From a4f1e1e4176653ccb7bda2ffecb933895f987de6 Mon Sep 17 00:00:00 2001 From: JD Date: Wed, 13 Mar 2024 09:44:10 -0700 Subject: [PATCH] Article Fleet 4.47.0 release (#17590) Article: Fleet 4.47.0 release https://github.com/fleetdm/fleet/issues/17014 --------- Co-authored-by: Eric --- articles/fleet-4.47.0.md | 144 ++++++++++++++++++ .../articles/fleet-4.47.0-1600x900@2x.png | Bin 0 -> 51306 bytes 2 files changed, 144 insertions(+) create mode 100644 articles/fleet-4.47.0.md create mode 100644 website/assets/images/articles/fleet-4.47.0-1600x900@2x.png diff --git a/articles/fleet-4.47.0.md b/articles/fleet-4.47.0.md new file mode 100644 index 0000000000..146e65f6d6 --- /dev/null +++ b/articles/fleet-4.47.0.md @@ -0,0 +1,144 @@ +# Fleet 4.47.0 | Cross-platform remote wipe, vulnerabilities page, and scripting improvements. + +![Fleet 4.47.0](../website/assets/images/articles/fleet-4.47.0-1600x900@2x.png) + +Fleet 4.47.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.47.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +* Remote wipe for macOS, Windows, and Linux +* Vulnerabilities page +* Improved scripting +* Improved Windows configuration profiles +* Per team host status webhook +* Improved DEP profile assignment process +* Policy data in `/hosts` API + + +### Remote wipe for macOS, Windows, and Linux + + +Fleet has added the ability to remotely wipe devices across macOS, Windows, and Linux operating systems. This functionality is essential for IT and security professionals needing to ensure data security, especially when devices may be lost, stolen, or compromised. By facilitating the remote erasure of sensitive information, Fleet provides an added security layer, helping prevent unauthorized access to corporate data. This feature is part of Fleet's ongoing commitment to effectively equip administrators with comprehensive tools for managing and securing their environments. It underscores our focus on providing robust, practical solutions that address the evolving challenges today's IT and security teams face. + + +### Vulnerabilities page + +A dedicated vulnerabilities page within the Software page has been added to provide a centralized overview of all vulnerabilities (CVEs) identified across hosts. This feature enables security engineers to quickly identify, assess, and prioritize CVEs affecting their fleet. More importantly, it offers the functionality to export a list of hosts affected by a specific CVE, streamlining the process of passing crucial information to the engineers responsible for remediation. This development supports proactive security management by offering clear, actionable insights into the fleet's vulnerability status, thus facilitating a more efficient response to potential security threats. This aligns with Fleet's commitment to transparency and actionability, empowering teams with the necessary tools to enhance their security posture effectively. + + +### Improved scripting + + +Fleet enhances the scope of remote script execution capabilities by extending support for longer scripts saved within the Fleet platform and enabling the execution of scripts by their name through the `fleetctl' CLI. This improvement directly responds to the needs of IT administrators and security professionals who require the flexibility to run extensive scripts across their device fleets for comprehensive diagnostics, maintenance, or security tasks. Additionally, the ability to execute scripts by name simplifies the process, making script management more efficient and reducing the potential for errors. This update represents Fleet's commitment to providing practical, user-centric solutions that enhance the effectiveness and ease of managing and securing your fleet. It reflects an understanding of modern IT infrastructure's complex, evolving needs and the importance of adaptable, reliable tools in addressing those needs. + + +### Improved Windows configuration profiles + + +Fleet now supports the `` element in Windows configuration profiles, addressing a specific need for IT administrators managing Windows devices. This development allows for more nuanced control over Windows OS settings, including adding new configurations such as Wi-Fi profiles, a functionality particularly useful in scenarios where the `` element is ineffective. This enhancement simplifies the management of Windows devices, providing administrators with the flexibility to enforce policies and settings essential for maintaining device security and operational efficiency. Fleet seeks to empower IT professionals, ensuring administrators have the tools to tailor their environments according to specific requirements and best practices. + + +### Per team host status webhook + +Webhooks can be configured at the team level to alert administrators when a specified percentage of their team's hosts go offline. This allows an admin to prioritize webhooks for critical teams while setting a higher threshold for less critical teams. The web UI allows for standard configurations, with additional customizable options available in the configuration file for more tailored setups. Such granularity in notifications ensures that team admins can promptly address potential issues specific to their teams, enhancing their environments' overall responsiveness and management. This addition reflects Fleet's dedication to providing tools that support proactive and informed management, aligning with the platform's commitment to transparency and adaptability in device monitoring and security. + + +### Improved DEP profile assignment process + +MacOS hosts may occasionally face issues during the Device Enrollment Program (DEP) profile assignment process, now called Automatic Device Enrollment (ADE). Recognizing the challenges posed by the Mobile Device Management (MDM) API's rate limitations, this update implements a smart retry mechanism. When a profile application to a host fails, the process times out and is scheduled to retry within the hour. This approach is designed to mitigate the impact of API rate limits, enhancing the efficiency of profile assignments. Most failed DEP profile assignments are resolved within this timeframe, streamlining the enrollment process and reducing administrative overhead. Fleet is dedicated to simplifying device management tasks, ensuring a smoother, more reliable enrollment experience. + + +### Policy data in `/hosts` API + +Policy data is now included directly within the `GET /hosts` API response in Fleet. This is tailored for users who prefer streamlined data access by querying a single API endpoint to retrieve comprehensive policy data for all hosts. With this enhancement, users can efficiently export this data into an external database, facilitating the custom creation of dashboards and reports that suit their specific monitoring and analysis needs. This development underscores Fleet's dedication to efficiency and adaptability, aiming to provide users with the tools they need for effective and tailored fleet management. By simplifying the process of data aggregation and visualization, Fleet empowers users to understand their device compliance posture better and make informed decisions based on comprehensive policy adherence metrics. + + + + +## Changes + +### Endpoint operations +- Implemented UI for team-specific host status webhooks. +- Added Unicode and emoji support for policy and team names. +- Allowed gitops user to access specific endpoints. +- Enabled setting host status webhook at the team level via REST API and fleetctl. +- GET /hosts API endpoint now populates policies with `populate_policies=true` query parameter. +- Supported custom options set via CLI in the UI for host status webhook settings. +- Surfaced VS code extensions in the software inventory. +- Added a "No team" team option when running live queries from the UI. +- Fixed tranferring hosts between teams across multiple pages. +- Fixed policy deletion not updating policy count. +- Fixed RuntimeError in fleetd-chrome and buggy filters for exporting hosts. + +### Device management (MDM) +- Added wipe command to fleetctl and the `POST /api/v1/fleet/hosts/:id/wipe` Fleet Premium API endpoint. +- Updated `fleetctl run-script` to include new flags and `POST /scripts/run/sync` API to receive new parameters. +- Enabled usage of `` nodes in Windows MDM profiles. +- Added backend functionality for the new way of storing script contents and updated the script character limit. +- Updated the database schema to support the increase in script size. +- Prevented running cleanup tasks and re-enqueuing commands for hosts on SCEP renewals. +- Improved osquery queries for MDM detection. +- Prevented redundant ADE profile assignment. +- Updated fleetctl gitops, default MDM configs were set to default values when not defined. +- Displayed disk encryption status in macOS as "verifying." +- Allowed GitOps user to access MDM hosts and profiles endpoints. +- Added UI for wiping a host with Fleet MDM. +- Rolled up MDM solutions by name on the dashboard MDM card. +- Added functionality to surface MDM devices where DEP assignment failed. +- Fixed MDM profile installation error visibility. +- Fixed Windows MDM profile command "Type" column display. +- Fixed an issue with macOS ADE enrollments getting a "method not allowed" error. +- Fixed Munki issues truncated tooltip bug. +- Fixed a bug causing Windows hosts to appear when filtering by bootstrap package status. + +### Vulnerability management +- Reduced vulnerability processing time by optimizing the vulnerability dictionary grouping. +- Fixed an issue with `mdm.enable_disk_encryption` JSON null values causing issues. +- Fixed vulnerability processing for non-ASCII software names. + +### Bug fixes and improvements +- Upgraded Golang version to 1.21.7. +- Updated page descriptions and fixed alignment of critical policy checkboxes. +- Adjusted font size for tooltips in the settings page to follow design guidelines. +- Fixed a bug where the "Done" button on the add hosts modal could be covered. +- Fixed UI styling and alignment issues across various pages and modals. +- Fixed the position of live query/policy host search icon and UI loading states. +- Fixed issues with how errors were captured in Sentry for improved precision and coverage. + +## Fleet 4.46.2 (Mar 4, 2024) + +### Bug fixes + +* Fixed a bug where the pencil icons next to the edit query name and description fields were inconsistently spaced. +* Fixed an issue with `mdm.enable_disk_encryption` where a `null` JSON value caused issues with MDM profiles in the `PATCH /api/v1/fleet/config` endpoint. +* Displayed disk encryption status in macOS as "verifying" while Fleet verified if the escrowed key could be decrypted. +* Fixed UI styling of loading state for automatic enrollment settings page. + +## Fleet 4.46.1 (Feb 27, 2024) + +### Bug fixes + +* Fixed a bug in running queries via API. + - Query campaign not clearing from Redis after timeout +* Added logging when a Redis connection is blocked for a long time waiting for live query results. +* Added support for the `redis.conn_wait_timeout` configuration setting for Redis standalone (it was previously only supported on Redis cluster). +* Added Redis cleanup of inactive queries in a cron job, so temporary Redis failures to stop a live query doesn't leave such queries around for a long time. +* Fixed orphaned live queries in Redis when client terminates connection + - `POST /api/latest/fleet/queries/{id}/run` + - `GET /api/latest/fleet/queries/run` + - `POST /api/latest/fleet/hosts/identifier/{identifier}/query` + - `POST /api/latest/fleet/hosts/{id}/query` +* Added --server_frequent_cleanups_enabled (FLEET_SERVER_FREQUENT_CLEANUPS_ENABLED) flag to enable cron job to clean up stale data running every 15 minutes. Currently disabled by default. + + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.47.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.47.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.47.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..d078f321db5f9db34aff0a1dd9a494c06adb212e GIT binary patch literal 51306 zcmeEvXH=6*)NTMlL=X!C(t;ua0wMx})BqwXC><%%M0ykHH7HV~1(l*GMVf&0-VsGW zdhZ>S-btuQ?j#Vu^R0FN-F5%@u5}J6?>n<+muEkF&*Yrf$`9qKC>SUp5D3-1ySG&# z5K12iy1Eep70zLEG0`*F`EC-y5 z8+{{(p0jC3Jw5Z5{&j?+>Sgw~s!lA?PEUgKjTPLhXT@{q)+U(d?zbzIPY|_zgdWN7 zGjoiUuoT?iUngMyef##D&wt-u=713W=l$J>|7)uv{1fEZf4*hCMfAV+HJ%fLJ(IuJ zzlr~;`k!JI@B=Ijv{7Vx5lEi;7;UBO5S4sRU+F<{Q z2*|%O^W z8~Cg?CZ0(gyOqDmF5M`nehezNWUmWX8tH^QvfbREIb*|3-cDgh zHHp1a`XG&PHonzBS-xskvND+M!g5eRUrvxyv{QW$su+BIdS-sIvmic+&{gVK!XX=s zo#rHTaWy_TQkITmPfPL4OG>F>XH+-C!E;M)595hHy3;WR72HE$n3Nk1)`I%*Kfgo@ z(S8%rYMEZvdJZNda6PPCuw>iswXJk_%8i{BUrlh17k~Mrvg7o3KTBn@LG1ij){2s% zlhR`WPu7jmcHTF#hdiwW-=3a9TdD8ZU;B9}@HC;LWqt=&nIuGrM$t_+cxLYIcs^C- zd3i9?iFz;Eb+&SN$YZ5qCK$RZNB-QqWP7`A_GWh2i=nrTiCV|prjTz2itR2RNdSrQ z!}ZBHV==8?jJwTd6RQMPrxo+a@;!8oqtD)$FL%H0FS(oZ1h`LQ2009c`T34t;wHmw zO2=!Vd}F0oZX%uKH08)Q8WG->RDZ>zz>6oCpY6?K>Iqjkz}h(qq8S<&fSzt1{2@^x z`^nI##IoQiCQ(Ke7S-qIyJ=_6nIoW3HvxhsGVbG|Ho4zxS$Dl5NaHu-^(8G9 z`&PS_h9z|cCU_PTUylKKQDl{UcMS$Thvr~R3UTkVNi+D!OT1h4xp$o}r{-#td77Eq z2>&y;gWk`1B2GgCTt}lTOW;((T676h`dg~4zN@(zE#oqt`lKwGy)|AI;Ja|`){V2!GEVYUY2=gyLU#lDRfyXZ8$ z&_#2)WOw_Nh7_@Opi~rc>(2Sd&aF-=V*7ewmHBKLnSoN0#d|?%FV8dE*zd!X4tCd6 z6j+bOfu)ecKuAT1?zh$17-T&>$V&)>r6P*!b}$QatjtAi0|$21>K}HDrTa5_k&Em7 zE^_D5V;u`!eDF%OGcOJbs+*^BPKCY(gWxZprnHruSO66Fzk+G^elPrlp0wQ=Et}I< zt6FvbK|-x@4WspJRAT$*g4jw>hMOxoqZDofSMMxeY1Vy8{?ySHTff=P$H5@EMxmPo+n+@%(_0(Fw5unOk z5>YsGrB z8i)x#r*(1C^7q-rB1~0YU9*zZUs=`F9b{zmUVPWd1JqqlMJ-NavR(GMmtR@;Z0pq5 zk2wgS>c1;7#Y+&1@OHZy^B~Vv^%b8<5o%?BLFKjp7p)Rb{`{dEu5u$|a5uqsmz)R7 zi=_zDH!0$ceBE_+J}pw@)lPz_C>u_joJmj6(;2NLcLW&RCno38obC+bA~WD-W{~Mt z$DRgq6{HLNrL2jYJz+A4G~~&NByFUfBy*MQ?_dKE-OmKSK0!WR3#&-9E`B_!Yw*Kd z)1cD+0b%ZlNE||#mwsLSWY>g5#Ft<&&q=RKEZ(g9Z6?*a6eG5BwU^?qKn|Q|pl4VE z`}eUo_{Y+KxoX9f1H}Rt~Mh%dELLWgdWa<)NMW^@t8u6vO7;4 zPFYZXyYt6S%}k%I2v+|=pi|18sAG2jOQCmg3KeWI>DR%!e)+m8&OC^;8KJ4PSsvY% zbJivE@GTjw!QX?QDFT6?=KYPjQ_(};TFcs#SJ{MnAMv^B_Gi@2-Sxae602aWX7^~V z7#O^bfPzejqM-WIT8!m@WNVGmsBK<9J!|AHl2uNatuOsmJ zwRGms!(*#PH;wEr65px;>`S^#vF-2fmd^&>7SSW==}{90sfa&fNo61A4ec+q&#o1c zhHqZ@AbEi>p2*@(lpZ+Ki9zt9?@T`Cg)Aus7o=(ov(D@xk98}L_?EZ)gq zkz(>OGgw%5$!W>O?!{8?SJR6dt!>?}hH>au zn7vTG_l~GIgJq`RZEo4i*`H z4*d-4e9ijg>0U$u;j#O_KH>zGJ^z)?SWF^D5o+;zvc@*}2Imxlq+Oecs}j@lPK6e+ zEJ^=KB0%qdAeh5W8#i0Y{_E$jsOi)O+a^M1y$80qSxvODTFROFg8LhCd6@P83dn|! z_Gd|Ay2d+$e?nnRg&05{qyQ1d-WK5Q20(6VK$M38!{V=q54eE8YqVWl{QjfmYg6?; z(g>1vw22}UQ<$lG9n?ezOvK}3JuG~-)x3Qt0!c_=2|ai|PVtkXe#NGBJ5ZG;KEeh) zJ-dt<9}hMa5V*>Nnf&i9v#j=qJuO-m=V}}Ee{?EaB@yX#llgp>aCB8SJUOsYB)Zz zm8@R-t~3pNnjlfy%i`>~MJy|L|MnJUNVm!zly7No*U>+}-;-DGOn<#DB6N$zi_tFV zD%TW(4vM~muFz-&^`JO>$906i;~ckW#yNK0I;h>J_kYnd0}o~vp;bCrfL2ceAdZXks9QJ)en;o(iI3OsWFx&cU-i+jYIuu0H+Ox;d>00(K`==_h;#UNK#?o=y-U?GnzR zl_?qwtU})`+jN%9gT#$c#W`!ue*AKthpvZUlG?dx`uCQU zeUcB7U1y~*I`SdbcA=&>g$4AeuLdo@i*sVUR8Tgb?z&qsertal-E409MWYUCwHk{Mg0`=J#5On=*N4dugF=mG1<=!aCztW)OUG_i zn?0(;&?(jD6+EIXFIEI7=^w!`Qk{@~1%)cI$%bD#*ujjwaecDd{^YsyHNrSC zc#4=7a_QJSvnVsDhO3yej-Pi|D@M&>v73N(I}_-{KzWg-I>Qh9mck% zqE}9_1b)cNdoS+DTHijV#KLsyTCCG(Eb?@6O|f8hO(rc#5j%4KC+Pl!{BmF8XZ9HT zlo0^+Xd4Tbbgj{(M#=X^{uT>E#0LsDa4c>g_m?Mz?5qXFlQbP{K3w0dZ5G=;q;7O! zIMK~5<(Rt0cKgsH>UB#e-pF4#@Fd4|Od4})HkVI7eY)`U+mrH&=mwKf?kCe!{XZ9K zU(i?XHI**qpEt{~tAPwsPRf5kw<5gH)}X}t+G=e~?Ko8B|2wB)6p^nMmE1LVnA3e=d|?9U-x2Jl!E`PXG}f85~i9e3N^` zJ&L6jUh!1s2g@>Exo?3hwJjet84PcGm4|f#TUeH)U4R+AS7Xh)t zUlUVjeQ+<u_n_(q}vmCZnYox4oD8@G^jZJ;w((WDOySPFJd9 zi-%ta79u8be>AYknt zVWh?fcms62!rA{(&B37SM9C^4qp(Whmj!#L4OB3`i+VK0Cc8+$IL_mTU!DUAY8Ae{ zh~z#JU6~~dHz!Q(G{F)uw?oDqP?69D%(#HNCxN8WPY!ujs{9#I5h8hcFfTy zJ`0ChQSTA1!36#t?CPNxDNEy)Rthvtm?e$uP{yBl>mO%58V2Tsev(jLS?G%-CEq)-EDmqQ1EK|g zg&yPQCrt{ub6U>-k?*6G1G<%Cr%i9R#8ve-&u)q@4tf|iFKJt$w_na|>lr{2F8>)7 z6tlunZT!_Fk9UHEW2s89XCLX=+Y{vdefe-9#PKyw5C4A1e)!=thwLhzdgo90paNe4 z+xXz_q0yr7PKMx$Gu)+YOU#Pfg(708Z8k}d;-lKCZS7`o_|*BZk>~S*2oJDKzR-2Kf5>NjV&=XH42Ag zRuTs~HdUX^wS5%1bkZU@x85*=ROYRm)Br;~-18kPxnC-p;N%&2Kj19XSz{}5pe$UT zR!&Lyb!&AGRxE*;wmb2X>E(wS{;Sziv+w;2y_oj4Sw7gLpMTmm6@5&a^YStQ+CZNa zr(dI#4tdK-bLX{bn5A?$4e>q3<2Ri~)_8XK2STC9yQ`CM%%D~%D@_||YrEynX9&tl$;I2YR=6#9XtAJFt=U95~(AI0NRTPRXUlQjBjyU1Ybs{8;kMa2m4R zsr**^ZR`kBxC`9#Cp*E@)Z5>Hm&&Z^$mz{!@0-z+h?r@4X1bEc&mCyVjFc7|gfVLJ z*M2~Sm>VcxmqFd-c`BFc#%5(nHm(Z672`$OkDSJ5;S4TZD2(b<*ruje_kUP3+Nk{GCb!y_qgRoYz6mz!4#O;%l|?#YwRbbhkBMrhe2#02rb0P0rP zp@5G(|MkFrD6fWA?%kM!CCP3NNqiWU1fN`FOVt{4nJrr6J&opWJ)Gejym%*NXNbD^ z*vv1%WvG*Gf0cK9!^-Toxb4aygM3#*U)VSHaA&ejx1JO9|Cnh52-7z9WqE5M|$(HpPZ9I15 z6G2}LIQL{NX*!KbyI`+A%=Z!2#6rv^yOZ>%+#&22iyy4f7tt~oa#dk6OujtI^fQ8o zRb?%lkW84a;vbK0qQRu4`@yoY3kG%manXq(xDW1K3}1PW)6nmo%buX2y4kRmu9j%2 z+Bp3+7#b{J5oPlEZ;aeH90ju>>u~=(CT+0dM6&h8@I@(C#rf}0A-KSFsaDB6QVY`( z=A-%ETeIjpG<|s*y5e^IB;0(Duo8(dkP&@8?V`tHE_`9$w^GsM8hA^5&17R8DgIh9{E})Z_%;{-%En1_pY3%k2B{e8}Cw6rbjX z@$CQ=GVm;y*AANn0JN5Pm1<3f4Lj?G6Z~G5yNoc}F*NL;Zy$S|c5Kt|NFs;m5vkBK@}Yr=d`HJ5vxp~yQ zTJsUFT(`jQMr0xfheSwsL&xO+yqRFFkWTeCk#;y7axc>66@sz@(w6O#9W) zN-?+$M)qo}<5*p>Pwn;P%#A{Lavx&XWrXfX%5RhBaPXw_C$rmIVBpahqY5sm0LMDv z{hJM7w&8Wf809#!a2m|q{2(FQ5*|t=x1now#vu_~Sd-n4dbe|hdP_N818?||g_A^~ zH!Y@iIDLCC_SnSiqv;@IcW{is{58#Uyrem2l{b?dnFKChiQ6ik$hs2is19R$5GQi23ARrF0l_dFOXxTY zT$}vVQlT-Ncf)+@walsGZ1l284`QxM{$K8Oqq;RCZA-$+aqjdf>ZGhYWkAhmAGW0WIhH}^W=Ny>g75mx{3t*oN@?AlE8l` z_}z=gPp#~z?4I-qVfhmu?lmuBdKZ@TN%bXJI6yIiB|Ah?T|lI#HXB#Sjm_9YLvQJP z`^;yIU}5OsWM(J#;nA(WaU_dRJwC6*Tth6=x(Q6#>{{Ku@O6?n=1Etby^5nkbWVuV z=pxC{&E`zFi1lG&0Q4w9tDd~EgEeVb{!XVvnfu?Zo=`kCz-op9c4yfHn+NzgZg=wT zuOJ9y+nnc|IBvLGU7acikh?D11e}8~DBx`BAEK@pJ@Y>r=~$kM%kMzTbQk;dI0L!*R`I z;l0GCymYn~vVHE%&52wLvUX6yNY)&wIDzue&;z+9vd;{08F8j_f$kXWRI1r5BZ|86 z9tk1HDNo^7$c|%+&kS+2#I0~|Hiz^$D%qKaA-T%y>Cuo7rocn7+pRrs0;Nf~eyt>f zsW$)IFmooeLk_476Ehe&?gtWX7dd@6FiyX5gF6L=23$1n`XP7omp(Ap>hhKtn1`dz z9)tbYJJ%0|*3LtD)K+VXZ`!>vYwov%3>s{w_8TKl){vXO0=gmCW&(D2yW2s-I0Y(l zTUpVvTniI&x^axf%kuBG+&9BRNHHC@8h+Bd`PEnArnMWFW@f7k$)PAYBUObQ1fdOc z4`CA7KCVZzw2p*IGRZx|(J=|JadK69Q!_`qq4R{BuMZpwaG#1*2ZqvGZ`n>H2U#ds zLHPKY672Q^qEJESmJz%!G)D1Wuz**?CWP!ycZo-&8rl;`;n7zQu z%2-@UV*sCGRJp7JyCjM3XeJB=X}yHcRx**gu&#D}z}sW4miX}O)%IzjH~R@80*R5s zMM9%r4`c($!4j5nZyAbX>YRx*nD>urX+v=AV-`A2Lzufm5igH8(mYz?)UhQL?J)niG=fb zHIMA>og1GUWeLk40!7r$luI>@N&dkHX8zUB(Mg#=?_GQt@skyVr(oRVKHzm(1o7E) zs$^^My&AQrC{EO-KPxF8r#G=)Y7q}8ydEQ!7Lz=>vmtxJ<^SXBq4?}N(}&$%J8(6f zZcpT~oJ8PQt@bEpCsoxCmcQ2EwP=iNH#nIfxxCCq(78DtFIY=d73#mR>?m@@z%l@H z?d^%9T49Df(6**@G6YKtHR1dhBZDcM{4~UjfN$E`u&}x)HysgG@GPuC9oXG z%+GM}6sHfL_pCx50Iv1@8X5k<6jygM z;5txT!39y5^VkohAC169>ym2OsB*1Nsq_U`V*NLyWFhxRxF zB?GB`^b-`hMn|AigriGNJ4?R=_K)#u|6qB36khm*4ZKml<1K#Ps)i2kHu(ux>%KAL z%G_ulN9%Z^U)$Y|ltA?qYoVvC^46#yhP>ve;@wyY#yU87?oCFMK$@;leNu|KevR>N z{CgJpn%$j0xqF5RBuf?wL~l6abr_Yh_1{rd<=jX34{-(3tcj#d*IDzXD9h`JF&m@A zZyGZ%GiNM#d$-3BgwnwaCF2GxHnj)Gw6Cvkqm4doW>ep0$pV$|$oe?;+Rd#>n%juAvrOlpSVU41;0bSp=Ox;-4^(;Jrt%Qjn-n7CyxD`-c@}rQrb>Bc-jMZm z=ah7fk!;X?684H8SMXg-UuPwijmpxp2#qjBb_fLW&8VC2$6@JrrF&!0n?e!x~DU_`=S1 z2!?|yD=xQ#bUV`HefBNkJmed1KuzP;QLq`BiJS(0Trk^V8QnG)(hj$MNHf@i7^4Tt zmXa*BaaKkYGcTTStLwTegR+tlVkp7=Lh@&1@7Ml%Ha&#`!@HKEKD7~jxUyBDB+Bx0 zI4C)g*(pNVonD+j#(#)-_M>+XO5yg0UBH=GGF%?aRsB&PKe7+URq3Z|u(|@ew8sWP zI|B!3+qUC#UMpdrz3x3=#Fcub==BG@R4>WBAY z`z?ID1~($t=W4DAe0wOHT(l_`+ig75!==5Jlxf9fMY@2#&>gkJOr9>Zau_f_FXCX2 zM&EMe?(hu%x#=Hf-kfa=+hgYb8tpk@4e*03Es#21LIcdPtc|u?!E{qWFGf^OiOlaRu9_9!Z`mS zRH~U6TD1D}ThB|@c<;I2B6d@O)*qdRa{c|KRXe7wqz29+vc_1N;|I^=mQ<3$Aa8Z% zjQc{`RE5tmWdpWZH}D}=TP$$WX^(BIQ+V;P{}_bFbIw?RLqDe_JanXSO_P%^6j=l= z;u=8tHgzgCPUu^J9@gNRV$eu4Jj`+LZumR|clE;1tpuBJYnryF7Z=9amj21- zQ8bb0ZE(lKp3eb3!`|m5y$MJ}iS_XC7-*E7z1OZb!B*w{BP!Z^_fy~92h95=PJk&3 zp7gz(elgi==S^q9bSTf3%J3@*2xpAod+*-!(NArl7CSLNqEX|^@gLtw)WB69wbV>Y z`YxVV(^axKw@3dT-TzJ#cp|tO@pWIqTO7AY&{8dx{YK)Ge|PyzP(G*HSUR zkV*7v>Tdjt`GMA$$$~>YGd#et2nfUw(v`4hY*&1jUY#$yM=LyRx>BjtnMs#(dEZUA zwJ%ZanKonBEUNIL1qq&~9F+tRhzO+zb%s?KC*o^%rHIw@Gm_@jh3(zdH48z(zRw37 z6jvP;@ed?OAFb<@3WX<_BnM3LQX;+A?@yXvdZAo|lE;4I($1LoB2&X*y-0TVP_l{B zkDY$9uMfNxqq^}3M&XmWgQ^NcvfkfE@l&0Nyl!P`M!V6OeMlPvln$RsI8~$>=q9Yk ztS&FQ0#p~GEgbu{0NYRq{CA~3DoH+6M5_|6!37WEHOH= z)IP|?gIWND+9V;!Lr#Fi2NKX2kgRoOH2YNAJ)7%X-we&s9la<$_gBfZx8G25XeAt+$5$ZbYAVtF(yTz z%u-KJ12oEuT~gm&6(k1tKSfNwSOKz8_t>t@i`U zZyDh4O0YXr4rG%0l&*~-4kb>aK*4n;9@De*UZ_A|LixyLpFP7dO9%w^8`Q>IL{?el$of-(m12ynQ7_&!a&JzPqla3VEuz8gm%< zhdT73$ncZuVx#n@Ax^*V@M7(_?=nhvwhpx84)4l%cr;7IP;NQ+mX{QeI^r^PpVT>w zVaKRfe{0*}$=$0*zLiEZNgcyQ3Nvk83dxUg>0TuQQ=X&->FK@gnDq9@s z#3b3s$tC>Dpe@*(;A*d+u`L6UK@!96C#6b$S?Cr%HelzEKqAsmD^~NWu0t&d^S4=C z=EXFrG27`!I}#d)`y7ynF(5qU*KSo4%WI8fYj)+L2^!a82e~@%WCO;2G*(I!*{T$L z@sp3HLhb8Y{f}AXG*9NkzP46aIMc4+W%RjjvKS~Nz_QL7>t~EdoDe@^_u+M`M5lPkWD1Jy7oJYaChE))MV_WaRIEV73lP4(T1Thx>5)7IVo zd?G)psA~ovY~1qaxH)hJPE6}s7gHG4B=`W_rR*-pn=|Y3K zwl1s1Zq0pT4ODq$W>%;e5-N=^6?+=%Y>@aV4e{*Nh zk9Y2i7+Y=`%V{9pzc0HOOXoF}i}+z!5O?ZYRy>gST(f2-Q-{uw0mWOU%wOMQL`!=j z?0e7CHGKDAIZT9{+_*SP=m}#I;t3O-e&sqm&w;Y#sLS1si$UuQ?QI6fSHAa?cJ{`a zRSi3=>!6TrkS4ZOm&eCX>6Key0Ct}AX7}m?2s;$+E|8LYZ-~XsS{vnL$#++F2q0Sf zO&cbe>_S zvPY=0bd@}kkr6r$)#W>RBSJ;V4u8G|m*?}AIfC>e;}`uBDv$kj9A&X!?yo~XGxv2InsaTZn3Wt-sLb%JdUB{aG04() z!Od!4gvO(UKAFt-Dw%ZGH+OyiKDEUFr1}UlB3VdiTfoIc_k6!Pg?cQGTjP}<(Td-= zQnnMDt`nJG#a@57G#bN<85jP{In>)# zVW|rmE>VA7<@JMgO`wp%ZSDR8UoTT-&DLu4saf=?ss03p9{-wMDuSOW!5RnWKHqOW z@5vSUvp`+<9y^;6MJ9!Mbn+$Bc7M%BiQ|x%q#)nwZN8POzZ3SxD6>jdBwEt7_8Zvr zniDq@l_K0F*exEk0w~G@*po!j<@RaF`fzMT{Ma)0vY=c$_FKKHh)Rat3bXoqaCq6x z(-8BwAYX@N+?5U#{N^tCT}C5=Z36odKJ>ueha6g$&7q#3uqb? z++@U$&iU>luJAjZB;~G2dvKSE)$NfL$vwnJT2F3>Pp$oYNLwk+eQLi~Km&JOA}T&l z7+T6MVxP5>LM;M5p+c&muXImGjqBK3VtEr=&wHVwCq1Nu zGu%JD@MPdWcttN^`IwSf^u~}sGt{Qapg-<5 zUmuUQ>Po;F4Uy9P=uU5nSEpMiN5KoE;DDZH7K2WX%)b247vb^ek49?JxC432x6J$V zcc%1&qi<;SHo?xr-hO9ksP?)a!s4XEpl}(1MNGCwgN{{MY=`jf;Gh3=o(x z=$PFQmcGoj_2xS;=r6gfoj&fu^V*d+5YLQ3*f?$^#$ z&YepcmBMWScPfI4W@HjUlX`V?_lB}X&8Pkfc+)_Lsud9tJx@cG*L_8L>~Z_HLM+2< z)hcv))a)_ymro;H2SmB?J+C4p*{~(s-Z$G;(Uk|(@9Y{SWr44W2;!}18_9m4qIU8H z(=AIa2!uopg+lBal=A%<%V(X_{lLiFwHvE*D+XEBG=g~}Lp3kn3F)j^wEYzCg#mj} zL|n$Yr#nPt1Hu|*ptChtXo2(}m(UuXif#!A(t^=jhBoRP8E!5|{9M0q1IdNvyatQkP$LeJvkxq(&?l#FWcsct}9!J z?0VJg4wlX>$!X6e0cR!o1!>KP)6ew0Yj5?Y0%1>rr_RsKw&dG`l5#Mxh+Z7DpDcwy z0%l*fS)|xt!DfxP3Dt{avhZ44A})vh0Hotim$xpku*#JJ(}&F?9umqZnuDFtUk+2BEL=>pSYNUN$2!`yyl>g)x*s1)XVQ=9EXYqd33)b$*$Gle z459o=t*F%A$8+rMcUF_x_&tDdLiLVQn@Vgj|k?$~=jWn<#Z#bY$P+2bTGo4hCQ_ht$VyttacbW94eA%~;Oh6aZwXHv_9 z)xAmb|7j0LR}evfo^41$%ZLVJodT4Xd#RK+lY zcPKQxJW-WhnO|y8sT2L&Ui_lZvqKcFR>ayE;iAV&4j7*LVN3HQ9wniH85dAvYR14O z6p#eC#c9mT%~bgh$wtUUq4R=|Eq%Z~uAU05Fs16+Jez=Ml66xbbN7<8|4J_hik;Mkm#z;D%QQ!wcSy z^-sU>7(mwa9^xj#6|Kk1{z^OqH(Gh!9Hx)0hw@pND+P zff=0GB*xQ?l#DTqN)m3on_r*)D97zbcQ64T;E@x+H3Jy>bgrjwx8MJqk^deZa5L8Q z-XfQcoQwA_hG#x|DYb@KP{{8HuX?2lfrk>iBS86_0*Axi@!n}MMD!37LzuKa5VL|j zdn0q~X*zS_7c*TNZ5;U#xAzqMo_S$bPCL2C5$wYzxHWYUzhy{aIG;uwG~KUMCBjJQ z?BeRP!65qd_Cfv3E&ktnk3i7^)5cRcUV)jJBvKgatq#n;Y8z~H3_O}2qNsjm(1BBj zF*v1gyE7KPQfU6l0yJ*(Ic4cTo9B15PE7^aUh5zxj=X`h>S&cN10`9)L4EvN88}vB z4(yF`vf~$E0tW3dG+^`I--19;Lg>tmV|R++g>8W7@_3$XB%P)5G?eg5zoNuMXA<7m z-SwN>_Yb#hIB$^;m#feRQD7K(aWiNIfQ-%%5%>}(n?~DU_=nhw$)FxCJ9-rQnnRI1Ja-7)!IXT2zf0;;Q9t~ z(S2QP2wo~3yTPEB$6={a98bxY-uOv*tL>2Zka+a(G{1u3DBj_Y-V`pcGrfOC2{~v= zep`5c1Up{-(o?I*-3FYl2u_R!1F5V`Vz^Ow7hwZ!kA-#vmx>r_*txF#M=B0kFo zL7k5ou93e04lH+gmZC2F-JRpdooCXF2FV~A(PX0y&JoiqtwR(WNngyY#Je<>rulcT z`>L2&^qhhGLKMcS{!mc?#{+m;oyan-33)4ewLka{h4ird!MxEu!6cw23dHlqs18V1 z$wdw*Gep_xokEvp_;)fn+fSTHCZsG{N>?7x(*+nmKf&OnI$)@`y~ipQmBop2k4Ysx zM#1MNg+n=01VlLpr`J!SfA9f^Kb4d)|B7+XrDxus7LvdtTZVAtJ-K0GQG2|PgZWN4 zo6tgG2^}_j4nbR4l@b!f0=YE;J0DIB(lt0kGLc)gA2P^aUd1FF57wW7@1vNPf961( z+5_uPB8FtxJ~=T&@iwvKL4=BBIOlWj=Hwsd4Hv{xnSAq_H4iu&qX7%L^X9?TUqxgY zmJ1%Xw75~Jm~UK4jdOcv1sc}MoH$p4+;Rl^B!X!4fiosolz1?DgK8bDHZ$#Azm;yQ zgf5Fnp6V@3H@nlBQd9^I)vy|XT_{@7W2*jERO-F2*5RicSk%JmMIbsHep0E`v#FUH zVEZwF9H&;`2_sz1u$6a87c|?yIdmwTP6-Z|+SwadBBHPnnII>|0-CxQ=^BG0Fy*uMlNqW$`}QSqm(w zna--&ZfZWmSHr~QPjlVVq8stV0fCYR8?80?RX?8#5 z*jUdZbJudC?s?`HcM?9q@$%VVwDzMYt5fQ=5dzt53^4O-mpJdWaRKu&`c>D47sq$4 zy!RXnXZC4-87?P@gVSF8%xBE1X9MTv1~$dfI`Hxej}j+~@ufBtqG+gw=K3f1KM&S- zHk9hK^?qW6*?@uZ9UoZtvb&K(M~QH8B`rkR%E; zWCX*NJ0*ygo92a`NwJTVj{$~yVH)7Qc{a74rPDJfOP1Rh)Lp+~uh09tdhT+7S`GKR?r;uV!xVP167$kOxcXp24go=sP*$i)SzQS4_V&LVOO4&lA(J}D!)_lmkFB~rJXd4( zCV5ebf)%iwnb5-{A2qHz-zE*6y;lbzK35sV>RGRCnQdJ>27AaqateKx_{D)c&XENl zStg4N!*&uBs3>J_US?+Y_zukyf%=!owY+z_{g^Yv5e7_tn*;A4J!QVah>P{(qj1Ld|=I~Q--tKLO#IME8kBcL4)xOI9r+^;>BMdQo8Jbsdog2B82#hL7Qjp^YI8@h6_oGos3jCt52zUE*f z&cKeb`b%e0(sUrb*v+ZsfYK;6^2_K!gcQrt?*Ze~x;(r1vy2AXxSz(l9i7!-)OD_J zTa{q^G3H^Jo5Ku#G)I&$G$bENo&ZnJOQ?Y~4unmU%*9(#&nQvALB7sT??zcuW(%&x z(=|uSiKDkx8ovs(FO80MV=+2gMF$wlqzBi6<-aeOs077a0A$A=50n+HL%6Y}l7?RK=NDG?| zDUO41CeR#+{GMq`a8o@eZHYB}_B+dneN`4i*JuAQHU4v;k>3SqI`;A1TEza!D7rZn z;qK%j@3}j+W$n_pVs8{{b+Cb8K7*Zw59$q=M%E?(S_x@)gC*D(GQhm*oy{-!h~GlaI26GJ2R~CLIk(zF~{*T8?Y3F4svIXj&0ry8RDt5zd(W|4(VB{smGW+E00^$~4+VmmOhN9$QmSHiI+NGrtE7fEOgf(hoFy(>yYx8)Z9xRw zb_0etO?nn~<921u{dEjitSO1n;8T!Lhh{7D6Aefn&h?4J9;`zaH9 z5}%=N)m}{da?uzdUgs#Y-;GKerP36sanH)UR_MOM#c;mSVYus+*a~ng30F5j8cFbw z^xM5UUp(U)sgXW>vKJ^1l9r+NaHR*+c^i52%(ER}g#%+9np1LB%TQ{**WYh#wqW4J zJuRIf@ylP7VU~KV)qa`Ei#qWO(Y{IZ zp55_@3DtLULworXt4q^Wk!5H$Kh6bkysDZf=8B)xf(6m7O^I549Bh1v8^OhD*5NU# z?e;89dC{R&MoU&)QkL@n+2Q zl8$#Bs%dOT?b<0a1Ivr0Yl+nc@BBN0MGWIPkgu#+&gKuw!}l{&(hJ) zy7H!Pp>K8;@6-kY>BWKV$qcet&%{Do-(H5@a(6>i40!(S98_Eu6%U3oqRSZ5GBB>cWzwcrKTN{(KInX2 z0^-KtceNX1X+pH5W-&aRDmQ_7mRsYOL0p{51O+Qt5tYpkCGZ=B`s2Q4!1CiHbLo+Z zktA~_;V66ghFZ83)!?}I@QR^<89Wy(?$`X6ZS?-=V&d<~sFf8=dn=b2*?y-XXoDBN z#Gmt0;9`BFbEAot_?}cZpZCTS@IPMd2M1GqFc#a81j;Vvo(qq;-gor-RA~miP}tx8 z9=zw>Dytxvxx}|zQqVq+b&|8i0$4)Vq{glNH2lf|x#?`38*eQo%$ht0+ zPL$jmmoqI% zSRC+$eOWa4*#>qM4%Mx}+@^WJd+>Re1hRnB4ybZ#fC=P=*Ur7Hwcl;nqrM`p zK4I!7ewUyjnVZMemG{k?@wpNc<3Y6yHgdn%#bbFqF^x|Frj|@ldzl|AQ=Hq$qo)TZ=VxBfHUJO+>a4 zDp|)Q+1DYVl%;H?ER}uVhU`hD$j->Vg{%|V$Bh5=Vfwya-~W@}li#x+4-mJ{a$V=V z&$-Tdzt8QNUchSf{K8q1w3C$fdL>zfZFp(zri##az;dJzD&IgpQndJXM*)rhngb=u zbJK(T1=}rFruS$;E%ucU2#qRpmA$>I@`1vz<$1e{B|&eKjKV^3`phPbeJj0%`YUT; z_4?p7`?1yxZ7UqGZ(Z`a(=|`Ic;=@eAOtJ<@9s(lM{`T#&0W>2x6emTo@IEBQt9*= zAh#qRfZg--1~I>(n}?k$z=(6`EbJWT7CLP=n>fHmcM@m(+VAQ}ftSYDsQ`e}8Vf?! zPCFXz^N$8IZL#I>Lu*|!pmiYcdI?yTRC5&gESQ-Dz-D1*;*9fm&=G-Z?I`={^`!84 z@|I=sJw}*>#1I|+%`K@}Sd=Zmp+np`;GIAg!N&`7Pa?VySYefRhlM0(b~kxxO`aMd zUiUhA)kK$blCP1DzFlVf(~oMj4s^dD$bt0igzhbM4q_kcFxB!2s3@LN^V?98{Q0w^ zgBgNW(7g*Snw-=9B<_D(?V|WK0f`-YZyi-rY6YH#Zt2ZsX+_RVqj1QpQ z?8CdSaY>Gsw>>Hw@i*p`o6WQ7Ph<^QO|N5*6)4px6J3Ip zVK?t#7J*Suu zCavPOME3ysT6$c<80MPbfXB*C!dqN|l=i^AH)_Chy>>lUYxA?Nh3}s}FqY+KuglP! z6)5Fiy8~$p7N>jZnL{qxH<|XDNBoh<6XFyF)KMO!3s)TGDZ7S7{li*O%d)EL7gzH@ z>ZE>0^;PYl|0|=1L7K$Hl`bOI{AIsN7)bxgmIkGI+9k{+%LA4G0;eeChx@jx253fp znAiQ)1W>Ym5MVTSRulHKsqas*J0dfzrPV|0DlAn}Kj#8AkNprjjWengtKte$A7ENq z$u_Oo7DRP@U6Z#-?X;WI2@qI!K}}H*p8vIe&qhprJVCR3v&R7amig+8tYnH7D1p!+ zEz_?Kl&ntfML2LAK8*2WUd|Z(2qGMPY->kE1liK~%UWdF7^%*tF(T!p+HNIFXE&n( z2e;PBMUHpBAW;v*PDWwO*Fyw@9SXbbdriyIQ`e0 zyJP5>Kj#$^EgMLEZ}iu3Sah$W_0hp0u|e7k{Cd{EZavU@_>d&bpW z(#PVqO9t)F`p%;w&?77T3ljwIb>Twj+`LP~SGqak+t}Nq`896{Q(=?M?f`WUZKaUj zVH-l}Pf5ByqSFHwA_rLrc*+~z`3J&j0bhvuYtR{EjygkIAVBFDzMB~~`(v;~I;=Gz z_=`4%k$*NLcKlWzJB^WULsJ8{(N-!+U=|hHFaS~!7|UY_ZNTnmH*2+w~)hL-k*X=yE)uU{95FA)|scp zRzBcr?YE&+5a9ILJd2vsO{35&m-craRS7%Cn)y}>ADeOz-T7&WO6n>wqHhc3vE@2% zxOOvgKYETh@d2^Y_CpK&pSxwMcY5c4fFv1K`r_|%YHPQ{oc#vNr2@93ZUC|~s9$(FE^u7R*>I%<8 z2L(`TitkKp^U;#n?jKeLjm8SS5IsZCS!iX=e#@6L(NL2s8f$Q4*@h!NxG4WzY!eXb9o1$_{mwS@!T|>7oVoL-FeKK0wVWTF-ATSyT6jqbju#=;6JKjT+G335-!0&)&P!%xPr5bVdpeFQ~@DVn;JFKaRfK}y<)03pjhN0 zdT&SW^v+E(Y_i04rvmu&tD8De|B$L`+e-b8jtG5p$PoXL;u&LbX3Q!|7hd3(2JlTH zu0FI$NK2AALKQ{hq66Jd^Y87fo0A_EYltCGOm=CYh8&k}cm@{$Nt9E*!X!8^sp)r*XqQ~kCn$(UhA-fhGdIwvdZwpEL6^5PC}lQu(YUNT)& zx6MDU?l%WKD$@bHwg|u=Z-)JZoJ_dogSP`!2P(=EsQq)-Il~{F11CxD9HWBA#qaCA zoATJ***tmPLoxeue7@gD6z|tEKAs0Ob51XmhXU)uf>y#~)(F8ItE2?rGu@MV{VLh- zRfuSqrax)Lu3`)W5@Xn0U$@gL> zOMU^!s90P&R!~4A7m}9%F~Z3Lw2IsZ+z2!r=~V1MADG7wBUX#%+}}5o@Dq7y5MRkIkv$Gjjf3*yyGx_-1GI^5gQs8nDQ;euqhqvf`NjNWWQ|Xp zPVY*;%Ix|lHotP8RD7IwKbEdbVWe-JP`7;F;S>|g?LTq%Nd!$^+G(B0bMFDqcY^%c+_aFk)4a>0 zrdBM3-0niqe275b?=q=VyFfu_LhS`*^@UGNTy zBG~r|R|y%D6W`aRcK${1HM?FRJ|Fh6z&jncF9GL#Uy(#<+}l280i z0F7DMxO&>b0H7Oq3UT3AzloE48#-kt?_iM9_U$V0*6I4tvszS9we)!GM#E4r+Djv7 z-m>;QKT-B2*i)Hs#Tv^6{!rV^68{w>O2e%(qEs1q*bN!4$GX9)zzIa-BCV4&7|H^NW4lw2 zMdhFJuu)|lp8b}Azw|P7Rc<<=ndW)R;%k=RrB+a(<;`cG^{h;Gj~v4s=CCla{E&Va zln6D#&v`j~|Mn{U6(pDsn4<9T8Bf7;<2PBBE+E3A>7G`BmeKbFIZv8Ndpi;!@*mrJ zAyz#dD42s{ILUX0?({-Ksdz!<_&BF%7T5S%Tgzjwo;Vq+j_Wrl2qe6F(DB~UCA zRUh+_f3+05T^g}&W-VT`{0_LGoy=Zll5!9Dbxt?U+&5sxZFKo?B!2=*yT1BW{$1~Y z)9}U&!cgvsO*PG+N$a~*nhw*K8PDm}m4-mWdKN7t%4g<;_)5Swu{ca!)PrqWAIUEu+agicR10s|-GT#`Y}R*w=}y{>}y&?O*3P=wSvteC~B+pwqSd( zp6^t$u1!4VS9`sgRBKs&CdK&@Xq*IM+iKE&H-cPZNB&k4S!vxDlGv3#fCP2`SEE4I zcQhmrP19ap?#Zgq28nL87acX{8tYRLTHd;sCwVQcw3o!-jX{*5Lrk87d4+HV5M49wk5OTF%m5euZcv%yI6 zvVnT{(b^eZP~7@%x*DwVTwGe#Q(sNot^oKUijpDwwwrmw`tmCmQT zU#3$A5X8Q|T1g6X{hoa!TdT7o`U1k*>99Pz(8ja1MvppD8YFypb{=Qt4rQ>he(!Py zgF^D%de#P+7E@WguH)AtjkJjN9lf(mCa$iRwkIvqM!$^Ft3rn;>>}ykR^^P^UX|)Q z9{B4Y>oJ2T--FbubeDJqszD}91b>Mt0dK=ps$T;t=g;sws0C-U>xO0gcZW*&!61yJ zo(R*!59kb;3{T-?qNGLJrt=p z!nf4^Jca+l6A+6r{S8>DJV(~x;OguSshJ1K{BoDeK~ZZ z)~@rWU*$UzplrXGYu9HqBrWlq>u0^0Lq&flJ*m9yPw>vx&lIIqx%*4${1f-;F53^K z!)-y;1sU~G$^-)g-J{eJGqM?ZVd#=hSl)=w>je7^ zS<=duMRLSvh4i$E;xjSPYnvj(h4u0}0hTJElO$6na(=CzR&3f_4-?NxAaV=9gRU9$ z7VIeQkUTBeZLARMGrHa`5ZA47ZEdC>eyi(n7ZXtTZ5JaA84V4u$(QT%XgKge^sX2~ zMwV1$XC(H$tnyC9xQuA(dSXN`5UcPS{^|MLQ#s*^!NieJjmLHKHZx$$7m1CdL}Hb@ zx`zjE9Q%rf4!@5R%|R@v&LDJ^{A+L7&-dfRz>}bMrH>$tRoB&8t6n!{)EFdJ$n^y{ zaz}_=^l2ErIBWmwJn5-5bXr$1f(8YZd;BiApDC=_Fcm3QQR3P#We;y5cK0j|Ibns& z%&hIBpnOoY)F2I?0FUo%tdf z8Xq|V0BUL6UR6Pl5rWYh?Q$(cA4ab8SVX?~(=73|_^61>c~&zXJzcZDi=fpw?cjiU zNqkvV3^Pbd{d0%RXW5#dm3@{kqv&6S5)h~j#LUT;6gzREMk+WNrsPRY?x)GXN?rq! zo}+B7R&pqAH71|dUZe`J)p}rG$;HzBRXx-ve6-Q-E^T;A3u0yR$R87;Jjq{|K(MV_ z+ujNyuZL=F+__06_0d~xXT^VNKhXm}aUsWk$1XfH{!*?Wm*dtFLJ|Y&O|Laai zuRGIkUO>D9&Ut*dk_&^SMbXKEBiY-6LGJlE<6BWm7qhZjZq9_o>hRwzfM)f-Rat4$iuX$L594V(c77IEW?4G`+Is(5%$K9KY4tMfv@Lo=jfQ1tpAvWc5;9diTw zUw&Jr2Dir_I!k7GVC0ORNtc1CA{Q3%2Jh0^O}0#D%uprvXm?IwTnBreq@XTvTpcEc z(idxyc&`eNy5SY$suI?#4m9?ztS4zzj$?g2wj&#H{=C@>3cZbAjBkuUO+QL*pd|n| zOIP@lahjFIksuRvhd{L^Rb2~MNApV+!;LFGp+qG>x_Jt6JnNvDcj}Sfxs^*xcyGub z?@GV=xb=y$^ADn*M5>-4IHDZwmU~oc=|GhOvfQ8XbxHW^@)21WL@;ZmPkHxQJv5t! z8MaZ5)Mw9^mS^>S$>;cpqrAr4Y)k|jUwlwzUWU{|OFXLvqmptbu5{h|yi&^3(g5Tf zP>F%}(jH5I>UJ^fmtK3>^hZ1z!#Mv)@|V9odB~$NY!b+|=Ni#XBj-TFl6|+(55Qfx zm*mB5QfKfZ<*Lu2LVgYIq(vtaKZ2?o%?wR+#&7lK5j!AI^FofEY3WdzWh}<7KT(n+ zsV|`Yk_Y)5`+i!Lid9RSNkdt&`XnZgYk6n6#y&^w!)SELpH-K1tE33Oqp4-#)eAeM zyzQ~1h2|m!5Ogl7tFI_89t=uNxjOKB!&>4b&c|`2gZQJ$tw394WN~Ar>u{R~lOJ>U z7afs_zUdv%ouc&c0W!t98n1Mt3V|YnjwW6@*d0TfIS;*>M(b4{8eh`O92 z*jebEG{C5zDeSax@}9&W!q;_ghg9rFBRzGKFfKq5m%e@LENpq9f}`@bOIreXwy#W- zge?Z}obw@OByt$St91;m{R?s>&(3KC0TS1(i_eB-d;To4jy+hVr-M%NlYkCMuy)~H zkOtRbqghyMQZD)kl&kWavv)4OF?-|>rs>?NT32-H9alQ!P~N~tek z(>rb)N1aNkP_^@A%6u<)|wGfcOMEZ90wtXQU~ zxii@>Hk4lA0uuv;VE3U_fmq(s*bQE6PO0wH$kJrMIqjf|tb+$&+%qG|J`#9E;!Wu0 ziIkhm*&}7(hpM#YTkZq3Gaxvk-{$65IoGl>=v-qmi1ku}cY{TJ3dBEjF{a$@(y2_y zca9?!%KoA^z%sBuq+CYR-cuHSm?===NA{5jR_a@Y2eI9Rt>M*QTWWoI+ut7ic(3{6 zU;yZnMH03LEI;L&lNZ5D{0AmXFCdu9vV;G*3z7mtC5orr?jwKbX=(G8x`}2g>+*nCRnHySPbuiQ^}7P6mDpPT^QeOq=8)!gR^;9tUPu!ImVqPlWT!fdkW~8&K3mk z&I1<&4q|zef<08gL=Cih%3$Z{-AZ&77>*WdH5tkAX-bS70a88oCzLnw0_GI*Bp7M; zu)okdmcAed@B497Gr3tP^~|=jXZ~xFeXop`_z=#V;XuGe9N3ZZ3XbhpfE^%se9yT8 zSgGGgGUx1QF$RiOPuB-DOuBfD>Wj2B+G6FI(p6ukv3_0NS^pOlY+x(XS<*Y~=%iIA zQ2t4Iu~(;q4VT(_?nKAly*v6ltv&SCsvo2_fvR(~yxA*quRmVLcYR1}OW*YHl}nkI zaWajT4g@`;_IM!sSmNGM17;bvD>?yM5%HP3Gxm=xU8q8Dj}3v*f4r9%1HRWx<_CE9 z;G^+jUrasMgFc#EzaVy?*e_#F5{P1;sk$+Ndu#E5%I<86#mtSDU`$`bte-~1^tAbk zCKcCK3|ra15L zICd7{M2`M=x)HbYtsK;Ej(}6F_yKC94cOOlg%RQt&qZ1+JphU(RT!`jaJ56YH>;3~ zc0sshPQWt4vaSEbN%u)3l)wYVP?}4~M19yvTwp4ap{K-kvne+X z>2ui%QhqsNQMx^MlyDY|!wi9XM^!9bEOUV)h_X^6H%Ua7LtiGE$p&~jU^sd*lm`q& zz{N6H!8{9ii_zu0G~`CcQYTpv$eO$I4Nl+7&sz68g1H zGA#cb>0b@KWRuq3vW>E)y_uXN`}*GiAVTx~R7M&YAOrJe1fwS=ZImVrP}mEI>z6Cp zw%?7A--$9)BP$#SOV2TFDXl+v1qH)N3Pj#}QCpcQQuUO)sY9J^GcOw_Vg z9)FhoM?iuuUF7A@zB8$N?9+O3wGIyh@*o%lxKcq*#1fx~{sNhRo;&5`Xre-_r-4dm zf%eohx}GkCtAh{-t5TME@So(*i-Tr#AR$Be&yld4>*Dtn|D5%kIvA*Ts!eGm7S4pG zp%TnT&4sqz2Nt14u`livyv02*bO7FV>^dWFs_H5`QbUy$btdl(c=6iR>oxq;}e9BUp%c z8|3VP-O-X4_U6caNXem9?PSfP3&KN#87 z#Zs2up*kxS2yb;irTwdrCnqcb=K}MA6Q++pijGJ=&h}*|P>nUV$*~Ypp|M!pl z7r+|9h?K}__q>19yPvs32DH%tPzE|`w+R6)24rvpo!(m;{N_gh37v^f7o(K+JDe`g zq2H&aBIMf9DtFA2=_Eo^nZXy=UD;UU@qbUj?5d%&PuqFXC$^Tqnv}7?@jZ9t>|k?` zWx_ks>4H!q4B_t*Q&0|b_RF7^mKu$3I4Vh-pwvOJxf$hpAWP$bYGyWyH5IdQ(0O^O z>-KgQ2bz|OGo^cNX^<)MGZRl7$lJGxaA1Qf6r&c4q08xtL#gU>UV2hLrcHDPqiFk; zg&l!Z-x=tKBVPfK*>3gfnh*emf;tS{v*a)tRmByoECuEcJGC-q>^(~w~ezkS_M-TUS!d7{Qxa80iP zN}K;>htQ3lNXI%ce^E5CFbOEU3(6r2>}pLI-@0t=I9z<%i0rAerYIf6OI#CjUUu%f z?MjqgK){@|0wY(vHakUB!oVsrLUMcNfV~)iY)#c`7;F>$S_U+-(C{bk@|lp{k?ZI! z)~%G|K$(8}NomhVguRZv@DG87WKd&g^lN9G@zoMj)I?bU<7W)g6UyTHSutHzET$Qb z5MsE$lG(MUNEm|nn=tEgzv(T}pG98H{hl}vwheISy{VF5+jz}z-a2J1J0Jb}U>NR9 zom)}R7_YT82WHlEqX$wcwT_!j8)^irEpC=Z@~x=Sq|STZv2@*CTbjv2LcgEk4g1eX zaO$UI9uq!7_a?h@Xt8T;(4tNT2)slYp7&o+V^&c1xnj25tln}0c{S~Hq->S+y% z>3L9IhD}J`nuYEwpE4WOLvxS+$(int#Tzq*fKCEC3-l^5;e|)hR~4`x(D&{4?F%uj zxcJM@%-5&?1O>iQcGLQv(7|;%hE5h5xsxKhcKilEaq1pMj8mV0^vS!GLTqVtYb$7@ z>*%^yxki# zNk3Tw+DMS~6fy)rU;lpm9NcR|Q2vd~KN#@$SJ2m=ulFpS@-t-X|FvKL-YIcvgt9G$ zp!wu}ZiN(xaST2_9YpMYrF?Rx1_}RvK9H~XN{f^qu$~F{&#%BY`+rJVjs0c%YZm(^ zv2POlDDl@D_Q90068|eE!3s9})KvaUT))j}3oqU>_0p5pf?8|9Zp! z*&NZ6=q?H^g2dMmZ*GMq0oaTGuDVS9chyDizp5@b|GVn4|EGT;Wq+9{E3t19`zEoE z5)>PN?Sm<0CH75X-y{O|gCxZW_Jbs4A@)t;FD&ev#J)-F2g$$Qu%9