From b3452a67a760c608b5119f58d5482f752cb94b57 Mon Sep 17 00:00:00 2001 From: JD Date: Tue, 6 Feb 2024 10:38:55 -0800 Subject: [PATCH] Article: Fleet 4.44.0 release (#16625) Article: Fleet 4.44.0 release https://github.com/fleetdm/fleet/issues/15984 --- articles/fleet-4.44.0.md | 146 ++++++++++++++++++ .../articles/fleet-4.44.0-1600x900@2x.png | Bin 0 -> 51309 bytes 2 files changed, 146 insertions(+) create mode 100644 articles/fleet-4.44.0.md create mode 100644 website/assets/images/articles/fleet-4.44.0-1600x900@2x.png diff --git a/articles/fleet-4.44.0.md b/articles/fleet-4.44.0.md new file mode 100644 index 0000000000..8621146ab0 --- /dev/null +++ b/articles/fleet-4.44.0.md @@ -0,0 +1,146 @@ +# Fleet 4.44.0 | Script execution, host expiry, and host targeting improvements. + +![Fleet 4.44.0](../website/assets/images/articles/fleet-4.44.0-1600x900@2x.png) + +Fleet 4.44.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.44.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +* Run scripts on online/offline hosts +* Label-based profile enablement +* Per-team host expiry +* Enroll secret moves to Keychain and Credentials Manager + + +### Run scripts on online/offline hosts + +Fleet now allows IT administrators to execute scripts on hosts, irrespective of their online or offline status. This enhancement allows for a more flexible script execution process, catering to various operational scenarios. Administrators can now schedule and run scripts on any host, regardless of connectivity status, and track the script's execution. + +Additionally, this feature provides a comprehensive view of past and upcoming activities related to script execution for a host. IT admins can see a chronological list of actions, including both executed and scheduled scripts, offering clear visibility into the timing and sequence of these activities. This capability is particularly beneficial for ensuring that essential scripts are run in an orderly and timely manner, enhancing the overall management and maintenance of the fleet. + + +### Label-based profile enablement + +IT administrators can now activate profiles for hosts based on specific labels, enabling more dynamic and attribute-based profile management. This functionality is particularly useful for tailoring configurations and policies to hosts that meet certain criteria, such as operating system versions. For example, an IT admin can now set a profile only to be applied to macOS hosts at or above macOS version 13.3. This approach facilitates a more granular and efficient management of host settings, ensuring that profiles are applied in a manner that aligns with each host's characteristics and requirements while also maintaining a consistent baseline across the fleet. + + +### Per-team host expiry + +Host expiry settings can now be customized for each team. This feature addresses the diverse requirements of different groups of devices within an organization, such as servers and workstations. With this new functionality, endpoint engineers can set varied expiry durations based on the specific needs of each team. For instance, a shorter expiry period, like 1 day, can be configured for teams of servers, whereas a longer duration, such as 30 days, can be applied to your workstation teams. This flexibility ensures that each team's expiry settings are tailored to their operational tempo and requirements, providing a more efficient and effective management of device lifecycles within Fleet. + + +### Enroll secret moves to Keychain and Credentials Manager + +Fleet's latest update addresses a crucial security concern by altering how the `fleetd` enroll secret is stored on macOS and Windows hosts. In response to the need for heightened security measures, `fleetd` will now store the enroll secret in Keychain Access on macOS hosts and in Credentials Manager on Windows hosts rather than on the filesystem. This change significantly enhances security by safeguarding the enroll secret from unauthorized access, thus preventing bad actors from enrolling unauthorized hosts into Fleet. + +This update includes a migration process for existing macOS and Windows installations where the enroll secret will be moved from the filesystem to the respective secure storage systems - Keychain Access for macOS and Credentials Manager for Windows. However, Linux hosts will continue to store the enroll secret on the filesystem. This improvement demonstrates Fleet's commitment to providing robust security features, ensuring that sensitive information like enroll secrets is securely managed and less susceptible to unauthorized access. + + + + +## Changes + +* **Endpoint operations**: + - Removed rate-limiting from `/api/fleet/orbit/ping` and `/api/fleet/device/ping` endpoints. + - For Windows hosts, fleetd now uses Windows Credential Manager for enroll secret. + - For macOS hosts, fleetd stores and retrieves enroll secret from macOS keychain for non-MDM flow. + - Query reports feature now supports a custom `pack_delimiter` in agent settings. + - Packaged `fleetctl` for macOS as a universal binary (native support for both amd64 and arm64 architectures). + - Added new flow for `fleetctl package --type=msi` on macOS using arm64 processor. + - Teams can now configure their own host expiry settings. + - Added UI for host details activity card. + - Added `host_count_updated_at` to policy API responses. + - Added "Run script" action to host details page. + - Created the "script ran" activity linked to its host. + - Updated host details page and `GET /api/v1/fleet/hosts/:id` endpoint so that failing policies are listed first. + +* **Device management (MDM)**: + - Added new endpoints `GET /api/v1/fleet/mdm/manual_enrollment_profile` and scripts related endpoints (`/hosts/:id/activity`, `/hosts/:id/activity/upcoming`). + - Added support for label-based MDM profiles reconciliation. + - Improved MDM migration puppet module. + - Added Windows scripts for MDM unenrollment and fleetd removal. + - Added the profile's `labels` object to MDM profiles response payload. + - Updated UI with ability to target MDM profiles by label. + - Added ability to configure custom `configuration_web_url` values in DEP profile. + - Fixed a bug causing MDM SSO to fail with certain configurations. + - Fixed queries reporting inconsistent MDM enrollment status in Windows. + +* **Vulnerability management**: + - Added support for detecting operating system vulnerabilities for macOS and Windows. + - Corrected Windows OS false negative for multiple OS build remediations. + - Fixed issue with incorrect `resolved_in_version` for vulnerabilities. + +### Bug fixes and improvements + + - Added "No report" text for query results not saved in Fleet. + - Updated forms across the UI for consistent styling. + - Improved UX for globally enabling/disabling SSO. + - Added new consistent header styling across the app. + - Clearer browser page titles and CTAs for Observer+. + - Updated logging destination failure response to return a 4xx error instead of 500. + - Addressed issues with query reports and host expiry settings. + - Resolved platform compatibility checker issues with deprecated osquery tables. + - Updated Go to version 1.21.6. + - osquery flag validation updated for osquery 5.11. + - Fixed validation and error handling for `/api/fleet/orbit/device_token` and other endpoints. + - Fixed UI bugs in script functionality, side navigation content headers, and premium message alignment. + - Fixed a bug in searching for hosts by email addresses. + - Fixed issues with sticky errors in fleetd-chrome after querying privacy_preferences table. + - Fixed a bug where Munki issues section was incorrectly displayed. + - Fixed OS compatibility calculation for certain queries. + - Fixed a bug where capital characters would not match labels containing them. + - Fixed bug in manage hosts UI where changing the dropdown filter did not clear OS settings filter. + - Fixed a bug in `fleetctl` where `--context` and `--debug` flags were not allowed after certain commands. + - Fixed a bug where the UUID for Windows updates profiles was missing the `"w"` prefix. + - Fixed a UI bug on the controls page in team targeting forms. + - Fixed a bug where policy automations when saved were resetting automations on other pages. + +## Fleet 4.43.3 (Jan 23, 2024) + +### Bug fixes + +* Fixed incorrect padding on the my device page. + +## Fleet 4.43.2 (Jan 22, 2024) + +### Bug fixes + +* Improved HTTP client used by `fleetctl` and `fleetd` to prevent errors for 204 responses. +* Added free tier UI state to OS updates and setup experience pages. +* Added warning/info messages when downgrading/upgrading `fleetd` or OSQuery. +* Updated links to an expired osquery Slack invitation to go to the support page on the Fleet website. +* Cleaned settings styling. +* Created consistent loading states when using search filter. +* Fixed center styling for empty states. For `software/titles` and `software/versions` endpoints, the + `browser` property is no longer included in the response when empty. +* Fixed the Windows MDM polling interval so that enrolled devices check-in regularly with Fleet to look for pending MDM-related actions. +* Fixed missing empty members SVG by fixing SVG IDs. +* Fixed a bug that caused the software/titles page to error. +* Fixed 2 vulnerability false positives on Microsoft Teams on MacOS. +* Fixed bug in CIS policy: Ensure an Inactivity Interval of 20 Minutes Or Less for the Screen Saver Is Enabled. + +## Fleet 4.43.1 (Jan 15, 2024) + +### Bug fixes + +* Fixed bug where script results would sometimes show the wrong error message when a user attempts + to run a script on a host that has scripts disabled. +* Fixed an issue with SCEP endpoints sending back 500 status codes. Should return 400 now if bad + data is sent to SCEP API. +* Fixed text and icon alignment UI bug. +* Fixed message for script execution timeout. +* Fixed failed scripts showing the wrong error. + + + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.44.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.44.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.44.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..df587941ffcdd5c72b2fb8cd1652ea85c9d4ecb7 GIT binary patch literal 51309 zcmeFacRZE<|37{qqfja#>nIJ15F+aw$tcP!A(TBrvgZ+{vJO&2R`yDEc9IdB^-KsOL>-l^xaJY8O_(4@vCQd;^@SRn3!iyZn|Ted>14N5 zPclfF!)(a)*sY50g2EdU{~RMmt!|3aJH8joA9XN2qUa^}7JloV#L9`0b^pKGY-S}`M$&A2kkI(xT8xnz{2ISO_tzt`ju z4&qXve}5lE{P%6>X|Mmjy>J;I`OkZW`~PRFBKR|KgH#@DLuyIx?Zh$M3T8_I0dVjpAQ32(;)y^K^#NpH@{iKC+oazBKGQ% zd*7M-9t3mpq2J2zRd7%gBdq6_{N8kD`#FR=)cS1|f?v~3&W*L@#U>EDO0A0!vLPR`scu(;}GI6AE}5vgB#wI3WN>AKxBAwA^uZ_#|* z>(OxaOpj-}cE*E9-F;bqsphGbjWk!9wVh?3hu}G0!sV5G5z^n?EY-0(@iQ45r9}nQ z(!*~IRt<4Bp4Y$jyITr{(oNzlHFj*T)trAzN9<^s$w8G#T$tEL#<4p0%-tP#BQ+jx z>}16UxQxuht_|2bi`$RGo-iB=E9)_K;&zv zPsSCEZ%Q%jFrE2QE{L8`%Av@0(=iM`b$zbHmETutH`@SopZatv#1_8hy@2Em=G!#( z*8=&5zhAns=_vb9mTIjYm3A(1mDm+**H$>(_lBP+o zO;5HTpS3oNqP9)~&By$L+H5@+t;|_76b$AfNYq67T_|c3dpwqOR_pv8OtJ7UK4Q0R zviVcDsG-P;%wpy1)Tb)=P;T2%iO0?2F0&*AxOQ8m>PPXC?v}@Qt@348UTH8(HFX&j zcs=~es~N)k)YFOMF*v&Mxl%;mBE56V|XIO_~wI7A z)5D3P-RHY;sT)$LI!?<#MKHzJ*H_?)jy9pJB7I#UPZiyDO@S z9Eal|lBf`1NQH@Entxg8XWhr<#Jxo%qY8iR;OAvI*b16^u{ISNpLPtTd(yi$7gl?m zWY6G+Tj$&PkY(y8Ut;qr8ppGb2fhObAzWS!sms~XAW+=R0H@uXny-OTTki}N&+4g{ zqaCZsPCU4VfAoAva=T_;eAzGE#Tl3W9chKsXe(K6-WhBaCI+F(8G_=XS>S?<1r_u7 zZhTPl+o=7aXOi}5e&>T{2b|S4`g})RIY3*yP5)kAd6~Wc+m-ZZjZbWz>8dyVAVQUy z6k(hXn>sTFQ>}BUCFh@W-wMCN^%GUFJ;>PfWcKBo1ki_!MOur6q>5}EgnY)`7%Vvs zR|6Oma#}kVgFv@UG|EKv)ip~gy=AnHP9F=4=fe9o9#Gx2v?nC!jkk;Ay988pPBo2Z zL}jBuRsUUy2|YaU#oRdB?D-x|ygUE^eqv->QO( zQWnAO)p-kVe>5adwCtKs*57~h{N6iKx<*DD?&hbm@;ZNK2|So(Q>XEyP?s!Z>{UK%LTbemr9He-tVQDOBi>agX-Cb4mtUf~{}UYLLFnYH4U& z)=`JT&8KLnl5h`UrZ5y?nuzPaj)(XEXew?=M01LCY4SPi^rTnKD!5-Fi&ivLx6xcF z1P$Iy#6d1L!g}~|QRE!x{1>zK_B<`6e(fSgxQS>#4igAdEjsSTR~Lgh&*krm-VvsH z+gu^2y3oiXCZx9C@Bq3?~|ZM_luKr z%)A!}HqUm^!niU`p~=pQoX5pZ|8)iay?)oxm{1v!HdB=b9mq`&BXDP6}6$ z^j9Sekf@`fmip{vZ?t2{gLBQZFJ?L(P6?#aKm!4ffu+VZ^6QP^`Q-jAsk}!IzdlsW zN(>m&6jOO$bRkzETnAtT40jCvu|NC>00KFo96l=9bWfRlO7ObFl}CeM5+i;cM#!(< zC#UZpK|j6m)aD%N%}S7cNf#?M|J~j4S|ivZd@wET<0v*6H7%Y{{Auoq?b()@m3;Ex z^|PO(&JxEnJ_pTqt$2=;GhV#6{p{tmJ8R;+-l4eZ`%V)87=$jW{3l`#W&mb{6sN``jyP zZnsOxJ~icA$?L?s8>(3}0RSPRv{(c>!fK+apbP)VPgw@L4t0U|&(BR2h@=?2u$B@n z3Nfc9CP0J>m|r*mvsalRG89@ps+W!*?~$P#Ug}*aJ)a?IvnL`R9x|uC+W$T8?<@z> z|C(*?j)*$-@^j;(b|CRBJk#s*K!~Q}?T6yEm%N?a%sY#Ts+l?ut(e8gNM$gcvgn%3EK^Wd-qv zl_fCKuXSu?V*ragK&x0}sKaR|hOV3oK46vt$hXhE6N2e`f7^CFrtVso5)$ z7|c_n?U`y9vJZ03dy6h0fu=ls81adaVtqeF`!V4yQ5UH}j$XS{ftCKl(lT>`{aTXY zMJj{BCAOo(TN^8F#2L9*Y_uUUg|V4+q2!pDD|K4*RWdn8ZvBd1;`{X{2fM&r(_a(R z_Kw5AXfG^}_}JawQIMcAXEGQK#U&$^VCL_}Dy{vmbB&|OTC_;G%kY2Rt1_ULq?kTS zzR~?31Yfq%f@UkiynFHL1fzOi^Jw6VXYa;U4r8tTM=F_mLYOt#9Q^8k1>__|`||{G z9mAcz=|Dt7J{}|waF7V^-xj>u0Rp*+K1mK99F}l}eS!jB;pui^VMLV0I}?p=@-VU% zoUsxsYmkY?FPO15I1!K6vjLG)O=c}SVVlGh7S~DOU~U%h5yh%`X!i^fIdx>DAl|0Ys|tv2lzhpCca;%+!ZX}QbSj9H9zmjYqX`kTNM?)$?m~o<9CI7 z9K{I3$>B;LG=cS?1ailDP@whnRk8Hb7kPidY(7W)MbC5sn3)HbYiCh`@rp+ym)~~e z@v1&}Px)rSlHQa&nUcl{~A}cBCb$ z?{rrnoI&FvsktvmKOdYAem!+!l^9eivJld9l%FU46y-NNpwUcaG@@>`y5`h>wH&*8 zU-rn0$q(V6+=LR;PfyrReqghms*SpP<|V81@*8l@eYejs zQGq7vw>gwgzydE?WeM2t`f>RitWI1V*#5_LcTrC7Sr#S7P|vg; z*(a&?Q*gYte84lCK$9CHg1RTJ_$|GUabP*0S3H;IyjwbQ6SIwLG&4!LANvjlJDbgC z@vP*_)sOkpcsRCB{KPL9ZVB&NMw~^(m{&7vC=`Jc~0MH-l_qJzBa|~-r@lXZ6B-4R8sG*DXMPpkH$*j%l>v}v+DHT>k;UY%tyGL z?yHpJ1-APphw4Ju5$v7x;1|pi9gPx(wX8<%*Etr}2FVYAg&NN?NKb1WoJPXWAGuj! zs#%6-RIbg*(_|w__&jz8KOEw0fNn8(;dqTWP9%XM zrUslpGRG#y23GRfBl=2q>byDIlvx7UXHhk%6KRi*XgREB+3uFm+6sVqyar4#zv3D7 z={(&PqFhVo1?oRmf#vifQ`Fl!N45a4FF^#e)&p3$=%DX*i2~^%<%*nAvd_B7#(3+b zYd~2q^P8d~ZOnHnu=N01@tPS;E}aJ}SdwBFr`QBU1kXGcB`ZkUWSZQ1**KA$*E6+b zwfgjoA}l*lxn}(hs;;9tq5E&4hkpsdM`~HnlQAmr?QJewCDTgzPB9qU z)JNM9k|zZ!Dut6#a%IJpR8rbJ9*+%VX>tv^o@_iWIw$tgp*HtJ`KH3;W4~5IYZI|c z$JyV0%E^h4u;-|48CGUzJ$^0PVJLc&F0ryu=xb#r16jevO-v2g{R#N(x+1{lHvBpL z4a}{1*k8)I^5Kas`K}LB;z6j`w<2|y7q%&V;* z<8=o+X#abeR8oEgCmLioRHeS0XilQKX^oi;6wp9P?io(BirErDgy$ASlz<zgF`R_5--02>tX?G+^kOQI5Y!v?TkXf4AMz{*;&<0_d!g~ zfWhVyB=iw{vLQW!rPHn;--D*9$^$11l&gT$=JP&R8Tr zXd&X0!EX+RbzND7SKwmD3w5lCjXI84!Vqz3XWHrnl|2=)#DIBsKu^sKKmn`vh$GeC zBN(9d6=Z+SN^GC=Xc3y2Q8?g)Wg*^cfhri;-O?QAlvyBR92e!mm#4u5g+^{KY+gMS zU4=ahniHW;N3;aO<$!TVdhHOidc(oIDz@W9lEHO2+3R=k!-3+M56pY!BL46bulWP5 zXmpBH;@|!q?8<=`sYpXh`wnWFI7=$Ufs8c->r-+Z4uf!j_#oImHQIbq`M*&V2&zyy zH?qInlK{HR;oU$NL~lpYeWfh?8S@yu4R{&dQ!nX>QX1{}wv|(VmhN1wF1~Zcwo|TM zp1NvSBg*1#((mGmw*HP3)w|;^%Yodr&Zw*~IZFdO7Bcx*ig#j?(-&Nh)0l^{95paF zCU-WF<1UjPtzPlE{=|K{rzR%^^S1jfJ)~OlO16J|>|58zREh{yqW4Gv@|>M%axF5b zf`Tp;2~rN|UvhrC+KmWg*WV(H{yhNQgCKEVE__Y2KYjSYhdw&aLuUlyr^28|q03K^ z;7oBZlSbu_c@aJW|Ejrk;21v`M#?x2KlB~;$@0;Bf zM-%wCY1aM}#+uai-x~?sY_Xy8eb~6lIsS$Fp1@S6p<%5SXKCf~K3rEkrjJn>zu2`{ zXxK5#!$d0kz8`)m|MRKC#UXA|d4VrqzyHZTbI)D*kL!$$DKCsH1drL6Nt%$E@#Lp| zl}K0LZ;Iz-N6tr8jYbIAYUIZVU!TTj8=|hPtbT-NV_NRk)tLk}R@|2ko*EfBYgu9= zUW7iuMY=>p5S43?%@F4Tq#W(tX9q{#X}upAL4QQyJz|r29)|{v>}M5gF-^u+=1CMf zmeX&HyjGVpJr_vd&2;wzLLnE6DIK>%*)Sf7k2l{x6x?g=B%%D$zPJ<8f0Lqrt4*KV z?D|49x+SO%xp7ZA*fRpdVmRTeRd?dtcEqAW76-Lv*#)XwGVOn>gDFnP;6j=7 zdkVa)1;;&E?_Z<}y~Qy%x?-Zl`hgtoTe6zKJa-e@0*{J2`O4SMRwrZYZ|t5UA@sOD z54x*8#=L|Fnop$M9!^9wWd25@#P>JR2Do(=Z+6J^EK<+iA4}Rjp1fy4cIRm@UuNIQ zZEOo0iOY7KrY^(bk`TMBQ2juAp}^C9d97vgI#$(ot@r(Sccb<1pBx+cp6)n!0rY9x z3+&3HjjGcIeP>b}M_?y|HPdztrvv8x`V0#4nN~VEn7EkK)-e1}P+Q#%SxyC#;1(Qy z|AX+yu&z4%#P^+sy8Df!41uFRf8Xm{kABggL*kOZ(tq_Y)}_=&`~b(i%ljH`UA{Oi zy6{WiU+#U3odwzMq))70mM)*{C!UhYSC5N4S??Un0L2SL!F5*E+&3}eWNV2JF!EhD zoUC0stY+3Fi^NMDWi@-27d=as=J9*H`%5e+wku6d35J8c0+KDJGubi9HJ#k24OcHS z9%OLWVwo%}AB_Vy`#06-RiO{KkF*!#3U=nVohUjLE$|UH4PC?T9dmIv zt}$FS!$k6I5Jv$kMrf3Feb47la8z)8rrYe)k~3Twm^1eWZWR9g4!$*=niFh47Y+ zhnd~za@;5CUKTnVba^)6M4%u+hYcMx7Ozvbp zE4*xF43+3IDUf4ye^uMOzVaw<%CA3XYis~5#}=Pe9W<-~#N~6=G%#QRu7dqWy?cGV%-{`Nt+B3)nxXECPPhg3 z&_Z5%1ehuYHF_Dvt6BZCfDvmBp@~pB6k6SY+9i=cVp7SU9iJhxpq0^gO*iwl-M~z& z)*D(99eOsJAPaTgrAoL-`8rPZ2KUNZydCl~v+6NVC_Ka3z9`5EG+ zN=$2U<>^2KrY?JMg+!Xk_rBeF1mu16zrX09oBy|}{i9x>kPaUr`DRzaRrS*Ga%i@& zGHyiJb}N8Wd@@(}>%!+O#!ya#)O8ah^SM1i7bQ1~cM~ISc;0OVCA()k{A>I6u&&U} z{c|6*OP=3V|Dj?gnJu~mOWQR39lcE?U(YuVpG9Ym&rg=5J7C~$Q4K+Fy*E5-uH?st_838*HU>e|=u3v^l2L2ne8$W$fqv6>IN zqk1F_H}P_6iRghe0fY?7$UVt#g$)~R0wbK>G}_r@@Mlk7>ezp1N=kaRj_^<<8_1P=i9bGMGmw@a)sEmX%@nBTnU z_vBt($)V!_6mJfsC*_d8vDcd{3M#xliaW&|m<#l!r|9VXeLA5{vb{nK1X?12ee(Q3 zmXKS=S^It)t}_B>McU!#+&aJ|cvZcSBVk6co9h!>RX;`r%EsP*k1Pt3UyfYE=2AtV+RJC|og^-*m$jruYTM`#&UPOGOV1;`bZ80tP-9wai0 zAESf>T_4|87j&Gt(V65d#qaOa0&TM~gWm)WSLanlfKEhgr2O6tXJ^B!)s))_I_uFe zio+ZDzbmakFDDfg6(=YWV&X+a59I$2c@Z$H-c!*-mKrz>j$B_-;#jjs`M`GnXG6ujYbNVk zJ>HxP`BF5YzBWK#F_GwdRb7Ulv2(EdYqn zK??c4ks_Fu^mutcb{$9J6Q48{W@aQ_vbK#UN-lf&NO!c3PqmxLfHEiQ21s3BT+qen z6-lj7&~h9~!!L9Yc8^NuN~^}Qke)J=ZN9PP%&f!j`&F4PG&LC#VRH2O!JW>a#5tHQ z$ts;GVIWldnixnW%eoAemyR>hOhn2P z2FZ+4;u-7P!&6do$0x{aaTht2582LIu zH!#!=E(_@cY|kz7dN#DH=DzeUTb{Fx^wetF8~wj)N<9NnOb*6|LDEpqEjf$*R4zN} z`ZYA#j~4DGOdKliA;Dme6=*s1-3%Ut-Lu$t#-`cGao!z6)m(g5H9Lscc3)ooi-(@R7x#$bS?TpfiW+bkZ%O8nv zUhD1e+IbniyImPkU=UUX36<@MG$jg!$RZ$iaV~zBcJ;N*2&3%w4yxi4Il?c_a%3Ur zx$J6`j#|C(YW2Who6HkbQXicyxw^S*_<+8vJDRVCu>x1a6&hr^RXhGhKj;g%q{hmX zJf6kBPi+z+U{dXvLgJ0!FL%aJ&}w>d^UGY3ZV%CKTX5S;szTfw0{gLrw`aC+BpX(b z*CU8hQp7@T5UjI5lYS9$UO82bpD>+LJ-;s{6RS(FkG(V+Lt%=3L4ksBh>ZH{^oM{k zc$fEVtousGYco=AnVp0$T<3!6@!zp9PXbRPPLe7@uwswvEsj_}$R(H`SO{<{g7>${ za6}L2H~xf064MS)?+;a#tw6=f5?}4I=Jqd$%b8u^{=U{Sq7_1})o|%G;s$n+F=saP z^p~lf+T9sb*XH$ob47dW5g4Gt08wgiff21Q?h2unievNbksjZUQhJmd)_tAr-_59; z0MqKSlw(cM*BE_eeR$8Vfg`msKNE&)ZgDVl$l4PhIIx_Z=V8o8NT7&0f*ENipyI6C zde0g=b&+~vGUu{vOwzXoIC3Uqwcv6EyYW`9dZ}Txe|BvyTvRyu^HyPfDIZwjtfoES zqXg*hF^k5Exft9Cmby3;v}ri_ILJAAl~-s*w^C)#%!FZ;8nbC+IZpF~Q+|p$fQ`b{`u%VTi_6M{G84%du zYX0(!?FI9ZMBMvZ=gj#Wq$-6mk@FhNkJl~;{}#&Kz%G>Aq$e2@;L?n~`o8$W7c$7g zUSPj~8?3874(7jv5TILaZAX2C=6Lqh&X^Y6WOb#$jWsA#v=-_lGn|aJQb;!Gw^C`+8Ks%EN4`B(mjHPIwQpiF8Pi>J z^y9%BdC%R_P91Z}_qeyM*FP&*!YI4r#w3s4gX^CDl$r33=gPwjk9%@Quv zN1LGHLp=-a|3nRZ^oXYD?Xl1Fm)~~?BypsW?H8}?xFM)*s?_2QlO0mjx~j6>5)m{x zicm;8Y>}F=5}>?VF_2{rqL*OL;6$y<>5xi6MRiw?M(HBe8i?FM)F}bYLEU+B$1RvHkV{tV;i6Z2eI?sg{|tNi zOz{Gw!5X(<>(lvXN<-3w)Nr3N!M$4_5#0M{A6P|740m-L zyS~@krbT7czw_G`q`n{7!1^J5zNHU0AJbc6XUVVuW$H*NUzKC#Jp1_OMFo@3!dJll z#aZ?H;y1K|SlHE--E_K;&C^TSHNLU9^D(ZgUC#E^F|&gea3Jnv;@C#6h{r}xeD#8& z6cU-KReG&dxi|@DKT)7*^z;fQO>FCcEKU-@QpJq>TaIH#rEy)=@#Ef!!3rg@q_DYF zu;;bWi0PEKm>12@N|@R?sl{~R4(+)nu+{aoJlixL)o^Z+1d(vZXKp>agvS!2P~F2? zp6}`8?)cPkAEfI!lg${~ui;9@@Fba8!zagwl(nS^+Tef@w4vq-k{h4e(4TCi>;S#2 z#pQ@?H!IuK*MhX^CtkYPVtx#2kPyd(1)8Xy%V+L#&Sv$DzJyc%i%j@%kRKbBc4#_TBd|ZO zn0JYB%%@+`GN#)T{~(;Arq%8~`o(>MvYrGVDr-aim^+gO-`CDZ!QPT-U9bC7U!~>C z(kp|d>LPa7cHq_w+pY9i?|{@mng^9AYFPuwrKtk z3JoAm(;R`Lb{hF|^h;u7RNXJOSlx)|{fn`caHfdq>9(AelB)%tVULb^fi=Y4!50fd zZCwT8gc-f&%?^nCtgHpM^Rp@4pD-ht1wCpqb#pH|{FC9q!c3CdL)V%oBvr7(RW%;P zXbRF;HZtlXY5K>Xw6{3q3&ECq_nUN=a>B|GXx{^}{}aYq(C}j~v}FXgVP?(F z7P~j;9U)T08wX#!Ot@3@`hf&-8_D-Rg}sKiw~Da_3gr)9$A^6%OTMV;Xbwxlg>9W- zr9F4xI-+FjLhz+rR%9Ti`pcP3C zPH5pYSjcbE9B}{-DvnUr0RTjrhHuwv@LO&`&6lp8tqAvNg;HiYrqpItj6mPx2ptSC zF4a!r<36eZMxbrE(rZNc-um-Bqh+!HYpHS2g~o9#&~RRA2m1%WT~6AJQg4X@$2u!& z>fI8>v5&i&y38t9xuGUg+V6w%z2VT+xyY;MJJs7FsUeRqOo{7Oi?I0H8Vw6MKoS*a zK~p7>%=@}$(uz4)epK#8dbt+6TSp;a(8NFzf#w4My*6{%{-6~#**q`#Wd=PrW1-x; z!Q}H+t4-9o&kt@5dv`dZS!1QU&W-%zF8p8&vy>EbyasK%cK$WSuQmOkcIhG%0|0Q$ z5`-+KhnJn0Hyu93I9Uk1EK|VD9;ZF<#jyH=c;bp{oXIyPTL=~bwUT=&uoza%4c6)M zoZn*WGeCm%sbHR`bUU8uZBvWQJIaUo@-Yxm8DqH*HZTvA!sQ)C7a9j;u!Pi8^ToCS+lcA&)YedEGg)3JQ~WmCcb908?OBBlVGxZ z!rhsPvTY9`f?|k(g&5;0+d5X=`QR=seT#$jJ6dI{KfVs)r6@LWCx;R1KsMdd+&Wh4 zR59HTo*<`QRM@^80KceR(j$@Ornrrxe{QyMwdX{^uBJXS3coNvNE;1n@Jzqoe;FjT zX_&2=UXX+pqGFVahA^q{dwi#dd*vlD^PS5c4lk6VC4R@u%UX2pf`-X^$VQNhix56> zVRD~6A3KU;0|)$ioR*iQ^a62wSP8H3#)05bu;F6}+U-k7wAAXjmunQV%UHn1T4&{< zIh6;_H*nRgL=C^rXHw;Zr%8tGnI;+9vF`d|%%4coW*5bXlw(ATFbnUhqCgZW?1RDQ z*ZDgaQ#chdGrv=A)J7I8P~?Xn|KNQ=-Xix~N)V5*@t?~1_W!kWWeM#X`hEdJ`P!VB z&!=p}F`dg3VNAO*f_eIi^7@{u6O4KM^%ZDbKF0Z)UQ@*|Bf@qP=eK~^Ps*6)D_iy( z)ogbIeLkBetw-%xR3g+c45PoMaca)hRoKF`stnP^?U8U)T(xf4*?obW*uZpp9dR&+BH_TiyxewFDML z+ueQe6jkjqa5KfEh+9Z42VL4y`!!qgq+8|ov$EuiM}QZmV+ER2XMSbhf`Kh?e$A#+ zbH#~On=xaX7eRWFrA22n{P~55Qew9^=$?ICW3DtWA;9eld3v+ki2MO8_)SAawV8^I_)Mqh5_+Hi{*sgh8(y?` zr32-EnsMJ+>CrCoSMP~v767r7bag14mp|CIL*1^{rW}1DZ$OUyA^g#?mx)zNEY{kg zv^n8-n6+DccDK}@ZmFx)N`BC*1Zm?z^v0PHl<8~tr#HkFD~v|1?zdn|DB#B*9QFRZ z(Nh^UL_yfj9X*>AYuA>7ZvOc|cK=gURGpF44Z`Ru7pg&J#YqQX>Rq%}IEB3? zb(3f>3|Z^%H35KcEx2tpK3>?(Hh2=PztD}L$M^JDtC zEO@gP%8IR2DU64e@ARv49|17sov~H-tyY$q8(mt6bkTlw{ zSMXAb!8ip6?baKe=eo)k)%8ndDm@vkh?9Yv<=s5&iW?4_Xjs5TQTWFIRZD2C%q2 z{OpX~Fk^PG2w>8yOy=`?c^Cb(5Az5nUBD(TQXAu;V>obiA@@nWV)o8956D@b5E{%c z(1|sbEQV6{)&K#S_e{Xus4M-BUUQApRT}sp!cC;R-xaL{t5QqS2{tti+B5*gmXU9-} zV<|Ak6ddkDA1}Z!>NiZ-PNB`%Ht3T)0cs1y=;(ppNpJk}aT=$WQw`%*dNA43h)8lM z{^sW4*BhW_PC~+T<#M@)t5VDcr9j4JW$kM;uFkpVX3wv)DMd$-0PA_-b4lCv`%99s z@BB+f`1Y&wS@O13!1?#&A?8${^#$D8ymBtsur`PWc=7}iVRC&N+G3+9zxpCU#?>R` zVUV^*_W2@YqKb@bw3*lJz@`ZA?_s3hr2;Sd9A2u_*pr-cU=`;-yp8JPSQo#n8=^bM z?lmtID0Y#$@u&|t*Tz9FO|edYz2equ_?1@(;K_6PVjL%}KBFz*ma1`!V?pGZ-$bByIEV1-wEXK<^ZR$IoS4X zFh?Sd!=MH6QI`Qgm!cK9EbHhQJQJ%d&CAD9MZA$wZ>&f23%oGqV3xPV-Ba{_Svu97 z^xC5P>^$O(3XL}m*ga1L7OpEMq~N#+YgYYS#4jjO-vJx8Bmk&pEAkBS?xRSWFZB4G zUT{yqyQA))9 z2i_bVBQAjuDOWjYwqFDF1{tBjWYVoUz!r9s5Ado;lHLJ{-C5aC-!7Y04gOg*vR~kq zW6+oHwr{JRCf7(Sme(8f5<@<3Y|X6>k6@L`7Cu`Z zfdenB+s}sAx{a)V5?$Y*23Hpsa0CG+(#KqOr)wc)S%R%J*KKjDtkpRDEtLy1_odK){OHS&{XXNl$p2gbZh<-$=`70H9X%7K#cfxKl}!U5X(cD zfvna z-1Y@7Depl+!$l2MOmWLWnD^WAeZt7eB4~I%aQI-~)DC`OnT!le%|Q@dxx8I`SiSZp zGW-M=E#O^pAzK|&PWsTjK$};&NxQ`c-pyQbL=q#y1MqI9GH2M+=k) z0b}%PmQ&5A6n#)iK=xoCq$>i<;v3-ZFc^(zxPi4FevZ}i!XNw35s1B|HT!9>)8JRd zZ`1r*mEN3B5(NI#==1qriE?RG$23R+Cwf}Sgji@C9h|+!nFZYKv9Lv(r$@jmsNeme=Fhl zEs?9taC^HP20E?}b2E=mqvxgCpYQ`UB69)sdzkE7NO1Ubhr_Q)no`)@*ehx|4vaRL z#Ats0k-CN2(*oH5?Fi|M)z@UON6Jsr&DAf-olL~#gFBllZs5V-BnG;;9k~D|HZ-oO z)PgSye(HC7qIe>;PCOd1W&(K($JqQWLDLm zwBoi-VA4F*f|o+Jy4vcmS+jhWW8s0fuj@q3h?7@~+tE=W`$J|N`SpL+U z13>5R45SDy5;Iw>Uv}6n0039|tSkgZ-Xn=2SguFx2OzIX`XFt$+A}>HX|{sv9F$1L ztQ)HVHDMH%Sa zmN0QoKEG`vUgt#$Xgu!hW|oc1;(%LM=H>W^3Yvaqk+%eoDS_Q6F=pL&^$m8+C%mi0L0v8aUb%`s%cr&dY&T7;$aleh&Q*4Eo5gj3B`zOTS@X`5z;9H3 ztXj2df`v7^dPK`vuF}pOP>~|kNI>NSJ?ZWy`q~q4dxV{7ZMS{KWKwl zt!#ZfZ?OT?w^5{fxibkE6Y-b{0Uz zQTKtpD+i;_}Q`;Mluvb2wVFg!y%=B=D?{M6)Z zcK6vCxdcTwD2+*1fOO1amQLZMlx18d1c(p_3)PaSz`3!IhE21;|9ce>h=4LN$YP?u z&`e70hCSUZ>&Ifd%`~_%{bvF*jok&L?BaNaF)=N_-i}4OdA+c-@M99bGQM=VY;#-B z<>vTQxKBbbsV|?^{?o)Y$g@K7YFK07na zigI#4zlFA0L<)lXt0A-iItTHLjz`MfJZ3UT0OK1Vf#C9LToeoSxC=YCBh6OEpKS>W)sRaPx!)oz1Gw%~q#MG;Dgg z%sDH2jQM_yy=*3?tsU|cP67x|=j&`(?YF!#0=SC6&aLW^rK|flo^WlLqUgawRs{8~ zV5Efa2^amj3*@prf&myxX{)4o?C?(*$bWL@c(JM!<*(rlT;%X;bDp{z-4%BE$Yt?n z_HJCH|Dysmx0^kMnb@!tmf0iVdiRX%!;mXyAPqgzKxwVw|6e|?g(i+*;ZwLNl?N4^1 zM|k%HR!bnU-Bo|LErz3h#s(fNoVoIF|LJ_-s&n0CgMB>oo7~{bb>OrJwz4g6U;kn3 zcpV=F5Y`2rv?1B}ilpV(qTi5vbYhK{9Dbm9-?cY-+9UbR#>vLhn(f-ynM&rpmAd$m zb-vQdnM`KS7P(Ln59i+$QbHTm|IB?&qRSMg9zKOk)z|HFC;v09U zj;t+|qj!~5bkah`-O0vet_kypNg5>>C(A1;D(@t)XTMRschYW})?e{1yPR0)9aFvJ zm&ZUO5&GJ3*YwT+H_wkT0S#Yk=&o&~!L!&wiSJ?PCp*B>=4@G(Ko)&LNcRq#seGFG zr#bNaA2(G;C%waFRo}TIFPJ!eQ9=9sOSO>I-xE$_Q@T~G+W*q0e3OHAV@3d6BAQR% zfar({`ucUqL!wqiT!WK5soSQP2~h#1E@`W?4KP=8557-qNgr>WFxL0EP|gr^37g}j z{A;@T?F{%MrXvY{2Rsx5$vwys;E6L<#EAPA0-w0@ zW((C1*`7bY{Ri?>(zohZY+CZW{Np%Uqy*0XSNaFa@yp8FoAqRU`}d@y*5P!vTYc5( z$9?{M65+Yw^l)9W;iAVS4;{z_>yI9gkSz~%3Mt1Mh4={iAQG?Z9ghGX)6cjg2(r6X zD8c(S)E1Y8PbO}i@crm}#!^LKrn)Oz2HX}yj=a>r;h~X{CpfOSo#aND>xfcJADqzi zw10$+-Je2qQ`|ZMGCu$jLpZJMkh^Y)uM3q~+Uo~@r3C(W3rKzBGe|T{Z~1>Dsedo1 zTnRFiz)e%8=!Ey(+o64`7HLnXv0AFGIP(E5{EwGA*d^QvB&$VN!&@EvJfcjkCiZ># zL%x$#;u;ntpm*1k9jryqZEQwsf?QH5AbbplMT;$QoIh|w_6asWb+C#&Tx_fvD$ zO=8CleRoIWb+^L-qFjIRw88nbV{qpnv%ePLS*;o_XNkKeQ zu_2^G-KEEAt6vOSL_9ygMgVb(LS6`m^rKF_$|`JDH-lj*(GuzydD=~yDN31V%M!F# zxi{jBllL4HnqX{}2CbWykGy#Iqglrc5_ye~u2M5}_t$QhRjhY$7+^+_R{<}fZ`M?d z>8ee7Ik9nK6SYSbrS+J;W@UBWZR@0`iSPXK9G}Tma5hU)zAw-s-I}dpb!YSjlJ&}K zM1}LnODR~mUa2->Scw|U48fEHnTH%aia8sukw1l$1LY%?ho+y0lW_^YLf2`^^D8tx z^9Om4N%9ItUI?{o36$D?Y%vW&t?!_6Opr5nwL*pi9B_W)y(xqrk_W`NXrgiCU5{Sx zN#kT388{?YsbHNxU8fxLtx6+DH0qAeERB->xv1-zw#R;idC*=-Kl)RmYz?v4cUm~a z`;r@GM-Lh^po1^qB&QHBsNc)}|C4jXrpgSf(L~;LXucbRa^Qng~!v;&G$ll5niO$F4Z2AY4I$rDiPZ z6L>TRKyZrUCcEQqq?;!xGy&jFbcIKOWTv(YhnRT6w|3?~(LET$cIL9jp%lSqv$_h9 zo&6&0XpDfM$p&t)aat%=3&LE2&Wcyt_4gGaOLM)C<-;WtejgCGaVgr?oPR@&y6R${ z8}d)}Mdk+Bm9AIM*snR)Cue{BloERl&&-;ceJO16-Q_RSYSap1jOAy$G=|ps-giC{ zb`AR`2^theFtl|d$FHrVk$~J@PjiUk62F{eB6=tsj2G5% z&|aWhdAZUNj(H_5G+O2*%<8#4mB+fz6@f+s1EN`?oR`VfPHJ#l1)qLO_&Uw&{0i7& z!c*f1RV)wNnaw`AdwNryC zx~-bDQrCi?^k3a;_5i<^F}E|d-PfZ<*nZyGaw3IPcS@|;!$#obZgRrpls8v*<^&9W&4MDQ3PZ@j z;iSfI(D;)wH|};DWFisI!dOb+xwEcrDH-7P0_-;44PX)HW)hRkqAx!Ym-5ih^>`ek zwD!cukDU9S%(;~lTV$$6=Ct{L%DVbYxAB+T-z6U@l9gBuo{q zhB#kf1RmNC^-R{s?$iK4P$pQs10EgAB#4uVS5pP^)6X{Wxn8YNQCx8Qy*Lb8UuiH9 z$t;_AX8BwcEn14M(>PthWYKlx$0a4I8wR^^A6dihYlTO(q<_zN-xzmOWIjK0k7iEw)^ zlm{cynou4!EP|nY29u>*};yG5LS(eQ7+DaU1T~ zWhs@=Ak%J*%2K2mWY12vEGgL%N%mb-%34&!*!QJuZFVhEk+JVeLSgLN7|#7@de3>! zhx6%tI)^VA{X8?z|GC%ezOLI*-i<=!i67p~75gioV6G?~v#=r&oRrcKpD}hmOlO1& z_BL zXg6gPQZ3;2m2hfP8~s%^xLec1+xag0RixPa`;IAyn^?_FY{)otG~{)Gmw8d%uo`(EHq=m%458OlRlYpBLv2u?n^4 z%XOPxU1bXRX~%bA?&1e6#0q9wArL3WZ5Csp5782m%~dDO*AqUvaMG$4@QuHoT=@`5 zgE}Q`hGw?>rq9hz72w6yDU3S7zG|Q0v1+HVLL-qT@ng-n68r0W(4A`pbb6YUwbRpa z5RgptbHCR4`lrlJ-}!E)PS(4-JJXQ&x`2%PalyY=XM4KluzoxUpvyIvax*Py(RZoa zW4vhNFmo0PMbm0$$x9!u#EY7}1`Ss2P;O@Q_jOXE>?5qUoo}o3(l72vzPk|;I!1P^ zzkFUTNqjr8duCCP8Y5c$3{N)F;2OETJGdSJ{3p7q5lZ-9O02D|fb$F?)&Jh4di9>m zXT@bd_>J`+Uz@+7!(2r4k#O^!WPli`^-k39n)V(P{panh7%^MjG);grZLhm2nxJN_ z0qN+j9a2?TdHiLHd|c5fBRj-iUNVnq;JM3)@*PDzXn?QS*|4k7$u@5RF^QUV#RDdMjG zy=da;lgz;tlM{Nw0DXJu2S&9`LA8qwH^dLbkYCI50SU;>b#lAqG%~+1G11(X{K9qe z+C+0bG-K3WC+*XlGi%dht;RAIH2(A@7|=Nxl^)kKl*rt>?2J2G>USa5drENtgFYKEhf;Swf8ZT2Hs5d%pd|+2Qm`7Q z6J+ksNT2s+3T=D{oPKT7P-_NdrbFqL@=ntKGam}uwkF727j+Yomk>F*G?=wFHF~nY zb?Gu%q)k`o;5uh5XrYtc5I2KV*w;PX_91jfz?s*VE(^c8WrwT0#c>Gb0)Vx#4BMmk z+l$2tEoVT zR_}dL`#Y}5>(5Tr>nj;k5iAVAF zYxGf9;yKt{FlCIcZa~G5GC&VGH;3}j7a!)oZ67wO? zKTZ^H&-`QT5)K~PJ7y}5VDJi7(ap)|zOIhf>U^olS1&#W~ z+#soZqu{{2t9%jmkj7DCoc}J?!Jhmg889q_LX|uq>0SlT3HS*C#bZ6)%Nj<*Z?Fu3 zwXr4w@PN3qAYXAe@vOX zzUMA2lzy47qR+AZbySOiu2npj_z^-lT(a#c60ji6s^>9(L&YEiqvQcdu8KBPp`S#r zJAgi>h06MQTHXvd4lsz*0kx3TN%k2=2GbY9OvZ$+JVal(u&3fuMmz**y+r%P%MvNf zaJ^Gc{#|#xany{C%g^!pzO*tJzsP3`PG)@`Wi-&)F7T>-%mm~QHA4X43~=vF^6SxF z$9=V(Jnc2-T&o~C+KlcPg#vN!#kBYXQUiYSgOQ#q)}z2XN*?&Lw`?(_K#aTBA|c={+=@1TQS zLS1m+Z4l@;kKHt~v?wC=iBy(IauN`i?3N`1!#t~PusYkhlX|$q0SQD!Db zB#5o!*X)P|?EiZcafOqSg7kO$ohMv!Cg9=>#;_AR6`UHjzRZOR7Tezp4L`8Lh9}F;pbzQLkna zTxD`KtcqU2nwSLL74k%KJ&zT6@ba`=$2)*+hHnOYfJYZ&_e{cYPH+sN>n11d6Vc9V zs&gn}b9OmwdOQ+Gi ziX9M&5r9bXMjH8%slddMX-Q{9q<}VCo!H&+!`Y44kLEF#P*}->He1DHQ2i=YkVq0$ z{rzsL}mh~Xx-EsVeP>2;7)gN4lVfbtUAcp9B|3-?VduH|1GgkXxyLMZ-FDAN zDgnqRMh1k30lGa8im0+w?_w`uc3h767=^uliK&5qK5zSSj4TgILjVsbBeL zUDmq#!l?HO4TF^#-{G*F@$Ze1i)5QjF#>~)a(_mRrhmr}abpU1y^bj{f#mlEa4&~H zYn>TYb$qHeS&~llrjM{PC9{adYhW4HXciZK(10k;aOg%eI{Stq( zU#iaZmEOqxOufC_h8Wki5wFdreND8Q2jD|uWX=(v<84i6vxuR4sG<(;wug7MS499i zu)WGu*8HP$MOCHR1xLciRO)~4nfq0)NNTJW`T1>i(w!qOeE(zyLJw`zVp7i#YmZ)3 zx9?FUO#(eA*+0oAmy0F@R0MQ9_RRyFG|6L09;r)ik!?o08l+}zua7cb8)QRs&4Men zJ14q~^EdpV$%@(py5P1I_EQ`!dYta^p%87a*4M9> z*wmj+c9jV%5<6|-9osf#doUYfyWpNL)K}w$4%OJtW}nwH{jpZ})ldXAotti6lOb?E zTNn-62U=iaj#8}^9L<$hv_q*9UTZlX*PfY6eDCQ?!=tLK3~A$IcYUfkG`-|XyvKo4 zL9*V6926(A3B$nRgv;P1N-gOhg5KjV0%m2;ucASxeA44A@FS}k`sXHE7Ta~iW5t4~ z=6X)W1L(a`pmev&ajH-E3EUWQGtOD{F5aTjcJ*F52dFFHT_QZhY&~Wbi9tiu&xZ2K zA0;eMa}@mb;%^v`(I%S7R@nZs@U?TD?AwFLC&XNJ1BUhR7sZmDacFbRuXN)VC019| z3Z%zX_NO1np=CyBXLV)tBdT8geK(g^n~7~+ zihZ2teg0s9oY&<1(SWGOojtW3}UlR+--Z&G|Zp|_B@$uKAH#Fwt6A-U( zpk$bO510B(`R(~fV=eFRA4`eua2Kmr7;laT`4&C4Cykf$$G6QNpgrNL z8(jY*q3B+146q`pRY%qNho(F7$(JrsV<<#uEB{$_Z0{TCrc-9z+KT8#qR~yv>`-ut z9x8n)aDfj%i+q#4tcO{P{l}|(@^73-yJdur+&eK!n*AJJMlVqMFl*FXTw40Tuckj_ zK;T&J-!bfvyf#zY?OVNG>d#}$ble^RuIwif1|o0}F?N=f+4M5$xGR&i!0>if>5yQ( zoE0U<#4Vo7o-Ozr<#w3%L{uo#fITp2=_S^5qD^o;h6Ay5avm_sgPJ^MaTHP=i;CMT z7in#3fwmb}zR7)%E04WSC*nR>=46r&IyoNqEOC4b<5iTlH|6LQRB8SwR>@beH4LfJ zd_cxczrOOm37i!#UGHjqi(Y*u@^-0~KUaBrs#qvYu zASu)8OM2hyOdvG0jq*O_ERPqaZ@kprSY>*?X#;moU7h7M`&xD;dH8#5cz?x-Hr@O1 z>?l%8@PJW1gykg6`flLnl1Mx=y(LI5+Fhryi6u&`XyHEtT8fTTs<(0UQxHdl&r1L^ zCOd?k#Rvo~&q{(}7#p_09o9}AlfKlH!ZO~%wK&ngOU8|ZxWMY1jX%@x&a5(f)F1LY z&0aNuH60DoN3C3sD(gi8gagO|CKR4K8u4jPFH70i%XLq?Ys#p`)^kePg{xNL;~8uT z&OWOHW#||_VY}xQ4I&uTkz3J0Ec&98DF}bwJMLKSil5qOJ_t1wdQK5+_c@AQRj&h? zjBC<8Jn-PuQsX(I*uOj>eXr_09dUul|4a6dqW2*9hxzHjt``n^999q#vdbtQYAFa} zzQ*s07xo62&#sV4;^@5|n_vkJsYzc2Vw2^hZN_cc#}{HdiW&+|j`yWw6w(qCyj0~f zA%#6J++PahC}UKH^;!;ylSKENUG99W++%3-z5IaM=;=f!?~)4hp7nYUo0=j3U+)4; z%vzJRf5AYAW>thv-au#GMx6%Jtt~g z1mN%QbANM|tqQQn&30A^BRU)U;?b{m%wGCEk_3c428zmO=<#Q~B%skBhro zy_Uz`cWM>WAk!4F+}!W~VWlM3dkuzP#hJSzuJyXrDni%bN9h_u%O;ZU6bq$3RzwF> z4VN&N>>s<|dsWHU`j4||vovhUIFt9RM2QjoNJKwYzXvzFE{(QFSZ-)Zg4fRs#ZeW( za1~GgB!v+qFSy1oX*gm==7`N_*-_RlFOK|}`3S?J2liphLlb}t@^By%Fpe>m@O_o4 zk*X=t%>!qJ3#(tOPB+XY?%YwtvWh81I)c_|{`4hMTbo`e>b!LGIREf~a31h^n+mi2e$0$)AE6p~ z@gp!PG_s_*aB4>2-3@t%cMm!)b$8~d!g9*NwI?s}Y|8!YG3)t2o-pIj_(B+MXEwdx z-w2Jy&jk9-emXfN<5E{KEoOTx^-eoySzdvQ+WJnbr@6%-ScXpYLa-#=jFmUAeq?T% z0}G3`1D#ADOpuO27c;JmHQI?MT^p7ZP9IHd>O}gKV&KZVnB90&EOmd~SUECFa$OJg z=+oe!FHBp8v(uB6?N?7NbEzy3NA&KvlCsNdsiYw9^55~cw&=gSMEYa;Sm|j-z@{XN zwITC+*MU+go-^r5p?TTGHaTA6n+S2Uj{c zODYW>(cgne(;zQnZC?OV*jtZuMoNzP9)naY60%Y;{1utzzb%%=8Bg@L?ym6o!Js2m z$45Sxk38I7%ENUA9_s_^rL+2tLbZIttab2N4zW&SpQp+~MZjxj7JgjiDLp|Hq@=)s zGI>(-G5SmODgkkWzt#O{Tth+|HKA(OiFx;~Q|NJtClTy%Mh_QT{T-ZMS)TV=FBsJj zT}$?1nk;qO$oK5m3Kpr{-s#lE4!pVtC)9}QoEE1}%EY)f;V0I;YXEg@y#Cg0s>!c_ zr6?q|XL%xcrb*S17H14XCwuA@uwV77JMNqOhO~RZN5ZN(DVeFayy(8HH<=gup={B= zs7Eqe91!eYy((yLuNlF`0l6`wYT*YkF~nnP-UJ` zEqZv^-A}+lP~fd=5+Y=krx!S1_Gb8=N4l@ZH4l3|jbQ2Q>OApI zEcww{W`d4u4qbXaRg{9YcPS~GR(^Zj;zUHDS@qh)AD^nx^4VLfwfByQhV!nJrWE*R=MxI@721yKUV(e=V~vEbO$Xt8JS)F z9UViwU?ZSx>_v>$M|y*#NCsT#HvAH0d-KiT7XG4{i2Xi~ENA)SN&M}nIU4uoQmPfA zijpvP8703)qs`r#6>hZ9omA)iGX6E?D~;W$Gm|N8(oxhG5}Tb0#*@?(h$n%7sCPu` zK~BH-=htERFRbg9^;}-!=}no!Gw`tk8L|lxCU;VFxi!)x=tn-Sce*)17W*^u_~7;R zJeuQaWm&9Oo(E$DmS>iS8GiVmDO^aaUYzLN)oVVp0?Nd;O-?mr1TMR-6J}4b5`oSh z3@`T{V%YIK>-z$<#aCZ8-x|yul<6TJhm9GaDmu=6o=@uf`Htz7#E}NVif!U?S!l-A zvO9hG)3ptt!`RbyI;iwmY(P7RpGhM{S+cQBm+iS#_TO%rI#|Z6-$P4i>Gag}ck59e zx83XS(mctn!2oq`i%agD3oSgo(CPbVYSomFkP6-X2fniK9}vOdx-+guL`X1Lt-d|j zBrC;RZ>6utQ0OY^+Ox`>PIP*Cctz318@_oSi!hp*h?0XQCaI+I zqbx3U+jeTC{dio9K<742OO8t|uTPVG5RQfNnL$_}%*au*m=TZWK zA{dlYTpiCi5E0}R%F3rc`XjPC&&_RJpwByxzH5f;%nCoinm78o027is+o4IVT>P`i zhnQ76zhh(B5~l++&n!s}>=!y*mF$wdH=vqa$TcXfH#;F!YmgV>5>vxlXykrX6<}Cf zE&N*tX@B<9fPxAX*06v3OnIjGCC)~>;gTKi%P0R(qkfO%gl_4FHvpkt1LYwhF!3|u7QG^CO;>L zO~dLghM(;~_`aT8%NN__9jNIfBLBw z;>_=>ms(sY4bXP&H8XF@DZhzmrdWl zkXpH}i#o@6+iTj-&jX5!bC^*1-i@BAYhqIU)HRl-OT!s2Y>KKapkiC0pq`JyQZD^Y zxeEdm;G{u8fh$NSKZ?gzL{=M^Y)0rUoCv9`ut5p2|#vbXu`6GNxSV{_rDn;+Zp?epCznum3K$nD=HlgRxr zDzRmuB!0VX$Zv9ly#l#IKgnLN#&Y-i7{1N541xn4yV=JLQqDDJPE^DPh^_AaaX!+E z6AQ+03gX)-d995gb^}y4Huc3~MuPRftsUNt0V$Kyjd)Z8!*b+%WLgQ-kyf|vxY34* zuuf&>mBU=cS-gX6Yd6s~PK2HkcbQ_FYN8-%c7DOe7@Tq<-~3nYpJEBTm@9$g!Zg0k zpC=LIevLNVA&(1tj?q%%{0m4k1dl1YjjK@6qc=Ba!KD}j#ZIy0ZKyE?BC^+jv=Lv= zAzh*7j~qUN%$ai08Eh(WL*w~7X;G`QZ6Ex@!kbrL!ffK(lfOkTYT(<+ij8}^Qc}+I zx?}avR}(~Fe;*>|VVF1c;?sn64R%8W@75TZYIbc`&~tr>$KA%E#x$7x*KE`L)4)8# z|871-4PnOZ$L;P~+@vBS>)k@I5g0lgN57Xlu1t`m>hOLD_W3E)89kCeOj~S&Z@vtQ z7-TUWKlR^Z4XFQi5m!cVux=?(2QAY9R=mY2(r)S#^MaEpjeb_s8O@~(aW5Iz6WJJ1 zcjhV=UIJYj7L8JZzca0!QO7rFQ#ek58&_jK+xK3&ZjTRy7F?{SD4VN zJjdG~4Z#t-x!BE^0?$;f?tbA&dV@-SrpqQqNBt7O9QZ)|6e|fhJ1;KlbH;%-r4QyN zACX{cXi;+Nt=7gZkc@RWw-mUW*2m-lMx`=sl3g&rFLT@N6Agu{>rVbVwH(*7P{|kF zCiPaMJyCv>=fuB7bf}6lLS`C-jaV_tDVS``V7m%tZS4}Lami1dsL$>5<>;LsA6y)%@ zqK&!3H;~XO#`!ERs7HlnOn}h}yC;GCNXu?xTc9?_xY~52-=D~0F-Fw;VmLS9v86ud zV;%5`*c1Lbc8$(z!D@lQ;@L^mi~@}E%-Yc=X*P`x=j!37j>P zSZ{IKh?Zmvpif;uO#LLq)aB+uR#eTCB=Ks1OVF@VE06|R^3kmogb7b8#*3?pm(TD0 z#iM(~&SSa7iLB#8{M1V)hjJ07!zT4CYt4+k#O7{Zj{+RlB&*k#X-B#B zbU9>o3HI&bL0z^(iCLwO3COBqjKxIO57p6P$Hk*ofa6@nTWixd%MK>-5}&y$K0Cc0 zWQ!i3qsNFQd8f!S``aSBG8;Aj?n$m;Q#I7oD%h1%iwTiyxD(9H#F8f!QHmEVphdgQ z*82&T7Z#dz`>EqEBRP)$KA&R+tkib$Z#iiTp(nWzw6AayI!KDFLn@V&zkd|RvH>Ju zc6ToX%lSf5jVQ|Z5UzUj!ve_+a>Kc_a=O{}pzpW=dtqLoA`1urOvioIcJ)+M{`eB~5sdILNzsN;VIi z?gRf6gRl!>!C$$f1t)-zN0NL~WW6^4o*pWogw)^3C(b3HSz!4K%f3n45qPeMdEPNmOVN->^5MvE0qdaod+(X#Bt7j(^?L;ZK zhbqPZI5eoF2L+ zeimi0YmIHwyI=d>@uZnS^AcEXye!3119FnqmX@^(^rlSW$ExbnVKme8A zd`jRL5K*A?d&+KaG(Vovji5lV`l*cc#Lk1v8k-3ZGZ&G`7po{AW{FvRlo_tt6`}n&&6XqF+>3)eoHU)4eYtWPlu)y|M&=y^cpsH(Ai=uBsR!$YcAH6I3 zZp(wFS0xFsW<9pU$xh?|@Q0#l->6=Sud#Tcz)3*GP$quW=@5S6Q3R2#<$ zub-c~9i?L|2JE*}xd=*lf}I+=VM7K8(NzN_?hX@ERmj>Sq(9)=T!OJ@Yp+-6D@lT|1H76m`1KFCGK|9M1&_erkb{?K#J@(!8}~ z%XB_7+`8e+^>aw=-v-dxLfTcml|px!F3V5X>5&kobov?d9CXa z9hNq`Awi+ukip+gqR||J9RLB8GCm+kMWJlmb0^)Ht#nDES-{(S@KP%@^2Xol{ZgY1=DK4S4VglL zf4_74roE^+cG=mOxnefo@2z-OIqcI(jW*jD1wCs5sIR{yv~q;=vpOGJStH90pYm|_ zt>dmQi?viKqnV5i4Q!ISE`_Z=%zaL)e!Pc)|6!@khsqasU{}<*B-z|T(EG?_O5v1j z>E+SFsmii;zo1|^h>@FuB(H0Oq`V8IMC5Hz3KW{l<_n;XjQ(ZjP+p>3C_TV`{+kje zD6d^8)$#v7{~fS__mw#U_lx7YveDMjMFq@c_`+!Z4FQ`kP^i1Rag^^i|M@|?i6c^e z6maT4e^m|n$=0t@&IPq~Oq7$@GKnpd*oqSWY+x&xQcmLkib+^*Ud)ktldDI$Fzy)& z5w`sMVmlh}?_1>GciS-k>&qKkzxww$wvOqaS!|gEm99KI{Rw> z8+8%;Z`9?>f1@rp{|j}g+4@zAiEJGcB$ E2T^^_YXATM literal 0 HcmV?d00001