 +++++--- .../discovery_command_system_account.toml | 13 +++++--- .../windows/discovery_peripheral_device.toml | 13 +++++--- .../discovery_posh_invoke_sharefinder.toml | 19 ++++++------ ...scovery_posh_suspicious_api_functions.toml | 17 ++++++----- ...very_privileged_localgroup_membership.toml | 15 ++++++---- .../discovery_whoami_command_activity.toml | 13 +++++--- ...arwinds_backdoor_child_cmd_powershell.toml | 14 +++++---- ...inds_backdoor_unusual_child_processes.toml | 14 +++++---- .../windows/execution_com_object_xwizard.toml | 14 +++++---- ...tion_command_shell_started_by_svchost.toml | 13 +++++--- ...mand_shell_started_by_unusual_process.toml | 14 +++++---- .../execution_command_shell_via_rundll32.toml | 14 +++++---- .../execution_enumeration_via_wmiprvse.toml | 14 +++++---- .../execution_from_unusual_path_cmdline.toml | 13 +++++--- .../execution_posh_hacktool_functions.toml | 16 +++++----- .../execution_posh_portable_executable.toml | 15 +++++----- rules/windows/execution_posh_psreflect.toml | 17 ++++++----- ...xecution_shared_modules_local_sxs_dll.toml | 13 +++++--- .../windows/execution_suspicious_cmd_wmi.toml | 14 +++++---- ...n_suspicious_image_load_wmi_ms_office.toml | 14 +++++---- .../execution_suspicious_pdf_reader.toml | 13 +++++--- .../execution_suspicious_psexesvc.toml | 13 +++++--- .../execution_via_compiled_html_file.toml | 13 +++++--- .../execution_via_hidden_shell_conhost.toml | 13 +++++--- .../windows/impact_backup_file_deletion.toml | 13 +++++--- ...deleting_backup_catalogs_with_wbadmin.toml | 13 +++++--- .../impact_modification_of_boot_config.toml | 13 +++++--- ...copy_deletion_or_resized_via_vssadmin.toml | 13 +++++--- ...e_shadow_copy_deletion_via_powershell.toml | 13 +++++--- ..._volume_shadow_copy_deletion_via_wmic.toml | 13 +++++--- ..._evasion_suspicious_htm_file_creation.toml | 14 +++++---- ...al_access_script_executing_powershell.toml | 13 +++++--- ...l_access_suspicious_ms_exchange_files.toml | 13 +++++--- ...access_suspicious_ms_exchange_process.toml | 14 +++++---- ...ious_ms_exchange_worker_child_process.toml | 14 +++++---- ...ss_suspicious_ms_office_child_process.toml | 13 +++++--- ...s_suspicious_ms_outlook_child_process.toml | 13 +++++--- ...explorer_suspicious_child_parent_args.toml | 14 +++++---- ...ateral_movement_evasion_rdp_shadowing.toml | 14 +++++---- ..._movement_execution_from_tsclient_mup.toml | 14 +++++---- ...ment_mount_hidden_or_webdav_share_net.toml | 14 +++++---- ...lateral_movement_rdp_enabled_registry.toml | 13 +++++--- ...ovement_remote_file_copy_hidden_share.toml | 14 +++++---- ...ement_suspicious_rdp_client_imageload.toml | 14 +++++---- ...movement_unusual_dns_service_children.toml | 13 +++++--- ...ement_unusual_dns_service_file_writes.toml | 13 +++++--- ...l_movement_via_startup_folder_rdp_smb.toml | 14 +++++---- .../persistence_adobe_hijack_persistence.toml | 13 +++++--- .../persistence_appcertdlls_registry.toml | 14 +++++---- .../persistence_appinitdlls_registry.toml | 13 +++++--- ...evasion_hidden_local_account_creation.toml | 13 +++++--- ...sistence_local_scheduled_job_creation.toml | 14 +++++---- .../persistence_ms_office_addins_file.toml | 14 +++++---- .../persistence_ms_outlook_vba_template.toml | 14 +++++---- ...istence_msds_alloweddelegateto_krbtgt.toml | 16 +++++----- ...ll_exch_mailbox_activesync_add_device.toml | 14 +++++---- ...escalation_via_accessibility_features.toml | 13 +++++--- ...istence_sdprop_exclusion_dsheuristics.toml | 23 ++++++++------ ...er_file_written_by_suspicious_process.toml | 13 +++++--- .../persistence_startup_folder_scripts.toml | 13 +++++--- ...stence_suspicious_com_hijack_registry.toml | 13 +++++--- ...s_image_load_scheduled_task_ms_office.toml | 14 +++++---- ...nce_suspicious_scheduled_task_runtime.toml | 14 +++++---- ..._account_added_to_privileged_group_ad.toml | 13 +++++--- .../persistence_user_account_creation.toml | 13 +++++--- .../persistence_via_application_shimming.toml | 14 +++++---- ...rsistence_via_bits_job_notify_command.toml | 14 +++++---- ...sistence_via_hidden_run_key_valuename.toml | 14 +++++---- ...sa_security_support_provider_registry.toml | 14 +++++---- ...emetrycontroller_scheduledtask_hijack.toml | 14 +++++---- ...ia_update_orchestrator_service_hijack.toml | 13 +++++--- ...nt_instrumentation_event_subscription.toml | 14 +++++---- ...ia_xp_cmdshell_mssql_stored_procedure.toml | 13 +++++--- .../persistence_webshell_detection.toml | 13 +++++--- ...tion_create_process_as_different_user.toml | 19 +++++++----- ...privilege_escalation_credroaming_ldap.toml | 18 +++++------ ...ilege_escalation_disable_uac_registry.toml | 13 +++++--- ...calation_gpo_schtask_service_creation.toml | 14 +++++---- ...ege_escalation_group_policy_iniscript.toml | 19 ++++++------ ...lation_group_policy_privileged_groups.toml | 17 ++++++----- ...scalation_group_policy_scheduled_task.toml | 23 +++++++------- ...rivilege_escalation_installertakeover.toml | 11 +++++-- ...e_escalation_named_pipe_impersonation.toml | 13 +++++--- ...ge_escalation_persistence_phantom_dll.toml | 13 +++++--- ...e_escalation_posh_token_impersonation.toml | 20 ++++++------- ..._printspooler_service_suspicious_file.toml | 14 +++++---- ...printspooler_suspicious_file_deletion.toml | 14 +++++---- ...tion_printspooler_suspicious_spl_file.toml | 13 +++++--- ...lation_samaccountname_spoofing_attack.toml | 13 ++++---- ...lation_tokenmanip_sedebugpriv_enabled.toml | 16 +++++----- ...lege_escalation_uac_bypass_com_clipup.toml | 14 +++++---- ...ge_escalation_uac_bypass_com_ieinstal.toml | 14 +++++---- ...n_uac_bypass_com_interface_icmluautil.toml | 14 +++++---- ...alation_uac_bypass_diskcleanup_hijack.toml | 14 +++++---- ...escalation_uac_bypass_dll_sideloading.toml | 14 +++++---- ...ge_escalation_uac_bypass_event_viewer.toml | 13 +++++--- ...ege_escalation_uac_bypass_mock_windir.toml | 13 +++++--- ...scalation_uac_bypass_winfw_mmc_hijack.toml | 13 +++++--- ...tion_unusual_parentchild_relationship.toml | 13 +++++--- ...ion_unusual_printspooler_childprocess.toml | 14 +++++---- ...n_unusual_svchost_childproc_childless.toml | 14 +++++---- ...ilege_escalation_via_rogue_named_pipe.toml | 21 +++++++------ ...on_windows_service_via_unusual_client.toml | 18 +++++------ .../collection_posh_compression.toml | 9 +++--- .../collection_posh_webcam_video_capture.toml | 11 ++++--- ..._evasion_powershell_clear_logs_script.toml | 17 +++++------ ...iscovery_files_dir_systeminfo_via_cmd.toml | 14 ++++++--- ...ry_kernel_module_enumeration_via_proc.toml | 13 ++++---- .../discovery_linux_modprobe_enumeration.toml | 13 ++++---- .../discovery_linux_sysctl_enumeration.toml | 13 ++++---- rules_building_block/discovery_net_view.toml | 14 ++++++--- .../discovery_posh_generic.toml | 9 +++--- .../discovery_posh_password_policy.toml | 9 +++--- ...ote_system_discovery_commands_windows.toml | 14 ++++++--- .../discovery_security_software_wmic.toml | 14 ++++++--- ...discovery_suspicious_proc_enumeration.toml | 13 ++++---- .../lateral_movement_posh_winrm_activity.toml | 20 ++++++------- .../persistence_transport_agent_exchange.toml | 9 +++--- 253 files changed, 2278 insertions(+), 1320 deletions(-) diff --git a/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml b/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml index 5c3412363..8d37071c2 100644 --- a/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml +++ b/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,10 +20,6 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "Potential Cookies Theft via Browser Debugging" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://github.com/defaultnamehere/cookie_crimes", "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/", @@ -32,6 +28,14 @@ references = [ ] risk_score = 47 rule_id = "027ff9ea-85e7-42e3-99d2-bbb7069e02eb" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: Windows", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml b/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml index 9c8e3f776..9d539247b 100644 --- a/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml +++ b/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["auditbeat-*", "winlogbeat-*", "logs-endpoint.events.*", "logs-windows. language = "eql" license = "Elastic License v2" name = "WebServer Access Logs Deleted" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "665e7a4f-c58e-4fc6-bc83-87a7572670ac" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: Windows", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml b/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml index 89b2d8552..2abe70f7c 100644 --- a/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml +++ b/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Tampering of Bash Command-Line History" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "7bcbb3ac-e533-41ad-a612-d6c3bf666aba" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml b/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml index e1e835acc..1597275d0 100644 --- a/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml +++ b/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml @@ -3,7 +3,7 @@ creation_date = "2022/05/23" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" integration = ["endpoint"] [rule] @@ -19,12 +19,16 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Elastic Agent Service Terminated" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "b627cd12-dac4-11ec-9582-f661ea17fbcd" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: Windows", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml b/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml index eb6c35024..4bfa53570 100644 --- a/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml +++ b/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,15 +20,19 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Masquerading Space After Filename" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1036-masquerading", ] risk_score = 47 rule_id = "f5fb4598-4f10-11ed-bdc3-0242ac120002" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/defense_evasion_timestomp_touch.toml b/rules/cross-platform/defense_evasion_timestomp_touch.toml index b0069f9a4..b4dd010d2 100644 --- a/rules/cross-platform/defense_evasion_timestomp_touch.toml +++ b/rules/cross-platform/defense_evasion_timestomp_touch.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "Timestomping using Touch Command" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "b0046934-486e-462f-9487-0d4cf9e429c6" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/discovery_security_software_grep.toml b/rules/cross-platform/discovery_security_software_grep.toml index f9d9756c7..4e9d9c1c8 100644 --- a/rules/cross-platform/discovery_security_software_grep.toml +++ b/rules/cross-platform/discovery_security_software_grep.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -48,12 +48,18 @@ This rule looks for the execution of the `grep` utility with arguments compatibl - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "870aecc0-cea4-4110-af3f-e02e9b373655" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", diff --git a/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml b/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml index 240ed694d..67dd4291b 100644 --- a/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml +++ b/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -24,13 +24,17 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Virtual Machine Fingerprinting via Grep" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://objective-see.com/blog/blog_0x4F.html"] risk_score = 47 rule_id = "c85eb82c-d2c8-485c-a36f-534f914b7663" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/execution_python_script_in_cmdline.toml b/rules/cross-platform/execution_python_script_in_cmdline.toml index 197752e72..fc32f00c2 100644 --- a/rules/cross-platform/execution_python_script_in_cmdline.toml +++ b/rules/cross-platform/execution_python_script_in_cmdline.toml @@ -2,7 +2,9 @@ creation_date = "2021/01/13" integration = ["endpoint"] maturity = "development" -updated_date = "2023/06/22" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -16,12 +18,16 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Python Script Execution via Command Line" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "ee9f08dc-cf80-4124-94ae-08c405f059ae" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: macOS", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/cross-platform/execution_revershell_via_shell_cmd.toml b/rules/cross-platform/execution_revershell_via_shell_cmd.toml index 4e8ddc53c..aee9c12c8 100644 --- a/rules/cross-platform/execution_revershell_via_shell_cmd.toml +++ b/rules/cross-platform/execution_revershell_via_shell_cmd.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -46,9 +46,6 @@ This rule identifies commands that are potentially related to reverse shell acti - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md", @@ -57,6 +54,15 @@ references = [ ] risk_score = 73 rule_id = "a1a0375f-22c2-48c0-81a4-7c2d11cc6856" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "high" tags = ["Domain: Endpoint", "OS: Linux", diff --git a/rules/cross-platform/execution_suspicious_jar_child_process.toml b/rules/cross-platform/execution_suspicious_jar_child_process.toml index 9cf5d2259..7afbcbd6c 100644 --- a/rules/cross-platform/execution_suspicious_jar_child_process.toml +++ b/rules/cross-platform/execution_suspicious_jar_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -46,9 +46,6 @@ This rule identifies a suspicious child process of the Java interpreter process. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.lunasec.io/docs/blog/log4j-zero-day/", @@ -59,6 +56,15 @@ references = [ ] risk_score = 47 rule_id = "8acb7614-1d92-4359-bfcf-478b6d9de150" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", diff --git a/rules/cross-platform/impact_hosts_file_modified.toml b/rules/cross-platform/impact_hosts_file_modified.toml index 99fc5e61d..fd91d3d57 100644 --- a/rules/cross-platform/impact_hosts_file_modified.toml +++ b/rules/cross-platform/impact_hosts_file_modified.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -50,15 +50,21 @@ This rule identifies modifications in the hosts file across multiple operating s - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -For Windows systems using Auditbeat, this rule requires adding `C:/Windows/System32/drivers/etc` as an additional path in the 'file_integrity' module of auditbeat.yml. - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-reference-yml.html"] risk_score = 47 rule_id = "9c260313-c811-4ec8-ab89-8f6530e0246c" +setup=""" + +For Windows systems using Auditbeat, this rule requires adding `C:/Windows/System32/drivers/etc` as an additional path in the 'file_integrity' module of auditbeat.yml. + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "OS: Windows", "OS: macOS", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timeline_id = "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c" diff --git a/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml b/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml index d07b08dd5..77bc8731a 100644 --- a/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml +++ b/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml @@ -3,7 +3,7 @@ creation_date = "2020/09/14" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,15 +18,15 @@ index = ["filebeat-*"] language = "kuery" license = "Elastic License v2" name = "Zoom Meeting with no Passcode" -note = """## Setup - -The Zoom Filebeat module or similarly structured data is required to be compatible with this rule.""" references = [ "https://blog.zoom.us/a-message-to-our-users/", "https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic", ] risk_score = 47 rule_id = "58ac2aa5-6718-427c-a845-5f3ac5af00ba" +setup = """ + +The Zoom Filebeat module or similarly structured data is required to be compatible with this rule.""" severity = "medium" tags = [ "Data Source: Zoom", diff --git a/rules/cross-platform/threat_intel_indicator_match_address.toml b/rules/cross-platform/threat_intel_indicator_match_address.toml index 33b1f3a77..9a1a5953b 100644 --- a/rules/cross-platform/threat_intel_indicator_match_address.toml +++ b/rules/cross-platform/threat_intel_indicator_match_address.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2023/05/22" maturity = "production" -updated_date = "2023/06/27" +updated_date = "2023/10/19" min_stack_comments = """ Limiting the backport of these rules to the stack version which we are deprecating the Threat Intel Indicator Match general rules. @@ -100,11 +100,6 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). - -More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). """ references = [ "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", @@ -113,6 +108,15 @@ references = [ ] risk_score = 99 rule_id = "0c41e478-5263-4c69-8f9e-7dfd2c22da64" +setup=""" + +This rule needs threat intelligence indicators to work. +Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), +the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), +or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). + +More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). +""" severity = "critical" tags = ["OS: Windows", "Data Source: Elastic Endgame", "Rule Type: Indicator Match"] timeline_id = "495ad7a7-316e-4544-8a0f-9c098daee76e" diff --git a/rules/cross-platform/threat_intel_indicator_match_hash.toml b/rules/cross-platform/threat_intel_indicator_match_hash.toml index bc87591b0..7a407d297 100644 --- a/rules/cross-platform/threat_intel_indicator_match_hash.toml +++ b/rules/cross-platform/threat_intel_indicator_match_hash.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2023/05/22" maturity = "production" -updated_date = "2023/08/23" +updated_date = "2023/10/19" min_stack_comments = """ Limiting the backport of these rules to the stack version which we are deprecating the Threat Intel Indicator Match general rules. @@ -99,11 +99,6 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). - -More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). """ references = [ "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", @@ -112,6 +107,15 @@ references = [ ] risk_score = 99 rule_id = "aab184d3-72b3-4639-b242-6597c99d8bca" +setup=""" + +This rule needs threat intelligence indicators to work. +Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), +the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), +or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). + +More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). +""" severity = "critical" tags = ["OS: Windows", "Data Source: Elastic Endgame", "Rule Type: Indicator Match"] timeline_id = "495ad7a7-316e-4544-8a0f-9c098daee76e" diff --git a/rules/cross-platform/threat_intel_indicator_match_registry.toml b/rules/cross-platform/threat_intel_indicator_match_registry.toml index 0544553c9..6ced44d9d 100644 --- a/rules/cross-platform/threat_intel_indicator_match_registry.toml +++ b/rules/cross-platform/threat_intel_indicator_match_registry.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2023/05/22" maturity = "production" -updated_date = "2023/06/27" +updated_date = "2023/10/19" min_stack_comments = """ Limiting the backport of these rules to the stack version which we are deprecating the Threat Intel Indicator Match general rules. @@ -94,11 +94,6 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). - -More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). """ references = [ "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", @@ -107,6 +102,15 @@ references = [ ] risk_score = 99 rule_id = "a61809f3-fb5b-465c-8bff-23a8a068ac60" +setup=""" + +This rule needs threat intelligence indicators to work. +Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), +the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), +or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). + +More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). +""" severity = "critical" tags = ["OS: Windows", "Data Source: Elastic Endgame", "Rule Type: Indicator Match"] timeline_id = "495ad7a7-316e-4544-8a0f-9c098daee76e" diff --git a/rules/cross-platform/threat_intel_indicator_match_url.toml b/rules/cross-platform/threat_intel_indicator_match_url.toml index 548dcb99a..9fbb7f9ea 100644 --- a/rules/cross-platform/threat_intel_indicator_match_url.toml +++ b/rules/cross-platform/threat_intel_indicator_match_url.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2023/05/22" maturity = "production" -updated_date = "2023/07/24" +updated_date = "2023/10/19" min_stack_comments = """ Limiting the backport of these rules to the stack version which we are deprecating the Threat Intel Indicator Match general rules. @@ -103,11 +103,6 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). - -More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). """ references = [ "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", @@ -116,6 +111,15 @@ references = [ ] risk_score = 99 rule_id = "f3e22c8b-ea47-45d1-b502-b57b6de950b3" +setup=""" + +This rule needs threat intelligence indicators to work. +Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), +the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), +or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration). + +More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html). +""" severity = "critical" tags = ["OS: Windows", "Data Source: Elastic Endgame", "Rule Type: Indicator Match"] timeline_id = "495ad7a7-316e-4544-8a0f-9c098daee76e" diff --git a/rules/macos/credential_access_access_to_browser_credentials_procargs.toml b/rules/macos/credential_access_access_to_browser_credentials_procargs.toml index 07c41358e..1b3d91132 100644 --- a/rules/macos/credential_access_access_to_browser_credentials_procargs.toml +++ b/rules/macos/credential_access_access_to_browser_credentials_procargs.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/08/31" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Access of Stored Browser Credentials" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://securelist.com/calisto-trojan-for-macos/86543/"] risk_score = 73 rule_id = "20457e4f-d1de-4b92-ae69-142e27a4342a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/credential_access_credentials_keychains.toml b/rules/macos/credential_access_credentials_keychains.toml index 2f68ef9e8..8bac1e60a 100644 --- a/rules/macos/credential_access_credentials_keychains.toml +++ b/rules/macos/credential_access_credentials_keychains.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Access to Keychain Credentials Directories" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://objective-see.com/blog/blog_0x25.html", "https://securelist.com/calisto-trojan-for-macos/86543/", ] risk_score = 73 rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/credential_access_dumping_keychain_security.toml b/rules/macos/credential_access_dumping_keychain_security.toml index cfe887826..587a31f4a 100644 --- a/rules/macos/credential_access_dumping_keychain_security.toml +++ b/rules/macos/credential_access_dumping_keychain_security.toml @@ -18,9 +18,13 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Dumping of Keychain Content via Security Command" -note = """## Setup +setup = """ -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html """ references = ["https://ss64.com/osx/security.html"] risk_score = 73 diff --git a/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml b/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml index acaa67ea4..8fe39e4c7 100644 --- a/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml +++ b/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -19,10 +19,6 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Keychain Password Retrieval via Command Line" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.netmeister.org/blog/keychain-passwords.html", "https://github.com/priyankchheda/chrome_password_grabber/blob/master/chrome.py", @@ -31,6 +27,14 @@ references = [ ] risk_score = 73 rule_id = "9092cd6c-650f-4fa3-8a8a-28256c7489c9" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/credential_access_promt_for_pwd_via_osascript.toml b/rules/macos/credential_access_promt_for_pwd_via_osascript.toml index 3a2483579..1ff8a8613 100644 --- a/rules/macos/credential_access_promt_for_pwd_via_osascript.toml +++ b/rules/macos/credential_access_promt_for_pwd_via_osascript.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Prompt for Credentials with OSASCRIPT" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py", "https://ss64.com/osx/osascript.html", ] risk_score = 73 rule_id = "38948d29-3d5d-42e3-8aec-be832aaaf8eb" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml b/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml index c493f283f..e07dd6b71 100644 --- a/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml +++ b/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Attempt to Remove File Quarantine Attribute" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html", "https://ss64.com/osx/xattr.html", ] risk_score = 47 rule_id = "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml b/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml index c026c8e63..b08fb8758 100644 --- a/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml +++ b/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,10 +18,6 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privacy Control Bypass via TCCDB Modification" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/", "https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh", @@ -29,6 +25,14 @@ references = [ ] risk_score = 47 rule_id = "eea82229-b002-470e-a9e1-00be38b14d32" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml b/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml index 9390c9475..c2b59e90f 100644 --- a/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml +++ b/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,15 +18,19 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Potential Privacy Control Bypass via Localhost Secure Copy" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html", ] risk_score = 73 rule_id = "c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/discovery_users_domain_built_in_commands.toml b/rules/macos/discovery_users_domain_built_in_commands.toml index a41b23a07..f38d4af84 100644 --- a/rules/macos/discovery_users_domain_built_in_commands.toml +++ b/rules/macos/discovery_users_domain_built_in_commands.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Enumeration of Users or Groups via Built-in Commands" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "6e9b351e-a531-4bdc-b73e-7034d6eed7ff" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/lateral_movement_mounting_smb_share.toml b/rules/macos/lateral_movement_mounting_smb_share.toml index 7752fee96..a22a8f619 100644 --- a/rules/macos/lateral_movement_mounting_smb_share.toml +++ b/rules/macos/lateral_movement_mounting_smb_share.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Attempt to Mount SMB Share via Command Line" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://www.freebsd.org/cgi/man.cgi?mount_smbfs", "https://ss64.com/osx/mount.html"] risk_score = 21 rule_id = "661545b4-1a90-4f45-85ce-2ebd7c6a15d0" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/lateral_movement_vpn_connection_attempt.toml b/rules/macos/lateral_movement_vpn_connection_attempt.toml index f0dd7b974..ec4bc9f61 100644 --- a/rules/macos/lateral_movement_vpn_connection_attempt.toml +++ b/rules/macos/lateral_movement_vpn_connection_attempt.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,10 +17,6 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Virtual Private Network Connection Attempt" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/manage/vpn.rb", "https://www.unix.com/man-page/osx/8/networksetup/", @@ -28,6 +24,14 @@ references = [ ] risk_score = 21 rule_id = "15dacaa0-5b90-466b-acab-63435a59701a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_creation_hidden_login_item_osascript.toml b/rules/macos/persistence_creation_hidden_login_item_osascript.toml index a8ede731e..6d9bac89c 100644 --- a/rules/macos/persistence_creation_hidden_login_item_osascript.toml +++ b/rules/macos/persistence_creation_hidden_login_item_osascript.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Creation of Hidden Login Item via Apple Script" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "f24bcae1-8980-4b30-b5dd-f851b055c9e7" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_emond_rules_file_creation.toml b/rules/macos/persistence_emond_rules_file_creation.toml index 899249fd7..66722e693 100644 --- a/rules/macos/persistence_emond_rules_file_creation.toml +++ b/rules/macos/persistence_emond_rules_file_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Emond Rules Creation or Modification" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.xorrior.com/emond-persistence/", "https://www.sentinelone.com/blog/how-malware-persists-on-macos/", ] risk_score = 47 rule_id = "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml b/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml index 339b64e9d..b7e0f1ff8 100644 --- a/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml +++ b/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,15 +17,19 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Creation of Hidden Launch Agent or Daemon" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", ] risk_score = 47 rule_id = "092b068f-84ac-485d-8a55-7dd9e006715f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_login_logout_hooks_defaults.toml b/rules/macos/persistence_login_logout_hooks_defaults.toml index f90b818e5..8f3498092 100644 --- a/rules/macos/persistence_login_logout_hooks_defaults.toml +++ b/rules/macos/persistence_login_logout_hooks_defaults.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Persistence via Login or Logout Hook" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.virusbulletin.com/uploads/pdf/conference_slides/2014/Wardle-VB2014.pdf", "https://www.manpagez.com/man/1/defaults/", ] risk_score = 47 rule_id = "5d0265bf-dea9-41a9-92ad-48a8dcd05080" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml b/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml index 2d26195a3..b0a286156 100644 --- a/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml +++ b/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Sublime Plugin or Application Script Modification" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"] risk_score = 21 rule_id = "88817a33-60d3-411f-ba79-7c905d865b2a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml b/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml index 3090eba49..76066136a 100644 --- a/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml +++ b/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -26,10 +26,6 @@ as a download of a payload from a server. - Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to identify whether the file is malicious or not. - -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://posts.specterops.io/saving-your-access-d562bf5bf90b", @@ -37,6 +33,15 @@ references = [ ] risk_score = 47 rule_id = "48d7f54d-c29e-4430-93a9-9db6b5892270" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/persistence_screensaver_plist_file_modification.toml b/rules/macos/persistence_screensaver_plist_file_modification.toml index 070432064..8aa669d19 100644 --- a/rules/macos/persistence_screensaver_plist_file_modification.toml +++ b/rules/macos/persistence_screensaver_plist_file_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -24,9 +24,6 @@ note = """## Triage and analysis - Investigate the process that modified the plist file for malicious code or other suspicious behavior - Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://posts.specterops.io/saving-your-access-d562bf5bf90b", @@ -34,6 +31,15 @@ references = [ ] risk_score = 47 rule_id = "e6e8912f-283f-4d0d-8442-e0dcaf49944b" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/macos/privilege_escalation_applescript_with_admin_privs.toml b/rules/macos/privilege_escalation_applescript_with_admin_privs.toml index ab7895647..73b7a1ac7 100644 --- a/rules/macos/privilege_escalation_applescript_with_admin_privs.toml +++ b/rules/macos/privilege_escalation_applescript_with_admin_privs.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["auditbeat-*", "logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Apple Scripting Execution with Administrator Privileges" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://discussions.apple.com/thread/2266150"] risk_score = 47 rule_id = "827f8d8f-4117-4ae4-b551-f56d54b9da6b" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_email_powershell_exchange_mailbox.toml b/rules/windows/collection_email_powershell_exchange_mailbox.toml index c0015c63e..0621e9acd 100644 --- a/rules/windows/collection_email_powershell_exchange_mailbox.toml +++ b/rules/windows/collection_email_powershell_exchange_mailbox.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -59,9 +59,6 @@ Attackers can abuse this functionality in preparation for exfiltrating contents, - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", @@ -69,6 +66,14 @@ references = [ ] risk_score = 47 rule_id = "6aace640-e631-4870-ba8e-5fdda09325db" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_posh_audio_capture.toml b/rules/windows/collection_posh_audio_capture.toml index 35f7a19ba..3e08d0f6e 100644 --- a/rules/windows/collection_posh_audio_capture.toml +++ b/rules/windows/collection_posh_audio_capture.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -53,7 +53,11 @@ Attackers can use PowerShell to interact with the Windows API with the intent of - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = ["https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1"] +risk_score = 47 +rule_id = "2f2f4939-0b34-40c2-a0a3-844eb7889f43" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -71,9 +75,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = ["https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1"] -risk_score = 47 -rule_id = "2f2f4939-0b34-40c2-a0a3-844eb7889f43" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_posh_clipboard_capture.toml b/rules/windows/collection_posh_clipboard_capture.toml index 8c2019cbd..00ac625f4 100644 --- a/rules/windows/collection_posh_clipboard_capture.toml +++ b/rules/windows/collection_posh_clipboard_capture.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,7 +55,14 @@ Attackers can abuse PowerShell capabilities to get the contents of the clipboard - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1", +] +risk_score = 47 +rule_id = "92984446-aefb-4d5e-ad12-598042ca80ba" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -73,12 +80,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard", - "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1", -] -risk_score = 47 -rule_id = "92984446-aefb-4d5e-ad12-598042ca80ba" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Data Source: PowerShell Logs", "Resources: Investigation Guide"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_posh_keylogger.toml b/rules/windows/collection_posh_keylogger.toml index a625a73fd..20d033f2b 100644 --- a/rules/windows/collection_posh_keylogger.toml +++ b/rules/windows/collection_posh_keylogger.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,7 +55,14 @@ Attackers can abuse PowerShell capabilities to capture user keystrokes with the - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-Keystrokes.ps1", + "https://github.com/MojtabaTajik/FunnyKeylogger/blob/master/FunnyLogger.ps1", +] +risk_score = 47 +rule_id = "bd2c86a0-8b61-4457-ab38-96943984e889" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -73,12 +80,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-Keystrokes.ps1", - "https://github.com/MojtabaTajik/FunnyKeylogger/blob/master/FunnyLogger.ps1", -] -risk_score = 47 -rule_id = "bd2c86a0-8b61-4457-ab38-96943984e889" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_posh_mailbox.toml b/rules/windows/collection_posh_mailbox.toml index edc8573fd..7846029f4 100644 --- a/rules/windows/collection_posh_mailbox.toml +++ b/rules/windows/collection_posh_mailbox.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -56,7 +56,14 @@ This rule identifies scripts that contains methods and classes that can be abuse - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/dafthack/MailSniper/blob/master/MailSniper.ps1", + "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1", +] +risk_score = 47 +rule_id = "a2d04374-187c-4fd9-b513-3ad4e7fdd67a" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -74,12 +81,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/dafthack/MailSniper/blob/master/MailSniper.ps1", - "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1", -] -risk_score = 47 -rule_id = "a2d04374-187c-4fd9-b513-3ad4e7fdd67a" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Data Source: PowerShell Logs", "Resources: Investigation Guide"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_posh_screen_grabber.toml b/rules/windows/collection_posh_screen_grabber.toml index fd02e08f6..9fc9c9127 100644 --- a/rules/windows/collection_posh_screen_grabber.toml +++ b/rules/windows/collection_posh_screen_grabber.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -54,7 +54,11 @@ Attackers can abuse PowerShell capabilities and take screen captures of desktops - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = ["https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen"] +risk_score = 47 +rule_id = "959a7353-1129-4aa7-9084-30746b256a70" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -72,9 +76,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = ["https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen"] -risk_score = 47 -rule_id = "959a7353-1129-4aa7-9084-30746b256a70" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/collection_winrar_encryption.toml b/rules/windows/collection_winrar_encryption.toml index a0d2d78b9..cddc0e844 100644 --- a/rules/windows/collection_winrar_encryption.toml +++ b/rules/windows/collection_winrar_encryption.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -50,13 +50,18 @@ These steps are usually done in preparation for exfiltration, meaning the attack - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"] risk_score = 47 rule_id = "45d273fb-1dca-457d-9855-bcb302180c21" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/command_and_control_encrypted_channel_freesslcert.toml b/rules/windows/command_and_control_encrypted_channel_freesslcert.toml index b36e716f1..a1a30da97 100644 --- a/rules/windows/command_and_control_encrypted_channel_freesslcert.toml +++ b/rules/windows/command_and_control_encrypted_channel_freesslcert.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Connection to Commonly Abused Free SSL Certificate Providers" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "e3cf38fa-d5b8-46cc-87f9-4a7513e4281d" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/command_and_control_port_forwarding_added_registry.toml b/rules/windows/command_and_control_port_forwarding_added_registry.toml index d1b13d314..8f966609c 100644 --- a/rules/windows/command_and_control_port_forwarding_added_registry.toml +++ b/rules/windows/command_and_control_port_forwarding_added_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -59,15 +59,20 @@ This rule monitors the modifications to the `HKLM\\SYSTEM\\*ControlSet*\\Service - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", ] risk_score = 47 rule_id = "3535c8bb-3bd5-40f4-ae32-b7cd589d5372" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/command_and_control_rdp_tunnel_plink.toml b/rules/windows/command_and_control_rdp_tunnel_plink.toml index 6ccc79126..6a0ca0440 100644 --- a/rules/windows/command_and_control_rdp_tunnel_plink.toml +++ b/rules/windows/command_and_control_rdp_tunnel_plink.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -52,13 +52,18 @@ This rule looks for command lines involving the `3389` port, which RDP uses by d - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://blog.netspi.com/how-to-access-rdp-over-a-reverse-ssh-tunnel/"] risk_score = 73 rule_id = "76fd43b7-3480-4dd9-8ad7-8bd36bfad92f" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml b/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml index 59c928434..ad5c2304b 100644 --- a/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml +++ b/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml @@ -2,7 +2,7 @@ creation_date = "2020/09/03" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -98,13 +98,18 @@ The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop i - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/"] risk_score = 47 rule_id = "15c0b7a7-9c34-4869-b25b-fa6518414899" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml b/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml index b9300b4cf..0689cc5a1 100644 --- a/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml +++ b/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml @@ -2,7 +2,7 @@ creation_date = "2020/09/03" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -92,9 +92,6 @@ The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used t - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://twitter.com/mohammadaskar2/status/1301263551638761477", @@ -102,6 +99,14 @@ references = [ ] risk_score = 47 rule_id = "c6453e73-90eb-4fe7-a98c-cde7bbfc504a" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/command_and_control_teamviewer_remote_file_copy.toml b/rules/windows/command_and_control_teamviewer_remote_file_copy.toml index 2909cf10a..3ad575dd8 100644 --- a/rules/windows/command_and_control_teamviewer_remote_file_copy.toml +++ b/rules/windows/command_and_control_teamviewer_remote_file_copy.toml @@ -2,7 +2,7 @@ creation_date = "2020/09/02" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/10/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -91,13 +91,18 @@ TeamViewer is a remote access and remote control tool used by helpdesks and syst - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html"] risk_score = 47 rule_id = "b25a7df2-120a-4db2-bd3f-3e4b86b24bee" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_bruteforce_admin_account.toml b/rules/windows/credential_access_bruteforce_admin_account.toml index 46aabe4b2..db0ed4795 100644 --- a/rules/windows/credential_access_bruteforce_admin_account.toml +++ b/rules/windows/credential_access_bruteforce_admin_account.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -93,13 +93,18 @@ This rule identifies potential password guessing/brute force activity from a sin - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625"] risk_score = 47 rule_id = "f9790abf-bd0c-45f9-8b5f-d0b74015e029" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide"] type = "eql" diff --git a/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml b/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml index 8d97b198d..efa9d7683 100644 --- a/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml +++ b/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -97,13 +97,18 @@ This rule identifies potential password guessing/brute force activity from a sin - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625"] risk_score = 47 rule_id = "4e85dc8a-3e41-40d8-bc28-91af7ac6cf60" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide"] type = "eql" diff --git a/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml b/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml index a288ce930..e4d0a5ffc 100644 --- a/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml +++ b/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -97,9 +97,6 @@ This rule identifies potential password guessing/brute force activity from a sin - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -- In some cases the source network address in Windows events 4625/4624 is not populated due to Microsoft logging limitations (examples in the references links). This edge case will break the rule condition and it won't trigger an alert. """ references = [ "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625", @@ -109,6 +106,10 @@ references = [ ] risk_score = 47 rule_id = "48b6edfc-079d-4907-b43c-baffa243270d" +setup=""" + +- In some cases the source network address in Windows events 4625/4624 is not populated due to Microsoft logging limitations (examples in the references links). This edge case will break the rule condition and it won't trigger an alert. +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide"] type = "eql" diff --git a/rules/windows/credential_access_cmdline_dump_tool.toml b/rules/windows/credential_access_cmdline_dump_tool.toml index c6917a922..519816012 100644 --- a/rules/windows/credential_access_cmdline_dump_tool.toml +++ b/rules/windows/credential_access_cmdline_dump_tool.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -51,13 +51,18 @@ This rule looks for the execution of utilities that can extract credential data - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://lolbas-project.github.io/"] risk_score = 73 rule_id = "00140285-b827-4aee-aa09-8113f58a08f3" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml b/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml index 024a9e604..cbc796d4e 100644 --- a/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml +++ b/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Austin Songer"] @@ -18,10 +18,6 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "NTDS or SAM Database File Copied" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy", @@ -29,6 +25,14 @@ references = [ ] risk_score = 73 rule_id = "3bc6deaa-fbd4-433a-ae21-3e892f95624f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_dcsync_newterm_subjectuser.toml b/rules/windows/credential_access_dcsync_newterm_subjectuser.toml index 5b77051ea..7acd66999 100644 --- a/rules/windows/credential_access_dcsync_newterm_subjectuser.toml +++ b/rules/windows/credential_access_dcsync_newterm_subjectuser.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "The New Term rule type used in this rule was added in Elastic 8.4" min_stack_version = "8.4.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,7 +55,18 @@ This rule monitors for when a Windows Event ID 4662 (Operation was performed on - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", + "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", + "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", + "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync", +] +risk_score = 73 +rule_id = "5c6f4c58-b381-452a-8976-f1b1c6aa0def" +setup=""" The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -71,16 +82,6 @@ DS Access > Audit Directory Service Access (Success,Failure) ``` """ -references = [ - "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", - "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", - "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", - "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", - "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", - "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync", -] -risk_score = 73 -rule_id = "5c6f4c58-b381-452a-8976-f1b1c6aa0def" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring", "Data Source: Active Directory", "Resources: Investigation Guide"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_dcsync_replication_rights.toml b/rules/windows/credential_access_dcsync_replication_rights.toml index 4dd1adef6..128169a1f 100644 --- a/rules/windows/credential_access_dcsync_replication_rights.toml +++ b/rules/windows/credential_access_dcsync_replication_rights.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,7 +55,18 @@ This rule monitors for Event ID 4662 (Operation was performed on an Active Direc - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", + "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", + "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", + "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync", +] +risk_score = 73 +rule_id = "9f962927-1a4f-45f3-a57b-287f2c7029c1" +setup=""" The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -71,16 +82,6 @@ DS Access > Audit Directory Service Access (Success,Failure) ``` """ -references = [ - "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", - "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", - "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", - "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", - "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", - "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync", -] -risk_score = 73 -rule_id = "9f962927-1a4f-45f3-a57b-287f2c7029c1" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_disable_kerberos_preauth.toml b/rules/windows/credential_access_disable_kerberos_preauth.toml index eac4ef041..88a222227 100644 --- a/rules/windows/credential_access_disable_kerberos_preauth.toml +++ b/rules/windows/credential_access_disable_kerberos_preauth.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -46,7 +46,15 @@ AS-REP roasting is an attack against Kerberos for user accounts that do not requ - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://harmj0y.medium.com/roasting-as-reps-e6179a65216b", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md", +] +risk_score = 47 +rule_id = "e514d8cd-ed15-4011-84e2-d15147e059f1" +setup=""" The 'Audit User Account Management' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -62,13 +70,6 @@ Account Management > Audit User Account Management (Success,Failure) ``` """ -references = [ - "https://harmj0y.medium.com/roasting-as-reps-e6179a65216b", - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738", - "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md", -] -risk_score = 47 -rule_id = "e514d8cd-ed15-4011-84e2-d15147e059f1" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml b/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml index 6fb6503ee..9c694a6a0 100644 --- a/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml +++ b/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -21,9 +21,6 @@ note = """## Triage and analysis Domain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys. -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/", @@ -31,6 +28,14 @@ references = [ ] risk_score = 73 rule_id = "b83a7e96-2eb3-4edf-8346-427b6858d3bd" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_dump_registry_hives.toml b/rules/windows/credential_access_dump_registry_hives.toml index bc34a9e94..c349b2846 100644 --- a/rules/windows/credential_access_dump_registry_hives.toml +++ b/rules/windows/credential_access_dump_registry_hives.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -53,9 +53,6 @@ This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, w - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8", @@ -63,6 +60,14 @@ references = [ ] risk_score = 73 rule_id = "a7e7bfa3-088e-4f13-b29e-3986e0e756b8" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml b/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml index dbf6baa69..7a83198eb 100644 --- a/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml +++ b/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,13 +18,17 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "Microsoft IIS Service Account Password Dumped" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/"] risk_score = 73 rule_id = "0564fb9d-90b9-4234-a411-82a546dc1343" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_iis_connectionstrings_dumping.toml b/rules/windows/credential_access_iis_connectionstrings_dumping.toml index e983409d5..048769189 100644 --- a/rules/windows/credential_access_iis_connectionstrings_dumping.toml +++ b/rules/windows/credential_access_iis_connectionstrings_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -19,16 +19,20 @@ language = "eql" license = "Elastic License v2" max_signals = 33 name = "Microsoft IIS Connection Strings Decryption" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia", ] risk_score = 73 rule_id = "c25e9c87-95e1-4368-bfab-9fd34cf867ec" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_kerberoasting_unusual_process.toml b/rules/windows/credential_access_kerberoasting_unusual_process.toml index 0dbf2b623..4c4471cb9 100644 --- a/rules/windows/credential_access_kerberoasting_unusual_process.toml +++ b/rules/windows/credential_access_kerberoasting_unusual_process.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/02" integration = ["endpoint"] maturity = "production" -updated_date = "2023/10/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -101,12 +101,17 @@ Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` proce - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "897dc6b5-b39f-432a-8d75-d3730d50c782" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_ldap_attributes.toml b/rules/windows/credential_access_ldap_attributes.toml index c00a777ca..f4e5730c8 100644 --- a/rules/windows/credential_access_ldap_attributes.toml +++ b/rules/windows/credential_access_ldap_attributes.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,9 +17,14 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Access to a Sensitive LDAP Attribute" -note = """## Setup - -## Setup +references = [ + "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming", + "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136", +] +risk_score = 47 +rule_id = "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66" +setup = """ The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -35,13 +40,6 @@ DS Access > Audit Directory Service Access (Success,Failure) ``` """ -references = [ - "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming", - "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx", - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136", -] -risk_score = 47 -rule_id = "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_lsass_handle_via_malseclogon.toml b/rules/windows/credential_access_lsass_handle_via_malseclogon.toml index 8deda4fd0..8b5579977 100644 --- a/rules/windows/credential_access_lsass_handle_via_malseclogon.toml +++ b/rules/windows/credential_access_lsass_handle_via_malseclogon.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/06/29" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,13 +18,17 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Suspicious LSASS Access via MalSecLogon" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html"] risk_score = 73 rule_id = "7ba58110-ae13-439b-8192-357b0fcfa9d7" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_lsass_loaded_susp_dll.toml b/rules/windows/credential_access_lsass_loaded_susp_dll.toml index 791113daf..6bec3a140 100644 --- a/rules/windows/credential_access_lsass_loaded_susp_dll.toml +++ b/rules/windows/credential_access_lsass_loaded_susp_dll.toml @@ -4,7 +4,7 @@ maturity = "production" integration = ["endpoint"] min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Module Loaded by LSASS" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://blog.xpnsec.com/exploring-mimikatz-part-2/", "https://github.com/jas502n/mimikat_ssp" ] risk_score = 47 rule_id = "3a6001a0-0939-4bbe-86f4-47d8faeb7b97" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_lsass_memdump_file_created.toml b/rules/windows/credential_access_lsass_memdump_file_created.toml index 880cd68d1..e76d113f0 100644 --- a/rules/windows/credential_access_lsass_memdump_file_created.toml +++ b/rules/windows/credential_access_lsass_memdump_file_created.toml @@ -95,13 +95,18 @@ This rule looks for the creation of memory dump files with file names compatible - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://github.com/outflanknl/Dumpert", "https://github.com/hoangprod/AndrewSpecial"] risk_score = 73 rule_id = "f2f46686-6f3c-4724-bd7d-24e31c70f98f" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_lsass_memdump_handle_access.toml b/rules/windows/credential_access_lsass_memdump_handle_access.toml index 0c8e2e94c..031caee24 100644 --- a/rules/windows/credential_access_lsass_memdump_handle_access.toml +++ b/rules/windows/credential_access_lsass_memdump_handle_access.toml @@ -97,7 +97,18 @@ Adversaries may attempt to access credential material stored in LSASS process me - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656", + "https://twitter.com/jsecurity101/status/1227987828534956033?s=20", + "https://attack.mitre.org/techniques/T1003/001/", + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-170105221010.html", + "http://findingbad.blogspot.com/2017/", + "https://www.elastic.co/security-labs/detect-credential-access", +] +risk_score = 73 +rule_id = "208dbe77-01ed-4954-8d44-1e5751cb20de" +setup=""" Ensure advanced audit policies for Windows are enabled, specifically: Object Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested) @@ -116,18 +127,13 @@ Audit Handle Manipulation (Success,Failure) Also, this event generates only if the object’s [SACL](https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists) has the required access control entry (ACE) to handle the use of specific access rights. -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html """ -references = [ - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656", - "https://twitter.com/jsecurity101/status/1227987828534956033?s=20", - "https://attack.mitre.org/techniques/T1003/001/", - "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-170105221010.html", - "http://findingbad.blogspot.com/2017/", - "https://www.elastic.co/security-labs/detect-credential-access", -] -risk_score = 73 -rule_id = "208dbe77-01ed-4954-8d44-1e5751cb20de" + severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_mimikatz_memssp_default_logs.toml b/rules/windows/credential_access_mimikatz_memssp_default_logs.toml index 08e5324ca..f1bb4e0f7 100644 --- a/rules/windows/credential_access_mimikatz_memssp_default_logs.toml +++ b/rules/windows/credential_access_mimikatz_memssp_default_logs.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,13 +55,18 @@ This rule looks for the creation of a file named `mimilsa.log`, which is generat - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.elastic.co/security-labs/detect-credential-access"] risk_score = 73 rule_id = "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_mimikatz_powershell_module.toml b/rules/windows/credential_access_mimikatz_powershell_module.toml index d5c164318..8a105168d 100644 --- a/rules/windows/credential_access_mimikatz_powershell_module.toml +++ b/rules/windows/credential_access_mimikatz_powershell_module.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -64,7 +64,15 @@ More information about Mimikatz components and how to detect/prevent them can be - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://attack.mitre.org/software/S0002/", + "https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1", + "https://www.elastic.co/security-labs/detect-credential-access", +] +risk_score = 73 +rule_id = "ac96ceb8-4399-4191-af1d-4feeac1f1f46" +setup=""" The 'PowerShell Script Block Logging' logging policy must be configured (Enable). @@ -83,13 +91,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://attack.mitre.org/software/S0002/", - "https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1", - "https://www.elastic.co/security-labs/detect-credential-access", -] -risk_score = 73 -rule_id = "ac96ceb8-4399-4191-af1d-4feeac1f1f46" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_mod_wdigest_security_provider.toml b/rules/windows/credential_access_mod_wdigest_security_provider.toml index f3cefe661..680a532e6 100644 --- a/rules/windows/credential_access_mod_wdigest_security_provider.toml +++ b/rules/windows/credential_access_mod_wdigest_security_provider.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -62,9 +62,6 @@ Still, attackers can force WDigest to store the passwords insecurely on the memo - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html", @@ -74,6 +71,14 @@ references = [ ] risk_score = 73 rule_id = "d703a5af-d5b0-43bd-8ddb-7a5d500b7da5" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_posh_kerb_ticket_dump.toml b/rules/windows/credential_access_posh_kerb_ticket_dump.toml index 1eea7bc0f..3c7a56012 100644 --- a/rules/windows/credential_access_posh_kerb_ticket_dump.toml +++ b/rules/windows/credential_access_posh_kerb_ticket_dump.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/26" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,7 +17,12 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Kerberos Ticket Dump" -note = """## Setup +references = [ + "https://github.com/MzHmO/PowershellKerberos/blob/main/dumper.ps1", +] +risk_score = 47 +rule_id = "fddff193-48a3-484d-8d35-90bb3d323a56" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -35,11 +40,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/MzHmO/PowershellKerberos/blob/main/dumper.ps1", -] -risk_score = 47 -rule_id = "fddff193-48a3-484d-8d35-90bb3d323a56" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_posh_minidump.toml b/rules/windows/credential_access_posh_minidump.toml index 4cabc039c..5b6e4abf1 100644 --- a/rules/windows/credential_access_posh_minidump.toml +++ b/rules/windows/credential_access_posh_minidump.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -54,7 +54,15 @@ Attackers can abuse Process Memory Dump capabilities to extract credentials from - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1", + "https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Get-ProcessMiniDump.ps1", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", +] +risk_score = 73 +rule_id = "577ec21e-56fe-4065-91d8-45eb8224fe77" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -72,13 +80,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1", - "https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Get-ProcessMiniDump.ps1", - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", -] -risk_score = 73 -rule_id = "577ec21e-56fe-4065-91d8-45eb8224fe77" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_posh_request_ticket.toml b/rules/windows/credential_access_posh_request_ticket.toml index 45c53eeb1..8004a068b 100644 --- a/rules/windows/credential_access_posh_request_ticket.toml +++ b/rules/windows/credential_access_posh_request_ticket.toml @@ -51,7 +51,14 @@ Attackers can use PowerShell to request these Kerberos tickets, with the intent - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://cobalt.io/blog/kerberoast-attack-techniques", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1", +] +risk_score = 47 +rule_id = "eb610e70-f9e6-4949-82b9-f1c5bcd37c39" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -69,12 +76,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://cobalt.io/blog/kerberoast-attack-techniques", - "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1", -] -risk_score = 47 -rule_id = "eb610e70-f9e6-4949-82b9-f1c5bcd37c39" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml b/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml index 523ae4f9f..82c05f660 100644 --- a/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml +++ b/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/06/29" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Potential Credential Access via DuplicateHandle in LSASS" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://github.com/CCob/MirrorDump"] risk_score = 47 rule_id = "02a4576a-7480-4284-9327-548a806b5e48" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_remote_sam_secretsdump.toml b/rules/windows/credential_access_remote_sam_secretsdump.toml index f9718868c..f9dde3bf8 100644 --- a/rules/windows/credential_access_remote_sam_secretsdump.toml +++ b/rules/windows/credential_access_remote_sam_secretsdump.toml @@ -52,11 +52,6 @@ Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry - Ensure that the machine has the latest security updates and is not running unsupported Windows versions. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -This rule uses Elastic Endpoint file creation and system integration events for correlation. Both data should be collected from the host for this detection to work. - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py", @@ -64,6 +59,16 @@ references = [ ] risk_score = 73 rule_id = "850d901a-2a3c-46c6-8b22-55398a01aad8" +setup=""" + +This rule uses Elastic Endpoint file creation and system integration events for correlation. Both data should be collected from the host for this detection to work. + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_saved_creds_vault_winlog.toml b/rules/windows/credential_access_saved_creds_vault_winlog.toml index be0e6de82..725523a49 100644 --- a/rules/windows/credential_access_saved_creds_vault_winlog.toml +++ b/rules/windows/credential_access_saved_creds_vault_winlog.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Multiple Vault Web Credentials Read" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382", "https://www.elastic.co/security-labs/detect-credential-access", ] risk_score = 47 rule_id = "44fc462c-1159-4fa8-b1b7-9b6296ab4f96" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access"] type = "eql" diff --git a/rules/windows/credential_access_saved_creds_vaultcmd.toml b/rules/windows/credential_access_saved_creds_vaultcmd.toml index a5995dc5b..898e1f7fe 100644 --- a/rules/windows/credential_access_saved_creds_vaultcmd.toml +++ b/rules/windows/credential_access_saved_creds_vaultcmd.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,10 +18,6 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Searching for Saved Credentials via VaultCmd" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", "https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/", @@ -29,6 +25,14 @@ references = [ ] risk_score = 47 rule_id = "be8afaed-4bcd-4e0a-b5f9-5562003dde81" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml b/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml index 15c7ca4dc..cb2e9af8a 100644 --- a/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml +++ b/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -52,7 +52,17 @@ It is critical to control the assignment of this privilege. A user with this pri - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_alert_active_directory_user_control.yml", + "https://twitter.com/_nwodtuhs/status/1454049485080907776", + "https://www.thehacker.recipes/ad/movement/kerberos/delegations", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0105_windows_audit_authorization_policy_change.md", +] +risk_score = 73 +rule_id = "f494c678-3c33-43aa-b169-bb3d5198c41d" +setup=""" The 'Audit Authorization Policy Change' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -67,15 +77,6 @@ Policy Change > Audit Authorization Policy Change (Success,Failure) ``` """ -references = [ - "https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/", - "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_alert_active_directory_user_control.yml", - "https://twitter.com/_nwodtuhs/status/1454049485080907776", - "https://www.thehacker.recipes/ad/movement/kerberos/delegations", - "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0105_windows_audit_authorization_policy_change.md", -] -risk_score = 73 -rule_id = "f494c678-3c33-43aa-b169-bb3d5198c41d" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_shadow_credentials.toml b/rules/windows/credential_access_shadow_credentials.toml index 408d46122..c9959825c 100644 --- a/rules/windows/credential_access_shadow_credentials.toml +++ b/rules/windows/credential_access_shadow_credentials.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,7 +55,16 @@ Attackers with write privileges on this attribute over an object can abuse it to - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab", + "https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials", + "https://github.com/OTRF/Set-AuditRule", + "https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/", +] +risk_score = 73 +rule_id = "79f97b31-480e-4e63-a7f4-ede42bf2c6de" +setup=""" The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -78,14 +87,6 @@ As this specifies the msDS-KeyCredentialLink Attribute GUID, it is expected to b Set-AuditRule -AdObjectPath 'AD:\\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID 5b47d60f-6090-40b2-9f37-2a4de88f3063 -AuditFlags Success ``` """ -references = [ - "https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab", - "https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials", - "https://github.com/OTRF/Set-AuditRule", - "https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/", -] -risk_score = 73 -rule_id = "79f97b31-480e-4e63-a7f4-ede42bf2c6de" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Active Directory", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_spn_attribute_modified.toml b/rules/windows/credential_access_spn_attribute_modified.toml index ef03fbdc3..899a7184c 100644 --- a/rules/windows/credential_access_spn_attribute_modified.toml +++ b/rules/windows/credential_access_spn_attribute_modified.toml @@ -52,7 +52,18 @@ Attackers can also perform "Targeted Kerberoasting", which consists of adding fa - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://www.thehacker.recipes/ad/movement/access-controls/targeted-kerberoasting", + "https://www.qomplx.com/qomplx-knowledge-kerberoasting-attacks-explained/", + "https://www.thehacker.recipes/ad/movement/kerberos/kerberoast", + "https://attack.stealthbits.com/cracking-kerberos-tgs-tickets-using-kerberoasting", + "https://adsecurity.org/?p=280", + "https://github.com/OTRF/Set-AuditRule", +] +risk_score = 73 +rule_id = "0b2f3da5-b5ec-47d1-908b-6ebb74814289" +setup=""" The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -75,16 +86,6 @@ As this specifies the servicePrincipalName Attribute GUID, it is expected to be Set-AuditRule -AdObjectPath 'AD:\\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID f3a64788-5306-11d1-a9c5-0000f80367c1 -AuditFlags Success ``` """ -references = [ - "https://www.thehacker.recipes/ad/movement/access-controls/targeted-kerberoasting", - "https://www.qomplx.com/qomplx-knowledge-kerberoasting-attacks-explained/", - "https://www.thehacker.recipes/ad/movement/kerberos/kerberoast", - "https://attack.stealthbits.com/cracking-kerberos-tgs-tickets-using-kerberoasting", - "https://adsecurity.org/?p=280", - "https://github.com/OTRF/Set-AuditRule", -] -risk_score = 73 -rule_id = "0b2f3da5-b5ec-47d1-908b-6ebb74814289" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_suspicious_comsvcs_imageload.toml b/rules/windows/credential_access_suspicious_comsvcs_imageload.toml index 17ed18478..934de556a 100644 --- a/rules/windows/credential_access_suspicious_comsvcs_imageload.toml +++ b/rules/windows/credential_access_suspicious_comsvcs_imageload.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,13 +18,14 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Potential Credential Access via Renamed COM+ Services DLL" -note = """## Setup - -You will need to enable logging of ImageLoads in your Sysmon configuration to include COMSVCS.DLL by Imphash or Original -File Name.""" references = ["https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/"] risk_score = 73 rule_id = "c5c9f591-d111-4cf8-baec-c26a39bc31ef" +setup = """ + +You will need to enable logging of ImageLoads in your Sysmon configuration to include COMSVCS.DLL by Imphash or Original +File Name. +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic: Defense Evasion", "Data Source: Sysmon Only"] type = "eql" diff --git a/rules/windows/credential_access_suspicious_lsass_access_generic.toml b/rules/windows/credential_access_suspicious_lsass_access_generic.toml index 9f0cec5e3..189c8834e 100644 --- a/rules/windows/credential_access_suspicious_lsass_access_generic.toml +++ b/rules/windows/credential_access_suspicious_lsass_access_generic.toml @@ -16,12 +16,16 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Lsass Process Access" -note = """## Setup -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md"] risk_score = 47 rule_id = "128468bf-cab1-4637-99ea-fdf3780a4609" +setup = """ +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_suspicious_lsass_access_memdump.toml b/rules/windows/credential_access_suspicious_lsass_access_memdump.toml index 261319a36..04bb7f0d5 100644 --- a/rules/windows/credential_access_suspicious_lsass_access_memdump.toml +++ b/rules/windows/credential_access_suspicious_lsass_access_memdump.toml @@ -17,16 +17,20 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Potential Credential Access via LSASS Memory Dump" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz", "https://www.elastic.co/security-labs/detect-credential-access", ] risk_score = 73 rule_id = "9960432d-9b26-409f-972b-839a959e79e2" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Tactic:Execution", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml b/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml index ff5beb14c..d3c14edce 100644 --- a/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml +++ b/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/06/29" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,17 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "Potential LSASS Memory Dump via PssCaptureSnapShot" -note = """## Setup - -This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the threshold -rule cardinality feature.""" references = [ "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", "https://twitter.com/sbousseaden/status/1280619931516747777?lang=en", ] risk_score = 73 rule_id = "0f93cb9a-1931-48c2-8cd0-f173fd3e5283" +setup = """ + +This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the threshold +rule cardinality feature. +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml b/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml index 467843760..c1e1398cd 100644 --- a/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml +++ b/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -48,7 +48,15 @@ This rule identifies remote access to the registry using an account with Backup - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/mpgn/BackupOperatorToDA", + "https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp", + "https://www.elastic.co/security-labs/detect-credential-access", +] +risk_score = 47 +rule_id = "47e22836-4a16-4b35-beee-98f6c4ee9bf2" +setup=""" The 'Audit Detailed File Share' audit policy is required be configured (Success) on Domain Controllers and Sensitive Windows Servers. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -76,13 +84,6 @@ Logon/Logoff > Special Logon (Success) ``` """ -references = [ - "https://github.com/mpgn/BackupOperatorToDA", - "https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp", - "https://www.elastic.co/security-labs/detect-credential-access", -] -risk_score = 47 -rule_id = "47e22836-4a16-4b35-beee-98f6c4ee9bf2" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Credential Access", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] type = "eql" diff --git a/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml b/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml index 6dc31fb5b..e1d3a90d3 100644 --- a/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml +++ b/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Austin Songer"] @@ -56,7 +56,16 @@ Shadow copies are backups or snapshots of an endpoint's files or volumes while t - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink", + "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf", + "https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/", + "https://www.hackingarticles.in/credential-dumping-ntds-dit/", +] +risk_score = 47 +rule_id = "d117cbb4-7d56-41b4-b999-bdf8c25648a0" +setup=""" Ensure advanced audit policies for Windows are enabled, specifically: Object Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested) @@ -76,16 +85,12 @@ Audit Handle Manipulation (Success,Failure) This event will only trigger if symbolic links are created from a new process spawning cmd.exe or powershell.exe with the correct arguments. Direct access to a shell and calling symbolic link creation tools will not generate an event matching this rule. -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html """ -references = [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink", - "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf", - "https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/", - "https://www.hackingarticles.in/credential-dumping-ntds-dit/", -] -risk_score = 47 -rule_id = "d117cbb4-7d56-41b4-b999-bdf8c25648a0" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml b/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml index c8411f5ae..44fa933a5 100644 --- a/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml +++ b/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,18 +17,22 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Potential LSASS Clone Creation via PssCaptureSnapShot" -note = """## Setup - -This is meant to run only on datasources using Windows security event 4688 that captures the process clone creation. - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", "https://medium.com/@Achilles8284/the-birth-of-a-process-part-2-97c6fb9c42a2", ] risk_score = 73 rule_id = "a16612dd-b30e-4d41-86a0-ebe70974ec00" +setup = """ + +This is meant to run only on datasources using Windows security event 4688 that captures the process clone creation. + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_amsienable_key_mod.toml b/rules/windows/defense_evasion_amsienable_key_mod.toml index 553158a11..713554bfa 100644 --- a/rules/windows/defense_evasion_amsienable_key_mod.toml +++ b/rules/windows/defense_evasion_amsienable_key_mod.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -67,9 +67,6 @@ This rule monitors the modifications to the Software\\Microsoft\\Windows Script\ - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf", @@ -77,6 +74,14 @@ references = [ ] risk_score = 73 rule_id = "f874315d-5188-4b4a-8521-d1c73093a7e4" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_clearing_windows_console_history.toml b/rules/windows/defense_evasion_clearing_windows_console_history.toml index ff83e5d8a..d1d098db3 100644 --- a/rules/windows/defense_evasion_clearing_windows_console_history.toml +++ b/rules/windows/defense_evasion_clearing_windows_console_history.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Austin Songer"] @@ -48,9 +48,6 @@ Attackers can try to cover their tracks by clearing PowerShell console history. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility. -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://stefanos.cloud/kb/how-to-clear-the-powershell-command-history/", @@ -59,6 +56,14 @@ references = [ ] risk_score = 47 rule_id = "b5877334-677f-4fb9-86d5-a9721274223b" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_clearing_windows_event_logs.toml b/rules/windows/defense_evasion_clearing_windows_event_logs.toml index 9cffe7d9c..324fa7d92 100644 --- a/rules/windows/defense_evasion_clearing_windows_event_logs.toml +++ b/rules/windows/defense_evasion_clearing_windows_event_logs.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -49,12 +49,17 @@ This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-Ev - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "d331bbe2-6db4-4941-80a5-8270db72eb61" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_create_mod_root_certificate.toml b/rules/windows/defense_evasion_create_mod_root_certificate.toml index c97cfbea2..9b7d9ebe7 100644 --- a/rules/windows/defense_evasion_create_mod_root_certificate.toml +++ b/rules/windows/defense_evasion_create_mod_root_certificate.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -64,9 +64,6 @@ This rule identifies the creation or modification of a root certificate by monit - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec", @@ -74,6 +71,14 @@ references = [ ] risk_score = 21 rule_id = "203ab79b-239b-4aa5-8e54-fc50623ee8e4" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_defender_disabled_via_registry.toml b/rules/windows/defense_evasion_defender_disabled_via_registry.toml index 99a492b96..d54207652 100644 --- a/rules/windows/defense_evasion_defender_disabled_via_registry.toml +++ b/rules/windows/defense_evasion_defender_disabled_via_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -54,13 +54,18 @@ This rule monitors the registry for configurations that disable Windows Defender - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://thedfirreport.com/2020/12/13/defender-control/"] risk_score = 21 rule_id = "2ffa1f1e-b6db-47fa-994b-1512743847eb" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml b/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml index c7fca7156..2850893ae 100644 --- a/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml +++ b/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -64,15 +64,20 @@ Microsoft Windows Defender is an antivirus product built into Microsoft Windows. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf", ] risk_score = 47 rule_id = "2c17e5d7-08b9-43b2-b58a-0270d65ac85b" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml b/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml index 566e8931b..25f6a75a6 100644 --- a/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml +++ b/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -47,12 +47,17 @@ This rule identifies patterns related to disabling the Windows firewall or its r - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "4b438734-3793-4fda-bd42-ceeada0be8f9" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml b/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml index 7fd311f3c..86cb361e1 100644 --- a/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml +++ b/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -52,15 +52,20 @@ This rule monitors the execution of commands that can tamper the Windows Defende - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps", ] risk_score = 47 rule_id = "c8cccb06-faf2-4cd5-886e-2c9636cfcb87" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_disabling_windows_logs.toml b/rules/windows/defense_evasion_disabling_windows_logs.toml index b355b53a1..799cb062c 100644 --- a/rules/windows/defense_evasion_disabling_windows_logs.toml +++ b/rules/windows/defense_evasion_disabling_windows_logs.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Ivan Ninichuck", "Austin Songer"] @@ -48,9 +48,6 @@ This rule looks for the usage of different utilities to disable the EventLog ser - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman", @@ -58,6 +55,14 @@ references = [ ] risk_score = 21 rule_id = "4de76544-f0e5-486a-8f84-eae0b6063cdc" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_dns_over_https_enabled.toml b/rules/windows/defense_evasion_dns_over_https_enabled.toml index 335032239..d2e57afe8 100644 --- a/rules/windows/defense_evasion_dns_over_https_enabled.toml +++ b/rules/windows/defense_evasion_dns_over_https_enabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Austin Songer"] @@ -18,16 +18,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "DNS-over-HTTPS Enabled via Registry" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html", "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode", ] risk_score = 21 rule_id = "a22a09c2-2162-4df0-a356-9aacbeb56a04" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml b/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml index c6f8b87cd..61a1ad7c7 100644 --- a/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml +++ b/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious .NET Code Compilation" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "201200f1-a99b-43fb-88ed-f65a45c4972c" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml b/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml index dbaf9f9fa..167099248 100644 --- a/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml +++ b/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -53,12 +53,17 @@ This rule detects the creation of a Windows Firewall inbound rule that would all - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "074464f9-f30d-4029-8c03-0ed237fffec7" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml b/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml index 153a80b30..d0d5927b4 100644 --- a/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml +++ b/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -49,12 +49,17 @@ Attackers can enable Network Discovery on the Windows firewall to find other sys - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "8b4f0816-6a65-4630-86a6-c21c179c0d09" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml b/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml index 4e8aadde9..6a4883a2e 100644 --- a/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml +++ b/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/18" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Control Panel Process with Unusual Arguments" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://www.joesandbox.com/analysis/476188/1/html"] risk_score = 73 rule_id = "416697ae-e468-4093-a93d-59661fa619ec" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml b/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml index b5acccf53..05a1d131a 100644 --- a/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml +++ b/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/18" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "ImageLoad via Windows Update Auto Update Client" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://dtm.uk/wuauclt/"] risk_score = 47 rule_id = "edf8ee23-5ea7-4123-ba19-56b41e424ae3" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml index 369ec7f7e..e626be02a 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/18" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -73,13 +73,18 @@ This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. Thi - Consider improvements to the security awareness program. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html"] risk_score = 73 rule_id = "c5dc3223-13a2-44a2-946c-e9dc0aa0449c" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml index 9c190c368..ab0090d54 100755 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -20,6 +20,14 @@ license = "Elastic License v2" name = "Microsoft Build Engine Started by a Script Process" risk_score = 21 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml b/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml index 93dff83ab..6e2ded627 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/18" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Microsoft Build Engine Started by a System Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml b/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml index ab658982d..d5a420922 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -94,12 +94,17 @@ This rule checks for renamed instances of MSBuild, which can indicate an attempt - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml b/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml index f0f2e0ec0..3c28b88ce 100644 --- a/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml +++ b/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -23,13 +23,17 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "Microsoft Build Engine Started an Unusual Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html"] risk_score = 21 rule_id = "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml index 1333b53ac..6f225628d 100644 --- a/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml +++ b/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Potential DLL Side-Loading via Trusted Microsoft Programs" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 73 rule_id = "1160dcdb-0a0a-4a79-91d8-9b84616edebd" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_execution_windefend_unusual_path.toml b/rules/windows/defense_evasion_execution_windefend_unusual_path.toml index cbf4864f4..947f179c3 100644 --- a/rules/windows/defense_evasion_execution_windefend_unusual_path.toml +++ b/rules/windows/defense_evasion_execution_windefend_unusual_path.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Dennis Perto"] @@ -19,15 +19,19 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Potential DLL Side-Loading via Microsoft Antimalware Service Executable" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/", ] risk_score = 73 rule_id = "053a0387-f3b5-4ba5-8245-8002cca2bd08" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/defense_evasion_file_creation_mult_extension.toml b/rules/windows/defense_evasion_file_creation_mult_extension.toml index b661bcc2e..2cea69c4c 100644 --- a/rules/windows/defense_evasion_file_creation_mult_extension.toml +++ b/rules/windows/defense_evasion_file_creation_mult_extension.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Executable File Creation with Multiple Extensions" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "8b2b3a62-a598-4293-bc14-3d5fa22bb98f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_from_unusual_directory.toml b/rules/windows/defense_evasion_from_unusual_directory.toml index 4aa169d97..5ed51671d 100644 --- a/rules/windows/defense_evasion_from_unusual_directory.toml +++ b/rules/windows/defense_evasion_from_unusual_directory.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Process Execution from an Unusual Directory" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "ebfe1448-7fac-4d59-acea-181bd89b1f7f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_iis_httplogging_disabled.toml b/rules/windows/defense_evasion_iis_httplogging_disabled.toml index 11ea3faaf..edfe9668d 100644 --- a/rules/windows/defense_evasion_iis_httplogging_disabled.toml +++ b/rules/windows/defense_evasion_iis_httplogging_disabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -52,12 +52,17 @@ This rule monitors commands that disable IIS logging. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 73 rule_id = "ebf1adea-ccf2-4943-8b96-7ab11ca173a5" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml b/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml index 169eb6327..8952dee12 100644 --- a/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml +++ b/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious Endpoint Security Parent Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "b41a13c6-ba45-4bab-a534-df53d0cfed6a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_masquerading_renamed_autoit.toml b/rules/windows/defense_evasion_masquerading_renamed_autoit.toml index 78f90e748..f89ab8060 100644 --- a/rules/windows/defense_evasion_masquerading_renamed_autoit.toml +++ b/rules/windows/defense_evasion_masquerading_renamed_autoit.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -93,12 +93,17 @@ This rule checks for renamed instances of AutoIt, which can indicate an attempt - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "2e1e835d-01e5-48ca-b9fc-7a61f7f11902" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml b/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml index 15b1f18bd..bb0d0abc1 100644 --- a/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml +++ b/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,10 +18,6 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious WerFault Child Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/", "https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/", @@ -30,6 +26,14 @@ references = [ ] risk_score = 47 rule_id = "ac5012b8-8da8-440b-aaaf-aedafdea2dff" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_masquerading_trusted_directory.toml b/rules/windows/defense_evasion_masquerading_trusted_directory.toml index d7441c5ea..0d71ea1ff 100644 --- a/rules/windows/defense_evasion_masquerading_trusted_directory.toml +++ b/rules/windows/defense_evasion_masquerading_trusted_directory.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Program Files Directory Masquerading" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_microsoft_defender_tampering.toml b/rules/windows/defense_evasion_microsoft_defender_tampering.toml index ba1f9f237..28e126147 100644 --- a/rules/windows/defense_evasion_microsoft_defender_tampering.toml +++ b/rules/windows/defense_evasion_microsoft_defender_tampering.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Austin Songer"] @@ -55,9 +55,6 @@ This rule monitors the registry for modifications that disable Windows Defender - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", @@ -71,6 +68,14 @@ references = [ ] risk_score = 47 rule_id = "fe794edd-487f-4a90-b285-3ee54f2af2d3" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml b/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml index 74bbdc02f..f0adc54b4 100644 --- a/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml +++ b/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -66,12 +66,17 @@ This rule looks for registry changes affecting the conditions above. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "feeed87c-5e95-4339-aef1-47fd79bcfbe3" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_posh_assembly_load.toml b/rules/windows/defense_evasion_posh_assembly_load.toml index ae4556e74..2f7b934e9 100644 --- a/rules/windows/defense_evasion_posh_assembly_load.toml +++ b/rules/windows/defense_evasion_posh_assembly_load.toml @@ -2,7 +2,7 @@ creation_date = "2021/10/15" integration = ["windows"] maturity = "production" -updated_date = "2023/10/13" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -102,7 +102,11 @@ Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = ["https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load"] +risk_score = 47 +rule_id = "e26f042e-c590-4e82-8e05-41e81bd822ad" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -120,9 +124,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = ["https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load"] -risk_score = 47 -rule_id = "e26f042e-c590-4e82-8e05-41e81bd822ad" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_posh_compressed.toml b/rules/windows/defense_evasion_posh_compressed.toml index 97ac8536d..ea3c5c53b 100644 --- a/rules/windows/defense_evasion_posh_compressed.toml +++ b/rules/windows/defense_evasion_posh_compressed.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -103,7 +103,10 @@ Attackers can embed compressed and encoded payloads in scripts to load directly - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +risk_score = 47 +rule_id = "81fe9dc6-a2d7-4192-a2d8-eed98afc766a" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -121,8 +124,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -risk_score = 47 -rule_id = "81fe9dc6-a2d7-4192-a2d8-eed98afc766a" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_posh_process_injection.toml b/rules/windows/defense_evasion_posh_process_injection.toml index 24a3654f9..4eb1d0cb0 100644 --- a/rules/windows/defense_evasion_posh_process_injection.toml +++ b/rules/windows/defense_evasion_posh_process_injection.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -56,7 +56,16 @@ Red Team tooling and malware developers take advantage of these capabilities to - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-ReflectivePEInjection.ps1", + "https://github.com/BC-SECURITY/Empire/blob/master/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1", + "https://www.elastic.co/security-labs/detect-credential-access", +] +risk_score = 47 +rule_id = "2e29e96a-b67c-455a-afe4-de6183431d0d" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -74,14 +83,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1", - "https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/Invoke-ReflectivePEInjection.ps1", - "https://github.com/BC-SECURITY/Empire/blob/master/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1", - "https://www.elastic.co/security-labs/detect-credential-access", -] -risk_score = 47 -rule_id = "2e29e96a-b67c-455a-afe4-de6183431d0d" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml b/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml index dbb452e5e..42ca4b25d 100644 --- a/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml +++ b/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Austin Songer"] @@ -57,9 +57,6 @@ This rule identifies patterns related to disabling the Windows firewall or its r - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps", @@ -69,6 +66,14 @@ references = [ ] risk_score = 47 rule_id = "f63c8e3c-d396-404f-b2ea-0379d3942d73" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_proxy_execution_via_msdt.toml b/rules/windows/defense_evasion_proxy_execution_via_msdt.toml index 06edc6771..df9720034 100644 --- a/rules/windows/defense_evasion_proxy_execution_via_msdt.toml +++ b/rules/windows/defense_evasion_proxy_execution_via_msdt.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious Microsoft Diagnostics Wizard Execution" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://twitter.com/nao_sec/status/1530196847679401984", "https://lolbas-project.github.io/lolbas/Binaries/Msdt/", ] risk_score = 73 rule_id = "2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml b/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml index 994fba84b..22cfee419 100644 --- a/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml +++ b/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,13 +18,17 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Scheduled Tasks AT Command Enabled" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob"] risk_score = 47 rule_id = "9aa0e1f6-52ce-42e1-abb3-09657cee2698" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml b/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml index 4c11f503d..82893f451 100644 --- a/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml +++ b/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,15 +17,19 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "SolarWinds Process Disabling Services via Registry" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", ] risk_score = 47 rule_id = "b9960fef-82c6-4816-befa-44745030e917" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml b/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml index 067980346..dd3fe6054 100644 --- a/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml +++ b/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Execution from a Mounted Device" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/", ] risk_score = 47 rule_id = "8a1d4831-3ce6-4859-9891-28931fa6101d" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml b/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml index eb411b70d..261c92064 100644 --- a/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml +++ b/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "Build time field required_fields divergence between -8.7 and 8.8+ due to schema versions." min_stack_version = "8.8.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -98,9 +98,6 @@ This rule identifies suspicious process access events from an unknown memory reg - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://twitter.com/SBousseaden/status/1278013896440324096", @@ -108,6 +105,14 @@ references = [ ] risk_score = 73 rule_id = "2dd480be-1263-4d9c-8672-172928f6789a" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml b/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml index 3799568ad..9f35c66e0 100644 --- a/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml +++ b/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -93,12 +93,17 @@ This rule looks for the creation of executable files done by system-critical pro - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 73 rule_id = "e94262f2-c1e9-4d3f-a907-aeab16712e1a" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml b/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml index d82cde4b5..347503504 100644 --- a/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml +++ b/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml @@ -4,7 +4,7 @@ maturity = "production" integration = ["endpoint"] min_stack_comments = "New fields added: dll.Ext.relative_file_creation_time is populated in Elastic Endpoint 8.4 and above." min_stack_version = "8.4.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Unsigned DLL Side-Loading from a Suspicious Folder" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "ca98c7cf-a56e-4057-a4e8-39603f7f0389" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_unusual_ads_file_creation.toml b/rules/windows/defense_evasion_unusual_ads_file_creation.toml index 23803b6f5..f0d6f96bc 100644 --- a/rules/windows/defense_evasion_unusual_ads_file_creation.toml +++ b/rules/windows/defense_evasion_unusual_ads_file_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/17" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -99,12 +99,17 @@ Attackers can abuse these alternate data streams to hide malicious files, string - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "71bccb61-e19b-452f-b104-79a60e546a95" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_unusual_dir_ads.toml b/rules/windows/defense_evasion_unusual_dir_ads.toml index d652d66f0..a2ec539c7 100644 --- a/rules/windows/defense_evasion_unusual_dir_ads.toml +++ b/rules/windows/defense_evasion_unusual_dir_ads.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Unusual Process Execution Path - Alternate Data Stream" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "4bd1c1af-79d4-4d37-9efa-6e0240640242" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_unusual_system_vp_child_program.toml b/rules/windows/defense_evasion_unusual_system_vp_child_program.toml index 6505482cc..e908eafc5 100644 --- a/rules/windows/defense_evasion_unusual_system_vp_child_program.toml +++ b/rules/windows/defense_evasion_unusual_system_vp_child_program.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -14,12 +14,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Unusual Child Process from a System Virtual Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 73 rule_id = "de9bd7e0-49e9-4e92-a64d-53ade2e66af1" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/defense_evasion_workfolders_control_execution.toml b/rules/windows/defense_evasion_workfolders_control_execution.toml index b9aa644a1..fdfa9ffaa 100644 --- a/rules/windows/defense_evasion_workfolders_control_execution.toml +++ b/rules/windows/defense_evasion_workfolders_control_execution.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Austin Songer"] @@ -48,9 +48,6 @@ disk from a separate binary. - Review integrating Windows Information Protection (WIP) to enforce data protection by encrypting the data on PCs using Work Folders. - Confirm with the user whether this was expected or not, and reset their password. -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://docs.microsoft.com/en-us/windows-server/storage/work-folders/work-folders-overview", @@ -59,6 +56,14 @@ references = [ ] risk_score = 47 rule_id = "ad0d2742-9a49-11ec-8d6b-acde48001122" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/discovery_adfind_command_activity.toml b/rules/windows/discovery_adfind_command_activity.toml index a777bad7d..b50a6d7c5 100644 --- a/rules/windows/discovery_adfind_command_activity.toml +++ b/rules/windows/discovery_adfind_command_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -53,9 +53,6 @@ note = """## Triage and analysis - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "http://www.joeware.net/freetools/tools/adfind/", @@ -67,6 +64,14 @@ references = [ ] risk_score = 21 rule_id = "eda499b8-a073-4e35-9733-22ec71f57f3a" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/discovery_admin_recon.toml b/rules/windows/discovery_admin_recon.toml index 640e7c090..885890710 100644 --- a/rules/windows/discovery_admin_recon.toml +++ b/rules/windows/discovery_admin_recon.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/14" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -49,12 +49,17 @@ This rule looks for the execution of the `net` and `wmic` utilities to enumerate - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "871ea072-1b71-4def-b016-6278b505138d" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/discovery_command_system_account.toml b/rules/windows/discovery_command_system_account.toml index ae778005c..0b1d7512b 100644 --- a/rules/windows/discovery_command_system_account.toml +++ b/rules/windows/discovery_command_system_account.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -46,12 +46,17 @@ This rule looks for the execution of account discovery utilities using the SYSTE - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). - Use the data collected through the analysis to investigate other machines affected in the environment. -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "2856446a-34e6-435b-9fb5-f8f040bfa7ed" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/discovery_peripheral_device.toml b/rules/windows/discovery_peripheral_device.toml index e36832140..e79a17c2b 100644 --- a/rules/windows/discovery_peripheral_device.toml +++ b/rules/windows/discovery_peripheral_device.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -46,12 +46,17 @@ This rule looks for the execution of the `fsutil` utility with the `fsinfo` subc - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/discovery_posh_invoke_sharefinder.toml b/rules/windows/discovery_posh_invoke_sharefinder.toml index 48a0bfc64..c5f92588f 100644 --- a/rules/windows/discovery_posh_invoke_sharefinder.toml +++ b/rules/windows/discovery_posh_invoke_sharefinder.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -50,7 +50,15 @@ Attackers can use PowerShell to enumerate shares to search for sensitive data li - Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://www.advintel.io/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations", + "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", +] +risk_score = 47 +rule_id = "4c59cff1-b78a-41b8-a9f1-4231984d1fb6" +setup=""" The 'PowerShell Script Block Logging' logging policy must be configured (Enable). @@ -69,13 +77,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://www.advintel.io/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations", - "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/", - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", -] -risk_score = 47 -rule_id = "4c59cff1-b78a-41b8-a9f1-4231984d1fb6" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/discovery_posh_suspicious_api_functions.toml b/rules/windows/discovery_posh_suspicious_api_functions.toml index f401869f5..0bc58e347 100644 --- a/rules/windows/discovery_posh_suspicious_api_functions.toml +++ b/rules/windows/discovery_posh_suspicious_api_functions.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -53,7 +53,14 @@ Attackers can use PowerShell to interact with the Win32 API to bypass command li - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", +] +risk_score = 47 +rule_id = "61ac3638-40a3-44b2-855a-985636ca985e" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -71,12 +78,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413", - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", -] -risk_score = 47 -rule_id = "61ac3638-40a3-44b2-855a-985636ca985e" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Collection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/discovery_privileged_localgroup_membership.toml b/rules/windows/discovery_privileged_localgroup_membership.toml index 744c5f3f9..6fedf5fdb 100644 --- a/rules/windows/discovery_privileged_localgroup_membership.toml +++ b/rules/windows/discovery_privileged_localgroup_membership.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/10" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -88,7 +88,10 @@ This rule looks for the enumeration of privileged local groups' membership by su - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +risk_score = 47 +rule_id = "291a0de9-937a-4189-94c0-3e847c8b13e4" +setup=""" The 'Audit Security Group Management' audit policy must be configured (Success). Steps to implement the logging policy with with Advanced Audit Configuration: @@ -106,10 +109,12 @@ Audit Security Group Management (Success) Microsoft introduced the [event used](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799) in this detection rule on Windows 10 and Windows Server 2016 or later operating systems. -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html """ -risk_score = 47 -rule_id = "291a0de9-937a-4189-94c0-3e847c8b13e4" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/discovery_whoami_command_activity.toml b/rules/windows/discovery_whoami_command_activity.toml index dcccd0c20..52028b477 100644 --- a/rules/windows/discovery_whoami_command_activity.toml +++ b/rules/windows/discovery_whoami_command_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -55,12 +55,17 @@ This rule looks for the execution of the `whoami` utility. Attackers commonly us - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "ef862985-3f13-4262-a686-5f357bbb9bc2" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml b/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml index f30c90402..fbadfaebf 100644 --- a/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml +++ b/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Command Execution via SolarWinds Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20FILEWRITES%20(METHODOLOGY).ioc", ] risk_score = 47 rule_id = "d72e33fc-6e91-42ff-ac8b-e573268c5a87" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Initial Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml b/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml index bf4cc721f..74e51e0b7 100644 --- a/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml +++ b/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious SolarWinds Child Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20CHILD%20PROCESSES%20(METHODOLOGY).ioc", ] risk_score = 47 rule_id = "93b22c0a-06a0-4131-b830-b10d5e166ff4" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_com_object_xwizard.toml b/rules/windows/execution_com_object_xwizard.toml index d1cd2a58d..c503a2871 100644 --- a/rules/windows/execution_com_object_xwizard.toml +++ b/rules/windows/execution_com_object_xwizard.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Execution of COM object via Xwizard" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/", "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/", ] risk_score = 47 rule_id = "1a6075b0-7479-450e-8fe7-b8b8438ac570" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_command_shell_started_by_svchost.toml b/rules/windows/execution_command_shell_started_by_svchost.toml index 707b1a6aa..010d9dfb2 100644 --- a/rules/windows/execution_command_shell_started_by_svchost.toml +++ b/rules/windows/execution_command_shell_started_by_svchost.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/19" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -89,15 +89,20 @@ This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747", ] risk_score = 21 rule_id = "fd7a6052-58fa-4397-93c3-4795249ccfa2" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/execution_command_shell_started_by_unusual_process.toml b/rules/windows/execution_command_shell_started_by_unusual_process.toml index f5c6bef24..7f7664d35 100644 --- a/rules/windows/execution_command_shell_started_by_unusual_process.toml +++ b/rules/windows/execution_command_shell_started_by_unusual_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -14,12 +14,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Unusual Parent Process for cmd.exe" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "3b47900d-e793-49e8-968f-c90dc3526aa1" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_command_shell_via_rundll32.toml b/rules/windows/execution_command_shell_via_rundll32.toml index d8b003529..f305b49fb 100644 --- a/rules/windows/execution_command_shell_via_rundll32.toml +++ b/rules/windows/execution_command_shell_via_rundll32.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -15,12 +15,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Command Shell Activity Started via RunDLL32" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "9ccf3ce0-0057-440a-91f5-870c6ad39093" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Credential Access", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_enumeration_via_wmiprvse.toml b/rules/windows/execution_enumeration_via_wmiprvse.toml index 007c5850f..a8859e609 100644 --- a/rules/windows/execution_enumeration_via_wmiprvse.toml +++ b/rules/windows/execution_enumeration_via_wmiprvse.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/19" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Enumeration Command Spawned via WMIPrvSE" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "770e0c4d-b998-41e5-a62e-c7901fd7f470" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/execution_from_unusual_path_cmdline.toml b/rules/windows/execution_from_unusual_path_cmdline.toml index d2ef500f5..d832bc27c 100644 --- a/rules/windows/execution_from_unusual_path_cmdline.toml +++ b/rules/windows/execution_from_unusual_path_cmdline.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -94,12 +94,17 @@ This rule looks for the execution of scripts from unusual directories. Attackers - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "cff92c41-2225-4763-b4ce-6f71e5bda5e6" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/execution_posh_hacktool_functions.toml b/rules/windows/execution_posh_hacktool_functions.toml index 9f8ece14a..fdbdf5c49 100644 --- a/rules/windows/execution_posh_hacktool_functions.toml +++ b/rules/windows/execution_posh_hacktool_functions.toml @@ -2,7 +2,7 @@ creation_date = "2023/01/17" integration = ["windows"] maturity = "production" -updated_date = "2023/10/11" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -17,7 +17,13 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "Potential PowerShell HackTool Script by Function Names" -note = """## Setup +references = [ + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", + "https://github.com/BC-SECURITY/Empire" +] +risk_score = 47 +rule_id = "cde1bafa-9f01-4f43-a872-605b678968b0" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -35,12 +41,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", - "https://github.com/BC-SECURITY/Empire" -] -risk_score = 47 -rule_id = "cde1bafa-9f01-4f43-a872-605b678968b0" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_posh_portable_executable.toml b/rules/windows/execution_posh_portable_executable.toml index 41224433b..feefe8279 100644 --- a/rules/windows/execution_posh_portable_executable.toml +++ b/rules/windows/execution_posh_portable_executable.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -101,7 +101,13 @@ Attackers can abuse PowerShell in-memory capabilities to inject executables into - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", +] +risk_score = 47 +rule_id = "ad84d445-b1ce-4377-82d9-7c633f28bf9a" +setup=""" The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with with Advanced Audit Configuration: @@ -119,11 +125,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", -] -risk_score = 47 -rule_id = "ad84d445-b1ce-4377-82d9-7c633f28bf9a" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_posh_psreflect.toml b/rules/windows/execution_posh_psreflect.toml index 096063ec4..a5332cf2d 100644 --- a/rules/windows/execution_posh_psreflect.toml +++ b/rules/windows/execution_posh_psreflect.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -110,7 +110,14 @@ Detecting the core implementation of PSReflect means detecting most of the tooli - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/mattifestation/PSReflect/blob/master/PSReflect.psm1", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", +] +risk_score = 47 +rule_id = "56f2e9b5-4803-4e44-a0a4-a52dc79d57fe" +setup=""" The 'PowerShell Script Block Logging' logging policy must be configured (Enable). @@ -129,12 +136,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/mattifestation/PSReflect/blob/master/PSReflect.psm1", - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", -] -risk_score = 47 -rule_id = "56f2e9b5-4803-4e44-a0a4-a52dc79d57fe" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_shared_modules_local_sxs_dll.toml b/rules/windows/execution_shared_modules_local_sxs_dll.toml index 79c5f8334..ae4376814 100644 --- a/rules/windows/execution_shared_modules_local_sxs_dll.toml +++ b/rules/windows/execution_shared_modules_local_sxs_dll.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -22,13 +22,18 @@ note = """## Triage and analysis The SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory. -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection"] risk_score = 47 rule_id = "a3ea12f3-0d4e-4667-8b44-4230c63f3c75" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_suspicious_cmd_wmi.toml b/rules/windows/execution_suspicious_cmd_wmi.toml index c95d8173d..41a514ec9 100644 --- a/rules/windows/execution_suspicious_cmd_wmi.toml +++ b/rules/windows/execution_suspicious_cmd_wmi.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious Cmd Execution via WMI" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "12f07955-1674-44f7-86b5-c35da0a6f41a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml b/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml index a363a06e7..df7c585b5 100644 --- a/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml +++ b/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,15 +18,19 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious WMI Image Load from MS Office" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", ] risk_score = 21 rule_id = "891cb88e-441a-4c3e-be2d-120d99fe7b0d" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_suspicious_pdf_reader.toml b/rules/windows/execution_suspicious_pdf_reader.toml index df22eab39..4fa9bc8e8 100644 --- a/rules/windows/execution_suspicious_pdf_reader.toml +++ b/rules/windows/execution_suspicious_pdf_reader.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -65,12 +65,17 @@ This rule looks for commonly abused built-in utilities spawned by a PDF reader p - Consider improvements to the security awareness program. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "53a26770-9cbd-40c5-8b57-61d01a325e14" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Initial Access", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_suspicious_psexesvc.toml b/rules/windows/execution_suspicious_psexesvc.toml index b492e40cd..5b29e6018 100644 --- a/rules/windows/execution_suspicious_psexesvc.toml +++ b/rules/windows/execution_suspicious_psexesvc.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -48,12 +48,17 @@ This rule identifies instances where the PsExec service component is executed us - Review the privileges assigned to the user to ensure that the least privilege principle is being followed. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules/windows/execution_via_compiled_html_file.toml b/rules/windows/execution_via_compiled_html_file.toml index 2917eaf49..b2055e51e 100644 --- a/rules/windows/execution_via_compiled_html_file.toml +++ b/rules/windows/execution_via_compiled_html_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -108,12 +108,17 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "e3343ab9-4245-4715-b344-e11c56b0a47f" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Resources: Investigation Guide", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/execution_via_hidden_shell_conhost.toml b/rules/windows/execution_via_hidden_shell_conhost.toml index edd366feb..0b3d4e314 100644 --- a/rules/windows/execution_via_hidden_shell_conhost.toml +++ b/rules/windows/execution_via_hidden_shell_conhost.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -65,15 +65,20 @@ Attackers often rely on custom shell implementations to avoid using built-in com - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html", ] risk_score = 73 rule_id = "05b358de-aa6d-4f6c-89e6-78f74018b43b" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/impact_backup_file_deletion.toml b/rules/windows/impact_backup_file_deletion.toml index 1e76aa2a2..1dac9da4a 100644 --- a/rules/windows/impact_backup_file_deletion.toml +++ b/rules/windows/impact_backup_file_deletion.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -59,13 +59,18 @@ This rule identifies file deletions performed by a process that does not belong - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love"] risk_score = 47 rule_id = "11ea6bec-ebde-4d71-a8e9-784948f8e3e9" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml b/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml index 4ebd2c224..ff44a981c 100644 --- a/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml +++ b/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -56,12 +56,17 @@ This rule identifies the deletion of the backup catalog using the `wbadmin.exe` - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "581add16-df76-42bb-af8e-c979bfb39a59" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/impact_modification_of_boot_config.toml b/rules/windows/impact_modification_of_boot_config.toml index f9559a9af..eff922231 100644 --- a/rules/windows/impact_modification_of_boot_config.toml +++ b/rules/windows/impact_modification_of_boot_config.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -56,12 +56,17 @@ These are common steps in destructive attacks by adversaries leveraging ransomwa - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "69c251fb-a5d6-4035-b5ec-40438bd829ff" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml b/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml index 020a629a9..a26440e37 100644 --- a/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml +++ b/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -75,12 +75,17 @@ This rule monitors the execution of Vssadmin.exe to either delete or resize shad - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 73 rule_id = "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml b/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml index a867567c5..db00af32e 100644 --- a/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml +++ b/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Austin Songer"] @@ -74,9 +74,6 @@ This rule monitors the execution of PowerShell cmdlets to interact with the Win3 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy", @@ -85,6 +82,14 @@ references = [ ] risk_score = 73 rule_id = "d99a037b-c8e2-47a5-97b9-170d076827c4" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml b/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml index 2bb2c0773..53312c4d5 100644 --- a/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml +++ b/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -75,12 +75,17 @@ This rule monitors the execution of `wmic.exe` to interact with VSS via the `sha - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 73 rule_id = "dc9c1f74-dac3-48e3-b47f-eb79db358f57" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Impact", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml b/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml index ffbb3aa72..a02c75d86 100644 --- a/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml +++ b/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Suspicious HTML File Creation" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "f0493cb4-9b15-43a9-9359-68c23a7f2cf3" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Data Source: Elastic Defend"] type = "eql" diff --git a/rules/windows/initial_access_script_executing_powershell.toml b/rules/windows/initial_access_script_executing_powershell.toml index 234b8fa92..a2dd1d97e 100644 --- a/rules/windows/initial_access_script_executing_powershell.toml +++ b/rules/windows/initial_access_script_executing_powershell.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -67,12 +67,17 @@ This rule looks for the spawn of the `powershell.exe` process with `cscript.exe` - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_suspicious_ms_exchange_files.toml b/rules/windows/initial_access_suspicious_ms_exchange_files.toml index f6a39b5da..95aa2b45c 100644 --- a/rules/windows/initial_access_suspicious_ms_exchange_files.toml +++ b/rules/windows/initial_access_suspicious_ms_exchange_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Austin Songer"] @@ -37,9 +37,6 @@ from existing intrusions. Other tools for detecting and mitigating can be found [repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security) -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", @@ -47,6 +44,14 @@ references = [ ] risk_score = 47 rule_id = "6cd1779c-560f-4b68-a8f1-11009b27fe63" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_suspicious_ms_exchange_process.toml b/rules/windows/initial_access_suspicious_ms_exchange_process.toml index bc7dc8ea9..74bd46eb7 100644 --- a/rules/windows/initial_access_suspicious_ms_exchange_process.toml +++ b/rules/windows/initial_access_suspicious_ms_exchange_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Austin Songer"] @@ -23,16 +23,20 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Microsoft Exchange Server UM Spawning Suspicious Processes" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities", ] risk_score = 47 rule_id = "483c4daf-b0c6-49e0-adf3-0bfa93231d6b" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml b/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml index 12c152718..fc18149c8 100644 --- a/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml +++ b/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,10 +17,6 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Microsoft Exchange Worker Spawning Suspicious Processes" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities", @@ -28,6 +24,14 @@ references = [ ] risk_score = 73 rule_id = "f81ee52c-297e-46d9-9205-07e66931df26" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_suspicious_ms_office_child_process.toml b/rules/windows/initial_access_suspicious_ms_office_child_process.toml index 02111c6c4..f2d6d2004 100644 --- a/rules/windows/initial_access_suspicious_ms_office_child_process.toml +++ b/rules/windows/initial_access_suspicious_ms_office_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -65,13 +65,18 @@ This rule looks for suspicious processes spawned by MS Office programs. This is - Consider improvements to the security awareness program. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.elastic.co/blog/vulnerability-summary-follina"] risk_score = 47 rule_id = "a624863f-a70d-417f-a7d2-7a404638d47f" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml b/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml index ef12fc96a..425294262 100644 --- a/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml +++ b/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -64,12 +64,17 @@ This rule looks for suspicious processes spawned by MS Outlook, which can be the - Consider improvements to the security awareness program. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "32f4675e-6c49-4ace-80f9-97c9259dca2e" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml b/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml index ea425854c..51ea424cb 100644 --- a/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml +++ b/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious Explorer Child Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_evasion_rdp_shadowing.toml b/rules/windows/lateral_movement_evasion_rdp_shadowing.toml index 780ae50e0..daae98184 100644 --- a/rules/windows/lateral_movement_evasion_rdp_shadowing.toml +++ b/rules/windows/lateral_movement_evasion_rdp_shadowing.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Potential Remote Desktop Shadowing Activity" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing", "https://swarm.ptsecurity.com/remote-desktop-services-shadowing/", ] risk_score = 73 rule_id = "c57f8579-e2a5-4804-847f-f2732edc5156" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_execution_from_tsclient_mup.toml b/rules/windows/lateral_movement_execution_from_tsclient_mup.toml index 994c3847c..f102377f4 100644 --- a/rules/windows/lateral_movement_execution_from_tsclient_mup.toml +++ b/rules/windows/lateral_movement_execution_from_tsclient_mup.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Execution via TSClient Mountpoint" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3"] risk_score = 73 rule_id = "4fe9d835-40e1-452d-8230-17c147cafad8" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml b/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml index a37040210..1baafe790 100644 --- a/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml +++ b/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Mounting Hidden or WebDav Remote Shares" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Initial Access", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_rdp_enabled_registry.toml b/rules/windows/lateral_movement_rdp_enabled_registry.toml index faa5a3c01..48f354d78 100644 --- a/rules/windows/lateral_movement_rdp_enabled_registry.toml +++ b/rules/windows/lateral_movement_rdp_enabled_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -53,12 +53,17 @@ This rule detects modification of the fDenyTSConnections registry key to the val - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "58aa72ca-d968-4f34-b9f7-bea51d75eb50" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml b/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml index 566d47df4..8bbbc5939 100644 --- a/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml +++ b/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Remote File Copy to a Hidden Share" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "fa01341d-6662-426b-9d0c-6d81e33c8a9d" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml b/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml index c53b798a8..3699b0339 100644 --- a/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml +++ b/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious RDP ActiveX Client Loaded" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3"] risk_score = 47 rule_id = "71c5cb27-eca5-4151-bb47-64bc3f883270" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_unusual_dns_service_children.toml b/rules/windows/lateral_movement_unusual_dns_service_children.toml index 9b28a2b7b..b8fdd20d2 100644 --- a/rules/windows/lateral_movement_unusual_dns_service_children.toml +++ b/rules/windows/lateral_movement_unusual_dns_service_children.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -60,9 +60,6 @@ This rule looks for unusual children of the `dns.exe` process, which can indicat - Review the privileges assigned to the user to ensure that the least privilege principle is being followed. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", @@ -72,6 +69,14 @@ references = [ ] risk_score = 73 rule_id = "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml b/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml index 412613f76..6fecab4ef 100644 --- a/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml +++ b/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -24,9 +24,6 @@ Detection alerts from this rule indicate potential unusual/abnormal file writes - Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms. - Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care. -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", @@ -35,6 +32,14 @@ references = [ ] risk_score = 73 rule_id = "c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml b/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml index 37302511f..1e426b444 100644 --- a/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml +++ b/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Lateral Movement via Startup Folder" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://www.mdsec.co.uk/2017/06/rdpinception/"] risk_score = 73 rule_id = "25224a80-5a4a-4b8a-991e-6ab390465c4f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_adobe_hijack_persistence.toml b/rules/windows/persistence_adobe_hijack_persistence.toml index 1f3ed20a2..7838d792e 100644 --- a/rules/windows/persistence_adobe_hijack_persistence.toml +++ b/rules/windows/persistence_adobe_hijack_persistence.toml @@ -2,7 +2,7 @@ creation_date = "2020/02/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/10/09" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -90,13 +90,18 @@ Attackers can replace the `RdrCEF.exe` executable with their own to maintain the - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://twitter.com/pabraeken/status/997997818362155008"] risk_score = 21 rule_id = "2bf78aa2-9c56-48de-b139-f169bf99cf86" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_appcertdlls_registry.toml b/rules/windows/persistence_appcertdlls_registry.toml index 72dec2b5b..75bf2e6b4 100644 --- a/rules/windows/persistence_appcertdlls_registry.toml +++ b/rules/windows/persistence_appcertdlls_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Registry Persistence via AppCert DLL" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "513f0ffd-b317-4b9c-9494-92ce861f22c7" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_appinitdlls_registry.toml b/rules/windows/persistence_appinitdlls_registry.toml index 960587be9..b6d0bff9b 100644 --- a/rules/windows/persistence_appinitdlls_registry.toml +++ b/rules/windows/persistence_appinitdlls_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -107,12 +107,17 @@ This rule identifies modifications on the AppInit registry keys. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "d0e159cf-73e9-40d1-a9ed-077e3158a855" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_evasion_hidden_local_account_creation.toml b/rules/windows/persistence_evasion_hidden_local_account_creation.toml index 5040e8330..ce954695d 100644 --- a/rules/windows/persistence_evasion_hidden_local_account_creation.toml +++ b/rules/windows/persistence_evasion_hidden_local_account_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -45,9 +45,6 @@ This rule uses registry events to identify the creation of local hidden accounts - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html", @@ -55,6 +52,14 @@ references = [ ] risk_score = 73 rule_id = "2edc8076-291e-41e9-81e4-e3fcbc97ae5e" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_local_scheduled_job_creation.toml b/rules/windows/persistence_local_scheduled_job_creation.toml index 04cdb1a2e..dcca16a83 100644 --- a/rules/windows/persistence_local_scheduled_job_creation.toml +++ b/rules/windows/persistence_local_scheduled_job_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via Scheduled Job Creation" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "1327384f-00f3-44d5-9a8c-2373ba071e92" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_ms_office_addins_file.toml b/rules/windows/persistence_ms_office_addins_file.toml index 609749d0a..04c7bc0fd 100644 --- a/rules/windows/persistence_ms_office_addins_file.toml +++ b/rules/windows/persistence_ms_office_addins_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -14,13 +14,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via Microsoft Office AddIns" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence"] risk_score = 73 rule_id = "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_ms_outlook_vba_template.toml b/rules/windows/persistence_ms_outlook_vba_template.toml index 1d886778b..206add36a 100644 --- a/rules/windows/persistence_ms_outlook_vba_template.toml +++ b/rules/windows/persistence_ms_outlook_vba_template.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -15,16 +15,20 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via Microsoft Outlook VBA" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/", "https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/", ] risk_score = 47 rule_id = "397945f3-d39a-4e6f-8bcb-9656c2031438" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml b/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml index 97160392c..8923d0a01 100644 --- a/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml +++ b/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,7 +17,13 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "KRBTGT Delegation Backdoor" -note = """## Setup +references = [ + "https://skyblue.team/posts/delegate-krbtgt", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md", +] +risk_score = 73 +rule_id = "e052c845-48d0-4f46-8a13-7d0aba05df82" +setup = """ The 'Audit User Account Management' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -33,12 +39,6 @@ Account Management > Audit User Account Management (Success,Failure) ``` """ -references = [ - "https://skyblue.team/posts/delegate-krbtgt", - "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md", -] -risk_score = 73 -rule_id = "e052c845-48d0-4f46-8a13-7d0aba05df82" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml b/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml index 545227894..e6a1023d6 100644 --- a/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml +++ b/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "New ActiveSyncAllowedDeviceID Added via PowerShell" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps", ] risk_score = 47 rule_id = "ce64d965-6cb0-466d-b74f-8d2c76f47f05" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_priv_escalation_via_accessibility_features.toml b/rules/windows/persistence_priv_escalation_via_accessibility_features.toml index db097fd73..be77c8801 100644 --- a/rules/windows/persistence_priv_escalation_via_accessibility_features.toml +++ b/rules/windows/persistence_priv_escalation_via_accessibility_features.toml @@ -2,7 +2,7 @@ creation_date = "2020/02/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -99,13 +99,18 @@ This rule looks for the execution of supposed accessibility binaries that don't - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.elastic.co/blog/practical-security-engineering-stateful-detection"] risk_score = 73 rule_id = "7405ddf1-6c8e-41ce-818f-48bea6bcaed8" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml b/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml index 3f953637e..d90dffa95 100644 --- a/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml +++ b/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -58,7 +58,14 @@ This rule matches changes of the dsHeuristics object where the 16th bit is set t - The change can be reverted by setting the dwAdminSDExMask (16th bit) to 0 in dSHeuristics. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dsheuristics_bad", + "https://petri.com/active-directory-security-understanding-adminsdholder-object", +] +risk_score = 73 +rule_id = "61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7" +setup=""" The 'Audit Directory Service Changes' logging policy must be configured for (Success). Steps to implement the logging policy with Advanced Audit Configuration: @@ -74,14 +81,12 @@ DS Access > Audit Directory Service Changes (Success) ``` -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html """ -references = [ - "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dsheuristics_bad", - "https://petri.com/active-directory-security-understanding-adminsdholder-object", -] -risk_score = 73 -rule_id = "61d29caf-6c15-4d1e-9ccb-7ad12ccc0bc7" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml b/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml index 7c0ea75e9..e9155f188 100644 --- a/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml +++ b/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -99,13 +99,18 @@ This rule monitors for commonly abused processes writing to the Startup folder l - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1"] risk_score = 47 rule_id = "440e2db4-bc7f-4c96-a068-65b78da59bde" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_startup_folder_scripts.toml b/rules/windows/persistence_startup_folder_scripts.toml index 1ba5001ae..930c62158 100644 --- a/rules/windows/persistence_startup_folder_scripts.toml +++ b/rules/windows/persistence_startup_folder_scripts.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -99,12 +99,17 @@ This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs s - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "f7c4dc5a-a58d-491d-9f14-9b66507121c0" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_suspicious_com_hijack_registry.toml b/rules/windows/persistence_suspicious_com_hijack_registry.toml index dce2120fe..4a064c0a3 100644 --- a/rules/windows/persistence_suspicious_com_hijack_registry.toml +++ b/rules/windows/persistence_suspicious_com_hijack_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -59,15 +59,20 @@ Adversaries can insert malicious code that can be executed in place of legitimat - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/", ] risk_score = 47 rule_id = "16a52c14-7883-47af-8745-9357803f0d4c" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Tactic: Privilege Escalation","Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml b/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml index 8cd918bf0..be70bc487 100644 --- a/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml +++ b/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -19,16 +19,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious Image Load (taskschd.dll) from MS Office" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", "https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf", ] risk_score = 21 rule_id = "baa5d22c-5e1c-4f33-bfc9-efa73bb53022" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_suspicious_scheduled_task_runtime.toml b/rules/windows/persistence_suspicious_scheduled_task_runtime.toml index 2a096d963..2d576ba34 100644 --- a/rules/windows/persistence_suspicious_scheduled_task_runtime.toml +++ b/rules/windows/persistence_suspicious_scheduled_task_runtime.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -15,12 +15,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Suspicious Execution via Scheduled Task" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "5d1d6907-0747-4d5d-9b24-e4a18853dc0a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml b/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml index dd4dc6de4..31bb0ed4c 100644 --- a/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml +++ b/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic", "Skoetting"] @@ -47,15 +47,20 @@ This rule monitors events related to a user being added to a privileged group. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory", ] risk_score = 47 rule_id = "5cd8e1f7-0050-4afc-b2df-904e40b2f5ae" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Use Case: Active Directory Monitoring", "Data Source: Active Directory"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_user_account_creation.toml b/rules/windows/persistence_user_account_creation.toml index fa0be4e1a..17543b815 100644 --- a/rules/windows/persistence_user_account_creation.toml +++ b/rules/windows/persistence_user_account_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -50,12 +50,17 @@ This rule identifies the usage of `net.exe` to create new accounts. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "1aa9181a-492b-4c01-8b16-fa0735786b2b" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_application_shimming.toml b/rules/windows/persistence_via_application_shimming.toml index ca066c009..911c7a349 100644 --- a/rules/windows/persistence_via_application_shimming.toml +++ b/rules/windows/persistence_via_application_shimming.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Potential Application Shimming via Sdbinst" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "fd4a992d-6130-4802-9ff8-829b89ae801f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_bits_job_notify_command.toml b/rules/windows/persistence_via_bits_job_notify_command.toml index ac30e82fe..ae13526f9 100644 --- a/rules/windows/persistence_via_bits_job_notify_command.toml +++ b/rules/windows/persistence_via_bits_job_notify_command.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,10 +18,6 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via BITS Job Notify Cmdline" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://pentestlab.blog/2019/10/30/persistence-bits-jobs/", "https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline", @@ -30,6 +26,14 @@ references = [ ] risk_score = 47 rule_id = "c3b915e0-22f3-4bf7-991d-b643513c722f" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_hidden_run_key_valuename.toml b/rules/windows/persistence_via_hidden_run_key_valuename.toml index fa2729dfe..e6f3e68bc 100644 --- a/rules/windows/persistence_via_hidden_run_key_valuename.toml +++ b/rules/windows/persistence_via_hidden_run_key_valuename.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via Hidden Run Key Detected" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://github.com/outflanknl/SharpHide", "https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf", ] risk_score = 73 rule_id = "a9b05c3b-b304-4bf9-970d-acdfaef2944c" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_lsa_security_support_provider_registry.toml b/rules/windows/persistence_via_lsa_security_support_provider_registry.toml index 82aab40b7..5210976fa 100644 --- a/rules/windows/persistence_via_lsa_security_support_provider_registry.toml +++ b/rules/windows/persistence_via_lsa_security_support_provider_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Installation of Security Support Provider" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "e86da94d-e54b-4fb5-b96c-cecff87e8787" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml b/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml index f7969871c..d08d13ab7 100644 --- a/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml +++ b/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,15 +17,19 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via TelemetryController Scheduled Task Hijack" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence", ] risk_score = 73 rule_id = "68921d85-d0dc-48b3-865f-43291ca2c4f2" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_update_orchestrator_service_hijack.toml b/rules/windows/persistence_via_update_orchestrator_service_hijack.toml index 61e2631be..e3fb55d7f 100644 --- a/rules/windows/persistence_via_update_orchestrator_service_hijack.toml +++ b/rules/windows/persistence_via_update_orchestrator_service_hijack.toml @@ -2,7 +2,7 @@ creation_date = "2020/08/17" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/10/13" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -95,13 +95,18 @@ This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://github.com/irsl/CVE-2020-1313"] risk_score = 73 rule_id = "265db8f5-fc73-4d0d-b434-6483b56372e2" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Use Case: Vulnerability", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml b/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml index bfe458eb4..5a7c0cca4 100644 --- a/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml +++ b/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,13 +18,17 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Persistence via WMI Event Subscription" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1"] risk_score = 21 rule_id = "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml b/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml index e8ad07ec0..20e0543a4 100644 --- a/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml +++ b/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -50,13 +50,18 @@ The xp_cmdshell procedure is disabled by default, but when used, it has the same - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/"] risk_score = 73 rule_id = "4ed493fc-d637-4a36-80ff-ac84937e5461" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/persistence_webshell_detection.toml b/rules/windows/persistence_webshell_detection.toml index 5979782ad..e854f5145 100644 --- a/rules/windows/persistence_webshell_detection.toml +++ b/rules/windows/persistence_webshell_detection.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -63,9 +63,6 @@ This rule detects a web server process spawning script and command-line interfac - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/", @@ -74,6 +71,14 @@ references = [ ] risk_score = 73 rule_id = "2917d495-59bd-4250-b395-c29409b76086" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Initial Access", "Tactic: Execution", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_create_process_as_different_user.toml b/rules/windows/privilege_escalation_create_process_as_different_user.toml index d977ea681..d7e296770 100644 --- a/rules/windows/privilege_escalation_create_process_as_different_user.toml +++ b/rules/windows/privilege_escalation_create_process_as_different_user.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,19 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Process Creation via Secondary Logon" -note = """## Setup - -Audit events 4624 and 4688 are needed to trigger this rule. - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. - -""" references = ["https://attack.mitre.org/techniques/T1134/002/"] risk_score = 47 rule_id = "42eeee3d-947f-46d3-a14d-7036b962c266" +setup = """ + +Audit events 4624 and 4688 are needed to trigger this rule. + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation"] type = "eql" diff --git a/rules/windows/privilege_escalation_credroaming_ldap.toml b/rules/windows/privilege_escalation_credroaming_ldap.toml index 843b87bf5..12815587f 100644 --- a/rules/windows/privilege_escalation_credroaming_ldap.toml +++ b/rules/windows/privilege_escalation_credroaming_ldap.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -19,7 +19,14 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "Modification of the msPKIAccountCredentials" -note = """## Setup +references = [ + "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming", + "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136", +] +risk_score = 47 +rule_id = "670b3b5a-35e5-42db-bd36-6c5b9b4b7313" +setup = """ The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: @@ -35,13 +42,6 @@ DS Access > Audit Directory Service Changes (Success,Failure) ``` """ -references = [ - "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming", - "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx", - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136", -] -risk_score = 47 -rule_id = "670b3b5a-35e5-42db-bd36-6c5b9b4b7313" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Data Source: Active Directory", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_disable_uac_registry.toml b/rules/windows/privilege_escalation_disable_uac_registry.toml index b76c05f25..b41831b47 100644 --- a/rules/windows/privilege_escalation_disable_uac_registry.toml +++ b/rules/windows/privilege_escalation_disable_uac_registry.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -66,9 +66,6 @@ Attackers may disable UAC to execute code directly in high integrity. This rule - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.greyhathacker.net/?p=796", @@ -77,6 +74,14 @@ references = [ ] risk_score = 47 rule_id = "d31f183a-e5b1-451b-8534-ba62bca0b404" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml b/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml index 6e62e5ee1..d75d04dc7 100644 --- a/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml +++ b/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Creation or Modification of a new GPO Scheduled Task or Service" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 21 rule_id = "c0429aa8-9974-42da-bfb6-53a0a515a145" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_group_policy_iniscript.toml b/rules/windows/privilege_escalation_group_policy_iniscript.toml index 609d3a652..03e63828a 100644 --- a/rules/windows/privilege_escalation_group_policy_iniscript.toml +++ b/rules/windows/privilege_escalation_group_policy_iniscript.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -47,7 +47,15 @@ Group Policy Objects (GPOs) can be used by attackers to instruct arbitrarily lar - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", + "https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md", + "https://labs.f-secure.com/tools/sharpgpoabuse", +] +risk_score = 47 +rule_id = "16fac1a1-21ee-4ca6-b720-458e3855d046" +setup=""" The 'Audit Detailed File Share' audit policy must be configured (Success Failure). Steps to implement the logging policy with with Advanced Audit Configuration: @@ -77,13 +85,6 @@ DS Access > Audit Directory Service Changes (Success,Failure) ``` """ -references = [ - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", - "https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md", - "https://labs.f-secure.com/tools/sharpgpoabuse", -] -risk_score = 47 -rule_id = "16fac1a1-21ee-4ca6-b720-458e3855d046" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/privilege_escalation_group_policy_privileged_groups.toml b/rules/windows/privilege_escalation_group_policy_privileged_groups.toml index 8ba7f049c..c0151d2cf 100644 --- a/rules/windows/privilege_escalation_group_policy_privileged_groups.toml +++ b/rules/windows/privilege_escalation_group_policy_privileged_groups.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -44,7 +44,14 @@ Group Policy Objects (GPOs) can be used to add rights and/or modify Group Member - Remove the script from the GPO. - Check if other GPOs have suspicious scripts attached. -## Setup +""" +references = [ + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", + "https://labs.f-secure.com/tools/sharpgpoabuse", +] +risk_score = 73 +rule_id = "b9554892-5e0e-424b-83a0-5aef95aa43bf" +setup=""" The 'Audit Directory Service Changes' audit policy must be configured (Success Failure). Steps to implement the logging policy with with Advanced Audit Configuration: @@ -60,12 +67,6 @@ DS Access > Audit Directory Service Changes (Success,Failure) ``` """ -references = [ - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", - "https://labs.f-secure.com/tools/sharpgpoabuse", -] -risk_score = 73 -rule_id = "b9554892-5e0e-424b-83a0-5aef95aa43bf" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/privilege_escalation_group_policy_scheduled_task.toml b/rules/windows/privilege_escalation_group_policy_scheduled_task.toml index 93ef369f0..b533356e4 100644 --- a/rules/windows/privilege_escalation_group_policy_scheduled_task.toml +++ b/rules/windows/privilege_escalation_group_policy_scheduled_task.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -47,7 +47,17 @@ Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup +""" +references = [ + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", + "https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md", + "https://labs.f-secure.com/tools/sharpgpoabuse", + "https://twitter.com/menasec1/status/1106899890377052160", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_gpo_scheduledtasks.yml", +] +risk_score = 47 +rule_id = "15a8ba77-1c13-4274-88fe-6bd14133861e" +setup=""" The 'Audit Detailed File Share' audit policy must be configured (Success Failure). Steps to implement the logging policy with with Advanced Audit Configuration: @@ -77,15 +87,6 @@ DS Access > Audit Directory Service Changes (Success,Failure) ``` """ -references = [ - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md", - "https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md", - "https://labs.f-secure.com/tools/sharpgpoabuse", - "https://twitter.com/menasec1/status/1106899890377052160", - "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_gpo_scheduledtasks.yml", -] -risk_score = 47 -rule_id = "15a8ba77-1c13-4274-88fe-6bd14133861e" severity = "medium" tags = [ "Domain: Endpoint", diff --git a/rules/windows/privilege_escalation_installertakeover.toml b/rules/windows/privilege_escalation_installertakeover.toml index 9c932e66b..aedadd0d9 100644 --- a/rules/windows/privilege_escalation_installertakeover.toml +++ b/rules/windows/privilege_escalation_installertakeover.toml @@ -98,13 +98,18 @@ This rule detects the default execution of the PoC, which overwrites the `elevat - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://github.com/klinix5/InstallerFileTakeOver"] risk_score = 73 rule_id = "58c6d58b-a0d3-412d-b3b8-0981a9400607" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_named_pipe_impersonation.toml b/rules/windows/privilege_escalation_named_pipe_impersonation.toml index f9c96d7cc..a47a4d24b 100644 --- a/rules/windows/privilege_escalation_named_pipe_impersonation.toml +++ b/rules/windows/privilege_escalation_named_pipe_impersonation.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [transform] [[transform.osquery]] @@ -93,9 +93,6 @@ Attackers can abuse named pipes to elevate their privileges by impersonating the - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation", @@ -104,6 +101,14 @@ references = [ ] risk_score = 73 rule_id = "3ecbdc9e-e4f2-43fa-8cca-63802125e582" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/privilege_escalation_persistence_phantom_dll.toml b/rules/windows/privilege_escalation_persistence_phantom_dll.toml index 0ab4f2557..15d3550ba 100644 --- a/rules/windows/privilege_escalation_persistence_phantom_dll.toml +++ b/rules/windows/privilege_escalation_persistence_phantom_dll.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -58,9 +58,6 @@ Attackers can execute malicious code by abusing missing modules that processes t - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://itm4n.github.io/windows-dll-hijacking-clarified/", @@ -72,6 +69,14 @@ references = [ ] risk_score = 73 rule_id = "bfeaf89b-a2a7-48a3-817f-e41829dc61ee" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/windows/privilege_escalation_posh_token_impersonation.toml b/rules/windows/privilege_escalation_posh_token_impersonation.toml index 9212e2a50..38f85845e 100644 --- a/rules/windows/privilege_escalation_posh_token_impersonation.toml +++ b/rules/windows/privilege_escalation_posh_token_impersonation.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,7 +18,15 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Token Impersonation Capabilities" -note = """## Setup +references = [ + "https://github.com/decoder-it/psgetsystem", + "https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/Get-System.ps1", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", +] +risk_score = 47 +rule_id = "11dd9713-0ec6-4110-9707-32daae1ee68c" +setup = """ The 'PowerShell Script Block Logging' logging policy must be configured (Enable). @@ -37,14 +45,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://github.com/decoder-it/psgetsystem", - "https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/Get-System.ps1", - "https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1", - "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", -] -risk_score = 47 -rule_id = "11dd9713-0ec6-4110-9707-32daae1ee68c" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: PowerShell Logs"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml b/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml index 58cf0f454..04916a7f4 100644 --- a/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml +++ b/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,16 +18,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious PrintSpooler Service Executable File Creation" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/", "https://www.thezdi.com/blog/2020/7/8/cve-2020-1300-remote-code-execution-through-microsoft-windows-cab-files", ] risk_score = 73 rule_id = "5bb4a95d-5a08-48eb-80db-4c3a63ec78a8" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml b/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml index 8421af4c2..16532fc2b 100644 --- a/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml +++ b/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -23,13 +23,17 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Suspicious Print Spooler File Deletion" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527"] risk_score = 47 rule_id = "c4818812-d44f-47be-aaef-4cfb2f9cc799" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml b/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml index 0902763f8..3a885ecf6 100644 --- a/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml +++ b/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml @@ -2,7 +2,7 @@ creation_date = "2020/08/14" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -96,13 +96,18 @@ The Print Spooler service has some known vulnerabilities that attackers can abus - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://safebreach.com/Post/How-we-bypassed-CVE-2020-1048-Patch-and-got-CVE-2020-1337"] risk_score = 73 rule_id = "a7ccae7b-9d2c-44b2-a061-98e5946971fa" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml b/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml index 74b137c45..dc66b880f 100644 --- a/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml +++ b/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,10 +18,6 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Potential Privileged Escalation via SamAccountName Spoofing" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://support.microsoft.com/en-us/topic/kb5008102-active-directory-security-accounts-manager-hardening-changes-cve-2021-42278-5975b463-4c95-45e1-831a-d120004e258e", "https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/", @@ -31,6 +27,13 @@ references = [ ] risk_score = 73 rule_id = "bdcf646b-08d4-492c-870a-6c04e3700034" +setup = """ +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring", "Data Source: Active Directory", "Use Case: Vulnerability"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml b/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml index a1be5270e..520a097c6 100644 --- a/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml +++ b/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,7 +17,13 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "SeDebugPrivilege Enabled by a Suspicious Process" -note = """## Setup +references = [ + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703", + "https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e", +] +risk_score = 47 +rule_id = "97020e61-e591-4191-8a3b-2861a2b887cd" +setup = """ Windows Event 4703 logs Token Privileges changes and need to be configured (Enable). @@ -34,12 +40,6 @@ Detailed Tracking > Token Right Adjusted Events (Success) ``` """ -references = [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703", - "https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e", -] -risk_score = 47 -rule_id = "97020e61-e591-4191-8a3b-2861a2b887cd" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml b/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml index bd0c2d26d..0e02fe253 100644 --- a/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml +++ b/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://github.com/hfiref0x/UACME"] risk_score = 73 rule_id = "b90cdde7-7e0d-4359-8bf0-2c112ce2008a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml b/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml index 3624ac9cd..59cf5a1d6 100644 --- a/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml +++ b/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,13 +17,17 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html"] risk_score = 47 rule_id = "fc7c0fa4-8f03-4b3e-8336-c5feab0be022" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml b/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml index 8822c6948..aff8e1426 100644 --- a/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml +++ b/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "UAC Bypass via ICMLuaUtil Elevated COM Interface" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 73 rule_id = "68d56fdc-7ffa-4419-8e95-81641bd6f845" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml b/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml index 17570ad8f..24ea538f1 100644 --- a/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml +++ b/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,12 +17,16 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "UAC Bypass via DiskCleanup Scheduled Task Hijack" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "1dcc51f6-ba26-49e7-9ef4-2655abb2361e" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml b/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml index 6fd7e060d..011e7e4a8 100644 --- a/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml +++ b/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,16 +17,20 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "UAC Bypass Attempt via Privileged IFileOperation COM Interface" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = [ "https://github.com/hfiref0x/UACME", "https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies", ] risk_score = 73 rule_id = "5a14d01d-7ac8-4545-914c-b687c2cf66b3" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml b/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml index b4e1ddff8..555a7b93b 100644 --- a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml +++ b/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml @@ -2,7 +2,7 @@ creation_date = "2020/03/17" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/10/13" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -97,12 +97,17 @@ During startup, `eventvwr.exe` checks the registry value of the `HKCU\\Software\ - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 73 rule_id = "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml b/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml index 17a963c3e..86f284981 100644 --- a/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml +++ b/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml @@ -2,7 +2,7 @@ creation_date = "2020/10/26" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/10/13" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -96,13 +96,18 @@ This rule identifies an attempt to bypass User Account Control (UAC) by masquera - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e"] risk_score = 73 rule_id = "290aca65-e94d-403b-ba0f-62f320e63f51" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml b/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml index ece0b2861..7e37e68ae 100644 --- a/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml +++ b/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml @@ -2,7 +2,7 @@ creation_date = "2020/10/14" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/10/13" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -96,13 +96,18 @@ This rule identifies attempts to bypass User Account Control (UAC) by hijacking - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = ["https://github.com/AzAgarampur/byeintegrity-uac"] risk_score = 47 rule_id = "1178ae09-5aff-460a-9f2f-455cd0ac4d8e" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Tactic: Defense Evasion", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml b/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml index f5f5a673b..b5bf495b3 100644 --- a/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml +++ b/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml @@ -2,7 +2,7 @@ creation_date = "2020/02/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2023/06/22" +updated_date = "2023/10/23" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -93,9 +93,6 @@ This rule uses this information to spot suspicious parent and child processes. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ references = [ "https://github.com/sbousseaden/Slides/blob/master/Hunting%20MindMaps/PNG/Windows%20Processes%20TH.map.png", @@ -103,6 +100,14 @@ references = [ ] risk_score = 47 rule_id = "35df0dd8-092d-4a83-88c1-5151a804f31b" +setup=""" + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Resources: Investigation Guide", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml b/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml index d8958776a..6f900b52f 100644 --- a/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml +++ b/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -23,13 +23,17 @@ index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Unusual Print Spooler Child Process" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" references = ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527"] risk_score = 47 rule_id = "ee5300a7-7e31-4a72-a258-250abb8b3aa1" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Use Case: Vulnerability", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml b/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml index 13c2b0948..7097416d9 100644 --- a/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml +++ b/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,12 +18,16 @@ index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*", "endgame-*" language = "eql" license = "Elastic License v2" name = "Unusual Service Host Child Process - Childless Service" -note = """## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. -""" risk_score = 47 rule_id = "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_via_rogue_named_pipe.toml b/rules/windows/privilege_escalation_via_rogue_named_pipe.toml index 94a7268c4..a06bc25ca 100644 --- a/rules/windows/privilege_escalation_via_rogue_named_pipe.toml +++ b/rules/windows/privilege_escalation_via_rogue_named_pipe.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -17,14 +17,6 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "eql" license = "Elastic License v2" name = "Privilege Escalation via Rogue Named Pipe Impersonation" -note = """## Setup - -Named Pipe Creation Events need to be enabled within the Sysmon configuration by including the following settings: -`condition equal "contains" and keyword equal "pipe"` - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. - -""" references = [ "https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/", "https://github.com/zcgonvh/EfsPotato", @@ -32,6 +24,17 @@ references = [ ] risk_score = 73 rule_id = "76ddb638-abf7-42d5-be22-4a70b0bf7241" +setup = """ + +Named Pipe Creation Events need to be enabled within the Sysmon configuration by including the following settings: +`condition equal "contains" and keyword equal "pipe"` + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html +""" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Sysmon Only"] timestamp_override = "event.ingested" diff --git a/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml b/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml index 9733b19b6..724ce976f 100644 --- a/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml +++ b/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml @@ -4,7 +4,7 @@ integration = ["system", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/06/22" +updated_date = "2023/10/23" [rule] author = ["Elastic"] @@ -18,7 +18,14 @@ index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "Windows Service Installed via an Unusual Client" -note = """## Setup +references = [ + "https://www.x86matthew.com/view_post?id=create_svc_rpc", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0100_windows_audit_security_system_extension.md", +] +risk_score = 73 +rule_id = "55c2bf58-2a39-4c58-a384-c8b1978153c2" +setup = """ The 'Audit Security System Extension' logging policy must be configured for (Success) Steps to implement the logging policy with with Advanced Audit Configuration: @@ -34,13 +41,6 @@ System > Audit Security System Extension (Success) ``` """ -references = [ - "https://www.x86matthew.com/view_post?id=create_svc_rpc", - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697", - "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0100_windows_audit_security_system_extension.md", -] -risk_score = 73 -rule_id = "55c2bf58-2a39-4c58-a384-c8b1978153c2" severity = "high" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation"] timestamp_override = "event.ingested" diff --git a/rules_building_block/collection_posh_compression.toml b/rules_building_block/collection_posh_compression.toml index 1d1b3d612..5934fb60f 100644 --- a/rules_building_block/collection_posh_compression.toml +++ b/rules_building_block/collection_posh_compression.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/13" [rule] @@ -19,8 +19,9 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Archive Compression Capabilities" -note = """## Setup - +risk_score = 21 +rule_id = "27071ea3-e806-4697-8abc-e22c92aa4293" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -37,8 +38,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -risk_score = 21 -rule_id = "27071ea3-e806-4697-8abc-e22c92aa4293" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" diff --git a/rules_building_block/collection_posh_webcam_video_capture.toml b/rules_building_block/collection_posh_webcam_video_capture.toml index 3ff35af6e..14e286f5e 100644 --- a/rules_building_block/collection_posh_webcam_video_capture.toml +++ b/rules_building_block/collection_posh_webcam_video_capture.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/18" +updated_date = "2023/10/19" bypass_bbr_timing = true [rule] @@ -18,8 +18,10 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Webcam Video Capture Capabilities" -note = """## Setup - +references = ["https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/collection/WebcamRecorder.py"] +risk_score = 21 +rule_id = "eb44611f-62a8-4036-a5ef-587098be6c43" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -36,9 +38,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = ["https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/collection/WebcamRecorder.py"] -risk_score = 21 -rule_id = "eb44611f-62a8-4036-a5ef-587098be6c43" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" diff --git a/rules_building_block/defense_evasion_powershell_clear_logs_script.toml b/rules_building_block/defense_evasion_powershell_clear_logs_script.toml index 1360e9a62..55d9a7620 100644 --- a/rules_building_block/defense_evasion_powershell_clear_logs_script.toml +++ b/rules_building_block/defense_evasion_powershell_clear_logs_script.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -18,8 +18,13 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Log Clear Capabilities" -note = """## Setup - +references = [ + "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear", + "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog" +] +risk_score = 21 +rule_id = "3d3aa8f9-12af-441f-9344-9f31053e316d" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -36,12 +41,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear", - "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog" -] -risk_score = 21 -rule_id = "3d3aa8f9-12af-441f-9344-9f31053e316d" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" diff --git a/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml b/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml index 25178ed9f..734988914 100644 --- a/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml +++ b/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/10" +updated_date = "2023/10/19" bypass_bbr_timing = true [rule] @@ -46,12 +46,18 @@ This rule identifies commands to enumerate system information, files, and folder - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "d68e95ad-1c82-4074-a12a-125fe10ac8ba" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml b/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml index 966145820..1e21c42d0 100644 --- a/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml +++ b/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -26,8 +26,11 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "kuery" license = "Elastic License v2" name = "Enumeration of Kernel Modules via Proc" -note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. +risk_score = 21 +rule_id = "80084fa9-8677-4453-8680-b891d3c0c778" +setup = """ + +This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. ``` Kibana --> Management --> @@ -35,15 +38,13 @@ Integrations --> Auditd Manager --> Add Auditd Manager ``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. For this detection rule to trigger, the following additional audit rules are required to be added to the integration: ``` -w /proc/ -p r -k audit_proc ``` Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. """ -risk_score = 21 -rule_id = "80084fa9-8677-4453-8680-b891d3c0c778" severity = "low" tags = [ "OS: Linux", diff --git a/rules_building_block/discovery_linux_modprobe_enumeration.toml b/rules_building_block/discovery_linux_modprobe_enumeration.toml index 6bd380bd5..46db52891 100644 --- a/rules_building_block/discovery_linux_modprobe_enumeration.toml +++ b/rules_building_block/discovery_linux_modprobe_enumeration.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,8 +20,11 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "kuery" license = "Elastic License v2" name = "Suspicious Modprobe File Event" -note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. +risk_score = 21 +rule_id = "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd" +setup = """ + +This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. ``` Kibana --> @@ -31,7 +34,7 @@ Auditd Manager --> Add Auditd Manager ``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. For this detection rule to trigger, the following additional audit rules are required to be added to the integration: ``` @@ -41,8 +44,6 @@ For this detection rule to trigger, the following additional audit rules are req Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. """ -risk_score = 21 -rule_id = "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd" severity = "low" tags = [ "OS: Linux", diff --git a/rules_building_block/discovery_linux_sysctl_enumeration.toml b/rules_building_block/discovery_linux_sysctl_enumeration.toml index b929a3a02..49c308883 100644 --- a/rules_building_block/discovery_linux_sysctl_enumeration.toml +++ b/rules_building_block/discovery_linux_sysctl_enumeration.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,8 +19,11 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "kuery" license = "Elastic License v2" name = "Suspicious Sysctl File Event" -note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. +risk_score = 21 +rule_id = "7592c127-89fb-4209-a8f6-f9944dfd7e02" +setup = """ + +This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. ``` Kibana --> @@ -30,7 +33,7 @@ Auditd Manager --> Add Auditd Manager ``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. For this detection rule to trigger, the following additional audit rules are required to be added to the integration: @@ -41,8 +44,6 @@ For this detection rule to trigger, the following additional audit rules are req Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. """ -risk_score = 21 -rule_id = "7592c127-89fb-4209-a8f6-f9944dfd7e02" severity = "low" tags = [ "OS: Linux", diff --git a/rules_building_block/discovery_net_view.toml b/rules_building_block/discovery_net_view.toml index 72f084236..e606e5d26 100644 --- a/rules_building_block/discovery_net_view.toml +++ b/rules_building_block/discovery_net_view.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" bypass_bbr_timing = true [rule] @@ -44,12 +44,18 @@ This rule looks for the execution of the `net` utility to enumerate servers in t - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "7b8bfc26-81d2-435e-965c-d722ee397ef1" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules_building_block/discovery_posh_generic.toml b/rules_building_block/discovery_posh_generic.toml index 29a7a9cdd..90aef7022 100644 --- a/rules_building_block/discovery_posh_generic.toml +++ b/rules_building_block/discovery_posh_generic.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/11" +updated_date = "2023/10/19" [rule] @@ -19,8 +19,9 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Discovery Capabilities" -note = """## Setup - +risk_score = 21 +rule_id = "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -37,8 +38,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -risk_score = 21 -rule_id = "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Collection", "Tactic: Discovery", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" diff --git a/rules_building_block/discovery_posh_password_policy.toml b/rules_building_block/discovery_posh_password_policy.toml index 0697c6f9e..36899ec88 100644 --- a/rules_building_block/discovery_posh_password_policy.toml +++ b/rules_building_block/discovery_posh_password_policy.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,8 +18,9 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Password Policy Discovery Capabilities" -note = """## Setup - +risk_score = 21 +rule_id = "fe25d5bc-01fa-494a-95ff-535c29cc4c96" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -36,8 +37,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -risk_score = 21 -rule_id = "fe25d5bc-01fa-494a-95ff-535c29cc4c96" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Tactic: Execution", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" diff --git a/rules_building_block/discovery_remote_system_discovery_commands_windows.toml b/rules_building_block/discovery_remote_system_discovery_commands_windows.toml index 0b70e684c..1454333cb 100644 --- a/rules_building_block/discovery_remote_system_discovery_commands_windows.toml +++ b/rules_building_block/discovery_remote_system_discovery_commands_windows.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/21" +updated_date = "2023/10/19" bypass_bbr_timing = true [rule] @@ -44,12 +44,18 @@ This rule looks for the execution of the `arp` or `nbstat` utilities to enumerat - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 21 rule_id = "0635c542-1b96-4335-9b47-126582d2c19a" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules_building_block/discovery_security_software_wmic.toml b/rules_building_block/discovery_security_software_wmic.toml index a94809255..abb504d6b 100644 --- a/rules_building_block/discovery_security_software_wmic.toml +++ b/rules_building_block/discovery_security_software_wmic.toml @@ -4,7 +4,7 @@ integration = ["endpoint", "windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/09" +updated_date = "2023/10/19" bypass_bbr_timing = true [rule] @@ -46,12 +46,18 @@ This rule looks for the execution of the `wmic` utility with arguments compatibl - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). -## Setup - -If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work. """ risk_score = 47 rule_id = "6ea55c81-e2ba-42f2-a134-bccf857ba922" +setup = """ + +If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, +events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2. +Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate +`event.ingested` to @timestamp. +For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Windows", diff --git a/rules_building_block/discovery_suspicious_proc_enumeration.toml b/rules_building_block/discovery_suspicious_proc_enumeration.toml index 61ccf6620..f6d248832 100644 --- a/rules_building_block/discovery_suspicious_proc_enumeration.toml +++ b/rules_building_block/discovery_suspicious_proc_enumeration.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/25" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,8 +19,11 @@ index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] language = "kuery" license = "Elastic License v2" name = "Suspicious Proc Pseudo File System Enumeration" -note = """## Setup -This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. +risk_score = 21 +rule_id = "0787daa6-f8c5-453b-a4ec-048037f6c1cd" +setup = """ + +This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. ``` Kibana --> @@ -30,7 +33,7 @@ Auditd Manager --> Add Auditd Manager ``` -`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. +`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. For this detection rule to trigger, the following additional audit rules are required to be added to the integration: ``` @@ -39,8 +42,6 @@ For this detection rule to trigger, the following additional audit rules are req Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. """ -risk_score = 21 -rule_id = "0787daa6-f8c5-453b-a4ec-048037f6c1cd" severity = "low" tags = [ "OS: Linux", diff --git a/rules_building_block/lateral_movement_posh_winrm_activity.toml b/rules_building_block/lateral_movement_posh_winrm_activity.toml index 8f048d831..29a91932b 100644 --- a/rules_building_block/lateral_movement_posh_winrm_activity.toml +++ b/rules_building_block/lateral_movement_posh_winrm_activity.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -18,8 +18,14 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "PowerShell Script with Remote Execution Capabilities via WinRM" -note = """## Setup - +references = [ + "https://attack.mitre.org/techniques/T1021/006/", + "https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/LateralMovement/PowerShellRemoting.cs", + "https://github.com/BC-SECURITY/Empire/blob/main/empire/server/modules/powershell/lateral_movement/invoke_psremoting.py" +] +risk_score = 21 +rule_id = "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83" +setup = """ The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: @@ -36,13 +42,7 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -references = [ - "https://attack.mitre.org/techniques/T1021/006/", - "https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/LateralMovement/PowerShellRemoting.cs", - "https://github.com/BC-SECURITY/Empire/blob/main/empire/server/modules/powershell/lateral_movement/invoke_psremoting.py" -] -risk_score = 21 -rule_id = "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83" + severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Execution", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" diff --git a/rules_building_block/persistence_transport_agent_exchange.toml b/rules_building_block/persistence_transport_agent_exchange.toml index 1cd24b108..ed796dd59 100644 --- a/rules_building_block/persistence_transport_agent_exchange.toml +++ b/rules_building_block/persistence_transport_agent_exchange.toml @@ -4,7 +4,7 @@ integration = ["windows"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/14" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -19,7 +19,10 @@ index = ["winlogbeat-*", "logs-windows.*"] language = "kuery" license = "Elastic License v2" name = "Microsoft Exchange Transport Agent Install Script" -note = """## Setup +risk_score = 21 +rule_id = "846fe13f-6772-4c83-bd39-9d16d4ad1a81" +setup = """ + The 'PowerShell Script Block Logging' logging policy must be enabled. Steps to implement the logging policy with Advanced Audit Configuration: ``` @@ -33,8 +36,6 @@ Steps to implement the logging policy via registry: reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 ``` """ -risk_score = 21 -rule_id = "846fe13f-6772-4c83-bd39-9d16d4ad1a81" severity = "low" tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: PowerShell Logs", "Rule Type: BBR"] timestamp_override = "event.ingested" From a4f9cf4616096254e61c6cef875c1814c977517d Mon Sep 17 00:00:00 2001 From: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com> Date: Mon, 30 Oct 2023 07:05:24 -0700 Subject: [PATCH 78/86] [New Rule] Adding Beaconing Rules from Advanced Analytic Beaconing Package (#3128) * Adding beaconing rules * Update rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> * Update rules/integrations/beaconing/command_and_control_beaconing.toml Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> * Updating min stack version * added beaconing to manifests and schemas; updated rules --------- Co-authored-by: Kirti Sodhi <109447885+sodhikirti07@users.noreply.github.com> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Co-authored-by: terrancedejesus Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> --- .../etc/integration-manifests.json.gz | Bin 8965 -> 9042 bytes .../etc/integration-schemas.json.gz | Bin 3101487 -> 3101686 bytes .../command_and_control_beaconing.toml | 59 ++++++++++++++++++ ...and_control_beaconing_high_confidence.toml | 59 ++++++++++++++++++ 4 files changed, 118 insertions(+) create mode 100644 rules/integrations/beaconing/command_and_control_beaconing.toml create mode 100644 rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 2a5fa5b631bf38ba27d85ca2b12f02ad67c64c88..3166aef51889d4bb592024e3a4e4047551743eb8 100644 GIT binary patch literal 9042 zcmYjWcQo67*sUtsTCExt1f{4NwfC-|HbL#Gz4r<+YwulqqzHP_9o8P~+c5pMdbTM(Wc64C3H*v7GFn4ux z<*;#ebhx*lZR zCZ5R%3mf+K707+-okdo8`F)-K3ifB$il2sgfLO!tqO#AO*AO@d&9W#PyczrcK%aU$ zcil1@X@FRfPKB37?Cv6Qv5H=I9joDK6H3i2)m;1=Yesf*AZO8A0# zI30N*)FaZ)BLUbMaN!u(cEo)LHoBe|oR%Hq2(|{A&~7AE1RViDG2!i<1`r;EDSQHb zwx({CvI>z}-6E9MdCnUfOL+Q8YSjt`<0JscQPE)QjtJ^y=1);|(RV^u)VAJGnms3t zNE5S*>fo|yZzq8C5fE|9;99Umr<;7Rc+2(L=OLjCrx_>SHH}#}(o5hY-UVgoE-{10 zXAU{qaI#&XoMrgy&%ie$*j1SLu0MP^=z?@CyZslN3$F)1UNRN1>LgH!wV6-A@e8h2CFNli#I(v4!%np+QD z4LYrlLoFf%TU9~M6Y|B?Bi>;#Gl5pB(gx7h@P1VYS8QaEwr{)j+&wrA!HDo6f&yC% zW;kJ**N){TD7&!!W}GHIpCc^)Adf(nC{OTt9#AgfH!gS$N|bjK5P(Z98H|NRC=?JH zeE%`Eq=}?t0`}I2q2u?#n?l$0?`fB}<-%e+%=aZq&v=oF*CLzN1(R#WPTmb zL)^%n7HY0-x&4q7mtD$Zx!UVM8b{?jQ4q@I#x^FZB)|kZ|z3zJZN>rWfg+I`9HJT}kjnj#mQP1y-Le_U(np@da3je0} z_6JAxNYPg(tSn#sc~mXGi;1?{p1uTfGEw<+j`ocmj}=mQ%5u~XNU&S_L93NG;}U~* zWvvyfCFeJ}92o13Y>5?;WRwrSuC)OAC`Z?#ndDNkRQ0#6>OxocBTA79TPZ(uu9);l zm$NB0@_AO;-m9kdPP=<>W&9*xwSKw}#WLkrKGw}pa-<5g<6R??u5f*{px0Y&7)dO; zmX|TNZ-!`3XR|^W^o3@b^N({6q_a6Om6@l$p4KBKtVyx+Atts$6er;fnMoztztYuY z)?HH4wl(cGOW@Jn|NcRdT*%gRe5Rq$%s$&JkVm&XW;&5C%Y4EreO-xMFbTyykot9< zty+74%^1O9iKt*2Nc-B8{dYm;5f~IyIiT8#SpZA`5079h++Mcj^h7J|b&1FFH2( zqf)9Xbu!XfEgEAG%q>h5$))@6z;8_WS$#WXq!^_sYjkYMhyU`X*ky0*p*0(=FVE&8 z{_Ol*Hy4sqe!rpqY-m=M*8ge&Ej|SE3{tdm5;h-tN~$fV_J(P|TVP^m{(U!Q^S$@2 z)t!G=oK(eRUZ}2y3|Ew!<#&g0Zb|_6Z zRlwy#ZMMbKb>~#BsS$gtlNKz4am5#vM+DW%`~6edBfuey{I~WhlUu$>)5?6;!Cco( z)2>m5o}03#Ta0g0ok)|mxM96WlY{>@B<+0?hnpP5m$9=Z*U6;AibWbjWAXVsk)}Z3 zCKFG$PWq9MgRLOnrYRc3WYtMGxygscvxWlLL?y8LiFaS$W>x;kUHH}{K=>@VEqtRj1L%TKaM!xlYc$Z_8%D#xFp{UYsxbatQwn?2#$DE<;UL@_-$h;W7 z<2}24p1RSncsEahUW&u=#q|0%FURKQVe;_bbNf@ z?6-oDhS)KdYvDKqDwquXJCOgp27N7C+anfVx$4Wgaa?|gUqm~)CZ7JI{%Fcu0??(q z;cEb8-7GF9c73wF5h!4T&e${%sIO_F{~7xP5;Bql3V$nm^G143f1H@^>hxtF5dW~- zC>wd)SZRk|($QL&Y!F#`&mkH7mAXtU=PZ7Xyv)>wzeI2tw2P7)Fx2Gme1(0GKh!Dq zIgplz;0e#MY4?pOQE6pQU>&y0ne6Hkk!3%D%IbdXgUwHZ0LivS%rLy&f3>4LE>3S_tnOGq z^iUly^5PL6zwSsiz0KYspZrl-CS%NZ*`z*8>2vvBV9K@nd1!pA`nlYcfF7`k-e+vF z=q0|7V($X$<+HuO_|_cTxGK*_t)4jE#%-43oaZ{wufz3SH*K=SZximBFykv%f! z!eVFM43XATtND^e@mM1?2+*&a|GZx7VC zg>lu6Vx^8rMjK`+Z>hpbP0Q@21cXrd47Ht_Aj@n3+`b)GA$~$rPn}Ob2vHk0Gh-Y7 z!2B6;ZNwzqqkbl!&9h1=l4NDkaVDc+MwU!3xN-}w!h>Xm2N`d#8KwIfrIiajNRlb4 zAcQ{J^Z?=x`swlk+0Q}riL?P ztDe{@U#6y`yo(4~U{_NlQv>4Ho2A!#O=&-}Y|R!A1>lRkrFsX7G8Y%9BD^Wf8N`9x&<*hALGBjykCp1OHUeL`d!Oy$q9ptbMM_k+(y{)@vs z!=Wz@@-Va&{%RYu*HkyqU9ewOTW(n3J`Hx`yZ4oEp3U%H9+um*#_yU3AHuMQzExrm z&Da;=(cnI@x;M2P@OW=GAd(-OB}_4sD9k4Fg#4G%Dw=JOm@%QXLuz(vxgozgP1|2N znOH2!DPF*%mkO_E)@`evGHPFhFDQEVzvhBRKkpnf{7-HyBl zJH^}fS?fcW#NP#1S>lN9zp87QK@aGSu1lp!T%LvU@CjRa@!=855dmh!toEcv{hA?{ zl_1C45h=V{pl_+qPpKribQWUo#hRyaas=f-u9j4WP*b^R%v0M1L$@|h_hcd$Q2gWA z&eP0EmmeEbPcyaS8a$dW)7Hnu7ll>@IV*PBTno0RD4CJ_ZmC^ER@&6=SDDpZc(FWj zV=nKqt%M`983)LnJ^Fh3>TE#4=f}2dW^v9P+CurFD(jr3>AB)@tC?QHM#>FtTBfO8 z1!Q$ul(u@*9Z&-pVO=AvoR*_hY@)E)LE-v+>*T8jA&H+w-pQo7e69iL0~4V6yTI5=+ga5eqLcdlV)mr0AORnJrplic`QUjuC9K2CK^Fh(qS zlj!T~@dsDh{4AOBxR-u7*L5NilcV&YL6V-%4u2R)4h1Hd*k=&u;HjhUoM5B zs6~#6YSElvn$RGcCBfe|ME!hg>mg6nJ>6`gBI={r(D6IW%n``C?wPHQ)Yd@Knm8%-*8_Ju-~CNjsYAa zdfccM0+s7>$B8TurflE<8DH00FOGVpg-fdpMBhphEQtrSV^dI7iw%^}+WGgeu^0GddT%jwxcK08X z&co;Sv&Al}rdj4yjX!Qe&-^yi)-SVjbIuRH9I>bztlIGf{;**7Gio{6bdmpkd_Ck} zh?DAq8@9r!e!$q}ljWVfF|=o~T5B9-8qF*R1eA#n;O8pO4+VK#t(UM#R!KJ6;)-1ZnF}?toMpcn%{NW0Gh2E3=5ZS03z0I?lY3D z1v7mGWl5n(HV?$sPO=GKR5n|aut`HkmkPO&oUT_!R}Nbq3^T$jHDpm8^EJg_ukXHa zzw|)Y30qKXzii(6N9L$+FgEGIk33Pwjy$W4WzA4CPriOA_}1r0l_J|S1@?bOKlt58J(czOf-vAvD@pSWH;}x>kb!1pZZcuXrnftHvK}{WKYTeL z*~ec9u5c8N8)Y+^Ih}z!yNP5WcYg`PQG&#P(33oCKj0prMC=gt>nVv?jvO9{7vu*q zYN}` zpO`AqRK|OXpwS*wU~l$p(D4Jd_Y|8D|16K)LSacTVP93gs2zv*{KolLhq4I5-l|7z zUw}gVsxRsSTH<8F1};Mg?$f;VdS>vo61nY1YjOJ060 z5HJ#k3(%X*=OX1BK}?f2W$fTpwbWEHHg_cD#YlAMgo{(> zZN^`eqs=J3JFC)WRANw1l2#AnNv$VOs|U}o1pr1psaC%=$CPyfnJJYalDR-D2=6xK z1;Vmsk5B2)%Pdu#yDXs=kgiCZUY5WY`%?@+IU-k7Ttrv-L|1@+bQ9_?V+&o6*)@L=OAV=bEc-QKR08gGzG4g5_Dx3jFLE|c1Lv*{*d)HF&_d@3n>-&)J#AImqxkTc;>&* zg3t7g7{WtY!LWP}^3uY`C>wZo$c{$Hjt!h91fXGfz2nuyA%jz@cD7RwQ`@FpO* zzhr3pNv2L??UtqE*|i-BkL48}Evr`B-W>dLAz`15< zZu=u-GNT%Dquc(0h3Bk>mgqXkZ}~~Fx{U}6oiR6l23z_W=9fh=+;3IHmNiOmX2XAp zze}2aA@XE>_WRARNOaVwi%jvuEbvX7j@QssM!)ECeC`rMiXf8F97jj&Hg-8nLcn*e|kZu|4VHIE|2B zGaeP}&-Ml^QkWM^wR;W;ax5A`_1o;Jdt5D{yecJSuDNCkCjLh!%hIR4UllsBJjiE! z=9JI_J2)d)5Vg~F{BPK&@GYu}ZT?ut$lu1vVFo!>2;2sfCn-t_)uj_@Yo%#sQM=`x z&9R6tJIs`_C-95seKxtfs^|^co)@lY)u#tfI$Tvr$>MUG1s)tMC>*p8(JimiCZU^Qf;nTlu(m0oHcAj4j$dbfL z;rjK`5g~j?xPQrn21a1+(AGMwabX5esMw(KGfi@ArtPw%(w8Q(`tUil`G&KK{?k2TWDb^ z*Vl>XVicW)B%NAZ5cW{jm!Xv(PxYb$-bG7xZB;!7qWD6KC+`#*5hhyEMp4V^5z8gd z#mGC0g;V}OSeKuf3K<%mzigyWd;n)e4si%2(xos$n6+XVL*J3W62lXIXebnvKNm`D z04G{`HjygaFP%`PD|WBWQqwnl1P2HOW`Sax5FR)s22$>_sjul#LM-F1YQ+_#i~h<* z&Z%a+Gxt*XA;O7Y2{o)?mP~y!&spuGZ5ZBDDHg_P**~yd)v#VIhx%oz|#6gQO+2>l+Y;Z2qOy=LSW8-%?kdZt}<-!j@7C` z6J~TQ|4?C>DTeQEv~!1V%*Ys5x*L@Ucg6MbW>WmH+#b+Qnmv997ahgVmGb@s25xJO z>A#-@UFP(E9F3B<45@+(eDmh|3jZ`6`2u-ejR{WNHe9Ix3wh zk4wIcIuzxVzM2tMc%QYT=1c%wB3hc! zKbB$Bu7Q;T*3%@^Vf~W$?y@BGbxQt!h-v?OR(zRqe#ghXW6h5CY|ubs`~fqaDXe*k ztZF5=ueIb~YQZ%K!K|g}`Y}Uu!e%7_?^yTMX)D0;m`*sc4y(*x)M722Hi{WK|5wmj z1o$g3y0gXz{vu{ntj2Rp;xQtsQR}e9w%fB+5v?dt`AV2o&Q}R}#R8N!iFo?Pkv)Lj z)2)M3inyItAabhU;)r~?DJ(Y+0Y1T*eO)eJ^J1EW5dIdMOj&mJ31P`wnZFN%Y7rJ- zUNUqY49%xBN^2ETk>T^`u;7k=aI0h{VhqeBBe1UAJP~b96@}D zr6k5R#zsppiZvs$jvj!zP@I5U1wUgKWCf^26#W*~s!>M9zvFG4EGZC+0M-7Ct%dA> zk#%peS&^sXB?b18q2Pk;5>44zQcR?x&QD;Bo-M^nSV>;iha|=ZMYd~WD*4H3oolg> z{Q?)j1-2;lv~e?J=b15|FfZqE(&f# z)r+;^fZMjG9Pjk>DUQMq44|_|F*f^pyVm}d7j?q|dB@6^KB#(VTY{ET9$yxqzDMv2 ziOS)dJ6|45D-G^lD+i`EA^M`OMh3NtNcaGI|W-A=sfe-Bv?~-3z)-D;9 zldNAIg`Er^C%d={T3ZQO8xrrOFe%q^e=d6+ye(u_=_t9LS=Tp?S?g{YT)DfQ^N*E# zmj1hjZOyj390sh5Za>rhi%WA-*tU-u4vZ|@&By4V*sO~+5^w*z%4_P?i-FeHbXD&!+VJ_PO zQ@SkvZ}90&$;J7cK;?SETu$toUm-(dXKL=y!?0sFkbsu_?ER&egYq{v&5)1CX9GO5 z0loY*O!;;D)r8@8V=Ah(_LKaK2<2u`RNZDBJu)4PCl9y3w8MTed#Y4gCssfB1Z6KQ zC~ZGmJ4iBZf#R>VkF%FF%gj-@(>K0#&n$D#oT)R-lrziZz$yOEmZxOqe2zaC?l7hR z53`^3jJp6=_L5KPryI-Z9;IQc;J#Ja`SH)r8d~LkLJ~wEFs8pFe!QV!=qJA;92ILsg zr5VYqawaPgZ*2z}K;%`4*GG9yPooVWsW~|*io=D)n~w{_bk;TvT6T_vC{&Qx5C~lw zaCA(j@svPJj3F(ju-LM26#JqYw^z)TPE0IWad>2mCvh7~Osq)3u zi^u)=rFu7g#1!Hb4ZId4CxGlPs6$Ry-@hTn%v?<1)p6NI{{Bf7f47T*nC<5#&FzZ)~^|vZ}yqe*UHM`%$h#&#+*1- zpW2>1UU^jO!Nx+AcU8}|J0irBNEl3PcO4!I#8nxqsw=DI8s$#dFB;ULqx&?Q znAMJWe2l<#U~(R`51wxhM@*ZkJ5P1mcuvubhF10JXh)yp204L9Y{x=viZ~)77)De66I(bJp{YBXd=bUp}tlTXDX z^(B2ICY^3vX%CkvGB_eeRdP@@l`}u~cnG|1T(JsYGOYOY4NCTF@1cY!jTSeDxS`9* zl4#r6FPxF?PcxQ7L^lmd#fRqt3OPh(#v_D~mHamFdMM1>En6wlzVZ^FW6Rot?#W&E Qza?I=_kHNM^Wfh90Cr#dga7~l literal 8965 zcmY*;WmuF^*EOM_q^Q(LN{WOa4MT|1%>Xi#NH@|ADh)%2)X)qtbR#7qEzOVu;xKeb z3^3$7_&o3Rz2Bc%=iYnmz1G=3&Rq9>7^Cmq(|3AiiFae`E`anYv<(wewK(I z?3%1}eSydHOzRJ|%nIE-!u6*$uMdbvFWg1Gj&EF_W@2U}eUBJNI+wqpHe5khf;Ym^ zlUuM%)|=Wku0a1s8U@@My+H$i4g}N=FQU(yB-O3QkDsQa4%7gs0squ?%#pL_+7+8gVbC+_{PX2EXxg++j%bmdqX}<-f`O6LE;|?FmmhPYYE&qR6!Pl|@6e-3 zWNVs+!B5!0*|i(PGHD_j5gKG{ze}XMi)wT zp=YD<3ZKk|i6~>`#qhnC!>%%Q-*a2&#*99U1>p`exrKw;+5U8A=$vBbopTc(lR&Gcct{D4R%5`ap=>)TF% zh)>u+i2N5@x&m37P+24m=_`F2!Pt+a$04%Fje-I`5`Y3DJ-)%1sBdQ8EO8HWx5ppN z4MAFqFOMVBfIHFO`K`WvBk>&|Arp`zu;PqKH+yIGn*X`NJ<@JY3qFo3dW+t1ACdPQ z=d@u*UynQqgl-mq_?;@UmVR$iyUvnJ)5jy1?Xa0KRk)f+t*qVRMv1soG9`=`g zD&*m2N}RunRnJFj(!G8lsnZoSGbnR0^kRGKO@q^qMSo11N1O2e#P7AwZZuhL-Lfdv zXA_QDumSJgQG)ShDZQYfKgYbZeFiMqBd^x!h3yFQf%iXL?Y{v9PDU$%9@qaN9{EEc zv->W1dNZ}1W`p*smI41RS#I~UL*DSby?$doY95mq_ z!QVIll6yA&xPo+#HGks};p0Wo$q-Hsnv+7;W5VABgutBX#fj29E=#5tU-O~&vsxof zl7hNWwo%_?DJ*pEkWuID^X{qMUCO&h_gGf=&8iDUQLBw8Ct&ljnEd4UAPgH0or$JH zu5BoLC75$Q1Y#4tjN@tQ3Fc!I_?X8ZKj;6Q4mEG1l3U>g#PZX>OvGjczbi6AUeI0H zu(UHeik^?l`%2Hd92Y=RG$=$l2c;(Y|6i*3^lIbxnFn?Ec${#DdlWYD=pJn2;o`*j zO?q=8^55y>=u_*@Nn zIedP`SKD?r*>k?jzyP6AO4pY)JL-R$edBp^R(6o)U7O`})vm~)G31YL`?ds-!OB8OHO->1$5;WmN@aRU;E>sY^VvW3^UHdYM6|>ni1#ceIcZ)x=RI z4;gzNS>??Nrdr9SUdyBUU|J4SS-s?HrO{X)8YquAsSM`NVZ%tOS&2a8gaNLE%rjzl zoq1NL)q4mTTs3+2JOvDXt5OLXR9eW52t2V%N2yYYCLsidQXDEW3Feg>+cOCT=Ozd6 ztZQ=z8k5UQlek^j;SK!ewf*Vkv8L5*(OC`rc8wVcB*X{vMhmfZQ0_?SJGEP9^I!N4R#o-v%_}WP*BxjJ>MZA#PmbI1!rU5T z#^(geZ=KGMG^TK8so$1+rt%n!%n8U_4^{u`>iF{ux9jZ&uwqBKF(aSftET>cm9=a` zV&sDxlAOI*Sy|d_!k#bO>yn%WN4Ydfs4O0H_eK)?+l@kHYp_h%_l+!~X^W394S4E| z2BtShpqG2o}^?~j$tr&QqCI|L8n!^-q^C5R{$y&et(|<9H3~)`IB6&5XSbz>0h86RU5`q{q|q zktq>JivCAoi=@X-`(X=a^dAp5Jw+Zz%1bTog+0Zd84HV=tY77Fi5JIHmTX^UcL@bp z`i(?Z?UK~dKU~}6dar-^I()Cvz#IP^adu6LRA^xdQ&3Jb;h}EU zeveVdaX{CxT*fc9$uoAS=zbqkbSNus+ZlCvd}c}ZbW!TBJkazgYx_i^g701(ONa?` zJ&fY1R)TcQgHtLr{ypgcrP}cCt?1GbZ;xgD#;*r(uKg#!=v}x)a%J^m5gbsDq+gHp z`lcMTKR_YV@QzB+cOj?gHhOY8 z7zZ})Y0mmyI<)6iqcL;m_+~0XDC7(9>CYmNufIUAsfc&C1QI=~b`oYIP%GD)C%fjn zce$cVjVrPG&O2Vtvw!6QGrq)Xmyo}U?Hu8fqfS3!%W+hT+Ii#Bxjt)c#17rOgNSK9 zBG-cQzrqZDnHHg%(?C>XO2N*Xhvc}KxGnaxi$eIWX+aT-Wc|iNdzJL@t(R#pewj5J zUNfHur1z4pL9%cga z<4*?mMLMmcT?>-!E|T^1_lwH6q+AGr~X6lp_bGs~Rot5jkd2Kx4Z=Q}*J ziv0jew6I;=g9cbhlh#E@Nx++Sh&a=0dd@9{saXrT(Xf)5&UL09xfvxuP;~L+Xvj`N zJdo?6V2701uV5#x+PNO+E_YJgX{%6J>!Nvr zt921fn#fcEtIxNKzhmi4-q19|bbpYS!H&90_F=NIz?kUwN4u(6e z9c9{Hw*1=TGJK63e#i#OT#>wK&L+&LP^fOb^T!l^>K3@zW?GQ)&huTHgF#1jQ^6uf z6WIcF1^gG~0#Kr!UPh&%&6&QQ54_PtZj&ch|GlDzY&_qgzF4kaUKqT<41P}QIA->e zs^6*iJK1 z-VQIdC#Q&VN3u-QOI=_+=aY)f2Nel1jYH751ml?uvTZO+YvpcjosFM^qdm;V*pt$j z6vv)NM1>m12FLhh3dn;yyAtwpXFH_MvvpH89QO_Y$5S*9??OB;e;8+QbE3GrbbhUk zRC3arU*ia0$)d_-LfBK(d1I#nVfqLqclwlW6+(a5+jSsJf9^=I(X{CzenpEE!1Fc_ zZwr5$^M%YOv+JOdetOw67~QnM?A)~6wyiPkCE>uj7$}m6X7;1c*dhJ4DhVi-D)Dta-L|a#p7KTCvvOyRj*V;Z&GkBIJ z1MKjl9SSy@bS4f}n>$#1WBUWhJWZ4tRvYO)e3%K5ZZ=N_(emETje`#cfTdNI8 za=RjL9^lEG;ArA|17s==)}n0%46i+F3{VGjJ1-vZ;PkcV+iN;8RjG$WgcZQO3~qFE zuOZ=3c#o8b`H0f>@(|n#e;AIm+5JAXwJQwac%g-_H5DHTAj&6DWqbTOMe}#rtVwh6 z1N??sdy+maTxzZjAlK@vP@qDOo^#hWU-0z@P=6@V-CR6g(3s!t(l2(ydL=mHT{`2XX;e@YxGehtl0tArcvm$ycRx4&K4^43 z$OY0K4&?PkfbXL4h?7Q}dQ_aJb2qF|Qdia1ox+(#7n>?OZB-`wm$km_*!SUe30uk7 zq*hTwKBgLAL=H99U)DrBHf3u2vB;<^?@T3GLg@ftO;ObHvUACIZ{`mTax)>bw`~9L zyPr;um8`_gA&4s1V8?1)w=38zg~X5#G7{BWJ=i-k+jA{g4Hwj$oK@>~PYD|r^qj0V zE;18>EDHXroNy6>WD9<^6V@Cp@vPk_8-J0}qfTWkM5|XfJCF}2=tgjR*8UYA{65Kj zVu4FdXbjS*oe{Q08jp)FV3x{^FOVD(Q(#Xs$n}L;u8YKy@@IVByRdf7 zFMSF(qG61H7^%zMb8*@}%EXEmirslP@2Rbc339OU{Q1$F#GS6l3XKoF&(mu;++H&T z_*(S;fY?#=alj7v48DCB;yV1gd5>*KW@eg#;4+D0uO?QW_&T29U%Q1Dh1PR`YVlRQ(!q^Si6U$A?R@9Ka@T&fT|oD{*s#8>$7hsi6&Sf1oa(*Bx{uN@R) zNsG+7RkoNPwC#A`DFnCXUv7IO_Acjd)?Z?r_&cB@ohi~LY?HPEtv)&l?Z(_k-bbt4 zIj{rb({Z2QB&%6woLSEs+8gHk;wM{4tBm%PKHL+UrS427^rloRnDf5+amY8WhHlEN zLP#fZ#!+qh8wF&dbf?|TD}D3$A3q)&1Cx_($l;S#?2gey0c;HHfx@xhi;F7Iv+>Nr zQ?uY$2(!>_k|e-JUd~=jP=zrAF$N|ZE+QZPhXv%rlef<>^5GdQ^5l~9V0)7B6q55y zje$u?H^U(xX1jY4W*Uhx?7&|^{<#MUJ>ka(wkRda z91T;SbFfbbr_{cUzYJrJ9@PDSIlv$6quoP2rVst72emi|Jw6BpEUWvYB+|kYc&&40 z`exr3$}pBThQ}mKn6ApTM{bF^GAWQnUEX&+znC6b;!=HHdBjyo5x@_yHT(g1b_I#D zcJ3%nfKor}#@w|l{Fwl)^j_DWdxO5q>$F~1c(#So$|BQ-8!j;=a4FJ1Mv~NyIMmdA z5(GCiGOUhxh8oI(%a|$%44(H7o6mI?SA=e9hi=)G(1#I$^0t&T_49l|Y`Pqx9@J$T zlx6B|8@yA&T%dNQUzQ~@lx2;ji=k0i9+R9`9-vGU5;kv8lF9{w=Xp|nzkNb4Z?x#^uLVfp&r?ulu$ZTFC^xEXxJI?3mdPcIV?7)==X!~M;Y2-iZ2Hu(p4Iw%p3Vw~4QJl_c!K6B0f8Z8K>x^^>e*pE% zFY&(o)z0j4s_se{xR?7YAaMDL`D`y|mF)7DYzyIK2cg_wplBCxb)A9iqn~%8#9z1Y zJU6}z*`FQyj2OJVs@R&&dDaygi{IfSf0$Z1u*a7L4UNUB2yIXLPId^%WxSb7d;+5Y z8Am)Q)^};#xkI_eS|-A@f~1&_Is7EiHADL~65Mh4*GEk<^OyzO-msh++V2k% z#kv*`-J0ZnJ89f{dttMODj079ll$@pqjqqzoPV)(j{}kPQs*j22+4n;kJdQQs^gvuJQOh0u=|z4=F{}0-KG8o zc+|L5M01u^X^gd1xpsuRR$eQ19!zUt>Z(>us?B|50% z%?yI$XPVDWMsIiFw(URx3sJpEhN0n_A>}*m+!0MDmb+j>H8ABY?AzJ}b;L-syS7|} zC$-Sh!)}|!F*p8TWs(a1bMCOBGXC;u8X$Fd(Zgl{; zqLjiCnV0yZg!MgZ4JgruPd=8FH-%L^i}y`paGBSm{>{a5swq8vyfSrlCRkEIrGt?y zm%gTP0!mpCK@d7m;IXBAa5Q5j#wHvx9#+ylF-G3Da&EG-1Cl5Em<w)EF=D)%6|GNLGBrNZ;(jZ=o28=Phi#MXHn*i&(GcDN-EPzNh%!wwXyl9- zolM(hKmEayd#I@4Pk^G(_9?WM{e0N3=~D=Mjei(n*T6f4_)4%wfeoxHd_KHaDmigf zAnRjMa*Mb=uNxBSwv=7}NFK)e-T^UeV#Zx01whYPX^ff8G#Ruipzqw#Atv6SOV_%X zi2;lB4lEMkMvK8e}koKk+!lg*yzgUaKPi);OgGGtTX#%um zAkcGN8spMejUd!+MtBh(S84sJ2&h!DEMsso!|t0lZVCvj^B)6!rD4xg@)DK*A-4P< zs<5TR-sa&vg~qbW5~JL0n}ihLFl%;ufXB%3SnX zjFlioY-I_#K9}4-)a5Eem_RB|{zCx50RITk+tygZKg3FnXwzUF50O2Yunb?mJq#pt zqvb39q}e1mbSSFiBU&Cw{k!L?klF|_{p1uZ?ew_j4I0Vw-Gh8t*0OY(xRIqovHq#g zQ-Ee90ar#;BO5?FGVI?XBk$pGi4E6$s!gi0AUwa+#xTDHl;857oB~@0>|Y22%E$Z* zfo0ghx&K0;p!`s5=!6M?AakKQ9t^(iil}s<(iNn1R1qw@N-NhIC*T0PfCO_Ns#STE z*(~HUr`Y&b=)CcJ46)0kw{O@4jYA^{K>4 zO1@z`%A?^W)2sT!FV2%x0r*_Y^%}Vyy9cDD{*#p-&l~$h52l)c9R}E3!EJ81 z;84xl5AN*ee}rWzEpII_EaP!4yYDq&`AzYIBH4JA9lK}p4PF&!_cr~2h4m+zm||r6 z)`HY>KbPnjKpnDRPN#hzrcZO*mzHb!nCSDZRNA13v7&sy0y0wpm1$z8xqNcArh_T| z5A80fW0R5q?HK3GoZ{>oDjTqH0I}mU-QK$zB;i$Oy*gjEM>Pg_{Vg15U?&O>R z)M1;WiuLhC8&mA&@?VqgWU;pkPWcYyQd@ zb>285l6$DuCwE(lwJXk$|8F3>N$>?J(&?tZ{b=q&I}NP`9jrHzvc+DbMMtdO_U)X| znYSv1hiVtZw}U0YZuSavI}@y2RZbaJ&J8>DZP?a=+j3i~wX2_a(nZS1Dw$!21Pk5Z zBJCoG*^xLnP4FcKeu@Zt^CZ=}5jVk6ThdR5=`NlqBrdl;a?S|bJM_#SPHM_;) z#@*R9in(ILuG0Tox%LR*`1KyT+VNsfHfM`=?r=+KOex{s$bjm0#dSHA| zR!;HlcMncY#jD7j&|1>ql_8u|a*I=gabcm774_xQYTqHWG$FhdF1p-zVvgoohxKWQ z%|=yr`WDRHoM7HgpR4H=)r?s5to1FwEBgcEQ#x^ZSc6u=ejnFMq!;CB$>G!Cc&@G( zRe)N(%liEr?V}lezRHiV@yL0x{gh5ReNB1kjI5zJdALF$gzw-6Xv+$MCAYYx3^Y!ISgXY1kS10O@kIRjGd4WKE zP9R-EQ;X=Z~Nz;Rs-Nef}&uA8*JzVZUV zTo}hmOwUBCHR`MN=3-sq;{UehIB}ROsya1lK|@tc_gh@IfoUB}Zm4NL-hlS?ljfx( z_3>M2kS{|3dloCV`D_VdW6cO|YG)$|T%2^D!)%@=QP`t6-5 z)0~vWH;%^5d$dH(oQ;3MiJ8zR?yi2GY0dQG+g2Bn+5m<=LXtBXUMy{9+u$c^ktZDE z!)pKjxXIMB_UnX!>1 z0>d-bi~|mLZK?iUYHiW}Ahz3mt4Sw=S)MMFTQ64>CXxCZLe7^aft~2yWy1QX_h_ z)nn=UZ02;IAq}=*2*~d2y8*M?8r8>*grh%5EXV-H18f#N^A=yDf;6b({9Fn||LWO! z9Bll4A+EU{oBO$Y+N_F*+sm?vJ%Vt^5mWm{yfdS>3CTBbjKSC=A9x)|-Ka0*oUEq7 z8dM722J*&_I%Q$d4M{A9F;17y_Ul^aK-Kluy3akF5$xGS7^f5>})0FBC0ejTvNXV1iH3&+jq@XQzYgGD%F>&Bvo^JCF&i?>r CUGp3O diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index ece874e00e87870d760b827cfb1182ff3abc691d..be5dfd6852e4a2ffe4d6b8864d291905546db50a 100644 GIT binary patch delta 16241 zcmeI2RZv{*qNb5R;}+Zrt{vRn-Q5XJaM#8f4H}?>I|K_7+=IKj2Mz9S!@vJ?=A4>2 zvuDoDT0L@)pe3_u10P{06GFaQkv^zy~mZ5)7aM1E|3O8Zdws44?x8=)nL6Fn|#Z zU;+b}>i{g~e?W%mTlER`zh5u>TFbO>c!^G*XH)!2lRr`Cn+vyI<3ij(gaJry z=wELEsDbPm6li$Xiz&xza@0$|W_d8J4Ny4<=i+d!_=p96ZjU*~Rqv4ml$NN+jc0jj zoMBr6523K=SmKGx!`tAmcuEXjKR1;hqF*Blyw<&w(6=`v5Z7qvV# zpam}jtVGfAeAjMg_J8cDx|i}&6#OY1<8DPysMwo5q%;R*-c8tK@?(hsyM3~=lkGC7 z+}9w6fB}F-r`NiQU@)JZ8v_|%)@%O>u(t|aA<8&byF~{N# zs-Hyu+fPi)NRtM(X-KU*0fFJo4HvaS^rr+HM<(LQ1=e6-sRfp+V6QNcy9Iir1wox4^hgaF%_K-tl zASqE}JDiDmzG#RidK<=$PZxn9j7dM%jCJzuHW7ph1?YyI5xlWpxt0k#!N!bB+HLcN zxhQ=JQjP-DLH-nhJgimUhHA%013^axei9~|CAxSaGGvA~f9aAP@hv%0n=;08^Fix8 zy|nLWOY$kUt>3mJe>Ff7;cmrq!-sN@3;Qr4J=NDVJDI4xs|Be>1!}{*kU)^ofRZrd z2oO~?pcu3^Bnb_e2O#jF00et9Km^f&Ebo!J5h`M&$l;OE=}R`K(GKyW>>&Z@Kp+eR z9a4!7jD*I6@L~Yn1UiJi+0lJ7HXuDd*>ZU-B136?L184?{Him;GpFfQaIdYPLLPP9~BMGSMN8=qB z`-)VPuMIZDPOYU=^3Y%8<&~22Ka|94QXtqoen(Arac}~5M^OT6C^FkfCLydviGFCO zrjoqe(Tj4ZmHKt4tx+L!G9~aMF-lKLz7E}DDvHfW=3;!AE?3j2^dNIA(FgbT*Hk@7 z{tKCdMo0d7<9MDFmaHk5#Dwu#dWuW0w5O3;N?JJc3Ge6 z_*SD1ndeY8C$F8$+%~cLc>Z>f6X%HzH!&`{4q}duNH&H%Einu22g}hT74mgYFLa)W zo^mIQY)(GdaA~hRXDFe5)YoDcE8znWu26tJX$#=h&|o9rNq_MU?$GhZh}}o`-qlbn zwpnF_JM{OMj~aJCwQouGA&kwDyTZ|w$&sYUQR3u$BQ~Dnp>&<5t1UD z*vu<{ood9cw=>irW{?jqXvX&e=EUyJJTw6lsp~ zF<-vgW}|y@01qebmY_%B3xqq032qe1wXm_S=bD##;iTBn1bW1jmOLmSxUfJf=n@D& zEYKT9(gRWt3;YAU3dw#4BmlWWkt-^ruepA=YcC&yXf9%b3R*6Fli94Jx{8vdsuT?U z8<4thBGX}st%Mv&ss4UrV=pQ1qwLA5`=Uonp^mLAI{2Bh>3LzFSRHc zdDd*7GM@D92x)P+2IWqhaJKPhh7t~D8sC%Kh$47>_m-8Gvq-HDGY6p#5+-tP@6E&) zSScw9E>9ty$s;%sN_;0dQ%8W?#R(-LW%JiS%iX1xoGUx(?0xu3(kPT}G@I6Eqn2)7 z$!q@+t)6%67pTfQzT_#<1{%jE=OwZKUKGdrbc%0=0x3j875W)xWp8IGf=-fFcp0@4 zu)e>`=1BhP1lb@py#`&b6Q;TQ4~rUXI+FVz`|>MaN}>6!_jOpN?{vBv@ROIeyRxXj z(f~s+hNRH;i6-ILf<+F}l)g8T%UGJTpuxG+65W|#%emH7+>pT5A)njpUBQSwRGib3 zIw=XMI0ukz+kjpWrhah81%{Xc>pE!pLu|LRSzs)K%#O)yt7M6cakLg?HKV8E=q~Kn z=#_2WHRSSc?2CsRnuX6!^F(;$yeOv=_m4Rv(*azW9Q9OxNBv=)s&iSQW1BK_Cm8;w zd_=q)n<({@QY>jMWq|LbvP~j|y*LauKdyA^cV_yZnqAP$&lK~@p*-8gRE(y@V#Hha zoe37hA7OL9BohYK+cZj5vE=lF?uw!-z9v~07)k;saz1eO3hd9eY0qxHZVHPBVsLLg~>acvp4(E6gHj{`v_efvL+FXXr!udbN3ea*P0D7+fU zRZMj4D@jV{Rx8|Cp&3gBt9@Q0Uq|jkyKFPx7FkD@Lc50j_2*YRB$n`m+co)awAlJQ zy~*~;GKG}3q(Fb}ClMc3*1S&guN8R4-+!d+#?FNwFGR+2b~LQ55(+FdrRMHLvIHiq z27%K%mRZ{%8oZdLgOnMDN&3NztcJb0HGeTn@B5O~=3!Hheg}0NQRjL;W?Io2xyQU{ z;C*GO?C$Va^YrZ)5T~QD))zChH8BZ?@+^- z-=WUWS!%e~${0bzcRxbl3h+2S;RLu;Okb%u2N)DVSJyS?%- z3n;U3e#c@}zlHbf^}sdkGGNQ<>G51_!v-EU(lVYnqKi#Quzab z6!)%o7b(Hl`Mrx6(x=Q#t}CC8yu;T&AI!Mc(vr>!fES1P0^da;QvnW5E1?Co8RjMR zPiz&Po*i@(hz4k+aILW1jY$h>SOTL0)ysP|>z3A;BR{?f>_1;rxK ze<``tJQX)T^aea4EE>}ax#{i2hEC{LuK{d!2x$kiZY$=YFGO|O*0eR_a>fWry5u$x ztq*FXSgmC` z1=cl%j8AR~SGlTx1I5($`9H&M-jtenG`jPW?L9`10rV9qk+F5Z_y%zc5S4*nJ1Bpi zG5~BZYD$}L$8L+`0w?SafP*a3*@D9I(PA8sv?7?w7P5`pA3{I%vmD6PK+zu{ppGh` z&3&;?$(j=pCx6nVkSFqp!t5CTnEAwwMpaB-KzB{TnA8Skc?4=qU)gH4tKe>Rxj>K8 zP|M#{@!5s?s0lC^d^mb2ddKlwmvS@%y)bRFa)>;43`Zq zh%E65SM^I#uHgyx(#A!donDar%(0IugeId5$@%RgJ%aI-pJ(e?dbD0bo%OL)<%PL0 zElyk_v>v=RyK0i{9YNh`WAdV2zN(tnbp;ou)-eHRo}9HFulgMGc_mBLgn&>|5r3xy zp}8@V$!(1*|fNEtDR*Ft%<_C^<(&7flbE zPn3AJ=>(in&|i;U&;X(+7H?RH^gUopUQFt}79wS!!%VNrx8YiQdQDd9$zOL3E+^B? zU#g`CY8n;NpKqwO?w^MUZTJkhHn}PvxIChjhCq|;f*d>HY@J_RU6wTZsH)oK?kb3p z?4b8eri;Zt{X)vMdkz$kjyJ3;N8*tGjA6~h)q}znu9ti*|J~6>&8+v9-m+9Kr+zE& zL`RGxSAK{s&|0uH&Uk^1I4{ndmCJLfsluaxgdzmbh!^9MI&UK?#>@cLX@*VO zWEHc^$Bg*ZB`(L{71_-f7Mx+IAwO7=Lm>ll`uM4BzhIoU+L92{-6(L>n-ZGA_MYO} zqd7yQQqF}EPUv$xi~2D0J9Mm-U|In+XwCwRu3!?F{5th2e8aXsrG#ZxAXHzRFIDjr zbmzk|exX}kbe<@RbIv`y1qmYDBB;dmJ5qOWbKHMSCW+xz#^FI@KofOFWIQ0>*=&hyiZSjKiFFl1cZHKb(|mkfNMAebg6B+f3a zv4iUVCc!c-g{ILI+ko#k@<5JgZu0&FB&_K=eSiva(o}ii8sdOQ=KN8V#ouc({&8U( z|0o;(2oL3kIOG{QR?sA$8u%oRCJ#gK!WzA1)AD(~gR7(IW}I_{h7Icx-yG9ewlU5`3kx zYTbt>`O8K*23rE=S)n9Z#vw0?L1D-IP%ZD0Qcphl1KkyX{4xt`K%?q&Y`~UKG-1WN z2DG*~Jqb4UB17dg57r$hdTDa$2#DWwZg9H{M-D9!&Cz~`@;+_tIn@;p$Z4*Bm7$X% zGykYMd35qN-U1WBWGgnH8~Q4c`h67I72>3O7qr`lyoC`ovvpd?{d~PQ`J}(2IL5f?#nO>4e;y({U$_08vCq#6|D>GO z9f03b^3e1nsn2Ml=LcpV$OyIP2Z?`-or|jW`sQiP@7t;NNO^PPS2KLK5R<;utUuA5 ztlWAVr2>P8_`(OXNKbh^-2Oou;b&`c9)qt2u{Y;NC&qp6iS0Z0&f+XVd%*3}qnPsN zXMRrMSpIYMt1pF$5}KshTj#w02&3;T0T8(gC8Zjp@C}~D6A+o{i_F39)pqu{Qh?e4 zjUd9s*g^O#dKsCPuyJS12J0#`aq){E);R6?e?Piq{gxQT1^}kSAA-cGyu_);+RDAmM z8y~`{X(+$xJ@JF`%amHX-$OZ{YP0aW1Dd#7CGu-S+~5VvAy$yo!5@3QhnhTt?UBUG zndL3m^3{k)shaX&G8{vj1;pe8lPfhUBqbD(b2&|>Cln~2)^7+vVu$c+I8<*N;gND1d)1h zwR;JxN&E=v(1v8v12I6h&Skzv%K_i&M!~zBr)8Di>-S4qw{qyZIH?NaT3m?TDa?ox zT2zSQDMZ1dc8Jj3rI~s`%rK!6Gc7&tnt%`ty=#-`=~sct1}>?whFZd&U?v6+;y<^Vpv|PmoQ2nJ*psd1(iwcD!ek zki@k)Z?RK&4{*Lt`8y3puLDL8!)_WA9d0)ez zzZvJI9Z;zTuc!)INSZ=ODT#KB)DMrVN&)i1*~|K;{v5&3dfu;GFU9=uMJ6yKsbn); z2DZ1&mUzqHUBGN&2xXbunyoopzkW>iSCF0JRzVky?!I6{FmZ?;uUaOdCkz!c0yH`& za9^f`iG41|x5S}6pf4mJRUl-t=FT-7aJ6gNaM(^@g$ zlT6a61FC_Yx0)`~o90op{d&Y%jN12$tDpA{9T$}?*_e$v=L71D@dc0YcbH>Cy>LDW z(|87koQ~kfRs$l;!av(qEx)ff_*V^fQMbuXuvRF`177sSfBtafjgWsrEvWQ&+_PC5 z2s&N9oB#Y1MC=u72auTc9D}p%+_u0FTO6S9r)(CH!jLhXM#RB;H~3|wH&;XnH%Ti! z>xK-fJku)!T)6X9A(oZw_A(seaf5{fv<|7UXLfc9Opjtv4B#!f>7M#)5%u6Hq=J{}d`+?rdd#5_$)b~34y zKZ~PMaoKE@busXl*s4BYO16*k@6g9=aB%bu2McVvru$Ne~jnzdU7G3b0k{sg_UaAG%=URgc_FVkq+1 zEXQQ*uNDo#;wUXr1Cfz`nH+N8W+-7;uOb>VYo9|Iul-Y7WiS?r?AnZ>YYTv5O;`2?iOp6_C zYpNEm2FUClk4Dz`SCWl%BXvjpRPM0b{_X+gcX&ryrQgepTnM)_KHM^;?9|?xQTBxP z`|FP#GMnEOq1hjZyZykE*42NU1^XpwUtdQfb*8;Lw!}#cgSIDHF*Av1nz-T@16_7@ z(WQ6O&Rbew!c&_XWN!w|_}#UZiq#A=+R8D~Y5+*i6VIOl8*&tv95N!a%G*-8)L831 zmPD_9?JHJbX`#3 zyFpBaf%G7)ri_iJQjB!?&xBR{s6*Q^4vUAeqSV;+oDT1XHQW+JhH2A->kEoe zhS5xCvtJ%62r0TE-VMmwtK3s0nl$MSv5wUb7hZYFM`gNmA3Dsfmbcumd~0y_A_{MC z{!s7C5#)68{hPU@)k>=s%7@E2*#a7o58N1M@hX_+*9i{{pEkRD!Xwe&lhFt%_c}TjV~L9OUhX zvg}gLPg7HV@!W*<@!t72zrAb@AtP5T1R$J(1AbopxnJcMSiuPgO58(av`B49t)tDZ z+&0`Z$r@f_`T=S<<RAzNU5MHow z+=+(a{2yYjXT9&XVPW^A5nrw;YfI!14zr1UGYnMd((J=bmfK6BNlR^Mv}}ys_(8W7 zCUYB~>txEO@)}bZH-q4;QWUs;FNA)2e}d`gbW~!!fz*${lUHU$r)bHfUO|`96tLG< zBs`WMu09^cIjF^~U-xHiXTavc#;sxVP5Z~SsopZynH3DvE`J# zQY3j2R(e(-n_zeCM7#fsO|ZO}PD`kdD{S(M^7iR_LVozcWa?^#b=U~+5cxm>*8aEKEfmPkpycWlxWvspNuO^vb zcSm=+-pw7Q-jgkz9s0L8l0)Q$0+y)(0Fc*S@0w+AB zPmM3;YsYcI}1}9asG3ekh$3o76BK1Y~3jvY|FXLBU5Rp=hAQP)x2)oW21J z3w%@Y5z}{I#2$^le##-(9hjQTP4!Js4%q$4cYep&iL1%qNGvJ^SS zGCS@GuM=@|MllU8&+Bw?S()PQf$FD3T$HjAEH}# zi{~w_eqI16FNwRbU|*C_p_j9h*#L_t19VG85|pdcIp%|=xX<9MF`wo*=X+PD>d zGs{h(HUiksd)!+fw|T@d{4L(@)UG1OPYUEgn@mw28Ar_I@pZ=n($o`=Z9|&-fbP-2=*+W`|5l@j7zwQ z<&^>tyZZ+Ue$Y^BMA@@)^2lzO7Bk#ABnLG#^1%jpP6}s&_^;hsi+ABSj&Q%89Fv3~ zx=%rmthK|+b&f}qrh+i{5E+Sq!XMB_{a@cbdau&X152Lg5#zVSXFeh!@1P$y3FRVvC zXZ{_a|2Y0%PV`;tk(p=<`+@%!pH~N~xp?N_`=B?g}v=W1iS~>8GQ(7S2<2HhF1EXV-bms(N zcA==4D5?(h9ooLv>%!22R+CvyIB%e#sg|!yGkk-q7I?BR4soo-(JEerhdF47VFgA& zLrXN^vIApaK(8$Iv&>;M_5mk0cYo^ulX+*xK|(y<|49eX2+`KmDH^{xsbRR-=}yg} zVwV`p1hAv+gQpU8@*f<;k+aqg+7%$&F4tfx<6R5BTyZWP?Z0}J*Z8ze63m}v#Di^b zHLSXp1;B{+dI(=8^j?|qK0SCGG?j-jT4H%JqJCMm#o>?u1ij_=`bHrGF=Xno9m4m#Hq~+yL%EX`O zROh|C^pmJX6N#XlwY7f~sw!4*g(_Qcn$20(k7en<3)LxxfKENgPc9$d&_d!Q2U-%J%sM%`sE<_(OI*x$JD{UXPvqdyAA#RmYc}Q&I+ADS1j)LBJK9^r6OavcFc?l#jGE4U`}gEfM1c6Q2S7mP~kw#Igs``e-X(m;D&{vUE9 zGOs+IX%aeOtps?o5J~(es6xi~@v$FaSat4vhwo{eb>7E}mffaTFX3a>4ZDZozYBTC zM{uDKFs8)e-4vjiC=E67+Rgcy7|}rnle8r8;Uc1|pX+*ZiC$-9?J2L!wmj>Z(~q3J zOAI8Su?b1Ii(t=IJ;6^K@a{QjN)Wj(8$q%v^baB@) z2BcsWkq=XPiJw$h;&c$FOz0rqnYa@JlKo7-U(`9dE4W&^G(`u8A@LYM641X(E3xJ$ zu+%O6KV*|^6<;=(X1w%hL;*kF3PJDv4cv_KOvd=`>?MXhe8SJ?`IQF_nD_ba#DbZQ_~)pUkW3mN zJtTt$$naMngFqvH_Lqbm@kj-jqrR?scqus>P%&QSA?x9ViyVkXI_PG9?wvc6KzMUv zV$Am~{=RukD`M|Z+R5V zD2{)roRWE_WzBMx*=sF7u|-Meb1Tkf+|7?tLrL^(?nRs! zQ!?=a@L%(w`?95Gj>j>TA4?<#UP@UjdBd*a2+;^*&YzmhxTSkdcRPoitOQF$20=PJ z>*F|{++0!2xOSXE0Ss7b7j`|QF;TP+-2jAVso;RIh)n_#M|PSCYJ+520*(u5RH(>s z*QcUxVwbZnAVK0sA<_*j z+gnWbin+6*8R$7?nEU5DLO$QpXu}948u1Ex2VDGAW3(~EyFW>RDY{&YYDqwtXHTJ6yI@s_*R=!gEl z!;tP4^4P7iTUZPYC0#qy9mY=c7E!6|71b)(q)xriC25tyR%_Z!UhWUhs)RMdRXG*zkIQ52wKAq8qk^^5nX#F2f~7KOSGKHQwa;ns_l{Hc#?uNF;X1J+B8YdX%Y`Y~XzAChO4 zLZJOk^i&v{{41JrAH{4GlL&GUHHxB=KV%5xzcwKFIcyOd#p1@?Kq|mfc^7ehRLn>;*!MXy=5J?3YEls5)nFgEEAB++=HeJsOylx+7d!lBV ztf+l==&y<+M4jm#{M!GF3y(tF;WDlfv6|8rHK_l(8YyDXZ7tcK+KoI6hol04bRbl^ z*Q=jS%%(CVJRY9V<-c<6&h)SK*f66o=-mhHrymJw(ggd4D+&r1xU0dMp6pRe+lQkl z)!xs!0*U&i`^2oJ2gJO(^Sox7b(!=jE8CK+(jFEb2r5lC4kuM>vSSbNYCgLYG=scb z8bhN*C2CF%@ApQ;=(!x@PvJg=--C?UTyjp~D8nCuOs-7U<)u+?)0^a;cGYX|Mh!Rv z*yZECYD_U7E~1hkj@y+FnK**C%;GfRNKh?#epIA^*4~T-yld+ zkN{$8Q3}U&B9LI4NZHdm~u)Gt`9`O{hC}a{9}rPeHMbBSCjAi4oT5#MF8!)iBw zbVH5iBLmqfTO+D^rv{-bs zl@JY?=mUGmCi4n66vSMgoDrSpd^(^^TV82*LX%DT4gZ-Iq{~GSd;1=yUY%Gm_Gj&` z9))o@8Xz&`I)cmh^g>PX+SV|+{uC51H26$DYY;*0dG3){P$5(HGmPZlU6XeYLt5^p zP&3@>daP7h`b}z)G|smxQ1>}Hsn5uZxqlfaE0SfL9|$s#Zfczp{VvR8hxQaHA(jbX zHg?dT=+@&8IeTN%h>)4b+P28RKD@J*1+4}hUmHQbTfb)dhgttj?mWrg9Wch{+mfmp zo*!CD$0RA{)Dny}O;d%2TZT&qAm~;;Y2z4?2l|Odbb@i5rKeoA=7*yXf5|5IuvGVK zz-h$XpTC;(^yCgV&`S>2FzZ@}5?0DeeL=!IV2_Ptb@tdGiTl^usd@UlzkO)EGnVLX z@l{VttDZN{ z&LH50*enmepw@1QY!!>ppOyW@z-`)Jkm!pH@yxRCA28kg`-@X7D19lA3OnkWdS{?a zLaT(th1SwFx{h748R&0Q@opR^4Wf%|`)v_0e4zR-C6_#U zLf14j;e+tf+lNbAu--59VRR$cpsrs9o@fj-sCoXw@&N6$xT4^7&nH1iaI7CvqJ7eP zlKK_#rg@yzowj9c(2p)6^SMK9+}_u(8%2fPEbe@;Bh!lcLcyvtj1qwI^nF=?*!FHDkog(~#@5Uj4P!)S!as((9BO)wL|hA-|RbaXzz6EkTe=hUY$NMD8F2Hv!CVy_Dm z{r;V1N6C`6i`@9(3~!}7cjPBSFoR6(+Vp<_5bY_+|z1Q=RBFbUG8FM`_fIr>RnLbGH>*A_|+@p=<;fYrD;qV^fXn`tRl(snI!zn zo}H#&MHEDpA4m+DPzH*D$k@$WZ^oBOXp6jLX@l(mupQF{U z<`lpTR;SRU)b$~t4sI}uk8nhkog}@f!(RR4Z_^qeIUBXjGP=c3^5mCaxD?K2BS`?H zl6|&MnqUBGUMpG23PwMg(35mCIp#f*JoowIa_S*Ekob_*$*5L<7NJu}OctSU9z6q5 zleT>Q0@slc+Hf|Uzx8b1g`6J?pKu8N1xDrd_q_OVQjTe*yys=vj-o;7)3KG`SD*dw z_R%Rr*M%ay0s})jK`}DB#9yDH`=~&KLCwO_2q(o@8jodRgS%DJ!nW^hIGC>XkZy@_ zno~cqc4uA}m@$GrVFn6oe_vbZY|!zVyNfTA!5*r_{K3KSZXcaY{c1VlJs)k9m0RoR zH<34ACd+(cfQ%E0igfHe9nE#%7jlQWOxK-PpfQUj=~Uo2rbBFZzklwT^P043$1A>b z-21d+dMSeC`{GM_lI*E-dJ<_o80DcbHq5{(64Ijza2uv<;86uLjSQTz6C4t<|kY~+Ih2% zfzf&0H`EH^0U=yi{gh!$b{>HatF3my56Gw9bA^BYg0^vg1>-7Yq@gH}GP32AVzR-@ zqnCc3Pm$&{rPla)(w-*$wEv&YhlaNp!84w^2xdfQ{rHz_p#Z6-0s=*D$2jyV4@w%s z&b&Bb2BFC+)@-Wxd^B!HouTnU0mR8<(mVaC_s%mx9vJ>r?+!?*ONnj$cRkA)X&PCK z*NCM|$tWPdvETN&D{ROMHt;vJJ7fa~C=Ja9p~HO}=AZ=uV{x$6Hl0P#Ez><=B+LIl zXSwSHvwzKU|C;6gHOu{LmiyN%_pe#*|7Dib1iU##pZS16Frfap0v)#5;@8{PjI1ZO zi?0udl?Q1euj{XiZ{?2gK*H9MfDOPlo7#a&6m zWAHl#qG8NWcT*W9&rb-PZWaihGnxF2Qfa%ihRGewY8CqS{&`J!K-< zh&oWZJdkjo{W#=*W^-tw>VGUOWt*S?x8;pD!QI`0H-z9pg1ZEF_W;42CP3qEjk~)OJh;0%1b26P^Ly?yckX>> zs%EC@TkG`Mr~mBgz4!U7byw65T~*i)4ImFkM0{~$_z3_5puqqbFaQ<|fCB^I!2kp> z;BOHT4EO*BAb|nMU;qjjfC>hnfdS}X00tO<2?k(+0oY&w4j6z72H=4K_+S757(fUH z5P<>2U;qgiKnezsfdS-T00kI82?kJs0n}gs4H!TR2GD^4AHe{6Fn|FJU<3o0zyM}2 zfTaPzYI*=#OWN*_WtjvmMe`fuu-w;MbS}r)vpedn6`XnSIQW0XRaX06BgF-58U677 z{1wI!w=84?hGnHT0~6a;-iX!?4vXohSohP^AGzQ>i=U z6Ejj_m_GQpfZOT?KeCUB$5||H4RpVJo62#I-1Ia-e`H+O%9KJKZ!rq4Grp`0qkYM? zSU+bz*fO4Y&g5IW{ZgvH`7scuefBZvp0f6~&C@6Fqzapyufj=E8gQN2+dItr=B*x~wk)C9 zmW37hg-fkGIhhRT!ySy8-7MncXuUNvI7I{~GV#7)y85WVq+XQAnvVy6lfPVW%y@GG z{gTIz!Lp8fn_|gX!pXCx!6Oq1Y)?<^!^`f0Ycg9RTxf!d`2N}Q;w%S0S67iIPZsJ# z)1Ro~D%0D9O8g27b7-YSioAM0=~Tyx%tW){tpg|RhO3H5mD{=`1g0O^0AZNf5o$>a z8L13FnI=Wgr~P!wRUS3Ya5(Y#OSM5P=+TGk1phJTrf3h|Pr=t^gY&S}5tojqs-Ydq zWdRZS4iXFHv1`-pn+>aC9C}$6se73L}0&l5yt2g|B& zuOj}N-{FnoG{gJR9#taoQKuOWe^AO($F{GzXRt93sA6c?Hgcn2K|qgMZJsy`QZ_LE zLpG?ZxWVtO$Cx;4dk1;kh=^{z*bwIQi@F`qRNwcNH~4IQ{QWtYv31a)!hv zA$pVjV`*fXaJW|$x^UVkPiUi9phLFqzQr#xP@m@4kMlf5*Fkw@eSV_`JfR-IL_L|O zV}FGS=m(#U(;aDp*0MBbE_oB3JtW&2D-IVpg-wtgvdKxXrQMb{rP|}y z@1b+DoKO|Po$j_v##13g1KE$o!A9pP` z$WpIF2@U&sAFUZpurv*5U)0gS4Svqmhch`fhTzEtU*SyZ!Afm)_*7ah#Lsxd#t3Pm z6~j-ovrV5FYW_UqaH!ELtvCqZzc>0f>HFea-F+qMS|owK_XYWWyw7-1w;V(Asoem( zLjU{;Y^fZodPd{vo$+Go{{-E?11;EZI_H1XcJc*=L<25EF`e?nJJ!xbK^3=I>g(b$ z9ln|R7qOj)s6p@%vgH*s9Iq&FM|kq=&i994xsoBS{`BQOu18qlaSq9ZQu-q!JqaB= z0(n4UxJ2{laXpA42QN{Cc@0{|h#;q73bEI4i;@<%t=EWDv}TO8v|vYl5`%^(xn|vY zdOu#1BQk^!__T{vf(zoHA+!!iPO(WjtXK$4Jg$e&_NM2_lbe~RQ=&TtF+nbHc0jt zBfSr?8BqY3NJC{J!?@al;KTyuP7&n}8Nn;6>kZuXHUV%#g})9T$y@W$wd=&Oz$!S4 z7ve$YB#O+U_?PZwY`4ZO16?)?2@KeTCjt(VMvJR?6bqHst@bhjFSJ2kkd z_)(<4ns?p=w$M!WlG_ok8`j&Gt+bKfHr<#*_L&)YJd8HEEHi}Kd0KObAw~P}n-cn= zrl$&Yw@3+C^7!`E^`^8soGKo#Z^({`|KosEiGBM46@)>wEh8IFTz{>-I;yKArnH2% zA_S{Thh3_-DKOu%Lsxbxa-QD(HLMhONH29j?VIw5WyxKRoVId5vhU>@tXlhw z*0+g2f||>&p_e_8M{YO7_gb@-w7*;qd}gUYaVhMl#>;*6$IsEdIP?Sfm4|6j2{+>Y zlpbWwH%@czXC5T@$J+{zb#xZ;{=kAr&tKr=z(ARk~G9|rd9iuIPK zkRt6oqn$$oVv}*v{?tiWY+fKLen$Jf|7+`A_3T7)t$VXnGaPv}8pK50Y4|z@ zTDOq^GJz^(2bJ-|9)s9cwG@x~fv&(?Cq0VD_NY)jqKJ0H5WP=NM36tZtSx;Tx;^$e zKG+)l9dDd$2OYm7(!NYBSQ?*I{Z{jcg8+SJ!*L!OLhPSfexq-dk)Qg#H?JOT`z&`x zY;Z68O>Ci#t&bTDwk{D%K0mt|`I78|wu%k_vS}fuUj#e0xB35yB%P?sCBKrji(}j^ z-)8@i>-+ST#e9gGg2Z0 z{_G{coBjLGJ(;0%VIsNf+8V9Dep~i~eg!yWhoW?LfP?FbVbvP2{7|S6$u3{gJUhPUvM>JH6 z1tT73gs+oR5)moxK(P^Z?(2Au&(XvBCsGx;IDRZ@kZ$!kvQa;C8 zP$LbT;VOCAaW@FCoZF&MzvT;?(~HhEtI8eYAcqE*0ipeG_o2FcYa8D&1VgekQT5K? z;iO^?b?pU21I-p9u>(Q+fu=1Lts#Y`9$xVpqpBUsg;(M%wtD!yh6=MoySJhr3j^c} zHaH!3Ghvb&H|zTbzJla9^vf70#;c&E8nTMSzb$*KpvPJhoaa81Td4(1iSk0#P5^Wy zpksyyS1s=Mwg(2^Nui`>W&-X>j#7bTS7vIBz2t|LFZu;2skxwPh5}4x75ojXCNy#* z76V75<+!I$7AchFPcsIcYSdx`u~57WDt+j&2w`4xJpIjxFQv2qN%h0Fxk03;CL*Da z@AIks(qQ@8X)il?UW5k6d_K-II4Nxm7&2@9>DX^t=H--HqP0P$sE@pyG>0kiDie+M zFfUjz=?IwCfR|4=B0oLgje>*a$P-12J)~oA8To(IyqN+jCkizh3LR2s>6UC1h$8}Q zqns|tnTbppJ0Uj0Ktj;HM>7|d%+%0?YtM0)TTAmO@u1Ku?Jr5q*O#UsbG;2m49Ekq zl)>}*_)J?Y>_*dN)si{y1<3+hNa=Yx@~q#`2t{CRtmu=3^Uny1n3h6pMpnc)!jy2) zpXto>6OoVR;{j{<*pM#0MPxotp)m*>L<=#+-d8fGzs}ObBTB5l>O&UQKjcz}q<&qXRT_XU& z(9mv89*96rMCj|LDh!||4D!qM(vYIeT0Y?GIwb0n^_x+ID9w)$IQtN|9mEh|1Ps1} zMPK8eWE4e8x&WX-y@?n{B93fw*vxpE;zFZxL=61eixeqJ@QNLnkfxd(UUa@+>^m#(wuUHR2=kHQw zL=j}e&@n!Oi=UAER3-KVTe-=FB;L-Ugj0PJ@%>Houg%mt%7>F4sMiuV$`Zb+;BXau z_BT8Fqw{Bei@JPQR^hA8H-kN9jzBfg({Yn^AR;vu#YeN!2g+$-hbp209{isM4Lh5I zj2TTtT3wgw+xt5k+A};Q)za#opot2Kfo%0C)uR3kC~0Jo-=br(eBT&HA~GF zDTRuHXat-bkCu|u{R~9>W++5X{jx;p*{Uc`E@BSz91%I~nQHaT0Ic&_C%F}M}(9IV?Y9oX-1{3bvg0n~;{MS#^P7d@j@$dz6g+;FbD4UOD7DiT&H1Q^* z1FtVz1sUyu-N?(?-*se3KA;6Rz3WQ4wLk_Q_QelR!{@xm;)A%S;o0Jkt_nZYsnbbb`Llb6t9w3fh9s!>UU>MHe?)|cclRN<%iPhVTDrd z1YfaO`)dUc8R}oCW6+A^d?#4^<(d6o>tSz&Y#mAX2UxO6Mr+!v#KBCt15yjaR(XR` z;d5rpCW19i-}z;T#z0Ys%Gx?q$G~cp^RVK9K+8M)3%`8NA z%(LiLClW+kotufY0r=unp!;tn64Lax@PE=+8x_9g#=7FR3kQVF;#}uz+-n!i9x7r6 z{874j^q$HBr2>zad+$DAS*0zh(mr{29E=t+YPFS2cbrkFc0&6@xIO{tH8=}_^qtWyNHW;fkscQ!fWjaBD(9cwF{dP}YORhXNH!i}R&hQF8uK=dSmhM=<%Sl)mnm7EOmxFj_~t!-G3 zE8#5KPB}=LM_iijXX`SZZ)IXdG)|uDnL1wgA5wOAi(HRcgO^BK<<;Q&maZDo;f5Gb z!&y6aI!ozNfQoUpage&+(vI*1Q7#=)$Du-liDSLpO-{*b;GsempRn+56|##oAqVDX zf<}zbx*(l2<+&*;4|v4Q#OM-UJw5JJ4iPspsgz~dPaI9(=;9_UWd9H|U@QM1H)F`7yHvaxq0dZ^zY;mS(oPn$UpZ}D12cMePIUqt}T?wM$T_GQLMGf6%_Pd~-1K~0f0%}`cfA1jW`lAYKIJKtcL2>95O{-7wxH^sW79&QJz ze&W@+_CG5^9GGPt>0(A<;%I2&+3J`}4UP{^-o zj%A*=emvc);~MAnsAHUX^TT)8VEtELWt_Q;!OBu6<&Xv%WQ{GiaY)u7E3@J0b3wf} z9p5~{F^x_P-IsQ`x2VyMGLqtr|w+Ghe^p zmZwoWkCvZOEMdBDuiZ}}MaYqA>R+i_^6ZINgv0F!Dl4+X4+Xd&Oh>GQDDYp>5}3Do zj><8Qq#;U2tOU>v5UV3rGUA8d@P?*&Ujy9G+c9=My9xDR3lv_;I1W+!~K~$rX)BVkJQ*j!5 zo)F*(s|E}!86@O{RU8KR0WxvIDgtcT7>L7DESyK> zo&KmNjcV+fa^+b@lU&Jh|KzE*2#%Ky|6|&em=SN1Kij1596ORgd7+@>FH(J$sXef% zDm6D7r!E${SwTSaM@QsaK2Bx9frJflo3Hp>*beL1He*S#S-tAB5?uxTHkjtUEfPz6 zx1e z>4|E}FY|kHbTR< zv4szS$xWS{9+V|`x3jV4k33EjMMf%CnqmOsm`XsS$JiZz%n!m&1P;Qh(Fy@Zx& z-<^1u2fUg=go-~v_0U;8LaDDAoiUwt+_iW2=d&+7XT6G397$Z5Y98KE1N-j(lAM+Y zJ;nw;-XTv?|83J&P~anVN!m>O{>O=gMrm~8wz@l`)1KwvhKW3P%r8$lo!j5DCRQHX zGX4(&`d`1}!(*@LC64&m7CzDX(00r(bRLF+^RqA55B)b!P;c9!-klO^G^t7#^R$c^ ziIX3tZ8=HMhUHKVU_!?1vbCZx@4@I(h4s8u%DYCZ8C-XOPo$Iy>~z+~OoSwzI#ZaM zr;T3JAF3omA)?$5A3xZ(#&Wc;sA@q$-syoPptQD}fA5{d7k~FonZ|$ZozfhscI#y1 zhNlv8pZ&ziL8{)lM)%Tm&TYGlmlBD7TsG5|%4lOOtzSVOYHR0JZalvY z@X$2UbhtZoizJyt^Rp-2fOReVWtLN){o>)F@$_LF0&z;*p!A+@c%f!#OS}N71ezpQ zu@SN02~_U?I@o#d{x9}Zk zG4?;c+8yiKC!-$S5Z2$bx3_~(2?DWUq;VnKg1{~4VF;lRP!c*AVk87)!0uv%V5b}4 z8qfI2!@3rIO=+8AX}V?v?!!QvG_9}z>tI2O{9OAlxY_m})J1s5f8$P>Y3Xd2oCL4Q}?c_C{J@#-HFqb;rJ!V*M>So2w);ug^MLUH9Jhn9O!!u>}_N+2DwW zmV?Es^F$vX3N|%Q;=^BiTLxILRJtVTJzbIW5fVU8TK^uUTA}7QCpjM~JXul@#X}NW zb{Y>~QMAU$ws+O1zn!Elc9()$3B_%%Zq0)h+uoGOhFIpDqX^VoqSDKcNoq=$$8lus zu5y#9TR-u`73+F&yJ?=&SolaW2sl~B@1#30?(RjZGVnBoI+^F-q;U`4``7e%0||L2 z@BL#%UxnE`tIrGaf}Y28X??F5v|r3Ci8@mX2BaAelWtFfq5}6h)y+U`O+?hD_2Ur4iq^e|{m2oQTs<%pZ+g-N{v6huc{$P>JK+82(=-wL|?q zZ;xBnFwaryf6r-E>yJ`bj!BwxZn2Jocjcn2ITq69AIdc3_7Lw1evLtfJ5dumSuO3Z zkT@CtPHGIFbytf1%b?cWD{-(az(*Esvj@vC!|gXZT9FaDbG;Pz&_6DQv${Yy(q}s_ zPm?u~l)fN0qOf+5fj9AQlAe zGY}ah1oyXkDJuMef$^`84sv8sLp|&sJaiM=U*PIZ5|_UM4@!78Q#tAYZ|O4%;|Y-{#gt&+mJ#V>WDm98SID@inBKV_VZQ>xTD&6ny zEXLNJaC7Enf3@5eY0V!_&(fLh_jG%Rbf09u#T>J>GvEoP8TkR*7!P7j!x(t}0KLKx zMK_?O?Nkv{B^nGn)a5Cb*6!v}Qs~)GDYJ4fB$c(}8)MDd8`tX2uRN`uKd03b^*`t) zjE`Aa3meo?8bbvER#}B^iCFwEFFQYPrSj1?@X5az=UMI?Q7noAyq7kQw4g@~&F*z! ztZdz&ND3k7=G<6k&De5!Z$C3gajNR_c`fv$ln)=QDa+}u1~z+Q zK4&eXG7wBZl>Q{Tv+BXN9ivar63SV6&Q-s8SaCMu>_M$zAa!M?Ux>|T8sH+{kg)oM zUc#`B$=*5~yINN2C1j@Nx|yg_74cIn`Mo}_li>mMuc_@w{8kSyIJo6}bo}F*a6X$|U!0IuU-jA^~>%pOT--KRZHX#1=1a4y?7NAtcLt8tcUP73QfN44jrL3JI3hA9sF zZMo(++U`SSM>3%sYs+C}GO7d);?b$VjYz`r2N%~5ek|0*DG29>Ek5~D`czaNOcj3s z<)8+cn$G_qk< z_N9LtPRPCcFf3kc=pUtK4RX&CMYapdlw-3}5+t|CO znkf@9^?hMH`@v*{9`vNzjXx5pnm1`m^*Mx35z?o~bAuBs*prRi2J_FUhtaU+2uJyL z!!Nw5{pZcy0puFnL<%PlNxrTVPYuI=jyi>-NQ_w2)~51XmpdHxLJ%XSs5I+LV}WX)w-{i1 zW4KxFm|3Em!qvM(!PPkF=adW~NV*J2Y}N7)KYXR!wKTv;?fw@(^zfz+N6-ZR!w-Z1 z@cwt=@jnWFGu)%Aizr4X@s($`TvaMUerAj>- za)Uj<1wvD1?iJDhY$Q(>@#U7{~vpoks8}&PCA9s(0`>(xas_^1Rm`cPK`1>F9*X5p5F7m!>ZojpD zi5;U_o7T#*<L$fWUy^d$-~Hen4}O|6|{-)SjSH zt=CDaSjqej`nX7Bkr|dVTiH=TJOs_IYiPL{hWAA}n&XF8sEd`?wp8pW6QPH&4hD{= zWfPe@+fOwEVWZWS5iiJ!;b834>2ag1fJX|e{nN6o;aRMO;6$eYO1>#JG*Bfu`*oxl z_e?d?>*lrbA_8UGOZLpHY_-AR#IcX`<8wM$gInqK47t!#=^0+EkoLgT%wrJd2HPJ< zCLNFgl0gS#{6~;LHvGEi=yYL>nJCBrDR@joHnH_(5FcrpWQBWVY|lAR7& z;*sk9I>GCbEZr@M z8sg?%V$bcgs#A?Pd#r=zMz=lSzw8}$Y-40We$oReAinfKJdh8M=6_jW!cFjc2bdoe zD*Jq6)2iz9S)XAXFm@))W7QeAlVMS;Om^8`BxJ|;QJx4%e_tQM?|HWsrzR034{R}a z{dW3M&$TTn`gtqA;Kx$#iX7KQ^w)}>E1`Zfd9{T&LbCc}#5}rqV3uH+LINJr&z3Vv zxDwELEk-ZbW;FX=`v>$0$N$~#BJ@9ZmlqyJp{U{LysPbE*i(up!w<6pGOE0@Pow9W z8gf7MI@)+6x&=j&JAbx~Zmh2kryu;_0fMjh5-i{o;=3Q6O6d<65+D*!PBw2rwQ+2q zPK`21KP(U(6jnDcprT$_E~iBvTzkfoVIuRXz)WT&A&KEMTEwb=k>bf{7bqhi_@N@u z=(`#WCKaO*;s_0a807~7bLUy4h-XYJBbWc6Xd6nES^p=BMr`{|>5b7T!0FtKk5TO- z2io^MCahI)UE^sGw9J`c;u2njGJ@T~M8!bvbiKZy&K$!FuP9pFGz8M#Q{us^M(!e>F~moBB;02%u4Hmit9 zB?nZYX&e#NNs3(Xw$h4(Nu=GSLa(9RxP*dW_J7S3obPKZL#m$mM~kZ%Irg7lwH7I)@%&&46eVSgl~TzAStiTIXO1a5zDYbh>zUCN^bU7^?RR`>X^S z+J4DKs&}&@J;DHgEiLwYLt>Pgb8~Dg5764Bg`=L!uuBk9!0}}8NORe@o3<-vD!B-3 ze933jl(kG*RYL31mfx*yqg=+PmTV`}z<6AoD9yo&sLaKa>a|V;I)RWtWNRfYl~cUm zpBj|rP*AT0FbIz&EmaaR=7o6gc$%}7KChs3HTtOF3#iV?l}~pZxSr{Bm3J*!$7&Xc zJFsZZoR+wla^?>v*I*C|wf0C==Hv zu0p%fda3larec{=_&aF1+(&w-7icV1@H6d1#7`ztc*;G#UQ^>6%lF2pFVXqEK6Wru zQFxyLNpEqmHbffh;HLKNt?r|b>{yC4Yt$dC2ET8WYT~2gHy#ET_iqU{%ZIO`s%=UC zWg1Da9K0m6SWsn%0v znXDE*cp~m0ikkl-S&iHL=qh0b4Ggch?Wv~h=p?7Lq+Dv&C!dJMRJyikOHxZ4R0li! z%;YNmQS->Px>BL^vmLj1)}e_s1e-TKv)R)WkUL&>6ilI@Zh87_%%5#>M7DV}CYmNY z9T`yo^2_;= z6yi>6`SPsZTCP_@Nt|{7297eB7?jDo+(Fh?edcGoU%p20J6>@fs}8DJ@wRv2qUy9G zbeRa#S+7@L{2q31Qt+qDMP|_gf&Hx~K4ER=`a_b4_x>O|;p=&q)@nD8rf@h7kKknc z8n=+Z1@G2u(4pJl1A(7tuPofjCqcpLc*GePSoozbL{gd$)ZhJ>B4R0r*}8+0dk~SZ zLrNl|CFQ2b_}Jl}wfb<-W0Av?qfO+t7K8l>1`x@q$f%36K$?CEM8-Xyiy^3I)U;gQ znth|$^!gxaeCg^BMjKo~O%J`;HWVtO=%~-HP-9n$$_vq zZr^`ciJi{g?-axVmfz@4{%hpb!a3zx(h;VxS@DRH$-ehWEQ_j$1t97KlR@bUctTw{ zm%v+qBF`|e8K__z5 znIGz~>G+LmvG=xljH2Y$#t*&!`0iPtD9>N9;_TH7eR1!5kC}jnOt1l2AnR;Ez~6U& zo!I=O)icolmc^EM6Wbrph<|AqQrW&Q;{qbLVb=;uWF7!B4JzxekH z<8DOVsdzzCzHVI?y5s&L#wXH`4X}x#I6cFZ{7vbbCosH*Sz05n$o&uagk281+-dz! z@abgbqK;jL_Luk@tj+|pZdfvvE3~4*%{IN007IamC7L=Ufog!i#2-fy_!9;sIn7k` zaYFH}WL8FdLA;~Ytn2SEgi=PR&Jn$jdy!o993|>4sJS2D^8YNiTZRIsxRg8Btb*r% zu34kBFv#mR`J3^c#qB!AJ)2LEd%wmAfzrgaOCn6r{u+`JdoGAsc(XVTES#Yxitv-K zFLSN6jSb0y>)>D~x~7&R$Wf;P<~Ae?G?vgYoSmDCZbavk1J z<$TK8^l(Ql!5H}+BO(|penS1p_jF&_hH1wvTRgnH{Thhbr=akBUX(9GgI;M;SSQ(Y zOaOF&H<#PR|6_has}DE`pjEo3SKd`R=IAuhWAAc#yxLY(k zsX(@Hff6wB4iE-BAOq-t_lGY@h&(J8>S6{R*U6&38wz7ib%g`9W?^nPjomm~x3=IC zPCc!FnWigZ+1t&6{Tw2u1dXtQb-*xsEZoT0w)% zKOB!7NWcBtsNlhn@gGKoNz9A97U|Bp9Ke5V_O$bkWftG5~%o8CP5vp!2%5OZ% z2L(H}^BJwutvQwX-Pp@l@uh|=IcAQcyl^(0i6d7*mIe_dx1PFRcT9xJf@IiQ!n7$c z%hWnX8D2b`i;h|(_NxyUMASGwkKPNLmXqhmtBGj7?<{Wb_=`+^=YU(elh?aZQsbzR zdCpyFwui4n09llY8zHa2Se3Z)!ot3Vt0m6CL-9?B11EB!iaCnPaEq= zH&ie2U44nex^Mm<#;-j|qWL6?R&J&1fxmti6^vX4%IcN+66+jIlTTR(E;H8qqPti~ zo=X(`yu-!f$gK+gC?BR<7R)b=o^)s=AYOCD-pC$d?o9>Cnp|X;s$>o|dmGMTM zLU=3-bg8XwOQnO`5AV60-QBmh^25GK1pZDv``f^pD}}<&56``$Ske%_s#0=)9<7{) z^YBx@%n~oZGH!HRR$j$#73x8;T~q^wRk)-NjQp#%>yy4ZacAV_H+%e>uZfy7WtQtz z`IrFmSuM2yR8FgSE`OXcmw2w`3$vx6cg^`lQpgjd3;T5r5+PFlB~z_>Bz z(t8dA%03E>OF%TOMCLSiA}P?_$Tid-$c%-)SlS0=evA%+^V)lcs}3((a>`ZY7U(gZ zh12f!-8EJ$-Ca`Sj=ptDEdA?K|F?n-%54)UG)y37^~l4+Zv`qjWE31z0JU=rO++;` zsFF=0h`tAr*cgqPUXG&hlOP$pxYt21&WQ!C$`>(KW@Eu9cCZOKk}(OjcZhpLw(pw} zG@n%n>ah_u*RSY=#S0@`j(}WuT0NRBx5g7rVx0oHpa?0AMDql;p{)lFv2X)q0W zV5b$FT}ymBIDU)NTLfQMlLvf=$z~t!0fD0o?PQ$coH_Dfv!f{p4c$xUsEn1%80PyM z6-I(7Sg|WS8MulcX_8pu3>kI&3zAUK=|js#%SMh;Wnf&yY<(8*37Q1G#SVCuvW^t( z4lmUw!$AJ##uF?xVa2=tGZ*_-uGm)IWo)!HQ6ao_?R-?IM2`cM2utw zJO}R8we9cn7CCf2a0(1_eVCrE+dACe*60oz=qW5>i?Zk&otUK>Y6*FG=#T%L?K7mO z_7VIG7tD=)e>g^9$lpm=)T;2KA4D)gIF7^RLu>-`0mnkQe%sU@`e(WAJ}=|X^>ejK zzD5Z$itnVJP(N-Dpa*9P@X}v7TSVoG#bm3<@}EZ#ch62V-LUVYFDMBtn$9WLqc(a( z^gt2yZlmmsx|PSUCzv^L-DW&O0d>!98F)vG27t%bzB$5+*6_E()smuZ0T3rQltojr zv;8@NTyZ>_;oaRo5u#?#aT+gVMAOsDEwUHv)k{cul&qw0I9D(OU}vywDC4g`>f9hG z4B6jQVo!WrSYe;|+L~jM?QPzGGUWP+lkF z3nH<|RYgB6_VzHjMkIn&^X6YxJcSRu37$y%qqb?MYw0eIR>|vM-zrH0f)0L&yrXxM zEbiwLSW_y06-BjV>W@EX**7%Q05s^Eib%JFefByaJ~tElEX<-$;UpNSgd z1;HQa_$Mm;1^ePR1c%z~##sq0>X4d<$KLUpQ+lh<{8VDngyQqcVWUhI3aEgh?qWW) zLynQKvVBMKMxS_%C24ffe4NIA=1X>g>Kiv2BR{PjnL zb93q~e{p!dAh@l9Lou?tBobGqvN6IuIZzVxW#GYk-Z2)cIdcGo_o`lChGnk7ltAxh z`Qla5qLjc6oU!_G@;IaVmg&pViC|I{ur}Lz3W=)M4Y)Ta*5f?WHC7+lNhqgzx2I5Y zRS6|XI?8fpP)n#~P=7q;lPoW7_9fsGLQr2&8 ze&`S<(_$vjnnS(i5vfKvYFmvJWmmsP@=n}^7tz}hr0iJ2wXoNO$p9=#iBI%+sD;qP7g9UanKu!r{R zX!kj1YE>w>TWGWDUtQC#%IdszGVMpM%j*7eJpPY0PFVaO|3W=TrW6qP59dPw{Wr+> z_Yp~au*ubre_-D=4?6UzW`XM@vL_?juR@@e3X$-h7A2IXj+7|gNX@Bk^c@NHyN+#@ zQ~r%yoC(xCgxkzTgX|Yiqwx}VoM^2*^)pwk{dV-u3c>O8qI}cfb?sS2J5y5Sc}}LJBk3(M zmVZsMmVDaZPpYq3C-tQ!bC&ZFb4pvmAEzApwCZcp&r-DWxksF`M5V&;dnJx*kGxY z6~*t#T!tyA*P2O#af;?FlbC`Whp7%k$v>-=Cz{-9*&sm^pwg9zrx2&8&n*4eX0i1olhj) zBbZ>F+?g~oktHfO>zCjv|D2~Ik_R;J&j`0`sj>*b3=Qz~`j=@-2wyF4b0_>w}A1g!1$kt}e^{bH>6HXCFqaYqqsqw_94Gqkt&fc)= zQ8`PGdz0%4xWy&C$V4^ICYJ#n!2>3hs?J*Jd^9S%nf7hQSaQyYjJn=FVRd>9UJ$U1 z{ctwypc{w)2ctw++YcW6R;mZ}9(ED;b|$8_2n+VFSTl{23Szn5m?7Pq@-zDA;QN1h z_$Cz`7c%|6m>l0cQl*^8c#S+F7$Pp_c+6=V8gN0RC%!QU=}*7we*1Tt5EWVkebc=| zY9%UpGOcu&;=*{wP0K~Y7-ogQ*!^qcRvOu42GXPYQ50T42W*|Cw_DVf@k1(>U&x-9 zPp^?&_y#=zJH<7A$6Y%F`%3|@*ViI6s29PFyA|1~NkM+ni9sOYDIr2|JzPN6`5~~5CK8#!8yAq|!5V;dp5)i2*0>cw2 zg&oVka)Perh<|f}+q-{rg6V%;^3bWenQp822gHGL=Z0SevU8B9R=XcXO0NPIu?Q2a zp>jX`-{l0Y=qgdwsDk2j3vFdf!X87=`a2VyQs%WH0zqF-9=>JB_c6ofC4P!iH{hCf zu6p8feHI;_>Y(@x4*v8z!s$v&84tBuU*@5L1kDEeP}Q3>>c}UuucM-CPYIXV?opkD z6vm|Qp21v5I=fNSuj9!UKCL60^R;zyKjz=jzeQ|=zq~KQvq37~vH{<^4E@Mx$UagA z$_eBn?X{ud{6^M$tfG%&(E zOr6WsKaN3c90RorZFe`5lHHt6W`zj@5nPnX0hoSd7KXFFx%PAj9BepK@4lE z*Fpc1{F^bG&2DYC{kI+4PWz$j#Y#bDn;eAO=ah@>evl)pb(;*~TWzQxgh6idZFd#P zt+Zd@$ydi+BFKSu^n^iT@hBL<}m1v zMmRya&1?E4IAR|%tO%4%QUbz*UQB`_7T!EslMk$v(@z?EoRD6rv{LZ(CR=#KqS0lX zN1jZX8iPKH{9w$trjZ5aiCw6pU|q6MGA#FWB;^vf10xrzinU``3p{jb6SM69ry;VW z^S>J+3rv!C<()h8HhxXyN-%X*h@R)+F_eNh`G42KGV}lTeMhVQ>F6DeexU=M(**Mc zEnbrZ#MbdTkWpySFlL=L$0Y>Vo;r|M;r!@(d(A@s!)f^vx1qHYUFg*)@L~mkiH`9D zTeC2V_PC|eUgl%hztV1>277_iEukHoBuUFs(uHV zF~eN!Bh3*LKj0xx5Rp6LhKf9Lb|*@JDPFfs!hDGxME1olBchrJu@A5+hvQL*9`g|V zdV6?%XN=Hz-M1hp(gft_7bAV6qC^+G-D3_9zkoP`$@6Lh+ z+bVp2<-j!L3l+G1Vm72zq9MCKrk`9#YME1HC(WUd;?C9#wUg+Q7UDz1RJ9 z&x2xA)`Vuq;z6dhEzRqHUIw&P-xoKSa@Ns)qT5FaV@bM6QJKbk8eP4lm{kjfGWW)& zfm&MwJc3HLOL`QWdpf@d3vHvl*OI+QK*x-ecU|vRS-X(z&-E!u3ehDz|s>W><1|WpIL>-1@NNGvL26BL>CQ`GtaL|axCLe$n-a$GOD2O%R4m5ILuQNZX3-1 E2d=R(!~g&Q diff --git a/rules/integrations/beaconing/command_and_control_beaconing.toml b/rules/integrations/beaconing/command_and_control_beaconing.toml new file mode 100644 index 000000000..ca323fbf0 --- /dev/null +++ b/rules/integrations/beaconing/command_and_control_beaconing.toml @@ -0,0 +1,59 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["beaconing"] +maturity = "production" +min_stack_comments = "Beaconing package updates and support" +min_stack_version = "8.10.1" +updated_date = "2023/10/26" + +[rule] +author = ["Elastic"] +description = """ +A statistical model has identified command-and-control (C2) beaconing activity. Beaconing can help attackers maintain +stealthy communication with their C2 servers, receive instructions and payloads, exfiltrate data and maintain +persistence in a network. +""" +from = "now-1h" +index = ["ml_beaconing.all"] +language = "kuery" +license = "Elastic License v2" +name = "Statistical Model Detected C2 Beaconing Activity" +note = """## Setup + +The Beaconing integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/beaconing", + "https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic" +] +risk_score = 21 +rule_id = "5397080f-34e5-449b-8e9c-4c8083d7ccc6" +severity = "low" +tags = ["Domain: Network", "Use Case: C2 Beaconing Detection", "Tactic: Command and Control"] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +beacon_stats.is_beaconing: true +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1102" +name = "Web Service" +reference = "https://attack.mitre.org/techniques/T1102/" +[[rule.threat.technique.subtechnique]] +id = "T1102.002" +name = "Bidirectional Communication" +reference = "https://attack.mitre.org/techniques/T1102/002/" + + + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + diff --git a/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml b/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml new file mode 100644 index 000000000..6897e064e --- /dev/null +++ b/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml @@ -0,0 +1,59 @@ +[metadata] +creation_date = "2023/09/22" +integration = ["beaconing"] +maturity = "production" +min_stack_comments = "Beaconing package updates and support" +min_stack_version = "8.10.1" +updated_date = "2023/10/26" + +[rule] +author = ["Elastic"] +description = """ +A statistical model has identified command-and-control (C2) beaconing activity with high confidence. Beaconing can help +attackers maintain stealthy communication with their C2 servers, receive instructions and payloads, exfiltrate data and +maintain persistence in a network. +""" +from = "now-1h" +index = ["ml_beaconing.all"] +language = "kuery" +license = "Elastic License v2" +name = "Statistical Model Detected C2 Beaconing Activity with High Confidence" +note = """## Setup + +The Beaconing integration must be enabled and related ML jobs configured for this rule to be effective. Please refer to this rule's references for more information. +""" +references = [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://docs.elastic.co/en/integrations/beaconing", + "https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic" +] +risk_score = 21 +rule_id = "0ab319ef-92b8-4c7f-989b-5de93c852e93" +severity = "low" +tags = ["Domain: Network", "Use Case: C2 Beaconing Detection", "Tactic: Command and Control"] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +beacon_stats.beaconing_score: 3 +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1102" +name = "Web Service" +reference = "https://attack.mitre.org/techniques/T1102/" +[[rule.threat.technique.subtechnique]] +id = "T1102.002" +name = "Bidirectional Communication" +reference = "https://attack.mitre.org/techniques/T1102/002/" + + + +[rule.threat.tactic] +id = "TA0011" +name = "Command and Control" +reference = "https://attack.mitre.org/tactics/TA0011/" + From 5c5d1b214bcda222a38199adfc21edcc6ae3c74b Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Mon, 30 Oct 2023 20:58:40 +0530 Subject: [PATCH 79/86] Setup information for Linux Rules - Set8 (#3200) --- ...mand_and_control_linux_kworker_netcon.toml | 30 ++++++++- ...work_activity_from_unknown_executable.toml | 66 ++++++++++++++++++- ...tential_linux_ssh_bruteforce_external.toml | 24 ++++++- ...tential_linux_ssh_bruteforce_internal.toml | 24 ++++++- ...ntial_successful_linux_ssh_bruteforce.toml | 35 +++++++++- .../linux/discovery_ping_sweep_detected.toml | 30 ++++++++- .../execution_interpreter_tty_upgrade.toml | 30 ++++++++- .../execution_nc_listener_via_rlwrap.toml | 30 ++++++++- ...xecution_potential_hack_tool_executed.toml | 30 ++++++++- ...lateral_movement_ssh_it_worm_download.toml | 30 ++++++++- .../persistence_linux_group_creation.toml | 25 ++++++- ...rsistence_linux_user_account_creation.toml | 25 ++++++- ...sistence_setuid_setgid_capability_set.toml | 30 ++++++++- ...uspicious_cap_setuid_python_execution.toml | 30 ++++++++- 14 files changed, 425 insertions(+), 14 deletions(-) diff --git a/rules/linux/command_and_control_linux_kworker_netcon.toml b/rules/linux/command_and_control_linux_kworker_netcon.toml index 75b821757..3275a312a 100644 --- a/rules/linux/command_and_control_linux_kworker_netcon.toml +++ b/rules/linux/command_and_control_linux_kworker_netcon.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/18" +updated_date = "2023/10/30" [rule] author = ["Elastic"] @@ -21,6 +21,34 @@ license = "Elastic License v2" name = "Network Activity Detected via Kworker" risk_score = 21 rule_id = "25d917c4-aa3c-4111-974c-286c0312ff95" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml b/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml index 03d592c7c..5a365395a 100644 --- a/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml +++ b/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/10/17" [rule] author = ["Elastic"] @@ -22,6 +22,70 @@ license = "Elastic License v2" name = "Suspicious Network Activity to the Internet by Previously Unknown Executable" risk_score = 21 rule_id = "53617418-17b4-4e9c-8a2c-8deb8086ca4b" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat +- Filebeat +- Packetbeat + + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + + +### Packetbeat Setup +Packetbeat is a real-time network packet analyzer that you can use for application monitoring, performance analytics, and threat detection. Packetbeat works by capturing the network traffic between your application servers, decoding the application layer protocols (HTTP, MySQL, Redis, and so on), correlating the requests with the responses, and recording the interesting fields for each transaction. + +#### The following steps should be executed in order to add the Packetbeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/setup-repositories.html). +- To run Packetbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/running-on-docker.html). +- For quick start information for Packetbeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html). + +""" severity = "low" tags = [ "Domain: Endpoint", diff --git a/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml b/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml index 5dda1e40a..dcb632944 100644 --- a/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml +++ b/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/25" +updated_date = "2023/10/17" [rule] author = ["Elastic"] @@ -59,6 +59,28 @@ In case this rule generates too much noise and external brute forcing is of not """ risk_score = 21 rule_id = "fa210b61-b627-4e5e-86f4-17e8270656ab" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Filebeat + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). + +""" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", diff --git a/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml b/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml index 22d42490d..1b942ca18 100644 --- a/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml +++ b/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/25" +updated_date = "2023/10/17" [rule] author = ["Elastic"] @@ -55,6 +55,28 @@ The rule identifies consecutive internal SSH login failures targeting a user acc """ risk_score = 47 rule_id = "1c27fa22-7727-4dd3-81c0-de6da5555feb" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Filebeat + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", diff --git a/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml index aba73a13e..3d086210c 100644 --- a/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/25" +updated_date = "2023/10/17" [rule] author = ["Elastic"] @@ -49,6 +49,39 @@ The rule identifies consecutive SSH login failures followed by a successful logi """ risk_score = 73 rule_id = "8cb84371-d053-4f4f-bce0-c74990e28f28" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Auditbeat +- Filebeat + +### Auditbeat Setup +Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. + +#### The following steps should be executed in order to add the Auditbeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). +- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). +- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). +- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). + +""" severity = "high" tags = [ "Domain: Endpoint", diff --git a/rules/linux/discovery_ping_sweep_detected.toml b/rules/linux/discovery_ping_sweep_detected.toml index 10131fed3..ed58852ee 100644 --- a/rules/linux/discovery_ping_sweep_detected.toml +++ b/rules/linux/discovery_ping_sweep_detected.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/04" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,6 +20,34 @@ license = "Elastic License v2" name = "Potential Network Scan Executed From Host" risk_score = 47 rule_id = "03c23d45-d3cb-4ad4-ab5d-b361ffe8724a" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/execution_interpreter_tty_upgrade.toml b/rules/linux/execution_interpreter_tty_upgrade.toml index bcee93b37..64c68f7bc 100644 --- a/rules/linux/execution_interpreter_tty_upgrade.toml +++ b/rules/linux/execution_interpreter_tty_upgrade.toml @@ -2,7 +2,7 @@ creation_date = "2023/09/20" integration = ["endpoint"] maturity = "production" -updated_date = "2023/09/20" +updated_date = "2023/10/19" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -20,6 +20,34 @@ license = "Elastic License v2" name = "Potential Upgrade of Non-interactive Shell" risk_score = 47 rule_id = "84d1f8db-207f-45ab-a578-921d91c23eb2" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "medium" timestamp_override = "event.ingested" tags = ["Domain: Endpoint", diff --git a/rules/linux/execution_nc_listener_via_rlwrap.toml b/rules/linux/execution_nc_listener_via_rlwrap.toml index b4ac27cb4..ed9ce7406 100644 --- a/rules/linux/execution_nc_listener_via_rlwrap.toml +++ b/rules/linux/execution_nc_listener_via_rlwrap.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/22" +updated_date = "2023/10/30" [rule] author = ["Elastic"] @@ -27,6 +27,34 @@ license = "Elastic License v2" name = "Netcat Listener Established via rlwrap" risk_score = 21 rule_id = "0f56369f-eb3d-459c-a00b-87c2bf7bdfc5" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", diff --git a/rules/linux/execution_potential_hack_tool_executed.toml b/rules/linux/execution_potential_hack_tool_executed.toml index d608ce135..db74f1391 100644 --- a/rules/linux/execution_potential_hack_tool_executed.toml +++ b/rules/linux/execution_potential_hack_tool_executed.toml @@ -2,7 +2,7 @@ creation_date = "2023/09/22" integration = ["endpoint"] maturity = "production" -updated_date = "2023/09/22" +updated_date = "2023/10/30" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -20,6 +20,34 @@ license = "Elastic License v2" name = "Potential Linux Hack Tool Launched" risk_score = 47 rule_id = "1df1152b-610a-4f48-9d7a-504f6ee5d9da" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "medium" timestamp_override = "event.ingested" tags = ["Domain: Endpoint", diff --git a/rules/linux/lateral_movement_ssh_it_worm_download.toml b/rules/linux/lateral_movement_ssh_it_worm_download.toml index 066a9ad71..823ec2e42 100644 --- a/rules/linux/lateral_movement_ssh_it_worm_download.toml +++ b/rules/linux/lateral_movement_ssh_it_worm_download.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/21" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -20,6 +20,34 @@ name = "Potential SSH-IT SSH Worm Downloaded" references = ["https://www.thc.org/ssh-it/"] risk_score = 47 rule_id = "2ddc468e-b39b-4f5b-9825-f3dcb0e998ea" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", diff --git a/rules/linux/persistence_linux_group_creation.toml b/rules/linux/persistence_linux_group_creation.toml index 7fff85068..4b4939ccc 100644 --- a/rules/linux/persistence_linux_group_creation.toml +++ b/rules/linux/persistence_linux_group_creation.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/20" +updated_date = "2023/10/17" [transform] [[transform.osquery]] @@ -79,9 +79,32 @@ This rule identifies the usages of `groupadd` and `addgroup` to create new group - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + """ risk_score = 21 rule_id = "a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Filebeat + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). + +""" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_linux_user_account_creation.toml b/rules/linux/persistence_linux_user_account_creation.toml index a7d8cfd05..281077914 100644 --- a/rules/linux/persistence_linux_user_account_creation.toml +++ b/rules/linux/persistence_linux_user_account_creation.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/20" +updated_date = "2023/10/17" [transform] [[transform.osquery]] @@ -78,9 +78,32 @@ This rule identifies the usage of `useradd` and `adduser` to create new accounts - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector. - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR). + """ risk_score = 21 rule_id = "edfd5ca9-9d6c-44d9-b615-1e56b920219c" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Filebeat + +### Filebeat Setup +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat on a Linux System: +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). + +""" severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Resources: Investigation Guide"] timestamp_override = "event.ingested" diff --git a/rules/linux/persistence_setuid_setgid_capability_set.toml b/rules/linux/persistence_setuid_setgid_capability_set.toml index 2ad182e1f..3a9e75547 100644 --- a/rules/linux/persistence_setuid_setgid_capability_set.toml +++ b/rules/linux/persistence_setuid_setgid_capability_set.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/05" +updated_date = "2023/10/13" [rule] author = ["Elastic"] @@ -21,6 +21,34 @@ license = "Elastic License v2" name = "Setcap setuid/setgid Capability Set" risk_score = 47 rule_id = "f5c005d3-4e17-48b0-9cd7-444d48857f97" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"] timestamp_override = "event.ingested" diff --git a/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml b/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml index 269e058a4..03f553313 100644 --- a/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml +++ b/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/09/05" +updated_date = "2023/10/19" [rule] author = ["Elastic"] @@ -22,6 +22,34 @@ license = "Elastic License v2" name = "Potential Privilege Escalation via Python cap_setuid" risk_score = 47 rule_id = "a0ddb77b-0318-41f0-91e4-8c1b5528834f" +setup = """ + +This rule requires data coming in from one of the following integrations: +- Elastic Defend + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows +the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + +""" severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"] type = "eql" From 57222571192cfb14bb5dd173fbfcff0e75a7c162 Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Mon, 30 Oct 2023 12:53:26 -0500 Subject: [PATCH 80/86] Pin python packages (#3249) --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 99ac81fac..20c10a6de 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -27,13 +27,13 @@ dependencies = [ "eql==0.9.18", "jsl==0.2.4", "jsonschema==3.2.0", - "marko", + "marko==2.0.1", "marshmallow-dataclass[union]~=8.5.12", "marshmallow-jsonschema~=0.12.0", "marshmallow-union~=0.1.15", "marshmallow~=3.13.0", "pywin32 ; platform_system=='Windows'", - "pytoml", + "pytoml==0.1.21", "PyYAML~=5.3 ; python_version<='3.9'", "PyYAML~=6.0.1 ; python_version>='3.10'", "requests~=2.27", From d0b02163625adb923e316acdb02fd894e8a7cd8c Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Tue, 31 Oct 2023 16:20:52 -0500 Subject: [PATCH 81/86] [FR] Support missing events (#3153) --- detection_rules/schemas/definitions.py | 1 + kql/evaluator.py | 5 +++-- kql/parser.py | 13 ++++++++++--- pyproject.toml | 2 +- 4 files changed, 15 insertions(+), 6 deletions(-) diff --git a/detection_rules/schemas/definitions.py b/detection_rules/schemas/definitions.py index 78a46053a..e4bf09efd 100644 --- a/detection_rules/schemas/definitions.py +++ b/detection_rules/schemas/definitions.py @@ -28,6 +28,7 @@ VERSION_PATTERN = f'^{_version}$' MINOR_SEMVER = r'^\d+\.\d+$' BRANCH_PATTERN = f'{VERSION_PATTERN}|^master$' ELASTICSEARCH_EQL_FEATURES = { + "allow_negation": (Version.parse('8.9.0'), None), "allow_runs": (Version.parse('7.16.0'), None), "allow_sample": (Version.parse('8.6.0'), None), "elasticsearch_validate_optional_fields": (Version.parse('7.16.0'), None) diff --git a/kql/evaluator.py b/kql/evaluator.py index 0a7eaa181..643381c4f 100644 --- a/kql/evaluator.py +++ b/kql/evaluator.py @@ -10,7 +10,7 @@ import eql.ast from eql import Walker, EqlCompileError, utils from eql.functions import CidrMatch from .errors import KqlRuntimeError, KqlCompileError - +from .parser import is_ipaddress class FilterGenerator(Walker): __cidr_cache = {} @@ -20,8 +20,9 @@ class FilterGenerator(Walker): @classmethod def equals(cls, term, value): + """Check if a term is equal to a value.""" if utils.is_string(term) and utils.is_string(value): - if CidrMatch.ip_compiled.match(term) and CidrMatch.cidr_compiled.match(value): + if is_ipaddress(term) and eql.utils.is_cidr_pattern(value): # check for an ipv4 cidr if value not in cls.__cidr_cache: cls.__cidr_cache[value] = CidrMatch.get_callback(None, eql.ast.String(value)) diff --git a/kql/parser.py b/kql/parser.py index b92863f73..e3017f2fc 100644 --- a/kql/parser.py +++ b/kql/parser.py @@ -40,6 +40,15 @@ with open(grammar_file, "rt") as f: lark_parser = Lark(grammar, propagate_positions=True, tree_class=KvTree, start=['query'], parser='lalr') +def is_ipaddress(value: str) -> bool: + """Check if a value is an ip address.""" + try: + eql.utils.get_ipaddress(value) + return True + except ValueError: + return False + + def wildcard2regex(wc: str) -> re.Pattern: parts = wc.split("*") return re.compile("^{regex}$".format(regex=".*?".join(re.escape(w) for w in parts))) @@ -85,8 +94,6 @@ def elasticsearch_type_family(mapping_type: str) -> str: class BaseKqlParser(Interpreter): NON_SPACE_WS = re.compile(r"[^\S ]+") - ip_regex = re.compile("^" + eql.functions.CidrMatch.ip_re + "(/([0-2]?[0-9]|3[0-2]))?$") - unquoted_escapes = {"\\t": "\t", "\\r": "\r", "\\n": "\n"} for special in "\\():<>\"*{}]": @@ -223,7 +230,7 @@ class BaseKqlParser(Interpreter): except ValueError: pass elif field_type_family == "ip" and value_type == "keyword": - if "::" in python_value or self.ip_regex.match(python_value) is not None: + if "::" in python_value or is_ipaddress(python_value) or eql.utils.is_cidr_pattern(python_value): return python_value elif field_type_family == 'date' and value_type in STRING_FIELDS: # this will not validate datemath syntax diff --git a/pyproject.toml b/pyproject.toml index 20c10a6de..8a5ad2dfe 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -24,7 +24,7 @@ classifiers = [ dependencies = [ "Click~=8.1.0", "elasticsearch~=8.1", - "eql==0.9.18", + "eql==0.9.19", "jsl==0.2.4", "jsonschema==3.2.0", "marko==2.0.1", From cdeb398ab39e96f28250055d9c16feb1639808fe Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Wed, 1 Nov 2023 12:47:40 -0400 Subject: [PATCH 82/86] [FR] Adjust Prebuilt Rules Packaging to Use Elastic Package v3 (#3252) * Adding support for elastic package version 3 * replaced OS with Pathlib where applicable * added sub-dataclasses for V3 * fixed flake errors * adjusted registry dataclasses to inherit base --- detection_rules/devtools.py | 19 ++++---- detection_rules/etc/packages.yml | 9 ++-- detection_rules/packaging.py | 11 ++++- detection_rules/schemas/registry_package.py | 50 +++++++++++++++++---- tests/test_packages.py | 18 +++++--- 5 files changed, 78 insertions(+), 29 deletions(-) diff --git a/detection_rules/devtools.py b/detection_rules/devtools.py index f32d6af8c..ba3f2c63c 100644 --- a/detection_rules/devtools.py +++ b/detection_rules/devtools.py @@ -205,7 +205,6 @@ def bump_versions(major_release: bool, minor_release: bool, patch_release: bool, pkg_data["name"] = f"{minor_bump.major}.{minor_bump.minor}" pkg_data["registry_data"]["conditions"]["kibana.version"] = f"^{pkg_kibana_ver.bump_minor()}" pkg_data["registry_data"]["version"] = str(pkg_ver.bump_minor().bump_prerelease("beta")) - pkg_data["registry_data"]["release"] = maturity if patch_release: latest_patch_release_ver = find_latest_integration_version("security_detection_engine", maturity, pkg_data["name"]) @@ -537,7 +536,7 @@ def kibana_pr(ctx: click.Context, label: Tuple[str, ...], assign: Tuple[str, ... @click.option("--token", required=True, prompt=get_github_token() is None, default=get_github_token(), help="GitHub token to use for the PR", hide_input=True) @click.option("--pkg-directory", "-d", help="Directory to save the package in cloned repository", - default=os.path.join("packages", "security_detection_engine")) + default=Path("packages", "security_detection_engine")) @click.option("--base-branch", "-b", help="Base branch in target repository", default="main") @click.option("--branch-name", "-n", help="New branch for the rules commit") @click.option("--github-repo", "-r", help="Repository to use for the branch", default="elastic/integrations") @@ -556,13 +555,13 @@ def integrations_pr(ctx: click.Context, local_repo: str, token: str, draft: bool repo = client.get_repo(github_repo) # Use elastic-package to format and lint - gopath = utils.gopath() + gopath = utils.gopath().strip("'\"") assert gopath is not None, "$GOPATH isn't set" err = 'elastic-package missing, run: go install github.com/elastic/elastic-package@latest and verify go bin path' assert subprocess.check_output(['elastic-package'], stderr=subprocess.DEVNULL), err - local_repo = os.path.abspath(local_repo) + local_repo = Path(local_repo).resolve() stack_version = Package.load_configs()["name"] package_version = Package.load_configs()["registry_data"]["version"] @@ -574,7 +573,7 @@ def integrations_pr(ctx: click.Context, local_repo: str, token: str, draft: bool click.echo(f"Run {click.style('python -m detection_rules dev build-release', bold=True)} to populate", err=True) ctx.exit(1) - if not Path(local_repo).exists(): + if not local_repo.exists(): click.secho(f"{github_repo} is not present at {local_repo}.", fg="red", err=True) ctx.exit(1) @@ -593,7 +592,7 @@ def integrations_pr(ctx: click.Context, local_repo: str, token: str, draft: bool git("checkout", "-b", branch_name) # Load the changelog in memory, before it's removed. Come back for it after the PR is created - target_directory = Path(local_repo) / pkg_directory + target_directory = local_repo / pkg_directory changelog_path = target_directory / "changelog.yml" changelog_entries: list = yaml.safe_load(changelog_path.read_text(encoding="utf-8")) @@ -624,13 +623,15 @@ def integrations_pr(ctx: click.Context, local_repo: str, token: str, draft: bool def elastic_pkg(*args): """Run a command with $GOPATH/bin/elastic-package in the package directory.""" - prev = os.path.abspath(os.getcwd()) + prev = Path.cwd() os.chdir(target_directory) try: - return subprocess.check_call([os.path.join(gopath, "bin", "elastic-package")] + list(args)) + elastic_pkg_cmd = [str(Path(gopath, "bin", "elastic-package"))] + elastic_pkg_cmd.extend(list(args)) + return subprocess.check_call(elastic_pkg_cmd) finally: - os.chdir(prev) + os.chdir(str(prev)) elastic_pkg("format") diff --git a/detection_rules/etc/packages.yml b/detection_rules/etc/packages.yml index 199a93a8e..c8050f5c0 100644 --- a/detection_rules/etc/packages.yml +++ b/detection_rules/etc/packages.yml @@ -10,17 +10,20 @@ package: - security conditions: kibana.version: ^8.12.0 + elastic: + subscription: basic description: Prebuilt detection rules for Elastic Security - format_version: 1.0.0 + format_version: 3.0.0 icons: - size: 16x16 src: /img/security-logo-color-64px.svg type: image/svg+xml - license: basic + source: + license: Elastic-2.0 name: security_detection_engine owner: github: elastic/protections - release: ga + type: elastic title: Prebuilt Security Detection Rules type: integration version: 8.12.0-beta.0 diff --git a/detection_rules/packaging.py b/detection_rules/packaging.py index 4423c63a2..6251c68b1 100644 --- a/detection_rules/packaging.py +++ b/detection_rules/packaging.py @@ -14,6 +14,7 @@ import textwrap from collections import defaultdict from pathlib import Path from typing import Dict, Optional, Tuple +from semver import Version import click import yaml @@ -377,9 +378,15 @@ class Package(object): def _generate_registry_package(self, save_dir): """Generate the artifact for the oob package-storage.""" - from .schemas.registry_package import RegistryPackageManifest + from .schemas.registry_package import (RegistryPackageManifestV1, + RegistryPackageManifestV3) - manifest = RegistryPackageManifest.from_dict(self.registry_data) + # 8.12.0+ we use elastic package v3 + stack_version = Version.parse(self.name, optional_minor_and_patch=True) + if stack_version >= Version.parse('8.12.0'): + manifest = RegistryPackageManifestV3.from_dict(self.registry_data) + else: + manifest = RegistryPackageManifestV1.from_dict(self.registry_data) package_dir = Path(save_dir) / 'fleet' / manifest.version docs_dir = package_dir / 'docs' diff --git a/detection_rules/schemas/registry_package.py b/detection_rules/schemas/registry_package.py index b94cf13c8..7c1719c40 100644 --- a/detection_rules/schemas/registry_package.py +++ b/detection_rules/schemas/registry_package.py @@ -5,7 +5,7 @@ """Definitions for packages destined for the registry.""" -from dataclasses import dataclass +from dataclasses import dataclass, field from typing import Dict, List, Optional from .definitions import ConditionSemVer, SemVer @@ -13,22 +13,54 @@ from ..mixins import MarshmallowDataclassMixin @dataclass -class RegistryPackageManifest(MarshmallowDataclassMixin): +class ConditionElastic: + subscription: str + + +@dataclass +class Condition: + kibana_version: str = field(metadata={"data_key": "kibana.version"}) + elastic: ConditionElastic + + +@dataclass +class Icon: + size: str + src: str + type: str + + +@dataclass +class RegistryPackageManifestBase(MarshmallowDataclassMixin): """Base class for registry packages.""" categories: List[str] - conditions: Dict[str, ConditionSemVer] description: str format_version: SemVer - icons: list - license: str + icons: List[Icon] name: str owner: Dict[str, str] - release: str title: str type: str version: SemVer - internal: Optional[bool] = None - policy_templates: Optional[list] = None - screenshots: Optional[list] = None + internal: Optional[bool] + policy_templates: Optional[List[str]] + screenshots: Optional[List[str]] + + +@dataclass +class RegistryPackageManifestV1(RegistryPackageManifestBase): + """Registry packages using elastic-package v1.""" + + conditions: Dict[str, ConditionSemVer] + license: str + release: str + + +@dataclass +class RegistryPackageManifestV3(RegistryPackageManifestBase): + """Registry packages using elastic-package v3.""" + + conditions: Condition + source: Dict[str, str] diff --git a/tests/test_packages.py b/tests/test_packages.py index 25ea95626..ca014cbee 100644 --- a/tests/test_packages.py +++ b/tests/test_packages.py @@ -6,10 +6,15 @@ """Test that the packages are built correctly.""" import unittest import uuid +from semver import Version +from marshmallow import ValidationError from detection_rules import rule_loader +from detection_rules.schemas.registry_package import (RegistryPackageManifestV1, + RegistryPackageManifestV3) from detection_rules.packaging import PACKAGE_FILE, Package from detection_rules.rule_loader import RuleCollection + from tests.base import BaseRuleTest package_configs = Package.load_configs() @@ -91,19 +96,20 @@ class TestRegistryPackage(unittest.TestCase): @classmethod def setUpClass(cls) -> None: - from detection_rules.schemas.registry_package import RegistryPackageManifest assert 'registry_data' in package_configs, f'Missing registry_data in {PACKAGE_FILE}' cls.registry_config = package_configs['registry_data'] - RegistryPackageManifest.from_dict(cls.registry_config) + stack_version = Version.parse(cls.registry_config['conditions']['kibana.version'].strip("^"), + optional_minor_and_patch=True) + if stack_version >= Version.parse("8.12.0"): + RegistryPackageManifestV3.from_dict(cls.registry_config) + else: + RegistryPackageManifestV1.from_dict(cls.registry_config) def test_registry_package_config(self): """Test that the registry package is validating properly.""" - from marshmallow import ValidationError - from detection_rules.schemas.registry_package import RegistryPackageManifest - registry_config = self.registry_config.copy() registry_config['version'] += '7.1.1.' with self.assertRaises(ValidationError): - RegistryPackageManifest.from_dict(registry_config) + RegistryPackageManifestV1.from_dict(registry_config) From 967f6a4c89761eb61ea4d33b3bf12b4b67a65db1 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Thu, 2 Nov 2023 09:32:38 +0100 Subject: [PATCH 83/86] [New BBR] Kernel Driver Load (#3236) * [New BBR] Kernel Driver Load * added event.dataset to the query --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> --- .../persistence_kernel_driver_load.toml | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100644 rules_building_block/persistence_kernel_driver_load.toml diff --git a/rules_building_block/persistence_kernel_driver_load.toml b/rules_building_block/persistence_kernel_driver_load.toml new file mode 100644 index 000000000..923153a86 --- /dev/null +++ b/rules_building_block/persistence_kernel_driver_load.toml @@ -0,0 +1,93 @@ +[metadata] +bypass_bbr_timing = true +creation_date = "2023/10/26" +integration = ["auditd_manager"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/26" + +[rule] +author = ["Elastic"] +building_block_type = "default" +description = """ +Detects the loading of a Linux kernel module through system calls. Threat actors may leverage Linux kernel modules to +load a rootkit on a system providing them with complete control and the ability to hide from security products. As other +rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap +that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. +""" +from = "now-9m" +index = ["auditbeat-*", "logs-auditd_manager.auditd-*"] +language = "eql" +license = "Elastic License v2" +name = "Kernel Driver Load" +risk_score = 21 +rule_id = "3e12a439-d002-4944-bc42-171c0dcb9b96" +setup = """## Setup +This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. + +``` +Kibana --> +Management --> +Integrations --> +Auditd Manager --> +Add Auditd Manager +``` + +`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. + +For this detection rule to trigger, the following additional audit rules are required to be added to the integration: +``` +-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules +-a always,exit -F arch=b32 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules +``` + +Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +""" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +driver where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and +event.action == "loaded-kernel-module" and auditd.data.syscall in ("init_module", "finit_module") +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1547" +name = "Boot or Logon Autostart Execution" +reference = "https://attack.mitre.org/techniques/T1547/" + +[[rule.threat.technique.subtechnique]] +id = "T1547.006" +name = "Kernel Modules and Extensions" +reference = "https://attack.mitre.org/techniques/T1547/006/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[[rule.threat.technique]] +name = "Rootkit" +id = "T1014" +reference = "https://attack.mitre.org/techniques/T1014/" + From dff4633dd44d68255369498cb51f56a949aff2dd Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Thu, 2 Nov 2023 09:40:50 +0100 Subject: [PATCH 84/86] [New BBR] Segfault Detected (#3240) * [New BBR] Segfault Detected * Update rules_building_block/execution_linux_segfault.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> * Update rules_building_block/execution_linux_segfault.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --------- Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> --- .../execution_linux_segfault.toml | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 rules_building_block/execution_linux_segfault.toml diff --git a/rules_building_block/execution_linux_segfault.toml b/rules_building_block/execution_linux_segfault.toml new file mode 100644 index 000000000..052ee0410 --- /dev/null +++ b/rules_building_block/execution_linux_segfault.toml @@ -0,0 +1,71 @@ +[metadata] +bypass_bbr_timing = true +creation_date = "2023/10/26" +integration = ["system"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/10/26" + +[rule] +author = ["Elastic"] +description = """ +Monitors kernel logs for segfault messages. A segfault, or segmentation fault, is an error that occurs when a program +tries to access a memory location that it's not allowed to access, typically leading to program termination. A segfault +can be an indication of malicious behavior if it results from attempts to exploit buffer overflows or other +vulnerabilities in software to execute arbitrary code or disrupt its normal operation. +""" +from = "now-9m" +index = ["logs-system.syslog-*"] +language = "kuery" +license = "Elastic License v2" +name = "Segfault Detected" +risk_score = 21 +rule_id = "5c81fc9d-1eae-437f-ba07-268472967013" +setup = """## Setup + +This rule requires data coming in from one of the following integrations: +- Filebeat + +### Filebeat Setup + +Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. + +#### The following steps should be executed in order to add the Filebeat for the Linux System: + +- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. +- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html). +- To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). +- To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). +- For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). +- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). + +#### Rule Specific Setup Note + +- This rule requires the Filebeat System Module to be enabled. +- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. +- To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). +""" +severity = "low" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Rule Type: BBR" + ] +timestamp_override = "event.ingested" +building_block_type = "default" +type = "query" +query = ''' +host.os.type:linux and event.dataset:"system.syslog" and process.name:kernel and message:segfault +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + From 829f5ea885192dce708a1abe58074136c15ebfde Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Thu, 2 Nov 2023 16:52:18 -0400 Subject: [PATCH 85/86] [Bug] Add Integration Schema Validation to `NewTermsRuleData.validate` Method (#3227) * adjusted validation method to include integration schema checks * fixed linting errors * re-factored NewTermsRuleData and added unit testing --- detection_rules/rule.py | 46 ------------------- tests/test_all_rules.py | 98 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 98 insertions(+), 46 deletions(-) diff --git a/detection_rules/rule.py b/detection_rules/rule.py index 6a8beae0d..f02254934 100644 --- a/detection_rules/rule.py +++ b/detection_rules/rule.py @@ -647,52 +647,6 @@ class NewTermsRuleData(QueryRuleData): type: Literal["new_terms"] new_terms: NewTermsMapping - def validate(self, meta: RuleMeta) -> None: - """Validates terms in new_terms_fields are valid ECS schema.""" - - kql_validator = KQLValidator(self.query) - kql_validator.validate(self, meta) - feature_min_stack = Version.parse('8.4.0') - feature_min_stack_extended_fields = Version.parse('8.6.0') - current_package_version = Version.parse(load_current_package_version(), optional_minor_and_patch=True) - - # validate history window start field exists and is correct - assert self.new_terms.history_window_start, \ - "new terms field found with no history_window_start field defined" - assert self.new_terms.history_window_start[0].field == "history_window_start", \ - f"{self.new_terms.history_window_start} should be 'history_window_start'" - - # validate new terms and history window start fields is correct - assert self.new_terms.field == "new_terms_fields", \ - f"{self.new_terms.field} should be 'new_terms_fields' for new_terms rule type" - - # ecs validation - min_stack_version = Version.parse(meta.get("min_stack_version")) if meta.get("min_stack_version") else None - min_stack_version = current_package_version if min_stack_version is None or min_stack_version < \ - current_package_version else min_stack_version - - assert min_stack_version >= feature_min_stack, \ - f"New Terms rule types only compatible with {feature_min_stack}+" - ecs_version = get_stack_schemas()[str(min_stack_version)]['ecs'] - beats_version = get_stack_schemas()[str(min_stack_version)]['beats'] - - # checks if new terms field(s) are in ecs, beats or non-ecs schemas - _, _, schema = kql_validator.get_beats_schema(self.index or [], beats_version, ecs_version) - - for new_terms_field in self.new_terms.value: - assert new_terms_field in schema.keys(), \ - f"{new_terms_field} not found in ECS, Beats, or non-ecs schemas" - - # validates length of new_terms to stack version - https://github.com/elastic/kibana/issues/142862 - if min_stack_version >= feature_min_stack and \ - min_stack_version < feature_min_stack_extended_fields: - assert len(self.new_terms.value) == 1, \ - f"new terms have a max limit of 1 for stack versions below {feature_min_stack_extended_fields}" - - # validate fields are unique - assert len(set(self.new_terms.value)) == len(self.new_terms.value), \ - f"new terms fields values are not unique - {self.new_terms.value}" - def transform(self, obj: dict) -> dict: """Transforms new terms data to API format for Kibana.""" diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py index 7a13f4cb8..d6f28d68e 100644 --- a/tests/test_all_rules.py +++ b/tests/test_all_rules.py @@ -1319,3 +1319,101 @@ class TestAlertSuppression(BaseRuleTest): if fld not in schema.keys(): self.fail(f"{self.rule_str(rule)} alert suppression field {fld} not \ found in ECS, Beats, or non-ecs schemas") + + +class TestNewTerms(BaseRuleTest): + """Test new term rules.""" + + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.4.0"), + "Test only applicable to 8.4+ stacks for new terms feature.") + def test_history_window_start(self): + """Test new terms history window start field.""" + + for rule in self.production_rules: + if rule.contents.data.type == "new_terms": + + # validate history window start field exists and is correct + assert rule.contents.data.new_terms.history_window_start, \ + "new terms field found with no history_window_start field defined" + assert rule.contents.data.new_terms.history_window_start[0].field == "history_window_start", \ + f"{rule.contents.data.new_terms.history_window_start} should be 'history_window_start'" + + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.4.0"), + "Test only applicable to 8.4+ stacks for new terms feature.") + def test_new_terms_field_exists(self): + # validate new terms and history window start fields are correct + for rule in self.production_rules: + if rule.contents.data.type == "new_terms": + assert rule.contents.data.new_terms.field == "new_terms_fields", \ + f"{rule.contents.data.new_terms.field} should be 'new_terms_fields' for new_terms rule type" + + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.4.0"), + "Test only applicable to 8.4+ stacks for new terms feature.") + def test_new_terms_fields(self): + """Test new terms fields are schema validated.""" + # ecs validation + for rule in self.production_rules: + if rule.contents.data.type == "new_terms": + meta = rule.contents.metadata + feature_min_stack = Version.parse('8.4.0') + current_package_version = Version.parse(load_current_package_version(), optional_minor_and_patch=True) + min_stack_version = Version.parse(meta.get("min_stack_version")) if \ + meta.get("min_stack_version") else None + min_stack_version = current_package_version if min_stack_version is None or min_stack_version < \ + current_package_version else min_stack_version + + assert min_stack_version >= feature_min_stack, \ + f"New Terms rule types only compatible with {feature_min_stack}+" + ecs_version = get_stack_schemas()[str(min_stack_version)]['ecs'] + beats_version = get_stack_schemas()[str(min_stack_version)]['beats'] + + # checks if new terms field(s) are in ecs, beats non-ecs or integration schemas + queryvalidator = QueryValidator(rule.contents.data.query) + _, _, schema = queryvalidator.get_beats_schema([], beats_version, ecs_version) + integration_manifests = load_integrations_manifests() + integration_schemas = load_integrations_schemas() + integration_tags = meta.get("integration") + if integration_tags: + for tag in integration_tags: + latest_tag_compat_ver, _ = find_latest_compatible_version( + package=tag, + integration="", + rule_stack_version=min_stack_version, + packages_manifest=integration_manifests) + if latest_tag_compat_ver: + integration_schema = integration_schemas[tag][latest_tag_compat_ver] + for policy_template in integration_schema.keys(): + schema.update(**integration_schemas[tag][latest_tag_compat_ver][policy_template]) + for new_terms_field in rule.contents.data.new_terms.value: + assert new_terms_field in schema.keys(), \ + f"{new_terms_field} not found in ECS, Beats, or non-ecs schemas" + + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.4.0"), + "Test only applicable to 8.4+ stacks for new terms feature.") + def test_new_terms_max_limit(self): + """Test new terms max limit.""" + # validates length of new_terms to stack version - https://github.com/elastic/kibana/issues/142862 + for rule in self.production_rules: + if rule.contents.data.type == "new_terms": + meta = rule.contents.metadata + feature_min_stack = Version.parse('8.4.0') + feature_min_stack_extended_fields = Version.parse('8.6.0') + current_package_version = Version.parse(load_current_package_version(), optional_minor_and_patch=True) + min_stack_version = Version.parse(meta.get("min_stack_version")) if \ + meta.get("min_stack_version") else None + min_stack_version = current_package_version if min_stack_version is None or min_stack_version < \ + current_package_version else min_stack_version + if min_stack_version >= feature_min_stack and \ + min_stack_version < feature_min_stack_extended_fields: + assert len(rule.contents.data.new_terms.value) == 1, \ + f"new terms have a max limit of 1 for stack versions below {feature_min_stack_extended_fields}" + + @unittest.skipIf(PACKAGE_STACK_VERSION < Version.parse("8.6.0"), + "Test only applicable to 8.4+ stacks for new terms feature.") + def test_new_terms_fields_unique(self): + """Test new terms fields are unique.""" + # validate fields are unique + for rule in self.production_rules: + if rule.contents.data.type == "new_terms": + assert len(set(rule.contents.data.new_terms.value)) == len(rule.contents.data.new_terms.value), \ + f"new terms fields values are not unique - {rule.contents.data.new_terms.value}" From d52546eee544b2921cc1df180e290f34931c3b51 Mon Sep 17 00:00:00 2001 From: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Date: Fri, 3 Nov 2023 19:05:29 +0530 Subject: [PATCH 86/86] Enhance Setup Guide information (#3256) --- ...mand_and_control_cat_network_activity.toml | 21 +++++----- ..._control_linux_chisel_client_activity.toml | 21 +++++----- ..._control_linux_chisel_server_activity.toml | 21 +++++----- ...mand_and_control_linux_kworker_netcon.toml | 3 +- ...linux_suspicious_proxychains_activity.toml | 21 +++++----- ...l_linux_tunneling_and_port_forwarding.toml | 21 +++++----- ...work_activity_from_unknown_executable.toml | 11 +++--- ...d_and_control_tunneling_via_earthworm.toml | 29 +++++++------- ...ial_access_collection_sensitive_files.toml | 25 ++++++------ .../credential_access_credential_dumping.toml | 21 +++++----- ...redential_access_gdb_init_memory_dump.toml | 21 +++++----- ...ential_linux_local_account_bruteforce.toml | 21 +++++----- ...tential_linux_ssh_bruteforce_external.toml | 9 ++--- ...tential_linux_ssh_bruteforce_internal.toml | 9 ++--- ...ntial_successful_linux_ftp_bruteforce.toml | 22 ++++++----- ...ntial_successful_linux_rdp_bruteforce.toml | 22 ++++++----- ...ntial_successful_linux_ssh_bruteforce.toml | 8 ++-- ...ential_access_proc_credential_dumping.toml | 21 +++++----- .../credential_access_ssh_backdoor_log.toml | 29 +++++++------- ...tempt_to_disable_iptables_or_firewall.toml | 21 +++++----- ...ion_attempt_to_disable_syslog_service.toml | 29 +++++++------- ..._base32_encoding_or_decoding_activity.toml | 29 +++++++------- ...binary_copied_to_suspicious_directory.toml | 21 +++++----- ...defense_evasion_chattr_immutable_file.toml | 29 +++++++------- ...ense_evasion_clear_kernel_ring_buffer.toml | 21 +++++----- ...ense_evasion_disable_apparmor_attempt.toml | 21 +++++----- ...fense_evasion_disable_selinux_attempt.toml | 29 +++++++------- ...asion_esxi_suspicious_timestomp_touch.toml | 21 +++++----- ...fense_evasion_file_deletion_via_shred.toml | 21 +++++----- ...defense_evasion_file_mod_writable_dir.toml | 29 +++++++------- .../defense_evasion_hidden_file_dir_tmp.toml | 29 +++++++------- .../defense_evasion_hidden_shared_object.toml | 29 +++++++------- ...defense_evasion_kernel_module_removal.toml | 21 +++++----- .../defense_evasion_log_files_deleted.toml | 29 +++++++------- .../defense_evasion_mount_execution.toml | 21 +++++----- ...ense_evasion_potential_proot_exploits.toml | 21 +++++----- .../defense_evasion_rename_esxi_files.toml | 21 +++++----- ...efense_evasion_rename_esxi_index_file.toml | 21 +++++----- .../discovery_esxi_software_via_find.toml | 21 +++++----- .../discovery_esxi_software_via_grep.toml | 21 +++++----- .../discovery_kernel_module_enumeration.toml | 21 +++++----- .../linux/discovery_linux_hping_activity.toml | 29 +++++++------- .../linux/discovery_linux_nping_activity.toml | 29 +++++++------- .../linux/discovery_ping_sweep_detected.toml | 3 +- ...very_pspy_process_monitoring_detected.toml | 16 ++++---- ...very_sudo_allowed_command_enumeration.toml | 21 +++++----- .../discovery_suid_sguid_enumeration.toml | 21 +++++----- ...overy_unusual_user_enumeration_via_id.toml | 21 +++++----- ...covery_virtual_machine_fingerprinting.toml | 29 +++++++------- ...tion_abnormal_process_id_file_created.toml | 21 +++++----- ...ion_curl_cve_2023_38545_heap_overflow.toml | 38 +++++++++---------- ...n_file_execution_followed_by_deletion.toml | 21 +++++----- ...er_or_listener_established_via_netcat.toml | 29 +++++++------- .../execution_interpreter_tty_upgrade.toml | 10 ++--- .../execution_nc_listener_via_rlwrap.toml | 3 +- ...cution_network_event_post_compilation.toml | 21 +++++----- rules/linux/execution_perl_tty_shell.toml | 29 +++++++------- ...xecution_potential_hack_tool_executed.toml | 3 +- ..._process_started_from_process_id_file.toml | 21 +++++----- ...ss_started_in_shared_memory_directory.toml | 21 +++++----- rules/linux/execution_python_tty_shell.toml | 21 +++++----- ..._remote_code_execution_via_postgresql.toml | 21 +++++----- .../execution_shell_evasion_linux_binary.toml | 34 ++++++++--------- ...uspicious_parent_child_revshell_linux.toml | 22 +++++------ ...xecution_shell_via_background_process.toml | 21 +++++----- ...ecution_shell_via_java_revshell_linux.toml | 21 +++++----- ...on_shell_via_lolbin_interpreter_linux.toml | 21 +++++----- ...execution_shell_via_meterpreter_linux.toml | 22 ++++++----- ...execution_shell_via_suspicious_binary.toml | 21 +++++----- ...ution_shell_via_tcp_cli_utility_linux.toml | 21 +++++----- ...ution_shell_via_udp_cli_utility_linux.toml | 22 ++++++----- ...traction_or_decrompression_via_funzip.toml | 21 +++++----- ...us_executable_running_system_commands.toml | 22 +++++------ ...icious_mining_process_creation_events.toml | 21 +++++----- rules/linux/execution_tc_bpf_filter.toml | 21 +++++----- .../impact_data_encrypted_via_openssl.toml | 21 +++++----- rules/linux/impact_esxi_process_kill.toml | 21 +++++----- ...tial_linux_ransomware_file_encryption.toml | 21 +++++----- ...ential_linux_ransomware_note_detected.toml | 21 +++++----- .../linux/impact_process_kill_threshold.toml | 21 +++++----- ...lateral_movement_ssh_it_worm_download.toml | 3 +- ...ment_telnet_network_activity_external.toml | 29 +++++++------- ...ment_telnet_network_activity_internal.toml | 29 +++++++------- .../persistence_chkconfig_service_add.toml | 21 +++++----- ...credential_access_modify_ssh_binaries.toml | 29 +++++++------- .../linux/persistence_cron_job_creation.toml | 21 +++++----- .../persistence_dynamic_linker_backup.toml | 21 +++++----- .../linux/persistence_etc_file_creation.toml | 21 +++++----- .../persistence_init_d_file_creation.toml | 21 +++++----- ...persistence_insmod_kernel_module_load.toml | 21 +++++----- ...ersistence_kde_autostart_modification.toml | 29 +++++++------- ...sistence_linux_backdoor_user_creation.toml | 21 +++++----- .../persistence_linux_group_creation.toml | 9 ++--- ...e_linux_shell_activity_via_web_server.toml | 21 +++++----- ...rsistence_linux_user_account_creation.toml | 9 ++--- ..._linux_user_added_to_privileged_group.toml | 21 +++++----- ...rsistence_message_of_the_day_creation.toml | 21 +++++----- ...sistence_message_of_the_day_execution.toml | 21 +++++----- .../linux/persistence_rc_script_creation.toml | 21 +++++----- ...sistence_setuid_setgid_capability_set.toml | 10 ++--- .../persistence_shared_object_creation.toml | 21 +++++----- ...tence_systemd_scheduled_timer_created.toml | 21 +++++----- .../persistence_systemd_service_creation.toml | 21 +++++----- ...on_chown_chmod_unauthorized_file_read.toml | 21 +++++----- ...ation_container_util_misconfiguration.toml | 34 ++++++++--------- ...lation_ld_preload_shared_object_modif.toml | 29 +++++++------- ...lation_linux_suspicious_symbolic_link.toml | 21 +++++----- ...lege_escalation_linux_uid_int_max_bug.toml | 21 +++++----- ...n_load_and_unload_of_kernel_via_kexec.toml | 21 +++++----- ...alation_looney_tunables_cve_2023_4911.toml | 38 +++++++++---------- ...ge_escalation_overlayfs_local_privesc.toml | 21 +++++----- ...vilege_escalation_pkexec_envar_hijack.toml | 21 +++++----- ...lation_potential_wildcard_shell_spawn.toml | 21 +++++----- ...ge_escalation_sda_disk_mount_non_root.toml | 21 +++++----- ...privilege_escalation_shadow_file_read.toml | 21 +++++----- ...vilege_escalation_sudo_cve_2019_14287.toml | 21 +++++----- .../privilege_escalation_sudo_hijacking.toml | 21 +++++----- ...tion_sudo_token_via_process_injection.toml | 21 +++++----- ...uspicious_cap_setuid_python_execution.toml | 3 +- ...scalation_uid_change_post_compilation.toml | 21 +++++----- ...lation_unshare_namespace_manipulation.toml | 29 +++++++------- ...ege_escalation_writable_docker_socket.toml | 21 +++++----- 122 files changed, 1264 insertions(+), 1330 deletions(-) diff --git a/rules/linux/command_and_control_cat_network_activity.toml b/rules/linux/command_and_control_cat_network_activity.toml index dae299664..d576b75ea 100644 --- a/rules/linux/command_and_control_cat_network_activity.toml +++ b/rules/linux/command_and_control_cat_network_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,25 +26,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/command_and_control_linux_chisel_client_activity.toml b/rules/linux/command_and_control_linux_chisel_client_activity.toml index 504dcfd26..141d91071 100644 --- a/rules/linux/command_and_control_linux_chisel_client_activity.toml +++ b/rules/linux/command_and_control_linux_chisel_client_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -31,25 +31,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/command_and_control_linux_chisel_server_activity.toml b/rules/linux/command_and_control_linux_chisel_server_activity.toml index 4f35798d8..e979d04e4 100644 --- a/rules/linux/command_and_control_linux_chisel_server_activity.toml +++ b/rules/linux/command_and_control_linux_chisel_server_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -31,25 +31,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/command_and_control_linux_kworker_netcon.toml b/rules/linux/command_and_control_linux_kworker_netcon.toml index 3275a312a..fe416ebb3 100644 --- a/rules/linux/command_and_control_linux_kworker_netcon.toml +++ b/rules/linux/command_and_control_linux_kworker_netcon.toml @@ -23,8 +23,7 @@ risk_score = 21 rule_id = "25d917c4-aa3c-4111-974c-286c0312ff95" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows diff --git a/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml b/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml index f7686c53c..1a731d9f0 100644 --- a/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml +++ b/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml index b70caa291..14b75139e 100644 --- a/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml +++ b/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml b/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml index 5a365395a..8e017be62 100644 --- a/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml +++ b/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/17" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -61,7 +61,7 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -72,18 +72,17 @@ Filebeat is a lightweight shipper for forwarding and centralizing log data. Inst - To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). - To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). - For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). - +- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). ### Packetbeat Setup Packetbeat is a real-time network packet analyzer that you can use for application monitoring, performance analytics, and threat detection. Packetbeat works by capturing the network traffic between your application servers, decoding the application layer protocols (HTTP, MySQL, Redis, and so on), correlating the requests with the responses, and recording the interesting fields for each transaction. -#### The following steps should be executed in order to add the Packetbeat on a Linux System: +#### The following steps should be executed in order to add the Packetbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/setup-repositories.html). - To run Packetbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/running-on-docker.html). - For quick start information for Packetbeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Packetbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html). """ severity = "low" diff --git a/rules/linux/command_and_control_tunneling_via_earthworm.toml b/rules/linux/command_and_control_tunneling_via_earthworm.toml index 5d905a853..9c1439397 100644 --- a/rules/linux/command_and_control_tunneling_via_earthworm.toml +++ b/rules/linux/command_and_control_tunneling_via_earthworm.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,39 +26,40 @@ risk_score = 47 rule_id = "9f1c4ca3-44b5-481d-ba42-32dc215a2769" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/credential_access_collection_sensitive_files.toml b/rules/linux/credential_access_collection_sensitive_files.toml index 9a30bc6cd..81931d4f5 100644 --- a/rules/linux/credential_access_collection_sensitive_files.toml +++ b/rules/linux/credential_access_collection_sensitive_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/23" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,7 +24,10 @@ risk_score = 47 rule_id = "6b84d470-9036-4cc0-a27c-6d90bbfe81ab" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat + ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows @@ -35,28 +38,28 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/credential_access_credential_dumping.toml b/rules/linux/credential_access_credential_dumping.toml index 074fac608..412374a82 100644 --- a/rules/linux/credential_access_credential_dumping.toml +++ b/rules/linux/credential_access_credential_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -31,25 +31,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/credential_access_gdb_init_memory_dump.toml b/rules/linux/credential_access_gdb_init_memory_dump.toml index b912d96d8..e0cec14d8 100644 --- a/rules/linux/credential_access_gdb_init_memory_dump.toml +++ b/rules/linux/credential_access_gdb_init_memory_dump.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml b/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml index 1c5d941ef..be4c0071c 100644 --- a/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml +++ b/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml b/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml index dcb632944..97cf8340b 100644 --- a/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml +++ b/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/17" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -61,8 +61,7 @@ risk_score = 21 rule_id = "fa210b61-b627-4e5e-86f4-17e8270656ab" setup = """ -This rule requires data coming in from one of the following integrations: -- Filebeat +This rule requires data coming in from Filebeat. ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -73,10 +72,10 @@ Filebeat is a lightweight shipper for forwarding and centralizing log data. Inst - To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). - To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). - For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). +- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). #### Rule Specific Setup Note -- This rule requires the Filebeat System Module to be enabled. +- This rule requires the “Filebeat System Module” to be enabled. - The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. - To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). diff --git a/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml b/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml index 1b942ca18..bacd6e116 100644 --- a/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml +++ b/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/17" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -57,8 +57,7 @@ risk_score = 47 rule_id = "1c27fa22-7727-4dd3-81c0-de6da5555feb" setup = """ -This rule requires data coming in from one of the following integrations: -- Filebeat +This rule requires data coming in from Filebeat. ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -69,10 +68,10 @@ Filebeat is a lightweight shipper for forwarding and centralizing log data. Inst - To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). - To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). - For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). +- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). #### Rule Specific Setup Note -- This rule requires the Filebeat System Module to be enabled. +- This rule requires the “Filebeat System Module” to be enabled. - The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. - To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). diff --git a/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml index c9593d0bd..fcba9634c 100644 --- a/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_ftp_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,31 +25,33 @@ risk_score = 47 rule_id = "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d" setup = """ -This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. +This rule requires data coming in from one of the following integrations: +- Auditbeat +- Auditd Manager ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). ### Auditd Manager Integration Setup The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. #### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Auditd Manager and select the integration to see more details about it. -- Click Add Auditd Manager. +- Go to the Kibana home page and click “Add integrations”. +- In the query bar, search for “Auditd Manager” and select the integration to see more details about it. +- Click “Add Auditd Manager”. - Configure the integration name and optionally add a description. - Review optional and advanced settings accordingly. -- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. -- Click Save and Continue. -- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). +- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click “Save and Continue”. +- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). #### Rule Specific Setup Note Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. diff --git a/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml index 7b22d29c1..297d5b761 100644 --- a/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_rdp_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,31 +25,33 @@ risk_score = 47 rule_id = "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0" setup = """ -This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. +This rule requires data coming in from one of the following integrations: +- Auditbeat +- Auditd Manager ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). ### Auditd Manager Integration Setup The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. #### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Auditd Manager and select the integration to see more details about it. -- Click Add Auditd Manager. +- Go to the Kibana home page and click “Add integrations”. +- In the query bar, search for “Auditd Manager” and select the integration to see more details about it. +- Click “Add Auditd Manager”. - Configure the integration name and optionally add a description. - Review optional and advanced settings accordingly. -- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. -- Click Save and Continue. -- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). +- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click “Save and Continue”. +- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). #### Rule Specific Setup Note Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. diff --git a/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml b/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml index 3d086210c..54d58ed62 100644 --- a/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml +++ b/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/17" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -63,7 +63,7 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -74,10 +74,10 @@ Filebeat is a lightweight shipper for forwarding and centralizing log data. Inst - To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). - To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). - For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). +- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). #### Rule Specific Setup Note -- This rule requires the Filebeat System Module to be enabled. +- This rule requires the “Filebeat System Module” to be enabled. - The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. - To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). diff --git a/rules/linux/credential_access_proc_credential_dumping.toml b/rules/linux/credential_access_proc_credential_dumping.toml index 33c1f08b7..e5e2399e4 100644 --- a/rules/linux/credential_access_proc_credential_dumping.toml +++ b/rules/linux/credential_access_proc_credential_dumping.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -30,25 +30,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/credential_access_ssh_backdoor_log.toml b/rules/linux/credential_access_ssh_backdoor_log.toml index a853ae8fc..c7d883179 100644 --- a/rules/linux/credential_access_ssh_backdoor_log.toml +++ b/rules/linux/credential_access_ssh_backdoor_log.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/19" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,39 +27,40 @@ risk_score = 73 rule_id = "f28e2be4-6eca-4349-bdd9-381573730c22" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml index a12712aae..d9fafe68a 100644 --- a/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml +++ b/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,25 +24,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml b/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml index 5e04ea59b..644ed904f 100644 --- a/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml +++ b/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -21,39 +21,40 @@ risk_score = 47 rule_id = "2f8a1226-5720-437d-9c20-e0029deb6194" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml b/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml index 36665e37c..93bcb474a 100644 --- a/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml +++ b/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,39 +24,40 @@ risk_score = 21 rule_id = "debff20a-46bc-4a4d-bae5-5cdd14222795" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "low" diff --git a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml index a092ad3ad..f25bd9e60 100644 --- a/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml +++ b/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_chattr_immutable_file.toml b/rules/linux/defense_evasion_chattr_immutable_file.toml index 566cd4acc..f0ec2bf0e 100644 --- a/rules/linux/defense_evasion_chattr_immutable_file.toml +++ b/rules/linux/defense_evasion_chattr_immutable_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,39 +24,40 @@ risk_score = 47 rule_id = "968ccab9-da51-4a87-9ce2-d3c9782fd759" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml b/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml index c6c03b022..f0e6bf8aa 100644 --- a/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml +++ b/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/24" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,25 +24,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_disable_apparmor_attempt.toml b/rules/linux/defense_evasion_disable_apparmor_attempt.toml index 6b060383b..1a7896e5d 100644 --- a/rules/linux/defense_evasion_disable_apparmor_attempt.toml +++ b/rules/linux/defense_evasion_disable_apparmor_attempt.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_disable_selinux_attempt.toml b/rules/linux/defense_evasion_disable_selinux_attempt.toml index 841ca4f4a..a7d4c9760 100644 --- a/rules/linux/defense_evasion_disable_selinux_attempt.toml +++ b/rules/linux/defense_evasion_disable_selinux_attempt.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -22,39 +22,40 @@ risk_score = 47 rule_id = "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml b/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml index f155f0983..bdd999459 100644 --- a/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml +++ b/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -30,25 +30,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_file_deletion_via_shred.toml b/rules/linux/defense_evasion_file_deletion_via_shred.toml index 828fc9709..09ea2aa8f 100644 --- a/rules/linux/defense_evasion_file_deletion_via_shred.toml +++ b/rules/linux/defense_evasion_file_deletion_via_shred.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_file_mod_writable_dir.toml b/rules/linux/defense_evasion_file_mod_writable_dir.toml index 1f7d0900f..98fcc694e 100644 --- a/rules/linux/defense_evasion_file_mod_writable_dir.toml +++ b/rules/linux/defense_evasion_file_mod_writable_dir.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,39 +27,40 @@ risk_score = 21 rule_id = "9f9a2a82-93a8-4b1a-8778-1780895626d4" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "low" diff --git a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml index 4bc87d73a..4422a4d67 100644 --- a/rules/linux/defense_evasion_hidden_file_dir_tmp.toml +++ b/rules/linux/defense_evasion_hidden_file_dir_tmp.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,39 +29,40 @@ risk_score = 47 rule_id = "b9666521-4742-49ce-9ddc-b8e84c35acae" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/defense_evasion_hidden_shared_object.toml b/rules/linux/defense_evasion_hidden_shared_object.toml index 9f0fdc4ce..248b097fb 100644 --- a/rules/linux/defense_evasion_hidden_shared_object.toml +++ b/rules/linux/defense_evasion_hidden_shared_object.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -23,39 +23,40 @@ risk_score = 47 rule_id = "766d3f91-3f12-448c-b65f-20123e9e9e8c" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/defense_evasion_kernel_module_removal.toml b/rules/linux/defense_evasion_kernel_module_removal.toml index 249580820..08f152fb3 100644 --- a/rules/linux/defense_evasion_kernel_module_removal.toml +++ b/rules/linux/defense_evasion_kernel_module_removal.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -32,25 +32,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_log_files_deleted.toml b/rules/linux/defense_evasion_log_files_deleted.toml index e8bd27f95..66aeee81a 100644 --- a/rules/linux/defense_evasion_log_files_deleted.toml +++ b/rules/linux/defense_evasion_log_files_deleted.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,39 +24,40 @@ risk_score = 47 rule_id = "aa895aea-b69c-4411-b110-8d7599634b30" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/defense_evasion_mount_execution.toml b/rules/linux/defense_evasion_mount_execution.toml index 31af2971b..78ac321cb 100644 --- a/rules/linux/defense_evasion_mount_execution.toml +++ b/rules/linux/defense_evasion_mount_execution.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -32,25 +32,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_potential_proot_exploits.toml b/rules/linux/defense_evasion_potential_proot_exploits.toml index a9f3c1055..426f6a76f 100644 --- a/rules/linux/defense_evasion_potential_proot_exploits.toml +++ b/rules/linux/defense_evasion_potential_proot_exploits.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -35,25 +35,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_rename_esxi_files.toml b/rules/linux/defense_evasion_rename_esxi_files.toml index 4929de649..3e92debd9 100644 --- a/rules/linux/defense_evasion_rename_esxi_files.toml +++ b/rules/linux/defense_evasion_rename_esxi_files.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/defense_evasion_rename_esxi_index_file.toml b/rules/linux/defense_evasion_rename_esxi_index_file.toml index a010bad46..bf24c7683 100644 --- a/rules/linux/defense_evasion_rename_esxi_index_file.toml +++ b/rules/linux/defense_evasion_rename_esxi_index_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_esxi_software_via_find.toml b/rules/linux/discovery_esxi_software_via_find.toml index 8e1676fe5..7257d2f97 100644 --- a/rules/linux/discovery_esxi_software_via_find.toml +++ b/rules/linux/discovery_esxi_software_via_find.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -30,25 +30,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_esxi_software_via_grep.toml b/rules/linux/discovery_esxi_software_via_grep.toml index 3cbc07a56..780bf18a0 100644 --- a/rules/linux/discovery_esxi_software_via_grep.toml +++ b/rules/linux/discovery_esxi_software_via_grep.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_kernel_module_enumeration.toml b/rules/linux/discovery_kernel_module_enumeration.toml index 0dbf80516..334bc4366 100644 --- a/rules/linux/discovery_kernel_module_enumeration.toml +++ b/rules/linux/discovery_kernel_module_enumeration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -31,25 +31,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_linux_hping_activity.toml b/rules/linux/discovery_linux_hping_activity.toml index fa4fa6f15..05b256ac9 100644 --- a/rules/linux/discovery_linux_hping_activity.toml +++ b/rules/linux/discovery_linux_hping_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,39 +28,40 @@ risk_score = 47 rule_id = "90169566-2260-4824-b8e4-8615c3b4ed52" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/discovery_linux_nping_activity.toml b/rules/linux/discovery_linux_nping_activity.toml index b006ad4ee..1242b8c6d 100644 --- a/rules/linux/discovery_linux_nping_activity.toml +++ b/rules/linux/discovery_linux_nping_activity.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,39 +28,40 @@ risk_score = 47 rule_id = "0d69150b-96f8-467c-a86d-a67a3378ce77" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/discovery_ping_sweep_detected.toml b/rules/linux/discovery_ping_sweep_detected.toml index ed58852ee..a0f919c15 100644 --- a/rules/linux/discovery_ping_sweep_detected.toml +++ b/rules/linux/discovery_ping_sweep_detected.toml @@ -22,8 +22,7 @@ risk_score = 47 rule_id = "03c23d45-d3cb-4ad4-ab5d-b361ffe8724a" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows diff --git a/rules/linux/discovery_pspy_process_monitoring_detected.toml b/rules/linux/discovery_pspy_process_monitoring_detected.toml index 834343f22..171641a7f 100644 --- a/rules/linux/discovery_pspy_process_monitoring_detected.toml +++ b/rules/linux/discovery_pspy_process_monitoring_detected.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,21 +24,21 @@ risk_score = 21 rule_id = "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc" setup = """ -This rule requires data coming in from Auditd Manager integration. +This rule requires data coming in from Auditd Manager. ### Auditd Manager Integration Setup The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. #### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Auditd Manager and select the integration to see more details about it. -- Click Add Auditd Manager. +- Go to the Kibana home page and click “Add integrations”. +- In the query bar, search for “Auditd Manager” and select the integration to see more details about it. +- Click “Add Auditd Manager”. - Configure the integration name and optionally add a description. - Review optional and advanced settings accordingly. -- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. -- Click Save and Continue. -- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). +- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click “Save and Continue”. +- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). #### Rule Specific Setup Note Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. diff --git a/rules/linux/discovery_sudo_allowed_command_enumeration.toml b/rules/linux/discovery_sudo_allowed_command_enumeration.toml index 54946d26d..3730ba69d 100644 --- a/rules/linux/discovery_sudo_allowed_command_enumeration.toml +++ b/rules/linux/discovery_sudo_allowed_command_enumeration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_suid_sguid_enumeration.toml b/rules/linux/discovery_suid_sguid_enumeration.toml index aa1a36374..95e93fd6c 100644 --- a/rules/linux/discovery_suid_sguid_enumeration.toml +++ b/rules/linux/discovery_suid_sguid_enumeration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_unusual_user_enumeration_via_id.toml b/rules/linux/discovery_unusual_user_enumeration_via_id.toml index 3137222fe..9c0eb17df 100644 --- a/rules/linux/discovery_unusual_user_enumeration_via_id.toml +++ b/rules/linux/discovery_unusual_user_enumeration_via_id.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/discovery_virtual_machine_fingerprinting.toml b/rules/linux/discovery_virtual_machine_fingerprinting.toml index eb0b20e16..2eaaf3647 100644 --- a/rules/linux/discovery_virtual_machine_fingerprinting.toml +++ b/rules/linux/discovery_virtual_machine_fingerprinting.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,39 +28,40 @@ risk_score = 73 rule_id = "5b03c9fb-9945-4d2f-9568-fd690fee3fba" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "high" diff --git a/rules/linux/execution_abnormal_process_id_file_created.toml b/rules/linux/execution_abnormal_process_id_file_created.toml index 0a9a75116..3777d753c 100644 --- a/rules/linux/execution_abnormal_process_id_file_created.toml +++ b/rules/linux/execution_abnormal_process_id_file_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -79,25 +79,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml index ad1f06075..569af1415 100644 --- a/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml +++ b/rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Linux environment variable capture feature via the Elastic Defend Integration was added in 8.6." min_stack_version = "8.6.0" -updated_date = "2023/10/11" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -33,40 +33,38 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). Elastic Defend integration does not collect environment variable logging by default. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration. #### To set up environment variable capture for an Elastic Agent policy: -- Go to Security → Manage → Policies. -- Select an Elastic Agent policy. -- Click Show advanced settings. -- Scroll down or search for linux.advanced.capture_env_vars. -- Enter the names of env vars you want to capture, separated by commas. +- Go to “Security → Manage → Policies”. +- Select an “Elastic Agent policy”. +- Click “Show advanced settings”. +- Scroll down or search for “linux.advanced.capture_env_vars”. +- Enter the names of environment variables you want to capture, separated by commas. - For this rule the linux.advanced.capture_env_vars variable should be set to "http_proxy,HTTPS_PROXY,ALL_PROXY". -- Click Save. -After saving the integration change, the Elastic Agents running this policy will be updated and -the rule will function properly. -For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). +- Click “Save”. +After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly. +For more information on capturing environment variables refer to the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). """ severity = "medium" diff --git a/rules/linux/execution_file_execution_followed_by_deletion.toml b/rules/linux/execution_file_execution_followed_by_deletion.toml index ecec2d920..29389ee03 100644 --- a/rules/linux/execution_file_execution_followed_by_deletion.toml +++ b/rules/linux/execution_file_execution_followed_by_deletion.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml b/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml index c91af8b5a..1f860d513 100644 --- a/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml +++ b/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -76,39 +76,40 @@ risk_score = 47 rule_id = "adb961e0-cb74-42a0-af9e-29fc41f88f5f" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/execution_interpreter_tty_upgrade.toml b/rules/linux/execution_interpreter_tty_upgrade.toml index 64c68f7bc..b883f27cb 100644 --- a/rules/linux/execution_interpreter_tty_upgrade.toml +++ b/rules/linux/execution_interpreter_tty_upgrade.toml @@ -2,7 +2,7 @@ creation_date = "2023/09/20" integration = ["endpoint"] maturity = "production" -updated_date = "2023/10/19" +updated_date = "2023/11/02" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -22,12 +22,10 @@ risk_score = 47 rule_id = "84d1f8db-207f-45ab-a578-921d91c23eb2" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. @@ -40,7 +38,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se - Configure the integration name and optionally add a description. - Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" - Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). - Click "Save and Continue". diff --git a/rules/linux/execution_nc_listener_via_rlwrap.toml b/rules/linux/execution_nc_listener_via_rlwrap.toml index ed9ce7406..a08fcd393 100644 --- a/rules/linux/execution_nc_listener_via_rlwrap.toml +++ b/rules/linux/execution_nc_listener_via_rlwrap.toml @@ -29,8 +29,7 @@ risk_score = 21 rule_id = "0f56369f-eb3d-459c-a00b-87c2bf7bdfc5" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows diff --git a/rules/linux/execution_network_event_post_compilation.toml b/rules/linux/execution_network_event_post_compilation.toml index 748785e0a..13f948802 100644 --- a/rules/linux/execution_network_event_post_compilation.toml +++ b/rules/linux/execution_network_event_post_compilation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_perl_tty_shell.toml b/rules/linux/execution_perl_tty_shell.toml index a091c5a58..d36348aa5 100644 --- a/rules/linux/execution_perl_tty_shell.toml +++ b/rules/linux/execution_perl_tty_shell.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -21,39 +21,40 @@ risk_score = 73 rule_id = "05e5a668-7b51-4a67-93ab-e9af405c9ef3" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "high" diff --git a/rules/linux/execution_potential_hack_tool_executed.toml b/rules/linux/execution_potential_hack_tool_executed.toml index db74f1391..7d116f4cd 100644 --- a/rules/linux/execution_potential_hack_tool_executed.toml +++ b/rules/linux/execution_potential_hack_tool_executed.toml @@ -22,8 +22,7 @@ risk_score = 47 rule_id = "1df1152b-610a-4f48-9d7a-504f6ee5d9da" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows diff --git a/rules/linux/execution_process_started_from_process_id_file.toml b/rules/linux/execution_process_started_from_process_id_file.toml index fde6c8d2a..c70c71ee0 100644 --- a/rules/linux/execution_process_started_from_process_id_file.toml +++ b/rules/linux/execution_process_started_from_process_id_file.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -47,25 +47,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_process_started_in_shared_memory_directory.toml b/rules/linux/execution_process_started_in_shared_memory_directory.toml index cd552764c..d15be4abe 100644 --- a/rules/linux/execution_process_started_in_shared_memory_directory.toml +++ b/rules/linux/execution_process_started_in_shared_memory_directory.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -37,25 +37,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_python_tty_shell.toml b/rules/linux/execution_python_tty_shell.toml index 0f6f35c31..b6129d5f6 100644 --- a/rules/linux/execution_python_tty_shell.toml +++ b/rules/linux/execution_python_tty_shell.toml @@ -2,7 +2,7 @@ creation_date = "2020/04/15" integration = ["endpoint"] maturity = "production" -updated_date = "2023/10/16" +updated_date = "2023/11/02" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" @@ -24,25 +24,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_remote_code_execution_via_postgresql.toml b/rules/linux/execution_remote_code_execution_via_postgresql.toml index 44daa3eed..ff5fbb6cd 100644 --- a/rules/linux/execution_remote_code_execution_via_postgresql.toml +++ b/rules/linux/execution_remote_code_execution_via_postgresql.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_shell_evasion_linux_binary.toml b/rules/linux/execution_shell_evasion_linux_binary.toml index 65cae9af9..74de453fd 100644 --- a/rules/linux/execution_shell_evasion_linux_binary.toml +++ b/rules/linux/execution_shell_evasion_linux_binary.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -98,36 +98,34 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above. #### To confirm that Session View data is enabled: -- Go to Manage → Policies, and edit one or more of your Elastic Defend integration policies. -- Select the Policy settings tab, then scroll down to the Linux event collection section near the bottom. -- Check the box for Process events, and turn on the Include session data toggle. -- If you want to include file and network alerts in Session View, check the boxes for Network and File events. -- If you want to enable terminal output capture, turn on the Capture terminal output toggle. -For more information about the additional fields collected when this setting is enabled and -the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). +- Go to “Manage → Policies”, and edit one or more of your Elastic Defend integration policies. +- Select the” Policy settings” tab, then scroll down to the “Linux event collection” section near the bottom. +- Check the box for “Process events”, and turn on the “Include session data” toggle. +- If you want to include file and network alerts in Session View, check the boxes for “Network and File events”. +- If you want to enable terminal output capture, turn on the “Capture terminal output” toggle. +For more information about the additional fields collected when this setting is enabled and the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). """ severity = "medium" diff --git a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml index edaab1cf7..af21e4fc4 100644 --- a/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml +++ b/rules/linux/execution_shell_suspicious_parent_child_revshell_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,26 +29,26 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ severity = "medium" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] diff --git a/rules/linux/execution_shell_via_background_process.toml b/rules/linux/execution_shell_via_background_process.toml index 7730650b5..e1e181aea 100644 --- a/rules/linux/execution_shell_via_background_process.toml +++ b/rules/linux/execution_shell_via_background_process.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,25 +24,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_shell_via_java_revshell_linux.toml b/rules/linux/execution_shell_via_java_revshell_linux.toml index d06677ec9..57df034c2 100644 --- a/rules/linux/execution_shell_via_java_revshell_linux.toml +++ b/rules/linux/execution_shell_via_java_revshell_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml index 2f3f8d0a6..abbf54a9e 100644 --- a/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml +++ b/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_shell_via_meterpreter_linux.toml b/rules/linux/execution_shell_via_meterpreter_linux.toml index 6e2491a2d..202e77942 100644 --- a/rules/linux/execution_shell_via_meterpreter_linux.toml +++ b/rules/linux/execution_shell_via_meterpreter_linux.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "The sampling feature within EQL was introduced in 8.6.0" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -22,31 +22,33 @@ risk_score = 47 rule_id = "5c895b4f-9133-4e68-9e23-59902175355c" setup = """ -This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. +This rule requires data coming in from one of the following integrations: +- Auditbeat +- Auditd Manager ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). ### Auditd Manager Integration Setup The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. #### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Auditd Manager and select the integration to see more details about it. -- Click Add Auditd Manager. +- Go to the Kibana home page and click “Add integrations”. +- In the query bar, search for “Auditd Manager” and select the integration to see more details about it. +- Click “Add Auditd Manager”. - Configure the integration name and optionally add a description. - Review optional and advanced settings accordingly. -- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. -- Click Save and Continue. -- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). +- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click “Save and Continue”. +- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). #### Rule Specific Setup Note Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. diff --git a/rules/linux/execution_shell_via_suspicious_binary.toml b/rules/linux/execution_shell_via_suspicious_binary.toml index 2b7101c6c..fa8380a08 100644 --- a/rules/linux/execution_shell_via_suspicious_binary.toml +++ b/rules/linux/execution_shell_via_suspicious_binary.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml index 5f5dba990..65cad55c5 100644 --- a/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml index 79d260c9a..0391990f9 100644 --- a/rules/linux/execution_shell_via_udp_cli_utility_linux.toml +++ b/rules/linux/execution_shell_via_udp_cli_utility_linux.toml @@ -4,7 +4,7 @@ integration = ["auditd_manager"] maturity = "production" min_stack_comments = "The sampling feature within EQL was introduced in 8.6.0" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,31 +26,33 @@ risk_score = 47 rule_id = "a5eb21b7-13cc-4b94-9fe2-29bb2914e037" setup = """ -This rule requires data coming in either from Auditbeat integration, or Auditd Manager integration. +This rule requires data coming in from one of the following integrations: +- Auditbeat +- Auditd Manager ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). ### Auditd Manager Integration Setup The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel. Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. #### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Auditd Manager and select the integration to see more details about it. -- Click Add Auditd Manager. +- Go to the Kibana home page and click “Add integrations”. +- In the query bar, search for “Auditd Manager” and select the integration to see more details about it. +- Click “Add Auditd Manager”. - Configure the integration name and optionally add a description. - Review optional and advanced settings accordingly. -- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. -- Click Save and Continue. -- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). +- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable. +- Click “Save and Continue”. +- For more details on the integration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager). #### Rule Specific Setup Note Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration. diff --git a/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml b/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml index 3cef618ea..91fa7eb9c 100644 --- a/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml +++ b/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_suspicious_executable_running_system_commands.toml b/rules/linux/execution_suspicious_executable_running_system_commands.toml index 1e92d95cc..f38a877b2 100644 --- a/rules/linux/execution_suspicious_executable_running_system_commands.toml +++ b/rules/linux/execution_suspicious_executable_running_system_commands.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,26 +27,26 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). + """ severity = "low" tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"] diff --git a/rules/linux/execution_suspicious_mining_process_creation_events.toml b/rules/linux/execution_suspicious_mining_process_creation_events.toml index e0f79506e..002a29e16 100644 --- a/rules/linux/execution_suspicious_mining_process_creation_events.toml +++ b/rules/linux/execution_suspicious_mining_process_creation_events.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,25 +24,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/execution_tc_bpf_filter.toml b/rules/linux/execution_tc_bpf_filter.toml index 56d562e00..9a75c23f1 100644 --- a/rules/linux/execution_tc_bpf_filter.toml +++ b/rules/linux/execution_tc_bpf_filter.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/11" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" integration = ["endpoint"] [rule] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/impact_data_encrypted_via_openssl.toml b/rules/linux/impact_data_encrypted_via_openssl.toml index 03a5a410e..68821691a 100644 --- a/rules/linux/impact_data_encrypted_via_openssl.toml +++ b/rules/linux/impact_data_encrypted_via_openssl.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/impact_esxi_process_kill.toml b/rules/linux/impact_esxi_process_kill.toml index 97212297a..d45f5244e 100644 --- a/rules/linux/impact_esxi_process_kill.toml +++ b/rules/linux/impact_esxi_process_kill.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.5.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml index 1fb436411..6ab9c3305 100644 --- a/rules/linux/impact_potential_linux_ransomware_file_encryption.toml +++ b/rules/linux/impact_potential_linux_ransomware_file_encryption.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,25 +26,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/impact_potential_linux_ransomware_note_detected.toml b/rules/linux/impact_potential_linux_ransomware_note_detected.toml index cdcdefb45..92c2ecbcd 100644 --- a/rules/linux/impact_potential_linux_ransomware_note_detected.toml +++ b/rules/linux/impact_potential_linux_ransomware_note_detected.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/impact_process_kill_threshold.toml b/rules/linux/impact_process_kill_threshold.toml index d89857749..e3ad173ea 100644 --- a/rules/linux/impact_process_kill_threshold.toml +++ b/rules/linux/impact_process_kill_threshold.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -55,25 +55,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/lateral_movement_ssh_it_worm_download.toml b/rules/linux/lateral_movement_ssh_it_worm_download.toml index 823ec2e42..e29caebd5 100644 --- a/rules/linux/lateral_movement_ssh_it_worm_download.toml +++ b/rules/linux/lateral_movement_ssh_it_worm_download.toml @@ -22,8 +22,7 @@ risk_score = 47 rule_id = "2ddc468e-b39b-4f5b-9825-f3dcb0e998ea" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows diff --git a/rules/linux/lateral_movement_telnet_network_activity_external.toml b/rules/linux/lateral_movement_telnet_network_activity_external.toml index e48026c94..01daa4c3c 100644 --- a/rules/linux/lateral_movement_telnet_network_activity_external.toml +++ b/rules/linux/lateral_movement_telnet_network_activity_external.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -30,39 +30,40 @@ risk_score = 47 rule_id = "e19e64ee-130e-4c07-961f-8a339f0b8362" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/lateral_movement_telnet_network_activity_internal.toml b/rules/linux/lateral_movement_telnet_network_activity_internal.toml index 3e7f21eff..3cb0849c3 100644 --- a/rules/linux/lateral_movement_telnet_network_activity_internal.toml +++ b/rules/linux/lateral_movement_telnet_network_activity_internal.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -30,39 +30,40 @@ risk_score = 47 rule_id = "1b21abcc-4d9f-4b08-a7f5-316f5f94b973" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/persistence_chkconfig_service_add.toml b/rules/linux/persistence_chkconfig_service_add.toml index 2f05217ce..1cd1b21ac 100644 --- a/rules/linux/persistence_chkconfig_service_add.toml +++ b/rules/linux/persistence_chkconfig_service_add.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/22" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" integration = ["endpoint"] [rule] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml index 415811d27..10a97feee 100644 --- a/rules/linux/persistence_credential_access_modify_ssh_binaries.toml +++ b/rules/linux/persistence_credential_access_modify_ssh_binaries.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,39 +25,40 @@ risk_score = 47 rule_id = "0415f22a-2336-45fa-ba07-618a5942e22c" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/persistence_cron_job_creation.toml b/rules/linux/persistence_cron_job_creation.toml index 602b15e17..f441b35ac 100644 --- a/rules/linux/persistence_cron_job_creation.toml +++ b/rules/linux/persistence_cron_job_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_dynamic_linker_backup.toml b/rules/linux/persistence_dynamic_linker_backup.toml index c1face66f..f2b8cf4fc 100644 --- a/rules/linux/persistence_dynamic_linker_backup.toml +++ b/rules/linux/persistence_dynamic_linker_backup.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/12" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" integration = ["endpoint"] [rule] @@ -26,25 +26,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_etc_file_creation.toml b/rules/linux/persistence_etc_file_creation.toml index 3c6a89a9e..3acc0756e 100644 --- a/rules/linux/persistence_etc_file_creation.toml +++ b/rules/linux/persistence_etc_file_creation.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/22" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" integration = ["endpoint"] [rule] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_init_d_file_creation.toml b/rules/linux/persistence_init_d_file_creation.toml index 18ae474cd..e6361396e 100644 --- a/rules/linux/persistence_init_d_file_creation.toml +++ b/rules/linux/persistence_init_d_file_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -132,25 +132,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_insmod_kernel_module_load.toml b/rules/linux/persistence_insmod_kernel_module_load.toml index fe1533de0..579c4e9c5 100644 --- a/rules/linux/persistence_insmod_kernel_module_load.toml +++ b/rules/linux/persistence_insmod_kernel_module_load.toml @@ -3,7 +3,7 @@ creation_date = "2022/07/11" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/23" +updated_date = "2023/11/02" integration = ["endpoint"] [rule] @@ -26,25 +26,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_kde_autostart_modification.toml b/rules/linux/persistence_kde_autostart_modification.toml index 4e40e7a1f..4e3c263c2 100644 --- a/rules/linux/persistence_kde_autostart_modification.toml +++ b/rules/linux/persistence_kde_autostart_modification.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/12" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,39 +26,40 @@ risk_score = 47 rule_id = "e3e904b3-0a8e-4e68-86a8-977a163e21d3" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). #### Custom Ingest Pipeline For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). diff --git a/rules/linux/persistence_linux_backdoor_user_creation.toml b/rules/linux/persistence_linux_backdoor_user_creation.toml index cbe874f66..aa6ef2339 100644 --- a/rules/linux/persistence_linux_backdoor_user_creation.toml +++ b/rules/linux/persistence_linux_backdoor_user_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -93,25 +93,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_linux_group_creation.toml b/rules/linux/persistence_linux_group_creation.toml index 4b4939ccc..a86662efa 100644 --- a/rules/linux/persistence_linux_group_creation.toml +++ b/rules/linux/persistence_linux_group_creation.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/17" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -85,8 +85,7 @@ risk_score = 21 rule_id = "a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f" setup = """ -This rule requires data coming in from one of the following integrations: -- Filebeat +This rule requires data coming in from Filebeat. ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -97,10 +96,10 @@ Filebeat is a lightweight shipper for forwarding and centralizing log data. Inst - To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). - To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). - For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). +- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). #### Rule Specific Setup Note -- This rule requires the Filebeat System Module to be enabled. +- This rule requires the “Filebeat System Module” to be enabled. - The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. - To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). diff --git a/rules/linux/persistence_linux_shell_activity_via_web_server.toml b/rules/linux/persistence_linux_shell_activity_via_web_server.toml index 6ef216a42..dd391a757 100644 --- a/rules/linux/persistence_linux_shell_activity_via_web_server.toml +++ b/rules/linux/persistence_linux_shell_activity_via_web_server.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -110,25 +110,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_linux_user_account_creation.toml b/rules/linux/persistence_linux_user_account_creation.toml index 281077914..b9ba48278 100644 --- a/rules/linux/persistence_linux_user_account_creation.toml +++ b/rules/linux/persistence_linux_user_account_creation.toml @@ -4,7 +4,7 @@ integration = ["system"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/17" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -84,8 +84,7 @@ risk_score = 21 rule_id = "edfd5ca9-9d6c-44d9-b615-1e56b920219c" setup = """ -This rule requires data coming in from one of the following integrations: -- Filebeat +This rule requires data coming in from Filebeat. ### Filebeat Setup Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing. @@ -96,10 +95,10 @@ Filebeat is a lightweight shipper for forwarding and centralizing log data. Inst - To run Filebeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html). - To run Filebeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html). - For quick start information for Filebeat refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html). -- For complete Setup and Run Filebeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). +- For complete “Setup and Run Filebeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html). #### Rule Specific Setup Note -- This rule requires the Filebeat System Module to be enabled. +- This rule requires the “Filebeat System Module” to be enabled. - The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions. - To run the system module of Filebeat on Linux follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html). diff --git a/rules/linux/persistence_linux_user_added_to_privileged_group.toml b/rules/linux/persistence_linux_user_added_to_privileged_group.toml index ad80c897f..98475a809 100644 --- a/rules/linux/persistence_linux_user_added_to_privileged_group.toml +++ b/rules/linux/persistence_linux_user_added_to_privileged_group.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -88,25 +88,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_message_of_the_day_creation.toml b/rules/linux/persistence_message_of_the_day_creation.toml index c55357c72..2be689b44 100644 --- a/rules/linux/persistence_message_of_the_day_creation.toml +++ b/rules/linux/persistence_message_of_the_day_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -126,25 +126,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_message_of_the_day_execution.toml b/rules/linux/persistence_message_of_the_day_execution.toml index 2ef391fcd..15633b3e5 100644 --- a/rules/linux/persistence_message_of_the_day_execution.toml +++ b/rules/linux/persistence_message_of_the_day_execution.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -125,25 +125,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_rc_script_creation.toml b/rules/linux/persistence_rc_script_creation.toml index 4f6508d26..e5cde1a54 100644 --- a/rules/linux/persistence_rc_script_creation.toml +++ b/rules/linux/persistence_rc_script_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -111,25 +111,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_setuid_setgid_capability_set.toml b/rules/linux/persistence_setuid_setgid_capability_set.toml index 3a9e75547..99fd6e6eb 100644 --- a/rules/linux/persistence_setuid_setgid_capability_set.toml +++ b/rules/linux/persistence_setuid_setgid_capability_set.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/13" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -23,12 +23,10 @@ risk_score = 47 rule_id = "f5c005d3-4e17-48b0-9cd7-444d48857f97" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. @@ -41,7 +39,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se - Configure the integration name and optionally add a description. - Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" - Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). - Click "Save and Continue". diff --git a/rules/linux/persistence_shared_object_creation.toml b/rules/linux/persistence_shared_object_creation.toml index 02892b697..5e788d188 100644 --- a/rules/linux/persistence_shared_object_creation.toml +++ b/rules/linux/persistence_shared_object_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_systemd_scheduled_timer_created.toml b/rules/linux/persistence_systemd_scheduled_timer_created.toml index 3f36b04e2..f8ea241fd 100644 --- a/rules/linux/persistence_systemd_scheduled_timer_created.toml +++ b/rules/linux/persistence_systemd_scheduled_timer_created.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [transform] [[transform.osquery]] @@ -140,25 +140,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/persistence_systemd_service_creation.toml b/rules/linux/persistence_systemd_service_creation.toml index e79968b90..b04b6d63f 100644 --- a/rules/linux/persistence_systemd_service_creation.toml +++ b/rules/linux/persistence_systemd_service_creation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup, New Term" min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -30,25 +30,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml b/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml index 37e274ca2..34c410034 100644 --- a/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml +++ b/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_container_util_misconfiguration.toml b/rules/linux/privilege_escalation_container_util_misconfiguration.toml index 1f523a382..d8756af51 100644 --- a/rules/linux/privilege_escalation_container_util_misconfiguration.toml +++ b/rules/linux/privilege_escalation_container_util_misconfiguration.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/07/31" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -31,36 +31,34 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above. #### To confirm that Session View data is enabled: -- Go to Manage → Policies, and edit one or more of your Elastic Defend integration policies. -- Select the Policy settings tab, then scroll down to the Linux event collection section near the bottom. -- Check the box for Process events, and turn on the Include session data toggle. -- If you want to include file and network alerts in Session View, check the boxes for Network and File events. -- If you want to enable terminal output capture, turn on the Capture terminal output toggle. -For more information about the additional fields collected when this setting is enabled and -the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). +- Go to “Manage → Policies”, and edit one or more of your Elastic Defend integration policies. +- Select the” Policy settings” tab, then scroll down to the “Linux event collection” section near the bottom. +- Check the box for “Process events”, and turn on the “Include session data” toggle. +- If you want to include file and network alerts in Session View, check the boxes for “Network and File events”. +- If you want to enable terminal output capture, turn on the “Capture terminal output” toggle. +For more information about the additional fields collected when this setting is enabled and the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html). """ severity = "medium" diff --git a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml index 25cce2de2..3ef2f2dcc 100644 --- a/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml +++ b/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -24,39 +24,40 @@ risk_score = 47 rule_id = "717f82c2-7741-4f9b-85b8-d06aeb853f4f" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml index 55ff7e0e1..2300d6786 100644 --- a/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml +++ b/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml b/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml index d75535a50..c920a0932 100644 --- a/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml +++ b/rules/linux/privilege_escalation_linux_uid_int_max_bug.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -29,25 +29,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml b/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml index 42bae30dd..7938e16f3 100644 --- a/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml +++ b/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml @@ -3,7 +3,7 @@ creation_date = "2023/06/09" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" integration = ["endpoint"] [rule] @@ -32,25 +32,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml index 4bc6f8901..22c1de209 100644 --- a/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml +++ b/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Linux environment variable capture feature via the Elastic Defend Integration was added in 8.6." min_stack_version = "8.6.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,40 +25,38 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). Elastic Defend integration does not collect environment variable logging by default. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration. #### To set up environment variable capture for an Elastic Agent policy: -- Go to Security → Manage → Policies. -- Select an Elastic Agent policy. -- Click Show advanced settings. -- Scroll down or search for linux.advanced.capture_env_vars. -- Enter the names of env vars you want to capture, separated by commas. +- Go to “Security → Manage → Policies”. +- Select an “Elastic Agent policy”. +- Click “Show advanced settings”. +- Scroll down or search for “linux.advanced.capture_env_vars”. +- Enter the names of environment variables you want to capture, separated by commas. - For this rule the linux.advanced.capture_env_vars variable should be set to "GLIBC_TUNABLES". -- Click Save. -After saving the integration change, the Elastic Agents running this policy will be updated and -the rule will function properly. -For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). +- Click “Save”. +After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly. +For more information on capturing environment variables refer to the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html). """ severity = "high" diff --git a/rules/linux/privilege_escalation_overlayfs_local_privesc.toml b/rules/linux/privilege_escalation_overlayfs_local_privesc.toml index 90c623e53..86a9899c3 100644 --- a/rules/linux/privilege_escalation_overlayfs_local_privesc.toml +++ b/rules/linux/privilege_escalation_overlayfs_local_privesc.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_pkexec_envar_hijack.toml b/rules/linux/privilege_escalation_pkexec_envar_hijack.toml index a07265022..e12bb1806 100644 --- a/rules/linux/privilege_escalation_pkexec_envar_hijack.toml +++ b/rules/linux/privilege_escalation_pkexec_envar_hijack.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml b/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml index d450ee6fb..1159c6295 100644 --- a/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml +++ b/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml b/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml index d5573c48b..1cab6128a 100644 --- a/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml +++ b/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_shadow_file_read.toml b/rules/linux/privilege_escalation_shadow_file_read.toml index d4a4ee038..e76b0d458 100644 --- a/rules/linux/privilege_escalation_shadow_file_read.toml +++ b/rules/linux/privilege_escalation_shadow_file_read.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "The single field New Term rule type used in this rule was added in Elastic 8.4" min_stack_version = "8.4.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,25 +26,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml b/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml index 5fc7846be..7ef11c7fd 100644 --- a/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml +++ b/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_sudo_hijacking.toml b/rules/linux/privilege_escalation_sudo_hijacking.toml index a76882c66..ac0f0571e 100644 --- a/rules/linux/privilege_escalation_sudo_hijacking.toml +++ b/rules/linux/privilege_escalation_sudo_hijacking.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6" min_stack_version = "8.6.0" -updated_date = "2023/09/25" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,25 +26,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml b/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml index eb18f91c2..47d276124 100644 --- a/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml +++ b/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -28,25 +28,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml b/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml index 03f553313..37b12bbcd 100644 --- a/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml +++ b/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml @@ -24,8 +24,7 @@ risk_score = 47 rule_id = "a0ddb77b-0318-41f0-91e4-8c1b5528834f" setup = """ -This rule requires data coming in from one of the following integrations: -- Elastic Defend +This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows diff --git a/rules/linux/privilege_escalation_uid_change_post_compilation.toml b/rules/linux/privilege_escalation_uid_change_post_compilation.toml index ff74083a3..f1a4e1d5a 100644 --- a/rules/linux/privilege_escalation_uid_change_post_compilation.toml +++ b/rules/linux/privilege_escalation_uid_change_post_compilation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -25,25 +25,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """ diff --git a/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml b/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml index 0633c05a4..6189c40ed 100644 --- a/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml +++ b/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -26,39 +26,40 @@ risk_score = 47 rule_id = "d00f33e7-b57d-4023-9952-2db91b1767c4" setup = """ -This rule requires data coming in either from Elastic Defend, or Auditbeat integration. +This rule requires data coming in from one of the following integrations: +- Elastic Defend +- Auditbeat ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). ### Auditbeat Setup Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. -#### The following steps should be executed in order to add the Auditbeat for Linux System: +#### The following steps should be executed in order to add the Auditbeat on a Linux System: - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages. - To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html). - To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html). - To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html). -- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). +- For complete “Setup and Run Auditbeat” information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html). """ severity = "medium" diff --git a/rules/linux/privilege_escalation_writable_docker_socket.toml b/rules/linux/privilege_escalation_writable_docker_socket.toml index e24fad689..1d3ac1b99 100644 --- a/rules/linux/privilege_escalation_writable_docker_socket.toml +++ b/rules/linux/privilege_escalation_writable_docker_socket.toml @@ -4,7 +4,7 @@ integration = ["endpoint"] maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2023/10/16" +updated_date = "2023/11/02" [rule] author = ["Elastic"] @@ -27,25 +27,24 @@ setup = """ This rule requires data coming in from Elastic Defend. ### Elastic Defend Integration Setup -Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows -the Elastic Agent to monitor events on your host and send data to the Elastic Security app. +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. #### Prerequisite Requirements: - Fleet is required for Elastic Defend. - To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: -- Go to the Kibana home page and click Add integrations. -- In the query bar, search for Elastic Defend and select the integration to see more details about it. -- Click Add Elastic Defend. +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". - Configure the integration name and optionally add a description. -- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". - Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). -- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" -- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead. +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). -- Click Save and Continue. -- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts. +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). """

    mr%P2Zs#wn)|VenbvQwrm5lYy_(gnbFb#~ zcwmY3pB<@E9}#rL{6X#i4ObJVG+n~~ldFM4UXAqGKl5rP1*ZSv)i9((UJVT8UwJiN zqmpXSk?M1@e}}7qn+{AR*51DV;BUPe<)U9@T7U6sCbs`Aujb!AQicDUUJYjMKlEyr zh5oTu^KT!i!vBF+!~5yK?bZD0NEI-|xko~k9^W|jkGL9mslA*(QOkej)qG?AH@%wc zf#+V$zkQ?%|LN7(E`T56F50uS8 z(GOmhsuEN-&u@~J+xy+3MH_gxGf$Ur(}FbKapxv?jOx3gVE%2(wd))enh(;KE6F&7 zcDXWd;qj8(K_asNjqw2zxMP0H?>Bn+13vnRTdO17=1Z>wR!m%2{oeXs$qmbTzKb4f*q6&8s@7QE(eM1%Qz393VAfM>U zS9iT@;J}$1(S6%Rr5&+0-~Z6sLfPzo!;l%OZ*0iuf^TveRtr(TmU`0NnHgc%<+g|% zi$?N*wf0rIZo@)`2+GCt?%SJC_wAC&v)3ub^v^;@Q8`F`A3^9oA=G`lkm*U{W~xzy zK=%u{h(C4XK4LS2x^F>U0)WQ2H}?TTx%@EswD8^oNV%MWl*_&MAuUe#A>`8bb4H5w zI|#X4w1JRIbB~|MWwHzm7ylf&lwUuuxIHL`kV}TCi#Uwas6fAE*DvG}G^GW2;OBPb zKNx2dqrO)fBoO;eSLP5?|6kCRr1=+gWki>`Z$nWeHpc0e4X?vwNrUFq04UM^a0W`W z(^s=Z6~Ui*VZ@}kTK&c?G;DkN%aHvAg7Fox7Tz>)nACp`RV{S zmx>mNmz=cF)OV4>>1p2*(tCZZowwO}8!Qu4XU`pck6UH#_n^k zZ`7~eUT1;y$pkdsH737uv3n4Nuc7qra4jF|!HupZJMY2$6y*N12UqBdqqa>vOEl(l zQ4E|e{3P;it@gP`jY$fcxGR~-t+^z``~UE@4Qeq0#OS}D*PuNkz@qtIys8I;&tKKo zgZ}!ezS^+h|2JsNU4s8FJh2&!DdThxbMG z47hpziTuKPsqkkzEhN?>2YvvU7gC!sFQgEIp2c1N@Jt$7laX)8j(Z^Ys=D zkO^P?Pfd7}@e33FpQgv{4gVDh|2HuazyHjHckzZy_?OH75eaYm|7v<1i~s;)xKfSV zQ-lG(!RCrE;5&ThrxyN|0l#7S4-EMKFct!Z#RUxpu>J!B9(1Ax7~o28b~hc!Q^H%9 z2Ru>lC4ZaUq_uy6`{53rMxO83{g%PTR2{a*jz{u}yNdG9|ybNM@Dh#)t98WH`g!>bh17>=-(yX zx8byGIlMP02Y=yRMMBt*r`8;{CKI>rb}^?8UIaH+pa%C}+B**k6Xs2m1?7|-rPwRv z(-<2Y+DttcZ(YQrcQGJL0dCb4M7mAcB%Y+PkhT(#-rmKBGHS@(eKC}lu;kUPh=+#K z)}6+x^wjf%FNtZwe6xNJrMsY^G%*LP!pH8{Ogff^Wf6`p`cH<^Od&sq(&NW}9ZHW$ z{%I&Jb$|QOhfWwq4sZi zQLpd+Mqb?PxR4jyRRzg7DMwSLdGb+#1vN@6fk&<{!rDo2_}R%nK44(yxHFPv{IdQ5 zD)Z6sY1B^W6rE4pe8^3EckWk26eZHi>dow%8v5FvH8Mc@zlsH0{oBs~iZW{k zj$NwsJg#6I)0?)3iH@4h7`?_frRO1CF$dBW3%1(Rr?03s!Z?%V(2Ek4lyOU3l&-NW zr%fGu-nzY^N8e0Gw3jN`T(MSM}RWDtg|V)d0=pyq`xAHYr9#X z9Ed>=P*9|KGmhX{yssy*TMDbRlRn*i8u`-A0lh(04wR&aUbe?=gqNS34~hv|{xm3- za>AW{{PfGlQ~(hKCk9kW7ER9eb&ab3Am3M6RXK+fKT1jXe=738f#5`iWCWbJkoRXd z@sw`<$6iiQ-NyHQYE{&}oi}o7WBliMqSf3lJW-Jsey%5aln$X8xQRgLnY&2IKcMqW z*O=eunYVm1oTf>t`=}pXLcD0vIB<1n5Kr9dJM-5kxb)BUM4Gk0=NEb+4Iv&~7o`xy zA0EAMqB;^c8-W5E7eiz*kG&@=qoCHqfhC964k_!>vhPKYF;SRq=(!n*+Rm0Sf~x3% zfUwBr!TU=Mtv);jnKmj&0GE7^xohKfp{r~CMMM^TcaWX8v6BfgaU>Nz8i>7$?#03g zAC|RW!(jqbzeD$y2q)3)(tx^*YgJ>$oZMMVNzT;ia-}TaQb=UFB~{e7#O&6-%eIl) zw5bF_8UEJ%6`I*^rt7KtUh>h#s!9rtyCLru*d4lc*=RW?^R^+noQe+w+#`kZUTr$n z4mCc~4kK2f{sT&U#1jCs6DJZhD|d(r*wsZ+1dn+D7I>uH_)jif^`))?bp~qab44X% z#s0VFT>8})5SN}lO&OyrU4Y0|Eckz~phs}&0)(D+ZGYy{L1z3<7>*HbAPc0WC#*Bw z{BowDd_C6)12Sp z6I$jUSC6_q(ADEAboD3^7H6!n0$n{iJ6v2n4$W`XPceu*TS{>0-ItbaT#Zb?lY7pP{unv; zXfk;&MALWQ;^)k!IoAaU%DcHe@RV8I>Ix=as9kb_x?%^sc zTfu7ZM~6B|d5#6;^r9JA^fYOnp`XWpkAsL|Tf z47?G$f^}Xeq4beIGtY5u0g-g6&^6qT|l84FM4#Jr}-;|7+UlQorllkSt=rO3_YGlnQoKyXE zjGO5_bhX2$Y;uIw9(a4t1qe=(2e4g59PT6LgU-@cQJ~t4>Fjp!Yv{ghmLq`2$wB1(dfOGhdw^Vwa*CtD5JuC#Qux7C=Gjgh=%adpe-`Qmz?(veJB^**^0JG&@ z9bD09S3R6*OkAeSl@FxMqEAHSMj|osjdi?4hZP~iwBqovzrqH{VwC6rGvC&^W z)jEn)-Pgwc+*1K*O6xoP=$qC}dzzF5{n{fjj7eckw5l!RgZ+xjj4^c|>c{&rnFbu` zQy(+>Skh%M(xd7~5X>!Bz3j{F#w+E#!rpB9Vfg_EU*lt028%vBVJn+eRN5}S4Bn?$ zpLvnmvUe@@RvjWAAi7Wqp)S;9!lo}w;nJKM&s+m2Lv%#kLThB0vLy6|uQiIef6>=j zjVUaF?qK<42Hc2k9KBIm^{MP@j$Bu;!9F~I2p(RIW*;SMpdFX?u3xm~JI*x@2Avz# zK)2l5y+Lmt=HS;MGW}Lw;`dM&XA2LnB_j=I9k?F1>dyk}#7){O(|a%Zb{(>bl?}#g z@o#!jL6xYW??dHS1LKxHl?qM%JROdXu7pywyg8Y?$eb0^-0{Kk_?y@3b?>1V$E3>o zI>S@&`pYw2vgX-d$bds{1;%wgH`h>vyeyO?ecWgCX6k*jpR;zMSye=a2hIC{(Im1; zhC^`3hD95majQj1@k!29MnZ1r?(Ot>2d|p$E;aLkXGaB?giZp&m` z?=Sph+KLJyk1d}E%uc^$l+B65zE4%gTI_qxqd8dGE@iABt)Wf1&_p#O0NwrBC;!Xb zmXx{ous$i>9n>IulbxKfb$2dEqMgAO)26ZPmavdiS8C{P9HH1#{ZmV-Snu3!Q0V|h z1eY#;k1$DQ+<_LSJjf(@K5Q{PS_PRTNskMgO74QsGV>slB<&q!l0>fkG)cTMewifX z73U_&+!SPzgn0fmNi2pH6Zp2zMm@^ERXQ@-?9i^6*Lp4_x;<9A$u1T8#);p}LW^l{ zGSm%|r-&-%%GtgzrBcMDzKL;)A)2>F5APbjLw`o+E--=}%Z5x9w*a8QY17Ic5jcKL zqnKMkr)6h$Agg>ySx+X@b6uFe%13@aGlcrPC7Rz|PpsnWvlzfI)5D-7(^NBBTve+t zsWx%}f!cXE4XF3fi4e`I*9v7rAF!6Fq(#00KBpQGq*?vBS=IN>x;eRKkCL=yQG@ho z8!GV`G!%w!R$KcvSmNaO#XwVG!f0qJoK^%4g=3(hurV|gj&8btjEeq&(4^W7GjYk63LHaU)mwZai+iwD0tMpK!&mxL=iM$!xq(yoBBUd?SQwFfBPON-v z)?b(Y;PFlb)dJ^yGHZI-RV06&=P1(SQa&)~eI}mX%bW&HX1OjVv&b8W$*fgy1*$FS z=@P$doWUbrQbt=ZNdu6K7+{3QSs16UGF0`oVPdHlr@9hsay4+4EJk~;4&5|bZR@Nc zwtN@@GDG=QCz3rQ@aBJA_*YvcNi&{Rt^v#g@dK#fFQhEwW@?u?(PmTY{E03 zwdq-iefoL$H%vJQ@dO>jW&6IBJ)Tztg@3V&e};c|-&eah!YM7G@UO{5_?MZ!dK?k{ zJ&P+@u00uj9AMf{8uasJ+BpNgOwD+HzDz~5vh$|XMAELBOSt+ zQ2JLxgy4<-Tk!rm?+P}M07RsMDC4edR!w#@Y>?Ug^gQl+q$QRI7Vbm;Nh0}6{7~4O z{<4XW$o-y|`5<1WYBzxvm=*z9l=JcyJJW4XjafQkM)n`b%p`c6bh^^tYw4@)+fJ;g z9(E&dP;MPrb055V2l9@(4X>Ff1=h$=F@4Wyzpg%?DW*i+IsLnN)bMP2H+;YHbjDez zQt(<+(0wCxf3m`h=P9W61E7=i*z5@Nkg;tju~fCg_I>dLvbYx!7I(fwjBQoy1^2P) zJ_UgvpDQJKiXiYqwAGMk@f`fXa0SP@U{rAEX-b3D@zw7+%Eq`yg1a_^d&vIAJzRHR z52H`!Ejoy{ItHf>)Kf9JC`q&h@jy@4!dOK1cPlksyZ!P%4mWiE4mYfx_w!UXkF>~g z$lu@Ek1mVs*+)?-f*!T-=aN(;*%z%O()R)H*pQyWG znZ^Kzq%?iY$HUj>#@<|wQcfZwC0vr=6%7exSWj6F3t^Nst<4i#!7mW+-L*W&?{>1z zT}l3~AF8@KK2j+O)@+jX^Epd?VT#4~Kp=a>N*WE5uO&TRyC+~UEzDPD^C)JL6&;&@ z@xwAtH#5Ytd>92e9;Dzf3&0Lvt6*z>s}`{G%`&8t+E=2QmMQRk^j8DJn(`2>SSN2K zZIGv(?sdRC&0H?a*ayjaWv7oSR^OyxTzqFU*e=@-`V8fmMQ_*Pqxx;oPr5(3IjEhQ zNO6XZq45IQv#uqk=!x>>^t0pRJC|7k>gA;AR&2eG4#{O;n;|Ws{VHTL@b|=Xc3IYm zhm5sfpm#CV^XNOP{qave_om&1`fE#--yUF(T88`D)@k@{G|x`2cls43(@syGIR_!| zz4s8l#|PniJ_vhnx-Zc1!rsG!?7caUwS9t@f%?7$Jh_pJXNl_dolt%bjoorv@ayBm zyN*xp*|PO#>cZ1I3e5cN7pDr3|g@}nev5ZPg{U>4vf zv5OZ>Yq5JNr05^6L6zQ#XNlm(JlC*w2J%h9sFCi28j~<~TuSS~b(vw*HO)4_v^g^zlokXiL8DE8 z6s(wpQGnO$pdYgY0W#3J4xpwxprh2bASHABag#eD^xY7{OSjU!r?K}^1a3X1ZthUq z2Mg-}4UnG(5C?m^08W@QBWP0(aN%8tVyHG9tdXoPtkA@-02>tR2AE*uKA=fAzz@R` z0@=R+%Agl5K!|F0$?UQO8W=|l2qC=(KhXl@mvId%qAjE)SiucifHQUp8BZdhteeP3w!GZUyd4uUsH9l`rf^c$DUW3V|4nhKjU^r zzhAo=+C#bxpn%{5J7_WnkRa87u44fIRfGq?R7&DdtEkYuNzO-NuK@# z+Uxp7r?DM&52GRWy0@^Nnb20EffHi@4>?@u0N(|&36}S7fJ!>)_lbo3$T=J_%f~_H zae$rjaXu!geFZSHp7)I`M#OJ(&~QGGetNz-u5J|^>H%axyki&v=zxoi&d$Rt-0lBW zsi_>f_+qE3;#J7Vv!D~7C;3&Z_HOPZjYZ{kqBkTxpnfkviL?Pe=>=$s>$Jkmk`=K2 zIQhBXb7}`lO#r+wsW8xS0uX@z9uQr2-lnD@#N@7x+(Up|B3GEzp`@XjLP zL53iqF3Z>^MAmS)YU@k$iEVsM$An+1neFza%vitgP5~Oh1!` z+yPM1Fs#P!XVCCQYT2`pZ-Jje-QJn+)Y8m+VlGH{JiBkE6CLdF{CaH#^NslK{JxNC z>!Cn!7L1sK5mAj2In1V};8#6=Bc9s|!>|(fWR5=EEK>LM*K~5>75%y@HbI zArC`V*YdQ+C8}0-e|6wd#0c{)9cyhbZF-Z=A=HS`7GSE*%vjQ8Vmk)n9Y8CQ3rwqk z7J+FklbBKB=8;|8+DJ~3GPUanijy2V=%yGNH)EkL^AyQ`D2qt?YX=66JGH{HHcK@7 zBT3#>){r$<3J(FTcirylyM`9YXaS#~dz>o$@R_Eci%@YrYQ!RxLc|rSz@ml)V>=#hvTWjU zJWubH-h%*C`To3BAZkc`%Os~2_h=j^x z5cWk*kw?GjeCmXQm^v;0sQk!%^mfsok1Ocs)JdVIbI;nn8I7$;S9fZFzUp;TbTwpY zZ9|q;qD!&;O=X2=NWGABYYa)ZAM_0iHxaiwH3B%3wt-<419-Sk5K|{cXzD~GD+<3D zJDJ*dEKt`mEU}M_4czb1wui<})zH`prTt>;6mdRw3RNR`L%7VabuxjB6P1CaG~b)PZb`9KR*=hfChTv^@9HE-GlWZ*945vQ<#z=Ezsm34?Yr>(EWcwWS7_QU823#a zGN&9y(^XP;MejaVNMZgaRo!6cebIi0NE3dSXwu(M4|cy2qdi-99U5RgMGUa^)X{x* zl9SIc8s_l8DGKP9xdwIJ!JFFsau-?NBgRj?Bkh#V#q+~_~6&L3f_s)^FR9i${#UnY~-L z$eI@TM~U{el?h$&&Ub*81baY!aD;0cwf*~MkgqfO$F9O64`Wr(o(lS$Uf+X}f!Lh@ zIrheB=(9VYKKg_~F+MoRxeucTH9G-Wn1dO}J_4|SCHpW6IL;(fKxHPU+?|Za?lZ(z zIyZ6yT~S_ze5uGjF;pg!AVo>_^2$JR|#$ncbKQIM0LES_C3^z9BW(v#j%yf@KM7LN5i z3nvt)HK?I>z_iu0ZXQ{NQf8uWBQ6BKI|JyD#6Xb}fM4kK45Gq0`56osxe;jL6=Zw@ zBcu^$Idg%1ygNr}&e`!rnz3S)!uqOZ7t!_QaIWZH5q+DKEO3kfU_3CkeQ9(vn7q|>vW`n{2|=|Z7`0jSGLDGv+~LNbQ)9t9 zpNUEvD+?EV_A4@M1@Ar1djo(($^}kphwtSk<4%Ludb#F69!*RU4K0D zmFo%Jc+C)%FMj~<>o4!9_>ij;hqpj5uMB#sT;~P|xjOlIZ@NTISk0lJW{ql!2mOdM zCehnblG?L*%i}UPKaNp6q~O^q6f!jSMpX#3B8L9twaWo2DyVsQbvw}H{AS|kOkpbT zzL9&OT2?nW!3~g7eYxSxz_tFmj=BJG{t5;Bk6SmltF60DYEnc&JRX1?zL7yXh2!ZX za9clE7|L}ihVck5T4oyPLAOJP7(RBjjb^3|%|iW#4sywy3K>m^yW?dvB3HLt>pG+I zOq>3rxly{%adINR3z{^=i1WLmqg(it~;>1^}$v29#5UFo-f62+`NjT z^hkYh-odY|tq{}wkKDI(s z3F9yr$l&Vg2h4~b)RI@J9zTg`jQe#ME|UMWW~;{4qE#Zb%vcYSNc|gH#2&xEcK*oi za(G9$qio{0L~1|lZuGz)nRIm2!XwFy2g5m4?ryXT3MfAcqm#l#wQ&6S@!6C08nv3Y zj2v(-Wy=Z?)rr3!`a_^wS}W+OrstCtunMYn1h(P@eR@^axRyLNs4~< z1M`Z_csPFi!jm*En?I}Q)nN|WA3*=62((vwvci|ByEIKPrF0gm@UC$_WBU#xnud)< z$fqS;9AVek)2t;JRR)DC8l4XIuZe?$Mh;TxMmS26$GE=~rst<7g|9XYz-Rz^TESL-^ zimX{qrN@LJ11Zp5ay@jH>{woHI*T}*@OVH~J%&g92->i%a~Bu!DnzN-i~BocC4~zr zSu{;TaHzLjzji@+R?q9K$xK+gTLt$rW)!g7P#+6ZAPT2e7=m;Bm&ryl++pVvvzt1 ze7rXIgsEC@{|M>hG`=@G1oH3?4^S$`tSPci1M?9zz6vvQ#8ub6B?**d4_YRw<=wRL zmMt5dH6Gg_oblKc{&2)^vbuowVPDGND*_nhfPhg|;~EpXS`0rn*K28{qy?TTXE;sK zlE8uCQOymOub=5wF&{7;N@Wp#-)b{~5@Ms(FI=hb>x@(1p$vAmhD(g2yTA?uBJ;dB z_)~c8K+EA2N%Fh{6ux+vylATI028KM{YEk)?1{_lULHG?HVoM zZq|_Vw3x`;Hyb5&^8tibm?vS(OlpOF+d!evX`lui9RW0~%`I~C8Mp#gI&CfO z7!pWSjW{()(m#HRm0p6#d;WUjNvTZ5*Rxt-3L-S~t}(NHxYXgb)=lW=d8x!-c`3nP zc_~+&YIo?g%Zbn9WHF1&m+!fAyup2)AFfp56JX>hz$Imm2Q83ZZ7IzKO&}IX4;#w{ zUG2Q%eV10a0>1d@pJvh`7Dz?7oeFW`7h$Nm9`Yx2+`E@9LF=St(DVQ%0m4fFk^kM? z{O{)Ge>XS(ySe%Q$L0q9pKoqnpXOS~d?7iclxa=#kpn{f_c(6Rr8dEZerN4bRS;4;ftWC_-5Z3| z-dBw3sm$#EK(^9D0N?m~|9rNA-%gQSu5`nF)s^!arLcU21QQHNFj0yZHA;_nsv!yH zj^|TIg4vZghhW-0qHl@dCdhYK3mvg!I5Ux5f+9^QP^2lOYMz)<`s~|I-WUDZ=?VYE zcrolvhbK^xl1S7;_gTJlvqeutkQ7<6;S(1eG+z~2CLOm}@3T*gUl5`3C z&n-z(ASW9@1^43drFuIF*9y_>@%?gnQ#+r9+x6kshu!uY56F)C2aOUeg?sN7zh4D$ z?IQQ-TZB$d-%&uoizEcRY!s~pv%X#CE*$t2K60B?+Y25adZy+T*6*{qVmKey0KAkC z4Wp~d=TARw9Wk#{#}{;D2#&vk@ z1AYd8D>(hx6VKmce@Tr%YYJAQ1#yr8O6(DRlE-bj6f<6hp}h{EATsntJz^7jGd)HI z$ib#ffQoMWx?pApH}BW)8TaVO@4S=a-?mvp;;4{*ki9G#3`H*Ewg3%*-$#{pS053M zmKYzJ`uydnlJD=1D%C)Ndf+N-Ngk}&g0@4xWO65iF&YdStLh}y`o_@0sUF%6eE`7j zdVn8P76ypGtZqOU;}ownDLRmlbchc0`T`v+$_(J#<`BJ+X!H28;Iwi|;DZ3Clpt!; zdty-DUC(Vome}cx~s$Zqp?vtTfOmX@5E*PiD1)78j*0d%9&1Jb zKbCk^J4JO`0Ej+$kjx}GE2LO&aqw&~;XNkHb5yRBC~bO{iisFC=oS%4&xKo2e(L8f z;@hjmbu`xTtG&|+6ZALr9^9@w?#@tor<{Qvoq#hUJ&9(_?4Yg8zvm>`(;Brxe^;>R z;oNO~b-HQfXC5F24l+H6(gWZlU4yWDxL^bhGB3H^7UQaV zV9wA+5O;L0Vh@|$<*PbhN$e`9!Kfa9ox+fmd(sK*O zyxs^+a7yU`LO3VDXhAyqLf+6AK~qNu+M`>h$|diZ<;NYGDi}iioW57n6VGDZ8i@{P zUp9HJ*FmB8avE-mIABgLhKW4AxZeAjb)I~;RsTMY>%$TfSE<5pl5Pwc`SSKhY@G9& z_*ThqvR@n>BJB)2nE>DQLhC6w6*$og2w?y2i@{s`CI%Ky0Gvoi;PeEv_9#!ky}#CT zer2b~BrqFsZQ+Iij)GMPl?Qt42X+C~==LBPTNKi6#F3p&`=VE4l8Uj=O3OxTE(`HK z27v7TN2JE|>}sX@PQ1T1MMcwD{)uhK*3x`JqM zABAdR=5cvf8>E8KhQq=a5!6K@Rq7YhjwVr?C<fW>v{Z)`YR6`57YhV$W3!*RMIG@+EEi^|$bdeI5<{SYnR2wpwBi^0bQ$ma%oiyZvhQ?{;zl10rGCSV^eg z=n7Squd92eN+|~AA#jWc+~!2kfDigmFkHVc2H_V5e*y6Qf1Np=4m{lK{B>^ZOu!vmu(=dCvBCqT|r5^%w0gQ-`3E zU~^JT7F+$0bqjSfd{yR!ZmBGr=d4^8qbiRU2-8ddsV z2s|g4>XrIc(8!4>XjEC9uK(}?QP8N+b3x2uFRc&Vc#0tAT=4rl;Ut9!1S3y2(6F*n zwDx^Lr}vdg6IB(4gT#H-1BSuA?IN#NhMPzjd?cUuo!j2CZZd5^VQFzFES)v6nh?_; zX?*D#)B!UBb-=90-FbMNFi>t||HAhPWt!RgwWh`i3muYgiV%X)8WEPd-3K8UBMDn> zt@(=X7<+p=qucm{W4Gu;c!uS?uJboX%(D)#fY{Z5BwR>;aE)wr=7jFLa}v?U)^d$O zXim(w%BxCGCDcuE&V9Q30;4UvNIFr3hB8;r@U4OlaP12cj6(LVTjdJ$Y!*o*1!&o*ZA=Kh07Rry7ucl#vf2)c}N) zQ$DW!_vxk{)PZd`#wq-~OkUhLTX2RM(ui<^JT(9*KW`DFRiK`06%>Q4Zv^V-P_^q7 zS)Hv8FPZPIZN)zQ!GO9O2|t_5U_07wcezl5WA>!iXDp1|}~< zDG^DqW*K$`SMiMtX(d#8C_{tCA?T$FCg4F6md-h7xT4YzBPV|CE7YF)o?WHywsn#r zw4Nfy=U^}dkMICmaHa^L0yVAxXcU2spp%dJy*!fku6LzqxpT0*)SMMI9lJ^)kfs<= z2gy+Yad^P?(mm&sh-)uLGwH@UGe-M6hqjl zTThkMpU2O+Xgl2%LbV#Lpd1@%%L7Q`f0`x=E3&uf0ovqIKTwlPw{TJMT&? zi>jTdG2lk~G`3!iy?vzf0MWh|0I>x{k$1p#LVykGKLzkXX)fromh=(8Ah)lT%+7g| zmtu;Cb<``N`7!<}z8;=Gzw|O#zYe1Txpo0G@~Zam0tDYx$6Bdc#31qJ1AUinkp72x z7f@{%8s&Kyd~ofgzWl^qpf#n7J~V6ZiUJlA&qC?3#jk6t<+hI4D=;{gkwZZzESG9ZQKYuk=Ie&o zu@_p@b>R~$t$`w}&=>=AAqqDiL>Hb019dHP{JG9mqqiJFjkvaYxQjov3F%yWYy;Tf z_+{u4SPx>k&`JjXxTms1+*4r+3IDpMGX1-ID#M2Z){lPQQ(c@>i9_d9=uLvjg7`^_ zAyo_ZXurVKGsk0bd%Z`xJlX1fN>$(f1mB*!x6G=6;uwP-OU>ngk+IrP90LyIcty=( z;#9u02IDf=LTY7F5;nk)CV*Rzsd~r|IT$M2 zpGf#vgesNGX_fib*Gxpg9VIi(5q41o$v3i<70 zSJ1xj&3ifRCF?EK&202&mw-iVqf&wsz3}RtKwsqAYa(rL$DLW+-|?{=%D(=f$W)P4Q7E9Q5u7=+H0Ju57M&5QzYphGgu+vOsR=*R@nU-7*T30wu!Ngnpv_RDR-7J)@2(E9_iG|Hdc7Hy~^rdD4N zR_Al3hzFk%AQQo_kf;7*ETG~STI+Lij@Fiwjk#Ji|3tYCYUz~9ie?IX0~%qwFb+#z zO?V{r$I|Dke!o<%ABKqqdn&B^y(_{ulP^pz6R8W5D@f1w7s=(U76zGI6Yf~7I-(z1 zp7cx2_ANWOEgcWFHAL%;racmk18@v8&a5jhDZE9UL<+okgCKTE&P z)?=V?=C!7!)>he)Tx%udgKb8XWI56R*&ljqT+vMzM_Wu2y4q};*uRgq8qSZlns9JJ z$Jn5wEw`Oqq~x1HGhZUs4b_mzs+~n_Na<_f5Ait=oPg+g8Qts(M%8Lo8f8lf)6X(G zY6+gPtR-UF6g)E%FO7gzcLI&ANv7MM5KYlvx@(o#snJoT2~Tu=UQEt@wR3B3sT1*f zxA$4t6}sB`rYxQ!3uPN~7ZuK=OEI_va&WaBemqGC77 zP0>%eAH?1Z5-s(+e;`~%-oa(mKhiOmMgRiuuY2)BfPg74N~p6;KqjuV&J?#1df-LR zght#1j1n$0)k&w2vu`xWFu0u}D04jcE(nt*L0Er#?1-YJ_S)`nCOMAt=Uk4Xd0+iG zufR>Uy0e@X8+djPwfn6Af`Dw>Z%xtuhHNYER9JkMwhRwrY+HYa#eT+j zUi++;7|8HP?ejqH6Egwp&u9-Ar_G?+=Pt6$H<>NG!~#N4?Q`@S`{#?dJOLq9N-eYU zE=s1xR#u#Ti_2GAJJx;pz@7;hlh)OPy+=Q9uE^vtE^e-*#-W?5NyN=nFXHA(9w}Mt zJ9KhoszFnaIJvrtVJL!$CJLQgo&9lgMF*W+`5;cNK%`AT9q9##R0psKLT$^2eE*oAbe<6}-WFko3VX7XDz*&S zM0Qo{dDJU&_fq6khMCT1dVq3WP~7#!512S;J_^NMDEDE5j!MF*7>3(QBi5mrUZ zeIXg~2YW^VCZu(6XB4;!{vY<G9tyOEN*LApcWl28dj zQbJ0)TaoS#=@co!echnX^StkzYp=EToO>U8A6v!;?+UPk@LB3Y1tgUIWtS@QhHJ zaF`g$NxPBkICtwgOpKJbq829Yz(obPnffQcx}Pw}j2b9Oq9Nt48F+m3kh9l_fe?P&Wh27QKr)eJ;TC^~U@tC0Gtv2EUi3_oZ% z7KekeuUTqR!aX}47cbpH?BL;&?sILcL7K~n!kos5c$mOQgY4cPxo@w;h|9Wb)0Uta06iA!?%BXOwFElNjP$llBaP2X4b!F ztsPOmPLEJ~h60>cLl~e}oc#u?4y`vE-7=z{AFnsM8LdZsFFss5Kry60aX96 zHFCEcradY#bkuITCg#vSLx+h#C>9Vm2jPUDi3PgnARJsJTcipe*^%J2*>lPw44s}H zX8Ifzc`Lhay!BX*W}eFw2>%)5GEx2u1>*mTU8>oL3$V{asBrA{_H2u{jwtx*>`I<) zO9U`gJhB~n5A6ve9+!1yz~Kke%<0mrWYe0ELd1J(2xHqpAOw^CM!b1oRaqGCdS$b+AYE)X$V1!*hgdT7lU?6GTMe>ztNnMY zp@?8tnj_=;Wm(44*y(-CfPs`#sd`=$zz7q84EoOON(m;eH@uqvZ-GUmZ~YHp5vhRd z&Fp`HMSz?U2*$s$A|w_6bymbO<$u76pcen%!HOt0{(qGf$v!&lrfvIoR)qO~nH72J zI(QW?5BxX=vC(yJ{1vI=t4N(7FOrcbpe>Wbxy2OI($>%0ux$d!y_#Zg3;3MsX5QrE z6j_hT(zpRGXlw1D9)k*q6nH%j&K*3UPg>|L7lkE35xvk~B6>KO zh`tmiq6enNA@U+MWkyLax+dsdr?TDT+0uL3=F0QLI){+o*WOzj5JMjHh4=k{~K_0aR-s+diUh@Qog92oxWI zFAZW0AP%z(=rBMCAPY%+z{eH{KfJ3xfQAUR($8~I%@zsnU&_8pxjdF?GYh>lzl{<< zq*Hjl>d2(8qfRIPa>lj!&Y|Ef`hYZ*gfid=rXWY{DUUa&ESYkFhoeE8kzILQM=dyb2+dO;k2w|6HThA@jB+&%f7F>3IPVxeKnj zY=d|$)W=r|w8e;Ykl}sL^v;0UVk*dx&HYF2B0ewc=*?8=MkCgS$Ip766HAVvcZg?V zEJKX@`cm30G+o5y(&GiGv4^Nyv7e%AikXDh6KAoPWf;{?eLH!}cUEE%qx$;;Rgugh zCYVJCuL6>F2B_-$1iD6uRG-RyN>NI`+mWIqcT($gkj#g+J7*Ikk|KtuxT79}2XFA% z_N>oug`|1wR^_}9Dy?g{74fcDpVtdXHcP%1?-}MY=2VmSBGbXpTIAQ}<3#-(Qo3&x z$AKs$2qmLAJ|1mdw*&hj{IzOa+(-8DFLlfaF5jVxL-6D#W#e*M$L5Z5E+G)W1bL`b zY1bl;YLzcA_1iH%OHC&H64$|LzwA5VD);wi?WKRIVZbn-y|E9>4HLP;Yy6ACvjHJ` zZm0L9!YU3MJ*PVDF~jTy?E$5`5G=&GinUS$rB{IMT@aQ%8H#j7Y=kMtC5Wt8ydHMp z{w+Za1|^7#EM*Hzgx1V8S>oDoY4y_N>Q{d-eQu9))(437&0sFa@F(m2(4qiT=!d z$YkM+JRa{DC#sQ-G!nB%O=A6e6IF4oBh-C1^W`@QihTUgw>&hPF5IHJEA6rq`c%vb zpKN4;@>m6PPOVva+VTWevU+mBg7%JXOx#cNTPJ-KU4b zKfSDASzNzL>&XU~Ha~QmOA2yq*ziQbc z-E+Ha+i-AIwhqHooJM9bG0%a8`S6Ch-W9MT4%u3{u-Iljm{&&8g#{|XMl)aQ;lKBu zEF}@21WnalOK0v7?tx)GU+#ioK86n$A5FW{*BRX8`7}mv`4+qR8kkuEJ8m%zkG=%s zn9EOL16Pm1Mt}fbV#nS4_vb#Ia0VB|6lsM#f`PNJq0IiKKnZ5O?%<+p%rcf(R~V1f zc7j(NrXiT-V?uw)v`Dcc#?qC7uCrEJW&hMI;In4>5VrP>ti079xR{Kd4<ae%ZMX2qCT(e(b!YI*}I=$Mo&m`-?xC8L5aE4nj=Q!^ zt}cpwF_gy#i2&&x1Uv;qVV&o*#a&J&zaoA}irqO9J{v|8@#iNo^1d_WSy)g%f0KLP zDbZ$u*k6mI^p{<+O(6fyNTU#r>#j556~jIcCTX~)q#O`@2Z2m2v7c0i`iJXz-%pS8 z5C8RnjL==OkqY4K4gv}EUj{G#v$;!P)qj2N!tmjra~G0-3|=yi|4Vb19?kzZ&Rwwo z)42;k+W;Yc^go}tn8Ywm36%qkkH8h5{|=(Vbm$M!@rUU6Lv;KxN3k50|6h~GQ4P*wI${CBHpz5 zi?tq89lAGRwm{fCga*z7D4hp;1dKo7aYbB&>JI9hmLomjF9ri_sxur|s!RtX22*}q zzO`RD@)b$21JgP(6_alN3hSWY`?s(TAaNKXOj<7S)s+E}s9xshuq#}Q3OFi9gYgA7 zdm=S7z|kA=}QN_^=24LCQiBD zIgZW|AntLBcg6zB9$Y-1K z=&cteVE#pr#TDfjj3d%HBd#W#9d)%V)nh_q;Zu^OVhar?Wqh#EpJXPT zq1Y3Pay-A(F zoyC^*_`RaATN1}&DHMFQX;i0l=P=!(flwBBJP!H;jHki~>dfcJ@C5~(e&!-DO$&L*G0>8>qBNeEvtCf4z+4aiDIyFTy+rt_G9PZ`yli;Z z*DQZ9BZ8C}^6fy$H+3KkCLcRp1Y!{&6g=&VvLA(6-)lsgt&L7WG+YA4lt$gK=(%PI zbJQN2L}|cDvAX8HK*16{9~;@M*v?U2FX!b5o$loYitZ!O0uo#x@D_OpVGtUQM$S*= zO!u4E?I+2Zq|`ugf}ahMxC3DWGt)pn?E(rfp@}Q&w9%@WlR|IS)g6|I^L*Mj;;$!O zF$`5Ta{}KFK^)N;5g=co#n4 zsud&%8<_O!S5boMs#8ss*3e+uRmu>5;7I4H9EdxHh(aCT5*ZqD9GnneH9~sG()}v( zthMhv>18S>jIM89U?+^AL7&Iy7mXC$=rUkD?ue;R*EOy>58DIHsb1cR8+VkWboepx zKmMPXQv>v2=2VD|O{{ynsDDCalL7wm@Hz3^( z@`Qf{YmtBXXbRDOcI)WB%%BW9vvK6jKZ+yw^PA?i@rlIBfk z`{okr%3OE%pG%snH%pp~IBhpOFH1iy_jXblI-(sGp%ptk14mCz_1vR~V;Wz& zOHMEAK8N3#lKTL6q^!RhcC}a1cneN6#bo^3q-v#uMM2@1Ob}Xc5`}7Q>-=>A=_Zgz zWFcH)-&J@L;3b(wgkfJsZRmE~u#7BSyMPChenP;C2_%CUJko|(7gJs@5KWuETI&%5 zkF;)Ec`f*;yeuy@fWryg22uw75ix9$Rw->d)t^Rh^BOwKX$C#^zpiE%p&3|m>m*if`H|ImhZrn|oLoHN|NmnVc8g&HHFn80Nk#3w<6~N~Vp~Hh-xtvS)1y#^~;|jvbf&*)j5jNNce4Qb*v{cribRigmcbms6 zY$;(0t$IVIx~TGIh~Ay{aW2w@{GL)R$u8KJIlwzD@Ff5n=+=S|;VCTr^Jvqg&4IMs zvd$uW5B$)Ah(JkFKp2kXHqiePLI5P)LA**B+dZdiNWDkknLh}ruiZfEo85tDd#dOm%uweL z=*Jvf@!VxOimfO7pU7k+eUJ;h+WQ7A*6xwjr67p5G0Kn))Oaxx?gsoii%TFmYh|Tsy6T{Bhq4(fYP%s={{)8M+O56Z`=^&QdWKm@{hfxpNwMcFz1dXVkkXb9x$HfR&-vg+lL!E67SuK>QKM+ z1fO?A8u1=^_01tA^6QYQtVRlQ`IH8am+qF}t}yWUMiO~Z*YWYGGxoS0w>bSgpo5Z=}LU;t9e5FMFn0Ln9n81#KKtjW5Yk2_uOe*9nbAwR#Wh&yvV6)n?7kQa6je#BuQ4&z#}}O$NhZ0hXbE74*Yv-`x&s zVy>?TV9NT)*Mdt!VV}3bC#%C6u$1+cW$G+SYxk2=_gg}!*Y(ry2R~;qPZ6%#yY;vF zN5n=n>#vn8H<&#r&+d*s(54nAL4a;Hd~2N!7$`lTN~C~gMkcgfvu0^9)@-*|czk}H zg=M*w(0ZUIOLi?=r4`n|{SLX$FLcwuEj8v;!+_PMe%ZBWk=cdIdR=Lf-`|<4rRmzU zc#+D!*;suuFMg7+nW?z>G>fT=l3jx2+1)zmmPEOZ{9QEl&UaWsZq$}|m7#i%Kf0R8 zc{63>eK~-dS$>5t#S9cR)xcC2*s_S4Iu`U zF^azZ-O+u&_$jVIE#__Wpe)+;*Mt)SVa!Zy=OT`-QCs{!GuRciP3%~g$ifxXP+W>s zXL~wdBGRnfzo{{y(yIdv7^h}|n{>{-SRqeJsiv{nHV#EC2+U&23@vVRdgY^uYEON| z)@^+M*Y_{B9^P~HTGD8;Gh1O6wOYqWy<4+r+05iKpnAg9YaggqoqKi+}UtDj+Yuc*BdUkX_ElLUX{&AOF33 zW(}W83TJgM(FYH<6hOcLq5?LA93{YW?d&$-Zwry&Nqa9#9qh$enxIN+;aX?v zqOEynsr;!l>&4B`b5=G99C~Jf%AROY*>jVP(e%u2cuO6)vIP&kPr#ZXL<~cZ@H%kK zc7*L7;ZjsmX|OKvP8Gs;mqJnw;d(v@Y^g%@5$nG!ux~}u0E%i53OGrC$qSN?T}dl} z2b-~lUeDM#VL@ZFNx)-u$ZG^ueH2X~#v8%}ueS&^dP5lD_1XXy4e)324WOg}$$m5HAL)?B&8sTfa`wE=;LZ+t~7QD~RN zsY)TO0vA6~mbn|I1h|VPKI`kmF&SDiV!LmQ5MzS9xu2dvv8&Y|>JvZKtREc@LqEs7%mYPT1$IW{2x$GXZ zIBd(kigbuI!RK?`3m^1?g`OGRR09eMIxdT`oV~PX^(dVA#$UW2n;(YU&xb(B5$xX) zzOQBv^w_)aMROUuv6<%3%3`{=sDzp2kYPK*NnSnQGN#bZXxD>C0v~HKqx5hCPp6ky z*_^p3M(b&e{)TZkw6S+T>1YC;8D%Tsz%eTJSw_p`m#WRXPrk>%KKolqH{N61jZx z3qE1;dx{s3<0eF2IwFMGc@#`h7x}89R4kkX?Y{eumqyg`c1Zp8;SXZvUQImyUQYAf z%3lBE>pHouc3JH75JhLL`Dw_K=uaA(b_yh6G=H)MMnt$nMxoKK9~!#3pXSZK9`(`# zn+&CEk`w-=i%?WT&akTDr0hN3zS>-0cj=oKsG_=lh7##wa>LiFlQRj+dzeRv13zGG zh8(cX0P8Z0qG0;@|0IDgCMB-r@wrIVzz7W%ICVXBW!P>Jqg=(h@4lt0?J2|CWGZ|2 z-K^b#nqb&F-g10NuzwM{=)6F$D2@~^&;-QT2n2T zHaI*>S-Sz$V!#hYCydfE& zln3F0%1_n>MJshOiRA1Z=l0K(hF>O*K8~GT57e#>dSLNkx!hL3L#~ao-0DH5cYe7l zUn1Q%j{an0AV;U?=mi2n?Cfd2IPupAOsf2D2L{sLFS7Ewg zkuC0C{*vKg9TqBi`*yLWP?g2dQy~hb_a@ql-yHov*FEj>$KaKxZ?7Drb|qhOd&b6< z8Ud}(CZ-Q{VA%0C|9Z=NQ*g$2ZU${JzJ#n`cUZ_xSNJx_LS4Mva%Vl&#(=pbFX9v|a=! z8)G0oN>8R+<(cn&gYYC;9e=%me-uyYYtH3PMD}s$;`SqCR4QEk!QHWNZ=_)ibW}mL z=_fokMg%Nzkbl;df!&a^Ebh+)f5`Ef$4^88QtQR?vx=mWSTfGD8pxVdDhIrvy)e<= z#o!oxRg{T#=(fI%81|~!SM*iR#f<)gmrAp7=AtVi8FO)r_0Y;=VA6f*mArru2x5@Q$nt9IZLq$GR4e~$U2W7{G^Bih0MFQLwOf-3Ws1A?Ge6oL8xH=!Ja6AZd(b(wr9 z?~9|PsYS+@T6`?I_RvXhBR*ikf&bIIt`@E(kLLPnnyyMv&kqcN!lEb9o;-5}*VlI} z+<(-#Nk$0~)$vl%B7F`P*pxBjj^)T>{vH-*3>)}=l*w-Tq;vwTU+kc6!XPfnUVv`b~@T-D`h`tBuyh@`O+bBvQm~40G-%Q-&(q zn1T93rSJTw;MK!HfQZVVv=FQP{$JI%rlI96t^MWWvONVy+dCO_Y6Id=7!dpN*9bT^ zQH1=sP;ZCe1rs22&=0)fzZ?E}1si_z4CQ_?wA4XD11qkYLHJ5(_==r5TKB^9XyIR8 zVA>ZxEO=F;8s=XHCO9R}Cj-^Y(tK(xiTfXM8*}vuVaa2Q2_(~ARup^_Yz~2mvO23R zlsr|5h2V{L1e|{R2SQ=vZ>$_ZSag*}x3eafoOffhV4t7^v_M;3kTX((W<);FjCk+0 zWmC?^C}mc^g@v!|#kR}8Zn4P-5Gj3o8}3k(0B*4zIy`GxYvR$*cDLp6tQO?`s^H5% z2isypIV7C-M1gIw*_{tGH{>&dSqvQ6ps1%I(_Z~+yS^IC1O0DrDh>E)%2675k=-XA z*xXXdcOIHwhSk#pg2E6Ai}KpZESo!y*M>y<9GD?-J7P#3+;Mx~3%tc0xb(T%aeIA4 z&2#1U_y|!^wx5&}W=Lemb;d5Hdv^f&af0UX*Nz)CxZ{TLYsc;O(9g?L&3j-dLpA`0 zR1iTEUfpMM!BH?MlNX!Q7K<#La;kiWO?4 zzaWv$6L1_+_OkC3OE7gXk`1PLrdjG?3_LS%^rlVi{vE$Sgc{Kgk+k!swa{(pzOnk~ zD8H56TK{eJp&^JzcZ;~z`m|VmQjBU@VHvtdoa#r7f$ec7BkY6GAcHp{gwFsBK7~*r z%oH;60)h%44`zeoNh%5xIp>v45yM2z=S*o;Fp;x!wy$GFp@PE2_h;-^)l9OozeUc8 zpvd_@X{4Me65HYS3cvneZ=^h^a#+1xeSyq(8ynD z2q|qO*z2<>?L9n8;Egi9x={O)i6(Or&YyyU{KnV;KNQtuV~4N&PRB5E7IH^d2Ay&} zk*|AA&$iiYpB!UkVWJ6(-f?A8N^UJhnToL{5o?oM@X6Xs7rX#u4I%P4k~)0rve}OJ zY*U%ysA0GH{Nx^QrE?-!$O5raZG&7V_{5+^42yrFe4munxvNkimE>N6iZ9TTu<-god z_Kfv@u=LT*>7xIo7x&P;cT5iRNQHt-a!t7dh?D7bd;?+2fJ?lYL9s?+il!~9c8`RP zsrq;aOiv9ww}#M(Ql0Ol%1d!!Pgk>P*M7Znc{v-=$e4Abo=#H1ry-xs_X8ZtS=Dgk zlP_0SIoY`4v#+FnZ_+2u0<{FaJ-{FMs1G6i(`Wk6`b;)WpuZNTRl@?c zYWD|kfwiA}?XHzO8mife_YJ~=?NnvFU~>%~)5fnG=Q8Kbjq~lzjT0DfhLFO)i2(MUA%yr$|Ee=7OdJX@ z@@F4>pb1O~fdq<(3%F7l3kYh1ZAwbu&>ZYE_ib847U0)kC)iXa!4hmfL@H~p{z#~$ zGfXhxKRLRwpglWGS~&$RXr%m%EYJyLSb~jSyLv@|UmNQFyjaa&7PK_bf+qdTf`%pa z^JLkO_9YQ~>~olzWDAJJN`RS3;tX1mJc`LYKr;z+1loFy8EJ!<5$6LKX7nCZ<=3jv zax}3{*DpFvH&G3plrQeXB5X*7h8un^vJk~sXM7yObzValqrbCU=pWlE$>!yJr?2|k zo;d$U^T+dB_RJEP&wjh|mj|CcTSzo!23`3$&u)aW^q^3dcoyc9g$o7DQXul6^s77t z!cGXP%Sgn2^Fgp*fq#2N0Jv0$IAV?Q6cWh(0GE~!5|Y>ASIiXpU3cd_mAJlA5ueM> z;`|)_Dc5+FBO7t92=G{e|IH_WwiVb7ehK`Ytqdk0JW=SIr`f* zSfsVrPx2N97CFPuMqodnwurzsWe||-CU(_mUofj`y)lp+Cz)W4s_OqTkjS^#Poxrj z{&ez`+qYq@-F+doX%pNDqW`cBIYatYVZU^*WH8<9J+?(J=AnNdb z0f3eY*mlp|N|4SpxL>rQ7J)yz`%-T#DWGOsFQNYzw{)UnZUJq`0}UtHpy32>_CoolyoI2_NFZ_P1)}1WgMd8Psx;$$4HnQ1d$$Zty zzYR)e$&&aoDC95qe-O&wjboE~|I_fR7$ie4Biw{zOZ7+j7hz!a1sU%8xm;<={ z5PdK+GidghLc2H@A&hQWHR28L3$~~!F{YP#yezo_$&-XJ;00>;@Y8&^_NOPi*j{J7 z0G2UpllVYwo^nY9QJ(rwHJ}Zf;O<|wVc?Fb_w12P`};)()H-AIB(9tL(;%2{1KywX zi^2QTsqRhrd<=jhLYYBRN23&%1NYk36{JxOW9l(wNzevQuJSvKZhYUO+kj3|WnrBP z>H5o#`}qS&&@<)~$ymDhFR?f87+5&*!CMp!9U{+I{;rv6e<0@J?VH*n)%xjK2;0W} z5GmuE?lhGfi%the51dGYyvcV5fKmp+4aWfJ$v_DBV>eq$8DhXy6NQFqIyE=54t{ZR zMzZTF^@??S&PC6g{@FP_YY&eFu}5F!#HIB<7*b)CGf%~T50KP^@M7Rn!@_E?&egQD z42)X7fnha(qAx_tMjl$IiwgQMwr?Sf-uhLbRz2WatIjtUBE;s?+itluijK+hg&It8 z19Eb@G3R3f*{)OEq;68&u%FxdJ(F4UxK44~`^j^u{f8&|!xR1CiT?0Je|VxlJkcMX z=zotVn*Vcv{sD6T0J(pF+&@6>A0YP+ko&(4_-jxTqDu{PPk){;5^c=14?9JhRQ#dCb9_5-1GVPpe%cK^c6&}yC z7jb(OleT?gV=tkHVBmt;r!=NsV4}Piu#Iy z)ntCmIDe?>D>xk)#TI(LqsD!=fMYNO-B zF6)Pkhp+01D*J}>sJiB9)=*#LPJ>H1Xup?o1h9YH`Uw?4&=K-dc{=lrqxd0;thQ6G zQ?6F;b6auuWnxBUMm?-oGNm~|Z2VQ8bjQuZc}ANpIEq3|RCCM5fu0T#ZGvpnqX8AI z($6NiT4j7E-aSfvk7+#{IJp=i0GobGXC?m3_ZB|7`G;v|! zGg>uqqED^8glF0Oo^2~Au0F9oQC?E^fKO%EQn8h&UyGDy1djg@bvbXlYi#?Z^sIZ0 zGA-6lu>7q14XZ(O%?Rc#BO#)Y#?dlw-I5PtwtdS; z>X3{ysUvx%C zzS=jT3DTcV!Y$e177BG*-_{b}^SJJQoO2clV8F z-zF~oju3$+F>NDua{Qv0qiSqIXW7oaBBe7YL8d{lBLJ}-1Ln4wN8^Y|Ty)ZXjifI*dX05o=wBTQCdP(FJfh+vjtkgEB%}I5 zt1l__esy$azl?_yf6{E_f#BT2vg0RaRT(Q~`O>eYBExfSA%XlzU)Q9WP1@iTy*hdp zUlAsXTkjHHM#GsBa(I5f)mzr%!+uG&`1-a3!wa>!{hndmyEYYom?Va$1~^|3{ie) zOM|xP=cSXT^C>T~!UQ6udN#Fq@_u(iUs1dAZ1tt4#UIWxogA847N4=X?!?X# z5(?SdCqI6+(&XNDpAY~6XMglaL7AKO7W_-OLVIY?`s*Z z{c15)rpC+cvkhc!eh&+M18`79|-z zp>N|`zeoOc(dwj@^8IE+t#kwSF;sJe+pt7bO*-TAUZR3>T}!Rxd>A{JbxtH-w^5t2 zs>B&>wRsRA>>r?yRQ%p|^^(=9n_$EP{#>P?rU9HK06ZsICjiV`05BRft(V9Zdp zQfAOl$i{n@Or^Wo3CfZ5rtdpm~l&YthyxMu`-o{PQQ%>ip!(sjaO1?lk~PO8X*gw>tX)$Rn(%etD1woFjEi_g|Yr*!f5lUUq?^hA_(8@&ad^n^LnPQ}uNhqu+M_cmKH z9x`d2?r2NyITd|jL9L?grG`&KvZE*sZ-#wfHlg4ST+S<1f+Il;pY29*8JgY_k+Ff! zQq@Bv$CAUdEBcLzr`K$piIc0ubIJ%TIX>H@k8&3}Yb-Noc5>|?#DD?mHX?2;+R9_* z$kcLm>wITELh%m?o3AvglfD%Nl9Czg)M;#Sw& z668k?V#~TdGn!(?xHw~twaL`LS7WlT$UB9iqa=BMKu8nqa7s|`^EegRwB*-8X~WI` zG1}kq!fP^1mxl`zgT6BF_;!w_I!NqPg9?RqDAQ1|gg`LT z*nu|D)!|ran51EZpu+M@(DkVz(L%GFqROthF4b`3MPlg7UE=%`n~mm$oCFnGlW!Ih zn~(hmwEFsERd}j4W`iDGWRv86vo3IM1G;}J341?7=RFYO=z81Z&si2PIm`s zf9?C&i!wg+QuY+CG~L-R-TKb^J-+it$FcaEs;`{dCj`wn0!9MLG@mhiK4}KT)}JeW z_C(^2P!4IA&W_`=WF;h&OC(J!C%!L8CXko8GV<9jlfPO`o)`I1Zil) z#MlmB0&T9X8;iXtYwyQ`caf*f;0x)UOb3ebfxvfPd2zPq%DlUFiTAb+8+S`;N+LfU zc3d<)$faNSy6_<4l7h%Ym^3($NFT9n`#5I2990b55Tp8gwB8JV= zAI)$c^{A%{@7Y4)Cx%flF$mWPjcHS$qC`yJXnrCE^OL*Vou>UWvoU2Cnu;+Hy;UB&;7YA12kOS6;X@Koc-Y zFrSj|o21>J6K5BSyka6TQL;vE^>-r0C^lrz&+oc;q#M3m%%G85B=?LyQk^pNQR5e! zQ3Z*XOawtH;>E?~%rAk$*$J75f+T)^-af)@)CUu2q1-PpHgCza1o5{AXNZz6xym7l zFND9o7fjYI8!V32{-twGEeydx?+3Jy!{CWV7poWz(jjZ@llwWho`gN23eq?=tBj|8 z_TkH$&CzrFrm^9q)y%oR(lU#k|INE@DdRs4i)Lrrs^z+csXY<<6xz+_`)~ z1HP6LeQ8dAII%d4vOg4`uhtjBhSEjEC!H#vjHsS1P}*%|l*9cvnUe9gC*6{;9FqlN zksh*xgle@R*^^m6*H58&_Xvq~ze72yj3sT(x20bO;%`xg^7>0&851R4PNZIvaFR~? zm>tD`lH?>kQ|-Ku2YA8z2UJ;j+{QQcz9qI;NuUrh<%;jroEsU^N~O=hsxp-0KN!P= zhf8WbXUvj6rWaD;q)JqTf+G?@^L*hhB_3h-NB_I1B$!nnZ!I=2LReSLi8G+#`{vOV zZsngaL{$T+oy8g3U+PTQONC@sq_!lij*uiH$W4ZT9^II1f}9?@#3 z#<>jBU^@scvic>e)l5&ez+LYJsj@H0RfyE=j9c7^V(pVsC@rZcx6S7Hu)4jSGJ4-L zCxkRW#$F4fXIbgmuQ&RYS9Xp;33P4Ki$OzOsm_aq3{8kEVl4qO){Kqg%O9^TA5V}C z3#4Lb5tx}gmp&0!yS4H9`CWoaN;f(stho4lD7W*R3>9w&Qx5aHX0t)~;qbdH zhT(Z20wIe*{_hzwBJ}xDd}h80$5?RpI}xYVl=p;F9OB{(|AvGe_kwf@ zH&6Z3z=TJie6yQajEX3i*&cnCON@55@?iz_de(SdozMK=r4t6FCk6&)ET8-J4hD3z zKTv-uyD6MI92h6I4*%&aJPLX%M%3v!r^=?2a+K*$75Ao7g)c+|iCF!o)ax~``QQ_S z2T?`&y%!;Yf1t$T7@rG@1o7Nq+8{5Q zmd?Yn-e*jpIr#o8LjJUaAON0*bI#6~y<;XY+3VTI2d~Y2wV$%7G)}J?_-z+)KttYN zmU){lhenff`c0e~FNbnX8b0KDr7Wiu%4jnQ@sD>2vorBm#M3i)cP{o;^;FAB0B4#1 zdscCM<-?JCPuYcDW%ii3L3smnz<^ZxMhyIAQ9`rLUUZ;b9-@ zLtgpMicC56L8dM0;DQGTPBT~tdeIHFwawNC!P4R#Z{{4n>*k@(#iKtJ$ z!cVkg;L)zGugsNSoprSrLGX1;J&f+|$l0qQS{p8{lXb#)ka~QbZOx_6^?|527hPUJ z5N&cjVcSiGcw##refobrIn)1rlv3t7ocEzQYhhEZp z9)m%Tp{@=))w> zR-Flp&RC7r#@W1RgKzMo-78%q%eC%}z7295 z1eMgeC2IE?xL>v42+1s%)Up?)6FH1Yri-X2c$Eu4Q zwdc#P-zvXz92aY-is#sJukBHU+Mq6DYZNEAR>upgErdK&FZH?CLHVkQU8)1`mR?}s zs6e5&#!1nxq1vpe*b0xEs8epiGd1zt!s5jMDPVytK#>r|g{KYoETT!CZmhW|KpP7A z0DG%MIkDxQ`RtU9Iup#ju~3gj>9)cYv^O_$E8ZdV9jK2{FQ=`!8fJLMc=O_a^F8}P zr!%Rnn8(2G-I+D^c;Z{eZdrgxm5i^~Q|N@A{x2y#4n5CV{PW;uvh+wHEMF zEpCJvAdkR_J^_AMl#oNPbRxpWp=(|yDkdodhsSENLoMLrOOy(&voz`P~ z-!_z-$F8wl)Ttf);rgZW2i3@F?yF{J*9;xTJSJ-T-dbo>OOQ3LFU^}hnglb*#QbJe z!fOsRoJP|-vzv-MWIhX#NssA`HCkbBl}!;CV_q9e$sY2QZY;GX;Y_G<7ZN5yhHJ`< zBXohiIng-SLamuDj>$%8T159~NfNB3nkAawYVw`ZT|;Uqt3>};Yupox=@v#Z3_8qEqdI4@*BO>96KT3!2``>fYYZKURw9@(ZYsw@*OPslg}*LanLRYoH}jjfYXPSKKBg=F7Fqs$LdXUi89-L8!>Y+ zm~CXl)X!cFIxGqFZg?@*R-G|WAE-0CTQtONCD`>g61-RmswVjq+&s*RTfbrBhjXdV z-=3k69|X53_*Qq1$<~YIMdb8P|J=GK@P474>@KbZNN;~$Ud@xg^cmU%lVN=i21px2 zp>h6*c`P6FzD93l+wZSuSf`)UG{|l~-?|t4!h@(c(Qow2d8UiHd+|MqbDH1D^d}w5 z3+LvX@Qpv2J-_|@{@UG&-95OwyIV+b zw*;5qOxz*3C%8+n;O;KLA-Dy1w<5_}d#`fZHjHhuuDzkT#)4C9)t{d|14 zK`pFHdu=?!a&1Wqx+4VJWjM2+6u#_#b(Q&(w;yX-o}iy~DlNWcy~ktWAFTD<`3pD` zC%fe_6n_fy1K0MFKe=X_-^yQi%Vm2n7N1*Z|{B{A?jwI+6)E?7*a~^WHfQGNnaOvJ1fbg zEH=@k?LN6F4%1dyimY1|GKpx-Ca@~@uB*_Yw{tWCn&01DNz7xL>c@MjTuD4nwf^|B zXWiNN8o}t(Xp*)-gxZAeh)DW-de3#~_p zYQUSFOz5V8sq^VTA)rJ*L8vw=a(K{R9Vb zHr;_{*&iB~8twm9!vcSJ*#C}(-6WwL;2NYy%{}F2h4pvLg_4w=&u)2&?*9$Vzvvk{ z{V7Ubg9BY8{Pmb?`n;15RU|$(-&&6%Or>l1txqrTiGLxk0y+u<-rCZ`Kyq~VM z3oUVgpO&a?HdC#UJx^z-q+!k2(TcTdpda7!g`HPY_49eRvQrJl4E^(4 zf)SzJP)0}M^tyw-= zw}$=OEG+O_!~Sg+7Wl1U|9`Zww*O*bf!`YTZ?mw#Zw>pmSyS=29+2%jK$Q@88MCqA$C%V}mIT>73-3+-d?BE~hB|ym@F)0r$~1Els7nJ@Sk; z&)}&?c(6Bwc$57TmL$`6~>?WqTU6yVqj-!Go{oztUmsX7qD<5Ln%Nk$uPh=)a#d4|DU>wmR{==&_JB zE$j#s5O*V1bJ!b@wB`rUxUw5za8-E9J%gY0dqJJGTuFt>cOS05T&~HD{M-`nSb~OW z;g1oA6Xi;5{yJjxRa4?aK}v>YE^3tDyDXuQl0qTzOXOAbtm=!k%*tb{w)(~IRuN}? zP_=$MgFZP3-aRznR->9xk`~Omp#JDwG@OC}OSg|G#*4j97{LMC_-ZBoIsk4wuu$PK zS~k7&b(&m1a~L=*X0iRM&nY&vCo>dSm$dlX0NBuz$jAze6LKVMUJwpZQl${WG(qZU z&)SiyAlzO$+f|#8moyB`I^F|3cOiqc3E=ha2w~ z>Kz3yA|cYZn{4r;9e6=&OoiyAuqdiuXl-Hng4Q6fexY?v;V-lfFNXSw*5aD?CSSwp zU!1f`(+gVrHvLy<{a=u^LHSRz2L1)Dn_d46TAK&{6|HFt-_w8C`i<5L?|z{*Xv+&) zkEuWzXM3^)hy4Ssf06Z)S*+Q)8GI&8|DR;tErGoXy89D<>pqeHJ+zK+ z;Cv|@Kz6`!!mMZPRQpSZd~!@*3Wt(CqZq?tMo0t>=Z^YS^?wN*tl<6(9B6=rUxh>R zJS2>i^&f>pchvjb$V3)72uuDb`OZ~>BHtL*T8l426#wwiFCV96ZRByUN5sdCrrC(h zISDgmHhOy$T`SQ=>6eWJGwu6YuP6>InR-OE7l@L_Yf7svkWkIZc_7{|V@G=(E0Y{| z_|i4CN&|RTNN+vBBto*Szh>Rv4a~gwXsa^&_3bw*9q$zU{Phs&34gp}R<O|>OSOcq0-EaqM`bY;HB}_6A}mSAjgi^uC4dQ$iiP?yO8$I2auneN z!h|GE0e%zV0w)L^j1$rD!Rkwrp-ue0zbt85t|_pBEKjmuQ8vH`xDgNbiAluArXlqU zUx7!X{fIAzr<*-{XLB=0kQQOZdIm*odvaR0okWY+SV%SJIG1U8Y}h426ySKCi(R?q zL*25zc`}M9o6UY5`PA!E85J>>$<3z1*_(AbKvU3LU`T+!1Nzy)2E{=Y3F(EA?`fr= zu>f=~bwkD?@DxR4QKT$*_8n?gFmAXG*ahjLE(w;XN4fdObv_YC3uRU2jkL@S_ahi( zEJ-1l(;r`9yygxnkB4Pcx``xmO`J>9sVJ%aTcV0|9vf@P+JtCT>J#WGJD9k#t<(J` z`Ky2D4F~29Bm-QRQozWA@kF^szX>o=ye9_y(?|c((UGTcSXtT>O6!Ml;%O)09AJ>6 zbS?9p7GVw049Axa`20h6RoiB{CS5}<4|AIDpAdBKjjwxuHVuEo4YpNn(l)#~$(cyn zQ&rF)15*+HUUwnL^BM3vXVrxSl;HC^_htON2Zr zS?MgBIAoW!PC8`YjyU~p8vckIToL&|oBV6m5}|88eGMtR0?9)&77#~XgM!)5hd~mo z^UfjQXdcD+r-&YQzmd2&;SBR?peTmn>p)`9ecQDHCYt-Hyn7N!HW3g$D51<+7F~#E zJI?;gQF+qD;0aQrXulixLd#J|Nn^H+s;$K13MR+sYzfM1w8C?~JhdsCilYfGGQ^jQ z&7~%78g0yY;uXkK-91Uhm&Q&?=k0bk%kj&J!Wq1PRD%uTM0;W1I;pLETaI2hYJ1a{ zq~T}V0KCKvTbHr*N7=B3KfW*6E`>`GFMqJ3eJ$Wk>ppD@I7ceW3lqjnji^m5!8!90 zWPN#cz@Sc(Rb$v#qC=zJS!gn~KKORhCEIbHx2~Nkx@QMwT1qjUPyTGgnxvD?`{VL( zn%;;j&&tAX&iifX-$}zCZ9}u{b|v5+AoWnt zzeTj>Qd?nTUr@i}UcjpS>+`}8`8V2K;4zFHB48Pu1e*>)0Mi*Jkf#1(qJN8Mykx?o zS-bjAYm&tE@b=$2+(;$&`gLJeT8co)mPD1bgV%~p)a)J$G!?af7ASun9^AgJsml4R ztZ8u-AyH;nu`9A<4DOH8!}yGS6?$0lPZ9l6H!!Jk^e$uIh=x~@9kx0Gc&}PzO|&^7 z6))iW`fVDk=#~d1cR6+5e=GJBnLccCXQl~-$MW`=ncyRM+gID5r4yXTpknz?5uHALBUgB; zz~>8WyxfSUrK~Hj5$}xa4?D?trzp6hL@@wW(Kc;ODe#_z-m?#(aXQ06_@*8EPZ3>> z=8Z{Ndikw~;W$-t&&a6@HJF|96ke`cYxT|GJQwBGE2J2^ckUd z^d0WU#I6$wI)KCRBv-HYhsNkgfIlEKNZdr)uA%{6U~2f%H2e`atR<8}sk36iH%8Xe z)8l(a0#fU*@x0(_+7wADG#tOLR?aPwKwvd7C0vJpy98Pu7Pr3q_f$0S7Z?3^sA%9X zF8c3K(ZF9^^xvVPfxo!uze7a>e{s=&hl&RN;-ddwsp$RM3~CaUapL~yS?2N7S(^J|VMpU5uuMa@=$Rha<< zH4n+;mg$|Q%C*|8R~Zi@7rKWJ%WU>f6}@S>P*o)&=a-_3-5SlSp;-_)Zr3d3wu}Gs z(1Sa9UoLvaIWHov(lve%!Y=YiAB*YpPfz_@SWgIjWx6YIPdm{h^?zG%zNLW-Y^XcE zafI8$3)kiOmWnne8(fPQ;fdI%F8rkhICG5eNT$&r&RQoFJOp7POp*O+#l2xCUzd_Q z-#iaS1Lj~5)6p(#Z$NK90qH7y_wO?g59RWM_f}m|Qy2Ep%+PEzQb^7qA0N87>Fz5z z?g4>cz3}gF_^coTo0;(v0wgDWgLR*E)j|^+v8TB4tx0mR9H^Lr zE;A$dbaR)HYFPt<{#riwTf#IyFeQi%bV+8;un(Zv{g zb4-W-r^*BPm(0U+|9_o%RDOBMJQn2sk$KRk{%>X;KP!*=+kaDe0RN9O57mCEpP2`G zKkvU}9{;R7_WcI`T6q9}W*)NsjQ<~I9{*|O0sMC|kD*8l{DM{Xv45?GC-m8#-`131 zvTD{8-;J+q#Zj$pm1uhPB6fo4HOUz_`$_!38i;efr4>jzoq$ zTE0V#RkfBj;L^^YI4}u)m`N29n|+#Vsr;P^|HA6D1E$!tQ5vekF08KypzYE;;+!n) z)Ci1U)E-H{(R$L?5QWyB$q>(;jC|##w1vnz@%t@UOie1c7+>*AJuV`p!5JjSCTh~k(=?Gx zCqwdyh+&+r+4$dc>hLz~2bJ_0$*p8i&D{i>5-6`8sx<6sM^<*q=*<5rg?}Z(ZY>n$ zO%|d!ymeRF*Xt9(b%Z*yuRrRC>0K`B>yl%jD@##0pQ}670isJtQa|?LJm4{9X{?iv z=&<1unCWo8*0auBeEOkNJIYW2YjVmXdKrVhgB0iKh#yiBwvxkjp8tkTZ?x{i-H+7U zjz3G`Us(Mm*6koOD-+ivAcwuQ4=l>b^+x4ND$lW*bIW^fy;wtZANpq{{3llf_o;Up zCA8V!I0(*NV#K}%pTd=B$TTiWlhE0T#nQbM3|x;H)yK;FUR^%L4V&q>8qZeHawEOqQS zOjF%ngU*`p*0`~2beSs916yZpnK3*V_!Sm^o67hG-!b4vI_I-|74P0^+wCV`dnqNJGiF3VsbGDd0V+Qp{ zUY>+cVrWcoWLsPPc-ChFV;4W&ZmIdZ6#hlku9PL92@yShHsp-(Ls0q~D>1GKl0XL7 z;g>sIqA#Z8#bohNHsn+9%JGS4zW851%e%{Cz=%M^1fn{4D1E zW}Y|mYg%~DumDIR+vrEOk@ib3DdM~*7BR14^eCLg;8Ln+Ugj&h44~(h=*9s?_hbMU z8B~hpU5NCcn4F{3bgv|0cTAj1LEY`0#9elBU!tqMa$Rm43#pl;zruk1S#>l?5%yxE zmlSJ{QyF8vg0v*hn@cBD;+q-VUXm$=%{#Y~3ko^#uzZi5Ir{!KW3KR}QuBJvGt(xg zy0n&ov%6w_TUpAhEx<|2b|};^8Y!-Mz=G?XXv?VuTX)eDEAFNko3C20-&uy!R6jw+ zp;J40TXfYj1%BCyM)oGkv@iA^0U~ukm4(uG@Lo$_ZduQ>e%=4;A zBaq?|ectS&zjd2Z!2P${;xDXh%jMN7X>1qA=3n>{M-u<_2_r{8;=)eJ%Oy4q*aP(FbnqBOpnS!2NIQ z>&4Ya+YdZ*TdR>Swi_)r_ikWS6py~mNkVyxr%gyG&yQ|Qzyp&;n;B$$PXumbK5AEv z)sV|Fzo}dh1MV{aR*sgZ`hLO{v^QXX(cy9?t&j2x&3jhBGXa&>xgzPJI7#~Ioe znLuTv1)TfG?=dBa#8ZtzfY)vzckdfCgpq7riMBJ>Unq50+gmU z$Jti-_d7f+1usuU4DBGqLs;s*8RW(dmnxD6nf>u(db<9P4rCttQSCmvt+)=BIGQ!Y znOEQDl37v0g+r>XymBsqyo~m=)QSJg%dXE(UV>%uo?1u>Hv-nWHyy}b{+EJUC+DT0 z#$)t>qk+c4MJUC9?nOh;^C{>=?%p)|&_39+s=@Aj4{0=YC^hRDQe060KGfRFc_6Kj z;S1}?Z0xnE41Lls6p>R!tX;j*^_!|+=6KuWz@RJWhN=<>^WgkJISF_=vH?x4W|s^p zP|XM)mFPU7Tv{A15meNO!8|nux#6ca!beXvojP=aX%pr@T}exGB96ju2w|LKfz7*$HN*fR?17H%pi?4*d0~e9VOzLB$8) zWs`?r_;Zt|pw6i>FTRDb^m~&hb@#H#Yn(O64AFbpZ1OA?UN(6mP1M=h zW-pt(+|rj#-bCfgCJzv&|24`x<9He6p{4#BHhH=VPwk_`bNcx>2meV50{o=~`M*v<6xIKW6a=>EKc*nS zUs{kqQ;>>?mlQ8koP~8Ah8txevda5`hUL1+e}cDZ2p%$9`GLrd0lyvH^26HqKJRp;}y=n?D5Kz z{$-Ch+w|Yt<7rm?-s4S$jcNf0FM~WfoD4*bjOt&5y#I|7WOwG@?D3F>{#$!I;MX88 zx9ry-@7=4?qn{#S5_8&o7HeJ;Xnw>MXdl}^oGIz^JQ3T->IR^dfD6h|ksC@lj+%@pB&HF=M z7rFc|<@NEG9QTZ`9;4dxrBy8*|DbLCPydd#c~M_z8@A$~F*SbkOH4g#z-!j?5>wY0 zO!_Inb27}8m;-;QsV6pHYUq@>KV#~g$3J3fv9>>BYTl?nQTrb;HGl=8NbbDVY7{E_*P421I4?5s(@Rag;F@S~ zKJrpimp}fOHMQg1e~hUeBY(!!gQ+hu^$7WC@ixdyOnuqJuQw#AE)spcF zx>0wtEWrd+-P-(!mgI9d8Fo+ z6}Gc$%kCW(-OPD2;cWo@tF9}?yo@o{k4%fuSkD|a*i5EO3eJ=7Q7F9ji&_WzxX{*; zuJb+EVEuOKc`O`Wo(R@vpstS{Pwk7RB{iWmAHY4{a(O=c(h%Ee`%3;zbqH_7hiy~j z^_UESOUD(qaQY2Z%B10@tNL<&?^r6FiUv=}0g3HCYq5?0duxhG@)^ltf zcrLgaJazPu2B(u7*WK&**ku~Nb+utS-{-uY-KFqsESW3rECEK2$aiX=EU{$mF^K^I z_WR%}!lu5lsv_(q*&em|Zvm?N>%2-s1J(r8{G7C+OCeoppjmIogYBS;O7gSzg{}+c z3}$9!YJ6!S(1?xj_V%UooLlA)XwmEoSN1g+?dBQuC@;303Su3(bMBgby@|Y97Tu&t zEFHS!0>s*zA%WFWr7?%$(%uoHi&BYE)r->HG0|_OUBj%yrD0>)>`bh3i3){sa{=GW zZS(8cK#|^bT{Q&9%6|V5+jD?Gf@e=leQU8|)`XvoMYEQbB>*-8s^e!OCp@5WKinkc zC@%j&XksE1zn5kB(Xf)q!|LMD^wOs2IM6vE9hxy(l-!m(Oy_L(Nwg+;eG zzv1C=zow4mdbWm7Gvd;tshm?Ah*iE7oXI&QN?(&x^9#ZfPH`R*qaOO!ZJCUXjk47G zv8qU@m?PA5g3$g*`(?#VUPWi_kKHaKnl!m1Z!~7v&oIv*Ae2isI!dM6G{R> z*s}-yN*X|}R^wohhyHoGdE`rfHZ+zlfy#XAMhhD}X#)SXet2uMw=b1W0MQI2QQh%0 z}w@GkY7tPfWkZ<9uW_&mBNCu(v6joD3w3()A zr?*rdi?Fq7Gi2l`d-s*E)f^bFd&}wC zWte;~bC9i`4q3um-dGd~GX;Jtn6_$FyGxds@14qbe9Q)O>$SXrpv+r;EBeE&v4nEG z6mjBqUlm1*A4#e809I=cQE{T3i$_GUH49d6UBOwCHk{TcC(0v;GBDFPL##G15XH}% z(P;>HHLR#*ND8OtK{XdmC7`OrZ;>4o_#=SF!QETAhPgX$xa5H+VP;CiN#}jvstO_z zx%k)H7$1P$p5d4jG?KX8e?h3-m%$f=))EuqfH*@Z!;vpGibPHWA6hGxcG$MQ6nUZ>E>uw@Wu>)&0g!uhsjndUnL+Xtdbq zC{A#Ra`*csiU*Oy<`yQFY&a<>-ppOiY+d%by`KiGNf4QbJ~$-u)a}a7i?lFCO;O!u zOWQJ$lo0Pp@pyKIQ!9>2NWJCHi3@K(Op+j_B=q60wAk=vY%OmMR8J2I+%#kKol)-t zGzZx}E=mYrRdYP^7@ocby`71|jJDmS2TQa~j8FSGnHi1n|fh81~31OD>gm>JZP1uxO_<7Ua+*C1L6SE|Go%!#7Re}4}&48&ts$d=uMW=Zx4g6(!&wTPVb%$h| ztUYca7loo!Gd&XSIq68SxnLoB#(9m%;+17u)kYcpi>1+twz>07>g zlC=kj0rh+zj5`dEnTx@RW}lD;=A;?@Y|2eIqi&1Vj}*A0M`nr-*Riu zb{fOZaDpe>R;imqCq0j0lt~(CfG*gOuniWy#pdS@xZpY@`gjxW2?VO*EOCzL@wiZn z6_Ys*o-2fjsDV2DkPmXtQ7kmd8d4uc-7K*?nH|}0{bDS#exSyFAv+sMz3(|zsB1T? zqc3(Jhn>kx3I3E7UnG+n2h0s5v%ptQA}71-mh29VV^pIbAR14{-~*o=xWuhgDTz(b{I??8w|%%tkWC^(q!;Q)?iL= z!R5yM!bR;QktC*M_Yo&5>dB{EYM*$Kd7}~Z&?+T131j(joe2wk4&WS$Mvh&Lvs1lC zRxcjJS|J=pbRKx?JLbWfvM|CVPQ+L1IhlM<7>MfOGZv5RRwK)_*?dcL_)#`%bTF1MGBqFN{gh2p96-Y?Ta`}qZLzcuiF&ae zH5R*Cv}5xbKUe@lynm06Cmu21my-Zzo-kapMz{>tcaM^BxXcy>VWR_LUs=?F#+U2j z1Wy$OkyITDE@WU3!buQvT+Q*BpL|!zrk2<}HKX}Kup!i|iuDe~D60ZhX|A41_5zJl zG88K`Ac{*=3cw^a4n{*2E#l5}s!`(2r$%c)4;_<{T=S{qv=digwSmGXjEnFsS~xwM zEUgJizbCEo5Qtac|9q*_`bN#G#e&?vP3wrU$HCX!oCbMQQ>lQ_g`VZ(MKi+oH#1~4 zzfr;TOMauf)Nrwvpl2rUL)nhec^>?&_~QO(-`nzjbAZ-b^jUUwVqYibb4=w!Y7Hw{ z<_Q=MIP{xZ8t&HS9-6hhS3yW+`mZ!Ba$XBs+Tpu<#LiBJn&dinZN zG~JV#5e2xl@PvD?^CLJph0t6DXB{;^1J!)SnAOKdxW4d#x_50S_i&M6AmUq9ej;#q z{p&q%SW;r z+8}Vxj&r@}5++@)B(qgz1fYRnd~n=&HT zdQW4^9ul$W^wxuMRWfUawv8y9?`zP1OrTW4W;@<5w&)XOyoy)dd6Kd_uP)}pBAVDzH3&WZ zB1LpfgpN-e8P>LYR~7vx?Z@lOgRtD2eo;ISihFp5autef`*s-d#AR|4w;UhF?~DMI zxG}uDSp8ee8$xNV=lmK(3TsFxDlc{~0Wwj@>mt>^G!LkL9WZij0>B6nh2L1w!Q3cWP&O8H({w z%?P_=ijhxc4%tFHxObD)nHfsJ=eTQrp|#rv`5kJt^qn0}Kvwnq!D^fOTQab-!z7ec z|6tO4_MpC{G@$Z1BmF^K9X)i% z1cf>eX>1TzQ2{Gz4DE9Y5kEN-HwP&<6*@N^BsbkPSM&v6%pu>W?X=jHwA8t@*om~y zgK6c7%JBy$4|M?IDLxGiBWVF?WNe_AkESXT-*?IYpNu}Y$yNxxo|u?a zcKz#|ni1@P-;aK-bO=tCu@4rX_@pFmfRO%(xsFOBUkYp5QBqVDxOW`dGsZ~a{cR0N z)uaPGzNnEZ#IW##7j`gn!9}!dN?ssD9>FT>VGi^M62tNYL&%otD(=7$>j|P7f#?b$ z*d0;f0Q0EVN=Wd7wVOA2tqdqtt@R|vJStB%+yJd8h$&~=S?KU zk{UvSSDaON$IQvo+>$_hEqEoK)X5y*s>TL5~Y_k+FM-Og#_C5W7_rS*`9FNp7huhzP51~Tr`>fnuS%vqcRYr)fuGP z1ogTGO0z6TBR@zdgX#GiA z0TXKNZZm7Y_=&~SDu+$0@&`;iztyI3?~zC65bis|E(U|uK?%*O_OEoc(h}ZLkAnRL ziz5TV*@RSv=#0$c`R(+6_0!0e2U#`sG;?nug=93r z+IRr>YSs>bBDxWbTAPRj(QJ`>NN6UpJkEUc9h?;MGP7Q#1>ewkt&qxaCXO5O*%h@! zA>OwQ{;0Z2s*~Qp9x2Z)WQ#$T^gA?fVxll{K<)>sE6{&Co?66RlPXDSLfr`-#&4>M9fg0JAuVSbd<%7eUI~*R_`XFIPixvJ(z8<1qF zlH`e#0C}7w#WV(0cqBSd%&(tqTd>Z7aU|r0uFz|y!vo=E#Ldw{v3@%LPcrW}(j`7{ z4QMC}bCu8L(y|b1v(N+zld_cd_V(s8 z4e{XAb+@*J!_B8gF?R5I+9Ka(pkPyi73^~??g*x`?wZDqnGDH`}-L#!H%( zihGUcj|jPy9-qglh0x`*n|B70Y~KhT69FlEuh>%b%1>0vXRI%4XkGTKj~8tA7Vh40 zwAC?$pre;BN^C$4J}N^(z=5MmKop;$P@0UznUJz%hqOn5t8}K{GPmEEn6S)y`O>AW zPg7@~~JrV&h~@4KQZS5rpzsBMb>%Ak@Ncb%7=(%g+mAZur!xrNZw@DyndK zPnBdRdS+Ykhlhaoo3UhCBK5aRLFKK}66IMNArn#Ga6yNtL>TpLU6McP@038w1Wb^Q z;Y8ZdZ`OZ~i54iJf0n1->q~JnHBJNiiBgAJ`jhVX?i_V?M{70nA?8o7n{S)L`c?J# zU>_eHDFHE4%6i9hHdS)8X}{ulRNGnqZM@FT4D?8mK`9T zYP!&z*7U2(B6t@w8zJ+A9s({BP5#=<&@4(Rbtg!2G?pyXcO%c$Y&1�fi1oaH0Hgaw~v=$v+<) zizavut+oqCttX1xG2+(IkFW4@X;cmh!`-87;K%lEb!AxJPcFwMAaJP}j>i@iaQ(v# z+WZxex%pkX6&LA}QliGO%}(t=1bDnRoqej1EMfJB6uejs-PUI8t$@~qv!?N(Fr6mB zck8VZ^vwt)4I*xvb|C8V#3EqM96IwZ9$*Rb@d5Ni&Xr0~OjIc^)2+OL?Ds9JgvFKK zZAwFv!YqZxLdXi-PxvOL4On5W__BxUF>bYbyzUxwvG-n4;s-)kr{n&Do52XuP*hUUUCpqHrjk% z6yj1A7`ehe``Q!;R;L5K08Uef-2~5d2hf!LQ%2(Zlpva>!lHtMM5iu~`I+as+(uRw z+&vr(ZKZ~6r-`y`e7G_oFBI+#{JW+i8r!QTm_hfqmbUA);ucwMj}J3bv!a}pG-)mk zi8%qt}pdWJ^^iqwXp8BDeZN8WR(1SuZWnuqVqd}uJ>@YW!-Q1`EB@@ zr`D96IcYrSbBCkZ3JKJF-cIJ=a($Quowe|A-*TP*Ja1?}pY{DVvHr2Q;lrUqPjj;zGH8SPcEc3~KF z4vnKotmV2O5=c#?=z8TFVCxLCHUN$M*?Vpk78+rcn2y^%+Q;3MWWQZ_o7A`2AJi=v zloc6d6Y|j<@-74BXbkbk81niU!gp$@{S3tMKIkoU@Y8dD;CKx3`wsMc24blYsysmE zBgkh#L`d@yA&MHJd(v-p!1q|Q;|Le@XfyLFLimIG$z7<=Whu#Jdi%w&!G$B}4>yq= z9^dVhj;#wHhj%D$lB=$I6|QDJu6oKhyTT`I9V>32D?5J8N)R8^{2R`}>(BjatHHkx zbj;WISXrTP0)i*07*-1K75PxF)xe92Iwo&?EVZK9d71HW5h9U%dZ7h!z&|A*| znL*s6fqT-5v6|c<8erq+!b5Ev`P)x`*5iuQ0dBsv7pq#T!VHuli5T2+@QFRp z{p)^4EWQ;tt8Y}>Us3jB63)rOndL!LWczEV_!j?IohtQF_e7ziJz=Mwi$^m^#a2(n zl}<(FcV{$Urd4Fp~V}WK=Sa>j`b+SXB)8M2OUw{C(hqJKV>|>xy^PMal0trRzLdagls}hyntDCe=u8~F#drq9lt@@ z`u$~IiXMuq+lCmoJs~-8i`ZyTzij-{9T72PzUY+uOb<92$ScBhT72=f+TZ}xT*X% zMo2sz_`DA#KexSaJI9~An_zXJoM}058OZU3du1E%#@jtM{gDC%O>@M?#vcgA)wV@l z8=q#FR4Lb;=TK1Bp#sKs0h>Rz*HA;EF;`gm$tIfuQQ5O0V+2Gk zOfPCy?q06Bo83x4BIQU%z_?9&I6@-8Ae(Ei$ zl|X^XtUomYvlMz}9L$`s-MjBxJi}>t)1UCWKM_}Zv5Mczpw91rRgCp&Pj;0IOiTec ztCl1hc<6YM;Q^A6f;sEy_J$*cG-mSS4!qt;IOX_}qYBU)y`p?wG3lr6BPQuo7>Own zUqS;W#dFM6J6H$ia7ZwqLOesE$|*L~jSOkmXyV_F%dq!SV5!DNLHYU%p;Qv>jw3ly zNb%Z{;}n1fn099~lZjx*=w?nqq0|7^;I{V^A3Vv@1SY&bH#rHY#)#gzpD5mi-BD9b zzYn;b4rLt|;vakugB`aJ`DDR|%}AWbe%U-$4Zp4-xVO#rVZyr{QRj{&UPW`VKAbEYN%eU8ZIr$yp8PHi0YS|zf% z%ofzH-or>3aw}2sc2aaBUyXGjAFcy?J%<3?Jd*S6JM?>>umeM4<--6F36~1w`YEU@ zP`t%9!OqOXeaICj)7Pc9z0F?DkY=r$o-iB5U;0#M1;U&+_~ezvOsnoZCAsGs!oKE+ z&CR9fkC?|F5`alk3pjL2)qb6k^VMazPHijN(!0E_nVRlLf#B4*7^@TjC_PwO^GrZP z2`R&2Y-#4hSG{9<0_)zu?kbO;Wm$? zuHRd_MK-=PA$N_A6VKpQ-I*4CF@EwbHGN!!2*gtHc%9c1fcgy#D4!YrDE(uL@l(W+ z7tN*g%k=(i^JYl!z3Tk;Fzv~NkS2ktGi1kN_XjY<(B1%lYx21~%s`~Ck+iu2JDed) zvMBzMz76Odf{6ySIK0krmFw$u$K}2$JWdQP<|3W*6JB9%bNba+ZoY)+c4#&A zi4xa)YHFqK4nKj#?C5%anQ%h4S_wWLH?mIRlj}7iO@OS^9@Q;7+YmivJ(hULB70o~ z+YPLX1vjP2j}+gnN)(k)TISv-Y8dveG>MynQR&-+kI-UOCVwdn`Wo1LB39n@9X33T zAs?gN@aA%B3&oMGFrP8Y0(m%x@r9Iv`1O6r6t=a`3H6;7J@F#*?cw&90igEFzzo=? zSYvQb2A~L8ha)ODdnv!_PGO5|=NKT?r`w`Hacy)0xgpjA)QI&U4eLTJtvEN_)AFiB z^@x9euWX5e4Ih70xX@1b9%y#*Dy&^~aCUq>!#Vg$H866buDb>4LnmZkal(OcNV&~i zyP>X|E+eMyIceIaActV}&0VE~=SgT;^{l{+6OfUwH%iuWr?cF+H_3(O8KOFOMINT@ z{th`J1lOa%1{&$qJ<0fSaV?hN1IsQIQ-2Lfj)n$Di%+T7esvOjacgAp5*l}FwXpn| zd|Ta+Gmqhrop%T%s`A2qURGM;`&seiN#)v&>?yI?$ARv?t($rR;-oI(B={!xp`PfZ zIzZQ-fIs{~gZSP?fbGL+yiW(EX($AJg;L>JV!Dd5ql|2)s< zwzqL@mp<;=YrGj}jpJ#5_mNw-z5)gs4O{k3dq0L<{!)Qe%47`trl;F+t1?{`bxuTH znj}(1R*{(;UQ2au!)JFdG8-w!i>n&?6zCtr7gdto26@L*v!+dcK70%r`N$9j&J;y- zq*89PW@Kh5bpb~cZ%LJoPspxm1-`CD?zlI0OA9s?gn!?;P!BfXV>%rWB<>Mt zyIv;z%!>5Rw#vgZZf7gRTUKpk=XsK8oo;)VaG7G~(uL1R?qE&wfs+m;8mO(?D=FZN z8QRw7;PVWgL4v&bziE7ic`T4AVA=NGy)^D4Q;S!^(AC-K2)Ev{*e>lxJ%k(h6Y$9EeG&) zidqZ(Ixd5e0CT`4j;i-E>t=Xm95vw?ilbnO+*b;PwBlKGGSXTe_JMw{mJj>;`~WWL zMN+a&y$(L6Hl}imh0t2-*hdD70BSj2Yw)pT{|??r= z&)o*pmm=iaDFSIi0S*%-U-b?oLi;ncw+C;Fx2%}muGe?SIk`3HRpo-XQ7&1oq#f)H#Eqw-L_|`EkU;O5IRZ~KY+VlsB~6*)jVlj}{Mqd3g%Ua7=IN7s zZRen^B^+UXcw|!f%MQ%LBz$%Jr&qtgtzG|EI0RhkA&Z#>9;q!Ao6j6i^|F9ph|kKg`qKusQ5otg#-uv}eR&+kAAQ)%V{t06n? z7@s>FPp%X#=_bU}2<79}urlFTF=Q@ri}10AHsbiWTIteWwhayU^7$hD{okD9fO-KR z=iaqSsc1MxhgxgDOdGQ8O59R0wMSg&JF7_qAP?RV(e5=j5ftuwHXmj9^N>C4jlzTJ z+3YbsOzkNOrhTDWsTj1MQUk`{y#W-ryxy(Fm1DJ+qSFAwr$(C@s(}cUAEa}8(p?-^Y5L1Hg+d=W@BTI zG7s`SeIw(_>$z_U4!E|9j2>sm*fogw0l=aTfs?i~2dPjn2mAivW2;zB`g*^k=5B3a z@Kdk9xFECNX`)X!MMsxHwo*I>3AMhN$kHLA4|h&GK`4?i3d_W z&jl@mk-rX{Vd$metqRfFAhG;AU;i2b2Hd}!bE={@q^9l*et;9YWneu;NN)sPHb9c5 zg~KqrtCU21zva{LX#Xsn@*?pKW_Pbs ze+2#LjomXYU^$S}3YXeRjcK>>3i2P;3i9+{dT-<8Z2^`{C8$QPxNYR?`;gP>t_En?1l3S#Q2KV!^qjpz( zRJVDx0bN_<2ztrA!wlf^Vzn!WoU=jrmhJ^>f&TQ6-dwg5YN~58W{jyls?W;*x6O2g zOZ;}3}!M~hm&0RQoUD&r|k}vRpP3O-9MGUF*tiJ%G#(%q%lrbmev6#84V|-L=%UO}Jdlx^2uZW+~czt$hg5 z`;59D)x!6V^Yq>TE^~JfCH7nAx7hS?Jgo}o;f+*87_nlpN|(IvUIf4RO@($&G;93uP`vSpj;UD65)8q}Ih%>dwO9uIi| zmnZLTiz&|N8Zp}C^%v`VKO=$?HL=bxB>u@74Au}Q2anrVyt5}}qBHP^&3L?>l;!J% zN)`%hGm!M>hH@6xw{^;K2tR>Wj6|I?OZD2zm5*1z8cfY_3-xbc&!)d(X<~k|{3ro7 zCb%aX)3EGg$g0qP$<-(ZDn0=P$#*h$nZLwnA(z#SC^#G*Xd6!h#V{pQTW>sXri3NQ zXTMg2|2F@h5+o+wIkLIvg%_ve{$%V|XHEf-jnFc8!248ApNI{FT~9;_I1dR3bw9{| zn2w*Sh6q%AuE4S9`my8_YbN_0&d=?lojH6=Im{OEz{$s#fW5tLE)3LIqr19MVJ+b? z&oLD!c-0aZMI`MU94^pBWd}!nJb2lE8skuT77(o&b0`c2@+jY6lJH!^Eb+#GFqDu0 zX6F&QIb}`#RFWnW?m~&gc_gIVQaw^GlZ5;%ViZPLdx}@8K-oeTcSM}c6&7!0zez|r zyTp=FG|_=JU|R$PM<4*Q1rPwL0|KnPKm)bgfFT?Z)q>H;%MU{M{6032kVmLxzy2W- z5zH$X648zsK~%;k6aqAcD;go#i-P!IH6qGa>3qeG*W^hn(Oeq^6In`C232S|U7pZq z;hA9Hc!H|tuQ;?EckSLpOx!Wh+Qv{PFr!oTP1{WZ2rbAlo3ZO`Y~Cv&ZISvzwXgv@ zb{_t&gphx`ADQejkBl*UdPw5t3$!1mWEO+G`K z$vQ<$QYML`jN=QeB8JO!>MHXW_4+fTsrVtH9y6KvH6)EiVpR~yNV5>n~mUl%% z{<2mJ0Lipz3 zK$3bB?(4D>Uq}Q6Vu$~*TBHU{hu%|&IZ+=2z=9nXq(&uG1fdQHRSL|x01hEk{3kA6 zqMBbLnqR`2-#{K;f*xP~%)fjob6p|MtrpIc(qSwd?SX_QAz*FVlR0CeTnQF<;O{{a zR`FtnBL7JszL+!8D))%hOhuUeXDTk?xLI=Vn>meT+?eq5J_zN$YD35n^S3YV%ou6` zmLM~K$myxTo`mT8N&p(su>D!HkkBWTlBK`EOXkW}n@Tm}j=@Dur)CyeP|Ki1$TS(n zH4Cz0ZUt++b`uGyyYt=1h&;G`an>1cD_-^B^P|@%Z>^T_;S4~mcR*Cy*yQh$=}Q_$ zEq6F^Zv1@6N>B+-h<%;nW!=a9pe<(scts25GGY1G4T;y@LFrHK$6Pnmz}Tc5D6B}! z#V=I#lX(mwco2j3{*83bSlJG(IV>9Y( z6?F0U4!A+i@|nMhq5ml+{*PW_RPg+o;whY!Zk#fGW(ha98<44P$ndIzPcfgR!_Uf^ zfmd9gS=~_yYc(Spa;eJ|NvTc}Lf44V`>oRP+{o;x&I+2F&&99PdvF`O`B{Lm3>)4P zSi&zVooX)2)J9gUxpC1PbX-!=@-W*Qh6f~ z3!!Oolq0M?dzi}NXZSZUjq*R(hSIk#{7theD(}3c=?eBJgx=42-OYR*Z{Ce4PyfAb z`2Um*0skLtLo(jHssCylD*L){b)p`fhIxM~SIb=0oK2jawVb=cNY0LF`pao!BP)6W z#{>q`>Y(8nY#XQCE})BqFV~^dHqX-#HY;a9^0fvL9J!swtZoBJf9vK2hFfJ_CCeIK z#@DaXz#xIx&`#ZI=w=+$4MN5-C^LyuB*J!h7IGP7d@Ceo{Kcrn{Htla4!Zna=}j!p zkA)fG%gPV#&nblP>KR0L3ygij@)l4Hh`OkQ4fF994EE#QP3-9^!HCCqqyivx0IVEO zgKGwfJV`ax2k-%fkpZ8`Sq(KAcFUezYU|C^cQk8~q#@5T3%RaG2%x%5s_|NgTW$hvlsfOF$qV z=?nBP*c-$C8-;K^8?)iOR2|H~4YpoMr4aKiKoY?R377DUly~_GybK-?uZjx~^j8!U zrfseW6&}u^luqNIiyD@sA-7R*;DdTn%~8Y*ILt%!@$WFiIu~*BcO0e~Xalyus7&Wi zV%5+jCY|~tpS~dfladW+$scoYMJuiG8w~;ma@zM{Yq65mI|o%-vM;A|D48v~doF1M zjh~_Ry^}Nljs*e9AF2>QwA2;IS$8h1ayp{hnmqD(jqlR5#pV7cYod(7&|K8&u&ByM zX^#EYZG>m>2m~m=6-26^6V8Mb`Y*eb z2KWQ_J$U8>*G5?*BFS|aIN5j0dw}RNz_b$}od>WD0$7^^tfhatb-xeEzK1Tq4A=dw z|9o$Xesy5K&;CB1of*&1jLA<56=3=Dm*4)%3Hj*Ae0EX3JULmOm9ETBl@lP1<^KiX zXLsV~H{s`3<0k<~@RM-ybJOxuDDwUE zNj^T|o-LGDEKaHg(yPC9)81Xq&RiZA@}(qya%3OZs81D6@&MusZ)K+00=eejUT;VF zxtiZPW+?z?nzyo(1c7{Beo7l(|ISwzuYCoIh}l`VpA15tF*SOH@~YgiK{Y% ztMIvt>99oDo{#tC69M|n<3pQ$tG`+wsS@<0EHODOw- ze(~XfJR4a{zlsn9jBXpHv=`yQ`XI9aP)F}Yvh-8(y5M{V(Zc6E!UO(5TK|f1+2PnH z2I%DNMA#_@MA~hziaqnhl~4YoC83e3DGaOs6_o~2RRxQ3#cC9fiq`|L$1FPtR6w; zeMV^i`zk0@J)#8h$LQ7?kF?+hSts^|YQh@sSA$)2?T7@LJ)3-!an)U%m?uU_S%6+_ zpu)slnW<+w?zbx(BS)nCs5Q}i6d`gIfms^QM74`+WuKD0S#fug_^P&erdW);IwQAM z>nZh9)C>jG1`g4MNjNYUSpSX+tMn2p#O zo7nk_$ajy(cbLe!q96xHNNYH-TrE&O1+-`xxCjkMSnXRV?X&RjJ2B?lc-6H_QMH0R zUp`By?=RZd1euqdsQ#6n)g-wcSqi4bd15COVDkZL}Z#i#P-Ex9qjc-EfW zoMA2wRhJ6W7l@bUgfM3N)u;PYCb|*g@{9#JqTahShfE}~3&tL?{76eYS1Wt_w zAc-!uM<;=eE`XF^fD&nb3}wDem)`p^-heAVN+#cdo_rC~nR)X0(XMfg+ZIIzl$AD8 zf$7wLRRa3kr=?D#_ndPZi8FWm=%J4r#W9V9RSmd>jkEJM+&0}U;0QNPW77P%L6{J6 z-!d9L@@}2Ov_~CbvD%%L(&!v(qUe6hU`8A(pKz^24pun+7ePrOJ}P_F8}U_5&Pu6_Co=hd z0sSFsRI}ZippWXyL?&3x91$x5W3Omss23r5$ zm3|!kyD|xH-R2WiS|zD+Ij>f#qlZc*{t7t2k;}QlF-G204W|@6Tc(c5y{gl=g?j2I z#t~Vs82-3}hTwg+YTPFTIqB?5l&^l`7^P~sudvowj(5VLaDoMmAb;^AY3DI%>8go( z>L_KZ$5iEoXKBH~nRJ{NIi6Ju?zkB4LnT`t)nbN9{++DR$W&C!p>oWLHPbPs!BjP% zQ-`CF!gXKJ;VM4(oX_=EU zc1x}i9c?c5g3U^LYE&Igy0CJ{Z40Rrg}SG>Zg>aEZw(je%Z7Bc9Y44RDkkyU4~c`B z4&1go`kt^iBmNKT>>fo(+uRlKfT}n^3o~hg8h1$OKFP}rbga4C(q0QPISpx+@giUW z+uYCaJuQ*0DX=)#dtNa+N5rp(cIUIc;A7=?XN9UZDa&-*6G>=yhzvm?m6QUlgz#$b zL=xI#X^d-bYs-69f8O(s+9QO*f$dsv*txBQnxQsHLZMH3O#nfS!X8#20E3(C{qN*KguS8!!nW;Dna9$ElYpErPLWL9&yxul0#-xOY zdRB7AwXXoE)OjA|L7T8nQ*HY# z_nEBhde?FT@o>L`(@_$kj%4rOR#@fWmS}UzY1~}wD&E&9l`y%ofp31Y@@6fBV&po; zB3_IO%T;SZW;#nfDX<8Le0MU}?@%M5W^e!RJj5ItRjHJ@9RUfi2B!hoJfcg@-b5-& zAM;ui{&S-&Gm)I#=&4q^BL#0CS5|;2C~=B1EK}C;v09w9?hnX>UB*vBSvNNhjy1i& z19>DMU`WT!E%n&#FJMn15F;`*MnN>7;aUQluMUQHXN{pqLlh^(JLl1f!#H%kFcW$ZQCq|^vQYvqL_Z)+rG z)fuh2scaR3BQh}`l8HWdrII@MnTVLvB4bdY{`c&dZ_?+k`16kpZ%up0MU!ftj^X1k zaZ9-gl|^9D9R5&9r#197WLxt0POaL@2YCWkubaKUHPN%#RpgFF3U}4q4k8eyomG*({%GbxW5;A z=b$blYuxsLgM^*lww^##xVNWU9mmGO`!V+FE4$aM+cJa0&d*c+&ley`qbL0l;m#03 zNMB^ltqw`5uYSZ{4X!js?eo}sQ;w*v@xyT|PZ`+(Q_akwR%-FjiQC(YZdYo*t0zZw z=VeW0Sc zz_pan!U{Zfga3AN?c)s(UUr1UhNN$oUQU>VSL(qQK}qNM-fsw&C}5d*`)+<%3wyPZEHO-FeqZ(XE@|>=lOP zo^AFy$S7|_UkPf&^d0H+8tHWZ0aRI>s6-su34GOH*k7r^(+nez5lQDhCLTR1e0tj% zbc%487Sv%4PI=#krlA#1NxTy@rx4O1r5VIgE?&IDLqm64Nq2Ke4?{_JZO$pBJ;9TZ zVtkZ86VQ8xqrrf|TzCXWCP@z(Nk_6dZo~{ch!}Yg_EDg0mVkNSKJj-BV4VNow)E`6bhmBih@LmsGW zTY`=n$?Nc`T;=jCcfVafC+mNPX51j#gg}O2%97v;frcR_no8mAE z6hUPPy>=lttVtdq4LUN%t*GsGC3Y-II&w41$c?|rY`N~V#afqw%nYAUuFi;DQN-UV?*M#lWQL^C4%we6hq|{qcQ&LMzv5~c8_%Tr9ev_FHH)x7c zETcv|l^6kFl{94#mXU*glNplVtq4A=q4=_u=qHWQlHSljbtxw?$V{asISqs9f}Sml zH~&qxQ47(Ak5m`S`I~5V1g3>etu7prnrxsJq5(gyCTpvfsKo}R&TOS7s*0YhA{U~{ z1+6B=+may12Bv~ru_Q^xmLRbRRg95To{E(v2_dIX5nkAWIy{wtw6dbUEGjHiUA;iChm>H-u{^`rRf zmbDPXq1P8(#dx4)&Ll52YT z=W`M8+EbqGLNNO@an>ea@3X6a&ukky!1d8mf!}=H^f!2Uu7BD4_~3TGZxIu5FUkfG zu3OF7)Nswnl|pGtCyas_GT)ARw9p1 zisx1k5iFK9ZXycDFc(8Wa2*Ju_nNpzAeE0nVkrclz#?pK9;4p-X0eiDr=#kE%8X=- z!c(@r<9QCx;;^|W+y+&M88USyba_zVWR>8}B-&o;%@>t08|mvdHz>59)#n8uk&N8c z-fqh}t}*);K)C5X<4z*>K_u>u1I&}^P*bK+wYKDZ&pMczrdVtyYl(cPHRO^upCv|T z4sDfrd_!~ANyU>+abUb8pD`YZ$|03UAu&nz#s-xOVK%F1ik*ZzsAz_vk` z4{ly)Sb~~j5~L(;$quFPjpPX6v$PJ+7#Bk25X^%Rne5ZVf;t1?0xv=cXm29?UJd8G z6GHHrbIC(&dn(8f7U6m=DIEIgZx&C*0_Zisg%J|Gp$`~oXEWGesr4VRc$Dh9^6?N~ zzZF;e8;0(6Vo<%SH@gL*qp0N~)Fv7m=E#ZNTCk)TD|?>Ll@F_fr*8u6kUI&cb*8zp z4>-9sx|Rxa1|GPUhvg4KfKqX{rb+pKKil}sv!`0Gi=3AQ?Nzicwq=iffPp5%S6k{{ zCfKWOzjx1|J{TbQbDOkYdtqN*I)K1ER5nA1y1-tb8djD;WK!l}Vt-)2^|$~=nzxE9 zf~hlS(b@%UU^X9&uN43;%pBe#pG-UDIV%_^EyD^vc1~55uOEm4Nv(7-fmiHcu(w zjyy3R7^nyY@4WztxQ}C!-DU?p48rFcnS&;NgD6&D$6eOXnB107;m>k$gm+0UBl3H~_jW<%f2*B1@g+Z>~*Vfdp^^q#C*^Vg<|i3>#0 z6;03a{8<{&UUMO*3q!#%Kj6S1*kL$=ZkWUgcr#zx07L*0BYwd84}$|~#3CADNO8A* z*!qp+(?wCT?9W5qU`}?Sz@<4=HKU!^)n%OZ;%6IG5XHRW`C#Zhlm+n4aYTmj>CvFw zudEk#LT%?aNZOP2ot_7x6pfcleYTEWD@1{>hhJ@tA0uqz0fACuQ0|pt?1~8u;8wIQ z4$;%H0sR1O!%L#oQBjhELchg$b-eG_<98fka`OW}j1^0sSMs_j_lUXEEVE}>WC1%; zg2aQv{koHsMUp~3WF`P!T0nzO&;{f7D*cd z#l%AK!7~TrK~Zkyi^L_?2nvy05Pa$uFCsR`B?>@AqN7<@)?cxktrpc zwNr{sBbhEHj!FU2SA766hUQuAr=fybkAf z5p^+n{t{QOs*PKAhwv_N0u)rKSv-sOLGr@wqMA9 zohKu0S>M>t4TzA()m5$kn1323r6rvGoap%r;WKXV72bP*b7N9U{9&WyJ2{cvG&@pY zg)A^%`?u85OuTH_u5O}qI1^Vw&9V+KQEFxO$BXn+?MZxo{MI4up9sL&kJMG#?8Tf(3wo-9DLr&zA#x2QH|5aH^X>ZgPYjeh^~;_kZ#$6PNuAGhMOl=`xn?nDY( znv|7uRiGC8r>9k(;>>V`>l&bP%FUJB9{OUg&Qx#a&k#x0XY{Ak%C_lFmLKL7jonfN@@hwgUPM*ON|1hIcVLORt&imnb(QK?U- z7p~)eY*fR`#_kwS9kXjHC0UK7uKKZ=HwgF#ds-fh?>1rnB81~kCK0@e;{2;!nKOr> z3n%|jdfz-O8o-M;L*AofQSUmY<0U-4C4Ms4Yrld}s~ z2#t<=3e$yB+_E6>xvIUS{6MJ2fuCboK~#K^gtVWegFy582F< zY6L2%{s4~Q3oP)I-x58O*wH|}j!r%DB6cLYO9cd`%zX}TE3cObm5(aD0F1e3`Acj< z<9m#}XMBfppjRwca+KGn^A6l+e8+N-*6-(}^1dfMod-Mo-UGx}yR)|0qv?+;(oe){ z_*Tf{g!|RUx0w2@8`~aEeCmJpNM6}wh>8WC?7+V4ZVl5l7GdcCI)Xk0m5DSj&oosV z6v4k)wf{=t@t^(b6|<~JR=w|)q_fE1 zZUj0{$|F#V1)-UaZ3zD(GC(NfDUd`L`cR@Q$H1C2HUvO`(O)M*iVQy6;tx)epcpB})`WY=ah0R?HxWpo z`$J*vNV%Ji^q3h*$QG_myH=d^fzlWM~MzNz~uHBqu!8kmH4)fYj@%D{6^c#`emPFwR zxCeERb{En6^>$_H1H}3;+sssTTNYYz zT?Z`|3;VwHYcg4QcoE;Rj-D0{g?<8>T5I($Bz$N9L#~Wq+Jr=YspWQcj)Xfxe&k8; z`Xer6V}!LRN1IcK*vmNR>Sp>c*X6iCJg4w%a0WHnr{BP)32uZzG+%09G?$3+K}89T zzv>HqeV3Cj!o{ZsG_yb=4{P-7{#H2cE==`UbH?tE8)Ep$Ii@mdSw^{!@;f(gP7Qd) zF6!R}m~^X$B7*Wf8Bo@s5K-6Y?ED0@3HU4>y(hLA862^*18lV2PsNqZ=o6G5Ln|@6 zMXKAh#Q|Fod>2&bvzIImJSAGIR$o4A68)Lz+NSI~hGb1#6ht-uiv8FnZWk!W%pYGraXiIiUd@VXPNlkU6jp$6sK zPe5F^G&=b`_`wm~4CY(7FwNeq6tx$AXi{?2b0lDIVt#b-$0>@5(Mp7URgpBcaXU4On$b3lS-6WwA9b-ZlSStvB*fR z1ht0A$;98H10!0*ju#XGaC~)q55hxW!Na_Ys*pwzF{XxRkf}p)OJco-cB9x589Nt} zIG9S^@cqrD(UZVqb32h!&rpWuEjobW2r&o9!IeMwNCqIF2?o$_RV8Og<1YP#v)$kQ z`=8kV(iq>)uCP&}`dP!UboujuMyW>R9xsn(BGIAKE8wnk@wgt_y%&a)Vx{4ZcI4{0 zA``mR=dVHfq}ifr=r&{=AwyI;%zp&OZrPxP{5dad1NCaX)XcVa)$lya^qv8gJHAYq z=6XP&F#T9U!;^VB@N-{t$_yLOMxM5aXt&G&E5rmiy1j%X`^eV{6;_K03K{pbCE57P z?g+VvvDwv|nv1PtG5uP5rjReLe$5ZDUwaeg+Wly>Svq3Lm5%JGvc-*WE*`WZuE+sH zJl2qDSoIT=6?{3kNIbkNh)A;9+cDi{t*8lA80&BKDRgnUSFMUAWWPa9apEOq_KIkv zj!|_*w|j!tAW{k*2bc1$|-m;Ft0T)j!L}#-&36C*9Z)K4`Tt^vA5Bu=1l2@e2-2HdT{79>nc_iYYNPLJ?n+Ub2Js6shZJ_JR`jeHgF+tG^nG%;NF@ zStQ3lc(8Vo&YLK(7eZ^~_T0@mrbc>l?82fKriiSX*I+ zqv*399H1`cRsMKIdt}0ur148IBsC`?Q13y5(K-VxUE8NDWn_N~?J zQIGy=xQBKv^_g_Vi(n3fa*Q$cNTClWcF^@AAGPeG_uhx+9zkbr+sUy>b`+Q${&|vu z!r_Qr51D2nUmMX$!E}j4z|g^&3CmOm$bd&ja42i%TFXQ(uqPrHN~u&2X;(-h{N~8Y z7eOLCU6g$&fIL6KC^gRn>hop^*A1h^W;KCEN3X}szz7ABLNBwR&95uoJO`>}pzh>_ z7#M9??d3JAO8-$;S)Qc|ISQrxBhb4}0X4(m3@Bwl) ztDbXJj1C5cYOMp#-mxl%OzD>ua73^PTQI#uk?Q{@Fa^_dw_ynYyZ1(Io~t`-$uuQXBM^rc?CwU&N(6Y@cqroo<5i13}k1(tM}?2JUsSR$ntqlptkVlp zvYE)0*jR%46hM=J;(*;tAQJQKE5R^Ou>+x^J)n7CM@ufIW<0cWM5v107apo(z0Po> z%{nMZQ-^gU)6ukn1L-??5ntYM58gBc#8B$mg^=;P66GQXxl9@b2Kw)m=E#Sk{h)X= za=H%5=)I9R>2~#l7AhWwx1`vW-&c|!skr5$t`88B=Zw3lbMTO8egRmRD&o=p5%_G~ zbhM1c15Dh>sTc7008QC$#t5;aQNo7m(>YR%MFO`W98pNTB-6%rNxam+k!!1dPVGM* zaUmhuj=J*onDHThb?!BTJuPM;&&8vS@(HA1+b%+K&MunmwyD9x(k{?w6I>+-BX4!w zxp`RNj@#Z$Yt6B2ICK`K(7Q5|tn83##Fa@4_c4M{eEP>YPl;m= zP>ipBmyoKmu&S9Tb7R35D{_BkI7y^03~wS0-t!mNt8H8Kgs?F1w9&=RdxT+u<~RXY zL8k}k-Hsvtuqv8VJ8)! zNQw8Li5Vz4iDN?kQie1@+(8plR_buTQHCTo--aY4Bs)-0krx3_g{1=vk5*9!BnOzf zUqyOTp}JU7E)9lpHTvUHYmnL`@DEHdX5;sjn(cwb?w5%KKyM5uTwH3hR<4o^!iyJP zjZB=lLgu@JC^Jphau^tYwf!*F>LqNuh(z zcAnz!@6nckTGCCr*zU2 z+G^>$9M*XMZdXy!3Mt~@>!$&stpHZ6&U!s5DtA(4YGa-vmHsOU*YyN==rXXa zM8}}Mv=CIGXR;iuPU<}{BUGETEL%ZStf|139a6O_@V?hiJGyhBm}_iNKSq}Fx0Vr~ z7#L`RVExyNuls)~z?|t5>UV|MWKVPGwvh*LPnHI}dBt|}6(4`K!l&z2J@BL%zrm=A zN4@-eW-#NDfu$jV)8)b8aj>xfJA`ELz1uLmFz$3haW|s_t)Fy_m8U-Gf#C3Hfa*l9 z!#x}nw(0uF6JT}$_JBDl$Pe-SgK$rq_f8;zCm^V5>Qj+z;xTi`22Yury;U29_Ws*~ zb50OZHC>T690*n=p;sm|nqdVM3NWXfUqZVNDHSPvikShokrRsCYl7Kwk^-9tg_A(+ z`v#uZF9OcoUN3=0YkPOH4@# z#@v<^uYU|19RaltwPA#t-%$UMIxf-mOJ!fpkzM8rABp!Yq1h8Ct*;uo@?(wV1qdx! z<$Lx0_jWU4304L~DT${#u5|tpeO1>~O@$(LDa$cVj6m>OGly6o8frQzU~8IU=autLsr>=eFYLtU{DL7P!AxMC?Jw7z?LdNmL@+NLElxyU$ldtO?O`{ zfnPPqUp0lFi^i|n!7sSQfM=V5C)|Ta9gs&Ik_R1;dmZDujo{ntqMPi2Yux=SSkNmO z(#uJai%FAn*q}4mqSNTXldApW3y|Yz(jy(=!)TL(?BIPuRQR7;rdNsKUIl1hhiFd+ zM7MmDgKfM`e)>v3ZO)Ho&gW&IXX?a@cxWw$IJJDdlJAJq$MBHf0EIXSfG*K{G3gvY z?es0!WQLHymY;8;o4mW5uhv&v@NG!){u${$d?>CBGFBl1!vPUBAA^venW>wPdM(W)d4L>;j_mG*r#_mbsLQ^vLw{)f^I5a8Ox|1dvg6p=5A8xBuAStV@cLFZt zwPJ>q`0i?UR_ST8l(eC- zgdQq-J0;;iMIoYMk=Riv%BbWgWYSXNDM_JYdH#~=9+H`klDSrrxyF)tI+A&+lG$=& zN#bKE0+QLBRKz9;>}m-V5(!jX2~4yJ4EPD$h=2roU`63$LYayD6kUN4GJ*3;ek&`# z%QxScNMAH;U)BmARxTgYaqm|;zM@Coux{Rw5Z*9Z-eWZ0v`wD05}tQko+wtHfluy* zA?~CYZXP(7>IR{^o&s*eVAE4{LH7(HN@x^wNR%>gloQZ(;I|sKJZ8x(8p&i*$y7Ya zECBjg0)k`~WP}uusKvLD^7myFIb}X`3V@^E$|B^jB`S^UzSFW(7|Y z<(IEqpX16tuUrtAoDY=yX-CRr91kpZjt=lBvu_M-bHbWt=A z*|ri-{ZP58vgEU)z2N1ou7IGW7t8(fg1lg@wx!RY@)#ye@FKV9@Hz5$(FFqueQ0zg zS*C&`veyfYIj*YkH`-c@Gg*4zE*v%p`aycmE*us>iw^yaR^>sRAie&+KsI%>q`djK zw3*`fl6i4+X`$?dfS2k1c-P<7JT8Cm=!sh1$gIOs14ZDsLF z7qL>ZNL~`25>EOOGQtvS(FJN+^KkS(kg^P`w|2(0J4bF6478? zs?9+ss10!Q{H>49X0-c+6DoSAfYYD+!qX=}P!$kiAta(O&FLkMaA+>LQx5;HN4kKL zr@}o84J>U?f*^PBqTsm^!S_T-BJI95mkicVVhbI8fzNGUj>6F+`;LycF^K~vgJW12 zufQgfNYSy}G%?Wb-d|QA9%}4zulf@uh}%M$szM(WnML(T-96l6zRG9qY`HylL2;b` z1$E@wyZt7wRE)N`RD1DqgZQ>F0!8X~x^taHZJPr>;OvulyK2@Bs*@^`3p=P0CLTF}h2RfS6zUtzty`xfr&%TjgAq$_^`qSEnu`r1 z5r#7xhx1a0^Lrfi?^8|1Qiz%O(q!-j8Y^@l=!_JafJ+H!_+uww3R{&*AbGqL9Q~0Q z!-u|#zZpBBlSGt@!lmiS6+kYt6{49#uH6h&Ho1Z@GFGF}1Wih5-l3;#Ypomh680@( z*JR#oBU|spJZ?m8`GS@=E>qC~Qa@nEV^+0-C<>Tku$X^yqxgwbc0JlMlbQH`-hI~) zJ+T-619=|xF>*A(ka5kfRH%3@eCzUJq-tLNBLjOkT zI|elRMM?Z7co@rJ^G&n+aYollWQ=jkWYsb_)APzjnY0hS_umUk_y>_;UQnDS#xcjTe`^sy->LY;OodJ*Biua+p3< zyqviNfG3xs1-!+t#x+Iw)~D6=m};$-YroypjVUm3(>1ghmEFZJbJPJY&S(;{T*AwS zFF16jVmUVx*7PWGE2sv`4V;|g-bgtfU1I7nZDY|0H?Dt(TUqP-b6U2IBxSkr{a2mo zCp-0*9eww1&vdw4sx||eEM~kkWAmSU6=?nkKrL=%Y4s6ni7VowEUo@-x<(<-)RXYR zDgCGW((=*PQ?X}xxWCt9SwnIeZIvym5}_lCFo6&fE3e zwwk%DF>%=L0E-whNVulO(1rPdV_hTXaz!2`-_V00Odc8E*x(^2d1MJrVZ5VH$DF}I zA$bJz(J)hsFjvSh)3VS(JahzCdCqm>y{a4}1b1G}&9z-1$Y9s9ATSA#numaKqrOuz zLl?MuE>J9dAlniE>byYUrUUuohSaC{{-31keCfG#K=OU6s4veOf2^YeO>2fGpN(1I0gsGkX^~GDTyb{+lKh7JgFBYQdf(qJx}0<_&Pgk%ilv=d}1Bx zfi%=QfSRcde!sR%bQ*GE%b^MLo~HCK43ua!Q)9kBO$D4*q|lZ_LwsUQX%KZ30KBOIdB29pIeBFF zulw4ddRp?c#vxs5Yz^5ywgh`SQ60Vxb+Lc-LkX5@Lt6M+>hcMxiN@rjnp|&cVxE5! zbccu3(KFRV4AGO-#YEMZx&DeurY0+@4XMDcsfsYQBudAMDua5l#xhwGM`}kFMw-r% zfs_Y5RuFqC3rlwdC8&f1P%7w_VjQ>j2%oHzWMWX6D-u{5q z1UwRWLF~%$isY$ncimjgGjooNWIMIP&wsdjX*4esV%0eVF`+wk{V(3`DyR*1UEn?L zTAbqU?oM%ccQ5W%B)FEMCAeF0cPsAhTHKxDa`N?CYuj40&ptQjf|+C{OzsHpoB#8B zu47x>Mrq%2@I(b{2O@|Mo(yhIk@Z#MW56`aNY(ws-81|N*@n?2oEw_@ML1!>nx9Z9 zA(b%bF7Nchjy|@OUD}RWEREWM57D2AxJg_tiqW)|vB|SL0S+OkNx>3PUwX0h(@WE4 z?OrE^U&A+}TX_$z^s6%bpLZHz&nby}HEA;HjM7&`PlWUYKO+;`Ragn3Frx_gU7=Mr zdkpnQv41>yOAzz!86cx@7Nz-mf0IknNl%EV=|~I@p2>|iECW$FxN^4+7b4l2rW00q$WnF?gm>uYD!w?XD;`mCsj^M}_qc3@^ z&f22_8^xntkSZYA_X}eDaBGW*W-62z?>zq2nluP|4gkhWzH2$~`FA?NLt(j5f|DB^ z@+Vb|>+x$$@dnGyfFPq=G};%@p$wuvAryQd%nw+x5Zltle7MJqAuU)z0*Xrb4Cs!Nf>JEfpqi0J9Sm9OZ z^qD5dB?GMADibQBYhA6`m?Y0aQZsm*6L+m$>g5xRf~TyN?~o*tNn2Qvu)<6_bNa9n zii4(Ajj<6V`9yiCa0^2$gD-bc!54#zJR(vFIGiDOty$`kzJ>KM&JUZ#2M$vL41uNmpf(mO}^~kG5EWoJo!&bZzDM3-g(e{ENmcEdy)v?54 z9maN+@W?T&CT^u|V4kCd9*#Dt%KXtUd|H@+WpyY3ml!QoXfaBRuAPR{@H%$x$#naC zMjh|BeAfm!!Vy}5Y%_yX4n;WSmg#kYZ8e*&MjU&!A4P%%{&cumHvE2Vk?l$>EX&r6fGc2R_#obqg}@zj5HW=5zO<-o%V}+dCWTz0@yaH}%b_I+&o7jRmfuh`?jg{=)OPi%z&`WS zcvNM$Fm+J8)Ryy3Ci<%~wjM2Aa|!*iuty{7;a_WZ*Us?~%PB1K9Npc**OvF8rHd8&HW4a z9pC~(jSQN?;2iCbTxq}Lr+EXeasYfxgIc_Hbp1X!7M=}9#v2uvJcuG7l2Hi$%r-|m z6|b5OtLiFZpMVdqWm%$Qa4V#vXTvXQgHocP$`9BYLE^N{;00=ZZwchOrkzx>`5+RV z%e1A=<~}C!=QWUjy(GN{zlaO73)M+Ka{?>Y<~ zV1D&E3Eu29_P*5n<3uZC&l`&x$#MP2{)r%k3iN`BBI{amHQV}WGc|Cd zUyesaR9Gy`Jw*tG3b^y}Knp$%o}->3w0(12_rN6Nbf$=D(mBux6BqVSg_!lPUv}&+ zUO<|o*5G8*=UHXT39EY>h9I*WglEEA8(l}ddO@#e#h&IySgMJ6D**>Q`4h{(=D|R{ zi7yURuC54G-g~EmkOu`6>|aL(ZLY8S7LC1Vl}1+C-OH4Yh}wgS2WtlTVg>G`4}qDA z{Q!>QZ7e%MAMzh|D6axNsh8n5eS?f7v(go8 zzUzvwM1;U-d{p_;EzN1FaH;qe=iVr(5wEw&+M%zby#k(`aR7$k_At%SlHpsI72i>n zQ(_iZcWq@x(`fpSa=8y4KEs_a4D074h&XR^1Zf3;+5E~khJ)ma{ZA6~@WlCPBg*T3 z7vGG#a+3DYRayf1pgI8n)~lP^dnuV4YV!0@dB8()EYQspYjRN~7pl>Y(dk zOYwiWI9AoR+OuiP=4)j3Z6z|@=!GQn$xyxnq6-oL3_$Nlf{pD*6@m5}jj%ClBLd6| zT~1~|iU6oKBB-$z!Vv8gU#R5H~#fJUO)A%{B==`QOjEPe7uWx6}jIRXn zS$uHS?+FVgH&vke;sjlduNM~|84PpAMf zw=2!)DoEU{3O+5GS*|b)9V7@|d&mxT8zv-^d$ETMEI~dSNJvo3Iq1d$eaB-}n`k>* zG(FT;j1I=D&4e^fr@L{g6w;z$?Tkqy39uyb^4?&z=b<7TW<&vnwfo>s46Z~_d$kAl z<~bZOVBO>Qlf}ZWx;(M*;e4bE-vIz-aW;Li-pAF2xNU#tfgFWTF0>4Ntj40WMR({# zTP0sk@4msQ&?wqPAWjb>FS-Qs%BfpzFC_o&Se^_r`I0PaR5s&iZXCr($H_&_JH+)+ z>U}>h0U-Mr*>V+BQqb>_0P4+NTx+KYAeKpAmO4f@eWIEx@hjbH?l)}XW+XyNNB%J^7j(D@7w&n7y>cJ?BN_Q4&&)V@a&Tlj z1m01id5rCEO1$^2x)%KaWN>Q0r!i7JbO+LnoOnjA!0(NP*%K?Q_!Q?2b=`$Fg($oM zNTvcJ%7wGhBB8HaD&|?YRE z4;>XoQP!nP%b``HI+cG1-IxB>96h{U&4Hzocun=&x3_X8uEJ|KiKhecP|yhG36PSpX9PsW-@b zX!oE6>T8rwCFsFnDrS5CGTn8CAsxuJ`_*&X0?i~vXi{FVB({ph)#)oKvh<}n2%u0I z^?(8Y(JHjNA{~tFw*77j5gh{w`$j}1GlY~aA+V5G{R6)$j#zL5p%sCNf7On&zPJiM z)NC44D=di^fSPTUJRo)6A%+aQ10>o!dx-eLBZ>G^?lKn?sZmVQ00eHHV54us5A7d! zi<_*Z1&hshwjP962t!KiAUx6rZkjCE5_d z=;s+qtL>P7W}+$XrM*Iu_AXL{AZ(Y{L3_09YkYSPc62eW@>nkOzaceAaR*0|gEE7{ zV)k+16uB3ZYq6sa*{Ts#?jB?)5fovo4iS@WrQ9x7oX((4XIR!zWfuh0-jH#Tk_nr2 zHC1}1<9N5V{zSVwfHFJ784jUOw}w_L|LlOJP};Ms&K5JWKe^t3G%W$jNJwX{X7HX@t zH)?fXs~V~4=Mn2qWQfYe$?76uTkTo)sKacksKcZm6GT#OTb=AL3Sg0`53HC7NVtI> zVVlI960=92efjVK+200=^RH4V4wNz}4&*&uiufP>iutz`y?&ITxO8TN zwtfCiNx|?}M7I84A~N#V|BT3bM!FbuaQ-tQ69=(tB#z?dSaB2#?9dJIJ!3I$bU6ZN2q%nr-h)13r8|3U&K zBYdEFTA1o&o$8@?e5QP(vgBMx=iMIOTC`_yCu)h4L9+As8mP5}Q+euoA@FWgrf$`l zjA2_x@=Y5Kui2g^u$Iol2qru$hM*rKEXQX2W{?Ylh52^}vyCxaO;9XFp5v%(F_vvs zzp3;Os9^Tej)6LufQxPfJ@Z!ES?uk%rOah?U|{Wwq(~^FX9B{mU1B;%hS}NEGz&#USbA z@l6Q1oF96cPJ4rl9R^h5DJ|U`s1cQ^@B-Xchk$)V3aDiwkUj=Ua`lD})^9SXNz!^0 zfaPuw1wFECda2E;M}W>`g&0D-93`q!dZ za)N2kg36!DN0O^1?u5#!Kzm#w*vM+X6tOmyfA`Kw^jM+mFI6{U&OcdBj%|Pasg%Vg z2n;lF?vqnQ02&oRN3MY_%|*q)c066*Vd+}XGk|u=K*OjRSRQrfA^s zq4ztHnTS22scEY9_(cQPXHqfcJ(JVItMas`Ow;a9q80{oPbr2JxgrLkrgQk=q6QL7 zZXiBIvlg`a3#=C}&3SRz>${~>egrg!b6PA6SY+}(`G(m+=EqZ7<21Ch^eW z4yoFuTT29I_ll|xC1x2i`;zc-(*nVFEg-4|5a1?INKE(FQOtRiIfy9mQP9R=!;>M! zMn!Yq0^$(-L8E#bg+90guTf4ScSVGf9(J?>m6#VCeS?X7)3W6yFN_3P@ z3rRn&cW1VhWYT$*7?>VFLRCU^J+8xPNr)|{VRY?I0`sz$!OFLKqn1Efac;+ef;R{h zEwTn+&n74Zefwq0Od{|hvcK;+NL$_i1${IMMbMP>Ohu|()UBIThAKL`PX+JuX%_a^ z{JpjdY3XM8!96ISD{1Wx%2>__&;5)NhkD$*qxgEKHpQXTPQ}&zOjYC0Es8Y|GM=~b za9tL~b?m*y{^?5lHeod$b(G`!HR-fJ_GN-}5{$p4V2z{o(}E{Lpok()B9-(_vZ!0| z93cU#7Lf1&)F=|lWN~m78Si|6S^YcPh)%5cGsptt9@Ajh*)>pD7v>t_|g+Kq=(o#q6;1ReWwIXVA0!irE_ zmn?2S(}9*}2RA~G>rlYc#TnMWI=M!+@aomhsiC<5xE~-n7pmqnhaFE&={r;uDG_t+ zvr(h1Rf;L4q$<&9Sd!!v5;2d&cSn@h__1$|J~eI~K^Ff?t>L9ViF*)O?juOWmnVJO zdj<}px|;rcw8}DX6(~S=Ok<_c?1?f8>A8SBY{571Lpt=UTdOKo3dOe6sMZO3X^U#N zxjm8*K>cHqwZ0=02SLmb2>dvhN2i|;?2OjeY7GlnKxGK zZw%vp)3@^wbillDAI@r3e(CJ4d^j4)u~dOWc_KIS>l{wIOjqavaG4$TR*4U?sHAS6PjkqFV07}Kk9wh&w;^>PAyYvDXtTQNKvEJ;p^2~zuOfht zDlw&s!jclcMGC4nVjF$hjx-G;gav@+k2<_<(!wV|9=^LSz064wzOU&CG&1zZayBFW zU(NsZFa^RNU z+Jc0{3!<<4*H~E4)e$mAU@;RC@;JbVy%G1T=Hj&f&$S9O_QQCiRZI0}q$}oPp$Ha@ z2K^&2`>t@4IvR4Yv5Izaft_o%D}nYzyjoJXArf6NCiDi_Fy!~)2o=I#y#-Mc-Rma3 zhVCg5!{2luLk%#ZFEb%Ws@EZ9YX~_UgoaTNp4FD0D}TPEpHH3gpI`PgwJ8Hhs*s=% z_Pai<3gaUgJX8Xis*tDwoN@|WBy33g-D?-|^AN_qZ`|0wNhI%)@;ZTdb1%9(f|8+_ zv7*c`zx}=U?1eJqEXp2ckP^NeA~f~|hJC4LCYqe)DxP~iF7MsfI^{gm!}FPbL|> zH#5=m$JWuf61Pm-{RIqa0qd6Z0?oWGSi8OO-s!Y~dd=8N*_{A9kFGM;7a20Ggv2+6?fZ5y zEk+QJVk*g{_lWuk6;X-2$b+~AO{QJWI8_1h`PGyK*vBho0nZm=Uc!#&?&{NPuc9x& z+h#->0EleVDgN7^%NTTREYir*voy~ zV||4F`2el*(7$!B;e787e%~K|$4GkDU-Nrh^mlAz5x@)gHGlh{7;2(PVyr2AL@6@f z5#?JpHkL3Wfxj++uPxY1($M{2NIUmns}hO}K-}$FtY?LKuuhmM?sXddw2RK|^(X5I zDyn8SQQ^jitPLWd5F?47Da98b0Nj(9>Evqg1hsg2Q+TRUG;=nt_6Cv4Tb%Os9qu*! z&z&=sowKd&Gv{pu@a=~9EeX;s=$c=TB$qvh7uVGnBVHHDA{V7_7e!O&D=FvK#^(bx z=V6y;E6ryK0cUyAXL)F6@^&6%H2j1y1{h%m9{~m!UIxU@23R%*SY`(3M*0Sz`F_OW zPCCa|?&Qs=eoKh!aQyhmj;!5}hU~C55m5!Z6b+a=GeoHTDbsx`a zPB@y>M*Mc2h-4oOlg4P@Ouo6tRUXY}?Pd9Oq_S#Z0fZP);PE~pIbasgDvjGnZis&0 z0`sEt@B4z*#Ty+g)ce&rKxVycKta8OUu;IisS5B!YQvHoIBh@kwordM6;m*xOHz1< zsKM;Sih-T`*Ie2(XH4c|E?kb<))arxclMqw`U4m`9bRsTwWL;P*NaY3_H3pA%2t=) z{l$7vQHP!S4Zw{%?DiF2`h+y)8#?GJqxQ&)nk?m;3cPp!!x1h9nlNPgw9foXjbc#x$HlP0K2(YHC>^rb<@0|4CLZ$b1OkpOkz@L%ON*DKEbdNecc)OoA(Z zAqBhau&KF{QNgHQfxLFXgnEIZ3dN)Xg_3N+xTLv^nE8lsfr3C%oU?SgjdY@!bdtVw ziiR{$Q94siHaKasU5k&I*(VHoeiQqF^+GGVnS+bseK z|5#2U5_}zEZpSvS_)4Kp6>u#6bg8}PAcPOTjwll(V${MDE?dh5sSf0 zTq6EMadx>g@Pr9$kGk8n#Ow+2n-n_;Gb^U?r2YwwC5q6Oudf@e8}^12iJyZ>?Rww` zRxlG}l)0Yaiv*{AsnZTa*fY#+634Ci&!PU~jzOJ{mcoaJo5aJbl9;5v9TU&n)|#3` zi?P1LgmxD(^rtmpo+&W?2$2bZohhPeC^okp<;*r3o!HAzotaVUnAAbW*?zg9<_@d` zR5PSR-2#7jGsnt#c`Fxe|%l=+0_W?Nte|Iqzwim%l`*e>Vc=U&|$^ z`HO0TXvU<$y<7nj@ICNUYDQYnz9Oo587j3}Iih$?)eI%o1nHS1(Q81?TzpYRJnb-9 zVx9QPjM(w@r&5ehD{P`v1p)QD{_-+UpU3V>6mL?JH>b0frc;zv{xdsPzKRgxOw z=1r7^`HCW*}d$ zEav^DuR)DktXGClSg-=n^maw$^4P>}EsiueuLm}Ot$cpyU_6)LryPt#SkLBBnNq&} z@>3&VawGVJ6sy7mId^*=^hraESBEV!^EB1mK#x=b9&6ABF+FW-M)E365ybcllTRN1 z&8?oXir8PRD}8FmrD<)=cc{QQh4}_Lw7vT%Nt|pKdpr+(BPA8U5xB~lPUVYXIRoq1 zAzzw<43t;VhTAYCG#C2eww5-r!6hoSPF)6f54g(hl#SLKl;tL$s~XfZM=inh!~R`i zUD0r*81mQgd?-yHbM%pN_L4QjAm|z6J49Eq&tvC9Ws2Hq{0qw5Wd8&IrHb@zR{?cS z&1gbB1Uh8mEh(S|D$y-Z1tzh+XCX<^Vuo!vq`A(|M7z9A-M%cx^XLK|s+(W&=%*hU ze2r(h!$ZbRvlT9o*$h{x?0RB+;rCfJDe$&|+kKYX-5Z%6;Ko3s21%_sI}GudQjZWY zrXY(YvO-Y^bHhW*-a)GYMvWqi%xq>=4Zk~QGj`Eam<33*CcT*%Ru7OlQO}c?_vs*nQZ(1P}#_Yh~ad?f(}!Jxy)IV-JrDOLfJfxty0*(o&Rk6Ro11!{Eq(6=V)QcNv35J zrtmo`=m>0pPMCl)ruZ0WpA7oj{wT}I-`H^4&j|i*3b>_gxyD(=4q~7aIYhbIL_#l$PY2mGS!-z(FDxG@=5@ z%^X^IfGwRyRJ`jlyr2ut5a~6u6(Zy(%A~pBQcl?K|0&AI>kt9Zd83YO6lJ? zoB!W9n^WDHfKJPwa!zL(nwBi_PdRr>@u!@VuKBB+Gp7TUbJ{Y0m2-#M1q2E+y5Q?? z0E0i}Tw?p5a&C!8XCs<;ugPWGx_{gtyYRXkDW8MwlPy_ES`gWGJRQept6rTa@@Ba* z=*$2aMgHZ)5FORpw*3Znov<FK77Ma7M}zjNSAaf27hUv>GRj)1%Ck#iD$hdvV7B!u$Jr_{m*T zlvi5`osX+R+MQt4XxG6?1yWJ(Gtz>EqXuU|#Aq7VM@{QJKoCDoX}Zwp#TJvIx!{u{>;QTK3nx7i zM`0R>9Q$@~Qf<{X1>Ym9AblK~L=df3)p2-4q@bt>W9=p+tx+Vc6(yv2K2Y+ZQt~3{ zWQLS~6P2_gX@gWwn2lYYmO5H9b3J6`y(%H}?CjA297Gekbq>%T@JMBlXE=UyY37|6 z-X|HvuVYuJg;Z#rm9NboGnrt8UVe~Cc(t0Fa*6h@+}OpsXQd}QA_kEt8B3SUG4U+55_Xwn3+M|dm;HENrgR4Kbu z5TsNPU^Z-7MeH;KbfQw`F*zh)o}0j?f<+8g3tfrt`6ZC+nZm*+lR`i~lR-K|NWuVG z75@!|>HsEMEOdCsS0Chsh29l7(mvyse=4Vmq`>k*g=Ut%=rDXl|dJ!$@fn9k~Q^ z4QPmQs-V^>is;~#h%1SZSXu&}=9+wG$8`;F537I&^gt+&9U+p`|$YtqtCPs|He?UL%tsyz?yL5dubjx|#pKo(- z1}n_VFx#2z7I>a^6Lja`O$rY7rnv$H#IqzxIC8wT@-5){d+ln$gJw&Im z#oh&DYy_x0pcY60Pdmx`q2h3AvkbEz$>cxMdi zfWD$BTm)Y!*3aA(Z^FW$fs7U^7Z15U9UYu}PMzRRtbX>Yp2t_4J6*GYFO|`OfEFu* zwa(-Asx)6=;nw|d$(;xG>aZB-%kX^hPJ6wpyh3r z3o7Pek0bTH^poiaQAC>neJK}LU-OAE;kF{X)x5Oyh(P1ntConDfoN%MvF$AEFWU%& zju!rnrcJsrI2Ci&Ts@rMSCd2P0S&ul!HNwZ9JMDNHI98s+&R^Kux$w8EBu2!xPOXQ zbq8mF&HBEn8ob;R`PskAWcaf{fwZ60%00t0j9d{O)}{ znf;=672`y3iYxz1G~5s&w(aVJYBekqDcIw>q7&dD33(7kxy=@&&f&-WL!H~g`&*s6 z%d+Gt|6yq*%L{lo`ntU3!gWRVIYq0GGshvu{5L$yyjn1l3v=k}*O!eJ;WufS2fNFe zLR-U%Rbe&Q5L-BRF1T$TzuicZzlK5%0{;5vSNK&g@G!UwS6cW3?>RrO2ml{t>d@=4 z*O%MPP!HtN37<9eSCnpF2){_L)Uv=duA(t~4mZ(W(?=1bFrGyK7b}{F>cG0sJC7=V z7~}6=_X$)9f9A(@Y3vf4?*I$QI=yh3`}u|vm3eYuvR3mJa_`x)Oz_0bx0zwQgS=?P zN@OyIZn|HW{`d(D`%-}uX6Z$ANIp3gi9qjw>=%!d0d_V_rQA-h$RC1^jPvCy;Q)xB zV_*V{$Zrk^P}&9&bZ9tEm%M8-SWoMl*Q#YjbU6)l{tcx14NQCuRJaX1x0!S^nLO2* zY~L~k>@o#pGdXC0LykzqfDMv^mIrSp|E%bD^@Hu$yh+IM5B#|AwtgRB>Q>W*ZklT8 zo_YMYg05P=ZWu9&goLr;a3|rc+}gCJZA})@RSBaRm~Bx4gv#RLL!tXCg273Zkf9Km zFxkB#oC4GxXm<3#eZjox!ROvQy$wV&iXH-t_kOd@`46@l;bhu91G4W4_ScYJO}NEO z{H#Z9t?q}@_q!y}IU>VUiF>l79&n*uFH?WCD^cQaT(@z0Ze1WC$4_1{~X`YoxtjR{#i&`!-vQ?I5vkEG~P z0KTq%$R_D^S3S|TfO^801T6`E@o0~6wzkTM>_+t1C0CcLMc0wKWaV&)$Xu!>HbB+K zu6oNzg`m%TMT#=W632CORp+%PuX3NuGo$)+3pi0rhLrQSZn>Pj04?pMW61UKO5XmeiD0@&?(oG4 zKg?kMZVKT*P2n=8DQ`pW-zDG=IQy_x_x|5|_w7IIp^tgd4)Fg2G50UR+~=4V@|K=gp_C^h0D;$P{O22*0* z$aFlU8)XV}dgbFsp4f2F>*k9^JV5uQGpxjN!wXjm*sHR0_KE1P?cDO&~iOU`3f-yt>8VrTkJT#)$ zO{)vHy#~j8aoJ4kqGEP`b~e2ypHSw)^5n_G?ex78cU0K&!S%wLf1l(hq$@;^W^tWj z*mVeW&h^>x)c_1f^{*Y9Fj5O%F}Y;|q}CEUwQS6@7&J>wHMi=&T+yChz63l^K;h+o z8*t?R-UgoD3r+#NdPKwmToG^bjjg0T_F#B)~>eD#8eyz0Q!28Tb^`-ZPXpLbIBN(M+ zBzOtxqjtHE&8&XIllJj|KMWrS9Mp+F@ zc#Y3KypXMqX>z3%cDDW=zt_Z{P_K-XCmguGklGE=uI(6rb;rf*$vEWvm$E8){_>SC@ zZQ)Z~>9_ibT~udH*9S!AH2aITW+M7cC-j#z%DCz5r^Yu(E-x0~TM;NLV9XIzo|pda zWkCj3Al5*#l_+tw?7=jZ-`1Dh{W6HjvYewubIYv(`t*=!5Bi<=&ju z3lhJ#Z)7B4yQ%Mo=48YGkT8d{li2p8=A@M=_*Dm)y5e_nUW3r6o~Eac4!3o|;y_G< zX>+9Y%4oxN2D|YQv`RO5-rj`F|7%r+5x=^H} zGvw;PnMjKTb$Ak)D1z#teXcsbAXsF<3}l=;GgKb!Z!m`Mny3K)vmd`nXn=-}aa#h6C;?rPj*dxaaXd<7OyUQ!`lHZUj4GLtk$MaFmcmwH!}@f76|!Atf$%LQ zb4w4qacjTI_Sd-qIIp7i6#D~+c?sC7GD0_%HYhKL%AG78(oyXA3exD918rnybpHV$P!{!G7 z4k`GuhU7S{Q#J1V3aGwGG-McJ%|<%k-R1urJ%593-&y%HdycHf+XQ^lo2?b&PN1_5 z{6oF{@^k8#XKRJyKD?4u0a#{xuj&wf$fTT?>Ky;*DDiT(RMU3FPhki0=2rjm=Jqrm zg+Sh%l_JQSTkHeUlp@Lk;>UJDR2=Ukh>Ft%QE`}i|DB4{y%4Lkas`|IL&bg6q2^|h z{6obRsQjVgUjIqOW#@sUxF#aOb&wQ?^ARM)O+bXsTKy%(Wq_nO>c6Bo2apse^_LVk zlLwSQ7^hlDsPUs3;};-De^3l;Y-Qrt<|5$5pC zK93&#ETQk<2|zn9_w|DB54_93xB8z{-2af`JhIMO|4&jJ=Ko5?Wj6mS z6$f`bi4XPrEALZrBro4yL!A_%LCQ4};2%_651i!RRNSFkD`mFBaIxO?QL=B*9EggW z<4w%Z7*_G$99H?CRGc{B|4PM;{wo!iRbjQV_5X#6Gklw@27XjnwL=(C>MsDTU1oJC z9d7f^Z+xG|h%W1q@*RFw_~}%Fsr}taRGMB02MJ)8sy)pnH7Ts1^7Q^;=A*+gqWDv` z)ANYpMcd#bU5_{TLd5S?bky~(3!#oZqhx{@Mk7wA{!fi-!pPy-rASEJ+-?+fh8MmFQBe&o%M(kb~NNSTBBbfZP>kLxZVj~SwhlR=STUtU#K=;?p|vg{Z|S4%%*1>Ty1!YVbu@F+xX%lrtisM zC&bLw4v7_3`)1Wy4zZQyXSglPYinr_-_n2q9` zG-WMN5BiBWZ@8la+3jf@%E-3fV2$VuIGs3!D^O$>kSK?uFaqa4K2l-Ao3B-2AZh^g zsL&C8e^M#IcTZ5E!qa%5$=i!lVI%xxV2t5HYb1X$54QBZ=gvFCCHkQ`S>BR5pd<~FZ7R?$Yn_+V!MFijgq<& zgWj;)wc}&PXM{u^mZK4DRE{1ee?BB z@&*$I*_gg@8m#!@7*tj|yW0))hakIHu%1}(I4=Nlz;?A6J=(fkcT_7=Kg6CLt5J+VH1zUq-F+lxNxz?5M99qY z{<*T6$RrXv^2$_<7HuCHXak!i>xsv(lSLw%jc${17!-6(2K24lIhqpAB{2AOTY6l! zqgWFJggDArsLSxQKwebU90|Tr11nE!kQv0G4U_a#ILVcU&?n&HEC`xoH5~t1J}76X z;5K&3c+qEzRSJb1Ua69&!>K~q%_%@HBzdgG^q3P>NHqRRL_?}+F{)+dlRd9>@~$Ti zT23K2o1(WcA}}SxZ~xs?qqGV*{o8I-YUAw}wNh%TwHYIiFDD!NPxC5A-P5(f! zp`Z6NLPafB@~mwJMDPy)Q=OZ!O6XBAt@84xln7j)BXuU$=b?UdygRgKU4q2np@cXveZB5U zL9rIH;}X>2MNz(yFo@sB@2aTIt&8-0E3MmXK)ow(RBV5vNXt^MU#uMn@?@k#Hfv{> zQ%zX9#;IL7d$rq^6D%v2#*@@~)BZaT#XC!;}^4vFev>Skd9O#)&yp(QOLN)Cvknh*fd zY?*;u^e8w0+~j+_(28rJ6Uq$dd57B z9T~!@a6#>1A#tl_Y~uHBpIJGepZE)Gq|woz_?V%25^EFI23yL>o4Qex%;oZ$HvGU` zE|#4CfH7C9YnP8tOj0Wz(+XWws(w=sceu|X9zXO3NTd^}wEB7@vd}?pt z`QvQ-_0~S+xK4x!%RQ-%YK=d9FOdHvY?qC2N4?;aB%i?#1o;nF`Fmx*;pX*ejcd8W zm`jmI1o9Kylg)shv5@NK?Hb|7;9^@lJ=dTnPui;|ViaBxm)ztxyji)ZZ_iNV@d9Bl zD9mF72$)dp?xv&5MjnR5gThJPyAaj{79{4kDJROFa|X(1qpJa}>KzOEzBA{+hqV5i zd@sxjy@2?3?xD$U{*>!o{jz=cw%x_863##89uuCboJdx(H8~$wIJE$ZcU(lNit}VIP$0QK16(*u1Ck8z)*IW&$Y8iIEGX#MY)~UDYWFpy$KL z=TgYv3&YX)I6S7%MT5(ygKkZN?5+aK0|VvJ12OgKXw76tqGzhJ3kawQ6J^GF{%J;x=*(6*;-t)AxGdMI#~} zfn?dq=Pu*(g&Mrup(=a!QopbVpc=7wN~vz88<1!R5nFQ^jn5pdf)p6B0@)k(Zr)dd za%rO4PxkA)+N6q4zR!HHJg}!SQsQ9(++yh*yl@ExpF7(eHuUw!so$dUn}X-(J3>#d ztyP1PVKYd(8>8GaV&pI;U*Os@5)B}&km@5E9*nE;`TdX$I0$R`82tq;-v>rza}>$O zzv7B0|5Map4i0GizWthuc%raY!`B){M$ipfZ(Br6a0Ms!;B&g#vA_F*$qoG-Vfak6 zF!;!!bCyxnP3Vq!z>H{LxM~e4)p}Hr@tmoeu5I2rO+=qP-w#1pJMw|edsu)>Z&edS za}c3i+|F}NHKTBJIo%V{xy1~bXs63aU5o!4#zBaKi@Kl+u{ZiL8Ep)%g~F77i(T9~51 zA8=XoVKaXw@?34{)T55Rw!rL68grd1ptJP%?MZvq4Y%N6z7^(Mw*plewC;hAyNIL! zmRP^^dm%HMy%>9|E>4sbhvFnd!lTS+imx`28Du>D`}110ZiPVWOe@5x~A$wO}oac{}mZ+9ebMTf6N z)vsY*uRS8KGjOlhQ!m#kFG0pHK{PLb?aSxV=I7Rc=WXfdWVGk)rKkOzr$O;qVS%r2 zDpxmZ5C^Md`>SGm#eGBEu!Bm`QQ6oi!i*@LoM8U4yU%8yHqy=3sbO1$$y#4YP0kW` zmWgqO-VWjJjIdhYex>{lhb>czRds|{a*UPB#*PzW{m>x@^-5ZEa3*?ykvF~y=p8HW z2Pz>kIL6Wdq-nf;kRC&RUEP&j-8o&|@mv*wU9AjV=EYqGXJxM;^Ie7%KSD^3Ex{8(^U!IUK!h5 ziO^6PRZ|I9$rM>S5vpeNz3J^EVAN4U&fPqu*T)?aYrz>^S%ZhA2C-=!brI@hR7x@A zfuWI1dyNMzW^D^i+cd*|N-To>Li$RFgxnMoSZZN34) zN%4`^Paeyo!k_JryA*XPMO1a0I;9lF??7u?$sOzBM-REI{|6@DoB|&`Wp$U@beJ|U zaiR=01w3g(bOOL`y_~TLucI-?6za_EX{l0avRSIL6{*UO zO076nnK(XvWnEnoA0ZMmG7sTSZSTcoJ7U5V9)>sPiNt9j!TRUZ6<`R@861*?aafFsrGGQUhp?%h&eUBj?BL229 zRs;!VMffwjxT=&m36@xF1sDnY=%ydwrc;Acl0@4~hlj2HV&0ur@JPKY@^)nZp5Qxm zN@!!t7~zCX2thK!U|DP6nM@@4IZG5o_=Rb&c1IB@me4IPwGg!7(h9Ln=gavpFkTe} z8_D2;i#b82{wEsO78KB-0SVWV&@n(%g>e@wHG`PDH+%32VcXx+CaQ6^c z5P}ojC0Ga++}+*XHMqOWZIbVO@7|}rbN;RFT7SB_s(U?ijyXn%`xG(*D_uNh%)g%Y z*WtUm>W`*p_k&YSiM^Cf z{4|qWth7wU^^C>RjMeiD#g+`Q=bFUHb?5YK8b0EM1Eqt?ca;6Kt)%p3pLhp;pDPhZ z`JVd@#U{kXZtKPFQ^eBFQ$|YB(~eNnN>f-4ka{ZZOR0|Z#hFI;Ym?dTy><0`I}P{N zHklMdMOep4=qH6Y!2Z!oEzeVK@Wev#&|+veUurAAe?4D%g=Szu>ZkSQ1-l9y{tlbX zZ;BP#kXnh`hw(-VJKe4$|E7nENN>=pwYDc~sp9NM)Ux~$vynHRN7m!_@pCZU);jr6 z(g*M2)(yLq2s!#rt+y8Hj@xv=Y}p@Iuy3-{V}6ST94n^L02VZ#n%C&s%um{{qCzzq z1C`FKK>rGn;o1nKmfjXi3s`|OzP%;-e!IKXtWiD`=qnP~zPe5rZ`s88S4du#e+l_CsSff7HczFW_K&%nvU9Jg6f1Tsg;QBn`x%4i4 zFp(88L)~-d|UF= zT#!Ewkgqwqj@Gq}CJ8n8=2+{~r$E$qM~%9`M}I+PR3q$%>y$zt)pdb*-XZRq*MZ%K zdAn@8O%XoYDri{aANzjJ|516JvFkeSCJqNAzE5>~ygi9eRS9iS;(u)J9|+O}(+8(h zr)jQpkv(H&@57p{1@tYq$q(VneO*Z}5BJ6Uz^y3ypfCe|T z0J-QeQE!qG{!!8Sr6zVvIR8=6+2_bP*B`kIxVW7&OkB(7d*w@E=1l~5!6m9h^B>yK zp_?r$iR&1_s2ixYuC2kf0?-u+D01F)^KRdN=}m2%gk>|FeZh>DerxN+Dg6n3Q1|;c z^dDN%gOd(ySoAWgzkX~a$dJ1*s6-0ln`!5eqNI{xRLxz6x}wv;>lMWKx%Fa1!ug8`tO*S}auW)KBc z76S|ESB35ixWv#GYJh62L+3V`=)ewNpOh|6V&qfcn4HPWgpx z&Or~N`YSCj2SP6ol%=1T_j0&=@mM{P%z)WukvW7;{6=-wBsPt+)B{H@zovoXPFF7( z@g{w>_~v>l`G@bbTdU4T8gC}oz26*E)E45abeYMgA{A9RwG&}Z%V%ueIN(rM5PvMM z-4HB?=yn>N)m1lmr`gR=y0Y9f1Mp9|8qn6aER2$g`?V?;A#`)}8u(d7a>AyD^Z+@R zF6C)szUvhNdxHipbAm_G&%X9vDrV1h)X>s~TtB+*Jrx@!T2CBo$cSyp=g-|7@rk$8 zBiy~B_Njsr@ol{6TL#zb&OC0A`&USin23Kj)}h6@V}cd&;uC*V9kKbAurk;}w^??QAc;&O+`in=^(OkK>m$26@U#_BE=NnYl^y7t9P+zDBE!)S=aRMJH@BS>X-P#QZWQ(}Xb%gLvc z$=m(N+buf}^WVCSfaW5aG!~Z#94m8#SpR_b0+AyrV~6i!d~&$y6mk)0mLsTp$f($P zK~Rz~vCjV8S?#-BQQLJ!&Kf`&Hw|t&Izt5PryYN&Ab&Ax$l?zmBY4}ku#pRX84o-K zAIuMKsJS$-!>$+h3IL+rP*9&khPhFP?u>djA#Sq8G% zi5NSsrkd!(K>TY9Vo$jY^V#XNB9qEG?RVp}T#}Z;Hy2WfD z?-nHLW@3M-cUd7N>xgI0ME~3pv&7@k5eZI+%~bC)N1E4`bI^!R;Sl@C>ZvWJg&i9w z-(|{!r!6jA6BWTB_JIJXpOd2Dj0&C%?!>MriziK!f>$7epzmwN?1(or zDE(e#O}VerUym(fM+P@5*2EEOs|r_R`9lXXy5_Zp8Z3DS^$yH_1MmFT`HHuFWJEhF z=Sp~|ZScy@ZBuqUa<@l3q;Em+VmvUFtE+GZGYq?-{Z8VMdlooJF}Gif3AKSL(?POi zBO5rlJcxRZp$P@~iry6RfVE8nGkc{1KhX&AiMwK5vr4=x4%eLXQ+FQa#6`C@)&` zZ!=GnK~7W=;!;crO1P_akLaP_BMr@DCsjDleFwVgN(HlZgo`!_&e>SsO;d_9xU-5G{jITM+FVD5y!}09 zftMmr?YjkguN_&Ns7vVk1-0q4CLG+SB&46visCURdPN}n|dJYV!(-S$4AEVE`*nHu?+fjTjxRu~Wc0;5( z%@k!0=w0@Jqn(3HM7@2Pf2bjvccg3t&R{5dAQ9I*FZk0WAp==YzR;;^=K_`S1^h7; zpAx@aoKVrq(1tkXS$%S^HMpj%CliatWNr`EQd&BKy6MRyOG3(Yo2?3BXUFeUwav5V zQf_9Fei`{xy-JNSWaRP$=j?Ih_o9so))&vndHy&8TAXaqV8d+F# zyl0-SZn#lb_D&E$J%0M4-1CG4Uw&k-bn_legzd48|X>CqHby(WZa%= z4e|aPkDa#YNP5>bRPzs}M>Y3IW=cf>qlK_%lt3&DGW_kjLK?X2f((C}Zy(7}z1H-g zk{}b!3OF3JQ}7|ZX(yn3#pxcy@qU}UwF?Ua>%hc8E2Ct>t_Z9P_CIn6DjFksPDs?@ zP=_m42kwfH_6l9+3po1oy9-X#l8?JWj^aEIH!Tk~wfBEW@A-`KVPD3qjd~3`F1;so zN9`r*GQ2_Fs584=(G9c@d&6_M5v2cE7WSgzcBab_H$II1F8t-l2hM*!U7lo1cX>)Q zrS&x6Oi$uu6xjhp^-*)h8QM*Ty*mFEehLD>+lHPF)jJRNXb{$y3&Q%cr2b-k+@{>Z zbT|XI8ek;CD>7i!FQNvTs56)usJ{d=M2@%&ZU(bE7oTUVI|+lbgpQ19N|^P%kB?YA zCm(NApyad5r}D~n&;%vh(*pEh1-$D-B_3AdvnUN;jJNb28r_ja%$ylZB zR7(Bj))9|qHPdjUH_yKPMyG#=U#LhLj4`l5tjP2@$?wlCZ(eWV%+(sPrBNCszUsH4 z6G_do^LF*Qe`jx}>-Xt8Ur|FBZQ-^78szxn^GGRV9q#v{J7Bg#(XZlFmS)BAglnP zqNsY}gKGJF`}Pd1iuok_5xKK<73dw1;;(dBK#tC+6*iS_%C;jvqKRR$pdx7m#^j|}<$oOeF zTQk0tkq9^_skqSz0c$XBVni?V*%3HpTkLg@PwT2bPH@@a+u1+jj}yz(}Yb#z{0Nerm97~>d2PpI~Lbm@!<^y9XOW_OneSDW?$?_G}ZGpun!PIsncNrmyLC2;oqC4W#_1}&c_ zWXyd`H_I-+RG|W=zAB|zkBrq4r?sHv)*L3ub5Bl@J>IQbrp`LTe9T{cfL zy_vBWqfta+JDoTOcvb$1uHhbKq!ZZ1d$pNSXfD5ixW1!v{L0wkS~a!R3lP@lR`9s% z5yOR`#>o7-_IP9)Y;3MMJ?Vh?1mVOt%2q=(MpQx`t>-os4`>!0z z9P=1=SgEV4`6ZKQ3MfzSg4(jbQU^mfR8orf9S8-N%zPrJRDx9dfh^U2A;Uz^WWlEC z-#HDy-C7YuvSJGl?Ml66#!3=l$>>DTw{F)Yt`Vb{W3+YrP84uC@bmcafZs%OHTlgb zX5K+el-S~2Am^XS85SrN)|j zNe7^boq%MFSr*CtnTjl?36Pvar6UvmO^mWp{FihNtW?*4dsspgCc;{GIp#U z6MKXIkMs|Y_)HlINfYJjf!hztOD6>k2r*ctc}vRr3IIA&GHqpNfB?XLjM^5%#iKMl zYUhH>`hur&7`Hz0+@2olpiTJIs*{%bT@))yRxSg~_^LUHbLH!1KmjdPl$0PQUO)9b z-6|yONqJdO{r69ewkkk|RI*kDl$>pssN*BkIC;CexLZB&SvqGdjl6^~u*Am;d6TQ7 zQ~^!dLy(PYwdaWjjES$x)>}D+_82yNj*_LLmn`1>reNl`-)B6;t5A0>B13srEU_0V z?xxDwF=JSQMl!;izD!sxWVZ*bKB)`}Yd!1D{#%mKCntyqlr#XAHRzXkotamF1o9@7 z#zKM*??KN}v`6?T0w_6)v3xuuB_sneourthNbs^E06|AI8 zQZ>gzZx_oyxMR6X9U`FYc|;r3!x`KA92O(LQ-#TyUit&m zJ8K_$&n1E-wloyn>D<;6zp6_7$6t(aAN#nv!PWc1Sx)CfwFJi*VmxD~uptvhn;M7z z4@T%Uk)MC7C-~@zlh(vJ_AGf+oR1n4Su9!HSnAZ@-2=f`Un#s^H4KT9I8%s#3Sg`J z8h7)P|H}?C8L1k9&_R>PO5wG}R9KKeaAr3k817A&XJ$UbKj@$-Nx@)U`!Pr$SpH=2 z@q|0X=`-w44t*w6;lO7FQ?E$aj~b1Xp<0)mET4}S!OkdIAnxL$T3b?nNv*s*UelZy zGK>(6H{Q2{Hn^lrfH#c_Ki2NA!5&jomNwC!8|qEOH=vpPy{ILT1xkor$~QA(MDE-% z2o=yNO4VH&z{*sHv*8Cv(9;4yU7Iu#SkU=>)^gNZKCgC#oeIlPK`}N-!`T*(mDSG> zuk2v#A9nD-4^)}G7%S3qL+?19!=u?y%_v~}V-N&nK2iKHh2XyiLH82(MQV^iumkmB z6t3skkOHH`<|me1d3L=zdjY(;YCk(&su0&Kn-~tbR8tP8QU4naPrm8^XGjzOoqKSR z!PMy0WLv1s!hna*S~3ZIqi*^%Dlw|yF5e`74|U*H^-L%2x;*f?R1bja$vM(td= zu2=OU(JzPPf5>wE=J4XAKWjg{V2yg3KH?i`@gIdCD$^f@phhqFJ-09k%&y@9n1FZ< zaaCt8?G<+}ao*JLxKC*+k*fQSGJt?WK`*VktBinxbFbww_wdvAJRTtJfh6z6@jlTZ zfuOdgJ1#t9K$4g)PYnJVvuh8BBi36+tb!raDZEaM(uN|URVF4bDbw|+e}z$<)i6Ptr7MJpS*`hsIupS$D_ z%Nlb-<#xOq<@vcMNk$QHfCN|jtyhk@YVIg^BN6`qpM%d+X&ga`^+Su+CcHtCippg*9k{GrC;_=wXgkrW&{EpS{!!7k z&eTn7Ym8&m>G)X8o9f)Yo#yA>%JV_JvwEb57a;^0F2lk8)he=ZCDFgc;j&ulD{;6; z-Hjo_TX%g{J)%D(`$SmC_evbAd1sx|f(w?a;=z@XxkM&dLOEH3AzYWvk`hJ; zLJAQemQyApNu0%xI3R zQf0Xe?naRP)WM)Yy*H=TH6kL4+QcGKJ;oTIhuRFLKP{9x{e4Sl5IAlYu@Igy+tjCp z3t&dEM02R^4_?#s2X$=sBnO4vfsn4Fbye%3Unq`F3vFZ?aGFFwhC7H0@$iU%l1%gT*h;JT1r^@FbNNCflK)6-r=C2|{W1LPQ&Fuu<@M4FJr zrx$1M#!~<22LYTeu>{HkKT4(V-=X#H9A(oXVbMM^u?$0!F@r;l4&yc4LG+W>ii6Gn z29vTf1rxTMse=x-<24f3PcZR}n8D?r9>6f{XJj=29NF5$y> zDOB_uE&nmZNy0z+!3f1B+$-qCrA!awa|Cr>ad4F>AOem|M75^TnEFr0)-#AwiR>8X zX#^pG%H3F^kk24RSGqPEkEmGBn8&djx1X3KMLj8YI-LF?DO=MD^;_uzE}?!qE4T{> z&M7^a)aQ7`sG(4lwfSk1sC9P;U(|Yfu+s@5kbiKQF-hSwyyx>&o(2{FUBT5vo{%5! zF%&?ff-Ek?cl6td_c#KBwqecnEnK7Gde99Dc40Q+( zrm_w4@h?vOFzQYF;|8VUVLgS1SJU$==4aFQtwmqQVy54HtDn`;matzl(9Kng-#;*O z5ooyAa5MbV#f7({@&a{nPp<~6NTXrEFj95Sw%?bww0sWIn1>(S<52K(Oxz7bAOjo= z9=}lNXwTwjlLWm&i98@EvHu?^k?;S95_^J)9wMme%1+#}As!UWRalm_t%zHsL`1?Y zS4vBHGbE}KNxkMtiSL@*Er>C{IVN8~bP#npjbnLmwQH7OE$H9eG71-| z|NC(ZDRx}c;Xu)__AwKhDFRs9<1a{<2*@iPEHHIYFj4llENqpzV|uiLmchfXl0lom zKS<&xXPit(3kT(7mY&Wdt)(YQH}q>S_icO$5(O~feJvsS493dzGaUN~bF&z)RKlq~X(di$4 zu@uBFQs0Yx6{?urTwqBO+KyFQWSMEP?O!aJtEH`9j19My?s4mCLQ>X(!+j$J#aM-> z)U?c^R-I^2g+N3)_z;>YMv6w)uLj=PCgwq*wj_eeOb{;TtkJ<8F=|8qA5c+Z@mmLW z)$%8}+WN!g3U(?k_z>*6Vd!5}1`yY*jPD;$I$A0sJNjp03gkawi^K(_4g4wKN`eZw z4-AYZPqRnGwxRbvwn(4?Zlk2r>_)r_z5pDotA*Sz&iL%70_AE`1S@sMl~+)4;Z-YG zQ>ZdLNtT&9i7KA`1Z1eK`v`nUg9&~1OkF|~&n7uWL`_>*SyB}0P%{+UQC5~5wzk!3 zWB=)_5i*<`uZf_%Jr`FutZH~&E8vRth#aH|`}3x^x{fG|pw=-&v+9IFbGIo_oX#|& z6G45PKv+2A$J5b$5@LR&Xju(xD|hJ6{);{LQ? z7xuFhTj`E~uAyENlD^sxaf>h1S1TF$xx~NKTJgDr(ndPb9TJHcdV%9*k~lF15=jnV zx_Q2g%rg{UnhW}xxTS>dlg7~Ittsj)7$Cp#sYVaWnD!E7zaMeGzvLLeyioJ9U2vL9 zPh{H^k>|vlEZt;+1aHS6ee=eg6Ej@VJ_(lJ)!4$~Ii*~EuBsv88e#h*QR@5J^QG#X z1<4^}-mCXtEK_Ey3CFH=aXG`-AljBp24sJ{V`7dS=_E)NhL|Atw}9iJJl1AmcvMHt z;q3tV0CSyIjDBl#yh4Z!AP7NtUX9g9@IAu}XV{ncCtv$?6mf$aPap&>a5nqUTX{HOlt_oo)A5?G zg+7cQB-kI%Y7ppY=E*(gs^zl*I$M5geLBa^{6f65b;obWtw5l}OW;F;W#9EfQW-V; zcrLDyW84x`Y{QFp&j*9V*M?oP6V_&c2rD#$^o_k|e zdbWD7cL$7>O*8JM$o2JsVznR*pflvZ8o)@92C%BL8A9j^Hu$^qSWwgZs9|K2vxJq7 z^4aeW#=qZBJ3<8))_pza2)D@oQpO5O+!lj0fGi;VaPB)>e8ro1I9OdZ5n!(hMu$iw z&>=F2334u2QIq5AezJ+@Htcs#JM%9yc*ZUg{b@oA-{s&@2bN*pXlaX}X@w|>=vy^| zP1$1mX1hk;Xu?HI1gvNc!^+^d=A^v6+?v9c5J0StfZuvXk;6V7-5OTEZBLIR1;u`# zom!dUmvmO9x4ebLO1FwZ2lL80%qL03g$j=ij042fN#uF-7LNllAt&3^phm5-E|m>K zy$tI(u;{v7ezt(9#OO9+i*c-40nG@P8+`w2HQ{x`Pc$WZmi`I%E%Z`XePZxneK%WF znwYftgp&|`Q;pD3C=fFpns2l4l@{Ct)py3?{i)&Y9zUk`7B3O7L?yP=BfJCWPdu*& z9T*b~hiz1Sd)Vz4CF*1JL7;4sX!DdX2@d%@3F({$>AVi{7X@hb8~R}kJLwL-A_V^0 zh-NMzg)}wRNQmuAvo>r?n2(Y9ir+FE%z5$~224mdJ3oFEKRHftzHeC5}F4xY#9j?L!XA>{q*n?=anIIF*+%2@gfT;b~NL@%QH=*$)%Y~P*rO!5uXc2!97!y%4I+y zPF)%tbJpla<>A;L6CXo~s_`yS`vB;}#5+UB|4O3=x0BKLuXi`hN>;>aL)Whtxv*Y< zXHpN7>!lAjj-7goY;9oBtKGQ3W#e1!wrl_gcq&nfV} zn^A_7Xi{a)r70#+z6pVfGYn=>#@FmaON@#EUVRChbP3yhv0GO4z*gk|c?BDb)|RrS znS+K|l)71kn%S7D*@em$s>)VkK@$QQHR22nqkdc-k~D) zLLOlYHTigK$~tXi;&~GS_Zv>!o?qo6i7d?sxZse9(#;4YNVcJr38R=G$6eb(GHIe~ zGYF8aK^@w?qf1N%)VLq^_DPZ$%v-O=kD-gG%~G|2qqnsbpt7 zw;xy;#@#_0k59W7^zKGm3i*O%OXie>s#uI0gNbgVcu+R(+ibObpY5#2?*w8LHRs#_ zB{-2f%z;y8GE8bDbRSzif>p0FY+-_c)y91tR}5QamEC74+BA{z3ph>i7Oar>S!%@V zlwSuZ5J9RBQ%++r=>ySs@XVk+ME;^v2(cY31;0!3=%o(fI=dwHrsamBQIeIVisZ3L zkmpYCGh2~kQtNB~^-D+z$aA+opACQuvZb>7!I-5|J$l$oz>tK>7iQ*^$tml>u6!4$ z@&*N9tD2i_vm+cX7Jz!Udb8ObK~qiYmGhsPTy%_f^1qf3oq&~W-wN8#GpVUG2Y@AIp+p>~ zUdgw31XU*BucVj)oZv_O!172LZtIUl^^}kA+n`=eAN=F?@qH!6_tc=(M z(;3>HgT{Gffcyn>5vtT0_p4meFeUOWzSJI8c;fjH@_t%CZTA&R$lM# zEE++TS57;bg5&s&^%Gm=)h38tCzS%SM&um%B4+GsT z+w*zb@cCHEM(7TQ*wT7A$+opFka!Q2JodYGHy$D6TDZmI6O$M=)7xO%vGLI?R*ceJ zCAC&-cQSPzTxz>_PBxEFbYRh{##S4z#3zOo9Pa0^vfE6VoTNlnTqK0w7t=R3RH%P& zNIXeEAb~V2lu1NOM8Jb6Y)WKEM4$s2SNQ5Q-Op~sc~sB7#D&Gbn&~EpWEt!|Irkg7 zWpus=HhPw4S6w8kEvZ;`DTl}9EcapyyZdM&U+CiTb1RDG=%`cMM`jatMV?Fk2c*-n zr0+~)#LLPJD_npU-&`*o%S=Zy-;2aGDaCeypyD|)RcttqiFvATY6KW%jVfbE^6&4T zJ|uk-rO2{z-)@yu;?aQ^(Lygb!e1hmW(b5%v+rkcdwe1BQkI@)P{8f?uN_;?y4 z_#37#d%!yX;Tcag7Z;eBs}3!TFAp`;i)@73)V?7pS#+k`xDf}r-K{6wPPUq#TXU~z z{P#{Bf8Km5D}=B5BEE=a9IwGt_kO&YDD)ivWJ9bmNc*t3LBYV!q`vo}xL`D($V8d* z#Lj>~&~BfXIW8?@**rd{Z8d+H9z@b<`0a;de;u|P`~%VfVGK>o=NaOQ##w7Xr8>Hbk&Q^nemH@>;N@)fh+`- zXts^9l4q8p=emN|S8lUF4zmC@?astsZ)NL^WqQUyzEc$q*chHe8lfpEJOfh%TDAbR z0@0ura=qPD(XTDk3>K|QnF1ZaHT>N?^N@Mo7_l?Aq8qHD&zyo={)pW=4`1NsAyMFk zeij#B(BdJnNu{Wkybq1ML_#+L9<_v27)N+Faf1n>rgC8ZW?*igsB+vo^>tKi6AOly zg|r>Fv;?fQM51sv0=3L}2kW^g3xhEZUKaMxQ+Qda0M>9aW|t0ZCS$m0mOybWk++xY zD0pvCl8uoU#@>i>`!jxR$E`6!Q13%l?1Pgo3wS#xigMn8#Fkjzjj)QeQ_rNk6kp6V zkZjklotWN(Kmzf5*ht-(v3A%xT0B@|-cSa<;Q4Z$A$qcJt+mwZj;b!*3l+Ryjru+9|QL;f$)`G08$E zk1nlAZ7D-1tV+ZDtlogCr$I4mpjzfF$n~^G(44;x%q9(%C2B)PX)gHghOU(cafdMv zunhZ-LsJETOB+A$!4CwrKHmW^N5H*keyWXK+SbWs;W@T~*7zx4cTz%jlchzYBhra|tQ?V(01B?ceJvUhaAMwa%eh%s z6OjWlKA?4|VjxTs+>~cFKng*4b7NDa;{q+MngaPP-pF=DCBg+?BW)k?lFWq`d@|)? zvj_=?vbtWt!@nveG>zXLbo@f|sf#y%^|C!&k{e=zylf3}BOouE&I(A`Odq}j0>*;) zRMh?lFjk(0FT+ZkCJMg=23#|0G*D)dC@Bnpc}`*WPeCQ~z(8hcAC0EwP=kOmd&{Nc z>+q&YjoX|i!<5kM+}}y-MH$m~JRY1JP{LIm{y#_`0xXkkn>xiQ`VN*kZ;;L#pP9`t zwyj%_)9vT|H<`zFYAinvSlXmNPnP^BXa~93aO^W+k7_5L^H0iP0jWWdoGmznpJ_RM zv8Y%6o?R;seRlVZrjco0!2{HI)up{KII*8CA_>S)Z}ofVkvhe)ddEq7EW*~XVD?2oV5{$1O_*bJ(+`kGS*(?So>J8M+iY$ z&uM`H9<4WVYY9g{7ID3PKf(}{M_MDqI-ArK|AHI6=37lA19VN(3 z-k8+iu}4FXmDU3#MJe?mxUif=Bw>9gO~G9p6i1fE3}q~rns|Hk2!~j`XI33i$G|~A7y9Z=Mv8tm(_Jzf4m$Ep9#)#FE@Wkp=hl~t>U?V%ROhGUuq7!PAlMmT< z6zyIWS^~-z-)Yblu|23mD`US-kE4AY@MUB72}j21{1UmQMb2Lp98R$T5hOKg*foxG zb&$K{AziB9Bb|8GFRpJTjiNJTjC~#1y=1I>qB%4lf33Q;tO9M2Uo}}U*Bj?X3oRgp z7ocAOn$O>_BXzmA5R3H~+=g6=Iwg#YhgIDXt0+4Zx0 zLlJo7IZCKZmSwnOTXpfWM1&4R0(hfE%k4Q?p4)ZKM3xRjLf~YXWCeoq^L4FZOg$i8 zslOf}oUt-&B`5{jpVEncF+b60Kec-v^jFvv!4lP+`6eGkPej)zB@uRISX)~|yZ=zF zzI=T(y6D26xKe&~RLQ6LL%;(rORoJD1jF}z1;IET{(xX}jbP($E3Y6}`7tq*A%K@y z$~ppE4}Qk-SW+RXRck$Doc<39_FdcvvFSttM1p}1(mq&#NHBbI5DCWrKS{9VmoLih zJOr3d@s;mcxp)XJy;1YUP8>P8_wmgkyX_onSdP)nJ08NGO-AI>Z5TnV*QYz}Z*Pit zyvJ+`QcD3N@Kv=B*T6Kh$j1r`zv?Jt?>$G14wH=F;|o+G*0-ehNN}wrUH5!A;61Bm z+Ex$x2|s@tzRKK;07Rh=KWDXqbq&aUS(+q3Prly*e$8`i7!@6?OI`=LgJ;fYskgYQ ze{vP&bk#q1kuPy^G!RqA7jv8uH3LPJ6+}JZMJ;0Fk+5Z03RGWIzloF_Iy*Q<--rDvC0N3||98?!WyJ}I}<-&sh- z#8P0Um7}o`{l~2<CN^WZYxWaFT9ca@$Bdh z(EcL3$A1wkDjsfNB3^ht`DV0cJI4Z7lI{jH7BUa{;X<)B1#QF$iUJ0JU}2^~{T zxNOS|UNa8Nf>D)LFT<}_%sJ(pbZpkqv;3K4qTjw;304}T6V+e!{T029^D)+Xl5+3? zQ&dIK4rYNV%SG)Mu{$*wKVG4+YK&KCY{qtH;3q5Bn2g}gowhuL1?v>04yAK1;-6bM zP+xDM1wPq{{>8ym(H0P04~i}(Gd!Ia;ioDky(<<%$9iTNL87<&cIUBgJmD*;*Nk(Z z3hdivJmydIsrP!dqd<#Ck>J2+!%^t*yxNi{9EKNBSkDK$v-}3VHBlTTH-^|2z4H4B^;>UR6DKo4=WkttKuz~^`){qiP>n-(&6r*^MV8sgoah{Fb#6s z^-w0PD>VI!hSfi)-TzC50so?5E!Ot$5edd8A0tS%F0`M_%ssx`-Zr5?dDUg2aWwVK?4?OM4ejsr+Wl+bVH2*g%D;BL zrq+J1G+HbLX#HO2_ZL+A>9ZOa$!B%ai+(PEx|@&dXp$fn6e7PbE3X5&;qc@t z1pf~=9Cr0h)~}PX+^+21Z3A05L_;dbj|l$zEr0hL_$g3oiaIeo6%{u>unK#?UVE5*UANmP6@@5>jxLTkGI^*dSVuBn(>@IF zkOxw=Z!t6wTA@;Cz8_3OQRB$f^!kPQGr-!4Q6qzDRhpY9lywk<5w~QQ1{{!(-hnbN z(^op*EWZO^kMqk=cith$uvROc25VYd)P2fdCC>`3ZJWlrYA!P+qWdVP7yPkTZ$Nxh zFPk^^q$Cf1exw4#PRL}WE|A0-;TWh{*?e}ADmj&ZI8F_F&eTA6{w=O79cD`bnus5E zFw1$MD&98FSJQ$5vA7E)(@$y~c5H9L%b}cH#6XFRZG4-rjiP2(#B5#Pd`gBA+2Mz^ zw+4)N_iJ~AeaIg_VWS0@XF6ZlF116fRfsOm;N;eCMJR>pi_m_)RPl7ruo56%Ph3|m zg$t;ZrCw`mf7Qe3 zdSkf|hkN8t`o2lKKQ%u-uAO$!|GND?H80 z7C}kL9B?8Uo`zV5@umw6FcAY=OWOMH~Mi4@!<<_@;#q=4aY& z%^Y9HkA4JF;D5qe4Q?gkbJL6t?OGviU-$CIQmZ&G%%+?*QoqgnQQT#{0Y6+CLSLuG z$d+Ep60=8$5j7*ql1}cihhaK-Cn3g?o&#C~Kbz#CBK3I#BEgh_l)be0xEZAMky@I0 z7X?}4$vYXDahyVfD1{wZoTozE%$(JPJYxl2F&P=5x3_yg?bZ#7bZ5DQdf9ITrM+15 z2%kJl3K2d|Z;LZ`=|li-e6S9|86dKuNO8@L0M*hMLMl3H z{mmda$*3#|CUgKjuutkuf{&8)b#wzE(cy|?58C31SxaOr4SleY&ZHR%xasbRSj|na z(Z_1t>|k+w$j;doBveBP@+d>NyMv?hT*`t+|Ng@$x#@y`rpA9KOUJ zr456wTV7$a^ffhWu=Y=C_C1a)G97Ikz}3D^@g9_V$@@=g_K=}n8#d2r_|7kC-5OmL z&9Si(=g@^I_2;hlVWmMw;~vQSx!;$0k?kmAFD(7-Iiq=zJy3e0bi7iqU)DcGBCzCF zDuen2BNoFlu)MNBrI(H06}DTsgfse(stDEfYo;vbd2i6I}>yyVNfjJ5NcJ zx>Be4aqP|yK?}i(%iA@HB)t&clLx_aLS&PXeV62HPe$tZvXyj1kK8aqBLGP%Nl@jfiYC#fC(#oH zW^Do8Pq|k0Z=k=iPU2A>sws>Sl%O3OmeAfGRd?Y-4OPBdBiFgh zV!I*Gfa)q8H9O|>)CdCKWbq|@6J z{9qNrIHHM0^`r%2X65-^7tzrzY*HCVkAS8=9lmFdHoz5yr|zZW@vZ(&EEJ?J0wMA@#B)nGH&ikMhBRk zyLUKIdSA55*zR={o;$FN3CT>?YOCHNQ0&KZllam>gi&D6>RDU`_5fwHJ^V9FWKYiAV)p z%)_mSvee-V1#wCRuIx~vg=|T+2d|+Y9UoS zw}?bAFi9n10iRNPD+9I|1x3ubf4-eQpLJWCX8Cperz^~yZSWI9C3pId4#nC=X1c|vwfq@hOx^f3`ddlC=mEzWRyj?B+H*Yr*6+Wl0H&yj0EgH(oGMks$;Zww2i9^iCc`&009+4J3#;e zB#f)XPJDbq#0Rj!e>g*t7DR)Chi(<cGm|MC8)yHGfPQARJxpjRWj?ClWTpAz z!1Op_y#(R=FP}vJVWi*VPpzJ`@mzuPEx=3gE(fVQF{AKVfXuKYPYH(9M6Z|>r5wr z?mf91hYWiWRUy==o>8~tHpW&AN}gQCjj(T$=jKohQ$p~xKHxwN_> ze5I|q29PPBo1Puq{p50m*)IQ@pUqqQSkVj0&lFiT~}yB5E_cbt20 z(}|#x@+7D?jl7QDJtkc$fuMD1m38?-taq@7 ziMZnjnc=66VHI|K_a0*3qa0&FHQEf3KJSea-CjIDU%L+3A4QGsH}$*ppC;G=S?2k_ z_BxMaFosBoIy5k`eV;mTJj76m|Btq}ii&ex)GmPl!QBbLgS!Ry;O_1c+zI*-+#L!h zxJz)i;O_20f=dW4U97eC-shY?-97$`zN?F>G3tWBsPBEBIj3lDx1S~FJ8h(39MPP0 zAxTFCn{S#9=QzRKU6ddFknIEFQW=8wq%WjIZL)TF-{;|q8-z+D1-r%gbLQ345F11eh!? zXkN1o`$YP@kKj`PIH7*dz>El9<*221E)Tebjua9``hG+FR(b;;hfw{9^zZGChF?4B5Chm$FqwzT5F zgG!#&5DwUj*Cqk3*w$fk9OBrh6{Ho33vm^ZhKoH2mh?P%_J2er31n>oAC|v?E^6Sq znTcVZ!=3U_omKj+O^CxBb&#QE?EHCmP9%|=lhW?@Ea=HrK@X<$#}>B#!IL9{oy4zx zTitE!6W$SQo+_g_gw&tsB5GH#7=qeB$4{Q!$P=FsmvPB;BZxB&yV~HgRp|^k_=?`9 zj4tqtvWngk*zZXxm~$sYNb1{S+Ln|bc6Q!MONR|g%Yvna@2n~1DUg0da6K}LX&(9Y z29t8?!wj`o=U@f?MVL<26=Gk&Wr!~CJ^!u-s zx)>o0Q98-}chYCZ1y1?OO)`%1N`*Fxcb~txjlI-KY*ShHQ~8uq=|odmJ5i~qQw0fT z%pS=dt`uGvCft`Cv`zI202am*tT``uTa=&f{HNX<)EVGzw+G!?#${=icVeHZiQmgh z@#jkl7LT+GKK(q5v%tS&Vnf!0f|U$+tgIWiAHf!pk4No3LFJlLxqVnxW@u@2IcnDA6^@1#DW z@5uIq<%D3!qpcf{DbKurHSPu9-Iy*w8S=r9N3@{-%eV)$g3GtN{R+YgkAI#o=v!GA z3&O>t9bS!lkY2l&!JaO~b}^3j@+A*rCnzf$)mUdAle5}jioXqbcnD13M$f<|jt7JA zn-GZr9Z}`mKgy6A)h6)99mI&O_qDWXR(PBGAKWPhHKKjNU2<8*u2Ihs`l>%fsiJn3 zq*E36oENKIdjqg&JO_pwzf2y{m`)t3z-~RL-2Hb~r1t+bZW~`4x4Mh}G;SHejazbX zp)oDX+>kP@nBWu8d$%bSFt2WJmwY+r|c^4E*9ud8PfP>sp%u7C$I+LX0NSvphs z`4YS2R7`2B#_L6ygbK<+Ln~=t7dta{cda(H&n#$r9oJ4SNSYQh=$%V@j&wJ$NINK6Z(SY%hYYE<%`Q&l)GklR~i5*dLy z81oK)n_Pc>JOsC#4}*IYi!qUg_Bj4$xx|a9?uPC?U%d+<5&Qfybx2}VNfP9`;qxrtAS)myZJzKu!oNRh zY<8>~0j#W?#mg^8qA!l@q@ZX2VM0oBGD-qv@P`Hbr0y9)H{1~#6d$(;%C>VZ^Zc2%egvt%Khg=AynM-uLFfjJRkfu(v$yjpulL+BlD~FmY&x| z&Sc+}I^swb&r_n>>BC3wU0pC~GrtylHHT;E`U4Rj@Xy9+g zjO8!JjOdjyWBH3QBLXvKV8rYKjF?6LjhKA_BW43&#Ej_Qh}q~Wk8|T#8)-(T-d+*m zb^%K%J&{Cm{JW9CaI^d$!`t087=}wJRr!e;pDN2_7^dKZ*IaC54lBsl4`L z8=2863BiAIji-mdL%14kK3vtUGH~H$k6OLks{*_4vJ7+S;@~{KG+6q@jDC>Y6kaNX z7kr<7)g5A-K>LfDUIh!+ztIBK7VN%bw6(WSFD74YyEdrQvs?PpjJh-z*4TD17X=Q- zVp?;xu4Xqjn%d_m16NvWOtv7c^oa(K_0py{)m$~Ge73{}N4?%oN|99Zg zm&0U8MOZ%cR6m9`FXMz^{NBKnOl!)X&U_GyPj)m|tG4y-1T64yMNJMrm0hln&EJgJ zi83Bp+n=3Gt{*wCN>IScq!Oe=Du92(eEEzGVPhbT4KbJemk;mQPa4~gL9Ar!^D$Dg zi(*CpBjY>099hI6Gint`45Csod>k=-T(LOn*q&QVk13z%^Jz4S_7CZ#h6?0<)NWE$ z{gx7oeZdgGxfnuV1LSEN+#oXzn&|N;lvGA~JZ@zgUDBaQVOO>tB9)Q%^W8;V<|()! z>p{LpxfhTGw&7Lz3M|__-d07WE0=l|fD5uZvs~bSY=&y-VC4_XnZt;ncF_(cunjL+ zFPRgd+n(Vp{wpBsGr4it(-Njz3?DN24kiH-=%*!?mC9>3SW8suYZ5q{BCs`RavPg6 zeAdtN9+%nib@JF)ktbe>Hdv1TsqSp7Gn}=Gab9&TkzGRvIO$#3J&4ex=@kSI3}~Do zqz9#sq6{}2*Glv6+1t)nkDT-P%&(ohRMk3&56_y~rnv9!8q>DkTOuJ7)-Sg1aeKe zGn2*Yb3-e6)Ne2H9+l+zDw>*)YSovAnJr{KSsvt;x(TCuH2o_I8@%}MC~Re0zA3%n$CGdaHXhvE$c^{(1FdX;q;uR4YvgO+65rvi z+r5iJ(E^|Rce;Fg&`#vV$26~1*n-K@3~qvU&#GgEDuESQM!H$2HuM-^C}ZVe?m_Uv z)$qiP$#VCaa|~YoFy3z{mKrQT(Ep{P-!$`{R6f;6PAf-t{+!Z!P}wdeo`rqreRLwW zzbOjuFe-;~FfOnp5-w{bb~u@H28VmUhn8~&kGRZ)Wf^mx-7eyLjreIuZs3FrcO$f+zrLwKSlHe1XMXm}=z z5e&0^SnKiV)5gdq-$N?#eyAmq(l#5>Tq^%#uK9uKB!XdM1b00d z(B=>jiS`Dt)%?nz*o7lth=Q*e0{=_oP5u_dB^pH1O6T~T!O?n^>%l_H#faXG>*>8Q zu1}6m$0D}DsV|dTb7RvIo!$}h=@kyHXTeI_nwtK>dnV_wg_iCJy^Vs?QxRPEB%Rjv zB)zi^J4daBmXaggnS#?_(zq@GE6vk$xhTM|cr)j{mapUUoz^WwUPIE-#ETus1= zZpR#{!&Ig$UikKD+4; z3zp5ib;B^r+t=let_{sxgnDVncB3AZBRKA6Wf4w=I!?)SH9b$7Kb>sc*f^VU(pSUg z7<)Z|Mx(N_>N)wFhfyW?#yZ41IwXMfCIX)PP{p~eYMo~#b?O8i;8+chHwwN>g2 z#H`9Rul@4*n1nX7uNing+uL*1??YdF+7%;291SBy)t`NKriNN-pB4ss8YL?^l><(r+Dt##VmvvpVc&>N8MbuI0f;^V>rUS6`GYIb=w*igOa0L0=;R zbHXzRbofip#xb9O$I2I(rNF!8DzAN=Ymz&}t7hA@R3`$k+pdo8vz3EI@?sybLM8H0 zQ73rFOAj^ebXmq`Oco>KzI%P>nDCF>j&Hb9rr{sCUE9LL%AZ4ULRQV;?}RKCI3Y`8 z$yV`f|4%~pA-UJWOe=EU6#iaGEv6>y`l0W*z8B(;F3ub0iJB&_^^u&U zoLPwG=$*Y=Q(m^0J0kTV85Joo=59BFGt{VyTh7lnewBL>N9`N_l zQA00B`m3-?AoWjSm0Ez{pTep()uLM(_q8&LZ_}7f)5usG7sBt-I@nptgmMA&LQkti z;mYsT*>M|QHzAEe@Yzo%Ak$NWDI1L@^2s9i+BDSZp|}9`-It|SHRiVTm&N2@trenm)TSG<`4ElGiBWs^n4Pf3kstz#BF?q?jeoni3h!KppK*xJ?){0Kw z6w_aQD?kwE*Vqq-w@jcgDdSpk>Z7KbZH5Yn-EW#w&>F(Mnj>?V0`Vd3YPI+Y@ zN4NAZ34PbeV2Et(O+A0k?Mz`)q0$+F=hO#$)$_Wo0THM_XxQhfeI#HP|~ z8#3gJ8hEY-RxeWJKJbZ2$ijvCiuRnn{r)^I?sws?mAvc=DkwQv0FlW-EE4~iNI4+j zz}Ze-fFnVwLWf+@Ga#4 zjZn7`mnaCuPsEo_;nl%+Ho%`dEUQlV5-l8}9QMviqLYuK&!16i9eoZCo$XPZGWR+` zWR@6F1zFkt61UJ4Y<+%cp7#zRz1Qt@qB0%NKZcvH-Ot_y4)1B}rZ-^mo$M6>`g_VZ zf=wUb@jezpbj#OMi-E0q9za~+BGJ?acUcSK@$9-Rn zhB%gCPfryF%2}DZ-2AIQJc?h74#}6NazJN^W`zT4)@UI+1gtK zF_Bx_CY0wG&#+(21>b}fwoQrBj(RVwStYCG$>?=#=yclBvkJP4%?P*x!&dal*#*8g z0`3BfrGw?-`oI0ckvI^zR8o->ehpSgsLzn3A-RTUftttOlq}_NYDERovCSUqBir@7 z#I4B3rV&{s%*nrIU$xy;Y0~>wh3M`w_ANNzzx64CEFC9^*#3Tt(Cb@1*!isnL;X2c z$}TS?tHVE>*8uj58uxb^u!}8X?oI2lbE2wrVlV8d1NJrE{dR8WI?-tw_zo8`>(lnD z!sgI;+|UYsDZA<;>Y^{=I;w}0Q(kJ%<#$i08d++1$g;~`0%>?b4_|({*7_G zF8_9x^Ksk=UzdMFUjh(5ZJhm=<)51O?ZeF%4WfTd|AHq7y-jTY>-5j8*<`iGWF5xdaLVfxjp;~b)sa~$(XvA937`bVf!)P=FBmC@9;}dsUPv^P!z&9rO+G8B|7}&upa#d-itQ*X1>YVm)zhmlv3;$e+H;N6`GOW zekHoYezv*8#`(wp)+`9?^35hy7G(C0=>TKoJXrs}4?G zzfYncSpsSLvy{$aOP-f9(Z_~$CAF61+6w3;CAYiv>b%_h=1NTNedm2}4d4_E-rD-4 zl;R_Af3i!rMv;%!X$TC+BvYRKAqXu#AhuhF#XzIzTYRW+FpUD?wG3m%tFtrG{buF= zy8X)(k?yfUG zL(_Y!4DEd*0QREY(fc!&q7{F3$`)U|8%W28zm|YwdCvgL?{tF_pb&9`EA~!7Ihew3u8Vm*4n+tC`zdFbrkFODzbpVL`<)Av5D z4zHv!PZ`^EeUktdylW+X-g@OEJV#?e{_i8dDbcV08TpxT|Cf>9JI;S?{E#>PweiC| zrMsEc^@I-#U{~-fXhA9+E-y=w;!X0n$;gafWx%V1e8--{3@su#C6#>O^6!}!tH`(z@4{6x%rKYADB0yt4f3K0SX5&(Z&QD|EL zPAv~Q7b2Mq9cB|Rjv9J*P)vgrZGZv7fv)%GR)s1PlT_j~44P=ONF%GR=ntDD8A;c6 zbrS;W99~-b-n&tMW!V!7l9z$Bm%y{li8RHuyzhrkct&)niR zC|_+P0XN%W_fpE>YYA6DwW#z+NE7<6?}(Ik)0$xkw*-KGuR#*7`({>yX=-+hOuCSq zvW=`acTwj@T4GpPK2u|jj&BkDMo?^Z3=;RUctvR3;0w;DWOmnlN`XIL0u6!{+Q}%? z-|DMi!A^C;qnsUcxZw4uSHry(V~vDL4j>AGVV$NLB3K|OV|^ZAqs;Vs^Oj0vl++sC zZb?5Uj-2mnQbR%Zcnb?5<$LTa@aeYn8(#=~(=tfmBw-FH?CTJ!R2@kzd`(4sdsNzg zoyh0jmKuOhUF<8ZxoM!h~Ed7~B`_z~~5O4WQ&71t$?RZg7 zoEF0iY*9Z$R#zMXhRec}bpzD4vf~>t!23S-&JUH~TZKWFjvmQEXIUX_)NYq(F!CNN zw@-);ehJpo^(*YBfWO+JOUI|rVC#pnHkS*}My}}$H$#xzJ{^s?L9wSWPv+YNzm?sM z;_c_W$1_*MENc`M}D6daw`I2|7t_n9K@iT9JO`~~-*7R%gs?#@z<-M;FaeGK2k&QN+ zJ#}kPpgdVTM4EZa)~-U(3LKmcDsD9m76w4}eL#!kd`%7--&5cE-!<7}X0cDK)mH(4 zbWP0c?k~feXtwA@U#8za8Dd((&@*X_UT`F$098%91TEt*b>QaO*U@F-O9@e8y(dJvjGiMdjcnFai~$j2n>aa3@UCLtv}bS1Ohu*i9d zUHr@>`wzytTw~^`xVnm*cfU7TI{;sH{Iy`UJD=E@o?{CGmD8h6m3_ z*YliP7;_~0V%fWYspQB=%H(B&Nx7T_rK+P!J{DeYL3iAxo7(#7di z+M#qE?(#F}Cabj7lqqxfE>C{Fzs4XK? z$El5qocz}vUUhPEQ}$Jq^CX5@nUKU&!>CEk8`WeazCMi38$-1`NF;x40UxztV`*j| z4N(MNXMg|qEg*mtnFMK?{%@lk<3C0@K=A42Z=+mqk#Ip$%wN4)nuoh@4Np_N!CXlS z-Kr>M{)Vcw>7_DaB2rhNAjHxKZH@B)Y2u5t_WkS+2+=R0s|8@8oF(6X5z0-+{8ype z(&Z`u7Rr^^|63?GN<8fRY5D$H$Zz$a4S4}-u9{ePUt}$*z zZwId@Jo=f(X`UM8-px%&JQ*`&0+nYm`^-hw8GyVm+#MxXQuR1<=Ofr9M`yFA$whRb zIXmqx%RB&`mu?6=wolcTOk0E)d>@-3Ao@V_Vyomly8)rDMLPEQoN@j(?p`?md4OE` z1%>vC$nxP?L;7s7-p7DG-knL7hUQ*7$&Zq&FDg!}Z!`Lg*iPQ!&$XH}!{Nh*0m@qn zZ}z%;;V_y@@FD9(`6H`_x7}}t$7~q7ysF(DCSCM?QW01=J3{GicBNyW?wtLTgl%}R zWa8mgn+kKkz!znX2v4MZvx1=Ie$~2fS>n&KTM4uYUR`^CEo_%c0CvOR)qX=+@6-41 zoEVas`d`8|;Xt8Ph*Uu4Cc{qIW4)3AlAjz+Te^ax9Xjzs{O1*Tl2v&;%C~-7iZlK~ zjeA!nl>47nw=<$KM~@IiC}XahHYppHATfpHuydiSk)<}LavAN{Q;EWXktEJe)Y+CnnLLnIaV#Tx3Xb#h8RN{!EzHTii|5cvS&t`dO~{9vadjTO*>{ z(5tqrWVdr93~&bbQ>>F~24s$2x3ko2$TArjoYj(9`WfldC;nA&@#fk~o;5OfOTW_Y z+w?IF&?9nXb`6G9*6FE}p%TJX>}R#s^nT3WxU2lp51~u=SbaGN{RH{##d2Uyi0;w* z5y@M0)lal{3x)-VGh3=Pgiriv4XNR~s=N;&5}1l8``d3&#;?oSIoPg4NSVhDU5G~l zBAx&rLNTr15i&O&MNpqW+50jr=^-;cgjIxqCmXpZ2=Ub*&_)s`?$BLhre-&)GsP$7GMUv!|{IKdx{K-<_lTPdwrQmxDo($KG;1fe1 z#5;fc7Yym8#CgSo_SB~u;DOo?Tu32==#4|JmfXnHSaTnP@2Qo*B z0vj_MQCX?^jywq)pI@1!qJ(^ogw;WEu-P$=y#zLDtp(<%<=p`!4RNA7MdK6G{B zAr<891a7KQLWW>xPcjC+N=&E1su{O0MOb*+l^W$j)0jSFJ;Y0&8@%vFiGSk?UDu%| zG|@FMc&uPQa8kN^0rB4%h8Ck!8c7l8z*4x-Z$X>^_~Yp)mh&D^^y|!@xulno*s71=jpVpao3eBs z6=V)dRM=dha-ASYX|j!QMQNXx>d!Y~yh?d?-Rf$k9@@|@&IGxVbuS6Dt5x9qErbYl zK!k4-n~;N*m$Tp#9H8QZo+%+t#8Fjm1UZv3u0_cSQrBk?OEpp1=2Y-m+PI!oJLi3; zPnxn$ys+&SXt&x=sXx_GtDEzi0H-9D8-+<#+@1tn$mOk68DCs?m)wusA%Z>E|H*0H zG+fae7CR{&IRana8&DW4ytZY(123w+B@3@z_Xgc2S34j%vY zFt>gAaV8R2k0NPvt{By6C1`_MvG%ddhGCPkVXYP(6}%{XYs|f;i#%&~ zztntiXEk$GzWpK9zMkJ)}O_m4M-V_R6 zG6o6ArQAtuvgocp*AR|8ghNfBO&<0Lh_aYtMo%EBg+^%ofW5{0Hqof{ZK5%+C7*XZ z5!OUe&5fS_9oO2oCHK|MAba=R4>8!)bU;8fz>e2aXCO%}Pp(X}{V`XiJ5$1CIra^F z5j20CgMU|CAg1s*MFyTH^%nFN!#q9531l2##B7lQD7Y~|^s6w}6ce(vSfKrBAN_XS z$h&T$YWIkB)oXA@JW)dzpjWE717{ICD~emK!DwGB5psBqce9t+vaxzv{e=7wZE`TA zmx0owoVz4g&n=)mSSN3{(-;k~#pbBl?}>AYBx5?a{VLH+~xCLYUk2M0xv0TVXh z0K=P1vIkDSmIOndnmI}Md++`Vk*gToff_Au9KF=uh~wVbBfwZoGs2uew(+%r z$VouCjuPlcy_iP1L3o@cC-EE?CccCf=Hw0S)A2+c(D&*Iih8RyfKF1njWN8yoEwJF z)1O#^)mSJC*OS32Z0I$tI!pjA>)HTH@C7sPEnVU8d-&hCAQ_Si=*^*(T7>VWl7HE2 z&V<*t2%N&Fbbhw1M`*VBZ9oci-) zv{mpVNJR(l5AzNWEx5SLtkon4;?mf9>n`wG+{GDu>YxS}cQrsakm&8njlk;_RJL3I z)>CndR}eOanh*P~gKaCJGLq~Y6?DF`py|JK_*?U;#aJ_`_XLrG5>Q^>#5Gp0b-Ab4 ztdZuGA%lQ}oF=CNWbMO;N|HHpOd1H14N$tSQvNq5Sws?*GaMlSI88)@pg=33&ntJT znW7pfS=3Dz>EIx*lRZM0&}l43jU>3p3qoB*a)WzdCOei7s>TIHts)W29E<80?$Hf? zpj`~eF~qgk{-aJ5=lW+r_Xq ztaxvZRUtjzL8k6NxT*W;fo@ij?0`h~XF@tAH3?T!e{ho)27CU3@>{9HRd400qo6(} zJrglE`gW~mgkkfG5W7=|s9~66gGdOwnn3J!t;nZdumEmkM>OA*le?4JQg=yq4XLbJ zkWVT~czC$WfB06WM}&0eD+_om$A2u*O4*5~ek(;|%vFaST!@0nqpb)caM zin8O~@Bf@q<+@q>x*RW=_!1)3t7{vWpaO{WiSfdUZ|HKGgbZu%iLP4YoG z?$C4={y#Lv!T6w4C3F*wEArmDPmsBQ9)yg`E*K&F{1-w<^okJT0e>-sM1M1c7hr~v z=x>IQL6SOgd!(E0+5_(D9T0oMpdeV?` zlCVP3m`swWWYP~Yv!ZX)jtVqVMYA?4R%tZcorxKm(j(MnIq|HHlAnk2ST*zNT$Bj1 zsL_QJWAUXW;0yNrYvP2=ss*(yvz>0UBE=M}f{Xa9sCbJK;zp&qxASxCr_VWu;L^Vo zen1yb_?kW>Ic#cZ!aBpObqj##du2TPDPiW~V@;%_D=CcBmJRW0`w{wX{D-?>hbHO# zMpJ|_#o_UDduJ7m<%^MH1+{;cD=D{7BP%3^lSmIEnSBe4cM@iyP-K6=6n&_pN!Aol zp?1BjQZ-6-{JVJzD6)MRo~Pts zn!R0tqR3=8HZNIA$Q~E_onixJV!=3;*f*}WND=fH`Ly1=ZkwG?HH9F03{QpES`;hm zU$dmZd=j?DJ0(Vyu|=VhZX>^PE03lJO>z;v>_?d{U4S@*GmadJoOSdTj=}zuZ(|*L zY#GjJyAjO}Vo*28a1)6YaC3pu@<5&<(g;sDY5T}+^R^*Q(1@0*Yoc6%C5aU~ZKrBvs2G~MwoKbreSZ0a> zw`Y1!nlVd?!p7J_`q|PuXFjc#m>jFBxGsO>VH@OTD9_+_$@uhMo&(b2{qMp|r>m6;q&$_`WTrA(SQtLUn zI&rC-2l4_31n~(fU6@;S3fLfJk3bL_ZNgudvrB=mK9(`+wysHn^YR`$pR=E;SG#Aa%&DYY@^;BvfEgB#|Jif80>&?VQ!2lc!#`q#xcC# zCU!~%x@kYT`hId-z`$+CLDf)jJj4L`Vg;5-wq62M3)p83Oo_Qm;3BTK_n*pYt)`*l zZ#E+WWwR#F^XAB{NL4cyYsd;WJct_kvU2mm;2}m}ewV~@zeEqiG#VuH_$Z`BF&xYoQP(9r)>iD>-7U5KR}a^A z_1N=lQ-2K<(F2weL#*BDagW-Yop16XM_H+5w(*BMp$QHX@Al4wr?(1N7gQiQH<$({ zGnQK6V#S4&i3GTDW)uh-hqh}^!l&%iCGZ~%%Sd1EU!FG5e;t$d{dRbC6JvCU92eMd zlCAefLbO`BFfRzV&CTqiYRPVvTpmG^zNH6MIfi$l4{>QBP`=Ba?}9obOQ*j{JR$A= zbu*}cO6TrpamC2PZwXfw)T-w@bFbA&0b`qRxpl8+YfxkM%Qe%BFKv3a%zY#=Nd#?G z&gp}NY?862$pUSUdOxkNBme1#Sc^5F$!?+~bOV>;k71?MN;~N0{v~-i52^6SKGf-4=m)@*2857n4q^=E}kUhkCz+TR2G zG=ujoq?Gd$Ueif0J`%NIU+SX9lR*hH4rLQgZM*>hJ1%$Iyx|$>u;^X1{rf5b)n$p{ z?miQF5-$JYEGR=Y2^EBj;ncjTvYX-OtHau{of;8_0m6%0&}ehJLHi4)!P|Me8-H~> z`bq_CPG;oTsC-5}l*^zB6a`9$ntQ)GjhVEWx)8hp`&<1I-oQpvsQyhlZH zvoCSd4EcjtpYl`~C~v#P&6iG00=ds(8}vFK#Z&J^()-Qrs!<-0TDUCQBU z4cb4(i?4OZ8+Q*{KYnLd>lHeNV#INm!;TM1$3VuX!Y5^zXU6gR70#k7j-MM(m`sK$ zt`wZTC@O#1BYT`f*}O%8PfCFgTERf3k{(1H7)0%^4%9OZ)K2N4qbJ4gXAWe!#qUgp6HbmtgMC2L-$zmcC z0L@QFx=;0|Pud{g3c}7+SA+dZCbucvmfZ-wi`~;3V~|%wdi!+!`lh_SV~$44*oxk6 z(&+^&=t~7*+u|R+!&62VM~&wCBfX_Rr$;y-*9!13ltb?@y3$3Mt0|LCZ;az~H(#cC zG)i}ihtU<+La(>LZp&E1A>g5LY**(D*sE|lnQw9~(`|CKTXE8`P4#N%rPMhMu5fCf zZ_ohc1GAze2C3MVrl;YX4TCb zdzeD|tK5HzwaDON?VDUW0GzDdrthHs!T#nGZpu4YilDn9I%?wQ`~8=v#+L)s9J`uk z{$!cGp5J7*cGxHFceEdfYhI8F6K2Hd->5nTELLMbs3djHlnv{AG!p;u(%jw}z8Yej zV+oI}(AV)82zdGQ52%!9xtc`Use!P3u z|MTtsn!Cxh390}?pyBUi?Za1AxnL&;<`9gRx6BwKT9==GRw34Yy4_OGA_Y6cPiA7g zl{T5I4q3TTI}aw8MS$E~Mz6@Q(E5YHVqN+xE^cdqVX z0f2bg5TOhb<7DKzirrTzz1x!=94P}?GD~6P*ds~1XoUv0-xHNIt(8`LAB;&BUA*bZ zI)9U4EX39o1%2=8nKUrVucEKkcsEc6zmoLnpfteg08dxyoF12s4q0vX(}&VG==F{v z^UR`Nsz&B$Tk$NCjW45_z14n=J~?Yd^7~1`SrL^H8rYXcMn6zLHn5tUC)8}#)(tixa&>IKvtMnROT}TY;2vt z>~Smjx3PoC8I;(H$15n)+v3&a{bZ)w(f@IU>9^XZqm1jS@>5NtDyR^U>U_B+_rUqe za^6AM?f+nj6mgb^4*$hE(l4jt0=ivw;c#6;{EybPkjo3=r#0|saZqg>wr_REX7Wb( z8%F!U(q^%B1~OJ_-%?MLOa}ZJ(|rUtn`=#dhT+dY;N2NP`QDXqZGm0K^H&&em8d0+ zPPo*eT$p(go~wcZIk*VGhpc5n)TKAj?-v)vqc7UgnJzRQ0B+ZwxND`Q`TD%JYoAyi zBUANFNbNkLAbQRT(5u%taB9pKLIWx)Lx`7%*J1p$P1Nq@)eh#6mu6juW;mLs`#jLq zKBM(%p(aV8>~bUT(jXP!BLWkI99Po6CcH{qS3mx3D>MLZ`VX2^?$>z>1PzNP9TCC1 z#=mui2B$bX>d0m;;r*4u&u*Q8-Nynq5_fxhd8Bgk_dQ=q>uxOGig9r|eK)b_On> z$gBZd?}tLaIwPPR>qZ!lQg^}TSBzO}*m^=C&A+jI+pTXQPmM~nY!tqIKGL{9P&}kB zOPIVWy3)M{{r&J0&6gX^kP>b@uz=Ha=Eami3SV}A$V78tdom^aP< z#;y);@I3~d1g$l+PU#-Ud|@#ZK39aeq)%Voz+RXZs~GAR3cMeb3tpz+r&vwRF>kbT zAbJMP?n5^ZDW>P|2lBGbmbWXnpl{nx#6>LSMgaiQ>!(X1)E5P32SBSm=X)<4E71 z=R$1n$?z&ijOqANvOW^?>PDQZo*@}M=HAUtb_n;{C3`GEQMfJ#R*5=#I#SdZs#~Ph z+@YmF)^5L476|E8;qpr_Uzh%&vxj5b?+J#IT>e;Q>-CtTZBn zp1-h10>u9Yrsipkaty zGPtm&L$Y1i+3HJ(MiLtS{b6Nuke~`2(6yjAu_RDWHu8iGy5(%hLVVn6dEV3{`Qs2Q zd%t+GHojZgom_o876}1+Qc!Fia=pqKx;vTF=nK4`&2f4>uP2|ok^IBIV*+U1EoO*R z8zM09!DJ!kES=Rxrr*Mv&eDZ!bcgN^9zQ9udA%_vA`H&<`)bd)B&YggV)cr#D}{R{ z&gyX`pMc4uEiBbgP&E9a&UljC>x}uft_2Y8zpyEgRL+w7CHK2siEFlMyaspu4oOgs z?<0^tcbG_jAWFekoQ1yoR&@!(%iqGdt@$OlE{4TBeJ`Y`v5~)LFyaC-+Set<-iTek z6PM>`A{H)%s;fq$Sr){lrNqvIi{5~uCV3}kDfFtA#*M3&Nt z`k)H`D0CjHaKdepEehW6gg+M1vNItC58CR1nhkJokv=Iql|#&21q3CDEb zr)tgZxMQ`o<_YE9LLaX(yPDNjf(%g#JmN;%Q$9;dV9!TmjHINy> z-?X`dUQYAqOg&J1!2w<0;Ro&Japk!%oVZ6)M!TAg^O@Qc-|Uj1VP0* zr<0H`c+l*()?9E^tnP)49?>RSyVKnR#k5x?!p;7rN-591T&3wa3Z`4x|Hau`#5X50k;Xx>UMPf>@0Rl8}0`iWp(tGLBdxi|W&1HNLE(-&FYV)?!8UPB7 z(~eH`rp{s;E8OD-C)!+G7lYLcM{Djw1Z;N!blWk!^o;Vi-|A#obpM7wswPiN5HK-3B@r6s59imw`ORqE1va*1}l`ZH@5bz>-8} zmnFjZx=UlBNBRa{_J%Bq9(0{~bN45s`1S3yhY3Eq7ynf?nlJPzl9|hsH#!d;U9u&S#>?aZk=gB9|rMOEt;NifQM3UT59)~ZMeje`;P4WWPyMGOoM)k#$iGaT8 z1^Q^;H_@kS8X`ErOYW(S5X4^xrB`Do#bV|U1NwckpeeAA-4PqISm&RCy_SSUwd{#qj8^fiYu;u8Ng7=u7ihC?QDh(L)-;EGq5Fb`fp1jhSA3Jr0{e`9wx9Qaf9<0Q76=5hK+pcMS26UB=LOm zkwV=?R#SiDc~J724xnTsu$mD)?{oT(g|g!fPm!RA^Bm>#p{a`$rn9X?^QmH?!h>Cx z9LJM>SBD0-M0ZNrNr1d|(t0n2h^LwUL985d2q9eL~ozaFL0tEOHP-Uy(!Y;TG5slK*_Oj9JjrbcC) zg!2_+2Q_lNT@|74m!4J|M-*v54O$k*P3n}F*cHzZg~t0q$3gO@a|(1&mJ<0{%M=lS zEl+QS(mcTE{i@f@3lXq^?i=d-icAOw9zzKGd|u{;F~Yo9^?36TIq)oUSJ`>HvBq;Y z(rXlstp(7%1VN)3ocMNgIEi6_%4UnRj<;fe<%7bO!q)W2}(UJ?pi+>565;c~dh(cG->KHsHc1j^Lfo z1B)dpBcCu23lNtE#e)d^OCeF2PYnF|1hjS5PXL-j%^B#yOj_s(ny`SIP7#aM@gF;b zR~KnVFGi}U41P&!U)HapWNowdYfET@hR7N~3Fi(TKqTad&q(tfw7hB15&ddsqQ5?{ z{Q3H0TAvjEhWWwcaMSvgsA-HH+dz=9Z`ntQ$!|1BwkL%WmqsKn-_|uDBD@yVu4ziN zodf_9+Ex5jjfqs=n*Cx&%YS*NG1jE?=%-~wg8)EkOt`8{5){`@m6Jzog~aTVEu zQcLN(1i&wCShp&>Nq}}wHP(t)STqg^p$Rz4JKd2(7Iq4g7GlmtR1KWvjchhZr@7fZ ztA?>ODRO5YZ6ZNzziKLS*KU0j3R?FpmjOVo9JOI~X4QPkyk~*4?T{IPa{OoPY}rL&m6u5DF20AAzZdfAd~o?uZ({BV~Rc zmgZxci&jkZK2=PNy0rt|yf1F;nlW_D%ly-;^0ER9mRSEdTLgJ6;^UPMW+QK5zF0<6h*^Cu$&^nEX+Y zF@zSNMzXAYvPgU?I8n+$hKW0B#vK3cn4%1IRlj1$<}!W|wX*K=d*b|N5&hwvJI^{`UP~tSC+X?jjvpL7V6E# z#zJ?Rpxb!5;K15J)?2S*jzq%Ciq7XmPng{TztvYjQ$?k5#0!@a`}VzPx5eKL+e5wc z4)@FzNiZSN$abi3$m(H2-|s0O>&_T2o<|B#c~6(M9%aZoTUI!nIHWmOX8~-WT`q$V zSsv3tSLJ?j{;F?ue;Pw_;22RRJ}K9=g#>OQwvY zyGHggDw{sX7it1JzsckR7~u-nd)v(EEIUH5I)$1 zW*EKK(%a|w4v3X8I=&1gP&)rS(=#QcO%N_i@CN&i0FRJ!M7~9E_6>ri8XeKNRhYKl zdTUtL+ZsraiM&`-9Zo!}Yu*)-dfBJtq^BnbO{nxQVVNw^fP&=yc{HUt1`uCykg+@v zc@z*7ddmxb4-}O3uZ<&Z!TKH@C`dn9*Y%BJV;M+L#RPX@LTqGGq-o$3$H4+~YZRzw zAcQE1shcq6=`rE^0~EekWE z2ML7d6hblCtx+9JP0upPg7Wqqfc>}}PTl7a%pt>SJh34>A%|$`C6x`>zp!E(Y~uu$ ze|O5RCHULxx!RvWe5++(q4&-e2w&^d^R^e1+~`w#1}Fu_-U?0khQb$&A_*z?)mn2b zBK58AsIFTk<`wDB*GD9c%Fpt0QHc$7z|i=i`U)3|FCqr{mYbtec?-sf<3&WE5$WNR zTQ@evHU5;DQ)-YfGi0e3G`lri{i-dA*k-oFiNC@_)idh?*VZCi z-pTv(1+dLrL7SORTsgeL{i@i8gLVezeE^>3LRc_>pi105v4M5A>gXD}{tc@(ZOTpK zA?7YQN(=qtl8P%C*9F6wr9U|dK#ZnTm*lg8N!<|faL<|#NbL|9{X(U=r1@wJnApzU z_E4CgDzLAME!33?ZBOt@yfX#K3exetr_{!s1w8E?B9=EDPwbgi|Az-qVTjt08V$osRd)>cmi=M|C=iBO|x{nOZT z2xb;1-pnqGBB{pPzKwABsdS|2Lvk5P;QW-Oq0v>cl_$bSZDeF!R}ZwgnX)FOK2Ez2 zAQh*%#?$Tx6DpncALmwz-sa}79?0~-GN{%sE7i?k)#0(4V1FnQT57Hr;$vsxw*g0r`N&iEE?xU0lfMW6ifOgF;s6A`V6-4(9CiS)lgfyHrRUeCF=k+0jqB{YK3RK|}?FxYIzAnQL2ZH&e-;6A29VuE zVGhcmgBvZP9lF@zQ+#O*+5p(RViz6xI*<+R?EwG=-SL;0!V)(L{PXEr{aOmIOrg#q zkrwWG2No0B__Q6dCkG&O^eA}TxG zHp4^SPG3+XbE*k;;ds5v)w4Um9~g7yj$6>P8}5`9q*Gn3#$5!ZzP8GhY=A^*ErdJ7S=Y4L@K z9s+@UO0bvJOOJn69#;6XR9^pwtZocGp%2--#ln0!lex-!J3l9zdr+2^o8SC5gwokgWSE?aC27Y-6aDVLFo~IK{C=yq(nSAKcdn_`N^YYA zuKXsRvyd~eX3pI0_P4uY(Cc(c*{`CLEEg!AC`dZuG_*wIYDt)Dso>D1eIzNljukg2 zQZytM*CdK)Q7bD`%gByp=OvP5CuXM?#E&bO8<&XG&Y!5+tJAa)B&ooR<@y-Mb7mR6-O2L7LTex2Kz1k zK|btAzIIh!<#%5Bi>P{FBoigBaRSo|I%1yIu1Je=cgTax8BII34{_A^j~S1-L?q8rWiF z&?y8Ehe^N_az72xKjf)D@+IDvS-m56dEt}^Bh#Zrhs3^Z3sF5@#qlJle4(2qRX#i> z;AK8$Y;OX#aeaGwRw}BpNwznKfUA}bCkKwt#nbO7QqX`1k!WZw zNZ0K1H8GdU;r;;D07;qU?cqHL5Q$eIG;|g0Rq%{_WN=U$L(Q+URo+n-Ygk&`uJ0iZ z>j;el&95Ncn;#LSlb1~|(PDwRrUJ-I8Vt+(+eRQHUwkA$^;SMPt_kfnM%GR1`T znmfi>?ep>;pFu|k?QQCV?G=6!#1Ihx@YBv?%GjCB)trunLw?~96)FIdIzkQ2pi6QF z2MaDzWROta&a^2<0F1XVu^;~LJr-z2&Z!_0lH(`gZLs4SI&z)lAB)A_X{@D%-p8ZY z;e41_Q3HWOa-X{SMSv2W_X}ltuY`}ZZmRYA{Q_IXrW5MYFgh=l*~5Gf(cME*PqyH} z*T-2`K9zm%DCHKRh<89+VG3YaazLa>20L1<$?d`|LlBq3ZUB#V}_N_GA19pV}; z?A-ImHVR!#y0;R)+@&?xW~b9!i{#X&{`q>m6FV1f;)F#F{->y>w%5?)n%2n&{G+%i zg7gx9wF7NfY`HHYt7h6#<*Mf&>~d&a1iy~S*92}y)8JZSdOqWD#%OaeiL@akp2Fg7 za1O%;bMkSX{z8C*p#b8mjrF%?%=-nz`gLs?W`at29zGk)dbe~_3~=YtW87!zbES9u z@TLVshNsBhXmN<$5J~TyVj#L9wmV+t6$`Lm3<;!dKhvv(>nZfMoI2df)Foch?tOWb zKlJ3+UFbN6Dj(NfzTePxqFiR@s(*~BKoGLwk4E$6ZUFqrl=zZXp2U>I)rz{5@%Se& zXQ-CW#Kr*ef{>nD+_p^4avl1~{?V>sBDie!rQ)k*E8oXUUyZ-BFxA#8QLTP+TOpG( zV^Q+M4J|>qVF;mc*%PCcZAkLR#mg_BA!H20rly`)3?0K^+$sLmDHeNS^Frd;@QOn) z`p%bTUrj&+v(czksEsq7i&ZU+b@Zv!{MQK>JuRKER%g>GD}Oa4ZMV}yJ3K0KIoBs; zXYCziR&>!Swl|~)%OSQ(S3Gu~#SHf+Skp;|5xQOkJ_kE>AI6@=nyR<8GirLgwj^!; zEd4yUuuB&(X@n;T!t_aX%EnR?H1{!gn|Z|hvO2(7pbKxGoQ=$DtM1AWw~jGDeD%yO7@Nww=#`CHVel*nUWK(*!*Y) zOxUM+qiWC?>OYiTteceB&vkYLlG2=4k#UT8_tkCDxZp+=OSjE!e|rUrz;){-SvQSK zawUhOPD!P*nzSQ`ws!IFL0Oqrj~*psO`50A_J3vHOr6rln>_2bL{aM(FQyO0OSY|K zuqWv%tr&ri^g|qvDdn9HEpJI>u`a+!;`qvCx3#jelJD=Mg-NDN=NerCCx?|`PKlC1 zXwAdrZ$BPBNtnhniy91)ew=rSbXu8L2L42hU(%;S806S9fhPw3HKRkk0 zP_@21K`vbeUuEY6*+&Y3XYK*)=|2pT!)_*-x|10OfaK@A3C0h92mx33mCw6)S z{p-!0$-%P8MZ3vIw#i3;$&A3x8RLT=uUBC5I2$51pw{5E5rYlsD+;oM?0whMxbuA) zd%M#uUQ@f(dm1lNB_C4dr`s3cL*b|Lm%>kCxz!&jL%}}t0(ToW6cCk*IYwS*6!<^j zhN60F@@#>}oBSZ*7B~E_9_eU~?Q58zS(lvyAaeGg?a;9l#pCZm7@$(SQY&IB+@++Z zyncWKQqy042b=el`q?~wz$d)_^-gH+GlVYsi0OOl-OfHxulVuq6hS*ycmfr6{vQ3E z(Ru&(?5|<^eB0tL_$T0eSufpPAK9?-y~}{X(7?Y_31LCax&Hk}OQjIKt=R16u2}wf zF`K6cy)Wlw2MxtGpSODe^w=x2`e+I6znX=%(M3_xz)&Xmjcyt68)1wD0u2Kt2bt}v zE(ZaqS$N^#zn~)-K97Z`-L*VP8SLr^FKrI-KF{*L(T0|HA}t`A3Y70i&gmL1Zk82c z2aYmSqn)wpaD$X3m)8sw@-->`Kp+-=XKMBlAXnbC|{xXP^EA#vubGs)!j)FJ9em5*Zrx`7WJ^5Ejb=Vvlb?JmWh0GD>s>6*nWd&#E(ylg}i(GaKhI3GxTo32pn>r zfMyJS9Uo4TG4!LIMkvI<-x0k;0innB>1QSbLB9p$s1m(6KtnY-QHlm_7})ZjVT%1U zXyQ-7Xd9^RU#7)B7=%J-y}(U29IHY`)eR4xmfj`RBf++-H;ZYS~SOhr-oAoBHsi0+w!Zx@h$(WCkrC@o*rn;Gr7Fc~mYwMzdL z6n@=KzPcNd02V&t*i>!XCp-j_u0Kn7+B5BeO3s-1G8&WKnEnD>p4{}HbTG7#T{Hv4 z@9&+5`r_h1c|hqqJXtGXAU;p5U)0cLKL&HI4u5r1i{T4vp%485(@ z<-TD(i`o3q!Tm!)w|2pLUzrX6>^(|9=vPEPele8Hc&Ih{Kzm5A^0=>Y`he#Mw9c}C zU5V$^_Y=P+g5JuM_YFEEh0XKbZ^s*SI^~znb}>5}be+J1vz~X8?~EZKu0Qx|H8uc$ zIkoO#<_xb$Ov^Y18}* z*}8QB42+Fd`bD6*B3$#rWophL+Agf%`_uqo$vN+J(>rf|H~-R($l}7pWv0#@29Ftm z6g?~{S#hC0hz2!Ck{D@LlAcQc_wUDCPrH%u z$#(kl@OpXye_3Jb8J_}g0bCan#8+nmqxbJd{VrJ{7;9<3ZN9_SIz@IGZ%BZL4N>~= zz^`3XGPXpyRRhf#C0e#Q*=d6>xn{qG7m?UQ<6(g^(6j&lPZ{V`xc9FNR4Ur5_6$^k zLl5kP3yBw{%;c)UiQjXdqPIL~2&`+{z^zSJNRq9rE!;{T25)>uW!aHId)O zICNGZOW}eR?MysNKL#ft%>-c1o(Cb+Gv%pwdy!Y4a=%qcZ>2cjw4`Er(W$po*eA6| z))J$gvqpl|5_29`r4{%U@w#ANcNk)!{JUNwnbe@QNkl||gXp>}1MslmFu3gRIyw9sPPA${@Yf`^I{aZoKn8#tBs)FiAR+<0FW&Gl zA~rC`?Ru^|5f*Pk!a&xpnlglG1Xp21>{q>SBj|0TnIO|J}aV z@Nto6RFs%2iAKIr?B(FI>par00y4Y1f^H-z>DQWM9cRIopMn(&Wn+A^45?zFp?jF& z;`$)IMC78Ss22b?j}|bK+H5+irgVlS=>o|k`;vIxh5Ja)w=9x}5irmxx{=)c3AZ6m z+RFXW0>`Ip^fhS}qM(WE7*WP(4Rs~`TNBYrq^S3g*maf!Ys5G_pJYwI%by)Fl%)sa zKTe#;=g11F7i~8tz0udxjZN$5`u0h|FeZL5CaRCRVFiFPFRNAi;mYabHBEe@@vb;| zC@{Yt{0ImSmK4~Rn+#~pr@hlZKO6MQ7)_n%SHGmR*;#^Wk2x&KT3-re8G1vb6q;qi zCwJFv^;PR6FoL|OY?55qxurD|ZmuY4FI^PO@efn3CI{&M(S@8T1@}BtV*H-=bOu?$zt4z2A{ZR890n?WYKY1e)f0%`RRT`%@4UTIdT31vd~sJt#rK9z-rOg*isC zT6JrQC@egKjeMsyNj$_sI5_@5b8-L-UvRiZ^%Wr;q3t+t7MB$mrQDxzd-Fy|;NT zZ%I%-l@>Yb6_bUNy0E)~lH1?L&k^pPxWv49U|AyWa>Xs=7;EumXCwQ7dx%zdFae&L zxJ*ewxuOhm%!#_<{ZQkZ@fTOOfa_Z7-Tk;;shRG&(5)5aONG6QaV{4#Fc-5?XR|nG z71}m*ls4`Yr(Y|rMjfsAf=(lFPQMF|Yb|D1299Qxj!^dx&srVSAr8+Z9bi!%oUK|| z`m2#o3=n=Q76yfU-u~r%E$LE=i(==8r7Q1k{=;@UVm;r%Hp$P7D{RXqAtuAV5Zz%exqx?QH9=9g)gaV z5K14~m@F|*9iN&kF-R@aMXlaER=8Xcf1+UFxYFN(s?O_$4&L<3q6a2HIAp_`&1!7E|HP`Be^ zr*4{{&tpvh@I9osPc5jau7<!uaIB=eUtlBbyJ9e$#G zd3I6F+N!#^zGxk3UU%BXn(|3YeP)I#j47IRGLJq5jLjE~XVIF>INR)3d~Bhj*$|&= zd$`>T_t%ZWeWFU#F%E&jj!Ous83`K+UUaB&cds#!$!$kPOrUjg8s0!(&ZTGxXtFVh z>ChK+0M_D^_X|_z!^ZpC@Z1ldgO5X@puG|9AB66eXH3r{jv_udD;)==h-pspsk7fs zzEyz$Zn;JXdq-q%LTel1+k5pRCXE&N#(xG{=`N>kw^`GdY^osa-MywC_bu6Tbg6pj z6#d?kkao(%LgXD|Z_kUl#Fbadnrd)skIHzgZ0gjmWo^l?>gZ??@+h0qFQU@ek8AP0 zw{&duK?qs|B}&P01T9vk;7M77rL4|#1eLxABoYt|Cik2?6mO(l1}eVAx)JaD7}4=p z5G7KQe(QhrQwoAmNr6DINi`uO`@VO=vvT0Td1z1KUbPu%$CYAC1tU%i8}X39w+Vr6 zhMGcLRtzSkwHeA@nW`H0M(wa|(iB+7p!4Yo;9sKP{ z09a`yD{N2=3>1w#mw1-ITV&VSGs`9@;E#txsJz;>7;4xj(&1ldOB;$u6#>It9+i{? z<5pD5MeD*|GG?m!Q@T7tnroTsV(%{R9$Mq7W4}bdTnuhmp1axUOATwHFst1g#2 zk1=zsQD;%Ur)VDR?&Mtr1(yw*W2~zIl2_vIlQt7xv1`r?Tkr@Zt_%Rhm)4UfZt?Wm zD+`Ggxc;x;*{m=TDEA_pvrOa-GD0X1h11AHj-#}+)Jz=bisoy&rIMd1L@1J*aEis~ zYN>QZU(94Ws;vsTS)w~s%@}DUXV8D+x-ddYW|DZMTv0L^mt>RBGe{(`FMQzuG}jk* zFW&f;V5PQtQ@oV6hIY}1HTB>rSRw^BoUeYn6|%HxVH-u&r=?Zx!}(rLIl&y8s!0`T zt04YkjKT(YJJPVtPK`b4h{eVP^6v1~!FzL3of%TszJCDz?<^=&?A;a(^FGrOhe(vfx|;!Ddmn$-B6` zG1f`gWBxXSJB)mFqkH=@9ee#FAm&-G?y=nS zJm%_t>*M89)|lCKtmkr!A2pyoxD{A)C6?Wxg9y64IDl=UIYHmRhxT+X|9E-PP^8ok zeJ;a+G;PpzKz?|&1NA;sK~P>P3fho+9%dJyg4CFor}+bY-(tBQ4bmZeMe3ew4tl`( zaY#xr>m76x7z=CBv2yJKl%BTR+j~0_Du;o0-8+||d&qb|mqG^2EPG8icwEZax0haw zAvyMfBedN}=swH^pU-8UGkdPpQ3KOqKg5CQFmhlz>>=^PE7&cfxk09Ud~C$6dC`P( zQwBCI9AC$xx=HF@8EJ@gNHr_u6m4*O_gEZe>EGcnxrAlH1m-ys^_Ph6#-f>IdE$}s z1${7zdX{GNW+ilH$F!WuA=yBFe^ZdOCr&<+C>Td?^-Zxfgp=nR=l5?sh~GHxNi|!= z2GOI}&Aw(Oj>d9&k$Q}Z2C+om%|`?{B3Qu%QJ(jvnCnYbRTn5>&rw*GpcOiX2B5=Q zXaw+J^rn1dOS_57IK&jOQOx0-Q6iX`!9OSk&ff(DBm@MoKscQEa%}LY01UFlsizB2 zi|3%FDZztSK%LBeh`;h@fyMB@vdh2I-g%Q2@I?;V-;vQ6;h2^ zenC2^ORB0UB<$B4eZ^3h;7d}Bl3_9AY)C0UlcMZ5SgrP@vdo1(1yJ@-;Z_H|l;ysj zP;}aBR7H$Z=Uk3bwo#>42BlIL{4u9!#$ByQFsII43ZrZw!>vf?D$5P7pG?B@#CYw>gP*O(ZS&)`so%tyT%VeG# znp%=m;yBF$SM2++0%)r8--;BIfP@DD^uzCM{tbmy0z+ZDZIHpx$U<%eC(IhhKO#KmR`HtiN$|kSRlFS|VN-9bx_^hKsezd>q3~ zTFucM3IdY@9~<=2&Af;1y3y(07k>_*F376>a8p>ermv;>Zw47S<*+(NG+gY@w{u** z4G1-#tdq7`(plb#p$S53%7_dTka}g_2xS3IA z-s$fg3$uJt^r(FBdLONGlSiSyqZub?v`5;`x6&eEx{;|`FgABHw~Dqw!+Gvd*Li&F zpa{=~WaUpXXyGNtRZYs;00yv1)d^6*ds>6@6kh?885&1(yX-PW65=;_&5lr%X#}dMdu}GVPDM4%iV|z?QH`l_v?hAY0T!@b8lpv*HANyuW;pB`!huN) zS!Sr!akt?Lo@S!-gI@xVvpHVlzj@fN%f{vV+uHwxLmFr%hGj#@3d)(vKEsMT^Rv^` zqk;zvY6*l=Vbcc|CR`z)g6anx1cw|GvAlwR^I%vj)`dLv9(Dn^~FDvNx-4z_R$vQ1fPjLv!}-M*7|cEUM7o(NgG z(O}=I?sbi}p?gtqYJ#KwR?0>1N-}WO#FzvCld*mK%D0EkWu;o9M6n~Pq0K*A`3ZsufdekBe%#(1~RhOQ7?4VxJELG-fSyf_+k0!tn28B zRIC`tc-mlA4W%JPzexlrzce;DSSEdtpmQs>?Um*AGVj~5>S~FsdcjjZsw>kG=kZ<| zi@D5}gBQGZ_OnxRO4NOp;rk($+9%){iJE&za8)A$dz5Me9oG{;iSL5u5=Ihmk*Xigr4$o(BgM-}S#*wKKTh)NYT#{ee ze}i%3Jp%v0IA8z&2aHRb`U~SId4=c!6_q(zWCRNkfH=13udB=#yjP&;{|_*HJ%`Y_NR3yzU*i4Wj_sQbMWDC{@UonQ~E z4dkU)Ad?&U%j9-Uqy6)J()(&eX(V9BWY0^HEl;3fcU4IR%Joi>%-&yJ1A2Yf5<196 zS|b38*y@HjkTGM3N0+_PMGr{F%990Cfe8h`K5RrX9%r4&!t{<%R%|q$6(5MEm;OPX z7C* z2*^Kj4bC3eIBI(>5Y+$Rh`;_8jWPy&%M>7E5EKftPv#%scycwtp|<%DZGQX7U~1Fr-;z8dir{{66JMH=%o9DXwgvo z3HHhTAWoYf&-ml>o-C{lcs|sC%#t5xAA<2%weFOy`k$}<}EYgmv!zYdzq2UwJ#1}go z8;^iktUuuR??(h%wQcP0I!EPv{us=`lfb+N#A;e)xf~PkGwC|-$>hMfz-P*dP`s!6 z{EFNiod|4ZO58D1X(ht#yFv#bnehG_38%DT^x1uIWo*ICAA3oIwiHjJuETA%F{>9? zj~ax%m9kcctb$RQ*9S~lqQ@TrbBYx6*gp*|6~#~xP6O3(-gXB$zG8My#Px%nTV$LMG)jBubMPRwO;U~QP5{a zkn>V|iI)6U8{|7uC3g+jcZ<_;bC7B4RL&YubGS4LIr4WP&izwQ36-Dzuz#&{OMn8; zC4uc^3{7B%nk)qsfuX^KnQhye_~(}qINA79V+7tDEk;uw?)hlgIfv>p2b~CivB51G z8#C(_H7d_4oUe=JKR$PBBt|qAOa~$Pd#{kleEnm*#B3o1aX_VRy1v$9^LB_1lU~ZC zeI&`t_*aBWE*JiGXhi;xjy!u;MkK7k@R|T&9fY8P8v}gmG_164Fn152gS~CqYbt{d zs$`QPsEc^1y+t%!ssYlcX!dmy`UkeLZylo0Jc*HvuN8P|@>HkOnUe_zhMuapQoMWe zlhoekX3sNUJ>U!}?A@hs89Hgtj;5yu(a{q8>l*(M+cfYvEcog8+BwJx=_Kqf#6+$ zkDJ|tWV+S(lxD1%hQ}JY&iXF^DUz}(At!JRWQ%4lG|_*MV`nrFIcoib9O3)^D{}Od z`7g-v|CKlrNls^N7yl)Weg7hkfN6~XiySd!{QeU;at;HLqXf(Uj2r`UtZ+t#$#WRU z)BcSdRp){jDLyn_x%>RiTPyK19BRYY|aT$mly9oY`98dl)aV*_5u+_N-62~$ian$Y@ zsD?NN5=S*?gw|2KWW(?dAaQ&K5=Q_D!@rPY&%cmkz`u|q0{B13@$r8}j=pLC6LJh7 z!u$IFjW`1SXXN-(FP)9~FLJE?PvltJ@NeXZ0J7-0H*X${Iz3QFaDHmB{h^k@)5W#+ zUjDa*mE$zj%ovZ)AG@g<0~f*poD(Kyy=Dt59z^sh(U-s zc}E2i2aw&Y)Om>N)T8-DUv>P$8Vi~dNEPGmtg+}9UD`N?udK0j7hQh*VCY)of3Eow z+2iY_hJbV?w0owf)4rsIKS=~S&hogVx*_J36oFrziUE>dpU=;Q95(o^+7(>i6a}KP z(girS&aNc{&%R-92%3gT#zVWlI6(W@X7buH1mGB$jXT^G9scqd+I9X&3<=eWL|T)w=CUSs%UDI=p* z|C)N)1AIrAjtxzWxu(Q(7IQ7E(7fiivmd4hvdq{w$%tl&bSZwr$8kb@+AL;a(cThp zYw{EU;lYzo;WGj5tZiwhiUEeUkn+HI1VHcPozrR|{y(IQoai4?hK8uIiVk%fkEU>h zJ~&!L6@ftRhbgN?Auo$viksxrSL2Mmh}5VMd;l>LQWwpN;eu ziY~k-SIlv`?>W2V5F^sP!yKwugLbG19@J*=3oJ6qX$fqiLevRte1#i;nF2?~rG7#G zonI4j%g1Lfco}QASXd!<)*7yv52;=TnC!?s)(3_#Lb!A0l}SeuxVvHL6LowIY4TS& z+a|o#ZjbUB<1aQ#$&HjJYZlaOF1pngb35Pdp!{R7rG+rM3-VBl(@xKiuz9LY^<11$-4Ua z934`0}$TNXM z4<6Wy;Y?8cTceu&Jajf_k9|MVN>5ii9C2YdMPB0o43=+YL>f*$(HT^QMsd(YLpuEx1|wXg`y) zyyx{mRtHws{u~$0SLt^YKJ-hAK58dML!E@>BHcmorGz!{8<*f))i zXI6s%G;Zb=Lw384C}TQ(*LVcW?M#N8|8VQu!v2nk=}+)<{(eo-X0Me@rShVR5Z8JH z_b^}Lw|Vqa`%=+Tw&itBB=|gQ*#%!x&Ko#Iz6P8kr}waM0O7(w5K`^p-mS>4QNj2kj4E0QvCf-wJ~Wo}<&&;QcW3LP5sOKr#jl8|rFXId8eRdfdUYZ@kZYXZSIl|_6d z44^YMd0|G*Jc%y2-EI$!3bvz%JkP3Dz3!fJc;bl;$!=821Tm+FvJAo>a(p8ia+K!tFQTvv^SL0R6Whe~DDFiI1XLeg!%Zoi zMFf(A9p8a~xOHiXg^)ld8fJpb%3Of%1^U>Xs*5+1$tp^4?gvVY&5OTFuzu9FU+i?nMgxKiS}vR(gZJJAkX&rm<4li8+| zS)r4eoh&s@CNW4B>zJg`OfFYV7AmGw&!MYh(RP;MYQxq}h11S`OV@Ux3*Syh)i$FO zFqo{QO(vsCE+#WcjvY(((MJ5qsOTZniB7yhJ#aN|ALtz_SZ@~QJHm=E&*v02Y|$UbV^;w#olseOAC}~C0Ynl&vIseyG7+5&&Lk0Rav@|g5m=ETKykFQ8XNZGNjps^0M&~h1VKpB(W?lT&X`XWlDp|Pz2*CvtbJWQ~jwX z1~tq&`_fc4g)^**u&EM>;|Qp~6waAM>myXC4UI-QyqH26eyhbw6NwC($50LosVy+Z zuBS+wL|_25-0+$>gOns}5|W^j;GA0hbRD(QpK4Hn)!egsC8>HUj0_cUDas#G6|adT zPl-auQZ(1!XC9bB-HjD)nMPaz1xGI5;ayhH+Z+|N%_Hg3I8^vLU)NzTa90C1I zD26kCKvhAJ-d`SOGN_p}jSzEgMELO!qsMVTW9s=>Y>WbPc(z+esgW~yP{EI-NN~P^ z)=a|S@QLt!0>_?T7kDRHFWZ!miY!#USgWc#iO0BZzc3!_<5}xb!X;v>P+7~`G z4R&esJ1pp{GDBQd)OU0NBxY;}YDB)AW-#FqA=1MgSmDsFc!PVe>#;R%z3e8^AKPBI z@zkbcq6fpL1@(_Mnzg0t=2)C&4(S)#vbW&~LO!!%l8n*rJzeZa422o1_}alJ6Rtnw(8-?m5qt zM9Q?7*sC)mCoyAsrnx{Mm=owg8sG|`9exl)Iw#QilyuJa^*u4EZ4flz-FDc9@iEco z!cw;OTPQg zWZn#=`H;wfF&kkh>xGW}xE@r#m5c=#BfXt9+F}l#W?g}JXI*wENFgW;p9uCchX06RIwfmRS5HUi|sZC@X@(QOI6MW_H~4tA&gwJ ztajQ?u@3mR$Uwd(q!m|Do>QGYmzkJati`_;e*(kl;m_tP<3~LkPiYlA^mNkxOM`vy z@0!5j<^^jvC=-u;<^n>8F)eP-`Hd@E4D|{>yi+ER+RfQCdqUF24HlO^Qdpg{FZUZ0 z>O3|#1=MYT)>>slTL4HslrLj$=dh;6L4KndMeim$E?9tUOM$TnRFRjY)vJ{9F(KMF z!4XY;xI{3ix&1rhiW02G3iOnNnnxLld_`{o>Z0jvdX zWC{*a1t_v`W+piMGT`lYmh4EUgD4pX=jA>hZ^Rp709vtwbu&{X)>Jnb5zY|$L5{sC zSuL&&;kJ3KJd&ze60u(FG*Tnw(-59#V@EtW3BB6JrFPv zT0UeZR((b7{8-cd+$ynzvf+I4!V&k2dHneZc<;M}sb4B123c>#{$pA8T<~B5*2Q!3 zvC;965cZVa0Xqb$aklifhtIp7{n@#-|A=(2(2kll`ncAFv#(jki%jtkEARQD=81AEDyAhe;CQ!NfN02 z)vU(HUhZt6ygZUvmh>e%De-fmVn1uCA+9=;!x2_nDuOwFIFsiTHnI(TMJ9p|1c z_yZ8aH>7fui^phYezm6h2q14r1@HjZ=P|vBY7ON8mKnfB%~Ve!MMHVT#o3>&m>zs* z2GU$O!13@@H@0{KB_bT)5EG^=71Nq1bo)$iTB@_aq`vG~`p=G5OeZ!+eYtt;*=EgD z2O(sA}C%$x^Nu@0&bOX#ak00DjiA41r>m%hcVHRw$e$O zsxQ^8A)lqTBye8Ez0|`18CqMsD^1N&@>Y+nbU~sxP2F14Ll;p}OFXt!)inNA8*+~; ze&4RJP4B2C8gqeir7EPVs<1qpu96zRD*6+ksx0T2u1rg>GEL5|Fo9Z4N|95QgNri_ zC0h!d3pB9bdtP>3(N>y(ZzcEyujRP8Y_7IiyD0d#Z(V|!(N2p8NHGw_T+zdVsiX6t z`t;5_@eZ-HkVe@v;a=^n`7IjwL4rh(=0Wpg33Y5@?(bN-8tza*#lHbM z>`n585G3EQGJB(45jTg`BGxCcgVttIB($M=g~D{c(SH|&RPVj=URvB37cuMyC5rb9 zDt^C=_r8R~FCG|NoFoCK1J>61)^|N~VZ#+O-2L2VR#j@4TOvL;E_CN+$MN{lTYv3F~Q*YNG;kthz7IxTY4n`N^mUE zTMA%C)EE~JBz}!uH~Xc6;IMHDGg6%g7Z1D54t2x;z1OlMPI%cs$c!mc%M|<3Uv_n0 z)A5}wLsp|VqXjP%TFyDKz3FZBr+;dxH|-%gM7S_*YmXn!k>9sOF*5yX_rDt@q zPoRZ+aWyGvTy?JXN0NB}tz3fp&ONMF0ROr7S7dHcWWvi2kbAwIWF}>E{a|Z4H_+h$ zZ(mKM?5i*Rrvit&R(=r}Km`*-!Dpw%ygn3S57{^a{HW?OX5m(poeT(fNvtt_xr2i@bD@5 zrr(nq&mEfefe4$C-0j&cQ?f+**INj9>muTP~Mne$DUp=?ZNMZ2eq!ss|PFT zl`lL+TAU5}go_V;H+Y?ob`lW9 zkL|bmIIjGq?_2s$eIFk$oL8MB8@o$Gp_Tm&U_~>>nK1NDG*ql%(f1}R66K6_$og=v zexB z0H({8hFBqrZ=_l0=cNiroM;WvxSGM$cU*IpAi}8gc6zFw$B+@nrUbkhUVg zk;b?|4%)%2#yf+pG?#BGqk`aA+j<%C!apK^Bm3TRbF5U0 zp#%Cq9Bq_QF+%-hgwE$86ldm0BqdK|=Vy)ytk-7#LB%BNzx2Hx$~F=6?yMWk_GfhO z=`%$AfN6KK!!&@fReL^WaR|@m*|aB+Wrsf?1obFX{J5Kf55me5|oj) z$4TAqGh9s?fd)#l4mc?Zrw@c{Rvn5WrYz~ff_|Fb=gk@&wwoIR@Pqf-A96v<-LiAK z05UzFtv5dC47lw4MSy4&zB+;T>dV9V^=5!aIOB9bOG*o1QQ6m+VNth=-w}lx5EYwq z%JX{b(6#xONay2`v!$Yb%4uuS0||+JrF;K&g;Vo@~RhJevLph zg&zNk29uaPjz4wi;8>7ohX>|DvhsFr9j}}$PdOo(IoZ@%gM71###hN@(KQwo^yvW= zpRL8XYPHgCjRT500m{wHenbd|Q-HqDFi5TY$rV7AC>C|FJFlxaP@A0~NnaDOU5P6H zTQyo@ftB^?j;=>gd6vPs&UUf=xEa^}JP!#yz=c`DBbR$9C>7WvxM9CRVJ1ccUtD+E zN1?RiHX79UQGOT#Q>oo;EzY4Y3~w{t)x5KG$4jHwP`8oj0D<5~DIA=pL*Rf_8BCyL zku*S`?D8{H5R$Xe>Li&}$gr6cZB-9yV-hE0Krx0#6!_>}EJxf4F%IERc^D+1Zk?(` zen;rG;Q>n2LjlMZ>aBsoGQ2(D!n65HRPV-#m@d1LlLN7OmNkHQb9^P&SdL^@9} ze95z$&9i9ZTG1?B{YOECOx!6>?i`OGBV#6v%b51@$Bx+K2> zI^M&E|Aq{y1pkH%UvU414F4MZK>J<-m-wL}4)*ZfKNkT1vG`?@5yJi;EWAaRBPncQ zO}%ft1(Aj#Z=OgcfD~oEZ{fq(!Gc)8ll!qC^;dnQY1_8E@Csj z`Uq0%2TMOwmKt9C-9w=0N9Hyz`3Hi=w+zP+7WhQ9x* z1Ox!DG=YSyH<0DuJq=fb`%iSxB6EIC_mw!)yJ!mo=pyO_zrP28^Rk@|7o8|CIF*02 zD0Fxh$+%cug1n8+_r1F_64^6M&p%mxV`CIt-#a*j-JCx=u{=ZV8Tan#2Am3P3Zv{a z9gYqEBqCf7KE#A3Ex{Ft2Emh636HP^fD7@_Uwey90#I8h;9v8V!Oo2V4TUo2+al(= ziGOrYX~WG$WIz6}lh}D?YlAI}Fg)J_>T?iJ+Uv6yi+bLsQ@E7}%3Gr{%ZVvS{&4+! z(iJ=A(?aj{Y1xtWmgwpH^k#2i4Z-=ymMT2+=i^&5@|-tnn{qrVvI=Xlhe9haOEktS zk-bz&^NWR@;7n0m26<%VZ1xxP942abFj_U;!?Ca?6j@wtOScDJb~Hr~jrs``iTu4T zsEzCyM!d+BfYEO~9wEiU)=wNOMt{&q!enV$o-k#KQ9=)?D9P_O9h1=DgEi9wD%HgG^*?*chklk`x9@%! z*Y4OcA8U4ZzSUh{3q^*AI6f9Cc241&;TuH?2wUoHSC1^@3S8^O{>28Ra3eOcEzHqm zX$fY6r~z&QE$w!F4@XLZ`u9+Iuw5&9dw_!EbfU%xZy(!#)6m9Cj%AM+*4)^J%S~pF z2#9oVf`D1a`aIq^X$lw30ZqzDK?sovCq-Br2j?smFUYNmzL7~7oQgpagvHeCE}5k~V2iD|aUwfST|2j3w7BRheQccl=@ zE?; zohVp$6Zl|Otg_GXta*WEX;jf{KA6>nHknj%GrKDA!$Ac3Ta00GpdcMSHOF6F_PGevZP zHuv@AN&@WOjs_kyrCl=shb!lYoG}{5##);y>>OJfn?~55EehmS@i~LGg`8f>V*@|0 z`NScBf;j`M2g;l1yJcRa(f%@KneoQOS!$aQmQ(lqPsS`pPF$yj*D#PRfWk)s+bdY+qAXl}b*HR&(d{k6EY=8v&`<&F`ysrH(Pr_bd2-2}8t(Gk*D#K*fobTLet$1bp#&?qaj!;zxz86 zFQH<-{o=ndkSKHF_3}g!VsAHtUdH05PaX-6i*IqmYNHv-NJsSsskd08mRBl_D|lqE z^ej(4*7uy&;~8N3>x4Z6z^NEq&7UAtEGP}Y2F{=mMUxsofz#fT8iDO7c>ano1*dJo zW(Gs|y0-b^My>}|^q1fY4D-)7-CNeoZdz`Y3}522Pn*f!gtbE*or10I38=5rJb+P= z$j5)e`x+@e{XEnB{{Csfen}4ocdb4BRLTCnfJN}h9=m!ySPQ>XHsLa~-|G>(`K!b@>(<5yE;b;(lSS3zni)z$M0>kD#-U0j z4ko)@wD|)X3d8^>=@S&Aeb50+A`;k)sckVC__9X{%dB*OI^gX zKmM;mN9PW@0RZS;s2CUHv)SRlZK2b)muE~U?EA)}w2h?P9Y1$tOLOFXw;eedehHzWU7p6KaW4K@e49@5eU%x4? zpm9>T-Arz%!3PiRRJ>1mQYT5MjGRv@<(x+VGxWJ9R_*{XCeZG z3b0;6%0_9PLIz$nyn5|f0p$XmehC8KF3*)T4jRF|_VQgWYQRc$4(`--7$b#6)NS)YuLP+vS6Lfa}*dlDOUkL*yssQaG zPZrW+KV8wYe4f{MRg5^c!{E&gl7uFPAD)$Fr5q!qm9cdu%0i-te=D>0|59cxy+;T9 zD7@X(4npY61N9o4+PPs1)caXI?#3xL5b))Pf-^nn5kh`ODdN>eTNRUHBpj7o5wgZ- zg49`*@x4a$Che~DVp>(@fPuRAikLEdm`A1*bolGEViImH@)Sr`jt%zj_5tG0iPe6I zHZ~ESg4&l?=E!ho9u3Zzd3)2PkDLH0w3}Bv2<6)YHLo%e$nDB^9e&iQoI@Yn2ep}Z zct0%E*WB*Sn?qqc`91i8do?i3v)DDEXqQwLk6sHgm4!!?QHa8JfYd$fvDt{#h^zk& zs+<4LEr(C%dKugy%8uJ^ZDZuRkm@6BEV17M~q~0QK0xN|jX&dOLb;jLi_i1cevK986SgjYu2%8M6G z+JW#&B09iAESxHl(qoF|D`lxLUc9o>T8j4F?w%k#k+M>sdih#q>M5t4C%z1)l%iZXZmCqb8ifcQFmD%{Mp7=tEn2p)twcjZt%#Z~B?egNc>;!~bYo4i=yVd6n+82^(`-EXq*Rs;MfGe& zk~P4>6OT*uGg_0MblzC>6OQ!gWN{uZoItOPZu2nJ%=Mi=p z95yur)(Rzp=SrBJ>c<>>(-5RWNdT*)&kUe~w;~;10f^fYi-@lYjpY`CPb3x}R3O8b zn2NO93PG17YCxnyk9f#)7J%J9co_C@j)TOy!)WOg6bKq?pG?QBaauqcu!^NPOCJG( z*kT?*kOquxYaz51jQI4?PrF-dy$1RNR;P%WVQ%B$RZun9bjROQt&kIPAqHUg&sM9D z4EblPRdxEa)sDJ>wpwPKKU*!GJ9wi~FoB3<@8$gb!9%s*w=O4kX79YmA@#s=t9K+8 zy4^~Typ>-xUczuO1rs$~2Yjf{i@ZflwbdL?EZ6zIjR2203lswmmX z4m`0@FCC_K;d8$)3j($|cv3`sdaT@_Cuc1_e-qX4``u=FFs{hvNS77q&2u|-g9`kB zjPi#E0A~`o{k>}fU`d{oN;D3TIV|o9AFQLDI;LG!b z1@Hp25)bf^o4?@8O4_nN@a5m^B|=)|ANDeZH^rCiZW_d1x^kw`73U7Wgjmdj*vozV zzt~I5fs=o+mqy+HVlQpR;Q?{?2KpON8l@lpfiI^&{{>%qvi$e(r7ZQo!I%Gc>}9Y+ z@s~nCt)udJ@q5?15c7VuB}Xx=_b=zR`)^-ak&OsYA0C{$8632__V9AgN{Q0~Cz#x? zE>*q1f7i5VMR2MaKOOxf?>rU|x8wy}Lr$RdX%w0B=CQsD+spV@QxALwA8I&ijnUaQ zD`lmu5YAE029C9IFFhR#FV~r=^^66eSqe}{JZ5$dm%T<{RLlTIwv-tywW*n8|JbN* z!NuN_idBg3%7i#FOA?xB!Om(TbV$O<%$v+Ph9xwR*EO+!>YGDUG!(%M&|Dwf#2H%M zLZ;)699Z#kOnxG3Yd0XUjBZFzuilQsSV-N^l9^;mlj5Z-$+Jx5LB1SrT;~PU5J-Du zw>LvPLoRxdytNW$xtABJ&fDyhVeXOkXbjBQ5MZ4_nhogK5Wu8Ji>_`R;J^(2B6h{>+DiOpb)@aQ(fx5vsY6;o8*YE)2-fq;J zaWqhI^{v?6q*KV=GW+?{_eDS*AoW`ap;UY%GxcQ*47!Ru9p z2WWY-vFl7TW@zlbct1^u($*I;a>yW9@f-1PSoYKE@sfFbb_Tow%A4@M?QK0+l1^%F zh_64O_EO9k)klE2oS4Nm*Y0Pmkc7P7SG;&XtfH+@7dF#bmq|9=;>nN22`Wk@;TOwAqL=k8%^Jr;QZ*r*xtmlt`oEONtGQ{$~czPac5_-Pb(2BkKp0y;NflI_U9m7JA+w= zM3b}% zGIQaW>PIoTAyunf1}s-ObZmLztn!BtGLnyO2W~med2_5AD!MNITq)J?;tMd8)Lr~J z*E;9HL}Vy0mI0jd)Np6(Hjtsi0gmj=xw09qeMARn&ki7KxFEji%RaRMzopGN;pOSe zZ({@7N;MqGg!Cmx7k~|SbM}bqdh(46KdVYL?5F}(M6LTWBapf0F~XmXk$ z-)RFRALdp4_gakb(zHKrrm1^ravCCYY0LeXS8?HL(Wjf&lBma0w^QWQ+2aH$vpZR)V?s?(;jWlR-|YUwMg@IO^$CEFDhW>=Kkbyj{cvnx&0t1Q8O zwjsBillZ`;F0Ou5V2h~&dDiS~4BJbPkc76ZD{e7NP$75i#WJLI}F?RJZqJE02q;BsYvs?du`_2hIcI;O|O2 zlCG`oL!w;LV7$)>R1{s9^q2km!B083?U#;>mP?Zk;3G_Dq8^f$tKv~Z)$9`-tak(e zKxDvK_bU)9ceP9x#p0#6_qEG7(#Wr0CNC;|aT1mtaXlm7^Y`ZS^78uJF_+WV}|WTQGA8w)Tkk zLdAR>(6)Mz`J{?1hG-YWIOGW-ZZ!^J$AyC5q7ay=)?q1S@6^qv^LBbR@X9)5ri<=;Czo$#1khI zHb(+88^A@o^k>6t0uBX*TF3sl-&XFORq`C8AEHU?OA(uvrP(Y|wSWF{qJIc6S>HA2 zQS+PdM5MRxdD>fN8}Ro+Yfg0_Z7|xQC5~4Cv!pg9;*`u2 zD$QHQ%yG-Tvkl)IeK0kPi?{%t30E{Ur01 zLwwR{eoGl$CP3-$OGG5o&Dw+q161=3I&?#)2P6|?ZO7NIwsuC)0T9@>6iIC@TEzXDo?wN&Eo-#MFx*iaj|gcB{{W)! zogicDBwI&U_5w+V&oSO|Q^DjfiE7*ib;ZRI<7k8%cZX6fp1v)fY~QZM1!ULm1o$Tw zJ~C9X)&A)l#EDCE4SNYrr+P$?vi0(JAlLgQLfd)bLT^GjEV7OG^0+IYcAVF>mMa~- zw{tD%o%z+r?jlj+#^8BPT<7>uZp~!YTzbfHY&l0Kl&!lS`EOGztIql-oOB5u<# zN8&w4Jb-XqMlkeaE}s50v=P)4VlKExF&?`m!jFIG&??LSkq%{V*aGAGm!=iA^hCPU z1Ny&NiXFUNCISgQFMr%>YJd!c`KSw@H#7)>L-`_d(?XH~+&MFIE&rbK>gGBd?@5!d z)shqc4@qk#0ogrNqzfqK7569RmH5BMyvW)V{)%~#hD{YVpK3A(-k-NoYh zVD51@-u%6fb6kZHXxbxwnGA73piXJf3f6T=>GaRqhk=*$v_){NWD?Mpa3X-MMSAtV z=>AH{`w(r5VbzQ&Z2w)5PXfXXd6_wZykO%kRO+8%)dN!SC`E9t4Yk`ewBiYZ3r>NC zbD#k{BlZrTucT+nQs=&T5+J6~%;)&~EI@PKisflHmHuLkTUH8aVLVBx@8LLLeNR@32j%e73W z%CAK8HriSaKRO16UFje`D(m_TSjE8qS&skfa18i=zZ?&64{w{bftKUe`2L1I$2jv+ zC-V=PbVyI18-I0g;FfB4W#^GUQ%i{as}Z~t5X5v2bCjG6+RrD+4g zW~FJFkV*p>-`atj$^Zh$Bf3G_eM$~`WD3#p@l-{_d-=X^zkgnYaL;e)#(pm|$^8lI z1z~^&b(|ie+Q9F1OXE-6!%7B*`b;MhrV!>P5zyr|h z*IoSEC+6P6f1WdP;H~e-#c&beWpc@nJ-EI9$iaG)gRqu1Z5&g`Fx?fSV>9v>11njM%frSL+dt{D`S04@lF5`yTPE`T${!;?YTtjUKA~4V zF1aWCwlCe^w$}|S{T!nsLguh#Esi&**!sfGdy6soZLWP5Sp(z419|7Y@cn4U{kF5L z#hqsbz)2L*3|af2$8KW9?+z(bBO(~fzW!fwa$dZoky}1wXKE^MbTNJ6ni~O-d_Z4T$}aQVX16rLh=U~t8@xBO3+2xd>x^X|*f_EAE>VXj4l@W<25 z)ynTP_#)@Vu~)B9WlyC0F8QF}T6VAo=qj*=5DGqDKd8h6SkWE44`4Ajms*yopB({cs=hFobJxBPlx3te1Hkbv0mW_@A{-;c&B^CCkOq5dr z_oqxG7meNr_>(5$L;Ii7LX!xP(M_tdJh5Xcdd3GXA$wi4!sq zTg$4@4cpSVeNlvtVBb7;!4*o26X}jMmu`~kSF%{2HD5|8Oo9cN5wO4ZQJ4m^5g{WI zx}Z1qg+Hdi#Y_S|JRNCpb1+o<(D}KNMDdFa>2fM@cC#HrEtQ&2{vaegQ-SF8Stt$& zK<*mUvYxJ=@)D`8U-(UQzmTQXcE!=&aq!g$MoYK8R_#>o?vB0Z+%SNt%h~^c?&gtHBf zLzrkLi?0Hd04;MGiH1b+uLbd?hL+ydA+fP8!(7Vl)uGrskeiqN+v-rp-TD;D#07Ul z`S5gV8KhA3#p zubn+v4~PMrA!mpWDYmnh_XQ@);$yXYlI^{nf8bd&&xN2Gb$1m%i+mZ}ghHR#_{YcV z>|p$lk2hNSFCQ;x^auHPKP7^Z?=PQz8Zy7Jr`J6FZ~;}BmcX~VX^jo8 z1HmrjU&zn8APYYHqy{&s++^s>llk702dfK!$GcjmF&nxsiy~U>I6s|3j@>j^B7mcD zYs})!j#k`DXb^OQ@*j-f>40ubm&B4^i9 zrZhv{d4jU8vS*4|mb75XwLtSKs|RxL75v#d1;C>jktSpFZD#22STpl;6SMDFwS+ZI zG3U`+Ty{PlRex8RZ>S;o-1@!2>k*4bfA7#1my4;m)Gf6o;q#cPE6YxNfdnZ!{TO$c zX@LqHJeCNV3>%@;a1#S7;IsONO?_GYiZa`(m68@Ve7(Y!C$_WC%%!m%)Y$k)JobSD zpuaZgg4Bpzq9xwI0Xj$jiL75RHCYtKLu zRFRmkZK!zl<7E9(1`4wQ+Tx&>asQ?4js2mD1TW3z@h8jFx$;+*>45X`9vc=9a8qxQ z8XUBRf(98XM1U~d#WMkQ-pR^22Vh#VL(*H1y@%X)BGeaMyk2WfS@oL{%ia_Vv&}wW zhPpg`V6DNiL<;IjYmf3X*q}a-^yV%$aY*1S;@ZVbLNZx;)D~+w1|t#BRA6(6^fcaG z8h)MLjn#z=uczkTHb$}e-a|YChzSq_?xy&QnFi8#ZE|Jy0*SJ_e-Ih@c+*tfEP-`h zE89Fvha#GYxL6iu#>>=39Ysw+^N{@X6{n^I8TzFL@F3JNrl7J?T&xaD!Z^ajYliGT zgC|)vz~S{ssv-tmNt-tOZ_Zv?_~HLl_5%Jmd+{v(cJ>mJ{{P|Z{V&R1!2h+gcWUFp z*MsE$nX^~;3YJgU6{PH4clt-!3s_kCe*TxUH=)}v-OPGZ=>P2O9kU!e%2D{-Dy61b zRa%9mI$u@3Vxd0&sZy>`LyJt4A>M9YqBW+ltg;|`PdUD`9KT<^c(zh00F-4o19HCIEI=fpKfk4714@5jhzW2i{4Qog|K;kQnH^`Trkv&pD|A)!zxf{UPtKzlhyL$ zhG}TdN2@#+C~0vJox(JNo&LX|@PyUbb?@)PT~DacadME0gk5kCd)M zQpihXI|fTs^wsF;=~PovM`aN1D24`-%!Xu)=+&ywE72o0DnH8Yks|Xas)5T$Jtd|4 zTeJ}KB}qqj7V9ji795Nq@X=!t>K;iYSrsePBx%~tjc_z|#$}RH6b(knvKFnx<{p|= zt(d`N4GBKSR00NKv?L{KQ;Rgk*+3PGa=RVt5vsrlrJVzK%D@=*9U2+(GJCT94`LGq zfth0WGezDN*!&8ryc1-Ov3mM2#y%x{Ei=6X$uwOS;Zn| zibOKW1#L74HRO@YY>`%mpyR7T5ctI6KNm=es+17Q$N^xk^@3AnNb68&)1Ys2?uBDb z%sdAC9zaB}YdSlRsL1{N$t&w#GvW#gy_kl>F#ET>_@SQ!!~n-NT$hu6JupD12e>z79Cho zN*S@iw*ac7)Q%vX^1k@|BIC#7{|W@t^@4!lh>ZUM2)5Jw8we))^altA@xat+WE^I* zXj+;WS&29NARd_8`Wk9#+u_S)R?aAipfN{Bh?Ol!^-Ed>QvEjFfKIIePSs803$3P@{7NQED=Yl-HkGp81-IBeYYvs81HFv}Nj_QTu5Bz` zrdOHWoqXPQ-p0;ZGU`5dA$CTfq{wDKsw!!S;#@}hG21&wNfZOO= zAA}LVzUYJW3786;S|`}9Zz}P`S(pZ**6cV1 zyxC)^s!G2C#G33N7!=&&c_ukNq_A(_eQ~(y$aUvKuQ$3F<|Ue7$AW6vgOc*AV{(S5 znuVW81O;%Y>a2edXiqW>b!PBg0-9F`baCqeJt75;n1zk7Ph6eyBa|togLurt47aUIM8WMD^R(H8!RWIUJM+<}x@*%Z3dVf;}2Xh^_Qu6?9SBMi3{a_7(3SQR+$= z8(RHMj>F69NMd@boOUi^cN{MxFmuFB9lP#-PjBQf3e+)Zf4|s)RWW$^EqFQM?GpKg zSJ2u;eh%9(wL)C&MPu1@;|*4(LGpgf%QIJl!h%{1O_936Em$Hj3UJ3XEu~6cQ?_Tz zTNI{Q>PoHV31Wy95Gt*8_Y@JoxjOPNpA2K=4WBVWy@lI%iUFqmcGoJaHMsCy;dD2m zNzxiPSF|KwLNXh$SJL};v1ZyHpW?xoMd#HDPb7c_opQkp1-gP++6*=~-Z z<`k*39@*xhW6aCh0oo2;w+)WJaL5y1w(q^v5{N{|h_Bw)mxXNK*QC?k-o-3ZUxWs> z8cjS+A2TK-aDAHo=ICeI`lU|%jz61jh~f2$-h&3&$o8-^e3PLu;Nt$YK1$oZd&42& zS>{H&2@Q|-}oAJ0Sw(?#_8S*WJ7!wC@BJSU(U0w>j$Z@bm>f5udD5mW(Wb$%mRj3L-R&B zkn^X|ee=C6M?Xtdg1tA`CpLnbvX3i>uH6;%iK{t2$ZM>Rqh=40=>_tL_` zm~q_}z(9N6gKYKpJFxd99-il5Eq^=>_(PbP+l9sV;#Yyop<5k^((O;nSXd@WKjV`u z)b-d8#L|M4+PV6>sgoV??@B6%QXPeG9e-ff9DzboVO|mhY-bWWa1wLcs2&i@dS%qI zrQY-Ph)@Ikf&@S2So;7Q#Ii>BL=LpMsEYwIA*I^Q7+vFuwZ=S0y*}LwjXE=+1=s}d z;sr;Y_o|#Ai9j;+sepNdwo*x!aBn%75!zN?f>G6%wyzB%>>c{C(TI%2el7Z9!A$rcm|R86bH>3lafS z$Vd6aX-+tu=qE|C9?l}1?~wy8Dui#cAwql(H1M-xtbDXkkssF*!3bcKzxP?I+#X1eb+f&#Kb8t!WqLhj=ibA$ygzW7!0pdexzPHNcl$QW$0r70$Pn2KRJMa zR{cRp84%Fg?tKaZTK)Vos$yUR9+NBxf-ONjs|5Ch)}Y1JtAqrk5`#n-NMfsct7hw+8QWS}CnUL?At8hk0LWYR?U{b9tr=sU zn##8nOgnt31}|W4m>Bik!^3TMaiYGmHcUHkj;bxZOclx3+{&^D-&yE~3by(oA!hB0 zaZa`>v-iy2gVhI{sQ;Hswws$=>t?iY?`du^Ftl0^o5-h%gl9}3cQ${O4mnmv{fqv( zYaeIxZn`-}h(TIm~Y)fPX;X zorn0cv|;x-^r8*Hm8o`N{ujadB>NorJi0&&2MT^8?G+z@kaYIp+{#2ck|)A}f8``( z)^Z`YY+CbTR)14reyEp?M#elMYYYt zV4VH4fj!-LqOl=ypFd8Z;Jk8Fl`mu7G+G$|6qjtzY+2HDt#-SoN*}=8T$Gc!tZH@; z1TB_4Ehop{HEo~fQG6B?danQlwkRS;0>!pYh6fj$r{$SI{eUNIKZwRC<1};f(N;pU z(tyqmyuLq+fY1QNc(Z6waSjs0Q`=mmw9`Ia@p0~ZITsP zJnw@ysK)!p2fRMT+0lP@=*4P(EhcR_NoE_EP2Jbx3(ck>&8AUUE?`0Azxc~kfpo;z@O*B&MToGutRyT z^4jPci z58Y^Lv@qpCZ?T8TOcljSDTgTzB#jx-U^8_aq?f9errby6Asmyw(!CUXQ0#4)0>F8-l=t9U<## z&X-QiqZJ(O*6w!kzt}sgpg0?B(ckz?oM!bcY+6k(@2ou78(r@+}+(ZxCHm$ z?wZ^AXXf0QIdf0Vd6@h3zffJ&_s}n0)vMRuYwsM3PY5Zu5cJjevOgm?pMH1O%Shlt zxNn0Lc`(7x25m;8;)qwH$ z#u%;XFB77ZJUC6XS)CS!iCLyTT~HbOAI;ZpXtC$inQP*xUMp>ViLC>;T~hFkvv$WU zIbIBezg9Z-+$xF4h};)D>a!gAo*NE4Jib)BbU31IRqu}vu)QIf3EUq+=*r)x{aj+h zZx?e9FKQ*}0(q*u;!(Bw#@+)cLbkm6>jidzG9vs}c(G(!i$kr{;RIADiM(+n$q%=P zUAR2U`DTPWEiL?cM}3WjGT-Mrlyutuu=a2Q@I~|v(p|F3o=TO)K|G)5EMzzg<55O? zcbvXg#2n~G)O;1Kek%*-=|r9@En(M26*-NSFq=bb5nAIz5E$;~7b<|B5JKUa1}nIw zs-;=|$E?LT(Dd_0+rv=KabxuQZc878uCb@?ejE>CCh)hOqg1QJp+Ggv%w!r&7F%ZO ztk{NRYODZmGF9dds52F&i_euLk0>%NR*d<(jkXPheU>B7IsqYum$D;Fo4xPY`7`7D z`g}Ose^NugQi!yjK*1eD>imKOD+SM1mXs@;5%c@;TzbNAfdulw*Ka zd&R>3%8c2*+PyYXV`9w1u3uUmhf|%dpg}KOgS7jN)!A|$8c;!rUFr-xjO?AlS~pU; zw@}vkA@D#roL|sdx`ojlqAaimj6uV}A%UMY)PE0vu+x6I)AfYcFDvncv8>$FFi-hS0p;EeBked?A zDAgb^sg4>LfLGrlfkQd+k*Dkt%KgBD)dw1iYU}LV9hQm1v^i@+-}%x?S*K>cHiQb1 zF)FKzn`IZyq^5Y6XRz!R_)|YzMjas7S^~lUj08;=Uy4f3V(0~-c|dP*>5co?wpYqc zbL~I((H33DB<3mzmd06GCtJa%7YaHLq z?MiXd)uN3C=4%0GURTjsf|ef*qt+++B?)j`FM~9=bu0t*z`t1n63v=wY>ikX+xN>ZPt! zzrIB#9kW70KpuOt34K&Rpbo3o6Mpme4Tt!P#agno;iMPG5`JF+)p z?bu{RBKTIWwJHC$7xm)qgs@svjAv77slPYtFOn}U|I0m9a8ZFdghp%tBMU5sI20D! zq!pDU296_jbzgot0i00y4n$B-bd)`VLK7^_tx>7t7ggDC7`NS zLib30|I@IZolbR&36EC}55WCPF~tw`b>Jc&Ij}ldwAQ>aw(CAxuEQYZU|! zrTY^%p2gMMygucua6Ex@O7G*HmML`)##cAfQgW0XGp=eL?9!3o1|4mjl771-2&M*d zq*3a!rKWco`0qv?Rdt){1g*l8J^^!}D`>;XDJ|W}G4(M9u`^048VSBd%IXtXV0afy z*&_4NL5C)rL&wSXPPX5R1{V~Eg*;fqo7 zEq!~ElU7lDm^eLdvmY{jI(RM6lEnP8MQ5MYU{)|PbNrRMX#($KjORCif6{XVMdL$rfIb&K z{K&Z6oQW`TTSKZCzqdt$`U0bhJ=Y?9rkY@JD2k;0;np_E>x2=?J4JGC)a-|$QNHTS zD;08CPo^bWy?E6e&g!^uk7YuntBuTj81_)4T&MC`N#m}Vz;ApTq0iB$SiBk03p~K= z1SQ6>AFQ^;F>({RQ>nV$FjI#cqG@lcNTF%cNkT{KXHOv_z(I-;#d$*EadnwP%fbX) zXJiR}?-X2`A!F%`XzD-*u#8d+NM|TcN0(LzW_bf`g!C&SSUdW+nL|Id5~S6)hR)#30-kwfd0{bHcoQ)r?}dr#h0hSRVw-x-eZNBoW23 z9w3QI*o$B`-cw-cM&h$5h47d5Gqn`pOf=_H46)bda%R!6`CH(R9iaFo8B+%2ULZ26 z6er~zWe;X1A~Wfft^^d;I08|;bA+gDPcb97doMbH`!6Apm7&8DIm~tno3NXkH4xIH`O2@^(I-@XcV43Y{gLG zTLmHa#Y*?jL4FMW0~2$c=*vMh!7;M8;k-bcK`$hpENMqV4;O!YINh27xc1 zMTTBJ_fBkp?{ZO^@Q07aR}QRwzDpP5gJT9C0}snMnco1 zgYABbaA9TH5hzD%6yn9GQ#2PR%>gx(tm*gIa4}MlQsn!S^64wo-pCcFWX_7q)BmL6 z!j3=f6>Sl?**D6_1z6;AC#wpy+aOgIrK)g7%W+1Fb4Clyz9UNO!D~TREJ`KgOeJtb zm!32%5>4b2y`%cIl74elyD#kV^I;`(gClcsM(H4RU^i8E%hvjAC8S|yd;yp$I%{ja zuaNswVP~f<(dD$K$F^`?VPmxp+i@wC`vfPQ#!-=}xFB3nT{L(2${Oi2$8J>WyAlOt znSuzCnZAhP{NAK16Cy-b)G?6Wh&a#lFr z-$~X@FB&m1T_ysRDo8WT{1s>c5Rt1;4&6yKzuU1D@)A}K8cH-jpH=ms=M#vw$dpbV zr}kE2U@44_Qy=NG&D&7eSyP~1T?ujE_+rHoZ9F4dmO41#1W%9kvI*q)oRpenjQ#Lh<#AkjUQ#5C$uq7n!8hr6(T+leGOGNWJJLKBR9!eA_5XV3%S)*D1R0_+u+7YBzpG)MUgX9 z-~vA_99f+JIk6bYfh2_ARh)|G^Iz-CXYnp18M;<9%X3}Ho7hdNmvXu zK08!QMe>cTE8L|;AdWn_5<1;3>~+|!aI{H)TaWc!B1+Ykf~8}izeDN5z2!(D{w%6S z(BzM6OHYxb$Xu3{UwX}48&g5`5JU~X+5r_(90}c$A*Zn^1cfZ#?Hlx6Y})#rX&=OX z4l+p{h}S*FOl_IFs>ja_13c8 zq>9%#svU_7Pto{f`$dx8!oa#3LgoXFya|eR?I#&W8XxC2pcOl;lr6i&SBesUfBoL8 z-4cT4q_LjwOzq~+rgl>%U6naToeUlH{N+OM7BWu;ABSRM#V@53z6N|-ODuzGrjfgi zV@#q>xAA|Mp!p+uDpesZEOiHA8KJj^TCJRE`t9^Owru8)iT&|)@JeTOrGw|4L#MT* z(Tjh<_ak@vHlTa$&327GNS^5ACinDE#tTiRZ;BZ-hBCI1KLZ;Mtb>DyAkRk($da+` zUQw2P$Ci&sKC7+gNhkt0s!_mg?vEd{tzZ>GEt;4Lu{fnsg5pl(guJDRZDX4EzU@#r zJ_QG{ve6=P?>1^zvdO!h(44nPo(>^y6fvnmN8boG515Z#MA2FVrI;}pqs?5x5Yhr7 zJfCv-$r&{vB4Rwr7NN3;{2=s)Z36--jePy)zq8&~eo0r0kje49$H>UKY-F$H=SSx7 z%T6*gS)r~vyjy~yU2%5SCDyJ`zACN5(AvvXwOQY5%&zix<18UYi!)*G8vuhBCauT>*k+S0Vb76rZ0Ko4NKapwb~T z{1qM0RKm@dwJ&=F)u$z`#A(#v!JWhJ{bi(8&+|Kqx<5*$nnfUVf<*~8(|5U;*ov7@ zq)cYSr6A;(7V3_NHay=KJNf{Sz!L>^t!;R~fnkP8P9deU=`<_TWu-tsj31t@Fk?hC zUNMm}8|+Fyr5}MUlbR*l4@w4B{&ej*7GB=e8qo#zu32J5#brweRl&aP$R3CD2%I#D z90won&(9b~`d_2JN$Mz$&NxdVmcH9o$U97aN0ox3Hc>N@j_0|(=j@}#*Gus^y z7B!7kUOZ4L+w~O*dTGvky5kEOw^X6Y^b9{0b;*}m`-z9%=2;=@WWf!m(K~$}f0X#p zh7)5&*xnOeCiVRz+)BkY_!qnOl%eOstLWW_7?wslo+V|U<`$|M@ z)06JVo!VwkYbT5An3eP1?Te%fa}(fOnlpDrz9$LiH^#qioeJ9y+pP8`EXk)e*Tfea zSb&r&>t}HA&JN%1YReBn)9XR6uk_35Psae<3nd?1X3_e6mWyGZAK-P)*qYij&?W(z z91yz2ZQT!Uu=G$kQul{(sSDBRsMwqbhEBiy{N z-9gmSNNK#MU2t^QP*%rqXDeU&)&HX zjU7-711Jt`$%l){TJwF5Q?{x-^aic-U5_(5s(nTV(Eb;zn85$dF6Mt*#e}?d3VPJv zc#)O`5=E`Utu}VuL}T~~F&ZQH^K_j##Q9K-t-+Nmht3p=?mJXHa2EMO2^t}PZtUG~ znDpRSF+_C%E_5&Dt9<11HH6h&=$@^gbYmhhL>2?}j=QUTU~4l#0O0oy?M}L|8LU8I zYWMV@syHJ*>mxoi^tOGObR^8sN8ZHiZOB(~pb*rD9iH#4x|w{ByrPF(J>OlDuVVMs zcL^d@t0#|Z(gr}HhZ3mO^%Yme8n!L<6X&SO7}9dxG2h)PBf=zYsP!)rA2nGGQ8~4d2IoYb zxvKO5vsy5fxDs}Xta^NITCkvcQ46jr9b%k$1R$5F(Tqt2o=qw4cp8GKVo*7Kb_tPZ z31NaAFeoQ2yU?zwnAFTJUz66`mE_s(mUq57{%t5mHvsfa`MVXxRGwer55Fr|I1lbdHI)4gYM>vk^}LEUoVBgJ7R3d@n#VaLt(6+ zf>j<=UXw=H#w{NXCBdC?2|A#BIks2U!a~tze9&Yz1%Q5Fq^n@k?g*WVEXUrYoWh zkS>bHLtM<)Sr~_LO;`;|ct8ciFZ%pyyWOU{(AQ;#uLx>QgcE13a-6BhnGnklJ;Y(N zAcz${%CTQ(i%6&}=_ujk`q(F79X#M3DIWDR(~~ z*!0*sP`gFt6zChLT2^u;&&_r%=>ut`u%tDep(2a-Ufs|qqDFv1tZpgr9TTID zd2}nqU6&}VtOLguirn!KI3PZt5-t-Z7Jxty3_}7w9m#Eg;_6)INkaB|EpRfMS7zp` zhABvRpW$|`NYqep*4!E5IQiV7uQ2!ust-dYq~3+J3vk$d-gY?$#K#fIXn6uBI8CM7jz1w>J3zJwFw)llkT5np2s6LOa|0H-y9sKE-B;aQQTpO_uOY(Zem~6vz)7BZ9XIN%HZ~MK^gO+E%UKw=}KE zh`!3h?R47;oO}5P6LtjI0Wiy#N5!j3$?iLiQGYc8G4z#WN7tX0gZb-n?GKugElHZ^ z)siVXTLc3hz*~hSSs0pEI{aA_3hr)i9ocNFOSiOkkL4Ld*g7h|#BFF=FM7gV?mF5m z%!QRsUzWZ(2X7T_{}P=c@t^jPo>^%bU+-L0W-DxbykxqCF~jVnACydZ&)4_v$?XG2 zfNfL+uzEp%I3Cw%B#w&|)>fc*gsr?USLK|;{G_@ovCAun1HzFr0wuNQVl-yALis1_ z`$am)vQc$ab&s3o3XJa+!(=B-juN{r+K;f9I#t0WNV&?y{_xff(9<`$;w?dauBhMu zZLT%rB5&QM^*AbuS(KB933#nAY7u6mCL7ux2q&tGw%Xr^khS51!p8(l?Vyp9W2>KE zz)-1Fi`(%)=kHy4*yz9lvSUgK&5M@RQK`qYgddB>&<`@?HCjcda^MJsv~}z&?w#LQZhu1Ri=OlHy(cv*P zuw6bm7!-1HO)#esy6Df~_#ne~PU|7DUk%2*uA#R<=6F9 z5&7X%b2Vi>e?;@;)ren)?_dUo3T)bJJU~3CFfO)EL{Z1D1-Yw!YjyCnjBqYn0#4sg ze%(%Cf3$_~R8(6R+4W&kI8&S3bY}Gek}Fw#1a2?(RgP_w?{A8y_wq9OwiJlx+n zAD%E?X^{-%RqJ}&j<6=CWmb9mb9>d)ao~cEWR-{+o}&Wu(j-rOc)RWWCp?9AX*$v4 z_wp{G#2?-wu|-2cIc5uG3EO2%@nNRYpiC$S7)@;x&m zM(Qar1hEpJ$0Qy3a!n1zR`}@pfvv{cP!S=vg<{1_caB$V_|unrfCvI)oe^jxjST zMpz&vTP_pz`DZ5Z0D9ZUG>KW5%>ETsjSpnss19@^8285C;x4;N7IY7I{4`1WAeSsPRCmOhO_fL=>yC z{yr~1|6g7LAH%Yk9y|^Dp9rm$IE-`*<-rNshfm3ndahVaumk#kNzhu8sV~YHwMS5i z^HP4I62Gse{B%KZ8jcZzu=x*vkhjpZAD#2jwe?Ql`4~TDDgRnOaB8O#Y9d%nNs-QX zgqhl8^V0lzvcu{Gye`bvobm$ZnK#n!Q#}SK1t3EeuWC#t8VrV7nG9afq*UMDb;Z|~ zu*BVPk2o;2wo^GJA!{E(^0~@?-d)B-U+p+craCy|m{RW5R{RjZf}SD1!08UnU+E`y z?072zEw-+*@zwV=!Clcm^aK*w`P*`|*Fu(phH~?ec+7og!G%Kx+Vsm=<6Elv^uC7)?SictaI3Z#UZ<;G|TX2eDF>Jwjp(jTaxJ?UjUg2L_wXgsN9WI z6{uWrP{1~jULEQJBqGR*8I1#ES&vGHIsyOMPlq<3vmesAMh1$kMp>~1; z+}|@(D_}1e6c}_4@94be)y%gj(E}R_zY<_HkEUWuiN!lhfLi@Zk(QbU1F;Xtj0cnaGIZ(`1Z7ty7$2&Xu{1(Ss>q<2xLw9xiGW+1OAedfUz}{YGGy$M|2uT zeBzAKKr=FOVWvMvpvR0-ldbhqow|Km6IXp+8YQ}4uSp7-zv7KVd zmWxKgkrcokg`o8&<{>fvnYvk+FhMzHHL>t!=RpvWQaPquU1qg-=a@6Wok*8Iai6ce zErVNJ34mP~AH)&w!x8WH0l(q9M%s5ye?{nOE23O0s4oRE66$hai>9z1VkQ zQuVA9klz-3Mpl;(O6~G5&TpSRH;f2p4nYC&+sShk=0}gQ2lh{k8>jZ@+ftWlaA+2& zYAiJaqVtlFxZk0o=7$2+qy>jLlp=~~c1aS&UF86!d7qTj2B-kkaX1_@5dbQ$3R!?$ zUg#S&DP+KIFeirCJ3?~8Lzy(-RXl~yjt=SD>lia58OR)}(Ve0^XNzWHsk~_R2I=Gi z)!vCAEDp1%C51?O-GajxtWH-8TdsW>vEDbiJTysOH0t`uo@8*6;dX(al47%s^mA~-Qj zck*Gvp+s0U#z0=7>?Hh2vZW`^AjoONtW{<9t_Y4V&9IO4P9*CiOg*?(lfTGPTQkcte%N@-+2`p7HDD>$GK$oLy>$>WejA?_>M)|oO;}Skv5EjlRu2&6vNMwh2|19Z-b#)-F5800@9pLCbxkK4t4h~QA{;~M;E z+<4lGng|IQ3kqsSrGdSo)r_e1^bU*pst$~@6#^>h6s#lT{oor!@G@rM$C8>E- z%R>xkD*i=?49?b&vcb_nQktM(IkyoYEjqIebx&=%_}_;M9Hn141le&zSm$x`#9%g0y7?PAGwV^j$DKue_x22dy&ngCE4 zjcKB=m}XeYk1u#~O8e1hPp!eYiRQr41O<&!V4m^_llO;O z?R+zLzg?8M8PlXG#^RIb{aEBjcOFo(Fq#ao5h1Su+rlbriMk%!aZIIlshr14GnLpT zKkM>2j|Q@g;1KIpTI~ttk4LyLem@f5Kv|z7D&R9qTU?Cr-gou1U+5EEUl0$1oKS9b z9eg@)qnaVN-Z?(SBV1EP1X0tzvzdJV>lY7vb5|#>V-eTa+2h3;@zS5*HjD)@ERFds z@GafggiDg1AVkPI-Q~xu@&oWG5y%G?!Z`TCldio7RI7WWk}oiBwe!*ets3tEqz{mz z;?Dado;}8>%1vONbN^PA^5{@}Tr-#jPx2hX|KO{vx}S{s`I zqAtS9Kf#Dr@{bO1q_KFYOBwn#(KB@}LE=AMpktxAjckD2_pE0wde$<6n_YX%38RYe3$ozad+1KbY9GQ~rV2s`x!5AZq_cZ0GzZ z#Go@XG&04%2eUf&zX!80g?|RK#lHiyA$G5S=CY9xkd`?b0H|O4ub`{fF`)V{(6#U0 zbrX|&OvX%m%6q>0)OA<+;Cm!G{zkTLeP=!b3|&?7@E;FM@J9Y%E-^7Ra{7N{E>$KH zL=tBBtFFH?m%THXxe#RNL^GVh%mu6lL)S&te?b?UFlIk(4mZ~IAJEm8^glyax9K0y z_0P=pWIl}Q^ey@~bComvmAO>g{>EJI|HfRR{-^2oZkStO=+dDELs$IHU!lt_0Sm)y zEdaml--IrNoI9!i6>||fF^0`tf|*Oqi4jHp2FzTxPGwLtcYn`ZG5?pjRP8a&7vaIo zRblxrnJdxeADN5w;IGVOarrNpOD!UcDa7ml!Ca(9|2yV-fAr7Hb#~pj7EfvrWv`%+ ztHu+wf1c7tfA!HdrBUQjeX?X<5I9|}k9&>jCraA|8%X3tzhB&FF2PY{{%AX<^W?KJ zq&tT{_adF>QlDd&A!3uNX( z2l+>yr>wwiCpu?kVc>8JjY#ip04(p+$w1qYa=}EQfd$2f7vq_G?r{i*Eg&mPhwy0X zsMTY$ub}bjr;|+o82@wi)dr*ahmF>#tD7hDZQoUrKJ%%}Xmftv0_Z6zya4$rWh~7p zw^@=4^nkJOEvS{OrZbaPfgh*-!VRszp5A|v!omE7ss5SMec38;vX$c^PxrYC}iqiCi>Q1Hfs34}K)VZjh&HHtg5!dGFJHJF8xdrJ{EKxJhW1Lrw^Uu`etXXwFt2 z<*#mPDVdSuPt8-`%nYBG;2&=4bPH-9X!gBrz+VTdBem|tC+YWueX(%k zr~3T)&c^$@9Mrk)UQg;COxfF}gBZO)t!o{dCn1`^0vqEwJJqMkHZPXAyd8JK)NYxG z9zKIQr2QCHdQWz|as*nS))c>rnP#2~@X;XRBHZe@leoHTCpoiprCDwvE=pwFkLf{< zU=^a=+puz~xv+mS|GX0CRN>9l=o6={^_oqsXHzJuee~hs_q9g3Hz^qw5o;3mPB*Nk zHeZY2{9`r$VVsENawp2~jewIka;_ zf9*A)?Vzy#QgSj)TGd6e2aBw*@wG}c^)?h1jyG1vL|l*>YV-=ipMQ5Qd}L(pQcDp2 zo3x56UNq)+`zRtvr30NCVR)I=qyU zm*E6-N!gqhfIFWER18341J2&Fq(FX=2qv8J;!VM=9t|d}x))7hYF39K9%2qL)|4FG zUJ~c6t^+O)i;gsAMp64M4@cZAE5UudZ%AZ1YJ7v5(&-T3w7i;Z(sfz`1O3s%l9QFR z%!U-r8XDRz?e2Z#&s;%yJi(OjI2a^0Vq!Kt^wFx>mq_A`EEpMUSwKg+dGrhkTy4V- zxlr)$XoNKl79Nr&3MW>azw>&&OZey_e-cK#b+*i578vB%6ImA-CbIa)nGa5Rh6@=u zRmDMwB2q|QBP8-qFw|z*-=)LJ=~iUTKFjN~p?G5qL&Ag*6E13{I3p_@w?{O#-LHMZ z?D%FD;Q*v~Db|n?RY7!TXR4bNi3q#g9+gz^{|RrC@vLq$1eyee|^%}zfAOa=e4U{p&Bu5TKDI3UR zXn8dao!BJt;~Q9q$gdT0XYgEA;82(b;mE<`ggzI6aEj{a$XDHna(d{aBNDiwYH#B4 z;Fxi``58;}lED*>9|`A~JGUH54TMlj3oPq3DiUtzRGaA?b=xoj@o}>B?|44-ixyz0 zX{?B2Sn@IwUI8n*TuCzTwd9v1xD3_jX!A3tCXw@3V-Gys0ET1k)sv=8MP7IUnJ;qA zSxmW zJLfdDge&UBR&SiwCw!IyQhia}uRn2f5;Jipep|)QwFM3*N6poFW)0j!O#O_WYA}(J zvGd9Zai763lidlBLp{B-jJgt??>MEJlmgEkm}~E`QhgB6iZd$crTnZgv>}VEzUis< zYy;l)3Af{hV>2YaMXraN5-)YjJevD?;s=jSc!rnrQFQ#Bfo=yR4girSz*(ppP9?8w z4I+XmoJS*oS97(+^an&lT?n!0r>`sNg;C+$0e=j~@&r(#O5APTx#7{<+t47A_s8dw zTUapk!G4A&RKIA$z5C{ZOed}aZn3oWirM&K=mCM^NBKVz;6W-Ls06_Lq{6*~voy&L zncF5V2ZJmYM|qq^tMGKSUfi%>(^UQ}v~Mh@TfHcB?KuynzwI9y%3{2!=*fv7DNzZB zBWe`Q#l}E^3gRTcfMK)?7=(*MfH>e2@k#@F)fI{u`Qy6yk*OIaOGHKUrsolB8+r-f zyiR&I7~q=vMh+UHAbMc3aaumTO)ppiub-`+;&a`4f~^%|?6j5@ouDM(w732n4aZfHyyWeFD96LE}(6fWuDQ^x3J0V1H#s(K=MRK9vh6 zVo6ka*@OONh68WTc->=s7OTCs^U|TwKu%;qT^z>TXC*GWANjHWh421nQnN^=ht99h z(c3ECmja@Ms}rDCW;98}*O5G#peR>26A+0j8WEQ}x!ZL203Fe8Y`$lT$U6*|S2`&8 zM{@x2L2Qt7(K;w5@@hoj^syGl&A&&uAGy=!?5?d9l*WQa3w*)`#yw$&Wp#rK+EQI^ z7$7R+==KxGXBxR!Bcl&G<5GDVgo3(pOtm(VC^vgg;}6ze%^FaS!vpmIgS&5Z%=sD!B9EdkoSY#{Ze(dH93nRCZ2P29*{v#pG#>&^WnPNp&h0NjczX?kjknCS%p(usQ$I9S#rgdATqQt@IGaQO;82|4xD_l&lbqp96$9q`mbc>_Deev~h3ar<>d*fcz`IK)$7w1XSPxu+VgABl$fqZu>ht~0cZl!z$`lRnSL zcBc-tr^>c8BQIOgf43s)EC|%$h*sqYe5XE`Q%pUfQEOFlz`iS(>KdfL#8D7}HPaVT z{I*-cq;q!K$nKt5N)jXv4kR!Sq$HAar2IWI|5O`I069gl-08<9%YpA;{sotH$d){9pBEhOnu zj3}HuA0-auhU)vnP@Iq}V=R`p3|nPxz$ADiKtqkUW+j?(TAEOwN`9tj)7s)QA)B=H zCtw8Twu$60KHq%5Moa%2PrN${9R*9RIyHK`W}I^B2)X0WKGQV*aK>BK7;pVaCAJDx zsQjU5&G-qo{29XqCdp2_d~7HLH8|cBsF0j?JJ8W^B~=lo*`RoAv2bGI7qH^dsN*j2 zBDwE;veObLeq#!So)Z$l8sar6%UAT1NC8MiSXYZoWDASy8$?7Yh8mn5&L6jfvNH?? zNEXc?RT)9vM?di+>V`P@G;vBxXwsiLvI6z8q*Zw_nxxE9L|g=uQ++Uc?mv$&W8Czs z-t~P~F6?_qPWxXz>IRWk)WN@-By4O-#@F86ngQk&4gOqvL1VG{5h{eP*(BDnW2Onv z)V4l01uNpA4FT4p;H4YiW}P^H>I4pa>SR9W7nN&bV@0oyRl_UCg5jnW#V!2Uhc_(` z$3|)ig)547l~2p8g;Bl9Gezll&#JG=F;klHj}@H;LW0+2(>*ej#q-u6Ib858wws<0 z+EC1G^Ksl8vXGre4FWT#i&ubdF)n2Fy@Pxja4n zJo&s%+Bp8|tf|b-&(wV8#>?lY%l;GLZI3Ss=?h0cJddo71}z(zL7YoRGOKg3mn1Ra zxrWTCgel$fg~%AcY)~O^#NJ^;07YV_gPODAlFZ&=ixySZowNI+Bo`|<3_LTF45p4D z$pz4GK-T0IYY-lCuHp5S(oFWqE_lxQQL+KBjGTt?CQb-PKRe%ea|}2;gH$lcLD+N- z)eUV(vhuVl5+7Az(|B{ydt|!mR9a=cvg?1fc~x~Ig`1wMuAW!?Sp~M`M#>q<0&Hd z^yZI>)h4IvVj{b5M||FOBAF1oe`=T&Y8HE8c|7ASW@-2yg|`yfx%_x#(NpJH&M4@# zuBWZTq%`Wm+OX@bvBY*a1~TJ9!-vxJ0QqpCkwEf*Qn=7a;cPs-n4%IvZQy^=G(}21 zvQF#ejhIzQX_>fjSC$w%JF{B`R#*lU^Q5IUj4pli3?BqxYoqa7UGr2Nz`Y2a#eXQQ zP@A*qqp3eFVk!FrM7(`)B5DiDA?M)4E05va4mzGtVzlS{ z_yd(}x}52=IBTql8*+pW&sZB|)PHsh5y=v*#$g_vlRD(bo?#4z1AUeQM%pqmLVUcE zM_c2nT88@NqmQ@Me7{6)f8Cy=-Fp1Q*5ug)GkBBTmJd@^lIyWwHj-K;n=EWDml|I< zOs8h9alqPxL!iGTuU8_k=RHaaVESy!C|Ard;)bgq5dmP5%8a-qJfO|WaJ}TSrFqIv zK8{za(MB5fx1|!u2S%jKNF=C>PtS-ZsEd4*zx%<~Z+=!6Gx2Ws2cMt$T~hR$Y0hbN z4y{3%v%iv^T%NJT?(%6VqcfC6|AcY zS@ZIleyHQB&0u4xVPQ>Uj1|Lgxj~yo1X7lZg5G5-k+J5Z5CErPW{V+1-5~ssM4^t? zVQw0`o}%MkISD#ZTbu%qh$$Yubvp1OoC4OD$?v37+EMkgPzsd;CznmGY*ij$JlpWF zoWi=7v(K!WT8XwQg6rjTj$Q9tkZLM|i{IxQ=<&AT1u=(Z9%cVD^K8aYV-AfU&Dl0< zYJ#P#_!L5%y#d6#Z^XKE2=ijdS!L&K#Oq-Sb&$_l68CICN+=IAJ<3_YYpTaHD-YI` z&zXI9UkAxv{z>kA_LLfL9RXB%fDl9WIFcs^qHS__3htyOz(5yKHMuvzUB%+` zcX!n8q#2$PV+cm1X)jz+6(VU_7)+^27twwt(rIb%{Rq&sot>@{rh_5uxWuG|$fg1( zrZjNF&ZJSTs2stFA#^s)q|SA}42k)D;Ee8jQZC zs3zCB1_$*Vj0BgM@|?4}P~R*PL%p~h)A^L-P!S@HU1(@QkJt=(Hrx+uePaP2c+Vb* z2D0rlZ9LHWi-%*|s=jp0#TgCXO5pzG2koy@@50R5M#KV&!y};`W2c!4?}KR&w{#Pu z?p;n>-+yh#0%=&}2h5FBRlD<>kMay~q71AeKYC8%nu@6{AAnbowdie#4her_C=9#y2X5{E=vLZ_sBd zNcmx_;DZWm8_-zh6Ag1!)ajHXENsJh z=3+T@J0MaPeEGq?-}Qr1U4?>3Yk_^*x3siy%IoV6%CO0@h zngKGYwt0X3q%#B73fi+$pVt}8k&=WOxN;=0Ynt7@ z4grZtOn8RebZ|{VtiENjD=#LF5!3dr0hTcu`eIU{Nq=Qu`3bR=(mj|0hY#-$@i73 z&gULVo%4Gr=EcV91{o1Xbo##FIi7K2yGR5K{1)NObdxOQ%g`V0n=aKR`?22D`_)p< z%l4S)12)ag6f?Ew?z9pi@#bKWz`Iy$9i|#v1xo zUIAe8g~qqDO1OZQE_T|5FV-ewJZjwF0dZa3l2Lv0>8QV8dqi z%Qc08?=KvU-fKaSi8>ZT*8c+BErsiRrv(uRqdDku4X{TzP911u?c-OvO#D?@1wz^#uaaO=ZC@^|aw+6dhGDEr;|um!h1o(cbG zeLVhdeNY$tPJQs!@6&<2DA0)6j86h0U+&=%;raK@TRS-T_vYPSg(v(Y_}b?{PSvy+ zk@uQ>GzA8u6k1D#>FJPB7NAa3a7;>L9J>JWJYUsfNHE6uBcq2OdzkK|G@^;&*NC*1 z(h2tvn~#dGHiPcO^s%keEaCe>Z%(T*F6;N$$G@W`sKO(5248JMaz3dBT7fGbSRq*f zY`n?#D_h`-hXT0bAt4y&)QNiO5cEZt6*O8=UL#@cV17qwo-%>o^n1@cUb?V{;3f>tGoBhg^qF zW-CR&;@@%|o|)iW2ju-4xYkknyVi01Ki4{zTK>M)Awh$u|4+FN`@hR|Sfu{9T*t2X z-{(4Lx&ABH@!xA5<+^{=I%vL{@^tC^QR{HL=HKuhRJ}z9VSA9=pZaZpYaJc#H+v~xQG9wdI0_#?%_YF9)SObd-zYP z2jIWq9{!W+0r+pYhySE{5cxOU!=LKmPxbJpdiYa4{HY%PR1bfuhd9 z_)|UnsUH4R4}YqMKh?vZ>fulI@TYqC|EV5;|ATsX{vK(~ZLAo}6hK%U&bCUVN zahLsHM^#$sRKxOai)*%@pI~LrKl=u^9=Y%qhsCABK(fX|;AvsuX*ftOLOT6c7lB}P zA@VzJfIhtvuJ5OhEv*%W`eS(tlue0-Y6k7BtF5&8IPyn%JWKs1*WTcoY+M*XmS!;{ zpZVf?k+5rmRGUef>uQ;D(zuljOoA@`z{6$LIncO_L5X*YzLCnq%8uF7GE>6)6VZ^z0&=VE9KEF`aihWy}dms%D7*R7v#k&qIg zR1c)iA#1RF+<7|J-uQCF*lo&gIP;~z$Hc*FgWidwk@8m(Sw|^LUdRH*pOV!{Y6AhJh2LBq5Ew}jhas&f8#AUhs>n~Fz(Mc{kODQDE|4ZQq|V}1 zwEsXgrZgTpMP+-Cy+R>Y!yuNZ4w-3wk=bHf2M<&H>Tl~On^SmLP3Fkrp!By+C4=HBb8?>f-!dK$U|K8c~=1F*YlM0qsf-pwGG2!!x!!u>#4 z*Cr=o2r>(Hu0Z>Y-4)k(0#_KLd=FQ+om(GM_>w)fstDMJ+$Znp?~AmV{uxciCqP|2 z*qRBka~$)GRZq_s<9?(G{S@)X3LXuzf=@60Wd&dPn;>caL+y_&aRUZ}#Q`0}{|Oy-nZW z{dMl^f!XMF4=VqDd!_cD*S`6_Qv2U8JlxP?B)qs#(7c?RAyp_4$qM!|#WgsHw}F%r zC|rQ1uC}C~!3~QzKRFplUouQC3U0sPqHj){4b0|09&6m<(?86a#=Ly!1lzDn4X*qg zIQNd+eXTJUYp`t27eC_?Yos+PW=TOE1A7)-;pxclSE2u%7D%IU90AJ`sNE|8qZh6F z#JCe6Q;4Trb4{Rx6Y$Agb3Sh>>(C@4?A{DeM=B+KaMVQtB0}!q=0ucGT|0A2w5ck?8nDJ%;?@+q64Ia|g5yL9 z05lcI!~bzA$;i@Tu}kk|GRdjmN9t!J=Lw%rn4?jB$jNt8kM|YpIZ1SM`rO|KpsGP2~mjV-PL2-6)$ee`lpg^A@)g&Qb=RuL{4M! z&p1m1i?U!h=U{Q(y-;wyH)lAam%AwPKp-s&8vtKQPOz(7g*_%ZEJ%ymitG&&e2&D( z30iPi?J{!RcVUAC)E#SKWAP>Cds^@rYDySN8KmkFpQlQCLCAo~Tl;|Ue0Ip9fKd#H zK0+F7t?Q*_mm>YCTdO{Sz_1R?`E9FiO>c$^R!lQjoV z#6-vH5NRogDn`}oiF3C0&j6-kXBt))T{vg zFqi8@qc`&%1cf|sk+mPAE3p{Icm{%hC}1bR8#4#VyO}Zm3kunhO##4RqY>drh^X_> zN7oepLg)%(b-Lp$m}1hz(=qBP0)8bfyen_F0H9 zDG8QFS>syj@AsSt`UbGt=+J7_>x-d|V!**x%fN$6H7nH38?k;9Q=zZdid|`ugk6rv z1?t?yUj%9|&8ff_!?t2u{CJc7=B%-v*yf!M2ns>L13@9YkdER6uTaP%NZ$QTNj&nZ zD2(J#pZop6$6n^yCWNkF{R-;OmZlnac}z3dOg~LIk0F>E0c5(#GH@*}Nw>0eOy8j0 z*C&5*iWN}lg9h+GZ1I8$L+KuzoDhr@BPTYf=ln!>Sb5SN=o(=xZ$fAx2_ z8U=om)o#1%XRnfyd)iRz2uEmr4tztYNA4KMbH;-`rsu*;!2OY8X{LXy zgP%x$4i@+NX1B{Qf{8Au)6H&RzkUZv*KM-moswoI0mEoW3#Rdu!{w#j-nW%^tD74w zSA8wdWi7{_TdrJN_BC5J&WzsooNgBwrE&l&nW-ZEqQ5e$BsSn;h`-ZXFaEzFLRJm^ zaa_!P6Cvg?Jm`fFRbPMk9&F||G=Yc^^=K)A&>#*Jg?ax0YON2I2d#^OKR%Hn zvH}Vr;L9x)KW&AQ#pyS!omF?rk?)(5hPR$HgFY2d>5pF4cT$K}9X@NKVl@PDw&+73 zjklv8S%5IWc>R*QTrW?p!f9*Cu8JX#luf0 zdENJ3NBk&-H0_Xy6Pp6>vWx2)Siy)9zE;t#8lI~t8_}cm6v(M4<3-OUPNZ3LBFJvA zW^!afCIjzWP>2Bdab!lk_au2c;#=%nU^yG4erceC$X|r2}MdXQ#pd;r-vodBt_Hu zgwiDWZMO*($O)E1O{V3U(uV22!lv%MWy~A6%zZcyIZ?p7*OAZVR|`5BMNU&hur+~f zmFKG+&r}=^ zh*6X4p)*~>Qg-^4kuF-Rz&lhFZ#dOeUP>{|!D?em$FaSXDmf_+saKRtt=1JoN70AH zYRaab0tHL0;LlrUICv9X0K1qX(9l${s)Uj0Y}U0El3=QeV8f4j$A=lt=Vh`dU$`T` zxy2FdQdHwiJ??bi&7BmKZd;_l*;|yMr>0m|YB5zmZk=|^-q4c@AC;;VjvmmG}%p9APHZL{)GOes-%fnz{o+Ka#C=AO| z9hIY_DoA8gk)@@zSV|C`lwn;gNU@CH1twz1+2Xy?P>)wdk%9CnNaT#qjV$n?zz>xE zjISyRPq!0@6)RkO6eGJJm3*oqeo1TQZC*;unemx1m9lRmY@FM)HJa9h^2c_jsp z_oh%mRH=QGCV?c=OJ0&UYq*OGK&h;EY)$(S$+dUPOyd!YuUBbJMV>}^DTdbtcCd%I z8H0%`+}5)POSebx7Ohu23o1d=~k&xAn0& zMPIN9Y!H4v2HErkc}j{>V&?{aQWg^`F(Jm9K#mvqB+yCL%NVAHAlm}<1jub`f6vk( zyk7Sp1C!!X#KtYs-uTn*kz>1>>Q(Wryn1PI%L7t;lbir5mx#`+K}B8U#g`SV**tuB z^E}ZTDfyx)+%`jJ>^06mitm+D5WUiL@aoU;sY8h^IL>W4#9^z4ehgU_4f}3}i#Qo0 zeliaozTMXHtab_b7rwFta(rjp_HG7+nh1pg6SwHR6puXsgua8f^R5IQ7g_HHUq)CX z7*toIf#sozSsJ>xK1e%)^PQH50F5oHH}>dV%C{U?sjm*9M!NoRbHf= zBb9uNUgKSRCHa%9MpUe<<@!$1ip$e)$G7R&AIUdN<|L*cw}+Q?Ya&&;bs6?zN@rB0F3kUt3u}{d`tAl-wGXx zSB1{lt3t;I_>Kd_4i|o(>>8TGXZ-fZi(|+E^5Ss3dU4c2UL1EjkQXNsq{TsR0BLb5 zdJ3ey+ukg`cN}ZTfYYkxHq%Ersl|eV+lP|Xt6-{zP@RXLjx|vKNUa$7g8}zvlIZdf z((TXxY3^>8p+5b~+zmK8H)7cRqwfClXIesjrCNejBR;w$bd;?+c_HalO-6TDhMS8As;M6MHcSQ&7( z%i9+^t>_1+lbe9sc#M@YQ!_@v6e3YGL7}lpR}^rnU4TkiDN)7uPprzL7{6TZ5{!i!@7v%2d zQ33lWasv)RZuCLw?&Ck|ZWi}fb@w4CbbB#a-eBm|_`~Ch9kBFQ=~njkzN!832VFH^ z_57V1eppFTlXBznP&VB3%{Ou|{q(&}`||t3%hah=Ba07i%UP=Er1e_lHf0ikaHW;* zkoI5KwEX3zSuHH(=@r?zNeK>4dn#T!{>Y)8dB%>a9~i1AeU&S2eA_g(dEGRIe;q9Q zG@N*9%>sN(wjOPTBCsHz_l{L)N7EW%)Cu9*Y9DgsW>4993^i`{q4;vayGwm1fr5)) z{1)<`QC6?52OnKPq1*2u|M%4eh`9l*nh;ZxI6%^0xVqw;Z0o!|O%D1g@z&7RoD{fG zu1^$0RQ*g*)y@KgiyH2>1UINB3s%mT=4GWZ3eMQH$Bm)|K_u_XJ+KZg4$S`cD@v0O zYf}RSLSABtZ|$0P*&XPlhk^_6_lyQl+pHF@ozhUzKlWf%9x(*VczTE@F+jk+U1RD# zLJrfr9pM61DT+qGi#?Ck_OT(yrT5W$SUQKZp z+I`j^&G0|ooPjxcbNa+bOY}A4Fcj0zeSSkkZbE40{Z9AUM$ivtl6VHdD3j~pPM2gh zCe|P=Hx{`JkEls&3ns$Gr;A+U^XoW_aeOh6X~KU|6H6dP^Uj|HEHx+rtMgmYtS@o~ zZl=we+$@R8zWvqwFzZSB*CIj>o-Ub>Bw5}A^E6-gSO*ddRtMzz2h<6<^-uBOY_bk3 zlCIO=fuEm|$*6YS@_a1r=Q%B=uzpU9N5SoopcG$cX6l~VxF}7{Qc>LyHXj063XqGz zA%JrQ$l?H}d}inn;}`y{Ee_jciB38%701O~o9gA=HMhUOfo!!UK5T`*zyX?98*@;V z5)bClg^XpG0WL|n1Yo)+?+4C#wq>L@m<@pc`WmF(GBS5MRn<6`BK4=5mo&z|-JzsF zTzQS4K7ee@zOUTC+u!0X^8>d(;K0rQFmIg(iPmbTA1tW3f5XHOCp4H_>o4=5hrp>E zs`VcE$`}p&tz$M`o_>j90;#vYn<7E<1hPtZ9QG>rzs3DT)T%4+85MA!={cB`gYpj0 zc|@^l^{lCBfxG(8hAQ%FLly3SYp8Y_|L2CPY2^-cX!5R_(F1aot&aOzssED33OdNj zC1R8Emz9fpjLS~!1f*vMy!x4Y|1bQ^AAbC&hHCnshN|DIpBd@j{LJV7QO|t(KO3qN z|7$~4C{oy#U&PY0L_w8*y$^}AeAzcaE2-t9<~`k*k}XC@MDAM?Cn}F&;MyiK37{KP zf&{fvZOs3)Qhkp>8fMYo8fI3-R}Hfxy8GDRH@&|EUgy(9{}OopH-Fc=iNQq=y{XbvdM6b;nMv@na=8Okg#DM!^R zw5TR_t|5IPTNmCXa+&p#+y(iVcQ1|%hW9JK`$kfJ)b1G@WM$pfMX8w-%5;KZiC1C0 ze$T)QsO^%&ukFhxbFfO`ElTyqLU6IG5XA9TST`t?#%z)|#~tCh!gia>;^S z{8FEuHt?%r5U;cQCB;9wsO%$<=r1CUOXM6AtXv@obTRRaje?QBCBBS-9Y2zSP6K_* zlE?Cg_}*D#j)@bR-D1oZ#)`i2(f47BY?WFYkP2OQ#@?~yN-Ks%=^I$b;Hry|vs5Aq zxzi}Cpk4jT@_1?Z(`ixV?N8k^QW?UyFFCf9gDBo+V)pPTP(B_n_%`XRzOg%! zO9zW-EVZWg9V?%!?x>qb&OQ`PJtL(Y-~|kQbw!xfs;W>>6}rnPBemGfdvU&&xdVBb zH9=x#U?h+cR_)dDmBjFOJQYM^n1KJA<*O3)-)Ic~`D_KufA=zf73M9q`>%HD!dD=X z845Sxw`KV$32~cnG$NZFn(bO`btZfIvc|&DPqP8^DyQYkt@X#UEcCmC>Nis{R$}YK z-4g$SPkyeVEP~#|^4PrnU!Vosdt&FdP1=XhZ-0XpKmG zTyAC+fO0HWm@IQ3YHZS6`M0~PleKggbwnwM(4kHN=OBUR*Dfj-k0>HFsPIju*bM5T z&Vc}#TP1Mtn_R(c|DQZ&z7!Ekq7GDhRvszIVqtVZio;_S@e+@hoHt+Z<<5DqlkCKd z&!weNSTI|*qhLazU2t=-PW=txX>p1&VG03_Jnip^Ic|Q$6RwC8R^N3L)K{elT(KU! z6G!i5pqBTqiKza$NpKPR@H?1F_HLHOAgGxL5glhhgH@QSg((JgrU`>Jvj8e6h1)o= zp;@18fU)4s1uVT{jH`Y$QAZHLyJQ!O_XQj8r*jOfYeqfE34hdvp`|gK;t-n9-3nsD z$27)v5bL3_UAE4QklO}!nv&4cuZHeP!zBAF!xNdtZar?$_O<+w`Fs{H65^69N7rTL z*yB9gg5Dztv=T!h2kaYIuU-^Hint3fcDKh8t}NyBhMRs0X!l#oL`_b1z_5Z1u@>(S zf#8SX$Q--on_1@HqFTVh_*rm|aVlPQ^BEBZHsQo2dyRjU1~1k3zbTgY_M~Oc>kLdt ztj@~ z+4NPj?0o2uxTxuw-U8Arhd&4K|0m6I0!aDw{kLWr2BcXgdetmPe$VX?ynB3enD&UY z2uZ!x^Mx?7>RqZ(HbPwR@D)IQwP^yfK0F(!Qi+U3uz-RG{$fDaEFW} z^2DC#WX%~iPaH>BdV>G8+d2pofkVLt7-ehfh@+nyu_j5YH90gk-`53@|CpSmfaS_G zZ2`AQ^>7USz)+58*Tht2rz!Nz+r1-mZo*8_SNbEqTIz1G{ES`wx~7-p}hYG5GgKr_Y0rL*UxvAwEG zp`=bS4d`946VL%ujMuSyiHU+uK%{h)*t}HUn=>+#!vRJ=!FT2XMrIUG1v< z;`}QMr_9;>7n13{-JJGo9qL+6hEpli;GxWFmo8o(%3*0LH2ekIE&ZqwEpN#V&IGXb zYlD!!zzp_&L6dUib9@t^_c=hi6$LtIV=)?${N4=~BE*8uvjO11^l8;mZwMWCX(sTD zxTyi@!-xYD%Bnje8-XN@Zm?G^LJ_3yC-)%&5;)1=R9TG-G(uu~S!`hkXekqGu!yL>?7B>mA=cVCRW^XxtVteN>wx&Lb_6KhqnX^Ws`B}w9!&BDLe$MCJ5G-RBN-M zROco1@#Yka!dcOcV8lYdAQJm&kz#?8<^g52e05bY*!PbS$`10)^y-U+S|Jc_O9#rv z5Juz(iTfIP9biqWSSe@#jE`#m0lHbgY#b zn_`Ud9{rg6_sA(&kPi3IjWfWWaY^ywzN-z0JIM1^${(T+>Jomo$43<^+p=5HCZyl4LowIKraE2(9$9Y?&zj=E@jY=3zBoyiB z%FqINWkCGjMhDPZ2E_*eJ=+(^sQNMSwgY;?bQ4cJ2HB45b#QS?bifYMqpeBvCPptG zY?3oIn4p%aC|V{6XA0vIrwZqGPD(g;^9}oq`!jszNmVtajqB%Pq#{=hjNlQKswlHV=C3&*aYCO7cgx1sj{LV9ZG%% zTU@uc}^v*uAi?C19UaS8Os3 zDy8~=TU9DK|Iby_|39k=C(hri3NK@9_D3%sS3@FR=I?;f$ig``4KQy}M3=uoU zw5#2LGBvZ_c@{4S`wb}>8p-)2bPH5^EC$$!tjC_d_ojvXtmhfDC@+OlkE+A5Fo=`@ ziIu%^NmHU|Jbo&1I&^JVgbCqI9BX%oKoQ|s7^Dk2Cs#3Z|=J_q#YK=^A<+Yg$*7UubE)HbIi(;RePyvx>IW#)N|4rn{d|qNV@Z-8baK~H3R^eUk;ro` zLZzm0K?gN{t;aeX$%YW%w9RQ61FEI^d*@Fj3^w(X=|*Hw#DX)WMgSOp_YU>Z$_?_SSf2Zo!fd{`*dqAi7u(T?wLD)!Cr*h1zysHN!?^-o**M9lz z_apam%PWBGea7zYg?l3xOpchyEa&zjgAl@jT<^yecRB=weDriSUCc^J5gCD^gg&

f;@Gl4 z6d0W9m07b%OY=j@s9RObUrb;)^g*%Gnzjn&rCySpR(N@(VU}76TLO$dgHf^6U|)Pl z@s!})@IIsJ^0^S$nIBiD???AO>CwL)^dK@H&Y*4A?mO!7VWTy1oyhg@y^Z_apZ9#C zl_z)S({lDoKlN6nOWo;NFXAp0HlcvbtS>g*9M zRl%Ri*(bpMB?8L(&HRF<>O}?cc$ut+hnLKefxMl&BJyH(Ww*u%M@Bbu&AwTKZ1M`l zms^7Q5;fXZr@+e(h9rScEL}YgANJmotiOMnmU%N8UtF6z%>3?W#bqj zW9IRRzWc8GNq{8*sbHM|0Szlh* zUD)U%vpiUft+>uE&9PLFV)pgXd>rA+UFFtx)=sj=L2GXUi@YWuv$CJLYCGvvqO zn%(1|?<6n6bOXP>FS4*!xu-YicabL@oH9Y6f)q;%&Rn>jA2_A&Ocvy6sD1wt<)?lA zn6xu^pzo%rPE@H+)%ADTpI%%zBoDFD{x)ZBPPHBjKKa8K(TQpiI*FT~jUH1KAG^D_ zc;Wg4lpcNaKRs$om~T6mq=O|^DDFCe_FNvs>lgi6LCIb!eATbC!aUv_S4oa}$;di- zFe}T5FtDKV70(TaoEet>Pd82(ckLQo?^?@!iD7i#+E|6X^dv4#_Df~tzCf*du(3qA zHFKndYSv#Ppf!iya7!z$`N02P4P9Eyl@e*BMOJ(0dKiZczP6f6a)3Sch)FWbsBx(# z;xYP4YiQ|qtRwmj-zKkkmZ00I;6I!hd{1-~u?)HK_U0u4_E8b}*S3svg|%1`29iet zU@`y({V!+_VSRGR^hX-IRnKp0OV?iQ&e-v+1DCZ`Jm(h;W;##a!PjcOBtPGM0ZZ^| z(vK6?s7Wui-ej&%ONM>;F`onF^yuXFUXyq(3X zVu$PCJ16V`c+-hs0KQx>1pbshLlyDJAjsx|F%#Q8ecAG~N8Y$Wc`07i?J;nahhnr* zYQ$r&)Puf1{xuDH>ij%lJN`UiJN`OglmB(VE`(}R&I|uNDfX_iqsu>sxSCLEg%ho) zM*6kECDJk#w~EyZI`c%(;1YYB|r{ht99@)#y2SZA&b-6ippmoBfK9LdSY?Zpp8{`-({=9nV!7> zuHw~L&9{J&;u3tIkIBvCul1xE()A8nvoAQr&G&6ANv%r>SQB8kkZw zpDDF)DfDv6sf?Yw2u{`GXFgH-TIMpui$msAR0zr=thE`Qd2<2#KFDH_yeS(a4{2EE zy|+p#FNno-IIqsoS=N-adkG3(#oic`j9sI)cB?52O%ubn=Gngk-+ZAc^~^ITNx{+a zqg!!J^JH?BNKr@UIkQ+YmwHop1ga?ZoZ8%3CSbXj4H)nQhQp#zbL=yQFiA35XUjaHs2 z{A&d>KqeF>0x0#6P=>x$-06DBI1@AVs5WLgWvQ;>#J3e$Oy@N%bo?&}Vb_#;?#Tmx zM+6dsQf<`+Y6Gm8`PrMf#m-j*Is@z3%7wGJ2$rhmnLtz4;`a^C4&|Ox8JK zs{YFRu854Mkw8%&$%;k=UfAAs+3UVjH|FKEXhnBfwgt8Gc+iyVtHTDc#1;ed3pHVs-5fiZ8dvIra@h2pUr-BR+Sk6Jyx zG3=VXY6!SL*(gmK!y32|pLw+U;Om>Q08cD^;Tq%E#r~nDQ$G-H0>cH#uMw1BoF7ID zl=={q*xwaEV-OMw(IYKx^<5!z-J^M3qX*frLXR{v)bE0rK7SY+)|JOgCSo#HuS!A_6^PG-9)A4c@uA7cV&HMg`gz8Q;4DJ13|S?on`W1} zG?IDl8*^M)F{;*fYSuFDs_shrxT9(rH$PJFA^t^E&J~wT7uPDk{Gr4k$Wp3bphLBJ z!wq`7o1fk7w(045Hg@S6J{34@ZQ5;c^cl!i20Y2gClX*n%zW~}{}^~WmM=l^Y@!L; z=dxI#macVJ&fRx!WIBv%6FT{DDIDsZ)Zs$XQD|G$@ktWwh9E@+nVCr^(mIQ`--68H_m3M0p}Q`-#LY!v-lM{_V$hUROnfXD`09-v~@*8^iDyFyaQmv2PV9B9{ zO5OE9@iJVVNg>QBx><6tbAcxN%|ZDg>A+{%moloQbn()0jC)+qbe={l^k)-+K4T;| z7JjS=5^{n4r=}!X`%F_}2{f<55XQo>_P>crdsinb#6OI(jW)dN+&Pe*l;8NSUtcXK z^FhDrGX>e{^UuOXSns~CSE!z0mcpEb^PVnCpJ_;hWe-^YXh^n5(iM@CZd+xiIh~!b zN_$um=(`FdH!O9S=f5HzrE~h@elh*g7u`P5;&;I8Q-uK0(39m~4wBkNX^ew}e}N(1 zcVi+EBV;@N;$RhRkmhrpM2gJUDlDt`%_KUMRoQB~-?^e284h;03o6BBc&^$TgG@IB zCz`~$to)%+CI_#dK`EF98!jyVxIX)R`MExG_P)iw^oi5$SNIABjM3egH1(3JOZ{a0K>>L2 z4l}k4$=q(}FvBC4?ID)GwQl?*xOF+SkbVHYa`$#L*8SI8Chyk-#W*d$zM^{QA$W*~ z_v7hKGy8#p37vS9Ouxjj>~7QPOKOhW#Rw7m*iMT#_hUN=E40E!y7+LWcGp(@cSa>% z2Hgo2Dfo-&M0>_`V*A5%!uthv0w-?}$Sdt-R|jsB#e4mPH?d;UB5RRwR{pY#QGuLS znprDJN5g%1nB^fIp9?1V=sh9(CHZW5ICNp(;jKzQG39seM{z?N)HT7O=Q9k<~K2q;@OFR1&O}Z#9gEpC7 znB$zsr-2rf`j~(v7mIhnf=ts6CDpc!=BFXa$l~E<34agv@|k%;d$y1}-b5V-_+;l3 zMW=1G^2}tZCi>-Y@8LA_8;gcdiXVKFImFr0lv#ViFrVbcWV6mX*Ydq8_4HP6ONJLg zR|L!IF$u5j&g0Z-7I{4SSBqHeFLimQqggtyb==Ihj+SL`=mDayFtg#!1pGW@i&Srs z_mSK8hcGN5yW$!DpItPxsWpCFd8@ts@5{*)9rt5F`zsuc-hc9N=zKZ3t zWa!a|#-(d};p2*jm(UY{4!uP4!60(#^|1xE9aEnLcD@7lloO8~^0j1JvFSiSC-pu8 zs=A5DeB5WDX(u%J^9u$~OPjx78f{)fpjD#gDw<|D$QzJNN~yqGcky$phG~KZThMm$ zOqP|$Ta-L@^C?4bk8p{tXwL+f#C=LseHMGXgIjuNb0`+=G>YQX2wd8vpHRaii zOIs#17Y1M7;=gR75;-mPe!iIUkxudy*Q@pOLNZ0HKFTEbgN!xL>&f&fblyGWCUfZ~ z-$dVXebv^H)85${m=|7Ap`J9tj{Vt>aBkosI_+I(Q@wLV&NX`4@*syvE4>7cT*L?k$ugOYVz(sKR%>WPd^X+6mVW) z{4gwFz^R?Q$2ZFPM!^M*+_yPydP#GoarV=flddSAk1co4eZ#U``gw_7E?;CRxdX^O z!~Fj~nM;+BKQU4YlJqjmLRAGqMA5~KxbXV?!?+<|&|n0m#A6H3AE7D*sxmMb zD4jw;5NV&elGm6&cwA`}X@#p)h{x?joyOuKQ`j_>;{AcZE4VOGP1H{C;8$K)GNFtK#HyG*`WT*Bw8Y;+UUSea6wTiuS zH>L+XNrKR;WJygd?uRE1yYzBWWAuBziYo+NmsWSSU(OjStCEatDO-9^a+ZGMM<`eG z9fqwxS!G6-?>9!UXRUkERNksu;d=N_!W5`YLJG!SCnrXGw>18UdT~8E>QQ;nEwMx9 zp-ctui_Zk-oz8nWsN?9~Z%LG}`>@89!|ds5k;G|JCC#!#maqK|tLxlFboHqfMfuI{NfAGB(I)ho|^*TV>AT?b<{`vpqq3#mb?mvT18tij(x!? z0aG`LAj&wQn6kG zKgUtU@Pg-by+Kw?)v3Mt*z0LS{A#D>y(VRBEWqVSpK^MT+`J$3^r}yTz)L)dgCC9; z!dJit%%4N1DBT@C3fHTK=Mvs9z+cL8PB8;DK?o?u#v zX$E1pEfEspG_gl0e^PpszgBf|@UD91hNbQJp4dy>A6}H)+J4i3kO&lP8ELgDHtlw^;9;SXq;$@*85YF|6y30^(2zG; zKDt%?866JFb2kNdM)O0&>leGWnX{NHEM^WGGv5$0 ze%7G+ul%Oq@BF4-V7c|U^0K|2%cp8?-DMTAu6tiOFRycG%w0m|7?ydsOF2rHS%0Y9 zUST-79c^y#CD-ierPe*0j%0O4v1s0;C3}Ub;h3fhP!NU?A}h{g@;Cb~%o;3Ec-uF% z=I&%l2G|Wl&|Tle+x)Q1g!)RvAL8g953HgXFweR4N19l&|8OKVs|Nu)~D}z(XOFEWh=7&2iRhWTZ01DvK^ik=+ulT$7=E_S^1{Mx#o_CfMX zSh~np|IN_ymlOO|i6dF33lhgDehkO!(U*Z%+%t}s1Iro5i|7}}i~TQF?yoBK_4q3 zBmUrOU0>b8(qqiGZ6)t|rn34VwZ0iOT+^uE!SP77y({x4y-W3f(7Vik(z|wztjDMlsPDEY+o_;mj#g6?`URxjNF+5GdvUz8$~>6) zS-g6Y+Vq8#qlGbxonOymwFg%<7cy*mx^EuV|CYzBPVoPf$6S*cbo4%x#|WOuWBC4( z$GrL}k7@Bg3bA$d{v(fZ;6IbcNMqzN^B8#y<(WK2;kP^{avdX&QTi#5sl$>Fre4eI zqqiXx2v?vFtgg>y@S!Y=xS)#PE7?-Qe6Q6C^)QssN{QP>Fl6;9a4R2>@N;Qs1LN;7 z$Ms0^5)rwrr=J#B3k?jrIbO&5#q@zk72J``cI=U@N4n=9I?Hm?)BRv+pCRw73s=YG zi@C&keyHSS)j5sCijK(#5eql8?-Gj&zK$Ms8(W%pbjF+J;8ZOc4kjLmvia_7m3bMN z&8EXB@nn#D+i!Z9$IsLK#n#v~h z|3JEMFp#d~zP@jA{|)K#|4&Gl!WpH@(yAybMAxBhh+@0ZqDiuXa1*=j<>w0}$cD}@`KF5?5{TqHfSwu)!d z%CcUworK^mipQA^Lkoy}L8VpclEBJ4#R-fs`wnl)%q2p=8jav(C&-<>5|RBzbx$N# zNQQ+aFW#oPPTEaRq~yf#iZi_YML7QTmWAn=OeFfgtt(czcW4``?Dgy|Z%j_+*b}*) zklg!EAL3WPVm{81dZ;V&8coW{tD*DKnQ=eaYiB=_Kk#&@!l<4jNe&S$#l}Cwy*SdA zlaVokp~_pP1iOPNi;-MYjyRL#WTjd+yY|%9cj{~N3mQQuTK>^3xI=~Av^)B+#M|h& z-DVx+v=+lqz9tLJNRa*O#p_OwN>k4Gpk>j@E>;@X^~yC2rL)gnN?dNQvA0ys->GC> z9`OF!f6|Yw>oKu+y0ms*>wx$}Ah266**4iWK%09nHnBLzTr#kxe#XMAgk+U^S*`PM z%D#W=+JFQqYWLLq6M+l)2ZGD&2ZAg62ZHNRe%;8^-sJM;2vpfbZTkelm2iUKvW*Gs zwoUwN1ed2gKl-6V#^fDJkGmVOB*uuLW(|1&8hW~EO`S_*>vc=h)o}~W*Gf~kZARyP#wjb(O(d`Hc%S-hq(y;xJ&Y3xDsNoZCPsN~9NW7jCeE~A z50m#_4|cf7g;g-<81==f+Zb=I zCErx7i);=KR1#>Y$+-VYj^mYpdRUYki+XrfiKqFo7vl#DeZlw!+1=aW3hEL|Hur<1 zi8<$Qtvi^FR?(P6qwk5k9jtwfsw$sc{Bka+jDwZ>;*jeU+LUKFpMBt(FDk&YIBzvl zqW2|`@EJy6{u4D4mTrzHs>Ub$m)F?7U!%vrrPYEOBZoWJ&y9)6h z4&u)^H1G&<5F!p&mU~>L8mj<7I5gh;TEdY@M&@ytlt6yD+IQ{z1;O@~ZpLf_n{&K# zf{e8im<-Y6?_9O0>&uf-bwC;>B#ZjQt<##cpH=lRswVA2cb-dfcU1Ctb!wN-d-~Ry zR!gF|ZN!LMkTFsR{QQ@UGN{dsXb!9$b{{{In8@+I)keXc(Ew$;$iF zn;ZKUzEx5eV;fp$HGf-qn+)n_1bZm9nkx;Xat74Oo8Ef}7xP*H{$=KgiJNw*Q zW~1U0^``MF8qA?zmv)4ZhG2P*9Cpsod&(f@pn6?z&3Dg;m}wE%rIM4LMSS<{h=L^_ za#a&J<+K1r)~%#Z&RpY9L=?!(aQyf~>)^0#i)!s{{Ai`Ww(odk?c`=Wytq>?`_kIP zHZFPLY08(>Y?>PeVv$w(iTtdVnePg^2m36RtS&gC1U=x!V>l)9OUKKrb^^AFyaM*q zjN!dCB9~oJiXKzD*A71wJ+U`yGSl-SK0dQ392l&{FXny3)ntGtu*2PjE^HQYzGBG0 z@wu`a+sG{$t&R!pK}8{#t7flyh~2`_sbq?KYlMn8--mQ%`gPasDp|Eg?Mq-gbU)m3 z*hdw~FEHFO=*8?dLf;Qh8s+nEO`Gkgu!_j!=LjhuyMM1pej4U(T2~s4t8Uo~lBjy# z7GEH7Q28-{rwtlAGQ>0rr}6Zo8KKKETx#lcvBTGpxt}l}pf$YLN?PrHb+p9+3tWCj zOAdxK;ZVqPz-bGk=E}V#buyc`9{L=};jgBjmxEsx-&lmUEbUi_b_^)zt;_x8W+t?Dm?FnkPmbmrw(G%b5Art!Q@6X}CJCyP`9u zu(sL``i5%mg`{KCK24u%Ve6vp#O3;aj7xa_NXG3jwD~I-MCj5_-!Ju0uMw*XTfLup zrA(UR7e|>=f-@6ZHPuT{1Gpq$b9Wzgq`oytF?CU}bc+3e)eYnFaeWy?W0=W>uc}w< ze~xqMo9?0|6ZoVBhXH&y8Ub)`63Rj;PuiAmWwx-Gj`KdEubcki(;99rgx7O$5Rdxl z>VZlLloYjh@0)~PL>m+aq*G84(mJc#3k5i~Zc*4~*-kuP8$2wBfRsI|Mw4f%Pc0&MF}t#*YkIM?F+{|6H4W@dL76GPTX&p)S$9OCDC^F7fYt_ML;bIt zr<3YrDs;Sz?k^pkyr%K!YxDzKIxhEJ9MLo7gJ&O6@HLf_m*4U6igNyR&%*k_ChksU z^>eX`j$O1z&*X^bi5q*CW6beZwja}8({df9(Ae>d^v&X<-^YMU$j{_N%82#HZ}A2! zA5Qq8)#;z(kiy60F64bg&{-JtCGDX~2v$r$Hb&`ls|`!~n^&_I}EaqL_3xWNmZ&PsAi;^vx| z^-V8u){{mTasW&`Y2?I7{F1R%&y71OwVG7shs``fl$N4Lmwwaq<+&Rwdxatg``~$9 z+3ToAr6Hyu{zB^3Tsuh_1rob)ysW5$n}E2RoD$$V!l0tWQICSUSnz47@G$m4PWK=$ zd2jyG+P%WVPOYhT#T*69NqOuaV`pJ^at!AkQ{Ox;OEVmcvFXcglcxoSjxZtgMZ7}r z%!`Ixa&4p4@A-Q?-IP?Vk&Q3c4G4m2C)eJQrxBIldPS9850%pnla6M2Y5Z|>z=gX_ zTHCJshJ%0TH>lRcdpiEP2C(D^Ly*&tPo7O-doZ>VGWpHl3Hy4uC)tP&xI71?#S2Z% zGG!`RDrxG|0n2g-3RaHd)i?Z?=WjGYRk?N8OT`7L6}y}QTCwjQl)k~%ZunTH%}zl{ zKGXpCDxff)4m34e7rzJh9uyUk-NKr9w!vXOnXXE_9WjI?9#(Kbms05Wf5dWJCwdbn z0P*qwcvhf(r-?cqXzw}g(K3pYl>L%(Y()jHbUGj553y@U_<%Rof zz>8)SQ$*OZV^k@1H>~0 z-zP1LYEMy+MPR_&0#0h2$L1}xSeqi43z#zdDvsIIwOA#D`&uOdKGCu zy7%nE5o>cOe2777qFjVePk3=)7yoMOL^o1AX5p-)5XD9a=L%Eb2A9%@3*X8xBXb5mE;Q*GO7YPpdKc(dqh?2C*c7-($@)mNqZY5h0Ck^Bp|et-@cY_z zTi&co1PEE~+TP_V@2!oiUos8x(*JFA6TrCtuEF&WAO$`ONRe!();U46X!qpV3v{E^ zgi86$x2en<%XT8AVO8jv-xz*z_uS-8xO=2OxO<|%zW~H zy-VFAglAVf0gbV<`>qg~(M536n1W1{;oc}pvm~G>^uhS#Wx}0bQ9^E$=Zc%>O_2k) z(XTibRa!^Sj&;eWeMmHMOa#`gV@?)5B`H-LptT2e?r>D;w&g$F?MOdw7p404X4P$c z{_G~g9o4Ekqch_{_12w0xeL;rcjr=!t!IUvvQKxhm9wDA zEAJaElbJERNN3?i;{7z%NpSfkE!7oaGfv&eb6%qw6FQH$ z)jBA(9=Ec`*8;G-_ zqqzLBc`ePD<+hmi8kNw8h?=eE_q!_xg#91otyx99UcWl2GAUR1RZs1W{$(>$gQi=0 z&zw9Idb42=a!wI!(&R;|UC?9-KM%BCKuJ;Dvb!QU>?C`mu~GG%cIQdY)H{`&RcuL| zg69Z^Qcl8+NU6v;ZbP_!ncg#1DgnD6P;r#bv}8%DlTw)1IozS5P5U?5^p&? zqI{1_aopaJhKH@ud$@0%|B<$i=p$v`XJ2~V=kUdzgU8-5Ua$|~c+~#&;U50!u);p| z7^R}qmkcFGd5%3Qu!DL>q}&hMVDmzMNI^*u(LkO5GKw~+12-SPZzT1kRMhffO{;l5 z(JHyRnk(A}52~|Q9Mjr^rC)|8T|Bq?ZUJ+s+pH9CTGZ!9I39Dpm&`|lxbV4s&r#z? zJ%Psu@x<_HyL|Tie7p1Wa!r$0#1z-zJEUYg<`Js%VFcbr(N-ID=}nS`5lG5d@r^` z>fEc$)k2lywiTdgG|h%C`#Xrk^;2`MvI?dp-HHsxRr!(X*73RYEOU}x`%j3yO|etR zA?^v}uywWt-Cgp6R_xuknrOHH=6a4P!w6v6hKc~Ecv=$h`7P``%{F_z zX=cfmweV<++7!tRYD0G%^z@<{`PG*oXB$evtf-I_5dT(v$u+5+ZUn={pelj=+rJA^S%)6ahq5S3IT?ZRfqFz`i{#9QjjY)bvwh z zsDXyzouWBM?AB}QDU4IjB81pANjTLFfoLE=hN7Ep;og}$QQWSu14(W3ZQ~r?MUeOk zdIhT}2f4Ol0p?#pspUS4J*0VGW}#zQNY9XnW-2&E^X$&SW#*~(#ogHS@-GP>f-%Ij zzD=&fngM4Is4$<|9Fv`?3m0O}H4RM)wtbPe_LTMyXC(?y&QZW$b2UDT9 z6ll~LMR${S2?-SES(-YyYt5DarvII?nDh0ez%|cg2cX?U}RNk&)Tfkb^?~ zn2h)Lly{n)YQ9?@olzsscwD=Ra^X2mRpX)t`wif>KTHKYHYFp1>)YKw zWHdfE$rzjchPd^pp(y>ieyu_CF7*AdPS+WbdLOQU78(p%nxVW}jPYji4wCr9Pj_v4 z%@*QB*Vw8b#A7T3X5Tbq;Hx#>@Hrp$WKJviIVJgmhY57!Jgd@7rsT~5g@lW&aj%}9 zQyGnPd50VEUK?xf+iqd~!DVcN=dz2VL==mFSB?%2BuijIsL5|u3zQuX!o$FHY<;^~ zS)w0c+rzIAolO^_sC5ZMhXs~<#L^dn+xBpJqMjpc5jocfN!`(HdG+_)LFRKB1T&|2 z+}z^BIlQvh7Uc>wPKFPPViE!^0|zb?0(XK%chmqCrY{{1no(~6836D=7~|!47f7G< zJ+35~dY;?mWAQ4S5-q-zr^no6sal8HIjywEXK9eP>VCLXO)}od*_rC2>HAf84MM*0 z5Ty8odU--?8Nj1J7!zs7&Gm61|48mna}Uq;`0Sa(Sg8T;I~X-ugcC@0fP0=b!60;g z)xLub+TOt^aQbW3pNSVy@1+8T2XG@a26HeH1mnbgBSe5Tx}8DsjT4-6r=x%@0m&-z z^I%bt_8J&TgcBe&_7NYwu4NlVVIfyn`mzHL^>YI~r5x9~pRc?7iF0#2VG9@MxN|RP ztWutAxj-fzUepkRRp&So@uueOUTv-S%5~#TK~lX;cbhAYni1v)ecIdGTb+xsQ(wl? z_%|dJ`erGNv$E90-n|pbvN)LCDjwy2O?ytqX|GkxbI#TuseD)IZ82Z;!fl5*YJA-K zR+*u6?X8gS$klim_7`*-ISja)Au z)7zSU$X&&u{d0aB_iKJDdW!j(5^9W(XbS`TwAZd*k+oAy~nQd$=v4~E&8i6y#%ZGR38WGUM&rcbs%ymauM1PGpD&1xOdfbmi&Fu}&OD zo4a12anmGca@MM7{9LTy^9~>*>f2PHUQ1jK&-5lK?s9>rmkm-q$kH z)_f|Lpbw%!5h5S_Gc*_D;5P?vTGI${i;D&z$xWy!x7evAnP0rrUL!J7$00HaPA!X3 zb#Y2wu?AXQP$3e|%m#Yu1EnwLn=Q!`W^8(d?}3Ca==m#=6+U9?WewOaAMlM{#Z58w zGhRbIn9NR>JbXi@!%8kO;{Mt0W**J3mZo8PC4~@;qY*LT?#-g>`)0+M{i-c)`G+7O z1x|;I(C)XdK7?^jqL%86`4MFGG|!(up)3~jt~6#2dcZWmcv%A)P`qO_a@$?2t5?HS zpH!ocHN5^sqaOwiojJ}oeFxGpthlI@5C!|sQXoBC?r0G)hiZC2l+*Zz%7czQbw+mFr=>Lft;2Ff{u($7<-B#} zg5_{S!1)zbqAr?Ww6%<_%z8Bvk>jhIH zReZ?^VKzbinCpgZbH@qq)^mq4kxNICzl>4He*9Bq)WDGq=G91xx#^87+ix-l`YQKY zk;Cf&DQDeoh9M8<<V~ zHd}6v9v6DMy%t+uR=x?A>7FeGZt1~~bU}v%B zOk>hK8Y!Y*L32Q5s6WA)DpC7jW8x5N`JKXc9%r~Y*mc@tsj@B~jj2$(m!*b%c1rZ^ zs7}<2Gh?shJ3`pC#zMMB{(EPsBz_`8}>X z-j_{ylLS)u20nZBo`>hWq8RRSNr(HEM9_4#bP2WOfWzqS{0F(yNpIl)!t!if0?)&LL;A(^H_|U1ijx@5JLoiq+XwFFDQVI1%6>_} zeyGl-$uz~9))LpJ0%G2Z*=JSoZx#y8@_cJYmsP1R3yM9gb zHjczbbd&zB=yGqg8a6KZ&MHL?$%A%QC|D7{e@9%2o3FkA9&5t@X#|)4Sx?%Hh%^vUKu3BJAAlwLq}|90-35o%N)&X zG!(k}{ydF5ww>@aC27%TP(4q>3+VxY`%qq3rsTlJx6dy+oh8ocCMr5nzAKi^B$BF8 zoj6Ap#0uDzsTC=2bo8;)tXReC#<2G>1(%7#8G7B+ z`snzO!h(JJzq`Xu{OTU(`?wGPyg8UTr%;x3#*Y>x894|0*=Sa4C~qaLn&kj zCRLT}wcc+ux@u^N@xRlbZ0p)N}#(J8^vrX3mG3z~a6|15pV|+L6t>0^) z{Y;u0YvgWewV}WhKM(#|^f4%$E==M032G?F< z+?w~`h6iuRNrpx%IYXCM-AQ> zn^hi4Jr)F`v~WuZ4|snaZiM8C7Cjz5Sj%lb{`6n6^m&eVTSb2p!0GQps-6Bt07vv^ z0bDq9h!`cE!pySy__|2&w2^kt9YvYA4;ZV4#HUs`mOr#`<^PEmZeInohasT9iQ&pm z#c+@qAZY|6C$|2>3fJ`~E8I)SxjU%Mj{nR^ioay_QTN8qCO8O3F#TtmIOKm%6W973 z+8Ft7(bYfy7j*RkM4~MQ;X?d6Shxs-A~R6?ldC`WC(J+gCzuaB-Nmr~ZhxYI>4%Nl zpDdqAviq?=DLvVrU{pYwzFHS3(tPbjfzM%L|L-(@PltgGfN z1^G&lxOFH0?n2_k62nb$rSNv=dj{_=uxTCKiP*H3vb-B1Av?0-XelBJbA8E)5?OxJ zqlSWd5g2M*o#xpQFM~z#ia!xczVHUW1AoL))=YGN@k@T**~K~^B@gaHnw8gPGIo+} z9wSg)t(%7>`_g?vsY8Aowj&bG$nFyBTf(S$iPDMTJ^D%1ABK0E6T>?b%J437>;A#I zTm7N1==h!P9=GR*+m{-!*f7I`({i#P1WbsbOGrdR{%q}RX<)@nM9ERUbo}CWdHFovxvN)K z!sAa>>L_GkHO5NC);HJf(QHjx`DJe&ZjF1k_8aE5je?E1FQ47$s_ta9Bvh`ZB+;`I zG4vkR*uR{V`uIp;Y2e{%nQD9Ylz9K&DDmJX4Gk7C*`K_2o&R&M-CdN|&iT}9w~g}JY5jlFYnPd|_kYf72k`>& zbTss|BtIE(=OnESNk;Y?2rvVy=`_5laCJf4eagSpdp`!s&6M;2s{=6tlv^lIHu#WF z)Imf%3R-%gsZ3wMEH|nE`4U8TBJKf!5DE&2K6r*f_YpIfD?2U{kQqSlfQ&XuQt;RS z$^}=vf$BcX*Z;Zu9K`+T4NqGx$aq2}39$!rPpITgxM0W1Y_Q|n*4?UQ!(r{dBTS9r z9>iWqp#MmIcQ)Hy?g?#8#RK8~!5XYHAF4+rF3kA5^ePYKVdZ4{<*#MfZfzJvo0t<+ zPX|c0U_aw_J(y@_IlA@Yh4B5MV$M*2*K><-KN0A;A~=wN{YGAjw1Y)H2g{dP+8Kkl zmr#Ea$3J;VCr;3i;|HFJrn_1$8DYJ?q@!qlg%sqJTbH<0R3tmsEz&=1utWcF0k6hr zu)bpXhZ>waY*_W?AWn<8x?;j@cwz$9%1m%|&Bc`A@dm{JxvuX1FMaa$s%MV`3&~ct z_qzSS4{^BL_S1T6>2S%SPxQJPTfueMcHhO}BPZhU zN{q~J=+-qTad<|Ipc&7DYXEr*_3^bPkctHC+=UVWn<*-6hys`mq~b*GhT(@RtE|(4 zJDNXD-`0`2Yump}-+^7LOCIq9Q#og?!dKlcxVD>2x_xlCrOVqs)_6de@>xh>wW1B% zJ4&@jrn}-hSS*t<(V4eKW`482hj^}fFQ5G{9Nj0yVEsG_0VXH*&Yqskx_}w8xwLtY56Ch=>mjcJ0V7levJLbZ zp){DMMO)y-2z3AlbSRMk8WWTo`4VQ`@>+7`#@q!~g65)ldh<+&5AxJqqAi#4UcU7> zV?F{^_X)$zQG=o{E8Xr{l7qFeEy=vJ3R z++Rf>#L8+pl$x|q=3+_8_EL&`Ne|_PiMv+6cVFrd=WI0YH>rv}3a}lpLGCawlhMp~ zK_2eju=+)}vcsV`=3-Cd*<_>YNf$o)#{C2@3J1=+n`GyPUK~?HjH{ML(MMnAlCuU9O5o= z`ws{9;BVSB`BUwh`rm8UYX4rl_HS9&E?Eb0y8UmoYuW!%yGHS!YS)B*YS+mBAE;ex z|9_o!E$BqMR(){Ka{X8!h=pB^Sm%nbYaz{*<7bEKWruorPnx>BT4x_i1mxJ5Z8sv1 z)ZZ z6-q9Q0dBTaQL$H=rUc&ks4cPzDaf@XD4Fe|Qtzcc9)9gy*v=c^Z%S%cWUQ$mH2D0G z9<-Vum`fr|VAmkX&{G${^e-1caV9HDJkEYyQ)Q1KphKbe-MDzcgu{2(fk~avPuRh& zxHj9ZdHs-Yuqbizt@y(J{+w{bqVv6*Lup?JCfK34?}+lLD(UT13Y#Bj!js?^Z>^7a z(>q%`eTd~uEPs)B0z3FL6N8SvKMm-S6i{R}`!hO9;uO#zeT}?94n3{_*{JWOW>OYOY4Y$Mvlbt`<4nWj zmP!m3Wi=`eB|&a5^?8ahCG?-*0lT%*VzyK8fG`+Qfxbe|n~?`}X;hq|rwjk02n_}E z&4wI_J_Ksv4=GlW&QwM%{3T~6b{ia=?GEeQ1jXJ|CtQ34o0aS^QW3|@bE)jM1(~8S zbH$z2kn{Q3vtd)*;_e^$F;}DSMB^RG`*l~{lL&jd_Ldo>c?=GHoAN(@`)j7*bjzUU zg(gAl4V{gh$p8UQ=f;5-^iz(SH~D$X#y?_$>?i~!x(V?oKqpJX4y0zu@Mzh)Ud-v@ z?!46U%dgVYN`CzeU&dr)996#SL zHmJzyVp;e?Qn|abMW9%P?H27<@tu=DI;ODrX*WQ^uVj$?ilFbBtci0}YG}gIJrg}C zCdpi8m+jFl(jiJEw+z`CJm1c!3gv2_ZfAzYBf4N(^V#O{BUO_LX*WgMHPll#Gn>ZT zS;&G0t9-QUnd&A?7jfEe`o}1L*}AT`rUS%l6|1z&YsV27YEW+en*b3@!&0f-4PD=*?idPX* zfTxl+0-|3M#)X=TmwcH(&xqErhir9*l3BBqh;Vryi*ACQ=y*_W&#w1c}wjC z!km$iRWTPMe)!TsaVI7#Q)9mhyUC2ul?W7KmFfQ|Aqe> ziGo^8sC6CGC-=PgGU`lX6Z_gUW-{}@^A^rlm;6}dB7wOeK=X7WH=Pp*8QjbZ$U3iA2Yb!uVqdd_M; zt?b24bPe9O1|Qi}A{?J118#P*hRP4aOGw8DBiV0B^cWA$_oj*` zeo5+Qy7Rd1A{-|STai&fMRLLD+Mb)k9xvO#jaDr3M`Yt1tlNbKlO<0cWB4iuYLRC@ z$ik<%Hh<*;C+>BDxZ>ekp?=H7uxK)0w;rFq&DVq7xrQ{;c%3fSw6Hc>;sA9Q`vShu zd-h)(<%QYTCmiM6Yp;@7@mxaaF;_A0g<@62dA)fZuKD?If%}s*)Tp`CTN-LgaJWOu z%yb?H|2SMsRKGcA^P+p@PTn1lov@sHRVHCVgu+;*Ps$7Y&?}UIoe>ocxVuYhi_J4q z)rXp5f}@^FjZg*dW;rUTTd^jr`P z6*B+be)aaUL4e=N+gD4RdD})Y7uYCtMmt$n_KRE+4p$)yEzgMd)hB|QW^r!J_+u2e z_DPVf9+pFmK87dXzfwJ3c9!;BB<^thVoG@!?anBRcN@y8zV0J2QQK@{zLf!g)* z2Zl7EffJB0;8UffR7Y`x;VCEF;H}@d!KL51!I#9t4SmN)ZWXB%F)6>*bUB}@bfqsu zn-Ai4B2eqd^Th3)FOG_;>F~3Gx(Ql5L~8H}=~NaigZM`X7$u4$e0!#3`_(lRNBE&U z>_WE+xe3pUDA1-#sYW)m5%O|gSGD9kBr=3h0o&*ZJB%J&UZH{m(JydZLX|cLTRn<_ zq_l0RYdnX5zKe_$c&kyKMN5AR?tg(Zmk=b-GC&|aC46sa?I37K0-$tE%Y#J!+%HK5akTP&ChU(2v$NT($;dn;{Yp0HPtrN$4#dpVh z#V^M@Da!Hgx*hhf?nSlV-HYNs-HQ?>&ALa&@4oy%h<+^~mLz}UZuSR4v~giR7&ZRF zcusmwF+DU7pGXQ{ZLZi?W_xl=wQf_9sUWI(&9O-9$O&vhVCSeMwfj|{9-et_qh?H1 ze(hsYEm}%xdCb|>Trl_)A%^Bv2ikaH44U&8F#=o*2?q9vZl-eowfuqF3YmAv7k^@W z%C7hdKF}g(ayT7lp`VPilz)!1g1?Wmbm-ePPVDTr=5w^SF+tKijFU(p!`Gj`UTx?W zn^?K(jszH)hq<7qF!h7`c2v~BVF6ZvJUZ^(&z~xNYCLpo4~N-_np!n1lQ0bgzc!9e z5(`;Z^})(0=evr|OTkSvT|LsI-FDjoTRX}4s$y`H?3AVySCp2PR@85CZ}xwTdl3eZ z_?DZxY3`{k(ra9mmCa#A0(~5m`b_9I3%NE*wAN&9`VGz`z-R>=F(r@C*r@~C*Y_9 zh4bGZC;;j}!2@Xlk8z=>HXG13M%VypJg6{wka`Jd$3|QL`FKzoh&gD+gR&E&E*PP< zNFi~r{bj_j3kKJJ`+~u&*sTfdOkjKv9H75INzTG^X*Br!@s0Vi;*(^ zFy=+PgakX2HM#CZOOkEtF~!oK-3Km?pY>vf z?z1$`*i5oMdM>cf=Vp&?a4ZfESZJYmlH~Hwg3hX+`P{+-?h>L_{J}ve>$L-TO9>1m#x|+*1nfNS(paFNrMZ4D)Xo;{b23Q$fioQ6|Ka%trGemhAl`$M_8; zlnId&uoIz7h})+oL=Cd-z!SAOC8lj=nJWTV5kYB%cupjUJpxP13&HNU^yjZ_ZU2T@ zbp3%@oFCmP>vZWBMNt-oPbiE3Sq!efdg?wTIgP=S|Lqu@Ln-%9Ie4|q&m8>3Rhab` zIrvpn4h}ud!7o*GE9@Z(7Uz&2Lq~E-0jz+VpPCvN62PQTyKGcAo&|Q*pjTLJ|D2GQ z{E?6&j`td4rc=+v2}8tefs_Xolv4PldbnG13jf1z8?cakati+g?H?)O^67_vK>qx0 z4yP?}uW#^mA+odZ(k7<6F_v>|e)`c*k$*h1q_;hVJC=xQOT!|E#g=$($>wwz^*;+$ z1}a3Ty4E`2dq&MkR{bxI^zIYu9ueRwp_K;WEN}|Qg_3VOFmecS%)g!zywZRhE1dqE z^NHy0)2R}j2bE~+fJ|1nD9U9%%?fvgIF=Z)!9`Glbglnfkgoanf^<|D4vtSPb)rbu zB{{ksZsgn9KdOu+8mJb1kE_5ChEd&svzIIU$ zdKt*qQ`3NOJ?JBh+X~F{K=kG)LWkk@;VW!5M_Yz znc4!x>qA+=aVw<&*wcrSLq@OS>({S&?uo*=H@j5&($#OFpcZ;S1_v#WrfucKQ< zP&cD2@>pct*G}i5^{twPJnzcaDrn&@MA|!iZg&X6yLq)vUUnn#!&_C>Ilvw8D{bXj z*UuR1RRdDyv=pFZghmZ=1yn<*D3LF8*xeURqT*KeSB_LY29ncXc6*OM1l9H?r7HR^ z%hG`zDwJC4Jru13nPVo~=yur;5`*I23p^~fawUvcq82b$|MVTpv_N`-W%4Vux88E> zequ^%5>{G!G3EJ%d^ZsVOQxap>n~HdyI-<@eK7R0<#xW6Viv&?HEFFWQndRj?Yg-= zeQ?9o6E2fkm$|3%k&Sr}=(!G$5~cnG6J2K59QomM|I-yiSf|j}(f74P5U%FiNZhPf z8@=$i_qDF{KGun|B`8z8rf-Zh)sb;eGX|XFrl&wY<)Psa9V1rG(LF0Okag{{fK7o{ z@bxOr4gKNc-mKmpjIvk_y*sshB7U-|7D*UY=L*)?5rM%hz14fpqgS&sh0Il=@7)$Q z59ocp{-ES*!t}L$r`kV^Pw-Az5xDp-<5S2FUojpI zvqg9LKj`75?4D!O7MJl-`63%yYlW;+r0jMbycym2+ZCgc=wB34+b0UC5R^g+@rOd{ zSz-5yLTV0nqL8|s^FP00B>r*5Q2u_!AU(Nau(-79mHC@QDV{>6)~yE!MkZpf7{y+a z;vEU#if7qI@tmBEwN|xe{T`_%#ttessYS=qF(eBBM*m0~4 zvaGyqwRy15dV^b7Cm<+2k>T5 zGMa_o3VV@F+Q&9LEbDqs6C;a&vPi8ll@`+`B1^+Ar@X@GTPACk6OZg5GxZGb9y7@v9Hb)<|bzNVCc;0y#%? z;vf1Vbb+7xqR|t55npKLbbi7QeNn-wzKHfjU&NUziigq{nJS_5MLR$BMY=vi)N6+E zK^|cu;_q<|!5SGY<=LN&b3jZ^3q5OFo41$xWHJIk&}i7uP#~t|8Y=#Cx7Kr*8F=ow zV04@6Fa}0Q0lxQC6t^@kC^vqH5b9JK9437eP}8Addx6{p)}!r-kxnj`YQ`UY|DZfW zD5H3SZ3|ak*ROsgebv2q|Wr+KbkN_!)2>(<%R90!F^*h$d5xja&1*33Q zBg8x0iW9hIYa@FuJu&4{#+!v?e$e`!N{u`>W|-I^R$)$qv8JQlaMqydn2w(j2-i}< z!2B*5E)f&1+iZ5@-BTpfZ1M=OuBD=dpj@Z5R4i!GykOLniV|(|Eoel28G8b|DUF8I z9W2&T@uOW}2lOAP$Qe*0ey6;S+Y}qweo4ZY?NF@E`q(iF%QyN2%ks>se5PYDb zj(T3rbEjhkl>$&gKsyJ+K^7D(Eia}Hh&I2dyKFLJ9r@M&yOL#QO1t`0$rAbQhmxfL zrDR!_SiNv72&H669~l2=aFf@IJNicVSH!)@+6kPAqsOVLICo911Lo?}bBc4+qoN4r z<)p1_GX^j2tJ^IfD-y0@9>$E2Bl4@w9<1uoKYPXHZE)T5p^3|xKa?y8bzL5mlBJIm znJd)jY*v7w-<{VhnAx1)&zTEW=Mc0w<&o=zwmQb`0>DNeafuqUTU$+LC8_VxMPzWC zCPB&4mma;{jL|A|@LnH5C9}=C&EwD=SNAcYPs!qT4g=YmSM%ApXMPguG7Y*E%K|(5 zXGkQVV-9v|H91`+NQ!Y`uUfo}5e@mmlWU6e$wI)h4n$!=If)*!k0u1KsypAp<;fwd z3ISbMP-nF zxQJ@iCc4-BcTvZkDT1MO)vuZ-4fkZVn%Wt;rxHGvaqmH37=rfPX_@_xF8e1IP=*7g zwMy#mDw7kgG{7feZNbM+?rzf}!fi3bt<-3K7kzK!E7on~O}dZ0Q$_>|)Zz~*{nPrD zd1kJa1r^smFKESLCEm^;K6*Yk^frwq!jIDGb7-kwYAUvch0+b?YX=gEu488hQ;TZ6 zmQ=rZ8oFWteI*KVjc0`~M_X{kUl&UiqzOJxn-98v-bIBLXZu0kff}d#dDGx6`kqp6 zzl{ow4{dOlSTlt&zKVTu=8X<>Y0RhWZ^`!S^)NePjqAJ|yIysAsX)^>?Uo`60lo?y z6|>gln#Elloai#&s-zg}FfmJ=Fu|!$V$U)~-Kfu{%Uy=2dM}|iIM-F^=+P|sfwc-9 zH8Mw-taXoXVw_YvK3wOZGKA>CTIG&GkLeezJYW%dH{hOrl}$;%*~$6cS3AY8{aIL*nX}-xCuoz2UQWqQ?iG)CMH`IZjIAdsyev z|Drjf^ILO-qxffYgxr7hE&K1ykvpO}Z70 zYjq^&v^w&=Il|Dd_b<&6<#y648!od{2BPpfP4Ko30TtzOX^ythRPHMC)Gkq;-h8# z5pSud_abFT`8dW1>osDxH9mY)LJ;LNG77X+Cz*yIb(KF>7m%*r%FLb~9s!{$a2-e; zm{)=K3y0_yQ5x`HDBN4no;obJ(G(ALqwLYo!fs&LqYWe-2s^o}Wew ztCX!3hP;P1GV7~1AF>RJ@~XlUIdwwc9lxuSRKy0kpk);P6haAf$KbrQG4jq@t7#Ht zG|yR=Rta#JW&bbU-YP1}#t+*S5RjJc8M<3Q5u{5}8lF&-wsBith{q4hjGH1gHYt4F|`*+{hwHITE!|{TeZl4(Vyab|=KHPx&Q@`-c3og&@ z;cDr&JP4F~QA&A2fyj0gQ{io8uHi$Pk8d@H(+!PN4*wmeY%4UDZx>zTozcGjE{qA( z(Sc~5AcOMB!`e?60r6#!1AHlz;O_vmE`xl5_t&J@gauzarS+(GVn3Rukb%{WHSIdZ zbZo-;l*WOl3?MRC4{@OR8VXNbS^;surv-GDLW@K7#G-)qDhLa3(I6oM*cd^Qz{Dzu zoYnn8WBkd_=1rxeeZg-%@>I3UxEts_BPJ9WA-R2f;q*Idcfrp*6S=x?_!e!suK@P9 zB!Ylo2O&K2{O%q};sD@{G6CbiLmbNgGsNkYv@`K+uAt`I2r;<~Cz4SFEHp`E zVX^@7_xJ*^px@~ZF%qBqry*@-3%9_u>i+=i9aw=pG{V=|$T+b0G}mZeWw(=8f>2w$ zj!G_|-$m&6|7R40|9^>sfKmi9d;vx)Ydu{rg`fLr#P;&gL}*^)S0Xg_KZ%f^95fL+ zhE`g})*dP?()-X#OF~CAJrLSU$N)htIg1C6A~;!*-Ls|_m|}f(bIJ?OJv3;^P_PSg zMHG7^`!sV7+*^Hlfuoc-)S0twJ;R*((q>cJ)-6!aZnpJ(KkNZP4g0u3ZJCCB!)*AbrN5%fiqk8`2QN<5=RPQA;kJ^nL)6sbNxJ2KH zeaNHm%>jnq=)Uch=QD40*IJaJ%k&wQ@@eQY{b;b^_;#M#NlY&(bfT~)gr#bNH}zo2 z=QWA$S_IpNYK`E4aQ;Vq?Zovg1#8+gqj@jvbZ7{hd|_DLmOgI|f5SWuE&znwz}O7D z1V0d6iFD@GkiTz!M8!Qk3E2AxiJxRwDNlV{g3xE)T7=MduGi}B3>}oaflGmCLlWGY zEhMsS7$Dl11QW2C0TaWq3d93io?s7#-!J!LiGN=1=Vs9su2YsQe!twOr2q4B-wG6> zlF?ENt%ZF~)i+=R+f7hYmV>^)I`&_8P<*NWH>2^>ME;)7#A-Z6*?D4GS65md<@ zn&8yzMj{34GPuS~-V-`{4s)OE$^)n;ph-koLevxfbTwf61SAX$yab^@CkB}FU_K)3 z*LoLetC3gcj>Vs6w><(+`8x}N##fMQH((x}i~)|ZehOfFg+~mO&VvTfeJX#bM_F1p-{a(r9RV72H_m=p9<$&-yQ z61i;c`wM&gFx-apEpOHRGu)cQB3s9AL3^=NEo`XMxVq(k3wIkhzZ&O$bs`I-*s+0CItpQtpJYuAYB#ELs`gcK_ zKrJ_IyJj0tr=3;RR7B4Sn)oSJ|3(63k8&$$d|gTtsOn_UWxJ z?&#Tv|e z0)d?X8$XB+aGh6H4w2seC@ClABQG8k11OWo>%jezHen1 z1BGuw4N=c}T@d?+8Iy%FkEZCeim`J~Z$OWONS9C=(b#0V@37lSK*C>$e3oY|0R|56E_{4}@3(2}NF?2xD0=@_kvH}JHXp8umsMA-J z{EuLyBSqd66$1xZ#4`A?uT2U~TPr*qtqKeQwyiVgP`&+rX*hs2o`4!?^dOXj2?9_& z3136Ae9RnTJh<^Agc@s4LN*v+ND3DZ;aask!o33k!;&;Xg&1D@M1s&by=|Y!3l_p( zqrgH+217!4RhmCyHS(p<@283e~rFXojg6qlV1DC}nB5zsgf(S-z%*`2)jw3vM4XdZdNQFTo7CI{y* zRPHZ2*OzjEX-DX>xEPRY0yALfzEOf&NkL~N^-En2T@ye+6WAFBDtZEIz{~+}o54P8 z#q}A2eh#V04ct)Ar&T3+u+kC+bapPm2%Vja#QrrqpOz~iSTwqn(=-62q(B^m+eu0| zDV01pLBYb5C0BjX=L)+SxYsOwHvl;aR2K!XRb6T@s5=J#?AATJ?{vNHerr<7hpxVpD`~w=gIA$pV+@6v8 z;Wx;e?&+AObf?8);sIUIpxn(^tiZS zYL!mW5&jh-{Gm^&z&5a+nk?V}2GIdC?O@8sNJ^);zyUcK z8*l>#;bU4TyvX|2GFoqKwmKJ$S6fmElpT`dz@|er(AY$Hz#B3U5-idhppQ)?1SFF| zk=hLW01P>Z6c!Qy%p;NF!@4s9#quB!=4$2LBVyM^&$t_%k=~5HWoVB`9z+P#bb_$~ z2W2uWd>v`K3FGIp=N$ERJW@p~eV(DIB$JRqfc*^!ir7izh9P(kG$VuYLH>?h>bEqX ze1@&I$`aZ6RN?165Xr&}q8a1>8~1J?>J5mB86N|eaSClI5%w{1nKePxL@cfWnA$0z zz%((`Q?%iG@#~(Y^UNX}xVP9@C-lJb8_;uz2gb~2fe=(wUZXp-r}inWYld_u8mrt@ zJ?ut$!gC>TNf%AOoQ*2uO_`U?JhkQNDnol1Ml;FW2cGW^8Fc=S}#6o;n zH(&5|6QD1*XMjNhxDfiwkC6x#h7dcIvrn=5?$@q0ZrIn~eHBgH z{dLp-BoAG^|L3Ov%9&rM>D(M{lk}i#7j@U+6aR0`-|>&2tA8&2)-Qfv`cbNWYyRe4 zwy+(kBj&Z6Ac)cX-l@6dHc-u9=UljlX-{*F`PyK8u(OO*|tbbZL-Ie6vw0BZpkR^e58W6eg`Y`gbLG^1Lv_fI3 z+GmI@2WVn*a?uC5a02JKU2a|q;6;+@v#)g4<8+}MrB@@meJePJN zP;94S+~ujX<0u?rKmP?^H8dn&u*%;#`QLO@;qEHwradQ;!w4szC9%ww&oao&>Lt(=nIwDe-X+K{%O zoK!3-T4f!+i=6#g=nE>@Pf@33_t%>Ug6OQZ(FQ%}g{sUF9eWs5EOTMvS(?D7COkS| z@--MA=|b$6%4VGhV_fGujkh|eDCszy_NM}q%^)zQ_G+1x)NzxZ4xly8_$K6 z8|zluLb}F`=|?`Gv4&DkYxBgLoL7996qP0-{NF5Uh@M%9-lMAp5pPlxpny%${2TDG z3rCY%hN$}$czZdo$_fGPdASMttZg;tgQvV zHw}sksfIeVEtlh03=m!1?o?~F9`k3%#eD+%1LqP-3%K4^b~>drto1*1Y((2bP*`l; z6BgR~ri|%9FRvcGN7=5=+j_2%B;FNy{AW|*+;r&RXCA4oDn{6f_Y#b-qtijj1Gg@k zHd8qDoGlOIgtIZT6en)<85|+Q5rB$BMo8#J-Ll)OjA_woOKxsj$1$5{(|=BGbekUn zG)F;|IP?ZAVd^ACoaA%Go&5S*!&JquM@#yfONfRovzVgJ$-0%TGKzJUlyb9qV~Iv_ zYKWA&5=)3j3AavyDOKDkp9aXg0NW9!@zYd7Qb?<`Rr`MnjTP=A`{9j za4x{jcor&HGg=^R{eq_ZVoNzJrWOC4x$de+0yq4%+C7U;pwk!)vlKSkJ`FP_*go>v z#LE+kW7q{bAi;u69F8W71?Xv^=A|Iy{?)v2fi^F=^cE#VJ&87v)ZnUc%n9elewnx; z0Rc-gGDs5D{KZqOp=?m6Sqb@9E$IV~!&gBV&T7PBSP@)5&lwL-8F}VXcoeYn5bryW z;@4gu1|H{Qp2zQGCuq%KuQK99D7&-{#~d(lz12H7OP?BTPe(?aWr~n;^y^`akgOeLo`8lM%LZlxTh>-TB!dtv2a6l_SrPtb3{aO;{i z0|CgH_zliaW$=QWy60@I1K3a2YHIIhBW^!2Nnwn{R~u=S|Noz}@Gb#|gMSl_$N zr`9j5m3gapa0h32`v)-ud9YI~$q2;O^*}3V4*v?H0i_kZ(S4v53^XBH425A+j+Wll zHapOO<}k}1xP2`+?*ryJZCBRYkIw@l(3{&cj4pY7F1^>Xc}GJ5bW;$WL^pSGbNANS zWlg*PKC4!@*dVd(n%n4)E?tFLP6-yed9@R!FZa)OZZh*Xx7D&OtIKYG%7vaPUxm7% z86fD3kbBKP7D|h_0PbeNqy%*xsX_Ig!7js)l8u(O50Ov3+U=-%ty%$vXmVUE>a1z1 zLbDhNDx2_`AX{tcj%i>RjSO2L!9a#a>R|y=bz=G9s!X*yB^9jzlm4rk;+|QXv>PT0 z(vvitXWVZ$or9R8%Kut`#HmJzTeg!X#sEcgU}8Yr41_^uD36%4U1`rlX&aZx^z$!aHv2^_;`QF*&JYxA;$$G%<-Ui=o367pxO+C32_gu#&;9L zBDni}Ch5V|Fs`%*jhkG-OI_0QsV%q67_GLol4PQ@DK7_&1RTT?4@KPJ$JBMIhXqg{ zXS{?pYbWn}t+*3-p>^hCefDhj<8exB!4p-nG6o+N%%Why!YA3;v)>>IwLZC@?y=i% zIo(yoRJr90KeM?LuL{kRl&NxSv3-t{$48r`b0J;Pa{Aoes-~d6s}ou)%Q2*XBC9GI z1h*0&qg#OmGlfu+Ywrifs`plkbl3t)b$3Ne!$fyg&=r0@IKcG(IKVF2E#tWXu`>{r zPEUD~D#W$yuu>TKm4MZqm^40hxi{qaCgA)#0n7fKfYq(6O?2n^a6P@CfThUZUs$z0 zRUYR=vaDOixOGj%n!krW1WI%IMbP@MdpCiTisZh03W*2O7QjSgZD$#Q&@T{BrZRoR zz9O9voAf$xKf1GgJ|{NUiXi|4s9S)@7$=IqYW$IVL6mrQYxTC$`^q>!`V;7hyL7AD|uz#gvTF`VX@_*AY*}u}U=8P#O zvs%o|kxv}}OcDttuwPGvfKtrxEP{AI5(P>69FR-`v67?r$L+Mz$Q-XX3+OlMz1eZh zx)B;|a?r4h&YXv%ZYr7u_yzF@o*a=I_hEg|uLTHuNkCKwR&#@m{~rn3*jGV+AiWeH zPv{{<3)XLDO*~(45Y8bOTtw?C2|nx2M_7!=*5;p=k3T01wGE|Dwszy#qrGQF;S*GW zS^+U+{Rx#m+VX2FcK`~>AOe8;JBW-a+jXw>16C}3(4}_x96Fm>yG?m!tI@kiF|H@P zL|$sSA9N7!BUGnfB`}6I0*4}GLTUn=SF{){p=URDrf>%A?=Cs!UW!xSf(M2k=bFN; zszh@~q>GoaOpjw(RYoenJR|ymR;hENo;C&s{=ky65_~B2+ki~Mx;zR4bE}k zQTHPOlentjY0FLi{-#6_<+o#56VC-^`|l<%6YY(lJVMY+>7C`MFQuB?!lmH*FuN)3 zl|PxGg5X1D_!bwBOF0(L(7TSq=WW@{S|6Uh(GeqhNtz#OW^ZS!bL5c6{Q|q%BBBBP(#Aiqi>*4Nw z3-$7_j$NvGWswAW99M#olA@=5;yoeAj?GpiCrrOAWuJC(-jLwP4~PfSxl1={!T0Jh z!#NzdzkPR?4#)PI(&fUps!=Fbl81#k=?u%{iMW!{9>ive6#SJ!MrqMCrqfq3E9|GD zZxo}cP`|oh8w!oRcc3*bNQ9aq1*yLG*+>`fGi}tS=W?H}-yqWP+w3tiPrT+|i$q^0 z?to<2E=u0Ms zboRI^_o=VHIk}@1<3j6AxMYA)2K3Asz=)3noth*w;`76P-UUAKkyByU_$PvEcq;Ar zRq_35QGb+v7pww=N(hOdZ>{8G#2%09!&-j=s7i#yNQBOy^3U8N_pSgmKOqKq(#X-C zh!74!L}H#&0NyO5bZ9QjQ6F_;4VdA->0oLAciXs3ggu-DehY<(-p?$i_08%k(JRxa z#cN?$V5Z|5z)~<)K)5D89V>m$8PZj0$%vH_uY^g@KUs3XLzWC_WH^Hv>%o^E*e5)D zQA%c<1la0;aUr=l@Zn?lc&>i<6iK-W8*k@6P!=>~$}G!|*SFMwZT30U@DO7&YBYM$ zp@H(u%dV^>i`#;)U>h6aJ=l7fFGip5J4Zj?eYvI^$BBjp${mTni(Cv_a%1Jvi8*X8 zuyqR|4=h(LD9be>H}(5Hr1X~*O}5Zu%CZw8|8ZwN;cqJ%$2CV*$Ubt=%HzjMTa-*4 za8Em8>Y4S2J(`=8ZC@$%SXx)OYgomB|C=XQ_8*yu5dSMrPX0Sj{#f<9+=VS0%ITsI z9T1aK{vRhA0`i0U+1w*y@~ICDprVR7tGxK2RHm_q|MUAhax$dkgC*zAkLbBh!5>9u124Zopj!8g0+t*~Cqe6wzW*xJKK+Qp z-zel&Do%4jo+sBGr*k!tD`6@-Tz+>nwlqaGB9Ww1*c8ua`?U(=V2RM5|CKCbO%)aN ziE)Lq1s5l0QX~K1GA^4G5x($eio-`>#p+929$72quc`V1pWqBNyH;ksoOBe|H%%#(9ftISXM zsj&BE>kC!z3&Bdhg}s=V^{b6H$<1Gm+9}^mR2=z~R}jO}9GMJFpnSjb2aLZWiAvFBa5o9_taU~ZDh~9CC+?7 z-RuV~+`WYs?nn!M74BMkZ+aaSyI@LtpHCCH4X!vw$wRjIZ$AgAZLv=mn=gl&cNm3C z;J*+*Z1AHMG?NaN$an21J%3F1{5qhX<+=Joa^^<%X@;aS4w3DcNor$+IfiBNq?7*I z`S^~j9}=O&=LHy-C3p?{&rN%Ii2QgCNJ>d*IX*_82|RCb@8wHsAjJ-6<%-^=2-7^M zoXWH5$y}=|2SFqL?T9>sU#X9x^n(pbP@Jb!w0OV8_&Vpnr6Sw-yqn7OQ;K9Vs`6I^ z79eDJkjP)EwG)8{)mmC#*^tF4WO(*+a1BsPx_|%B86>n5&i;iuiu#2*+7A9N>gfJD zT%J>G$T#?ATTP<(Kd7TzH-(>952&NhdBm>nX?UhUGY_s<=mDQ+(_zYJ?P8b<1Cler&6`VSlfhuQC(!UXCvl`~ToJbq^6BhIR-qes>6u zA3B8J!>dIPGP$vSZZ4YTJ1dIGP(gM@N^D`!HpP$vGF}~U492Y(IG?-q9p{YtBNM4K z)8BPQ~1pU+UZj8u<|#DhZwOZGO51hYXO&tAaW?;9w4%TRluw4E{;Gk8Ii*R6JK zY9;N-3rhl065sTm@>w4q*S>_ajf)HD+37;udOZexl2$^*P>wCc0=I7AyNVnZfkpWF zGfsKxx)wCt)1&vh5F2QexV@S>o!6){JzT~up)J2mD#9mKG9BTY^dAos-!vP&36*$g za${R9eAfF{3lZ|GhG;_X`gaXc>wjv9s}D6q#c@NHq2yvNw3{iuyz4|s`QU2Wd=!d; zwoGbD^ncojlRe?3j2pgVeh_Q?6~b`#Voc-mgWi)Y{SZdEP5kGctGDjIxqFT&T zV^L@|hAk*cr|>gbv+t(guZo>K$DqwllwP2G+sv7+=2tUo$W*W~_A|)!2-=6ax=M?S zgdq-Av5tX!94ilz{P6?Pour0ajE>;B^g+OQ_d==I&(M*(6pryBK!}2j0oW-7u>nhk zc+^i3MPdRO>-qNaQ-(2UxywiZq*ziifXG0C`VMk~!$utl(GIbUT$Pg--qQJTtsh6!t7S-b=*!pIkR9{_( z8pUqXSvZ78z?qGyn(vqmEIq+oE_x{;rAfUe0^f$QR{Gcs{fmE9a*};KKIB4&T&8&5@PR3#LEX_E&Jz)?hzVu!EM4>IXK+ zcqW__HQFUjuf%h_&)9=fmTwfUxE6&58Mi&tFPr&)9fWo;jFi&;IS6s%7A}YrrrDO* zX#Bveq1e;29CNYZl4(CVT&$PkfV=%*zIL&GDtd#+i>X^R?YehskmBYWrZp=!sJCtj)NjHxcON1>k+0grcb7m z5tJ{yQvz{vQV|Tz_F%^q>4(1NuO-(10Wj+Tw|+k#0L&QkvB@kY_K5~haD-mGu@#H1 zq?vO*6)+a9z+KA=59U%y(ANohWDd3Fnm9`-uY3j|UrC7wPK@i|Y;AfQghTX9)Jz$x zzR8vc4Npls0#Cg`MLg2${g& z#3k?8lg_sM@;^V$k#0DJF^P`{YU9BqREesNN+Zd8SSAimoo=^NuAhD(yuSPw;dK!Y zRsgQOK`4N70+;|3(m9G2)UKCU^hna5x&un^0$6=Oc=Bx8q(e5tnDMj&Cvz&cYX0gt zHbOnEo8j1lZ2L)}ks>j)J5T47uru6s>tb+8hp_0(8N**EE8BeUR2PqNF}!{p*A}GT zKa$*8S%8L}E)Q^jBLxBFJ|GT=sh7&DG%>a;r+jYGm6$-8h2pvKBDw0Zp6ZuVsk~~K*YElpV+z`ck4PuP8+0R>QE&?_ekGfP5*g={Y$OHv)f)bCb4c=@|xu&(+ ztG~>6mJ%-)6xN;l(hkvZ7iKGd21+7}4adBA5E{c8P9 zTU#8yckEhXTOJcwk?|Lzww-!(u z_p!g(W}!HPLDje`zs0Mxs?@=^g8?>?(?CQ89v;vk0R82tf`5kvdP(hl%bjn*zd8j2 z-8#CicMglcsMl zp%kl@dP#5N^dz>#I<}TBXsT)FJpkW2b0IfY-OFg`wGrjv+NcMK;^f0QBz(9whW)uV z!a6DfshD5_h#6P5LcFJeg1f7F+hn$QTE^GsPb}hjk2!Tnd{v;&^lpZ6()TV)PEB;P zE(42c+(h--KNB1D&>d<|S1WOw@(Z(?64lq)zRb?{Q!tqYn}49eXVWUPF34kHC{84O zTJ@1Emfx5bj|bL@JmWgt00LC&f@QQoh^l=z$)@WTWY` zD92TO8dNZ%lC}|DskEmItoegLMx(6eqaB3bs)%utXEPZX>!n);I$Aes7ct(01L#?^ zY<;UG)u4+kR`19%HM~p*ANR!ss~${zo*5Fc+@ky*%)s@#FZSO9S9Y7Z!;eU^+cr#W zzljXMpdIDAGIV)}ulMYsLm+V#)VKhfE*S<8E<{R+*(b?VPI|iYB=iN%NQRe_mJxuK z2F52JzOq^Kz>UY@X<;D!a_u6yL}Ys*VF#u!8xTEUWBWm{1F#3;abnfcaaK=Kj8S_( zXpc)=3TolPeTArUJku0Y0{0R5jIsEHwbC$yJ*_PKo&c;OU}m@v7P7$PFfJt=zUKunl#GvqR_)v#;nct@v9d|) zxeb6vaG4-@75deKG>w}spyZtCSDLiP#Z^C~Og4Kfns{KbwHNo?otg50*Cb;eJwx0Fx`SvnD3d;D^nAFe09zH^d`4RXRn#wP1s2xdQ5Z{0H#N9 z8J=l0XAwomT(@29(sAB^xD#R9T+)kUZoay$P@PY|fM8BFdk0W4C}Ayg^`F(ug@3lA z+y%U%$VgdViE4}6ux1B?LK366W2*4eH?gK)W_i!C^pBjW`i>{s+mJEKA7MK_a;(Ed zV15U@!2{#4936xV;1l@q1*%7=H@h!{YI?N{&Pw+7KC3BfeJ+Vr-s#6jeQ+Qo?Bt+1 zBXS4uWJ1sH(sg*e*f?~LS!B+LAL(CzIrTOl9CcMm04)6ov|w6*JymjA*ydpXvPb|z zZ7(|!M1I#;viYS5A9y+frpKkQcK7Cr-bbE@7L++VSu|DCU}>!eAkWBf^^L@>5U=Fk zEHydTw~Ewvb4q0Qw~1}R`JbOe-CkU() zWvlf{!@}A>*bZfDcJNI_#SNJ!zM6@4^4zJeI87%{^FcKEP&ffCI6QLVT@*?FFK?!3q!S|0etP%e2V!rb ze@p769Lfv>PT}xa5Oh<^6JuwA$Wbs8AYVs~51HqhG7?kX4*cQ4mHA_)BV`Q}CMuU; z8#|voe?KU%s`UqPDnBWac6nT8uh&krC$(ZK1MXo^`88|1o0<6|)7SDp7kdPp5gEu2 z;VkZ7DtbmoskI)MEx_P(Vlf`U3m)DFmUZF@VnmQi)bY?8*&5TS`byGen zpCZmvz17QsdrLxQK*yL26_nXXn_C=A6bS!T7DxCkf}DXkLZ;bGK8&O;(c4$d0Dlt+ zDRBP-jDS`fl8DXG%&S2V75A|fa38`aB+(2vi0Kd*Yu_Nt%fG6=CQ;s`?8~Hmi`k#i zM*>*ol5zkC@MNGT_}U0!y6L+3fXxmG74a4QWgTQ}Q3=)Ga?97~dLf1IEH( z6$-(mW&|=<2#68XAJ7anKn4OC5zwIz!hxij|J}YH`qN@{c^3|vCqIoj>@O0a9P4uUtpY;D)(dYeL z(btyDuK7PI`Zi?=`RC4dD9e~Cwbkj|QHOm#0%&MYZc>`21A$0sFg8T@ooGY+w^Z%} z^BhlI)q-VXsTMWYl1cIBlvf_n#|uf-e$vvHmU{6P;NbbX(Fu*CTU(J^h3Af!7*^zFutrwW8sP>K|tJI)s&+DmxM~P7O_rm%Nf?HrQ68gW` z7vd2RmoIE8pJx2^A>h??L|*{G7T%Q-bBS_ExmnZP{te2k*QPG)@2lashk`P}vL0%W zt9x9U5*s%Z-I_3wSXpX24~;w#pP3}(IB#sgwK5lNXBI3NS`pz&4E(|QFF)Y?3&b2X zaE%^mZnzVaxuHd9te_@idsvqmFSMrf4~-rKH!G^k4I1Ws`z+wVdNbM?o*#Ak!;VW& z70#GT&+{?d+R<+8O*NyESP@M3$GnWy-uGF}Tnhm)r=MBM1KC4F0sz>Gh5$d+`eDGs zoQxDtwt@S)-dwaItXy*5mqe-RW3_9Ld;;KwL`Ef6ewQR3`(Z0)E}9k1>HtBDzTFLK zv|Ik{>*vukE%nwt>=Puo*bc`LH-``5`oX_aIh9FWMEUqsL%BA%N?C6;yL&AVFpCBe zqnftxSgVkvw_r!%B>|tJLAdy{G;X0%U;e^RJcFH+D`ctr84ol@g9ylzD(Pf78iB|s1ZqJS9&cw<21kXO@R{C-GwgSyqp z%wD(}hMG*er>mChtR1pz|M2n#V_uqN(`uppP|P#3SHspXHf<2K+o^z+c^YNe5Dw!p z8szR|-Auo-Pz{GN+M+UFmscob8RfhzA}JW{`t)<1Kfwp)w)3uYD*i=nE1cJS<9-XJ zofD-i_D*Y}vgx23Y{>Ut)`Nl1;ske|iVch6L4IL^#q3Evh zo0|r`X^Z;6reN4znbsitj1vwmq-XfDGwfwf+6G~h5~qFu#9r;gU(AS%fqye23W%BH zO0dm_)X@Wj{dBYw&G>HVt?b$+_n5tT8fv})-8-h&Ljs4*+gux1{jr(kW?9Drm6`cY zy}thJCYO(-()sf;8F95f=OIqI=UnQ57y@;6mW0?esOCwXy6Z^44kaxtU44KEoQagv zy^=H-ADD4Cg5lx1w2ajbM;EOB()GymiR~pmDF{#GcpZjZ~@GJg&YvK zy8mPiF)?~i<{5%2>_r$eTids_vOvRSYpvRd4Thzay-jAlt@ z-d}+VXVw>xiJM#Alj6U!=}g#{Rls{JGd-vJs@J?)y0a&48pOJn2rzCI=UOp z*45t(O)=p|$loLBYG8oKbb4HYm{9ZRqFkslt&zu?_G=w8n#HwNbbqNq+F2-rv<2`3 z7jM~_$}pTgfllnUEMjb=qJOjF?UbV{cb<4Qf$nR7)rO3UK@n@~6|!-JpIt?ZxJ@#v z>oTFO<52TsGS@zgqH5!Sep+V-_hFPXO?f)D^H#oY;`%9cmxIsh;&yjd z!}qBBCx!P@Tc<5P;PwZu*;kB1TxA27De-%@r+!;cvXKJVXkUM!T>3DDQa?5L9)G|I zwva*{x9xXN0=AgqQ?UrkDm5O_kI)W=m|v4ms{HBR#4<{S{xm?k0H%V_e7AmkyV>@26j?j<0h6%~#bgMt z+(!41-7o&eWJE$S8T#eut5He1;4I{E!Nrg#fuEWoK=+uE#wbxwyhdv<*6ctVXDnsrB?{ppK&M*a0t$5{ErU5Xe%^qI7Vh@7LM3_$f$JPriLk8078 z01zfb#sl&B5u7zz!Tk%Tu~$%?%y1U`Z6Au$Soj;K;rI)uLGv%1#y-P|apCHj)$^Z) zN^2x?g!*nsaIfF$Wjpu9sx3>{(*y^DP-J|S&_kY_r+#>#Y+(JNY#6;5#cbPWVdhdX zrx0lplB>Hy_BXD`{wW?PC4vrYo|8}_!X-v~aVk^+2XHaE(c*w-MRf}$-g zd|GHy`x4v`lxw%BFYkQ6qS4sD-~|XK$zR-Ed4FUuU6(b_K3} zx8Ej+J%PLs!H&;Fi&2xE=JO$Ht2fn@t{fH@hwn4(;~H{3bo;YVBK~`#WW{izbQstg zq3~$)OdjS9A1yzygN-Ni*wo6JJWd__3g}58!NL^l@soxcWc6^floH@uO+!8dJ1Hb2 zunf}xaw-WC=~1H104t4j4DQ%hkEJ>#JGGd7M$)Vu_JSMkR%YN32aiMp&ZT=@z|nZ& zmD6|i7*1NPcWUY$rWHBYoag4Qp=5*4Q!YJfhM3bfO-EvE`w4!n_lbF%b<#7|~6UfHa zwFEi26NIqIdT%RWVMv8>`%9xqm88RS82~8hBoruhrIlK=m+=xWLj$1IZ4y!fZ8xWH z(gf$ewO^j--*^F$Q4k{4<7kWoKxGqG7-P5~EP*X`NiblEMVI!;5wMs*K+drO`D73y z;r5mp3C$w3_xicCkgF8w3F=E!@2z>wWwZQI38{Dt~yaT2;&j8F7d^{w>MVD`>)2O$mxt0OOmJmUy{BGf)M1qQXDMT07!n;D-Dl1nv1yU|iFRU^Agl0tp&JIR{wz_h%` z3gT~2{c?X;Fo~#4tINdGVluhh=o4>MZqkKPtk7r@wB%7uH`c^GrBGVCm!ydELRD9N z15+o^GSN8G!eKBhZ!ef5OyDLEo-dN9FABK)yK1gtBK?3Nu$<Z4tZ7=~ACG~WHgW7L=ujl^TbJadTkc12e zgGHHF>^-It;RFoBumF`6Af^W<S+g1!SW)e&ynk(PuNTu`$u9F#rUS zgj^3<#zLwVJnw~YEk|VQe-p?2@k^zlbmzAAUaJmAv{=2AHM5ZFPEa+?Ni5) z7hP=CF1l!c`2MTMNMvS6i@G1Mm)@l&kU>gD zL`qwYe_3Cp-a!mK`m2O^mRi$2)lZ>aFX_pMwzdHDcfq(=49AQ!uW=C@85T?}c3wr# zyyge)Ny$i==|MSLXf5;D>9afFt@>F#j}O6_(c=LW3JRv3Drqi9`~|Nn-z|JhSkSE4 z#sqAifyvS8=I^S;r@l+UHxrqz170p5DhRqWLnBhKQ3#ftSb5ACkraIj1}7|9PIJ|_ z&8OnC%0GP3jtJ=Z#rP-UUr7$%znRY-a_8s}E*-lU`>-yMq^o1)xrQgNoXfG|CwXkj z<#$JYz3y<`Fpis0n4dO^;(?_-H?RlX-<^}DnFgmL;$BXahR2lNdg=1QSr~BQRO+g^ z$ew4mpCUrh!1Bd^bA2Kw|1sC@9`hux8}!EGD@Cre3AwAUq_nrDo)MmfFu{{9b{y_8 zh7lV)^Chm&???KeDg9eelz;^l6tS-U78FrHK0(z);cbfI5sO{q1!tpfZp?FHO8V5( zv~V$@P$KYs+*bdWJaZ`J$NeA5PeE?n#lOV1Mv2#bqbTnUE#S;qq?OW+i@Tqr=35P2 z;6b>_%-9c8a9sthyw?=Ws1yKFtDr?OE2{R>oJ87a@S(E>E)euN+Zg1ZN40nlSHLO*634ygr7e!GrjOWazj{E8-tfCBWBxWc4^(#0l1fe?ipB5{FgKY{N3G!w?Ej0 zv{YOO(k_HxILhW)K5`2>?2{I~J}R0rPa6|^&GFPc!Jl+g33-_-!~J_YK?ErBGM{F; zS-!2FbqouNS(Eh!g|#{AI`I!Gp13+ZP41}jEa$9~68xC{rOz#F$vWjqoG$@-Z%6SX%|ZVY7}~#3+tv(G6)Q z%(>+?D$4lHXdd}rM)T7LNVB(jN0B(Ta*ju={VO0Nh7=c;272_2Atm7sS3qz2xIm>d zc9y8nZgoGLYB{YvyQY8UGEV7`EJ};+_FNff9NnJ|Q_bFGp7muGSk6+9M-&h&A^`&j z6l91ncYya1m;uSA@Pdwb>xStDuq7rSfWW<67BiK$Njd0ZkFxuVdSuencHH!Dm^1Bv zV9w2!3R^LwS6JL9&bLgLS=q573Ed0j?}&|Ra1!M*w>BB%H`K0+*?#ey$*)Vl?;~(L&pYTL~ED=s!X!gH^%j&WbH^L>yMP^M^55nb;r3|}&3zzGE3zy#j z_r)Om7fajaj*c&n-fP^zWQDEU9@m^3o$JAF&GW77Zqd}t94S9CH>troBrMe!-Q5cM zML05>sO2??SVF?LyVYZv~G%Jl-1#6{b&tdvp1%gtc6*jT^2Do2?jB zTf#W_A9kU6l-7UmLj4|gp|Q|i=sI*4Itbl`V*IrW?FQOPK-j3im!KQaB`9|iuvh}3 zlltXVF3M3%4^!&ra&DVWAgw*GJn z(idpV*rz~>Yf-?_(TE509 zhR96$h|IEA$=);BA!N^FgpBNQ9n^RI*7d!v>-TtEcm8+IJMMMTalGH}*X#N0{QeAJ zWwNlz)OO^4)U}R?H6wfV4ty&q?vDuOU%GKG#XcoIs4DWYqeipq3@%k_?n!~P3xG4k5G{>x&bQRp7e-h*=9eCC z?!5a!?=FkE?08G88}k|{5JLtqFD{uFVzfAToJMo@VXcrpBAn>zqb@H-nxUqc2d@{W zmZ(e4bJY$S3rmGk80MIiT}&KHX5v?SIai)FnM?GReboP{Uk@Eyyve926;lAa+GmEc zG*+4Is=FLq7ZX|3Kk3p&p3fMK3Va*PzV-o_ikN_*gWxr<%) zqn&&3ZaIF2D4IM>8p4sm&Jb&ls{E)kgV{= zK5o(`SvC_Uhe+<AB*)R@e z?r04Rd$O$InB)1JWvwAiQDf2l)D;JbDT2+@!Oxo5Tl-Am==KUpPwkf{IYhU_i_ql! z+Ht<2__j@neeZrq`pvy@mbraVAnq(pn2O8v=?{b0p9GSyqe|%m9u4{rZFX)W(`Xas zcXaPK5-F+ksjb!7)^|_Aq0(C=L7#xS6huiy)?e1ddhJ?~qQ+dy1iQ61r;UMsTU;pe z5co+!9GEf2!rep_I$#D=9zKnEEUSZ*c=2x`ST=+W%;L^USi5$b{a!8auur)OBcn2A zwTSP<+N{@7d%ux~vb*rc+}Hhvja{DR{m?YjmDBH@HW)S)ag$|x*-z>bflVpbGEgH@ z$Xy%y>B*zsD~&5EwrUl-ym(H%{u_o>t86wBL8yCiE@L$Z%vNsfljp3((Oaf2%{Owg)&$Lr5am8LNu(xLJ%Pk2gMm3OzIf zo$%WZlUt>wv2xeC$$Mv%d5ueqN3=C=Y8wcP(Ze9{DKs@g8Ww?IJsSOZs;i!@7OB{uc6)(`EV-QbSM5xRo|5FAEN2R8L7IPsz*u9=C= z4*=dGG=x+&c=cnfZI_du0}mdw)jtz70+EK>hQx|dJ9?Vc2Q z8vwfp3{+Tg6kxoUngP?^w|+4s{)=n}k}V{3#KBzW`(>i9FD4#P>;=kP4ikS|dwwD> zNuqaM{$tA82A1Pkf---8dh-;vm5Ow0e%zZ@Ei!+CqO6-IY5Y_SB=-jU@JaszRZR3R zR59s-j&B?@eKA6VB3D(FTnJk?2yBYJFC^O#tm~aO?E1t)tuWCd?-c*7jhA=tJMi15 zBS+eE^{k1Xzgp;7q&jomCIbk> zp~%49ZX^|^EodTC!6jm%>P$mxM2era1d`DE#^(KZZ`piVPl-pDf|DGS*i(7Mq_1jE z1e;GlA3xzGS48I38s|O6U*B}yQqiv*_SV{Xu$0W26ih9m?s{zQ}{5uPkIhnjA$)>-o4Wc+~I;Qi4L5#g5&E zPr8Stz(pRr{ANtbA`nGTaKN-W69fe{e>k&QAc4Em_{9AOOY=oV0ek=0WtSoB8R8Eq zPY>ptwS4p9Gk8k@aiR$nyS3+J9@qIk(!0IJ7LmlRj(;Qio9KzU4bug9n~|6dnSez> zdJe$(3W7kkDg9+IhDCu3_Zk>v;eXjf6huJU;JM=L7vLOb6?!H1{*zC5MBsD@3!QpH z+#IoCu1Tv)TJpoPbd$+g`vJa>kApuLt50!H`Cb?W?WPItE$k;@Vyofp7SWUBNB}*CpG^@+@1-Xccy=#m$Ae zN`dh`h}*Q;IJt#IlJ4=uRM3)TFKb_~=G&6=+0;s#{MMlKKGKX`YuSwA0I_x^EM^sf zJ~qwEnqy=dHhvkR;@%g9%FKA=o+Ad>_LW|X>u^qznQt0B*zEpv;^Wi!y4pz0_tV-k zlX!jLdmobhazLMR%{(0b`zyK?s(P8L11EP?&j417$1ctB?qJrTF8yPEQKr0^NSf*AG(1w=33 z2NTKmY-wSKR|yq(7~m@Ddx)I4T8wmkNctlh)bu08Xp3l@*aI+`54$d@YyGg>ypZ0l z5G|)xz!-D+#RY)+Mk@%exIt)qzA~bqD(PxopzcP;3?e@xsSzz8_cM|mR%JL!Q_)n80mw}-_dzx8-GFP9ldV)Yzn6eB?VsX9}&4O?lRh4KDlwGcDlrGA_iw%z}|G! z)$$rq+6$@j@GA}+vuh{6qUW>Jxx>2DvE7{Cj~%1)rhiB0O~L3qY8ag-=7}jJr8?;n z`YAqi?%gY7oLrOL*&O-x>W0Vn1R^Bt#(S0atFpD5+MoI4t>1VXVlThG%lg$7TT)+c zg18s=%zFB$cZ#D{&otlSMBteu37XYQhULA{`b;~nB}&6r_-e0hN!#!bS4Llpo7sDK zv_P|Umtn%|i)6xRHOIa^-H^jaFpWDhx&fz}exwcOf9}i-}_G8HtqK zhV$}9P1Yj_2A`c9_pbmTp$zdDYH1&`J{Wu+w9348al5^^Pj7oS^ZbT$xsq<|3kUN9 zch@SZn4MgF+sHK!VfU_-4G*TXhBxj6PPOixw&)PKy7I9L&-ePZemR}$=0PFO(3g6O z^2^4)Pu?$ttEQvaVoikw<>U8u$?q3f#t#2AX0HCvGv)yT$Hg)ZqPlPQT*1R7_%-Pr{T==(ik>o z9uc|bD}fK|EVI8oRuKPsm*JV+8Y@eCiOL4$^IQ6})fIMQ=?khqnBP1Uv#eXNk^{H2iKpDq6!#LS4Y)AoAG9wdvw@4sbt$r!(Lh+s_pP7 zQZZQ-P8xbIJ~OYp4+!^V{XwtlL@Y34;J^H2S<$Pee31RATQ)(pQDB}?^W0KfV2rfH z7F$%4kXn$!OSKS8Ns}2{`}BM~yHS$c>lW+c(*JB$@8b(9$|N0>Y^Vc4d7(t2Kg(C+ zlRdkqI~i?qjvX`@?OZmhh6+-trZtRX!#-(7@Gf5>+l_TBME zZcsQcNnE>c|B~{B&yS`bIpgl=(XHB!V2GjWmEWAyR4vDj4JgP_UO3wJNAR3+aI+)pt1ic(QA zs%8Ws_Vngby{!5wuf!SMorYC|ovu^&ZIrUc8Z}8SQt3qX@n&#wzhAlXf!0(|BWTA2 z%1XH%+Y?ZjzqoFz9&$yX>gioIfB|S)q=(QgvZar&nLl}wx1kBXSYSd%&l`a^u(ciK zd6E5QT1qQb;5%}2zYj*Q>EnHCQ_tN3@|y5{TWj~UshDM9hHk9&@rOpNHPBs$DMu0>%=NV9yHugVeAYl={N21whQ8f1 ze1@wVdy5Y4CqnDxuoxznKDqPmW^i=}Lz7(T?^p9f4ov9rdr7a5oiFs zY#1nu`U2ph1uZxoyT&77q!(Sk<1f309p%K9tImjy-36U*$cQnkNcE~$y2`#s zTi?`gwh34pWhxe|ZwiuV0?;8bF97UGvJn?ry;OVtPeT!{1NR2XuVIz2*zZQxGdH>FWiUk z$QxX_R@TXMV_w!MvXY77B6uS|(+CSW^l!mJ4l*{7&`iMw7IYvs@<#NSfdcmLU?P?v2zdw5V2IYdyDAQI$v7L`a2?q1=@dw*3ZK9*FRrfm z)K%b_1e+>PI1fcSN^Lvnk0UY#8(+Iy3bsXa2CvN}Q%lZpM$WvYl9kobra!&W&q0OQkN&HK7*(8Yr!Jp{|wP({NN&TQ#C%P9C zuoB%=z3hnth@Ruzxtn$IghS~Ps>i3MoX_#jk_A!iTT!6 z<+&8~mfcFVq#^gs&PR)@n^sG`>y($`9WJiz+9zF??CE;V^=^4<XreT9+96`=AvB{A3D;@UgFdj-PC?0IHeJ|>n!q3jtp zNbr8`tviz^Z&A?VCX>OGR}?)xv-t$OOnayg$wM;KSuc{OLhO={3UHHkXwI34H~O7! zyji7sW*TUq=owDKE&3+*u#EzPv($Z*&w($Bo*cHt&Cem(f&Bp*A2;WWoVh^{p#MNg z3$&A9N^=kaH96ucNFbn=LfAzm!yAK2;ZJ)d?MW$XZ_DT#%oBZX;${*9$0-ywVi@qo zQhJ}XJ9*j_k3YPx7C zfb1|iAWRL zSFO5s*QfJMlRJ*UkXdIC%HWk-=h?1`~E9h8m^g9H@knLWes1$N|!IN(gh>*12*J(K0i{rI2bIp zS}^%=n*B-X0tNupO)tGG%xv`0nve+<+Lto*lO4g6rM1PBpoJGo7EZBWTCLyh-4VI^ zT?a$_MCIKecUJpqvR#xE&7k@pvfSz4Wx0IWajtGdj8Eb%Z@q4Q5+nYa`?(H5p);@0 zM|2L)qK;5%;=?xCmY95L=`a?2Qi57-@(%+)NTcH7boCq*tBnH|K6RYSEG!EeSFFTy zJfM`wp|&4+o>#uAQ@@WnLA|7kUo>{{pO~}`Fq8JnFDC8Y;Wux6r(ya0CCr7e&=R_H zMboZ~h3No_FTQIG0B}TPnXJ;!D zx4Jx#8O@`rCF}kekjeg{bgE~Mnp(+`g7Z>UH0_1qMPDQJSr-im;BS6V&{ zGP>{Cov}&;@kSi~B+)hx3!DIW&3x+zud6ZNi)O}~ETW3Pg8+t)K>(t!b8kIUtoOI@ z_CFb3aPoUzDS?kbr*cmN%Yb>0aLQ{24IPe~59m@nLd!#vL zVCIZp@4z`#gIevXBRCf}%K|Nq=1w7ht1 z5>hJoPbQ(vKTJZWj#NT06~JT;=XaIRFATu3N~ksTca>0qHg^Ui>(k#Pi^0mA;4a7?x6D0vgIq2vn1`Tlh)0-QMM&4yMNO*RM_-a+t5i1hyfw~e`_1! zNc({YOm0Ic%)gck+5J^6^hXOHb_-b_t{6Q1Z@GoA(4Bw*gQjxm4gLp{(BBgYx&6P0 zgh>BMBm_nqA^KClbV2$5Z@M6Qto%~&Rs((Emo^CVn>Hvv_UVi>IGv-zN&LLj(MgZn=yG$Z$1avKvczKG(Y zPRiA0GplK86MQDO+QNy0GbV0h>He5MDZ3j)v!Gc42Rl6_rrC$et4a8e6Zgo^6SsfD z-d4ZSsJIl)_X>h>_l4TEmHA3Nnk&n`eD=33^X{)(IkXD3o{COW{Z!q>ZgU!5mYlum zSa0Gxs=IsXM*72pt4l-vD;-)1Z@Apom*)4yqP<`)E3x}k!!v?A>+_RW7n`azP{=?SZZ&c$_{x;bSZ#e^Eliio45H;vU% ziCxotno}Z`_(&rYq$3R^Z0Q(eq{4Kgp?4~)*4L1XwQ(1=9y+kk--~%5O1D)i$}@@` zoF65z;%;9437I6TRl9jrSDgBFPF&dV%^Lx0h9kIZKHK9UOcJ_5UQ4z_N68VU5tY+4 zd^kJ_rQUDV1Ba3@B>D*mk%IUUDxgXVhD5uq`+bJb!fGBIQrh5@G{k@|{~YhOX?l7l z6K4^%(vpz#gWYhzrO%siH}bW4(qq7=N6U(j6ZR=w-el)FP}ifSWF}pV(C6Lz8aVbN z`Oa5&;=>P?mZf#VuC=uDcNSW$xIDD<6g)w&9xa{xzpr1jC-yJeAC&#A_BB}6qh*77 z*>;%kw#0EtKUsY~$!4cwDSGCrx0&df5%TY{A8%m5VJQtIq6fHKf)o(|R9}K75bhvJ z1`0xO1MbW4@XZCTUWRehHlTB#t`uDVijD+fJZMh*LWu^o>(LFHfPNPJ4WS1ns%Q>L z`@Ioq!W$| zTUbIR_@o3~p-27RZtU6mt=)KBZaiYSdwB%`@v9J>C=)eBz12)-2TQl-sU7j!(tsUK z@>Wx!PbbiEE6{O^QSkQ`<6F4JNCdYSD-W!I(Gr>-W2c`H8q2Y7IG1vZW+ZslXz=9- z@s=&}p{O>E^v72_u!Nu}sX1Y=o{U$%J)|@o>_Q*K8cyTvKsYIj(U^9;uES5fm41G61<+PSJ!HYT zy#B20EM|&QBBZwrTV`)B1rfoUJOAj`dfLmn7RS00p4w?n<9pX?3_t4nDOTWp*`t)m z+i0=Q%Rc(>!rN&1n!f#&Q0j=O|}C zcUle%F3_pDIo2|V@~tUEUl`(UysQA7ps_HyiPBl)jkMCHy}%b4JX(7KmD5jSq>xUr z0M4YMAcZgMGLM4Xb}nz$NhyDe=G0f?(L3rY>SE7$@*7K5RFjY0v&wudJYF&`TyTTR z{!{VHZg}#+Cpn7V!p5X}CBK1@%Qv`2X2HQS+87ZDjJ~7UU_g4nceEUKgA*?hfaqw! z!gq8b0uLmupf!orCb36*g$u-rr=2DDbuf`H>ZOxOdfXj&|& z4TKCqJQ%&ilQH)>%QS0Uf;@cN^dC?~$wIM1opA2MK%k3(WT}=1Q@73q4Q+fl*~o{Kxccpo zNUYkDW@m#9aO6Ut@luIkDb`0WfS(5`!y-HqQ%Xu;mj^Lp9Rvc56g?FW;StKVM(%f% z?c1Ly+m_h`>Ypgv+IARai+?!0gB+)--J9)IzO}=Nn?c7xp^0fC- zhl{HR(envvN=&%jxb;r*%#n{zj<1tyQ`EW2?oMk_w9N z@{+i6jrc`xxIXcVeuodi)4C`DTuq;7^E=Ej&y^i6M~|8hgnUXs+j8f842Xel(y_^jSC(`Zd>o`BLD)%LM8PD{mrAr?7TTF~ z56Ry)tb>&{8V;<8Q=mrjH#jX0aoF#0+WNJBhSS#mXE?3$BhpZeUhmD`D6K}riS0NM z0&_9z#*?$8FA}U}Sm)Z?@flq{X)EYFt0cO8k#TDzC8bD7#VlR)1BV{SlcJDC3J-|g%5_p4397hu z@gn!t;B82Dk{LL%py;UJXWZ}XS-yW{&r)Mqv;hNY3O2+gFxmk>EY`sxgrvd0iseV8 zV_L-rs-!6duq>3piZlf|>woT6jUIQas%rp~Kgx(I1^eAOJA;GV`Z`Z1zf11C0Yryn zxtP`O7Jw9onvdaRd!=0#iA*^E0=A_HlL-EczhYop1Az$+b>bNq4UlophA#V-GiU!1 z>J^aUQqvuko%nI7X-*w?os^EcPT+njbjl$13p5L|_F=2Z%Ngi@M92SsM92Gm0BsB_miW>+&@GfC zo_aS|Cd(!lfSxg|Sc(T9jbX>q65up}{K38tJwDOR*vo7qB7u@7He|+XX-J-wg)*(Fa=_w|l0F4-bH$7cJ9i?j$mZpQF6*PONIkr3nz`1q(wQ>a<}$ zbr3!sqjHu+YSlrSdA1*MBj>r61mnVQjAskm5l~ZiDn5>>1;GKm_ujq%c?bLIazXBO z1NY6>IJsOrqVJ~U-^5SdzI^VcN3VbC_GQO0WV#4AoFb>`}>n@Foi4LU%3Qwb9Jqs$^dn z^6hJ2_YR8x?qYKRhTBDRSJhbpyG}-Gj90BqpL4lKa^GUlvAB1veq*ka5xZXX1qS=% zO|~}|s7`t7ma5p@Ri=to-<+&r_2Jv6{+@XIxl5j9mBZ;=ZcAhVEGZF5Q+dqgFlOtD z>D{!`5nX;2+Qzgq`-LJQxq+;vVO57}!Z{ z9#nNyUQ()MW}1IO#iFL3+7{_MX(w^YNR&R$1N$skl#goPPbikNg55`eL605<46Px$ zvz-WTLx&$(_17z3Ul$z8wQueRA=Z!)q7p1x!?q)RSXKeaAl`#v8;BOuRDG~Iv(4fA zRpmtIb&~inz2%>AY{!3$V~5D=JGmX?g#RS275yZx8QmSD_zk$`s<%8=JMEd6X7%Cv zs(*M_njXr?TB@USU7+Gi?uTTC@1mULG?%=IekgF+oaWqiPpK=<8oJWyY$P<7(VfJ1 zM)mgU)t!^?$3uospEMc1f_(?Q2{@Vb<^=3MG^PC|pgr1#<0eKkZgdDIv!~#U_6%0V z3Sd}6QSub`FjvggbXHoeppBmuehcj68cNBFpN1rk5r!zTBJ_iQa4l zcfzUY0D~PQjUp0#UVf4jjBPA)&d1%8NP<~H?ZHx7MQofqwD)u zBn`M(kzUqkPTdh$Rn5}sV2ScbLTosd%7%SAmD>$KTYkiXoD%q=CHQ4hFoq7PaF+I;p zJy+3Ye$~^gg@!NfYof=!Yg7QJQqZyzABB}8U@92G;8`9ySa<|Kfhl|`NwE@U09`wD z1yKqt+Tmff6F_Kc2;A;~Y#46qGd{rVzyfg6(J}&|ll1ZkNk9@ni3DHoLCpw5@YWT!g>`~6Zjcn1 zH=#h`(;Nef65xxv8x#t9Zo_|jWbP0-6UP3d#LAllkK4pI0I|7_-q_+?now&uwNED* z<|Wsei|%{hfRZ~rV^{lTCM!}dk0f!%ybs%dB;PDNPe+ary7c%ShJ9#eN(&g^(bI`S zU2iB=&tdNIMvQ8G{7TRv@kuY~8v0cd?)TZ?L*I7g%BDzt%CPjhLY%^gU~`H+6HDpw zfz{$aO=>-rEtd>LK3MV{P~sol>5ZVE@`Q>t3j*>uG-U@kQ*7o}@y1-i`E|ne1wU zd68qbHr_7|HGy>oL`S{s2J4GhVSSNQ-EaCL{v&-+j4MdWfXJmV=|O_NJkF9tpDQ0J z+`;V#lq}YJw`{Bq&04v+8*y-_p#-%XdZ04Yfyu2V?Pd?_QfmGz#5-#KvHOU%iG8r1 z0lh&u6vMKh0|WvGyv~NWvG$BXcQ)jWNf`gLMW)TwN!06?MW)t^?cN_2nXMBve%C); zH=6&6R;iUBLkYHu8?P!(t>fC#g<$7@qZLi8GJaTz7w1XRmq^1VpK5gA@6UN~^sOoe#fC=_PnQyl=Lxc5>}HcDtf$Dit=@iM{s}(Z*&@*JP6&MR|vt zE|74)+Mv>ZKYpR0I9q8S;t75;BxoNd_{%dh{L3>#4SQz#MH&+{hKm$f*?lr*^=}>C z{=6+W^s!h9h-*Nf@r8dvOH2T*COpR82T5$SDB!CJv0PDO_M5;&{UySbcN}3_)<2Fg z@%|BEqC1W-Y04jd`W0caKZ-DIeeKJewZH&@Y!o$DULwcz;e$I;#0feP&vVEIIEcpN z-Oq^PWfP+cwOZ4j;MzaSK7BX0yvKALdb-nKj zbKc$Wzh{1da0^)?<_CHyu zz~QB>-@;2b{EpEiPky0Ez$!Tn3V(Zgf55)%Nf{tT($L~Kpx^GK0aa~i5a9w|*20Mc zIUVRFSlA{%b@B^|#~fJJfxhGZP#x^l9Rn41v?f4a528ef0)b>2zT!|l=rRJNJJ6B= zWD!IMK0DB!1!Vg0<9eXjNgqODfwu$XD4grflB>kvBR5?omX9Iml10~G9c&km9MaMw z;7Lp43mjWG0G;w^7Pv9yM~Oz^CFHnZ9Hd4-0wtRA+Q?{88;&#ftya~;7b$A{-kX7W z83sb~kt!qT<1Bzvmvd&(0lY|KRioeJ6MwFBhD)nVXuHyGX7#YTl{Py?$epdwL4sz* ziJ{Dub%t1lb9QVmcPkt`34y5S_7f*PlAaEQ{*!Rq=ms;`f5u5Qqu3GJFYv zF3|I(_r-Afv$dlewoTV7tV>+6T`z(SaWqNvG7z&-@PU2LW$#+Yr z9m5O%K5-`DNi5dAl&bxAl+`O_hU)u8GRZjxFpWQ}?`GjrF?bdVagkh7Sy6xQ_PKmM z2-S}?QUD#HkSn|qO~8hy8CQ@P2KmF@?nhXpeeQRc25B$O6?HvgR}GY^0pTYhN*pn} zkV+J|hEK~6Moz-tLkd1EIS9wl6XTODEJ8MMmARlL9J0jBw9hE~e-yN$C;ms!`ago! z{}HtQkD&E`1g-x)L96kf1+5o$W1C;@YX-ixv&yQs7C-W?e!F0A`gIdi8kSL}H5Le5 zuirbXGZ4zy+?=u7-N@i+LFstq(UYivWlXg+A1!a?v36CJPT}%+zZu^N>JZ#IkfcC| z1O`;l4ZN{qn5#Efx(9K9`&^W)K*AMbkCLJi1i%%3-X9i#TvwEy^Hg4jh;O38kClk`c9$ci3Io_~JlL@P;OV%i zYibcPD>cdK$h3dreI47N@5EB0wy0Hy;Vkx_HLF~Xux9mIjI{m7N}k7L`*IOYb~?2} zc3@D<=iMq7rm4Z#z&+9In#$V~_$CWKB!DP||btT+A#nnVGm3lHV%Xh#8 z;VFL|hjj)0Z0+)T!7r$3R^=-8XD*}U89m-lygJX=Ui3FR6ctvrVKRbD)rzys3SVr? zPbav3-L154KkUreMe40=Y1mjp^J`od%1F|hU0XF zvLKNMA@+>|LkBNpl0i0*Dy5`EY(^2#Ghw#BA82|FrDQPn`A+%wf4pm6qB|C|d^u=G z3#G5!4|k=wj=EBgInFu1x>D{(U8!?c+D#hrWZff5-^ku0Rk|M)-2J^PRRVXVo*v^% zZT|OFDc0a-*`u!1?N3(T3I|qJPejL+(4%5hO>|;(%s-@FWWR3g!{06k8Uv6PiSLnO zHQBE3bs|-RP>wf$7FPrE!Nx!p}r~hmdMFpIy__Iy)(XmZ* zXE1F4%wKJy@~^Tl4D%n^L=#|}C@d4b4a-CYD#E_UmphYW3BS1a!XXVaQC@0OwJFxv zf6>L)xC$wDNo|SCpz%$O@g*Vz(J1Vh%ibMG@)n$&qi$lxF z?>re5@;MTR_NR4L)m_TpLxQ|Dv>Z{P%F1o>;>8GpAS2FVx?G3{fj9xK=0S|0+8cEm zc;-R;r{ZzO&);AkXI#<+g?Ugo7Tm$@@`EJLF6VzUm{%haiPD{|SG>BD@52Ka{9)CD zB>&oilXfjNz8C3f((X-Y4Ji3Tw78w{S8(kENM=GYQaA;Zszuci?1yGC+Dc!ObjK7e zEG656K_(Op0f<$|_CfynGRMJ;`lXHhzrM_o9BU*04=-~!e_rMmk1lhPFY7t#?fC5J z2?&G9NlI6(_a1l1YIK?U{dbOaz*mRv6v@AEME;#S9WTysF$_igJEyweFo^%@RCgD4 z&;8d#N zv9o-7euCFprRl^IqN1f{Pbha^p*=9>aR9s4l=l(kpq7S)3h+NdMS>1)c;3AUCN?Og zz{@alQ()MIh7g`d@;r9Xx=FbOP_HSd5g1^jO+|z0q(~|2XBC@A_IvBCVl~YZ5=zt& z#;f!wJEts_lJ?qZq^_WBM#f@0MT=v&p4@NwIK-VpB1&&+9yi(5Ug)DU)hQ~<K5XnDq~0w*y__YOBP zf_OF@Dx->v*E{9+G#@X;1-h$5p4t(u=8-fzY@3}NlA*tVsC~9W)cXBI1AmIW(luuz z2g&r3_zW|Vclrna(rl-2_4=R8cG16^?bLX_(v22x(Z&^1dXlMCkE$R;(IJrl)iSFB zh9Ip;k~h9;3S7LODlb20aPJIRyZypwP&Jcs+d^*X{*PG#RZNHhApz8{FpOLT*_n#??z-ZX|Be*HS&5z;4Ix75>ilhBzNp>UoPY z-{&_Q3-2pmc&vAEJmWhndlZinC9=7@tV)RO&2j+}e||6Xb`+BUpNdWB=M z^!>L>K?ec(tfez#R1_XL2YfMNhXWNpmF|t)@#)HP9|%Zix~%c{uWocMY`Erd3F>J{ zrJ;71%gW+L7GQ`QQ|wQO+te$jFEmo)q8&AZl*BlT=A$1a^6u;tpuem{I-j~miP=x@ zV!P8w=Gom4@fFLAV4ug%OEO@^OLbxJH_h7QUo>l5TUVy~KDUiOvbT1s8y1qOpk@p` z<&yfqQ{L=Rr$Nq1ekDICfh|jn;3sfZ{XX&D7F7?#dGY!AwJTNrCVw z1=*N>65b~YON!_6XI%y~6i@P5Gfl*wj*1Fm(P@zFmYk+WeGHEWcPIz3`POU|#UHs= z*NYonv`bIa_!0|NJZSl_xGVuS9vvgx0UB0D8;}d~kuJ9OFY4}Qb0|IaQ*Rae799_i zRM1S=+;Vx~jtW{BOZXaC!J}i~Wv>w2xBNW0s-tAaX(~3-}|R+EVekc z$>Ct_9gxPSV#pbSzNHXq)2!}&%oZIDa2T!sq>LV z*?K09%G&N^E|)sUQAN{Zopb`7s_55XT#FtLG!W2HVldLT#Yybua>$C#%WK+K*1j7Z z*LV1yE$UW~K78urRMOKZ3+e_uN^y4$FuueRhEi93_^iID z&#d%kf0iF0ewZ4W?orl8wqse1oWUQB7&vEksF;`AXicSR{~_tyF7wrX znpG;fA&jysnM`JY)}oZ*)w}%`{llArWp^(qWly*H1f%IbV>-`8)7U=9wM5q2`f@nx zAU(yq?s+}rdgie8MQA$5}k#$T!kI}{;eW1tyR>hYU(T>nMl7!nr0IJh;#j^fv72&}AJV6?v)TkuQC( z%~m`$`ic=bff_rs5|aykcVX-pzy2NpSXM{V>irX7Y$#3Y2@#Q)`2q16=eU{~Gxl}; zFCvA_0_Mg)kz)mH{N>B{Q23>9 zR2Rf3Ze?D1{!s!W{Yv&Sy%V+i65c&V&1W9e;VGqr(XTa+xMGDWj@U4@Z3O2 z0_n|0I+c8Oxs6Cr`6j_FRk;ieKe95@h%^!GMaQQ`yy*y(6T{y?P6m zRv#b4Og7wmeW(l@2gqwCf9O_Utmt(rV|lkYALTV*uc#8oVHfo#oc#8btlRr_ixw}- zCl95(dR4T6@V-?(7CluI(W`A)k(MJ~*{Y)}@ymqg#&&NW(J46P_5GuTEE;uW zA)7t2kS)Y!v%T8#Q&EeVLDWWv9+(7&dG7Q)$dZfUbRNE^2kXOftc7 zQwyq=pTIJQc%cGu7+9t|2N2q{tQhBTEk;3a(b9ipl$li%RZaa#LuT)g#|vx7YX8uX zRh%AopMnG2J)U_Y;iCwn;f{}ncym3Y&#a=5{AzLOm{%HowDCS%%w?00>Q7YWY}_wV zC*1EJF2>W;x! zT2YF9js1?!)R@Qn;|w^-&kXn|*p`Hvk?PP*Vny=Jtw$%xm|T?vPf@)*`^**eOF;sc zq_mH?U_oO)xnO$7Trl@PxL`&0K~sOth8tzW+3?SQ%7%X{p<%_s2?I)cu*&_vlM08W zTz}Ka_4iZZ^i$$Q!J&i)CpI0USNnwQyC~*P>6lKk@Sojiktt9O-vrMtLFW)+ATyGR z8GhC7jHF@(WHOK-vi&-TR5++8IjSaQQDyPUuN z;zNBh$GdXVQ@bJ6lfelV?E+FHZZAVXR~{u7ctcJ{0Vma)$muR1cmM)P=Z**hE%P*t zOmsGPgYOu4#$~7tIRZMZ(aB3xic4*su0;>S&u~ z8;@e3_6s06Tb5;RN3zmG!MYNcFsz=qMR*J6anceT%>>yfMOvQc2te!&Wz3LR_JwmCkyF~%+ zHs-siYXgRuSsQk`u`CXsdWy=_qS7<2H$zs8tel8epk(v!b#$a@1^u#N5ZTJDl~DpwUt)}zBU z+Hsp+72ugtP--`hTZe56*xl*JT|LCg3}Q8@C=ST9q?X!%ANhLeuIeX0o@5x@PqK{- z3lm5oP`OdIlsYn*u@*H-AsT?s+9XWW&wV1yk!H334e5Nlfqwu2Fs2A5Hv`z#C}wc(i(Yv!83{E&l;kf z23SLM%L=RX(q<98>N-jeU95xC;~N&_1Yz1IZ1k^b^2@4aa0!HVOw`4#1d^ZX>nd0v4rMy2ZI+8Xg@ zhHTXXeLI4ODV(7aBe_p|EoNvUFr#tHn?uf-mG7Bi00)XNh@;?sR!nuIN0letVz}?%bp#N7MoqG{lNkzYA2* zP#{%W3eTu7m%H1t8LjI#=kQO5X8BJkt}{(9gQ!e+b%q`9RC*?;NI%lwV%TE;4A{zq z8nH&TKy?^`$W^QyRmhs!g$+oQ|mMhl-1{@c3WPD+&K!S9|}_iDj+Hbq}~mhAJn z>FN59nROG*qPTeCOj3^bdg@D7wMw3(gar5r~Fszz}2MkRErx?INNQehL^HX z;Owq4$t|Z}vxee$%x3&%4l8&bKvMK5BJB0A>i3AKH7+n!Uj`FuC{~p1q)c;~Xl>bb zYg?@{`FI28EpofO9VAd4h0_Y2|BJJ`V5_oS+civsbT=hmG18D29cH+ASEsN zAgO?~bV*8gOLup7$r_+<&iQ?7ZR-wI4v_DfvePZ_jd^dUk;2jGW7G&Y!Km zr_?%ENMJ%k>oW%Zlg*y1iWBp?1@}9Vr=9bftkx}xvoHKrb7T_=gfGAM77ZxETT>i} za*IgJgL{{^a&0WIC*E{`u1=Y0>+U@65aKP6K+>oKFdjlxnlVO{1i<_V5hZ>vyBNPF zGW`i(VMsBw;r;ZYuog1Ca3CcjLD08@Y%f#+@^kVL$WQi{SQLbSJTf6l72X9o5e)Qp z73&rG8)#@)NQHxf6VRH# z0zb$-m4XIA0q`>z@{tSD?qwzr0=x(D^?^cW0&3{pD(DxGtr?)ONvo}#=Cd-NAhEh}%03&4t63LQsS^Fzu3rFIWC+gBSQRp(GYZ?6l?%@J zgvB|Bh;xl!sfG*9&y+(p8ff<$jev)Z#>andG^GERjmEst-$xqK4|JDD2dcy-n8Jh}qb3aVfgHo{zLiXLv`hvJx2?5o>?r zGtd1?#0T7k&+D2`>F+`O;Xj)7c=CTX>#NESFG<^vdA?e+W>F0ozPl)X&llh;u>0)M z4uK{z@AshPWdIEUL<+42Xd6SGmr4Ld1P~cy-2TZJgolzg#P0yNH=Z&rM!yVTpX~UgOKT$zsYofLLQ$Gpg<)>sDg;;70_VlUj%sl0|BmI1|h(?ei7hL zGbRaJKmMWzq&3Kbd_fsqxgB4oH8QMg2Ck*#rlTNt)NOMs#c z^6xJPPtXgvK{da72?jtnK0O>5z<-oKdZm zq!kYy3D;nj&8morsa;UY4nuY5InnKV7eG5Ex@})na~`3bPHfZhK5Xfj~)3{=2dTVG!T zbtwWTba~l$ce>_|_x+gHXFVKophNy&LulncT zj3pm|BnZM7+88M)eP)s2C7)p|oa*>+l|lbp2d}~0@DnVI>iCS$LA?aj&+WyTdLt+4 z+&K!6qZax}Z<@z(o%v*&lhAKww(<9&#WZ_TFX~Elw?Y)sa~G~@naELx$NI(XSPPro zg=XP^q9I~(*eaWIU~q_-0-Rh{Q#~BKO(b9K zYLLk(; zt}n*OKSewuEAEBodHw@`rUBev#Jzfp&}A@I=pv)ier^2w z)>iruY6Rg&T}Gil)hlYhdLZ=C+0JZ`Cm9${(usay3d+b)%q_5d^wgDCZAV?TgzQF_ zx_2y^cR)!=T>0e>HA{Ln8EJhEC8GR_v185c%Ysu+NQl}dl;-?p5*wse}gu-z6rPP=>8Am0NHmEIRJbL`P2XaBUVywMJFQrlTS;0Xk@IiYvnDbF>I0oIj- zB7iXonJ5^&{j1#g@Znwj@FD9>^8PgW+Sj;UeFIaE+s{Rxoji-OF3_}35~tQ)%{X(k zgTM4~?4YnQ-rOqt?FC=o{@}A-sIhsRUvp(AFO;nrKX%}eda>*Y^EswNe$I1AU$w#= zc3ie+*yG!4-L+y{i0LSPE`fh(Cnux+)r~LBmzy2nLy1CF#6F$ze?N zKb#}agQRpPiY#MwKF__xdV%9_aUN7^D=63=OZVJivnI(UG`nB>t@aElRRZZan@$-N zf4gn(H5OXv;`3wkb?i+6c(2rj8DTHHkX3eKE2zl+3ltl(ErHbDX15o3g->$AO_<9T zKGYP2M zWF%qTN+*@oLhD0vvWX8lSrEu_hV%KQvWHuOdI*TA8Y#}GxVV! z%aC3CCYjAnitQV60vUd>dAX_q_I*uOSG!8TYO-e9+dVhHUx2O1JzzUO zy;cbUY!80}wjDTnI&8tqk9%&g{uFFAHPl5%>v~M?bFw`&8C7iGMYm7e)v@y0u7rV? zQUthgh<=d&<}S&As2MQ!S=*{~6B&)rxLMrLo~Q>}pMJd*%*+vTjuLgYb=W9YGH^M^ z9G4mgSY$y4VAqwj_)0g}!j;AP7>AjXk(Ww$F)HF!0qkbG zT}aJl&{XP*N}7#QU9=X)KC?e0@SnV_W(+n;z>vly7KU5@>Z`|7X0phM4oRoNDo0?` z&v!>ZJIvY|=mvMox1vcRy4V|dRjFwY0urXwFBLLnn|_WqqR<=ZR!D{pi?q~8O1C1U ztoK%+3k=*;;Y4Vg5;%*8yX7AyaCRSVDAM8{&uHdG_e#AfkN*BDGww9}EuJ)4r-5Dv z?iozsiVZr?2?}~acvfIT=vN8;H$!4bZFIrWk8u)DP zm;XbMg@*{TOTPr!fO|ofa^_x;UHG>kYopxR@Jo;_co1aa{!@^Z_$A0{6g;ZE7i5Ds z_rQM;vOy3+7BN}=N#ngB+j=j^7P|RE1ldY|b<4rO39^O9IRzNSZsjZNHh~PjyR?RR z9%Z(!e0Hmok6*4I9)0PK#2nMrPS<~FZf4-Gri{tnK)W+`=7Suc>=#VME9Sk&**A## zoS9C19p~9rtT#B_{6uajQ!ukO@LP_W{LmJ|5sEYCTU@hiCbOEH{^dZWSp$bRDM)_p zZ(gX-oE-UmY#&LZia}|2v47M%SufhaZz4V&^walTx9A06QHYBssh#2~7Lql`fI-|I zwuZ;QEsj?Wb0;NLScLF(EOs?35=%n6N+$6 zKKt=5#FZZ__RqT$ThNZX+&C_Hnj1P5J-q@qH@dEo{!YpgG$hro{U&9R*0f9RNmY%$j~QrNLQX00IMJcIhgc}qi8!jf#7yM z{kzYB(^mJ3cdiIpi$6mu6jI;&10T(5jy zaP*)0?0ZsUst0{mdUzb7&r1GTiGBGk8=h%bl$nOYQ>k~t;)^kDrG%CaL7t(aLgHb0 zMfuz3p7$s%#XnHmlXmHDgHPws_1}@O%fqTun&=26Om_sFT|kl&F#=?5rkQBh0W%mF+94!_xj_d?`0)vBDIb{Hk4(RqS~mz&OPls5Q|tbVsohe) zzwwCv$BoA?ruNSp54+LdOzr=8edB@muN#l6!y&nocEAgRf}08F{)VIQ%inJ} z#{Y*K4q$GL7=-`tQ;nI2Qw@L(OhC!S{--6&2(e^W?=9KAUzRMzNvQoqD#OYuE&cp` zDYoVO&r!yN}X#2zNZ1cWO=anNQ!gBOtubTEM8O~e57 zG7wNe@|##+Nbq4HWlX@%n@AbZWF%m#f?UN1LPJkO&NnEUpsT9TXNe%+820J$NWdNW zMj(Y0&ytm!RKv)-w0e8%h?&lzTh?oCtZbupm+N|MtLdqzDPqap!#xx~Q8QJCRw_$6 zh6?htMi2!nv)++h{1>}tMn+SNkea}7&m1A=%!+kIf6a6B5C1XG z$%o8yz@x&Nrd{-qea>~#HDX^}+e_08+ti^Jfldw0Y&R#zull1GYd;%ISw8V$YP(#? zGka|n)si%1F=J)Hu>Ac1HJccslC z+N9{cHc4%XcB{=F3tWPp)m(r-<4VZAfXs3XesPmt@DOhD7Q#)&Ntr!MT8$hvyIix0 zU&trMPco~}R7+Zwoo2qXl9Yaa1}jk``_XvEjD`*mpRH|nR^z^!QbVq#&ci25e8>Vga>CoP?wC9e=& zs^xa;(zUF&2veVXV6G1w_T(*&>0Z__>2u6*eOe^1Hn{!<_`s0ifmJ_Gl_hXLua!jW zu?_o!hBVbx>oq;33~I!nSZtvbjB};kk@C7WXZK#FuS>tO4G__;*!x|HEYjVcJH9kH z^jj}^8t0}@onJpD5W<(m;m5s!*#Ba{~g7zvX6I)sOXGr2wuGB%X>nL7PA=6J% zRRg?JFsJTf5%NwOHUh4SBC)*)TTcI%M0tTD0R~Nny3PRfEZ4vQk(u|CCEBq=N`DfP zltedVs-|ks8DGuK7TQzfJYgMFcg@lgI>xONZYWSZ=}*?tG+3rzUCF;Jlgy0dtdFlt z;CE>6LUcPs6;9L3ikqg9#3yiYN}Pv94haFSNhzdZypAD1wjgM}bKDHgOT9g6TiH%! z<0bUmlCN7O!4@f>WQg&fZ{uY8WYYS8`(zJ7-OUo|a?^DMb(N(O9~WAG2`$c0*%uQ_ zquEZL^62ozR_U|@Xlv?9>l-#0XSL=^<#~7b8tNa9eQhJ2D-Pr;&^obp7WPHj=I6n% zg-&srw-Cn7ZUu_f{<&MyR@Irj-z}-0>Opo(are8W`5O7V=~kvw(tWiG2eFF9(zb0B z(u@n;W}Hvuw3it&^^4;kFtJIu!Xqjq1@>|ZPSI-$S-_zj1umT7E4o9#2TXw{XE@0a z2m-g=L9T{aAy-3RRTlDnUC?3C@VFkE%kuDerk8&{c-d6ya9C%Ou#~U~qvnD)j{X#n zLa)mwyFKZXM&)Bu$YaEim@q@;v2QEHtLpQ!GR+MJM09=BPE5#`ytO z@a`f`8!+VOBKo2yW2*Qa?$8j+6&coJ%6x+L2o>z)gVE8!N@E$`hibQB#!27nMctZD zxs;<~E=9;`(irQJG4-QHoU7gl75i~NDe9NeK}`(geskn{)xK|u7W(4|8ej#A)`>Oh zfG=U>O`*a%``PDbG_#`G#NNxmMuTvv zNXIFZGa3RG-r_&Qdy#j{c}c>8t=pNmZJ13L`$iyA`-UGlw4}lT`Z>r5B%bqp=sI8W z(@kO``L37Fe5{n|3$+gdX9E8$)9tbC?OwGY5pS?s|X=99#sg6Wx0PX?NgK7(=2+vhTP8> zYB)bDfX)~Yh_v;jm?vw$d|-p}XVB)N>%RAM0q^t3eU(T&E;vA8h>-A6y;)X>UMn_l z7f@&lq5w0>jB?pTJ`J^OiB->RbmyiV)wv=cD*Xao-(0^+XRIh%gf9Oh#`U-Gh&!QB z@HFEFr669Hw9VG>dq;3N!>gtQ&38f)AaEmoz_XAWzKn9(3Riipg_?i2AJzEdBL9(o zR92P8X7sF8#2YXENsKjMl}^CN9*qO&n?ar#SB|K$z>_~S1SZRC6Z(XAj|;@NxP#?L z&+Kv@6_BAShUg5nxeM)wd2^Teu3}~=M>$R$9L7IqP%^X93U-K5H&StV1o_iaYpTS; zW!{Xe@YWz*n4q567yz?k{wSVNJ|=O-TA8AK7R;{xCV#w)smRE-w#14)l*A)(ac?|D zPwh~V6L@3}F%w9f+K&h0=Xec6jcHcLNcjKAN3L5(*{pr4aSS^7i2W*)^}9;ev}){c zNywbd~7PSg`8Y#5C%GtmF=y^)}X^(1DH0znRVZ;L2M*-n8`^>p1 zyN`wsu4Qig;z}TCcZ0R&gKIgrW>S-c`4?>2xZD5?#q}r}(VCwb-?aJOj#CAFYZBXt z|M937ApyI}`CA8$ZHIcb=w+b3+%R~YLW9L<5S2nnh(Hs^$3cAQIouLVO@lzHpT2XI zQU}=#ECLj8wl4t~%#f29oa=nvUXy|i(GgLquJ6FLpSYa!IcF`W6nCKa+efzrSdS2hwA z)U{;&`%5xd9r7i)@^4>~pV*{%Gdcb*Uy{eWe}73%#Jyfy=zgd6vQ|jN)^WTZ8FjYj22~Pl@V!{V1EmNQd7xV;|Z{QSQf>{V|+F`yCO_QLxqa zxAQ9JJv1d`I?c?61jR!*({BDpkLSiR4xC|+vbZQDN9{}|XYSG^!_FydQT%l@%uk{M z5*U?eod(i|9uHx5CL{P?`=-3d{gR4cqPYk|my2t$tm0^^Jl8S~+cDr))Z^X!I$(Pu z9&ukvhCrRSj~yp-)(w0rWF}I!x|S0WQt2FLtQQJpbpe>VNvW=67XtO< zs+kdwC1rk?PG5Y0jq=BJU(ZE?&-U%EI;H`rEXX7$H% zN^3}jlsNzvXdqs22V=g3=B)r*&~hSuJI8I0TU1f}+*{AX(-egj?Gfs}0ME1cUr3hz zj9^9?QIV_~%f3>&tgc1qACM~M)M$yw_@-{1P>8-!wSmN}WPY`mSIs2c99s3s#K5T| z*gWA>RxU$WC-VeT2pi|Kn|?_w9vQ_W+zPx78ae$u^{0x7;@$kEUNAiiG{t6;ShSgT zs5qbG;jf;DI=|M0CXPgdI?+qU*+pD-OfF+c^W51IEH7rO$c_k zx(UzU6H@>Q-wt&r`bl}~UH?pwI zcuWM;NaJsS_W|>}UBJ7{kBA2?IzFzDw~C+V-=OCE;4i#czGKWmsaMIr5{md2G`f$p z^hDwiZt(48}Ov|&MBvhe$f79kq4UD zC9MS(!Y9Wm3pe|{i2#HCt&xpBvUv>u*Lr@hkruCYNUPBZnmr|>kKB464+vqudoBLm z$nu@rbX}L75$bB}xYGq5r3mszOBSE8{B6SpPy1b-#{EX~Ymz$GxerwSc>CWx4sYLF zj)3b0GJmv^&DkAv%$YEsEx_i)iszlNZ_`T5s>wpp<3LqYA9^U`m-V>W3&OpYswZe= zJ~QJvT=|)H?wTfsw3zR|EU~+PN%yMXm`*r3#c0A4Q;>i`3u6W(It=CCLzY6fjr=`| zD0vTwxW(;usEBof#^~d!TyvWTOr(Dd*Bz`qb3YJ3PRR&vJ8|e2K|JF*CY>;sIo_Lv z72@}d?m0)-*F#IRi@Y=8GZ0z~tf~P?c;QCvsjKL84cQWs>An#dm;wXZPFzg;u4yff zRXtWmr0bV&U#=EuSB^WaE)qxzI+e*3wdZD&)X zL|@gk^w2e&O*_=EQHp)%aLchEip;G^$wONi?A7z;YiqsQk{**oQC#&TzT}=Cr>v4_ zttVsb4-rM3@x#zyC&XGF=fTSlB2m895^U^mvS~7U8kFB{m6W`YVR4a{j5q{xAWu%& zh`0wg1 zqBRqn_49`lbQq{=+-~ryUv@GR{5%H#U}aaRK2B~HdK&4gvzW*%r)7W5($lquInokH zzO+AgoAb6{L-wrJX}o}L?4v9*m+P}e1#Zy_o)~FD77Z@vnb-=oKJ@nnmk!{x?v4T) z6;GA*XMtT@<0;JE!t`-L`x6`X?RPlH8@9DccRF09R6!FH1O;zyu4;9x*&MDr1p%*vNQp^Rj}69hf;X4>X;PusZm2&-;%b;vxe*dt zp4Ul2m}falFK|O!M`w#Ouf}N8G=6q#ckQ>9S1U z9k=$e5X=3JR9(G(g5(w$eW?W@s{zH|TZZrt8*qEo0z+J zF9wkTHx3|d{tlN=`kREf5=W6#Z=))5glmEtZkughD8Yn_pzG+T)XP$xJ>0s3)7Wzh zPg6{7nx=7{Ref#C%FoReG6tmHfQVrhBmih$B0O-)uoH=8l`&R(*Yimh<+U>B4(giD z*ZS`}@3XPdsUZP^h1X4!6U#4f;K_Sur1ic|TERuvX@3XO==EeC3 z=jRu>Oi$mO%T6knhECT7UwB=+|3~(2bx#C?{bfNI zjj-$5I^Xnr$cXmJlYMQ9+MCUr4;ig7C_L-MYjO)F+S)^MzAgcx^#ST>t^>A^d}gVG z#H<_JDq~SXs!NzkJC~+{QUD8$2%iQ+Q9X13C6}(Flrjp{bQj*D#=o-P!l0_>NM_Dz zP%CB+&14jK`I>;7g-GD`(=j{(B?i@)u@>_@*E0UX{xh!Vp{?F0%m--iXta!8rDD5X zP<*b{Qd`9Xl8q<`5%IjWj)#3U@kf|zZbxY{t&=K z&%~wE=TMTfvp0dyi-b5}-sycwvfZa@b0d>lM&DkzYWAt{F^~$rb1>NDH%CZSl$WEa z6OUV;Ohql+DmG8z&k*GFM|`SHA(z8PVQ(Gz0)>c`z%cO@J^H=|x{E~>HO*{$S4Mze zsE?grzO>N<)>H;jQbCDlg0udR+9r3z*_}qWl@|N9cVBY7S^rNf>Zj(7YDPBNQ(MKv zk%nD4r*0+b-{mEoh z|C|G=JTv?C!HE#W83>Q2XT0OZc8Q5r{eECM4~^T3{Uj9r#o-;5UGNj1cKXTY*D1Li z_A&=V{l)Z_ynSALw`kEg*kuBpEQ=i6}JmI z`?D}99r*1Nqe$9S8W7;&F4vn=#6Kp%@-abj6QuMZxfxjH^j?uLP|sLdem%ie2M$!CCp5k3>x)88RuQj7OzkrMCE@U-LG zZx2ImuD=ht2mTszr%5^@-VeF&4u&B^Zp()ucOh{zWXL@qlf*pm47rgYSE!!@DTT`Y za1G}!FRzcJdQUrkt|wqS&&O6-ZAYL+ytLER(Wu6@ZTb?mH5lBLeCN_{h7F~~Rk z9mrg+dXA(xGV|3u5An8^qWLK~+kvx}vzbjC>-xcK93VKT-NlI=FJD>03 z%coSWe6AB}W#id1s5XOk3!6?j|BG}-gt_8x`v>W6U;GgqeC`G@-HBAID?f2YLrixt z$$bI$*1P2y(iUm10NIGSI1_JVccA~f?obbByqNg>UV9&+12ava=tABQCXe3z9v0yL8W#K! zz>O6h9^;UK6}%7Ne)IX;%%EMr{XT%}emUbKL7?s|%zmXTXSm93IHPXxCXS7d*`UZG z|2xf`-y81;{oi68gsp3U_E=S(x#vVA54}0w^K7i_ z6DFFVTRycqN|)X}O{K4^Ho)!xE~$HyZBrLNXJ9~;72EaHxTp0zgmNwA$PIjY#qj5r(f z8qb!ogG)GHS;!#W?W$-I+;#eKn-`QIaVD~p<=LV(s93b7=AxHwfZZjYnp2GsxZ+BevT>; zkd5uQ?sLdrg1Su+)BMK3&qS=M@i>g8JHoBqk%i#Z5T~`$VAyo#fI}M)@U!O{lmvJX zzpRR>k+$Qe>$upG36E_iFtXBL6^`PB2VP83<0?KI=RM&+o|ogci_`r<#*UVuiF+e&(P zh%7d(B1<|85NU=_{j!wC_#cJbUxD1mJ;j$I1-}Bh)sT5ZL~FLFz@pVB{8vxtYw4E8 zLMo-_vxc<)LYQICcqYSZ8g!9NQ)*dh5rTd#iu*j$( zCEV3NO1MP#C0wSr*%DG1lR#bph#DNn@a)sPzp4zHTVExA8dJw$mHLm?% zP7l5z&<>KS48lCw|NR`n6#QTB5wzHX1Xi7IagWpQbcVow z>->~ZzN>@`RnV|TQ+B%|vYMhiVXq4j3k;2#-p5ENK9!==>|3IW2>E|oK#cTlwq)Ay z36Q8zD}lp`KF!2L$DM`TPavNDoM5KaHNfEX4ax?e!xJ(oH{{o4W} z3l36;N_bg)LToJkDjwX)#epZ}yU#a3CC(xm4H`@BPHUsvL2;5FqTJrsO_z6AV7 zVAfUjLEIzotLn7CfxOPVvEUutK>G~-_erp0fzn$)jyBVMNoe!^bT;-*2rsN)@@GS_ zsw5G3!y3AJxSf4SV@j>n_$j8pkE%r+2*2Wb-CQPjd$1asvXK%cp|`q#hkl5Mi*<(l zmUFaLKhnN8FzRrThhfam{~`M@`oSH19oQ>j=Zs}cu^Oa_AfB$-b;9Dm>6JP!dAr%v zK8&oJdhcbfcmL^Sn*P(vjQ*(4<$(6*sRncO)fX!X;=iA2!2EftVLw&ZRs6T`gEb`l zU?{kwtjYW|o1XhK2zx@%yp|=VBND#-eYW(Xzjuc%5hn%neG)>~RgvqUMIP$2zURQ1 z3?(Zo&!rht@uEjV$MJfl=iYQ5wOC`MrqPvizQfp81cU_3C9c+%hBzi~t6bm(7sTfM zP76XpxJkgXX(8`2d9v#f6n&p%WN{0W+ysc+U$#)^Kpyc_O^}I)59*|5uhHNC zaO}kG_m6QFDMV7TE;f3rMwV6n&2H%|RU{FK+16A;xoO;iY~1{VmZaxfx)!94#{8{9 ztDan=qJtZ`q}XDz3L}`4_r3BQrsmhU#pAY)&wRh2&2pbu{D1?01;4Vd)UpFV1SS4b zYnU0+P*z7Tuu_84={m4S7F1fOn(NnPhLe)8M7DBrBk~H~67@TY9Mnon+opW%RInGx z*6|W9(;Q@@7WqOMB+w~`^H_rT38p?iRv?RoWp$dqm}$PGK^bNnheYNNnH$x-;&iMyeMz}w8Ct~o5n6p|sJN)<#-EvY55@!Fzl2;HW+z-{*$ryT`h z)sCwhbTXw4v~e?6<;06=v;iKo2P|c#>&~#;5(k(62n4k;?C56>-=4 zw_tY1Y4iEwTX*_h^Zfl=WW+M$W2u~RG=7%ICB{%}7r?j*RwlYMso?Qz27MC;*yaeh z1=Y#q@uoZK3K#h`Wa_%DKZ#+p%7M%cCOTf#|CCd~r?c193Bx^M$LhR9v1*4w)?@pO;_vFQ z!mh$U%=1d!o!t4bUxh$;KO6@*=_kjOcMCZlBcrjtpekW8VIA7|7HJ41D8YcA1+SWO zEws*c)e7r1SA$x^MUi6Y>%wAxW`9BByTl|y#rIpL$1Gc5!xS)DT#M)ke;Z3bkrsOj z3^|bE!e|o%O-RHvU`ds>F5|FN(w3Ak&FW0Xn3iZC4gJSQljJo%{fVT={D+_+c9tc9 zT);n&L#*{S=?jIx7xcFXuI`sRuFTvEiKIb2B=VnXT)%9-vr-$h0b7irRwb0FOjM zDrhPom5IOsdKpM1#3us+Z7FS_MF4hMA_A)D{qz{Vr-Clv1sA-?e0=*1*M$;7x+(D} zBz}xZ<)qJGen63hj0979`iVw0iu_hFSqAxjuGAWEI7&hW*u_wxVh*s&BoyFxy(;Q1 zj)%#d7YCquh}lr7T#Bp^Ab;b6zO0r4hb&|sl-s3W(|1u$^p(x0D;*;GvG1@ZS#zD4 zmls&^1#8tx?#}Ly>`1^`f8N-6wf*D9?(6-H9foNfZ5rgpZr^?n^jsYuG46AfyBNm# z-w>&!>+AS$K6@{0CO3sjPI4Rf>@E`1)7hi#EIg74QIXr_O-FLI-bx;!-ZRMZzZqnj z+lmJUIUfdG@P*lnwSqMz{2~{3mJjDRB9r69{!l@04Gb})f|MQ%sTyBXHz=b7rE@&y zngK|_pirIhW1mgD5M-8?RHpf^$V$T|anuYVN^#ki-Q?3g8JfVL*yJ>gC`pR?%aB5h zJ4UzHUO7aO41X>tz4W~+Ji$9$%67(RB0A7<_BZ=S0XPI@ZjIL zc=?-}XOE83Zh|Hjc`J@XtiI+NyAAKWOcv^3%@5ReUEMD99DP0S6X>zCFUUc}gI^#H2@qou(eIu7P4c4YTPGdOt(VZd3F9cT+8{RtNI@y7_d zP??J>W;)$XYr66v+X^_c*t4f^a5RhO1BBxJ_ zjVW3ipowne^5MaJneCN%9dzl=@19y}3>L_LfQgQW z`pLo7#Jcv;GBGp6<SXN zy+?4f7?O5R*Qmm`c55L9&lOt@6^)|7QxzPq@R!3o4SQvvDJEmqmj z><5EO^e=;}G3&R%h0%ET^N);B4}o~MtM~W)WZw#QV&tj(bV?7s#VcZRysprDgX@9d z>cR1d{_#L?UD8_L6I?SU;Mlk9aiY*TtwEwQ45&MnX@-rR&jz6dNkNStGJh3@CX?CD z!!e5j-)AVLFc?mJxK-K0A&Tu*Iy5vT+9kJC41ftJsvI$tc%&76g%tQQ5L>_C)eN(RCu z-C;+p#ab>7xK)tk68(QBm%@hQf6NJ3`ff}0^zBq*6|7%O4$1&}6`wQ@RRmq&^U%tO zWfkJiREJMxR0VPmcEwb6TCS```16DHc3LIm*qV}ofeT^++rp<@Q4V1!8&7WNe&$t< zhbfy~N1mCC>=|)lR1B1n=PuLmI!x4lrYm+~6JdBGO0a%g_v~u16(L?YOir}lu%$zL zI8)+dt|e`|tX{C{R@SbH}ZV|7B?BuBg?>A zeb={|ZQ_8TH$E9ehxDE%Cj=LXmVWfx>L(jEmqLnafKvWw_u!Y^FWXLRLzS|V$AIF` z9oy!cMR>Vn-TXh3fobkW`avh+aaMIvsfG#r0G@ZQCTFOVjZtr{YfS?y!VR9eWore- zki2<(U1+-bR#-5@Eos~CmBi`myxR_I$-SwYh-*DDbr$j9xa3Lc$U_3eGyPD~`{Wbk zYYrQUfz-^{D!F_)nf@aFDv39bpZQ4K>X^tvwUY&pV7^D$xH@w~_a2>< zB6EF>K?tQY)kqC^$Ad`q9sf%is&O!obTU9^U6Z=Lf&ej^|7hv65pC_u8El^y&|_#B zXEmipJIg1F3V>`(Or(YDHx35P8@072 zDLOGz6UTX(VDv5lt1mt&gO_n?Of}*U4UGXHJ)@>qLgcG`rJd_;7cKj)f6k(#u0Fy9 z%e3EA-HPE<16eL?Qkd zdzsK+|4J^{pe&Xa(C&bI0H}4Af6?|ee%OlPYvI(W>NVOoE7tEORuZ;cw0)Z_4r;FA zbyaB(SK)l`?ytfFNqeqn9}?CsZu#R*(rfn#>&pM{gf;jd4QsOeg8!PZ9)~2X?f+ZC zI^=&(SQksAY}V#46{0@+D`7px#S@P15H&1(BO&9z1pYgdcCVy~Sdudwcb+|B_KW$R zNGlrqp@vwqCPlW$(8=sdrI~Z- zSGmg3u1em?hBx#iF}F`IBCPvE<+8W!Wlko&-QB9|p)PSB{oJUX2cNH93i_-EL8ZEq z^Mi_n+$wxe&@Yx;0?&9Q(#{&XkLvv0w?uAHf{)h@j-(le@VH13Hf-xbtpQpaLIe#@ z2>1CVmq?MdbcC#xG(OR2J%&U*Y+~S}UyiXMrqe`&!;apL6n8fNXsu zdk2Nk&-D!-roRI{+IRPvv~B*H{s>JRubXJhcd9R5LDk|RN1Ks<$8dz6>qEG>o?nOY z1ybMGP`r z@M3cP?D3r(*8ug__EWjGQ?j6uE5V8<&af^c1H^Y@)~T;S+oO2pY9JRE=z@mKQQ+h% zNQd17`$@EIuTg{W zbkp|qygFX}<49FGPazT>cR4KkO0bzb7)e_KgK}P18<)}(@_tyk^K;}gUD}IA`1(DL zgjL{^D4|ckWyWItH)Dc#Jo)k&T&|u%n9c5J&6NK8jt&c)I!MQ~lHJSf8T@w=NX=x> zpy0d``(rYgWPO9uDk==}J+7}8V1g1i zdtF0qfx3Ju-q>Ie^WHR`?-9ZNBMyFSxw)Ih67F*Ym!DU!qOT{E>H&;Zvm)~EVPYL& zcKbH*ug?zTgz7yOf)HKZ&*vyx@J2cSMJFmkutkl)&zN1GTYr+dEpLibMUfhPMF(2( zDnloyu2X*NJ6*e>*@C)xFZ6*~mi#WqUz;+P$2MT_7#J^^thlxkp+&IqKjq`m2J(UID>I7dx{KOO%C zEo7N~Wimkv@v%xh4I*wS&NgoIR*mawpXX?{c@lWb*jC(;KTsm(vH&l=Yb$&Dq^AP= zTr1e)Vf<#MP4f+7>bWG|?oqA+SP4heLAQgIZkTLm?Z?Y?VQf)^LdvGr&XnjdmTS33 zc^&OA?B6B?XnET8)3XefQ^^&+=jRrGw@I@qp4Rab9rF;jF6ek`zrobVMZ>9)va*e? zyj7Yf@wVp~Cb1C_eR36hI~alO$Vk!G)=Kl8Fa@jDRBXq2aJ|V`2TZRj3V2F>DNaa} zsjHzx#OWIUjNY<`1*rI@jd>ux?qRhB;@+%uL_St3}+=H5nGe zYJ=Gy4$5O%9DEe-Ry%IJ7(r#x3Wtg*1B7(*I4aOObM0fI!KUG0^LdV(8 z5K<#!{o?M!?fo}joA{N!S@E_=Grn;i2FO1?Rqxy6$w?)9uMt)LmJlC2ma)W35kfB* zi-Yz!H?yB{((8>EdN8xSw(mm!^UBlUys^>n-Iz{>4#tY~L)mWJ`9?cAisP5cc>vWuvmyLMAe;!GzP5fwX&pM|1@eATG@3kQQ zA)Ze!1xH!&21M5QCubKykuszcCZp*^kP@1#S*4#9tV?Y$Q0596*C5fo$XY{4_J@vLcT^xWRlsh%^yY zGDrztFf_BW+WrWPwws&9^{x=}|Il^Me|f);|Nj@3 zZQHf5>}7k|cCD6m*0SB1v9xR~+qP{ROW(6SU$3`5ukSC9zu|E?j{9-F0kW_|o?cCU zfbtZv1Z0-rT1lq?y6LH+8h90Jy_Kj7CbQGg)lE$Ia#=%nABE+8!hZ1T`JE~5eWSXn zT)8|sOYV9d)OYAps8I_}hvq9M#|@cFSsl?r7hg6Tlq#|_TolMT#q!a0`sDWt*H6D( zAiPbZvuH6EpRxEDNbDlY1*8=rM4=*D{*-xPtkyS%>i#Em)dS~5|6r@K?D)fj!4~nE z%uqxGJt@<+6EK?!2Lt>y0@#sFjL$@_yK&~_<|?-hyOJq2HR6y2$+0U??<_rSo3|Pz zhC@AV(kz=YK1UdRK-TR|N(Ss`!N&r4yE8-e>DwDi{{W*I?H0_oMT)(WZ-espA-?Yxgw^jBO>8H3iO#IXQhK;YvIWd3`N*&5&1vZWg$_y+>Jr2z7voXB321$7Z@8% zDhJfh!u|+G2{g?D;bYW5MLjGc_(BXBWD}CUv><{Kpx_fWolwDZAGQW-Z@CjcY>$b8 zLX=D5E_f-0|2PzSWvT9XyT^RyW#7xjAAYmVeM*K%=s)s`&#f9w9U}GpY!a~}otW&v z7HE6|xX&7x&to@GO!E^!90-z60Exv~10knpLC$c6-t2}-sGE$ZPZ+ebuPfLn$@Pu7 zH7$Kv+_%t(?PEK<;XCtnD_D!fpF%yDzGY?>6c%8sfy-!MFapQRz7&2d*#KG|*|bwT z*A8pAE0|k{?t-tHva6iteS3iE^Q*f~$8{6u=Z?J~Qq45?{M=aFooRa&0r<0kLNs9G z$CY#D+fv34{>h|8C%_UegR8}udm(2vD#i()IvNX!5xfbpoH5i;!Xnztrn>LSaL!vy zJAa#N>CKq7#Im>a38Z|cazB-Tx;|R}?)n5#=FaV>>4n?26v<9Bp|b`j3@5?aDcB;R zt1?_3enB9fH<7SHPSH@85sR;;!grrH0RkO>#QC7P9a?X-S1W4mQ$@(_)Xay8xXiB3 z>9-BSUu@Euzn+gJ7v!YXz`6^)p%qbNY8kLT^uC2RQr3UK%QAuQb}pD}Vd*sI>dwqN zWV=7T;gpn@9NBVBExWoQ66fHSgf~c+^ILTZ;QU4NeJClg{&@_o1Mg`DwW(CH6S>Wr zf#Ub#4{TM%i2F=Gjh{B6AL2+i9s@p@?T{aYSOBY%NC*)y>zw7y!C1<8+)`tKt&)WJ zkdtwLOo1zsgwzr-)vJSDF?n>{1zL?y5H9k!f%+IDGEU`K*Ma$Py4yRc5VYJ;4q$IH z@VWlkR7cBa-xUL+nWOb32`!OK_codl^bnQlMvZ{dQiP18)Pt^*gSlA5x&O!A0nJH= zvk%~Jwt)^3*c6~9qC6cb9+(dBjERmKnB|O306^`FG_yW@XqP^G;Pe^0-~Vgztp87o zhyQaY71p~5pd=%`e`NnCU_3~c1=1H8wc6!qko=b{3>^GY1 zH9eTH%S*uPoM*3Sy8B|fD6zRSO92*^1Ec>X((4)k~f9yVoAKd zr*FT83oeb@$sIhxJ)p%tNTL2*B`&Uie4r$ype&M^Uv1Flb6$%JzIsLJ-f8sTO#QgQ zVrRS-ZJ~ism?Fpvlq7~ZxW?EgIx10Qh@Mo0aC7Qw?=+)Y+a6?yF#o!_^kYe~?=$?X z?R%s32JnP9PV(z}-kp{NHn$KfbaO0UjA7<;s z`V(LU@4~qeuZppTYWqPb`e++Ft`<=WF#WH5Yu5kDx1vP^T2H+vkwnu<4VaujR~lx+ z@Oa#nnFNo^S}PIGBuN0O7+c*H+ z5@+auo!##cWV$-Dh`k32+<}SP0S@|pgQ{I8mAH9!`gFYK%{cvw%TX_%+uaw8QM-b(EmG;z)NoTN_=50$ zx9_U88>IP0`oVWk_9r5!+tBnN;C*73qX(sk7~hNbeHS2YfyKEgQ>z?m#HyndYNWxS zL&v8PZQaGxpg4qmqj7`1RtNWNreW_X=I85-7?FzAe>*;|O(+C>N|MD%)Zj~BVdKTw zLchm}ua@-)7%IoJS^rckA8jkgo3z>H!@4Kw|5`nv#&k)mI+Y2|0Jt?XX#RQe_m%jJf7E-JG&t zVm#q8xtgF1xr;TB+SZ>@WeVsX2K(D;3ezpzLXSg<=$x~^EDYkt70-0Hpw!~4VGeT~ z4eu82_-`E;vE@=JAy&J1fqo`TeXKuB=KveMGfT)-`6I^Po5=**C9LeqaQY!d-igR! zOBg5mFU{Y`=2X*4OJ#voUc~r(nz;ngM5@xv;~9x`qh%Bl^so$~%G&F{)T?Iv5cZsf z4VX5h$M#}G+BZ6uENE_Yjl{NM!#U_Uq!L7b0}U^UsDT`+R9JxSJ@l%$+t1O_hg(<( z&s=C(ShoQsep)bf=_jcn+Vo3|s02?fkmwZB4Z8ilZHJ<5yqwDz)%MGNfrsmK$2v2r zR2)Jrm!uJ2;yqBz1A}nBf9kxaj8<~&XkMa;`#0_ret7n8+h@O2a@hRewomU7;JBtofjZ4`*Ui1rPr(l>2+|cM^P7%*5 zwn@3T782aml!WIVzAD|r0k z;d%b=;4$F6cntQh;_>=C=imGlZ_uOPULNmsgdgSyA7gk~=IW0OWRs2f*k{}6&`C;9 z5e&u`1WTT3`LFu_J9vEmKMCJ;j$M0)slUPF;=zA{$EM3MuIm!2|HB3{`d>KEyvE=i zb4y|@To07EZ3iQ9yXVDVO+DgXVOR^KWhcR1!u+kuNcih_u{Xrb>wpiCNyd5aXpm)d z9Xh)y<}P#BZ=%YecQlAhY>+0!ggrc*i*5->>Pt*XslZu?9AABUW1|=;$Z8LKOgR6}v zLWXc3K}9igVobo_V}mrjudM2B__?;TEEfjo*wO;66YW{oqP&4BWC__n>o;JQF%B#sL0?E^;0<=u2T!1ctVD~t zS_P*q@`}U`Ndup;=)WV-IqwnZ64+7~Ch-+2+ymx6R7~45V2-jw<(ij&#USp#RcKgH z6}lV9Ueqq&HxykZc?2vbwKNze1RTu&6N-lauTXTWgQxVLJ#N5`ZOExa107U*HMt4)XE=< z@`0!n*jR|MaDdP5fY)ndwO_;uz+nL_0zeT*2Ja8H;Lq$zmC~EHCOiKG+lIf!(ppG% zU(-3C^O7i!ld5o`%g>?yCX+1d3_H|xPM+Fp3S9=>(2-TvCK}3p)bDrJ$r7@nygW=n zASZY$FK#aWR2bIUbi}{kaYR*Scu+ z`{j4q#VqZ2q(X#-)8ZMsRS~z{wj#!F!!0PQucP@C`GviJjK;V zrd-pgo#%|7>YUBUL|RcZ9B&av&4jumP!fX(?nrp$vPmp!zj$ei;xuLFZ~FM)CYDk8 zjS6GTlf){s=7=96S;&J=iBhVnr?{_t6W5ZosAn?LIf`wg@{|~HwiDHk#g>r>HVtKY z^OsCF(MCUEzcd+JVa@JRWg5IArm$qm>CRad=dFaT*{VBNz+u8kXkMiOOjz6NVlC(W zy8mJcR2m|}5vPVqb_>C+dCZgb6Fe11%g+Qglr6xjK z*;9&YjF3Wn(D(<<-UIvPuZtTa^`6DAxMouPz=|Ov0zhZn7Xxvnk$bVQ*Jk-&7~8ll zISaFwuUxYqPGUi__!I0kQGjv~OW?GvLf^|yyQv@auOW>1y`oVTV>-^U!f>mH3U<$V7+N^7aT4|&2QCCR|3qi{;G90bOhWY;$%dOYIY;2#0=Pub zlYb&6sG|=8V-RpKNq_9E)z3ncN+#cev8AEn2gnBc&=H|Nu)vY5zS4dO+wB349pOoW zx}V61I0^#r?H_x=Jy`V;BARDX>X6h}coHo?MAW;b;*+xxt02(J!pa?$UZse6Fu&UG zkawZUzGa|^iSe>?3&MtN^#QAFF)?uV(yqfp(M(NS9kSfc5=Jn0pQQV_08!S!HCjSq zJY$mchv)vWlji-T2vf1J5UCTq5@g$YlPpZ2elHF-ZLZ+*&Bj3Dw5xz(jv6tk-P zHTvOVgfDB>F<6lUTA9fgA_)wwBgs%Z={no$irA%=@L8=tLK&zug^z;}|LbPyZD65_ z&n|oiSXqLLNhs+p%Dyp+YMI8CDt#iJq$_?kL!K>i=I*iz!J zQ3|UL0@~9PW2=$>-*#V(#@}|IBBgK?{IIy*7DA`R@yd%_%XYU#ge9C#bex8wRSS!b zm7?RvPrq>CY1}#k7*WIAVg(-8TrxuLSG$tNhtu-N|@BqEFO*suAj{| z9ceCl0HXbkA@_NDXn1otsQ30sKW-9u4scg?cWc(GHhire2^j79{EpTV3*d`2g=$`M zG?{+2<-ix$H|H5*i(@zA7B?0&>WO$Z&rh@^osjEava`{ODy4AbsRgRzy5a*d_((CK zL?MN1#pZxae57PxA;6ATA_uT&ATa`IC^%Xm(C`=&oszj9SE?;s{%qi3;l*!Rm9Jc@ zC34NL-zeFFSd8p~&qTpC==Bn~`bL0{!f4xIu*t|*)a?@C(Naj40vx-?AtWpw3!^C6 z@`6SE+=ay7&umz&MFHPR*R2H?<3k(@oM0qoLJV1GEym@lDIiQr8cqdH?qGY84A+O% zGfe>GGHjRoxOrrrB~04$=Bgt6+ch3ew0d8cfi^B!_y8-VVo%%ZTs?=?drYQprEQfH zcjhmZj?-g-Rd1J{9Czk%lo`*`>1Pd{gURAF=5LnkQZq)lH zuBc&~WItvG+g5B?WvP~CTBo^IJ9<@-R4ZyM=$p5kz};sjZlr7orn0gs7w|y*b&R*g zHWq|Yu}@)`qVt=wp{v5y0h}1wCWtH1dvjay&hf=G*e2Kz@K?M_1#TZz;MNP`c zP*Vry0saOU>5JH)~X(tYq`F!<6f5P&iJ#C zu>{?S=v6}R*{heVS92T5mrl%Nf4PKhkd1vWfcW|oAW6qkw^Q+pHnSKK*;8Hj@~CMG zR83G*vY*C$E$+}`F#IBfnSUt`>3^hC{5V6t9v_FEph^@zmSz8X0G2@z%YbnLv!g+nn}+(J9NNyV zz|>p-A3N1q4Bm1vQCi3x>`p~PoTL``!~6ZQIM?Mypz-n~0!^T(MZY8Yf0b zCB?8ww-d{Z}dfVVx z+huBwaj8tuvV5R-La|LIGwzyli5@g&C}nMZlJJr;j2~UIP61=O6EUGxe6Oe)OQp`%()Obc}T#F_)LA-uQ*d`P9NZOp!jaMo}ep5c?~A)-p; z^Qd%Hl0N0H;LjG!@i!e}8pnKb*fXFh3mWrK{3f7sP-ZnYEBe&L(ecM0oV1UFn3lox z21buy%R{iWf%=ef36FlV4JTW4r9}Kerue?U+D;KquaZ=73okR1=vNVYQ7Xk{a5@H{ zi2PgD9QaewFx!1fKDNQY9Mp_XQh@-rcCet|2PeIh(ENGO;l)>?J;@6d2mHo;r z$!c!PN<~!a_a&wYVR${Jl(EkU z#P6nDAXuyi#*PEr!5WCNO~JbbZpso7AtP-ulpw_~h9l3!7vED%0Vg^^(elDUKiM{H z;*%wv#SeFArYS(O)8T2C67RVL)dYXVVRlgTG7i6j)=(R&*X{2klF2)7xFzqRq>iZ| zJGdJQg!-qZYxl&T^CkWp1m(B!`Ga4<=^!Ib*K)s(U7#XL-HWD6Z{gDC*q(upF63Em zjPD7p&Wm~|*Yf8UM7XglYSfxMfPKSt<#>Zcbcti(U%Zq<^sY?3s5t$>*UeJE-X)8n zm*T@_LQc_)lYTCht})=`4JI~VJ)1Q%xc+7iR-1sF zw&CAZP>>j>A8x`5J)6OsH=ck(<_%WxdG%jR9HAk(vHPFg2*A#V3oUZ(Mr`yu2aD#ctbTx31RZS3174{2L>&H+;I$PVomKtbz(1?P@-V zZWA>_P4jsRoY3l6wQ!)ynN`{}RZn7reSLHLQE+|1XfT&K>lkRjKxL-Z0})Zib6yq{ znkGP`qi$)J4Uij6_iD%t0T@$nm8fZtx3-skw~tX~9wfW%jR>QrQQ4FFa#>FlSb-nI z*$O6A>_R@g_lhlN^iR0Nq>CpvnxW@wEM1Q0YlL`c(3d?nk`?3=(L9=4Hj-gDY-Xwa zFZhM2)@fHnZA4r?eV)2^=t1;4{q=lq>PAhCQc8E3TntP>RE1`%HVy;=LY_j@D^LE3*Rn zMJL7=cR9}V4b%RVKdY>zTUSzYhwnJ6=Q}tPvt%coI<31^dKTqoFQ|NjzTZl> z5X8yaPM3S!nO4dv|4MDr(LeGzLF}rS2jb&;i-m=I$Tv}qeEc{oz`j-LEHft=^AQ`x zioi$m)TBUnP24_h#Rw>k*=u(MRu7=%v=GP;KWrYf9X&G9&af$ow{@=e-j(N|dNREr zoKMHjke^>qKB#%Qy7=Y^c14T!Jn7p0b~bwL{b3v#jPIP!O+XKDVFhtWc+q=`aOxZ* zaO$17>kfN86Z!`m@P2r^3sn9|Z^wl&vFsrj0$(=)VD!>vUUNS}ccF}4(+9XA$DfC$ z7m(Ty!V8OM>FIkF_@rkIe0LkxjTIBwu-9?s{P73pC|Yff;Oo`3bRhElebzvmP4&OZ zqLT`X*vwGpJMZZk`SIlRH(OFBj}=WfQAY< z7=UhW&*uHN47*H;nR(Onuw!1N!dq`E?IWm@f-LsevU$Eufw>ZTi!y8c zTjbwH3zby;jm1(+MoyKrv9x;M5`qT5DO4E#j)`m?U!?s^g{a0&YjeUEMw_5bv7FrN z6-_Tw`=b=PYlK$Ys;dqr!wr2A-as@!Ck0BCnYp$meemGnHWV85EC?Y4|=L7Gt zYRx>%Boxm4A!Ay++w*%rBjk6rEOGm@2OpAvYrFsvnDzaw4%*I1MQ zUT`cK^q%ECITv(en!=WX?g|)E$PoLU*5i-fZ~V*a8?Dzt7^J0c5I8C=mA*U$lO6zMIG0Aq)<&XeccK#KdSd=Dn#p;0}4U);zj z+|{*3hRu`B3?GmC4rJuBtFu;-Ao_yn?^HaM<0<-JX=R^;ioAEkrt`ApM6HcDb z)XQK`u$(QkFJF#wL!8=wZb?VkbsrqW9lOuHHn03_)^u-wBFJpkRg2%}8lMNi(*ahi zTMOu+?duCFF1w`Oa<0z0LONXhIz8wM6bzd7m~&WHos-e?WNyCag`K;j+OWRZIf-IXb(l<%YG?2kEa{XtpgUd z5S~=S45QVvj3ZAv;FFe?Q;)QhtSQgl#@8Cy`)w(#UxD6EJuc~0pW0;-Y`#ZROjDSS zpUHe|Qd*59#q(AAKr4{`)|TQdw5{x#EjB3L(=%XW;`4Eal9isG{(BkVUxeKCr?@3( z+f-e#yT`9IhoO?n^Mf^!PRPyN-tT@~{Qvgjavc8g_wr3Wf-;tuBkd7#$m*j80f0y0OT@G zFgvQlsaH21`-~~Ki(#b6w7PLF7bS)i|hkwyIO$IY5sT!8$zy)iz2?0zFv zu9pLj_h@5t6jR#h4{HfOXokdK?zzAq zZW~Mfk&Aki>YshV51eCZlx}59x5q%`;*_(2OhUf28*7`ie-F4Hu+gwCVmPk zSscVdv*1y`vPTrAcES`0dkK-eKE=a|X98+_&mao0UEHmNE7|l~6%5EL2aEf& zzB=n~rU?K~!voTvMSt?@`JXBMkGY-CW<}#hA$N($7zELLY=r3Xh@D-TRIY8!PTovI zrA=0)3w%3cQ_>ee?{=cCN{$0Yg$=^~;M&Pn7qTE3!7HX10ZKJxH&C{9n(_=U30G2^*=dK% zscWm~8*z->E%tEokNekrZN@$}X{$@pIwaF|ui}(2FoIjjKt8Xq1ovBpmrCUxiyJ6- z?yr~EY@+Nt#p&cqp#m(MFL~9!x`7_=6Tu1nAkc)O*)7sI*lr?jiR1@kQ`(puX}#G6 zA>n{lIh;r+1BU1~-+FGe(+n>Ns3*UWFK^#KV?FkP_p#ogfaP^i$kSCoXD!)&?scQe z&4wD0d_=mNU3)g`ttIbkwegU)fF=20>tpX&Qb;zFQWjI^Cml~V1S%T|!wuxhNj8`@ zh||0s&NXzV--TPxVkS>eL~(gT14tE?#p`#TdI7*^J96TWo*@NVUO*CiazU8q$sPCz zVIomrP6`bkKDt}LJ5r~*nDa}tu8w3@bmA^%Kf{hMQqoNVl}fvkOcZ)IDJs!D!1oo`pc-vm`_p9LV4}113S@noKo7gTtzQOTe0j!0Xl1R z!f+IvT{KX|kz9~WD~t!CTH#L$MX^^aX6+MGm#3xG2OO#K&5c9A1=3e(muO(EBRMUY z1aQrf92CJdhc)o`K7!R%t3`ocXUB?LvFW6v>GK?yWYFXw10O`Y@Dl&PdIbh#_)gA3 zqb3&F1G}LCCCJk|A`;p&vYs5sVl@|1Q__8ToHq{EOb-R z45@8=W0oX;iXqnTqedL?@H;t!US>MK)nI7EcV!;Ve1XP;MMqcz;`F0S2^FYb#q2CB zu&x^zdCOft@@hGr+6?F@%5iO!s80}jC^6shcl``UGWNxbo@gI`17^2WB7$tva*gk| zkf~nRX-`GK@V$3|Z8kLY03kOmqxsLb)yI)V1>+P2{+&dD$Epa>{>aRB4B9gNZz|IL zfZcsB{X1s+GMhI{wR%qCKU&iL_f}!+mtyw6Y#DoX)s3IAmsYykKIC?-^Kl+zy79@j z)?k$%2VE7HR3P7oB<bG2eng&k2K8KQZE5I< zpwyv9qAmTOIO5*S6;;_Hw_640Os4~?)~6_1g+R{;6v?mvpmEvM)74pW$4+A)Xk3QE z3>ufYzK_c^xte1n?P>lsF4HLWot%Jxbn448V4dE$+`;NYFaBmMWJ|G~^0ECd$o6DN z{uw6qzd$wx`DHfE$O8ZfWHTm%{tL3%Y8GXt(O&Bv<{RO^L>y!-|5!%^JRD#IHq79B znaK6HPdQr(DgfXhD+IutF2+P(EtPeS;7zu7t8PjB!HNjHuLbMo4+&-0?9@N_G|HO% zY20F`!{chl-rAjY&R-+ti_b*srx5HHRn3#7rXWia@!sZWLClLfJ_cI6pM^7ZIE6dc z8fBg&Cz*omBvZSps~QonfP`rcZao}V%w!$P5hUmZ_$4~#P~`0NthoJuP0K+0vUb1L zD;7&1RN+%C3HK!TjORV=y2B zI{-Gy_jTE3d4c6zj9S@0>#}&h*!Oi=@!xgX^i+mSB<}mV%q6HCe_Hc6Gcq(1RoGbg z!M>u)%2+@|IFKc!^vz6hH=V~Ad8guUe-7>M@a%e8sOxn|mGV=Y_y9;`bHTV{&*y`B z5>+sLX#t6BHe`^ufOnED@||QWybG8eSMIVu4SNsJY5n=Ez(T4n2MW*y?3#*P?NoBx zIum5KtHdRyRU74X2^%^Uo`z8K?O%~5fZp>^jyB5OC44o~Om1&^t8#ZYfNaW`({=1- z;qFs6_sGL&Ls5CMA|9%xU1;BPMHOu+;n37vv~c6ZRSSK{4p09*mV=%0b~oiva{BY^ z7pgsbX0k8H~zBjM7ExlW)Jt+aN600V4vv9ctnSvMzI!vf;N!{)}v`i@)u}p zhOXw_(zV5q;+qRtujrYt*mb(!6P3#*er6q3QOny!A1hQ_F?NjKb94qMBvdH!Der`~vt z+L%*tadKu8M5F9KHrGL9|DfDA{5cS%l+`@y$OiE#d~o`)Cz7Wu>)>On3Y%%a&H6X& z*&|vlelf$GF}3I}fDNEm7JJroMX?E=L9ZO$a)JvfWGF$ey>1%vkIGla&WvSk@b7mU zF-!`NgSR>D+url|6O=*pVj@#>I~hv6w+5#IOz#_yY0Uf&>CfjwZp=^FS!e&t6{C{+--9u5ER#~E3ik}T(@1Z$uP-re^?N84b zYO7xBW%GrsP7%YkFD+H%JpP3<8`6N|_mv-ieqi1~Ih{dh`1_>er1-onk7jUQ9z^-Z z3seH`AM<@ZZwf-m1&K2S*8wn?NMXCK1)+-j>eIZig_-{M|@YuQ@dS>8LcqRx{F|xu?EgyVr{!om_)GvQfS29 zDx>oc7WbYFrRy`YK+So}K6Paxi$NJrRA^9h9)XpE=g`vRYit7@A@B2Dra*HvS>B-^lJq?8 zA)L62drq$l-U|BV z?-Tl_#qn?0W3J%;9>fvDj@*;>>_RZLDi)vGG6F$e|$(^WBAp}O+NgV#PEH@23oSU`G}ZN zG&F^<#9VbV_>)hTntEV%-|&pvC%z&WY+DAdW!9O{92e51UrO)1#1E1Hwp(owByJ&M z)pA%2t6_IPakdLkfM#q1*r+Hh-f!g#v*W5F(*sGouL~9Xw1Ca-^(Xa8QR4?UBR8Uj zr<~C=1o+<}hv<(l;w=lWZpbd?Bf;Jb;bMC?kkoe~WXsq#=fkVr&EUp8)A`?w+P4cL z@KG`q1kz9In}6XyZkqcpFtu%a79<1J(~W8{7cVjvwgbQO3fv!$lK1&Yy8Q**Cf@-! z+%3+X?lwRoJ-{kuF15xMW>52F%ec0`X)Bh>L)hgDuUsBkrtF&j^K%U5A86BMUoHFw zBY0s4@hrE146ZG?Qa`FQ7<5mI!79sl=`DM-O4b&m<*)Q6MNalEz0JN$Zz2CkZ#Ulu zu>O(WVE-k(71sW?+`0o~qKH5yRedfk+c<8FI!2c)({=PI=mJr1$4BLO@6=n!JN0%& zSZ4;J-cA${|4qH|`sE@{gQ&L~$hT5q`*JNieHZjL9#h861k`#Ub4=bx@u5OtPj(+s z^W0yDMLld>vy~y=&bfg%cV-l^0#?PjbR~L0tmpvL=d)>LZF7##Gx$5{CH58^GI(|Y z2W&f)(2thj5K_jFXv04Y4t~UnKRl{_tv7k)m-X^fzej#^A(gST+)F`m?*bC;3f?O5U*y_BGY*v-vr$;${@fE$MZ0OREw=e)w#+~KhES77l(05ui(mrKXmy!NK4*{}h3U?KS>4+T*=`r2t?qu` z#j${PapCW~IJRxv)|`d;!A-W=56`i+@4L7sq5zgCmO$3`T^vT+-(4JA{9YAk7gx;u z&n~V+R_o-1gsk`{l!IcP=_$!4>xIQ12>5xnGpL#)EwhqsBXSWb%M=3lL8rqRwfd!P z_wWQGRwML9pkZ7(g{rvAGh@FGax&X4rzX(Oj~o|~SBmyVdF;lT7e=uM518ObP73%$ zn4Fq+~Y1hwUoGMHYqB*wjK4mMtv| z7nW{&DZ?XI@(&?vD4DsA!`5x??a2&EYIFE+q5BGhx=J|}PSRI}c}UA2=!v|oH~_rJ zV;LJk!bz^KZu>k(2*My>G@n_vMNsT2Y8rSO6{2mY#F%w}H1?-OLbiDy^~lChGawTn4)8q`)9l@uD`^%H`j<238tsNl z`=T(6=W|8Mio*a!El*2ACoE3a1 z*T#w_n>jhS*Whv>CA}dT^hGn0#3xBuN`^(JL6W6;y>k9R@-{|W6t^n!Ba>kG9i^+K zbM2=Dt7=1mT_pPRj?&@rJreIEU<~@r$q0Aj zuRFH!=OS}`OPS3qsZg5XJxNEn^)12Kxu}^S1swGmr-x<$4FG04eFr9p)!&A~o8o@H z-?7^;nY~^VHidgTFi3UqA|Qyn|8NCKIJ+}%FCg-`^4Yp=c5@5C6OO`uc`%3)5%2!v zO2CKLzj}(jy^xrL)n|+RDIr+_Kvf zlbSS+=bZ55j=q2=2MyFx^Z8vJSZhCc>`LQG#Ydh!Wb6v#fYa*{qA0M5p8F9(Drl1j z#lsIG!7{<90w&wP3L4vp`Z#-ydMsv@7E}nXNuaEX28|#ivlvAN7GPOLLsLIrE|+&m zGLr*Vya>h9Vz>yIqb^~01w>OY!fncctHLEP1ZP~i&F5-^i-alZO@iN=!}?Xj8zy-# zG!W2F$;lwbjqhe$4zd^_5T|H8_>-BjXEHk@1K=gwsf0fk5L-2VVBfBGfyX-Qis!NG zx9IaMb-7+gp$w253a7S)_W<4{QW2q#v)ClJ{Du9hlE6&_Q8e*`f%n1W9N?C}flMLf zeqcesst|H4fHme*yFTVq$k9$X^<%LHDpXDrPccDOP>PCVgl*l}CA zsGspmU?9^ieYpS7#4?|8KW|J`vHa!1o>qJD zWpHzIQnRm}kj?Ky!7GsHcPbdd-fLpawpw||#)88Jh#(#=P^mk4Kce7^T@eibN~ct+ zb2xR=@V;DZuYi9aF4j%8*>G(2E4zS(i`uF0!$t2$jyG#@>~$d8AUsUL475g&1W6FB zvwG*xC#QS0{##+nn%|>W^Hw#_r#49kC3r~x>duzbYx>w*${_x`J4*$KjfaCz-a4}* z>v=P>THCY@=W{P8N-Utkze=u>Rik8^dYt&;S?f@%K27-XlL__IT*60ikK!*Ok}w6i zU&hL#D^E^po0`a8;CWZ_T=W#n*qy-@QXxXF3wPXSzkxhI&~_2;%szYbEYRR7AKhlH zwles~p!XE;glK5k4*nVdwfpLvvs|;lh0rVoF)a5(SfCVl5Pf=Lxv8{qcuNimKrGbN zFXF{uFSC#sbT@AFJg49$bh|7aT5q-bukGS`(_Ab1b>}AZIJzy}Wt;e%XPGBP!%XsO z1pKT#st%?5n6t0^4YCwwLG1HK_Fm(xxr z@Hev=Wpm?vAJ1c%tT9?ysnxL-9-1AmX15k8ruvihWOQXSxwdB@THJzi6vn5AY{MvI z!UBlW_ZxzKqVdub3arQda+s*pT3h_;CbfozAJJ6D5e&rQr(^_RCeI~&19(Eh6F=o4r8+dJf zo?F5p=d+oDuS*TUCe_OSc9b?ueu-fCtArtny7%7T)4?5JBGnt)%tzg99$j`o*YTAw zhFUL1%ysEF%45TL63FcQsA;9)lDgTifBClK@zk$nuCGpaG5e)Cz%M8aKcOZkoj_o6 zN%0|jW3f?G@3XAKh%*>dbC@-B3LHv>Q-{j7oFapEf+Jm=c`1vc^r2TCtOdm`|CejptKXd`LSe7LS5$#}@wiwXWv|Goyl+d-4_4O@4Q_FC@ubwEsS+im zH^_^E70c^&*o)m(~$fJ1A>6NJTFYB=OO$BoZOt8Rz^Gz z6wLDV?p&k$(sXd7K4z;M*p-l;Ot#yd-{6|UfYDSy%=jiB@#nrD$wNPVVbQwC&N0OA zoCYfOcX1DVQKDS44$JE}SQ~TFey20LMq*SXfh54JcM0%G`3!osU{0{<&}fW=?b{dj zJp;J1f)NjlZ`{WF*0Yf%sCTxu4x~pE!^R&4qOjonnTDC-dy4d;ni6>O><5+07IJrM5D{KgqLEISwWzNtQNIGIO5D$J6 z$a&M%gRL{?xd?4*Kd*ttkuxsxpm8KbYJW!TSAC7IsGZ?Wk^xNq)R|kB=q##EFuywo zS@W>P@PhE(rV1qru1Ozp*3Q7bJEz=a1c?L8Q!XkN=1JP6^oZ2Vhbcc{jOGlWnM;72 zz+mVlUqkbeDm{rm8920IQVh8-6BZW<*pwC2^-+0-ASZAYN0@skD>`3L`8QVm5mxD7`v+tU<8^70zObNmz5Ub7l2|30i-)>#G(E4LTpLoRnU zo7q8hVAu}Hj3WeZK{CdkrSxOL7gi#EvL_Xh9Nq|C1sCJZW) zD{BbXXC|OaVBe=1wt?Cj=eEUHk^nxRGn`lQ+mNyZbWt}KJ29MD$ z+TwA_R}b~|TUynx-1%Uf)WPOIhJWb2#Koa(Xw-fyz2d433y?}J6I@=(FJe>~tT1#E zCt$bhD|F$Dy=1V=P4P5R6MoZmZ%iTN{DDXyh@E;0*eXV4qbC{;E+42hRm+7fo^I1> z$}F;?N^H|rrerT|7w^kkI@pzu*u#kL;U4I$-P-45w(^qtxq5alTuy{Rzrx=iM|X{m zTbSp&)@6@YapW;dv0MLUp}_I~adppsdH?bM_t&y(+18frmTTFzUCTULHdgD%wr$(C zZQGs4_Wqn-{nDS%r5?}w>vlZ@ zX~8*J>yV+u({-bwU>Q)Obf#hlC^K6CRMc4g9c_lZ{}iS85{T2c;*r{B%hY~M*I#bQ zQS5d0Vb}t3!RiA16j(XF2#$<4m&!RozXCc+@6tBmC4Likq3RpaT3srAyHijO1iB!nd`oh^hH&%MF<=xBV)_k177fGd zHHAwdj0O`I&ZhGca|D*dNgLL1AKuoZa_DNaG zSUuw!;b6KY$LKOD9D`NCQ>n7t^r-f@ke2F%i%~>oX%bjNS#b;bUuexre|6uHTNy;> zzq)Top3t-(05ye~Xy!p?kOtK{xH?TBpSVHjI(n(_1i3!_OFaJ>yLhUBA?3D&d5qpy z|M<$lMN9ay`pIKkowYImnd=D#wkTrRT7Nd*8Tt6}Ir05|+)bma2tdlg&~qA)Sy1g0 zr4Q>-qQ|>_TwUJh)zXaFVY`r>Wg5q%r6yfmXa62n{!}2qSh=AQO1bNZ3&R4zwGg8|SGUSM5QL z3{oq{bR4=AI_<%Hw5u={3c(5oE%! zI>QZ+>lUjqF(shc@GtQHGO~B6G_??PskNp3&jgl|{$~OsgG}JxN<05d;G#q?%Hm~p z&|2PcL>?ox&7}011hUI;JTOzXkkJ|0hnQy4IR8)n*|jTbINRM=OXKyr`jDj zaDi`MMP$v#OJoaD?C3#-#I}x(rq53z_$5c)G17$+@-BBcnqBO|1^O5r*RTwT_M#31pMF zv=XSG&s$EE0%jRq*sUrnzo;X$Og@e8yel8%CwQ~jB+Tc!S-#M4P&&FG)E2G;-OO`0Yw{;HW?U%c=3D@&Vc|2FImMM^# zv@->12bzd7wqY&N{+)=DayEVH^xo*@Nf7z0OD46zC82$P1XXg9)$IJ8m4h)IU z9~k_+H}DOSVfRs-kQyZlC-D5C zZb%I^_OR)lWLxN?AJEY%(WY1x3>5AmbaS3h>bCF4sH5giqlfq7rofjaN?JhvN)OsO%@Y)^nL>@qMV9p;ER`Ja469)h?y@k||SDGRU6+M*-kNl|1Hlua7-9 z=*UOLC;Dy9Y=8($DRv%j>}25jL!OTnDP(BxlxB$LNjf=5&fP@>tfHXXu*|!-%hnMQ zTI1rqbPE4uEyM2hJbG2%`F8~mebGp9_EF>@gn6iVs{J}Sb`MS$H5`Lzy@hcol2NOr zhElrj#p+(cI);8Z_awk4q2l$*#1d=yOE-b$;;&q~j^h`c9?I64>EJ4k}aqMa`KhHd9$Z`w>5O4ra6TLo;sn(2S?5;Qd zfS$Or>8(YcxZ?ZjI%tYVbhNweyPAvQ@=GJboW4Vh$hqA*=^E2z?dNb;FiN*KAsId4 zHD`Tp?NNeSibGk8;@BmtxDb(T99-HbuO0%H zq>>TB9sJmZzezuRzeEPkq>_yfz*jX zg8Mb2(v86A{3|lNxesE$5pXw+j1KUp75?+pMus%wbuOKYc((NSf$Fr%5hXM~(Zgf! z&v?INRQcX>j}PHCZkxXAlJD+PeObH0b&B@$V~Gt83^a2cK);6v^g#-YX#_hEUN#yU zk!zZ{I9kcz+N4lW<+TTzyad!~JvvX-K|FsWtgudji_CE|G2)cFH^ox(ctizkT~<6+ z)#;C;tQgFPrSo+vyPG$-bw@X$@rds}QTbFDR00gbd+OW4QT##yj|?C($kP_ zbXSPy7^S>5aptfS%ZHm=WTO6H(C zAwUKVW>r_>Z=FzteNUj?88AFe$7DMI^H=%hpD|6l8_3CDypV_avOCE9okp%th-l$$ z)8-U5GxT$`={W^XbbsgLiA}dT>n9`kSLoWYSaZ8IJjO+2k$~%9p4a?R!Si++&mRwx zDI6lJAyf$Y7+geY18LdN4cGRDyS+CzkZDD7D_1}QrS)q`JjwGh0E0`t2!wa&R}a|z zksJd?10FbVfNx~J;3c6s6-CEPy4w&R#sLE<2>Ffq`!MB(s`OUBaia(;(&k%|;>}oM zeQvb{=*e|)4Z{1;o16iRq`&3Gj^AKqRT+gBDn2T*rdG%*ZTlpXF*%Qec>17`UZjO6 zW;NaMtCV|0ZV?R7xF?2R8)C3dyLg9tJJQM{ri7PMg4HST@@;4*no>_6{hHX2&!F$x zo5dFFz1^M+r-XjB`|}2|(p#A2-vl`Vwdt)i|`|Xp4}iQ3T+gt@3hV)k&JDK zGmYWJxj|7-DWP-_jWN~;RwRldVr)OB7(%fU1;=^^$1$-rAL~B{T6hUd z`NYPM+oaJ2P$QVTIkN-4XoT4gboLGTz!O^w)RV{`^OmXI@#>}|c6oFp(hG}`=HL&P zDH;{AU$U>cLn8nn;Fm5jo5#u)L|AqhaxeUFLzG>aY_zX=w*Tlzd}C^+hX6zsr_9J^ z>W0{Um7fwdYpA(>&{izOPEr3+oOoWQwe@(?`K~WzW}ZwVaRHE`xs7mEUf2 zv+Oo<>0}ib+1n%?L+t^cRZt5A*w@E2gXwx z`vE({2Ij=gXkb7zOyY{B-82(Fof}Hp4srt_KX8KT$j1%s+w)N=-2u&KE|PtoBds zC>`&mDEeLU%A!iPv4IiGsdgT81y?F2e(Y($b7@jyZC9Cl_as(IQg6LT>alzK0(TML zT)O^eX-mmtPfA71M4z6S0^uAfRjFB=81Lx`as`URvdlFA>bjH?c&CI1613chziXyq zwWslM1==15jXPvS%st&Dj*3EO0pead1LSFAKzo z-{z*D-EpXG9F|~cXH-|Q#FVw`wKWkTuB$UzV_084#||=8tJ80&QpZ zO(l0JDOqC> zv)n{;_m^3g`t-7?94(N{Oda(3tri9)U)=u3H)Q-+o9V1GUVB>ibw7Jx(H1E(U`=jl z;;jTT!;sZ@1)rb=3&42wA!|Vdw|Hn3H}IEZ#%)aK198lWg?*dxdGGcrL(H47ntSVx zbE;)h;&!Dgd1R_&{IK0KUs@81fI4>4Y~GYi1PJ%k+7*VJ*j~O4MoXIb?-`2t@81Lt zUaCQ6^VxGnrAyn>qPHCA^FLLTr?&>4lkNKRP4aub7|rJ3 zRe`>Fjd)9-JVHDsKnG(L4f%KWSUVudqml7$J}+O}F1krr2f7YGP!7-`EYSM;I^f;3 z3-=guj&&~uig*YMW)yHf$m{hPLPi7;5@)i!L!=}@MN>5}rppK7!CR8yOwc~AP5O3j zEFt5?3fgBMPs)x1;%3-oR9T*g3@Kl*yMC#jTY~-obSXS=8EVDzC^{4sV0k*I-<c`dCw2#VZN=DaO7Bl!c^SYe5z0`x_2p3sOm74{I-A79 zQY+ly2Y)n119bQKlM*OCsoNjXMZp;PD$k` z94evb1J)9gq5z5g~+^1Ig*ojX|TPA)^L_;RN!$0); zeyr}b-b!n&7;NBAq0`=oeM!g4dT_i-cKLMxQ?ODH)+yj;i(9~Y6C31k<_18mj#OtN zf7!vJ*F{oRX?l&|6z$wH*%Z-YZu!(I2X%~n2+du~K{{{P;BGpOnQpC#I57)iF45BL zu$d{Xj(aI_5qp4zGT`I>D}a5UB^UI>I`q{B%4DpF<^KD-rA7F|>{rwP9-IL_fgZBc z3hlX;Z7V>)Yr(3exPhM1Fj=15t@8Xt3f*!urI37vNo2{Q1f+|!i=~`;4lTv2ZJ9(F zlumvg!wve3>0Ir%9x-)Yc5*qSlo{0luxB0$kkkB4>?`d7=m{yxt$T)=NN9=OPH{S7 z#aK>~A|deUAJYsimbqfFmPd>qXN2yQFaBc-0M7(gai1k^>-T2mgC*G8Vj1`6Ph^m5 zTx|yr#I_UGiUn5>^LzcgJBK zFFi(EusGX!+lgTA?mvfgQk(hkVg#i3HAMNRV)k|rx!v-1C)UBk| zQ9*5Kk^G7>AjX#xk$4;qoXJ$g?_z}y5VMAAr<^0PjY{&0N#5>5SJ1*iW%>DSGeaZ2 znv^cXp1*FpJ~o9FSmK%O6}TPy6`6AxPB%{w9$}r3)l*eddCNBiL$WWb(k)__XAwc^ z^NLir%7f|3`9t@xqk`W!ny6SE5lLA~y-qj<1!1mjm$e1MY0DKoB8w4 zga_jNlpOkDg&yZ98Q(J%fGYlOm+xU8y(M@Y`!<0sAhpGSw&jh^mj8~7l{|c2oYnN~ zRl|%SS}m?)n%pkRb@k-S>}D{;OZNAxJFt9E)yvFn!rR4nE?KsPwsuA!>}|PhaV>2} zyN&xh^TtSG?PW^x^G2}!(x2O z4(2RYX(dOdBT?u2%}y`O)yanKd26V6)wAq#=lVg{)59SH+JFl`FQEMcz70Pk1rlqL9=v1Et3FGxoCWYLv&jxMb{IrFz;DFf|Rl~DTxw)NYYw)yz=~fN@t+s3-dN^;k{84*gD1(RQ~(S{r>v;t_Vs0C%^TtVENc+Oe`V z{F-{_B@GccTC#WJ{7K*k>B%gfb5>|Ye&w=1wgZ`QRu4>atF$5jd60>w1A(GDpHACm z4_1Ku7Q6uTeOGjbKuf5uM(AuHyaLGN6-0xs$U0DJd%3&qD?`U9NSiU_Lr|CbGpDQ} z^QU4%8E2@B{uqAukV-5;XR#O>1 zi}-Y)GSmyK`g}%iM-b1du{Cv0sjfKvgXi^t18fkW*0?hP~&05ar zN5y;|aft83FCNRO_xCUg7G*`*y{KFqwpODi&dyq0uj?gAUY?;Tc5LLLZsdc$IMdWsBSP zsbHLhu^dq`cvhv6JcIp&I*y>_!psxE%G{Aw2@jG%N>@%ycRGZ)daPcW4K_N6m6T8U zp&gv`4Zm8{Y0H=()@u6}mv$muWq`)UHo38lsuv}|lvdcPgr0{U_XR@H3YeNvBr$w- z(M(#=5Be?fjZ|iiGH;b6E9uj}$K%Kqe#n*6l~vhI^Bz_tK3u*ofs*3X5`g_G@Xnx= zzf9_}Ho%zzf!qWuK`wB98h>hu+S21IQ;Hm0srsttI7M3*Mc24<0?SUk#a%Si?xAgAR)hoyHOSuZBT0`73lE{-W00!6xdMmm)Gw6%A zjLMlUs%rd0D&uf_1!EKH{A)`M%;1@=W4sl`jhSv#$)1>j3Z}L%t9bPcScUdghT9DG z&|QkGzZlU-tSt86h!`;#J@pAS>0S<1p0`e*A;>6b7>u(?9Z2m*7LQst z_kS&VtvZ2Yeq{I-iE?uEvVIcNZtfbJGnb<*z@wYAOVltwAB{=E z536BSrRIW-z2#LQ(?GmhGCVGUz#19kC@(JI1Mn`kVG~yk?C{cnPa?FUV1iX5=y=k$ z-Vn~LtM12DmrEysxSToAiLo`Fz6LVsz@sv1O2Fapt{T3V04$D3m9$-nd1sCHy-o2p zkWt-}o1*do6C==43?qc_-W|EV;AC!m^Z+5-%~5+UYOJ;F+LDzwVX$7Rmh zVFR~GMAyXBs}2gi?2=^uu09H(HyaV92m>-xZ(&XTlfU6_*Z6>#EOm)HMO0|k{PQU_-Af(J^c(v0R+^@K-)#C(_cK-OdUTn zL{7ufSEI*o5*Nn=BflOh%4*-pJw@Na3Ug%7PbV@~tb@zLeh#X?&3@OHm4u0yiR zi~lc`Emb{N2ZhjSQRT0`%29@$n1NG5nAgr}k>4`(RKpZc4WYtlm!V6JYYyxyS!$1H!GX=a}RlrtFc11}$PXl%ZMDE8D_rY|&w96=f| zZOeSd(2;juqlj!_Y+f9bA7ksg!(CqRL_E_P;=e}J6IK#J|6?I+rQ`O;xq)em2wF4H zQO+<=h~&9^{QLTNyU3Ne39*Qlv5Yy#acnbP;gG*&56&6~0NEf-8}&h-(9Nr-*#SKU zqn~yR!qC-#A%N@Pn@lFu!ERuu`1y#5X43NoX8+l@bCXOS4r%IDY83nP?uO4n6(2O( zh1iLt0aE@Bn?~wH1DA#L$fo!$f(KCrhzwqwROVSZTwpLnqYi`S>K{@5;yaBkZ-)3S z%(LB%XIXhSfU0KVUXx58O{gD%_+q4YI|@6*&s*{iFmW(b8jLK#7WmxU@S^8$rUoKN z_5w)X{O(ShQ@8PzLBRZ~H}JZ(?Hp0*oxaq=^eOo!a~nuzIp_988@6~m=R&`cRDtWh|H@Q6BryG13(b9f)b_A3I;Z;>27pNMUOe! zmjdv9CjP9|VCp!-*s{B7Epv=tJp^V>4}4rLWN}Il(6(wB~rOGbWjW+@clGX#0N4ERC`DU`Gogg`Ky;h*+7X+Vi$u-8ycH183M{ZqakL?|9h( zD3b11#sC|^3rDwaECne|ks3E+2t1D6k-jC|-&{2Q>`H~ipt_uL1tG>QkZK&NaLp_F zo-T()&?e}@2kQYqbGLCX>*;grUqtLvAASR8(E4=ttBQON`P$Th4lc4-B zJylrjO=WmWM}cgy_cgsC9Gw)tVYwkD(TW2HlYqPL?MVX~L7le}F}k_##NEWH+!1O- z=zJjq8W8qJJHQarZpb7%vaBy-SRC55I586r1K|k!kd)f1-5kEoWCS7khA-et*}C3b z0#Azc*Es7}8c|n?BM4|Q?|DIsO1&1d#|ZBzGwIJLoB%r~~@D z^mx7M)up6#>uY!61Ng+yUG-?W0Q!qNt$vALmumI{=c(7jMXuV_$)e)s>{##Q-yiR&r?mf<2E_*4!#1e~&RkXhUx`5_w3usJF(vb%HF+5CZOyYleA8M5+TC=RI$e3w#J2kC|M2!Taf1Na z=B^;yT+Y?bSsUwH*jU-`4%L!fJF`C`dj0n5bR{a)niP6y(3sw^lx~nNly-+$WXeFedCWkBN%eVV?07KLa!zDUTk<*eA&>~1lnBrw zi>0D1lh&EZ0gbXKH*{0nGoNk4tr*n_x-WGTo?-URi%}Fp_r6qlb~xHa!N@{nUe!dtd>{Ci#x4#c0fKhQf@#;TPOl$I_oyAJ0(V7U2hKQwlmd(KEu+`7bQ_P(HJ1KVdA;Oa#PbMH{Sx;JEC}>DTIs0;?ZV!oQp6o1eIUy!ja2 zN*1pdwz%^Cjk!K7jmK})Enw;NX$)xHO9p#W)noNF*QxuX%mau6RKk5qq9{=e(kk}b z=`!Qaag7Q$;~(j0H*c;&kex5|jV0C{Mcx!J7RqNRk=%6J*yo#D5{)E5hc)k2&|ys( zL2k%L1p!MLfj_0OU7`wZk>dVY(@KGN_*To~Mpv&TO@JK~cm1)A9!O>rWm25O2$TCa z?&{QHJT?ycvZnM~&oM0JEKE&ZA`9{PH^D=TT`O8){QgCcawEbpZEY7|*miLoD;y)Ok+)(-5rj?>@u@!q^T}lL+jC*qKl0fTvacMPktpVfQ$pn;~teHq{U4 zu{3~RZ`$a<6r*ugp}0gJAYfH6QV4qDNa)PNUlVo5}F$B7Y4Iaud-$bw(j;ay7HwZhQ7sp0{^@S{*DqO zMWTF;UGy~-EhCi$Gx+!jS+)>Y(Yt5mc>v;%o^SlSRN6f=XrK7%NX}wOed1!c-Lnna{RRMo z=azm-!izdmSNAR{EYGiP{bDCy#8D|-i1nco3p4yuW-h>r%e%MNaS~caW}y!0Ey=OM z?9E=EZGIXp+Nk2{#Y{XM?Z^EE?Cd#ymY7X)1L~4bE-4IqEh*_45i69Ya`vHf8s)Mv zy@<{ye}0#Ey!x0ksqOK*K#_-BhymbuGpo==WgA@m%}}_+eLnh@FrzvswSD`-+BG-s zq7V9oeSzJ#t=BD`)X>X)-ZpX~xtf#xNdhmS~1#P21e+`HW zi*J*d|2?|jFs;Hf1&ao?t@#uE7NLMvvNlDg5aZ%H-;Xl{qN&N-?|Va}>2aX&`ab_; zs!S5pmNnR{w~R5R=t>+b1!|qr)Nj<_Mw98KS2WheZ-?g1rQATB4 z929_4`OJ?Vj8g|EAVkXp#kCSoN>F{KM)aFuL})o{cnskjbGF#iaQ&Itb~f;C0qjte zPm{K!A(&>G6F!~g_`Z9m;%5oqOKO{ToPJaEyTujAW|QEU?R}8CD{^UENtL9>)U~K z(ww>9acxCHxmj_tWS$*RSrYN2B9^I$-J=ODhpSK77U?Hr+2a#p1g_q1^M;qUm=fqd zIM<1)+~HS|ej1w0hRc-Rl4e~N$)+=bapJW6}%? z&wl;!4|cE6iuc${@PWtkXcbC$SDjkUq26Y2Z<4v@fs-kaeDl)Dy{&mM1yZ?*?~g0L zL6bJ!La)S8k$WwoA!dLFWSD|+JZb4YsVQK=sd#lKi49AecmY>a2q3s%e&NX zu^>L?>9p%zE4F8Klgvr@gkTgZ@e7BudncOBgj%EEQ;?qQjDQsits1O36iQJ>SZQcy zW1b`~xC5llMml|0MGKL|cGNi-ysz9#Lv4vVF8eRm2p=Utu$mca)z`~&&rcS-DYFjG zUOQGcAH zGE7qwoWa9Tf}*eY2LbRK#g$N>58VltA8I*S#q}^}U(UAF>&DzuwnkPsM&I=AWVCAb zWq#k_9K0l$#M$#~5%#NQ0OmW%BT_zOM>hmP^((C(1u`%@&CB z^nati?S=gyhhqtAxa0I(GxVC%iqM&}Rfb*u=yQQxw>YH-gEL60f+nOamUNxu0|?dh ze9yf8BEL0qM>>tJf*WHJh@6-`of)arUMJ%Y4dUNBHrHq$Xu87dDxiAg7&w{JSc4D&^OC5dYppLt40{mmW+r7n{+dd&ga5E`zaSXET!xb_O{Vnz|(zB@Xkt`CG8kA4Mx(cJ|NVRWA1MBUj%AO@)3Abp}LyT zZ6x6tCklP(O^uq){7mIkP(7Gj4M;dj!9C8dI6g%U|CI|##%{u&e~}WSM7oG%!UK>N zv<=)Ps!>=VvgV_p_FlG$;_T^_?v0%!?l2BSl{YM*t6dfoRLc#m8yQ`1Lht98K( zzpstsENSsyOpzPkSx0@N>kB=T{P>kV{LJMC+7b9%xs{AGW8Rz{YrZz?0K$WkW%{jk zn2P%QVUJ2J`fJ^XFvn6eFKEpyMTBim`8Oh@19ZehGXjFyaW`fo>up3qvxwQ}lSTWO!43;@FH?mnOB-)NzzOA$)@F>85 zLb?S!GOaDGc0a|UBx9?MuD{y^Tzl^+&O7;%PR`Qc$GH{h_VudE);?*!Kty#dbtUIP zE=@I8{SO<@^pB0_2eI*zvXTF>@rKt)g_cHF9$upWI$;(2@?sYG%dwhYssYDehD-V< zXF1hoN`smNI}2H2U|!H8%vCY(O-yj?B$;sabtVpAM-RPCrAIg^NM~G?R+9g%p;bAS zkHud4*UYu=OHjD7xGK2QY}=bA&0g-_-}m8m(PCeBUjQFGi3hZw9{&h2JX@U zzFZI67JcjamG5_P(CSq!p~XSe)X^Mz;0?eUdpRltMmtgB1O8*;g+&;0hI23@P4vY= zF$ZYY1^ku+It?yQ>XU}QfUJt0lT1&bX^x_c+CLt#8qafb>xOu!*YE@i`$;E%10y44S)NPtrundz(1Hh zuLeZPT;50Zw9IF-V&voamu5k@S(MoaX=I-ZD5BLUl z!#lQI7r`8;sXs16nMT&sWWk$0E>2dW$pRi#NbTeAk-gAp4w%e{$7Q*!NnkR<(956! zTMpS45Zx<$DfxY2oeE9AZE0|O+$5Pw86L^ExmL%!Dcn9s2PiRq5b>(=CF``d$M2HV zD_`sxH9eJxGv-V&<*e|eP^9y<&rDnpK5b3uthc$2+EbhwjEg{nupj(IGwGZ2H8KHS zpWh`9QF^+F$+pNJW3HVB-G~>u8#B)Ua-*e+q*hgq? zzn)H;@%04VFRK>z%enc1I$hi&f!TEdY}7`25>C7NTUcu~3`(c^7dR!ulRQYYCg|#` z=kCNw@DbgF`R`|)XD>X^!Ub*N(*@WYMKEPXr|uLI9lU4oN)#^N^@O!H0Rc&^38YND zG9?3u`5$u-k1i7hBL%D1e1GOYmiYWl1-sbt2iVos>n$`=!i4-u^@GgbvijwZkJPX9 zoGA*fT>Tlf;H5ew434gjZ%R1`+$E>ob`$|hKg%rJRO@vA4XU5$CC~iX$I3}xyuQZY zijWtb>@JBl2fror+j{{dvWEiL$P=-flzvYIuF(kIO>z=b0&5D$3wBv7aQXL^P$65> z;lk_gi=bM@*zk?pUTVY~OI-o&S1kfR{pTdx&l_{;OTzLwNYOGW2pziJC~G}^BRfJHjyQZTOO2GD@t^{>Sj@W<7qg_>v0 zBO^Wes~36chp&1JrO%j3KRpPZZA68hsl~MljX{rCdEjN+*YNNwH$Axhlr(j#NL3tOUuF))y;wE_V-&SL+h7RR6%(&L@K_3`a8ePAY zWH?2$wG9E(kdhGQLYga4_YUMS7vA%M7nWo!^lM0a3@6m{#?QE(p3dcK_63%R`?2FV zGdQ|GVo#K6ZU<{|OvWb!?@k4Khi@l=@>XONNW+#HA~IaM3+RzlzZKWESANU5(l3x z3RgosxBl`PoLm5Edr*=AKI8pG+%HI`vwXRBjqeZ^td1*NJ>`4w8Q0iW&1JTbC#B5F zvR*lE+KVy4igG0vdw9uX^BLaBny}E-%}61zu{{v(D@S9HW10=Z*$;%0FWGMW82x2B z?Qbat%Axt~u9D=<@Zw1#$5_~Qv^1+vc-afz&1pt^{4RunTDgFH@)9QX)vl(+g|D?| zH$oK+0hI(jbWI+2=L6=f`~^6!3s)vJ8un+@m%e$|j04S+jKOqe!5aHRJKH3rw=;_!VnD^rnwhjhpeDk>fq_mf{whb$=FMEm~ zdyw(i7S#0~NQboYjPxCb@_nl#_jIuF%Qdqk)@^++N29cvh8E0y@2HJc)sdyuvD9eL z5`W5L{(-xFg5`r@+GxYP;y0b#Zw&YQFw)XlO*dO_Y%;|5o+Oei0~%kJ;y)JWX`~u@ z8wtq%g7JVC=@jRAqUdD94q+0B7_yO1dAu0#-r5iT4OLXWlyJPsO+aH_T=1QW2H2db zPZ4`pM3d~|*=^2to%#YOsKZ3(mnqdyO)vSUG;35g>nILn>5Pf0yIxL&u3?0$!#$y~ zXcH4yPWk*c19~pf?juw-0IU7nd~@vpL; z+Y}GVsU0C8L0ZXdo55&0TH5^-NR4X4{_U6eO zeR-dmNo6Jmn4MW7K>if^E-a=Yttd$#P?)kQC*kzI*P}Rq@0tV2V33v{Zq(SaA z`U^N#lMFZK*fKT|<+`6fPAkYkBTBDd3WNS3K)4^Igk(-?CCg3M1$6lz2yuA0@%DnH zU{$k!*t&1orFZCyf8%oFS_7qikg@<6Gq>iJUL}obnhC(Ms9xxNE8iA_z8Brp>dxJ` z*%(5dycsql;Dko}q;B{TnYY}z;&ed3_=-wv+@p2K-k^&%7SR#Y4sS`UxYk$eFmw^3 z=0Z}|d)SQf%2jMD%k#^Fq`Bz3DAwBe^oFBkmZ7yFO_5=9gKgkW1^A0UU0Rl`MLuzx zUNdJ+pR(|G#~WxTRU-r8let-;X0rM+2{z`MCWc$*t6_@jE^I!urCIzxHS%%4raeMc z!7--3$Uym+q%qUd$Na*!!}Tam4vYkb;*wH`(r6}!;pyp*p}$N&kfX%$@p&w(M8Q{v zA@Ji#cUIr?eH`m}_TxSHpFAX*>BVQ&5*~UAhCXZ;!A38E&ETW{@egMeM*!L>QxFht z|AX!;_nMVvg#1l>OB+tH%tgeE=@$CkMS8h_bafUQQaLW**C!+29_s!(kB_Z2GM&pDai{+`k9&2)!XhL`mo{M2iHw#hxoP_ zZ_F}j1W2`%FA>1Q+xi4I`blq9$2nQ}=;%#+^^frsLE~8^G}sG;J$IK({}S%kCCUl) z5JXg8z$jJ-)-mDW3ODhjP~Qluw9;W8D*i|p^4WcS{)+L#<|Ybh=E`RBZ_vH_+`OOC z3ZH0yRjpQqJ1XamD7`vaWwlw4#jGN!rXy)|iQy0S%Ab1f@-QQ9W=qHRqq@|7wLh@S zPKNujKbI78&Z@=?vWF@72|~7ZlFu#5zMS9|0V^%3ApvV_O9v*?i6OV%Y}u?UJ!$)> zV883JPgsg5iY}5QH1wYl&MV}Y*B}7{6_9B2BXmO!zak9-eE&9`Bwo_+A7G&UUDt$a+bRNNLc68fW!xSM~NLxHshHvB0qn02KbU)D$%=JsYwzhZ0( zojPQn+XYT2#fX>)vBu~02^f7be%~l!@Fq7G>7C7-T4yPE;~^Ps9G^f>`y;IgzP6lT84EsWEwSR|f8{TQ#YZ1Cz|!J`=J^ zX)OmmYz2ptAeOB>VNZBnlj<6@3|TiBNVC0Ku? ziIu}6;D^Iw#cS%t2;qKN-APCH^4-30f;{=&{ZB{5}jnZr^+(LHN!PNpY`sj zxy2>CU|h>XZ=C=w5x;>^yXMp9ew)!3B*gG7R(Lb4FGq-w-s#(`!rmC+7>u|czP{s+ zXx65gmZbBHgw1ttzyfvGy!r-3)W&!|f5vZ=vVqqSxe`VycT|h|EsSyOUW>X31 z@3p0@^c9L5+rzwUthdo!P#IbL0}o-3aF32H2Hz%Fh} z6rh6HQeSR>8=`P^z9R?eMTg8A7Iau-L)TC9#H+eW2-9*PhZy4Ij>CbOBe2Kn5`opP z11Y8gThjyPqF@D)e*`vrp>*Awo+ zfd%RJ^O8n9H)*3J7ZVR!E2}_2tj*8$Ov;MpTkQ(b>9B9~4nj#AU876;IE45?pX~9D z^Gj0}ntlXs54or9-x5MKTKlg*QVRABtk0WZbYb!kL7fWrka3Y6h-B~-E-f$?g8p}I z&8}drpX!rFmAuq>__2ZbIHg!Lb7$?qrl5*u!lv+!L^-^|v2eXoZsS}+427?jJ^hEF zr|jL`osrvDZEsU(kXU8zI_<=hzm;T0jevg4=9 zMOX#ub;i#Ufn&^1`DJ2a7J78-enaF2YIpDe?DG89Qh^z`IlS2&$TrVP%AbI%i zBHpSHNg661aH$pZ`27D7c2`kxZCjwOaY%v$w;;g@5L|*waCdk2;7;LA2wJ$iySqbh zcY?dS-y+Fcd+&2jYxiZedaQ?fs4@FLzh0Akypo*%=F%5n zrG-;V@>wjp`OAt8Fx(X+1lH*}IeoXg+6NnOr@e9YUSh3Y=>Tn0Kf{oC;s9+^pZiid zQ^e|t*&0X{dxS^VlYQn2+4{X#SKjKox{P*t=Ze>e2bkMv1S)ZN8K9}*f(*ZBpJNZw zEe&>OHLFeH!{XiP~MyS?H5I}-^v(cH7c++mX z|08k>-dn(}uc+r`|YyJJJ-*n_ip{-sP#ytW2NV&16ESal-~6FOA5 z&J>!RU{H6j`*Z`j>E9#1GBD9&1lmlZ3Drt+;RE$U1Waho8r#VjeTG}->fw?-e+TrndoSc>c9t7cHgH=XxEGOirgCN|lR|uC2Q~89F znk`fDQnJejU|XfvZ)2(rneJ zn-CDGMmp_ns0}*`LlRIzG!wwqEq7_*bVo6DMHx}OE?6Dp3*{&My#YDJ zzBwL!Ks5&!10e@*RHep@mw4#Es@dT?8i);7WUN)WQm`uE4sI9(-?H#7w!4qFLhlM- za%WuDkBMVKHj<54b3jCGlj7aiTtb91c=(|~zi>3dAs)G3E|0komY>FQAxg?X+uUU= zQ`33+D)py=MwV~!K1uK6<+_gL%3HEe|2_)Yr$1Wn%FCfO!PFX6tQ{3MDvlCD2)R@A zT#~7*iA7k7hfzd1e^1Li?(rnS2Ee~mv16=Gl^%U?Ynm)yHoe^@J^4j_kB*diRu513 zb*Y6rYm?6ZtJbN$E5fvbRv{cdjE@X~Ak)VCeUbviukN28GFcC?7v?o)SHC`y?X$|Z z1>Z|f;R?3I#BkivqGI+ip?C^8C&M=E_wSE{9->g6WO5GNdK!13Uzpw5;sM$tqWamd zdRxZ2XJu55_`*!!RCnooa`U5xAZ^74X$6AIP2VXiyLCpqd1^1{Ke?RT8MVs9R3dU% z<5zgstvuG8f>_aQn!iS=a|H!zoZ(n8H z{6WR-OZb0e+``K>$zbr6c{R3*)w7Ba-1mUg7%mWv+a?U6aWQ|>xV>^iKdGd24POh} zu%>TTeLINo=L%Zhq9set9-(*PQn18siW!2z6(x#@m#}o80ebVKh&mA>{@Lx&5NS zH(eJqfVID1qF*04eCioRaw!1FIMA3tPbyigeHp3$5aIPfnB+S%R3Dz3K2qbC8q1c0 zWwvTA#e{GlWh!eUVp`L$7V}oxhKZaa`Z$ryg@9G$NKeFhh?Z}aQvJ+pZZt}kqX(18 zwRDn89jJOil8j1uHRvfRGf^G@h=N!$pz)`6+xw={>!ONms_T$`t(u<{H}WQA?Ovei zrOdsfNQYx!X*nv}0$q5Qmyq=7>?f9;Lh>6!P28lS1Dw*&8JcgPMfd!t#qk_KyEF45|O8s^n z`)!cU<*{I*df`aopgYnLiNo0lWY6|pQOavXCcM559{L4HI(@Z6{=xF8CU(9L!8qI3 zZ>x`?Bgd+u#8t0i2W4iUSeuNUIy|g_)>tSH0gdzFcinRVWkd`dP?u>s&6GMNZ~G@*O-VzfMHh!clm zqqp(yL3i!l8d!_pI)s9>#!--%L7d!T41{>zQ(;KAeTH6gx!*y9Ar`Xs4I?q-!&_pXtkn?5Xs}ja- zZ%Y|J4Lb|rq6LzDN!{T91CU&u7jWs;@nLOX*|9~tFdXH5i-yMkrIee%6rt&Tr{izS zt*x-p=l(O>&GM7 zx4?*@$pU47tsAJsWhbX>+p=W?BOAWO(?+Y8psvh@))gi`-FF{2`1La0YZ86e*^m1L z+h6Nbyr(5BcnDU>UK|Qk#xf|xb$y6z`ihD41SaLo>qG`ggKyK~#5qw|1`SokXw7j} zx-sD;?yY;FfrR}`uKBWgmKQus@SQ~t168SXvP2%B!0@>CR#L~6eXdz8)0P4U>Y&iF zWIP~*H8g%a-k;Cq40bOM*2o-=KZXt$0xJv|(@*TulQJCnjvj|F`UwrZhw<6YlFcap zgICqVHnQ`9LtFf{x#t0#O?ZT6tKmG~2J2_qrJ7ZzJF;ygg1T7MGh$XIs_jlo8aTIs z?d?^-n3}rA*U(6sHCN#ku5h$HNU$8ccNN%Q^uwGhDo4PvsP~zie+s7HF=OA=9;*r!R>71^K+Kdz7p5~rA)W+iMobViqC2B~gRINB&yfvf@gYq?M z=I2j{v;gB&|DnPYzldFgwJ(L&&6z1Tp#u;Wid7eB&d)JR=;-%iJK4@+iFA-EXS>le z^Df_xp;*x>n;*J3W@U}vL%>m&A#`;=*pZxEKK2cNFtelTEzBidLuu+*5NqP%+BTGV zGbs<{(z-WHU5Wc+fts4z^cTYl^=)qaiP zAK_04ls+TE1em~xfRS~z7RK>0U-CSfaNL)Se9=F(V*(KPg~~g|@qWSb6V|2)d@~R1 z!_t!wK{t5GpQ|9+8@$|XE2pNnkiz%)mIRyB7ONK&V>eM({bhsYJqUjW)&{U&D8&g# zg;Eoy3!Fh;f4S*;KdzGB!L5%}-Jkb3=z*e(&XKV$1km#v*d-PuLY}U|$|=Sve@%Xg z{wMhr``_f3c^ioxtcvqB`7QWRi$d9#W0dvTrdP*aa_xnz<4l*jgBqz-Sd^23d0zE1 zvq?iH#*_~;~X#1Cpf9`bAvpglh^~CVm1P zestyq?0|ZONbEZ}PJWR<$uF4xeGo9R^2NS*i=2SLx5Mn) zI+Pyr2bfG$e5+%ZB@-bRsE2Gbj26kc^KpJCu_elYmjJe{L+iJ{8V%1V^pa8@UyEPB z-{cn!l>9ERV01!-K%$1Uxu<;WZ+j=UPvY?>`K^Eh&M3O7p}wc0jeLJG25UdQIreMd zg>WZZ;(N6!D$Wd6?2Yw|4}1*!E;c9HwESGfuOM^B52aR|9Wx&J7MKbbQCofTO`0-K z0iW|5kE41uu{4j2^0yP$0gebqi!A}yEd~U4-^(&6KZYckisOQk-|2<;Gik_@&IaQO zxs3M$%EpA&W!jmySq$$psV-Qmaj!&L-k6=IFMK1r85U46R_^AC7sg*Lw@QXG@TV7N z_MX$6qtg9+Cx)8e@x_JoH2A?bMQQuFDb^+s_lA9}1(yuX3I(p-9lYHtQ|-F)&i3%Xx||NS96FLnk%AJ@QbeZeqaq&-{_Kt3+Y_;P}0| zg5_EoKylJy=+7GMQh*Nrt%DdIjb(O^^Y%sj2t5x>#AAYO}i%S1O)fY$_(0wF!c_Bka-U!r_A@|N6C; zX_z#{4ZT>7N>8=cte+Ax+memYBtd@lo(&6z+Qe6Ylz;^YHv9+#cPJ&Agi^od6*PN|geIK4=Ui`IaeLuMM=S3bBc=#>w4pUjy* z(QJx&0kqKYsSj2G&29`sk$Ds<-7xi5CW^hEX-a$hHNm9*MM_H>;-3beGn2o*Xoj59l_#4eq zpdHmE#6SBMxCGu%hHNGnDJ52#4d{>9sydB{>F0OC*(;{uQlzfEf9 z6*PsGN-hwqT#XC4E?w zGj;+=!5A6dTlzkFoPVU?gWSS~#Wh86KpJl+ND9ukqAI5rcra%6JRsL_@IA^NTDYFJ z)Lwo)o>p$AxjEs&0)X}|2~Th{tFoh@Ako>34B@vt(f52qNa*9)%{ilPliB`c=qH8(qzs=lf&;JZVP3Rj1pMD))SFU||QVl#1TmW%$-Oj?Zn^K7Q_L#D2X zw)K~Rt83tNTWd-7V$xej1ax>-tGQ$Z|Hac_CGk#J(or{31}|L(-B!#~h`f5o9|cfn zV#1sVD-GQceApl)Y(xz*CuW2^u^lm|ji7(;z0lGdCf{%d7!z(m05>ZIiwOOr%u4p$ zoxx{czM>c3{gG8Co|d_%A?DQV5knog$o=tLxF(`mj$TI~FZ4t$nS(My&{hA5+S zD((-`%erQSyALB50B&RIpn^~0@q{0#&#$!%qyym}BqO`<-*=vEGfHxpGiEiFH~bv7 zofSJX3&ttD{PLz3p`om;br!qk8Cgs@oY<$N0!-0F-jK!kKe@a%R&WPVxS|g?H3=0nAxxzE)~cE|r3c`69WeVj3|A?wH+|#CwHf$W~p6BcI;7TVdEJjOhL^8NySD zCitpC3?6T!1)*s7iI7|2Q`dvZDY~7jm*}QD<0?`0=uM?L+jqcr%p(*Qn5ee^{R@k@zuf8J*%PYp3 zS}>cq*}VC~9@u+PW@mnQfIKXcU`-JULHj-?Ov&~<-GrO#U(NUOtMO_m5~5~?C74_A z8K+?P?RoJcZd#3^dg8`7)h%P&wx{2TKHh^Z>y^4hWF;P_QR%OE)sF;ecQW|suz zr-USiv2~Y3Y3-zCc$dVNhvKiYjKLiWh~IV#+N;u+$mVG^ItnZGSe!80B8NzWjlZUa56CFB z7Q0oX^?mhye@VD@qHPQHSaLH98Jgv`)$P7mAV{2NXbLVd%}Yjy&lZwhkeTWKOY1}WQ!BC#! zrC;HhfaekH0~6GxXvF%~_luq1liFdvr@b3?WS)jg1V&5?XphV@6v;wQAAxvZ@4`R4 zFF8VSn^G@`_st;{dKXf#^kFky?d$>J}heP$^Po@;91 zgV{8#>E>~ksRz~Df)htAS4-oc48Y*0f@A6#z%K2)MEo%J3%Px7=&#rg_O(!bqODqW zwnducBa9KpcRL(07Rqma;x3Vml`lrI8;pXf8a_zISY_Iy<|I)()e06UTkXy2jBTJ- z9^NFf;0q!HXbL^#mSj!X#S?ex425`_tQ}o^ZVZkkreCs$R~+Qw51_p1or}~1s?@D0 z01qn#{3mh60t2md%MLP&T{&{8`OVI|A?j;x2^vYs**xb)JmhIya{$_R@wo1O+!JK} z^I-Dp`to>ZUl%XXxiept-}yG2_tdO!4&e#qcw${}y=}y!sbSV(8e2KEeYKrF7JAQdIGG&u^242*rIDU_;$@U zJFt)|Tvc(YcR6Y&s#(o7tmKK@L2^m9qz`=V*Y>ilMHBXIcZn>Jri?#WAooUf2%oAx@jCpeU_<|@V5!jU{;6OO{#LL~)tt5D+89eW zO&bNr3!w>XKRFa$D_F(Z@@qx8)7J`CG3guEzZGl@sDiCi)y-%-UP*c`PXU;{3`o_~ zd6;uFJ=>*d`o{Q(3S9!J%pxg^J>O^Sgqrvu(Vc!2XUR1GUDRgD?y@kGtGp zevE%JtVQu!!7@8||69RMMrt>{R5Gq^G#Y76zTpe1sm$zlu|YbubAkr)k7tNEY2HTR#qRq4O-){m<`5`G^4KY6QV^zP-~yjA^o-a0AR zx@WtH+$FoDKP-QvsJ!7*{acNwut35~at`-k3^@5zCscPMc< zytZMSg>_+D=wakUsP5q*f|W2Wh-8zT=kZ~+gOf+-^bxJ&g2-!U zxJjAMlCTA~wV716IgUQNr3g6A1bUG{+R)_POp~xcXKVe~Pp2}i&P}&$pecpgTOS$v z%o8i_3c3-bOUl-*R-Ft|PS%2lq%Q*SPr~L0H>P)j(`^qQ{`Hc<%4MqZ)%gYTV38sMmgq?Abhutt8_qa0Je5fknhiE=@OiQwb7b1B z?x%mPHXdVNH_Rt_v zSGYT?rpmCjrh{vp*K{?&)9Z<5-(l5z{Rzhr8BxdfCzkW->Un5`4|DeTO&$M6#F{&7 z=f{8(c^4ElHTVnjM5P_Ok*~QCSbpknal~wzU^%{Z%;LHB7|D94)e-kMT{UfN41Y~m zEx(tuZrRi&-#it;N!5VTRq=zObnm5?ovow5H^4J~A`Fp1_!?MHsj3Rqc>tM|_fM(% z>AyJn9|4C5c zUlUZL*96t>zY^4#e-l)^dk*2(1eGB>e&u(93izJ}Re9Ynq2+Ia3M!&N3F`Ie&dZ3 zH^Mk7Et>}s;)#W&rq{9t5Y^qpBWyfm|A*$gr=p&soqK#PZ!IRHjAsI9>sNk0b@-$C za+LE{e%HQw3UO1_nn`h7MxVA(#zVAC+kMj3b~#YDjGjEnSXCy;9^E#17aJxiUvmAI z^F1&3t{5o!AI`Vs59doB0^)p){~w$$k_(?xo?i;U5%drEblv!0&R0IOwD>RQ`{kAM z?ErDUrct$KVYquiaB*p;yL-+3YW%~(S6aI9?&5g8=dAVu(9VG+_=b->4d5P&{{*Xv zu7877$o|r&_xqf&Lz)Oc;$jC{&2yG0uTZ1pUVgU zN)Gn^*7tIRv?#XMsKLk12#vyg9RUCSjn2-{CVj*Q|F-pzwC&=qdU$8G3VM_h<)(&O zve???#AvzI&PI>UMy|)keKnsakQcnafD@Z_JKXy%^>Fxe>E$VL=b84IzIlfRVQp76 zI+vSQ;rZCnnIC~2`SthypVE(7UHzWAMO}{n!v$xGRid{5Kwfa^UoTjEQO)wN7hLh` z1smcg*DSQCk=sqG9g8XN4Ho_Nf^D5&Qpn!dH$`Quu2TnF3<4~Y!VKN?m|nTy>bsA# z|2G#bMlk#Gs|3Ua&%@vkbBZwFhkKvRKKPBBfB||#Zjp8uP{&sqS#`<@g5kE1oNk9z zeV07!uEX%7N=<_6k)^RDsBFKmM{o!tS#7Ni^(XA?yknP7tJ|RE*lwPVW{Fx#(pLFj zE*Qh#n}=6;lF%8cIy!3ARJwUHHRJ*_@`%G(BnmWo)9O}e!$WLVfRGiW{k3mIFvPBX zuXejiSFoJ27JyQ*4K&Pp$Atv5#fl(_e&O>2$F)>VOo8Hnkav>2+JO%;P(W*QU&&WC z>C&38jP@Lr8fb<6#C!8LM!~1NIt9s^SP@)@|N2%^)1{vYYN7;I1SxnFd$(V%;@~Y zJYxoFJ*i2pb4#q!A5b@j`zJk}@Wh}75v_N;nmN@`U0u0y+Wn#Pp;n>GmY z{gxGKWqfqfkSjyaQW2*>zpP%@c{U6Fpd*b5IApT>(Lw8xJa48BYEOT{+ROfFPsQAX zEz~0y`#ZN=$7Xx1KSv_;9x_Hs(#+c`nK8(ym5rPI5~>ygNxt(2Ajx-=uy-*o^}x}P zlpc!5)<&4grl%}OyBj>bn|cZCmNe9Xk8w7sQ5?h2g3()h0}v8t2!ei17`HM2=YOSN z*MFp6^l~%z(KeXb)U)2F-FvS8L;98X?EWMD9=+*;>4oTc$}wkVm4L1-Zi2vx1-Sm? zTy<2O@%y0U4+4O@ellCMyaK>_zX4$MR{;2+#s>Qp0LHvaaRjoItpffLfK?V2bp929 zm-qh)z_b4&0LT6ofTvDp6Wo;}A9LfH7+$in3{D|t_e>p4UAH845W@e2tSGM`t7SAn zMD@qOWKhUD^BS@Wtelpl#NiWkd?|lUVfF3L&m%)w0c3p&c@z;=cDSw5jI4T(M+BBY z`<`|R@`sZoZ@Pa7kT^bfER>in&X-^T52W^r-v16+S-(k&!n^T1G3h7OeMhoeK-Wx> z-1q|mGtVB^4b7`>AD)0f;90S-BQbS6WvujkO& z=w!E0(vZ4uZ3K|2WrH2U6{t&a8s(iN5d~wbU#(zCisAcjZ5KgcqUvE+{!>v?H~iU5 zbS)h~0z=SEVMW{y8e{{%fgODY*}x1@+zeN<3Fk>M%@9H&5BTXI>qfB@EaXMlkE|9V zG2Vcx>#A_3lD@;3tqVVPzxwiMh*jjXh{ncEV#)p`z7Pu+C4x?(r1z?$A8S6g)1XpL zMf(U&JIvD*YGa`(C1NWsHG0FMuabT<|r3Vr*BrPwFohY;#~>D59neAy2#11@4x2KS=v_pOjts=T@g&pw%~98gGRU zJK27K#Mp5%J{kEZ%Nx@C31JnI(dv%@0tuwI+`hA3F@xt{VK8*YT~t!mrLBOpsT6pW z0AaUT^UKrZT%I4Hpj9%>YeYN%tyjbMBgpVY{Ey*#r}W{u3}pD?{xN*jkM6DiF?>B`{zLfQg9zV=Ym7sP zu(yD#rA)W=Gq#%%wfdFXSHjmN`{W|CANx_u2t@eu?#Ard(WN~qD@(6*I?SG3YH@2= zi_;~Yp98SQxIzS5k}xOxq+ShQjd+mZ+xg#yuLsERMfhv@4&idzM?SW-D+yMytvtxf z*H~gb&`4HB)SslorDOBk_sK8Uyk518m@Yset5rnah?}eSatg}tkTvu*WF35fK@UCq z6SAWFKXHP00l`&CF#xDmYrQ@TBE5|7o-K=cf1MomrSucBE$+)me~!A~7H46;qs=6H zpy=>cJI)RC)OO9!YcQw{XjQt*OiO$eS3chb_-1mZH|O-e_XeL%8f7|COMIGi<|O*M z%Pa04gK3TsGUfM-P>RAcF`JIqoJEtr%_mVjEdI=2W*XUL;leG%3^Nl=4w&t4D#Py< z8#wdD$HLaSWK~RXl!Tn*4GVE10DM|AcljmD)UC5Pqn8{#IvKtQ`O)Kf%0~nUj7y@# z0^sXDc!;I4h8s+Zu)H46P&fmD*-wgaHFfNRp+g6xOso;BacxY~F6C|q*%c{wQrkan zb{<;HPm20kzF5mdvwFCe0*Op}5P)nML)JRmhoK*k5Cy>M5w9xD7J&Y*mFgV})h-wO zw`u5>vpy(R?(4>aeYo1WJ32ii91Z*d>@Va2OMJtvetaI;z%_J_obm9|+z=6;wyUzs zI%FQRPm;AMG*+Jmb2BYI4W{u4x;*WdJl59LHYyT-$Cce11gO9~mi@q+Sz0pU^ zgQuO_ay$$20A;GGLc|}zn}C(*#B8*>Rohcv+z0{o)m?68HE^9N;Tzs*YslBa8T*=N z%>2*tM>SdBOenS@CyZT76L)}-Y?PRQe=*&%5co+W=4x6HrYl>ME%LqTLaPt_!Aa=c zOnEwNN@XN8_kS>5iC0XQ<`vToBv4lne#LYr^9YlpK$vc+@Zhii%hClZ*Zd!r?g=5t z(gl3pM|#C{zgX97(5DYlykfeB{?VIfFCLF<797m>3{kG{{fN#(0if7Ek{02$a5R>d5^b4I_Qy!;e9EF8RgVlSCil| zr7%sRFW&{BKfw)Ld-Sz?PKLSztgO(^tvS2`uvb2vXe0{0i3w9bC5Bzjr(w%;D{MN=q&6lAtKfmd0+g*e|Kp518g!bnodUuH*c* zYvvq_!A$4uHaCAUSc(3oNvTPg)Z;S*fJ zvIFxyx`Y`_uWSu^qF$H(2XB?gS(5fj)}Yx!D8pY#@84* z;x$ILarD^bIbGQko}+vD!dAfc92IKcZxy3C!2kTpaGqZEnM6{#5?{1ntIPPgW z+A$QZD_!>Rn@{j3F8vYZYE>>kf5&@R-LmDk2gfKo`_tf2cUlXes+qtvy7RSa#!-0U zSgPZ$5H~1Mwtf`2#kW$Zb!tb8?ma-bWls!{Z1`fO`{09q{q}kZcI@Vnjh_GU=!D>; zIhY)T=>q;&(|vKh;Z|Uyhy#$)@yO_28mrO$+coi#r!!i#^i-kPD#<4- zy<3e*K-SLsK9@hVaCOLYP`ra1tE~ETwioi}Auj|8YAm1&CnYYxWpwvE<9bhCmtIPk z-{>NWQuGojP$eYw=rciX_UzVt{&9qnJLy)WQgaZ7%@42B0eaTV=fY|m>%E{xnWDbv*^i1%>o0MM8JP!eP|Q z9Tmqgobd+SHi0eCmM#UP1^YtDyx)hKVjlaS=Qp$MGt?~2DT;Ob*k9X&kaFTzpr|zV zDlCJM1yM%Nye;Ai0w5!N ze1|7AhNc+h!Yd_uXGnp}V!5_&CVfkvLBIxDl;L^*I4=o$O)LAeMv$5J?b}2)X9TXa z{im`W+R~hSwj-aoMcww?LW{z|+(P#{)+6%uVk8*IGj6F(*2n?1Tugci+R$|+%Vcm1 z&a%;ipVzOHFQRcXa>12BYtO0+U4oapH49sIL;MZIqMS z4OXTY^R}Y|4_BOJuD5P4FrQ4|2}VmtvTRqK1e5fc(da#h+E#-w7YR;y*TU|~krW#S zlT+8aJw*&2d_X(jxSJ{I+d0(VkzaFgE7?GHMpp(_EnnZ55c51jynpBcI4!A!xVZFC z78myiocP&bjvU=CdGnbO!adU03#&+L4tMzPaTy3@%o9o*-Xm(ALR#RmVQnr-4eyT~_ z_8SozAG7lp_1w4lxY1$vdGBaggh=n3v1nl-{-*UG*w;bQinzI9Z|cO@a#lx{Zi4)G@~O=*Z)UGCDqY7F56iuz7H1)Mc zCws!x&#!?wk@PqI67ROuP#>AkzD}+%mir%QMJ*CA9nmH96f8zV?)tgh)mX==lxZmh zc9C#Q%(7@IG0I)C$guQ(Ds7vfBg7J`UOSl-0ffe`SM&aA`93WH9*sm#5Fh_eANTVd z+&GomdIrGAEdM96>Wa*A6UVVq{V@et()+Zn-NpMfmvCJBDePP79}YgpgPJK3BaIJv z_i4IuOj+lv>|MNCY-3V57na`}aCGZwG8sQhu|0Fd5K&^#Krn~svM{P4t~vk7&#wo%@7lRoM=JTpDDG-majcBPf;`*$Fj!jJHmx zmN+6L!pQ-*kug%-AS}Ttx8Ms1kCNLDq6VSSB-%UQ2l=Z;Ez3O`ZvBgNF5x+q1FTHbNnQ!Gdwsgoh?jS}C+Hc#k{_Se6XhST4lmS!3eRlVwMQ zyvTqo=4Ck_!s;Zs_x#p8w!q!>41)GINV_8j={>}yH{XTTu4=q=9JejWR~$5OzERRy zq#k_iddWUW<9ueSxa%4h8r16?bZB%45ewka$ao_m4V$Dau7D`$tD{*{!n`1JW`xX$ zQ$;%6N-hsk5_mVeXr18{?%QV6i>)R2D>7=h}b^ms*fY?k>M&Mi3q z!rFvJ7IR$BK%6htpD#P(SwgDMzhYPvyEfgK)Bdwq=^G&X>+<@V;muq_2uE34?gS)FdW<;|FAWj#R>2oX*DNl4iM2<@?s&h2+sA{%WU;_Ir|ed;AFnKi^|&tLJ;R!Sjf zZ$@ujfNt7d#FRvbuI$uE;4PW66gPU;$Z&@ayDH5OBP%eePK9%JnC6jGct;99lQQ~d zZYA@yg0829+j8ibwvgQ2*+`4ptU)+`0o78e9RNNI_NLunPI;OkKj1l#z*4wv`in8V z=lAUs-)}a9BPbNGzNfoITXY{E&ani--W2#85}i^VdD-Xjo<3Hp$LY}A>;U&14E-c<)c>a zm5C{F2!XsT1rZ?jl^xYS7Bf4-$tV}=UWX%@;s*3%cVC%MRx69)t9q>CUl{~ z2)6qO8{Esw5umL%NbxvKsuaKCh5C?wj0pW^L-#!^h7K_8oaiIDPMX4SX5AZgZnYrZ zV2+;C)%SVHPmvQ4<9L_s} z&E%MYNEUPcE}X3M=V7%U-g2;9ppD_KZ#ghN*bIN~nhqzQYeb4Y@-fq@d~`OedsnzR z2CX=&IZ^*Et7sX1T0?%RG{d85cB~b6NW6N+%tZRthSAbA>s?u;8ZP6rX}TiY4YkrI zG`-z@_|2m$aWp}I0t~;s;YxsG7JdOMpCrBl?#O1V3*5nBNImRD{|4?%c(hkBolybV z`=)npq(h|IrVz|*|K5f#Wm|{iXz|zA9h6uz927UHXWs{g38yBRQxCTmG5(xktr$y)FKU`42n3W9Z zL4~J%*6*Kt!zdJ-$Z%$)tV0qX$z#>}Jxfw#37;}@@iOe9*xq3q%r zsXf;Z>ouFWk91rp2JcPrgXrGoA#O~=3P!BkD1mD{+>&M{eB;|*6v_X3(Sv|#39~7_ zboR;D#s3Xv-6?|3lL%~P!Q3-%ZN9ShsB~*wsJpk5d!#<+HbWP@fpfvfYcw1Dnno|4 zuQfa@iU8&4C&o+d#m$G(tM4OGFMLbDDc3mDQ%s~Zn!1UoSsI!<^iF(Yv(~b>WFERh z8&y7u*hAF|es#1H#Z2cmwV3_!_(Kz!z8gcD->C0u&@1X2ai5wbv#jip>iG?X`nmyr zqrRVtTWD<^8-Js|(pIGiq5N%aO@M>?zp5`JNcDYKYx%AER^c6tF#3Z~-wd;dlDL*! zLBweCs0YkQG18D&>qaKf;}hWdOIaPMiMY$P+)=9q{d%C7;|c$edLr{!+m^>wa>4*g2j#BJ2m2efK8KpjISr~i{YkNBdo_UQr6GLaOrF!-8_%loz!Ed#TOZh|{UuH>8ACcj+f}1P=5RC>6JZE3yCR2`}^%!$K^;xdLRKk z&-3fWPBB$t6TiQ34mYY}HM{h@avC}0_}T+f^vKzJEx@R#p~~XjtM?n6sTx)F_VThi z5#Ukd%o18ppW7gZ>1X_z@d}LAOBZh9qS+^rXds&5Bk-;yBj4X4yKBeD9|snpXe&h$ z`p0HT$#}lHxj}wlqoS+Jwpx0W?M(E!(_$iC)Lh&_&`6^kbBrVB#{Gw}IpB8k*ixpE z36ov7%o|hj;p;r*NWPwEv1HQG?9B2wXMn=j=HpH9OHvM1y~6xlxR8C3uo`UI@PVe} zncDrpxNx;+r=cXaf}yZ;KhH`Z)*NMW&Que%c0FKH_J5=YXpdLQwy7(~DtkhfWG z39r0_YzQs8g7Mz2^Lm=E8{FV1ijlSs+3ORiU<4dfTR&L9qNqjK3^u;IM^9he>%$^e4FBs7k+AwxQV$rV6m`R?I3 z53}h7XwE5`@)M*4PiILY--oL7CwVt1o~ks;10;Da1nsZlmZe{wZ$Mvy$@?Aq`Dhv! zrM4e<+bIl7ud0d3Y8(w$2uKP3C7ZxaRkhlIB^0joA{@ydZIsH%N+`Z-?Sgy$C3(kV zMCHA_VjLYGzslxOOFtkL5&JrcD3FWLZ)4av(Q(E|$Vt}@n6yZnq*d)zM6+1&5}o0*OYDHRF({#I1NC$!=62TgyNO96alzp2Wg{M4{>@2RwK?K zdCb&GKNfNeJF=wj*fL!eEWx^W#VSNC z%#1di(T`&+tO}UD41`_yp<}F2;TdtsK`)0^Wg_^HF}_Pl`?5S_k0;t?wkzJas61a) zfi9>IpzbWW--rgiD~mQ233pg3Eea_Y4etQ9dJ)qQG@g=Bu=*`B9zxs$i5dYsVliQ1 z-`LC&e4V;Xx@tZY=`z~v)DJ5c5kJICnUvdWnigJdxC)?~eRCPZym^TZFy0FuX~iV? z(8#|Cc8#*(5)yQ_rCP_zZC;d!MmY5rl7q|+ZQoR=K{g#b0zC4m;3Ju*NXI=bGYaT6 zTS;&5a6yh$i=;9+B3CFX5x`qAulX4S=vgcHA>mO>oCbi<4ZSLk`v~v zOT1euf(RG+xPR9&0)l^yudYxxre^AH=m-ES07_j&>J2+Obl^LJ6NX8Kjl$e$tnlWy z#6?sxuX^y1(45ZRx4(L@cShS|3$ILi3y4o|ZzFEX(|xs#E#Zqvp$nkvPN8s1NeXs>S2ll?il7jL*`$VVE6Mz5s_#%)YOK zmUZ9$O{bkG=1WoHSnDOzb?ZnS`cuIx2d|STmcQD0~r3YB|Wont1~O@-yq;jq8?Vu3O~& zS7=lNqdasQ57KJ^f#NxwvMy(1=yjbp3=J$_L;;(_o>JUylf-G%K<1Yp@$7IJ-i7vZ!$0ak!SDjJJThN#XHu5IUy5hR#q zHzOLZ3-OwjDj^qhYbhp=_c<(EV%NU6BH$3vDm-DmRDFpR(v`pGfPAazD_gVKdT-oh zSL%>U24r2++5q{i0IcqoV9zj3YNRMJ#Ksom^oh+%Lu6q7a)+b$#>F4MaGwX*LN5`if_9hqrC3JMyF0Jwuk!-wdvt{3WQt+8%5|-)m z(W@RDnDeR!)4uA#Re$wh9sqyM|LVb!TRFe=U`hE_2TO0%uhiY%ddvPS zhw%exI$Wo>7;fSg&0e4REj?;tiwv8jLh(EEeF!`GuQFY2oJhcQaAFC-TkPB)Q1p3O zOcvgZjdqILmec*0k~9wEvy#t2J-n4s$cskYIRu42?1<pPsff>oD( zBbMg4h&nJR(-;5!$QmfY8Z zdaoXWx)}Y;#icxK2Y?bEQ-9h&Q<`<4!FU+1xwUMLuS0Dge{5PkCS&iMah@2Cpf_!g1fsDTy}7G*|-FEcMb0D?(Xhs@_px2RabY9(bc1S^v$_h7yB3N zwdOmYSsE~YyF0o>F?qSSfV=Hpba;cZ68^KHA+?o|G27>Ch7E0&_F!2Qaytu=ZD zvj+p7HzokM`6mBUU3m$VVBAXHYxKj3SC@<_2c_vV{dQXL$hu52TPmKlV~({=?P$bZ zddpq5fmaG?r&v^2PvsAq&MYUkv};IZZd}^FiTyc0{y-0 zvq9%NZT^Gz;*8VswdhdU2EyyBo(B49LUIJ-PTt{uD#t)K^<(QxQzEJ zPr3_SOisZE#w%Ba#{JApIl^Jv=;uVgPI5xb7haSa^~Lu(-QPMKx7~zZ%R&6m@2jGc z?Q5cMd-O}KBD%k^X~E-Ic`2Q~)*u_cPeMm7er7B3_Nlb^?25A8Rd4L~BxR`X2ijGI ziRY@>B+nV3UDI2@3a-CZmoLgVl_TIjEe=puyFk^vy6E&&_THdgtvVaybi2%-{-Q$3 zL`HfAd)AyeZinoBW;+4kckU#9zGw$_>|!}WTZ-qL+XnOzbw48ee??p`xFV~q#on7| zEgRcU3y~)J{GkDzHIY5Efp+P|%Xc&Bh&iHhz)$=$%P8!GTL2HTmfE<__4ApS%^&eM zG4UVbZ^L}Y%D;=h&uQ=CuP^tP0obE<;x z=joSWF7f=}=3iRH9S8BIr&X-S$u|WrlexRt`y$Zr#;gbEnHs?->u6GZz zz>Zdroggt6x8G}@yAvvd$UhM*fJPkkbeTqUss#2`3TB}!BJcM06ZY34Xcu5O?G zkNC^)XQJM{23!4FyaSJ22v32*P?yHUf^s(THiWSmlZADt1`S4P);?| zwC!*}Dz*;~^pqN_seJs;%oz4`sg@$hfZ-4MYo78>{9QWz_ALq^9@%KH$wVe*yppkrGZS{~VN2)MO zpraC~rO|iO*J+x}dKQ~w3Jr~pe{*u$EvC*tCF-cHi|H}(OZcwsK_L7EvL^4)`)wP@ zr+R`R-8qHQ!5bjk?cI@9%ckrs%nWHdOTKFBjA*&sC^PZ2NqiGeP}x2hKqWtjFvuCH zu!m3}HW{=d1evO|v{QG)SI5^c9NADNXtxh@`Y1G;R9uQIF%!S-B%|O4zzLA4*Sn&8 z>AhrUk8U0uX03=bfD1NZ3X&xwg`3)vK2RH2fbV~Ber_s zzJkAPGwmC*p2}m9Jba+wlaoc3?6NmGb^XeB^(4C!9+q}G21tF;+70fx{;k$*DtvXP zn@V8}H>Gz~!`VkN{{!Z6hG!n2n{;n<9|YudwBLwLKpQBPws0<9veXOXcbWfcqE{Bz zO4k26^A#iy|9*Rt(C6MG_&b#zGM74U_if4-x^u!ACRk|~Bo2#j50E!g#`E%Tsm8jq z!9SFyC{FZoV#TMie#fjJz?UMRL7*e@!g#2e4v2}rR*IB3lE^&JxCc^>dTbf&ycxiGj?2JHb3$ z_Z_n`z5nI}hZ4AN35NHD0FkzfOqhI&cC=B0JG_{?sbb5e<%ElVL>hA&f(j_0!Y0^) zpb&kub@<;(j}GA1Z}J3m$aYRBKdxTlevk6?MTqGS2*7gb$G<}W_G0jlst4KQT+|vE zl4(>pJ6g-o0IgftDD&C_oSyxiJRY28>!6-hd30v$*l5HqQ~!e#y#1FG+$3NXWd4T< zR^H8C-u{aTCWrz3VS-~`yHtWsJz5 zg4uC~?|RH4(Zb`*ufLX$emRa3lc`$IMkO1FG5(>L5t_hP{`;5a;wOO`B%Tzv=)alZ z`@fiAjCUruj`AN&@W;QI;F@kYf zxY8=*!_!CQn~x(Pv2MLCI(SInkH~z%3qmtW@{Z{Y*Fj#4eMZ2t%SAMqldNKEaFI7R zzH1TGPo2)$QNARn_M5tk4t>QI?rtPl-QbpajS9ZEGYnM;I53Z<1FJ zaf4Xc0X(5(ZJ(Ix1Gg$Bt+lD!VwuKUVkox8@#v5EOE$D^8~cE*UZLdw8d1KQs z%H!KEAYx=v44_))g;-@Yl5IAJO&diD4lwVPq0ndGlp#OD(p&7s1ZzriLB}a zN_L|ibyaCY^xX?yT6dKB;|0_In-_fdD}!Ode2>^q_ldJ+wm$I3ULwlD&%Um}xssxU zyU2xlKtoKxs8@DH*t!+~FMQDykg8F=TMC>p%Bt1LneB`)i=cq)s2;?|#2OF`Z=mO$ zKOK@Z_~5;>6=}8=s*BbU42c_}-Uxmng?a32QqJK7q8nN;f#~S_jZQz@6TvuPGW2!V z<74n(1|jb)O+U1n2uvmtjo$1-1`w&7cRS*F^44RdhH*$<1LdYItH)3dwjhvvv*SQp9tZyv_6jiju58R`$Gs51z&Cl5}M`w zA%xX5*uEE>y*nB-<}$)h?J4ppx0~Mke+$A0e+1zGadRd;cRy3{AW2YZV&OO9pxjJ} zpOO=rg3rGJt)M;lA2Bx{kuzRl&jpOhyo`=2Savx;DlF85+J?U4c7eP!v*w4($+pp2 z(T#oQY?`x&yx~^vinyJusSq8fA8h4W&f?1?4Smwtejq&+QGQpRR>b$@P@{2ZfGx{P zTgr%0tF{t`iY4E8^aZonfjmJoBEw>gG{*-`vQU!)cX>Y>u1<^7E&QQ?oi-3H{wV>A ziKXs4{X+uIZ)6NFY_w{s#r?38$L~gBe)3yBYqBCTy$dC@rI3qcdv0(jy0#oDU#Bq$ z@=o?PK^J{S>U(+Oa6lgN>c)-+L=oqh1l(^{+8n>E{HNtJDfzspO7RTyuZWmI%u*L# zFcsj`3A-VPbe%u1E5Gz+u7C)9DF`&*BJaxQ4>q}EfW%l)8V(fGY4Nf-|1JXazZv}{ z0$u6VT<(91vn0HFQ0F90DcGM(t-?MFhmR@JqW=&nu{B$M0zAqBP^3XQY z_5SiYK|Q^%$M;xKp3xd`T)utS=GnNGsK>s$3;#LG13k>0gE2n}6tx8)0InL^Id#4y zakw4;9)Uh(p(gKoa6!Js@*h3eh{%3j5KVx^{~)rU*>e5;HEh&uZ`#Ral~6AI{-(W| zo1E#rM{L9dhYDYgzel3M+&0G?V<4NNg@1MnbVRu?Q7ip1IROdvy{|*SH2>H3AX_-) zN>>DQT}-$s=F760Pv<&tF^W4z(5`+qJ41_X-z(9|;!0Oo=1##EvTj8N<+c4rUe0mQ z3dyVNK!l&|5mdf2`5Q*WO~6emf&>Dxm?P7CsgCuz;L=q%c)};~fr@bs7rhAX6;F%Y zJGVlRz*S6Be$+2XEfw?>Kbfd-i&IjZD#RqqeEMjr}#Rn4{8P3)+A|$}~#$8*hOn6{#6eGBAN5R>6 zo;ZD*MYF29*6$%?<%wl+kVS0rOYws9dlF~trhSsk!PAz(h=Bqg>mJ&Yde11OSaEBv zD8#k*4C9=~wfJld_>^<7wEwuf~sQq+3Z^g>NT+>;ifu@TXqkOc6>C8YQrI zn~WAY-U+-Nm<8R>SfKfHeELnvxnEzEQSBPxGdNW|c~?6*Zi-kpc< z%$6796jh~R$n^W4`#$_&>>udQ26T$Bf|w6rt{?lIm!E}4z!}; ze_UkwY%uU#r#9MC=? z(n}eVSQuS}mUyW|mal)5nRz-6%1R@~1v)C|>nK7l75TG@_k;H<5#w;e7=`cu^30X3 z7WBTL)}He5%|v}PHzL-epHVEtxS9BvU54Ev?0_EzuY?+V`W)%=nveDPwz5LCv+fLr z#L}v~*3_uFxIlKv;2+&7iz|=@f-x8ghFS;lMc?>y6f2Nj2BUf-eAMlTnO;r(1ayIT z-OyFbxMD8Ju;X*us*g#njV|%1e+-QfvvKR3oV}o-x6r$|tE|~iFs8+~uVF4)gu{%A z;ej?x`pCoxx8CgXd}fELkrDRsjz_^r=^0J2<=EneHfaViJja3-(BA-KdHSI+YtXHb z>Ye1>Kf8vQ6&N?e^+m~5yxW%VKal(56-^!!zCjF6x_x?t<%X#%*>HXT*@?%m&oOK`{i z775A!C4p4jp0-O6{CJle<}hQYZSbkHb!a$;2OG6*LCjijO0>26G|G`95@_7e(c3TA z{Q+t4=PjCyx(9HscX)et$Cj0PX`0}^8H(+J?^ipOf@fRMA@;yC&f0Y}k$#=YH3P!w z4N8|z3&z|k`Pgg;B-wRa?JYzT|2sPZ4TG@7_I}o?(bmfVG@wzj_7HTzyHaR%{)3t# zVjl0pi4`f;!EvSQ4x07^19;Mel6C%QZ{Yv1yw1Po_DRm*HvPt@ZQSqrd{UPp^3>Dy z?e@&;k5BzuQqMc9>tMWAPmf$+VFBV(xD{NOIQv>pjD;Q=}x9p z?j6e1Hir1Ct`?@VFTaLj;ZDyl*jLfR1rUNx`2$D7d8Z zq#sz8b0j3p?r;{okTo2=!#W#vp!yo(X**ALA7OF?mIWu5;1C{ylJ zrf%iRU1BrK68r;=Nb++VoJ!-A;qph)P_m5ef z$&D)cXfG^X+dO0{Vk#~=MxY6ItX+vU7&~^Y&lQP`AlMhGkWvfV6@ZK<5;O^FPq0Z` z0P?nVD9s=baY63OQT&JMdON2&%9o@Gl(bMQd48|A6AE{Iazzlx>%Gl-o4>|V)lpJ% z5ga}}(3{p{M>3h#Yu7|F0gOFOd`3Ort_6NdE;V*X>%OU`vYG9}>FlckYiqZP$}Y`3 zvg^Z(36?W4eMxs||9mxrB3$g(hu=#PKd*J}p2=Ft3eXi6=(%}KWwy>ZPBe+3zkjLH z9j~bj>bSSf^6k60)H*Tc3B31Gt>v1NMVqF)dX8|ddc8zOA4@`cmQN@dImD4Y2@`wjI{i~+V&Y)x45QBr5C%}Vq*&2Ave$~wgR;BCNACZ>?Qcdd`3blHW#dg_T zi5w@u-YIIWjvYY6b-o6j90PEbMWd*92M-{U4#cBc47OsKKclNWrEtwIM8V1Bb>P^k zvTZQQkE6np5+Pf|K7Q-3{Zc(TqG2Kx5;aK}6(*KKg}w;B%2O2X%IpEWy#A_lM5LsR zpaB99kb>~)B&VB-$Gz0&`}U5S152dLRD}c;-SuykEZ9IZ1f(>;XPBlPdVEcS*g#s6 zW&(#5zZdjCpWM$7A;yACbKT;kV`56*TQZ=m=wn%lW0<+K^`{9YwV-k%B(06_?7MLe ziS-|=r0t3{tx7V~PMZ9kn8lJpkP)a2^AVGUhw3OEEVn}P+f4Nk=G({`_|2B|kHWq+ zP{K~YU0+$Qf34C1&J-dCNigJ9ST~oNQmvN0mq1tZoGor<|8irdlvq{O`DLhM$XNLbNSF*wXF{` zRDn(7W?Y{0I0+^^IY^;jwmz;>u(!zBFt%o?@=^3pR^~=@Cp;j_|9s=&XjuVVBe|BCRfTOO5qR$D>CWb9)%cU+U#fA0-v3H9e&+r!smA#KRE>pv|EH=k^k1wo$nN|5 zGTq;Xam^pYc(C|C8O8`e>fC=fjE^Dh{$Us|AO6=3rc< zVSMEM7hw$i4~Frte>aTZ{uss%*8g+E_}j{V!7!GT{@XDAH^NwmmT!47m(lUy0eQh2 z8I(XmYJvGb^2Nrn|C@ZV&Hpi9TzvEYnlGOJ|H>C@{r}*Lk6Hi47ypYd{uf{TFTVI+ zeDS~d;{ScV7^t-^aij$kh+0Hw9Xg@gBeaINQs&z~mHuS;l+5_Eq~XN->AqwAA|xM9 zYa#~tb|UczKzs<`sQf%8^!2&k>QG@O)*Ciz=te#H6}gYeqV|bD6g`FYdZ!6oT?jb5 z96i3t13Y)^^G*75w5gQKhEyHzjd9-ruoj84tk~m1tx!G6k}Dk-Z#vc_nB{Y1gZO>~ z6QWTo?f0AUoNu2Z_ry;!QUe1ccIHe7i@~9xp*%YHBw{`~fIDMlfmh%wU|bL7V)Nla zI(BYhgcy^(CRzOqmqZ6i=WE^<%3qZv9uLQLmPhi(XW8FX_yG&Jj`9I2$|h`gnR1Jd z8uxw5aL@ITjqZjWsD`Og=!wirFAT``ZJDA263t=teZ}RBFjSlA#c1cTN2^t(c=3T) zRs&Iufdw3378Wu~q!KTDlp;qTRtoAmy^pHvy-c#7K=veL*g$}30HM5QR%CZ;- zO*HcvmsH3ifRCSD8ji~4V1$npqE!KvEquLf;-iHXkd12v(jwtUW72PdVZ!@rNACJX z_O4pzGngIUEFDly)t!%l-ej`OpZ443LTWUAk|)91WH`z?r#X!tDjcdx6WC) zq6hD{{IpYP@j7*W(#a|0dbusx)QzW9hdQ8IGzAjG0l6G*S;|A}|mz|*>Uyr)SS+Le1k`sXQ4@hFO;0xTG%B5PQi!zj?(L9nUh~%P^P_$ky|1H)l%g=a zUru=V2{_+s4ES6mxoUIW{5{-$G`G`inj*n`bNdtT?);!0sS92HZh<&76ArYUcw00} z>iJp|+GtT-LV;I4=>4hqNVPPIIl{b~y@FVrh=`M9*54$`Y;o#`&gPw6Ty^13)fVid z!4^sFBVt|oEv0`Iu-rD|Q9NgDGi@H<87J45AG=#>Gy6(^va4C!7&V)LoEC^!>tvOUqjqDBOSa@EWr-xHGh62BEBedLV zpG%EfTO|WcnLqO@ul8D;k{_d)ypLCc`drUir!*<8?89?ca06;YH%k>bEz!p~s20bz z66eDxs8U~P$-wiN`T||y#6g{CR+FHjLs8N1E_G_RlHs%a*_`2vqj?jizjoiDeg>_8a z5cDmNN5{>6ey?HWju}1`KaU@@kq#gS1(TEE<6p*nIolv)0&A=VN;QY(d4CfBb-?bV z=7f1x0s-nIC&Q$JZ@5p|LgHS>yEqGA-x=_=NH>kBozuY=zv`5-4ox_LvHuG8-qv!2 zFGU-IASlSF-ftQL2sq#2mXb1aUg9#?+}j^Fy!g>?RF3ki@#@S16Hb8SxNJ33<%t=| z-guu7Yer*SM_LF|7~_uXqZMQ92b(%mNu_0!T^Fm2snu0}zsO z6|*9~wb#kG{S~J>4 zQygqPqPnw-q?nK(-Yftu(0de~v@)cud7>DhY;SIM<%u9!lTm=$Lfl#vbJU#DUd08g ziX*dZzK!%r)A!SI%v%cn@Duru-s3WFd)Jcd6wK>W3yqg%nXr@;nI$W2lA^voxWjPs zzIeAm%y+E!jLyZTA~l?TVZCC#)G}lWZlCkV)4SNJ{^j_5Tc^O!CtjDST**F zn?69rqUP;E=@F)SA1~1vi@=IQh@^LY4w;^#O{N+pHRhY=^D(yjs8*93{85o35N@Kt z_mwrw$xa=dn-CA|ppBDq38inJ)ASqP<9DUHdRJaPlay>aPSx3WXKpksFtO!G)L%J* zq{z8EUmeMj6e3UdYuD|2lxnV?1WM3vh3+-`q0F1v&y?dLn9NSU9Z!|gp2{;6;JJEGRv8jRFhB|*FR}Lr zbEZWn8|C?txd+jjjC66|G5(&4GIT~cf_q=VG`6~Va)XQpNd3TFKnDY)Bs4q6o&&mN zA|-VPw-r?eoUs)Bjl~j6KT#@Xe5qk@C1(v?E#@n=2Kv@^L6;5yTxMmAHmWFPSxBY*+;Iv~r0{d+YU;E%CA+Vux4}7uVXsWvcYRbjiO{NGA9+? zT$TbRO96HW)RYdiJ7WbUhWiqySbp52?n#t{C^dWVvy|fG`#D8Zqzv&62dg^ajBsD~Eik`M7H$ zzo!obQHxQq0H2zX-or!r(t#Vc`nzK3mN(H^+!@k@&-ve4cSOr&N2f@?nZ$GP29=q@ z0#tH?2%DX63m*tkdq2?*hQP2F<&M!TdO3I@htSz-`fQA`E?tKd&nc^)#tl&SAEo@f zLeGO@UrYP7)~oLK|Bedd)@LOuZ43CBc{{AbfxxfxK}Org3Wr<8TTCO*vgy zoN`jV?}m--h5G`2w#~GgM`o^o6>@)*BBr(T-En7ervOAG zPC)<-3f)I=1PO{$XhP#V{B#clWs6gg17&m{#F%NRD#wH`MQWpXu5C?ckEu|3;ieW?1UA$f&2!<)uTCl^1wnHMF*JxfNvM3S zO!9H8sz@+f1_kKY!s&AdYC7B&k4F76vy%O0Qf@eGQnRrXvq31es~_o{t#_xX0qX9i z{sbg1f6iBGlg%-0igD~6+%mk^R0f@V>~=HZ%!UR6*0aShd-T#S<|o!H+({24*W7#> zGvz3--BvIMNn&ZTj2C4WddnpIMGlU%5n+8~RCwDHoW3_%KPeG2qB>lCLtnXs{~qM) z%Mue55Mb)kkNzhm#Ni*+2(l-y4rjgXY)?%==1ih=SHkX0#s;hJ0z_c7)xxSru zc35|PIV31slLj3)t=@;(O8?n$S;MM1CFSX3jeh+oMeCs(W?J47uO?+pPTfMn*i?e) zdpj8Uy}apqbJYb`ZsSfm)+Dlutdjb^s_a{e4e6;poe+OA#j^2GY0a6d@c#2D0-766 zHLLuTV%0>y6F(=d2fkUg4=l@lY&fi8*6&;Pd@}4GQ#>y~$fZ40>YOt+?3@1JmaAvH zm;6$ly>@C3NoV_14z#G?C@SfagYQm+&S7V(L)|f=Vu_jK$Fg2aku4`lSBY|xat@~6 z-qjI}(^wThu?*XJwqUnieokC?9GJmF?fcX#RwvypNSsOV1J4%QeS#FUj1_!+lCBz7 zBNHTpcMukU&5O`ALwoI*ZyeGV9;OS~jTMjPi-lU_ZG!5#+2sZqSc)={#$Vr$;Vn5% ze7CnwpX{^&?Iwp?OjyL7AsNj|cz3~dGH`TdHKAOa{3=(?%G_U_Ow~BnZUcK8)WP9> z%dLTiAwl7pGt{74=h(*FIA`IAoje+$r@KJ%CDSmV70OWj{y?1Fq%k*!!EgQfwIFjv zKI;L&06I9kyc9FvMGx0S0b~BX9%PvWMJ?bmFw_K~HoZ55viov?ual>!jZBNSVE)_v zbFh+Y1-Hc+LFW|im1~U6dIJJR@n4%jl?UW9u!a?o`+oGvAgDufA>?#LI)-Q;Y+GE1 z(v*M%kUbM7xd^>R%2n`tuNSI)=>F+XuSal8BL!AU<~I(5QCX^e-r=r4j&0BXp`)MY zxfL<*QfM76v;#{@#&zH>X^$$FtMTXF4;zrj6cH{Ero^{j+Loy?kYPSO6cd*Y(kQ%I zHw$eurcMj50B!UBK{I3B+|lCt#kz`TTw1&__(xOOEd_z`v@h4>Q; zvj+KGrRQo!VkT>EF;lk)My^{}q>iy2?y#Ntx)sdDO!^RaM!SrR{DOR}HK@c1DlOmf zG671UOUVYv{K%?<(y4Y>EkxGTI%F4O)tGI0Nn-N?EgbTAor~on+}#17kFT6z>cRYB zR)3t`P1NiA2Na`vfi!s+fweipNX#i+hA!3sS^Twj{F5mgG4bYzI9LQ&EbvuuRZveQ zX{`qfySm{c({aMvYv(d+F5;N{O(wV<7=6U zUDozu>4|1MmZ13IL|p4AYvfPLbeD$$h(z;7Viw72s!}3x)f9L*mes?b`3qmR?nR+|7%@%p~N1 zXB&q=CK#HCSTUO4Up`_=4ASU5)SiRE8-yhGLS#Jv(dK(F1-9d?^c!VoQ#dFd5KR|y zl+yRw)A@XN{Cilv3l?c?&-IPs{AR%V7SYveNm~U)k`?OdYN4GI!R8JMA}5SR;Jq)k z4T}awF>8GdJns;DJ{prkL?a@PQ$oqZkrL@e1;aR88iDLYv9P(88-Lc19nulkmmp`D z7$N@*{xm(ui`3(*9f75-0VA6u3iH$aqzGIbSfA^y4kM|q#SSLrg6TvdxCzI2ukLu)8Qjj9`KaPzEN_64qvFrA!3O@(Tp@$;1ZxhMj9H> z6AYOJqV6N_I;d?#({dgd076rszyb!aHrO!;R9xIMBBf9g-hVqT^*OF4DLp!B;cXhb z;>o%2h1=5mQ zpU!(IxVxevVA@ELJSDz(OHJF|Hl9s3Eg5=CpOK3Nrm9K7)9T!OGE`soqp>A<4w@vgmvdkr{8UlyB$-R1Q7@f+Hk$G#PPrC0ARX9^v`&bqx5OuW8BC!;h3pA?` zYy5C(9uftpRLK#KIN;x+u_t{6JL<$R7ht~Hg1{LxD>&Li z?6-4>j;i57-~fCKpaZVXnkxM2fmLxZ@q^~QBoOZ+CttDPcy+7zXDQ84@lQ__nxUY3 z(AF}8j8h2=K33~g0&REMm-;po>SAH-ozHogIf%3i#vGRyUi&KhRDRCCb1mGOGh`B& z%!T7PDa~hkk?-K*QgYQl)j3$-x#XaYvX2>}m2u|B?pC@V;z<<6o++V9fAh7FPB3e> zkv1)rWv7^Xx(tWg1TnDCV3Jr#gxOnQxOAn5Z%3|firkEA&9xXv1R{{$ZRBVPqMKKbu z0U_0-85itB0rIt@Dd?=*?1$g9E{(H)U%mD3?PiEhoaUY>qDBr*zJuzdc^3gmKU5#( z$vA$!&2}JA8fe$Oe;gI=ZkCYhfk`*5uS4b?mmY8U)Te5U<%H#n?cq9tyX$&WsOYR04fUr5WG>wP3?!;)^!-Z{Z1TrMCsPJl@q^KUrxnUH({4h=Vi*0dFjhRp7 zFcu^;4%L=`@-nj)VY`#-k4n*0tIh2yyeTq!Rah)sS`pn#!)g&G-Qg+=fDHJ-Z%fuFOce z%^6hgjjng`q86@x3{rn$!wr`Z?b&m ztTkMt(3R027EZ%2WaeTW;0&Ff;^VC(gA;ODwozLT`%a(YE1^$*zH)3(kF?0r|IC#F zN>VHU8O%}9038OuUya&Hv+r+G}4jd#+aj{cXYo! zC{RyfDY&mRo%h&i*WThv_2d5NW~91yD{gCK6(c;lF6=xL0k2!;CWw=qfE2kf z>rRPn-u;Q!UK%j!j@jFKzw5f91XM~+!36FBS|z6-#1KoXJ&l12&9rpDB=XFm(5**u zyEbe<3<8*ge~nUr@BR&_=vA$=Z0pxC#GOkDJSWcI8s+wF~C~&KtaN{ty)7LfW2N5yifuiYHsYk07{fyE_UVx*!@24jcpHs*B5@w*= zgIX51Ycsm+fy+v~K4h0-<8#fbvqFOpkvGJL*DY>mHF!6-!9h87AEfom?sWc!T}Kbt zD`EfA9)Mrq;{yY3@J#};N6%}j7p+4FRO=M4kYEM<`b^Gt5TW)^oFEwXxp93fRUP!i@<9xorkmQo_4&rA3*q1P-cJdj-@B`z?z?rC+HGu9XU~*2|Kyk(RyhN^|(M* zo_?kKc1XZ2K66vRrV&95ZQ3ht>1Bp;5VduAYUBI#pf65Fb9hear?ZyZ9bB%;$IJ`~ zmyyf!V#%r{h{^?8p7~h{@)6nWBrsmU^*5R96+Y zDWGV{>y3geDY;+zg9%E!}O*n$+<|FF9#ij0x zYu|-0TBM|`(~}46)`Ml;5P}Mj1-s)>XOX#11f3DS3Qn2%JX8ly%zu^YJ{QY%X-R<^ z(@@az6P6tHPmysEaQqleLDM9gklc@Cnj7G6@(k$9v*FZq>hT5yD*IEH>znC<*7iwzq1v=zBtgTY z6nqm-(m|BTL3|vd7XFLI(0S#shRK!-HN;Q1IpUldL1{&! z6Sg4KC`x>cyi-ipl>kbog%E|Pdo}XwbyRXFIgnr!B^9Ddm{GQ>v6>Y46cH&XG!C!? zZ1-I@6d1kljlK40<{hIArjFyK)iJx>;tj((FL5h6s~e1Tck*0UZsn`33%-CJ&o`%N zR=8gYK58$m-ifPwzfF9*+D2hyFR$j2YIZb6smZZAS0LK6yBMY$6@?b2y=j`I9S{fSiG4<`i=#;e_PakuW(I`@_5?-z*o zeNREMm0Z(ZTpuXz6||i_s2E!e2R!0WKmkW9`dbreAK2(PK8MM2rK-Lx<`B=26q9V2wk0e0F#R2vyHkoct zSt$<6ttqOu4o5B`L`~LEbN1_}$uEM*taNm9l;YqLQeeMRQa8XIOj0O{eroe+f0In1 zD!0r_uEpGZSlBF_z7tSL z&1KSdb^;1eS~I)S0R4SRJI4tl?IZ99v}ZG+efF7lIO3p3U?G3;)|B&d4;W*K%aVqR zDGME(Z-*1neFHeZ4Wito%_{a-nsdy z$S3s3T(0<{P$AOjr;)gOh4feqN?PDZ6$8c}vr5AAi6ENNIZ|YN>Nwd=PecI=p-x@V zLd`jJvtRe}caQt?@R6>r>eQ+7`*$YzKs*ksv6L?B2jL>}O+Vk=wk@1arevmN1T~*; zTHFIlKU~QnGjI(Vss!YR3V-tCLjCB?QB5u?F3Zfsic!9;f4Vw6;^t~j*FzVIu}Kg&b_cif>H9x$}x{5Xe;yN&L)Aa8Szctcpf!Jfaz)_*Si z?(ggN*0dWwJSfiXS7QPT27RR8rK*!9t;Kh#%Gf*ta5_BgT;jzz7q1-eCqK+~lJp#7 zSwpRF`k~kLCU``Sjp4=%e#xsSv2!ZW2L8qjap=Vz-8}(hU;&T^0i|=W}dkVpgdi zV)tU&>v;rKfgrFjf$$xD%g=a|vjh z`Rt`33U5WFlC1cKSYnJNX1|PoVGnQ$m1oL-zsoyyu+Dh15f1o0MrAE=x*CVsSZ=dC z5{dWAJu(w%6n(H5dNj2ED!b&(DrvURx7b;iTw6|gHV%FnXrt82R@x!jSebIrD-pf} z#nPev?n@cW^DNe3AY6DX0z40>TouEf%2qeG{ycJLg=`N{_3@Olb$7-4oG^LS#ruhW0bzmE`vx z2EhQuF&a)Fdl!t!h=10A9T9!!Fq?C<>bvU#E-OY2_EM9+;i^@5JxWvab};zLVBR zl?Dtes?cj*u*4CDaWt|ZThD%u@2gtodZbtx=r-q{d-0sxIW|@itOsIxH@=MHnwPb4 zM(_Bj?xE8zB5ehNLBUtrVAr7yf%X~J9-PFl z3VT`2)NvL+vW|tBDZf^Yh2|F}gi=F(TGqi|=&?=Eg(SQwwK@d}-;&Y-WmQY`w}v8M z=Z#bF4#r#VDfmkpmev=`?wW1OT;|v3SJ}j=lZ;}%H2&Oj>#g0gZX45y!q&Y-BQ08r zC{=sbWexe9Uxfg%)Ac0>Wkg0P<}AzO&EFy@P+*UocqQ>zIJfW@EAcQq7L!Dt0G?^E zW$G1jJ0Yj{uLZhi`d{SbP==aM&7iAWQosjlh{8?X#CmEF{v9bL95-EykYy70`rJ%#isBMzJPUyP33_hi(KOs?YIb%a<%`N8@6gl{=p_q4j5ohCCA?3H zqjC)B6=ommPwC0Jvd4-XJ?E~Z194;nI3cP7LH5}I4jc>XG7rxY*01WB<;5%u8>v`G z^e(dzA846D{Qaa9;2I#4eo_vgA=tPaIFBulE1yo=y#?eU!G%b?KRaEHoQJBhn@$&x z)6chr9ydqV$GZ4~P;ozScg=IywN%Wf@c>(dzJ(kW2p8R2 zKZy1rUUrb|+^!#-LHj=ed=UF6AS7H|JdjWhKtpUWh#({HzV6Lm6E-?tH)*gp-0P~QJ;ZFyxC`k+gWFLw5p zVGG#d*+cAEqz)W~-E@rkdDlrVONJ!yPzmbG1z3U0fmreYjNncn!#qGbumnAku!67O zecDGbb}3lODR)O>*1gQ4O{Gq!M5E?gEDx-8N^Yq0qY_n7$j`>|ZLCj+$YYik{g)&m zfKPMLdOvq$B}BnnzWE+yR|!b_))bKSKX6&#vhN;(L${{Dht=H`!4!25(v zkUUHG-se5Iqqv*1DLnevP`%Mw}#=m2PyM8ncZxone2rDFst+Ra2@PMjg1U( z7dU=@%HrTlD+n5MhM2&Qh*POnsE1%(JJ)fqu zbPw_H-;zH#_`GkokEPWao8bbOpFvDq-E?b0%G(ra4r0~LO4T$~!U4d(g&Tx8lfb;h zblNBR4f{vnGtfs~N!*cqXjqQQ!9(HZS z^qYd*_k0$dZP3^Icl`YH$d6+-Bg9t;3to}2t)s^WqYYy!TCrk6cX2fOB*+`*c1f-D zIASExfd@-`v;4W@A`7he(}V{=tsWy8P)|TB3eUeMd5Z@8CVDQXQ?!VE7ex3!$I>_%khe{-}s#G7icvKe9oNUIb-S~3b z3yRnJ8NkK0^I2c!DYT#($lV>!^otek@J>vmLD|X*Avd~QC}pxCF0(F?&I68 z$?ICUk)BEEyoPZR%~52#YGqE8pway27KNEboB| zROv7gf&=O~1u>6JbwUSv`bQQ&@k`i0+A!IAVnXaQ>pSS82g+w?2_-qY1_N79?+GIu z3=w+~abKN{)vX}*86V;j)DQaoqz1(e(ahfZW(Unp%kJF&>@)TmO5StV@Awp&{F;@m zWbEpgvWl3de;*)`9UHhE4s={_W%vF}qn=bHGnX^bI5*cX;aZno+0_jV$bx@RJgDUd5M{JyYt1i86 z$95D4OvuxUfLV>CScm<61~G>(B=ffKW@hn_reGb4EZBe6C9Nd|zN|F_z+x7(e#?i0 zW#4z|c*B%}HAYzL(ST}|G8w@9IgyE17Yas*)3zz(! z(sY=6yt5)u5VX!R&PlwGyFj~6I$ECe6pH)F&@oip&6MI`GT5+2Omw=VfVXL}!x#D~ zsf)w+NzNJ-?LE17+1xGK!#PL)$FVa!cHP?0tiIt=Jlqid5WF7A~AM7!6XUH8uKC; ztFdcit{2tExi#7n5>`@CV(mnJm#5YWm!lt~e6HQcIye6#Q03$!P=}K>wSqGa-#%{J z+?3S64I)BZ>~XW&BEH=NJ{vPqfD3yJLTym8_&Njlmy6b8aZFV-Vg4j?q6)bFv8cXJdh35!*yXdKGuA`{jLc;lbF5M zH}`6Srb$8*r}^SR{Vp+4tM`}9CN$n44s#T|*ySr#^%v$(!*oCTowLfhofLl&Pu0ql z2}}kE2EdIWf3bN|ZqVA;7?2pHMJ$7kZeXbWDB~Rx$x&dh_Yw8%9dzZa%A36LNW7<= zj$!qL4CasUL-%LIpJ~2H!%-5GWvd|NN{jT8W25iwjIjaP^Av=TNCw)J5tqS_JTBdXin&jNF25kI`z1(v>T5^4>JyhyB{W;126ANiD(09*>r$TEhE&Jox!cLiIy)SrI!uxfVK$)IF1$e#@OBy3h(71yKjkxbJRG_gylE|ad1 z#(&Qeq7#xV-=NF)cXSf4U}dD@V3GElvw`eQQj1E`MSbv(9_DALiclvsXte(USBt8A zd!NJ-lFvG`D)os?I9Tfg|JEyu+G19@9@dHNV3~#{cRYTja zj6>T!SAN~BerYX>)vqXaOQ);>=tJ9nx8oPf`AeFtggez0>@TP`j@t$hV)??DgiA%} zykt=icF9sgcVWTH&oyh`M|%5?>UN|JCQpN!b;EzhSWDOkcFA!3yI-5LA%U~~x5zG; zJ6VE1j>?L>Ro;R*L452!x0`^!8Z9MsIFO}A`-UzyZgFf$B_OZa~tag2D@S` zL>{0AMZU{(@cbFTW@p5sGUu9yBG0;Hok{z0=gon>i`?SuAnrhIo(BKQqe=P8>tPot zSOQVYb*0|rXQV&5>9bvcWAfJuI%z%-29Ym}SSL23%e~GR#W`cI%;8W-nN&$9kj#Py zwRWT*pyz{_zJIbkACk$?)qp@NHKz+p^ z_0U+H>@X;P@3Pma=;n$EYtU@u>r5)yYr0ap@PICZ#o8|j&fR@L#QNSpb>$lFe)wRX#h2xiW~Y1ARbOd!T|lBiMzQZ z>naVWrzr6|%9;Qg^?2{Sy;V6HX;X z1o;(;;o^xd?Y$GZmsaYwC%rlt0hHH4OC$0<0ZLm&cHrVYJpz(i8flOCzFaqejmkiTGO#$o+Zm(QazX?I*)kFmQ54{Xze*WJ z)z~ii#&r#IRkEXRiYpHI0qSj3jL=a)KpT}S0VyZ}ZF;K-{t_S0=o-bBXQ9J5&e#Be zZ>Iv`D1%7D^>5l5v73)$5y zIs)|p0uqeOfLan2FN~-(FmVi8;qixW8Tpic5k+%&=kAxOgQY?1r`iyTUu*qaF4(YPQmxqIb4{K!dDgWRMB{}*#&AcUIaP{q2EXwbCcZ54xczzE zw1i$!Pwh_XV9koTFT-0G#Jx@}AO8h4$X0aDsOz3{ zAtqAVI;D-5VM7D1{xIfMk^+ZluG^TZ#iZAiSo4ADPZtgI>_;TZV;;-cjkJWXn!5RT z(@wbT&vYr*7`qHt_hG;&3@sOJ&hmDS$V#PaYMtYS6NX?i+truVPnUcO@dpOIowGy$}U>syzY(6XCbg{D4ef_@Xv8QJFj1Ee*+6W-PMJw6)2t<_-MS2%bDC^tG~Xe zEA%76kNXXAelq1SZ6>URDQWeLFN3<2M-bv3HZTjyO;(fgktRhiil0Kn8Neut#k6oo z8Zd{sH3^A^j#L3-Pjg42tKWzwbB}q6B#h@SoxJ9?U&l?VIPrq5NmL9h``M{+PG-xI zo~4vWPocf4w%EN&0+j@><=j2!I&xl~FXHU;8OR7V_ok;~lbxPEZSuj|J-@?i1f(Q> zcc$Lp3o#}V`kb|}J*e%Ly@r>}P?v$G;YV?<>=y6+F?PXiQ}nlHj8QPOpE098Z=jyp z{@%eh!-cM93l8xUou>1Qh1)=lU5YlNKITC9r9H~2 z`V%l)TGzdpaG9?P)#QAipyq!0AY$#qpFcX6l@~-J-O0CYl|!30u9Qg^Lx>$bIy|4c zB=tTN$Ua^*uG{8tTjK9i&by)u9t7^K*vl^yzh@`^dx(xf4af=hG%ly9ZOqGn5he-Y z=phd?D$2jHW#^0FelE1BXNKm5iz(kI&;(EY!bX?7lQfXrX=2QCIER^BF0|d6J`i8u z{Bl!R>L;y4e5qbhI`&I&ljGd|1(}45+1&U0ZU)JNiPpC9Dy>g=hC+o#TB$9^^GBfp z_5GyUEsm_|OqS?q{7L}`fzDs-)Hr?g_9fzY8xkL+llS}?!7Lv^X#sn-=3tP$>VesF z1R*mM-~Y}`h#4BE{Aw7EEh8hS6H#*QjXwM^!!~2oNflF~GPfyB#`-fH% z`jSNtveqrrqD5DeRaRPLip;6Ri1`j>DugF zYY9%NdRy^^ojU)ca#2z%?(*F7bsf1S4XxY4{$^4w7xdE_Y?ew|Ul$w@f8T@?fvalO zvIk}~iGE^fOGg)g*$)yX@xvn3#b77F=Z`?AkjRls;Lw_rkB;cXc~b{i^@H9ba#b60 z;I_B|vHc(dm@i~NaX%y-{$KRY{qc}A+1}b^{1l#oep!j1@;l+DcXL1g=I-s0-?fqh z*YoEY@NW_MX3Pim9`vPbBS<29_V#(EE|9pghHu9$6B4ccD8GWdWvo=}pApMintM6k zF~LRj=`V0(!VTq}btHOhqsv9^I8>v?#IFvN)snN$x7vZP^&S0)rSxL!Y4{r`cC8VA zZ$^?GAdu#fs?)KNn#ixs?~^+F1(cGK;!3^RxEb`GjFN91#O%zHt9Pya4H>OVK$uBGI!6wGiUbJ>*gB??c6DK~ zkvx78_Pejx1388)IGMlH@mnDY<&i+b#F%PjL%xk|k=eK2!Dd24o=g4xrB8^$O!|IO zkpXVbmVE&|>lEe9{BJl7d>$j)9xJ+?>{dGC+<0~kHtX%pis{w{mdocBY`?a;?)G`4 z9UwehpLdO6o>u+#@~r4O2kW1%-`;t6p{t|N>J?&CmwFqqS9$B#G%SIJbpi%u%RNC% zi!X#qX3;ih!BB0rQ%A6FxLSpRN7-*sq)fr}niFa0t zJ40#^V~yE(#sd|cznm_ocAu*&66y#{YQaQOl9d+H+AK=0d*6y$fh8OEQA%PXn>|v@ z9V4M^?|~u*d9A&YYM_f;t1y;cPI2CH^*$b!kJMY|BNO}7cIDZmE8@;ZvRBvv#(4FN zwr#etMN)1b&kB1~6-ZAqEoeFAgS;?)03CKxJ;B8U9>)Y9vYE0}*$)^x_mTS1^m>9H z*(7EKH794-b`gc}vN4Jof4+9tyjT9R#g|NT{xx$AX-vclG(e#!Jj7tQ;()<7aIZL+ zpi0?eC62Q^sBQRhAxzut)YkDicA|D{^2?&0fP@KK8T zqhK+wQOiH*pORB>PO2`J z06yQTtiiu7z<$?HM7`GO4-U66GJM1O3WJoNFSxeYD7Y=BKAs}xM*vO#7P z$V}5t_1)yt#^PhpU2)ip+xBWO`|nbfEWF;tVqWoUysYQ2bVx9 zm2GCPTXgjEHkSp+PXzlsMb*2zlD$JIn2VZo5#@w{9~LE4A>EL1g@T-hzvBw~E|f^S z+KivBTSb?A+*95(&_3K}Vg)boy@%?+M@h6I?^SVw-k3nRf82x|C)fzLM%ti6eP9hX zgu34VRIZR4#h(x$Pn&=g2ylhmC?1w{*~#RR%ncT(9cCkRZ2RzF(Th&lg_`ViSuD&i zTs>8ykA1YPkVpmZBvJMWY?!UsH}gHWZhu~sM;axMFw%AB#AFKjMeweQHVB0>7e>Ti zG&4tHb$588M!3Ent0t+`_P}?YcfyI;0~@HD0#jq5G+P3-VPG_jK?u&09EyN&vfhQ z=8V7RBG7`4DEie=7P~+4^1#TyC-DBy)H#9e4u%u&y?G7if#EOm=48b3W~x&f*>!Ct zC^}py?}J}{8V6qE-Zh(u&RE|9SU>A!cDwG3J&RsAipBt&Zd3$l28E@<&QZ8>uvj8z z0JJ;gCXoap-?Uz ziN2p!u_3s?7X2jQ8xi3ggOMvpr^M{v`r=>wIuly~ymu&8# z1Yi)*lEW4P>HsSN1pU7jLW>qbe}TGl`Ff?E*jO4R`B$E=pbU}c2fD7fg!^0EX61ue zT-*7t?5{LZKv>hy=3}YS!7Yy~)GR3R2n9KRxRu>8KE|uuDhyqR@vC@x-A90M5qb28 zKPg7F=10`?Bl5huxrtbyl-$xY6haHA?oa6)+bOJKAx^Ml{Y<+E!smZAiht- z#=$T#5S%3e=ohwASG?7o=xtkGl5hMu{=TLqwD!#abDQtN!H5YLPYDC(Qk`Xkp7T#x zp!@?P6^-)r?K~-tMClcNexh%|)l! z+B6+*w2))e9+n*bOuaqb+0G($Kb89}OL#~xZ3X$}H-Yvwo&d&pLL~k_3@GQ`@a+=f zeQBcu{rwFc<|vP0Jv-4kR#gLhnBE3;>{wMA9VtT8;xKKvDPU?B@bl|gfPT`NboBxF zhm4H<5b^j`$9&??4ba%n^HkvuR^m!CZTu2F>PhO31$d#iry#u>*Id5$QU+T@j>5JHa#=8CtO{IR$WmS^` zCLKX6(2T&7BZvwn(g&b)0*N9$jqRaEzbBUj^3v!j@H;*%Or`wod0Bs5o5>ADHADYg zR1H|7mjR{QWgUGA7qRsT=EUW8-b@m+gF%OzSt+F^>f zD|PO^oI^ZAc|u5?MbNfUxS3y3vu&^hmfhcAPPj_T%n*dXn!>$a+Clr+sYrsG&|M>) zY~|NFCqyOooxnVRwu$;y7?%N6v1j{uE^n5mg60HmROFa0u@vVNwCp2!E@i5&-aDwsSD8?nW~lV97N`Rr#fzQneb#&f z6Vouh&nS@c<|5MX?Ms2Itn zKZEIKwsazje}(L@*eZ|SpF_g;4=FGjtZM_%f+c^$_X8S%f8l$CqcbFY*CZ<`{1?81 z#Z@()9q#x`zsr23n{K2Hmw=@2BL7L>B@zCn@48t#D&4@By<1H&3^>uIU8qZS9t^ZY z6t`a;_))OE5?StEjl5Y>nA6ASGOoW%Y3Mkn_z{WslljpOJ zZpViIksSlZW`%L!2w_*AZyTPMVa%nmjT`DCOf(Akc`es(=aTJq>O*Ta>9>mNZh@IQ zy==(VH|uxjOfO3J$aOcioF^R}m5qLnrK=kwcoBmoczfWfk(LQeWblSfv>5$-RrbYL zOly`a_U=U&P{JJ!R7ko(xW$NsN~eSu3w>8FRGvAaw(`x(dJyln6?zBdxUulh59gMUDCe{owIA~HaWF$$SNTu}uy2(vH zifvt-4S}UCurf;p8k4T~8kLe36kj5~j)_P+=caV5K$=o-PTCAPF2cJtZ}M}}o)q+d z9f3pgAQyn5VJyf6U{%F^iHGZX&Rd8|^5e9;e=?yRdieb37v^dl(eJz_7@Y;^Uk}6; zE5}e?-aCEF?z8ui=0sRbq66!Xchry%ejB|EIS24cK-l2APc{2NGP791O%NYBP0n!S zDy%6);R^j9ANfs5=5Xv^A9-&nqbbBk&SLx5NB-#{Kt5Y1%A!dYLRmM-cEd*PNqm1| z3|(o8y?S>ofIQhUvNXi%;d5f+l*QG|xj9C5_2S>tG8sVpgZ2>J_NrWA`c|I0s&xm4 z4xIdlc_Pyxd%MpR392Q}@msr3N`)qUcIJ|e@`dTAah{_XCmc=xGbKaqe>(Es|LVwZ z{_4o#Av*HuzdCYrQo{+n1UOOmnwx=76wE0ChSLN(xR%^%+PM3EY-$^w-Km?N4i);` zTdg=L)&9hew_dA{@%8faT721T2hQJq1sggN#?1(}6pInxJYJM*7oPsm6l956W*M`Q zZ|?{R=r>fFt9)DaAtS(nEB^~NX=fhO3QZnyQ&+B@_)tHM{uKPLV)S^p>fnVq~(;mw!qZx22VQu<4hNGA=I zF8HKny|H7;KauT{i$XW6@XHo*#~W`fv&~j2(>*Phk;ccv_r^@!R!;cDz$Mg7yp}_< zC}I1ZN6M?%D&8ajDHRnZbToj@NW+A5t+gt(9z?kT*tF7u-Yj;r^5;m9Lz+*g`KB{o zf^>4qxZ~TmE%kNnNI4mIShhPB`4q!qsYX zu}ycX&72G;ls_#$`})zGQoLAB7)djzH$t&+W(uJP^-L*;qh)^ubRgCX?!?&Q$q7+~ zZUzr7)$F_99Y`wWQao{vYiJkl<4%=mukpAh9k_a^B-f}4sqaI}==W8CxjqK zlCe(k9Zj&g!8C`a`J=IFIUSR(T(HbhV{=`DF#=UNNBJ*w>GkH#POZ4MxA0ZnxwY}; z71JioGG@iNCmgY~>qRxx=Ed~M6yU)BPC!2X252I5FO-5ap5DmCN+5e*f z$M~xO4}J*7|4rh44!i6Zm`U_D@cD5vi}#XVdsB{L`B8}PmHgRqXL%~(5WU9hLLw~0 z>#@$@CI0_;tkM2?tO+32807zXtW!E7THwP&N))yS14opI|L3vx z`s=Zt{^zmgRbXeW;TvLMs^1o@YeNMZlt3czW0|&RQo!dL5El$ZJ)ECjgMf=bXI$Rls_rQ0^+Tp0q60s1;nJM;*k zrV8Rlo+j*Zu8Z8uc?I6qgWSP!qA|apwm-s}vzrcatP4ofJX5gDz|l6q?k`}axXe=O z5<1v@;nD2W8;l;#ME@4Gsi3{S+8jWpOzKnP@LvR?TIv7 zW+cB@*K4Pb4EThzW)=#q8wp+tASqu=Ab}Eu3oOXeGlGRsyJRJv(=uaG%`=jy?8Ps= zj}-Af;<9)+R)uIqD_asko4=zz96_3-Ljw_MeDn0s4x6Cj{CW?Ber6;0NLN?#5EX9Y zL#C43-M0)<8Q`2YIN0*)m$?c5MV6v(^g8u8WYN}Kzj3c31eQOKL94wsAg(=+PSQnSW_L3+m;X1eptpXlZPvTKF0?#47+pAWx{(=jZsn87S; zA*DKJ4(HQ-JW0_WrtRNcAZL6qbNRFGnQV$jnD1&IEejKFi5^(DH0@>~gu<%BgNGXu z(6DD~yTu09{pf|kOi9Krzn-Zru<&`is`8c_vJy37;G*z;wJe0bg$x5mD`D-k?{hlp+KR zP&s(THkiNYNbcnC$^(I^vdn25a`c?D@O0hwb{Kdr3 zO_fGHR$*M)5WExJ_wjV?RVjFPKsQ*A+&?bSTh+F{&cJrYRf@Tk7?s|)Z;%CR_9wMT zsbnFixQ>r|MWz456QdD?;L>3=Y_VZw{c?7j z-j(M320Byu=DWBW%1ps5nLGH#{GMr$-P%h7YKb{Y2HV#2#_wHbYdn^3yoDGtdm%cO zJmA7gg%4JV-B%udXYe7VV>j`WZpoKWd&~eaYb6Zy>?cfD`N%!7Q<^-}7&V_)D~3_A zvXJb)03(sGH>en`v?JRm!?>mA0X7}E>GSKV%kIvT)3at!@95zGHbYkNHUWMVJIL# zfQ{uzk3LZgL_rjEzQ&g4Tp-rlhPsJD)csQ8oM&bdiN%6G92937KsHd&F7(yq3?WM} zn@79z*LG%ZSnL5Dr9a!q+XB;PK@9Sk-Sgj3E@$6VQFogoQl~~vg0X<02Ona3d{?3` z^KmjUAx9AsLvIzSB(3`<$ckN#j^5$5-DQMf^Y=dURU$1moC2AqR3zXXzXOaUSjb4G z`=`8tq5&j|dKXO%17pnH3^R7K#uNH8hFBjg*rs_4_TXU^;H|}3C~>}|Qrf+PjtTYG z1X0Isi~=RuObnut`%qVke8otq=EZTxJS{j3ugux?xV^JjMdfvhR>Ps)@}bqEH{S2U zzx>8d2s&i6~#@rY2pw&mWmm~-t4Yj^x{`i%3QdVeUX z3BC&;Q-(Ya4~cjbjsDgU_aQaJdO}IZ|EM- zkaI_3jsEzy5;Fz*QjzdWa-bt@-<4Z!O{9D3rm@;l{j~mq?es|j3SSO;oV+M@I`1^d zpEIrjE$BFbvP|2rD*tG8C0#Q~EtkI;&&rM^4I|-B?26 z2~@?_)-WfiQ)vM#rJ>)5^-^6Au7OuY278>HyA5Q!>;N$><+B2MUCHOU(gotDx5dwS zEUS_BIeD+?0;|n2Uhb(+m^K{Bb*ZVH_BLazSigzXt^?}!o`Ou{u2Ia& zEvD1KgdYmLS#gFQhw?Qshb?5f1iEV&)hJfx=jOuC~__(`O8RI=XuN#gVinUNSuiZe9yZOz#i=lM0diHcjUB7f9 zG?HOV%ek@-zrzoR6|-f}jU^dV=(VfeZ65rIaM&$WR2UiFo|NnK zcy#&F9fS<%XVI;MZU$sk-2FvG%GeQ!3IC!Z@>iJ(K3Nb{gi#UnN6MqmylFsUNsH9q z#o?DvXqU#p;Tbv(x1%oVO#?_Ezn0=DNixh&Ux+cRSY%A4aTrf zrnFNExulgLdPAd0#Alb_&*RCZ;vw@-JE2R_c*+R)cUP(I=9)HjHk3gnb^@g#^a9{+ zKU`u(A)7(HD@8^WyDu_QgQv>peMa?3G{up&k(8{MgSr`)YhOFZZ5%3mKO$9l(I4MzEK(U8T^ zV^_o49@!Ava+ZYgsBF&~>0wug@U{{xj#NSLto=rbvR}Y>GC*I9Zk>BrwU6PFRJZqV z7n|Z_qi;06^YHUS17o#ei4xhbc3;a%4=?tSMC$vz$5sl2r&6Nq#OHD%mQo^r9+!Xw zGyGbGv)iV{eDCDrmYajFZcjn5eY$N(${+)Z%nI4Kri>|;Y{0?T>^S39O{;wyx=leLa@~qx? zDl+>)?ml&ny3^?~u)j$FASM5$~; zUKKtgY7x=t=)8nN?#6u!+;HYd>9jOF9&f$|j?<;nI*ZG^94FE3kF#w78@~Ey3%#T%9`-f&JV}C0S?EV? zWJ&?=nxQw@3O&Vl^`B;g3x}v(m5-pCVAEw%6EuzcHL&}l+GRsoLrT1NkWttf+>qM( z#yATJ_p!oBz=}ay`52AEjn$Jn?wQmS0~I1BILt}D^Wd2yG~yThN0LF|vGIYEjJ87Y z0)9w!wDfOvv{IZ@{0!~=VufZ8EUgqfvSVWoJ9_q&?e^^;S0YzsaCc#bLz)Pwz8cr> z5h{TSK?h>2V;S+R+)o^V^0rv@g-#szR`Ntt_-Yug~$sL!{ab5B{1wRy_yBT{}m+%WY|GO$!0=T z*zDaxb}hr!N_q)op&uMgM%Lo`)0G%DB|Z)p$XI}Fk@A2#BM>f_u#CRT7ma0GNmM`G zfF}1n+t(9e`JZSMvokkh`{LB(73zxzA~TsvX$af)(DMOG7PL~UNnAA8McT88*w&C$ zm>*BLT+1J5&+JEdxo`Sx`@uFjd+^FES>l%Ue_N+6nB$EqJ1jt&*@5EHsCQqvd4Ft% z#>4mfXo$M`2RZoV{>plF7kGV8yVJ$}JP`SFH*w{6xrLperVE93G4y>51%DDeRP%;z$Me8qo2U&LyWxNMEh)i&{5lDfJ8PJ zGN=fmGa$f;>tEo+yP&j(bNIst#JfV+{{bgKyNB-^)-AaIV@%cpH&57diF>T*C@gVm zO%{G{Q7A7Azg-%|(kAU%`!btpcEF3s|5f{`6;V2dRjv_|os2Gon1yv5>Z)4?QUPZI zROsNf-xNQ`ir0r6$Pcouh1I9!+z*_+B$P~lnrPx&N&(PN`J4~fg9NGO!OBv7+x?K6 zVxw$Z*)jF7lF^r-Wty+5D|+y&(yFzMqKgNnm!EdyObSF_yTnunTvdKL&BMo#0u$7g z2IE!6)7_ovO+QC$Gv5WC*@Sl(gMGEAWLCkdht}IA-KRdsMOn<(2DHCR+8cBWdMwua zE2r)+W{6pXb$m}lSz{BD^;v&b0-lQsf~Q4)`=*A}?`pjMhz&T7Lnny9TBJGtmv^bo zzd0o+GAb+G>Urd9NGk0C^*!4HvBcDtB6S zYDS!jA3V8L2Lq6Y*$P*W9_^mqoal3agd6Y#y}q-*L46E1XUS%8U5a zz8dYZ@!lh?&-fxXKo<`x8Iu2!T)oD3RPEjd=5A_8;KsFJ(xD|!MyTwl*c@#Vhs6xU zms&~`ew|ipq_-CM^}=j{=U$k9qGX0EQKA=Y&TkJHNLHeBK9Y-(Ow)Q~ifrD?)4R_Z z*oY;J%cAuBGcJn~{W?$Mz8SpO@|`Bxuj&%`z8+FK!Jt!5F^CS2glDqOM&d+oH!LD| z5$ExPi$5UB6EIGSq&buF*_3Xil{pT$LN*4zapgZC%)3$5%Ika^-vS5- zGvtW{0b%^`7sa52S@j=d2_g=T#)Ex(gvlzJ`JFiZeICQxUMspC?G`(gT}5{NAs`Hn z<6jWw1U$Du@-@^2x7Q=LWMe(3UnYaz$Zl?vFd12)qGX! ztQz@oO0Zk8VRlyTS-`mX!rH9xOWE8DSrzFtTKE^6no@hn`5)Z$HwZ8(z$X;rYQltK zgt<@enEZS3QV<+6-&Q+(6TJ7`y2rn;YEwb3cA*Br|b8#B` zojBO(wqiuzaIxvDlg`r4($5cE$=)1Rr;&2pJj$}xN}R=$3e6u6-~z1qH9#ctHg|ul zEU3;n7$2yG8fWi|9UF^`-Dv~ZsB>xwbsG+I>K5gebR_IfB(3j0DpbfEs2f~2-4~k@ zvtBKv>c>%bcWH$C+xc0v5=~QFHj3uc0^0(fB8jF=EFTmt3ViKl(aOoamgd?s#=5b3X6UiM~8;_6f04c?U*r`4IPFT>oA_&E<*TfHmGoWHSPS#Ha|s2gQ9* zT~(MNM@ongJyIk5>H2@VybB#mH6~ZW->!M({Fn7xxZBlVN2*d&O>>_ zvZV5@lju+SAzL!`PwOb~a)z9kTP1B!tk$qkOW;ZPdl#18CiwFPq*&fc~3@5F8UBlf=yzc6>f)Bb>VP1??+QWE_| zk%Aqm1@B!dZDh-2##un{_SX}RnAXt{S$57z#2KG3Aq<1FY}muQb=2;VzQ;{;W;5N( zZXc{oC#S$Rw}`NnR`Bj>%**l}aU6>`I^%xOao4C7vU-aaZr>O@)H#3uM)JtI>&9IT zh%aR$$}F{`CKJK+byKH>LK^9^LUN1#C&fLj`jq*USZ0>%@_Q^10)`Km{kxKLNTIxb zJW5gcK?SZf>*`$Lmx*S&#=qnS-CDE46n?>xBbS)Gi279eauIfT2QZ9D*q3dLkGNjz z#FCC^zXo2>*OyP7oP?~NjJK>OK#y0^msvuD7jeGlTruS>fTE2vy zAFALKZ_BjpL-O7q-?6(N ztGSjk`<$WuPjij@U(NNtA7j<)U(0oHu$^L@Lv5}7Ts;qd7=lzU+Vq1&Oy2xl-A>Pm zyz=e^f@w2B>I>CBIH_U7eUCC_{( z;fhr5{o{ox!@v^<=!0@t`JaS;zEN~5{(P_hzEuKMFurkLC!i;n1yY$_fK;Z1?7ux5 zoqU;ky$#daG?Q1Zk?5(Cm8IDKh?)|uq*3Lbt7Q;qW$G8GJFsj4#PNgh!Jq+s-_g0+ z8{x}y7lhYRdsy2rQdef;=i|qBB^i(hDygSpp#PtS^SWZ*KNsKLHjtBVKHqrS)Z5FSd^9$pbXxp6Y>>ctxr|GR?E^MqTMuzsCz~Im8mDzxWJ?Jfg-`5E0?>9qW>bqc=Q^imySc$kk@>C$h9wY#7 z!Hp0l2-H>5;<7vw#S9;E?VbyC+w-7Szkw&O)g(XAB_uhhExKhJ7xMX9_J_jC?j-`A zs|R7X4j^>^F{{dNzz5x5{1tD1C+GmF(dL>%#M}F2$bAqDNhB!dFNOrx_HYk#dN815 z#c{pD{c`S&-Y)b1Vn}H{JHa^zmH)wz0Ml%c7?Mzo_+83ZK8^j463#?~@L}41H z0P-9VIZR?SAd&+jgoX#Sb0Bz-P$m)o<&(d-^~s#)ljTTqi~o1&M8E5(EM{zReJ3^u`q0c~E04)W`tEoJT2@I+KPP4V;i6avZl3*zq z>VXuU2L9H6%km2Ptbo}7i1!^9Qu>|Dkxb2BWp{R|--JP0jdMUs7WiBGja#C%f*7ES z$Kw-5=_6b#=5@=_JC(dPpa&@W-t%;ZIl7&4&raN<9(Uv-P%RiLk^)b$-j;;l<)f=n z`*I3S4jOSw3G*{hG~H)^zIzr1@EC__Qxh4B{Z6&{UIc1Im%kIIgRM}$KNdxC>ML@? zaq)u1thotz8jX~g3kA(qBQ-&s8IOv_gf#|Kq|vjS2}+Y{{HWZ-^i{w|ZdGjNS&J>5 zMTUVL7~;>D#d#&=ddsqCeQ^eB*h&V!n05$V#6aw*yikEtW?8cn`^D#(QpBr@TTAyj z`9)=|m+*^IoX+85PYY_n+deUkdm>+Vm3 z?n7@3_qat4=P9_JENM5TsC&xxn@3+98IHSpEq&9oGK_SQ-)Q0mPeY=hFp7i`XdpSPa<-96)soQ&)}oI9z32F^h2%$vz&iQ6ellUJMXofwDs$wg4i2e^{Z`oB>)Gk=!65QS0 z-QC@T2X}|ydI;_g2iE{0Xn^1r+}+*X-Kmqj_g0PSF{-Qk%lZj>?6scx%n6KH&UW%) zD!tOQ2;$BGo-2}*e(_Yg_s-y?Cigdrr5(F>F7=iS{La+>tY|BD>`SeVogUCLQz}uU zprtU2m*79GLa9b|Sed^DKwDSPfb5d>L55ZN2=>fZuk|%QuEyBoq4S20Nw^mh6=VEW zs{>4A$Hvj5pRqY#$#6=@PHgJC;L@Kv5{fxJ|G^mO!VMj;g0`M-x=N>y-47w407h`C zp>kMT7|Q!t_3QJlC4!b1+q$o`=};{inrvF&0S82SB1%5RpeS=L5fHJC8q{=+u6G}| z1b3yvlOmAF~KW!GQb{(B7k~YH>WPO0JC(VmQ0&r9VtH3|*>aBqC#1;Y|&H zU!ETe#?VPwAR%0U?Ev_8u{|N~I2LI1$$$+T7|wrmZtcV$O`JRPch;e%plqI^K-mN20LvS#9JF2YKe@qJOc`0qQi8-nV>VH_j-^suxyJQ1+WI{qP&%3 z=b3VvuMiTo;s98$K9p@pJ}n;FB@cj&XPV(RrS&Pl(xw0C+e|5bch($Y--OrOTX&t) zs#K71s#qze(4r8A@18+#O)CQ$I4N@ZQ?n5v-qU`mHs!_j3v@AC(j$D&Qzv|95IJ~h z3-`7=d#beWg2Z!Qbhe-p9U&#>IMnZWep!-7z`N`R#1L zlcH_l@1B2ACpdxoYWRJN_d@g#v-QAO_^G-ow=MLfYVWAsuc-=Q5oFRP%lE~M_Tgax znY23$21TKRXv>O45ubqKE3vCE5-hMG> zQOCTcQ6C{46JdgLN=4i|S1j+Jl@b-xDf$1?YM0%ltphy=p#G!P4h#fowL7GGKw9nY zrBF#9C9%9x-Un5qK2zwJFk;etj(3Qx448PDM%G-_Pyz&73cLx%$DYZ+u8pPW*g;ZW zHFs;81Hh0?7Ik^XD+*h(f6S&RgXeFFP9}j_*H-g&B>%EQDG`n*V8iCr2aH6sjJHB8 z8HCW!#=OHS2kYn3D=*22$=uXOT9$cy#4@xu{V!Aj-<`S$y<`Yj$AZ&!lCfSx*Cz#o zm#$+h5i4j^-W$?9jf5gn6L()@&)t$vM-CrwXm}J3E}}>8-jd5yMLld=SV2AfU|iVd?a$PCwyf1? z+vP$ErbSq^Gx|Ma6nYh5yQRy4|;lqYzrR+jona3CWUj|7t zDQ=#yFCnd&CAt!NzqwzQttIP}t|ixjmwHshdi{SD+nw#hd9hE3HlUGMt$dc4uIq7( zP(r8v^0v@#d8jSrewT@fOSl&S?YpW+e6kO^#$~m|g_LXABMhO`yBo{shN?)^Su5Qg zdT#Y^M9DeJ81u9W@SQ+weJVnXz;|W2zqakfPb1z_ISnA&HYX6P2_z@L1#&l0Gr%2` zH$=BUinRex^r?gc z9@Cj^{&cBCymC%sRAJlF&32<$kL>=5DEz`S-^2@b_u zr@#0ztI5qR*9K2UnJ)(!QP(XRgO|AZ;(=oB*-J1-o8%=4*9je2Z8UOpJ{FlND)MNR zR$3uDLX)jh+2pWGJ+^n8OKSuu@cKRs8P^b`Z8HfG+z30Cn~JT;yJ;z<{)>W`7JSWVJCn2W#9|*vX~7kp%8~B2!XtDx4Mr_8ZPLv&RT}{$eI%16p~1?Bja@iZrtpgi0-0 zl!oJIHnqIS-oq(|oxf(Fd=x(?b>^&)K)Bv-I)@7G(JX|&e|u1N5(Swa?h)nmlRu;) zOV;I(GCQ*Oh(KoSAJJcDopa1EjD1tFV7*yMeSSs%HDh~)uaF!#;*K~1qO;=P;E;w2 z@6cj(1pxC)BRg}uPMm~MW|$GqZc$7- zJs3PZ4|uh!krPHAzE`8KI9t%GYQ;#c!* zo>&ud@9j51-$65+aviS1);zrOvWdSwKV%6wZL3vuBn#I(csrxN3q6nY{>nj_FuGU| z{{-82tqt5Mr=Y_0Y}0!sVT!5QV0ToZuV^1Qet7Z(5>|kIKu2(Zq7@Viz^Ws1d|;je z1q)?vzDRhj*<{4{+9MLa$}v&D$E2-BCHLIFqmX+}xco>17*Yvh!Eh);w*XoL+vQ8Y zbIqzf@#h7QHvZ&1o3wCNo zaRkO%f%~{>#TQhNlsoq`Bu1!MTD|6YcCcN~qDW>2_Y?L}r|_(v`{d2maFQEIiuT^V zt(amDD=-C%{p_fOi%z98(mPbTRY8*-iQ}3+)nHjIpifOyAK3crY}20xY=wZ z_XUjD88aB!izt!yMm6mWo+wTTh_EWa?#Q>eEOtjxuTKxo4J+sK4!hxb;HI6AaZYKb zhK4Sno0WNwr>QH>_}Sy?dYB(gbp<7RaG3uKfSG`FUp`!D`+cYbquB_;kbt%OpRS3|U(E^nz$tg=uDa zu)$%ztv%%t_w1_4>wBblBGIIB@^A!A@&k^DhIl_c$TRgGJ7{64#x{eVr2SPlhXPxiM|u(Gsme6DZqSY9t%UxUzG9SjlHTa|DE* zA%5}&s247s9ij3#jpbEN7hjbKvZOJck$J8EGHK5<^NDC|rSELGr<%q>8~@UltSVQM zZ_X3v0QZr+FAWoK_W#td)YzQUML88_L+Hcl69fS1E41&LCr*}i3=DwI?(iq_xU$2{ zjCr3bi-GZU~G}6sth>FYV5gt!n3V~nv~hwG>Rz)>9$9LEot2VE;aY0z9&`$yOF z;qwOvU^K}`mGMg>TfzcHeR99wgPE-~?s?iFH;xS92acR1fdBA-|JU#`>}w;d%pTiYFEL zW~$FfMbV15wCKc8^@=e=CeKKk72NJ8A2vf^-OQGOh8$El0NRPYge}1IoeD7k|Lmz} z3Z~z*JIbQPJx2anHDS2&(SE7vdM~cjyXNld&0f_jY)NS=EAU18~=VGg%^T2$hfaGRYmI1v@KdFMQb! zKF+%%c>E-ARcg$wBi()m%wVLZbf4g&+)EaXzn)P1DB2p=h!34GWSQ;46Y7e|UV}um zg8{zD(b534sXMnfU*rZ!=^cIar66<9>YOyNIz#>}&(M8qZ=_9TY}hu;<2HZ5nWGRE zi!?Vey0MPSVzq#7p*zNrW|{TaT~_%4%Z#Q|b$)srG3|6hS07bx}NKq~zxb`;@{8 zlY{c@d@C_LaigAZ<}7{N`CixD;=6Clq}t!Em}|cA`v^0!0VcuIEh7bA|FrDq%YP>X zrp314_TmLk%{PB!K@Eief~pgIB&NE`pEWmY28vlzVE`g!t%9nqv)!)7M=>QxVleiE zIlo0tWWC6bxT{Ban|FIDUeA+I+VzsVFz=F1;Wou@fr1{N0Irc(mOPui>*cKyV%<$7 zy|H`vp7CCIbZ;sn_yN~s9Jq`yG|Hrwe@saEx3>0k2VyN#WES&M?kXDL^@a5!L?Z?I zFSR4g#sTLgU{(6q@#M3ohYvcuE@Wi4q(gz|rm_U2Da+~b7_`WWwC~sML8Kq!bY)3v z5<$6yBRMg;P4)Di161I@lri9!h@S(;GYRnppGbC7Fo(X)D~R{t7hS)PsV96>hZPEb zY4iIefKBME6xTBsOQX8>GVLM8#h~NC%Y6bpR}DA}`gy`^vl=?p=NM*NMOU>j*|BbC zy&->}==6x6iC*|akwEXHyS$<`7XE{Gl0MrPodN69l&3q)wZ}bGln6Z}*)qAEc&l3c ztb>>m@n?eZ!wzq_lijE$*qg2$g8A5@zzSAN8*0>61YfdIJ|i0lE?ycIDB-V0%rnEY zfJOkTBgmHtxz=nVz9s!F&=scxi`DN=a6Pltj8@#CT8!pW@EslrHVp3mycDuYrIU7ag<;tA)KU@OIx2aB9qIRG;|wQE;lw zLe6eRiQ~X0dml!LsA0_?Rgb_V!WF{Ngw1z;lr(h^_w)3b_FB)WEoufv8$5auiq z6#+dQbrVM9W?dNMD5pi&Kz2=x00M+Bh2v;yDv1y zx-z)VYS@kDC6_1ADb~S&VDw4kX+rWuc@hhdPnN`1cn~ubVm^uc-{69sk68`g&*a9^*J_V%TyPrKBkVGCVP%G6r z#y2IQ{-}!Q$sMQns)imb2@AAK)d*`HJ^dz&X!tsg=$JbuW3svFVe24C)*5m(NRkDI zE=;^F0g_~mv)6+pS&aeRQdss37V|%~wcA^c=QOJWPJHf^1xI1S8~Ii0;X7aWwJ-F~ z)mGKbklC3(3#b87clm(V{9D45n(5Nl(Z@jpw&CGb<=l_k%bPcFzNM_5Hb9(US}M?r zg-|dpsiL-ZL#DvZ=O&r;pK6$6+1Z-Lr5D3P+R;|Y5d>zL4DMoH+w2-Bmk_vNq(UkT zKj@Me>CnICZs14BpT@a8`so++i}l!gTWNq(dfNe8LE$QZ{{uC9y4Q3>-EPKb%z58U;nHIZQD_;)q||JI!p~z?o&OyGc~73sq_)gy=hXby0TouFiYvUT8i6 zrMmJ#;k+t3CM3CIy_5YD+Pjz7DVj2$qVx5ud?>8i4J!eSfCWP%H!Le6rzIMq`RGOE7}>SqcLCq zGmm%Br2&-4(7=qV=SwS#>n8n|$e21y;u83q$f!d6o5*P0eFd4fUJ0Ymix-4$x}pnN zu#d0*nzuOrnYV`S?&E*|$Gipa0gr)*#Y1Z)vBm9I_&e!R?9Yv1B%*P;V)_Y$;U?w+ zGCLNj;Za~|zW`8&ly>hk<%Et|e#-QdEXJhj^UJqvWRu<;QI17Yv%q}~z^-esNigOc z%AV4vF&bCATfH|DPS5w>Pe%u1o$t|Ef^w-tgQ(r7mKQ#_o zMb4i+20TA>Zd^Z=!dp)!0-kr}p4br|i+O6;-o+(+4LEN}Z52C%W%|x_n;{8fOlA*} zn$XI)Y>tOqp~=JE)40g;06pI8Rx!|QsZ!uK)FD#q$I+)p2_~Jx9O;#0giaz;26hgX z&NAGt%|_?=bnZ-3lEuQ>e`?4celLP*O;v#1X{nuPQL}wx@=EM+A2??|f^MxbtVYB%_GgIdI643H^=u6{ZHL%7!#pNccH249b*#B^Rt;SqTBPd7ggj>? z6&0A<*)TWRs7H6@=vj;=m6O1?NekDP!Rkv_b1O(6W*H5VXrLo32%12%qMQTXf0n%b z>ssE~EX(uS7FV1n6nAufM?8|s2r1|XWisx5KvuG?fif9H97F#y8DB=e6LWF$ON0UX zI$&H>uCHra?3ryQt;e;}c!NNyErH-kX>5Vu%&SARr96D` zlNZd27j=qnMMyK4hf_K+Pwou2QuIpI#K8)Zu6ayKRp_c@xQchg#U5et*494x*MaEq z`gC@#B-Z04iowneV8p$e9^M8|%q5lW+aT4#p(MM_C{|EXA+~g<6`~QSHCieX=+>v4G zf8mbc%l}v0G5Ig#2}08os0XOzx7; zh%8zqE1J_)Ngk>7<=@}5s2o&qJHEXM8_FsGs;$q|e6AMSR;izeLQ7`82Xrv2KM(n< zjAFD2Q-BoN@5%G}3+)^g(onVUT8)S_p8Klz?HYT#OwF-L4vsB+1+zWP#Cbn1nw)O* zw=(ezx(TUtuPsHW@&tiwg5;Qh&9kRZJhU5^BR0?4NI`q_;A3FqcV>xPXt<4>a%QAe z`6nwgRFCeBOiHU$LdM{ipwfniyIK!*LfDkk@g+Vhc?zhsfkGNP3R+^)QO>v#sscZWa4=-;n6&TnzIzg<%P0I}8Hq6DugS5sQ<~WtR8- zVW7o6GrL2ob);IZ5B0uZROE3OM?!VWk;OKro%gQfYFA^k*fbT0fXsSq|71rRn5*6DFB2`{ zdTSxpzCj$Pxsu(8*U{$Rv-+WF)W~ILNW+)s(&41b4c~}yZeo9@>xiV--2}hcqU?(B zX5oHuK5#erA|P;UcsCF5sekh)atKZdl9RsmWT8*=7^PjGpE-ArzS4AJ^U!Qn3w8X! zS)uaU`_)Q88vztC!%P~IQ{M!rfJDv%h_Jd3 z^-zz#rN|=Uw;#&&wHF$K+d(!pvZcCnyUmeYP5td><(Ob1E|2QUFCY9VdopMEZ`Xr5 z*!D;C->wHEUlMlAVhTvo(kKk9T zlk`AzeTRZMY`wM0^42>6z}H5@Z)&rX%MOgo$vWE==g6i`!u;{RGPjMGGz~OwzCQFP z2XJZmjn8vCmCPr4qmAWuS0^4!`1BHZ$=-eD`gLMGl;`PU8^RG z=6apf@hS<^-3tte9&aPRE4grVdtpD7)Wu3c%s%J5I=}81!s7!)dE$m3K}DE{R0Z7` z@F-CYBp1c)VjnCFfEnLZiSHQ(FN_teT^hEz%t=2x`19v{mAYOiAXfg>Bbev~6(3gs ztMC9{R@9JHp}0ZWL{?yYv&E0$WleXOPaWRelToS$;@(L3nfM2`nRBc>aJcR;=q7nV zXk)|O9Tki_Omxza6(>)E-|*TeVsr^gCC#55ZT0K^VUd7iY5g_pjV6NFkpL`m8qNdF z(wQ+HoM-#awT+E0-~7mv@?IY=0I)Z05t~nRK?fFK6Dyw8!62s?il4Vaw-?j@?4H~e zzQ01f`Pnk5JoKIA-W}rp2V*3jDHR>C@a*yFzgH(dXSx%QLV>>DlnDY z02uh2n`Dz5YWR&9JV_{cIjXz!xIW`P$Ioj)&R$332R&Sz3r|WcnIGVX6o8~+Lo7=) ztT0Y<9;BakwDA5)#pe0EfjPBdZEy8On9=UNU>*#Zlw*Q{dHWD;*+`d0A6);8Vl4X* zub7C={x^>|)}f(nt(4W@G%3(uGdPNj9@7dPOKtpS67zglw*A{Eot}~tv^^9I@Q^vN z{6KQVWU1wrr@^;5CBcixI?xOUYfz?w;~LGfSAl?&){Zx85Wy5)pZBVA2@wkgLB2_{GTiyRXCJw88;Y zqxRC4nE%?%rciIss((fqq?Xc`7J%$#Bo_j|r zY>8l$Fk5LsWHXXi4c^J^Dy;GvYd{nj5WnX8hlksXsjWZ?k-<;`W&7o9jK%ZZT8+Td zuXT##MR-RHwpy%MkhR@)iBash!Iqr28LX>Pb}{SP`OEmryE|0rw6EIeSBsvVc@L!s0i`4as3|MXHE84PCQb2OAqzJL#PjS)J`ku+%dTwO}S1NAQ{IkhaHR6K=bLnu2No-pwUI{ zt1H66vLlAyZ{S)6MLPI*phqSJ3za>^T2FuypqH0&igFMiT`^{rZs?Hs;;$x+5H(p~ zMI%Y$IubaXNkN47m`d9G=a|yS^NTuAQ)-4Fk#rKhgm+>uQ+t%e%OdbdQ?Q{fR^%WsXP_AK5AqF zXq-hM3W#R`%nQxmQhylmnQKuTcT1<_N$9S^WEZxq_E90?RAlkn3@`tXg_W#%4Uthf zkeWxg75;hisb@Fqgf*?RfPlVB!2XVQ=R*$q)?FY)q`F8a8O;9lY_8d(2h<`+m*KZk zwDO{ps+w4wrkJ757PdT+fPTV)fIF~`HzwwrdR9T9Bphy}m z0ov)joK`}Q$LW9T&<=rJYt)p0Z?QrG5El=qN2*<*p7W2e6E1h1b)g?7$m!?!j`by% zu!qHU^Q!NEt!UAKpQkBLO^A~Q*Ks})R}nr{aG*gTA_~Fy>R1lK%C6N&Wx0|mJ>vU_ zrT?Ke=6y~wTY$`Kd{q2Vhcukfzn_tL#l*DaPE7C_P>;E9^5>yogh?HsaXyF3c)t1N z)DCO;-n(EyUwkocEA30W&x08!e%?$>>&av75@VAGrdOA`H^@qDo!*l+-@|ybYf`cg zNUwY%!Jd4@j~TE%DCbE%awirVh|FeDPRnlD_}Q`>j=Rp$gTVBR5gJD9jauZgZPerS z6EDX2X9y0|cBe>&@va=P{%M?KMqr$UfC;da8p>{F?gfhbZwlsBH+2E41E`7vTD!J- zk3tB@tP}j3eIXl=tsg(#pU>p{SAFqE7`cbHYrH%uw1dCZ7BpPq#=@7m8t!+_Jso4N zy1k_6-ZHu}v-^`x*3eUdCFC1ec0K8M6+)sx?-4h6qw;FlWBk#L9qs^1ut8ybTpFo+ z{LR2*d`Ixn-~O9{sbGTg1^lN2^PB6A&$7opPswlQM(}S3=9lumzFk==^K>eXuPYRF z$>i$O<$ESIYEyf{_lzCJNc&-c{Ygr(zUgWlT1>J{t$&G<^hvyo(yxsIRLa3bi$L|< zs8Hdmmp?0u7@`=^#AB-?Ld3D(t`=58rmVsGuOCsYvnZz4TL3)9H8_$X*Wm)MB^6@l z9dy3(4{}*NlB*Fkh$UEjBsl{)g|Lm+&ZfJ)H#g8ZWhyIIKq8IxYdHeB^D!2W21zLY z$Za3^{gEOQRuh3wkbuD060u8SYZ|J~nOv_SA*=%y@)e%T1WHY54=*&0w}y?IPoE^) z1Ix4gSVFdEMnR&oi=37DBlnqW!tZ4-CpGRf(v}y$v?O;lIlk<2; zry%=PnLd)V-E`--3jPt5MewFQX~OyllXb?$JN(;`HUVi3f}(PqE|C|8p&b=!BV){K zQd1$5zH5IDNAUL!X9~P>=GAV94N|#5bd2llLJBDOHNf1@?^Ulh(MKXZyJ0X?Ur_Bt z8TTw>S=*6jnxa9gXK^rDkxWoc3HFF~Wa^UATwkYHB5~5i#(D?G@?rKPCUlXYWm_ld~t-aj20qDB6E(2YCLjee+_96{rs>gzr+K57iS?Pa#I@6gY zq{)j2hXIx9W@X%$+-u&jhyW;rrAzFVvC0KWjvbco7eV+DpFPuNJ$BUooWtLs?Q5hxt2E_=BsZ7L9^JCH&dGG`bMooqP zM5oU}?p6QW=CjcL5{?CJCG4}I>UO)AZMT_67pIKm-X{4NS`YB7hMEY_#L@m|gv-A9 ze71hl7?1RX=>-};5lwgGw+k_vOI#<`Qx5k5H_Hb0#LZ}ENIYEnik{Onn=q3XYR==t z*tQ1SF;h0UKQI76N&ff53k3QMmZw|d!eh1uVDb`};fIs>T9URx{?c0f{Q&}aWaHuJ zV?tFEBDLlEv(5olxzdxfj|QI9fP2DGMpbr^ zA**ZrjHHr>9LucBq-G_0FDH^HnVR1iifKlf9H6tcTbE;lMaj$Yw7O#huNfdUpi`l>9)Oqu_l*A7WZzjuqq?I_BwlzAWh8-^ZIa(g&o& zzNY;xrHMNEbCOfV7MlP>OLNN1KY94yZao!F4lMHP`z$DG6!l$z6)tT&32#_txKY=``P zo0kguRf8o4IVkhksdYjuRk&NwyM&94aCr3316~{c_s^MB>@{G(1#t>Wy4IrhBSs%D zWlxc$IvFOuL>FcGgOXWT93g#X@Y7%op?CA)eB4jBH{?KlbP5U-cM&R)hiW~)sHp@8 zSGQB3Vjdiiexjkyj_!7K7*22!^5g_mKSpAxPaYMXc z`TL}^d--l(!brj8(eUkBpyLo}Zlt*B1QaTj&(dGSG5-8`asac25g%UWIp6KRrfTSZ zH}|b$;#$z`(l;?|rwy_|<1{z;X}7b*=Nh}JHLdgk<9e%w*?1)dD?IRAjq!M`E!|NM z$P-0H1Q^&n4t!#BaNdx<{($%yRpQe2@9}~4UO)3Y&ks*ks7Xw+<(^-*S&exfDJ7hD zM=h-$(WT@1K1SS~3aL|vqp#5{VS0((hqOn-D*92tManhVx#qDVkO0IXO5+~mQVl5+()*)*jNnH84TBE5?DY(bEf zt8>V24X3ITXGz{Xx5b4xZ=<_L%Rw?91c-aYdrVwmaJN6!0}5Lk3XbynchJbheYLiW z+H~w#ze|IWw})C-{YD{hms^|Uz=>U%00y@V?oZkL#Tr} zpln1##rNd?0Snvnh` zh04Dai(l=wDZBdoO$v!Q`6cIXn}J*yQO40ZD3JI0TZ!3;u7wjsv!@KWvob!!hEv-3 zD~F~f5g=ECZ!yT#U|lwQ4S@D@Ix={2HLjC0#eOC+1Q z3~zlG#o}R;yXjU@jNu6}2#NS@BJ$W^_#IeB-N@>{5^-2uVfag@^9 z*gPV4d3UMONh#Mnh#;R!FrMC5{WJzU9Z;|>y~+V?u4>v#i zgDzHt64ub1J{QSuqmjL0Q+5O}mA3NG*h0K*=IQ3vk~8Hw3;*73NX+5{mird^g>EO( zqwp?&GAtHDKwKy0^wrY)ycL**CD#{M;}x?ju!yJuv7*qe`Cz$n{?I+_sunbkAtn8r zgsc+K+8_>kNEz+o{aHf!)sJDZk_Zfokq-q!$|L4^)gi42&stY8_ngXc*5*wT=T2lQ zg{aQICr7oM#rh69G?Y-^AEr(Sog+sT=)!sAnB>JL^L=QWcb87X=dE8EpRcv3^D*;%&KdaV=-(OFO?P`^HGSA?X8BrDu(P zm$6tIxW)(a-MoxPT*cjStVqbkmb`^8tRkCD+j?Mik;`IA)(-Y8PDRZ^zAH)B`pr%+ z+||j3(|KE@%&%wV=dSgGKTi*bEEoeG!h(QyUlMvk%n>8_Q4~(#6eATTz`1l^s3x1= z+?-Ehb8`L4_6ktX+8r>`Bve*&Ph7rnumR7|-svoaBjnVZb)mVE0-$bf5ONW_Qcz++ z4|e*!JJL|VVwCW6ts6T`fP6lA58<4;qS=Ru?!i|B?2UWdF54UycYRnMItbj1!MHST zL+Ei=mjLvjuLKiVzp3nrNlkxfvoH10T=D@k(KqM&2_eoJ2}of?MFIWC}Xj1hig)fox)t^i@TYrDnqCDtGHX%L!Zy zsm3-?6S4x|cn+)pU-Z*t>?<(R&I13B2$`UwgsHo^=82RCa;2vl@ty;iRS(sT?USE( zSA5do&wFVso9%KsxNoG=tK7PWtn1V)$+M7O0gA)b%8{gY2-^DI-6-&HU1ftXcQd6b zj)g!ia(5w#S?pfzNy#z0!>7*|0Yd&BJ5o~a2lYDf$XW=Nzm2sJ_OpH)OK(>o5J6rE zE57g~4e6Bt*%YgcP;HR$T`{v% z0qf4KC;sX^(-D4X;Ak@sPSFN$U${79?VESv-+XdIgcpG*q5%KTOTI~bV8Hny9 zUT9vFcLU(P9K1rp)^$3{WN5gBN>XTo5kO{dq4TInh2dURog;<)&t@#>x$=OuE(15n z@NYh0ytq#_ot_CIzZLB$RvL6~?$x)=>IZhV6RAH*d58)q(Np9qt{c6+CSX0o0xVVn zHCY||ut#@dwy)qeTzb!RAU#$S`R`G4%w|4kjmJu4nPn`~dO6(quwN%hOBOmbSo|Ey zNnby5*=28uCP5Db z1}KJ_#Q_#HqqwjG`wY>VtGMa*00E!Ip#F_sKkePqEn05udqBt#fK+l*hw$&Z#YgWV zz8mwDjfv$?M)xk{4cjpeM+UY-4fnFOCHk2eYd}Qo49z|pY&ni0$Ge`V3xwU!K85w6 z>9Lq}+~(*mpt&I!B|3c5&k29sh5r5HmauXK9qn#Wbq|v}9b2X`_#EH@5k&#g@`Gvx z4%g2flO%;BJ76d=MJsp