From ea5d021f0c7aff8c0427c0bc06c5dc8b72f841f6 Mon Sep 17 00:00:00 2001 From: KaraZajac Date: Sat, 16 May 2026 20:29:48 -0400 Subject: [PATCH] tools/iamroot-fleet-scan.sh + docs/DETECTION_PLAYBOOK.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit iamroot-fleet-scan.sh — bash wrapper that scp's the iamroot binary to a host list, ssh-runs --scan --json on each, aggregates results into a single JSON document. Supports: - hosts list from file or stdin - user@host:port syntax - parallel xargs execution (default -P 4) - ssh key / extra ssh opts pass-through - --no-sudo for hosts where root isn't required - --summary-only to suppress per-host detail - --no-cleanup to leave the binary on disk Critical fix during smoke-test: iamroot's exit codes are SEMANTIC (0=OK, 2=VULNERABLE, 4=PRECOND_FAIL, 5=EXPLOIT_OK). The wrapper must NOT treat nonzero exit as a transport failure; success is defined by 'stdout contains valid JSON', failure by 'stdout empty'. Verified end-to-end on kctf-mgr → kctf-fuzz: fleet-scan reports ok=1, failed=0, summary.vulnerable groups by CVE: copy_fail_gcm, dirty_frag_esp×2, entrybleed. Per-host detail included. docs/DETECTION_PLAYBOOK.md — operational integration guide: - Lifecycle diagram (inventory → scan → fleet scan → deploy/mitigate/upgrade → monitor) - Recipes by team size: single host, small fleet, large fleet - SIEM integration patterns: Splunk, Elastic, Sigma - Auditd-event lookup commands per module key - VULNERABLE decision tree (patch vs mitigate vs compensate) - Mitigation revert procedures + side-effect table - False-positive tuning table per rule key - Pre-patch quarantine pattern - Maintenance contract / module-shipping SLA --- docs/DETECTION_PLAYBOOK.md | 302 ++++++++++++++++++++++++++++++++++++ iamroot | Bin 0 -> 141584 bytes tools/iamroot-fleet-scan.sh | 205 ++++++++++++++++++++++++ 3 files changed, 507 insertions(+) create mode 100644 docs/DETECTION_PLAYBOOK.md create mode 100755 iamroot create mode 100755 tools/iamroot-fleet-scan.sh diff --git a/docs/DETECTION_PLAYBOOK.md b/docs/DETECTION_PLAYBOOK.md new file mode 100644 index 0000000..2101f9c --- /dev/null +++ b/docs/DETECTION_PLAYBOOK.md @@ -0,0 +1,302 @@ +# IAMROOT detection playbook + +Operational guide for blue teams using IAMROOT defensively. Pairs +with `docs/DEFENDERS.md` (the "what" reference) — this is the "how to +make it part of your daily ops" guide. + +## The lifecycle + +``` + ┌─────────────┐ + │ inventory │ ← iamroot --list (what's bundled?) + └──────┬──────┘ + ▼ + ┌─────────────┐ + │ scan │ ← iamroot --scan --json (what am I vulnerable to?) + └──────┬──────┘ + ▼ + ┌─────────────┐ + │ fleet scan │ ← iamroot-fleet-scan.sh hosts.txt + └──────┬──────┘ + ▼ + ┌────────────┼────────────┐ + ▼ ▼ ▼ + ┌────────┐ ┌─────────┐ ┌──────────┐ + │ deploy │ │ mitigate│ │ upgrade │ ← three responses + │ rules │ │ (pre-fix│ │ (kernel │ + │(SIEM) │ │ stopgap)│ │ patch) │ + └────┬───┘ └─────┬───┘ └─────┬────┘ + └────────────┼────────────┘ + ▼ + ┌─────────────┐ + │ monitor │ ← ausearch -k iamroot-* / SIEM alerts + └─────────────┘ +``` + +## Recipes by team size + +### Single host (workstation / single server) + +```bash +# Daily/weekly hygiene check +sudo iamroot --scan + +# If anything's VULNERABLE, deploy detections + apply mitigation +sudo iamroot --detect-rules --format=auditd | sudo tee /etc/audit/rules.d/99-iamroot.rules +sudo augenrules --load +sudo iamroot --mitigate copy_fail # or whichever module fired +``` + +### Small fleet (~10-100 hosts, SSH-reachable) + +Use `tools/iamroot-fleet-scan.sh`: + +```bash +# Hosts list — one per line; user@host:port supported +cat > hosts.txt < fleet-scan-$(date +%F).json + +# Show me hosts with any VULNERABLE finding +jq '.hosts[] | select(.scan.modules | map(.result == "VULNERABLE") | any) | .host' \ + fleet-scan-*.json + +# Show summary across the fleet +jq '.summary' fleet-scan-*.json +``` + +Output shape: + +```json +{ + "generated_at": "2026-05-16T22:00:00Z", + "n_hosts": 4, + "summary": { + "ok": 4, + "failed": 0, + "vulnerable": [ + { "cve": "CVE-2024-1086", "name": "nf_tables", "count": 2 }, + { "cve": "CVE-2023-0458", "name": "entrybleed", "count": 4 } + ] + }, + "hosts": [...] +} +``` + +### Larger fleet (>100 hosts) + +`iamroot-fleet-scan.sh` is intentionally simple (parallel ssh). For +fleets too large for SSH-fan-out, wrap it in your config-management +tool of choice: + +- **Ansible**: ship the binary via `copy:`, run via `command:`, parse + JSON with `jq` in a follow-on task +- **SaltStack**: `cmd.run` returning JSON; `salt-call --return` to your + SIEM +- **Fabric / Mitogen**: same shape, just Python-side + +Sample Ansible task: + +```yaml +- name: scan with iamroot + copy: + src: iamroot + dest: /tmp/iamroot + mode: '0755' +- name: run --scan --json + command: /tmp/iamroot --scan --json --no-color + register: scan + changed_when: false + failed_when: false # iamroot exit codes are semantic, not errors +- name: collect + set_fact: + iamroot_scan: "{{ scan.stdout | from_json }}" +- name: cleanup + file: + path: /tmp/iamroot + state: absent +``` + +## SIEM integration patterns + +### Splunk + +``` +# splunk input config (inputs.conf) +[script:///opt/iamroot/iamroot-cron-scan.sh] +interval = 86400 +source = iamroot +sourcetype = iamroot:scan +``` + +`iamroot-cron-scan.sh`: + +```bash +#!/bin/bash +/usr/local/bin/iamroot --scan --json --no-color +``` + +Search the indexed events: + +```spl +index=iamroot sourcetype="iamroot:scan" modules{}.result=VULNERABLE +| stats count by host modules{}.cve +``` + +### Elastic / OpenSearch + +Filebeat module reading the per-host scan JSON files (one per day), +indexed into an `iamroot-*` index pattern. Standard Kibana +visualization on `modules.cve` over time tracks vulnerability lifecycle. + +### Sigma → your platform + +```bash +# Ship Sigma rules into your platform +iamroot --detect-rules --format=sigma > /etc/sigma/iamroot.yml +# Convert to your target (Sentinel, Elastic, etc.) via sigmac +sigmac -t elastic /etc/sigma/iamroot.yml +``` + +## Day-to-day operational shape + +### What "good" looks like in the SIEM + +- Daily `iamroot --scan --json` from every host indexed +- Trend dashboard: count of VULNERABLE results by CVE over time +- Goal: every VULNERABLE → OK transition within SLA (e.g., 14 days for + patched-mainline bugs, 24h for actively-exploited) +- Alert on: any host with a result not seen yesterday (could indicate + a config drift, a new install, or a disabled mitigation) + +### Auditd events from the embedded rules + +After deploying `iamroot --detect-rules --format=auditd`: + +```bash +# By module key +sudo ausearch -k iamroot-copy-fail -ts today +sudo ausearch -k iamroot-dirty-pipe -ts today +sudo ausearch -k iamroot-pwnkit -ts today +sudo ausearch -k iamroot-nf-tables-userns -ts today +sudo ausearch -k iamroot-overlayfs -ts today + +# Anything iamroot-tagged in the last hour +sudo ausearch -k 'iamroot-*' -ts recent + +# Forward to syslog (rsyslog example) +# /etc/rsyslog.d/iamroot.conf: +:msg, contains, "iamroot-" @@your-siem.example.com:514 +``` + +### When a VULNERABLE result fires + +Decision tree: + +``` +A scan reports VULNERABLE for module X +│ +├── Q: Can I patch the underlying kernel / package? +│ ├── YES → schedule patch window. In the meantime: +│ │ iamroot --mitigate X (if supported) +│ │ Verify auditd rule for X is loaded. +│ │ Monitor for the rule key. +│ └── NO (legacy LTS, embedded device, prod freeze) → +│ iamroot --mitigate X (essential) +│ Compensating control: tighten LSM (SELinux/AppArmor) +│ Document in risk register +│ +└── Q: Was this VULNERABLE before? When? + ├── First time → config drift; investigate why detection now + │ produces this result + └── Persistent → mitigation isn't applied OR is being reverted + by config management; fix the config baseline +``` + +### Mitigation reverts + +Mitigations can break legitimate functionality: + +| Mitigation | Side effect | +|---|---| +| `copy_fail` blacklist algif_aead | strongSwan / IPsec breaks | +| `copy_fail` blacklist esp4/esp6 | IPsec breaks | +| `copy_fail` blacklist rxrpc | AFS / kAFS clients break | +| `copy_fail` AppArmor restrict userns=1 | bubblewrap, podman rootless break | + +If you applied a mitigation and now need to revert (e.g., the kernel +patch has rolled out fleet-wide): + +```bash +sudo iamroot --cleanup copy_fail +# OR manually: +sudo rm /etc/modprobe.d/dirtyfail-mitigations.conf +sudo rm /etc/sysctl.d/99-dirtyfail-mitigations.conf +# Reload affected modules / sysctls per your distro +``` + +## Common false positives + tuning + +| Rule key | False positive | Fix | +|---|---|---| +| `iamroot-copy-fail-afalg` | strongSwan, libcrypto using kernel crypto | `-F auid=` exclude service account UIDs | +| `iamroot-dirty-pipe-splice` | nginx, HAProxy, kTLS | `-F gid!=33 -F gid!=99` exclude web service accounts | +| `iamroot-pwnkit-execve` | gnome-software, polkit's own re-exec | Correlate by parent process; pkexec via gnome dbus is benign | +| `iamroot-nf-tables-userns` | docker rootless, podman, snap confined apps | Whitelist known userns-using service GIDs | +| `iamroot-overlayfs` | docker / containerd mounting overlayfs as root | The rule is intended for unprivileged-userns overlayfs mounts; add `-F auid>=1000` | + +## Pre-patch quarantine pattern + +If a CVE is in active exploitation and you can't patch immediately: + +```bash +# Stage 1: detect +sudo iamroot --scan --json | jq '.modules[] | select(.cve == "CVE-XXXX")' + +# Stage 2: mitigate (where supported) +sudo iamroot --mitigate + +# Stage 3: monitor — auditd rules already deployed +sudo ausearch -k 'iamroot-*' -ts today | grep + +# Stage 4: contain — temporarily restrict the trigger surface +# e.g., for nf_tables CVE-2024-1086: +echo 0 | sudo tee /proc/sys/kernel/unprivileged_userns_clone +# OR +sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 + +# Stage 5: alert +# When auditd or sigma rule fires, page on-call +``` + +## Maintenance contract + +When IAMROOT ships a new module: + +1. CI test passes on at least one vulnerable + patched kernel pair +2. Detection rules ship alongside (auditd + sigma minimum) +3. CVES.md row added with patch status +4. NOTICE.md credits original researcher +5. ROADMAP.md updated + +Treat these as the SLA for any blue-team-facing deliverable. + +## When you find a new false positive + +File an issue at https://github.com/KaraZajac/IAMROOT/issues with: +- The exact ausearch line that fired +- The legitimate process that produced it +- Distro / kernel version + +Most false-positive fixes are a `-F` filter on the embedded rule — +small, mergeable. diff --git a/iamroot b/iamroot new file mode 100755 index 0000000000000000000000000000000000000000..bb95bc8efee52368863862a03594a30756e8a3cd GIT binary patch literal 141584 zcmeFadwdkd(l- zuo@MWBVMAS;_Zlv7y`mVAb_`nctcQ$sL(?|P!y0`-tV`1CK>j)=Xsys`+43!exG;G zk(sKluCA`GuCA`>namjIyDB~|&ai(ijLQu|$(L(PhEYIHG9 z05$>tWmu)r*W?zuz`iC~bVRe>9IHI~+S#JBueOA|vRIJ&Qz8c9IX1zq-rfE3( z`uGUzl+>8o9jT4ufa?{vL?yINw@ zTUT43l#&1CSo(~t^Tx1Dm zU$s=apX5PX8+7e3BR*h6D2uba17NC~96QZ(9yrbe-Z3_ifidVi$H4cFf!`B@|5VVoGfp=G zKjQ{JJ6=B@{W@DP$N%F3Nczes`s;x|%Q(f@VC{SCIDDVQKN3Yh!@^fZ;f;c^`Ti24 zB;P+}bZLQ6;vX}95}}gGc@riV`Hj4B6DN-`ii-36g+{^TqWnph^fHR_i;E{0gSL25 zUeR4fULj~lf{lOt#C&7?q)SGP8B;v6aPs7$(WCMv7zM@o`9@($e*OejEzTb`2G{(l z`FVv!M(L!Iaifa!jVTjLiVDZ)$dU~f=1&5TJpWxq`6EZ8GkHew#4+QGK|5-U zQCd=%pD)tq`|~GFAwB-j>Y#w~it|gxf_bwH{$l^+LTMFfHis%>CYSmRsCZQISWyQ$ z0Oo~kDykxSlRtI5CH16H=!G;v`6ucMMHqvUeAL5EC~ss5c=|_99EFi&TN6uk1BJR7 zHjM!UlSyOzlc_Z7wjghkzmU2HmKCOyOe!iKKgnNU6o8!{CD6vyQ6me+Pa0J?{_cFE z#41L|S-*(3VU$jsTslbvW&cs6Ed}bPn)0-;qw@0dVOa$wcTLJeyCONHK&PTQURr33 zpDcz~RO-(&rW9CB-Z^T#zX<#bfG#oeCQq7_pXWD)~>aio_O*M0Wd5JN| zmwn}ckv%WGxaqEEpQhXNUQM?bHxr~^+JtQ`@7;vExEXnIGpn8#_BKXl4;?%bW0ya6 zJdC+`=->g6Fn{Q%(S_{G*ol)TSwlZkll~#qs!Gg8a+7IPAY|EMfld1f!*O zXJee#q^2^>%UKrtK2B<#DF6O@J<4GJuT|5Xjd5Pty5?nLTmKuq_M>q|E8`NZF}8m^ zdHi@}l3E)X7H-xfParMO%DCEs=LmeFG0cMB6*$SrwcsZOZfQ)g;10s?1Y?Q?cN93$ z2w3nUp-(U#wBTxiTNsa9aA~LUCvrrp0P|<(OYC)Fua#GvYvsjk{6Y&~6@{N}<=YlS z;ma-j!YF)&g|CjnS6cW;6#o8`^}4k#3jd&m-w=hrw}YnN6otRb!q-RPXIXe-ldfm? zx9=Gi9EHyrr}4>A_(i8_d`c94u0@|3g@5KuP2V*NzrmtUi^3OL^nIf6N#ix2+$j7g zi+)@bzSzPSMd9l$K2xLcGcEc+6u#>ny4_h(_`TaKyNbd`Ed1OkeDV*PzA6fzQ?Kz0 zqVTCt>UI}K;WOrFe0>!DQA>Umg@3`q?~TIeTKzg0g}3!!e52d3?WEG8Pm0D{{Y{R- z=UVubD7>wQ)F`~Ihpth0TMubbcv}y-QTVs5{*H^n+j=O9!q;2`{Cr{9N znH7akv+W@YZ`k$_g}3!k6@|C;upkO=>tSIO-qu5X6h30xLlpi~+a99ueXM>RjKbS` zFg71=4*`olDGI;g2W`*EQTQqgpAv<)^^h8cxAo993UBKnEedbzAvX&Dm2D4E_<9Rp z6orpi{hAtuxAhQ+!W&FP;x{V_Uu5;SG76tz;pax-Z9P;);cY!Eh{D@?SQv%3^-v#$ zKe>yRQ$^v=wD5bQ@PT4Ye=rJf^D(yQa@#*dEc&Dwnbvu2J~h zdAhx{D16mFG(IN^pYe>w=SJZRtp1LR!vEdE7e(PW+^P9Yjl$b}0#W$nshWOP6uy!h zSNtlY@M*tj{K6=Fz>>c{3ct=C$0+>LRNe00DEwy@{$LdTCktd`m`u~%d>QQeWLJtE&7Zo{80;^8->5q!jFr>pKS3jio$2ytJ|F# zg}3~dl~MSrLmFQdh0n0)7ewK6U(oU_jKW8r)A)5!cw5d5QTR$r z5A{*_0hS(A6n?OU-y4PBG*h>GFbZ$;F}~B~wwrcMd7RBG@r^S z{K8{e4-2C38BDn2H||G$we@Mkfhhcy?KE9g6n>C}k3``!to=oO6y9s$jh~Kh_wUxe zATXoz><@A zJ}b9>b{>*=K0mjAc3zQqK2x`U5eJ`Q8_8?E?k}GQ=sR7QD3Qz*}2o!KXOz zJU3wfQXP2e)c$pK;MunQOLO3DTW47x2Ob;sreB5w-?|BF7+wdyjRT+Kz*|RIq;$9g zf0Bbf*MVma*#3=k;O(3S%ZeQMb~Z7tQyqBcbCG}pf3kyqmIKdo7xu5xf#)-J`#0Bt zKgCAkTIIl>>cB5>;8Ps%jAws{PAx;Q5Ts{tb8FFSL=k<~r~fIq>5g z_%sK;$bnCH;HNt9JstRf1AnmtKg)sVvpD-#>A?54k+{xv;4g9Ds~q@C9ry(fd>;pX zp#$I7fv|z+daY4|m|NbKr9w_#6j*oCD8ifcCG*fxp2<;yTrVAL76V z9QdIQ{4584m;+zwz~AV=&voE$a^R~R_~8!x0tfzP2Y#Uge~SZO?ZA(4;3E$Ftq%M; z2mUq(euD#ly92+;fgkC>*E{gJ4!m;UM>+6&9r)1>{6Pmk&w)3rxR)_Vz5}1+z!y01 z$qxKj2R_AtALqcQI`HEi_^uB89S(e&13$rm@8iH1I`A0|{6q)-|K0vS4gCLE1KzS- zN#2UYHE+ck-tve)zHx)MY;{s?QD)4B++`^d20^dTITNl$1_y)qjl1&Ft;e?27&t#=GMfF2;7q}wKTed&1mum_-7&BFwFZnJaKSVQw+Z9Dxu06EL?HW`@AO5$2Y{OcQt~VQwYNRDrh< z<`%+C7I-sZZXHZR;Eja2Wia<1W&b}UoJzP};8ldrBD_K18p7Nfm=S^BA$$(ug#y1u zm|Fp}O5hg=a|>Wr3j7pdhW=(i;71Anjc}2`4-)Q5I9K5N2zMi#BkR(-8Ou!VKBXy+>sH2{TkT>jl1&Fhg{6gTVa= zGc-3N0{0}$klb7-@cD!piknpepG}w{xLGN1C&CQ9&49q|2{Yt2iv(^(n4z|rD{wqv zhS+9~z=z%h%+T7*5coI345`gDfp-#SC~c++yp1qJXfs*h&4ihPF%5w?5@slE?maBy zPdI~cy}+voXA<5Za1CLG%w|O3cL)z4yinlR2s1=Bs|0?5FhgUrQsAcuGbAEzM+sHxp(^X&M4=B+O9K-211DKjB=$^#ZRV%+S%?AaD&~hKy!J;CBe; z5nd?pYlO!Tt`hhK!VDSBN`apu%uvw`2>d8vhKOd7zz-7U0%Yb2+zFZNf=a;upMKu3 zN9`~S6@;%dzkU-5udt`3X&AonGIs!8SxrEJHym^auta!6S?(nBkBCqmQVyztto|(u z?m*4NpI8(+<_k4u4)ay`+$r90+s}bZk9fl!H{eEnDO^1t^ZrEKub2Vp)kWwK+V=pP zxr|Gy+6@?_d_IqHIRfB&TSK*)6>hMqb$A+;s%iWzU>$2Pz5#XA_E7vB&i<=}1!Nm>& z1b7)7I_L}i>I?1khQ1H&QJ+BKvV)DT;4=`n?BKXNTZdL<=XIFli`&+?&0BG@x5C5u zzb?t#-o&Wbc9R!1PAMB7L$#2S?nNd28lv znYU+-tWDn-8tP6qOJRu!TfT=akPE{LJvg`Of;Cn_d{e;yUGRogkkC|czAktS1rXzo zugPgGnWd=7m;mJwSMVVcS4`tL_Rax;y3r~KI0`&0@K^;Wp@(*jZY*%?g7V2|7!s#Y zV)HGGJhb0E&U{JVT^MK1({~rdnUCnZi{ctx}aF-sTfaWCJk{k7Dj?#cU za4?5jKq5;90VtaWWxIkmLnDD{?jDB!9%2kva0MuM8|Mmsi$dNex`KWP=*4{!C?){S z&LpYjFbRZ-u3!aCeYMtQP}r8SMYQahqkI(u*eRr z@m6GXWgtAsi@DRiaf9e;aK*r+?25tY%W7Bf0fv3PXVV;#G99JpEqtp zW4$ljcHtLNaK@Loly50*38KtxxUcY>M3KV12SFMbc?RSe*muW3m+y$TtTxUpM88qJ z`&LYe6}Wi}d>R(x=3d^siJP&!nU9+xyqPz+VsNsEvKOL+BH4Kf_xs}ZHrAuT9w0!2 z&%imN!IlsO4gTvuV`D=YrR%;&b&{o#&)2x=#G6lXlfaubxY_$TZk9>^UBMEB0vNPw z!LEj;YmdVkP^$%)tmgHaqL38MVZCfHhV_0rHt_~Nl*@>eZAZ<^A&}VtHPNMoXwO^& zOF=v5kxQzhoq-LY&R{z$FzD#fY*5q0`olnIVjGFB@VvQz{q6V_OT)c?#|7Qqv>)|a zfV27((*eG+JETtE0`ln~N7F3;`$F4cJn0d*?;}#Xt-f^p6OeiwEI@xP=|kH|CB-1# zuZe$?OUIog9tYxv9xy77s=5PhqUy=Is<*o+2t6>c%$C^UEtT+*iQYs%?Lu*N>2} zVkkUUh37L}ScOVxwwA@kC@#3rUR$`oOW&Ox`s{XZXq&g}r@c8t2c}2T*JE;)L-mav zAAUa0`2Bc#l$|Af6Fc$J_n^Nc{PH9aau%J~SZ}Qxwbm8%zv2-y`m~dmZpXZ#z223- zT;W}Lu!T3S&imOhe+Mw|SPYUH>kC|6vJAtnzt45%p@63?+A>PJ5A&9JI)M_F@Uy=S zy7r*zL^Zl*VC}1gopsy-|D=hN9K>NXs1EFFYz%GU zDoM(8pc=lw%@E#vgqw4DvkEtVbmz@N-1OtkE6rod_#$&y=Fnk7LWjLGck#7U zH5dPcHv7V3+{qC2>X#@gJVavdlQNKR|A3xVBy51Ml{FZ~RRDoN+C@lrO0SlJN?i+l z4fj&oe^j(RiUEU3e9FR6u*fADD8%#%?bzpi9V;7`X;{*3S8z6N2Bz;Gn7+TDS=xe1 zU+941yHI6^<6Xfn&{x^v7Ovn4a)T8O%Y@;pnCcx|-ssO7Og$jTQqt%r2_~{U4Jq>{VL!lfGb)-ZZ!#r zGH4~v^ot2+7}tiT?MlurTNBsty2yvl=9nin+c)4`^B7!&)nCBF&0m^fj1bhf{XtOZ+KvwH`IC02yZCyIbdjPm{)MtcL5qv(+l#+ zsNRP0d@#D91MJ+b2D*im!+R+1AZI5Aju8@Wl&p z2JFH=$XC&O1McAs(zi6Uhtsk6!G-(!Hu(RRUD4xvt`QaY8tSIK;v9a2E|e9Tf_s4N zr|)(m3o6l$EBGV|MA0&*Dq)=7&<=Ih9&(vF(HnlleIF>WFinC4%L8N+fmvY|z{%W; zU`nm|1#4s|FWDQu1_rm;yOxVEY79t%Pf3rg9U!qf?CzUSKz(2rqw+Y{a}gLMn-kX{ z{kIV55kVDHLN5-5YI)~Gyyg2{b5b4 z$~bS?sy4p9EB)tWUDm4fm#m5#60-WW;n(xJtAf$PRScO3hO$C&C3utCj&iG*T`5*9SePh zYN4+ED1>&Gvk;zW_HLTmcC5vD${X6Lra?6b^OU~MoFpkt8BH<9`Qq@vDs(-_{glg49G>5iBzrZ;v z0|2wDp{*lsGt1B>?HBNf+nV{i7AKlj4tvfVn!ca@(^K-JVPLA3?Mha|brU@?gTj7y zQVk+k1AT|P6f02Uz?zM&QD?IE<-4c1L>QNp?r#rHWvi1dYY5PU)CA}+R0})&u`~~= z1}b?4w-D+bsT(Psp?!7OGas%K8r=+246Q+hTWbIbl{M-pWTt|Wp`fC4 zF+W$3N7IGv#~(_M74->ru33z~Y?h7W#QIv*?`lr2ht3C$x4Lu^-s8f{Wp!CSiVzl| zWmiz_^)O^3s}>-0mA7S6qV*iD_5QRGl$Q@7n{e+eh=2}u#YI(e=M=sb@kscBp+sB+ zrNF2WnJmwMG@+Fko_T`%9(DSVEeLa58$(F3atrVrhc{rKk`%!(-frP1UowT|pyILzN!?f|=9Y zQ}f5T%J<0{gwA8CanLXcn(ZS^>?4glRSkrveWZzfG;GlEAVgW-0fL0Krbi0OeAvFK zc4#cL6;|IBHwV5uZFkwv2?)40?|=+qO&fTJrVLewJIyCOQq~wZJ$s0^;`St{`~3Cj z8w4*UuT^3XWpcf12Yd7-u!wMsu!*K7tg! zih?Ap2NHR{yN;XBud+j*z~`%jrkF^O?^??m(0c*O)ek^p2TJ3pKz)@Cm4*`B>MqE^ zd8;i5d4V=CgWo|cb~FH_kod@2v7>rilo$I9riO|t+PLXkI<^FRu^ep)}dMavQP}_a><;p(bx$ZCOKHU1Iq>>)6#n6oj*BxXOmA*j4tFb1w_J9tNCwE*e49>88G>qX3xRwI6re!8ix zuxAL8g}R?D&`)bD*FhB&t{3X5?wVfgE$m5eqW`=-_NMJYA=4Cn;4IC_R1=_Nvm4bF zPW)^Qx&MN8zLmRyN$O*av-ySy6o9Y@o3cZ{5A){j0ns)P4N*I>y_1yVOcaOjjb~2E z@a8qDw>f-R2jP2e$*xFndqWub#NonuKvLP!xal3k!_e$KViVb1I@M9uS)0{B9`v&> zeM<$YCz1uaO6q>EE~W9oD|Gphn=+2Ij()R*DhE_*C^H$8P;#95u|7eBODH#1?ylS( zC3Cb>*j#zz^y`_eE#L3Y_Lg04gpT?%)wi6~FyyHP{t0@mYyq*n`N4k081B2-tl zeMae7uEnddqIVVN86XkYhvW}1$&7|~>3_mk#r2Pyej2*=^=j$bWq4HSkWt4oOLaE) zVGigm+r$9Qfgq?AL@jLq@u;Z1=PXdz{*eAHJM^jEGBN=2malgO%PC2>L$bX;j4hil z+@o)H=nFVI#E#9upu|5qzP>)wwYWp)K10ti{JS6wTFykv>VqDfo@;{<|8(xWGWXZD zEd3Zeq%}`qOLQSyVT$Ez*dR743xQPgV4MipOWzt?zP~ix7h-r2FJ0GZXH|0&YpqT? zKCf)|2fW9VcPsE#Gr+fDnU0%9rcV)z!#obSpx&i|&%6oq2|H%EZZXyL{YWN!i7dil zwEKK5n!+X;)}>z5lV;XDFs1`c4y~)l*{-a$-frtSZ~Cg@)36_a8>7GuA4WTp&Hblboj!zcnRN-B4OtztL$?_X zA2$!_uo`{>f{_@Rc*BJ-_%NHoUIsA(Bx!!MfT^#R!Q?`<7~h-GgTJq070)a@(}0#U zp=IW-up#dy>y+n76sXNai_<6pIq23C5%#>MYc18#w;FnrknRu@B(;^9n2?@pQBn3| z4A{@#O6_?D1IO6)bPW!rCYw)?6*J$u+cqelxFq2ktub^_im!6dX;$|RIgLey9 zt9lYFN4jsdqi3a8ptJsd>HDQS%vX(&ZfqrkDyjyFAZAKMu13TLBW~*-mwD@H5y%Cp zY8fGTPK88jBb-)q2Fspb_IwfbBU}ejNTLBxJS&~i8nT8x2@%}4qb_0Vtt)bp%Qw1$ z*CUYhhUd6b<2me0t`^OELti6PgevV><#JfIj@0`nkl61|Wz_0-C#!Q{wpg@gjbK4V zp*sgbL7cix#tTyr4Y`6>NEy}zhV(mCD!R_GtW#f!73_CCO;}m8foBihz^CLBs-ktZuEMN!BgLPr#HOJ zU4*uMpvi zJCm}@)}lZA{hhdGy^iLQ$lT%UJKx10K(} zjg8m}bunDQQ>pHX*-{Dm-GZlB7~Bf2f95RGs4YxkzVPp@SfmNdj&*X~e?Ug+_MbWP zFY;F7DzOY}vH2ja4zo|6#umXeSUDEHOeiz}}DHoyP zPUxUFoPdDwjO!8RdP7NTGm=J+Dj8Ro(T3B1C;f~iC!;Hb6CGE7z&f7i_~h*n+#l{g z*YbzHSEfdM31;dxENVfF{B4l9CV;_Mo=NR+SK+JB3iDOGAttAOfF?6Tbu^;AB!UX` zpdoELI8={jUqKto>Hj!!+JDE{@=I3efGk5;Q;@bsXZsE#F}$=+lg@r6_to*0CmcBerxzK~WN zq?eT?DC)~BJCfuoy96xLBl}k+xXQPI@%~luuJRLsE87<5D&GqX>|ex3Wm-S^8R`Lw zAD(Sl9J0)xdb@2#f2yxw4cEYJFskgntFv8Ktu8x=R(1iMzJ5W1|HO(`p_7)tPK^ce z{x+`n`?o3x^*;$YtM~0-GZp$TPq)!SuxNEwX7z8b~bo2rdmU%=JgU` z&(K6;R)>~mJW2{GGhOfd5{-gTo0i_PNIcaNG{L#y>#WcZa1ZH`m1c{5-j}jNe^80R zr7W8lTARMHY{$XSS7od4a4F$pUnn8H@1bJE%)Q!q<2K8|H4O7VYee+tmx}1c@K)%^ z+|}GjL}&+X!$Q!p>k@YMm`eV>u~AYu=3$tP%G@LxX$36mEe02@5fhBe0}zC9Le1&u zDT=?vgD~jl6P9g38Bmi@LoEX$Jz~BFhT7wN^ffHBzBHV#sNt|xI911HYOVxqBU04w|34tQR}M?>YW>Hc2{9jfaf5#+su z`sDiZBFZWeeqd#Hf> zEvxLoajYD$ToVc zdTZ24ME%LJVtxLTg52TBXz+Jlniw{&O%qz zuh6G$k>BaDy`T8?5Yn38RFs4Z&I_CHMgR;VYS0t;a?@6jzs#* zU6SQ)19n`|gETuBt8B|~AF73>)tO+xkzJ#{fMS^_9!c)p&mgapfUw_(IIazh;wH3* zTyHWD_as1vJeHGWU9ogRn9-keL|T-df$%W_5m`rukuWrh!44qBm<1(kL^Z1l)*-#@ z!)ET<1a6FJkxm$jTrjqDeSEOJ3?J^i*hyW=j9HGWo6nu=>NXUK=Wb8C1E}NbHs4(- z*Eif%a$V$JDA#4~2(AIoWDW%$oQ-_|PyAZq=2_fu;jKrpB<$EL1PEv!DOdI#8@oUG zC=a6WbkyyON!alQTtM0;4W#Ncx|Er#DRylo^!`65|6353^1pJwCI9!h`ESYp%6lUJ zJY1UOznT8;|APEHWmqq|{S(QIb0E5i9g{^gM$X~hCu;d*C~P_De^S&NSS@T} z|A+16czH|8qvRdGh^o}`j>f%hI>*a<1Y5}eOY#Oh4?{-U#{<|piG44ZJ=A~0zF&A( z?BfYs?0%@ejxJPk5yUZtreh^^G<*Wf2fk^a$yRKPFTBWo9|n3k6IeXJ@csrUL1!)p z)mbZ>-heZ^721fnMsi)Dt(hSt{AZCI8{-zB6*44)P$XGDH3HP3f%GG6HY=p;MNIn_ z=0AGRgE!BXN2y=EV`V~S?&2v5^$A2I>pQT2#YWW|`cb|1FABHDevXg$+yEtAajHdp z4pv%5NP590ne@?`n>RkwQ#S zU&B=*1$s^CS;sw*wAw4}her$vXh`fEd;B&y6w2p`+Rr`+1@L)Mn;DHvY?Q4|LC+ao z@lGc&*M7pv0SJfZGtA#LXD}siSN9e=ICIwmlzZ_+nCe9uO4ZBwxn_M$Jle%tftBGy zw8s?$!4(1*gge;?a^h4A5c51CK?L`Q+2^Ikp3VolA1VReT zr{Nqe_W;*oe{WEERtW`@)aoE)$nN`#zw_X}+lv{(z0q9utu8D53Fv*Iylg^c-k58R=vNO!DB22c8Xu`&&r9*80gA6#%v!H7A zIpwVI9GQ-s{SLCJ=xCs$%L6E+v!p)giE!?22i?#)q=z-1+VD5W2vyc4wBX*#k8>m{ z4jcLwfkUnQI|GN>`hT_p#@E0IlMt?8=4!SqhCu&FfahSGB3H^IjIiejwsC61AB~OS zoW`<4NAH9p@Kzkghgb9c51aglMZcBwRk7&5ma%2etn&)_uZuCK?-p~Oh3>=Mb!F)7PSz@n~Il2(p|A|L*JnB3p4`8E-<3oGaI?(|Sw{ z^f5}?QG6@etk(mK%AS9Mshebo17ig$J zLtQj9S3~VIv`RxQH1xZM{@8Cz+Q2(#0m9t?ac~lc@f{|!_BTKquRM1nx7~gYTolUo0_Klp4D-QvJ$cZg3PM4>-9Xs^ zz>=0{CG4E!$9sjlZun1)fswN|#qSCU8A;~Ip@o`MlxJ2$XF&RpT?p0T`52>LY>0gB zRBn9i-4BXYCxmCd(4VqRW&jmgekv5C&Z*P7`3UQWH5?1kW+rqqd<|z_MKTsOtov=$ zrnT4#<7Qy_ZYnAh5Aa>HUPQgjiWB(AerSym-~xY)*^EAr3t`tD$kU%f_n~ANT>BuI z9pDGur~s#q$ezdu0jQ@^kcr0G@>WZZbP?!kjsEp43`jSeB!b4F3|82H5-`c7>Ug?{ zKcJ~agt_Zbfg*X62!o^wSN?cE3s=_Q{ajp!TlWib?O@%n!_{rw@3ryZe-QUpi)76a z-h``qZZ+(gBeow9kBI!!Qu4ECiM>sM8vO&)*W(x=^88&ht5ZS9un7H8XR$V>O4-3w zSNTsUz!QlgAx__~DYKA8KU|B!Kmi}lT>I(YMQf5Vex5~pb6I0Py zwX8LeKn_Ut`;CdiJt`h`a5;>@b}T5IysJ5b9Lpu=r5eC?asC5rHOET0O+3$oi&DR0 z%GT+4K-%7+y+ykPq+l|?4is$jAzIcR^#Cpnk4u~-^zVb-A#2fUTh@nAkDXP+P(ym^ z!worQX-*zoOfROn?Z4nvx&f!=tU`t4g38d>>SirX@hi48eZUng;#jwh)XmU3yGT>E z!D0rv%>gKrlxO<-8rllm?E$`-6`kF<=Yz2iFlN9m#-;4=)vm`^l^s3>r}%=a{H^$` zG=ittQ(MY{lfET0)Y)x5%dAhcPt*Csf7Q~}JMxDMU>B<09yE_IyEC(fDX`-d$iuu! zXI|B#7)K-w%U_cT-0a-cH<+&4web;FlWQZZjL=q2*z3g2(QG*jFr5-RcF|MiO6}Qj z42M{kVD)4Lp`6bdM}`G5ryP;bMy-^;jit1Mf{g>mq&ScxupxLoHYJ))rx zHB<(uIv)JZ1hm)`U%&x&hU;Tu`^1$}trg7NybLi2T+dpx$38bt5Cr*c68hkgkpCQS z*`Y?SD+?cJh~UI@U7R%%r#6w4{wzf@K&5p&!(ASP0N@+;bcWff8N1kuS;C;DWVsAq zf2a|~??vq48vz=5TxI%5=F?;yHQA?4WW7KJ#eIOmZP=jB(^PxJ#64qS+uHAa3M#Wv z_YE)FqQhze29@$?E!_r4f+*X6W#T|J&IU+wq6#$JlJ!w1G(eQh6*8%Uf5H`E=UuDz zqE(5;20_ohiqz0%Fy8rs?lJQ4%;0{!lg%+X8Ttkz%c%-8fPCD)6G|bZ{=gvc=>u~p z;_~=h6LmI=@*ajD>OOM9@B#Zhh5}D87lK&IM^d?uigF=Ah)~dmUMDoghJGeA4iM;W z7D?4D8oH_qC7)`a7UX&<`4a1)$a0Dm_FRgEfeoH2o?>&Rbi=IG{*W)}YKM-5iHd`F(|_?cq-~L zR7dC@3o|;+_a)KLYUmzEd0VI9=PFlZjGY8}$K#yaRYxd`9T?1d*q(L384ln<^Z4_m zQN191MsT;Q{64Dg&b~&z~DkYnngc@ODHvoQ+Z_18)dhJ5TXv zx{<{ok@LAM7UyHp@O)F))5zkUVi}%`R|>ZvxHWuMP^m^B0>?VtL`!|9bq)#cd!1pMj3aK!P6@tJD zG>^~|y6;bO5n2y4-&NnHQqig!p(Su@2~Gh|J(XKf@N*%!c7b1Lwe4nOE?^<;tLPuv ze^7de_H}%7Q+7xnzm|PU`bO(Ljz8o;Dzl>tF!JhLG{+^b4FH6Id|;REkW zA7HAe&Kp8fbst8J61+&F0ub?OQ10>!fS6yMG2uchVbSPdUswojJ97!72!N@em!tPM zuLv%(T2H;5?@c1&kY=#ZAs){-1?wy$hwO?Ic=f7JmqD1agUS93u9!t&4Eq^x@&5r2 zfiN~$HPMD+)fBygE)#SO-&=OasD$n1Ea5T-Zqlwi2~y*%R!W~@D_28AS?jp#A>uSl zWjVrzz8wXrb;jim8S5SD7KnjZUR=rdQp|JKvmO`4OmlZt>!B>H!^K#3yCMmiY%Fh? zAeImTHIO|7iA*lh>U9dk#{zJrJ<``_F5#$H+qqC3pXg(#Qh^gyC8^eEUR2bJ{FM)l zk*6Af8&IpuFaR>*=~$YdP9W>%HDimxW|>ga2(|U zo02x71;U-0p{e08i=dq2PN0v0R&|s%jI#kJ7PWn?Rd=JqR9FD4*agixeSK(WX7yRX zrSDgN17D6m3`#mVR^Rkcx8r8TUL4p`zl+)yxvNlPNe2E2Au>Zh)V#&I%NK)`C&jzV zb&om+R~SiWT*LvI?;e##S_2^`zV&{EGjIboao!LPaLIL!J58>$-FwnZv5nrozDZ ziHwQ!cq|gj=URMx*%zMBfw4saCO?m<#$%z2H!59=Pew*dyH4a-y=80S)dE-(j}-ry z9jae42cD>g|G=P^*Btv0j&CYYlD!LSJ8m%wVvx|Vbw1cS?|2X>CO(q*Oko;MCn6kF zvoIvI5TgYO5qBUr<#%7f5J!?05bO$^9|jTT0S>#Q!v~`0SEA=QJmkKjA9%QewWy38 zc4x762=zIH!c2B8UWb4x{VQZfdLW~W35Gn0T8v|l&V-P930>6YyA*sR6-1AM2P=D+ zx2c5KJXyi3x4L9P-uR+%`NhmYJjxPeKC1KcMt2>RU($_xAUMmWq<}c4&>TtqG;O=q zkqAB>Zh2ozB^#b2&FH(o_eb8F|{! z96w8HXOH?4e5_s6Qt+)vOnOXj4bwM5db;`|xI&5)Krw&NlMg=IpDekUjO2FhVHnuw z(RXF=E{Au>!rbc4V!epeqB7=7Ux{N^Qt%%=ND-4N7JuW^uGW_2ZIJvBTAoWi_P}}Ij z%lPMcXC5{(3}ea}Iz93jPRv0VKEUj{4K9b94(89P6Pqx&4-AlGD?Jwk*Fs2Wt?_$nF@dA&+7xvMpfRXcPWt09DN@~XAjDKv z7JBu>ls)ePkVOb@KiebY=@)Ktq8>pP@DI zED9jq>VKeu-q-LPznAl(>`m?eC|KAt2s*O-AN1=OUm0|~q-5tKK--N6{T6`?GB|ge z0rc2v{ydWWz{aEZn|eQ5gVhG=S^)~449)`ezBfdkWzZnnm<<9g&pgspJKMhmx>iA; z&3nXHb-Q6t8S1D);`5sE*v*7JlOYb8%VAk}DHE+GV?52%0jnuL(i-rshp=aXGei^8S4V*W8tm~p6KfVqEhub&>1^?0v){!@c z3c*>Wny_D*#>xJUX|3@sARb*&UtuSU*KOH;aAWBvRQ&=*iH5?c+JFaRw9~i2O-&=> z9p`+sBC9^BI+Oc4j+2Ws;@&5j>C9J&3GI>Gs=D=`I#l3Blk+ewRJ%mZvs7nVKQ9g% z8_9-&*GeFn55t5IR3|;pR-eF%IGqNfx6&nS&)Bl%fRI0U9Te;opNhT(g>$`_`Z1oY zh8MZhz*cyxHK4NDmc9z7IQt=SimN$y$Dz=kqnykAY*`ekGmbp0(*=`UZ z9rgoSW6?Lb!aeFwos=C;^j{-O;!{|8A=72w=pK~4hEeT{vDWL1$^(q}pa%r^-{Q-mVw8c=o{T$gD4D-&eZd`qpnT^XF2Bb5hz`Y6WskXOH;&$ z&45U1=hvKBCgW#}vup8QG=GYg^$N6&%{`1#)?4uUjWpzYXrQP4@iZ;x=B^_3 z-B%PJM}qjwAW2PvwZOZU%WDUY2cYUbYh+xr=D`pcqe{#xo>@O5=wbz{)}sJ_OBfM6 zS9|*bL048{ir&kI0g_5Q6>p36PP`-wy$QYwE3|OVuJ>bx?2k?g|`{8}zzZpV_m$LDn zEf)ML;#-I})AXjszXm)MdNJ*pUaHwQ&_7}SwNXDeYJCe=K2mW2$nnOyjH3>BOmv$WZ#wi)nwGiLZ0F(KbO^!VJU+Bbf7yfica*%Tgg3?@^+H+WM0CpaoD9>|tt{Jed7_;0xd>%e9b&GN^&LAp;MtQ0yfF?ok)w z>R8O-A7JeE_a&N+Kgm9$M7PynxAnnnyRFmF7C8O{^>aU@uF-TIG~LoBx_zGu-7?T| zYqp5=kAnVmP5%>BfdeB=^tGCPHt5W;V#NUtiE5ZHeO{#LOPc5(1HIX@*+186y4j%9 zF-0<5gWeU5)2!3Mnxb@L6A98phM_8Sy`h?adK3SP$$tswi_9}>l^fa=JnO|!fHTf> zV%NgKor=5)o^L?67~CX(4|S>LX=t9?D{S3u-3XpTj+=uVHiTmP?SxtySn)A_FR%c& zH2>Mkd{H#;4qQ7l_G%NiN60M^++^s7z*J=Duf~neiPfXVk_;`ZoerA~W;6^ps4$FY z;6j~r#8q#t_(fHRiCED?ZmNzRo{3|uu*20Y!OhU&S%CBaZG|7_)?GAgIDuR{ZV3JC zjS)JuLl^BeUOzWc55YLNf-;T#D27R|po!qA1B6^GqB=mB56b4s-=mZ2db_gv+hK9* z!LNX}*$n_YD-_4!aFH>!CIfd^lW#&zgw;GU(FV6XUKe};*YYjX{n$yhn0|A5q~TnL zR+@dNH=KjbRwNNS^=TJ-LmOsJOGxE2pVIB2T8TB!(Gj701NhBcO+D(*r@&8I#oi0z(_SbkBP)B{A=%`&tbBKxL*>xPA$g;LCOQ@D=3}_ z*@jmDvW8bB9>teY4=-VY0e)W&31u#6Lw(?V5BMk!>Nky)2X-l|J;FSR46Er}(;Io8 z#vvchI~=u{f`|P<_wQs;k@(Ototp^&v~x5%4hXt$MVn;*Alaiz7GQ66-sn6@ixE>K zm{j9b$$v0WmLPSIxkrMGOHoa`IqYxH&21WHp0|||2;e&I`!|>8BEeAD6B(qvXuMZ@ zyl$co;sk&q!$KU}!EGUKha;k8{)wAE{&2exw*lO;)r)a2X*yg{#AT0b82Y#PDEa_d zb^%qh7ynR}O}tijHu&e&+sz^7C&92h8GqcZ0E@s$I5Wo7BKG(ANAg7wI|URH2c3Yc zp#oxak*OoNge-C=!>x$1W1fEb9Qus|#M7@RC|l<4fRcEbuBGV}%Onqs&$XR*V5_H!_Nby1jvlN{O%6W7Basb zYQ!?3s8c`=J!ZMjR1@I9=xDH^Wt`Xp?uu=#2PiS#ML{$g_W0gL18;qd?&Kvtjc-MH zD|+yQF|)n}o!%11&BR@|I&a@K)xaUT^X*l?=*`y*rdGh@IWR%j$AJx+`n3ugkS*Y! zaJu$$PRXZyhDJfy2txhtS5!Xb##bTD4=m-1BJ1nP&&pK&7TrNh7vE2@xRx)~jRo15 zBv@vnMzgiy#?)B0GtA zdLcwP;S+EtVr}9*pyZvoo$cWJ4|2Xh=Wo6St>kZB{t$ui50DrtwDUKQ0)(yn7x|lI z|I*|0SNWSh)XFtr{a5*$rIhn_bP6)>!998)%j`88b!h;_E3g7`@ZYDQ!8dk6Y(jV| z%?baZzr8m-DBbpv{$c12gKrgi63c+Q2RPX%7B8`qIDF!URU_=#I$cKfL^xGzQ9hG6&jZt(#0jz0h&IhT+4tYpqcce2;Iq%@9J6+F zMGfj36aZ?(9Csvf${>tdK2Q693KsUbAJ^` z&f-Y@b^hkiOwm*$B(w837i&?Dz>Xox#~{$6Y$45Y`I{+Fvsw+bW4(=ug%q^EV;8toUw1||= zg_v(|9pHTP-@_Pdt9lzrDnJuaP=~?SuCl$TKLh89p%#QDyI}NC$V+lKl&1O7TFR;B zpoUowC0l+~?VBs~%QXGDP4vv?nD2v7+cT=(%&PoAy!h3nx?WJ%>)2E;kM(A-Ub8dB z{>M5PjxVjGQqz+Y5AUbJ?LaV*iV#MJxd(t_xRb0rXp74Tze~uKs_4HCbI(V|?MT(1 zs$PeA(^s7XIkhcd|An@#44JAxxgE1U%rRts>{A{77GZdF`1=y5Y^J5JBR^Jn4;|3C z^EsEiD74*Q%K$gm&@Y;^HZI$l1PcNdw|CDXJ3qD(t+8kcu96?yjWKV|k9EQu6Bw`4 z>nQ&YmG>m{c^O7mkAoTj7~|Up)`9W8r^)p+tO4E0O>}nG7D17gQ{~rosmnAw9A5{G zS>gD-xMgd9Jb^1t%s#Z9#0<$VPv4Kv(BgUARXps6_l6< z0ez%EWSu6fA`rvAMKC_gJ(NYCk(iyZoVEDcZ&mw*aN_76&S`a~0ojyZg zl7x=&$ZZ>5RTtP8)}QiA#X3B1BYekAq))oJcvsWf+gNf*fnr3n0AAB@_q@D zTNxm|`d%S@^d)JsHT8`L3R-~gL;%lM8rlQhimdP_e2XuO6?@0)`ZwtMAAv^lI+lk~ zo1uC66yPi@C-{CL3_&e^O$%NJOu+NtHIU!mLsT>rqpn_A1)7aV9C@%}d?nwL^0G*{ z1PTOHtnK4<4ZWeEXEgM^h8`AGgZ5?AROytSj>VEbfLp_nPwPHS*tenq{S#v${Zm`8 z1Av{)=QIj?Izkb8d8mbq=ANeUMOnI5(rYaEiUmzUS@RvvS3C1xl;*hn*EncGEkIkG z^xPvjb6?R1tL&T?;?z_*(@X@=*Q2OP+NVHk zuNIV7oe1%)gcp;iP3+gIE|@*6BKC;yJ^zZD{1zAUTp8SiWc*d0%d1X>SXQ2kc_%qv zuHrE<$PAxgW}d6F&U2-SQ(>Mq=Jl7c{#`z0PoQ%wao#^07!wgum z%6?3!k>r{TYIW#Q8Q@yTfI)ohZjy1Kcwr^*IOwj%KQ1?&RW5Fr%NUL;)}QMI+@rE_ z#U#h%!w*J0b2Ud%`&W6RQ`U*cbThZ=X4=4g>SiuOGhmhgCX(Nppy_&Py0%SpCu_QI zF)B=;e1WUvw=UE437WpHN&Fup!uJi(9hcu~t?9p@%J7z?rng=@zkBB-Jp&cpqNc#7#t~X8dz465rgg@)b-q{AJGKxLk!e6v+gnH#!m%f9&Q89&`sFOsvGjufI@7 z{|AW)O!ri*dvUm?Syykok(vs4xCJv&kqo#<;Qzy1MN=ZAIY$wlzCg|*9$o*R%UOI( zJ3)kU)4%5|&U#o($Tj`4sGP+G%{hy+k+b*)b_>(rd#7!p)gRD?9rHITUop7U&R0D2 zkhI=(7K8bURsWD>qXbMGvG#w;SEOJnbK6)Cjp6+@da%3rbq_YpXMVS7#{z+p0y%w&wruqt0 z;54!leM|%!^HiDkT>oXKxLB{ulb2zx^UG7sGfJQDsDmi#dX|18(>MdqQ^MkBe3*)m z=0&Jj`@`;_LQ}tEFm*oSjpO*KYjnL1y58ke?0WkkBJvT(4u_7Vz^IXP_4)~mkl+g8~)Czrq7JhIt)Izk1mnpF+uL*oEC9s6Ikwf9-#X=R2&L&8mn7rDtq%Sa z0duh@HKhVhV0C6364X{0GaXx_RFQ|q`b+Xtz)fs;>I^wMkO>0VpnU3@nTsyW7$-BK zn+hYqdYEi~?7J(WQ`v+X1?xg3gtlr5Zt-?;X*y;dzi$nXI9(?l`u{Fa5elvck@kjd zWz+(~<@H%&7k6e)oWNR?JOd35nX4qFJ_$9lz$kPs`C%`Y-fv2PuOMy)TxJ6;6P=! z=LE&T{BJyAdkZqzSpxsLDh(Xyw-!8Ln*~B+G}~kuSU*&25ZRk_7YtbP59^~Jznu#z zn{(;Q$Up45L-G%9_%O8&7HRv#0+=fE4;>(i#)TyRkN{Zx;NchT{6i*MWB#Epu78n# zc=QFC9rNB}Cw8bG?}tJ!!9ZL2hg!hc7tTgyjPtqhwR##)0KNRdA8X%lJzeaDaksoI zzaL43Ha!mXLVhd%a1>&)wNh}G{Db5H|8xGqdj1E)#%rt)TFr$BI{#2X18B}aT*T5= zi|7f(HrP^Yw50P7w}TkpV*{5#(sdlo=U+GJ^sW{+Mh=4SJ1__FxtNJ(F9rm8q1GIi zRG2Wh)gj=(lg{>lf?E)P?3+k~@_Yo6Y}dfw`A6Q=;}BV1KWhUv>`CuWG}U@s)SW0* z#jGDGy$WS>3xz}d92udTQ3`$=pBJdRi0etvqvxS25->60k&gR2E7FEn^O*}i>SR!I zJ=zCibqcn)?9_4q0ng5U5X#C=EW<=oE#HAW?;LUFC!T`@Qy&)zPJ@C0Z3ZQJ)>=dT zwTC>arJJOoJ%D7`PIv-bA0Z{gl%eAsK@15FdKb15qN>TDPg_VNJVfg5O=%~ESK19CNfjKcwoq!oj z--rR%>GE2ATrIR+^5oW6J9zJ9j(5-xT)`6D&97>(D1}QEvm)_?`fwp?$(Jt(b>%;U z)GwHv*zBC2S)GKI@F$hTrQvAOspyH?d!Lk|tEZS zfy3f&f$x(CX0+^AdceCRE&&V;Bf%RU1U0S2w|A2Rhx*-l0uG&hR*aAL;FadS2TM&^ z&B?dtQz>KBOF@RNi%m0k^=Xee)b=$Tc;r{+ zs=x)QE4O@G7Y7`|nfM!Scyk0V(JxO$8NX|WV-Oub84tQdKWbsZ-Hc(zq3?LkhKi2w ze#ZsQTyYTOnS8q2m|2~{s`wjs@TgE$A280JGQN<97}9W$KlBM~f861R_U7xT@gG&R96n@o{56`$F%adV7 zs%VC0G7n^YeU4vCwoVXocJWo1l|o5VPD1k}p#7;!teTghX8QgWY?kvN%k}=gOmY7O zD{GT#+(hF&z#AZS0Xo6%v9o)abzzTqy%JZeXYn}xf!^w_7vMFVe!7f9FTH*ax{Wm{vt}Ao5)T{Ed}at-zt?TVzM%oGN0_tk8TJGKfICqgd)F zED73w=v)wUr;Ybuv+*GWxXB#(LmdbMK~5=?Nj?eWSOHIWJ(M67w8FDPo6^@qFb<^{ zZ>H>?B!q-y6;Km2mMPLwvs4O1?!$pfVQP;2YdC%F(Q>^XbYG1+q^63wQ|ixj=G6dT z2e*GC13^vl$7(*@yWY=o-vD{3efAG0pt5j#0!LjC#+%G5hoR(eyM+kAp*h4h|`Y7HM&!#jYTvqdy_D z?3cLGSNNTC{QZf8nB{A6X2li!2|X9xNbUnn@SO?KC|osG4m}>wLhdHrb@oH;Lwztx zg1x9gkUJB95Zo2~hp^I0ly+z18aRen5twiCSCvt*leHB zDy)WMsP=-DtCH~TehwhYXQ5mcN?Z-sz*SgsioWKU>CaMe$g!->anDAv_*#}c1wi{P zbT^kY7~d@SXw}wobnk&V^X3_3$+4WvTy|O;7 zT|sqNTD%!G(VP#};7~fE4GfTK%eJa{*8+Elvmo29Q9^k(C>x&fuEp~c*~A5*4rv@D zoiww?mqGHj#IfpPE$0#H2_L1`a>}`VfZYH#%*0JHZmiE^XnyMOozlP6y54ta8+vJY z!H(zE7F{m-4|{&G%I~wwq5F)cZ-TiYApY=#+JQP4EVuu3^|Y>@ui1~y74~KjaSLl^ zN?@&8-fgM=7zW8&kD#k$m`amhhB+l^$NVQW#lRA82#;~|qi~$NX>f)c<>g_%Espc; zu6A?WM<5TcDKG%q1w8`%4HpiID$yjD5WXW!^QYzU0V@6v`lsGH^o zGu7%TGQ6c7R-|5wf}dqB{(`r`Cu6i=nMope7QR25EUzAAp(e)t40MpA-4WMnay4s? zV#hWG++dtnfC~m`|424Z<2>^vK_usjMI-}av}D9y(;V?b-nHLrM0&} z*swySXsRDXZ=M^Ps3MvwM5=$N-%3S>rJ%}^ztR;HG5DJAlbSG>?M|dMHt)Zj@6*dW zm;=aO|7k_F^##b-?+uyo!SfTKr|*zzQ^PT{naAD>FOTjnMLTGu_(e=89)sI-lfdyX z3LS>^K}~rj9KM1Moqt7OyE+@?+#TX;H{b(|Y;~UmGc^|N(kT2s7}*rCd=^;#5re68 z$6e7_DS9OIzheuh#@f(%+=t(6Lm7mwv7ur@9zfu?{9zICA`P8B93?NlrZ?U1LYQ=X ztOVyv)OAo8y$WlXlLUc$o&Oqe8cyD84j*6U)ReN~m&D70& zut5*-Y31ydd;S-DZvtLbb@qK91Qe+ntV6BZcB@c=ax##B5R4K@Fp)4w0I?K9NKQy3 zlR4)=s1pcSQ^eU0KHA}__Nms+)&Z@G;?&kUwbs_wvDOo#bslPqe!u^{_TFcoB&dDg z@B6Ozy52@f&e?0a*S+p_&ui@>&3*<7*y&?uF@YH&gRRWG#Qv(~=t{MQpr`Zbsq|;M zdj0@>ThVcrF!m!S^IFQx62>{XUZb4sMp>XyUbaz|FiP9llNn`+Mp-O2{>98W{wT{e ziaMQ9%60MWKuct(yOHr~SQ73+vDHiJ-stmI2(oNp(i#S?`0nArGHs79QP5 z0ZhX(KhucQo=^WJr~Q3u|7F^1ZI-k0+VsFVaWT(3d2UY0X8hOowvx*zwoUNpLZh%9 zAjxfl_bHLtxQ_N*!lQkFw9D)P7ToRCcQQUN`DH&ygv&3Y9L_Jww{_yTc#G7nV>j}= zEN|0y=!tKe+_y_K;vLkyTs2>&ro3Q3<0;SX;TgN-4?N}D4(1YsWVY;g@dE0f0byir zI@LJGdOlMt$@Xt)R63ds+UJImp%jD~M$5YS8L{yNmjLun^xrO4;5$ zjCY;uCasmZqpv;1PIm6I#E_M12qsYnYMqtRKc*gMMwCfvXMZ&htBdzjzCu$teo=W={LNf%7>D${*7L z=UBcGp`)-sKjR$wZP@-6sjRjpsRwAHeJwpaQ_3^GGx5?)3*9&z9`QjyFPXbKY%$Jb z*MXT=;AoDnR$U2Vzmh4XP5%b`hZLU0O4(KBnYlDVf5^!nc-BSXN@xeHk=vlx0mmTc zgvRsn@i63|$jMVI=kK8#@rj;7z1am1(s>UsiO!crl=$AiN7ao_q`qYXV4||!{PRGW ze932Pu$;wv~$#wO=4aB8%_TO2@5YsV(sRcizM|h zx>SBsrx1)EBZ)NuqJnr&>afh;jND$yoD8r5*XZ#At|9+q<}RuT8#>B$FUYqz(yv_{ zDVxXo7itClroWFUx@x|NaonHlK-W47ef~VTnOQ21^czNW&s-eoR=yj{{y8pSDuCR7 zFq+~>ukm+?IMSpGjauveO9*};^IvTsb!wK5PUAcHuVeusl|O{c^Dyf7jS1@oQ+o+q z`fjj(+t6PO^H{Z6cYrs@R`0v~nP`mx4`+Zmyc+ZTyQoj96>-for&Z%ZuzXhCTZyxG z!~0%p?6k+u@YYSONcG!Rei0ofGY2Tlu&@F#Y!Hn&nROS?57;3cIXv(&vj(6P|F-HgXIR-ZS}UEEEvDgZN~j zPX@doH__NdJ8J-`^(vx3?fa=l?H{??MbyqrU+2cqp{sS}d57>PZ{w|0w@JUHndJjz zW*_wH@ECU92AR9;9%a3*Nh z)zhkCd7F?ZcxQeg=HUyK_ot=~+&a}3q5KLrwYLDq@aSSW+4J(5gIaBW{Z+dGy2;9a zS}@{yjM)FHEPu=NGbQ%p_0)Hfx2e`d{P04W^ncUEQ|W6f1w8$do}L@XbKYmg>l@w- zUOT+ur5TxNtiC3{UJ#3mJY&Gy{FjL`HoQAEeI&5NH2cjX#=4xalB!sB$)Zu!yFZlb zwu#dR*Q#yUK0}f$pu@~`2k!_szZv2Dp8KlJ@48d8OT$(dWe{Qo<}NPeu6@c@*Va(Gn}FDyp7_HJ-PrhOe-P zGkXZf8~!;p zeFN3`#Ru!7jQu2w!iO^IrlPF{9#82%BNrkO5*n8 zmZLHUFlPYa&1OzGPi0I?m|lB`yG=;J%17ZZRGP=A{;NP((iySvCP>)E7&eE}RWmGE z|J@XRtm`)n}1eS?X0{_ zMGCvOHe+b?cIDW8dAH|CKFV{@BKr2Kr#+N+_UmF- z@|ac+d$@YqeR&(6(SzZ*(q+?LZ{bJeZOw$=XO00Y(4!F4)a(#+FvHa1n-z*jzuj`{*nAo*z%x~d zz-8v~J@ZbZ=GEsT^nIDX*SXgV<1kYQNN{H^5-jktyp1c>=)Y+MBV8qoZz&&-p5++L z@yr#X-UkHrA97*lG*_)s)$CrJ`{t^q_^n6HP}^gah>aNP7n{!;dmV#szSQn31Y6d} z-@XC>&s=09?}Fw)XCtCM>mdF9^W8pEL_{{sf1QQHH*LJP}fYqOayGOOvJ?*w)L_YJMEX{X%6^xI^_U+df$2h+Z9JT(J8yQTbZ zRrF9wG3@e_R)U<(G`fB!svm>((hx7BG+L3>RFH8?d;~?AJDb#lU4V;&!rq&lxy`4- z{lT8eU2)5M;g@@4h70dpdE%sR-llz6v)%_Yr&}*IdSetX>~s_fqV_}o$vkv{5W3&A zZ6YCiy;#9}_GCOyM0q+-;g`Jmt|LYTae`I(wmR8NCsiB&nz!*!VAst|7mI+QQ?2{* zN8Gm!OcGtFcMfHbsE4OAMQpFk>;}W{zI+C*e^Knn>J3_(o!9qURw|?qe+2b%N9IB5 zu!dh}>V4m(mh5-K?K!ja<7+5v*^w5zkv2YI%K9sr{RQi9`Ep_A zpY=As?V@Y*7*)>}O3nT|pIWE=%kY$W)YZF!dd@vuRvXmop&kgRfMWY8UO8 zku*a1zJfT*2$eX8pJ#$t!~0aj$|SQgO^n}r7k-Mp&@$FMlZ z?iS=-dn&Q_b#?KYm6F8aN=LipdO}aRKi_?OfN!==wS3RquCmBr(3|`LT~=2Y-_AZ> z;64f9OXxK7a$cm+I#DCCBbmegc@F^kLsA3RqY1U+8K zeBm9VySdsypFLS884z&YF!BjpnCV|;^l-gVwcYzcMMn=az&|RY-7`lI zyQ_!O&tokXeh~6A`~yIT2>DF+ZThp{s$WXUtKG8aou5+<%*b1~uwF>`IVnu6UG42! zyDgKig8zV!@;ivojJ$-ZvDj|&?;Y7o?VDn;;rEU_ODRvgt)nze)sfXmd*yH0>$-U- z!*DLs9Xq_D_xE?aII?2f^9SYK@W{4jhF9$VdmOg=?ozSsub;@fzasB}irzieSLFR> z+q3&r^-f$@**o^jB)sf>}KJTQSzCQ&e3r6(*XQ94NU6zJ3UiRX$$6dCAnu;z#pt zctwq8ZQg^Hd;F-Xcw0s9<20!tjts8vm{qdJdJ3prT3O5(s(sh2%_F{CSu%p!4^`Lz z6^uabM`o3bxQGI37Xg*4{U}g(J zNQgcE8<2QAgJejY9Qad8%vka@_SbHRAyIK^@42GOZDWYPnIt3x%}2Ac@qy2Drb!^ z(db$J;NJg6ex$v_5lhRm0KX4xvTFf`R}kDT?q;tr)qA2n1=8{}btf?ZC(bvXLaE|{ zMO6wTDs7QU1oJYQ2ni!Qh>Z2`6Zjiyr!l*{jbzqghwXRz@n_w<_Q-EaK~?y#`sV(< zi}$&u=Alb#hTU6z)6LKS_2Bm7mfVhBP`&NN&(;>dSDp9chqy$ldRyk8>f(p^whgPV zdRzbJs*8C=9a=Ui9BGcffk&$Y@Y@A=sEh$Q9jsr!8OIMwx3-AjIH@V2)x z{ViGjFa$gE@QEK6T6GL?CyzXt@eCR`?$%Adq!!efCV(I>0@13quk5`qV!VjYv!3Ms z7$zRhRBU*9Snck27$#_af8YKf)Y&1j-|75$I*+`MYt-({bNvR?;VVEfj-gGb%Md3* zLp@8Vzm)N<<#6zmIVbowS>JksZ}ar+l;GRl$MWrqe8V#`nX6!(XJj)2SVy<0xIC!b zq^5S#-HKH`=$Sr&6^AEktBAia996sZGiPuy+#RY?q^+oDO9q9)v~nM)lQmbhvzE4A3_3+PfQG?V8Q=MmZClm))}4 z_o0aJ>=U2{-`ep|a`av5gc)~guOOeUG-?_|zlGrD7!wTz=U zKH-piDWzGUnTFsCEzZ(s))OUezP?&kQ&Q!i_;y_!< zj|Em|Qq70J^tQBdD|wVz!Kj8O7z>vpRjB33;V8Nwjj*)b3XIdN2H!y~bSN56)0*`= zRG7Eva%wuy>I`Rftpyzc^nX3lpx-sw@l*D&C73Tjd|>Ta0g1?&GRiH}+Y=8|OG3 z+|RJK{Rd|4_+BIst8)rN=(SafY-^w9xD+qUY+hiM~EB35)s%Fp5QqkE8J)$fyi{7ueD}qwQVgdJ$DV<7EB_S1O0~URdL6B z&DI)j)%Rc0(3ynygblwzLz`5KsJb7R{2LX;$BXZ{#nzguR?eohow@_=TP$BrPXLp- z2xJI=Z!o6tK~;aOqp6YUrnvuW4(h2qVE$)m?W(Dk)h`T?>r1G=OLi#pWBeVw#az4N z)UHPD6n~B{*z9Z97pwmx?i;fIH+KofR|4m{2Gs6B)RsXj!9VzAN~ir54@y;a+grSV-jyj5YLpnyXar4FfTmUI-CsyJB8eOqCbg z{;by);l8Z3yNCCFXZiCa>SV5*qqa-?#?jctc}bw-Fjg$Je+F(Uz5-N{_rJ4`ZXU)y znjG0jW3(L}WvtBHY!hGZRGe7d`)a5eTKEjzbevuRleh6YSQB=Ly@ITI!nWFJeR*e} zX3yR%zJvE%eG5+H-@CJsNxFM?zQQ25&KBd`JovUzBW$AQP|;}CLsDa2J=~9vZafosNH>_GsSRN7Z%$)z$XTx*rG4`{0@lFAbBqF$M*@!rV=Io7g)# z=rty@YBseoVssF2p>*?6f(BzHvo|nMO}FlTm1W`a0hulC!@-%2e9(cfzqkWmVd9d1 zflmyv0x^yN=*<1cGs5QbPx1f{Iqa$kfw~zlQRV|W(FBhSx-SU2AIAsF3!|a#y9FK^ z{tu#%X7{PkvN<;Ic`JoEi$7aJ`Z36-Pgjv$7%nx*wp_3;o6wU`8H?LaI`kJ=UThyv zS23J_FX$z$F#QQE+_Agmoqr?WopgJibTH=@=PhVHaWlJt#t%5>ctzF|{yKb=QTg$)*CRCK&3^I}Gw2TGfXjReP0#?S`) zCz%`6U^NY_ehc;c{)El|p2G8$q?YK=>Ep~N^8(Hp%$ZafSUinxwjL|Q2sE#)mj zw&)X`L-n14rt`j$^BQ$fp`~OTj>3gq2gk|Vcn`X^d@{56E36S#<#i4d9N|NV>?Zsi zAb1f==@{f&3~OoKG8K81CBB=?k&I1u=l&1f)N&-CtA@OWVVN#wsS0Cktglcgex)}K zA#O?p4+iG;j5NU7>9oq*biO*@ET}5GVMg!xGcFOZ9#>b|elUMn#%)zq+YWluo*Bw<-mfmK5 z6#PZEm8s>HqlQ;ccrSA<0MR7%-P$cPh6RPS6Yi{4Vm`blvr-j6y-;`>#9u3pR6BvS zm?^t+ue>iO^b`^-suhm@q-L1y?__ppuGAi-368m^^5CLa&4hR7fQ6DONbn5tr)LC; zxVPeyMSRJ8ndwk>My%qU?N0K|VYaUJ6INS!EPCOv42_=gG}(^Y2(`?4PaKkiTQjY} zaJuJEY;5aVS{VV|GE(iglq;hkGf!lBBZQdMAPmmTS1Vb7&5K0+|NMvQPre>9hAv(P zvRmjdX6H5BKK~;%a`yQQk^CF1ci&R=ZG6n{?T6ImfMD?*b9$fV1S%c>mnwgiZu@kR z%Z2W|*XHt#RAez_9!!pjZzNS^IB53y#y)^ZIR4KJ1C)!XZnEoAYy(pF0rgllK+Zco z1tK{WQt11&Q-+-~=(Rm%^iMQYquXt5z)c%5+_j~E{DUe8}>TP-@=}Jp; z&C3kF9rIWASjCAq#bV1x*4!)Ew@&Z4ec!+GM2U!-KF}4mOzDH#yvkQ~{$~``V)M34 zJi6jmk5AS2-mTK?`re|a5&gXQj@u!hSY|B9+0Z{M{Yu`CUd=1!SMOuJ_g3T`P!;3X zvY4I@`v|6ik~Z`=uX^`8t9O52-qs2DkMFL|I}X3!OT*GvR&OTdYueq(-Q8(* zZS3_x@5S_v^jHiw`9(m|P8@}RIUtZp#=8im*{iuO*(Z@3+EpL;87IbafXCVB?DRBIDvea}zKSe*t-CTIkV@I?|1LA~hj0xny-%iz-K?(rP$vHqy5n^<(Ar3*j8lL8ODKQ%KdEK7ewwxfZb6&# z*5MYsWF}?3&!L-Hjhm^Fxm|06@8SiwM(Kn4kBE?#?fZL143E(u#T5*hVT3M+uX}HF z>cw^M?U{PM0tqbs_YDn3`YAg_%XqvHL5uy6Zi33sfDG&d8toEG&1I`S!~P^1T00im za3`~8w!&5{~K*S3O%O$XZm z<%Mo0;$slzAxxuh7gw^MD|y?M?4}akaY^t0e1qN>MSvPD65LO{tA^mX&DDHZHCIGx zj?sSVhiz*GAAF*O2AELGueDRh@ghx>!WoqgheW?;@ha}MlFsI?$Yn_nFhnwd`i zoTPC}BjY};u9I}#|7-65k;mw(bgBG=(R2W@D}$n@_pdH)VOOneqEpm_-AJ4J^r-Zn z)ti^Wo9-S(0E_ca>$j@`&Umq^XmE`2jT!s8+W~Cd48DJHp}ZTahFSQl1eyX#8}*(g z9T`*JFQWUl7|*q(_d92zB;5;{V*vrGs)wrdb*6~S*EzmnZIv0QxRbvr(L7Dj)h`Yy zC`pxHGxTe|el6FpuDl5w$F2i<{nae=_uKy8pZI_8@c%yK|9#s3`>Oxfc*7+E&na-{ z9*v)#3(+^iKeaQi{ER?;C3B%b7OMu^JYT{kEHidH%1eJL$`nwz^@7c#ywsaV?Vfs7 zd@LOg6}dg>TDxfYJ@l}-{LI&cEZL-gc9hu;6vCPky|&;O03r&H1AsvG@plh~k7X7d zr6oOcHR|{%jAth&Ha&9I9vF{%^yGc>4lJgVG<<3mJ+9xb)pN24AD{*w77qS_Nd9#| z>nnrQjjtL1-FT5E>Y9e!rNZv5apjj#ZiZL?Hv_*q{2#p9dq;z28<;>m> zcq43I;b1goE^C8&WoDnuL){cKJ=5d}A#Y=?FY3{gX-RzR;^*}zz6uH2zxRc6HW!f6 zI7$aXHtMDggIL7)1|6`Y3HRJOb{#XaP>u^vW!{h7xP=vch<{wgX2(V`-Ta5sU!&C{(X&*>e5Zbt8e-jl`Ik3vh!OjF&l*+PA%IpuCg09AMd0=iYS;NZrD2 z-cu00W-&xN(k4A>%YL_^slwF%#h{sYLcp%4QQpRT`OS?**e7E%zeYf^CC0vU=UHfD zd7FN1z<{IuvfUbAx||M)r8E)(2-!16+(5{ACz| znH@A%KEjwo@-}W@B}iIew~*mpRt{zLWV99R^Fn3NTf* zW~zG|V7&j)D!x#0>u@^F%%(b9Qgm3^`*cLPbo&YbCJ2Dy2mtr3r`=2d=)VX1W6#}H zJ{4dC0H0R*VU&w6_cL0>t&m5o|LgFH%;qC`?k}d%8hF(CC!0_CFJCh3Jb5;MEGBlH z5aO?*P&BGmp00)-!l1%&)Y`{A26bGCVTZGGTloKjo1bhi~Ma zIr8t%vWcs?&4YrQRre7i*XF#oZF)=&#_40b{Eafijy~toC zd^Wm3H1pr)LY+7i{cb$XwRuw(LPIq)gfLYnl`kfvH3 zQ9JFh^xvA-pEfG#rJpqOT`tyPQz%BqrnaxzK+nZb^gqYH7Xti9e{vWqa@j}pdoFX6 zN^>E&z=|7#Z}!Y1<(J)!oxbm$XYw8iC0d>U9x{7i-4Y|4;pE}@w1By6*j{9+6yxc6 z`XzZ2Jyz@dK23b`O2iEtd>!!jKjho{hk+{?PG{bxUOEx^j>$Y#YOHb7=a~X@GoP=l zQw^PLMT-jeZ{}A0Z z$5!{iChcZ@aAob0nMRBC&xyNga^{Tw9?)!hB6YhhcHh6K5a2f$|I&=j{P%#$%+Jx% zY%V{GhsKMaJP#S}>O$9khigBJI?_O;MX*@HN(mLVR!6Y% zA`LTh0J?7+H3q^n!XJ9_OpW>WWDxyCdJ+Tmzu?2P%)zu&<&RNr&hAwjY|DOsK9DWY zEd0^pW?Jy<=TI|idxV4VDq83v73IF(jn8W-q54;>`s5N zg{{xg&A|Pt1ic>|Y8|cOj~zQ-|B{lHGf#^i*?-*9p?yk{z)93VcljcJ`p4ORmkWo5IlHs~Hc{NZjcVNUF34IKD`@1ovI5$<6Aq{Y7b zX#Gpx7-0Mjlp^gyp|!kC9sFi%?J_2_vDiKTB~PT8{q6$6@Ip3pV)ESrAvZg)NL`?= zR62l0gWAQXlQR#II3um;y0IS5GG7p&Qg?9Vv+6ArTV*?Ygj~%`a~0e}Q;OzLN0sSe zS1KGp1)s^O56Q6oCQ&7W11=CLFJx8}xf!sMF<;KSl9}T_d?fquoy=7K;V*-S;*N*; z55I3ja)rGl&=Q!QF|bEK555Za6gQz5zI6B5<1QZcLr>^>FY_1crKd|h9>Qn1)U|~< z@*dT}8^!eWR{KIQNmie}fB&rX!EfXI<%Hz=?OLg&Bqv~g+O3|lPu$a+*kd0AO3q!k zOD)ONFu?7oma)t+`UKAL|LD_jeL6zJXY~!A8Z7!Y)!qb=xdx3}>>cxm`??Xd3N5)% z+FrwKAvSEE>RU<|S_I+CXX|msD?uyd(0<;zT?{H)mFRIEy%0AuN-1Q0+~pq6gA03S zw;~Z+<;Is|?}f|`)z~H*(j3^Q$v?yaF~ViLK%R>CN#Nw&P&dp1g3~C{JtG^(@nPd5 zoX`Uu0ZXlTj*+)aew~#9xDtA{lPBEG% zm>S9tXXnw|AD^ZEWIzkLwEAyAq^GR~LV#ehn*f!`&H}x5?Z$-`h&;u~oyu&V0&L?W z>7NG8_jApg&$i~f(Y*gM<4;2BXeu+$*PdaXbATb3=S{-PCp6CtRO04Iz57*fex%;l z*HP~|@ZXnWdBS?%QN4Jip7nQ&>U}DlpT-|$i@N8js{e&Z{m0esX4Tib7jLE(L1jUb zCGQL2?|*z8{+=q=@^PgQirQWD@t>dnVBkL(_zwpDgMt5G;6E7n4+j2&f&XCOKN$Fb z9|ObW2f(9HwP3-#1+m48YUfrhs5rK^Dps{*e(k)Ph4r&4YHDNi7gWuhH@DJ#2}EX+~aY-*8=T~e3_T-Sk=+Frh}fEJG%&Ay#QfyYmoSNE`Vlx+4#pYJbsfxMU zt}>q|C#^-?{lt=u4IQzz)?_Nylt?8SQ}J#M6>~txTH~5Utf4X0x;hc-=!_>@5^Zg< zQ<9w>`qtRl*4Z8Np^Z`06=t(rP6p2P4ixwsmsg>QG>8>QOb*zn+ShL1-cXy&A6-#$Cc6Kzkb|ji& zMc%lyR~)UGZf&Y>Z|I6XTIoNktXZ(|BoRowq9R_mu;RF?cyVlqhm)d>0W$_%qK(!j z(T4wxPVHM`ce*3i*wWqEo`^NIcBj@hH?+3#ptX(i6>Ga1l1Z7TEC@#{ zNTx)}wKa3A>gUaxRUTVhGjn0hoO(Sdk9l5ack9YljnD?p4CrvuR!5Dpc&LxGjyzph zvEaC>g;qaSm`-*VCRem}6m~!m^c`#MSlzj*wPU3>KAHC7U}=1;vn$czMJ8kecPF~q z8X6PrEMuAHjaR)8mYA)o_6}RYYf3Z<+$PtL&Cq%n*Vfh)ThY+Cs;RTHJKows2?QE; zQeQI{mQX)uUS(A**|0iMZ!Ntw-K{A%b&*|Lmvz7|nje0Z)>Gb`jZXn$r0XlzR~ zbfh6CO<6N$$0rjp`rzbJ*^jKY8bvd$SYGIab z4INF%ve-#gb@j(CsH&Jr_KG&%nBPgqSOZ?BEGZp=1L5cLnS* zruT)%y1HA%qgO-rwsFLCTASB;qAKgk`tE3G&leF*DCk;KufAZ}=~!38%7kYKqf6SQ zpdz>IUNUWsZ3Bh-C%&?=9ZqG~WZ*KdH_2xECEHss1gceY0OptYMSSz`7#-J-gx1#Gbn zVQo=OrR^K914&ZqHMTS`cz|ewH>}YL=ZAS%mFZqb0%lSgOD0?5ZJmv)I@77_9?On6 zf5E(CtLp2j<}QSJ)C$@-%zFiUCxp?hM_A&uuY%{dJ8}u1##SY|MG;O0^u*Ytooh6= zs<|~)l`(cwlec<`mu~7pYBa8PfLG41ubMlvVm>AI0EW*ebvL;D=QcUN(4HFxHH#>!63MP94!5zj?Cg%tn4Scb*S6NS zmoG7_$DwgmUscCjX%y=FGK{if(cTaa$WBsbcS{p{| z1ixS($CA)(B9#v?3zjUHKhrIS;U;+Gm5p;d-1_hkAyODxJ76Vd}cRM-`=+2rqH+HY>N-=}B=2Rk?@=!w^iy0^yBj1-66%-UtUIsTCKdzv73PQ4B zh4yQzvn)2dzQW75E$x*S6ilYhp=D)NlQc!TD zS`@h!$9g+!F>@y+Sw;aI5k|!rIp1am?8>wNr_mTXY+VAHvBGi5fdx6+B+|fC0TVdk zayyE!4p13Umty|H4@GH1s7~=@+Si_p?Hlv9-Xa=7d&A1sMz6g!iDuH+5(pw&M5`LA z2FY{;2X%|;=aYRAQ%8t8H%EyUZf^8ivKtX82%i=+Z|JZxF|n9I(*=85I<9G12#|en z)D!A-rBh8ibOV^0<3y0vHK}Kx8roL2HrF>WF0!_?z>`t|@dtu3R##J58$26I_BgtwCJRLFt;_`ozNbtlMIwHFIGI7y^%&dYHAKH9}60~3t1Ey zUAC5Ql1cYtW3@MQua((FcPK@Ufv!MxTqV;5)zJn@u1z+k+Pp4VPmnsQjVtL+w0Eu+ zI|6iRDxi}G49Q0xHK8a7szi^>pmc{Z@c=lf@b%5z4J#cRl39iIHEBw`v}7`RNn>Xh z#fU(DwYRpdbvnOmApRY#KWS>|fZ|AVBxP)I#e$lOxeK#Tv#m>tOG}EK?(3AM*b-mq zY>CC4@zmCppG0*sHKtySJZL>BUNp7z$XHFqoCWjdEkvX)TyPRLa#f`i{kp1!7@VtC zV3A^O7WIs4>p2u-a;^xlxfyB89)f3fuSK!rqd)zUcv0!(sWJ4Mcz3gB>XUEu#k* z`?b~k>O{W7#)RyY8P2AU7S_;aJ4+A@coaM_E6YddfGYk|e}#(Ur9~yBu^^WVLnOQX zBzR)Tw0S3@dWAKDwJnVo7fqewY|qYQygPx(gNaj9S)N{z?ntHigxNQ{D)qD$}Ko__acs3ZZ2(u>fSJ%+@x_L)ouO*IlU1)H94c3CegKGH;s!mu`v!JRD zxSd04f{hE>y4cnElEv`6ga4h$vd zM>JUFor~7c=Tr;2MtdSDDjGd{UYGV!(h-P5bZ&!&bgBhK<4evXBY&y38c+r+1$8GJ zW}GpQ+Z+Sg5#B^L5GL^IhNKMo&|6?q9g1b+N0eWuEF|4j0}o`hW9v2tf{7kVQ5P)T zTOq5qvtvBJrQo2Xm;=)gA}40FAAN4etpfI8dd`*Mp=P7)+h+CZYO3ZG&a4R`G4E%z zho)BNKB|~oSL3Dl!FTb-GPVP9Cg63=54g$%{PnyvgCFN~Rkd5$K5~S{Hj}iX^(bS^1GlzV46F%{Lzd}fIfH93E_vFa+Vz2_8vz-7 zbl!LO?Tmo&`*I=yi#auoa|B;%AUD)a$VXKVGI9f(NGb3Z!r0<*F{px^dRg)fI}P{@ zjkH77;F`q|D5XS3m$$N^wF9(yp1JSE+8R5%yVDd#=@z;ayUeP!1=gm*-$ZaaVO?rz zXGh!G0`!y*zOp$(WqYuA1{$m(jQBNWP28ObD$>P%rRoOBriJW|$bp0ardQJ&~P` z%uOU)%+IIZ2e)G|@F98Eoq(Gp8if|w$lmJK22VcqLg!P5`Z~=bQZKPs=m_@#le@OF zxfy?@`Qk#qt%sYrL&Dias@&tAd3P}Y?8jpqw1{?diF<3%K5{!E?Bl!LlM~cHtTVc_ z5m$y(m+_%5v8=3!{|X8U$_mR&w?olx8BcqVVyV zy=wtoa={``P#re?8wKetP2(peEbiO}fx`!?qH@R$!G!A>$4<+O* zOz3Ehv{Ut1WcA9N2KnLZ7pX6`4yn-D4VPz;CzwbJ*AIFOBNRv``Am<-2BDsf8~9;7 zhr77B1UzZG&cwC(K6}o^4yFM_L=W@k#w%;;X6N7mhC@UPmlPWku3*H9*8suQ?@%xFN=i zA3LwU#vdGa5|zo{=OL@|=U2?}I?}kFS9w|#!W^}pY~ql`vD+OC9m&{D;Yf`F4m z5#kv|9h03c3~u0;lJj_A^pi}ZdBxdx=$M6Y6Lg#ds$(T8)X{r9bMRz zSY0U0nc*IbVSfDY{TMXN1UzOj^i%Q<946PZ9GS-e3sxd7?DJT_|ysLjC+Jan($b6uA*L-H39hv zbc~QKxq5XbIGuUboj3*aGwGdKSU~f_Kto29;;)9{NC99S)IqVrSd8O&hm}jDV?UrsY?zt~yE)W)HIhzjXlX%;60!n_$BxuQFD3HJi57Y* z5;y{^p*Iit*uADTiI1J}u$v-gLMY9=d?$IN#RcqM#Ls$Yxe*fL6SnC7g3EGntY`%? zWR-|xf(9HS;Ik4B7CwA~R`$0NH-dUD%+X0?V#r#t*i7-LS>WHx4;_Byf@7gjQbH5o zC*uLpEiXTCotZv?`*TV`@uZ3ReWd-?ok;eBF_r8)8j4OL_^M< zw=km02jhwg`J^3X2@u#vCfhK0esnv90MX!!{W_OqJ;)vpt*f19kh4mymT$HKuEf1 zAaSC#hww#bJ65^ZFl9>Visll?q#Lb;3Z2GtyAb9Ma*SZ&#O)DhGD#SL+t}${p(EVa zq;2S|((d6`shLHL(&7|F+xe|-S2wL$q6VZSbf z-Q1cWHV{FiBI$~Ep)Z=+WFfAA9An0laQwA&w4R!VxIbKYw0b%@UH~Di_yR&YQb%E|CDjB9XKbo!1}8&Wsvf?|0Fm>l!8t)(USO<&pmw)8dM8Sy8MtAry9)8m9` zYfCE+2Q`o&7wSWIuo0s5WYCfT5ZE5l-Ujt+yUKB22M@f)4Ls2lC@9K(4e7;_k3t?- zAIVHI1;n`-V!oe3!l2$o{gswgZ`|HxYWZ;G_B)VEE|r&B|#bZ z*2te_t{{o(bH~k`6S8e1az6vu0gxl-Ldy})Vv@uVB%J(XT5<9FojN1vD$3!Nea)Ly?3&bCzaG&IwJigr$wN$j3qK(oWPzYL^5<+8xsaJFuS}7meR&e>_ z9Wlf<2s%-Xy3H@>op)|BA zf4&j9s%V^+f)Eo@8N-BmI3H3r;-i>i6TWf>N0u0^A?qIxbYd)bCBVkXM>MvP^qNZ>Cl@s+jUh2*2n$aQi55uBu!X{1Zc*(3H_MId66VG*20<7p z;rz+=pSPgOP2a|+Fq`p7Vy18JhQf(QIaOSH>6b7p)@qOmYr6@*^ni9z12{)Zg`b6e zXbJrND&>w9@^`42ApvMKmrItlXMg!}kl~b$sSM+6q|IR`nK-q+rM28Q&U4}Nr#XGl z!jl%$#32t&a`BXUn{<6$b3-pcQdjv&tOgQMpp4R9DCVZ&#ee)GTt9 z-7M@$B?vSjTaH+z(yqK&q+NOWHS=j6kdpJi3~iT&G9lRVMw2j_!Io+$Z$&*p-%|$D zX}EhLzG^`zpPE-zR_t&)t|>4}nwqq4P%UMhbz9F<>RUS$LQb}RDM94W*~!f4-!)YX zF%fzB5ptFhvSJqch@8ieem^v>KCT$``G+s^l%4&tq$zri9VCjh8<-~SmVa=)LAlkg z;^6+|c8KO$4_S}t4=ts0wL`;4h!k05LC(M*VA5|dCoO9uk62|lEeLP{5tv>{M zCEo@MiO9al57_qr(V%I^b^_>-?!!b6+=R)O(r!rkV4FBcjS1I&fOv@60LD$_mds{9 z6vCP;&CFC%d?fw}NosWjqI;qx%b^X(rAZEWR&e@<6V{M{C!N5uTosv-rWmz2joFxI zE?`%f&xQ{+ttI~WseBP}VzDyk|MIQWq*;v?j*t1y#xiKgKhl`>Et*!c{3D%(%LPD` zUw<5-kz0ST5XddJqaQiUKU%(1rVm_EzW=|>^au5`6Q<9K?u_S0=vw?fAnlM>4`B6! zqEUky{5#AY_@hkS5BrI@(6`Jd8DX>nPuX=UUeLqon-E46|Hw3Q+>;?QC($KP+wqXL zBpO%6?Vv_r-;n=-Xe=!>`8e>H&~zKr*N|OqRyxJOQyg?a)2=uNTtmT;Kn->*wZJE1muuY-+f*WHLx)0r z+2ku<9vKKZ&wXvzIn{yNw^8LF#-_25jIwzhScc*#f&j0;bMiyb`tvZ0!Z6SYy1<0F zdHoog!~u~TV!%Vo!O|#G3ha@P7yd8GLEivB!iaw0(q*OL#9#)p`Osp+NUQU_Lc{v` zSoUOO%48eM*p>I++M}rriW}y5^#dn>x%JyQ5{$`=sTPJ7v(yWW#+z}?o4H-k#G43E zD|A$e*o|jL*EnH0bJ2pDg(ua|t~x2qt{b8r-hpi0+N#A>wN^W_;qq-a4iJU|Po3%1 zJ5e8PVrRb9#aDFpBuKaK2EPOpA;pjB`}DTx}eLlh? zf?19-XeeaCgy_2xut5LJaHzv65!X5K=p!-?(+o~^l{sdSowo&D;V6Q^aN-Y-{uZ$p z;}LVwxmzQ7R1Tvg9Oa@^)=`*V73zaoD{*%HX%!QXojCK1z}+g!V^sVw(o`a+{63DF z5Uu}VVm?RCL%p0U-KlBj4h~B99l|z?>I*?XIi_NV%>O|9`Uqo@`9}7y_GGR=jS79v zoDCBCv>z<5awLe)TO*dvM1PEcj1V9qv_K!t-P0_M9nHjQGj6pLx!|}#c$QY2f>Z5l zLsAVl@L&lMv6BYRKUblETthV?;PdYG7I;uuZtOM7rSn79OmnR}5pOIdEGA=6%rIc$ z(FBp8W+XQ5c8Dtw#*}V{qHj8TfFFW!c8WMSw_`bCSTTdA7E#Zv<4CSwaH6xG)KbOd z(jM^`Uky{Lru`6e)Kv@7bVRUa!C1NN%-if6XyjFK-ai^4qKC%j`qFGTaw%1p`Od&d zE(T$UwzeJ{&jo2*Hg!-@v&!-qGb+P)bPyMJ(8^z{khXltgsB^yM&rjy)QvzP|5(Yt zDLNu70b6jFmAD?V@d;HAPYrU(h#>H7v+VR+JCvR0`yA8*p*v%D^4O*n-8bziAK9EJ zFB->TbxT>F5R<0lt6fkVr^bMgdC$}Vx>}Al*O0AJFjUZ>UqGn z&UbV%LDFfQ?;mg_KHqcYI&n)Do}K-bi=vqvL4{EB%^~Xd;e(Ss6v>LZzMvrOE;+hM zTFmL0MxmXqo}EXP!5kT}5riJMY*_-eq3~lFaz%Tl^yDsIW4F?+lM{0&%oGTm@hiGJ zS8P1kN z)*xzxYU}uHB`&ry(K|&)0Z|CW1wvdn_l_M$YY6kOjSX29HfxOe2W7>^w=y=sJ1ygV|8Mu zCv6}E#*c1gQK;qO=it-G*`H(14z>l1VnY~EcnfGl4ES;|LY_|jfXiXA*ttAZ8Q-UN zIwXipOks8GEJc60Bb(@c^nrFFC!$w`X9(0JLIz=d`7$8ytZ0De`He!$l=ARG5toK! zw;q`&D45jj(&rRNXz*GfU~Lr?CE~`CF?Qev#j`PWj1P8<{#-hZOCU3v7|>(>I6C&` zbao{RozAAVp+R9oDBgf?1&6k;_{l15A~CCTt%Ml$LwVsG1W_KIZNe>B&fX2J`78s3 zxbaKb?Y|8 z@=XWOC#Ju62B{d6~PVA6N$;l8m zGdrH`qWn#RJpxJVN*|{hsOOX+RGU^Q1B?QBQRj8Sw4>;54!@R71n>G6Ua|hBKBW7Z@ z+=6}+)i~#Bk_kxiP$hP%QJA`)EEs(l4YGG4aO>dE?k(|2-IZdxE=_W3`B8xg`Vlg8 z)kF%bX}nIyVhIX#Sph!-Jz?Qu27Rz&lLcBkhf%jsBIM8sOy01zPk_WStEgR-WOcbx zWF!q8{6@hUvw5L20LCZ$Z3PwBa>*Fy^d~94n6x>SW<&zbu zOM5d+O2h`Vk(_Kv}GDvcAwE|aq!2tQ}YdsOh=yo~$ z*O!iFW9g_8ItOQ)I)lwFM(l2a0Y=UhV01~87D`W6A3=M?K}=oonFQG&oNaG%-g$>I z)1|2Ia^Kt)B+COhK7{`YgvfEL2y=CgzmU1Aubne$=e-Me2^k&SsDP8vLGbUib6FlA z+Aj1KI)`GHj&-?EfTRP1>b{1?0asWNf8^#`WRhto<)k#MyPsBWq=3>Y5%?*8lSMi9!@-07tJ{JXX*onm)#Y$;K*h-v) z9g|XOK@3O5?s7imKZ=HVjc+vf?867NWDCni@!fuC3?XV=9;k95-KtF|pU%%MBG}f9 z&=9c)DTbjNU*nf%qrefGa{@g&;ni{pef0Ql-6N@@?i>T@X&o!MEmNk<5cACLi)1Tj zR6ADsjMB!-o#^1MB_t7`;hqZ>A;nVy2Dp>G<>o1GNR&>L)}eI&*t5M?+1bj1sp#bJ zDA83(3LRCo+AryA@*bN zUVg6EEEr?yF(1;u@1kY7oq9Pq?=}G0G9zsL2f&+M2O~nu-w$W%a=5JRbg8X4CjI&0 z8#23yd;7wqXhZWr{AT+{n0>JjteL56IAlK63U~AbGfN zEZM;6c`=S`Zic_V#J!n^uTUD*58Q7Y>ke<4ZsI}@+cDCY{o2$YK-a;En2Q|)gzMPpAbL;0+aVtKeiM;jJ4shF=YS0Di!rVYq zm}&x-^d!S(50YM!?XG};b#ru#2b^OpnuNQCkCO`~O?IESRDet5p=Wrhe@iFVHJOsL z(;Gh(9ct?V2}8HTkESaFU61v3C)Lg5vPfc1Ub2lPh{Rwxrr4HB#&x?vLC=H&Zyt=R zTLBSK$cK&2IYnCn(Oneo&IO?8BUOAyeXuqc-k$KU03ggA0Xtn@L1gy>&-2!utnB9&^w~@u=>7G(&mW7|8@Nz)9mc9 z6FUlT$0L0@jv#H)SM%JG4y2=ikK?S+34c3vfXbrNPAr!xDa2?{x{?8(9iq<^RpC^j-+6eVB#k#APrF8&l%4jw0ahn`vR){R2}8f|ww zK3Go0u_wjEqY^N@+|hL#GrB;vY$l<)g^06<`$3efgh}#5QJi^)fC$EQZsWiaq=gsD zBvDSK9~@Fw@kECZ#KyL_4@_q>ScKCZ`^(y-7A6iT%H{`O3N9EnkFtOm@|xq|W@4vX zXukyQ+{;8q9glIiYd!cvY8vTi{;7YM-*sC)sx6O;hcUc?WAdRbk= z>F$2j>>bNEr#N^tsDHm+aMwYgYf7>Q+tv1KFpgh8s3(OJvO*S3DwfG*%i(Lm*=_9i zBzg?`8E`>M9;&{Cjdp)z9NC2vd!UR@H$22_iXRgocq`O@(r|5Y}oz^<`e3SA45@; zdaBBOaF&5d_OWh zglch^n$qB~7u=D(CNW;eqd+gRN@>0%q@b>^NHoc%?(ZDso?zds5Z|%pic_G*lDU~S zuWh1(o#@`$L&Aw&htkm9*uv#Zb_Wkp(QZp2nc!}`oQ2O0Uu4#QXp@P<6A%eHe@i)Y z5IP7K%2R0?Tw`P8{>upd{8&bC$#;%=AH_3B4pjgr) zS3AE7hq-Mj(^j=Nip&Efd&LFsj4V2ZsA4b zxM%#FCu#g^38@UYTF2Kc9d*^2;#20m`mIZU;Z;^G@yoS=OJzafi7K%D6j)al6*jGe%Q46^WgqxqF48HItAMN#PFMga z?iv{FL+b!n3l}K6*T>cSG>Tueow%^BjTXn#%8-M01ZYk1>X(%N34^7ftJ6BsLUeIn z3^!3XdPgcjCYR$d9f=-JDK*#ICYBeo9Z_kUQF>8W@X_ugQO>$`d)H9y1|`kbgTlr(Zqe|)2a;!zal(&sZW7)P zmJcPv1t0>a13aIlQ385!QUzw`4ymv{S}f;K9eTbI(3PB_r40eYS+Dn;7}4c`AMBw> ziYfTah2Q0AI^ifB`Ril**f~I)u7Xnn$>g6f2~vjDfL-tKm`fK~J-~Q^-z^JanD;8? zRt}g14tKo{$}uJQK^CzhUqrL69N-`|xg^?Q`H?M0Km~?1)PAEMEalRj7}!$^rcMuC zqjp8#kp(iYrxak$me_~lf+I_vk*$8FxsOE!lZuP%V`;&pDbsxZ5C77x<_e%@`U-IW z{~`Zc%{9Un&(QlT=eL#qnoqTXSP8dcgx8nYH|OQo2EJmXfY|1aWshSt=|m?e1|VKLq94aV_*w8&&;; z*K$Y^@sr`q<7U}rq2M>25QjA{-I!?amheCOuLI$+kALVdoZZLaOYoIQeXWx_%xv^3 zSq6h~PvS|Eu9dAU;>_k>IhrnvZaM$u;bt-RkGgZy_<_!TsaB zPVi0?BoBO(t5Tga!*nB9pH6qZ z>HQCi_;)P-X7g_$|EBTps-L|7!3#fq|AW8q?@|7}#lQRcHawq80lUbr zb=jrQUUs4W531y}9ti(sAJr`EZg7u77F~9E?(hLLmt8p+)NtxPs1aDAMT|3`!hq7t zt_&+=v7epUMbU=?J`V;eoYjCa>5sYj51CbV%*ex`5PwFoqvUC(Hieuc%BZZH-V2S<2X3m@M z-Vh$V0XM#A?#y`$7A%^-u&VNqLq=PBOQ^68!fOD7_5+h)2Gn2O7GFI@X+J@In?Uy0 zu;``SdOV=Lu19c}Dft})FIf%xi)MTc(cZGUqa9fP!JGVSUU9oC-JBHhB}*!fommu#fVAN`3v_S`FP%-)~eM+H{zu&R~S z#UI?%%J;mH`gDr>bc=7J@RG{jXR3?um|t;1b?@J5dmpSWe&nXsWmU{ zx^C~vHP`+nR?@uJ?y-B1e&=PQ4^_D4@ahvbo>}wkFK#@x{F{e;=YW=ZuNIzt=iwDUJ9dwk_xQ{{Wk+>P{`2z0 zroN_KE4(g`j$@|c2`;4 zdupF=f4_Fmw!-7~*=ND$;%}`j|L=vrY`t&Q8zb{y+ke)KpX~kUjhEFtc-Lnxc>I~< z6Fq`$y*!*C#q& z7<=D=x77S%^cgp2{(R#ftGt7Ld(xGwe!15L-@WG6)c4*#tNy1g8*ja4$D;XtH|%rr zZZ}=F%N-A$a^R+4-mv5SPaU)SceniWqaP_25p7!U74;?!Dr<+b%cSq5;l8^3NJ!7}{1?%#D`-zipJo&n@mmYt> zej_uxthwgi8CAUxzxd=HYY+cM+tHW(<-9X~*!kxVcC0w==ZAddrSm_1!1W#FJ5mcj zJ7Ux0w|;K%3uTK}K6c;LZ=C<+kB+Rl@xA-r{M^%r|JQyGm+tk8rz?9lp0v1S&DHzv z`c~n2UrDZ8ef^ko*6jPe_kVWsc}K5o`_7(s{`a;`ZKtig=dkBq@11|e@EenVduCek z#PQ#{y0!AL!!~^VjH9lPf8*fKo#zcdz5a)9zIWNLR#!f7!%g4$&TZdZc)=(3PZfXV zuuqM6Z|%mPzO~N}eo=7k9?MrP-9G!)XMbFkeDD662VxhW@wG1Zt`>WTVJL^lu@0@$-$yYS~er)r< zetzP(+j=XvKYhVrM}2a^Tc3UN*9Vk*?%mcgS3deq{<}pZPo8wg??3&^s?AGx-1_Vn zuledLT@T)Q_|F@DxUPErjh~tM$3IlP`uJB)I{n0LYws<6Z01vc?b(0VKV7`~glB%& zHT>zquU>Tax);y-S<{t2`QzRXoO8}aqkneEu6ynJNFsT6{_@woUrasoPv3g(kq5UQ z)$qab$4|cQ+WI4IxwUTYl|A46^X`+z+|$|o*blDx@s8=2WlAq!-@WdNH(vVFw?4mm zzoQq;d2-|5e|Ya}tI8i8QFHCsPkd#=*7r7j`};rr-LS{InqEEOk-PpUecshguZ)>{ z<2?<-`zys>kV)Jt>fwSCuM&8m&*?Q#*W5Mry72G!_pru{CU?0_e?)}+aI3UYxVO} z=ACr!sE)J0cggl^KVS3oAx*n|t7-iexBuheneX0k^J`<%!~gn|Z_Fxx>)~nLpL~1k z9(x{JkZMh};oHlmHx@?ESon#YzBk8CE01pFRVt-TQxj7fCpE+aPALfzHwoaHjCSz` za|G!g5u{2(+h}r@8@pTWy7n^fbYyF#<=Hx)t66M#5hLfKG0;fb!Q|rLS{B0W!H?|0 z5cQS4G0{)a+L%tY?y(-;Gh6vtvcLvDu z-{Yy**+uc7?;Ho@Z6jQtJfAnNj<*MLAf3)YT-Po?RGGJQd<5|E6Fv8poMG}QvR^q! zN5sOur<2`Ikfg^iqf2~1^|FZpwgGR}>8v`zZ>2#pF0X7U8h-}0a0Ixld0q@3T`Zl> z33?darZ{66C*M}Kj3zdXLvX3{qZY89?p15`{#z61o&%v45H3h@v-s4B9=^N+<*pXk z`bNIHgFe}Edjs*Z&==q&UhePci6WnxvqWM2v!D^uiI9c}<_P}`N93_6h7%j}2b?W} zczD;4E>vmay+XoyVKUAChHg9N0eU(t>QgW}z9xsrw7&5!?iu&utAeNow~qQ-Dy;3g zRppOW+aLPhs$J0Zk$q>W=A$6t9kMxZcOjNzEJP=y0$iB?i?@G66kG`ZtW9zqi%3=+o9gJC?N_Pl4pBx#ZmgCct#-90nRtC{YZ zBs}gJ9310u66OGgD0ppzn-ewQ;8o;m#8x9lK^Zkd;GhnoF?fJ8BIZVg-uGWst9I|b zyLaGR`M&#o_hTnLYwy2St*TwMYSpURwRaU*3!7?a22s>3jixr|~%r!~=Z35VY9A z?YqHR^oI{rY{hd>xsI#Y+AXa^Y6E%I&@b*-(Y~@ew#;hia4UEvYw?C&;7H}um#fTD zygW>*czlogQ60OSP*>|V@d6V2W$KfXEy9S?T!}Chaj|`IosNB5#3O>^F7`?ELeW37$GCkPU3;H0( z)}Zto$?&-n=oT>tkEwTBUKk5C)UU(CKI&KSz=ygGEQ$n-9ZY)Zu^T<&#ewmoBq zW<_OqZmW3TpmwxZD)YYhve?SR@=i--)Z&{rs4n&Fck}8O`lyHc z77=gz(}XulHX7t>;$c)>bIrQ-4I5}lOenn>YZ&2I;|V5;HoruR)*_%*2H;EA$SwJ> z035}O#fZF!N2P>?Jo2@DS_KqV`l3FY233%Yg7C&?559TC%P{a55|4Php^Nm{c>NhI zEM@VosMm9>RX*?_UEi_8yKdOj08dZ(*U0z{^a)z!T%Y$|6_dj9DuWLJjVJ*ZhR(|u z+WVCRU|e>2fXej!HqJ_7wfWQq`IGI>nWEOkf6TpJR!JKRIJL3R!oks18ma9TE8+3` zzD8RAuWm&uz_8p7OTOG_Ier&lg$TAGB`Y8ocHs#yy{rm792`Phq+U$Bnk)%j4K@hM zcNeVk$9LJ3{)ONr(h8&Z7szyrlbbJ(yk5`qe=D`1fZv6^C;Eo565-NRI@U8-+5Lfe z4hSEnaANqRBRB~g8N~8fxoWS1PR|crf1?ePYei&0=soyOQxd_@G;CNVc?nVLO5gh) zSWbAwa#TytMe*QNHg##*@kuXw_k&C-eac9FONri{LDeNg?|HA3D5IkxR4mTx_2ToD z^n4h%gu;OJ%?+)sg)lV~jjH7p6=C|ES3KR-6Qfg^HZCzn#b~u6ycGWw0}#oh5Xnd1 z=MKFGPo$~Ee&nNgb>aHOvMEY^pjVap-kZW=kAJdVTbKC&38_n*E?z2)){QDFq!NAc zip4xPi@?RHZu)y+k{OrMBXP+p0u;NH7O92 z&)jLzA4WyAS`?K>kM{GcWq5Io-VTq}j?wBoI4P>@!ny{m)WgoD^pOgB)tTN)Ns*1l z{_ePt@A5+=O({`iUIzpVOdnv7j!1Ga26^v=+k)jJauFD<-d_q4^ftg|^hQ{bSU1=Y z4d8eG*`c@)x=8*Kty}KFoCn?!!wXsDTJ&wbP~9bjFf%QTz}sBISa(cI^6ATzak)Bz z-lL&~@6O#PiW7t>;&^kzBwJ>O1w-~UG+L0;Jfmx9o51+ zM*~vdGVmM%%5IR$v7)YZ?V1K`arB`p);FxX!MegG5VYeu?|4cxBhX6zd?wkwr1g~% zRtJxEbcsvBt+lVzfG`}bh*#n>*p>#^Uv8G4#w6dtXH6(_J{OdpKND7lpZicHAy;im zON-^calLSpNJY8) z{VdL2fL02xqhD`W%)3G#vh)id3me8;tXnH>i^*iB`OPgk7NVXe&CA22v*no+p1O>u zrHrNYO+0mm{z{z{y)#6}>)ngpE$4eiXC z2SKMmkAOz+$eBx_SQ*eZ&?(R~Xm(f5+yh#EC**=AL0_ft|DH2jp?t~D=gb>GqZ#lK zy*p>V0^0V4oEdo=(!D2V_JPiT?gJgY7vZ4My~q#le)4|ghf3iq2nWrAz6v^uwOWfX zQ4_&ht(Bm&pi$5a)@1d8w*616&jJ-+%bAZ64q7%J`TRQW19a-aoVf*5d?ROO2*>)o zSuHm0P=^4rSive zW;f_8=mco;CpmLJ;XlurCu6cH@(a`(X!MDk`8CjK&}pKFa^`$YK+Qg#Gn+xnf0HwJ zfzHh2%x4JyEz&;``Tsrc2Q+*HBVE6Ud|-9K86*MW*cbc-KKdvXyjbe+yfdt-!vbiaL`vkLrYDw`E*=| zO>-A$+j7&K0S&D%%|&N`A9N|`C};$93UmYL3}`oK`AXBg0W<L<5a=}M zW1!+9$OR39z5+T5T8{QO3mOKERN;O=!_}s_kLV>x_np8$i1GuCf=<$P#550qW@-@s zEL_*4oIslu2Fq)MWi^2W&TIG_tgZO%!tWWxeV*gq z;;RiV+TpJahPId11}i2`s0oJ0=hOtN$L6*Kr%V0IOXdZun}gw+UZUC ze&67{Uc0QTW0c1*oRs=oa^|N<295}R^}w>g?jS(svBjCk%P5ac z!6~2b>UpwIQB<}n3M1M!$T$=IUlYkd2F87t1s9F^aZfRnVqLJjCRo-Sfc_v1r?L$9 zAx<^o=rSZZ)4)~&n~!@{b<=9q4Jy=EW531bfLIE)QY-+ZK6e%3ipwcNE91t^MYk9foQNS`h7s8znj3*2cGwVQa+BOzfHl} z692QLzeP0;dJ7SIAm=Ld>kr^u-IuK`-Gn@x)XrzlGX7x7!A4XN}a(>ZzSw z9-J=sJpf@)VOO(l2+%#;1zC$elQTb0`I7el6GZhgRqmV6N`W9M?*rhS0PhUW=^nQG zpo0_CCda9rjGaK0|8caEMycZ9fOTjJpe(4}KSgzfSOJAkmI|5hk70y)1!*fhfKB$+5fwxQ7PiPCzqq0kMoPg%cjb1)3VZk`aO z8ovtE=h8hnb0^E#?pyEFFBD3tuNUf6XH&46KnVOX#GORk9*T?7_C;YX>I1OZ==%Us z8{7t-XTWm@+bwQ4#oFNIRGPm;J=Ybqo2I}L$T|pF;V;4G!?|iVP*Q12hqWz}ZH9dQ zP2iLLGx`I&jgoB@5`2J)ym+7AWK0jCc{myVuGu+U}TtO)yj9yUsFJ_2`edBLE-yCi@WYA;deM z;?)PsH_2i}tK{%!aB{#SoXY7{gdalq6%=3E7issA-y5xz$QCTY*rt3he08cD$%p(? z{zB`KI~ZPcNR0vCUvYun02gZl(to-N@iyI;@6*Q6r%i_X<^{{^f@QKdQ8wdd@MXaF zHP|rK#-*=QtnOC@XZ`-#;x^6-t z*rVK+Z6}+~wsn=Vt!@6Zeb9Y09II*@11KGbxvhn=lRSDWjK*l6WqG&wR*_AEyJ7e3 zT9hv~SxRcgR{_gKzRzvo*x0vRo}*Vk9eeRLYpT1 z%~t=gHrVEiI`4q;8bY4$MZ8SWw*#NGG9oOvSkW3rA`2S-bMFQ73rl4s{z zjWaZzRRP~s3X|0<@9|#5&HN~5p5j#pEo7%yU#9&2!^QPQ)D8D|c=e|_Ghp4%)xk{I|Hl$mx(cLo6?l$J=gc7U zjFS&Rc9?3Iq~U(yg2{W_2HwXozp(U8s7I=+Ly))kml&g1byeUGwH4}_>g!I%TuAuI zoOw3;9NTHk;jHIOjqe6mJ*#qwBJRmg!B$YZ)Yt8X`oK6o1fuUX4W4Ptk=$mre^;Bb z*JsA>f8;pz8A3AqAusf6dtG!;T^zR8#S!q#$2`neC|@Z0f-Hg zdsn)-VuR4u&ykwfkPR(z%f1nLUu*3fT{nY*~MDeAq%pHA1WpP~HyW z&kT4kBVHU4{Eh%S^FMOtNn8gz&_`e#o%aDTE|ET9iSJj1W7L{JD`YIi9Nsa=_&xd( zTR&ZFP6GY(68~@K7VQhD8HgL`2YI`W;-27_D|xPVke}m-(ikyV5M-Xm0UyQ+j((kPi2S5h%v~PA zT;vaM?r39j46pnos2M7sou;OM^sR43ywTTk=6ROAk$rQ1?A8=4VsGl@m?n$3Y0Pgv zNB2PX<}qn#$U4Er_N@iM$P{&l-wWWa#+>IdoKtyE&^Ujb{0_`V(Zmh(3I<+|y&_;a z6LYO)KFry1`S2JJsf=OV&_*{Bg1e()H3zP-Uy`rW3>j^Z@jJ-)G0xp}yo$!d($>j& ztVW2uv8Y>*o{MDdg{*Er=4e?K+hycuoW?O@Co~1aL$2y-2)L1EsmsS8Yae9&3S%R8 zzT`L+zBLV`?&idfavz{~rd>>KOgC0{3(M1^i`w+J~V46RoxYDP)g8HeoR32-o zJbXKB{;0BBG#_4y`R-dO4vr9hrI-Vs1U8rKz0CU>%7g!?Pj%)?09SzLh6ScMjC0%l z)nl$OuKV&Rf}-F%2tGNNggo(>O8WA0OqFlbt1yo9ze;@@EMLI{2&IFA+UdQJIla&{ zzijzG$MNU0C;Io$_@HobNGd7kYF~l8Fy{1kSbB{z*K-^Ht_m9Mpdql)I&TX2+N}%f z8dgHqrFcfLO2i*3Np z1V;5r2Vr*st9J2C0o&l>+Yc=1;yVOv!o~Ljustq5f#(?eU3@14n{n~cbC6eEe3t@S zgl8f8KB#|;0$T};`d=E8UN1+ZYP{Nqux^C)QW*4X%;#&8)@oz0jK;GQ2!9CSEfkKp zmm~19K(~}2+dsmOApAeM-fr<>PNw)=5X_UmrMTNvAE303K~`U1&O{f0x&5}Wx#M#t zPS{?$!+(oU^Z{Cgo9V-Io!8hV7xd-OW9lz4M2E(>J8oFsYYV&hRRQRbyWfXa(!Fg% zdau6IG~aINxEuq!`c^q_h7C5(UF(0dp)uZeTcUW z&&2Mq{IPXbyF*F(d^^#DSTpX;f$Q!5SWN)-Fz=p`;iWc`h0KF^uBPu5wwI z0^H|h=lCCnsyV!b`T*+R;UpjfBrgeh2P;hT8*ikZvzPd{QNL4YAK^KudG0LaeZ7aD zJp{9t*cF*3`wv{QHaLArGC+3a1@JDq5YP5-uIdf9D(A)4Sk|gF&}sEhRK6iRj9G~| zx_n8$RsstHyMW}Nd=qG)B)=7SGw^MM%d*A18{1XXZ>jI2_WG?4M8GzRIQJsXQ9^_+0X;>Vxd<@mB@=5?dj`Fh~G9q|ps`Cg);?DrD25!%1HNxnbXB7C|#E5)u z$Ha$ge1}IhH09u&%iIKZdOo@zaZh+1yD%N{e+f!K{TlAY^71i>S7-ugqKR~403^eU-kV5O7gAa ztrB>v1l}rvw@Tox5_qcw{{Jq4*$=4un_~Lk=z~o-KF;)0OedL+%ZWoF{)Op{a#Bc$ ztxUHuRZ~PkFAKU)_9h$Lx)+>*lPiA}`J4(Tf1Zv6r+Y2a>CGx! zIW z*ROfR({eU*_(>cua-)i`@ln2>d0EBC{7uJHG{Sh>7gW6L=M{Bw38Cdpy7E)U>8@sa z=q43k;VHPuIzvztXX)Xbu^NHRhy=0UUT7E02j%#ffPcc}za3t}!H+M;TL0Rmfu(htr%L z9XcFK!3XJjiqoSnS{^pu^;AUCy(7 z{k;=a_+R<@)9Uj7+25I8=^Q$A6g+m^L!q$TY!pgy}fbolJK#eURxROrKzSnCVfbbCz@ZOwVOn#k7&>My3g- zBTUDc?qs@~>4QukVfqBq!%UAdowI_|XL>HvDyEH0H!@8y9br1obSKl@Odn+W2-7E+ z9%g!!>713EKGSoVRxxd4x{+yu=?K$traPJLX8Iu0N0>gr^f1$-Oy^w0=`%f-X%*8( zrW=_in2sEdoas)cyO}=7 zR7v;#+btgi7lzj^EZ#2HGi#GaIL%Aa5#e!wTS|ip7R?^vt2z8y9v`^l*Kv5ONBZ>K zf{rUW+#O%r`8JREn!n2gJ(bGNnDQy`@n6Qt>C#%|ZQCi8x7Ydt8-dh#5`- zEyn*qIladj6v^ilV=wd5GeW|(pWDJX&BqfS{+$Bkvpt+rc!@YeWR7wTLM|O^@gsh5 zvAh%u6_FnzCS3d1^0^(tHse%%t6X?0XNzM$H1C=`+D!DaX{jz$4@HY&)mRCy^H1NY2cJ@gy%_=6s#>{ zJn6zoe~Dkut7v|DUPStQ;P+s_q5cZ7P~xWu?dNL#YTzVC&(mm}-Zd)0(=F{cYrGS9 zvHTB6{xifOPFMS(BaBbG@EaJPapB`0@;}Y|;;_1-QO?jk9{gViPWP2z!>;w}`;14p zLuq0;zhwENEMJ$~a~|?v(sI@)0eYDAH;t14!J+kPA?lynMV9qPx35LOiK;VQ~1wWem~@BLqPG)?9@hQf&KHLGkSU%~!E4tqqGMG5z8f4IYjLR3iaV^&pgFepq^bTC$kn4j% zUj$wvP8TuOE8TA%170j$TDvdPC4-DZu9XEnjq%aXOW2ZM1-zJ?X6B#TtN8VJ?<&Tp zU3il5S;lWu(ZqF(Pf|yKgX}&Xw=f>PUtM3Oh`5LG4C6d)D)up+{fc6gYbkO1C~&e5 zH?yAOQXWr9yj&b|)z|NV7rWn=fm69Dp7_pvZDQpm4cP52wo+ zpZbx)Gm40Hz)7!WI6t}{=>%RZKYh#}A;V4wlM#(iI`L77qu+m-apaqhagD#^#Ob>M z(oguK6Tel6&SpI6;=hRT zjEg_Y__T}v8picJvz9;3xSogB`MH~MJuj~LA7)(7n`{238PEP!-H_%##`rAbn*S6` z$dKOZ`TaEd13E5bT+jFafN`&Kt_MGro1Q;yD^YSj#JHYcy@TcSuzWqAdeQ61zmDYy z?zk>c;>CncmvJ`7;&Y5=8JFv55a)iGF8p4ek11z44@(?=8qYJPI6sdwuIC+>z%JAA z8^-l~;|2wL`nP`rKb6l^PBH5I&qu={e1`G6S@aCmECRwu}^wn+Zdta(D6#17ym z>I)ma+XMf$#NqGVs+i?_FgQKPc-T-lcT0la?JFk#Mdr`4gTUrn{MCbh-rI`HInM*H zmpJUkiz+`%#MK`B*LvU|XF18Mm7MP=A|^ceGr&X4V<+_em4)axM_vBva|?+7bkXLT z4|$x^Ew5KnKE=ZRz<4sNfU8+u{(?d-R?a72Lb(|J4i9{}2TtFMDJEx=#DnUCzsS<% zoKJf1su=$O_^BKwUF9(9A%CX_exC=P^}v5Fapbd8W$+FzH+tXjM6~y5&iF3Qzv&@o z$tlI}>w0v7#qO8Bqf-pOzyqf>c9fsUhgC-8`{X!X2fQ45(#_?@*%VhYf7>2~$aleT znr1xuV};B22XOjHi7U+h_bw0o0WH5pam(){;Pg=s{$CO9TOjoF6P?C$9{l%vl=D$e zH*$}XAm8!A>HPVsd@>CRpU?GpzQlEEd3vb_zRm-`#sk0KqkeDn;9uaOCzFyN_1mTL zcs^&9-kmI_CpUSN&o?~yf8l}u!2|y*@P!yxwmqc^vYYd>K(^nYXsc5ISA#g0@#H#% z%kL-P^kR?p-opH|wTgd05%E#Rry3O?-^0LZn(=76!g*LF#(+~kXLx=|=ks2iKd<6J%(|CN-F zaoo)+|F3cW|F^^o%V8e+yJC8Nh6lb(;;_%(RkD7-A~$&OCzyYd?L!&!k9zRm#{4rs zQ;bhB{~pH0XBF@$-`B$)a(>4AqXUXxzSED>XMvO5cK7cudC2*!N4b^2F(!Q*<>%69 zw(>ZW@i6EAKE{_zoG)yo2{`FV#?}9RnB`2iDQ4~G1U>9nr-%H_z(cn5^y#<<|7Sh$ z`y`I}dA5^Ru%I6UU+6# zOyRAHi2WXNp7g-~$a2CrDFO5SiqZ>8q@Qiqt84ik2AnQHp-DWU@Ou>z?_@mmoC4|@ z|DeSA!bUa#FDJd7!-kf_t^_XY%hiAVf!kyG2NdIC<{#j6v)mtP`!L3Ml=Y;E`EQjt zU)acQ;FKTj&+DMCYB^lLpXY!_Jmfs>fxpCZrY=?jRtt`#WS{0j3YJovBkz_$aJ{i$nQ`56!X`#kWh z#9{wetNa||yguc@{}bTG$#0je z&f7fjVGsNhQa=1QE*~ytai`=*KOR$Z=WxKiz!w)LEB=g*=0qO`0byt0cUVs3Nrew{ z@Z%D9^3v6_%%Az53OmoIXwHLw!J^`Jc(DimPagPc;AF3|F2AwOgFhv4JO_7;bH)13 zq4cuKL17r}9X$p%{1Lq8rNNtfRdx#d_FjGQ_JQG~9g?3J7ahZi%5VW(**Vx3v!iO; zBReugAKAA9{CRUbq`p9JM^Zgq{q1%DyPtG+$74nZe zC+1^4vG#O4Rk=*_amF|n=bKb%>XAE`UPGOpp zZ-xWajc}QxtULQ-20k$^smhZfw@s_;Ne#6lD~bNJL0e;{aE@=0cMT@fbQiTXYt}TZ z6R6BodN`4wN{bI+M+khad&o%lt8EcdsO8w8(bYHD(cWjoXd@b7{b(c;*=9UHLx)_F7emE<^o+^@gdQZM8!dZO*RGd=BY-iUFWu@0m^h) z!<9mPz`tjNazPvFp;WuDjcBq8l36M;JUA3LMyibVG_(@C=g@}lbe-z%Nu&jB&{$E{_82^7eOaFXOHC?8vHFpl`xOhE2!L>mwo1K8bfu-A@tXskQF#Yhht)g1!+ zRvLrJ_<%uMm>Y@Cp{>cZJxZsJLX48fU7S#5)UQ?GUHZ&O#joYU?2S`pa@#ag!^mmA z-UaqZ=t*GT!oK!_w4_`{1z1hsix9$hdaI zZ763a&&J6cM&r7g)eT0&ntH^#@fb4 z?7e4fsHtsjFhmzRp@ES|Q)^3YodF%Mya;i7uv^UX6|j6m>A~SXD{w`%%Su}J0gG*P zw8zj##p4z`$xhp8HT--LH$WbkkPVXHPl*L^bM=)XakZB z?NB%H$IvG^*zFxD3XXPzA+N|*QqH!}Gk`sz1WK;QDJNg**eY`%VWojW@9#xxwE(*R z6t)rUPjxx4j^UoZ7@P}iUo+5Yzzlc5>7X3j%9Y}dq-b}nfpk6zB{5A~1i`m)2pyK% z=!DcRP8J4pD;+(#QMEx^DkXa2a6z>bpiLo^fbJaIxpej#P&@3LmDiPJ7n3F?dt#PY z&Xn4V&4IcFqcGuFvTJHtyY^1nr-$2-Hkjx>tj+?u**BQVXMqx=JZ#1-IMQ=@L*!$S z&ccNr>UUR+blXU+`r=NFmG;)koHkmPXuUO6dopF9-ms5Sj56cSirNJTThTc(2u9Q! zTFQV^Bh==q4p!u>v)idl@U;32h%~VG5k@0JkS3CaMU&T0vI>0;s{pA5Vu#6PcBJj< za+D{k9Z}wy*ud5}LulQ3?P2dtB$C7FltZ3#)I=p8b9=7F0J;biB{xz|#Af9=6ZzV4 zG*;0c??;h4QbqB^-PO`FP}Lrb4WR}Glcb%F2t9+H>3nICmgQ3;S5q5NZXeXN(}NBP zE`GaabEM;Nh$MCfFCvb76}zOAEa6TM&TCSG19q#+<(BV`7@+=IxjZ8tOtAo*ct9uy3Dn*;yjLs|tcb5iB$||8bIZ{Q7 zM_YA3)TwpDvJ2jF&k<-CT^L?*XKRQA4Fp^TjVi)_M=YD`O(Vh07|_G;VJwM04qbFC zHE3XD7(>@c^=s>7m%(pN7%MxrVyvX5D~y)4NFBYA0b{3UD6~ba;(;j!5$@LF=qIT8 zxGa&CU-Xn#*PzFI+~-(MIIAht#cf2BGMBCr=>*BUcWUHWa)<60hV4AZF}oT2~z}WkgSFp)cE*L zwX&&8o(zzKKvWyoBlQ4or8bO?REl-jDpi|K!Y84o>c|B-cy6zR+&TeN?yGKbUxYDX z7uw{|K!L@E3#B?&7~T;~Mp$vEM3eT8M;386Zp^{bfo{M7xJm#6?L_B5y3bzIaIv8J zXoil6?7MahVHScq$4)3YkNtQ!DiW!!15RUrQF(jJE?e7sgY2-bm13Hq{UdEnw8Cs| z?7thFed0kdnfHt?zlz!Myb>+vBjf7y094yRF|8j ziZW4o8>k0Z4~Hb|q&_t0bS$WfY3sT|N!FN2j3kQqqS&>ua8yFMcR8nyQY_LdI4n4i zRP$9RXQuQ31qs4qcD7hH=R9lZYEQaU3U4kyHW8^*H;rF_MYeUd;7a}D2R+}P ziyuFx5>Z|+qG`yLgkF!K;Yys?<0m=3rb{#<(^A)U4X)|YoKF9Cj<2cyUWbmRpYQ4G z7MvW#H!F1fDUPq{rObE&Q+NK?1IJT8EB#rHujvfdchWHjKT2E2$Kx}3d<1_ficVjD zH$+qYoe;&XWax9Eo%qo=Idpve9S%*8Ftg6T=F>EZaQeoFzSiIQuqelO=bvHm&p4qv z(ed?nMl{vm8PVyx@Bfn=zm^5+@0Mt)zjH$I>02%C__qP0a;5yqLqC6IipQpo!>vC% z5NeMf;&_^7EWt`lIZM;@Gp_jAD#f6w&M!x^@~`nPxZ>;g$u*t$iH@mg#Ca+9;M$&l zy)IkRx4HP;_kTaf*Y&5@%W3-J=bQpU&P(y2E53d&MN`^)*M7Jz#eP@(ZeAd(X$bpz z+7DfB8v7|u?Dj){A3)QPW@PG4{~6#x{J7a#?=$Q7n%(K?YfXuS^_QyGo_?0UGo)#S zjGh0Z<7+w(k?ryIcZxJ^(-~tCI-aKVKB_&wUPr5GnWdOYKq#LTd3G8ilPsN#UazO$ zqX?bjj1Y2O3i?bNrO(aY3f1w?wh(nfymZ*9D~mFG8?U1{bdJ0fXMx;;pT2Kx|EYcI kyem%iw{5PH`U%a*fjV8yi)EQb path to iamroot binary (default: ./iamroot) +# --ssh-key ssh key file (passed to scp and ssh) +# --ssh-opts "..." extra ssh options (e.g. "-o ConnectTimeout=5") +# --remote-path

where to scp the binary (default: /tmp/iamroot) +# --no-sudo don't prefix the remote command with sudo +# --parallel run N hosts concurrently (default: 4) +# --summary-only skip per-host detail in stdout; print summary only +# --no-cleanup leave the binary behind on each host (default: rm) +# -h | --help this message +# +# Exit code: 0 if every host scanned (regardless of host-level vulns), +# 1 if any host failed to scan. + +set -euo pipefail + +BINARY="./iamroot" +SSH_KEY="" +SSH_OPTS="" +REMOTE_PATH="/tmp/iamroot" +USE_SUDO=1 +PARALLEL=4 +SUMMARY_ONLY=0 +CLEANUP=1 +HOSTFILE="" + +usage() { sed -n '2,/^$/p' "$0" | sed 's/^# \?//'; exit "${1:-0}"; } + +while [[ $# -gt 0 ]]; do + case "$1" in + --binary) BINARY="$2"; shift 2;; + --ssh-key) SSH_KEY="$2"; shift 2;; + --ssh-opts) SSH_OPTS="$2"; shift 2;; + --remote-path) REMOTE_PATH="$2"; shift 2;; + --no-sudo) USE_SUDO=0; shift;; + --parallel) PARALLEL="$2"; shift 2;; + --summary-only) SUMMARY_ONLY=1; shift;; + --no-cleanup) CLEANUP=0; shift;; + -h|--help) usage 0;; + -) HOSTFILE="/dev/stdin"; shift;; + *) HOSTFILE="$1"; shift;; + esac +done + +if [[ -z "$HOSTFILE" ]]; then + echo "error: no host file provided. Use -h for help." >&2 + exit 2 +fi + +if [[ ! -x "$BINARY" ]]; then + echo "error: iamroot binary not found / not executable: $BINARY" >&2 + exit 2 +fi + +if ! command -v jq >/dev/null 2>&1; then + echo "error: jq is required for JSON aggregation" >&2 + exit 2 +fi + +# Build ssh/scp option arrays +SSH_BASE=(-o StrictHostKeyChecking=no -o BatchMode=yes -o ConnectTimeout=10) +[[ -n "$SSH_KEY" ]] && SSH_BASE+=(-i "$SSH_KEY") +[[ -n "$SSH_OPTS" ]] && eval "SSH_BASE+=( $SSH_OPTS )" + +scan_one_host() { + local hostspec="$1" + local host port user + if [[ "$hostspec" == *:* ]]; then + port="${hostspec##*:}" + hostspec="${hostspec%:*}" + else + port="22" + fi + if [[ "$hostspec" == *@* ]]; then + user="${hostspec%@*}" + host="${hostspec#*@}" + else + user="" + host="$hostspec" + fi + local target="${user:+${user}@}${host}" + + local sudo_prefix="" + [[ "$USE_SUDO" -eq 1 ]] && sudo_prefix="sudo" + + # 1. scp the binary + if ! scp "${SSH_BASE[@]}" -P "$port" -q "$BINARY" \ + "${target}:${REMOTE_PATH}" 2>/dev/null; then + echo "{\"host\":\"${hostspec}\",\"ok\":false,\"error\":\"scp failed\"}" + return 1 + fi + + # 2. run --scan --json + # iamroot's exit codes are SEMANTIC (0=OK, 2=VULNERABLE, 4=PRECOND_FAIL, etc.) + # — nonzero is NOT a failure here. Treat ANY stdout JSON as success; + # only ssh-transport-level failures (key denied, network) are real + # failures, and those manifest as empty stdout + nonzero exit. + local scan_out + scan_out=$(ssh "${SSH_BASE[@]}" -p "$port" "$target" \ + "$sudo_prefix $REMOTE_PATH --scan --json --no-color" 2>/dev/null || true) + if [[ -z "$scan_out" ]]; then + echo "{\"host\":\"${hostspec}\",\"ok\":false,\"error\":\"ssh run failed (empty output)\"}" + # Still try to cleanup + [[ "$CLEANUP" -eq 1 ]] && ssh "${SSH_BASE[@]}" -p "$port" "$target" \ + "rm -f $REMOTE_PATH" 2>/dev/null || true + return 1 + fi + + # 3. cleanup + if [[ "$CLEANUP" -eq 1 ]]; then + ssh "${SSH_BASE[@]}" -p "$port" "$target" \ + "rm -f $REMOTE_PATH" 2>/dev/null || true + fi + + # 4. emit one combined JSON object + if ! echo "$scan_out" | jq --arg h "$hostspec" \ + '{host: $h, ok: true, scan: .}' 2>/dev/null; then + echo "{\"host\":\"${hostspec}\",\"ok\":false,\"error\":\"invalid JSON from iamroot\"}" + return 1 + fi +} + +# Read host list (strip comments, blank lines) +mapfile -t HOSTS < <(grep -vE '^\s*(#|$)' "$HOSTFILE") +if [[ ${#HOSTS[@]} -eq 0 ]]; then + echo "error: no hosts to scan" >&2 + exit 2 +fi + +# Optional progress to stderr +echo "[*] scanning ${#HOSTS[@]} host(s), parallel=$PARALLEL" >&2 + +# Run in parallel with xargs. Each invocation prints one JSON object. +export -f scan_one_host +export BINARY SSH_BASE SSH_KEY REMOTE_PATH USE_SUDO CLEANUP +# bash-export of an array doesn't survive, so re-serialize: +export SSH_BASE_STR="${SSH_BASE[*]}" + +# Simpler: collect per-host results sequentially (good enough for small +# fleets); parallel mode uses GNU xargs -P if available. +TMP=$(mktemp) +trap 'rm -f "$TMP"' EXIT + +if [[ "$PARALLEL" -gt 1 ]] && command -v xargs >/dev/null 2>&1; then + # -I{} implies -n1; specifying both warns on modern xargs. + printf '%s\n' "${HOSTS[@]}" | xargs -P"$PARALLEL" -I{} \ + bash -c 'scan_one_host "$@"' _ {} >> "$TMP" +else + for h in "${HOSTS[@]}"; do + scan_one_host "$h" >> "$TMP" || true + done +fi + +# Aggregate. `jq -s` slurps the line-delimited JSON into an array. +TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ) +RESULT=$(jq -s --arg ts "$TIMESTAMP" ' + . as $hosts + | { + generated_at: $ts, + n_hosts: ($hosts | length), + summary: { + ok: ($hosts | map(select(.ok)) | length), + failed: ($hosts | map(select(.ok | not)) | length), + vulnerable: ( + $hosts + | map(select(.ok)) + | map(.scan.modules // []) + | flatten + | map(select(.result == "VULNERABLE")) + | group_by(.cve) + | map({cve: .[0].cve, name: .[0].name, count: length}) + | sort_by(-.count) + ) + }, + hosts: $hosts + } +' "$TMP") + +if [[ "$SUMMARY_ONLY" -eq 1 ]]; then + echo "$RESULT" | jq 'del(.hosts)' +else + echo "$RESULT" +fi + +# Exit nonzero if any host failed +FAILED=$(echo "$RESULT" | jq -r '.summary.failed') +[[ "$FAILED" -eq 0 ]] || exit 1