From 8c0ad3910eadea1776568b07d13cfcf4943974b4 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 8 Aug 2024 12:57:56 -0500 Subject: [PATCH 001/138] add macos security overview --- content/posts/macos/Security Features of macOS | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 content/posts/macos/Security Features of macOS diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS new file mode 100644 index 000000000..6cf957d45 --- /dev/null +++ b/content/posts/macos/Security Features of macOS @@ -0,0 +1,5 @@ +macOS comes equipped with many security features to keep you safe. + +## FileVault + +By default, your macOS install is encrypted, but it will automatically unlock on boot. Turning on [FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) will require a user password to unlock the volume. It also makes it so that you need to enter a user password to enter recovery mode. \ No newline at end of file From 04dccb94696f12d617e7a33a88fbf241afd2d30b Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 8 Aug 2024 13:27:03 -0500 Subject: [PATCH 002/138] add app sandbox info --- .../posts/macos/Security Features of macOS | 28 ++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 6cf957d45..434d353b5 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -2,4 +2,30 @@ macOS comes equipped with many security features to keep you safe. ## FileVault -By default, your macOS install is encrypted, but it will automatically unlock on boot. Turning on [FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) will require a user password to unlock the volume. It also makes it so that you need to enter a user password to enter recovery mode. \ No newline at end of file +By default, your macOS install is encrypted, but it will automatically unlock on boot. Turning on [FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) will require a user password to unlock the volume. It also makes it so that you need to enter a user password to enter recovery mode. + +## App Sandbox + +The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. + +The App Sandbox is designed to limit the damage to your system in the event an app is exploited, however it can't protect against malicious developers since they can just disable or weaken the sandbox in a future update if they want. For protection against malicious developers, you'll need to install apps from the App Store where the sandbox is enforced. + +There are a few ways to check whether an app is sandboxed: + +You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" + +![Activity Monitor](https://docs-assets.developer.apple.com/published/67f023afa2/renderedDark2x-1667920132.png) + +You can check whether an app is sandboxed and what entitlements it has by running the command + +``` zsh +% codesign -dvvv --entitlements - +``` + +If the app is sandboxed, you will see + +``` zsh + [Key] com.apple.security.app-sandbox + [Value] + [Bool] true +``` \ No newline at end of file From f55e87b9506489837474149dc610adb35a6ce191 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 8 Aug 2024 13:38:21 -0500 Subject: [PATCH 003/138] add hardened runtime info --- content/posts/macos/Security Features of macOS | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 434d353b5..9a0836994 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -28,4 +28,18 @@ If the app is sandboxed, you will see [Key] com.apple.security.app-sandbox [Value] [Bool] true -``` \ No newline at end of file +``` + +## Hardened Runtime + +The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an optional security feature that developers can enable that makes an app more resistant to exploitation. It prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. + +Unlike the App Sandbox, the Hardened Runtime is required in order for an app to be notarized and so you'll be warned by Gatekeeper if an app doesn't use it. While this warning is bypassable, you should be cautious and investigate a bit more before running it. + +Check if an app is using the Hardened Runtime before running it with the command + +``` zsh +codesign --display --verbose /path/to/bundle.app +``` + +You will see `flags=0x10000(runtime)` if it's enabled. \ No newline at end of file From a0ae942229bb7a18f2303dcec7fd4305cec06069 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 8 Aug 2024 14:06:38 -0500 Subject: [PATCH 004/138] add gatekeeper --- content/posts/macos/Security Features of macOS | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 9a0836994..2511508e9 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -42,4 +42,10 @@ Check if an app is using the Hardened Runtime before running it with the command codesign --display --verbose /path/to/bundle.app ``` -You will see `flags=0x10000(runtime)` if it's enabled. \ No newline at end of file +You will see `flags=0x10000(runtime)` if it's enabled. + +## Gatekeeper + +[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. It's also scanned for malware. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. + +While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. \ No newline at end of file From d583d906278bcdcfeb0550d027ffb247453efc24 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 8 Aug 2024 15:21:55 -0500 Subject: [PATCH 005/138] add xprotect info --- content/posts/macos/Security Features of macOS | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 2511508e9..f7b34e736 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -48,4 +48,12 @@ You will see `flags=0x10000(runtime)` if it's enabled. [Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. It's also scanned for malware. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. -While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. \ No newline at end of file +While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. + +## XProtect + +XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. + +XProtect uses of YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. + +Apple also issues revocations for notarization tickets, these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. \ No newline at end of file From 9b83ec0465674aafb15de48af39d3639f0e51d8f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:02:29 -0500 Subject: [PATCH 006/138] add secure boot info --- content/posts/macos/Security Features of macOS | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index f7b34e736..f17c6344c 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -56,4 +56,14 @@ XProtect is the built-in antivirus software in macOS. Like all AV, it's a last l XProtect uses of YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. \ No newline at end of file +Apple also issues revocations for notarization tickets, these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. + +## System Integrity Protection + +[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. Since it's protecting your base system files, you should **never** disable it even temporarily if you want the best security. + +## Secure Boot + +Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself. It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. + +A unique feature of Mac computers is that you can set a different LocalPolicy for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. \ No newline at end of file From fafeab0ac4ff5e8800a9fb1d1f6f4eb8e22b6cda Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:05:00 -0500 Subject: [PATCH 007/138] add DMA info --- content/posts/macos/Security Features of macOS | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index f17c6344c..98e24665d 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -66,4 +66,8 @@ Apple also issues revocations for notarization tickets, these are detected with Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself. It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. -A unique feature of Mac computers is that you can set a different LocalPolicy for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. \ No newline at end of file +A unique feature of Mac computers is that you can set a different LocalPolicy for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. + +## DMA Protection + +Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-memory-access-protections-seca4960c2b5/1/web/1) so that each DMA agent, including PCIe and Thunderbolt ports, can only access memory explicitly mapped for their use. \ No newline at end of file From 00b633af1eb72ba4eca64b480a756ca8b3383e4e Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:07:25 -0500 Subject: [PATCH 008/138] add link to apple platform security --- content/posts/macos/Security Features of macOS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 98e24665d..58b28eec3 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -1,4 +1,4 @@ -macOS comes equipped with many security features to keep you safe. +macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. ## FileVault From 4afc0a272fcf33fd7b33c5d6b1b4d507128f6b76 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:10:26 -0500 Subject: [PATCH 009/138] add lockdown mode info --- content/posts/macos/Security Features of macOS | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 58b28eec3..1d4333af0 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -70,4 +70,8 @@ A unique feature of Mac computers is that you can set a different LocalPolicy fo ## DMA Protection -Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-memory-access-protections-seca4960c2b5/1/web/1) so that each DMA agent, including PCIe and Thunderbolt ports, can only access memory explicitly mapped for their use. \ No newline at end of file +Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-memory-access-protections-seca4960c2b5/1/web/1) so that each DMA agent, including PCIe and Thunderbolt ports, can only access memory explicitly mapped for their use. + +## Lockdown Mode + +[Lockdown Mode](https://support.apple.com/en-us/105120) is an optional security feature that disables lots of attack surface in your Mac. It may break certain things like websites or apps, but you can disable it for individual apps or websites if you need to. \ No newline at end of file From 88f4bf926fd9e055f65c526e488b680e69e74e7d Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:14:39 -0500 Subject: [PATCH 010/138] add custom umask --- content/posts/macos/Security Features of macOS | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 1d4333af0..c36e878ae 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -74,4 +74,8 @@ Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-me ## Lockdown Mode -[Lockdown Mode](https://support.apple.com/en-us/105120) is an optional security feature that disables lots of attack surface in your Mac. It may break certain things like websites or apps, but you can disable it for individual apps or websites if you need to. \ No newline at end of file +[Lockdown Mode](https://support.apple.com/en-us/105120) is an optional security feature that disables lots of attack surface in your Mac. It may break certain things like websites or apps, but you can disable it for individual apps or websites if you need to. + +## Custom umask + +macOS is a Unix-like, so certain security practices carry over from other systems. Consider setting a [custom umask](https://support.apple.com/en-us/101914). \ No newline at end of file From 62d51bdae52493c83683d948c1a2fdc9ef3e3758 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:17:12 -0500 Subject: [PATCH 011/138] add secure keyboard entry --- content/posts/macos/Security Features of macOS | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index c36e878ae..dc9d6f883 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -78,4 +78,8 @@ Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-me ## Custom umask -macOS is a Unix-like, so certain security practices carry over from other systems. Consider setting a [custom umask](https://support.apple.com/en-us/101914). \ No newline at end of file +macOS is a Unix-like, so certain security practices carry over from other systems. Consider setting a [custom umask](https://support.apple.com/en-us/101914). + +## Terminal Secure Keyboard Entry + +To prevent other apps from detecting what you type in Terminal, enable [Secure Keyboard Entry](https://support.apple.com/guide/terminal/use-secure-keyboard-entry-trml109/mac). \ No newline at end of file From c3475b8061a163103fdb24cbe6cfe229e1cfe3a6 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:25:37 -0500 Subject: [PATCH 012/138] add admin account info --- content/posts/macos/Security Features of macOS | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index dc9d6f883..5177908bc 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -82,4 +82,8 @@ macOS is a Unix-like, so certain security practices carry over from other system ## Terminal Secure Keyboard Entry -To prevent other apps from detecting what you type in Terminal, enable [Secure Keyboard Entry](https://support.apple.com/guide/terminal/use-secure-keyboard-entry-trml109/mac). \ No newline at end of file +To prevent other apps from detecting what you type in Terminal, enable [Secure Keyboard Entry](https://support.apple.com/guide/terminal/use-secure-keyboard-entry-trml109/mac). + +## Standard User Account + +When you first set up your Mac, you will create an Administrator account that has powerful access to the OS. [Apple recommends](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac) limiting the number of Administrator accounts on your machine and using a Standard user account when Aministrator prvileges aren't needed. \ No newline at end of file From 9c3c63fc8bd1d1662bd4981f41d1dfc2d80ed077 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:27:39 -0500 Subject: [PATCH 013/138] add metadata --- content/posts/macos/Security Features of macOS | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 5177908bc..c587b967a 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -1,3 +1,10 @@ +--- +title: "Security Features in macOS" +date: 2024-08-09 +tags: ['macOS', 'Security'] +author: kimg45 +--- + macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. ## FileVault From 2ffb9448fe5095dbad4ca76d05af5d1ebb974ca6 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:37:40 -0500 Subject: [PATCH 014/138] add reopen windows --- content/posts/macos/Security Features of macOS | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index c587b967a..dd3e590b6 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -93,4 +93,12 @@ To prevent other apps from detecting what you type in Terminal, enable [Secure K ## Standard User Account -When you first set up your Mac, you will create an Administrator account that has powerful access to the OS. [Apple recommends](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac) limiting the number of Administrator accounts on your machine and using a Standard user account when Aministrator prvileges aren't needed. \ No newline at end of file +When you first set up your Mac, you will create an Administrator account that has powerful access to the OS. [Apple recommends](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac) limiting the number of Administrator accounts on your machine and using a Standard user account when Aministrator prvileges aren't needed. + +You can [hide an administrator account](https://support.apple.com/en-us/102099) so you don't accidentally log into it. + +Also make sure to set a strong password for any accounts you make and set a time after which a user will [automatically be logged out](https://support.apple.com/guide/mac-help/set-your-mac-to-log-out-when-not-in-use-mchlp2443/14.0/mac/14.0). + +## Prevent Windows from Reopening + +When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. \ No newline at end of file From 3ad9d5e25ad8929943d64897e97e91a8f2015cec Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 9 Aug 2024 23:51:45 -0500 Subject: [PATCH 015/138] add trash and file extensions --- content/posts/macos/Security Features of macOS | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index dd3e590b6..42890cda7 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -101,4 +101,12 @@ Also make sure to set a strong password for any accounts you make and set a time ## Prevent Windows from Reopening -When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. \ No newline at end of file +When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. + +## Automatically Empty Trash + +You can set the trash to [automatically empty](https://support.apple.com/en-ca/guide/mac-help/mchlp1093/14.0/mac/14.0#mchl0deca7f1) every 30 days to prevent old unwanted files from sticking around. + +## Show File Extensions + +You should set Finder to always [show all file extensions](https://support.apple.com/en-ca/guide/mac-help/mchlp2304/mac) to help you see when a file is masquerading as another filetype. \ No newline at end of file From fb0132721b4a4e6852870d631bbd8f9e75750134 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 00:00:45 -0500 Subject: [PATCH 016/138] add system extension info --- content/posts/macos/Security Features of macOS | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 42890cda7..fa91c09c8 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -109,4 +109,10 @@ You can set the trash to [automatically empty](https://support.apple.com/en-ca/g ## Show File Extensions -You should set Finder to always [show all file extensions](https://support.apple.com/en-ca/guide/mac-help/mchlp2304/mac) to help you see when a file is masquerading as another filetype. \ No newline at end of file +You should set Finder to always [show all file extensions](https://support.apple.com/en-ca/guide/mac-help/mchlp2304/mac) to help you see when a file is masquerading as another filetype. + +## System Extensions + +There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them and they're being phased out more and more with every version of macOS. + +Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when absolutely necessary. \ No newline at end of file From ea2cd286c670a3eb7476d93ace808a431fb00293 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 00:07:59 -0500 Subject: [PATCH 017/138] add lock screen security --- content/posts/macos/Security Features of macOS | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index fa91c09c8..289b2a4e3 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -99,6 +99,10 @@ You can [hide an administrator account](https://support.apple.com/en-us/102099) Also make sure to set a strong password for any accounts you make and set a time after which a user will [automatically be logged out](https://support.apple.com/guide/mac-help/set-your-mac-to-log-out-when-not-in-use-mchlp2443/14.0/mac/14.0). +## Lock Screen Security + +Make sure you [require users to login](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac#mchlpf5777a4) and set your Mac to [require a password](https://support.apple.com/guide/mac-help/require-a-password-after-waking-your-mac-mchlp2270/14.0/mac/14.0) after waking up. + ## Prevent Windows from Reopening When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. From 395a85aa99b5028c19ddf7684561c9084c980c4c Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 00:12:14 -0500 Subject: [PATCH 018/138] add lock screen keyboard shortcut --- content/posts/macos/Security Features of macOS | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 289b2a4e3..3226f7469 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -103,6 +103,8 @@ Also make sure to set a strong password for any accounts you make and set a time Make sure you [require users to login](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac#mchlpf5777a4) and set your Mac to [require a password](https://support.apple.com/guide/mac-help/require-a-password-after-waking-your-mac-mchlp2270/14.0/mac/14.0) after waking up. +Use the Control + Command + Q keyboard shortcut to lock your screen any time you leave your computer. + ## Prevent Windows from Reopening When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. From 40d669dfc56ae37bf8c84fdbabf3454f8c6d7df6 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 00:26:11 -0500 Subject: [PATCH 019/138] add apps requiring admin --- content/posts/macos/Security Features of macOS | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/Security Features of macOS index 3226f7469..e4c3dc2bc 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/Security Features of macOS @@ -121,4 +121,10 @@ You should set Finder to always [show all file extensions](https://support.apple There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them and they're being phased out more and more with every version of macOS. -Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when absolutely necessary. \ No newline at end of file +Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when absolutely necessary. + +## Apps Requiring Admin + +Be careful installing apps that require Administrator privileges to run, you're giving them a lot of power in your system. + +**Note**: When mounting a .dmg file, usually a graphic will come up asking you to move the app to your Applications folder, which will trigger an Administrator popup. The app isn't actually running, you're just moving it to the systemwide Applications folder so that all users on the system can run it. If you're not comfortable with this, you can simply drag the app anywhere else and run it. \ No newline at end of file From 9343a4dc3366a41952e7ac6674d2dfe574843484 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 00:39:55 -0500 Subject: [PATCH 020/138] update name --- .../{Security Features of macOS => macOS Security Overview} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename content/posts/macos/{Security Features of macOS => macOS Security Overview} (99%) diff --git a/content/posts/macos/Security Features of macOS b/content/posts/macos/macOS Security Overview similarity index 99% rename from content/posts/macos/Security Features of macOS rename to content/posts/macos/macOS Security Overview index e4c3dc2bc..774d89421 100644 --- a/content/posts/macos/Security Features of macOS +++ b/content/posts/macos/macOS Security Overview @@ -1,5 +1,5 @@ --- -title: "Security Features in macOS" +title: "macOS Security Overview" date: 2024-08-09 tags: ['macOS', 'Security'] author: kimg45 From e8ace076be727931c96c4eeb25f98fe928262c34 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 09:24:31 -0500 Subject: [PATCH 021/138] add firewall --- content/posts/macos/macOS Security Overview | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview b/content/posts/macos/macOS Security Overview index 774d89421..24a4b6eb2 100644 --- a/content/posts/macos/macOS Security Overview +++ b/content/posts/macos/macOS Security Overview @@ -127,4 +127,8 @@ Newer system extensions don't directly modify the kernel, but they use APIs that Be careful installing apps that require Administrator privileges to run, you're giving them a lot of power in your system. -**Note**: When mounting a .dmg file, usually a graphic will come up asking you to move the app to your Applications folder, which will trigger an Administrator popup. The app isn't actually running, you're just moving it to the systemwide Applications folder so that all users on the system can run it. If you're not comfortable with this, you can simply drag the app anywhere else and run it. \ No newline at end of file +**Note**: When mounting a .dmg file, usually a graphic will come up asking you to move the app to your Applications folder, which will trigger an Administrator popup. The app isn't actually running, you're just moving it to the systemwide Applications folder so that all users on the system can run it. If you're not comfortable with this, you can simply drag the app anywhere else and run it. + +## Firewall + +macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's eanbled at the very least, but you can block all incoming connections for the best security/privacy. \ No newline at end of file From fa85ce464292886c3fbd46b39e2e584e1b8879a8 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:15:45 -0500 Subject: [PATCH 022/138] add file extension --- .../macos/{macOS Security Overview => macOS Security Overview.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename content/posts/macos/{macOS Security Overview => macOS Security Overview.md} (100%) diff --git a/content/posts/macos/macOS Security Overview b/content/posts/macos/macOS Security Overview.md similarity index 100% rename from content/posts/macos/macOS Security Overview rename to content/posts/macos/macOS Security Overview.md From 79d8d5df2b9e3a8fd2abe5978431b94d4cef15ec Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:17:44 -0500 Subject: [PATCH 023/138] wording --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 24a4b6eb2..7fe61ec6a 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -119,7 +119,7 @@ You should set Finder to always [show all file extensions](https://support.apple ## System Extensions -There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them and they're being phased out more and more with every version of macOS. +There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them. They're being phased out more and more with every version of macOS. Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when absolutely necessary. From f83379375e5cae0feefe57ffe71c33d2de47f208 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:20:53 -0500 Subject: [PATCH 024/138] remove redundant sentence --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 7fe61ec6a..933849b47 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -53,7 +53,7 @@ You will see `flags=0x10000(runtime)` if it's enabled. ## Gatekeeper -[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. It's also scanned for malware. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. +[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. From 1efe2fde5b35bf73f332b86c1e414c203beadfc1 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:21:59 -0500 Subject: [PATCH 025/138] grammar --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 933849b47..955f8d374 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -61,7 +61,7 @@ While the Gatekeeper warning can be easily bypassed by control + clicking on the XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. -XProtect uses of YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. +XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. Apple also issues revocations for notarization tickets, these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. From 5437377b3f9a28d40b3ba7f8028869393086c084 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:22:39 -0500 Subject: [PATCH 026/138] grammar --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 955f8d374..2ad78ddc2 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -63,7 +63,7 @@ XProtect is the built-in antivirus software in macOS. Like all AV, it's a last l XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. +Apple also issues revocations for notarization tickets, which these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. ## System Integrity Protection From acc4054bf3e35ceab61744f1f2d1ab952630f16a Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:24:24 -0500 Subject: [PATCH 027/138] spelling --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 2ad78ddc2..4a987b04a 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -93,7 +93,7 @@ To prevent other apps from detecting what you type in Terminal, enable [Secure K ## Standard User Account -When you first set up your Mac, you will create an Administrator account that has powerful access to the OS. [Apple recommends](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac) limiting the number of Administrator accounts on your machine and using a Standard user account when Aministrator prvileges aren't needed. +When you first set up your Mac, you will create an Administrator account that has powerful access to the OS. [Apple recommends](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac) limiting the number of Administrator accounts on your machine and using a Standard user account when Aministrator privileges aren't needed. You can [hide an administrator account](https://support.apple.com/en-us/102099) so you don't accidentally log into it. From 7c7388f7609907a4030c56ce01d0957c5f8f3efb Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:27:06 -0500 Subject: [PATCH 028/138] add bold --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 4a987b04a..13c7d3f9e 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -121,7 +121,7 @@ You should set Finder to always [show all file extensions](https://support.apple There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them. They're being phased out more and more with every version of macOS. -Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when absolutely necessary. +Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when **absolutely necessary**. ## Apps Requiring Admin From 626bc7ff2ba5056524f81a69b0023fae87c0dbdb Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:32:01 -0500 Subject: [PATCH 029/138] add kernel integrity protection --- content/posts/macos/macOS Security Overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 13c7d3f9e..c0bf59224 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -67,7 +67,9 @@ Apple also issues revocations for notarization tickets, which these are detected ## System Integrity Protection -[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. Since it's protecting your base system files, you should **never** disable it even temporarily if you want the best security. +[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. Since it's protecting your base system files, you should **never** disable it even temporarily if you want the best security. + +On Apple Silicon Macs, it's combined with [Kernel Integrity Protection](https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/web#sec41bf3cd61) to protect kernel memory from being exploited. ## Secure Boot From 480af4c4449d78c5bd6917d5fd1cc2aebf95835c Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:32:39 -0500 Subject: [PATCH 030/138] spelling --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index c0bf59224..b8f728fc4 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -133,4 +133,4 @@ Be careful installing apps that require Administrator privileges to run, you're ## Firewall -macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's eanbled at the very least, but you can block all incoming connections for the best security/privacy. \ No newline at end of file +macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's enabled at the very least, but you can block all incoming connections for the best security/privacy. \ No newline at end of file From 08f550c5659a5d5bbb6944b82311190aedcd3d5a Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:35:25 -0500 Subject: [PATCH 031/138] chance custom to stricter --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index b8f728fc4..2fed35888 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -87,7 +87,7 @@ Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-me ## Custom umask -macOS is a Unix-like, so certain security practices carry over from other systems. Consider setting a [custom umask](https://support.apple.com/en-us/101914). +macOS is a Unix-like, so certain security practices carry over from other systems. Consider setting a [stricter umask](https://support.apple.com/en-us/101914). ## Terminal Secure Keyboard Entry From bb7ce57dddd981e7e91542905bbffde2de71f44a Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:40:45 -0500 Subject: [PATCH 032/138] fix image --- content/posts/macos/macOS Security Overview.md | 2 +- static/images/activity-monitor.png | Bin 0 -> 352204 bytes 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 static/images/activity-monitor.png diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 2fed35888..70ba89aac 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -21,7 +21,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](https://docs-assets.developer.apple.com/published/67f023afa2/renderedDark2x-1667920132.png) +![Activity Monitor](../../../static/images/activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has by running the command diff --git a/static/images/activity-monitor.png b/static/images/activity-monitor.png new file mode 100644 index 0000000000000000000000000000000000000000..5f7db35040806bfc721c3eac275e5ce813dfa2fd GIT binary patch literal 352204 zcmeFYdsI@{8$VoAV>44~jnlj=#hzM3zYTimG zFDX!CY340LMG`O*Z>f-Z7X?LxQUnwQ6)!LITkE&h`}h0zyI8Ds&fc8OKIiQHJkRIz ze4f<5JYc#%8U3_r(KBQ{-C36;oVuGXixNRo;vkc*eTd4R5&Wy z^VYSX8?YOZH==I_U4)(7w8<$W>rCL!6|(l9Ft_b%%dy!Y}sRANjg| zgBmevofBSj;&F#`jCj)$FuD5j=3&S$Cw4Zy9?u!y@NKd>5L!N)X7g{&U;l1R`rp#$ z71)a}dw-mv1E>u-^#cor`4-<<8&%m%^$MwNVm90Pb`$=y zF8;I4(afhuo?31;p8VK2GAsYJl|QJWsW*@_Re!-Yr;I%qs&M*rP*Nc)mr<& zqMu?27mId?^-VX83y;{mjaQqSzIDHOB&9RME5xyFK4qz1yeIfOyvzo9(|PbS=vDBe z6V|e{$@yKEOCfBpGE&~jwLlx%FRd2fhXF-9ZnqzcSzTO-^&%GhAj}5s-ENd_VRyN9 z?qqwSSFP2{oq=_?6SIV)?e4ssPn*e&WTUCSa?EmO{UGe!`57I*H{HidcOScI@W?jyi?6RjUM%&GO9dYfFRyQ+{T;gAKJ&Hb*vXO&bH(R3ALSvJ%o#ff z*pTv=&p!s=GVilLYj-v~Y02bZj_8=-f#P4YtvWofr(f@JKBwo4QDQs8wSwdZXZG#h1%S1 zAL%1Tb2mN)N(SEsN`O8)*0&M1B+l?I(;Q}wcU}Go{~qPbhAF`w*CDTLE`?vC7XRz* zaCzlBv(8O;dR)T~NFCo*k-7t#9oC`FHnU8ex6^T+FM@UOcc-v9BMU3@IC+#qAGe}hij zTh#S(e8ru;WoT(+1$AHo`uCY!9jkM|Py#bxL$el-S8nMOY^s00 zv1P*|ZhK46K&RF~INi8%HrU;L(-H0Q51Te8-`uoSd$d{mHPU`JZTjx{cmKELd)D(U z|Mz$+^uNya@Q#p8n||MP_Ky>P$8DAtrN&PF`S=jBdSgRC95&Z|{G{sj*3FMMeSgkS zej*ANr;}YV{YJK)wXyFv$7BEh=l|mqxJA)jrKQao-X;k?B%&%es%vI)l>QrnYUc#g z(26i|;$Lak8LbOtTi_jW2rEc!-*B?Oaz%7RzUSFW4%z;8>r~Krva=)zxw@ZGP=M?U zd}PsBt_X(Hk8=LPUM3qInoONomb{^JlwUlx*L^tgnp1KYyA6|;@uBSs zO3=51AAXH*;Bs-)n9#};u&J%is&5`Wm%7&a)*f?7I9b1B8pye|AUlsL|m zn=Lof>o48bv2;Pbb<{=^%PQ*WKq^>?w!=?xAJ0SwdX3Rstv&`q;~ABcYd8-Fx)F4e zbj(Wb$FZWd@}5a?KzWg_*>wd;{h?veh4cd}TYYmD_t;e40npUJbonFT;ZMfax0K;* zS3#*#Y)uE^xf1o&)=IA&oSHS2ba@6==|=?ozY=xwsXx%vYJ9eO-DPflkiA6 zN-}G@=J(#EW?strhRLJD1a$kb*T9EsUrDPLeA%{HLOR9jW$R)Gc!Y*~87XJAyu!36 zM~o*D_6Y>%^YqKjSR0;t)7wDM)qfNd<|S8?PJs6b9h9o?@3_07ziIBSn^m4M6=m>B z8(Vqt+|SP=uMD-D^3iRpN<)5^aJiB(yaNZq38ar*-p0b~WDO@GgziKD)0fT28ZsON z#(vL_KACs~B?u#Z?>o2dA0hCX)HOTJ)403JE3rYU7dVYLvgZ_2ZH-H<#Ov2(%On?V zMYV!%-^g|62U+#oId9xY@mI}Z3Y~3!9NYB~*0&epBaGoKTtkMj)IF1rnfKt`<)c=a znmt==V&#M!q~6E$Ba7>I5120A4vC(Xgi)KJ& zgIqA@cWvIt!BV$#{!;gz%(-6l``9)ljL(!eY1TPIr&*<7bs+@ztz5VUi5GM|!En@s zUFD4dpB!qPzW#zOCI&&c-@?(Hw$ds-YBKsya)9tD&_Nt(M*pV?$A2iWieo_qPgyQw z?@_UxIYL(I)cIAgdaJE#>H+xMoom!M2|=8y=GH-|yO*>ttSHZ_1#_ZnY(e(p@{0dB zYlir#K9;zh{}>o?b+t)dxCbxX2mRA3)9L$o1>{C$+VdbmS~;vltbyERuIzHgBcgp6}b6p7QaoQhzjgH>d6xC$jmb= zRf(dccb+m4vfq*O5#V)0MpI0k4_}QRM2&H^^sdZ$1+>-?R5Ocd2&6vU#Le$#PCE(*oSG?erz2c&d97`kE4!ffS zvQ$RHZ9%J|x=von0Bxxy=_a;!7%Sctxr)7-aZU940RCtgvu_MLHN1le?N^jV4GpKlLMR{oCy^7n(KocR-a`| zNSC+Cv3u$Iv!k9YO?puESWX2LAsEMQh@P25^R<7aBM;$6yA}c^l5cqOhZpP4=eme5 z#!if|N0YI&%<*4aDar~q)p4$@MdCf_UI}2kRn(Me!Wd(4ltBDhnkq@hYY6$p-4(w~ zvgh~f@;7AG^4lZQBhVn}7iQHg?>#`Jt1q@1tPwOB>q&#TYb7xLkjxVE6w_~X9Di7~ zvlDZuq*m1*A7?J>rV|o#I!R2%ECvF}&W9;-2OF@sT%>lf&@}%B7|&{cvn1EzeUaqF z(8)ggV!pw2oYq!(2!D2YhDl(V32r%$&utN7QEidS_ZcJYn zOfz1_E?c|_RI-)L)XRBTN|Pw*4ywz!20+Yl5Wh2Z2~*%=giqjQwW+5)%rxHou5xrr zYDR{2|ANpV_ljtN!WEBAa#lY@m1R23@5Q1c1y5amFTKu>8=GxV>*`~hUd?y7)?J)Y zDLB}h=*C@yoGUF@kQJ^QNnTFxf6w+UH_%V7*)T$>{#O6lMZ9{nmh;T08WQ7OsG@2f zdJ<2a4-bDe;O#ltPt!ArUKt{@jn{8&oaM*RZoRQr7t(DQm9#yL$*27~7!*@-`pxoL zH*0h>_BQ-$DSy4D`-NvkcRnBkN{0aabaf4C`EQc;J|kpS^3(*;y{x|l{z%yle%JRv$<+C9 z3yCp~U1&5{=`xKzEHgqWIf9S85m!6PE4hJv^7_b~#=EB5hwC=0TE3q=>(bB>bpZcc zvcKK?xY{bt2N*-j`L^f_z$9#ZF=8~z%`qa|e&nogf;HY@5RE|~&Q9A%Ch&j$f%{XA?(n6)A?Z#H8U!8wAK{dBj*es%X@QB?-y z9!7XCb*F)L)FO>JId&ke+A?qLCemz9dY0GVZvB0r>+Rj>;k?)Z18%aPs+5Rl&zh4| zR7TUTy~dkqRvb^y9KT);VXmcn9oYykB3=qu@AEW`M>0zrsF{U7KT+|pw-0-YekeJ zU-4<(OasjhKEJ70riLqGp&^as<4=SVH}^`sDh~de$J!J1A@!_DjY&43PMP5uMh45r zXS*0#usLx!K@VIF0f}F}w&imQN(G4nO8`d8E%Lvm z8zBN2Ta%KTJcM`?Ho5}V>@mmQBeT@^hJIFEU`&~t`o*i+??q=LR-V$psg<+Cp9k*d zU7YM2L3+5ZXuVjT?EZebf$G$%fod(4LD#r4@ifJ3gQ@RCQA+$bLQ9yO(FS&LN0o{^ItPpU6V_wigN>0q=Q-oRd0>~b(~jc*v*GFYb!2J7=tP>R3MK z=e}$!eiXw#s$&oNg}(MLoUbAFeXiT%`7e<9D)0Sqb^6WvF#slK>gS^xxLyjQtP&Ze3% zlWBOQLTpWv?_!ydrXm8zU@Njq5YF*TlwKuqC^c_wU|+cpBR%OxV2e9B;138DsJWRm zWg=yJFh+ViZ)7MlE|7;>ds1%*_V5>c@`h4NBZv^@rPmW@UqC2f9s-D@&xs(eY2vm) zu)#$7o3e?sXU|i*N>OBVg?%O&G;5JSp?Y+YI3Q8pt?txoWOS$r6g}d$1Z{DVhz;w} z?OHF;9NrC`!QIZf-W#0wr|d%Fxj#5@1inEUgV16=Xdo#pZiI+Gr)C984w2|SR*)!* zC@`7+-;gcmiTG5wU!((xUPBuXxJz?YCbYU9m3-ki3*E9c9Fl2l%dOm6QA;^UIB>&u zQsrBkWtlrPw6eQ-y(nl$#eqO$MJK`fW#eYMzo0HK=9Phel_%rRmemEzR@ZahC$wAE z#b!(%RUvKY&a{E$?ZYjS%^mjxi6 z@E?i(l@z;z*mstwymD^fhM#eSog-WoQe0aZ z_9B_laa5IZ!h|;cwatvm4id>7t_thT z8b^{TMx_sjJA5moK+DW{JCvp`HOyLKayx*uP?dP&bZug4f-;oH;*ZL?GU_P8rQk4vK^l3klFZvwkAtq)r?U` z;^%t)Y^6dYrWI2Us`s@4wWg3$%ry)>CJN)nN4v$UO5OEY48`urb-)$}m@>Ee+3-zm zKv|X(IDmA;dTz&rQd&OJpp#=B(S1A)6aoV-2RW}DV+;_URES#5O3g_i%7(@;ZpZrnFJ2klh+D>RQTU}}=b$CmhS4&v*?QJmJxjo8N?J{4ET31K zv7-Z74N^cLw%4s|b+4$~ii5F=iT<_Kd=FiV>d(qvS5DQLPqtRo%SEDwwc~ugMDVFl zGbxdmLh`WiX;#NF&ZfSky|AHW(&dxWq9|TqC0YeLp|KYirnc$b<62L$IU*bV8m;pH z8RXL&n3~90&qhs@Ale;&ny;9|KEUw5SATA>66MFRS!zY3d8zWn?v)%`9GEW}U+-Xm zXQ*o4nwBL1u{9a9;16eBKS^RyM$19!2z|z`wc$cM;_3zSJ=k!e>$nAU(q`3$Kk1%< zo^8fl7VF5T@Kl&8PkxQd8m4Al!KvK!->FHTm3n->x%jXl?_*)S{D1p!*xqK3G3qm? zgWIqZVesz*p}z%ZE%PPWD@bf_^6RGgf}dw$(Z42VT`j#H2=<-lFfa2{)kx|4b^+m5 zmzA*OEs>mL#S(@_a(v(q|+D*Df(^_YOmC zAB*p`gyW|oGSK;*r@+~DtkI%^+JSw|Z61C|x>@L(K0|GEPN?_A+;?m>%^IOyVc6XV zv0S7@g>|)|OH2Dap~8qrIe2qn09_asm_Zw@7qmZNw45457j`a@@V#6QrKW9vp@FeY z>`0$?l6yu>sB&fC#^`7+?&QYPxMpx8Z#?fK=&AM{Z*@@;%axFNyJ$n2d>HStJwYBX zG-%^GC$Q^5F|(z)eywv@LN>-28s(%#l`6EZu5^Vpr%q zZbza%>R4DKn%xRh^jemn^zEnLIif|oD3zxJpV0hz+Am?bQZbojP=7=_5y?~BclvQt z{yV)gy(GGDC;60n;9BOdxx(Sp)Wkkk%P)g;&he^P+ZZpQF4T$KWGr3XyAKSUE9wki z3+59VQ*7+Q*#XC09Q5nz=zE?`6K723Qx?n0PJg(}j&)pwu%)z2NYGFUb4Z2g)ODdK z5^I-GUaQlm);~o>As3t<1W!9OU3SxOvOSF)f_<)AT={lH;ddv*k-$lM8&+HmI2}JIG0vEb-hw^^`XTP;~Sjo^!%% z1@K|8V5Ki4?MB54`$;JtzAUf#$qbP+CtF-*^u(ZgYH@#F%l01I3@ zh>JI-!bhde1Eum%#@LDZ1;56-G|BwfEk~{t1P~WwOd!E?M}|*vO!+iW?UkigX%9^w zI#XK-Go}t+QT;q~R`r<>iiTj3DKxx<|SJK`>pFyb*t?FKiO6ny%qJgs>_%_kk|DP2>08Svu{c`C%{fZ7_hGR0a%pUs+2p=q=$6TR+* zn@@z9%gPzwBwem_)ErGw!d(gG%YcrIHNre;XXDRukr2f1E+ih)^st7_{KnLQ!tO{$ zG0Pm&bJ0I4kdJz_lo_{x7kU(2+c>JlvxUw`7utMlX=W+k0M{`rm>m1!xiPY)gY0CL zp&g$MBb9r|-d!-!+XtB0vwTrpy%ks5P&;;?u+>$i<)XlfdB4`rt)vOvy(^!w@MpN3 zql(}Sl0lW1sGBqmrvHSBm8^f((u$LN_?6+=eDHyXcapl%eQS_xnj}^qHXjLN&F&o~ zk9YeKY-Y6NzT%&pJd;!jq{~=M8kaMzt}YW#ZhT?o&|;!LO3u&6KL9fMJuCF zZIe$JsBN#}AmLj#2G8L)H_kpU;_jWEnn-6)r!D@B>tT#vt+%S#tIN~Rh)cc6;a?^+ z)DN+bnntlrwK1-pvQKP5a}0YuRVH~778EJ671t&@Phtqv3CJ6)8!{{CB9R&p)8wE_SD#%{aN^ zN#YogUaSo#&r90-LEQNg`1!YwnT&58a*%!Ixb8z29WUHb)HK@bYKoQsmOHl@vY(K} zx@L)6QZm}@)j<{WB_w}sXeIyA{?MGFg)N)q8P#Ae?1+cn1-ecUF7Y!)Zg0aQS#9NW zxuxnqHh$ofhPnR^@fU5>#yjNZYkvw^AAPMAnjb=V~G|)XWeE3V!pC~i}Ilpu5ylx=44;Oo@<+86^#!%OJSELtzN%*=&6Gz+# zZf-LZZ_^*2y8DsuhNymTS}eSPv;mQ&095+3kvs=6Rm-8igQ5psH=XRGs^tkv)rCAq z79)Ko=hPci_&LJb^FhL-A;8KkraHF>Fk5UJvFcL{*Ly*_a!%_Y>kR=&vQJlqMO%*j zH2cGuiYCiELhIYzp%ix4& zgl;US36|0iS{bnGK4zz9L`hV!(1(x#eyi+%?SdR&EUQ$vfP}D?3%)^o0)FPRsB6-g z+G-k_Ue~ zX41+mBNGQwDmg`9anXU25z~3^AToNf66T9Kf8HTVLp@_1BbM6JjyIdm4;<@+NTz+W z>L5V_#xu)^GU^@|$)KU=V!Lk+o>K{U2aK4>SWKYwd8ZMTQ-6mobZFa0zS^AhA5bMM zziFw}kMQuQJtJ_Iyd*PIZ=ymq8J7f3BZh`lz8|L~GvQH8YcDroUi>bQM|WdI-PUg- zph1PE%h${Y4B=2*M%Q3XZL%8?Ky=e!xuX`~1*R#42A`~H`DstZyB zss#^xEd-Jvv8}b=x=kSTE-!)6O3{fO6zv4SyZ^{wEeF^+w3hW+2H>L$sv%(ZSG1)) z8=_?AhPEH>IDqR&D{x?!!-=(`+WywBlV>S95gtUkw5h~Wsd@~^BxZxzVMNx5(aO(c zr<41$Kn|coQQ~&yTh3L2gs_G<7ZqH{Da?{md4F@|4B4AKe1ld>?RZNuOQu- zSFbJs0XKOtj;sCL+T-U_*Be1nxqZhN64BYrbqAr}C`Yae7Z5bQwUKmg5V~bMO^!Ocv1+Y1t zWMvUWZjP1EnaFv^)b{dLnzC8s#YXf*9cNlx~Xv~2gPkYjojpNEA#>CUas0?{;R|nxKaP0@p zES~(B*C1~ytn3yt7n%Kd&(j>|)%Pg$Li}La3ATTORbQ`u?$W}M)&=6>bt|PfT$&;G zla|YP>bt>$#8eSayeNfN!RGw-s8VVO;71~#c%wC;&8Cop(eiEU}fjR7gkFt z2V71b16~obKJnI9@CVoT@JUeYq6{M@cIv&wez=hSt>I|Gv@{vmAbCP{>iad+o+0S# zNgl$T=HE)v9A$ut*JK0WCumqG=5(gBP&(bi@{NCEF!?7x`g>meb!E=H3Awt5GUr|r@}QMf_#e_?je?B*tPlN^ z0YT0qun>pSqJ)lszwCa+hR*d2500W(`-I<+3zQr17WhYTLHrEsh5MD z;db`+;KGD>235adzJj$_hBgK0$Tcnt_ktSW1qW-(FG@;S>^PwrZd zT4OgKyTOzj@X7KYx(NvhiC=%gM|JEfhs=4YZ1^Z~ccxP*E?UC&jMv0K`<6Y}6yRhZ z)eYH4SmU!=URXv*Qos2*L`9`8CLG%t)oTgU=BcJvGY+o(8SQ)z2*?f_>HSb$FeDOX z=x^{%U%Nb_Y0A<0PyBi#%g#zIFndrs%ci9-0-;4~KcSwl#(d9UYD&lur$c6##UB~U z9gR;gBz@xv|ESAcxASvgVJR~f{y}KE0LepOy_#BL335`O>6%tuu&$C7?tj+^=V@O9 zQ+X9z-OuLK3&vURwTr%U+w5@9BKqdoQT262aGF|PU#Tf+^9esBctTh+9c_?nEv?)j z_%TeBZBnr}33u;`3l7@p3qdMWMa=zJ)e2r%C3;ZuFwkxn8ID1PSwduA;Mvlg*qw&d_)4cu<5;x)0 z%DspKT+c}n&R+Nfh*J7{8!&TEC#&ctXQiSeKpEXCIT@TN^l2<+!N3j(shB1)lg4X@P^E?uh( zN*39|>EHDEk)ptE&8g_DB`GIgeZSs5T%DHjwJ}W4bsiFZtnLA@mcAu{yP0pOHueJ{ z%)>Mu9)0>+DUtvDSn#5uMh6;&<_Bn#C%4+UTUlt4zudwBx7CF5E^FU+gy>tO<+88k z9+B*?Cn^9E>nQP?HE7eWqYXsb1Dc6Qhl83VBIg+)>OUYYMoKs5nVSBEkR+Rj_V{S_ z7cS-m$23e!8ur2~9)TSQi#}da6?DdWMxvs-^Yz|4dnY}#hinr zwbY=@kLkW}Qt2Z~V|(FPob0HahY>Zn@tNv#U1|^gI)ol{azL$kZIM}T7alb9$Z5#| z&ROT1AcnIl^P9Q#i(uE#4CPuz#%rW}-E%a6FE^i)`2$EyEu$O|7?H95Wvm#ZSXbkx zJjN`HI*K$FnU#tCcrQ|a;sXqcy#Eq*ijeelsUP|XSpT$v(a{gW?rqnsQ(CYOf#?B9 z-tIwc*BLD-shscx?SjSQo&m^B4VWtU(0>TXn~4mS<-5EllNV+rqbwV;TPRUtjrcSI zrhkX3zbr#4g7q4lLj~jhskDS6R>BnZ)`o#q5o_wdu`-3kE1d6K=4yMGxbGg4-NJ9N zKf-sVU8x+VqE=dd-X^#rP6Z3Q{XzpKx?NXhOzd$Cez$Sv;UeSZqYUs-`M+vNO1~PW ze=!kiE5tUfU;C|-)A^xO`C#r{!iA88z^edM%!0^PT5M_e z$A~zen2>*pxVogsftz*{S78h)j6eS9l&QcjFW3WVo^{Ae>T2M)<~sk2zS$FC9iXLT z&t~9h$N->ixbKEpU0k1Hym;55v>U|z9W^y;Eik{rF*wzTm_!F)CzINeuA8ZjYV8>3 zgf^Gsq|}RNbWE+!c`C-tW0vSB95s`WV2VqBu{)YRSu-0rse6XA(`7k7@gdOZQl>~7 zn0}qJ6eEeljI4?<8C2tOe*VuaU`zt(v#YOq>|AO5@slW~mGB8P2Pl8)oh1V*u{%Sb zf*If~%!Rp~2Jo?yIgdMCY~bojeH5K?>W^@tIK7-ED_m#q_GN|M+BKae25(NBAa(Gl z$C}sPqoVmJ%ro2pac>t&2ubj|nur$a+adccnvojpSRC% zPO<~WY^-Qq4Cd&|nPF6L$klN9I6UJ8q9cX5xWCrr(!{mKN7r6ZW`c;U(Cc!Ucw7Foj z+M1aX;ZMyxy|qKvvdO-z@kjM5xtu5Z!I%59$Cu@gG|-I!tk@ z&74a8d*$_&^EdSI=W54NUCWAFsX6LV5#&tt0kc!@cimWKxyDK6l~dTWuY1mDt`veo z0UjQ62fr3hB0_jGd3&SGG<{(Hz$5c2>Kwr8Va!#p9g==O=I5@RupPLJNf$F0d#wsF zvu;!?_=ryr%4vr6BJ~7z8KW3t&nH%D+}4(lvbk8Dd`{^A1aY`E71RbnFFgf)pnzL#@P#q(yt)pXGc4X@klfL*%^pSTr<=Hk!r9OwE!~ zaHUw}P!U%x@h*cO;FxnR^ZSOfUMz z(mrhq$<8g?&+bS7Rm|0y`QfIe=5fu3=`MTue{z1MB?H$Mv@%tpElxFy*{80?G@giQ zyD3ReNM5#0Xk!n^fJ3Qtt(DF&|Pe(Y`$H)n~SInqUUDz7JON3FcxlBi&9`1JCC4JRQH0>DfR zzb|TIUJu*Y!HkA~xL%5r0Rc~H@t)KNw3ub^S0vlSD9Z9#n=|Hj-IIEZU&7YTKXFSJ zowEUL^%dkli{mtTeW^3;_C(9b@(y;VkG<4=wjkx2`H(9?9h`|>Iy}H5)7?hME87G} zYbu74Kk3Fv`$vf#7Bj8}v{v-)fd|^0;llk^7AyUGRnPH^m&~Fi(VHtM*RU^+S)BTz z5YxHU-wR6NFV5^xstS5bt-`|a2vvAcNYvYw6G|t!A%FaUHc_4x`_LXaQ~X4vjZvZ9 z!$(V$q$yp!eZph*NRXY<+cRSIANIijY)-Xl^$Qq zT_a_OF#p&`I9HT8uA76R1)L{oBZi_>ep52Hf$G|jjSh-5q*A(Wq{x; zK$nGW?LaXAnFvq22^TILE4o&-(sk_Np8rVL%0)IU#VO<%+n%(~!3!UnQP#98EkAZ3 z6qz|>PT8Xy$(dQ4k_J@TJJfU91Kw7i)k@o2P_;q_qaf6bC8A>l%>C=Um@MfSkjQ_^fZY`IM(~oT&N1F9WyGJS=^ARa1c{W*D zHb=3GL0k_U_}ka@w(4uzVbn^-;@cDpy}I>_W?*rJ#Y1=3AofN@{Y&_jO@4SR>(4lY zN&P5r+WWj>ZXQ>Vxs=>E@NepJ^1Y=+)WsA~l1c4yvdeg>U^FqVm)o59Y~0%3H{{b) zK}rX+ts-c zH@=aiQ@SNCY@NNJN5CP(J)V{}7EfhXoF2ppJyeQd*%z&R_@sQoMxS%{PO?c0?u=$V z$6GF%WoAD>`n|UjS9+=Atm^O~!oy2lJgS_n-QV|_#~@3bPt46s@LHYu7oM}G^*+U7(1Mc?vPuCPCcz1lFppxkK*NtV?QcAU2_`N zxALQ>0`K=gvN4EjY8lW)wEvx;QjoPmZwL`YloJil>h&|7ysiF|QtG4*`XGqJN=CIh5#DT|0DmrK6Csi14-A zv-}GN!8chCobt!8Jw_*YX$TAS>$&nOmRt1UMN+$qU`i_~2&%fLr8q$d(iZ5{ZvOb8 zI>{+bh*Y25P^2Q6s`pE#VQTDx8u$AHV7eXJwa9@*IX zSch*VL*9P#O!1xpAB4GUWvW-?W67SXPM%K!7MZzf@nB1UcidrHldAdC$}bDlst2e! zsegP^pZUPWZMJrg_tn{NjQ7!P7Tp<}{Px*xs`a+B%wXeU0(|Df7_)HKpa4I+xcTP+ z6q2{1xpbhk07x1dxMtqhGnqtoSjsx2DQlL@?YCQmHv49BdSHMyEdZt+>f^z6AzZjJ zcl&#*YK53FT3)GsDTA5mW{qOdrTgAn$wl4E{}kc2qBuJ&1y&&>QhhmCQzbv0P97)9 z2hj1Cm;To`JLO(|Mff@u7m2{B-NE0Ll11I&_2En_TpZO*?u3_ZpY;o}IsW4uX(!i5 zvut|Ewt6HiYuQGl)vG+D{~qI^Ss7J?6uYE_-aje}v_@in;`h~p3`N7?@GU4o>F zM;d-7Px*W|cV!y9Yn$KOFIK8gtS~5RN$YmG0)wEVjar&y-j%egkuR@kK2xV9^zA7# z>gP^hD>ad?Xxv~Sv5B`PGC_3kTwv!Z`i-p}7XQKdWl*`xNAW5|>q~zNqMHe;Wjw;$ zI;nAhFV?eA(yX@Toc2ws{HwGtj#Ov_Ft#J@hFMdDo?3+?CWrebHe) zlp-NBaibNr6lej{TeORg7<|84B#~U?FE}R?{$PmAQOJAc?nLz0#(xw*b)tX5h3WTM+6?D@ z$li}>7nOa#VsDDuS9{mfuNlKi-94;@DcFbvTW9C6_R>R{F(Rry+1Zw|$bM%Ewa`>j zfoO+Zmf7!`mbTJND@wZ;`I#w7@;T?ChIratECuFj2`0`75av3Lq($=fj3 z+_k@C3``eKMG%)(288CSzV{#veviYb0ej^UP-`UsWXIhrA&NI}-IJrEzbvhsu->?P zH0+BhL-K%bP@}Ewz+XJu<&*GWh>u5B$HFCynzDYFmHg2u{z%s@&ENb*W?Yr4l>@;R zhYc#5^|G5Hjj2uf%Y^uZ-1-|Pynq@;h8JWY+e_-!h)il>l?A@{Qk4-)9Wxyt%H}wX z*x70cfV>FpcA($h}5LlZTchuAALWqHx)PgUXJ#FQso-~P`ugl6`V`mpSh+6qPS|NPP|JtxG^>6-GgI2S>@(yM^I(k4k-38M` zPW9rvCufV;c{vo(W?PoSQoE5{^eh(PwS&8z<;WcB;6YfDw_M@aa};JRgnug+hj0NT z63xX0V_WRG+8U}CW4;KxYYQty=I~I_Z3}+1n$f{qD{3mFbI#*tSTu!BC*ZjOuYi={ z`fee!<;59($V=@7UHxc0Vj<31-@S72>Q%EA7fPZzN|js>U3j9=Da70rxin*fM|{;p z#y40zBUQ_J4YB9)w6#B4Usc$UuDX+VVBz#3?A*tl zd*7gR|4%}qCsO?8&SbM&@gUt%;uk&egtnJQXLd$#nu-%8bs zsR;jpPud!{g)8Q;_+6A5D)PwE$~CjdfzSGNxZ8R$mx`X6{Wa6_@=W1+S5VI6uJQsJ z^P1NSNBb^lXCVPcnOeEYm?G$)-r~K6Qe1)p`MkqD%h#$KuMUNk$pvEuTugXl40ezT zbFGQOb%P35wRJQ(r7Uy$3$wYpNIO*Qhx4!6CVE)3d5;~)sZp=EhP?L;MXCOD73T=> z_%iz#Ef0uaeQ@ME(wZ-}w~gQ`2%PGctuEdtF0j@8Jm4a8Y&b`ble3z1+AxpgI7l|I zp0kv}00qiS8_$sf3!jlkfy${2B15q&sG4uEvYc$Um4}`LoPtUUl$=9@HM1`Q>{W$v z4aqhFt3KH<5Qp~SbnGvkjU00r$=@fAs}?S6Ebw7{Y%Js{O&}<0)1-GtE{qvOaURJb z(QP-8`uG%kd+}FS7^6}{utL!{4xyZmK`}*j4Xmx%SiyL^Z-w9! zZ$H{2f|Iz2@7&E#Axyb*jHE~Ul*`?Ou$1NX?wn5lYiMAFZ-bTaudJ_$zo9ry*a6nI zGF+@cx;siR;wBF{vc7UHqk&@*$BY}$Cep(|$=Pyk7TnFRjAAuIDNlK&)7yqiBi}>e z$1npI&2!gUrEu$TLDC}h4RkIsCfjbjXFkE6^+OmHif+Z<9q=N8Mbh%v*>ddiuIhZ1 z5!X;0|I8T|8n8pT=}hx@0C{#h7=_3-Y71vH;(fac@2_z{l{}-XGxy8v+9-j+N&;9aTsHzZx9qc+iyuwdHd3@yQ>fq zlUbh}7T~v7Zp- z|2v(5Km3(+hjOUvg$G}F5pFH-)M6D0?H;vRXiIehDOc*^#4%yo?%U`UAOR7RJNNYvZWUlHCqu7 z=`EqV(QEO91IDbfhLEBy>m!kkC16pXWV4zF+V2 zUH89`TqLW^dyX;380)YrwI-=uD@xfu;0-Zt#wy3(nrH@ZktZHrfVaf>yr;;-kk@8T zNj#CzVsDLwu<9{13hOVJeGkMRLJt-WlbE> z&^)UyShQ1HSOa`3_5R+5a46RXdUkD>8XC-Q9hm~yMeV{c<4lQKSQ&NqFW4<)hsV|I z!{LU_!djZ7Z^VZ;A-&x!*iG8aGU8^T5wc`^)u1YyM5e%{1$=hX1^+wCf04h;l0R1UQ5lr*kqsesqQu!&`P;Kf{>RcSItqe=ga((Ll`vz_q5-xE~Fp>9A2sEx5*9#U0|lYwce3 zZck1yU(FJqN~_u13d_4z-9B}6fV*}Lw^^k7uXOA=U}mjR1xf=yQf!vR3fP;_$Zetbe$~79H>TP)6`B3}x=|WP*Q_rgew@<$% z32xc*7{)v@98Im`VYK=#vo0Q5+oI*F4*gg&vpLDzzjfWaY&I!Kmjy7HD|kE1In8`V zZ!9$@F#z5oDo={?b=}Boo-e~C$3@ZNJa-lKh^AFFP63CWGG33;A7qI84h1&V|CTkb zRN8(-?jDx^oMYK#I=8%9b_7ufc#62t71VXz>W^x0)n5CmTuw>0e%V7#)TV={ZeoP^ zslK>GB^UQxLkby?*mR1M|EwE(5>_H%>9K3X>0ZvRzH$SGLR3Wel)$(P|7JWo{44|l z1uJb*V1*s^_(F{WT5n@hDwdiUXYYgFTa;Sc2b7q`Sm#z=R_I|bu1#~#zef*w5D!cx z7F=JZvhGhy(Sxn18>zmV;s^Nrg)0m7O%GMntsC}m&|ADLdt@|TOMd>a8oYwoza|S? z?Y8izeD1E;^T=yhQVfauaXj2Wo!j*c=o(g2U;q|)+l5`r8^1N!wjXEM&@(V!`~W9q zWWX;R6&Hk2bhtu$u-%UX@qJ)w>+k69SI_@Rz}xZj{4$vdlFz=sPkM{;YNzUPivl8= zZ@l)s1RpJyi={La`PP1wDlO|)+CQ5v56CLC6uu+@`fToznMhPWT9xH7c6dgDB*VDa zJ7l$Q{v3w(_J@eJiM*xVPtQ39c_?TLU_<~AeO?7SS61DAG zqUJc5l0UGZE#q9)rsyh-TcB$WK{KZ9C^rJ=YnLrP>w09~?7eDZM*Du4D&WbSGuG)% z0hB>`d3}k=SccNIXpO`7drLGq1u(WbI%w2F5LZy?u#wzTWDv zu*3V>LQk!=V25!fpTShxemOgrmbi1+Gg%nY6VT3caQnX6^2N}v;F|_ULlMMwrPUa-8xm5gSD$RA{C?*cB+n)bmzUvB$-#t{~Vgl2z6@#y27)+vA; zhDGP^N#5x)JLZMehGhm^f%#s1B{dHGvpKzKpZ8JYAgJ6Hpq7WOFR#zgG=Zv@P0+Nd zaQ@W)(GOx~lOeo0+4~c3N)9huy#z6TvX|^E4gRhLIMXT{#|*)$Q{q)vhYaE0_G;C{ z3*#D0<;}5(qAS^D5~J{M=*wgddoYrI_?%9S+q`XE-&sgY4-&_@U2rPL3oKsElyPw) zoqRaimwsQLvZ$-^*KD$R8Ltz(Ngq5p``Ng%EAZLEQ%Dq&9_Mp(tl0N~sx47dThRKL zu(e{-Ba|v$OU`*}Oq7x<9T`zieA(6lIe74Q{a7eOKjRgZ)8qODNzbh{YPx7senZzL zrMR431Rjh5vIsOKi9T$Yw7{Z+zhU$9{$JwiRa1R%G1Cy7JlU z_?5;Y1Cr4d$Nmpj%a}q0>u*btFQBrm^anGr*}jQsGXfNE+^@fy?DvIc$hjr84^F|* zMt%Om0BI}6p|r03B$_n`%*l6EKpw@Iy=+Y`S(~!Zi&_g2+?l0VTwV~h*O*jR)aa7m zFkKcgmLmcXxv8xp;5==bCe?t#ysBaM{zy^JkR&=UcCl`JRg;@$&1w=4HTSE%9f`P9 zd!}@?;LanQ_S-{K=-QBG8UIW@XzK=kZHCXOT*B(@+g5-0dBB}gcaTwTmF^iem^D(n z6K3Ct)oL~?&O?**v=;6-X~}u$E?nuC`8*9+oLP#-NBb4{HmJsaTMuGj2%3ucE zexU`gN-juuhK{Ooq=Gh91!Py6A8WbP;sTX5C}Dv3BZ8%|4K{9Ep5|4Bo8~lzC}VN* zdow8OH(b>_CfbF}6iCZVgGS#`gN@} zPrRllCTVS2k#LaAsd$up!JDb<^99ndR@N@A`o*3bthh5K3~HY^Aad3d`BOfrAzCT@ zRmH?8O2@5WdWzfl`wbbbcl3q8l-rBqsVdICE5#sta};by3x1{!IFlk-|!2bbR4W| zJvef|tQ%WLGp(>ET8DioK3s}}$|?I2Sw=pjeS>0q|L$ue)hnio%^Ir)dx z+=UKRj}=mCmXXf%>c20K32OiQ_6*H2J3XGp4t1anxd~_F_);4s+>Gz zT8rZfj7tqJ0wd|1XEV$5@?i8U<@H%ESA?jc{PJmq80X_s)>}ma#En7{my;qVuRd_h1&<8iEA{eSUxonA*tK2Lywogm4=D~TB zdF^um>yq<%<0Ey#?lKSQhe zg*!wAXl(Md)lg zQnMvzgUM-6_XhPox`c0evaW1e2C|tSn6LWnYXCCBUoGyuidq|)(DGe)^JdCtcnYI> z1CR(<_jD)iP54Z@C=%6J4Lw)RD6i!lrK&(w#@hssXOcS<&$ zey&e2lXT6k+lTqlNzYdbOW-I)FC@Q*j1rWb19QQb=2W5hoL6_hHq>nz02-zshQKNQ z5L(YmQ(IhXL+NT#n%rBfa8G*KrqwZQT`$c=tcrdPr22Zrz#b+KbAQ{0C|hgmP?CY& zf`7%2JXg+4WG7jKhsd6(t|-kT!QQXN@u*t&KDfz0_=_b_ zPF{hv-8df2zZAi}MFD(}boo-=4eA|pU#}cihp0Y=5gELRLbWh>;9affaDzD;%i@vn zkUq)iDu;P{9=U&mGUSLR9uFlwynKKj)^$1H+BIc3Ad;S^IB~rMLsnB&XWz%%>Q83O zs~e^YpR&>)vH6X%=TaJKxg^6sX-a-X%MkRDspy~Q^3UMqW-tp|<9!%kjTs-<8vtIN zHMjp|N*!P`EmmuR9xAYJ0za-i?&sS=5+X2f@o-+D8609qCl9k5J4Bv{?_HShN>zc= zg58k;G(ztbj@YMu4A1KjadrDQVQ2QT6YIh1ATEa7CrV5g9a}%EIpzcqiK+*uV1(Fm zYR1zQT-ihxnn#PT^@8(nrk?D*blOP(Q+fdH;LjHXMxscS+s+k2+J~HuR28EAzljS) zA$5S=r@ciy@9y*^rLqPPU?P?6&)M|WS`FIVV$S>`;vdhbGuO;(sW|GI{W>pgwed0y z0rFcQw4`c=Wv<~`FVSYI+QrGOzPYRo7Qf=}$GEfG@N02QQiNk9!upZFW!STzZBTWa|t@U>xjc+J)In0&&Ck zE5OdV+Kea6bMmfQ8bka&f?y>c6{fuf2h?7{Ue^5zD_vD?K7Thy&^JLD`zHzrOxmnv z!_RU@k^nG^OI1JX{z=Wpju!8rg&+4}yus%%zSgU&dk`CB-O~g0UuV>>%)n^(XOsn* zj`9%;qkbNWgtW6J^~4goccLGQtK=sN1S3XyE^d160_b4o9nX3yitZmZ=RBN9!vQ&Q z{gW&hsSk`A{|!iBd(&djLw+4&S-e|P4e&%iT9_yGJsN=W1h2ieKq!x-{S}zcohO`5 zE3C6}48Xmy)K^Imf5*_@ze!L9dMv;YZ~r4i&VC-<|F3T7+K$-67#??c7!}~y&$O7{ zYHATENyY@cBrsOEw>^Fxxiri~?1}BaiRtyc=HLAlHC3>_!4%)Ydz`6;->RPGL*#BZ zLsbDSmPd30pf1bq-`7h|8#K(IrmHY6woex|HJNV?sOKfLQ(27!Xb(qehfm z=%HaXa{P8z8YW_W64H0h`S`RJ$`#X&a<}EL2jf(>Owp_#ID!4b-#HvNvjetFYv-#~J0-_Y#5Y-R-2#2vFBqMLts zX#=FkV|UDCWoV-)&)zaT;x$&VVLAnHmMjPx+fSQ%SSA&Eip%Xg6)u1tRyA)tkJIJG zmv%I`I}ffmCG8JjjBk=Px_+ksSy+2x%Ml41;eoU`FGmn;e{_u0Q*R7S|FU`8$YmpR zLF2HstHC=aq_)*fza&HL>VjS2B$>A#z84m^TNxLDa%lBmum#w$Q5FJK>BBcAzHvJ^ zN@duzsx~k8@R5unDA==HX`{TPy`)_ofO4l`^!Qd?b)QEr^QALY-eV(^y{{!>nCVHL z+pOJIgnXz(+mw)M$T)9pvQiRB}(lBzA$xR)ieeuaI4 zD4`Bom?rS4p;Rcr(z$Jbwrv-)EtI7^XKm;L9kb5SNI|R0t@fF>N1DaJZmyI%Yiv@^ z+wjm@`6bJ$M!N?0BJISO7kqo}ViPgj8SJ7q;|F!|z`as0Wo`$|RoI4}&)MVwV%cm;6t zQPQL5F<|G&!NzKs{WnzWc?i)Ixwbl}l!%&-+%AoJHZ`Yb=^k9OM`>FcebbvEe#Q&y z%VTCaVwHedxGU)<)<9#8r~epxV?3F+;BcHVQrDoX%W75CG~e$URqssi@zK#6Gd5?0 zZj8)stgCpd9y`{OCc{K^f;}MtcT|23`To3K#V=LCmJs*X`7Q@eUyB7G^IYW{Ryzf zI#KU}7ia({EXeqk$m0&&CBkn^L(sQs7Xy19} zblezXrOhbq5{%sYDjS%Yq*l}i_*k&|EPa77RCBq2nR`yjst6|mMV4q2d2&Ca!iNRS zR@wXsX15xkX1)f{bU`yF>I$s1wf-`U*|NXkxrB?EPxtM8(I7&paxMmR{}aDb)%vf2 zO~Fpf2-cO&k$58q3q|9sRdHur#Wq0?|3oA_nN+H+Iz*JrvfVgpKp~qf?)j+L?SD;Y86zo2f6xz&gg4T^07~|k1h#%yWOA>PEDyYB1MhzeND)C7H5?Kj4}oOm zM%=6btZaCm-E8ooCv;%;GX8SA%wR)cud>g1Cr_e>8`g9GQu<)?>yWwR%>gLGLii=<~GvC6eSlPRt3%(Sh`6y(=i zh1I9%f#FPrn8Dre4CnqO8gL z0}u`824br}AFRI{J|RKg^-%Vl$MGFxG1EOu;bY7`q_e~ZQ!IZ;Jy5yE&0iUYr^08y z`4Xn3<>p3SOPcvc1cI%Jy}%#(`{BI(wxSYKH3wTufNub0Z9|*E9E|y@1J>^K_e3;( zMI(*UV*aUi3{C*N81TYOfvKa`pJSU(bI#@DSf7WqD)GSF5HDNLZBRfwa*+`(Jcq4? zAbl4=2mHg@|0GNW@zCcP+^66m>1NSwR_}OF+TV27(TfxD0#=>RH|tu z;4k;F#hbbzJ9(i%P)_zSkX##>29TeuCQg^RG~UaHId%a(t_30>!B`r_}k2!*$Z%ll2i7>|%Tm|R|>cgW3bj9`p zFd-)6q1#;@z>HTttDTx&Gb@A=c@SEDr&&lJt{>a4cC-q_ok zXa7_q8!U?ZGM*77EU~<-s}xclqIUnS$Au|V=X~h2R;fUbFg;$px^`sijYRFTJr<7F z6+^19ee7q;PD_Cocs90|2MgY7^m@f|y8RGKM(#%y@TKxx@p=Vh1ecLM`;NTP^91Rv z`fR)@t@y%cPH3Lm1z3^C>sMHMM}SxkTgrabhs@oZw^FYVT})H-3_D!LmHbMTr`D>- z`UBz)6|EM)@eUrI{V}4NtZV5-q^-nJ|&G zgc0ey2I<(4iG%sYbn2J2o~Gcq7qoiy@~$FQ+_ zkH%z2t%KDK)P#+Md#mN!{iwXYiPZ5lqOT^q`=(p2*IpP@OhsdUuyq0>e;ZwW$gKXF z+L?-g&wP13zEZeVHAqQFOLc!U&#t*27kEhi3An>WN#tonhOw_-`@gEDR$v4SfWd!5 z9WBCL?wY?t6f;IYlG<7c2eQPtqTf#DHpv-D!LCR#xDmv7v(&!jQH8&oz$&^@4 zc0U8dn@~ehJtA*?C2ZO_Wr&Nky)i@n^%ECO!S&cAuqjb>j3nYbUkOZfHQ7<28qu@T3l+XS+q|^i*HX-1 zgPPZ%Z=I)Oy-L>2%xfF~C>kwHEZK%Im`Lj^`S#k4KIP3fEvYKV@|;?X@Y_~3RxV5* z>0W3yiSc4)%0CQPt6~BH8TatBTrxnMGMCbHGi@z0nR2L^seZp?tv+Getqm`}X}v7p zuldCjGj38Jf*IcevBOmZ)jp|t%vW?Ym=8?aGlJ)`^v(IC?@z;Mn|}1z#{}_K{Kg81oG)wLWP2E-Fk{mciFRqKD1_0CRyr)8LW&L~BOE z#wK<9kL_ueHX1$odnELF#!~W9t$foh^Wgjww&%`$-q#Dc`|RwiTgx1g!I)Eu&#cK2 z0gn`*-`mZ^`A{~WK7&#MzIQ(O`^4!}lxqU9LNX_BPt&;Nd$Bq7=tI>};_|4yzu{p) zzLlY|7cBws!ddziRsFWy_h4GuAM1Z;m8#|Q)@>X;N@D~QQ?$9ohSmZ;Qy0x4uh z7>J2~QaZ>qyKb@D_|*_=5aMwH=HPyYT}#?PJTz_m)(*X8Sbfb{T(c!rE&f4BYxiXl z8Q)5dkbkP(nmbNAJz7pu%2q1${u>c|ax`=?;en;YtWD`xQFwml&jjO?&M^JhFbRC7 zXSl(c9MMM*8bz{Xxrp-{kCxg}{%|}9(UMaX8>?~jhv?+&_Xx&_6xYB{4LgQm$YQAY z5B;4yf+4>e^`5V(hhd0`hXL%}-5BmGUo(FCOcsfL%DDMWqh?WBDL>zf_JvWU=|-ooV#97=lnt9+cBNm9X_%>jQpsIV!sEw+Jy7WLb&zi69g? z&Q;hFwrwR5_T~j_Z$}6TAk;Iv_Kkeb5xI+EPiY85Rz&20pqJx<;OsLYzig_9E zVe47<^2_nF*wKY^@)l73JdF2AmqL#!3$Tr{l0&ZHd$!E3ooFDXGPyfOW8=-L-nFFe znNWfw(REaPO+*ApVIPVZQLl~>82!+M2jZ?ILDm<4LOB{{5-Xpt(PrMzsV5K?hl@M^;szh={p0AR1G7a!(2f?iABOXM-sP`l z88A#Zvh3gKS*9_A*j>jOB3%-6L9+tCv|_LVnLY&`qX8GWl)fwP~4S$-g}|77Z-?E8@mxRJa_f5V5Pcj3PIHxHUS z2o7<@m5u>L25`nu?1T1u&6gX}?`-^IC32oESAA!o`#1hRUua=`3*>7}c1xUK38V8p z4{GRoj10Z1_%X=hQuzSLqUUGA(o3ph*9A<_xU+pxEp!)GH}VGoYWKy%;|%7 z;SM8l@4B_E=2D8^HOHNRT3&o-{dC2mIc-Nv?LL~G_D$t=+`vQ2<-6+A1vQTaG!Q#Q zi&4tuZ3em2Zl&)&l%Ey`NARs^S3_AwzGYs{(2s^OA-@OcR>PQqPqMd321ZL+R_}7( zDT=`drOGdBxp!;FxEcu;FF&IOBXwx7fShppxs1e-iDOMZBmpFr zd;23Fmfo*c{wIUVyW*@C)R<2i0@hl}UH9M!l_s(L@5=HsDkF8ri!4A}e{gLOuPiVi;N}y=+OQ7zKDT$Mq1t?5FT7$j@iu zA+kuyCs{dUk-Q@{vspGB@gPHrvdH4C2Ak5I!qMKBQyHq{I zrZej9|=ua*w(1$3Yfl!F@$e;8x zYU&&d68$Z9=gDD_i>DKnZ^oMRm~P}-+>VVGnLdF8E{MexBqc=F7rs<^sa#Uo;~prO zBfat*TybWgfKLa0&8|(i|Kp9AC+Ezg63X;OA#k87C-4*xbwP~u=EAV?u!peQorN9- z##>YQ1j-Ne2s>T@Ytxc2Hp4m|f1%?LSWs4O!sJG)Y&qCR@liJ?QzP%_u_xA15;&Si z1&`j2`8m~Bwfp=mSbBrwwKfo@AaXKe#Qla}9N#2->mdwTAVB=S?Rpt9 z9)YL`!6v9ET?pJtf7e~zL&%f$0-?bLJBt;(*o_=6!#9(HyCPzsL3y>SRx9s0a_zGa z74T81wTtqI0-mS?jk)^RA|@=MEQ8Rl{OB+N_LD*>k6IR+>3ZCF-!;m>Xhkc5;1Dz( z+Rzzm#4qG$0&{sJGMrrr)sX&e^wg#7qw2oR#b3Qb ze3}JV@jL&5(#a-IS9Dd)-*M=3CT^r3g|HcNo7>)p!Y}Q9)o?*T5*Kv@J~yZ!f|Yg$ z!V-$?V0M%zC;b1)Odsko_RHdMNeGnLSrnS2j0){`1K0PUSN&G>w4 zWU7YOj|>Vlgs^h4Dpb)_|l6<1`%SUQN_B6Q)BH+_Nv}-byaJzOZ%s% zA)Y%*A!Ed9xciRni*!=wqtzI@IxcVIgsZ?&7f_Ybm6ra>r;{h__>NNa-Nx#2rJO^r4xz4FFyQBQF^*0NZ0JC z|1*wdg~bj0mz?5Hov_?zv?ooAToSo1f4SykG#)*Hect;a72WGZGeJN)My_(pFvf<} zy?!Gua|F0ZY2>Qmf4SU;F%}_s??ti0kqQTFmBF|xwo9P$>Y9$3uv4YgTH|*6*}Y;G z>i4(t1QfputUPLCO%SvdwQd0$ds)_T(@%u;*6_E&)(NVYcxDh=g8f(QU=z&Fl1vOI zctwpnBPy)+Ld4!oh;Z$(MT#Bsxf$woD<{^$D{TNo>>^f?eT4k7Yy8Z!8jeV(7U|Wgs zX|2>JA-Sv}VZ&lgvxLwNo%d*u!<8$&S8Jr?RF88ZhONdOu@jQslabhkQ4xz}lTTQm z=P;Y_qp3Wf)m)1Uk?h|@Kdrx*yYh~l&#IJ0Uh=7Inn3At5M4+CraLr#S65PmG_okD z-n7Zgu4*;ka_EEtMgN1$7G5-}a6l+vP(+4G(lHx2ov*(rr3J2uRM&8GXi|7+W*2g1 z=I@fXm(E?~zg+m|CFSs(;hd=7vwxAoE*X4{zLb;QBC8LXy#x_|!ey*3xt%E~$r!l* zX7c?*HM=g55&x`cV}6jcnXfMg6ifM{%bo5+fV0cgEq>>a!R?TB`!!k9x_H%vG!7n7 z6*mG7wa;DUrq7WVpyItcp5G9hDB%Q;Q$1NXD+TTTeIu0|*I`UOrPZdlnFsqwLr5t1 zntD%j`^6>iMH_1|9o?#8p5u%rZXP^zt171Fd481WIE(yw*1|0TBJ{H0Ex*5Hjj8d@ zh;lQ`l(uL|J*}LT;ck&zIp`RkI^T7Y5Bb}#?WTMO^sU(%|8#4#wBL{#c70FJk|J8- zznVCkUl<=^Z>kglQqjodk=Zq2+%wpX9$s5i$=inH6e|}LZY|tQEsQTdC~27F@aBiQ zbxR$_2N;R-B+-l1^#`DK&8OcaG+#%LRE!-s*@F689Kl|CbPJkbcH6N3BZ-U2<3)Bp zA=ss{ZOh~7b0T4EOO1JJ&t)tN-i9agSW)m~;vd9c3slp+o2D>E3fIG_2Tb>Az`Zv4 zZK%*tsjVjj_KXQGo+}>obE;6BRR8W1hpi{DW&(fEvgdrI4<5GrU|4(1Vx~zYwoBJa zZ!EJczo=LDWd4)gr5&9agUPDJ{06$d+kF?u!{WLh(Iz!UG_3TrI}OVs4F6hVO?&q9 ztT$}pkFmS+sXUmiSP2COq=Yj`R~nfgRDx*=5T%ar2yw^{P#ayn_SyG!T9w{t8Nx=%7F5rf7;(&`%JK^@if zE$^QFjYJFYiNliG`ILzDx|L$~s%GT3Hf@oCmRLzh`}^kEl8vOLV=s<(|La=S;h?nL z*`I95ZG7nzC+{PO z&wI-RO~JhvAamizx8GeLK6==pX1;UJ7#0S#>jAw8$bCn7aTIJh>X}juZ-~54TP#Li zI@bnNn6sB+cw2Ph_ik&~Bt40n4c~TUYzKur%frOslE6k7PmI8hbalHX!}K zFSj!$7xmrrzPResn%8I?GBr(!ms0%b<3+&4vBw^_^-~r_rjuHLUmwJ;((JjZ&Q02R zYBu<17YJ`>;jddWJGa^TVuR654lw*$mrvufunil`ii?I;T{Yeqx`0O72A6cdxYl$! z2B!Pj3~zS6{K33}lct=b8)v1sOSg3?rOn_d1^po4h9#nml*wQGR?G05_&9-JK6r+H z+GRFlE?7Co=iY_!;hB^F`?4=Sz1(K(C}6XDHnpFAr~XdQS^vA9@2v)92EnB$Y4TTo zSLd-==QMxj6Nor|%ittR;Yq9}&#Lk#+Y~(_1g9b!R0)Ia%-d z#RAovO2a+2{8u8nnq^Fb!_(<1ZAE&qR_rR6UY+tOp(s#7{ z2TUP9J1|CKi}A6%yJ4jGtM_9b%VNJC7*)E@Hd$PGT6`m;U2i3HW9TAvi0=3e>H4E( z&=9`(9I73qVf|Sxfn$-+)MLBbUyO6H6FOu4S;f)gq;I^{)Gv9N#sh|gGjYp*q)ou; zpmcs!ym7&W?!CzW->f9li&mlZv+)tY<~TIJgUb!#m~Vk-aGc@YRPJH#+Dox6%o zv}S~ZgwmsH}N;X{{GLXk=Eyo!b_f4@BQPfhTi}l6$Kugl`49NEHXelQqkFxk~_l2XgAv|9w?dqWV2cJ zN`{)Bz@>MSO*afogwrb-^no1VI`790f|M5sh&Pp#+pZoVA)_&Lv9hB3xxb07`3#|3 zW7(foPYhb)11;<%e|$CYU!H=OJtvW&$gm^*SDpy;FgOdDyDKa)u_!V2iz-dmV+6Hh zOb&B^?)pdJ-V5z>RzP+gckiq-r^K;yTG}9+)oE(xvy#uqt-BJt!|$j(5-HN!;H%|^ zcWYHMf*t=fkJn=xy1T5){*TQmcQOvQ_i?3K|onzE|aNBHA_WrgipEF zuPwJ9SMekFK0$Be`o4;y5|F9LA0IuAblqGznwxt%awfh=c6J1)7jOm~WNyq@bBc2h zTtAnF9I}0ZHOR)Fs$Bd6ksm$ls$Kd|2j&dhUu_qk$^6w4BE!|eMo9=_=bkMh$YxALWpd{osbUVK?AN3D*d*&zN`2(9gu~1UZOeM&f#r!u{(|p+< z=*z^*5;pY?ew9CEosh=WPf>BB&-$Q30Zz!TC+0 zsbRQ|QlPQh8JE$`dHlD;u4hMt2NII$*hase_15J@o0QFafD6-k$WbIHhBz_%fvvfS zqJIzry`^%}LDEOl-!8Kyb*~HYa=)M;(bAU`)G_%=V?M@Y?;q6vkMq!p89(|uJ0MEz zSjX+VqF?&Iukj8D-`F?(XDcZ()lj|Pli~8#WdidQ%V-HZ|RkS`R zf;SEdA@_kE$F~^oX2KSEpBt~8Qy5fN69Y-Cm^l%*{Re>Rgj^gmgNebAIi(%{P0^h> zxoJAP6GbC2dStamz@CiRb{}I7cC#dZvt;xa;uozrn1cWK&Vz!I5&P#iEVkW)aeGgk z;X5gzyd!fJ*LTQqTzcS+%l#k`>~}Nms5`XyyFb>Kk@9B)TXA|sHIQT-A%t?OgTp*)Fb`J=%d+c}=L&$o~C{PpZM zQmZLRJZR*iK`{9Bi#vDO-o*;|Q|~Rqy5wYoBdiR??_2H|mr9j8t5FRmGLzM#2j}06 zKm4WOUvxw8t#pduy|g>{n=LIRr(@B+rXZvn@VK3Q7EP%lYVX@(*nZr1g%e(P5ecB?x{=?Hjr~YBjI0TVC4C!Jju8 z2II0mCw6a=5+t=`cQ%X9{~Px~Gvw>-n%QBU*g&Yr zaPSXmzcbs$f%n|ht5s!OD(`=H9H&oq$d0bhIll!%a2?vx^k?lQH~LEQZ~E)o{kloK zX1@4yki=D_k?e-dU|eK;;fX5mhDP5$r(sU%fQn93Wehyfx}D!J!qs>^7f;kX>+mE# zm+J~d^8Ibc6MDj83+{~T5pp-6HtJ`ed!H}2%WnVEB1#IXXzLI^eAVSkbaD4M2X~Xz z$eGMp`5R*Y&7M?uy4v=`ytBs0Nv$6xdZBYIQL1LOWl7%}q^Ma5S?wakuC0#)vw!6-*RxcxFpC0t{FHL zlC9Lh_@tyj;x(>I;qEuxKvb%IM|s#&v(%l>F7Et)t2Wm4L-j`Wl2Bmv>ew0-tO?Rb zluY4Pi2t`WJ;z~dp(}c@6uKf$dN)E`S^dA=!?-m6cr?o1%w}#XlCMSyvv(sdg9_o| zNij&siYn~(xj`6s=x^Ig);001*0lUImpW9NCl)k3o>CH3K-eGnhllIv)9gTA4xuTS z;}f^lnbYP3g-237sZkUWrz%TFh3@RTLb<-XO1KW5epbr`=XWY={H02+-jWUF#l;G* zD{kx8pWrXN^LA*h>{W}m`@c2Aulr;gVFAGNZUBDgT(eKK8F*h9TmMsT%!$+)D`|rS zfTQbPa*f&K$o794pwQC?7I_CQd4-9tqQKh7#rN5;FP~z=TzkC2c9d3?QbkXfbOiP!}@v9skY_gNSnz>Gl+?6QlTOqZCbPS|p*Zdv|SSU<> z(o_FWl}U5q4{b>uR@eWkAvtcXtcG)zP*oUE=H4(J`=7?#ukWP0ioFYNA;ZrbiOOoJ zUC2;hk0~mHD{XmsmqcY3!+}NQ=eW4T71-&jSmLu1A z1&PcVl?dlX`Ccx_G&-SY`>3Nf>JJp!&H(xNCfVJ^lWS$+Z;E2q0K z(02hU*6t}M1`0n<{^$9yfl1ZP_Op5nIfsNq#62?`J44qYQc0zp!}8}5&_i!)0@xFq(+JAy@E4em8- z)l>8N!5N|r{Q*atA?zBnCnSkl2Q6Bh7^44vjYI!c+qnDh>?OTVIBQ<9?s-wcZ_$kr zmeBBZt6Vb3V8n0OolNy-R-n_TvdxMbH+}vu99=!bLHVj|!8qtfh)uf=cuI?DSZQdH zlT0Ft=l;_yFh8CyY#dYAf3=c|Qb@DHte*OzFDF)5Wc?J)rJkuz;Uj*tw*tPkw5|$ zquJ0~jk6Dd zz8TiAsPxy(<7SS9>i0(9d~Abd?Ups`W>O=KAR(H-!7s7e2se)8c8q4zr)V9`X^Ddm zm!Levy)lf^^!K+4=%cM1o_{fE=WzzB!G7C_87RK>jr2uVMu>O|yp_o#CPvvb`sME5 zxIY75fGR1m+ew!_X2`bG zrw(IJP8v7vjkW|z9L$n_amb3|cKcx5B>{&kfIVzUFX3&bWAyoLYW3Wxv6bc|JG?MvX2oo|EO>sRG^%gq`~TcH@u$nJs`<@icVAZ58Hp1s7+Q>gcG)f& zw+*Yu#-A4oA_1yq6vQDQCoel1_h+_*HbXJ6~f5fc`B&TdJW3LDN5h3jHNh_$KV-k^Z(7 z(J=i`^iCLBuo%mn9P9>TN&E~}9pP%KAiS; zo2|t#dqh(NlyWs4e#oVjCJX+~z$y=WML1$Mpxsd>ZD&0?qbZ*E+IY8;2Ku$}%km z!v0?t0BULR&gTQkcQ4@yf zFIyrD>RSJ^Sz;YetbA7-@|2CHov!?3bsJ9>eYh(fXb^-%CMnf3PH@9ij(X_8Ku|Y& zr%I`-IZL4PJqPY8AT(fX{XrhcQ~zAa_>s`ooQ`nXzbBB=nIc69pYzN3>${t;1o`oZ6l${*>I1+FBep+if4Zb)EXeW{gC`-vjdshb8F7ZrEL6- z)7@Y3Z{#8_i(?{H13#QLpzH8d^6R7b-8ho@1UvV)LYtoT>O>H89(P_f_=EfVE?X40 zglLU}>Isz^l+x)&g$_&-*ww}}yMTj`qtkiv-T6Nd`iBjqt);(3Z0m+&wB0mA*if?A ztsyzLPaPY2#>$1Nb)y${ZGLtfYiC6Urr>SM#5Aj<*rnf5Lc20W#3t?vqb7@|IZi7z zZ#Ew9H%dz9sHZNnDJ;)@h7?3CU*!QSWzXM4eV5%elyJ%P!IkM_xYc1N<{n8bLFY^w z1!XJl91Ab_ZdvSk@~^r68Z_>Ft+W)WT2@=6`O7l6BCjZ75lE{`ss9sRe>YgkYaGmB zdpM30#y{z@@2S~J8ywTH!uJxUca6$G_3K+I%ZD|as2S&fJGyao{+IN+UZHaVc8d3u zs#g+%z?I}5_6dd^EjK4kqZ@}F{q|T&fi#*VbrU|P6{+A1IhS>kAa@?I8SvZR*1$E` zeU28mD}+!pH1`!jjMj>&k~$LA26K>Yl0HOyQ^>W?dlX3!BK+>Vh_^dsZ*!D|vy=`S zEnGfyXdP_?KK&p$67>dCsYU<56N&#nZ2fyY)Bpd+kB6j^t@4W4P%p2N%K5Zm4k;>` zN;%|IIcIa4^J%20m_w2()Hd=}GwQ3iN(O3z-nJ zztV8DLcy%FKB7Uui$|6JJMDU(M8vPM7CGQVgc@+nPP~K1 zSkwV-e{3Oir*1s}uYbIy57gDw6~#Ee+yBw-d^GPISy4aO7PD{Kux*OxQ5usz*g+rf zES_(ePjn$siT1x)$0v3tpg-SeX*+>wJf1vCj68U^x~_y+j7 z4tcO1uVp{V%Co8Fws_Vsc>|?k@y#W4-Lp{Jd*eICV$o#_6ym->W3Vr;SRU`~%64H# zxREb9=Isnjhl`uEY4bsLF|GmEb2UjNL*Y4?k&OO)=iquVi%GSTheW=lWC<#Eu!a1w zM2%aesNO~h7K=_UOb!^d`CDLNh4@-+uG+P6vZ1f3iyvn;iY=uIOxgjGbJW@?a~nRP zS!t{peeA;Z-NpWAJwagAZ2jszO;b-7j^fS64B>;a2ypaf+}N4K(yPAx1_5_mynpm- z%f>mMR$SiAKPzSq;cT~iEsG{EE zz)304trU-R_k0~Ya;;kvX&^=R&ejl-I!U{Mx}1;!tlCOT_hc{b9rn$nt}&@)L4oo| zbwL|X+ehf^Hn0{cyP~6^_4#*2n?+Fph+$TBBZTT2k>ig*Q%h~V&-^(>NM)$c%R~vF z1Ez+>EPR>w9t6e|)xnB9mPoJqvn@+ehNfLguL>$WR)&@@{{QQT%U`oCh`+ipb=x4- zcJ~p*9$=AiW+S`3MPK(>24?*q9{=_k?@+Ff8F*2ly)RktT_0?JS_@7?QdQu&vv&~O zCnL;~e{JQ#i+F$hdjqZW8ciB~Gd-CI!7$s06?}p1Qc*@9u1>Q*chbv}yD6#KtIib0 z&G8jVyIyhCKpn9wr9(?8-qTo*^kI>zE%7gqkI)3j(3Hd%a9TSgC%_K0hCW(AYjgcl z4l*6b60wMmjt(nWJEYA2x+v~O5arL@))Outa1rxw9_<$cS1DRys zk#OxsC_9vpiQZ7R!M21PwQendEbdIOC9rkIIGwk}9s7IvtD$yFY4Yt-Qdc?HTTN+( zp)6Kfe$(%dsIbhkCjS(#Zbs&iaT|u zWj)o7nZ&4CLYosCsuf&VzROWdsP7qLrNI+R zx+{IQQK37-T&`D>RH0M3Q~=4etQ`5GO9F*l`AruXu0g8M~!oTubHTdUrVh}#@{ax1tvo((9`^ZuMi@3f;v|hK99_Q<%kc#_D6>V zz*4!h)VX8?)b@)@OXUf>{tw?vjL`rtja3hDNrT55BF8edjIshDA*Pe_zI;S^AI#Nz zv_&N2;BfNzaKlrriZwI4rK93@)-8Ie;_T|5OvJ8Z1H+Mmab+BrsPC6tD6rg;2!LEz zqGzG^veFIwzN!&)gUqa&?F<$P!b0#U&RXvcF6%CF+zDA7|KHZI9=kwT+NA$)g1-`a zY;QtOO1krEwTWrx8Jx)GW($eJ`K>6~E^z~=&}HT>`htA$<`1_FW&au77nX$dN+{ne z``|&u4%K&+4`Pnh#42i9st^9Z*^*o@JA+p;+B?|Ea=JK*TjVWWZ`=?2k-Cmt{$E#T z9K;E^{tI;{aq?nBU>ik7mFt?_9seYj5@CHK-ca~w>2r$=J!Q9D>)v)9{>=e%hv`{O zZ`M?qwz)BBXg;;^&eDPzI`wYYCQvc%t+&mui-I6k!S-hRw(yNV(t|~2Al|(%w{kY$ z>SRUEw!y#INZVYR9lc5j$BOG&-;8H82_wI?JN`@#;XsPIjs~Mb#Vp-7XkWAzfIz3D zPq$tO`)|`=_^z%q^d|B;Sj}}GiQkDDQvsU<#U3>V2jFA#p>~zaf%~C$>b8@#!hIl~ zlgp@+*6b_|n0wgaHFH4~r`B6Ejkc!g<|v;mM=R6b=$keM_n72ct44`{T&6 zUe94Aa@VZ>qzd?`yLWm`UvXhM=H9bPXfpJL|DAUfIof7?gMaO-wxVCykZ)EWMMFyx zVtHKhnfZ!#MVnrAE9R7nMkL?(OFlP{O0oVW)Wf<%sih4cR8M6*a|km=+l^t#`qijzIQ!Vp2Z=-fhpi$6dQ{V|!Z*qs8Jl8lJXZ+q0$PpeX8W*&aBjhhhAwB^ z>IVB=T;gOFuiN6mM^=C3n%m#op#(?ZB-_|Zm+keWae2CnM|AaLl>5K?mpu&~roSgr}*gBRV<1bbE4-Intu$X_j8sS+?fW`*Lic!6D7r zVj|^Z;KvXmcf2Y(H({~a;-nyYue;-}W6lC*Ly=QT7xSQq|DWaYo8G5(@4ee_K4e^U z4_|P5E^^e_L<6D9*@&xQ!6Etuvd# ztuxC9Gdb9K(6ZWj5nKPH)4N&}-elQS9grY%fCKo2(=Ozq`Bbb^Tg>(CyOC~7rQ+_d zHJq%|xpBo+FPpWL`IoBi-aPe0Te(uuh?CVL2v=T)tIf@v+@+l|T6r#v*V~wWKg?*C z;(3a0f1~E6rJ{TE=?n4*_b(T@X|+YF-nz0Fc^~KU^H8%EMHG-MYqIxtd7wMltH>KK z0`c;;zg3fse4#!Dp7K%}v;9Xsi)WG>uqKj^{(UsvHoPjbhHk5WRb?()zxq7@-xOE3 zQM9RQk@qbq5yTwz*KFbLS* zBL!_!Bkr=)E~XeMghYckzcae#!gqLdoM4J$y^?n(1Mx6?%z8zYJJI&$*f-xel5Ka> zaMSNh)t4O3lq~Sb0P5xbk5Da?;;IWfc1kfbMAf(Z#H+Ia(e`2XF!t_eN%nv%n~)2L zeB^Ct9#lZl?Y@y6z;t&k)jeo#*R!N=X7zDqos-}GxmMLAV|k|-NeKx|n9yeHHDaDe z@kqwoy)sNcJOI$U8iVo7u(M;FzRx{NblZFHRA&ssDh2-n!WOkyrsHf+uSVYaqUXyi z8#A|48xHy!YvrRbN>X>hzqevtow49af9$g&*GycqeeL6Ef9XkoB2F~2zgshq@A$#* za`ALMu*eXbvI}Gn3&>&*JN1%7%Bt3E27ICC1f|bkMn}$R{6v%%`YYT`# zM@-*1*783Zx<}#3t4c>hBD+MS0x{}zfP?^H=5|ZP!n-48ugGEVMnd`N7Nv33jxI+e z%}Y^M?N>mYV?!e!2@%otJ13Dw{yC;k)0jb&Yu$x=d2%dd)WRWwy<6mSh5$^ZMswMH2 zGd5uB+0Y9gq9*b+FYy$e;m$$!{Wu?QyGMO=!s@xDNqSz?kS^uMVKx|!Q=xyDUd7qw zow0kX=L`COYZ^X#w(e^c2ar0|krh0wGE{iOJ|sN$5!T&17PtAFbSaDP)1}57)o#Sd zO`X8A;!zWA`b*!9W*nGf%rclQD*W=9^!xw7IsUmW0f+kQW!;7_#Tzs5H-)fD9PKPY zAkEOVZ$)#r*?Oq5U3WaE*z+}u0vvU1?nZ)sbdbB&a8Axdkv>4EuEe8hHl!Ap@Py(; zp!)ihix#TdKOebPk6NX9)A!YQ63*W6IRzQO_5f@Bk7=K?$~dM6_d~gjq;gWC-JkDQ zhxHuv;zQQaFK3wy2|O*?G^$kZ(FKTp@pIp)o}=m7Fsz)J=OHIPEhoup3G3ecaaW_p zHIR0+0BA`>9ZtnjvrtMENs~LJWNMh{d$DIpSpoPcU_!q^%w|EQ0O@wz-}X951E;H@1bftCl8+dI%>JB_pVxTo#Bmd%0l886UNtKA z3Ku}Ow0GXjuWTiA9vtxqC#D%ITO6mqonm9}0STHVfW?GdRyrhJbYD+eIJ>M9HN-}E z6)hz64J^ECHHt5*K%&f zucJV^V0WxDA)U1dtv_nMq}Jz>^u&fBcOPH|{9_&*NWWZA^_9cY+v{d#yv*{~JmdY^ zt&2$@R$+X=U|xZ1!>N$^-c(F_l3q{I=!=TYf4#&g4yJkPq-DiX?fK!-yuh{+GO0S& z(>zC#C=dVjw~H2iKzJKC^^Kl8W!(n^yS3-xQ#|HlEN6_fUI%3|c5L^w4@+K(TA}%l;nUxbEqcAOR{K_#_#hn;Q&+LlD_7OFQ9Z2C&Bc-$1_JsGcR*2hvZUNEa(GQ?*Fa&LC? z-pg?K4_kb4_eR^TKf9Z7QrTM1G=Ju%;2U|CZk9m1!u%3`3;yE6!EEoDmi1dv@(;2k z+|wMl9#*Frx+i+kKfJn7*no`uN`AF!RN&u3+bwrcagM|+4kG1TeNgshqX7E``gQ?e z5~jL8Kl5Ub>WmZgncxMSlk(XMo_?Tc-ypXxudoo*@B*S2(PI+`Yht%8nl4M-48 zMbW#z_Dt1ecp`qEG;ikbO?Kg}2COql_z1yw$Ig3^*KMTyMt^?RYEzlmh)m$J zDreHd)K!H)gWm?u+XdRX8y3cPmE)fKiZ{m0FnGrdn?lXe_ObjxtO{#p-JlZ4P2&C( z66QaDz~S4nqwTnNi}MYuTm#Oa1s< zRvmHiCoQ&$l8I@5EK0mR&n^TZCE%uc`Xwag0yT$QT;ooTE49cGxH7upEq=6;nbg2c z+VGjJI^kcwTty66+wIh{QZ*4_tEs0Vok6NKK?^vd>5`I^be;WUCkgfOMgcr?&BR=& zbY7iHG8yLB`SIR~s+ZLj?{G7G&nG=wlXa9RjV%8?MtpHUdB`yfsg9&;Z%XowOcn~& z<&j5qNY2J|jFBSa(WdOMGEb)CvG($~_zR*Q@rTHMk%;MGbL;oza=xNCr88-CS8fmLW45jv|b;X1d8Ib!e+ zcs;P-*5>kQbKU%Q?97+ospdF2gM4+|}Iy{wn)B1&?5D;aTo6{hzd}WCs2rM!RIIZ2xBSDUL00 zm{U0gbO3HRlC(Cag%_#Q7NFX%7qN3;f)Xh@@(XjlR$dAVJ0DHM9XFap>;VgNTx%l2 z%+y1C9|wteO>TC`>Wxia_4KAE^Uadxey9%2`k0m=r6jgGF0-=N>Ewx{7cxrrJ<0no zYoOiP0T1o}TLf4Xp&@;0Wp3SCNgNDE>Ou_l`Yt@k6u}(L*Gs~rfN)@QfPmr)rw|D# zsVI<2Br-`3BshsXj1ghRxTeqdL`{T>6ln3N9W;uaMa=h*D^Zc;D=~2xvvK3!P})za zNN29=09)C?_rs@d9YFtSBj0dayy>-Dk>DN@g*x*yyd+vxxp_l^*u-Zdx-r}EC0on^ zZbN;KvZw4aU{3Izo)2;TIM%MP*j0iLmdx6+G1?B5f$neIJ5@JKex@TP^Fa?v9`~)w zM$RBdD9;9tS6ip`MHEe5ybw%=EZQ!`D*uay1!!N}Lz8XUC_~{O)V;}!hJK|zvKi_F z>$-R}z1nUjeH0NMAr;`53$Yduee3F?9F+2Q<3URqxM{w++%Mt3%>CPieBbmDaq$5p zI|VHTrAagdpPhz+jUA`BEzNE3W7k6j*R}i)o z?Nt3DBjGoNP>2SQz~W?XEaP zU21L25?Xzv2HU#LQK4C?<_)$$VMq+Yc$cxnY zAje|+hoqmr6bwe$uGk=W&X$xMX4fg3#yAQK=jz7RtaJLDyI|`q`8FL3`w+3L zA#M>tn{1^((ifvZ_jb)Kq7-UN=9hma?toVem{k?{edQ}i1^glZJD z;c#qqg0X}t@BPLFkiVrm|B5TrF_E$#EQWTN`LbHiJd9?HQ(G(pUhXbeM9H`8h?^Lm zCMC>IrIQF7?F@q|hWR??gs(qW0TeREq%!EEwfm$G(Rw|k$D@m*Ur5-A0l)`EC$=P5 z1#sNfnDzejDq1KKoCE1eEqd#lo15N^&+KEVsf?)O-Kcbft00XEJ>)lJ=%7Qaq+xtW z6_03rPwZSxEucbivazYP;we&5=;X=j9x_{S{Op6r! z=&RQfkHwVbXL~2Fz6St4y1sx$RNAaeQC-q_yhnH%%4^pH)L6bj-{wH<(UXGW5v~+C;1Oc^#8369ku&HcmyD1Myl(rVu82QrQKJoBvekQP?`Oqw z$=5FB!2R1(F4Kj-a1opV{L-GaJudVJIsDZTEiqSUuQ3wC=E{zNXv(7jcMa?nGr?Cn6wKj(jU=;% z9dTkL;&yd$4D*pTfya;CQ%oN=q+8ApY9QDLIW47kI__QWNJvT>$H?q21ChKV4te!* zPNQ11&Qk3qpyRN1P*!kjiUb~UoIY;kH(>f}={th@aWt@zU7 z9|l8@bA$>aBztv6Unu@k{!W(h_D7j4j*0}t>bC;OOJMMfyaE@>rXcIpH{%*k%qocwuZF3`Lr=}Ed zz9>KA(ups50FXn3Uk}q%#clxJqYsDCu;mAmj|&)w?F9$z-&#cfH^!#{k7+;(!9Y#1 zd8c}~&Z(3W6fGodv$esMaI}7W*g&~z#=ITi-`6anm$WQ*v-g;+z}Lgd$JiT8V+s(x z35(}tjD#NjC59ry9K#d?%rz|_$zlAFC*UWz9-w}Mli3ev9`|K}|1_5b>9xw`3q2E> zfO6Wlr8GB~SF+kxmZU>v-+Q}uV#4>U+Sv&#-wA9gGRYxFKcEm(hR;%gXu5q<3Ix+E z4`%qI=9XzIxVjUo0$fq9>jF=Pt&xS-1=Uk-?FA)FB zJr<2u2~F+U39kGBWg)RKA)~t+{;#7lGBSEUBF0>Q_$j8(ec<&Y_*^f1Z@2sxT2j+l zn(lwV64%nT`YZ3OK)WpdVo_@KL65ltDZ?eSC4KZBgaJDqZ;hg~RQB@`1Biyinc9Jk zM+-r^Dp38Uuy_gC!2Y4UKl3MGc`$>=@eF&B@e#{J2@DUTg3mFBX@kyCU+h>@1I7nL z=<8M4QRJ*w>*Jw9NJB#u&@43xSuKW z-8n+MoD7gws)Z;5wsY#`fPGnI@PKS!gcs!wZnVFbzd*5futPzrNN#AG<%^8h$PVY( z{M|URwJ9p~b;M{Am3x)|tgp3p@iP-j5F=a-w897WjkS&a$l4$h2p>G|1h6^2Q@E=x zuz!3&JXX!;49B9g9aUyJM?2#T@)k%11sh9phlNjGng%4gb{h^Uz0`YOVW=CjB*)#L zrZ(t*k83{do}K?2OHTTk5BfGBclvT@`QJ07QNV$XTi^dnAKwMg${&fUJ%{s^Crjf1 z^%H^5zn&K^(yKgg;oyB9>prV<3LMSV&UW+zbskeYAa}9+c&b+$=*_H-)~;twmL;;* zd^@w>y$!n4v=njUq!{j0TNoVduNxV9-y*#)+odTzq(J-r3lnQR=iBgzR&HS-a8=WD zQmYZ)MCk)n>W@%TVCCLeNJycH_n#(u=zayyVC@w1=qDEsoXV=y;+f^kK>FG zvoft^aa+n7;66y?lvjAV)7ST42KZlSduRGmt+aEOT^OpHlgn3W5V8+Vuw@gl7MKLY z47~-Pvg=*{$BAS}%_RSQPZ&Zi|Ac+R%ZP=LTZhcLLC9v}5@kMRyC==O&=ZlFhjk@{ zDttz5_OlSe#Z)U`m>=N3J?1t2`i2^Va?(Q>U=u5|YM&=p-iZ-!oU3|`P2=*m-2KfT z2@ol_;eZRHI;s~rom1W$B&Z~0)fA-#fN=y^i-1^?U5e*rCD+<}N|Z?62rX`@Fd+-Y zmr?*3H|URGS)vFWLRHK<2^WMz8PZ~-+R4}`tgZbY_p2SdPx&7cs^&R4r*^pup)FU0 zA{-B`4}64IxExQwPDUzCy_X-i+eXbg$YbB)^&|ZI|o~Y@?7{q9OIl?BY={0Ho z#LOpd;Q7Efa6?Mo&^4*rGA-#-8#?*SE>ER0OAmXItgN!f=*BAhmw^8FymFK)0Urs~ zRV-;W5(A+xZ3P4UUzVv8&U#I$TYaowjoa?oedM>qGZH27WxCCHXA>h-tge}KIKje>@&KnqVf$p~1(@AI9{_dsaE#g-aqb9WGe zK2X^ybz$+L?ecbU7d@CVRGAeL_%Wh1pn^bpHD)X|KPVtnV^ix?irmwFToK4GJG{-i zFF@bBC)f(&8oKIuU5J*--+Ef8E`rNSM~IX;W~QaMf&c$(LL~%t;VYx|EtYLYCWkRJ;a!@mWChD!QsD2OB+i{L zdDHsZ4Kc5|tL1OQ4B+{DU#4+=|KTcQBK&90TE`gJy5_|2pw zbVT?koxNSF%OSueHvQi7U2+LJkk;6cD&th1j9Cxj-vik%9JC{)=Kcl7k#n-u%$eFh z^inWCy1wBvIqVg^$$9u^M^5C^Yl;DxjAbUqoWeH0ml6Mc$Rd!i2NzoZ{@TXremsnJzSu?l;e9lKCdhTlDhoJAsNfIllBU$V#TisEKb1W%4H}1(U6!FSKFv>#t zLkZ)D)1Hae+u?@Apn9Wx^)2oMm$#)wdE-G^*zqkn6YI#mk|RRMjQ;p50S{6<*z^fpqi0+ml;{wmTs74p9!onB_co{H z=D+mnRTZVz|IeRmm%)jcFHYla5i=3_k0yMXt}1_r+^YXwpY@vbJs92`FmR0%KK^oj z@4b%dTvLVg$j@7HXH#lHuwIu_QFdyW@Z$F0Mjba{iSowST6qiR)C)KHmzyzq7F++Q zDBR1GU2@RiH_d&1N+jA)B!zK1=ib%Px{W$T(Htvht}Vn+-OkVToHY&e?C*mfx%CTY z>sz=>f_T1l4gY23Tv3wLuW=z&cn8+2C)dRuIFquzSZ&gFX6m|>T`VXBkX3U5obs*= z5DQ&oW;cZ3i0lw|A{~LE@w!#2j#F{vgRf!?TAE@b!Dlp7ICsZ-&I(7R9@@VS>na@# z*8pg*Q2rwN6H}%yUOXLKH0u>p3;tbo!LH4?vg6n)9AX7I2l?S&Z6%soFjgrRF4TEd zcJl!{m%r52pumf^Y)~@v2%%Rtu>n*(yqBg< z$)(2f|KoJ8rtQTNz9Mdf$8`VwUr14|+1_ez9Fh&cQ{9(f_2k&mZnf$9(TL|2*&b8i zA2!b%_OLH-l&ZdSv-OPnEg>|EI%p;Q>C^Emkws<=Ej<R^^n@{2z{OMcKu}?`Cr1(}#3`VpKw+TZnymBFhNJCUrw{X`0-5n> z=sl}kvj)LiCPe*zAt^KQCL?W1`c=BU?N%rMX}e?M_Hi%rR0A@690^ z2gxL#~ZcW0}q$veR&*XXEY-u6?eeRm^^7q1GL|59_Yzo|aDdB?ws z#Z&R9*<7Lik~Mrd#6&a1Un4{1jjxpj$BD}SWAzVn>W{-0`45`2{g(-+k&E)up;tt! zZ}ESRa^JOj=4xFr`;)_W_e6rXfzE8Z7$%cFnM8N^l>cA2KDr848SrcN0yVf+pfY=d z73CihZ=eh5yS-iIT#CC_F77tiF0eK5=>3dK&NBBT0^Y~F@cXHi@^#mmo1g2_wFLRj9)Q=&HaR ztIZYO7)^?kW8DfFS_RJADp%%DtWGUU?}sYYzETZx^A}&(r3D=Me?Q4{U`To>2G@!v z{=AP;WoFlmkgDQ?>akx*gbV+Nn03BVMY`H6&08?rjUr1CYbs@p3#a^zj4f~{{C9IA zw%T}cyMKBe{$#iMd|_IvqH=fTF*2=1MfUeip-)*$8I)Go>L!nmb|zaiLsBfT7cHV) z|3h7eH_>@}&?Sv(gvt$vWLf_0k7W@6@a-*``qBAkM7#1VIX^dWkz5#eSY*}t8fU{v z>P)|6wWErkV+iz|QSi|oCiacQl&!1{ZuZFE}eCt@nhk77-`?0g9F}$Ti6^5ir`U6Sy<0QODLz%6iW&SmaJ7u&- zaQ6MX4Lk#(m>jz$ZwdK|k+ACNAa+IMbUIrlg5ByGdz=a3FX3)3{aVMVO*$;0aj%Dz z5dX4$>m%c2gwWv~HGyrL2;W6#y;k1{V4cj2fGt)aN29KNQA^6)yDC|1*{*!-;bare_x@cSHhZiSla z8ZKtmPCxL$IGQZ$`Lw?=>*(Q_OC?O3h(mdf(d+m3tL(U=E_aikQ75Z*XfEVlW&I)k z{*+041xX~sf7g6JG-pUG*`(d|sEdFmp2GID2ohnFNatk{_k&n5xoZU&Ro}|NojQgD zd1=5jDI*^7n|*W)`L?XYoqP2r_w37g+DsuOh=c0~G#GpbYzu)xRKWMaZ>GWi;4jOX zq_n%xumM$g7FG5`wNNCu@>if~wp5rJvJ?P`ZniLusd+x(zzS@f1pm%}-uUBwisoYf z9gTf%Jx9w!voI_VXs$8>#EK!&Q0AgtC~7(CzmA+LY*mWH6pgveop-6}>bP2|%!ts5 zyh7zK;9TrE0e1)30d53vK$HevP53%!X5G`;i%KB`?{zv*eke~HNcsBSQnH1}$g0y^ zos6wyh4B>$5ZMSzw{4EFYth6!9SX!Mu+F!&B)`|x(yiTeh344*T@%J$1Ampi?H~dh zHEcZ?ypDY3=U5eJ0?g&wi?f)&xgZ9*Y_+O8to*fYxM5Z>%C*?_>ryWv=PA;((o^_Sv=M={qaKzHoHB)1vs#g+3Ggli&^U!g<_g9$DmNad=alu zgt=oTBeBK(s*cDHb1RDH1{%?2`jF{j1 z|L?OM&Nq-(v&$Y8HygQbio9X$_oIcHcC@Ckoka$u`^~Pw#k%yMGTp9UFlGcXPfOExY&PvH4pG%MX2d~(U z=?UtSZUCh}xLFA|9*GJOt5E7iInDMEG-pmZdxL#91Qwjq=NgL-^Pp9ye3eyevab&r za^;B|hb&L)RrwF4|7lW*h|Q|QM%KKN)F&@TcdgM3f`)MhF2?-qdpIqdTSyy_)h9Fb zf9Ef&fZ=`@A~?C+lz;2W^EH&ICD#giX->PKx^F4mt?{8)E zxngwpFGawbCH{aJ&Yv4?K0x9SL0YWTjUG-n6&6w{qG}JFpo5~5?O2Aa%#GKPKk*Y0 zW^7SzE2WQHieyo`kHik6MBa5@?ziiQYJ1xE+~RMQWzbH358nvpN;Xz`W2u|YIeYql zQeC$o_a7+}P-pKYRgr61QO%t27gdeU0%6g`w>7-)^ncEg?@R4_FJh4huD1?Z+Zre}gA7DLe&Ui&}1ItZumiIxCvTOM9e5&_3%`2#LgS7wRMCGIr4!0E>3liA9=#tq5kl6gVzeuF z9ZdikJUAo{%-qoz5pb%iOLP*-G<45p)qiVIlL}+ZO3#w{F$R}yz8S9m>jXXdRpknr zB=TdgfWeiLh^=E+e648jg!waFE-;RKhoFIPAhC#YFVIL2=@AK`EIoi3cj_-&L3tWC zHVqKdE&n>G)Lp&K)5lG?E};6dWWjfqU%j`P70N`VYVwM`BdUMv2N1ErfRZc@@JyFN zm>pb+PJC6$ewe3;y+T?GvbS&({B!j&&=rt7YhpKZqleMY(_h|~aAeAcoO3t6Ybvw{ z)oV;BTw~sjDEhGujfa4tdi`o#2g9}V3h5j=>We^>cB4VdK&w0x$YV$Ti|JqhQgr%X zyypHT3xIZH&EDvjkKgocwxgnbA?2OCIP;Aq!N_a}k?)rvV*Y%0RG>qP7$d)tKX&J6 zx1tU(H$UnhTK~^SZHZuYBEbJ4*H7H1a_M@Tkl^o=FFeF6;7bOM@%&ySDwGAV@ayn~ zmHKAV{`!O6e-2e|Jo`2uFmpF4uc^LGI4e$3K#ch=rku0&r`t$ZBIBiBgT zk?qiuvN$Qm*OwZV@^gr(A1JV25=GwroHcf!=hr*69YOnjw{xBl zRAuMflz)j9isrKr2sj+)a4StPThR#|e8TiJO*}%x>HitA95MRPzXow0Z7(s!8T0zv z-WTw5%sEQt8WEFv*Qx10|K{~3#%txRnu6ux?@U5ehMr7)s$s)#5k4|eHW{+VgL z-1-PdUy|vm#dLsoKpyq~1oYRz6vww*xi5o1lw5wm*SZ{gPxJ;pB!&1?Fu4}u80#v zs@&hBWzP<(j>!YL{w)yv7cy7Y-E;S=Hy^-~(|tPOy}l0#l94dq`&`J8S)Q@(1SA$z zbWNH%F^_0{x>6uXXJBVX$MrzNW~GX-V%2SIOp8JitYo;;FCD+3m(1^CF)PRMKteRE4m`F7;;k8r(FCwKpnOGz$00B*E4_wmtB~E(hs4pU2{um3Zb$s%MkhFu}$|5 zU6(0O@42AXG_hKhODct^`oAN$IiMGG7J9A^*A1o&o1wZE7iD&Gb?2|PoJfKMC88RY zZ30|F!dJnUy?((~23b8_Ju8dWbeNL-ynL~I2)~}Y#}MqM-&W#<-pCy$oO*0KQ5n1n z{UH@0j_%}5CMV60`$jXH(;Tn@c!C&IW8z@*(PRF-dqEq&vz=AXX!tGC>UZj#{k8r0 zI8{r^t^qC_BI=FRb8orNk7-!JuIg0zF0Mz}8JfCWPAG9IG7{r&ITx^)3QktciPsy! zcic)nXVJ(-vk$8d0dcpZO?YYjdMY_i@7?uvg z>R+m?ByOMiIec(2g3X5Taf7qegxqzHs!?z_nnQ|p5LLB+x2n+R){Ur6 z=PG`knHqw7R}?mTvm->ElkYg6v#GVk{C19rUI#u%$EU+JM7Ddy15Re;j~M%PeXL_A zygwSSL)`VU`Y1G_Q^m--eK_?#GJcJz`fyiYp}Y0pVJ16rk8|QhblF>2TrUO_=X1R& zEyL0}HAAWD&Iul$q4-i!o08Y^*4h1gpVgi>RFAwDcE3{df716kZeuX~_T5{7dXv#$=*@pG zJ^h(!bmqms?Vs!f^7|ednQYE#Yj3_zy)E?E;WJ#775+V&ZZ~^fgd`X%#0m@gYMk(R z$@7414s~r3=D$uOPBz$hk1@kS!^#iR7|~m!u?*2)nZW0!c#s9x72%GNnjCIi`rCh*|?M>m1JkqPh_5%TV>AO z|1S%Gnq4H3S1(E}x$YH^9uP(oMbeMwLhTP!&L~P^hZPZu1nolYwx89?UrneMFugeFWzE zguiC$xyWbyjRp5j#Z(Z4_ZybmCA#?-E)5C59KD(G}GQ{5<>a&Wvxi9hEOyq@VpP{47;dI_r zP%z0*9nWaPj1LT9N^MjeM!)htk}jX|-aglflHLY6Gdbd$x_DQ#nmVkAkBFxa+n5Th ziG7OlP0YqBP{~L-44U#zd^h)w+WXJ4zOJ{~QEjRrRv~8zzaDEIme8=azx`M~?uTkK zkYmb^=d8s8D>HX_GpjG!)>8Vzu)({dW&s9JvFG(4&n19={Z^eSkv4d#8@YbgW$32g zO{=?pCmFePOTQjH>U~2CPYIR_gl?{$YQr0UcJ%?o0*Y_7RZ?wlo4a2DNATNsXd`rh zzIrYB8;IIPE9Ci+4+m#U_U<3MZaQ(foP#e|ET@UojZg4rzO3Vq;12lAxXgcPAjY>8 zWE~MJ<>I2>gmUMzfHBSlCc7Ds7eM?$k8Ic+w!1%TwsaDE!t)A#8+LO(pMYnLHkxhR zmX5-ra>G`ga>b1Zk|YPjsMR;Slxr5?8@R|06Y70+)O|nrqK;x15!{?r&_`Sb)+zTa ztM7x{mow3OF>9`={RYD0*(VyROIaytO>ME+7FM^Z_mi_ek9Yjd^XNu!=N9pK_x$JG z8n}X8Kb3H&h25( z>|3%offKYFQNrF@lb^)~xkSb@mc|LM2kfha*z;FR$s#`w4xIx7Drc~$FgtVqUfOE7 zq_8kaxN*mkwOg``apKs*udu!bDR`8Qyk1XML%G@cr8*BRC0}P1!5x!(M={gK2k4ei zJJssLlZ;ORcslON{AtUyz1Jwu$q}c}$=x_ne8YGT;EGpS#UT}_=QMPeb-$uhGXrer zK*!GeD`b5&G{oCx-(;S*+mV$!Sr_9xX$l=WdO1Iy*KMlqy5mBuAcfAPQx!dO=s%t$ zoI;=wcw0PGs+;_BwDB?sJdM4+`8r7=N!=mow!fmMQ+#TXz{PIQm)xE+e^|p&0i`6; zNtE`U?hfF$nn(=K%&1er#8IAUqw!3kG-FKKmmrrSBkWykoiOK}Fk~O`H)=)%o!PN8 zV|&Yo4*rx`%$HCBuo13fCCCa5|A(`nQ7x#Q%Cjn+Bn!5J?GH%sGoe#;g>=VDaGl6Q zU(vG7l>E|=bOkNbrKM91<j2W_aY^9 zkPe~O&>;ye)DxcPE9d>rIqN-tu~-Y%y6=1To;@>r=66BX`q)-CEVo+lTt*%3glYz>Csa3@GCo5G4c_iDBnc$8F#%!%&h1M zvNxqNsdW6-=7BG&v9l4iRc(l%sMDb{bUkr#0zEb8Zuo#@!H|pl_%+FhT}FVcJ|8s8 zgd=-cgwfL3eN(py>4pxHBxUuXRXsk6Z&Td3&uV`;Y<*`XDapul;lSfiEmzgh@{`PV z(uir(8Ve~`fY2CRYAjR3yj>f+LH~E-bvm9dIsYa;Er2eycEbE=h`*TQ^0G9EYLmqR z8SD)sI$rAdkL1W3O6a%jE~Ezi#o*dKxYLI`e>$z@9HU3`+^RCzw^*K^7P-4TpAAxe zHRof)xc>^tOonO&-(u_iVa#v9uOSnuk)cUYaK#2PeE*uWBb80i;efsA=~QdHze{{P zc&&sg#c8O;nwYX#c8d7ONATj}R^}wk1vf1hBR7ilK;UsHE6a~2YG-JUhc$aa< zhO(2vy6m|R(#6vM(Dw9;<8-}aHU2QOHH*G-AfwnkAZ?0ot8o%2i7hyk?lg2HaINfy z-)XqNcMy%5on%=9S6fvd8E)q|&((NH9W7dVk2#*OH1=ujR${6P?5{J;NJTylZ>TJM}~XI#F%BsF1I)we6cJ=Xbp@MGhbeYz}?2RJutPFwEa)8TC5rR`B$ zISPI3c6=r1PI*IK6M?O4g? z+ERaLw^T1tRX|>6dY;(!nQR(xk>9b<~Cp`njf@f=4+LfpOitK(R8SAc-IbK z>uaFVH1l!pXCx$`KWE5v7SN~R@#`deW$M1i+X0jAvMz6k&R6+*D|eRJL!C`b`>hYX z@~0A~j;A)K9d<1-M?HR27v{4ajn;07( zMx(l#pKN!WTfauvaN&QrL#!E}^^pD8L)e6@o4q|hr0&+s-j8A5oNB_jlEt_l-ufJ} zPW|#u$jQg#$KhnpsFa^lJ-vDFh2~GvTWy|N3@>gh+>YC6@|QU6&sg7f#P0NOrQ_t} zU%79LFv%gdWBEaJ01v{T0pWd~wy>a+2=Ue;!IHmN%-la!b~^#bv`MXen0>&cdih}G!M zN`_NE9pcr8uo=mpKZ-AKWU^XpS9m}Ay9&^$By(yW4yR75<_uM&;0jY*#3sRYHyt-5 zaz`r5i?rAFZG|?L1%fZ$By945_Y_-TKwt0qU-C|53sAy0(prpjB-iyFhPan`WR#XE zv(KYh)&vw&@9M_ijaWD38&UPs{9K`=Kpi$z{0A7XfBvy)W@BR>1YSEYexlYOp3ZN%odWH2RlWT*tX%_ z{bhq2Gi^*4r`hj0+gE4Aj27yQN5jHU+iz9eYIrB5xsbQBXj^|8TcO9v; z@cli@BKzLYhU+yS0v-oOv$!gt%n28B5DHw+SCwznQn93gr{ynb zDJjV#_P#D+ZBgG=I zkXCLRxy|7NQ!x;bK^h+n+-PHf=K&^R0gq00Llv9NdD|X|-lMjmv3PG5w{%(zgi-0z z5&0e{%LKD1b#gq9o$OXKbi&vYWwT&cM{@N7nx9_dHrxJ7RZad%D~VieWe19ujc!jS zW2))WauBtPnE?5qhLMY7fmnk78vaSSZWHHzvcIlVbwZU7<;KSBZ?W>m(slBJ{jTRn z^Zo>Geq%dtTw>j=_8!S(lOW}ju|EVMsH*A0^i8~0IB1Vf`V39dtNYSZeODvWk_bu93U{-BG@kye-uz z$~mcS+9GBY_5JSNP$eG_6PoGUjptDoQS!D;+HCgdYxv-F*K=W^{WENz^ffjiN6w<0 z?82kEmG$+2&nynfxy@p|YerC$bZ+3lQ6+bVr6(;QE?G#4$SLO-58{ws&pyf$G*#|9 z?{a_gEhVjaZ6ICI`&GdfnjrBRpxb7ILrriSnGtu4_Bp%CnzY*ek6?xMn2(oswPbim#Tk*DoTbY z=WM;6#>s~IT!<)7MPbj@MNTGwOrKQdUr;woF9L!tHetViQoOD1JL~1Clz_`K1J~Ng z3zwFGPa|&0&mjuVOpc$#|eBw@HV*TS*Po~`AUbC;tFlicE|v~kJ8 zqs~|5bk{d9gz4j(9Hx3rJ-W=gz9o05_AyB!FtR6u0(=>zLxDnm<@fFHslZ(@uZH6% zrKH_NbcEc;j}dGqBfEjwVC-9Msq0>ZYG*=-w&NDIV$^oZzgC(cfA*y>T6T4=)5dJ+{mQ z%4Wp)K|&2l9|n7l1J3EJirCIaR0GRJd^@kx4CeL2lp7#9T>kiFu(Z8mYOrU(cQQm0 zF{#GNyG%A=Qr#k{>masA`2C^ztEs@%LP0e7<3jd+X3edr1Del*(0LBGj02qpk#9Kl zn}N(UpTKCXx*)p+#9h>Keb5UfA+E}W&~Mz`((iU_7vg`SzgE?+{3N;6*xG$*s@17_ z|J-VRon>-z_u`GJcR=?6n#rk8ieA;Ad{};oy{-m6O<999w!$9-Z+0E5KfCJ_Y-@Pw zvdg;SXOs3=r_OhPCA4X-k?p__a!Ro3H|h^J{`<%LB6kefjYUP{IQ0gfw89!DZvO^l zSXu&wD&vkAgtL+_o^w!u+wmnJ$n~=vB=b*-0!A>MlCy@4>Kk^%Ha+p4C?h zdTnSnU}DA71WRc#4eixDHr!#}%CE9pA4bpU636i+2uC<{`E|3=q@ilo-p7l0o1$oq z?Y_25kkVT5HPS0|m#1^wpn3*j;TEA*8-n=AQmJ)vDf3>x6{Pp6I&cqd|r6#dL zl@lmz>?h4g5pX4l&7DhReMLfeHlkd@Z6N&T~;SIfQc6A|_>zi-+GfoP@mO;zU)5 zDJ&^P;evbn&{`8*{S!HNX5t=%r}ux?LRnk=GUh-j9lv%|Ti#067e1ZmDs)&*I+Rs( z;;zGouzU5h#~CPu9yW(HziCkZIZ!-5fDfY1U*sGA1mNyHxR3rsxpMs4U-869_5{J^ z{()YU#af-OfX%{?f}RMS;%VxZ8)EyX!G64IQ(U?7w50-_I?yoR_zrFInMlrMj+I1i znmLNr~Sk)aL%WSnl+C1z(N~tGDWtUvzmPtB(q3Qpgwk6p_ z4i*7A34zk2MUEH@)vUHdc2s3lH?;lH_Ni5}hXmbLP|L6I8H9uNjqF$}F1A=@VED%b zWsVj256;vr-fZ0D9fTMSulcsj*|9QEib^UmEIc!i@eGyZ1_<(&#@oe0v`!QzVPd#}{z=DCD@ z^D(KyKzfTsVdsO5yntht2*2Pv9!$K4#?mrZtA#QT3y8kWHrx~t! z6UZ_0C`*VhwlRc(R+QN5Iy6b2cF;z2sJ^6CCPI*3{8fRz@M?KfJdoTw|GRb>2@u;f-$P{2UR zg!FFKmw~Qh@h_mH<1aF>o1ZU!feh0HwgbwHEBA9dlytq?s!AJaDI5VCgCx$v95L%C zuhCcfcMaQ2`n~oxivMrz4~RT z3~KGE2jwlKRb|3Td38%Y^nb{v4S>Yk>}8gOXDB!WoxXRgt9H!BR%#7$cE>K4(MKzI zEiQa$Z9oFIEmhaZ6cDTWGb%e%4(c>~%Wj@81u%V5D z&r}s+$-6ckw{m-;>$g5wrd3zs!mkZVo>LETcgN0?e1JOxpbh!pPgVM_g0kx45+VqVJ|t{ZX?GZ18W(-34wdzWZFycM@IyTIF(oSQ?R| z^buz!S=D%7!E>;Sp5Q}1M$3fI-#B|fBH%5|7XrwOrx@EaYXueXHL85S7{2ml%|z59 zhYV8@g2=)pIpl{^XNOB7(8^7LS%zKKjrh-#>g(v)qK^TIA^_Q5+JP#mUxnzXLBC7Yj77c!Ns3?a_QhAtpngQEu`9kxihV# zE2KWEx6}e{LI#b@6ulvB{icmElT~#y+enUZH~nbuvhW9Wp}u}AfU254j+dim9hD%K zJ+l@&5)-*HL|DAQ3)TXY46*5Y@VsbT&0R<+O_{h#3jj6&PI~TTX&#R=i;-Uyj zzpFLS-{dADz-O^AUCzG;U85^)mcmW;f9QZ3GE}%vKz}>GQ{`p`$LU<*hnrG$pep*T z}KH30|uUs2sw^z2;p{pp6?b4Y$}@D%yziXzkjm1Hpmkhr^P-MNd8-e7+qa zNcH3|j!@Q+E=|(AM%b-ynI3&Sl;8R1uC2eLt#YT>nE z6gOclsSa*mv6f_qQXkmp7sRt_Zt`TX-U-t1o!9WQLyTrdTbDI5#WtW-%H?F$ZmDjB=7RODs-?e_vW-qkfqT%X06AC@(qd*jb7Po0|~; zIk%rJS)qfe7)CbGgM2T-*7sc9h#O%sEl$OY>Q?A^IS}x>DwXVyycMPXKPBqkVNum? z(0NU6<~lJ+T})biAig}*1(?G2iMntyla=+A-eV(nRyoR3gd%S=}tGO zVm03DhNKtVu-{sh0j~Pp$>6Nli=qfEgwh?5nQ@y3e<%Q=10K7Kno2?vy{6)FGGc~! zn{p*N>n0E;>#6KuiG?5+ zqgb&`S%W-`_omf$_`<__nSkNXI15ZH$_mf0hbku(pP1k zZ>u`i@!>VPV^`aMb*OrgG9+!r;@3F2OS%-a{V>TxiF;W+pK{tTFa?|lpnBQ+`9~DANL8$^ z^|e=HzroscQzNa75P%=wL2)R|txuz2|H%syu={2`C;_3_qAtPXtE<9lZKzFpX@_VZ zrZ}XC13Dm19RD`%e+1!49M^d<_!aG1kC*CExbk_mDp|XK5~ySM%a(@BGAutLlcTb&u@Pne` zv-Ih5QXvStjf5nb^`XLvpt2Q1w$K?B8-YuKXayQ}Zt9OJi@k8cThEei5AD4)dTOc- z=Z4LT$#D8^#1?X~!tF+qL=}T8U&2dLMwH&u?~T&4-)UR9*|{&cGS6kQ36D#&r;b)I z{b#}c=R1jCcUAPtXhg`)!EFC|87Y!aeiZ4%>H`0)S}^HLKT+tnNBzH~rT?0w{_`7Q zo%Z{_Zgep=KGuMYLi(M@O1tuE-#U)+u@$<93KYmdB#e7HRNcsiGu-hdQ?IJamzYI( z?u7}wDk6LeuU*uC) z^eWLZ@>{Xbntafj?E+g=W@BFYk@kbz1ph}GE&!5_1Msu6I=qrowc{QAV;vm;JO~?p zHWGU=-0opNzFPH8SB-(VU-!YivD>=5fFT@|P;#prx);M=V;}@m%h3e@B#hn9vRPa9 zzn@U+16v9=7Sn_-*5Y0l#?4~)m#~>9ks5ai>D+%O{QtKvyA;qIVcVwl1)hIqwf(|V zi_=7W`a^Y}Q+ai7H|+V6**Z;F$J}2tJjt0FjdB@Wv-TRzq48w>Gb%p2p-+L_OTBQB)4_H}(v^hJ3|O^N!{}wgv|YT^oV6k9 zIVeG26^fWCvC`|&z{PTJuLef|`uzNgV~72j|7V%xe}1(I?(0_7$i3JA|8ygsHnXsC zf8E?K%jAh#Z`0L+$qO3e2OJ?f1HON9?yzIzpGn@Y=MVDiZsR!1lT!^87NwLdXZFwA zo#^-4v{6{pX!Br-r4U_~gV8=G3E{6*j}g%Gea*fYrM5_v1Z-6LIGn}ix6)hraI43V~QqS(Y{$Bqgtko$r zZF9z-ge?g#boo^TOIUcBXKWW3bsU)?2!p61D!41LZR*t@oB%+h_xS zA|gsun?^-}ayTRq+pg!pR;S&1=B6v;C-WC(Z|~Ow+^#kCa_6TX$e_H z>uY8LP5;Cv|Dy)=FCVv6@fw^_TaQ7TmWa(nmm$sRYrKt`U5o7(mh2qz$Bm}GV|h8UnbpOB#Tsuwe=%s(D%Z!71wW@F^tsomyryN~%9drZ(!)WrStmuYdx z+j_hyB_zdUg_g215Gj;#P(eC@w~&<5^e z;_;C9I~^%h!VepH5_|q4-01+ky8Cf^8Kc5!6Iq38+4+KgS!QWc{^lkiC_=C#*A%6w z`il}%Ze_kYK!btRi>t`=FFsgLO>*fXzH>R$c6e-OOxfHOPY3d`F(cNs%bLvb-JjJ& z&$0nCEDj{__a>zwabMwfEf(%emu1x%&>Z z9ZbKC7X^Zz9rT53e7D`|*(-i3&A&ofMm7onR`P&^$q6>z2QwAcwT5;3gap&}z=irC21_-QA|E|O`M z6qOwzf^WJ19mH&Fxb`DDdM!?y{e9JPll%Yc8UL%`wM9ZCXCCzyD3>iajS!i(A0qU| zOuPgy+9d`0@e9lNC3QOBa|PT7&h_OD*I6p;w%*e!>|3k4p#z)W@KrcP3Qy+c$2H^1 zu~;)&|CY9#HC`WuaU43NcZzk<$E5H?dvZenvmsmi7O-6iIcoi_|Mt zlwUDd=4!k-NBDNrUM$MmTW}W|VRP2ZJq@O#%rF0)AHRyq0>ke}GJ*Ho_%uliMdd7k z?us2kEI$V_LvZ(n6m)C)o!~&R&yru!o#-Wy&>xy90*sML6|YocrEOQ3DYo)xEyv#N0A6~Rbv|vx;mvLK&Tb~RB-(6t!Ma8}F@;dnGwHQvL>-pG~y*n#R z+(t64v;-bJg;%pm3}rVRas`)!4j?AmUz-fQ>HsuOM)*6d|FHYFyXajL={!S^WMh?6 zj1`nCQAs(tj1Yk2-7R9Ai4&ZuE$wdasNa%fWgpDZHpTvO=qg+d-$h!QSZa97E;4_t zvv4JNzYlMi2*=*Ct+F_7JhHSa^Jwg26f8z)onHnqMm?kZlf{(Xe`pYAOnI_g z!n~3#DKb90rXu-v<`^lt!#elE`rkdMFXzW&q=boUp9DV`uZD4g4{GRNh+E@JemheL zl_h{=WD9fhP2n=f=1Lp-Km?vUS6{AjQ6ugQRhUpDw}W zH~JZ?TLLv4T^}lb`7=U_=zWOoVM!u=-Em^klD?*DcNrmI#_cCa1UA%%REzH80<_#p zLjApz>xL-~nlNr{uWQF7?*Ehb{=c0mA@8HQF4e)ZARL4@cO|v0bxO)6GQbGt(6o~K8=>iv-ysvaF>b_>uWGG6US~%gS5tW^^LI0x2jlM zd|Qz8M66fZ>b50&T6u~??%gwEzwL_gZpVLTeUsb zwW#q{jz)H6QNWA!f8JO9A16E^{OGr`<9xH@NT98=5F#7Ac ziD`p-#yq#oXfGt{9Z?)GK#q_*)%tO)Wlp+?HwM~o5$3S5(own5UZuvQn|NDRDq1-y z2Iy=W*d$)Ru`*sRbt!GbX3PYh63Lakf0B^&TlLI=iH_iD+W`l^91HUr6C;&{>met? zd6?KU)>cWsB}tQ+`CF1dFTcBYh}!>G>>++VIQXMK11{U~BwN6=XHa!sX1u0jcVruIK*rtyEuA$H6=885dD1r~U%?NjiHIZd=;+3=mZ%ejQEx=}L~l3@XLmIAz7{ z6iD@^L;g$8$cR(vg2nJzx7iTCp8KdIyYxh9cnF^`=2#u3E)ZXNKOw0aN~6%-(b4$^ z$9J(LVEKxDhE&2+sDhebO)|+Q33>sUdUJ6MVqOf0;<@v4@EQChD^JMzkf;DPlq2N) zBWj`-htN|cR5c+3?^{+E9IyXVY5gacqGux_$1usd@$fcKDM;LtrZOQ z%wIDJ%O!c+Ob6R&<~g>DbEFULT-1MEjnd!z$Wiqgun99>dC(M&6I>gUveDBis#-J~xYxlkGA(=wa^r(ReUk#6`N`w?fM0 zfNLyR=Wh#6zS=zLd{b(kx?cEYHSCgtpRQ#g$hTs~4)+3HWoTR>h*JACcl_KikY6kU zmvf!o__noYpwc~rSbBR@-}Gw~H8V!sCM*hxcsj}pGtIlh%xOx`zUWGmX1}G^c=9d0 zSfgPvS8_XnFJu3&nHwS&L8m7pWLE$F{Cvduq7lPNK?_p9#plJFpdam&lh~V0PGsDp zy&(wAtB+aWOeNGE#vt<+O9JT_1XCO&+i0I3UXG1*Dn`Mu>l$|N;obt{X`U$g?nl&f z&XrRy%!a;+bI4d@)@ZS;%orHY%A)Y0EM9F!kw#&0Fw~I`^ZQoF5WnGh7r`TG^IV4* zNn>Z)CF>XN=2?FVGpz8S&cdIzg*Dk7aGcvDO?Y@)PZ7ARTgT6m|);9+|h)b$pR_^aQj6&@^mm0vA zf8LzGB*@zdo#3^5Hjj6i2pk)5NQWSs5O8H#WVH?% zC>Yrsq|*H6=<;Ijl6kcD7Wm+o{sg2yMkk~Li$Gjr!N!XFHUUc#fF%lFsqMzS3;_!DSt zo<5@KWlFS3gnSN}&O4COKVPkgb3rw1A*@_dD)6N_oHs^Jqy}Pe% zmM{N&VhnR>JiB5{k<;2S5&oFg`REh-@h9$HhV#bV)5g3b@1i4_QhA@ADrnDWp97?9 zbgJomD%!m@*8YR!R-8(+CzfEci@dbCvsE(+uNX8N*zpMBC|S7Kt0io`M^WVJ+F0t6 zh>f{j-Pf)EMHuFqw$EP{HDw+UeXpM{eM4IsKg4q~qRN-yhDtY%wN^s07_JN<6GDZy zb+S=Cd{{h))lKQ67(G(iiUy>nQ1rwEo2b4Nh$*^5_5u6rrSHLSUW@h>bpdwYMeBf9 z7H7jHJ&&JB`i|6(@WV~&)>(K~@b1OVM!<&q+OpZ^8r)8z)K50vy!0h3p^M}fmce?E z6gfiAJNSH`K=|8WC-9X(H=ck`vcR>3n{$VX(h1LIVz%PilZ`z6D}JEtiC^8+jDvfQ z?2PsOGc19aI{LRjyRjnQ_2eCMZYM>my~WJ{h2sEy@cuKfc!*W_jXI^vD=5vu6+$qN z1i1GpFRAHl1${8v^!u(uaV-G=T7UA5^5mNidYm8#SyWh$?H*kp&e5kk1)sHp>rbwv z{%KuQ`u!zgX373&4?pzA`RwjFGCar%h)c=4!WSEzZxIl=A3j>$kK2-MT#|iFP?K*e z_ukKBm+$`#X}VrKv0s0D^@duDL)zFY(xJgQfh2|5=cufEm+P*%j?vO`{G5pqR zm%g~-M2)r*V6G)gmUdu-jQ&i|d7%!l7A*>)6ElEcVfh@o{M1ctlCdxox^TthzB{ zAHi2}u~Bqkvx0xOCE`~UPkH`_(%2Wv=Z{?*zj6r$egs2W!PXo1Q706;dlY#C#}NYz z11SW=BQWo8Ql+f((jO_D@!WxN-qk-CH_YD@eskW_bf!@%BezPr?Co~0u)+^AIN#a5 z*h#K~Hj_Y`H%uvgCaU@5(i#_-8%=u+!RH(L(fGjA&cfaEkdpN!f^KFkFKWOYE($7I|8I$3UsY8jO|QYTSWYdQn1{U-VY8Nh7RtLnRt=fc=uC;EX-iSg?XM zjSr_wT1b3C(%33#9b!0m+5QV>w&cBFD)oTsp$F@MZn3CO3E%ThCU`YXh9n}Qf2DO$ zwp!K!dN()SxShDD_6`BzH{<`Dxpir)#%qxytGv>x7?mkYt%N4;$3J^NwDlt`DRwr} zxI)JgrU0S9PfgmPmDoyX@BB6u4ZZfMb(9t#IbBTt2NbnE`wd>@*xGvNZ<~S|+c%Y^ zxo=@xvu(RMP4K1@0@piL$w_X6RR{ezW&Lgu{LOfL=PAN~=ZG-(zcX-5{r24i?4&fQ z!R{qN!~<}Pv1*b9QCQy4YE7p=P3q*{zg>LrV_dAcheE1Ha)-Orn7pmb1@>UcE9}A1 z9rtaHS7*Hw(#zz(T?xI=qXdUMXAd-#^Ec9`uqY?NWSK07Zw}(R@E-Cn2US+Kk*GrZ ziry?X54JPiCHdJU`CE*4>#mM4w!kO->pqQWpC~!R%N^;XYTRd*7qk6ZH(>PCYI?3j zN4#}Ll)vM^_(FEH5;MzzN#8)9Sk92p_>BKqhyNWeVYq1AuFN1E;%2Fz5HxAeN2>g&9Axs0bP?bQddE? zd!l~14FsWu*>KCF*o)`FWDO;|g0qW)Na>*H)1hR+I}REaRl_x}&pzW==P;}t74uBr z#dd7sPbU}({f^vGVMc|zn?+~^+goNekR6rdUqHx1VtQMNr9K)uB;Wb)ts|vG_w7Oe zt3oZQlz-vy71ov=J?_4dwRKuQa2nw}Kn}sFZa#Nq61MKOt~9g~I;b?^TP(ak0B}wD z>dW~;dRQviHGyp_$|lXTLJMlfMdir65T~tuW>*0;w5)T%iRLPtyoF@Yr}+jMsuta) zPy7UGZ*ika6JmYsn>jMsgnbXT--uW9OSDPCVtxzBIB)+^F&!0dUsppFvKS9x-*XG& z54M%v?9?~ZYwp@#+TXb9RQ>7o;4Q=1m7H+$7N^&aXNPRm%xyL|y4jTU)MS3XeX0uP z7NzmF9_2?~bnLwG2TyIekY5Vav*pO29)t^|L1`tdAy~odBi1yjwQZB_s%PeR0jdLZvtU$)T)( zpS5WEt2>cGlqUU|KAC;|xCtC@+8jThmwNcamv{e4VxZw9yy-Z6w20tz3jOv-{GA@L zD6Gc=tD7 z65=`GOf~|Bx4@5ZO8EDLM@s|t%7=G^JZgG22ypPX1WgW*p*(>SZ$vmi&c`* z!FxBs#ig6$uEP{Ah~ukMEW-8Tiu|#~Q@(j6U4Zr^I{gz2bQ^)6247~`1_046v)S>< z5O$8l?c{^&Ek#w0=Tl9-RGB-jvU6u)~URWNq65b*+ zJj8KXs&|6XR%}&Ngz3+2b_ZO4k<$mJOwtv+78 zhYTq?M-{Q6rOnc8Wyinc(l#Xr0;Yw}R-IrBY18m6LyCxImNtZZM7t|PJ&UY7V)I+; z*mcF^(nWO~44Uq;Z{VhuBd_Nc{>SPGY>G$l4qu+r22BxQ$QmxC&aB(i9GizvD)U4_0?Wwnx&neVvHZ)W|hMIV*OQxrHvIp+_LW#~ zheyknVyTld%>%U6Cm=Oehy6e&FZwtnn&H^M=vbWt4iWYG_7Hc)C(Db*Cr2~FX)(>u z%HM1$>^Mg=D{M+mmd+o^D{OPn32sy|SUA$l=>C2`8ZbdT2}(Sl?iu*w8~0>VFGoAF z(n5FLbjQlykLfEYIpX%%S&3n%mDbq}KOwd=UJ6vqv&XQ|vi2mn!&@T*DTPJq=n12D zs94o^*ehI3fKy3p+s?hq>W%?E{~ffS!!jJ$fUyoBSX-FIZ-2N@Y0HTZP)^Kbc!D<0|+8U-{nEwSkp7dj~q6@Lt165C!4W$2*# zfqWWHZEddyr~gWaK`Pa~Ip<;d-odT_%v-=QA?@J(Pg+n7VRuUZ9G!Q7PRl{ea2=hT zXLxn$H&fs3JrZ!MDPKIDv=>76RLq&D{5Nv^Y>bGfOqZrTkzRhDx0s3|r!o{K7q+L5 zYZ|RW(0ShHFDIp4OpH_u>Brmnpe=lMaRpPOQ(lJDB1wBSL^ul95aH8OVP;oi#5Fr= zV$MeNWnF8-mRvPp`ZNP);wNQQm>3Y^({r%m&4v7H{0l&4mtw$MR)TfM5yy%X68=C{ zhq}MbBo@U)GF`P}Av>bJN@g-|TlRQ$3AnSQ!XEPmc@4*T-Ycx3^4si$#4>{qskkU@ z7PaiBe9i0olLXmds_kkMMBLCxH|6|X|WZcRyPqhEp5{XJhy6rW~9s8r}b~D6I4Xvy@ zBK=92)^mi(Ay8};>eXMHA!p?a=`DKNOLF{pwhj#5|3N>xp~CVQe-Dhgw`7qm@v!9G z(0^(Hgt^DF)@9r*%*-c}<8IuZYP64d1!eonu>;bwHsdK;Ovxwo#)DU znjBo4I&+SGj2>7!ym#1eeX(vl(-LSP_YC~Z=>YP;IX?lbdD0nST z2s4orM<^v%p0(+>EIZQo_o$E8(iQ>N%lRy_SY_al*FG|;(7sk1*%TPJ>s9`I?X$jMv4D?aylGVpp>W7r*&MgcW_O6n&7i$N$tqBVH(OHN_JKO zKCPgx3TQ#RmJTO!%+L~_^z_VY_0Z9()KuQ~D~=J%wOB$Mc8Y~d(LSSu@DzjM-$*6* zUY$f|69qebi@e_WTi?{#6uAO*XKjRGhP2wWCccWdEgmx(dcL`V*ZvkNp!q1ZeCh_C zfQCPR^ILz50tBk@lPB%7c!JSa&$i`U5{l&YMUk8 z40I+9U1#&y#fA6M)E-58AjwwhMa2DvxLYD?kjhK9Piq*W1z(i6z6p=15E(RCt_-@( zs@QSFYFbc$)G(tHWhX*JZafB{`W!qEFuVSC-3A=Q=(+U(1A5wX7r%7#S_?BWq}`AJ zDF`s%H~Mr}6UH|{yUZKxpTJIhh-+$8?ROdnJgI?rVG$QoXE6TWIiz3_H zS7r8xdL`y#0NKgRj7jwmVgcjM@|;bv4Xe}uE{=*mR;cZS(P!bNH&h$+igQJ8je2sA zIDG4pElkyhC^_x=8s0I>r%ku2aSrevAuuRU$BT7+`LmmjN4c2!DniEA;jT<6>#Bq9 zl}x8r?|gw1oBIOLul%IUJiVL2jC5aWqNjFC0q=-k_>2_~lAs4X?Hlv8$G5YdKxOHX zhE3w5lFOyell2qz<7JMpH?|zP^5b%I6EYpE3mFYNU>@+jYJ=Sg{5F2wD}oB5jel`# z6}9;GiBnl{MY-#y_tOlYnq@XOVXm#K@Y=uZ;ZZ?F2ce44!SY)^#j4>T_N2VMjA0?a zsZdbZz|`r@b;@yAO_J>xx!8C?&2?DPzTeGE`Bf?rohFH-N<)&GuW84?d@&a(Ke?rJ zLv&}wPL1WPX}*(j4gIu!p&st#c&1g5ZDORTT{>9!O`m}Mj+1X%+EATI=;n;?s@Gtt z@C`YHqPRXuk`@{9v@V-0o+55JPy%rw@_I5`q$cMr_u~-#u zi%k7XB;C(4zW2H8&}WNgxom(WElNSJze}07h$yuwm1sFAm7OV-ltaksg724va6pv3 zt5Y8k1`89-ez*~)5}$UavT%hdU}zPbA60AK)+#?71fna$*fbLC<$T;3rQKB);!e&hWHxkw0~yHq$ADlhQN1 zz4Lp#<=$fzO@P+h^OtOebT`xA%j% z+ey8Y@VM1;-j#ul3uyw-c)t+3HN-1r!^hRW7^r~wgn8KjAq=|9Hem&tTpqb?^Wuhj z8O(kMzQEw=>`$+%N2bKV@jQiHc{x^OE}>>>$5H<2_BbqDnfxDnz-LTdiL5jUOGUUNb!0u%;zGOfE=ujG6tV z{7HmT(r1Rt`J3zmfbjwhEhAdG9_AVK5Y2M@ED?555w>WcIh{8~5n_%X0Sk1S(`0lZPO$59j=3K zMoJxTJaTbyDt-FXZZB;}0+jmal@4#M4ftRyo-P$pdM{ed3d=M#(N=g89W71L13q|l z-a%;`Sr+|L-gs!#vWJgAR#gi5azDe#T+{y-Eo5CprH6ztN2(GcMY%5bOj0&m$I`6A zdCN>7qke=lA24Kh{adZ>7a~o&DG1fMU)kd>b^x}8OJ;b zkX6wN5qxrR55H_x1j)Ce$*+f!^I+75QmQ#9v`Ur2+6r4$<{xm*XE?EQd}zooIriw| zI*4GTILe!Op!&(Ff~xpU@}R(jQWa2|NQsJcr4tlTK$?OI0s#>a5kd=u zmIRS5fzXQ(@+eJO=)I}*8mXao2%(42LjA%!v%Xog&CGh&4>q>sPjV+$uKT>s^EmdS z;Uf~vF~AXb=-juu_>XJX+;18i`(j+1H6J;t*jLYce(Pk@@9goXAJexdoy4uHi&LB# zDL87Ig&R>$?n5DVZq?p*I&q&;n_`l)zH<~SlBTZ3sw%OMRPzzYL#_giW-fiUyP`JH zrA-(v-K2(N%v5nG4B+sY4IZ04b9<@JmE-+i0C zT@2Qq9CuIi{5t+kf$}MDf&jbKb)1+Gdk3JE<`0BGJ!>fnzGmIlYlKf-ZPS6A;1Og= zMQg4YoR{iw=b1{z%5S7wMG8G^G8lrVG=->@U_5m#G26CRQnFEmh(dcH`h zQJFzDf$wOWEYE4=B#ht#m$wmL*|_>k<>D zk>WIn6T5uU_bG_8k}KM$Z}!cckB1nApUa{|et+p_YXW5?@Y;UN4_iyBw4vEQn14}g zA~JRhEw2lZBv!+{dR($+mCh>3jsbc%TW?jc_6ti?#D0t`04G5@ zi0LI^qMKSN*~{-w`Ub$!rDhj;bLWc`31zZHufN-bek4V8IOcAp^bUx!H`@PmygZVT z7WgU~*4f8SG!1cIH`o;{jG4SpSToW)u4gb}p>%ca_rIV90iSr;w3yj>oWu2kquQZB zExTenwd6@7kqnMk9Lpjuu%tNlhJ_T3AT3Vj8@HydX5Vk;0BtFPe4S8h7Up-0Yc6V9 zMdbB$(ZV`6-79(~taKug9JC1RzREONWq#H%+V0oPvA4-8kh`f|up|NIV@QdMQK@ZYJ z2)pY+)A;93wTHHb2Iuv$+E2A!m54iKzU^@8$kLfL+$iu9?{kmD&i1;Weq{qD5Ne$u z6*;0uR66FsK+ytnYf*BCo~NP0#hE zor$fv-Sb=9Es-d8tveErmYOTc{&zgkTeFz-SC7SS8M53+E8Jk%z13t6;Yb);pb#2J z=C0VXzUs=NCr@9xPDP8aK>5sMfjV=kK34wMAnUdKZ&wli0{wXJM>Io(0#Ndju)D>u z0BpPKJ}{LoNoi!k!sBF1(}0kQM)^MDHfOJfPBvl%4=MHea3<@|4M`5gkWE4Th!#Nf z4iuGCd7}xUpBc8A-aCz~-15*Ts+-)-hz@MMU?ZfvSPevSLW6YdBD)%01sXuH*m!iS z-&y!C)z?oNY7%-J$m<~7os<`mwN+1he63Q+-wcZUPoVqJZcBe$JmHLJcG?Pu3Hf@V zUJT?{B|3jewAF7vz=z!N3t2g=*<0y55pFnN<3mkY=Cv4#a7fxO!l<)Y5!$J0p#G1-F_`>m3_ZbIuI4tCk|!Z{W*AG!xJqs7KgLF zwF1^Hf^OfqCczn%VR1Qjy|+zrS(TIaB0iFk>M#_3Q$h`{GnHhe-l6D_-*@vw1C_W)jj2{ z!#18-w|o#Lv8Um~XW+xNwgot4!^#jK5(qrS9xmvjEif}{*S}z=FJdmD0?jvxO5q7Q z*n4YZ#t-8|ioD`WL-e-seX}(b5jRk<)%|myNw+~7k6~~f z`zY{nE>x>%{OKg@2VUL$$H}poW8j5Kts<@t8)u@%*E=7>wTn6ewxMq|4uJ5(osn{@ zZ3nlnh>|}1m*~@`cWIpFxnkTWNc|6n`O`%&s0S3Tl-a7Y2Q->jF7Bs045}<3+(7L6 z?)2)6zbWrX@7$YI)`6AWpz)|kj@H&YO0|=X^akM;)>jP&)RNGr#Ox;ds3XH4=G$xr zXA=Xhdi&+1DDGl>+BMwMf)uSdr1xMTo}d)zGOf^V7lg zv`4vKOY#OQP>=#Z!&^4gc^|p@$am7Zx7eXyVQQmV)_FBEH8|1xO1IUzxx9n|b8oSw zhkPMD`d+B?LJWkcoWyQh=jN13H>X@hhZZFKQXtW&DeP8B;6k=Ge;BUjdfV$@`E5d~ z9879=pJ4RA|Lj&#PmsJSvi(_NO}e$I=Va+na^t3PMEcs~nbw_oI_ZJkc?(=scjb0( zQw_C4q#0^Bk6P_v!0e9p1as!O2los%r#Ghv(0 zCV$WO_)MOWLGElYdJ$6AhVKls!%97zMz;$2Y|XhL9Wt*JnrkS3nc>y2qTU-irwhN- z8cw-Ox4R>q$!rc6d^~RY9*?cA5QSeK-`qrkS7v1J3jEj?*546?H)^KCIbbu&J*fqqLK z*r&=}qJ2BpSDNQaJV^Sk{?2H3E;4SiXu^y8IeE!;fCM- z0a|%d++*>wy1CS2l#SpFgd6ef!$o;aUGmEUc6MRazWvfWfzbwmN%W?vN6H~VFz5~M zN2R1v6;&~f*QMl$H)k&!oOnQlLX{%{S4n0gx#9)q`3jNHlNzIl8OsHx4!RZVp z#~j(LeoM7U*?RsRzdQMu9Sqc6sqd4U4Gcox?KMWXZ!DCOx&6caKTW<~r4@J-+4*~t zb~3RpA&14!xC20kntQOz$;~?x0^RE;f|*E8?0fTSY#JH7vr;}ar<)jv{7%q5dlKA zYoYI?Lxu|AEe7{NfgkExqS@^=OyS|2v(--JRBEQ|tcut$m@O0#K10Vr8+djxZlx#d z!R4zQPnrD=n%WGiqeC}#ollpX`SvfHW3~bTNMHG?>c%w=5ZnG&->K43eJzaPR`M-; z5RUgC4aiLn2|qzX;Wv$tj94)Ks{{RL&>b0!+OS-7v3pjc$A&dof8;hxk1)s%!D?gP zZb$4+iH@R<${OWc9p z%4ccnWW$qxKa-G3h&KrGvZzMj!wha&cnrOoPsEH~U9Sm_O+>Dy*>4!k|A-I`1rfRd zHmTM=)Ug3dWKyEH(k>VBHv*JR=yR_&u*-^!`d>=;n%K(6V7pRL18A zagp#(T0poEFk>{cuYbFLbj03rW!?fF&_H!%sg7G^hZ?s1`CLuSY86c+xme5SzKOS|W7w8|shYkE;(VSicv zDmcWtQp$PfM7Ts&wC;=~@1(T<9JJw6ppgk5HHE&MppIytzO|&UBCKt6&;0_JAnh&U zstYHbTNN80NI@Ckr2{9=?gJwjH#U7NhutH%%~+gTuLgz%<@!#jnV@e_nKr#9R#Hgi z>H+k|gYAfT)onplX(&S}S;f_Q;e3+yxX84fY-@GeZ66&O<@+aq@4*TwoG;uB{y2f# znKkFox=zKOMpVM!M0e!i%kj>YfO^n~#b^0x?4^S$j;Iuf>(qS>R$47hLZ{t}nXjB! ztydDhAccT;a+59eJFIuCzF@e8^Z0q zGls4k$xKymD$WC;HBp%sOF!o2 zpJC0woN^pDJ>ex6AFpPn`}U;zidPS(@4NXkbHA9Om$5f7Gj`l}oAlnh>RGYkG5s-| zY~9zJP9S@2qfD80=>UE=%_A#F9o!na+!p)ToVtCJ(n9&$BM>2n$|qgu+o zazEo?1gYz6bqns}AO_d;snwr6!fN6w+Nr&Q)~CFIl^)S{jD{BIC4SjQl+=ue36Qsm zHIVr~ey3)UmuY&Rv`XT!q^UyIdR-Z;&A>IP_iVAh)0ltTya~u~&mD{}zB@lRVGM&- zg+7wkPYz9p5}Q?UjiZcScaotPxodTXv>{O$5OtA)=ddl1>f_sKKBEQfi@6!dJ==GN z^Y+$jF_EY;sr6jSt3#P9_#gNB20Bu*iRpQ~->37oVh{5S z5E%{#cLu`Z^0|odZSW@sq#Ol$;Z1(>nwZ{)W!=;Jr+OJ{-}klz`4Iga&!NgkcloVQ z=6ko6QqUc73>b#mrn!NDA=)Tr@MEE*z_CfNT5Idvt9rf}Xirj-ed#6jP}<$3B-3NE z{rB)x$>=BdSyh>BAiHIykv-;Alni#VNPvg|xwi|fCluE0-J+6th8}0vZ%L0%OC`iY7QaH$P9QIE zq8^3p6<9`mT$QDPH%CoY*?>ooBRSO}`89OlWa+qS7;P-UIH6wMwroW_b)9UQI+0N?%h8s;fwZIs1nkIbG(Mzr;`%*{k4Pu^r8rKwV9;p6DMUUXo|!b>=&j6DX6g7 zG%9uUml+vEw!lB^?hcs+>jow_C^GlPN)4XG6Mi_1J-mNav#PfBgiU5Yojg0^hpys? z3o0aIopwnMbDZ#hcf3Af+IwF*z$=Xn?8d90*=j@R@a{fTAKwX(AQ+67B};I% z8|m}bvclyg9vS)$Z>cL=*8LOU+`e@Xz_1oUhcyaWwK!@0Ycb!dPRoU9W{#3*S<`F~ z!pVFQ4<1gy3d{%kF0RepebTzR>ea2*nXG;28Yq;^7#7dh)w}*wTu^7p^A3IQ}j<>tQ(&D_Fm6&DM9nV|Z zmvrm&9&NOU=6|p|ci+IJ+!AiQj>?sQ^o@>^CIOBmZ zL_D1^skCTvArdjieeaG^qdcUY*VQR6cG&$d@Y>l~e zSfe=FKEDZz(19o?^wVFGVCzQr;wh%N`>X6;l81^wq8-+_Dg@d?l}X4l5^>*;QS{C8}!O*EsDH<#u_eHgBw)1mT|3d9&E& z2YM3duw={VyT4H55GLWJxaqx-xfyc9$LgXEq$VLf=##^MN0fp=eOBaa9h8LwlF{OW zzC@&jT)n%CtE!7)U7woTE&gbsIgZ^q_x?HeIeIpp_iGs~+FA*5VHOshA(Ek+fsSm( zy#l;1#CKmec5r6F+)1%@F116Ru)ld>GZ5|VW(Tv^O6v!&B@NM;?AwM^^R+A3M)4*{ zEU|7Zd0{}oP*eDa5lZ>+Ao;r>x}r;m;@+?)4DAeau--OOMb|C2EbhuR09dGKG_wCA zk>`9dN1#BEpoLX?3GJ z-A_M8O>Qu>A+&Q9A~&AY5}8&fdQbSFKH1fHE4*jU5oD@IDoCd!rP#E35_yJwLvRLx zbawfT(G44Rj^mqL_57)W9$fRGWN$8s>ro@#OSthx#qRpT!j+wE*IEbd8}NzV_o`JM z$@4)!om#Wzhtk7`O<@^-@vqWbDm)1R5?wO;<)=T2idphm&T3^Z&nOdP4LCd0F3H{G z_U>cMD|E?r423O5tv@tK1p+f68WQ>DZY$pkceBJ|eexVNVcAw@I%^W~mkUJEy}jfC zm&Gv21~&d1iw2$7hC*94huYd|q>JMlWAz;WJ3LDmXUcQir4QnkpC$OhOCFo3X^FEDli_Bhab!6{w z31kgMnXF!#2Vbmw>uI7gyIF+Wv?>R05Q>g~`+jT#N+6@!78sy*0Z@qo+e73E-Lu%P+n?p=c-a7%lsp%pxLlP z04k%9I|p>SPWMyX|6}QY@BwC&Z~uuUk?A+QT_y>u%Ab6YpuJreq`?$0Wy;|PoW_&( z%kGH}t^V(eDW7(r2dCs0v3%T-V>gI;%&tw|%(kgKS5tuv!{A`qG@1p<5v}M0sPJF~8*G<+ zCFVw7V_kTJsD;w2IQ_eM0-dW=q{-KVjGG>P00XU&`(ZVPg|LR9Ulx<3>%2#0&R>|c zPm1->FxJxnCszuDzYrs?wp%=2&XrW@n^NPT3I0z2jH9RjU|NoXH@;t6BYV7ft6CCY z!}nEJsU(|F_aGlf@%G>SEWb`V`ur32PSh2?$Swxp2;4Xj4yU@9eu0+gE8kGGVL}$t z=2^* z+ZIp-F0|SlFWti|uXnuRwtP;D9N)mh z@{T{ho{C4)({8IG^)>8jV*#xGTVLZbS3>Sy*=I;u4q$hR?R|Vt&Qwlmpe-0Qr)3x8 zzLwEM6_SjxhM^yfmkCmSk2w+JSYL0vQdBE6cV~#jKt)u3*RxIko%2J{%sA(A2E=jc zY9TOdO)N(Fn;T3xP5DxPhkKenx*S@81F9BuO}FMw_fuHJ|Czj^8`=SKPOHj5~!< za4=Wx!cYy-U3_sgvve-U7%`^?q?&7afJ-%T+K82JxMGlw zU(r#v9lYy2WdSv_2|Jj2R}>!D`SGvo+BLGWHC1uY4A`ZQPI|K*ky|&#YVF_|=xjw(epXVt^bpw06?mTz=aG%8^X z{tb6W98CNB;oqD>soD8pg|54eW3P>O9y+ICE67!fM$WMAfpXoR@cQFr>y#a+Z1JQ= zl?E)N9&H>~792_k|5hgG%>Wq6YSvE^j49jZI$WF5=j}kj3q%#ck!Nu_7HgR;VTy*R zGR6MQgRq8SRSC$b2eotB<>b}GjpeBoZg6%9;LgYTovapG9QG&5lCCbE4_W^!b3Rv! zEeUyUG5q}WpxY(2O2?3*OIiT%JhfYE9-WbeGpMHu6?9Kn${TtM%|87&F9CeG8)T-3 zfIaKVtGmY}AG1vikX+aKAx6R+A4KU}z#?734k8~vii`Zq>LzbUhfa0IB3VMuLW#FL zz`esduiXsvydbC%{Ac1dcm`yLd0%4 zHU6;cwS*s~%To{5ICs6!1VlY7=iwWHgpj;{cWLq+^drOw2iQ=a#dWUV&diK)ZH||08A=`HO2{kN|{9`i(?N7~iH-{g@BChVCzzTTF+HLqnw=IG%UQd; zWG{PBFO^xA+|VwVs8?IZ8_+zp9=Rz}C--x;@&CGW{jVooIQ$(7>!FU=>uIdfJsN$& zmRwjFMPgJ(2TEMFug$X{1gzKgn#)&Kpf+9SH1$W8oxzBR#ejRHsk8jdio~LkomxYM z*5A%A#D!>Hdc5Qo1Oh^0m-H#Z+}`$%a|{k3ccF@lR_e7Er6JG+3 zMcGrzM8DPjyASpQEz>1`q66!!2!Y3DQM#qcHrH4=)zRw((Qzk2;#+zGI>t<>;zjT3 zcguVH(>jZkTf~4U5R9>0DK-DWo9%cX+4~%);_wxl4J|3Omf)Pobq6iQyGSu#Z=u5s ze>78u7km;KB@4fr0Em$aEYa(m=S%5c4cdqUK=sF9}gpy-y48U863& z6@gCUS-^w@yz@_ZDJPC~yxIaW#*0W0XKUQ%5!w?h)__SU{HS?RbgXT0Q(RQh>gJ0t zSI~7I0T}SH5DHlGGHWTU^i8e|G)K_h>eF@R=W~H4hGq*xds_dEdu|f_eNytQXe=j< z51^qWArFk?pEcjgBp+wY8zg6zkmBn`0AfgS0noM)(7XR3urmClV)|g|twm85yQMMf zqZm4`J#B-&9(g#duk=TY?OkIu9=QDFvz7K?UIT7!Igk{~2U*?$K<<~AO)j6>@fb}UQc-d5} z9`~+>HR^r#Hgav%z87Yp7!fAJ3(e>sxt$$Wu={EWsyKV=qAW%s47@T{q{!$vNrTf| z3nJy^yTgPs%?z_qkJdDrKU3zXtg%Pow8MEpDta@Zh+1S5s#_Mn1@uFOJl|gQq^lYY>7qyqKQ~@ zvir6?qhy~$S(QGU{T|U>jN8mgC2Qe3720T%!NZzW+CRpESxFEnHb{v{prZpWUuYGf zMlWy9*1%<7D!T_qaS^0Xu>_srr z=1#x$n%KhNYHwElHrA2gweYB|C=#}JSc#83yZL%Nj@np0V4uFN)4b0S02eY$4vq@s z&VihXs4l)^t#_Ye82v(ct3D@q__5Nem?Q_KHgZ>@A~6d?MPskv|NgTak)yF|kY;s) zpfQ~WC6kfl)FZ7?(?};YYI!ujH1F`Hv8QlV=6ndSfhf4mEOcJ5^f(dG_rgFolY>PQ zy&RWENEjxe4D$P1w$$-V8*zL1Q`#R=p1DmnG}~#fb30nPd}=T;3LbB2H}u~@L8|@Z zmM{c>%Rfuae!$9%x+(tBVovRLx70Pe)8;~D(pKTh;{YONfJb7=rk>8JJdxT=!YLKvnMW@{YX_;2-)jX(z+zL zu3cqSY-Q#V*2a96qqN@ej*68zFig+`Q?F|J&-4M)%YVl|`6+PwQ_7Xf4l#YU!W+G8 z&dJ9Mvj#-%HCaP$`w5ZyfC4v-gRiVgUGV(aXL1D&sU=>ASA@p_za?F!&DaV^1pb$!nf|YP%73ctLxLVHN>ZBjUV{$0g(t1btUCP01oC&Cj4@Dr#b(6> z6o~7{)1@dw(l}#`)uWmeGKx1NJ1g*VO!lzOzyi#dD>*i9jt+2l^4=XSRa_qQqST`- z#5cFGUlxjBt=f6B(Ku`NlWQQ*@Yw|0m2*k;e|qu%N7;{DL?iJ>nPNidk z^H(rA_Qjll`1Dt@yB+hGm)wh^QKpUVJ98R}U_G-KeWiYOSzbrQ&X?`F^O10qCRluo;9yabH@H#{?6^_lMXW`R70 z%x&7xIUBkB-m#D)q=i<Cm9Ux+aXU6wMK?2eV9cYM$CPMXWANZ<-b^tO6xexQ5>JAhAZ&1=yzj8hvS zF&<|9mnch{w&P`)q{mk-%P?QI{+V>+;?wR}kwLPh!6d@jm><5M>&(0Zw%;7e&ijbR zf;^_k@K;B5*$q_0)hRKoL|sMOJEv?=mQohqYIgxg7lsfgVWieo-%OFh;XV!RF=%DjO*g#1b6|kfZsS+CMCJ zX#e*AfBlmmrl+n4{u@j(CsZ~QiRVNaebg5z&UR+)on|MKcn|@!B`(XrGl3oom=QAj zcpuAly*;7$0$88omJX|b zplHACXsAEFlfyJJukTt@Tp+uqdFD8rX;ZnU=j28vR#Y}N?fit`&`$6WCH-tiC6BQ( z1)j6HZ<~|#b~P(U)0l?spz!PyU#P*+-Ub?5HTNY=-08)?y|iHZz_u%@3JK{0pdB(c z9VMnOquK7}(U+-mDw9#B$i}aenJG(>8q2`-IlV9gm*n|cU@Ej_8V>aR`bw3W+iuT| zYqLhA^7P%YkpwvoM)a!R9EdG0E!GDHgiBQPW%H&C>JY8*C0#SzDTgE3_3jQz^wYhG zlOOVW>aaNpZP`vbO0B1qbp+G#+CSIv7_ZEZ1TnL0rRkHjfgUICRbr=TVQSi0on^9k z<8jGTn@#lICZle6TZ1b(*nS{EY#`Y#Rbg`T8$sW*iVVt5nOMjtHt`?+DRbsGdG`PQ zO8@nB&zK0h%!ski-jDX$4nOFKau@XE1_cMPKamv7QK#R|)C+Y0FRgE7F@ei<#xwNF zk8g5N`Wk^o!^Rrpal47GZGNz9{aU2!0z&4s{a6tw!M!B^!;Myj?{M`3 z-e{Izer*mEppZ2B6Mzl7iF-SNpw_&47}H5#M1yJZ(LaLL<0H0f)@INg{_&1jB)X>t zF~l%;6bBy9g76(x5xXqwybhN`fPdOIySVRhXX|ByQ!1ure8eUd!4nm>V_uyJnJ^u> zw32Fm?g}ULp7Vqx$fsp-AY|&O*Is>G0CA?NT(W-6a;GlCx)gglK4P)xb~HYXs96U) zkJBHe@C+Yy3@lNl7nAPudmob=29$cx;pAF^%I2t)!tS6^;VVKV76^No^dCQu8PmW| zTytdu`YBk?`qf?c0#aX=UP{(E?Fpvnq| z60`YV@H_Atjq;n(!VKV+mE}k6J%A4Qbn%ma>aNoSJrZ!~p`S5wa!=>hqvjWYvt)3} zNU&1->iqFMp%+MoYwyn%jJQ{sN4}O1;8t zFALU8y*-dPES`Km32%8nh$9zk=OVgs>-Z;cTzpE+CfsViuWz4HZEOl)$A$6>@5wo0 zQKQh#vehr5*(dAQMFyte1Hob`QjQwygcdrRNN4$rZp`iow}JAf0>qGaHJU3FYH7mIf6+F|J2w5jnQ2pbn<0Ux^v~oYrZ_{@=rD3P3iUYd26uwn8s4GW_(ib(=F+X3v$#Dv5na2P{c%Fs%z_w6Xls=2R!yA z|EpX-uF1pU%CrVjg!2x5_~#p!RTrmTUmn~G50ePS|FPXg-lZAt=pIe1Xsot^x2Nhk z!>#5yEh1yoW&VVM#tV}>CQ#d6R8<@m zg5p_g35l*skpQx;P`Z~jr(s8RNu`kwA}t2G54@Vlv(P;W*SAP953`1?O5Wpf zLdP7D8Wp#*08sVzAt+5N)Kgcl0@{rQG;totp<%;e6p8rjp@aXLM&X{JMT*IX{_tN{@5e z6qSZ!K+W~wJxT%|_M!AGkH+v=*7W$^!X4^Q{5kzKnl?^M!{{a zzT}HM%w#)B=Ra8{MmWRfcfR85mJXP*>MQ{)ESxG-ty#)Bt3hv{ijGs13Z_45*91zR zpw39DSvbE_vS{m7zKWy8NkM)}J8=SnTbByeqsJUC0J1sjm!GJ#vYEy6Xk3sgvu>k; z(itUE&(&sn=WU&A)x&gE)A+c($$!N*shpBfs>{odHvCR;XA1B+cFc0Il-j_q*Ip@R za^4m{930Yky4tu=ynoL0xgM5HDc6AchLUy*{oscNXGB%Kb9l`WSIgIPQC?Pv>hbIV z73hQ73*o~SU*(j5%`*C0Y7NHhhJ11$kV)tCFU)xg;l5=57p57ILn^Y0M{A|o)POg!fpdV4otx(iX>4xDZc?u78-{hVm)_;qhKCN1$XJb3OB_x(z=l|pgTK03K z*xA`P6Bm=airQ24FEe(Ypu(D#<&4hh8xzi?H7?gRKx%SZHI))K1pGIp%5~5VvJn zBcj<)b?R4DKQ22s27^O!BN)JvXE-Vd_dQI%O$(KX!NVm3g}c zGyFWVWY_Z_fn}AK!LC`A(#>7tO_dPr_`7^IAo|CZ#{7wqb%G>zJ75El6=)1FS+_COi`EBWO&t&AZ-NNoU z_`~D-jZtJ-MV_AWK9!7{$*$?ml~s@=uR%r~x1)5&E1fY>tLIPeAIZ*8bi z(IW`yJ3BTlna3H_g1XLj8&C1ncx-si(Gu!bf5hhN%9>Yzm*A(YzF!I*2wOah>}Jpi zaDyxJTR5vmafoJKRxsp14a!*VWiEXxHV-f9@V3$rm}e zW%AxI_%J9oggrhRaT3m3_mJKF4;H|Ik%TJ$v`J$OD%L`RYpU^>^5*les~sYRvi3HP zg`IEi3AUSE7@Uo%*oT#lkGDe>_KUBv$IMJQeekbNx%;>*sLvpcp4-0~pFrPA4P_UR z`c?Wif;nVgbaGMLlPGsV>!VVoSZ@Ep5HLJ1>WIssL*P@{EiJ{B$tYi3ejaZ9({H1wN5@jyc!#x)VV+S*JV-~dT=W_-0Mo# z)>WrDQ+&(*Sg)*9T9T0pDAZ*noCw=I$$fzavJ7EMtKUU)jUSudeoSGb8v_B}KX`9l z%(@tEc|5l>ibGUbLJAH0_+D)AP(fk~Fi3qh`UkktMQUOShzkojFCgGf;3EPZON_&Q!#9YDDWQJlGtdS=4slMc&z#v$NJqHc;7>` zcWI}@1hz8 z7rB0Yn>YA~yr`9&(PL;&^s7Od<$~4{?=zhiito;Q_2VCR#oi(4)Hv8pbqp_WR*cAZ zMSu-Q#-_-Vp01l_HM$LfktY!c7KjMXqiv@T&2oby8y_vlgtbst=|zIiW$JKgSM{B! z5ao>6X_31blEqqIQ`4vjyWJEqjWT?K*Y!|dfJjlB@{-ia(@*P=G;%8OJm7Wb91}Bu zIvGKE(5TQBPcAx*AgF2s4{w@t?i_wSYUpge@uZSijDkA?*mXZR0XO{4j`n4Xq$mta zXH+g=$v(0CzJ(@@UG4AstY(vc(cZj|1r0?E!ByL0dabeV^r&N?#pjwMXclc&4w4j{UpR(cE=Lvcn2Hli zA{b;vtL|!eiL=SU-u+!1nxt)hYl=d}8j??4CRUA_Rh($xB898Boge{M?4;6m68$KN zg_pxqK2|Bg&KUBeN1bv(ocK^1>!%WBX9swc*B`4`8dYq#>^@I<{Bz6q~~%(c}f=>?e6{#_)AjG(x7+iy+g)&+kD9t@QlVf9ebeu> zlNp0pQ}@PNw*~(QM@bdxpXr!^;u9(wN_ofo+ZyX?E-=O-;cJ3W`s3yOa%MTz)z^EQ z({k%|xhKV6pE@0-$EBG5Bzg#sWBm@@m&Ba<3#Wpgy8C8!1dE+MTF6;Pfhu%rYJZJ9 zCq-`cWIL}KH0^DSPHOL1d&J%!saVzgC+O#1uYK&5`mjqRuVs}j%_O6IJ@IQxW@^NKjN(^5YB#`5{vU=ez1(0gd#jcOHVR@paw zMB@vacGazbqRP_Vh!hMZNAnSR{?XpEi17@C>2(#vqcS-BtH-FLe^RyPZRaGBOpB?$_7t2@v$F4sg z@M!op1o*ov_4u5<)Fou%Q=S0a`Nq7S5$AE#c(#8wm6y-T_uVx6{K;K(mA#R@fTZSy zSz!)=cQjJbdbITG6Bl~N?-2Z}Ql2yi%lqH5x39?o}q6REnbCDaa^*eGt0|WXC zaK$>XI4LvKiOR!?=#gLvsn~~Gm@~2;@Z_-Y%!dGvoD;Y$-tQmaF>{-D*2b)YQU3wk zhBVah^IxwxRU!O$OYK%~X~!D#r!4I9D-q={ua87$Y_Ii;gIj%MZSr;e($A2-9fv>9 z@>r)sxUhzQTy20wahfS37DkE{+CbunEc{Og4!r!d{%{0I$!hr8yz%imAmTe(;kW6` zJHlSp9-XM1(}W^;q|SA0;Pcl4yhE+h*qaRp|L$R#G5x3>GbK{}e&^l*v)_avh%s%v zvQgqWj8~LZD^uK(Z{j$4nWZ0dx|4mxv=;9oJ(XJ6an0Y! z4*AkIHZLU*(KA*Bk(uRD7Q5zkJF&c2Mjc4#kT`>Jl~%Y5XdxM}OmpU`oD(y%!Ow1- zaxgC_eCL(g?8tG=A(y?x953@vwYIdq&|QG*?pprO9ln#^gu8ol2}CZj)M6;=*-cNv z6tM0rL09RD8{Pn-B8N+2)ZRX%Es^Q?x@q-=>q5spL=hD_&k=@8=GMii+PtBcAq5Bg z@Qf=nshwS5N&h{%4~zcEx|d#b-FH-Lb}5zr0N^BJS*5>3>lF@y@9)N!JSd)BHk&Fp z_LIj;SG?1L%X5Z!rJXh7MbXoBoA=J%va}N(IRmYMGQ(H*WwG%dt-BBS4<_QS(KtN$ z={c>ucsgp=bs~uNed+M!s6BkVsj&uSE?Q#CPup!Rd;3|B5m0AI=J*RPsfVvwaj}&1 zR1JpQl*HRR_poK(FKNP?;NE2yzKA<9oQ4r)uzuFFj1t!RLz^#Py-ncWfWWP<{oZJS zrq#Jmi};p6mI_cuM_9ydJ4@)cBeo{2rgq1lI(d3*RbBRx8} zyT4x~{R*}u-nNQu7|gyOVW5kKt;C>kBMRBbyYOec-XXO7j_)`v^@fBOcM6@oW6-nP ztEVWlLz>Nr>K*ZKS5xHl%y7zZ#l_2ZvXZj;(Pgkf_sl0tgyKuTv+tEa84JdikbrmMU zo>3Ce!##b_s=sV1srUTz$Jp>kmXDlSABG(yXG>#P<$qM>jpGcD*Pd899qR?2zKy-) zd5sXs^N2R3D&u(DfQp4}T_nuYd&>oAU5>q18{h0zE+?XthvvUM?esCc5j28G(AVue zFE|MH6NogYiBP+3#>Op175bi@FDU}-<(S0Z9TbM!%F2ImcMjz^pe~TVR+Y=;#N`aO zN*Gh=q3EOYZilBOae&FgrZGL^e~bub=mLJ8(~Wm7jQLQxJ0y0M50z#Q=6)4bPZWOR zLDcBy8w|(S?Mv>(bI^ziut*Oa`Qa1@sU4zo$F9;Tmz)0%*Eqhd?=k?GG7)m*5e`9p za)`bvDDb@{s9_!(q$+(klAV0cM0P|`3EC|m5Y>PNDEo$p&Z0c{nWpW)!T0|U+IeT~QQ2qKDu>pt{_-qj8-jO3Y&f78bp>=(lWyET; z;0!s)k%M`>$PV6}#nSkwWOTc{5Dq@$d0&PY-2~HAu{5sicbYWDmFdrF++OPr8y3S@ zHhvC6dq~_)`*n5H)@f4a@^NJKE40)Yb$Le`n}(NF(B$xhY(>)@&nS}O!_#y{=#4g6 zyov#&y9WGbwiTT_vjGI~fV1Oh*Sta4VVNE^?)!JbheRolmWz`nRHSkrbTBV`v+upB z1`HM40ay%0esbZ;*8iQWFx;iokqYY)$0R+zseZX@nAMCjNK^-&*y{F)=HZQ3G86_$ zoMHSv)?97Bo~pe0LX)sP?^R~DU*dPxU~haB<1^IJ0IJR2^sBFDJ}k-0+O*spwC^Hj zm*G>&0Phk(QtO8n<3q3xxvWAj;b)8pSqx&Oj8bNF$p3Sq2ux(GuY~)1T8>(zxX~ju zFZ*k&J>NJP{cOEJ+FKt_!~`<5PMQc<>#;R2ME`$`y=gqu?f?JXqHxMyq`_E-WEY|Lc}} z9y6cMF~@Pd-|yG+^?Li@L1CUmbt8}V#K=tH$E_*0Pcen+edauKFyY-2GW`z_3T}sg9`N9;B4~jvruOC>!<7WL!WwcAoBCv$v z7b^yVj*(uxYs1-_|82I>pJWwg*E(E%gVtXi#$^cvV<9AFQr;_QO3x z)!P9?ZVU71sV7|AW}Xj^_C<2XE353ud*=;(cUQj<+wb&81l?l+pOlADzUz|;)!aPR zC?{HkLdw?4k~gvKa#jN3B$)6-6Ul#Vo?z}YO%<$ndO18{wXO-igM9VpuuG4r> z1zY0PGB0*;2I^oV&w6Rt!#L5vbF1Tmr zZw}j%7llb#Jo;2npn8sSO#)mPmDYK65#FC)Q@ggdI$ne4F1I-tt!W^wI@h3-Zxu7y zI*g(`ns##Ppx(M55M#ZI_dZho^Ts=k&ub3V<()N05AR3(Sye{GIO#?|U5V5P*h*6I znR(a39LFbm$~x%WPfod-KDN$@=owL=H~#vorQAjS^kt0UlKRwx5W4V`RtMhPNqz;V z&62Gqy34!eyAs7iPYFxp=7w_5gNrhJapn`9nuzj9TGtlt^R|d3>xmm=Ef10~RsG!> zu&(q6A8}sg9Wx!qh@UXKWxw?`Flsj?2Vd-_yAtQkpQiTWm#fUoC7-oQ2jHYx^jIxy z`)7fwT%?O33~~f{2rdgf3OBON<31JSQCs$|Qm|-Q#>3ZeFzD^izZk;Yups0$&6s>E zKGrAL=P+BVt5PAw@^^0#J+98h{n$e4LbF$>6ypnqVU{?0S+R3p`%j;8ZV5~b+?moG zTcHmMDYrk*KcqhU9)*3ry&lv}26vN*i<&7zVB?P7ku zB0!bzcy15{Fx!kX3wxiJiNf_CG|e_QVyT&AOnCGPmp+KvFW#FK*d0zMoF;zW`cOc^PtZIeTjXtUBh!9eqH3|Od&|}S2bf}clrvfILyz_vDckp zQa1qq$!;z_;tOg*Z6@av(tVZ{p1r1SJFW2(1JqL!IUr`zF5}`#&MOh)pxb@eN-f;m z6qK1kSGz)L;PyygyZLr8zqL?;>UAB;8PWLcaM05*7f7t{yh6|h+Oy{(*W%>d!B}nO zUXMArNJoW>mGv*)Qx`7RVe-og)oFbPkx$WeUfQj*)J^^nKu%uZq}P zymIHIktn-ina5g-YlB1?2lwui2_pYaB|j)+((^QrbieHbQ_&Yir;Wyh%C&C13!yYO zlwDX0Bdqv6Vj1x>`%QN3@+#ZC?)JjU)Gc%OPZUJ0?9(6+AQ;eXsf*1o5Um4wW3noZ zp{xQ}KeZ9lX*SjukfQCXj|IsN*FMe@Z0`Uwq7u!t2;$y6{o)sMUKj^!T_bfZM0m2~ zRi0br(=e@}VH!%d(Q8YftYDn6;jt*`1Y6Lmuri%YXi@`Kyv5byV^t#tKjz(=7QlQ^ zDO?2fU%CduRLp^q#ST4Lk)p8Qiauzq-wqG1!#xSOdmz+i+Kg)qMC-a?D30e5{B!Sf z^Zln&ho{noU^TFIWRC#Xv>`~2UxMh~@(_uG$~Nmlf9tsGxaNOntr!u*2RZUBX)?~Y zBgw6ZSXQTIWc(0v*_}Egz_XqcWDMom#bEIlM4Ql54 z>r7zB(VoiDJS;XzNd@Tnd!|oRl3uhiw+hAVc3i%?rtHV%n<;Z61tR54(PGBF-ErJn zu6rUf5ySWQ%txEmso!>`ja~5&7u=N8Q|lr?Icw~w$zYfK=IAtbGerE3d9c=cxHd(juyFiPm3fyph z%0XMO=+Y@NVM zvs%@!<4V-#9_P@(;o1>0S_~_4B~<7p&f%p-mXg;W_TK&bI9L;1SR|a0Sm*AN&Fz+zI*+wY-y%qm&iYrNp*(92{}@Dg*fy zQ(rLJDt*c0lP|WgR++6NNZkD}c9nOVbgJww_PnvFSpXZYV}CVgKrk!wlzvyNx)%m~&}QBUEt zO-8(D0%zyXMa`fMm8IcL?mHUI`Vt!WCc>we&CdNz4gFAfZ`#_-h<_|)I0{VZof&9u zXpq=lGkF!XwS76DL^6Su=Ep(YuwG=GS9YuZrhBU1&SccT2AH3Ns{zWwikhp7|1x^| z`*!_We&69ZYQ;ITLWVGmME2Kz?@Qx4=UcH;hqngo=EgkyD7ogo{c1Vmr}u=fzp;U= zvg-$-K#QM&tv|Nn^c9s1SyZ7p3I^p-^SzG}NEA#Yd zFaxcmBsWwAF4NO^Uu9_*QI`^JrYhodxOd~fKNKVb!=HTZxd4YS1tqHjgwg3dZI(mACMIrDrssSwS zp6>G&G|2p5&xg=q1z{$u{#kS9&{8#?9<0?9I8&m60^2YKt{HtNPi8vOEwy!C@0?ZL zdG6!3|0da_fnt(MpWZ#+?H6IvmK}@UuR<@gdgs4IxDhRQF(rDR#RAhxqNXj1yWYPJ z=t4CQW9LQ!eB@g`CvJ#4i4#T{yj9w%9}qs>Nt4~JiISH`?ADp zw(3$Slf*{QrAn-S93OIy939+VlpuZoU?z|oTT?gXcF>(ju$G=!>8|1QjEDQmfYBQc zyug@st2;0sVufTgZXH{_i;Qm?6zt7Gia_if{GS<;r5BYuH*0bVU=ePFtj$&`J4GO;#<0&3+{9 zRYj%!X|9kij*6Nz-OKQ}n(NWBEKKX@E9G%ouo^0+zoNE&r}OJOo(H_vH&BUKiUbRUsu8tY7Pd?1@ynMJw)=?>JH+uFY z(Tf)4Vj*{OQ53cjzKC<$X)5PB7gSFh+t_Sx7_Ikt^C<;4?b$fDZ8KhJub8j=tD45Q zI(*tlB~d9(k~GafSWtGmK*Mj#M+pbnS;S2nB4-V$QCu~}bva`OwZv;YjrSltntk2@ z-GORBO4O8{C$s;&JYw*xDy6Nxjm59ET&Hq{1(3NG@A9L1dIqUc{zb0x?zhxR9m3hn zbfxEq+0EVE1t;-)0mF4hKy%swcqzjlOdc^Dd||)+%p|eHWtZ88)oq>wiZ(zD)~O@5 z5bzOOn!M}Pi?yzwH+Qw|eTLS*^tNc-=xch1j%7awZaXV_iBS3Qx7_wpc=baxwI3Cj ziK<@zLFJ|JfI!3-+~AE=Y0zCT7|v(Wo^Ev|X(;Okvs7Nb`%;38PpYje`Lbx`W5rTF zJ{6DTlsrWk-zHqeu{SZm(Ml4fyV=H4uR-8Hn`yRG0#aiAtAD?9{ir6*!mAfI)cR6C z=YURHrBOahd7!QDshn8rJCsh)g8NXxcwd(IPp`)5^{gHBdWnb}@5A4PeC%&j*ZiKf zbN*bGMtH6MQ``L?{v3Q^TXzt3QCr8G6*f^Kg4H={4y0B;tZO65~mlj%SBG1AD~4Zg3SUTC968VN@UFiE$WA8iEVj9U%B1K>AZm}3!16L z)uj*R>L2!Vl7xCF?qOq(qwEzyUZKfDa;bB4kIZKpwXL6P!_k|yW(Qpqd+xeoI61!j zMBmQvi;fadd;V~{2Oq8aJe_PhK3?47xkZ{TD({0(gCQp+&DqJWP^D*r`_R=pE^lrJ z|6u;wq^QbXt3%`WeuclqAjh(%|M6vA^VNU8Q?IEkT;!$?b?`p*>h9#*cBQdZLs1%w zpK+)2Lv(~^1}i0Y0LQ0-u?6jyT8Jy(7*)r5E8b-Y)z<&f7}Lb_=@tbquci0=due8L zDoki|Q4A(?Rt`SFc}5Ol6;BpKb!Wos5af|6J~W=kpsjcJ{aU2%_`%pfPocw|=ku&) zd#X_mJ3ygjs6+5dT%52zfdk{s@9jDoND}X2%T?>0oKv^ewglRUH zU$;2d?6l;Oo@CGaR!LvsbZa?-!+(@Q|9-Onu||Hf0<>`QluDz1FHu6cM=TV~x4cMH zP3ve6h*Jl|Q?N21hYnw?TUX9w5rBPqL6hzbH76W*1 zK&j{C?a6R68Ix7pp67e1Di^fS_-qSbzd(7dm2`uyzEhN*=1^%6v9qT*lx_RFz6s^Z z|5&pB?~lqWNvAR4z5<_-9f@&G_xTgsc&;#fC(>ypi`~mZ?`i6GL=s>w?D} z$-gUwgASht27FgZaqAA02pC}0wDxo^3JG>&f|?;vxjJ>_QJyWL;EmQ$PHkg8kfx`2 z%? zy~uLi@zEDbJfOOOT_YRPJWWHAl%7$wa8r6tbN+jxM6o64Rh+*6w%&6IvO+(K)GN1` zUhZkHQV~(;Ta#d*QcjHcbH!yWYWRxNkN+O||5Z%?PrM)sdTQ#rR|q=ABLS|QoB$Wi zVrsn+eV_j=iduy%4JRxlXqr)V>OAwnlq~=T2x!B%M-%Vyf!p0HvEG+N%@BX27ajYr zs0^Z43lPY+;@Z#6|qP;d^J--j!Nls|)m$yPcu5-JlS@A1kj`pjCH}d}` ziT}c8BzB5PUPCE!ymPm0<;$GhL5`9oce*04gHK21)N}vf(@w*iALN#X`g z#ufH>uXu2*ETrozh!(Ex@;MFj=mgM*B#g8P9~g*c8RR&%iPwyUDlwj2^vBowZk5`! zf3zPhcj}v{Big!rzeBV5zpjEQfg=09>@L}9URDN}`^@DhSA~V@KKkZmFu5d^ey&Nk;FGBn@&p2yttV#ap<^2-3+Q^k7$nh8Qn=fAwaf3HOgWL`WvafFRZrVpLzqffT6k>s5U z+KQii=Nt<&%XKK~8=3z5m|}^`B1_C3|X0Da*s$ z{YLcO-bH}w^Hrd#Uu#f!q#~&)$+wI{rt812{0O!&=U-+KYp`qf{^S-MzHoJRrZH1T zX1zaa{1Yw;1*9#5kAd>1UE0yxaElGgjtw+osWhUlSgA*o`tU{K7XN;n_qy(!Q!OF+ z#=zjw|9x*dbE*>e+T|RY2QY-NMj)3N6_VUnq)*jmE6U;L%C3mlm=0>tTB4&&#YWYC z!)RGfE7JzXX1IJurC5v^KEzS?Dl&|8$$I4pkhM>mQ0@8yx9_@M=$0> z62eKFM8@8%C`lTMf{*41^28+Oc(2cfvF@b=2RLTF3O8%tuFjM=eEL?z@k2#vFe{C} zw}9rR)7$_5V{0{_`|aX>JsOS@xZ?3=N`i0dZle=UL-DVu1bsi!TpYr28Y;KcYaS%u zx2s>1P{#T&_3-l#9eKmU#u{9OqBMAPOpbQL7`z)KJH5}=*m%SGrnan3v!}v>M)Gje zQ{O8|6*>yv5v|>{o_V8Im379NNExTO!|JJ4G9fmO+-Q&;zv$_Z_rE^opRJK6VD4So zQM0iXycC7`hmbjgLfW&-uu`VzOMEJu@Fc*lAC2ksE#mWn`>xs!Yy!*^i*(q{%@p;- zgw*)^JVc4;uZciyM|bW}Kcb?Z`_g z)~9Mx?>CIsv;WR~QfP4p;o?~;IA=Ymh#$|V)g#hqGediO1(dP2`u`Q$GO}fuoS`5~d7ufIPhAIXPHV2b0M zYW}LbGF|iiBW089$e?0BdZA=#4~yL4K0MN4Xmv5)&=eN93*cQaz_XR~mkTdJ zhJ0E%XDRQ0{qmJ80M&B9zzN(T160x7QSXo)1Y60HTfnv z9sswo*fmn(4y?1|6TWmc1Hb!jBbH=Nb)QoKg0r}a&|@NYzcvT2|~NGiU!vvXe5 zdu{bq!E$`zufNft|M$h@->cLR3*B$0C|i$L{mVc4`(`hC!J%U!hfe}O-QII8-t_1Z z+0HQY#ORw*zkq2rjy*XN#F*YrT30(>b6R+I){}ih8IkZyqhidpB~v2!-hdWcH~mfU z%9!R##(ca46!T#KMQIhaDbdm(V7$^cc?>u4&E`l6(4{I~@K!aaxkiAC^UAhzMXI#& z0=X||RIayXZGBbPA!lGIr+mK#ot{cyr`GLX5>7rKumXK(?oZ(S40hCEpsB-#BCa#f{Dod=;(asQi@8(9xj6WPCt@m$Qly-Dc7~zgoX}l~6Ahi|x}~nMuMa z)@?itflKF{^op}!R9|Bd;6NZ)-1kmGdi%n7`YorC=z4gvTPE**LLY13=F%Jjvo<=E z$V4w~f3fJ>;+%~rFAwy#UP+k~f9|DlLIN=wT#oMy-|Z7m0Z^7_2`~5HNIY&LtW;6N@7Py=gx8Ow)rwRl-#N@%KUhyJ6 z$f-X$JAbD}U!S?0J`2@MII7dhQ3f9k_ww-Hb_&|(AY_qvRfv(yeQ4yGe_z_%w|xZ- z+bZ9!IeUk#waOoLdb9havg;1)r1CO8(lN7=1E4j1eKv_^dfV-k zGs{rGgy@ggm74%Iw~Q(3>fC4$Iz9_iJn0EpAeN-!{$nMFZL$Wmw%M+C0*Kbx7<~QgmFwklSFT9_&Bw zuj}WtK)=!Fej5I%>)!QSsf)**dbhaUZtaGM%9)<1qcFF3(WyI}$+_&E*Qaj= zXA`arQ)%%Pl9R<-G6egMB!lm-8o# zs7%=JD&6oKLT{t%o$%`ep!@svl<{}>g0srrV(m$J-7oK~oZLS6rvLQ0?fXw()k273N!|mV= z$4t^VK+dhkkL#Fk#u4!Z+0>u`?*EkcrZsE~RpeuCRray9cb^%cLOt{?de{^|rVceAsX(;%P&mTv zK-a~u4`y362dQe+{iy9TzkVEw+vnXdx+-~ZkndChW{rAGZy_z_CferD#%@J<*JcF4 zOt+3{LN@sm+#M^(f(RTN%cs0tk>LNucww zz0IoY`qRA2)5pQ{i^tLG8wOSxYR}ee_$Z(W;+{ycZ#*f7GXlZ$aHDX^nGAVZg}II zR+HY13SerE6n;O$Rk-&yt+Kmt_WiE;T^5NVE>6PaS;(gt)%reuem1Ny2S-6sqPKt$ zjml=}n^-fJ<#MV=NI3MdKx_3M_d%ICm4;+iVV`ZM1 z`DTQQI+BwpX_gYs@Wn%dA#i?5QCPUcvSqV$zQHmM>XrcW2mTXDkq5$R&|-Y?4`Y!!aF*AIg4}Z+PvM!Y=mPi zUhz@43)N{P4ZNQYx)RujA!_c=^nHZEjo&LKTg70y@6;U@gGMD>BwgL6&CWM$4%k!M zhVZQr@!s-=zuu}tS=h!=BCy>n^BGT^?ACT+TtYX?+xNk=jG%s(rLB;TOi$p!dizbD z2Fufy0o*Hxu!|xrK*wSTLmI6im3TFOC#5yToPX-F0ruPHMi^~EGoMq#^#iO#8)(=6 z`b7pFVL9h{

)9__wpfl3UIue~Qi=NJ#bKkfX~x?@K+_I}YuZm}ich;Wqu_%{zMG z06$cZ@B=c%#=tX5%f{VHYR^alX4O~a-Y5Z4*UN7K1$je~`Qc`wzISzBYIZ1~8Sgs= zD(i{+(-D%ZGvs5ytDbYrc^ydeB=rRXz}I3Zav@Z4k9Mp+r&)%W4IQnZX(a{Te8+lo zuW1k?Dib-yWHHRR5pcOy=+BFIb)gsD@S{F}a->FQ%P*R1M(r)EPMC#{7Bi_UPeBhH z!ZZ}=jj@fm2I{W1VmT^m{I_8$`TaIpBV*%}VdBZ+ZtZthpElzrvw%jS9(a_@iN>Hu z*QKHa_cE8X55zyPlz-I+^Pr`AlH8i9Pgj0Jl842b^7}=?mo5uzjKBO`Kgui62&qUWF_XN60=;)%XKTj!aM*gkZxqv|+dJhGF?me+ z{EhaCK-3XWm_8{pBl|P>2ZCUW8b5viF#b3K#QD<#cT~;+=G3;LEH&J_n@i_a@+q7q z)Ao~nfX@5y@*mV|v+Hj*^aG|j1MlNrCzR`)ZGHZWtH0)9{3Xo^&DHFmoGY42)9keG z;G-}G6&Z@molx{we3flZ{M!lVYgin>dRfi=TmAkNWbk?W%8Q}u%Bza5;lSe^$$6*E zu)dgcYVZPU0+{@T-Yb2K8gjlu!!Pg?-xs`z_g=A1lf*^q&qLn?GG21e3H~wsDmW?g zX7~Pq9eqV*$9!w9_fvn_ck=T@@R1K;HsY3Q9uip7D>b1_FAhH55S-i><>JbD&lG4I z2%e(zubJ`Sn;~s(^NCp561=2xtA4G%WNqGM&wZ~SPH$Hb?y&Ss;O5@Pp?7HYbc;ZY zEQ~nQSaxeQ6hMvxZHwwx{I;HBS0|5mIOQ&N`6A74pSzbVn}rhe^SW#s@soI8tyyl3 zK|X>>4f%ta|Bm?IOwXjpT>ajKLLYU}D<8)Ff&IMs)JcaA-3hzHxu5e?eYlr})0!1S zSvfRSj^&i5aiPeS{3`SDIZNrNRzKXTC~{gb;t( zz+T6VcSClXQk0b|o>V9-i5nQ2nl=MmxR@q;)gD zVjP%O<{&sT=*CfB%=7A2irl6#Ufr6w7B7%0_2J(WG=i<@Dbw%RXJL#EtU~RV;Cvf5 zhZL=77(L^X{OF}Ki~MXRL&{-g%e{IJ9EA8xtn!Pu-UDsAi|j3ut5`D@DRy_x*hP_^ z&M_f&gQ|yWk^WhXz4wg+=1Q(jSQ`|FoKV81*Y`0jII?Y+ae?RezjtY{SK5Y_8%c*` z?)?rpVJnp8#U@qY^SBz&S|OQD4eH4bQAW4uXPzyE*7-Jm%A8{%kqh;00_CxN=A%{} zxG!L-t$TF-U~8K9UAFb4^>IY>WfzoN_q1QtVf|XcMtXNMBaf?>-y@;P*QN{_m@tLR zu(kNjM+NP7Oo9Wl9gRxoeB_t8#pYxjVtqS!MS&~OP|}c+7MCi~CC^~+me&e)V9?Y< z5V{dvJ#5UWi8);Ad!b!Eco*&F1lZ4A#NKVTlenP9r}!#3_$w<~;jBpyU#Y1=B0`M9 zZh?u&8SbY1-46#VCu3-z3@ct3qud%lMtk2r`?ZmmC*juptNyT&5PN;7{XtVb&}pqR zY|(BCYTJ^-JOTRE^}8*Kt^)jp3OLD(nD}#{I*}Kj^DA(Rxu()AyPqWQg zjScsv8@v|_UbMgh7vj2hl{@6O=O5IxZg0s!TLWUtRJh_mF7c>j-%Nk3n$5$5IsmXP zkY@CK_U?g(#?ch`&=T!>@aq(ON0Sb>eJLsCzG7PM$oI+byzb+A@C+C}()geV@;IJao~&_mEhkmPh!ZRYV zPezUH^!LozatusJC_~#lh`p)(LH})}{e1O`GJI)g$*`fi5PB>UxKpBXe*Ppzk=3V8 zsKXDQdRID*NwT)6A?l~1T~0WK`SnMYZ6bvMk?_|pyRl%)yHzn0h8w~H<(qoG4ZQ1n zssV+i{)T{je%3HhE#->DW;+CJ2>rFZResLt=vw*E;hx0%Sn&EQ`uoRL26%7hhzm_= z^)>6rUrgq%MV9Tq+|NtZtd;oyjvU#kVL8fVci}aGRd(zc;IaVPmpmUk>ft8Ne$vVW z88l~$%w9WzfJ?F<`;sU6;g&lL4E~B}_AMPN$Bmj)EH}ixpUk1^93-hRe8hS3dBTZP2!@^4aq2XEm-GgQAEz zrQcm(LmCFWkI{R84m#XREqU17Rjr-(+RC=U^*2+K^Wom?kl1+M+d&Jd7|I{~VTUcO zq;P1^y_sFBvU&Zpe1~g%@A^mbW}08K$Te_M%gALyaVkhRiMBg?jxkIHg`$!P#qG5A zXeWcNi}nl4LRd}x<0sVF&9*NRN6y0u*yWzvi3(= zoO2M9j)aYE@B4;jlA!dbY$YDH`;GEBj;Vlaz*L_q_~47ZMG2w8<%m3;Ser@Tnf5g4 za#YsvFAgEIKXsSBO0;P5`saKRxc|lJ5r*>@_JwyipG1bh$1`I|MR!Yu8&kVE)7C={ zx9Upoyb-RaWT2Xc^%UT0(x39^0^cB^Yiz^Lhr1}Fjx(W%{*eLF*ViB=PAkOQ5=v&b z4}ntPO(}iTB4A|y4`n4pr*v7veSf5iavEd9j9E28)2drP!|T``O@v7jvD}$D`5p)p zW0^C%#@)3#!vz~37&_F6*T%hAPj1A}iy@olN;U^8>dTH^l3ZiftJGeZ`%Jy9tCL^2 zB92RGb`B*jf#=p-{?t0owu(b<4IM^!{p97HaRyI9>dUUJS{{{iJNaJO^^Dt^cFJ zafseb$RW#*?rl6QMzXnD%#~;y+<6SWQpY_}mq7mnWI=uYUoQau&&U~J@S=md)3CA1 zP`<|TP?nyZZQt*0egniZzj4nvLCJ2+ogWXVkoC5xe7sQqmWZjB+o~@L5t$V%V zS-Ixy(N!fkP|WO4v4>VX(U;~&OxjZ zmn8IRS4dhjIhL18PHZxMv$Nq( z57o-98FfHW?i*A|^}1zne+2UHeBxXT*HcA>2#n zrsVCNYR=aHj`0kh+Uoc2vDI3U>RUTo(gvQh=61eQ*ewUP;`V~`hqF3=y;eA7bqV6c za1$+q=9cP{Rj$-OHzzZn=3*kCXqIADv1xt-UyQo9R5;|crq z@3lKmV=1lK=gO@*B1Tu2u%(W}OU+|H8;l-<52~Ny#W|$%q>8*~D*_cd5>5vsKB=2Q zbLS5!S*+*_id(2{7UB(K3x?e>W8pA*gDOPTY87Je^M8i9gP>DBV27)5Bls}73S@7) zNg~c@WH;YAei)J2ly7hEI7xyLDMaPIJEgGL|`8b{WCTR#Qm(;KLaT_+hl+MBTPF*5f^_ zLRX#+PM}`B>WaS&tqKP*#Pi2SK|BH!q}eZ_YlZLH)*|_@w(PLDK{%*Vi!Z@bqedEL zOV|HtV_&6vdiN(j^cKgMaCx5SAUf~b;01^8iheb}^SuxOf0dJpDXxS1FcQa3?&VqT z3Y8+qL_+!yZ{Dqsy%yeV>%Jv>KgH%&1j^w?jvwTiIKoi@XPYm!%@2qX4>o@mavV;w z9)4+<>(qVTbcbF=)wv^3l(zYRcTw=eQ0qZI;Gsgsio!5!0$XO=<4?IP6jz>eHv8+o z{j~jtNn!y@9>wSGA6S~Wxu~slhE|=B68B33Xv0!FNi?&-97wa3dRJiQUVZ#(JntqfwEk!>vg)6*C=WuHr#^Ul zImWl`^IYQfIZ3rrN_%0n24>JW*;P@ynL0BvmG}D$iuZvduK&_iu8NN)M;+)v(*W-A zm%M`uwr>M`I%9OEgfoWDIoXDKIW7ocEQEGhHnZ{8nq`Qvf?(?*j_&00R4zw~$I&7n zYuWnY*c+8rq;q7}bI8=77$pcDfXCk=8blpMhNE|3)&am#m@+9ZfVz9u<9zZ*(rJCo zCEUrVRFoGG)n`Hc(if$>ltsokjM%VgN-H9kM&^1-VX1|FngKfVUb@3`IRSQ_bxh79u~m znSX^$^WOLIeJ>hTBG%NIJT5I#)X2W}Z z{)>V9s=uR<1rffOs4YIm&c&*aBQzJsjcWMmEJ+uT(Lo19f78xT zqw_pnB5p+v-@wqFI>7t+PRuFu2%)E)FXH*29}hp(R-Nw2uVcP!WorHA;`sbeS#PuO zT{FjMHgD1%Td==(rG@HT>NNlF*#WUSOIn2ln=5UcSc#kvU-Mr%nOHjnd1gDtI?&kT zBueDBt$#Sxb!Jf$`~l6<>MD!zRYPWamLKY}G|$$MpQN zk40OTq*&v@n=zqeBPfCxZ0eL(We&D8OWb*8>45S2<9BV41q^|{b-4cSbd#+}Lm2wp z2E@IhCyNzE=O(Psl_;l^N#IaXbP3h+v;*mt+W4E_(~$5X7j`F5E=-Bq&}_ywB(Hpr z@4kq-a?v`kx74!c#@U;R>hDtAIp*y$1(apRs{&!^VzuF4{25V-Xp=*lEtU~u(QPyf& zj4Nlz49-yH{6fck41>!|!tJrbcnN3LcV{+$4g>E=%(>!z+j}cB*^gFaxFMca=rOhT z@z~o|qG*}q(_^00vO8KHYl)hlqBe%d*1W#1>_>)dH;c#i`j#<1!tV^|l6UzillL5X zIi!OO-_`B%%uSmi%haE3iGP%n+%-`cx%lS%^Lfi8kf%_+97|~E#ksSTiMKE3c{zU8 zpi!N&+Y&AmTw}xTxGhfJ@thPFQTnV$EIKkVPm)e)tca^pa_eU!EvozV@`B8?%iUdG zv!RCE<>eo#V;R~?oE)1ou;fd$aE%l8;wwlf}di?2mb)<#m?@T2DJ_^E0EOt z&}vxxp~Tzr!Ey%Z7^*BOKVYSJ@TG&etR^*?+ZG*&K&vXpa2;KYa5JvqZhEk|eCbi` z<=@v2Y{RUp+3HgVpbyNk-^+ifT8E!7*@TKxamZWm*VZ%I;NUjl?jO3B%i+dA(o)7c zG)mLAG-+N&1SY+T2_&4%cTea6OhuY`F~-*1{$7}NfjFGTh!nNwoil8hJkNL=SddFC z;Z2$b;>&R8c9ywuP2>}WdaK;~kN6Fo3|2LkNh%gUbMfH9F~7F&sn{;NIt*6N*}_yb zY|Oc7(ZlIcCAoL4EN35@-D!gNKOt*(gx7iGcT?=<^p;)I%&XmU|50lpI|3lq_jdUG zz`IACn{xXZ8sUorgt#)2WW~)}tW<+jeZe%>hx@%e zc3;E!cI0ab2(w7&|>I@zeiO+ zw~T@u{YtxHUB#!L^P(v2jiX`mBdW$hl_QsIQX6%Rhw|Lm5eGycZ0}&r@KhXGRHEXS z8qYOnW*lfLKdiedbdZWc@W1}D!prz`hS5r5Cgs+FwWn}*E0QerktmAHvTv98Edc}6 zAunRVPN;}fVL5UCG9^AxVDiPe`s5`xAT&MpSl=0uV4v_yiWfR4@+x=hyH;r1hC+qv zvm7&qmEo6?h2Xs~zD3N}_?&j1%#ABxlj{COgOOj}WEf?|1M702#kbdA(kFt*sW@=C z^?RF(#Mr}S@roj64~jPHm-L%rqC$5AEJsK0e;%$HXV_S?kgX%z6nRY-gy0+8uPfX_&yI%EGZN&^1aMQAp(Qfew%l4uL5 z=qZ!}F+tN)7^}pV8vZLrdwzi~PjFCVxusI$<=wTSk5O`iqRR;s95quMWaGejN_qKV zzIN`bAijc4U$>c(84nq53e030jWu$N`6i}qRY)BZZ%SL=;_KXzmvX4ja5W9Nu(Cx% z!}Igk8rI}3b68oghbclxR(Ncg)kufn^ah!y&R6UHs^S(pSaL|kBhtpx;s;)Jr|B?{2S#2hJ6jr#Q|(AS!P#gn0a#Z!u}kOC>7C z50BV(N(w9Y?>7OC5sO1e(hybEf_29YhBq!Or7X)fJn%m@*rYWd?Sl6u)AMWx)dI0y ze)E4c2k(9}vR%wep6lElbQa(GCN+whkmFl%V*S~GH$8d;WqZu^$hyDs%U@lae{oWI zF-+ap1+>f+@q&j7(>XR!i%TGT{0}(yL(OReB)LNEI{)R;5A1MEBCg(Mzp|IRh7P^y zQFG-D>4DO&5!dBaQ|afZc>T7gqETVLX2Os+G@D_k+ZeIU-)vP1Evz*m+wlQi*JevQ z<$;{@%4prf6$k5I=$|md(j`Zj!dVIp|04%lmE*=V2>NMp1nB| z8UFz}oD^df&nRqp`k)SZC#&4RgH2vy3?yFe$zL)3y!s`J29JLIO<*_pGzo ztEy|K$6Fp#uvTQ`b8uJ?(k*M2j7f!IOTx0TC0kX`BU8&dFZMDU zQSK+D@=Yx9`QDC)?Uj@(%<<|^ld!6A5NYswr~a;{Zll3H)|>wAGnA8a1${o1x|;I3 zUTt`+g=2!#dB7&IGyN@;R<^VXzdyStyfV|L@7WuvX-*r~U&#uHq+KbLpp`m;z1spr z3!RPca!86r3CJKEZ?>s@j&Bq2Z+d-Xl_Np%gdgTW9vPil%Q0|m--$ZUdw^X9*T{-7Lc3=m>Klm`O#5v&07=sl< zY3kJe=V-A4$F&^?70#+k+Dxyro5eKznn+?Jdpz!$Xw64Qt*x*sF-1ehORu zVXV(k8U5WqiQ=jL@&<5!b-lrM`;9QB?vM^s*XzdxE%bZV>0BnYQHOt4{cN-`k4Z2z z(NmzGB{btcbR27bZ!N6AhWnl)*9ZzZhcYbIPwq*RFx^Z?WRNUpx!DPeuYzAmr;Tx_ zR-cNWz(>zw^xKQ&59w*EaMH;HTCBo@b5kF zjgxBycJI)mUhaW05n?vv1x%Z~X@6W1Y7TQyZH(0da@=pt++vxLIZ>XGx~ZjSdy{;b zq+!t$9f;L4bDSmW2a@4wsKe$htNDwg=Y@L)*O#r{M^{(D$j6Y3_l!bwx+T?Glo``+#lW26Q~sP|u!%9!vgLe?VN z(*L2nV|1wuW0_}i0Gd*8qdS2)eFhW4M(k>Ml244S5%+`r0;I$nNTR$QIHb6)Nmje-pvmDb(Yc3&P@dgm16Qqqt*; zFVpM_-+BKjvH#zm_U~uUqxl?DDT@hj*`EgwNmc%F^T4b|e&kzUfeimB9DiNj&tqSb zsqgGC-!BpDQ5NPk?9_7W>XkU^l>mx!YLBMntW&yQf*MIRDTlvZ6>=Q9I>hX?riRpn zWvb|QF~$QIIhU}P%;d1Fc&PDaRBHYKRp)N8*!h2o0#@8myqlGs;VrJ6wo#bJ2Vh3o z)xFro2;pQi`0GWfU(|tKOX8UdkFVIW#XR?eE<)g&aB?RM2-)rrc^hXxsH!q%IuN=; z=m;a#9mHvECo>xV6q()sX{p?6A`AIn#Fx~*xSzvE9*AQGlnb%aH9ug4+naYMQ<7cPOZJ-o`x*w zWJ@O!k4yLWNn}8uabi_g0+imC=LU(RNk`Tv+GV`*)WpAGs%#cVQhPSkl)Ksm7Z|rr zzbm+*YFuo@op)x$0Hl^&;w$;T?ybMq`TsqtEMMX@xPG#sc6*&=9Dv--tnA+0C)Q7> zKBTl((>@>Oc1ZFGRXW^DIkrfO-g-iH_U>pcEG<~v&1p{@Wg!q(mQoQ&gB>w>u>eJ` z!C@V$!kK2|;ZidFcp@j6o{q(6_QJt^Q2qmvZo8vg%aeSmPA#TGbQ90tF-v>8A1zh^Ze6<~@UH>dL+P#{QsaFPp2 zN=6$OrsjYEY{m4rEGp+-;YW^4h_Ufv@^~9yq}=282Z_`YFe=&&gC39KT@F3x6?XWN z3$V?>K4x^DcM`}=;+%7%J|=--GU+RPUPCH}dwht9FmVfIui>YKbr<8Z?9TLJ^l~&b zh7ERCmspG0n7SOY|NY-K{61-j_<=K6sCf2dDa!BK`{$5IP zZcL>plyW9xwc7wH=Rx^xyA=5}@Z7J)H|a@XNav3Fcw6v#cM0;SYC6Qd&*QzpyTxiD{6 z0>booE-Ch1hx1>gN%T*e8Z6?-Oiy`nAXfx;%ao?g)8Ok_H-xLp%#v#P-Q4e|I9p7z zD=%MxQ@z^DEGE~6V)?8^t){B;Jukora;xlh*vVF!?ZhN_JHfi%YRK_h81qrRCw9Eb zVdXGo2X0nm=*x_#Iu3V}RDVnc%#I zdI2;yo(^s3onWpVH2Mz*!o12hK8~Hp+iqC~{JS`15xIHVxf{z!B2vGMtABP?da^8$ zNIh}}w4e|39&d@zJ7s#_3iKqSCkTH|UnKDf$A8|P5yzjV>2@%Uj{XztIRNe*O94}i z?`=1D-c)ZBIgX1T{t_m6Uy`1ojFG{DUx8a7ZPTk>NbSH=Y?@DuPi!H1b-hQ_ZQo=R zs-B>2V>;p=0)nsqtX6$gEXv@1Tkk>I-Q)eAwA4ld_Z>jA6W} z3EItJ!^|0QMCg{Sc=49J_yROrxOu!8%q2XA=eDdC+k3|#jKuT4?3j|QZtr%W>7H4F zdC*K*R=Klav2NK5L?`b!j<6dl9JyRSW-b!GwBg}?>>;wmDKvk;oVTs#Ik?zO*6;pG z`=D{LtK-{9%r0%N$%$>kjNs5xZV0)l+k{phEr{)WR4g?)xnR=dwsB4{m%bkDX(L{2 zTBw}Dx;jECJ8!O<(P2m3HQ_rX|3&cfFz?eiMb{^mhq7L!uY{4r-^pEvc; zLic9ocf${##Vas*mM3(lif$2vKu6z*g^Y6f4Jbo5UW5<{A7vdGCfhM_(?MT#&|>z|q2()OAafn>*8~ zpLv5tnfckC7(ajMZ^mw!ZasF5SmRJ3MBeW-;VMAh$c1XpbM7-qgYWb<5FVmAc^ls^dY(bcvW(iQcR7y%oMa9OhS-_D5w)%Lm zwT1OeO&O^_J3Z?C^N?Mm%yW)&Fk0-^4X?34hj0&Oh)d@gQq1)AlOjs|KLSPhdUe$) z(2cP|n-$Gew0WM$nv0WKzHXa$XlsjirkM^t>QlJw3 z5+Pbt!UyGX2?F^IR5DKOGyBVAkztP5Uh|4el?1IB`}gk~EF`xAlWZul=|iLN=BM0z zttaLaEAg^pF*6=9YnZe9CLfK|s2 zcJ`OJ^N@_}e4=}=>7gRN#Gq7>DWYPw)LOq0JIYS;M@+@uOZ~R=v4f~X7sP!*UspXbq2yi%^73NHCdiz!5Vvi>U^086m ztcwxH{J5Q$EnMyX=dD+t>Oa@}LaeW_CpIe&P5`X-G2P^bNcYp5Pv+d(1! zZOWRsFzxy<5MsF7D@isWR1~H(W?o3VfPXe#yhX;#Uz?XVbrm42s;l=C%)`Km{#odm zlLxt2Ejc;0h#{QSBGxL+6*WKV;ZhpzPc9m1*aslVwVUN*dT2HkvFz^nC2{8jx*& zJYi;Yd-2*5!hS?uGsedIe3FwSlG-Th?8Sjm*Cjv|lB(LS-sn;im@ZRydoVQ&I1Z6; zUppIt3`hD`ufHr5x>LPTVBf`-9eq6lL0`K+FsitbB5%e57H+y|Jn>VBCT7z$2AqLj zp+kTNRZi``n!YuE8@X;Key;6yQZqZ<4F6tz7&@6coRJv@sZMqrlt*7{pg|cF=#WC~ zl=kQt&Dd+_Bagvt6KEXkO(dN+9OMu9Qmh;&Pf>Iz~EAa|jmc+C;9rV46ya2A_S zc&q|5*Mu@{M!$8f>8Ljb9OAhYTXR0LiSvuSm<-(K7x{sa21LouTaaR!gG_lY?H}I` zZtpC$?zF}lnoWU|eiC7x@atywisJ=&hPlJz!N5O61mfBasU59V?tQ3Sx>OpQPSer; z$-Ke!Svm#;x$3k3!aNc||>T)+!<;3Kew#9Ygl<-kMOG z4(Sun!cEDjk#|164*NNoq0ay%w#6<06n`r7)9!#^FR|q5O%D9e!FQ523LEOlLRgY* zB|TPgaAfR8!y6Nu;o#YB>=A@QMBqI~2aUIOt9SSaQeh zumX&pB%U>iW!F&ZaoKTE2%Z6;5ian4)(P+qi~}qZvX3O>;X8(Sj)CAf|HAB4_m4?6 zqJTA+rH#rK$3jxEnipGWm{)b$^8#h4YY-9HbGv{+NTJ`J4K7-s-6+d zBoZsWH#`qJac_t?qK3^CHiGyw8nkHZj>yB@T5Bv|q=%z;#O?XFl4LFs9ZxQev!{wF z!_?zvN7A!D^E-1TY4ue)k=^|!49l3|#Y%2QYtiab?3!C9Jf+x|idALauE|!kntJnd z!=i}L#nr!nhJB>XdHrf7hKWyER zfXE$B6i!XFG!AZjCQsbHU#MVOx^X@3fbbYRz=1T9`pZKjikmT2u`3^*)Kc9jSo0wk z&dCq(zxYhKP;L5xYKhlD%cjU}!)I|mnL?z%RAWf$&H3{$#?o|#kEizdfRhp~Z;+9; z5&yiQoy11}qwMMmz7UD|y(6Cf<#>l{*~kX-^QPp)MG`6rY;^f{FTM%PJcuiaw2 zq@1Le1M$8y7l{^fU8tpaafl_Ege|a9l5{T7Y>`|!S+=&b`K(O{DFlWy{IB-YG zww^SewFq`5`#6Ny1@1*v#Qxz^77lG@nTX@Lyl+NmY~2(8mAhS|E5ocOBaJCE-x-T~ zsqGCVri(W8Da=q35xkU;E0*YI2>JQja5z0|jgqCmq#f@^4Z0}oW+!V^9!XbGZrJfE z*(7y$Yvs|eB(`#&D}mBaNi-83S`jhEraIslQYd(zRV7C^1X1a{oGz=VmKqVwavQ^F z?G*y%A*qv0!N{7?rf*58Xm5`1^eR01usLnhtr4X+9WB9X2APk%v{QIY_*twxbs918 zgZdytAQtUGqsP3RFTGQJg#I*OijK$9d!4CvV{)S~VmqDHb;pHQvn3zVzc5O>>tzl$!EWk^*>BdVga_3uCf zmxawcp1!R)+*YZtp|*;xpL2k-lvw5Y3hQ<+i0fsA~>mCR%~6> zt?%eYaFSusB@i~_Ghdi4^KCqT_o^`jR|Pg~Atq71f(M%5%*$O z?2x>5U&?I#X0xtAiBBG!p)AN#1%1q08^!q$5{<)#{g^@+2~?;(S@RzO`Mv+s?lRE> z%xy?pdlKs*$+b&omlR+^dkmhGg#Wa9^5@m3;;;T}aN_VPH zw*X~QD!45M_HSjFDK1?21XUM!?QeKrop^(?TjRgdc+yRg89zFpcx1T`4tAaf+ZG($ zA+pifd*d%q!P-J8@7)CtXk!tfw~ZyWhqa>lsop(Zr@vIRgsLmey#R%2OLa9jync}Q zGZ^x*tPTA>|CVQP)HZ@BB|~Mfcsk4Cw-vogaqw0-1eKBEruehF8h!&QR`i9OP2#PxY^2U)d!6X%jA6i%o}gv9=T3uyO>q@S`VK zDJHcjUUDC)qzuylLLfC-UBBv7xTF}5l4e00BonY-zY{lzK<2eMBZ0N`d1^&`-*dJy*q&E zBZvN3m*)FAQMN3aG{E}oJ@UmWC?E)5q5Ab-btUEr&R(M#34I+Ug_~=)R)-+PS9tw= zHw$z8IH0e4q0;@~DPdabT)7Iq12YC#eK_eH^`c+otJ}#w9HO?{qlKbNf&xkSD~t{= ztnW^|MMwi&!gi9Y;o~-Q55QF zU}Io881#f!9J)j@2zSRI@$~Kt|jZQRl0qnH@j&rm9k}ZQILY6mK$)S z)Ck4v;`UrqxYwZFL`l6xnRx|p?TbT7gFR7BD}1&x@NG*tyf!50T2gedU8249+8hWC zj6>B##ynrv(VTbVzBURIr2hS7hKR<8Gs(20MGw@>y8GR}27BjY_Zl}U+)Vd0I5`iU z7bY6GZZ0b%t-qX*+L@Az6l6H+8hEeSW3yKku#+E*$C}~rGQj9D$hYie!WggfT$-1W z+?1o^v~q55sO z+33m{9r#!P|KiOZANEV_BN-Mcyta0eWEY>-)ShLEP{(yzxv@(+1C$*kQK<lxn?s|ol3w%p2r&!9X#+;%|& zT1F>x_jC&ZoKmI9%0KQyUMo);J&8%U@x{z4orU}>RTe89lm|$%m~P&C)mZ=e+@!OT!BvyLjo;z(^EMCs(-kxD8gufkHL9z0#^wPtPu9TvjjY}GFetqQQAexDF5 zdV7S*NS0Bt`>;khi5~<8Kk|-<(X>giGds*CIx5O79GI!-Vx#DOOM=cQV1~LmB2+;a zzlP${1e*MWk6u+Si91PJnn9f2LP1$X98O<^i|a23F)2q5j4p~JbX7X4epJDan_HZ2 zLR}DBrs^Yfb+G!60UwKf3B+g~klTsiFdr%=pDS(V#)Yl|%xPq|WJ)XG z*ArNOc~oe#_h_2>6`$p2pu9MiS8;#q!FMb9ntXbs0XuPM+cR(i9ZUd@H&?I&i-Ijp zpeo&3re4rqsL?wt;JRF5k-Q}{6coc#3J%Mq|!0y-`ys^pyp$8aFqel6N zNxsnyEie9tR$LA+0#4$bVZ=@Trp2m8A{n$Ep5)b%x+#|&Qjhf!nKI`J;tNU5x@7$9 z^s|C7eC&j2b>CZu(Di*Z;Sp!^!X~Y>La(J1l><0?u(!vBbhN7G)ryH z5i((Yh!OLC@x7;zo$ zCT8YmQ+YTmHt{2KM?KJ`hqH>KZs^FSzCb=)!ITktLtZ5zkp~NQBX?7X&nI-h`qnuw zm8!;8yFHf0lFrs{H?yd%4##H=J=%Qx_c`<93(n$w={D~Rq<3^&-KOc5As4wtyYSaQ zu<=i0I(GuLc9Hh(XlVl|evvB1Mx(kQ%-ib3u(){+TPX|Hgw0e6hR<{}$`hDI$x|;%U z0k`znA|+}n+O*G8zu}N9tj?bD1LfPr^ek5Q{L*g5awk{T(V{HLpEcC!&@ecrR;key zcfLnPxX*)%orXIBRLWp4zdZrpDvGo8ff^+VO&cD-uCtK~Q{2;;N^H?SCje*Hp*8G&w#!*nHN-B6iC3`gHL z);otPz^e}?C22t!o(hMI_0V?b%S=hcIKIvVsnq^-M;LF1KiH=$VU~L;R;3#jX4B2p zTeK}CuG~o$pO|N|=UFkLk~B=0s9oi)jretcO0ByKqm*enRF`SmGCkxJBPaHJ1fiFP z1~eSRR7HGW{2q(GwLX+PU>bDAzUlZ}@z?2a!0fYRlJH`OlBg1DugX2Mj9!=6)x7wC zgT#C6O10W8#3f0cwB(KpQ&SNLpVCxon$Z};zt0d6QUjd@nTWs_zh&cBrIbtT!{h-& znkX1Pp@umx?UPzB`9vO@0{@;G`-auTK9|fI~0&K8k;=K%hU`xFxjz$0xA^?NADAqhz52hEVRN zM(#kGD~CK^g`dH9tMJXdPii@7!VE|T^jeyrehwYoX>gVgns*9|ZwnLh7d#QP4(Fc& z*@+4jtO}0a6N_`cN;SO~d;jL4Zf$}XP+YbXoReX0(dR}S0>Ad)Q83M=f-nPc)O%~#3FW#Gvr=o~3kcBKhJ|5r-wMec>ZaI!Q{&841 z9^rqbYa80_S^b;GcSpLK!E{)ArsyI5RoT5??I$vHOA#_mzXE?VhSGWF0{t(y=n3mJ zSvd3tgQ7@A-<@a;>R=ckaV&P3wcq2Art7!SyU&C#EgjnoaYi*- zx=)RlKKUB++-ot(hKDC`k>bai>*-JO6w)MeN8uL)2fBaQoZhE){@vKV#DA$*IvAzG zuxo(}@wh4f`T2xdt;f1r8j5+dl}u09?8n1d^AAs71FddOTzca(iFW}SGrV&#v#x4# zZXL>yx)!4O705{yE!*T#@6@vuP2G1NXysDe*K@aIiz~I4F}{u;nt)uCov|w6Lthtl zTyMYMZe}bT9Ijb)t&mg!@~|F0i{OUX;S&5&5heCRy?o6>_hAu_?dj}ZXZDRX@l#b- z)RNgdST|<-V?~`I5xlU(Iy+dAh*zBFyH&Drk!A*6>DR0G7C?QCW_>Rm`|!5b52(A zlNwM{)6vKXheqM<>T zfB4f*7Vs9&-W53axIO54-p8{oS;nVgWOvs@$diM_%UtEqYT~wELfw-m zCQsOU86zEZFyP|DlI(z`3U&RvzES(th=io@gi5fgKvb!zCnmHWCJTddYHA>pgbyW#7dA9oo?LULk;IKZ&NzG@hgF4ku7X< zT*^UZ^jCX+52Vidh@$GwjK%n>Q&mIe{DtwSKRO1!uEWV*C((>e$Gko$!T7ERII!ER zp|>|0)VD7t+R)z@^|WM8g!4F{dfccrb@aNWmxh#7^Z(&dfG_D0F!!07Sgi^yb8 zW68ypcav8{vugn@tZgxidSKK%`H}gKfpA_GYK$7)@OO+-(Ep*imm6vKty7Twpwi7` znG1CZifF(7KhKCUmKT;xKw8epc$myzS2ZS z9Td}5B{=+Qk}F+ZNa%-uU@WbYSax7uNp?_9+Tr!~oSd8)t$%gbjkN5uHdT9I^|t;>TrOV4Wu*!p>uVD&={u-m%b^|N1@tHd>{GmaW_#z`#qVx? zCcOIN4|zww$Iy5!)dePpzl_y)=zS4#5sK!mKPNMAVlojpk%8C5Iz()YXdVEPKqrWY z(R-JcCl$ibqHKDcyAD?|8!1V^jD%A+7UvH=+F@LHxPM0SCp;0uk-J6`4??)^7!L}(?|@K$*0 zsWN8|QcueK$1m{tvxHW}JvkaCnr=xi&rdS!M%yRZM^t_uV^Y$4P^kow=as6o>RUst zDTIY7lUc+bo*6;t zyd?X(;8^tvrk1s}Tntr|NO#BT%uxo2jj@}U^*4#D2^Fobn&zjgGD7UKqFVY%6GXWb@<33!Z zbeFqFdq>SLP~=NUgH=;kG?067;Z`OrP8rd*zTT0rA$YF8P`mJ*6#Q~G5ACAmtjP{ zRR?zMZi>3rNEi(T1BnQ%Al9}_zhH8DkLcC<`9NYss4hky1?;3 z4hr^*9;&cAkSBS-9&l%!uro?4G=!gcx3xGfy>Ngz>-Nh>sf4iUg-xzedFqDfAaLtM zHTtNquAcrRlhf|Cl-BZJS^!2BvXxg21h{$8oJF& z)y6we#NUJExyw&Diy%;>@f3DGU>U-66Ux~5qVKM!U;R{i_?Nn%K0&o?mxQ+F*r>|$1aR9WO zC}irV%HfSe_^t`zA!pB4iigzT!L61U#o2ch#Z&J#u-@zKT@->E8p3>)k~+n`mnHh# z{rqmI5%bch%ooyO;^57JQifGhr}YuCw=yDw0bcl31PsAYC2&*PMZu9VUW8d9d?TeQ zeWGW;=r`dvnP0CLpdWy2u$$WVg-lM)nrC)K5` zLE}vH=@G#dKR=;%9jhCEc!;aXf-!B(nmY0{nufiucv-J&$Z=Oe&K}?T#yyXbu_hT;CmS|JUW>U$Z{;^~j|5^ml}@4q z&#gIIq+%{;e+7-R#Em?hanj7Tgu9n1j-9^S!Y3Ao{o1TKF&EmFuxaE$DakAm8r#*#ws2tLA$MS+w? zkJhg1qk>M8?9`tmo9XqU4HiWAANwrMOqH(878zx5J7*?0tYb_iq%VM}aE*o_ANKq8 zhm;JnAd!JW$UcxYAw*3N(^VV~$hJ6V3xlngqzT!`7ngd`{uk5SPESvU{h;0Lvlm&B zlQHG`&bCx3Q*ZQrd@KBSG}piFD7nOnSVJ|f^=k6!m5bA--1`0O^|1vfh1RvXfK!u7 z7g58hTNM@o1vT}*ivN3@``?i{f8%rjbOBQtL&Hks8LAg;Oo5g^e4C>4)UK*KX9E?U zs=y%h~tTiCZ9EpG_$v#KgNJWbAh$^ap!0zmR`(1 z53Ff2Y&LDyZ4TVmwOOzpSDo1@G+;D?W`^8)p_I_!@b*zUu@x-H?X;Bo`ZzgwMT_vY zM`Z2E2Z-tLo)yEC5c}(_mMO#JL(yC8*Z>`^o(T;S)HtO(kh_pz04#$YV!;{Q{bWv{OG-D*ZG1M z6#dsu|Cfuwbd%`wL>t03$~MA2MOWFG^u2v{wCNDZ@%j>&k^436m(UAqZ7U)x5@$@Q z^}$CC^6v0ICyIR^yy6{Uw;&IWe23G;k5EUFph2}w1K+#3J$J1>89Ih3*Bviq28GC0 zFlOvjtuyvJPcpaAREap+JwrFxr~vc9%NG$uMYjmOuS>$%vt`P#67@ zwzt}__x|rMSf%Oi zj}-TzajiIKMEZv#=Wn9mEl!onT5Ehe)M)vSU@N}DU+$8$v&YONbk@DjY~G7Ch!;=) zcW~f8BKG(>?gxs=W`*Y2X4(5YNR%>le%JPgrz_ zSF!pNieThkcjhgBH!rA*BG){ETP@Uw$=zQXFegmPX=bU z0-(wuDQx6uK^kYhXyy3*uw#sB7|~hu5OIpL-)gmyUIn%D5<@SuCcOVs#1;8pasC>h@xA4)5JfxZm~y#e~XS{W+i-iXnxwjYs-ZvM5mpBC;|$ zEq++qB*MFj+MGB1;cdLW%OE3TuTp*dJA!S&r8+5tgbGqO519x^NT9*L+v>U~egQ)iXB}R?yAv~*Iq@O)ZE-qd+EOh@g zgWAs5S@vZ>scQQ%88Vc&m}orRti_MtsD^3x40iVjs!0U^ATu*FO-FvIo7xXfXPW=r zMgNyu?)t+6*_Q>ye)dTbW6^LX66MjdhmDq9R_{Yax8|e=KepOmsJ z&9h^q$I$8n^AvR#zywv=2IZ>$Ld;5X$*5S05Ewtf@2%bMHhKSCBP$es2z%WVBz!m! zDmpaHiz!nS&~Jzpm?mPwBgNlaMV9#W<{XfCG~T4xJbX1}|7BwRmx@7nBG4)S?`Oil zcVF}^bFvjRmtGe$&Ju}q zKTb5Gf*s1|(6}@GG^P@QS{)ADJ>!0yTY6)_ZnnAfc85=Sg}oKQUegD$pT9reBkicD zH}}zfV0EaJdZa3z1m@|lbn}fa4L(~v^j9jY2u7D>!v6Dn6(RrJp?SQ>I#6suQKfW% zPu9%EGRcd%7*gQ?Ek0|3VqP^)Z5P2T z|M8fm#P3j(DJb2b&{OMkFbW#s^yB4qv!NC8!*ean@_-jidhaG8@t3kPy%jkg!n@(4oSjLa0B+ zwHCZ`PtNzMhH$9hlXUsDh6|pdDE*=8MG@jp>DK&Ki%OGC%NX?o-9{;}E+?5WLoZoG z?hoQ1#s!^x@5P*90-c8klqUVYj;0;|6E^%WLhKq+ys3=41Uqu<jkzoCZrf&j>@m=;s|bmxZ{u@t?I$%kCe^PwltH=`6LvYVU|~JrGMXpLtio<)R=YH2m1g^w5m*sFkeh zjil%OIFdFNbUC9kt-ITY!PpnR&>w_P@GK{&wtBoBmp8`XlP}+c4i0Io+=&JQoJ}EKEQroX>7gq ziRcXfJafE$oa-P~hqZ}lO?MPh#sPIw)GpsiFm)U;G&Og9^-3WgkKfb1L{Y_xl^o=) zzFmWD=C$j8X!>z_#MH#Kl5GCg>mS1Z;YLG{f1bFVV;c*zO$v9ljk(`x9}Vw@){_(S z-Cr8-He5jRLk?+XNxIv?f3^#3Hg|()2mH4*%*<=# zPo$aav$cHjiBye#tQx-uZ5iu{ryTnZfY+Y*edqS^2fd-Fst3K|-^YcQS?qnnB+KE5A)UHrO8LY8^~I&yiVYEiBNV z82&qM705n&8UGM&`7yo?8^V&@=o2t4a7$P*EvrbL*Fl$`SrN8bGn`u|SdSkK^a@Ou zgQDB@s2nfK22SWjuqKroq`UDw>Wp9%x;W`xZV#08X0j%hslU`KC(GJ{tmuk&N>6<9 znZLI{-@I-kUz50GtNc>iz1MwFqJrADLEuB{m&*ynF{ByLs_|5{rYwG&0=A^lmSCeJE>HC%?a@rZhDi#5IW7X$&@reB})gAP8k25 zxViN%@AvO8w`gRxR|wSaISK&hPx^6w5d*o6SCRM*XQzs8XxdbN;8db|tgSu@*%fjs zKVdL+)wbGxv^w0%U-N=p$|+8pA++eE?sG2lujwvqC>tZYOjk+;JmdZ-;N570m^|yh z(PtZ;WQBI=rg5G7Y}%Xn!nEz%L-aKqSsMY(lqAA^ zx7a&_r44Xy9td6Cd7$L<(Uu9(f7?DFlzJ#)17-Z+#x`%2exUdBni9<=0n&Db4o<;L3S>+L8Audhy(yqJsuC zXTwer;UTYN1OYE@`FUE4_FmyYJ|5k>l3XE zWgi2Ta-u!k73lGM4UJ7tY3zIX6nv8YZ6h0%&jHgCsx51Y*4gq(4hdy~XMAH#9UZ7H z@39>psesIx8-~rEe!)GQ*y+A<+)G4;VjN|#jtnFv!o2S z7hcbmuYsVfC(|zamORFj4F1$_Y4-wTqpyMP=vb&V8-SRziCvvBDLreknp05pu@m%O{NnF!b;00s9ZcE4pj$4D!Zoc8c@+ zBo-;_g@YCGE4OQ)Jqj$eb~B$d4FAA(-Sv+T?K@gPdG~?!v5+-v*bcxk3VcbbPN<-B z8dkjqTaqo2?z&7nX`ZzU)T>%IV2_=*VQXS)H8*dx6K>ZDRtPd{>N=?dU}#Hsb%$WF zlcGh)w~b`Gujkp8g>{ISjfWj_Pl{gR(q8WRSGaXwp6@iglE;ws@n8Vhu7NC>fpw4b zLLdvm&fl%8?qsGW)A~F%yMKyElsx$-oFk7K#F&uX}i<^y)wWL&I!BByLGNr zfi^bBhA1WXzRb2+G?`$=LSy-j5-Y1I1se2eoy8J@PTN_*8fMdfvI)k?cQl3E0%`Vk#tq|t?B*Jqct=&$f#kqZR8@}K!jM-)*XCVp{zTz+ zhb>mL^PRRH84Xo#&HJMy7aL~*Eo?~jEF|D5NY_S7XZIUwM!=AShTLo zHfsTiSJ`depPk+-ewcT4XRWvYIoaxy#$>{h1%L+V2$+yNbWOX=>Uv!)(vdLLpUimd zfKS~2fn#YLqBCKyr=I|1s&^jZYxhmhI?pGXEHWnwZR}k1?L=SmC9VZJxB$Oc6?b;) z;?LA(NBkgM0g?_^O1o=d`(mg_!Th}fQdIctAypO|a_W>##qBlV?#tdC$87`Iy#hQl zaycb|fwLM5lJNeGLF$EQe#D^=wRj(%+}p!bFTk~BtnXphlW~B6(eQEUmNQ!o@r}?M zV;~bSNx?M-qYRHMSzLD^>8sQ=cZKRVG8|7g+J_&2aYx)=i8!&Su_h_`d4BIE>Fm@P zon0$g{*HyttEZ2&qT5^Ind*1AW!+D<@kq?5vg5t~c=Ie1KB=e4G~d(loTRU*a{Vb` zioi=jf$t0@+;A$r)gdfUsifERBqYVXx!}9cSajp|auR~0zWCK)U4F^#1frMPhRt13|GalpBtI30^g9#} zCdIg~qJIawQ7oemUclBt(6I#AP_|0__9a`$2qh#LjUfnikS_r

eW)Tol-Y@bO%R9S{36$IhK=Ns_`rOfQ zxzT{A61ddc`=%MKe}x&d8Ug>VsA+~j_U3jU2tp-ArvczuXkD0Fk1=Z9X8p54cEcAP zGu3<2Effu>ZTkRYq<~B}@8Zfw{M2U@vb=m9YTMxQmD&(0V0VS++O zKlJ*!D!6wTUN*GJ&>^7_yKiJtqs3yTMrV|TSOj(U6r<=<5RH(qo2IMc zpndv_>Nb~Bc}pobY%YuRob(YV4-GalEZkpD+;3SM&%HZ*1xFg1F@rE{ff!PFeir~* zC-ug9t>5zgYuR8GCUqb|% zzA3b;LO7eo3C?gMB((MD{tsbq;TPrGt$hO`p(3Rq4h<3lA|XS!3@D+Xgrqdm3>`z4 zbVx`^cXxNgAl(f!bPb))#l83bz5Cgp{XX}fFms);&b5y3ao9icWioOl2Z2lt)G~Vq z8P@p0e}c=I14T*EDH{&_TF=iN)xQrg5~=bD#+DF~=_Wuwt;Fz=L%HC9jsAhZ`LB|W zZjB}w=%_~P!WD;wiiV`t5MYeDt2L|HsXZyWA7BJtylp$7LbirWA3xmKd|a{0yOeN? zi4o-YpPT+?pH^_hwPyb z)0H?@*Dt7e5s50~bX}f~TGo4qQrMFh|3d06M^mbxzNYiw5bChYM#2))GX~SyD8fJZ zsZ=XsWJp>!{8gXT&g2Hm>C^cz4?rk+$0fC3)sAOg^aR}T0&>?0QarW`Ru8U@_Vo6G ztR(8gWfKpd2vE*&?hR{~MJDp%|E%2Jdxr$ClBY0dXkC6m%tWt-U|lM~&nO6R1bTEB zb~H!$BAsl09mJVsOcRU*@E|^Gf!YnHE{ud`;`ZX+Sv*g=xQvyaTyUNB6t4O#V3&n= zVp?Z8WjSrB-JVw=wpJh2k-i}KvXca)pjGk8V&?5kI^Cd{9izeZV7{81?l*0Y;si?} zA5E7n#cT?bla9f#!#pi7MRipX)cl)?&E-u_j(78K1mAq%M^lOFh=G3p$YVJJc+%*X zwY}vW7k2Y1?tHeT>m`ru$WLFW!6=W0bzhtO8 zm=W6h&IgU9arO04re*|L|V-|3P&&Wd=`T$CviA#)94-^61M)0Y$72Rac% zhzK(R5RN_w%7deZuurTeFd0}@G$cSX6)|mdjTyqQ^)-EV^ireIDa+F8`J1>EY>m?8 z7jKKDdeQ~;xjVRd&OIF44BsfeOgT@d`tHs8ha7w?+#u>tq0hXFRN@`$B~QM6c(<0l z}TV>zjDlasYW5E&LSw^OSS>=m{q;h+LBs)7l zmJr0uRG@}83cGy;M>sBDj5-92-<_D_D zhR&aW@Vx*q=@Y?5u={}biy_B9#hTTP$E8-Ej!VxCBG3#}_1oUHSRQp)*Q&!PO|U*= z+3}9-{dj&fMPL@(uGjTA_;{d0rz=Yv$RB^X+gaFtZLH@uMVD1dL)jmfodm;K*EG*w zmu4BJOfo@LKe`%@++?7+Tu09K$nrizd-*}aP~ z^x}N3E_Wa{%edniejMTpYtOO1k)#$lw}0!y zheR0(qvGx1Y#rS<(Yu-b7Qt3b<9jYKEI ze;o(8n%7W1lKS3?i$59%g{D(ApONoU_s|GC)%)D8umgz0tkEOK2fhie@W)zoMopm& zcQ^Z%G`oiKLk`_)nt(1hm${w<{nB1oz}xBuz-|?OAioF}*ED;Pi^Bl;quF=vBMkx1 zoObC*N-5(j!YNA3jmI0=j;I~GVi(P!htSA-Fw1vn`|mxVF&l)2KTeZK7Q0b=p7FH# zu*3tt#diV{h41JYx)tbS_=n;A`>kls>hI{MX!A{Mxm+S$N9>|W^y5Q8+$SkpH4 zloMSIUj>(LfrVkjC)U0-CBu&|btluC5HT8NSel#`pE8>%yR^?u5f;gjIS3hqmhkxnIk zW!kqgS>-xJa6A%Xb00>#sZsRd;ZJ@b7(YJ)f?#d_sWIX2_&5Ko(s@5Xl#$P*Cf56! zSUKt-ix?aj>_qU1;3WZBxMpx5K}ZJ;8ySeEk47{=WEoe%nC1Hml*rZe5YOTo@Xa(a zc~!c)3@L*}U2QC^A5;@8?_wZ+U+2(*(_LdJ(^PaFXqrZ~3J-ca9hn`nvi zRCzPS7)lI{baHkdf9i(mR>yX4LS@#nACVmXR}y=jfGFITx@FD>hItfj*?GlBfnate z@}iPMw34xy@-^F-sp8a`uwV#s!@9VVhbjMB7ahLEFT#}%YOr+MR{vdf0F<8JuINdt z1X~OWbcOLuD3BdfhddDO;3q2$UkwR!BNYM~^|b=17YM8`N&4C7PXVGawi9*M3Tyt!7Q zEEVqS?l z3qzFi)ItVlj=7WCH)Aq4?@n`_oA4%8&&$#X zUeeb$AS;4pZDE|jJj~fY$&PGFIub!3Vn!|c*JAk2pFr1fIb5G!chGF^ipGtl>rsWj zsFwBnufBOpaxj|SE3mgL{6YhBmD*Yv4me2Dz8~?rk?f{V=zZ7rVhC#)N37E)5rnbx zV!u>Q29p+JAb+aHb5(=psSNsbuQw?|+m$p58murl_$o1FYQ-OnUzDFR(fcbMO2fk& zX8Qb^Ca%^xOM7VsGGsTHKcg|a21PyH93)TpYK}802sI{&F5yfpa}7$+2$Vj9K;sATbFKJ;1wG_$UUg`KE=hwbr(a z%&5XNMVLBpKhxp*G@8VENP!CDV$cFjd9w^+ls9%nA9b)$Pk!PkzN_s|2 z-jsOnsq1R@t7<+mJ+1EAu0bk#(*9iKV&w^jWSYRwjqXB4rwHh&khvw zNs)t<^&~`5E$GXB$(^s*VTVDpTc*dPlh4h(r7ioUqoH9f33RS~m^Ktdo^^{rc4;&K z6`oQkT@t`4l&zBiX{&h?+=vq>9~J1oKZ^VKh1X%{&S{oJG4jy&>*DbPa;1gWD~YSA zra=8ffVq*f5qqA9Yfaff$jNX(VR%V(Np|ipW|_>I(NuA>D}lC$GXh!`^g3tASoE4* zL1)GPf%_aT!$aRynmVMUs}=09%cRGLSV`<>{UjDAQJNFY{!-Ly-{Y@N?MD$pFM*Y# zXrCPqpt?yB6Jx~bFan}PrJo;LWjwN54kA$Zt#KCjJ*tq{1bmiv>4Hx_hyGuVM{#^P zs#riPW%~;xPJOEDJ@S%z$hEI*8f}M8r(;;ne={e4TBx)D)*DbYruS{++v3#Bo0%U8 zCFM_eh?W7%BdPgE*paSos~_EGSPM(4Y#j~EN5(#>fm_*YwLeoj^#vN3Cq3c1c>lt2 zDtwBp;upn<-gT_zMLQ?Qbq!}(UF2fJujPemq99ZldboTb)k_`P!9gMKRlvJs3dh+r zbf}hsGF{-6QwTJh8 z3!#Rk%jVn5?b*XwA+~{UXZo1b51fqe(nuR~gt%`2S^uQ4=Fd?7e8IozcT0oBe1Sqv z?&Z7nl;{XDJw3hMkYD%OXY*j)M19#6@P~5>a>^D7K^E8I1nWrbo&o<0*Eep|_-9NX zDZME056JK@8Xt9i-rZn%-uJeu&D0uBj9jMCV{UTn|5^IUX3l1ouuom_SrHNK(EBEv zC_wenkafCI;yE2;P{O5|-dJ<$GesToTyn@zphpEF6wvT`J-EHle%6OgSJUUbL~Aw# zPyE87aSJ!$({Sh`JTm$sDnCta@4ol-nZ((Z zbSExTCo2hYT7cYs@wd%EV}4(rj4HDdHnUzCL)V3pRo zOO|2FOty&PV|+MjrfxMizcao?$uB{U0WoLA*_1_(L5L1#gHs_i9zodxtl*?QpH$p! z^pIy6wSkhVvgl%Pr=AeXj%f{+phCKKX9@0l>dc^rHQsbJ_2QEX4@w@TEH-)O7*>Ly zdL)sK>HAyYP-2v+xW#d9kg&&UZ*>yQAWg2CP`4a^ccQCuu~-o*JOqkXMnTo^8Kd?o zAvNFAUU_$K_P$Xb9|iKaVMDiBF8U6dzgKq+3(4`}>Dybg6>};fA%g`=NL8pgG`Lo! z-(Q(FW*MNKsdSpev|GZ?IN86OrBYcNu&%cMX|hZ`$-J?|#u#AZHF~kQkYuV#BuAQ>zX2Kdi%Azf ze*dx+4qz*OYlILpkoArX@NS)qQz6;!rPwpKIc)zMp-s^2nVSksR+x*04`6X5!s#(?-;t)Mte)XL$cepX-Owl zI4>&afM1rS$JvER31YCY)w2Duu+d$2@ZWrD0&(6_a?&`s>QTK|rEa_LTvk|z4=KEz z_OsPL3QPW48=OKQFT1CG6d7AFk2Li7#e8kd-J$$}mKtNB=g?5}nesX3qHZTKi{Aw+ zWn25R0L3Gbn@t5U1vu1Ixf}Z}!OFm-B0>snr?!ZOwiZEWxUuk6#SXHJq8qThKySN` zI{Yyy44%|DbKML0)qsG?O~ZYgzgmGZ2nDgq+Xk`O&t0)28(C6IxH0Ey=l4hMd( zM11-gBa=@Gj7}(v#He-J^LQ>v1FRM%=riOBDuRx(z>T>{;2lU`5yS%;ctsxyLdLXR zv^loab^@+Va{Xb$Hcx7YfIJ}KG38ax+yB6!uWXf_M@0^5v$%!?%jdgCNr8k7svOJA zyFVv#k57_Lo9A)fYS9ju(|f>^_!Y zK6<{&esc&U8KZv`;?7CTzxm>u% zuAAcLi`b~C?8tsCtDm6VCz8A<5Y9z z?zPg~lhPkPUmq5{{VuweORlg@UA)U%@_qef5?%){1-3Omnd_&nY@0P}Jq5C(sg0?E z$0CtfC`*%X{|GEUK0xnzt^B3Tx*SI>_3de?m~#~VAzrH|#p-J)MwiCXL3`Y$V-ViO z2JkwnC9sn3e9cH1^Hy8pd>|0YjxbGB7#J?myM0ft`>YpL(E9d(O4T~4tS^}F4S1}F zdah+=yVMg3aDF)`{#N%|{S;TVua3Esy@rDGip&2<>A1&oa#Pazc_hnuseCr+K z$N76WSGY(lWU%nnbcO|zrsZ8<>FNs`i}x6Qs89|cYYY(l!4Os8k)VaZ{?s*(BjS2x zZk0S;B=rt3nYd2V{zC;+g(O~RHzay=`08YfyeTjGd8?nn`FOgxrOg&>od->|lx|Ng z@2cEhheIQ*gG)z*!^W4xSAg_QcjY%VOJ1kpDX17>rQ}C0TWbwn;1f=g5e74%#Z52; z%VBdkELu3>E8>@FVou77`rN%y?eP#9bYgq^$Z)aWyx@l&atTAe>zE=4LI|r~09yiS zhRM;m#LF^V?)wG+A}UanHHcCSqSj%XL5phISze&~v2|Q>dEA zp4q7isV{s03OqZWl7ud}V1FD5Z+}O4gKF5JMLn}O{6PkVv#X@Ygu()KYwRvazg+zU zXruQFiQFkq?{{!*?JH4!$;yryhkr->9XBoea0A{ga+a2vEG#;(AfeCR#yj2xN-nV0 zXScD0_?YsWyPETQ;y3(k+VSID6hTQr{QS>&7{_fX4-Kj1SC}MV^w`Hy|J3Xyj5L2K z7IkOISje`ii{hB*<_`(eB5`Z+Bgq6-&&h5K1PM3%MVl``_K6M)9z?W>>KjTVerPq; zY!1i{?*^+R=&1Z%OXaThhSuGj72VXptMj85x<*vXrSxG5uF|i!0@^M(7VW!j$QIw> zSh@1z3zF&qbtqSx&hTuNE>D_fp0?GqBIub6=sz_pIM;G?NYL{ZiM%-N_3Rz#)HBnQ1h*$*pIP9uf)9;=UQ+hZbeSa~oKwao~A0{$mOQXa4n zY1U(SMn1mb6WXzfS;0=j*mhe~AQX-{zH^^$H;mYRH!m-nD-^E^XI(eGZX;Eu zU*pH!%+HP95QF*W+Du?Mg_y69WR0i1ySWDAFv!@xJv+OEdZQn2z3KBz=cFplq&$U^ ziMvZbn=6A9wlgg!88!D^hkmP*U;l4iA*&tcdBjI$i@U+a>%l~P?TY%#t$bv~?DH%2 z>8^7UlDRBbChK!WdYB=m;!s7^V9ssSgHFG)gW{uv47TjBydM|Q+m~f*Q`A|dbd(R1 zPCD%MB$7DrDRhC8SemZl{T*WY0gbtq(s?n}p?R`Cy9tGAs>x9uwXuY6$8*sT;o*eh zLTorEhd!itve{r5@=2Fs#4BSO!Q=Nm7E&7y2AM(o&#y+{$nN5|T2V z)V&+xKE082t8S>e47BSOoXxWMl;iGEvFmLXTaio=Usrwm_pgvcj9m3iSz}&lIM!8k zuN95KD9^u>{(;bI;XMj{VK4jiPV*%}N4grbwS7{czPeoSm_IP_9gca6P@1sO1l>s8 zG^|1i7r*2{$(+dZxjNoN4iI#%)&9#B#SG_`mZf;1%o;gvA`#$z(lH-~Lu9QIKRc24 z!{AV?$(*~8UHr&|v8lAZ>n3M7M!R;2AtSb6jN}xy@uQcA6BP4rRLZnyU|iB(DGk7p zqnbXnXTHrOZ&gLVULy;JGrc6pY&zq5ZM*&6zmWx=>mPD7_4>So)!^Ce`zGt7lFp}3 zWBxwhn(!C0+vqlz!1o{>Z_%>rXYtQHWAt$ScVqzs4r%?Q|)SG*Grw#_CT% zjyF9^o-`5k)s@Fcgt22L>CSOpGU}I8e5Nu#l;Hn&kN}Zqk|!E@*0ugIdo?rZ2f%lR zPxj)QZ3kWU>r#zzb(|`z+{*yLTz!W%$&lHnqg4ivk?%YyhqVMwVyd-{XVU13%tKDk z)qnxdX*uI-m!A~DQ!Qc^J(FEY+eQK^S|ToPr~U0J1=T5oRkkr`ptMYUF@nt+TZPb;wzL0t=PV#7E0kq>WvOLjGm|;n$zJLjE{FF zalCO_Fb@#O`Nxrf(b*QqI+@=%-~EW-KO70%kF$%0_^F+-P;gH#TYn2@;~p3kH= zgp5N~wm0FE#pYAB+8yccJ9>2tMjaSgxEvKkCmHp4X{_p#9HP{3JX2)M&9g<0UM1fo zR|(HYsEV9=4Tg3mwaX_N;1WuhVO4@|s%Ap&76O%;QwkUJ{=fdnKOOu3vEy~R?=cD% z#z$1l*v!Q;TF=fE%}PQ>Do07HtP*W9ZR(<54cW{nSr$AH;?bB|U6)v4E|D&SOmV1s zvG98tL~zkf8l)1!7u9prS2NO&%VY81vHNwMi2asp_8Wdmp*}XQuP{bjX0mAM?(EA? zxE=E2MoKg246twe8A|)PKr5!2u%(i~dBuagGbxaNWvbo|RcEp-Y1ycmr10uk=7m`B zX_XAcZWp^ribh;^*zZc;3Rn5Az`($&SBH%ch2#G_kn+Fjb{|r|6%?Fv?5bN4IEp<8 zkI3f^D`A-$WYkWvO1rt1Y({`)VtO8=N9p}C8u#DjkbAKWF4TN7IGX&|^$4p^qXUc= zJw~~q!y_TkN6q6?73P0byZ=?Hd%vXQSFlmcGxCqO3j*AQ^ASp!B$iU}I z7L^%mx|TY~pzb$M%FOnIMqRQ|zo{<4)l2G%q>4ap52CtpW8%IUi=*TBh98mOCQsUb zcly|4U_^v<2qk8SCtvt*D1e;QM`n7U-(m!9hhuEV?97>o-=}QVovyLil$FX3WV0sl z@3K*$((qC0Or;IJob&~l&#fQ&TWk!Jb8rlCa(@zND+)0YKdQ_fPR>ygx?uk|mkr=8Eh!2cSvmS`6BS|kDh#ibJax{nKj*H3rjWw= zc&hAu!tb5w??YXE`$da+zm<%+KusqS=p#4Bns-yRpXE0%l|&dlSv+2@Vy1rg5|w^Q zOXgz#n}DLZgKXCflRpso(tHITK}}WK6hDUGc1B?`SH0`1e3htBU%EYMG1JjBZQ)8I zQQlm_AJupFZ+1{P4(n44n}nm^L~xrlt6xXSR%sDI<1wx)(ra=u{dPpz1t$?PcfmY> z+Xj{MDk8l+2_WPC+NWoe*TE85FNU!M=qFyq3Pus%UJdU2*^21nwKFmf76@C7L&{51 zbquR7Q2fLb>-NJFu0Q=c-ce`#;B=}E8q->gjqb8K)yW^M4kUqpqp_gq8l=m(ClSS( zGYk+e=as`J-MrP1^O7b-k$qk6_WyBA{m;#%s(%lwiMO@B@3ZTRQcS?4xG>A=jp_+< z>L9d>^eIi`+2~=E6WlT_W1NaB7TFFp&lD|yEb`M1*_6IhLqpG71F|D$IA-#1zmY7442WwNq(X z9Au93d<5`LH!JukF#D<8d6zCs&ZVFDO)*G3u?pDxdb0!hdCB46Z{VYYVslO#WcUDG@BI4X$O z_P;b2e@R6!5RuVEYB08$o#%}4u}5lpgH-*MO>5-QT59zZJLV19S&Q8#rSHOO%rn?@ zbwD`G)xQ9Gs+#lLAFrQ=xuaT{S;*B#>Qxrra-dU`iBx?~jcIZt``flE()N6ki>Sxq-XA=xl!2uK;x$ zh=wE)r)pCb7x7wibM&UUVQ_w@@X$XuV%h=2}QfZ(-HdTLkaiP4zynV`r0jA zQ{dP_V{p>j{p-XXwQsO>TJQWm^jlS3fhP2m)0Mf%Y_L4L!*@c)FD%Lh#uS(o@0$~H zezB601!BnDSNjW*phrakQYTuVz!2HY#vnJO&L$%)C{JU`1MQ5642nY;!xs~K|l}=XT zk*U08#8M691Me(#oCs5W*OC+Qz`qKBfp5qk@9cbx^FB-P@8&llb|ZkI?o$`$>?SpL z$*o}WLX<{s-ACuua-UNUHNDZg{Z@%^Aw>qSk{!sA@9YT20Fn26(OHAmd**fuF%MK2 z%m?=4K2pIAelM1>S#&#FcPyc6F`Q;2I1o&yQg4Rc$O~0(FfRY%{a3Dn&8QsMd^o1_ z!`R_Fn`E0mwo6u#R_SvD1U#WOJX+pe25CkTw3Z)c1jTDVA5XQWraAnfexvY1=<9g? zgCsCRG~@{z)3VrK_Zjx<^@}$a7n=(1b-xmt&x4wo z7?T}!6O4(QPbSo>%hYnb*U?jhx~Nh5y=v_RlfyjhOh3 zdg%H&x`DAW;PDk>T2z}=UAK1c9}l6h`{J}hoTA!vz0MwcKgh1nQ&StdA@{tG6%a&l zgfZXCra;zM!%n@gVxtvcM^UJz-dTXAm}%GseE1y`T-?q9F@CJ3y;?nUV@iAV()=p= zgSh4cUv}2}@DD(I22%v&$Y<{&ox-_r%y2f11Xsz{*P;~OU{kqTIRW-i%5kfJ{=czN zH$0)?&=Ck|h*eS$syt!551H;inbcmim~rt-!jZ&49Rh(9hyRhcP(&?3Q<#GUd^^qY zC8#TI5Ag3w$X#|y3-Rhaj}5hRwzu+&m6Mj=NG^p-JT=klhNfK2*~_~wKh|a<)wKOw z{E%Fr2nr8r#}{cxQb-g4FF5L5Y(PZ5H371-p(}LRArmPgPmdNr&C7RtzS+dYTo`jf}tMOSDE+?ck+4d*Syuz~+<4(bA3pS8%>=A6Q{*+}*0(b`PKcQXcn znkLSDzF~XrhmS(#w20w~X-|d7U)3>Xtn;uzgx96pP4f0tl<%ehRJSeraysgzdDGuz zC6`czGkQ;Ni64Lv1>xozu|A3N9+eTJsFb*(oq* z&~Y3$7aFZ>3BKS#ON@el+YeHPlRFU?OAPbr&q*d-3CKi9refciN4P$&%z!Qtkwk*; zyG(Cm;{Rfan+BbHa3ja^Sa#CW|Bm6nGf>2Dn}HYbPH-2p;ec4aMjsvOl95 z2%9X@Owc;3n=~kB3E;~w^_ufb6m&heT1a+1>eav=mi>f{eE8O{V@>cAJn69Y!qW+C zKU-z~5#ZSR?2iRf{)VFZ@xXK8?hu#=Vki9Zal0x_rPE`y*}(*`k&1%Q$rmp(D{j8w zb}cQdrY7;`Yn+2w8}<`Fa0AVqAvqN`KIH)6{9ee_n>3Qe<1Fxcz#KrLFi<&Yn4YVz zd%i~hAh;9Y!jMj~*-N{GB1I+v!UFomGt^QPip-!0uK~{{&9t}ol++%{gMsO3CA8K6 z`SZ$>aS-BqHHBH~3pYniTf^4Ld#@8}KQp5$naxQe{OMT&d2!xY)>yllJc#J_OLF=W zJ3KvMZl0bu=T{N&m!vh;O~2EOjDja*t27-h%%rFCvsnt09?7oUp~5wic2ypCCo$%qq7tlhSpz^Ko~3GNZ^GxqT5r zxzy7YiT=5x%La!LgGZi3kcRH3N5kX=ZL>jt%;lf}A$DSLT#J&ws7^UeqH)gZFCp90 zkU|B1*@nX~yeMmi#SO>CN2!fBfBkNAj3OZ~iT<^gfF+eEgIU94UFe0z_$}(_K2555 zuQquMj?(#sBD)M1)yc&61~&h& zc&bvRuD=lFnvGzf>H6U5k-b+vUlFdyC zLbY+Q+ORwCpoYAaHqSPT83CKi8G|vrPfwR`=uZ^iOfT<5P3O8|(46Gq7BMlKJVRoz<9O(+ z&v6aJyI#o&o*;`F8WFX6AodEimLObfeDsJ)A#50`OUv)s^Ds?~*P8HocYf^@fzvUu z$RTn3F#v~%ByQIdpnftbqz6W(YERtV0^{4LEB47&^(~lG{eK;3I(!66QiN$3D_2*G zcehZ$@&_@4-P?KcJdK=2G1?UPOou-YIb~Z?Mje>6cyX-etlCcjKYXE~lz=`x3;TJy z$#t}c7JG3jgN$>>r479RrWw6hp@;i0tyugeU5kxWcoe3=LG_@wui|-vVQAl?Fx22N zRGD@LhID{2E_*ZWNVRFatPgWtquaz9%;pnGl-`JPde_YL`8Gq+k!ulA?L&a%73JN3 zyYGj|_&Slv^3-?Tn%92C6-rwX+nl@@hE4geBpWIZn`^6LrCX9~*v7@pdB}b(GWpsN z>r9^9`x;MA&&&7%LPn|GgJY#(-K0Csut2_~x;99NF$-X$MdV5S4+M7lR*!sxWp-wd z=vrz+{p%#1pm4n+my>Z7q$wf(S3!3g+G`*>;uCDDjW1-qRdp|@rANVSOG$0$Fkt>( zEYFYM;S}!QtTAh*GXFUAd(qJSwVv#P;vq424DwrFJ_jv1yZyu{Hc5_-E_{9Pdt&r^ zZ~r&#D$m&p?c=GIq{wdy3kIlE#c@8>YB309g5qDAz5a`W#GCHbt}c4PuM<(#+S!y; zb~sfym-h=)v$v(Mb$JSIF7X4jz0p$j)n(TCZ4qRj=e(4{sbhVl%iNTt`!4hDo2nAv z%wbkl&3>j<&i_<)x@rbX{fbT`-FxT!_%C|?RyHe=9c#fnB(`$_ zsf;5&Q41^p!PfAGf{`(~PwY38NT1H;q07}Db_?zo4@~h#sE7sS6Y)i^t>CMS^#5_K zQWNk-;aCZ+(r`>N9T8~A=Fnt)SmuX3W5VQ{6krc*v%{wVrpOFJkL21B zTG0Ayf`c{7_(lIk+{oGp9qjLeb?}1O9WW(mI);DdFri$MI)hK22Wm&Vb#6{mn+xf7 z3b2L(RQWLWY8oE$599N3wIV*PQ{oFGHu}L?Bc9KbX1wO-2@h%guGsdRRB1h2vVhu} zR^;tEWzZED>?38O4<<&?dk-ki3$h%J>tHS|gpm+`K!;S@z_i`gx=Uqv(+$#xwHYwrC<*?!?;tS2Kl_qwjMR2No`1W&q*t#rR)5O%}c&bi*x^Bvk zd(^M|U6W%p|E#Wf)91S)7NsMS>#wu5MZY;Me3}HC3gXxVv=!$66ftqGFMW;`P>ov; z)!1*XD{QrzEz?YQH8G;fwA>mlpC++NRIz`m8lB6sJ^aPp&Jt#SNT{A^VSOGtTqtEN%-uX;M>w>6kGrm_!Aez$Z;L@o4y;HN_6Rjg|^j+wg=K$v)K|OZF5ZH z`JYEwOS}{sQ9Gei_=Kxf`1Y&Ge8n0PaVyK&DmI1V+M-fIicq0R=?Rf1xR@m39vhlo z=+uHV>;!!SLvb#j7o`QY>2wppThvl&{4_lwQpTCC-hN~Rp;$-KF@c`OCpZp*-6`S*yZG%DL2g<13SQg^v#IcvPBN+}Vk zCe&HzpNrWhfJX1b&gw5zy$cxP2uBiXaa{=;2q)i#3JEXtdkYs;hmR7>p0|ZMJ+&v8 zm^y6T7%956dI^wWOH+mm(Cxx%1nRXpZ+6?~<*R2IeF|{oU574-&-zZkQQ!&ll z>cZ{(+}+K5LPnRg)ARPMXsOkrJt&`4HJcsYRT7Bui>Z_mPH>JuuJ8ieHqQH&qR-eH zIqj6q86g?uOeb$<+4(O^MYd&jM{mj%C{xaS`F+v{%u7m>ZgjnCWQCme>FiErnl?o& za#^H*#~0kXKGF1QdT+}1BdiRMYkNxYDKN- z2@ot03=#~>!fV8klC3OGj4ZMTj%;C%cR)Z|*>y(<4wjb8axW$Lp`>H1cm|kJG|kv? z{Sin$xB)J6XZFux5-q1bxW{R4KOn>I&clqve@-&9$rc38dDHtpqZ@g&Z0Lc@H_Wsl zf#K;(u+)Vw9(D1%vx5wku_c#cUURXEwGVMWhCnmew;ym-zrL9|)lg_9Ogq2XcX!uX z@BvvN3SA#$Py6VhAN`(ec1j15m+nz|*dH;9Zmi;9_f^nh57aoVp&F?BV!KlD*76q- zW>szivE35-bogAn2D+q{@Hf@InCkGUxb3#b9HfTu$GDo0EK{vRRvNmPB21qK2MmFIeUp#bnfUv0Vuw1z<>*-A3w8@?BT~*+ z>{sFt7oMYv@@UwTCN~{#HlFp{KPZH?%=j9o^|fIpkD~oYP7V+Uo0k9tYPR#yt=P@! zM>FE*Sd*@3bKXv#d2IZ7mbSdCY=L8BSFdLPsRf#2l8-T|Rw;{b6b@t9kzr6nx-4(2 zHP_J0JdoWGLMjPXSfs8DMC;Ca=34ek;dd`80$TfluCcFv`S^UL`az*UoWbh@#^7Cryg~3Rq zJhrjjQyTb=N!<@gFIpeF&onZa%;H=p&lUS(Vtjn>VTx_(N#OYy{T#4X;4bzY zsAZ!kP<@S&*zQ>Wgr+T__H71tHwb?vzWN|Wj1OY?#w;{Dk%bF<>Wb~oXzE|+Tb&=b z7`}p^mat7P78mrY@i6x=ew5y~-sdkDwkeFr%QR-ApPb=jj7EMJ8^G68AwL>-GxMt7 z8wurJ*?`OrzYAD!GPyJy6*K6k{evb@MRbLAeJ?K-n;Li{P?wVmeJqv7(pOhj4;{ndPgCCC! zD!!o74z5FkFBsg52f!51hw%90Y}(-svCY~$EfIg7zReg!(Ij%6YsP6qg;U*OAK@I~ ze+ZO=iFFe)Ida;umgm~{`)bJO^iFGX*?S-M(F}T`b^p4fyl`3HPu_mq9Gl*B&KkxGavw*$;OZtpz7Azs;Mdg};0vw}uCceq z^TlMRDtXK3NspZQNHM7y`X0fzK5H`d89&U&&7|Afboo3}sDW@*=PCSMv?;T5m&9F@ zR^2?2BJap+1!r2n(8~)mlKkv_-)pB>`L3=iR3@dmojbBTMP)JI{FF6Mf4mWDFIl@Y zM>sP^tR*|U3PGQFDG>(Wo$KuRr++PSa8X8oe$ zHEP+bx)&=L98dFgxqkYoNST|~NRV2{HWs_T-*O9S+L+JM938znz4f$RD89WKt24|D z|1G1W=Nu9erWIq3+CwL)aaew!DMJQbTSk&8DB`Q^RBaaR{Z}bACi>OuBM9tQ z9CU<80|z9Uy}#93!`izy@#o}dZLVaTgqR`flkd9>8g9pTQy;r)@iEBbqQnBYCV#$b zR)Tq;h2BT6JyA*~CJt`(evN3F>p`8tHOQ`OonTERdh&8qW(AD!h6I>eb^`PXzR>MP z*e%l?j1s>CeO13f5?kVDd6qywnGHOZqRn#8|J6xS$N(9{L$4n{$FZjMuyeLt@|<`R zFI7Uw9%z**66y@P#{@1pAGtK2xm>{J@ZZ-emsl47TL!3?vCA|}mmFbd4(`>rJkL6g z!>)V6GVT#9CtM<4hNv0L_cntogCq-iUMgP4h?kv$on90f{7~u|+RHKuDCOhsH_oVU ziI8{+Yqs_8oRjj7MM}@Gl%;H9GZOg}ZUg#WQI&j`u;f&jW_^N_bTdQ6%>Q_Oq`80W zDl8^CguiNr_;B^+!&lNR!kxj&NTWFmOHl4s#O4~|)*O|=6}5I~f=!H6N3}ppL??eX zZ&#`Siah}CwAF_`oJAh~^Cao@Ro+%V|IF$rEXe^hGO}iR0T({YYv6<-zhEpnOuHPN9RD#h@ud79*%}KSx zBc=Cy1@=FVUOnsN0=1^PCEb*I?v43I$vBBGV+90JM7_3%*#n-vf}3R&%#6foL8{>J zum|^!BE1g&IP!tp_s_dwHEFo*=(|PQF|oB2}4i^`c%1To}3@7+Pa` zF8@<@PL0x+SXKHz+n&@`41`R@ft1*jdG{G}PMmTX3{gLJ0(ie`iuXuseZNz<+Z0)6 zkW3YoR)idXkftsnz^Iq>B_ zs4RKI0RAZ$;5o3)D>V5qk@{Ku-M1PUgke1O6GTbFG`h0Rg?jUex>~njb%Z1Aqrec9 zRImHO3*p%1`lvH!q=J275_1yWl6|KMnMBRad`@cNNsSV zF1&T>Dr9!ZOY8QX7VV-3^dQ_%P*!XK$Y)qXy+AViyj#0Z+T&QU zsHU(q9QH4+PNci~5bGdm?D$`r^S@<`aM-M8_OvOAplUUg8ofTnTDZ7$HR-GbCBl#7QX8DIySb7Z!LPjnmMSfK8_a_Ak|6sZw ziruTh_?b$gUI`2qKdEctKPe$j!hjwYyNH3eF(M6ncrb)7;%%ZaZ|&&}$%|qJosrdoKa$(rW^Ug7jXJ zKme&p2sH^Ml$-fx-kEp4d)NI7)?zKz@0?xEF3)~;IFAoGj&uyfy|^vQz4>qN*qN^M9?LN!RAp&_y;+s4RS@`ou-mfATFJU# z9dYHkx>B-ruaYX|wHX_dcp~WzNKEX~V5rGN>gxK5&FAIVBYH6}*)M5|p3$DcK-jyN zg>#ApY8-mIeRI|E+D@SYD_zl*4{N*PIxL^9x!)hGQ8+|es)_4*2-v{dZ^BNlkSV9! z8~3*(tdEPpM?%Z;JKcd{`6e{`bTqHLfL=n$e>&z0A?emsBo*!5o(<+7p-m;yF^s7&j342*ew}bT6%uEYW$)G2jHo!l=?F=ce7H(~ zxfoXsl0mW~AKJkpp=TIrc{%M)0ab;OX+1h+=eF@&P#&L?AwC3==X&;nw-h%= z%j!2R)xegE8Z~{_v6hCFgw)FocTO%*E&k~1iMh>lFE_8Bb|9*pXWJfBC@tpZdKh)xgX_~vhJS_Vq8y#wHn$fn zkQo4&m*|^7f!L`cp59l4o;{16N5s<>>HvWuMOtujLUU-9uVcp5i&YGi7t;^HSY@G8 z$>%BL5(BwZV^aH%jcFt9-*@jZ(|rwO&IiWSvX)bw^jDu~&<@+t{v>SL9dT5Jgz>58Ip*{82~+grhX1JMLq|3)Va1FUoQFTSotTbWKe}wbcOX)J6$>x^w_+qMy51X z^8@K&EW4WgUL!g5^);GzHJWegeJ|%qPwElO#D3$6wH7VPXw`NK8}@67KX=0at`x?< z-|P&_mkFc{x?=Ci-2eV%Hr8@IyYosH)tT0lLd6SItS`-7`=5^v1JvoUbE!CV-Jq=l zD{hlLdw-ToAn2(`B|d|t*&3U{y-H_qSV$uI2+vE)#5E312AubW9=5)+7rQ(i!I{Hz zc_07Pe|c=W20t_%FFfyTGQ3&!(k^%7XBf@x=3mt0ik{AYlIPCr7cV965Ofi?}TF4F?u&itkmt#=oecl1BV*E zO3xIlthbi2uK!T+yPmJaOl2j|-E!w`KlA)ckD4ys0tG^vn&>?2fhUVN-Btx6kg)i18549sT_h z#VqNsfdV28RAHNQz8kL9o8Egy*`OAgOto$rlPUfmBmreZ8sDpkn3N_r(+M=bAj1fAsPZRI57z@-ID&5!35* zdKIdA&=g(bULRBB-V_6o0hkGS#M|w?*fwgu{;v$-pFhN7sGp4h`dhY~em-b5W4Yux z_>{K#T`jnS@a|aT?Nf3t@!f*@dj;bh>jK24H1TNIw{e+tSKAis=Q_S90-jK?oFPNfQDfZLbtFU!E?4b zfve;rK&tS1xNh0C4QA!w)GJ%m+51JCc>|NlFIBl?)Op*y`|ly@^c<`k0Y!CCWU44p zF&hN0(vynqz(3E0f`GZ3f=yHG8VzzJr%1!7_eCTmkNyH)4FTzhpH4^Dn+@cq^;tW{ zZ7zO7u#YcHR#q0Gr8uGNjx!mmADc`4f%(~yt$+0;{t7()st^Cej=is3oL+fn3&nk2 zvBTZl+m)V5{}NWlC)O&YtDYn2T~ox}SM%Z8(*cjdSp(Hb@dn*~NL4*Ytc`i(Ks_I5 z!aA9u(OrMPY6Z$mBBS);#{IP?78g{=P*?ayoC1eVc1aaW7M8q5W%WTH#dq9}JIA&p z3C}1^i8_m3 z5AXUM3@sN) zL-B|%9KGS*Z?&D-E}_}vSyna}lR>5I{=CgnY{8KF1-ZqOvxRIiyYT!!U`7Ag|p|)mX z6&!bvr=?}=|AY8q=p_`eF=HPb#9}YEv9q-M*qot>-{8qW&1g>TRqvBoEBJA&D$MEf zC6@6F*7R?Ru(YMx0gyrM{UI) zmb39WZr+d3eVwu8%vP1t37$sRtyF2EYds;2`KUzZ&)Eir9C00Z;BLP8bdqDk(Rez4 zWIW=~FI&n#5H<-0Y}4`v**ZWeCfi~_DS*oI;wjOo7sQP@o}=;N!PL`aVDPKnfO%Bo zH^7>JMkx;usYYn=W}EMm~dVSB5taa(I%vJmjHn=fbic9bW!WU zGj?6mRS_A{!@*i`Fc-Kko|b(dU0P?;y%tgi=$CBr)X2o7mEi!$$CkhS=VA1_Gzyl< z3H74o+u2@@l7P{4;dd7vwdtaK``_6}tKlI5H@+W4kAdJ|zezZIDe{>tGH7n&q+TBW zwElomQ?9-N0Pi5wzqx+(KYpU_!iP+^R^HGU&^8L{(B)_w@lU@n7rZ}&hLN@g*lW!M za+i4iZaYHn<@-LQNIwnq&h<$4NJW`Ie+=a136*HDK`+ak@vmv_MpgcrE60u*(1rJl zKiy!A>Rk~L050s zi*DD~`Z5PM(>3w>&YD@oLXk<0c!m3Kq#>-5nEU=M9po6}#uHIuIQw>6tuH%U_uwW_ z>hBVfPvq=mnEQG{uF#Who$4YR@NeQG>(3>H&h|%b6vkKmuQsVW=hUt|8v+#6$w;2q z=(6SCki*m(V1Bn%k~}a#*TKFNNz!hb6qcy@r7j>p4BZ_Ae3;aZGjv0~$juWUG zmr9Gbem`KkiQTncV9=TR1y>6UbkuQu=>6%`*{E+ z{>3BrcPJdR@Yx<@SohwXm_0^Y8ksWr)_UW2TXbwKD-j~tuXbdYhu6)K)ck2P-t+tOf;A|7EO}`K#k;NL zq{`;WdgR6P7|F(r%&$X~u12iug1l;rLgkzG z*~^Bk!R0dxjpPNAG8SbLugSYR4@G-1exe1g0_nl(X0~C&`fHVS?x{7rJb_cE{eCeK z+bU9vw9v4m%5FV)k7&`9&VXorU7o)ba@L{20-@L214iTon>IoxO}{%>Y?S-iBWtsJ zUp4-MYiYVHXkkne5t2d5!N};cxc^AQ@d~9Gk|@&s?ClM*p?X}o>4-Hc2?Q3J=LkJZ z+j#MJ5hlv#L5z~@RAWsv0V2E-8p1mnadAeRx2*Oh<{&;1xcOqO`Qa5mCtcKOA}3K9 z<-4Jg)6jp_7Are6(7JhM+0z(5XdDY;F^2*QO&?@)OsSyg^)dad9?XbjDYWQ@X1aUc z>?`Br@0Fw-u#L-kqdy$*y|l3qTykxr56Qkd9vjJ%WF}|t&f|LP%Kua@|KoQ4bD+QA zD}!O3gDkc5TepVCEuQjT;f@;uAasm;VTmU%|A5utJ8!Z{ipInxFQ?dHV*hYWlY4Ai zg@4XJl8rgq%(7Qh+|+<9RqND$6jC13%uCQ@H!14V{ghI7mTIcW#*T6cEQj%2x9a)y zB5;N;6S6rVx&6SG8gNq|W5FG(OU&FgahEE^NUqn|DmofBIvM@;*VJ_3Vypw5-2Uqe zDKBZim)CT0aCXAFe2o8j^B)i{JjbFF35|UYy!N-Vk#P`?PIp0Y{oH|0hYUKACUr5! z0H<4fR%<^SXCJJ|4|%4<&+inuIk4Ar=vq#t_I{-K^TKb1Um(+fzc+>kG)|=t2uCr8 z+&q~b_C1t;+$O+xGV(H-Kj!Ih;&{Hnj1)gs`q|8L#w(^6+zigbFZ0E(9vgTLa8Ft}=l|h@Rzdh&Nb}NA|!Z$CRgmK;R!&!_!_$cOzXmtHi=L3e2c66&M`DLqQCq zp(xPGCiG7auzmL}f;4M4fSi_Pvr>GwkjviLr~1XTHN&5v$Z2Pn^Wl2CHDsIhYZ2A6 z!%X^UPrn&3pRQZn(bd~+)!IiXpGV~+V&B~TOHx@Xlx7A&+pDE6gaIAf+%Y3^Fp=d+ zX-3T1<@kBw?>@lf)+G=B-lH~C{i@;IAA>^)!Gt@RDj!+rijjuuT6m9dRmOf`li1L` z%U$BVRV-Y7M)@eRvjbQZvkAaorb`xK68F9atN`u2iLZ{RsQj#C)xQsyN_oMY zY_uj?&xSG#_eQxV@RQ$UVG=pTC8~ITE|Um-G5zZ_tOaciTn&xHCpfK2Kz1#7BmMJ( zsJ~)eZl%0ODUwb3LoMAwExgZidNjYk!}izJP+oG7xg->q`^?`X-t|$G1KVxX zcpwIDb7_oY8Bu0Yd^*cEd|OVSjZJPUWUMO@7qN!-8W zM9I4%0*}87HkHhOeEXwWxWLosMuAiwDo}FQMt!VqsTcMb8D1MWisEf*fU3VEJq9tU zHFYt(G~cd3=Jzsu9RAaeoR#Bc2D-MJ8gKE4)^WaVhLNU4G|M>HlxzGs=4J7~u ze9275W^KI_z#W5e)CK^)6zm3&F;BBU4S~c?k5&TM61}AQWnw}%wunef-YZw+apPv9 zU_ks`d;c!*|G5X7K5EC9uS{Z2s9L<;%j%VvV{fiIMWdv-fqRcioZp&aBtBMteb*FD zVJ`&7dBJb8{<$OPYE(nJ5P_@k5Av?r07QY?0m+pIs;taELZ%_~yOz}!Z@*j&$YYD1 z(2pHHuI2M#tH2EaeO&F4WaL+vWua)5paC*ja*t?DG_Ct^0x-K2prM$lWoc>Pv>zyg zPKXMcm@=-=Fc%|~Yz_O-FMMffZEM(@oYZ1s&DGM~-qILhkrps6p~kx-D^4hW;^6}>e;SA3Kn;d6E-mHWWnDilohzR z!ttf%5hcvxMyuq7CWR5&rD{pG?K`3?@ZaR6RlnORT!(`kXi|`IoU>$K{qFpE>2R~@ zZ^TCs@8N+7KHli(*ck+#KBB7|QYZ2z9ezqnHpL!33744;5M{Wr`E;+L6mlcbu)x)lW${D z6^b}HhD`ZF3wCn4*M*TwgtS;pzdm)5GEnt5$5@Z$5Vsh0Y`ZmCSX2{Yf7r9W5&wG{ z@(*RX_qCIAy_moC$ZbsjYxXJ5DOhdcX2#^HVpt3R!OhBAto2NCkBB?lKqJi!28p?6 zax~N%X^sGQZOh}BUa&T%?p3Q`Ce&S;2CB-ie&G^-rKH%#8PLoIEqkT zQ?|9*ttwdIY94rIcnIDjr45&SN@G^ax9<&|(wLm6!lQ$oLOJCifWlz7YT+^WnD)AF zyI3W5s&#H6qh2d&^fgP9%C^0RS$aA~F;%EeHy+``@u#q6lGHW+No`kvKWZFV*==u> z33g<4=+pDhPd5NaE zY%H$u3aSeuVE&9lHj`2!C!whVs}{S-qRpjf;PkfQ#N2Xt>`V3k@?Lq*FI8q>-DgLW zU-RY_R+m4LITKCze8tV50u$H!U@F&6xGe)*%MN+;f#pw*8Z1J@9 zB?K4Ai7!)}6iRLi!E|itTCp2a3S2iAIon=l(0$NS!Q`x;#AKItRBLy51~Ey9CVx>a z9-nAEzb`FGPZ_X(>gq5R(F(kyHa(Nm=(eT7H{*-RdY(wT#jYupb6>l#aN=4>6lu8* zLj@S`BBGgu^Y&-Zi&j7%t?DWAN+@khH1B2immz{}oo(o&!jszcaQx>)DNT6s3Us{lZN(^q&|zZkYUfKGa`CXx zg_`>H^h6Vvcl4l7|GVx%Zhi&Nh9tXsIxY3L`t+Ms>z3Mqx6yXhFD1O zf#Y$aE>3#^=4;J#_bS^h>Zf-<@FR~R&~}+9ahFQk3UYiV z19cIG8uFAHpLNOuXP9Rof+44`5C`=s_jVsfS^v;K`!g-kU^#UKWV9}-qe})S=;)5F z#Z;Tb3yj4mx4GS_3Ptw|SA0vo{B`^Gp?A{}wanPrWDM8eGLwJgf>oUIqkTji2)zJ1 z_~^4com1~-j~lW<5%K0ZG2ip&BO6%JirbQcxI5~EbC9R?F-D9QGSlJJz$w-?A$a;T z5G}XKsByrOu4c)pD;Ka|EG$q<+J^Z(25sdY6uVSg#9Q(II8l^ql{jtvO`r-pbfetA zKefwT{rc0H;3<|LjpF$-fjeN)wkECR;}zXeaiVC2zHm2G+SyDSE#DL4ETy@itg!`* zD=rJ79lA+1Q=%z=(WG-kk9HiL!0PqmTeh2>EP>VF>XEte4B4OolXfGI#$-JlR!oWjvzTp;I-reP z6u{YFN~El9)9!zrjC|AZNGZZr)zZPCt-nEZ04jINCwW^l0`K2cOk!ixIw14Mbofha zJHHf>c#%zX#ZEC&HeIRnGID7B6M2R&sGOJh@rlsK9s+zSLzq+pW^CMv*&V7jPn^ak zmvWh@*qxSvS>AZ9Y#0KS?2duZgcf^HxY}t-J+@N`s9$Y|@;`{5>?q~}m@On*1r0^k z2c0Wn3{O*NSka?nX#6*;-eAMCSPY@OZ0CthYKlPMkqF;JAXaLk|7_Z4W!491F_0#m zzsnNfSKnw6y(xL8@9fX@)(ONE4&7CvI&l|KO(jOdEpTSAEEITyuRglp+^XRTPD(hv z7ivUznbxs|!Rji=qB?{XE|t-WH=AYBmR>lly^H>S%=xj$kK|kEIdd8oSh0KTNSKNA z`mb2^{WgV(*-i?QuGj@H`X?D!zN_@3y$Nbi?d?J{L6wuGb|5XD#1JwZ5;y+JTjRmhD?xJe)-pRQ zj;*J|TyzSyjE!Sd9#8CECDR zGL9|S;~4=P0)%e$hLWc~+{tZ8bK{&xzW0`;T`4YdEW$!4Jbj}!_3peMz{F5L4NkH8d^B`s{nf+nW=Jn?|$8A4IsH>JMQl;$aY%;O} zsCQMCAMd_9`#5!(cYhKNuCFLhsTr!hxeIV;tSnx&xp+CK^AQAGPdOckkGT?#%IxxI z-{7yWJoaF9BDZbeR8GFZY+}BR-3e zZn|Ly*=y{6Br4N08F2pU<>t}%kAm&;7B!o+09*X3R1>$h1VAPR8(Rw{4Hxg8J{NhB z&K4TL854CgM9ZZw=J9xt%4zlMq&^qxHqrS!hzih$GktuF*boGUREM0}AfT%3m`Tdb zO0gUj5V(-Yg=RirQD2x5%_C3= zLfhq_>%EOdQtXpIEfNW-7ITR?dcp&#TjB-t6PNzt0?4}J`;l4taL!&Eu@Xc;Z25GP z2ebGHlfWpQoDmi#&87vAuy(K%q?>bqr=iCnvtXI@+OPP!sE-3nhwphjJ}eRpfBF$- zfQ7{BXstYVmFVD!T|)J$Qu=GQZjI;E+b#qg*K+4@RRSLwo&iltG^)c-SK1njdi`RD zYJ#*rk*c~%qnCsi$w2=9&SUOUQoF(nTW||c5MC-5xdmb04nFxmpW~|kTEY2XHNtK2 zz>#L+er0dl`JxhL!ffyl?lj zvyax3KBe}k7ONtpxStNk`^+4G9p_hfg)41}POtUDn^g|(wOS7xL=J!y1CISgfYKDy zD|GXbi&m93^}N|(uw$GeIwECMf>U5ol;8c>z}-CeHQ#8Z>H_OxSXqM+>u{%h;XobJ zMVR%)gIaq~6U=%nWz9nnctJ|?xz)PiVrbc%W?!jc3&UY4wt7=j%6C3Utt)=bs_Z>| z)@=3jc1&`4{Uji?b?>F8X6u@4sm);6o~PlFXSTWS($SmbfKM}@s#i9(va#x8$qoRY zHBo>j6x3X4=o>nm$O+Nbo-kS86|Qv>=8mN}uM#A^odch7kEHS2Gb4cPmbnwPU0K)e zmiew;@K}ohGg1=2yA^E&)Y>rXBMN!875FkgixPEZ{&-dTv`3?SiPqqTL1ao2>^?g) zjwyz@O=Y-pW-%pQD^i;9bn&@OA{C{TeMAZBN2QBkSxiKff> zr2D*Gr1R29ggeoXNn@?80@wQT>lKk4pq(|bkfj2=%Q+H)25m3oSou!$Og`}UB5t)Nn7e2`>9eBg6Caeym@E~9~5WAH{s&@vSslXMTR5RsYbT3PJzLI z6BfE`D>dPM3Lj?aI<<8-D^YKqzI&2bGJbyA)KU}j}+iJAV@pt<5*trLm$iDzXH z_m`7R3VDrXLG5pN0EaYR7h4~RF%*YDKN@ACSr^W)*Kf^tkkTuGn3=?@dvu_~F&}Jp z?|3ru*ef$x622#bPiC6H-u){3jm~$j+IN85M3b7Jm%$+)bDn7^N7W6#4c}~4ZWg*i z`=Vzj$2#a?>=OA{hs^AVl-^MR=FRDThbcE@_n=1eYMw}~r{oEQ|4wpleQ=`BRB}E) zc9+fYlX;%RjaSfIQ4&%uSfRzS=!AwMm+CDwi%!l2Ewj$5&riqkQs=t`c=ph}6TE}< zY;Ml9dE_#XVmIxh>Dk_hUlFpSR*;6BQ5z6R*+JZc;lpOCHLUgDQ;&HKgc#^;*{!60 zy3nz!2R%J*=~zex5>n6u)=+Nf0SGx>9lG-oPn@aJ2t7%MqT?<_2AJF;hr0JJZUu^A z&(aFR>6X}DkKWU(zWJV%!!*p^vN=KJeRO7gCeZm-ikc)ZPyK!J-rPVm>QA+opmB$f z(VCU`z4c`)4IM~7^d{p~)%~e$Hf@Mya?qQjoZO&=X?()K@q|@F;6fC~^t4t>zq&AAiQWYjq9o6svL>PqdW zCJ`_*oS^6>Ua&iY0v}*ELl9dfvnPCAXCt zD3ApXuTWQ!`L^BQ)-tG}>5bOVwDI9UQvOBaYJlbX+5DFz$xrRS2vg5nazycZZx>s+ zbzR2LC)blLk%6ZJ=Y(FJX||?@cM|??FURJk{J}-KC$TaaN(YheXLI?dlY9%_i+MQd>c#;H^lktu(=F4YH_vng4dm6ZpvTK9( zcDsc0sFQmA!DvDPy50ciFD;oQSTE zrgB_a&a@ANvx1})cY6u&ChIhkr9)q-J%^#F!R)pDa%`v={+v3XF6W)PyG1jW6ZWo6`R@t2y1it&EdwueCSh$4eV3op;?xDZ53|CG z@$z6JTT_+r*bQ=Aqxn*v>i*o#InCIVNrb_Y6)G=Qg50`0%W#2<{voTUy(7`Wach-y zE&5Yoi=t-UPG|8jG=iaa#RYO$#&>6RsQ*e~D_d=az)JJ$dsX{NRCfs=E!lfq4MN_< z(8J~D)n9Mtre*7otku>^So7P4&7$VsIT_b|J2h`mHE;0kD1yjsK29YLw}p~YO;c*w zF0YP%Y4>gXV$N63L?&)c>74Q8qb(fN9JgPj_j%~{8LAX!Bn~}iC-VpOG z{ZB_a{2VVh#t)IL7p%RVtbyq%3TR7+@37_{b8Yc-H-tX1fZ?L*L z#f5skPyV?P6(T^}UFG8x8g`Wxl2~^}6xTc_#cLOuohDSXXeD~)z*{)AgV0Ffq{JRT z=k$_tPbMCvG$j_n-QY%w*ir^Rj#%gA=Y{7l92M-h={K_abKtTF(BD$|4Bppj1wYR%m5oan8Ef`hCh4DK_y+jVUX z2gMfG6egnE{saZc8mwFWRGw1q^$dr7zMv~yw7+r9@^%yN4`vc?wwS69$WG*gz^+m+ zCMG3GPq)qxHMe$hQKT%)XOEqM0C~0c1J`J83IEa#$VzEk(If-g&Q~mFzJ(&+#@Z|o z`6gXgxly;7IN1mRpRkbi5BUb&X_FKKaClJD%Pz#Ur{?)^(w`Aj$awaSx+MLt9<Ogos=jXQ!`in5SoeEhDRpGO|CRHH*mFvoA0IiaF zDJfWOfMb4td%pb9t3j0TGWcg&#=VOHsYAzZOkVlmQo=Qsr!5TPOwFn3e}r8d0u^Y(DYLs7fDj3S&6RIke#Zp>g=y{xF?(@W-nyi zhc((Ld)qc1ew9})y{9L*1lj#zyvKJsk?Cn{$>f`DzYY4$IXQchk~R2)EImfEMn;l! zz{uDH8gZH-kDY*1DGKOWku`v#veTYAUIJNP?^En7_N9i^u>zZ_iJ#g2(H`}Wlx(VF zCCvWV7-tAP=Gmq(-($-p=udra9S`q~BdwT1{={N?hO*xD#i-YG-oDnf7JJJpNDJ$` z^ITK*=2subH~g|8@F}QCT~h_qg4d{@M8ixjbgv;cDNigALvu4VQU3C`CfAUdj$Mn?IM$Fm(1%wp{@=6nsK}e zm2#I$Npy7m7-@Sk4 zkc&)Z3$Qb(4s0qm%52>apXIqrxEG(Td1Rl{A&TStEb6wQ)o~2FKF%Z8Attjk`wFPF z!1E`>(FL|Wju_Oob7A7Q9JatK9Yc*!3dU)>oNrJtC&Lb)% zwsos%SB#eR`Scr4@$zwz*2eT8^ld7;rTn39sK}2z`dSWFuQ&5m7r#nQ1WI&!)T>9jw$ql~zbifZO${?~lZ%un;MkLd#r{en~uH@3X^nNQ-|4 zp*>)+@eRPCm00$nKF7C)aJd3|Jp)!E!vKF5}3{wH}k&RiAr zFx(H6PhZrP@kgBJ2W*nC>7~~)6T`|4DXqKFR02Fpi$aQh1YTn-Wv^+Sb9{W(TJ1O?OOp24TCC)q#hagk6GmMxu3I z;HDY0>!>K=O3E#k`x(DA?JYn@^1yi5XT_hEC2Q5@qCQ1;=TBQww?lNpoe(&m83^m8R&dQx)p(s z=Ms+_C~?1l;x~4o8XvL@B-;ab2EvO|AB$XaUFz}EadxXa4*$%K(L}0P&FA7Yn6dY2 z$y+}Mkg*1&awgR>!Q_I8ppn85YTUcfi< zM7gW(!mJ*5EUUdJGNDyQGzn1dde5g`L9NC=hz*xSAd>5Lv6q?oeShRz$)vpF&wQ9Z z>BSv~jMN$VB%sF-_>l|bE~Z=R{8OOYzH&R*Gb3%32?4n8sAhxsQ>e@nwHnvEC6}Q> z_>fuc%#RBtG}4$+l=`N8(nY%|GtL2L#_)O5^C$?N0WB+5*FAIygD*e6C7{PM!j|=$ z9?Nv*TGYy^D*RN`hq};5rsLK0R6~lDkhNcU0O8;CPxs5goN4n?;KisVo=R98WEk z8s|AXl0W;duw{6@h<#qE5Rz)e5ga3H5qQ3==;YDtcal}j^TCxpsRMefwt7CwC`%%Q z1>Ud(@(=1a1gW|3pP_jCio>Y5byt;~590qDX3*YAzo?j6A=S?uU1zY`-Ycm8zQ>63 zYSnECf`9H@I+*v`z8?M6P!P83#FH3$u%%sUOo@&w5Dw(pFEr~}2^qrD@xJx0{P+@8 z(ZuxCO)=zbKGPc$iaO6_SNGo->RH-d*7L85!Vhvh(tWc5A*Xq zi$nh-b8k-ZIJu4XmlI0pao9E;o>MDaue)_I+lE{9-8j!VIr{zz!x8r7LadIvjH|}Y zH-wHdEjoz3x+Oeptb+$ght;!Rc_U9Rz1^>BQ7XUcx~(31LKifiZ`-@@UhKdt^Ai2S zPQnM4&!CaQhU3rT$;q5e{Iiua{!dXPA_3hwR_b$po6C30e#+TW@t3YPnsEkV$VZ{| zE@xx?JavDf;n-?!$h}$I+94M%7B9Q|ivpb&P*k(DyzI@+qp`{~oIulfJtRRI{J7go z;c>ivqYm6PDu<>f)~vMHA9`ek?8?_)znIwD1QOSU`*N#{ap*9^TNg4`=bqQb8VTGF zirOdYc{L6PJ#C4hdP`L#ieIb{x>=t;e2HtFb`0(?HT+OmbcNn^)=^hu0d>`WKVxZw ze}w~EV=G;B=w*&9@Mg7zY|4(+c?#QZ4~3N0$?d&k85`^I1NEO{8nLp?fmqEm?cR|1 z*dZbUwQ|U&tlv~5cOE9TaaS>gZ%kP=HbX@iZkKR<9A~!m38M3$mmbzR4A$9ji3EO! zeA}FEKl4`&3YT}8aB(w0&u^2wn6ga@WA%L2MKw>utHTa>Gi>Cs!T#v4jM#x1!`^Q> z#k;?bY$a>zF~-=@wAZ|tOgfbp&vReN*mk>__yx;^%rk*L>3=#4QGO-#)%f+;H9#Od z{<%zGH@n^+r80c~h;01&I+@i;kj!FvoP6M>Eq9hr@rO6(*(gw+;bLXdWr=j_ zCAQr$Z$bB5k3Ux1>CBZx40LB8Z%t{(QT>?9Y7ui+*fK5>qm($f0v#7(SnJ-)J{~=3 zUTaP?>)B3Q%PY(fv+bQrZ4x&nR>!lvvgvI;c5VzRR9KB7?|7k28f$Ndl8zRx!<~2?nMm8@mZXE$dzRlO;x10}iR0 z?6x4;wq|ERJ{H{+HM?EYgYIZ)1SDoTOU*lF;4_ceVBnoI=j@aQ5N1m*2eF$i7yO!p z*F=12P&kplk;rM$*{7)AotSX&t_`7VC1^7^&D)2Yn^qFCCv|N5zR zWe-Fka(S+-C6|V~Lr|HxQa;iTupjkN8LQ+^+i%H{p{cg_em~I6-~14;-hb>2L!bbf zQY23e)}z|!VUUzHA%@LqvhlUS{+nmzX8=Vrq7f#Od!ZoKM2D9f)LT`EJ{f{$d~0;p ze==@T;h`DzrTQEx(&t3q!awn}VmJG9ZEeNDkm_wGZ~SZk&~H29%*2RyzVsR;K~EV( zhb}b^axizEx@!Bj*>7o?^25%X{^#+8Af>ZLr&Ea@X^6U?O2@l|^LatewmVjj?mx{T z>h(S(rTO%}lPe@cIBTN&73kN3?v{?r&T_xC)L^?Y*w1L+=Yfk!&szVZ#ayr?(Xw>? z9GsT#Cc9MB-}9_>#&;EDcO(3clNECqcRK!S9sEt)kV#gj8%$R5Uvv}yh6^)(P>9cP zHG0Fp-WtI6AYn z!y`CGyYv9h?8$C?iT7X$_ z`-T=J)x7zlX1-ThAZes(w6Ct|(v$*E(+J%^3ZKx0F4xxkdWUA*iig%#>uP3X1xyC= zhU)WsDgvL0Nt|V=1`#%lla$+~AzYJ+gNpJudje*4xeL`zrFiv$JEr=Dl;5 z=v5B{Z&D7HK1~T)x@f}%ey3pKlePYS=yHsXMd?k$`^mTe053jbHU@|WXz2fx)Mq&? z&`uX!6Ur_KU#z1;#8pR9eIyUgxIi+jeeBsG{CXj}s@U^$-_;qElcHLUy^t6ETJ>BAJ(CRnpDRSdEwNgV2iuqXY ztL%@#RPfW(j(+?4f^A~vUM@-~?QAzHw#a?n_c7=k#&KD(`sVmh%gA+{Zi8DcOf3|- zHRh8mJLjEu>$z0}2-Y9Hv^X4(?+U*%p#VYyWhGk4CEoL$faA|pRCn*ocFYIk{$n9o zI+WBmR;L1CHVg3!v$x_41{mn`sm0g_h01>DU)8D&$SmU%)R;*~HAtIe)=is$>9v*R zKBoF#{SB4QtbX`U=->+E@|srKkU<7E%Rr*7I?i`ZC$QgeuQq0L*S@2<^U7Ju9q2Fn zP58|cw=i%!A&K6H8c3=@JacOjxvI;I?Q4sf@S1CU6@AfI z`>|PvoeKFS*w&$w7EU2<%cT)Fv$V?b`9J;UUwJ9E<~cSUZv3R@m)l#kRh<}~SK{$^ zI=Y>6IVnzX1LDNDA5P8fQf;1HsxaNt>5^}Io%VzAyPgIdtNE;(0*~JPzhIlvBh=68 z94CO`0ARL{`~o5%eww>|FTo0Q$O8#tpX#=PCFhG}5jVQ_zgaQ!L$oz>2z zJVs6WcEV)5LmhwV*X3~?jH_+70bZ@aVq*BT3BeASU3@)2oE1qJ{{r-`U0HXTP_xFA z$?p1&{}cmnM%VkiUfb=nx!C9$##RF$bAJ-H3hN)a^MVkKuCc7AsVly427*x#Swu4} zxhkN=SekeldNsG#2BIS!4f&0YgksCqH*=-co}uef;df3e!8_ zk)7jI{QFD`Lv^Xo6aLc#h4kL4~sQ(&Wz5`kcHP@xVTdj9y@l&A42Lve#^Aw=f}WeoZz?}tK*X@wWI4xQhc7%yz@VlV22 za$YEx(ljS|hZYghXK`Ll82c(SwIJ@@OX|pa;&pmggp+^k#29>3cq*t}@#r|ABO#;|}>PWhC0gz|hsJHD*b^k#} z#TX{67b61{?Ues*-d$O_jK8DOazj8T|G<&yFY6*trbJ#4OsYvzXG+&n>@^#A0~P*J0F4xADjlTw;+#(V z8+}Zy+d?-;z2geXAVr|AuJhacFBGRZbbl0yd{-dF_w32BU1KTr=bZtP-yICui*hu$ z6cb~t&G^>22PacF2bOGkPgVZSUHq>b%!|BWu(F)REo3CF8K5Eh^W-7>$2!`Ox`)33 zVKRSek6xYBj{RdgF+Z9N%Gw$LeD4a!4gPv@&vntrvc&Zs-nE|0$u!G_a@Zp-JvU#U zggu^tJoLr(E5Dno$qaO`p@MtmR$#48RRtIPpo%1CxbIMJIK#P&bwl}avIap$J?n^ z@Z9Mt^q?L}^-J;i_Y`IL>82y1@IpEI`@niOyu&7DqR;BW$AL9Ofni4Ma61MDI-6j(kbOKC;GLpU<+Fu6=o)6!r~c zq3RsIYBP2;eGy9aiG6SNeFYz2)U@JYIIqclCcc(KM>7cPx_)+_r`0RE(KAS2G=zGl zC3L*K?|tk4(x6Khsh3&FFntP6m{FgAycL?LXX zl5?dKk&#ov#vF#RISq5RIsDdjUGKwn`&_s0?@u>wZqMiA^>{uW_s8+B{ot50 zy|&1=jU7!+dc5I~ol93(fz#xyZ_nXHWfYfZRtBKIAFrKsOt_!u)L8-^#Kib zb|-ds1GV~kxf?KuyksSIVQfz^v{nmL8K>%6*RE?ef&!*lW6G#^;7`micRqfJ`bm>ZRFLIN zq~FDG+G;E()^AKluFc=Q29JL12Fj2!u3C@H7B&dZP5M}6K6CHx#tnt%#gCoAl`F4m zOZBb=7Vym-mHh^q@T?;WF5K!>KlgBqAzKRbR~P8@jxMw7E3l>H)RKQ046=S%Jb3mQ ze0xH>`1CX6-3d6v9*kD^>;`KD0VM8S+ldH)qI03 ziNAe<%aPEi%w5^fwE&$=Cv_K)%M+pPF3ph();>n3)+!?B1v;u(LD#%;eQ?CJ^mpzi zD2~|g@N7)=-_!(-Pnx*F&c9WEB33j!*z=ZQxq_ojf(tWx=iF_KKa@tN>SX!V8+e{S zSgi_1udkQqqzk%setOu^^T1jE+U5=6NtA5u!+y+kW|9+C;fYa+zEMDPg!U4!HF!@b+BsyusS!uOiGHnTs_B6oa9wwp+Vp-FTps~{( zCYO|fnCT+|e#m1ND@-4M9l2GN@Ap}7M!UpMThm<#c|Q3RyIwG0J$J79DyXSeDy?&4 zE(JL)u`A6TfUzE^1e7bxay&|DjxlE%nY*ziR%_3l{Sp2`{nim99xWxJz4#Ho*KNTq zR6#HIT=z4{-M7KkcYuSOr6&x`5$ij1?)DvttCw=wgie$=AaR@e5OedqPs=v(GSlh>DtN=~ zT$HnKS%aCz2Lp`2Nt`DiWRP62X_YXrMm++6f~AXe>DQSq_KJhN)T~%`*@*L;@XFe4 zVnE(NOA}Nv^_#Bmt(R?|I?Wffa(L0TM^?(@?BC{>Yfpad^fTpbo(}2L{4t-s5+T6J zfu8&4q$=k`>Lihx{G-Lxtx{pWa@$ZJBHE*#4|++Sw%nA~wr*Mywc>OCj{nWdr+y?kC^6GNcR7cTOM$v?H*HQTk;dc`j~&&Jd&f9f5K z5Z}E+U+eFe4{#qA(1u6);qK(ebb7e!xJ$grNv7MUlYtA~^zpXDH4^8iB z!U$PDJV4`j7n7b(lsM}eW@YwL zcTnQgZsbO0Cn#?&wM?2@_d;2oxE;$d;_yzMWtn1ccO9efLyYt}!o8lRy8jX+7fk5g z-B0W3*+;w;ngegekF4uz#(nxR>yc4jCRfn4JvUP1OHbqNkv4cy(hTe-}0$j9oor9ALS!Oqvmux{v2V(OT5KB|&v6b&i z5RIcK2iVPEUIU+Xw{W`W)Q@1y;q$+&*T6?Mwey_K=5J4IUc9zZ)LQD<io({&I_@a2(c>?th zf^CWGuaM>3<`Sp#%bemC^p1k_NacSu&siN06<0vqNqHHIF8f>*HGTP`k9F=!a)5H* zyPv%XtJ{6<*Y1@Zx`CcM*4LrTP@_$ff4M0RgksES7Hv|qJTkM`R(ld z65GJO^>YU$PdZ4{xf^A>Z?>HImFdfA$__7ks8Hl%^=Z9-@ez6@UFacawCTSav^hzj zCQ4GtDd+tlP;@?qOFQBI#`W-G{EgY49O{cffM1!sJxj@>C2^9>!>X{K5klha-G@A< z#XzKZ@SFsQoVb&k-5KCKyItXNAB=jtDO;Pfa-}sWqDAe5dk!L^zo`3d{;Ag%sd6JZ zGcs*HN!i|+$`8YoW?De`+-&dH1?`chX%oawOd0~=;R5g&6({SfP)h->h@nYNAv z$BsZXS8o)K@JdTbT~DA=0}a%nTgSpL{PA}uBB#Xg&N`;u(AG)))SUpwuNIZ(P!o4V zi`q?dWlMTWmXCHdJ*F#eyt}os`i>~DyE_n6V%3H%aYx*Hll#NOoiIHYehU8iiiZJ#t|3*@njmd5Je&@fm)HrU9^%rI;o}LF5#o7vMW`Re zGt+mm`ZF)Q!i1ie*BNQAM*!ZK3;_d{AL!TNzQ_yacAllYv|CP++t3j5i0O6gB~;VO zr|$rl6vAkco+4oHhsT`S4w+OGTKBXz+%pqMv%2ny>gZ(N0Dhr%jdjbPL~uFw`!0O{z8L?>`fZ#p z%Rw%?Ku5zigt7A^L@t$$!U1$t(zHfKymav#?w+3z-3`0zoMF=z-C;fkFMfTEZ0b`i z(*@8NfI9t}-`AOcM`verdir=(`5>wh5IE&thgnY- ziz{MhE(pq>uRBM$A<0`FL<64P5MCA+vv=+3NE6K$tC;GQ#aQj@Jd!f|kRXUR0vrS` zi?`~}VTzima?R?7K|deg)J7nC?`WCPQK@pZ3J=UW9~~??^c{!z&nqDBH%gNYKcIR?61c`tg^ZwW0n4 zizU_LG5@%#Lo}Zk%BPZ1s51a}$k6%@oh^y&g@V2gikT_Gg9_?O9l1BA*TT3_Cu3zi znY|C?)e==D*@HO#^#v%_&_9E*KKEjynfAFWN|c@zfk}Uo5e`zb9j2U25sh zyP>&R*+WaE)Abg-*%1I%udn4G4z)7HxrAXFR7r6=C`C6G#VDz@#8F=mD3`T2&zYrR zYvwBrKk53h>VqgM8D7t=LERL)ivUgEFQ{IYd(cVL*BYadGw~|NR?oX5%X67QS|iD?7{AZZ4}>) zpj}^Ttfh$>PN}~7>o8{*exQCj00f7!Cb;FZ!RWHIaSZ69HfsgKkvh<)MxjaJmVnd{ zX+f%XW}NxzX}rO+`h7y9nxbPYzf6c#fpOIEjK`sl$p`RE)h|-`OTsM+8$Y&cY!BEj zmp|WVg>mK=tb9&ytzlE8w?UcI=*{x)Fes{eWnuHuNeiXhgMG{_e`6o@NU&S_S`jo& zqNGK~tQzE!$HZm=GIlDH;o03-Ttag**{oqLv|KdHhnmQLNxhPA34Ul%?BPj{rbT|7LZ_g-&^yOw# zHgJ6m^i(RX!h%{h^w|9)uyWRzOjP#G*W)kvs6ns0HO?Trbtp*(6>WxMDs zCk;TX#``C{Hx|csT5n+k%C8<;yt*4@hIC|$kiqOT@uKpka|Y_adVs=<3t^<_YCC-U zwN7A{?2{nzz0&&rw(S(6zM%H&!w-Wt6W@#guZ?o(0U2FY9CAPENMH+4zxBuuY@i>y)ryXF1 zj8Q`iH!QH)yIVi6YXEjCAE#hNS-{6>PD-W~k(2jMt7&i2%2INM)s~xDr@cwKP}cmy zW_oZDi?hhzm$k6FvoJle-~K_XC}(Ghy|y-4F}>Tff|&*X3M=$H9O}9G)-x%c)thbl zd-I*UtXTK&70B6YHPa?N@;c0@fp^2e;;QZIW`Vy}q$o_O9yW)DaXQu$NnPPk7zSA? zZup;E`fk7Vy@wvMLpS?Pa-#S>Y#iE{5csDFQ`F$H@nxQVOOW;`Kl3CJFjUJ^%)Sc} zs1U7MXogx&GiK%;s*0Tx*Bg!vDTWbkaSX^ORr`5VM;~vNM1g13x52H-GHMDtIs;<) zj&NccRY?i{jGD={UCM9+LPNh{eXu!!HOA;G#}08x$ko$cDs8?}nwC(j=zJu9nzXin zS_sPi&3*Z>q)|50hWCfEB7xby20;mn{hU?KD`q_$Dm0q2T(v+Tt0!Y*yUV{>g)Hv`P1V_9V$9ZY3kX(; zF1sXd)cDg!cd@-YJLw!!G&7};&9>}WvV3bmn7}yuHxEg6)qG{HXvAQCTD6P}S63jh zB#U0UP*%m^$;sxNgOa4P@{}SJfi>gTG>Mwl(4{0Emt6tM{X3L}^717?9!bAOD=CfO46 zzV8E8-JW}>0wMO})6TQ#NFx2fJKGTg20$TJbz${tDg}=FpsQUgc388vicWu`r>^Tf zoxo#B!$UFrcLH{ZhlZBf8{IuU`i$g>CKrL5fQs4fX%7bQ^ibtQ+1lsVbL~1ke6v&n z7D9RG1J^v1gK7-b3I2!*rB&&AeH`v$`^rt3nqf-QsP6qbBk&g-j{+^%3Ai_?w-b|H zYMrY3jQxmx>1MNjgg_}fa3Mn)`iRY~KpznVWX$7tH+)N{hmM^V;aL;mvauh54|??Q z+buo|HtE2fO}SS)6ACKe>9IZ?z$G3&;Dah%6+PHwB^4Bf$ zvllkC7c@dptl)YxY4qE%%g>1MT2A79xf#dl8{KKtp0e9I-Y@ZJ zY)%NN881b7gF-yCf~B}{*2omxeIbQvSLqb>>9qqRVXAY+0PnSMvteA$69r$!3R-GE zDK%>iA@#)rMP&+O9P|;vW!rkWR7!%+e0vU@($>RpbY`AsXX>&tcX*b+iPd_sMi#b5 zrUiEw1+yva8p>cHqE=}6W-hEus_Nw21TA#jbBE^1!p4IZs$ne7{^lRkxB`?%-3F}{ z!+Xw<&r7ia??v4k#qX+nFDh2^p!bGMAyZGC{k}1k-v>P-_f~Qyc+Lrs61#s524`3>E)xaQLB=04fQOi5-6A@YPt1c?LN zEg!af*z-_|?yp++r7ZYtd}8gQcaI5!|7-yiR3@lK32k=Ea0QhC+=^ldn6xyVr6OvN zysn>{W}guQtOKiD*st3?hisVq06)5wnr#mn4s81XEe|!19oq3~3)qP7>EX`M9Ee&F z0EyrnVU6@UFp%j4|dyZPCx@;vKi+r4IfvI%x4%T9h7NNUbj2${4D z{_F`H(_AHlY!TR|qXj!N1?hi?&uI7@K9sa=OIfwuW^Hhm*^`)F?SmTSW%Fx8aWh|b^-ZA~T$==-IxTadr zQpWCP2HP~)PTt4(VDS1v$S#`=HMD2jq?fdQwfuui3ys_+g`h&(HzGndA~@?>wz}j; zo(6S5?0OKiCAC)hd^tUbD!!J@EB=izrq%cC*A@F(wbzGw=uM0Mgp@|F%k5)Of15{k zc!}}RBxHLShZ~XLB&aq2N=fN1gcHNj4*(9FJPnvtT<{hvGplU!T>JJ$UE`KtLHlGd zlSFRUh|E-?5>z3a?wR4<$>b?wnE)_602f;s&}(5&YLsMpTv4F47JjMRC+@+MAtUaB z_HOU!BN!c?KP~6b-ksCYUOSffdbzF*-J^0n zJS0z)fG)=@vLI<$fQ?YV6d*KwVjG{q#s@1`Cv|p}c5SDtH>0+mdb@n9f@&RKywbF< zXnlP=^DI*G6~=UFPs8&QV#MDR4Q#B4<1UBj0LA*vb`UI}^>BydhijBn0Wb}%~j5qtW|uphS~1Nm@FXaAU1eUz*F}8 z!p{88DHLL`O<$dMj!WQHqqX#aET_mb6LQ6A0` zU8NP~u`4?JkmnEmxeK5>a$c0duXLY!7bKGxuv^DCzhEC1khe)TNA?Uxr`;>JyWrF6 zn-@<74|XnsHLurxftB^8J@Ir`TbA*VoJOkJo2kkHdp}(h4 zpZyyn1zjMKZK6xYxX0Gc!oJ}ymDi6}vN*S1VBr)zVVh+<2?#qjr8(q^^6NI{WQUUhdNQm=yowDH?>9ia4tf8lr(o5TD( zTSe30y*RPAhyN*NaB1wczU2-;c~pIF%`~aQqL>pFv70)+k+xdw6CXz4aJAxOW@v<| znPBkB#)@mo^5-`$DY0xgW&HzqkU^>FYu%Y1_8@GCdQOO1)0Gw~3f8lwp;hgJj9b#k zsooXlJ?h;mi-Q_f-iJ$Pwj2ey2KDyHMu`!tM`;fdt!MNcmd35QQY-sqxGUyqRqzTL zFk*HPKRhzwt%ew| z<)|aIF=`?_@Mn9vEaFDA?3m3;h~rQFY05DR3ZnsNy7G083OV&tJBk6p;me!No?Fe+ zzo}OeF#%hsB`ZEpLrI*QWJs5VKXmJB0qg4sujT}(tJUjPFOB)84&jgUc*%dsXVIbd zWm=;pU@ppO%!1iBuc?4Mx1q5p4oTGs8#9Y-xVNet(rM{2MNLgUsKfq(TV3})-=t=6 zVWI+Sl~VDg!-7jZE-9tW>N%bVhRZcKubUl(DIj|ny-W`|3OH?Z|0F~ncL~{1Rwh_F zr&>}*ehw!5m`=!MMXO4Tx83}@IN$f1mB?3AP$)NYp+txxKkzz)X_kU{enndU4otaO zz*DidLjE|Q+(}+d%ws4e6%iT0HMtipMYPFdj(!UR$W@hWe!Lm!s?*%sxewm7sH`Ks zvBAY7p!l=M9K#O^9Bqi_Rd8c|e8vw}-1*IEQ==PKd<-sqv$d{DcuwnVaHAShpCZNW zy_+4v%042?ukNBT2ULh@GGG|tp2m%d%JQNDJ#pix>ue6wdLJZ-+zDq(P z@f|MJ&Ge!_{;hc$i&|PPdKdLIVO3|++0ZIRS!Yi@Nr(V@=Q-aH%Y2@zrRxKdhQpST zhLT!B-diZ2XuJ8V^-_CcGVP9z*U=!gS-T#M!pzC8#rsIN84g+XyB$t^=(CABuIeeO zY4%Y%9H#oi27AZ4=7xcqX_eL&ouwnlRH53~cLBuHkD&~*6aTcMmgv%4%4Xo6qSOLg z{3D{Q;0ME_v}Saz^AKn6v5Bya+0Z_zsLY3S;OW+m)Ue|cOK;C~^h&IUcjO<2s5IkB zOE}H`M(OyNJSU`il@R7|owg=H{>+AkC#^}C8gSXK8xbV4UR}h{7>lAcF~Q{Ma@Khp z3awz9TwuasO{(jQm8gjhq4^F*`F%uHn}m}R2l~Xt?jcVlL|>4;RS`*V?Z%9uX3K*i zbwbO=8XTHTHPazj9Ae4;{kUF4Jm$d;C!}|g&&>HACa|!@eBTH*?ce;CZ(h;gSa+j> zZzA}G){|wlj9_})uvXlX!v=52BJZ{o#650FtG@fZ*h?+f`BB>%3x)5}Jpayhj~+C5 zIvD?xMN~Rl@#X-pPqFYX{wGy6gZZZZos*Sx_uLM3d8>i$j?g*XpG!onDdb?e?to!X z&EsI6P>xb?bVr81Lv~*oeTy6_ekMj~iB%ivN2Key?QC`JB6oe|CRWXMCd}3#PS~`N z>BQh^<$QhFQR;5=tQ)YkA^|-+1K1e@%)^b$Nr5-xkFQqm^RCxBk+;M+(3qri`qzF3laDtaw+*ll$6Pxc= zV6~7xIaoQw*EFh1+RNT+UQmG4C=q!GyTrZv6u z;8yJN#`Qe=xgROb*75hEc^&z*n*&47W1`HYba`PFH+(7*#pQrJbvz%KTJ=t_&Pc09 zJkbBn#=YnGO|n%_`gzX>>|62?R^wm3PhqWnS(&`V!eg+d*1=n6)qnV3-B6gbg1Ko$ zi!|P5WX7s*6Z2qH>;7VCpxKva`iJl|%bGQP$vdP>yVwSBt#S-`>-6OwAB7cdMF^;N zHW&ZFN#|LM_euO~Q0??{UOwrI6;rR`=nXH}$Cv84z4I4G_iET4c&s>7@swKMxlcpz zYQKiP60Okl)PzvuiJ1|xZvO9yHFM6}`}PUCu1rA>jC7#?Ods-bRblp&OW!w=t1=71 z6BT~}D`?_XQ>kdn#J(rfZqd>_YiGHt``0pi-H(ll#<04TAU<%Nr>B3OE(ChLf*0 z2FDRykfM%iyCIOv8`CveuIjzK%Kj5A@jI2tL0!u^uk%GhgP23VdM5Rs(q(|Bu3lQ^ zq*99QnMdurJ;$1yj(@t0anY(hrxl_X)3~tM-#n!D`1sMejVQU==G%xP>KCA~-K*Zz)YL<}H+pW=v2q{ywy-7aHxjq`9HnRVXwJ z@~|A?yWHWF2lPcbRijAcw&4z*u2!q+<_e*GeN0kT4B;NbLhVJjXyJX@RFho0_FfM% z;|>054CKBwMg2jSCN0@)>*zXAP3#YOJOL5ntd_n+q}gov)OqbCKUgDX2E@G&AwHkN zij5%iN`gy8DUzWI106HH<5$X_@fP*cuYA$7HIzOwu&=R3BtVEdY`_}-&I5m4 zijJ-i5J5)I=Glt5E1w_JbLf((=XZlX^d9smH$e<}gXL>BWtDUev_?a*7Wl``PW!{p zkVuj?ZA%~1hP{RMi;$XbC2)UCRj&(|UP^%2go`cO(XU?cx`w^Uv!T7r4lf+@3=N~G zct*ZoR(q;DG4W=TJ$&9)U#pnfci0JOFIIkk+)t;V9F<2tznz6S&!LIP-7p18=lTaz z17ggs=vnE*8`~CXSfqfEidgRQiXZ7Q19Gt-*yo5-ni7GN&ES!X!Ks&3KGobK(=OINDl1lHGEj|+GC<6`#&%P#R#_$Z zuc}&RWDa81ygvcKN7-jcNGHiCaKS7QR$oUC4ThXbOevv z6jHniQrogI{FmTw7r&oJw(b$MLGC>bx}})C`2GjC%)%ufC1!c`q{6nG$`E(_;Fm>N zr}@21pS4t6*k6T3P7;EHRYwDtQ|dNT} z{FpqxqxB7Yy@|qGr`zJOBfT*UTYv-Cyvz`F#!+?8Ir#=fu4*hDD2&{s{LUh*1qCf1 zZ=xO!36p%|H8ii;${x}m-Ruep-aWEcLJ03HR+T&E;GZ7UmuuITA%~YzSWj5@oI9-) zaGehEhfW-OI8^+WZY;g;SCZBlAB^X`v1h9N!9(K{i!_;xif0psboNnyt;q#R z$8@#V2t66&fB^0gS8QkQbKTG@ClLx&-D%gNHuG7znH>y@Nc{>xnls_;A?mq*PR zoy=S+qFg-*Ho4Y#(Cmshfnn}%9#`ii%@0Y%WNXoj6}66f8ZK+GRCJeB(pG4(PDWnR zF6Ep1Wqs4DA5F^OG=5zQj?|r}gLF2D6}0)_Y3+c!n>H|J0^v)n1}{v2bQvAM>6glI z(vLJRRd(^1>F{n6ER?1|6FH9oKe3|LuFl!@prLD=~~^;raHq3 zyR#uB!Rd?s2(;4S(KKbHxPZ~oy@@#}_pv2`_l>63+;v z2|pAQSlC0e&NaC7R}THRvecUjjV32T?i}oUGu@L!=p@gEo+$n!)H&z=U^NyQ*qYd>dv@om_Ci zzcP9Y&FBqVCZY*)3a-6`XjnhOWX06++hc?|aBGmG6=dYIAXER;9~6@0r6Q00dw0tE zEjpa~j4r?g1EdH2M-qhSp0R|h=?gOTV=fa>{7dbdTk@?O@d%UGUQZR&| zmErS#IZAxoA05v7%zm8dCvj=%qr{u1Q!44+r*>wz@!q|;MYOxR%8{GR7xD&o?~`z~ z5cj&7I1N%B5PZj>*Lg?bp$a)F;z>c>by_XA48NI9k@UoQKNDY~OaVD5A=6}-l?m|4 zuo7?*&mEQ;X^O*Oj`L&$^yi1@_w07Ty}gXtF8G=Bp!w-*ZY2!y(EiDcwWAEF>^ju; zY&J%1+|ORlvEYeVZX88SWT!i)A&j@ax)3G&eVNSNoKbEoH@Fp1^Yc|nuu&i<7MzaY zFR3}Z!q?rgS7+tK0j_@qd2N{b^Y)t_Jp;3L+S|(^Iy*~h2?889UGa!-t7{>!Yh`zb zvTIrQyz#WPFGi_p^^XF<?)koS=hlQ9Tr5R6Zr9oF9Arx*rpp$C{#HHqc7 zWzYTVziUU-cc@Xcia=W~A!{yd=p3S&Dz$ysb_2_@c|2sc)ns;)Q)sCBsiskUpvNRR zMMGKr&~WNnb71KcF}IfTVyv>z+fHVcB2LI~7Ov0M!`@l- zE09M;}hMb@4Gb<;_BJXGIv)x&?GU>ugO!I`y^xo$zIOA;@ProE& z+`K>zz63e!9(1QdeKIWzQJyAc=DL1NvlkAgkl?n+uQhV_c8e^5UAhnu7Ai(4$Azd* zgfWJ5JM1J2@~RH=LYANdlU6|`4A#@KbM9)^m%aatv;U2Y91=Os_2{o;(t(zH*!-wT z+`cLbQn}99<8!<8)u)HG;zq1D2mAFI*>C>!z%FoUmFd})z*6X!(g`v(1cD~jA1f!Y zYcn(_3o*=4N>J%TJ&&%ffb4BfUGTrX-9P&1KKGpy zMd`B-2wMidtPH=yOTx>oDhOyfcD1z#?bOj{IP{_kA=v*-FvYt3N-F_+h-P6TuF{;K z;vyH^mpsuP1!>>Rn{;i56P4GCW4Bb61%p=mA_h$tAX)N2t}Wj|WmMVra@lVEVKy1z z5K?zmryu?R0NtFM>HmR^I~?uV5FiXVTlVui?P|d%J2ix1)WLsi=D$78hWpj0vwaM^ zl2^Rvgf{049OOd)88u%f+JEclFX5+M&m^co+|b&iKBqMAp=V5b(sxHW- zWTBupLyd~Uc8pBBWx`T3c3h7M8!hj&a_XyYt`aE9oy(nZC(jGa;CYU5)*WVoIQAb^_2UFC{A7OsoaIDCXP0R&8o0<@h-`e&FUoI5$>0D&17S3=2wX} zBlrB+4xKp(i8=>Ha~!yKoeKrWe-_9G6+|3KArYe&l2Urjmg{&KUuRXo6y zrrK;53I5_Dt+VNXY-bipXClwTd<`}3Z>g4>1l5+2)%<2thwdlI)m}IJgReg|SArDg z5`0&;G9dgO!0!qC%}*^R*CpDkuFy37nw;60nZ~+!A+T;t%hwUbyDsrH;NWy<)9UyF zz4xsy*$VN(5`{^9K>qWL|8?O1{E%V6m*-LTCgaiF0{Q{n>D${&Nidy?duR=)xdiTy z4>p|S9~7ygFx#i|6`Hp>aks$^H6=n(MQb)YmP2EwS)3A2T(}CX-bY9Afy5;-i90Bw zm47GqBgrCK-;2K4DWxt+RPRSKqoo;r1d0(u`yj{q8AbmBoSP`zPdF;~rVz_I3gdcm z`TwCe$axtV`2%7Hz#0UnXD_@h2w8WfB>X1SAXp~4SvYJy5`8gIsVp6ij3dUptn|wd z17r}6FCb$`wLY8_2`htWRy==^mPEx5;o&)xX*`N~eHnX}lgRB|)%xO*?BCY^f=VnJyl zLu^ZE>uH^{hd}T8ZT2BSlUmctBvxikC!Hwm(XP=P*iQ>SKm^RXb{*&Wf6A`kgJ(k7 zvhTan-ka@T{pa4mqyldHsJ%)yR%klWDMswrz8rC4&G50U3+xRrGI@}xU$Akxo$-uqj_dj?A`)EH6`fP*nEhv871Zwxp&F-WtL)) z%I>X_59Yi%0qv{Gw0rV0BL8m@k%Z3LLl0oi@jmc$;gE4AIKQ@hp75O8pinrwrQ}Ea zkI+ls${h>J0VfkzZ87QsE{<=V*wALH9t;MolLe~R;o_8GjlCF5pY6z z=w%(?&66)J3r}^~rXK%9Q@TJu;Bvs-ERXha@RK*qTvQ@LyT8CG-#~gfP>7&M!BTpm zjdtv^W7|S)3TA(d=}4)2IcWMXj{0)ixTf312cftBE~z`1$rRRUTLyI(%AdF)%CW(m zra{*Cpej>c-$<0g-+#yXg*ab}YT50P;-%!;(gt4e0r7Jo)2=ZvQyYn)?A6jS@Hmk> zeF;@)>HUaqrx;~~N~UTIP6sx##DCmrG1i*_2eGrZ+3V|>HKO`APyO}i`}O%2ZKOCK zViYF2x1dK?txLy6>My0SiQ@C${$&{1oF5lky%_57_KKasMe9UwWYI)mX3cX&XGKAI z4VqGz%Mq$gUg5$SZwCFV)i z=NKIl7F0j*CV$j&t^u!IRg1F;E1FrO18yzg;)k29)cz|5_-E$eKM!q{fgjM=T9pPTQ~G|_jw zi#KTU*(`qC`iCUbR-#Bf(`3-f*8P6rIn}yn2Kq1k(yS9SW=FHpf#y}WFq(bzz!)c6 z_L-yy&F?YK3Rw4}Yh`{B{Abq45K19A>+cWiP$26y-`+jl-kK1Et64e930@4Yj1D;| zjwyYUJtzK`RCz*;!}dsi);dRRvG}#GI!p5W`Y^V7&PHn}%P)lt`Bo(oZR@QFc$tP1 z8lON$$z{Eqtvpt%{Ne%aSBVB0g2v-Kw{QTOEvIc9Wi568T_Y{E;HwHtTW=f^Yq6O- zhZ9hyYSLo8+i@1d8-KU#)*p?k$4|F21#f0c?@S#XKqU)s={cnErBFp z)35G>am(mrbI+-eETHyNZk_-UopaY?a5sl zk|(>l=wiE8QB$n^**$#)`Pl9|0PbVJ*?1@2Jo~Q3)hO`HgLYd%+YeZ}9#T6}IYJ$g z>LkzUkN-zuo+PA>fNP@WY?CE~jJsjvHO#@DLQ-K?yZ9;ay`JA3OEpPCCw97otAcNVSx}6C1Hm6Pjdd!e%-@ zyfd`Gm*BFCTd%yA9}BfHPYk&`MbyLag#KybgN}s4T+B@Aom$1PdW+J%d+&I<6?8~eAum=+=0e`NXwNOR zuMOU8JCSE5aP@-Yykpr$l!>liFO$q2h*K$t$KD5Cd+I35e~z3=Dgs`YWLzoeegM1GRh zJ)ogrcCaqWjv7;t$t0?|Sfs;ApYHWRJc*yg97io6?kQ_{?Tc#rYi{I6r)l;Z-gmYy z9#d`DfBjCW#yx;$2l-+L@yv>)gkMq6Ma#l-Fijvy7E5$E9Q3f%o^S#p1!3}!-HORa zIYs|1%>OGrj+hk>ay@FFUA!k?booh-qtG;R*a^N3LRDX|u`~&FKL*@3U zo%6izfxqQjVS@51ez}#6d@`xj8c#Y!3iQfuKgwCpkY5QK|C#fgVwYT5nt2|pFHpp% ziJ~sMx+Rh&_HQ-8WPEC-eEO%1b50dClbc+72(As}3&3MIVerg*(u>kQ4z7ip?XSYE zD*MQwRqax|u?tG!R!H`oOr9CLs4*%hHD+jr9pI1^a|)bN1y9oP8$~Bo!Se~^?7@eE zQ=AZj6eao9rUW;fW*RafhXcZW7!9kD`gu;!Rm&8XEQFEWaW`{cQPLysn9Jes<(eQc z=;7AKPWj+!Wtvc9l*$RSTAKq^bf73v$+3%3FK9+Z3l{Z%rx`a}+|ZnWNUoVTYy?q_!OPrZ|sj7C7T1tWg$f z*mRlT<(V&b%YCh2H*GqaMzTU$v=@~9Rp|d)yZ$ta|2k=O?9-u7Tc2lJA(sFFy>1fA z?HLmJ<}e#datzj%3hA`*@St5%%O=MRcB_|DtB&RI-+1Meuqt2Hd@xXy+}f- zt*iBkTw=AGJ_2eo9;Moq`uG9)r?8{eqwO^7a$fBA7l?!G{uFSB>f4I{zi+E1{51O7 z=-Dx#xQ0-`4PW=geAY0^U6hRH7_@#hz4>wMXXJ#0!c}o>GFhY+z^N;`xWNhU)U=goh6&oJ#>$-Ce=$w-s0mZSF@&vY|yb4xf1#`HQ} z0Xlgb-dx@OUzL&nE5Sj7D|QLDp(0Sx;3Eye zZXVYn8uK(}I)<)$LL4j&(G~*tc3w*gx)U#>@tU*x*eX-=M9yeOEX?chk`N>TVVe2H!RcwTYF zDC`YRUcg@4wf}|INkczmXKT-V|IJzVrWoxcutI3ADid>ux+v@evHMhP8cT5B0Ol4O&9MN+uci1?!X;E9t?&^oEMzc z5Q3xzNNmPTuOsf85|4<08)#fdZ;cNnqfIj}dp4$@vhM0$RmG7?&aC~x8RVO&etH6I zmmg&-u`TXN={J0355P;}5Tu-0>iW=q{s!8E;W)tGR~flF>cN>`@a2pHEaYeXGU13{ zOe!=Jj4{RNu%-;`<@x{NG)Eo(b%{;W0ON`qzH?s1ODXM>=fnle!Uo^B6eV{>+JiQXEweertR-Vb{8n1&*cTA-#!-iLWka~EGU5@1;i2n|IY}NlQ=uW^(O2tV6!W}TylFw zABt14EVQhBt#N6og3Rm-%w4h#i_gUB#af_Jz&HESN=E!gt$z%mJBha8xJEZ&G6I8yLl7+nyiOWqtIX>ZjK_k)=b}##Pc7MP|CA#vE_&aeXY{X9{`ZvNX!^=0W^g?L@PKAH=dM?6d=xPf9&kcJ0(NAZW7pO5D@EIw(JR4*pB>xvz#+A%iRJXhK}uP%QNm9u2bt`sO6to=uq@U+P_X! zZY?28T%d}&Iq>fV&S zp96i@-IEfQPNet``lO$(TX4}?YuJ}Gr2#S^oQo8P7mZ~d7B%O4s(GvzxvQW>IeBEl zy1H9W_OESq(LERW&qi;J%-pyCF?w4Xt<#-zb9W9&0S6yG(lWN(xyPdv?Y$c}nK9^-{jpM8ulnDP+#WMS97%U8+}k}79_2a|#Lh^&g7$zR z!31hY>0-w!p~0UiE$H5;BuU{Ea~0dzvWr>t^ORN!H?t$IFWrHaec{kDkwgpgj*V?N^7&1D7Us3?V@FnHuH*f6C#!f#h;ye!7M~C7q6Hz0 z4TNs$p^K``3iA@Ak*+*!Tmhao7SKbp)+jZ|y>nXrmt{`;4cht-_NiYizh3_8`T6?S zax14;aPQ#(-9%n|>=_`*eCW$knT3v4?d){Zz&WDM?&}RB$ z9RF*Z9*UJCR4P~1>zFWCJZ!c78~=`oVXM^rI1zP!(tIR}XEtQOw_5Qb26yC&vta;K z9<^hpR+-y+m;$Sj%?n0o&8O%QBh;y~R-&;n-{Sc0t*iepqWJUA_(a&%VVyN_EM_bp_GlNSeh( z`pd48AbPD;E!nIbB;or*l*dw!$3JeC}#%4z*NK_r@EBS?m1GU-S>*D>I5kKTv%esELww8NO+T z`GMKS;fT{|#e8L)^Lv%bCq{=$%7WOuNa$q{AUWlOpdH2! zci3q2?6~JPN|x76{x-i8ro+0F>kTxdUpWuS1|boM0f7L;4NNgu;XX= z*7Q{%NdtTUxWW4SP3-*L)X0}DwI)8v(*ruq6S0Oq@A*5B4jUbP3fdxzX%H1iM-(me zv2$XfEhpdh4o9(j-_-|DTg#xsG#eU8$%DA zy3S}Dzw()bY?;#Gc)BF@md!o>><5s0_Bk8hc7Hylp2Btr+}eUp1%*PwR$RJJ8U22q z@^y+wV?bW3SZ?wam^%io+OIq57~7ng>lmH^@5^e*wzSl=OiPIdni!`-FJOL_m01dH zRl&gm<;E0S299Lq zVk_-J#8J{fDjB+Na)OyTJ4D)2{sPixuSswEvbXsY)PceZeypA*)rL!qV1{~e2k{}THbQ-tgD14E-?+UNh&~}kZ!DELj}I9y zv?=h1x(g+lRF|Zuxf7__cPZ{b+1v^o3Jm)jgZWQ@L`Ea_>^m6t-L7qj?>OR<;**>= z83k7rCSUb$2k}o<jPA z_Nw>l#&_LniMU*dx&wRB`5_LJ+Ih@dtI@H0`nSnKd&P2M)9*gigdr8S1`Dmk zq-P*UD9@b*Lv17Fxq{o7_NfWCj@26F7J*in-3d>cUh~q3qL4n(UBqv(%nV1N`QlGr zCR6XORZr`Q`6e1v-}sY|kcok%`wKRN?FW8cUz%&~ zbaktZ@l`{$>g2D8qk6#9`!0D$3P25x>H0IUVb#g%>4eTznMQc5&eyuW0+MGL!D%G9 z3~e!r-*T^rqL^iDaOI(`%{JYIj-fjYhe%@{Ey2JH$fM_}djr}KQOaidKRH-8tQBlJ zJ<6ZN-_s&7VzOU!rl>@`d{)Bfy5ku*#A>k;Q32yo6DSaI?ZkN|(bFxZbHekojW1fs zf5lBXTPJKAHH)5SjQB8q_!sIUeR)1nW?qODYYfwOQT;X#ZdL=zxYz<>AxX~Q^I)$* z$DaMnO3Kx^4p26}|@avAZ?LCAbZb^bE-Rw`7WpRn#U~ z2~WUE8sT(s*!_7J0pXUOhYW7b2^#6Q3sVxX_E@M@{Xti5C5C1~B8T{riIbGl8(Tas zdmQd~`kS-o*>sqg4!)2Q)p00OI0ScEpx%(~+*WOkscr01z8=;^C}N>oX%3y_K+^3~ z>dP--?eP^BK59VQZ4Y^>Go8(*`rxkpjKDh2qqd6dyQBMXPk@QZ+D5`)WjG^X%*7Qr z>n=YySu`E>_V8y_Z-<7jjk26ucE|1~GdpeaX$kGSi3UXERo3;*GFu{5p`&d!GXOhyI()iMkk0gE#Hh8>9oUN7_Roc_PNshFV5zlPk`f@ zC! zUy*Dy5fgrKqb>DSfuf2NysMAGzo;T;lU-tgL>uz~)JrHMs*;PagK7^`rL_$ekfVn4 z`rIvkh77E>D3KbyE%LtxzdrTbg`L)%=MHZ=w#A7}1gxDW4QE(K6+0gfDc9c#RLcuy z-}6JT|9E-M+HVgdtD!pEnF;`wlohKapDteky3*LqZpgoRQAg`7KQ`=RG_>%b$}VRW z6ptw;1x3Nt0(_vRec=<`@{`h1oSIV0-;~CG?$QXmS7>ioSGUsSdvCsFlABwNrgH=b z(xCg<&A<;|POZx=Cv|?dq8rinyeS5W_RTHpdjozlLF z$ehr+9X(BmYD>`+?B;DayixZpzx9k@D9J3vzpV*kQ_!*U%t^a+w3_{wEBJ>G@4L7| zhkrFjY^k>+RO@TDS)~x*4^7SfXB4#|v2S1*~Z>TNPHC~AH$?QJ>Hnoqs zO4FMpu&7>iP-q};xZSRU?v3}Rbc7&o*elQ73Nx{3tKENHO!_wM_Eq2V(Pivmq`C@` z>fk}RIohS%f$!}~F<>z9i$7zgQ+FSkOoCMo6{OrA&~5&mwxCUq-UD6FJk}w>+)!4`6 zs=&>%;z6(3wk&LsF=K0gxf`>U-WpqQIxL>D?t7G6c0_}Ba%;8MCU2ruDoisiNp&)V za1%g`jD@>;8L5M0qE_qi2FHeNCPm*%2|+T+l^NYeRLRGE%-H1t(0vRr(Y(h-K!ZrhGTm65Aac6;Ho^ zjA-f5@;c$NB5_p)-{B%LX4NItOzicR4tl=GDr+OL5OYNEDtp2qqCE#W4-2M$c+nyK zrlj#F+4;{p*M;>S6wmXgi(9)~Z%xxLe>u@_K5$v!B339ktmz(@e@gW=z1b#k@MU3v zUq_Q=r0~Wm_o&CWCr~f3GVh9}{AE1jBr)8){OlUZHJ$Uv*lQuXhC3R(qmpXuRH@}o zYIT~_0RG2(GN~*bov-nXudf-0TV3c>dHq*!*^q#@mvCehZcJm(<>kx7?bSVd2lV!9 z6-3CD=E_@G$p!_HUtHdmElTo~>6hcL|KIe>sjM&BhGQ^|2z1*c6wSTB;3*`%#WOUa zV+)#o3b+PH;`20t<;Lj1!6%T8NYtqIBYh8QYysoTW%dUPVvOR?j-T!?lQFF?X)j7! zHN$eT!w>bR8_sV@wucq%qA=|`%8M87T3q~{KTB;6pz3EAKtMoXng0-&X5$j~{@sz4 z;HF!qaw3ms_a8xwc}2V0%g1^XK;Jk*Zz(|5*TkBU+w5c;K+-?Lo^8*%4nn`&7{LsF}9@6Le7A*QH*>N2 zAGdXeayI&ky0(s`C_RFht@%UT1{j+eEKV!cbK6y^XDYmA-#t1;>iL@|;m?lt@8#8Z z&tG)Es#k#1y&9z(O5gLu1^#B&YPF)7S`ScZ=&j-+mMH!*D!iAn zBTCa*g)}==9E~Mqm4KXf)`?X=fUlZZWBKoOkIEcouG~^&y3oD;XFjzJzxbrIK2xk+ z>s&V|{r$83QTVkzg$Ki);2=fk=?^tu>S%CnVDE6s#AvYtn^Y-N8LcqI!7g9o3-S?d z8$s)h=W>lPBPZ5Q)yV}FKA^w9o63IQ5tUDVr($inrOF?Dtzc$IrrV~W%tVMoa2{4>cqKisQzUoOGxg+a595=Go zXw((e%_`c%5^C@@J&i@8wy5|4LH~!C3r@rg)Q!@;GUWtrp#wDypLizL40_oX4?>TW z1(gZ_+`Jo+%Tu9hyLT3x+wswybcN3hQ**j%GOuOuN4JA4$7q^zep3Un!T9p=!$Ecz z><6yaUF}L8P0<&Ejsn@$hb=o>ZwI$U5V>V?-WO!ehvOSvuU%W4J)X-X@n_^-cl+zveYE^4zx_bg%Xg1A-}TyT>Vb}S`q%yV z16YT!kIlMzrSV0FedVfak;VZ(`L?^w3O42S6w|IZ4z5wT^Lar5`5>b7ddl#-`v@i) zuV-Da4^thzu11xG6Y%?1t}vpK*>wNa9ZWGoJsOQS)AGOO-|6kipDb!U zF`R72hvgag6Ixnn(}hq|z8Ct+L(t0PjZG;AL8V!lEyvfaO0`kWe|7&Py`tfS_3%TZ z;D^(zZ{gjbeH!m0N|7sTvj&R`I?9Eu;t9+s9yeSMC2v384_}snEDv2VpQ)Ntq2X|Q z;6$QIm?Na^H?NT0Gjb!v7siS)^3TJwtP>F+v2 z<~@j*=;@q-`)Q0heX~IO8;&;;TVE$26dUq@sUb<3m5FgDQItqx+)DG@nKqg+y>|43 zstfRGdtbKDmZpSK6P8VVH@F5V^{q-hQ#=2^X0`sAz5hIy!-s#FjJtL{zWhb!3+LMw zkwGMLYRpbu0x7QRkZ#>wltakJ17Kh|qF9c6fYEE!oQi{zwk^KH5vQUg1A*#&<$F6H zn78kId}CArOL>kUXKFU6rW#?*9r@RieIMp%UhH!4(8#JY`+_n@C|DzU%nB81E;kmN zV>XKt>^DMxhGk?f-2=G?f%}pBvmw-LoE9UO0plWwS!tSqvE0z}%+^4U{{0euiY!Hk zDzcm~dkKUykwU9(eRlo=-aa^b+P639(ddbZ1L&JBTVVcv5B4T>ZrXe{00tkeoAdho zZ!z-4fOflbYi|xB!?1uv?^+r6L5~q*@E>NXf!kqqluNTv>nz?a5T(tIF{HX`-8&7OIZJo8*#?>=LcVI~6r>z7fXHSK zrtv%~A${co=!{F|F41>l=h4xPO83rmKJI(R?eczcOG**=IN%)S(FF6t1a(U5DHYgD zkZVU(@X|fzb!#zi*fzKntno7`@UzT&dz28-m1UGuvG4SoH$;$6{2O<5T*&kgvgP)s zGSFb=*?^9kLAZtI0^zo*vE`lN4C*T$@HT^QM`6s&$?=OWrQ+7ODK_02MIu zyey}3okVcIK$V`p-#*m6v%kwQJ1jXsv2Sshr}h>%E1Tg#6do@}HyAWK;oS-r-&}QR zNvTj#=+7>j#q05hxuskBcK;*J`CI1P)ig+rfSLE7OnhBqd2}}?KKaJ|>oBpRy8J=f z`IOq++kld4<@+Q>w+U_? zPS>Ao$e-=9%k*>zn2k%#rGd>cT|>7Xo(lS#&*lGe2Za~@ zC0%}k1zfuBrAWBKx$YFJ5L1vJn3Hk{q+WVXZN?dulW7CwCO8ZJN44xLY}XTA9^6<3 znTDE86(RZf%j{iVsrR|VXex1o`9~Yav&orsL-@^m+g%yGb$Ud-Xke}|!G2|vsqyEt z*pWf8QN!*2?TEi7i1-z%{VEu#{1h=^G#;C7pZehR^0nIW)GOH$1$;Y2j-8!M7>^se zn?$+B5#36*K3r@bUuwE5Zk5*y1I7-8p=Uw|l?k!rz<3T{F{Dl8;=8C>xx4im+`>p$ zU48U?Yi2QE0$;5PO0U@bb}Ln7tylFqMb%>&Ua-8c*Qy}>>WtEn4y&A_>qQ#? z(4O;c0uN?1;3pl5Ol~kudr!DNbAIN^$E&3JC?ABHSQ+P~MziZw#WJ*yZ8agBVmPEi zWNeZ4f=m>5IPt)qc}?T>nl|O>Ef!SehMU3(H=3#3I&Y$!fwwCE7_o7O0;)Lzg=O7z zsrLQ8F4bhJu!4Hx=W6@y+7L!4L^CR?MF9D>u57~Gk;>y8Z`&a=!0cxK61k1- zy6U$}rAJUt6>+Hw<#e{eY%-?(16U~noTfxk9Ukf~(lw)zV=g6UKEcK!$e?IS=6~eN zbNq${Og1`)xgQj{^(!AJY?c;%!S)tQ86vG zaKOaiBx8CDgdJe9v2iyC{Uu+VdsV%D_5{q~ zDain_m6l>;>hUWI=Z@Meq7hRRt%cXS1ET+>TG|}^SxNr=Uu5c)0-w~oF9C$dKouF( zA#WzpiLXcjA061U(OhY()(FM=h>RsH>W3W03xz!O^i^sZaRF+!EtsYwLp2PmKz>I~ShxRG zOr)-`#}7+AFdhCg*S4?9O8;~E*W@B@%Cv@;#jPeZHzZ9?4e0q%WIMZNI747JL)>lsq z>g&+|@-_%+&4x`KA;{pN#ZL~|-P|n?I$vyjNlUTsq*qc{`ugUg{DBk$nZ<>FrQT?M zvS>0BoL&I|QD+;>RQx4T41=>#V493k5U&nOs5mx!Ja=>Jnmng^YYbftMx9Z*klOv+ z?kRdGu#|N+b=mSRyVb6sM7qGwG>=xqFa<1KcC!+ne|6Ok*az(jm8B1ycR3qptOxRo zkso-Sv7iiHT)}g`Sa%nNr@oezt^nzlQ^Jf4H5?q2akd}{9E!60GMT#a-kaHkPCZ|_ zq4E+e&_VPa+46P^%t)BY78NfZ-F1FhxPIbB*!oX~R-+1|TgksgZ)H3`RlN?GD{n}m z+H7=EOx2fLGgn94Ky+Xm2_9X;YTee*d@372R`*zwN=;gCaAhtgmg$8@p$cW7J?`k% z`U_@P&%S$l8K0I@yJO|=yMh|jX*MT7X{xJ(qb`pz`hX*ntCkf*tlN87qGk)=U|aPs zYOiu`%9W8MBmPS4lRqoxj;D^xU6uPy?yA#s1+ObAMO(fyc0l?KlRJ2HxEy=Go5vyF z$6d-bT~6WN*x|GJQTdW9{>&I8kqzQQ-`TLMK2P4>^SybzKNG%rem#V*AjrTe zcstIo7hY&fJ{38p+@xY)+_!pjCF`>@TZT{N`DNQsk5z~6p8gBm{Nqt8fAWch67;AK zXdfKgZ~5JZ4K}m*jjOb-bbpmw1^9sVuhO~{B{Lp=znKSg9v?Mm-@uaI92rt?Bo<~` zFETkwQ5qKiqeq_gwsiTAAX(HZ0%%dDFPzBUpmOtruCe=uUm;Wl^@#3P052j2w%K%U zB2I&Xs6m=j%K*kc)39=4PY` zGvkEK#YFZ1U4gq7#JVxk)|%Y$m^AVGE3hB%OACCnD6)p}FsD3DOw@kOSo%;h!OD4{ zaFu;6JInZBncSz#HDw)irkB&tKG$N)vyc~}TZe(Nmmx1$rP{1XRc6(A9m*_XT5fW2 z(1?q2K8+vCWgXd`96&FMhU&WmMIUg)5B3;{SKM^gihgZ%%>zB=j%@wKvipuo-4*V7 z0DEZ1heolEbp!lG0@dtLSda(WJg_0(mS+YettU<~%UFXaW)xO0yZ3EpR`=}gJ-TCH z-@u+7kUejkBhZ}Iw|5GRdEG@L%Jpx+kM&oZe6FBgvCkD3l^b>|Q~Uu#6lOr1f(I*0 z4s4WEHfj`sjg)D7x;85BFMGUPQF^-D+|UpP&~5PQJY|J=nb9Z8RLEHtIHa6qClqyVf@JUM=<>Wk4j>BdTsiw_3B6iq6bbRGIdA^iC2-CG{6KfUvR|MQcj;$3Rp{I?y0 zizyqt1+j$IBdc!jE!Vj)UmgZfCN|hNk2K<%l10$5yN&Jp4rav#H2e-VmWQTh_93R- zD@w&F{>&?8k+eiD&;mAHbo(r!y(^?{M@=cjnEE!{&B<3tpZG&5{xYphJiU?MW-R(c zQrq2$AWkbS1TsENoLCUcNyZP`*FgIHtpNymy{G^DnX>;K_g;N?33Wm6f}sTo-=X0e z-LAo(7Z+g~jzx{kqhKsgkH*iXR#6M7E$^g&(Gj}4yiaHB^iZ=472nym|9*3hjxWJs z*u8Tw2~|ZO?A_UBH<{P07j2n4*XT=M{bg-1JHZBIh#djJ!yQ$4C z1e{~~kJj(_>Y(SJ<{M=N-s4+FG3p{bVYF`SBGWeK;B0BbqJ4p{P+ZrGDd{LjBR+=U zi2WmPErD1xWt`nwNPaI38hW&Geap)}XgCxiYQ4W6v^3fC_zTS4rY-|^8z~Pq8_eYf zU;?83rc?i@$aLoNfpa-0ZDUqu294l|DTQha~*-_9+39voCUbX z8!t}PDFjecJe3XM3AE6}y$}hZAvCH*Wyw8d#NmY<7TtQ^1k(&uj~;Taq=w8>F%+kdj<2_48te}5`&=cnOT+kFQcnF$C3*zH0OdMc}9 z+81snoMmSi9Nk%!1JO98PJ={|>5J*^PzPn$0 z_~}RGDpqCb5+|wLa7Shs*^iVK!N)X~u}W}%F3Nvz=eWY^l*2|>KB zTGhoQ12`$KhFgjD1EKs51~4W_E%W(p-Fjrtp5M}->kJ{%t=4MZ0I~~?CAgdJyRNP+ zt#{*Adz2+-?rtMio*@-j@)_D6`O$(+vL>73>uiqv_h#CDmb*!}6yw{*$f zZFTr>wpoHBis;bqUDr~*U0?OLC8Jye9;HE5A z?t)XEu?-pvwu)jrLpKUk^G4nqQ3si$(7N)nO>m-1fkVvRSoP7A#L56GaqEpcAOx_S zrU?>Bz(`ApdqX=0+_-W7Y|P7z6L;7l5lE+QLTeW@gT!)bEXIlZN3siCt&d5pkn;D^ zii@In@MS*g_mzS;21u$Zh*z15Te6}PtIATN48Cx5z92_t^X$1CO39LYP>0{vswm%+ zgt2#C&MUZX2HeOj0k|b{Fyw9c~x2*z%aNu{`Q}z-*4X zAcJL#dc*L~Q$~c_^D0>6JF*v_j$4j!9%7ItfsuAtOk1)MD3WQIveM*EAXvo<^~5tY zNd9KksS%TCDA5QrNS==gkV}&Gv6N6_{^dS=asqhHf}$VKtS*5@H|c~nRw<>JRVrJJ zVLw`CrY{{IUoK&oKWKj=G7r!xXie}-g6++Nbl&p%4vSXiCmFSN;7I#0QTm`EwjWL| z-MGK9zBdTH7u1-sRx7lzvTjCo)D5HeOMkQIMwdBH&bj?p!nx!vQkPls6u>kZN@A*T z>ybg&4;}X2B7A4dG-vMJgcrwNE3eW>TGsItFkf?%{!eAv@x2SnVXoZIafDc<9mZN5EXof)?Ua7bDa!9;Hj+bTf1I(d!~v6*j7)Tq1n~c^ zmw(G3pSXMP&ZOHL#NM;28!9fg;Ac^xEk-0^>FbdTT^!1A?|JRHp1j&BWyqY@W@Evy zZR=~nMk;2T_pn`6Th9AqJmf9AW+bbcn6Cd^94e5FrVSVTD!+fgvEL8A%I)PN+nv9#8A)&4a-m&eD^$)^j zp+y3Zolh0nOk!A)Nry=lKT9psXeIuWr6CKy5aj7LUD=L1e^nCNue)pO6|VGAY%NwNPJ0$Y0h z$`$RjrE=-G(Tk^fVvR35GOg52qZ2Cenr2-FjgXVhJ0P;bWIIE51P=o+iEXilTVPd{ z;Y+^rYp8~*oy#D+FonB&>x@|GayJi0K&mKypOD);m$^-<(JtD@8K$$zqTT&D z8eyI(m0%|ZGl{9#iRp_W*M0Qr5)hDfhnXz~{jM=wtdo{%eM zBtdCL%IgHw`|A)kBe1jua-Oo42WmJ9nSS;3B)lQSvtpfs4q!n3`mJ5*D+^{wfcUFXluj)wl~urD(hnM}{7_V+o-2~Bd+V=FyzLP(lrFo2sXr5Q_Axbj=DrvKGo{FyL;rVnP+ zaXOb=V;MS8#nxs{ybBePhe&$g&gnOP=I&9>exIcEuf*>D6T&GROlOY`4r3P>kqi7rab z22)>@8mcQcD~Ll&X_D4gA`rFAH4VH>cX)7ve%QT|?+z~@`*EW4qj$v- zm*HA-V2t9aQ&omKi&jAQ!P`M|Nj%OhyJEu8a-yD=$|>f&BP~#+x|OrIjzOqhsTl(yVEe)Mbt(2Xy3-5shwm&QYispnr zFHB9;ELDc*u*pMBlOyiv;ZlH_X+z?{jy&1;!#Ph+iM3V{c+x(&)Oq1M7t8BR-_^cW zE*$b8Y{BVS{I?wGZdRg5!y&5J3pv}~0tg~HrAlFAiF}9VCfY)8nxA0F>FZMWJ>Jx~ z0}r1dy)8DT%tayh-TDzOmU&7(RXiuX71;zmf3)Lm%^g8J!>oDYReK`8XyI$q$fj*v z19;VxH7o?$q7#|1i<$jChSq#kD%pN4i=T0S?rJ5LV?}1z2+C|-RJJpu95>9u zSvpH#_M=p#FzxgU16-iPD4#Xl4025(_@Svyf%PdkCn9^n9*g&@Y^jVdZ{boC;;L@< zOL~t3c7e_bZjKFYd@ssdL|))kkM2)54Wdf}eEL zheeH$gvQ=9veXqflP=#gMiMNF1dXlB^fbm#9_U;VWK7k<3ExXoQxOK~w|whPX_

?Oa0-C}iw}mX0k3lKxhqtg;m9*xcj?f8XDRz#IliQi=pyf^Uyu zdC98+Z#w_s0wW9t`cJZEUJsKt1psHgK^GThDff>cpfvzi5jXxrG&A`ARC5W(AfOYO zc(-IMgK9iDm#gUZ;m3*oWY6?_Ez~)H>ocPyo%8%O2E-QRqcj@~z!jUjB-Gr(994OX z!!%~3!-1o2ltCN-)~NcsEGr=*=Q;E_JF{pdoV2=>>IXe3aE#!lo>+79sTuE&R#6(DzT8EJ1xXPX zeYh+M=@-0jut?B0hY?oU`{_-S4I}r@imy05`(D=KXN}SKH$%uDra3Eq*`aB=S-xx} z1Q$(9s#*B;8T@sNRHb_mjPVB?1T~V#^4`ZNWA|kj$A8>1(6&rZ4m{PlXe~$`2D!dW zQg$(B9Lp66EW$?`FJHAx3j;J8Qx)oM)#ns6mtgX(@j_?F@A(1862KI3Bc&dY zK8-O&rZN4IF7>Bn{uPmvpWn64WuOmy!*Jx4bjV&EbLlkWA_R#VW?n8WwsZdi0YbY9 zBK>p0jHkKPqpo;{1@H+?Ff=ie8EV|>kL2M8q3eR@THvy@eRJDK_?a)f+u_}bWe7$H zAzqKb*?v!hfgK$^&4{0L5ZZu!hNDJ;U@14#^J{|@Sx=uC-!Y<*wZF&xxDNoH{Iuf@ zouFghcPGK`y%YSs+2Bh^y@M8X%=P`9)-jSwHVH#yLzRWLY$GXVv~qzvBpvqT!EdOl zD7Lpf4?yD)a%B`L2oiKBXiga!^(T1w z@02>8x!O0VZoYZPo8t4;ufl+K_3D9ztZ@djQeJZTJyVXptm#(BWrZSDx@4thNfSdXcA*cdH>^uGBN*m7&fVm_rV&DjJd|~ z$6S*PJMYC|bPbJjih)Jqc9?{tD!99yZmVqvXe^=v1|xE%Sc0@f4obr6h6N*JtA<~@)I;k|>uJPu;#9LPaO_@|8_;@gSoMV}29p6o0$qf~RXSil@n8fj?d_<-!tAEG#3lE)&Gr&{ z-~K5V)^P2VU+Oo-O^U(p`FcoaDaTsPALiabs7<5G79=&5f2>x-JVb1Il>-ah53W}&u1B?pHQ8Y^EZzYV*N8qd< zwqNS$eZb&a8Cz2yc-XLIdae%jW5qgl>2O9#Gn+1Vq`L<&&oZHTUSogrD0Bx9IQ|KD+Pc5f5 zlZivPCbufF3itJ$A0B+;XAeZ@;IA5VCqP#GILiI;rTY`9w+%L;(G34D7BJTLCZ)}S z{37Sgkg-3;W?24uK9s@lj)NgZQb2!1@jGZ&OODh_HVKXkMVCrAJ#!^JDklz)J`LD6 z7gbniTHSA9GcH!#8zBR2xH5X40)U@*%=jgFDgC{t%d2vR3Y!l?5j2syK4FF^nmP+|K zr;7c0;vvU)c=x&;)=~#q-=P}m{cL-gQ)q>OT;GZhQzAV(Iq8NSz^Lt)Embq)FR5B7 zW@}=`9#XewQuXtsy>is3B5twN$ftE&K15&OA72CYM9?#5z99pvwzx<9D4Q8SSs^+L z;J-BF-3oP!e%Zbkb>8*;V0eCRH^4q*+h(Zm-mjZlgH%jDTV~=`Ap;|wSpM66(h5S; zC~97r0~Z_0Xrl#liJ9?&W*VnpXml-CcRuDNA23vgB@_t(`P=Vx&r0XZod%;YdJ-x} z7{(D`5FDZP;UAYt?yhl;Dhee;E~Q5FErr_(@b@soU9AaAfR`^Hf@G8MHawS8uu` z+%##shVPoku0*F5YD=1zB~&@-2W%n~r~Em)8N^2)$vm<|5E#(4o$@ z@s(=2Q3-mOUL?7yx#h>?p1k__WD}EF@`MZx4ztZrW@NNy{5sJeyjAmQ=Y9*Vsz3 z?=KX$2ilw}7!hLYVExcW=CphG&AgihYnNVD>P>T=wp_|=*S)3Wv8fwCMz_vAmrJ1| zO|VvD+0lUM6_W+Z!}Mai;E&lwRmOWhhPcWL3zk;gs>XhqNP$mk_sZT;$5~b_EzV`j z-XvuLe;@8%1{)=>PSBZD)iD#iWPlSb4WxSn9%wb!`t!5BgHc87DC+m6qxA|lH z?%03@IrbMA%7F-@^sXW6r%pPfhgg-e3ut~5f*by|fb*xY*7qFlI!CAYJIk&VEUnDZ z#Em@u0$H!=g{v%FWOcTnDppm|qAtTCp|jWqe{z5oqjzF)dhiS6u1O#e+-y5B9+RY!G9yZql8NE(i{m%rv+AdfOtGpzYWOee_-%o6UE-bu00^)_ueTCzKHf#Atb;eh4mCOX?JfcUjKfD_v8$0y6JOh}M_Cu?AcD3Qb|EzzWio4vV3-a;zK!@( z7F^{Xi18*@+DPTxqsK+j(}Vb8*GAJ2Pli(`7h}?@oo;wUH{+R0lFQuoUnI$*EyR9y zxTwimYo%I?uj+g{^caxUDzU&nvC;eel$zeiOP`Y4Z*)7gR0MpM4m$q0t4$kYX!#B>)7 zFi<85PIZ>)Oi!NZGQ3ZosSHs@Nu20;$nyv1n_oV?i76~H871YF4d zmdGtDZ{v%r1cAi-{|4!QVZor^AC~gdF#wb$8cElU;C>HxLo$<=V$gF-XBU#ee%xu! z1`;_hYIQ9@CIiM|1Dr&|sk6Y*;?V7<#x}mT*CIo*=PA<%!~Bj$M~6X`H*E%4^ZF}v z{6`D9Lwj-C=!+gt#Q6Uw9WbHTyk!1RI5p5GnDc0cKbjiTv0gTB=(>yXkS`|!XDjP2 z*P&`lt3-BlSL!eNVqRtYj(w_(@XxBuWtN6j;##j-G7Pr_D@PT$)_7VJg=KP2wT)ex z!@(@I8Ubb6!Ee$+_>~{Q)GiE%kV4XS-8}XPSLAazFT@k0ngQRG9t_gQ1%UA~h1ya* zbVi<13}`m~F=`Inv{J^`>U|&d*qZL24RL*+RBXqdGjZcATUKNtXeTG1CV|0dqcjQGPRDt;VlUrastS8QV4RvB_!C z0yQG8OhSGq2;Ogh{>p(AvfwZ_x<+r#K{T?=C#`;%dYKSBvf$)J91PTrUa|^AyW4=Q z;Q8<#{wb~ffe+l^xa- z<<)vF4Ht}kgVl!4*nkcT*ga}n^D@@)-MbRvT`i;Qn`Z`E9oB2KRT_O*!)o~6Aiv7g<^W)$D01YKhiHl#{ylxANk!zG zqh|$Z9{NcYM1T5TdPyXiI*EVKr4Itk4KJ=wHyze0jxJ_yXm%n@UE-;Qw}%*bpm1M! zSG$+(&yGCg1$%w(YGyha)>HhvzCU3k;=#xPU5kR$$D@!b(&$(~C+<4e&?A7rhnU?mKkeGt(++}#Tqkbrp1U{P{1jtoK`DKGfhiM%#D-`5zrcEG)tti za>vZd%q@r9QlQc#M;1*{ae)*AMFb656v6lI_q@;XKF4#s`d@$E;eB7<<#V3rg)LQ8 zgvu~dV)hQf?PzmuOGL}R9>?ad1X+K&RKA&fPSbMjHxe3-b2v6pD<^>(y6cJ!@n|8> zwHjc=c*oI2swSYB@q4B`t{;!UNbdJ!|B6@PE6Xp)TRqayDC(@09Ajtz4~J7cSQZsT zS}k;ZwD?3NB@4CI-?k#EhnMF*HTCNieuVeXI?-n~f8gZK54Ckf3x_`_b+Ov44eyJ6 zJb;(=3^#DiD0J0C{#~lTpxZgJXAa(^oC#@E6g|wNk*XJ5udUVoyp*#gn<@V-$1swY zx?6MA=iurcEsYrk88z#T&!TcUhe_5YowD)9`*8AXIDG$f%ZCZpgMvd~Pf((+N(1Id z=d@RX@(-gGRgy>ezCo}2pVdomMm}Lc9X!&{#`L!E{XMMmOC3w?TaxPUNo>~q51`kX zc*Ufe`&g9Z(iiTo?8-pWIujCRXx6I54&R5@F-Ltu9<#P)d%L!8<^1Mn4LPPiN1pT> zC*02y4`7g-(|#pY982}cuJN*ZDa{DtS6$Ya%&|gV{v*v1eK{&o+WeCt_|Z)D7r2#;(qAMm zVPbz~FQ>#a$|EUS%HL>Couwvaq+}`}*zol2Wkzh?ZHDFmH;^QW|4y@oo4E87ZK~DG zH?gk3080p^P(OQYU*v27W?5j|fQ|qX2f{jA4(pyp1@%M>ETL%jN`Y_<6I*lHlmU)P z|FOs!?)P7Ck11-*Y}7nTPRYV_H^DV!U2ZA+lhE#Jj-ST5%X+NSrOjf(QS;MGc&L80 zm5I?gQr1zI02}Mf_PLayz#XdGredR-DbJC+wqDlo>rc~vG%JG!k7CiL!TUTs1L8)? z3Y|^Q`f!CV)v&CoMSCdsgTT(I9P%OG%awbz=Aa3Zn|D&QswtF|ficXaJkB(CB_(wA z_SDhXX0?*A)DsF(#2NTF1(nw@<{zHsLRZK^`8C*G>bV*-iYUFOcW~oHcg-~X5o@=*ttZUD};!C7e!=1|^K6z|)B`KZGF z7F9VO=FZ*ZWg1>9tX4Oub(qcTU5*OHUm;&-?4CdlC~)15YFOB$=Hv9FKQ9F@ExSO= zkzgujR8S_IsG1P*n>#)>DJPiuAEppJc$>n`_B*vLbaKQZNVvoOvmr4JR!d1hoZr+x?PoFSziCXh_NsBX zFIFN{38?b0D1ctwNycw>2=8RCycEtmH{QMm5@o#2vBy;@^@HLy-H+^|Y<$#VrWzIw zD+-G<4etm%njhOk&@DVV*zEu0nsTvXY<1_7e=Jd%d65x{Xi^onLTVMOnxz!0`;4ps z$XtUrF;pjL#yf$VFQ;~n)C+yDX-MeAX&ffG! ze&v2teHhJE!4yE)^^dE1)S~&oS>4ogw*iS))*}e#7B0v~;W5W`Fl}07beQ|$268}~ zDtVuEdbjQ>sLku%or_N6tCd#@lqasjLL(kCbhbq4wUAqt-Fyes^TO{iA=1WcNbU5a z?*`RMg2;2W(RmwGUhY?`Q_;*cUBcOZGy#93HU|$5YJZT#9;1fkDtC{h>0;#UD#_al zgYE1$MO>*{go7xLmJ~BAEyFl6Z=JwnGa-D>MN~9f-sFAsv)iUTh;+*nT&Rt&sG=ST z>#)F(DZM7?aLEeBWkJ)Ag^1E*FL%})QWNjRX{f4T=+zb4T&lv^NccUx8D0wB9Cv-2 zCGnLswUUAVwEKR`^QW5Xhjm2Y0~=?pymuDq@Db(i*utw443c}R#md|KqD4erre-c; zQbAl`nxCCm_VKTATb*wpE!yW5!fk*)UKKwV?jGJq9#=n&GA3b8OZ7FbIpK-HlpEwK zUld2_guSJo{7utvuRmq0Q}9!$Y0B&PC2GQi0N_W>+}l}LyYwp0Hm}MEb`{amQgJwu zR3|aRTsdZ=AS*0FZ?q*8AOVEojAzXgzDeZ5HTtfV<_oqhpNduhO9|8yj>lyZH=q+8 zAB4(f?ZiEQ|3P6j?b^RZ0_{HjA3jKHUa%r`$+$TMLLTCE>z6F;kgylDo;?X1bEk-z7u*b&oGJb?G{|)GRTjOzA z*PBsisPNS0F<+p#7Sp_5g%!_5qrTnjuNb^JIM~10NhQFC%e>%IpOJFj>rCPU?G4g~ zn)~pUOX|NlpFWFT?5~Ur5=nWJpdNE5x8|5$?3BzPK35Wa)W6Zjv41TleLV1q27Q8Q zgGZop#m+T-nz`DrIx_YowMrA8(~tKHKVn>}cUBJ?22TlYqs_i+Yu4-{e)ra--H*4< zmpWxjNH893tfp_l2EQY(we_+ArEq#0%-y#Xr^CcS-!~e8@i+<%mcsb?!+U&xfmZ!E zXpx@XcBMEAf9F)Chf0yUuJ$Cpy`zp4uI@T77y{&W z&~Orhb&&+LZv`%NQ|wRINEs4PmSu1bv32UaluKGBz$m|5Smxsp%1Zu270D8aM^mZm zicQDW;KaXz-j5afz%5xh6Z0SDRDTMX+SsSgTxp|o)uqSXpl)0x*MU)sq%ZQRc&_WU zc#6Orkvwmn%+HQdi+j<7oUoEA&>(QbX>|(@?ASY)#^aB9Olbq)bYfR~imM_r??;;C z6FPBLX6Qw*mTG`&D%Ox4l!0D*5Tj+Z(y6CWK_gGkW7Pk+mxe^C#4x6Qa8`z!6L8eD z&h?8lQMSwTJkE{>bi&6u5C+z#o~VeAN}SW|QGbz*8))&mvv{~BMFRjX)BX~-s`0-| zK5wo)uzE-5Om%6xfl~Oe@-5mcsF%vq#p3W0=wPXafG-?`bj8(R!E{<`q(ZbxSX>gh zASd~0vT1qxWf7pnoXg05f@#h7w8VV2B8c-jhf*(>+KOdBq@PW27Uq(?@(4)KJ^cu~+2>0GW4Up8Q=&C2U@mWvJMaM}=wC0vc66Ugr@}6wW&PoR=l(?^c zt9|Edj0Y*FKMEf}pc{9TLWdh|@yO7dz{brR$wG|43t~wFI1U3)h;kF>rkKU^I>x*x z=mT$L5%ELRQs7AKw+|uB8#Ijk!@KdHqbEPC?i}E3XA9YTd?nj^+)kj}kv%*?smMzH zxMPDy5@pUGyEjPytY!Mf{nY-0C$3SLvkwN1=|AEg=`=p3&kooopX>3Qt~`w6pX04j zZm#);M6HN6dK(!qZ_-CE)z>iS@G}L9e}gU%eD2sRJjmi#x*!QNxX+TgXlW&teUKKD zAH6O>NNJE3bqYgRXH%6f_UG~q-IZPrDH5z|Bo)~pb>E#h$X2G6;(x^6DGTlKeRp&~ z+as2ds$6dhT=c}y)WmPko5uQkk!VwnuY|iD)%~>U=EmAms86`l!$qFOeeWB72?{!X zkqgT(>UV)04S89HW;=J}GOh3k3x(CoRhF_zX z|14PbqW(5+7j%4**mx7()ga`7HsaeD;|$c0?)l&Y{2k2^!f$JRCFgi&Fn@5)b}zE@ z_cXh5ZLI9xj~JgZLA}`I1-oQFwI#3f0=17_#0YCIQAMd8kC_JJH=xQ!COhu+25Y;fCGY1muVVx@V>5sd882zXQ{)DD1i zhc`pkA$PXSptSY@;rk?>j@mko6_eY$~qNRp$?!U1D7g!lNuwfcBR z@fq-NXnyPq3^`djP->t4RghcI94GtyI(l3^*nXk3$3BW=*>7Kh;1Dy;}(2ld`ZM7;T5jB&dwq6~#r zuur6f=#&{h=S2Hdj{qM;1#keGw77g&b zLEq$uR>=Y;bSF+y5xOhnk=ldom*Qotn+P9p-P0=t-SuSQi$p^#H`|o;O~nlCPjc%I zaQ0>eWb(GP!w9&CHbp**^W&W7G2Af7rT>U4O!VE03ZNY}UvVbSQD#OsPWkwlw~7)P z{igC`_&}golULfUAJm<$&wUZtjRsma3MH8sbX8&nRtig#b|G{uX{rm}$p( zWLZxB3KTUVKkkyu?$k=lQODE0tomKm;xmkCZ~ILP6Gie*y8z#vIE!VUeR}s31nM61 zkX5419@gIMR)Bqpt<+b%3gBeO$zgM)&#<8eh?~qerfOEt@zyZ|N;>U10!ww4UN*Kp z+X{8BXL@3Y^{^44Q0__MzA<$PV5NLfMM~ZeFrM0``>c_HgFYbgst`Hj^;o>_5wrcx zbroLL*Xc&^ip*Jf{&GKb9(9-VOMduk&mt~V>t=S^%fx>|3gR;*=e%?g`s!qwt3Lnz z*@m2nDQ^SbJ@y~(8F=0XyW*M5>)$>K8E39XoX86reRVK915C6w8 zYC);0KNr-3b0)9?4XPw`l5QfJ3;&z=zm1gt53XxBEoFgld6#!nuWmh@$KMKR3m4#? zO?iANLy9j80!P4Vj(-ctg%ez<5>MPnZ#X~Q?Y=Bw0FYFiGTsI@ zy*LP;al}-Nl%1%B5+Za|Uu1$~E`;$-MK=VwV(BQDxZ>q4S*)L|-1MpJ zWBoH-z8~PsqnSMNEoRW_0NP*Lv-eB)qo?a_<@GX>2-$s351ILL!5F2eZ}BZnoG85} zlAIDQ_5EAcgF=I&iNoO|Wy}5%Hw*L?J%Rnp^7ZZKs{1|j!RqdS@!m>MqLJuNx^z+C z>uYv}j>D!ay^NT0>`uI|r_9x%8gMe~wzrcYDZC3a)f=FZI!laQadbLyw6wB?hd<#N zA!plhjx8Zl(Q0BUUb{XAFGp;Bomu|2f=uD4>pCXI9=+}bjYrWu<1FS8)9?#vyK zPV7HcRGGN4FcZt@euTV^p5p=rGNHKmvFUv2%})z^mjU;7~^g)h!p@799?zth_`HZ z!=G&2%|6ffK?TjY(b9*q!NY5Mo}Z}nBI&1j$34>$*LGdmiqJ3tt6=(rvp#shkSqgZ z)LXXN%mL-#`vsp9kd6b8x8`7?IGeMR4`E!5i^zLW_slE6xV|BxVcOy&mJ#H7spET~#5?!r^ByE&j8 zsBENav!^>7(OlmoSZ0iiNOXEXOY8CAp%$tJYi^M3-b7^h{X#uN=a+*EMkGh`e0Mi( zQGoQET~oNM{N1Li6U;-asVR=lAC%`Sv;$naHVf>lyIb@hFj!LMTs zG3TR>OqhJ^uqf7K0)N4U-?Yh9D|Yo?M2t0N@Sn6;-G|j%$1CPOHafBpByPyuj%3r=8t9A&BpRZxn*Gi?8v2yfNPR<@G!TgRQBb)x<}V4EWiJ+l;f~5;?Xe zY+#_8DHMDa)r;{j!M^s|(6}r$@<@-0Rz`fT+FROjxEvhYTyCFo4R}U_l=s?oR7jV$ zPMk|qBK#Q%K*1ZUT@b;1ZLXgPUxlcpwT!9O3tE;Vdo8vml>s@yI7p+md&K0#a*mDN z2JjzvuJnWiS8CfrF(N_E5QN4y$kUkb(oGegfvIv&EkOS?POolerN|HEwJlkV`J?Q> z&lN2l>y#g5tLHAM!qk)5GQEyBgLD+>6h?iUOzdOTU`M5 z`LxKR7&4aUMZS)y!L*?VMKAjGvpt9&3#nsbEo0o1m6B81G9#-Nb_ZY*@rhs6JT5!1 zf3T#x&a4?FMc*h#-Sgr!>U%5Yy_8Peu=>(d0s5Nv;WTE#^ry`s?nuwkY!5V=c(tXy zuOJH%&7xs(zmwyDzu}36RqBlE-zX2EC@lM_ne{c8BWjj|W5^5EVKAo5&BLzN5uYsN zJWDo$pn>c`{aC$!(YyK=7$1?0=Uo}ar3-ScG;f`170NNdiS#p$@cqp}C#BuZB0p=R zD|@GxPJLAKx#5=#jA#uXUOD-1}z0s7nE&zbs(3bH7})40km)EcN-8XfHAd$ z)V)x1^9ktkGl11HfC;u7IF^Wd+T0$@Ld-xfhnMWdbDVI_h(;@U zn>I#$yrG$Lfs<7&FZTfCy~>^BK~blxQr_{UF7df8?f>;R|0_uX=RC>l=rv z-A;0`cFBH+-D6vhy`9=CkN3nZ!XOP!HyncKvVptVTez_g+gKlQPa%h@EAsS$h>XS% zQ{Um~DJw!uzyE|PDn*8?ung{vJ&#V{_F-;ToGcr_2}H{C6WhUZGFdvS=+ORTsPV=n+O^4X?fy^PEeP$;qlX2h>v=Ng}3>_ z!MEZ}zl7ycL4`nE(J93NYXmK>*9|p@J&t|iCE7j{fN{9j(}Ya2ig7f3wmAjuv9s{5 zygZ?ly-1wHww1etgzy#|8`?91=*a_j*UBosoA9T8tQ|(HaNFd> zQOTtBd~rnLPT+p?=e6}2_?^tF#A2y>a`>1~^S+}q$=uX({$zBW#C^r^C@>$+y-qq=-5b{jjm85Yl1WW@e<^?2LWU^V8KrN_pcvv|C37Up^)4x>M>Mq zOICRB-1Zd*@-hA8eB3XtF`+y+d%G0yhH45Ae+S8Jf@Wa{Ew)il5Bu(j4;G|==t-Ib zNhcEFJuc&yP09zU@rA^dgaY0$X0x&JvxkAR;&#RRE~=bAii3`~_Ae7+Qpc!KrbE5A zU5)cKldE-|Ov<}wCU7z_5%BlDxwqivh;j1`XFK#=y&WBMl;|TVY8h~oJV^$zpccQ1 z+{zFGC@v45PHUfl_oCBjkW&O>l4K)5cLY>b`OuM=9^GU7C2W$y_fJLd6?3B?l2%+{ zsSfOY0FpjG=iT%oL@7PzTx;+L!YWZbXAQ5O=}dPAwvA{>(ep)C%R;+Pd3Uo#y;0K^ z>x68FUog*7ui3;XvSY(wZI}QyHHtl3`nGn1!QXYb)I-+HvkDHp9Y_$sJ`!5aOlZa!hH(Z$Z_p_U z43b2Hq?0jEOAPJ(XAy6a!c5C_H$-zRv!V1X>L0%19L~?@@`t1?3i7CJRANvwg~Fyan)Rt#{TSOUXD8P%N15}qX^rRvzK&b4 z>qG-o(IzE6pHXT{%vLY1)XQ?@G~NY1-Y9X^>OzYH!$3bb^E34@XphN`bL94I9-fIu zgsy6H)N|-E2QWcWtsUJHhV{zJqP61e3WE>v|Qf zu@oweQ-3?@TZ@R5)ACUG%gPFI$@^;xerSm^6I5Vsiq~1ovu)9E@Dc0MSk#~TsRHZs z^8X(L{%`KPYe@(Rg1#Dfkdg1dyLiB1YeoYEl{+$N{hM%N;sOc(Dktf9jLxO!H1kFG zfZ7p@ZRw_eMi0)8dVL+l_W2NZ#;9)Gu6l7=^4{xh8&m8=MyDg(J{Nbv41MZH98l?7 zP1J1J0AEL~UB5#tHam;e(8sZ24+CE+$T^J=;{;jWQO>U0po3x>q4y`Y`3&A-gD(ZNo;H<;H`ReeA zk-ztnT)FQ1xQykWbi-PcX5Vm!Fa2#87v%U&{7!6tAk%3P&Q-WP?}97!VtOhx_iEtf z)%n6NTbUF~!mzekU3@ZqqI0xOW@ZgsqW0)Jr3ui`Wf;P{pgOxK<7mRP7Lm7CW@*ob z?{aM3qq`@1+f|VJb$C2Os{?O5S%yYB96JVw4kKFl85l*FsZVeVK+w6tRFxe2o&iz( z11*g3x|&sL2tzOc9`}pPcHw#3$gCIl3;{V5k|WO+t?Ojf`=)%i1JA0%oEMR0qKv)j z{PbQ9dZG%f>+Q+Yf7pl|)OOECVNqu*4PR|AmCF+`7;al#AEp_bY_MT?sG~~sW zh5C_7YMG8`tHIfB{iO5>VdIr=$Y${|GTO_`XX>amM^}@Cj}Zf%6&s2fsOO(6jru#O zFn?N5W-U|g^h_N+8}zb6ZXt&EH<$zQLXB-aU*UrI`}a>ND;wwj{p-KLplUV11^1Jx z0%Jq->W95004B&rod)P}Fv}}-BP7ZipGK>KTp?s(xP0}VmUvz?1v^9tspnu!HQ`@R zw#=d9q>#X1q_(Agbqdra#LL0qqR{qgV4mw9M02I38Wy_i#_&d@>QYCH5q_P-deBC0 z_C(d({>bhC4Hb_V&v`x3FtbQ`bN~I*XWy+^2X}jXzOeHaxT%q|J^REu=49neexz#~ z{5_L7DC^EEMfImZc5$1F9g5AiKfH5v&NAc zl>|RSESz``?HRb{R9mG`X%Oz65-@RF?wxi`a6eS0a=FL%k4@WSnj+#&%>K&z{+gxIV zuWM07PalH1<4j|+fS9nuQQV6K3pPe;wO(t_KO7sl4*^16kd!g2`*mkSa=Pn4g}%u? z)^uf0qBX*ia|(#T09<(F5)A!cK`-Y5)TpQyORMk?mv4_pPaf^K)nhMtyJy%g6$cKY zw3#u#@u0w?iR$T)r|Bs$vWA+1eJQ@v_}W&-j-f!zPdBZ(hg9JxLc7R_*Jsb=ulbyH$892M>G%Gv_PCeQkp00H#8)4L~(m69Yo}{;|CzX3~ zvbRNxo10zCs0zUY?91f3v(vKj&2rs6eBXLll0*9Y7A*H$;)h)2@fdBxi_OozT4YfCtJU-5z`!Z7#qG0R_RqtI^IgvPMGqwoy^D^s&ZeeG6RRHG|;t&Oe%FzO$ zB-hYnQgnB0Vvi~Nv}gGNQjKI3?L`0`DG^4IfidvW!;UcXc?= zRt1FngtII)p|2VSq?5$1cn9@B5{w=@0#=EAmB*(SnOAz&UU902uxrH+Tm15)T~nTt zm0sxZbhu-<+?NXffM%%1nn1=}fxZ{PpaI~A*PGiL_WXU>TTgtr;r@rMJ4SN3vk6Bj zaEAtHaL=-?NDe4vZckX5ZOTII0z6z!bct zDXQh4Y94pQsKe!E5Z1y zwIi@`Aa17?A76B7&@i{F_QL z9W(vdRQ#SN`;?uB3zNMKo9E#LcN1c3&JK6QqvQW=7KF;0!sg*-M;Ce1idPa0b9_L6 z2LTS#S#kCWz`nXQTz(}e8@}SPCOZAFpnjWWn#FT{JFD zZQ0lZARsa0jT_VX9=6Jqn5DWolg=?i_53Mi%!HcSSyk#|zZ~5|BOFX6w zTg6VyRMh7B%BJ&@uxI7Fva&3t?K8n9q*Nrnl|AH-ba>TL?t!E{sC(T+oE;!F#*h2W z>*971VoRSUV=i2n`!C?fSB^dH*2JwJSp*2JT*|V^_mc|Q_WJG`Xjt4XX)u1qYmN^e(Ha0JsN-F zMg%4&uzD0XXTAPQ&xYxJc*>*plSSeyLA34BuR;kor(}MiqYA*{(6xrjfGXZT8i36L z5;E@IA}`n?jRX*Y7`;2`s>#1)yzD0)m&6$@c}V$@Zj0yG7)t9Q(=V11bNdi9{w345 z_!@o`W3O+5D?S`D7T+SLrvR40hOz?%513f^K(XR_UN0mrDq*teHm)R+x}nd79^0cG z6m0m%#!}yaY3)yp?LmaKC$`C`U#&aJ|BvSLzx(~4mq@a^6x+X)XOF6^uJ()0YG}$1 zUb%v%j%qoh;MgWqm&$YI`*jUyg4+&Z$sCAv_)h2OW?0Z!c6T9GDi8XFuWa8C>|X-xuWUNixUmO1sHmIPZEhdfMxYYw0r> z+C~Cn-Q1g&Ooo5$ApH%!xy5&WhY*Aw8!c^t$X}J>4yPO#JVy>*Sd9&QlOYcgSbZgg zJva{OZ&b&H3+f$vl!Dxhv$c*`@D~B9+WoW8n2uelXp7&q0r@A#aP6Mq9yL9cA#SG7 zaG3tvd8U%FB2|Puj$LlD*Ej%qVM1m;D`uPmxTybc8NVg5kfW!X-FQ5kdU8nNtTz9pbQ z**kF|A3q(6+vTf!`JzKu;4ozs#-;{W0RFxvi6Ga#rZ|$5(1Sgt3&5U_XczAp0oJ+$JQ7Qztu%Kyz=)l7VC2QE%A>bJU_{z1M|I5n2SH+AXTzi2;zKrgzQ1*8a^T?X2tPcm zLdSy*{T#giJTfQFLR4vKg$w+5LxZ?%YPZ_$P$1t?4j3;$l)u08mJrX7>M8F;NtRzI zNC#zEE}$M@T+}&O)-O^pz081u*#>wG8*;;4ORsLdJ?(dXsLYKqkg(BHPC1D$)%W%2>jgxS|M}He)wvylB_xJUn1@gwo0#cNnaElV0>%*?^%uO2LUnwx{iyxdQaNMB zy$uE8H!kNv?cCABjTshO-8T+{Xh3W(0?)AKEP+YSz`I<1h_U{dCtQ9h5xezpnjVM& zEubya)YRg9!T?+KB&Q{S=B)d=JBX}f|04b-(sZ-`ki)m;ow3B> zQQq+;B)JJr%IeE(H+xv!QeLZ2e=I&=+kzYv9L-0)304GCa>8w{Hc#N|7R1*7aYR_% z^RuJ+(w~+qU|rc|P{8b$PXZM}#I=ptk&jP!3ivdj@Pe`M9|qv-Zd!kfHL*$n9!i4jdZ4^Qs(W6Q5Db zX}}5Yx{~yQq)oBY;EE7@{|0ysK6dVQVSZJjemtnapcRq5<`wgLhF7BDmvwfFfDbzP z4Vt09#<3)4i#S^?T>patSM!A05HXN0ECE8jx0Y5-T!>I=O`OLjxPBN@&MU(e;T~ys zBSeF#cuiM~5(oN|T*Ndd23Vgm`&mhQtJyYmNmQ7ORqSV1#gtU@G8*I^mi-(0K*I4( zrm_-_^>SCk3~ldbE2a|9T>3Pjtf;%V@JNnbu?qzYN$31>uH;QngPeU%)DRS;AC$r# zSUIA3gYS8{n5UV*oPYAP_(ueU`KTCe?MdI;I)OLf^LH$d}gaS{of)(u=_N zXFiCZKl$4Zz>Crcrb)n0#-k8cs{VEHSBCQXM5opNW^HGjy)1-!X^hYLxW{x(zRBe`A08M3lu zV2>*(0kar2rJBfPZRQ$eU_2no!5JYyE*&YJP4n#8&$nsQ3q$O+am$xD9-KY{QXPsn z6Qvz3|G}o-yzle4>dax|`ji^nVC82qva$sKI5WO-RvPHV?m7kq5~_ZJBUtsRP-ps> zy%V5Rbs)msL^1GMVwQ#7fx`Cz$yHKi8rP)?=OkfytrppFLZ(2vseLdC4O1WGq%%i7 zjZ!de>h46GC!r+jK#n>auUus13%hmw^+*L?DgmBSJ(`QiW4m<%VUc)1vL35GVUtho zFl9hk^yaRMsa$iEB1fe}NV)PH;s>a{+4&&CDRzYqC}*R8e{Niw@a!DKXdY(9WEFsk z5DsNSfx`iksUylsr0g6JbL$YZN8Is83MAQyt)q*mH5@iw(Z_!-+5eBQ`VaT_k*qm= zh#o-pem~}@s^U$zMT3apy2mYUy842%yCJ<~iu%2~vAZIr%06mmDZLtAORaRRT4J-e zXYS0*U!q;=N!e57`{$_Re@Dj*VwiLO`%-;0E)1RP+UGu`U%{!OT8 zo-<0GUv(Wr)d*1a<2L)`whoIl^zWB<_iQUd&mM{NCV9ixojbkR;#>xNo8{IPzak%! znN77C^PWrVstRsS6Co9FN`4X*5!?OwH4jot?MQ*s;#_orN^6$?P?P*}YYRE{7W2E% zR~r!y=dZAqScK(76GkRwfJ~ZcrL#~T3+jdqn`?%Z2(>z(ABiSsd#<)kw!tX)ZuLn9 z?ZgG{=lFOYmXNf0!3PHY@tg6z(|T{~^)@;j#kVN(EI9~x-p5tR1u!=JF+`jVV?po) z80Qh!%15&4*HO|j!B zTJeK>&ZL3M1D}guVcGW^aW*J9pQs&c!gPBuVmaft3amIvKW6SwK}hA8n?4==T}#Na zolT+d+H@zib6s^CwBW1KsSEF}or(G3eQJhhS|d*33KF;Fq+rCung}7^^U(+^yR5Jv z@p&Uze^VzPncTQ`SZ$b@B`zBGMc(?T=3r3up*_cslzT^d+q~YIY*UmDe=RP{jvxEp z8XUv+wYRI;2$pPW$wmoM6T`|vOQ!{x)+PyTI!o~gbQq-4(PsTjyaf)t{wc+@Ykr*$V=qxO3p!J#MNWVL)5o;;rMZ=lEw@iVZ$Z* zK*v+TmQX<@mj`^=*U-k;b^Q`MMK*9Wa@Qe--&_i4+-R`q$GEt?+y-YAUCV)%iCJ|s z6%Z$lM#`?D@Mu+3{9-=pxIH&Y4!-u>g6MRp_dn`w-KFxt_@O9R9Jw^Q+Yh3Fq|j)+ z!nP)NsW|A$Er-Nl&#)2&AQ1=;Qnd-zv9UL$F=}==la97{G6BS)l_V9 z3n2|6T;8$GG~o-&ksjb&RBO5I7za{deqdtmRSm*N_EeCWb~s%>IiZLh0e+S5`vQiq zm`GQ}P?m9S|L~yxjjK8M7)C zCWVbzUwzCcOy9R|IIr9mq3S59zK0JP!2|i{Lz<{y&e1%#YCjYywt^K5LV)luooi|o zvLjlj7rkx#@5)Thdmy`UTge-S)238EDZibvDB7T5yQn&4DO`eDiyM89G*#1=;W1~H zAO(FOu&-f~A$ge=z#;7T9$u&M8!Yv${ID<(Tmj3uKD(93FRBU~y@$}Y@5FWOOZ_E+ z+xQugW?r8){`u<6Wn)cWe;qCL#O;tFp`UvT)H z^SAWL%TwiT4KSr2u}sDK_e$fFWK)PH=Ji|`DxJuhipT?`Fyw?UngRWh^!8r2VjO4R z>TxsS1{3{)nj(^9{+f^89qlx%g)+J@e=jna7kGV|-C-uZL+$9=J!t03IF(WTkZLo1 z+W*q$6N)ZIfU}!2nz=`crD_5h+}8z?0Tx1pqBWuz^Vbl%W{u$H#m%ft40jWKOKH7H zC_I5+{*vTB{*tw4e%DRieHG>6g= zJ$1PSmg{L!p9j`U-^@C6w0Zp{qrwQ@jB4gIpGj|#c?Q^wPjk--CuGOQ+3wwtA)Vhl zdk|sCzgEe5#2N&P;7dd`-Sgm5&0`%bs$t##%*tXlb9fL+M|uBck~P7*%iWCYWjkeaLtXB zHNW+o>OXb+N!9DERhJWf%^kRmr_kD+IxePmdLP9`7L1jMGn$ar31JgxLChc_CE*q_ zYvy&M#v^CDo|aT!BD(O*+fCQ(yzBz?W(d7^ZGig^rK(k_OLlRlV>an5i_-IE*5F%5 z_amHqgVxW>4kJ)30_w|=)h5$#jCRHJQfJF1*f*^;0SvTceW=-j(CyQzmCp~p@OV*w zto(shnpJFP=ANT59eXC&IJJlnBIfEoc-ypaY0?)C?A>@5XPUa6)@dGHU_rIPae*@} z;o+o(kpprKOBEA8UmQKoYUlE4+v;V+4{v3KiQ;p+ce=B45gNf;KB7hJs(i*+_>!QW za&6atX93*cZoQ&^xU!nf_bjv&cGN5XA?^Jbuv@&nV0 z_n+9vz$*Y(U^6bulmVZ-(EYLiGf`zxYpSR9*9SQW)4WqUa;?JhZu15Tbm@xywhPuM z(9v%qW5NnT?~Ue!Jsf@5LMkj6X0jUccA{P#or8^>OsO(_?xl4irtTsQj&lMF_xh2` z7_YQ?@Z4y#HtSm?xkUeu#JcP)dS?~XIYF4&%MM&eM<2AQU;Bp8I@Y8(+}IVf589SX zlqEjIiW@TB6+etn+OivNjN$7jgAW`Q)&~@=IAWYZ3C-vPbgW{0^JbI?uAo0@8q1!y8b;p=1cv( z|MyTQCxvHIo}nbNFS9Noj9;1=e+`iA7OjWr1CG!B}mq6iiHU-<<$@NH&M62`QBcJ zj$+0@%-s(Qw%C<>zk#pIef>Wt(1c zxmA3Ii{l^z7&vY>)r)}Hd;pU2WM#o$A@5O~K19R)tb(kq2k1^n*%+DMCeW56(Rn{I zaN+oVjD57S9Hmcyo8y%sI~`feR?Wf86ViIeRiBDexE)0bZQ$<kwpUSU&nn)*BW zV&XHeVdk@IrHXa+qZC5q%^=S|f!rw)B24Y7e16*OTtAX~tHXo3A(kaAZs&(jPqB!c z$V4BOxsK)l<@_6FT<`2=M&A+q8+-4!yK^(Bl6zc{=B4(Zk>D=3_C~McT_=&ie+2J0 zH*!yeFMx0hU}(jh3c*DM2v;b*duu*@6f02Vc_o5GfxijCtnk zH8YcGsvcxo$`0go@d7a*P)Q88SK;u6X&Pff(&2A ziVFy|2MfEk*J_t9{dyx)q2o^W3HHfzX6%zwcg-!IT0V2WQ&e-=8XS9S&r#K}FVEP9 z5q2HCb8%M+CO zB{X29D3PMN>*W<;!ory%`_u-4E`B#^P;o&7CIDxgg8)=h|hnF?IjeBHTr^csaR9=jI%iR+Xj&xmO5BkPmmhtw|xD8zwc|o*J%lMbR*v~Ly zM*KKMl-~t`Y#+^WbkUWq1e+T>?mlxmulQ!9Z;iX@`Bs%*f3BZ1er>b6 z;!_#dWgFBSjAy~YatWU4XlQTEuWkuQUAcZM2cg)M3DZRjHj5SsqK5tX&Dkxcu20Tx ziGQB69iOHUbU%A`*%;Na9YQ@}%wl|KY_iHRc0*^Osie&iis2C^ zRC{s(($0ECb(~6eR}dWf)of#QyFrU-`|j}1ojSiqIUq?kU$8ydv}S4O8Wd8Q=|5V? zxuhW!naaT^{tUf=6{ADpQZj)$F7ee({p8B)4Hp^K3`GwdJm36kPtf%-!^3dqbZ8n?TU5U z2$}a)S5pVoBS#~&U~^4$S?8y6e7T~FXpU}s+#WK5ewwIH=^UCq(Ah=M=ZY>dTL}|u zRwSie5yvd+(7gTiljIg=B|YduL$^~4Mh|acy1ITf+G1*BZub^2SCx4Rfr_LyX%}dg zLekPKfjaeX*=RFwo^IeXf{vK%cNgWBYPcJI+o}P*~v1P{6?#3AE?DX3* zKzOSH21#VLI0C~^L3>dQOE)>cStpXfqKk~*_{0t}frh2m9CiLOb_J-b)T+IJP88-Zy6vlY%a=62(q%T|(izdP4vV-IIxVl)y zrHGJ;Emjf_ag}FDd`T8ASoSvh=iaY%iuFr^iG`z&WY!_3#TA#5yh%P)XCo?^+yqc=WG-gtlWCz$b6 z^Yhz{pb)G!99>dufa(~nA0Me?M31 zafj1~)8HZ4i@A!=jX`*Vxt#xvC|(u)tBJF)Q&#M3o~)w;C%zl)Wpg(}*-H_8Z!kP= z+^D;gZ1e-stxQN8geCl*=*i`;ZPpf)DZ6Dxyuy9CBeT0AYvvgxIG|LeP*~*=++RKJh3rCAbpB47Z0yDnRUoCT<=J8KysK>@~ zD4$Kq7AHcL$y=8@yFd9~o)Y&yJE5IW4Pd!;63hqjfltuC8u%N=kLIFM3Lnl{Y-W4f+p$H}9-sw2KKD zJmh#|(Coo=S9%VZ@G4UVsHo+W_1b^M{2CbEtB%x*KdDGA4H&d1LOA#FRc~u)w8>JG znZS#^WtWP&9_bjl?sJyc2icsBp&ypYEi$9Z| zfEzqq*ca+IFuR3Fr*N!Dj+KE}(;pi>$dM0JyldY~F zluSp+Du1byvJ=1%hLBRhT88CytY081F?RnFm&(j&d!JNYdxs5rSA)|>Gloh03|9U+ zwy8%z8+kKM@W*8mTwLBUhyGRg$+c$3WupOou$&{A*5aCc3_{^bABO^njt#em!|+sYCQ}tKb|*CBw3CLP$01Z%5H)<8l^BT_XbX-_BE6-J zg;XzKhBH`czvfKQ`s7I5#p~nkW`xCv6MERI4pL|4Fqs4}QK`r|(eYRvP)b6q3XDF=(4nHCUIGqOJC69Z(7 z(Sg)O&ofF(;LKJ*T!RNHRw?f)3=|V$WatCP>9^gDzj1%B;^-76r#X;Sn~CKBG`Oy8 zDY`+HG4f(uloa0}>W|5bN#kLP8UA!Ytv*l~K7Mxr0Wj$JB6W(B`3raD%HWuS__D@N zF1c<<*Q%?o39#RaO$Wa<=>!b&C^_&BH3vh21vU4wH*qgZTsX|b4 z{g}Zo7h{h;Gd4pwjvsH}uVUOh@FdNbQaM9khEYsoWkXap9h?Xa+IrcD$vJ)iyDWa7 z?%d=$q9Cfe?*qud5#+SMQ5CZOFg`QmrQgOs9lvxQVrj#p>^g@mlfcy0iRZ}y!+F!S zg@HpKN;=+ER9aw@f3Rs5Kn{%yIgojYlNb)fY*q@oHMw)Xfbz(YzVXea@BgCyEG-=R zQmuq{AaD1=8DLYi69aUwk9nAcMae|L8sPrgi5Z{1RwqqX@gR~p$dRzZjjnB%F5uls zTYD~&r^RajYSOYN;#uRK%ar_^#bXYgXDfGH3px7nZi-#F{hFsRfcq1pfN9m*F?%qI zF-k>aw=NTi{fU^QW6hc11{}gGfvfudon!R?n)Q1e^Igp{*hJRM*!-DL`oo!G{m~GP z#;=HSBWcAortG;YsCc17X^_L==G3Up9Rkd_d@}$dBZLUA5g{@bAw*@BV(>V3lVDk^ zOp+AW_M@TS!(06#A_XPC$1l{l%y>u5u+hNt37}omxELbE2qqEu$j%3;ylj#zB@jyE z+ghweD&Rt?>XLlj!VdBE8CyTLpd94&bb}$OAPXu!5^Fh^Va)Po%0o*4G$l(#)5npq>YMl!L1u?Y{h$u_ zZ~gQC2oX^Hw(P4xv_m8*=Q2e7;7}YoJX7gpj6I$6ARiAG2{r>u(-9q~8JQDKlEaNi zdgJ>(ue$U66Hxvqez4KsfQjW_sX*+38Z!%BURB~c1}H2#0L9`Xm@5=*$kuo>`3~Ws z1h8>hl*D`$GYkY#oWm&dQ-4`Nieh^nVEK$KvpsiayvoQ`zKXc&eAWJqW4TLAKrj)| zW5wh^l%EAlSwP4LQOaQWcm3f&r7r;LxnlPz|>CNy!t7}*qPJUvQ5>x@77bfK-* zb;UEk{Jb)E@!8I^C4-UZja7G@?bcvtMU#`|OqnN}*s^piRePobEfcyjM~4x~aOPW8 zo*`G)ZTv%}>aOwfAf`yT4;b_)!Pf$XWyg8tgO8K7=?Plj8b{YE1S9}{y{wN^lv6S` zBjepr8hh0OUB$K63PwbICA&bX$JKuqUNWNlbJ7S6ob7*~dWV9wnxo=P?cGgT-L>jM zB>r_M-55QV$kn|yIsy)&quk<(6-lj2!4+b8wE;mNK&6jljNOumaK8C?Q1vt8_ga$b zib~j=hfVPwHN&vcDWGJ`839b}``l7p3v|qo29F$am&t&H#wiwCen|UyL8Q=G)^-3D z9_1L@(7qcm$2U-nXGI(H$Z?)Me+z>(Y{UlxnMX8P@~LVrCP+U3WqF7ySB}fO#5)gi zbvt+Z{yiW1hwt@!@A*p89kHRfjM@?2j_U_MY^!sM!0PvcAsv(+Hg$4kosK(@g8UB_ zuyIZ_R<$6G1~9izS6*f09shRL#|74Q|Epbdd*eHSgO7{DQ(aS^;5MtV#xFGf*Mvk% z6+4=G89pkyr4OEujOmnEXB0+%!&3>j5~+@3z&57=zJIZyTf2GL3-a@B@UjL%tY1t= zMw2Bu3ThfcOWi(t(9Q2D7~GXw1wrzyQc(d{o-K#pNU0^Yqr$>Zh~5es_2Xlu{AOa# zyqY^7r<_6gsh@W4{5kYyvrfS$hLgVP#4AS(O;1IgywwP(91>Cz03(PeuPF*_;=r>Q z!#)j3nJHFKZHj(JprYE-06ic|Iu|#tJ|IDH-c4QK)FJ;t5*m$Y>3WM^>wBG81I+tz zWX(U^P?Ahlek6@OCsP2SLo<<%#R}NG#CWxAXl?a6nif6!Sk_M!|4v)4v}?B*wVR-|WOInW|U(-7%|f zK#|3Y>z5*L4cxB?uwaq>GpeA)>S*Gz)CMLE0KlTp*BWuvdgTQ0O5r8VJ5W7d5zVsvgze#sfs7(pW> zK8D>G)iG)nbp4bf`{GU(%y{|B6r;S;_DQ<8QT3l9uFUdd@UUhsde|6sMQp1};SNm~ z|5_7mp%3)_aX!fFbznTj0BhEkPM{KkX-_PvH>Dd8)<3ieO15hMxR`RB} zI!5Vom~n@B&_jt;dgFcS*D^-6X~ zzC&4lLVj4j|9ThRS@wl(l5V8Si&q`0J9+U;-GOv41J`h1bDA$dPYYYYq~=BVa&O`k z*FRNW3nSB(&*WT_-3?ECnTPfLnkM*rvq9qhoPLAw29ZChmgz0)5(#Jx!%YeOyse3I zB0@84FKxnw$FUUmCymH8ga-gs1Q0-tU8pPFaYg-lf6sQ$?K+0Ctq!tB(gS2qkZP?v zyVukmSvaUwd5yK>0YnoM{A#qK;X$3WR);Ag8ISTaMe!#7MZGsmGlT?ywgdzpN6VHv zkR7I*Z@zu}!BhxiMK$C`oS&uSpn|)J0=2@J39U0`rL|T?8}oymZmKlb&-IDK_Td2O ztmiEFnd;;Fk!1jpYS4Z#tfV4uqA=c14sYvk6(LwEQf8m1fD0CiMtmBQXW;zS#@_DK zSaoq-4tEwA2fXtqUv!7w;ZpX_++psTq+HX}B*MA?LaRTgF^N@82rq^+(`O2m=lW84 z-Jas@zlvr~MZ{8`>P(^HBNw<~z$^A34-R1|-#X3XDsku*lei5{z;OUlyEtcP2jQDW z&L9D?d=^+-_*4hcPHQZR0vb>(88=0e0WE&Bvw|KD;OtwV}%|ye!$Q)PFgj=t{LQ2%#N+|EkSXdxG$WzleCjRpVM8t z!n-E$X!9A^v^{zIa$-*r-EQ#jyW0*LoGBoFyRUOA1Rw*ix`2XzsOG2-K!sf*yoQia zWfBZSlhJH0ry&>Jkf*lXTVOiK0XA2--C5lV$QlN+9+BKX+59|6!<0hu9N@n-PkbvM zmS`LyAVH{r%;x&W&3|wLVYm|P93~AgsG0%KaM|$HI-u-SQ^)e1E@Tr5i2nsXD0uP`V67TqNE4tAY zFX9p+Jvx1EI-@R*7QdSM6XZm0fWvraFCU#JOTIDqhw z5ETcc59v*QT_g7`Mgj5|;JH`;x8WcYj)Jq!9!;P&h2SA!&IvB(Ht#4Ua0GO;B+fn6L zOe}8l-QPhfuB%Q{gW0zN|NIBvm$~@5$$_aB1WWlT$IvX12UQP>BO+fD8ZjImCwj^r z#MdpBXo#m_>g7N)E|orPw$| z={5cc7=_>5$->Cj)!N`G@H#~I?A7UgnE`J%m0E5%3?c6sX+j8dV({xrx;rJJA-iv= zqt9;R3LCoEtH=Ofl0-pMGQcX|Lq^6trZvfLC;%j^j$TOkbA9{bH?~*5@(vy{v@@9Jk9Iq&pR4Go%-e^$mATz!~ta5T@G9AaF&>nZCcmnCmn-93yAqS z?|N!CPgDtTl5>L9Z7GS=GDDVSNKmG3XhU_lEP5R1_i|RUGRfD!2Y^EL8AlGZIH@i< zA~W%Y8i5Gh6(TF|q>s~N*ME8x{ISIE{*4}f+hM9*vV?@o<65#*nKA-QuFK+E zYT@J!<9$fYj zsg*exTmTU&zA!WcNH2^>uU99yQYwwd&BhIDKaUwzK0f!;G?0n4OG9B5|c^a6SIa#n=T+RtOFe7SlG9Ku7w;mXTdEi7ASnokW zctf8SncC{a;D7}q0HJVq+~?9?4u6=u*==NDLz|JjtpH zO9qb!>@%x?ggnC&Kv1ZH;6Jzcp|vj2k9bJ%{J;X}+UX_XT>5eBpfmSu(;&#i7DR9I zqG_#3Em<>ZPyad7chzmG#T$i>g3h9U=-}0|CPz~HYI6Gc^gi*x+@*7dXWfUV!RSSMOa-2{SuY6D^)Kr6= zxC|?GUFBU>({Rqs8ikp8gt#uD*owX>>8E74V$ZU+tu1>nZHKxG63c9A zj~(0jfLjd+1*cmYajdN@U9mqfBa{Z0rN?z)&Ev9Dtg`?`HVxf^-Yx*r_W6pNQ3&q?t?3;DHG1;=zN7 zu)-J1;jECK@B08Bc{9)D?^F5p`S`zml)J;Fwn&Y?D?WRKU1bqavUFNeWry^UbdHsm zv%cIsE|Uv0RrUO5hQsbuO*y6V13%%KIf^GVDX_xYDKH1$I;m9N!!$Dt+y zDbWbIlUH!4Y1(QFP>hgZfKpF)bqy>i^pJ(RX+M5csQFuYx4nP5HU!M-|J*5lNdI04 zZm=yf9kj1?a#F?MajMe^EI3*^l*58aMFKtH^&5kmmNiWH56bnp%kTXhck{b>BV+r! zothahEpy-P>;!oZc}_Na2e{auP`zRG^4NgXD63EC(~)AHY!P*Dx*-U`{e?U;*iZH> zlk}72Wr*^)bi&oji#z+eU4+*6jIJ1}cLouyB;6{860AQNcUfQ|9MPW=SqV|e5SgTR z0mCFvOx~}~N#In4j}qmP6E%;cujSD52>DOOX%@s9)-x_#)+HIwl2c)h&G)h0xNl#OdH#v^k8>=0?j#t{aE*)U|a>Ooj4O%CpOZU7|HjAkc==ORd z!CacL+Yup!DT|bYZF>dn@;6OB;!IPcu`xk#u{t}RX`=4< zPI1)Vi_>RxQULeTiiWDZw`giUJt23_B|-Bz`N^h(?(1}FqUg^|0qz;uX3P_z z9@RL%=1|o|H%%3jlNYBOS)<`wfutHdrUr-dy0pMeDmk$z?o40g=xdy(SJ5L~{pmJy z;q%`qq>VMV57;_6(Aun|E&^Dgj+F770ObE`n>O&{>L!Q+=%CQR20_&pKoZ56W$K8X zvFx@JgP!)*zo3Zh1WH6OhVfjmtN}!hzD}ZVq!Y@gDM5gZukd0R$RYE-hrqt$VJ&tY zI8j?OI%M|9`bs%lC?C@fUx0%@xnwvsIAdJ>umo4`FkYWne0R4A4~Z{^gnaq|gwkdT zW!vD%>FDo*P(4(X>-bfC#i$j-8<09{QesNbsR_TL8zv@Q2!9N3ng1_hNruCirF)#Spz@U8o{3|0^~a{114!o zg3UOg&!lf1?lWl?$5p$2jKJLGt*g^Oxpe5hiK8&w@YA*61>iKqOa4ODz?VT;Gq- zkUKN$ixmf1gG@jI?k1|x$BbungC$+}+W{@ET3tLol9PyXpE5=PDXQJQS__E??*S4^ zo$WD&17-!DyP^T6i=Cgmz6v#X#wL93n_cihX5B$CKw;QeJGtt=!k>6Ro9+(p(30SQ zsg5{AYC^vpZt+&G5qX)(n|P-G@w~L#OKjxW>-}qVyj!%JmGG|9LB7-cU)QcB!h;JN z%~g>kW99-&*=F6_9H;SjgHRR>ZNL9&r?~)A!saf%NdP1Ms~!j%!h!1Ow7SGApfwB>Sm@Ig00 zzx{qpwK>gHV&NquQN*@c5gpQUtHhKA>LkUsC3a!ZIrxVVtv3$R)3V?U+!WE|sx6B@ z(D>C*cQOSC`F& zng0B>k^`gJJ43SM>s)e4m^OdeA^yyIS}%|E1lxX*7Se!M1N z<*@^NQ7J{ji2gm!Wd))jt_3ye@lAK_an7n{>Ci+g3a3NVWy;*u0{gx>_F^>$BHk9w zcX6UqL$I+?pO+iFI*ceL6Mw43cK}8>WWkgcD_blHYfjPS4@_scY{jNm=!2$!VekrWB18Ar=}=Ww7#@|KE1`&iT;*EbShdLk-SxkzBx&V`6674MS9n z;hP8SKr@470t^L|MB|fsFHJ`@^f|4Oq}P6dDXt-mu|%*c24M_h%>Gk?EJd1qLs>J& zQGgjWu29MFD>h&r=J&T=KPB3CoAnMh-YvZtsqSBmGCmVD>-zx1i4W^r|8wrIVBP7e z%uUby^DA{41>iV}MwpiR$y>`^SW^#Kl{0dV(TbuQi{B$u5F!rA{BSQ^Tt&|76!p(k zkXCXf+Y;NO_v&szY6M>VtxmN_^%|=wk+y1)$=~_*p$&aikI+GsN@}$sRuJh#n-N80 z%jY8Pu%glh+yJ0ci;B*yNu`r=9#~1g_^`K|m9x~qr~|raW0~Byj_;ExCX{o=x?=?s zvA-MMj^|JXfJs?f(Hyb=<+*cp{KICvTRCqXK>W_fj2iz9^SXDy>KO$@&5(vTGNi>% zB7t4!8K*JUEp9NfqG2PKMxC^3>H!6Xv!?qWAbtF%n&AsH_G_1PYO;YRdHkD~54v+- zyB#^Mukj04a)-_Gj%>TyDI>fMJs{6Wzyl^fC3$|)>Bi0IK(W2@Q>7u@ zL(tcDX^>$P|5K0zSQ6V_!$Ym4cI9?4`K~&R=756}?D*h>HxV0$DxmRgK{5I8m^{`1 zkAaL019BF$8iR^W!9jD3s=*vp2JcHB4-Z=A?uEbi5Rb0f)rK}Z;U@;XHVE-Y^X96_6dV1~KCk;+k8{z) z=<$W#H2TiP0G;dnH!5J5e6LmX8R@zyu-@A!=f2}TCt4dUW1n1fv@&XtP!R5S7dh<~ zA9XF3iOa6-A;+lRGCku4X}e-wOi~4;^rhb#)7*CLJfTrb2^h4nz@cf4BtFr)2rkQz zydAA1qj(BTdh<;BO0G~C9IL1K;;F6#!cKg$d2B)F24Fgk&g^*sP<>ZV=^v;~y!|=< z2iK?G*9cM=2Xl3+(CXCLw50AJX0KJH6aZ;%)A*r`za~lJFe08S-*JuNaRrUz-)^d& zDEwt9YZJWbgAE=_t%^r*g?Zdr&E`{ZYI*^>pTgO=&}>sc{ls!jJzF_Q2kXxfYG-yB z$X~_s$P)kad?GkT6VClS$GDiOMs)*+42YO8!(Qh1$SFKkobzIHQq5g7-x;q@CeQk^ zYhxiAb)^{nC}zUEFCgIQA~ucoG3zj7Vl{=D*WZ^(^kmGXxgdT@6t95ZzR~mI9gy!~ zxdT=1aQS26&iwJbr$FK%VjV21b%=f`OVqqW-(~)+X1zJG4iGNDFxqgzAP%tZZGS+v zj74Sang%RwdDz>NLzkdPdL1XBdNU;vL*EDC$B>PV6w7rC(w5gY zS~HjNNl$zSPyaj9r}^tbg^$+hoMZQo@#^3&Kl_$(hFqGgjogwphM_yXlS>~t_4dHh zEcnpDyeIi=9jo=7njsc!Y(p*)U1qbolRwK}-x|&di+V`ptuoiB)QsJ19jxD&1s zzdd#k-h`6%aYR8os<;5> zCa4lrxm&|aHQQNq@*4zTh8!^3WYtA@7zWyAy7W;~xc=#ZA|Q{aIqhIPzrQvJfz7b7 zcg|Gxxd@=uS~E~tX0(wUdst08MML4v^v1deaIg)xs(*@}-Fct3{&eSA!C8EpQ@n`- z+&@eM-W*%*66NBCaCXRgR}gjaSw}u$Tun>MARx17cQ7?@X**ITthjcO$zrfST z%|IiNn$&!A*O}GXDG)wpT`A=I4^q#|+DI~u-Pu^hFgO9?+a@*slhSJ-b<4bihmnk# zEPR(RL=P4lL>^-P)P1-D`qv_z?eDfLi?Gut%TKv6M_*jb5G9xVFyy}%b*AJ#Kl1|b z2^jSK2PaQksmeOr&On?d^=eERdHoVb9GDdw2@DfIA=t_C@PGiaqK|TqZ4R__*tMt8 zcfD^s6f6=Ifg9WDKr~X*tF-vHgJt9yS&NfK#3-W{McPa6OB#zBTvyAOjGdH$7uZtQ z0fe3)6M*Lp-QA_Z&zrwkNhl;ne=zML1 zP7jZKfDKfDZp(~8i+PZeKH1z$ieR#^hO!6~g8e9x|R zvAzEGWC$nGkM`JmHl5xy@@+Xc6D8Y;r||n^rA!N|vMaTOO8z)A>5S3xc9?!Of!&JL zQ60^k(ODY{O{Y=-OOuMd9G&dql%@=$G z(F&N(fK86Q+XGh)xW`BR>NZR2GwSS*K2d&d>Y%%f|2jUX>b3pXkC+trfCBSoGZ8)u z#-{^<0aAx3LggvO_~k8K)_{|hc1Tb5;2vu3d;1WeAv;#KR!x^YUTDRvyDlAV2bjm* zIU0EnKHnp-Y)Mp7^AR=xAIU~IvqLdKtxnCCgI^7Age*2bi#0M&djf)Tco-__$RFcz;Kb@n{4Qd;JOY7-fcZd^AJw7V zh(bgL(M>xDHVYXzLe{6p3=vM;#Wz;xh3O#c&qX`PR%Fh;W))^(Z9jbwB(T((%k?w% z6=dgDKTrR!EC75pq&10sKZ;X7_oE6bI_Yrp7KJcyNJwaoL4ce<`q)m95F?Acu6*5@ zOVGb>&hkZ_=JyT)RWL9xDnhW8RT628e?sS2sTU#~A1(5H<+)1;3v-$Gb7QszN?C-j zW@GosnKR`(GJ%NfnA~@{rh8+Fc=ct@Ev_f}D{>@(Oz1``yS;dp0<*M@^FR2O1aL|= z5R(?YhzS@lH{|I3iU{fxy^81fgN)JLZ2a3fs$rr^fK6!xhjdQ<`WR;X;Y>(#buDym z@z;5Yu(O0ar|hi3DcehM(rF3H>Nnd3v<~_^Cz{QBka z+{HR@EI+LH>+`7bZ523WH%ffOFKHv~EG(*6l;uB8^{XwxSz_1A89&^B1b{x?EE(^P zkH^0Nitoshig!JlWC;?VZx@9n zRVBCDr~qY~dCA;#4g#j`*Nh+5;-0zmQy30TSVUIL@$}~v(*UaTOWZd>qmYCPetz-s z@RRT>m$M!7y^>QYuI zFv%5Rth^-qz*;TQyrDawEq(#vW;Xqt&;(3&YY$TfkFbwb9xFI|((T1yRdu^n%fXz( zj&z-!anROUPODQUILJx-0i~v+;8WQMUDoJdloujd%nTrkGAyC>|c`;T*F!eg0i-cEs= zE6m>bFG=Ry?PZGSZiSo>GgKTl>i*)YI{h;%awMLgqhE@R2)-_xc`7XK#{Y$l=Io#A zdQX@rdIWcss_XezdWQ_(bW4c81Y@#WHj&pBu6tnG@C)BZWlMwf8f;gM);fjrC_t+} zg5?=BdI-YzK2@0^)VZZbr8(dfcKm5pfQ>Wa-_PgosVfy+&th`#vp@f-U3xzsw`3SU zoO&0{#~aBF7@0gYlRijU&+~U=bOA9*r*sXnK}{rT zkvWR`z*oW`#ex_hk)StI^M{`5qSksT^;_2_1EWb7>Zk6`{`;dN{trgNNZJUVj8 zPu}sG8Otk1n?)K=VeX^|tX@ZwaRHnXuH-iwc-dt-Uhof0F+5(y1~gH8bEh93@qTPt z`+9*?f9iQc_+7M40u-^18w(*1nABVK&M_3M@d% zbFBM;hKu8z`;)9q1e98F&~Gp@X1Vpe2!@^(BKxpte*Z00k|&=N2OxU3*r$z~Uo^%( zm}h^O)pr$P)>g+$3;bZ}TEuMa)*A+Yv8rEq{pVw$tk@MR;d;al4@-rePV=(xdD%1% zpQc&8PF(W=zAEhaKk9@D^PS&ocn#VYGe%2;Q!f$}uYEe(65;uvU_Ij`u$h{ok5e(L z@PCgbVt)Jj*JL*vhC`LrlxG^VMABy3Bt;uz4n(@`yrdCAiIY~Y98`^5l<`YDr>O(- zdTBG)OtH!C5fWrN_$ZpiFuxq`2IAaLgvDRE^17jS=-tf@^Z6rNalti;dLxZ~RiZx5 z0zML#@%TT=D>!k{-)1bXx{s^(QCV8F|Xe33{0C> zwZ6J7X|v3u2nwAMfl|Mhg9KzObv(GNx8NxtErOylM44=ijGEQ%9TT7!gLN7V<2B<3 zux77T-o|e_*f5F<)719O<@V>S56v=mJM3v)a!G;mi-ZU(S%v=L2)FrX+5gRiPHXko znM~3AxRWr>yaGReeHLF#q&WOLE*cxPB)0v+ztnDu`OS-`ZB1OSIv_3-YUCGx-s@EK z$QvZd1t@gnMWV>K^M{XiZqPXd0T>W32j^U!aO9IpyICX!Bj@+|wnwz(^MD*HuX&Y| z7QFTIEx3Mb0RK?65#x*9NR?_E?-8t#Bir7NYen7nK=71f(SzYNHzBdHmAc%K|FHAD z_rotDEBQ6`v++Z7(#zx7|Jtf}D<;IHlj1{fPMX-7e#5l1?PguIN4J~8xLznt8A*;d(t4f3o!xgk$dP0)Powrxp7|LIpc9aiw}Oy z#Kk&qp+Y%!8rYCeD15(QQfo98^|rJeHd{A>qR|Rp>5Fs7V62EJ)$A8VFW68Bv`!N* zxDt=mP74oDym*q46ExDjaqN)}_IqdBIcZ9hFD(@o1#MvX6xT9_a6rntu6P>s+Z|)g zC}^9%0+ahe)X1r#-N*F~!G4gbA+fr}2>Yw254_l%w%MTFe?m)OJpK@UT2_a-Q{~4- zo_0e5)5CkcQO|Ik5tsrnFV0Yc09ZtSZpK$}Fs5axK_X2qM$cEnCzHiNh!XM4oLU?o zuOilk-!%L8)?>nTrYrPy@-6cr%y&mCqti1E;IOUtW5#)VKPJ}QEqTfK*Ks#rvc8M%xj9Tix;;}`a$W3~G@31& z6y?vqQhk;hlQ(ib`Z#PI39RM~M>tu?w^zt2mw=t?v$Aui(i2|Ly?8gKcZ~b}cB(fv zfFpd!FZt@P$m>Un`D@cLy&zz+fURK)KA+PKlIEHGrczh4j1+G+*i8Kwzf5-jb9 zl|Vhhil38ABC0udU)KFQXso&8#)KMR&0y-r_}RwRcy(tyEKXH4->v)_68v8)(rfK$ z^0eROi;tnfFM^*aJz6g0#0QgHI_nV0Rl`*wWz&F=ZR`jP&KfLrNAG|G7(BaIWE`By zqQ;>DpuuGTz0=*>2BlEMii(HX8MibX9~fQGWH#u1(VZIcXF+Boxyyp47#~VJLi}dI zX;|pe0Dg+l`(v#Q$uv`)Sg#uZrCUK}pKC>*P%0mURA~s~uh1|O{)pea6iDL+w)DA? z${O`pYdB6q;8mjB(j21w&lFeQ-+dQnA2n~_KACH~vH<v?6igg2dzl#%%+vqEi;q?RIF2T_WQpj=wW1|TFTJQ6y6}hLFH(T~f#hydOfu5Cu=O4z&OtZ8oR!+%)Sp<_aM3C+Tp6-mkvEZ(cm+FeeJ58yx|`)ufHz{^1L)?k3`Z z%8r^QH*2_u*QNr_+-u9RNdWVcIJ0{xOVu;4=(+pv2Kb5VOK@EmaoQu3m2JlVEb=C# zD??)pVg}o`x0pg+q)wGHz_*?HzC}?rc=qFO2nifpggpWXi8XBnvVe#!Udc~%nQiAY z+aGoBtYDg&O_=E3& zh;t{Ol#bESwX2LE)?N%|3_|Y3>r@SP)+@oP*qCf z5BMNhe~IIEJrW$QgE)~lrP%d?Bmn^cc97#?lf1;lI0UdZhswQb2|;>*73wCI-H#@+P=GHrpGke~-bP4pZ> z#(|zJDX>)a^<^x#d%B}(s!#^q#_noZ3NlVWBCo9fmJwGD3`VQ1Ky8fw;om`8J|Zcd^n#_nw%`aRP6953v51PH(CXh?}GNx7m{n0 zzp@`GJ@Q+z;_^;UEZGLtC4i_z?y;zfOMKUz^&n?@k)v6#0sDn@TTNz~zA?I{r9f|{ zAa0g@OxA2U4LMOsPgb}YqF?uJ9@_YDgO}Opgy9pP3n9MO@~!c?Nr+bd)|VSgPC44R zR%#$thV6k{wx{GHhVS0jQ#tg!S>@`U12yZ~rU)d{T^u2=#I^c!S3IbZfokKX;333` z_bap)8=PO3bYtDYCI9i^X4bJAfvJLKqI+=-Fc|og0si}%%H73}p|QIkrJ3F=IqOl; zzH9Ez()wTh_In+L1=_C8w6y1)K`S^12gKJ04brEdIem?PRHy=UY%z4>wP z?a&PP8=HMM(_9V{*Khd~P*>MI)Q|e~Rm%x#JPjP}HPzGK>~_+v(iJ8D+t>K-FIaVB zQJuU$QQwyoJ9P?kzw@O%=z;5!=)5(0y|1pjjg-2ROzvNIx>|Sn-fY|QFJ(<({b>-7 znLOC&v9lV+PL~MzrtfBY3bkEn$4-c`acu58M&6tL5Fc&sv=_f0) zkNg5OqUT2*2c(?}x)U&JVnsZ(#VmBin>H?*T6Pgrsj5_@TWg9^}oh zm|45(gS*vU#B|-!ucscT;RjO7^7K8(VRx;&|Bq|F4qkhsb_0UIyU*UR$yU$OEFyg% zq$P!wnSW>KG=6Pp|Cx;jl9$`6z=rwN%I9UuL))%z_-as=mNh-)UNsze|3P)A0ec9Q zhqUfu6`$;O6$PEp6K%X5(|u9U6KYcsLUCtQSOyGTV}~|;`;17idWsh&|F6sI|9>wN z-d}{~SvbE68@t0gtNW@e-?0}(jCV;>qpR-Sf@PvBLK>byNoI}6*59i}dxByMQeOtN zziP62QT<60Wb-EBTPojT(ADjp!(|ucY4?NIg@0rXxFqK4+gkPL&42s#sBZn2@TG0H zMUMxp;gxK26O)(PZC?NTn*Z;M!meLzaVp~Rms;oGo#vL!cYZg|5DwePYTYL5Qi5XwCxIjmLDeP!g&oPg>_t9 z+^AOAx&Px*t8TrYxZo8*9N2buw{PmZeG{)H9(M&@>e>B!#lVHqbvgG-uDec^<@j_z zL)JP?2Bt;T`CGqCi?gYM@y}%z_MEL5S+zwS{G?(tmkN$Nn&X(~yE|s+(n-vStDCKT zeK4PB_L%ZOj}i7se@nRyY)fFbO~u|W+mbFw&^U4Q$(|KvivQ~hu^Vpof3CRlXyRe$ zfMLJs6MX2#QOWA?FCIOj`o#PLIbZhv8faGUnlbjZG|*>5)i&5}qKGZa5w?BG?JIQa zEi9O6`Q&BlXuEvFx!v!2ji>9H-tFqpyChsB!_-!!eR>d6e&6v=$8BEURtHqrkX0{n zdmW3LFy%)wc!4y@f9&i3{fvM7q)Wuo+>^QSz`HW zcsPC0vwe%c8Xxzu`g;TRnEI8yo^h#rRZ7uJ@9*#S1#i*2R`w8WX_0Ab_uWF0!ws#)o;dMfCtByylwTfDwrDO2Qxc?2=cd*f65}H6W4m9b(q_>< z51uPC?%e@BxBtcT&wJH>-RSw6=a}_5YU+7HnL$`juDvZS^#3F5yW`>h+HJKUi5jAf zE;`X-^xk_ALDXQB7`;UA(G8+!4AG)Sjo#~Elt^?!j9#Pnaz}pWp8KBnb3gC-n-6>M z@7~W|&wAE+HsjpW&4SOFcXIi3+{|qY)NHg(UtUJAwOuNRk~vO{1^#b`Br@n+r7>oT zR4C)(_0}}eMPl?^+0z3hU@}OFR-z6(!xC*GwlkA{@hcWkqWwX#hSjjCQtR@UH-$VMZoX*kKrc18$Q=hFClu8beh7d*FLr!Q6866AUS6qu~OH={QljK zMews)&xFrUMCHu4zSUGC#29>aj(b=YR;JiJkegC+uvBi)=C{z~D%RfTPTn|f?GKF8 z-=hx%G}3^HwhnX`Rceap8i$SlwERa*p=kb|h$!MA`NIkhM?D{%{J2HZ`r=o0Gp6%j zkgKAH$&j?Lz2{w_8tSayJW{>Npb2$qPFUgLuLF?(!G_XPj&tV3K_ z)2zZ0t-1Ur+UMKc$IlM6O@7u5)6T)j0upQ39m+(S=Dq!_a8xvCU?IacZ+wh!jx_rv z=hy=vh3VCKn)$-JoOCmefzzxzGo%9bG+TRtxZd*Z>KyG5&#Oi12>(~j4h`Tl*OC7O zA<>yCw{att(QFeTz)wy#OaF4^s=;m1P)4`q~^O0wQRlijWbTeOiJXlD=U!*2CQdtX$ z`alz6D*26Brm*^wTMTuDLs~AC&BB5&rK1-Kekl6=G5?nIi0TPtnW7%878`hGg_ABN zrLOlC%ujg?WHdNiq-2#emr`z7)he~Yjr!6%IJoMcUK9^yiqs6H^W`0%ou#qseo1a? z^J|Swg``aAk|^6E(IR|Oh%FFX#G# zE29sys7``-iVqdfrq76f&wh^E#>7hLz29Y(tVBU80n2ehC>TBOHkwkH9ne%}+S&wO zXz|txdyj|8WES3F@vpNJBxg(^nU(~Xn4#3nbx0j1u@IqxGEp6uybU`-9V~y-fUt9< zsi3VkAUP^HQcaITYOp82td7a(1AhoUAJn*dt4iCHuQH9TqV1JGY9-`62;@A{#XF0W zD)Azzx!d}`Cx#k7Ifr0p|O#~b^sWC76%?QUGXeM&b>y%2n@k6qy7CVn8^j<3?rU5mr=X)5U&Pd60p_JyQ&%1SZl!Wt15P5uI#a5I~HO( z_~6vK*2ACl9)3l&>u4EioAveG&Z0zT+JDX1@%WrXQ#dEUrOxqJld5`a%5F0^YVM~_ zSmz}veEk_VS%#Y82R+r`nQGUgVWB^ZV!N#Z7*`A!2d>5~1zsA$YA&VYo!YsmOlJPe zbrE^|qe6CnXa&+TZTl&Sq#hzmz78?`ME6v~^r;x?H;Lu^=@nQ5SLO6hqS>F5iOI8j z&m_<>Xjo*Zij*W73Uzrm1hoP^o)?N}j&PE-ZRjbLNcJmwTu3R2UX&6tcImy2&9pW< zey1ymq3fBi0RV%P@M2I=^$HCmiB;=44xOJfb4$jFGpdtvioThDEqK16%JHh>c|*+o zL14n&M?IjO$a@r>W}jtO8-ERNgev~#mNwrSFZKYkOyQP49qRk`_c))DV#JCx)QO)? zTY?5YGJ}@7K7ht@6+pewPeBMW4dlG;R}l#6A3Kp@@Y!jJ7kna;VsFzq$$z434g~k) zm2f$d7+nlv!;l}HqPHSb=DIbjD(y<);iA2tV@*=2ndSyq>Q!g~o35s(f}r(J9|1b1 z!IjJg3q|&O$?nq(BFq&Hhq~g&gUhUm5}@8ej}=hT_L#~i7f`lC|6{M64_c=MrcNrC z;frlW_=Wd#TgBZE^4`dam;~XZ@|c~Q2n9-eN7;?!^^WREO`zFVV%Cl>e2Yfh!pJAR@LWRj^CLbL|R5M>?QgAWW8Ez z%7nAH6(2IthJ39niIm#%eV(LG=X$-PCbrdl8D~~kIDZd-9UxdQ3vGj{Jxc&!;iMZu zi7bxc9+nD%#I@;hJJzVYmYoUDa$Vp2Y9@k@mdk2%`FWC$Z=+?Jr<2~Xr}cY&pb#9{ zpG$N6AaFmsU%03TW2)e^MzsFNW1=VqWbdo*zt0JE$UU$eQ5?->FDHVt>Ub74D^H1Z z2~^7DB}Po7#coP6Qq8{q=|@dv;2Nl4RI*3M_;}iu^2z2{l{Oh2)yyZ>l=#DGs~lQw zqe1=EeYz6>RDA`dt0gtN(WM3xADh@QwdrNxKP*98nXm)b(11|lWDjf!#&&8opNk@O zj>K%FHfn#uvrdl!-ojJ;^9-&SX^Mk-)A)@XnWFXJ==A<1R$#9C`SjxMTe{)UxF<+) zF2vl$&kO!Lb8?D@;rDCs)1o-$0hiVNSXK>_c^1VOwa#-hY)vWz%*2<^q=LqjYTh&lw{U5iRJMr&~2phVr zU@x-!Yp+s^v18!z;!L0S8qMH|=+bK1b~WL}5Nxo`E|34D^-|ys;Lu6!{X_-#B(6yo z<=01iD+x#pm7!*^D~%JO;@sP)dnTpB>_)0t0cnqn38q=s6id{vf~+2c~XF&64^ zq8H{&Vq0TsufAlpoF@A8KH~{IB)cCgF_yvlTxgsBiWK74i+{s`=JiCsXCiFq|3(IC z4Cjwv=frD%Zf`8fCo-c?hC{0a8;!udIf`|cY*|0bSmPrfGwZ1zBITl@+IRYOBTU5w zKo=aVjA4X~1h3m@9M*Y6CpgQuCQw9KI`q{|P@upF>QPfuRD{p(&QJZTABH z9rBRWgG>Ti-oK((2xE5m$r<4InC2F|a*(tljA6!C*+~X%k=poHY?kxCL55Qb4CD)y zrRPiRy`9n7VaJN`9dC8CXmVe<^n9>jqA5PE9&LN4BwEW%cifWzYcM!TlPo4M!ZHJ1 zCwz&!l;Nr^q}UP)sAkgRIyM=|chql8q7R!4f1Uu3DRfuBVw#!*tD(n_?yHV@maY(%b!&{H~RjzdrnUAw1N&j z_36h$CHCv2;jWIx0^f>lwj|oXhLJIv0f)r&huRW8wLeplJkb70@nWQE1b&qYaW7;1 z*IC3BH$Z10WW_&G;$UBUzW>etl7sl-p`XLWlZ@t{;YS{YWrroDM9zVid6wj&iW{Pp zqBUhj;QARp2RZrR@v1Q``CU&{So=8Bc$7V}R{JUs^yP#>qdKiGP@b=UJwUe{g{n9| zhnTa$bTCL>#zlb@3&lMe<<3_K6snqa8^3;$oLbUS@6|Jv%%3qmQJoOFET%ZjDKBP9 zJsvOi*E!};n*1M3QDr@2N4yV>_e$bwf*b++&o3IKzl@vQ?F?(*=`ko2(NR#aDbaYm z^1eBlLPS619K1Z)Mj&|FjVHev=>r|-4IskENPf${Sbm$4%){TIgsB=(V9G!eYg#v< zR13A&?_kheox^G{4sFrFvC_%68)OVm>O`r2TCM$5NfY$PUYTLdU?&cp@#WPO0>u;# z+E=u`&hp)Bq|y)n7WiETCxuxpbv!`gYNuu*+-K4mCh6}ZvYM>>E&v7lDq9cw0HE%0 ze9*<=YVGL8eYpC6A>axN1IeJU7mY>UKA;(yqz4n$#P(n5wbx0dn`c=S=gsGyVZ+xu zL8V4ow1CFet2KzrkS9T&EJX#y()Ga*pUFRDl_(-Kg z#Ym;&wKkNI@-j>8y(4o>z2mPpH`q8hkNN2PQM%k9%o3WF7qY5;{kDFeWF-QQ)<=0b z^~=kweCl#&tEswtPj_ZMNHQLiFaiz%xyDshDKr=N@ZmK0W(j9#n)Nc5jz4rIe8+~a z9z3J7tD+IGe)nMgU%0qReWvd*F}np*Baw^G9F`TT5PXU?+Cz0O>g6Oro7Jty?+S-m z=Kj16c!7k5_on`gl%_Axq*>VwQat}eLsQ}?;T`2iis?ToXc!QXL8@(5L{2~ajf!AO zx6tSKn+#p8R6Yt+5Kyn=-G-F_-Ea@X)>A=BoloA#wvAq+)&CZZ`a zTKmI1{CI8W45Yx)TOoLOhnr3X{x93M@p_3=VgQ4uX-HVhY(ZPv?+7-aF^Bg-<#^&~ z)n?%(?2OW=SGyh67KJ@tOMf=f=|PXO<`x<|Os=14%dha;uLypz;8s7ROXGy`@?4^MbPtyqiI23g6`{_Tmc@HfEko7-48?F`qgGUWG8?&2VFs zRvej^+X$|+ZVZi(+pph(j~=Ihq!iI|&%;PGiv+R)Q4)elW_9|x=dH&-n#3Q5y+A}s z3kzI9nH96VkWo!s10w60x@nSc?MSSBmg@^Y%*=5aVXzOB9im*Kt!r8+z}{pvP+XYx z#?))+gDO~#NYalRp|7*#6FQx^8hur0r&JKOJhUJ~1v!D-@(Vto`7 zY1H^Lvlz#ZD$=E3RVK9yC5Y)}hLbWZQh0$-)}oo}Dy z5L+hEGzD5M=JQKkYiMs8h$FO-@v*L#RL1@bW4QVbFa^#-nG$>2btzGM$r1$-tez~`>9zv<=EEJxrb6f zIM7TXH2ov!3$@M&|dvSNv zaH*-*;cu%sOm+QJM_;|{I2Uudw&tr!w4n5W(%;35C}F8x)SYON z5H3>BKX@)1nf(;&Lgnpy@VDNg=-y}aZP~F73PjThi$_ddAKumr?^ryy@@8K9&`!Nu z5gk`Y@Nh8+c`YfZ3hn+={N3=>0gGN}x#elwcNT!W5cCoUT{An18wqWb`N%Ys@B!_EdobFRE7|Z`qm)cZ zC}xPnuHmT(mM}K`kA;)+_Y-$ow|~5II$Z|&M(#wyD6ROH!%?B6z3mz$1!_0h_Mw40 zF*8!fb4|E)J|G`ozJ`eHd2vGD8<9|>mxm@y{_$PB+L9+5VHkN_UMh7pGrA?1WbZuJ z*j0r{6Xwe9os!RVGA(*@D{=li)T2*1OF@`S9WR_x z+-8a7)G}V8&e&(Oz#~rI`cCkH6!w}!=n*)ECKpIy&SZI^$8^Vs(Hz-Po5Yf4P|$Gw z!rJ!EYuntA&IR)L@SQD*)&%y8$w!m7Dt|6fFIo_`iZ?Cev(pyzv;G$`G>W@XAsGutSdPB57ONL4g%?;mb zhVbx{hW`&0)(LXRxJ-gvIO?Z911Cua`6BH#kz-QCzrOLfeiB|06aesl@T7m4zJxD= zk%J+lCAA@BRn(tqE#(RZ`wUxwFB@ClGwxq*SENCm+8VD>hK6!DpFrW=M*M9NO6T0p zPSl@ZHSG-ERERnaTmIlC3$H#FSv5%N*Mv9q5tWSELCwlpc>o2&J}DDgDKIJ&&5fp} z0z&~I&;hb{mF{+lj>B$PVoB?EMQaPszU|{%ezl`F11+<3BB{jPXg@bq(B9+Q zWQFunr*rx_Bum)HeZa$#Lj}B0OYA&xD}G_?pvUaPL-^Q5M9=>C|MBINK_A#p%D&Fu zqNiK9yFHuA@E*cj$~i$LA>~rheM2PHXMC2K9>ND=e_D>V%3S+TwNQAb_Um?eb2%eq z@1xrD;!scUCT8e6Yp=v9b+Q07htQc7 zl@CR`i%vO*WdKlLbutoo87+lNR2Kqk>v|a1>)iGoP^ugr*cQqziYb(Ts3I>>)N`Zqfd4jk_CzxYu!ZuaV^KMLeG=;p=a{kbI=l+B4mxXu0t;BZe?!6j*sB%aN+fbBxV$>ZtcG*ltzC@ zmMxlt~Wl>4qd<^{42Y8p1D+Lxp_~#&;qR_lS)GtH%)7 zsL`MdJa$fV&H+y!u_Yt4%RoECIyt-Y!ED&Ej2P{X!Tm5E{%kf1L zv-A*TvFR>?OzfdY@C{QGO4&h_*QYmni$7t(sA{-oz7OE?csfS&UXUd@NMP%85$KJ`>BK}$18i*D2}Ngy?XjCs@~BYjmAW_K$}!8%3N_mnbXrU zbN-mmG=wysvZnUMAz>)#>or;`-avy(= zbiVDRTAm)eP3||>n&XQAa)pOnLsktemJ4sQVy36P(TM1Ga4_u9#)bqF?V;AndFxbg zLCPN)+X7QcR7#Zdhs3l(=D( z^dzDqT1p5rE@e>PUkwPQ#Ynuu^c;6F%L&BwXJonRzQF`sPmena9%uU#phF0631@_{ zJ=Aq3@A!b!fG4+iluVT_L#~-sOEHVc-k5E^IGTXbz6NPa$}Rd;VHS}u!a~Bdlt#{Y zvgLBGNT7V!2O@jI^^tOZ{a~ay{30Ae&U;M9Kzl$*NF3pU>z~K75+#?loGHA+YWaM& ziXs@M5Ojqx^%BBYK4)wxa@yGDx);kb?&fHYI6xo(5Z|zdi>%Jasu1m2`in5u9S;9nrJubRWyUnpMg4>q9dMC;*vP`3Dvl?dCv+jAD#Yw-Rb9Q}$9*5eq zby6CEGj#=dy?e9u#EWxErzSPT`GQPI)R{JN=qemPC;*4~u{#5$&#Uz+gg0u62+zlq zdeclG#lTg$JF9pCBX=0Fo>lmV>G9Qo;=t+*2 zcB$*Ps3*>1d2peq*k0qeZM0ajP0)4(`@`ioJ38bfnT?X~(~3Ja?*d2hGCSaxdpn{+ zYLPanbW4*%qQA6yyBY7Sdw0{IdpqBGVsWH@{dV&em#qe#b1v1q(Bs9tPKk6en9pFS zY@DfCJF_E}B779-tGXd7bZHPF^^Oj*`dX6TTW9D+e629k$X9Jsx=j(8T(}VR>TM49 zDmmYkpUk;KWcqP-XAmlf4YCL3V+tHJw8^}b7Uwl0L&nlkhV}#vnJ>?3QZnYV5A7^d z;Sm=a80RtUr~i61HbvU|f!?si%jK6M+Qt)PavIcls&Ukr z5ZMHw5wK0;GSo41j6QxQc}Av8I$LPA!^0!weK1q!w3YPph6KG|Xyid3&QQAKc3I7! zp1z4*JE^5N5W*8F1QD6UST|TdzgS_FG90j;#9Idm!>KIEA)F8e(-P^|NBlQ{#dAgG zCzRXQo7uN^%-3Ftgi%UHEz@sf55YvfL(+E}N>XngIuS*PThUlSj4m&yPy+Z99Pv#| z`{bX%8vq4G5n^zuTUae$3KT<3!Gl5FZ0N<%{by4e=%!^3e9uw|LewU0Z=$@Qr6`(! z9HoK1EMVaYZwL?w&9vv5vIui|0q0()1}xh{>_+7JZkxyiFf-}OKwmEIon<}&rYKx0 z7=HK9IY6gX@hV$#VLhr`>Gk)dZ4w1eADkK?K5y``zY+{zd!)_c7_h>i#f3z&b`rq0 z#&ikwKj92-tY}5k<=!S*`)*Yx(iG1oXaYATShpgXbDYGKQNj81qp+mRhssPM4aycf zMWY=rt$%7N)!ED8)iPw4b-&K_*;!3;unXmv4XmaS-P(M=V7B9m7aSdjBv!hjopHoF zK^Ftwv;QP`=(xm^&7hY<^eGVv*n@t+Q8@si`{KpO`*#vOFEH5S@be!K#)$jLHb`gf z6AhSO93prsdU{&V7L08CUA8hk z5yDew!JgTWRh>2f{yS`8`|zJ>guVQ%i}+o>Z@!&XspulK4?;i9BNroY{kdsfEpPR& zYj#R;rMaBBmz#z?GzHWdh8pUkg@67Ll>QO*&2~?qs)3-!l#_=ns#g#u{H>E~@{9B6 zZ&5^R4*R*Y3CnZ&NBJ$~y&F*o585TF+w8lG>=ds;f*c3aCfRRAi{mmS($R?Ufa0ui z{sSU&JoJa~DJ$ywAxVk7hUKkRQ``N+@PmhNQus5^X=lmG9RfJnGR1MM0(~>3E^k)Q zxHT7M&TylQ1YE%KS){W?CHSEw9>o6AW&3M=s(pFm7a-w4|6`6m-f01r+|lER0zKhd z5q%Ll;RO-G;&tlEd$C#2LsqVd?tBtc#p+mwe0RXXaMh?jVQe=gt6Yd1fpcpCggiHP zR74Wh+LJoZ_`OJ>@afo5HL6@-nVy^`CeG@2cePkCiqX{fXCz=|3PtJN5CmUOW9bjz z6FDZm5(lmEjvcXuX`XIG{`8)XQpW}D6v-uX@R-%+ygGRo!7pnF0G&LPTHUNiS_2NF zl}g%j^xFrR&PkL)Byxf87)Uzxs&Hl4QCR0jkQp%GHFm+8#I9puQ2T2{*M7BTpkAlerUqSIa-%S&;B zUEckclcWdon%^nBXWxETf8>qcIZRLK8YYa_Qfx`Dp^iNv?yOp5X|BmdOYME$0|`iE zWtO~AOn(~rJ*`eA@ar)h6E6W)Lq_%FX?O#Su;-u$Z#UiE$f>f7cPN*rb@GRGPZ!g2 zX652-Re+6qHyZYA{CRB9Yx%v4w}+u1wS=!#ZD)hZgz=28o_P*Q1_F1GC%QDu!!b>m zxn@1VSW<$Mq&BI-h~l2DtksSs$)8Hs+*d3Z#)}P}t`5tW1GV_UVV^a-P7)nnXmcrx zmA6MvD0*=cOlgpw-*34aCY5zXuaaJv-mz>ib^t+W}tN)AU>T^hf>=( zba{6i45-nXcJT&>r3qx}X0i@Zt%C^R;%5&=2qAB`qGF_`Je3{$Zl@1oJGh*)m?+Zh zPla!myk%D|4bBSdZr`A4)g1w$XrcObyO>kE&6AYVjy#-G)}>9>;^0~k;Lu^WZgZvZ z#aZbLdF^8CPcF{M=Y{vBw1atry_cw0g|s9->K?|9zcpQ{p!r}pAlhp9a_*4Wo@vf` zJK929$rNN^B}HAC2;mQbE#R@W>1_2gowEZ^lb@=c{w+50CK8!fB0i^fa%IcOD(*}7 zaTW0REj{*-9#VIBV77ygNBIz#rqj#F2>9I(#DS{t*QO8w7tY7 zYPb)RKGgkCoL<&>`7yd&*7>~i4tCmyUgl*3>L$F>a{cpss4 z+mnL0M0kMi%AFg+{Dw~>m0gBnWhmOgQQWya+Q-^~iPK_IX!qq^)UBQ18orBUStK1? zoNe!zwMXQ1W_TNMQFT4goVzQ>xS+OF0}FT-4Kh;*+CItpC_$;_kMt3vih3?qsAz6O z+z%&%KgaSsx*e%1T-LHA1T&P@=Bz))?icIhk9DFaSUhVxn*ixjq)BJ$@{Da?j*e^(sWSzY!8k7-N8btm1mj6Zu1 z*eMl;od3>;NT6HE=+wMAh=o+5 zi^>31gRt2|aaPd=O^YX-@II}BiMrXBJG{j}7!J2;9OaaDs@7NP+t7BTjfD5sIBl^- zQW~M?;P7quyL^-?uKFcWiX8<^lfINgWP}F_ioIISsB2$4T^}!gm6rDj99`fqvL03e9 z3S^e71~bo3Ct-~IM60A~G8|u^e>D2gJ7*oveYZY&PTUdc5|BKKe#D5vi2kPbLzyrQ`G}JcoSBT7lfkCtotCv1JXb^gU!!t?gTlo!ON!mx1 zoYDB`;m8wdqA;%aj0^mD@~BPv@CIS`Ys&cSY(e}?iL0Ff`$7GEzL$Be2d$+uV#c>VXHfyj%-($ny+{_rRW#)tQ@;LaGc%)oLtcT z?5aQf+l=jLr&fq*K(+RewaA<{ybm&%<@X#RIj&b(Xtn|MoDsSzCY(t#Pu5eqcVl#5 z$pjf{C5-yLL&PWY)kLB56I$h8hlusO2(<)C{sN&PV)1d`4dR7d947`p54E0rWc7V0 zC|%S#O5hx{&*f|FFWpoVAY7wfX_MNoKyLDi?u9p7KF@JXr)cPV+SgElCi)*U`A(^u zn7h2ctxr>;{ycOwZ&zu)(3xkyvWWW=V}X70@WyDFMf}xTANTnZeU%~hgTqfy_HCDJ zTC0;7m!a~9H=n-q>t5XozqXP8g=0yxccN`d)TWCB1~?^5ly;{Q|8#{MHN?=7dC*0< z#m!yIEOkq-XVJHrMSFd;OUwYgzjz#a9>5zg=Tg`N>%p!js!J<)IGZ;lfH~wBJ zaH9VofwnItMpO1#(|Wx}yQF`4-C7)_;_n-GQ5X{P2m8z!1j`xxT)VkuLmO@ zoJ(HF%)?bv+V0)!N=WKH~vXD_$}{tDFPCq7Z#y`Jx}x-@0eTB zT%Y*2;)OKPDCe@l-J-?X`?AY7I7CCE&CgR=ycu!rtluylb+0v~pA2gmN>YFvC+(N7 zFF@1OB=sBiEE)t|%~IC>X@|xebkWOtrF=D#Lis0Mk-;?eXKA_D?qIH}>VSs0A~xM_ zYfmui1NNi14LRoFVq9|CHNgrbnUPlyV$3hMzM13jg06&{wns0$Zr1&Dq> zcmyX|$F?+K`CQ3x{hbd!d2_aCHsI2?K#d^!NgY957&|d4yd3L_s?mDJ2P*H--R?)E zoLiTTHg-J;i?NIiyjV?}I*M4PesYB)buMGFoV83B%r=U#1c4mI)b3}nS^g8((B40^ zVSk>Q9Koi8axl!Wo26J@Z;HoyAQM@`-QQKrgb&Wp!glOF^24Ju{9o z+o_q&W2u$_{JR6cq4{RkbOhp&Pkw9*CjZc$N17Hkg3kjrF0F4g8>1h ztFPfDx~z^gG!EMz z6MTy&q>s87dC`e}OFphb+>j%;QKHVdudQph!#ei!b2EqjP+t*CVs~$@psWL&Q{zGk ztpxt(^eIGuz&>{HxWHrwwi&Vr|5VNAnj+p-UDjxa2bkZp)D+3XUiE^Op+MtAW0yEd z^iq{3z}sxX1{GMiu!LzvPKCcfyZFkM&qwdBN4I0hBHy(Id>6^D61$BZ^ALAccOBYp z$Tx-8j%b5Fc@9hdE<8$d`{3|CY=EEc`Zo^3W6DIIb!A7B>xv2`nqFh-@CZ$F>=bm2 zTJ1_zjJe|m(rz?TxJQQfhdFnz9YiII>d-p$A1Qx$X`NRV^HB1K&`lj7hUjT^Qdae0 z;#WRU-ucFuHd&!6RD4p!6>n4dV2lZ61tV5EC{}XKIQ2}RsW_a|AjOJ1%*WDEHAyv| z0w+Lz43y~`UleCra>U1Ve3bB5(d(0fzs!0CO#Irh;$KL>@ZiNnaan^1_UV6dgjA#g z4WLt;P#cNQ56L1=|LT5dr}v|t)pQ=Dun`ctC9L6rDY@)B%EYaNfRS7K%+CqKeyj)c zdEfx(YEqeBjk<8!0*h8~JR zFbY_KuFs5%fQ?c6uUhEb!s|ksoqq`PRvPra2R`fzJDg|!eUA*kSMh}>@?zVOSO}z= zXLbvR@wYwc4e3~yX*J{#>r)2D8b*FtIY=1Xu*DIxAc@D<-cje8e1s}?ibbKp8FTsE zp<-|b9z*)i8LO~Sa+=X;+w1aWL3me0TvaV(6WF{XXBwc<`nO_WfYoDJQ$GPh^d8zY}(g#?ss8ghkMk z9($#N&h#;t=si%%%986gz!QKN_#0i~*W2kD!@ugzueg;gbW&jhO^bM`loas_ zj`i5pKmJ8*c&|JRuE#^~->UFin-dC$J&x>yz}LHUIhg@qL8OVGDc3W+^ZNhJU-q<`(go^QmM&1Pb(P)~2@N)JXD z;I_>gUgWTng=prs_>pF#ATV$?A8{2G_t#m%%Yrcku>g#!C-8;N{Hu2Izorvxs)p7I zqH&hHuWGrYOwYYW)?7Uf*3VznC7_;cw#;SC7SSU{MoC!TbG~QDBRF-{^LK-PIxR`_uW2)+ z9flZ;*MOWq@hNh0-j-j+lg)YD59EF$p+3S!6q=NCt@BdX-lql$e3Q2*gl!a###5Wd zW42e(u)yE*D*?50{*L@%++S<4T7iRf)F}8%1}C%Bn^(^e|>=RUEaLp z@D~_9Amwbwe+j78Ri!>0FO6$EpI71guUgALQeg9V#tx?ke&^kE0!Z@gf7(*i2bE8dCtiqwvXOxjJZ zo6`*^96p&5a?7h8Xrhi6_t;VsAn-MdkmNxIrl^F}Rc^V_VfQ62l=Wk+~c-Hg&6cB~-S?G(-By`!SYCU4* zxazM{t%FPR^wfq|O` z6%`$#>(}ZFn*><^4~5`Tw*6`5SpU_UON_&@4S$ z;v18b?XDjT7ge@&FH7Uj$!t`=US%}{R}oin1CDV$y-NpS*GU)pvuQ<6$!>wJS)wzE zYfaXaa~zE_o5>vMgTtg|z@3dUQFX)1`G@FK6JqWJGy${wx-G^^rhF+VUmD)lCn(tU z?$gcdt7_)qo0rgPU6DC46i4-MEA~HzI!%K6;zH@5JOi_UW~axn#KawGHGoj$V^jNd zke`-4nC~EZfheaGJJax&jaX@deEI3L8C4*D(iq$JRm$U&XrBWHTE_9P3@NqL@u!dx zBXsLT-3lSBai$rwQ`o0Of%1tj*H(G_#fR0y2OIVBb@^LKmk`Z>Eg{i`NM#8MpcED7-+3vH*qv`IaZ^c!_@b@n3*!)+pOE? zHN(neCF-`CuSIL;t`g^7!F2z(O~6P`Kyv%URByiIIA0mi&hDsN46bQy(C9^YtQ1cv z0+b!HPX?fi}DKzO&$4n%7;{siHx=6faD^~Xl zBEVSm_`lEo{pBbf82k3JkMESC!elhu`2Kd3mqQD1Jx90cDbGt<5f>di-^HsJp`8OK zEep*R61HN^wVYG~(%N?6+;awQ?u|!SX*BYD9`4azTu*apen2B%#-Y7Bt=5$&UcgN# z%&Ok8jfvy`#~i&8x-+3PxFuEW$7JLnSYQh58Adg4xY3r1%xePwwT_cup<`Fb$?c{E zk8QEwiZ5s|RWe}+5JrkQ&8G^L#}lL2ftb2%DKTMLFD)n~Q=EYZ_^3|@=rG-BH6N`) zTq^0M*d*A7MeRh__bUkh@3wNn#~`xurv7;3q(L|zO`M*N8>?tu4~s}*(cq}D8GQ~F za(WI0I&jR@MU_xQ(RtQb4|9ZuhUU%29lH+Pi{OLM$ni~te+$?0V-xE7d=4qK${{9U{x z=P7PG5NRY9>E@aH_Ccyf(U#_0M5>sKiDRt6miWcI$V`s@j}6uRqUiU>>h8P(8|wC(8_VajH>l zmY2EtXTQ^$Z0`Hsnx>}yCliN*oE7T4VJ*!h*yy;M#R7vZY60!)u=*l(XrO`j#p3Os z>eaZXF7H>#sQB$QGu%65Kub81CSQic@{hH$sN|sBpk5Q9RE<$_18lQ^63eMmA?pY_ z=doJQY)Cg^C-~>`^`}=rr5z1UQw~n28z0IyH5{`uZG(o3u`?i44~OIrX@2=&pWT$| z+eW3q%d3DVa@`ba3T17Lj|V%`?%rm2_Ky|t;O>Kj%=GJ8+RDHtx3UiYKRT6?2V$@X z=XIa6ZPT{pmHGZYtury7j>B2E|gcFjOJVlL*_CG~YZte5-Z?t#*3+tnWD*@CZ= zH_8G1YV|%xkqGM;FV;oWPMI1(M7N5%1cI^np+|ofZ+905AM?2PJ!Q>wmKC}8hA^iY z>qI%>I*cHUoLXzeQO%q{znVNIZjyC1*<;9gp8xTgY95TG6yP|}_=RdDZEVSHRHr^H zjB3_kZozZsX5 zb?^!E+-D~18qKP_l1EjjW-dl24D~Yy)VFhre(}81QL=l~Fr|Fm#=Kv(?a>A9?=3kX zmntoFcVY8Je${5>ZVUH&Gz<-M0VR+5mU%Droc(6^OQw|G{7au*A?!8EGNh~GvWXId z-aHCUPZ^hT)6DSfi2_}Y6{Z$HCg2nZ5#EFHJM=heKC1RTyzWMfcSGVtaQP5orUWO$ zl9fZk)+#e~m$m#2#~BpWwnHC{Ej`}{PHPZ$`3}xs@Xd+g9?@5_Dh1fCmGQ6s&O`j} z!w1>w4$%^3yjcItzxi1K)aPRJI@^Iyu0;xYcG4T$U-T#DR#S8%f!{6wd_eYCD zeKe|n2)?--5p;E$Cp;U#-HE|utx~>+J#a&p4;^SJdFt=ocnRn zeyaTIC^inYvvlyr8g(!ERdD(XOqDj?t zL(r*$a!8DLnqTTku!qF$q+3)7W6%OT)x`>h4|7cGN|GcTER{0EJ(Fjw)HnjcYzSbr z-uI=@1Ph)!uaa`_3C`C=rA0i`HFi>>wYT>+_b}<8U@k!JE3tA>9Z7vFL`d5%iSi8F zf-P|R-OFFwx+?#NudfVi`hVL-M8O|Yq5={l6hvZ##Arc4LQqg?hD<=D1f*dIsMOf# z(WsP2cbCA3!RSuut`Vc3FaGX-9ryo!UU}#X_xXO}%JV$0X2*9VlMhMKyZHNjw`5Le z&n-qOUmGpQOYqtLOrRT;;Omk(tQNXw{@l*p#?oyalNZ$>k{6ZPlKdQbwnV2Ecyh$G z5t61UA)Mp@J%;H;W^yGOEHHT}F(5|9x=y{%bvm}-H67B6m(6e^o8Y1@xSif9Cd&+) z#jItaKa9KH>(Nl56UDcxgZ{=Rc>P+h0Wq8GY`IHx30TH>Q0m}4gJDT_hs;K{klCP* z86M_>zH#?>jkb#)k2_4<=@_bgR+{Uom-{zZz=N6i4(SDVdwze+E>HL=+pH`1pUS7+ z_t4pn2c5nk7-B*E^66XHUmo9wAnYCbIYx}R)ot^9#LXTT4!&}h)h zEJPHKPV{nL1{wgXmh%E+niBxh#4US%*u_J0hIFY;F$B_-y(@zNY0(h+c3oZ8=Hi^- zJ|9`Kr$KJ{-#Q9e0bzxA|0Apb<}f(T5Bq_9;R$wX@~@XmMuQsA5+y0{*ZvxJCEXuq zp4`VqM?U>7CAwSHb}x&?V;*>TvTHV7S>WLzkqRr$)368$wbq6MI2g5-3o;Ntpv9jlwU}f} zZs}ck4<(ZiB=k&0=~EX_RMILyt=W~ieCHZ~4yrSheLcsv3D7e60cMaTpuktON)+1_ zwOKxkJgPtH*VcT=ocs_3@YKx)e!g_tCrg%wFG@~jQpFTEWYe<1W0%bYiS0y*y|zml zr_)8|2cRc;g}*b8+jm*ZsOlCpQ}iaBC8dX}cjk3*9ttD7JAG!W?dbOI>GZe)+Y)Oaoxk7>GL3$YVme2!p2dZ2>z0xbs>zvkC1p}qbGcFmAvAwWH5Z#>~cgEnv*sx@zNpn6ATE8dre5NgInHu-dz5DZuDkr9xikmd^w^U>Gdc1irZKv~ltHBJ7aT`@;^CZi@rk ze+e5cuTqGOKeK2neA6T{WT*{LP0B}g_7?%oRQqq502l7DjlW)@S~M^Brstw0Pr(!D zM&)YmPB8T3`^UyeZtZq|ncZ&^R?&1s9lkBe&a5}tco@JvbVs$O%|RPlP9BHeMO9^V zZ1rvpI*Ghy1VAig!0|JfM-&hv(@3ymav7HMRB%o?-plhgGWJ+6aYr~Xy{kr1%(`&4 z=YN=yJ{Z@Yy>Yo>+LwG~h`G9HhX4mlkd5Es*t*R|4eoC;Sh+-w(;9!^^geQ_@Y(G$ zZrPRQ6d;$JTF4>{&$~B&^6&g~xu83&y|yh&>7@f zSjj_>yqZ5b{0s5em-fLJJsC?(La(gXtL5Od7o{YST9MIBRIO%`aGkaBp(=09j`jFl zN~bH^%U`606MtV&0~!<0dRO1rbi}nMGy!5565ck9y4I7|0U{VSf&iyafcf=?a$@OE zOlo`rXC}9KWDrm3JwpA*IrzcbY%_o)?^Hi%CWXZ)Pw;vZXfNAI9b_3S)0He+chpCB z)Owf5dgQHt?W2zo7UNAqj!g|Z$4{UljL|ZJlfKzQuH;%_dI5C1pg?=nAlJ$4B^(e0`4P?18S)ra+HPw(*`Z)gGd!G(=f zCUKpfVGHlNvk3&0M=;Ur*0I}7jf|^4!j6F>uND&=H4ayF>hx7?SY$4g)XU*#tq4wY z^=~kk`A~@1q^^p6fW6G;H(zer*X`xltq)(bLe$59tbdlBTq9CSu{|5{t| zC&dn5+9@vgXj%7A^+YshuZOH+G0O0gn#5?*$1^sbXJLiY-wA9uT@;fLe88(LDklu5 z>!9LKhKikMOeQ#GUxw>;$WKu}K8h=}sqtpAmCVNh75MxzHX^o8t!tqz2pU%0?lDKG zWoSeHquaucM`y>Id3WzPUo?$)E_GPHHP0=~CVqTyA>X`H=6zfiC3kiK-i2+Yjb6-W z&7y;_;E}3KNimhMdtB;8=;ErEkPO6r^2d~gy zn+Y}3XUzs`Rd%;)-@-&CX77F~We^k8@XfZ!CV5Q;Ap~lAe&^?FaBm9@LzK}op3cgi z!J7S?A_5!dhyt8j9jyW2FLZ!mDm3Uehk!8&Yd&OgnDEPImSyIS5YtY4-aW!^)xo)i zE0iq^vyN-SK>zHjH&AwUt`nag_uTDKUKKpQ0E#DNFl8}KCBQt}8a~nextT1NTva{+ zs*|p&TAyApdZw{-cmL*)(dKp+?~!6O6s}d6xK$D&{e53DO~dd*MTm8<(Sl}X3Kb;x z!!B1#m*{A+07Ju-MX$769-AhYjR4=QM^3&Dw%LpVLL;(%iY@mbw#cW_HeWfAJB4)j zD>T-_+5z;ugSBV;G)4RXiFb21JRH!Du~r+u<3U(g`xE^G%|_x&=AHruezA8vow0s& zMF{woALxa2Q65hA{NxB0BULVMf~Us#J)nBuLFseTqC5E6!NexKESI|#K|KRM9-GP) zj-^LGp+4(lK|&g^@;Dw`-0^cgBa#Jw{H(Qv|=aHhx}bp1iZ_mREJGY<3oo z#TL`z`1{Te&S}&lv-u({x=^4hLuz57*-{*0EoVHp<+gb|l?+@{uh!OSIUXWu9-^6B z)Sc0SvSo2-=4w|v$Dea+-)4G#8@@|!hWXagoLCDsFRaryK3SoYlx-jJ8wORG8T?5D zCZ$Lw@ks~$_9QS041MT$UhUDl*Xx^f#;)IP{4Pc!w=ch8ni~Vy6g&;rX>j4}2rk{| zOTP{|K!;E6g|KB59FGpwzJk^lr3;cUgLfEG@?W%80W{B*M#M^~;B~+%Cv0CM*}Y&A ztaKrCqOJUH0umNK?t+S5g8_p2DA<@#w08OUN?QQv4B-^eMhNms0}&KH6{TJ~zVx~^ zoGaT7XT5bn+LP2HVpeN=q$RJb|2KV@w5_wEo}2**F(%udztkj(B?cHn)%cVmvKG!3 z9uhHk+#}=Z_q99WUsMDl57~XuGM>wUd@Z7~CRn!)`!)1KNxZC?0Y^TRohYx(PjjBb zAK%IRd8ogUCi&w$W8&_Jziv=43uC#q)^b}GLK?^qWR_ahG#MWGf92xrEq-3t(`Rw` zB-v{&>+HF|N$`&l{kH(KT=C=^jmYC?z?jqrj8T?yr7MV)H(9tJEH$3_QAT~>u~r>X zRZH23wc=(@kLFkLBPh>(o1xhq$yLU9_#YN?R3%rJB{taSg#D!RNYYvy`JNdl6^FApz3|H^#+=~+PQN- z!qjN1O_=h&qh{UxXpKOIXJZn{dk2)MapGd^3#CKo=t9v+s{>8`B8{4_>any|gEDwI z22U@ySolTi%XZmpPg)F}>Cej_L3!O*I$Dn5FXHNa_29pS)6i^0haJ`yWDha)2ntZThpI%Uir!qZQi%j%tXTRSn@b}jE&Rlb@nHUH*9kDa?d zm&#hy_UbykoiANNf{;2$vD#mAp3@1lir2e{n7pkM$eA{osuEC4MJHSL?n0neJHA(i z;%`dsRHw4>pYb~FNY>#cOOm9zNd9!kd5LG(6<2~#)-oqqEMLnZvuGPL6pO)tVku7{ z+dW`vo~%%mMyYs&ofXsxau3Y*s!!9YGZM~GoObrI`Mutut;Fr^2@wRsIjFb-HvG-P zFE)eYfwJ?sFY4~*$KBM<#LEfQpvd^Sl9O9iu?yw>&j+Jz(l``_D49df0SJKr8@0*w zPk(6&eGzg$A0EbE2uc=W25LNqYR9CxB)&s<6*c;-1@(M~8Z#XO*y*`p02EI8n8lpo z?&_tGNK)x2OXZ?QH`W)jfQD$ju}^&}cbc8P)O8jQrC6tN2B*NVw5elMj7<%1>l^sT z@UeH1OtJ z{Q>QikDZm9_S7)8oVW%WUI^K?j& zMXVRj+TMJy5Q?aKn{0o>Cc+}S38Bk*&7{#a_#X7(WjcpM!CP|>!bkGsC$*3yckEf; zc(+Ul(IOQ9P2<~2`AOEo0{%vg1Sbl6UTG-62qLK%WiFCABgO>BFLY7~+Dt>Tr^}kF z1)UYx8*+8WRdohkq(E@DZS;E&z|KFXp{9Zio{3$X!}$#&4c{#Y3!kf=7!D04t%(R5 z*qEptuVnQa3l0NJ2KxDrYI5dMM|s%s*Q54 zRIj|?jGE56&>>YX>5^%K9?LWTx~aah#n$PS!P{2QhD8F}S9#)df2<2DNsM6A*QiJQ ztFTD`o3iHcb&Dt|+XdrgbMO*3?pZgOv? zI~woHoRHBb%kAG_S$KZMYe8fcU#gJom9W!5+l0IzFqDvj7Q< zC^bNWWesPWW!gP1x z81qH&7I=GvzwTsbgZF*3v=1TO>*(=0{eghv?eFn2a_Pd+rU}ktHf1k+Pii*3>=NJ0 z$v%!w2E>${Drf=5fw>^@tl~$sFaj%k*rqw?_+>VnPP4lEH-NSkPXd;7RT5dXnpam_ zd*U;PiH0S@5@1nirGzTPAtXs}GBi*GV2lnR>C|`+{|2V9*DH`QQgO4#U6MDv?;ibj zp^s0r{Hb(#s1_z#YMgU_u0*laK$9g*I+I|sLtuZW;N0|`vc}cCednd>F@bfMeP=yV z!n-Ha*#2dn%(Li_m79`dA0+Q`^jiO@)*9)#cFk>_#Cf#MP%{Pc#aaF9kD{d!qRVXH z9$ff$G-@{}c}(7)nehzK)e)1LUoK2@ZU5EWqob+X@pNoUEc(bY;RT_Lr=t_T&jJUvG0-gtjCmX-Vz z{w`H^Fxzb_qn(szQUpQ2@usqF`=e;KuT?NLKS$Gr-QpAtN_G$PSnqugY_)b5cuX`m zD>@5wX682A0FC4WOWhGJM}do?4fO|Wb{~)AyDPp9*?g*bl5Q}@D)y0#?XRL)EyH4lhAWoKa8bPVliiPpMRm;|WPPNmtk)m3YS*p(Z%5C!UBq3{&w1xi{%0NEX z(epx|Iwq7XpzmhhHO;m!OV@bKX`Gx4rC7;7^r4^r`1ylZ=EZhkX65U?LHgkzUWX={ zOoze2Y2e}dte-$&-d*(D|DjF3a=>Ti@ANB0A5?DzJLm}YjJ@1=qePLVZ9|cn%U66d zw&K3*-kf679P#vODuZSzfcdV-U0y7_$S=Q!4_wz}t8jCjeMCMJ=P&lbGY+e8&+KaP z^>BtJ)60)K6}XDBV%8hJqWwk91q3|;^;CwZ8|!2JC0GmtvDv&cE0+e&Zz-AN$+1S0 zGmPG}>Z`lGY9R*CE|fLb&uzwC0FmK~1M zN1{aovC{^m*ix}qO`~IZkvW1z@g)r-p?n4Ee|_3}MkVh)Rypw5=51poJ^kA!&x|;n zuY1ol6v^Vo8qB()9tCVZ*q+t4dKDRhP0Cz_I~v=C>|@jSB-i@#{b(?g7PB)|*4un*|6`W{&fkn?U zcqcNZGNmw$B|w?Zn`Q}fC$kB=Z(pTm9idQwn*vt2}4WfFo$~~8-I{POV<=w60M`Y{0#C0T%X4Je54p@ z(_{4PPPCl!5>0c1zo$kKpA!L_6zML*$l8nwIawR7eJCLC{%y8`m|~Hjg2e@p7p(MA zlT3CmQ!|Ruw)`8Vz`+Zh*!fPms7vqQ`R_3P1oK&+;74G;#q?)g*3_ngCM>8q(z4Q+ z*}&I~99yLvti<2vs{?2=BA3VAVKEJEJ$_r0uwwx;{f?-BJV0#f4A*4ANuLaH%*E@S zyLK%mS~iwmKy2d41kA+&#k`dmqTUMxtH+r0Cqa@~N(?BaMt6wt$to^j);zd8_`!n`w~DlzI;%@ z_tg&L2NIefW6KZ#h085Za4rr6=1ikUz z)q4}M*Ayzd7ZjMhJ9qD0vQRZ&xR*rS@4C?Hr_Z?@SeG4sYM7ETAimP-A&i;Rk<}89 z86Kf+emW3PyA`0I9ErnOd6u^Q-ZqVO^73)zk=EqMr;o+<-X*_?A0@jGTJ{MH`gpZq z%{%W>-pa%7b;W08(qBV9TjlA(4l95!e@RwMGr7V_70w9D*4e~WzRcQr`lO7cLPp>;SrHXDWJANa-{2AbCLt7$(htC$|a=ov$7{P+ZE2vyiqA=^nY>4 zqyT>(Ul?e8YdaxGA?S&w@!8yVSNK>2N~=Usb?lv==k4YWchgoXgFQ8PA@esoj@tSB ztV{{tI_K=zt^%`^heLbqMJXvG+AWj^g)|=_@V-(#Tx-TTg2=CbyZx=7 zktr~qb<)||f@EKk#J%IYyY{|gq<^ninl$MjE&J+DGK9z(eOA)O=C$~3MCSfuNju?j zTe$3_kFe)pE6ixxHq%%WecpubI?B34E@`nrg!KP?hU1rvo{@ubH`hCM9l6SleNYk_t*8Y?W z0rYbtx~3$6{va3XVIQ(IB|~FxDNylW`hyC3-|2fTWi!zlrGIy#{tYhi9{?HvninEh zZAh!5!t44(v|N2V_Wh4@S&vQTH_J{*hl#k?l@{&}SIt8&hmi@$-F+gEr}zCySe8kk zp&Eai&^?2DQRmOv?!6r0dD&*BmgN++rVr+e=FNTVp>xkPEsg%MgNn~xxsPOb*#*gj z{o35p9ry8)2Qp=v-dmnFzC`d*%1NR)@R zZNxZP1$WwvNO^XU<7}ULfWq2h-}1uif*!D=FzK0LlI8?2Zq_MkUu&^;)?o}maF%Cc zn!D0nDE>*tx6TQ{tdJaEZ(e1Cz`89(P`zKvvgOR8pf4aqTCw5^a2AP+g|co~8Tepk z{E&?YM8^`Z-_1sFn*@l8K60$oWPp6c|M`a@8L_*?XNZO)YAf1sD`KgmDlYjU-Ge?U z)7S#902i56OBz?L#V`4#dHA>@k=S)9+qU20M*;W>O*NUtonc5hm#I|Q9?LB1s|&Js zp~O7HyvarM;o+kj{7n(P;JwmsJY34C7fv{xqQRZ;G54eS7+3za!M?J(O7bRWecRgI zk`UHKN4Ry;)JJqd(~FiR`Tx&i|NfA2da`=iUpl|6a2(De{1qy$>P=_6+hB<1K|#f) z_~_2Bmcv+YK}PuPV~@4y;ogN>#~FX58?V`QQOuJPKBtieS)7um2MwW0)8JlcA}YG= zDGU0mNl{WQK1%G-l#XQ?%Bjgf86*u$-QA{VMuVtPSSA8{>3~v6@=~?)7&BJz=icd?l+ z-exH`T|i`pqGSYb!f$qLFyli_6;OPIuD%A8gYf=G858=GxP8Fb=-ab$L%;RnL4!rX zit!fAcy^m_C%z}nC2f;@>fLpTR79R-+=;c4CvB^ushr$+B`U`-VSTCQt3%lCrD6D- zvJ~0|XIV4!+8gw{1q9uBoni;lhb~nR(LvvR8B+?TlswGVDPtQ(T=w#8_pr+u8nYyM z%ysc)vLr`GN4*&`dzsix%nTAZkm&?!@%Phm?$bV`IBw2_%NHM4K1_B2kJT_JwXPVp zVlTQDqSjI#mDvyyEwQ_x z+r#lbIlxgc4{VJr1Hldg1xZ&u=PPqk=2-$}*(o1&DPEuP+}&2NYO*m)d|0|+hAIZWdQ0gM>)EYQ#`%aKr>n$tpXAyMeyKz!a0M1LzK#P_&X5BV znGOlCP8)Y?@8cf!xkA*?Z$U?PL`6Qw+)g!NcthNidhA_FMa33JZO0-ULS>&s>M`&| zT1|Ln>{=p`@)Y%{c`)Bz616P9X@#o1UZdMg{LZ*&^lTxjW+ZNljZXB)HjBvBy2`Lf zR&bd5h@~o-Vw(e4Yc4MdrlqA1=ze>eO?())`PZ|r=BIJpAF+U9NMNLGX5_X7D62ovH@8mjjJ|-WAyoNmSC#~)eDtV3rR{|_wyK{!iQ)Pq$i^r9T}ud^glX&4ky!#OiyF@ZBU>UNRQ&!ear zdJ1BzZC5eSj0cJ`Ep#bnuLB-E6c~i@93!%3=ywO;kX(!iqt2Rhl%cT5;_FdA_3ID410GF*YHvQhGk z_X2bA(7i}RG{cnJqibW`T8@>l+9OLRoxY3a>WDy#mOlLia%L}7+jGos=z=LCa_V~I z;W8{mv0C&fJKjEa3O=mx&)fHZ?Ou5dSxoRJtCIT9(FvUHsLlfSwV3e5$D~6l8V*qv zfsXL5bweB<+AV>1wigo<^E1Xp1Z^-{;8yF9vkUARz0MHNfTyLB=UAhPl)34YK;@2j zgv;`jRil|APe5miGm>@o=Igc`E<_Xe zLbmu|J(8$dY3J)U3_2@WwYb-y7B{B9AGR8M_uyc3xrC%-Uu)}=eY5eNo-hms)7zom zcPZ>gW-z&&%g@mZ+#+aVtC{1;o)(Inb|0^eq&=p1CY&DmvmlxasjO1tOhz6 zy+2=O_44FZhkx<+&tvVMc?ISoAuvxLiiR20lx1dSK7>GG(=#%J^+LRLbaeC!OchyB zDAeK<^U0Q;DnWXdJsNV@8!*K@`cr_)%9Ov=-a%7c{oyz(4)|F|8BhN&Uw|(6Yp$dz zyP0zT|Mtq^2(o(RUtV#jy-ZtuYeTXG&R_IX^JH+O%T#s7`Ljmj1@n&2pw&WeCtNQT zD9>O5ldzjO=GM)IP%|po6yK?owWH_^u#=2z^AuKJsip08XB)mAe#!)s#UM*UqM4ZD z#Y_-t@&=8(^M-?h7O}|{VGh!W#E5Ew&goVGQs&n%o$H8(!9usdMHG^IlLP>nM#vBv zsM1}kXPK9&&Zen)Gqp2rJT`s_h`YyJ48Yt4TD0sy>rCxh?=c_~gcu1ZM%;QM~=J8}e0cD7ey33)%)V)(@ z`(=H=r01k0w}n{6Iw|(UvB~|?4+AfC(g4{%S#P%wGfjaXrt5unFNWP(zJLGT*xK9M zyK=pBtoNcf{eiIcdl$e9W`Mnx)ne<-Cp+WCGBn{k5tc1TX2_5QpwRkZYr5g&xXlny zMR%(F{e`jjLNjo;(+)1|wQdECM}w08+tC;+kW5Q=0tt>w`whc5lBC|ILazdj1@Od- z1w6tK=}2k1JzJ6i};XiJ2HQW!x4?BO@&4TUTwl?;kwXrH*l=qBi3LF=`F(8@L zAIx*@jhy+K?x+@hyb1r_Mns=;mtUvjYYu-fYWoqBf`JTCX%G88{^&$N5c5ja$#C>L z=pq0UB&N3H>|^bb`aP5gu`#W^3Yzponlez9Dp4nNK4uI_>??8DEUBa9~QM41Gi@;6A z(pk;Jw+yPBZAL2`Eo8P&sm`~kmIrj8M){mOpZ;l5|K&#BXVP>}oh^uWK94JUsMB_% zJL)90llKHDvecr3@XRwg~kJ zzLx3+g+hbuPA-cyT=XNX(#(h6I^^5Dm?mqbB7kEy8G+~AR+PlTn zbg{>x;4c$(-rl~5g;WUiOfI_)koi-Go*xY{u9{H7#m)fL-TT0#_RX$0Zf-#dkk&SC zM+bShLQ;{;V7+^&o!6?tp-YY)g?%31=zobV`0o)P9baL&VH-Z^$)z3F(zGDs%#V2= z)wETZ@&Ij#96EcSv?P_Tn9vAYomMe2zQPP^5mt)nv*LHt9{dv8=Y=86DD&&@%qk@B z^;l3YI!M{8{dFx%{{74A-?{2HWFlM(ikB){XAKdF3KP|Dry^nNcHtwC_Jpgwf^+f# zdz})L(iPMnZXYnuo)jA{ZEu?yxg`_+z9ZdoCICeKTH)~pK7v11&ggZkbn83o;A?ls zyUy0S7Iv=plbvS)nn+D5!+=s5C)$SqAZ%tmkK(oS4yL@lHxz!5Zr9L%|K`m{Go4!e zd2~doDxne%WNHp7wCBN}fpKMbBYuMj^`yPPzz@8oy()UkS5-CWeN;t4gtuUU832k4 z$9E_^R(ON2DskDIGz2sK8U=q(H801;$ORokVd9{3Q(th(#f&FI+kh#^j{J9g+CZh# z>Wz}Nw#H4SIdPq$qf;Eie+wwkWB^^rRb^C5Y9I6lu}*G@n3UplKf0Ik&Qx#3%{MR5 zyrt2{A$D!Q{Q5)9mBCeRucZ{_){x;Y_m=ozMLXz+-SsS6KNk$<^ZR6qg2Hd*WX!jp zU15Rb*S9*-WMV> zdDdXJbjURgJz8vc_cP84w-KHuu`W^Q25Z9f7hQf$b4jE{;uN2!XD=gTo%V_CcGYik z>2rNzcE-X=JsG$^fsU5U?Qka0DI6tIK-ua_<}g@k*_Up3b{D=V^yW|2_MZVUTnY#+ z_%SMRv}r~iE$)l{qVwnMCgWpGmQf)pFVuvDzgJJ6@)ADB&npqcIO9~FV@Y?$i-(|xo@V1m zQKf5R8Vk2iU#~MEE+X^kzZ8jj8Rbzos1j~}-c>r=*gWIkF04*I%1qY(c>NRe+*thN zZn~lSC5QEms!g0zK&D~`_bZ2u$r{P$LNgb5v-qSSqfqgifGN1-Lj_>C4oUWfyQCsk z-{Y@P|8ndU#%*4Lu0(Q`^=u;)1jHowI?)Qb9-Do$bD#S6ui1N+M{^|510@lEe4u@u z$?fkRfRR0fTAcv)MUS`N8Qes(K62j0mVD1i$pk9MkB^io>A!7 zP&I7J<8kaw?~2_vO}NlGd9WRTIX!ei-kDF>KkJh{?YsKA%kq8gM^g&6e>tp+63Cyw zRo^CCvICVr&HWkUA);()d!t4zF;Z}V>3s&0+wH}SG)99d$H^GASg(XQrAJFp;OUvQ zavLRflgb#-hDUD9P19B^49UGz9?{`3r5p14Q}y3zZ@1O3w%kltDvN6or0`din3FP? zRFsduToU8B^e1^GxHCf+I)AjPjL{7m?QLdE@r+BNijsAZGG&dnJ{d1PgCB!ZPx zW|xh6+kV79T}6R`tQtcm=ZV*P^=Xk-D^`o`cB@^I#fkV89G#RDUaHUYc~hPB$JQ_X zrJycxnG@sRsKmJG6YO8Rp_Bb*>FU=~4=R$HI7#a)=KSW&Wma|+#_?&ibuD?-JF4Gp zAqSYc4mr>bU{~^lN%Z&1kY{6I>5FIacnO2oycdBX~t;*&BW>xbvOi%#$^`!hYBFd!Y!)H?gTsNG!}c9q#TnNDrW{W2vZ zss_>gCC|VKeQ!>v-pruz1Q*Qgy%AP>sz>U6!b=Ff4BDO7$JVM-aL+QfF9APZ9~DT% zRSJpyD^N*~G@$S@Ddk<`{1!EE{IxmOPh$62mK3II0I{!F-bE6=3f3_IMs?~cIDPR_ z4O?RFv|spe#!E?>wd3D9u5}4!eCMVx{f%XAkKgiC_%LPP!t8eaHHF*Lr=9^0WcHo_ z>TkvH#%KMBi}3<75ZopS^zNh33t(-h*(U_gvN&8MoM5&EgF{@ctkn@+L`CLyG&`4BK$9NJA>x89z{F#s@88 zp76Q_Y#+4`TIDB?-;r0pC{r1JBa=hMlFb$`2hwsmByL=&L@WdILsTwg>V@5|Huxud zSq3_(+|-DHF9;{AT<}-=0MbEZp!5^5R=E{-1tNKVdFt9#qs{g?@i{~4DV-(11Bt42 zW=ZE%KtWv)Epfq{L)WbV0||>X^dc@K6A$OZs5>vHb7vFvR9eTtAPZx6023=*aednh zm^x`zqw;}lkCergb%^-9BKf%Dpc7W3jr3 z?7cL!F)-b8U-xKY>U6?$hKW7dY3JU{i!ZF!pnhwmX;d~I|7zlFqrYnJsQ4Iq`t!`N zH#imCO!wkwYP!@$Y>qK`^1%1(U4ZN*V=m1{ycgBS|GD_@$m;c?4J`u6r5=d#ACI7K z7fis)pEdEhAIUtl4j(aQf1=kShQ z(&)Cgm{99br%2J?GpVAf3~4Ol(!flqI~i)*eoy?YQz9?Vv80NVi1FqTgVXX?> zS3U24CSInyK~~K|J$?5fbmJN4r^UFwiI=|*h{NNeci19@f4lfvfaGJRXp$_GJRG*y z6wL9*z5sp{U~rD_D6*^<3Hl|+MF6=thlaEkkpmfHEsLrGWpTYQResQNcV zkVd47U4^IxvrM5_nthFn!nw^~7hQyZM7PsUK_4qR9U8UPb-eP&TKHr(&}HwKofo;+ z)%Mi97r9UA;)`}68F0wA%kj&)>X{i(`1Q9Jh&CzUv^+N)+Rgy2L`ZGD+p9sZhix!x6yi?~kr<(H)1k$C?Pf9^{y z&DS@r;L~1k8XzZG*F`dxrpuSgl2OVwp+3oH!D4zpi>P5C3&8;m1?IE#cyqAJF|Z~% z!NmwuPg`xs-PJOc7pJJ;0AvGE8~Lj)+r*1*r*1vr%jW7T7Lw$(KcZH+8bNwTmyr$SZ!E&>Ru;nHuSV z-i(JWT4H-Wkhy-&Sey^`snn1JLP1j6+qJ!qhNwCHzR#?Kk6}bZVoAC2Q59=y*zu3k zB`J4A<|FS;#N!>SU*)cSyb@wLjXUlO ztm#S%3|99nTM8~s%CddRk%63>@a{s6^)3}$wu~-(@E^fKwJ2G=WSqytvTGpKWOCa+ zDPF02)toRWf!gjngEu~9Wx*9gCYTf~SP%fKzP(x?m@%6#NhgXK-pUZMz{VsL6VL}= zUn{hGHn|(`&c}>DZKf3!j()W7IMWMaruA^JURqNN7FV`;fw!RKZy7D?umH_uyTHqk zEg6Pl&SO$_Fzcd3-PB@_1d3)V({{JNv_Jf-3O=pHMs%t6<|BCKLP+(+;lduviPRYA zpS_s@*&9n)_Ea0i=V|nD_*uGt z5OA`ajMaYu=e?-F{qsoln2N_RaEU9b3DFh==0xGmH zTlv6*_1s2CU{R#=2V~I%kaEF$2H(72o>pnUyCk)ry3Yf{!Y#qa``k`A8-o#3{L2+= z?QEOgKK2;zS=`y=NUeRuKR?B*x%AH;{-;SWW&7GUnX_7&o-1O|*FU}e;b_?|BQ~%{ zT}hKFS(TZ+*+3^-l~3Xld^`1CNwHIUQs+=Qci5yhhlLi(ICaD!tZgs2Y_j#{zdi~L zA>N8wfOHxhMFW+cdv(j@y;D*@oNU#ky&_h2!yah9lNLQ#*Jhse8#ZPffFH4VCfllk zj^=prqS%3e%t`U9wgFh$-e|GqxqTk4IWiLEMMyfb=H_ul^8#eaV3RSW8E5ap9}L@a zNsc~@LCg5ojNHjN@FW!49={q2nUKH!iz%B5y4p|i@3!yn03kR~ZY(G&bMdIEuRE(N ztsv#N_;~Pkf(!AFL!AD?AoBa6g;Le&q&Jkclr)**c2~iRhjJ}=l0jCr$ z{{OgQe^$pYO6*?X=y5(;yfT>lWY+&6z0JMGWR4~!6f}9@xiaZsv@+p#tQen2 zJC~CsmSsx_d?+jtX^#1_6a3KNRi0+f#)PQsVMoi=&WSc#1^jASQVhaCt|8$#z=7q@AeC%a)j|xV)d>^-_^op%?#jXaCs! zd?}LRoL3d0`vVf+r1Om}JaJlR1CbJgs!DC;&7TjY`H9_4t`9BbvX|s7X)^N+ zy+wDGp8iTxlVrEeV~vD_*p2OjKZ6L-Dn><6Fo9s{|H`)IxTi! zZmuD(daY<2GHn(1v#zBWd#hy{x?fW}zo6Hf$FSY`l;9u$H{X3dLUa7pWr~j+gDPkM zFYY|;j+SYn#tOOsW{8Rr(D~ZRP(=8kbp64B-w$*M&UY`*J^ zw?7~AK0ROCeRF55jK?W&B;5U_pQO{?lTBHM+Y1J{=|+yu)>VQbppp1=#Zql8GuLyq zOl>Z#q!_el{NZo9f7^ii&#d+7U&uGY2je*jPjbWiiYe{`(JtK9?2p#BPTj4qhdBXyE{O6PXtlTdA9WqR$s*_Tg&}y=h6E(&RE>jfeQDOfZf$zLZCwI?n3Gzp+`r1 zGkO(I4({SJa3%dWEBbzetOJLO^UijNzspn68J^cb3pVi!c2ZwfGsYmb#qt=X&lcWqb2qQ!jgBrGyys2o3LEBd~8`73D zgm3+Wb^K0HrwG+#>uy|SVaZ^*f<021TW_wHNxdA2T+3rxMpc6D27H$G(w%MrNcN;AoU3=u`~^%K<)WQ@UCNV(|l|s&m|Aw9r@!5^j#crH0XYhhmWHPbY>ZVh6oW>NNS-6SRX%fv)IS zZVg8W3Ylt8gDaZl82vU>wlz86VU@StRB&pkl&0~@*hTrBQGsfjc4e1kAjRTfX@9!@ zZ|x&m*jzWu>8-|Ok^s)0w$0~JlHXEQ$D*xvhg2W+4<*d}4W#)WJCFYBl4HjE@U<`H zKZ!HiKBL^8jy9icI~pI?w}hv3Ximkmn^JcvP6_T79Gk9HFO4fhgB)Ykz9{n#8Ra%t z=#}AnB$Q*tcow;X9>v}i2~?3c2s-^qI}0-s!IZv}Id=O!FSRlD#crf*Vy?W!*ssO5 z#uh^$_?6b^B{&raEarv$=W=w&h;w*`(g%I^VolcSR=qMe7s{-Z=lObX5zCJ+jL>|1 zvY{6>SUunP;FiOKkToy1r>N^ejk!_xV;Mjijd@au=}P`uL+Mt%l~kS&a?0^%{a&XN zmd#Ff8ht5^6*$p(^>^SBfFzLp?!9Jk=)yy{gFTnD4J%u#4c&KaxgJN_@hiy1JG1&c z;L)}3hN>POapF!-R7cT`fl2$2k$xs z(E|7CWl~qcr0yJ;^?_?Ceax& zK#v~F{@bhY!QSyHeYvWI4T`dy+5O#rknWOxi@nxBqSE)IHd}TNUk;&Z%{k5LeHS*8 zFwQcG&vu@%ZVtO01&-B7@krK;$UvqK=H9YguR3#EsaZG5T*Z{7)>>^)w@L99>h0BF zjl`+|9pA5jMI9Y9NHK{U(JHDzWnqi~zY zMHR7K0FCXE@T5MDa$hVADL97wIBSdt`i=scPPy-x;0u-mM)|fMqTli7k$Z^PAuab8 z=)i^QuZWdRENAJDOvO4De~i6%RFm7c_iGn7(nLY2iU^_< z=^d0REhtrL6a=Ir0Rn-5g(^*Y4H0S5rT0YXJ@npNfItF-00|Io+~+;Nv-cSHzW0pv z4}%c~dDgS$TyxF!ouBzvU)oN}q*x;+Ol+@PG`|XLV_JqE8_7y~T{7WiErZ_&4;}qB zPSsU<((DW0FQv&%IPM*u*O~SwjSpu(-yTl$%1ycNYgm$P$!eZg*MNgWTmGz*Cxjc| zERlx4E9?yvnmAAU#KgVjbgpw~U6e!$!2Ay~J(jv$b4{L;+U58n3r{r0rv&U5D1qty zdFa!_IAeOnf2>*h+M85AsTV(m2afZ5J)rTwiMYYK`mEQYAPss4#9$XSOzbwt_7pFM zAbku;Yj1ZmfqflvYj2w@{a{(9w3pMymF7S7AHM7lgO#-@a8z()@7weLuq`)w}*}d`s&1YtJteboHhq z^pB+PKa1LYj_Su1(d;*v0>Z|=C|yoWO4rC(6Bl9L4a~y)Q5vfEfU8~I@pkQr#_Gz} zD$R=-3awth4@)cmn30z*Hzj{JwSJVGy1+Bpcm44fWye(qc`a=RZ7AC`!2!=_jE zkyaa5A-h3`0?T5()}<-CdNYM+kU7CJaY#tRui_jpNJ}JJCZD;d&%m`)()h-V4egc< z*}-MHD9=XWb8|AaV#$y#Y+B?h)N62Mk&=%!`5D(UZ}g3S`A*0`_jWg%d*@<`V|ic~ z)7y~6|d-s zZcMf1#k3xBQLV7daUnZsv5D&8-QVR(XQie+U4M^S=&j_X&L}s)0kA^J9J1M5j9SJK zs?HMJ5W1-VJ1}~K6_Xdv2nH+0<*K|wX|GeW$j7xfJLfkASU3Qy)Kn;^B_DI4p58O} zk99=ROrG>t@H^}Vd^?FFp4%4oYKLNlyAhVnbtj%OX8&41{L~-o`Z`Z&uCm^$)iMo? zlvJthn5gAnhbBmCH4yq2nK(O)j-!N8UpQrI4)Rn7Dg^y%3(U*MuLHw{mJ$)@$DZrV z&owruUh#nE!>gj1*WPP5;9ak!F?1n(g!+Z~V+*;zX~EF$=^a?>x7%I`oF?y<0}`qs-`7y&lwrHNOw=$9e5jf33|U7b^Y%3)nyn_huUFv4l_28@GSfYv^%F;NKYUTK^0@1w&}>rlift zH(=^Ba;qnebkAacWfgf8vEA)5vuzSc$|MU>yWLUT(NiG84A2eBB*{Dkjd9Lgq08Wj z^2P`qhjv_^XMNhtu=jXef!b00e!R8)J?21Pa%?-O^H$99#G>)=9P+fH@)@C1)|2G> zuFohzo)}Hs_wM8Kr>KelW36s48J^f}WUpSi>@v*uAdQz=0nv+_GHM@@RGz$~-fhmb zG?<_;k)EU=v6pqfbh$XG;2x!1aYuFCceum+;I~?dyEbQlU~9VI>8AYmH1&1cAb+XM zxNkKjPB3~!AtsBu=R%#*-Iq;_N#8170ZXzX)T8N`mzbKIdCIoY-djbZ7+doaibg9Z zgY6)buM?zWXJ-0s^!49y9gMKk-KN-d;ad$VPJZtr#WJ`W;?=@-}hPg~w z;tvfN!lq|rXfQ=0U+a?{igG|!+4m2(-)$BfM8DVpprX+ZD9 z=0eYDOxt-)>Tu)7tHndNzhrHtq*t>bA=**K7A{mIz|iZMx{oua1?tBvdDlX`kH|C0)?ENwxz(3zrXo+<&4X2o9iPMd6t{ZRpTgBKUkr&A z=^1Q{dA-j#TpN<$Yku;4&qOlyct$edV@V=$Tm`&@-u!_hVy;u`YAin_szW6g{G%Ug z+92;)G@X$fg34x+Kdu=0YaArsgX{dU87N70ruJq1Uv5#5>en-OA5j~ZShfd>CWID5 zyck{x&1WsIThZrJaT_fN8W0-CmT5RTMd6#4Ky&3ccl%T_lCL%XELR0`Sm)`o>0NjO zW7e70R=+OIR=BJbNtaOdO1EfvRx=?;7?DGVAB|$ONpb=!oOH)6THep-cV?Hhf!{bZ z-J$+>B=YoIafK|+42f~$=n#?4LyIe(t4LOm6*!2aCn!HY2PIeVO?voS`p)jZQ5al`B!u+)Q^kibiGV$k8)Zhm?ZuaG<(&X)iP?SICts@wC4osG+IUvm zD9gG;WK5w|dW`sPmq6MftP*51#{8q6b%a;}QTGg6#z73r3J3oZJ_?#$GL`yWxOb~! z_|b#R;bLNI4Op+<(YYV3`6BuEK0qU{AOz?q5{ZQh!hEoql~(BO{4?ayE!cIOhB|VW zIHK@V!P6BXK>$KQEUa>TCBBacMHDC#MHZDM65k$$)!Hs#?!RUUh_5*;8KEr|c=ofp zx@vQv+Ci-FqnGn zTpeDopvx;u%80PLUi1&wMala8sAQGB3EWB8?*qnOB;Syi0nUxaXIJ%3MhW23UyNLa zfwDe@sM@*2E7URIA_j;`y7Nm?(XeP?XrN!O{hKYeB38xHVMsLl=Q(N3wDHta%AGR6 zO|aOtF`}$rK;qE8X-6bj0dhPj)G?v;8->V0^g45zqCr~P;s_Z*d?I<3%@BV3pJzC? z$$JAA>}MpurFOMc-FPq}tT5frm-S*=qOaiOQVxKpY8-Z>ZnogYLw1?`S%kkMPnFq} z?9j;3E1nU%RmsshrJQC}{x9!z%U>#4sa3TMXCJgIx1^eJXL$$|i!b>?tmNXNEHE{B zcVebRyHV6Mb~$q&&r^S;f^@O>*(YVszHMx~5p<=uIzHcYk#KpjY@+r!L?)QAW^-bnv{ zS{^mSYqRE{pUZCW_x9FKe9!@(bTGe{!;saXVQLt-Xj;#hl%YG10r@IOGqt8i9trY3 zHrbDD5`re5vtp<}m zQ}BF;yTzI)WNc}_0YLOGX`&vlQw=JV1+pz|P++CS>)HT8P zFpg2ho23RYEKo7iPH8Wsz&Suu2;2v>;otL%3n9(vcO2wxEMFb&#M%uPOwT76&7FQ6 zAxFUhrDP1S5Xu)T+8+I%V2%>ghGV^`1HybrWcax8I6$X%_}w)g+3xcEPzXAtZ`TL!)MY{acGicrWCDD>pXDq?>wUbIhN(-OimW-8+ViLaU z0M(I&m#U(57zCJ!wV^d%Tl{V2*$T!#Ako&d`wXVo-yr&si6rk<;`(ynC+sB zlO7QND+>MWG=woed|zqp^7tuD0m%E_L7NMwY2ZvohxL@+xKl(_qj|q7+;8S5+DMXG zp+AfhdR*%&d!F*USAuA@kXfI-T1(du|9>5~n1i3%=?eZHgc1bo&9e_Gsir1lo^7k; z;`6N>^h^DQW%U{W8Gyq0_5n)jg^_Ybji;~6=87$|S)IBPCf8NpU&Z}A?(&-cELS6+ zdTf`rpNMj|SD_%6#O`Nwf5VfJRctX-zKE-WTa3PIn4@$(chZo~plBG*bmx#8> zr{Xs|-xO!ss0O6Udx|OQ+rcbuyMIC`SB-m4-PfUo-3;y++E3AkZ2ZX30yIm;(8508 zCcUx%Q=I)(3u(3KaRoY{!~Dj+ZJAZ15{jDJqf`L~NN9R<890h-``Z0QyWe^|O}9)9 z?%c2xwYi%A+~;d!#QK0;rMs<2lLqipV=ps1gxhr#H@SJ@X88*Ei>2Kuq-)bL@n-;ifPCc!-jf)6fXq((ZW%Q1cvYF9#o##?PU zIM!M-M=IEo{EVfRz;3@P&)KW6{3ucc;vL;x-xyCSZ4gCjgVelHa$^Zos+F{jtMD9A zMF@W+o3}HTg{~)1k{of2XLNGv3yxIPmzU#`Kip zS5uXVnlB4*j?s<%U54U1x!MZ1XCofC`pv|VJUy`y6VBnJE7r~T+2@jM4JCr(cKyyP z5mQfu(L+zzDY}(Jic+oJgOt;;$9J+y>9Z}?S#*1CPx@tM%1Bn7WSE;jdLX4zEw8a* z|4vCd?B;HaUNG zgliJ?qdI|JOjWZCc`VY1^jXIe6m(!??A)~6iB4ao(SkAS zYMJ|pHT$iYh;U!uRnd{WmtJFwK$Uvgrjc}U}`!8(t}=Vt{}6;yiUD$kRZSfHfeV&tW`@Q%%% zC{NB~oL=~5u5N~O9FIDn(5sH>Om;4kzCBhw7{%IQTh7AOZ2DIP*kWi~qYvuVr^ z_UHqL@=tj8OV3{kGW4(B#MJ5J_{~YkC3Co#W$H;er)-hk)dNV${&@#ohw~o!Q9irr zkXho`+AObROXO-=&)N~gKkj6IxzqnJPI+y2e!k1)({?mb8&j6hSPbUaN!dxA2nEsB z_WALs2cyPwqNzY4f2OHA(gM5)MrkmO*tq03gsU@BPp8#3)j$C2bHEI7fU z7yH|Ylsoes%q28K-DV{C>3v1mmTn^`6VJ9TR}Cl#zU{PDK3fcvtB&rN=%SOFag{~} z)8ubLfn&>^GDp8C2kw6y^X}41NnTQ!dBEV(RFE=T=Hj^dLL-b}^uwAMmYX+HJ$NXP z3eD7XF7`XCK3BCgkC9Q>30xfn@Byxe&>(kIEe(qjT!gif&lGoK86teyy$*KzFt87%$-p%AU?0wq^fSd z==cML{j#S8*;ss&Ff&2Z^+VvT!Z|>ZRpX*V`hhKEb)rOO0i$9*$8*D{hLRS1x^nm? zrbv04Ju-P_m*r*!$dA9+u$QLUCVEZo2O}y(wK4h!fw=1<-1~qF9IQVOuSwyqIYcQp zD!oGibi&WZBz_WJv-lJFMt3-vrAvfvtw^?Xxogz91dU3+^z zMv3vE@)&_d+eqt5U`_*6g#W(EXQ05c4r%W;P#% z0Agmd=R>UbV6g(!k+^GPbCQlt259`tvDl7(IZ39wzXUI0W1YW%+4h_6zpS}8Hdya! zEiH(D)1lU1aqT_Rv23Z?7Is;8-nwHVrVduYD0EqnuLYRl1t*;s-qV0DHQ+Ir4ZOr`Xk1AYH z%eRk3Y5$p^d;R{BO04IPk=BUk;#7lUG}HRHw7C=+51DF1?x|gMM7*tMYJ)|NiW(hO zqhjO|c0*^@%td=xMtVl1NRN(dxrFm&@jI9rbd!k7!yc0TQYZcOQ-?IhjA9@bkX@U@ zc6OQf4FWo0Qf$K-t9LZbLIX=~q=yStx-gi`mf5Rsj@j>P#Gv&HY+zS($0Tit5uo9l zUz3~aku}%pa%!UKa?TTY4N1$w3~i;MjT!W`_q*l!_F|VgOnrFnH<`ROZf|$YS#sfE z*O(3*Z-V%&tc79s@53s$$2^}aRCzOG(#O^RIGxG!MW`M&7z!V1M`fc`ULYQxm84{N zR4Ut;syrNDcl!OCJGQZo@!Hg*a&vnT`|dG%c_Cf4Z2tCmKoC6Td5g@gxrq~T8EG9n zXS0>s%2_tm+WVL`c}b*&O1)))j}tP=#(=J2L_hSKE5oPj_$N2rxMR62QMkTjY6Uo2-P zK|Rx+c*=d|+B+7-9VO>$1ep+~mGR%r55`sQQ^VVx&Fkk)KPd@?pIZQmBTiV|$o!<6aCJwV}n_i6^J@do-<0 z7A0dU`^8ghYRtqB#D71ESxQ@(FVsFJ$chUFtjT}ZdlYZ<=Cr23@;I&;qQcDEMp$_Z zuOsk%yLmmFMXTdq@`Hh!AKfJv{kvY?X!V-_bsr%e!>TOYD!vV?cI~3V-&*j0xQK}Mfx9Y;@TATR|y5He% z&MSyV!kIP074_P^ElttCIwY6aBI>rHqmQFJuS*>Eq(^lf+g!OZy=ymXY33>D_b=!F z>gIXNFW$4bGvr1u*3JO2vQfEzMA$Xk9O(MPat8o{|X7>Ct5p;jNbz*)4w-3LAOAuU`t51%8Ab0jlv2t!Rz zMe6~NCCfEmowN^rwl4;3b1>8$xkARWSyc??@|lhNwF9^F6TM*PT$p3#QY;7Zu~{-S zjj9u;UjW8*VJ{T3&CiT+Qy$@ffcfHNIFH&T35ig5O&hmZW){B$0Eq4#kj7;GetGheI(_kH9!jHv#-Tfl$n~uTP(9XpD(0TeL927rd&9R!XVg8 zvELi+v($MDxEsXNPQ}yX5uf9R;p*s9TZoDHlHE@XNY&I+sqr{$-sy%i1>ntXB zU+B6N4ZLQQ5Y2|%7%qU7U{*4lHb(9PRSg;E!3U#s9V3MF&AI$z;$?X)jOr8Do0IZI zsE;UopaME;%7t?@iA#<%I&@2|V*?wcr`5T!eVU&bv)mwQ-VF)kgu z&x4XM{ZXVrrwkv@((Uyz3hm_OdOFpO3B9?y^+PC$jyJqXuAj=tC9vux4)NaO{bc9>K*Dsx)zod zy`RXJojqt0eJ`RDz7890%ioKO_BZ79m&`GwR2bd}(=9i+cFw{P)aYd(wd05?Sa=nRPv zPkG8d0Cl0aZ&2fnlTM-iEt7d$B8k2#B=GX8Mbt(G%TQ|m9fd;uW?netiRX2v=d6k+ zg&Pw!WF8%MKj{YvuNaQ>R5U!gU||CjcZrA4?>d`WOi}csx2TINJkz zYWkKcpx@-UXvn9P8YVD9CwCU+bNyj@NDBqYjXOt~2y-d!lV}e&#ey_TV5o~PAbX`J zO&pT@(D(ueu_B4F7GZ|kx1BWVM5}l2D$CO~Ub-2Zy7xeTFJ+(t)#ZYX*B{Yuc6ZUj zKPv1#IsAs;;~#@!Uyp0y|PIS0yY1q|`dC^V@K;Tf3TfYALk(SN6Kf zBgQ7x3;5?0vJMR;SIda6JXYlwF^v-iK7-Pd&`a>PJ)5ikVzRrlPcoD{sI6kIgzuEk z^TU?k-An69t3*Q6!^iw*Dm$uW`vrE*AKb1UoN}49^4W4k{_BE4iucl#N|XhmTU6$k zY2Ct3lo6ZuyZ;rKT5pDq`F=dC%9bF_cy~7`Dl7Gi-P%1wK;2 zjv2v{M|Z?jawa~*J2;RFf|3`?J7J{W}bV}$V+++8FxlY zT}Cw~O@y%(sl1HyUn3u31}1AH2^@nn4Uhn!GZ_Vcq56VB%eRhhWjR`N_3_t66 zD;~He!|)qwdiZm!9=LK(h^uJZ!Hkk36rgeF$y;LK3RhL>fhWE1 znWQA|x?*1T0n?5u4hg5v(iu7yzAR}lP3V`89@v<^$d{vIsxnhuG?zSO z2ud^5#RU2w0m+B?5+p-Xxm8w%@Dqx;N`!sj7zx*uCMbB!S`aTMSBz{ib;b+X8%rl8 zaP@&h#gLk3q}MRb5hwlr6Jr1RTYtx551Q;Jfg-gp$<{d>fwxHJB!c!Xzp^EgpJU75gx%aLp_^T-^Nvn;f9O zI*+0FxHcp6O(eQBNJ!i}%1o5l1lxOP>PVI!#s4(C4aShKQ1+h@93Sc?Q0S#&qb?G? zO@g7N|1CC@WBB2oyqX&pzuKO+xeOAFFG3)*S8 zcE8_|HxHdzOq$}+XR?B3zII-f`5QR$pA-}&js(Qy!bw}WysSqUHx;w5VD0NRv59&d zD9k?QGZ!b`9!;VR1a;1GW#=3Bg&#__Io%n*HttF&dVUxYwHC|EsmDhrA?5wF+Vfr7 z-cLXX(tFPvaxzeue~N$uoF7dJ=P;k||B}AE8rdjT(bS;d%BSM(=y1zK@_w_(wCW~} z0-3Nc5rfCg9&5`Ki7P&ECxly^retpgU1tg#FZIfzS~w3&YkJoDL@U6^vk|^&nz{8z zU~qzOROTdbU5;<>tJclR5@NX;W|<@E%YJ_Z-&*>QE7u<@K3uB2>H4~<%W;BgFq?id zM70$jEywR(2d;i>QH)x&Gx+|w?!eL6FN(fKUDadnyNYGaHP!h{a-_Aj{nH~S28lw| z^SHrlXbYK`6J4%YT}{RBDA4e+Vv1=(n*LE%2vA33WqnQAcj#F044GRcYQ3@kJ81|@ zFwQHB_LpfQNe0BW8=&PkMAs+$tv6o?9Nv<3)oL;;(Pck%)N7!^yia&=$B#Vdaq|1> z&^0`3Q z?DpH*AfvI!02KAc=jG2Es>R2AlU`p=5bC_cl3ym)D&=zC-VHuf-rHR2`B>9~(D1BF zL4OFf?hpDb1r*uGWN;4JpV-MjDuerjIF+||zaj?nw};Ri-?(zI!)}J^a3NG0qB#b* zEuFvWAT{cql*@Jh-q)!{e!Pbxcvi1{tXcT!JN@q=)R`ats`{;Xw-L+1s*4*#UO%cS zl*l%=0p9lmaC6oGn{qiUv$ML$;x^zHHs${ z-IWAAYlRPyXurG&KFLZAq|JTo>Z~6$pFZOHSDRl;x>gfd6XWz8b~K{b29^EUX$UTI zx#GCVmMusQUEW}p{vw!2)Dv}2JyC_az;AVhyE&vt6C)ZwrWf9ouL-+6E?DeaMP<|d z=7sy)g%n&amYG9G$e&O;jEDGayo4^kf00+EcsjJ4uWaLB8Gj~OZzx4i=m5W6CtqlEm$OPDp*nO2R?tgQ)}MJHznlNr8LQd{S>-gQ!PbI*XOyUaaDe4`swbfDI@%k zv-AK1+YI~3i%biuQk~X9mzq2eGTWkR1&;ep%CgYz5vN7Ut`-~CuwI&mW5cv%r^5-* zw|{RU=?w1}h1I0v;vPM4HxFD6taeK`D0X)476_A+=Q3(y%8Svu1km0 zaz#}e=ebYcY&7LQC;|kdVVTcsy(}I@WLms)EUD1hcFRp3nrinLrLs++jlsqP_&AO2 zZ&~J=nB~QH1ML4=dun`tFZQ*iv%R^{j#EsDx^WV~39Q%t79uyU0Uu;$zHd77)k+rwk}a02Vpb_%n<9DJ9=T_l zsn>Mu=iLx*(pdlj>Bn2ylIW^N%krE3$bLiz8zs&cr5xv;?`#;!3$Z9Wzy~yNj7Np@ z-WjZ42kfI#ue*AmpME(j3shrgr1kS3CRuz>r$+U9K^Lnud5?*EkN@SbY`7M5M)j~x zg8kLMe>RngnmthRmmCJn!;CL^i40-wWRyx+Yv^{ItO0aZXVVxm*!z@HmuYXZEfRU83(-M*; zpAnKsEsyBWarxJ|)$Z9-+0ZPmTi}iT9ltk@FXs#1x@(_Ky`QXO*P{L9int#3cG)KG zR>!`dS@GMJ8arP@8S6)k3GskMgGYH^r&Wh`^)#tuCB)<17J|Og!`C0$3m1}SZ0#0j zs-z!dY<-HL8OM$1IXri(yREBIqzuiz2C6b&1Q3iO-)G6X>Y+9yWJdy|uHI8UoHZBhOB?dvzceB^wmtAdtbnWdR zexd_Y3J&#)Jnvv~$BqRP+!x!Dsb0l`5;R-QvzW_+|HrPM-gWy(^|S6Z#&Y(RxB1jS zS%P|qw>j%*d(?d)W4;N$Q3-KS-PSn&93rZX*?%m+NUB}>U0J52WJHvwuTGR|^b-p0 zSXY9iUYAwXFYpZD^5Lfmnh6u}LS3o_(iU|3bPX*o{ z`&=vVtiZ$p?=!oyWVJODq4f;aX4>d-vSAF(`5QMeE_z{DMqcs|wF*Q%j;x~agMY1t zf2d)aD>(x6l#y1y(r1s1iV@&C*Dq6h>pfsLRT25ZJGz#$rlkqLpw`l6?`W4Q>tlgW zpDv%wQt-V0>HVy26191a-Kz=6C#(L;fKrqvhzp|9&^cRdVGrN2Ql895IXvg2%_~G# z7gPz|N0c%yhIlA7Y9T_*j8|g0oirVJ3mrp0Utz8<5?YM$2duGPAqdemGP({j-%}=T z?1V@#j~ z8R{slX);c}q{tNh%i=h%UO3rqnSc7HZg(eG`9q{iR}AUO0vF!vXUXfhk0t!~B4^7c z=*h|peHun10p60I`@B3_eIpzzp8tWR4x zw=HLl9~rZ3_Qcy<9FIVRek+lvt@**z%@&Ozj48wjCv-~{Eg$;5c?La59X-TeZb(p& z?OpwuGqvc2#+me!Y!(n65XBi2x4(4V{W1)7i#V0s^nk;&-^P3H;B&Hnz?^hZkYv)dCctk$Hp zm%Ev`GdHQZvLn;<9_yN%XwS+VMTLWkIf`6IeO|&7J=yJP-9x!9ua2xvZLIX+a+!c` zS>7zOk%N4;xo{^S{B#$j;Bf>oCnd^sSRGQptUZVWYje_~BSmYNP!?szKPLVCPbKU) z-vy@wN_l9)9}xPlUr#9j@BxfRPFWFU@@xGVzA5ZE3CinD+wz0WUb<)`hV`2$H&)p% zz0)7gPZTraN?j@O=D(dG-inueUupkL@1_>ZV+I{}V>zblD3&E+n$%R~UA`~U%PgbI zmZqsImNKu&E;ae3XxG^3+y~34ERVZ+>K=1Y2iwu?E~Wn0haW`haP?#73zI$ylF{mM z@tJ>cOx^p%(_&m<(pNDRTq?=FCRyfFv7{(h z@cy8!bj3+t(yL=Y-IY>?j8cZnMZJlbz_RrNHyty?f%_E3@O00ZkER7y@;>6dT0z%f z*^}_&8LH+9+4ok1to%&&0iK|F{1dNv>GZh7SLiH)4X2fpag8u9G#uR?tzdiySi-9P zb1{4ZF6>w~E4}+S`CgLhg1)}K{ULUCqoe_=sjRHLK@B`=W_`O_*868d&FNoX+>Hv0 z*{{B4$u7;i-bC!2a$m5xT0djVJ1ze3qI1u+y}O6yqE+#%kjuWW#$%%yJEWa6%@&N; zUckkut=MqVZk zwml*f@1l(g&xGFexQt56_2Wmc*6}fY6C@0Gum<>x@kIO=>ne%uqnT@yI45b*^)8v| zZ@(+aeZh%8)gu1<$Kk-z{mXe9kyJ9I%1}_P9~A^=`!kI*Ct4~)!SCVjkrbuIN|Phu zY#?45BUpEjc9*5clVMpd80DU-nCb0iyQ}kAAbPfeF7RA|BV67WW$-YN(0855K z*m8iA=-{2pNA8P9-;}qaIg>hi_1jH^JgsL(J)fw1avblRC$?~_8)~v87p9kPvi@N% zdBg5Kp+J@`y%&Q#C=FtA3=55N4k^vbHbN9n-cZQReJV#7r@FHAKX0~|{=+7DHmuBt zmDy!5EzBLXw_HmAS#;EqfCauXaL;tz-ZslKV$q_XmDQ~HrT(i8_%QomNuQ(7cI0u3 zJ~`#T!3Dp9?*Br%tkzT7{_459y2|*Ucu!S18ZWtK{_PA~xPEzkpGn=x``m%xtJU!z zEF^8h?@-!*91gvmgrpyyez<$?)7_2N$rnT9jRWNe4fLTdk>b0pqS7l=(|>iw`(@Hx zGmbrXxpaQ+w6q_Bn)1YKVhccX5w8+zctzoo<5Q!vn45piIX7qfGWZ8#o6bflu;olr zDA7@;jL=k!aH~0D&+pmldZ~+`tR=!!R?5|_Pp}F*MPhibZJUB2xK?AW$S#mgFh3E9 znAu<4oWJqzM#+&lNvb|aAj`d$_eWDB)bL(-iw2utfV2y z7$kYEl)PDrATCm9ZG99T>xtKXd#J07??vB>IG2lLyEgyQT%0V~uKm;+kH%rS({|>5 z&HZw8Ua;e2AwnAv>PHPBXD!kJ%#-DkKPh9!ly#?kdY%F-a3!y$0Z%uLlLF3;B)^`m z_9QlaZ2E}Xze4&t9Nlz$U6xrd(wu1DlF{TUV5B1-j-DTKo5Pn7YIby^;7vy^oqiWb zbl)b4K8^Slc7H>s!CQg-eRcS+f~*Ewd~9iAsRSFage>!QS4nqx)3FpGmfC{73}2OYFLgG-&!T??w%|mUZU&hCq_R? z`BL*iT*0mYRtqTxnYM5BD8x~8;`gm4^}&KN8GWgy(E@+Jw09T%DP5VaoT~1i70-yP zyd@|5qjdfQH6Oqp$vU2YKkT0e{^wYj_z-|T0;Ujw=|s;cAm`|X{fO4%7&o0(*=G1DR;scBjW7S2O#J*N$Bd6QMNUC6ObEYAy6JO zZeCTAZCa0DWJK+l;b^x07sGG!%9?K%#7AgS7w9Xr!Hyx#F;)XPxjL{=JDl5_)?6V8 zUqexA#)|gEHV81aG&oZ7qdk@c@Hz<0S3}LAIo4)nt*WKAYF09t=f8;QaD{&e*X4Py zyzjK@zDSG5zIYD)dTY3M(^Tau%=;Czn|-b6!AO<~=$iZHJLuHq>we7Ipx0kG*K)|^ z`==O&BI~~w{+~tse;ZnoPv(RVXe+@dfKC)2oE>nU?Q#a}wQ!Pm>^hW*pO0?dBZ#=Zwj4c|RzSc`u5>iG8cy|I(7vgrF*C@7Fra?IPd07{}|Yo^OZanal+Q4M5H*}m@q@ktQgT) zl)Qp&w()KhN+L3vj?})61V(;H>a(&GalDOvg8Rwv;pOsp#*g<^my)Rl*`vIIa?*a6 z9KNySE;9GIChnfi*_CIJJy{!;9|TrVFpGxd+G*1%2A|a+DVX$t6AT5O{->h@+#hr@ zp6nVGvPb1Q$vW}B7~Z5SQ9#gMU$p;zmTMF^lJa^%Cv7i@0h~!dACY+=BxGYY8=T-& z|9Hml86OkC!dSdXeYIkBG$hLxmvPcJ_to*(sdyb7#2Udxb1S;O7 z?R2o-j-cCZtCG|%)nI|BcT1~2LJ@@t7`MeQVIf(@G3rA@Ywk<;b6uL=ylG+oN^R_K zEbbl$mfz^lWns5 zg1?gs!HtX(2naZdKiows9mNIgDXL19?ESB8>vtHB;zLW^K26TDqc8eb=1ieS6;l6LJA6|PVtXrb3O;q6%_&~u5#C0x^y zEkC$3AxT*TNp7<*=NM!4{T?+NaQTC*ZybLKv)nXWYHLH|ZC^_(+na^C2t4mZc)mSH zBmDWMj~(yudQ_l&$79dKgYA(U~}13c{(t^2PK?Vl0L|J%`am1^v~ck-s^akHC|ka4 zzIxqeTj5o#e2HaTwD~8k@6{Prq%qxSK78Yo|A(K(eS2Qx680&~!Cd9T3mV^? zNXmlRH`}tV>qE+Ogh{gtEDA3;_it~AX74F$#!ALR*z^$R-HR_K4*Zeh++MOEfK&+l zf}4^f5Jjfa1iT?a>D}hGFQ3)(Vu8m-tArhJYZQ&vJoggR{mQ+6n&fhDQzc{n-&@`P zGm2a#^Tn3EO`kC&7*PG5V=GE@|MHNc?5vxzN|p2-dfibhC1!z+A~9r)QVwo&|f%2~PpYny+SMqfFkx9LF2%nTXM zQa#BT+7L+mqGp4Bsu|U&ag5|+FH=L-hJRiEl&Y|HSA%fAy7bEUF|PRG4#T$<5p-)u z)>mvR-Ii(d27-h1w$jIQUsYCaZaoxA?)mC>|8n)9Sn}KB91DTT0RL>_lmIYKr zRJE|QB0Qbe!~Sja1ARTSu(W*}&o~>{55>Dj4Un&wpBWylj2es%QI)&4yULlgjb}gY zo~S-`@PDx;x&7M~yI(uH6;snuM4Ht=tu8^awJWH8TC~k(aPL~ySD}7`K*mfwKS^E{ z6^5K?EDrrm6)TisMmUr3GSKi)?91~^buUi-08DCIy$yUeVH~eNT=A@eHO`;62_yVw zLWqQiB<2pn^(__UJZ@e(H;;-JgjZx2E2h62~qgYouxy_mPt zTJv{+`v3QX;$4urd_x(WH^4fDEDQd&g?W|M%O!EdA1#vp3Z2|#m+*k6KM!#=^FY8$ zs_JL;mX!F|RsD1B@sSFZtTjPUY|ibNT-Vi86Ldn*5>#`d`jScl0qvE_?hcBqt>HBd zWIDG0^C(2U`PX%Me(t8F>X(RjE^d9|@p)UNZ^~D=TEEibjgaAr-@aZt`1aQ|B{}dS zc%3&n{z_6wtefvdSK#uFK+!&9WPmDb{~Fz6$xMdXp#YDtYhb z_TA=|4`dOp#kpm1d!}tp<(M*_FNplU8NShw7_(~itGHwN^uxW~V}Uc-dDp4MV{a1y z*x=%}ZRuQbDD3)5cby61oP(`2 z!b*%V>^frH8wkir@$s}(Rjzi6s)nHD{)_*+Z%tU$&jRa@m*AXlGzL>U&s}!VdEN@~ zlT=l?X;1xE)JZ(M;<_VhwbC8k=C*aRmo2dz&IT(rp1tRMyLnKQ(8Dr%nv6lmjIOQ? z-KceF*H8MG!?u`1c=I&1hK4BEyAKE3A)(o?KgM>nWtCy(gCfr;ITgFI!igW*jW3{h z`33N1w(=wC`OPG0+p*zk*c`R^+I6n{7UG7p?l>X_Fv6n-TQ>aXECQN z>8^L{ETFC8kJ||PcPY9_!HDCasK@zi?qVEbKd!HGFUnj&sQR+w*CQ^_WVjD)_YafGz6Q0x%y|TD5_tNRCPCF zOdV_s|aL=H`z`pgPB-zJ=V^hSZShpG4pGREoDR3zam5cf+ zZy7H-;}^H`qMN$Ps;|_z9r>=FyPQ1%rWNV;lzWB78tV`Kk48(khqW;k;x>sd;|5LO5w7*IJu3{cvrf^Ot(^m(DLSZ~3T$`@{a6#?O8lTcG_7iZ8yTX_jmq zs-fmi@Q0&vW~SF0Fy&>Ei$_6@4ZJ^eCAW~`*ph5snJTJ(j`s@Kdid57Z6*T|7{m`4H*UY$eq>e}Qw(v&rKMBvb(wYob6eaF&^B2(5ru>o{`jWzT=E_*3~L_0eUHEYKwG^ z8=zl)VW_pNNLCnCbt$;!=@ot%aShw>)P-CGPh<#}cZ&|=Mo;M+5opOa z(S6*%c^hS&{9D3J(B2PSjTn|UfpV()eA>Kr&6^(Yz5j;v#(n~7RQ(~d5kma239>bM z;R|bZ&0;Qua!Rf%)B6kZJ(p<%j-OETd3`ycKrA;(R;vW}TYc?doQH{giRB$vpRKfB zmdyT~fyjAMYrw3P+10k)Y|T3VmDCwuT6B?|+{0?1w(2fon!6|8_qZojV-xE1$iqKs zVPKpk3(B(#k@xk=M-`*QF92*&|1KxU38@-#bi+y>l@z?qKt~~j2S&Vi_m`_8ObfIe z5Errc*1{Q!H-(GI@dVcrr2M&Dsd)cA{l#!1l}pZ?&i(F9>N^*!bL;xlTi+SIIJ3QA zfH{7@j*4fe=Q-euqM-Z4|~!nRA2dCp!pRKE@c|21C$uc?0@vqnknbw40RgGY9>FH(+U1LU6WO!cD;@wo1#ST zuSu900P6q86GiXAU|m$eMFr=;nF{o0BvK57UPHZJ;qEI5>SO0N{ zbD()~tj8KB`p7oICdKIam!B_>AR9`rp>TxXqO>i(t@`56B2g0{FAB$IUSDz*m0Sd? zK+zS(I=0#3Jnui2B8)p@uUbg;jgu`@ofT!N zQ66WhHjdxqCSy>WtTYEif5uRJh=vniY%yfVc^2A5GK6U0UCan~dPzcK(oyW`agx=h z8X;;$#HOP>RhHh-MYWvvZ?pM`5cz!z$(8s)?oDVhyPz%Ji!#;|{2Ni$AEy|T6OLVuw$kG1C=7y!kTqP;#XOExr8kZz zT3d;hxul_lAJgp3(&gWEjXpTpYD{vC59o|tuqhQc6p>1>^p?{`h8GbW$Sp=Ky~HQq z%bG_m?na<=>dF^i!_$88SE=jE<6n`&HBRjB&O-AW*0-BEX?(Hfi2eAEM_Q~TG+jQQ zG)e>4y2f2wH$-7hQS*E{w)Sil!j%_Roa(Nmz22B3y z#$#z)Ow!5^pJMBLo^2h&-{+ng3x7|%A?ayl{%X(u(4=#%YZL3C%hYtwiXF!AzS~p) zw{bo)(xZ6Zak{K_i~O^DB^!tlGt&zAjTFVn5}6eV1FcBUqFG^mo&VxH@T4dND_kIeiZmhfRHs6ZOd1KN6a3Npku zV--^^oRdjoTAUWo~u<>B)9TJzs$VB^y`)9`v2fL=`+ z1Dn!1!UH4Ej3GqMY)wRgxs+5uj4>1z3{mdXo)Xm)6X68QFzrc(S5jW*7FCT`XcY5u z%n)anY}po`Pd=r~B+s)3UvmmqFuCoif6ZVwyOb0dry->iPrI-&? z#Iwoi1pk|Px3Ly`ecUUCy+15}_7l`5)*ldJ8@U^2!DvNCT;}=+LEI>!lb+mBSkNRX z(R5#~CCI|{m;lS?w2nN2xo#xnwGC-$g_`LIOX|!u6>{b0I7+J!*(A#6zoD@7*{^-w z!G_`hJYIGK2s<-wk_jO_EoP^sBb%AhY@OVQ_nvIgUv5RS`DtHG-a=nLqOO4$3NwE2 zDt4*w!N=%_fy`u}HBDJM^Vtupdh$H0tLi7B?<;B`MG^Ziw4#b;K-K5|IP__Mp2bN# zRuy)h(-oSjMm6W0_wLO6>Dz3g8B7FKRBY!cPxud%Yo@u!<#*w-n5L3W@3SXP=1*V+ zn8HgTLQ$@8;uJsWVA!;V1h}jov1SP$JdrCNK!8_Ohw@-8H<8 zL12Ua7K7g6s8!u4ndh3%hT0clIdZ!|<^&AY6A(K*zX4UYm4K23R|Mov)(X-8nsv091v{b~|q{sG0 zrPmX$q9V>lj0(LS6YN0m$l5eT;0e4@*p{2s`L9=@TUA+wa=99er+j6r!t-q!qR7n(?WL8jf?=b6a(!<|w zQOm|}8naAJ^Np%QMFqbj4Lv=t=q`(>f>k!hq$9E!HwmJMT+K#{)*k!M zcqQGrTU4H5$UOwBi}KJ|^Hmi!cokf6Xb^G>h3>-raFl1OzhfQe0zJrO4QAH!*GO#| z==GF|tcOl9h!*R(X)1TVS?g$BeBxgZiP9@yOzp7PnRqoV14yoA$nshFz_+tiMTS>Om|>!OZnt7kWe>&?is z%1PhhL@UP_c~5^`qZ+BN(Z-XNw6V0IiZT*Hd>li9To$pNC1a(izU|H#e{YHkbTy#Zh@nq42#g^1E- zES7pbxf=luy7*B|h<@9VCutV^3;wd{KjxTj?^^kP|M8>a;3vfsb7x0}GCP$g5|0v0 zeCMjHEIL21ru^dk$h{n)w~6)iF!HDM;1Zy{M)Y~zk&B87+X8xJ$7dPS6BuGRb&hJ- ze%FKp)UbOo9p(nt!IWdAnOUe@@9of-4k&zcg~kwe3=l+ z_8hDUC;Ti^1{Pp`l0VXYo!o^p?4ndFML4$~=5-*`j34TdW8enK1S4arAKpqCiXk<` z^|2g@kRtgmnFdqO@D(;Z>rk96yXU(d|9@)%{0y;GkMLo@9H_VOT<++tun#p%w?Sx>ST9+Z68;f{%VT}kfJXD_Ad1vRtR=$NUYTNO@x zLPj^MVZIUU9?l&*3g%84_0v%9HEi~eJkuJybjCZiP$RFU!>xfmEbe-scP)}lsGM%l~mX}oP{4hZPdsH z1!zu1Ylq-2(4cmpXyTFi;x6%DbAXK%s`qH`hgWp$U~c)_b=nwsK9(w}U(-{jdB{lX zIA@a{{3P-^&8m%1m_we7UGeIYB9-<1rJ9Gq77|BV%q%BJQsZNu@Q#d`!gyxXf0Fkh=9BVl*wTCc zH*F)vFW+3h`p)EIL<5@nfF2l$8>{CJN_O~1zW(&Xl8G#5cC7vi6?)Q_IhO(O>2AO?FC!t zG`|?~X8lqXs_yDl6UOrTezYy3MSf+tb?wT_jnygP3)$Q??AV+x z1k3E}kuy(;LF|H_M*YQwL-j3=6im+#tG03J!pR&Ri;3;3+mSGH-30`%oHrMTa!g}2 zk5`8S3)hfaBR?ZsP(Kh2oRLB&t!(dwSM1&V(L$&c#YUtPRP=vA&M4L2b2H8}vpfwU z*7P~Tld9rxL=D{uwans^+$pj-ubJ^^rfPx3eI&>VtR^{c*5ZQLifHD>Bce&<-)^8; z^LaCa+@`#_Cg_lnKA$Zt)_Fg=Ar2wWei#oqBUj5l)(aPRv&}!{ znREP|U$sz^k*Ad5-5A@P-MFz@96cc6v9tFT zQh6l;Vb4cjslA4SY$4u3K{|v1iG0p@%Yr-=7h8Ep;%dRMewk;FxwFl~>jI|ec{$kjF4)Sq40 zZ+_aRC;%zeQkz7LU6Pq}J=R$8uWHz&WH}L|kxG~1mwpxkjz4#zlMpX67+kY=RXgj$ z0fzx8n?&L5$d6ID-rx&?l)vI7zsA^al#)B#2uXE*Eff6@XVtWZ)u}j zRYyzo&y$j9g<0o1#G1fw)bXgx!KinM&m~8M)@gc-c?>b*Y5mj`$Q?Rzy8oaXyTrK* zt6G1k$gts*SLA?acn6yxuF&~iQh4_qV&e+$pd6c^0iMY-=gb$*i0XO>$)6K9oA<8C zJ6pQ{v$ebAU-nAZ)sSkUAE?9*OOh!~{O`A*Qw29j=*YVT4_3$bR+!_3B-dQe&3j(VlvKQW;Qc3ccJ2rI=vOekU2%*YKl8M$6tqj0ReU0zzzbr> z`cFyUmXWJ1Qr#P>xH*pWd?QtPV>67*%4-bjw+_F~nE0MGOgY&$|?&oQALD=wiW?K^*xm zeWSukXo?Xu9Kdfbnv;H&(6Zb+Sgq2sY7L37tDHVkY|-*SBirx)9pEzJCnHRTpidG6 zX*MzHS`XfA%Y3@)NWLr5r;;vq~CgBjq)qe7J&=02IM6;oMy)xMNT&d_va7G80nU$olK3$-ITvw%^is zE>u7ibN-`Z>O%KL-@oy6&04QqhCeiifAq1E;nRg0%Lq^>vBT{t5yy=NXSqbb8ej}h)< z?=)-3#{)$=vX62Onc~l)s6LWN-%$2!gmk>at@C(1cH0}(`P=C8A<+c3scPx#?hVbU zW7=H_O95g0k;3#a>D)ZsTW;2Vz1%WHKIvbR90@jqhhvH2XX`psq8#=7(69Z~oaR0G*al)}S7&8vl8EZ^%dyqcL&SwB6E$5lBL*}Rfi?Nzu(gEJ z28^YJuRt!638X01(QVB&#uKUTC2d1|b(l6QJmf_DxHJ2T32@`-wbhI`aOgA$vMons zAGyDx6;f{FhEFhre=5(F&B60PKgze}u@@WCnuFcPWD8$bX{Cd~EEhy2X-~1?1 z2^KSGGxI6oz{NG$7sdTwr|n5AjQN{r0nUTJN)2J9?FBzrQFE>`{OJ0LM7{92 z2Si~kXiXwqp@Cin&OKa5%bm#bdcEgP%1~gY)R=jtdB_w9pU8as51E()$RO4wfc>)W zZ%G37`tb5g@uE8A^E0q3;8(51pev&*+JLzce#n5L!Zgr|CPo0)`s`L>D#vFMzdgNe z#g+)go3WQ`=`-I$wpJd+6Ju6V;tl7~<5^Ow=W9?Z62C9UwkUYsJa84ZqYA(9wQl8G-Mm@k`aC+!j)%&m=Eeme>`YCk>`E?j z+I^J#rh%(~krea=V?NhMkIv>8BIT8op>5nQVg4l@P&S9_`EUm^5X-s&e*qsgTHu>- z%5MMZip8OxF-4v0jw8gV(>CD980D;2!HDoDTPRcCIXz9>#aAr-Q=bjKj1qNaz>NSK zGqYNbEInmV8BgS7&^5?QA?@ceXe6u}6~0uw3w{F*<7kk^A7pLFH2KGFB87l;B zTmvb{3GpwzUok2*8sJ{bQeN^_Vu#6WcAYNF^FMnhg0^zBd!WdpD`Q4urR9f-%K%Je z34P-S=g!4Nl(j7ImUp01{*3FFbH9HZRx+ zz*;g*5~vSCaf4f+);;BN<@WCR1d@i^CX&|7{G1?460L_g!t_!?2+(j+V*|X>3^mz=ry(_l z7__D}&-&8@>{kY+4Pbbthj?NkIWMMYLEUQX^E&kF4orwXyX%mxp#iFXU7uAmYv7xL zRoHX#)w5zWlw5EwP`Tk=_1ThK8C;05$v4UX_fb0>4s|p-a`UhqvBh+L9O|@ih!#L; zi;O#J>20SB#(H3{+g}#^NCFYsAJHQ}N%yPSjlD%ZL7u9&)$Tc=7dCw(yme_e88C_U zi^j|$@6ptRv=)3vq3a*ZnX);4Plcl>K$y;no336wS9B>iDJUajxbaYDHbTCG5EYvi z_pl*0v?+mSj#($^7vtLxHBMK(xB9c z;7f74$=`DS+4~)fjmgo|F?kI!IU;RJEG}Mq0NGl8#ISS_q}*d>prde> zlR3?h0&$zun5mkS03C8~jb4SEf!_h}K1ZGPFGAd7Nnz&ebRq_85jIl?+9HF=Eg<0x zL)|UJWLC_THA-qTA704xhE@dTRMD4PyB;Ak#*EOZcCY zsQ3QoQ({QlbS(giNyplxr-VTndrB-Ds$qL=kF*`d_8iZMM4@^PQ56H7oYVWCo@u+D zb2Ppv(>OiOx1F|YrHc19!-VR_|2e=+m=-DkhCCU+F5Wk1!t~y=EV1BU~9pnCCR3dkh2H zCm%{M^rj31l9a^jfEL(Wh)Qa3WXy)tqKJa}2*9Npc+4LIPrvO)L-*hclaV$JJH<=> zIBnn0?H$l)JI6pqq=;ff9TShlZOr+eB@SxrvFh*Py~NHiK0+UnLv+}KQwhS!y@}f{m!lA z5BA<19*-#WOKn$o<%$PT%gkPQLOOA*#Wqi84U000j%0aM(@X!hnl_rC6RB2)hxL+t6+^#Cuchd#vdykVx+T-9pIE zp$OLZsUhcF-OUxyV8$4zNKO|8%fbw#lgC%z_iS8tFavb~iup1b4Z&Epj+z3NZI@anR2hG1%`6<+nn??bNl%6M!2@f0APU zj+9iHamMnQH`skt{_r)MH_4sycIfo&4BaR@Y3en(>hVP3(#;vKAQ(O?X&b!tVtEv< zA?e&$BsF8cJl!!1)%Mc!2I@h30Yy!*r7o?PrTk>?zIJDL%kqXh9SJLm7+Scnlbs|J z7C&Lo!-b&9hhFaW4sL`SX#|rnPgwbk&U*1=xB6DScmUvQ?sQm&y?30q>{^^2I=KVC zhBek;e$A$(c6Id72@DfcF6N5$?F3Yn()!|7j~28ra2Jf&%RvwujtjKDdE+Znk+{>) zhE`bQ!bqqCz-@iolJ9H@JrroaUXD;q*y^@ahD7c)e;kDvI-ba`T|C?#HpB0JVXkYR zSvpw4_#DElm>ZQ=uO7Y`7T(9*2rEDlAzKLE=-#lW?*>1+_MP&LZJ%#~up@-NYVg_o zw#tOrZ+SDPX4-0Vrs`8CKUvQ1Rd~SSqcP*V3k#kOF*UmbBNf;Lyz58J@fO=5^{1K9 z*xM3l<%Z^gsy4N;V`c6e^)Z-FTlmt2YA=1s$1myMi*!+GPEC@>?Mvk-gL=7PtzTP4 z;q-jAhsmS4c+PhjA#`#}mY`teiLxLwQizlQd+H@7;<^ju3!t0Ib&KKX)-K z!Mg0Kg-%dcbLf;c^$p<#Pa&u88nXeQ$}NWJ_0T~PgPfoJQCut}Sa;GY2wWfqD<6Jy z)PDturall&ei=SLP}M-GT-D--KlV4VF9Z#gw2B(J0Al;8Bf{bfbsYx21xlA~F5d?D4IoKAl)zQ( z2{($+Ln6f9J@HM%-TIv7Dn!1A_X9|-fV;EQ&BXNI6`gTZ9%8vC*evLBr+0OfJOX6~ zi19ywjk(ztW;!q#OKA;wNj+fEBII~U{Xnh+6bK+|2iv3ozt&$ritof~zJ$|KRwenS zRxTxq(3fi@WdQ{g4!=hr%?fXOa=;bqJ{YlDn@fzn+#j({L;+0;l|6SLHvYnguo>)$ zpl_C_9z=nvhq=B0Es47rEnE0>?V+ZzDwrJp!zvnOC3CjBh*$OE{X^BpB>iimfpp+T z)VoLC^K0Ls|;XR7Q$bu4(27{Jxsae<@z1o zxxxnLZ1ooJREL2i#_$X@heii0e=offA^7O0d{bXiYR`H$Q6UCUhD=$JkWka z3>&dF_H2@K3uR@p=YUt6pIT+*$lm>7lunXgRSIJY@i9r3%#8cB^=eve)rz)1p<8m% zy$P+5q~tAptmGIg9jyeKeq{_dMj%;_L%C@zFWk4
+ Activity Monitor +
Credit: Apple
+
You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command From 19969c7c33eac13d92a94715b128e20c95a261d4 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 24 Sep 2024 12:38:50 -0500 Subject: [PATCH 094/138] revert --- content/posts/macos/macOS Security Overview.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 496722a78..a482eb6be 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -27,10 +27,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -
- Activity Monitor -
Credit: Apple
-
+![Activity Monitor](/images/activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command From f730edb1a2feba42fc8d6357b7227e91edc386c5 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 27 Sep 2024 21:26:50 -0500 Subject: [PATCH 095/138] fix inaccurate lockdown mode info --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a482eb6be..8f662e6f3 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -105,7 +105,7 @@ Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-me ## Lockdown Mode -[Lockdown Mode](https://support.apple.com/en-us/105120) is an optional security feature that disables lots of attack surface in your Mac. It may break certain things like websites or apps, but you can disable it for individual apps or websites if you need to. +[Lockdown Mode](https://support.apple.com/en-us/105120) is an optional security feature that disables lots of attack surface in your Mac. It may break certain things like websites or apps, but you can disable it for individual websites if you need to. ## Custom umask From c8e270ce7047eede66b1806c361559cc7963aa07 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 29 Sep 2024 02:33:14 -0500 Subject: [PATCH 096/138] add remote management --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 8f662e6f3..a68651ce9 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -253,4 +253,8 @@ This adds a lot of attack surface to your machine, so it's best to avoid install ## Accessibility -Never give software [accessibility permissions](https://support.apple.com/en-my/guide/mac-help/mh43185/mac) unless you absolutely need them for genuine accessibility reasons. It's not uncommon for apps to ask for these permissions for eroneous things. \ No newline at end of file +Never give software [accessibility permissions](https://support.apple.com/en-my/guide/mac-help/mh43185/mac) unless you absolutely need them for genuine accessibility reasons. It's not uncommon for apps to ask for these permissions for eroneous things. + +## Remote Management + +If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0). \ No newline at end of file From c51d834b02f2d678eb25a5dbc2bd639ef021e3de Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 29 Sep 2024 02:35:55 -0500 Subject: [PATCH 097/138] add remote scripting --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a68651ce9..3e36e4172 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -257,4 +257,4 @@ Never give software [accessibility permissions](https://support.apple.com/en-my/ ## Remote Management -If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0). \ No newline at end of file +If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0) and [remote application scripting](https://support.apple.com/en-mide/guide/mac-help/mchlp1398/mac). \ No newline at end of file From e9449268b9c52dc7d19a82ba4859f2eefff4aabf Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 29 Sep 2024 02:43:24 -0500 Subject: [PATCH 098/138] add firewall command --- content/posts/macos/macOS Security Overview.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 3e36e4172..a5c4f2aa8 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -169,6 +169,14 @@ macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/ Avoid third-party firewalls like LittleSnitch or LuLu that require you to install a system extension. They don't cover DNS so data exfiltration is still possible. +To block an app from the Terminal, run the command + +```zsh +/usr/libexec/ApplicationFirewall/socketfilterfw --blockapp +``` + +Some software might not allow you to block it in the UI, you can use this command to bypass it. + ## Disable AirDrop and Handoff You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." From a27042c48508c8fc9417e9b0ab840549226f3bf7 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 29 Sep 2024 02:46:54 -0500 Subject: [PATCH 099/138] make commands more consistent --- content/posts/macos/macOS Security Overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a5c4f2aa8..2ae0c24e6 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -32,7 +32,7 @@ You can check whether running processes are sandboxed in the Activity Monitor. R You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command ``` zsh -% codesign -dvvv --entitlements - +codesign -dvvv --entitlements - ``` If the app is sandboxed, you will see @@ -54,7 +54,7 @@ Unlike the App Sandbox, the Hardened Runtime is required in order for an app to Check if an app is using the Hardened Runtime before running it with the command ``` zsh -codesign --display --verbose /path/to/bundle.app +codesign --display --verbose ``` You will see `flags=0x10000(runtime)` if it's enabled. From 2692183dbe57ed39c1ceb371a92ce26288914535 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 22 Oct 2024 13:31:51 -0500 Subject: [PATCH 100/138] remove broken link --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 2ae0c24e6..a8b6ef531 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -179,7 +179,7 @@ Some software might not allow you to block it in the UI, you can use this comman ## Disable AirDrop and Handoff -You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." +You can disable AirDrop and Handoff to better protect yourself against nearby threats. Go to General > AirDrop and Handoff. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." ## Bluetooth From 95c3593d44648d6929a9ccf470101661c7dd5abd Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 22 Oct 2024 14:29:34 -0500 Subject: [PATCH 101/138] move files to fit with convention --- .../macOS Security Overview}/activity-monitor.png | Bin .../index.md} | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename {static/images => content/posts/macos/macOS Security Overview}/activity-monitor.png (100%) rename content/posts/macos/{macOS Security Overview.md => macOS Security Overview/index.md} (99%) diff --git a/static/images/activity-monitor.png b/content/posts/macos/macOS Security Overview/activity-monitor.png similarity index 100% rename from static/images/activity-monitor.png rename to content/posts/macos/macOS Security Overview/activity-monitor.png diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview/index.md similarity index 99% rename from content/posts/macos/macOS Security Overview.md rename to content/posts/macos/macOS Security Overview/index.md index a8b6ef531..b311bf2da 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -27,7 +27,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](/images/activity-monitor.png) +![Activity Monitor](../activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command From 215a6a650c480ff571e20d6186652e9e9d427ff1 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 22 Oct 2024 14:32:00 -0500 Subject: [PATCH 102/138] fix image --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index b311bf2da..ad74778bf 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -27,7 +27,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](../activity-monitor.png) +![Activity Monitor](activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command From 60509c7a9a31569fc1c93c70e7c2a3791e09122e Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 25 Oct 2024 14:20:59 -0500 Subject: [PATCH 103/138] add info about icloud --- content/posts/macos/macOS Security Overview/index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index ad74778bf..39c1a13f4 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -223,6 +223,8 @@ You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a If you use iCloud, you should enable [Advanced Data Protection](https://support.apple.com/en-us/108756) so that your files are E2EE. +If you want to be able to install apps from the App Store without enabling iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**. + You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple Account for extra protection. ## Touch ID From 5fe12886f68207b7f01fd2d545b9e3bb394abd05 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 25 Oct 2024 14:25:40 -0500 Subject: [PATCH 104/138] add info about encrypted swap --- content/posts/macos/macOS Security Overview/index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 39c1a13f4..311c1ff4f 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -267,4 +267,8 @@ Never give software [accessibility permissions](https://support.apple.com/en-my/ ## Remote Management -If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0) and [remote application scripting](https://support.apple.com/en-mide/guide/mac-help/mchlp1398/mac). \ No newline at end of file +If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0) and [remote application scripting](https://support.apple.com/en-mide/guide/mac-help/mchlp1398/mac). + +## Encrypted Swap + +macOS encrypts its [virtual memory](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). Note that regular RAM is not encrypted, only virtual memory. \ No newline at end of file From 0d127d575fdc3f112d22e357aa4f263c94130bc3 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 26 Oct 2024 01:32:53 -0500 Subject: [PATCH 105/138] add info about shortcuts and configuration profiles --- content/posts/macos/macOS Security Overview/index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 311c1ff4f..7f08a8815 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -271,4 +271,8 @@ If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-h ## Encrypted Swap -macOS encrypts its [virtual memory](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). Note that regular RAM is not encrypted, only virtual memory. \ No newline at end of file +macOS encrypts its [virtual memory](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). Note that regular RAM is not encrypted, only virtual memory. + +## Configuration Profiles and Shortcuts + +Configuration Profiles and Shortcuts are very powerful, so you should avoid installing or running ones made by other people. Make sure you understand everything it's doing before you install a profile or run a Shortcut. \ No newline at end of file From 7b4a438cb552269874842d89a13a276628c4dd64 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Thu, 31 Oct 2024 12:17:49 -0500 Subject: [PATCH 106/138] remove extra sentence --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 7f08a8815..f55644a3e 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -271,7 +271,7 @@ If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-h ## Encrypted Swap -macOS encrypts its [virtual memory](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). Note that regular RAM is not encrypted, only virtual memory. +macOS encrypts its [virtual memory](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). ## Configuration Profiles and Shortcuts From 64d50fe935e592fa0ae94d1280fd29a41eabdcd4 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Thu, 31 Oct 2024 14:08:01 -0500 Subject: [PATCH 107/138] update links for sequoia --- content/posts/macos/macOS Security Overview/index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index f55644a3e..c6b2ad7fe 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -123,7 +123,7 @@ When you first set up your Mac, you will create an Administrator account that ha You can [hide an administrator account](https://support.apple.com/en-us/102099) so you don't accidentally log into it. -Also make sure to set a strong password for any accounts you make and set a time after which a user will [automatically be logged out](https://support.apple.com/guide/mac-help/set-your-mac-to-log-out-when-not-in-use-mchlp2443/14.0/mac/14.0). +Also make sure to set a strong password for any accounts you make and set a time after which a user will [automatically be logged out](https://support.apple.com/guide/mac-help/set-your-mac-to-log-out-when-not-in-use-mchlp2443/15.0/mac/15.0). By default, users can read folders and files in other users' home directories, other than the Desktop, Downloads, Movies, Music, and Pictures folders. To fix this, run this in the Terminal: @@ -135,13 +135,13 @@ done ## Lock Screen Security -Make sure you [require users to login](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac#mchlpf5777a4) and set your Mac to [require a password](https://support.apple.com/guide/mac-help/require-a-password-after-waking-your-mac-mchlp2270/14.0/mac/14.0) after waking up. +Make sure you [require users to login](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac#mchlpf5777a4) and set your Mac to [require a password](https://support.apple.com/guide/mac-help/require-a-password-after-waking-your-mac-mchlp2270/15.0/mac/15.0) after waking up. Use the Control + Command + Q keyboard shortcut to lock your screen any time you leave your computer. ## Automatically Empty Trash -You can set the trash to [automatically empty](https://support.apple.com/en-ca/guide/mac-help/mchlp1093/14.0/mac/14.0#mchl0deca7f1) every 30 days to prevent old unwanted files from sticking around. +You can set the trash to [automatically empty](https://support.apple.com/en-ca/guide/mac-help/mchlp1093/15.0/mac/15.0#mchl0deca7f1) every 30 days to prevent old unwanted files from sticking around. ## Show File Extensions @@ -217,7 +217,7 @@ If you choose to backup your Mac, you should do so with [Time Machine](https://s In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in using Disk Utility. -You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a-checksum-to-a-disk-image-dskutl1019/22..6/mac/14.0) and [verify it later](https://support.apple.com/guide/disk-utility/verify-a-disk-images-data-corrupted-utility-dskutl15186/22..6/mac/14.0) to ensure data integrity. +You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a-checksum-to-a-disk-image-dskutl1019/22.6/mac/15.0) and [verify it later](https://support.apple.com/guide/disk-utility/verify-a-disk-images-data-isnt-corrupted-dskutl15186/22.6/mac/15.0) to ensure data integrity. ## iCloud Security From ac925d29265a6a2377e1f00b5a9618a1ac465d51 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 05:40:28 -0600 Subject: [PATCH 108/138] add memory encryption info --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index c6b2ad7fe..2a12e83a3 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -15,7 +15,7 @@ FileVault works with two encryption keys: the volume key and the class key. The All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. -Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it. +Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs don't have memory encryption, ## App Sandbox From 60b2f5f5256808b74142821cb0e649fd98fa1483 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 05:50:52 -0600 Subject: [PATCH 109/138] grammar --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 2a12e83a3..092a160f4 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -15,7 +15,7 @@ FileVault works with two encryption keys: the volume key and the class key. The All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. -Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs don't have memory encryption, +Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs don't have memory encryption. ## App Sandbox From 6918ed690c31eeaedce43de13ddfc632f547405f Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:05:12 -0600 Subject: [PATCH 110/138] add hibernate info --- content/posts/macos/macOS Security Overview/index.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 092a160f4..fa0ad1e6b 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -17,6 +17,13 @@ All encryption keys are handled by the Secure Enclave and are never exposed to t Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs don't have memory encryption. +macOS keeps the encryption key in memory when sleeping so that you can quickly resume what you were doing. You can set the Mac to hiberate after a certain amount of time and destroy the FileVault key, leaving your data in a much more secure state. To set your Mac to hibernate destroy the key on hibernating: + +```zsh +sudo pmset -a destroyfvkeyonstandby 1 +sudo pmset -a hibernatemode 25 +``` + ## App Sandbox The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. From 2b9fe74a0759e8b1b34ab81f1740cc17e7fef2d4 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:12:33 -0600 Subject: [PATCH 111/138] add app container info --- content/posts/macos/macOS Security Overview/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index fa0ad1e6b..c741b9826 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -26,7 +26,9 @@ sudo pmset -a hibernatemode 25 ## App Sandbox -The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. +The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. + +Sandboxed apps are given their own container in `~/Library/Containers` that they have exclusive read/write access to. The App Sandbox is designed to limit the damage to your system in the event an app is exploited, however it can't protect against malicious developers since they can just disable or weaken the sandbox in a future update if they want. For protection against malicious developers, you'll need to install apps from the App Store where the sandbox is enforced. From d0fd1ee2fc790d984322fdad03e40fbedb9e9339 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:16:16 -0600 Subject: [PATCH 112/138] remove inaccurate gatekeeper info --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index c741b9826..aed4db5bf 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -72,7 +72,7 @@ You will see `flags=0x10000(runtime)` if it's enabled. [Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. -While the Gatekeeper warning can be easily bypassed by going to **Privacy & Security** in the settings and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. +The Gatekeeper warning can be easily bypassed by going to **Privacy & Security** in the settings and clicking open. You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to only allow apps downloaded from the App Store if you choose. It will still be bypassable but it will stop apps from being run that aren't from the app store without you explicitly allowing it. From a35fa703ebda0a900c5157d744027503bbcb8dda Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:16:51 -0600 Subject: [PATCH 113/138] capitalization --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index aed4db5bf..d6de8cf0e 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -74,7 +74,7 @@ You will see `flags=0x10000(runtime)` if it's enabled. The Gatekeeper warning can be easily bypassed by going to **Privacy & Security** in the settings and clicking open. -You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to only allow apps downloaded from the App Store if you choose. It will still be bypassable but it will stop apps from being run that aren't from the app store without you explicitly allowing it. +You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to only allow apps downloaded from the App Store if you choose. It will still be bypassable but it will stop apps from being run that aren't from the App Store without you explicitly allowing it. ## Apps vs Other Executables From 601d3bc0b8f5539e23bd2c471846a1d2bfde1676 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:33:50 -0600 Subject: [PATCH 114/138] add reset TCC info --- content/posts/macos/macOS Security Overview/index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index d6de8cf0e..fa71c43ed 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -86,6 +86,18 @@ macOS has permissions that apply to all software across the system, called Trans The Downloads, Desktop, Documents, Movies, Music, and Pictures folders for each user in particular are protected by permissions and thus are more secure than other places you might save your files. Consider using these folders for particularly sensitive data. +TCC doesn't have temporary permissions, so it can be useful to reset all premissions for an app at once. To do this, first find the app's bundle ID by running the command: + +```zsh +osascript -e 'id of app "[name of app]"' +``` + +Reset the permissions with the command: + +```zsh +sudo tccutil reset All [app.bundle.id] +``` + ## XProtect XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. From a5fa99b03b31c0d93af75b09d98b84e5e2b03813 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:34:52 -0600 Subject: [PATCH 115/138] remove recommendation to never turn off SIP --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index fa71c43ed..83b62ca32 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -108,7 +108,7 @@ Apple also issues revocations for notarization tickets, which are detected with ## System Integrity Protection -[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. Since it's protecting your base system files, you should **never** disable it even temporarily if you want the best security. +[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. On Apple Silicon Macs, it's combined with [Kernel Integrity Protection](https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/web#sec41bf3cd61) to protect kernel memory from being exploited. From 1249f170ae261abaf1de5f899b2e2c651ef13c18 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:36:43 -0600 Subject: [PATCH 116/138] remove rossetta 2 --- content/posts/macos/macOS Security Overview/index.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 83b62ca32..367991895 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -264,10 +264,6 @@ You can [randomize your MAC address](https://support.apple.com/en-gb/guide/mac-h To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple Account password to turn off Find My if you've enabled it previously. -## Rosetta 2 - -Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a translation layer that lets you run Intel apps on an ARM Mac. Since it allows you to run more software than you could otherwise run, installing Rosetta 2 increases your attack surface and should be avoided unless you absolutely need it. - ## Keychain [Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1) is the secure keystore in macOS. There's also a built-in [password manager](https://support.apple.com/en-us/105115) that can securely keep track of your passwords and generate new secure passwords. From 8403b920514ee71c4c9b326850523c4b6a33fd0f Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:30:12 -0600 Subject: [PATCH 117/138] add TCC warning and change the section name --- content/posts/macos/macOS Security Overview/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 367991895..f4436b014 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -80,12 +80,14 @@ You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not other types of executable files, so when installing non-apps, you should be extremely careful. If possible, avoid installing non-app software altogether or install it in a virtual machine. -## Systemwide Permissions +## TCC macOS has permissions that apply to all software across the system, called Transparency, Consent and Control (TCC). These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. The Downloads, Desktop, Documents, Movies, Music, and Pictures folders for each user in particular are protected by permissions and thus are more secure than other places you might save your files. Consider using these folders for particularly sensitive data. +Be very careful about granting permissions even to default macOS apps since it might have unintended consequences. For example, granting the Terminal full disk access can allow unsandboxed apps to cause it to run commands by tampering with the `~/.zshrc` file which is executed by the Terminal every time it opens. + TCC doesn't have temporary permissions, so it can be useful to reset all premissions for an app at once. To do this, first find the app's bundle ID by running the command: ```zsh From b41b6b761d585c5355e695ad71ef3e70d7c3d639 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:32:01 -0600 Subject: [PATCH 118/138] add info about unsandboxed apps --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index f4436b014..f33063ef7 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -28,7 +28,7 @@ sudo pmset -a hibernatemode 25 The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. -Sandboxed apps are given their own container in `~/Library/Containers` that they have exclusive read/write access to. +Sandboxed apps are given their own container in `~/Library/Containers` that they have exclusive read/write access to. Unsandboxed apps can't access it unless they have root privileges. The App Sandbox is designed to limit the damage to your system in the event an app is exploited, however it can't protect against malicious developers since they can just disable or weaken the sandbox in a future update if they want. For protection against malicious developers, you'll need to install apps from the App Store where the sandbox is enforced. From a78a75e176fa4ac9bfa666ad3805ec4528161d10 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:41:08 -0600 Subject: [PATCH 119/138] add gatekeeper disclaimer --- content/posts/macos/macOS Security Overview/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index f33063ef7..f1bf24df3 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -70,7 +70,9 @@ You will see `flags=0x10000(runtime)` if it's enabled. ## Gatekeeper -[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. +[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) is meant to warn you about running apps that aren't notarized, however it relies on the quarantine attribute being added which won't work on filesystems that don't support it like FAT32. Gatekeeper shouldn't be relied on since it doesn't cover all software and there are ways of bypassing it. + +Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. The Gatekeeper warning can be easily bypassed by going to **Privacy & Security** in the settings and clicking open. From 473277a745b5b305af55393a2c41fe7e9408aa9b Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:46:48 -0600 Subject: [PATCH 120/138] add info about fixed mac address --- content/posts/macos/macOS Security Overview/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index f1bf24df3..29291f2ea 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -256,13 +256,15 @@ You can also add a [security key](https://support.apple.com/en-us/102637) to you Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. The fingerprint data never leaves the device. +You can + ## Network Security Prefer networks that support [WPA3](https://support.apple.com/en-us/102766#security) and avoid networks that use deprecated protocols. Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hiddennetwork) as they require your device to broadcast the network SSID which could be used to fingerprint you and identify the networks you connect to. -You can [randomize your MAC address](https://support.apple.com/en-gb/guide/mac-help/mh11935/15.0/mac/15.0#mchldb2b7302) in Network settings. Set it to rotating and you'll periodically get a new one. +You can [randomize your MAC address](https://support.apple.com/en-gb/guide/mac-help/mh11935/15.0/mac/15.0#mchldb2b7302) in Network settings. Set it to rotating and you'll periodically get a new one. By default, it's set to Fixed which will give you a different MAC address for every network, but when you reconnect to the same network it will be the same. ## Securely Erase Your Mac From 9183a984b18ed48014a2c16f676d54f16fb88bd2 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:50:46 -0600 Subject: [PATCH 121/138] add extension info --- content/posts/macos/macOS Security Overview/index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 29291f2ea..281be294a 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -178,6 +178,8 @@ There are two types of [system extensions](https://support.apple.com/en-us/12036 Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when **absolutely necessary**. +Removing an app doesn't remove the system extensions associated with it. You can use the `systemextensionctl` command to list and manage extensions. You may need to disable SIP before you can remove extensions. + ## Apps Requiring Admin Be careful installing apps that require Administrator privileges to run, you're giving them a lot of power in your system. From 4f9426b8d4a13e236ba6161b149927e3f5b1ea9c Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:54:01 -0600 Subject: [PATCH 122/138] add info about wahts not e2ee in ADP --- content/posts/macos/macOS Security Overview/index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 281be294a..2f82b44a0 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -250,6 +250,8 @@ You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a If you use iCloud, you should enable [Advanced Data Protection](https://support.apple.com/en-us/108756) so that your files are E2EE. +Notethat your [calendar, email, and contacts](https://support.apple.com/en-us/102651) are not E2EE due to protocol limitations. + If you want to be able to install apps from the App Store without enabling iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**. You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple Account for extra protection. From df74a8f01247a635f9d9e4f35493eb9bf3579a62 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:58:39 -0600 Subject: [PATCH 123/138] add third party app e2ee info --- content/posts/macos/macOS Security Overview/index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 2f82b44a0..c323811fe 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -250,7 +250,9 @@ You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a If you use iCloud, you should enable [Advanced Data Protection](https://support.apple.com/en-us/108756) so that your files are E2EE. -Notethat your [calendar, email, and contacts](https://support.apple.com/en-us/102651) are not E2EE due to protocol limitations. +Note that your [calendar, email, and contacts](https://support.apple.com/en-us/102651) are not E2EE due to protocol limitations. + +Third party apps can use E2EE, but they must[ explicitly opt-in](https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web#sec184c512e7) to it. If you want to be able to install apps from the App Store without enabling iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**. From 53fccba6ec5be586041d02a0dab670d665a8ce1a Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Tue, 26 Nov 2024 07:58:56 -0600 Subject: [PATCH 124/138] spacing --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index c323811fe..67d14e86d 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -252,7 +252,7 @@ If you use iCloud, you should enable [Advanced Data Protection](https://support. Note that your [calendar, email, and contacts](https://support.apple.com/en-us/102651) are not E2EE due to protocol limitations. -Third party apps can use E2EE, but they must[ explicitly opt-in](https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web#sec184c512e7) to it. +Third party apps can use E2EE, but they must [explicitly opt-in](https://support.apple.com/guide/security/advanced-data-protection-for-icloud-sec973254c5f/web#sec184c512e7) to it. If you want to be able to install apps from the App Store without enabling iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**. From 4f30fcc529cc1e41f5d651b0ab5b1d8f30bc3ca2 Mon Sep 17 00:00:00 2001 From: Tommy Date: Wed, 27 Nov 2024 07:15:23 -0700 Subject: [PATCH 125/138] Update post Signed-off-by: Tommy --- .../macos/macOS Security Overview/index.md | 112 +++++++++--------- 1 file changed, 58 insertions(+), 54 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 67d14e86d..e005cb9e3 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -2,35 +2,28 @@ title: "macOS Security Overview" date: 2024-08-09 tags: ['macOS', 'Security'] -author: kimg45 +author: kimg45, Tommy --- -macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. This guide assumes you're running on official Apple hardware that's officially supported by the latest stable version of macOS. +macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. This post assumes you're running on official Apple hardware that's officially supported by the latest stable version of macOS. -## FileVault +## Encryption By default, your macOS install is encrypted, but it will automatically unlock on boot. Turning on [FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) will require a user password to unlock the volume. It also makes it so that you need to enter a user password to enter recovery mode. FileVault works with two encryption keys: the volume key and the class key. The volume key encrypts the data in your drive and with FileVualt turned on, the class key encrypts the volume key. The class key is protected by a combination of the user’s password and the hardware UID when FileVault is turned on, meaning that the user password is required and the key is tied to the device and can't be decrypted outside the actual hardware. -All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. +All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. Swap space is also [encrypted](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). -Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs don't have memory encryption. - -macOS keeps the encryption key in memory when sleeping so that you can quickly resume what you were doing. You can set the Mac to hiberate after a certain amount of time and destroy the FileVault key, leaving your data in a much more secure state. To set your Mac to hibernate destroy the key on hibernating: - -```zsh -sudo pmset -a destroyfvkeyonstandby 1 -sudo pmset -a hibernatemode 25 -``` +Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs do not have memory encryption. ## App Sandbox -The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. +The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app. -Sandboxed apps are given their own container in `~/Library/Containers` that they have exclusive read/write access to. Unsandboxed apps can't access it unless they have root privileges. +Sandboxed apps are given their own directories in `~/Library/Containers` that they have exclusive read/write access to. Unsandboxed apps can't access them unless they have root privileges. -The App Sandbox is designed to limit the damage to your system in the event an app is exploited, however it can't protect against malicious developers since they can just disable or weaken the sandbox in a future update if they want. For protection against malicious developers, you'll need to install apps from the App Store where the sandbox is enforced. +The App Sandbox is designed to limit the damage to your system in the event an app is exploited, however it cannot protect against malicious developers since they can just disable the sandbox in a future update. For protection against malicious developers, you'll need to install apps from the App Store where having the sandbox enabled is enforced. There are a few ways to check whether an app is sandboxed: @@ -56,9 +49,9 @@ You can enable a column in Activity Monitor called "Restricted" which is a flag ## Hardened Runtime -The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an optional security feature that developers can enable that makes an app more resistant to exploitation. Like the App Sandbox, it's enabled through a flag when the developers sign it so you aren't able to control it for apps you run. It prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. +The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an optional security feature that developers can enable that makes an app more resistant to exploitation. Like the App Sandbox, it's enabled through an entitlement when the developers sign it so you aren't able to control it for apps you run. It prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. -Unlike the App Sandbox, the Hardened Runtime is required in order for an app to be notarized and so you'll be warned by Gatekeeper if an app doesn't use it. While this warning is bypassable, you should be cautious and investigate a bit more before running it. +Unlike the App Sandbox, the Hardened Runtime is required in order for an app to be notarized and so you will be warned by Gatekeeper if an app doesn't use it. While this warning is dismissable, you should be cautious and investigate a bit more before running the app. Check if an app is using the Hardened Runtime before running it with the command @@ -70,17 +63,25 @@ You will see `flags=0x10000(runtime)` if it's enabled. ## Gatekeeper -[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) is meant to warn you about running apps that aren't notarized, however it relies on the quarantine attribute being added which won't work on filesystems that don't support it like FAT32. Gatekeeper shouldn't be relied on since it doesn't cover all software and there are ways of bypassing it. +[Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) is a security protection which serves two purposes: +- To warn the user about apps that aren't notarized. +- To notify the user that you are running an app downloaded outside of the App Store the first time you run it. + +Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. Warnings about notarization can be dismissed by going to **Privacy & Security** in the settings and clicking open. + +To prompt the user that they are running an app downloaded outside of the app store for the first time, Gatekeeper checks for the quarantine extended attribute. This attribute, however, requires filesystem support and the tool used to download the application to set it. As such, it is trivially bypassable and **should not be relied upon**. For example, Gatekeeper will not prompt a user if they try to run an app for the first time on a FAT32 flash drive. -Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. +Another thing to note is that when changed to [only allow apps downloaded from the App Store](https://support.apple.com/en-us/102445), Gatekeeper will not warn you about apps that have been previously launched on the system and is still bypassable. -The Gatekeeper warning can be easily bypassed by going to **Privacy & Security** in the settings and clicking open. +## Other Executables -You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to only allow apps downloaded from the App Store if you choose. It will still be bypassable but it will stop apps from being run that aren't from the App Store without you explicitly allowing it. +Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps (packaged with the .app extension) and not other types of executables. They also do not apply to CLI utils shipped inside an app if you invoke them directly using the terminal. -## Apps vs Other Executables +## Command Line Tools + +If you need developer tools like Python and git, you can install Xcode and get them with automatic updates without having to install any third-party software. Alternatively, you can use the command `xcode-select --install` to install the tools without Xcode. -Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not other types of executable files, so when installing non-apps, you should be extremely careful. If possible, avoid installing non-app software altogether or install it in a virtual machine. +This adds a lot of attack surface to your machine, so it's best to avoid installing developer tools unless you absolutely need them. ## TCC @@ -88,8 +89,6 @@ macOS has permissions that apply to all software across the system, called Trans The Downloads, Desktop, Documents, Movies, Music, and Pictures folders for each user in particular are protected by permissions and thus are more secure than other places you might save your files. Consider using these folders for particularly sensitive data. -Be very careful about granting permissions even to default macOS apps since it might have unintended consequences. For example, granting the Terminal full disk access can allow unsandboxed apps to cause it to run commands by tampering with the `~/.zshrc` file which is executed by the Terminal every time it opens. - TCC doesn't have temporary permissions, so it can be useful to reset all premissions for an app at once. To do this, first find the app's bundle ID by running the command: ```zsh @@ -102,27 +101,37 @@ Reset the permissions with the command: sudo tccutil reset All [app.bundle.id] ``` +It is important to note that TCC is not a panacea, especially with unsandboxed app. TCC only protects a very limited number of directories, and unsandboxed apps can abuse their file system access to attack each other. For example, TCC does not protect `~/.zshrc`, allowing unsandboxed apps to inject their own commands to the file, which the Terminal app will execute at launch. If the user grants the terminal to all files on the system, then a malicious unsandboxed app can also gain access to all files on the system through the Terminal app. As such, it is crucial that you only give the minimum amount of privileges to apps, including ones written by Apple. + ## XProtect XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, which are detected with encrypted online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. +Apple also issues revocations for notarization tickets, which are detected with OCSP checks over https. While OCSP checks may reveal to Apple which type of apps a user on an IP address is using, it is not recommended that you this check as it will break a very important security feature. Instead, you are better off using a commercial VPN to blend in with other Mac users. + +## Verified Boot + +Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself (assuming Full Security is enabled). It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. + +Macs let you reduce your boot security by setting a [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web). It's best to leave it set to Full Security. + +A unique feature of Mac computers is that you can set a different [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web) for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. Avoid lowering the security policy below Full Security for any operating system you require to be secure, even temporarily. ## System Integrity Protection -[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. +[SIP](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) protects certain [system files](https://support.apple.com/en-us/102149) from being changed, even by the root user. This protection goes beyond what is provided by verified boot. -On Apple Silicon Macs, it's combined with [Kernel Integrity Protection](https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/web#sec41bf3cd61) to protect kernel memory from being exploited. +On Apple Silicon Macs, SIP is combined with [Kernel Integrity Protection](https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/web#sec41bf3cd61) to protect kernel memory from being exploited. -## Secure Boot +## System Extensions -Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself (assuming Full Security is enabled). It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. +There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them. They're being phased out more and more with every version of macOS. -Macs let you reduce your boot security by setting a [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web). It's best to leave it set to Full Security. +Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when **absolutely necessary**. -A unique feature of Mac computers is that you can set a different [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web) for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. Avoid lowering the security policy below Full Security for any operating system you require to be secure, even temporarily. +Removing an app doesn't automatically remove the system extensions associated with it. You can use the `systemextensionctl` command to list and manage extensions. You may need to disable SIP before you can remove extensions. ## DMA Protection @@ -172,14 +181,6 @@ You can set the trash to [automatically empty](https://support.apple.com/en-ca/g You should set Finder to always [show all file extensions](https://support.apple.com/en-ca/guide/mac-help/mchlp2304/mac) to help you see when a file is masquerading as another filetype. -## System Extensions - -There are two types of [system extensions](https://support.apple.com/en-us/120363) on macOS: legacy system extensions (also known as kernel extensions) and system extensions. Kernel extensions modify the actual kernel, giving the software extremely low-level access to your system. These are very dangerous and in fact you need to lower your security policy to even load them. They're being phased out more and more with every version of macOS. - -Newer system extensions don't directly modify the kernel, but they use APIs that give them lower level access to your system than regular apps. You should be very cautious with these as well and only allow them when **absolutely necessary**. - -Removing an app doesn't remove the system extensions associated with it. You can use the `systemextensionctl` command to list and manage extensions. You may need to disable SIP before you can remove extensions. - ## Apps Requiring Admin Be careful installing apps that require Administrator privileges to run, you're giving them a lot of power in your system. @@ -238,7 +239,7 @@ Apple makes beta updates available, however you should avoid installing them in ## Encrypted Backups -If you choose to backup your Mac, you should do so with [Time Machine](https://support.apple.com/en-us/104984) and not a third party program. You should [encrypt your backups](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac) for added security. +If you choose to backup your Mac, you should do so with [Time Machine](https://support.apple.com/en-us/104984) and not a third party program. You should [encrypt your backups](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac). ## Encrypted Disk Image @@ -262,7 +263,12 @@ You can also add a [security key](https://support.apple.com/en-us/102637) to you Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. The fingerprint data never leaves the device. -You can +You can enable `sudo` with Touch ID by adding the following above lines with "required" in `/etc/pam.d/sudo`: + +``` +auth sufficient pam_tid.so +``` + ## Network Security @@ -270,7 +276,7 @@ Prefer networks that support [WPA3](https://support.apple.com/en-us/102766#secur Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hiddennetwork) as they require your device to broadcast the network SSID which could be used to fingerprint you and identify the networks you connect to. -You can [randomize your MAC address](https://support.apple.com/en-gb/guide/mac-help/mh11935/15.0/mac/15.0#mchldb2b7302) in Network settings. Set it to rotating and you'll periodically get a new one. By default, it's set to Fixed which will give you a different MAC address for every network, but when you reconnect to the same network it will be the same. +By default, macOS uses a random MAC address for each SSID. However, it also defaults to using the "Fixed" randomization mode, re-using the same MAC address for SSID instead of changing it on every connection. Essentially, this allows network operators to recognize that you are the same user that has previously connected to the network. Consider changing the randomization mode to "Rotating" depending on your threat model. ## Securely Erase Your Mac @@ -278,17 +284,19 @@ To completely wipe your Mac securely, use the [Erase All Content and Settings](h ## Keychain -[Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1) is the secure keystore in macOS. There's also a built-in [password manager](https://support.apple.com/en-us/105115) that can securely keep track of your passwords and generate new secure passwords. +[Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1) is the secure keystore in macOS. Unlike the `org.freedesktop.Secrets` dbus implementation found in most Linux distributions, macOS's Keychain supports scoped access, allowing secrets to only be accessible by applications associated with it. -## iCloud Private Relay +On macOS Sequoia, the Keychain Access app is hidden from launchpad. However, it still exists on the system. You can access it by running the following in the Terminal: -With an iCloud+ subscription, you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. +```bash +open /System/Library/CoreServices/Applications/Keychain Access.app +``` -## Command Line Tools +There's also a built-in [password manager](https://support.apple.com/en-us/105115) that can securely keep track of your passwords and generate new secure passwords. -If you need developer tools like Python and git, you can install Xcode and get them with automatic updates without having to install any third-party software. Alternatively, you can use the command `xcode-select --install` to install the tools without Xcode. +## iCloud Private Relay -This adds a lot of attack surface to your machine, so it's best to avoid installing developer tools unless you absolutely need them. +With an iCloud+ subscription, you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. ## Accessibility @@ -298,10 +306,6 @@ Never give software [accessibility permissions](https://support.apple.com/en-my/ If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0) and [remote application scripting](https://support.apple.com/en-mide/guide/mac-help/mchlp1398/mac). -## Encrypted Swap - -macOS encrypts its [virtual memory](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). - ## Configuration Profiles and Shortcuts -Configuration Profiles and Shortcuts are very powerful, so you should avoid installing or running ones made by other people. Make sure you understand everything it's doing before you install a profile or run a Shortcut. \ No newline at end of file +Configuration Profiles and Shortcuts are very powerful, so you should avoid installing or running ones made by other people. Make sure you understand everything it's doing before you install a profile or run a Shortcut. From aa266d283e572a40c5badd6790ae6c84a101d66c Mon Sep 17 00:00:00 2001 From: Tommy Date: Wed, 27 Nov 2024 07:23:02 -0700 Subject: [PATCH 126/138] Typo Fix Signed-off-by: Tommy --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index e005cb9e3..febc4efa2 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -109,7 +109,7 @@ XProtect is the built-in antivirus software in macOS. Like all AV, it's a last l XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, which are detected with OCSP checks over https. While OCSP checks may reveal to Apple which type of apps a user on an IP address is using, it is not recommended that you this check as it will break a very important security feature. Instead, you are better off using a commercial VPN to blend in with other Mac users. +Apple also issues revocations for notarization tickets, which are detected with OCSP checks over https. While OCSP checks may reveal to Apple which type of apps a user on an IP address is using, it is not recommended that you disable this check as it will break a very important security feature. Instead, you are better off using a commercial VPN to blend in with other Mac users. ## Verified Boot From 044933b20ea7bfbf9cf21d29ad9e72264f5c70e5 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 08:32:10 -0600 Subject: [PATCH 127/138] remove colon for consistency --- content/posts/macos/macOS Security Overview/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index febc4efa2..7f1d53d85 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -89,13 +89,13 @@ macOS has permissions that apply to all software across the system, called Trans The Downloads, Desktop, Documents, Movies, Music, and Pictures folders for each user in particular are protected by permissions and thus are more secure than other places you might save your files. Consider using these folders for particularly sensitive data. -TCC doesn't have temporary permissions, so it can be useful to reset all premissions for an app at once. To do this, first find the app's bundle ID by running the command: +TCC doesn't have temporary permissions, so it can be useful to reset all premissions for an app at once. To do this, first find the app's bundle ID by running the command ```zsh osascript -e 'id of app "[name of app]"' ``` -Reset the permissions with the command: +Reset the permissions with the command ```zsh sudo tccutil reset All [app.bundle.id] From 890af86a514ab6545fee9f15ec2bd2102116cfe2 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 08:38:44 -0600 Subject: [PATCH 128/138] remove parts of filevault --- content/posts/macos/macOS Security Overview/index.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 7f1d53d85..1c1097e4b 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -11,9 +11,7 @@ macOS comes equipped with many security features to keep you safe. Check out the By default, your macOS install is encrypted, but it will automatically unlock on boot. Turning on [FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) will require a user password to unlock the volume. It also makes it so that you need to enter a user password to enter recovery mode. -FileVault works with two encryption keys: the volume key and the class key. The volume key encrypts the data in your drive and with FileVualt turned on, the class key encrypts the volume key. The class key is protected by a combination of the user’s password and the hardware UID when FileVault is turned on, meaning that the user password is required and the key is tied to the device and can't be decrypted outside the actual hardware. - -All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. Swap space is also [encrypted](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). +All encryption keys are handled by the Secure Enclave. Swap space is also [encrypted](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs do not have memory encryption. From 58172c93f780bedc8002cff3dfd172b092d8fb98 Mon Sep 17 00:00:00 2001 From: Tommy Date: Wed, 27 Nov 2024 07:43:04 -0700 Subject: [PATCH 129/138] Add NTS Signed-off-by: Tommy --- .../macos/macOS Security Overview/index.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 1c1097e4b..3f4b141c5 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -276,6 +276,45 @@ Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hid By default, macOS uses a random MAC address for each SSID. However, it also defaults to using the "Fixed" randomization mode, re-using the same MAC address for SSID instead of changing it on every connection. Essentially, this allows network operators to recognize that you are the same user that has previously connected to the network. Consider changing the randomization mode to "Rotating" depending on your threat model. +## Secure Time Synchronization + +macOS uses NTP for time synchronization, which is insecure and unauthenticated. You should setup NTS for secure time synchronization. You can do so by: + +- Using a local virtual machine as the NTP server. The local virtual machine can then get its time safely using NTS and chrony. Check out [our guide](/posts/macos/secure-time-synchronization-on-macos/). +- Using [ChronyControl](https://www.whatroute.net/chronycontrol.html). A sample Chrony configuration derived from GrapheneOS's is as follows: + +``` +user daemon + +server time.cloudflare.com iburst nts +server ntppool1.time.nl iburst nts +server nts.netnod.se iburst nts +server ptbtime1.ptb.de iburst nts +server time.dfm.dk iburst nts +server time.cifelli.xyz iburst nts + +minsources 3 +authselectmode require + +# EF +dscp 46 + +driftfile /var/db/chrony/chrony.drift + +bindcmdaddress /var/run/chrony/chronyd.sock + +log tracking measurements statistics +logdir /var/log/chrony + +ntsdumpdir /var/db/chrony/ + +leapsectz right/UTC +makestep 1.0 3 + +rtconutc +rtcsync +``` + ## Securely Erase Your Mac To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple Account password to turn off Find My if you've enabled it previously. From 020799e83d904cdbee060a282d53348d99f5c2f7 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 08:45:42 -0600 Subject: [PATCH 130/138] update author name --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 3f4b141c5..1d873bec1 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -2,7 +2,7 @@ title: "macOS Security Overview" date: 2024-08-09 tags: ['macOS', 'Security'] -author: kimg45, Tommy +author: fria, Tommy --- macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. This post assumes you're running on official Apple hardware that's officially supported by the latest stable version of macOS. From 701ab86b64da6a3b3cc8ff36536c241c1bd276a0 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 08:47:07 -0600 Subject: [PATCH 131/138] remove extra space --- content/posts/macos/macOS Security Overview/index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 1d873bec1..333f076f3 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -267,7 +267,6 @@ You can enable `sudo` with Touch ID by adding the following above lines with "re auth sufficient pam_tid.so ``` - ## Network Security Prefer networks that support [WPA3](https://support.apple.com/en-us/102766#security) and avoid networks that use deprecated protocols. From 0a7288b843936337a9464323d9e56605ed560ec0 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 09:00:38 -0600 Subject: [PATCH 132/138] add source for image --- content/posts/macos/macOS Security Overview/index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 333f076f3..e72037e4d 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -27,8 +27,10 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](activity-monitor.png) - +
+ ![Activity Monitor](activity-monitor.png) +
Source: https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox
+
You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command ``` zsh From e92b90cd145ec09e54f4fe2169066b68f39a2d92 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 09:00:54 -0600 Subject: [PATCH 133/138] spacing --- content/posts/macos/macOS Security Overview/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index e72037e4d..904cc5e7a 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -31,6 +31,7 @@ You can check whether running processes are sandboxed in the Activity Monitor. R ![Activity Monitor](activity-monitor.png)
Source: https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox
+ You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command ``` zsh From 7165be12b34a5f548c31c0a8712520450ba4c748 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 09:02:38 -0600 Subject: [PATCH 134/138] remove caption --- content/posts/macos/macOS Security Overview/index.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 904cc5e7a..fdff709ea 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -27,10 +27,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -
![Activity Monitor](activity-monitor.png) -
Source: https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox
-
You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command From 606ddf6abc3cc934636108c92b7118920171d6af Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 09:02:49 -0600 Subject: [PATCH 135/138] spacing --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index fdff709ea..333f076f3 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -27,7 +27,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" - ![Activity Monitor](activity-monitor.png) +![Activity Monitor](activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command From d6c6360159d0278224652e1152d28e2f66fa9169 Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 18:41:54 -0600 Subject: [PATCH 136/138] capitalize HTTPS --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 333f076f3..444bdffd1 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -107,7 +107,7 @@ XProtect is the built-in antivirus software in macOS. Like all AV, it's a last l XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, which are detected with OCSP checks over https. While OCSP checks may reveal to Apple which type of apps a user on an IP address is using, it is not recommended that you disable this check as it will break a very important security feature. Instead, you are better off using a commercial VPN to blend in with other Mac users. +Apple also issues revocations for notarization tickets, which are detected with OCSP checks over HTTPS. While OCSP checks may reveal to Apple which type of apps a user on an IP address is using, it is not recommended that you disable this check as it will break a very important security feature. Instead, you are better off using a commercial VPN to blend in with other Mac users. ## Verified Boot From ace0e4dbd11007f474c8045c7de470ba5bfffe1f Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 18:42:31 -0600 Subject: [PATCH 137/138] change verified boot to secure boot --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 444bdffd1..65561898f 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -109,7 +109,7 @@ XProtect uses YARA signatures and is updated frequently, independent of OS updat Apple also issues revocations for notarization tickets, which are detected with OCSP checks over HTTPS. While OCSP checks may reveal to Apple which type of apps a user on an IP address is using, it is not recommended that you disable this check as it will break a very important security feature. Instead, you are better off using a commercial VPN to blend in with other Mac users. -## Verified Boot +## Secure Boot Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself (assuming Full Security is enabled). It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. From 986f23dbfdf1200178de48485a4b4dcf07c8f02f Mon Sep 17 00:00:00 2001 From: fria <138676274+friadev@users.noreply.github.com> Date: Wed, 27 Nov 2024 18:43:46 -0600 Subject: [PATCH 138/138] capitalize SSH --- content/posts/macos/macOS Security Overview/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview/index.md b/content/posts/macos/macOS Security Overview/index.md index 65561898f..63569f111 100644 --- a/content/posts/macos/macOS Security Overview/index.md +++ b/content/posts/macos/macOS Security Overview/index.md @@ -340,7 +340,7 @@ Never give software [accessibility permissions](https://support.apple.com/en-my/ ## Remote Management -If you don't need ssh, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0) and [remote application scripting](https://support.apple.com/en-mide/guide/mac-help/mchlp1398/mac). +If you don't need SSH, [turn it off](https://support.apple.com/en-gb/guide/mac-help/mchlp1066/15.0/mac/15.0). The same goes for [remote desktop](https://support.apple.com/en-gb/guide/mac-help/mh11851/15.0/mac/15.0) and [remote application scripting](https://support.apple.com/en-mide/guide/mac-help/mchlp1398/mac). ## Configuration Profiles and Shortcuts

+1uIgXOZU#>pVzS3em7L{A* z+6GC(_Vq+ieR!C}G7Ue9SBEty4x^rpt!bi*G9DFr;X1u*qc7l#eP$9l^?}YPa&P#yoqQ87BX-BzR zBjbNUUJ;;eSwW?8|C>Nd(DYVx3_7E_UT1;G~AG$-g=bN8P@+L-U zlyPl}r(w5OxPsbB6rK|vGy|E4qmes!L?^Rkr8aIq3P5EJvSU2OQOL3QREpDXkgw14 zQACQi=A{w90JG%>Z}~LJgzyn&_rAJLufyibB)%P<2OML%wvGP0?&_tQNmSbWxin$) zZ_x5QdrK3U=Bj^HBP37er|j~HA2DpAhG=JlqfCp`o8Gkk-VOKY2;!Kx=b`HT+Q&oX zCGoOq{cJQd0cZ4pc@k}&O3-m)*4X$2GP3h>D}2F`K0W1eK!vpU7Ekdfk6R{b<4Xt% z`Uh{zxxQiXJ??a7(YOpii8<>39RUO^-Z}<)$Y#3H!sZ`{ihTeabOOIJDSkYZ1nEc% z@0E1v*XWB!LX>{9N)LL^ea-ja617Bz;_&qB*b>LLjJ%b{CW-?uVPF_KPD;p#{1&~! zg!}R&q&>SL-Z?D5M!pQikDpH?cowdUi6}>d9^N}_P*;fR09}w@#>v;0@5o<$F(@HH zeg@qrv}ukkVh5sP_XNXuj}pt)R(p;jf8Ex8B#FDZHdffAk<$OGs&4ddhX(%?hF`sb zbkMZ!;KQw}vuYs2u^+|Sj-GR+ZsNs(a8ZeI_=%_JiZhZUel-I-atn91V3{!p%fUv;b@d0zpxv#th~&J>2| zR;78`v_0(MIYqk9H?AwULW}Qsmq#_%O3jL-il|8}kuc<|d>?|5R0Jshq71Sy*??gr zc`@w0iU^D*#`-#~3lloms@H-r631NvN=GM90SVu$nI#cK+|Ux}%4w$7+u2Q`xWG@4CjUUVDp72Q9X6$&?Ww2XG04qxVw)qa`QdLlAm&Qcw~% z18wy&vj_R%cy7iedBQ6o1#{?sRMJCW6x_sCqZ;?3f3EO5!D=KAu^qdnIp!PsW@vQgjpUtNn+2v!Hq3T zv9A#1g1%`*dINEBXNYuvoEGoBJ)y3-a@d|Td*yrRTg-9PVL#Y%$Yzcgkz@Gw$Jyr- znyrM{9DdbP-N@o~<{IK}bEsb)O}*1gI2EvoETELlNKW;c6(VlV(clNDH8b9c2jMj3 z^Y}e}g~Y)+OW5!-|K!83{4Y>?)L^8sUt{sw;G)x`D-`90M8fbae zu{ux4d8gl-ncq!c4I!hCmeZ2WUa_ZU$ki#;>GGx7RbG|F#of7b!ACWo%}E5?PM=sU zAVlrIY8~EIQZx0~-yUHhJZ5T`y41EU78MqNZ$<(4?R8r6h;8OmcrJ$cSJw0u!dY2# ztt)+QDx-lO&MhNAWuPhqdm1kS7Uj>O*iNiPeKt2Xb~q3em|fj$ETx5jAW>TI5pCFG z&30L)Dn?y&Q+7D|Le1id=Kd{tF(%TNtbn}wZ{vEDLk)&ao{ktylmcXWGDM~n$rlX4 zI!ExLZUth&18Jc$la$$!XNcM16Tfs`UpI>QRw$3RO`U4brw8I>Zr~Gu=wku~$9u?x zms#PD@5MCJedjA4Uu16ksPjIcB0=!zgfbEcAS`EntuZQAFHXmAd#)O1kQZ84_`{Fo zc+s;{f8$RSJD!&$)4d$zI6kwEtB!H??=ODk(hlgh+!@cx#wL)v@*;C~><)626nB{8^_R%-@!I?5FCPx8^UCt&lh`m2kH2S~}2 z>g|1G!jH?0uRQv`o_TJudb!3x&q1F@;5RJ4`_GS7QO^YOn?m*KXP+M`t08sHWZE*v z=PFd1_C6y?1PcxIetu6z|G_j*&bEW4c_#ZWU5lQ#FuT!5)YW+)Z2j;At(7xvfgHJt{Fz?M~MKaJGcxDF} z-h0CS=}-aolz#i=;GeBBXI;?^Pl)Ax)&bL}*cIqa3II{@2ko zHPfgR@kDQ}$xvI_>~3?=H@qw}84143AgU2O_|YjR{4!WL-yJIHZ^rg5ffg4!aQOzQfW%AN&yVjsP!V^`?KJ112pwm$_ z>4GZ8(T3=7mSu^iP-$n^OU}~hu}Pcj>iLq1{25Kk?19v1`|YDzKs@BtpOSi%yL^y6 z#fyRZrsPn5y?B;r#+D1bo3rkdlk_V|%-zl{qqHsd8gI>dJ>LYRuMdgr8C$)}&UnRe zOwxw0ha(X5!{~7}UzygKP4!ySpU|7;vi|WTx&+WW^!~Yho@#wA z$>;^Y$2uaqaBh9dlf3n(cfA{w1oCa#Ebl1%9Gd!75s)!;$gAMaK&J50cJswh*tN+C zSi&Blcp_Za!boOo{B_?Fa>#d_H{oN{N$u#t_fq3>7mXpzzj>$Y*jeiZMb8bjCNL6- zKc+7<^)wwC8O}GW=#Ceq&3t%OcF+DJc;$FCYB?tH+*k|!A!fIp%)CY7(w@cYC>2rU zhKBePvgpU7%{rWM3@L*V!+XTMl;}$r0<#uKCAX6xG%1P?=$pmuf={8-Yn!9AM=<@t z9@VdhYa@`(?D5dKpT9vaZP#!GwfjU{%LZDBVnIDv{K!1hb2LV?J=Eh!Stw^ZXk!Ehwgo@CG{KIga@)x7BXK(AaK3T0w6!J;D7HC{_3wSPNmQb> z<(}~In`sR!KNOKgd&c5o0eHzG0sRCSMMdsInkMH${_6=FOxodm!JVU?Ew(aG8p5!K zo=Akfn&FqjNp_9zK`k zw-AJ}AP3=mlqH%58SFciLq+9)j0bjukwV2w(2Nom3U+pHxBC@Aq8VB2@ou-peN+KJ zXVYg#OlWf(5lITi4ViB+JCl8yLNfGAEji#l58xIiybV!rNVx}H*^(E|0)(t)GSgY> z2|0z7wR{xxP5w(*oFj}^M$i6crjM8D%H z{_343-WL@qUzAAyJkDj;Ooja|K-GQlTTywnI%!+w3(i-eo0_p3JyX-t5t*Vc?b3Db zu-a#4PCXPD9unmW%QuiQhUJ%si?ZSPj%IzcSV9mvACnS?W9W0^*mY@R&Ry;JvyASB z@2lt&@By*B?AmhyJK6E0h$!73qaX+-S55}^S{oR?{oDRIU& zhE|m3uy8qSgMsjC#@ueUI6BoKqQO+;g7)mU{in0)=m1An=Zbrr_pN-5HdlAdc{D(o zqua(n(*r|SJ`V>dH0RZhKnF&R`~$9|`z4Cl1c?KQhwM#qry`btOh997|XNF z$enihaf$BRqqy(ry>AEjx`4R<)Jkmnp0kH65-y?=gi38o zUg;g+r`Av5xy}|5w8v|O4V1DnEPNm{2{!G>`Ag$87tvwVE7$uCR0+ez;#XCi28b-VoYUmcGvr-S~> z$6n9^aLlV6=|sC04>FSO!U^+1t0npi58z|oiO?U*(a}Us56WYuj&uh*OkCKJ7B09@ za@AVjTKcMb3S+KKHZ|QOwTChGpL31_kqSFJ?Vf~YUXvuanuNL?)I=QHPv@RrUrF}= zOW6A4$Ti=D$rd1Wuuz>bnA!?9E32`i)gmNXa!(eNM-&~slb!!rAGo3-ez0jOQ$ocia7Rz%Ds^EECfTPQ7cqp~TV# z7cTe>#uL?=y^4G~_~=RUA})dZ4?VnYTTRX4*dgB-MR11O@~CgHqB?)6E6*04WCc=- z{IFyey>YHuB4cpj5I~GKV*!AT^%P5@c2A`{5yK!!uv}7Wo(~_ewRYh^fI%1j3Illc z%Z29OQpeAOqVx_2olES!{>dJV$38UtFW9}VK0J7p^?l4$G4oH;N$jo=)T38=F9mt~bJsjs zV`(*2o~n-p?xUs}Urr!hK80s_(gs+v^VTPhTrQf4$9{+I9JmgByAo1{6Fu;`P8r7& z%nCYnD6}R6_Z#bZ?<;qm%~D}hkK`+@|89UFo=pezdEoBUI3)T{D5~q!()d?xlULH; z@i$5f%Vpv#tX^$wT7A`vh97qPAEMqotf_nJ0`6_^)q1tiN|jm}+G^!mhG;31A))uR zl~RU)c)23EV#&HwN zXYO*dyZ=5_OR0+;Y!q!{$|s*5l^*!+Mm_A&4-$o}+Xep398U6p*WmuC#k{oEsFrzG(6|XBcUuH^y?F;EytC-j zs)v*pyDKl=UpWK|9?(_XqqdHamhdelE=!phP%KrG);fAPFN2531l+5o1i`fwe5WS5 z@FL!KA%(Ygv4|-GVfkL?JafKzXj)0(mEX#UEM@eq&=>k?%F(N&tt|ac_pmHcj3oo- zSqzR>CU--wGiMR3dgjVve+HbA5S_sLM6&IZue-f0P+gIUoVKfOBLfgTvWN&)KR zZdJxflDmhd6Tf=+(K+6i((#v;CBsd>VmIvym8!k>vJ^z?){cn1rVsI$5-P4Fzo{@g z!hAi>n%W>!Rvy)f6eg56X41Lqf z@eM#}(MA1$1fz8g^(SogT{>D30w&O-58~Ia>?rt%@b&7TUX;187kZDJfSmBjay;<5!^NmMY|7+Y7lOdrPY@3tJUGkFZ zJCqvRzak{`@CN$0=>j@qyt#3)8zUqeHCzP@5DPa++-7>`*8qKxAB_nxLn;jD2DI=> zuphsfWgFID|2CJUPNFTH1=5(j6Ez=Gebpsec8dUULdp3s*2hM8mpTR6qxNfZ55~Uu zDB=qee#?zhj{m@I375kN-{p*B+)&+%Oo{-+-_01$$@mKv%J>kXq#tm#0g{i^*5OvY zMp~4?X$A5}{A;0Ygy@EX$e-^sj&lD_0>S3nQORE+C|LaSU0OL($e6>vfe1ZiPl7+J zPoD>sxg!=;y5E(%hjIW7+nq&?R+qtQ+!My+|I|F{g{{R1v6a3uMSnlD^0Xy8;dOKMyl{o)Ko@xfHs#o90}6Xd|(%<2-diqOAK!;4M^K->Cv) zvr*BSQIkH86k1Tf>eqrIW)nvR9ZT=0q<_%ZoJr>^?6MkylB%Y^e6 zg6sw48pa??xGBy+SR6hXgk1qXa)6#qmvNZV->VQT3O;nh)B}}$wK%xE;%3lWw!3cQ zn`Fw%5Q~?Fao6Hu_Q9Zk74nm0nyN&L=)6v;N^0RkJXOu=x#oZwd zMk(u&d1Qc1I>0e;r$tM&uOps|%s^*S2hdw7t0ElXVB_tqsWuS$dor;dAtLFgq5~fy z4Ho`?j%z}S&G@&6=B?dK_IZOkNwuFnk8}WH1eojWcw>(pt57?`W0io`YOCTtkV%GJoZwE*s8g#vF z^9OMIVM|Ig2<{H58@nkuv^y?)>KjHPkRsA%AJ1bqP~Pk8`a;ZyK0q8{0zhweQ6Tm9d!SQzQST>0st!6&zO zWj(3q?=^bRf5TaF`ET!jAAz;x+v}nVCR^u4C0|Y|CV*bt#$yZpT43r2yhM4;<>XfZ z1WZq3hy9}C?a2(D&(jPg_2F>lw0lu{e_056cCwbrJ#;!C2=_JiL@aEsZEL*xwQ6bH znsK7ZopPI+iW|z{1N@xB%$?w)t~3vFvxKP z_BC=S4N)MYqYd)lkfu@F0F66qZ#YvE;@4whU5(E|s8wz7?s$4xgu!;k_{|7HJ?Tyy z0;?W{X{&4(h=7>0z{!SX>k}w7j3IHb1cG~OA#6dJ)23QPX&G^sBQR+=?cPivuX?2rYoE2)5fM- zwpWP?hBCBCrff?BX5nQ7&`tDi#J(k$afS-?)p+yh{MXu(x?KVwiW>V{>R&dWM^yWA zpANzPBd_pGa;(XXsGhmobRT}dVmcPsQ{MuWZQJ-vTlkKs1&@rS`zfG4$0$L*mX&Sv z>u_4fPJi;nk&LSJ>Cxz;fS;y!B>)w+WaYP*06ss>_jhF*Ok!sH8c{o=0PgnWlt0I` zFnkG;Cm*X_ol6(Zi{EQLMd;g=pYr&uk@m6*-~W0m_tfd2CO1K4R%Zli_VIUZ1k%&e zQ>P9ks>{v?WrOaD2LMd0M4#eM5}lbX>F5p~+DFfromK_&xOXo#1}*%m`8D;(ngHqh zyI?!^r5h!1n092Yf6`PlU0O^7QRNB38{Cv!xmh=>!iT?;M5rywKl3)qWQxTbnz?R(j- zF!1< zp$UHlWV=$f`ULQ?5PloE(J@S}S%V;>M<6fH0MC!KbfKpK;Ac{8UTotNfD;0EeDpR= z1X;O%TGl=+XqUmJl#A`U9)Bcw;bxYyM8L*|y7!@F(L4~lMdVnGSbzcC!7pUULHyO? zx0VjHa3t2$eyyIw-idOQBrIg6n*LJF1;5h-v|89YGzZwRARVY%4Ep?}QhxxLjCFC- z#$DxI$H%SUtit$#Fox~L@b6x19~_aV(Rv)XYc*{pnmAp|wGlILkuZv+Ug$PM(2*Bx zOXj0qOD!L-LXV|XIlV|8*b27y`@C>HMIaU}DWB!|lyJpWi4%nX$mVD1vzTe+4MwuL ze5zIWB_LRt#_GYdvKG`3K$V3#{sKsrUX{^_`=v|0n%zJo<#!t>1Z#-%#bp3mO1{moszA4e8RK^6)bHfcMh(cHh`)k>9oyVA^vl zhM8+UA*l1q>>spMhjX87wv04Mf)p7D$lCn{Z_;vwZlp~qD7^ZSux=0L`urc8#kKf) zPpovh=%jo7=6k=p|B|y8c_B3a{m=h=CYZeD`!fH0p~~$y_-4(0uiwEBbCw$2_sULw zl-=1K$1e7WKUT6db2ig!-_pCE9E{*B;fNpBjFX8s2`acuKA#{}EEjc6y(kMYWXlvk z$6y*45ge+pvdX%{e@Zm}Lp>GkID{421LGd8w=25^!!)|Aoa(|V9l9sJ+A-{mIcec0 z4BI4(7mirB^$V5$$=#ORkzJ`dYDnH{K@zBMm+n5WFVpY$?ErQ`VZlZ2v>fp5Xj3*1 z=VXMJNX|G%Oa+oLhBA2y^X<*;TJqmp>Yfh3B1sLAA^4z!Zmdqu}4s1 zITS(CG30gl>B^%}k-Q2}>)|%;`n15ZNgjvW0+-Q}j^arO|*@SY0^$)b#zSj!Wy z23!|^{{C$bSCGDF%2ZUu%~yjUt22N|x&T_)VTsrPW+O2a;ngWI18{>=3l8;+kBX%% zme)qsY`?d2v@19N9iQj_`f*IdF%iqqtRD^qr)h0pk%;9fDI6ES{~lJ#0%pQ~KSP_x z^P_neiyd9E{-i1iqH{<6O^{Dfo=C8HpX1}W9GhqC;uNe0(Hj<}7oO z<)xq-gQ8zwc^MrPNOnu2OmMFf`V}?wR)T`V@?a%TPCUl$gq;5*&9wgGOxY3+-#aH$>W^Ik6nsq<<0N|;$R0)1I7c~#ygDE1Gwgm^^w2jERU8UM+BhI22F8a{hQvWW z3wTX`gIbrCD1$EM(>;2Pe7+vR(kfCez&fu4^%&@u`Rf=$(Yp-p#*kCzWT4P59ls$; zV6RKzdyWwKwwq%3yhK{Fk&FlF?!lz){CMA>2p!z%UF@3Uiu~>IrTa}@sBmNWPS`kh z`?z5TX80f!rATokV#%Ow`$^5GRrhSyqL2tRwzGE!I7?B!;2AVeIjuqKhe(9a?COO@ z!7vtIXua!E|77N{+@zbrql6_oqheY%C()hhNnM#}4LpLnX{b-Cd|M-&x=dWs+pxij z(o8{%5sb*uWrj|%ermmcN@x}Qn{qM#>V&znml#xupQ>o0>{A^eJPbtNo2TVh4M`0Z z+8;um4FCJnC%kP_QKLhQp}$cj8?~|uQK~2g(luGpRF-ur{M209z+h69iu2)o$`_xU zrs3+FEchtCXH9#NF7MWae>avXT^}YTkB!;4z?-j>4ipxs z)TEnPJq4Ys$ZJl^{0}oex?D)iLC%|>Ct^-TunlzMLHF^t-HSx)>fhq4vI!wEoKT-} zwmiIk3ni}qMMFbX*m&A}-Ft1#J_oFZ)tW1yePm~Vlrbd(hC@p8VLG?N(ice_e7%e* zQmkDLgL(Btg4+{Z){eKp^5hQ`_mpxKs`8YeX9rmTyQsMEJbR#|-vht?W7B4YESD@_ z3}I7)wTq{D`5E|=Qr)0#WgCUhlI(@4#n@+A=9CM%biFCX4W*5y<&O**AMV>iMTNsU zReRgWD}v5}H}^Dy0xET>+`L3zoruSCT?K=|scz7gW_DT!M!+GNO~qTay^c7kj#!Ci zNeVJ}SHk8JDMW4!zt3-;jkY`)W(jzGev_b3TOd2{fh?;SUi0QwsT9x}YN4eg-V{iO=QvwI8wV~1x+_h*OCJaJ|k zYH%Scc@ot*S~`KYU5&2+(jbt+o6C71iQrW;49U961@b|#<$b9!FV0j9Yg9_!d|ub# zjF7I4VFI-+qBcBSQ4PfQARgqA5FxdUV}f0q0Rq+dPO7lLDAaYpe`$&^9$SYYbcA>C z0|Hr2$p7mFaP<?RTl-OoRAbT=d&2sV=eq1X;_wPL)sVDA0 z@fObCH`CcV>{cxVjgK5Zk6z;c{)rE8?@9K>l%u}MRDo%cf*&lB36f+hT{Y|DAIADA zOz8M|<9=Q!lsfSGa0}~R4sv*RT-AzbSs&APTAp*iMxRaS^Vuy7symB<6)-#_eJrBK za7UWzC!U=D`fONKN=LM;$>M;tdEb|fT#J1@$MGa2tfz{eeKh<1Axv=p$PVqlx%_b4 zY_<8nj5V{O{^5OSQhekV250h~=Y%Wyx;5XaJe;$HP7W?7X=BPKTm3plOsNR(lw(Fn zj1f}edHL!{SS#B{^~9P#ej7hYoiY6{cB^YIf8n=M?zcw3kK&)L(Y@nuf)*)W-ku@`_Fuld#kmp6)7@syW?#PTk-5OUc+bXN!Sh+>8WcE95vc>U8>=>k2 zz(wuxDRTW}OO<7 z{v~@1wlKjuM0BfTpn8=Upn(#ERkWM$`iQAg;@4W!pS$eLf?%E&EY`d#Gi0E1bXInT zY_e45gG6cHX39VcNwXDbfBs@V!-;A{7tBsD{jr_4+`(eTKCJAgne-Umf4NpoZF~*h z^n7~2wW+B0@1YlDB1s4rs|;YgzMM@vP=b#o^1!{zO`4d+#*k3JAj+{m>`M>k(OxVf}?o_g%Xg5^VuI{E{tzu)JJuf#-kzMB*mBC_r< zl$wWDC+@gRA1L2N`mN?61uT45eNG)e`qw0 zjlmJ{t^Jz(P9ZrhY^mk#zd=Wi&G@`a?;NX@eaaqqo+29mjadKP*d!Y)SJEK~ceE!d z`AV-1HToQ{ltEZtT>Pw#5U5>)shw~gSMGexMF_z5lf0$Wkx8sXl9S4@PkL=I);f6T zv)3A0Lt8OL8|@-o{de5C#P@u!rF`IJV*`$Zx6$}&>q>hmrsR9)qx+|RVURB}RlwTh zQ2`wz8MhB*7(HOv?>H_M5BQ9Um?HhfZc&vQo3-AywBHh6jGj6x++QTLYmt_<%r^$Q zVmayUfSD7#O1UoKxEzDZd+Y&YYLuS*=KA3Peiv;qxVVXd8%$W}4e#W)JNz+Ws0g(^ z+skuLQMv^+-@cTY!5nL%HxIsD+p^8&!*PDI&^7|{gH=qogQY339v>5#Nqm92;SIes zFS|2M$!HF-C>GD_`Z(9nnBXq>O3QPD_T{Qj;qgBo5cE$lGqfRaW!{eqv93V2Ih%3D zd2!0V!~F9Zk@1H`OBKId>to@k_Guq4VLVHwQ2(IaJcn{vMVUXBf0>b;nr%q$trgRO z=)E)P;GLQDE{|g8nNIl%pWF^C ztNjp=j}`yBxgWzTlICIyhVGTy{6c)v#Y0}m6}5sDT5i)&2V&Ya9HCd|eM zja0cGJ;)mcJYedmh=A2-IIY!CQPvt(mx9_bs7g>NA-y|LK$*8QsHHy7tRWbR7?bjM z%=KfcKCT-8~)_WzZD%Q{r9h_n5|bl&@l$|ewBRk3fNshYUNKj{naY{$ciez zx7IH=U%clA8`Ibx-L1U(KH!jZDsqwCWG`uZ07feOmM4mC2_q`t@c};_Ch_DcqaM>9 zBqEgY=jD%Kp%hhQq3xC;<#;OAHQVoGXLsJ7*vJjk&F*$_-S!-ljSp@VsWIf_n3X8 zrYwrx_K+yOJQuC9Ene_(%yILID;ahmw$z{<<__E@trZygA?SFe`%DGFMnDD`)A4L- z`+e_63R3KPbrdgNk6y2WZRka1rvSnz7>ngxVGxWjros@Qdf^*C}empTE*Xw?n5RUTCdTf~2hL+3G1%vdc3PwRT5h=6e{V*$x zEvB|oT@UaelnJ?3GzDz+R{F5z=RujGGZgl8o1i#uP-XX z(ubcoa67fu5?ZT~Q|kX-@jAaKGD$GFPyoB(;&S@Z!e=DtKaMn`xR}$F{E@PUQ{1tCzQ^OxV@~znBt_Yt zmbKa>8GV4NVX41d_E}V!9rkQGd=uyX(w8%C6B9hA>lKJWQ0VSW&^9i=I$iF5NnAQ>wMO0g zUwBX_YNp0FnF9|^72ZA7Te8=ZyR5zm`hZ01fXD-jwnE;QMwB4ohs!}7(%zl!yZ7z) zhpp%I&}`L3$fq()NF@l|G(coZ`|j81mx1#!EHsd^IY@^S3XOdKI!*wGMNBLxYRPiUtj`6P|&tDUz+k%gFq;9{J; zJ<-L-y-<+l14U*cswb6CHDu4FR;ZihWl~d0RW{_s0teDHaG!6eX(_0h!%o3z@{*_Q z(@8_rt*uYf_SA&`ugPcdm+}iY2PlQ}>uvD*7$CMW=dkOuKrlPFWg{p0x-<5cr}$ zgr@K;&2wKIV{;M*vf|I9uZx>Ym^B0GjOnSCkdmvHz{O>}QZ(fGNSgBMd{dIDZGYVr zAmK^wi}upmzau+7w3|93I0~3sT1|XYk_I^a_JWTzpHIV(V54ko6eR}5thqevpK>98 zYVHn?6z1kSCvA~fB=l*i2NtIxKW$)GyMc6&jlO0%uTwdz&k&qv&?m=Mlq;&cjrhj+ zj+sd=dK0U$TQ{}9VKdAlSR{o#SvF8kaUyj&sqQ{YwDBHP-bRhmnl|ukYT*tbbTKfm za(P+IrB1;@HAiQxaK*3}8rfIPiCFFW0%S6{lR9Z06*8w)SmZPVOeTy#M5l{zb2RH- z0SOOyEgjG*+FLESPoob7sSd12`&lKNSI8>;mK%^KsB|bL;V^M0s=1M6vdV#4F3~g{ z&>ttB(3~--GU;Z^4z})VN+r4~GF49mN)B0)NdjGeZsMv1gugdoRjU|p8ZUd%UH z#Kq`T){31qpfq`>s#g%5TEsJ~5PeSDky--lz=$PDChyI>JxS0K=rA^Gl$P=3XlyYm zD&!(W_eaGA;!J#L*06l?0ZX0|5OB1ppNEaIDiFq7Y%_84{^@ao31HcuL+J9rMV%?+tk z)K#QjJVk%K=r_6Y0ZsPa8`IyKc=g6xoV0TVuLsSHFq^DtYr3%WG85! zn-D~~PM=7t4ko!?VYi1SrXaXpP}+Qodlht<$R?_$$>*`Nc+c4KGO<68U7vbBq=`7{ z)^ykS7Ow?+Mimw=J=|ZH9f`#k=Q$}uVCM*Y36I3cc=&}DlT*=;5apgXN+XCy)1UOy zA^hrGdFE&}AP0Z;ybQE&cTiyId&EMM)!3eJjIjMk^36oOTs`E^r;P&u>$~kRh$hb2td)6M#4QcL3jWP{ve*OVv8PD{6J;aAifY2svg| zOtysZ`Hx0qv)RHi++*XR1*AkiV>|$hvZ~<8lEnDrwmy3S)Kyn z+FG~Af(cN%Vl=$0L*`1%AXFVb7u9q90C?gboU6W>>r+%{MPlmYmDQL>H-$sx0@@JE zZh|8s_mfVr=Hz_ZwWsqVFu-hqd>3j2pHY-I)Szhm^)slbq7YL{$_KJtkK7S#dwPxr z?Y8u>K=TZHMzr_nFX-UW^F-D)V?e4q zuDmoRE@hi$4`$l`d?ix^EL!h4KZNrGy|;l{9EL@9RG~Y2<*}Yh9SPd~= z+r3f+tl1JAfOXLg612{&?~wYePB&9+DQ+E&i%fi}#RIeOgUd}i#-2sx*@lFUrHM4r zZ^c`Irtz5mNJ?C4@^ z&Bemrb6U$zbS&h}#K?F7Sw4OTc`!Y}Ii*~Ed9=I2y(Yje;)qz=nR12@qNMI-S{ zu$&k*`Q$ysDctV{T?F&l6f#eQXkpM@BW&N)d z&b)|c^4r^&n3T&Xkr^OzZ>};N1=ih$>s=I!0kd^coj0muqs+>C)+at9VN7HyT}vAh zr;Z031ZKk`OyTXiYY2}=rjbao;^8sehv9_2lKfgyQpz#&cP@G*LMqf|b^$_OwjdB1 z^-`;mMDf1T&di%$vR7BVWsF?cH%f@DV?w*cQLY|^@J+aE^J1OzI9sBVjj&qQg^@+I zlr;$u;`P@gER(-UGKY93w!FHV@*!3pb)UMd{273!Fq{rk3VS%Y_hNpxRu0rjR#h-u z^&_;LQ7n|ygg=!VssO*SLR+zhJTng$nf1$DQ(T_^bbNN6s#Rl_-b}KfU()^yto{fgd(vjX{9w;w{|v9e!z%;PTr1v{c!&^Mr0~xC+v0O z9b~WR+ee@yp?*i2PSQ+x(?8*HQNb0{)538a@}I08YYKW}r%A_V;s^WRJcfkPiq43!7iQMa==e`3#T~C( zdhIpu`PT6up#Y2bf^j*RJL3V@aM(>sPNSr`>P-qoJ>n8$DB8Dk-ZBdUFhvp{4hW3n zWypX?Z=7#3H?YTk@LNJiQ0(SHe4#lg%DT2pzrQgwv!-kt6I=~(p%yvHGhh@U-)ep< zWOakU>_-s?A7{L!njYd&$MBDSLYw9%mLBcr9t_3xe%BndZ#c-@s;k86cd>;jA`%8_ zyELd?7|c%1=~T*KFH$ByraGI8t#ISg3if0{`p>I=q?SeAZS&!0j7GZBIzNTF#*|xB zYiAb#+m7C-TC^D~3WlJkf_Vha6pbeR|IZQG7Z#K$J^r??0m*9BBe2`GAev98tKBv= z9Tm3RP$$UwzkfQgcw^uJVlGPBqca4FCpA=WGWKNg5YW4^MxKn1bB36|lhq(}i(g5b z<^C49dGEGVc!r_;lKHv_{nz7S3$5++rOk6udzs1rgTZ$Q7+n&qo*m_iH&c^ zh(}AY*)rJVpboC@+1+f7Gn#7_M+0dNjT-cfYS=1U%gr>bt}+|km4R_Z8o6Qu87bqA z$)HQ>W{=@vaU}j#+Qz)T<(Pe^bsW_6ymh*gk^1->uPDh;?Z0FVb?74eAK8`p z@LBYa-|aai^Ur@?^dC$5HP_ML;-4E3%c8PrQ<%L zZk0q?g!7JX^ULe~#?5+l`Rmui9znlP*58vc-wWALh|xuP+8=2ADKwHy=oSlkh5gDp z!mqgIFX*P=Pwy);sX;U4=i#cQ$->yAPi z-Hf*XNHzQ&+VnB(7&ofgtf@Qp7sg_n90z(1tQCn!G=}>X7f~op`mZDIf#WTH+KiH` zBWV(b`DfueZ5D`8Xpnr7Y`?$;Q?Od^4NJ;6Wt9s;ISQ0_%p5j-)wPSwF)KA_uhe`P zFgeA9EuOxEzKw}CBBTm-QV};w2DIKfS->xBtXZ@zTUpd+>$sn+y_bSe+jbH#(Mje; zY*+K6J!7v54l0ZQ=zqcLtF?vBrm&ufCHGD}7fKoE@4_aqqd{C;>Ohi%++Oe0GW|AQ ziKpk37_eAA%djdj0}_7?MJPexmLIA1>~2-eUzF@BNfn5T=i+T3GDar1=Z|IHpGh(SNan^> zR9yAWVeRL-KyqN^nNAshHwgf4sxe&?ruZOf8GR<~XvsZm=KAjgZ=ME4tD<@NVE^X& zzQ-bYQpIKZq~J!ACHDw^{jE0jyCB}_cbh2fNIEt*E-Wc~wGJ8Hoi^Gp-p0xKReQX} zZhkZNr&h(OUy%m5tu1Ym{nPRE=6|l#^}d&s`(<4YolyL&J#z(ZszY7#{3IyqqdSi2Wkvr(8NTT1s;kBa!ZC)rh2ikwNWlP68X{xib%V;_lvmezBy!>FADW${l z_9qw~(a*96e%2-ZKeX9OyXJy>tut2wFzZk{4tdhOy3ik+{Nkj@%fuQsZT z!Qz=Gxh#|tt-NEBumSE_W6SMAL*Qe$SxJfo$wqv$MbDRCqT? zf-c;+fGV;mF|yCxA*18NrR_k+Z<@|J?(MTo>$e?IT=IlkdbwB78<}c9afCnwFFGD{ za6tp%X>(0GX;)C!$TWporJYZ?fS&TnJx#VEbZ)Jte8V7eiUSIMa(EIyI)FWG*<0_^5UAaG7#} z%^X9iccJU#O)P!W!uS0v9Iu`PXpYFQW8=kC-BrT&9k>nT>vJ>U49X)tY-iun;i)G`78#@KgZBpe8{~Ul*fKoD7{5O>fGCwIP zNb-Y`D$rjXk=-#1)0JGob?Wbm1SI8MSQH5{H)3lWa|b*;b2I+5-YxSAjH{TinM)b^ zsa3WNcvzi2ylOP7;K(c#NIckKXg>Cg_2uMBcc)5T0*VXRW>ftXbPK>OGIq%3@-M;$ zcecVh3--Q#zs^r?r^9rbOB-d%)`8yOHO8Of?-m#*U8s`|ldK+d>2vdc zEzh+eSw+Ne1K0TRV?$l5A54sv=;3gpmGS3c&b=j%Q%t+H)l9sYLKSDc)9PY8nJ3GWUJ1@jt|ZF2Z8vMKForo2lo(*$Vs zMekH)L3g8^di$`Ad(OtfMmaCcVofQuBIgtyPW6fEEb)`0wZ14@SCzr`IpLn#6e1H? z;pjqGE`JiRBRUzhi1Uy~F^gRS1%>oUD`4|G322CR z2$!bOphDf>O+Z;SdHb>$XKI*01lr|Y2!OG|#o<;8%SB+rU~`0HvL6&=Tl99@*Yc*W z9aZ$jW^9!-YHSKs02E5DmAKT3q$J7{%%Nw2wh;D!pH;%4L<#3;i)vg{uywv=j&Rm# zK1zAU;@B*iJ*=m^SG-2FSJ4t2AUtI=I~+TulNd9o*z+;SlIq;g28VT=@4>4or`^o6 zwv?ORE4&h$r+d>zMTX@H@Tn5s!3}&I+k@(?F~9e=tSXbdkisnX9ZQl4mn7s8Xr@d6 zZXyO#Zs!6N0{9zsHlh}7pPkqbET5SQ?|UNCq()Ufro}$oHvRxD9_gNCa^;b!Mbi|5x2Ph zdUhAaxr+bk8aUS~0sw@;f+;sZ#g3>o-<&lY2E!~rvKI=B=#)qqU90ZIm)FS4BxiYx zW;{o)yj>qX#`iN+FZaruh6iY*MmnWecw> zB)c#d7#KgZTewfe%}$%27-x2NQ;pYU|Kpy1&F3Ej7@uzqAEml~LV!#qWE^3((2GuW zKRI+d%F>=jTK&oJNoeFxHM|}l{z9XSu4FTbfha64yR_&Z3|6=r_eT&>T{Rm9J)b|j z)L6VU*`5%eeF0L=TO!v#ghnN?39T*eXuve4yiuOjlw{v8MW#Tu8#k_#z-nCYScNC} zTtQaTZm2Y-(|}FHt#)}BEh4!h4(yv_kn`h2$)N|sTz4>0fPbo29MyNhdy|==@7Zi4 zl#An;3W0Nlt&229>!qnhbCITaaBXZ2Fy1I%|77lr`8)E|<)F&dS%vYN*qhCm!Yn22 zfq#*Fe3wOIJz1p&c5TXBR5e42gdvY<6Xz%3f5Zh*nuGNeF=KX8j8q?3;$1UO)f-Mr z*GiV@CCm=*BPo5&1V#0PXT15HL%HBR$*zDrO_GdWMOaqTiy{iet>GUjTZNwIXEkirnq@0b!@x1Sddmso@pPEqG{u8dTXjK zVXFtZxnLlf-xJ!@d@An~dPN22DucTo!H~i`<$xX#+Ns!XF|SQs=AyYo@?XC!M?q|Z zD}gR>@vs7Dig4-MbyS;L^`voKlcn~c@=jaYZ^a744C@-?J9`LwvZ>Q+aNN0yL;;V) z3Sm>xL80Ro|FLK1m{A#2eifzT2u?XoL^cNx1Vwc(*ZL!Fgd$ongq~7L-0S(`D(7fY z00$q+?J4jq;I7P61UgSAc9h)5&LJTR1I!jkH#%Y{y!V~^Ek{}b^QJ5=W@UPBvZdOfwiO1oApq9^Dpp9!NE& zmj0c4uqmi`_OXI2Pl7X{Q@|w`|j^fpp8*F?kfGGjVJ!be; zy>1t~WuY7$p)8MeMgwEa4AZEo{qWv&UJcqS3TV-b(OOP{DQK=j6`vcS9kIAkFW;k; z)YbqrOV(`5E!U^g`Bj&nq3GJWCf&>cn5TxK0J4nh(TjJj@#jiOa~_WMSGN7q$+id2 z=GTFKV@taMq050ukT&M5Ina?yASF66@J|;4gi7%EI(Y@0E zg6ilX$PN>_z~j<}R&VZ1?RDyWspAnl@8%wWu@~ADO6*2|yziM&pEdR3N3^kVcF$&UD zcDS=!up=oTYVIU1>*oqbrWAA6BN^IgHbHnKMdP%HKBB=~D4v<5jO>mA;_VBuh%66` zo)$C9b$l|*Z!JR^HJqfqSeS`gx}42@$3^B4cZxTxBFZx{u7G5Y@GWh>^b-#XmbQN5 zwCs|RJfenvgqoVp5hNd8JuO`WGM($sfBz_Sx0C5CVgHb2{bFtFx5m}aZuP9a(8H(DYv~Y6osBpYBy~Sk zP2?kZ`4D3pqJ;R8(vB!941cOvEg1jW@96QHC2Z>c9OszbsW;wfDWxPJ6O8(7=HqPk zK-&rNWh66m!=bHX)Ep47*wQeA-?P%7T_hjy{saekGxrnl+>Zq{`UCt&&uke4Wh1A+ zXQACQC1r*@?rJq?yll?dGCF|m8#UzDewOEdwQVY0I)a0X1*yk0dhz)xTS}WZYt@&j zrK6p(nwVaazJn5sf9=TOwzQ>WBWuA5U?E4$`sR%r$hdC&FdFUL#coOqGn&2k0}gq| z)v?7*24JI=#1;=Q7wjd?`UL5u1_Lso)r>qyQ$VS(A1)lJwVH9>wAs zy7(|L^l?7dn z$zB0?j({)#HluBs({-SZC8|DE1EdO3);(r`JLpt$n-) z9AEl!&s;e<{Q1KX&}IfWa2zD$HfTwW#Gddcif^@0CXKm+d>drmn z!+diJ*3#zr_O)#kj=g{1Zh<@1=l;xo@ou*ayyKPiEvg99S&}_goG0{IalX;B8oE;X#Wh(X80zb z#@Q}Fu?4O8bYnazXewSkRUzqjw@|TNj{c8yYQJcd=1JOr9Qpx(lcZ;)s&+cZ#lD~U zg^rd-h*1Vn6ByVRD18?XdI3@;KMU7o;inm3q7qY?$T|V-6z|E-AJX%87VvF=TSN~T zaOT*EWcD{$-YaH|NAlWI(@Pdz%WUxBs3gVm1J%j%`%_T%h{0DLGFk3y8SsFpX6B54=B2X zvhSZtjz`7l6oz>H^T0~H935BxSGDe=0EnOLQCWma?;pN1o^*3J7~x(thv?I4;{Ofz+I)yk zBm68qXNK;xuYG!UesWpeacxhM?Zi>dSf4B3KpkP8h)p8zrvEvX^qF_+G3$>%3(nCH zN8OG3i}i!e6NDcKwg*Rib?H9LZ?JhHA}K88eKul z(Bb<$UkZ+DVFN>sj4#c1Fspwx=klS+Mk*1AS(!q7MbjPExclMP1D@_S#5@Pt?ZGo9=Ia!i2M_Tj;RP9Y)?|bfgLEE#y$fNq~2%be^_SZme&* zumm8<^h!!j&L2=L_UyntSVZwaz~;{Oz^OAirl~9VM;e#{PZmeCq;L(8B4=j*fPP}+ zOdF zjL55D3C^0z1Pt^-bC26Ju=D!XmrM<#SrXQ>hL4ij0AgwGH%aK!8T!ppdv5*fm8!c4 z=06pcVBx}F6&J5y^m-e^kYlD@C`E8sH?zaAz?AO_gqyW#TQqUc0Ij|svD1~9l-e-; z3)NcRhi@ei=&OPA)hK|06+O7f-nw|jKSSH<$7Yw4P#$z(~zAa*mGN_1XBZCV{`sTf|oxr0+;{U^J0 zg$`wu#P%`MVI=R2WnH!>n)J2yqVwCP_cg_TM?5ObN>vI@RIva~dI_lXU zBRe>uRks(!06cPzFMJz^XhKkh3mu^-c{^uVICnjK6<}$S2biO{Giov8m1cT$m%li2 z)kU2>+RJo+x+z9@OhBc69tzCBr-ndYa0=kDs6626>^fdy9&$*+{Sv`UUckY>MyOd7{=OJDXm6N?judsYW9e}l#W(`G*>3aJ0dLs z`xKgKo`SxEKV&$eE8B}ya>3IpyJ}W`ZlF_iEiT=w-%2t6DAej&E_&M9U@T0M)mN|H z;Z6?dK~kcf^1&bh(Q$ar#c0_nW#6?{1QpIw*kpiL6xlOOE>9c0h|{R;Dnspg9Vk1^Q<=_2a5Li$fa%6mzfNcQ08+h4b5el{Eo+K5 zjsgo>d4N=X50eM(TltSveOlkvf_w|%Le3Yo;_VPuu!}Ql90q9U;ThFU6v!8pLf?qm z>DSg5i4@_&g5~v1(6yOMUZysv+~WX>S6b+|Nnn4{XP@nQ7#!vYcr?}PNm~~UEH>Jn zDjdgbZ7p-IE}7N$T>@*ZCifY~U*3SdY{)!7@OK(!ppw4a9}m@`0L`? zv=eER&fvG;YiUpH*8a6@+#M=zw);BV*^*Oomsb2)SwW?AdaCb{;eeg(aq+@F$Icdr z#9^+SoyOC5_iRE2oHQ7uuYrh{_nn`ux4Km%26qxMx|~RnP>dyCmSWgFfFNg8jo19H zk?!gU2Kb}iM@-{^wLvJsexb^iQt(=aa%OcsU`*}`_Jm$h04usu?-lvx0Ds7sSOn9> z&FC)bN74E^N-^xJ*Lg%kUZq=6+vQM&LKBW3=$v$#NmEhF%wI<@z@;YW5Mns^iq~qq zsS0OE`$_^6p3pW!Iy^M_`~~_y-dF{1iX6)LjTyLV+!surBpFXv_(rDJK!8Pm7wcA^ z1$x!Lm3;lL(MT0~z?=S*dR-!5cu zRoF$_Q1WGLP8EZmX0ao%D=ka1;O(5NsO()TD@_Rlj+0$p;19DIr^b8V3-8g`BONom z!(a`KQ$HIjqDsTj8w8~$U4RM?P6g&;)2uVYz}f`8%A2m-UvbN`Xs!6SLMl(+2d~v+ zO)S0np7fMu(o8{r%lIzpEpd}F)-*sj27AzXi_y}@q@h!*Sl+Wwt!N{?mQ@ed32&1W zmF7NkOD7PZOrZ7vxK9L$$;4|Ms3te1xf~DaiAzPvG}G#byKc-~Zx2ozFw=Hq0Cnq{ z^HlGn!YVd;5Hf)}=^rrrKI7YIp4`m&twuQyl}o!cb^e{ZBM`qj$#)-gHUy6icqS$J zG?teNA#CJ$m&dK6em8o#Fy{!0L8$^*D=kFZ(+x9phE3;|Fw$VP5hC&tm@P zihSclyJ`8}W-V-Tai{b} zpT7(Rcmewv%JkGDjeyAZ1z;p}#)58%vK$syy16)O^bostC=5n4aj?Db=4Yn%nx$kx zp-Be_&nI7)>vcJIN3oiZz~Fg9w(4Aq=0#x<&$2avS}7UdE6eWyr(QFWrCHpOr+q-X zz-O-qF)B$}?5z2Al)j}hES?#)f|$-ThZ_OuX04t1uZ({o)Bh1>GCde=@4IiC`kq&) zv+2tTYn4b{rD4!NI+P^*kg**tV~VE|72WugQ-CKSs@qXeD8RqQKJjg-_AuYUX|aKv zthm0*b0x7k11Mr5Z1XmRCqLbbz+ajtc@7<%VFKIA(9?-v1(Gb}YwING0nPoW3e!`M zea0}Zn4ofOjRgZ%roxq~Nb_g&2iA7rCkt0?2<)Z`JP|y@e5Dajjlx!>`ye%0K&uv@ z*}FMurkTvjp`{25^U%!h%X6DT+^>qxSc#M`VrzP)X}*le2vz^h6FzmU-jUNLkZ}8v z@KeVBoGjhaX)Q4J!zqv&rVc)5C%b#C&0~CZ;#Fo*5ad;-Fp6ian)?3E0h6jC^v%K9 zrsf#J{Xzt#k`K-x$VM~|T_ZlpG5Pr9*jwS!*`~`)hke~)%J7e7%K6-CK3I^prZD*G zi8AFSR7n_j_%{}y6FjTBC+f*ZgYj+)ewl5{wghyT#P697Up+;4CQ zx5RqFW9raAm;4Qkt%=k60Qs(arI@^eT~Pr2#KO;Is3A%1eS9IW&@}G@k7UsIM0P>k zkKd^z-tkqF>AyuO4|69mDS~cE6!Lfglqw8#fc5GW@Nx(askO0iE^i9h&J_!NdtNkV@Gw zHB0}P7haD~KP+9Wmt}l|M$OZ8g|8y`xNRbcM{w_b^K;^#2y-mF6+)JF2I{LBONdc) z1UwVRa|V=h>PA&8EL~RQ3yJjnVA2WRNW@P?mU~3qAYZi{Co`lXKoV0wfZl%6#WzBS ziMnlE75G#aUc;ZuGD)?CxcbytsA@%7NeZA z&EFg+6Lu0aF5X)KUV)PSDB{p*7UX zbVxe0Y}Ydfzyy&a&lAW;FtKE>x&~qCy7*MsN$>3zmiEZxlJowJ8CQC))_J}NlRpkm z`zC4I0@NHsh|6iZ{W!;va56x(_aEL(ehh0maj45$zNCg6As(Afn%8mJOi~SmH~GOk6LN~6kCet26XihfGG!iOy8+c{gMc5 zuhZE|O&w+w$q)<(bog)!Ai82bX37s~{G}I_`#H!0gBwz?00dAVj$94)i9(7GK05d3 zT7xFpS?I_}E6uF*2gpVm-S9J@8Z70@Qtt{@blrn~fW}LhDihXu0t{VK8P?nRn3!5H zK@xeD<8>TDYircMST;^Lcr;iuulhNWoHCWmWTFNuNp@Lq%?U01Ixb)`i4v6uK=@6& z7DP&OrM9I9I-c=48fA>^l|*K=TcoD*q?aUFQ#f;3cvbUjLk3s!76=y8UGw!d0w#ut z5dh@q)K+oXY!H9lOe-)}ZXvElwCY3Web!NAjgkc76?it@$xOI67SseZ*rmzzbZl?G z+xtSaD;4KtRD$bX!_pEo3D72uxMM;a)b$6+4b5VsjH0_ifJ8`fQeoN86_2_zNBf9) zvzab^MaSUP^syQGe9!XZ!dIND>rXC4Pe>3RyH9`r&^P17Z2l=5%kr6_}6e7|h9Gn+Tqs!Ut_CP5&yqd*d=zQ`&%0`sN* z+^RBEd|wxPDXP7N9c2UxonrdqW=FGx0GW$1{f`!aLnu{056GbV(9&q%qHdHX^7ID% zeY_`o(K4Cn0+-Gdw5^>7deI}mPjWXch6ohofw^+LCllJ!GO+4M&@6#i8NfE~gwB#pw3I3RTz0J(Qvw9sNkY-#)gAw zh(?TlhIMYDLgzRS`GYZod90br*U8WV%(Iq})`JrG%D&kg_^naDGCrUa(c6O$BQDlu zEQWm25ZzsyRGIDU1CB54`3>fCbxf*G^`B`jCsIg_XRHpyH z0EZe3gr5PcihkBy!c{#9i&qqmwgxF@SC31LJ?4)!ITca_=NF2l7x^|(Hs9V~R$Bv^ zZB-1pxDTayrD0GB3Ys4*G7)Z24wYRTTHVr0 zXy<;u6uAd7D%krI3oT#cehuw741RxGt8LIR8BDANnz8JO+? zbmD~U$c_SqoQ*!mcSu(x2W#W*sY;xK3(`^hjh~=OP^8iYKQ{nv4?g1TFJ3Jr4IIsQ zJ=pH(L8Af+nJQTj0TRMv;cj6$YnXQo593#w<-NZf1GOzFxTv+Lb_wB=>a>}Ib7Z8- zJ$`p}Viocn0l2bO-4Qrq6M<~vl*S6~<2e8DcRjMfxtrrcMG?qT2K2a!cL?ldo+a*c zmOE>r*czi6v~t2UHKp3D9+a~RMW!NiWEDgiY(^%E03oPvx@Fb?gv+QBRzqZ+2R)~E znJk=Xb$i1#(g8HDZZ%YwWG%I`68#qJ4yjQ9sJ!+2rjZHV@~2wbJGnT-#dw=S^-0JN z1j%@asTtNJxWPu|pek$>WEH>iOb=rqR@fPN?qn)(&kQ%cn=)R01EI`R`}VNZ0P5(%Rx^Nvqg=@Z$8__RHXl+bti)eaX|IN8e6dvc^P8b566l9g}AZ zKxQk?iWY8ipK*`Eyj_6OFw*`BKWQM|a_cfKZ*_cNebsofkaoXY^KQs0!m&Y^&8Ro}CgDH}Sk zN-}MYHT^aU$n5rK^tUDM+PpHW1b$~8Kik^+U?<>%rZLx7zg7y{ptgk-bK8tOpoS)- z_4_UXmJ!L)wYQ&D;DMdVe8}FM3l~D3BmL$LPc<#b&TvNB z$4o#B;t{z5;2TRDNIiUQ!@Ftfj~(!RYG>YkaCH@{!E*aP09~fBSO0++ZQZvgb)}bY z@*wvDr_>5}+$3(5b8q5!!v!UfR&ht(<hdd1u2a=|1ctn{hhf=jFXML#Zn4Q% z^|Le;!A-OLF+RBF#@Y~9(?d=#ol7Xd?BkoyMbt6CLkfQP$F(e^|HG&y`ih7_D-x8* z^w)j|F#PD$a~?x5APZ(9Cr{$<8-bF*ab5dEJrB$0h*FyX+ls)~{-3*^>ThwhlJ~s& zB7OLeaxEw|WMT#y08hw~UbYLN@E#@+Bd2|fs^Fx)wWovfLHyha3aSV53x(7&eFtq- zXMfV`-^4R)eEsZ&o{Lk>O?v=I(uO3GcW<>7E=7B>dinNa@se=)!w$q*mQXu^X7-3= z6{XBJ^Xy4LC!yb7N)n#Ry%i~1ro#WWE2G^QMOrroPAH&WS=B}*MNmWA%YF?C<>q9$ zNJ896J2LiZX0=V(QTc6E9soK+ItqmE6EmRMxXw?>J1CCbweZVxZ#1 zc>DmQaYk9|U;Mic7>59zQ~*2&M=HBJxXrwK@qp+_<=-?y){P1xU&C%MQV- z$E2x!4llD8Lq~ndoxb5t=o$mtb%h9cK7TUyxtl&02vIp`RSfR}ywo=s=($dNSbgcC z8LujcS`R(6YQ%`H-@L2n3FX?E-*cTOFN7QIsBTw~Y$%ClPbWI47YRjJNb8bLm zxq9p>O7Fu+S`Fe;a$0!+ho?h!U4?%|s*C~R_i#(ge<^{0iH7EVGKOj;nx1z+Q}rb) zx@A@w2a@1;Byiop@WlmpzEg8g#b{TYIISM=UL?&mfrW$C*F(t(z?KUiWao6DV5u;3 z8A!WA+?5$}H2Se!B4CvHBeJ;jGaI$?zUGHpAwc{2h`NFl(QM`yat?T=`W2iz_v_{? z`P+B$DR@7sX2?7;vZgh-Q~m)aKG^tz`EJ9&LK8EhzBR3FZu+_5bq9^46Q8TiPV-4% zbwT3wJRssU)cMy0^U480#ymQh>0QB0-Hit4*z|Zu(S2I^LgznZFwh)pkajU2w3K%H zyn{W`OgplxVL&0;TVGsPJA5(D(=IqhTt_}vJRq{ZgDeO zq9#<;DRQH^h*VkQ%UfK2(j8P8ZuvlbSP<4%GpC?`RoEGvDuwDML##Xmt=v|8)>RP} zj#y~;-g$WV1+M&5vqzoHda0K+angw0a>*I;%OgY+&C}Uu9Ps-s7EC09L?V}9 zUsI(ne=>$Ux#FamEd&h0<_6rdc7{Y-={hobX85o)x}f`A=W`((hXBnz9cULn_fC?l z!%s3-cJMkvDR0OC7HbJ5utOoFPCkzzeSgQ4qVB5}<7?%DDRRahP1;?yuDUwIM;e(V zQwi+N-k~1ck^ZCvb0yqV%Ajha<0c|OvF2MrcgBnIvOv>a_c%8}m$YB#veQ^Oc0EBW z&*Zh-xxBIlum)?DUW@W@hA&m%nuQ!VlQ7<$D0(eqim8+mdlp ztIYIE9=?7xC;K)Ia+($stsAh$XjrdwEw8~kapfl#bnyP@zhD0gnN+;;DCz_IP|*G& zYE7IwoAU1{cLDjJ@WOb~gAEawml3=x4X>mU@sBOxaGs79Qt*mOak3JZA?8uHwy9kFQH zyL+FNxtHH$3{LC)3P{sYO)7riZI77mLM#gY#I2O#q=f_X`B=c#G3V&ZlbkjN0&!{u zBc{BGENy;N^ah-!b(iH^sqtE^Ce|29nx!jodsl)8St`!9)f&xZ`;`xnpcR0?*}kZn zpxZZwp#G2EuUrU(GyQuFnmXlS1TEa!lQK#_BPO$Vc~t6IKh#Z7JI z2JsLR7HBIZKshWSPBI(7hL5Xs6Okw|kUcAE**NVZKnn_6L$3AVCnt$?*(Z>I!|5SF z0qNJGbBZ8-mfj07L(Qu{0i~8&V%f?iac{8U;S2u&Zj>ckskZ)gPA4RHXs8`7g|9Y@ zk8D|+C9^qfb@*tXMa?(uk+01XKaAWE6p!f_US}~r5Jz(($yhW{7<6lY;4eBqux>rOs#fxE`vUIM{q$bFwMRW|J<7u}E z6}_ljZuHaWS|-;Mw|Zl{&N$l&(p3DWjMvmlaMBq2vjf7nn8C-Fz(rV-def@}!}LO1 z-IVf16s>eV+$Nu4g^QkQa$WKRv_1s1#hB@D9^Xe7phn5v;rlB1e$Vwt+OC3m<+Vp3 zk10M=H+_3}Wup5z0uiM=w35BUBUbS6jXnN%fmB1R^*0hmdWrP4BWMrs`nha21PRo0*3;s2X(?&IN98{WGbAA-p z?0>qzG|#^eUl`JXAbY%cXhJ9vLDzBdGbLb=J%26$eNR>-U zl4n+J83Ra?lO5IMy{e$|3IGQRu?s~(Q|6eFu!dnAX0V_h+zEjIu|*U>96qwldB3E% z3}j*IpP_-MrDZ@lCAQKmWqM1&(bb<1U-DW`f;llf>Qa`- z@~;42%)K}^eHZL>hKbx_n<>#`XjhVh5x@R_r)1O3)4 z_$hY`0iBTOnP4Z~)IsS%%{5Caqk6DF>|9KRvrVnXcy^(kVord;Ug)4jHPcvrwabsE zE!*!18hS*Cg%H;32y%hv`|cG`Cx0R`A~7{u1d!gPfDAsLGy)tZ+C>=+cRGM*iIy@J z<20`aa}t2M;MV@?8`uE&v9|*1GFUtdm7eE>2&5dV^NK z%rJ&+hHSP9HHBxKr(Ao{$n}kjs9xzQ-7Q7`V1~Of>9p(FW)*(bee<(UKsv0nh>> z@nhMh=)vTxyk134qbEDAw@C{qkvl4Z&w3UXSdC3W+rLK2KSl+Uc-?OF0~KeXPVn@H zOzv{QSYrPfbdBGova-n0uuj2a(4G}~lm)mutB*mhGU!=Cl3q0jHN(vPf?}yBPbN*Q z1@7IZUG*~6<+VIx(>*>ZfUVJSWJ-frx^#&+$EqD)j7!6THOWj1vNZI7r$EnF~DK*TmQEo~=+Z&?ta9rbPtJuF|@6snR0=94ZlAAOfXdDS$ zGTKK(=a~$nZ4UsMkd>y3o!2(hvHcT7=2N7_B?-5ljXbbrzl&v_FrYuBVCD} zpojx654cM@2VW-?lZM#ynZKEef5$wl3Pg|>J&y9W8-B0B0(!3ag@3ABb1Pv74L`j_ z3OjbNH;gbQBDV}d$1}aV2zAqr$0LpHr}_0T;XM^A;10X864|#mHmRVtlgS{72Fl6P zc2Oq_SVjLb-@5Yu98#B z<)+bK2FKY*uGLtAUI(lIS+ytww9Pev^X=*|;0;-glO>X+i`${WoPdPVUHQd@0zg(v9C0xr23I#<50gF+5z-fl73K;8VLIF2 z(T(C+XHV+5+yt2WuUnY&>UXq0B&g`xBFDu%bnY-9#S)%qm^e7`0#J<@EJ@#DnEgJT z5#-|N@R-yL>E0!`zI&r*FtyXBjEC{@B5yP8tbPS?;g+elbLiz{S~9RD8pFi}8C24zqpyQ`wop%hid5Vtg6m}0SgIxZ8`T^=P!09l8id5qav8FtbuZdnLO{f2`#vI zuN5CPeZe5owEMPFw$#DC%!q&cjFRy$L_ky?)jqLq1^7vX_UzFp!~W0$H>t#tF<)Tl z>7*{i46>qDTjf*A?K#lrksQ8AqML_}TWgpQQCAnB~~V1LVz7P6&H`n)dgaOSlGd-D{h2 zpOY_v-Pzsj$@G_t(fAHMn?fBfw1ERk`NIoC@$oOUx5~w70nbsrv!Z z2fR#pq708S8Fx+DU^M$^)LOuxj`3?)2-mQeIs@0DE8ML@p~lU#7XXeq!&f7R3(fo4 zT-L>xzz#y&>Q<|!XQSsZ-&6+|Fq665KZWqHWn1!q~v4ehK zeT#fl01KKNzqt+jpe5_wV)*t+z>M(?rdf440=V{2B6~moVsK!tlh-j&^x~=8lsqmb zKKo)gBmH(s(~|>cuJCBHcjtza^i0`L*^XUN(Qw_y^RU_Hmp4RrhfoBg zZ^0Y#R|iE7U8lbbMCST@ZKCP3=TL~~-Y2(RQoleizeI^Yu6W~n97`sSXUp9Po0z&B9q}{~+pHOA1W$ zho31=18V*y$VoOb0>yyv#PWi9P{(nMYd%#;`r9|fcr$!DQRYSVwx9YLr@Sw3V7+~&3T1(7NC>ny8Pk`5!;ZfvnH3#KG=~`YR@bhg4T+?X({q{ZkGb zQvW9|IhxP97Zv@T6*6oxv7mwYc4(_+Jzmuht%>Tt02VY~a-x2Ne$jqCfDawZd(&>8 z+FuNLTeh?QYh$alqbzMYp9>8c1%d~uXpJcwJDR7jQ%lnDA(>*b%DcD#^55zd#G9#% zCv5A|EV9wL3v&yr-KLl({gjKr$dx%6c2X*Msr_z!^m8Eus~PbfshhVAHIde%(-e>* zYfQ5f3;z|SMOb3Txhx}Rm8;53W%QPsp>_AXy%E$b`|}=|OCMd((YFoJT3U?MQkWU9 zTi@g!|Kh%_b#k+QcM-R?@zJ2gda=#F=IYM^8?=V|lJ}%++YahU(6nU0X!7n8##e#x(sM1-bAeO4bE z-w{F}-4ZpWf^=zqj8=Yrb*LF{l%khaqrQh%vphBSUUC=Q_!c|OU8=g-k(`cLL~3^s zI5LRtR{Zqp03Lf>BLb`05D^@4dmq;93S^0;5mJ>!m!u8X=C~D!HO_Fi17-FFoF?SG zu8Nl8NT5}yGO%jKXP_ykCQy*)+8Y!~agm0HU zV0<~-ulBVd8^FDt)_GK+gd8$3Q^A^714k341YYdw5=9dvu{iO-z2<~b-}>bx`yVQ0 znHTspHfphs)Z{qSB*9TL&T3abe!rQscftY~$a4LUIwwXYi!QoOSW37uxazS_&=&D_ zbo?SHVHB+kFz)O+og2njp`T^PeHZ!U6ytdZ{k#Y z868KXxb>BU9+_$EWPRIFWQofy4RT(Xb2QX3*DvnxolR`e0k~G43&~1X-S^im8e0*L zGU?UKr=<3QVxDq0{KZdslWw)4-H#D@tmkZBzEANmB|UGb^L06Q!0!kIBid6jIsvs~ zt+$+z&Ig|7Bnn|d$NaA2y@Lnxs|F!>@64fg>-^=oXyD7@!z-4|^yoG%KBL*{!P?mE zeG5M&3`f6f>1$5rligyw!?-2d{hFz(aMAxRt?{@s7c<03?&j^C0sQEQQ(WD1zI}W@ zKGP=XKr(P-hB&|jSfL=(*NIAr=&25<3>)b+sTOX*315aB||W&_Q% zV!EKd-yKkuF>rP5i-lW*@;<#1+S*ruGQbC7AUt_b^G^TF5?39rxyRdbxH)O#9 z;k=nNU_2l?|GRN5h&#$EWyzO5h@exj@AC8h!W9_bff4R&0o#v?&MUtWLmsRxJJAW-`1_}Oz=d;nKJ~iweoy8DJ?8UFm<~M4UhXOxxdK~ zHqm&lz!im*8c$MFqP2~ep z$`#3*(1bLBVf^7%{qDN^zJANq7Jq9|!>|->8t?jSc`Q03W^teKn2Yfzss-F^y@*4W|{M-)tbY5_gmnU^AKz{BryAA5C8li+7?KF3fK`L|XCKbIX1Jl-XqcV#v+^5+ZR9 z_ONgyaO0s{uHd5PiEYR`-?&n)Y_2+$XUG<=FP96J=u!Pk8EL|`v)sYYj{Jw@eXGiE zz(GFsZ_)5nd;r#%aCLe5@_n0gsQB``&10Qgx{pfFW1F{<5)R(pDZ$2oZ6)-nA|s8Z z%oC-hUCNLz(`RA(ZDr)aHX!8}MV1zF=2JZzJn`!B?qI(H-h5ALRM!hnd)yzi#RFzr zYuiRN(0-u$!p5HOreM;|(VFo@L`r{*B=mq)Mjo!}fs8}&wgJhyBv51x+V~a{#*wKJ z(7yxJ4s}kojSiW8!LL)E6U(yq@W1VJ6zSZuPEiNCAU?Bvv=;UE>uPd9ks zo-gMETUxsNaQ_%MN_>J|pA!92YJYC>qw;%o`P=R4ZyOFSZHpP-*eUdVg7COmf4C(( z8<+3@ij;SmB$RB*y97&28&iyQg(IwQrVGz`KAC;~{y2L%BtF93E8%iJPWNKNVF&hx znw_Xy&Yvr?pPEH!3CEOEr{KczDsAi&9@E%YK`k!(noRqEEd#^ zoIHhoG%P4p8CbzrS_GsJMIo`F5hN(C1fve%Z!<3-S@>R zIfnwBmQPCQW&FWU=Oo$oajhFB+|-Ty7_*C4AT8|YvpjisJAf=*_L;!MX!iV*^;Zop zEwuVl9DNgz_5EOqvIpHz?jJNq4Kzg(<`gI8yXCH$CHlg9EVp}Tpp-@Ep*XakkzoIs z{)2p<4W-_P)!ic~4?81uXC#|Qu4wan8|1$D0Kj6RJA;BplRapUedvp6h_?4lI};T4 z>oOCaWa7O(4PEg$p_ylHw_681ti~jx^r=M=G;7bLXYKolKs9y{JqjEad9?t2;WpEO zW;Zos=Zg+2X!Hi)9nO_h8vLWAYP42el5> zxm#t+U1vhK{`>6I(4EeJ^I&a39quU<;GB>$d*Yd052FkgK zmi zyyf<8`Gz6;lux%sZ8;Yjs8Ud=cd0e^5&B@zutwf(wbC7({I!)GD8bU0zR~Nkuq-0_ zh4?ji;ZK~gaE`45<@b!RIo**v%Wu{D*J1?L^V@LV1VKiuc)8(`W`sZULsfvX+|`r0 z)4ST1ljVEZ$h*h(4ycHDzfp^pLqQXY4JZTGVZeu-BI|8%HleI*?GJfPPIxnEjEv~8 ztSBKJs9|b0Aw7{`)8td_TD{eq`~_Ox*6NSa8aIb(V->5u=ZaH++0Zq^QqBmPHO3J#K1HP91#Zlm)(D_&o z9+un*`r5_S|9X(Sy)OH`?FQGm`N}_LByv4sr^Ctp$JN*L$*$3ssjcW_G- zn;SYHmgcMBSy6kjSZ)LH_Bna2a$E1>-E$ufNG~*Be+sMlySZ9h#4LqfMaf>#KC}Ja z{4tc?w}BFkh`#R&o8Z&R4qwgevn%sb{%zY5HUXr{N9209vdURj?p|IWUv0p3m1n#3 z=G3H~+zh9dqchTzZLQ?A;4TZ#>r4AG1{^XMA1WVfUaa znCjyX5=VMIBA~`I?*VV7CZ< z3OS103`^00x}yBkzsN1{dSw~h5)DUfbwN2XEc@=WBmTk3nyE*3k&Q0$fVu45i?En6 zMV5ts*O$ti>Q0(rK&s5EVUzXYiLW@-n(Ig+!8@eUNZZB|khGc>$D|P;sli(13~4<} zZBWqbH3zsQJx3g&>AuO|i-mDqovZk0#P~^n#SZDh;|wF#>b1`M?BoII!tZOnwfLSa zd_1N1-2f>2uCL+#rW9<=&W!tP4yD|(wnIv_(T)`QTK1fs#G31@?+2Nt+W26fo?Qc} z$mu|`Cz=>3g!mtEi=of#kkTDhxa*4DbqaE3;Jry(=?=sx(M>xq;^m}`OkJJy^)l%P z>qokOYPKz8RzfHY?>30(jI=-F9*&Mv(R;B>ZK{SEB8e=g(Hg4Ebwx17M0djUe(8cq zO{+!wSB|SU8_&zU8+hg?z9|d*QeSU5zHl<2t%&&VBu{i)anxR1k-v#|-YAa;_Daf_D=zdNDbvr4^J@sekkC%gG>-)ZpMbe`4LlRB_o_-H9%TKG3g|s5cpFg}#_Q{%=R2 zcq^}`HSI3Fva{z}*c&}>PrEgoE2`22{X4KLLazVrkIC=SE~YmkztW{3mKS>0XHA`4 znaX5*;~Smb2@2wl|Gev00@&C8S)+t$c(gp${0mme1hu+b(g0$3>fl>kkLw zL&``WTr2!cfW~9=nuqDRQTY_=J6vBo)C0PL`#asV*M<#`O*4LmwqarFwydCJqso4l>z8M$jD99A#}PYdXB~5B`0+kdY?UP z7z%Z!p3`564%LH>=i>f#AnV!mzT?i+L0h!C2y^W!(2Vpt!3r#mU(bZ*`qvWX7TUqL zxU50bD85N7o&j*CQ{s^=UP8j+j+o#?P(of!=;xdNT#x--ws7qhXZMrhCJLqIS$F1P zlrm~el^?(v_S@+N#1izM*CgeY=c$I+DaJF7fi5j2r-e=!|4W<0WdVabZ4{di)%07Q zNCWD4x#im?jm-$+=a%M|&X^ZrQFHTEPyJR9TF~(V*8AkgCLBcBGg_7{mn~7Qh95mo?jDshke+w#7_sOJ4=$*4gwlMHSh@6DBgG>ar|t;SUMd8U0(>e4pQsi?24QYXIi{c|$QA3!uV zUGY%tWc|2|^=^FUUDNM5(=3tLm)euYv)YI{vZnC}_Kbv4Pb!M*da4SwDBacrgLIv3 zBF!uA{5Sa{zS>*N5ka2s$hJkjJI@6hH~ZHtCug4-NC21Guohla8*O?%^v=8Y6^BSF zmPNiyS6~S^EZ#}^c)j3k$WmDNB$juZ(JsM~y@Bz}BV>SATB&_Z%AD2`zb0;tlF;z4 z7Sjt#2G&ZX#05uC6zD8Sx-8+^`uga2s?b*kABy^-+%Em!&bZPNTvk%H76(31E>8O>y11WDN@ zbCUTMVvgRS9|abl?Plj*Ez@HQF-lwXL@3Eal~?4L8q^lm4ly%Hj5i1m+?a}A4J3?u ztG^_M%rY*vga}@u&Cj*A>_-K<;MJ;C!de_4{xJ`n2Xt9ISq`H2)wp~=7Jdp^e5xie znI-sQs@Z>&3=*R4f2uklLK=5exQYac596!siQP*r?=R3E)0UVoEUi-X*JYmFb~jU( zB7RQrv_a`^+JG6Jx!fP90pIu}>iQqveO~fS$jOLR#LnlK;}bR0Rgnau>$Q!R^U$YQ zYyZyG-gj`c$jeCbiB}Lci)>{|BP)gzz z{n)FUzF5NlSD%pS1?sCC^Cm>a3=RDe_4pV96mT!)DqHP~pIjJ8Lwp2UA?(MsP+(pz zH^)-=8`AbQu-uH@PO@y)e(Q=8LRnnMgkA1Q-U(@Yaas0EGD4p@e`V4FI@}Ge( zvwXbqTVq6jJHzS-lfBkk)4O{+NaT&zg~d6&j+-s%PTkd^Ut2hp~`Jk#e+;$eOv+lNFwdJ>{> zF1DrDr%(NN*Ps9QzMv(zX%$4b>s}~#QCGVkJ+Y-sfcQb~5rkGZKc>wWwaOt;aeDk=VHZIYeKTSMRI+Kx(=W;|6Ae*gQZ zaH;5P3Mso{Pd+}nM(_iF#+e^^g?|wFt@Yav`n`*P>MmcYXoSuUqt*F4^vKc@fd=&zE@#kI}iwJinbu%d%jMN|va4MVt4hDfAAyN4v$ zkb-xR_}hCk(v6AGhK}pSdL;r8uY}(Kv2G8w1`NXnH^NBDpv~H#Hc;}{Spd)qS-J@E zo(v>3h45$H@ZP9=oP6xXWm#`qsF|rVrUREMktb_;-zFvHRMbh)(L__?Dc#%Euh2`( z(Lxt4)TMU#3hH%ux`yo)S7c1I#=9&Ago)j6Nd29OS7p&p`;J3;9E^>=$Gd?${)r4l zqYL4TV|q&wKIg}%c1No!(_aD8(Fty7*=7E^_?c|LZ~n_9U-Ooea@=^MK2#Zs4-pea zT`V(+Vk)KnGu>js6%LwU4sJ&|C!(B&*xm#99`kxOSyhq-m0JjDeMwm{?iE^M8=wt5I%-=zhR1@!c(Ej(;s z?|$I8y!qzZ54}2I2twxfQ%|}#!^+yrK)P*N$ER-4iaW{z zNL$T&$sHq$;I(VRmr3jRQ^%Iy=1u1e)CEVK+ET}_&$YoGmp4A@n$|Vl!zaX384>&I zmiv4C_}=V=GC*A7BmUp$#HEBJWR7Wjss}rZJt#7p6mM|%(~@Ktijw6+TAFbS^YC?z zuU?)`zt|b3IA}0mnjv{k%aBM-$Jh$!3-ms zGpcGyWr6W)>`p!8`Tg*m_XF_w56EZX6K|nj1^x6nc2U%`IqsU-^sJUtJuPcMqZ+T~ z4V;%E&x9)&CDM{RL9)`^t7hnJ>!dH;*7HJ@62h94N?h7SN{e3t>;7MRZyuLa-u{hG zQiC@3nVvIr=MxICxt@Aud9*YkS*e&E0BoWqNAUgz_KuA|>x$n6wTiOP1gPq!AYLdyD0)li^Svdt z%>a*<+a0I}Zb{D#+bfuUp|1eBOS20;s$n-KjZc{wP^s3jZ6p~Q5zm4&NhpR-3xZCfde=;VCBc%+pl1HKV=_@u&QpfsH`2hCeIZUlI*lvtkOc-XdZqE7Go({dc zc~Gz%=dZcU4CY{MNLhxn0w%;!H#U2%vskYYC8OF$Xq9wm$okJ0O?`rn;^J{-j0 z)-DSGF9DiV11>*s>w9#P6uD5Q*~p`B7!vqQ?vzZ@Q$M3N(uJKZp2mKm$ z3ZbQ@n7zWxW*(D$`@;8VqCVTN&mU#!V<@=3*7F4__EdNCN-x{Axb}e?%YU!^Ror~o zGdJT#`~8OYZ;_|AtfyMOTt{q|7Mgr-kCdSxqHJqW<2rw3QUzw}Rik2?YRZRLk&swRq4iR;|vyF!VbL%AdWHW=5FVN#$y=>p1-0d(bAdZ-V@sqLIW+C54maz|O} z`qTT0pZ*ju@dWXLD=B&Mw;176b~?Lp^Gn6!^$Q5_>`8$po#Y01`66vP2N@SGMxj#< z$MtJZZyM3(cA8+P$d1}`f;g4k8-v>*(WZ-HE42}0Gail2td&U~i~^g4$5!rxn7IMs zXPCdBw67Tq|79976<&VLN4yR{j0La;rQ7H)b3VCh@EnS)e`12zfN!e=P)93!+kSI%MDcoWWDew};UrENBV_UkRJsS1fV>=}-Ep3Y zK`o7$SOOp`6gP;##AyFyW|h7s^o(uq--mvwI-~Eop7*;8OB@Y?EN6f&s2}LJ5Z$eSYKICG(qav)XKVIEyvbGo!+3tA49L%nBYtywY9#2 z%d2omW-U+>{1Zw`_#3I|V@BlKUXguuRuJeP<1xV3Vdu#7iO4)$#uI&`V3ThB?ab(W z&TnO2#xv*Er#5Y(Hbd!i_tp#r%ihX$mfI5@FRVZNz!L<;^l$hZK2wfgSY1B{*Ly&= zh}e?C%8iwdQN+e^LI1<_iMiuwky&TcSpn-_)n3T83hL$|a_9-5c6SzKMD1?F>>IJ_ zzp(E`^})#Sb%Kz^K32iYKAcY;ZK&2qlkMlrKo9JX$p|GZNcWh|_Dl2f0#oI6yCVqs z2|Va|_gpoJXIW~l(j3d!gROy^?~MtabA4RF91pZsR2gUP+?7$8SaH~m!q=@1-5Mb7 z@hZQ~QD~6Gwr-Qi6TU!@qin-G~)DgyPf7ghHf>gJsneNcq}}xQ$(O zoDId8k<{ivLrdOpTYo=@UR#pS=Wy^-C&gARHof@k4yilevF_XIHHU`vJ`6hT{Vyub zd0fp`E39ecCJ?+O+ewUF)3FJde0=Z3K6FAgk&i$L-RaM1MsVFdzXW?c&IYc(f)sN2 zvUP#C9Np)Bj(+I5r&!~DP2xeC9g$~G>_diQ1d$GAfIu!4Bt8l2dH%5eQm$i{du6HH zAB{UtV%_wS{1Y>ttNw>z;DoG14L1d&GL9rG>n^N6GWsc4?JM9EQ7xk_J+AFSYb7@m z!j}_@>e;T{F7Y%9-7(_X(VK|%{Rv-=o2SgW*V&j-Tt-}wS>Q)c0t{+?L+85SFZ?n= zSv@|xr@?WkFWBh%DYwz%JXoi>120i9xH;NaqEAxbwLWCU8DE;eW`E>vnR~`|H<(1%`}3@d!zjuRo6~*-o*S&ZnWQaj`{ljC7isU_;ldP)~h&p zSgF0E{eFjyiS4WO&v555hGtZk^&U?WGDrpXm)PY@Q-ZkXwmAw{i0Gf%TxG|1v(Rj|)0KcEje3sIz$kgCd{Z@zMLS=knZp=a{TL*rL*a zm?Fy_YY|yFKz9deZ((qkP@Ep!JAVN1`%+zgG}A#@*vTQzq_+Zf#=jbXA}d^)X+Qzc zzPDu|sqmfJ3yVxyCLAxsP7kzfP@N*JTfDJ9l@kFPl&#}i0nrbcr#ONaQ&E=-0H3v) zB>~7PfNIXq%iJhQ0x6q#+9RFSFg+)CZ&|=H;4$ zf+@deE04pB0EnTznud;f_w}eXUDlz^UeTPlMgHiR(7YYp++z)kvsJ*_a!!=d z-@d^i0>>@M8dYq|1u~ySqdH=iGWjOwzwX8Mva%G(W$V=*9x>e`r-`T{#J!hDBQz>b zP>LWATE5O*9{puee>ESvO1HRC7@4^lnrW5Q`g@z-??UEtSWc7TJDqgS7R+_RB3LcE z)_K}o6cKJ1xD9b@F2gYQ}tb!`lo@XnVAbPUYypYC8i00|2aBi zpJQ)0;5~aMQoX7&!0fj>a3o1Zaa;{d_u-D)+q*bsne_A-owe&~9}^0A_c2DvC=tig zM&KNv{{vg&zJzP9yecRUi0gWp?f=;7g1;dgwpPv#=6Lp9m@Ni6mtC?APn@%r|0WpI zo);`V3D=MyYlrCMbir%%OJGk(?d@n*mkRd*pvn0(xiiAZHq*g_ktj5sG( z`nf^tTxAw;RaXsmE__C&TXa1lxBEdN|Dkg7wNN?=;DlGKdC?(OJ-mnDTKOi`zP;f-S7y0wV>GXG<^`C)@&9#d#hH+v7(5=3(4n5+9w&z2^!r~3G5 z?K=_S@Jf;FPJs-Wd@7BI%(6D>QWz6ZrznS&m-pZyCu9yfb$Ut+``!a;(t;aU>2Wk| z1I(;V4GgQW#WY`a!{0Fr%%oyu-Y4x7*>e+BBNd2h2PBGfq=^2ZkyFehRvksied*H} zM}?HydahOe3pj6ddzlMv#A1;Zj}zCXEc0Eay^SG+0t&V^a%}Z>_H&6WQi3TozeT=lPZ^no}bmZ0U6e zDFGVxPIOiD(%XySm?7Y_aZg(-p<*dF+Zz=gF)G4DMN}QAq?VRDF616P=!!=H>>1wK%OsmSuAX#iH02W(I9Dmr4Lc`!O5}rE$p+;%wgxw{PZ82u-#`Z z&fi^$J6QjxNhFAXzl?;Vma@J1<;g4iK#PS?qL@VyD`mIIx`qxLI}}DVe7T|HpMbPK zo7`o$(Yaccg?Z2D>^B<7pE-g=B!&D zi`nC8o%c_2O3~Q?sWGut&VleotAv zB3NVf_F0abCf=|)>xzdN$UL0ydi#W(R9*s!vY$KS_WJ)&5sLqo7qWn!9?-4YotaAe zLQ$vVg0wIbh{Db|(}z-CYWhQFcwZiSF4OYg&8^6r?ZWTN$J88#>f+qBx$Tnhv#dun zcVlPp!p5G}+m0E>E-lK=QEAX^;^#4E_lK-ddIkhVKUo%d9Pq-luyCq(y>nN52y@MvR{28dQnD%3d*-V z*UlOWC=cuPmSfP6Q?*9l&Ny+0-k zK&2jS&y@^A@yB$(XoRpDCx@Qz=33&>g48F^QQJmx&fRJ`=vlJ{Zk zF|@?BUd=&y2=(I|nnSO=6km>WkA~)@Pu8QO)Ex2^hI__PvDXRJJ!t$QdsQy8X=Bi3 zp$dS0+kd7gxzqTD@)#!{pp$xqFDhy8m(EN`_6jslcyJcsV_TPn;pcYRE9ivrkM8tp zwVt)v)pon790S59`(-90fb5Go<}Z(xV~%I6129iE19$L8tdobetzfDOpkA-6QU=3V zds37w|7kzU3oRj$>idDR8(2RQHk&)^HMRg zeAEUfIn;|k(gqYC>{1dCFJ*UpPO`_kM)x{fePNh}HObLzvo32U#+tkm9!FO7x*R58JKrw3)J9k7mL9%xt({ES=VU5fd802oQfT=`LS? zWMMXgF5>00t7zX^@stInj8Iri^U;C>@m$AZZ8@b<%=Yof%-lJu| zD2t(4;*8hhIv)HS-gcHZm>g(*F#UhQ2YCN?1E;Fb_6oW@(4a0^^ ztrhFJlMkVUxt2^UW$ZQf(>v92+lw=c@>u5KKTqld3MvETgkqoYZyhH_?J1Sgjz&bRGJ|7xge&V`K7_8;%fGTz8Hw87@YlwT!v*7<_g>bHHHdu1 ze2%{{v_^d(zH7k02puSc{lc&j zvdXk_?3FnmJ1i$KSo>$Q>q`UYy4fsiAX0c5u7I{&A~yqYx+hrDQ{b$U(cL{M$|_0(+9nBAo*waL4Kxq)EnV_rT29(db}K-DvvoLfHNg;ZFD3r~R(o)aG1Vcy|K^pT^7cTI zwmmw!2g^|6xk+R;+?*TP81TwyZu@d*wb_*LYjc|PIaD+6Pds&jPH z-`T_PwdeJmu#yo<9}QsVfJJwmUW>jz>ygO2!nb!A?HU#bJ9d3ftr|Y-AEM#axGcVu zjl9|WLf2w0dWfi|g#&EHpw;7$xvH|6d+yP-fLTLh^2}?UMZfIwxK>dPd4~y@SqQ4F z-RZ9z3VI1VusxCIeaN(N@x?;Vp+cz6@tC|;m4sL!v=}E~@Y|5gJ9VJfVlvq@{vkI6 z#U9&5r{_MGIg(5&4^mU}?qi}vxyV=}o1}aaM55ySnuBQTO88`x9uV*v#jc*A4#Nn` z)?ZoAvm@0Fabg|!%;uBr4o73^D|JH=F(-*K7#!A_Dr5z3Vk9%`v+_n@WqDz5mYX^i zz#`sW^vw;bf|mw(7m05-`PxE>4&Fp@!b4EAG)8e3Vn^x^4yOgoXxgFv`u@3nBw{pu z&b5v6V;IeO2F4BHZ0jC;`pA6FF_QRqLMxrhwC#7{j}Kl>JnSR ziKv20oKfCpaLSnaP|67fHm-%8%e*IvnIe4_5@5A;fpjwMes4~dEIe-cy|mDP-@LhJ ztsu+BL7V9e!(Z{U_HbU}TS&~nr?;k29HHjcV@`|e_ade<0VQ5g2S1U*{zy$7?JKrq zmSCA!Zl^9wf*Y8-IRR}oMh^_@;bl-{hW-E`+t@DoA7~rN$Fw!6Dxd*Z7u~mc4~#QA zZr_HscGieuXC6WwmmXL&6F{rH200Wb;{23mfo@5IpatoQUi>XZ>$gcH{DV(;-X`Ua zIXi3~f78R*e*!Ib$VA={2IB@nlsM*tCjIL_nvjeLz);`4PI=>1MWxSI>U{-MtQ6t$ z^S_Vj3#~KgD);Lfqu-^@#&&MGpp)JVjze94Xj^XCK~n4mwlA!~fgp~9!Bp($#u`fZ3gp>vO@9k3w^g{{7XwZRMA)%|B7<@1ejld;v&W2ggLd$n z>D^~^SHMc1$>6zux5q5G=}5&2s6I%}-k**SXs^LEW)B)QSq<1f};Q6O|@CV0pd67$MF zAeuehXCFV>)$yw}82RLWkc}Pe7QZt%mGj7o@623ZAk18Tb|2KZA$^Jf#Ve*{^ztnf zooFKLFM}*CSrGu0qDh0U!x9x=J7Ek2YQn(LESUIOJ`p{K0xt>Q^6MKl1G-VKyU7uO zo)hE;edL8FlTar|FRg9C?7t8~Pl-EY`{tFm+7IJR_#M`ELULm>02AY%cpNDJ(j^Q| zG5JKY+>c9j_=u3}L+K@c+`HWT{U}kEK4#KbRZT>OYTj2wahda8DBe`xLwX~mW_G|$ za*_zT+iHzoRW~r(!smS4_1sN?al#EfWuh`sGc(7{ZOwqiq0?90@Rx+NUy4{yW)PA_dc zngc9g@qpca6tWqZY?-g55eKom&~eKub$&t5b~5!EKL62l_dfKg+3F5Cov)Abmp-SV z6Xb!reWxeu{Iyj{!l@5DZrBY!1+fRFc^cMB;F&hnjytbREo!086uM1dWa_PT7j#5V zqM6gXEd-g+?YPvbJlE(2{})-Sgz~gR0@mw$J+mNI#&E>0!eI#_j=qPNKQeJmh;Q?A zQOqdH-!c^=nx>|;9;PC$yY0R;a2kYbxn8Y5Sm1lV(qZFmu#v!c{ZrDsbt0Lsj}|Ox z4dvf+w}Y@xk5vRbDLA$h%@XilqZ0_3n6_SJ)}el-RX`-A+4T4E*>+sovg|hXH0nS^ zS~e7kY@^U<=%gvZ#DO4JYLCY9zCi*E18r@_@1wSxQ^) zm_aZ=$z2ABrJF#kREp%cq8Ao9%3z_5^i^Wpd>s}*(D}M$VG80|laYn)TXa-kH!yFu zmko-~2%Gi+X~k|0P7GSG{+K;De&O)S9*2VV%X?e_nntIk5ZVZWrS#44aT1&}sdbqU z9e3B1_+#BuVvdsQP4FO%_K(#ARJ(JBf_zoKfu3h(;dbmyAH5`4GDg>8mojSAFZbfE zcXnnfe%fIOZ02R=DZgf(1;id*@7=PTSN0P(_ak>~Nr{7aU`^nt(xNF4;+9+d+FKRiN~S-T@gsEY-s_WL-Ky%7uwi=a;UqYruaU zUOrJ&Jnq_3;ZwlDk9U~qHRRd+!PIL)O@?Gl%M!#rg=!^V3zk=I@`#}4;o6q9YQ1fR zI#oVQZmwmbomBKeX}W9b%7z9nRG?vx4m5wqv?mBloI(nls25aTZEZ4H2vTqxOX*X% z=*YeNFd9^UHW{m%JRN&OSW;P8;J7Nam=2Mfe_{^^7eaCA@o5Q9d%#XPnKMTqW zGV3e;QM62Y%V+(72g1iZ@?e)SUU|y3pJ-^|EVYk7T^UbP)X7;|spNqX5L#QdTshG- z(?N8_ZgTsB?MFz(=jzc!~3-1Pc8U@G7&P|w(vZk#ge#oq@O{&=V0Jhjz-}8TP zu*w}msbk&#DQnn@#rki@cVm#5S$57qKtvszmug0RVc>_~Q-3KGsL`aH5UsrLiY~}4 z^F$JAta2U4ug45Wd`y=CG)Z{mC@Th3H@3@lhWB?pT>l%srVBP^a8lIYi{I=QoH^lv ze^8&f@xuO?`bL?T#R$*e*sI(D$E5;;6cJR{x9YX!^P@pv60z_#g?&b%7GX`v-6L2xn+IM z|8rgj*dfz_P2kc;eZrd?NeEe8igm^BH^*Z;cfh@5bt#mAZTIkz13 zz>I$BGQ;|)FkIii_(KK?v^dn&arNX(^;*AwFriEK$^O!|E;BKDW(Y9PE*nFT>0VVO z^caoI?M<{Zu7$Uo(*tMXkB%jsmwxay zjOFaf;sero$EXnnxmPTjI94ng1UUg;i+B}ITZ!=@N1_`X z&H9=#vil4ODSol~J=cu$a}1KncLh8rnxF{a8C?(SZ)h2vM|z7KN#GrI2MXbhfJ()Q z<_vqR^Vyd+WgTcA^>%&pE4#X@GIGz|b6|dHE|NH&&4%YdAsb^id^Fyz@rlt5=R zL6Uqx4B#+Wu|{6zBESBE)8g?9BW}vvD++)V#CgP9la}C?j*EuGRqwt0&#wX6 z8CUKDq%WWR?74CxkgBT!xI18!PuD9O<#L^tK>bx=C>dGnPp^##?W%StvJ9>R1b!t! z$mOc**uRs|E9(3I|0Q{K2T8eCMp}56P-vPuhA55!AzusxKM7Z}AQ_>OpkNwfcvfdr zyCTNqGjbny%m-T=p*R6+qlq=m|CLoAvsXxOz$3?E>?p-I(WAF=1fR+7alKtRt?X=1!-Ipt09%t!-nua#hcXogLWbM1aYM?ToaADWFc;zq-v>9AJm7v)Pz$NkTl^3rLEZ3DD(V zt~9!5&zw*VYBAT>fe^HiK9w%S)n`krMl%&XlaFvbx%M+0A(P5Lr|8M~)!%k=_|@mv z9_oEEdCY7)c!AlgY+|2#hxJ8RoS^T6gy%LGHA zb)WY5;ri-HD8})dNx5BXZuQse6*=<*dM* za0h^2(BxLetmBmBoqywgdSZ8@gVYW!xCPcg3uH4+vF-L#JOh>`O67g=WU2ixTcTYY z%j7mfw(iRLJRgo%+Lw8Ctnm{LQw!lAWOvTC^Se#Q?UNSvVlMZ>y2ppa&!*pl`!nq~ z3+dC}fKafuw`KK5#y~`_9W52&JldK@`zXZv))$)HCM@mSlR{{`_<`EpYR<<#dOp&Fn4s}e z&sq`zIW^iIbA9$}!P4chgl{q)%^k-QRe|Z@IDRFYpVEN&;VfE@L-glt{fJ&oKD&Cv ze~IEkZ9=d0T3B#w1ziR5GQpR`1d3wV5_c6?gS~K7JypwEb;Ut;S!GEs80(V+lrM-H zW<6Hk3zLF!ods$hF*v=kA`y|XoNO1rn(&kQp87rbG$;&UrMUlGsrQ*I!oRUR10SkV z?zA6in2W8I?)D87?G_)RPZu^=yisc9~MI|S*)p(iH@W1N7ZQ8x`=_Ey{P}@MoP8wH`Th!=TqF6^lYt@sKx=O5CkkFVvZ}IW}egChY!0HHe bX=}jw(YLaD@$;VnpL0L^o~b!~`H%kvQ Date: Sat, 10 Aug 2024 20:44:06 -0500 Subject: [PATCH 033/138] fix image --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 70ba89aac..b9f8c3f14 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -21,7 +21,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](../../../static/images/activity-monitor.png) +![Activity Monitor](/static/images/activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has by running the command From 0acf25f18a54c8d6ba0f2f90efcea32d2b15abf3 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 20:45:35 -0500 Subject: [PATCH 034/138] fix image --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index b9f8c3f14..480ac2ed8 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -21,7 +21,7 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](/static/images/activity-monitor.png) +![Activity Monitor](/images/activity-monitor.png) You can check whether an app is sandboxed and what entitlements it has by running the command From 497f089da82bbe69dd421ec483ea5915d6821edc Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 22:52:08 -0500 Subject: [PATCH 035/138] add aridrop and handoff info --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 480ac2ed8..344b2a255 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -133,4 +133,8 @@ Be careful installing apps that require Administrator privileges to run, you're ## Firewall -macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's enabled at the very least, but you can block all incoming connections for the best security/privacy. \ No newline at end of file +macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's enabled at the very least, but you can block all incoming connections for the best security/privacy. + +## Disable AirDrop and Handoff + +You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." \ No newline at end of file From 9a8b622f3f35abcc09c32e3e94a782d6607f039f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 22:53:12 -0500 Subject: [PATCH 036/138] add bluetooth --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 344b2a255..f4f18cbe0 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -137,4 +137,8 @@ macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/ ## Disable AirDrop and Handoff -You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." \ No newline at end of file +You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." + +## Disable Bluetooth + +Bluetooth adds extra attack surface for nearby adversaries, so if that fits your threat model then you should [disable it](https://support.apple.com/guide/mac-help/turn-bluetooth-on-or-off-blth1008/mac). \ No newline at end of file From d2023812c5e6eb49d832961ed2764614d386a170 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 22:56:19 -0500 Subject: [PATCH 037/138] add hardare disconnect for microphone --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index f4f18cbe0..67c11af15 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -141,4 +141,8 @@ You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/c ## Disable Bluetooth -Bluetooth adds extra attack surface for nearby adversaries, so if that fits your threat model then you should [disable it](https://support.apple.com/guide/mac-help/turn-bluetooth-on-or-off-blth1008/mac). \ No newline at end of file +Bluetooth adds extra attack surface for nearby adversaries, so if that fits your threat model then you should [disable it](https://support.apple.com/guide/mac-help/turn-bluetooth-on-or-off-blth1008/mac). + +## Hardware Microphone Disconnect + +Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1) for the microphone when you close the lid. There is no such feature for the camera as it's blocked when the lid is closed anyway. \ No newline at end of file From 671bbb5c9a2e950afa5b141a4c1d906b2b7bdd24 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 22:58:20 -0500 Subject: [PATCH 038/138] add restricted column info --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 67c11af15..7fe65c403 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -37,6 +37,8 @@ If the app is sandboxed, you will see [Bool] true ``` +You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes". + ## Hardened Runtime The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an optional security feature that developers can enable that makes an app more resistant to exploitation. It prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. From e3601d14baec6754dad27ebe6293939641021b4a Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 10 Aug 2024 22:58:38 -0500 Subject: [PATCH 039/138] grammar --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 7fe65c403..ddb4596f5 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -37,7 +37,7 @@ If the app is sandboxed, you will see [Bool] true ``` -You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes". +You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes." ## Hardened Runtime From a86145bc2ac889277793514c24789dc5d1f5845f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 11 Aug 2024 01:12:18 -0500 Subject: [PATCH 040/138] add disclaimer at the beginning --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index ddb4596f5..cc0901ce1 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -5,7 +5,7 @@ tags: ['macOS', 'Security'] author: kimg45 --- -macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. +macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. This guide assumes you're running on official Apple hardware that's officially supported by the latest version of macOS. ## FileVault From d196c25001519579037d42f2777b7394ce4e3b22 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 11 Aug 2024 01:12:52 -0500 Subject: [PATCH 041/138] wording --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index cc0901ce1..40f638708 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -5,7 +5,7 @@ tags: ['macOS', 'Security'] author: kimg45 --- -macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. This guide assumes you're running on official Apple hardware that's officially supported by the latest version of macOS. +macOS comes equipped with many security features to keep you safe. Check out the [Apple Platform Security](https://support.apple.com/guide/security/welcome/web) page for more detail about the security features in a Mac. This guide assumes you're running on official Apple hardware that's officially supported by the latest stable version of macOS. ## FileVault From ba517eb61ae7122aab07a092fa368b2cb51d71d7 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 11 Aug 2024 19:01:18 -0500 Subject: [PATCH 042/138] add .dmg vs .pkg info --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 40f638708..cc4036431 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -133,6 +133,8 @@ Be careful installing apps that require Administrator privileges to run, you're **Note**: When mounting a .dmg file, usually a graphic will come up asking you to move the app to your Applications folder, which will trigger an Administrator popup. The app isn't actually running, you're just moving it to the systemwide Applications folder so that all users on the system can run it. If you're not comfortable with this, you can simply drag the app anywhere else and run it. +.dmg files are just a disk image that you're mounting, similar to a virtual flash drive. These won't run any scripts on your machine, they simply allow you to copy the app to wherever you want on your machine and then run it. .pkg files are a bit different in that they will typically run some kind of install script, which most of the time requires Administrator privileges. You should favor .dmg over .pdg format when downloading apps from the internet. + ## Firewall macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's enabled at the very least, but you can block all incoming connections for the best security/privacy. From 7021471f7e199c6058e829c89541b6388c488366 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 11 Aug 2024 19:01:45 -0500 Subject: [PATCH 043/138] spelling --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index cc4036431..64ec57aed 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -133,7 +133,7 @@ Be careful installing apps that require Administrator privileges to run, you're **Note**: When mounting a .dmg file, usually a graphic will come up asking you to move the app to your Applications folder, which will trigger an Administrator popup. The app isn't actually running, you're just moving it to the systemwide Applications folder so that all users on the system can run it. If you're not comfortable with this, you can simply drag the app anywhere else and run it. -.dmg files are just a disk image that you're mounting, similar to a virtual flash drive. These won't run any scripts on your machine, they simply allow you to copy the app to wherever you want on your machine and then run it. .pkg files are a bit different in that they will typically run some kind of install script, which most of the time requires Administrator privileges. You should favor .dmg over .pdg format when downloading apps from the internet. +.dmg files are just a disk image that you're mounting, similar to a virtual flash drive. These won't run any scripts on your machine, they simply allow you to copy the app to wherever you want on your machine and then run it. .pkg files are a bit different in that they will typically run some kind of install script, which most of the time requires Administrator privileges. You should favor .dmg over .pkg format when downloading apps from the internet. ## Firewall From b44da91ea3c5f741b0a04781f3c59f85b9dac7df Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 11 Aug 2024 22:07:41 -0500 Subject: [PATCH 044/138] grammar --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 64ec57aed..444e8bb83 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -65,7 +65,7 @@ XProtect is the built-in antivirus software in macOS. Like all AV, it's a last l XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, which these are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. +Apple also issues revocations for notarization tickets, which are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. ## System Integrity Protection From 89cdf0f870be86e1f1049f3b10bf2673af08e98f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sun, 11 Aug 2024 22:08:21 -0500 Subject: [PATCH 045/138] add mention of ocsp encryption --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 444e8bb83..bee84dd39 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -65,7 +65,7 @@ XProtect is the built-in antivirus software in macOS. Like all AV, it's a last l XProtect uses YARA signatures and is updated frequently, independent of OS updates. This is one of the many reasons you should be cautious about blocking connections to Apple servers; many of them serve a security purpose, so make sure you know what you're blocking. It can also detect unknown malware using heuristics. When it detects unkown malware, it will send information about that software to Apple so that they can update the signatures in XProtect. -Apple also issues revocations for notarization tickets, which are detected with online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. +Apple also issues revocations for notarization tickets, which are detected with encrypted online OCSP checks. Blocking these checks will make you more vulnerable to malicious apps. ## System Integrity Protection From 061a06cd082f4e1003ab51abb3c5b7788024b10c Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 13 Aug 2024 06:42:02 -0500 Subject: [PATCH 046/138] add warning about security policy --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index bee84dd39..ea887a440 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -77,7 +77,7 @@ On Apple Silicon Macs, it's combined with [Kernel Integrity Protection](https:// Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself. It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. -A unique feature of Mac computers is that you can set a different LocalPolicy for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. +A unique feature of Mac computers is that you can set a different [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web) for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. Avoid lowering the security policy below Full Security for any operating system you require to be secure, even temporarily. ## DMA Protection From fa227595d7794cde7cb054e7d4da26a592402535 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 13 Aug 2024 06:56:45 -0500 Subject: [PATCH 047/138] add detail about hardened runtime --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index ea887a440..ff1110b6f 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -41,7 +41,7 @@ You can enable a column in Activity Monitor called "Restricted" which is a flag ## Hardened Runtime -The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an optional security feature that developers can enable that makes an app more resistant to exploitation. It prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. +The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an optional security feature that developers can enable that makes an app more resistant to exploitation. Like the App Sandbox, it's enabled through a flag when the developers sign it so you aren't able to control it for apps you run. It prevents certain classes of exploits, like code injection, dynamically linked library (DLL) hijacking, and process memory space tampering. Unlike the App Sandbox, the Hardened Runtime is required in order for an app to be notarized and so you'll be warned by Gatekeeper if an app doesn't use it. While this warning is bypassable, you should be cautious and investigate a bit more before running it. From 6eea838a89b475ebc5210ab9b845f24f073c92c7 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 14:39:41 -0500 Subject: [PATCH 048/138] add apps vs non apps --- content/posts/macos/macOS Security Overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index ff1110b6f..5643227b5 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -59,6 +59,10 @@ You will see `flags=0x10000(runtime)` if it's enabled. While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. +## Apps vs Other Executables + +Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not other types of executable files, so when installing non-apps, you should be extremely careful. If possible, avoid installing non-app software altogether or install it in a virtual machine. + ## XProtect XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. From 39521094cc9cdfa21954b6de753bde256b140e44 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 16:32:21 -0500 Subject: [PATCH 049/138] add automatic update info --- content/posts/macos/macOS Security Overview.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 5643227b5..cd920989e 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -153,4 +153,10 @@ Bluetooth adds extra attack surface for nearby adversaries, so if that fits your ## Hardware Microphone Disconnect -Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1) for the microphone when you close the lid. There is no such feature for the camera as it's blocked when the lid is closed anyway. \ No newline at end of file +Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1) for the microphone when you close the lid. There is no such feature for the camera as it's blocked when the lid is closed anyway. + +## Automatic Updates + +One of the most important things you can do to secure your Mac is keep it up-to-date. On macOS it's especially important since most preinstalled software like Safari updates along with the OS itself. Enable [automatic updates](https://support.apple.com/en-ca/guide/mac-help/mchlpx1065/mac). + +Apps installed through the App Store can be set to [automatically update](https://support.apple.com/en-ca/guide/app-store/fir9b01adda3/mac) themselves as well. \ No newline at end of file From e0965c8a966b349a97ef9d11edc3b13c60d5201a Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 17:45:58 -0500 Subject: [PATCH 050/138] add info about how filevualt encryption works --- content/posts/macos/macOS Security Overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index cd920989e..db1639d63 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -11,6 +11,10 @@ macOS comes equipped with many security features to keep you safe. Check out the By default, your macOS install is encrypted, but it will automatically unlock on boot. Turning on [FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac) will require a user password to unlock the volume. It also makes it so that you need to enter a user password to enter recovery mode. +FileVault works with two encryption keys: the volume key and the class key. The volume key encrypts the data in your drive and with FileVualt turned on, the class key encrypts the volume key. The class key is protected by a combination of the user’s password and the hardware UID when FileVault is turned on, meaning that the user password is required and the key is tied to the device and can't be decrypted outside the actual hardware. + +All encryption keys are handled by the Secure Enclave and are never exposed to the CPU or anything outside of the Secure Enclave itself. + ## App Sandbox The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. From 06eb072231553dd0ac0b1b625e20ecc6c5eecbd9 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:29:10 -0500 Subject: [PATCH 051/138] add info about systemwide permissions --- content/posts/macos/macOS Security Overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index db1639d63..321400082 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -67,6 +67,10 @@ While the Gatekeeper warning can be easily bypassed by control + clicking on the Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not other types of executable files, so when installing non-apps, you should be extremely careful. If possible, avoid installing non-app software altogether or install it in a virtual machine. +## Systemwide Permissions + +macOS has certain permissions that apply to all software across the system. These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. + ## XProtect XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. From 6ed5b8ad19fd7006f0e87f2edcd0f47c1184ee49 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:33:36 -0500 Subject: [PATCH 052/138] add gatekeeper settings --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 321400082..a5af5194f 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -63,6 +63,8 @@ You will see `flags=0x10000(runtime)` if it's enabled. While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. +You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to only allow apps downloaded from the App Store if you choose. It will still be bypassable but it will stop apps from being run that aren't from the app store without you explicitly allowing it. + ## Apps vs Other Executables Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not other types of executable files, so when installing non-apps, you should be extremely careful. If possible, avoid installing non-app software altogether or install it in a virtual machine. From 5da211ae8e2d3d8c9caa42332771d6cb86593818 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:36:34 -0500 Subject: [PATCH 053/138] add time machine --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a5af5194f..7c4876723 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -169,4 +169,8 @@ Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/secur One of the most important things you can do to secure your Mac is keep it up-to-date. On macOS it's especially important since most preinstalled software like Safari updates along with the OS itself. Enable [automatic updates](https://support.apple.com/en-ca/guide/mac-help/mchlpx1065/mac). -Apps installed through the App Store can be set to [automatically update](https://support.apple.com/en-ca/guide/app-store/fir9b01adda3/mac) themselves as well. \ No newline at end of file +Apps installed through the App Store can be set to [automatically update](https://support.apple.com/en-ca/guide/app-store/fir9b01adda3/mac) themselves as well. + +## Encrypted Backups + +If you choose to backup your Mac, you should do so with [Time Machine](https://support.apple.com/en-us/104984) and not a third party program. You should [encrypt your backups](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac) for added security. \ No newline at end of file From e3969abfe19a0c7948260865e7a4f7a0c83a6fe8 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:39:12 -0500 Subject: [PATCH 054/138] add encrypted disk image info --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 7c4876723..2c5ebe692 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -173,4 +173,8 @@ Apps installed through the App Store can be set to [automatically update](https: ## Encrypted Backups -If you choose to backup your Mac, you should do so with [Time Machine](https://support.apple.com/en-us/104984) and not a third party program. You should [encrypt your backups](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac) for added security. \ No newline at end of file +If you choose to backup your Mac, you should do so with [Time Machine](https://support.apple.com/en-us/104984) and not a third party program. You should [encrypt your backups](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac) for added security. + +## Encrypted Disk Image + +In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in. \ No newline at end of file From dae8af8234ef1710d3a7304c302a4ae562f868bf Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:39:27 -0500 Subject: [PATCH 055/138] add more detail --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 2c5ebe692..d4f9fcc8c 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -177,4 +177,4 @@ If you choose to backup your Mac, you should do so with [Time Machine](https://s ## Encrypted Disk Image -In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in. \ No newline at end of file +In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in using Disk Utility. \ No newline at end of file From 01f2f932d3f6dc72f07968f5f206ea01f751b44e Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:42:37 -0500 Subject: [PATCH 056/138] add checksum info --- content/posts/macos/macOS Security Overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index d4f9fcc8c..2f58a014a 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -177,4 +177,6 @@ If you choose to backup your Mac, you should do so with [Time Machine](https://s ## Encrypted Disk Image -In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in using Disk Utility. \ No newline at end of file +In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in using Disk Utility. + +You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a-checksum-to-a-disk-image-dskutl1019/22..6/mac/14.0) and [verify it later](https://support.apple.com/guide/disk-utility/verify-a-disk-images-data-corrupted-utility-dskutl15186/22..6/mac/14.0) to ensure data integrity. \ No newline at end of file From 5470fa87108b9872aef647b8df48d01e00bb2af7 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:47:28 -0500 Subject: [PATCH 057/138] add ble privacy info --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 2f58a014a..92ceda685 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -161,6 +161,8 @@ You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/c Bluetooth adds extra attack surface for nearby adversaries, so if that fits your threat model then you should [disable it](https://support.apple.com/guide/mac-help/turn-bluetooth-on-or-off-blth1008/mac). +Note that Macs support [BLE Privacy](https://support.apple.com/guide/security/bluetooth-security-sec82597d97e/web#sec18ee64d9d) to protect you against bluetooth hardware address tracking. + ## Hardware Microphone Disconnect Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1) for the microphone when you close the lid. There is no such feature for the camera as it's blocked when the lid is closed anyway. From b1bd5fdc3f3c46ba3f088ec6e09e9a622350e3e8 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:48:19 -0500 Subject: [PATCH 058/138] add ble privacy oem info --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 92ceda685..30f5897d2 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -161,7 +161,7 @@ You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/c Bluetooth adds extra attack surface for nearby adversaries, so if that fits your threat model then you should [disable it](https://support.apple.com/guide/mac-help/turn-bluetooth-on-or-off-blth1008/mac). -Note that Macs support [BLE Privacy](https://support.apple.com/guide/security/bluetooth-security-sec82597d97e/web#sec18ee64d9d) to protect you against bluetooth hardware address tracking. +Note that Macs support [BLE Privacy](https://support.apple.com/guide/security/bluetooth-security-sec82597d97e/web#sec18ee64d9d) to protect you against bluetooth hardware address tracking. You'll need to check with the OEM of the bluetooth accessory you're using to see if it supports this feature as well. Apple bluetooth accessories support it. ## Hardware Microphone Disconnect From a7bcb966245f6cfdac2da61d94749a848fea817f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:48:53 -0500 Subject: [PATCH 059/138] bluetooth --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 30f5897d2..8e7b3a354 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -157,7 +157,7 @@ macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/ You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." -## Disable Bluetooth +## Bluetooth Bluetooth adds extra attack surface for nearby adversaries, so if that fits your threat model then you should [disable it](https://support.apple.com/guide/mac-help/turn-bluetooth-on-or-off-blth1008/mac). From 72cd7ca8ac893efa4740835987478a2d01ce32b3 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:51:52 -0500 Subject: [PATCH 060/138] add icloud security info --- content/posts/macos/macOS Security Overview.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 8e7b3a354..6d1836c69 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -181,4 +181,10 @@ If you choose to backup your Mac, you should do so with [Time Machine](https://s In macOS, if you want to encrypt some files you should create an [encrypted disk image](https://support.apple.com/guide/disk-utility/create-a-disk-image-dskutl11888/mac#dsku7bb3d28c) to store them in using Disk Utility. -You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a-checksum-to-a-disk-image-dskutl1019/22..6/mac/14.0) and [verify it later](https://support.apple.com/guide/disk-utility/verify-a-disk-images-data-corrupted-utility-dskutl15186/22..6/mac/14.0) to ensure data integrity. \ No newline at end of file +You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a-checksum-to-a-disk-image-dskutl1019/22..6/mac/14.0) and [verify it later](https://support.apple.com/guide/disk-utility/verify-a-disk-images-data-corrupted-utility-dskutl15186/22..6/mac/14.0) to ensure data integrity. + +## iCloud Security + +If you use iCloud, you should enable [Advanced Data Protection](https://support.apple.com/en-us/108756) so that your files are E2EE. + +You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple ID for extra protection. \ No newline at end of file From ba7cc8a0b97442f94713dea946d85cdd9cc4326d Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:55:56 -0500 Subject: [PATCH 061/138] add touch id --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 6d1836c69..21ba16759 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -187,4 +187,8 @@ You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a If you use iCloud, you should enable [Advanced Data Protection](https://support.apple.com/en-us/108756) so that your files are E2EE. -You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple ID for extra protection. \ No newline at end of file +You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple ID for extra protection. + +## Touch ID + +Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. \ No newline at end of file From 07a92cf5843642c038eb7fa0e0554f119d896254 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 22:59:02 -0500 Subject: [PATCH 062/138] add fingerprint info --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 21ba16759..7fcc007a0 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -191,4 +191,4 @@ You can also add a [security key](https://support.apple.com/en-us/102637) to you ## Touch ID -Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. \ No newline at end of file +Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. The fingerprint data never leaves the device. \ No newline at end of file From 65a567e1713d81caab04a3d1d71f660fdc0ddf9e Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 23:08:19 -0500 Subject: [PATCH 063/138] add beta update info --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 7fcc007a0..c1d3f738e 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -173,6 +173,8 @@ One of the most important things you can do to secure your Mac is keep it up-to- Apps installed through the App Store can be set to [automatically update](https://support.apple.com/en-ca/guide/app-store/fir9b01adda3/mac) themselves as well. +Apple makes beta updates available, however you should avoid installing them in your main system as they add extra telemetry, can be unstable, and can potentially have undiscovered security vulnerabilities. + ## Encrypted Backups If you choose to backup your Mac, you should do so with [Time Machine](https://support.apple.com/en-us/104984) and not a third party program. You should [encrypt your backups](https://support.apple.com/guide/mac-help/keep-your-time-machine-backup-disk-secure-mh21241/mac) for added security. From e132878e35324d10e434b32441568176bc0abf1e Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Wed, 14 Aug 2024 23:21:03 -0500 Subject: [PATCH 064/138] add network security --- content/posts/macos/macOS Security Overview.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index c1d3f738e..dc94e2f97 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -193,4 +193,10 @@ You can also add a [security key](https://support.apple.com/en-us/102637) to you ## Touch ID -Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. The fingerprint data never leaves the device. \ No newline at end of file +Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mchl16fbf90a/mac) for secure authentication without having to enter your password. This can protect against shoulder surfing or someone recording your keystrokes. The fingerprint data never leaves the device. + +## Network Security + +Prefer networks that support [WPA3](https://support.apple.com/en-us/102766#security) and avoid networks that use deprecated protocols. + +Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hiddennetwork) as they require your device to broadcast the network SSID which could be used to fingerprint you and identify the networks you connect to. \ No newline at end of file From e8f65540d0275af90f4957969e6f08edbf127af5 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 03:47:03 -0500 Subject: [PATCH 065/138] clarify filevault --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index dc94e2f97..4d29dd6b8 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -13,7 +13,7 @@ By default, your macOS install is encrypted, but it will automatically unlock on FileVault works with two encryption keys: the volume key and the class key. The volume key encrypts the data in your drive and with FileVualt turned on, the class key encrypts the volume key. The class key is protected by a combination of the user’s password and the hardware UID when FileVault is turned on, meaning that the user password is required and the key is tied to the device and can't be decrypted outside the actual hardware. -All encryption keys are handled by the Secure Enclave and are never exposed to the CPU or anything outside of the Secure Enclave itself. +All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. ## App Sandbox From c9068fd90cd4c61da41fff1d0eafd6865c00bc52 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 03:53:59 -0500 Subject: [PATCH 066/138] add secure erase --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 4d29dd6b8..1c68e89ee 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -199,4 +199,8 @@ Macs support [Touch ID](https://support.apple.com/guide/mac-help/use-touch-id-mc Prefer networks that support [WPA3](https://support.apple.com/en-us/102766#security) and avoid networks that use deprecated protocols. -Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hiddennetwork) as they require your device to broadcast the network SSID which could be used to fingerprint you and identify the networks you connect to. \ No newline at end of file +Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hiddennetwork) as they require your device to broadcast the network SSID which could be used to fingerprint you and identify the networks you connect to. + +## Securely Erase Your Mac + +To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple ID password to turn off Find My if you've enabled it previously. \ No newline at end of file From 9a598b348d423982f23c4194bfdb5c5e106b9b53 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 04:04:32 -0500 Subject: [PATCH 067/138] add data at rest info --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 1c68e89ee..e1d862938 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -15,6 +15,8 @@ FileVault works with two encryption keys: the volume key and the class key. The All encryption keys are handled by the Secure Enclave and are never exposed to the CPU. +Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it. + ## App Sandbox The [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox/protecting_user_data_with_app_sandbox) is a feature that limits the access an app has to the rest of your system. Developers enable it when they sign their app, so it's not possible for you to enable it or modify the entitlements since they are defined in the signature. From a454503cbcb1c9d5a017b10891e6e31d0f256ede Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 04:08:06 -0500 Subject: [PATCH 068/138] add rosetta 2 info --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index e1d862938..74ee47c9f 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -205,4 +205,8 @@ Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hid ## Securely Erase Your Mac -To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple ID password to turn off Find My if you've enabled it previously. \ No newline at end of file +To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple ID password to turn off Find My if you've enabled it previously. + +## Rosetta 2 + +Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a translation layer that lets you run Intel apps on an ARM Mac. Since it allows you to run more software than you could otherwise run, installing Rosetta 2 increases your attack surface and should be avoided unless you absolutely need it. \ No newline at end of file From 56813f59e9fbb581ca44a4d05f5e68b05ab1768d Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 09:51:26 -0500 Subject: [PATCH 069/138] add keychain --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 74ee47c9f..85d76fc31 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -209,4 +209,8 @@ To completely wipe your Mac securely, use the [Erase All Content and Settings](h ## Rosetta 2 -Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a translation layer that lets you run Intel apps on an ARM Mac. Since it allows you to run more software than you could otherwise run, installing Rosetta 2 increases your attack surface and should be avoided unless you absolutely need it. \ No newline at end of file +Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a translation layer that lets you run Intel apps on an ARM Mac. Since it allows you to run more software than you could otherwise run, installing Rosetta 2 increases your attack surface and should be avoided unless you absolutely need it. + +## Keychain + +[Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1) is the secure keystore in macOS. There's also a built-in [password manager](https://support.apple.com/en-us/105115) that can securely keep track of your passwords and generate new secure passwords. \ No newline at end of file From 0ea3885c03e10f4083e6603e5fd7ff9c6755fb22 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 09:59:50 -0500 Subject: [PATCH 070/138] add private relay --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 85d76fc31..2bca1c1cf 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -213,4 +213,8 @@ Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a ## Keychain -[Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1) is the secure keystore in macOS. There's also a built-in [password manager](https://support.apple.com/en-us/105115) that can securely keep track of your passwords and generate new secure passwords. \ No newline at end of file +[Keychain](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1) is the secure keystore in macOS. There's also a built-in [password manager](https://support.apple.com/en-us/105115) that can securely keep track of your passwords and generate new secure passwords. + +## iCloud Private Relay + +With an iCloud+ subscription you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and all unencrypted traffic leaving your device. \ No newline at end of file From 447da84a1f7b82ea85b11db588cbe0cfef695bba Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 10:00:20 -0500 Subject: [PATCH 071/138] private relay clarification --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 2bca1c1cf..7aa9f5ab5 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -217,4 +217,4 @@ Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a ## iCloud Private Relay -With an iCloud+ subscription you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and all unencrypted traffic leaving your device. \ No newline at end of file +With an iCloud+ subscription you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http traffic leaving your device. \ No newline at end of file From e1455189857156b8d178c1dff4fd77f85f857ce4 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 10:00:41 -0500 Subject: [PATCH 072/138] specify app traffic --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 7aa9f5ab5..16eec9bc9 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -217,4 +217,4 @@ Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a ## iCloud Private Relay -With an iCloud+ subscription you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http traffic leaving your device. \ No newline at end of file +With an iCloud+ subscription you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. \ No newline at end of file From 68d03213e4d683684cd33324c851a34f0305c2d9 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 10:01:20 -0500 Subject: [PATCH 073/138] grammar --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 16eec9bc9..1cc13ac53 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -217,4 +217,4 @@ Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a ## iCloud Private Relay -With an iCloud+ subscription you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. \ No newline at end of file +With an iCloud+ subscription, you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. \ No newline at end of file From 9116c9ed1f67b3abcafbccdfddee2ff6b4db8eee Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 15 Aug 2024 22:31:02 -0500 Subject: [PATCH 074/138] add info about saved state vulnerbilities --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 1cc13ac53..ceaff24b0 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -129,6 +129,8 @@ Use the Control + Command + Q keyboard shortcut to lock your screen any time you When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. +There have also been [vulnerabilities](https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/) discovered with this feature in the past. + ## Automatically Empty Trash You can set the trash to [automatically empty](https://support.apple.com/en-ca/guide/mac-help/mchlp1093/14.0/mac/14.0#mchl0deca7f1) every 30 days to prevent old unwanted files from sticking around. From dcbcf80ac4ad4a7c3a85771fc053b8c06c631d41 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 16 Aug 2024 06:31:46 -0500 Subject: [PATCH 075/138] add security policy --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index ceaff24b0..fc178f9ff 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -93,6 +93,8 @@ On Apple Silicon Macs, it's combined with [Kernel Integrity Protection](https:// Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself. It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. +Macs let you reduce your boot security by setting a [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web). It's best to leave it set to Full Security. + A unique feature of Mac computers is that you can set a different [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web) for different installs, so you could have your main macOS with Full Security set and also an Asahi Linux install set to Permissive Security and it won't affect the security of your macOS. Avoid lowering the security policy below Full Security for any operating system you require to be secure, even temporarily. ## DMA Protection From 1936cea50dcae84aaeb049411965eaee76496ee6 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Mon, 19 Aug 2024 00:10:42 -0500 Subject: [PATCH 076/138] add bluetooth auto update --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index fc178f9ff..15d92bdbf 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -169,6 +169,8 @@ Bluetooth adds extra attack surface for nearby adversaries, so if that fits your Note that Macs support [BLE Privacy](https://support.apple.com/guide/security/bluetooth-security-sec82597d97e/web#sec18ee64d9d) to protect you against bluetooth hardware address tracking. You'll need to check with the OEM of the bluetooth accessory you're using to see if it supports this feature as well. Apple bluetooth accessories support it. +Apple Bluetooth accessories update their firmware automatically without the need for third party software. + ## Hardware Microphone Disconnect Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1) for the microphone when you close the lid. There is no such feature for the camera as it's blocked when the lid is closed anyway. From 9b712dbd016d820367ce891c9f2b9bd007620baf Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Mon, 19 Aug 2024 01:23:17 -0500 Subject: [PATCH 077/138] clarify permissions --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 15d92bdbf..a2b813977 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -73,7 +73,7 @@ Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not ## Systemwide Permissions -macOS has certain permissions that apply to all software across the system. These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. +macOS has permissions that apply to all software across the system. These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. ## XProtect From d1b2049525b56cd28f5feadef2129025658c539f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 22 Aug 2024 03:43:26 -0500 Subject: [PATCH 078/138] add camera info --- content/posts/macos/macOS Security Overview.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a2b813977..f1b1a7d37 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -175,6 +175,14 @@ Apple Bluetooth accessories update their firmware automatically without the need Macs feature a [hardware disconnect](https://support.apple.com/en-gb/guide/security/secbbd20b00b/1/web/1) for the microphone when you close the lid. There is no such feature for the camera as it's blocked when the lid is closed anyway. +## Camera + +The built-in camera in Macs uses an indicator light that shows when the camera is on. According to [Apple](https://support.apple.com/en-us/102177): + +>The camera is engineered so that it can’t activate without the camera indicator light also turning on. This is how you can tell if your camera is on. + +Make sure not to use a camera cover on your Mac or it might damage the screen. Only use something no thicker than a standard piece of printer paper, such as part of a sticky note, to cover the camera. + ## Automatic Updates One of the most important things you can do to secure your Mac is keep it up-to-date. On macOS it's especially important since most preinstalled software like Safari updates along with the OS itself. Enable [automatic updates](https://support.apple.com/en-ca/guide/mac-help/mchlpx1065/mac). From e605a413a6433c8b879002ac5a7fc4e974291495 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 22 Aug 2024 03:53:21 -0500 Subject: [PATCH 079/138] remove prevent windows from opening --- content/posts/macos/macOS Security Overview.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index f1b1a7d37..7db0c3b27 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -127,12 +127,6 @@ Make sure you [require users to login](https://support.apple.com/guide/mac-help/ Use the Control + Command + Q keyboard shortcut to lock your screen any time you leave your computer. -## Prevent Windows from Reopening - -When you restart your Mac, you'll get a dialog box that asks if you want to reopen windows when you restart. It's best to [turn this off](https://support.apple.com/en-ca/102318) to prevent data from previous sessions from being retained. - -There have also been [vulnerabilities](https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/) discovered with this feature in the past. - ## Automatically Empty Trash You can set the trash to [automatically empty](https://support.apple.com/en-ca/guide/mac-help/mchlp1093/14.0/mac/14.0#mchl0deca7f1) every 30 days to prevent old unwanted files from sticking around. From cf1dc84ae562c4b159f9bfbe16e894d869f4b650 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Sat, 24 Aug 2024 07:39:00 -0500 Subject: [PATCH 080/138] add developer tools info --- content/posts/macos/macOS Security Overview.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 7db0c3b27..b30fe9454 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -225,4 +225,10 @@ Apple silicon Macs offer [Rosetta 2](https://support.apple.com/en-us/102527), a ## iCloud Private Relay -With an iCloud+ subscription, you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. \ No newline at end of file +With an iCloud+ subscription, you will have access to [Private Relay](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/). Private Relay uses the QUIC protocol and routes your traffic through two nodes: one run by Apple and one run by a third party so that your real IP address and your destination can't be easily correlated. Private Relay covers Safari traffic, DNS queries, and insecure http app traffic leaving your device. + +## Command Line Tools + +If you need developer tools like Python and git, you can install Xcode and get them with automatic updates without having to install any third-party software. Alternatively, you can use the command `xcode-select --install` to install the tools without Xcode. + +This adds a lot of attack surface to your machine, so it's best to avoid installing developer tools unless you absolutely need them. \ No newline at end of file From 3390c8027b98a0111212be14003dc215496a5724 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Mon, 26 Aug 2024 05:00:13 -0500 Subject: [PATCH 081/138] add full security caveat --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index b30fe9454..dfe8987c3 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -91,7 +91,7 @@ On Apple Silicon Macs, it's combined with [Kernel Integrity Protection](https:// ## Secure Boot -Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself. It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. +Mac computers ensure that only Apple-signed code runs from the lowest levels of the firmware to macOS itself (assuming Full Security is enabled). It accomplishes this with a [chain of trust](https://support.apple.com/guide/security/boot-process-secac71d5623/web) that starts with the Boot ROM burned into the Secure Enclave at the factory as the first step. Macs let you reduce your boot security by setting a [security policy](https://support.apple.com/guide/security/startup-disk-security-policy-control-sec7d92dc49f/web). It's best to leave it set to Full Security. From 96201b19790522dae9baca224b010d6e04353269 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 29 Aug 2024 10:44:22 -0500 Subject: [PATCH 082/138] update .pkg info --- content/posts/macos/macOS Security Overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index dfe8987c3..d14d62a62 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -147,7 +147,9 @@ Be careful installing apps that require Administrator privileges to run, you're **Note**: When mounting a .dmg file, usually a graphic will come up asking you to move the app to your Applications folder, which will trigger an Administrator popup. The app isn't actually running, you're just moving it to the systemwide Applications folder so that all users on the system can run it. If you're not comfortable with this, you can simply drag the app anywhere else and run it. -.dmg files are just a disk image that you're mounting, similar to a virtual flash drive. These won't run any scripts on your machine, they simply allow you to copy the app to wherever you want on your machine and then run it. .pkg files are a bit different in that they will typically run some kind of install script, which most of the time requires Administrator privileges. You should favor .dmg over .pkg format when downloading apps from the internet. +.dmg files are just a disk image that you're mounting, similar to a virtual flash drive. These won't run any scripts on your machine, they simply allow you to copy the app to wherever you want on your machine and then run it. + +.pkg files are a bit different in that they will typically run some kind of install script, which most of the time requires Administrator privileges. You should avoid .pkg files and favor apps that just give you the .app file itself. ## Firewall From 725d97a5d9388c37c1ebfd65b1aaa53640bc9658 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 29 Aug 2024 12:22:04 -0500 Subject: [PATCH 083/138] added mention of not giving terminal full disk access --- content/posts/macos/macOS Security Overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index d14d62a62..aa8c5a195 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -109,10 +109,12 @@ Mac computers have an [IOMMU](https://support.apple.com/guide/security/direct-me macOS is a Unix-like, so certain security practices carry over from other systems. Consider setting a [stricter umask](https://support.apple.com/en-us/101914). -## Terminal Secure Keyboard Entry +## Terminal Security To prevent other apps from detecting what you type in Terminal, enable [Secure Keyboard Entry](https://support.apple.com/guide/terminal/use-secure-keyboard-entry-trml109/mac). +Avoid giving the Terminal full disk access so that unsandboxed apps can't abuse it to gain unauthorized access. + ## Standard User Account When you first set up your Mac, you will create an Administrator account that has powerful access to the OS. [Apple recommends](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac) limiting the number of Administrator accounts on your machine and using a Standard user account when Aministrator privileges aren't needed. From d69d301a89f048d6f97bd42d4d0d3a031845ac17 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 30 Aug 2024 03:33:36 -0500 Subject: [PATCH 084/138] add warning against third party firewalls --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index aa8c5a195..81e2b7077 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -157,6 +157,8 @@ Be careful installing apps that require Administrator privileges to run, you're macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's enabled at the very least, but you can block all incoming connections for the best security/privacy. +Avoid third-party firewalls like LittleSnitch or LuLu that require you to install a system extension. They don't cover DNS so data exfiltration is still possible. + ## Disable AirDrop and Handoff You can disable [AirDrop and Handoff](https://support.apple.com/guide/mac-help/change-airdrop-handoff-settings-mchl6a407f99/mac) to better protect yourself against nearby threats. Turn off "Allow Handoff between this Mac and your iCloud devices," change "Airdrop" to "No one," turn off "AirPlay Receiver," and turn on "Require password." From 219a30a38cf74898af0cfbaae855cf34d8caef17 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Fri, 30 Aug 2024 03:37:39 -0500 Subject: [PATCH 085/138] add command to fix users seeing each others home directories --- content/posts/macos/macOS Security Overview.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 81e2b7077..a6daaba2b 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -123,6 +123,14 @@ You can [hide an administrator account](https://support.apple.com/en-us/102099) Also make sure to set a strong password for any accounts you make and set a time after which a user will [automatically be logged out](https://support.apple.com/guide/mac-help/set-your-mac-to-log-out-when-not-in-use-mchlp2443/14.0/mac/14.0). +By default, users can read folders and files in other users' home directories, other than the Desktop, Downloads, Movies, Music, and Pictures folders. To fix this, run this in the Terminal: + +``` zsh +for user in $(ls /Users | grep -v 'Shared'); do +sudo chmod 700 /Users/"$user" +done +``` + ## Lock Screen Security Make sure you [require users to login](https://support.apple.com/guide/mac-help/set-up-your-mac-to-be-secure-flvlt003/mac#mchlpf5777a4) and set your Mac to [require a password](https://support.apple.com/guide/mac-help/require-a-password-after-waking-your-mac-mchlp2270/14.0/mac/14.0) after waking up. From 7681d3fc1d79d4b36522cccddab6034b7384895f Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 3 Sep 2024 17:22:50 -0500 Subject: [PATCH 086/138] add info about documents downloads and --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a6daaba2b..153133142 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -75,6 +75,8 @@ Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not macOS has permissions that apply to all software across the system. These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. +The Downloads, Desktop, Documents, Movies, Music, and Pictures folders for each user in particular are protected by permissions and thus are more secure than other places you might save your files. Consider using these folders for particularly sensitive data. + ## XProtect XProtect is the built-in antivirus software in macOS. Like all AV, it's a last line of defense after all others have been bypassed. From 529d37ac3d444d01e8d5c970c449f932339621f0 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 3 Sep 2024 17:25:28 -0500 Subject: [PATCH 087/138] add accessibility warning --- content/posts/macos/macOS Security Overview.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 153133142..9ef17e563 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -247,4 +247,8 @@ With an iCloud+ subscription, you will have access to [Private Relay](https://de If you need developer tools like Python and git, you can install Xcode and get them with automatic updates without having to install any third-party software. Alternatively, you can use the command `xcode-select --install` to install the tools without Xcode. -This adds a lot of attack surface to your machine, so it's best to avoid installing developer tools unless you absolutely need them. \ No newline at end of file +This adds a lot of attack surface to your machine, so it's best to avoid installing developer tools unless you absolutely need them. + +## Accessibility + +Never give software [accessibility permissions](https://support.apple.com/en-my/guide/mac-help/mh43185/mac) unless you absolutely need them for genuine accessibility reasons. It's not uncommon for apps to ask for these permissions for eroneous things. \ No newline at end of file From 3b93c30f47c4b6d92c71e9c09f714e362ec2a24b Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 3 Sep 2024 19:12:03 -0500 Subject: [PATCH 088/138] add clarification --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 9ef17e563..c54c74e8b 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -29,7 +29,7 @@ You can check whether running processes are sandboxed in the Activity Monitor. R ![Activity Monitor](/images/activity-monitor.png) -You can check whether an app is sandboxed and what entitlements it has by running the command +You can check whether an app is sandboxed and what entitlements it has *before* running it by running the command ``` zsh % codesign -dvvv --entitlements - From f49049455052a087dc2dac575aa4742255da0d00 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 17 Sep 2024 02:16:27 -0500 Subject: [PATCH 089/138] add mac address randomization --- content/posts/macos/macOS Security Overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index c54c74e8b..3767e79c6 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -227,6 +227,8 @@ Prefer networks that support [WPA3](https://support.apple.com/en-us/102766#secur Avoid connecting to [hidden networks](https://support.apple.com/en-us/102766#hiddennetwork) as they require your device to broadcast the network SSID which could be used to fingerprint you and identify the networks you connect to. +You can [randomize your MAC address](https://support.apple.com/en-gb/guide/mac-help/mh11935/15.0/mac/15.0#mchldb2b7302) in Network settings. Set it to rotating and you'll periodically get a new one. + ## Securely Erase Your Mac To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple ID password to turn off Find My if you've enabled it previously. From 03ddfb63fc4109e75109da0fb4aab0bb37c37138 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 17 Sep 2024 12:49:38 -0500 Subject: [PATCH 090/138] add tcc --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index 3767e79c6..ef4a110b2 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -73,7 +73,7 @@ Gatekeeper, the App Sandbox, and the Hardened Runtime only apply to apps and not ## Systemwide Permissions -macOS has permissions that apply to all software across the system. These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. +macOS has permissions that apply to all software across the system, called Transparency, Consent and Control (TCC). These can be found under [Privacy & Security](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac) in the Settings. The Downloads, Desktop, Documents, Movies, Music, and Pictures folders for each user in particular are protected by permissions and thus are more secure than other places you might save your files. Consider using these folders for particularly sensitive data. From 7dcc3a4db519ce0562faa6c784abce4a699bcf4d Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Thu, 19 Sep 2024 16:34:12 -0500 Subject: [PATCH 091/138] update gatekeeper --- content/posts/macos/macOS Security Overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index ef4a110b2..b0de61c76 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -63,7 +63,7 @@ You will see `flags=0x10000(runtime)` if it's enabled. [Gatekeeper](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) stops you from running apps that aren't notarized. Notarization is a process by which app developers submit their app to Apple to scan for malware and ensure it meets certain requirements. Among these are that it is signed with a key provided by Apple to the developer and that the Hardened Runtime is enabled. Gatekeeper also prevents the loading of unwanted plugins with benign apps by opening apps from randomized, read-only locations. -While the Gatekeeper warning can be easily bypassed by control + clicking on the app and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. +While the Gatekeeper warning can be easily bypassed by going to **Privacy & Security** in the settings and clicking open, it's useful since it presents an unavoidable warning when you try to run an app for the first time that's not downloaded from the App Store. You can change [Gatekeeper settings](https://support.apple.com/en-us/102445) to only allow apps downloaded from the App Store if you choose. It will still be bypassable but it will stop apps from being run that aren't from the app store without you explicitly allowing it. From c6b0095ef54223951d3f24019711dac66981a2d8 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 24 Sep 2024 12:29:03 -0500 Subject: [PATCH 092/138] change apple id to apple account --- content/posts/macos/macOS Security Overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index b0de61c76..a482eb6be 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -215,7 +215,7 @@ You can also [add a checksum](https://support.apple.com/guide/disk-utility/add-a If you use iCloud, you should enable [Advanced Data Protection](https://support.apple.com/en-us/108756) so that your files are E2EE. -You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple ID for extra protection. +You can also add a [security key](https://support.apple.com/en-us/102637) to your Apple Account for extra protection. ## Touch ID @@ -231,7 +231,7 @@ You can [randomize your MAC address](https://support.apple.com/en-gb/guide/mac-h ## Securely Erase Your Mac -To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple ID password to turn off Find My if you've enabled it previously. +To completely wipe your Mac securely, use the [Erase All Content and Settings](https://support.apple.com/en-us/102664) option. This will ensure all data is securely wiped and no traces of your ownership are left on the Mac. This is important so that the next owner is able to set it up without running into issues with verification. You'll need to know an Administrator password and Apple Account password to turn off Find My if you've enabled it previously. ## Rosetta 2 From b0bec7815666e45d1549c5977d324bb6e597ab00 Mon Sep 17 00:00:00 2001 From: kimg45 <138676274+kimg45@users.noreply.github.com> Date: Tue, 24 Sep 2024 12:37:17 -0500 Subject: [PATCH 093/138] add credit to image --- content/posts/macos/macOS Security Overview.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/posts/macos/macOS Security Overview.md b/content/posts/macos/macOS Security Overview.md index a482eb6be..496722a78 100644 --- a/content/posts/macos/macOS Security Overview.md +++ b/content/posts/macos/macOS Security Overview.md @@ -27,7 +27,10 @@ There are a few ways to check whether an app is sandboxed: You can check whether running processes are sandboxed in the Activity Monitor. Right click on the columns and check "Sandbox" -![Activity Monitor](/images/activity-monitor.png) +