From 660bc5754f72269fffa4e618f5efdf98f7d35274 Mon Sep 17 00:00:00 2001 From: Antoine Le Morvan Date: Fri, 15 Jul 2022 16:03:07 +0200 Subject: [PATCH 1/4] Writing pam documentation --- docs/guides/security/images/pam-001.png | Bin 0 -> 48386 bytes docs/guides/security/images/pam-002.png | Bin 0 -> 51502 bytes docs/guides/security/pam.md | 362 ++++++++++++++++++++++++ 3 files changed, 362 insertions(+) create mode 100755 docs/guides/security/images/pam-001.png create mode 100755 docs/guides/security/images/pam-002.png create mode 100644 docs/guides/security/pam.md diff --git a/docs/guides/security/images/pam-001.png b/docs/guides/security/images/pam-001.png new file mode 100755 index 0000000000000000000000000000000000000000..02b8f92d2ef663a79793f11e0811b5dc89737df2 GIT binary patch literal 48386 zcmZ5{WmucRwlz+0cZVRw9f~_a3lu2s?oiy_o#O5kCs=WZ;_hB36u08`rRUyre|*1^ zCvPS*TW0OO)=Z*Qlx5M7iIJh8pwQ$%Qfg38FxpU1(6Rso$S27Y+8mG<=&x$B5>T~M zq(@Ltlu&X~;_99Tr+$bzdK$OyUVcw@b*oCeqYk{niEtA1ViJxLMZp!32oF>MhAt_% zR5~>&z!*ko&m~PX13(@}T>wcAbkQ+-C(zaD{+{n+xqV=sv6{JgYG*-rzuTUj`Rwqx zb=P&6t2?x{W*yD5J^ zTCDlLHF|e(^z!qLd@T2A_AyD&Puf- z`MAnHlg-UlzTn2x)v2TnC>uD1At1m2(-tEJeiQ_Ox4QPTvq#9B&GsHl<0m&Y=dupr zU?wU2p;+?$+JEmK8s=o-;2}T>h`N-PyY%Ei7UEAahfmrL7@Rhg0M{dzR2N<)4>wLX zkhRauq$SY8=oug1Bl-DznZP>GuckFfJ zkmGwzy*m>c((+_PRlm2{n!2P>buM~an(ip7X?ptqu>A}DfGI)}{wLkB11lV!X&9x!FI&MYAMCs9}nF!ShKpIH7|4Gx_Y z+VqXn(eJhYa#pl`NkStG5uI_;*b`usbS#@7M5_HVmtQmB^Yv71{*l97Yd-nzKaQpT z=h#4wfXn~`PjZ2)rRv3{eb)Y_18b_wH@5Sj`L~zlx(8c@liwU5slyS%K*bnPG*m8y ztCI?x3jwrHz=zSX&A0KGta&9MTYC~OwIpOkNmNGGEx17(Vu8uk98j6~9NaLjIE6H! z)QO}J6V(#p4PVahFB|FeHrRIW*&c|6E>kE%G?LXUF0a-j^s4CAK-u8PqbdkkpagjK@_TBd+`?T{DJ$Alcja+WMizr=l<=HDuUe;tg z2C=o;ud}^BxE8N+7jJnOcn$fVaW2p6ZE@Xi2%8zkTWqTRmX_0G4E=LYBpc{JO%#!V zpE&Su)Zn8enLWZl zC%ga7c0@avXQy)K5}ozQ_&cN!Frh}lRTxE&b?`EmG*L=3%9&Cv#ZPqBd&DjmNB=1b zWG%FGKpvCMOSC^iX^D`h>&}-X!cotC&3-*>hM~YTxk78}Sag->jcZN^Pph5TmwF(8 z3ipSO6SdxIP7?iJq&&Qelok~c4wSPI?yI$+F}8hiMp1E?B*&UtyFw~@Q04Hq7TzD8 zPNZNgd_A^C>60!vMxX3n!(RbeNz-eSy5YVU=`lAiw_m3*Z7M#46Hhcb_!zoO~aWdN?u6t-s zudf)V<;Y4)28tCNQ&Aw@<5}+Z4-BKk`a;$YG-8lA(m=&^yZro*mur=!!Kk`Sjojmj zs6#2tHwO+YUdA7y#lfiHQ2Q=y`vZ%kl*g{^o)?11beW-^g!k9}6GzO{m8DIk5XKJI zvs{@Fv&^WOZ|z8i4OhhR?d%5q<}J1z&&L$~WC^d~y}1*^EZxGR3;kETR^QA@^SHQ& zs6wGOrO*qf%9O}>VO;%7!kO_#vs5&s0Vs4IMW1&yoDLnyDK<9tT0cFJJvf^aN065MV26@aP7%Sw?LLNWJ>gYAr*ch zle<@{dSzz$1IUzDGW4D;4_2E-%L=B3f^4#o!2jE1>b%+)es7Nj(Npy`oInPPWV|{s ziY&EtQgwNNJ3;lsd_F={_M`9(i)f=Cc8gN~CjlFlkcXjlyCE7b>|}E~)^Hupw*yMn zk@`~k`ywd+LouK>0u@(^VsRIOoKiSf^QgSArB$@#zw{=R$W_V~u!H;a0z%V%DI>mc z*sZ&GvrU}%>n#+b#?rW%YMf#|bux(|O8iZkD4DtQ$TTXsP@c;UJkg?ga6d7}-l)#B zwZxdWlX+qXYG%il{Jt8l0LI=8Ep?8H9Zy-UM_Uv;S}`LsE2EZT(SqQiaE=#hOw~ zPLr5&7MLjwu_1FP{UC4sA19`c>p^b|-*41Cd?P*sTlpi#L(ys@##2r1 zLSYqT|AdAC8BW_m!tnFtyfkk7D;&e<*bVwr*ukt4kia`?>B@*o>~N${A}>t=i{Ah>=fyeiftaP6 zljH)0HWzd{@PX;G^=JLQN%c0FZpop7G4)kfoKakGalT`_>P6hT!BwC6B;WT5zQBpR zAD=(!k-lo0d&EBqiB3#0I)kgrgy`vCx z=MSFV8&Tj4&_BBK(gBYD`6h+cwnt;O7mT)Kt$zNk7{6DLB0%CLe(-s}_o#s)$y07g zMRgoUT7WO7XZPhYigF9KuI($DA?>hJo?#;T%-gQyK)>NIne40aZgG-m8pVUz}7v+^JCn zbBOsz%7c1x>5*nbY!6qq!I|7d+br6hghKwJL?I7-&^{z%V47DLcyoo@J%9}!#5R~{MV?gq_#tLj%*$zIE**YDp> zi^4r1#!>l}c#KwIgkcNRNoA?|M-ie?#dKfv!&g^1{M!2<%=vFXCJm``Pq9h#K~#cQ z*@+y81N%c9DSPfQi^{4pJPme_Gj9uV%>#0LL>TFg875^#a~upUDVgoxNW@ zx|Prk9-3k(gvi+py{T4FD}c7|Thrx_#_mAtQ|SDfZLy^yDIm(oZH(yUE)SjmJG;c* z&K0+%4NX$`4q~14!7XWBz(KR<>XW5Gz}|hn)QQ2%TL{MMQRq04d~(?Rw2x+WUteNsCYpLaO0JHrLcy^w zvzWD}1L5-uDYzqp@Tr7TflLNP$&qG6QuN(Q7J}G9M%WEsX?mu%3|trouvX)E2lHnp z9x)=!h)fi|F1Rf-9j zsXfWnuvFStBwRA1DkyJ{XRY@%q84zIK&CfLqqOQB=ZJhW;JB6oPEBLRpWDAaKZ6$8 zYd{fpXwu-=_MO`sOVLi`^OwoJkdp_i#A?N+k=PEeZN*UOq6>~Au3y+$@XV$xqtSf6 zpPD1knvpTSv&Ob^a9Wyy)Hub#*l4aV+MNx)zHsNTsb;h^+A~Rr2 z@=_?GM)Bl{dTtQez~A&h2!&&^`IZ!hRB~!8XvkKS^TVh-ciqGd=et-yw z^mArU#)&f}#1rR( zE2MGjpu;PP%LkGd%uwuDcald14(4A7Yn9R-DJ>05Q&!E05Y2Da2puU>?~+G5AH8J{*5Q$YZA^hcNE>QdP{`9_PUS}KUdf^ID;lqNivoNfX^ zCR~Y&b-?bcWw)?3=0@RG!Zz%lqcL4aTvjbNi$4oU9*nIYMrt!V$cwLa7AjqOv{9+> zo1SSkuDg&rmn0Np`6mC92y{l`?nvSs5S-5GVZte=>8qcdt32_`&evz`#|OMRY(=`) zfmY&(uN|1JlbwX9ZXGkRl12X9$^lnyB*zx!?X4)Ea}TbqaYpwoveCRSq`}x^V@|n~ zBvn*hoD@yJFbMyXu*@5rra2`(9Wy@`Ey)!gE?gZ5vX(t=w!Yb&$pbm$N`5IGx*H3G zS}`P>Cz5xv8CBOW1wn@cm{CVHsn?fxLEzZ+-^GjM8*EqD_LA!+rySqA`69DcndxTH z#-x0*yc`wox|8VivzcjLD^jXm3H}xideYRWx0}zqJ_bQLq{rEWCcI4Xz^R0Z9f7nq z6SW8m-$r4IypT=u36{Lq_3fQ_CRTb2R@2+qlFbkL{3Vq_wA%kjdAS6n4g2?oV(dR{ zSXV$jK)g&vaOJEox&FV+7?#&1#Rpaz`+Mk=>LksKZdojL%z|tH847ODK4g@*ETS}} z2UY=)$>W*T(MFjssq;vFEfMt}PeBkX)mDQW20+V$hXGbPsKVdpImECCkzl@=#li7B zp-WQ=VnPNAKJ6yf!b6(0qx15(PeK0(c;tTwxIEaU_2Rnh0Md44*Os7-LP3a!8Po#o zPnU{^-0)97&75^`@Uq8SFP%5vA9o|1CWi>fpo$(}86iH|?D;q=&>pof#WyQY4umv~ z{GeX?54?G1L_j2Z3dSu5u;xCb?D7f7x!-QBEQdpO?MO}^W)igTQPMSQ$^XyO%SC*@0x75{NWy`e^08W(zJ~99LFDj75@b%HCMlj-@UmIXnR^;MoTLW z352Va%D;{_mBT18J`?RWa1@)4_(~NyIgFmGKL-u(ZisZ7OT-rwUH0bWFpnOa>t)Bu z9-*yY`Qu)x$!PybuJ^?3Wv;FxB8{s)=jk3zW5##_MvMK9%WS44W_i_B-u2hg0NIW_ zi0^rexO#rk&rcwwX2%8c=@!MiX37GDaup~VH&pPYSi1YvGGgW0ibc9^2z@_p#+aZ|G9iRC3aB0a98uGeZM1vON~2ch3L${W)rEFo zZ(;J}I%81_x?q{is}^&bhEdMb&WTXA?o;lo2l-#V@xoiy5ZQFwLy%{_#+1Q7(U08lrp64y7FM!u*p{ zU}pX>MW8}{k(5(ki6komfSG)|w9JM|@mg%l(m9kIp;V$YW&yVVf)nxH-~IV3{mpK2 z$r~ai)(EG(-xl4_ygz5Oum@nVAF$n=({67Fy#}L@pxBHYI@(%~gR!Bf^DI^#uJc=S zUS488H-dwqAh6PMr}(xUGnMdiVY=4;BHf$u|EZBw0oe+=X>ov4&wKk)x5dimPku+g z*BcxBe<(xn!*+T!eiu47~1i2|Er;2GfPY*pP2^4 z^3=Ss&3_^2@RPMw#scv|6znu;EX_DdrJg45bG@>XZgHn?sj#$qu26Bf&_b6m`nfZW ze%W*F-aID!cbR%BSm>qywB(ZFpl*VMe{ik%53Yk;4=%od@Euq=?##m!JXJfzQc{uH z%hc#~+62+jZ6>wj6P$`>O2)3o+iQjLCuPo$V5ARa+d;Fg-!UOV2A;%UpJ=f=>cpuR zB@h_gD%WIz3mpw59Y`&PRRDlY01L@bm*RXYmJcxh_uwbTKgeuAFJ3H#e1+kE9#HcA zt15g?QA^4HJC*_Fh_cuB!iP_QZZc<|0aL$Iof2F`S&ttBXYgr;TDCvgYPX2_Fj4@X z3@JEJqCNhUv~C=X|AD3Xj!o}}ic&dc799_yYLyO0mi=4HeKr7G4y}?_CAMtT-l(kprck897#TcRkBR}ZOseHjm3BMIa*zcC19}a2T>gZ?J1oqv z*ZBw;C@s2CpiGeG9m3#OP3r3Dtf^}o%te?rPurN^Pi6Cc8s)_VcZqy6Gxx!meNz3e ziAGRCRkiJX#2sR5fU|v{VS085tdF zYHHsqN-FJg$*%)M9Jhqn&b}=GRFYGPX&{2!|3rlW1`#jl_r0ir>M2;?P)*M@X?&NV zNlW?zA*yq(zW&VOA_{pOhO0iJMW7f5GYaWQ5=HhRj6*ugsXGZE7z&2snKXqx{xE3d z2=Lf{Q6IQH1dKH%1ens#3A*>i=XR)ka!e5N_ss=Ad`oG!8Hw`|`t#+D-R=0tRtU0U z8iBH$W|{|P4f+3O3F#U@=;~RNeAj(7-}NI|L{t$JS+0J)+lca?qa%1YC{mIX72{ys z=dSmjQOi@PU9dLNQ8F+JlU1?lCq~5fK){}BhOcv|FBXi<^=~6b1(a%oMtpCd=bg~K zgoxsJA(NDGhn|wArkxncj)>&eykuqp&i_q1h%`9_c)6f3(D|&V#!pX(+_&aNQqb7p z6QIU}J8IG`-&tRRoI)>$EslAa09C{;)&e++#$tI9lmR0E4W*uj#C2s6?Y6*V${($% z6!W;R_P{3hv)ZWJ;x)t&5e&~?hyVY!Lb%M%?ub7@ZEbD6-DU$y%f*H?_62<#F~X<` zVu?P-dbJ-mt3-t-Ib4xM?5h%_DhbR!pr#Ks4Ek4D=%Hy!I#kuL=1M%Xb3jshHc1?^ zz0A;Hm^7=g?LOPnVrkFo{>a}%CRBk~wa0!s<-?>UKb>cICIp9Lrzw_WJe3R}?W@p7-IPd2)-0b~S zDGGs%VvVVC_iY&1S_7Uh-@|vnJT;6pVepFYK5U=OL)N>6C6_~T$`5FT!T|G3<23Du zA>7|^%2TL9$W110ZO!3S4b|ra=!8YM02e_?JoTQ5H%2ECHLdo$YjDWnb7f4`ANJ=D z*|njPFo#zlG#~Pld&M^~xp&(H0?g8$eHgL}aei-? zA-(vo+odQc?6W5Ln-3N^hZkt--_bJWE`pfv zgeAyftcpM2?8=933am5guT*y2aiTH@970t1k?~{TfiZB&3|MwNg699_R?TL;v}affC<4a)FDcGiX((rRT`V?UZ`-C7(>4Wuf z73aai$m-mM7bk-thyNysy?W1OZ$rb}bt$pZ?nmF$;?esQmtFrGpB>eGG;kCTr9B>s ziZc0w9Bv>1Tzw>VWHR7ksfZzxQXYm%w>^AQyxypFz0W4;r$;9PrVDK(j20~uoo+j2 z!2m`+hq?Y;k%yCQ8rN}u+qfoxAZNkpy-Ch|S?7uc5ELU*e9TqV>bfTMHpAELJcjCQ z;)UgeT6`ZNIe#KA-xABy)FuWqLX4wBE=`FCW4YM^Ub8sN7j$#Dm7^U(Cj@GfD!gf` zD;<1%oAeLBb^H7HNld^cMhLNyE>&E*5LQnUg-ZM32TRql!iD{&%cI&c0|(ye-)B;Z zoxAmmS{(bOnyfNFIFJczw0-x<7O8FRhc(yBYaE}rtf!7qGsUL`zoN(hIEkD~jBX99 zR&D5rjXrCW8vp=H5-{Xz-oVUH=I-<{7ZVUpNg59|er43UD)y};aQUQb{m7-ZG;jB- zUUKuFmUrEL%7Y=(ay;h<9?g(R>OkNn7}(h0BPP+4rGaqBJ|SOt(A1@=0ulzf zIx8zyR6iiY!H6d;FDnTT9I}rJytbqoE<@!(m*{@P-}yQ0!tbrgqs2ao?THB=pU9F8 z4A#e{Vzi~Wu)fcA`x~3p-H;`=sthxNjHm-)uljJxJx{7~U(?wvp=x2^SfSubS+U}C zRiT?Tq+zG9Oy{aIT$wB~Y(eepNCV+*o@BidOcG#;+3vfo-Z)v_C81mgVJm@Xu@)Mq z`L6qR+DyN26_)q2RH7X`D~{3*vGfQqa>c*XIUmjrL9m#2y43 zK7EW!+d7g~>JEm?7KXdEe@yu*@g$C?s_zM z!-$r$LdR!opy5;^0Clt~d5nssfqJkuQg)5fB|1Wg=yGrfgq`S=pD3^Y#xG3?P6?UF zj5r-j&8xwI@q+SS_UYaGG(Gbf>c2o#wV@$tr|~$x-gdNXIYo(MA`wCFuZnU@(XC(F zY~}StPj4R#+s$@2LiqxxdiKJKl`}ryJpG~}(UP8j-#kI;eB8Iq7VJv8Od%ckc1bD* ztn5oYoQ6xsBiVDFStAHMv-hK9BL3EH&t6^&L(CXMg{|>!SfJbGG8_vQTXQ<3LQ?EF zSFjAqJHOv6v!vZQ5?40^@h$|SK2TQ(?-r(u7gm@Y+7UGdy zfl1roODnRr4r7E?HqX3_b~`@^o6Z1r;G`*w0nEBBiVTb-0dc?v3_2QZ)^wbyk0*MV zEZ8d3mqcgr#^xdxz?01TC0txV=BiC}YigLt^YcHVS94)s?;Eo-I_xspyMKkE(NAZu z)Ia!sNiZOs?IYR?+TZm%R?5er-}IyU&kAE2TfXR5tG*!UV47F zY2c&~+>8FE!aV`Dt6~G@yF3h59u&@uB4P7apO;2`fI&oqK8WI5PL-i~lMo&|Z}UHz zH7=$rXExMk`g55WpMg>zJ);O_m+Swkv#-tXugt?8&lZnW9R$_VA2^1YZMFMYYa@`P zCuooTqh`)XWj(U`d!E>S9xsOXpln#*dt0L6uO?;2)=!PP;OIcw@s2O7{3O=Sxna#@)QD4!=Ox9f4qi` zj!csTyzbsE?qLm7+c=zTwmU!PVO(@wzd+779u<;$t-rwbY5-KCGR<~Tm{I#9Xwj6j zbYZ#ZQ%_Tj&?*q!LJLL+!W|3&zJ&k|e~)!whL!O+4QuWN5r`OmmQS zqswnx?`;DeutNyL7cYB8&nSDb-&ZE7LX41@HQ_Ivwwc};^?GXeQXTVz@1?4V*-snl z+f^2C5k($cn3m_(1MCNWFuJ>Fz>EL*X&e?_iJeR^0=BZ0o#u zrF2ae6!G?`nxy%9#NsxK6h`Ik-OgqD%HW2 zT+67EN>R+9T(Vb8z_{mmNEy{klClHACkD2_qh@oJV{lSaVI;Br#f@mak^H1fxbffJ zrjW8yfEfoMBYwZNdj% zY1xp`Rqimh&OKx^JU0golL2S9Ke?R$nkOS3lQAd)WBJ_kyzubddG_=O=dt*JHxOt< zfKJNcdr0X1I%RPY%-8es*HXFTwSCW$7rZwv|C3r*_n5jed~!0EN_)0e(4#N5d}8Jh z25BO`P{P)kf%0;uDqksIefPnw?llI7M$J(RHP)wib^Cf}bL7?PR^^PX$1Jz2UOq<) z$X+_MQRb+VdD$AD{n_&4-XDb1irf|X=0}epIB9tXMmPJ-z3uj5+D`jVpSDpGdIChI ze|?{j(9(>;k*byv^0vSu-BOV`@S51kr5V1;&7*Yn3NAQ~^em<8;aHt>qaLbdcJ1$! zOI6X_iTwB>HC613;m+y-?*)Yxx&~~qqk+fiDVc}roErn`QK$7@O{<8Wh_(D9j?ewM za8Fk;PGaqOIp-i^%3gvXw7L>J1e<-@g^PhFOWR#sF^3tSw8I;ANW|ue<$D>gr2P0m zE%ow=pcaG@UFXno3oN8jY;AP%=N^xyci)Co!RIELLhzvQPInOfmmeL%g`$wt9G30R zVR`zEbc>p70=@ztp$S%4_U}}`b{t-Xv59)1ZMZG(So0EqjP6kJbW(g}cV@qcYU}Y$ z`SmE_T6|XwT&3zlqw1DrJrel6XC%9OD=K8UMS#=Yu}=MsF)j?|%h|WTFxdbHIk?u( zCU(Ew#Y6%|9^&(a4GH*V1RRvfa@vhJskF5Gmho4RO79pk2~oN`i%uOdYIR!$J8f*g zo+ugu>nTY!_+17P3Hxa>L~CFUls>>RU5Sz1WQTn{MhWf1iA4uBnCv6xuU%oZ%=UYI zBUst}Gfe!e0yn+xh+(WjkwSvf^&YY1)-z;WIqP!|$M*BL7PbJ)huIoYHc?-h0i3L& zy!Z2-ci2E~6|>Yt7VUWKfG;By5MCR2N29&K_0mTMOGK;PDs+4IHMv*cgc~cRYFKV) z$3PpyFvh%znj7Ub85|N@gh$e8@+NX>Mk@ku*cR_-0B%T5j=20G(hwn_v`P# zVB_B{8td*3=%d$6HR7N_M-lDn}{w#!e!F$L*B9+8cBR3VOdN4y0i+(QM z3N9NAK{bxhjF2pSv0wN9US^9u z>J(^3wxoi5L&DVSzys1`7K)@N3@V!v`E!pbhUw|FZfArw1YH!i7{M{8VW^GTc)}RD zEA*I9%@*2I*p=(I>~@xzFSHl?^rvuPx~Zlurgx)lJT#`8>pf{KI+;m#ZEZJ($5u=g zR|ONX5}`oW*XcTHkHs=^u<55r$!u#V zYR>p&e-N8VZvzQJQ^|`g6vup; zBkn^1oz@v|E%ta=3E+#~*pD*Ja5kLEWdj=imnr$*?3Xt_h3VVS^8*A>7%;94*_70O zgJulbJWg32d_YTrgp=6j&MMsa&O#yYhUTrjj=~hK>hT!L?)0#-6U-qW_vm3pu0uDP zo;<`#8}X%c}!v;a zHq3wLW_lm-e`~rdzZZJ=+Og?wDlPr7r^*`R)Y?AetpY(cQOua7HxfTXKeTtOxC9vE z9Zs=+m8hERc3bQSV(s`nLK@;f%!zu4G|pZ-hxFM7A_6E)hpyd1{1CrnZti5 zz_i~y9Zrkel3KBrnJ$I}20>)2sr3`KmbIE&(rc*)pB03zxP&Q>i&c>2?I+Oc0rBU1 z=Qq}ThN2oz@;My{w~~JYo$MlDSXkIF#Uj7AcW&w!kT&UR>AT*v_uhaKwU#RDRfZ^A z)b{&^INHbQ>ZRQ@W=+eM*dx|~X(x%@fxOSM`ylS^0C<4ngePf?|5HXT=FWOx3~r%6 zhD~GmakeM)sSqM-l4(xl{kr6gX|5V~Zi6nZ%3sWfW^$*PQlsA{Evoi?WGW7I@Jx=h zcN&vqZ^E`M5!=ToRzV4TwH<1>iRv21Fy%^t66J7v@?<+rQ9v!0HdLGrQdqw&tLM9x ztu1mx$2fXiS8cew5AGcW6KBEH=^-WbQVNnrt(WW`YIq!El+G&%>gf;nwJlp;{JY+6 zXajWG)yHGH%j16fz&W(tbSs?kzJ2Mf4-112!_-u_I=hvW4S*`Dh9jnzh|`ELq00JZ zraFCTDyYaQ4|e*TR;@R>=rgXY=Jr_E;S^CB7Xb}|*H858EZZV}yz02CrjSDn=c|>E zyWMm$=B2IMINGj%|03C5`urnV?hG??E@(m4@AJPCtAk9kHCp(khWmqT8jz|}jWe-> zcICCvSGC35^TgfrEUT5V5>pXVP3u>arzk}hRJ1Ge1!^~@Y>O}iSZpcBJcE|2RRV{_ zqqd-^jTQ}Jt(xoeB?UY1ZHz@?P0g32F&=-ha%+(^|*H(cwCJ1Z=fC0UREj z0enH@G={QrkeZy5Joq25k+BoeYybE-o=)T5b=hk95ntbBZg){d)ok7JMa1Y&ZKVLO zmHqnS;!PVHq5D{L3ntq(zAB8iq*PH@saATP5TYJ$6sXe4)d~DU1IH(P)iUjXrJtV5 z6;XkK;7C5~>yk7H#Wv&DJrnMgVq-zfZpnp2x?U)zFs=zlXV|rA-e{Am44sqQyT+X3 zfJ0=~8q=w}^A{!!8fBak1=eUtUJL~zR>@4A8?)S^x122xc3)jW@w?WbO!Hj~%Bh~U zaVfI=5WR+y`DlmUg_rwme;TKX1Hv(sdi1&p%6>Pa)-a=1I z7{}rc@nss2!(KD98(vX~b8D=Tgu^OeJiPNAU!m`Eev{&x9a2>OAa^S31 z^6hcYvLt9Y$V~g;peR#I;BKs`^13e5c*+8szhz)|hSmON{+BFjvZK|Dh%f&gh|=O0 zSf4clWpM?*bcN1EIY<&cXi;A|saX)t%oLM)Y9}n@aZH60O9T1}76!bG{C+4nK>R!=F9=+&oz|GF) zEJ5gPZv7?xfR}t-H!U5%?*sh=bSqbx8YwEO5^2(K|H%%|0D-#C+Vjd64Q;zy*>?Ks z_2z>U#<`*JEP1Pn+R!U={$6fK_6WdKFt}oFdk+WS_qA{8_|$by?J_*X66BnzqOByx zYU#tnHz=wvyM4rzc4;+43onk{#<6&LrMmQ%oXAsZLDF|xE9mtAc#8o^XYbXNH|E|+!w#s>bDi?Rb4> zrJcl1^?BC`PNEQVVQHavFe;^>s)GcV7I}fomr;uA{WT-8T7leio;*7I-2$&IWm>3g zc)y$KAY;KeDR3`i4l7j>(!o3H+Vj&Ay!+UI7jB9`?%mav|m$Hv^TGaik_ z6nX)6Z)B8djqYK^y90-MNCPgtUX%dxHs6kM^fk0pO)@>~fh*L3W9DDlM*L8NH>iQV zFwVlkrD~CSJ*K97zY+3wldCJ1p8R5yA`bLFZi$^Fh^R~-1iUDgQQhYBistUEbETqb1M%(< zcqK9$VK&kv80v9@lzRu~af72er6pd`;qVaJehaDZ6j5iov28Co=u=*FJLB5@x?fIX> zx8wS?XFvrkM%#zc;ouLI#3mZK@Mtl2t|c(_I)GZA)bh6&KYcJN)664$=YwL%X;k=p8%55&ka>(da=18ziU< znk56tw-~)7-;Z6NuMNAWubd==Mv)^VRrEEGVm^H&;O!~RH z{lL6Ibw1E$TCo6f^Iv+QTicz(H+o8zN~?`nD;Lq{#Mi~BK}$NrAfXrtWo3se@W>-| z8xf^J#f20-19$pDpbij6Tmz^I1Kj)2@a$+n)gg&x4qo&tK!P8uE`Pr0^bQO5vEoX| zIti+;4a2sSEo5LCeGW9S{h$TM6xy%)<7zg&`AmsL&r2JNG~h2P15?O8I?Mb4oRDi7#{ybV4Vq+^j`ha?q=y?Ndz@X2z8U3lQ5!?GJSNsZ#|gIE+6E(>VM9Ai`cXgp0xLn1ZnQBeCKg` zD3PazALuK%@W1OB9PVemnpr)ed23eA(M7y%9?H)5a$D@_Ec{9F{(6bWPv|zGCUQRN zj?Le$ul$uH+KeZ!4S8*Oi|E?p?Qro!IzsnHd@B~O&T%Z`g=ITzQwmDW%7QA9D!Ths z?xAr`kSVk)0kG1G5_GFe4n|&6@n9>$mC}OUXSj>%* z-R_J<6T9smDc9y&Um@3A-d4O;)mrVUN2;@TwIlR}0|-47@Dh6dCd1S>_3qNSYs>Pg59GAFn9LX2 zf&zAi61oZ__5PqqL1A7!RNJ<{ef#+}fLUnn(Yc6etxXDsOBB@#i4dB3v>%8fI!R$b z9QoApW;14f{fR4XDk{OziT`hKsyj(U-LCQN(oUxtQAsrDR?BUZ=GaCBO4``1#HrVc zMwLK@=Us~FLKF=NE5>rn*2q?nl=&5>XKv7Fk(eQO0r7M2VGtZEX9UM=zewXtzX4_v z8XXr(&;TDQmYCQDjOaS_kS|$V?h1)DtP$Lf2EEj(14D9UAN@s8)X;qI2kod3BcTf( z7J0i)Jxu~FPm;ghAyz|%Z^ajOCl-ekn$zm3ZAh7r)8LF>D=aY1lfi6#gxIV^3QYpv zmSK}X{FvtgvP-z*3v2QfEG*>T%#7=W4E^wmE0!M+9$e+ z@>&H48%d5)o7)MCN|1^rAVQbQt~SrX`cIj28Cl(QE7VH(iNRSVTt zPJ`bY=`SpyJSXSb-os2oZ)j&FOtQ&%N{NrFVoVM8i0C>kPV$BVJWVGZ2IW0C0h40H zz877xtm|otE~zL$_8a|A3X!tCir@th-|5?quDI};kMthK&bv8w%@Bs`idW1NVtE`z z0s`s%`JoRS!4#z(V+kns9EWF!?Z{gNiiMFOuZ}>x44o2VA!aWJ-SB-dG>U#o5-+hCa|KAE<;mpw_i1*_ zL-S;-qCYJSmvaRzgpEOxp<2Q%6ZUunFKC<$RRZU&#=uceJL;ssv_#zp<`}YAG z=-kL6twgCHent&-DCvP+52%*Yt25-PG`GQltH35?lD<+&@LPw{>)$ZjWAe%UA3s|< zCxHr@G?#TsYzPvwJGUM=ulpC^np(t0k*^LxmS^r)olo2VO+!PttgKEfF{h>U`+<(5 zh3C$jZr#gfTFX28EpX=5vma)ZROGH89pqGI_oHPl{7TNeNi!6r(4!Y+Dy3j0-`*m= zHDFUU4Kmg{X?3AUQPF+nGr>n6W{pLuk&OLJ>+Dv?=e_$Vt7PA=WcWBMyQIVt6cC-` z>6<~=O~Y?(LB?S+bcYWR+nn9Fswt(P@Uw=h%=ny7m1jpElzHZo<--X#0YoWBx~~g6 zNa#)|B^t4~9^PGLTCluF$WTfCPE2CL9r%4{|t;G z?g-8|Bi~GtvUsMjN(uU%pQ!C+!PU}YJ5J1Mkf_7YJlnb-+j`u72&#yd&q-F%__fcY zzg$#VHl3wMhucvD%P4g!8w0CvnJ8LBoo1|^_FG)`A)GcGrwVmchl7$jHVXOP9rABn zs_`Bf3Gmitb*IN4qVAD}Fs&7o7(wNtNx0!xi)%EK`j@;b1 z=b{bR+?}m_sFOY~{v}19mqh^-7>L=1!cQFra%M3tcB}F~HDay8Krj6_)56(5TrZzs zR8&>bA!4voBH3#b5tX*W#rt6#)RUjqvB+2IyM9u^Ba_>3<2?^gAE3y7Cd;034 zKnX1K&vo=al#C0+(-y6%w2kX~sxl!*E2r^ZMRao<;n0TcFO4{s3+46{NoPQ(za5ze z8R#%qK$M<6TR&KVrFYI^KJ)}{tGdO$Uf3{J;~?>R_Ew2N6MqjPga)a#;8AE*I_hh4 z#nLc-G0p^)P|K#sxY>T*8A*Hucy;N|PF68Gk9q&S3y>-04=&R4K&t9xj*pxA4A|bC1%r3i_ z7P=%wD|`uv1+Lj2Y7xn}3z70ToP8Z0vli(7t$}h19ea>S5M}6CQh!-Ym0D_!1sVSm z!F*wE?+Z5?RYcq&3Mqc=2+5qmvs1Q3DxC9Hlk-l!jyNnncW9mdFbs%Bu>#Q6f1)&@ z5!>)K_!gT~t)eyS-ZD->CG&^;fxMJy)Z4!1<%xvvlQ&hab1IwlL^5-+Qq8O2&W*mK zms#k+mfI3e$8~89jrGWB_O5u9#t+}IZ`2Xmsrd|SiuHG=SI^vJxt+WIk*f@-du^}f z_wO~ewFf!59UhYNd0m0(L`6yLKf$Pn`5x$(odA{^d$W?y)0YEKys&ay65zCr_a{<> z6%VMRp)m9yP~+c~8Y^%Fro_;~ z*JRuE^!|L0-*G&D!rp7IbzSRRuXS!y5k58%-QbEL@If!ekI@IrhKkYXHO&|=f6rB? zI%~hYZ}Z@ZCEu{_o`ZW|E*XeDx7?S+cX_PKY1ZUSDqiLT!@6@Sr%ub8sY zHzAM)8(W9U`=TUQHo}Vk9Wvm%EB6M&5^%Bw{~{5EUbxYkFyJc1W;D?$I$+&aVAv5L zBo)LKIoZpcmkHC9K$xX*VK!VAAOmn}JzFeZ5^vu$IQ+p+8-7SNWHKzVIuGr*m*EHI z(%%+`1h!FPSXbmIq-{uzP%vKeEs zq<=hgubpg8Ovp}58DJ(b8q5RFE1Q|lE4epaUd&wKMunjAba@7v3x_slmvuDE+pJ_^ zAl1;hU*9@nl?mYc2c9=u-qJqRzkh#gv-a#;W$G-boQAah4NE(NY%Fj|f)-nX8AZ|H2yh6QY>2qCB^{$^$if>NC^Tc-r)t#2g!6o0j03$c0*VT%X@SSjaVw~t4Z#RTJQ~7gBY=t5ls#3O%1A_76O|G6&$5K zq-S|CcGVkFQ8zFpgR4E8mu|Qw3`vfUua6B9wv95e3U5n%8(zBGyR%s(5dG~qzDiUw z%}AfP<5a{`#n7L2GS!?C(dBtI<*1?=POs>F%#HYx^>U zca~=`(Xg`oe{>EX^;haT1^<`4ad=RuW{LYP&f5*&j{2P$d=ToMN;wzJz=A?E#naV{ z`O9C{Xja%|)5QAf{@LXrhNoAc2{1&8ZBd0=?4!VVP}Jg8D4 z?j`;r45ML|={m80x0C|+7aBBOL53fnI7;^&BC$8*w2n(jHg{(G0#S4ssdeFC*GV_^TrC@U3dTuFr0CA|CuAZYJ702{wx}%a_lBhiKR# z${&6)rd78JGGu^3okubnM=4)C2*k!l|8_&t4)10X7?mno){5DY(w#3&sp^g#pgGn| z$DohG*pR@g{RFE}aoy#vU#+UQ9r}%66q1#~YmnfHLWhj_HqL?;{F=1B*V*Y%*y6p0 znVUefZBCq!Xi-(npcRb+6bPwr&lG{q@;0Q<@Y_nKFwE`fUb=Ht=n5a!fHGyrTU#_u zcr~)d@3sa0JZ#PfKhhjP^wGG#FKV2>cfB_Cb2t8)l>3y%iL&kr;449X=$5&jPl<=O ztTfmHeAfYWS-%HgO$A2hP^G;UJG?ZV7=ovOQ?`rJ(*}OPiN=W_2}6hH?CpH#VMTY0 z{%-&R3-JivoyGRmszol@YoV?c9e0#$twrsXchk7MF=_ShiX(N!xW&*^fPwOtfr09= z>7rU)V*1tK5h>1z%5DtKs$aa+JXPgQqa&AM*BLXl`|l`w>Ok1PMR)t?-{K?9haHHF zi2fG&7J2VEJ-a*<4~)mU3k=Ed;Z)usC349kno=SLDi>>xQR+HVMupp;6@5(%l2}3k zZua$*PDmU*;ke^O*(0`@{@UJQb}Ei*29xb;A+}3>K?7!F<~ESvXWJST{nM9$E*2=f zck<%t;y+oQN;bAFEBi||#W)MaE4!rNACh5;h^Pcx z_ke|?csL&u*8$|Sl#4m4!gNyhMX!Fx@WdhT zODN??DN#;eQx!uoG&jVf)O#|)DN-NmQIa96q<6L_h_b*l)9bIp*qp~Usy$5=`X#%V zD{Of6px^trR{00w8;L#NlPP^7RVBd7b1y2;iPP(x_^`^0A2y4(ihjBaA3@ior@Y!- znU=W)<=KI^Y9N)#mwj$V%2*hT1+_9CDndojnXh*nDoSQgvQtHxtWgUsXE<*!W`d>tUe;$TBq#kr$bVMzKvRmJV;rUJd zgX8_E$@Myv!xz_WQdBv&(S^t{w!%XzmX}koBP4 z#MmfZeBGl5Po*<|a-zvfH8|n#e7MiN%~}-s?Kxe4Bj#Ylxyz=EPiIE*yLzY{^@3(Q zRsO}S__Z9F#E7vJ4?e^mK!h=fvn+(!w`2>qis1JI#`V|_6Pm8xA0?&WdQERtWt-zEEiuKpjgCRRX{js9 zBs^0#_$R)a3xN59o`6DY5nX@MDm*#e>q|!Co@`{v6&0u`-YwFF{#q~)CyvG@LI@SM z>USgff)+#7LU$jj#E}0DQ3$%@jYz&&3JFcX*iDKl7G3KJekXOdeV&bY{jHuwmBjQEkYPR*HZ#*XyR z7M0?)EM=uA)HY2W)#fEz&a5cezzZ|(p+RlF!AezeuN2?4w_=l0!fKI?38e)aD1~;Q zM;_1tPKOhZPnuB%VFyll2u5=WlM*4$sk2-GHQpmiH2rOxC>%f;18C1jn!#07Q+-GQ zQ3T5CYEs&(AJ>Hsts)WrF&oX-v51Jkp;nl;laD}UDz*dB0t%(D%BbbOf~bT4@{vhh zGD?UcnHyMS84X#6-087mB_2Sf*B_4bH7Cg*jjC-kBV@(lR0_Vvc1Y(gh&JfE4r_`% zVBW{XLEQSz`we(9OYtsteNx6;ix9JUH2#r2N3Pq3&E&fVSh(xShA`GX-KL~U0k z#RVFA3y{zCaFLG{=I+SU(|k8~pOH;ftL3-c$5>y95a1Hs= zV!p&T@nz9H2)+3xYtdSKV<`(F_wm-yo;Gis!y`qp)v%O)OJntp`t|5N4u-4y1y53Ou#|FZ#EaKkYZE@~o zu0~X~%)_qt5FT152TmYDb-Q=+x)JN5LW^p=fB%u%#wgBb5!2>TK18HY5psXlHYGtp zjrQlMg`*Q`lizp)Y}hHMc{5{6lQw3tzhAI0fX)eMv`2-_?Md}7{&kT*m4_7Q_8 z7$gveLh>N8O%B+K64_1LKPh*y4MiWpqYttG5<@r_c2OUclNOwyPtSsHUX-0~9d`F~ zWH2P3nVs0ARFU>X&7sq^jKEI?G$>@$#X{;Tj!E*|8w(M7#3W+~eVv097sMU>%e^BD zE3$vz2KYNk)m`&Z>pj83y5xS>1ikNr&uMP|$dzqC%Bt`)M$_x`m5<|@c#>eRv?Yit z(dIajFX)(P&$|{#1)ZPY4dkM1fwd=+6KINRVNpzCK%*#S@z!iudOE6dF;}mJtaUUg zAMH52-rsZWNZ6o!b*AjBy3MZ}vUXdsJPty)^@umnW$iqH`WERxclV2ipderHQOxGr zMh>X+^T1|1{|J5Yp0KXf45bW7|;?_xRWBo9Z#6C-)2h$48w?K6w3n&%{1ZeWMKgd3L zy0WM}0?w%`SMKv`O_Hh*J~X~y(EY-O-XYwxiczIxC~&XcoDEfcTN8AzbPYAQVPyt2 z{9P#o!oI!xe$4PAyVhpAz`B879kJaS@okgoAf*as&`V}vpjSB?sgKUf!X;w=2@^0F zgVCNdF2sjBs-&~9*uHb^`0lC;O=(GG@c^ZJCG0Lw$lJ#7pK7M;AeAm&mcQc%6#S3RW|SJ}}0+p#*=GMZwD%M*&5j) zYe}C5RIi_L8_dyklcp#A>2ZuWoeLCQh+8Ue6<>B+<^UE{B0{E}Gax2ZXKkHottsUQ z4BW37%{$WahaIpPMo_!Q%oAGMf^%OWoQ!e>2-R~K#48vkYURGM*9c716s8&*NLh4W z!9j9g2>TaqI55WuUWtsJUy4gCcaes8E?VrK0{`tM7L&GF9f@%xY8&$tNr z_iP0{_HvC`%TtdOJ=z+5=7C;8Z$Jh|#Fv19i&B5OT-nm?x}0!3WduAv4Z~;*eEt6~ zgqa*i8@DJc<`w%VM_kDb<|$9IAgnvUD@ zcr^Km-iVoDdE(Y-haO}g?G;8_!E{Z5yl8q>eKuNWi-0p%X;L!XCys1Ll%d9HU&sT~ zbT8*B%l&29kRb+(L?{o$X$(h$V3A^LD3Y}_lO=}!n&iMK$$q;H2nQfh_-}9-m5Pu@ z&qwq%M#hx}C#@^*s20gWQ-69nEymIql!Ut03DS$4=n^HIF>yw^`Y#1quU9-Q2h37qU$UHyRV181NV27c+Xb0Pq~qqwh8A zqxjq1=gKPzD_Xnx*mKAzQpigP9#S2GWFJ-E~j-xu_SCfAI; zL_9{$afLo=3)(&~am6T8sMlze=xHzHQSHVT56meXgu8A~o;F2m?$=fPug!D%{8wVR zc1~&yYMMt(>i~ONcziBcvKCK4aWF0{{CNy4vWv~0pY_}}s}^IN2R~TJi$hiN6Y{}@ z4JWa%pVH!(Sl+f?%>T{SQ)O6DfbXsAgc=&GHQhGzY{lJ}E)IqpNc2Sx4M_d`waSaiYjQ1$IUv`J74~I%_ZtpXV%ex4@Nek>SS_pn~nFKcFRqPwT>O!cwJW!ERVvUc45ihE<6Sln{F400iB2lNp zIcSepe&!HUUMI->M@s0oC6QD);sxPD3kvZiU@;NWyj(OhO?A6Pc1buTZ?FR3cb;)HwKE=iAW&IM*ya=*56 zv&}r`Ep_VO7o?L`Tyc!=bf&PkpMyrv^tU5+3;Rk^Qg#Np{YC_ zqS^8Hpa zf&2u;(FAx2d@u(}M5vCJPV))z`zD2Pa9F>-}`-XyLn%P)Am)gSe&MVGSrvf`c6&zy_+XR~5Lu*o?$RQx{1U*i^O`7Fm>(eYG~K^H`sYvu1xtCM-6yNB)UIz%KL*GMd(%o!A^P zmA(Jo6BDZD&G!1lF@r#5Mta>@tB|+fSsm+$#jYxhTJg=7=18z}fAOS{6 zoz+*=WDb{dyrKQ(!Q&xpb%dCuD_4T!MZ&N`Qt&8Y3Z3s!im2p(o9f2B2kKgDdowe!3CR$VZ95?eAruGd&p$~jJ!Af> zd=|*Dg|Nl!Z`)^o;>mOmHy+jxi37?4I7C8Wm9zOFlry;GHOR?l=eVTes{;xoW@gCE z_%AOi96Gm?@y#+}AQpX^9a+x_YA6wFTPs>?qpeoCw>b7~Z%6rz{j-x?Nh|nR@^48` zBggUTJo8>LfQ9Xc$pep476mj@8I$uEB$XZ!Fljn)8L(?|xTWksbzWD9Cy(JH%JKrs z{0Ufu@_gP<>xU|Ki977c11nv54)bUNT2`7sdCod=a9|*^)Af(v+WZ31?^yl`F+#w)jI5BHvY_S6}Rdf!{(yXIVMWInnU@w2SMGHib2MH40dD+ zzfj1GOg1w!B>_$NFY6v*(lGd~T3m>KdaBtHx9*x!DI%4#;>+l+Lh;W5@3M04RAPjWCBDmwI6++{ z_!$o#D;yD*NsxOty0Em$q7#*_4Fh~_wLf7*;3MAdog=gse#8^H2m~I zfMzcezG~wA5yN;lU3U0g2TbCcP~+j}-9jrus?)7C!X^ERQ^ zp&Y1GMxq8sr-mKiHWFCt|C3tsE%eIt92hy6>Z{}h89HYT7K^WqlEe^6o>TuxW8~=X zI}*K4(0=g0Annxr-cf8oOUutkW}drlv2&E(FNu8PojJi zOfo#?r`rUT?)vQaj25|;BsxbGI9M2U=@2l&ZLgrxa{!-(NW(CB$tAQZQ@Hs^#Fc4Q z55961EAi%vX>c5NAcCJ7babY!gCC9*Du<)Ixhas&jK=Cu;QKpoz`kqtvR4Q{w2tBL zhRDn8&Vqr$I_t`L<+rYNmZk+4qQx0|Z7Lv8A=NzMR27Y0rKgZoPD?5JOSV}5`IwTj z_S02{WQr2e*)CFh@RTrbG%R4=p?5oi$2-`9d334=Kb8unJ%{g2e6WmCGes|UaKY^l z3Pwm5MD(Zq0?R`!Qtq=*8yyChLk8!s{5z+^<)(JJRO?2+rWc1c7F>OppA)KDp-XPW zoSKlxIdqvY{2zEvx%7ftU!xj?kiN@X@D_xDX`~J7Paq!5Jg2bLR5V>B48h~sGfcF( zQ1jVd&~Ch=6sLLgAy@`6*JPQ$`^WktKa0xQf2_f%6_sp6l)xxe;D_?w!^0 zcA~<-Y$3YULQE4rDPGfK(m^}Dh>hS)us4&b7<_IruS>`n*5B?*EhZ&~W;&)A`Msl+ z$tIV}>g{)h1b9yE!+xcqp<&%%jybvTMm4YCVNZ7%2YYn-2jr}(co_)_ku+`AP!X0!4)1gBxdMf5%j!`QWZRi>g14+G$Bo8vRgQ2;R6333(&NY zTz_w?mKmN}7!9=yNEs>JC6E#z9>t~@9>#(~qK$xB#oTDbjvpYY5_QAl96jFv(qSX& zcjd-H$~08y<0)jm$@IS6sCD1yAbBQ+r2V-VQMyuFn0rAoKVUSv8p^G?pc8s0lJFDV zj+iYPXeu5;MG%&A`?;`01GwDu3WD@^Ss=awUVdYLg)MftNghZvQ5E?2i;z&g&dSq% za@6xmSE#wRH;xeD&lRn(GA;Lcp(r*)MFsqvIbJB4(v!gJr3XdI`#Pa3YhnqZbk5{T z{q2F`#?lrqsqF_ixvmP6zVmk*%BwaNZL94hdI(#AsunK5hw0YlvSUiVN(7Yb(MFud zM_Blt;7FpEXQqLL*Zf}^Ycu0kQtC3xZyY;&UDSFIU-JA0 zg6DV$@?FyWn<+S?d_p?00@PX;MC?=dMzI!D-f!;%ogFfc=bEsyLP6vEb`F%lnjVc8-WDJfjQ4sD`dbuq_5Xq>1M3w1DBA(#$xm&5rGU z2kn0cLAMi^17+pXMj3+bsv<EL( zv-~J9_A;wpOX@#Rg??Fqpav>07w?9tDSYOj0r4Y{Q{+X0m1`7G{EMg3At<4EJi+zX z)oZiVoHXw7+F75kFVp2FMH~#_HuLOl{+ZNJR{t!JBokMRDbsyXzosyVmG|A;(5+Tjb|=`^m23*Y{79}b`Ii`#-o_PVAM|6 zKx2H1W7r+T-$@pjKq{VSp=$xAn#}!V^i_-QbI3#pbZ8_7Y{jx;BQYS2ku~r zj+8?e>Yz192a0p@I=@+aSy^G&CqluF23_Q&1cIxvNqaSsL3b1eDnrIM?23wpa4H1u zLiJhVC;NgSET_eb&ZvrMs=6&B3s~OP@qbPsB<&LH%5|2|jd<`H*r9b`LP|DxaMiag zHoY{4)eyI3S?Oi5RMD;j3BTZZyiH6S$B&jkm(r@K# z9ojqKAo^WKqrzOpOT@O;%7WtVK6a?R*&imEVckPJSgYR)es#FNlqyD%aABNSV&hMi z>arn6qjYjqnK>RZ6K3|3V$Sr_He(uah8lvtS6E+Eh=ydnOHB`_K{F7d_yBgZAgqi= zuN2a%?eKn{xb?o*urfbdNi&_p_%j!9ilpeH4QJR`U2$LRU*q>lvtx2qsxp}^Kbo2n z?y8Y0ExFZ*tl2C#@8Zz$RE&SV-~4QA+_SonbE=$J^*;NjWcTW?KxJtf=(j)U-EEgf zHnkjk3@5rR@`55gcT&W~8^cnCzDrO1UY%%IcEnbI-i&J0`G8(vyDW30z{P;T-njdz zbwG1w0`5qQjdlq5hw-k`3n8(e7!6Pab<7VK!1Jo5hbFTBJwsh*O~gqO3O0I4)bYlr z6Hpu(ARUxXN1tAWj6@K`85JxxU?NZoCr1!DTM)dT!=g~Sin%GZ>m8<*s{ey7T&wEW z(o>*N%ex=$$V%{`g|!i>36TcoWwefrQi(A)c*htuK)nPqQ#T(<}=4~ z+YiJl!&dOr?rUmJp4NMYvG4Bhv615MGHiUVqUb1nB!bQV{0S57vsbo_5F^w;9!Q5W&y@XxMw z_Q{IjDi#w6?I*nSr~eFp>B;7$}9SGo1{)v5-J#Ow$OY;${L`qJ+=}QMzpI z11PUDdYIHX7|<`#c7$l1{O`nWBruqIA)BenK|yYOf-(J)GZCbWvZA6f5N6b@7Xi|0 z+`9o+`G;dJTy3n$M_S-*Egu>yF{e)I_;`pSeb2jCw?pCiuO2Fr{i`(_4ShE}HgG@8?yOjyC_TVx znQH$fFuFg!-2XlF^LTfyprZq3v1SX-vFDxn?;_XTSHNi7{Vu2ORhSLhW|SE4K-yoP z%=#qW`>mm+1__3^iIu-FBgrwiC4Zys)j42lqw`~3?kHh>k_Hw)8J5)amDj-6tJzb( z&X5{ecR6^uMVX@KTbK8O}H~%)?JDo%4)~IR+`z1Ig`1wDm6)B%Y zJNK-n)q1!ez9dtgCRsP1y6)%;&{sE!e)h7O((I!>}ynC@_giEXSo0YEOK3p&*7z9laE=I4YL3YYPF)^r`izlerGA$P_cNesdjN=#j{lZ22q67dl+@Dab` zE4;;k7_6g^0|7o=cYw?3}iWc$!#mgLZZ~W@TEmA%MIkTN&)zqA*0q znHBAY&5_z1VedJ!6@)>b=F1V-kAg!EhjxRi|ALeFdn^)Y$i823NA9YuY}}-XoTA*t zUVKw~Bo8}=!SQ4Fa^-<C#9$-!DT^ zI1tZ}3P;Qz51#TAV%ilVcL`M);@j62VZ^U0lo*oB)LIe?L9hU_5+KBw2!-8n|FJVr zm79jkz23poo~Z8c?w?e3zhJ-cV!I!)cVO-= zJYGdQfS=u8sa}eepn5dZfE2d2q&O1jeo8o5+^^8e94e+zdNJATS!V|O6}qUrUaXNg zQrNH91*F(54ur<&zl506C1)mBKjkJJDtG3f?Q&O>7Jr5B3kofn7AjM;WfB;)Jovn@ zR)kW{QA63Ir^pcx!Q-YBH{s0XCb!Xxm(7Zo)sL?ymMvwHO;4Q}eV&k02h9C8)h-k( zhiq3%UJ_YN_;~f!_c0cB^r`QGk|nqZZJ=4{@>Ah zH@hiF@f?_JC*`7){$jb_pb@8n_u{e`20|(qYrewE^GG)~KsfTX+h(%*_ZO?{OVbuC z(#Is58BA&SW`Rfh)|cUh*DQtdlJ(~!VaN@`R5}O3pC}08u}dS10w9NVWZ46-*6yi} zDFGoXm4no=S$G3%erKR4#Hgw^_Xm()FERUr9rO=G*h=ZRV z)liAqd46QQwzTEn>K=7;#tMGCPcw`0`Jeq%a=Fx~?|Z4E=OgFSK7#v|^_VXGzTpf^r6oqhkytEqD0` z?^7@m!n@RVnc6I(T6ky>JoQlB2B+#SyL8fUpK1_A7~)`%HBKmsW~Aomisig6`~F7@ z5Oxk95h*2TtM>A8=LT-MCsY!+3h%qV6>-@zc@%1UINZwf^4a#1wqd{I-glsoxDPS6 z#jgwdIz{Zt@ZP>vyUuFiqQ;wcY3_maA!55w@l%?s+~A&Lc`e5*Y+yN1HB{uVieslq zW%5>bkzc3LL!wp==fno!_qZwKZL-$Fq^jPD`mx3Ii8>NZ^o&H6K{ygiye63bgbFv- zaWT8EC$Uju#hK!F(Un9`{%=WA8ArID;=2Dtbo}66z>bjl>7~8Q$7$Ym`uUt2Xz42W zkX&j#k07D;dsz{LDuWZU(=cxd7dU4>APAwemCfqtZA#aD?MhRQO$C@`B@ohOd9y>N zRMLnqxf*V?D)c;KnU{`zQnZ@6UFh*?W=KQSN@UdV@kh5^+|-3V{+CT>Jbhm3v)SFr z9P#wr4D(QVEy$Or=;MfrZW?Rq9Vd(~hnxKelL`Ap&8QMzTR_1l_s@`wzQ+h^G!0~r zNwCV}DC@CY(*Xb~OWjO4?aGIb(qU+FRjppjyDP;bat6|4c5Hroqe3gc2g)f6g2NXL zj$hTlT2wSDV4yz3P2PYy{fc=pFeRW0`mIS6^!BwT=6cI@;@YjX5-H|bWhQ_YRhHk* zg;IT;Y~2`)JuC&ii~{#=alwXXx^8&s(-*P%cZ-rC&|Cu}!o*Sv#-F$9b6+wzO>eoa)Kwq- z2rxN~6!Ss;itg@(KTJ}_-_K|F{fS!@cg>hl0evERNgR8R!^i5{9tQ8zlgvBE{2!DKgTKFj{Gq@&1C0+Ui0eG;qNmu7{LdNl*JsSI*lsoWJgQT zv-Auo!KHv(>i{o`BnSDIEwmNL_w~*?s;Pz0w%e=3bCvhXMl8h|@3kN6PBgkP*S1ef zU=PfKPI0mC!qMi*_PMZYx?w(oo9NJspmyhPtVFPUM)kuzZesItbs_2Vi zT>1sJuUfNVXxN+AJUE?jhY^M0i~Jf=V>EASU?G3hO+#!hm!{?c;aRta8PnndLIQp0u0k~9}tpJiT z>zU8KUrD2zUSwoTo3HC^K#!XgRWcn@YvF`O_phZIR&Rs$Wu!Id?OdxZj!MG4%t2z8 zDfm6WW|jObZ$}Ls{PdeE_FwL%02@7ja;#KQeUs^q8#bg|1Uy4zpv?w8+kmbHwJFwl!472}&fn8a z+A&a$Qf}@_S%HYhnGBcl_fCKZzK7=P)jPCVbAnOlns8@RTedix(%|Zdk%%%9$B8GC zN(rx#xIC{wc^;Er&m5{+Q=;l_su3z6m;`IJ(n!z~*l@P|Q91M1ev$o0ba%^%zOJu& zR_65$tJD_p1Y42h@3wr0&G21Tjb!Oz&#qFoMvh6Jtl5hXYF#B~>CD8l4=Qb&DM|())lT#MH1(Y24PmSC(~+Zhl!Z!M-aX_~!?Y@CHg|X1cpX4N0j8otPuu^^ zRk*Y4kdS`#zKp#~4w*FqJoN;20XNi%69IY_E*T3{K#PG@-5ig~IvSX~FRCDj98>LV zZSN3rkcwk%2ZRV3`lA?RN)?a^Khq9hLjL8eLV((6IR#~SD@IFHp{{uzx@Q^V?^ox1 z$&=`Q%5fPJ{&L0w>-*=?JqL#&+0-~kg|-LrT1~#7knApdPS5|@d6byOMV!C)>vw20 zpXhh5(=jkb@tnYP&pW(yjso!`TL8z==i6k~HY>B9>tF5`c;D*z!`NWClwrc$pMdAN zMe~(GWM_S|aaqZ3y?*bI7#1sXpoq{XD_o<2>7Jv_~US({#$waste$gmLHLN>#T{4>=sFb)bGQ zRLsgMTT*aYPftO6HlN~ji@XLWEJ75MY$=c|m6U!wO2`ic%Qw&%5>w<(fHQ|y^B5B( z{VqN#oZ6&MOtPLRTimo7>bqC1$bV*;$+nXx&K$lw5LzSJHQ-sv9A=5%APl2*E^R7W6(o{p(`=gNGRSYK|85Ky53I|hPaEGEa z%aSGFP4waKuWI}*-oQFBjQz1iLuz=X+oj^E<$TE~dJ>9ch&~s-l}1m`NP@os ztXAkQOhg9^5m8(%A35IWDRG`BB5HZYP@bWmC{)uFO zD=bkiIGN5wp_qcAjh!5n2UtOA#rG(FI)A&{&7$wWGytjQ7Da&_HT*lGbyP%=i%^gW z{8DP`>*e5Ny7xfk(w-Q>r|pH5aqpX)BOj#1s%IJ0h*Zy4re@lI4c!uu@KUR zYN3T%gLSWl)YW#NL?RSXbXnuUJoyOExC4d0jRdKG*=rIoo;4hv<0iTvZ?NR3@V?%* zH3SH^3`{bdWe2C6t1o9b0o0G`w#plbcz3p}RH{yqCSp`Rj;9f3g@H%HvKidjf)-ec z1R?JWAXUK0o>J%3^ChmxX8$i|fgK+h&+Q6}N5k&+#>0x+|2vr%lA_$^{qd_m2Fy5w z_&n-jXWuM(Zgg8c@%ed^ePi@VS_wP_JHN;n;OL_p@+k8vJ5W61VX_V;NlJFcLV|c_ zz(af|m;AK<21<5q&~KMxX_68oCpD77@VPlQ7^17=CE)7XIujLwN_(+YgNyh{x4A7k zhclaq4>z5qEBIqUc)KGP4&7a)KBpK#M_AN?fl?E1gitNA;$pz(IyabKX9yw(WN`hx z;Au(>n%H&^+M8)j)(l6;buM-=J!7o6NwKizZ%d*W=bxFF7AM;8xF{i68d7ZVC5loI z>66-oV2PSbyF+%SZ#yzI$MFHj$HH6BafF`}fhxzx*TK$2(EJDM|B*0}n?>`E6-Fpo zc3M7ngSRBXO>dACO={74qh&y$g9Wx4@Nw1XoJrNxBIVF+AcW5V_D3d1nNL*(1@J-OBA_6# ztJn7+13(Hn2IF;Wfj{2j`40}uyBg6F7Vc7G*~P=lk5Sj`TZMOm5HlJn(WS0UvmE^+ zlbcuYYIjy7H1<2}nCgsa-J9 zD&=TSv=*ra3DM$h!6dw7Lj_nwO5kO^ZVk42y0<-AuL(3Y#JxXRYv=pK?k zVmvqAjz zl?pN0=t14rSZbw;Idg7L?zOC2D-`>=yhO|KF+d;w2Nh^<8Q4CHD5ywe|2jxfy`SRp z^7X7tyfO*T?lN!n2OYf0ER%hf{s8c^DTClQx)^*cvM?eqQ_68B4vgIeO-yKK-gn*0 z2ljMkzt>^*n?_@fEmJLdG=zLMTDPK_MkvOTlS@W7PeSFYhcml$V{gl1nWTlPI)~o8*^GJp~_c zF&dg@Z>96_*k7JbSeX!Cg&ryevC)U)@^B%Pif1tWy@0o>5NFDhmJFBqm$ie6uDAFq__FwK4oKp7eDDsK{xl7s41Be+uqp=QzJg z#eG&@G9_`KVEq@txc?UJE0=1*_DQRu7+w0yakS71t=S56bjuMaQmE90&HPOlu*bf0 z-Dj1N@SN`i4(vM}9{*Qq4gEzz!F;iK8JLl52C_oBXVwWbvV!+*4chs?4DTeT=S%3Z zAUa@5C)fXZtf8M=?tpPeeF;GCm`C`B5iL5qxjdiWZ}XyXr!T*Yi~R3ibh9H)3`h7= zyrCflWLbLsa=cMRDR`8L!&Hci<9mMq5u9DZu$fkhsrCm0nOyZmX`5=Kv!3tkH>$7r z9*Is)V>+pvWI}T323AO%u;C+Ok8Fi@*@1<>GR3j-oOpNab1{`<`SIwL-dwW(9}5tl zVV2wgoE$2MXXm8Um6wL3`sPy23T=$pj=mY3@*DY^i5Q04?jt2JD~e4!Q!Np3W@3pq zQE6s2+dpZjByBbU$g#Y#Kk-aN_Gv|E5${L0g;0bd+m0yf2i(#;@Vp4hAj%Xz?f^6N zKSUwnn7qO{mOcbyUON928y+~I8)2Xk!=SOt4m27ZjLCV&ecjuhX1rp_YqmLEg|PePwfgO@_bLnJslsC~ zUj5t^g_9qBBy=u+5grn8l5zWyTAPI@LsN_8b}>FS8bZfFG4u5e#t!Pt?8)y97a{Gu z-^T-WMdAe|T-WpSR>}iLQenur|97=%?G2T<3&@TC>P{4gTbTJ?ScTv_5l5dN9X_=Z z^0F%tBYr9OFzh7X6cawE2g(@Dl8*=c8;r_8%wgEI0b1Cr&b6GIW!pvrE64qerlMYf8&GSg#8!2 znOv^=|5fKFImry#^lgTeJCxiWNXj)2YuFpnX1kY<594RXa-s_9idQSNC9iV}@WL%g z;Zvc|NCJ}4l;NFO0mkICRTbvhfo4`$trC6p@S%9{yneydZ~Vm? zf){AHRTa`!hoJW*w{xuc`41gAWmTSK%TU(vN<;!a;e3&u$SR@Qq z`2SbiSB6y)we7-YD;p#?jYxNQcb9}TNH<7GcSwhHN`rJtcS<)(OG-+&l4rKQ-}%0C zo%8qjgUeaWJb6F&de$(r2F%Ao)23v-+T6Q6h-jzk9HK{Yz`yE~#c$jR~hJ2Ymj+*9Vag zTRtmCsuTu`jr`2hr|LgKa8qtZ8YeLAT-q`45VKj+;~SeN;ma5#uYy9e-g8agqIc;X z_3Gh|;C<42HR#TnalMMTE{wDH8M)9!Ihu9E)bEu|q!f!~RlPtK=et0xsgB1WdnL`# zrhr)7W=aLgL&c5ZoyL&^(|FxcYTP$u-_zU=NcfOt)`J%P7{B4XcI_)z7$bZU{RKCg z9{JG%S%cu&NQt-W5vOc# zUyjzSK!(r|>C~rIq{||!|DxFdH_D`$x?N=vFj2@0d+m>ie9Y+&h-sOMiB5@s^ z2&>XMr*T3nd+P(Ngb*_6t(QMz2~7ty+RRqJmwq{}DDN7$emUHFI^FgBo~gdacx?X1 zl9lsB>VBkGl;MRGZ=e>hvwD+aqQv{}h?ZH7Ngj%Jle6c7nzHS+?C6MIHA@}3#F!j* z7d$M=#Qs+%%KNvDx!Zpy8-M+PKb#KkvYPJRP&do0C%^eQmRJZw>K-z_eVJNu4Vf!f zW$i`8rf3f+&c(iYnQ&NY>xrD}NJOBaR6X<(?xDkC55*zsC?ls=$E>o@6E_H3{wt8C!%0)d{a zv$~UvQsL=sqoe*3xkoI9lYwk)%`$B$dc0YS&eKp>948wlxq2|?GuCHvxMF{hdT9$| z#LsxV8qt($e}LW_TX-|haKslB>(^t0dS49|otd%6eR+*-$%W*q?VQ=s)FRxlRoP$H z=x!+zoAhOcOedo(bvdIvwfbS>17fVun>m*G=|EA3DV~1^WwxwhB#o(mCdm)A29Gn7jovP^={gxU zC6cYoES7Lw(+^hTS(@-t+2lTrEE_aJZ?Tt55eE_XxlV5#sTOKy8l)5-gu<>0}9->iOuC(}W4AJ^bsH|flM_|8_UX=Yb zlmIe$Uqq=0(T@I&Pa9hG%qO@024!qS1Y$C6@R_zt2OB}gPk{t}Lr?% zj6>3fOe_(S?ObJ8!vT-@Ykl8pSzPIXxhg$W^Fk`tlkaL|7?4N%iLnU7iBzFItpwL* zDTCHMKB2x!JpziTII}!rbV81kGe|Ioh@LU`YheFH>KWU23w)v{bdC=-9w>jU1nD*XB z34aW(GZrUe5ER^V*$lQI$}fJ^KMCi8R;E0QK#!r7XfHCe)v)|tV?!X3ab957v;Fkc zgYRuVcye~G_oRphWwN{2QP<#@!Co$(4M}7H_1WHgC)WAljdfl$*26)0e3gE9jqQLI zgS{jPE=$Z+En11*oo^`56)h`=Ma#EoJ@7E{#KV3%h^HZZpv%)oW|e09^CEeVjx`yA zsUeNCNlW{=tl3jrwg$V5_sI8Uok97#g)7$V3dUj3aju`_k4BC=_K1bMFAJ;wt4~MY z8ZUR2_@Oc5A!b}OHXB!{lYB9KlLjtlrlT>zuA^K;#DUqgeOj6^fei=T;q4W_mRgD9 z8TEOL4p#XWTDc7y09VQn@qc7wzbW3$4q|v&-Rab?GN4R(!g!RLZ(S zY>H_=G5Ghmkoyq&y`p}6g>W^c;8&=!e*2%ph{9jnp`Z|I8e~(&26*+1($IeOvFaI! z28sp}{hoo%YFU?JB+Cf+1bKqK3O(>qljTF@Ms&A2fRDx#Hb#Kxq@2ERZeqJ8Cy(k51m?@VN& z_c~MO7z{gf{qSo0_`u(4`{HbvHt3 zTxp{Xsa>(J-Q4=v_pK+Fe02lcAJvC)6B$v^-@31@bxH-Ug#CGGE+vL9&}#JbgOPru zTdTsi^o%meiuX?ul^+$VmSa@)bBpSXD%{T`-iNo!mx70hql|wW-dpfxPx@zugjtg0 zU_`xr>nNTH7ABQ0X-K7!Qr4je7327N&dn>yyoHKkde&sW+T_-l5&AFqDIUC zUnmTy9ddQa@%E3i#)3K}E#}KR!p92?Gs6p!+C}F55^KDjjpg*)JuUKxClvs;c(@ zfEsZF@HujYQv!<`@k^AR=Lb9fVL=PBO1m+m4Z%%;Z&Y zq)Gp{KaFxHY&}P4$CMU-o|FRqQPx`_E?DHI(t5A#&7I|9MA92rBk(uk&rOtXe-edJ z=*%)WC=b}I?Y&p-JznrWV-fizoqX#4s&JjM?ALP|FPRB-87Hse$DpG+%i*t>`W3 zsU@E;LR$${dljf|ee)}@EgP2uWn}4iwH+WOE&<<>(o^~Z_wbpCFe5+Pkqau(W=(x* ze23O~n$#km{gp~yRy$Z^iNe+3xT9R*WIrv^%aqcVJZhC9VN9qE1F7GUCRBv2L%HWd#hau$^84`Ndi*2>KKn(6$78arN$eyqeg1 zbF<%`V>!_0Z*w^>di>fj`@o2@yo&(|-SVkWVfBndh(G(hn>+(|5>(cb$NL$R+$yaS z&c*U9JPmT)f}lUC+IEBNigAiCc*IX3{$XLC*p=@K|J3`E-3I7qWOHm*k{4LhAC|GGn?PqC(GlsX8ia%nHnw0?BZ zr_Eilur=&CNq;aec}qo$V}~ALE|N7B%(|@cVRmeo|a;?S1c)Qa-_*}5%YqET(M5+@buqHrcK%5Wofjy|ntSZU>+ojdLItuT{y;oV45dEy=@iQ`x$2Cx&dL^XDqK3R)N z=D^vS_N%ljM|jmAlr;v4jA3jRG|i?bHRD?&F1Ftorf+o^5Gnd|S+4olcJ>r&R~LTo zdN|ka#OvV+-go%asVyanKwJt@x-5>o78(oWDP2sSj4#bp%L2-5$mv$8-gGMY-}QSh zl8Dv%NJ~#&8nSD2-EdfDEu@K*Pp*DDA1Aktl{AXO7)q!Jte`yHf79jiB=hYZtx%Ba z)3di%9|tyf-Nd&G{k&&`?I#jW5nJ-afp;UAQ)Ht|R=rEACM3gImrDrXG=$F3!t=x@ zdSoD4qod+}sp<_h%~4%Al$!R1xulu~rq(=U#7|7E;F;hO@K+D2a7s5tzZ0%urwW&s zraSzDBkiNmFE`6pPKjepzxHQcPk+`@+FoThvF9h8wj(m{FLMkn#z=zEieZlOFEskn z>;!$u)M@XHUl2!Pdt(; zw~qgOEFZpk$D9r|U{J)udfLgQY@f>2vkRv?x})0NC1wWO2br3GN=r0Ai|$B}ueW2a z5cbNre0w!16;64u7f(}?VXO7-o>o)f?oY_%=#R$7z}xW5E2EK9+qsIc%4PR}Ao{O- z35;E9lddbQs1kY#8rwUzotKO4O3&gb55n6sxAVO|z$Gx2J^yuEPGhY6?$!6;I?0u=I4xfGg&PggCj zWf)_DX2yX{$z{%C-`PQP3=t_sS?GSY6P;Bx2{|`tfjN&yw$vD(Y7fVL^y7)NG`QCd z7lcuO5b67>*P6e0$Y|hvVQf=KFvkzwzxi`R7}^;UaITzKSL|>%(a`WGrhroCPp8C8 zC%lAFU*fGmaK>7O7iznZ5zSEnmVT>MWmSmvv+4TLcMYfHRl(vqVv{jy;RZa~EV3&x zd`Gw1;t<`AnLoje#X_6%zys&J#!~eOnmTgm>w@XZHa_`yeZ_;{ z&EoIUQ*8)5jxbV3ln1G2=sT%c;wZGaIWDjpWX?;%g;#xnlt=bjjVZ^N6WCLZU;i6a zIL9HQ%vJ!Qv-?xpu;!1p-#bNlA3jp*NSGIY&VmLKVK$#<-zc#sC!FYXs;bpEv3RF3 z#B7J3l57vv{-E@zSnFHE$1)Rl(swC(Ux?k#=!GdGS@;a3YiwPj!doNQxaC>&wl-KC zBl|b)0R5No*W7G|vM%uBzzxfYf$8))FMw>`_AXxjHk~(28^c8AQzR$F95My(Omrx{ zNacz?wU&AGee7W{NS9cZtHo@L`5m&=0tNDC&@7J zjlj4}x<&RZjJKhM$vFy1js!H3a~o_U10bnbaV?!u92&cM1$Vj>3afM)AK)IeHc5%J z!UGj^GL$5*>SH-GdcChr*J@N)eRkc9N&nbEt%FKgP8ev@T#n~ zBUm?=#K?T~6)!MdFD)XB^47Ht1YW8#(h{EJ(nL*J#T(4Mx94G$EhSG_uKVa#yP0Q_ z$&=&g3jgJXLgzR2b@B5tREZEq3nzQLbF_@p4A7pA?l)MT+vg?`1CUZ0Acy+=A?@6|pr!s@9PE zqOoP0Md?m_e(q)FxaKZqy_EgQyR+kYRK3m&R<*+-vQ4!sTy08t&0ylXENr#fP`#+7 zYGug(Dl_Cop}aSV0n~{;B0$n800Rg^KtM`yJOqUr6ovb~wbJp5GGB5>;A>Yv*|P#R z4uyrS)-uW3)|X|@FIC%;BaWIN@rbci6^`(wzrn-j)X=S?fVPo9gGx7L+`i5T%}6#| zEaN!^H|oasYcbm-vwf{DxaHs0UDAX*vK11z(zId)n*h(J)BwMK(K(&-Ms#CHuD?WQ zdeNUXod|b1DPUtoOlvHH3x)PySVW}dWxQR|ab{3Rno7ipOo&IM(Rn3TdPIMjMUVLG ztpO2Ko4TiRY;b+S|EJr*($GQ#&{hwsw)N9#8ObN&!2E?MDq@Hz?g*;~nBl+& z>V#TfOc{lB{P~Si(UH)y+?tr4j)v+_Nd@}4n{E4%7MO`XlA;L}K0k1*6D5sEF|~oM zK?vIS)Q?#nkku5Z89o)g5PBXDKH0I1a3p)C0+|w3%4XE!$JQ27p#!zMQxyP;^{ptTTEU*A_(v1cNDMlvBqu3&DvS+8IiDs1%L>f2hDhyFbi1~rWW=h>db_;} zU0r%Wjx6|=7)Zt~u^L~2q|p$CWB3vM)_-gV71HO3)vOWr{8@0II`fNrX4WI#x+Etr>P zUZ}AbT?GoVKP`O9BvTIZ02l+W)YL)d$A1zmGfK{v*48=0Ai3 z5Pg7DW$OM9n>M0=!9Mqs?GY-Fkofv+h7sF_qjxNt@R(R;xAH_Q9`4muyOZ!=Gg!4@ zUTF`FUdV$(X+hP#h<^M|pWXDNLgp+PN~#)ji_$E;)KgoP&9X z5C&X=5Y`}=D7hXk3WSZqPxZ%_S(;o{<&*0QB z0u`ta3kILv&QT4RGb=K{X~(A2u|TQY!oWJW%!0=PsCPjCPHTlvA%aye91QZHztN9- z37EAVnn*+ijC%maQ?WezzkdNc|3AQFg4u-o)~N;tVIiG!!hbMm0pg=+&pWIN!`r3V zuq~{x0ktn+YM-SNF#-p&$|>#7|J95=pegyKl2ekTkt~JTflV1498rLrq?mfmCG~HC zLPt)FguNs2v_2Vib*n-g99@TE8#K}U7E(hHJeVVd z#LQszF=U^``IdZ&1Dvu7enA&#h?iQ@GhN^sgtE~Fw+rWeot8fET%d>7=ONmAqa{0! zJoX>c`^I)-baq?|;X6r3bUTWz_dAGDmh|;WlBGsheh-@7o4T-RXyjLE7**s&dop|- zSUuVH!lcjqX^S5qh`>Bxb9EgF)11%A03V30H)O1TL#B$w#-Wd&HgzF6x>GL~ZpvT_ z5NaEDQLFp5!}{33aT3yX`A2Rm_%A=?q64@qM;A>}lLd#egC+Kdg5{Q9(2o~|~Z z?#(yBP2Dm0g@!@J2JYqY6x8_~SCV_C-H_qHziNSHC=ju@fYjn-$QA`?6gLnV$s-Qb z0_xBW2??64|CFJBf@6B`juHBDhvm5d$(KZ+uYy%30uX5h11vyDHw}izl{Bx`>=4B? zNLQ0j`i5bodySqbtPj{Jv#cRxmMz23f57)txkcljN?J13Q}>Cy;Fx+1a@H|SZ8r`< zQAkT`?VAfcoKl2PX|+UP!&@CXxW}*iH{Bl*+)O;l|JK7)7_73xj7CZ+K{DhZmNkf_ z4WTC|VIBnogKJmW^_pE@BVXuqwMx5pB+kEGEgz9nh$GTQxL^kNAp}0Q>7k+DZ_xt< z`#i9ar%x!Un`a<;+PA;o_hi=QUA^&*J;yja@h5-u`@tG`O=fkVe0WU&HxI&BbX!;> zMAs-zmzp-zBISuuW%klW*t}G}dHKKi!Wi$J9NzF{rTe#Q@!AWA>yB*zK(Gms^%QdX zh{kuyJ<9Qy7^AyqGB$SMPFF_QS~cIyT>Lhc2pV@k;%0(t-i@YmJRoIJ$Ts*}vzK%* zrlQMqVvp!P1?uRed$3$!qBnA%<(W10}p?|7u&MrEw>KIt-KE1kQd?at?X0c)b>(w(dS1CR== z%2hT}X;L9XEs*wGyWdq+eX~VK%Gs_YKb*I!)T?02s5l4_5n$6+GTC1P|FRy?VvxY< zj6^h94VII?^8WH90A_^$K7u&}4|51!ov#q)(Ekcr^^=`%g5U@DC4< zcpH_8P9f(vtS9=2-}_>UjaZ(@+g*LCoJZdO6-&AX=w$%jOI@PC9O3|H2max?%l$K$ zT*K}|`|Y}?-UAf*co%g#hpM0c#5m^73VCfvfOH@cM%ae6Lp_7>*t2~K?DREGBl53D z_!9}x&7W3|8RiI4VzN`l%v&X-L;e;FH{{RwvrE5vuw z-=F#gd~lvJzG5Z&hKy6~1HanJ8cP~i^skArrvRppCbC3CfPY9plim0GM8B5`)+Ja; z->blFs-VoWc96l(CE2d86d@oA!PDS96I*!$e-I@;wW+_#XVlK-chL-+u=iU6t;jF4O(63s2IA**siBw9-eUB9Ugm?s&py0uR8 z&w@W|i~WF35hf10XiZQ#UuNlkxhBXyl~4`?XQ%*BPpCHxqE&|EQ>b7kq?bixC~Zbn zrU)5-%sou|95&Qs%0=hZdy)GQzXWAh;?U<3Q@^_fwR1JR+!@OIm%wTObqv)_GK4gk zLn2^5#0v*BH&wd@6w_Sz0c4#p01e($Dz2M(2|KS(`;>TlEJPoVoID;n?)ARZ|7)5q zQ2K3aJeK9nj!Y zAJF|h0LpnT%NiJmS2y9R|8TPv|DLt zPnlVM?GA4!JExFKJu?grEGPpPzugkIi2;TxlV;W$w_V105zJ+>40@RlQ*}va#eYbt zbE+KiSV{9JUxWu?1c*8zk=7=RW~`8|6M#07P=olq#coFso%;H@_i1$*XK4fxp39KJ z!9(sv;3aWmL10o0uE4dStzUwC!gN!f<=rpb6GcXYFYFR7#-G(%N_>CLiV27f=mBHs zJV!+QMry<#=r|Jk=<{1ex;{Jg9`#~7xjOxr;#v$2gb|(sN6w(@G!_I0W(38jpiU}u z`cQ_P+@w}aD#r^Q83n_EN!K+%;f&SNxLu@ilAxRvR9hNfC1FTwIX}viCBd4L4!gY$ zY1dkoB-SD_%$*sSJ29E4Wa~npUz@w{tm$9UJ6xjgtPl{8Tbj$hF1K5K&SK(8lHXn~b>ONCK`GqHrK)@_->H)f!eD5H%FCyJ^+7k~z%I7P$b1hfsb1 zOvY5#!2(%}lP)#A5J|vHC8YAFaKI}X4*HORA*%)oui!)#w3i?y2KO>y`MI&&n)L^X z*aBiLutd$$Uy)P<1$+UMGhy++`lB#-bC}Pj3k%Ws+CO>`m0=@|fDOU7QdOmDTaIRZ=_;600e*a6u z$wxf*4pomz%f{TtyV&KfJfwD4qsghq9s*dc1d9?95T$o8i}bdT`GBnhmkKX#1-8(` zvg5mm)2RqfP*M=m`OYKOIta}Jd>9QqZrm32up8M>U>P*xg_lg(fbSKAq)C!yvKv=M z3;4@<`8xz2KC;+(xBO`4)cQn1AIDRLvZb6AZDW(te*VUDJA?X9G!xADe5!z<$P}Ur z(l`rnFCEt0C?0cG>Lbe!=GnST4?l|j<*Fofhmq8$qYZTZVzUu%_Rbc4r(HvbF@ zkN0>Wj8jrTKVnd%0!BCwfW_d~2{gr9t>4CHxJ@FyXSyx{yComaE7ZoI#RWZhjS_TG zb1R7O(am$2MPN@PY6-_QkyIeU1OBH2kRJX#Zh+xP7pP+1t6Zmo#ayot`{#w(&9$g~ zS=8sct(k$mbKOal{ZoNM(?3261t>oIZi@nah0UxlVMQSY7vCQQ)DoCVh1vfi%V6er zLC^UPPT=#o;gTJT{Tp>4Bbv0C8D{4!Uc-z12-`*{qNcXyiq08t&mP_^UW}?7oC(2@ zs|KK4@gs_xST_a;IQwN*0vC50U;51BucKOblV#t=30B#-8W2OI^9QkN}PoK*TbV1m8r+d}cOJf`L zrLf1scWWU`&Eu#-=-WYhcYR*x!@Y>2ft>_B_rntB96W6lfEyA3Zisi$c?p7ts58+E zxg7mQl9Gs|=^NSx$7r1-qZ{}iIm-Phif49zc0mRg$P4g6KLPEi7%4Wq2Kg8Zqpmuq zsl}v<>7UhCV6-Ru!H`>uuu-~KtrP~@NP%XUqGnW4oOhz4k`)ri>5C3{EQax~Bc=pm zgXv#siqv*C)D>JkN9*&Zsqz2?Y6A!{p&IgmNQ$oaFI!Z%SR5{RhbAi?5%+M0wgz;6 zDH~}_yt@(Md|0e3e`~}{Ee;2gBMlgm2bnbn1W@NrnCSC(E2*yaNCa%Mflz5;Mspf9 z9l1wM-}k?Qd=-a_$9W;NBTgy~YO~L9em}Fq;6#ff4Vie>r!nlf)_0&+B%~LA0CHvn zCIeXzyrd?SwC)+0GZ1fQtkvhIe3_hqFZp$aJ_V1)yPr?x2B@rlVt}msNm6kmlrT|7 z0EAzrIQ*H(NAK~C$-oJ60Dmbi9VTCc-!Rq2d?!u~xml%gAmQ7@iduPkU`Xe^Rj7(q z9?x(XPO5$=NLxoBA5D(Mkd`1d1|%U#jP_#uW`tLhoD*65A}jCEqQh*^O1XBo*fo6C zs&;<4#5Gf`OfnyW8o%8dXUqzo2?g?KC;qX38iVz<86CA!eC_oa&DNvLDC1i-8l^+1 z;RIuvkaPWh%kK7sM!D}!i9e%3%g9I^@O`_4DqlaxdG;Lta#v{-rkVlGx$oMxf-O7n zB$ytZrNg%m8#gxF^9RI92#DxzN5yk$*9pVy8%TrCA;5eN(8C2>ASIMl-;56XrQ2~* z&f}>2_JbOUZehO;l_6&GpEm?7SE_3dgB;r_R&N%ozwHuMytf&<+>{gUl}F+hI`04F zo5HHges@yI)u_?I_|jdN<^cHSsAh%t9*2oyMA0-wRE4jh|88tbGd&|dx$YrdTaw4O ze2nX5YpP--mj#PuVDe!vlnicnd6g|3&NiDXK&09 z(7skcs%V>k_zIQ9Nlw-r*bnU$_q-nzNf>0HH#73#H&Uq7s7d0Uqo%G3fHfFy*N6h(KCM(7da%*XCzVT}T?I;CD-i@-z_o&@0PjY)KvC<<5+ zPv`nVgZ^7m&b%`6bF@o7NVUSpTPCrPzDKvb+olJMRyAyEO!FLv$(Y4mfjZk;qBH}E zkK0GR_{6eBK&>JHv!Xn$0d80TOQ3ob<7T`zh?C+qqoHP4z%r1+AGmCXu3P|hm-pe# zct~o>N}>da>H-W>sL}kMdlsmQ(il;b8yPdI6qa&{ZaZMWJ_`T3^%KB;vl}n01<4sG z$)AgoRsynS=zs8L*Z^&fx(w-;JBnK9XzDE4IyVsHCMgte{ny=<zuLc-{0P_<$#@{%odwu-9Q{(WElHG-eALhN+iN*~1HWoJy%yhi<{q-CK2*6>(`Q-VE=L%qq}muXbUGVk6tH+T^5AP2PyPHp zS=M$3RQ+84^hu|dEf<}}buv1KC62tPb(i|QN5>P- z&Ui9_;5}!#tE-T{Z6CG7S$zX8@rQvQeC#&@YYjUK0<+8B_WPlwBZF4L;T2XTY>1#$ zAVcT&@6N_VLDP|p$$u7`FZdMNGll1;sI-gll+V4pa&4ZMwH0_Pv7rp2S3?X`PvSY+ zskK?zsOPofoJP*U%PGX<(({}5$ZXzxZ#Yyh4o#G!#9Wm(8_QCC(`ef)l70H25x)xB zMrCdxWVPf}10E2M3?S*tXZ-?w5J`$!mmLeBdMoa4p(L@HH`mYF-tsM6aRFOZU~V1O zR|Q8*m?hh-&Ro@v{4PP!)A#jFW&L9L!)4cfH=WV4Wy)`7w8gKUTp<-2bmY6fE|xP| zdSt@==^ZZlXpIQ(SfFSmko7l2aE;0=py}`mqix{(m~!<)UWZ}jOsa(nuKZrt>={BC z+wBfhhSUnLe6&Ev$F3srVJ8or4Spqcnj2=dy_h-x;W#}NmLQfKvFifK^2K=}}xE{_OC zOKOHW6^egzrAHJH3B9wgFZ+;yNF*r)POvg%@bGM`nV^G6M&Gxj|>vZ8~S0W3IKud^;^ zf%9>6+%WU~(5~I`gb}yL0zxQiaVLJ4sUMfek9_)6#e;senzzdQ{XhV{tsG(7xk%{< z${}CBKbGPZrE1ycqN&t%hR+zZi)}8_Y+HK&?NfuW174^a^Y=pehelu((t2@%Tux?0 z50rjsd=IlSG+fGz3L4&Jkr(k}a&2j1rkJqc(97n|t^7#RK9+cxn{M-g7Ed}l8VTc+ z6S%0jFUq+H;0a%D@@rv3{-{FfQpJ>CyI1Hx!$6PIr})O26WhE4BIQ zA1yWwTuKkeS~pMH#LKn)mf0N}B`d-YccLGa5yoHOXtqtZ>Kwr8@$mkt714Yu;8Byt z)AuRA!%nh9NZdE}AB5u!0O$8{9NJ&A1$u-tQUzz43sF(4?<++>uBNs665#Z|{nQ>*wCMBgGKwY&nmATvB!qbWeG4CFnoDXLUDV_#~w;v}iXEl8q9)Bkrj+ zzm_hd2*v&V`*6&x)PH_!sZ>Q|%ahzS%)HRB8W1JoGz z{TbMj09vAoKGd4Cq70PO%q{mwf?EQ3&C~0M@O>mvo5%Y|#x}<{TJsAhgx|FeOAg$U zjOt%dGHt1+4EwpNl*B#9dgGQ?G^e`Q{>R@vYK_A>?;7b!h@1hNtTRm13pPJ#wV!eK zgEy&a52*y(6mE${eHUvVm7av(#N#j~Vk?^Q?f${i;UC>@R~p>cqy17?=hb>&>^o;Z zQ#-EL%5Gmg$@Tk39{$N7d_0arKCp0e2l|T^0YB{%cF-AAXM@;i{)1Fb;hSa`I@J#S zJ#5~dkvMt^^QW($hLI_2FNv=Y-0Edfu#b(xmXFr<6;nC|`B!7n$r)B9bv|L-M}#VI->BOv~~^+eHq^>CEACn%d0W(!=Y0_L6K%bl=aG zwU;{V0MJJGTdk+b2ij$+NXjk0G@(h55BJP8wawR{jbqmNVbmRj3qpmqTukx>Obg z{2lOiuJ<-fi%rZ#ZVC@k-5(sY%_KE>lkgD&FUf$WAxHaXDLjmZo~PLdBgxB_#&$`U zQR9aXv6CS$z`;8MB{&xGEafviP^_0?n&}nAjSi`^qbZRiD(Sz)%+m33-hB}L1)TL} zFgxp89Bl3olQHuY==4Aglm$rP@0{{g)M(z$nOUjTTS`e&NeQK#bygB|#Kcs4vT?=q zExU4vYg+i-2RLv7P^8H|JBMil;4<7~;#T|X%>2$E-(|ATY|zQ(RmaWdduw1P--Pqm z6hc3-V}KPY8vv62;Mie|@aXQSrf~!3@r5rpC=BUKLbd79+*$wU!bY(P=MLyGw}4eH zRTxK`XgB%k{f~4CcJ{h8W`j=hjD$RQVq^{a3O_SnTT7V(R33-LvnqGNJ}h9lj|(J6 zdyfqdq>8c7U}T``~qwxhh!gwDgaETO9GjyQI z#{Ji#S>vs4_rdvO{fXaR1|znM7<6a}dpvMWn0S(=G{XgYz`EWH+5<6C6wtEe1kpm9 za&=j|aUUXj27e_@VIONQ0k>o_Bv#|N)p2KG8te7PajK@{1y#$mh%^Lv$Y)@c%FqvQ zbazReD<76Bz<<(iF_vbph01ccD)3|@=9qq`NNYT+{uG}n?DhF*D-a>I&D=szE@JA3 zhcN;8&1)d)zaTaKOIS5%eU>hUNy%A4Z3PXLxpf6u)ViUS6{S!R2@v1Cdxs(;Eus4E9n{p#ntwsn93ieN2*8 zQ8_Aa!~X0xxB3kFT3Q!IH&chhq^XRKKHJ3L1`CUe#Efn^=`F4FjYjSCIomlAA!Q(l ziVY!g12R^>M$2KYcn`VVc{=r8y(B?xoJ;Ag?$j#aiMiz^!mneB>=@gB#d=R60u%NQ zgA8gz$$yJCwq(xURp6*T^m(^a&WCbm9_Zsd6^7do9}hfs8z=;&R_S#|{=n*a1?6I3 z{(CB~sK|wfa;rI-8}L;xxV+42W4v&P)OgKlIMFaH#{2$B;G`i=Bv&T{9{pc4x>^+c z5kl5hJs|n56?Z~ATI(Hz&T4)SGjrei3k$QBOf9Y?{Qv!|zgVuvuHupA`TmX^F7wDn z2Z7)B$4#mJ$Uh3XZQuX>&^ru6m{bj;>*a-P#+S?ZkjD#FU;>%etyXUFvu*evp(&ZT6M>elz80@3P z;G+i4b^&Xe$yOIsIkn1#n)fLyjwzp-hFDwSk+OZDYE@KRO_He)gzZvT;A2rvtY7b8mmgBYRZXpt8hMqMV;Skcf%4$ZAs~)8D(I{FBliJLy zw#v5K^&Q8pTHn*v*0IN3Qe#DBe0iCm$8T!i4pj0?w=?`Zjh-|Uk( zu#hfklq7v@W54YdrdH^!oR6*qRg+1eN8?I37mlm{Hz4T7`#b(H;0o zLRVxB1SqK@^Ub~jJMAs+UiDfqPla!ps_;2$?82Vo8V13;wDRw;I9xFPr7j|82rvqC?dRR09_yv}3MU&!z?iQz=rLPes}kmrdz>Q3 zQ^dt%|49c@;%TeeJHRWVkq&@(a~s~hD0C+9YEmY&Yb9W)PspTwr;I6E_{(Ak`l zk*g6kKsyRWu$pz%^FXG-e(od+y%r(WG3RnNkY?_3b;|jySdN9Sw7vhZ?@Gg<_lReW zf8V(g9dWt~*zrPOLL<+=UoIkMw6;Ns$Kg0BLqWBCnoL6&g!nJB(2f&P4hrnu?zuD1 z>9rnuEpXu)|I@X+sMP*Iu=;RDSs1lw-PMl%%43ZKs<_j=AAMD5h3zL*{aOxTNV#eg zaV#xQv6wcFf-G><7S36XSs7_U^LEo4xS@idwT{HkJP z9W6gZV&r+c7#a(E|D5`_JrU5LW9KRBsu%sF^?4ntmX$jIo4QUNGrgw3 z!+9kNc^u)bKHCI;;(KZ}i&QnUi*?Zj4p84cUeC=yzCI#>M4krhdh&+5qhr|mS}CeyX#70_!P?4+K)57UQ3n`7$hH$a82Lbv7{r_}hsM_bK$ zBTB!;W{lzpa%Cimrp(%lxwW&A#l~ynFE^xoft|wKu)_sTMs_h2RCu?BES=+|2!A_G zczH59F;U2ij>l}KET$qr|hr zsiJ%-*@z1a=e)<++E>?8K&s0wF>UnI)K}s4CVI7`@N`IHeUoMmwBCV;01ZvH=M@It zwO3&Y&@f9oiOu~*t$L(CYHm$=uq;LE2?8~B(uo!eIWt~S4FU@5KhI%5JuA(Lui!S3 z2%pCYob96t(oMa4CLEON+zCoHsWr5No;Lhdm(}4Qo~VWza)L_n)bXr+W@a+ zIepUT*Ja8QkUHnSM}mEQH_(6DiAHUyb@7*yHf5`g ztAXM{kr~(0x%TIk%a_%lUv4NRD;HL1VV#Vb*P_g_(}(+3_JKpk>Jsk>S=&-I{2^KO zL&6VhK(L630M;}Pa5Lbso0r?|zCVN$8&6YHHQz(fX9!E^yyt+Gfw>Pdl>>uCB;VD} z<;!1%=P)6&Wn)1dFh(ZtKiiqv;1$_ks&ON za(d5AmD%k+o!1DkuRMm_mcmcBo%B6Y5Q$!z86|xm701GQIcAtoZSMV>eD!gwg>rgx z(^bG5^2e2i$CKXA5N8!t{VEt~me&L8LLW6+<=1)i#xBFHl7@vEvt32O$59HO4zEU4 zu=d?uY%;8w5RV_xFwKUpKNn8^SPUNPcwPF@ ze^BXKPJ7Efrxyu~C7mLZ%8&6>M#5BAggo`Uj0k>U67HUReaxBUYCOz&UNWfQa-9p~=l;RIRC}(} zyoD<0Fh%!y{oX$GOQf)R3crOKvHPZVagS9WL`hy_6VFF%b056cjaA*QO^b~vCwHJ( z_fBR<#juS^lSr1VTF%5I_cZ+PaOeJC8~(ll#WhBgdeq>8yq6VO4yRwyT;-Wv&A6x> zM-*x4VYfli{I)K;3B5Y+faP$i-wW9HpzShh@aMc2oDSRcQ&FeV@<~L z#0Tv@7)13Ro&s}^>I}t`8q=Nao5*jyNXRF;Z%2Nz{HbV;AZuG2p{Br$! zrv|L{NeL%2sWe^!N~774IccudwQ}Gjm1 z_V18(oD<5N3VZs*WLDSt`_L2ksdgYy0sSSXQ@|RBrE{;xKOicAM$vVBEi#d2b1o3d ztkfT}T@M2|unCPeQthm)H%nYY^wX$=eyGEGpaGY&bZE--4ug1~AP5yGu7DT&c`F`B z=h^wK#9corXOqpu_}$akj>Ul!Y`GFK_9C9}+U-ktyiYb&V;Fo=p~~@lRV0dQCpEQ4 zk?ns6jBk1)O;-X9r!_T#!lDLuTMGVKc6jaHSTFrlTfaMfoC}}CDEi#w^&CfTC=)y{ zD)zz-tmpO) zjz_x|fSntM`A>i}l34%VtVQI&)*r1fgdO^U6`I_*b;s$)Q$+KZj4M(9{<3xSO5_#buav?c9)`w2QcN@pwzj4C z?%sZ1ja3JRziNKYmmA-TD?b50UN0ah5GZT;X8o1bd_3QQUdFB@@6}^p|NP3oEM9iz zkq|Ah{`Fe9wl-2d`f>d+-u^zYPa^Z+i$Y^@ekoQ5&?fAaB{Jl$1T6lLz*yTH|8`@T zORexUHmmG*o!u&zUVbV`k?nbQnb=v*`2zauz8ar|QPiQklRDs`#fw211P$XdTBS;@k;%n?|Z>+{s)?P)j9w???0R_xmA8&2P?{|&5uV}}~g*p}lq5I(P zFzIRsrxW$X+0hRW*v6ZLXe3vkuQ;eV@=n8cmh9T!JHPPZu(D_^u9v32qUT zD)_^?sLeJTEWFK-8djtFxQ)T7aB?_lt>=Mj(Fr@W_8|CqbVxBhsZ zhz5WM8OjiA&L2hW!~Old2+XJoR6_sv8E13vs=F~Mf|E9Op6y}-Ut2d_ZS9QSZZ~D7 zyFC-8yE_w`#SU>kxb^M{9+Tx293x^PyIj8Q zN#w6gofizx7Vv*ew_&jJx>$C!#`mJP0H{(SOhdLDh8xRu^wIxPi?^8~b;~2Z_z6CVUY4 zyYwJIb_XL(2a`iTBmK{S4gA}}gldx_f4ikOQ_FdiZJnc#;P3m*A3g}>ZDAu5SpxWf zRAwFPO*WsRFO>fb)R4a|Y$GoNP5zHk_`Jy$IF@8Z_0ItJ+rmN7^p<4*XhERTn`~!k zs?q-p{Qrj{0`vduP%KpP&h}efe@%Y+`E0xA3Fq_kgHjfQB0l>!!|)?b4hoK`kK9!M zdGbARB9REeo{UHo#*M3m-wNzBlhs-~YFyUb%Yn6n)NYRz<|m~5-1LKWs~b+yE6?6n zi{#?GN_cgJ`bJS1fiKu0Ktm}o0Fn}KokR6G7E<$3r8`<{Wzc?c}_QJp|oLS>c@NZ05*y^4tyDX z+$t>CtF6!EpFz~+{mj+7{-oSv-R?%5)6RZ$d|UCm$&RITP7u$SSP<2zesxf#9f`eN zPI!Vdi83LaL(vVOQ8~^Gm57#SSbB%1^W5`d=DEHc)wZ&xqs7vM$zx^i-6t~{C@e%M z-sRg}BD@AJF;PmyGg(ZD0I5J~Ol=jB2jC;Ep2U{;%?16=vqJ7>UuiCt<-%yVi zpOFyOa8v8R3pmw|6ukZR?U&9{#aFSKtw=Tx7Bo$2vfN5f51g1^>44&c2jf4kus_)= zP)U@73R;Cw!)Kb!Aa&ILX61#l~2~DI=8HGDber_dQGzmgSP$H2paTPLlH`sR#m~;Iug|n*;GV)cO5E=|(Xsb`(z3)wSn=|um zb(>$q#{04}4FfVS73w;#-T=5Jq8Qu`xN5;lgz4jn_;uRQUu$#qm~(nDyrbE{fgZ0Wl#U{$q( z1`Lcvf9QqA@`~ke&ef~D;vH4TF;~k+o;AlhN_0$`Ege9C`g2!^`Y^T!s^D1fRx%=^ zP1S-Fss=N*yjQo)ABtJKc^dXix6yke`FHu_RHIb}<(vp-z8 zq$=>6r5Vk|Zw?-Z#-tZe$V*2>eCT%^Y&+@0&oW})!v<>PD(IJe-HN$w(U+bY~Ab8*V36+KT@G~f$JIyIJ$egl1wc|&7 zQl~H3Gpx13Jj8_d^*WYsZAF)&ga>W)AM-l>)c)f*l=4w9dZcnm+=^KfrjDe~A-i9o z)RH|U3|^tj%Ke0?ykSX~)IL496SiEhtk@O4A;?z=6HyJPg8wz}D5x>N3qi176y2jK zSmhk&Opw-@=+x}>+c_)|*##6D4U7+kXz!&gQ_oRsN9<|>@Tef8>R4btcV@bewx$p+ zmTE+=-ZRvpe zv3BmjDlGKPh7Vd7N;|%A#n(j5Kv7(%i&(w0jFQi;0BP@uv4g<#mkG@lwswS&=e_1- zndLFZ+K{6dVoGQ)Ohlw(Ubks4`9MKBAdOoHAfAob@TLIo18PoT(PyOi_y7QcfE!5t z>(cTN_ef8cQ3Sb7=#1)3B^II@ZpE}WwWU^rmb>0A6_UJUGzB^~MlL4GF!VYt*}))v zz6j-Ju|gY;P}^Q)hO?LJN7kc^4_P6$vDit5k^x)bqg8{6*Yc50K@7`J(Zs1U-%p81 ziyPvXN0C*~YixmeE890QkPhI^Q%$1sgdn8nc7Mz)ZW( zLP+nok^@(0%UJJV>S%IVX-yR7s#G3IO8ko?D`}1R!h_Z??e__ECOcfkj3y7)zC}Xa zB8@qEHF1zrGNXRbQ-HC_GCT_pSsZ(Uph`m2F%Y%&yCP4051$=-Q8yNip2vkoRol2! zzck6DDz150v~GCPhApsv&;l$EeOX`Y~jK zcQiBHgKP2!@dAL0pJDt?Hlo~dUHNP29OLfC;qE2}QwNqPdS^^bm~frBQZ>{5W?u0w z^3%nyc3^eBwc_oNCU>cZ2H(S=o}c$?Ow*P@>_QUqWLJAQNX|bLwfqcg5gUh~xHbb! z1Zeqw$8|dkHc%KOO30L}U^47WU|fQH8HpLdj?a%joH~N!TGMS4>M9ojo-3m(OGhko zQW{qysuv8JQT(6jzAO-R{&A5xsOC;#8Y-SI!uJZ4ZDddtQA+ja5upJkze%YFxXN85AtVs43ZQq1r>?PrO8kdT$TZ70wNEE?v-iSj+?q2H-p6d?YakJzfo~QU3 z!jl>TbHl=uS)73yW zOm^rJ<%UNvid!)ucQN6NBKTrWo-@^j0D0s%;^f$b{9<^k%jkIadm%qc^&tq`MEgcB z0PG%nBj)m>gS)c6WO_^xMV{)e>N!;I1V1y8e+_(@R~XzA^X9_twqmymQ}o4bY>q5f zJgBLu@c>?&Me=EZ?d|Pxmvl9vTum^J*!wIXM)LOp2h7HxJWAQPizT{>j`fCj6R~1} zBGt8F7_Q4rEPBJ|6BE}axLS2two9@$b}3g~pcW4SDt?75US_C;tuvlz5U@(4y4hj} z;ifYpvfS}bd4^qNbd?wDbMXxP^Iipp1@mLJ%Pz7(hpu#GSm#g57NJ!gV-D2c@)EM% z^;Qc3%%TpmnAGLHux&#q8NIL>y(q=~NNv3+8AB-58a>g^-eis9HX}DuY1DhAT6~&~ zM%5;LW5B&vFEdn36L~JKTUyfd4(rr|W*h7Q;e4)T!}b$T zx3&Q({koI12;uC%u-->E3XlkrAQa9XP;*zD%zH;ywy6zOdo)c zH^&#^Xn-H{0SFO&k+=oT&3KejF%o`$LRHP1h}#@FJpRwO%;4p~%uJ$X_ch=78YAd$ z!>Iu>i8MyTsqA=chVSNozH~vO(PhK9-3uZvf$jUTlmr8Mdc>|y*GR_zx0x4@?d^hv z%Pa0{l|J9t@RarRqH9h1Hyh{l)r8i-_6E}4*giZLr64k>m7_-oze4DubFkq|dF4Hu zvQ9Vko2R(NL)ol|iqe$JO-CcCZ~}qUfeJEifkV$W(;$I>NAg<8{?kthHOSuQn@_io zr_|hFomTH5A|@fi=K}7rC=u&LaJF*uVWVsM<`x{tLgIy0<3>p`NVMQ59b5IsjP`{p zSg;h!qK2l=2&9+g!S(23`-4&;P5H2PqX?zNr+i8#2QMl!`h30OlgfX30mS90>`0Oj zKtZM4xZlN!N``mRpMKpwi33|iY)EmnoXdXDttXN;b)9UIMF`pvr1!OBlbX3mH&4)F zr_!bJ*z2!QojPCE%K#s)_IZ8oYCZ*!@;bbe|I&WegCwn}s7~YL#wA6!419goY_h?h zoSNzeQ9m8Z$;zt21hneqq-xfGQ~1pSxU(Cwh-H)DBMe#^*CsEPA~AZ1$CorBXyvR^YKqh~A{SC6^{8aIBz<2FUICdNrjqNOgQk zQDTDJ@pK_qp$}<2smw{%Yp_tM4+?Cxo0U{Mxb(zL?Wg!+f<4Wx6G$G-BC2T(MHFc! zZCOxTRG|P+m|jSHyHL795zdPk1z@Ddj$FJJ2#W|4eD-%*G!^z1Spq5$_7D+(rlvnH zj^b!vBdN#uy@nqcVOg6L2y@;%Fcu;(2TW0$rP9e=nw2Lf5Shnvm~U@Q<$VcGMP@~n zKGdy8&22sLvGcSm?0-=Rn!qle+Dpa@$>Y$50z=7t}Npv7|gw#`M>ha8~JD-&76?`O;udcZb+q+%m)7wRVB@D6J03S)2$d@#_2?s6wlFRdE5^16Q2!$1%5lM4@` zuM@%DJY$$HGGN@E>eL+6Hr;EgRO1I6A>7rgQ?{q2;o~|C81;`%%33FT{{r#Brw(S& zH4#HCV4e9Hx9=Z_1diLen>;qDRv&$)A-Rb~6ubwoA_@YL5)?i8`q#~a5PIm<6JCLmaYUAR_8{!pW5ecBh+;W6T4vi z&tn$ihj@`{ggsO;ZD?%U^kCnYul3jRa!EG>Co2WfFKc{6HUoK@JA9_wV;_#cA>``? z>V5t7#exsc3lS5h4Z6(@qWLO4zZ|}NIxw&kCDJcRD)6oMTx@9&h2xK0;0jOK=`cc2 zoo~yAb7y;cVj-H^X7u9dvGppqPpBY0oY)Krav=`N5m|}!ce~D|NTjOY`+mC7dwD#< zcgpLWJbMjZU)ltl*#HQoGPPU_#C%m=TQSfnotO8&AfKuqacPIr>Tto8J}+)=zlZ5L zSRasJXK6CJeA`HThEQ!N%u~E91CI@r;rJi?E|2QRHs=h0D9wl6YdU#VN|4?j;N15G zn_t&+2Ba74h$Ac4HMqMP{FZaQX|G)H#wcl9=V8B{w|HYXEF|>ZyxRkrw!)|erg+9e zoRo1Nw+bAcKJV{O?1;RNYI93oC_lzL4Z zEIh6hxx~vil5C?oI7kjgz0TyeY^E*I^QNj;OC4UeLy)`~?AeE2Z-skj#b;R?1KkW8 zF^B245-PAI@EQg`g&=#l9Sge+g^BuF>u*@siEz_%U8em}IqRdlGe!+GT#_t@@53JL zP~eWt4{! zimJ5`b18thvswA3FQoMJppyVl$~;Txh10GYtTTJTex=#~h-O^^5ChVmw#naz`Eq6yQ z52Brxo={Aoz);kpNGweG_kt@xpUSDZR*LgGA?c0|?Vd%3~*$wqU5Gam(#;8wHnMMEi- zb)#vk^$TgP_mL#k35D#Fzfr?31bh>=G*_Ai8J0N8h55OC7aPd4i^Kp}dE?XEfm$qI z0Ep39*A962+eExA(0;L~F0;MlrVGSjUY6MEQ(9=`GhAckW%j!h1Tr=naO{NBRS4cS-E2uuGS|nsLm>*1k zi4}jPaoLs+6-HI3<1v06z6oQSp)x4LKx^!dwmNs1ypV{7%hQj7W~4l$tF8g?@iJZ; zbkq|Ov}H-taY~k)pDH!}QFit+6>h^_oTw;L%OUX$SV0L;jI|;1j7-|&#R+kfJmGNu z!NN-2r#f~yrCE?bMG16{7k3)))XDCC_%%3nYaT0d1EUL-_E;f@TTia+Z)^f!q<36D z+bD}B%uaaVR0nm~`$F0Fbqog1o$)cg#3r8G(_k}6zWA$X*_0V5GS8R`#Y^+qOe6H&<(*(yyvpIBjPt?$6l0IiBDz5S~f+ zj`ZQE_nyR`(1XKIv;1TN6S);V4tNx}Cc#{G=<3G$pq0fY=zydSnc}C+Q-4CZB1Vf$ z+2wxA+R}({=g#<>PTl)smmL3uT_-AVY#)YyTcU`2rnAFrd?EyR|03Wb=$II_e}?=R z+&EjV^F$T0Y+(Dydk7=8&~c4Mhvsj6H@&T0e3VTkv;2hy+f+;ShHGb=ra%p@e(e*C zfJhllh|$oE_(j>8n*(aG4j=g^dKN?tltHon8}>=k$4Ipo?yGia^A&!h)qpp3LnQ;3 z5vV9d|0?q@^~NVDb3me$xE`;{I?jP6GbZDnYN)K zC5vDgvF_0OGWy8Zs;y>R3gmR@N-{Ej+1QG!pmb{ZnCcNo*9DtH@GL|Biv7#&?nvFA zw6TE;GkM)qmvq32K$8w|;4?(1-BIM`lfShpYH*Xu&iLUzCbFQRgeR@|GnHLUFBC0> zdTfspw9?GwE!(;jaRn|RbS7N)fkT(iI!(n1kynARyH^qyDq5<1dK$p%=X50fxe6Vt zyYXvB#8WiK_Of%R{9QDsJH@SYC@RMD=GGzgVg+GE0#9DgJzJrbo%ape=SOZiIuTGy zTlVXbD9PmI(fs}$9u~iQ6hEJO-cHi*Yghx&mH84WE74`jn8i}88DPcl z3An*kP2yzO$4i2F@78lzfkJY{AAi*c$?w1uFZSUlI}<6wa6=J|RX?te$Go6qEseX$ zO9H5&-riI7`EQJ_X9B`Wtr51 znJ{qQ&pnd`r$oAoGcPkQYB67k(PgPW-4+Gk2J*;pORb z^T>2$B~Xx;ogE>vQw6fE)~vOg6CPUvTVIp$2UJ%9je1Q$^v=0AD> zc+KBfH?O(80yOo%sr0xH6f*<1kREtcQ#*v$^~0}jwc-dh$tZkH3W3?E-@`uu9V1}; z|7ar+DaWv2&ttPU6P2i#ZJV~4Mk#laox=s4Jlb8es<-^K%efwY7VoF|tTij3TUFZz zjMWz~h2OPo#84CehjNFBB>qJ`_q^w<(}fKZxM>S?o`jJJF!CiG__MNM55c$uL*+*W zl6s)h<8<`im`u=M*)c?QbF+!3rTd6a(uE*X>p4Z2I7!}gzTN=O&f?*!5H z06zexgNhsGl{}q=gaub11zr?Cvphd@Cd=s}v=n1?3thdMWumtNtayybsK*~qGhK!V zUHj~<0_uUbIYy)MjQ)%z^L(m5{PM(BNg|`BRGxaxirC|^xWU+3pb8Rjdp5M+ydc~f zm-hRQ7922p_qH5G{FO1;rM^nc*rsV&XD$&~BxZIOggLYZE5dCDFMZ6?`8Rzbn_H;{X_*}h8~^}J10S>31I+9xfiMXf_JE+1_eC)#yanO|!K1uijR z(t1IXz2XU`KY#AkT247W7NyngH!u{D24lbX@)I8<5#c?|vT2#c6n9F*;fKc?KuZLR3 zkhQ76t83LqDkZz&x7-8V`T4fF%i)tthDxSU(?h@Dz0L zrba$YjJQ#u`Ld8TBRED{)zHRrIMvwuqE0J^!ks2E%Nw=hc~Ut&O=l|+#Jzs%cFe#C zURW-F3#h8Co%+6Gq$@7AYuz6zi&%sLm;oMCmM7^W0zu-` zX0OtR^8u%;ze4@f1`PrR8smBQuf!RLRuyOo9`J=N) z!R#AwU8&2wePn`((m+%_kTZYq{H)ncxS387D(oJDBv0) z9}&p`BT;9q(Xyhw?UMr{TpT4%nWi5?V|wxT#I;HxPZ~>g7Y#wq z-pc!UpH3yK9i5;oLmQC_KGNA&ZizlzqfNe~)}5TONldbxIT<)~J6Zka-XheRZx2e) z=r*3F7t0&mxuY(YQw26!nrR93agU6*A@EY)QTSA4hA+n=97pZCTaf*>eeICd_*`f* z6H@$#vB!LR1CTK6=-<1?+VEgJ<}U$4(Qzu=sgzI4#m4t zIxL}5okR?zpunlT%lR{V&|>Q?$7kI*BydreEhbNONfb89P+qX^VfNKcTQyLU@}eg7 zO7__c}HR>eB^_A~_Y{3sziZl7;& zYSBG+9M@~y4!c#eLgrlMBG{Q9tGbrjq`b-bRShy`wZ0sfXMdo<^qG6V`XJ!5=7LB-8|JMezp1b zM(Sd!g@0^rS`i89x?9;+c>?0y2))RJ%ryg2ts{Fa* zCWB^^775mAbe`5!M&R7P2Yhiwj;r6lM`3tSFRhTdLFrlBO?&@Z;uR-`806 z>i0+FypF$K4-!%RO11h46={tgoL<+MGPTV@&*+W}DbYxYJ}Lm=Aa>VSH6sLPhD#?x z=%nRhCtwyoST?rSI7_8zKs_W{^W(WIA5KqrW8TWxRBT-Q)qC-QwN8&Q#_D#6&|F!p zaJE)@s6p(_6*!LD<|w(dtU9MW;tm+0yaoN zO4N5ZmXc5y{lEt40`bT)9>eas9wzl6*ZV%Y-RFgpsM`F5>D%m!RMFLqil>yK5EdrY z&~*&HNE;*UdU*ut*oi7CqMo#!3faupyyy5f-1S2yk?q?s9x@)=I~!x*dH@`@5>%TH zN$~L!cq^PXTg1qS{NeUAb~oEw@!nToKU?+WZMM1)2Oe@sRn@QgT9fld>uUO((H)QpTu~Jm*ZLzNzuq?V6m89oXd-#HUHbfQELxH4XEre}kkzG&4CK!y4hs z#dO$zaGL1o*|a_(cAKa+Nnz#jVBpd+n=OMS5KY7&HVT-cq?f}W zHl}dA%$27`NMwaiaBcoyLhLdOyncIOn^014#TFL#|Ac8BNcso0L8ny3(Z&h9*Q3H0 z@VW|{Ac(%kGD`;WI~W4D$p^I)U<6 z>v6;seL!xam9?qDMIk%{HLz=haJv2w`eh6Me=(QKXYQvn6^gJU3e9>eP6!J88F)1w zaE~FWf06BuRPe|bFOeRF@kvFuZ~Zhr`muOwNKnE~`l2vn*Vq-_HKTP>9_s3e8%vXr z(U1G+jYK~Au15THlYCzM;TFPj%oNgE5%~t3jz-puKeh9cRXUIG`yaGkwrsZ~lRWZZ zNUCKj7HAmbh3vR|R+P=B;1$$o&DMITKePz{x|IxB-o|zLtnXImq&a=ADgg3Hj_uiW zYSul8h=~&0{H6h}srpwV*`x({zMrks2?coH(Ahs7@e}8D1qIuC zc7vnxNEmevJkI-Y&)2`BF&wj1OE$v?XCinAldrnC<|6d{?ySvDu)l2k@Him*#iK%_JbX@nMoPX1cx?s zSvd;qtxX?G!nVaePcZLhxo0n}QT?}|wp6KZ1G*AgXIJ6$gZIj;^fhbcCfHBGf!ZE- zi>gT99WW5nwj3K3DVatFBO;Nnnr;7sqIH*VJoARk?K#mpJ*ufP4Fr6$nk_QdZ*wg2 zQSpd=SSCaPbZ*#Q{?8bj!(fm-_g=Y4zRSuZ6)ovG&k*1e#Ow@BnNPtan<>`WK=r4H zicWx*s+ws;ueGV?#No4sCb2(L?YiUuqs(PvehqJ{!Joy~D7+06Q!8Lz?y6B2jU^50 z{GTdRC)0Ce--oMG+=BH;RztJh(X4V0az$$F>A*l{?~*M{p{KLnx8l8Wtjh0HMCM%) zCDA}bcf+|VT$TMX{vQX1}a zFqCzo!g_}uT89}NcYM7ZgtOa?tpu9bx6|`x!TkKNy7R;G_4;Y0@?7z%(MIQCw+;8! z!(laADIP4&&tJxT5KPH~tH7*tNB(xn_+9m8z=cUi;yaFhqo@J8j`4bP8;DCsBNn2^ z`+XNWWs9foL84eGiEP4t$4pVmi@K$)kEZxiR5IBep4>Qf`gOuW1hg7S*(A28*j>%m z8flQh6HoqEdP^&ds0c3=rS_>y!dafrI(Lu5(V35ZPFkQ)LQX-i;`F>3he2-1HGDKz zbHH7pBliJk*tq3f$`{^Or`}*dGB|bn?E^leL-NBEZBc<5ZG>-0jxy?q6v*0U_~IV~ z+ipnP%zox}a8;iTzMm?_f$tFbBY*LR*RXxq;VK>Hf@KkRm!;wvBA3VBV$)wi5{dfg zia~|gIExN@ammM;kOD)N)xoUa&+!Sy`y{^sBW`?2DFQhRsgd}V-LZ?jTmf&EKW8zm zyHuLEV8fXW&s$mHvhi0UTHJf-`C_x2#6^OYU*MA1<`x}sR$W^$9Ps?e@H)>ar%1V) zC*z;JHr^mt<2CdD5mU=ttxV$xc&rtNo9aVADDwYUv;H$nV5kg|@DwpYwuK_VBriv8^ zH!aJ~M0#rY7IS3~x`Ilw>15BPUI|AI>Jo zwyij8bnD&;igrtUcI8SGx#4|cp3L_KGouDkz{~(Fe{ ziAmvl0EPTpe~i^naa)H1ZNbb2L6t4h65Oq>L3qJIMjIv6QQ7B|Q>M^gHlM}v*u?@m z$Flw9$eeRr_l>z>5S48zW)m>s1cr>ZLW+L~MJE@Y>V%5)*RnNmIOU{Kx_Z*n6lqj;@JMZ*@cG+g7B*w`rXI*|&t*HAzdj#2MGQ{%6lb0XLDboi}g`+0#RZ z=(c6n{I5#I=Kn>gW&eK{YLS@}g-CbZzTy3_FpI_Z9@PgD!M9GoE#y*rB=^`d;kTZs z#AdFy_UTIk{`G-Q?WVHkw?bX<9Hqhf(y>#z!qk{{{5wErCHx~3r|Un+>i$s|7fRUp zrWjbaXj7{0J@Y6oA9|yd!L5+i^~&jLi7T^XkYKiN^_fXJfdc2@TZ5Fm?T+LcAL=y# zMUbKVXuhQyeS6#OYDiI3l|rB?J*C{{Mu2r_|9nTQW`J+W^roO$X8OYZ>ImO@+Tu=< z&*s0vCB}cXyAL^M2)ISb$3$B5qV~+F+1bLD+9-l1oV`}6(Y_s_gcZGp#F&vcutja8U?(lcSWRY1_ zO8eFoyQ?40_?e_7(Eo^vuW=UDDwT+{m;D}Oe6Sx~y9)11-{WQ;$9SRzKjnBDlcUkB z<(s9z6K{52 zdnn))A9lmb(gpc9h>52@i|3Ykwl1x9=XM2=DrE zQ|}@=+;Fh;35Vj}vmcG={ojT8`9sGu;|Dc!TO_HrL4p@j>v0hg$e5I5U>N>>FG}iq zYR8>luJO9(*u_PA;6#B}z-2GPpZ1`_e0Y2Oec0rpZNw`xW*R$PpqH)0HM%WoNZNn( z(us(0cCLFU%*SOB>C@y@weO0rC5H{1msYXMsl+M~O8o_}fI}BQ^pq zkahzTliSHLN!wxtFy?Iyt?lO2RIc`kCM4)u%N4~4t0NR(|8}uOjm{0p^vR+_qv*Z5 zUD8e<{BDdMO#yFg9OFv>j#1?Ax(2y-SA-A$wcSj+7Qqb#d%Tg(DwtO*k%Tk0DwW)_ zNMeKoys4pkU%NC@CsJ_H-Bf5qt#C|_2K0&VMBNhdx21&$Icl7BAHg8c(s-rW0uRbwU~u$vXS25&{3Q{uIC#IS~Zre zijv-6j72+7uqgzjRDQqi%EgwUi>nD$AC^+aoFF`T{WnwFct+pJ{&P)@0G!odZcD(> z2K@&X(apeCCjAq!KuG~6M&Vi7dFsFXlm$ZhVj%-%r;FG!<49$b{haP6s*c~onLuSs zM>CN#GMXg>SkFOE!2j|^`h#i9QvJ};LPD;(rDwx+9jwfry$vaO?$vpXQloEJv*2@n zpKg#+O1(u$v;K9yS+sW6M|JN4@7d%4#j9f5%U%SNW*GpzAFW&axhs8=F8nflX z%?G<^&%m0hu_6)ENvpEPMjVRIMVF$s=2bE@Y>UXpI#2pnvqkg8f(NF*UBDlj+F9z0 zM^AT2phSDZyWk*mEBULFHrghK&z~Aje|D&ze=?kszhX$B{>u%D6fjNtf5M55whIW@ zQvMT8R9tbZ$OSY|JMYhKJ=M*o!>jU~t4%e=%(H!rM#=kqeUF1*p|{h|ZK0qBeUXF1 zHX6L{8Ap&p=ITdq;0J{JS1w2h+Ze^^aFFgqFr}>o!-!yYG(|J#>PGx~{iLL%&(?D8 z^NSg%V+3I`-~nFpNRN{2+C*^Wdm%sNH)N%g~$C5nVkwv|JgjJ zL?!z%An|vlnMvpkd^+LVf3ImyWuSDra|!2{+&>L&Sg1van)LtTa1*g4bt|#U#RYg7 zygd)(T<^ya0C?aQ8I#_e(jj-&GH>Mu2qKf8wY zUw>cnLP&eNxjFFgG(C)ZPOU2=dbuo zXeOMpp*3;+vMt?p+Q_fR^9#|QrS)vaEN1X??%_{qxtLjT(a)d==1aAWPFWK@p1W|5 zovnP@Cw$0I41eytX?(8|s5XCs8?frN7n_qd-gXX&TygcBP1+kecVEh|Bv~C@frr4-**sz`oOZYDdCOAC4J|olFq|jMqzr6pOG)6!d zeidUhg$v>Esz1|iqsRp#>RdH9c%KYKdvXAliBarBTM-NU=bQ4%rD>r(RZir`S*mJ} z>H_`lu#cM(+hZY)%Q_70#b`N-k&^;(1DUWoc4(^3)~J9!us1uJO|MJ*xTp|7$F^^D z8~QSDK7h48N&lT)2d&+}J$9}s2O8Vbk@3iiWcd^}tzdKy0&zt8;k z5aHK+Kq{3>(#D}**klFCNQx(tTz`_!AxYZVf&1v!{BOu6bL2)=x+m)E{gF}50{AKI z+iiQnD8KGjGLb$%&gT2k`>Qb=PL;$yYEA>wz&j7*4^ID|1Pl*9m^3?fWuGMb;PF9P zrY<^xNAt{H<8r$}t1D*;#U=K=O2n3gJ>NqZO!s06owv*9%qTH~9&U&Fmf< zroLyLNM*?;Eli$6W&E?zzC>i7z1A;Jbu!ICN~1|mxmB%;vTm)zD{Eu_=_s;SOIja1 zN~sJggeGe@Et_8Ibph$`WXEtD!HzE*#UGhKV^Z{dG}vwAnukmbZ2f1wpFv4g;cSD| zpvrIbZKj=R!eM3I7d1Epgy`X3PxcB?5SWBk3pDjFhyI-w7EGZx;Kc?i^|4EZZ+3e= z?fKuqcLnT6DmjGnKHSz~M zXxrss1;|GvP^RL5^_pV`9&WpM)tA-dxs^d8q(LIIL0aM)PYcu(B}z(tf{F~+Y~Jxp z)TugbJ)_&NUZB4i8~21^O8DVS#9dV#8@QXIwqhv-jT19AXgvGrwu?{yc~r}uKUlS7vatn+vv{0zGOhO%yM_};aQgwjo`)a zZW4??^7q?&UdP>}T_ZFXF0!^x)>bL+-F^Q(T=g{MU__j`+C14k%iq9?l(5AkkE#8}%FE)B z!tlGGCj_`CN?Z-0Dr^m78i=~PyZ7^0E!FA)J{S00zc&xw>mMwV($WLL(5UpD_pabk z!cQ*iRmx3MCAV=xUZC!<&-^py& znhChx8S{7I8pf75vJ=peAHZKDU6GRfg7n^E5x++H$5tbQV6$983Jvpb_W6loHK1_t z9$l|>*yowQ`qEdwfj4HaWNuDju5%S}*zP2LB9-tYTY9FXW8au={!BK4b!y8KPX{F~ zRcPwkZuq6c$hqCnxqbU4yq;&hzGEFp4EhWFanRnfgZ)DhoMg-5)Y-E_;vDXJ_*FT|N)x-up2Y!o0 zazF_>BT+4)G+Z0aNdv?8@Bz7bJX^gV+}AY_h~V<;{Xu}n@1A3_FGUJDM7&zfb1|)n zd$n~XN!7HN&F5Hq(?z2r7d}oG`vFV5NO_R_d!$)_ChB(#|zaJ z^>L~ROMoUvlltc=Ca!Cm0u_={z435lXBw}E$5a-F!Xw8cY+rr7qK8l(motQ@Dy=~; z-qqFBcbPoA33Qk|-zRGMY|esaxuK!;4(F@ABn6ZP6o=CQ8y(hP4D|E}aRP7dW#}-+ zb4(LRBrkky3pNNYNz}-IORN%9W-CM{4uO1YBe2|;;-lAVEBaV}_(FaGd4RWm0B17E zRX^vi?n)6#K^}V*V6xe&WD6}V@9P`%VXhRL>D;(kOh9U*e;KqD@tTK?xuGy%{ye|M zX+B)vD;39H%wfKA@=DReE>pzbzm1a8_j1wED^Ms5uU`c+*spAKpG{x6rN7}VnC)WC zoj1#;yW+{Iqa1VgJe6PEjZbrQyj@LjzJ%_0lp_D&Z&7ATONi*MA5e%o&kiQRH21H24BEB2lhIJUI zuHv8ezKrHceyoK3O@S08EK;x)B}k+m^fWsBHegSMc4Chme+nwbH-B$J#E%?MNFeFg zTNC-TdlapNXvyN3rM<;oTqY3==Be$=scino8@A6d4CGQ{)hh_Hwt^i9D*=<5lpcDu z$8%eE3n@HFoRiOsHK>?h*8%p@#PO)ur`I3xH4qs|o9(6cM;BPBWD4AQg&n?$Eb5AJ=2zXWQQ+h^dTq1n>W1VVl#bDENiQzxJ%Qpt?7|Eg`~(KSj@ zha{32>QF)bK zZDp}|ct|Tt5&g=J9;?CS>Yw_4)mnB4cYe5Avwtll z7`qh>wpnQuv-~u@IM{X3TP3PC9~XXU8}dNHNJ2sqIFP|)je!!*P)21`tv$H%Ejt@Q zX|(Bwd7H$W*Bi@2u6HUsXwnV0ug7NZb^-h&4;~2uJ`MOdF`GT~nCA?sB(zPxt3j4y zC`<^EUS29f)ymX`tn9q?BPQ@dP#(bd@@-mb1N9SNF-h}jluF&7(GD0^`zBrvCJt?K zv*2D{bvsQI(eV54qzun2&Y3!Q0)tU^Bf1jA*|vCLT042wHa*SX`u!dskJ zo;tnAC|fG3`o!=BfdhuYz9w@PK(e0c2}$!HT8KwOldS;!cIVDie9aC&;J}VAndF;N zKs&?HqR6Rx+x-HtW!n$nulZVN8JPc=Rj~LlI~Pq$%J&VbY36ia9`JT~qtKUM2@2y| z)4`Kz3ss?*b`AP0D;x0~n8)upc|5J?*@fjUpDVO(&-V< zplM70@Z$e=MSxq?M^8gzIFA?ZywhN^&sIp*S3UPT3G|gsS?hQxA}K}SkS<}D!4~bN za$Lxtn?)btds-Xf(~G|T&$O<#$;RFvMvt2=mmnzcq}U)OhN9+12y`{OdN@d} zL^O@SWC9~enezj5=$6#b>%f9mG}j#P9dGxNd+$^-t4ca8xf3yWx2l>{qX1#rAU_YD zC8#;`9c_#shY=CtwnR}vCQaX_7+SdWc8-D+c9SOAPCr>R%h_@z=chH{Im(()XP-em zFLD0L*J2O4Y%Q3wN1~U;MW|q@1`NjMnvV(cK)%?>#A52YW_MGqpQSqwE80RP$=Eh2 zM>qk|)TlSWQN@}*F4JyOs<@KaI zq{xml#Wrl8G}eA0uBWdY0s?I!+jri8=wqy@s%4GmJNPANkTtT*!7$ndgfNSpdzmYv zB+5Bd?qER^9fV%yITF_UO%)CE&X>3bPSJ7MFJo3MwJN}P#~Rcd;Qu&XtLA*4x#p5@ZXdEcpF&(BV=tp!>C}D0=W%okny-EOVsPcOVDkY6Po+ioti4|Puckj$q zCn{k=4fM_)4@5WKt*mQ^y}d7k5pM;T<0+xeM`zW-^9PR0w_UXZk^MZqMH_Pkn`&Yn=HENoLf^6! zk6&=*7Q7#q$~yS$`dxK?a5}5x!$qrw3o|LpM-RsSlu~BJ#-!*Hs74GSHx8 zYF~xlFu3@7r;){j;Q4c(99Y%k*< z`k;5Kk=!5nSz!wg5Y}bfWv4nDCjLt83)|zG&qH*r*1nB5hzTF>!P0Q@vy3ASGHYO< z;|o-&;1ockPYZwXj+!ed*xCt8|!h_?Ie027qM+@5vuwUq(a zw+~^k)Kamfp7IVC$M?`5*}@@30xXLidMy^>^rddkapthiy3Uue)_yz~#J{ii=1Rp1 zog<0Nlo@CK2%|vdgfsh#4H#DHgiqPlQGC>b?a}J^I+uAG8>EaHh`@@?VsMi3Ebo*s z+TTn>8l08C{+NhTx8ib4*fkcZzNLaf9(-2#h00ofm-R9=R_)Y(x#RvT(~F5&A9Ac| zDR{ToU?-aSMiATc96Ky$Nmt91XUgXIdd*|;L|Gii=5)=tfbn@@ieKgG7u8Nx{v0f0 z*eQ-CT6i3YQykpH_fll|G^Z%tUTaBm=0vkB%yvAjL^!y?`LV?2O;Qul}aVL{AmkWqz@kx`6W}NrGu|%@Mj+H z$%#cpld%pRs%;obJ{Z+UX@8U>ED$;jm~?@>o{c0l(k|>G)WV1aa#Gk}NxP1*Gp7Sv zKg-A#lTu-?lE42w@UehaifN~U=|$4~Go`;;kSsWjk}pjBIV}_+`k#+>2RQ@WN#7?H zQc_3@eIZ7+uMe-UM`SyHlJL02O34&4J>mNyP9rP+^$<+*X**$~;Z|>vcIkD)`3n0A zH|aiVdY;=p{7p@>sExPzCKYkHC|I^L*LK}GUv9KkuOX-rk)`mz{$oB^V4PqVR7e0~ zEt)R}vzcX|euCc&46l2DGhj|y@QOn_rKvpI9oa}Pm5yXiN}N;ni0Sb&79C315)qLQ z1$y!y9ePHBCO+X~%}UCG>-3b-0R)eP%8>Ih+{-->XaXpWlA&hG3(&#PQncRJ+a&g) zT&Vxnmw)S0q6etv4#jrY^U?;AZ#a}P+Ogn`&!XF_(VU;d6_MP_!Q_$QxLaU6TVUkV z+Mju-=px#O%V}h`G{FPey>Mo`Esq15RHH#MDPC%6&R^zNs|n=wtZn$71b-Xt zWI+ey&$<9k)PS2@p>2ucq=1_k!^`STcZAz5N!SHhIg1JD= zBP6ij8HpT7E=Tem4Fr9vVD(_xj)(GRZU*+5!6bdV`^*e0Q9KhUhXdX-~g+* zGDo24KRib#znv_UeyTXZfJ^+nlYj)yx~f#w>zURk$VT4t%1S+sv*7_BuX{GR>|fai z8$E4$sd++Nqh`}mVNO#u_@4^eXO*sDMj4TLAvv>22zpuY#cQ-1D9}>1u69?L+t*1t zGhD``qs66VIq~GDw5=l!x0{;G>oq}OR|He z0-p+85?xCMi~mecpoWRRu+eSnYr!_egnp7x4jJfVlGy&>1um0=!YeE!keg(h#Z&VQ zJ}6Py?)y1>tXWE(0$S?pL)@3U*wp^>-{FP&siy0GUViB@+U1-W;2581&Jf&1|CU2h zX@Cwi5gD~oqGdyCu+hdSWy5vXzj%4hr6Mp*@Ci=VQ0rjx+qVLmAR%;z{L#2Hjb)p2 z{AbMZK7^kc(+U4rC#>TA3RKlUTfazh6rCI3py!EOamJ&}5-8EsHh1Lm>uA1Glr1@k z6i+A=&9j;dE`a!O~7RF0@2!$5~%~3+rLIhlKL3yIsU||f{t9GJv{erzystkojUcZhf8zR$_HS#aC?4hswi56r zHrpKDOLTz9JQ^r>jyCp~6s2gT!)q50i9blIj|-ru#Eu^)iOS%&`Npg@heT_&gQL7< zWuuIQ1cSAb;qj@f>zO#)^IoD6e4d-MG)eA97dHfT>P_lLgkiNsIA=x-9;GyXjvT44 z9=@dJU56EeIuJZ;xZH~!ovf;3Y!+hL0FLKC7QVL=TO6fC_E7AFzH@AgKz&Lo5FzA` zx1yj8A6Su)Tn~YKgIf)!{Z|}$I@jO$GG3D&tRYGT>EbUXp*-mZ*__STL*+_3C*lup=e zFB^UGM)?x~@fmUvF^f~dtw`a57FwI!1&oIVc@~#=*YM+vI4Bv@4CEl%ElWW?@{A9n zB4-xxH3-}>(#SA0se`cgKJ>mV7gS$H=~luc7#Bjte@myEN`?4rtm(wb-a(a6GJ6h> z#^6j7f{YTY)+rT|$iFK$7!UE-%MS;FqxAFy1_`d>i8`V*wMoRqw}(U7_6y+)=o_`E z^K6!`!GCQqcR|w&>W6@P1yXd^L5l=z27jNyFOgj4A>aYk#%Cv@&Z?D zU*SgJxj4cp=02q59()3_%B@tj_EuoDOYzT(65Sl5BbbD1ulN$ZK@N2)cEJ~Ti&w)k zo7Tg@qEC4yQB{DE7bIpLHW=?7Dhq|gU^5eCT#@T4dkvDA>BM;1oj2t9)_3V%Z16Jb zeXBB@tw1kOv~~7Q%0S{Merp_WT$fBYzg#DZ-f@|^js3CmLqlo9MPqaX8zht?n_q3e zvf9aJ^S;>Ic`1u82bp}@5p2;!)DPRqm!vlc<_&o-M6zvx=%&PRnW^ZFYIDFIJLJe<`-3utiGZALZ!!#&>d~4_$4RV=8t@ZB9r!P z4%J_91I+*moIDi%yTBB~zPbQ{CXL?17VqhWkT z3kgxTkgDLj=r`u-+7*}bDh2DL54gp;0{s4v@qaiK#WDcAWU)d3ZHx>FdF5L92axBch_5urOdum)j9rre~&oR0?-VCd@a3tiM ziC8iQv1>Z9ztO>qEW4`t>$%I|flJZIvAQosp->$LBh4r19+QEuO+!2VhWFcf7GvT_%z3!< zTkEE275VCb)0?dXdt+9G9yP#Fe-qaCI__t4giLKT-f@ENMPBo=i^yDI0+vZN5C>`{ z!Xl4IT-XlW*bkl94xHEyog)Rb;e!WGB5366Y{iI)CWAfOam+*s@1XTQn^L0(d;(U! ze%2I)6P|UNM85F6hkR{!4xQ_%zhOqpt)D4>-D`8w+XA(k6hGJ9o>%^7^yO|xX6?@j zEuR|Il}Q;`YQ9nR%mtry(PAGx@H9vu$d6oI@Z9bSWP_pv8SCmc^TMwW$A1ZJ2Q6`_ z=dwBp;uTJGUL(Y`AR`jQ1v6Vute_rB_f<761h=p6K=~W7(y-|kR%>E}vu*d{HUdX8 z^r(-6G{h-;A#oWD_BFHCsw2;SIp96wKKvvDSxp~B8RE}k8fm=V^7Z*&PX{|o*QV@7WL#32gJr8ZMULqkTE|@G7puMe?P}&OFZ4QWMpJS#Ncv}@bmY|XrncnGZ~1F9@WLh zE0>2!y^K zNN$**xfV>ms@x6A-AfGYC-hEomX;N=t%%_sc`s?2Ffg#NDYn5r&v(d4eIyXxn+etj z6Io^1n4eF#Gc0mDww?fQ92J9)6A}|MU@Y)|jlc5-33-u?9VPIp9)}LOIZii+LVnB5 zv_io0suAVX%&9`4{n|Wv&pC^%0+N#^XhLDdBb*X(thmkbm1V55R_JH|dihQEFvn+! z(1WqIE>AJN*(U1edG(`U)s9`e?dLepf`p%YG7vF1c%#)=iyX%@p)&0M9+cDsd(~dV zl`94$W!yreg;f}kI*4N&PbEV zY_7;7B6YCM#jmbQdSOCA5DP6?nVGBQ2B60mLlLNY@>Iog5)7eV8+=~}w3PQMwv}{k zMj6Bw?JKU0m)=XnEU>)6CbP=>LSXL9;im(^B(OXESO|E+I8H%4mBWysMs9Eam%t=@ zHGU6t%Km%h@8vcemnW!}d?jxzaWe{H7A9?EJOZVmCfvJr-v&)^C5((L2ufl~QhjO+ z*V-Skw>rNSb+tdHjlU8M?r^CdJGJ%s<^|m}IUmY*^kV&kF{appkf5FLP_vVxg_mr< zJzr?hB8XDO4_bH-2^aJdRa|_Knyl*66ME|bqR{k|Xv`MdXXTQwwgJM#XKoy^FNzf3 zNoGG6lp#Fp3G?(0K(m?^*2aZtV#CBM?S?KNA}+fgz(_1nmlE2X0$v}k(|gej*4)ig zwsp9aNccm|)IEp0@gD#n0x*Hi4vh>20uJlgM*P!;Lf>74epSzKF~`^Q-$Z5hh;T>f zMVh3NAIrt+F8ry!O;>rK=~O1azz#xEkZ|$8ge?#r_$pa`seb-V=tuHwfw?F5IYKO; zd)=pSN0}A|6BXv7_nF@9*Rm2O+YCA#%)jA~2eUv@>({{q=B$YWUs^wE{bMu*JbW_p zX)$P4^Fn?BGYHCfz5URG1n6aXp9t=m9wgb*@&6hHd1!*~c()uLiLo=3E&p2lKy6w! zMEr?KIwCt>R7<Al}bG%{$7nX@;VH$nve zW`NAC(&t#k`n9u2M9>CF7YxFX|1#v@nYk7ZlZJMY05sDcPvR2-W$HP3II3HtVdydQPIF5IH8*phVggb6Vj6bS%^bG>4J+xmqyqDR z&5dVA(o)V8<#r$rBH4Vy;;djHdNYj>kdrQq4!zaH4uYCKtt@Y2-&~SE_~t<}ILoEw z%)LrceZ>j`K|v;Wb5XC+B-A_+7ncom}i0f*(;Wu!_F<7*G{01Zx zO-TW$y4IufPZX}VS#hDd!auPaG9;TxJ6kS})zn1Y(?aSl+}|B|la>Fy^ukL;*UEh4 zpmkII5IjkY*cC!pmfKfPwfH>t@-nKdnnHN1ERTjaB7%aS_DA2r-1cB9P1nY?;T!V< zt&nX0UGo(%lq3W0;?R{)2J}mR?2P+FabhHCxp?$!r42&!MP;D`vs@Z zR#N4PpCc8wE?CTs$V?CVprHX&06AQ$-J*$CoI3dCqaY2M$(`n_0JP*xA)gJ}!-kPA zGngT*<(HLaqe=oMI{kD11j^3D^D7F4#3UWn zh&@5E{gK6htd>76gv!JUR&71BHyjx2>~mmW(#r&%Y8K38T34$!2?`iEdknvV?1R6p zJ>sH}W%wwimaL)uEzKI%G6TfH>W`RSZiKf~2n@9aH#{D-=tvlzMivxgOu6ssO-?Nn zZ~ZYDKKj;ddaHs>(5AAZ?)t;Mt8Mn}@<_`Rbv)i<%4ZJl6uy0EgzO&7d;x!!VTzzm zDsd~Z_k{Z|_hLOrSzLSMKc{%}kl!)6eNy|$8_r}A84AIHv@+7VCi3dMoM&oeN&Ti0mvuxdY6K8}hn6g&|OYH`$ueCi%nh zE0}lD?sli)77AzfkYN^NCUDhi{la6X-fTe_U}&&u4h_C(>dR)o(PI^=Wj75&OcN`j zSq^brq4bjuDzs*zNANcz?;6i}Q`U*zVT%t}pNt z%TSCH-wOoo%Ua3f*|JtpajnN7t>TbRD}%^o6vHOi)d?L% z{<-P;uGw#QmT0TWMhpt|L2f{>z|8awd@Pn7iA_w6jmX_}0|Tz{t&%{hvkb`h$4!Bz z_&2HV@)DW1M=N|c!Uo{>DPuj4dD@}zm!sCDd}aH1>118|7sMV2w}&G5RqA|u8l;71 z^>eA2B=L7x%$gX_v$Ld}DUsJa8~Z2;dG?N;tc_Qffe?PNtP7m4xqn79891&UJGn?u zquc@E9iag34gc(QsB9dpP>{YlnfSeO(O-wV_1CfN_>8vIVt;F%EY*jHQyD^m5_Lxw zDPf8tp%^=4?vmI+k5O@dqm}h9FtG?7nj4`QO2w3IumROvnw2OI-^`mRvXc`JJTMBW z2DdNsy9boa+PdD8+Q9s5(k3m7fH3hiEr>PaPMv460CF6tuh?of;}$E#H8~dic@^$%Xjf{} z$KdIMuJE)lLlPf5Btp&2=E6hSd&*Y3nUtv$O;--U=_OLhKnEGw8p+P?$CfkSS=n1W z!kUGEVBKfr0Qj*-c@V;B?f$QN2LYE4LlpYIt(m-G5buSN1Gy9rX?Z(#8?H|<;G=Wb zDZseL|LdS(ZO^VS=AUtKe9`|M&;VIObCwE>+TViXpGp7Mpy6Fy6Bj;}{m=IQk3f7{ zn&5cIz&<|VS4VM3v2 zpMcLZT3n)+&P=;(Idk<-UZH^%;D!qGsdXQBKn*}C@;)*xDo=8bD;4i&4zwXL% zbC|8Pb;~X52KO`X<_hXJNW~d*KSlH8(EmLM56l2+sOBg|tcNY>?JuM%sduO7kC-+6 zL71FnbH`de_mT~@g{%B_>oJxig%3Gd_?q*C@WRKr|3V#Ldkg( zXJYI}XtuBUc_qK&v?W+MIDu7eko1-m7P&C1)o1XJVrGj1_h-nDJLn@h@@aqd#t|CW zsxH+!_m??MWKDRjStr`~4N90L^C2OT;J|(na)(I6=?b;!Dm91Bp$!Y)iq6;7W&*RE zKrDPyL68iV1k&&A0f!k?nxXJXWLL#h+x1z)))J}x!VN%I30|V)PuXAA$}vV)I~EX) z7Z0eAq7#^zpH~r%ZnBdVb#6J7+_r!|4}Pr_0F4({=0z>&5BN&jHy*6Mj}8MeC6r8d zi5Eqs0;S3uW|d{qb(Zb!Wp3U~hm}9g#F{5K0=M4p_~ROH>JAQe4ohkSDzRklEY+~7 zqjG#aN6bUv8})>JLar1r#%WO>e0&)&k0&>#0RPhWnvPNe35c=)aG_x61ZR(qLm7$~8);t@67zUTvh+TL1mL(@{|Q*Kun)k!_I=RPj_lSgP4uPBva8GnVQ{o^1Z6@xQbHT)y4i z1Ln>b%YB+}uFuhdt7M=Y=4aLbq$YL25N3uGC;g znnjRQGt*EbvETMP2K^s+#~X|jd{3W%pi?#`^(L>{&jSj*?B7Tgmc;6G7M^+gj?k`yK)=h$ zL+=U;gXo~d5`3zvZRp@2aEC!`zIOP0{pVc(@<& zeKdoGeao zUYBKaDI%@j?-K(^J-(~A$3Dxs3CPlfR~yk=TnGZ$^sQa%JI$MLQaY~Ki;-?KvLL{{ zDjeMH?gYP*J!3vb3x!=NVOqBQhE;lt`43$-1K9|)TQpoYxGnc4A%GOd(LV_OSjHro zN@ONKqyY)a)`hWD)?|3?Ns^{CxY=`o2C<307p_g?8|AdJUIr(rbh* zE<%F(R3a)^b>~^X1Pzh*x%{=dU_q!%iCS1_*vWmnW@@+ta5PS1xn^Oq?buCZ&9RJ53B*EFcbY!)7eyoT_-aL`u`R>?3rrWk;yi-V6EPJiaQP+ ztxFu(98{Itbyk_|!hIaXmCvhmQd8$@z3@`*?QjN^+_@-6o`9Acx7)gtfb?lR{u=cP zU-fbdNip0-2VU3!Ck&tEWNL>_w@o!Dl6u2Yamm4rJzXjM4IP2VjM*)@+3oHyWT3Ct zU3tQU9c@Y2zdO~W5dH`m-^sTsz@%pli59kOEeLfOy`G29p`F*Eoli1?%|ufA3wc6f z^)0d-n$vBq4i)(Sez^CQryAQ3_5TKncDfDf$(9l2_5}Yy|&GC6!!_fccA_!v+D<27x1+ z0NE`Jmpu))kZQY@*e4zj_Z;3Y`D4Tjq5pr$6e93=q#PVLZ2a{fa($YbCtn0aMEg&^ zn6_n~phAAENG6Ewl@(`(2pYw!SHX_PrbeMKlKD|Pt>M$0{lUwba=;3n5JyL&WN!gi zibk^_FWe*vV*3ZONd7luVL2}K_!`0af6W@QL5YSzrycx9ik|U45CV%1D6cV@kw5Uu ze0V$uBCn&VbUM?0ety9rAx3~weeB1NAzb_JfHVVNZ2l+^OOs#A4P)cugMagSAm5#> zeF+dN@ZAI)A;W-oXsbzcXn0tUu~ve>L-aBC#s{DwN$=txa_W8xEz%y0A7Q;N04`sF zBpBo%py&aRxa?;7Yl-GkDhIi36wqth3P7*bSh#oSe71oNjNYe&b4`4|8=x0R*b2lb zV_YT;=&&PcHHar_Xt};bg+Z+Sfi69jqs4IfYoiSzB24HL6+g_-iLCxlGOMp=2{Q8N zX+PgC>6UzXZ09Iy%A_S3+SKbXI13EYzk-!XD7TUrPY}0TXl5n`e>((|g3wjAbDr?I zg>^gG2zpEpN3vIw${h?dAPC+V_CM5$CQOm9M!UF;is_8f{S&@kX+sx$e zJZ`@f!G9C3n{VR-zGOlIHFY}VVa0v%mPYQp{vaj-)IDb1iDtDF}C z$S*3I&E@Q{;krbv4&wAMG^F=sqXY_k^NVTKAf@aHZ2BYx+W*uH(ojPvu}VNb z?fGY)A-XQ1Zz)I@xv7{C&g!A)d1y$sCHK1 zy>$CDs{^T`e#iwS#U~-xp+#|Pn2$cuc>u+f{KxlwJ|8df&sev# zrQc92>k;hToCSRBF-EfnqyErxbc>Hfj_t`7XDpKfR0n$K7bP1Fd#`^QTxXy;i*+@4 z+f^|2+Yju9zRkh*>HTPW>Tg3mzv)S2JkTaLom~@lpp6D1COJz38bJ;RPpTJFu;%zdTSu_!lB%vg!>*9nGkOF$sF7u zV+s8}s=;enOqe4KkK#Uq)8OiK@J32^WlCEl`POt92+Uxj^8H>_^mzEYa0 zzjBg}TQ-J&TYK|(ZwSQ*4ozxZJ8NX11bLinyA|}kvz3Yuhd^-@B*Dl$EfS>tXqrV# zNhxvM$fbnX8y+=63nS|P;Elu0ee&;!#~e@z=6_B+(kuQW;z17z>`(d-V?xVf&cT52 zHzy_B`;_2UdmCR_f3)7+Hwvv(32Sf+4RYK96fE-S8I9e7+C`Bd)=BP`4?%$HNBOw> zdD8kRmn3NY=5}dy5PVTVE&JpNXE;M?Wb6j0=0jtK3#1zxRltSdyttk(gy$2aw@SaHEbx9xcCvFg;eb`5Fl#MOH zu#r9N|BBa$MqrMFRu!nK<0nN;t*5gVVAkV-cG602m4ojQ8zN8Mzn{>J5JjN$Z5FGL z6ub~eHO~}lwzZ~m_3l^feIy2*CgZ@|I(dn3K}YdqUK%$jF$F$g9#Q@x;r=i@r}&>* zGg1*l^@V^-EgcE4d0}jyFjE>xyPHy@;O(Db6L1+lj*7Q|5{jgTNhbyuSZ*s;C1Z9f z&ux$9eG<|q6PYzOoc2m$@E8`UaW?U}a`<`|ycD=~xGOlht*NTI`eyI$`Fpol8$qsy z868Fr8Ro@jgf=?(#|sDX*K+v1{AJZDjHsY_r{%s2DN8|>!`X{JK*1K+Z`y1<+(H+% zlN`Q5%oR#KIBDrjsrFreF zTzp*y#vKR@7*C+*=*`M}sz_L=L$Arc1h*}?4vlnTY4_|-f|*BFikj@UEV=LiD`lf&SZ(4 zA;cy7F)J#J7_n3*PHKMa^iP2=Jl`>-La+n89|brvG{XkSc>0dxJv{#Lsf-6UixkPB zhtLQ|R>92RN-q6B?Y(7ioXfT>XpzOt%oZ~U!Zg{D&ypok2*+8ug=QV!q)hgCc(d*j|_5ZuoMJM8XP3-HDO#V4Z> zlYB_&bE-{zLgYm#v81joijOP&Q!oDDjqNK~J9eqc7j8FYUMFW7Y-7$LnlLI(1U;f0 z(n_&c_9D!-c4tsY;XyQwntVjwzz~5AkRBH%`6w5fQ?3>~mAA)vqsMN;>qh$*s{zSC zYfX^l%QtGf9sZ#5-(%TJ+G6fzyZsHpAajBOwY_JI4Po`Tq7DaHFK^&O1{sHF=hc z{Y2|oCVn>lKF1mwDrCq8)-Ed6WiHBN|1=HT~2suL}_HoqI zNY@+kr>c`b_Ah<1t7`_ucu7to!ztlP&Q5&qPk#dN&zaB&F^6PZTf-3kA8P$QR{ z@sE$GcvSkV_8cF0_h%?+f1*82meI3vB{1`x;sUG!ieS~82qs?1cAK&jtM})HBNGPc zH;C~V0F?*7yWv{8PSbyvP@z}HeWUwV#o95}^Ug4|SKZr#I`IKpH;N$i06#*HR+6)$6(sUdh z)>`3+-PGt+M$7fPw4w)x#3In&F>{r)>)c5=*Mo(j~a{Gp*s zY}`c|mLE1>JVFw&g5*c>*waCW0GUx6tK+QBzbP(R(ZU(<0KEfyJUZ|)(*Gu_qTD4n zKmXsvmEfHJD|!V-$N(Ui{wthPth#6N_m(Puf`FBTnB(Byl!Zm4Q)K9}Hw0lknM?Ul zaOjWmFO2BADO%Jp{Lm^%T`u%_@}$b3n~q%^u+e23`2G8IW6?+X&Y%B-F;fIIppu46VmEwTSbM3B!h$PTR=8jwBRd*y(Wob0UT?%+sY=IfVNeL5J>R_9R< z>7FKqaSIabdRuw!wVe~~uc5Bi2K9b*k^g125{+h$n-KF&S)dd+ftP9yUv^rF4^7dZ zUE~4wKbAm!%zxolTx{EmaVIz`Y7q(+5R~CoyVv4{4DxTtf44W&n2t0YZ4V5X=93#`v&zG#sGc7`}XlhV9lIE|JBno$&pD3nP2gh|J zypjH%%q~nNlFwN7L80%Teug@ck_IurO2wyWEH16$Bl82G)8We%smF}k706|02AK1o z76o?Xr%oUxNT|tvWLuG71%3q2JL8wYfZ=y1mG5M%J9REs%c|5Iu^FF}!rj|9BJLQ>5_WEFHlBN<-}{Nb?}VE!Q1i^f5*o+ib`f7mGIg_LGV#EJ)CbWAbzV zz+_=C96p#LPQe)5FBQ=f65!%5!Kcx{aqY>%} zctC*PWkLF&ZB9zi|28B*PRGz2@$ZQg*7}t2pO8ShrAh9*j;hThU$yo`hdR>#b|OK2 zlQOsW4RyBXHf-C&b~LC19eK#*f1&X-lC6uuc-vU8_z!dI4{z#BqvZF&%#&0oOL-?) zYkmDk0ARjTIF;?5Nkm2sXmI)ruS?W!jh?2D%QHjXvMyv@a}-u2LC!Lu?XVJLE5a;` zMp@Pi)jEop(F>K)iwM&ASlbF4-wUIbZT=!nOfeYd(@ShFO!f|K{M_+1ZrsOz?&WPk zUOeO0utxX=&vU}Z9=PS&!mx)Kr?Pmbw4@|xPM#$4J|yiw{xN%0954FiOws#aS%|POxK7v6(T5&t%|6O18@+-|&#p@_1q35aQ_FtG6BOU= zS+}pectlev#pG5m6LQa)DafsSAYPVAGwS}SUvg~^9ZnphT)QUkj8e&P{d#{~?M>mW zhl!qE-EhisA`=W1b2N=f%GbB;YKBV61*GDd;~xcLOiGMDCeibi=T=gbd z!9skFj*jl#fph4A{ihcoUPuuj`sG~NTi{>k0o0$vDxFmP!N;cbHvvp6+Lp0fC2uw4 zdYTa(@_$Dg>C|VecK%tx8~E;UF5i_`zQFzVZt=~;Vo5|;SVvtLBYDo*h}BL-PH%2T z)xjXGmj2#AT%n&~mObs4)@Wh9{Ah#x=omv<*>(p>1PtvE?-&Bx_1b|iH}@C<^T;+; z$AQ<`^(x~A&w*cn<*$wB_LWFYZeFo`HW;Hfzh#cls#cd=t)QKR?2-klA`98hzV#_{q~1A^%pD6(&L9 z!E@t5!p3L6NUE00rkB!9$Kz6SiBG2Tns!#86Eo>bvg2sihzbE)A2D{|GFMrYP_w3Z zzVdKUWwa;6QpbU2#)lAELCLDndfzX1F5LpP$nYR!;V+8pB%}v-=W^jN2fUK5jo;{h z58`s16jFn>!-IlLlUN&3{=8QCRl4;nY*ytam0~c|kS5{l=lM?dPh#EtzZ2T)6)OF| z!qAUhyxwo@fH*f2L|}JZv+(PNVnG0=Z>X#w)WqcI_4yv&FnR_73TvO4m>#1RRP4nQ z{;lOXbDr}r>EJ*CNWA!7}6frvh@tW>G>vdS^YKPfFdJm2iA{*XIs35Y{Mn z0KcZz#)B(@gWTs}CZ_b;(!+z>CxzhL(3}tPB7zu=tk$^gx?=;-j_v&@4TpZDnW_6* zf>;?ZXsG7!nEGpFd{pU{=}C*r0UL;f1Si=)*^|g9m=3b9I zgG-0DZ88Ym@S##xqT^@l=k`xQK{Tm72s&4<_fW!29+q6BO1WOzAM(U}0VA;aL0l6C z0nBn0(_UtKHXqi9lJH|c<~spaMSd;hw~ThjwtM5+(pXtjS7SGO#ew_i)TK3hC6SL> zTFn$hYQ%w$5*t54pZ*4o3(gS6Ma<-ArceSC5jj1-tB0(}7Zy%HeOD=Ef$Wdpr@9e1 zqAAG%dqe^rsm2$_$177aJsW(1Y(8|H!{x4phUt&kPXE?b)lNf9NO2MM8b#zZTu`ZW;sN-QC7#6l9)ifOxu( zyaKvm&?M|#W!0_ZgL^s62{$jtKq@rP$Q_Kh19C5j^|j|mA8ZBznA9j;Jh;>IF>>Ql zZ)O1DQgk}v^;BQI^=uR+Z~8vHcJ&9TID(o|Z{zFlsGvY&G-1%o4OajuLTF&_W1;lKSd2l)0{+c z^N-@f^ID1Mm$}Ob%pKj6iRC6|IxcNSBfiL&B0?ikPkuT$OP1RMUIEM`i3syWH_MaZ zO%RBtj1=YlTD6{w067-`4~3=q^cH?Uj4>B@`d$o7*;!K-&p`HEQK9;{;HoNJc;Cq|J9CwgnK{Y}_rmAT_=YZ!-HL&>tvR^>P%0lGWm9{$e$gK* zMq(Mi$$7)zX!<~`+-J>Q@ z?3?0GhaU@=j^)In>OYX%R@LtpXxad*d`tnl;X_m3pf$n}0ML|@ljvZ7bhHD%!Lkz# z0*R8AQQdKUbo%?own0~j+MiKA`w0%Z@7ADxtwA^hxcRss znU7jQ-o8nVZFty|g_Krl2^-uPaT8LfW^!F9y0c~IoZoV(OwX@!C{jJ*WIQQNIW#ts zF-=PA8g;}NUdv7{mP;>scQ2^L=gzLjO=J|OjY#0hCO&3Ypu2EYuLF$hu<>R*EJ)}y)g1x{@$yEA&IcT6F*POg4=sY zN0iN^4*p;l*xotcwRQ{3{<%|~&w7iA07y%F&r`LKJ;RBS>|ZN)6_~vC*;5U_l>Oe5 za&Up~z|LJA19wNv#0AAGfKFdPinYhMdQHH*)2%LQeI!GD#ke}^Gym$Ba z0Q;pb{+HBP)Bgy&n!ppSSs@_1d*-f+Y*wRw6RX$8*^xNw_Z_EQIXLP=c@ zJgx4_gR`(A4Xe=yv>5AXUiAK!-td}lOU@7Ah3X+558!VYF;8rWgsU8Mnh1@*$hTF9 zk$_77%3L;8&?5){l4!7TQj+rtBYUcJPOiKV+dH!j-caY>oLIj~6YjeapgxeN+UEeN z)8fn#zw2iaZW)MCuI@Mr)u3)tB;^ZzGO|*cX-Cw^#Q}=^^Sw?KC<0(EyR6|J0s@$Z zr?l44(69&}iSS~HJlHsX+qiWPe671UFP#AfAp$OqUZ2WVMP|P5(H3W#UEHYZcw%VB zfyZS#5Uyp?;*}obSQGyp48@9&OA3jnSdh@)>k%E;d0hz7Ch=pbZutG9<9owO=WapY zmS|+(`e_Trj2UNZmm)ksL2JlNl~hQCI-XwMjNjYoUTysI=aQQmTI8>Hf1RR#PMB#( zq9tV8>QGrtVdkp=6b1d10pER>2gUZIO=#r01>i~p#F;cw1W z)=8TB_0LL=2t0&I$R+tjP8#%&Q$a-d2VA&q9{8ltf3mRu|092v=KrVXMY#|XFII#h zA2nMQm))yHx~&aonHDpUvy2yD7=FT z6GA`^R!KD|a<)klG(D96qwA0&#krG~!#6%82ZSjV%hG;`APCnoN3(BU?`lfrk#?p; zQ!HJ?H`(pJmh>Mu;)$Sx$H0X%N6qW}D+wrt4U+tP0XAvkq+mpqm6oQOt1KODotm6n z(e6hjbmmH6S{gZ`RF4O-u!tb&b9Psf?mxkJb{3Z)eb#x^pbIgPtuV=f^Juw!u&HnT zBg#VI*<6`e3c6oAOJp(dAQnl9-9R<_uN-b1M*o)+9=2*6c|jaovh2xww51{7i`G2M zRg|ceusX-=+pwCY(TgSyVJ!;Ip{?3uIXy$A;jrYQ<&!X}7VM;BrZ`jD$fV6}dNU1E zm9}L%H4a>kJ@GGT8kb{ijn>$VsxKr3Xtn6sZ8@0M@{ke2Zj{wKeRwafW;8a?qb5fZ z#=LA=t}`5nx^sR|uY568l{ncr?G|=;G4(H=kaMa_bB|{Rh)HPI%*QGH5lGg0H!BVXz+|uPM0cR@2;VmIh-HLXYqHWWP7!qNTKn_w)O3hVu`V zsrS1@9t|ydHuqV^cR;JLo< zvOH=HqkC7yy7&XSPigaB4Zr5C%NG(rZHosB1tm%GX*XX?oT+WzBJ=^13|5Yk`TQV0 zA=Lv(@U8KEZDMF@b03j#;O+qpwIThtel#vZ>ty-p$h?_<7eBoIYMcpGMyRXJ?zv(3 zg_an&WrlnxJtdf|nV$8}F#Lk?9MLs~eA)RI*?TW$0zoj$+VbqtaQquE(g<$Oe7qU- zpR(3D=RH|aLcIzZR+K-$Sj}W@NL>%Cit(UQi-n)kI}>@G7*^|LI2W5op-5~GaEkHL z+QPVx64du0kqlP>=ADYdYu=5$h+|(Jfi{A?oWAhwdVca3L@wZR?s2^-H@z2Slr<%h z!_wa_mSsa9rP506WcM`)l$QK#PUWKUTxOe)Xb#uSA|SlbiLQ;LVYk09uJ%3N<&fdL zccFS|Dy=!%!!9a$cOUdlaB4N*_B#w2HiLn+fG)_e!*S!v0UKsRAvWqtfn@WvTjLT5 z#H;X1KuS7TwypTgiv^hHS$9FaYphHMA&8)`d}WeB8~<80y5@L4`1O!%%#u5bQ~}5d zN@B6ous0a^>%i#f1}&8#ndYQ;_uKDOCd~qJGi+p^sx3AM2s)nN!NqKS64=-pnzO&f zM>_Zd9N&MA%!PVkHWC;W<*eF$j{y)pEaqVKps<(H1g(tTlenCD&(&VmE{a5ohhr7D zdO>EU12D)FJlMgsyy=A#-cWWqOAFDmmb)!A13d3+3>AhWwHORkc_*6UB!IyIwjHMq zrRk#6P53WA@9R~!ofo;O<6ps)@XhCr;!LQmZs|oA0w@gkWNKMqSBG07BTu}$X9r=F zlvbRM`yd&zkR#QwVe0GAlVaH@GY z7=UFmGD_F%j1NaMOoQ|KhVycs^PbY&^0f{wQBsg8=x>hD~O!o?{tLN@3_y6@!1zj zA^9d4UgORQ@e^j|1K-KfQm*E;zs-oEv=j%etdFa_Pq9m95+wRuu%dZ0i6)$VFq^{2 z?-2vvC%w|UU|enGDjDc2?X)p^7eusFy-&sYsi-jBBSsV@Q}y2T)LXodx4&y?dYZ1a zbyg7)9^P;;WX!yMTKq0i`i(y#s2v*a{q;yw>GQ-4_ru&xiMTb9{Sj!)lF|UC zsX$7A_v(W&W$@K|Fl3l%#u2GhUM*sO%4ZQX**Fm zegUDXXX>}$GjW)*#uKT?j&$$rzOS|il=_`TV%G^;Q%!4!;mb{;2v8N8(Jd@4HU9G+ z!6*>nh<(*H#3E$vIZngZ{Mw$Tce~u6`iqq3Sw0J~=}-hIGUY>lx+~o+)_^ZF);qxi z^m@m7f7{3X>@cpUj<`#<0kPbALTpe?CF72P0WuMqsh|Zjb@ai45P&{Y(Wjuo8FIXK zc99{!mk|F%ukZ{{8d0+Gqwy(FArUQWrJIx$18ESsR}0(WR-V(>iK`j&m^hsgD@8gk zoWzlj4=P`?GiH;QmYYwnlUqCU={SYJclp2v(koo34~bnu9@3q_D8!CRi=;TtuIg+Y z1JO4n5ohJ|qgb>7X_%gFtN9k~ew1ip^*=a3aEqG0*oey`@lw{72p*D`imHO-Km9R5tjQhiTC+Sk+e zkzUATC!M(3wwpEM$)Ej>9O2C@fyASOmw1Kiyz89LAKRIymbDJ@6_3L@bp6#QS7+2B zLE1L0j{gQWjk%^ArH{c&>|)clL-{NZYi=5-;y}e=R&wYi}UdS>vn|h<9I+Qq{TZs4ldNeCh*JaHZzW=e#f_P z55B%18n2A;%CgJ9$Y3ab8VwZB3rzh8N*iwry>UgnIxA&v+Q6bV0~lZvTc}6mI_}Tu zAoy8Q+y7i^d>Y}zrsbl-W}}+uOGOmY!-b;;dA>5t+cIe;WZ|jL6vLLC^k4ySE>W0H?_Mrf&|G83V ztb3X5XFZCz%r%FjNKyfA&%I(G+3IAr-Qjmy3X)I~-Tu7Bb$3j0nY>j;YuGg8jllCk zCiUFg^@<2VLc1PO{S+)J;a8i?hGskqdff`+w)$a?e^2>`C1JL$>2x1 zIV)z<`K$SFLU#To#lPhO&T3nVF>y%v2Sssq1PP2Rz|E`t+nL>$wW%@UG>IUtnfx0+ z$%zthcw&6J{CotG4X5r3#?1)=;4B%3!Ruup?$1B$ZuBO4a!lJ8x@&S4#YOd38o8&G z62qI1=?P+w>n@!oY2bGDf;OYZJ2_|TXuPk_%k!62thMA3YWi~!OJs))YHPv1f;s{&^KPFv5Y365G=6uK5=}A=eL3hKR z20A=fYknAmjMPrDiq$Z1pJApby_l3}&E+am5{eIs53b;u2ANL#ySTnr>yD%poBL;B z@q+;|l~rzFY@bxsRBMc%z`M;S2io?oFI4ZbO&({61TWFs1TF}>af}(?>@pfn_O`2( z`HDG%Pd@I1B%b%yg;6=zy0Dn{VZ8jh)iP;M*{BjPyJLtpV;WyECNedtWiV<&P!dpE zsy02ZY=5W@Fd1(ttT8)tij0Ztivi54FtueH*He6=FtHyaFk2rFZVksb^t;w@J-ah5 zq(g>W-`;vAjUZ1DGdNal+Pm%c@I?|STW6X~Wp9FmNyZ9h-pF>FlTYQ6c<2~*M7XO2 zAGV4fA-kAAE8+Gz;d+45K9H!HX|A(mV?M|tMm;pZu_(NJK%2ta{d}l3NlG%+U8Lf9 zZ9&wwi^y`>P(>#`49Y4_zj&=qIX$@C3${Xe7aok_@OV+!Jj{JyV^1A3(#6<$H|rVn zbU5_sM5WSh5{`R~_K&sTm zK8B9Q@RfDk=pohRdv3ks{y`7xKIPZbobiL20RJ5z*Hrrfoz+xxuJIE8v6IhlBD0CQ zwTNK~J;pZ2(Lbj!4t&W<@8B<@hDxQ8x4STsPz#-$yO4v7c&*#%ug-CI$6g#j1XHd% zF>wg4j97PVwZgQ#rA2cgpR|Glarw;^p&iH5CoIUh#xscmP3+B?ega=kW4g9Axc2is z!aYumF@v*0SadAZC~QN2Fgv~mF>$lkJnY91JiPrBG)e%GcEt7`*Du&dgfpVE{yx_C zt0v#vFIODjIIL3>*bg&{Mp==0+X4#C)l zM3CR5acH$A*PB{Hx_TpOm+TxBKn#twA~InMi9)Yt4 z2+ITztQRDNECtxXT3b5Zj2P-SKgMr5Ri3QijEnK*+mAml`fZHJ4p6-x1rJd(4Vf(r zpD$M0Oud#MU;5tYVHVl9AVOVZS3PPqmOLtt4dIX$pr~@;%nD@~?v`>{cO|_@BH=~C zTQV*cCVNQ$rmgz234N-~*3r7fjCq!_)ee*xq8|0aWa!J-#^i_@uF>fa;$jKOJ&~4} za|YkMZud1by*_%_uXS(p7#R=l6LPxHuH!y5qBwhDtkDkV8!sxI*LX+p!^O`#{l>U+ z-4>x=<3Mr-fXP~t6A(~L9mNbyrgW=pN8R%(N{Ck!ac8_B3$E}Yn4m65g14R?t^TI( z0~s#5eUTJ=Q!cIfcyc#6SovNd6^jQ)eZ~W)J#=XQ3yeY3sPD%_%_cXj<_jkj_U!%g z>G!Uu&(w(B5y19JQJIucWn-+#nMWhjqqf3e<+qFD za=tQ@<#2(r;-@ zC+lVwuPy6XE^n()j~AOoIjGZejlbhqy`|VCCAAyt=xm+=JK^8etc@=3T)&tZ-30*G z;`5>3x`%guPL)fjArNxZ7Z)VBDXum>D~)CGDqWaW*X$oSKq-ZJeJi-Fs{l+y7EOsO zY9d)Ert7F2?vu$zs>;=fbS= zCP@7Kd0b5IkwW^rO$}t=CPxdh&CM4z4YCI5h+V@IxtH9lI4jGn!F-B)Z z0KTUkM`zj=%(qxG!~$<6VSj9n*NRxFg{0Pwdl#Igk_Q6;Ot2>Xuwe70uG-)(3X#;IembiL4ZzE$d3VJB@>B>Q2%U%-VSd0n%%f%4w&vI$`ZVqb}zb?RRz0jA}CvYcf&UA^pV}UWs#B5|a1xh&&cSIyyPLEuN zoXNCTH%3?Fw4*r0OnKl^Tfk0RI^NGhnunc4Y4XkegUuuQ+w}4a?LU3jVFKtxTlUP3 z){UJdmOq)yoXUs>!02H&s}BrojTs=@V4{3LcixUi;o!vfp>>|lT_*fGp*;@`h$XYQvlL&C~XDWnyp<*hF+i^7q>6Z;UrvY zXlfZ8cwGQqX#ES@Mbk9*=)xQQbdApDm&27tW~EBj0Wo~I6jFo=oyR}3UQn7Yyj}(m zZqZ2tPh8k`Y*J~D53E*E-P@#K*ZdFT@7SOsgx{5Ll=_Za!1!Pgoe&vy->=$k)!khR z216@u7=v_W7s^B;%Mw$}!v>u8B4`4GTIGDnql57gBc-fgAxzLfK&x7;tXdiZKvs-y z0w4#^W7dtVfbx3VpKHUPAjcX2mxd5 z7E|}xGj4Xb(JqkxyDY?XG09_A_ydoq`Djl4fpEy?S0r&4I@wlz>}#TVn=zZybZB5p zE>rg8fEF=9=<3$Aho7HlTv5+_TM}OU@W!o(cqlXm+zPgDje?rmweny^yE3QF_YefY zNC91KgIp_vDl{b;q3(~feN;yqccJng^&!6WKso^|66pXK=UqK(%6hQudE)H$^l15= zW2QJ1XDh;}7UFeGy!i9Wc`9CzEL(7@kIztEY zsS;AX2+1|w#60~xGPK~>VAWKeQTJ95&)qX$4xv85jz}1vOlvGTdGiFHB(Ji*Z}V^r z+-V1STV&ynHdw=cjYa?*>4jssIzE37x3gioQo^KC*68+` zC~G3HEbW@*F?Js2uBa{d*zsv+u>*;tGGCM7ghFCp0py6rT;{Nq0+GU@of8hq2ac#b z^giuuyCd-ZrYKM&54h(|X&|n6hJnqrV@0h^hNMokqXgjDCvXP9xiuwcBe)bk^Wz}p z1da^&q1Yn&2{YpnJl~+&Jet{M-90j{>Rhm`)<|&T91?15*i(~ zBE2A4iM2d`Pm8d*bt82Rtxy!VWQJ{;zk7opMH%g#crcQ(og;NQUAW$f1XB6!M!wGx zDfaLyaH^ht60R5r%0%H&r=ez-_<&c zm+e-44Io55_VyCej{gImUNoZ_e-!<%NC}Gpq*xH*zK)}-a?CugE28JRG%S4liOkp4 ze-KZi;17c`H_jz5<(gHIpR*xn(Imop#L8vV{=q*{f@~Bw-(gE9=P(4o)<1y$WF!>D JD@Bci{|_Cuq6Po} literal 0 HcmV?d00001 diff --git a/docs/guides/security/pam.md b/docs/guides/security/pam.md new file mode 100644 index 0000000000..0687386bbd --- /dev/null +++ b/docs/guides/security/pam.md @@ -0,0 +1,362 @@ +--- +title: PAM authentication modules +author: Antoine Le Morvan +contributors: Steven Spencer +tested with: 8.5 +tags: + - security + - pam +--- + +# PAM authentication modules + +PAM (**Pluggable Authentication Modules**) is the system under GNU/Linux that allows many applications or services to authenticate users centrally. + +> PAM is a suite of libraries that allows a Linux system administrator to configure methods to authenticate users. It provides a flexible and centralized way to switch authentication methods for secured applications by using configuration files instead of changing application code. ([wikipedia](https://en.wikipedia.org/wiki/Linux_PAM)) + +## Generalities + +Authentication is the phase during which it is verified that you are the person you claim to be. There are other forms of authentication besides the use of passwords. + +![PAM generalities](images/pam-001.png) + +The implementation of a new authentication method should not require changes in the configuration or source code of a program or service. + +This is why applications rely on PAM, which will provide them with the primitives necessary to authenticate their users. + +All the applications in a system can thus implement complex functionalities such as **SSO** (Single Sign On), **OTP** (One Time Password) or **Kerberos** in a completely transparent manner. + +A system administrator can choose exactly the authentication policy for a single application (e.g. to harden the SSH service) independently of the application. + +Each application or service supporting PAM will have a corresponding configuration file in the `/etc/pam.d` directory. For example, the process `login` assigns the name `/etc/pam.d/login` to its configuration file. + +!!! WARNING + + A wrong configuration of PAM can compromise the whole security of your system. + + PAM is an authentication system (password management). If PAM is vulnerable then the whole system is vulnerable. + +### Syntax of a directive + +A directive is used to set up an application for PAM. + +``` +mechanism [control] path-to-module [argument] +``` + +For example the file `/etc/pam.d/sudo`: + +``` +#%PAM-1.0 +auth include system-auth +account include system-auth +password include system-auth +session optional pam_keyinit.so revoke +session required pam_limits.so +``` + +A **directive** (a complete line) is composed of a **mechanism** (`auth`, `account`, `password` or `session`), a **success check** (`include`, `optional`, `required`, ...), the **path to the module** and possibly **arguments** (like `revoke` for example). + +!!! WARNING + + The order of the modules is very important! + +Each PAM configuration file contains a set of directives. The module interface directives can be stacked or placed on top of each other. + +In fact, the order in which the modules are listed is very important to the authentication process. + +## The mechanisms + +### The auth mechanism - Authentication + +Concerns the authentication of the requester and establishes the rights of the account: + +* Usually authenticates with a password by comparing it to a value stored in a database or by relying on an authentication server, + +* Establishes account settings: uid, gid, groups and resource limits. + +### The account mechanism - Account management + +Check that the requested account is available: + +* Relates to the availability of the account for reasons other than authentication (e.g. for time restrictions). + +### The session mechanism - Session management + +Relates to session setup and termination: + +* Perform tasks associated with session setup (e.g., logging), +* Perform tasks associated with session termination. + +### The password mechanism - Password management + +Used to modify the authentication token associated with an account (expiration or change): + +* Changes the authentication token and possibly verifies that it is robust enough or that it has not already been used. + +## Control indicators + +The PAM mechanisms (`auth`, `account`, `session` and `password`) indicate `success` or `failure`. The control flags (`required`, `requisite`, `sufficient`, `optional`) tell PAM how to handle this result. + +### The control indicator required + +Successful completion of all `required` modules is necessary. + +* If the module passes: + +The rest of the chain is executed. The request is allowed unless other modules fail. + +* If the module fails: + +The rest of the chain is executed. Finally the request is rejected. + +The module must be successfully verified for the authentication to continue. If the verification of a module marked required fails, the user is not notified until all modules associated with that interface have been verified. + +### The control indicator requisite + +Successful completion of all `requisite` modules is necessary. + +* If the module passes: + +The rest of the chain is executed. The request is allowed unless other modules fail. + +* If the module fails: + +The request is immediately rejected. + +The module must be successfully verified for authentication to continue. However, if the verification of a requisiteite module fails, the user is immediately notified by a message indicating the failure of the first required or requisite module. + +### The control indicator sufficient + +Passing one `sufficient` module is sufficient. + +* If the module succeeds: + +The request is immediately allowed if none of the previous modules failed. + +* If the module fails: + +The module is ignored. The rest of the chain is executed. + +If the module fails, the module checks are ignored. However, if a module check marked `sufficient` is successful and no previous modules marked `required` or `requisite` have failed, no further modules of that type are required and the user will be authenticated to the service. + +### The control indicator optional + +The module is executed but the result of the request is ignored. + +If all modules in the chain were marked `optional`, all requests would always be accepted. + +### Conclusion + +![Rocky Linux installation splash screen](images/pam-002.png) + +## The PAM modules + +There are many modules for PAM. Here are the most common ones: + +* pam_unix +* pam_ldap +* pam_wheel +* pam_cracklib +* pam_console +* pam_tally +* pam_securetty +* pam_nologin +* pam_limits +* pam_time +* pam_access + +### The pam_unix module + +The `pam_unix` module allows to manage the global authentication policy. + +File `/etc/pam.d/system-auth`: + +``` +password sufficient pam_unix.so sha512 nullok +``` + +Arguments are possible for this module: + +* `nullok`: in the `auth` mechanism allows an empty login password. +* `sha512`: in the password mechanism, defines the encryption algorithm. +* `debug`: to send information to `syslog`. +* `remember=n`: to remember the last `n` passwords used (works in conjunction with the `/etc/security/opasswd` file, which is to be created by the administrator). + +### The pam_cracklib module + +The `pam_cracklib` module allows to test passwords. + +File `/etc/pam.d/password-auth` + +``` +password sufficient pam_cracklib.so retry=2 +``` + +This module uses the `cracklib` library to check the strength of a new password. It can also check that the new password is not built from the old one. It only concerns the password mechanism. + +By default this module checks the following aspects and rejects if this is the case: + +* is the new password from the dictionary? +* is the new password a palindrome of the old one (e.g.: azerty <> ytreza)? +* only the case of the character(s) varies (e.g.: azerty <>AzErTy)? + +Possible arguments for this module: + +* `retry=n`: imposes `n` requests (1` by default) for the new password. +* `difok=n`: imposes at least `n` characters (`10` by default) different from the old password. Moreover if half of the characters of the new password are different from the old one, the new password is validated. +* `minlen=n`: imposes a password of `n+1` characters minimum not taken into account below `6` characters (module compiled as such!). + +Other possible arguments : + +* `dcredit=-n`: imposes a password containing at least `n` digits, +* `ucredit=-n`: imposes a password containing at least `n` capital letters, +* `credit=-n`: imposes a password containing at least `n` lower case letters, +* `ocredit=-n`: imposes a password containing at least `n` special characters. + +### The pam_tally module + +The `pam_tally` module allows you to lock an account based on a number of unsuccessful login attempts. + +File `/etc/pam.d/system-auth`: + +``` +auth required /lib/security/pam_tally.so onerr=fail no_magic_root +account required /lib/security/pam_tally.so deny=3 reset no_magic_root +``` + +The `account` mechanism increments the counter. + +The `auth` mechanism accepts or denies authentication and resets the counter. + +Some arguments of the pam_tally module are interesting to use: + +* `onerr=fail`: increment the counter, +* `deny=n`: once the number `n` of unsuccessful attempts is exceeded, the account is locked, +* `no_magic_root`: include or not the daemons managed by root (avoid locking root), +* `reset`: reset the counter to `0` if the authentication is validated, +* `lock_time=nsec`: the account is locked for `n` seconds. + +This module works together with the default file of unsuccessful attempts `/var/log/faillog` (which can be replaced by another file with the argument `file=xxxx`) and the associated command `faillog`. + +Syntax of the faillog command: + +``` +faillog[-m n] |-u login][-r] +``` + +Options: + +* `m`: to define, in the command display, the maximum number of unsuccessful attempts, +* `u`: to specify a user, +* `r`: to unlock a user. + +### The pam_time module + +The `pam_time` module allows to limit the access times to services managed by PAM. + +File `/etc/pam.d/system-auth`: + +``` +account required /lib/security/pam_time.so +``` + +The configuration is done via the file `/etc/security/time.conf`. + +File `/etc/security/time.conf`: + +``` +login ; * ; users ;MoTuWeThFr0800-2000 +http ; * ; users ;Al0000-2400 +``` + +The syntax of a directive is as follows: + +``` +services; ttys; users; times +``` + +In the following definitions, the logical list uses: + +* `&`: and logical, +* `|`: or logical, +* `!`: negation = "all except", +* `*`: wildcard character. + +The columns correspond to : + +* `services`: logical list of services managed by PAM that are concerned, +* `ttys`: logical list of concerned devices, +* `users`: logical list of users managed by the rule, +* `times`: logical list of authorized time slots. + +How to manage time slots : + +* days: Mo Tu We Th Fr Sa Su Wk (Monday to Friday) Wd (Saturday and Sunday) Al (Monday to Sunday), +* the range: HHMM-HHMM, +* a repetition cancels the effect: WkMo = all days of the week (M-F) minus Monday (repeat). + +Examples: + +* Bob, can login via a terminal every day between 07:00 and 09:00, except Wednesday: + +``` +login; tty*; bob; alth0700-0900 +``` + +No login, terminal or remote, except root, every day of the week between 17:30 and 7:45 the next day: + +``` +login; tty* | pts/*; !root; !wk1730-0745 +``` + +### The pam_nologin module + +The `pam_nologin` module allows to disable all accounts except root: + +File `/etc/pam.d/login`: + +``` +auth required pam_nologin.so +``` + +If the file `/etc/nologin` exists then only root can connect. + +### The pam_wheel module + +The `pam_wheel` module allows to limit the access to the `su` command to the members of the `wheel` group. + +File `/etc/pam.d/su`: + +``` +auth required pam_wheel.so +``` + +The argument `group=my_group` limits the use of the `su` command to members of the group `my_group` + +!!! NOTE + + If the group `my_group` is empty, then the `su` command is no longer available on the system, which forces the use of the sudo command. + +### The pam_mount module + +The `pam_mount` module allows to mount a volume for a user session. + +File `/etc/pam.d/system-auth`: + +``` +auth optional pam_mount.so +password optional pam_mount.so +session optional pam_mount.so +``` + +Mount points are configured in the `/etc/security/pam_mount.conf` file: + +File `/etc/security/pam_mount.conf`: + +``` + + +``` + + From 22d24457ba24439c3fed4d43f1194cd994b74c22 Mon Sep 17 00:00:00 2001 From: Ezequiel Bruni Date: Sun, 24 Jul 2022 00:10:26 -0500 Subject: [PATCH 2/4] Editing pass for PAM modules reference --- docs/guides/security/pam.md | 230 +++++++++++++++++------------------- 1 file changed, 110 insertions(+), 120 deletions(-) diff --git a/docs/guides/security/pam.md b/docs/guides/security/pam.md index 0687386bbd..1d33798813 100644 --- a/docs/guides/security/pam.md +++ b/docs/guides/security/pam.md @@ -8,43 +8,56 @@ tags: - pam --- -# PAM authentication modules +# PAM Authentication Modules -PAM (**Pluggable Authentication Modules**) is the system under GNU/Linux that allows many applications or services to authenticate users centrally. +## Prerequisites and Assumptions -> PAM is a suite of libraries that allows a Linux system administrator to configure methods to authenticate users. It provides a flexible and centralized way to switch authentication methods for secured applications by using configuration files instead of changing application code. ([wikipedia](https://en.wikipedia.org/wiki/Linux_PAM)) +* A non-critical Rocky Linux PC, server, or VM +* Root access +* Some existing Linux knowledge (would help a lot) +* A desire to learn about user and app authentication on Linux +* The ability to accept the consequences of your own actions + +## Instroduction + +PAM (**Pluggable Authentication Modules**) is the system under GNU/Linux that allows many applications or services to authenticate users in a centralized fashion. To put it another way: + +> PAM is a suite of libraries that allows a Linux system administrator to configure methods to authenticate users. It provides a flexible and centralized way to switch authentication methods for secured applications by using configuration files instead of changing application code. +> \- [Wikipedia](https://en.wikipedia.org/wiki/Linux_PAM) + +This document is *not* designed to teach you exactly how to harden your machine, okay? It's more of a reference guide to show you what PAM *can* do, and not what you *should* do. ## Generalities -Authentication is the phase during which it is verified that you are the person you claim to be. There are other forms of authentication besides the use of passwords. +Authentication is the phase during which it is verified that you are the person you claim to be. The most common example is the password, but there are other forms of authentication. ![PAM generalities](images/pam-001.png) -The implementation of a new authentication method should not require changes in the configuration or source code of a program or service. +The implementation of a new authentication method should not require changes in the configuration or source code of a program or service. This is why applications rely on PAM, which provides them with the primitives* necessary to authenticate their users. -This is why applications rely on PAM, which will provide them with the primitives necessary to authenticate their users. +All the applications in a system can thus implement complex functionalities such as **SSO** (Single Sign On), **OTP** (One Time Password) or **Kerberos** in a completely transparent manner. A system administrator can choose exactly which authentication policy is to be used for a single application (e.g. to harden the SSH service) independently of the application. -All the applications in a system can thus implement complex functionalities such as **SSO** (Single Sign On), **OTP** (One Time Password) or **Kerberos** in a completely transparent manner. +Each application or service supporting PAM will have a corresponding configuration file in the `/etc/pam.d/` directory. For example, the process `login` assigns the name `/etc/pam.d/login` to its configuration file. -A system administrator can choose exactly the authentication policy for a single application (e.g. to harden the SSH service) independently of the application. - -Each application or service supporting PAM will have a corresponding configuration file in the `/etc/pam.d` directory. For example, the process `login` assigns the name `/etc/pam.d/login` to its configuration file. +\* Primitives are literally the simplest elements of a progam or language, and they allow you to build more sophisticated and complex things on top of them. !!! WARNING - A wrong configuration of PAM can compromise the whole security of your system. - - PAM is an authentication system (password management). If PAM is vulnerable then the whole system is vulnerable. + A misconfigured instance of PAM can compromise the security of your whole system. If PAM is vulnerable, then the whole system is vulnerable. Make any changes with care. -### Syntax of a directive +## Directives -A directive is used to set up an application for PAM. +A directive is used to set up an application for usage with PAM. Directives will follow this format: ``` mechanism [control] path-to-module [argument] ``` -For example the file `/etc/pam.d/sudo`: +A **directive** (a complete line) is composed of a **mechanism** (`auth`, `account`, `password` or `session`), a **success check** (`include`, `optional`, `required`, ...), the **path to the module** and possibly **arguments** (like `revoke` for example). + +Each PAM configuration file contains a set of directives. The module interface directives can be stacked or placed on top of each other. In fact, **the order in which the modules are listed is very important to the authentication process.** + +For example, here's the config file `/etc/pam.d/sudo`: ``` #%PAM-1.0 @@ -55,102 +68,78 @@ session optional pam_keyinit.so revoke session required pam_limits.so ``` -A **directive** (a complete line) is composed of a **mechanism** (`auth`, `account`, `password` or `session`), a **success check** (`include`, `optional`, `required`, ...), the **path to the module** and possibly **arguments** (like `revoke` for example). - -!!! WARNING - - The order of the modules is very important! - -Each PAM configuration file contains a set of directives. The module interface directives can be stacked or placed on top of each other. - -In fact, the order in which the modules are listed is very important to the authentication process. +## Mechanisms -## The mechanisms +### `auth` - Authentication -### The auth mechanism - Authentication +This handles the authentication of the requester and establishes the rights of the account: -Concerns the authentication of the requester and establishes the rights of the account: +* Usually authenticates with a password by comparing it to a value stored in a database, or by relying on an authentication server, -* Usually authenticates with a password by comparing it to a value stored in a database or by relying on an authentication server, +* Establishes account settings: uid, gid, groups, and resource limits. -* Establishes account settings: uid, gid, groups and resource limits. +### `account` - Account management -### The account mechanism - Account management - -Check that the requested account is available: +Checks that the requested account is available: * Relates to the availability of the account for reasons other than authentication (e.g. for time restrictions). -### The session mechanism - Session management +### `session` - Session management Relates to session setup and termination: -* Perform tasks associated with session setup (e.g., logging), -* Perform tasks associated with session termination. +* Performs tasks associated with session setup (e.g. logging), +* Performs tasks associated with session termination. -### The password mechanism - Password management +### `password` - Password management Used to modify the authentication token associated with an account (expiration or change): -* Changes the authentication token and possibly verifies that it is robust enough or that it has not already been used. +* Changes the authentication token and possibly verifies that it is robust enough, or that it has not already been used. -## Control indicators +## Control Indicators The PAM mechanisms (`auth`, `account`, `session` and `password`) indicate `success` or `failure`. The control flags (`required`, `requisite`, `sufficient`, `optional`) tell PAM how to handle this result. -### The control indicator required +### `required` Successful completion of all `required` modules is necessary. -* If the module passes: - -The rest of the chain is executed. The request is allowed unless other modules fail. +* **If the module passes:** The rest of the chain is executed. The request is allowed unless other modules fail. -* If the module fails: +* **If the module fails:** The rest of the chain is executed. Finally the request is rejected. -The rest of the chain is executed. Finally the request is rejected. +The module must be successfully verified for the authentication to continue. If the verification of a module marked `required` fails, the user is not notified until all modules associated with that interface have been verified. -The module must be successfully verified for the authentication to continue. If the verification of a module marked required fails, the user is not notified until all modules associated with that interface have been verified. - -### The control indicator requisite +### `requisite` Successful completion of all `requisite` modules is necessary. -* If the module passes: - -The rest of the chain is executed. The request is allowed unless other modules fail. - -* If the module fails: - -The request is immediately rejected. - -The module must be successfully verified for authentication to continue. However, if the verification of a requisiteite module fails, the user is immediately notified by a message indicating the failure of the first required or requisite module. - -### The control indicator sufficient +* **If the module passes:** The rest of the chain is executed. The request is allowed unless other modules fail. -Passing one `sufficient` module is sufficient. +* **If the module fails:** The request is immediately rejected. -* If the module succeeds: +The module must be successfully verified for authentication to continue. However, if the verification of a `requisite`-marked module fails, the user is immediately notified by a message indicating the failure of the first `required` or `requisite` module. -The request is immediately allowed if none of the previous modules failed. +### `sufficient` -* If the module fails: +Modules marked `sufficient` can be used to let a user in "early" under certain conditions: -The module is ignored. The rest of the chain is executed. +* **If the module succeeds:** The authentication request is immediately allowed if none of the previous modules failed. -If the module fails, the module checks are ignored. However, if a module check marked `sufficient` is successful and no previous modules marked `required` or `requisite` have failed, no further modules of that type are required and the user will be authenticated to the service. +* **If the module fails:** The module is ignored. The rest of the chain is executed. -### The control indicator optional +However, if a module check marked `sufficient` is successful, but modules marked `required` or `requisite` have failed their checks, the success of the `sufficient` module is ignored, and the request fails. -The module is executed but the result of the request is ignored. +### `optional` -If all modules in the chain were marked `optional`, all requests would always be accepted. +The module is executed but the result of the request is ignored. If all modules in the chain were marked `optional`, all requests would always be accepted. ### Conclusion ![Rocky Linux installation splash screen](images/pam-002.png) -## The PAM modules +## PAM modules There are many modules for PAM. Here are the most common ones: @@ -166,11 +155,11 @@ There are many modules for PAM. Here are the most common ones: * pam_time * pam_access -### The pam_unix module +### `pam_unix` -The `pam_unix` module allows to manage the global authentication policy. +The `pam_unix` module allows you to manage the global authentication policy. -File `/etc/pam.d/system-auth`: +In `/etc/pam.d/system-auth` you might add: ``` password sufficient pam_unix.so sha512 nullok @@ -180,32 +169,32 @@ Arguments are possible for this module: * `nullok`: in the `auth` mechanism allows an empty login password. * `sha512`: in the password mechanism, defines the encryption algorithm. -* `debug`: to send information to `syslog`. -* `remember=n`: to remember the last `n` passwords used (works in conjunction with the `/etc/security/opasswd` file, which is to be created by the administrator). +* `debug`: sends information to `syslog`. +* `remember=n`: Use thid to remember the last `n` passwords used (works in conjunction with the `/etc/security/opasswd` file, which is to be created by the administrator). -### The pam_cracklib module +### `pam_cracklib` -The `pam_cracklib` module allows to test passwords. +The `pam_cracklib` module allows you to test passwords. -File `/etc/pam.d/password-auth` +In `/etc/pam.d/password-auth` add: ``` password sufficient pam_cracklib.so retry=2 ``` -This module uses the `cracklib` library to check the strength of a new password. It can also check that the new password is not built from the old one. It only concerns the password mechanism. +This module uses the `cracklib` library to check the strength of a new password. It can also check that the new password is not built from the old one. It *only* affects the password mechanism. By default this module checks the following aspects and rejects if this is the case: -* is the new password from the dictionary? -* is the new password a palindrome of the old one (e.g.: azerty <> ytreza)? -* only the case of the character(s) varies (e.g.: azerty <>AzErTy)? +* Is the new password from the dictionary? +* Is the new password a palindrome of the old one (e.g.: azerty <> ytreza)? +* Has the user only changed the case of the password (e.g.: azerty <>AzErTy)? Possible arguments for this module: * `retry=n`: imposes `n` requests (1` by default) for the new password. -* `difok=n`: imposes at least `n` characters (`10` by default) different from the old password. Moreover if half of the characters of the new password are different from the old one, the new password is validated. -* `minlen=n`: imposes a password of `n+1` characters minimum not taken into account below `6` characters (module compiled as such!). +* `difok=n`: imposes at least `n` characters (`10` by default), different from the old password. If half of the characters of the new password are different from the old one, the new password is validated. +* `minlen=n`: imposes a password of `n+1` characters minimum. You cannot assign a minimum lower than 6 characters (the module is compiled this way). Other possible arguments : @@ -214,30 +203,31 @@ Other possible arguments : * `credit=-n`: imposes a password containing at least `n` lower case letters, * `ocredit=-n`: imposes a password containing at least `n` special characters. -### The pam_tally module +### `pam_tally` The `pam_tally` module allows you to lock an account based on a number of unsuccessful login attempts. -File `/etc/pam.d/system-auth`: +The default config file for this module might look like: `/etc/pam.d/system-auth`: ``` auth required /lib/security/pam_tally.so onerr=fail no_magic_root account required /lib/security/pam_tally.so deny=3 reset no_magic_root ``` -The `account` mechanism increments the counter. - The `auth` mechanism accepts or denies authentication and resets the counter. -Some arguments of the pam_tally module are interesting to use: +The `account` mechanism increments the counter. + +Some arguments of the pam_tally module include: -* `onerr=fail`: increment the counter, -* `deny=n`: once the number `n` of unsuccessful attempts is exceeded, the account is locked, -* `no_magic_root`: include or not the daemons managed by root (avoid locking root), -* `reset`: reset the counter to `0` if the authentication is validated, +* `onerr=fail`: increment the counter. +* `deny=n`: once the number `n` of unsuccessful attempts is exceeded, the account is locked. +* `no_magic_root`: can be used to deny access to root-level services launched by daemons. + * e.g. don't use this for `su`. +* `reset`: reset the counter to 0 if the authentication is validated. * `lock_time=nsec`: the account is locked for `n` seconds. -This module works together with the default file of unsuccessful attempts `/var/log/faillog` (which can be replaced by another file with the argument `file=xxxx`) and the associated command `faillog`. +This module works together with the default file for unsuccessful attempts `/var/log/faillog` (which can be replaced by another file with the argument `file=xxxx`), and the associated command `faillog`. Syntax of the faillog command: @@ -251,19 +241,17 @@ Options: * `u`: to specify a user, * `r`: to unlock a user. -### The pam_time module +### `pam_time` The `pam_time` module allows to limit the access times to services managed by PAM. -File `/etc/pam.d/system-auth`: +To activate it, edit `/etc/pam.d/system-auth` and add: ``` account required /lib/security/pam_time.so ``` -The configuration is done via the file `/etc/security/time.conf`. - -File `/etc/security/time.conf`: +The configuration is done in the `/etc/security/time.conf` file: ``` login ; * ; users ;MoTuWeThFr0800-2000 @@ -278,23 +266,23 @@ services; ttys; users; times In the following definitions, the logical list uses: -* `&`: and logical, -* `|`: or logical, -* `!`: negation = "all except", -* `*`: wildcard character. +* `&`: is the "and" logical. +* `|`: is the "or" logical. +* `!`: means negation, or "all except". +* `*`: is the wildcard character. The columns correspond to : -* `services`: logical list of services managed by PAM that are concerned, -* `ttys`: logical list of concerned devices, -* `users`: logical list of users managed by the rule, -* `times`: logical list of authorized time slots. +* `services`: a logical list of services managed by PAM that are also to be managed by this rule +* `ttys`: a logical list of related devices +* `users`: logical list of users managed by the rule +* `times`: a logical list of authorized time slots How to manage time slots : -* days: Mo Tu We Th Fr Sa Su Wk (Monday to Friday) Wd (Saturday and Sunday) Al (Monday to Sunday), -* the range: HHMM-HHMM, -* a repetition cancels the effect: WkMo = all days of the week (M-F) minus Monday (repeat). +* Days: `Mo`, `Tu`, `We`, `Th`, `Fr,` `Sa`, `Su`, `Wk`, (Monday to Friday), `Wd` (Saturday and Sunday), and `Al` (Monday to Sunday) +* The hourly range: `HHMM-HHMM` +* A repetition cancels the effect: `WkMo` = all days of the week (M-F), minus Monday (repeat). Examples: @@ -310,11 +298,11 @@ No login, terminal or remote, except root, every day of the week between 17:30 a login; tty* | pts/*; !root; !wk1730-0745 ``` -### The pam_nologin module +### `pam_nologin` -The `pam_nologin` module allows to disable all accounts except root: +The `pam_nologin` module disables all accounts except root: -File `/etc/pam.d/login`: +In `/etc/pam.d/login` you'd put: ``` auth required pam_nologin.so @@ -322,11 +310,11 @@ auth required pam_nologin.so If the file `/etc/nologin` exists then only root can connect. -### The pam_wheel module +### `pam_wheel` -The `pam_wheel` module allows to limit the access to the `su` command to the members of the `wheel` group. +The `pam_wheel` module allows you to limit the access to the `su` command to the members of the `wheel` group. -File `/etc/pam.d/su`: +In `/etc/pam.d/su` you'd put: ``` auth required pam_wheel.so @@ -338,11 +326,11 @@ The argument `group=my_group` limits the use of the `su` command to members of t If the group `my_group` is empty, then the `su` command is no longer available on the system, which forces the use of the sudo command. -### The pam_mount module +### `pam_mount` -The `pam_mount` module allows to mount a volume for a user session. +The `pam_mount` module allows you to mount a volume for a user session. -File `/etc/pam.d/system-auth`: +In `/etc/pam.d/system-auth` you'd put: ``` auth optional pam_mount.so @@ -352,11 +340,13 @@ session optional pam_mount.so Mount points are configured in the `/etc/security/pam_mount.conf` file: -File `/etc/security/pam_mount.conf`: - ``` ``` +## Wrapping Up + +By now, you should have a much better idea of what PAM can do, and how to make changes when needed. However, we must reiterate the importance of being very, *very* careful with any changes you make to PAM modules. You could lock yourself out of your system, or worse, let everyone else in. +We would stringly recommend testing all changes in an environment that can be easily reverted to a previous configuration. That said, have fun with it! \ No newline at end of file From 534bac414bda156471dfefb10dbfb412d081a38d Mon Sep 17 00:00:00 2001 From: Ezequiel Bruni Date: Sun, 24 Jul 2022 01:00:47 -0500 Subject: [PATCH 3/4] Updated contributors --- docs/guides/security/pam.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/security/pam.md b/docs/guides/security/pam.md index 1d33798813..274bf9b177 100644 --- a/docs/guides/security/pam.md +++ b/docs/guides/security/pam.md @@ -1,7 +1,7 @@ --- title: PAM authentication modules author: Antoine Le Morvan -contributors: Steven Spencer +contributors: Steven Spencer, Ezequiel Bruni tested with: 8.5 tags: - security From eb3c356c06ec3982163fa254d4e90108b9075e60 Mon Sep 17 00:00:00 2001 From: sspencerwire Date: Mon, 25 Jul 2022 09:34:42 -0500 Subject: [PATCH 4/4] Minor changes * the actual contents to `/etc/pam.d/sudo` were not as published. Fixed with content from an 8.6 install * fixed `pam_time` to add "you" to the line "allows to" ... now "allows you to" which aligns with the other module explanations. * final sentence had "strongly" misspelled as "stringly" fixed this * added 8.6 to the "tested with:" meta --- docs/guides/security/pam.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/docs/guides/security/pam.md b/docs/guides/security/pam.md index 274bf9b177..22f884dc8b 100644 --- a/docs/guides/security/pam.md +++ b/docs/guides/security/pam.md @@ -2,7 +2,7 @@ title: PAM authentication modules author: Antoine Le Morvan contributors: Steven Spencer, Ezequiel Bruni -tested with: 8.5 +tested with: 8.5, 8.6 tags: - security - pam @@ -61,11 +61,10 @@ For example, here's the config file `/etc/pam.d/sudo`: ``` #%PAM-1.0 -auth include system-auth -account include system-auth -password include system-auth -session optional pam_keyinit.so revoke -session required pam_limits.so +auth include system-auth +account include system-auth +password include system-auth +session include system-auth ``` ## Mechanisms @@ -243,7 +242,7 @@ Options: ### `pam_time` -The `pam_time` module allows to limit the access times to services managed by PAM. +The `pam_time` module allows you to limit the access times to services managed by PAM. To activate it, edit `/etc/pam.d/system-auth` and add: @@ -349,4 +348,4 @@ Mount points are configured in the `/etc/security/pam_mount.conf` file: By now, you should have a much better idea of what PAM can do, and how to make changes when needed. However, we must reiterate the importance of being very, *very* careful with any changes you make to PAM modules. You could lock yourself out of your system, or worse, let everyone else in. -We would stringly recommend testing all changes in an environment that can be easily reverted to a previous configuration. That said, have fun with it! \ No newline at end of file +We would strongly recommend testing all changes in an environment that can be easily reverted to a previous configuration. That said, have fun with it!