From 3fa3f507b53a7e7b0f2bd64b2d706844feea936a Mon Sep 17 00:00:00 2001 From: JD Date: Mon, 10 Jun 2024 14:24:37 -0700 Subject: [PATCH] Article: Fleet 4.51.0 release (#19630) --- articles/fleet-4.51.0.md | 114 ++++++++++++++++++ .../articles/fleet-4.51.0-1600x900@2x.png | Bin 0 -> 51826 bytes 2 files changed, 114 insertions(+) create mode 100644 articles/fleet-4.51.0.md create mode 100644 website/assets/images/articles/fleet-4.51.0-1600x900@2x.png diff --git a/articles/fleet-4.51.0.md b/articles/fleet-4.51.0.md new file mode 100644 index 0000000000..7f43b9f66b --- /dev/null +++ b/articles/fleet-4.51.0.md @@ -0,0 +1,114 @@ +# Fleet 4.51.0 | Global activity webhook, macOS TCC table, and software self-service. + +![Fleet 4.51.0](../website/assets/images/articles/fleet-4.51.0-1600x900@2x.png) + +Fleet 4.51.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.51.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +* Global activity webhook +* macOS TCC table +* Software self-service +* Simplified APNs and ABM token uploads + + +## Global activity webhook + +Fleet adds webhook support for global activities, broadening automation and real-time notification capabilities. This feature allows IT administrators to set up webhooks triggered by specific events within Fleet, such as changes in MDM features or re-enrollment activities. This also supports reporting mechanisms, enabling administrators to monitor the alignment between the number of devices enrolled and employees onboarded. + +This update enhances operational efficiency by automating workflows and providing timely data, helping administrators manage device configurations and compliance more effectively. By leveraging webhooks for these critical events, Fleet ensures that administrators can maintain continuous oversight and respond swiftly to changes, ultimately bolstering the organization's device management and security frameworks. + + +## macOS TCC table + +Fleet adds to its monitoring capabilities for macOS devices with support for querying the macOS TCC (Transparency, Consent, and Control) databases. This gives administrators valuable insights into applications' permissions on individual devices, particularly concerning accessing sensitive user data. The TCC framework is a critical component of macOS, designed to safeguard user privacy by managing app permissions across the system. With this update, Fleet enables IT teams to audit and verify that applications comply with organizational policies and privacy standards by accessing detailed, granular permission settings. This capability is essential for maintaining stringent security and privacy protocols, ensuring that only authorized applications can access sensitive information, and enhancing organizations' overall security posture by utilizing macOS within their fleets. + + +## Software self-service + +Fleet aims to streamline the software installation process across organizations through software self-service. IT administrators can easily add software packages to Fleet and make them available for end-users to install via Fleet Desktop. Administrators can offer a curated list of pre-approved and organizationally vetted software directly to users, simplifying the installation process and ensuring compliance with organizational software standards. This addition not only empowers users by providing them with the autonomy to install necessary applications as needed but also ensures that all software deployed across the organization is secure and authorized, thereby maintaining high standards of IT security and operational efficiency. + + +## Simplified APNs and ABM token uploads + +Fleet has simplified the integration of Apple Push Notification service (APNs) certificates and Apple Business Manager (ABM) tokens directly through its user interface. This update marks a significant shift from the previous requirement of using `fleetctl` commands and environmental variables for these tasks. IT administrators can effortlessly upload APNs certificates and ABM tokens via the Fleet UI, enhancing the setup process for managing Apple devices within their networks. This streamlined approach reduces the complexity of configuring necessary services for device management. It accelerates the deployment process, allowing administrators to focus more on strategic tasks than manual configurations. \ + + +For self-managed users, the integration of these certificates requires a server private key, which is essential for activating macOS MDM features within Fleet. See Fleet's documentation for guidance on [configuring a private key](https://fleetdm.com/learn-more-about/fleet-server-private-key), which provides detailed instructions and best practices. + + + +## Changes + +### Endpoint Operations +- Added support for environment variables in configuration profiles for GitOps. +- `fleetctl gitops --dry-run` now errors on duplicate (or conflicting) global/team enroll secrets. +- Added `activities_webhook` configuration option to allow for a webhook to be called when an activity is recorded. This can be used to send activity data to external services. If the webhook response is a 429 error code, the webhook retries for up to 30 minutes. +- Added Tuxedo OS to the Linux distribution platform list. + +### Device Management (MDM) +- **NOTE:** Added new required Fleet server config environment variable when MDM is enabled, + `FLEET_SERVER_PRIVATE_KEY`. This variable contains the private key used to encrypt the MDM + certificates and keys stored in Fleet. Learm more at + https://fleetdm.com/learn-more-about/fleet-server-private-key. +- Added MDM support for iPhone/iPad. +- Added software self-service support. +- Added query parameter `self_service` to filter the list of software titles and the list of a host's software so that only those available to install via self-service are returned. +- Added the device-authenticated endpoint `POST /device/{token}/software/install/{software_title_id}` to self-install software. +- Added new endpoints to configure ABM keypairs and tokens. +- Added `GET /fleet/mdm/apple/request_csr` endpoint, which returns the signed APNS CSR needed to activate Apple MDM. +- Added the ability to automatically log off and lock out `Administrator` users on Windows hosts. +- Added clearer error messages when attempting to set up Apple MDM without a server private key configured. +- Added UI for the global and host activities for self-service software installation. +- Updated UI to support new workflows for macOS MDM setup and credentials. +- Updated UI to support software self-service features. +- Updated UI controls page language and hid CTA button for users without access to turn on MDM. + +### Vulnerability Management +- Updated the CIS policies for Windows 11 Enterprise from v2.0.0 (03-07-2023) to v3.0.0 (02-22-2024). +- Fleet now detects Ubuntu kernel vulnerabilities from the Canonical OVAL feed. +- Fleet now detects and reports vulnerabilities on Firefox ESR editions on macOS. + +### Bug fixes and improvements +- Fixed a bug that might prevent enqueuing commands to renew SCEP certificates if the host was enrolled more than once. +- Prevented the `host_id`s field from being returned from the list labels endpoint. +- Improved software ingestion performance by deduplicating incoming software. +- Placed all form field label tooltips on top. +- Fixed a number of related issues with the filtering and sorting of the queries table. +- Added various optimizations to the rendering of the queries table. +- Fixed host query page styling bugs. +- Fixed a UI bug where "Wipe" action was not being hidden from observers. +- Fixed UI bug for builtin label names for selecting targets. +- Removed references to Administrator accounts in the comments of the Windows lock script. + +## Fleet 4.50.2 (May 31, 2024) + +### Bug fixes + +* Fixed a critical bug where S3 operation were not possible on a different AWS account. + +## Fleet 4.50.1 (May 29, 2024) + +### Bug fixes + +* Fixed a bug that might prevent enqueing commands to renew SCEP certificates if the host was enrolled more than once. +* Fixed a bug by preventing the `host_id`s field from being returned from the list labels endpoint. +* Fixed a number of related issues with the filtering and sorting of the queries table. +* Added various optimizations to the rendering of the queries table. +* Fixed a bug where Bulk Host Delete and Transfer now support status and labelID filters together. +* Added the ability to automatically log off and lock out `Administrator` users on Windows hosts. +* Removed references to Administrator accounts in the comments of the Windows lock script. + + + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.51.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.51.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.51.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..573d63cb76082f093b40092cec9187469f30b673 GIT binary patch literal 51826 zcmeFZcRZE<|37}o%m^iWmC6bUQPwG0DP&|*WD~M74hMy-Ly0IOd&`y?SxNTDo@MXN zanAR;4yX6)^Y`!e`>*SEOXoV*^?W`bkH_;d?vKag$!k?*c?wcSQUCxb6cz5O0RTAy z0EkIQh`?{qkM%^s|4!R0=r{rZ?Pcg6o}${NHSkM3M>Y97KwdlZJa|K3e*3{~04P9` zp`H)|Kr6B0-P;;3@Ro*e;{j9vAXvN>DTle+Ti)Dn;+Sv4_x%sl-2( z_!lH`I`A(@o=D=KO8ip^;9rnDQG$O#5@!wnRN|jX{0ovNI`A(@;@rYNmH4L;|AHjW z8vX^z6G{A2iT@8Okx*S3{4@LWrUZId@2q%1onX@yv2dy>mXAEIquQd%o;)HK)-aai ziFqz){5V^)FH1ajg_f^+-YLCr>}vLMNU=El%bdbBwGwp^{iQ;lz?eLux^B&H{7)3- zWB?gpVq_k zQ(#-;?}eBlVE=mqe)xVG_TSq#=MewBy~GLN{pVgm`Tw*r!ao88|9Sdv;eVq3r(CfA zSOoCToc=kGe=hT1kob>Jfc*;+|ANH7An_lI0RExOf4KTzCh;$6`;Slfm!|$p%>REZ zMd;!KK;mtut@zOP#g2G!`C=pID?_*1C29C1^~5_qNOjW)sXMG#1g+yg5QJ}yxOuCq zve_=P6xcMvid}ab-grxpZqC+!H%Z1g#fu3u7jdRf{Teg44Zmt_9g5zObuiKL*mAxa zRYW&9?#m))!hL z;snU<@PE3v$7PHhKB$-utKqfkYL+i?^~|F6wPA}3TsAr9@M1v&XJu=pY1WVI&~tV$ zu*7qzr*z9Er(*a1*0|@DTUv3il|E^o=JpLARVi)gr50>y*1XGh^x@g-u}`5TbJJ>E zk8X!mRY;C`&dUn6$QBl)3$f}}UhLQJqW+<)H>JjPC*0g$zJo;`$6sO>RAxfl-=(o39)f+U zphjd#?a^SlSx@dml{?{-`G%9t`!vDqcW^baL~1N$YF2u>FWDRm7J3{b6bnc;T6c9# z78KOiys}rntQHD*c~V_yc{MsVz+$9ZcKu+OPL{UuV$0h@Ipali1Wuq9G*G22(dpnu z+-nM>kD>ixRY;*m#+H@bZG(F)DVsw+^ao3|L8iP!7qc${Zb$j?LGuM&>`ApI4iXh! znl^LuAvr-*GZ6{sIFY~PT_Ax3*WFTaP!JAk<2t6MuYb*&o!5Ihj~=y5oJ1ZZ60XIH zd3K-q7JaCViHff zyw25{jpdRz1qq_fnbVd9zWtr7N-wgWI5blEC;=C z`nI6mJHl-GIV1I^*UW=`Ja1a+>7a)S9^;)dmv1(CZpME+D*$BOg%b4?5jO8)7mexK z{atcR=~FRC=_se&yXT$qv_BO${gQ=7w#{b;M}u>^n$;aHJ@}NG{OI?t-z0Y%Tg6v`vfRLZDED?Y(&&oK z3)}1Nbp9**^H_S~wvFD0?u;#<2hgQqfgdoV_xYSMgD!^88I%cT*{r#;27=Dx;rX&% z=Vlo{-lWzWlv@o^ntkN@IC7depvteBPNnIMD9X6kS-hvBFFIxVUPNibJK$X;{;V&= zhK9tGmJY;eo1^=4L*!IF+l~LKTH+FvFcBbrCe>idH&nvMQ#&Wb9P2FRkr^X z=FT`d&HGOWDxb-$h4s0P(+%3P&Yd1}!0_~LB zhO;{1m$qK@1WOz*Q4-&}m&7Ws1Ot;g5j!yTjd8 z*<95!{nBIEB*sy>^np1yuF~E5*uetV!u?_fEC%Z!E9O9lwp{Hd6X3p3d2amJcUvRaz`d{1tf}3^$*Ki-hSE>Z8CA7Gi1LL8m+NLRNmOOn|gqg&7y} zB40!5n-QG1$cMOk$(p$b{_XMS&moIk@F^r&#lyc=Tb-uuAFtuUJ#M`N@$!|p5dBd3hb|#I?t9G(keDa% ze=4hhZteI|mBvn$kr9#EQ&)e*{15K8ViK=H4&$q-sK>=UK3j(NmX@u|lUD&QvSV>QV53HOhR2-SU+HT2 zH2L@mXLFd`jZ*<+A0%x5Ct6CZRnT1wC;K2qHQxpjO!nc0kP*A%i+jNH3m%*(W!$d* z#xk{Fyd{F4PG07IgS}s^w18 z+p!PdW%g$K zCXT|EhtKOQ!+&%vdCH}!G{-ya;w*scg!*Lh4<;`62%bxsDB_1-M1MZ@+)LiY2ANZe zd_b_eyODADcZFcA#(nrUEb*plU@Ibxemp@mWWTXJ+HY69RCM)JVCN*Nv{K-N3)uG; z!(i~u_+Uf=8#5Q42R)5w*^%&zvhOm)(;!M~$s%EaxN!A&GNX+Xf8^`3TmV2+FpLf| z7pc1q@Gm^U^zcOtE^TQrt5mr>q_mU3ylq+eJ|OSwDj_7n_*N*1{$y;TJ~noYw%wN{ z$AmV&ahoQNHSzRDv;PUD+aRWl?kPA+AgD*kzPi!2)`eS-i^)zG6152GBRJwPfxo$0 zY-8a^$z`gGVsFPzJ zC`C5b&E_I#b|eoqA{(bGDG6s+zVZLh@p9VfK#P?fe&2XW8GUbXrH-islQO9VYb`_z z=4)45Z2b;4KAMi1Oa@=WUaE3f_pu`9dZT&GF_g(C()K7>wSnz0{>Z4SrL`Cw)};l@ z@y79EdIcMPe^r-UHcO99qJHO$_j_W~o8?@9e=_y?b@`Zn=|AVm*!6aicR7ZnZag`{ zDJYi+q|4!V3VaJZtfwWDXnt^->S6XwD>1W_$z30rnL-DY%F%+WuMGl>pS$og{xlI- z#dVGm*RffMWfgk5pMH2y49RULFYr55nzVUmCCIM>bBXc$4rk3d(;FbNG#W4EWc&__ z2FzyE|8i*tamoH}dE7d5Ff+}9Kpc~lO6wCjnul5c_8v@>LLZM8sWd(%lv>>Bdi|@y z`x0Xv8Ar2qHs@cyvHc=7Zr{M@nm$I&G7oF(5F6gzgJuDb-|MRl-wV1j3OU3L!v+%I zJXur2;%A!1)-y8-!7VN6IDImSDj}ANxURUL>qABwoMA8Wk5tMUR&x6eJUNk}O%M-7 zJ$>Y)LFJ~iMpD$8o7=V?))9Bl$GwjW&ac{Yb$D^`H%rpEtz^C%>dg$!{hfJy(6cxi%M;F5Fez zTyJLLRK{5>OcNWkikl3x9}%cEuwizkOB-Wi(lWBX%X}*l3D3IAzPT>H9+Q=2Mcv|w zDlo5#wH7{M4mOPiCYhR-Pl3tPWka-GuApO5#d>qqK1s@YTfV#;8q&_IJOn zV=$=N8+TEH`AgKGU!C9cqw`|5`zXe6G9#dg1uXX__u~K15B8s}W`e>s*DG+__x8Q* zLPz!VlBwh3>5&}brOkbdH==k>-P}W|Oud7I&zYXwMMK>p^iAI6p^_uH!I!J8#)rS| zdcudt#3bN6xFxdgL6If0DYGorcqa9aF3{}^Ul9qP=XkJQgz2T_7>-SjI8QB0twA%) zIciPBQ8YN8`C^-RTzdBi?JQi_W8U7>5f(B)D{@1>k0ChL5pxDJ*zUKU?(LCCn~z&W zL#Ib1TXfdT8uW1!5=35({9uMkw_N>&)iS6LIp96Q3`r{H+=DuCFcoO{X|#9ms?ONC zLFU2r=S!#`oW?sd8f#(boyPUfiJ)H+;j8A4a=bh}n(KZEt(fC>T$l(OVRU6t1qWka zw72J(G5g+NVsC>nw6;C+du32G-(Nnta;Wx_y?J*f2=2YD!7T1-_5{MW0mNE&jSiDC z%FY!zuA74z4~h+E?THasP3q>o6JDbC2SknsFWF`H3KqXd4aHEVYva!!HTajW?2KnA zkz7RWSu8O4(o8lZ4cT6E8ewGbx3}TwgC%33*Sm)=*(GJnjhBxcOBR(ZU9z|hF%FL8 z(gVip(lvv zI$xqO|N}THmb_ zfiR|g3nW)^7`7?!w7B>MGlEnPzhzL?AAl6B+B-5lAF&C zXAbDI8d>25&n!aAak@s!4uvFO;tg+MvOvTbrvBD)>Oz;KH!I1Ej|Qu%}&75!Ey+y&E(1P#?E2 zUBdCS$Q13vy;e3UZE@U_Xl%^~Kv3FxEl>OK?KZUf{LKORv9JgL*es+_TwzlXr_fbi z1!)KX=&Mr0B{qH&zhZ;#z)Mvg3r&IcMTqzWi5-O;<~g$CXFy`j@u(^#YERE;Yoibk zX=m$`XTZ%9+Bp+2Bj!^P0@Cyb21+;*TV$|EAI7)0x4DWAC|{1+#))gD2Z}0yaPh^1 z7dx4D!8m8lE=a}>J)l?u=h7C3K7towf+z&2$AtLZd@~n)ijc@qrH&i4s zRX&qX;`j5PSd)Bji+|cNW}SPquRl<+bKgv;$UJv@oVRP-6@Dxt#0E9idboTTdeWQT zMH^wa9%AC=X#_-m387cOOV#icJM=$clrI}MmRIO5 z@&kaChYw%X6GP|===#lhEDP1>_Gd`4p1gIC zMDCWDHU}3hmW)ac=e;mnEE?np?R(x!-E|%19jusM#c}weZH>ct>tSt0LS2~Fc;K?f zSYW%BAu=x>IUtGAg%y?WEd0Q&VsQo{6qfmbL7cl?3_ak^rXqG^>w`q6Tx${1^NzC3 z7WEY9f2K=Ep4V^U-?;x)t|8?uGGyMIxo>m-D`vi8Ax3NZdqQoLWZuwcPBMSkV9E~i zKZ59FCV+u9(XIFd>DW}uX;!mYRuqN&7J)w8I_lo}WJzb{6HaqV=cvuQ!9)cvo)M~; z&dM;W!c6Um-t7vY+52Tg8kVv=E!6ZhA)URYn{6rZog^}Dc!wy`X9uTd7W`NqxI-kK zKlQX2T5V{1y~<|)qxq{>d*D_5H>Km4+?zV|GYPeo!lh2t^yDL3>))n(gpl9s8T}3% z$H-q^Qu6*RB!&5P<2DuPgF~EU2(#gVAUUyVbF;SO5BP1wDIPL@3H~U3m*>T-LRZ=I)i#?$ z=GAdd$3hA#=nGguqpH2%+j1b8sb#}Yu_s`TFe?4p-8oWd?~vE|UZ_Y5$uxSx$k_+X z5!GXg>C6n_@|)7mI#_bRA3rnc&w=%An7Yy=@`J#a3y|t1S#(<~+p-TxuMPg{-ZmC~ zOGw8Oz1WZRQ+)Ey4qaBTp8mryB>(8KJS@K05|c61)c(`XZE2+Uu)NyZ+{t;lRZ1CY zAem6RTnpd);+L9g`ZR<=GHZ8xX|HcF^Sy+n=hZ4NoYj4;!K$Uc(lP@#43x!GsYS{F zdS6L8`V}mG@Sw+)!|-%2WwkBTddT{EQtfupiYJh z)nfDW%5D_PmqM7qvvOQG+W$365_K+T1FVq<+5{Uq}CqM(dPoouu0UPM=(_XA^KX>$mZjdsQ^2y>zrwN&BrM$3o;_p!ym$J!YSJY-=0o4n+!C& zb`+946-yaaIsXzBucz}SxWNMRCrPF_^&TYY-_QNG|t zOT zwMIJj0cjQFjqXyXPBfnvYPu_=Yv1L7w|(8j{U#HvKTj{=m9!cOu4*`!0ELEdvdp7o z9k|8ND+gnx^;ng>7`OYy%zYm*IUl{69!d_cA?hCeS!@1?)Tc8rsKoj3j4)_yr+wxT zhsYD*>VNRpw^XoI>fTfnOLvUr`_k# zI&6MZ$rc#EW`N6Dzkb5{O~yZ<2Q+T|rFc6Zzuau3Y5&bbvglUVcXVpXF$XzR$e=Z3!q&BJ=VLz#YS0 z%(t+<{z*`$%R@VJW{fqo{}EcV4|-h+YNL|F0_V-iDKkpGzrAvo0hG{Tv|bED z$6w(>0H}I|b|M=s)DBJS>GFmpr*AQLy1gYZ$;ge0dMKE;oxtKO&KDFof`78<_$s*oxfJ2M zq&MyDIm6nGfTwK_(WeKa`%Q!qs^aPI67gmx!`|VT?G2j;8z_k@8^4}Kh`No)n;>cJ z=YEtY2N3q&vp#)_omVRtR}@Ng!OFAZhe@UEScs=Qno+IEvK&zXIdGcMAWdsyli5Ew zDy-xo6=n~BFcMc(!Kv%LE$^cqK6Fya)B6k2Y>y$@OiOtI=oxZRE6Bfg!v}2vfMB+? z+hfBBAwEK}9B((A%VX9Ayisoa>&$d0?cecTSEh}s@eILqG@DMJ#g4=a#+ z-{M13u!|eQImF8O4+9vv-GQgmO+Wwdq@7fHE+jr%zhiPc#ghRB)2z>2zu+g z_&AbVZiybV4RZ1IF%{&Q7^h`O`KE&@(CwX0%z`G-A$l*sT5PC;V?^;fgwJ7=5OOZp?o5{-8uEjQ&vyz z|7gLzE=F}cF(_qTC?Zefs&QS(#|wY@Tgbz=OwY7dm4ojx3Bm^S#3w^w%UG5virl~L z`j+W}kn(PP?ocA$Q}4K8L!@&D<|4R5#UZ38uOskJTucF*xA=?fssLlPp2jTmm$04f z7LXVm9Yk2n-gylq`8>!TnY-=ax^d1}_$tvcDMnvBWVLWFe|?M%0*ng~)|}hkW|N|k zwco9^L*{9Xlc>@E>6;rV6~(>$`13Kn?-*glh%J!b-6RsVz3E`yQex_|qv2A7E~Ds9 z3hwO_c}x}~?s^`*4lq_42!2ST3v(Zqek57+w=A2;dhCs?cWA@;#6h?uz5bKyEFb$2 zF8l%+0+3wU>0-YSUOHNlwZddr{Gkm`mHw6aw=|8Yz{1bx7eo-yQb`b`Z;n53p?OH^ zeHGQD)MaxEL<j>NGfmRot~#`V7FQq;$5jZE`6tUqSfzdZ5#=?H!Xa=Lhx-gss5bnnj)^s_| zdA)IUgvoUG7ZPm6!&(y;`$Ub=g&U$}Dd9ir?QAG;Lo5ie%(~W~8$>-y1Cnw|mtF|g z?8OPl#^ku0sX)v;e8i1%n5XlOe`SChl}L>hqW(R+*S$n)H^Apd_z7523%__Y?(Csz zZG#IHKOuQBmX1!(hM8cP|EN{s4tDU!!73$R5M(*6NoUazo{j7Sg}`e-@)X@oXENGh zM3#7qkB zb|f=J>)V{HK}q-cuKYZU&fsz2KmP8Q_Z`RF)>42p->8TXMH`MWO9} zzP_kf_s$!=Qh2qc+eVG#>1c;HH5vaceqAJYyR>wVbiu7vZl!rSm$5RoaL2lrC)hn-pcoIXt+Md?D0c9&rHJOy{_Lt3AGBe~F_H(p zdD^@6)&(<^%3)AyyRj0CsgaaA>{P-7Oy3fT>w$;&L$+$DYSvETi9X_Q(9M{ZnyK{aw)TmH~L>z3$t9=G*z=!p%+ z`f9EYnUbNe)$c&1@9!f~$^8fg}X@3-S@v1N=c#9f6H+eP$gH+v`+ifY+j+nULy{+>q z$;RY3J&Ri>=)!dtn@4#|&Dms<4Q^FRLitK^%OB5~3he@`2lg+5Jo!_m6WZ|?I4Jzm z@wRDpGRU){Z!_u|l|7TeCMo_YY54T_EtmB>rIMYjGtZK`f$2tvuI?)1Xux%pWQdIG z&jh}p!)RwLNP>-7Lh*-`SHuRjUX9U$kpJG%cx=yS_7*UDHV-7c$S^-N>u6q~AByfR z#-@40ti%1C?12-+fUM?e&yV9{QSgyDGi2Qxud?EwaXsC0wnprpgA+Ohh+^yxTEA=Tm73b>8~)tcJ0+)!Fb91UBn%ae~nXvv3^ zP|#}jLM>}oPkQ*W;TL;T&7c%Hl7DA#7=J$P^|^Lm%ZS$Px?A^4u8LHnFPDSZOHO~> ztU(ga7%+}0-wxdDunkt4{iro`VH>S+>VlS`gJP+dI{ge9GkAf#9+9%`IKQ-62xwlW z>ay9Pe5tL1H38MDSQD^JfyoUi+uXcB=GW#qdsx)0>u$E#QTSE! zcHJ#D*5cC{vHrK!I;X86rCM!!jYNF?uv%uW6vHa$;j(Fgt z^8v?Jm+0cLb_dBq4woyA&p@Eb#GpEt9fW!@uVA1g=pnc}cmss3n(zeBABTZ3<>_rC z7^bu5O{h}Co4}$=OX<@ChHoYtnX7@0?yP!9R>rp~Zt{KO=F_DEpfB^LR;gaol_-4X z3b{i-mB3Q0dhml3krifgTefVRj#n%HyHwhj)NQBbbp9Xp8vW|dImaQZMH(CBd(|GB zZ2MzcO5w{)1d10Twj4-3Q)cZ3*QW%e(*)Jj<%eqaR)@X!&2yW{f7G)pT9H^Xc-?hc zcHa(={%Xavl;7fmw8HrAD_agP zc8pYXZ)3NB{W$MS+iL4iAZ&b7&vJ?th?KSBe1GV%>`><>M4mPhfeLp~p_J+)%Aw z9j>W+`;QSkW*ch{0LAmW*tf4`bR!PB^GDv;`u8p7UoWpYSoeT7GVxbVdQ)LM_MJqB zlc|Yb-`@7jB+pBqj*v>z?iMVH-;kj?o^L?~+FKA`HxWp0@UgrVF7_Jc+a$bAnh5&s zw%UWjrT022`$cwC4enT2gQz=(w}2|gAo~{hrZlPX%Ez5KZ7*|Le)fdCD%6|3m1(2r zA*AfpnA49y+XX@71Qrv3#|wOf6UPcrtA(m~ja}W>7owNX`uA@pcPACC`DYgrQ3Y{S z6Q`Mox|Z(VfyMzDBG3*40ODIXQ6C$;NVY!F-9dARjMh-P!@(x8c$IGKno6*8ovE#Y zch9i@CGF!9Y6&*Lf#+yQc33nLu3O$wJp)>nL;uW0PgQTrgmk#~@85L9zdJqduR7hw zQkW=*lN1-B6zH(Dtgb55#rH1Ufos%j3|(wZPc_wW@wBTnt(iU!qXAe90sxNzh~pPd z`*B1uA7G@2950k%vpZEP{4m2mFzuSFvIp%(SKe`;K2Cr^QIo!V6!=P1|GY5LX+%6~ zoWaq&jJV`oy+)=Yr^rGlbMYd?Gw^ki;kci%#XVYp-YjbyAm~cb)s<_s_3rUN(T#c; z*}nj9n^4)(S=-64QvoPRX$%z|KmRwq&j=$rmY-Bgl&@2>`y^#|=Rxw1RVRLC|9ki^ z*N7cwi_Iyn^&h8m8YikS!A?7NE#JJ7C(*by<@BlB0U3p>-5i(R!NMJnk!{wAd_N~d zMMdb6ie(5FgS*;Zo>$!8_CJ0LYE9}Hy+GEQI;JiH_KxLpsE66O`b9HyR zFaCNv)ib~sWES23P*=s$pzagZDJ%g9eDRCesbk--5tlrl{|MqXzRl#A)84AQ+yr11 z7W)vWJ|+{9CX%;(X_C?^D@KOBo~<|bq<&HL4gv*WaV7GlH2u||^rxuNk3XjXEhF(F z#|&U|X8?GRaTcwByhg7^lA;q!2EJ=kHhLXfk;5+2xrAHhBI-$zXU_w7*O zoRu>hy~DO;Z34gDqU-sz480s+)hTQ8q&~&PA=tSA3pps@fC5y%mZQw^F89ks>konN z{WQILr0RUQ!YEAW#LDlj`tIELwjit#6H8WzhhoYjwTM)jEhgK-%C2rKbHd*_Jh?0e?UuNsXn3+Uv!$2rv3b2$Y2zwQtflKw)avZK|Cx-$Fbc4EMdpB3veU5V=$RN$knwnv#qrx2EN?v zmn@ND>R(w#RPe0SW2XmvOtCDHZwHJIId z!%bp)EW15l-5Cw-#LcZbZsg8xuGi_Me%jvA@qXUY{N%Ha3UPFQ$6J+LBF zBhoj_Ip6DJZ2Ai`+aGf>Y`D%WO3@!iOMebJ*x_8!+ zd5b#KJ#I60*CfK_N-c%vB+b=ZjJuY1WyiEt>@-iS!fkcrJ&R0aW$uU{=4U#EbjRMR zHJAJeLiZlKi5G{mn;Gv!;K#zTxin(&fzO6wEy@~%X9w%O|~-R=qZ)wP49@`rV$^-%UB9~3&;5l$dB=g?H|;U`{L3w+GuI$S007Udv4e(YN$%Y-FE~}!5%v%Sw=JKb9-hKwDz(#oOLKz&qN&o!#iK2* zr|Pz^@cVe8-kwDFhm2u7Pr`e>B6P_i)S{DoyGT)HF`?Gft8Krmv z=pOy0++-DfFGX4c%Tf_%5FZupo_k=2)%(Z@Z0huad(UButro-gfMr|tv>!9P?{Ml} zBa+M)fZ?a&&02$TBKD!Fs-zv*N-MAnzHN2QqKRFBQM=6Zh@* z<;W~Lnv3q}E9XD)dRyWRrb*X_%#Rc^2h`v6_d@l0r4_epvA1s_)ju3pC%|LJU}RC{ z%G~B4ln$#|fJbO0d%5a<+<1kw!pB40(s}W%%7T`gB!Z|sf4@jJl~rS0tB4}kd&fVU z@m6vCkW;Lzsic8JUwztXhSYJ#x(BYNlUaqBc2GMCZyf6d*ITHAtV(4f^<0@2r9i>% zre%q*h#aQ%76%Y@4)aSpP`Hn+gKF=Dq5@%N8VtG^u(>oIo5pRcSFr2+hJ0n%wB3>zfH=Yg6TX**eyZ1ElF2BnA0EV|SCV1UE>)JzZNB(?)t`d zUPeXomhyhRe33kmc%yX;T`;pkOrE{_lf9=W*ssu+KJ3 zW$L(`zTg<&fzkLfpiU~HT7A8SIF&Y>Y{;D8>*T#}-&c=*b~NTtUj2E84b)aUc7{a5 z9ZJ8CUJG9a6F`paA7kC?O2~f8O@}SbRb-)i^B|`=9vv{zsoy#FXlRFW5-FqJPo-c5 z#9X(uU%g`ZXNPie9?U{Z!Omy${Xgyec0VYtmGjuL6`Aq>^nZ(#Zem%$BT^#uLN!J1 z3l=T6=bXO_C36$Y5U@h%D^f5tqvzcoy6~~xq)->aX^6Pr zQewuw2)=I}LOWo(&n(Vg<13%fvyqOHCDll!NYs5d(Y(J}Eoyy8f5Yi1pvpEcDO%#2 zB1d%_(v`B~3h(bo0Z-xB#xAXD0kSIa5RZ~Ap(*nOD9O<4{xJTy9#%d+KT-RkNA=sq zE~5wKe=20_CM(zfG^Seh-^7fR0&~a-Vpt6cgr$#>ayV17unzlFV3&O3Y47byJU}Bq z#FmivQ7$z);}Z>fZ?CFDPHP~K%Ma>^nRdUVCkGqq9d|TM)o!ADqoWwrK!0qVkhXC`~2wx{iI1L4Oas;saSz9hKR#XkG;p z=J+Sy{ia{WS!Kt z09qERKBNP}Ggr=1BM?RPp?9zgL%D`0BKe%v)V) zGv!*LD<8ca0M+{@a!BOn_#qOqYf#@{MaQk7l{slIZ{f-)Bq|D;UIv`Lo64Cn&CK4} zc{xPIsEn)i@v~5T)r9gYiEnveK_k*q(m=NmcH!E!!&0wuYYEuRD#v}>{Hc=x)2}NF4 zxbPATbOhU4{_J{IczCULzdlE-kBy`B?~5Hx0f}G0sC!}TFuvoo4@iD0Hm?_Mo6{MR z-btq>1jbfSXTcVU{QxS72b2J*9rH7$_K>qB-WENUA8DR?l$*%X3=%GvSoY#=@KT`K zKYE!ndxw0bgB7*r5!$*oadRG2g1uB#R;&~JW&yZWg2Lj}8;>SN>zCuU~=ebIgI-O%;Lp+ry` zZ;sW^xO}boHU&mthXT;B;7yED1L-_NGdS})fG&{d$Jaw?l*#%x3EAj=wXOm6;hU?Z ziJna%@$4wPuftV~OWDR#FQq{&g-AM9k14JT0e+y1CZYinr%*ekT==$x`wojNjc2C7 zaLae54?NM74AvNE40M$!r7JF4RK3e4V+CRi@{)O@($(O8MT!Y1Xy z4dU%mH^r_^(gS<%zF)TFEysAf5bS?;8TFrA7&W%o6A-O_=~;uw5vXSHkRS*Z(M- z&A>o>dNRzI4aprqAHt)Q90n+OrEEtsh6QDTMJ&raq0S|>>EO*N940hLZnhAOtYu*5a6`&hlYufIbA^tlfVYBkQAV9hQGo53$Amw)n>k2kfz16r>~9@;mz zvKu|3@q7&5xIl1IEm>JfX?-;atxz|t*P1bh7cN7gfwzCn=9j`GC2(f2vOS*8M7Pyp z6Rbujx{)A2Vx2{odIfKfg8<(Z@|9ApMnKEr8zpG3wlbLAP7Ce&aem`WB>@Wez5Zl zo-9Ed461js+s#hji{pwzj|GsF=q8Da;MmTu4X4X;ACgTrl z;+If*YC+Ez4F%2BN7e$hH0#|;br%%yzR{H(ah1ASLa|{(2_lp|VC>hr6?V;LyXal zA^NGO$Kj6*tmo>kS+yQVZ_OvNaW4si%_n7#-EbSDG^D(SL!OJvjtx_f)JpqKk*Wel z?W_GkG1F9mW5^W%nZon|uQt ziOvEs;8rYhi`)m>mG5j-txcN5@)Jpv#Y-fi0H|t2*UosB?&qz&f!cy9aaLW{)N39q z;bMz9Tp<^i4yVI{_vV`YnT790o;oe+l_oCsxp-V{Zu;YVAEDGvbp1uk4`Vkj9ZI}{ zJ<45L8T6G(Nt|pr9o-nqCIBAKMo3^?`+{<%EM^C-uRw(O)7O0+JmbV*+6mUnPZ52C z^(!#+tGgR%AMI7+`F$e4z|B=T_GCnwWPz7rb@x0PQRDgePk6a~|0hDaSOZcoePL^b zgk|x719*o-_HMaEu|8Fbz&YhgvH0=A>!meSS3nimz-Fr%l{DbrDcILCp39UcCcbhB zA11^!;BFk*2-9VJ%nlw)`LZyp3?Ab_`0*;uQME1&s8ouP`KU@;T3{Be0|>}9ymQ%@ z^>tk{ooDfdOjI?)9+LWwcv-vlH`EUwMSmY?GRc-=@Yr1e&rTpDu&FrX#P+O+{?>0g zX}1eNqE0AS3x4fO6kYGYR%yl})vd<+BC|dA;IIGFY-AeAU208YR2Y73Dp@#2U4|Z|u^2 z3b|}-NAEX(+o!-?xh9d4l^i!*28+2Mny$6?cyPAlsSOmaAvZ z$P6LzDZC|)oEl_)R8FU>?C!RWZ3>qJdrtUKo5zWyEL>|@`XXa&VlE<`{3XS@+ZAiB zACKevpT1Shec&nB%YIug2z0gy)54ZR3gQt&^8$%PaK$=gkFqW00;dRd$`0j0|B}o) z+xwfBtY6bxm=M~D9)9a9OHY|-hVQyy3g?q`QkwGQRuQhipf z0=g`v=10o^3|$a32M@mTk*C<2&mWCC9OmLvdN1)3-UQu*!?bxtwpEy7^I=jjLH$m& zE(}~@1MA5x-VY>rU$(AF)UrbV+OG9F3v@1pJrn$VrX&fE0FeX&9`N+cEv4Ku=JDt4 zVVNRR0#ZV2jx+OD?3Ct}N^HfAYRbfGwzYfjlSYiVSUX<`r}Vs5C9ss!TkS!r13*6ZA0%$!U{r)Z5#_4dBb+coe%m%xN{^Q?c=m$tBJ( zjE?7G!Akl1!ODxNfI2+#RUPY|;RA2OA!LaS8a%@9<2gTu#=pf)kU}_t>2dKydbe%`xpeXkr5!iy1A zqn7FMbl?0fbwL-!h&^#=Q7-CI#VEk%ekrzZCqJhjJk|LX0UZhk-1@qWuf6dBMGcu| z1~NN;*@Ft+*Sezpr4R%DvPX%PX+sbE<*n`k^r4aKKx%FhxmsXSELgG{U%U+M5?;*C z%3}~PhK2N~*n(v-gd7%qJ%0l3{@Hx5)j^9Jnfob=yyIX(L{AQ$$RS0@SujZQJZ4vx zEa1yP_TK3nV0UM{BigI7(Ya9;fM4hmeporZqgOe7nNLvj!`LH(L-}g>VgWiq2=0!_ zuO9q36$|#Vgu@}%5zZul?yGHJ5;qJs+i0D#vj%AfH)ZT)5C0h=BdZJL7LUd|6lLa! z4i&u)oEpwaqxxnu8U8daR%Vk@tUa<^-o8v|9slCu0{_uSO|0RYNsa^Wqn}qq9)&XV z+ko5%`ya2uO;TXHUY4w5gK1s(wZ2V+s&$7Jx_RAfYmfd(xJzehKN9Jcvnsxyj)&3Y z#rLut9H=l+H*c^lb7_uV4gFOuPM=55YSi#FF!2>E{1A55E*pSHMuVO; zti3e`>wt9=ihjf3nQ;M1zJWEs?{`ko0or}G$>POcR#8#q`0PhFv(Ic4kN!t_NSgl~x-O>qhk0QU9<{zIR5>eT?S8sc}$j~62H!xvJUFhxWZ%CK-ix|`JtDsLC_P?Gl3t=`*uAU<^k&lm9iMV^ z^$xw2tpLm72bxv>(_s`l91WnN3HxFd!P=C>CuJbsD?qDu*9HKNJY=)+dheTqCwvhS zOhWE=u8FBFHZM_9&TrnN6l*%@mE^K_i))g`dBc1;3aJ-2ic4u zU!DobEF9|tzC_<)|A00!3XC)Iz8I8t7TpO_*|!Mh@8GXujlb`jHUXvRTeseYqSskQ=f^A+D#Il&GNL_TR7It&Pw2Y z$PD!M4>FQ34pLTD`yEudT~w_fu*;>syF0&^aI#6{H(|jc10$G=!SzNpH{N-J2Ki*) z_i($T$}AEM(DC$j@b#%((T9ZM9dWp)(H0sk+aa5RjM zb|*(+qbI@b$8V)O>x)$sB>EFg^D>U3^-_{j+_y(q2DpEAS*~*rl=FJLNrHWOG}aiT zLLDg!mZ_|46=Wv z`DRc%@FX|A5>ff$b%M@HWw0+}YRwC8#T#x)subK*DKwqAf67GE`X6a_T#r_F`fQVS z+s|Km_AA@2%%pHgZ}-hhR%|G|SRhDxNF`vDaAsr3zWEUjRAsJge#yo3tUgUr)nA<0 zw>P?GInbd9M%{4;t~re-#p>#UoaH1G5xG64N5*Rul+5GYoB-B z;Tbx+dk(6zf+i%peJUH&@l>LEkm((Bvth6N{@hI4z}l%z&{e|JA#cJk<)B*Z;4H%* zd}n4*kANQopnQ@*=AbyFfuMy1NNRkhbi#(|1nCd}FC}|fn8HFbyWBqr>x#NOzG{XE zVbm6NW>%KUZc@$6F!5P5hPDi>hj=tUDZubc&~+z;HZDy9{C`iP^}yg4mb0?bnH|%GrUS#}+ z3Yx6c&0v+>FMN=YQ|T2*Wn7)}ejyt%>t< z(Ze-ilIpZn$h2S4QLNlzL?l@pU-Du zbx2`o3Oj$*V_m%z8N;Lt;8lzJ#ux^xHVA*!2kJE{nyqS4&4>&<}af{nQkYuaJ|V(nE}0_(r%N-h;)--x%KZJk>rQUu zR4HINGNy`BV-ii}E~WIYd2*PJq&_@$hAmmrzlk$qaQ%C_>y8;!sNrc+^)Wg@_=ZuN zr1a`rAeUg0ziQ=ZdyIt|!k8l{$U6d zkM% z66AJtKy9uBH;LW3zt;gA2Uxhn<%7aoqH$aX2~YLC8~*Zdpo&)e37Y4Yog++;2~KKU zEgBaOu6R;;`;{@Uj8JqB61Xs&*7rjF@|N+2V$|EIdjFaNg!zlrc`k)r!*Y&-V-P0h z4+#{=$6UilcHu(PBC?eaO+Kl}tY`$<8oCN`EOLuuQAe8r=O=K6 zC(k5{VJvAynA5*-Z}jU+d!kr~uC%YDOEX8`p66{p^;S?Ylz;PA@c}XPq#i|I&}><- zidl6&8(MO@3KF`q>-uRH=v+ z7_t(sEq{aCuM%eVu5nW_{m7g00mjhE?cZy75Mw|taYRkC^-HkI1*Icu&#=#p*^@q9 zBzOIgbQLgm*ov^&N004@J1MRLu1@kHjTn0$*CtI=yQI{Ymx%?p5}P7aT@1TnW&S>H z^!{Y5z#d8dRUG7}Sr3t59sn#;m*)nFj`_M+NMvgeX7axsE)tTyTd_C&ggr4GPEw~Ytb^i;MVN}u+O9v^O)t0Caigy>?*p6t?>)@{N}C?V z%%xwZ@(vZM5E5h~{hdGtp`~+B*ybIK@@VB6(c?kD(bkp9M|9r^Ti0;6Mp9{C7zFjQ zO#>UpHaM(fHU5^3TpmQYbPQhJ6h}vsKo0OHJ_M;0l1|PvEri%Z`Wh3gVrur&D$ngOTSk2VE}0PoWeJelnw4&sgWObGGJ;Mv0pDR_G zvS50s>6q1+u#@`^a6epxU>os0Zy+wjE;G$Ss4 zW((NFH{q(=pX@hXDDxhUHEp5VkJ=rdStA-}jTzcB8x@bnoi9ST4T0Yv%gmk9pn=eNstxM_=g z1R8{?PsR0$`(q7EOue4nBZz2Es-D}{bA(m<{|?P|=wsGOJx3V=Eby>bOqH*#>TgyT ziY9Qt_fi;KNAgf5RV$u|4b$jTw=<6IOn2|dO~18yGnP*kY{+2eXk3HYA8y72#VJ5$ zBR3Ph;t*Ccw8|ZOJ*r`!HJisD`wXuq$N?1RDF|psU7UWiCFG|@!3~qliFidLk&$`; zY637|0Ptn(xpv+5RdqxG;qBXQJy8%#K?P3Bop>5_#?2cbrbb` z&npsIehli9@e2U_@=-IPJV#!16&Obl8Zz)UkIg4;7a&E*2(D{sr%7{fpadCq9@03Z z@TUEmU&c478usl9zi5{(UnmB7G~yifaRBM@*jWIbRQdXY6+F}hE8xK}z2y$FSvkGi zzvf%O*-&+FEEIzm1N~TDb+n+OQPfkcI+bQttSYLb25dwj!-HA0Iq`a&g5<6zCb%RW zEwslMyqgvLelZBpLPQw(O1cv^Y&R7Q36iyrfC7vW)1>-%a@e_g_2d+cbW_Pm>d$vQX(8G`^xq>qzaE9aUJ9_Rq9Yj?+H(#Oi&m?D2Ek zrF*CXhSw;7OHDivdl|h2hK`)jE%h2of^FVx3*PsZW1yD$(wwORXj< zcM~=_T3Jspg$zz#C!}pKzDEF|de?_eDEVUXTZwnxgeMU9f+me|be%w4K7NrcHayY5 zQ$f;LS?)GCzh5gE6)!y3D6wi+ExKrd)J@A=o|>;=Vq5ilH|OeSW>&jLbpDjjJ07}h zcb(bXcjJ@$URkt2Kj}=-jK3xBR8u(BywUc`%$F$liL;+qyQNF>gzrpz&edQEo$fRg z&PdPkjHohOZkm@UNKc4yTqxRePZ?oy|KSd5Z*|`Iwb2S_G#_z)G6Bd(KR*Y`;9(_` zM`lK&Ko?zsLNaq`;E+H1pWpe;zIMv*(FQiHPtImj5OCOMlqv5nW>Q2z_D{c< z`bI?M$)o<%a)mVn#Y(qZJxr}0ZF=g8y$i16rEH*DfQ@fp6VvJT*#--{pDm+s{YQEb z?^V}Tb>CUZhX7_sS-zKA$d|!mE;Y8h8HBzbzGsRQ{7$-t{JKV15`qThq#MhH`!xXc zUf{U?<}4=o9%O(*7rjB^CfmY;?tnmH@@2!R-CzGGg{ z#z$bUMj-dftv_@Dft4#}9vw&YjN|FmByX^#RnT?U*8lSp+^tLIJ&8ScKtWO06-sG=9T?kg0#LV?St0#33-9zi8?E0iEoqinsnk*I zbzixN=(JMr@VkJdRy#}Pv3|+H74U-~%#5E}V{mT_4*z2AO##v#Bq&8pu{?D?$L-W& z?)2AziEKE%`sL(1>P?IGX~cpKp_EhZZI~$MBcOZ=1vz`QJ)Mi)Iboz~%`-C>qI)^_ z`nXJ3zgXp;H=q15i+c>r30T{#_Mfh9Hl09x-s_zjeRKNYB+# zLUxDXNBgx;gGE5dlUhyxnvi~M$ZQt<;0M;JPs5K-_sGO1M4L1(Ngc(wXF71q@J-JR z@6$}Qw#}(2X}xa@4MmI@z%%un;dvzEWpah{(+CH?1ca%4SGB}+Q<%?4)?)L@g zb~Gq(0SnqrYw`&6FfvBM!SMzXY&4|6cBeMA7G8w~PG~=#*tKO>z;$iJCdsi3r05@G z5qP&#?{qP;hqUWgpm={*sk%b=YxZOnb%pE>+|`CxTonLqWdh6cB76mN5`+?E*Za~> z6{J5Z(`dfN?usn;t$RDC`nx^Ya^qL?+3YGK&fxnFzHABg;bR7@YE+Lh8+VMnzFf${ z`L9NBs~7^L-TsrK@{VIx4(rWI4jkoSah~as>ZT}>ZT`S*O%%rwCjL^ zfN8thj;@!f`q}{S2*IB_Vf(I;QJ>|OYq<5O2)#c<)S8biqMdx-l>rf3zLCOxk6q5} zdv@DEFWN-7BG@p~rW`P%&^cjh$X~!h-Brl0CAKo_@TIL@^@mQ|=&v7bO5Rk*A z_C9+Zn$uI3w=I*G(H=oYCwJADq^dTFwX2|IpP_INZz*aV!Oui5wn1bmC%8Yv)Vi7F z%%Mh`&qq}m9{>_0g~ z?xB$`9Wo0yW<^vG*K>_oKBmi5Rf&!#AtMY=am?tjd~3*^78R)VRSU2J+H8T~QAaZ} z>PWh1HW*vHe~kfsBspOoDb?ddbE)ORM-A&*#Oa%oRr)nFN2|P&N6&%+xP%f&&cO0B z!0Z&Ofbp11j!88Sb8y0#kW8*Qa&f_E;4ZEUYiwEX0#Y8u!{s86Z(S3whZY`77d*%Z z^emwyWm8SZ&h3AZw(lzJIn9U4g(4SkzgrCVz2Z9#wtlK6>3m5=v8vz5S}R9rUaf08 z0MB>$cLkP~enj)u_M&9BtZF?&tvHBP2wNX9b2(kd+}&^GetR_{0=Vic&UInS0Do|l z);^PKw{)UwYdBWCL6xSziUS|*DiEU}JU7e$D)0g6G(C^T>e?X1awuP;VKd@POVFNrl}>0)wr<($${+Vo##3o=ksX4$p$L($}y$~3gDNHT_ISv8IA zrZ8smAx^fGZTWX3m*>-vWO@F2TUpWJ*HOOW-%yKNNNXQclIiPOGu>Y66@4yJey`3i zNVD2(0E9jP2gD~T0oo=peCn0~{48xzj^IP;mRUgnV+QD8$1n9Z8>!WD#{7o8V5T+( zoUVyVv#I7d^^>m)_1)m)&w{p_Y=3Wv4>?Bi)y?0lZ5au7hl7C0+$W`|u&vAz|BKkO ziK23NAS(Cd?HqO<1Sh%GJ@vY+iy*0|)tIFAAy$57i@bN+$n@@op|J;YT`YWv7ujh+ z^|s1{;h_NSd%&s%?H4;?u!o7Jm%;oawI8eE%jF~kB5Y>itKoqWJ>8wIo9wNC!)WMT z2&rS0&!X#;uFeOQh9FXgM37>TF@Mrhmz$N+%g{|D{1cKjIe(MAJJSfP2{ zd7mSt@g&5Gc$t;bhI>WcAc~RlF$m_@>GCZDF2!E^T-zn~9Cy#b@>m5b1N1H8b%+50 zN&{RF%*yu}#YB!)5`k5`wJzf`++xNS}r~CG63_a)36TKa$RQ;66KPvkiJ7~ znSUWEcxUP;IAzVs7FoLQZDPEd_x!%O1(oNfc=nk~txuatHY5b0rKqL#WadD9Tb|=U z0kdK$Bn*&^fQfsewzv2LyiO@EugwaS5WP69ifM9m(j>SB+kJ0#Ad|2?v?tX8*9=4k zwNB}PSzK>UODj~p)hMy|gIW9Zx0%-6wj+)b(&$$`lCh-5smYZ+UfNl&)|jWYqSQ|| zH&3Qve%?~X_Fn~TuWBgXBgI%hcMc&J3f@!|QK;?3AZ3moKN4{C85+_Yxd zQp-8#>5n_%#KP|4NLEE^>r0m(5`I^wHLqZlc9|Vn{q@CO$l86&EgVylYHiG#_%0TR zsOZ>yt~9a`#`Q2CN)o$|dL2JMm#Fc67AW?{&-5J8_-GphE5M|-rwL-H4F}1(usHV{ zIDf6yTqh*E|DA=2WaLG3LAR-nxB2ncfOJhCWTFJ;UwKjFt0)&2&qTlE&_>sdWd}v% z?M)Mg?ri0XXx1*z!04ug@Fj8Y)u6rJ0-C9lCc@46@pX-F?iFb#i}3*bn9}M>cYARY zaf0~M^(Am@kqQT)TRd`CfVL0^g6^!qqy2O|v^s0zh4l*=??P6Zp64v8K8xOaEmhA3 zQti`*LZZWl1t+NT7DtR&^PXmXqlJG(`~2uz9zhc$J-SGr(E(#^<|FbUaY5V6CdeDr zwHV-fh9?lqO36ILVnRRpcA~pksZ5SlR{GBMj>?73AcT*aq__%U;5kRln{weh2KM#g zORT;GJU@GkPJ8Rxg2}bM`X8P}slLVwzTQ(Nb=I*H(f;^r38B|()(qRxD_dU8I_d4W z4WsL3Rp@{0#dnb4F#dsLfC&1+Owq4AjMdCdnon3o>?8w47oH1qYVtcE>^xcSNPXpK z6`R=^H)`l?+n6=fii()(fxRYwaJ8FMQ7^M`Q{--X8gPLrH0y{>T{`D7mP zC!HrrtZRo1j$x<<3&AXI|2;f$6tj@UiuD1&rj9@}1(xiFsdo*uUupoM?IS>5zc!KH z{?(Fwtfn&sE4O9kG+cQemZ6tsx~Bv3zgXUbB!M3)>&A4L%ss ziICRB^DkKEH@e~3Sx)eYhgHEuG~Q9njc_{w8u#S>&<-FfQ&Z|MHRR$rquiP`A;5#U zRoar;|22m(8}V7}382t*k}Bpo1CSJ!j1)$!*y?TjJwXhu1oyG~_dXI#sgr(3FHTxY z3UzOoh@{uMJhk@p;6>+P@L1LIE>gt-8O(0I6a8t}tZgry>pm3jpsS)GL`#8dsNjYR zam@3%Tn4=b{cc5o`3jc4<*{}|n{!1IOyKe5E3YeFh+HVH6NP1P>@HUywei2X9R3&_ z+JJ*YoAeuDhki^9FBjBd|n=DWFr>l>jFwwWT;9HS*cFO4} z0N$WSg81eS{IK?5F-hRc?SN?Ua9~kJL_=~9n(LuoVW0Uq#Lm?sqqO3Ctq}tD{qOBu zJ`JO2_1T^107nYmaS$D4>oM1#CVj=w73(+9-oOZB0MBdFIs0>p&3NdQ@}TfW>_svM zNd^|Xeb=2ZGO>^dB>A`Aqn)KiOT(zj3<3>)n8#jMbg-W~fMlX5QMDF>ypQMCJ>*|z zHU8)UJAqkA?~plz2NoS@jb=@d``<~ig@oW6wDUh z!ko|e))idDWdTFjt`#ItG=F#qR-kaOm)iWabO7E+*LEVBp47VJ7|L*=TL%A~7*%Gr z{QOg?S8~ZoSOo7wx%y>J6o>!XW(^?E>(U%(V)qH~7Ev?4@z2Sp0iBkX1ap4-%H_Nn z#CLYf<9szndmZ-WjTSHoMoXU#;%jQ5+XOhZ51L}vl8bAFOiYHmq%}W9lt;C zyJrV2X1{LG(^vY^3C87jfEzDEn6A(`jwFi z5Ca^I8(w9{m!GHSqK9oh`@ku8djSV>YPz9eQ5Fm zRj#qEj3YWX^_-6!-xFm6KpOLInDwK1KeS)mustAXyTOvEbB!f$0tQ)si63Xz;)ZXz zEI(W+y^AHkkQX6j(LHZD$e`=32#2wKS?e3Q03lN1_E9FF)1#1SZGt||rX?w)pQ~V| z5z zCRuPRDl(VA0Sx#Q@HHTi4Tc2=t%%8Nt79n@Jpm-;6t&B{i$!k{)~i>J^no_)Pz1G0 zeXFdKM?4XLk=q|`zPmGGFB;OxSXNWN*PPyLfZyYXIb0g@DeNdBnSqK0T7M2NEI*DE zo=3|=uIL~;6TOj_CGW57EC50jCzPp9+gCu$VEm}j$jU{Z^eLtfcN!T~CPDoGrW>@k z@gwYaf6HD1MgbCB6a;bsf`etg`pHOIje7ZNz)sJRpME#5u0pQE7uQ^Y7h%BjTk2DO z+p?>GW7Sc6}bLYN0_=vcJ5en~NS+9N~cb)VCHs2{zywJR% zsSub+vcgDKn%2_h*OF7Q`#|1-Y39aajP$Om$r-X>j{(4LWLoi`_Z5e{V#`6TW|Te< zu&lgK`!{|2`8VgJ3u>)J~}s!IxZ zwspm*X}Mi#>P_edQx9&?TCJ%J$X?T5K|ND}C_?Yz@fu>Z@HEE<<-I=ZozjydRDz-C*9f>V|C&>7tTl~6s^qgi`rp|O}buBJ($L#3^ z?0q#OSAcm4kjp_n_V*Vb*=*twusqX0<$&NM&8G4^y*s}DoQi}lF)*qUZdsVKq~2TxQET!2P~D=FCT*zasWX&uq{y!RIO86NrnnQnpfGDp>_6x37oq+%6=wK11U<1be zMiyW47pbo#SVH|S1$Xc(ey9oG^LEuB(L{$f<2S$|d-;qM%KZZdSD1N%c$7r}HhXsgUo#G+6x1lnKyazQ13%G_LhwEc z7^Vu;^Vc^L;(rsC*$1|Sz?J?CuLWBTi{~2bvC?%Uf8||qQUvU55}0rjFuwE{ox`Gu zhuF&|kE7wI{()1r<)0vf=&usQkCiXnHa~$uM#l{hTleQTR3|nB3+~`scXuejC+-if z1{Q`wBdpg^6AkC5dHrb=&{5xlabwP$+F(K@(H)x5#p?R*V$gIg^Y1YnvIBeS$W6yB zHKaytWY~Z><(<0kTHXr-;QKEKVFO}zD-R?B2}jF~V^^-gc1~`B_5T^O3Z7gmDfL_y zI_lV++GFszk$g`0hfy7;W5X~Y<;6<6KK($wRRpvOOgXlAo6k8AWVY&nUA30ELcdj1 z1&!8np4Rf(dF|+gE0qO4FmTl!L2+%jKhJ&knDdov+gfk>VDYT?s(uXtzkhOm!a5@# z$bxGg5Bqa`<=ZoLn?jSB?1w<@0?NVDoWsY6;zmib4`g#yOm*_Uo^_7DtY&JEMCF&Y zv+UMP^@P}UcB^X%m-;vPYy9|xW zk^=|aYVjayV7$)Kvpd@r?WCzMr6yJ@8;AfCT~{BRkwxiz9&w;K)%AFuT;E1$$X9G zhdD#2NrMKhgmPd{DjT<9E~1MWX~58;b8P!1Xb}uoPKtYw4|K^+H^&lZU=fv{S}fZ? z4s8+#cI1UrjZ7pTt=lCK>|{u+vYT_RO}ROrJEK1*@1JFzvE0@il`Li-_RCSiVhh&B zgMN9%wdmDOpMjs2C0@t2EmO3ow>%u0_flS2c}u4xro}JcJg2Nfb*-U(R(Wgx`y4Lc zII>R`Fk1;t;B&O4priRr%FII zE?BVGpIqi(iSQdRkU9PP^XR1fzt6#wakBkN!NE(x5{Ga7BZ@;Y9je6P$vM!0Lo4xD z5Qi%9R}zPg<3JLJDsiY1hjG(i9XO1e4kU4?5{D{r7&raZfkP+xR}zPD(}5)Z*Qi8r zm22~Uryy(_om2Wo`u}wetp2lf^5Q>BCsY4fI=S{ArIW+A{#E!xF&#+aP$dpkBKXis z94Nt|F+C8(p-TKU3x_Iks1k=x^6zOljGGQ5ai|i9Dsku}|LVY@lRS{b|C~xtQ|K49 UD$rkg2VF^B`Ns7kMXS*N0+I-&^8f$< literal 0 HcmV?d00001