From 400c81bab97ec994ee47ce766d7522617aeb77f2 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 23 May 2024 14:31:11 -0600 Subject: [PATCH] Article: Fleet 4.50.0 release (#19211) --- articles/fleet-4.50.0.md | 138 ++++++++++++++++++ .../articles/fleet-4.50.0-1600x900@2x.png | Bin 0 -> 53257 bytes 2 files changed, 138 insertions(+) create mode 100644 articles/fleet-4.50.0.md create mode 100644 website/assets/images/articles/fleet-4.50.0-1600x900@2x.png diff --git a/articles/fleet-4.50.0.md b/articles/fleet-4.50.0.md new file mode 100644 index 0000000000..dd728eb897 --- /dev/null +++ b/articles/fleet-4.50.0.md @@ -0,0 +1,138 @@ +# Fleet 4.50.0 | Security agent deployment, AI descriptions, and Mac Admins SOFA support. + +![Fleet 4.50.0](../website/assets/images/articles/fleet-4.50.0-1600x900@2x.png) + +Fleet 4.50.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.50.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +* Deploy security agents to macOS, Windows, and Linux +* Policy description and resolutions aided by AI +* Mac Admins SOFA support +* `zsh` support + + +## Deploy security agents to macOS, Windows, and Linux + +Fleet enhances the deployment capabilities for IT administrators, particularly concerning security agents. Now available in Fleet Premium, this feature allows administrators to add and deploy security agents directly to macOS, Windows, and Linux hosts through the Software page, the Fleet API, or via GitOps workflows. This deployment functionality requires that the host has a `fleetd` agent with scripts enabled, but notably, it does not necessitate MDM (Mobile Device Management) features to be enabled within Fleet. This new capability supports a more streamlined and efficient approach to enhancing host security across diverse operating environments, allowing IT and security teams to ensure their hosts are protected with the necessary security tools without the complexity of additional infrastructure changes. + +For users who self-manage (host) Fleet, this feature requires connecting Fleet with an S3 bucket. See how in the server configuration reference [here](https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3). + +## Policy description and resolutions aided by AI + +Fleet aims to enhance how policy descriptions and resolutions are generated for policies. This new functionality leverages artificial intelligence (AI) to automatically populate policy details directly from SQL queries that define policies. It is important to note that Fleet does not use any data to train large language models (LLMs); only the policy queries (SQL) are sent to the LLM for generating descriptions and resolutions. When administrators create or modify a policy, they can opt to have the description and resolution fields filled instantly by the AI based on the context and content of the SQL query. This process not only simplifies the task of policy creation by providing pre-generated, meaningful explanations and solutions but also ensures consistency and comprehensiveness in policy documentation. + +This improvement enhances the user experience for administrators and end-users by enabling transparent communication of policy purposes and actions to end-users. This can be especially useful in scenarios like scheduled [maintenance windows](https://fleetdm.com/announcements/fleet-in-your-calendar-introducing-maintenance-windows) visible to users through calendar events or device notifications. By automating the generation of detailed, relevant policy descriptions, Fleet helps ensure that all parties understand what each policy entails and why it is important, enhancing the organization's overall security posture and compliance. + + +## Mac Admins SOFA support + +Fleet has integrated support for the Mac Admins [SOFA](https://github.com/macadmins/sofa) (Structured Open Feed Aggregator), enhancing its capabilities to provide comprehensive tracking and surfacing of update information for macOS hosts. SOFA, known for its machine-readable feed and user-friendly web interface, offers continuous updates on XProtect data, OS updates, and detailed release information. This integration within Fleet is facilitated through new tables specifically for security release information ([`sofa_security_release_info`](https://fleetdm.com/tables/sofa_security_release_info)) and unpatched CVEs ([`sofa_unpatched_cves`](https://fleetdm.com/tables/sofa_unpatched_cves)). + +These additions provide Fleet users with valuable tools for monitoring security updates and vulnerability statuses directly within the Fleet environment. Users can access the new SOFA tables at [SOFA Security Release Info](https://fleetdm.com/tables/sofa_security_release_info) and [SOFA Unpatched CVEs](https://fleetdm.com/tables/sofa_unpatched_cves) for detailed insights. For those looking to delve deeper into the application of these tools, Graham Gilbert’s blog post, [Investigating unpatched CVEs with osquery and SOFA](https://grahamgilbert.com/blog/2024/05/03/investigating-unpatched-cves-with-osquery-and-sofa/), offers an in-depth look at leveraging osquery in conjunction with SOFA to enhance digital security and compliance efforts. This integration underscores Fleet's commitment to providing robust, actionable intelligence for IT administrators and security professionals managing Apple devices. + + +## `zsh` support + +Fleet has expanded its scripting capabilities by adding support for `zsh` (Z Shell) scripts, catering to IT administrators' and developers' diverse scripting preferences. This update allows users to execute `zsh` scripts directly within Fleet, providing a flexible and powerful toolset for managing and automating tasks across various systems. By accommodating `zsh`, known for its robust features and interactive use enhancements over `bash`, Fleet enhances its utility for more sophisticated script operations. This support not only broadens the scope of administrative scripts that can be run but also aligns with the ongoing efforts to adapt to the evolving needs of users in dynamic IT environments. + + + + + +## Changes + +### Endpoint operations + +- Added optional AI-generated policy descriptions and remediations. +- Added flag to enable deletion of old activities and associated data in cleanup cron job. +- Added support for escaping `$` (with `\`) in gitops yaml files. +- Optimized policy_stats updates to not lock the policy_membership table. +- Optimized the hourly host_software count query to reduce individual query runtime. +- Updated built-in labels to support being applied via `fleetctl apply`. + +### Device management (MDM) + +- Added endpoints to upload, delete, and download software installers. +- Added ability to upload software from the UI. +- Added functionality to filter hosts by software installer status. +- Added support to the global activity feed for "Added software" and "Deleted software" actions. +- Added the `POST /api/fleet/orbit/software_install/result` endpoint for fleetd to send results for a software installation attempt. +- Added the `GET /api/v1/fleet/hosts/{id}/software` endpoint to list the installed software for the host. +- Added support for uploading and running zsh scripts on macOS and Linux hosts. +- Added the `cron` job to periodically remove unused software installers from the store. +- Added a new command `fleetctl api` to easily use fleetctl to hit any REST endpoint via the CLI. +- Added support to extract package name and version from software installers. +- Added the uninstalled but available software installers to the response payload of the "List software titles" endpoint. +- Updated MySQL host_operating_system insert statement to reduce table lock time. +- Updated software page to support new add software feature. +- Updated fleetctl to print team id as part of the `fleetctl get teams` command. +- Implemented an S3-based and local filesystem-based storage abstraction for software installers. + +### Vulnerability management + +- Added OVAL vulnerability scanning support on Ubuntu 22.10, 23.04, 23.10, and 24.04. + +### Bug fixes and improvements + +- Fixed ingestion of private IPv6 address from agent. +- Fixed a bug where a singular software version in the Software table generated a tooltip unnecessarily. +- Fixed bug where updating user via `/api/v1/fleet/users/:id` endpoint sometimes did not update activity feed. +- Fixed bug where hosts query results were not cleared after transferring the host to other teams. +- Fixed a bug where the returned `count` field included hosts that the user did not have permission to see. +- Fixed issue where resolved_in_version was not returning if the version number differed by a 4th part. +- Fixed MySQL sort buffer overflow when fetching activities. +- Fixed a bug with users not being collected on Linux devices. +- Fixed typo in Powershell scripts for installing Windows software. +- Fixed an issue with software severity column display in Fleet UI. +- Fixed the icon on Software OS table to show a Linux icon for Linux operating systems. +- Fixed missing tooltips in disabled "Calendar events" manage automations dropdown option. +- Updated switched accordion text. +- Updated sort the host details page queries table case-insensitively. +- Added support for ExternalId in STS Assume Role APIs. + +## Fleet 4.49.4 (May 20, 2024) + +### Bug fixes + +* Fixed an issue with SCEP renewals that could prevent commands to renew from being enqueued. + +## Fleet 4.49.3 (May 06, 2024) + +### Bug fixes + +* Improved Windows OS version reporting. +* Fixed a bug where when updating a policy's 'platform' field, the aggregated policy stats were not cleared. +* Improved URL and email validation in the UI. + +## Fleet 4.49.2 (Apr 30, 2024) + +### Bug fixes + +* Restored missing tooltips when hovering over the disabled "Calendar events" manage automations dropdown option. +* Fixed an issue on Windows hosts enrolled in MDM via Azure AD where the command to install Fleetd on the device was sent repeatedly, even though `fleetd` had been properly installed. +* Improved handling of different scenarios and edge cases when hosts turned on/off MDM. +* Fixed issue with uploading of some signed Apple mobileconfig profiles. +* Added an informative flash message when the user tries to save a query with invalid platform(s). +* Fixed bug where Linux host wipe would repeat if the host got re-enrolled. + +## Fleet 4.49.1 (Apr 26, 2024) + +### Bug fixes + +* Fixed a bug that prevented the Fleet server from starting if Windows MDM was configured but Apple MDM wasn't. + + + + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.50.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.50.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.50.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..deaf55245d144e4afd3105ebf980811c5f648c33 GIT binary patch literal 53257 zcmeFZWmr_({|CAW0R==3(rJPqAl)#CfQk}INr*H`3DPwKC?H69L{dUfI;0y!8l|O6 zN^+OHBUl-gCjia?fI#tjq!RYl&+?W5(-%pH(A0mfN7jEnf*&HTBK~{Z zc$(wCw+@74|G9;I00{qcdyW(FpF801qbJh%D<(WF{zBp}B>s8{yfyrFrYDm43yHsw z_!}hg82B3`PbBdd5`Q59{0)*PAov?3@z(Gc5`Q7_H%Ojf;BSz`yM@1y_zQ`@K@x8b ze}m+SB>qC;{{tkFYN|pyvcGIeWA^m_kt(PcXuc{Qac-LR1NZBwA5mq-+7!Z?CQ96~ zjshl6vbFlNq~ccTcxx7&()%Z_XCvPfOL(rU;i%rSJZ#O1^bUh z0DsNtuLJq(GXDmN|M&#h-yrcfNc;^F|FH<*Z zZIP@6HchZ%*S*Gn;nHWe=D)R>red8E#f4dlIMb(xCJg1huUlJ(Vs;fBOm#fBov(-0 z?lzU=(;LN$NeI!uD|#Uy=*_K^rrI>M*jHfbbucz)36g=k5L-BA-)j-Gd&hS+Z^r*l zv0ShzcKHw*{>;Ym#hcmz7Ss8#o&>)LmCt0d9)q?)JoXH4Rz>{R&dB&^y$cMmzR>zM zfuH;)-^Yt6E|c)lgUXq(TApV;Ey^XXURiX0HtY#ONK+aIw&47VKeQ zi|2A*>9$Qy<=(yRNw2GtIti~;KI)#n<`*%pR@(TJTA;N>>lXV_yxr@GkD(Eo?_wvvZw;PBGtN(D%97f}Wwhm4_R@OX>ZM z?icJ9nD_TPU@5($uOEmfHT0!h3$)TyQ9U|^?@uvBK_P^z#N!qFnpTeA%ESma@&38s zrtp%wqv3LkzFZBpn-Ns`kEdGp&xdf_#P`IKsd1D&c&4xSlKn-&Qs0ZWcM8Zh+xPTL zmu^2?_sL$XSS#fB@j7>*_0{;qAghsHnc%@Fy&_%H#nyL+N+!#gw|IeCorgMY$xa8N z39l)QK7L6X| zqh+(O_$DX#-0a&VOoGTC@-C1;g6nOqJSd0&(YS%F?H^dT=HP+P-O=QWx1xaEpnKPmEzQrZ3jrq3wHM%?eYoUc!GJ7&cp5GHnmS+xK6fb$WA%oqV z8kTf_jSj^lC#@Sjn(xsuP|Cz9ap~|E!;F@-5(AMM$II_r+9iCoZ*p= zsC^-GeakwUN_~E#C0+Y5t$C@JgFZTBf@j)Nxy97cg70`%0LZ!p73!Zv*x|)4nlp9# zdlXu7gt6grQBHfeXr1zOhtE;prkxIVS0o1E-uDkaTB}Roc>NqUQRFZxmQ4fy!E-TU zG4;NHPqGK~ZGBH=n*;xR?W>p=om(8QAQ93Y#eaP7Fu9|n{Qd{OZxHNceFS&rYFz?& zApLH3keuv($x;*hmfgY8@PeLJO_xg_5tSAnCdRcvX0NGTYBe~^9n?cP+}TL8CoV4x z)!Xg-NA|QhdJ=YwVnTN(mN0{u(y*X-?D#!ir_A7s5etT80$Dceu53Y|^U$Cz+jDMF z@aIWs7p2;6jMD0-Fu;@3dMi83|) zyP8USEm=_7rW6AFOHSe&9~-WkQeR(g0n@%)s^qukoVTD|i< zw}YGBLG)|Klja3e$|Qha44Hpls>MIbB?Ps=Bffo2uuQ3GywIrJKS1r!x7MY^NW08F zXj3V|)YDBwr3`8(@;-%S?KD`~3`)#|hn8S*H%=|JW@1?BVOD4ZMg?bjEsNP$jnhmI03sD*z znb63hjR+hNbwLZP8Smj$&2JlvS$x{@$|H@jhH#%Q!`(J?` zKPRSRV1G1IlUK8K&up;DPGLQ)-*u9H*p_YK^n?SJ8=4z;smtO#ph@skO ztupj&Kl12i;MQ<=AMMF9fcZt7s7?0oPlvy9%5ATB(_3L;etmKE^hCa^;e>glh#_nJ zVeaCyaC2K;ys*{ja4hjv=5;Yjm_>+$Jt{OngCXqAQ|m5zy)idMdR* z8iH>|NZv9p;`(K4mOk%>Cttq2S?2Pd4kxeF_|p}P3_2O7MHoT;bgjb`E=Y1V)+vu6 z$cFeVy#)c@dvno1;(b0`;(V*vg$%}b*_5M?52#3fnrv#s2y>GIA;5%J_HxSLPJ30Vlok@(3_3`M+%aDzr9a@pTNH zc^c2x_+n<-uWxDLzpIqN%nM|!S}ri17h%xax}AA46yPF17T0}tYJ^urEY1FEPvgg_ zC&rvDVM?Nef#mVhw*M0?70xQ?FGi5Zi=SKk0TN6e?Ku-# zC6jHD@Jr;^reh+>Iqcae=tN~inTA&qV$RZ)&hze(o)E!BWp4nAz*)fID`D%+=64hE zZ3_Eze1%*C8mesH=@BdL*4$Su=l!;rV@o6Ol86ih@j!_1Xk`Ln=FDn7-Tj=`>DN&h za+LNF())YYikDKFT1%qC9^L}DPN+|niZ^w+OYA6XdWR_DBIXOBqmQzSO?Xae_`2(HtWAM*2F%i0v&dK>E?hm0XLa%7k9=L03jl~p#_?g6qKEE- zd`rgIKHj&(E8ChZYSk_pRQA%?cde^!gUWuc(n8Wq?}SnqPM%FRz{QU7ANLd~u%Rvg zy3dftnR>x79KS>9H%Y0Y`wIRc7SKP%v9|eRy$8P@7qh({Bx(`#2k?o*B)*m!@y(_0 zC0EW}oEY0R`5+DIht`^YRGHH+=qen^46uM*i* zKc9;@zbkX78QC;bMRjU^wSn({j+fK^5wuv@VcX_Qs_47JtM$xX*iTbBu=YZXK)!B` z)%IM7$61y+PvNLY=t=0<7%|f140FprQY&j*&Fw$%;tUUMhIlCI>!&yq zTy8#ZBulNewPWjP{q`1ZLQFzPel^O~!R_Erm82=JV!0OzX94GKW0~A?$)6B%63sG0 z!wR1F(rGz)m`JOtg(-u9M&pVidZTx*R_oA4OGrYBo}WdQ&2`(grLc7A)}5`57G_RW zyv4$_a51a6`Ej;3@qMjIqxZc#%@M(Neun_USO7-pY<=ZRF0SM)s|&e|&@FPM$(= z<21WSOWnGnd221eQHkR)$?mmI-K5^)T=*XM#fTn5sp+hG=bn)XYIC9ey@m}e7F{QL z3oVepLJj)WMU+3i51ai5amJGw0WDm@a(4=q_?uyP;GY_1C|q;B0@aS%huepa>+7dd zCnPe2Uy>?q>0cI&;wF?pq1C3}L&E1wPwhER-73_eY^tI1g2J%kdb`Qt&@C_T(Ft*B zZ*Ke&S$Cnx64{(t7H2a1`L`a>>+HQM60vyc{zeh@C*7sdxYW0_)QZ%a=SMlmtw}Bw z4KHT8?T}8&?Hys9g$w&EJDa=0-VD--h#K@WhQz(Vp2ZG#`fsGeJ(KD3@r!6a>J!Np zoAecUf;5}y}*V1-JLtf^po8r&Z~2p?mCBo#|@zg`L~1sXeyPZFK(%9+Hk&v((P<@$zh`9}-%%#A{rb1Q%iS6ww6-6BW8Ui!9iE zI9S-*U>{rC9{ImAELt2WpISY9@RFltZ#CE(zN5(^hEie7A3 zf`|vjhPU?Qw>TvA^4yFl(fJlZic^&j+u)e8pvbLPge{2G7ZX@mbcx2=scAbK4u!F+=SlmlGk&&%r7w>@9!*Q`= zu7p>HIbkpz&;9Ep#*o%2B%hZw?bhtuOWy_D(K^sIJ0^Y*YxkQTVJ!XqDf;=V> zU|F65*^hoNwMx|9&x>!juH6Ke?-OuXcmlf3kTx-@W>m#8Xrc9UMQPcobbi|<{9(-b zR^ed7r)2rnn|n#YZF=hhte%r`S+CeVy9`5QQD3yrZY%b`pA!lTPYNn)=CmFp4OAus zP^jQKqIUG2>c(Duw$w=^r^gkxR#u8Ey(1gDJ1d%vKTf|@W<)!ZIc^SFMHm^iNL^@c z{h5h)<>bs8%2OHDR2gp<^q%NQ;5oA2p^5f;XTqdAK_T_GaKS@4IqxezdwXn@z^|G8 zJ}mmS^q09ru55NYZ&3`g4$F^|*Vm>#CQwC`Ib^cIB~-fgbDkbJ!K*~6g30zjxtm+B9+DT20O1$_P`Z_sQO)ymd$A)L2Ka^Pla8ki z|D=0}YG;?#mBRlLjqCXU2r642%DYoj-wa?aK# zzX1{_v~wn5$1JDc^2;$88miz)Y*oNz`Y>J;YHJM>SdNU^!Ha9Q4~i;)aPh?hx7|$p z5WKVI5FqD(exO_d=hBseK7tow?3e_~jBM+tURxjyq&|Cz$G-u4 zd~g~%`4QoWD+d5!Fe^m$P_bnv;FYpzbru@K%fY7}$xO%G z(QfT`d8g4Kp!uPzAD3?f84(~~)A+#|9FR8!V6V^%q~VG>gT1(+;Qz7|an!3*Poh%! z2k2k`#rZ@6}6RiC$q^89o~^6QV`O?v8g zRb|RJo<8-|O6HocU|&3av8&+KgDLe)*QV#QnP4kPcSq8_VCgM`p9#&&mE`JEMO!2R zfn$edqL(gQ_Eh_KSjc+7OLnm2!*H9~T5QPx{A&HAtM{>p5KGiJ>&ZYo5=v__k2b(J z_+TQZ5fJ&BU(@Xk@F_6N`S{D?idQ-YEbl7AacTlbC07!|pwT0`Byxf{UZFe9cmO94 z<|<6wpMI!j((#w^l~#6YA4Y|QppoE(SYn1^IIG!8z3EKGhJ9#i<-`aae$N4}(`Dzw zS6W-03m;`tlg64ks8~C*I;uN`Vq690hRV+GalVn|YG&U&*r5=u+kR#PEqy-X-TLaXMl;Dgo8vWYG&9vwOD)_SIdeAb zg(@q}7N%_DkQOy$NTTd`*qw8_X^@fl5xSmykAuR99xv)Gl7)0+w;*58O7IZ5#$6f+M^Va0c;8qXY@x3Y zS1R^iIqYK7u^B#7xIQsYEN`VUg7*>0TVx1O6t+AH?8D!BR(`c4{`BKuBy0*anl?>2{Gvf%{=S2~$l~4~ z_j% z@+WGyno{QfV<18$EyUnWcaI?2q2bkF<7s8g-Qsw!&S8?x4Sx7VNKuk)&hzXVO9SCG zZC~04F-T!)?vJ!rKw5?d=Q~r zrB`aAwQW1Xl!W>I3h#172suDAd#ZH-ts%7gOQ6n%Fw=wV)0wI8I37!O?Xfey>LhFN zqcjQE8(68X8*0Cl4MyCG50pM3^NGXFTY z*vWAODZxtav&-38LL-&9mvQY+rdesYMLS;v?c?_h?yDq;+B!70i>u24z&{DVz;fe33nPS7HDDlB}dfM}`kk zE7H|V!e=I-j=pTt-RML-fc;h6T+JGW_Q;@hMFGAO1nEhOkTKktsX*F>7+&J!!^DUIpNq6D0QO1c=YEJXdWvTlG5sA;9Fjz{u7 z$>RyBqp}oM^YxkDM>HukhOQWDf(}7zB@t$rcK##%mvVx{pfGS3#eFCgbG@>`E@-YL z_&jFm@Av88)ajJHUU_!$2VA>Td@2HC>-6<`wj;`P;xIp~wl)`!vY*P(vsM*0*w(9W zR7F6b+0rB0cEk5T056z@{B~KDP}%y>C&ZI=m09j3-a9>+#1YIp*oI^mDVoIOF?g;I zS~)9XQn4IXkGl1LL92$R?1Yh#}4&-ren2>iID91RZash5s=C8 zS#-qEX*rHlmeF0n$4>k*?>p!z+}5_YMp90hC9b#dci9lV+iUJBMKW@Rg{?Lyk>q^Idmutj zE3>hii#+T$4)097$e>{A>>L_$XIxpC*6a|Ud_Dh#^Yc;XFhf;^qN!$mO_8RP|5OkE zG^ILg^{FrI1H*s99MiFiU-w;2WLg=9{AFYh1(MzKeSHi?D=hV%jI*Pr?=BwERxEwj zK)<6BDKe{0Vm>bRFsu(#AjXJUko7Wyr8>E?vub_uYRbaf5t9N=tEUMfY9N;`p0%8- zA^I>(MtrF1TFa1}aOcm5YHwWjzV@0I)b7Rpzn*$cA@RjkIh5ZBF#C1^b6O&1wLuus zEpDF;BWfj5iN)WxPrU>IqmLh3V$9eS&xCi!RX-)>iW^ge!vKy2-3DP_TK|v|_ z(b}N6N_jAc@?=bM!Er)%*Q~cO6`TRPONBQ(tLqR{0K`9wt9Dr6w*8tA9z?=XkXHa; zubn{ExeN@JT>(v&8NaG2&UWsX?abNM{{qu75i5Rg{v#|AlQFnNNHSghN-i8xHh+GN6;cQ7$Nou<=>! zf3kM4!p`(*oQPw2Q0{+h9~KPslXYombG)=^=&_ z4m9=G=eS%?Z~FCoJNttuR}@uz60K3~JX3SkR(G1%dBu3}CUL>EB-(yLnRPXYI`8&2bx{tfpL zNPc_uzO*EM^zJR3sY>v2P#d|=V%$pCDy-=BU?d}Q+R_Cw_)*D>$4o76(?vjpf>rGLF*WBB~)IPJrmWFWe zOCuTqa(UP#@}8$2MqXEBkG}kIJ3yQYL>*Ts9JO1c$dU5S3;jJQ$fXqJ89(!}rBso# zVt-n)1GG&~aL;KvxV?(kqGvolG5~SM zq4Iq{^FZT#t+S5ic!L~Ti5kfCtBrmf`f5+RuHuRU-ynQvAHNJj8wdWo^E}~Rx$r8v ztfk?OuBQ3g9aoJjJc&bW;Mi9gSrl-C?TREiV|x5!R;O@!j1=T}Ys;baZYn$+zE4xI zGncC&;(C4bd=h4!KJ}U4w!`qG91Wz>Css87L;8s=KRq(q;}7Oc#NN?V67}*bL6FKfmW?WXEoD^7Ih*o(7Y&te3FD{h2b%Xn@;7 z!BR;Hp2TjSV?8pH`FdTf-E2MT$t!I7^bkxBk!-m9uzbNDp0$sc9io>3sw-`Oy_h_x z8ami4MI}te&?7JV^I+GJo*^76>22p)rAVKhb!bYBBa zx%p+D161TKFv&fabKZm3WZ$Xss(IQMwJ?f4m~=QeDBZQ!H+eYuHGh6kZ3mN6{z|nw z$T`x(GwGV$puHQi6uWF<_(%oELH7oZ{L&4o$;T`_gWjB&74$2IpQtjWSaaPu_S&P* zsP;=nA*#FGruwEGU5~>?;d@{Wx}u-5BD*Ii*2K9AzW^jZbNuDCl*vg)wD@q-<(qX` zK4msl8OxI{UZRWPvZZ`%hDD_e9!3de0V7Xo7}wqO_XL{s+SQfw5>{Umm38PUR|RBw zh*9KRvp(LOI4&u>wG-VioErsjR3EBa%7@>g?#NI>DO)V(wLWG)AB5<HE%wgK_(~6Ar5kc(wjc9JVCT?j7O1AhT*f3xcGjOwgIs!`^ zM;r7!*jzWAB-_n7{PI@u+^lzHKD^3+YcV1 z%lh@Tc&j3!MXrk|?owd=3z$p;TZ#M*ck9O;5$k~_Ft*dyN7zUrrXsE9#}XgC*H1yhrsvGL%2>L||AhYOD;^~$a4t4zA2s*Hg2sGp$Z7!9y!P8xmb8X+A#2k?f6& zK(_qMVvbT^VhQD>(?4jsf-Io2S{mJ84@EI*^pJ8DseEUwpeU651;qa%tOi8L$)K_S7zaCNeeF{l&^TSqRtV2(A5s%a-*+@N(*+Lcm>jU-y@~ivo zDzD^+I4gYk;yhible11;l5UmjLtY>*dDIqFnSv*L@%yu z96n-+(K|OwW8{4Stnf>REE1pJR%qa0+=eQ@76t3lreMxe(v>V5f^!H>a_=8WqYoD? z{EkFG3yl%ZPq!i!sP0sMDNAB0g98c76PH|Z&w~J-o~rfLjwm1v=e^01eqUMyN_&HC z!Mu0rKvv&qf(~pom6CZt$wi!OfJT5Y=!stxd}ic)6PDRhbER{o4k_zoc28!P*BPF) z!(aOk=*&XgRxJ5j{H;qB*FvNSff4z$>8>7qEwv-wZr(kXt6_6II<$L>HWi6^2MbM# zG3_2%;XB9K&m1Qd3N-adM8U{CXfoQLCm%uadiIFIYj!4S96iRr*2gsb^X=$7Wu8SP#Lf^4i~c`1rzNcQj?INaS-kaZ@oohEfmkqI^JcbFy50J@x*Nq(K^$Xs=Q- zdUe%kLq}t;!+7{SLy4~!mL}(z=qX%Q0OqOyNVHR%5$#995oMjha-&ie20i|8y^zkG zL4(I&2_U;Eb0d5lT`@t91732^2?J+gXS3wC^+I0C@9b(>^Os|0$XQzG+P&dNBILyj z#T6-(i~OV`5yaUz(vlrc9@}lm^IuB8AIqZIU>^NgUATgbUD#-KYitiBQ(m2tsAan- z3@m!UOE?IZxdUHi+rI|N?<}=9`%&zgWs`SkkUxAHl98B~=g_oKv)}wGj2}0ig#%Xu z00{5r!&m5=6;x!cBPxi@0JAxB{vP= z9dq*YtuvrFEKM{-Q zh2lT>F<$QrB?095D8xYc*(idDJ2c^8*7oHhU^pegJ*m!4$$|Ue-x}ptZBnyNDp8E- z{iu468S*Q=+epFFP!7hb#p8reUUIL=SnA^=cr@$2rk*t2WNc8qrC2#2ed z^B+CIs*BAZw-+hwj^)FFuJ_5N%)vIN4a)t2{KEDh-q?5*-ceG3N+z93o_-j;%~GW}P(Dv8Or_wH->H`tCHm zn~RY!^OQVJs0e~%eZpGeetH+LlT!A#T{t&I#dM$S*gH+!hB8|KSh)R-og!M5!j}ww z!$1%atb^Y_mgC9eq*<@zHt7Ns0$`G#D_|)9DVMEKa?^n~Pmf0>sGdy2^^ILvg#;#f zf!J{?6n+_9|D|eXz&Zhn-2mW(D`CJ6Myl89fb}amt2hb-WSCmcpou^piG-pI1o1>2 zZqfx@(Fg#rmR4hDorv^dyIKe1D_vC-Wd<&7rwBU0J_m&_Sj1A|=3cmULaFkN9915z z+=^d?Dty-m&I{`YWd7-pB2;mCIp~fjDrAHxv-=)sJ>%mdSyh+13Us#lyX&1PA<<&RUzNmBv<-WRQ>(le*!Jv5pe zaLd|@)!iBzG0`n6gO3)wt6-5u1)26L8!$=jxMw8)8 z3mrkAOP%A<^Qx6zawx~quKc(){zz@7&3SXdbosy@PG>!k!!yv6>ONW*=9tjWv*&C_ zw7e99ady@On?i*mB0)C&`=D&0p5bx-Jwp&z)m#ddTY=V5=r=e z(;4gX-C=p0%DW9xw(Xbf6wClvyY)s4N$%_p zm>J(k8j6}jICVHo*gGzuHQ(dfu}?`uyWE^KN{MMtLB?rc7)Z4eww()DB6bf4UD2UvhW!UW1;SLY*ngFPP$musf=2uwO-UnuQ~5&%`zBsUX2P+($N81a?ksOQ%fm4Xt53f_uSqlN z*KXdn!LGjB2#z`ja3#EAuhGrmcueIDqA^;f|N7gmE2M*@0fY2S6_#Ds{W!MfU0fP& zmC}v9SnKVj%+*&Ta+EQ*?xbJy&TzWV>)z?*u+eLxLf^4`?HkAZ?vFRBKf!h@Xs~k* zi+*ayK1%Z~PH>E=UE;FM=-<}_R%`n9q_&~myq|;@N^Z3N#!v!QH6g!u8`16w%$Hm1 zw^`J?=GCG@>6T- z_7vzb{5TRy(>i55wKsfH7LQGc8)vm6k4fat9{Ic0e9TN`d}bV>zz?@Xqf712_yI8T zIm8yU|Co>=n(?@_G~BzuIz(QS!O7&@WzvD~g2jos>;n%E^U@=&mnzjJ^lTE!(*)I> ze@n?7@42drkb)3_#e00e*3wu2-|}?0haFg1Z^=_)bG2e|KZ3uxqk`#Tz)ma@0K${s z&Qeg!KKBr{L^n&p^UH1Ljdu*q$u5(Y$+_&Lm;}|lo9*@heNfx0frp9%50@H6-p{Z7 z+4EID-nki-utHyO7@AuPevRET=cV*n$)h87Up7LwOv?h@ED{S+@W*OS|AGmiUYq=m zq4QGr0lFerCVETa`pTExaL`kPgWCkUi#w5y_o1>1Lb)Pm>z4Sa4bFun--Y5SqV(Tf zc1E=L_NJ@SqtL_fzL}xAeT3*a!0KNxN}fx&=zmV)tM?o`f7W*LL7t?o)e+60!9?%J z9h<(z^Cde@i*tjn_gcA(=ADzOOUQJzjznCYLwQEQ zr+6XinV1j7)j`bwSmBk__E3H({TiFV*7jt!Fmk0Aq=tu`o>6aAY*N zI&aJL;42nhdP+|wg$aFV(JoPU&XI3 zVHQ3tcwp^sRkeL>kC~K~@Hrq&3fB>O9VW zZcliCfOA+&U_&l}hEGF-UHcw}(H(NQvUa`8}lT1U|kW^d73@AzyeI>)<6c!IyZOo9%n8 z*qJwKO%g|I(O67zcJQ7$NWg9=&Kc=xoreGXd6NTj<^Y1|;m&TjVp4@vUe#3TljmA? zPOV!~`Vw(FMOkB*w;uzf)r4Ub$o6b{+BG??cf1^0HspkQmOnEJ6c=VbxMKE9BKDE* z`1$gjs9@gBZ)7XUzMu97*IJP}?$e#ELMOaG1OG|p3$a^qbSW@DTO1){@a#fFzx9A( zzrjw=?+^3ja(c*}$d4pTI!$}YHUtu7mf8SI28*gs3mm2SL&DmD`hWq1D^VNJQRvAq zi<+5uh=$5L&*R<3&X;>hjDe3ac^O${9~|#dKPLcoyFd%#8O2;c7r?Wa2-`>^`qC)Y z`Wv&yFvc>-x-olb(^9hyUD0n_K@gymi!|+AX=-}D`8KfPrp(vpZNFOblS*$`bb#$ZMhrX-ul7kZU@L`fz6zw zL8zE+I2#H0CrTEn;cA3{f#|Tqv>3$;+98Bwl#`G)l&Pp47jl&npf?i z@%&d_%~a`Kk!7gsL2%=IJr%-{nix!e+%DmCA$)fE3#?IohU#@0rU^~~B!jQc@#vPC zykA!)GDpoQkjqko45Xd`E7PW@53ja7F9#36P-kWRJF<~3AgHg$$)@aMVhV)o69>9@l!3gC&A1Q~pFxG3eW zqwbMu+!-c5W)2W?0~x{D0oPF5&=#(UmNnv<|5#EqU%6}+hnzBB)-QJ>?f8RI;^L4p zHd)?@4R%@DI+yl2KX%}X*uE`&qf{qKlLbEJ3F;@A23Ki+?ryu!079WN1$?K9Va$H# zN6y&$QLy=##LxGb38(b>rw>(aP!&nIlN2G`6|3*c^wb(I#|LK>CU!1nYDb(CzmcjG z8u~QdfDPNim=t`8Dtlo5BJ4f5H**4t954_7$;aDVykZA$W!dBQ`B!2v3rP|}QmGPT-rGCwyXutbpbg*4Rt zAYlTdkqXVX2c`~hxMM*#=l>f-gVvR}3###sCJlPzX}j=z3N5Xs6#e2wVU@h}v5|2J zTI;U_OVR%IdU8NkrdxQ@{;)Wvd=E@^VDEAA=M@1n9DjmgLPB6=7z$$CV1l1%ymR%t zOAxrV+tYc1F6B!{gX^E@1d?XtXrbF>NCdj>ZS$>v~kkpZ;w6`q=n5c0VKAjGl^^y@8G&&Flv+p9p?Tp zM~g%W-mH`}#xGqSzO-Al#ddd8=)sax?@7&VqDnBlr2YgMwQcs_yC>l^2VkV*z5~^Q zROVFM{ zXijDABeOseFiwbfi+*@S`wZKi)+fnm=J{l?(8_XtS2#_Blq;VFl^`=yYN*`6Aa)8o;Hjg0>wqIh0yZ>Ody zFACRH%iSrntxW`Vu>-HYcQ!fB@zj(4oTYXg$}an00wVyPbuPv-Y9;3;OWRd`uJIQKk2ZxLiGZPZ0c^Y= z`38H5sCdcs?DxUfED=94R9nw6sK1oM_^*=!p1Zqk^yI$aw6@3RA6`SA|BK}}0bso{ zllCc3`8@nOWxMfCoHKY3No1t|=QYk%*C5lSOxj0kdwOc-VA_WqZ+!4M>e{cJ^_Gmc zNOl+ECnzvX0RR%$5wLpwwndd}cO`iv@H{i%RLSC$^wTgjTg;k=3p}L2yYaPmSC%au zX?Y`yJ5-X8WA5$pHRiApEwJs@?$rrP|K1!9N)n96FhfD&&FmH} z#6Vc$wj)S>3^_svbR*98s*ZQ(Rm+X7NRw==2!JfX$iuI_bMh6}t+#x4G7qU|Ta^;> z@^-;jM*VFkCLSmv*?{3m7_ItQ(9_XkfG2fFBiG1HZt95e$$~g_I*Zf%q7tjv1%@#& zWSj*SoE~y_Ye$UK*ro&*%BLjgKT2Cwmg@ZUx}V{VVeKZVdy@r?}s4E7p;rN=oO zlzd|cR>~j)ezQ1;x(?1d5)8Q>*lAW_Oay>X9RRB()%aeFj(JzIyj^5hAuZS<09!qp zE7`F^Y04m;iak0;k`2IiTd^~ELMut6I}>t^paJw-y&+0=7DNloY+DCwgDu8Cy@E(p zEfPm|?;l@09_3E1+Z1P0+`hjwQO5IARi@-x>l1QD;~IqD#z_!SBdD^QXTPSWPIW?CixNai30xcw-1?dVZ)(KWD` z&mR0aSgHO#fM_|h8f5X7)N-P3Xcx=E`8DyGhXT(&{bu7Tx)c_~AX5ov-fA|QtmQSC zX%4a-^&=9t`0-U%79AvpooJ@N_}J~j5EbJMuhk~@#xz-^Ke(bh&J{;?XU7|z0T#?2 zs>ujsC6DW0&C0Rg8nCi_w|n8T^GM{goOBN&e&NXjO61XFo%i6<#C@t2)mFgA3ROw> zwK|>8@>{E`Vx)BKIoA(m8`%2N_SWj|Tnc_M7j!8ABg6;{cQbFGW~63X!j%gOTp4#` zhTuM`a^ANb5`P~FIDg2lIXWzN^boKP50#jvAY&;3d`6Duhn?#o25`K2YM!Me~;Zr#e+e8PZ++MKuCIq6I>YlDB^PvDbl=5}x*aH$OrxMCx~jQFURP<2H$0XOfUf z-8T^h?@5aB4`P;2*vb7?#%Ie6&#B2(NheO0Lq~Dim2mN?k^)h^x!q+t>kvrdc@?CC zGafV>&8FI7;jgtZ!W%J_>{2^FX^4iZvR%>h-p9m8vK7L9bR9^3cz=P3{wsJ;nV>PwubymKzQTOnbaR8AxZ}OTLW9hL z+F|R~RC{)ur>dFw$6>jm_nXd`#Uv^?%5*Pj-||TAg$oVbLaMDRiGl-6z60H)%~Iw&B8IV-;6`C}$8#x)J7mP|%dFs=ELM3oPsG2&#Pi$Ig0|*w zshBOd(z2c-TwG-%gBMRbhq2KJxcab}hRS&gg7H{H9dtvVkE_|n?}QwlS6GN(>7&sW zL<^dSy-Pi|UswY^d7o)t1hK_XZCl6!lk4ID=U!JP@zcB3)y5qN6GXqwxBn4im1$!@ zP3T?(`L{YbBy?_z>)l&$_HM$_T8vwx5wYibud4_G=pHtB#k%y)I1|i%6r`KgrG8%W ze~=9xgi1DmoSFO!@a*rBE%{H&3G@*;yn6j+V>o-)XhMOvJ{C?oA-lfp{@A?L*kmtA ze1CR`v*cVWcE^aM)>7-|k;h)$v%5wH5nS19 z4fuMPnbxa=dmiJ;r)~%*$%GD;xvPBjZCwxC4gcM4jMXlai5%|`L%t~-Lfxc@ryxua zslv3(zj##ZWr_aYph5f(Nm&t@^u2gChu=RAz`fBZRLvwab=kOHqUm!ENA?wK)XYZ9 zrB$QCBC;V0yC>}CRjrTK!a&kfR&TV9?O!tSwwIAhEt<9LEyJb3{~n)}0{eKFTY#Au zV{qGZ3cyJ)^i;PvO%7+WV!)Y<`X_>@jnWwpzu#?B2P_Ac&l7H(Pn!R>|6z&oYYnhaxxmCSG1YRq|=2Kp45l+Ef za#&HxZz~nDHq4k*@pQ6*y{es~5(5Ctah>tvA7E#r z+N$~qOcZW&6wQ7L%u*DpC~_21!Bb$#<8PQGv=5cvC5U+5>iGt^^ZlgBYh7>YAZ55a zG+whuQT&?1d^^VX>jSCmGTZqrS5~*L7CP?Lo8|p9gc8f+Q{Kj6C3IjMLuenLvwF7m zPbj?z2=3I2;0f6TRU$IsupQ!^o+zR@hZT*YVz{uz*~26;&SY_V#|1bSvk^J9%_tpZ zG%xLru&>#TkA@AWcSK{%wpxPcdY&KtLnr|cql*}SN&v#K9fosjnY>ukZ4i=k9Mes8 z`xXEo@x_jeen}wHb74w%`Sg;IvEP^Tk*}skepgOsQ43hygME;AvGC;E^8mSLg{NmX zS^|9xqylIPYs{K|d}QC-31l8c7gSOBqQ?#U&yG;gL!yH*f)ED}&<*arq6H7tl5Ms3 z$w5an5vn^Nav&yZ?h`u&c=(+*G6bPXMNwA8!=xG`E3zA`QgUQPD!p6fqT(R zSR5F_fLvVfxp*v%-%IMTyT?N(LEKvduyiS(X-~i3trxbp<|!~Sq4ycK(^&-38frI; zn>MY2DPqlr%(#jy%XGx2swKaj->(cTGB(#?6dsms?CK@lw6K?2U11Qp+jkLkDPVdD zQvSULvR30B|DH@yZ{yF<5wG20=#*V@PGu#9QlUL~8VPKho$7FC((qKR8vrW&MIWstc#a#MCt@RiMj)kzOMSXvU>ipkH`0td7Mw4vC|ja%%R z&EY}#G}JUtxEil^P`i!?qv-`7*ydCH}LC|fsqkq>PU9hcP^i;WN+W@^B=E99v8zrIFxrM#YH0m6H2d;Rb3q(4Fx@CfygdL-}uw)m>iTVEiEN9%KA;80U<8+nzKEk*{6z`$uaF zT+YbT7Br$KUC_q(jpF;>`rs*(@t7XvmX{mv{HNaekAklt#T-Vj*en8);GdHMX5UH@ zGBjkCxh}MTTvm);Yo925ARRcdYp?h86s0x@j1&1q61=u)%g`gcY}Ci^vt0xNKCcUm zpo+R@5ZtXi8A8=yG`ti^Lr@X3M$fW0hEs8U+Q{}`bd?gk}1+tIyh--nXq2PH>>if8ypfu_HO7B!YDIgb>J_QlBCv(4bHVHUTI`m-K_3XQCEs zZIw%#->5aJ-zrn>NS8A%cb!%aW>fV1U00eVdLrO$9 zLC5G^J{54S+d$Uf+P*a~aCcd~x;*GYVi6f$53@QIQ=XMWlVRpZ2}?0vqza?F5a}6k zE9OWVOh9xVQ8fj{qPHQXIJLBKBww$QYKX$LW*3ya`;hftSh)- z#L}xgW1FfYq|)=+Uj<(WUJ*OK=1OL2~aa3#5%(h|VW=Dv1 zE`6t!4-K!Wor*!=WL82FC{CC^{F0Jy_JS*SqYl3Al`eLBlg}=bZ?OFwSVnDR-ovCQ zP)3(i4`XAOccmEtXRi4VkUPCxw^p$;&FkmQ~uGgoql{A+OX(MZ=@7@;?-si2A)QaO0;cl>PA)@kc150tcw;0C8ugXo%-Rir2gg3QN zwFCqN?Qcbo>lsR#wAPuuyRIoI=NRj z=UWZVPM%0|TMF+OJ#7O^O%_fZV)IbPG?-?IyC;e!VgM4-&*Bd*QFuVk5u5rH1+{cv z$hm&!BK>$7_vow&7wb+v_%HEAE6=CEo=P&K0`iEAvaPY+FU2E4*YOye>Grg!8Otd4 zsw-|N-hJ`4VlSr?28cFGOWNMbWRh(|7H?lEOW>e@SNaTjz;?uv3H6YKeOv ze+mI(rvMo{;C-gQdf3_xP@@1!Sqf^4`RUH4UxJOdQ}&#iN3{w{$&RGTkcHRE*th)j z59Ih&v2j&7An)u>HkQHLL9KM@yT7FWi-%S5Y9JU*W6K+D_WlBSoCEw$q~_z(>qTwd z5N+uO6&7K@uCs(&Ff}2(w=QK)(Ev4l7|W0UIO}XXgVujpZ`~o(x7?{vGEpVr9-Edv zBw<)jh-S-wDnZLnj~^G^UF)@cBf@f=)PwH3t0(ZJ`(a%?9npU7ccSU6t8hH%KrZda z@Sq2od`vYHR9Qm-j*E@fst7PP)tRoz64U@v^%$#D2sQ~3V*3enN-GB|#=q(Frr_7@ zjtl9|z0fE}xXdrY1INc4iQ853p{5?~4acW85csNDTb2fkXSU?PV}67}Dd%V?F9IrV z7M*U$q~q|OnehrYg-%)7JopFRYDX}MHnQy2bHM7XU6z%#mFy_F7%uj zO{5(+YBr2bRtjA4`~8p#1XW4NXIt+$09cxzn7eaxv6Y*4@&_=RASmrO2RMUjCAk&} z%Q=LxQrQ6HGGH8W>ZsESL?sz zySKSxbbR2w1T5}4H>RgeEJBqiZc(iyT8)pT=>ylEM-7G3U?(D@b>hkXHIm5WkMDx2 znD&%G4fy$YtVTwr6mpec%Gd2-(`@!-Dv4%GV>>`z7R!oNBiGtebM8*yDjxY3PA-(V zb~AOq_1y+EQ&H0(-!OApTxTxV>`^1|@!v9_a1(6wtwy1^4V?#@`8FTA$*&|FOGq=+ zI@QdS_DS5#0XuYEkx&g|8+(qWLipmpgk&N);ID0UA6_gxgPyEnVBl1cogVi;6YjG+ z9Kf1p_oa_M)k?mmoU35e*`2d)=jo|DIFMA{e(Mr!i++=?!aq6=U4R^Il|Lbr)|Td^ zxxXn3&58hNPTw12H!x7~F757q2>)QmHo5)_4gC+xNByjbyIE7|QO#!wR9>2Lg6o$R zA3PI#dZM;-*|4$OPaChqrTxjr5aSAmM0k6@&b9x2dVAby-0UdOj-krC#l(iXmBF7b z=lndbz~e;sLv0DaZ~ik2FJ=C^$Ru{}$hK9k87AKw{B39IX`4yz2*WzsT;Ks4gqmWe7rs5=vk6`7%Fn#CnqC zs)gc*&~R3kMn+>Mw>H|yymH2(ge!mMu>NG&>j+UsWmx^gu+g495F}A}zef*JtnNh6@HdVz-YuO3_{LUp zl_np%hmvR1rtq_(w>33-Z~NoFy|c8Qdw|Ck-P#V{m#+Vu?Wsca1YS9|!AHpQ2_S4p~Jfs7R&0fL6N=jX-(7Ps;+QIUhiNLeJJ? z<88{1F0h6(5T3&2sDQLi8RqFY2 z^{tQXEX&J9S;Lv5m)F+mhpgI<4Fu6#!y}hRfbfj zX#I#$1QisOBUZn!-n>GXo5~491$lCLaM5>JwWs3B#>MGC7Ql6I20NqEca+Vkx^pSj zY?M8OOFwPbeF1$?(2tQy`*n6UHBW5r%#!O*E+1Q?ypo-{6Wu0SxJPKI-ds2uE)`O? z{4~U?;^fj9;y?eUB$IuPRS&U{*{M%JXm?vYpE71CerIOFN%m$mn(R|T3j*+4`8$F6 zlIW<14kk<>yZ@V~PLM`!{?Axawglv#BQ-!>G6q?|4?)%Lj2H}&#fl7-RNYFhD5_UI@Cs)J76ghPL1Lj~Y#R}zx0 zDj5VGOPjITolQNPE+>fj_~qG33ZUuJaYLYLjl5ZS^6;@h6oB21Ibo!?wkFr@3t8#; zKPs%5)|R>glHu^ml*CFA$GwOPWSO936u_`%DWv9hv|mt@%f!g6o|i({e9ayMvTl%0 zMq`Cww=~`+Y1?&JgD!)_K4cKs1yAErw}(ko-A)3YqZ&xYyn9@s_#w}EcHeXWsRj7< zClE~ktZbH{O;_r3g?p@Np9rpW=()2L+zi57U*lVR)4qE)yLbW|uAhb1TZgpkFyCN$gsF0U_eL ze9>?V@CI`+1opJY7pEa)(>Gua$AH;9@O) zm^7gr^O}mZ8zy4bdZst@dJL8@0%9~j$Ad_wU!{wxTN}q*$m?qZXWHu}JQk|((3|*9 z3F2eyZLDTvH*-Q-cfCu*gH*T&oKPtLs3gPcNP=&Z9x(3Vb?9X)!uEWkRUzpyo!K2p|U0UgFa6M|r^QXm(| zhycA>W?RuCiVBV-DKUk}5gWiPH*FJkD16!*&;rh6x|A~mEV}1JG!iR4oB)Gi^V{}D zMTPi+@jp?Z%3Y0%peybXkB_U`BC>PTBTKw%T9gfxK=<3rwOTL6{p+m9(AIlncb@+5 z&zX*|PBQGhWffOnTO6AV5(ZAxx!%HqQ&{xlS=AS8D6lye2i%MPOY~p$bP`pMfog>V zU_=C)S6C!o3WAH-wq}Uk(CH$Z0|QA=Y-inb0pPW@6^uK<`JDqa6keL|F(6g$Pl+&$ zqeX7}`{gx6bqGF#v+qpDVOYeRTWtyO-$+2Jd>W+dg9a5oNw4a7VV*Eu{OtLwchb06 zXWYF*!ZjC0R`G~!7wIdYKo=&m7Kgwb@mk&q1)u>KYW1&DpQi4{dOvmN39oG+8%w&n zmqud^f5V}Vwra2(*nT?%0e#W{l2AdD{RlQ5KDbgv}BXbGL+w?$M&LmX00SWq`R{7>s>)@hwPG9=5?*;ZUELBiCq+ zVE3%cCasG+Vx`PUM%6Pf*lr;188CTnz8&`*S@u4^HYRPC${yFd*VQi-KAo)b0crWW z&YbaA9j1;9EBzrn{dkq&hKFKi31`4j!V$Z6#7^?4y+Nw9Sx1NywlQ{KGXPw!mDEAJ zFz>xQoD{`%M{6op5zA621uL_+7N+bmcJh!gps$<4Kk5$mP8`4Q5oLh7HD6lKO+jd4 z>?ib`3xRCtw11w01)!t3-eK41Zw|PM?Tdi4htu*`vOdZxTimkTgGGsgC*7K&fhr^v zomn0?kixB2HX7)$$S!J2$K(OeD760FGxTyEAqg(k5jpP5b)I!Eg}?swR5vKvd1XIr zD(0;QAx5h$9|+@sjcx9v>RxRe)zM}5D_?(IP@}kUo{s9xl&TauFGn_sSps4Wgr*yr z(O$xC3^_EJzE%!$m6uA7Q2qjZdsY%p9w6pige7_X5(Ruiyq?mgbfmcu;#peb*oV4- z{y9T@*=B&d*SA?v_qTnYf`mOLMaXam&{bKoU!qcTbf{oW2=E?q8aXBU=bq^WMv-mHKG5nK*3m&XulDqDh;5haIrjtmqCx5`#v6f+h=9i+?XLeGeW#b++U7 ziVm0o4&C-ROz^57Pux|dWLH^>kFDglUe{RwHe62ZI&V)aXTd$aBkvk>Fy~9w$ipt} z0&8{N(+lerHEkH9G%MG$%C1-RTu%6Pz`E*F`jrjje*6Fa`rNk4G2&SY#OfqQ;JXMR z5ZOMm<6>Gx#;WPQIhs&m8HC!K8!Hm|#FJx}G`s{lck%;DZygrjxYn-QsUpwgn+Ne> zG9%VgdWxeMXM+HI`dLqXFEB5>mG_{M0gNIREzx#G zHorr3Hu8o}qZ6pQ>DV9dKLsjEyUX+Tdqy9;)_(}Z^oy3vMbLhF4HAWXYC4~87hH0z z>uDE#KKA1?Q30DyQw(|PX0+;xqpuRi@9%Bx;zzgH)vNCk8B^+UFKv^o@@%#H?o4fb z1aJ_;^7|x;WBK=+qg;ZJD;}Iy16Ntc!5s~fw#k`?hK{4xrvS3W487q*WxKbApG8)z z3|gC&TxC)uefr4@RwPGywDX{1`xI2-Ks8O=H!Wc(5#A>WHYF?rQWMj>6##1iUUf73 zFmaf){UH0%8RxK2&G1Zde3*B0SsA{zBHaM-QD8&_37p_X@hg3qCynJT9&R=2+_Vs> z*a>ytI#m&pJM5wE{M;4;VEvQXE;U5G7jq1CLTsH?}9ln3_+e^85d}|12KSGR?pN zZ((7XA${Dy2&}v86?yvXj(%Jwv42^?>1`wL=_y9cpWvJE)YL$ns8Q;5L97$zcbB)e zlL?5Cjb_A6iCfNE&x?m#ZA=4>vX(bY-NPuv8lz>{&KPUNdU*`PPh(VL`8qTaH@}8@ zpBEw6%TsM(Zz%a%kVJO^DEWSIE^^#-!~O``n{ufep;Fx(EiMVg3j;5vd%!cZn={oD zIh(;ed|7PGq0X+S7Er)`eKA-#|43e0^ebsVv4-i_z;!91@z(Xy4P&F3_{w>=!BdF6 zUD~UNuMa=#zy1NZ2(_Q~2%VP!x7pXQ3;hT;u-vlY_ilHQ+T2*Hif3d|obgqdu+E!0 z*#b?&n2**V<_Hx^LjXhtpa7^p8y^0+T)q(&Qniu$fX9H%G4!21*W?J!j$6SY{yLAO zQ1s%9nvLqLG|Ag$@)~7g4i4=$ph48kF1=o{V3$eq4dSFnD$LOH&Yd?94C1rxys|MY z?l26{OFkI9)9;XX6r&#^>mF|4q7{NSHVm5o`~K-! zYMPi#xc_H_FKKwwnLY3K+;yczg?kW##QD95RQ5wG+}b90Ce8)!4p<`8dEe6(H3q#q zTHL)^$f;P}t;{yZR^2XYf4#%Ci?ktqhi$zV@4diyjJ0=Vmf|Sd+vW1@_7M&g_Hx@9 zrxo@B@X|P&`{>jAG=Lj%cdj=f0qSObL`&~w8SjQdONgIv49^}4?q~LyT=@BI;^#7; zVm)__)SD_#rVL00rQhk_39a6wdZ#lR%J*2y0iNv_?&C!GHu|2!%|VX=mu3HrIOBKf z&jT2IuRi`-T#E@^^dV)tZ%uIClqz~@87rHfsE=}$%qJ^Gu+9p}CBla8^k{sKojyh97~JNC9QQ7ti673cibQ0W2YB z8OCRQcW7X&{v~oz+x!C0hDI!PqWZ_5!mr9;$98TBr0+;H_?=J6ZF$;48nWc+~L86288%p^>={2Xv=}n^vhq-;4eH`)M zDj6`yu3M@qn{~U;YN7A3CjN)Xow7#YDxSz}%)Jv`+|@hfADYv^91ew8GG{)X#a9mI z2%CCjB$Kl9=KF(Iwk*R>SCQ+`ubHV<|Jdu%?rpj8bbgj^X$-uRU!?m>&Jp| z6sFM#fs$5U#6d0fXdenpZ2a-kPPo^|&Rx-DRHTZ#NiXB<5X#mLrC5*_tmOJ;YNq{k zoN&t!`~pZZ_(LCUc|&Z{w&@j_>+gHC1K}WNwXNX;xywX0u)Wy;d@Aso;{~2M)oEBf z7Zia$Z&Z1wLnkLYRxaVyTxC*|oD?jl#3Zb|n?9$+Fc;K@cUE#m*sE^M&wi4`k~Tt( z2bO-^Bkh#`qa=HQv_9?wVZu#2>s#n}+CBRM9Y_(jNBUShzG(dLb#tm>5L6{&K$eQ{ zO^kLkOik@=qDgQ3{ZxWXf(H0TMp)fQMpIA!v7Ry%|1Ra>E4n1eMvhBx7e8U=b*<+My6A+X3Y#O*=qOPrZ2+-0w!n} zRKM-7z;R#&*bJa!;yjz$CMFS`83h<%&FOs)Qfw0+7SzUz^({B*3Uf!QQz3vFKaw}? zpFS>b@gih8xi0Ih_L8aIR_Q_+|1aY`4{jPUQ;V?xZVWP(C#1z{w>L&%Dr0N)<1W!H zp6+v-a(GUx@%;UPtN7|wcAs((7N#Fi&Tp&J8%#!RAHhT zUFevKf)ONN!846h0n;bWybxkj%FCTI;=%xU@kRUxcCmT+3G3J|TGFnFifpIS%J&RF+O;sWTU` zo)rvU!UC32tEung(cK$5`Y3@!oe{j9r6tfwS2q8g4Y3vk|v9nOik2JG(0k{gU+ow z=Gkua=zCY0ipIHM8|;V}sIUH~5`PQKb>X-}`kJNu(UtT5$ZL*RF6%o!J<2W=)6`$C zjbb9}&~3tT7$_}DF_s$Y#4;aCT^{aY>8rmrK^5-YA?&tM;bv3z>3yDGWYz9fs-PVM z9tx_s3alj3OF&iu$w<|ZNkz_cq9l<%x4_1`KnzDZB!xv^ z=Ew-_+t{;bs7*kfrQFZ;Rn?67Bcb{mI(_|@@7psE-C7`YUP2Q`DmcJPhL zfr8}Ndu%b=-M~wu?$Y?}e@0X!1p!p4Xa!0@b{but&K*3RS-M?86*&Yln=rtK3Dbne zF3O*oQ?Ug0(+8x*SaO*DM0P$JWXI5Lc)-#@1K}3L|7m?Po6mg1TDEXEff5Y%3J;ik z?;?7P9qsA<^lSAKfpyH;Uk! z6p#bWbs6`}dOx&-*cI5$-?#NqDaCc&!$$C5!XauU`GC#`q-WT$32Rn>rNC_1PS zaE|r^f-DduWu88j05}6Aw)t~0%n-HAPq)eG@vHUFC(Mj#3tM4Wllj+x&kj$v{jgoh zU{4F}>cLP0Ih6xZhK_n!MJbS=O4OA+OS3Ula>04PjJFyVU`OTo-EhIAmzA*mp!6GE zNk{L#2AcrxnDwU-X4)CF_!MRJl;c)r|JEBaMjl4}O5#?m&)m#Ka?#uUU>VE-MIN-U zFx-qr0jS>X`2w|y{99hSnb!FYMNBaPks1XzG{~~`Tv2S!mg?qMvt!)3;)zul1i8J>b6Fn&_|SP9Uz{mj9|OrF3hcbbFe$ajYmdnqGz+dYYR>9j{( zm`9;g#wT6Le|`heo&jl_9~3_;xWXgi1V$o{O<9 z)^~22qDXsGL)umoEu@7JO+oBTL|#>59l#Oy86o=^4dA}o9N!jNwjh|Ra#{uQ9}qNc zssTOsAIptQ{_ETl5leM@MY}JFCVj`|X>J?PFHGtTJVn8J5m;Y$1Ka+&#kW8o{>)GU z{I+|b`%rj?CQvjK|(IjyuPu47)FY zN#7;jA$~?x z#NuM}bR}AVedB*|Q6uFk3N(dQS^T6=?13vu+sD(wVD}j$PTj~<&;y4-s%j>nesnc= z%3BQ;q&&fvmd?*6g6vqhTPhJh69|O)dNHH?GBgr6<;Wk6_A9G@a5tTP?t1JgR_j(~ z?Kp78^tI-6Vo&wI2^xvg6ZwZcfzNhe?*$_b>?z=ohuQl~Y5ht~-sJ?fn-r>p4^cj6 zke$YI5$cbU_SkD4Q%O&L3v zQ#hx=$t}2-w!)O4b2_sRt%Jc>zN0#-5X@oR&Nu+4e>}u*A9huwqP!4aJ`32~b5*mC z3cHl%9P$Z~{zs-%oQ#Tpo_LS?O;e*YLLzAW+P9z1(br>onB&O6QH0$%eIRES0C~ju zn{fxWyw>}Hk0zgI3VTfC++ZShc+Onw*0wQc6bg`5;dXwG$S9N7-TjT@Wh6%tb_cXK zYO0z@PHj|R)BcPn0MaLN2Ls@}Bfc!iLjGcU5^6Jf*%2KJrY>9eOmlZ@7n#viZzpPh z^$`p9NB%Q#Z)KR`h7Ri*abYIr7d5gJB)2ed{}xc&2m6PZXkCdymkKDk5_l)Bre=+S=G2fdPBEn~yd zyu#;Y4<=_CxK+3egejX7={^_d5cp!wd`(_yba9)0GRujOt4%`;F^~AHow4JFF@>ii zw#xS)JIDJQ1R6J74unO`9c-RS98d43JIU| zgz*G$=V@jn2$9@h5jtzdP*ID|dcc5aLZ`aKa_hsDE6W~To75EqVm}JjAJPq=(DAPi z9D+pasZ%1m6H8w!3G3kjGag+;I0wsZkvCxc(UFIUe8T6;pUNgI-qkB`8+b58{^gMKbl9adOjotkUgJ1#t z$@t^O{K$dN3yA@a*|BN-7<2pw%*i-YD1S!ryIWVan|Kk&L&r9sEj|+s-Yg{(2n7Lw zejrl97wj(tqKEeR+l2<9WJ|1?6pI;4pkr@-!nZ6>Vm;xu&FR)GZ7#6c1W+J`JoK_G z&a=7LPZKy|x4MEof)*83nB)^!-fb!**G~6h9dMNYLReNtsL~G}K}LYyqdLn5*H6r} zw*h6};9pla_OzkSu$6H>_objTXgai>&zi|>Dy4+4bF`tGC4Q@_(CQvWQlqY(XAJ)2 ztItdmgzx{=*-(K!ekA^~YiW+;-h2b``BE@6a_AfTU%6klb5N94&1-&Di5Xbjam=3Z zN#pD30GlCJtRYoDUyDrZBFMljWr~{VP32Nt0~@oxDC*{ zT?RbntXQ^lJ#Ap%;VEIcC%6AqW|Y$rrV#@u*vEr6#UV-(7#}Kw>RVs#>|m(rz-NR^ zNpEj}!M5LS{E13n`U2EgrzYKScz~5?FS-cvCetu!J~3dQVh@c?oCg+XM9xdMbg{te zxl2tsHs5Fb{Xd^g>|N=e+_86#fa>;Wua$C>7{DgvKrRnm6uLA_ecwt23f%ro>ISNM z1Pn`FZBp(pjqt>=fLly7>2w8$6X#>S-mu-8q7y64n)PhVhbZyibyNk`2g(?j>=4~2 zh$cM*9HfMk?>fAF+eD@8?y+Ni3vq>U&D;bn>)Vx6g%VR($DR<5^Qy1OskfUwo8*;Zla+bxI0H zl0ugAyH;wtS5w-!rO$?@t5fSIZ889M6UAR|5uPk{P8b&%#?5*})_LbB#Rd_uJ=3Y< zw{c}_*N(6B=6M+Hl%h{;f|Xlw9Jqsj49YC*vZ1-$+`FjI9Z0mIk55f(#`fj&gwxcZaT~RzufhfvwjQi$Lk7`4uSha!d{=M>V36Ff@ zU~KXURN*Ck0Jry)I`Q-Hz3Uql5CfeKmz0tLR@$`L)FzZzmPwb2>>`RkV7P*{YUxeN=bpDyoPc@d>cd@)v_Sph zq%s)%<*JLf)XT_(2Z0G?C+MNoz~uV>GshIx>L}X_>0#nWqpiBoClu0vul*KO_WN(r zJDdkQt4!>5aqwxksmjm4f2oXOK0nBRxCa_D`-MdfKk7VB;T&Noe&U{iYDs2tY4ZsC z6}#qfwwYOD)fg%JX=4MtzE)N!5QUE>lQ9P2=_47szCYjZe&NANq3Z#U$iY8F&p*$= zWR3$nbnra#!=K8~-#<6}5B|JF%CfJ6JTFbaTwFh!d_1skf8YNBwx4tzJZ0qf`}-H@ zXZ2C;|M%%*@_n;@@Dl3qtp}1g6w{$f9G;xNmg3M#97y6&B@R{M|2oMFkTCqD{&SOQ z=qb16pP{DE@8A(~0=571;GbVd_DgUF&-`Q#-}*-shhjQZiNlj~paZZ&D{&x+LzOsG zi9;v(R|gKA?;^(Je-|+h-wH_(JPyV5M-GSDbRdUAmH3Y!4h_s-Q5;%{ zLo0FUU;mzl!&u@#5{D{rs1k=x@~;jYI>`e`9IC{jO2GbiJ4xDlrhum7CqF?q-ho}d MsHv8ra{tNy0S{4B_y7O^ literal 0 HcmV?d00001