From 8c39d0cf1886fc1e8a169160e162fb40fe200d86 Mon Sep 17 00:00:00 2001
From: Muhammad Ali Hussnain
<91005947+muhammadalihussnain@users.noreply.github.com>
Date: Wed, 21 Aug 2024 21:45:13 +0500
Subject: [PATCH] DHCP DOS Mitigation HLD in SONiC (#1651)
* DHCP Mitigation HLD
* Images Added
* MD Format Update
* Updated Mitigation Strategy
* Update DHCP Mitigation.md
* Update DHCP Mitigation.md
* Update DHCP Mitigation.md
USE case
* Reviewed
* Updated Design as per COPP behavior
* Changed Design image added
* architecture added
* Yang model range update
* HLD Updated as per suggestions
* added missing architecture image and sequence diagram
---
doc/DHCP Mitigation | 0
doc/Dhcp_Mitigation/DHCP Mitigation.md | 296 ++++++++++++++++++
.../DHCP_13May2.drawio.png | Bin 0 -> 101472 bytes
images/dhcp_mitigation_hld/DORA.png | Bin 0 -> 18097 bytes
images/dhcp_mitigation_hld/Delete.drawio.png | Bin 0 -> 35007 bytes
images/dhcp_mitigation_hld/Discover.png | Bin 0 -> 377675 bytes
.../TOPOLOGY_DIA.drawio.png | Bin 0 -> 42925 bytes
.../deleting_sequence.drawio.png | Bin 0 -> 53856 bytes
images/dhcp_mitigation_hld/design_image.png | Bin 0 -> 84558 bytes
.../sequence_diagram_add5.drawio (1).png | Bin 0 -> 44359 bytes
10 files changed, 296 insertions(+)
create mode 100644 doc/DHCP Mitigation
create mode 100644 doc/Dhcp_Mitigation/DHCP Mitigation.md
create mode 100644 images/dhcp_mitigation_hld/DHCP_13May2.drawio.png
create mode 100644 images/dhcp_mitigation_hld/DORA.png
create mode 100644 images/dhcp_mitigation_hld/Delete.drawio.png
create mode 100644 images/dhcp_mitigation_hld/Discover.png
create mode 100644 images/dhcp_mitigation_hld/TOPOLOGY_DIA.drawio.png
create mode 100644 images/dhcp_mitigation_hld/deleting_sequence.drawio.png
create mode 100644 images/dhcp_mitigation_hld/design_image.png
create mode 100644 images/dhcp_mitigation_hld/sequence_diagram_add5.drawio (1).png
diff --git a/doc/DHCP Mitigation b/doc/DHCP Mitigation
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/doc/Dhcp_Mitigation/DHCP Mitigation.md b/doc/Dhcp_Mitigation/DHCP Mitigation.md
new file mode 100644
index 0000000000..37b1218869
--- /dev/null
+++ b/doc/Dhcp_Mitigation/DHCP Mitigation.md
@@ -0,0 +1,296 @@
+# DHCP DoS Mitigation in SONiC #
+
+[© xFlow Research Inc](https://xflowresearch.com/)
+
+## Revision History
+
+|Revision No. | Change Description | Author | Date |
+|--------------|--------------------|-------------------------------|----------------|
+| 0.1 | Initial Version | Muhammad Ali Hussnain, Asad Raza | 11 April 2024 |
+
+
+## Table of Content
+
+
+- [Scope](#scope)
+- [Definitions/Abbreviations](#definitionsabbreviations)
+- [Introduction](#introduction)
+ - [DHCP DoS Attack](##dhcp-dos-attack)
+ - [DHCP Starvation Attack](##dhcp-starvation-attack)
+
+- [Effects of DHCP DoS Attacks](#effects-of-dhcp-dos-attacks)
+- [Behavior of DHCP DoS Attack](#behavior-of-dhcp-dos-attack)
+- [DHCP DoS Mitigation](#dhcp-dos-mitigation)
+- [Current Behavior](#current-behavior)
+- [Proposed Behavior](#proposed-behavior)
+- [Design Changes](#design-changes)
+- [Requirements](#requirements)
+- [Architecture Design](#architecture-design)
+- [Sequence Diagram to Add Rate-limit](#sequence-diagram-to-add-rate-limit)
+- [Sequence Diagram to Delete Rate-limit](#sequence-diagram-to-del-rate-limit)
+- [SAI API](#sai-api)
+- [CLI/YANG model Enhancements](#cli/yang-model-enhancements)
+ - [CLI Configuration Commands](#cli-configuration-commands)
+ - [YANG Model](#yang-model)
+- [Testing Requirements](#testing-requirementsdesign)
+ - [Unit Test Cases](#unit-test-cases)
+- [Warm Boot and Fastboot Design Impact](#warmboot-and-fastboot-design-impact)
+- [Future Work](#future-work)
+
+
+
+### Scope
+
+This high-level design document describes the implementation for mitigation of DHCP DoS attacks in SONiC
+
+### Definitions/Abbreviations
+
+| Sr No | Term | Definition |
+|-------|---------------|------------------------------------------------------------------------------------------------|
+| 1 | DHCP | Dynamic Host Configuration Protocol |
+| 2 | DoS | Denial of Service |
+| 3 | DORA | DISCOVER, OFFER, REQUEST, ACKNOWLEDGEMENT |
+| 4 | TC | Traffic Control |
+
+### Introduction
+DHCP DoS attack mitigation aims to safeguard the network infrastructure by implementing a rate-limiting mechanism to mitigate the impact of DHCP Denial of Service (DoS) attacks.
+
+There are two main types of DHCP attacks:
+- DHCP DoS (Denial of Service) - Focus of this HLD
+- DHCP Starvation
+
+#### DHCP DoS (Denial of Service) Attack
+
+In a DHCP DoS (Denial of Service) attack, an attacker floods the DHCP server with an overwhelming number of DHCP DISCOVER packets. This flood of DISCOVER packets consumes all available resources on the DHCP server, making it unable to respond to legitimate DHCP requests from other devices. This proposal focuses on DHCP DoS mitigation.
+
+#### DHCP Starvation Attack
+
+In a DHCP starvation attack, the attacker floods the DHCP server with a large number of DHCP request messages and accepts the DHCP server’s offers, exhausting the pool of available IP addresses that the DHCP server can assign. As a result, legitimate devices are unable to obtain IP addresses from the DHCP server, causing network connectivity issues for those devices. DHCP Starvation mitigation is out of scope of this HLD.
+
+### Effects of DHCP DoS Attacks
+
+
+A switch forwards DHCP messages between clients and servers. A flood of DHCP DISCOVER packets affects the DHCP server. With a large number of DHCP DISCOVER packets the server becomes overwhelmed, leading to the following issues:
+
+- #### Resource Exhaustion
+ The DHCP server has finite resources such as CPU, memory, and network bandwidth. A flood of DHCP discover packets consumes these resources, causing the server to become overloaded and unable to process legitimate DHCP requests on the attacker VLAN effectively.
+
+- #### Service Degradation
+The flood of DHCP discover packets causes service degradation for other clients served by the DHCP server. Legitimate DHCP requests experience delays or timeouts as the server struggles to handle the excessive volume of traffic on the attacker VLAN.
+
+- #### Packet Loss
+ The DHCP server experiences packet loss due to the overwhelming volume of DHCP DISCOVER packets. This can result in dropped DHCP requests from legitimate clients on the attacker VLAN, leading to connectivity issues and network downtime.
+
+- #### Impact on Network Performance
+The flood of DHCP DISCOVER packets impacts the performance of the network infrastructure, including switches, routers, and other devices involved in forwarding DHCP traffic. Congestion caused by the flood can degrade overall network performance and affect the operation of other network services.
+
+
+### Behavior of DHCP DoS Attack
+
+
+
+ 
+ Figure 1: DHCP DoS attack topology diagram
+
+
+
+
+The above figure shows 2 different VLANs configured with 3 hosts and a DHCP server. Attacker and PC-1 are in Vlan-20 and DHCP-SERVER and PC-2 reside in Vlan-10.
+
+As shown in the diagram, the attacker launches an attack on the DHCP server with a flood of DHCP DISCOVER packets. The attacker generates a large number of DHCP DISCOVER packets with spoofed MAC addresses and sends these packets to the switch. The switch forwards these packets to the DHCP server. The attack is shown in the following diagram .
+
+
+
+ 
+ Figure 2: Image captured from wireshark during instance of attack
+
+
+
+
+Due to the huge number of DHCP DISCOVER packets, the server is busy processing the DHCP DISCOVER packets and is unable to respond to other clients on the same VLAN as the attacker. This demonstrates a successful DoS attack which overwhelms the DHCP server.
+
+It can be seen in the screenshot below that a legitimate client (PC-1) is unable to be serviced by the DHCP server. After the continuous bombardment of DHCP DISCOVER packets, the DORA process fails to complete, indicating a potential Denial of Service (DoS) situation.
+
+
+
+ 
+ Figure 3: Incomplete DORA process during DoS attack
+
+
+
+### Current Behavior
+Currently in SONiC, a default system-wide DHCP rate limit of 300 packets per second is implemented through CoPP. Since this limit is system-wide, in the event of a DHCP DoS attack where the attacker sends packets at a rate greater than 300 packets per second, it will result in CoPP dropping most legal packets as there are a lot more illegal packets coming into the system.
+
+### Proposed Behavior
+To ensure the availability of a DHCP server for legal clients across a network, rate-limiting must be implemented at a port level so the effects of an attacker stay limited to the port it is connected to.
+This can be achieved by removing the system-wide DHCP rate limit of 300 packets per second implemented through CoPP and replacing it with port-level rate limits implemented in the kernel via Linux Traffic Control (TC). This means CoPP won't restrict DHCP traffic anymore, allowing potentially harmful packets to reach the kernel where TC will be able to rate-limit ingress traffic according to rates defined for each port. This will effectively isolate the effects of a DHCP DoS attack to remain solely on the attacked port, successfully protecting clients connected to all other ports of the switch.
+
+### Design Changes
+
+To achieve this, a new entry “dhcp_rate_limit” will be added in the “PORT_TABLE” of config_db with a default value of 300 packets per second to ensure backward compatibility. CLI commands will be written to use this attribute in config_db. “Portmgrd” in the SwSS container will be modified to configure config_db rate-limits inside the kernel via TC commands.
+
+Following are a few use cases of Traffic Control :
+- Filter packets on the basis of their properties (eg. IP protocols, source/destination ports and IP addresses, etc.) and drop them based on their behavior (ingress, egress, rate, etc.)
+- Change or modify the data if needed
+
+Traffic control(TC) uses queuing disciplines (qdiscs) to help organize and manage the transmission of traffic through a network interface. A qdisc performs two main functions:
+- Enqueuing requests to place packets in a queue for later transmission
+- Dequeuing requests to select a packet from the queue for immediate transmission
+
+When the user adds the "dhcp_rate_limit" entry in the “PORT_TABLE” of the config database, that limit is then enforced on the specified interface it corresponds to.
+DHCP traffic can be filtered and rate-limited by dropping all packets that exceed a user-defined rate, allowing legitimate clients to be serviced by a DHCP server despite an ongoing attack. This design provides a mechanism for DHCP rate-limiting on a specified port. Applying DHCP rate limit on a specific port requires two parameters:
+
+- port
+ The port on which the DHCP rate limit is to be applied.
+- rate
+ (packets per second)An integer specifying a DHCP packet rate in packets per second.
+
+Since traffic control(TC) only supports rates in the form of bytes per second, this value is multiplied by 406 (number of bytes that make up a DHCP discover packet).
+Upon running this command, an ingress queuing discipline is created on the specified port via traffic control(TC). Next, a traffic control(TC) filter is added to filter DHCP discover packets on protocol 17 (UDP) and destination port 67 (port used by DHCP) and a dropping action is applied to filtered incoming traffic. Incoming DHCP discover packets that exceed the rate are dropped to stop the attack from overwhelming the DHCP server.
+
+A custom program (daemon) has been developed to monitor network traffic. This daemon continuously checks all network ports (tc qdisc) for signs of packet drops. If it detects increase in dropped packets on a specific port, it logs a message to a designated file. This log message serves as an alert for the user, notifying them about potential congestion and packet loss issues on the affected port.
+
+### Requirements
+
+- Support for Linux traffic control (tc) for implementing the rate-limiting mechanism
+- Support for CLI commands for configuring DHCP rate-limiting
+
+### Architecture Design
+The overall SONiC architecture will remain the same. Changes are made only in the SONiC Utilities container, SwSS container, and Config_DB.
+
+
+ 
+ Figure 4: Feature Design
+
+
+### Sequence Diagram to add rate-limit
+
+
+ .png)
+ Figure 5: Sequence diagram illustrating the process of deleting rate-limit for DHCP DoS mitigation
+
+
+
+### Sequence Diagram to Del rate-limit
+
+
+ 
+ Figure 6: Sequence diagram illustrating the process of deleting rate-limit for DHCP DoS mitigation
+
+
+### Configuration & Management
+
+#### CONFIG_DB Enhancements
+
+New attribute “dhcp_rate_limit” will be added to “PORT_TABLE” to support DHCP mitigation rate.
+
+ "PORT":
+ {
+ "Ethernet0": {
+ "admin_status": "up",
+ "alias": "fortyGigE0/0",
+ "index": "0",
+ "lanes": "25,26,27,28",
+ "mtu": "9100",
+ "speed": "40000",
+ "dhcp_rate_limit" : "300"
+ }
+ }
+
+
+
+#### DB Migrator Enhancements
+
+As there is a change in the schema for PORT in config DB. We have added a new "dhcp_rate_limit" field in db_migrator.py in order to support backward compatibility.
+
+Existing Before Migration PORT TABLE Schema in Config_DB
+
+ "PORT":
+ {
+ "Ethernet0": {
+ "admin_status": "up",
+ "alias": "fortyGigE0/0",
+ "index": "0",
+ "lanes": "25,26,27,28",
+ "mtu": "9100",
+ "speed": "40000"
+ }
+ }
+
+After Migration PORT TABLE Schema in Config_DB
+
+
+
+ "PORT":
+ {
+ "Ethernet0": {
+ "admin_status": "up",
+ "alias": "fortyGigE0/0",
+ "index": "0",
+ "lanes": "25,26,27,28",
+ "mtu": "9100",
+ "speed": "40000",
+ "dhcp_rate_limit" : "300"
+ }
+ }
+
+### SAI API
+
+No SAI API change or addition is needed for this HLD.
+
+
+### CLI/YANG model Enhancements
+
+##### CLI Configuration Commands
+
+Proposed SONiC CLI commands (sonic-utilities)
+- config interface dhcp-mitigation-rate add [port] [packet-rate]
+- config interface dhcp-mitigation-rate delete [port] [packet-rate]
+- show interface dhcp-mitigation-rate
+
+Background Linux TC commands
+- sudo tc qdisc add dev [interface] handle ffff: ingress
+- sudo tc filter add dev [interface] protocol ip parent ffff: prio 1 u32 match ip protocol 17 0xff match ip dport 67 0xffff police rate [byte-rate] burst [byte-rate] conform-exceed drop
+- sudo tc -s qdisc show dev [port] handle ffff:
+
+
+##### YANG Model
+
+New leaf “dhcp_rate_limit” will be added to support DHCP mitigation rate.
+
+ leaf dhcp_rate_limit {
+ description: "dhcp rate limit ;
+ type uint32 {
+ range 0..8000;
+ }
+ }
+
+
+### Testing Requirements/Design
+
+#### Unit Test cases
+
+- Verify CLI to add DHCP rate on port
+- Verify CLI to delete DHCP rate on port
+- Verify CLI to display DHCP rates on all port
+- Verify CLI to check valid DHCP rate (rate must be greater than 0 packets per second)
+- Verify CLI to check validity of port/portchannel on add and delete commands
+- Verify CLI to restrict one DHCP rate per port
+*(previous rate must be removed before adding a new rate on an port)
+- Verify CLI to ensure rate limit exists on port before deleting
+
+
+#### Functional Test cases
+
+- Verify DHCP rate has been said on interface
+- Simulate Excessive DHCP Traffic on interface
+- Verify DHCP packets has been dropped as per rate limit
+
+
+
+### Warmboot and Fastboot Design Impact
+ The existing warm boot/fast boot feature is not affected.
+
+
+### Future Work
+The scope of this HLD is limited to mitigating DHCP DoS attacks by rate-limiting the DHCP control packets. In the future, support for “DHCP Snooping” will also be provided to mitigate DHCP starvation attacks.
diff --git a/images/dhcp_mitigation_hld/DHCP_13May2.drawio.png b/images/dhcp_mitigation_hld/DHCP_13May2.drawio.png
new file mode 100644
index 0000000000000000000000000000000000000000..b69b545e61e98e1852dd37541ce6075b5f9f5bba
GIT binary patch
literal 101472
zcmeEO2|ShC+Apan8MY+JY@5os%|oVb9(PDeWS)miQHBT+GLu;fp(rv%6ryA*WtK5x
zGSAbuUhEDH_jd0+_k8D^?>omY_S*Y>*Lv6buV+2a|M@@LS6NZ&(1BwIcJ11ANJbiY
zde<&Y_^w?Tt62L$%kkWf5%6ob?P)2oU72;qhj;DL*lj0q*3QDw(8Sze7aSqJ`4^mn
z&DhG;4vs*=IXHBzty%OK+L#c^))^EyTbmRmPeu)1PmZmt98kmO=v1Gi#03tb}y{*pJbw08u*
z9eKI6xj7lZU!vC5<_78px^gC~xGa$A9jMu9}IsIJ>clt*NA`35S)8
zjP2&Q9Sm%2O{^@p9+Q&=!NR`zhMkkO!Dg$Gm6ee>=n%T4t)33}b7S7NKBsGCqi
zF}Z?%7Idqw==Qc*{Ek_X=$LhwccA#qGMxYb$RE<46V$!9&hV2
z*5Ju^+#PCA`EE|3R&^77JL9d-va@ZC4|+q|z{JRSt7~4atv4)m&>!Avur=1vx4OJ}
z{YKOFW!aoa^mN)-S%KSaTeabU;A}7Y`$)qtzrLLw?m#b
zvQ@TLu{2bW5kG6=#Kvu8D9Q}b3IWzZ$J~Bv$~PNq?VQjE26ME5aXlw<6H5SM1lXmQ
zjZN$fRIGLMpo=a8n1ME9I}3C03fjcFR`%eN`trJ88+7!{jBKD*C3`z?8|X6VgSMO4
zV&{VXwzIJ^`?{b|FPlTL*7@!Ex26PaM>_*Fo}o|u<8}FMb)*b{QLwXd0*}0PIVT!4
zTbqFc{rd7YWN~lJyYV(qad2)m>TIFe=>CTQo^R~{Rnfa|x4zP$&pWBe5V{T#unOQvmdB|RhK}&4{w!Y}r
z8x|(|`Vcb3Yz)9Cb#ymS3QVY&wUvpb-NsUIiNU#$phd^t&I%1M@NyGh;#THXkR7(P
zffv2TF~ZG!oDHoM)9IyAtxqYmBn=K&q(?+-c-wx5AcUIyS##{x1p
zmb$jkFEpTk34WW{*EexMqZoblHi-Uf`{U>ExA2OHX^^85(hTRz8jbo2h{OzPGkcbt!#3u@19I^wDqZG@V~zwAnG*%Kr7h!HYg&(da<0`gYrg_SpX1=m0?o
zH2*u$@z+}r9`3E}xwRk&HkK{eZ(9)#_N|BAu_AovPyTt%Ble#kNWbdz{Q8y^x3V-e
zG5RMPcBfnP4L-J9pnqb;*mCu^0pPD;6rk1r!vJtv#|}`#
zUtRdG#$sFB?{FymuXqXEoI4T0!Mo)sZbQUh#3cNPKl{dAGqBVbg&1szqB7U9wKdTL
zG59wAYG-f`NGuztv*5G9qlW0tjn^9BH9HGn*3b<|h>C<_`Hi=ckZIj`W_TRUm3!015t)(
zL=e+KYXa`ei>5B1xdpE|c)#h%*2>;S&tU5+2rM9K|0O#5A9T5sJzhKXD=?2*AuY~$Pp5?7iZ;;sk?32I7b)y}T9kKU+>-@IU
zW7hkg&-*)Bab7g8w{XtRvtnk{`rprjaQp%*^Y5E+w3*(p#ON2lnPJG_
z@36yL)}IgLsJ>coVExes{kJRsbpyU>6@HK&`^HxP;|=$l9s0VLIoP(X`afFqKgtI4
zqG_frbRxL_04vP%O{ZM!TQnIO>i=(tp#<{Qr0lT6-#ATw?+h|8+fE0V3(b^n+eGYt
zkqk1&AIX%6Dl5zHOd$WeC+ao_{JR+F@0md6Mf*Qn7Lf~xr#Aez?Vv+Dj@#YmKOZ}X
z_#>GZJu7R-^R)r-IJ3El1*9iq)3LL&G10Y$B6K!Gpc(_ewy7J~?5se;?}ycYmFc&!
zvIB9>hV~4K<9>SR|Bjj%ULf4t02BJS{Q>jO@gs1deFgLh`M>WBB7XOn{`)}sr%UoT
z^TXKDWG@;P=tM4hxqtsy_*-=r;@d9&Z6EA^JAOs;sQ<`s`q!eA?}7Q1e%ir3v9WOT
zY=j>hvC2=lC+NLj=7#<$6|`ke{$~5(J8+^;vj5(GU`KQ7=q>ndmw(;;@S_~enjvvTN-2u
zRcVRSiV~_Ia6mVKRrpVy8gSV=B$u1>^QWGROpICrUgxqZ_l)Fprdd!9rPz)!+#-JyNzVos*%*!u{GYP
zH-l)zZK*b>T^S@#3~Zo^O^|pW0dY^xZ
zHUEYU=V04TqdOT(AdNJvbq$@Ad1aa9&z;s$m0{j28ve`6dA9PsXnV@DMXsR%`upz+
z^cL9aksU42K==69-4a_$(f?`^2?*2BA~sHF1Ay1)4S^Q5{k9+enTqXKtv`qeHiWgC
zs@uQuZeVBI5^j72=Qk>|-+w!N+a(8DTPOHegGi2_v0ri!
z1r5G@=wFEFzd5Xat@Ly2k-q)L6Huf2?f0Vm8wUeg<&M_RZ-J1R8?AlZ;pA?mako3U
z(DyJwkA;TLAL`@&5CdQ|(13n`fuB+r-w>XNpMCuVda=I}o_2cZCJ;S+ZQa(klQ8&Z
z{eSa|Ay4C<=z_lYRsIlQAlT7J*n$QZCkv=X`BrMix8>PxhX&`?O8j}Cv4!6sK;u`f
z!LLIDsbgRPL|ea^habUXvs*O5_Sb_4C#Y)LAr#xP2HUL$_g33>XrLXkKMyqiwZQln
zVvB8&1mC9k9|{g2#|a88c>kS9;%6q{yFlXiI2pDrAzIb9eFf2Ne^3PgTIRB4gn)i&
z$EoxC`$*jEJS^Ynx_Q9&6e9S3`|q2R@2?O<{P4j11H$Uf)%yG6loP!zzT%XHYioMZ
zrtbHLDuQzhi9hf3FN@6|#kZRd_wRpV%Ugjja$%DMUxE5JKegF;wx)FpFhBghANIe-
zxsCoFy+6dKQ?mu-)PHl2?puHV$KXKAu(!Jee}q%Fq1yh*H?g7>-M@Y5?e>6p<6ZRE
z>~6lXbpiCH$D0+~MV6AByLM6Tl0k~9I%<86!|qUPTw9NI`vLb%cePM4R
zS$USnOG};RJ1;YbC~&t{9DoUoJyAJ;dYUT!CW2XEb!j#O*>WF6W4k<-Z*-U|n#anL
zyVI`m{Tje<>f+QJ)`!n0-msS5`#3Lj*b#9dtovDAoIs3BDBZ(%5t`_e0appI_1&TY|lo9ClrxlOuC
z>a8d)vxrvv<_jmR<%r>Qim}E|?S?}T?V9u2+4{bsyF_B2H)&n9xNe;NVjpQsa}*N$
zBYh2~5?+@L5q#=UX%Iv3^dqzKAZ+O{ERq66`W^jI2gQjP_zi`hP(LO{tL3_Aa5X4^
z=VMDvEMMd2lI1TM$2rwece0!MbJiCo`xFAng-+i{a$!FATYG|xRg^YENur9VlEMvfuL
za%|xJpy6GMpOuDQx$h^x&5xtIr-%CXIHM@+jp+4#QA(#4D_rLQKF{DIXl27*&ZyB(
zQBtC)@y@n=v)3t)V+3m4sVYZ}IkGO%L4-OlkXcRkp*S-C_VBo13=Qc`Ud2Gk3Z7Aq4RSJCs%uG7lL!
z<6gq6qKJLr910Fbkxp~h!FRhE6Y;>l$C`w=bClOQv2Y|k!{!Lw=EdS<6~*~+FZm=S
z%QBC7O9S1bjw_=NPY}WD_y&)UPQJ~vIA2sNNot{gYGp!PrO06{RtTP*n+#BE_%=xb
z2G4eXHwdSvL?!i$C+_>^q3;pCqLn>v{~qO#bA!UQWlipOMHr)s{PNrw0z-b@?vOTk1|2={
zR*56nZtdNtD1%sJHQiQcQ?yH62S8Vk?%+)i*5{MGEV}ry*eL^Rw{wKtf`ryBUp*FuJZ>KKoux#L*%wWX?u@?nXd#*HZowG?hEI`~{IZVMAV-o=D1U?Ul^JexVa
zyq?%YEIQ8`sFAFN3dTuw
z|M9B2v6Na;#k*v=TF6$*hP39Isb629LQ%6I)W&dRMUs%p9&Oq?kH5rj$k@eBR1hk0
z&Ud-FjdXnOJ4mGC15@p2F-eW9p-*tuZGSvnClJ%D?bi9Aa3DI(K@BeZ=q-`Drj9L&
zSLeDlt}kqF!fF1CNMJ;KhMwQo*fH=ReaK>CVR&8&irG!$yhmwo8Q&vwJ}Ra@xi2?M
zSI4aQ2Ja=(GLYleWtJ?NA}&6^7AxU9Ub_DA%;>^MMivuiT6!$3Ro3I_9-)cndko7D
z@o2*7CGu9ynjV+{BN5uqc)#QZ5DD%F72yIe7ZlJb87O*P|M@HPE)VxEl43dIm-MPoI`ERt%C3t!~R#n-1J^nYQC_-
z5aiJP^Z8$xz`k1@eV?Wm!Kxi^fpB5LaEC0Xzw-WX{1FCDcTEZGIswZL-bQeWsuD5~
z$fh;m39mE^n7wLFr;&A@c`LARm+yJJZlR^*TUpy_^_)^q!w8QNCNKo~1Q#TkjU5(|Hf>Yi;$w5lD3!x^trj
z_&Ofsipzc?doj+NKlb8V8oFCMoSI;n*JgU+?UvaAw?Au<`+>Thn@b+E+V^>a+nR=A
zr?0uTEQ_ps!l_QpOD~BAK1FKZI(g5=_$=@ZYP(-tR{*wCw>8dnbt#I}vVbbWLj7)^
zRCkCR3%mFY+yL$J54sy*bw`5r3--}DLr)_DK+Jnx`829G+ANcO&pw>9$*JHpWmAaZ
z=8Cb%i_*{w;3}g+(HSiQqfV*J#qfC8s|+WE*9osX+rDAWzZad?bk2+<
zUNPQz>h(SzQw?hjPu`BJJTB=tjNlnBVlB4W(Pq{G6MOS51M({B+7Si5yYIZI
zgLrmd&~~CZSS&u2gvm#XdupLuwOk2uWWlkr|BDZ9P~7vh)Ogb`g@f_$y}^m%XMW2!
z^FmQ{75UYgyzm3qSWFgePhNkNv7o}(OUY(CAU~Si$5doD{O+ZEEbrr8QcYB{GTq>0
z;0_d=^3ieba_l>l<2b1cc?03uGW?gpCdmJICFN3Ir6K4szf`I7sXZdstohcZ!1pt}
z1Pw`yig%OqDg&-%W=%+)v_pAtgtMfZ4X?dEzuZkX8}lvOLFCegh9LDg?NlZUhBGNq#lJ
zy)<4|>U{%twwkf7WH;m}5o=nz3sUQHTVAqcAwLY91GdyShjXz-ck-lSLH7g{lw7P$
zn078+!p?VY!pQjT*i=##bD!PAVJL*__Yfv7?fWG9cy6pc1{`G^E0U@l;epG()*
z=2XhKBUmn&a<>`Zef31?kjxQx5L7gA8aGf9RkB~5GtcRAU4|bN^S^p^@+EN=wdv{H
z{XEM}56{Pp<+Uq*xT-5yl5ENU;p&l-XD>qLyWHb`Zy#yWz$2Y<*-rVmQh99Sx2h?7
zGAt!Lpw+oS#fj4WR2`lI{M$5gS6~vSLa^M5$4Dk4T5R4hs~D{VXF$F-noI6|^v%?<
z=B$K=M?8YxhxA8q5HP@ZhiHYY!0w7QG~5xFYdsz(AcZmPfoYI(1BXPH-{JG^K7uDv
zSp8BLtHT&m+}79fX!8-+gp2I&n+gd5MlPReJB>L7PaHj=t@|P$Pa$lAQ1i4_{ikrO
zk9*1P@MFHB7k#a8QWl%l=|HUty?h~UIwHF*wE=Ub115N(Dn{yv1%{{jLim*{vm*wQ
zf#hUkk{R{};)$2XKN{BDW=~tAG-V3AYwpd%LH0I@kwg5BcNi7eH$8Z!#z~mim360<
z&D+J*Iahp~;dBrmC+v1kMa(PHF%TIf=@
zFMYf+uCF7`1&zFrRZ%tgZyMv+u2SZnio06Vne&YT@FA@M?$Ka_`tzS;8@k6r=Gm
zo|cqR82iF{5P=mWa9O18(f2;L@f!kF1ow@ABaxkuPX18<8N040A8^07Zq?yDT|3}$
zkmb?p=*MS8B*L!Ft#fK*2P3b!MwWegm;?8N09|!H3As>1b4k({7JPIc7d0K`OyA)^
z_comyWHl>`(-wN#F0*Ql4>WQdIW-@iJdXj6Bt&ftPyTAV>+)DF2(GpBT-2({;E7$y
z)=s15uc-k%S0*DE2u@8)$D)#uwBDitKG?fgd0*-!Hfg)9s(uK7{E9<79c<)>)K9#L
zcn&;PD^uVIE=v*J0-pS1^X2qgUUDL(ay?T`tsxR3&FTw%%qVK-fneUdNMC83>&FNP
zF_tdftP(Ma?PXV#F-smWcqb_syJo88Rjy$qL$@*8ML(SFWN;ZT{9$->qzvh#^-_it
z5w1}jJZb|0UtsVuBXVDaY?x04+kFCdszi!ZN1U)qM)JO}CudBx=qxJAhqDIMcw_A&
z^kLAURUj9JmEc5M$AF@Sl_yG8cwTb_BT_z=>gccX?p&Hv)Dr@{)Y5469$<7sWHugz
z<-heHxlDsb2`)`g1O|?3fpj~SYbMeX85bN{Up}$w`gq*>`R={Ey3V+F!16o}`Qh?#
zDo!3vy_b7>n!|*KT+xjyYprUrmZysocqxygPPts+ogj3Ka2RWg(kb_jN>PZROPYsJ
zY4}4_$^sN!l0A2Vi#3$Hw`WFudW5wOoUDjAetVA6wIws&ZbIh>D2|km7i>N5Jn_On
zNffNK_{m?JAd(#8x70byUy5SJOO{#ou0qU<-vGb;h$jNyz&V2G#F?{i2X6^{k)F*4
zmU;l3No>G1lpvY!I0~7xtY1Tif&BQ#XSKK4^-fMy29U-`kvmm9F>mFF-7Vdq0dXmf
z56|;J2Yvgf*0U>7Z|_P)a&1`5U%GwFj8m@N@aaZy(i}FA9}1lpIddGNe{`apJL05<
z?lDed<=9Y(?)x&OC9>?8Fu1I!5XN8_1A)7!GNG=xh%i_zrT`VeN=B21?~CQzd~P&$
z-K)<4E=E+m(A9G-kXu$SI4!?1&)0GJUjY+e4s)D%u^%FNsv{)dWo4bld4TjitsMBA
z4_K6o_|^BZtB%|HN3rRMrAswmxExnF^G;4B%U4Qpx(1<=g~!*AKMnZCm);vNSN#U&
zG70M9-Z<>)nwPx1I#B<1>USC^%^OLS&@M>c=y$+&I
zWQF5Ib-{3Sq=8@o{PVeYgW+xz0@mFkkYx_H<_x)HdbFIZZ{3S;?moEk!O1~3#$x6kF8KD6;^%`uAEgUd@f>k8c08Yn0*tc^BUnj15lCVND=
zGVZocY8=m$TA{sglb~c0xcKdh)BT}J(GV?qQoE$%mIiQ>Yss&E)*+s*p&C$Cn**+F
zRE*`**KG6=%;yc~tv(hP@{Jcy0}9Zh28_!>5soqyq{PC&`4ujt
zRC4B3ER4c+;SLFxX;>7WZOS6(>GQ05sv=qA6BCujXIC%3!Bq-iV;<&l)5*rQVF^&d
zztWa}7L$|JPlCI(N@1z^W;(+pU>=V#1+4-u(XePNPcEF9`9>=fD(Sc+`%{-7h8|xS
z@JNgJ<~wZ1JQ!lgoce&x>T-#smaRT3z7MKRe?MY&*#?_bPCOP
z=+*J|;grY9^H?JBPq;1(rylrpJF|F77Gd0wc>JoR{9y@f*H`;-jw)068eX}9Z(;@PL!(*NZ$5X|tbM0pq?Hu08&_{vjGQaHkDd4X(HNMD_e+0;{
z_C94QeLx89BO)qSh}W|$SsX~y>&AXOnpu>hH4dV)x!Iw&cU8t^!WcSoRi#nAQAY9X
zW9|7_Y;%s%-DKsrSv3pTxaMXqf}}=v*{*{}x&~@vjJ(o>*B0)UEuXh6OxAgvbMXa6
z4#*>%wIai0Gg=YJNv!{nL?^4f9DS^%ZpaKcZ}K23P@9oeVhTd@+V@7lnMbgeEF^ux
z_ul(#v2Xbzu%rVZE0LR&^ne%B3qKBK+g>dMVB=|55$mN?qHvd-rJhrE>bTk@@(Y!M*YO-Q^1E1L?x%o^T
zSyrX@ht*3-!XOS#CXmwCYkuH1R4dUnCGXv7C*sa3bA3Et7n+tfv;+3g48UEPu`2ClkA0mFSixtZg1BaOT
z2zi}Dm&@g8u)nixaE_#Ogy{+j0p6j$CMCwwR6ErVR(xaVg;+#TpjZ^rw^aIwY#3!^
zIXqG`%>cUw1-5Tmc`cJWL_9gP?dB-F*!QuQH7a9v89y-6kP9Unw|
z`NPQ|PfC;_t%e%K$PGYqO3eBC}`#8jQ>e;oSN-NI?E7<+~tcxEnQ`5zVA7vlz
zPY#JhF4l)SU%fqATs>cKsr8g>5++rCYWx+`@F6Bb20DdkeLDHu7oQ0`Exg{N*hK93
z7Gi+7Z=6+??;%Bz_)eMMKw{Ucc#ukjj4U3c>3D>dFj2a4BIW?Fge8TaBF>+t0An2H
zZZ&w?BP5z6XXH%M)8uCW4i#qE>xxpoFgJpeVGQoXdpyDs17$u0G#t2%0G^hik^Ix;
z*Cy^wW}L$pLt2K&6R~40YZNg{TwBAI=vwdJV}Z>rw-&>QX9
zkE{8zD4>g|IG%%OLJYY^pjgJGCFRf{ku2^120K>)GT@*n?Kr_l5j??(YqL0g&RFxF
z;mJ4Bk`p2Y1uu8nM^fS3Qsya{cT|4v#JjIFxZ}N1c6D3L>?_^f>ZZ4bVfB-%66*v9
z%O9Cfhdid{a8L-_*D~Wog+Vf$eEF)mR&aNUbiJ?yQ=>
zzTVAgb#`x?XcE$0WQ2_b(8Ci*>@u2yiN-_oPL?;NWnU>Aom`7T9uN~qQA&uPR~_vt
zExk~25#$X!cvj!qH%_Cq0Bj+}NEq~J%;tPVW$1DJ4!M*r
zDg5j=^VTeQ(tdneF!)Uw^{NQSSPNqF&oqdS9Xg{XdF$FimV)OKoE@wR(klWo2d25Y
z?ox*`yif@fE3%XgTQCbdKqb4f&=+WU{Sfzkw$CR|O251P`YhH&SRIs*48Fqe{ivHh
zqhBf`d+}9q&+DX|f}1c$`s5ph{Z|gD4WNQY*9tAwTWb@p!sJ3aW@4}|n^(5YCsxnK
zwz0Tj=ycvwmkPVM`{s#~b=ufeeMfR$no=Bt>xDY@c^}T4Z)FPvCsLx+
z<(_9CLTVYqK4|AHg~?OVUn2TyS_otE-cVbvndy1U5bOY(%E$P7*4E}r)%ht0V{LEM
zUR70_rSP=JY?|rHo*BQW=5>R{4MSpA`HV*IkF8@m*jljA>vzJjzK6g&
z^})g6zM^=SMO-_{HNIjAITH~1$dsgfRmRmalnxL2Qr;3;P1(Eq
zdEwRUhjP+U!z~4^cQyHSJW}Pp`0})mgF}xGj<~CTT*>Z{9V!VwoSP%}LQ;jcsw|c4
zy?SlS5@C=YZ6~)JaY`ET=aY-op`&pPE*yD)59qEBHUwBus&Qh%`UtHvP3Zl`4E3zo
z;_LjEznI@wRxt<9UVbRH#j4|BBe8<(dFw(Wd4yNj;i6g@!Bc*EMrtmX_Zz5?p*(D<
zd2QnO`xv9O`J)$f2Eq|ce5l8-nftM^izdnrsw9LSUIdQo!v-?pX#t9vp||C93U=hX
zeWK}OBgWd%s*5@vOO;~`R=
zBP%TYeU&i{JZ=w$DEu`S<<3%oG%nGUP0&p6IFnISoByNh^VH20E}nfLxoO}&`X2OrYmvJ=Fw2kzmF%wxukpSp3nFD$$3C*WI2nKAxQ$N_b|Jzt
zbEV&%0~QBHJZCPlr|xw8x8Cjk7XYM-3WM5mP;B7;Bicp;xXM4;;A(
z8-5)$d`Roy$zFCF{6!*Xtjm;k4H|S=)UK(T*#^b5XRj5RVWa#_6^3O(Ca+v{|AJ$6
zsF?ea{KqSrey-%PQ3#_pWyvmlR_T!u%mQuK#h2b13#&a(Cri5=VbW)BAVTJsvO1R?
zZ42fm$yddsFNFti!
zYpDVy$-=p>xjO`Pdc3RMLcB&FWJviZy;e}qBYluwM}wk{Pr_7MU(uIPgFlt87ZQ7Y
zHY7n;U*`+RI-B0K7OzdB>AdQ`mzZbeBya3Xjj-pVy&wRToAvT4)vl#&&(-)`zbdiU
zK;22Vwh5EPB#Ac$F_b>ra$(|VAFtAL=hgR@rEq1~XW+1?Aj4y$5Mr?M2GAJC#Cp_h1M4+A*bk2EwWwnEV3k1r<9Bx
zj}5>s%Y^x)ZtxG{{)vdn@WPOIGmpI$z~3{U=(yxa@CnNI98`MX
z9AJ$bnaI(Ik-(jN^?disPi1wy6nFGJ6BZ)0Mw*Gu5ZIia-V^Pyujhbd;JoAq61?3D
zA766hMlJ6dl+2$L@Dnk;q83Am6Z9LazhAz&Dvt~wod
zQJNuCMuW4+qY;u+5B#EDBss2$O?}~>6QeSGc
zv21YTiY92xoRNK&?!<{FY#F)=;S6Fcf%}`T{+V^
z0fM`dJ!a|ipLHR3&anixG2gmkd(CQqob7p<1*F1uqe_kM*_xnb
z1w}d-;J5qEvM|j#ZwWl?t=@Vl9iG?9XYh{{pNBRlbiS|Cfc%MX;9xA2!
zsL?em9G#nuVx3)>KI~mO<0X`>^1mm=D
z<}4PS4}Lg_pITd4C{5Q?Vc`LeLuxJ{%8sgj`>C4iLfA!N*z?)Xtq3z1@bF-RQ4zr3H(R91+aT7*+M;gp}h63JYIBI!z)QEWMY^H@_JHt(wWkZ@z
zZ-qj7)Wu6zZXTO?`fhEJ01LRyrDweI?KLH^L-s8f+MdM=8n1*4I$$n7w5BpGt`bjs
zaeY6r;7O(gf>4HFJZ6g+R`;`hu*@7mgXaqIq!NO})-In+_V^Z@<+ah1Ji1pV|6NXd
z${rd$-jBo}*PU0@OXnUV6K^y1K4L1)IqK2GjJUwNKygyX5m65|!IO>$D%l~PB1YUJ
zReMFa6U=Y*G)4GpNEj=Ta`r(tJ>6e&Xm00T0iR
zlQk3i)Fshg=Tn?nTbD@tr=6|VjCp!7m23#k_A?WBx_((65Kt_nDC~{+Q0TBUGaM>w
zJbJ70(yQ=m$!_s!u)Uvz3vr#N0Tq{z-xN1V`l{A4^AkoZYjam(ViIO)hG)vBkfD$+
zgR<_G{ve;Hfbq<^P@7w8PHKQE3n1;Ki?^cvAQ{`8PZ>I|X+M}XcLHzIfj)B_i7iXM
zEYqO#`pUJC#1i$x^ZuUq79+Hn?@Ra{$xBjZ1S)IB;mGyEH)3H7>pD!%cyQUn@g^-&
z{dD18MF`7_wwFHO7R7zCE*bf_GI=k?ECBXca8lXQx3|uFv6D=bwG@j(*@OnMbxk~=;Y+fzDp^b+dc%&1W$D0|itxNS({adAgQ|okqQ}Ye
z)o}5e&4up$L~vt@G3tCz1nl&3*6KL7urHm`VPaOTSSGJ%vlu=t@Epxn6$&N73y~8?
zqp%h*%a%&~m}UV4hl$=#nBUdy25FqLyJ_H2PS(Tz*4ARV_~dLh@)P*p<90?-o_>$2
zB$JRW6`}U0d||JTjjLLLT*l?@!qx%0FxlgR>;gb=rv5ta+B?NcSDQHA@)PB()5M+R
zm01R&R%`daT%X@hB#=J!=q5#!aW3x=@29pHAY;{%a~;;oL=}%oTMnz=>^&Ye_4?io
ztw$4;X0OzOL|S@fj=9W~^SqM-ses;URa+J@NolcRCcBAeHm|5|sJ^o5A7p-I@2(A8
zQEQxd+NJQ*($;SRSevoOZ9_rUx=Q{2Y0#)laxt6tfIvyk({aDXfbxH*`4^(Mr1
znwWg}qR|1fSPmeL%ZsJg^>j!cRH4MV-hkugUdN^6xIdZ4sZEkkPWLAEx~=zfQE5sY
z1xNKDV(*G-AG|uOu5O{VmpNtg_jrM9{2{$k$-xydA6P6x1&gfboKGfjgp;WR8+i(9
zuva(l-y>CC!c`wjXDVnAscs69!^pjGMi4`$bnygvYZ*Bo;O8a6
zx+_CQLv5@a1we$T7fu@Mn$p3g=~@DY){dMnb~VfO}rR2t>Mjh`;5MrA{fpDD6%
zkZ1ZyKBxznTW%On==!4BeiD`Rs5$1=nRAfc3D1iRPY_B^LaI6uC0zgtd{I=@eSaXW
z^{hMO3wukk0MQDmw>>Sp+Y}^-j}R4@W?rIO$+uK_
zq2!ic8qI2;$YxF|Yaf(KR(b~n4zwmuo|VXkNe?~GX#YSR1hN&Tq9;&_re&c>?=J?sKMr0=y|xkX6qT6Z--rZqgk2clEj)dAMar;|HR_o<#+
zb@{+GDrKObC_UbsWThHTV(oF
zF^2dJ&VVa52u!Y<;!7_TKLwQxwIKg!^g6g8^0;PpFD&u65K#~tlS~|_zj!I6gB=(T
z@zq0c*)WeQn01UOYK-fNbQM2Mx!MlY$f)6`YnPU2Jhd}{lD$V{!(BoBO~i9h9%6KY
zCOiYay2SLdKsJnF?<`iVN)i%tpQwV*p$$dG{qIu#{;ifpV^B#3^8`rb9WAEUe@S&s
zy}}~D(-5x&D5j!;ruFb3l7KHAXh-&o{ZKpd4ro1MLz-l3-`opulAr=Fw0lRK+cf7j*_n3@aTMr(9N|!&6bAC71im`T
zG`eCN8E=N28E@^{j8fiZC*0$UARX5DK3(lZtUE(rjx$Iu41ka|qoMp>|2U-7sQ9rU
z<-5mUtBPs}02@o__yqQ;H++M!p$B>xF5^Hl2c2J&Iiyn$GODDU)#(L-!UIOTV0IDW
zctYn{Rsz##t+(3@U5X5!^ptk0K5oPtlNkDPOw?e`jpzc?#d{)!J
z1*sXFjFT!r6^h^Z~JzD)`Px{@PyEarZct9s539$_uaVmedYB&i5`B
zB#(m=bB0r5q7B|ewB`j(=7TdR*f{c7uqK8dF{`4%RHk}XJXB&6dXT19s96D7v7g~i
zZDXJpGO^TUh-Nyhq`C`47B!Ml4hDYk=kTipf{_x+A_HsGn8a<$%J^?NKMmsxu7aI(a~~
zjQ;SkPzS?!F(9#Do9hJi4$UB?#~F<6K#icpw!*^B0qT*9zzP`2>CSy_-DgFv@lRKk
z2woXTVRdC@Nat!HkOH@UE|`kIy4)}sLK*rct8~p&Nf5~3ZEM)8JllOv8kvF2dlZjV
zd}q2
zWTIcRI{aFu3Z3`H;_|DaJidUWw^o`n43ZT`2|C#8Ja7Yn0%8UPRRk`9X7nJ_xT;FRE4GiP!@9h{L1K)B
z5CbFxU6=$zrmlcQuwK-Rd?y3fZsurNAq;*uK0?So40*H2E?~0`XEI&#cWgM5Jq*JJ}E5bcjY2k40|hleGOqZ>c$_H
z<2LQVE6>)%yMIK_yEtq79&l;W1Y_uHVNr@2-mikPrQ5*bz*S4Kj2
zT^JBlzGjXi(48wg$a;Hec9eMf3BSW`Ec~0?I%Sww?-9^Q-Ui}<(p^#?sE~{8U
zX!~L>amyaN@sFMOl}v>0V)zY7Y50fjaR^??LxV!xrA@-@>^Gc@IBzL4d;2({ex5MU
zO28El8T(YvD!|;N$
z8B`xW@j&4GV_mPb3q=k(N=bL&5kOJuOLoOx5EBem>{_hD&5)b0Ctg4oy5D8PT)BAE
zNuPcLBIFn#qI;R$3}gm5d
zuTL!Z6|uyGGSkb~b_t9=$f-QI`1oj3udT#cL+CuyD5+)swr6Sb~sVU(9@0_Xz
zfYfUR4pL*cD8YuJ=4CKF-MXRYSC*6vv%Zk(PinwK%%W**ZNCEaKQ|SJkBoTl
zj+`L1Dt?<66JiIl8q8NHIkZMV2u7zfTLAegbjuFa0a5NQnqkac?wk-12_^^HlP)zs4va`+G
zsk@er(0v5|`H7H6{(QCrw}Ix6R?VQCOwI#of8R7g6UfoSPB2=~V*q8@Y`Abv;#FF$
zFsM544)xxqLR%w*$-8@r@&T-}@3XYKy7{O!OD?bycHKD+MEIgiRmcVA29i+8YsXfA5gD@O`vRJ01Ls4T1jh%q*`;tmTOt0g!QC+NwoEM8$@mcc2
zFGb^g?)DOhF3=|nw?8of5`EL=%s8KtjL>BILNKO}wJ*yku
zGf}!Uk^vQk!F`#;{T|Rurse_X+ooHXtqr&Zn8eS;d7W2=&B-TEfZh0}i1V!f2
zCba>`&BEqH4p7d;$%6znut0#=6U&RjV8ynP2~wesQOk$jV3jq`YclSk#uZ}z4KIRK^>UmeWqhw8a4$~W#%oM8Iv<0QMx52W7ySRN2
zC3qDMZthDZ?tS}2Wt5A-4#^qKRoJA2E1};(HG-^CfMWMw@*lc0bC2NNNv}`VWOO
zzumGZjDg*4&3SnVqw;W(DMOnr2i7@GpMBJ2I~O$?C(mStNnJx695&Y`N5iO6<}t8`nk*hZPShsQ(`y~f_5H`u^@bCJmjtmI?$d0B8h$VzKL@m)U`=qn!2)f
zBw;CY#5*?g0wJhZOt&t;ygfM{b%he+1r`9ZV}G#JgQM<%E31WotR2>(AF6=UbDU!b
znDO2FVIrOjpf-BR)OxcUStue4|Fi%LMX@PXg)NJorS7O>d3|>-moAAbi2V~Nr
zlmEv*EL-#l6vS}2k5(4}edTyn%;xr2X(F@0s=NB5|06th+2rda?*IDMfFHkg=qzJ|
z3YfYO$>Sa3dkz2XK!YQSSGAslklk1W93}ECxZguU@Yx|W*ul1yFsd#sk1Q_1RB(Q-&<+wIYWucMFQCS%8y3B~U^gU@QD{v%>{}v<_F~tx9V%cJ))kU_y1po)|EfD!O!)L;u5Zw~6u74;I~X`rc7;K-LE;W|18fWPGZKJLtxD6C=_f
z^Au6~A^EqRIH?L5hj(0b?N1d2~C^yIq#F-XV@uuGab
z9Vh5QV7d59h!ftHDiZ;+I&KvSoVFYx__W@S1Al*ANb@cim9eHrhr(*A_ZKb{R)IW=
zzRiDr!P~q39h{1bGig2olph7r8Uy10xv2X7a%V>r!yuonU1pKL(rS>=T6lHEczb&x**0HL+2!}mqjJn2CiXKYr2QkzFCwdw+Gd02
z`}h2{NJfKp{r5%k*E3}6Kl=A)=*d41`$Q~3WC8U3yFD~4+V|_fNzNJiTNalV1xJ(!
z0)l8X(K%Prbexj-rglyCgka}Mh9q6cws%tb%-VS%O#j*M@xi&_oIq}xfOYY
zoFn%0rla`Yk$PglN8JLMApL9OBALg3T*TXpi=JCrTY~PF2}XYVTl&t*K}-c0`r&_H
zl)y#n^~#kA{VSG^*~Q=byT=NDOe};f0Lsc9wizhL6aRILq{w+fO4L(*)$#vwyh&=t
z%ol?#!rwwFNMzg5(E}w{XN(r5fetzC=s!-oriXAcuG~)d(c6Qb<4flQM@T)$_*cm`
z$8!I+Tm&D$%|T&W^@>-QoY_VFYeX33w+M-{!j!`$wim#E-Yb9kAe|nAuQ^X718mcR
z0-bq6wqf3#|MrSWNnlf;`@gT)%xi4t_V#^S_RoBP4&?(%Qf4iFAXw`F8NCBHT*Ll8
z>Q9*M6*=R`0_XSo$X2-(W*I4V(8awqF@)^DXZ&fkSlACxR({ek>@~206>0~?5Ap~=
z8YVGGMcmhDBDo_38hzM|ruIZJdQ0xRjWYQ89~lz=Tl*p>5_U@9=FiW6;hULgi+=+O
zVWBUF{`%@_lt>{1M5gZS2oNuU4ELVEE!jqd;OuvGyIu&!46o_-9{W%p?dek3K#dF<
zWI!L0I}LKqP*0cQHX*y!#mOgt^4Semx_`+p={&4^;#UGP^2qOP0U!>UrP%?>D37el
z`aB^UZTNyb557lk0OkA;IG#jqDEOa1MDb;$oMxu2A4DcB>EHt@W-wEhQHL!Yy2
z%@64ksJxB7&VioM!liPIy2Ncv*`UDegePdN&ffz6k+OluQwevE*xz#Q0@kq0OFuwS
zoGTs&{47a1urS6A2zwlSzz9A~5EH(Su~z;^G8kh*35PY@1G{2fD*n{os|ns;lI_nJ
zZh#ctnqvSJ$&ps<#k+XCEF6Z4zT9)Xx3&Iat7NL*?IryiR4+qg@ebSO^WVdcJ9pL|
zI=Ce(cxgg5-}NB-lK5Njfiha(?H;6BT>?tEp+WbSy*a(e%LU2wv?1Mb8bCVqrID>o
znXAu$sQ<im(cd8LRjT^DgK>_?Em=
ziBnwBpB#Y$sE09y_l+5`)Og8*!oZrP9Bmf1B-gQd4_xh3Uwp^)9${dRW4>ih@A
zOBU(6_l*;l=8y>L&4<>btMzi~JZnf-3aYeswIH-uUi#_DFGRQR)J^QlHVJu(hh|3Ez9*(J=HSseg&+e2K(oU#n$s0E*=N*U?~z594&M}!8
z3^h%DuYVb0!r;X_`ZSPFkXP9voZl;c`+#QKDGU6Lv-4f#T~z5jaM|*q8_-4Q`AiWa
zH6A@jzHN`;6YXTWB2hJgU+?B1V7ZkrO00Z;nnQy}s}Pcn^ssbw4}HA(t0uYu
z&WnTh4ho%wQ}6-6lsvcxy8l-4r43?PwG!$D0%K^M-li#iLB2<Mbt51crqedd9yQT{#B$wTo0&~|Mc(|1EbBM
zMk3R(gBZHCv4`>2%&Oc?B7wNZ;J4c7w*lTsGwS=b1=6Y6<+Rt7jt4
z&nS{COLNYLX@Gz)hGi6_&gpQwX<3LWL>Y38NJA)@GiY+WC*ie?MR1LA-p_e@
z)@GNXYA%W4b~-6K!x-WL%iT0$nqtA2K7X>ICx@WKSSthr6nO7hdwBGTv?RXt|0(aZx{Qj_~s$yo%08?;f3M2HM)!%8Xx*$1s_gOh<_pC
zl(~(+9v6_oR2@2~&>OZdZmiMJFK86$R~_~3CG1~;Q<>|&XU7E+LU+w_emly(63&Vh
zgC6SD$Nn9HnwbydW9WrjV_L=|#GV}t*jgX?p<+j8xwD~xYnW+vtOOFYhm?|Rin12zNWQ9q4-Z35g#%-b8muf5_mHcAOqD)uR-?
zv?!wk;~kCXDyk}{GcxH!nIav`6Sh^ndQZaR$H>RyWAE~s=$i~ihuqa#g?lj#^wDNEkX@ASI8azH}jgLGWge2YyO
zn`Vl^d~3x0HnEU}m#=b)=jm&OSH?d#s!&Wue(BbdEF<`)aI-8?sp|jzWY-Xav`p~0
zpn}rLFH;E?d_UxSH}+5qCSDn4*t1^!?OBO#-=Q9A!^tq~2My2V)n=)t{2LrSRG7jV
z)^7izVaz)pU@Nu?HkqG}IvvoJR@N|^U_;Poh^
zz7i%A$`TF5h8{>@sKv%2VP~K>?5x;c7JX>2DWf#TCDY>*6G8Hl?NGeIo6BZ
z3fduvQ;>R<-f$59+}%%n04Git&oDu`?aDJyF!uW~U`3zZk!Z8f`)K0FI`^^#cLXb%
zeOV{*=TKU>*k{T>9Dm4>-?q)1i#th7uXZ*RG5gE1yPGDG@i)Y|S_FS%DY56Rk`-L?
z!G7r9ORyk87ObddjMp$5o15W5ph$-V#_Yg<@Z8sRfjq-bGMtZzmttl-jJupIN_T(P
zb9uinVgtM(lzY2&(Upa(p0H%}GN_CU=}LJ`KeK0yv9F`++(jq-
z#>AQQ)7mZxg(lA60$7yF#@XlQ{;ts=D8IDxYP-K&QM9Ds{A1-o)*`bTQ7n`0Zj2u1
z&abEm=?6zPzPgpZm=V5sZ$dUo;qxth&!kAbe=gMe6D6+;^!DoF0){A0@$ilh)sNqy
z36}pgH73%$7O5%`CL=YxBVV{U+59yBhAfsF8F~JSXzt#3w4}$=`|C=|u2&?<%mS&5
z7z4@z7a~X0&7yF*aGA`*ZafpUT`x`L&zNv^n|Of8?8>d#u><;;PR~%O1CB?c7Bgol
znj5+E4v^3z^)ZaOEYEDxveC1tL&v+3e$
zTh1RDOH?$U7GNBk-sLF4Q&=3P)M0r*Ga|%K6}J}MT5l|;OWR{V!E(i$ul02hN5qjc
zd@;p=?lyk=j|DO{`EVR+@_svY?3R1KOJZEwQ68BaR=2`0j!oCT#(z5&HgJ-U6*c?Ks8{zl5g^4;)leA7Vd!Vu;X1<$1uf&yk
zPF$2l=9c)Ksv;HB_Q@yoR~Z5P{FH%d4Ajch;Ad&?nXtN%yzhhFps$~RbX#aHa)3H_
zH%FWivp(jmw251Bd-OwmpFU-;z?5==gwM*XCZ6EIW$6qDYfSWx*|dodIo}!QB%7#j
zJo?i=)pv`#x68XdBv8NRn)A0`&HK`Qk~eSD7W{>Kru_uSGT{c@hu}+iFo~|$3Z4(v
z?z2F=nQxuJ`Vt8TZ~Li|XA*9^D^pKBaV9y({0y0hI=fsiKy@fsRhr;_?8;Y*&}u=Q401$FB7+
zoQ8tbF@7Bsa2OjyxQI(t4opO
z%<8(sXqKgmihc6rIw-$mylr)1nKz2auw-3CtjluGTk!KWDq7QU?mdHC4<(ihkSMvA&#roAgV
zo|L5ZikM;gKi8`Cu(h~BbHlk+OAd)Y{3kjxa(^EQ^~${Iw^FdN70=!3?LDzppe1Ay
z-lya(Bdj-Hu(kEmV>ndy;jL{1Ndp;4=Li(suosBI6O2E^slWVadji4GwuH8jdi%<+
z@qb?0?yyxl?GpU2FJ*gtA+E)2XVL#~0Y-0&@{;V`STtOy*;kq{pZ7OJ^G%+EiZk`;
z-0~72CSqlyl3^l2kxyR-zh3oYq&oTXWyl~$>3t>+kE@k}kIt&_<%p=AWVmZBaOzg6
z#u-_Ok2*a5KlRt^BpFyQLMGrpYIp?N9o(DBob=8fk2MLJ6G!RGVzCK(DQfpJ-EPw&
zoMOPM0i(QjmlII>YC3>9qMir&ytldS^BlSUR9Chyg#izLPl{F~1zdjx@2Y#4-19eNUKKX#R(Gerigq3$`RSE_H!}eEh3fYnFie=IXPg6c~GOY4@
zYB$S;7>Q$gw(93jP)-ae7S6w-yJXc6SU`}Vp}Iz__uv9^=8`YDDW*%|R`Zz+5(DUUEO1ajp_
zSJvWdmAYGmQ@!}@X~5&E9I{SYl>|5XM`ydBO16K#uk~|KYoL)P;_rbpJh8}$QRYs<
zc#~L=D9?8lbuBPKdpbpW_~{6pe(<8)#4k>T8?{Q|V;Z{+Wy0wdz#YKJh&hb`=o2X|
zD%=1WqQ|v6yWy@(Vu>y(OC?q7_<=Lj-ZNWCUt^+87EVsdv@&LmRXpsiqR}D+$i`Zs
zT;YZFU&Rk_@JG3VdS!)lac`KISM~*^LOIPg0
z#GC&X$2vh&4jjL&DPqV)xvqa|ukG_`#7*(Ka_%YOaRe~|ri-O0)?wBH5LRA4_{=>(
z<`3X9Ftc@nLm)G|`+53()_{#iCB|Tlt$-obZ~R@ls`^{5#~Z3?S1|JqDx^`c#~RKn
z<%{N)Dd)#T>iu?|zVP%2M|>ddJ9qw_FQ^i^UgU+dgtPuJ-_CNjv+xNF{}q&-TWCX%
zYYQAJpqBtVmJx!I@@weP56lu5^~WbF4ISSco5iOHaB*CM2+rPUPaucT!Q{P
zk$7hy0xhpKo9^SY%6nQKL9F>0K97s3|A1p9eXklkHGRM`H3gZrkjuA2dYn3R4DhE+
z{X0XUw}vZjtjUs@ASyy&)|gKSWVYlE$0Kx4q7Ix?pBnn*uqtbutNKCxKm&Zp8-)*E
z`);g~$|En>P46l~!fvWR6JrU|#yrt^;1IuuW#+TdLyrMz$DR(RFW12?n>G!h?}8CK
zez%=vYMR&|o1JcCU-DP)3q{!jrW_yq^sT@H|3*3^k>*)d1YUcD_%Q)=r|A%uf(?7&3z
z^y7~V$G-BaoUx25FLAA|>h4B1w8+M0-zRTH+YOo|{9p}IlFS7x|g$b0&7r&Wd)g(H4b-iH3aXwEiAehETDXLUOuTz`O(Wb&B$&r?ZoEF
z=bq2)TpCi$;<=i{j_6^;ndmRQ9N#bL|85hUi~76U>(~quDuLA2k){-qZ*<;P&6inA
zdf4l8Etfr>(9NjqMNhc5F(XtJE+Hr>gt=|P6k3SJMUeKjn<6j&9F;R05gt7WL5XNG
zfnpVqDD-Cq@;42WP$w3U(2)pc&dKRq&51i=Hk!8Md_ipn{6-G_Iv8TwS&SF|N#Et~
zAEp=Xavrt`Pyb-e_Y_(|*C--l>6VILOO#|Bq&=r8XAUUpwT5=e4S*)g+dLOyMsr@!
zKK<5TmiH^df;sY=*f34Sphx5z+mf*`?%laWC*X-L@0pH7ZgfK(_hq^O=@R((G?$2L
zw=gxXeqFrZ-+_I;Kc&2amMB~uhKHC#*
zlP~8OQw70y&e}oyV(BGI&y$tK@1AvG6+k<1`awkTvw8W?QAfV}PCuOLe&RH6&<<2z
zN5NBB)4Bc6qo(}rUDW;nT23DOEPoYLZ<8@Fgm3@e#85QG81pV39qB`~Trg5MpMNhv
zt+$)iy6AQVCY`U2dD9JH$Y85^A>9&)X(j25;evN*lhs}K(E8OL>#lH*yvE)u-p(x1
z8sgc$KP!^~5R};08S?QW3jpWuZnruU8vdE3G1kmG_#k_&!o0dH0H|-E4QiTR>LEb|
zHGaa}&zFi{#rVVoQ=9&{!}tWZDI%S+h%%k>#Qre8Mkc_(yuy_65@GFvIVF#k{
zlCi}rCIXX*$z3e%9CC=`R2TCK&WyyT#N0Smz}#q;qNtw?_E~}+{xQ8&D)}C(ha=um
zG|Hjj8@`w1?FZ$>o2#y9BMMG9CE8?JXRa#$&UnjMri7t6z0JsQTMASExBf4%uV>fl
zb|_*4ANr=nIP*^Pr&Dke1ipcF^ZPLkA7o@daP3`PJ6%Btc=iq4)-cvKPGuo59RGe$
zOg)A*-hs)>a1eSN*9NS@@u*KDilNkHa*_QdFfJ3?yA)OVldcO7RJ9J&FQb7zZ+7V?
z7tNodt4D67Dm*(YF3kaj0Zj4Qdrgou-;U>;z;J}=l%OsFPi^EQQ@j1ws_?x}D!_XPjv#|-9%%5Sa8
zlv*ITF$En2t_C)~ypv5BHDCRHpG(c)gWlwb0dQ^f?xE=wX?Fo(&j8dp>@7{wdV0*%
ziP_4}9iNJ2DX>AyHU?2M)F(NoCZMT;GB}I49tvcPswdeA5gx-rk64o~>AGMy}neczOAG>9m3bfzvX%
z9^Z>vc$R-CN8%@L22PeplDV1
zF3sF`HiM{i@Eb3DE@mOfk{d%FJxSc=2%$k8a562t`gcwRuQ=r<c|;@;AxrY&t~*wQIatGl#O?sE@xqeN_@ax1ElUgRix
zI+Yw4^hs$^n|p2>e4JOFp7
z^5OXAU|F3d(DpKT9OuQ3_H?maf8n6~%$Z?;o<$cP*nw
zfqGtrpNX=e2Vb2>&XcIo4Z-SWTK#D+O
z5S7sHqY?`fX>iwIl>_UmBQPg`yHm+{=jvhX-UiR$w+Y~2JNc^18NFrwM`4o{AX&Pg
zOCM*ynChBnIAS4D?*^QVayDfhg^erRn(>kPT(%%kT)u6xH@SmDU=R$4J
zG*D7={`k3}xh;>e^c&%dGdD)NNb6dF4<4$AzGPh%=Foe=x`gfAiWO&bk(Hl!G^k$r
z$OgIM8>8+zv(SowoZ!})?w3cOT+4FSFzR#>X~doMo0G0EhJcGP{3bmQ#{^Zw5&og#
zH!o%?&iEqEhT>0%RpG;TvsK^m#(3%CG+&M(idcAa=2nhO_I`FezJ18!fvKgxo4$;oxxM&_Kq*0VJAvf;Vpp@~qyJ(C!K@Hg
z2mRLfo~fAz1gcm{U7AJV35V%mRmkC@)&($uOw8whVdu}@ddux`q4I@a=&tK_wLGoD
zjr({GhBJ2#6drpj_Tf)nXI0s4RKAc-Lrhio${8syJf%1lDTpKc)+RuX8t)~2s{naRLnI@chc8r^4KDS%-=;(_tTZxmttQ-*2LH=seQ`a>Uv_&+PpiJAJ{Vl~EKB@jV1k*BLC;{n%
z``_7okY_fUu@KTd$mbiC&s>{I7tEeBY}~?CxluL&
zjo?D@$y2tQiFAQFAkc^rfdGb=8k}+BL6o)m4-9~Aa%MCg`<8F5?zbN`SAslK>He?*KTj6aQ@_~=?bNbQg}Y2_(PYf*f(0MZbdJIMnqPPQX6LXP
z-^h3BE7mucGvf&*0dtth`!fUM(qJ|y{!nDWKesvS
zYB)2*#NQ88PS1d1@poepSVp
z1VHy5y1La5t^hq;v5pyjZRA{jVRPPwk@2^jK3Lod+K?q*3&*nR!hdxWcxTyT`3)gS
z$i-Ymzfz97T&bS}9?_D26xalN1?6=CxkyXFt1TXtM_fA}K@@4!6mK>b
zKJ_a6lDEN;|Lg4~_}O8Y@kz8>&HeRe%!5v@!Cmu54
zzUpx{8REL`mTonc^xVsV-6z)-jx6@lW3ousNZ3DUDW25NIP+LDOg%PNBSAeeZ5HBD
zD?7zrniACu8?2`k*LByG;azG&fFNBiljEnm%m#gPJ9EV@MY>vVV8K{XcD?q>Y!L;rnY%DTmUa
zH3cV^VQ@7RExZ>oS42AYOv5OM0kBH^@!^KQW9f>qI*1p*tr<`{Rw1@35}3UpZ~m}xa113HI+
z=!|lZDnc@
zFCM#?KL762zA`jomb?p#18M!0t>54K-h--d%neM;Ur57rhZ=y-zJrv#0s%f3DqNhA
z?+#p~2dQ|DgN-xP2rkPo^sOJMN1#M0#IXnw?+Bb*A-&Lyzs|zPl@LEWSXFWYOe$vM
z3lIae%olWqm9OP>$;kPcntu00tvIUcq1IYQ>&KIiP4%UWkZ!6I0ELAhLGHlu!UVLE
z2N1+xxjX=IY#+=|9BV!ZWFe~pE*OVo3N%J(P^)n?Gasd0+@#$t77YSU-Ypcwx1>JM
z9ae!L-UNu*T%&ZM$7DO#NEYZ+&JeOu=qOg@ZM~^n%Xv@Qd8RntbHxQD$yZ^*7*e47
z0@-osH*i}^Kt6`1A`Fdf0EScn;b+)X#^>iHVa^nf_WkD`YqD|V!k~r|pgRG5j+xIi
z;kpF~+}=NhyVZ}~g5Qw_xK=pqY=PMjQcfagUsI1ZLfB}1mzZI$4VwDFviBTJ`wJD(
zFR?p~OlpTJ@4iP{1%tFd`1)4VORl#_UH{*
z5OsnNh?8?(j2ptydX`Nl_KxJ=4~H
z=K%LY0`enB32gW@|IDIR&`_;*-d7W8KbH}DikO!j$>l(m-ODTz;Uc~!B*b+)Cc}1e
zo)@^6MyMuShU&Z@j1FvJ8M%!v+r|7gAGNrw2ocR&H*iD=I|N0|;te^eprath7-Jz^
z>%T0llBxc;jUK}onkoXbS!wT|@GVza1Y!Pppb9_8qRhZpGQqYxLZs@N=`EOJ_#uFolDAAudL#{@gLR#!muHH3~1
z^rb*DCE-LBFOq%=ouf{eU_X(c;5g2JRj6-`Mg}ax+A+QqN>;$$yl%ELl{sSp^z}6_
z6%3^##A=drMS^;Frn3AQz6<7%c@yrS&+P~8{o+3TaWr@p&8DGeblq9k;u&<1b?Xyi
zkWVcHd5s%}j;A8yZU(uD7*hEcpjBG424gi
z==d=yLnf(Q`SqTM2^{t-L^5KUGVMPDwD|uGs@v~csj&sYGX66oS-ShU<-H2EOf-VE
zB>kuusgwo07*Fx0wNsCAC(Ma!B=A;H$?;evbJQuh>{3>){lh3YE|@Ij|4w0U3n2mU
zI^_wo&wrb#V4%Ht5N~pQzrqH{g4ww17CMe}eS$qV*KbniSH+@Wq4(iyq;9`vlEjZq
zHhV#gYAp~!Pr+<0yP_w_zk1<0iWyY)!cod94=2#h7ftsp;?P!MT7NBU%6X{X@8Q2E
zI6=JoXin%;x=NEmk!%}>ZyJlc9yABD$a1;_!
z#$d3lr^dmy--_Yt8ea@YM;Y5UH`Z&K?g?hXzR#e&efQYa+`P@8Qgw~8BA@MVQAKI|p*oVYg>8F+`=J*(
zpw&E!+s@&gnBgcqcrQt%x{v9eJ5Y;>&Ucs;ln*bytBqk&Ru_5f15t06!)~SFfFR1p
z4UizRV$d=vin>RnMk#Gt^Kqzk2!{)6K4d~(IEurpLaMIMKOdRUxP!S(5+HI87v(d0
zxv`kG;M%R=CJk#Cjw(V&NpkeE9HJQ!iIVy#-o35We6{b*|8N1I1USbP%Wo#I|4GvA
z#sFRURQ!kH-%};w6}qO|qsFHNA(uOLIrk|McWH~Dsoe{?%fu0i7a~fHui>Z{dYJX7
zC{nQ>-63z}aZ7IFj0{W$CAkB*vfuGfywAmn1aTg^K5J3~41DK?;GNHOx8d!H2uLxj
z_zQ0ErEO&Sqm?8C-=VRz|DGd1+7x=XT3Dz>enEy7&TKyj1E-Ac-NIji#V7+;K6g!%
z#IJ@tpk5K;6CXG&obX-N&J;7
zKVZ6{C5nolRlpMX!z!AfHS7!t)bpCBpp1t3>_gRM>paj5cZCVBZj+;hXv`WMkMZik
zZ-{H}%h1A)(Sa26NxYq9nQEJXX2CO<+Jh#$!~8SNbxhe-_pP(^a9zw@$OLyt-U_>8
zfO32F!yz{@ccMfZ{B4|H0QKs#St~dn7=wS{c%2ys{QGdlCs>=$dd8rL^#%IY20&Q8(jmbTy=Mxa$gz-agDQuNv(pJ8TY?GhfXv
zl-NbX1GRf+etc#+u<$@~O+>
zEmWAFtO6+hb9C@re3934!UQ3f&U6T|v-VT=$+E^V-F>+Tsi!qa$F5iT%3AnlU~H3d
zp^>)3>*A|k^X&6c9!X>`&8C^Ir35dq(i-$SQ3DNMlQ=7RSaO9?u(6NYxAboH7EFZkTP_iuJ;YdGKC}e{w>GCU9lArc4%)4!r*8A;{MmcNPJ5V)pE%2#
zKq9>&efQ320`%1+oXS!VlIDPBA{oYs)gxiT)Me#hJ5gC?&F(sX-}`W0seVq05(&zp
z4nC2(*DK4Wy|`%Wu++7(?fp(hC5d2d)4C3#RtV`g3Tw`*1*ym8!$hrC7)QqaYZ*+L
z27ucY}@D!i8ZYB3?4T6j1GZx)c6g-OSob%OZ^%+ruComo_?
z1qe=J7f8LCI?)_DUtl>rIMoXDq21SY$jC?phU}ESdi%&*^WbfmZ+U3ZH)7$a%it#@
zDS>&x>dL+$*8mpUCtws7!1xx+b710Gy#R>`->7lewrVgS`Cfegc315Zq%@aY!xa}$
z^h-N~FAwsbJRUzJPVm-h)#5*&i|!n_ksjV6QHelr#W1{Ch`?j9yY^nuoA4oi0j~Tn
z1+v7W$%OeeF^PACXrw}shT;)w;|-I2sUi!|QPcg#T&NhWdehoSLc*P#DX{RcmN7=MTn*hYkM8<&a1)`UrqEn5d22P3o?
z;FcM~6|J_jn2K+XWQt-U`$R#%Fe_&9o1Rq|O+O(spHEwdHsM78<2w8PY?^wWpsl~x`|xem*t88>JE
zwCU-stOq8uFQQIs(j$ewA}eKz)chG}WT!jxQ*NF5E3Utm<5v|`E0&H+-GDMA)=r&Y
z?TL3>SR33ikyjnP!wwFhTO&jG!G@82E@QtF6cf-W`+Ts0DThE>8NoTtPLQY^rA#Ur
z2O*vt4}PLdQJ(ith&#aw%l*f4&yU}D9Tf
zuE22lJ!YYgj~;z0MC2{N!2t;|OtMY;7!h}ks;xQOc8-gyTdQ3vw)ePt2m-Yn(YtD<
z8Oc8P^j>UUONp@@L47U!cc49VtFKQUiTsif&R#e6%gE#xy{I9Yj@+pgl)DE2wjq8$
zDt*eA0=NDs8Ox7xo1BtjX4pzqeZ7AHV)y{4?WRa`&?#-^fq`O=;;?O!j||_2m&+OY
z3l!|TNN)x&MHdyZ??c}g9?{u;g`>AUyB>?OEqZCiV4@W&S5+23#q9Y|_ODlX2@}k#
zNwhu#rRYU)R_RwI8*iwJ;bzGE6L)yqYydZKhB?&|bHT!zF^YJ1>(9;6Tg-%vUs}Q1
z?cU9Jf|oyVSe~uzGUK|*KO=c@_uM9MawYfwE9n5;DZjt?$1|49*ykcjeMeq=
zV;#wQxsn;B+fm!?K7Gl+Ib2a1hlHKbS!TGt!q+eiuBN6RgFr!9Z8_SmBVHr^0yl9c
zq1DwRRKdsN5^uJFx1hn3jimj>XzB8XV`M$O?CHT%z&-Tn6BFi@+amgnw2Gfd15?XEg40T0Y-06et%Fvg66W`>HnNEX~AB+QaIK
z>yjaEA4^dl39uM;Fz%8f1)pAqNII3R;<^1@Vd)Bo<1Ze>Ptb#U4;h4^{)bkaCVvee
z6n)Uktxt(
zFuz^eo&O6va0x)-^6`7Fe9U@ZmH3|89h}N2xpc6X!15?gBo>#;=V}mOBUDGhB)D73
z!3IvQYcdA-dEhPII(igTlaAn!x4sGIOhvrz$v%)}hqiv({3doT|I+rE2&&%MUy%PC
z_mJeLXly~Msk7vTC{akB{XiDjlc~W1-emD&{^7BYAJ*bY?z}dv!kUBN_1jZq-J@GWef~>gaa9Yj1NRKPEzegt%woQV2ybAZFc^*9h3Y#NYSfBEIibmH80`4-
zp)_nLmy@<>WxDPRl4$2YD+`^UDI`fy@;7g!;DfxREx>mw9E%%pDv2Hfm1gJhao~ki
zAYmm~%*sp=79jVl+$y>>#=TiyJHs6=j3_0}p9&ici_`s^Ro7w4z&(F3TYL5R@;k!5=HsaZXOaW`@NmHWY*o|xzstdzG
z*LxVx(;(%gClBb>>>3atMu<2#rkD{(aI;cWH$i1T_WAC5x|?rS?u}XeFqpKDeH>Y(7KxF&GPVNa~15
ztmO9_Wd$_8{*T`1WDsS0PdqB=xvyd6)z+Z*+~?}`_ppgv!5d8b1NEO?9x!BL?scD|
zKAH0za)Y4?FL5S^G3b#DRl@vFfghg}4*{U{dn1mZWrEen$Y=sED~<-
z*2b%#@#7pWL2w=p5~`!@HXXaey<&!ba}zmF&r=5<6QCK_vSNuDQv
zyfX7!P<0%vELuOt41MCAaVY#3uC>}d@wRk`wX=ku;Yh(~y{GlKxf^}hyIq&6lX2Ym$U`e(X}rgXcHiX6T{VrT|OfT9zzZ_s7q%hyCT
zp@-wEj9E;APw~gJhWEC~x@c=&d{q%RsBiBGnfRtVHvlnv_DA^R!S*CcS9Bnf4-|#c
za;P;PXnms?tQnw#Thxu2=q`agxF3wQ#_LqS^NI_;PsPLV`bd&L5*Wm$ut!k@Wq_wG
zG$aS`=bvBbay;jrSHcfnic$iRHvso__032b?P6d4_@ls+Zp
znEg@z5PB5{{_n5CWg1csUvA)gBG&_i%3nx6Z2KKDtqRb<$}u;(qN5>tpTaO44b$=>
zOgoqake~F_WhKsV`#vUuyd~wr1f`JukX*ysyu9)9Qpl7!N;xP-c0WwjM840q|3{f
zV;4pDR$W~6AZgjqWpyg|I?P(&H?QBAd6OB)A=CZ=%gi?|l!~9I;Pnd;CMs
zbt(-_h54Yi?kMIE%|y}3O@f1u84F=KpjV*s1Tem4cY&c%5wtp_SDTf6AXKSyn7x<4
zQu^GWwc?_Z!TrdqKcI1r8V(MzyDvYIhqW8ahKHR%mol+vf+$DG&nJoH5#$Ni`fQW>
zc5;|7>4=<9`L#bQW!xj;3Mi%xt;xMVYn!!ZUi1QVSP%A!b7rGkU~)|uF;<_0BWk+Q
zv45wMVwbCuxb>(|x<6Ybp{+eoP}63oXXUYX_cbbeE|$El?kBN{NR1qH`
zcesv*Y42#V$jnYWAOZVw*I1F
zwcF}93axrpWCvrB*!iBP9;A4lEEuIN6Rvmx>ottuY!)@looH`DUJ9=wSbWUh2b)C;
zYC!&@;Z}VbL#YUlxPv`?$IUcQfMRzswqOOTj&N0R~^b5uDF02)LVsv
z_sz5C%NGXV02Pp&_C77_UzR8W?MWhe+J_m-0E?mFe5CSj^0FZ$D1SU-MVJ-DOu2;N
zmYQ&yNn}N8EbG*PvAHK!uOf6(D#1m=2`sS>o+#il#z=9=z#ppA-}$BSU%e;&?_Sw;
zrGUO5hKwC@ae!I(kB`oROGT$)CExi)FiMFzbFo@(1M~CGlZQDMj&7LZyH7J+&>sh;
zZW*Gp!Wr}({6>mlL$(mY^T6OLkKGOC1iLKgrNGZ%g^O35Mtvklf_jG=y>DK>(bynGItyXtQH}5K*=u0)aHnz{cwS}5
z?JMWZHnPk({n_
zQ|%-d(XE~^U-|h~32IiN`N(LbD~M&TGcY87yGhRtB0MBt88%i5M$
z>&7Ewyqs}(%=H|FlS{5tO`mc7HP>BVYO&UU4}R2QRq6@w41ul92};pKf560aye{?R
zC;tL!Bdq5siQ_Ox#q^V!{!%0h@~V#pJ}dO%5FPwJ;MBxH8JYK2Z01KgV
z=%%(C@CW&4$;4wUrq3{|9|?jYrVp}JjuZF!;x&&PAyASj1QE&w~B>m0skN
zjyxH5Q5jR*R_=18kaS_ldg7m`vLg5W7|>Lq72^a|FT?LBt|R;}YRAW5rVWqgR*jmg
z&_YRfA_^oB`L8}axb}ucU_MHu^YQsE$3?M1uZ8jONI9Nsl_{_B0%;pboCUllre}1>
zz$*HPvNshy#iO4tXFd21g^N26Gs!r{obqMO7&H;DnkztI*tt%zbkm2(LZD{k`L2AT
zaCK>F0AyZl4QHNSkeZs-G%JL>UKm?R<3k7MhmW_XwA_!pl=QC4E$Mgy)Zx~!>>pC;
zNecJHjrHHx
z>E{Dp+}Mb770;pVCw>~1_-^7U>#6Q_r9%D13>*3SbL8DzqyDL0n?@Us_qE^~`
z^h6(Ul^&QryAXcIAQ+zp&{YL0g6V%irC$sx5VbHl_ikohK5ZfRAyEOquMt++x%RB|B_$(N8d4K=D%+0e9_&DFp}Xw-^U7DGz8y$GS8gm|pnKS`iMxSGjEbhqh(aYkIY
z)!z=muoIP*7#|a@PLCp6eE&ZWSVvnQKr~I=1>BeNc!#Th9xH+$|GGbzVqFFy(40rL
zFphu2F44TNxOVHK%_RQQ4`wMGcll6NAap^dGsvt_;JXqqCFYD`({-s*Xwo~+3&}hZj^ri6r@iZD2pnJbzIni%9_Uf%2Z8y4K6N-$aiM!N@P_#RgxyB-9;ue{=o#
zQC8eou>@D_$@2sXScV_<<JJiTy(okhgZ!Ag<-TVj~&
zBf6aJ3*UVA@il?^JV7Jg%2cJ<kQU*6rU@W`2_0$CdBg9t)q)Er
zen<0QsA(C=iW8AlA9!U;+x~b!$Ykf^sctD7f0N5w?XZ!ct8S%pW{1yYT3_
zA!92JdIAoz7w5<7$c^c!o($`5;G
z?jvu+i(0^HDC_UNTe#c$iQa9MpX?7Fpd+4x-;b3*JGM_M!`EPnYPT-llX1~`WZ@H*
zdiVRWI_LACZ&16MJCkY?WNuospG76(6HUvL`EbLJMhblVf!-f?Hck%>5%7hX}D-}WE6w(dX36gE~r@W#!|
z*5Zbde;Cd5vN2PjQ76-cEKC(LQ^;vbL>nrvwrxM0C4f_9*fE-GevlY;?Ygf_-K*X7
zkE9p<#mK~%(Z@CZzk)?-shEX?a%i0sdAQEmB1AOE+B}=3eRa9&dH!s2q8q7Wft*RD#r`8@g?&
zwt%HrDSpH{lh1k#P5{ZB
z=r_xAEAyIW!-h3B&@J(&(vs4D3_}$-1g7BYSYRAMxC=9(hmxnb{G%;m_Oy
zuh^=!ERUksPhPkA{|^@c9O$Zwspz@gGd?`FpM|;6L>Q?22fyMtaT*Ki4en#`Y2Hzd
zaGo)_1OS)4JfQa9n%y>_iUOLvFc6-mc{q!>DrkhaesoqKAMcDNVJPHheHrMTeb>{F
zL0ejwScMvN9z7z9Pq3$9lFf!{hA^=e2wawEwF(tCb@
zWtfO8ptG`;hK<`QY=^)SJS}>Cs{7$A42A>Gkn)q{v9ss5$1w`@_gD*50AH-Xheh1l
z%aImFh=|FjqTR&1G|VuxkV2>J3|G)+E3)pV0QwXiZHfR3r=LI-y#V&D@kA12zy~m_
zE~Wy`!-1ZpYrx(zm1+3eF#mlt9=jVx{f@5?H_v#-YY*6stc>c&VSn;+gMZD{RUg-7
zAiuuN7F=cC3>hBcpXc8qx49=^L)NFe&mm4d3QOh9hto&@Wx@n~_5fNtx5RBqpthhw
z3X6KR#t^eph>67T3b8E_b<(cF=ka%_l>a5Y-vS7jjYIPg22k#*e~9x{O=d>bx0J|4
z^yr5?5If0}Q2m4d-T*9+uWevdv=G)u+n2(j=)^(qmI&voVKDzF`kWiE2mT)5(MD
zRxAbbtANI8#GmW5+s9iW2#t#I)?YiIf|KO@TozNkvJ>_&pFEopBFq9+a67lBCwrug
zhR-d)W7Ln)uch(Pa*m_9f3%gZA(&j^vsIKAL!*X_xZ`j)OvnrrE1=}{Y`}lbCl0-d
zG~(E;OE!Zn!4T+W2Z9oqg%T3@>}}I0DY97{4HA8frUv+aVM_RoQde2uiAytI@xCeO
zLhmVjw)2*d89qmky1#9sS^s`N6fQSobJgHmj|!(wYl@E@Dv**i09^w`MPZipA*Ni(
z-$ZI=et~tM24%3Z2vjHf{M*?Avc?qQ1Ab0Ot07$$wplCm%FNn%G8hfsE)xzVxL$G4BhZPf&S}W
z>G`w2&qz#Ob^3kg^WU$MV?gt`5=5@$-6Z-wx-Vf#zsBkB$kpfe5J)i#M|s8v!T~io
zUOnp3zj4!u1d-@U=n&pTG7R9XZT-#(Zu!fnN;<1KOV8MPl$3rss9?!3)G(V-Pd{sV
z@}2uC-E%uMAhn^;PR%8V!Z{^xdz%>z{}D!WEg1`*`#M5WU|?%db^}b9Pk|4}fWm7+
zJd99}>B#*Lh+`jY@%gCZxm0UHJc|1Q72!lnBh|b6_mrg>W1^@k-4?GJ;obsao-L4T
z^T?sAQ+&49q7(2LqKEq&r2^cF)@`IF3N_x~jTX!qIAoh%w;aZLVoN@5CHK_C<`lj?
z`)-xi=H`;xH(KE*2~=sHDyrilDd}orK)`^%t%x6j?WJP=f{~;j$9apO;G4r8vB{tB
zu?qQ{b6DVmu@!6&F%14!j|^tCUTt56ah_LiP;vR_0X8fBIMU~`cRlW!RRzrUE5|!6
zC%s-cuj3^6$z`TI^@y!~k-9{m+lvz~XFxXT>pPM9xhw;tQ?{1m#QmxgZgy_Arfi7F
zEZ>xq`jlf8WvPX_G=2iCFg@snOf7o(
zaP!Mq54sC7Uom#=()>#BsMQwq0*la!y3S3tl5&}3ch}Ew06qMSi8sTuG
z44b=t6ef{WbDmDp4T9M$gG0Ify6o6s9`*TDuupc99}e@;tOj1xTPWk7>Ve0Ekc~=f
z{75fkl>F|S)E&wnVHFB?_tG3$DV-FmI!mWgH9Ugi6~Of%Z93+o_;^n1_22(le{wYW
zM9qLdFsSj5oy>2Eyld8GAq~JcNATVE>QsL79Z^cy@MF#wY0R?Z#e8Zqm1FM65XnXx
zu@nokWDleA1(#Zka~$om?bzrRyB@N-7CaxX$Jc(&v8QBo9j=dzVZ+XuW<&8MWx36^
zF7k1$5V%@3$7wkakvgh@2p}m=d{-lQ*)?>$-+Az!l4rpB^09`{YN}hWH<`C`efUd;
zZ~wkU54Tg;JN1ha%My&sRV*B6tiB
zBejzrm8UWPK~kh4A@+}O{ZJd!kg^&bDXdQzUv}DS*6or9fppb=^dodxgGkyNNIy*8
zmL{NoOe1JzVi5`&wUh(uTp+&oWm{^XN)N4Xjm_R=V0VpY+L`S*TG~AH4Vu0{r}x4<
z*-S|sq@?qd;+JIxY)1ohm+hlF$9s1d-TvXp-x*EPM8JP}yXo
zPffAU5x3R5E*4Q#M0>`;y!&QTV+!;;apdLJd6XKUF*){!>(D3G!>4}&Mg33KRnSlK
zA93a0362YLX5?I;t^Yb2Cvd|nHsp|cBN-Y}5Gm=mxIgvo?4SH=}-YIg6m}uqEcHk=YU(?$ryq+*Q7$#a5
zWa*s5<)0a?CN6S}>5z2?s95bt~^0+n!ZNk7_3iNpBan`(mnR-uCn);
z>UOJ9|L(!#IIrPWt{hw2-l5cL!7oux$#Ggbn3Z--K6^X+Pa(2VQY|5G)~oQFtnbkX
zcH@V=oD?@%MOfIFN(3AIWnbQst-HKHZZ?f*P>Zfx{a5^Zx!Sj;cH1Vca)X}%lrcu>6K4%I2MjA7NS7GrXO^9L45bo=YK$(A!U@;hK6
zc!dv#lZs>`XP`2Y9i%8HE*_=2%Jj(@i@{P9l!!iI*CFG_#E6yvZdzHKqB6lA0%QvZ
zuF~rZBjHw$$*A)VInKK2aN)#W0jRFF7$K8}rX4wqTcg)H)^~l5Wdkx2XWL7ZYzTTB
zG{z^!;GfED^TGJ^`+QGftk$RK*Rr=qlR_N9q`~%3ywbqQJ)Gkihq0RM*0TPG)5a4y
zqB&>p{LS8bsjYZ2WbmYVW<`MB|0iv(%-s#zz65u5ew=0`
ztYQ~%Yd=5r?b*$C3+-Mjjg|442qj8Aj7;5!z?~Ot{SxrpqKu!s(!XtCF$z=v1T4AU
zoBo!@1QD`qdiFDv`7v&xqbVfyykE;%M|dKGfo6F{Iz&>lZa9jD-~Z}AK0zW5VmH4I
zOb6R<3=P8?nSe^_y##4qq&=;pBxf;W_!?-I%G=GwRmNR|g1s~cd9vL|dc$kV!FPAU
z!qQMc=SZtZ<`dszWjBbzzEo$GCw
zZP`f==4t=Ed(^?|fM#+V`f*M>BHDJU8q$!Wl<*^t%?>X$HLUh4D_acQ*fH7}!-e&+
zPlCc+gEW>Kgj9HCmIf9ZE_Pc!uIOX_Go{qCEzaX>&K1wxS|Hj$$}>;4+x61&@kds}
z(`V>dv`O+v_N(L~hmb@&pV~=+E5*rxV&VtL8T{3
zt+{??=*&x#!XBFDYmz_IS1YjxIe{S>|FQtA_{U&$$3Mu=W{P9XRw5hWvu>=9;y1$mYUaX_VOf+~M~$)6cf%JiF3A28mM}u2!0XP=
zdPju{T1T!|0%a{l#dCOpU~`U}Sm7LGnR-~6XChp#!8cmzOL`N>mf#19!g8g-@cx_e
z9v9@&-bM#pgMDdn+a=56$U85+&Lia+ca~j~mZ@r#1^ad}Q
zk9jOrbKsERcizDOD@KUtKCo&c?%~yLYpO}1%y;`9L1^=~cP%caHJ#ousCu~{|
zk`%0^-RNi18#-Q~+<2AWv|c#N;y}h~CNPrErbL8ox}}s|-I7MN6SPrIFjrj;oQ+cV
znSFsTHl1j>?G4IbN{#F5;s)k#Z<=jA(`k4*nelH$=fFZ(?sLk~sJbo6MXPejG{N-y
zIBxrA_6<*jE(kvMew7=?#Jxss*MPNi`84ibA04@K!10WV&lS95#(3BX`whww$?Ol*
zjzU4k=9|$>c|`Z1oPewOnAm>+|5oN`Li}yOXO+qF*J%+$Z2l8v~;*)TW
zIvh`+l?C5|3Su5OsYT8(c1iEeygp&ZBveX8$W6sgt?R?g(Q6|A8q58%)(HbyDI*z<
z(VSLXyNha;4NUNEy;29FvOp&OWU6MQ*}@T~DzDVF!h%dKbMSxBj$2-8VkMH>KT^8f
zH*S<jgJ^K3PO(v%ZMLBz$)=z#A{yB?a^I|{
zB9`eMF+l!upI>5ov>-TE%me#;`Aogtc&k8)-*Wx?JQ!G*n&a0od~|{($E`DRO~hmI
z>bOIZnWTIi+KY!x*6_K)e4jPQbMO;%)SaUli#KHy}havR2JhQGoR*E=w;iLy_F
zOoM(~-KFA)X=A}7Ww?4|P)^UM6v9zr8qAv5Z5@224x-WgIiY9;hS?X+FZJIZyQyHo
zZ^vw@Ss{`-b&opgJ2>3jS6+lh>=&pOUc!j0A}8(`C`a(AQ_GxWf>~!+L0xf<@ognj
zq|_s-{D{LI)@dtmYyaQpVBdkBku0(KiNO@V5kOMzr;}lDc<^LHSp|;%?
zrs@+3p)Tt$uG##Y=DHjJ@|21>jt6BhS$Y4fCM1vxl(JPDkQjpaiVe470LJv(r!<2x
zQAN*2FR0)~nZk|!|2|}ds|}bBX{u_75+R&B#9QGQ**N30{amI;;YT4%zd=^cESw9^
zCl&FlTJk9EK+8T01`~Gu2t0ss)jZVF7m+#BFPP}Q!wCWCbsh*=uV6Z`KQ~aDc@+)x
zu8+rVa9;pI#w_b)2raY&VYv+3UaiY}N(sBSg$NZ=4VYmUtJ?xtl%S*c#4P6u%J=q&
zo<>qpXvmAVvrAqAuQhXf3mBhJLT6PJgU0Zj8kC-+_o|By&;lwSc`Cu2p0F*Q(OzW8
zhJ}|vQIbk}FJ{fAo>kEJJ-h^=E|NG=7=_g2V$N*$!cwzZHRgg_cYquqWPL_$pil`H_hB
zIENhFdtn9gR_wxbybLr)eAahu?Q4N?E>#HWJ|2xpP7-
z#P@sc$3xTjRiFzPys*H#!l)pW2BwO~_m#2DGHP&Q&OW+nS|X65{smIk%`X{R*NMJ{
zI&U6gq$Pzid#f>C7h!eTu+!%u`Pfi~bZv-V)<
zvPqBTAqEH&siYA=`oQ}i$g>$vBH1^HdII41;TSv^1Tu%{L
zhjDDtfg&u*5LrBfiTLr-POY148APDFAPG38s>>b(pzOdp3~`DOjEsaq(*S30pX&Zg
zf?{J(gyNh+wIakUO{+^H002WrOhU|wvSko(|8fW%_}!wb+y(;K;YJmp=go`9;5c>I
z<0bd7Q^6f|3KEYPJ@#0>T)ZgdA^_*hC5h|@n-`tV#rk$#1%^y1i&(_sREOYeJ;5AI
z6v-hfEXBCj0#_ar@%TX&A?!T}qz)Yaf;zR|H_=dXR6N9M9v<*y7~&ps21}|75Xp-Z
zkgy#NH#ay<^4d)-fSMlI28ghO6!nrmoW3o=4hu*5n;_gVQp3J6)M31+r^TVBoyj
z-h_i|fhuOK&OBGPOKMYGrFU1D5RapEQBtcxrT(RMqZ-Ye)TZby#nWW_I4k$?9{#2jBk(p
zX9Sz6Rz92-$sUPq7#S=5YU-}X}fwN8uZC#>Z9y~n!qCNh!ahVchH*S@acNQ
zZ-i$Z?p}dARm~-GGRH_2n@jZM3-h8o#962i?-y)#s@y9N&6|ST7ErFu43SZ%JZR`I
zDDXl&Re|~Vz?Nm6V)wp$_tvU%bJd<~gUw}-@I5*PYvJOKU*IC96vnY~;7Z~